From 89b1833b85616644e183b27b89c9dea0d9d14a42 Mon Sep 17 00:00:00 2001 From: tghosth Date: Sun, 1 Jun 2025 00:19:05 +0300 Subject: [PATCH 01/93] Update translation status --- CONTRIBUTING.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index dc13671a78..5bc2c17dcf 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -106,7 +106,7 @@ If you are interested in creating a translation, here are some pointers for how * Please first of all search the repository to see if there is already a translation for your proposed language. We currently have completed or in-progress translations in the following languages (but please search anyway in case this list is superseded!): * In-progress - * None + * Turkish, see [#3171](https://github.com/OWASP/ASVS/issues/3171) * v5.0.0 * None * If the language you are interested in appears, it would be great if you could reach out to the translator to see if you can help them. From 3081c09d72a674caa9456369f1ba0e8e5d976612 Mon Sep 17 00:00:00 2001 From: tghosth Date: Sun, 1 Jun 2025 00:19:34 +0300 Subject: [PATCH 02/93] Update contributor details to resolve #3170 --- 5.0/en/0x94-Appendix-E_Contributors.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/5.0/en/0x94-Appendix-E_Contributors.md b/5.0/en/0x94-Appendix-E_Contributors.md index 9c8ee5d9f7..44d2436627 100644 --- a/5.0/en/0x94-Appendix-E_Contributors.md +++ b/5.0/en/0x94-Appendix-E_Contributors.md @@ -20,7 +20,7 @@ If you are aware of any mistakes or would like your name to appear differently, | Roel Storms ([roelstorms](https://github.com/roelstorms)) | Jeroen Willemsen ([commjoen](https://github.com/commjoen)) | [anonymous-31](https://github.com/anonymous-31) | Kamran Saifullah ([deFr0ggy](https://github.com/deFr0ggy)) | | Steve Springett ([stevespringett](https://github.com/stevespringett)) | Spyros ([northdpole](https://github.com/northdpole)) | Hans Herrera ([hansphp](https://github.com/hansphp)) | [Marx314](https://github.com/Marx314) | | [CarlosAllendes](https://github.com/CarlosAllendes) | Yonah Russ ([yruss972](https://github.com/yruss972)) | Sander Maijers ([sanmai-NL](https://github.com/sanmai-NL)) | Luboš Bretschneider ([bretik](https://github.com/bretik)) | -| Eva Sarafianou ([esarafianou](https://github.com/esarafianou)) | [ataseren](https://github.com/ataseren) | Steve Thomas ([Sc00bz](https://github.com/Sc00bz)) | Dominique RIGHETTO ([righettod](https://github.com/righettod)) | +| Eva Sarafianou ([esarafianou](https://github.com/esarafianou)) | Ata Seren [ataseren](https://github.com/ataseren) | Steve Thomas ([Sc00bz](https://github.com/Sc00bz)) | Dominique RIGHETTO ([righettod](https://github.com/righettod)) | | Steven van der Baan ([svdb-ncc](https://github.com/svdb-ncc)) | Michael Vacarella ([Aif4thah](https://github.com/Aif4thah)) | Tonimir Kisasondi ([tkisason](https://github.com/tkisason)) | Stefan Streichsbier ([streichsbaer](https://github.com/streichsbaer)) | | [hi-unc1e](https://github.com/hi-unc1e) | sb3k ([starbuck3000](https://github.com/starbuck3000)) | [mario-platt](https://github.com/mario-platt) | Devdatta Akhawe ([devd](https://github.com/devd)) | | Michael Gissing ([scolytus](https://github.com/scolytus)) | Jet Anderson ([thatsjet](https://github.com/thatsjet)) | Dave Wichers ([davewichers](https://github.com/davewichers)) | Jonny Schnittger ([JonnySchnittger](https://github.com/JonnySchnittger)) | From 7f0beba9aef73c3bccbaedcb5da092d14ef041fc Mon Sep 17 00:00:00 2001 From: Elar Lang <47597707+elarlang@users.noreply.github.com> Date: Mon, 2 Jun 2025 22:34:31 +0300 Subject: [PATCH 03/93] translations in progress (#3175) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * translations in progress * Not often I get to nitpick @elarlang 😂😂😂 --------- Co-authored-by: Josh Grossman --- CONTRIBUTING.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 5bc2c17dcf..aaf9131bb8 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -107,6 +107,8 @@ If you are interested in creating a translation, here are some pointers for how * Please first of all search the repository to see if there is already a translation for your proposed language. We currently have completed or in-progress translations in the following languages (but please search anyway in case this list is superseded!): * In-progress * Turkish, see [#3171](https://github.com/OWASP/ASVS/issues/3171) + * Persian (Farsi), [#3172](https://github.com/OWASP/ASVS/issues/3172) + * Ukrainian, see [#3174](https://github.com/OWASP/ASVS/issues/3174) * v5.0.0 * None * If the language you are interested in appears, it would be great if you could reach out to the translator to see if you can help them. From 817d521a418c2210670f4571ce2872fc3b58490c Mon Sep 17 00:00:00 2001 From: Elar Lang <47597707+elarlang@users.noreply.github.com> Date: Mon, 2 Jun 2025 22:35:30 +0300 Subject: [PATCH 04/93] mapping correction (#3176) Co-authored-by: Elar Lang --- 5.0/mappings/README.md | 2 +- 5.0/mappings/mapping_v4.0.3_to_v5.0.0.yml | 2 +- 5.0/mappings/mapping_v5.0.0_to_v4.0.3.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/5.0/mappings/README.md b/5.0/mappings/README.md index 634a2b4fae..380067cb3e 100644 --- a/5.0/mappings/README.md +++ b/5.0/mappings/README.md @@ -2,7 +2,7 @@ Versions: -* v4.0.3 - latest v4 ralease +* v4.0.3 - latest v4 release * v5.0.be - "bleeding edge" version for v5.0 development, where all v4.0 structure and numbers were kept directly or as placeholders * v5.0 - v5.0 after re-structuring and re-numbering everything diff --git a/5.0/mappings/mapping_v4.0.3_to_v5.0.0.yml b/5.0/mappings/mapping_v4.0.3_to_v5.0.0.yml index 23295636a2..09b7365163 100644 --- a/5.0/mappings/mapping_v4.0.3_to_v5.0.0.yml +++ b/5.0/mappings/mapping_v4.0.3_to_v5.0.0.yml @@ -90,7 +90,7 @@ v4.0.3-2.1.5: v4.0.3-2.1.6: tag-v5.0.0: MOVED TO v5.0.0-6.2.3 v4.0.3-2.1.7: - tag-v5.0.0: MODIFIED, MOVED TO v5.0.0-6.2.4, SPLIT TO v5.0.0-6.2.12 + tag-v5.0.0: MODIFIED, MOVED TO v5.0.0-6.2.4, SPLIT TO v5.0.0-6.2.10, v5.0.0-6.2.12 v4.0.3-2.1.8: tag-v5.0.0: DELETED, INSUFFICIENT IMPACT v4.0.3-2.1.9: diff --git a/5.0/mappings/mapping_v5.0.0_to_v4.0.3.yml b/5.0/mappings/mapping_v5.0.0_to_v4.0.3.yml index f3502aeb22..faaf261dc7 100644 --- a/5.0/mappings/mapping_v5.0.0_to_v4.0.3.yml +++ b/5.0/mappings/mapping_v5.0.0_to_v4.0.3.yml @@ -20,7 +20,7 @@ v5.0.0-6.2.4: v5.0.0-6.2.5: tag-v4.0.3: GRAMMAR, MOVED FROM v4.0.3-2.1.9 v5.0.0-6.2.10: - tag-v4.0.3: MODIFIED, MOVED FROM v4.0.3-2.1.10 + tag-v4.0.3: MODIFIED, MOVED FROM v4.0.3-2.1.10, SPLIT FROM v4.0.3-2.1.7 v5.0.0-6.2.7: tag-v4.0.3: MOVED FROM v4.0.3-2.1.11 v5.0.0-6.2.6: From 2f74b4605d7de7393fb82811119a9d1044141ff4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E7=90=B4=E6=A2=A8=E6=A2=A8OvO?= <24567775+qinlili23333@users.noreply.github.com> Date: Tue, 3 Jun 2025 14:07:55 +1000 Subject: [PATCH 05/93] Fix folder name forgotten to change --- CONTRIBUTING.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index aaf9131bb8..10af41456f 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -113,7 +113,7 @@ If you are interested in creating a translation, here are some pointers for how * None * If the language you are interested in appears, it would be great if you could reach out to the translator to see if you can help them. * Often there is work to do in creating markdown files or updating the translation to keep it up to date with latest changes. -* We would request that you base your translation on the 4.0/en folder in the v5.0.0 branch as this is now static at the 5.0.0 version. +* We would request that you base your translation on the 5.0/en folder in the v5.0.0 branch as this is now static at the 5.0.0 version. * In order to start a translation, please start by forking the ASVS repository. * Take a copy of the /en folder and rename it to the 2 character language code which will be used for the translation. * You can then edit the markdown files to include your translation rather than the original English. From 36438d9de113411a7d900b37026d524a284b7a40 Mon Sep 17 00:00:00 2001 From: Gabriel Corona Date: Mon, 2 Jun 2025 22:34:24 +0200 Subject: [PATCH 06/93] Change factorisation -> factorization (US spelling) --- 5.0/en/0x92-Appendix-C_Cryptography.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/5.0/en/0x92-Appendix-C_Cryptography.md b/5.0/en/0x92-Appendix-C_Cryptography.md index bef9421a93..0fe3341f0d 100644 --- a/5.0/en/0x92-Appendix-C_Cryptography.md +++ b/5.0/en/0x92-Appendix-C_Cryptography.md @@ -27,7 +27,7 @@ It is important to ensure that all cryptographic assets, such as algorithms, key The relative security strengths for various cryptographic systems are in this table (from [NIST SP 800-57 Part 1](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final), p.71): -| Security Strength | Symmetric Key Algorithms | Finite Field | Integer Factorisation | Elliptic Curve | +| Security Strength | Symmetric Key Algorithms | Finite Field | Integer Factorization | Elliptic Curve | |--|--|--|--|--| | <= 80 | 2TDEA | L = 1024
N = 160 | k = 1024 | f = 160-223 | | 112 | 3TDEA | L = 2048
N = 224 | k = 2048 | f = 224-255 | @@ -38,7 +38,7 @@ The relative security strengths for various cryptographic systems are in this ta Example of applications: * Finite Field Cryptography: DSA, FFDH, MQV -* Integer Factorisation Cryptography: RSA +* Integer Factorization Cryptography: RSA * Elliptic Curve Cryptography: ECDSA, EdDSA, ECDH, MQV Note: that this section assumes that no quantum computer exists; if such a computer would exist, the estimates for the last 3 columns would be no longer valid. From 5081e45a88b2f44d7cbbcb36a39ae8961e5fd832 Mon Sep 17 00:00:00 2001 From: ff00ff-security <195214694+ff00ff-security@users.noreply.github.com> Date: Tue, 3 Jun 2025 11:37:44 +0100 Subject: [PATCH 07/93] Update 0x03-What-is-the-ASVS.md correcting spelling error Updating the wording to correct a spelling error. --- 5.0/en/0x03-What-is-the-ASVS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/5.0/en/0x03-What-is-the-ASVS.md b/5.0/en/0x03-What-is-the-ASVS.md index 925ecb33b6..5190b66815 100644 --- a/5.0/en/0x03-What-is-the-ASVS.md +++ b/5.0/en/0x03-What-is-the-ASVS.md @@ -174,7 +174,7 @@ One of the more common uses for the Application Security Verification Standard i ### As a Specialized Secure Coding Reference -The ASVS can be used as a basis for preparing a secure coding reference during application development, helping developers to make sure that they keep security in mind when they build software. Whilst the ASVS can be the base, prganizations should prepare their own specific guidance which is clear and unified and ideally be prepared based on guidance from security engineers or security architects. As an extension to this, organizations are encouraged wherever possible to prepare approved security mechanisms and libraries that can be referenced in the guidance and used by developers. +The ASVS can be used as a basis for preparing a secure coding reference during application development, helping developers to make sure that they keep security in mind when they build software. Whilst the ASVS can be the base, organizations should prepare their own specific guidance which is clear and unified and ideally be prepared based on guidance from security engineers or security architects. As an extension to this, organizations are encouraged wherever possible to prepare approved security mechanisms and libraries that can be referenced in the guidance and used by developers. ### As a Guide for Automated Unit and Integration Tests From 5d09af2a677bb11e6b25bfe3343e9ba24dddc188 Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Tue, 3 Jun 2025 18:49:01 +0300 Subject: [PATCH 08/93] Add Portuguese to in progress translations, see #3182 --- CONTRIBUTING.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 10af41456f..3f77f1e9ea 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -109,6 +109,7 @@ If you are interested in creating a translation, here are some pointers for how * Turkish, see [#3171](https://github.com/OWASP/ASVS/issues/3171) * Persian (Farsi), [#3172](https://github.com/OWASP/ASVS/issues/3172) * Ukrainian, see [#3174](https://github.com/OWASP/ASVS/issues/3174) + * Portuguese, see [#3182](https://github.com/OWASP/ASVS/issues/3182) * v5.0.0 * None * If the language you are interested in appears, it would be great if you could reach out to the translator to see if you can help them. From 378edd0e8f6280a88d91ff78d39820cfd7fbcd4b Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Tue, 3 Jun 2025 19:10:26 +0300 Subject: [PATCH 09/93] Add spellchecker (#3181) * Add rough draft of spellchecker * Finalize spellchecker * Cover more files --- .github/workflows/config/cspell.json | 18 ++++ .github/workflows/config/local-custom.txt | 92 +++++++++++++++++++++ .github/workflows/spell-check.yml | 54 ++++++++++++ 4.0/en/0x90-Appendix-A_Glossary.md | 2 +- 5.0/en/0x03-What-is-the-ASVS.md | 2 +- 5.0/en/0x04-Assessment_and_Certification.md | 6 +- 5.0/en/0x90-Appendix-A_Glossary.md | 4 +- 5.0/en/0x92-Appendix-C_Cryptography.md | 4 +- COMPILING.md | 2 +- CONTRIBUTING.md | 2 +- README.md | 2 +- SUPPORTERS.md | 4 +- 12 files changed, 178 insertions(+), 14 deletions(-) create mode 100644 .github/workflows/config/cspell.json create mode 100644 .github/workflows/config/local-custom.txt create mode 100644 .github/workflows/spell-check.yml diff --git a/.github/workflows/config/cspell.json b/.github/workflows/config/cspell.json new file mode 100644 index 0000000000..7685269ee2 --- /dev/null +++ b/.github/workflows/config/cspell.json @@ -0,0 +1,18 @@ +{ + "version": "0.2", + "ignorePaths": [ + "**/0x94-Appendix-E_Contributors.md", + "**/LICENSE.md", + "**/SUPPORTERS.md" + ], + "dictionaries": [ + "en_US", + "local-custom" + ], + "dictionaryDefinitions": [ + { + "name": "local-custom", + "path": "local-custom.txt" + } + ] +} diff --git a/.github/workflows/config/local-custom.txt b/.github/workflows/config/local-custom.txt new file mode 100644 index 0000000000..cf2fb5e948 --- /dev/null +++ b/.github/workflows/config/local-custom.txt @@ -0,0 +1,92 @@ +asvs +ASVS +Elar +Grossman +Manico +Ahnoff +Andalis +Jacquot +Shanni +Prutchi +Iman +Sharafaldin +Yardeni +Sjoerd +Langkemper +Sandro +Gauci +Boberski +Wichers +frontends +metacharacters +scriptable +JNDI +Tsai +exfiltration +HSTS +nosniff +CORB +Referer +tabnabbing +safelisted +hostnames +XSSI +Subresource +NSAPI +Silverlight +NACL +codenames +IDAS +CSPRNG +TOTP +PSTN +CISA +POLP +IDOR +BOPLA +PKCE +backchannel +ciba +FAPI +CHACHA +PKCS +HMAC +Diffie +ECDH +cryptosystem +FIPS +OCSP +Saft +sandboxing +TOCTOU +livelocks +SIEMs +SIEM +Multipoint +Datagram +DTLS +SRTP +CRNG +RTCP +SRTCP +SDLC +SAMM +Cryptobom +TDEA +FFDH +urandom +DRBG +getentropy +codebook +HKDF +secp +MODP +ffdhe +KMAC +CMAC +GMAC +RSSA +mlkem +backdoors +documentbuilder +creativecommons \ No newline at end of file diff --git a/.github/workflows/spell-check.yml b/.github/workflows/spell-check.yml new file mode 100644 index 0000000000..56da2e3019 --- /dev/null +++ b/.github/workflows/spell-check.yml @@ -0,0 +1,54 @@ +name: Spell Check Markdown + +on: + push: + branches: + - main + paths: + - '**/*.md' + - '**/*.markdown' + pull_request: + branches: + - main + paths: + - '**/*.md' + - '**/*.markdown' + workflow_dispatch: + +jobs: + spellcheck: + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Set up Node.js + uses: actions/setup-node@v4 + with: + node-version: '20' + + - name: Install cspell + run: npm install -g cspell + + # cspell config is now in .github/workflows/config/cspell.json + + - name: Get changed files (PR only) + if: github.event_name == 'pull_request' + id: files + uses: tj-actions/changed-files@v46 + with: + files: | + 5.0/en/**/*.md + *.md + + - name: Run cspell on changed files (PR) + if: github.event_name == 'pull_request' && steps.files.outputs.any_changed == 'true' + run: | + for file in ${{ steps.files.outputs.all_changed_files }}; do + cspell --config .github/workflows/config/cspell.json --verbose "$file" + done + + - name: Run cspell on all markdown files (push to main or manual) + if: github.event_name != 'pull_request' + run: | + cspell --config .github/workflows/config/cspell.json "5.0/en/**/*.md" "*.md" diff --git a/4.0/en/0x90-Appendix-A_Glossary.md b/4.0/en/0x90-Appendix-A_Glossary.md index 890e57a1f6..acbbee3b14 100644 --- a/4.0/en/0x90-Appendix-A_Glossary.md +++ b/4.0/en/0x90-Appendix-A_Glossary.md @@ -33,7 +33,7 @@ - **Public Key Infrastructure** (PKI) - An arrangement that binds public keys with respective identities of entities. The binding is established through a process of registration and issuance of certificates at and by a certificate authority (CA). - **Public Switched Telephone Network** (PSTN) - The traditional telephone network including both fixed-line telephones and mobile telephones. - **Relying Party** (RP) - Generally an application which is relying on a user having authenticated against a separate authentication provider. The application is relying on some sort of token or set of signed assertions provided by that authentication provider to trust that the user is who they say they are. -- **Static application security testing** (SAST) - A set of technologies designed to analyze application source code, byte code and binaries for coding and design conditions that are indicative of security vulnerabilities. SAST solutions analyze an application from the “inside out” in a nonrunning state. +- **Static application security testing** (SAST) - A set of technologies designed to analyze application source code, byte code and binaries for coding and design conditions that are indicative of security vulnerabilities. SAST solutions analyze an application from the “inside out” in a non-running state. - **Software development lifecycle** (SDLC) - The step by step process by which software is developed going from the initial requirements to deployment and maintainance. - **Security Architecture** – An abstraction of an application's design that identifies and describes where and how security controls are used, and also identifies and describes the location and sensitivity of both user and application data. - **Security Configuration** – The runtime configuration of an application that affects how security controls are used. diff --git a/5.0/en/0x03-What-is-the-ASVS.md b/5.0/en/0x03-What-is-the-ASVS.md index 5190b66815..6ef8a213ac 100644 --- a/5.0/en/0x03-What-is-the-ASVS.md +++ b/5.0/en/0x03-What-is-the-ASVS.md @@ -170,7 +170,7 @@ The ASVS can be used to assess the security of an application and this is explor ### As Detailed Security Architecture Guidance -One of the more common uses for the Application Security Verification Standard is as a resource for security architects. There are limited resources available for how to build a secure application archiecture, especially with modern applications. ASVS can be used to fill in those gaps by allowing security architects to choose better controls for common problems, such as data protection patterns and input validation strategies. The architecture and documentation requirements will be particularly useful for this. +One of the more common uses for the Application Security Verification Standard is as a resource for security architects. There are limited resources available for how to build a secure application architecture, especially with modern applications. ASVS can be used to fill in those gaps by allowing security architects to choose better controls for common problems, such as data protection patterns and input validation strategies. The architecture and documentation requirements will be particularly useful for this. ### As a Specialized Secure Coding Reference diff --git a/5.0/en/0x04-Assessment_and_Certification.md b/5.0/en/0x04-Assessment_and_Certification.md index da84e85661..eaf6392f70 100644 --- a/5.0/en/0x04-Assessment_and_Certification.md +++ b/5.0/en/0x04-Assessment_and_Certification.md @@ -8,11 +8,11 @@ Organizations may offer assurance services, provided they do not claim official ## How to Verify ASVS Compliance -The ASVS is deliberately not presciptive about exactly how to verify compliance at the level of a testing guide. However, it is important to highlight some key points. +The ASVS is deliberately not prescriptive about exactly how to verify compliance at the level of a testing guide. However, it is important to highlight some key points. ### Verification reporting -Traditional penetration testing reports issues “by exception,” only listing failures. However, an ASVS certification report should include scope, a summary of all requirements checked, the requirements where execptions were noted, and guidance on resolving issues. Some requirements may be non-applicable (e.g., session management in stateless APIs), and this must be noted in the report. +Traditional penetration testing reports issues “by exception,” only listing failures. However, an ASVS certification report should include scope, a summary of all requirements checked, the requirements where exceptions were noted, and guidance on resolving issues. Some requirements may be non-applicable (e.g., session management in stateless APIs), and this must be noted in the report. ### Scope of Verification @@ -32,7 +32,7 @@ The use of automation to verify ASVS requirements is a topic that is constantly When automated security testing tools such as Dynamic and Static Application Security Testing tools (DAST and SAST) are correctly implemented in the build pipeline, they may be able to identify some security issues that should never exist. However, without careful configuration and tuning they will not provide the required coverage and the level of noise will prevent real security issues from being identified and mitigated. -Whilst this may provide coverage of some of the more basic and straightforward technical requirements such as those relating to output encoding or sanitiation, it is critical to note that these tools will be unable entirely to verify many of the more complicated ASVS requirements or those that relate to business logic and access control. +Whilst this may provide coverage of some of the more basic and straightforward technical requirements such as those relating to output encoding or sanitization, it is critical to note that these tools will be unable entirely to verify many of the more complicated ASVS requirements or those that relate to business logic and access control. For less straightforward requirements, it is likely that automation can still be utilized but application specific verifications will need to be written to achieve this. These may be similar to unit and integration tests that the organization may already be using. It may therefore be possible to use this existing test automation infrastructure to write these ASVS specific tests. Whilst doing this will require short term investment, the long term benefits being able to continually verify these ASVS requirements will be significant. diff --git a/5.0/en/0x90-Appendix-A_Glossary.md b/5.0/en/0x90-Appendix-A_Glossary.md index 146baa7b95..f751b15d21 100644 --- a/5.0/en/0x90-Appendix-A_Glossary.md +++ b/5.0/en/0x90-Appendix-A_Glossary.md @@ -57,7 +57,7 @@ * **Self-Contained Token** – A token that encapsulates one or more attributes that do not rely on server-side state or other external storage. These tokens ensure the authenticity and integrity of their contained attributes, enabling secure, "stateless" information exchange across systems. Self-contained tokens are generally secured using cryptographic techniques, such as digital signatures or message authentication codes (MACs), to ensure the authenticity, integrity, and in some cases the confidentiality of its data. Common examples include SAML Assertions and JWTs. * **Server-side Request Forgery** (SSRF) – An attack that abuses functionality on the server to read or update internal resources. The attacker supplies or modifies a URL, which the code running on the server will read or submit data to. * **Session Description Protocol** (SDP) – A message format for setting up multimedia session (used for example in WebRTC). Defined in RFC 4566. -* **Session Identifier** or **Session ID** – A key which identifies a stateful session stored at the back end. Will be transfered to and from the client either as or inside a "Reference Token". +* **Session Identifier** or **Session ID** – A key which identifies a stateful session stored at the back end. Will be transferred to and from the client either as or inside a "Reference Token". * **Session Token** – A "catch-all" phrase used in this standard to refer to the token or value used in either stateless session mechanisms (which use a self-contained token) or stateful session mechanisms (which use a reference token). * **Session Traversal Utilities for NAT** (STUN) – A protocol used to assist NAT traversal in order to establish peer-to-peer communications. Defined in RFC 3489. * **Single-factor authenticator** – A mechanism to check that a user is authenticated. It should either be something you know (memorized secrets, passwords, passphrases, PINs), something you are (biometrics, fingerprint, face scans), or something you have (OTP tokens, a cryptographic device such as a smart card). @@ -68,7 +68,7 @@ * **SQL Injection** (SQLi) – A code injection technique used to attack data-driven applications, in which malicious SQL statements are inserted into an entry point. * **Stateful Session Mechanism** – In a stateful session mechanism, the application retains session state at the backend which typically corresponds to a session token, generated using a cryptographically secure pseudo-random number generator (CSPRNG), which is issued to the end user. * **Stateless Session Mechanism** – A stateless session mechanism will use a self-contained token which is passed to clients, and contains session information that is not necessarily stored within the service which then receives and validates the token. In reality, a service will need to have access to some session information (such as a JWT revocation list) in order to be able to enforce required security controls. -* **Static application security testing** (SAST) – A set of technologies designed to analyze application source code, byte code and binaries for coding and design conditions that are indicative of security vulnerabilities. SAST solutions analyze an application from the “inside out” in a nonrunning state. +* **Static application security testing** (SAST) – A set of technologies designed to analyze application source code, byte code and binaries for coding and design conditions that are indicative of security vulnerabilities. SAST solutions analyze an application from the “inside out” in a non-running state. * **Threat Modeling** – A technique consisting of developing increasingly refined security architectures to identify threat agents, security zones, security controls, and important technical and business assets. * **Time-of-check to time-of-use** (TOCTOU) – A situation where an application checks the state of a resource before using that resource, but the resource's state can be changed between the check and the use. This can invalidate the results of the check and cause a situation where the application performs invalid actions due to this state mismatch. * **Time based One-time Passwords** (TOTPs) - A method of generating an OTP where the current time acts as part of the algorithm to generate the password. diff --git a/5.0/en/0x92-Appendix-C_Cryptography.md b/5.0/en/0x92-Appendix-C_Cryptography.md index 0fe3341f0d..60f13a3270 100644 --- a/5.0/en/0x92-Appendix-C_Cryptography.md +++ b/5.0/en/0x92-Appendix-C_Cryptography.md @@ -5,7 +5,7 @@ The "Cryptography" chapter goes beyond simply defining best practices. It aims t This appendix defines the level of approval for different cryptographic mechanisms: * Approved (A) mechanisms can be used in applications. -* Legacy mechanisms (L) should not be used in applications but might still be used for compatibility with existing legacy applications or code onyly. While the usage of such these mechanisms is currently not considered to be a vulnerability in itself, they should be replaced by more secure and future-proof mechanisms as soon as possible. +* Legacy mechanisms (L) should not be used in applications but might still be used for compatibility with existing legacy applications or code only. While the usage of such these mechanisms is currently not considered to be a vulnerability in itself, they should be replaced by more secure and future-proof mechanisms as soon as possible. * Disallowed mechanisms (D) must not be used because they are currently considered broken or do not provide sufficient security. This list may be overridden in the context of a given application for various reasons including: @@ -153,7 +153,7 @@ The following table lists hash functions approved in general cryptographic use c * Approved hash functions provide strong collision resistance and are suitable for high-security applications. * Some of these algorithms offer strong resistance to attacks when used with proper cryptographic key management, and so are additionally approved for HMAC, KDF, and RBG functions. -* Hash function with less than 254 bit of output have insufficient collision resistancea and must not be used for digital signature or other applications requiring collision resistance. For other usages, they might be used for compatibility and verification ONLY with legacy systems but must not be used in new designs. +* Hash function with less than 254 bit of output have insufficient collision resistance and must not be used for digital signature or other applications requiring collision resistance. For other usages, they might be used for compatibility and verification ONLY with legacy systems but must not be used in new designs. | Hash function | Reference | Status | Restrictions | | -------------- | ------------------------------------------------------------- |--|--| diff --git a/COMPILING.md b/COMPILING.md index ae7e23cc53..59dc007975 100644 --- a/COMPILING.md +++ b/COMPILING.md @@ -14,7 +14,7 @@ Whilst the output scripts can also be run locally, this may not be currently sta **Note:** This method is still in testing and may or may not function depending on your environment and underlying Operating System. -Stabilising this is on our todo list but not a top priority. +Stabilizing this is on our todo list but not a top priority. ### Document Compilation Instructions 1. Install Docker on your computer (see instructions for different architectures [in the Docker docs](https://docs.docker.com/engine/install/)) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 3f77f1e9ea..ad418dd3ef 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -100,7 +100,7 @@ Tags in old (v4.0.3) mapping file: We are now keen to receive translations for v5.0.0 of ASVS! -Note that we are ONLY accepting translations based on markdown and not preformatted translations in Word or PDF format to make tracking and maintainance easier. +Note that we are ONLY accepting translations based on markdown and not preformatted translations in Word or PDF format to make tracking and maintenance easier. If you are interested in creating a translation, here are some pointers for how you can help us: diff --git a/README.md b/README.md index f6b39a0089..9a55b4fa5a 100644 --- a/README.md +++ b/README.md @@ -25,7 +25,7 @@ Originally launched in 2008 through a global community collaboration, the ASVS d Following the release of ASVS 4.0 in 2019 and its minor update (v4.0.3) in 2021, Version 5.0 represents a significant milestone—modernized to reflect the latest advances in software security. -We gratefully recognise the organizations who have supported the project either through significant time provision or financially on our "[Supporters](SUPPORTERS.md)" page! +We gratefully recognize the organizations who have supported the project either through significant time provision or financially on our "[Supporters](SUPPORTERS.md)" page! **Please [log issues](https://github.com/OWASP/ASVS/issues) if you find any bugs or if you have ideas. We may subsequently ask you to [open a pull request](https://github.com/OWASP/ASVS/pulls) based on the discussion in the issue. We are also actively looking for [translations of the 5.n branch](CONTRIBUTING.md#translations).** diff --git a/SUPPORTERS.md b/SUPPORTERS.md index 58107f5821..bfeee05838 100644 --- a/SUPPORTERS.md +++ b/SUPPORTERS.md @@ -7,9 +7,9 @@ ## Introduction -Within the ASVS project, we gratefully recognise the following organizations who support the OWASP Application Security Verification Standard project through monetary donations or allowing contributors to spend significant time working on the standard as part of their work with the organization. +Within the ASVS project, we gratefully recognize the following organizations who support the OWASP Application Security Verification Standard project through monetary donations or allowing contributors to spend significant time working on the standard as part of their work with the organization. -We recognise various tiers of support and the amount of time the supporter is recognised for depends on the supporter level. +We recognize various tiers of support and the amount of time the supporter is recognized for depends on the supporter level. On this page and the project web page, we will display the supporter's logo and link to their website and we will publicise via Social Media as well. From 174a9bd0eea593995297e183ce261698db69f046 Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Tue, 3 Jun 2025 21:47:21 +0300 Subject: [PATCH 10/93] Correct branch name.... (#3185) --- .github/workflows/spell-check.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/spell-check.yml b/.github/workflows/spell-check.yml index 56da2e3019..e3372cf3dd 100644 --- a/.github/workflows/spell-check.yml +++ b/.github/workflows/spell-check.yml @@ -3,13 +3,13 @@ name: Spell Check Markdown on: push: branches: - - main + - master paths: - '**/*.md' - '**/*.markdown' pull_request: branches: - - main + - master paths: - '**/*.md' - '**/*.markdown' From 68d4cc89b113073de6cd8a3d56317bd9ee7c5c59 Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Wed, 4 Jun 2025 09:32:44 +0300 Subject: [PATCH 11/93] Improve spellchecking on PR (#3186) --- .github/workflows/spell-check.yml | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/.github/workflows/spell-check.yml b/.github/workflows/spell-check.yml index e3372cf3dd..b1b5a6ab21 100644 --- a/.github/workflows/spell-check.yml +++ b/.github/workflows/spell-check.yml @@ -40,13 +40,25 @@ jobs: files: | 5.0/en/**/*.md *.md + separator: '\n' - name: Run cspell on changed files (PR) if: github.event_name == 'pull_request' && steps.files.outputs.any_changed == 'true' run: | - for file in ${{ steps.files.outputs.all_changed_files }}; do - cspell --config .github/workflows/config/cspell.json --verbose "$file" - done + # Convert literal '\n' to real newlines for safe file splitting + files_string="${{ steps.files.outputs.all_changed_files }}" + files_string="${files_string//\\n/$'\n'}" + files=() + while IFS= read -r file; do + [ -n "$file" ] && files+=("$file") + done <<< "$files_string" + # Exit early if no files to check + if [ ${#files[@]} -eq 0 ]; then + echo "No files to check." + exit 0 + fi + # Run cspell on all changed files; its exit code will control the workflow outcome + cspell --config .github/workflows/config/cspell.json "${files[@]}" - name: Run cspell on all markdown files (push to main or manual) if: github.event_name != 'pull_request' From 80d18cc4c1a05476b1426f6f7a50659515ae1b41 Mon Sep 17 00:00:00 2001 From: Elar Lang <47597707+elarlang@users.noreply.github.com> Date: Wed, 4 Jun 2025 21:05:55 +0300 Subject: [PATCH 12/93] rm pre-release note --- .github/ISSUE_TEMPLATE/standard-asvs-issue.md | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/standard-asvs-issue.md b/.github/ISSUE_TEMPLATE/standard-asvs-issue.md index 7608fd4391..b518b93a6c 100644 --- a/.github/ISSUE_TEMPLATE/standard-asvs-issue.md +++ b/.github/ISSUE_TEMPLATE/standard-asvs-issue.md @@ -7,18 +7,6 @@ assignees: '' --- zkF8qIbrXQLxq zclhPDQDk7sS!>d?(yMIh+Itumy8{0}QpI;K`seH$x!OIGQ+1R?u;gq?b6tp@iz-vb zYk2qGJH2qvl^45p$;O1j<@29hueV6pc&dz=%nN%QSxk#G?seaaYOv?8`o8w!RV(n8 zZ0tv0TH+!S99T&$-=5=CBMS$yiYLnJIUE7)cWni*?2ODLX;f4;mR5t&aS>EcJ{Dz{ znwPPpH_edP{XYB<-v{cjfbuzaDG9>Ji{!89EGmJ!9i2Uf0a0Zhlq07%+CG>=j0=lz z2A?2NV4jyf24AUr0OW(O-OoaK*v~Gi#DPvfsPsIbh;JW<_Gm#dlF}=aj5x|)K`t2z zrvX&id(XUqtQ(I|R8l||Qjw5Q6j?)aNl0Az`DqLljrU#n+Q;+A?}QQE4{z#EaAPU1 zS>wVzUWIYrXVH{F(b+zaHh8#2`vXk#Oz$cW#m$$s8G}IZ5FSQV=`|-@;9f4PI=v#) zVjkZG<_m9u4o|6d(ZU@t@q?jZY@FbV`?`YH<0pw^>HqBatgYmjiHc0n_Oaf!2f@Ru z`>PG&(^8CFFbPW+Zr0p;-Lj~PXU81s%>Aylw#v3mPFbv1WhP32U!PN*+h+c)Ls);x z`F)|T*mrFm_KJCg`y_59YsPtuJXV-!RhMy5*MvsOWcY-JG11pZ1;pV*^lD?q4{(W$ zV=R&RVKwq43N`$#`UH(y(WeizS07pv^W>dJJBOFFy2df{BvfM@7UEXvV9vKUu8|kM z1kr=`T!kEFI}q){5xtGPR^P%eoC4eB0}@FN%FTvNl}be@(iA-|W9@WO6LnTbjk2Wi z93k|C?uPQGAW1(F^3#>C?v&71!dym^=GEd#O9R>`9u2_q<-a%#m<$$f$2916-OrFQ!#uBH zwPMMkel_qhpI=a9r>v`Z5Sh=+14de6nO zg%l2vk<;PlomWQ^-R7>Ja>~mzVbot`hnLt7mHN0yt7JNL`W61$`0PI(K=(hCI{qKe z{LkFeb#2rqr%^dyP(g9B5>#I+rMr0cRip9+Z+ZJ-zS%<8ib}+tov0Qrp?WQnl7vJ_ zHpNs2jw$%IlA_OFztF$^c1+}*Vz?;MgkEi9&)B${nh&rrc$dG9M*EmX`d>+-OX~{H$J&jTAc+lRh}gYzkW$v80UgMUEDml zX72K+vt76f?z#`-bt5fk@W~a)xkaQIB=?;(!cM&)Zxm^e=IMJDoKg>>ip!N<{6GH) zrLW);mnCj4So-0V8#4V>PFR73wh&|FEz^BI7gOiPWT5LXC>1$QEv36Qkor6A(3AYS z5IeZ%xur}%YMu|do#w1U%I_CT!LGLKuR_U%$KAD;`m|C_Z;>6g@OMVt?s?Mo1$$nV zV=FWFd7-Y*XC78B9A$6Tz4wT|?7?DP!M3G*O(M6Y#a@EFTpDY;#h16Weq44sI&DmA zJe?>4-cCf%7>Ggyskdl(3+$s6?l3kL=njZNq9`CPS{Ty=UwG@=uw7r?3t8_@YE%k#^hB8 z^}8E6wr+%W>bA`%ZHeLbO?@sERm4SGw`^1lb(kFKi0Wpads6aeubZov&A}HX*kBi_ z^c{OzLd}aufvj=JsvOU zEMgFl{PI&m5dUeQ}q!3R(R2DcX3-5j*l09ZQcV13z*yfIBj|9CTDZe+9 z6_WdP(6O$lrJJ@TW#Ny>cC8=IjA|!(KJL#;?6J##)xp4bAe8%Rs=E^qeoW zzAMKwJKlU&y`*R(mBHf61Wejo57v0U?PP#@rCk4`OjutQ>&{QF-0sc%z%HQfz<4F< z_T1Vjs7VKt|A5ph%ToP^_q#d@AV4jer@%%B@;K+|ktnd(hJ$(yXu8_r7KUL}gddC? z5V796Dge4QYLeA6AeeGujn?gk-;8>1CyJV60gk@Apfv=b|WxzwA%EKFAXctFCkbn)_y!s`_mrMDd0SPi&N z5iqM)02sudaxXvjgo~he_t0bLAA&C(%kW*?3oe3e74S@L){v z#kGQ$F$=1#XsB?S29)o1eL-3+pg7%7Zvk$iN`40TVZ`2MrYG`7g?EUp8#yzQ zCwmVjJE7WH@%YA1fZRj|I!S*9TL>`l`eAX)2!;Cvq#)e&P+iD!gI>`P5ugFP+U){1 z5A@TlmS9XGH#R>PghV{A{eQVl+=KT-takznQi>$`qh@fw-RwfNAY;T~+6yS)BFqn7 zk}d-fzN5thi08mI_{!lk(D(5O`mP*`$gQxqHIDWX?Cb}va-~%96lX9|&aesiuR`l( z`Tm6@E|ctxqdm<8S=N_UZN#0^dCj@6m=7X71CTyHF0;+vgMawxQdKWGRi1b;i0w&J zozcs-VtZ{nm|W;8MvyyRD^N<~tS~ZO+oDb;&^(D5@+f8bN@I1NL8;8(ZFqSyTSX6% z9L}*$@5{Vbr-(0mGQ9yu!SYucZ`1yfbmYmWzVuX?mMn)_^xKm0gq{5}dv2yWWzD~S z(RRIPq$#~O$2plF_pRt^2U&k)MTyTr>)Cjw3KsF)&o~M`xI)PSKcpWvH$_}Aq|RmX z@1IFX(#h@@H5`7fYal6tQ#?=v#dmdsZTzGv!uB*=;Z+q!>BJR+0@Ig`s@IF{)yg$A zk+m%)Ws0~OE#)IC*3(A@p+x5X{Pv$wI&e?#%hsY2>@gqO54peaRj=A)#MYj%-F4*d zYAUkw0v1@|l=CB!SuO7I4?N>&m!>J~U0_k3wDlW~n%1wcH0+QEu@Cl;JMlsf8xxv3 zxc0Z@XF1UPoXwQZK6?4OS8i&2Uwctn@YwI>Tt_}gcwkwk)kOy6R}jLBmKfF%`pw|e zGw4kd?)#r6L_-m<7rO}zQHCH~=)dhjv0z+v*P|Er;_|Lv`~)NJ$to}u1?Ha-hh?ka z5eGkLsKyu%MEFDMQy7eX!_-3Or@vXtH^d`g2d5^h;HpuBU>pL^OIW7*$$euJ>;HQ2@SPe?OP%d#2> z-KyfA;1_lfQj7zac4PQD<$!5lc}`TT32)lj2ufGSD{`c2#}JdAec>|S2Ta-w~2mMfR&QEu2(5_IrAciXmE!GItFB1jMr zRANaSi55|coK

C4)dKNRT91vSbPQ3se<-0-rL8}bf29+9^>?{YRVzl>ZjvH%FC0n*%}FBow}E-}S^ z!-57Q=7p*OXyKFP#xvOdC7X_wYf39p>4R~OG0FI>n-49faG1n{GdgEXOs(DQE(<(< zJr!)eD|f+LO75!7{QGg6wW>%%y>-QD!M@>pnyK2KJ@-Vz?yY1mhn!{!ynw|@YjAUA zCNWvR(y%fo^+2m-752?cUz;)i#6FYepXS%tYB8Nz(r}P*Iv`?zdoOmQ64zGQqlKG^ z>8w_)*8l44c=|L(Y9*Jbs%Rv+yq_)nlk=sY?ns@FfAQB^KzAPM79Ox55_RxWz2 zP9v3lk9@E^L*g-R!^ptNTEM&k{b87*)?eyI^H&r$)40a(vRn=4f{U;jFMBo4F4gT@Z2~7ltr94naqvfwE zhF!R-7{Ypv`9_Z)6udtTDV46Z#Iu#URQgO*d}TSlG7+?|$`XIpG-^j^gGXW8g12LO z)irthwv>+hx{LPFh0yTUFn&SXm~qxsO>KtQqNz;O#(Okd*>3xb{#`EiBTu8fCJu04yos1-dv>Ekqm#&q2o|!zEoC-N)lnT__CfKNaA1H>A9(fzHs5X z4->7U+E$pl0M2UT%u@pnJLT`V&WK&bQCN2=m~L~?Mqeh_qTxf?22H;3#fS6T^}Z|O zlEIpq^hy@kn95>4Tbu4BS|Ufm6yXR{m$wRmEDgePl^qFgQBgW~Nz!eO*jORopLdt} zb!WnIg`N;Ul?<#v4(|)6$XvksnLP6%^slAaaIx~4Yfpyw) zjS}*1^%kT;W>@2PM6F5(%b!m6tWMu~|6C_#W8US63nd9KDb;I-h4HJ!8t-|ZRF3s4 zjjVDPU(=6#F!;qRyl=}fwc2!PS3{z_s<4}v&Ne~B~a7cFU$Sqip`XYpLiAW2)lon2luQ(;#)K^e5d z&*iMOe64UNU$S}Sz?4a3YATK5_OXObKIfzsTIH&_`FlbwK_xY`DL$7qY4X^}&6vqH zv^HlnNt}|Cr6j#W(|nv~Nkmg{;-ZgRu1#U?QYBc8G90L&KAEoCQi`dv+ADh`;>Yvm z{50EgL_M{?QyEi9oic4X^YdD;`}yYKlB_*Un3;OzUfvKpN+z? zH}%l6=xw-!+Uoz!Vd&SdF-o4cmR;Y-3sj=HT+#b@ReZk~XK7OEnr04-K)c|=%B>}9 zK2>wtZ>8RWQx$KjZ3-@6u4 zGv2UxhmMgh8Q!-86dW|TMs;76BsrsDclCrG9%j_{8>}B!FIiac@|^EWF~$hy!4ts`G`s4R1ghWSKZZS#;zQ3XwqMWY0CSs0mZA1(7LJ+?`c zO!S+ywau`YeZYE*K2L_h&E`DhyUFb<@j#WAjt$zqDrdZTK-_@rDpd~_k_0iOOzcIN zY%hVRk`;`kxBy~N8}#r#6Pws)&{w*5QYZWV3bt9K54ldM)`4g>VZ@H;DKTRxD)43O zrJ{-~P4`c-o=|{y00k$c!7>sl(2@u0+AN6Uf&m3`+%|s~GC7#Pe?FMfvGme_jxQQ| z!tkcQ_k_o6Wa5{eK`RW%D54`H0jX{nwhsf>9Qn%Ep-C(ZuVi;6JdB_;=?+ zh(+C8MR|)2rCj9JgZCz*c`1Z)K_4*C2kfmg6}C+yF@Rt}7%jZv*|VGXp%#9>3-1wkN-cpbMba(tRj!u&jaw$qry zuF||%){D_-vuH!$J4=6;fb({sK4tseT9(JTm*@9CO;Z#3QzrS<%kPWhA2=oVPv|*` zlRf@a%i+{m__0S^Qh~(iE{RiIszG|zJA6LJM&aOgy=?rIHCZYbxjPNU8@-0N*Q2{@ zb%*2x+van4$hSr_i_j#GaOf;9rHs!!ZLtG92h ztnQo_>~na(2o(GmIx*YZvqHPOZVrJfeH!lyQ^+%7m7e(((DA8;qi^(7(sIj$EvOr} z%ko#o7!EdGY3BAYE>c-m6zx_ohyq76Q@y3q1)2->*(^uuA@bkn$X@-vnr%i(; za86<+>Fkw>wB2zrj!(Or6bjk6q6(}Y`c^IY-)=cxrQ6EJF~MY}bz6zoE&SHToBOp~%<~^QJ7_wxU}(lO2YIe4SwvHFxz1q%ckd`~UQ>@zsk=-u zQ`a(Z<#s)ZbFO91xrsTm0n+Am`U|#E(&)J2Oa0m02Wd5M>Vt_l=QrwE;O7*em3~R%8L6M%*;Rba z(I7O1P8=(65)-EzXTX)Dl~AX@U;pux?7#aCw|^ak?!P;%zyI1@ zVw4(N&8?Zo-b3Wy>Ux;O9ua-4~vP)jh%_-^doWQQjR^jOic9j z(p8>%T$d->&Nr8oA6eD3akRQC*VHT3o_b(z^xpsY(hs`Ou!SY5Vsow~4j*OfS|$D> zd3AZ!ipyv&k;^gyalzk|5_6_98`x}y@)gpUx?|a_#loc3n+55bYhx6X%y~wz`f0Y^ zoAE_CPDd{)QI(AxH;*55s*^xp9LF0=wWb*#&k~$4CvSC7x$AJYjkI!@q4IQ4WoaU; zLeomQmT9u8lPCKb#ZeSM>UHVsOILGk)rmXbyQ)a@{YRKPb{v_-*B6q9>6YnoJLwbb zy<6B!oWRqdK)3%T6d0qO_o(so3Ev+)tLq{0rVa7nSMkO1WzgHBC+7mhn zZUK8C$&<*XqgRm~OxL9^L57?_CXc~y*2MRq4rq*|x=CW*gdVv0V(x%Av57HP6-=IN8po>`o z&&&`yQ+pCpV6Nz1Mu=y6D@YgYnIXY-!Mk@taWtkuq)Pck)%tlTAqIa9h8qicf*+Ab7E?ugHLbmjQJGg5_k;@jNwtrqd z;G&(xDURJM^SpE$kSr+dy4)l7kD*%vT8u69zl32gys+tU=yLAl5<_v$#ZUr_Bg`#f$2Je%l2qLZz-pdKnYyE00*+?a%FkrX5|? z*Ri&u_BqISpgWe^Gn#e@Su)i}V8Brlff09rH0DHutvM_?@{%5b=X!sT5id-#_vySE zY~eS75ZYjnSXy6}cPsh)G7GxIL<#Ln8Lg;X?6 zQ))#Z`*-Z5dIf7rRPFtYyk1mK*oll8$!5Ej`uJn|7sh{3;sYDf+RY~K^GWqi>%1wS z$S_^9cx1*|fBo-+$v@%aqyI`;)L%S);ukYQte@4QOxZKXU0EIurFYHJSafE}ziv^v zoS-RX@W%dfF2*WNNe)*hAKqz{s#k#3Uq?0f4W?^~)Rr1v($8<-NU@i=Bza(a^{b3^cZ5vJDfN_l;>o)7 zQj{}#jhCM4`{bzghp=P~UJh%C^m6bay5ZMpag~FO(a4`qjv>;jt83xH!!&&TJ*s+o zBZb@%{nJz0JN38`~v%iDgo z9N;|*ddgNq$q#{gKM>Yq2dkf-k1o&cgL1^HK9T>sz3Yj&`=H4nnA0>RKz@Ok&yrFt z5_T!%ECLZZ3DA#yy%#~;TlzzkLZTi@F;I47Ekf*FIgi}bTb~-~6A>6=o#umbcmQ}M z3f;G)=?1~ff?G0}x}sMg=O<{7i)=aeBYy6I(&h6cBSHj(3lo-Ey8l|l<4uSVF5vFy ztaO~${(Y16C2Bed{Q!?_=1%c^s?K?{W7maE5YIgkkhLKIvFe;cBl20S4fL{$Y8@{9v00Ch)6Tvhd!zHU1* z50SP)z(z~(jPL{^An0=fy~qwbyT4z#eg*`BInR1RGqRrn;?lKo7(>9GHYi>|eS<g=&+=clB zKrT0-e9-_?7Vswn*bT{s;h}VGyo=zt1N4$b3Bo(r^J?>gXnV4dl5Q!`S4M6LRNSB& zFLKK^5Tt@)_3Z=@7U0j0HHKorP2|T>pKeAwU9*~KN8gt(AX=tR{J-k)^ zguFdRGYr*}Vfu8Cj^Z0xLM4r{aO)c@b$Z^tD00qblKiod%jOj0OZ~naON{5HLVskN z_~%?zoWz$V?=x}6-@2Z|)ZFKHgGt~L(@v_cM>G5GKpd~;8%dJkd} z4wbQ%+$sZ&$HyFmn9vV74Ld)O&R3xbHoMGCfF8e!4jFc~@(tCWR&c0T6;S;?oT?OU?wqxl4k>J=X ziu;oK-W$3Z#LBLrr0->`3DC1#u;2o>1BRR+4fKV9>+VHRvT1<7@ptbjhVb7Zf>O|I zgI8n0?Fmg^JO2m-Qvi_;z;qJawQ9hIha~o?A*79^9I4U=^P2&wwrIqhJG4wqK5Kg5 z1JK%#JQTOvQ?}~Pa>!?MdJvGUi|Kc;s8|sauwM~WEu=l+siG(zJsWdyTtW(&?`ya& zSMY4)^CCdrT3$~w+K&M-72?}*@V#uX9UB#7RfDv(fXrg}6bGI<0m=T_5mRrP;E`+J zQ_UMU&@MI96wpXYu%e{MD<$NV@pU4ZYq1>AH(7#Sj!__j{Z-%{qWtvKiG@mL5dhW& zFkJ42MUEFm+#$y3A*oo}uv;F?K=pNzY#ufh;K41rMTAy!fFA^D@rOkx>R!ZkBQv0p z2~UoaH#>Q}Lkn*A0lAMn>+^7{N;P-#M@KQ`*MA@peei$Wq~emGXS`A^S)DYrt{S!yKW3zrN@S_K7& zSCA|p9yjN=ktQ6BfZ>}L3^yRCrdnEnhrwry7zlT*kj18Nx3N?l)Iq~fF*d@dJ|Ez) zgq(FZxoR9zYzW+-Vsy`t2KPK$H6*P0yH8=J2TYic1z?QegKEGFEZd7KFzaJm>xExu z`+6|^od}Y46h{7m7ajeVvoQYB!EVn8JQAlgkT`38ma(3hCl(*|-N>r= zjk<1cI+u5o<$MIyd;TGt`HeEE?5k1M`et}$4cUYSN~^-o?@PY0j3O^pAxb3vjJ!>k zeDJ#Ai7xrM4UNM{7~n|&|)1({3MIg5VeRJ6SoNKs=i0zf* z6aANa>Cp;)ytQrPx5>Y{>Q@ZT1OxiauZTR{+4=za+WnWz` z_qb7~#+q&rs-EUoBPpqLr#Gsy>|Q6%keRC#gCpsd$DMxd$q11INyR!6KLBaB;=p%3*B1~=!8O;u9&a>TgvgT#vJuE--SRdAN(H@6@lkgk z8{{40wTIdq%R5yUx$kEcaG0B7b*CbG8FlxF^0N+-fp=hd9AKItkKGgls0bm^tMEDo z9y`Eb>#3igYKwrliFoli5HDV)qfSEoTo%%3;J|G`d%dv)A!-4BZONt;>Dnu-P~94X ziz{sf73~G9m1Bv#48WwHv{N~pI>g4xKwUl|NKK63rvW6TBdeQXzDxD=5o`ikdeH&k z(PToEeRgaU(m+dCgfhQI#BNB=0SAmL$GUZXoi~S4#M>4<0wS3-T1wJG6gtRerrNxK zlm*p9|FD~^*eIM0q5g*K*_LAusY`&$vPiorE%M>p}3~EIsiadR0 zz5OED`FcMy>V1yuE13ybQ)k!Ya-YTrq!$#@{TP&wkPMqDz0oVCn4U8=cs=&*nhV?c zkA|<@eojgG`!+VL@6$R z?Uw4NBD7ifjdz0&J(9hHgK620+Fa3Oqd599?L~F>%UkqUtvqN*lCB7!62I%G{Oay2 zG<~9E!^PfAOr@F%o{_mbBs6(s$ZVu&w`jw3U!-F3F9oQ74V)`LpQW4oPD|ASTjmW&WLo(ag& zoO=BNS3702+4GEd6=#w#=Omdj&<1j>CH`U0RI8j~u)6!ErGS?`a!6#Kp-*`Im z>BD5+V4lYn&6W8_47;5VQ{6x2J zFUK>g@Xh#Ifow}pYCqJIl&>57g9Up1VYMo+G}o~y1xYp&`&VCE;m*MF_fz+=PuK@6 zff5WVKd9p7Ui4U+&V}Uuo^om+8Jg^g4ca{z_*Lhx6MAJJ@PmFS)a-WPM0qrZ2>v9F zKHq;0v6pb)12SzM7DT~ayG~c`;*O7Hjb9c7BHqPAq>3-1uY;6xb|jYFP6ct#Akg6= z*B4`uKJ5p&tbs<*$`r(Lu$|FGj?dm+2!r6zCfeuXx~X|Oz<}(Q_v6M?T+v)0A2JfO z&G%ga<}s^F(#+CAw9w$0;?EcDfSX1zN86wQ|FXD7baxfO4$r~-5jKV!ZovF;uiNMR z{Ci|I7Fd{3_zN)YJiiE-5a?vedGF<|0h0JDNE?O0iLDq5h+zWu2FWtvdE-L-_xrIp zAnOF9^i%=CTci0f>SP1EvL%NaB(A+q& zF2^cCH4?xM=q6GR!Th%NIXH3=K&2oP$n-_z6rVwGMxI;{(JVxEm`1+f%u z7-d5v2f7ci4&EL*7ViMvqq#i*o!mDIyc&qh2-@S(gz%llb`;4x^8mSshwOi2O2l(k z!3Bo3uuW>-39@1@X~;dhMRp^8UZs+=MsSD_O4njpk%lVLY==GU&@e3l2R9hFL6eBU zh%P`D4w<-f`0{(zvdjW!gVA62F{Rq+btxF!+DHF+>sfy9wMcY&m&e5zHEhb&haL;y z+8~dB>OPovPXBso~hfw&{KDtwQ_j6N* zgZdron7HPspdpE6F2dXresXA(C=o`qOH{`pT%-*@Jh*X z^S3cuM>_~L46FD|{P>ots}O}k?Swu$pyynFFKg_i;Iy#ps+#HYLo4|DUx-cr;7d;Y z*7dKW`TrxwdX~FwRMs?R>hY~i-U4}}t&u99Ug^74ByD-D(JyBx=$SQPg~rDgDNao9d6^0?YX@?s2%GnrKMeV1%Mi=BMoi51gQ3bihUa~H zm)TxTYnEg}zcI$UDCyIyY@&AywphJWSxm(BuLp3EcVk5GI2k-MKWQublDYgFr528p zybgnxtYUP;%gejf>+$rYQDw%_gX2~7O%9FMYpjHb`U4p08z1_sE8Xa0pX*zT(Hcid zc6m(RL^Fw{5Yv)uDkZP{AYOqHmIk7~fH6%us6GS;Sq*tTG+7a)HQ1h@W{1&4Hv~Ka zCnC-OSwREq`3Q=QvlAnK46cCN6%2+y!VGJpJIL+W&KeX$q=2V7-f2X6ob$e^F?G#i1Z z+6Z_BB*!!zgU$kRuCfFnRRtt`YdklBRY|N25V7Pv34yQxA3n%$Yb#(&ozQ@@gl4>m zuN}fF1@4789DPsYaY$mJNf8EJivP4ECxPrpHDrSCpk=t^yBZM5_x>m$&b;W2HQRu~ z`ABQ*xe-LE4Dhj)!wosN)f{g4c0%?#cy>jRRl!&hv|RvwO{XE~R&Wr% zs37V>mAwBJ5m>`~4d4+6zs{Mj%W1;niB(g6+phuiU$d3?#%{JReAAFk z)>*J$ylT<4nqJk(Q*bv%-}@g42!Hjp|D)Vg|J^|!m5pU_Jp1EyI3~C8jPWlsoR3Fn z>U!tzT)7eA!!6BX;fK?K;PXJQdHJkO*#pkAia+DMgO!N9)7z9|mIerxs*(N^U6@D7>#v&>G~5 zNRq{JRrF5BEMU>{H@gx!aSX3;sqY{$hV>io*Zsaj;nOSrpLG^j_Q233Ge2&smU zjvEDv8|)iIYdvk@aGOG4`aQiHf!zRLXf7c-@xN`9K!)$|9ivpH3(!g2+^??R0s$Jq zTda`>i$qtT4yAzEOJ3>zgQ~B)>k^UgLlGOo0s@5*$(GZgRNFs^*hC!)&ll_SzNaybN|Grj2Y~paQ1Yy&}VHyMju5xG>!d;5rqV6a~ zX4A(H^Cf~G#3kU>EYNd4EWoV_orqFCmJO7-n|w9P4R@z_xM?9r?0^7dF@@xJaPFmq zYJSn#9l6&D37*6TjDo1uW+CVpvr1^fzKO_vFEp&wj4;}U$%+RuLB55^-a0@@=5q&z zK7LR>-$%rDUGQ+ARIAU2JqVY6chWGxCKK7xau({jk~b5uWdqc8Fn$3??AE7sYTd+A z#8)#TNO@uZBV11?|i|u)jdpIB`OErV)gK zNLK&}S0CDA0`#pMI_)lhcj)fPx|5%F{mbKZaxQyKY5LL&bLSQl?n!${nJv6134U$# zsH!Z5C-h)Our_5-<@`R0)n$fl3bu^wH6&_8*|dYLRo%I zj))(Z!&{&6`FQ$Uh)07j9A|RXl_#QJQu&DR`N8u;Mp9-)p$R92(XiS@gGu;e?8VR& z`h*LXv=sV&x+l}`)Blnc+(}o2w!h*rWWK80zJ8DTzq_^nZ@(t=KTxy&e>#^e3n>YS zwa=HMvW?zhUnJ(5pGspPHG8G`WO$&TWb0#?djuRja`OYhfY9Uu z0TTJf5+bkd%bK@H2XRpCQe@Al*B0AR!rnkH2dEdJLKCJWf}Y^*szVxl9Tch~NLJJZ zn^R2Z%$E)?5wxv>)k&*5yBQrd5>b^GfW7s$t$3KwY{ImlgLsZPP`g^<3+CTkJ-oAvFd!#@9jc+GMyU0T$b23)_QB5Loj7+NB&dPwAJ&x;wiXS8sL371 z%7iIM-6E)-A^n2&K5p7#ZzqumnEVmdt*Ah>T)ySAkMtQqNEcT+ixGS*$h)3m*U zO{VXgz|WqtMw2fKG>S7qT2EssjysjDWGMU7)F;kw-XBo59{fVu{gM3utESHzJBs!#6TL4a(7>(L2E_ zeoCRrO?2Vjp|9r0{!cgf|F6&g3-|Z_!^i!7p(jeqDMCJ>pQ*!y1Y1Y0*j&hvcG;(A zFqYf;j6e4;+n9$-j+WDnwlXC{J{Z!MCHI z?DH46DuCiQxXo7I)i}o7lMs-A;Yh<=w2WaqoKs)}zCRNp#*Z$;((-)hm76Z@@dbij%$*c26dBwuz zTorp_oGJEXUW~5LPHDbgJxn}G{^bLD{6#iVRt^Jso*w81flwd7f{-~-nZ-FF6dJ^6 zU_;org;X6GC#?{xZwC};8itCIyC+Kk?*{|I38w&gDN}fXZ~M@o1v#>WBRYtY_xeXOQka=;eF>)9efFD>vcIz+gMgwAgYe zlp0GA#SnzYaVWZC12=*Y49ynEpt8X*Q3_k@cxQmkqbbp_lx_3Ju`an)J^NVz zai+S&;zFf!uDc5seJTA*Y@g09h5%kp;mdq`QQwnRlQbmYxuFQiQQ^H={LS zV0=GMD8qp?DP;?)M#w|2je%JdxmYpRAgcqw4td`ISdu3Z@g!^sQCmODQEQSzYQanI zWuVaJVqQ$oN-sGi&1@q|PB~bJ5vH)5=$ik8ooqA3Y0&3+;IP7%8OPd)+DrC)?hLcm zhE`-7`oxBoW&QwMVs@qJ?$|{>TcVa^Pv?%!7z8zd^VV)U?*|}4Y~2{q9xQ zw~$U&z9BSs7XH^aRM;_6>h7gXvttbEercM;M_UsvWiv0POX{@+<>?%|988O4`Ncr` zjz>^bxQUf>^ipO%rEgx`rIcDn_Srfip-WoHY2MlWvG?r7oH!E-t_N2n&)$1XM!Kf_ zxPGAGJHN?v+FVy^e6(!TAWLQC^lg8JO=YR&C({>x{fA@EU;2iB15M?h=W)Fx(z8hU zj%oxO#S{9|^i76Z1=HOoijf}9Y{eC3+g(Zg{t*d^#@%Y>qH5=^YWveC^9}|VBsa%K z>#Lq!Wy=gRu$fdjs!o~byQ3gyd$S;goK=@Ds+abC&9HpjSDo{Z9g;kAFV)OC@MhR# zNF?QB{KC6DCZ0(HgzBv2lsLDW)k}9~!!n#V|73fd^schTp65>$v5ahsPK|=Z& z(&QBwTh}j965;qjm;jm|-Z&6{f^>4Meg31@wKT=wi{yAK+CsBe8}nB3%Np8|4EdHS zX}K~f3Qy?#=P^?(`o{|LrKIx)Z8fq>k_%dlF@4Di%B7H-M)}dkB=;zo)V|UE8fkDk^>HBXsw(fpr!jF&w_~e(Sc(SG++B8D z&2g%8YIgbP;$~Kb3v8rU?7o&nqfs7Ayr_|%y%+ro_7qV>RugE=H183$3zy6aOW10h zNt*YrkGH8;$-XC>7$@_sW5qaUkZ4FsdQdybW*y*I9AA5qg4&Mi$#y$Og(GgNM?=xL zQphH%TsFDtL1U{9c?-+2&Fg>0jDPY6ZvPGn$3M>*mLFsvd)%OVXQKG!c7mvw_Go63 z^HnL0A`{Y$$KfL~f)mBq)5g6DCW^hhNoF;YuO~=~VnzH=lO_pkWJJ@N3So*(-(Nl3 zR$JN(rK=>bQUBJ))49|;NjEWQE&J2t0pn7)&zzOcX%!o5X0|Th@-+2mlQ@4PE$gn> zu-HzR|*QrPf(|gDgZ0zK#zm9D;r1W7s+Cv;HQ9 zFMjwUiRTG_qL56)702Pzljdhy9T<7SwcbcXpJOTG!hC10*~^}1B^j^Kd8Vn)IFmbwDJS6Hvq>5HxcY7 z`FJ~i2F5Am9Q$u1WMm@+z19h+oWm_8n$ngas3R1tu!jvvGV7o_AU8qN0Xf;h&Q}8Q zFlhfo_u)=C^T8OGkx7Cynh-`dVTA4jy1wgR8(k5E#^lfvA5ts#Qi|bfhJ+;-xCj!1#mEWb|iB^c#(S5R@6lK1j!UE&m+tU&cf7V9Pua# z#wK|n`f+G5l)_aZ4irHSj38}~@1CH(F=~sR1HIt~-f%=#f8uyMK7MZBJXRETVAHPT}nhI@#%5zItvzd%eyh8}`~lb}9DHVMBSpdJwH?An9Qs!*rZ zT^J8Tkq>?uu;q+{RMjkgF)|R|TkeUMNS0>dE3@|&-3H1mwmyCe^EPG9XF}L*n$9o` z1X6{6>?y=c42#vR({kK4PzyI8?|Ur4)NIsKXQ28jC`~pNRVr&8lIMpRDgI`@&i|%D zo8qWv90xh7yQbSWG=rez9#h z5#1>cs{!uiJ=DWcN@8L)gcU0boa6R>uC|j4`*Alm!*+X-OolmMIn=VlX>Zi8to#5k zZ;U~U3+gF^Q`rR#Qn}t~aBlf|TFwiA&H=dIVCY&#{q~da?M~U%HnUrU$c3(mz9>?#JEGH9H0VBpxp=auf2~vN5}|#K{pK55r_to3r?YYfDL7 z;AKm^1*2cuOivn1nbJIW%v|3Klc<=iGMum^her~sK{9#(-|R{^&3G~SbMYtLc(ItL z2A{X;ZnhN)SKgH24J9e@EaZKd(c#lW`|KEAw$4^;9@XMkv2tv!_}I)aaWsGVUCkbP zd+|JNeN}rTOpXm%S!6++?6s2^+&XJlTYI7X+bKtWTS3){cX`3Kmc8oh`o&!L)WGN? zk0V+4n?#9RY4P?Xdq7ZbAf-A%a7Ykt*CS>##B)Qy+Cv7Jc+xUD4=UYZZ`&J*pi|qp zj}=6NA7+b^2m~~CMB%Hr8rf#3Pq8jvyxxJvn^&$&^MpL~>hwR9H`ZrnsFNlPeU z(SH=R2Qj|)zrk)xf&{Sv7IYzytdmH5XoGesd?T1WdJz#I^jkqx49u!VNK|1DxI_5laiGnPKkv2Po_Of)jKg zAZ@coI9Z2l#7QlYOme@vm&d+2fDa3U3}UeQ5rV}o7!D5?0ayu~fGjO(kKi{HJyQYV zpSM&J8?gTBZYQ)Upl~N}c#%~AFdscX&hwv8S-Wq+$Ais$oLE|=9cFs+wq3A}8Iv8?}uac7Gj^1%;cC1 zq=#v$Wz=b46->+(&oKXzx~ZLvxhC6`c9uyRP_S&Mulz*0UoJ%`Ou;rcA zge;vu?+<6~XqnWMvy^m&Dd=V9Jay%)0_^(yd&YL&68AwlW3H0C{N``P%+Ca5Rr=8? z!GqQs>5N&|4;Hj-Lpkd7X^emUBP#sU|NVE7CH{Hh+f@ROh_1{?5i>iOyb2{zHnNt( zE6lvB%G4;zlqp!W%s%rpH5A`$t4_3|e$7{ZrYBX$tPeEdjoT5P?5?cMv!RBHVbc7C zzUs0u%gOUC6HPkxTnni3kn zF0{&|Zw@MCF%jh)-TwY-e!wrEDi;H^6>g`03CfO$#;_!P2~Sj>aUZgoCQaVr`8;d( zjCJTX@sArJO%K~|inEZpM^{Q-a#84RmJb2v`m20x(@{Q6a;Q}yPdxq+QpPU{pyng%evN4T)*mc_hXcW&*t9O{ zu5-tpng3*q9!9p1;6O?YiU}*hF(>g6HAGI1VEv$v5c( zPeF-_dDvx_4Am=yrO&ppkWN0`_9BIVaK9Q>oh6Vxg5n!29mGLevXGv_7CZDomyS&% z>4AuQFLVrzc*Co#z)J|=zvqxAf#d~>ZBUnoK!3G;^TqO>I|x@U9VVXJ;7yS$a5)U7 z9}Dj`fL#R=M3^EIMc|M#T8pOu+m1J=vU4qAX^OpWhBPr)G70*}g~Mr5b&MJTgaVF8 z1cc%aAe5j3uiCfBCS<7I2|A!4^rq)NZ9 zGCuGb)0*^%gg{&nVYFb_0Bv8QHNxf_^ei}EA|Yu8x%-WYPE8OB?wt^U4lFX)-a$}{ zAiYt8hBaXYGffez^Q(=VZdPYZpx}E;WxZ5-_7IuJ82V<1k3IO%v`({db;%gp-Y9kb zWSj}+Vc5+KM+P*kn>H4q`}l6dO09_YS;4%5Z)oz?P$K%Cq->{$LTJ=0Gll%Kwa3CA zGwXgo{VvHpg`)YX9okiS^p9%#OtZM05xHwB?Mz7CR97p1uJMuwfnoQ(IOXHpZ(=rW)yt7prXwQ~OW zEt0dWYddJpKmy&)&Y$D`t+`a(N|Ngxmr|5-T9>?YgViXzdMesM!gt&2x%CgBOO{m( z4w_$xSsLUAr6v_{R2d3U$}#i~P3A?|6t&Th*RD^KPB;~wO&PtyqMnY6R^K&C&Jbf7 zU~#cxjqVKBFe`I$3|D727ryw$x=X{%^j<|k+nLRf0Z)?;Z_>QeTD`{yLkfBO`gkgF zy;7aA;lbLbeYyD+H;NBxDmyCphOVi<<0`$QX(b%CIIhu^2$Yqttwpow;w%bVCY}~S zqi;QNMgNeCyl4{d9f~8MDC51oU)Zk^x^yRrOjdqF;eknVO&yo&XHR987TbF4z&B^AAEI z3*>mXN(m0ixL43wlS9B1upR2qkpcyKG8B)KAGM(oge zQh~70@^{;v0P!ZYF(!~{6FksBAr9W{jKlS)hnXQ!BwzlbP!4T}?Fyv+^YkB{fus_Y zlvc3y-Q~==JI(9$<$1CCpF`CyXN-u6rd%?{JXUy2ZJvyI#n>O&Uh|DtU*m@YVNmD|(=$OO`Kw zF{>HA)P0cFD+N~?&*XDGTipf>@K=N3WCYj&bM*z5|cxA zcm1su2hV$wTYWLQ7k~B14%OUL!L*Z&!b)YD!eR#J!3@iTjnKRj9n69~}9& z(H8!B^28UXikA0k+?5NnGq|`Xidj1J6j&5_>$n-anQe9+aDVaPrVK^3zyNwe@o;s z_L6T|s6GW}|8vz(J2qOwZ)h{xZav~x5BuUiuTXe;BqP{0$?kE1HGL`lB>U)tlBGE( z^3c3KJqEdj(2^l@X=U=w_|HWgo+F(KrzZ;5FE#PRJY20cJ!p!i<1~hk(1=dp=K1YJ=>w3&?*CAqJV+ zfT(6dH~b?ap_#v3B9baCaACjYIT0SQQ163x1(*@YUJ(T41{K{w3*f4!R+hlXoFR3; zZ=kEt9u$T0HPT?BXuOi0CJik-0)iQw-H0s@awRKMaOfV+VoT2>DPC3DIyG%}TPfWB znkQX&$@eenJhL*LKu8aeO2UJ1S8{0Bhc;w5ZE1}N4~Qul;OAl zs5{3g0;Goki$F%n2rOb330NS7LTq;ksLx;p0o~OB=nl**Pa&=S)6DW2UXgL8xN(Ni zjs;Up(NZ?z%p-_vWWFeX#%T_fVs{7z5zJ4sg9hr6|4fU3Zr>ha%-egCX+3ut3b=^9nVidll#d`d^wXjzK~5=!|uJctca|N`Mr;_u}_|b($n=A_CH+6vKF#N)8|Iwomfn1Va_)RCtii#Tc`btRW$xDV~%n z^*fDM42Y?s`Lb`4&=E?OF&f)LgZ7V0o((k{R#05&Y^9o3IG1eP z>s&0QFPXGR-7|BLJJNEm{KS^}WQnc(__gi@#d^Kd9Z3OwwqFFEljXhequd`bpT3p#s583&5NinK&YMW^fP8Q7H0wdF+MIaGR^uLzC-U4?<;#hN=u? zF+eh-BFHDJ5lgGo^JfOYWq=7Xa2b9@e_jNh*t6e$y7RpW9CGuY)?qY(bpIeOHUP{4 zHoBLy#K-|u>xU>WGRA%aNme}c_aFx2V$Bxry_s59=8f)~C42%gXG7QPIMTJV>>(&@ z&LecL|DZDX22@oy83h1nAJ+cBv>X|c;3`>rW8~)G_8*`EH6s$Q5YHJoxT~!X0*VMQ zF;Nj5lF0#;!S%$SSO!I42lYUmeIM%XWjX-dLw6BYwZ{fQ(hBCdZNzB^GDqD>!&5+D z_#MjNjv{b$+yyxhbU%)O>=Hzj&Fh3#CKxlI)fZVE4_3JqYGrTOh5&pxKt6yo?)^_t z=mK(L)PQ#rsr(fqMiF7m{u!i(ehX$kgvkJ%3BW$ciahTd_1c36MuW|vblU0j?q1;H z#{w#i{Qtm(eI`=MyKS#46}s1UAiBqM#&0Nus+U_@lgC#BEzcz!NW)-hEXUK9_>JUc zP|zJOTg*_iYn{NS(k-LzlsZjJ#`N&T<(uVC`|Gn8E<_}t@r%u@oc+OmE7NE04HBE& zvpCb>s4YAGs(nL7dws5I*WXD&2cKrUHf)3WLKOj|GJCUbGYV#} z2MUiqc)ig2l%e%?;-KwTcyXL|hI*)h0k?Z?3|Ek4fSknj@e0;k3<|>BFHtPF$MMq!#txcjqs3RY%JYauQH^>0 z*tB2ctG1scuWB4qmTM~CRY+phI*os3lt#|y_&~O~*YJ~_Vy-WX3I;zcQyl(EuXseP z*cpSKFLLRnI-bvHtfXLE`Kin7c-mvM)Fn09R~n)(X|UCC9AnzFW6#_wzGtvL3~`k$ zV4LgJF<~)g%f2WdHPX<^Qz+ZIr#3d)`!wv$*9IDXMcRs@t0_s|Z$}DnvMX!l1=#B5 zn7CJ(&GM>KVs*mFOTMqc@stjYbT_;1p=HQY6golEfdq&3rR#${3pO(GONU)En)-Zb z!hZ+zYJleoSXHL9Ja|(ZKJFj;;3d1X0CNTOW`OGnMC}0*6+(kaAAX(-C|{s>nx!(G z2mS)c3rp_;JK@UYWqa#XIgx|6g@>H4&%pWG0HvYtf6x>@dP&D_pg{7N^g;zug20{4 zU{eXv7p4lJzB3ZZ*b3XF)b2wD7>EuX5i{SKK*lQ}x!pWKUwFVOr}Jpu@aP`sV7w8^ zSG=WZg{%(;l(2$4`qp@)dr8bU47+Ec-?a_9mBEpNWV)#YoPrerrvOL`3>;Vw$Pdkt z1>7grVaP$#AbqI1<}s7o1>P1k%AnrH@s%S$1)6%6d|Xx99_^T5e#!z|ClH!%QFjN~ z2ZX~o8{ruq@)Y0%+=23i3~evkp{gcfqAWPx11^*%0xtuc!*IMi9WYu+I1eThh=v37 z@JQfaj?oZku^Z0O>MgS^HI-lBT3A*We$tKOOwW;tWu3l|ssCmv#e`k>B38YG{v;YF zj=sU3u76M5IBteB&o6>l<#J?y1S_v%;_SVaQZa^g_2N8qQI|}HD<746%e(wW-G!Qf zi!l~Vt?3Oc_3wl1i}i73pR(5-I!#x3bWn436v6Z2Gy2@M!cnoN4>dbtgtLz=;e3PB zn+t9{D#9(_4BJ=hJtJPfN3zABKP)um5MA)OtHBW4o%TXG?yCC;@2ctqb552@0%`n0 zzh9Cszsry~3&(7;gG`&J_DYI(9~buacD(vSH?7^I?hOHjL19cN{Y_zv2MrxSbkUNS z;7%qMCR z>PJ?dcJMnUW-N@I-{R^;TadFz-d5~JhsC&iTUU{`8XLy&y~4Y*HuKTGV`X>S8wPF1ngz! zY16#Cz;EL|FzG#hTSc5!ObiUunQKC{B%Y_H^gViARlajh015pMH(MtQ?I=ql+>g z;oOknN|G_{n?=+pZM6j1^>=&7d;$^ObrWB?&HrNWt%Kr9yLRu4!~+CPurR?AJh;OI z0;G{9G~QTnm&Tn*u;9TOhagSUGz|e7x8UyX!D-wbayFSq&OG0HPSsmA^Ht5M_rEl? zYd74LeeZRzbzQ#;Al(4!kP+YkM*KeN6*9S=4;=lR5;+36<({|!0NG2ir+X}@Yg_TF zIF1kG*IJiH=>UVv9Y(wH6i~qA{wESa9Jfp3ETeo)p#k6iX z>I4D+T)>?%YXqyQ(DQ4r9I#t|hasc`=-BJm!oL_?!0@^G8d!r0XB(%Y6i1!kmfl*C z2OPT)X#7b}=|;qs_HE4};1BzuIr+)TB|D=S4f%CS>Kf2IyG}ovl?0?ehM@pq>z}PV zfFVOW^nJK(0t_quLE)0j2e-}lo_7I$Ip9Td4OIimz3W^Zv8Tg~FyMR)xQy7+1|#u- z2{h0y1%@&lYJjr^&~tiuwWt~|JU_{d2ZhOHHVWIc*hsG-y+$%C6AeK3`cDo7Ca{-{ z5UUTJ&K*&mmVK#im<;Y3>gXeamYO^RLp=`UwitQnrZOdzqaBBn4s~=|gH_w@SSHmEx#z;X_VyD;IAc@FhJQOXZ@8%GKSLyd)_G4O zKQ`O%qZv^A)P@6c;av70Y#BJ4vJI3?Z&cd*DVD=^jxrGYq)V9kYkr6Qw;LWioA{n1 zStOPQYZDs5ReTkBu|h7OT$LgHEbWTyiW!<+7i!ZB)1bWs1X!EO*xm7|lPoodZ5WHK zpe_`Pp(gt^BvYhB@Epl zu0iyEx;zjSvogt_V~9Y*Y(Z@x`p92CN>5pwPBxj1LCuP(gZ5V{C5GbS)%Tp`2!iC z6!I0Cg?p{N&zS}c?pFsn*j%If#W4mYh8ukR=TF+MC<}O!fWG331F)JCsE+Lq#5WaUQ3z}Zc75RoAF2Z z*Teu|JN=%){QqGJ^Z{C(YJi&sOfs%nt$=gx+E#o$YrQt2XcYoJw~Y{GYBm6e1_-}_ zrW^nnFm7t?0p#fHMH`lNgzR_JN+N8AZQL&oty;4O4DuzL-g7;pZ`U+ydM-~?;&dD{ z$%-6+Mn!Qm_Y&;Pcs08rMB)N=Vs|SL>dS+ON6&1Eq9-0|bvVHM)QX~@FBlQXDh{mrtOwsYEe!73xOd>8IP)kh*L6x1VZvov zEbl*!V>j!cmcTH8?`^9T`$Kr_mMb%zEZIk`~0pji`SOyC)lx zfFBBegcsJ>dp8sb&L_)qGrrp_O9Z$^+Ia@I%rghyw=8gNsERo2K`{@Un3yCGg0jSZ z@PW|zp^Q=KM6-b-GxuLGlv!))-q760Joml!aYg;+dRn;=C#ivF)LPD$`k**SX;y9R z9sT*}J3~fMDr#+Ah0zgSJ(}M7z41FzujgRyWdS*pna}EmR`O8%16<4g2Q>l-nd3f{ z-)``CRHrIU=r9?6zSpnOA zR@vAnJqluV|JRpThUX^4D>+r~%umhlt0)2m_m1wbl4k-Xv9Z-3ljRWySXW_Shx-|bzvIYc) zgh2dF>F;Sc06hB4aH|am%tdkl3oqzjr%w++hWrmc!gU{i_gd^+B_juf+r$ymK#H!z z3O;|2`O)#s2X|b8Dbq&dzs5#>AA11y765p4jV`(7BRt8!E@FY~hSK^=;!P?SXMy%H z05T)oI^uSH9JMga{|>-v%=#w)>x^a-sQNez0hH8KIpCn%as<7<4hFcjaqU#OwsHLK zRJr!heUEnsM3k2g=bgH7hSwz@Kpj&C807#W7U&*`-oCa70%q7mMuD2|AAAJwwnC$>k4*xw**JD(Od$oUTC%r%+>FxG zYz_S^%xH>}1+6SZ8bQ7)8B4)i$eSria2H&?nEAL_P*$OeKB~&Ph6q~fsEP*1FsS9l zm`m|ZI)m6IZC}NySs`x-@pIyzuc_m6v_}WPi>nA?Z?f?%ohqB^Ve+Z`Du_m92aoIr z4r0j7abtBL%tmoLXFrH5Fgd&gVmbpm`piy2_BFY<@+k}xhK8$&9Qc=_uyo{a;fGHs=1>rXf^c| znVO1}Oplk+d~%OmeS`LUp0{`$3pasF6x<9B{D^UPSfp8o@;BZ14#kogrGEay7V(#T z_}j_;{;(21-uy786X;rH-G+s6^?aHsJ&5K_5vsabAw|9~k;D{(6Z4x;eTijlCo&Z1 z++1JH^QRMT<$K7;yqV#?(ag9BtwXyI81;w9i$+% zNpK{`Q${0MwAxaY?@iJbUHd#xtV}J`APfJT@=$2cp7w0uZc%4(HLn#rpKwE#wocXX zL5vUevgv5J8iXM z?K%Kg0SLflr?{ryA8^q)Z31B*4bd7uk ztQRr>eGi!90)D(T?c3MB5hFd%YqF^(kZ_D&Gd==Lld}MD={2k2yK&`vVlaR@#lefp zUcubyfZ@qYpicXp0D}kYgTL3DYjVox3n*Y(9e4xKiAat8T6(>~76O@NML=x{3^}gd za>PNG_ka67$W?5(mMYtuUQ(Na0rB_saA)pXZ#YyQ{}mXy`~zU61*l!d?0{lZj2dtH z8hN^SO_g|Xoi?Mpam|w+(5dZjKL&O|fK>GvAXuU7*kt5WO96ZMS=0i+EzkaLqq%13 z#@T*`S$*x@Y9x^LititHeiejY+WCNMV%lvbMe}Jk)Vv5X1#8ZUiispoNc9ttAZ1Yr zV^*?9^TilMTbFJ`$*E2DGoXc51O|Oke3^I9rPEPz&aUNRDbM3&}n05h=R)%hx8lO~^&XBdyvGOS~#4lUQDLZFAnq?lb(9N}Q8SfCr zbi9SDy|BEoklx8WDUS}4kA`f^`75aAC+G$t8Z0alEJU9MMq$Xh$PBP^gcJh^vP^Lg zp$)C#t1fdUyDdCLJ{Y#pX;Yn;jdha`*xC>M9}k9Nmle?QHO*e>Fqy~Qc_Ve~w~oW^ zx%e|oyG~b>45%{jRq|lDp6l2@{KHfKSAOvM+X?>uV>Nzx9Omx|3&GyTc*+-Tu8#z) zY1236501mjL)@5T7Y7;55{7~*e>v4g=xt6@MS5N zoHgjiFdX&4fGzRc4Sbk7;ZFG5Vla8j{0ogGTcMaKw-<({+ zD9gBgP3&veqZEaAA2>wW6HP35nG$&y@B%GfOj;MwW4l(1hDuV=@b{1FTf~;BL}ge_ ze>S*CE<3JeD5FtfkrI@0kL5UHW!|`~`E4N~l`nWNV7f{GzzG463qY#(Z?d~iFZn(TfdkU(Wp{$Yer+H)YYebw zfb6e<{SE;uhg5WhEsDwjdLG!&uB)qS*3AYm>R_7&_Tle#i@EQmVc)`at8xz@XZ6hh z9$TO^1UxT*a|1s!=X?B8bFv=ncejP+Wd)gUIuK(*^!B@haMj2Dx->-nLomH1-gg4~ zw+!Y;GH4W_iDj^T2Q2(PlMVnhLA55Y#9FI?UpM{XiJcbULIjGz!|&Chv=BH!RPj3e zg$(FircUGgYFFe&K6jp`KKumD!kh8zgn^@T>AIm$>o^8lPJPK`i`(m$oVQnze|9v$QB1@=S0m`b$ z8(Y4AU@~8W8_FF+Duo1)+*T+{MnrN$s~11Jqn+Q-)ht&ErM@Jze(hz;WpS{O5cz2j z{hL>tr)3j+s&MF9KW-6?Tzk<|>UIS)P1h$Xx#H9a|x72R5?~R@$?)-ZRIeW`pb+Fn6+6^vdD{ z$>G$(`G1HH0}}tD+%33$im#fhL^dV}(T!t|JNcA~n@3Bu<+d%X8D!68c?`iEd75F# zsuRyhcRiE2t>iSwwsMsBpXaYP3-?S@gTQi`T&y|<|Nm`+H*Vbi`^o9f|5cl)S z)JbUMP)Ffj)md8F%Q^}!%UDM(isWlpa38yC%V zlsI-us&Ve>z4c1p>E*R}Y#jfU?h5B$1JXjQV$phaaN^+NeT>Q8pl{89S3Jy?;ej;U zl4eZZ)Gi!JdAO9Hly0--)&O4bt{M1}@Mh^t%mve~kwgONFgGK8DRmgLaGPjs(S=J? zpr+G3Al#dli__Rr86{y8Yt}((urUO1e=5z_(tJ6Fg@(`rVHQN8tL?g6Az(H!6gsDvv#hpW@cT5CY-??`^lgXY>4C%0Kh_kJe_sb4){F2JK_MY7l5;&0uw0zPWCeNOSlTu?3)Il(*WAE;##=)?t0L1 z1ys8y<1O;vTd92~*9O0TBsG0!KLGh6li~w%SbMM5KY$e!uE7fD%cRDERJ*aT=|a1s z685OmPnQG36bkpoms z4&6iA<~C;E(k(rs9(;oU;haRR08d|#SHD2z)R;F(eeRn}55g7j z^e*C2=cAFm6se<{bH2trx<(QDY-&1u)?7RUFif|n%6>(c)63WvRHAB0q)J<$=Jc~v z#$xT-6=$3$%a;qf`p4p~JK1^xU;50MgkWb`n`JR*c8e0dFi`sm{JzM%Ht?OWC#StI zr$S!hN=RH1<)sm6`pvmJSzeE2gCGCr2Jn}D{yPc>|BD472sOyp*^!|%sG=dU>lv=1 zfn^x;2B{o0R2cHbSTQ`bNrZlyvU>xfJ)gWmV~P4s**E(QXV%|7&R}5 z-bocJB|{HGni$m5P+*bRU#g9A>*D0&=k%O!dH5?e?!vVsAA!u)=CW3Y&r!;8qJnjI zDp~f{C5g|3x%K_EPPsl$NNvAcsU@GOj1^~u$ziG$jl5~)V5yFp}UkX8|M1&%bvp30qIxFHo8yV_YQ zr^htrz57TGuhWHc~@JF1|zttg!;K1aVS8}WY%Jie{Ba7A5)kLB*+l9R3NB$sVOu4LeNV2sNtOSd-l63>$Dxaw<{&t5$@XD z?@&;rY6X)_&veVR;TSf*kCIz1;>8OgXk;uM+)Ad^A zIF4JRM5qJtg*qp=e0|SvY!tkovi!=`;hNVXzI9T!796JqlD2GDj>0jke7caMY|_bt zjS}rEH!qk<-sL!E6(7>KS)RYhit}5cH-`LMh4b`3R5*`f8Avio%`&D+C#!(2h9qw1 zzt{=>(jO80Jtc_$)tZPo`RJ38%_oBqA5J_>b@QU7J6Xy%&#b}PubzxPCcVo!Dwe$F z58F%9-kBcxvxE?l0~UOeok@AYy}IW)spTgN#d5bmBci_m$E z1_RM|34Bef?TSCL5oyu3uUsvId-ioL5|o>lhG%BL$QY#0W3`poYB~rRF5CZLZre%5 zTvL%vWcuyCh*1A2)LRx&{Y)~7e>YZeHor2S#m7-(ftoV!bz`1P;r0iNMRtZdohoZ( zCvG9rswieE#$QPLzB*%3^a{$JOkMPt31;#r(e0N0`xc0nbVllv%pJM4&vp4(>hm1V zQd<>s4@}v_e(5YMXD)D4wrf(>WxJF{)Tk_8dc^B_F2?Z+INIjU)eHB?o8U=T`lIne zCVt?8nm@I-Iwi%n8iSN*8f}JB9F^$X+VYlN#(YP=i7x%H|joEeI_5l=cQ>bcoqzDI_S}5Rper^aeBP>3a8-=5`;Z2=({3fLcH&NRt{w1L8w^a5j1lc`t@O zA3=s7tEQ;*ZrrB_B-#NE!0_Gq1Ru3_3KnJoc2?B!Pe3FHz)u7}I|SsF5CF}1Mmuys zt#Akk6@}`rM@#JcfPm;XCz|1(g&4m_H-+COzGk0=0A{+i>u3|d>BwuOgtSmN5cHIB zUk~~A-%u~@f7YHoY{23DIuT~0)J7N9`;eqx^F+aWM8ow%zmm-asyTD_&?UBgLn;$% z!A>vd#b_jhq#Lk~ayFm1O$7418*Rdi>om_LrIVXfv)~!^U(SEU?JfBA0{-pBJrh@E zNJO*K+m#c6GX9OAI5@x5kzqc!@j9ZDo4_FF(5tf9jkmJcY_2)pxtQ18p~uX9Bi~Xg z9mXYg+ij1=Ufn{lfVJ54x6bEvAXUtg1;ZSb5bD+iwZ_?Yx@B>MqxcVBiNm!EUDr~m zm`(-6wb23~4pl+&bbUu9eI2T?$PXItTy&!-dDz-iUiYz{2_wG@HR6<}NKG}DwG`yS zi&s|nSe6=V7iP^O6(Ai^-=f%8gEg*+&dc3;FLEJ>BX99H`Vdn5N2AkCRH$DRkX|` z7af=NB7JW$JmH5%(a0m~`YrA@E>BX{SI%ewH;c|;XfaAj50e%5&di~wuYB~wHq|6o zQ%`7_pYbB9PDe=gq4!v+*Q&Mw#ecPf{N+Ep{WsM>{+||xj-NNyRJRa6%?+y7J$Ylm zTtJ=oR;=y^bMB!5SZ<^-mpS*wILSuqvkr$~T}i%%xk44O(vs&Y5$yu)q*P@B-Fxn} zde55;>`JaG!!!rtI`2xw*Elc!^gJ#&#o7768*?JfWtXJW6C??->OwU-b%Dy1F5219J&K$$G7RJ;-!wNmxwBO60u2SzH3Zt5@fm$M5 z2MT<&a~m8^>C?hOEh>d*xxU>{=BF;%mIs&U>Q+4vee+41q@{*S$x0?xA`l|_&_WTx zsb}C7SYpG?VITOzycP<+z|G1!E5oe%wq!Nsd2b^$0vWc&r?pkE(8cwp>$95;^Znc~ zsIt3DZc$)(%&6Xd!==`~S=b9Odta+8n+!y$gkrJCRLPk@zZ*W4BwsLE=4UB;XGEz# z{duoxKds7b&SP2=!s?>rtuXMC76G%@nVW5HZ2;}D)=z!&bTiMQVx{Mne*xyrwA+H)#24p#884ah{M!3D<#=P%&i%- zqR|oxMz2cDGM|IRrwS%?N$cE)IypIU?NFGl*D#c4z?~)Eq-1*C9DaWqG+xTY5QI$7 zM~tS1(idd+#6rU`Iw{eE#)vDB`YNu6fyP>{;dbtWthT62+U?J4uU6`9RSQW&lGlEI z-8Yz<0HWxW7=?^H4LcS+s`0CGdzC9$n@V?I80RCUwz4zAqEmoa9J84{XKdlgOk%d* zLP-+ex3r#qqDM`CFf-zOS|amYFe8gNIPSOjtgTHpl&%$)c{q~`29k9#mW~ja=Heym zr!(t=CSqy1pOgoKj+8IE31)o~8(Q`LOCQPqEba^-N;P-H6< zJo14otXI&Q9u6?xn2S^<uDMZix=>XHTb+!a#PJ@b zz+k6c4YOxuyc#SQMX#cs;Lk5f-Lt<%X23JjS2HmcXrw*x#(!0I3^Jb0#-!FBxoVmp zAUfpAAIeGS(72=-`x5R4dO#aS}&K=Pt2#WITVpJ zKX5t~%O-&iH^eJ&=EH+Z&y1aftX{D(6nRKX8--IsEuh0WM~V~P%nHhL7jw{=RH7Qu z3)4Hu1?$R5xxQU$gtOO6UAGyvZ66t8X%DZaC0qQfz&@1Qz3y&9FzWqqsdMSUKEkFi z9anW&vOnCcI6kT;qr+FlOT_xD;=GjAbWM=jsctRS?x6G%julP0ymR!dw6=4nE_eAr zZ%Vm9*=GzVcP5mko#Ciw0?*FMcBCYlWOyEBiP6OqgAbO*Sfi&l?wxhh$5Qkf#b9F6 z@Gy6lTsiF1ECt#bbW`>G)o1b<#Huc(Nz=lEk93Z}Y@x@}&bEQ-nIblHM?!ddJ4M;m zqPCTrUhwJF(59eUvz67_MbDc&C}$mppod*%!wRdZH)z1oR|4tkDFIu2K;kN&eHGlqu75VdT@jvzPpTDO6dB^{$kN5NYx|NMWckDo^lpaFiVK$9wXQNY+GK061A;sslw{IqmHq2St_xVN1MJ1Ibrf#uqofY+65@^0} zo*Hy?SeksoIlp=A6g)awJ6nlHckwkBt|&S@#s!sH6PyH^^jojn5Ga*yuEJ`w1A2}f zsvXRS*(|Whw(ze-;m?|l#~npd@zbK0!j@PZAOKe=IcuAVAMG)2ZiLhp3~e&pvk<7( zuGl4BsVY*(F2aKtisWADf4dPwkRso;7|1rp;$!SXRI_0-Sw=Z%rp;>$E4_(Zx$n3k zTw1ccmHt5uGcF%=p`86<>oh>ir*C|63=-v3+g(J37Voy4E4I*83w?3XuRR!s=q2@N zQ1alGt@vz(Cl2!q{b; zTVA-Nb3m4^$9G{YU}`$AiuXKwR;@V5Gnzg=dlU+LGX-N3R9P`>16hgqirCGIz{?0$ zNQ){*Er_aVMqjSq^-#MUP;g{lR*oO+wj13Yld)eZ$1S3cwXV)bmrSo-bGUfxmx^Ot_SnuBJTS)`%X+Z1 zo#M0N9Ji|Ow3f=!g|Ge*C;T@LU_0W^F7Qv(+xB$zQ0EKLafuf*;c?5$>mF;`5#9!3 z0hixybYH4((=c@#<4)NvC#GuQr6tvD=`u9kKRH%;mCnxHhb!V-uc^&ffJG2-YGqda zusd>9esLKbm#Vq?*w=nq%RF+PU5U|E)pJ;g?HX6U}#@Is>nvlqlF`io({ z+q;IZCrQL{bD5pK$dDL1$}%$)bkw>XH(YulR}7!GoaeI8s2r%JRUt_#Qui#YiIQ6` zlqmS)BCz~>5zK4d!5n(?CKL@Zc;)< z@Q75AVg!C*x>k!i;oI&%V3lW!O9%U)K)k!^I9g2N%ir3OOv|gvm^FLz9f8=i zoIw@`A}4ujG&dzQl2u}!ztkzasx0eg(;CaFb-6%_G#l_bmzf)-&LZFPQE@V@4o$tT z%25%ndu$_M&iFB*`E?#`g}%my92?Hbs0A%Ap>Y4z2wXa!KrRjicsA`Fy zR@n2}bu`$!s@V%I^|@PMg&b;=sus&kO+Vn^-RjypY;vK5I4hG?e|>3E)a`8ITKsF* zhz@L#6VxI%;VTW9*2KIztdc|zVovc0(=q~SQFqwy($dm0O$o^O;~LvrIU4Lw27G-y z2Ym!7;9e=R+S{bMSHw|zwC0{IZcC;eEI7O`6is(d5?mn;F9W-o@OnyM(4X(9OVAOr zxGxbCV>+yaQ-Y&&$4{U|max8<1V%xMFe&QpbI!Ts4!pUyJMpPe*^?2a$w^_gE0HI$ zR=3GbAA=ZlWow?`FkVs6+0m}*`&C8+S%&O2wB>rhEUuopsl%(;hM7b}rlB)4x2bmL z2*ZoW7qWP>@H&zLWji#~iBtsgDk2#fNvG5K>4p$2mo zu_zsbLtUoqtpKIuuf>T^wC-&RoW1dm(Ti~RqUb-{g1djfsWH_LRt%uitP)M_ll%m& zS|dC{g(KgSkDsCAZ8(n_5leb0auuI}D1sy0X{f zKX6uFVE@Ip8ZB*E(LmE2s@G%FOE;sUkm)g+Q+mtIt~T1gci2e!w;sMZ!I5WUoD3kZ zQcCB&#(Tqq*0IResaS1C$5Pe4m6 zRtU6iCG|xwdAfk}hN(spvu9iVPrV9V%w3Tj5Vi!{DH4_Xg#xoCk$Zqfwmn9UhL2)-Og5k5w=L2n<|FNN6S%qVb`Hbmb0?lrIj&bqI-$ zecqu}j@&1T9CD^0*n78+N=W{=RCUvKqhMaWCT!Aq!QJ|P0A`EtOO42!O-i8iNcHp( z=e^-7rbzK%#}?|@7oE0el)@hOAmI5UYhaXiWvPdk1lhyt2QCLMCtI_-qGyOg#%m}G ziRLeQsbjyQ)V}n#55;Qnn{|TKuDC26Ef+o!Ac#dZ$9wn~^wmr`J7>8X%JzC)=kaKL zw@rOVOjW9I8VFyt#d~!rFU|=zWjoJ)eSf;h}B7#hd%W#q_X z<}Toj8s+tMOls;ONHqnhL(~kXOUc2kNB@b8Xt#rWhpVTPuDh&nl=kQF+&Ajg2C3aA zmU~)LnvnTK4xB8m{mV>5kn)SD)-35(kzOi3deCS6VN!7M&UjE4_TuhXn!S{T+{VyS zvu9RI`b&wG+IphJ3Ptmi-Woesnc|DaAV|wR{m!YvC0_y4q!Ug!BZ$uv=;V|h@bk$p~$nie7K>~Z$fm!2USM1hpLwwZ=RVOu# zNAaz9BzvSUBQ|wiIwr+HfjaD>jF0t{!j#Ln3nGS1=i8W`8xqEuk5R-{Hh0rK@6`H?W3l=Mb8Oj`Eh;JHMKxTTuOg zqGGqoyxS?IWKMZmggcf4AHWf%L|GUnC`oL(Im1(PE{IAj8498Tjm&C0p)o6FXyBn+ z`e{X(TkvV8^S#+|y`};W%F@l2gNa9YT2t2V+}#?ch4D8rZdEx3q-bYlS|1WzsBo=5 zeD;9P`G_PdrFmoWX-DzJNG&BFV#%zLpqsQ?U_yIWy_(@su{*y3L-T2>FiSlI^DZqK z#awFB4^PHi7>%rsw*E>Z%jjNQoNOiAkk?}vS8MEVyOg@yL?Ly1ruTMU56WerQ0^9{ zjnqd-|A=NHHtv|jGXGPry0gSQI?oza48uba>Gq$<1r||-!?~FnPg&&)VZPpwyn;vI zyhQ8@L$$%SC9d{3b0^#*aXBGo=VYz=AoezWg+8^)rvlez(WITx#lpJRWK4RlbWtLM z^GAdAln$8AJoMTGP>2cmunXg27NlUl!!^zi7u8?pdRfA zzH#-3%Jf|%kSt|$|NQ>Nq0fq(%z<8$o{>)y;_POz`^_^&n~RID{@aENo74D9UCVgt z+6nfm{gP#yfd$EYmBux+!&MX+P^_i%$E-nP#ckFX(yUVvc+B*cCq+W zt%FU*pY1vnFmIb?jC9($k@ z_iASOLaKrRAt2-;r0TF4Ex)B~7swXByA2Dpe<9IOHC%9 zZzayVcUio0+>!;o2%E`~08plS_`L$+feuse796z2W1I3`Ep#t2w|2|ou}HvlbW1C& zPYT4li>CVZKdZVuKLwDt^=nfFc^R|deM{;aZVg=~&h`#L8t8TN1>_()_gOESA<=K71>%M(n6kxsxBm(k5@BqTS_rhc?(@6 zwUS-L#D2ob?*-T$GnFxP{-z1Z&?+AcA35JM8;!+5qZy@%_5EQf3y{_9X~tKYWtX!c z*HQ+lFlN>}1Z$H6Iv+cC`kjESP9E$aOCAnmdefOz@VH=@nLR=)N9w?uZv;g@luReK zKq2V4S*En zs#y8+@~fu7N@{tRflN>m{)@dkht_6F^qpJ$?*){pZ{Lfjcvv};>=~`gG`MuS6+jcj z-Nh4=9)#w&TkCYb4xd=f*n7t+zcA(apmy0i#OCX=KHAbG$#@E@Ng&lw4b8RbgXi=q zsV6WyMSBiu4`mFdMY1!12FAjk5>c5D<+VOOvi;D8ljG_zWb*426OsVO|C^s82^y)&QY}&0E;gKNguPSuh zIzpGs@g50O^<#YA=AQlL8Yi>CNB#w%J>M`kL)3L8&C&%eSoWkd;ufq9C zD4aIIq$W{|$P9?N?fuOe-C2fmUzhn2uzgZ+xv%>1OYeCT%^kXjw(iGovLV&SE;FuL z7E>;4dfkq%RVH}(dsGvnd!1Y(7n)6N^|SlN85klok0=7}i?qDm>0fGuG>`a^PGSuq zO2JjuRrIlw)`!L;oh&L%#^s(;rtZb*V2C?Qg%saLUhE{!$mk2=$->L4H)2lQ+)-3z zZ!wp#7qZ8NRW?($3h8#kH7#S0kjZR=pSLDPlPUwALd%S~p6!C;8>^PdtpTqI@Egd2 zrgZSg@rjkGX4E&|_Ic?Mic->Sfj&uZB_YShb~6!%#|$@N&F8dA{jPm{K`F^w&4u9lEtH%Iv+jeUt;dq zbzEylgYC6i*pF(Hw%x_=tW@NiCnyqxqkBPb?B(Eu!?O2|LzTzt@VwlWkC_i~wPq1A7>qj&5TXLni@0o~_qew8kpAfI!ZJ%=35ae9Jbz@i=4xi>fz$o$E& z*aGq9UYuM2T!Ht^t!a4bgm*glEp~0Xb=i2=6}U{3M$!HqyN?qI;8-S5^SCe%wtw0) z=M%y5yGotfN!uO&&SwYl|lNV)hiR{!5i2-n)LBw*A&nC;>A|ZvB9xF{Ov{x z&41?-jmh>!9BGf3TY+}p0JlP@*cs1-P|4@YOq15*+J??&UHj}pCF>MLN5}YiAyQ|7 z+6Ix-!dx+Dl+$bP0d_H3f5P;Ek*B!iU6G8y$XLxG$o?95jhXCVg$258Ni2rn7ll?WypM2QP3WE$Axt1j_CwymOc4d`stnW8zM#8^LF& zA&Yt?o8tw>1Z!21VY}7@$(&p~3lDr^qOp&S0V%OXyH7S%XC8l1>N@eg`&(0M5`kK^ z%J4+BOH{Sh@PK=ETJW?oce1KHnW`SC)ZVZ^-~55I$1~H+(b_9y;Y)%)Hh}p5edsa& z^E+It+rA}hCBuHMnhv9g!?UIKKr&JH5@8qxhc;S`EzwvalLIYjA|h~UVB}xmJZNT4 z31wgc5t4B%pc<}s1B;;rpl`UCH886a(jSlvY#crA9dAOsOCt|pOTxeX_{?k8+2*lk zoEWVEX{Stao(Fr-oANDmb{%J~*Ast9gp4-okixGl^yA=z7vpIbG42fX7F={&jdSbs z>y3B;e#j3fhR4k;r8Dhx`534plWd9k^MT+hTcb#6t8X_><=lLm)-&o17QI;CIupN) zWlXtG!i*KNwtZy#VFRS>?G{8)N0Iq!rH?Fr=unyo=8 zoKE~Ir=`S2fe+Q#C?{AlJT0>c9iHf#4cm=f6VlWh`n(P{iB7I|stooTv2C`(c8vlJ znsfdiw~S0fcy2?WQ3z=lat_nYJsvg$ygBPor&AT1n8*ft@gXK!=}8uXuqW-#P8D*o zmY~7@s`>uqVMVPy@6M4UvUfZ8V%CMlGp?-5W<3)?e6>uHt(Wbri#-nv(a=*)Ad27O z?#p>$7N26kw|9IOtxe+L%*uT8(zb!k_hW#5Q{K~>g{FhiyM%E+%4&(dz#5R2-St5)@;zOGT#gN6^ zx*UNnm%l5hMaiO@XJb%@!gv4)AvMp%CdLZVe?P?&{V?Qk2pPM`iADJbX{9Rl5NC^B^8%=O%+yScHoN+VrasS-bXhQa`#2&ye0@pkhR+{1 zpSEu|5M?(n{jc2X_7Rz99P=DS;@tz6Kb(HDiL))8ym)Hge#!XnUi0d|uJ{qAe=4oR zLgsH=nbH`>C&nxxSvaLy<^49FY%r(ysXqq%dErFgYOeWD()!1ULdrt%^#Ma-sWY_RA?6Dmnvx*5|{I_TgVwGjItF;3!!q z=?2UjjRw|^i5Q2x(a+-@2}5T5UiXA1B7`;?-K+gL*&UyA(byI!8-2)!G||J6Wm2ke5Y<1K*;no<-c;_n#vU3M-72Nia;)Iee8qF9 z%cAVqa0e9bOrD4v#i=w-wJqb<7w^k0hsd_JT&QE&+!d<>w2`Oz)1?I+mt;ZU^+Wlm zNysE>)3UQbuj98ArdQ6?55i5(uIUoXI_0ZpUz`)a5_B$GIcjxNMc%UP93-PS0I zbw)UN|4d+F$b7U!Ks8Y=Dm4g%sOBhh+x_DP$4v9DnoW_T--pmE^2#P|^^e#5`x2Rd zT|s$!H5UiRF?7YfCWG$CP&m+R_1@n;&sad}l(yE~`bn$S+5g8cRhBUF{b7{<5KF+V zHKe@$bk4vyw3JW28|c>Xwou_UjH~0#7eBc5sC^#Sz|OT7i!fOsIf#{cl?=>F4Z*|C)ga%4QS6@)f@5?hC-9%`?dsFkP+4HBk zk4uD-wl+cVy}_~~>DRIl&HMEi!1@>9%{e^qe$-*GCIN=*#b!Dq>9Ju_q#0WD&}4wA z;80Cwt9RcY(0y*1sP&Qv+?a|wEW zwtX;gIx|qqS$B`^en#~6)41nP9LsF9_TEWh1}iT)?&zz`IZYUiLT6>%;wC31tj#rv zg42?mJ?c-a(8NLMzDpQI0*I2gS`{|)F3)~JBY`ot9jak5hwqpC z=3_q%AJlC7+*eG6nOMs4U}QKj?fyu1l?r{9a@;dFsTyMsOG}LwD#E=$ce&>pt^Tp0 z#$5&+p0r4Vn}}y5Y@}aHe}a(O>7TKD^cqt(9A;x>&eD#-74+fDsJm17iA*mBJCkNN3dGo6rbyhwjIUWa z0M>Vo*}-u+FU@LGjZjz7cy1e%(N*J5?XU2<=QPAAve!X^*Tz_PV;xwqHY#A z4rt_kz{`^&8>aJ86uZu(x!1CGWQ~os2uoRUwTi}DLc0wkvVJLx)>`jpFW4=Ol$LLG zJavp+zE>rr%0Zd+mMv=`-z~rG%Lg`1D`gFS3T2P=_Qsrf1_)51QV!RsO;MB{%NGTb zj4zU@kN4hN!VaWT8(0EaDcwF3xSwm3>O7n)EOx84QWhAeEKVuB=oGulHcO&Uy*@NS zZ-dHSmy{_RV8Fd%Rz|YnSxlwqlhdF$9Zu;$sB77QR>oqU(h~hhKVftpYm6^MQ3dtN zDL469BdLBnYu&BrtxPb-QmFE2ha-2_GSPB43!x81l;xszrjsDvUi?03KpgPDV#S_S z#Hk_3o*X%}%k2MamR5PAnKaCXfz+w-Q?X15N83XpEW>I~Q=pPlRuY19^!0@M?IxX= zCD&Z8f{*-xEeuY#rciPXTYJ7<)Kl*Eh}>vn5!88tfp-BBQ=_KXys<54 zs7Dsgs0q)f)!@I$wNbBVV#IU@>O`MY(*H`9 zj<$6}`bjNO^-g(wxdBsqi;_n+z^2I7kySMxMNkYuW0~j&wRnz<%{dv8D~Y)&AdVkSy-ix(~HLRl+ZKaQhEuDT061DVhJROYVQW;pjad zdmJ`S*U`dZ;N>z6l-pu=G#+{3u8)CI``yi2=~4;Gz%g(JIbi0vRs6rmd(Wu0(rsIi zDwhKe*yLagWwJ!h8IFlYfG`4)g9!p73|QohZE`js5Sbzf5FoM;8JlRb$r+5uIp^Tk z>3*-yJ$H=0qx-$r-9K8t_s||=OZ!`E&Nb(n>>b=L6vB^LO`ioN1sN>1Cu_*vk?(w4 z9=F^EX$K2N&s6JF>O0`K94dEV)SHCLMmdg#Rjib@vpZ-9>#AqYB21$F@C%8m<5vAd zxr5K=)27mgvIVx&u3l$%`&~>Zmmq~mAUjYv0VoPWt5`)Vhu&kc^ba&lmV! z!T8G~0nY>{mSShUEISB;JNoTnzbSW)Ho&I3X4z2u4&|~MOtrZ{+5GorU-2o?2O}}u z;T$W_tz`>tWlylZ-qk3BdR~fyi@#*y>iY5lD3$o!;v4)0BZv6bxNmwy?t2_#T@%bs zl=ZkJ7y8lx@MM?hG)1aX6FKx=)b~?L#qxY(U8T0g8-1=7#+KK7vP@4G-^)k>R?hXG z8xIuFw){CbLB6UCR+9N+kR>DM@;&S0yR%-JBmVr#2t zAoXZO!6aV>S&=K;U;o z15Ixou2N;s`S=F*6TnbkoLogJ(c9>dhw62@XDXb_jqc^oU>k2wb*P>>w~I}}G0B2& zzDY;;dby;A!QnD#sjb-TTI~F|m5!-8__aEDek1Te_6nnLQEC)y>xQ2pGP-GC0( zXbRV9wldaObv1Rq`2OwD!#(%;v$Ah#ZH@%2zLSBQRBT4staQD7_?94se54M*)++9u zO)APY<|{4p^Y+D{^Zn@l54ZXh6_l~!$YN$uE)gtghnx5G3ZBsTi$tu~MLFafbUAl9 zXQ%gmv2$}}q@Q%Zz<+85r2a!Ipz^OV;lE$?Kdu|u@D9~b?HyBad* z+_GG;UeEFWVE(sbKrU&P_LTNw^B2iL?Em6R`1*g~Qe@!$1**HWOYU#Wv^>tU5vFw6 z;F8(fHC}1`QU$!zmf7A=jEvdk}#R-5f=$YIS7i?BN&dKDa=kq>9Cb+BHiBw0ZJN=&hKM5nG$B?JQ z<|)1SNqAY{Dpuzy7~-#2--v!tvt7hiI^WG^T;f5!c8tIkj+DVa6pNtPWhoNWJ^^Ox)5wPsBpH0X*J=<)Z?ItHSp~V)+=7_^SUboy%p2kAluPOtF>DI2H5N7#iiX z^0pDUrN=TJIwuU7_5koO>(T{vR*t(|Xa9em6&oz%J)$aWB=2UjJMek5)x0W5NhUx{ zyKC5P2<=CDPo$Ir*&pimz*PIipU7bq3s3BL(Z(r=EDP^<)m*rj?H_jD=#8S_UrB4Ne4cuA+WLM0PbG?0VJf_P}Z!52sxP52n3?7O?9*x>BD zn00!%RCv8AqDxl-RJa>3?>^a)PLhx?3v~7w;P#pCSEw?S=?`}l1k*g33KKmN|I!w# z;~>R0J+hyJZPn)U`$zUJtC$kH{whoXg64|%Z@foVV-=J8G5Zn+kNbSmjShe`Eqoe^ zXxC}AD6%ZNEdY~gjVAsg*&=f}G3Qc6m%2gFV)x!H4ZZEl64C{V$UN>v79x}5*(A2% z)`p@oFVi3iOn11|Upp%fG*|x>-GNbo%VdPwG}6;?^*&f3a`VMzJ7*i(yuK95DJVL` zqXc+Uf{(M#NSlGl46Q<}roU6wZy8%2Brc)RUk(_0I~t_cvkkc7LM8OAB$YaVih{cl z&oM<7bK&sU$T4`ZGG=6i$!OND+u3USeXSDeWuwO$QDyNTYyky*sYn14Ny zx5k?mRa(zEV)yhhLe46xpN3MXr~s5_6r1*7S{+(qiC4pV<96!bRj~JwJS=yux=@sl zi+xtwShY+Dwl|wBv*}53BAD^c^}Q~ha=$xB4^}ChcF$;`(4{if_iMah;OI#@O9LDk zOZ3DFwl|0Ho!vXN+pl4uFZBY9eCy`~r@JDTh9TaEou(8f{q~;4W_R0Vto9g&zpfMs zwX3RWZqYSk_^@tHO2<{>W5(^^q|Ep}tzvnD+N!E#BVE)oA1HTm{v~ujK7M-ESuw4K ztJYvAL(N7C3<~E($G>9xV)QQP{oFPGy$_`n52?!OY~s)Nq0GHHDMY3|`U`MYF=GNH zasW-ZGL+ztmnr;WA+KSpmQObJc68@@X^HnoSbWNt6Mh;#alx2GZ5Te?ZBjV7eRVhG zE{zeBvAx&}*zsSz?n`h*xT>D;r}KYK`fC6Cq>sD%@cPVjV{ReyKTZ37k(Bj2m4<;c zdhKP;sCXJy@6G{Qn2 zGFJB%t~qTkGIhWX*Za|cT#3v2K2(k+P}{I_*5= z?s=uu{#@DGp#YozzugE8nqkkaL<~Y^+@FsS^CB=ddCVv>Eu zq1c~qOM#}%r*1_`QGDO*B^FIQssSR>zn9OsceOPbRnZIV)#)zFffC0CxJ!5PjzI}7 z#9x1asqMopCvC!FhKwJbm(n%b&`i+dpNfVONi2Fd?(z5YGEr>mP=jc-pS!a5L!+ z;QxUhX3Qs0H@FU2;oN4&Ld_Jn+qcxDD86WkO^=6`qHG#DQ3rnoyUs_?YlyY%4PWP*Yt}w%x?%Qj$ogu%Jb9IqK6D=R+()6;(>7gzCszY)u zq1eR&@U2HZKDEJHnTWMrhv_ver#KxFK$%r)`_% zlYYqPB}?h#Xt?Vow!?KCaQHltDUL~3$mTh=JMJX_kz^jduWvh68=uu`7__1aXwY84 z%c^8#@s4OmcuR`xj;OtxExRvg$w_cfzJK(ShM)3LWkuF*(t4mG6 zRIFI>2U|)ytP;o%T&3139o)x|H!?N-b~^l_99_=%mwY-UYc}LnncSko^B7*R1bTj( z_RfC(J>rWk!s&=(T`@lJ*GXHg+%@7hj{4t6_>zB*@L44ShWm#NLlUW=ytBJDENFJT z+A=PTE?mDO0#Sl&tu|$*nr+1JiI%utK79Mb8qOmu|fW5CP-UKW^RJpY<{g{vs*ge!A^^O96`_WNqDY?xHTq`C68* zZ(YHVfV!K0dw-fDP_M%fFqY{b}y)&A=% zrrT!AmT&UNPp_AV71)89NW(_5L?AbLElbC=H#Ip5bZkO3OySi#Qh#8u+Uq;&p}+Ou zw7>UDrTPihjXl`LoM}Fx9IOe{8y;5u5|4QxQoxp;kvLbnJ%{qCbnMN66-B|gYx9To z-PaoyLeMCgRE-PHJHpRRx^FIYb?BT@>f%->V|sk!?#*=pd1c@0Oes()g(QT#A6pO4 z>J=F$(ouEB$FrC8jGY#@wLE|!2KG14OIWI}R@9mT?(<9UnoNoRjGCFRoj^eY-jrT1 zkfN_)1z4q)Kf8o>7{9n=-1zcL1c>BI1;{?ivvF6xvHJFl(>`G2b?kQJ>Ru2xymooJ7a>M>Bw6l>ZiAW zGt)!Q#ceBZ{~Qor2=L`KgEpe#mg^(%;)$!rmiU#Jv&le2J`}Z*d3qKts+HB_Vu<%~ zHg-R4xOiQbkP_cmW(z#)*W?$LP*v&hqaBC!e2 z39_)S!Fq6SPaxo0Jre8rSKyMYDSu$V)4P9NzD0yijme#6ty3;!zYpAg=UaKhD&x1a z9mUk!cg@oV|HDV`Yq>yv1$>%jR*e#-obv`iGx{AlZBGG* zl{^*3EYKZg;S$VFd zoU|R{vT)cr=30g>?fC1`)2brB9r+*pSwCuCor=gA`o|sceDji(eePKmg1TD~GAUDX zzn%6^u=9`hNT%IpoA0^$WUOeg)Le^;N#f>{Hm4$li1SjZ6gvQk5nNU^ivISd*GHX@ z&cr8*fZiO0)UO6D-F5SOzeF{Pt!gT(_hB-zy}w)=L6-5*AB3w$npFD(YEt)xZ~7UJ zfgcW7dFhrQ`S>@9?+ClUS>|neq;F6#*}!mN$)@hoY;4c!s zTJo6pq6|Wa!2A146m!AU?Na?>rd#hIeDtH(H(Sf0b~{?Qt zw|m^hjC=WCX@@IK+T+3t8Bf-*Nn2Md8l`Q6Noe$VI_bn8=}dTQ^|R)VdSAK-f7tIc z#O7K@%=C0g@HL9HiZ$7ZY%_h_iyi-tDrFe1gx z$3@L79lxAv_8t|g>Oh#@H15k4#v-j2BhfybcB)%BXR)ihc5^ObI*bcG#p0ZNxcp(SVCtu3qhirth=ScE+AN!xK{LT z_EOf?^v!4a7!^-1*$hT6uKrUEL2-(zmmiaM0p?UPgJwyhz@NnvPDa+r?r8CcAM{%8 zMTMQN^s9WXVIAAG8;lhNRiV( zq>nP+&O`kDAm5|-NfpNTsu9lsT)2R?IwiOVheF@aN!vr3Ciq#N46|E(cEOC4?W?fp=StUmoL3svUgnifL|j?! zvwTG1+aff0C?=PgRQ_kAu~!viK@zY4@VtLK`wv>UCl&PbBUB zxRm5D(Kr)6=j6de>K!&m(axwVAKG)&=MC5yhz3m_WHAmHC)>ljF$4|?tNuMPWfel* zrqGHsORly_{mz{4JauA@bv5LjYbX2YCWMr%K5S@KYzE=;q!@^p>}v>hPO&UzSLbgV z(Tjpi+0iM#BQlcI`DOW=-4^BNjWaJ8sP<%_c8&|CvuV4aopaW|YSg_SRMI9&1B3dv zg2qE&2nPW}(}{425r>gI2Hl?e8Fn>p9kSw$B13l^6JsJbh8Y^Cqd>}W+?7NG&NhD2 z%;dJz%j)S>WPEffI;S zL4D@AZ_L)$wX$KCp)Ehx53AsUK-^`*87vr~(=_?>^kpegRkmQ&lfuGagsB`DeWwp2 z4s;hsm;U;W4|i0cNIo=}VE5Dt|8T9H$m1rG9Ui$-{OD2`cf1#sRN>!0!gK4DFxHJI zdm`Si0@_FU`uge(u1w_+Zozy$+$lLdZXUl^u;5wn5r%pxuWBsEid?`@y`|RYF(ONC zQ_f~znsGv~q8kb~>J@UH)KHq=YO4@O~Tv#+op5GI+dmbg5IKTUJ=z?cyQ@!y#Hqq|JWwtIrBqt!l?_Bog@BjVb|NZ~{ zd*te|N#w6H)+<2=;>~vxzazL;9zQ^+0N{mFNPe-wo z&J3~P9gbg@S45%N>GGH7;*D!;^;O259Up(R<$PQ*n}PvOqjmG948FZDPpsl=2%+Wf z)7fJ%BJh$TrW47(Z;xdQ|GjpF+cHR`XwYt-R&V%fl1r~GP9JO3Ix>XXxz`EB>RfRAnGM(xEPTS`vk zTVc1s!aUv{E;|O_Pc?w#<*N-WfiXm(j7~y`gcY=)Bn>ltJRBCD9PIbaLzhpa*L%*7 z{N;B$rE3sY@A*3G99K{D)EZe^nDFR_=YE*T0x)oUEuETMGpk8d}SsG$!wr;t;*Rz6A%Y_JSy(M%^Q7~FV4}=+a zikJX%Cq=nxDwkz1iu1GN=BhKi?2e6cz73t&tw|=lc>`(z1tm!@lgKV(zwV-e-16H77Gx7BitEZ#Sxb>*KB); zSql(!66pC5p9zemnN~sL!MY=nIHD^g2<3gjP-P_QBc1$HP!cR=0J?+**4x|QA!aQp z8}(9*$6RYkn9Rl)LsayMo~AMVerW;c1HsSssre4hKWlz|MZIc*)#Rwvu^d&y-@y9( zNHsiw9iqGxkg06Cp{{g!GA6=9q`<+-*KspQ>N+wF%)M)!s_t)QyyxLrYbBawpV*1j z_tg~dmZzyf?IdWP&(4Ge$3G((yT8Kds^eFnr?uTeEg$;X>R%v@^%sf4)cwgH7qCl} zaG7km7#Sq&J_j8v+|cQ(y2m4@h*jH?28QAf5NL8C^|!W(=kKSTn{qBwy-|bN467%0W@BN5W4-k$sxw^j{lpH{mlyqukY# zg=NFs<1!$(*LgEzAeozOgA+AUwmrNJmY))phICax% zD!9Dcdr9+Mt~0cke^_|$H|LwcI*T@t%G0;Xv3JP!rvrt`8WbfiAmkO6g3^@q=9X3 z-|>hM2LhDtpc~WqGoN(Ke_~zk{fl*B4nryX|v%5%G)U zk6XwePh)?PV5ZzGv6lBHlU47A?2nBC)gV;M3|OFjiB!Bcea&K0o=|QW z_jsGN#5R}-Oug}Q3nXNWQAtm=?+|tFhUspM_X~`|(LkLtO_5W(evYQX4bltn4PBO< z8R;()UzZl&5I(=>2ewnh`s;6bd_!g(U^#qoe?|J((hu#)d2=vubNDpZpXW-R{IIM~ zE>uXq!p=8D8MenhrQZ`ZlbMT>A*(14aoeClJ={#N{TfHwvkc-MF-Hr^%qRYtu0&hJ zk7;^PEe_qG>g$yq5DsgV%x6J+jyQCs%unEUwkj{4IzHw33fqNzg9M9nn;;J&{y7+cll>a!1L>FWY@Y(&n>mhOdiA6 z)@z6AKNo7vA9i*;s^6#v3U5(OLgUd!!giy&O&q~2)asj$VyeiDAmM`X_A$ol+VBz7 zNbHfXjd~kY(37;@6AwwZVoQJ@YVNs}=ori16it7qx$`u6?OAq2M8;iGv5c|pl9~zk z%q=IYhP{73QNG>?NVIKlX8C9xKgvDk{o)t>G|4>g-?^cu`SP}59jD``ArZ&E9Gv;G6JwUX8d*<@P~=(DgqHfA`yCKdERZGzLNlMRy1una87T^omfxZOwS*ii|qNA zz-+i1aJoD7ZjMmO$GqL#@B8KoKy`&~M#y~Hs{P|hGMYSvQ+MUKkzz=5fSI`KLOgnr zqYPr!tWQ@k2Vj{!ScP#ZBXh zKNh<;DALZ^GhdXh7vsLUyF+!{G}BbFG|T%%RiYhK!*P3vwnyh8GlyD~9jwP2*qg>y ztzGSp{Xyk}PhND#7~OQG>qNXsZG8lk)vOX59U8P*i+v5>u&jBfP4umiiwfg}Wl!^M z1TPT!6g;ZUNz&9Sdo9SsCKLP$J{bGcR6HI=hWc`bd&+r6-qLHo(0RrcFk&}k^(Z%i z0UNPO(}#gNFGX*ZX|?5V?#atly`80^wWvc_^jntf9=N^xU^!;lod@<)=F=5tv?I8! zJ9Y=WtbG)@(m_W$(verCA&cC}N%dGsHGN(MQCHd?L&odnh96SL6LNu18mWyB7d&x| z##{AvyW^Mn^GCi(v&(vAB?29@C^I)ZC_qB8wu6UFGInn^I1~@n@1MX`(Isv0Mwr(5 zXhcc|#p@bRU$w(QkZJJ3XxqGx>RAAM-OV2#S+ zhJrQ4UE^vL1~houSM#At`5VcTfa4N>_W_SzBq>D1+1b9x_VX9Xb^$*zs-)mH9zajT zs|nOsf3%SI^Ru~&V!|&5d-xa@kT!hW%+HQwKkA9DIdyxRc#h3Lb~^0;E7}|LPue?$ zMw~hn#mACFQB61=)-K?r#g0dFmIlZ7Z0MAwEUrUMMhnc+ts6#CHGQ;)^#8q7MFnV( z30z4P%#Ymse(3k#S#LVcEGKTpXS z%`nj5aFto%QeJp6Us@Zb@iDB*>a`!9reNBsxTvMADc^STeNVb@#Qb@0fk;6=9Y$H) z@m+1tS|ltJ8!Q)Er1#cC2rVb~^-nC8n!DMvo1ASLR9L3Qc?$$Y!|Zaj~2KlUpdcv zjO$fidCpC|07nZ>C;G3|m8TA2^|zq+b>1kLq(O`N-OhB?Si~8He}qUP?$aUUp38L+ zasKpvwidmSUwVu<9xR;B0~Y1EMbxWRE|RklaZ&2g|RO ztkK>$V4tq(TRg5HGCx;jUvInk7dZ?D0Jkj!|BZlbiXXC%UObni=$a=+PFju&tpq-* zprmjd^p|(_i0%Rzqe#LCct*6yrY*?2gwA95x0H8N|LD%Qa3RAd!?B^0Ub?2~;rHe@&0d;- z1>qLU;?D?rU_p)(>^Jp1HNymH+e&K{ZeQ_4nLU{{Sn46PsIKuPvy{`G&M9(sfw6MC zrbc*4fo#F`ICd{p(&;S?`CLj`9|zUjCJK#il%uGnUzrWH9w;M=Jw@NmpGS&Vm%LVZ zC#LgNk;fa3wYfreXsqhjKG*;(Iv2Tut2m+1eW#7Y;&V!Kn!MQ>)yad}M!T#4i@8`3 zj>>7v8^1Z1h1j6&9#ecd)!3m?Bd=dLTdl5qNo~~A0Q@i&2;8XRD|#Z;qFmJ2ZY6;R zikrGWCLVgo?@ko2!@`2)LxjH{(5S15YQMoqW0a)}dwBDk?aS`PnzDvXv}ytNL&YHi%u`O*U}Z-pKQZujTWTZButJm% z^md#EiV2UxyiV9MKjdcP=xchF(lfX5_tl@Y>Q+2c@391qre~RpIi_ljX6MWp?@rlx zPLNC0ZEt|Ck=YN*-s>(5@~3@!{_)VmTi~!b0Oro|0nzZp;qm)+`_+pEfS4Qiv%(*a zX^Lb!Gc=|3cWlXqN{G=uDelnXa%&CeY(UDRSjHR{fU1!-@41#;x?#FSl}9}6#5S~b zq=1(5-V&e(e%TGrNdR>hH`_0$zdn~{{i^rXmpvi~KAt`e0&N2MW@P#1@gBqDHTX*K z%jIG&x-ti~Y6K;Z!Be+4Y@PmsiiL}?WYkaeX?S9b3Pw4%tLTkwHYx9HvX*N6P+s&S zwK#gCSuwwipPNOKCT1+ulykaC%{U*?pCd}+HHIk5m&;pk&|IFK^1`^013g>$0hE7) z4~ioNmtg}N{?XwbIE+zMu#1YHa3$Y)TY?2jrdr;17UT6 z=+D7wi?&SfrX-!`stMD(HK_4^$K76y3vpUGe)%t;X4<8@SRbP!0b2&XE3>X>pEtl` zQg}HZgDl=xDV8*K)*!)JIndn%8iZC#u&Wsj`GI}*PB~`>lthYPM0f&5((Qjl6?`8t zIdBeaDlJ{2J3l!YlmL2WeSYy+!oKR_ z(o)YX?r7aLcQG@&{Nl8J$4%FHBo>d;*c0n+THH7FM#>bRR#)6tR}N+HCoa<7gW`Xz z)H1d$nBAZsre|uQ($LrFf5MhWpj(|570zk>&jAaJdkZh$HUE7G%KW!O@M(|7dixb< zU+Zcq<7$~%<=XJnpLNAN+3)`VS&uKvd7g_u+)gtlZl0JgFwzrEQ2OLBoz(vlSEZ5t z2J@anR4(N=G`0gz!}@^j&uG=0*QyAK)bl>21A`Pv0#L07;!|_x)RE{dV)p~hAYz#d z0(SGpo0592OOyPL^4FOUaAbBpCF-FW_1SeC)?Gmy95zp;U30B>A7&UXWrZ4eKsdVb z*K1y(QXmET~ZN?3bh9c zM;fnBlowBmwVh=`>;wSF3xu^k@Hxj7`KmxWWZ}Eyvz2s@&Y{H!^47Pbw&~DlLS{w5 zi@N3dnvpj#{rU3|!^C`SGMUxfvM@)9hmHd?J;sNnTih;ktMOxVX10&LMe61EKTlhZ zRUCSt@&P4XaPBHc8Gf8oT2kH!FXe0C*n+Q4DR&W(E27`xvzm_|Ern}m$`Q_s!v%4s z?^UEJR{U}yZz4`q$OO&WBQc6>Jpw-tUCT$kd@b`9usu6hhFHEYEu4c~7m00GF)c~< z4~Kf?-u_hd_bUK)g}IMYn(8ETn!zU;OMp7u_(I*Dl-m3_NUmZyA7zn47ddZ83~YQbuNLW z@HKIL;$S0nUy*4ZOQd=Ts+AgV+t)En58lIPGUt(QGuY7E;ro5Y~jL9~pO|(ih zFr%v%9`hhtnfJZ(>vN0bphu)|8$4gKcya>(t&Bf#ZqJ#+4$po`ahf?X)JV6FA5Q_) zOv5#X^yd`^v4yy$*14ghDToOuvp;=sEBTz_ z(5;d>p=8)Pi%Rg0K#EUWqhaIv1-hwZ6V~NEV%>*Pr~#a7eikj%)q7!M;+p>$j%^b? zF0k%PkFT1DeK2S@tDFg=KVcLz4lh;-Dn}$lnIR5 zx70JQbp`+=_Ck^Vl2R-`fJ)Krlq=Kfj8|DO;vY~jEJ_L!VMNf zwoy>6U+RI1U&b2lLtQ=xwEUnIWG8yp4v38Rf3GvG=>b=kXk+gsddxC>sp&?FwmNwW zICF#Ma85<$FEKG6XDi==-&ghPwDz?vt_V}UzxRQUXtYhO*~C5E5d(4`N1Vh`WIzC7 zCy-cq9~xPRf|~TsR6=Nx#`mav(_EXW7|pgV`Xs1ph1_|N7g4%EKj+n58kxav-vv#MfP5Z!-%_gu@(BQZ}%q|9z6;A9Q?;ze2czE)BGCH zWG%q_k?2A{ASP>2VT1ltT!6uTz)xgAVEEf3`K=_@Q?Fknc>|dlj0+iiam=ftz4wpe zD>^w2C=cT35+);`>PU8yfy5vXj`Sgf^`xzc-qro7(T`{p72w+`;k zzjSb{x=f&nwID0zBL)KP(N6Ez6!(^!=r_Me$U^s_VZTUz3m}q*f$BF>uqG)zd1+he zUnG4K5m`%?A1WLF1KLpT7$gptlglRA&tu?*3{}`DrGZYZ54UGI-|F7?Zi&?SRh4cz z=Lbt`md((L@l1;t-O&6stQ#zOuNaiNMV5zDaj1o19v2cGo|I3KNmGU<1bcf*4M!zy zY8P;%9%!0W8bYPqsx(9yFd(8WT2nUFMXd}jrQrW>g)lPf??Trkub9F-S>62V-`}FZ zzfs!L|Ax`x41K!Yp@+F*YlSO=cS_#B%oXKUvw9S$zGA6bY`RT6X*8HEaPf7HOZQe*V}7{gGK|-D6Z{ z3JuXbWSzfg=0W2({){T)r$xxh(GVkj*{LCJ+?@}_Yf|f4tab2_`nSX9% zx)Eomu6Jej0mQJ##g#4pmEPw(v;W8uXPIkneAeE>K6sC36i~3CAHr->u}NAmYOrc& zSqu_mtHwgAce0hNZB)(Mf3(>olP(q+8JH+@(mGb8JGgCoDDy=dP4ej4EB2Rx>@L&I z&Ecb4=AUaT;7iTVEJ8#L4yF2YBgUyQVPc1)OO7&QeA_v#Sd~y=SGYQqjx?nuY*%1-J{n6BS%<4;5bP>o?W zcnaXTcw%2S;iLt>whjEsW7!_Tu@Pcjx90QwDIa%cT0``oF*3m?(?%kS!R1vyOYd1V zaJII+NL%~>mDjPiR?3%X*8ll>J+D5ffnDlPX}5GcyF$=-RCUA3dRujVyb7?_Mc~ zU?bNMvQ95mfp^No!P@HNp>sRILb*jMZ@6JE0k_cOM$>Dn;{RF*Yo)#2DA?Of*PZw~ ziY!aN#YtLfrV+ui7xx00uMAmhv`5xKCA9|Q?ftZqC63Rx5NgpcLTZe`Y&MPhS!@4P zH4}>RX5i$=+z00>fEmrwJiteo;9Z#Zn})LG4k}E{$aTi8A0QCe+kBS(Q1Dh==p|Iq0N5mG`Vc*GA69o328l^>o5!0X<@!W~=6x%|J zBOVSG>J3Oy(MYO&f6~T6?WS7vIn>bx#XE@#qLtCNFrHiqnz&oQOSy#Bc?a`0*6Ip= zqw|N2<`{OWiXna~ZgVzyLr4~)BFN0&3GERE8BBvuKAa#EYkVumyz>&9G@8##WCYIv zi$!)1tEW#~_&f0@x$!GquNuoeDD1~O425~46k2-;m{*wWP`$n@@573%!I4!oD(uUW z4nVZtC>+Sb3YwYt6xD-5GY?r>^eSQig^C?oOPf$Td5yQ%Y{} zse08TaKF3mhx>w5D_x?5eEJ#G6GT{=tXY~Tp0;0qjvO1UQ}wC|FtYezB+6g;d-;}Z zFMGloU3#VYt|*Lp>BY~R3cD+fkG+C%eL|NK9k&~QECkiWpQ?#&3%NqH5PkajSHf!j zv}!bRvm!m8fnx47P}ZNk5nFt<*UmW>R`DC669l=cxt4p_FbKEXJ(^)i&s1`PTA3-~ zuTNyo2*fuZmQM1d}$u>T)`G}nIul@N+rJE*}zkgcEOD>Nf%WQ@5&1P z(58R4{QOWnwl30Fy;E`(kv!hyU0n{!Ljn}QMBvn$qFicctT%V!IIagevA&j1`YC|i z0a3O~a00pkV$%({Q`2r^&E1oLxBcSEnJQHdmJ<$)ioK_dZ@6(lmxIE|?9im>CM$wN z!5gj~cp5Zs&izL0@znQx+44o5%@>X+*0*1-J;;kxL%9gIe|96tu_5hai6SQjl0>Ue zeF4q1{+?d^`p`z#vZS7s+6Y$Vp@SV4nx1bp)l@oT!dtR=Nl)#c`%{*}&y8sx9$2m> z2AwCmO&wnmhT3L&pe#SnULrK|M;sgc(dzjOr z#^xBo@!Y#cNb5yF=fP@(qmU*Rx_!*k%+1|pAqeFHy0LBaquJ>Vr=~+32rK++q<$IVTjS?i;afR9hM@O*c#;4`gZT7^jttGU4C6l| zeTY2j|9c<#{~|!^{{wdgtH!OS%JZr7wse^R3-F)AbY+w0v0u{PR+je2d{)B~v#yiz zA4Q7NNFnh}y=yd(=z`ZZ(;woi*Yo0#TR07_-K7(PTxl6QEKY1x>t`=pA ze%rV{T851<5tt#;uVK^0FM%GqNt-#k4@}t9^%=Qaw(eH^`$^~tTLg|mrWP;9V98FQ z2&;FPPGo5UNbzF{D1US%` zH6{qhI3$g9a(k&@Mdw6Ydh7S!t=j$j)Pq~-@2Lk*i0zGYyZ@m4amvU@ZrV}PA?tN# z-P>DdJ&E>t&f9Jm=6#~Uy|u5|OZ+5@^!ADR&4Uyq7wmODKC$7Fd7-rGOe}I~vg=I! z+Wf+K#y$9^;HvDMRs}+R7vYS(EqZ1!PK1Y{6M=uI0oV?);;3TfJoUJ`=)& z4hErS_}RH_+ET%%{4i5JweTcet+8lAaWssr?FpYzYMPOl(WD*6YH*G^gr&FS9u2*t zsp9WwZv*dV!SksKKyklm?j&YvGlM=;4Rtd=qxi%|7{|_0hK`U|$f3|e{49Pk_$T}m z~BBEm`k;NDR^f5cL0 z^LD|D64S)GvCXs?HJ`;itcz_)f5)Y|@aTC;RD0{+lUYQR16-PQ1Ag&s}(B znUUMt#sFArd~RxdkFQo)`76&K-_j}Y*%kNVf+ei1C$$Y@JGf1&oc@7UPg+U?1C@$` zzVFIi^+3jt1^{pfGFP~baqzj0P@nzMX2Sr^aBwegu1W13O39k<=~G4yiX<8al?;il zWj(nb8O}TsNk`YtMQYkRmzq_9Z)bi?77QhZ_nDXfrMyT(A?Q6^bAXtPGiK){Cv^Is z8!^D7ULx7PAkhG}B$E$vV)+)Wo{XCMUKe~SSJ&xi@NJ8*KRS${A@iYbl_N?dR$hDo zEx$xtwGL=c@yr@BL~de1kmWJnNceu6oi$-as&GhPfqd_g*i3{LNWmk_@kgFcG~oT{ z2tZpT;rI!ltMo^CMJpmih+HpdjsD8^L63Q}^U1EMBX#N4GM$(DaFmJvDVTfpbrJu+ zQAdOWcTFPaat$oF6yW_uLL9!CO>C22JBy>1u|xq7(Q_iE_cB0|r}0t1Kjk{=ir4p; zTgTZ=?%vp9ZYlYX0ZHaGg=xvznI%v0Rm=&E-EW(E?}qR1y?@zcH6p&F>bfxj1;%nT zz$UCX4D+RIW+vSDs8*@a>;QKujZx+HVn*3yXwOk2pIkyUW+M99axSlWoiOeHxL~!` zz{+|0+^!g-li0|hA9*U0RlX98;(=h^`o9%Wr`w>+$R8DGp)Pr}lj0z^?U%F@nUkU) z-}}F@_m)v@rf=IXGj(X8#jP;Kof6!qv_J_EN+3vpq`15LRB#*IVIYJMfC-* zyO&U0x-;u}{`RiD*V^x1Yw!2Nev>cxkhPLrxv%>=ExAh0c_zZ2u z!Io<}_sYZF4gPDYi?>e|6mM&XZ*tG8#9tAY(np23lpf)(bP9;Mpil*B$Auy9hBQVw6h_(QUt9VyX zsUpv!C7PM2cvmkDL#_!g(*@h;7#@R?>FjxpR%k@TDytl z4MwsvUnd#=mN%Dnk&)$8^eRrMGDOPyy+Q5OVZ2m>c^w{JUku@`$OP9y)7BpI={gd0 zn$#(uJ0z)j+M4Lp3OE7{y(oU69pi^&Eyg8kt0|I=H8+j~iXDBw&q&p|BBJR#woG46 z?nP{_C@m~f67I0}6_Bw0+AW7!$BR173T#l_b(v%^s;1L-8wI_XNy22#?Ht@4r81V0 z9z!%0DR^lzavRL2Q#BiwmU>YkRfPwRHBi~>b&)mC)!p6Hx-*EdCyYwtrrfYOwPajVrYkMYYeib*FvC{OZC8S4x+#?BG;=U6QY zt5qZqGED|X&UI0)fJ@c*1=Vq|{vh8htD04HK*vNmNN5`bQj>-5+&*|LWb{X?+R!7F zY-z03N~WP41C6rbw^yW58)sypn$&OH=AmZ+YST^{LNGs3q=1-C~kFJ`3|Z>^e$J#QwekmP?? zfd~l&-&k}8wF-B*dv9%Ae~%{Cvn2Ek6muP80dWyONh(XaukYi(>j>0p-uScye;)Zs z0^%BI%9{&oPBva0=)wTP#wy_A!sCZCI)A1s@z$R5RqT?l#FW$kKIhYA6^qW4bpRtC zx;A7Eh}LK`Peq(scc@E!o%pq>Jg#+y{HiziDyzvMmHjGdv7p>|l^M0bkk|>q^0)+oRhtoLn}B*^T@9VL=oF?AgoX6?HhR z%jSC<=dHIa`5dD4P%Cbd$qqmOa^=~R{g?KvzEmm}sa(ZxG)>F5%Vgxx5U?I?0 zUwGg2;p}D>emwp_p=>i|W=N1cj)! z%Qqa`@XOQwd{~v~8^PuJ=Tw_!?x43nz^SpKa=MN-X^Rd9I|=5jKZQu5L!Yi_11 z8hP2Ws}l@yfAK$p(>W_ZsD+p5(ZNg`%2l12LXRRQSpwZetc}HYRSpJ2bxQ5aCQ8Ny z`*No0j_E%AkPV%yvvJQY)GHF-5d@+Dt>^E&ruLVhO|IvILRD78j! z6I|X|f2GL?Yk2n{0FDE^(^%%)M3lfO{ns8;&-%EszfoptueS+o)&%b1|56-Kj~1vk@Jg<4 zO8kU9baK+t!Cs{&v&H&n#2nWXa1b>wlR=60*RE0%_1$R6u^OuoJP4T%SpuZMgx z3Vp*uSv(-(kB&{$8n?!4O*Z~V)o|j!sfOj}{^wQ0aqFLGdF#m19h%Iu%@QS=-?m1( zw;3B0f7^}|VL=)eE|1?hFHoVy&em;dBCzx|o`8|LbFsQAaTj(5c;@@{v~`25mM1En z-%of8PeCq8Izgmo0$vZEF>}ep@~PF0U>?=r>;Rxe5jVvF_I z*p(>7S+$VX=$(6~^6(V)WBm)aE8WWKQzNsVBnc1x@dj3n$8=LCK?a$%ThrSQs~XfQ z0K46?R1{^=k_FJTO5-+PG1*##8hQ+=Tcj5f*6 z7#bojWHFh}_bO-WdzD~H_6X4yoZh5}XnrnykkSC5{n{~GteY%Z?@>_6f>!<*!fsp5 z*%Y$R(u34jtpc*>M-)T+b=owqjJLawBneMjWHCL7D$lK9{8I?-^AVn#6pbnK94%p^ zL`uMkH(NXYz=*UmOvt2kcw0QOlyR|qyod%`U2|7&MVI%-Wk(_|!xS(O_S`hpSfcj1 zm`v17rp0uSw-UYaAdAiu(#Qautu!Y`xxGZw?#yK)Y-f9Bj@&e|&#t$H+&CHefN5GH z(Y6s@mid#U`0_ZL=Q+ER{>=!#Ts@jEb|!0Qe>LTXDSf?rOL zuyQ&A-1dqrQ(5Dc75fk}e3~v6~W$sZJEX4?|pxIT|Aa4FzB1nh)$7U5cE~+-cponhh^qW#GrUvK+c@ejXdfR3mw76<`~>hPX022Aa`$<>MG%Y{KbvApCG z`CyH&U%M1QR47SMzAKt`R7)jexUfO256z(BszVennuu3xp|@hWedE;~1Z$`?6y$(Zm^y!l;mtzHsf{eOoCm$2iTu$S>e^`$T)ep}=v`AesWI~r5 z)rQy?VHmfaG*1~B+7x4*qk`7v6coL<#7xSl6GO(d5@_ud5|K^LuWNSQJI1GcMVWE2 zjE`xkdeQa6T!-D06$vVVo-QbM5d%J&ID)IQEp0h4h4NjxuO=?S$3KQvqlOZu{g&w8 zz!*fQ=sL>GJWWV`FSb#}*^-fG35P__W3w3|5iA?HQZ@nIA9Zq4nbVpiMUnMdBbH`n={ z05hhko=_Z&Q)s5N`g5AK15Au8WxKgNM4`Cmn7wSG6T*r z5@>`iA5ab)_xI*7yu&;emLVi_($TlkP3l{$jbE5$&wke|wsOo_0?cvj%KVueq~Ak5 z>XxcW^P}a^qRAl_!2F_}48eG$PyRBfH+1g`M|BtlYsZ-b`Vy#%vEzneDxs?}xcr7D zZ!4-;j4txY3!rww+y1IXrYPhet>ayjUI>*el(4Rj^AWA=6Qx4_XOG1>{gOHIn;oZi zFWw?M@VE=7@%m zW0fB%-K(ZZ<4@H@!EE|6jZw<*UC}x)>9-lzYS&2pi@5q*J0eR0ZkHkv)aL*vywbV^ zS>;-p-kw^QZ-4lB#Zul!_5OxQUXosGL^IYKcHbb4JKV=vANw+=K8n&l)zNJhJ!+|A zqaPS$-K=IBDKpMX1y2qH5cJAFaZMSrQoW6F)goDyG7=6o4etPB9!==(({LQDO2c6} z=CG0Sgd-JJ*-mvbm84~!QTIk$3^$FV!d9PCa@^oFv6DfJqEP2kSv+(9-ltdnr|qZl zhdVKweiNL@FTgrf+s&X#bS6zrnBU%kpYx^|aoskVDz@1Mqo_)LZ~ycgv68((HyU@b zE8R)lv-Ynq#;0Bj_$%JFS14BYovWpYMh2Ik=Qa?f2QzUhLrE__*0c1$9$R|t_nq=A zoRQP}uUxck;e_}>PZ&`LleEGmuOr4*#wK*2JMYRS5cRdN#FC=EVZbwT-n~iI4u+F} zg;=f_8A!b#gNkMu)FrfbRG;Yzc&pY$Z(J^b`~$60fYQp;9nTe87iwu_7`VV(*9R6G zOkW9B2KU?z-j>b?Ob@%7PKFoWC)@MG3uu&oJ^TAhEf3JrTY8NUztl7xIrkOzIB?i? zPA_XmTy##4#Uw3ExJ} z0%#tCUXEPatOuLE>pgEL%P`+w;vGgajBSi#E&J$%axk>yv}38s_XrqKpe{yKI9>WL z-FN9YOR$ri*&7wOlBM|XxJZQcaucth#7?$bwo#dSnHtnsNgI!-D9DK6uJpTN?UmkL zaqo>9_(&vlS=wq|j=Y1R6&)K^_ksmwq#anQg1|7OC#!kD&{RzD#YV*!y3uR>e{P>iv076n4DT&zcrRvRELY`Vh9Nc%n{N&g{5=0t6xwB)P7Aw}sTAJU)P=?XMoArh&n zz@7-~YT9@AOSd-`4^gqUyNC6hjeUcvy((}N)&5X{Q`2FW5I(e+dmWZT8XzB@5X(oE zv~4n*1DMb@Aw-w$;i6^-9I$il$&gqs=~9k)24$6Cd(M34R*W$8NF|eSZ{#ZTAhy90 zJlIBBitsUoxHTTcqC*U_RkDq1=}TJ1e6W1YjS_MCe;MnIgOH^BHr|;29jCe(W-nO` z2qm=wBJGjNv1<_r(SPku)-4=KZs6rYGH@(Hf+F%IlU!NM6O~8XrTWO{=QzsB$1!4~ zL5)648*RD#FFr{fiF9)d)f&Me#!@&|{i?6iidT%2d!R3365~bl&yw7nE#lAW@fEH>yg`WTySjLMJ3K)%I9u;@PQ&5zeFOdw$mm0g(x12q^z0FX*T3Xq` z#7#Btx@k?Jvp&o51c%1Rs(>zF5}%Cc!f;W&^HTPl(Sh+~VAs-Jj`*a%2-WyfR!-Jk zs+in;Z}NK=d-gY&xSNF3m2?OHS2spP0`0Y{c#XF?V4xqE|XW7SE zbwmwW>V}rTR-h1mlU1IVC}NWK$6LEMocJ}I))xTlc0W}b8y&*^^-$^yw|dt-jmHo$#I6nQiQ&wW-Gl>2WcIkXrvuaNBmCa zDh&6%!v|f(VR*d+SWye)n8QPK%cG4?=&^^@+Rg&vwVBAgkGR9izR5;2cQH+gRor1N zzycQo65RY2g{-BjLCn8wcjQP29r?Vf#k6W?URVBH&*?gOUDJmTuA>&Xf8*GKTv=|C zbD3sge0DyTv{)A8y)N;dEyRIDdej#vrL5dep2)Y~t{mDy*>%m>ZfsI4$~0{0iHLV! z4pFjN=Mw|myz(*AYOYFhhPyfy#W?ZW^$hljU_}CW86nSa4q+aXn1Q0y>Rv-1+fjA# zt|^~yL(HqFWF!L~R(Z=yoL|p*MQOS4{5eiOSphr`qqO3GDwy#GQl^8Ba-2(q=dbXCqoQ_nI)argt}KS%_sm~THxMqNMO zFiG3CyaZge%DpDaA}3?Lg#=W}ppZVNbj>KuvMDJ`>uR;Y$hJ{lcY|azIYLVACyB*Z zbd>K_yXNjhuVhW+n1*$Lkq=E*K_g(N9Z$|c8Q*Px@&M^h`hdhca)Nd`SxCs>c0tK1 zjbqT-O!r1PVf_?sZoOAaJdQb@9u{oao?5XUTIt`W(F<4ZTvr0%+%Rp0hnq}*I!H<; zT$mnhJy{8@)J2Sz5v_+d{RQAGMnz_!@yGuz^8D{2 z&;JjLJS5U}zDf*8fv+CXE6;H%Mfr|#DLclGAK?6|x4ihVS6*)#$~XsHYfXGV>l${D zHtiTiayp_Tb?#OH6Kp_WFZ-kbx_0W~F})76%u-?9n!;w|2=z%WL)gpit23D_wnN}Y zg8c+G6_<|PQ;rNs?XS9;S{u3PH?hjCtE=V@cdmY&v~gP(G@1grsYO=F>&c%#2-Pc1zn>;4X7rKL2mqyz zVUz(A*K9^m%kDz8$$iU8cf4q2d;YeEOa(6B%Npf8v2jficQ&Xmz??hI16sr;&jkfp z?x;_j&Jw!?X7Vw9rt7`42eYaBC|ASOJK9;V!N&O})V@hF7}t4E)QsavYu54$q74-Y z5LHXPQ|n`Q^0F?{Cj(wQnq|@KYFnO7#aM%YCKU~R%QA+eF``Kl&Q+*rL+XB$<&RS7 zzm_W3?G^8AOiu>*9P_#e%bL~?%G#~ai_i#_sQZ*c8M`!n?9c36^Cjz`81H+H5}H_W#xajd6(~G)Vwtx) zi7;XHPNT2N;S+-%qyoZkisV}4t63_aXArVzlHMOSNPK_3Dc0Vq)1j1Y(a_kXH8GL1 z08g43q`1&Cw5;d&JuGJ0vFkCvF6v!JF*43&=Db=NwU4ZlPPjZaur-o$tg{nO@&Utu z4`X8x7R6+(3* zUmZ#h`KmHl$vxbrsuv+o{6*X0x_?GY!w6M3U9gPxQ2~}dRzl&nkRxd)cAv*h33@YL z7`17=oKL>8(?Ry%;~u|$BI$Ro*5Hg!9r<)(NGPvAZ4~cHWA(EJl+v8Y9O<0y3unVm z7r74PQkVz)tNU`qEzNN67A9T-FQURFEUf3xUst%Q;d;?psA}}Savofa!L5KNyw;@b zuQ-$Zk$W?zI%}dphGy{%GhTxF!S>!_*%QvQySaZ| zZapb-GaFUgkm31ino{4b~piHI(i_uM5 z-%WJ9m46)4{w|b`LhFh8iHwUjtf0hQa@*}|_CC7h$DnH=LD86idqSvzK@%z&AhD|w{}x(B#p6q*eFpa3;ew_V(mcq=31 zJsn4}ah|?v3oK)z0)xP7wyn6vwFEE6-HnYaR>Kbee9m()Xxu1mwnK9`q1-F+!T6 z!_R(LE;1CQ(v1JgR|xq&)6&uSnsQsj2*AA|ZEgHS2@SDz)wJQZ9tC>JW9yQ53D5|( zxy=B<9G4%dZ62JAg43E%-Ni6KgI1ef>IcET>L#2xe9Tj)2p2V?ep;^A1euJ;W>bLt zPAoS4fA^sHIf4K3fAMkuE0mM}cl|h4&6SS*q*uLd{~z0khk zpp2WcM3Wx%rdSu4{h>hnf;jv{fn9l7d<#G8ry$r}H*)KaFAvE$+(_!y+RXEanD|%4 zm&5v>t=;WyBGq8w;@PdaaYe8+KeL%Lk!oO3A9wBVV%j zez2DuOif-kgxBi~>`-KmDvx?>yh0TbJmDHntVDPQ*YK|5$!=#*R~*5NGMHP0VqI|f zYKN#xH`TTj;*$^l!z2}LsJN*fhv~g(u5=bG<76ij<7WF+q%w=qh!vcG7RSb4DIWpXqGnEY76{7YNZCY{jf`)sf!Z5M7+pA|Wx!zIT#zN^(`vpmeR z-=8uHOcm^6M|QtUG-M2qD}UKfxGoNBapxP``qrG7mC(4*hw(Dvug;-+5Y??qkOI1+ zi5~>nYg}|Y@}oW4`atj(cHks#eKEuB7^P1xQ=U9H7KZhMT$wm8HqK!RPp&v`GsmEG zHiT2@teY)$xLBlrH6=Qx>N?^r7v$M2f7d+nUDvX8lFM--Qrm5;WHe^wEJkc!SlVWt z-_|3gsdvTY@WFWdWUQ=sRo3%WO~c*c9!#kWXP~FEx~#YE_BRamObA>4kO6A^w?33s zT$5+^HE+K(qmJwZv+XIaM5bW>g&NdzEIRHrzu+SvrA}-DXm=tif(NbKWh8DM=frMs z5)J6!KYmh1J24PUQ7)U`T_(0m-sxK0i89K5g|1z*ZeaurOZ@tE7GCg4kRpP9phSp` zzDZmTB0RP;8a-L8CVni+i~%Q;j^-(XC|!eU_6Bjjo}Dv73QJs%R~?&0BF3Wi+L^d+ zB7X!uQaZ5ryQgQY$~5Juy{@zImPr2wzpI5gz6FB|(rM{8eE8Cx%;CR4pdNOEto~f( zJNCMlh!-wC;Va*hD&I|r^LD}c>QA+o<$wF7&%IER&Zcg8#4(HMav`l#DLM;e))t~5 zOkb`2St1$t*{Lsb`NhL{TJ=+ziP4^MiWhHc&}!N|gw+qCNR^fyWzPr-Z<=)O0LTa)4@MsfBiW@?Ig4vBJ?JiBU~2q}pd6ssL^XsTik_ ziDf8x=&P{kW?tpK!-BOItH}Hdt>7F@RibE%=9wF46bm zllcoV$o8j*8CR!$An$2onot%E+VhGGMF`8y3UxzGJEM4=TAEkYY?B1-pp=P* zmIt=cq41Oykx{Q0M$z1bPJF7mFlGDuB6XT*WN2g~8Z2@FRsApFq~oSiszxRtTRx;S zTPvB3dTKD9Dt^7g*Ws;c8#{or>ewoAwLjEV1?UQnt+dBA z;84YaR*lI)w>fv#3d&jB)G?S&YW7I+&kwFw@CV=Gx;*jJ@J*G{>trAB+|Yvf*t@pz z`&?RwHeil;+WmCT$2MQAmtR&-f{jCMeONy~|9!SUj&|vB|7@Wtl&iZ*EpfJ0-=T zxOXHwso{cGwK!oSBJNZ&GLopuliUPS7p8tTUKM7IW7V%IKK=Bn!N&nO4Rj3}r^OG) z#|8m~gum@K1q^^5j&Z9-7<4*_RtRGP!}>E#H0ORRpBtM=;sNo>3iUhP=PL%S^DXd( zAJnOd)nM7sv$Uj0nk9ntGu@BA5^8pm$? zlLQrP{lWK_xb+c|$M*d~u7K90pCoSZ1X(5l2Uf`0=8)@FlO0IOZJFPGKp_YsU1;#< zY7z3e7lRyv4G2;qGtq#!^(RUU`reYYkCm_O5A>Gz4fw++t(~=3x~vSC@u`bgQ>~oS z4gZ-*T=DL@TmXJEiq{ZbKIs_HxY`^OmAq>eJ0G-!G9+vay2ZcsvlrX28uFadP&K6( z2o$VMgw2N4*s^mJjSc~puQ$0-jMF(RNJjVM#022MWYuKd>gNH#b-=vba|7Kh$c)Le zJm>$Mx?v3J#+Rp+f7e?7?M)q#L^P{<8ocs#{6PZtVwt}Cx~nea`pWG)mkDuCo9imJ z=Uvm7DSm+yoyALk|Ig_}(Zqi=F$KyW{3NlI4nBt{{)l&VCyw#p;y-;9#GZ*)mE8Pn zp?XnO)p~v9;F=VmbrWNyxFk*-fRS!l<-FTPb5hjUD>bGV1z8ZeN(_jKNv3 zA0AL_V%ryN6jd`B?Enk-Nx~oNoH9gOx}KW-V4f4#TTZt$=OX#8BQCu52qk9G9jlhsQ>fKWe@&eTqO3tIK1VWn&)V;e1U^aeeLI<4 z8D9URz5n+r%+muVnR6mFXMUp8FK6TQiQRnN4(=yCc_fEhasHmM2dUS1vjq*M&7Tk_fTWlyPfsEo>-U8@+gPe!&mVK8y|?NDhY& zstf-*cZ$DBAQrxV3Hy$XaQ-FOa3}b4-wml%en7EbHQSv7nWVw&TL>@ z?;A`ah3oxO6I;PjD@Sh3w?js0#%F~+7@I!GjyvqDh&KAqm6xfPNCBPHed~uto6+Hi zEWy7JepxpfafW$9hjY$!{5W~7Hk(UQMMaIQZYWYJ^8h)CV;$%U8>{0ipbE-w#sz-Rc98!ugFkglF zAOu(ZAoiBU#G!0J!9hMrN4PprziP2zE81#WNSG^&ca@oWBh$F-Qc!%@UtT%7DM5Jn zmm9m_hPOuK(?3b-@vE#~sT78Saf)uY@9N)HcJ`2v{93~T5#ID)+B~*2Jv>h6muhJK zGuVQ7bN*s|ElByS8$aO}yiAnkE9D`yxTubMFswvGfZ}Q{`Modu)>pJ~e{WhVWgn)? z)1M^oQ&%It6%ogn|9&Td{6E6{=)te}5+B9yK*iRM?vkO)_3)dV;B7z`gF68pNYn$L zeV{+OkP7VaKYc$zx3XCe|2n#P=&o=@TSb4k$-%f$!BR}0O+fCbpxT%v1pQxws$Z!&A&+>=B0A@Jf8GU{wnnAl#L?Sah= zgC+@)r_JS-L92WCbfQQNeCL)Z<*s6H{XxWc$K#JxuUfY+VLwT_b2spdPoN&99$dG2 zLKLQh0zqnVL5Bg4fdX>J51NLW%QHN&yOZ2Ga=VA6!Nla^oMY}JsAOo;>nta>4SCJl zjaN?FsZ;dxU+fv##3yg!v*~9RK(q^Ijk8WWV5i3;sbt?xwHh6WA=?A~%d8O>cm6PAW)@_yk+%5BtzX5wZ|KmEhR*EAmB4p-_Vdh$gTO}#mOnQ0d_g9?)EryNshT9N2m7~;*J*B zBTsP6m-~y=ztHgi@k<#j{vf6Vu+86oE!SQG?vPWi;HmTW8EAel9ac8G9fa0ReG{*w z#1~_%>({T0rR2bAB45-%iUZwS~QeD`7eMfX!Tkzc}hPPJ{-X?HNr`k0s$F((yKOAlc8VzQo$~Pt^6(nDc zG;9s4w0>972`R%sJo!0~teuR`Y7+41?S=F@{zeW4sg^zc?}OXD6C`6Ls)!S-{lf1# zJ%wLT1%DnpD!!3{Fh0(>dyafz)se;@$0d_w=V+_{>=7b&Gc7==bGXY)kL@-!Dbsn< z>!5M8AyDnPM!6tH{i|-C^6B4>_7HHZv_TGSZp4B2dKuvXv90oxh)i2pkDyMbG;bm{9ffb@MHV{;--Bi~5*< zqlfq)6&J8%ufu_~xU@-lrT%>lFH1_O9=vGAbAR*6PCT1;SocsiT|1&9LBxNLF(&TLwqS`^J zymbn4gl_mVs5jC6tc){Znoa4ap9(MV`C|793 zOix^Esa5u%NcCs-21R{TWPTg{A=)AUrUIzsccI@-efIhKPxC^v$%RYx)CdzupnWF~ zpP#=i-g&^KPN>Fije3bVE4A}-E(=c`-)!ovW(Zg04SQO28m1Bm9?O1FFm`0bSW)#Y z|BV<^6{}x_5IVfN;Kd_ftO%nR6Q`}~v3d;BsdhSEaE+%-%hJGhas>DQvlZ4L_+j_({S|+Y|5Ufi~szOwnESu??#m_E$ILT}$#g z{=S0^tAVZtz@cT*f|+{cpy{zN)3oM8g%o{IFe>BBlk#gvViI1woLks zba}+1zOypLE*XW#FyY@xh(59ZAZ0${{Gy1<5D(hih!aGYfYc z?8O@0rfLOyjd#}DUFXDm`gM3}7@yFlbrdJVs`b%8J2`{O8P^Mnx|CU9Qa*cM1J?E( zl5ZSIul?B=$t#ASM|#craio+sQwoT^kV(|tM)4)s5~sI1ze#}BE_^*9a;@yxz(?i{zW@)$gM4401#yfl4juI>|d?=Ka zDzr;Gmi-Z!#)UBRE+Gl7$&smLB4*83V{f`616k#P7vbnaCBBt(;W=#%2#Lmr?s#D#vzX1uUDUN_B-B z@rFj4V$ef>%*!ZU&B3?QgSRcT_V^5)=ZZNYBcifwx0OUsSSt?^1WLtH{ZEuqAHC&J zPvF^4lD>tz=G|+{XPk%ApA6tpIqSjfTDi^rS8ImUvVC(uNpj_Xl58#b9!uu<;f!`% zWx5W1>+S7LCA!7-?U&|;o}~t`5>LMq-eX^XcQ?(hQ-ToDVCU^vcE;r+bnk3~JVkiX zxJ56?+L_beU0D|1%Rh74oO~5mb!!oI^OoX@FZkeV+=J2FTO#Rhfc5YJYTN%O2}^JW z5s)qcA2$4Ee_@#Zxyf~v@b2o=zqAz-_VA|ns^@C<0zWj_@_YfdC3kU%3py#o9FSo= zK|~aD>7iuLyn{5&%I!CWNWxdkg&${lPM@(2Lep6dH2RZ)#B?;-&1J%vM>I)e{#OHMM zb(+FS%O&hExQKf#=*)RT*p)uh&vfXTPyWi0Li%E8F3gyi>unJk$qnb43n#9F9Q%@6 z{xYSBSKWQSELw_vZt$EeYa;p!Iydnndp}UvQomP9a@n{cM{!X>tJmGPMJr>jD#?3O zzq!0>t{>kYAB_Hmm}_d?Og~e)Bxagl7cUSuOX!>b4opHVJ%W5?75~(c^ij*m?fGIaq{(iDnW4xF^7H5YS6QZ2~PpUry$aP+tr)nb-7&0%(V;W0S46|Z+qC4 ze2cp9-jH_-wWok-2 zW5;vIe>Pg9eP_Jqz3E*)L5gRNb_Glsy+yj4;K~h@9tvz+2F{3)Kd(e8WCVou2q*w0 z^wpPR2YoWbj{6mCcHhtQxz&tWgAXV{05ut2No$Wx;IK>Od zXKKlD$TWlSYMAKR4rJ*B6SiaYS&UtG9~^Cr7$MTT!GW}s1w*c^fL1GRk9$|B`XG1p}m1}xnXt?(i)-zA) zC0A5jjalQ(G7}26HE%33F4zuf_F`h*n=K}IhmNv=;y*Cdw+L9Rvy;|4d_CFMQLCG(w*dUd^9$ud5pc4Ga=VSmME|DU1mwnER!D=k zjLZzhCh(}SaHHKb{h5_YgaUujxgI#A1}AjzszchF@_pb zIJ))2_V;QH3|*30;C_^P#-ye_gV2v37mS+Tj{f)y>H10hv0-9kF2#}Ea?$)$NJ?f) zrg^pJ1V@>tU47^z4fBrIue;+9lF;Ie&Ch2n!RdH++iufW(J0#0uATAsjapw_rWL#& zgGl-49dwy5^ddk)qg7kktNh+Ldw#ZU7b|O{mwlG1&$#)A+r98W>7OKP&ey}Y-xX5vN1GSr zXKm|j-E@fRJX2BTd>VFU|*H#h?)@2d;rD<7wV2RcLT^L*-@pD}|}L$iVeIUnqX zWnMfKk*auozhd%Xah%GJbY+_YX<&ch}G= z6q69n$MqZm28P$SIadoNF8191g_omm;yUgxMSiDafF^!k2jB8U6?4?&G{Y%ksq^Vi#9)LoLej zubY~OE{+#(V>WX|eK#?lEkv`B(^+OpZ7r39J7}WiN&gXpckA`-SvfdYG8HGuG3V^e zw(k#{^qM(zv;MdQ4|>0Cc5~9VZmZ%&(8r1CV6XH4c2&dcu7v-6$AACVmiG(#?>*nH zm(6eT2%jAFY05o{HNkwbaq$ji6op*tq3EIgMz*8hNzZ1S%+)S@KKS;Lq&yrWdNSX< ziKsvaKR7xZwvs8MSjagec+?-R`yOtpNZ=AfaLos&vkjkezjuG}u`!b)mg8~->!lqL z-gvpj#^^u(2O`BiNn-u;A4Cej{|7`0%D$XuSHvlSRKLDtoqtd-9Mo^wcFleU*(g`^ zPe1$GyyfNGKp}F``(KM&assOVdvX0YYHLSRqzfgN=Bl5i5r{R-5MUOLxU|fr{<5%% z=4@Q`RArrjB3>k^B6XdBH7A=n-AK^Kj_>==?A)wZDgu;m3m)7gE1p>>Xa4Itulq+? zZRy_&a}+4W>lmVuU2);T$l0yjPZIIlbLY+cYD6`m8gS;bq==`$TQ|&E*15XR>o@-- zX~t(>-&mN=XC4Ii2kjp&V8;VnJ#%oAObedP3+u9_IKghZBgJ7NF}wS#|6;;tTf*`2 z!e~}`(A&VkQm53GTJYQ_u5*e90^CW2rg7uLzP={2QYYI$$HSmT@4YX|z$FrME0<$3 z)!tZrkwp=4L}+0}?vpavoMdvpGgo^_s2MXE*SxF6Di^T6oT0*YYgkRxIDriyqT2)L z*<@&86+rn(+mkO8|T>b%t$t?6yJ#f<*|DuN#fHbl;&W)Z)=nMp3(i1o`i0Tks2;YvTft# zoJ**Jb(pVh@+Eq59ZE~g9y+`2Pumkm!bkvSQ}-CY$eKS8jcky3wv0uXRtlC#w{kV@ z@+~5iLv+iU;(8vdPV%4VEoNM#KSOVmDGa|qh7rxI;{BKnar-6TT}aZ6OoPe1@R%2{ z$A@im$!Cb8_5HT#3oWWX5UE16c-8nVdVF_ZTzJ%TBrXw_Fspipdnt!ybsiDrqv|^M zZ5`sOGTh!kLy8I04*`gd1O4nIg7_Cs7{u)y`7Ifyt%TIpFLLiWtsUn z#D0Z64ilO~TEn&v(s2X{tJ>;(td2%{Wgj3A^Qz|vg+BKNj~rSWL^z7OBnj+lZ-V0X zM>@(h``?$Y%hkE)RbX8UJt7U!=?|QOU_`-O6``u2Rt=wwEuBNQKekY%} zAach^V!)8_if6(`zr3aiv8+IkhLWCqFNK&~V}McPU*~e8^{ad~0f$D&3hrox%i-Tur=`{}1ZkI;zdR@7L^ZciRm` zHWb(0;$GZg7cGH62_CFSkl^mHTZ&tO1eXE{5Fn&T@Idk6?pEC0wUg&PXWn<7v({Pb z%&axD=H$=(mzDcYzW49*`CgY`W=@8!-q*e$T;HivOiIokead9ct=y-jB8}*ik*$n4 znWyT!gTfjaEzLp==bRG(CpfwTnCU9pGV91{7vze!EjOuaEbg6W!-Rj%?(_&EOaJ6U zgN%!F6%VO1LqMxvulj-}TYV6y{MJ5|(aTwUa{DUOao&fbrr?#*EO~Szp$H-l3c_j+ zeG4i(7Gvsr$sp=`?j9P8izkmYSgaI`{OOoeUTq52YE#23u|Ig|NEV$KxwViw1$;W` z-H?7?F*Bs1YQW`&SprGY{E|&Jv!&Y$0enZU?YAb`QH!5f}25&MmGK4 zLTjaO@MWcCh(6kGssdBL2SWCTSxiQ6}w%eqM5DYQ;8x z;c$X-*!}m;&k=0u#Jb~6#~eZcV0~4 z)WMggyivS8EWZYeM$nhDO+Ic;}HXu+Rzr^EnkLfFRVK3q(=$gN)kJYOqgxjsVcNZ@ObklQK zNJiFvVlztloj^?_oo&(*P^P!a0}|;e_}XVm1Pss}z%94u92f2zQ)?@BC&_s(-3SJg zv&_Hz=W^2NFkJvOoFKlRllUNPCMZQ0YbQW((r?vD^jAMy9H?ExrQJcAVh>P~=?$s! zA6_=#LULu7qqW1+o%m)UU~(8VK}aYa&KR8R%x0om^(4*8yI>U*NC%InNM1m1%Fs}wh zl7?9|qWUKkTWJx3u5@1PxH-_Y$EZkhlp1TYT&p*_)6g336VV}18#XtE+JmF-IuXcout`^Ml87>=2=NR zF0)+!SdJ7xXF1`QBW`%677WPEq}Fbk8QF6iz8SxvAq(n_Tuo%nC+@K^^X~7q1lW_a zNU{@c?SQCeYxG_}RiQ65C#5~qJP7%IcgR1L)NCAC6yz0Kz!n0&&H`^uev#j4s--Rx z<%MwFTCqJebCsVB7N%47L#te1M7RxprFTc%(*@z<;DMoMiAJ7)$N8-%ciwELUM-+-vO?bm>9^ zrbSD=R||U(`Y89gGv3e7iKgWuRhARjMMH@bOpQ$Tin93vCFWMxkOFKpR(NM(T&CPxsH{F*x zQAK3KnERmAfFO4TLJ008{X1{=aW(ek;dF!9Vnt#Q08&U#r9d10+Djo%N^x{!Fq3cn2VBS+^}_91 z2+_QfvKj+Q!4~)9U!C59v9I%fhvAVK)~QN5^zP0epJb_)|3RASfe&l{PiboUZ^ zN4Y=8TZW_374WMa4t~ZhdG|NF@*Z~0vaunaE%=qlRK8j}^VyJwUys-o0+X3{RR>#c zI)3Kfns&Ht?Wf+C{&Sy%S@}3IbGb8(sf$=m^g6bP$x?6=xEU0Da&PI3xd@Z-Sq_=Q z$J5pctEze-PbW~F_R`xoWbuEKu(Vkdy_F1 z@mjTVWO$B0%F+a*WKn`J4XgW{N6xbM15zcUvdquj(uKn<*u4bXR)f1_HI?ck%CNdtIUac+J3X&77%K|EFHTf zbnn#_<0P`}Yavm7!)s)F#o3{H$le*S?p%0c^7cA|Ub6WBCdJa?p;<7?9Mz?cqp~Oq zR!cJm8_wc;ljhH91*|l-Fe7fGeqp9;H2glYlyzb@Vn#%Ne~hhrhw8YCeyXV$Kx8V` z+O#}SVsYPf>L3B4QrWXjs>7t$%}5*w9{UjB;S|hkC1!<>kqg`@3qg(zT-_x*Sg2Z*BP0*p;V^#yrU^(rLzsnhZ8vrVbd3%xQOmn68#&`kN zRTy-nywc+azOycPa>t-EBbXOfMb1tBTnJK=1T7U;&w5+B_3-yy#iu}$%QBi$TaKc8 zWY+-?4(4vbs!mBU!HIUhW1KlJnNA5EZc-W>Z;j@3A9m*ZaHl@xi=Q>Kq^N-C4R=(= zHD&6_ksdc(i&&5eu9ZnVj;3zvOi(XAn%}8Vs4}*e^!ax(Eo8GQ16zzNwt=D1qo8GIe<;y`} zd+5qygK6PS5wZ)NlSmY{NY(2?Na7*Xc8;slje2Rj8qP4hP+0TXg#if7HmO5lrC#o1 z^T)@#4Ba?|v=Na%27l-+=e*7{_@VoK+uA1)Z&XQK2e(@1qm~3K4Cu>$yhLA1v^#gF9tM4eU5`+7^xoH+rHt#lsPETU zla0ndwjRxEDT^XSJ5q2_KmRN(+`Ura+U-UxuKL?E#Vqi#Smv7SxFE{+*}QtElV4TyvSjpE{Hsx7a)O93e#O|L}MlPhs2tu zF(l=4%HqSd=_*FX;@#~8fD7l7)X7d4fq}(YQ_a$pFqF%*cQ(dq)^n0`5}ocm;-qeq zK<`irLf?94QYESscF%!Q>q0fd=iZI?U%UsWwckvXSn_C*8J+5*IJo34IlS-DsVCVI zpdvcm2~^jAJhhp>8d~~yL}C(SGG0lHSBjz@VqYkB%THl%e-B}ZJvs@HQWesMF{D{K z(`_g+?a%Wy^Q7nC1Tyqm4D!sdlEQp|6pEkd$HWkFzCN3(r$p~c=Y-Q(`NkUn@dYB} zK=$HGdlP|NTfco?eS>hgql{}}sC_FKfYhJLX1z!XnuR-)4p#Oz@}d;!!6G{iCrLoH zt>vddFL!c(IG0~-Uv3pu7Q0N+^{*OaA=pgy7b=eCC`u`NV~Y6-An~=fI-JAf)`8SQ z*7_P(PP^a#KDy6x3-gaAC0Lu9()1iPXUz=mnBgexoO#N5>KAOgK+{uuJKn4x9e&p2 zIkqIrl7zZ4h!DGXArz{2)SE7Euih2P<3I0+iDz*U*Qyt!^^6kcacM{pAnBDc>clyUqG>BfDZ6Ydi`%!16v!2lRZ!~4vmDf}lva3!1B|Xl{ zV!hpmCqnd!9(<)jsjqc8EB{CtJC7pN0dR2bk~L3A6v7!eh8GFdR-i_cwVj_P-d+MU z2g(z{+pjULlDs&xzbxlBMh z$v`89u8Y?KsC-c!W!PS(T%w5?P1Fj6l~-n37Q8kkR~Uk*@~3TQyo+P^^Jw)OkU5Na zGo4nw+eVnJJfTUz5z?TabdlfHY_%LV7p9w*5{$RmjZ6}DHSTeP$>^qQ%5QG1Z^h!e?LebxM7;>lD|fcDv{_%?uNRYgl5zJ^%LY6MDHMITkPwF~rbuI=dP z$1dfs)Bw-y?R~6A!Ak+ZuZXLKs4h~1xtsa#)*w^;98bMyxUk3iBP|Ztx=09$zR!80 z0_wv!C^cYHe6WDh; zc%pMUP+ztu<|?MiXq9ZTz*ah6l@($am$;1Rzu&Rf8S}w->V|~M$4k^4(OYc-D&x)z zH$BZMSj39P@uqJlw|zGOQ1tgppGB?C8T%2o$@S2{6pbPiDmgMMZ)fLOlM)Z#G3|oo zK`Jii>)+QCUYr6XnmZr3-`Fyr66tz)u%OE<;%!f|Hf9%kFPWK$*1B9Ot)ow z^P8k1L7-TtJOyuOBdBINSaDbJ&#&`)+(0}|kG!FpyI>FzXZP+O*LeRcAGw0G-a}F! z!YHpIKDJ%AQF|}9cQD&}+qM~q#_L-6+1H0zDNL$i?TDBMpta1XJ2t|`eZHeqUsQ|a zxcxVbU&W5t{*Y!W<@7n7`}%PCF5OW9pX+*gvPq#Ve>x~$-F~9$%d*(2!?c^EPJHY7 zyfUosg;7a;@av4~{K+B1K>N&EZ253n1Dn1we zI;y1zfwJa^*)HU`QE8b0!f02%8JyYz_<@+3Pfht#rVIgyzLpd>Go1uPHaIaavZf-l zvgLDj{**WBiiM@>>FChNX3Csq&``ieD#3w$;#VC1)5I|9uqTu*H@n3%8g{z7mc1xF z^YDh4UG|ye_a=0HoUkHRu{mcxil*97-%OFR;^iZ+JgU7-5PueR3@mA`ByP#w32|RH z_*c)7?)=VF5r>Nkv8L7x{o&$XQ$YQ;XZl&F`2veka+wul5Am%{N1n1NGPKSYC2P^h z-yS2lO?GoL=jOJ)kV+Jx=>!Id0@nC=Yl6Tso-Ay2I^o~u1>mYr)KDv|*Cj){Mb5bn zjQNdN|JnfA99zn&GKY=<_ffEdyfO3OrOQmEe!X}yJP~lA@1AVj)erdEqR?qFHf~o7 z;u4i`&znT|v(^+0S>cZ=XsZ55C3I>#w=6I=5`)oyDfu($*o9_BIeuS0(thK5+?B?N z>%)rGV9glFgMycp4%@)6K6oekvpH`q2M z$$wV${UrW>P}T1sk`Q{dIe_thg#6Tatsq8;libF&*S-+GqM2+mH z-TE-U8I`6CE~U~#M~bn5G}1(}{{99{%9A(6LP0D^3m-WVV`-_+^!FE$+R^R3_G_;k z>%ZKowqMDy^{%H{-pw`J0inyH0ct)6V_-ABQZyZwR>eND=eVMCcuE~0V6S}8>`*j< zY#z!>G4zMrNS~@YfJ#Lex(p>uJ^RDQ;3lHo^zl()KG{_Hjv{9zIuOrsi}(BymM)~r z#Z@JOlQ5K0%UkO#yMa3TsLJTUYz;oZxX!3&{*H2a!T_-AepEX|^pNCvl)Gb)D5rjy zRGb4XmVjfSJmCVJ+b0qv9KNQ%n`pwGGe(>s6>ZEV0)mB%j8!uYG zZVuHtiT3#Z{T6bplS;Z(wQ|fYmC_%fQiBLaBwu_XzzvRFn$3mr= zXEc7-#@k11fM?@s#)@YqxKdm>Ia?5Eq3eHfZM0FP)HRDZLwbMf{*311lhE%&JUohs9>M@HMf9)0e< zCk&61Nz)o)FAEVi!&l|v10|@RU~~7t^8a#)kEB!nblIK5tHk3u6!PMfmmiV*uh#7T zw=otrImJrjjfHNHFVSyn%KE7B#=<7&-S|SRDDbN>)gbSzXvsbF>kbGj{tOQIyn9fb zWCN_R&5Okw3n?okNu-G*VzT|yq()-(4?sn%Nykppcw-^J(?dfPidKQ~j5*6J6s%z$$iUUbn%R3%{&VyujI!(quZ=~?Rrm>>s(0i>rqH@OMv1Q zON`w2j=-4HgnXHVy%KXSys>aFUhmXYY_kY5#Ng;?mJR7d4m1=Povs1hBgm`ICb_hR zIP$yMMz;vR6_1E9~%7q~Y)CYk=6-6eOh0K->cHZZuM$zlRXs!IIHye)I z;*^ahCajHA5hm6(x?@nIzv@s*3R@Qt_!{jb2j#~>PKEMU3c^KxYId1A>M4NR*7H{; zkhlS%9T7JP!lW<`E){RJoxRnDpixn;kyq=#TN2}9shwg*<>TOujl?cDrnFRY91~6% zuW8%nniGY&b7gwvQk}p83wzyn6-+RAo|;&X znh=kydRSdj4a?%U@0Ly23(q17oO_bCdS`W$+SzGSezpJ~FOZaDS)wJ8eJ+^5WYc(b zC>zQibc&6<+O}!U)oS-0=9CBsC)P{Xg*G*^55%96m3m1;YiH3?^VwL>CRx#vuT=37 zVGQWO@Z>D|FXPMopHj?Ci=v$dku{sC%1gaTaW~kYbepSCyizDbixMcR&@0${SFv;N ze6S#3xtF8)@SDLmo&sr-O_TBSQ3nb9UYX%hiN}_Xdq(~Ou{NKvf;9|PO?~X%U&%E= zMK#WuOIR+*qQ_-(A zvNIURXmV!b7u(mWsYX~~$&Cc@DE&XiEfk!<0@qhIMA9wdwBXe5}WJJnhqgTXfx|!o>L|udQ}BIG}b} zdvgf%;qNj78VUAJx9qvheI$=v99tgku<%_dV|&_q>IO+>`8Mi04r?ao3yK zhYuVr-n58Z8)iUcwts3M-w!b#{j0IWMHX++FZOeVWRJaFpm3RLX)%Eq84= zH3Ljc$w?=FexesGrn5VH`(6t!OZg6G zA~3RG#K$ zZxc9+I18~c7rN1z;Xu^bKLZs^<@=-ej$e`=IP%Ghpen}M?|xKVyJE;?RB`&xDc28c zli|3)$@SW}{S{O3>~+G_)XM=YaeqOP8uT}f)_%5qgbuT`%wOtX6 zcUGTjC}-`Ld@@-76a;Q`cTm}bkL!3BM4hf@TNcm}lu`1WEcuByWo%cfIj7vzq?`t( z%x6xPnY`(o-&*uc*PW5*u4|iT<%)G?$c(5#8w`qL2WTco&^M;t0g5qC!^o42XPMxs}aZ~ZV3 zw)4ungn}c-yaPiI!E};1-qEVynY~HgvUlwc(O$XHG*%w3ousloM^O_ZU5#%he?2Nl z$~69l!2K}_7z-jab^^pBn))=U6gOt{4LXffaiu5YZ4=ROsl+NbC%>xD!>RF!v5{(U zEQvIIlGPnnx~qv1NnK?yDP+EDTQa^4Nz^#`+4An$llN}j&!L1?z6g*&A0d*Pr&gcN z%uy(UTMXOL@9`S!sV)1=@_jh;P0HLBYevePFQ!9AK4H13%P3gVyo?=3+l?r=%2*W8 zq7D!$nyp1)@#}J+a+;{w@zl> z{Q8x*wx*NonpJ`&@W-1qt{EfwQ(M?)$y#9JOh8GSR|E(k#6d4K-X-bw{Q0pQhg`R% z>lOEDo(?ToI|(o-gksN_vdQkNh1*_>GGK^R%3o(e+ev{Ui>PAOsfu*g(sRD^Y@F7yR`DxA zDN**8*dp_~QX!V_3EUogI$RW&xnNrRZe1AdD?;r=Cf&^||LLX}`mpxyOfmxkFd5i^ zOD8FMvQK|>N}&hhWk1}1biUIJevi=v1@!>M?jyHKuYK<+mYn&LZ~yGn`uS&X}YZU5(bBBBlI4Z_ip*NxwmZ&gI9Ll_j6gyt!t( zVYh;0N?h9yiV|+tyN^XzXX)n|VeMc%Dadz-`SC(7J^Q1Xyt#z)l0ZK7=W(aeMI&DC%>s>XL6W1M zs}KHzZXuJi!w+8GfA%!vH;}&Vk?y%akV7(7a(5p%4pMK(_?`?`i~65SW z+a5KN9J7yIu3oCzns^y$mx_eQtv+y@R0r4fxtb}+EWa)5ge^wPf`d5b^1#m0%g(R* z>oAmY-o19g6+3Y!K?3AI4>X{)C}>9|Ow-^ssp^HnO1x8Qvz1XB26@R2u}cVjBHf z{bc!Rk#~`@%-5eg!A@!-yR#@LhUjR-o$CaY^g6e@pQUd-qQQB)v+v*|M5jp2zB^Cbs1)c#X`F-@W7jHAb{rXdoyVIwF^HxO zV1*7RaG#oVh3lm1_g63%j})#=89)#QvDx`eM%J!|fV4eR8Aj#_Zan48-20Av;_7u@ zOS(*VOU=?BAs-BKuLHrDA|}%d%8-_X4fbD;@EXP$iih(Dx9jBofLkZL9pI@SKD}(; z?oJH~Ge2Ctj=-l6)ECO~xR9)2&5#r2NJeI(#5$qvNIY|4PAt=Twifd2B(F6aSYYaX zKBBIavLmvk_fofuObe}=3G_^{ElVSz(-^hp7bo7la%SsY&9KN{rsh)ate%HZS2+On z5KVNijhYRNIlB6u8lgmzL16Zbg#c%qU1M&tO9pwjX2O<)mSOHBMy7n>oL3wcp&OcV z9_Cule%M|T^Eq@x(5gFEE{<6jY23iUSTF(o7KDN@KR;&adJ7KcCk$pdKDB9va9k=6 z|11k>J_(CRzCja6JWT9TU#&E+l?rH-cyPg+6SI0}$pp1%_;~QaWb;nlLPX*=O-z7} z(@t1b%oxNh88K`r2)2>_b9*WdP^#%wGaNpfO0f1<4SA?E?)%bHn>)cU47Uh}S+*#^ z=d%e6Rj%jbG_PyjME6&q`r+O)53>vuNTf(yVip7#JFT8VWSUj?5uWj%EkW8g`UV-- zF=7&>YHbV-Z4CfEI=$;?y@|21GCl0irtS9*LT=A$5F=aSPGVWB?@NgE*@aMp)#=)c zzKed5HDmF0PehRE69ev0{^rM38?J>IZufw4<XyrA*P0Q`wj5s{Q8+X8SyU=nGrHGyVT*EXSp5JT5RM?sRr9=PrD+yhry+(GPtq z1VFK`IFqLZCC@5E*{G}SWGiFCfteGiHTz{ZA#{LyiH`F_xpC694b2~ly_z^mE!?2k zwe$PUUaIZizV98_&=aDYn)P4$Py7A`T@c~&O{SBsC{B%=@YmfsE#(9ECe49%#MU2+ z;wV!#`G{+|L2LBC*KI=;uSsW$h&O1T8G*|o%p8#&gM5l*RurQf2gw`G3zQgJPqZqH z&6UX*ttO5503a5;u{8(1I0W>Wm0yew?05IbwPl8X43(_!f_|p0aN5)8AmXcVngM~u zEXQ-(plpYF=-wi_Ifb=veOJYOFTB_b<2GP3w0yOHfdbH@i3y^Ogq;XVXE9#N#;^|IQYdP!p`X9*PS{0a!a`_8@d9-apHS@%`7B~6s zmupNw6*r-F*kKRyn&r5prxmZBSxOw5cWI;@YP(cEFj!hzAkC~5M7YR|9mJE|nr7!z z#`_;#T%eL{W`>&NUgUvVl27jDOYWK$RZ||C4P3N0erEMONxj|u7icB7=j7C@7KXza zm~+{i_eE@V+j^D1qaIqLkWYTCtkZE{rWY zh$h!JyJXxdGk9uCW~t}3)7;6D_G=l{4?5bN?nCOkGvZ{UCpybbx=AI79qpDbEu&W7 z!urvLA^|jCE+gdSX1t5C8I?Bb=Trg5&wJ_xyUUE;E#vLbVoy&q(K3O~G`-9!?yGE5 zORQUKevOW^j6l-_xh$V=D0D0DBR(~Uc6=bGUahWW6g2Od|xv@_OEBh>ieX( zGbJr1+?m&;HIxOeK(=ojMrL7qJP8zh#&qk2)u&23Bv?ChN_y{|e9loDuzL6qB8($L zS2>}snQ}#g(m<8$V+YFI7rzpI5BdZ%uc+L4KX?+WA%o-vGMUqIVs}ARX5$X(2!URr zUODi$ht;o;jQeU2!8FOErH}TV73kW%F5Q4UTrH>Q!76h9wT-y=i5*9YN%MZq$+kkS+}kn8e6h3 z`?-l`&jesVO25=%d*j{iXCmXH3z^;B#n0sI-`$b zohX0CT>jHK)_0`)O&3S#3b;Qky=ZK)SC;?xwUMs37yl($)xuAl|4$sN|NN_bM)~yw z6(YU#Tt1VBG$bpPd*5YH;p{uisv zmH)Ye{B(6l8w&rNBgFH4X{z@2_Z9}tFh#nUwnq$KJpSEP-7`N0EQkCql%;Kn1-AoQ5>}awMjwaZ-IT>X}|DRhvID)=Ajxx644eIa zRpXPw1*K`4YtC|$%xM0w8&a+vyl)1oneg8BjrZ6*q z2I=QeVWqDCFU_M0-_n(amyb0$jOAhh0w*G#uzt}#SI-1bA=A2uPtFr8=5_6<#vW9B zQb9|49|@$iVT0FHmDXbW+FE0w44s^$ajYYa6<=*2B?s|=&1~u=E~1Ty4%nC z#f(mwKTE9YbeL#$MBC6UesM5(#%xNH?A?o4NV)lPFSJ&>CaPPk`?V`wDoRSx4Ixc? z){)|bYc#4+lZhFWaNr$qZ@3QR(nd;E&&IC)QAF!Pov+!0^vq~zXhs(HoyOWcr`Mw7 z8qc!esjHV3tpYC3D(h9MUTtqG< z6gP3%p1NG;1kDa$-3S|S1C1FT11#IiBRzlmGGA@ zjFcNCdxc_IR=Gq{GG|Piqi`gK^QS!DL0&wQMV{5M)<}+@`Pugk{1=IRV^l8Sa0x4K zwiRBwm&ZGGEzzm)U6PqXv2_J?N}|6TOYo?0?f}8`#lfI@QOo#IV;B1gGIAYMA`!Or zeZ2WU$S_!P7@=TH^4L3Np62~>!!l)q=uXW_GcQ0AJf%4q*X&Vxq2s!U3iUJWQ~A?? zyjuTTslb(J__?Q4O_m#_Iz0)x&+=<3gLM=fEwt^xB0|PGluG=J(N?0^sw&n@EO*DN zLevJQlZ9xuF~4j6{B4?$#vVUhw+T$qAg>96#Vtgu5+o#}eYyOEBG8To?YFh0rI~Ic zY}(tG5E3uS?U7mV>`hJf6rqwA($3hWCM?e$q^3ObPnTX_#kkvl*sQL4f5*G( zNZQTN*YarM4OU(U^_+TN|2kf6YCSs`vPye!OH#dhalrO7hfRM!`g0_S#N2qm5GlWr z$W)HhfjB5i(CiNu$c z$t13_<#Qaa`pro;>!>le#o2e1zSS0zX`=?bSE|e2;f>6^d)1Nf9Jm-xo)HltgNK~w z2nGxC`#k+1yA2CiaoB;ct>5Y)3|5nF3%u*DBLu8So?2;=b!U`##)8@$RoYXy3E

zUu6Sk&SM}bROZunnZ()#I&8^h=~9b>qeL*Jza+i6K6nt)OqLfODuoMg`JUM%kDr{c8?jq`3I@bI567shsgMD?+(xwn8>FR+ zhQF0ErdtTg1p!L1Tsv9FCbI!^oKZIEiRqX?V(hA6%>qbH*f32xIytY+aqVSSG)p49(l@r#lR7k%8jS)&Jf~^v&HTTt45J=JdF|9Gqg+#RNvy~FO5K?1yhx!~_aGq2K8X|(NyaLJmf-lft=j5(5Rj&) z>*}kaw6Qd)rW`b$p&fnf^g1tcpt7HpQA62ZJKEeNGZ<06R3V)1^Ue&yN!v1*Vj;{3 z)!rO-G66OddSQU2V(paH#=6{W?Bie6OS_}@B1fPTQoyI_pmfD@WYHp+pqoG%+Pg^G zTVkC~LeGO{;~q!N0-gHjlGR(qM*U4+cW=^6+el_RI*Ck34k=w$s_|S^mk&nXznIo> z{aLI0@SfMWglHDx<{M(%jMOOsGWZ>(b!PqDBxsgRWdac!t1!1o_pgMDtble^j7g|w zbpPTVo+hA*`bl865?jN#Q7j;iyIr&l+iAjy~~ia7}^*X4@Op z_n@tSom-OwDMj+jWry^cQ=Jxer|+|pwQ@3AGExTB4jS@@?@5h#?b`TSuW`x zs)9K>Z6rPK3Q6!70yvWXWVDDH0kcMPVoQuo?QJ$qBttts2tg$@O#B4@+-zv@Zd#i} z;Sa@C@M0bj5D<05hKW!hf8*Kh%(THXqeBKcgaPjKjsNMc zPmlq{H|Xlecc*5|mQSaQtU^?<+@xL+R{7li&23p6RI>(b`^+)E0dhaKKb&N#!aKUD zX|ZcNT_d_XosENJ#=YEA&5d^Zs>=*9qP?eFD}v+oTv8-lrwZWux3eS30UXPDE^c^g zf-P&|W04G*NPFT!iXim(I-E>bdWbpm6|Y1B=Vxpik1N>k&!7i-efAtoT1 zbz&iiaG9Ui?|)71#)Uui#}&f|s*u1pt?(T$}uspQs8 zvWJJ^Jbui4Yko4l$t@i4jWZS=;|%H9%h3z(&u%GNX&cQKmtpc;Yj;KB*)(&RNsBP} zp)K~}oXmwIxu8_ynil7wXfPl~8Zf1EOf}iI^!$Z@i;PAs_f%O%pLCfN?qGBK z9vI!^eGK!RnH-o%0Qd3yWVhNbp_rQc!I`(mw zni<{%12qNJ2V*g|JU2o?_v%V7-f8~89&4r>R$>U1C37m?mw>09O8p+Rs&TlXiRg=? z%-%f^X*Zr)0C=Y$@}zcblu@b9Oxj_-nqXz1_>RVIDK$4J*2m3ZLlPToyNaCKSNrvd zw5&2j(+$@0pWku}&)KUEbE{vEvXD2n>dVo{1Ch;Evjhv$Y;=bXpUlv5HeKNX zxw)n=lZXR6NwF$u7c=vD^8Qu@D-pY*CaeRK9O712GuBj3;C5@3v5H&{bYU|d;woiZ ze|3(NK~PVzHC$~Q?c|TUL|z4_ctvc46~uoEOgg+Z@|8DJ8@Xj1v;XeOAlqr=%q`Kx_d+k`-aR{GCu4I$ zuJmN4^yGurYLxf^mC=;u8w*OE$8JJMb;m;){*nc6)1yY4hBjEohW#bvqj}x_>^iy5 zK<2Qy`o5ZpUO|~^{KXt+w@h0&HF0b<1F=_R8^^}DHcT>Ay~`~&d20e4l&SB$Zvizx zN5p9W#Q}|Gp2o3d_ij$23zKt*Gx(l5&IXu3*;l7p9Vry8dG%eCBF9-gNG z_WrzE!Yp+iH_A4teAVy5q`Xb%9w1w{4Y2ho&@!xelk98MT*{(8X3ajlG zL<{t3%J`Y-6$~A9b+>>qvxJdS-r+)P9}!ZZ-xRIl zSr$F6ble(^%%E^F(UnqGS&AP?_vdj3y{}wJ#`BM|6=Ukm5Hbi4A`XE#Lyk*y(J2|q zT5=rn;|P1WOdxuKm>RT=*T2g)OC$;|{hk;l=ETfP6TCBPvRg#O{RT3>6A2ailEF@E z?6En2!W~N$o&xPwj9q3XkV;Hc^#~rTv*iml1SfT__^V_D)*ho+3tVVUTOODG^K*Wa znsvAHeZi7Arjp0_=Gq|2C-x)$4{@rX^u?MX4V!BE`?_*bh4jd)B2Otc_P)S zdH`#?<5kf9jb)A}>Z~}@nN_3?n{%OF$%^|>mk@O-$I)4)DW?XC8|UhN_f~FwQmZTn z)5;1T=@oLM0xJGk*4q>SxQr$rAE@Vp1x)9Lv>CZOC8T_$xU2TFnhtc_0{GHM4-+EX zjuhIe8S8@1-q;LH*A-*uCLx;H8=046e9)DKYG{*}OSIrO+(slgj+=FfWJsbt!kzcy z&ngquq>d(~^}e;8z5ytKbQ`%TQ)<1_73QyjD&7%GSKa!pYtGWsx6mvM0+DOBs==Io zwe5Wi3TfZv%^l0qY)+S~J`w^WN^oUh!VlH)C_1odD%Zz-p16*_f|bmJ5+aiQLv`X~>cS&!%L1 zXx%60(E^(CONn4LVefRt6VrX^*UJS8tI=@E$apgEBrKhJGT;&?+wST8A192w*=s3kLIpZei!3 zSj`XHP0b{;wm$@?@%`g@0zP~8{d=0wSgpl#^N5zj+sVe!} zC^v8z5D7wk%dljW%hn2Sql2V;37>QN9hOK&Mu`u$kkBMFSX0k>&Z)6x5nXfcgqv}- z_(SJY5s z%!tnqV(TzdSe{KS_2a01k-10z)IoI^U$i*sJU3_20wqW$oP;z0-Vip5$v%0mllDSV zh_w*z|1%E6_ybj8?A9LZQI>u%df2Ob`5MXN)gs0-R_$Td`GkF%V)z$UMbtps3zg*}lWC-H z_3Y$Mv0i5QVzSiuHbN&mR`nC3ca$g5<= z!qxJ10r}!!yRWe{bOe`$Pc}RbsMP*&yo^s zP>dJEgwf(w^`xBq=T4dTt*4@#1xUBI~qQA}eo$I0^D@u=7M=w+JQ`g*Qo87^h85X^LM?^oaE=OcpgV&^F z^=Lq#ETi}V5IAs4D$2w(#M7ww!brX*fn$gt)Speu1Vr$1Htz4a4P}ESTAbRW~7vf@-1Se}sb zL}bA2?Zp~Vh`YIak5hDIOce($^HW|~<>-MdTZtVM+A5?rC`euNVlu3T9G1tWKn{CF zz?w(!8UTW&L;*lxGSJL?HZ6Yk|Pu4KPl8b%bgwvAd?dE~IHKSc;3zx(k3-FJS z>*fU>lKuSaZp;ehg#8%XuSXO+j-vH=*VoxajTkwSvU6`vuD6nCvYA7ybgg)Zw2!(^ z(#+)8yPAcg(jRNd)_H9sEz$}q_!t30(bYnaGl-(G9&>stGKd+%@U?>gsn{7HU1 z$r$5#$9NyVZ;BYPrL$iR-4Y~DY@nacb={>|F@?K4txk4mXQPpe>X3@v=mb)pb}s`} zCnuBA|U13lvoX*Cm5{LM-oFU3l7|&QtD^c!GMwOVn^-c<&*N^^=s!Euf+y zUsdJAv~N+)po%w%xB5Y%eQDCoc_&&)nHCtOz+^lHM{-hu7;iDC2SqoC)i1qe~R_#FQxS~=Xjd;_N zt(+2^jvdED*4MREK!(XNzdS4U2{g#t8L^SOo6SB`j;cAza zcz%s9goV#XTp_sv+pXTKZKAASI|{AYr*?a58&s6m8LC%hz^NtDW4z>0#e&e@m#x!# zMvQ}->u;K4)e^Fd=~7eHjj&sSRj<*OdS)WFb-5(kM^Q$kbv7dbu@~ZRN{?3ow*x#{&r-LG` z+o3w%aSzgY;%GhlPUkq6+2GueHtN=5JWpg|?qe8m``X$TrEhJB++&vMJ>ES^5aB6Y za~x?^B0d@vkIUBv!<-^;>K<6^g0f9StCYP2U!P@2*UPxVl2zmifZ_L2&#G#*u9u$6 z3vqFkx7>GXob>Cs)f%T2UhIs=y~FL5)LWwyEZ=UwB0eG{5R zf7*qm1NGq3A$@eay~1eY8lh63H*Z>a4%Tn>$WV0@Cs`E^bgGlut7+GnU3I&L)_-^%fS_KtZS znFt-L;3YQwInS-@%}AkP|7$3^CJkJr{mR?7%V~ko{J?>EfV zmoe>0gb5q5oX31QZK#etn!PiBt)J23eC32k-UXD}*w_?KcuH{fJD2)i-(?_<($y02 zVQ=41fD&Y~Zhqz_!I&x!^#{RE+0hyO>FXjgQc`UOynRfJ*XzbrcNYA+zZDMqP3cxy zYF6^->PJ?sUNxr)J=nl<4}Ig4FqBI#84v2!(VbDTz%f7t9$M1Q>wMfmIwfO`If4_& z->4-xH>81}py9~$5kzBg?zIu1W7=Lqw9h2uOIvzDNzTLyBZWn&muR(3moY-~_7^`& zy|bQN4_@8IWZ8%3HEp#tEdDrR1Nkc&5l_2Wt%5zIFn*r{2Zbhro#ZUUSYK3k(IhGD zD;9I+#N{$(9)^%?)c)LJt{cM_rW>k~*fSB65UX?eqP`>NVH?OdGvU6yJ=>bVq9_i8o|=^bb8zqHuhtiXuunTdz#gTD>T=8t(5HuCrKvH}74YM+2`TaFw6lFdhqzh!`h!F+DR67iZ#h00 z&5lF-7i1w*jSox5c$>`Xcl!ZYyS{|j4G=pHNrzs?4T!CKw*$#p8_TN3B5X&qyNa%# zy`)cnE0hFxF)3KyfshOs3Fq@DPUlRFK?XSMatv+Dqg3VfL)s>_3kfM!II=4uq1M}5 z(*Z)TI`iXSiU)r!~JmcW1kLzTEmieS-vAH6kf9lSvGT;S+;+eu_ zuW_!z-=_=xggpg!7mmg7xP{FBAsOA7p4H9mL3t$ygW-u|@Q3-+@f$_#=ejhD?(>$` zzL}wCfL`nlXZhd`NvTimRe*+RDWg6#u9acl>VrD^70Lu>`E1qqx0jEJvYHc+Jmb#C zyf1n|R3}UH^FuZWd6J$A{(@q!w_BHDk{yE5!i}k=n?2{JfTsW!83NMKbrC@t^^^wM zrq9%LdsQWovh9SRe5{oZ&@@vmek>FTtg(7FfI)(4_O?*~)ek&8>J=RE$!H+%MdPKB zWn|Cc_%XvTwL+q6u2=FG*hyiS*n~)5RLjyak?28E-m!X0#lGQyhv=zVL#BY!O=|z~ zBISfO>W?a%h;m@`K-}7cYV-aa4JWEZuzpHwh=<83%$K&DH`Gp_&^xps)lys{ocr2r z)LD>iPa))(S19_ep!Zw5f;fBPQ>PTLeyc%gZhZnuc(H%#v3di$Zxhp%QKC?5@Z_8A3@>1S)~B|fXXQq$}cp61}2 zcrhUCb?EV=H3OMo@?q_u@WI`wgkVxu7t0`8Uh)44%bHw#{TR~0ocxpfHVzcte|e@{ z=C~ck%V9$E*kRUDfN%aBL3w7@m9s#3ZU1VOgObC6e|hDRXA5XFzP^-_vN^4czsHk}jJK>5g`?1J0?YIok=wkg-<{dY zU7O86xu6Jr3fIhgz7=0*COLj(C!Rr@^oHkvML2YLu_c6-SUHS@-92swEFPa($sQNS z%F6mVE*`@rRkc1h<6Sks*L1YWo)vEz7Y<{MX?)&DYRE>LyG7Fvk^NoX@OI7we7X<( zroDYW^QHdnVEX!VL82nu#v#d3`;7PMhjDuqZ!?DilZwV!JVH7AHLUdf7pG<-a|WTH zz6u5%M5o44>d29sxxF=(9UCR3I4`WGbY3yJ1^dRf)W5-;I@z(reY~{MV>xu+M)1moO4A1l*J-M&9bzdgSJe*%4V}I*+?SXahDJU-`u6M`2D9;?@m3RMKB9j}O zUcnj5B7=xi%l0T3j)Q`=H!5W}07EXPQN0CT2E1*pva{tesi`yCsis%OcBXo*$^L?X z-g$a@641OhWGZ4LZ$`JO&I9Grw5uZVY_~6i= zwc)#Co9ZZqJ22<(2c4Ux3wq2NG%JB)XkcDz>s7Hc>Q%=KlgyE3v&buiF#__*^gdHc zYj;xoY|W|V(==R`?6SwVRZ`-!!i43`E>e6;l*S6QA`juZv4WnZ-!57?>#-`faA=|F zrDQZH-LCN{<%2`y>861K*O! z&q{?6Y)k#|fcfN|iQReBG~0mu(H$*|P8d$Imjs;3QQ(_(dTd9Ray)0m?nR#d^(!1(0|zb?U00Hjb*_5$GtpBIgcSxB zKN957GlF8cI}FEwhLt5al|sd`K1qG~wsl=!MQbWF;mI1;5O`V%SZyvo7q{i^%1JYB z^mDzRgdvf7#ejoMl0nS~Jbrf;7T>LT8BdOURc&=~Y}e*gMVqa&LkSnH(-OX}Ud-!7 zYA3T)8AXo%t^(8JE^V!CxYwl?vh7Qo0&GaIt2{+yb4_r#FD{@dN;1+I?a{=`(Rip8 zxy$!J3n6_gq~h#MInVR&X#?i-HdsgJ;coYbtEWRT?-b&!9P+aLd;7W(HF?~ z_8I?#v^7GpFjrg@KxREm+|dlo`F-2!C_87K%5U)j=#za*>8KxX1gVWq=+E3jP}-7ltykII(bSi_Oew?cmMa}vX}EYcp<%1CYdkmAJ44<;nIbKB4yGD;xLwHt zs>~ltwbqDCfr5ZQS2$1!D8G)_SDeJ~KvGhdmpHKz74UO$6wFgR+FLJWlY2|EoxgjX zdAP777(3XQw{w`m z`H{UoFBWgawSwDpI-MsmAsAXg4nv%JpoWen&fUfp$A2ahBy#l?H<3TwC^dmnOHa@5 z!8YtydmWPY-?-NMpnAU|AeCfNTBqhV5MnE+t+rzj?sdYr6e{SLnzs+Z{u7iWH;F@~PAoCZQWV&}$^p=8XY70#;pa z)q54&=FIPB0rp4l2UX8Yn8k=*ybL-KbiD`*yL4%V0NFv@k@g;58c|_o{S>&QG{IgY$cf@ZebM6oVrvD%{)dZ=pz;#>*0qZp9Yn`i zV0`xK4rpKyY(r-+s8nSeX?Y`-w&LP_Q3PPJeinz1pLC9)(>-!inl>wcr`j;VF|PM_ z1NeHo@nu%bUrVlU|4u68uR@uBm9d;T>Kj%c%@3)K?OVI`G`AU`LdHa0sC&#&I{4qz zsvR5F+Zo3bPS|IU^LRFjV`{P`1W-0|p+t+kc#fU7$tdqQB z!;iEk*0_Nj9$*glb33+)cT1{w(c)3o@c;W|r?ph(Pr+iG8o(dMP5<^|+&V{VTK*^z!@2s_%Vr}&8wG1V2(W~aURj;{- z?P}s@(g$2h=$9@{ooYK-pq-lPfz%v8uZTfJ0}IE7N}|&K`d&dpeWdX2f~cnBw4Z>l ztOJj{mGa;;9|*Wvy0k%q9#$A$NNFgt7+vYNa5z9l3R}0dg*Q?^%Hq9lommDOoi>fT z(yf`Jm)6!i3*tMP%{Vj3TI1BUShND|6Dli@?!T>+m+U$AO_4GJ>i5 zib!=IqWALY@GUfHFnHNf|JXyEX+hMqZdXRwc2~L(Ex}Q(VQBo+ULP9E3P3w|rjNcA z<8jukJ4#5150tDlG#c=%7g#zEYuTVQxmqE-aOt&eiEDl4%zBjuAl7m{jRL&B-8&<^#rR?QDk-vf6W-FhC0`AW6X zONq2m;}MT{a~!(nYSpEfg)%3j-d9tO)wJBM7srL#ZHO?w7@^uI}DeW7?I4GTonR=k60W zS+L4SPVTgnl=aO6 z%s!3#he!X$0bEuxZ`a}K@D+OG()YYYzZENfr^tC{ieiY7im%nCCJUf*R#~&|92a(5 z{c8D^UI50ZBkYu)Y}6Y4dA48%>0L~?(*bJ~!o0C>sVbWB&enLRlp)8X|LWG>KqRE( zJ3#@6RYjm(WN`e5;XcnxUI*&PssxDW*nWHt0`Bpf%wB)B)^7EC7g^2mvdPSl9rsk+ zLAd=wmG#W@?!H@M>Q8M%CBF~6`=dtUFW}k`Pp20aVK3fep0T>39T*ceiYIdss%fCb z8s2gylsqt#{?ehQF+Mg&>j~ca7U?I8XVrt#HcVgHh5DV%N2%|QB7?}A-+sntn z29>`THS_rcwikT(8rO(V+$@=8r%H4RF7;aW{pkD|VPCT$4LLrGOXi4muS7;zFG9)E zEws8Z>-J@d(Cd%IdHH_C-%j*$#^baGc89`_nM9}hPqU$afmx+J+r&i<&E3FW+PZK{zK`A z|2Jt3psV*(atSX7A-{B*%;4ndi{h7g zr*J^N%x0XiiMMr7UZqep12Cd(<@m-z;<13Qn8B+xTD`)KdW;3aC>J5HuKuEgny+oC zumm=YrsQzl9i7s0I}&+*|7kwKFYeze?R>7LYWPvOh3vTmziH(RhuO)27PTm?EFCMP z?%>P3(e3!HsCp_h+E_y|z=oE}XCaajVCEED zM&$*Yat-^~sv?~EiF!f>j&GyQuV@&_y;Kt?9A%D42y~!ckpyV$JA&n7!|YuA9~9*7 zm>oe--w9k06-H!;k&d!6dkV60A+w`MmBhN_&8Yr!46Rlh4V$uoAfJRux*UpgOdK`EFn zXH7ZiA*DT19A;l(3&XcZ3JxclxI0_VQ&_A;^ANr=vMVHv-Q^G84>&QYkRLuv6hssX zisiBIKLWaX8?99@H+&H9uTTtYfo^24W|a=yFK}*(i}Uk|Dsug4^;{^KvuBXQMBDQD z{`}x=jfjxvGBN9iZ*?6FS96(Kt+RC1ziQoVg-pp!DZLHQ!}1cHdYG|7y_;|-&PiM% z>HoUAWc{7s(OS)HDIlGhkpxsyAEy&p>4e8;!ObZ!60bz~gZ}bor!Fyr>zx_?Vy1fr z>6Wy05B3*?Z>x`mEKP}x{=Aq9X>=y2b=JI^YvN`rR6;IaDZojuZfp0{Jx2gq*NM{? zA6|}il#v`fY6y`nj2tMq3EZK*K%Y}>u0E0c1BO#A zH_lR;&1^BB9(28t^i2w8lkLxi0E^T@J9c{(6&gDkyIY=|4O{=qLbTa07wg#O$M<@q z*z&)svkBV~$|t96l5B64@CLxe*pbioNFyaZ0urRSJv^S`Xkyhs%&zlewpM;l+OtQX? zrQD0EO4YYOGRawfO`(}Rrj2Y=T;KB}6h1$)aCR)ayjLuGy@JR$DYl6I=-#PsG`-m}>K`yWI2J z-R1khe;&;Y<(t1ulJh#PZz>Ge6?6KM<5fyp_VZ3rS#vfF`LM37Y=lzI*aY${!j3QQ zET*GDF2l_AvloP|clm8ZB<{%VtyO`W>D|(f;dAUJHiGakI~i7tzr{4Kx=bbNeAkXFP0aw_5ub;*1Dk}XoY*Yhy4h+845x8zwF_^%U+4F80VslIS*31b4{yyQ~{hc6J?fxz5&Z7BPG5hN2vS8VFfAVE93@8p7 z-w{`CBB3&x_e{3eD%BH9@X&ShnHw6rLQ#5d%Yuq_kPyf&x2 zsmzCDCniIwpl_-%kLJ&O43ZDr!O7-YHhs)$J$M{ye3ZDm7NDfooNx6G{`f0_`Ud(s zn-uLJJH6LoU{)^N!`d7;o;1!N-jYA+R47P+2q5L(1gU6o!jb*3+{yfrZ$2g2T1A;* zPT4(X1^OgaK{=y3*Y7R&tX*>YS1!@}Zaz8UNNuoYRmYY6o-plPsj?owQekT)L$LyZ09vXwpUO_`4YuD79}u$K1?BbHtAr+1{N+w10)L4dnaMEAS+~ zL0k2XMy+vq)dLlavl*c$4h2?-g9NZK&zGSEr?rlWG+do~q-%JCzTv)qQ-ycdeB5V( zY>dj#Z=J4(ALPDPM@hZPBu5H#^ zFiX+JXAiWOiA~iqHW$G2xda;D5$@e%X>mMdc;FW5S{5((OD%8j0p!3VkiAkZVX7Hb zHHB?ZY@JT$63-9s%ja3zhN%q(+Hq~+1HbJlv9qbwxv9S-7*`a=-+W%E^%#6W)*Kvb zN2Kh%)iPaTd|~b@rdhS07p+=Xe6iJrnm;&(0{Ti4c2C{fI~Gdne6l^54cg04F@ z+p{PwZWKg3xKh7K4Y!v!Iyd^g9B7Dj+`g+@2bIo$Wpkq+_m!))r?pQ_K|8mXYAmas zQ)?GBq3ceiRozDC6Sj)07bOZHzqQI?`UKkA07ENy3PZjZMQ*94RT|(Dvnr@svOt_U zpZsF?@^&9BvZl2%ZS7%>{`T@6pWl$msiLtHeHL3z-xEv^#=wiGE2Uz@couLYRgq)5 z`w+hn5T(2&jp|fdRi+W98G9afgZ@f6fl2BpPYr5HUfml}jjKy9i6hN5GpcHmjd*7M z1FZhF?(xmRy22piiK1)LvhQZ)wFigfImq20u=C~DF!SEl*8qUZ*LhH$Y0B=VI$O>K zDjLAeemM1)4krwu3G12;b1+;mOpqJjrq!>$G<#HE`5cS5wmJ$x_rkcc9C{W502fhK z>y}d3YwO+iKF+L;mf#B!D`~ev>EW8CJ%L2G`E&lfehF6tO+C)!r@ywCKmWDgq?QmV zqz}NtCHpEnQcNt7X6mWWk(3y17)afxlkB3*M|=)v=iKEXvvfz|$ve_z0TC{x_H406 zY_48m>r`G%e7k~u(L3@bph(~Pw5c)(k=?+vVn$~E9&h`)?Z&7Iz*n#r%S?6<-37k) zjO8!RlePIxHtl@hM)P~MU>uDkpH~y;yk+97Aqn$1?f8ZC`zy0C0!!Oo?jHE3R+Njo zt3O|6%ppbKATS{sBJS=U4hSJXXflr&u#D)-cNxj2SV((>(-(sS82y$g9IY6xszY`4HF747NyQ>~ z6rD`gS8$ft@)^T3)^R+bh-Kz5bP=u8aV;vv&PU|G2zhw;OKvtVLz$i7@tC{enMPCk zL#18ewi%np&zHZn){E1@&!Xw3-5Y~!T0nHay~2|Pv(w#Yl0paL%;G2H)2Eqwp=m1b zo^}!$ah6C>YS0?aH^SmlGkkMq0%Qc`2%oo&1T)29B^4FDk&bSUXS3sP zW(>39Ad~E+EC8MS&sHAjziH)}?ehp-Dmo_S#02NF*R{A{&Z`6BFZWO*8lx(H1Kbp< zA1z={w%v&0_W6109M`FEXRadorW8+%QWGMquzGc`)fiPP<>bUJ+JZhGuIDG2&|Sk~ zQJ2524yNcm@X*3Z!nSTJ8T`HUsK_>Fj;!_z?9Odh9=@j7u}^k@P4K!oCnu^vN`Kx( zxsHF5ZJ%T{4VqCkK$&uU?hg(lhgT*R@a0!ogV3F}QGzo@JbOB%{IUnK;yK#`qB}j3 zc^LFo$K~wYXk3ioWOZd5$6|O{Ap^vIIg=_SH^n2s_N>}lr`dbQ^+AeV!i;&sa36mr zvFO-q6}!qAID6HMT}~MHpQWNd4}J~1`o_NGvb!&Tdei@HN5J=ye>ed5-*yrIr=RHi z=nozLv)B0h*bg25({()lL&yJg9Z&qw@jqS1lRtF)PuKB3W+D7%pZfor|NnQu3;wUs z!9V*(fB47$Yz-3-{P2(e8+7~+{o})(M9OB{7re+m!|a*yHTlq<41@gEoK`6Tw2ieC zDE-Er_?&z+iW`R$25uUVg52S$=Cqvj3$>Gc#2;E}xi3MdCLo5vJ>`^~Y$gi?-00g- z&B>CZXM>wD+j}$=Yh#>17Qbd*U#a0fVYB>7?&5RAsYYAObVu3sI@^M({ZK&jw8W)7 z{pD!(iA1}??{5Qs(m7FXrXuq%@N~MCtWxl8+lrdrKflI91q0dwq~(JzLUxH97J2VN z&zD;TC)7w3EUCKoll+A0e^lYdV5To zD`DBZu#38>CcfFcqF-kIEY$o*;T79L#G_^{S;^Z}edZ>Ulg{1q>sv%X!cub@^Gn~C zXAdL}C<9*k9GXyXV?vlKBHo_&%O}m@F~J|z80v+zahmTbQx(6}I-!G91Cv+(@tt-H_dT~BkL z`+m*uDRMv2hu3{*sGmULstY z8qM>nG;nTvtbDe5MkrOP z>H24iq^&QHV|wxtF;zqS3)P)e0fZkG8IE`PjTf!`Lod_-*Q_B+ESFuY<2_w7mI)3s zD^C=HemfxXI-?Ri5L0;N%aw2&`|{x9&B~Fr*~(r;pTyo_P)6&gi-)q;PpB{GGP2~K z_4#*aUcB~qx)c+3I-6cYon5pJExqx*m+lu7aYL*&!u)ux+3d{?yMp9RO0wj&?a{!s zuZiVBp8QWk@~s_r4=|fCfkzAF-2UXu|K@g>2{tlJOurM{(>PIX^>Ub|P$GV8{kDLW7IhE?uwLA(H=&@~?1#R)*rU!KV^M=sP1gbOWh~8v5ZoCLc&FWCzVElF%puEq<$y)AFWS5}^0nPt_DZ;`Pf)<0k}JG!v@}`~S%G{)aW(|IB)GP+?=d7lh4UmKQ(CI!JyT*oz{ctlpmbB`G#xNi>W+ zDW^SQ*PUW34rs#)%sZJt*1N?;dk5UwJ75-K-^X~bGJ&NhHET<#H8%M2}A#6j4B;*)# zm?*v!USVm2JF}K)hmlPaag2(l3@gQ{!%MP6(hr)SIW}5*`g8V`O}n!e8DuhOGnFuD zgu6ROTDOv@t0|3IUs0+)fG1ddMjDhpd-)6^FzQQ>6Axg}wBe=xSL-bF@Z&{Iojw%)QT!ULQD)WgXXawkKE_WNYE?3n^D! zU`~{hEU58iVr`VSy27{8L)6!GCX9CSH#!d=yiAxnuX-EZvUDh}7KgTWM5YfVKp{if zW&8fh{XVy^gnZ7h4c`g86m_-~am{!j$&fpg6CV6aA)AE!?#g^&O*BCDpzuN^yedZ| zZ%)!YRD42?2R0$yY+>MP1y|AM+>X{#LeaigF)PQ(mCz+LbO?&?UdK2yh;&*eGda9( zWuHmIUs)u%ev@_l3O!%p4tmIlG}M`>6%+gA?Ps?gKRfC1_0yTxJrx_RziK~57YAR2 z`Bn&k5hg~7k)9+~?Uz*8VuKpmz~gR>C=mcomDaA)ZF1BaqzxA%qy305GobF2)c~RW zX?tB{JEM5G2XzeqzOPI;OXBCa!HU=d$Us(d%wV}~fqF1JqIC%)I;#cyoV%K^$J1jd zP$esU+Gvcm9^I5sBq_6-`qf_gl&Vn`rCj)OM?E>2zId#Fs4JPd=;g$HJ^3Z;5wa`#Gr4&&lRa&L82EuJxl zL<`>2PP66T?~`_pT;h|UhAUR?jzNZ$Qs&4b93GcJ4|9a6smt5;`-;}8+MS86 z1xxYU?ytmen~Q5|_@$N4C{2#K0bXM%XHkDh9)}*N2rum-B)ZlHA-pBb4?|1UQsm>k zwlw0skf%Cz+n!DhzkOW8-tHx>eD?GOBUbZasT`ISYw?JR&0U{`*kh*e1nNXax5W+$ z^Xghx>h7iA34qZo_#u;7%VVyX&9=bireu#xF!R{2)s!d?9BHoDj5Qvo0+|ndrzfZVfNV-d-_sCby*T`HC3yGq0Db%*(#05$6 zK)~!X>T0j%yEogHKY!&V?|93rksbWL0VBoT$!Ajw%)z=(WPomBlFqL}P0#miyzY*| zFryLJfGbre(p&Krg=FpkB?gY$lfLF&tGnbQHa0e4{2@ma^DZ_~Sa@CO#eC&h#cb^U zwtU{;FDt&GU`^eY1}*>e8%?l^# z=O;Qz>Hq-_rJ!HCyHA$6;(hq{WXOV}MM&F{PYzt(r&=oucJz`5CJLvT<<->G)aP?q zU?Ckp`|7lw6x30Q@c&|?1Q8GMh)AfZSN=Xg{(5TNhyDxo;loV!)P1^ydf)d>(V<3}!Eamg&SfBLjzA2)e? zyY}om0h$^=tay^N%zS0n86d3O6e+24y_FacKXNOwp>^%Ngyk)_(g71z*y*q!2ose` zN7qLR$}~8F(Mp;rZi=C!UwO#VUxtePS~UaHgvG|D%82(=_5 z9?L7X7?^iZScWa7Vnq5KPtbi*CXU!cvcQzONHpk~Is!IbxtFifwc#b8B{?=AvwD3K9wZym6k` zrLLW4?BZiSHjtS@{1g>;=xuVTrCg?&Bw=!iSFEKZe@UXCob?4inC{JbT%gysCYnY$ z#X0h=dnpfhF-#5fxII-Srd|2*yROATQ;ff^Mk&YziLf7uM7iT}ezL&3F{zJCU~(V; z3D#MQWdwjzgf_zRBy&GOxhpT-Ksg(4aP#_(TL&slzy%@K?=)?(ByPvd?3>L?gXaRT0rj)d?Lzt7~?7Dh`;TJiO|#6_A` z)yJo(=-BC~p91ao6kM3I4jCekT~S7rBfJIWcK9UQn&S$&J~{ zV8x@|+%gFUG-DPjN`cieugeQ|!J1mKF>R3%sRi9j8ncC~D zU3>cX@*7X24)WDH;wEuKRUffbIp$wEYdtK|vNvdWz0x(>F6a3G#Z1<2R*OzrJcBYu zlq?|ixH{`YJF7Q`vfwsP>7&*a5h7xKRYvsVDKxF(xnwUKv!gu3*_sSV7RY!L#`((y zxp9y*(IjJpFhh4qewYwPryp@6ld1>m&#`jQ$DCwZve=KIrjB1DnOJj4X(6sWHs#zr#NV2Hv4$iC_Fc%Ru8S6X6;n0q@Kpp0TPY?i%yJzt;S%vl~y-xpVs|& zBRHdEp;2J${VFC9VH7Yb4w50kbnp8W_B}dn7t@Z)j^FRYMS7W>>%A0R9nv!=c`=NGaHld9>4(L5I z^6c_LDq_35fUf6Gu0eUBnkq1QyEsiZWi@)7wPl@91jGQTz&H|~PfYjcRYLniN>UR=qSv#?w z>KGack_5RV8nRKWo_tf*vL1IlnX`ShLa5>e%tY^*IE2$}IeuAA-$B5Ol;=3GOsV0uH4fD{FC(j@m zygJSsX_B3jljm40Pm(=Lw-B;%|3laB+f$9TCa_erUvVF;gwF-D+|#4a|B~kQ+Ua=qQ+?Y-UEuPDLC&2kF2He;RJKT0Jh3dc+&Z6-=pO-4p-wD#Jkx!WOE7U*z z`Qu-Xi4Q8CmBnpGm@bhpEF=~B3`U9D^2reIJ$Zjom-{leOS2%drs}jztw3v4=^Z7Z z(^@7%1st2N^a>Uu&PN;gWyCYm4(95(g&vSnBCDTv0ir#|G@63x$-*<@TF25r33x(I zF8gctxiD=3^P%TSKYa^WSov8f@t51l%cAnLS zNq!E64${r~mR=Q&N>kcTMEgVp96pp$2r(qAAGxu}>(5WE*-uqq&nv3>H$q$9K6gK# zw@1@yu3&9E39-uqwHsUg5?H% zPDTV(T)_>h({S=OcaBi5kSP$CTk@%TjEs!jfj)4WE{Ik3w~vE$t!?yyo)~$>`!Ey& z;jXT}-Yj;4E%gI9XYyl2gCw*)ZC~UdXI$6gfQD6jW^t3(x*bb8Jc|SbW}FP>TwpV z9*kRiK#ExJfIy}zFC$ABA(}zVYs`A9zy)4%GK!6fHaJ60nN2KI@5@*$RoaZG=!vSN zM?gPmt;81F#WsTrI>W@`Bk)zjq()6uGHr!3!% z2YXk)sInY`h1To>TAd(q#E+oZ;mF=ZW0{`MSl?(a>L3j4Yz+x>LS7fGru7C27memn zf;??seVQ24Tpu$$e|_QSKUV_)RrcN=d0C|IhI0v=coAWo3(lVSRF}hHHrs2b7<$ZF zW2H{ZVFlbYGtC4Q^B!nf^@`-4Il(d8HZOa$qpY8~7IwbLtA>KbcD>V|?@Ir1?^}&J za<+eEfH&Xp%WU0BiO2{y@)xL$RwQ?;%y$AZxMp}^EGlVEIR8y0;Hn+u_nQ-=N={$l z%V1oXz6__5>y3p2(tJ$wm`Ix`2*`(q=KPAoZGnJT|GYDkqZ@w#l3c1FYrLcC7?^|j zR;OmDozAt>p^CA{_<8SZqQCeW<~fZFe5gpN`qLau{s+&9kgDC@n{JnFA#Nu=54+me zx!pw|%qUuZ)=V0c&~K?7pQ5jai6)im6(KAMzDFHgs;8XXnWhT?aw6O#QCOS~ZqFn9 z(qG{TDNlGNEKLS?6qr>y=N?xZvz+7EvrfNc!S$A7f~upHL8@6u`#g=#_N%r#J&yYR zp_^(5I67a8*2!+iG()qnJL+d%ij}^XoCzp4Xk;iBPZ=ok_+8c^4X$!?X-oz0nXq}3 zuOmSFxfnkpaW+Z?jv$OQ65yjG0GT@j*3&Xy8qBdUTSYrJe`$$o{^F#1#kEwrAN}y) zq*?XMmpIigEbNBjJHe|q4|;tSeMly_1{XgQRfBjjT*=fsT*(~UPDiuE2V6gDel-pDaFtED)!neAyw0Ex5(q`Y% zE_v+V-G~0%Zt=&1Hv>HnT=OSY8&vYlpNKwxzI?yn_EhF6=OPJTN4d$g5S+KPr@?&A z0cSUyjVs#(7g%pU@e?8=<2YwbWR7`s*1N8Kug4Im!dv+FN<}bb*?Xz z0bqLz1|FW}@Wu(wg%5Ai*ALs+F-k*POhN5lhcpcWBpJvKJcdG|?`l?)o@k6BkpLGZ z7Xv^V$zH7;cI=3Egb9s5O$Cxfj+p8E`25G2;r5hArQ1BPQhu#XsRxxBfZEzDZWVc zvN9VTGqYBYrOF-%?=*QXYQ#pboyH&ycY&w}+MgMW!VOQx_cMdrO);yVD>tC%Qmc-h znWi2IQ>}<(mwrwHpN#X1FOlXg3T{nq=Y0FMLFY~M*SW`}DBsI(0dq)_sErH}uXSeq z?U}*S$?199eRb@_`vKwpKGfo_B9SsjZA02?wS;r*r9O6d&u@3HLTdTBZa-t=IjC5` zW+q)YYR?9@Wi+KzHKmLUl4Oq3-Ph04*JTc*$&RdMWKAeo(|#8uet$X?S!Yg0zWl`y zzw=e{h=mR3Tct@QKwd_n z)*@&jsF8azn|m;F8SigmXz@6qDI>X9u+@lKDi_2)?bQktkegD0cd*qo$L45B%~n51 z>n2){lom<$Qdv3u++DLGVAtq5EqO2e+_2Cncs3-fRv^l8xLE2WJjVsu6qjsw|yZ09U}8f;S`qbgR|T+`zQ)K5C|7rRDOQ9fLK z&>|K-ximEU?v==#GN9i{bi!7isS%_GS0aydU(ifZ25C?`#mN;JJyxe{S;a(5hE0EXet03Z+E#VBZcHOt>B@b_Q!-3Wn2xFJoC*2Y~mpMih z%b(wk)jAZ8uBC+A)m!O}^P-1bb+!dKZ0s`>KdG}07ED;w1dqev!3K^!oMr|@ZaSqe zpD5`@sxCnSDc5+!XwdUBgt)akV2dgxO(bU$$Uz(%D=H*um8q+o&SyX zYTt>Tt+Cw+ZnT;kryD4C!%d{1Yh7lj83o)(mZ}Bl7&f+$1;pMF8m0hHtX__0Ry~uZ z9i)2jm#R0%=*`$34?dMBp_K%`BYg(&eWY+RMx$~k!_z9&@txpnmC4;>jaw?MBhsBo>N8J&k%G@{M|XdU z|8I8uJ9M%CnTm*b$cWP|oCbAQhW9tl8W}7VYV@z44=JqK2`-J8)_dHQ{~pkazM&WS zPQZ8^6|Cn|pFe51^`dFp4U|?(zF~50n(Q#}N9Z$aw{Q*BhCS_#tZvoz?yNdA2Y~07 zpkI3|EX-0X_B7^bTNpnc5;M^)8wl7KGaBC~QZ)}ohop%?+-#u0x|$T>jrDBK(TEtn znA90KjEQ1*L3V|x&MRF{=P@KmdJv&y4i#RHG!Y*S;wgmL6nLnCQ5U6a>A!Owu|+H_ z+)utypc=bPWsDE-xd=I+QMgJ6HpTktpD7vs59;1Bs?GHM_w7ul?Ua@>P~18#9;~>- zlp-ZSfIxx-DNX{xU8jS4fdmOQ5JCtLJh-%I@#4jcJH;J(^85eK-utYx)_!@`UMDZ| zE?Fyip69;q`}%&a@Am?@c*;7J;2}n3YsbA;y)y|B+QfC#?M)j*6X#zOUKccRU8Pk2 zQD0Orxq}q^2X3S0XhKIilXYVZ-A~$!j0mtCu9_Q*aIh}2Jn)qn#dIm7IM)CP@GdaX zSb8>~zUgG!95g5`C-!}=>3P_|wk`oovXyQGXC(sxvd8Vu&dr{mW=d=>-!*x>h(!16vbTAU%?-D$3#nWD$9zJSZA^Xq{S2oL~cS!h=*9;h? zVG0#U_Xq_5qAp=&nTg^S{BX(A-C8pyAL|>#jI|RnvbS0Ad8b~u(Xl~tAn6s3rJQ?r zcVc3pMWdG5p6C8y?J7TDHrE7iDrWStF^GE$o1eQ;xKdHKF7eC7=(etzU-}pDcz=TA z@>eu7O+K(D#XD#}ez&b=Ze!Dtix`c|G6>6-HNq(B^z(K#6ahsE56AVLX;3z!&LYX6 z@u63{Q!&044-Rr9Y4M@4reiooXSMm1WQ3?ji%^Qj%$}KrnZipZWS#3MR;3H}EPar9 zzNt8IWFN>%uYoZGteg52|FJ&C=%SXVLhMT9aF(Ts$naJy5@efJV+$ykW9+RLW{Ox@ zpvz;G)Jr!+vugj&55`Bkq2GbBpdaHMy7A(4Sf=(v^B}BWz>5`AXFuh#H<{WK-Ae?r zpLO<{tf3x4$4^>{MPr^M7{t=n;As-lE=(UXnKMuJG}2ccIVWErYo?#~E`q4O7pOM* z-8I-QRv3`s5pK$j{;Sh(FA6M-+VTMZD z+oqs3`^*z00|Wlx^b-jK2MC{dLvhq`+Wlv8jH_MHJ)knB#@9ivFD-#@_Um^`B93=m zo~^$gG`IY_YqA5f+A)Tb$5ABX6rnqXD}xMuGukC`f@x}I-+tbsTlWik+D|F)qUDg* z5-LBznJf5?ptjT7Bq!nJQx5it%t-GqvrfK6)8ze%mCPSaUP}xfVN5tRM%6W&Sidde zwq>uV9jigW({j8x!v#h)1hJ@tNMv@xSvS7J2r=$x<*17Pr$l zS;-*N=HfMe>F>c}-)pOZAG7%0+?6XMixfz1Ygr2J8gjURO~(*98Hvzvy&SUe5OX9T zRai4Ph}>)9mTy(b&U*3 z*`U)v{yeJAj%P3d_qKAgH-BUv?D=MnLDn4cwzT~1 ztSK|C{j6(LzcMCt?`7uQvLeNWPMp{?nXWg@lEx7R4s~^Do%0%9=j~zkOg?~-9|A7U zG8--Kri!W>xB7JYIgWQcz(JmK2&>6;gmVH{aI7NH=->8YWwc4%Y+(}&SN-ytHcrY2 ze!iud)vh&{fC&}J(pSqDtoe7KffBWJY+6T`ZY5eO;jceX5tB*O(2yC0pt53}K53I7AdTZ-W+*VQoE)H_xPxvOTwtQ7vpzk46VFnjhZu|5 ztD}Lz%Ejg~Jep7 z3YVG2&aSoty;?9P%!DVOgo)4oW~XLX;v5*(v+Pexjw@YskH#;c%!)rlD5&* zR*{W~RSn)gGjv-0Lb(3+%Z}7np&CbH#q)=>!j3}5ZG69zLoYtYoR}CoRt@o+YIIa~ zEZYW7Jw(fY5%{jpfJ=V7WjF%bl4ijt8i8e6K`ZUO4{Z1d^z^v;~QpqF8>E z%PCLk^cGi}hXUC055Y_3tb`~mzn#|)V5EPF$?yb7(QD7y*{Dr}MQ?atmg9*lLGnQx zCwBfDnq8Z#Dz0U$CO`qjh1ortBl0ISYFUfX`=sZv^kJN&#yRJeaz+(~ywch`HgcyOb1P$4gqds;_*{Xpl0$?0=j ziUoK2l}^Q2k?AD2z?=6e?BDTi_J*lp%wP^M^n#cJrfs+TW4S`DDt$zoj%v}k-(3sl;(ENZ#-eo!(l}tdZ{cub z%xDd7qWy&6&^5-FXOp9fwT{w+H6y|DMTlXe#<3NxnfM-YVHbb{r@Tz9AR<+Jmg~V zA?@zR&wFxE{$%kPJHP6jxKi=sg;(?GxstNzXFXW%SamOrkw>nkTYiLRRV`FVR|maZ zWIKl-1%j$3!sR;Zf`3Wz^?>vS-NS=vJ0`vSg$0Y}UOWto6x3O^b0zA{l`ZufIj6m@ zmvlU*S`d(5`9(Irc<#J`o8vxHqcr+T;EH4wNN^^3D>Q)8_>Q*RE!4cZO zep{vz-7a@L!uLy$MvEX_RAE`u_E-r|>BM$R?4ikkXoKsdsKrFO>LBpCFE&8Xd0s}& zS4~&b-ihy1Gk3{~9nUOdkOmL4GkMbs-R4yrbvWB)wwTq%plY=i>FwO0(W&ykNl#++w!G~5DxKuT3n~KtY>r}sG;C@# zv`SB|@u8J!18fM7ZJ#KZjU!>TLkj(Jf9&E$zgSZ+o~uc-Hln=4P%;LiEtjq*DcPsZ z6Vm--4Kb`#AFb*)Vgn1`&uhtMmPcn^^kZ(COisBkk@(DkDXdj}LgUK5^zo43Mvlq6 z*Ax`b>eWN*=+?t(j7cRG4gA*&UWfyt5kR7`3?v0fc0#N3{!bnhu>~fkED~phrA2|O zG;I=RHE@H(2{_8c19lZ|p7$*6mw3-b?Od*+B$M$A`or^NlN;-?wC`>*g^Cfz|0GI^ zJvX5xlwFP|hZ)vtbCgh<=g@~8N@N#}g`#rZW12!<2{=ah8i!8Hwx^YxM)G-X8T4tX z3lF?O)42oCnAm>XXKE3(D-F8Z5`8J1V~1D>(V zOh&qdq&pz@az&u&zPu;lYY8)Xc#dy;Jv+5*#4RR86Q)|bm+#zrBUQj6C|MBu3Y#Dq z&do-%R)>27S?!XD$nUJ*Jmo7L3*30c&-YdxhSy2$LtVW?op{N#NHDXA&;0NjwrZdZ zW+cu;Qdw>-RX4MKKSX31SVv*OZum7WI@>kEkgIe4q`~FoWyAXwzTJ@c{<;6Sf;+$b-i{K06NV*$X+g_YPZE~XQ9Eny%D-BFi!z&}7 zr0ADuar)cSq=77_<~Xl_ngM(qdP(eU_0L1aoWJ_k-EU_CnBR3z>a8OV@xNsiPh^u; zaUjvG?x1W-=>XpHEbH7;h2PEl{WKju`wnTVdNwtUo>h8Wc_8ANZ-EE(?4lytHv#d?;ZD)YhL9jzMF08-Z!B zzql#nyQkF`NMWT>N#dkSu^%; z?}=_jO=uRz+AI?n0gLsBRIM3p+3iTmSob=^w>9vI8Ma=HM9$SQmvVGj`sIMuLw+*#VN)_ruWw&c=UtzPnMC8h z?S;GQR~^*TaO*B%5k`$5JNBK{qT16QXZ@E}UMrDkM})Xz{-aEQzHB%)TvGMT*4hI{ zB-Y(zTJ2yQNl-!aupZxituEu}&oPe2M?|poi8^Q5;e5AAXpNEp;bpT@e1zytCe5J{ z9Evu4^g^MlL^AhXj~S(cAFM6!_G(AT!y)rb0y=MZpl=4^jL~x367*~qzd4e8$5%0)%I4WGM}?f3 z4%q_V&IE^`?R`t@DAgZs>Xq=S_R+Co%=RF_yMh*VZ`fyJsPHdu8K8w6eFnJ4;kDHr68=93NoA*|)1+C!JucXL{(*-0Vg!>ge@ZpT}MmBVDW`FHoszmPB-6yH90IALX*~M--jUx0b{|>~gNq+y> z1=ZB$-EGBNcl&epWLr9)sxwt(;}3(S9+=B3rGg9!wvHiLo+;oHOL`J;rf;UH%X|v7 z?rQ!vlJIsZ(9~K+MnYS`z|Sm;cskb)+OhB{+^nWs`_BtBoq;Z6tC5Gggn}IfNqj!Tw&pNUqJ!jV_ zBtHLMbP;ZA`gObJT9^i__gte(i?Ma7=AR69el&0CB(W*tgUmWwHhmkdL+BCbQ{`sa zZEg&HLDwn&AiL3h9Tyb}a&%VUASExWQW1r`@c(KSVB&Xh|nD?mHElVw+;e4lomKV(ya-V6^dcWiyQkA0w% zx6VgSB_ux9ny7a&D*Jk|!vJH^f7J(&^#y|62+~c!f+-yBWHGhBoFgAkkYGS=dzRGO zCy^1h@iD2Q`QR8wpqqb*aG4`?p~Mym8xHh1it?8{5PR-uWO_Ou&4>rrZVQj>Kf(Sk zP{g1R4=QO@KDXogtk3y=02tJx5uBoEWmW|9vYU+;OdDOsyz-0Y z()nyBul~ue2`eEBc{P^JCpSi5n9}Sjtj+R*E~+I$Ii8>o*?*Dh2Zv2%N^Gf~7fvjX z%_|wCZf?+F;%b+ZWa!Y1 z5h)-!9m=hfBK^m90l2X_i5Jz+FBU~}g1WrssT8R(dD=q7RB50)c!R`_a1YgYC@f_p zPXdvZb=;<*IRw8QybOAm?umO(SCcv~fN zTQ&ISy>}T0!l&C76`Hra*=!N7)BawY9pgZstVtE9zpf9_`a7K-vgn>8Vmap2?JhvS zyQ?qd?5WQeFO3kx&(zVz#M6;zP{3pO(Xwi4Gi7F=NC%^n%KXk)VsdVX#D8~n(rPMi zARo>Xe4rw?pz;Zh>wv}cKIlQ^KhiJ4rX&@th3LL#r+@y^SZVzSQb6Hf>{m`Hy(a#T z4yC}4b*8qdmhCc`8(D4+$XZ<-Q3I&ero6cJ=dK(Fl&O%|PG#w8_{P75I?G zcNZzZDm(~A$U53Alz%H*{73ftk{ZjbuT1!bN0_%GMLgUxC>FkSTGc+<$Lbtzulw)p zNxm<(rk~|FT<1;cXjs9doj*PHsYrTp{hXPpt&jf%0_c9)TYKki!v%1~g2dqkgmym8 zS`B`#BRaaHx{$Zmr<1|!BmM!5cUvK`Kko^_%D%SM{JiINr&UIA!@u*4 z&5Q_Cjb3ISJH9EA>$0s!NJ}Zl8!HRx7Ojr{KolFEa%~Gm{2!`&gDHPbtJjP5X9~RR zhfw72Q7D|lKHg4yi1yR4kxDh)a{)`uJ0mN-UQtJgKQ?JMQYg_xzF@?(!|)iBW@pBP zB71L%9r^wtbdMxXfj}cBo=sDqMf+_sY^nph8RbaY^S#7z=-pI4YNpLE#MeYMO<<3oBN~PTVH%C3pSB{H_e%XYy&src$)lM zX19l_xaR>G&$mQ^58LG>bM?~P>;B3V`u@4psftk37e8jVSNROD8woVs$r)|pB{uL; z_Q%cD6^Mo>=Om<}(7ASg?W}Lxiy7xk!MH(NC@NDgO=U5Yw{^oNSKT84mSgMJffnGr zELJt^*1#jn?HhlP_Pof9-M@;ukJPf`lj3}rM7Rd3mp90_Sqh{<7xg=#@avAn;T zJUbD%G1V$J=nu5ZoP;Jfk~`b$ZA4cCtR!zne0%TNYC%u3JDgZBe#7+pHwpToLLh+Q zxt(uZ=Bv*2bjV{X-p|s6!sSI#lY-@|6NeHTUkaHVN6q_Yz2KrX9~PbhTR|brypQOO z%&SeFzK6<{%W3IxoUPSVUW*1W|CKtvkCn2A9epGcv&6{#K{Q{s@<@B;tA9_9{vp+l zGzdCjeG!u5`M{I}zyAcBOi`~53v`clynVLDBn1)!H+z}%6->0G9STkAcQ6HONBfqF zmjFvb6LXfyp`ZoUWf3{e#Ko_7w_dpoHQLwz;}KR1P`(?xow^jgzlt&1AM9dXUj`Lv z(hr7)L1k#Nf`nxEj$Ic>Yb=7aUTS{SBaz`P;B4g?DHvy-%5pq=!Zd%;k}IP{JOFKb zUi{?Z%0Jh;O->=SRS2)CZ?X0B-kavQMbAB(axTVeKidulhx9dYCkwq`xlrS6tgQ*U z-|uk~5uvaIM95#I{`nOTPQ!c+qnl)oPt|bw0a%nP>x30D1KiZT8F^r(!x(o3Lu2i-Oc5o5+;kzGhX# zgcYr^$BIg^lvas2m>GGVi5vxkm%l`-e>4`NDZ9_p{+@rf|7!;r&yQ%x`@L&=%gd`U zs-^+$@0-=#%AK|i;Rk6>@JY7XdH%DheY5ivLmr8CA^)Tob*^1Qa(Dfei`60YTnAr5 zO6x7Yy}XNgZFsCZ&#LsL(4ozdpXJIinrbvNCb;SGg+}lPjVp;S!L9fOF{vZR(S{`R z6aacFRND0vq55U8P6!KY*Fsiq8Elk4k@D|k?yRR>Cd@;L!@#K3?j+Hdy#`^DTY^q3 zD!9TAIj$jp9F+2{R3ZQ=XfzP)k_s!B$MV*V%*?pB<5M>p%-#6F?K+qOvIvCno;eFB zyC#!H^X6GCiY;vPAQcZOM>9qd4YNnTRzFuE&eP+{W*v`_k^Uyf@87lwG;;JOy_^y} zgAw%+uF314dsH>tbW;$b^d(EvJ1QVK5`V%yVSKbJkkPnR!4S(2?~0C0GQ(=F$0504t+0cqUP5`jiv{+_?PBvc)5f`XL3N)7f*J3+t9~3Xzxe!D&&|fw zA-NVmF1gE!6Q^rW|Igt)w}mb@M?LB1z4i2Vi^FLU^^ovgS2fiEFn6=6{9}lDMO$^p zVKyY81ChFpe zYPURH=iD#Z{gJ+Pls~lAX_usQ`oJX)gXY3HaocYpBfyE%UUSs;*#ZM$-Qh`A5&*lV!0VEaXPhLTCBm zh6(e;p3mKA8+oQ|gT z%^2t`i+->vrm5zEtZ)j1vEQR37$6CsJK+@2u>?gGl|Yq_xt(@-_0IXy)%vVtw1xkB zF$(D{Ra=JDt&u$G@hp3VSJ_78T(tA6>!p~6cY7>S{Z*~hJ^DQ$c0=ljY=A4$1L*Z? zg@LYV%_X}vMqoxq!xoxLC4AE7gs$-@VGMoajOmN#KC2**8j@FQLpk&$`+uJ&+U8L= zCySj#CCawU_};LyRLL3v_7$%>*T?B3CJ(~lLzAzI9z1_pu;O*gSos9E~w7Zpx@Uh+8yOBGK>$aO?qZtNuhSOPW2(e{? zJj<~nbK6aZGs3q*`UMPEK3Fxu?*=U{1cg_a%?DnbwycEQvV23|$?v>1X(30i&KNF- z+&Fj$UmjH^-@LeuwhcLIqP%%ZmHJn%BwCgYlqsY_5wEEK{5>e@Xr(Vwl%L=)o<3Xy zcT4-`_geuUw;Gz7>35;$3^AXq2rCs39(5))w=ABAE4(0~LzGSFe+H$9`l`W10Avdo z?%VBY&+uPhXSKEhv!hz9;F7kxq)pYZ%TN=O zBgY%x^b(au&rn@O1Or)0zYB~;I?cztKQz9vl-^)612SfE*@G4JDNWpTMuMSP_}^L{ zIm&g3{eBVpMDg)T%y`w=RP&)8LDMkUupdh8QoNcR*Vo$(sTe*nRT_lW^lPbnSXrmc>xqEEX!U+1{-1xJ$zy z(v9`lj1A z^3Cx`9#>=`dVWH3oVYlsH(26~A)WhDp_{wp-0Z=ZCBvyTx`$QTcJVsSZ-1ITHoQYG#<#TWbyjI=^OfP5%y6I5@B3G`)&<8;W3UKg#>$5> ztR>F>?%~Y+xC6RIcGMbb?9Dhh1P2vMI|h@IlJC}Dc%&J@HCTIg!^W_ei-L5>=xgo1O)OY}rC_L2TJqL7_;gF?Z+dtFfR9U6m$Wum zrhndJgt6l&Jhy=n+_F1QrhEC#j%teE;5Imk1=%-qCGWeG1io?K#CGX!846rf3A1Vt z1kZAU-QHS0`LhNE1b%&h8}5sKKN1KWwO`)ls1D?@GRpwssb!4OXi4kan2HE83-?voT&g z#f{pks^S>Cxavo7bgb@Oj;VJUt#-M5M|ha{MqDic+9Kmz_b#lUU>wz2J4v9C)Eafq zb?yInvJ4gS?@BLCVcZ?9uX82wNi-kE&vb}I-4V@8;Zd= zC8mxshmTtrEp%S$Mu6w??%3bgWU!!#J55OGfyI4^{J^h%5%hHMra~eVg$IGAfZB!G znD(6eeXldl=`4@p5UuRZ{9Qk=M*dZCXkw`ymTQ?brp$!V1mz}VnAUIT>UyBoDz!SV z73NWyL)nrv{JYM&;nL`LgxMeO;*z{BtHR&(GWTgin;7?4Z^Hjmbbe9^Mc4$ZXSn6|`f);jwhMSF;dnR>? zi8Bs)c(6ZbHS=)-u-sG*0}j^tSBsqBKSR{Siw7dC1WB*;((~Hg0iK|KkcQLAs(NkC zy!0L3UY=}To&pjV3+xbUe}8aOtZ2jbuCE4#bT;}LMj#3@8AN1qP}e_-%}R<%-x@J37YyMy^)T)V%$u54G7*w7RTKcKR1@RGMOaI5cgc@gbi<7aEer=IC-!4nzJ+n=!@ zB-$p7Wfj~LmPz}=E$8Lez!L`z%PpLbmo|yt=h(mlF$p`8KYtt#KUcXT`ZmGiD6w6x zwasWtzT;KVOsbl|n*?>hY>^z?Fh?Wj(9?gU49PV0?n}RiPRZ+I8ylMdkBg+#h>Y{5 zkbj_3kw-&{?HyOx2gXZ|q$VtExL`3{wh{%wOtun!F#fz}>9>MS>~g&|JeB5UG)_F6JQrD=>MCpYdeI0A(=RO?$98{bGz5zR zd`-sJ9+zG88eipl%q!?we{-4k>+JXY0Uq!y%ayAhQW`Y;q_{(D zcQHP2wy_>KWkzQrdWHmNR@Y(qXN|Uwnv-lJ@PF5?^}1TPF7K}U^l03;{bMeRJ@telH)qKRDn3+>jxqqa)iqR_mbE(?Y!w)@6YO19 zkU5d+aX5b1#0cOo=#$!w_z7$uUNf}m$mDAk*7Jeo#0R(i-vd~b|1Do@1by{v(9h|Px;t})l*M!(kJ;QS>~u+Iz%e-}j%F>p*ctZUL~7savn z?sVu$ErTWl-jNHsvG8+y#sOytU$-;bn1_K^u4|^>;EXrJF1AgPa+0*kZ#s(%zTw>{NG?h@|tP{q@A(we)XPQ z7F=V(U7s7szm!3IHkcaCs`hS%ivw=AMtWod-=q(ajzONT2#qq%w-0-F2=n) zt)FJvj+~1}O8=urUl1-Ro5cHNm#W_WB{p_>cPFa&4Y2UZFTgmKi*huBEf7=%1BLbEd&q!Hy8*P>dl68geb zZD{J0Mg6LVzZRND1=peaN?hg7Tfum!ifv6k?GNuMy5-|%il1HMxbL3!S5Ox(5winT z3f6c=W>9e67Np-!iF!%JO<^iaWXbwI|Dtr(+xV+XSvY62{JG@y$-WvXf{vl0@=WuG z24iMwrr_)cbB_$IcxV-3J3Ylu46A3W@GAwUi+(}&TI;HftUalgNYok_i1kohU*IBk z-^Q$=J$%*<#o-g5C)}rU#O(pD>uosyXPA`9{qxB!OBZ;Cji{njXV0TkSuZY%gW9Yz zI1pO9XaII}bc zN1exlw>|3Qmj8%NJZbhYe;EwWDXJ-Cdot-w$*y}NB8q5a)#zi@|J%qvC zaC{FPjHy#21a%ym6_RY{MD*$YZr8;|LEt#v&ph^mkSRZ!+!Z!`mGYn_B`)$4G+$vcWvDt`Pbc?0snTr^u?X+aJkOciS zNiYl2R5VUO`HI>5)fim7UP8_4O+>pdSM4b3V`F*(!_u6YpOu@mfP|LH{2HIKVC_{M z()by+Q)YrfFHfCXdNd5IsZBE?*vLjJaz`?3kY%c@TCNA^J4$T-yr(9~2`%x8K}Fgb zASV3FAdX_i5Wb@Y@B&)WvuARrOkhyc%?>LjCK8un`cgCg;A9KO>^2B5NR8%-(%|}@ z*);2_xLF@Fsrsi24=~*1~)FzLOQwx;r3NLHv0yxLnEnBGgk)pkFz9!?bC6 zf+lSvAax~M8>=6)^(zt{yu8$^MQ};~ z10n5Ja}OTf{YiwqZeMoL^OflW;`rKyKsW}QHQI8U`MRp0&Yt+{rw@ezc%3Ka@g}j< z3=SYs@71Dmn_1G#RA+JP^OI=%lwV6J9@2e3gNwvIb6uZ2E^nBXoM__K=M{HRm@GDA zvnYDw`2E{)xOX`~ztMkKk>nlQ62BD8KHw(WZC!yvEaRQw8fHygbRl33|D;FlhY#I8 zbo4w4FI!TUs;V(7n+@n{nYEu4eLLcpDU_miD0KB1Sjf_{4?MtqZYyC-@-Yyceqh}4 zT(JVvx}A-jvdCpxD1SLMh~gUsYbDRbjjDeiu5aR6lG1#V5O1NF>8cx(nlw7oYrN-p zgD)3cy6KPN&}UKeEMH?z$%Hq^X|%kWve*=+{&>@DX`!t4*G^4o*Gf?SfPwjxq>vT* zq>d9z%wQmPxXhmL)}lZBT8x|$dd%hgt-`83A>z3rLGW2)6frZi!06e_fy1nTPPZK6 z$XuzEcv;s4poqJ(zN6}fcI{bARTF9cYo9BlGfQ8#>?ucI!G=uBbLW1Q*-b3n0=Z9T z6*hJIjaJ3iM2S)=Vh3f+VpsHdG&N056s}d>!9-)S$*c zKId~NTs;;YKYCO-;uY5w`Q)4j()8W9{*i4qby-2z!$d!WS0g1~w>IN?^K<%*96`lu zad63KG@&J&CYsZC=aWpJN3h_(iiW}5DJxAQm|_7Vni)3OGO#ki&C1W7;-)b zy^>8B%!FA^Af{#QdU?kkkgvwP8&b#0lfeU{<`;R!YPWve7{?zdle3h&U%CwvB+DMO z6%FMo73;y_J31C%9(G77^~~hy|NjZ&2RnpGdhRv%noQ&9*gb8=G=ZT>Qw16utNUl<(Z3otc2HD5;M!di6H3^{h3rwJ+i2Jw6 zA}JPdaeDO2A}wl-w09m=VVmqy20#yF^Pi z)ievYnb1_vaJtz@FP@LpdJ?}Bb0KHM!5Ycl4l#mHv~`+lc1ynR^W<<-jEm?(7<{C# z5<89SA)a0b5ps(ST++R_;8@SaV#UNCriMh(R5Jl4Q;@F5d3xZ>Lj5GIYW8LutB1_p zmOboI-RxE(0mRy^N;WTEziwjfHVACsI0HTV^~-pRwJe9YQ}CEQeGupQmj|J}{q3zXLtmz%RMn(q9bTy)IS`pGiC8 zFg!z8Y|$w`xNFfodmMtJS#9ValJF6@yx9EGeu*YfyOv0#R11dH5t*L8@ykeSO!|A^ zdzZa4X#1_`))damU|Ao8-!>VDhk2>Y0DD&bxa6lI#Y|1Da>O1M8N^P#3xf3#<(3;r zJ9M?U?jAegN15*rs=V`}AXaB5X(_Hgi>-WubB$Zb*O!n>yW{Q`wo_8#M!ykiZN2dy z(oSjzCXe>6352@f7hn8XlpZ{cHN!zOz^BWnmIWDZf;?u4>#aI;(Y**I$pVN`(0JhV zwW+B^F{ewStD@l}%@+?gz-a=l>j6^R$r?c;L}6|Vf#4gN-IA4fyNt;_`SNdcEUEI* zvRGZjdWvpNFqV1*t^sQ7(Ol-kVf_mK?u zD--wAF4~S(#cG82l;%TH_=<&-kbnJ`GIw9JG$HBf*%A@wVq_GQInZJ3t&P`=SFJ^A z+S562OZ*!8E+RXsW=30xQZN0ZWkt?oWDSm!SNeamBQgFzup^OKJqfmN`$JZ)vJao= zYiqT1dh0dZF>}VQj$f8zV2x1#aCI2h7FRnOoWLZmz2VS5CK@LGaF(z2Z>}RbO*)u} zT1Wf(P<2lG_g6vy;QV630&87hu?EiorY<}98n;*N$L%Jc!XRKKtyX~3ZXYBy#kS^p z9Ou5>V%t*c5lVTI`P7-!vUWFCNQhRqj6#Csw6xLaEx1tWsq;ay!7P|<&~;Ad6-m!I z>6u(v%`#2x%c>Mm(fCcXV7t*XTAWD^g%?0}G!}*L50MZ@FQ>-rUCqiJFZ@Z&X*7pY zwQMw< zIF0!fy5c6`xi#p=K5gwzt6!m8c|9ClU#1Wlt&b=>M*Hk}``MyUGS*nPI3A{k*0uE` z{8YxQ=1lcxCT~EY^+7z2RZzOu!d7ykArO3$>!JDSTOB$)<_vD)r}=3TH@0T=c+PN$ zfB5gPJTDVE48{qjoFoKHRPDykqe(+=IaO?qQHEY)o+jOLte>ZjE(SgqR?H<8=Bo1_ zOYFput{c+)Ojd4GxkB^8+9t9=0Y0j#Jr=Ok?6aWG^4_w+U}yzD2P4s8CD_*W{=@yo z1Sgl0gj^@9GLfYPc2hCpmaozW@h|92Pgvs$b{waNGblPDV=k0@;cay5y=sM%8ryq1 z+=Iu@{=~wB+m{_jjHFfjviXJpK%BkZ3Vpd#Gb3E#T`=xCwo7ec*F++rOof#+hFc+r`;{3i$LCfot$F=P4Ai z1F^59TYef4NdxV%ozQnoNp*#nk7F6^%5n{E3;jKx*yqX^?TpGrO8dl3|Jx&=R|%k} z=O4~?urNyTG_Bq3ttk=86U_vu0tk9ZlvCgPkwW6QKL?+@68+lgQe)2krD~s%5cA2B zSFaOLGm3hjQk`17(_DTK;gPX&Z1|SR#ETCg>g_!*y_0`vr}w{DbDa18V9j^;o?Ppk zTdWROT=LY06&d}K3A=R5(c({IBwuU!E)hPFMYN4Ect?yw;-&3)wm*l_Kkcaz!~Qeo zZyGj<#6X40N$|jdZ@}e99v^HU?_%DZxO$qi|4VpP-`MsJ=}1{AYtX6PPcZ{NSY}^Y zEzT6#9q3kWYE*4b=8kJyJ^+TQc)f}29}pwER}f~?#);~niG7}bM~D{=h_^2KFb&Ck zNm?MN>yh9dk7REZhDpu%EfuqY)fj5LaCI&#b5swwucN7C5v0%5?&oZoNJzI@gF*nX zL2cd=RaK{kS_`vXi4R%1T&Zj{!$fnY7u}j=8x4E{axz&jy3YmcxaLYpOdG3jYAd0V3G7VO%?k(jDoKH`^nWhjy-RWa%QI6-_>Hr`oQbQfwqrjB%9`Jy+(y? z-wgOtBqn?G0|udnfz{PIpEWqA!Y`YV4LX|te1MVoNtsq_1;hW&LHEEx&stQ9yZk9Z zNk%xJHzhDbH{we7#<;?c9K?mR0VZxrvFS^Xga8v1eUhx6D2<5iCa-r#_0_mZ{09qiC?fK9~2aciGF zl=W%?M1;CGAx9Ux+PNQB@hm6q&5M0$y6xS(wfu{XVJ0JoY=REDeJ@rbv;{6MB_iL+@2ZM5;mp5lBD?Ata%b(2I2G0s$m6>Ai(s-I;5x{jT@jWA8Ec z9^bbP76&;ZBRR?a-2dnP-Pc7o3<&&|16+^IuP%~#`EE`(PHTYUSV{8ODMqAvTz-`7 z`tYnexctOy=|F7ATj<&}Q=h8_1;jYOZg4Q%EZ_OV^5~1aFcDthXKQK_6_P7SFz#sb ztARA}9XNAo`@o!tuLx}20pRDqsIc~Wrmg%wbT%lSPd)0OaP7P77T3q_^oDXKjAV+ zEwm|`hvgTM6?z!o^v_vi?oNT%&mV~>Pb&^M#hG{OD*)JZ&OI{8rozp2Dpnp;Q zB)jat{Y8~BvnNc6EioVWs)?Un+Pa^s9!YP3N`R}hGvX)n19c^msyq|hGQq_ktD1)0 zoV?5x2+!>9huUuPuaJ?3n z_u7jWyIrz9*^sUo#PnqS@Wd8jN1A1@{UTsxX5G_2ayjV7%s;_uM4KwJHz-+|w?mhr zsiPi(Hlu$Ud)~4gtbIJP#X?;n_9kHPv_bigQ&m8==xG?9H3a_B4RHrE2zN%Q&8V6U z*~4fmFT9qWS=rlb^6gT*4&|~qq`SSvbK;RbKssInv@9rN5p!L(Sx4++DtbVpOOmO4 z#?e9%zR0L0B`=!87o=dx1x(ncWMxu-X6-$x)f51N3+F-X?M|(B6Q=Nd5LUWXnq#eq zmZ(3kw*o{zaWBx$p=>ioic&If zG2bt5s%C61pDw~8nn4#lpQW>f*T-y2E^L|*4Oya|Q>K(n#=U31s2)&my#wymhEs06 zNlHDxr~-dcWx25^|8sJULWcS$Y?1MQVv97#qb{rJDXBJO=!2$CgtMD5Vde~QuKSBB z@vg%!s%J)G)=`w2B~Wr{Y}54S4Ve?ANzrj;K#~83Tjx~^c>q+!q^D>9PJh7t6iFAX znEV9H6D8FS!w z|CaFW!+`%q(!$Wj0Ohl;wHfCKP+J<)#R8{cP=tkpNsp&o3Wlf49d4#wWOd&=OH4t( zQwCe(IYQ6z@TNfqDGW>dYU~{xq+4@#=f=;zL=M*7xzS3xN8v^rbyL`}zoQg};6r;Q z%W9}j)(7xQln9wc{5y2*Qwou&5`x^AiC#NIlNxVvc|{!ciZdA%!`fRhfJP2W7!iu3 zKZ3-K;IquUh1~Aa&B`6`k3m~!p)NB;YEa(QBe3*r;Lut}P?P(Vu@Rlsq5qpF@tQS4 z{I1}tm#L-^4$mOEj@UtvlLC6x?-X9$lc*6s|FPC4L;=c>Yle|e+PuXzP%(X__c-(& z`h5<_HIi0Os> zamb;s91`1~bx@=i*1_!6GnG1Q{iW%Lmg!#m-V{0^l$Rve1cv;i7D^uX3K6oe)F3ggg>dAw4N ztVO^~AdlL`&V)FRQ5}fqc|E1yoFVsPD7rM=Te0!)pFkIHv~M%15_pgx<*k9xR%s;l?vZE{w+29ipu5jz z=lhjG#9iK2k~mIM8GE|Q(`~T4zVI&hoP*|p<&b{Da8amO)H?~w^#|U+@#8EYkX)cq z-xG6{cHY#GiS8oP8z8JkT90UA1xd3rFJ=lwQsaL-3m0~(@s!|SS{-TAy_7<7xoT{O z5Zo6=zvs_wVO?}Kbl+p__T=i-V=LZ2>_xL57mij$`rctkC_yIGsxh~Ty`$nhR6iFK zWIsTEi6of3ZE9&6e`bEk9&<^5Ek^vZa!%g#cZvAk+3DOQvw6sBqR`Zaz&gPhD|2 z=CBo_$v1amhk06H=hA@MGzTAMP}b`a>#Bc7 z4bMoTOz;gT|#aw%KlWEFIXn{uluc zP^eO32@$5XAKOg^wEmeqlWIlD$o>`lcSd%>D;h<~$PQ8eosr!%88o7r#Z}iNNYTC1 zmf7HI50EFcOMe}&;(dojecjr*pdK~&?8#N}jCw8Q-|Aq+2IMU^Ac`aeYKap|W4Ip| zU*hpO#M-cUdw5MRB|eg=-Ib)vFHsQ0^2P|)dmm{DtEar(*EHnz zMdaAm9EN@k&ZhB#?hwTb9d8DOh!^n=qqGgJbbNeJI(c*R0Fd8_OOv8%FqUj$*!p>c z`ifG^l4>bXBbuBl!nPRwj7R2%3vnLiPm9p zRFWIYy5Ux!97HmG&>+O*4@bn_4PxC(w{4Cimcy>r@zICRdMbq2l9aB-qO3B>$9>!Y zZ+IkLs^0MY_WRC&!RGY$H!H6^eBW!u*1!u&A^Z6!%*|0E5c27jldoD2%ZzV&hACxC z`Zf5OgC4g_7EUHUsGV@hRDm^sUV;)qxa7}4P-l&F>Ed@`mDfn@H$e0KSNdc$X}@6Y zNgs}amBLr81Z0x*5}cEt5UPdwUBMUnM_HyZ5~;{=?g%a zX8hCJ7!gOY1sAUcMS6okQ2F`;yXt&vhqi3m>fr*3^Z=$i4{SvaN31x_YKxZk1SQS1?fx5vN{a8FH3+M?5WhTvQ>o zDy`V04gm zyU=E^9pK_0&0`~9xmHwWJy*yi|z%aivf9OjuhUh3;8~b}U-ARRmoV}yAdOTB=b#NxKMLA+XHf>y_?@#R4c67*~TSbtY{P2+qME&DafKSn^Il6lPip z2zf*2-RgyI(Y-H<)mvJKeyL-D$y=mo61p=1hXj&2-f4+tKh^dTKGP@K|3{jo(J=Ba z)F5mtoQ|aW)!;PD@m0P)pum{lVD-UJD`$nevBO=S1j2JBW}o3GMH1W^5<0*?cN-^I z^2ufun0v8>8!E;O$HhoX0!A?178rS-=NeO1ysOT8#ck#8z9sQJyFu9CXw&XU1F|o= z@9CnO+PxIxfF^O5zzK`C{>m#R)kRSw^>$xCNc9H6cn5|A{`c98$Odn-U0X>##NBFW zWptlQ#(lx#EgAEbb>|eoQzAY~Ei_-AZ`MO`W1Wul)L8A_oW+&!`yB#nCU zp*rdbG#6*<738|=?{)`RBx~Lrx+Xo0ohV$cg0o^BY9d}i7Ex9x>8S&g4$Wh33PW@t zL{pHL80MEZ#Sb071D;P4!e#4hYt%7w>zUBHu1Kb%u@<`tmdHSU;j$>=&n`m&P zt4!FTKIH2X6IjU9j|}CK^Zye+ElLK3USc*3liDhnO|s}PueF22C~g_cU{@}luG1O0 z3rz7~jKhL}>8EuaFe)un)KEf}O|^@!CcuMTFv{@`Fn8Ur^OnJ%T^PRt_b!d}?A*iJ z)vr}dTZZ36EtGy_ne2A8REqiUT9gl`(Yb1NDW*YCj0Wbbil+h+n|30o&%2FWdaimo zjKJD;o_5(#gGHXRJJfU0Uq{AcgJS(f@&x14PU}3VjRu`bq{6W^I(p(bSXhPk!ONc5 zolQ~9v|Jx%`5X*)!keWEc(}!v&{w(=LQ)@^uMqJg>EPs7i?D^y3V#%%Ufcp?HXcRG zbdvAs)A4Xh_D9oD zEPm!6Bdz;F9ZI#8HQe@jJEH*RXyJI&dV+t*rHGv9D=ciwrX3N>z``hmf~b&pf0U^=%+ zxe84%a87CIB{mo0l^bGEa*dwQSqo%ryUl7h8%*-0+H_r)IVp5?F&JUO2Q3|0q^NNy zME|;BO#{bH^+3%u+f#`ZnUC&26BFN7MRU`xA5KLq8}aE0V;j`O4~cxy&-iJXjMAQ% zdgn+!k<{*+{bp;rnWBY%B7uF=Hc6MdYiMRzcEI0);*sg>s^-EqV)Y;)#ffwZnX%qA zTugecEl>;~Y#<$Q#$``TF%!b9lNp|U>v#5|K?gql5$mzU|J!B&mLAbP1&gI;8E7&` z5AzXj-sGMLN{(S*E%3$}<&76LiQXISS=L7@-X~^mN#Ton7}}V0?8di(0r{pMQqgyV zbRCBRpxi73F2eQ_el&K|ms}t5FqYh<4JYr%^ zCKgVEy4Mu6>|Ew{{GSj*v^xwIV4Dz4j61)L%R;?2t2~UzGw0I1o#)AfJIy@^0f*nJ zJ$e4)g;~e5_6Y6lwJ0sK&s_kPmfxd(L~JP;snzHfqfQW#O_ipFJm)G< zLmG84@ihm46VY$x)^1iNM?XN zQ6Ore`R8W9;VM;inc-*h1Yt+_s^^UnxeR9gX3N%yuKe-J1L_wOF)Uhf(LxSJZZAn- zfVQNgnmq(i!`TylVlonRVotqs?a-m(}8+6RN%1z_?I=0LE5nUQYw(eMd;>ujLxW zq7G%Fp(2cvZn|kGGcU^-P(n62BdhqkYx8K!ptf&^IK&bNiPN3vzElfW>eBD-iBJ6; zwrD{+f=V-uhMh}%KGR~+sVA=*H}do)=%nOTZWxiOY%3m@188B36?i1~gKTbhrlvD< zj=Y0Wf-1QqBeE&r3^o}ObnUkuK&69ZVKyWQL0|6HAl=>I?bvqeaVjXDIAk64Q_F(3 zY3KLB7Wki)9yK(>-fHV@W^}ETh3!$y)!Md&7Q9IDaei0s*DAp{JFlq#GxitTJvysA zV&=(7zs+qxqMhfsKB8i?#OjewIwCI0yyI4ee{L;u`=u5lOZ=_l#1uN^$r3vd6f^Bf zCJ>ssu#pz`z>ITad*saS(T$6TH6ts7?HiWZxx*)m%j+_bDIp z4hAn_P6@1yH#1lB-)Vf2ZlCH}Xt2^l1LPlsW&-1f)vx0urVbk8$734}1B}l%9UNw4 z3}kK?^Z+nQzj@y^qj6PUVPJrJD#(1oKa9Mli!`=1PWN_fkUj_is|tZtH+c{hiapE zWCGu(i~!Wdhmng6*r`h7o5&L2#aruDl?nFLa7&!o$X1ekMwBE8>@$U1a;;Mt$6KyqS4%z>?QWWW$Gs`hAmwoZ zHI5`!CHFEbJIqwCp`vnyYMxAdr1l4i27Bhu80Fpc)tuDd&7X?CyOD41-T$SE{nZL% zmHSC9pbBfWiPjJj^)jX3qDZz&9Pp&>Rt$haha5VMjrun>xG@>hZOgK9;{Uug!Bh*G`{LoUU zi7kIp4O2F+lB-)->4*TfI~g;4{WM~ZpPX`>)ZBJgsM$Go^+vO}!cof_IIB|vJ85-# z^_&YfAlx;FQ|)LlmF-d-*#}H15D{6Js*NFQH6i;2$MtTuM)5x|Kra35fyixdgo8cW z&St8{Mw{TZ#hij*0e>4cd~nl(Gp(x*U;Nb3Nnx%RW8aWI)Z?BC@c1Y_)on3+v1cFn zq%(}8gE0XZn7`VmZeDCsttJ>U)KpaQ_&-?+pt}FbQjq@-ltM=C2|e+2^tT3=j!p}@ zYN^lx!rk+k9YT{%Wx!dS!S!$%oj=B zZ_ObX|A&Wfu5QjRDq1=9ZHK9`TO(Ss-BZb?iS*}fxv^#Xbyxv;W|c|GstI&xuD=HH zdW+b#{-U&?NG66&vqYASe@91rK8*X;cQP&5SQ^7F_2|!99kfs5;9w6b1q?X$eeb&b z@TlX-PS4!Yx>Qv{nEc|fLtv*+oF{o4}^?lHQ{5_ z`CS-`98|-DfpC-C{Yr=D`bvo$vmC(k2jet%4 zXUQ1&N68?0rq-RZ&lFc2NqvCXu}=x_MlN64Ut_)qcj-L>FV(y-US>WX-d8^oK zWb8^`U0_xHXmURM&@43wsE2n2B^ZF9X%IAbz{2T7Yh!fEa{8!w)KR7N`)GiWhcVfo zb0S31juTOsHbnz-G|%_ULyCNUqhEtF{nS=}*ChsYSBPbCZM|VfXP`3a0Ufgn?ei~_ zC_mzita*EV?FazHgD~pf6|5WvpNSP;owcaCjTvqkYLhA%FcZb`TANRGrUv`kaTyvPV(eB>`y_N|293x}V`c(9B}npVw<~aj6#kl`9OJ z(Xp_*TiVlpHxUkNk0M6vaPQt})TA;apK@mS)r5|(Dlg#I`z1bnb0h|2w~RXiRvb+& z=opQlIdX1;wHg@JFmqgfTBZb~VL9v(!cH7uSYT(Z2(T#9R3WAA2WYr}j{?Ws8kmDM z7$w28(i-8-=9Ng`PeS6cYRqwu=^KDEvWjgXTd#KKwC1VXb!BE%V2$|QeiWCBpml&t zeT6iuDWZ9!;*l{^OBv;vYdd5wFY}a$l=Qqh;4tOpp8Rk=gLc)))yv4Ar$e`WTED4_ z)&i6xy;msaMmb#?%+DjHTE2PD99kw_WFD6ZS-rS$Xt`{r+1F=3Z-|KfMO8&Tc2VM; zeQKUGfTE1r!=pgkn9KCBebwZPRL#X_{E5^0fojj_NW*-UYP^<=NB&UtNtCG!I0i-# zJpmr+($W&Q+?8`oE8F?53{7x8!)v4pzW*5Xx%l+D}{UMAaX>lXqzkvcu|Tp z4|tTQ3*D$?V>7{zEoz`9Xwe9l7_P#_{s@aMP4F$4lx8ur9^{4dw`VM~8|-%+l6y+C ze48YeM&L_FkVDRt6^d37gm9wUE3|7HvA_@EIYJ9cGBz8`58YFX2Nt>_0^USQ(DO&m z-;yxV8EGo-yrj`RZXfzNvk?KC(!G#n4qut=9X7eOcxRdKYY~y7880rLJ~{dGd{K+L zU!LKuXyaa;$dab&BNYc=frWvvSf?baqh|m>;#|{_mY##7mJ~Byi5iTo&x(9@jo%7` z+9}!Ure6${b&y#D8>;J=q9Lb0H-($#pui(h>TwjyB zyMk4UPcto1`a^!^ejZF97gAYtBF{BF6IbZ1qb@MO5QPH>PNN|OLnF^m#yoT5fHQ?D zQ{&4p9Ub}aVxEKGNRu?C3b%o_HNlG1dST>Wsijy4f(5EL+qaEkW35y4a;et%3)7~V zhZ3yHvU9O_<&fESI`P-qi^mwZ1@EAEjSEOq=%AT=0;_emp-eV&`FTp=mm!SIiOf3K z0a+E7NIGEWB-=O1|J9Uni>_%mIztihKd~+!m8k!Lb;%2SIk5cBsqUn_Lh1a>^G#&6 z-5GOF(^u!ntG^SSl*SUQkF~A$7i_*1(|)C-0B&Eb6rPh6KK`PT=%9@ElDfT;ydw_< zKS#c$Xev}w!=g?PqA#-86V?hv&YNCS-tgb-kNwwh)7Ss~cmA);4m`Qw&K^CY5bOtE z{Pl~9E%5luS+&w8Kcy)+?*IOaDqD29sRsAojxFC-TWV%f?L^M2@ z@5KzEX4NpxEh|-}#)+j!Qb$Zb<(mMGtLHfCwb(gM{B0I}vFUp&(FkRF%EqDUT6T{g zDHPjE`I0xqOQIy@!mZMJKBV;c)pZZ0>}gUuaSCaX9;KDyJdG;%HO5p7y-Vr43HXo} zlcCddEFT|qZAy5&A?)e1cMdm`4az=iNUY7`%yuz4MzzL!I|oC?723RNdGumVvg-E& zY})YaHfs`dCj}!KWW(r#gtQ44U}lJ=Br+lEQ^g}#JWiOQBJILr5^L_SxL>EX<{_TY zRs{OqK-)Tbr(gsdEXbS63N4BP8bPEcl|Pz>~Qv9YkE0Zycn!dYb?PH9R<>3{l+|5%I9n0XlZAal*wyC%x&GZ zvrhoU)O3&U8wz~al=yR0W6YlLJ?GqbOStgv` z`!-xYk0y)}pf>&_=$_B2?%0pmo6&%@juujZT299d*XrPuMiHSad|x7zPx--|hAqX9 zQlnJSKTrV(d;Sq;E#2=$2B8F$-|-AV{S7(Pq;@{^h0JQpOA4<5C5TcGu`|La=CuzoC|)n zKot{8f{sF-UmOZ zpPrq*Zs=`VwOuI3Kmh{KMJUwc*xmdaH4#E&p>qM)Y zJNemBVcTQ08~arwd%lRX&MRd?Qf#wRY`ulDzrUf*@l)~}UWZu38elP9A}+fM!`^yB z<4-=hH&&Qgkk)T}@3H^3+_<9acXU6%vIBqoB5LQv<0*KcLz{Wf@lETYX}CV* zxB(Y1LJs^VFUN86oo5Ogb%Jy7B-0LG&_f;ZBAy`w)O9qY3-7ZK-{bQ^qpIAq!Fcwx z;E$2tk|@6NFox`%bCZvUUI8T++p{xY?UdGn6;4%mVB<_5XL){65q)h=qDMrA4dmr>Zr5i?@IgNcoGiGC@WURG44DZ}`Y4z)sr?lt}w;td9IBX8;rX zc@gehUcvHRq^ao4tp4R4=6XgEYdtE+IQtGBPw`K^xg4>*NvY1isO(QXk0aQRP1slm zPA5KGyhWehE{zClDn`aN9lXB`rVpCPuC2KI&K7>j^^2;8^>NJ9-|3#e{yp7;z%lo& z%(cD6i*~3Y#GXrPw$;+c0rjeAC#+VSH9{&>{hba7g8KL67ikqZ!ij(Av)+{h`_0b~m?4R1JJN5?k0Ern%EvW;g;1}YQ zQPnf^4}E3ig|D;D21P(?a~(MAvar4Fc$|!dq`L=S7R}w7GCEha`<7&ge%xVYTy0Yz zQTW_dd)q*K{m6<_t>mTJ=#YtAY8x?6)$>QM8eH?GkcRU0_)mj*$MFp94d~9;-La!l zCHd%J{ux-eEeF@t!%}TE{yd;sV5<-k>NU_D6iM_t=GG1(54&!+leXJ4Xa5dRC@%wJ97VTMWd{BQoi|SF~8I%4Fio-iV3T{+q`C4C0CI<+-~6s zA``z#G{ej!8ciXCegvR)Vij^+h z{DV3A`^B(sv9=Ev5R2w)Mz`&0x4+P|k9%Hz+UMfyR>=KA5Wg%=+@%N8(B&L|l8h8tcI3t%D zO_sZ5R;Grx`DC}=<~nI8%FNn$(lt=A+CIql zvw4P!$wK>sOPBaHNS*S7K}93;-m&pxMHcRd-YU?g{&#u!JxBYHl+@RaYgyOBSV&t^ z4cB=V)A4qRDEpKp?4(<#w(#}`gVe%|gn56g=bxdx1J9U$uHD1%&y^;A&koOV(q8{X z_0ZdRTer4{Y%fg_#u-w2!|Y|xAR6Hs-OJ&n7nkzCsH!(i$4Q+R$n(}CnvL>mAZ5|A3XAon4RyW)pA}-y_H*#o8sTlr{vJ?2gwpu=pyv5gC?5<{= zfU;C~kkoMnMum*)@HRKDieF4Rl5L2MtUb`4+U0Pn8IVrP1ieu7H%vu~iRak*|lLTOT&& zBpg697K#aa7^b0yPqTuCw6a8*{O|6#ngteQTQtC(SSeV5&d6|jU{s9;tYbk(T! zcd6P~Ld!qRaGB!v=gQ|a4`(jO&YDo1m0N@-j<{4haNS@C<@ux&P^rCaG5ANG)M~EpR_>uT22vwSC} z#I#{-wgdHHknj!MHxrTTjn7J&7zbsd2%A z*3>bRA7+c93laspUbu-VB52GkQv=>4ZgeJiYvC13COWOte3taIfeddK1a-(Z8&c)`# z``Ir_hAeF*yIc*AT(sVQ_mt!^AVD}oG2Wa~m6J~d^Z3<9&A|g=Y<-G@lUD#9x$X7` zjTq$yZpJwg0@%fDO$YJvRMN#DJ|Qh79&gsBaMz~oB4hWDx!hH|$4mY2VZXIjkN`OpTz+SeTUnm#o@)=^tNwR5FbZ61&e^=VDOc#{+>5XM#I$y|(Trz%LjsWMah# zbb0k#!cf4A_u*~uhfpVjJ%JFW;qb?Ik zf$`0ncVM&5v)0SNPjiCGT#cp|jA&1Ga``~^htTrEc}H7jvnno+UzrO|yR1v2AS?#CxHk?Y+nvqwg^05Hz+W<(9THww?}H}x`m$+ArbU{b9xhI=5OW+j=5U@NVFcuMCNH7 zGn^g>|KPfWYUiK)!}<~Xk4-Gxe^@^pBvr|R7$OUklB_sg`sy`^82H7(|%SCe<--@ilJ3VZCqn`2+Eo}o~14@QFr#UJp%U#8e zSBHPv-VyG5xFsL3judSwBqfuQ8`0lLaa9izW9|rXa8_5zv@Iwoe&{RpMhj>Qb2~^( zT1%QdpHkBg)gTR-O%ONwRbL}B9Pyk0HV_-|PJKvGFC9vESB=r&q&GO8Z;+2`voF?u2JbO9|r`CM^ zp8uBI5QeXtEi~T9J9G7V-86s6J~*0wM{#{kty40g%<7c zAMbm`Kk^LwqpG;OuzOSYPI`I4(M5wghM3Q)0_Drxb~<5u05`f`lq)DTbM)QLl`Cn^cgJ8s*yxp+UcsPp&(G!H_iJOSBB zr2tIgKKPl@DZ;YM`!^)gA1uhs53){3^;a*;q7RzNKqd zU^|z;>*b$#?bf4s70oM)HYznZQx2>neA733+Y;uMj@ZR{7G&{1Oi+#0 zHST930yd|I>G@NGSxMk@<=3rw<6A?Oy~!)dx3gv^G4{bvS@>#wkUB$dPERNE$D$w( zu>P{$-aWvNANGdU> zln;N9$uz6?3S}?ZxLfW$4 z8BmYgk~y(Vk#04WEH{`LClv)$gK)t*PS=E)I5RvOip`JMw2ZGf1jTI;c!{VR^5jlf zYIxts(9VcZnvtd}qxriU`W2OKx=tCKpea2a=<28IIUOkM zLUp#M2{c4fPX7KADO8bQRh1B6jy$`61 zX z4L;fc=K$4`2AfI}OfN>|!%%+xu(L{Sd`aU=og@2lrx-Ca1$hdCn-@PNGwm~x;c41q znR>VtrLw*{jHrh2>y!jG7X4Tm`y_CWa4L5yU0O?QdN5V74T?$) zd)4XscFw&EJq217FB7JnF7TNCwE4Wpba??p@^v$8LyJLCH#jR3Ud<`AlsxoSbv=%h z?=d!56*|t((V3bgDVc|EZL1l-Lqiu0N{7k~Fw?qdX_Rz{X5~494+(wnkuUq1CeD!I zujVkMdJZ2_*1(9LUP??0C#oSUgpkb0t2Q~KX2r&P_5E>{DAuFt2X#>f+Nab*&;Fd< z=4R)&W?6JEaTy|(t*l&Q1?(Aqmj-)Gj{sQYua-?+<~ z83h)W)3$C8rb820Z92zG`v!hRN42?!udSJf1a3_hIw?<^_-SSA9L%%B=_H2uqx!F{Fcai~1j%$F7c+ z1P$E!;8j4_2YD6L9VBj|1ERlm%&sh*Sgf?S50_~6g%%mk3fom!}CD7QVXTg z0}1=G-`#J6W5hVqh`k@m=S>cb?A5|iDMrJ+3Q>R*dkUvFIew4y4*84*BZHq?8*(Ye ze5(w*e*-k&q~n6=NEp`jBO?9454)!>Xtu{p&oWhX|ASw!X#5}i0x|h6r(TjLynLS8 znBSjP*8FScE{-(t{=Dcx|W>ByUdscRI z)4ut<^l=Mi-}fIl4*K=~%ULYQ!1@X4^}qESRKNY-_6a=VgYu9%4n@P=$Hv+%2{buo)#e@~ql&|&M?<`$+hznX_kB7tsyk#d8ko~$8rQC|MG$RlVAg)# zE`#PojT!9PM!Q>DI10{-k`ZPV*%A{lgwQW4S+o{HJGap*QyyQAfnfZ-;+Hj%(&zZmmF`s??PhpI~H7eNbUNFOn$Zc$PcmD%}RDMFYZ*cBegCP8t-NgwgL2 zOtVP++T=`_IO65F5AiMGORd$>n0=$y!0n&ng@5dtU`7*Pj(Y8}0?QNFO*E#-;gM*) zaGrFd)=7vHjKXKCrc^gyp<*z*E?zN)aMfFQ+~<0yl@`ZJ#?0?)t}zqG}B zb#1g_mEC^oBjTMo@TjB8jpXq@0#3Vn@C zT_SkN1abpdD}5>={5ZHnIjh2ZUdSl?OPcguC_#8btz?7PG{g_TbrAyFpbYN-Plv<) zp)67PN6g0X>_2ignhW3jUeDIE%2$&aVvQe(jWr^t4?_2@Sm3%G|InO<`BmI7mQ2)w zJl-!q7<*aV>XXC9dtXsb;V4i;zr)M#u%tBzV~cDvF{znFNZza*Y3?{LcUw0bY)o`> zLk@pEX<(Xtb^}XvYte2+OIQ^N`cocWT$TuK65V5%IIz7t^nc@7nyfCdy!Eg(INPP_Y@XUydl zHv=a6SwGpc@IAU~aw`s|-gu?KD$HceLwdfSM@a+8f{(YXDL{gds;`GQ^oqKH*pL1% z?-X0qfbw~&K32~Q=Dx|^W%KPgNo3Z^!jOlMI@_jZ+m;KPxIxZZ&T)etF?dtVPK5yi zxvJyqx+!#I54EMtP)4>U{Fqkt`VEy7PbS)XBP!>#-^7ro^Tva0?&ifX6`akCOB}8c zUGt8ML-d|bJupu;4iIK5SlD|-tZ*MKO!#>oXCePdzXyxomFq`UE<@@x8&u7t*WC^T zx$iH1>f6(pbBQF(K_8EG=YD z=8o@f$!F843rFp_bY@xm3(}nfwNLXrn!5f)!SW`c=ps#NCnU0iOM&I$webuQg<)qI(W13>gDXm4L3^3|Bd1*xTO!Lq{KxdXC)(tli$Cs2K{{miXY`x z?0q9Eoewi=Udr>f$hQBY`cY|fc>{DoZ%C$DA7wZUiV(+^wvsRZ{lxrl^&0t$`2Xjy z{uwg5dLTAP5QrJs>0daK)GuuI$OI-YgO9)<`@&N0upY0+iYz*lA!P!*@!L828nd+($3H0QQd@Qa>7 z^fTw;kWcsw!nTf=r%ob1!a}#b{&|PlxhC>~2aR9qH`<_mMo9gL3UUi0>PY0ft+GaB z1`Dxd)}*SB)q`C94)-OQfhj^sGMiW8>t0f}72q!MM_VqMG|cz1Q;=#zq+BY;T{GI% z=Oll}6SzgTWM;XB@3-nu?%6`lQdutc$I%FN{mv}k`bj(bZ6GLAnXhX?yLjr->v6O* zmDrWL;u=Ymb&veP)`|7Wi~86htOoily@G=&K=zeDe^a7hpC2GTNhiT#-)Z3 zqe+LTF&=0H(2i=c*>cEXf<(e@vIT5p5Et$Bx zTN-J7Ub#(IyY$neMPo%4l09wv^NDkP`34*rL#Zg5@;SY=2XlUAz}%u8Pu5*0r}5f> zASD*i)r?@-=iPh{6LJLS<@`D13^_t2&^Nd^^NM)#>rF>hp}Ti!D0q_VV=a5UrZrD9 z#yj-Aq1KumfK~iHSP41D<|;ZtS5#Fb@VtI@5`S$$RA3fRzQI#mCM1@qr5UA%HrrV< zSbfRG%hJIHb|j5Pi7OK!>E4kZ7g+BtZ6Wr#jqWUIUMNyXZX{YaTRo1oQbjnE;eU?usCV z!Akl;GQx_B$9r4TEuVX4&&eR;MA=RUye+bfO1R|0rgh-FFM261hY`&1yRaYpq%AVI zwipCmJYloeT7sg5<$R!s#is`zW936#;p+d7KLFD)>ce#s+UbOE zcI$p$_$mZjUVu59xMnI%5BArYGcz+Yv$yYj^X8j-&fI_Yt>^69aUUI3Rd;4a z<}Wg%q9Q6I9z|&cB|V0J!ZbrYzNdo2#LTU%6rptqm^;`xlnaxR2GNOz3VN+XJ`%BB zto#A?ZXW!!2{bQ_e*oAr07HZC_>|}6%#zK8Rb|PCnX69}FY<-u(6OkK}6e%H%4TPx6G?YIlYCBWO!Xd$%`DtaqW$GanoXw&2$m_f%vL znxzKG_U7en$~iAZ-;WnuEedB+bYrKZ)}38_jLznvpdoEsAfE3wTX+#E;>RV$rplL? zyv;77Ypu+;7nZ1CSLm0oAk$isR3S+_3Z(Y1`>sjVfwP@pjH9A~Pn}oqqJBC?+e_V+ zr5AZ3d33lp?@8Qvv>*CdUx@89uV`CoGrgI-R}GvZ?NZ98^oE8a8c_{FW;HRbN=K@i z!xu&qjgCNtZuur%qu&lrBhM>8%LvpQhZnbh50OpRC}Z&aJuwW9t)izYhiJRl9UftZTo0)a9PZN{a$L{Rdu!?ahIw;~%k?s+uGQDCs>tIuz zT#{93KVMAM4ST}ZQ=8k`3Ps~K%_#-4rh?pi#U8a4wK2XpwfOoq7b;S2=d-obFOiVE%m$q^F zXvJo3p+jyuPD{rI(4%U0@J(C@JFTG(IzZ088jlT|rfQbR_?vt~6_t)s9PZ*r8v7ig zIfzklE?RXQgZ&Ec&3;u0`ym~!2yxfUvd7xVL<*1X85{N4kN$+hkJ*xpLsMrmH}fLC zBJJE%h$E@^Wa%5!6KQO5{JeNe7CQUWX zEBLASTw0ROe~~w~lmFbG_UeqIhC{hPdd$fw@NtB{UzA=E9dtG4lV)~fL@zJU^Tu&qD=0bf_BQ63oUzXtLbSfwc6qTDPYGT!6 zyR-WZ;+#TBlt~@{sE57_i@?A=V%@>{JeyojaE(MoRz6jZuec^`eA`;# zO1aW$oto{M$wctVK}z*VC+O#bu4~?B`k_BlFuD#Cq z+EPtpRvuyn;yCG>id{4kS-hKOC!)31DXV3t8>R+5EO-ZH`E>a!iH6$mR~uayf@n3T z@^`8Z5(7h(u0wX^nt4hsCumtTZCp|D!x#C#< zfdihURKaau5=#W<9&Ho%#dht)?lI>{aH+ACDGzm|A@Qm#-S7>WVEd^A!W#d6>Z;2_ zjJBi$w|h4CSXu%IlcsST`fmD&WAkKIlrq6QP5=2oOO8sS;#nPhQ`6{Hv{gU#kbpe} zE}bOJ4s_CHk0-CC>Xv)qr7M`uBskq?`w7R8TGFI3sb7E#DK$Rmi6r%V1V}nOuFGWA zXex}UTayZqDt1FkuY%^Zu~ELRTXZkiSug-)BhPTu`6?piqnhE_l1pNWDaUq76e@_2 zSBG%&6>21W&oF5_X=c-6 zHOlWiBm=*T403UP@B3F1y-P?9=0us_t?M^**Qx{I_l)Z{OaQsJsbmN&m z+5DK$K$zaNwMz>}OU26y3=)+@FVi*p+W|S-kZhjHuqD~7^n=aXvaZBp^+K(@{vyzx z1N@-+x3es{0%ap$-h@#P$UAp)Fm`{;peciNQc5A()ecLMI9~r;(@?sbtyBX&9u&v6 zHwk^TN^WVeOR|kRwXCr6YaeMF4JAf+t=RrUo%ySLu!?QqAL$ad!*Ca5=`Ex>5Lxp| z3O_Ag?#r6@k^{ByzC9RG)}+#yr6We?DZlzyLL+im7oF$dQ%%YeeNu~WGzc1r$R9efCi$-?F^eU0D|3UiC!wRz0PB%BZUQGLi%;(5!wfDd;$8iLr};*tE!4 zg7vb`Gl_ET(8j-GEMZB0w`Q^Vfc97#VgI+I9ETryfB*cn(%q3lF_}DMvkB_>}^%ZBu6#6??Ky&AGHOWY;lN z)bs7JiyX{}P?O(AD~EjoI;Et8Rc{=_HaRf-K9HU3{J1H*;k<-;U?LkgA&uFf94A;D z&~(a`KU6}Qm7LAp+oupUSr4q4w*t*uMg`jMj(yFRq-9$xiUdM;Oj2Y>Y!gy3K}|6z z0b3e(N6=`UKVd{uX`x0o^^+!|?bds_CKPBKG+$`U`Fa9o_(Q6v(J9ZLFf=yH=fw)? z`j;GLY=5)k+;?f5vxdw{bV`EQH}|ftTRP?#I4VEnXfACX;+GaGmf#?d)1f{Lx{ZJ} zAV>AEn`D+fK^m@mJ{0P>ij|tVj6-E%&l1MZ>cq!wwxS(m_f;hsxB2T3+i_!6uDjsf zW0EzkOqvNxipi(NM($EA@7|v~rM9~Lgy~fb^0?E!Y}tEk^ZZE9Qo+}Gw7js~5Vp@< zafrfwJG|h-dsjcj$*;3g>(=e~kiZC4eEBy$;4(MdYZ(R86r47;HZL~mG!iw`ucxj+ zM+0{5-Rv9Jk8(5{$NgJf99z|oIE737ZU=vCOKCSzPE8n!O!9hJP;XzjB~iSxXoW!a zDO+LaI`#X9M`OeSP*e^5y!j%cCWGFdF~qDXui2))Cyz>NPlw7snL0!Oc2!;VX3PGh zrdzzCAbZo?lpWwe=OU{krJ=saUF&3}bZ6ujMeIvI>y;9|4%c5evw+mzd z3$SU7ZAtI^-K};3K&RT`aZTso;yY9SFnN?ZQ><1!yhgYwR%cni=sI6#Bz~8JKVN)x z+8n3glOvR1SVzAM%h$;47yVTG#oQz=V`6Hw^rf*eiph*}!hr4dKw0tqP>MfWAWCy8idu@oake~w&K6c@ zC?4W>m2LRgiMOA}I=L8LSFn$7X0ae*CPqcI3Lxr%X5TR6@}vle;e7Rwt)|V;C8KT^ zxy0;LeX;CzZ*zNOo+z*C?x5`ojcsb%#*;O9jFVgGf%gzkCRL!c6NAGJ%|ZnsEtZZR zn6p%f1BeM^$|VsRY`9n(i`pbGQ!uRoKiE`Ln97@pi<2vQ(+Z8}Mdw!=B{rCM^7m=+ z#L&nnWmDk=EV3PppO`CIqM+P?d7v)o;6wPuA=!5m-u%A56#REwY6c6# zFb?MXRzvq9?`jsn3ZT6JTD80pFKG$X?|j68Y0-sWva+utQ`oPoHgO*2Fz?(|IxyDK z38ahSRNLe>Z7lER>;2R|4=x#3Dhi~19FXN%(*_iT?w?Ut-FI!L349Tbpi_t;^|DCs zV(7y^`{)J$kb{(}C}`vp6(VW3G$IXg`7~_@_-Xm(>pJZOHJd4$@M&fa=9vc)uP;p} zqztPRr?r($mQ{*N^$C1F<`TEWDdmsSGMQtj2j7XQC(tBR&1C~L10mvR96Y@}XDdVg z>nwWEC}ff0>t>Q;856<5Hp%Z4kW)mnWeV9Q$F*sW>~a;dX$qpV*5!Gjj|?72W+54B zTAci}AlQb>QsE)-cXBzcs7!H`m)};GC^UhFh>ZlXgUkL?hLet6v6f9nw)lyD6BUw! zMpfBjsHISp{0lb=KAGk(Jz3&9q@Jw!Ha>JLSs~Vx zoqAyZ)=@Fm5Cat)NjYLQkWr%M!cfej4s)}=xpjK{?NG}JM& z(rT)yRkCR@m3M~#jG!vBVP&JLy+rf$&1{f8ZC5pwSy^PHqwFAWG2!@hrVKuP7dTNi zir|N?!>$)jZ9)RJ0KOjKJ0*m!r6BJaOml9vOzw99jEXT@l_zaqY}&#oY$D?V*=l6A zLSz_CtBc_SSDev(SQfPS91&ip2WA6I`ujjJX^?FB&U;0=n43)gj?q-2X1CE~O@n%x z!rV-ik8&GEB`@p3KEE0|Va!p?N@8%9H~!>{um#)~L8O0e_f4H+BADuXe{r8EZH!)~ zRtzTl{xD(*U935gT|rAu6sdkkyP1@X1&i;zv=q|{7;}(0s(Zbx>82s{EH1hbzbdjh zQ-N8XqC#bH-*JBiOf}3DP3GG^y_pGXQX&cNZ#ZIjDC%;j8}cwHlVWygn$guJX|F6l zS}RzZEGXWUE3=*x#WuqU+}O6lCY_nY7XTBD;}in2uKH0;rOPqmvh3M_Kui_f@J-c+ z3T_UTsQfq~G3xq>=JcK0JxTD?KIO7TDxZK=ysk~<0JV~Q=R_-8y>2OMksgC=;7r?6KCYfb<7P>Sj5>v(-Q=^9F-I|9$gGJwKQMWnAJGaPuk)xrE1-Ck)!g^ z;b5+1FWu?XzS3CMdlzG|VI)UBy=abh)*cXP-F9AAtOimB=PgznX`PyZCi;pgt1bm( zkRNLSN$yk1Jmkh2;qsD-yzo+B3S_RBYhzp@<+RmxpTT_EiFX19_1Re2My1Y@EVIpw z#*-$+?TmxWw^~5u?@IRD)U!K@X4iAT!fReF^QGg9q8aW$>dDG9<#!(aNzQRU4&{u7qUiVPb0(Wf8*N&4_8*qGt2cY=RNk%LRhCBU zPSRGB^-~QiIH@!@-S*90t3NvOo+Dnf57N-$>@{6v0u1VP2`wfcW^yZyJ8YK|lEHlf zvixBk`>+g;Us$pB^OJ26~#|}M=H27dq_4#Qf8rqTm z<-|>H4+n2&#G$m9Hjbn)w#))2^)`7=?#=H;I0F@}Eli3VMQiJBVmpTprj!i;zln3J zF}S3r%lqXg$z+Y|vFqY%l_T`KFS;=iTa1oRTaOc-YJ+hmF2h3}8#K$4L*?~*KVe`S zmw0P8dY!E(R*&gU_=(9j>s=o1qFSjq8FOjW7slqMTcAcI$G_sJ{(pt5hH5jD}#koHg__)sz*^s;d&?cw(Az8MBLv!Lc|$F(jZ$-O?yRy1sdEj#CGetI0%|10uUk zy#BUObH8Yd&?i10fmL%k2`^d2QnFPqtCONj^nx{a(>f$)eUN%DWvVP%XGqZ+*O!&P z^f(yfmX51#X%uSSQwNp=rI#-czOZkE)GV(e#LDe5k^Y2{0wdfbJY0HiOLmWXqCz5` zz;Qb$e=0=$k0KKPD1oz{NEAbGyDf-Js!L>OGrvrQ@@WyHe~h8^Sl0{WxVM!lRH$fL z&B&|DzMkjlA!&OZ z8+%QsX*BLtNjWa0shsDKtUgYw>3fP-(;QqnW|7jmLbD1$9TaibTu`-SxSYAmXvUK+ zAcXzpL$>N1O&?GlJ#b0EsrqtR42%O^41GJ$n3$y$Q~;xTT?Tc@>u8NxMkGX&0jy8u zPHZ!cj_X}~S}jNA>UZZT4TXgR9G&Ica&}mqScA|Y8gCEg7@94A>~SnMBXdrS%q|@{ zgg<9yGwiOyPIjGhT-#H9`A^Pbt+-r2?!4>AxY;g7)njh6{M~S03HKx}|ylqQ~veBAE znYF@|c0mE?G(}|#AXI<*d14$xiO?~15$W!Hy~BL>iOlpYmgubTGe^aIEN>$Tw9XT% z*XzccbStJbwVupFX@jyKb(nRsJJlX>XstVXI~hZ8fDaWxR&xW!10ZKRyCn8*`c5MR zv~t-rWZ-}oSjBuutkU#cIxj>d7i~LIF;?GcLASzz`x~kAHSuoOI+QkSj z2DiE>vMKS%)+we5;9NdCWSRibv@{(e*2vO73|5f2skXxu`;?s|{6hfx$dTNjtCjRM zo-={iX2#HOV%ikTr}CKpa~w({&G2x7B6Qy{IGLeD6a6Yz&cV$#yQyM+mck+eRn+DI zp{+g@kRwRwv)wuA6x~#8=wxn*7r@X!u5$7qpSo%yf+F0?fFmYO7nxL{L089lR;iMq z`4K7xXFSw+KKt=4VW+IDo(pOm${B^z3{@czktcO6#xbYE3$+JGE*SBP9=O z?kb|xtEI(E*XVdBlasS9RBWBVeZ5*OvEtvEP;%(9Jn6Y)OjjIV8;Q%L_)PISfQmJY zWU)TQtQ7EK7A#7xAktmt1y3|XNMTN7}Yf-(ppRd|>3UK-gO)}_LvMvnY%hd+bm^%w{Jen5E7$q+= z$1RUSJAV_%nZu@!IZk=iF(6!6(CD;?wlbCuBC0d+pRY*pXDVNU8o5y?QaS zIZ{eAa+V^46^=fI&gHJR3-^B5u$`#+$a;Gb7PNQGd#v^K+Vj-4W`VLG>fso&IytI! zm*3z<(Xg)(ZQ=S_wqVLH@x%$)*tylyDBg-La8rKkEJiDbi@WH6HUU?1yd^ z-j)QwCyD3W_Ejpl9F?N+ITsxsu+8Cm_cUm*7b^HvSgjdAfrE`P>vevkUTZ(dK&w!^AsWqGOqlo z;{S*XxSvzM`TZwO{lCud>EHbRkK*^pU-A34hE|s$EcmM5(U(NgK-ok_nRH4Xk6qk> zp)KuAg0zHF(fD%cZ8p+?bqKEpRVmtvy70~MXDC`IItp%6H{Ki4>hM!!({|PE_)T=BQ*e^cf<8q*WfJrez`mM!_^hR(@xf6Av4C;m8ef@ zflu}j&YRLu*+V7f!_J-6>GG`7PnZ`{7jT;pL#JDWB9DQR zv}I_3B0Wysw50)wTO+#L(TnBv){6Y6SJ0=@zPrBTGi=qz1TDdqFHardcERTOu(JV` z^UU4WZcjtS2PDQ3;+V^r9)kUXXsO3?hT&KH$l36 zy4D^o{VPNJr#rZN)JDXoD?Pz}W}Tt1oS!g+k1=v5Y_0D-RHjrs!yCE}`gR{LP_D=v zaUTylJY)4*Q;21rc<*V`R!luUKa>`g{DgVu5H=e#e!oNfC$I#5WAz)W-}CDC8vHG< ze#`cMzN!A-avyZ&)DbU{KbF$os4PK1tEcpG{78p22xjFRT*REk2)yKx0c5o+s20Av zIpRfD7>oJVYr+b3Bl?5t%om1dQQp`PLAS^fJ#VHzrtcc*T-`cV4aiezR}L{#uuhS{ z&71Jn2#yLaHcGT4A{eh)Vj8j?kd=?uqZxh{l&%n>TA;MHDO*H98J&qSxlUPlep=P^R=1ga;9Lenb=)x+&8+}}Rg+@=r(>P!fnKQ=P! z-++jvkC^XC(^m4I{O^!@1l8k~htI2_%I=J9!e%j`E(5s>i4m~S z-9*ciXR?Q}L`K{t3N-v6ctG_D({G$N*rO-+hSoDfz{?h8D*O8UVf~zkAEPx7vVHHU z*L_kXkg%YCB_;?>ONV-aAMR1j*qXLYoG`kR{U~xQIA4h+=%afvv`$<>^8}x^6ZUPv z>oOnm@DqmXVJJ+DagW&LX)(V1fez)LMg@7bL0l|#ynWmK=b=Mb>$(pDJ)r@z$aXkM z9?f(-1&0J#Ge@QF{FXdxjp#k$+jmpC1Pv6S`4>lte*^OynBOzz_fq;TV}1+Y-*=^d z$L)GJa}`cVLVO8UFXl^dyrnm%7U@$vT}g=R>?P2-Ho(Do1c3LlD|eitRXSg@!t{L3 zNRdXq>fGGYK%F|c4h8CT1<(vI#V~OdoW$Z45g5eqn4OvpYKia9IO*0YlDDb&Qu=Vy zjzmVfpSc!SSuDVKNB;53=Krt{%FofiGH(438_EC0-TgWC8{=Qip1+RU{;Mhf=d}OV z+wK2zF!9|I#t}pM$}#9_erW z_*Wwg1M^!y{x@L!mwAnTJ?;M#3cvN^U(e~^`tiR3M-PoeNzKmPTc{;ePX z8!-NDKmO$)|JILxIm9r(?Z^KHjQ=uR>#wK%pF-ice*Eh>{o8*0Z@~Ds{rH!I{98Z% zw|@M~A%^*FKmIph{QLciUk>tb{rHzd4D;K5{BOYc_xlyU z9OR#~hF}9bds{j^9iZPRk}xXS>Voa8b!`p7`YzBb z7wdl%6c8X`R4}x&aCwE1?WTX#la9vChXQV`Zym2D8-|=#h zTQ~U>=5T`6cU^v;NnejHOKg;4g`234t$ckW3d)kM<0%{h`E*=6kK6`n197Z4k$$b#l?TgvA++Lg^B%7 z1Fa5gMs8z5^mY>L9Q;6TGgcL##QZ*8@6%^kN2LPf&+0FS!xB%%pJ9=&ZLZB+Z+deG z5KvPGcdnSJy|Hp@7F3WDFRRhrE54G@yQro?6;p|#N7_TUJT6ju=MY?y@uD~%Nh^vQ zYfiY*@kc?S32)mjoIiac{+VWpQU7!JsNSl02>H)1{5lZv>W!L z5wlCGK3`-4s9&XH$v_SZQ~(|uk&Q1qxzXC-+q0%b=t^5~jfT_uQiA%;8(ttt7)AUm zSpJw&{{@S%3<;wwbPniRkTB}&k}&^)!~eewxc;f+zXVX0g!LcOg@v2-Pbfmdn5Z@QEN zNFfkfZ9FG_k5N;^@tW|{pxh0;5!Gscyj&*9b6qq$=Mg5Mx)&UexQ<3MNNrp{UmaYy z>2o$GQCL~eyj1_r-el}D54K60G4=vv2?nF3srs9w9-#bJl zghYgNv17~@j4N!NU)*62Xl19`A)#P@be3rjc~g|!{;0o~O$g^`B3H~8zVEntjup$G z3i;ZZxvaPFf?|s(1pq%QA0a@XhXVS`#*}>LB#+ID?2N+6@@<}l^7T*oJ_&SPyt|I z2(~x1cVYPOPwW2=fy4wA09MLi)4xeEXkE6y)&0Ay`WyLwo)qkV2*Q7K@Xyl+!11T~ z!_NFqMgQge`TrImGgQ=YvaE={^2IO9(yT)7z)-CNqnQS{@P(yO)f zR8TCh&jec1$P!SL6TEj{#X{;X=oXL5i^jKbDou9q3l&4+mjb2Hb;ThpJT92)ca zO8GtYY|~*Rouhm1HPa`?7gc=}QHt}_KCf3GFn3abv?ce+OV+5*oG&`?YAq5MZhUJV z;$UW;HU%@&4*L zNwhFb`;TG+Bwrf}`?ntWe%2w|fJI_w9~}C|=^>Z7 z7RxP^V05sW`8YlMk;Uw4ojwvoK`C2o(isfPaFXhh9A?G5dBO#-E9Ti1jK9L|VwmGd}j*OcQI5(~%ijGTf-0qQMQ4jRPe36|&&PX&jC zHMQA?V+dmij!BQa$Wi)L&b-+_{b~jEoA;MWm+1_imWYQS9t}M9{sOVg%chPSPv8bd z`+KEw{Xt73iK9xzp^;_jOP?z_6+dvo5yD|o0rDc-B=+5gl7q={Zh=VJt-X$k5ww20 zz0Qszv~+6z-pEmY%g7M)ShBk}GM(GX`FL*1%u1+W%bQamvP}At|7AkYNo=Z=FXy!d z-qH*!x4X@7$BA!hkni+$FpAC$D@Rj_v3;GjKS^cs39PXYF2acYbil^u*ebPqWtGA~!DH8UyFS zk#}F=_(VmJBVIiEb;QBlBiv2u!?Gy)BQwY2s;Z0(VK6m;EjCEr)dnwFpAYUJUtxb0 zA@gbU%6#-`NskcrRW2dMqakq~@j4n!#GA;Qp18`-KUAF0#hPQ!dd03-q>3Zz>{IOm zm;b|&cw3Edin*7T8Rmxm2($I8yh2h^xI9Aa#gZh~R%*(KntdVl8X*>a$L=Glmk1of3#>=sS7c~z$EuK$x zVX4J%D!TYNHb{U@ikYv6;Ss|8cq1^l{P7!^B^}vy@%!+&bY+D2@^A^$YCkD8186MT z#CskP@NZoWEV{8QzCNTgZr`}i54+v#36wl@$oolb8vk=rYNh~0f8hWMr+UWo%GweU zXE*6W1}BJY*Sri~Ll<_(JS(C_T++wVfC_^2>JDqk=h-(a$cDr#Zq0UcZkWTJ7bAoB zaLmCp^y0|;Fn1$fDL5T?7bM*hNP26-1a4$g-(GODox2kAgmW1`?fo<)e=OC?if$3x z3g?+my>Cr6MuzJps4zfwFhG7ZK(;hM4(cJG?ICFBB}nWgXy_prJGgF5=>Ha4syMH2 zRzE_-Z+tMreMyqgUST)Kusy+GfPD7Tn(@#8S?Xs~?kg6*y1V)8*rL|kWaWRs>W8JegR82W zZTxBdj#b7BnF|^Etupk%3ncq=pO!C(eo`Zn+anXKcgnH~s1BkRE*0g|bC==Y_In|0=RYR_U7l zjHphhEOKsn!V}T-D%zc!J3-utN*RL24&BX5KTjX2UAmc&{vEnHB8^?T8*)Hy=_eGw zw6>TF%m?<8jM9}?7MZQ>x!g^tD&xz#zU{*+cz3)9osM_B3*Ltp7+1P*{60zCO|Zn7 zxn;z>yEFtVCss@{I$g##gb>`?we<_b1z)WTiiM%o%yxEB9XYiD9`2IETMjD*hjpFbEbU?0f*etJJ%z`7&B?I6?>XZSQxD$H^ z=#K9xC%48+;DN1^MRm%*Am-`QZO!?J*)qI}azb%O_we?544rFWHSEOD^?BGj@y?qE z9G!Hk6Z8cMxs_akCxjMBxfSCZi95bfYiEp~qG{deH+T>t!S2Tk7rp?`oZ)qy)8UJ_ z8&3C>C$yiT&mSpL+l20<_(HrcxKe*`?%41J!R^=(v_mgFzW6~eyH{=8qXhhP*4{#p zhwYr7hmCBX(76W*_(c&s;VtJ3uX5fXLy#F)crUP>QI|7Yzguy;zX==FSuu1^dwQPB z^+4$HK5P|}AZK{(nxG|+c+{A=f0g)z3xeg@5w=^&6_Pe$d`k5YEf6$)!g!(96q*Jt z;YS8N`$Bes+Z2!q{nxoV@BCH3%jv}K4sofobu9Ok=qW@X;*vsDBOw~0yw{G0680u6ZdULpfDL~FZhQc6lpy8lWXqu$!Cl!X@C$c2A+pMrU*?1DCP)j9(d zTiL?UZ2LvJXI2>89osw`uq4XBZNhRz&7Tw;piaP+=o(F=n1SU}S8+%Z;Dn})x;A^| z_51?sYW6G6pe&fahzO_m>Q&pS{E{D$fQrz(;>clB{wr+c%IXDsYA>XKIqTKCFA;hg zUB2Hr!+}%5Sl(~0Hp+ddj&!d!?tG|>b<#ez1uM~}B3Nvz6y9U7B=#)`g_nsq;h3V||*u};Vaqg4% zcp*53`_#^^;_!O(jZOyZTf!!!W#uGt7O@h~SA~tL-cw4%M95?YO9m?C@!-C$G*^NY zk|#cn?D+h!*lx(vCPIC_Mx6;tC#T(pr;yKX%={K432Ry2OFg&vE-V}d%NMgiwt!6a zu*pR-1D1JiyqhTCU^2Dky)&C;(^FgI^Swm2(XUU*^;uuHyx1{Y&vgLBT!{>Ml0)D< ze&a9OG6nM3c|%vD`xrQY2^4HLd44kEAT5QRTyRUB#ch|Lo0|n|oPoDW#0CAOT zdVB`b(??-GWR96un+nO9f)^f6j1VrNEPJoGq}?}foCG0u zZL(M`Z&E3}KshvIrQ7okzXs5K`jizeztLPADz5BdCkYnrm7%R5-@cM1%9ysAabt>_ zZDimr&rTW4q@S--!NuEseX@xZ>P~7+c%S^@G0RiNDdXzf=OZup1YEB8cdR1&;zSWJ zE=GerLSO8|SdOkO0vv%JiGs`#m2-!i7vRya&Zw@Vz(km*9L+ww-U&;b<2b`zB}95vkm? zDO__O(`x(o+${$4XYaG6`WN#rMqY*~>NAtZ$lAl?3w(d=Z4vyeOplP<$=Cm*h; zM*?MZ97Q!8CI4{boh#3J1qty=JD(XgXyL0$9m9&(eq7+ zItPd&{=RC?-ztp^b=J7#5G}yD_6rVTP2b}Y!qbE;I-sD&$zF$lX#x$p5rvOUzU;(WK37kTPeEBZO4 z!4%C~6%8M*3jo>OozwafPyRYZQ`3M8jKL$-eawxDC5v=+YNm2+WvGy9b+o`Wz-z`pci4^ zVpBav47vj6L@o@v44Cx9vcrD7HlHWxfrB{0ft)WmHrRtvEqa3dc6#9mn)oh16S{mE zo%qqOm;gQdDG)E6$9hyrks+U-L0Z-7+Tk2z7_UefL*8p2iMkb_q>#uTM$%!3X%8AD zboA2?kqJo=mdc&U8WU2PrD0*du{BlJ|Bh9960!1N{6Wo9>boMQ?VJ~LSS#hhIB0iM zw2+TmHnflMu=tsVgJm^CF0*ODJ&WZtIR}R}Z2y?VVnA-q;>xvTCL&qT&i;l*8=FGB zTVAMq#@So`tM}#Zk%wiGHgpomZr>zY)}UXJh)CbOQijZW3*K08k2uKy}l z=BSQN*yAL&=H~1nDj(6dhoJtWl5O%cHx1jGkPl(Gk@;EndK@XqGLvi*j9GcZt?CMc z1ig~z>*qOL@o1xav`Iu*?n_rQwL>yG9fc2pzl$2=vudMi@OK7U?XWLrl#3V&Z+j&ONhjaSu zDWmF?j=y}b5ZzdIZW#}uV_6g|i}0L&dy0=ox{ xUr{JOG2~l5s+astH~*{{+x{? z=$Q_HZgIsKejmaC%+AxIv#o`F+cjU?c`MAZP=y9 zX^??AQ=E=g?@dn9`5;IsBb@m@{vvTb7`rNX1MN&*+!mivjuoju{+`{e)%SEjxHTd! zmzc>~h^M#fO~Lna$DFo6ck;DaDiBQ_4T%Q5!snN3Umibe)r)DHSI=GVGp-3TE9TZ=+X#xZx4n#n5O2chY+7k5Auf_|8Lm&D5xX{JYL}Gh3F8 zbvlLP{?GHDkWi&0djNx*`pWf62}35dY6aI^!ZvbQ`E6=RI#bxgYUuequT64FqmB_& z+QMFX+`XpV*$o~KY+BBhXo+TaGhOg)^6N!MhpP=FrKGUfZz`5p8j_4s$8+w5l~;N0r`Mbgx5?#QGvHz6rp*4B&7+^MP>Sb0@b6ZY+n z8~b`-&pW4UD;9@U$=D%#>&2c5lrfdE-re&H(k-5+Iaio(jNRO4bkd4}48;!Yba4Ye zziWc9ktx1T{b+GM1lpN4(W~xqGVFy=v{c!WPK=;h;L#Via*e5}fKn|G*fyJy6eAUm zs^I7dEQ2WIILp=Ap5>CgjV*|kOhw*`$=T(*O=UttDXk@h{uwM$j7x4mx@a+bh_ORi#@VMW-Y^lda=T_xb&$^DfU`6P7cUt>9b}y zVzgRF*SdLJ(p{iJwM+lHZBSbL^WF@lhDZ5oR`eBB{58kAmAyMmpe^Wa zZg%1)@Q~arG;8AFYy9V(%F~G<-r66~mOLW=eTeNvvE%6C;ny~Kk_lg22Vgxp#i*wj%h~TSbl9kvabVUp-&jXo z^&Oj+@|kbmh$6C0idtA9hb!tZd^9ioR*vTMhzu;4Sv4<3mImTwnA*YR6c&oeG)hYe zH;%Nsbjn|Rs>1{DFd<#8Z)<5AH60Al(VKlb$}rnIn~|KaX2#x;b*Ov*a~t(f{l`4EqsveDf95{;~O`lb&rM^-q7Gd|2;QW%$sip+l09++W2RY z-u_m80v5HrPHGhu1Pc^fO4lSY1Sv!<1feYLedQq>6xWjk<+wJK4DofX_(9rIr=RQ$Rjj%_sl$K`>&-+kQByBfSR8r==Ns$Rzymoy>V#`)N0*Js^p-G5TOVVaiAkW zEMyMy#^f==b{J50s%H|T_2La?CRua5cbu&l?ExT3RP22%Jl*y@Yxywe0Z8nJEd@9V zWRw!xmzbJ2TLZ=T+;kPQnD@qCHEBs&08^GV8nbw)_kryXZ&DhKta(~(w?Bo9n$h+0 zG+{2TTNYzGN?cNq9Bjn9r|LIRu1}d)QGSs&tu{iiANQpY<<%N1EQ$7uHV)0n%FOq5 z&G3zsRGg8CPB~v*tdFus7`?RyNO;8br-%TNHi8Lx1~Fa&-@Yua6J=$v-m_@~%CSvI zEb6+=$%YOb6Ax^97aNDNhTvzFM(MY)CBI%BlK7}?&(N3PXkfyy?tZvFl6gm%nxSs^ zDu6p+fnE)(0vT)4dl!qx-fw3fS1hclMY`bGiu$z^N$XDWh7DvHK7LPO}mr^+`&gIu(nF(Hs4I+wL zj`+EsBBd*U6G_i~O>6OUwC@4*x2l<9CxcMWSbwkr8j)o#Mc|JsQ^4M2rM4&v&=!F zlV-6ycxgoA0`54(a_Sg!a4_Wk6hZ%$g1vz1u3)SzT3Sy?Bx0;as1vX9* z$g-5Crz!)MB-gw6X1^`u+Yn=Z|yJ>#FSR?4A2w zd#!t~weot0e-4j{+wkn)U2N(Z``lq#B2Ilf-hA`2y3I_1EArXtBU@)*MRusZ8DaAJ z`LEKoo;KL^Q?}`GyDhrundJa>106SH8OTw2)=~z{`5oV^syCKq`g;DT{f~h?ZeW%8 z+rpSummNt=}^96H5gzVb&>Rz;+=b{*LJ{8@}X<&;SbQP-Awam4~fi`XW@4qop z88y^I&tCsrNJs&Tyf?m{mugdZ=JiGdDYNBB*mbDzhMSB@RK&2wmU={!h~n(q_F5^C z)rV>|u3l7JRJ2q(*S)$EOzb=CTRJ`$?02pnKd0WGCTUSo7ExU>{S)x>;(2Wj4oR8a zA*PdT%-abryKR@3e^?7PEmf-p73M9H>FY+xp9-;;xR#YF`T(Qq>08XLZOrUUE{N`Pl7!<~F-Krz|4nb8e^i4-uKfL>*xn zn@I&#clo|4E?Io)o|+GUKd($LP)OGm8i^dV%yY3}RFWKR{_J5Xe;Vy;n~xaT61d*^ ztmj^5tI?EoUc?8dHvgWFrir&D>MNkoH5 zuSp1)NA(1x#D(YTEV}hNTwKZq>U{A~{(zr(&DZqG<1*@HuKMLDaZA|t>McG{+Pz*S zQ>6$hUgMqZjyC>CyECEes#jpPBJDVZf21SvLV>DC?YpbLie0YQ%}M5XNS#;hRUL3F zklI`^I+@0qrJrQ?v*D)Qb4<~M8X6voW20#}*2=aVxAP=@UoZYqYEz}6XTt3S zX}F`)$mU7OCfJ_WU4?eN&E2(iva5%KKFZ>~cuEuDh%Kj7_%J+`HR zOxUQoiSB~98=B8QY_U|`&gq}+jI^;OoVVunj-M59;rM1*StfLqNg1TzW#H0pml>VT zry&Nq$P87kwhYA_3I|IsDhqkfcz%ofW1fN1?N~&q1!*t5j2SfpHwl(FPJH8SB|B`y z16S}+%B~63VLmziunhQvFGhD=GgO-Qw35{@*2MJo)MF`&E=x{UO#QpOrfpfL zG>cGU$VyA+ez^gMf5C}6DZ`U-8if+A^<(`*cn~w&>+=EbEvl}hk;-RX$$?iq6!}a6 zhc6Y*C0E$TH*D{cR2RUhU9;a}b|?DSMigA-dNM6)v)_F0?`{i1k=XgDP#M##t0yl_ zxemEJi*^>+Q^^79<0fB(XB>niUivXZD!unz&>uz%_#CxeWG8zkW2pctb~d9tmNM`)p1J&H#%RW^vnhhPL)=-zMIbQ>P{AFs97x9QpHdkq zogQ^A^Xc_p8rsiVuj$dzsBIZUH|)yz{jf5{H*Jaf#tIOznCO|2vMFhK;$pI39q`B3 zwN*B5yXlLOhj$Z~L(XvgY{yfdo|Gc`NyW=Gu%2zu zt=3B$4-zjU%lBz>j6k{LKV+*6pc}3#%r(BaVstY}H-Nu;=OYv*>q8uXX7sKU8FHsiAf47*zZ`98$`rHfN*=5^ou9Vq~6W-5z2%ZS%%0wlI1u*o(m` zyMm-FT4!HTAL(X*a@pa|zKd_TX=05L`?#Rv2dj(!nGna7$Em|;QRUl9Z1?kgJAUr= zmviCx3^RXmxbqT~8jE-8%L$>x*_#ee}%_28uGBV2U^$&m6n6}|Qb+O@T=BW2hX3bh@(}9r zBgck;=3E#B?>|)E3!aFoZz<`SYuB=MWrKm$&2mOvt)=P^Z=}{|OGhG)jwe2@_|Q0A zxwv@#vhifi`KLs;(YKj*?he^YA1l8Sqf?f}c1rclu?x&cjCL+D_y2DoM5w~QfO}fM z@j^eLD~fbZP{;n3zO$Pv&QC~*PJ8~19{LH%$Sc!#(qU*(qFrk zl%Ri}<2OA`=M?EUptHhnQt>w+FZe;ZAXJ_fqg3}9$)Jp&lh{?>nE zm~`t|3PI(5+wI>+O}EK!^V4neUz9fe1i#<(8`h*#l7B(uzhC(G8UE%r|C!4J4k^SJSr_=8f1@@NFf!9Ip@xGdJVeB@IsM&j*v% zw*=3dpWEzW4iSD*?yuSVa*?xbriQ%x^Tg+ks_Xv|O#h0&YI%8i{|V?SDgDLR{*H;? zS6WHwH>&<8ud749taQ)$9Y=rq0MgmX&Hld?2r6>QmsR9dRIUg?<>fA`Kvh&!ep9}t zzXb;LprnVwpGWEzW=NIKwgo4$lori zD-WS>{6!nf>dHgu8-L@&y7a(T{Cj@CgTU0@k1m<;`ZJJB<>l%7{`=hjhYAMSf0PQp zwH8+L^nw00Yb$vbI*j6JkS*xj(&gH$(PQ#%cAWaeCZ+fPdJ&< z)e`?2PW03K6HEWU0OU_~3|#<{X!u(I0;hQc0vVC-3}+!>V_KTLCjpb6iygFx4mCf| zeKu9S70?#l9h8b9_{#CEBNB$yxrPhnjmq+4B7CNJO-Gt~N!^<&kJ1B}7vsmf7w_3F zf3FvcY_9vxu8{6bokYVCfxKtFBDRpA<0;xVPsd+D-OTKOb)=vc?iRTM6Ygl;bZI&U z`{l`V{bpioO48&vXeh(^YwC>u5qbZ%;Qx07$;;6tJpUh3@hH;6{a;smDtZpleT^fu zs4iPjzftk->gC7>26-QKPWb;S?g=;T!Tz$Vmt|Rgu%6cWP<<$WaOhK_hs@ec{fBkS zrQ?=_4o#E*Tx4245-=^#zZ5NV|Nd1$(hOFk)7yFSgh zo0BVl>(c>j3vS60@5(uH37<$QSv)X$Y%D3hna)mQZ0)_H^@8=-#bc}tC$GcNoE)Z~ zyXP5RyfLHI>M?8`Q(?lK+7c!LzJ)QLSZZ&0@>1C6O4rBgFSg~+uVCXpVVh&)w3{Vh z*E`srzrVKnl2yOZRP2{DOzYf}yv6nX2P@*ecvVqz|R%9to?f%OwCf6husgQKoj%dxRV=|qe53kZ zFgs^H87}ko;njP-I>WS8(heBThu!ky&}uX5`>gY5%V6YFzV8>_ z1Rw3b3(WAFm8X;>!|m|l)9+`|svU*Gxr?Q|g`T@lz8*f^nmrL(8$hfqpn?MNJ{ct{ z;mbrjgE60jXI+G`B;LHR&SQ}KLxlgh@c$|e{GYNcC6#~AvRW(#jjzjd%>R^fxj`Da zdH|HvW(^{p=1A6ezFz(S9V?{0|BKqP_=24;B@+~X#r5hVUzdOQWtWaQMBeQc3Sw9${NP9%xe0#Lca(&y;uG*ZuOaqpmop@pD+L z`I(kB`FGD>?5Cw3L_;`5INTm^I2b5C`Oz@H;4vj<`#Gzsvg-t=bT4i1yIYG=gv!_J z$9R9CE1fraq@@(BzG^+qwTl?tJv$;e6~D3k9e=v}!+Vbd&*P^qU8+oLP`Q!YmB7UH za%;+zpYixPii45Zi-qp31vYDwn|p&|kB!kP3@^7Xu^mcukIV>>7dCDdI$2HX)&ap6 zZbYffa9|wYcD+8KyH3E9OAOh}49U4qdS9@aWVr+@-HQi4GeN$YDdS@j%+sf6SDLG>8tOpy)g8r@8jEbSt6y$|bd_ z`9^DA(J?k3P}Lhv>0A*@*%z!z__oqk0Z-Zn6EDy2Bv(s_5O(t7I6?;I)2)$TdOh^L zm5y_Kf26iNF>*0{`T{!z5Zo1DUGT2;MCjF7AsHPUA8uUXO9Qhqp1-$m3ul;$z1WGl z+;SD0`h!>NQ6EACsbeS=AoIwgZG0`LiTwO^NnbD|?WaYlO;bx#sXCS^udkRNPm{l~ zeBMl@Z}M3cfDdZ-KrX`4S0X-y5<3sS^jxD>^5v%z+Qyb+$p-_;cPX_7XXjzr8t-3Q zU636X)VbvH@jsmZccS=DTJ$g3>|Y{PC8ghb!Qa{JU)of9Uix3zEPb8$GcWspG@VtT zr-OfwMfQI;xBY)3gQedv{<5H~6}`y*%ZT)+@|ZBDI=!x(NRe!GDu69XK9dX8Q*HGS4!F1y4!K%&>|%C z&`!p8gHSW~K>euf*-&GFs2lq8Ete7CQLY?(5^7;Z0r!t)adT+xn~IU8;luq94VeF zN;n%t%uPXXO5m;2CDCOFpaXt}C+CtXGXj{Sh|wkU%8xb&sodRmEu!|N?A-bBb6QYy zVxe+yV`9)Yt8c=18H%y6z$3_sx>9_8cxEYMtGQuSo4J6k>e~W75oJr0sTDGar26xn zlEK&HNko4EM+^NwWJm>mi%E*qM+Jjj6YoBK3>o=3;(gL7fse$RT}_OO#S`MdaWQyd zRw9X&Oe9N!i78}ZLT(&^NEVJG@DUT?Z1pk#9B*bO$eCoW!_#G|EvX%=n=pwvaZMO$ zl`STsZO9ZAo-M{wEuxW${jT3=&qbs%9%qMILon=UIf)FofsrvPR#Gds0;Hww#D79N z4qm;6AXiL)2KvcExl%G7px5z0_*DG1v$!nu^K5>Syru zIKa_(xm6tl7D6-mEpQ`eaQc!)+uPymalV5sOH1$H)jeWd3YgF8YaUMJlE;|7LbISS zO!4px6y`We%m9{x#+;f&qbYJw3>h zNF6n)l*y*NYF<^nbC0FlZ&guzW}Y++?OvsIg(>LVx4X+Jx zy%=i2v!qjqvNcEdMH?@CFl@m+b>(4b(KZ%t1?)x#*XL7d*@ zbG3II`)d#OXu|LQV?}?>Yn-z*Aztg~{ zm@3uROEFqQGij)t2UP29b_N_PnO{BAGr(8!nA4)}!>fCn){pcwB54-=B6JTfi#0=M zh$WXv@-|NByMrO-NjU2O@{K29S&j<1dB`weac9tS}r48z{=50wN^B$m_@KXNqGv zMrJ|~B*e%*4-HxL4c2sS!~>nC$O5?DmQ->{tQ5Z%86l=iZ~_4ziokLt!*cmqqkse` zdm^UHjWuPY+@i>RiL6Jels;WO9raS(vv9 zOe7DJVtKd+9PDnGdW_fjv&MQmCIqa>F5|W@3XFcC+Re%|M94W2h{Rn{C8T?9UUavnI` z0oRglv!Wekh9mR9!S-YVu?mw3b7v+M<0h`nFgEMKv($ZA-l;xzhG3i(C6sidK@MaLU#bNG z7bkWNK>~Y#2!uQYIp?&gK2!_RtY9>NFE5MKM@15IF%m>Eb`|>p%ZnZR;-}KF0|057 zF8Qv~|?wf9~i zlE35W&6Fxcm2fz*aSW9k3pkFJdnGI;0uaZbBQWO0!{P4Qp4!-B+`w|vZGkzRr>)3aE_(8FbQBI2SOwh^ei)R7uYC~{}_W#m1h%65koS{L(uW* zZ?$8QfJ>!2&(H6pM?ZDm-wnO=rS|@l1LPDKuY(fFMu4@?Lz5g~?7E7NAG{qqpR0(+ zjhxBp6|I1J+L97u7Ko@`kd*Q7{#s{O^P1lG-Z3sIX$nE3{FJ^s!~kOkU^L`_UZgzr zBM_a)WF9h!gUlJnlM2#-pJ}X-W&=+7iNp0b^8^ZE1u8V9m3S-ZF+e4cySPC%#bwwU zLdi`Y&aJmd3L2~pa#gImY8n>d1Un6Jnz%`2HNf>YgTXQSg-2pJngj^zV^w5;{6 z%k7MB2kR-8x+<1es+CtN){sV4Jcrh-hgK|PGF{w!@q>ytktfVroY~XIx}{%9O2?{9 zVgLYra|{d8Y1jpUAIFne2oBuW%D7x6yC6C)LpnwVTyj0qrmvvsQ>IHDUNtV!l4i{B zp-j+R$_b8i9RS^Ln3nnUAUq^Y;g;Gi0wJv3%i%L&3KdE&(~lK5!VaD`t93L5`sjXy zxNg%j0E)kPjh zpC*e82t5OU#ZYA+22vE&D^J6HXZN}`Ls zPdC>XC?=7IdCPao-$)x}3I!a$HVFX0a0D&R3k{|^GMp$!&dpNF6bVd(GsTtRz)^%U zXgWEngbd|rX9Yg&0s5Zen28(&Zztv?S|{@BGI>NBW}4TkL?r7UQ%qmD1=`Nx0uxDK zKTZ-bb<&MogCLL`8l%GXBjZST0=;8|ZIP<-nGMV5Rd4N}8vPLKYBOTMjCM<5wkpXoUDlf(8uOiLx13nT1 zMriGHfJ@nu7C0UKViE%c+f11|>6U`FF^SF+QOU$qt{81%nFy))CPW*;!pKDxhdNE( z-7cM&5?9346Um4YF)k3HIFb3SR&@hWG{DiAvk6%5+yrTt(;Zq?x+fs!0BXgW1i{SG`teSgQiAI&Z|9R}MD_ zN-&+e1%6Fti6tSTxIj$0!f`}5j+91X&X}uK4P1Z^401 z5rD^}>f?#-3ht^HFLMtd^q8_p>uKv^eRh5)N~UhlNMJsT0&{pO8A~A3^WonqQwg}* z5#z2Dr>eh(UKKTxL({#I(U2vLm)-2eav2<@!zs=q$;pIkDr~Ic66euvNq3M;Xoh8+ zV5Nv^Q^ip_aQL;cP*KY_ZFyzvH=6R`k-6!UNd6Xn$TeJyM{Hv^*~Wl2rkB~3+K?&qsrwBUeVAtF7<%D!+f0Kb<(Oma{QB z)A9YsF9ws3?t*#NX%@+EtB3Vhp=A{jyt)xwH-SRug(xQ~Ar{s-&JGk3rW6YWcgbVp z%BoMQBK;!N9?UxXJ~1FUS1FvZc1b9a_rZ0mP@|l}pprrvT;ir?TxYPcab#kX{^V3D z7I&ko21Ej~I&h?f@oUME`!7MNltlQVB#3+u2hW%h)6PJ|xnMMSHNkZ3vT2NiwMc&A zsmW#~7B)sxVE^u^L!NQ>TP*=2iluXXqQNRuaRuHPm3iEvzYNVI3p6yF?|x-tkmgSt zSo-o4*WXhL0xF!B12*b#yvl&FTS| zkLylqmbq;;?0TA{A6~Nl`fcAflom~+8|F*%flO6}3r4rUfYXn6JWtzQ5#p*wpXuu~ z2?}$i5*~~5!^;@8BMos#n7BCrCw06TzY1&>9)&5DSQLvh3W2>&$3<_gl0ih}-s-@2%-OTBmJY8Y{En^7_q*Z;6wjm6vC5$#dp?}KJYAi#g8D=S5m~|LDxd;)l`Uo$pH#pZsU?5!w<0R44B* z2H!2wkHMXpO%tQ*?@G_B*F83d!}QnqF!Esv7V7zbX}`?*Va8+ zPwU>N`7OLZh*W8YbW?0FE~ejxKnY`%DCgG|*y`EroJ8D|Cn-~xmmQ!(zfD5bqp1;x?~rXGoxBMA}Kuj%#_18Zv&Q%;dM_)Dr}*!4eCpOltcOaO57 z-(=Ayf(N9Oq*$aQeQhSoO(|zg5j?5TFo~s(6?=NS$1Fo4>XL*AMi^rb!x*t2N3o&V z_3FJRwnd`Yp)Lyn9~XkJ?zXk&&8hqMt`5%3E%_{JeA7572I!H60jln9q9L&y z^>8FIZVF#U5*etelr^YQHXyWX*Ss>6ew>pUt8nUrmWru<DG` z<{shVTtZ6{T46*W7c+tDS?{CSz1Svt4h8!B*4^e{mNHtDcB7&1g17CRD=n!@re^MD zT*8X>jbg7MPS_3Eg70^Mdlw(IEUbUpKdKye-~M^%d1)y$c)Rd!M@Q>p_W7+)@4DEX z>mT14d9zp0E7D>L2nmgEsk~HSv?;Awa45LEb8sdg_=`m|`}GL5%xFZx03o+}Q%Fgx z^qh=CRDyMNMah&u&`{YlvymK=ZaN8fmvq)$w6qo-$N0rwPge!ttr6s&7lnA1kyp+v zC-^V>OH48X3{R!UpGw4_4KT<=tfVKo6&MJ9oLebPZzplVEWF&hp$`4_sN4*I8I|+6 zkuh4|O6QRgo@O8^CnlEw*GKCBnBp)1Lv)6rHZ0>>Mv=Dc%0=+JV&c^xchcgAZMC0Q z54;nnuLZ3!SA>y?6(lge{t`s?dCr&M(06a3Kc1Vs-M;?y?$7&hZ(3*FBeDUBk=Yxl+EW5lz+2t0^ z6UibdQ0;QEVXqe=>mdlG z5;*V!qw#8m5lPSqt7;TGBLc~P)8-}WRDNKA#Yd5t^lTZfa(Yh@%~oOx!EhOxLLN+^ z1$8ux4*S;@M?O^3Tyut|f?g+-gb~O+;FfeekqjQB{1lA;slNUx^nT)K)n>?%pbr0! zXU}Fvo&=1tscU#y-B4G5QzT78u810pU++}UpW9iiJKgzaeYiGzHLA5R2ODfXdi_PD zyBu>YB91UN^@{E@pK_$#i z#e}Emi}S!@*-SHzo4&#U3|Onl@(!!dvRjpSw@^8#++?Vz1-(fudMyJ!a`>EjAUGB< z75HJXb!t20v&;9s^J=TU3%2jdzqk*66O{VsoxW7(mG@<#wyi^L-6~*rFZ8O_>I60V z;^SMJ6T=hdsuB%rTv4Kq*y;j**Zl80Q}^zB<%?dOJ5SEKpM9vgv~Ti~c4znI*al`? z(k~7hrz&rb!7wa~TGO1`W@`hgK-Fbg{yL^&mr*eY0>Xh(=~GpfvXODIv8p{#-oc(v7c#++24LV*}d91 z3JMC`zoBve9(Lz#`$1w-kN>^xB#%(o^Xv@N@gUg)`FY23Y1X8^@qewo>*aW1zC)5 z68F|^ttG40|E!zJU0nffGBeu>&BtBiZtm6DxMk)CILS;du(KG6A8gcu?m}{zvu9kF zSTple9cf2+HR}10V}C+p9wt4OBu)gza*@l(gkB(QrqtKicJHli{%~L-4C-=?J9{9gne)?_ ziM$r(IK7-PYjc9gv$2@zi`pYkO<1I)wX@KMyV@J=+V|xHNoP;MAo5rx{<9DdYRu zJBPm*&e|y#?cA3Nd8d<^1l-#F9`v^1RvY(2(hD-`!fbUJ62)Es zV10ENo81saY{pNfjF0Urlz$#P8&cl`*Wu?b=&#=M&)>YL&Ryt4Urn5&!U;9HZcOB| zs1wy70>x>BIBI~I!WNF#_+?zjSh2_$Tjv#kdK63Z6n)F`iBnpoB5nr9Zz8~8sJ?4Z ztx;x7MfGb{z6;G0$A~8sO3awUi4R%g(j-fzlc}#gcQQ-WYJ=J%0ve(2zyi+vosr6` zJEI1p0=KK*Px-U03xQ;JigI>4HE-;G*jyJBOV}kR{oL$R`Fhl}Wt%@bbL$|`#`o~7 zV9JE*rq8aUtBGBw>nHzxyX%VEp_&F?e3TOhTh#=dyHSWzqz(_%5QbqzJs&u#+A3)J zk?(ymA?6Q^M=vS5dMcXwu$CeL8tyM0rH7Fxz!#37(&harWP(0Px&=ERjA1vxbvvGk z)2Ln(^a4L!Dg!e!Oa-|^gZv}(9$AkhX%k~FNs|by2%;nrm!^eeZgRvRtwqbGVUMg@ z77YEKlF)z! zN**H+ff8EDWxB_V9#<)fNp{`X&8*LjH`b|y%vZ;wJ4W(%6%!XLeB9Nt`)t;HN4|n| zY4^)RM&4{puOGZC`6AX|O{)Rf+0hO))AD^5G|P;RPS5-le5B$yPutrHP5Q-0J z?-~yDJnosFr!5%!x9}2T)@6g9x!MjvzGXmwq6)XBd`tVP`(IKJ6n1OX!ls7jp-_w{BZl1> zgC2XlXaYAePY@@Kn8{HZt`9uk%pCV|R=xxn zFJrMy92Unb%qrj&8Zx!bl}Z(b>Y>_Qk`I$)jW%1VELB{QVRIz3#^`dFNS(&$rtGf>SFt<=JO9~i$ZgL zs2?4b?cEy*Ssee-TzFI@YkjxqlFh>7;0p`0wP#E9itY}nzVHuO_O8+hRBjkhj_XbL zSpQ)%f5iCsJ~VN$Ie-0@A$+6?Rc9PPvmI*kPsmh>)fz2KztgJqlA=qT1Oq@%wFD3xRmvi_D*W!Wrs-vVqP%8pt6+7=MM>C8vfgwv z2rHo1edLBJf_s_sO4^NW#g)i;amh3bFQ?bJj24&i%dZzaoxPPB_kS_y_1UFr>McG> z4DNWQfN-MlV@0jWX`rp!Go>;B5~G&8n!H?NIj+AW?YNv#7*ULC-ags%pueb?@{vA)vpfsU=sq42l?< zGrhUFaNE!%%jOq@+u*)nMCHI%=>42e>tC-NJ+e45+$tKsFFT=`oAvy{Y5r!8UTd(4 zMhyt*L?I>u3TP#k+ z-`!5O(nPIr9{6RwEz$4Y>C9(`8rJbUkIw9^PY-4`)TrD>KO6)`-O!E`NrZCA5rQ?d z@0%WBR%u(?)d2=pRB~^tfU9l(ruFo5pk61wT7p)3el*@H|3@Ip097IZ1A8Tr`n%Kk z`+>liW7l~?+o-mmp@G9nWe|W%4uv-5+tk$oyt;EfJ5QvXe?XV{CO?vuw>Yy2cN)&M z=InXGkN<7XruZ|JoK2Qi@duQ=G_?KA7T=CxT1MVIb-I5ZPJg;@_o>vvMs4qFUEh(^ z_o4^1iAAOM?Im1&u7U@vS@Opko1ea7Z?H*sAuf|fIXIbKq;LTU`AMeNn#Cx$Uz+;_ z`Pn`F<+zs|4qtv)!) z;qE3>TT75L<9JH+@!-g0awMKSkV;OUwyJpc#_hXUEV0{s0bi}P*tKBZWJ_pj+YE^*YehN4h<6DO!Xv%S2roa-L%>i3kp3?*IhDM zEowNhTkqIJc6Z5+ZwEc~oqqkJsO$^!7lSypwj)SYnq3!}5|6Ry9$Ay#U3LwkT<=d5 zV8ixTgiks!-s<$xG{pc1!B#vR0n` zVu)PsTfe@}A4ZTcg(kCDRVu^R3 z$KH26l381Fy|b1=5{_!=@SZMMSKH5@KUc|)<{Y4%?;BckzN%W%1CApSGf0s18aT%! z1_c$h);2RQS%*A&dfN6tGFTy3I_g*h{nwqWp+!Y>w`+6ffjU8%6PFXO;UvS7vnyE1 z6{Qvx7IWb6*;Mxl-q0Z6W^REteo#J5*CPpDnn7PnRRux67)tJK@44=3@Q$9<@TM$H zEG=zo0(LYxmA%@1dxM=7X4zI0DA**-nE<}YSmIJcrCNW5qf&VKa)Xg!b|NOxAR}Qm z0k7>aQcB&@s2p5eTkr7O@fq>Y9#DuifU}|j6XIAM{FT+Dw4%HT+NZviUkobyUaE&@ zOQR?H?D9SwS}twS3Ufw{uxaZdMGafBl0P+3MT35a{I|b8vweQm{du%XQSiafyzl;B zp?SM)cLMWPM%9OPn{s;W6o@^6J|s{H!nCkr!RBYDMn$*XoH71$ePpqV`l=j?ea73%XJotxSdbU z7>g7#OFg(Jk?%=XRJ7is(C3eTF|ZwO79MSnu761TVq$W+DD2?*?r7IeU$>0AN}mni zWKZI!q29!kAVhjs@%$xa?I){o{YB`E76&a0u1(IlhMzwiaRQlItxi6aq#M@WtK}o$nXcRb8H{e zZW{7a2o^Sj{4GoskP^v6`7GlK-s+YXnH*}(iM!g=&%L1CPuERTNu^Q_X}%?;%B(>< zh0j|*O!pq8Z5>Trnm^cFt-ZcyXYr`uM;&Q?iGebSvY2k;rl!UF zkfZ2>?TOgIIVe<{fX!P_-so+2{(0f?qpAW7|5V8SsQThk!0RGS{|g&vD8RZ=q79*4 zmdj`gq4%5!?lQm)fwRv~z0=Fj-MxvAEzZk~3dtLx+jp7T`;i)-(Fh)(GMaF?zJW@Q2tkX5rYr4`L+-TUAnaU4uFlZYKjFxTs{@i4{jlRrAm=s_wM=zu4R>;yqMo+ zksvH`D=!jUaye&Kqk3IUUFFN-oxP{D!*hG@b{;9)cD@rGwX^!+((vuM$~1RHsK))< zql0rf&+XDyzAYu?w2s#PFj${XyS?5qYodFb@~7MkiB`tG=H=DTTv`f3*%U(0_-a(so9nPq0rZb{C(5=GvUkbjZB3LXC4&NX zrt&|ge}B|^oSNatn=3BoCv~}CsH#D>Qm(Kghq~H-$!OBeoTtMN+xGUT@58=V|i zClQ%Q%(U8+|HcSmXOX7!wcT;wd;8I9h$_9Q&fIXXQubo&=<@crA79@I8qyBM_WGYH z@7~kA*U=eml99OhS@04el>6n!pLL+U^$FkgIDz1cHa}JSM(!1sF1ndsMl#(CMcZhfZaw8TKwRx#!=p{`m|2qN7m- zuEQOUAxFwLeYd|+AF>%qS(u5U#Gv%{0~mpDYN#}Tj;oDyMoDTsQYo@it$7J|41q%5 zueiDnFL>HWcnuF%2~qi}B^E5i7N#+5__#d<)+2mcNA+P}cMA8GgqYk#N~3Rp!^ChcEXv^nJ8TRAxM?0Fge z{&@7LyJ>wpSYi6C$w-sN4eQmS()atynpYRxKYRB~goGA!Vv7)8{L)soX=$DH@X@*D z!QqLy5j*Id&z@}HmF;KnsV9{;_Hf@^hb-%|1m4++TF}efp!xh_P(7f%`*E?; zM>UsDkJb$P(Vlw+d#nDm5m@@RO&l9(`nZ}Ds&Zi4Wh=n#FsXBjDnm#_b92%8RwPe* z4i!DjUYkOxD~U5H9jTldsk{Z@)(D*~DjI`^%zv$H0 zTlvx569yiy^1#}3#%-$YSJo6;ryWa+4&$l75)i~eP zBZ;8HOTx!-`ezi2N{XCSB*zqlDS>T%nl15c(qiWy7UO=%i37jUOuDSR(y?Tq&!t06 zLv2I9(wzoTnuFrl(J<6JjPR#A9oO`>lD;fcg?2@p<@6^<@+ZzELpi1T5RJ{n8%mZN z)1JAubd3V%Q2{BpRw#5z2ny+RuMrlin#g*t4cW8)p*BmKZ2YCBGPi7~M132=${99u zc(2}dFbW+Kywj=Ofq+U^SW)U>N@ALTAN%AE#tCbyx&7B6jMv22AFr-v7fwO=*G@ zB~e@X^L72MdE6fzs=QZVpTExrt?w*By?+DB-7`=1!vQ3#?}+`D@Q&HvJIOg+7C-Th%3DfW%hcvPFpHk(PIup~#jOuJ5@ zM6pzA;x>46if+Wg$kn-`sMHIQnBR_G6~1h)@x5q2{m43Ul4vG+%Z;fVboQ2$cBIO% zr;1H>%y^C~R5g^&Z=J*Z^M}j6H8sL}EP8DaFa+yG!Rc_4&dA&C`9WxP}S>@$b#dMK#O`OYp5d^3jx>QWSRkFx3zhw7%pck)LP=ha%5| zpAV6zzC@lb%8M`84T33*_lda_jJ| zK9BvQNu_B9#umW94T4>G7PqSHZtnfr6?{SxZ|mAaq;||r7}{3mFHm+`EV=)puS9Xe?gslGW57tb|tdShofQMTmB^%#iFbA7Dl zv-Q=`qc#SqP3WY(u5sUFxhHs03~c|gMGA5l@QTV(s1n!uKn?$}C|vfukz-Rv@wH5U zEi})=3WpI}g_+!D80tovMiwqd6q;(+DG>mK2!)MmaY~bP>seA2yxSwoMv_}62B&Sc ze&(U(vbG8yLQ@d%S_B^u413U&4kAQDZd7o@1WEaHJA=^W_D7V z7IXJd0NxZf?+D=Qf+9A!na1Fn&sik%&0{abL$*rk?Qea8gF{x{m!G30O#{#xD-x|@ zTeQy?)X+jU`Ip{7Pxua|1Km3`SvsgBS}p=-Bm!%}66Q3>V-R+t2Wmdl2v|o(t0!@% z-2*_FssEaig5f!WS%8ScG$lMhBtPv@+S$$#01~gD{Iy(9&K8h&h4IUJ`)t4L%gr$q zT6BlLvR`jOe^{fTi$VdKJ?Su7bXvjCWXHUr3*fDFZf@f5%^gx%ewV3ZBa%YC-q+ zUU-kyodxR$j_ORuY73I^8H5+gIg_i(DwHY%Q>TrvD&$h8cz;*Eu7$;C^|ZVnNbyr2 zV+=$uy&=nTL%M}@z)Hs#V_@0Rd2b7t0FnkAn)ti#S^TUr~eh9XbCxyfVaE+s-NTTr#bZUr*@6V_Zw(X`*}829WsWb;{fQqo*Hy*R9B z$HwS6ZpEvw5ESzNB;DV?aTY8QmWe*5hjxfs6zqg`&Dd_tdX-bODyehz*-S7yI4BERSe$Cc-4a5Iqe7-OG=tn4X@DtTEb*K-ZS18 z`@+c#&zNdPEGnu*!R@(bEw@iFW`n-&w~J0H1c=i!m-Iu9<4oVo>a`RvlmMBs0@_jG zYcZ!Z8&xckz{?4GlgqHgyF^sVkp4qvZ7qF#W@4uQgr=vAr&xInx(Zt#ed+B~_|}CH z7{S09QbY5B81$we<>_DW`^oB{kh?93P#QJAo$-yt_9R8_EWUH8u7O(c*^C>NqU2Mb zZ|n(Mh4F#>j*O;b5`Vp)S>0OM>Gl_D3;Ky_J?*StTRi5=vrS)6UZ&CdkY z=SVj1&MlxCoONwXW_{28@?QJ>Y+fFX8%-{*W++dn7gVMKw5s*XVz@3jjJ)D6sOq-q zz&9@@<-bCw|77&Po!)b~*tKinE02xmF4VooLj~bC9;4uVsm=tey{)y_H8H|?G&roY zgBEirdbvmQQz0NI0K!-Z-wItzFzcYx)UL@|fJsm4a{Jf>PP3q-+oPrC6JM?>&AwX( z+t3EwFAZ;xLI?ihHP5`6{v_wj@vMpNKJN+vxu5DjZ(-dGEjd4TFL!>T^j}d%ffYyG zH|H1?XO5_{3MQcZqKGQ0sLZr4Z$FkHw#Y?i)_>KbmK$o3G4%IdB~}dy!kz)76w1_o zX|Dt5;E?l6S)&O7v9Ty;7d>a!?DC@V!;%is2H3(E+{<>P_*ah%2)zH8b7LCL!If+5 zHCpkueoxKA04B6Qg24Tx%Sl!?+T7>&e&vpJ52RSN8}WZ59H8oD6>PvRg(DIAC#)5K zd7S$&i%2dbC6Fd2XsJ#gM%6nv%)tg^!*87&IJg8J7VBPaa2qN`=_EZM`O7X9Y-pbC&^iqQ~=R5heM^P z*qI%mdd%pXjI}w0ilT4Y(R2GD;g!Pq{?Ks5m`})k#Hx$ni?;)*M#^P5EDB$zQw4=$ ztK|i>D>4>MCbBfm`5;?IAEqR|eEKz|E?^ea?eHX35j>eOcY^_Kr-c1!XQwAmzGY+E zDScx|wYmcQLC@cyF*y}LNF2B?B8pxBk}6_~DvX#rT{{9kqzXjuIaTeCRz)9#@!UB6 z)s(bLl)U~Edm4Jr;~Uf=Wud&rZH)>FpryH#pzf0$M)U?qC4FA(2=Yd-r21B$YlQNR z!=;uPC%$YW@@!`fcU`fqvNeaU!O^347EsYS&`8h^7VeD)`_2XD)4hGC9HLq|CemT3@w!1<7P}2A?Yn=#$sS%QG-4F{&GnweFb( zqHjcyE{M=I;Ss6)fVFgJLsIJ87SsUcvE8`4BFtA+yqoT|(?lf{t4p5nLZPHo)*!)1 zfNc`4%s=}i$=owBdTxtr|93-e>Nl7LXQgnG-aP)06QF2M^aK>pt{JI9krj$YZmahE z?LS|AOu4aWIG5@?Crx7}O8Y-!#0Sh07mpEl_`3EIx_RV4-CI(hXxOEV37b)zT$9Rj zNOEVXYlo5`Lg1xlp>!V7h`oZnM-EHp9qBuJ`zVF0#K!XubMP<%0axzKyCGH(usqu7 z=bz~U1+YgF6NpL=~j(oc(iuh7t-NdY;Li-s}a; zx<|0bDNz|0sjxq?6nylXSxx5Ev@(gjHp@plE0wQh6DWRmBLW z?lg1JP04cqS!cxm46~2}uc*w5QiHxPto|PswF~8{+gJkD=Nsq{_^0F@-yA-G@(VcC z!h>&D2>soSCF@|(TqueAT99m4{K^*hYM3%Aznx;=jtK$N`|7>5Hu9kllMhu)UGy?$ ziLn%TDFDsH&~?$TY@;U5{^s;y%w)btLMj2ifhozHQN1=UIlLek~6b=iPgiO0%% z`lL*J0JB|2Yg+jQv$lZFb9p5XYL>L}mlYK(74LOT`ZdkL(0vf+4fm>rM|2aNx!Lg` zl>5FU_!e>xpV_(!1EIsDd%B`QLH+B2|FGU|(1)M?!&13jg~A*4i>H;kt6(sFp?D(~ zz4?|I;~}T9Cek1U54~LTDlWI|78BXM3aMb-9N1?Kc7bPa1Y81_-%LPupJ>@;KT;KY zCN>JLLx^RTLl(Jilg!WaYx2Zs0B=qqb?-gbU2Or{5BY~>)jfE8mOqynFx%o=J?(vV)2?Mx z%5Q!`_(R=WOim^_!i9Am!l-t;mL$6R_3qpHF>+z57-;mHi@mYAP)smgwT)q`H$aHgh?uCz zsWPhgp!Q=Yby@*|}+jnKyog4ygGKS<=?*v=|a z?^x7b26l)Iye1=+C7Ra5m)A=BFD%njewGH@o>%uBw^8n64eD50;M#L&RZ?YDUErOR zjSs!J>7Bw6O57zs8mg8_aGMAbaXq{GNjsn(s3k zgG4WSI2a+e>hD}Z&$=&e&kk-=Z#4KpcsI9In5G7NjMvf6aZj0Rs765C`*AuBd- zqQIF^ONj(q+L0r!kcl1llXY2%j%9HLM{IEphpN$HH^ZwI=UH2?c)d88P1eB+s^UOE-d$2lummqk5SCwb>gAbET7H?euPj_Cgf7eqaLxU$50yk8YRV<;}* z+q&*PMCm!Qm-I<@dBIN6@cnhsH8#xZKP>14CpgR@t<`Ix4&ULYnscIgn8%l^04eAg z|G{}sWW9d_48D62_;H5jX3GT$kW*kGS7eY`6Ta=A*WgUX61BxtmYi*0LJ-I@WQ}K8 z5IX90r(Jc=531dn%G}|Zz%)W*Yb*P8`-1{XUScapYiEBMAz^s?=QS`ZOva$3_Fvfe zTA55%TThTeBNW$$yr4L?0dNsof7s#-oWITn(cG@q^6G2-0bFC@7mvK4zvsx@;%Uji zi)u9|LEEteg*;f{at?xv>V#=7(AkS=Fc;!xnr$LfZJpDYq5h)2CuMR-tgm?dH{Tlv z8NF@)uvJ9!}|HZ3%&*f#9@nwnrC_%+Bgn+P8om67&?Fkpb!k3m@M4rnrCs(`&{$e5S$p%*YM|nW-Kzx_vMc)q5txcbop1sO6hVFK^@Sx2FzO6 z_-)M2R3Q%tg3h^yhlwl>rc{vT^0PLT}FijB;{o7Y(Jkv0$Y}T!ctf@(9-|qcEZAVUpb! z%GdW{&HG@yyD`EZAh2&4oiJ!9lv^{GN`>!UeUON5t3&ZLPD=5Brrg5V5AHyYw+3N8 z{W~}J=}B;p6V;t;Nwec}tpDG3@@Xkvah z>#1BnDS~f(NaruDIy(jv?@Nh6)C9-O66Ev^GI-61B=jm{!wbMuRAY5^c(0XIn8*qR zh+0&>#c=>p0tNf)5a>|GHbFx- zIC#*{T3|ixKpQV&9tCF!9V;E(xumsO|8OT-j?n;pAB83Z_|WiDQffc?-b2GY$zkM% z3aYyiS{uuwsTn`Vqxw+nkAI-+(HwmKXl?YQb`0RLY#EJs?BD(YsqWu4bqSxK_mF+f zCome{Sy4%jt(to8R#x$EhGOgkM>NMNgGid1y21T9iYl+xnGvMX5b`}^^M{T{oxu}y zYJb(?5711QxyhvLq$+y8n@0gW?#w8U4jS(ElmfsfW#$K=R7<&X*$M@tNTWDhkKyyX z+*X7C%jRUX@nr#)xmbGP0n3R`Hl~&1S*ClHM{Aida>L&C`SjT{Dt`vp&4A1eu(eY?XVx*_O$z3yQiKf{b;f4)p)6deuQGwg+ZV<^3>TUrXML|@=C)Jzk}jXtZvJVrM%z|Ht%tDe#1RIPdSn+?pi{4Ey#T3P@a+SxHEfF+h zvHg-${XtWGH=hTCV533argTMKtvHgjE*Fsyt5??lO9DCK!egu{qh2db%j_uv;CJ>v zEY*7l;jB!XmqcNK*Pzu>FUAmYPjLrBDUV&y`)d>$q`7ft0}#r5s@dn_{0CvweQ@aE z7SJpm1+cL@6fJ~d*}JoXR60#l83~wB(`U8N_II>8rBowv9F2$zWGu5rD;nH+_m!rf{AY2gfZc78rwYNy zry$L}&As18n}0Wtejfy${{~(G$7-6f!r_`AqpS1Wo_GIcIa+CY034zPxLe|~$RThT z28xF6P6d|xOk{t)TKjyr45^#S?lcRaMdi_j4T2j`-2k^5beW{-!J~%`x|N#Q7@kAH zEj(C@;jr!tLJGo(b1Bx$!;ps2H8^agMluO^F3s=ha8y2Rz$1h#_i^qapbceeSoWKg;S(wNH`; z=CA>W#%JBP#gBVg$hSV5dMEVltO9W{GqzQ_+TzD)l81GZrz8%p(yva0LnOEv%XPK=PFr zwqPA_n|6H!a%* zosUPHM{*me8>l>~KIDwPkYOl$E~Bpv)J?#iJpfh^$rhq)q&yj(a2Wq=2o$FG@TLJ} zjC}aA@6!126)L!F9Co_$0Wjl~#8$QW>DT*|+ocmdEoS_hj$*F{Nk`v{aBJ&O>pV2kqIyxx9Ty?vHX5 zf=Xoa`u5(G@OOW9+eL0f6Db0=kJZl6&rm3|r{xj|IXInHKorCL|0&G-+`uHrMrInHE8UWE@^0RN3%ug7r$}9A};vq(*)QW}^P0u|{ z(GbC5{h2>La{{X^rEZ>+eskol$UNYE57Qq$b6m~O|wz0~U zPAzdBD|FcjWhg2GNY857Zfv|%&kV=svd~?^3uf_Jj!^&}B4bBH^=bUsi&;C%tg=d! zMbX&_D1L1PpgOHSccJRrC>qC~cYf}XpBl6~r-)l^Nu1O?a zZE-}@sQ7%ZRrg%<4J=h8p6qE0jGf(vm@7AZ^$m3LLnYRdiA&gY^qSW`LYwlubpLNv? z*EA!A3n2vgQT|H3`mcVC*iU-K^Ue1%lo^0`jbQS%n zm(_YLPa4U9uSb|U4NU^+V>I8>hqawcirHMQLVIpnPA*RN?v|U-wICQ(wRX<83We}k zA3OPB;|9P_B!WM+FI*VsYtqm3LZRpP1qf*W`CYy+bO2Pc(H??>yuM0ertV82ola~p zIBd=R0HF&K+7OdKdxTt=1eQ$(%E1Nzt8hvpxOxiJ*|f z(5l<2_u$9mXVmqy+@9lmv~QT#!pqT(D6lWI48C&-PP^UHJ)x(lhH9gNl7IY{v+4a$ zGoQSmB0oyZYA#2YYi)Je4Rl&Wf(iAHu8>eJ17vW z?TthsyRvg`=+-{l-M}3-+qNuz9AO9@B=2*sS8IZ=^2AZoi)q=6TE;E}TX@-eFJ<+f z7jJ-GS18@CvuL4%X@b2M>XBaMUbng^BAF?}ODZwDGu9RF^z8oG&rLj{d= z>v1yXcM*CjX-3obmVz(gN|@o0u40uJ*+6X*2YaRvinPS;?e{mI9nbDnuZ)h8_Kfdv zeqWr98h^|nVdep$Z<>)OM3Fx>i?L7zQAd>pGE<=Rj=SgelE}*w)%tiLFeO_xu zea?s653`N2z<_b+IF+@OK-IvqtZ-OT)t9HR+;{kALD-%$vImeiL#)rHu)Sc7=j?WF zU`bW9YMxIW%c^IGS7H+rvIci`n|4flVT&#v4r|*>GTFAfSk*&!nkklSRNR0pP=+8~ zl$3qcQ!9fZ-aqW|C5Pvj&P10@->U5bnxdyuOcBS1NC-sN&Odf%GO84sn znhqv*kET3F5A!bS%pA00wFWcrk`14{9rxh<^bjkOSL>lFJ`ggEd<@@I-MM3DG|HB9 zwPv^B;C$iK7gtnV!SVzaCcaW}%aeISxO-;`#+{-|3=q!EGvM~IZ19()=3SWT0v6pt z-rhmLZA;hY%NKu-yFMSm!@AbiL00{x?dB#N9+}v3|Mm_PA9#JzFxqa-3HW|dT@4Zq?DDMHmi_%r zK|5i4VOudH^#x*SU!p&JR1L4cj@f9~NI#d^Axep{reJ_EwDGkOPwcUpubUpsYL%4fkeos*~$EnAC zNI1-(bhM*O$~@do4ls~9T66ZM9N(6{WtOU_L;W_~0ulxJm6(-?ahV4|uNU>@`I!jU zKf5oUejd~uzVUt9%ZaO(t`g%IG0n6?!M314%x1d(HS;$Hx@6{gi=;2PU2B35XSDck zM^@G0D^&FX8Z%j=3$7(dTD*_Pc+8()-7V}~1P0g1k~uS}P~cVywmzmzSa9)>q<%Y_ z_mf*&B_~FjDxP6VbTqF${|5ef=T5mDtZ?W5eDC~Z<;;T)rY zLtY|oat>bTwP!Pz{u#uL!TpD6vbL1ugA5)TK8P~`VO0T?o z4{UmGV=69DxdJ%V4;~Ln**A)LX?ucpXXVQpo($|3vTs}Fa^{A! z@)Rd%I6V20gGL~ToSvng%ScN|MvjK$Bm2Z7Lxq>=cV(yXA5G5V2d{t2?g+_O42VRw zn@%{gH9e~ux*zjh@gNR-|NbAA0)q+u&^39bRkp=Kj6pA)oJXjuUvv1dsygzN!34{| z!;b0ow&nog$Wh7A(80l77?XK?`n_CG_gOBd({SXtq`9qm?YZtRdfuP8oL0Wz4CGtZ z9h?=jWySWjST~_RNMUIo)7tZfW1I)Eva7TMboX387L3erUIoY%?f8aeMAU5o| z9X~7ui?O8~R8>dW`N(jweI?5F_%zlKGP-=1e{*!4mo7C~9?9=M0&Oa8H1nB}gU#9* zX@#bi$gRoW+Xo`(dTpgR?b7Xx4D>S}o|1e6iAmhmW_BOe7tEyF8EAahOfM9(*7oE8 z61zJpH9{wcAPSC7ipA-QYTXPH1J)bCFQcWKeV@yvV3E<9=wOD)HDI+mO zQ8SBM!np;vQ!mepi-~3O5Aj2-UDv#O=iL<>FCX$S10TOCgl~M1WtK~r7i6aWto3a{ z(6f~H$KNNuS+}>IarF2LGYVgep4TdK*w%H3DG0b>5Ideo?uIu*|FAZ(*PGTKe$KEp z16Ldz9Ne$j0h{Zas;cUJ*2+L;NdH9L37PHri6U-0w0{KcblhI8aUtXRS%3+l>K zk0b26w>QT%wMX5z$(1!$e+K9t-+J|@4-uJd?AsTZxGjsEdfjW+ebkVL30ed^p zcfx_B*XHw%zf3@d#RT0d0Q!UVC2i4K*D2NNfvv&#thqXjnz7<0&OlxFo&kBvKie2l zhA`csrE0t{S>$Ee|OhNKSMvo z&WJ#Ztm>dU`;>P1w_D%++#UWaBIhBwms+d_zE8wRT?rlfezX^$+Wp=C9xH3bY-)2JO-bHaK&pF%!u}$Vzl!M1@emrgpiN0Z;wWW)Q51MwSB5kB_$=6i1osX3v zWyFge`Q(3u-Ng@L!D4At=$U;rO|*Gqy5P3PaEN^ycW`ay@GPJqO;hP1@c;e!jAdXj zWlNdW(^nGl1Uuf1I&9z{R!ou?w^0hm-76>d?=Nz()W5u%rc&l>78CPabginYuY8q5 z^3X-=DS=@6cac!pZGb%>8Txac;`L6p1+1PpZ643|!IM`#LxHq3K1^j!2t#o*3Hv~` z$<||`aT4RKo^hg{4^`DG9*ynjP}!X>;N+5ClZWfXDHNP&SDXC81^u@i3Aqc&F^^{1 z5cwD6W1bJAgm@|EZ7NoNGwY4{)|L!&)IVh@h$fEaT;sN1YcY9ep@j)MBR--q8D`{o zO9uX$YOgL9N)%Oiks_pA$sD+%&OyxKHq53Dl!hCzYXq{j$*0$Ka^V&}BHA>0R@F;~ zf*sKR2K4B#=^3xlgor=-JHJHDTakMFUpmrMWTdC821@S(+4y#zstl8mM$ovE&7gm< zL=ee_+u1G0bv@!K0})TE;+h#SNDm$d7}y2}9*- zjXv?b7t!sRt8kEhu6p@JU2{=~!V#a-=Uu|5QSWz8UlBPOy|ZvMYR;y~#${2k6^Xnc z1T>3CqQC2qGM8ya$j<76{K4LPFu9RRV!q-}XaAmYY6r15C8|}ugVpSHS08^hC}xUo zEZA|rwsaeYIj@B-{fX`T*jaR%-yYI)i)|1O)@UMpT0F4^v`Ecsi z-!`J6^bKY%qpTkeM{?+J{M&f9Kd`U!xcG= ze+%ZA8`yzgS?GX0&ajXDHV=)|_(=RYIj!7x7woAceV-LSUMZZwvrGTp6s(SyzBHID z{b*c;NYYQ%am$8@AU1O9;~i>fWb%(ihlm2lfV8?Ync@3AIsE#bYI5#1l=&rlR~&(Mk%%y!s+ zcoRPcj8BCpOG5A8rgZd+ws72tH#ycg)k&1-O5_jQXF19C>Jc+qtU8x=9tUN{y`J?` z5NPw6?euHkdnPs#^sciA6}E}9qDg2!vA1w^BJ&nPf-N|quiLLE=%YjX*L8Pfx5;5d zotZ}COMQ-*kqg7~P*3(5!rq$*%09^d*#Pj9L`U- zzqykB*q_zy+jGNi3w0fnAM>L8LcJQTeev$c-tD`;9nHKtKtC{ZILoE8a6fqhWUnIZ z?V4)JBi>e9_YVSJKQ6v5{^mltD=;t{mHm8&7Bqu%6@4o^xAbeDS`VaVQ(rm@-gJ(& zbx+6uh4BQ>B*!A_2k^xOmwrn>4P_#(7d`JonUJ-4EHV92Q5x6C+*q=jml(WBhx)cZJ--$Dh+`Qi0 zd6SsFZ`~(4m^Mi|#A-DDB>5MKOzQ{_#DSAv+ogdn>n znp2gePL&v8wIUZYiNq*L6aJQgH<531-ai@d;&-HKBHhIOR*K!IFxOh$J64`Dpk#11 zw7r!wAW+q@Amb=!sWL|H3$ci#k3S#@Ek*6KZ$l;ybMfNH`*P*>*f)I~;zDx<3a7}_ zcR9Zi;=APUN;Cf6gE?Hu1vVT7R>un;U^7-SvFWKov2t+L62`opwmHOfv`Z~tix`?Q zSuOqA%6hZmU=-J~&v4pC%G9VCzMyGq1I1SWdaXgH7lZ`E7?j@@?rT*bpoDh}eUm@o z=NxBfxI3NI#+`Dj6T3jaNZ}Z$pqTeW_#HJt1@wHDdgc~|@CVQFdyY+`ytUrkHEFE= zj+y0U^I`lJCY8Ky(D$<9+p%v#al*)SSbT3m^H0`n+Gk4?Rw+W^Qpt_)meI#f#20#N zIW~cvRFXfe&`p`iW^!`^ni?3hWWMUp9073MCa>Q5Xd=|F16mQPIRE%!5i)cWq#EU# zolsH<4I#(|ebM3%Snb7D-69^o{4t{^2P`%^PHmR{by`f1HBFd5>Aflj>_<^MdE7&t z&RG9LWqy09O}f#GfVC#Pz~}LERxNotn_|DmuELbtzRPFW5JF4#t>X!hFJ5W(xaf>` zb7n_B+bsEeQ{4er_?W)~Lll(L|BcO+XQX5kU-RcpJ}eNX2-C`pm7JYXw-7* zy?MK)DFOD2XdMCZ%(5Od_pj>Y@Vd3;cZeM?F&wd)1GkrE_R@^0PD~?1!Ywt$_%=>k zgb8&*{BNG~r_6X%txU9l?dapr%O&45NoIp9aJJ2|+iJud6_LMqal&blvJS*_Db zwGPp`c49>_6NF!r)#KbQa+_$rjQl<&Seh@SznqTE7)(tjPJRhV%BYuIs{A`@gTjk_ z+xou6Kko^-fr0cl@}=S`p@J)`)1;DTsIL!0CcbMLL3AdQf2I>UxtZ}S#ma^wt4d%W zHwZp?;8CWD;qr3YCSh3Zhub_AaJk~!sa0ET1s>aus}MI=PbhG5jhlS0isIgxIHEg( zOwy-K{&C2)`yu2|S1)9i?LVbmPs3@qB5P-)+|F&~&KQ2zj7>bFx&G8zYoAG)tUmfE z&7H#6M&|2}jLj2*DU|cmk^0|6-n7(MMBj<}N`4Mq8s#)4nEYyr7k$rpY^3tsC`i4^ ztpTSy`sdW2n^=>EhgbrxU377nrmwvA(!W|pU3%4Vd=j{3c`tg_`7Y!MDqzX76b$`% zYJQH5uUEwG66N{vy{y;BCsE}cz4Z&Z{e>NDLNXB=Y;sy(OkTA(8c?p-<83$~gcg2| zTz|M63c^u>*)V+BkY%*VBl27%*><83Kc%mb(csL3+~Ez}AZWk?$c(gb z?^vgwEP+;V^du{U#1yA=g|c*YqN6AN$c^~8m&N^j-`gN-8`(%SOdfQ?ZwUqz+wHD;0Mbm@dW9b)Oo3z?TU;2GvZy(hR zm2r8N!{8~yeTKIpC|LBnkigLXnTQdP&Q;>d*57B#QNE*B4<9TWKb%Sm35N82mpeaqBV?vL_$qaM@oYN%_R z@fZT!$PjJG@V*kV#jO!k_ONvw5rgwc*Q*>qETNeJUIfRqz<%cvGk}cAm$eMUFXgszG6mo*#4iVXM+FvMzLeu-MzxjdEgq(- zH)~De4v#&?(;`?~Rz<4DIvqGu3V6!k#{sgRzzVaOA_9WnMDF+H7Y!yCUaR;~_s5>R z`DwKl8S=5@s#5~DUSf~lzE-zjo%k2)xr1Kd7fnjbo&C7as2~D2D94e8S^0so`Q?V} z)^D^NgG?kR&w{mcLW%&f2Avvlt1|3OsG6PM&$S;5n}xp>`Ll#iG}13q&dF0=zX>90 zPa&z?ZfpR4yaVB+`!JjK^OcZm;6X7EmjNh;q-kmNY$W!7?EhS+(4?V7nlH^ji~QT{Y~5+L_jmc$*-C?8=frv*i@elRyut^ zDf;MGeLYPKD~dIa7Z2sY!8e_&tkX$iIDj2a#lWXj0kottX6nKoml z_Q#XI;ZQ# zW@~%&Knol~+nU^r9zMXg`|19jtIXp^v+SqP7+*$M{Tmleuh#$Dx(E&qZpj0F z_MdAH?5`*`Qf)NkJy#%+bPMEX2%oUKi+fUa6_4&XZg%t(T|OAK0bhYP}Q+T;k%yG?9Gl{!7Yx@vEdL=hKA) zcfqT?4nk7P>0>YNr>F(l`-;A$==6nR1)T7te^_`We#-G13Q96=a_=vY3!9RAQG(DY z8YlS!xKt|-`8cXymChJe{#bD>_Lmo1z)D%k#sNtigq{)zt0K0wH@{FpM{iFTuutC2 zQE@;6L_! zHU(VGovvGYPt$@Tu5A=n>2NK852{oDwW;-I<-pwYw2w80STO~-O!2Pg{85X#z1@O} zuPFZb-m0KVU&m;vduWfF+9zS*hMq6lRdpmpF^VMC>}|=$``xmeKhK%lllX1Fu&VTS zK2^c)eW#Y+9sCcAbvV0ir%OiX3A%cNZNROaGiWDkDPSin9Wvk6D)nj>Oy6*eL2jKH zV2XY4g~C3+>;C&HP9#s|B9ATQ{iF|m=o9RRajmVL45Fj~uqWkw&k(1No{B_v1oBZ4P*iV>p$*u;Qt?)+{8j<1T(h{~_G{AusHy0{Oye zRO49_%TA@=%6Me?7q=$25q}1;AcbkqV&eoPPaJ%BT5FW*OAwGI_(*%2NHJS6ju%f&rl`jC`JDmNO1aX; zO*(mG|sS-u!MsOL$LF|$-@g*ok)$6eLA|lvGo-}ZrQ4Iyj}Amg10ItG zRR6B9aPAcT17Lfzq392aIJQY^`JFtZ`CP%`zr!bZ;x#MS7zfzfxzu;cEVY22%XW$< zVZT1Z^Xnm1QYS%@Z6FE|NtnQYw`}v*#(t@9F=d{lZnAlt1x}@?6ICKB4rA4N!00cp zbVBe`7pajTtBFIazf*JFoBj_!53l>^gYCT}`fx}-D(2;5k4Z|?1r6a29N;deHjj2s z>Pg-L)*MVRlHUOt@IPgfDEqZ8N~Vt~+&K_sjQt&ZyDYUJp?%<}_)bxImgH8dW;y^L zIE$C=nn-pzx{jd#lXXXWc@(VA6m9dL5_Sw^Y z^`;~Q(?6soHlgSRX#EP;J~Vz|=^jjn4>@X4zw&a!6)7G~2R>#MV))p@Sl}Y|DHFRd ziBQq|YUB9xeB6Bg?|)dkBGlr;!Z?<^RkwBL_X$1gtD3S{-_H05u;iZ$zgN`KDM)%5 z!|ElHln!A8PJ!K<1>PFcnt)CPNqr3Nl`z=LBLoC$r_Gi`dpt4T4orNMK@mQwe=>6< z>`O|4)4+7wk}>D=K=;hr)Zukstw7K42@}lA4cul@(l~B;P;=p!^vYe)FDHpVYz4lw zUe}*Er(#I-@(DkF;X1}Hq|q*@PTFa`fxZqz7M{cO!xEse<;|jkpmzD?4yIj-%KpW` z{*RN}c+4Ut`;@dAP0Pw6(x)q^53L|@EvV^ z6k*L6I1ded4~P{ndMH63;IGnM%edpZ#7EF&J#!&Y<{&BIY`}gDqgXfZ=7H9XZ`yt7WU)L(}&eR;7^Wux*MChB3M!KM8G}gr8edB1@}ZUS(bCk zm=M?F(9X*yUPn2iq)qrgte`EHtz{h9yPy7Nci_q61;zYU!r$TY_#C$%)=55y1U({Y zA$tLRIw6g37XFLn{QvRv)^Slk&*L~C4Z=|eNOz}nb8vKbBXM*~BOq~fNJ}Vibax}& z-2&1jASfUxQvRO4KJV{u;E#LU?e24ScAhh{JF$Hp)ZeaQ_#vI0Q%$tjOdN08s@_Bv zlFRDp^Fn^PIw?e*2MXS`5K=w5S@ zd+r!?pU;!`M2M-CQ3H5nr@#J)AJC0@1}=L&bo+@(Rye!w)pywQ=W`;N1_qyt1Ziw*jA5KurHsV!0wq?QIpSNn z6FXzwg#&vDcTUCnM4Q5_0bpxn3Dn(+k-(;5);jXIre>cxah%>4Q4vqmlFO}U+laG= zAMX&zQsUEv^*K;6by60(t+zerXcBy(=a`p3$n_T0DOYh(XYj>gCN9x3{&2PLl?(y(0N||{Kt>3V7YiP*w zi9ZXIdlp^GQ2Wmt0~{R~EZagh;q6Xm)8_9Ol)5-l%KQ~r5CeRTjcsH&???8C=;N#x z^))DYso9KHdVL2H8L$PE=0(L)>dJ;!;N_LxhbWSCROp(R3PGa5wNl z&A4e}BT4#=jaFab$kWW%&*$5~Vp(XF{v4d|;VP9n#c=S#iu$&6)yJ@5&06*vE9O`% zn#Z~gZvuezvo>|}kNk-YhBgW*V+)_$EZW?RvH#&*iT-#cj#FOzn#vFpStou9cWfpy}nzQdJWgl(^}wcvfRBgbnxNUHv730pIsoP8l=t_v3?ltkOciQ~Q8g~JXE z^*@+sgm>Y1gAc2`z=v*en;o|7!=?pfkseey(xL#;fX@)XTCXsAt6gUCUZw5Z0Y_$0LGAIo>AiGZGYW#~1otUpc1Jcx+X@Yh!**IyAd#t)6;KO(Z1MS3? zwSS`mkHF#hKXCYm_(WrMn5{AR+-(KYm|@*@8&McPmH+B4`nCs+CX>}VK+x3^7vp=v zZ-y}KpR$w~!fl-ljzsfn{TuaSC|>pwij8Zg5imEZjDG;Ql?hE2^2#D5`8rI7$xICz zYW3`Yt-HUK1#DnlgU3UK%Yt} z6RZvX`epE~W@*jH3YG$pq1qp+6R`goenWHFjcv*8ajiH2Ubss9imWb%{){N{VU+&E z+y3<^j9d??-zSXseb4h4Syd1j9bsi&K{j2+FFuOw!)wv}xDPk-etZg47H1$@24dDX zM4n+sWZCVypky2#rDQu+iRUX!rMKQvWn}(aWt9nihS0#^h*RnPmOEYiFX@JeYwWI` z^w*IET04}?SRY9lB0NI57%-TBDsG-tS6AoX_K)16ex|+2#sQvGjqNRLT4rLz!g}^6 z>tt5WUKAVkjTxwF_Nhz8qWZ!W!%w)Q7rW$VNIx*E2W5%0Y4jWb`>g8prmXS6*vzJ`G3q+5rW zb18l|HtdM$(vs9+izS?GaqeQEg*vqv==0=$8@Njw`*vOWz=W#Zm%$Tc>mDQ?kH4Pd zfzdJc6HQQ)S(aig173$$mZ*%3Eu(<^ETS1#;~BW<2Z`j;Iy&jUkPJgZpewZs;C;2kyr0q*6@0%2V-=_(7Rv?r$FViu#)YeLVq)_-PxdeT zitaL$+)HLe9M%@gl?Sx)WrP-6t#R5rbs?R{b7>oL#cr8t?5L7DeSSOW879u#B^3X@ zR~ss<96Q?q)mM20@XP;gZ#$=IYpWOHU$j}dt(+V;^c!G^x@~Edyf2g!qYwjb4Fc}v zd!A3GUTkA<%ozs5-o`9`c=Wf_4RAwa{fm^Csc)-*cXWn*5N4>(eoSmwZfCH{X6o~- zy6m2$mI`g@!cXD%!X!~-0ut!r!-m2$S;P4^_+5qp8kk}L>B9^MZq3atab98L$xiYb zVjBCsq2Iu^oCWw(IBN%bdu_xS<`(WFj(t|6km9RDP!_l`26E0wA`t%J7hrh*SwOUG zsOnYY+ALqUC~0Mi?PumZ4K!kGGJHQA$KTr5GT%DUEcKU{0Wt%VtV3*#hrViTEP40< z;QvHrpC&;mUR8BGrT@8dBIk?vC&3}MoHa5dpwiXUNQHufd&YSno^b=)s=)o2snOG7 zl*qGWpa0;E8*pssjy)3*1-^YQeE={+et(}kryDS%y7|oTMx@3nmW5~nbyy0_V5p2% zS6gl~{0qjD2%gCPHUWJ3_Eo`QHZbk&SC>A!!J3ms>e6n)hQ~jESc^MOz;#|7W^9c7 zz27y-AFtSxC-L_G=a$Ft(>wRt2UZDlU;-Bye3Q`S6S={_2jkoGVwwi@l*NuW;(Q+E+ zp0015J;MJm9=HW!L8_`J`8zw?&DV2ht`9dWQHoRFN8w&IW`1jEoO$~NdRwA~#3~x!?Y_ z{xv{D3LvWFpRGueSN)CGaH#es``gQgCP0o(ljWeMPMeT;EKqOEdwh9Q?GOi8Pw+2MNs9#yPFx zy>^k451mHXE=aM>GC3sb^c(+F6G!ctqSw|~{FeT0o96xcDJwQ{hk;3E&AEqpqi@}k z5s_~qn_5NKu~C(GVX*4a&5+d2TN$T+TB(g1c<{gA6OJIFxBgW{oQf2s6A)JjOh&Do zRU@*mU?(u1vk=f*`Yt#ox)lg70bI>Oe~r?V@|MA(-cRNL*coTSe1Z)P=ZRjAt&7+8 zO-j9MmMlqHFk1Maj%6N4+eX-8(NfjC(h^c|5w!>x>d6>y9C;G4)cG?75fLz#BTy%M z8vz6+MFW978UMK8OJ(`s;=0i}-4OH4POe_A)lRiX4; zOeb4kq1xK1O*kp_NUBDTrPm@Q)J#YapZ9bhE6?WxBk~Tk$O=#8ocb z)x=d**B)ZK7CyCY#f2u8D$FuhrlW+MIDHHKkF^25?;-sUi4S&$%c-0-QQ2ejkh0Rv zOU`&?jgr{O>szhTl&aq~kkXE-8*-DVB{+X)_Fpy$UOXj^CRd^r4~_k4p02YnK7&QdmZb7-rrF zIdY8x4~^n?^aERxk6X9fI92;^xa$%DdaS_m0LcWtw8!3uF6kRTbG|BUCbyr(S=S7{ z_1!bK-0|XT6e^8r)85?_Qbc99AgE$WU)G3RTxzsB`!FoVEGiZY7lV&40dKR&8>!pv zFrREY4l#V=l~=Wb+XOgqXF4o8Dg^hI{k;QDY{2?{n17{xjI2Fo;^^Ej6D|ov=Y40J zSJ15>1E@j(-!)3gd^!v!oev>dzC^R*@He=@fah@}*kqrXw;ZpCl#Q8vyLA6g6ZKSG z0>bkg&%vX-PzPl}Q~oo%$>>1AhbDYjYcAr2HXQ!KpiHNoMgCXqQ#->FUgLv!^`xlj zKxB+k6FgX*w?_!7p$IFRo>P7>>(XFeW2J4rU7CyISG(ZkWo<4p8*%!196uB z0GR-V@EM3thKQDqSL+qMtTrmYl}8vchfduCh4fzc$_SQ>x~qM~Bw&$g+1 z2WIgpo&YeO)sWB|H{2b3)tyl0<^g~N#vN2|#EyB83SADoe=(h*%owM_>lB#2%gFtq zoG?WPz7~ve2F~N#O~wVPZmssl^i1$p6lpA1>w!|RI%a}2KZ`_zy1TkiiW>-1LU$R{ z*7L3O^d>xd<-5eFLg3Oil{l5w`HkWYXOu5g+02JlqIJu*nI^Yt?rG~2Dhu1n>noUu z@_uf_kCz)uJC+d$+wbIlRQaG2JeHb@6Tn1@FuvmAVo14HQPndm73EkgB+G~NyX)v2 zdpar-d;)E%dHxzEXFHR2G;3ML^ly2>uFU^stHbyg2@Ps#kAK~O<(uEUhz~Icg?WoL zgE78|2v89Wl~C$mvw#0C>F2(fs#goglB$w^N-)zP*AUcqh#4y1X}xO-Qz}iPB`1W5==TTdwT!vSrN$i9az&D0N|j!$a-ia*QZsxl@TZhKSHzL&5+l8~p+#3^ zr!Nh?4m(#V8=K}2vCt+ygbx#8&%0W#nmp;nD7cDwTiwe8Q_`un@&MiP-$prpgdgFb zXv@TW*bzDTIuqJniiDXnEEYdMXCw=7#nZ5F(cvnUg6`ZJ#8V{E)8$wb!QN!)%eu!N zmS03zjl2?-`@ zvRQRNp^MQUtycH?#uUA|jl@)qebReB-cf0&aPYx3+uSg4uKqy$M5R#-n=5NE{C^|o zp3(EC^vM6Z`SwMDZ1IjWv_zoaAbf5p?Lc+5R44LY^Z%wu557vR^=WgjgME$COCf$r z@0hETbug3*q+}MOZEhe?I_HKScXxMW>8UG@o$99jk23V&OMC&z&)ZhX5|SA1s~Nb; z^q(-LRL{QMK_2Pz7x&&M|3$)h5PPDbXQxN7)4iK~{ieD~4BB9G09k7|idQ-as7|GA z6+W|`NW`vG)yd2^tD3VPx_zR;)}iyu=U|@+1Lh2BB~%vecgTW)=;L7TKZv;*zGP<` z57j9{*Oo%N4k&{&67(hmZ4iB zWq~whfh>A$)iZ1RsQ>i}-yDPg*X>A|*J5(ypc%L=WyvH)o}K{J9@Y2qC4dj#0lXmy zts8O#gNnJYStu3Rj!3*~<$2W>8XP65;(bAq0Ht4TNM_`UU**~q`^8R;*luiyDK=&P zzgGT%zsUX~wS|?#=)vO|Fr|Mz{i%X*oey`6=2eJDOqumFIBb96_&vCv=G$#&0kMzA zpRk^AZ0AwdB*Qm%SW9?F}M zfR5F6>2@iFjK*$Cc6Y%Hkx5tsB5Doq#(pSEMRo_5#O(h2s^9*3CjaMIQHifDs31j7 zkYcQbg+`=~v9c4pam@or@vVhPwOmZJ2@iBABar@THdT2-yx}k_Bhb}0^$o>p9f!e3 z$1}r>I`yGc&9@kk`*oW??!F0R$SV_@`JK>m@%UYFG+#gNjhhr?VIeJdi{2g}kgiJmsCoK`|75Ind zU74}ZutEJ?T;&Gk2B;~ZH9^ny#&yDarbT+Yl(-bJ@G<>eqEGSxb;bKXb%p#4$RYTj zxKiy}ptQ<}_6y0MlW9aL_eOV}I1a+0(mARL(mg9T<)e5w{+Ww{pe#L?o7U zs3Dan#Qvz^bsTGup4|cb5F*xKWHbTeC&!JFV@q$a9&R@4c+LB5gzVFVCb_q&!4ko7hzD-GLpuXYejULh~gRE5#~19D9qAYfr?o6NprLmUd<^<{nG!r?3~5PmS2{zR%9n=_%PQ z#L?|f?z1Sg0_*0?bHrJWXOqX}!Nh_Z>y~p*@Zctku%d5Mc29x*qRQ&+EB0#M=^G{-q�bvJ)g)h4JOpO z=;I6?ZfHn0P?#}xDBRV21A^Bi1UJ)RLgwj}{-I+^HhOA|=1?khBOoLs;WA@N80%m3 zK68{W`(s=vC#V^azRB&8^g#JDr7QpwFnBn@<~oa~Bqf+r_};NwTgUGUZmFIzHdhjZ z>Tkx+=c^?>m`3!h4OR*MQm6E?;CXu6`(uDydqJnmquI&yDaE7T%G@fjMnW+GM+pJsZ!O>=eXolFTgaGI3DH z-VGxFY>3BBQuu?f=^5qY9c<*}m`*?q{#?)9oD(r9fUMY4#U^Dk1^QL^@uO)mF6aqCLj@`%W9Cdp5b6>CyPWjCw5Fv1)G{Y{wIV zuVrFd_|?kqaInsxK35g)HFQ{6jFKvD;^YS-x%^E$8aG_c@};^2)-WCO+w>S5upTqt z?|BsZrSV30^zqI32?UoaD!m*}VU~i`c#`@DRdVB$Y;nCFF#@&X$ao?S!XHD$GDeMs ze7_A?!;q~nY=I(}=;LGISLJ7PCq{H6!c6ti@tnp~7&f9)u(hSoA1#Wmn8i8}a{dPH z2Nfuv^#ojfbcY@lEuL&dEfY6b$>*xvg-Zznfoi63MS2gX#HWngvpgo{C>Y_>4;Ix?Nl6N&qSLt2@KG{?Y9F661t(RTS6DA$f;gXFjF|gc zm71Q(-H`yQB>piA8(B2?J6SLC&opDEs?A)IxXe@rQ}T2*N8^q)nAG)BRG54+bAgA* z4T!+({NqC`P;zGc5A_RL^gh0RUtmPR*g+bYdmwQw)_Hgw>}EjOTk&$^S_?~}?l zOrXWanW5tu+2pJZ&=Yw)3~Ip)2~-`{lrQK8%n~$(A!5;xrUt|R#>v+O64!8JCK6%} zi!$NF4S*KQ1ao$ch4t-^0G)JMdy0Jrpw>3m?xUt=HR2fph^#S0&)_M|-5;P$xBus* ziXHlFMK5tH`sP@CjAP5B<$^UG`4;Uz2pUw++M72AGCO|#XP&{f`WFOhh`V=Ru+H>1 z-aS%w2X3-8x&*ev9-*FZRAzqK{M1(4=~TsX@ubM;MwKb+(AM)L$5KB44KV@@`9w9z{#o^!=C!sD3S!F* zw$Pugs-A!5SiNnXi>nRxtoKw9wi%<_@=BBvounL-g?x94`;RJyr74209=@amZsdhs zy;2nKY>!mSQ_b-reiVY(G)4s~IMS$j=6Y#PH5Mk+PnFEE^txS-39!;K=3OWolXSSv zvx0}{v%z+Z{rutr<(Iel-Yhsx@_qauyX_>T4Xk-B_c#x1HL7NV&v(;tdV zZ#`?)h`voOgL@tMvRCWFwfUbqhvS_Z+(`jj9txxbqda?tfrXBajEaN-So1(SFaaIk zGr*ds=au=AJoCFz?)6)P+a&IX%gdk8s%>noXs~Iq#b`mc!q7V_o$xk`DFrn z@Q@<8T+pd%PRY%AOSWcQD;R7_o2t)d=k3;bsW~pqxgyGiDul3upZb*i?wMY0A35cR z`WSzD0?HMI1`*${fPK~D<8rG9(yDtZeYI&?9fk0SV zyRp zBYRl4E?*azMzAVfk3Dkj*v28ZZhB+gXx3JftME6XUHl)kyuLvLRF3&nB-%mtw@J?&$%O0n4hN`gr3ATx#sbq)bGZ|vK0&%3YN^phSSY( z?|A-7!zSM1Jkh@;k5j)3i?%l# zxa9>Ta657jsbzY5vI*MjoEfPJl?U+`fml!qe#=9o_3h~*1==4$oCGNpLaYMFG=Fqi z#x+mN=BuB`ZX}QUoZDwQcqR`%+`5I)5l*A1mgoJ3 z7A!au#bDT5^D$mRr=O?gYOvM+JONwce-D}mM-Iqu1Q8+Zr}#1>Q7|^q8&eYWWL_6G z;1AGJ!O%bL<60-TB(Y{@SL}{_6B%t0Z4FqUmEl|o8y2k~C28i-D;|mZA5rWt|v^3e>DfC@UG# zEW!ycgg+s@m5Goe{z~*RgDTOpdymxgVh-EOWQ zvPF(E=LY^=`t_iPIcj5rQCM1CBr}3cYe=3U`nbMhgtvSzHp-haZx>gK*9c0dhv`CF zh1Qm&F2>P>Z za;m8&hZS8?hX;f`sS#lmri)I6;~eYHJGdJ5*GW!@qvdc)j$q(c``kS-;=`SYoI&jK$8mmLCv zNW`bwUchJ3VSEu^eW^>x9pOae0ePN?^1y4Rjf`+`qNnXw2o)4R0J&g=u?uA1bbcVO zN`H{+ZMC_IxjUHlP@@idKN4wjpvr;CN=gPZ{nc#_SDRqBtz?mN$_-ykMnft_TVyE_ z^vaJpf0Ux_|wYHAF_KY0$t5%h9=>@N;ch&5SG3o6+XwB{@5BHQ0LD+d62o z486fta^(<=5bVoxt~~;w+7`s-2^Pl48R&|;YREh%V9~)H@Fc>jhLyg!Cysd;KI@S* zUtx^i$?X|t7BdK4G^>7ZuLEn0{g&opYq&2qE9*|3zZwX3(1@ahkFra1kjT z5=;1tbYq-A0Jke+8&R&oOLIstQwucO{;su!{xhJZ#lyxoeZ@Ga)p^~I@4I7Ic%rh! zoDQ#v(!rJNUdQmeSWu31Ean+DcTjRp!4Vx+C94xUn*4w`0n?c8usWGHOP3AS_L*1> z1x_zE!MSC^?xE-E`~I4(+?*Sdvys(d^{*VM_?HJG=-6tkD0Cz-?E~I~NAa&O6VzoNQgbRVSA4AgDemSnN}nx4QE+C7uMn-Oe9%kl04vq(Vk6u-}f)l zdaFMj34c=_*j4a()%yDV;I;9)kqJeUQ9D|n#3`RXO}r9jVvT2<(H`m)oTGedahpF+ zD2w`^KRKfbrpw8{AV1aSi9od?rejpj9((oJZ*p53A~eED z>#4pIIkH^boY?|Zy}2$;Y>fz!BctDI5nD9P6gM6TQ*PIoi&uwCwf^!ALUG=9`6@y- zO!_ii4E?p`pBRk0vYn>jie*;RZ*E#PPCpQ-L;FPD(yUtDiKbER_BaK&s9;a6m_G>G z)os{5HXx>h;1v3LsCv_P>{)v3+fa=}Yw7V{+j(v@F@KQ?y3!injXKj-Q=aWQFz~IH zG+tK7&hbXRX;h!_%Q)X{xBGR`Yf`AyGdlFqw|(O%d5YGc1*+CrlpaXKLRGsRMg{&# z@rR;UIeLi$bSL*cQpiG8Rr0+{zwv>!$8s?K#1BFCjOX!@)g0(6E8~4-F<)z~*=_!QJ$q0_ z(LZoJBB1>${&A7E#hmP+{aGYuQj8hqB2~G7 zUa#=Xa#O1?S6+=oP?jP=UEeUB*vmP?vA-vGXLW&N^U<&qXVds0tJ8km;pIW`%9{+u zaeaNgDv%8(VNH%g`?#>v&m+!J7cZI#&XJf{wfBMSD({^A2g9!BCwNem<*{K$^B*2hhfkAP zozjBepQ_~FER+AVOgoB-d#J22k#&TZHcu?Dm*{T`e2y8e_#T|6nxM8+tvD^4@YaL_ z>Ja%7($>U4k}2k5RGkpSO^GM>rDj29gi@HKO&!H2a$(}&Dq@#hK<|`VD>PtBRNzg9 zSSaf)92yz1T7MNwvsA(tO)G4$k5gP;mgc&?>+N1yr-kO?`)R9d*iNV$zfw|mB80A6 zL`|zDgreXt(t>mQz(sz)*eMG^^#S!4&6YV7=2LbbOwCKGy@S6Z`AjF^>?YI`Sq6mdhxxlUL5l z_ST77?~23@k7}Ge^-PIOU=)Q%z%@CHk+}P4nDCbshGtS#%2KyNP6`sPEVRygsFn zyPvJ&`1(D2R->9 zdZ+E^)1Y*t<1fxEr{A1^>bxgpQONC?RHaifE{3F?lI+KcVtbe6D4eNCO1DpmgUjx< z9-Mr6LVh6rB5B<`6@C*>H_1O}>VP&pIX^<%ezQ|=txya8s0r=-oteK{7vT69m%II# z{`Hfu8P&-W_a(K>ELUFO@o&zp5%F?OqS>a}WUtZPj|Dih?|)9(n^PZt3?2P_iaeDJ zHqQ?PZ{r5uDD8QzZNYor`aEl=o5B-y-Q9|2l}x<9dDc!W8aB$+EjqZx!uljB^A`#0 zNRhJDuh4y;`h%?Fu2kOGq z@rYl|RYcEOtH{;+joTebNnmU_wHn8cq;8J4(dD9=1Ab-vTcR$zpBX$~NGqjcq_yF^ zU?Q=#K;m3|Z-zA3!1u0@Nsxam@tOHFRjr?vS6$=}4O`e~MY5dR-m_;=_!Mnnj^4VK zrwg(!NINp=XzkLkPRpzJUn@^h*RRn^A>T~X{uqN2P9lR1a=gt879dU$NfF9e^`#{+ zyYUaQ6bju04TQh@&M*_SqOC<-u_Qn|ty!;(TO;x2-hw~Ef=({9c*1=OBgyRBeJw&h z$xb{Gb);l&QC^&&o^RUwmhLtWf{4#`X&;&E0+{UNPT%u|XjOkaJ8qtwmJg=`5+FSZ z?+XMKFzW1 z+rn_0@l+TQ_ZLau?$hsk?8Sg5v``>{Lyy7U$x06O7yrZ}0U?V=_`wri!J!47Ei7q| zqXSHhyhK^mKh>6OFy*IjbMfV5iLz|)_mRuP-AI+nDHmaRP=N%=`^Tb1fcD7Wrq=%4 zd?Fzs&L9!b@k15y!C>2w49Jz1wulicjmvU2Zs?4Q?qKmar3mG*u$$$4jZsrxUR>ov zB9eMY z2M6Rzk=rDF)z-P&ghJ)!cGx2@K0K|AT5`_2!RQn<0p%ftQ<7PI2mbCg~Fk`no3U z>U!VqX=1i53PWRix~H?Exw`sgD!gN{+q4~OP~LVEcsiFZ>PH(C|2&)yYevi~yxqvo zU_vxQ-fdLj|LgYTdgSs3U>=S0+yX>lkW01%O*TsC%Z}Dx>L%jONqTYXKyX`6-mn-` zbaJ`k5ao38TUf+>$I*B173y%8vp3T#48KNm5Ah#`0(7+B)w@V0^8nJ$$*TwOg-qVb=}*Z^0zol__1qj6Yo-XD8j!Cc2;7Pb1g6 zndj%10WE`*`De)8H`_dpN%Y4gwpl1O%!u|4MS_XX=EO7X`?o&G*<4C(Op3rhda+Vk z3gUid!(>y}^r{i@Hra+sbRpl1#;|pHjlwtO#vkk#v)%Ec(FV(4lBiosj?aLwQj(_qIoaYp2OFnPh==IAk+M zGF{mBJ6Gu)4aSBKKJ#V12CQ4OvJzkpRYZ|DHzP<2S{&;5+ zO4F-#Wr25uez_L#qoj=BWJw|`q9d%^^^D@gaqr#-pXK7?E4udACqIo#l%VQmzRyZ= zZP56xjce{$6_84;z3Ew2KOK2FqLN*|Tn~&I+HfqHQjX#ySQ-YjdE2NZSMkv1%y(n+r-D{#A^^lbM*Db95o!8lT&CSUo4pgavi)uB6 zA$-wq+EM)LY-Z=HQxnimFW$;>{hE`ZVAm!oCk09B z{~M{^D=}|G?|YrL8XAH)Zko1+gx4>uCV@Velz;}2Q9K_JnU1Hoj-UD=EksqA$e$#8 z!c~!ogu}NhUhm9hyFY}5DKvG~wMe8zWv$1{IN5P05G{G|{(A_sQn`rCp~19-{! z9EB4SeaVfq4RHRv`o_aL_Ixy2wxff@iaopZgj1{LmGMJ%S(s(4mBX^|?mqZo}Cr+l=|o3lP$8$E;w&)^}r z=BIIYfq0B=V^b&=&(J~b6^CeM%@Zs7y4o-H(qDYaC{5v|M}6?PiCp48os|`vEap;0 zxsdcsM;xf8A8YZ~H%l9uMAI>t!ww`ud7ZR7^D)l4VbG%zCAakA!#vTuicNjfQUt!% z99xTBD%d$pPZzYM08Qa6ROEd>O*txGdX!BS^ZkI5*yZb7v0HeC5Sw9z9q~GGag&k> z`>P+Op&oHndIh>UPKzATIb4|Nb9Mg{?-*G zf?a6|9>1&7GYM>ri-Rib29Z&#Qc6_`2moebEj1d}Xr(l8s?PyJdWM9Iiu?@qUqI=9 zAv(weAX+*;Szc``Pnock!iEd2{`uX@SN}V^N0z4Z2XfC1TH@pQ98@_pLoi}9_R<|j zt`i@lxlbm<*f*3qhV!_;EyW1?SB`uiDtZX7zrrSny2!b^TnX+`OQ~rZ*yhts!|KHKZs+v7}!!%uBKj0(L-T9!+N9 zjrksXx!dWP3-|p+nyTXvaSXvKJaqV>deQGxvJ!n{WWufWE-N#ONDlmhPtrw%?2CwS z3C-?^$IIVjM_#NNe8ko5ou5K+l z%{6Dus$L6Y!P}oy&vedIzFK8j4X$X1ggv4F0fcDjY7hsbZ#b$u&_Qs=)ALh#=AITF z)PcGB2Eme~=I;K(?*dE-BaxeX%Y-Ax>V>Fvr|zjcg|4PM+Lba<=PrS(W}G^Ik#5N= zU;*)xC;mA!v1yzp%tc57#zyWOQx}(*ypxnTsC=0@1K}{9IZ5Gh zAwsS;sL-*^G+XHKEX8FB!pS5n5j_?j8y#JU&+CjCm>=t(%T1c%4|=G751ClHp6cdH zhyazmDAI0Z!&y=K7=6R*>SbRLCFS8#!gCvY6R&eIrLGk|?7_)LkCO-ru${Ui2D@d| zrkivud-8S+FcY*EOA`*PTnb7^NC@x_5)H}`6uv6E5#&~=3QLaST~oYqKedZRI9SgM z4mgIJWD<;zz>^`3h2vtrbas_Ar2#wDb2I6OEYqj1oJA&)9`rXyfuPN0NM#quIv{<2$B-~!@*6v=}@=ZUc5N*Yne zKmJH<)GAKR-LhfJH5A!7D^D61f4q%0M28jivZ1@_y=_d0!VB0omm-R7U^q=288y3* z&h97GPxm$BlRIp37;&)!GkWo?!2c*^m|S@k9WCwq&OxMgA?=o-4YW- zkolR&C=6v!jx}Ve?W<_ZTEl~YKrn)+Tq(pZ;a8K-xV-$VGlSVX;g|>`S2~Wcb|IZC zQqE4pTm3x~8o2*a3xY_VPLT687@pKDZSA6*y%P|Ek%ZA8FU1?QQ$M{ICMWjOoJi8{ zRx1prG%uEtlvrsYIQK^g|4iSZpgb!{8J^Tu)aU5?nOwq-2sDUjUKIn)kpN2`#7?9_i3fc4NM#@J8s+HW4sSV97C$9Yb&i9B>fs=b6 zVa66ZTCJuA34U=o0K?IthR5zjqepRe4NVU6#D2iRHS!NAvcZ%sq~p=4jjwSwHvTav zQKdh)tRRUmccr#sbSaQB-P<>Tk`PGkMg!ELun^47sNllXgv7&(QunfS=M}U1l18Hu zFe^-zbbgpS!k@sW)&mfFC%FqZd|76M1V)>ce>OgR3Ipoop)Ff05v!O5N_q_k(lI zTpT+7?pC$o0xBo>Q}%32ldj}ObpK2%w>PVA`UzvYpx!! zKCwXMWXZ1R<|6KV|G+a4Nv!QPqofKWbK4DN0H_TfEBNiTr`S_Em zlI4DGVyfgylm})yqQRpJc~D8iaE-r0fhFU*{pf$7LP*^w^k&yHbf)eS|HJ}p)bXu^ zn|mz;Z-mQTb)0QyU+!Yl8S+(+keU>}x1Y!Zou0zp0`0H9-1#&3CXucvaa24)vFjit z9FRbQyCw#0wa$T=pvjULdD_dZjI91KZh>AR(DjBiDm66^9KT;dy7Q+(iZPW0^H0pR@Dx;=n2gfT9SqN-wT0u4U7Pcoe1z|YD3{nQ z!eT?gU#z?9+7*Mx|02Du_Q-RrKo`!@IVoZD`swMtAt6lARQTh&CE*>~wKCB+!-Z<; zQt0wz-&J(f>cM1E{Z@`7e&0>2Pm;j3tlce5MDKG7@Ew>KO*fcCNyX?Xy05hMMwc=7 z8!}$ck2;w0^fZ`k!pw~Cq`ic7^@4XY(EV001_Fwt!&HMfhC;d>LVVx{)^m*w(88kX zg_AdwAGH;{Ir-?actD{V{ zEYJ=Ed19TcC+0m>gmltj6vNz^BNIYqS@^gm+{C>*DX5Wz%vQXSgLHg?{RpCoo|NF1 zbKU02Di`mEcLS_1rLk9reBjZU>fMu;&tTk#%c>QyhRo-QiRmT76l{tSf059EA?n|y zV8uYJiFn@!7H+ZJ`ea_06b2ad)VD9pn1C&sr71!%3jIH4!yG!f9Y*7H_OeK!+{8t= zLS}po-9o(EOVR=$$Um4G95mgtbIkcj`#IL1bcsus!_b5~HVd8=CB$it!=tjy+j!Gd zM>H{bQP}hWv!i4#TQy22F}=Nn+muZ;&WwVB+Tnul4bB6~f1_CwnKHi@kgdU0eW`or z%Ty7JJxLl-UHAd!WOi(%7^1;nKUqtJKh_QzZL!e5%uQbP=D|LxR+F;u?(Xj%P^Lq7?M5P%gk6}Br4gW8QJ$G$y&@XL$>To zG^A2w-^!9PB9yH}_ANpTjeY6+e0|=(>-za)t}%06&pGEl_qor#JRbLepy6t%l zgG1ny%(A6|t4$^!w+09+7)Z|yfUS>^r)!m7T5QtgYo~t?+?33Ct~EF_(*%#Zlt#!z zE%?mX#B7A!aKAX3xn$S1lo$eSeIi;E`JjJuKA}7&O%Dpnm!35dVF$~~ zNKpyF1&?MHo+hpEKXTd|X^8?q<(FAkK)1`wiw+iNW*0)adq;goCfx%3OrFO7jJi(? z#?10-Ce_57JS+@N-{HOcWN)E5(6$s7TI~}GMsGY8<>hBK&-5-jEszIkdThdxd##anIvWpx*b-_#97<$ zlN0|0m@qRt*kiU~BP|+a+(2cVMVb!>uvJZFZSZZSY=(lo@=4y@LMXnJx7S}4a4v#U znlv{<8u}4VD4b0`oKlFFD@8atFSt4}nnjWn3c&m6GY*(A?j+W8BQd`99! z4GN0#Ac|#N%Mc?G#dqPP%#tNXM(dewQA)5ge>OgN_+?@TbpeclX$}Nx2iU?gv|X+B z;ccs&%^)TkVVXLHsLJFhR(Pu9!WHufRuPqn?Qf0}72!-&+&2}aGMRObm*~Nbk-GLiD=UH% z4W2m{vIgifJe~OQv9*>=!mkE#RHI;=j}c$Pc%*AHAj)EysciNO^bOUi=mh0(6-;J_HK!ikO!n0zLa!`@}i z#`0weC8^8s!TVrM*lU#bk~P7Jq08BE-XuLoy6CM(N^2u{7$ZcK8^1tT4>~gt#)#EY z3O1XAhN$1Gid=n_=9i4SrQLi=iq|CJVq!qo^vFlz3yU$*R5N-Y3OOZ&Rn zF%x26&s6GWmY*4BY&GfnXlnK!LfiDGL+oQ;q_wa*B}6>WSPI>E;9vP=RhwJQZh)Cb*@g3~M@Sd%+G;`=jE?lV9MOc`65o7dqwga-rlcpkkXnH*&=fWA|aQayE>6|THRp7JNg>QzT+=KkHzNemcZ`e!b?n@+$)KBwP<2Gd>7(67<lJ(v} zA3kgH#W+5l;Wffw_oudY;MbT6Q2J(|!rAsew{gJ{XFF3|?N83E{K|lnUQ$V!=`*dj zKsaj-xypdBeq86i;JjhF{@WPhvqIdbak+Env^&<|`B!<{HYSq|NM5#E2qzG5^-IbL z7gj=Bu!Q$nIl|MU0r|DA8~d{LO-1_(Sgp4@=}XquSQ>38Y~2=KU$QIuDE?67+r5jm z4kz}>XkE;ROq56;`5Gb3vn4z|sY=E=+;P~F85jsMnGx=mZT@$s^$3f2UhjbT{`{$w z1H%V9Y1C|xTd!@s5l`&Z6AxXx^b01IgUsL&!ls*$OskzTq!PE&mxpm*Nt98oMjav(6G^06fWlq zfNl+2{<55qPv1X%Ve7@bWxLgAli=#n2*tR*(%&<0`#B_f@IUV7Y|K&K*iTnC~#4#z7i0-8iHUvBFV;9+8{V@8W)^%WDvMDrC|LJ<(q&oU886#CQbH|soroj;@vq)+L zK!7z8H0(}%qm-u?SjGf45(PqljGU77Cn|Ei(-Tx>g3?#A=OS+}#gY~yRH*Lj95y8Z zll&=3wwqeoCbH;nT1lAU*piiqe`A>mPeBjfopC7M?v)&FfOlHpLe^9td3t({yqkkbByWNf3JZy*mgT57Vo`J@S2L?!#H=Zw_clg*O6%Wb9~j?$f7xwZ|W5LvIawI zaPC2?70c3~=>g^4NZBSL_`0xJ&=J{2FuV)-+f;hTo*e98%mmCieyQc=d~k4ZB(|bS zcBLSFmo}iR4MoGx0nYeO`#?3`xO(@J%QdKxFY!T|D^&hyWpei~@Sx1rPr9R^%#HeFTn&lTP*|3k-@C1{1>{iU(Vl%@!Md; z#BHv&&~1~l{<44pozZrmAM`4}f2<`%nvTHw5B>@3IXr>>dI&~$4|Zl|Dej6EBonn| zqrkuN?PKTd4KAO>GS7vkzcD5`$diF_!Gs6=WlN*(-&oq^)sTpMRJ&@t z8ZlHkb0u z);J z^RR6n+$t|@xgQ(L6n>D*Eax3&>K%bK@Q%&0v`Q@{`YwY81(^x^iUf=Y{kf+Uq8iY-Dd*f+jJE7BMR~f9nf5I#D5@6%3(BDpH z&SEzv!1RjRCf%a^lf`m<(9PDu1yYt`@C&o9Pt=)IJ6>KS#MPtYo1o*J9eBy8OW=0X zx+;6yJH@90{)a-nUq}0NGrD5z>7>RMk773W)j4++iRbS(Zt{9q6rjm{9cTWy+1H&8 z!j7B2|H~5XTqK!Zs^OlnZG_si+&hB`CzfoQnbuuc3p6+y*oREqU$Va}Kq3``Z8wX6 zbV_H~YH-B81?&8CWqZTfWt3S{D2>8YK=UYq^fvVh-5hD5+eRP9Z(sH<`S$(XQ9hrK zXv+OL$!E@ucB;jyN-ibMvncXa_KZac>cy)k6Rk|t729eiC9;s}IB$ALW4_g|P1hwZ+q}(ut-kZJ7RJ<%C~pf(8a^@DlCo^C89QS$^(g63kfH6v z-J{&hu|T5E;N#KKq@{c#y+TkFB;_I_8av2nl+l-IIr+TVAa&AUXXOJ~58i&wkvskU z3P$t6h2X+gtcW34-qDW88VE%~!i zvYi3?=_Jx(aD+9}`*JB4L=y^j zRo3IZ_`pY*CGnjNP;7(qAwbq=Jy%>n?x|iY z+p4)Uxu^ePO8dBdV7U*z-h&>B;m_T@r2euLr6#oK`C3^SRVp@^o)>(* z<!0O)x>*;QKk78a)ruA%8k6%jQ2UbKYYFY{M%7Nyz94w7Hsk8sV`^r&rA5g|1MBS_zZHIR005=fyAN=sw`Q`D+&Z@t710uThZQ zM5KN=Tmj2s8G18IM8Uz$8ga*zVHm6s!G>!FW9S3QT4+#K7Fw*TGrGT%dhnu`kzD(! zXH!k{r^kTki5}IdzbqH+bl4xDa=d`CU6fq-UKkaO(8V7g9l~EoriPk-fvost`=cW5 z>18F7L&VG_<1|<4wGim{)sQRjIiaR_K8qWB1&Sz%ezQm616-eWL~A?-_9a$tZE!@K zoObMI9I_|TJ6_=N4;&KR^WlMJY>dwe*R7)32boQ`(KI?Qy|)*JOziwg01>+(wUaS= z)ajP55`kl0Y)_E6&yTrp%p1NdpI_m?=$OS2-=aRfb6Sd-^nUv_S+7j{K3KE2m%TT6 z<$kEjaU3O^chRx`<$TnT#p|PjBWR@H+24atll-}}#vo;CY6&Gvq}oQLbnUxB_57dT zpCdIJH${1>XE~2dW{waHwnr;y+AvdF;l_rR0xN&Q%u)#4GDqPIf0SzuqzQ@<>u5C9 zwXUBJqOo=_ZfcG_YF1HFWRFpy#1O|ZFlYYDJQq_`&;%!Lc8JHt=<`In7^x_)NlPn8 zar(`WzKD%iJ-?NgAHR(8=VKr>M(ETqEu|K)1f*^1{vjf~9{fC* z5lGXSn$#fhDaE8|``g}&jxV5V@j@00=U4D}O$RBnBMxD~aaFM$)!T+ZgN7t8= zld1SP^0F}+dZ!Nj-cf5yu-hbjCvdXw+xY$Tq^;{~qo2vg^*r@;i_$GLj&G+Ie&0!a z?G+|{#M9@xyuWVnoA*(@oat0^<)yfFmut(U>B;;sey@R+bLqRDK^ie1*Zmh}t?Wey z`5d@u_$3=iMXl~8H}{RN%w~lSWt3a6JCbH)&ghi;|Tqd z-2ugmO^+iD*|X4Y**OR;-<*_F^o7>@*bq3ahqfv~=n=ntF(wAFsU1c~{wTQY{G4nm zYd6LTc^qtcxijQF9B#$v{3y(p@?N6~c^3JX1yA(*wdB~XdSJGz0U79ShYk%IzULY|m;rY+c|`ay!#+%>cAlTvkOO6N&Du@RsaY3g_hQY35MaoN~3MG@?XxUWCJdM zGoF3Hka{(C|Jv8N>w7>zF$itI{jiVQgS5zL=8hv6D$z)RL`KwlEJlp17!S&t1BJQa z5T&MFa*CW5P~N0R^<Lflb|zi zlY1VhpL^`;g9!}Q?VtKRF!lZjq!*7xD6>P*pya#i&IAYsCN?~aZSU9A>O zn_>F?`IE%@##6(-bvcH;)3e!Jkm%D~k_QOI@p_dLx`4kIs~T{x^{zy7lXS%bAJgxC z=y^@cy0hH1^!Iwbp6{nn1xF%C%6HjDcHtY?=A|R|#1<^k94x!^m*sZC=*A2%hvLT} z`Nd2RS=#27DP-MZ2xP`ahw)SJWj^pIsnDdw^LqD4DpkI{&xJKZ={OxOqT(;ilynO& z+IE_eG4de9k~(uI2F+oN>;-_n+>iXVTEU&p?M><>XOwVDrLFv!bXhhj1I&A}0=vyr=pRl5*z$*C#HJ*6+sRZ-ut5Kl{uZ#ZcoQf~F1W zJ0eOYPjsV)TGk)sI%>B(A^=>&G~djR@aG7SwRN!LM)?aH7_xpoM>>b#ilz^#nA%l5 z{Gzyn8dlQ+TsJ@Kh_)6?K0)VwEAcPOz#6?B1L;yMl{5+xNX|w(-5s|@;He0zxCmaZ zih#!>rZ?KYAT>lBA676njJ0ozrVzbAOr?;H@)dM7FF?o65NrXYVj|Oi`CN z-#DrG#JeY(dHomNT@~H=8H-}^q?Jq)K zqj_%5Eu(F)sMLc?Q5@0MCXSUE2u4tlobRVek>so;yIF27Mt@^39nz8IIZ(-1U3Cd= z2zfHH&gQQxiOPO2+z=?eI0I6I+q%|tbmPN;NK$=7e~I{#b+7H>=<`mih>cehwijdr zrP(t2eo=n^I_?mUeY4Sz={)T?P~MxbrMj~*MkaG)8)%j!@tmldv1 zWI209YlZ`hgkNa8$e2m&EGAoFLJbacrY{TU9XA!k8HjKW27uf^k#TJVC?wlPpo20O_WVr*+3wSkX=jtj^0DE_O^W9e zWIEYhaJ%>RqoyU_Bkq0w@(F;uotkS-MTqIK-KSY`FQUkIU&t!HTSVfZhBI!1)(8eKdO)N|FttEqApzAmw?9XU+H zn9-ApP%;hNqI#<@I@vcUS!mlb_@ac6SdF^>lZ$ z4rS1=4877dWnBBI^Jv6ec8DSGzIatmt6#!);3&IQ@?QSW zuBd4tude%E#B+-M$^E8QDwz_AVxO{9NR%vzCs12Yn^OVmt}Sd8yPpEJ*cvgbCy(ff z2FLiWbIS^)nVqHWu$TJ-e_5U{kg@D#x(}&d2l=mCccsLPe&nyTx@O$a55tW3yB2O>A$b@#mTA~zAvd@@!grfsb`QM&S7s2?Nd;`>P| zCA*G0ITqc%h-u0@nNAMGq48yIZbt5R8rnniIzFZ$=1QslzMZ~-fxL3^1``uuTrJFH zWJ$et@?GwoisNbByD&HY5e@AYZFtOImZ0m@U+1^wUe8V2#*Ad#Y&iPpxgaFCf z2>P#3YD63-jz`(ND5j8c?{yja=h~*OdkMGR(;aPO?H(hl`nVTG-mW06ND4h!d$Ine zYU8YQN!RF}a9RDXdgiMG8MLG{=$bEl&I7cB<>UmSiIY#_kTk3y&FNIVSf$MHwf`$u zYwuOeWc<8cQPBuEjxb@xBPv7cno-i-h!4M`M?b2Gs3~0Ac43Z((juh`tx;?kkZs_aJY93K=RZ8$7JW<{nZGrW z$iCb+vUq2-G+-wt;K<4}O+P`UTlOyt$isUg2Xr} zE{%iO)Plm{`6r%cQ@_`-6cnIvLV%yqi~Q^xGdq%V3}AEnoc+Cd%~Lq*zmT*q-?e!H zZ3Bblg4L#NU^TbFKt^|?l;-SAz=M^rNF*FcVEANIY*u6-)!D&2>Y^Zxmgf4Y6tBN5 zBAI(G*Xyp21;uf%gD;L1!k?GV-%a<6b%O!ro4i;W@5|nS)pvp~sb}jJS4Ju;OL4Wi zm2Q1`eEz)OPu26b0~*cFVdbH8-Y@ZVh)jM9!!GY+waCo=BktN7^$S2WAenXmw8Wbn z?p5-6iyh_mngadwkBg||Z7mUcsWCM_X?bv~g9jCBjC{FeK*l#A_(TrhsghpLy)n5E zbC}y5lyKCydv~}ow|N4-vg$PSM4m7`%W1Iw6c7h*t-`o!t=80&=hf5N#hkLO;}25D zQ-2q66*5SurWo4#ES z_|~9(RWf$lw@_zF0bLfVV6mNkOIr}CPoJq3OYG>Oo(bw%Kn4J)BeO%UJTk_8-lxD- z?f#j7PF-eb!^F8WhH9pM>!$Us<@SZd5u>kaUg^VYVw5;0&*p zNtn9gdQH;zc7H1y`;=gqeIpg+h7V4zDdUDjp^@3?*)!4IgN&%3*iWq^3J0FXbL(u0 zykhrFAL(I<0RBp*`GF4o^LG6oRX)78K25s=@D;=Zr*@7gPXUUEtig=WP22c66td_h zNVT9imBZ+L4SoFXcrJmDS8yC-3xy%iw@&|*qk1a`A}$ftc~p7D=;TWxV5K=>-#r@b z^Ptf}#zO3>2;bnPe~|NQy<=Owst2-cev)c?Lg!uQ#NI%YfVihn!}~@nYXug_(y~WV z{jU{zZbQ$~rB=xk@6Nb+mYm%wvX+(#-6{5|^1gR@vsB^C^vmkQf0iFum7)|*&!GoS zF4|)y<;>1G6I_YC$UA+r zmCwIqr7sh&hlckBi)Z42as~G~d*r6J9%lc;_|Kb-W2xE4zs|w6B^9ut|0oslvLaiR{49GsW_}(=oY;u_9nH%djnx1l zPR39K2H2ypg1myf*|wj!!SuiY4Q`!38M1yws!v{4e5;?Bs)~5w_gq^j@>xT2^OcY) zRU`t{*~;X7%ISk2$n!P@e`twi+}s^I62ZF?`fVn;(F}zPL+qus2(VI@RSx158Mlq* zs@od5Yf@ZcPE)9?@V-@I|FWyx(vlCrO z9CDDoBY-h^8&=aPk!Hw+@6HZ8UHx{8rLt7Esl zk?#1kM*78PrhT}b1q99R6>aB>r1Ns9G$i}VeVmu_eL+WBvvW}zsz+X0*@&fFtOzI- za6!`m#O})Z2FG3-yY=-zzvi4H=u{{}`^I+OnQ5G3_t+?dY9A$mlJHJFII~$6wNVDZ zR;Z%yv?I$mgJBTT%O=IV+ForifU*8|iHt*u%($Xqa3s?C4p|PdOt6lIeD2=jUk{I5 z<-}^eYHq+KfY~ErllopY+%wwYeU?Y@REb6>c$;jKk?ofgxKpm4{zpv}sS}LkMT#+o zAp;|HMY&6moK#vOQ?9AB(T&=~{u_KbB$eCk%sWJ-WAzSDDHKdEu6F3MR=clk8PdAz z9iQ?xJS%VSEXrlbXOFhuk%(BHsO#)}g!j-AV9E`~(<*A)oII?ofj)X;QOel&ee6vCFH{dIf}T?^DdHT$fp0e46XC^W<|{vrMlOuQj3)UUt-k zlOmDGQdvhJWS9?Vu*_>&V>3U)YX&=9$7z90I&s z?@QycLz}RP{LjZ`ao)bAAr$I2-BB*RXB}FciVo(!5?)LoLx#51Io^k}o4si4ccE&_K#u5~od1B)-|!9nuJQ@8te+iQsDF>O304 z;n*oG@4)&Mm=(oS8Ts*}{3);_-aST6D@a)mhlJuetXy-GJ@~8wx(pp**J9&>{6EKk zC%qT$c24eZkp6HSIdiLnbI@}-7pmznw%sK*rk}(Vp zw&9Q612UTnTW^FNB-Rf8vNR5-a_7wnd^sU18mMy;qKBe1HiA?9h?CwDFN`hX^RD#| zn@P~_jLrU<&Vgwqp71GV$VtDrf{t+3cl5S?gxM@4(x8Ik!3wx4K&)viCXTy3)_wf1KF8M;Y7lucB=*JU` z;%$+@tZs|-R!P0FU0yqV-Ke@J`LE5V$Dh63Xuqdf%j|mzgp4JU1*y!-@4o4520dQ< zNgdvYk%)3Im_0{uh<*CBjpdyRpuX*n9_X);sFbJ_X3s)_!Aj_F_gZ)0qTfo9ZAYW6 zmHm6YG(NG|6HSOOdzW1l6Tney@ya7h0m43bJoJPpF6VStawFVOevS@{nu|q02m`Y_ zR##^P^tFhdqJ7XgIoQ%p^mHH7J`?ASY;`6r1nq=!y=6_L9Q0Kom=5FP^FKmPO>#Gu z@u)NuB~<-roseQ(SA3Q6IY8r#c0!^g_3h4ck&^m5*M!tOHCK|0ODtb3DfFMny&6IL zVerzjZSKkjS+aJZYV7!Q*CF_rU2Wk#=4;L-A692o#*oFwdHaTjX>0O$Q6|+asz4#E zvJoH(!Q&Z{OovArAAh){+^NlCG@01!U+SkT@M^Zt8<~J|GAJ>o6;p1H{%jp$9M-(Q z#D0NvNfi9MYFc@aG>xA3kQ8hPK(Fz$QxZO)(N?R5R(cQ@wC!}_WfPE{aJ8Zn*{0F; zX;L)RscNaAc*rDvq0s5P2?)AfrjE>wQ$dM z^TWuY%ST?oN?XDtW;V(Y-$SkW(huX1G3XnDVAFUUW31 zD0Tl^c4Lb}SIxOpSo;s_{ZZLjJ84{yF3>SUH%bfqa*Q^ z+#y_P62cHBF-ZWng0%aHSN^3e(MytK>dO)CRM=2Rmu=@3(%) zl-}%Un}q!7-NEO5`BW(efYtMy+ddG$dGhLW<`oP<8dj_Uva1Q9E5&d|W9dDv>s-tx zlpP~UEqdNz5e7C9VD=URHqX@>+e@c)x6}F?VU|Qw2*ygTMv9CM7TeVoJ!H{Y{N=FZ z+7OKCPWbR(4HtB%Zu9%mEYa_iDxaTNnA}csVr(3RlR)@b`30#p3d?7mMi2FX{DXDE zP9L9h3Wil|#wh->N$JW2FiJ3i{+f(yHFBkuz-GWZ1Lr>$adO1;FN@1|=hn)$ZZy*p z4xuYY&~Im1aHfb-)zlL}dQkkPzxs>YvjjA)?_qq!24UoZ4RZ0c;a%G5y{EGk6`h4k zc9Sh4KrumqwV(7nM*F&r4RHKZo!zVn{lG*_H&l6%2=*u>Lh*YHWEOE^|9I**_dq+O z%6UB{O4z{9>SB&^M~N#0Z7W3MH2A7EV@ipdCU_!8Fd8!fX_b9u)|!q$_+_(=&ls0e z*aUy5NlvUD7C4kO9P*7PAaSTfb;w2YyZg}~8q&;8+f!68*gmy^Zh_HdL zsPu{It;!$Sid^TKJT;*BcTj)P05a(V8Bvz_MIb=*ba2>oJAT10dfvvW^7})L_@r~; z?i=FnHb9P!L5hvh6{dXy$x-p{*q%0bIXP3P1*DRls6xcixP=CgJFLgebG>!(qjxJ9 zpW}C&yD!f13oPcju+91-R5b`cGzEnVIUD2T4J*d*ub^BVANJ&EI|6?$HbM?g#@blb z$~|2~_#KNincNDwMta`=v8tnF$p+XyB?LD|O;{Aq#acNn1ejKXx}?{)@Cn^sIyqJiap$Z2h-xlpb^@1BlCvMb1SF>WhiAe}e9{SOML-+iTXqzB zO`U#VAIdDXSD8n*q2k0kV@WX;)x#u8u`8MeBjUt4IUy!8l2YmO1j=kCsBo~Tll9f= z@rnKI$I=Y^3^zD6WsTtpux}liY*WlG;w#q;xY)>Ao3G3)`j7ONPz~OmhOK5Nt{*xB z+^J;>w0Tdz#0t`}wo`D1i#R>uxX)Us0Cm~x-{tRgRk57N%2(a82YPFg-E&>L5v&{t8Tt5)KtfZ+w9-`SX&I{GF*}_ zTu|^d|5o1oA#bn=OugqI88Ra$^ZF!I5ddj~{hrHMk$S z24@{&b~V-GQ{piIbs|Pf4#H?@4!7uran|X!LW?cRV;fTM`Xp*VLZ>dk^{+kt?I~~V z=@r?9tviUd%`cTSPq}g-ML$A#Oo;7`)3SIkaKCP3Agjn26Vy7b|4Qd)EcZX5>1k1b zzuqJakcoIx@TAjQbgyOK79gpM+T+VL+l4knzYlEvrI=kU`2NpdmNrOm1Sark7yUjY;?;}E z;V%)VN;XUO!BsZ75n^PedEvh-?ZJED95%x+QocSF?~3gmu9hcb9%eu`lu?mgk_S^$ z->J*;=F4`}zbs0SMs;E02$S~^{X12!IiZsyy;3$ee?T8a_q*h0Zsw;UT6}RCq z8^NgScwjqJF={J){o6JbHf1}Ep%kJGDbBmrdiX8SVd_9NVqEw&(+kda8~n+q3VlDw z@67e9r^^pXYJWgLSDysUsrJbJl$!rKSKuqI16_AU8_!Wk>ufnY-|47-MFd+~5&<{o z2A%htauCA93iGXdN40!xYw5V4u_wP`W3mZV@XVO|^f*3M9uwdA3yNP7VS~{wUsk{4 zIFzS6uGr zQv}}vwt&;jQ+`#L=(-MovfD9~&rR%`62X56OB6fQ=2MOGL?}8wtk+=k_xw;fuFh#9 zD#C5GCy?u8RhHozQ*&var#b~CYw}r+bLLJ<_R;13CQyVj6QKsB6FaQXyn|I0q%=}p zF;SPbdq53RReh-j7Z@PK|Lc%Lx6EKF_K?ebVX-=B=h%jI%?~=RO?5}Feqjnq61;J$ z32%MQCpl2N7GvAG{JI54Y?ZPbuE+3-YLL!_U{way6JnU*JmiC9{=Y2BnDlUR-pe>e z{pg;#6$g@sO(_3h>E=eCus|iYgIG}`hm%8rYzio@IJt5Og9FmG&s=zj?mH%|ncI-r zywNosgb-Pi(UTA;6aem}q8d6@=*$HaF3krBxS9l1ZVPzTbOn>3AS~{Z0#=oIZiT4e zXZG;T{b&)+FQ@4H8e3ghhPEsixYBWjN;WaJGUSkxM3AkF)@^t@t!)rWmnw*e88-|g zqTihx>rh^f>09+2{4;t~9;6}M-o~M`5#*vs`lyb%gSpImQBO@(k>>Se?zG~m`>FgA zZR8?Ij4}?FtoJKzg40L(_N}%)@yTnGsu8pQ#&UhkkK}0^23q7Z0l<>0RkXEr1l!i8 zMv@gNPMuK&_|&)gWn~|u*c~&F_K;X0wvRzL^b|-8$q|ZEE5T-Wjr8xrM>pI2VgkKT=+DFamt{KRXNraB2sqK6Ox}7T zbU8^ddY}7^AGA-=1E}kT9>iVe1D*;>KSQEZze zz-L0!zD=IL-#v!}hLni01@w}k6cAFUdw&IH4un87e<#`;N3kw&gRr#3vzaoMM22R2 zaAnKMIjJ8$2J_v`2CwXF)lQ_GZ0iGsx!#Yl15S8I4m|dSdG)i2{&4*Jx~w*{n5;|# zoolh9yQdHriM$B*pBUJEhd=uxE5A4DMdAKbb4sKWdy58o?@p_RcM(ZQL9O=$P0@7?*zJ=V*tUl8%UM)Pj$n) zyp}netNXdBMTP7EyLkiJjZy=^YQDv<7%ZOLT(iRC>dn%Z4O-h3sHR;(QHZfSX%mWx zKZ&QW5bU_7RsQTIG5<|{YLtbB{M3$NROAY8nBYZ5mEwHbB>dXoboNEJnIy{)oTCm< z!FVM40#Z?VkwltaR|~T{*AAJCx>H-m&3$hlNYh7t2J8%wzKkVyQp=ftV#U66&`lR7 zudK-njaYRi{qrhnSb$iPo93e|#jDsg>w}pOo|RMdRq}O_S%;c@S2`uvtBj*Tve29m zq9B6()sO-tv-^BE=a*=JuC|rK^NUmOO(yoT)8hdwf-Q!$sygjc?!P8RYF#cM%(l8} zLcW7xX7#?N1C@M&aUo|Hxb9|NG7NZ<>oXvr2L`i6M4M)9ui=)^Qn10jy|@iH^v6lsp>)~Pyf=_k z(@L!?k7ZuQL>o#^G$*_n5#lE#iF2v&v<`q?>+biOD;jo1*N^Lut$7zz5OYS+x3C^j z|NTHdC5s|%W zbuo4bRqdB2D*GEhn@;(kxI^!x2^q>v`+scnAxD#@;MeTfsZpK(oO4voQ-20P zJq!l2_0**mJ-EEWjPnp;!87*JT&Z#*D2XIE- zCEC3Z%bMdrF2)_2g&D4+&-I9=x`cA6-_URa;o{lEQh*s`;SeBGRzPSVv>V8b5Xw2h zeP=snHr#qsyVPyk*?56#UnqMd8Zx>HaFPjOl8){B#nhwnqRRpm#Gc%TyX}?SJUXn1 zXAhfCt*CWX^9pKSPV%h{jVHy;dfI~hP7+6Mld1*FBsw-w?2vqbnNx*O1|a9a&m#aN z^^NI(v%ET8XhK?pVzV%D^=7x|2w%>xkgAz&q1MKuXN4W-vGk8^W)Ivp)jYLOoxaL_ z?;pCc*Q4I$rtH*J(Ev;>F!28yJtP}2X+)rSO#c7=2apOO@F!y5608ZQYYdl^kJ$9c zgio!qdq-|=Vk=-{-7E1crytev9>@#-?uC)FP+1)Uc|hj1^M?lAEFh$4+T5kO>0Hgl zNp{NPF!v}MB!cTw%i9$qqRQRiiZMU*@$D+}Uu$YLQw=i(m5qnb;=t$!tCdu6Z63q{U>j!rH;MnPOcqgnN_RZc zzEQZ-8q+@&rPQQ)E#b}A7y8s?9L|gM zaU$!8dPO4^X=&+@;P$^qN=HGAqO4C?IWB0$>|`z5b+ zKX5D&;fr)YN0hO)w{6=cB@>mZR(3^d7G)|*R_W!XUfY;;#>q=5nB z|Nk)qf)WaWN{N2o6m|T56pMk>1POTz_>O;3m#*YLMV^8M?Q-_AubYVF!YXp&!qnKD zpMT@|S^nu}`G|hA*svsARi-lD89^}zE?o<5{&H$VtQvTD4pkYYM9)n5weu9uKAjZ> zk^`RsmEMe{3=!VB7_&F`sw*}~>!&oghuH{q<#UM7LneA3myx4t4e|%{9SQyKnQVX=e?f2!18-X&hP!vqPxJVdQ$H|f;zd8G&h}1@Wc1cJ=bt;| z6x867#GawA^F!QDdHzg-&otKt?nbf+tIj-DCk>c}a-6FQ%hm7L^b-UOP}I0m2ILcP zTp8s{QOlIDfIR-wOg1v`NzC_ONO20~vH2OKSd=U)SWvjHCXBAT5!>GrCiabn!>({x zhZ?=~_48KgE^l=H6%z!VI(-m{wo30$8GsW9Yx>U6db_b3eXPCT0Y5}9)kGum?Ozrf z8&i4ZCJPZ77>ZccE;S#|>W?b5wzFXTTWH$7z_`7a9#1_JKHOCtTJ3tlV8D26{)$os zm#Yw>exxqW_RW*@z@x`p(hUnE?-TM2In4ZgZ!>V7Xb-ChK1vo2Fr&|E%4CHi6t-_O z#nW(RC!y!Dn{rXXc4QO-W62hRyx?1TD+K|mIP{=Zvd5rg)w*Jt7l}wtcfzsZa6E=6 z^)VAj0+>yQpa$$?CX*~NO9a6qnw3;%o>5xewl;iea7N2d=UGANhlO(E;;GT#OGtOeZA%wS`hM0^`7t)uR zqI9eVME% z!UG+)Za|;j#nxEg0%hag$=7XW*Wuf&jqTEaE(8F5pRZUxCn7HL(PiBiG+QTb(8M1h z{uzLPFa7lisEsq{tPHhM|8DX5AUX{rdkJU0iH7zvcczU<^67Kd`k!U8vJUJ=#Hwn< z<1J_e+Jj;!RNl?lj*7>2+YJI*Ad{^hwV>x}GF|-Lct_$h>13u3VlDmD8NJA29u0!E%O-)TWgvw6hz1xf) z5;1@7ODq?Ch)1h}h&V~sL!{xWWAdZ9I7I~f{*@X1;!dVy@1X`EBS^|&fT2>eZC{j7X}KejuuVf1}1YCQyY z@7i0&ZBT1Pwz&yuc*CEz9@0t!EWD88xBy+8Y|xix#sKDv_K3C-D-Zw-T{O1cUL&3| z_uySg*YI%XgRb3nKGM^*5V7fN^^b9_tR3>_O{h-q)M-V5`KXATyb6t?)yo66q4A*L z_Y0u^)H4T(v>RL^q~UPIkpIcC_`EN$b$uHe)ll>v5+K=lP+;EP~5 zJ?7r{!ls=c%Bip6bL%DX#gE(5zA3P8zv3)1zXDxBK1G$p-o&a18omDO-fWA)R}s@r1UKu?djB&Dczvr ztL=2v1b?clOQmq{Ek609Pzb!A;Rn9#uQ>?4{UtonPg(9|I?=8$t?<9~2X-4&p2yE5 zKJH#&nzaS+VSt+nNhaH*68N$)*i3en{guphAmbyj7~9DX#kF}r3QDWzd>;Fww5z#Xk~!U0{~>s7uUq)D5P;vrbjNtE=A zOuDrzQKqnp3ePgT(5?`-j0@Mt-TAi4SH~}KwZY{sPOY7E#(MeAdrp)8N7Gw}Mb&-p z!+^xlDJ?ma3?(fk-5?+cQqmzv!_d+oodZZnqarQcLxZ#uLk!(8bmM!T&-eG9>-@tt z>{xrRv-jG2t##jhAh5=w_Sd0XHAt#`aGA1nl}B^IWtYe3BM}GP?oQ!E762{)0;DM6 z1Ue$A^JsE7GL~P&#c>Izs0O?1zRmj zp2FSYYfJz9;xEApi8EXK57FcjOx7(eoEONS)zslp}d$v>PK2lh_F_cUspeOWv z`J#n7Ppl9f97Gg;2tVt6^?-#>Bp6OT|2J1s+=iY-Fp92%S-@VAybo9g*jaW;C_naC z*-X1FJGiMA#^O_GG?kD7a3QWb_@Q0322@2%MON$F=i*5m`N`;=NhwCa)9y~+*CbLvx zRWP#cty~{(rWEx9_N_?3k?1e_^y(-k<)M3e^s1Cwd~PA_p73*K4-dugv*jP@U%s!Z zXAJ8As#n708NsE#ihdK#-0R$8u2&&_(sJuekwBogGC%X~^l$&4M#ji^Zlt)TovV4H3o1AKJvr%x6gjFBcz-64!Tpf=55CAZF zibSj_Fvup~{@dS-3ZWV6v_qrS%^?O=+FA_j0d`NKir@Q1RfwL&-e;aPPK^{6myVko@BspgHqbQ~ z6%~HBq^SDu6Ltmm&ve?d--hF?sQdrJ{{Uv1KH5VfMW60qv2`CLEXAg`lMya&<*Y7e zW%A@k(Pe_mnCd7&4dCJlj1gxbpIYW62{&OmE`^B_tJ#p;bHz3LaW30e&jBM{WC<-H zrvp~op0twRBDgSUxt+DQ-`uoW3zw@#xxp^i6ULW`gVQ${?Lf#>)5p)IZ{*UNw7Zr+ zasg8%0zmJyFmS2W)}EVqe2Ivv+}cxHFx%PxG9w&?o+yg1$mM~~TvOmUho`AMBmCnh z)qs2TiIAM_hWnh|^C$_6Tno#v4UX#*-B=365u0uS`zmv6ki34MFCeMgy&Lhst*PkQtCDyvXI8KY-tn0GA93-f1FTfpN6O+V9@^hT_s}<{7K#lHlOr`V1&ed zq_1(|$veCkesoU5)*pSx=L;v)VOEe?iq65m3lv& z8+=zXv%sL23-#QL(%fiPtb9_8@qw2PnM9oP6@(_z%26+$y`mhFSdLNk?AxCP5?Oj% z(6kMq&uVf-Z>p=cyxk-1JNwF}<6O;W`}#i3?%z3}2bVIJQzfD_^h?3pKeQ0c<9)M1 zk|9E|Z?mx#O@A$Z5_BZ-XN%CF>3tcA;lEp zqgaLAH=uk;v8pUF&s5201h<`F>mT47c~ko9`I}4YnoEI~pXf^QktaFjsXzuXUBAot z{&n-mb`rObFLw{67MGSDuW6f^`F;j}IZa>lPlhwhEs&snq7^Xx_?tE+=|Gi`wN-9b z;l+cOvF0om20iU@!ea8XPO0ntj<&Ye?90YD^jqnU=q{ba#1@|;M=u((bv(DQj35k_ z!nEoMheq0M6Y3q>xxV)p^Uf#e%FjCy4FnABeaQt`0}bF^R+SqcyBJ^g#45NiQPaSSLE5xv_~mIx9Q3T) z)4VOG@X^-mIoj%#UH$6@e7=N45Xt*zTnFo}zt%lPxx=gCz9-B)am!umO~m=6ruTt1 zy);PGX=ShL(uPl@YPUa?tIX$S5X-#SXPXvWR=JU*kdm>+U0Pv9RQ-*{xJLRbJ)Ym+ z8KVuo4S9VlNLT1^uVgKgTQ%W&%Y|k>|FhZP>ep^KJ2i{GixsU+UnBlbmX3qpkj|4T zdU3Saqm-|o?_5xvk5c_EcS{oKWwFW^{~ik|^@C*8J%0f$sG;0PylZZ$w7&RW6kfV*A;&LS+}<83_PXZxe8y+=H2JN@;ky;Q1^&XY3!DZj=z*|(9@=%Ps4g{^v-SW;S&EeXMUWFvta&;B#=1ONc-yB zpQ)r_g_ydtby_uEiK@tC5m5_TzcGFtYR@^%p&~dTiqG zHLq%o#SuYi!J=Qz2#10YkqNpW9df>a__uwlimxI*4yu{hW~vYix;3eGwsoE6NmIy!#Gq zH9>)^?bR0R$_~o$uY73Acw(1$-lE=kVfE`bnugA%YbXhcYJdhI^Q|%o-oim}$qys+ z7-(C$MpxyZ>0)T1K{9bzdiZN5^nn_sV7u4H`-n~PBL#@^%tyI@XcdY89NFYA>G&{% z3hPMhxMYwiy6G{tL#x@<)sH~1D+MrmZw!ArDrZ23oGRvg;n<#prpXtk?s8yn4~jRh z+(Xxp-^tJmsy4KVF4)y=k%eQ$V(KI*FE+aEym3r~TkKX?Ch+6eAI@MBb%gHniCD%`U&QpKfV)itu448rvvSWMr0VzWbM zlJyNBH(gwILVniE3*d*-o>$C+U(5OlpIk~hl1#sv?BcBOx904hWnB-Tb5ouUVzgf` z8=6A_nR>t##iRFKK;+t%(uWQAw0%;`J*f; z7wY1bx_2EXV^v+=6k>F7WHo_Rwm%g4EN88%znn@c{)dM62$PL!Eu}us`XooG3&FFu zSjii0c?w`iop4-VBX%jbfS{}%S=gs0GU5R&2qi_Fp}7Lyubu-}6PeA_7n}(Pn~rx? zdn11|MQA&c6kZ$~QD5`0T}3$(A3ag;V*|HO9$e~usSNFW_kf{@f!?VL#`?vZvXiNc zCiz!MylL@ZBVoaH+&x#!_0Vi3JGU&5_~29K%*OYu7>%mYI;H%?vdgY7T#s+eZR%4f z*9N~*Ftdj_N@_GbW>Q=f_9e7=M`nO6I|M*(k94tt!3A|`y440 za6Y+X3&-Db}7ClhhlD|9Wrkr9afAajJ8U^dm#VM9bFu|P9qds;Xc1ZOCD9QHy4qgzeR1u^pEc z{p004q@BD89!rQjO_$)>Ec|oxR1zOqaZ1#gmT;mTSxyrD$@)0-k?Hyz_1P+WTwctU zhMrkXK*ZcB3v8MeF7*#BhKuq#{Yg>ob(R}MLFDBXIrzL_3(7zw*KfaRJ1eBMdHq} zppav09#4F{@EnS}q`=MIZSI;~S85*ye{93=?B!&gwC5#Gv1n{Iqh<7y0)JHx}o7mUm*l8H- zAC(ApdK;dC#F^CVyZm>B=HXE#;nlxQD;gH&c&b15HaYQc_D#Hc6ks9zELUXZcE;1u zIP@FNfQkN_F-thbW(2h27_3zxsN~+CH6*W>ElZlx-xV+NtKL?=PRR0`cHD z2flQG#bBQ#_kqY1$J@I*o7z32eA|C$2EmOV`KPBel+)*fYTr8Y_uOf=^OACdAXc`G zAvCCIFGmct^%w7sJ8nxu)x*uTTZm|;ZIi96X-Kir{w=XyRr2WCSH9R2pQ2B)DEq4S|V{8P%O zFoX!feN`1PA1JQqA6nzjCt)-0a4n7|OMy)lRI+l+v%xyxlF^Uq2BgbcM=$+eR+fTT zV4nV{`73*Ikt2;@sZLt1orAU3=QYd%PxaUCVfSCDwS2=IS=3hC?_mOv0DwL@4|{7& zdFG3sZVo{zBKD^@OKIUt8vG79DrKLL~d`;MTmU3N%oJ~W~9T>LP3IYr#4ELU!uNtREWhsZ#om5?IVYsNJCkJ zKYz(&Gk0nUlT&-6&Oi{j43tk^1n$@0Nq8Pl>SRhfrJ>`El5fv-?38zqYPMI((sRSD zO3Y5opY{&*x4uflKw8&6m&3btil!#!?;*|zk+|+vsnMI9(>P?eB|tCG5y0wAsL7-r z`!|(J>VdZGJ;63pd7KpPA!CIyGo0Hl@n=VJ?E{wAjiu zV(TrYJI3?jc(llm2_kHAXTU6+Wq1=B82-Ic{4wv{yaR4SBLVpg z-s8MZl<^ez?SNM%j5fUcj&AJkXxx%WpI;Zg2;VSqME*V3hXPhT*l~mM`cX| z{~!dkQ}vUUd8{ik;G&mQXk!Bt02YFNZq~IM3uCYR+ZL$Y8R2w6|MeWghiUFSka2Dr z^AO8L+Lu2vwUrDD3^s!|J+JIi7lv|dXM4ECkD`E1;Bv}qm^^}{X?=v} zm5Q-@i+1G2fHxHMe7c!^;AHfT;IbmxB(}Y;@!@X;!4b+gH5|lQPFqx$Ch!evLF@Ml z9`XZe?bPbeAb8a983n5h4WiQ=-_OZ!Lrj*kCD^O-M6h`M7p^&0UhaJwK^A{^Q>HaM zeVx%Pvz+XWi^cI9Wl`nWFyXpTHv!Z{|`KQ4pO5l^XJ>lvzQfMJ9u~Z`EPU>y;$Ka`f=(*pKp`Zjcrtj#o ztSR5Wk5rXYQ|49viJ;OyO8~9}Os0)W^t1zXj=PE7G>iuG+!}7ow_~R89}9fC1CC8$ zN(>dL_9q_Nj>HvtKOKKKYfL!zBew&Z+cGtG3ZceUd^o@j5Gxzzh$Eu$Wlgnn|`47GEHc|=Y z(u)Mv%p!mFLjc`Mf%|0UsX;7d^bugVqxx8w`kB-OGri`0FJ^tiNiE)vi0PKwq?1w6 z`yR?P%l>7Q?RdFA?!D5lt9e-UTN2}4z|+0-58HXq9jrmoaDUmDxDwWOrM9hk2Tx-Ep9@~ z$H7a1?!zs}$UFa`{W!7n&+)>UQ^Z*b^ugpT@vp!*8qYI1;N23yZ`>uiTMw4H zdhZ5~<#@C^Hh?G{QR%A2F$fgBb(Xi%*_ilnl(iliVkM;X)33BD&wFGc7$zEH=`_e8 z$$Ir|2xHxCI^N&tA=jalG!TpkJlA!8x)8h6ItH2V`{|!M{THrzeU%#k_}5;36}Qno zjBVk(`a?M-3sUmWoA_i!g&;VQ7RYo;c9@p>KJ;4vsXFs(#sI>9S0&b3ABSC*S*5V1o~G&jxzJgpy;oe_w$Oga;Db zY3&ebcunp7`F!5=YvQuZpk5`qeP{s9#}SDaZUIp>d#YoRs=|xDGo+fAbQWw3k+ylT z5AT0FYDetnnPSmh@x1l2>EAONR>90ze@nXY;%0hOisRjW9Y-#%f;hZmpnkCI&RaD_ zsE$9#e2jaICI-K+BP(!=Kskm&8i|=8BR$Kb?bT1_Aj+UhwP@s%`AarB3VU73V+6fM z(qWrI-lWZ_cBDz3B`%kePvUXwuc*l;Ffzh@LTT5#B}p~N>8CP%raEjH~1xu zgoM8a5fgf!zQMLIft%2bS7U}wFNq@6S7iXJRUfTWz?$5r&%}lPr$~O#`gOSkkvH!@ zv;>a0`RRPIvmDz!bqN%FAaB`cLdl)OW9sPnAGIPJ`cTdB_obC?BVw9n0}OwKx!w|> z)hh?(Pv^XK8=#lPoYu5nQKc+iQv8SJn?qgl4=r2uf#%B2JDE`0MYU(B;hU0n1#y-k zL6;|t;N{4{$%stWKQtbnz(%qm^&1mM^Gp>?>blW?Xddq8=oZ^I(LdLvLL){$z3|k| zyWRDv)<_-Y@6o{W)C=rmNmeimWHD8kUh<8a-Zt5~gZK`BTY9OvKz*--2;3LZr$cs) zaAgP4&DDJpzUW2A+O#Q-&VsMMMWIzAYsx#6l9(2ZUYXaloeHTywj1DwZ_#BJDLX}<#rmXP1+W@tZ&@^=qx+&G_b@L*okoplp6!xs+={C)dp$<|C6ql&oioUpG>*f;!yD z8z*GJ#FWVBy9b0DEPt9hPm?`k?N;909-%r*ZxN}dDfGqEwzJk>PjC3Hm0Ly8?XLSD z+KlW!v>;=65f=(eRJ+wExYJEPU=F`qHj-mht#{aMh+q1U2;VghBw`&t+6!Ga!jx;9 z(l=^IJ=u^RAN5>{dN8E`0zdD`bp|MOW^)vy$Q3DNSVr35!(5#&m7GgI@BaRWwtY}N z{fEjT?T_X&QJ%6oPtJZ!cdcV_g407z%M-X?4p}6q5r|$_>Kc98`}FnX=jD1`H@jpT zoR#%u;oE39Lkw3%L#E=^n?P&|o%%fI(x7ZN5q~KkksHe>{hf!uZnK9?`@(vv3TAF^ zMqrNXgzUHbodZm6<<=&hAJ_N>nI!L?&3#Dsa`g7p=b-Uqon>C2g@#c02*Hl^O+H~L zu+VlvK2B(R=Leq8+E|mjv3=qGqnq3w}A6q!cd~s5dKa2-SB{X@pvZxggT8(CMi_f@I;4h5Fg&Fp|=ogcF#oCoL zBsATfrfWJg=^TE-w3di%q<=HZM8psnL7&$Q%}FBa813rBSAa30#Ie z!AgeKjoh{1QVm1sX*(7cBhSbxuyK&h{vSQ(e>LO$XTSJIorq?3J% z2<*MZT)ml+aGiIpG{=tkbo#JtXhZ#3_2rk2(&17gix1i6-wKW2gHLdOjVcJI${1c~ ze;;u{XVS-IA!U<%xi*NJ*z_D(XZrNPv}J|*Lw&w!>C}#e>j0!_KqyI8kzRj7pP&E% z;Y3*^tMRq@cF#P$+jYqPeVjcwP|RjX!>UU5UTr(3MWbt!h6pXJI9-$`H+%kw%Uj>I zky;n;^3LpW<>&6_9i9RyARwNX;`qC>Vyf0#o)j{AO|X%Ec&eMXFlJqt;ysYCk&g-M zXng>W6lO#6&gnIUzc?&#PVQv#rK2;fdJcxh#wIGWw*%KHj##5K3YB&FP6Bu|&6XY4 zTn*5+LS-Me9v)UtLkT2{IFm=F`^f2w(~=C2QsA*ns^Q}4OL=O= zDX#kx`P@$X-L4~5quZ?-{-Hi5VC*aFM$2>u$ zRy|^qqgDfTku;8(f+jQZVXmx9Qc+JeXge7%JFV@z9bAOQ4?C{z&GSC+mcnMTI3&yX z9;g3^VY8@r?=H<~jw7TQe~5&wL*KTmf7oJ{Y~3YtnEk>uDGPn31$loX#5@S{>DZcg zDZ<+*?K2sW*2;UA4qcOjfSx{S^V|mDX-i!(75H%o;P{_g-sioV&gMIW5mm#TU61gb zL(tX5@e0+?Tj2yXG>T-S{WosX+a-_fIDE}jN@nCgQK#b)SL3VPLhZg)yjbs`L0 zwsjQ4ds$t)^{;KaWTU9C7c3&FJOv_PM{Zk>u89Dl8XM_`(`x>BB3wfVh^FJyz;CC64dmP(MF0V!1m{IaVM5Yvhlam!SY8~I(b4T8%@S%}$}?U$^Hv+Ln$&9x-Erw5XTsN(OAG9-2P0q0`DYQbvk*T{~s zZzLMJj~EtwdiPX{v+n0h8rDu94%FRP_5nxkJ=tb{l5ffXoVHwEa+JND3b9pvTBq3-YR>Z4v{5{SM|Tk@t$T~uYG zLNeoKYANu!k6hHmS;@%#)t^0^>0iC5g6@?)^oQyQD84M>u5@dm7>Qthr59(XyDQU48Bw>6h)b$BT+(^3> z0FoQt3WyE4p%c9hV2<@BYcf_foOx4N)Ji%hf5UvI;BBT9KSdI@A-7=#pNc4Om9d$K zt&COs+5&QIGe0Ei=C-%!2vCvRw4y#|#!uc0_z-eKeM8$3 z#zi@2C~qh4d<1%TprJe!6cyv$U)e}^t6;g}q!u1qU{^|gO-V&QLVaF;gp^IyM&aiU(AhQ92mcRB#i$_K2g{n-<1*} zz+6vTNccb(o-mgNVM>$r5Liv*4rhiEtC0Yz06<_;hBNz9xyk}dlj)S2EpbD-Wj=`7=)@#uHe9JIvYL$0mYcV zsJDu>JtHR{h>wH<$iJg_1iK^80Tj1o!&Au$l6oGhh(yIjWm!A+#Plg)ykHn@ynA1_J z1y|aC+qDUrOWNrCt--STR@&V~yA-#|D7qc)i{v{R)e=;m0i@h0K%1S8mnsP=1(NF) ziqP0o61Hie8ce>WUG-|vVN`gE|CVZzcQRv$bK#oSo9ZAQAu~}n$^Y584|eCE5r+= z+Tm-U^qIQb@inH@2Xe2I)0(Lw0CaGYXt2mht^nh2srz#$9*C8N0E?4VBk?jxm{r`f zzdQ)qrI?`DJ>{At)!Tq%5imy}>qTKcKM)I&${EkOEV^;-^iDXU2Q`qq`+wDi%UX?f z>ybNE-XDhdeTyVtd6xKeQAM6~nI}x)!%qF>+e7lowVQCMo=!ZQN8kcUHjsv|sa%aK zVVv*PTwa8Qt7wK~{4PnG6?ObM(^o@-oqD=H&doG5JiTa{8*Z+?HEzi<}XLj=+nn;dkOYJ5EaH0cVr01U%3MYQ%G~ zB@Hk09RMuwk>Xl0qT7>s*Oxk>MLlBAj8buYrTZd+I>rim&Z8XmF=%d=p--YBAhufj zfc<8{p=RS~~oY|5)ZQ5%-=gI}{WhP3BsIyd$0M_nLZL+bnVYa>qm+wo_;P6|p5hE18Hj7nqw+ zI1|;s=RKr|JVfr@z@B?!Hc(cEg=d-i4EB3TJWFUR`!;i2YVy$b%ooNz)k0Yr**#%4 z8>Ls>nk&gJ92MYVdBBI`f}{OTH=-mLYmV7J^A|q#uP<-I2SQyUR-CWQ@!@Ks;iVU09oN@}!6@BL>F(blJ5rcOqukE%Nm2ejO zY`y|VsQsPtnM_hkbf~)tNAEy-dc^P@%JZUg#&O5~TIdi2!14M4*0N&nnZT-pc}^kE zf;7ocXU&g7se;-=lFY0e(Z5ZG=gdJ*N~5;JnZ=lv7U+T~Xl06m;~Z#%2pVk3W4a># zUeDrB)i#?)l{Rhy`??%CzCv+OTMu9~S%nvS6y zNpxJ2y}i93B^5X7eBzvst#4XL&M|z_eg26v>f=qw{SYCc?A-YhZjt5IT3Q=_bhNz^ z`5UA^)Q^W4V(M#Gf_oT(-XCKwuhTEA&{W#<`x3})f$zhoFQx#4{tKnRVVhciG z_LAio*D!6AOBJyuu^dC$we!zzH8Zw`@TGhFmry@@zp@Yj*UtiXM9m!Ti8@Dyv$L07 zOD}0h+8dT|Qz~wSqdZZSoh)ZW4-^4{kw7GznyF_8Z{E|t;c`J3rIH;|Usar12cQ~q z9wv)Zt1s5lDgcx6`w38}9%A0*5=(v=hg&v;T~#k~PkNGw3_x!%m)ZnaD0_h*wcsU} zfJ+_P4O8f`~UTuaC<;L)1H5I`NY-a@us0Jkkxc2V9LvqJaD+ zN~57YH7A3Xu5d~@$*ySU1~aUW_2Xxkh{?y!M+LjLXEVvjfhgoM=*HU^ih!C&1!*F$ z6ALMgECyb81u3zBvM@=E>_Rxr-7tu70^A7rdo>r(KR&S{@%V?vCR_`G)N0q(p4HwH zk9T?^LkC0H_v!q@n2}E#%Gul zHXbvYL`SpGAFL)9yR(Keg(XKZr^mj**^TqlKAnUd*UOP)!NDlhgH0Zt%^4!71_^a; zbM8d*B?%=$r^gYh5Zs%QK_hj+7O(bqS&W%2&iCbOPyy=cTjz)jB5as*jv6`*x)}?Q zcS)wF$0Y5VMfWsvai%C4T>tX&ox05Y`V@EO<^eTPQQl$4Ho0(gbo4cYvGaAbRUgXN z?h*Z58-rs)OjCBm3aS=me2t3aQo{T~=2Ka9VduHhFJpC~@h~35XNl-Xbdz?|GeE}i zAt!AvS)?0nf+8dR_XERFMxuMLs{&n6kDeUb;4U&!$HR`!vM*x}Ex6HN+%wi0h7=QH z5%;yVHQEj!W|5>>&B_X1WiUP?C1|4x292p(K&qUN&VkeQ!fLrXZc*H?U4qAO9(0Hws(MBcgk|0bI|Pl(IGs4A0gGM9;z{vAC8QU z-ptBl4C%1;m8_G&KabuP8xvex!Jzg5#jN91Mb&On?DJiLlSZS&^FU&_1@Kh z$TU#*UIQDvxtgsn6p5k@q_bg8RkAp z!e*<3<}pDKK&I6*YK#9Gx3x8=8cYBsvfBo6gzaol{=W)PJQWIV4R9wpdM)RXXYwRg zq2ji-b_320z(Gz2i89K{r%FvtfuM%6vho|;GK@~!r0ED75Y8Q(dkAqB7S;?~XaJ?L zb2LA^%aSKcqfQ2QsGF4Djz&^YQ0B?`=?J8DL~I-UX@FA+p^vG;r^BmlekNUkAVJDS%-F&=4T*BuHV#U4k( z3HVVXPPHR1MiFc7^q|$OJYv4&ZcuB%93O(a}0-Oyv*~#SG=pJmM~QcTngMxK9ftQ6NFusF?~uk*eoDF9FS4=qKi;m6OYXOVO^B9GDLKc37~6=cZN zazr|nan*{y?g8R35Z*u!jNp=S$x$L7c#mybk1$JtX-tYYaCctB8dfvDTV*|i=YfT11F^_ zICYKSo>=^J8`G7TZHPYQf*YG?Bd{)IL^`$!e8Km`{I=$X+ov1jHu1NYKQwbz?4kw< zT8HF=#(N|+WHFPGz<06cuKavW7M!BGmN+Ag79Ai$2W88VSxn3If;0>tPF-=d)!5lU z5Pp2S_$7(IgA^LSX?t|{x+i0Di%Tm7VMv0IAaJ;ggRO0V7AO%7ii4Tj3w)c(kT%>J zIQ(0c&VjA5e~k~ZN-S5-ulEmheykj3b3uPi5^)SpU2_HqIX+pJ@!>>`MyIcQ+O;N= zk7|V6B-8U^lY|a2BNav;Y9bLf8FLoVDb`jg;dLTcAD@PC?~7115EoLP8;@S1h9I@$ z6v#sVp2LAk^40wC|JBn4j$(z&F!k^!kdZ`z*@Gs#`!`A&lM)m-adZ(}%HQlx8!Uu6 ze`b2q_*&;2wh{dmBgQ!5H}Z1JS+$Gm+K7fycmGLJrG_`JW}S&ik|5bt!QxMFZMCa1 z+>If1J!!5j8O&3?wIkGbN&ZQE8|Go3aBhMys|>6skOF@pl6c-%ck84NUV0~MF6d8fkb)8y&oW+f#X4FN9lzr27eyln` z80M8pkzm8F;yD_fihjY$&0@{Ni@*QnGu%7|UErV(qsFu76V~@gLRDM?Pk=TCQP`w= zxZo5OMn$^6BhIR;9vLgDSmM;y@I%8>h3gi z>{y8=N&Qcxl+pIwSF^71E%}j5sUhvh4uI?|tTA!#Qz%tI7k*A(!oSSmwCY@kjY#uk zeu3mYft_BgRt?#@pnC`Zg8j-m@(*#@$-}LU6z8EYe;Ebt!8bWh)MFV zGW(4;!6WSkqeCURLRBHDkvM2B&LP%$8x6qfYLn-Cit}w9I!2UX!uZVQam1-z**e&3 z5B%Hd&KQEymT+zhl3!-I;61j#zzzGc@#s9zM9%cgdi* zpn&N@7<55?cHDi~y^2H;r4C)-`oZpa+T^5E=Cokd>F*xZgEU<3*u~+SH@zOm{!8=( zQu3YnDAMk}lV?WO7JrV#^Jq?4N27GQ>bmNgMnsti*nV5zaV(r8$1w{@Tdcy&lRV7y z^Sv1k+!Y{?>!G{cKk`>{k6L~22L#Qt9M$#s z-dW|_U&;gZn$5PI-q6$26Qk`7G5ej;tey?Bu+X?()J1jiOMIDPVKg8OfA+H#h6u0Q z*^bhEsT__>M7y(_w8*(%UkHT1rSF_!JFGjA0d|z$#BH<$5d`l|rpKXw@}8t}`IZ0a zc#neB{-?bmj?_I90`U>CLCH4?7JhvxuC|2l4gDfCUg*5MdS*5+a+z3^XGr&QwapIa zNdp-rOfkNyXX>)OqJ7+f*f%(3`qXg$j`#gis-*kKi-$yQVyI`7PTb3UpH9dk!tq(Q;Ibn_pK^D|#X|qdr?OUwSdfJ60npY)@@de?Fv9?(smF-RLtUX=YY2}Xw zcS3SO3{?X>_(yM!W*hn)2mS3XT+VCSZ<#NLV$~%Qh>89G5EbE10bhe1l7;WXbX0{Z zjR#{+$)N8=?a^djyV+g8i^nt7m-0E!%*_jW{E^$2(_z^E&~hN;_gXSGX6Q$ZYv!vi zCw$0G1o08hrTCrT`M_nXl=)`x3)Pt5oWveemnT(G^)04N4Hn%yge?5HT{T%r|ypj zY=5#|w{=_r$oyxPo3s(gZ2)U`V|RxyaBy z;rZ3DEcNbJlC#Oi&n@^x%^34>NCRTQG-A4lC} z^V;plwXV(={ryV)Gr>fBr-`eIhAKui%=>((>PN%Q9{3F^xw~(q{K7BaX}kMO(&fiD zKQXdhn8%TAko@d~)cy3}*)-k!2juefo+0i*(6bx&aX#P8`5^5de~_o+S*yp=g++XC z8DQ?(%|3j?gBRz-K@4ru9BggdH~?uMf4$Ll-qD1+5XTX{#N7I%8+L#-lmSEzoA=T? z4jn<>b4*BG`?+;+fbRjG(QY5X6*3%@##k`V)t%>U>z3=$O6W5YLqwfRa9n~G5tL?U zOGKj;3LeihLI$E8!<*rZ=r^LeJE#82EkKaK#>E-OVLq;(^N7-<1@a~tX@JY~rSFh; z^KQKx$^h2PXEc_n&1d|8PILd{AKITol#G48N8e{YgnGvj@}bVj*A6Mk&9NI+G3_Sf z(@AhGgS)@Oa4!`=%yXk0G%3yYRbB4#!b$K#n>@uxO4nj3{6jN(q5&&)S@X3P@w4R; zM0C+&YWMYcp?_n(c~#6kR`E3s)AV>P%D7w7=>_)jjrUF(ef!Wd%z-J=2{zyT@Q@o=&A06YfPr^GQd7fv z%ebMGqbT1X@||1f?de@%Pg`gx15Gjx`|*a<4xUQ$1M&|oQn|D6TAI#< zeSnUzgQk1v(j%eo@g`ry$b#MR(8!L)CQstO0Z+IG>NsgYAfeU&HAgSHe;l&!^2yyb zP_kwyK99yG#|{v1{qWoz%empE0q)#zopJxElKhA&n9HjCVIq;$g^qY(gi>7J%4#)Y zb{nTE3h`L4u6{D`Nqd7bFf9IBnZ;^1>`rEvY9~`mO8(LV+0&zNVkPNtpHC(p;xc?q zSUY~r(4-xhLY54V*rRF<5QK~UWhOcAdVrmG>fh-kR(d0Xkv16`e}0JZHZW)jf9U$^ z+_-8kSqmHs#sv3lrrMJvx>gCIjmAwdIx~RNrZNU4bGzVwN+iiqDH?z6v$2v7t{E_q zGS1JFZR75CI;C8>{=C;RRv|%PWCK8K-&>x;8vSn=u}?WSGCK=Z9>@5NwQrz?HG;<8 z@cy1iW7HuqR9Fp&i(5u(_O9A7_Yo!yEB_F~yT$=u9$?BFrsfO=i8W+ggL3$d0oM&I zB396i?c++# z$W~qfo}}Fo5LlWfjF${I=YmhkD9}PMJHM{umNFHaPboYVDv6B}iEN{ld+!9L>UNm; zLord^&-}8th;ksqkS8f93a;U(%K1^q1|y*C9(46R-{n9K#W5wgh-)Yy)iFitkzrFh zZid5xY>anvuw-|&bt|eV0E_l87TU$Uo{>|duzVwX(AW30XxO~KfXknvJ+DrKwXKat zi7{jq=ZQx|s8#6am!kA?K}x405u0@dP66I#BD{>`nZgRPJNwt?yd)QJW`0kfUK-3c zIySIqZ;42BQfTO#GHOQF7fgG&?;Yxe3Fl6kt?ho|Bloez?9~X_iiLluk{}A5OEY2e znvAUa401nJ)U>hV>sTjUMFg02if`$qrIl(_H%ulQdZWkXCi0&02Vo|cgsHP@#V(L~ zO2>vY*1QOcm}_d~3$qTiH>i_mIgQAT371JmmaDWg3|giWCtrYi4QeFXajhwZd^Bq# zvz3ywaDy<5*le2Q42Rf9Hs-*6jjw0^V(<3uc&hwbt)u+qPcU7OJ$x^a&MZZXJ^7jG z#7=t1Z*Xbo(-QgMz3jmdW1&Wzdpc_;$WMZjF{BNt&M?egKI@PH6I)?#EhROnNGxu> ztv8;RP(h894IF$%t`o*1+eGV31a^$6t?F2mCw?WfP8T|)8%BaN7lJ`3T9mlHp8&V& zEA6MO2cuGr2TQy68Ow%a7?rHzoB`LRpebviK}{Lo!-I z{m||b>~fSYP63Pc$H>(U4SD?}^}#87&3QKdmr#xryh_~4{`hOUSPa9Du^JBI*wwZ6 z9jf!V_;Zo{Q6bO!6Gk$HESZPDHhjKx*-)pMJmpBa=F7zuO@km6r4qIjzTx5|CjWmF zor_medHeRC#|$M!5eyL$MZr^;qKM|HS3o?U$_mX)0hN-{8go3=jEX1BRW(?CNX0jO~$FZh*UVi%@*lX>z_Ws`cx~}{B2vYvvt@3PU2c#V$ z3CLRJS~iAE3(T^PI8_Q=v&H;zZPl=p-2d)OPYU~N?yS9=NixW*$cB#JljGE~bY#nd zF393Jb!nzW5@wUnW;Z7Tqhl{%bxzJ6<}@49I?a!7MyHo+=e(f>)AVD`o*p7yxoy!r@SKVvq6NJ~5! zybh{~zq-eWKL&;Oe`K?7Y~HYG;g#ilJp6w6UI4+v%!M8h81OX!3g0|`&GvjgwrQmr zgDs~xLU?8Fm6A-enOnkYb~22ZA#|d0%m7?{Wtn-;-Xg@M&w>SNm3r-jHjmAU8*JU` zA$VUa)c7@SI!3!>nO_;S+)@~bcoe6&k$==;c%r}7HvM@qZm~5Czk5M(y~I6YV6cF9 zp5HLM)eWYs3WFrY^wPhz+=1b8_hEY|p*wYc>lu3D3qqrt2waYYP7kwas;BB(VU2?R zn!S^ueNZ;7#L>Du?-(cMsBhybR*pI9fB*SCLb2}H)4DY6_USkDC$3yDyU7@AI5A*;blSQ{EuB%M9P*WRvTH(* z{iGhRIRh(!Y!?sUw5QinAX3#isF6VKugEnEZ==y*I)_$LF;4Z?p8B{u>?QyYa4DN@ z-o1ab7`=16$0}aB7`;VbH7XK(3y_IpGkJ)`V>o2bwZupFFTT)z1b^0DXk756R95(G zCHNxY8${2b;1(P1Q!C2vmnUFd4-0>42^( z?%dhrc%Vg%Uzfm8loUC&tB5Xr_{`3dM6K;6CXT27Rj0UEQR*b-hm&5uFMiD`O+*hG z*2?|MF$hR~BRC>TULM{cnKK^3RqxyyXdsk89cg&DyZh#jpPX!Qx^onCmL)So0J7=` zfXwt>1MZq0x2-tI`bI+a)$q${ttPr|*?PbA1K;cI?S zuLX2Zg{sdTHR`gtdJLGdy#mUL78`Rr>H1*6P|TdG;nT@z9nN-ZdRTonfpfoS+fc|| zRKlsESJ0R&9Vx4R5C~+h9rC&t<d}YhN4jVF=x!?R6#p1l_x2+Sdc^ozq78#p3Tx#k93R>Cr>1HyotV#wBfhu<-_{I`anhAwJh{r z%J)MY?L6AufsoxsT=Q`nR$?p?$ITef{>ol*jBfh~RW-aCeIMKr9SD(jNn0qK9#mBi zdf9v);1m9kOzX{9ruC0RlWk-v*6NOLodD03U#nIiGo^TT-oy4lI^&H<8#{-$cOu8` z3JmsNW903hF01LP2Pl@K(~SA9`&y51@}W1aoByh?zhquzRa=;G{}#jQFX%KL{U`$$NuINBVA*Y?nOKuEWpmZjI-GD^_(rCM=;Xj`JBk zZW?4=n%P3zZ=uf#n++Rt8piP9O=oz2zXWCq1b7#fMCiW|-thJ;SSTq%h9;Hdb&^7+ z%@&8J49N0-@CfCL$k2mG^?ArA@E4#XCB!>O2z+TH-AL5sx;e$H{*2s34RF{#l>2xy5ja@ngnniy=)KcfcgMtDJ-B-994(`xK9=u#WwY0TG9mt(#IHmCGI(p)jHqSp`le&2^2!WjIUq`P_l5Dp0MHdGd5hOSPFiZ2@um%T;Wv`d!J=<2*P%TK077a{a zt8RlRb<+_$~)Od3;@{}1B7T*YN z$^?i-c6A_KF-MALw16iP+MlYCoLmlM$V^R*fYh}ma<|}_jW2r3r-uyAsrsoq@Lo) zjM4BG;~t;x09%u8s1dj!#~*^;8YciHu{au4qb`bshltZ%=O{yHAjp)biLwfrzW5a8 zzaInL?dYr!i<^vSPD4NIU2hr1(^K^R&22IV)x5fc9c??4-pmwi2EZ4QkmaQ@ZN-ra zKh8^LB|kn8yFAB`39U?4iQ#4c?}N_g6H=D2sGLmh1_4Pg-0%>drTJ~V>XvqZKB~ih zbat57Z|o9YDa>_Bqu^@Qzi6Leg4jJTkb~ug73HxmA;Sy+x!}9F?K`NA#2M&Hapf+lZc-%R?bBxmak|x&;#kjX|jSVSUz+!628ob&~>db(`9TD-b9 zgIBtm(~ZQIpt{_8ZUZq1p-k#&;m8sZb5!uGJPG5>?dd1oDo6aFQ6)CX@MR`dNCYAX z_=ZevYq(iK9Svd@TV2JtlwICB$U6^lPYhx=U{`aErm1ya4-D(E)$w;8ugT;0Xx&|g z_2S11^?J%={93Nl7ruH?e_HZMk5wZa_~F-)Q0bLn(z3qWX$C}SRRI2Y{x2it@oW2r z2jd{x3WAN?G@qnXbpbi~$_(e(UWkA1b4ID|IP0^CD!1|yd1u85dvp5BWf4v{B^stL zuheZ8zeayTewfS>G#QQKoo9fGIVeUdH2oJMo%0F4~ zu0@GFP3UAD#Gx5Q=^&>WFXMRDQ{UeL^iDvooK#D1V%8ev zpNy6|!SmqC$ac-122u4o4t-U+lK)VCbPqN(+fk+Cd~R!As$P;eL*&>9+BZ%Hpg8qP zRJH4-FTk}tUaLSNfQf#Kqt)a5LklK7bJmFa4$a{B0O{v#)Nc6`drG#dZ9qwuCZ1%u z#NKLq2BsD8gkO9f%^i;Fzc5cqEJQ|HHfmJG2<7AivR9>2RcgyA=payHb&M(F%=C&; zv^cioUf8ZF?LOWO>j%m&X5M>mFeWPJA?}xpfL<3y_T+b4g>!v3O8+mkUn`U-{65D} z{TD^diXy1~^n~i;ZP!h9%A4%WK3zd>7~ zBdeVt^NI(=0!iu8F?Flt9=Ii}Zl4~TqS4_qO!0;2E*o+o`0p~}hMW55yeRZeXs9aA z^=?g!jdUqS{HODAcrN1xJzjfEdK<+Gdk{i>s6IZ-sy=}qnrUXuXrj=APh>a8Qjv>D z*3qQqRf2hvx{n4dz^|6iETYFd9RDKqW4(OT+_B{RLk;qlN^pQO?SC54=2@k3!QawydccuMQC49>X z{Rokn`f8}glwe~o@vyV&qI%Lbv&m&l`ny>1dFn`8-?=7t#e9@NO{5*s1C385W3ex;1&N`KRFE=r%L zM~g2{>@R_t95Rf($*XNjUD8HI-Y;3HPGVJOdoZZmX2HJTYTlblZip!MZr-C-<tD#&S=}Axl^vb403f=dFqj^ABjiJNY8+v zL?3O8rhVP>zaFCBX(i2P;LgNPGyIP`vKj66qCaN=zX2Y`bXU^P7W#d*Bz?83-*n1q zH_qj7Q>XQ*iTruBTuFAqnS0(KsHnC?GWs3Hi~!&JOz6j^DsOPrwue3xGw= zTZc(W$3pDRVSFeF4|Zi3#DE3k9*2v`J%`~=EK)o>#~m_Q{hd={dh*irxe_EciC*H9 zteShJ6xUniJ2W0{#rIqiU%i`mOq~(VeJERdf|Bctd2@FZq@tjPF7>&yJQaQ1cv_qu zdR4;ej@{uD)4M*sA`aY{a3UtM+^yam@ey;dtnUU8SXT>}rv&l-?1XHCcXK{8nNZep z;cgd4iDwW%@F;p%GzjDy=yPL7O7S>gb^s){NmR1kwW;@|jnkP{=it1T6;tJ-)!L0j zNtP{Hy*TQn*b%x5+)$Am+xzsO=q&hx(V-quXaMusPr7UNCuZK&<&ThiHUd7PwwQZ; z9Nr9Ssw%dz0X#D;wkF=bwA@s=ww5(50lxrK7e&@wGlVO zg=|6C4Scd&wk9C63S3&E-mZXnwn;N}8}8Jhl$Vk|>9f_sij%;Npf2X-&ZJn3;w`k| z1E`zTA+W^29*o)2UcRYerA!C4YY@6UKU=D8Pe=r`mNP*9w)GeR!zkvEaw7wOL-_&% z7QXL%wOZ|06$m}ULvR<&0DrjUW|lWZTtCOtH7D>RFL#5Okr}zv68faBG zf6oex^hZljYK?FClsW%ltF*mEaM(_`Q{4%V3r=5b?J+a%$K{_Guk~N7ST1m#*8IDC zBYTnV+LLs%j>m6TE#N1&*fP`&F&)Ssp$DCy1Co@bhrZ?AGzq`q5ZB>t;dan2J_-cf z+SP)88(>@Dp}RN92ZopRxEI4pVDPyQaPbK7f)z`!%P~D;_&^F86VyCL+(UY zzP+Iyw4mMh-iyrsl?z)$HG4Zz03BX(YHIQflRk;kk?hiQj9x>mNh{(%4O#IqlKP=} zF@#~Y${@}78`LJuW4G>8`8ez3Kq8?!*v5$Vs>!LyL5WFkM@ZYP?VODVo~oME!ryqw z+!@-uqvIIjFmyM;aqU>GdGES|SYmWqkmLeB7ZL3&gRz8TE{0itI&5!?x;riX=9>7E zb=5jw4KBw?wd56a7g#qMY@Ik>?}SR= zB$LM?L0{w7>b0MFc7oTTffb^l)hnPx8%-1z{F|GE++PfOSQ~a)(m^7}eCJqi>;i5{ z3|fmuJ$6#QP<1|Q(hlUxMyZXfxsDM${P;Q9xQ1R2_(845g0?Nh_N*3JZh3Dz1LCcy zpCe~h-A)zw2?@IPeQSH!mz5KRko-t2%Wd`}&iRIF*yFNr<;2THot;fZ5z^^~~ZfLsw-}1`vjwfIG)mDhsV>*^C#IBCu@W%Q=B3k{$G0`=~j2vV} z=a+^Sdo~9~V4F$_p&xjGj#NpiX^QnL&{ebohabXVy8~r4zUS@idRa}zN9YTbi;n^4 zwB$+Y&8}Kd2Xo|04XB-owV_BLp7-hI@bQISc zy*OHVB5bTCn0G@Q!eK>LpQYxq!N=SkA6ICe^JD!FY|V;OBWfK{6hG=>G#^A+9=glB z@!vasfTz7D1S5%e{7k}Fxx*mAQ%s`CFE9y-s<`q3zRbE!y2k@LJN$$%`|Ue&3h%w} zlBe)T(gpS)+raZ0v=HeYG>Pgr{S;g-&U>|-ENzE98hdHVu?MD?Soxoi3v>|fM7^I( zCb-CLbjeOO#(FoZ6Fa9Woda)EPa!(VM9iWKeo8JRr{b|G~0p6o8;F0meZ~w97u1xN7y-Cp%lduOR%yWX{ zPOeEgVs#S5>RlU>z7!7Q>WHud#?{f8Rmv9XP>fYP1t??$L8X#i;Q8Jk7_m)Txe8sD z_UH5iqT69-c~-P_*T&_3Y8&bJIB&)AG097QU4Bn~hf+_UwCPF0!8V+acS?s`g@-7K ztULn`M3boJri>-V+np}RHr(ASa6tA%6|Inds6b0cx}&@u>IeBOQ6!Qi@D zx{DcArHhJ)ikz)h^Cp`xB4T8asU%0J1h1dpiQ^@-%0|8h?x;?O?hlh z1N~e!uUVSv_3|1`?fht)MIHQx^}KpNt{r%#%<;GU#Qoj1akY(YszyWyNgLak2^6O| zYhPBdBE>~6jCCy6q2(9?xaJgzeZi(Z{FnO~O|0*${YZYeFgLmJ1$I5dr|{@&c-}$E z%FJrePIsgZEzzV}mTf5hRLG(`g1DczQ=hsnp7QswBKmr@AO1_V)O<_NfcAZgV844| z2dO0I=Q=XfkDLCR_o%XoTpHYE8HOZI%W5g$N1Lf^s=N#F%IdVN41fQn7X`)1soPw8 zyGh_Rl1UIpbX9QE7O-R%Paukh#TIjUzaph=YfxK=vX#P_HmEZl5Y$d^gIqq%aqbM< zan+1W3Gfy3&tqYXS}Adw$z)9#=W+(Cy{?K=^bj zn&Dw%bcUxOQlGogJwi-|%{fDa4n(Cs@vlwefhj3hpJu`7L{`|D;g*1!hE3m|-%K-s zwS_xZo-v7#Yws7r8i9mF|H>FH71GGgMIawlt$ug$ydG)thOk$7XwTRB8STl|bp<9a z#q=j9N=o0<0l@ReGU14K|04J<`g7gTn4dpkf4!E#ib)0ugl%et-uVsSUxMA}iF5}- z#QXZfgXIFzIOyZ@DgVVesy>&qkABhs?cDnf;10^mx6XAaTWnS($>ziuybthcne~BG zevm)55bZNb12=PCUy^q&SHEz0KdEZJ={g#3G>sZl3tii%jW2@=R~U)B#PozQX$!FC zfSYU?k=H83^RmRBEnN>Sv!8>Dm#I^nsr_@~a_5H}Jw^HVJ!dKxz3k9QKWV=6B}n0y zAMStQgXuYVhQOJ7Np*sw`Umh|2tzvmn(ZBSW_zf2KOM*{WE5p4-3~Et9FBHOMj&n0 ziWrE2)A(H1W9_TH&taT#-EaK$x>|Gg32k{xP%U$I7xgFXBiGS@d`@usp^Z32JHihX zY-uPHF>`lfxoD;F+>o}PGe1T#e|TSY`w>5F`ukhjT$v7ua}#A`XY)^pgyQHxD3U?- zTHKGKxxEYKpnGOtv6l*8ma(2AUDa+0FLiX3+*@F0DF9luDqn-2+E_le_@Z0pC(D8a=@k?gTc(X!X>dc~Ytn#ZTu%mAV3kE736)XuE-xz1oTSs4tfYj{j_a^6<#*xBw-rB z=Q3##w{9{{feF^^U&}E@CLLpbS0NTQ97BVvL^nlokN8n8n#*E1eU1a$C%UQX48$AX zA@&A3|V$Wm_`5xSQ06~co`%Ryc`r>l&lM(}aj zC3R!q+|bX6xyvSPj~E`ziez|uMVdbovfK-3H{Y#oe~sh!sCb^jO_(i^a&eP%k|i5W z&pH%Bk#m1CYKX=_W}XtKE>ju{u?1b4suEd+w6S6WdJNJS^kF zPfQEHnfPk@)8us;k6Q5U67@vl@^JqQ zpQq#Jtrf$x4+MhxWSFSj;h#z8NKqGWX*>IvxL@5u893p3z-2YA&PDi$`%6XS=k7^D z?SbhssLS_5MNr%2m%|w+ECEqKqckFM%0-L@itcfq%9>DNqF7rpo%d#IIBjRoY1=~Z zXMj_~JHgLo>ABdjc-&c|hbIKr1d>+FU(%OlchVOdcR105bkD?G_;G_3{{2~UiXqx_ z&$MJ2Z*YiwdP(%PD69paF@w7vmMw9@yrA_tQGC> zRJ~-}&tbwinSDb1TKG^~-#h3bIB*RthCuGnc z7_ux`GSEHFXHXJSDV7CXRIf(~9K}^V(xp@cZb(~#giQ|uzecc%vSVTx_c_N`qktWw zzFXJgE|^<@yeSOw?U1-S`ELKf$gF79%a(XQK89@ld-b6mVAWsYLmQB+83nriv>Jx{AdRo!n6lb2f92iPiQNcQb!wQlaw&{7Z>xbVrs(1 zO`O}D&S(;t;-Pigs)-dk$<~-l!9D0PIt!}Z!oh~AS{O)C00b(X69O*&jL0bI$(^LrHT`gJewFAml%ZiW;QbYO&lu?dyX_`}7 z?;bF6d^N1Hj`~y^qYSrM_0yasS8{`HO~ySo2qbPPFIqm4Yt)8AbH9i_bzl zQ2w%$m1E7m7hQ2eSAWLB2XIJu^xFy`@H$uigRf}q7+SmujuT8!pBFLc?V7m$)aIxr zqs3Mnct}tARjZwM{m|=L6qYF+2d(zaNU|WNCDKlAdxkb0qH0keKTwQ-jnc59Nf zD`q=cdELBlTLoiiB<~-gWbXFu?d84nECiB#FaJQpGLsb)k0>%^Nh2 z`nJ<$fm5()`LbO@M7s^huB#nCXa{Lv{rJ@sB}^yRRL#Ej16Y>8RsjCimsubuKi7$msh$WUD%f1`0x7Mb^GWZQr^wgxp5t~8cUn-@~y!&LS=It`YM~1+bdP~a_@&hM*JUmClN2s;8)$D z%_r`pS|3*lPELlTOs6pZahf^ho)?R8?)0p{DdpC(w z8uWl;ay}<3Z-o7=2P!9xrlNH)aCL;-CO$1H)&;6AiVAxt3KoW&> zof2w8WsEQvk*=Icug;}Lmrqtm8|u~x!rlxri?)1e!uGD2`d4~(ey(XDf|S{Rbfvm# ztrM;K{SMNO&bsZoQQPMAz+zxM+X(MAOe(^-z6#-R5eZ|+EA9JC0~P_x3&z1_&*4wn z?5nm}T5=_hrkS7utXif2Vpn4kyse9oStEE!h7Z%Y+Fg(mWMyBz>&C7Jn=Xet(nm7( zIBnDUN#)NG|3WVd1%GXU{;k*=o%P?K_fg57l_L(M7dEOz@sp9b9^Fq|q>eS-DLrMPMwB(%uP7%S~kcZa#Q#5VH6gw^o!dNbbg zc8AtRCQF)Qq%J2X`Cy4{%R%*`nNr;jvQs_jS!K8VGkHZ&#a0tcEgmM2AEwt{%fnwubg>4&BYBGL@I>TjC(o> zGWy4_L-Yk$%EfYPa73s>gD|LuiO>)~uGVUlHoXI7yR!)1ouA3lySkLE z&4_D_nI{AeOHt0jAOV^+W(73$=tloWQ(x*~G;yZIxQ4cnSTp{d&x1b76BqG!AAM!l zJS(nkyY%YA5B%{Y?8FaY3=taY$NAAJ-jNNC!iUIPvr|Lh3knWI2H* zgb0_4-cb88?1no9c)pHxG}uhFKt&8hJHtn@ExyS*Z1QDUz;q9|kTP%#L>(47$AI$p zCT^=4Ck#BJ%f!&frtN`nE>F`yX5`QH^rKm6o3&X}HD-=7i^{J09VO^;_>YKynT2h^ znuYo`;imv;!(WY4YpUy29RJ6T>PHvX^E2EFXo@3Fv|Uv6?(n-E@cYOgZF!Yl|2K|m zW8at9-V#`v;+!&q1m}T;3@SQPw=ajg*>haeUAT@7YfS7L3Ip8Ikeu^l;Es4tr%UDD zh9rWi|Dv&vF?YIRysp5PK-fHM$bcQzdHt%Hcu+oJa+a&F@oL{9>_H07)XxZ-wLO8$ zO-9tVkz(&1iV%~wOg&pindNHw?jIj{xBgRB?N^~o&LBrVcEmutR2K|n#_06H zK;fw%@1NyFOlHpt_QPa&CKBz1i}GJQ<%+(n-_=Slsuyg%z8Ch8$Ombom_>+)ZeWuH z@S#i-wfHdk z)5|o^xZO*9sYf5{62L8c8ABspNv+ z8`kj`2iOs8mtH3;AYiy>7g(70i|m8+7ZeitNUfs&2`7!LX8&s&_BjAe zV6&*@6e3 zjVn&C-6z6-C3GQ`OA5I{{k)eI#eOu?gq^6(+LEBsQzz?H!phQfK+RtOF5&Bs9;p1_ zP~ulJRSWeT3Sl#B>u6mOEB228?Rq>2j(!Xni1cu*?&cge`*z}n$e%568h$R^NAF;w#Z|WIBm^~#vL=R zYC~N|aQa$wmT3`usXBDi5x*8y9b;(U=(VXU!XxPuu-U0@Bs142mz<3mT>EHOq+Art zvm$aRPY@lBEPCRV$%wJMGp&z}5GWqdM0_;}Z!y(tF!C#s5>sqyX z1V7BK=eh_F6A6D(f2ov?1DuVQ!p=o4j<}BcyNCiJe*abV>o9#(yA*yN>ZF4uG$kWP zj)V<-E0Gz}&Z9xr4^XoR;Oem;VBtRODPZW6Y78N4gUYOxtz(c#z(cY$B5eLSzRIEk zDS$86%h_*RC(&xTAt-2E{YiN*{heonCpc!m)ki179#N$AJ>%;?g)8bwKT@kD$@c5P z>L1{lz?c8^*ldd0@5{v+%_XNokALOucyc7(_<#R-5?fn4u@}USb|leZv)z*m)o~zj z2N?)1^E5~@zCGssa)+{A91dR(CjZx%BdactmgM!27;T2Ig7Q+8CWQdKSJ`+2$tZk< zw8-~nM(igJPbMRO4n!#wl8lKs}dOI?l)C+q!jvm{A=3@w<-rgTo&&nKud|keJ{Gu>u#G6PZ_kIZ4i@d^Nmz)zGv)xY2S>Rn>w|;^ati$fWMz_}+ z!>VG_BSwpNB0OBN6=!(fpZ9;vyzE|orG72uUBTcW<0C4CevKJgxxTNEd?@y#>mQw{ zXI}x=qe=Uj+LYH&>&M&b=?FV5yO1Q+8y;g627x}zV=6Iur0}K~9&_!jQ|KGU)2wd5 zEIL3~#$C~@L(*9jqX){_=sUHGMIbc57_2?qLDQY4cdl`T&`F&gS3c+XEl=_6 zsqdV!yjn%iX^FjINPCcG%CVFaQH?oy-sY{wGRrLXK=7nY=Ta*=?`9vNp?Un0?Z%cor!k zY`l*wnBDe@ndKZYmc$dHnN5{}gh1&z@P?yVDTa{PB$7S}0f@^)o&gR6&sLY@g;1|5 zW%JRv?X{V)2s(q=?tU8y*QkG{+4iOC+KubC>Qjj{`NL^W5WfgM>py=(&;jjzfdXLA zyAYf;L1_pih(89IKd6#k&e-*RBo}*kGWnn25 zh067PXe8Q4_990OVs^3rq4V$UQJeVO}M6{%X0c1a`>e3O4Ii7jYqa z!%d|#9?%6x=Iu4CUf1e;a@U!6`6q(RPaRbKGjs_@lCZy0@*CP7Kp>Du{)8PVUQlIg z#i?Y#_^&yOhrG@O(Z7@9et7rZxp@cCdVHi(R19@J-{;RTYm5IyE>FD|Z+h@RtP;dk5 z6p8-?c?o``tWYClH&jtQTxKx<>}*XzkSK`fVuEo;4koWIP$dER_k*ozt}*gAGiyi}u8R-ECTs43^j5^1TPDcQ zq1X1UrDd${1v5}q>W94drfh<YC=%y zdqPWGXLZ5s?RPEH?BUEn2OX|%l!)iCSvkflSorQo@Sp3;jlT$vnP#|jL9i5@bMOXg$6a#g7iR^^bXy|*xC!pa>$Gl@8CW-yUv`((`Tc&@`P!%hq=N1D%d+BaSjq7E}yVhFW`s8ufOo>aH?LV zN^hw7ZQwu-*Hfeom*FrgSCy)(nx5VrRq_hbpo%trg@A>R+vOcn3aj0OZ?{}Ad(2QO z2|*%8Rg;K$IXjEU3>KJ=dXLthZ0_wvf~fjKAVUU~Zk8oE+@_sJ$^Evm=qO`0xBAYq ze~^S(8EJa9YOt0%)97>^eQtVa;-+Y#&!u&1L6B3&VklRaYU(G%Gnoij)x<%rYXDX3 zrz3Z6JRI)hxXrz8yZNbe+twcMhtCN2o~>qPQfeQ()di=zROgFzl_fW^HK1=leA-^~ zkhjni^|i)Y(Ve`3i>@$>IR3Vhwj2YWI#7k^r9w5|kVc&I95~e^5IAAmFPN680T_{k zzj~tfN%U4r?2)Zw83$*gZ^g}BRlI2J9k_O_L^ev;Lr2d!NT!C}tfLJAE(hD>8r25> zN8YDB=D1P`ZYexwdU)F$?|?}aBCftn66M!8H$t&3?6Qq{%LjHY9vE93&3LbHv|GL% zeJ6y9>~xL}@9kNochaAM(xA#;=pocf5j!&! zVD7jSQYl;^pDuA@y&_gxh5yBo1d9j84qI^l*m-H(ePTO7jvw$A{o#Z{nY6?tYGjGb zeroRuI40C$U%YCgz?oG=kDFUPX2v)vNKEo;pTMa8_aAzaf?H`*m{rn`8^{pvf43rj z7i6c) zfM9v{T$T6CcNO?k@vAZ0oP|$agvK0SxkEoV+A-p=-{B$YI{$$G@nY3{ILzi}6l%6w zi%of}+oSal&(2);tyql+lN)&UwilzfC7koUo-Y%h)BSBRO)f-=a3JRVjAYxlp95i4 zWz03Y@$zpT-xTZ-uEl!PZ&fOowFKgyF(diGjLp00m)4JOYu%Ar%UFth?iF*=t2)Ss zp2ho!%<(k338dc&iQG8LcPOnMi`z^@)HA93LS_x4(1V1RjjsjOsZLuaoPnPa)7#FS zFPSYSog4B0Gj>I@pZa%L4=Q9I;Z9Uv#9zO9T)hr(eGOs@jU0CHVC6+^_}>JWls$Wv ztw5YRXXe3;>Z$P-$BHzn^BK!om$?l>ko##&IeVr?t2~Z4q^?arC!?e7g@xEc$Gle9 zd!`0E@}C_Ca zVA{nY+#!P^gK1hPAmYQYjhd8YR{Yjo)8@&vW%FTjRzzX&#u4XPOltZS9^cG(g^VyQ z$}aPkcfd=W{n_F-hGav%QvhO@@pLz2Wqf<&>U@=`R)n9R1i}({VP)Xz=-P_#@O>Q4 zR}&$KNee(x`ppvRG0=OrV+%Y4g66bGa>Kgt;#7$(e(g5WU>El6>sjRxN|CC0_}6K^ z zC6fZ2BUjG?@>BEHU30!}*=p_B3;wI&-OI1|u8}7>Dck>+4&#=Jx8sZ~Tbgq1xrqm~ zB@Eiy-<*iVqO9G+lgd{H-&K@w?jX_ob$YSM>PLRza&Uc-xNAF|^zg@|xw8DQM6*i% zbu-HOeWoPpCY^i5;|r(&(WiIeaUPHO^$(?ipIL5VF!}iK0zc_Lnlz5ym*Te?K|{ud zrfY^sQ0vkoF61O%ZepHV62ywuyXtV;VfVbCF~`vXs4$`*EIAcJ_Jt1b`; zqq=;taP3LN7I96A0wV^05!?cy&`aDfEMYt$4OmJ8m8 zo#&@Ov1A%yC2ZW|ULfIt80ti`y>5F7&*1h#%GF)6dFxK5o%sFczt%6B#cO9dImi7*B~J}4 z?%_LrRc~aVp0zpG1i`}J-PFr>#^SGa^+^n6<}YGj#S?Gorp}2A%q({icK^A$-kt^+ z{@;Hl7>+j1hf`>%eh2PYtMoQ3W9=L5b66swWqTe_9i^pT}gK1Cou_9T#s=;(ic0)4`l(5%GKvl zX)zx4=2TZrlKjtbk(Z!W0Is0cRZWr&0rF&mpYUdl|EJ|))zMk~GfR%bGdri^rQ1tO z#)NAjiJo4F;+>YQl6E;ra3%t%(fQ$ioShk0^}$5kZF&qm%pIQL6!=I-oh{n>b`Fci zk&Kx6vJnqU^-@M*IiqO(_^EFj`#yIvf7qfh9XbyLNYAI@ZhK zWz3BI$<>@gdq0v(oB2;4SFUS@5c|ThZ-A7rC}U1 z*`LKu(dh+X7^z7^D;;f9rZW^P-JKXZQchVr+&WV8jysRL(ZmOql5RJiv5=dq7JBB} zY3%C?%YB`dY^K88v@_FoJS~@HcM@wyP%duR*J3>4apZo_69$m25KyQ$ffFuVdHr%u6`qfJ3EdQokAXLxEF}tAlE8+2T5h_hO+b5N* zy0nrW^mN(SdAdxvO1gaMQY#CVsQa;I{f)1XcxC*Y?$kEOQX$YZ5_QpR_nb~I=T49o z$~2~@$M`%QzgAHs2ywRB-QWJUqiX)|p7`9Q4<9=wC7yL<%9+)R*I$`c|D_TVzP;2i zmGE z*0qu{NT*h1@;PMxgLn_I&>`6SP!Dd&xk+m1d<*Uq_p>9BFwXiTqv7tB7BmiMe_&V9IXp!J{-?yQgpDYmI!r*8GqJ89cjw{b2@HIO68}D#MY? zaZO3Lhe(}$n0nC6pcctwhFni+53RX;iaS~d z_ff4zk-ju5M%30&g=#SCvqxptFajr#3YJ(@Mk*BM{2CgAP$gK*HN2O{#JeAm=34v1QfEPy|0;X_uccVEUIMh?4jkG0S(7k(>pTH0m>S2`G7wElOhH$Po>e-oQNFR5l3*Lcka z1dI<9{|Js=&!5lyg1WzUf{0Td8(dUnJ**r|8EsqEkP76>1#=w$gSgS&*1C^1I zwC@yy7%$au+K3@K4U}Y{IL0P9AK2g3SGQ?gtLSXAH=4tmitlFB1Bc__erC4sD&X=B zEH_z1J!87aU`Cb28|}?LP9Qw9W*nBEe~pxQnmnCitVic7A*ZLY7GU4v-b1v|oI>f< zO~XFtHJBO{%Bvpe)ggWrjh3c5T^advYY)pC398y@6^|6S=}y13VN445>Z09QgpP^T z2Zg(YKhP6PM|b}9^;`95&%-}1gEyR78=gC5WZ7q`Lbq#@=I+N+YFIV`oq-1yB9`5E z(syyU#hH-PJ(&S@87pluhX1SV!25s~1h4x3&_T6(<$Xo`Y=!r)q}4ITpm&VVf+3IrNTnT5YOw<=k7|p8+ozd-l-G4G zbGFnaZkY~R{MQcjq_kPka=NzUu2UP89+@QrDOR=n-48T90cc+w3u=AN?SYd-fFuvz z7`spSR+`$bm?nJT$k;Dhn~Gm}bN2NKD~}{Yz4D(4&OuE~mb&q{4cm(jH=veC2~JNb=$QV|9pKfB-7#649HfC~}33 zs0NAS6>jeGL$dmQr$NcRE&0m15tWqconzOlX1J^%ES%`TW zYX(o+@1I#U>y9e$39RgRR9x=t_#n{xY=j*qE@S6F-fR4$48B^Q(Zj`$($x;Y&*<#f znRby<5%DS={CCg(kX6;t>gpyX>C348clRx~V8ZUXIgL#5H3KyT4n3Pqw%2^?FcC3& z{WCoQljT+}5U|qo?JFI1 zM3kiR{F=^6OiY{=dRS-xC8kT1g}}X|P{nU%4y2+tU3*#S?!v?bSE;%31_|nFFb?ad zIFbbs^V2DmOCpY2>Q)?+ynJ|HIZF84=y;YVh$K?=#6b2Fn~Dn2vJ?!6`Tcl}0aitG zM&P4G&N?%W#{#IUQGGzSy3=+JlMRl=RYb(x0>KYVCR`^8>_%x{9caDfCrik9yem^2 zT7Vs?v=^X>WdrkYkSft{sSvnQcDiQ4r!U<}`JmF2DP;U{r|*kDu_5pC1g~^T8P6zu z7pb(tD<6X+yVb|3A3{%Bv;n9AZd(US)gTis|6#Lyt}ZxpP8C?n`)`kq5b~REx?Q_| z{L{lPM>2qaKnB$j-!KuzitUv?c{(&joUN12DB$T`fOlr|Ggtc7wk+s^Y2=&T+e6hl&faZK_wj+Wm<<;g!o$=Eq8W0Gf7>j4brXm~nv0^If0DK>rry zOTfuKFxaJyG9KWS;l zeBsvXC(mEq#H8hZ4;*+{5V;yC*9}wr?*3a4zWkei_Nw#uf$_Ovoe&7z+wN5U+#P}K z!(9B}9JfzZ*<`~?8j~gMUSC>kJhf(yjw6v1j!9vSbxJ(jn4s>ZtG_tIu}UpzSMEyL za{?6INN+`fu@tCAIjWjGZrZ$o}9` zHL0ZvDKV@rgKm}26@tetQB3Bbx7Ar9bX(cN1SQlI{LF0KQf*_Hn1rqw6wlQt(ymqz zMk#1@dMUFU`c77iBK&`do1JtcLAT+YuQt|`V@X`cl2Qy#bAM1G)#n(EVQ0YP3Q#RH z%U`aM@7`CJFD6b^KRz??oS={dmb*;%%qx9}D1Ny`SWZb+_s2qGULCTY6U3m7Q1@nD z`;hOc-8mCkqo0lwG~Ng6+XADZla_1nnn96!@|5KB`0H%u;maCcriu%HVy=@HB6}7E z_or_apA1_YTbo|iSYe+pP+fxC$5uFfF?(A(pSQ9hSDlAMnvX1hPg?EM-MkO+cG=p; z+@Y^yyQ>A0hiwgr5Z>T z--P!2VB}89#*~ey?SlGi$F4}_rj30*M5aL+=oLNDzv{Fv{`9#rLs)R8JEO(rBPul> z@yu;&Xv4GPqXnz^lkro_)*hJE0GIT0aL~Xueg0At=-Z?nJ^3=h?OvNVJKg4hWbXPh{(b z{O9j*eGpEItFj%i2<~dT0YM)j_(8Pt>|FgJh+0LvGFX*sUaz9E;$B-+GnbbF*?ZIh zvX^(g=|T8%>qEnDnk;Wa*Ra+VPiO*VaaIR?n5ftf_~$wvp%WxMvYucV$&xaW{18J-PctOV}8`q4alT5uUfQxdT3waU8`Zb}*nv*jbjB?sM}O$Web_sw9 z5rm0qVT_cd6Lnk5~7}j!Q!vg2=l|=1*#T%}by(pw#&Xw%J zShakt$w4*Ld2tqD+Gt;KUlBs9F|0Kv{j%m{^`hOKbl1=H|NGWfqcUSUJ|M!JwR?X!@^{g=Y;0GJ{+Zz`&P`g*xv2W| z1FCTo3iJvb{c`D}47-l5xZ|~3862@o^D@m}*)PHFu`03O;3JT;(QqXFZr3Y^1Z&Fg zLr)~L&y?*Bo5%DI?dCPN+eM;Z$;zwSD<0_eel<@>u*HOkAMpoA9wm%uc=jxaGZLOph{pzt zqpcX~PhkurEuSK6KUURd8$&WZ+@GZXgo0 zwgXxUhZ@`6tS_=uDe59Zo9yg_hmX(0+JSDe^Y$fQ;I3+aAYwj1Qi-sOsdLUMT(o!de|j4bgSsHBItu9H0%Dc%b;Pu3#+~XHSTS$*=*bPg+De+aZ?J#XSWHr1q^RP`6vRH+7A8_U*Sf*D&tgmuhOPJ95_- zwG(n3X6aD5^>9(ks_sQ;+YBAgPEWzy2l0vHcUC>|2Kjcec1?-BF}=obO^zvXbNej7 zxtnN$)af)84fvc;n_o!I+OSopVm%Fty`Z51{Bxz2_460qh>f0y z1z5fA(jShEKTn^z&_?uyXunu8A=gF!A*K~JbfizKnFszkP@-M+2P|p`Kh|<% zNBXO%y#4HMUC2_83d{xNve2vPq<1GIL)aasmDq22faw(l(ob@eX}G;Q1UJfjG`_`& zi)A0f=^W|RW5-vCxHrdpGnQ}ffSId-hIYJ8bC7Ghl0-it3Ct=^3QvO$Y=cJ4;+;Fp zMtyj5G~8F2VZ&-uqR&!|&Qem4VW?Yv7C!|RZAPNi6wgBjdNLx$9)X{JKQ`TI?#6QW zG(#6>+d=mFXf<}t33=5PEUYIm!3u_In%4(=Z(0F?t4|58czS~vP7pjTYdLlZ66_K+M!f zVDVpwrV#N2({EVZlOvelOHqZ>uy``U6GZ78ug&qhP1@d1t(0t2h27|Np1#Y9D4#c* zQE^!sG|eExcTC(S2nJuPXH^@@&y3 z0alpndkn;rHmO%+z)%HE<_&V4Ye?YxaA0UOMKtYQ zH)U=hjX=eA?Dn&uZlnnPt7A9dB8JPwo*W(*KUR&>?=+A#$PyYwNOMbE{ecot$lJVoPytaR8z`>?rN~XCWdV7gDZt7ks_CD8ycBTg=9A-Gusj z)@_(qmI~FRby5t2;4b28aP7GQeP>{%ZZ1L)wSuj*FQ}6IXHEwY4RdI0PsaTka<$c~ z_MWOnhp~v-+Unx5)p2$cP-yF>R(PUqEh@)u+9Xsf-u7OmMTb=lUbJ=M1H+G4`rTR~ zN0XM9pXqO1U7P#gXDBXRGVZ>1!WaF)p3kb^<=r~x77bsRC;5=qay`OERgz z7dw-$o3+GSjrSDgvW{+Lu!>#MU}L&C{sy*9WnIth!oiRn+9wm>3{ zO03rGfVqJh0LRFhjIZ2gl@pt?!jy=?K~+;2KuKAE*V2ciROB4(Gow(~l5j_a3B3sjvhzbwC^z2e0#h_bNCC@7 z0-fc>8>a5NcE*C-DIB|h;E}Qe4HETq$!t+7vBRf?HZc5w$7w5*QGQ^ybfOKhUPb(N zvnFv>Iq7D86nyT7`1-5U>t&Vz*Cm{y@)u5jM3EWrq`A2K0-lOMW zq27IvQ`?Hk1+h16yi{^5r^MCx+@!` z#CDTO(D65p6O$6l4^n!h+!L@dX zU?eQ~qN>OE3QP)i6NIbLgRWNoU~323ZOU(8%FP=^DhpEl9Svx=QYCYh%{11^_2Iqd z)?-_leFfwRH@2yGeAX1OxCWXpb_1L2Rpu7iLNoZ4@8y>1-&r$t>yfLhTfX5;s3TGR z?%zFX#^ol{Bq6<1QsPANWWV>>yasuud_?8=%rr1u@;(_U!@}Ex&=@g6d z6hD-6vctXv@FKC!SW*EX9Hc>!H48t7`ax^ z#iR)@3MwW3$LbkXB4eAG!=icjMV7$zhZ5{YX({l6=j?FDfxCm{Ln9Ea8l_cVn6)h*8cbr;q;L<5{-`K)^t3!>FKJdLAhgRLpAmTk_B$)= zjnQ6xrhZ~^R@wgV9`oG_iMxKla22C8aq@k{qV2PVJbZZaIq)E$kzY}F8WBKT+&kOTpN)=0D`0p z$UL&2r49DY60gDn?+oJf-j*pSo6E_nFMw-4a-}eh4Ju?etn9{Q>+D1)M5p5&SA??Dc5a`~o~2jJ=4)@p}aPc_+juejy5DwB$*z}2gwL+(w+ zt(+D_9ds66JutR!B{>PA5Ni$HX!j|AuM-$HgtP_0l&Nq$>{4XFwh5L_s^+XriCQ4x zA-uaP{&Qt63g5hggs{_Y*XcSE>H5)v_TjOkzfPSvXgU1^|L|r%R`}ViyD+B@7G#sM z|IXXGbzPOiPs}{JH_~L{^(LR)?%l?>My09(iCI_$xyzBlz@@QqHdIjr_sZQT`f8lF zn{Ur1GOA}3RUBYiT@aWX<4Ex6rnN7|GjiH=-wA%d){rQGXu%NvNAgZZ8+0E7%8<(wAEMHyM+}znLoQQH}+ceBa z3^R?bK++{z%S0sJMQotv5X4K@5dkil)?(+vI)o#5I`b4TluWDEmiv@!rnayraKq0-V|emps{z+j5P zvcn3J8PX1eFOHDLGlVJ1M1gHRtLa)-fdHEbB3qcWT&piWFdZwVSEWiIA zeogufqPXKuEy3-b^{DAaNzU?ZC%>Jpj)e__flMt$jLJ3kwP|R0j?V$!oof-q#({GF zS9B82nD;!?L(5@LXHm|iL%R}DrufOIhBKN=X>pxMGV@MMmhaKhUv)J71GXL7 z&~oa`n~s?;kNVy0X-qzINUQZVM6;5fXklhbbajE-hM7@|Z=y0ENXA4~g(an`Uw>d3 zTTt2c?erfu=9W{9ugva@@u%*!0y_|7V3d{Clo7Y7IiUDf)yb^>ik^(f8Eg+VdD{H@ z;PU&pL6XZgV?F3w?EK{eF+X>grz4Q`gXOGrY3ZNCRj`mRwo^eD+pzN}wiZ@NYFegB zO-X}u$nNfNh&%pbK1!UsW=KkXcT7!M`Zt8Cszr>6GEJ)!1s6mT^o~j@G~RBYUU5=G zHcbT6vQ5=P;XUB1c+ze0Ud_s+0M>ZFnvxg@NgGrjn>NOjFeNb_;v#;y*dxc)N?^P{ zv_|nFOR_lkqXbhwCu=1lu8JI-8p`N%=OUSs z)p_%4(ce8J>PI}ik@WI07SMVp^l3lE>_l0a;t8kQ+>lB8*ml)mqUwU`Ncvo^-&Y0u zi_ClXV|(V-e(iv2C!UTk@rq7&*(zWOJ8Iu~g~Kt1g;g8$floz(YBkneiIGB>x9{{d zOreVkJ4-`Lv{{;tOyMt)WBbnavgCn5M9+NcVOock>ayxt=p3&*wsgO3SUeVs|5ixF zDan@l+O{I*O-p?d10AEon=P-@(N-*A2_0bgj?jwDu8U7h$)YWS`(a{oaR86hZ37BMbN&>c}07V?BjNd??UHD8~4 zSw+H|YELGuImYWIAM+%~jQ!i_u-69`X$LGh>&nnA;?065Br8_)2d0@;8r8KxAC;Bv z7^zdZ0`txQZoVK@tr5M3iIRf*b7vh!S%<}^s#l|~$ST*!Iel5$p%YeYW(*&9SwS=S z@X#s#FA^MByv$YzGkJ;$u~cZw@_ z@rt4F#HXv*r%93g+dp&lby_MnWB=~?mSsv_`*Wtt=H~tXROLtIO1o}qZ)P7fE$Ng!W(pmIe)Q`RX^ilP|kq`WxZOCM99wl@=b#39RV zTcumn&@gS4|5EMAC=2(E;yg0YN1=6K@{X11(#bVYw;QLOuQWrVKhopInR;)_&3371 z(__gNvC5QS=Y)q=3)trDb|_ z5jI8=>jXQ1G8xvIn~UCSAbVBB{gHo;bS!=Z3$Y6+0a)_Zt?~ziED?lWJ`v#|7JzUF;=dmzrVKXw(?eK<$`ASl_NF-<-$U}t&DX_i9!hLF*)J1$flNESe@i# z#C|WbPjOIc(lAmWU#VP+@U;K2(w4DDVJeBhn^r(6#9jHvplG1{G%a}FEEwzvmN++DRIhw3 zg11aSQbbD4@frwx-IL^O;+1gH9%-x4R6wh&*#Qx))PU*|0B5bRRj0fUs=$(VCS0yM zpAhUm#)_XtWwv@FlC8AauEuZa(MQ)pi*YkIUcOZp)HSu7_x*qoKHjc>zLSKMu(&;D zy_@Yz`0Us=;9xxa+gQlWKJm}cBt^vi5$R(qwlQwQy%4!*F=zSSNnKYJrvg`t`P>N^ z39=9(G<48z*mnkvp4Ie38^w%U7+{?^CI`Zc44hhWu-<+s5~DMAH67>}TNIo$JHV-1 zIqP|X=n5ivgk>iUtWh>w18JKmJY=Z}8hf>-b}-VKa6_?o@02Xrt_mejfdxd9>Dian!A zdEX^Y!yW`E7@f{l{jQW}=B}NVHG;o{rm6-wb({hg&}zMYW5xd*L7nr9cZt<}m>UGM zF6_lBZeo=Ruk9vTGluDTx2RD6#8!!Q*w^>&BGj>o%gsU+uHSfA zemm^-qncB`kAJLV+JwdbBby!yFebXuJl%SZ+-U?Afx5LPl-P$K0$&mExYlvw&q+$Y zNVyUg?r6(N2d8>2W`%8sv2EKY&Y}~;@4*m9Y82~q@c1=DKPBdDy^LaRGM#-8Cs#{b ze!!5eVP8;JtC%*rW$0%;+URGcT*JvOnENjG8{}|ep1m5#;0b%IyS}gwE2{=DyZ}VM zW>~@%-JBSUqM3rST-Rx*?x>b)Zw^%Sn!LQoLadD+a()P#53f=fW5Q&qr1&!>Nyhzx zc1Qid@qYzjNq_h3TlI*(50y`~vhFMxzUx};^`@4CF&T^b0}TwjmXi{_0|_VX9IuEB zOz;0y!sP$mgX}N_1X`+h#2i-AJ41_|Z*2NI;8L_)BX7nl?vIhoZ( zLl^jbU%2)Ov(zhZDbYA*7)3GepGN72cXy}-F8J{iuq)YC5)%svPwreGT%vyj)sBd$ zdB^hv9@r3eI9oG&9##*hj7nm%CnJW72jGIp0-19r7Y7PMV_ver7eJ>>W}ga9UD;&l zbwjljrR!1=uAa?imWmcsc6(uot_zTHGINwh_AB5$CnOn?Mv#WY%=_Dg&kUa^uOkvu zuN(xxdaTi#J=uP2^YKzk7aVzPOjv@ORHHkZ~ix=;aRhx#i_nZN%BT2X;8hP4~7% z1F7lvmB8nN=A1?0g>hklL`N#pC&Tsc9?60;^hq!~RdMtTup#?DF+v?s>R{}-NC}m5 zn=urHMy$h-lEMfg*-QuTb8q_KfCzQpcnT27Nmlgl5Rv5wc0{%`-s%7C@DB`NCI~AU zWgMZyq)T5R2|eJ?k7yT2Srr6Kmx4QC24F=h{zd+I89F<~CcxOz_>#J<(!zT>84rmo4Q0#enPUM#K=`=4;H}pvmDHRFg@SW9#`C2vC&v*YV5`izO1OJ<= zc5}m(&TRK^frh#{&xBU}{JW#yg%1>gMb?w=L00HLa(xvVBP*kGWm%qd-EbAApbUJ2 z9@gozhN!@HPaT2d4W7aAlT4uP3WDG$G^}Ic-Yhxaq*r7%!*Gn2(8OxGiCNaLlS4h{ z8FWIJ4w5o#BG&6$o}Z4hOERvHrL z)-@p1!eUoU(7-o2~kL0XS|+cT^-5)-ZRiI&EgGIA&i4)!pJLNb?DQ`7`u`J^_n zpcp?Tg;nP+{5j~$L(&9-6PsLG8{r||YUjUhMGkhQ=N=6=V4;!cV5v$3@9@ljqm@NL zrwJ_1xV;eQ1L{W9fDdYQQpRyzf^UVCRiaO+ERrgS4^*dAzW`t$aV`b}QT}m_(+}CE z>zFMKVuFeja^d&6WchanF_UEhc?WiIf#>_z&-5Vb2B@38H#UfV!f8XZ+v%_VsCFsh zwpA=fWVMnHWWrak|A}}O73U)HCtQixOT zvg)1QfVoPT$;U2r@`Gb#tD)6p&z6|5CK42y8~9K)n!Zwj zdtQp2rN1~DKhGBhE}9TnIv59JwbziWi!}B^k=?2K+w2+UFQpI3KLNUTK>Doj_CGC8lK$O`4N4U z44sYow*V7zXjj(o&m|SDK*NJ~mFz@o0LQGyWhri9^${@#Upo6UW2V-%Ys)0>&HaPb zX%DdA3K!Flx7QO+=(5I|6#O6_B5VPHULGLVkmQ!Aml(}Zcwn(owUNULa+eBgC1 z#~*h&3VkL5b%BCqqyr9hQL=&^C?XQZi{V3;WkrAh;+4+qGd*9_QYO)(PS6zBqIIS7 z5zR8t*&l3+Ybio>5u=lac++{IPKSAP9ZmOg`n#u(4sM(0tGnOc6?j{e-Ibk0`Ql%w zdfN)WO`K+B?W>T><^6+za0!+U@Cj7f%Unmra*w_qdW{(Ic;hb}KQ?YJ*o;h-*udPcOEg5w1bAxC6@Njjc8~4!Yv~3Mm`oCwR{z9WF92nTL>6b1#XAk8lSmi3NO8Df9bz<=9t0?>hq%TBQ8&sqZ`SoI0HrMgkNmCk|J zQ?rMADsFSPXI##G^H|kJ(q(~7+P%MD4%~TpmPs6`R{7r(I_YedYH&x$UEm>b-%S;9 zJW}3MBJ31$^F}TjY?cJpPrw9XNjP3b60b~Lx?1yAik6!cE+N|wjriK@GQEo29pMh% z5Nsw?s%pTAz9`J2QSQi6T;skH{W8eFtOR|4ET~Co5Br*sK6wCbH1I4&aQgx%B$|lx zs$zHCI9Yj>)^x6^ewuypU5+RQ51s9A3Jy=2%!+HN8ru?yG!xTbrlos4WjHIUkq z!E5#4>t05a(kBj1QJwog(kWBj&8i*oFf-i=?JaV^yF?b3{ar%MyEajj%XHi{j_8mY zKfO-5UV(CM99uZ>sCy_r5FGphJN6Cde6d>Lhh|=s|NZsOO0$%0M$NU>OAIf zwS<^U8N}5&c~`TKxEiln z8X|U@cL$`Z$VJ#PnSfd_$4a(i2*5a7ZwrA^~|#4 z;q8}J&jFIKoA0Lgi&Jv7!^9hLOZ9c2&?rEzu9Liot$YN##<c8>wrn&2>Pgrv9he(`UzcUPyL;0eeKilyKJ=+kF8AQ zZJJ_flS5CatYAn8fv`AGGKS*ao=r6E><>S+Fng^#yuoCo{EXuc@RnzIPrXmR zibL78ocAr7P_-`7iu4SSFQNPd-@4o3GAZrq0&ga>Xa%-#&Y zqlmb@O8l|cr`cxRqw~Tgc*u?8+IcoZ}(sn?R845 zaR6ApW8;uRr?zsz2%~0%5=!Ybbq98ZeU{uXK&`sabO~M}04HM7R>0B{HFlXb$#+D7 zreUgJ@R~04fWu*lf-9Mb8Y7?@L&RCZ+j5Q|arKS3CZv<{Px0~I;%-6VN+8$-2oVd( zMCz{AG;(h)4M*~dX{~?qGynwatW0ehnl!K|$ow$M8h8;}9R(z;;QKChf<=1=B<~gH zbp^VLe{$(g&N`|ws!LMwWqjmzlA-DwPxSQ+4dxoS{tFP{Wy8r6O0V5UR#;29yos~-1h)(HT-|uSOEEkqvUDkB*e_P^e9Eoo}#Nlu0 zRrvGyti=G-3dCdR#WC5$2KkoAmFPk1I{Pl6U?KbYkei3V=Xkl@soFU1!g7>{Ozk53 za<;WB?2DPloP@}jY};L8ZVR+NzTjb2e%GH zxDPJj;XD0%W3C5Iq07d;?nrSifby}r&a*j*u8Ug+U&i6roBD@Op^5%4M3+@k@zZH!-0FP;`kdFL}bgX>;G&+)qn67 zYEGAFNH`oh$cD?`5v2G^`D`5b0o7>Bu2zHBk!4!Gqpc?!0W4md^qJS$c1YjXh8HuP z)09yt+*8)SxNi#&X1TPOcUne!h?U3GmOiI7@GxOfdLl#`^1|Vejg~dri(v6SZCH*smvoP@%^=E&S z8+;!gl6&;b;H&5=>q&H%ui`WQE6K8z?XcIoUyi?XY1+}9J#*IVkKCoYF_7)9$5~-` zPsHv#!~eR;E4|r^ufU5})ceKUoQj-)ec|sqPnC)aapNgCL@zN*Ns6*WA%q*|3%l&a zTZ{h#@K`F*v^mXcBU$NWWBs~9U}tCrSXNcxumg*=2nR!Tokx3J#7D(D(Kj`#E1jz8 zL4=dQ(ohEzI)IWx@F^36Y8F?cfs#gWB%)li60hxzfZq0l3X$TgW4z9#K3eDSb&(;c zg04PRuUYB16ot_&Q3+C(?p8aCy7;2PUZF{(nt0`QK{Eq`nCSe0?+Xiz|`|U+y||ljjgNi zqSH`uY&Ya?xm6J#VS8x9C7Kt`Fxa?(9<7Y|khhq-lLyaV+^DhD>K*}OKBT*uWJQ`r zwP5IGaGhhO%v0cu8HW=YVgae1zde5bA4TUL$n^gI@s7}jh0SHQTsAhB+~ywQ*k*2X zSFX8ib0?f6xAet~xz8<^(A-ifhNPm*{nBNqOgc4Dt&`4Kk`VRV?=Swg&wSqR=j-`; zJT@CxbU^omtm`*$_f5CaHD`_9M&QI$971C;KyosNi=n()sw8!~igNrYJ}=V@?YWN- ztp&Z(8pw{I@}n_ysCayjoY^jz`LD?qL>bMovkTUH#vj);W239O)WTwNutZ?u zVC{;eCtLT5D+~SJ9KXUR3kaS;q)hcd_1rCuu1#a37{|&<(HuhF zWwww)6og3pkF*L10L%0u5~WB88pRt}V}H_v~07ULRCYoVnOoTwC|Q<}-rfqkOK}$Vc^wRL~W# zn~A0^qrQR&?3rGnplztH8X|JMH>o5;Fi37*- zT<{3ErgZj6eVJzrArBqkA{?zz5m8v)-N*JnjlLgrnq~v>DX7$_VCsWRMUl`IsxoKl ztf)MtYN~Gto>URLgW}B!VM(G7RE%gBG*+-drmsk&tJX)0{xHN!W~YW^BN62;N(dHr z@aYWRbO#1O`YUdx!wQdDM3+d!GN#On1{xB%IIjfA&O?Z zYl;qxFWlYsESe%L3yD-V2Ee2xA;j<3aWeMT`GdO44uXZ>hb($45|F2S$Lh>JANC>K zUHpuwfXSmVL5bX?25pPmSirtN=}+ySeV3*!`95#f|2F01<2oK5V(6cdx;{6q+&qT5e-dm<$BcR(o? z|L#G^nHM1=<7qNnN1-MS-_~Gh2JVUpMO!qMd$SOKGId7k6|i{>gndm4Di90=7LL0X zadTjyE+|i(&T)H5vTv(-$RS+FEc?Uww!CQk zUWhP42K+o`qg7j%x^d~(-5o?+5TzSuwzO9ahdg6i@e+qR$+NN8k9QRAF8KotG_Jck3BwJNpX2i+L6}?uP1kh#byG%iUSw1?(!;K ziVVXOtoO@Wn~KO&I%s5;v=l%s2!I@!Bm$eDx)ODA+wK&5o-;aCW#jE(5N`njXVWJ5 z9AZ`pVJ7h+?Q2zc(Anwu}|%FhvasX6k%VK!(j^tg@q#t{Z}A|TT(r*$C-yL z8VF+5^LnG)K5v)*FDxHR`hDmb`b95zRl}Ws*XPyTXiP+M=l)g5ckeCTZW0Bn)-z7c zV*w#-QA8*oyP7!Ykpo_@A*%j9)Nh=*KbLTT6g41?!CJR4a7l6(_+(>IexK;ziNWt; zOqf)Fwy_YTfzEq`RX9?mSK2zAAS`A=t4XiHZBzt6gF$GUF29o#m1;5}cM;GzFQqUs zk~3kYBFkYQibTf+)CPW#cxSN4sHeqwPOmzj!Jl(HC}l5Uvrmtgar!kmlbL0oRCjFO zOOdCPlM)NPejl<7S+m_2-A4?w0Om^N*O?ZJfkvnL|DW!*X#7Besuo{qjMrnupTYDy zS9Q>X#&g>8hz~TnSzVT-mw83G$!NdNNNNP*vaipXVr6clqYKW12#iF2#4d!<@k2_P z1!v^2E?gm)@SI3g3E(q3q3;h3RqOW81rzi4`FnT&0VfXQ(GJ!ds z4)J=RKN~y#nW`<@KbHO@*g5>cfI88^{Jv}X%DVm9TLDO7Z=2{Gx?*0lqW+fWciQ53 zniE^=_o3Bb==6c?oM_8*?|Mbj3$?obnm~bC;%ZR9DTA%vQD5y8WT0kwO#j)A(*`@H zYTDXo$hvj0QkGF))Z3O0;DCkV=rrxZ#!N|T^uG-B+bx~$)U?7!_!n|lQA0*6skda_ zv99F{eode^hK4Nc;YMlBOFI@1;G15yoHfT+E|}sg-D+l)kCejea_RPeH?JtP{sUxG zH-A-XHezHIi}&85Q?&bR-=LV9@F*G${9I@Q9EYmIcz>- z3h#RiLUL#XSmQ^&cEui(7<3iY6X4>6*MZ#AS(6xHo#w^wL%X+S4rE?D`+exFHbEnw zik!|9=2x+QSkY>+gQiUiL!%JU5EIvA=RtFXT?IUo_)S1I5t=S85fI7ACJ+-_R=SdL zuP2N&ji+;$D%EF5FR7JKaIlfOdNHv#LM7^<$k&X^LB1iPCIlDtkt?mi@VG$3D0k_@ ztBm`4@paAO<9

M5Oxr?UrruU0}B%pP65yqGV?MP2&m7=>VKq#CHkNF_uy!T z`Ns0v#;xYX#REJw#m%Yhf|R3?_eKAoIh}qd8s;?1u2j!-zGL>enQG>%1KWl83QUq%m)q3ncUX~a!ZaAq&s#i+Jdo{-mma_H3ox%StZI@p zpl9VfcZvU9^wsY}Uxh&vW+&ob0-xV9Cg z$!LI_fNi)dDNw7ln3oXf}w$?a0aPTvQ|7fHEB76e$a`_Xnl z(MqrZK42E;pWm=t>xSH%CQr^#>)(@bw5J{8$~bR{u+? z;UCjW^A`%s?s*u>99_EmVWujJUh+-(0Ahm9K{`Fm>ci;r)XZCmzCyM7j8EA$Lz zh>Z)8wJtDz% zXuM-8-!E(8Z-wCo3UxXs9cE?*RtSPk^>wL0uV|dlW%-@NV$|{SO#PjV=_XN)=?z$} zo3wf=GH$;7`th3t8nyALAeWFkg~htWUDcHS&#oa8wJLa2r6fGJHD})TxzwlU|7P|v zA)dzVQW1G0b-B-cG;DFzQT1w>$P<}i$^pnXC9OCg$USu+>C!^EpQX)tKrqpfpI#`k zRBFNvEz4qH+cGb}(m9@?_gGj5AyyH6aJAN99+B)nb3+hX%w-K}hp6{)q z_Yym*y3W^A0Ip{*V+5vdRJLLBvkvGpyQ5IcI zyU8XW3#Y2TZk*dSe9%9Vt?443b#23^C+^GfZCijt3OZIX_u$;ow~W7|jiT`@Q}5}P z2(zy0U&UwiOeYliH>JtfKzArK8U; z>)7m@8Eve@DsCG$_IwTa%BmWT4h!kM(GhitbWhLAk8o%CoaX(64TtlwR=;LrF8yJ! zTd0vdN13uWG( zU!?TFMcm63k|Lf(NOMjN;8R1Na$+?FJY7L-QO)j>rh=1clOzfuFZ;&RlBh~+R4z6z zZ&MvAt3gGJqtriRxAO1sa^8cG8gAgwz z4t_gFog``q&_{}}8v(Y$!ijZ83jiT7DecX|n)H)@SlLqsG0u@TB|TRAqQ_{%9mOd_ zQXPbq!b-#C9760L|310K)D14w**2&o0?pEo0zO?Gz3nh0t=m9r5@VhU@*CvB(K%9s zuvQ6*P==PVt;>qrmvey{jbScf{@jsN7cHl*o?QjTm(1T7H>~U74BEJ2tP|~qB=T7O zo){A!A0M;(5PN$(0Gy_R<&OKZAuMs+*m|{sQim{D z=jE$ab1LW6?zk*y0y+Z^6WbQoPZ$K$H;4(o9s62DZ6iFduAYBT;^?+ zN52p02yYL*%$p%`2UJ!zSz&wuM@HkqjIx3&b+l0DH)4?%0+it-{mZ@krawy=wdE02 zCBCg)rnaP}qj?jl?DllR34Xpn-lNXSuAS$c_o+|Zy(M%I9L`M9i7)U9Lq6MJJL;q| zui3jqGQC>@)VFn~#Mk6rf$-L;unNQwD7%yiUhJKGd2HV&j6UvebJ-rC}*Z7 z!?+Tp4~n#wobN|a^_?bU9tqn{(|oS|^i4{X(|@e_a7q6FumK6&NrL6hv}kP%A_u{I zXUrEKQDrnqDSc(vmJ6MlwG^HM)<5TyekBM7nt%C4(c}C`(}Qr0C%rIT^AKuA>%-id z7o7{4Kza(qU>1XZ>LLi2Bkh+y!bO;g?RpG6)AWvq0tQp%k^Qb-7~OtqR}9YD9>DK` z=+dsJL+6D%-B$NiHe)u?PNkoeutYnZsd&!3WvE%$|7JXD4RMn8-ABmW=j`kEO-LVK zcZ{vaXGWF|3)5gJ z&kl{~+&-SStA_edNRgT8NO=vl1&y~7>t@6`ztm9XR6(Fd!PIG%R*bshk&+_y8tHkU z`~VdMv5;>aE&+N}uyd@PY-b;hMIO1Ws?{$1JKk57%p1#c7eszD-k!Wgzz{*jh`aOd zzYj&K3Y?sgQ31;F63tO=^qQiLgVGh~i!*XduUg_NWpy@gyOq8pn0iLe<#eO-Zxph$ zJ`!TI=2U`QaF{C3Ikr74N!1=h0E0JSiML4U-7%iGOl{gPD_55EZxNrI; zaa_awFtpwbmHUSVr#$~Ei{&j<-~?EVtnUNmzkdG@Xh&eoE8$$Q)WYE0kN|n`nO|6Y7ybM$C*n(f$pgs@PAm<`m6N_viqj&Q*zE z83O+Gcwfr1Qe|B8N?9gkgsUERkSLnu%H>#*5eIRJYyay-ts~U#_|9Aq z-Y9mve;*1TT~kcG^so7^+qAf7r3R=81ri~gHntSQ660ZB1+_D##svQ*<_{RMcsQAa zskK8Y3kmf3qiKroBr5r*Q@P(Ym-j%ZH51dSpSa>a$MhO}17Ltcsjo9O@y2&KnH2P# z7H=Mj9ZCCrD0{WyiGXo>EG@Gv)qG-u``p!0uZm1&C;E5L>Z4r3?wMeL#5&W*ki4$g zDM7-qlW{n1`PG4wYk5B5y0?J_ng$?NFy4q5{%OA0MXB{r{iX8*h z#%RbDxM4i4P8TE$r-|! zN~##Cc(B9QV>NSePP%kM<>UlVN_@%0`WtNM+1ke4Bi=oE@MqGw&iZD0#$-=W&bD5e z*4>^EGPh+)3LBYuew?$IXJ}m{PHdWz&?J~YfvhSP1_3(wbulXCowc?1+DDdkuI1Ej z+93uhd7~u2r}bpg^wbLXWzv)=`egm89tbbweUnxM=-afs%8_V_6L8lIB~~rODbK-j zgq+HqQy2qreCJ@XV{vp(jU%xTl|vTVH%V?7Bb3qj4J6T7@aJ=3e61~+dzGiNO{JFe z9dlru9LI@tWnGY6S7E8$*6%~Y!o;ZM`}ra9`6b-O8<0s5bA@cz zi;PuRTyB$<7oMB2&v%tB7VYWcNS9X~kV9{kZ#^pVRCM-TR8e&CqVBfQ6FuxLsq%9=zG%?=X7uQifTCG( zK%M-`vaXHdmwzgeS2wu+4(*`TZ{xkn--bgpl?Al|%tnWO-$UbG9}R9#xWT(YTuAQW z4llsW2@{Oq&y)#pcLWy&E52O0#mSA^ARgO|~I897@hLi;wNS)}58&`+glDK6e00&YKT8tS6 zSdawdc-Y1HHHjkCstETSB1H50bwP`3I8{-+{*jSd>Uv>)tKZ|i%gpN&)@Aecnw~H5 zY;XkBOs%?>t=k$k3ufa#xYpwklLeZU-<8Plt~cr{r*@9++x|Xevy-rE%Ny5MRQ3+p zh+p~zwlq@^>!#e~7629>eMQG_nmTKW1%Z8;7*XM~+movp8!^**MjudJQc!wJVrTh` zW5wq2u&oGNwCs6HZStbhfZ!NhO#DlBV)T*djZ?OyHPTzgjnYKxH2)>>IJfCt@XQOm z>+>EVM-H+2wuSNa04Bq8)F6@P)^M*glcUT;dy5GrrJmnl0S`(lMXz`+3+ytWWsGzP z+-E*URV+KU>O|7$c1r2AzKv@=nUrcJ3&~9ib!!B^eMi#=Rw7S4WYrPb|DwOgq)Un7T+fn6=U-hn&wjZYU{q7Ah%ZeC@gMT$% z`}Hn*Rgs?_0V*O(VZ9`?g)vdwe7aT%CsC76c%8fEZYKPndPQZ-?`1vg#QK8r$d?w) z+v6WDFs09jvNoIC(UUG8)J_Mn>n=Wo{7orbc&0u(-ScFR?uB63JA1R@;{y2}=@I3E z@LPp!tf1#)@c6ghwfL%}3S-OT22|70PJQqM*_3JB=+N1qWY+U)irZ!Q26UcXS{LM| z_f95QA(U%)6snpmiJc9!CwKdSL-;APGVAm^vV+GpdwL$XAj1F6nvqY zh0l<6{mAfSEG}G{Keia8f7Mni!&8O*+<;q@@ao}nl{H~!)RrV#^={=kEN%Q&d&z!< zQ3Gau2NE3@f3*A#OESXJWTXjngn>EdQ7?0M;&_@WZ6+tF#1$n02DgOf-?NqsFd`I! z5#4Nt(X||gtOG6;1_R*eM1*xXxCjp}LO3yxV@4|O$uuCrgQ|Fq;K#LBG=x}cYg!Ll z-sKUg|Kr^~uZH5*|9_J~X*(OAOBB`rqv;iu&KG6MEj?aH5EN6Nist1esAq}BUo5DP zk3PPMbBv`rT_!oKyESm$8=%$iAbPYu^G06MBBXRC*RmhJYadgn66g@>@g6a6#S=WH zQp}u8rU=pEGk<;yt=x#i$%hbHLj$E6GAkLCN~qGw{hD~WmT(73#<8q1^l%L#{)D4d z;KhMZ72GIHsKf|b=U|sZK%mdL4pNsYBvLB3;}X-;g&PlX31a*-6ZIHlZaqzWUr`eq zWb%pB{;$eoa8x_QCq|Ip3-oN|V-aFQMT7~SvyCif*3YUVC);FDqxbl5Lc)$F zC)%?f8V4G1qc4kXFzvZNn8iCI8JkxO{!EGo@;VJjZPr4Y&$W?p zl+tsTMi^|rQIb1;2}hJQF^gw6RtikTSsSVHVRdXPw2?7y(K_!Ta6JtM(RGYPBh`V$ z?pD?Nm&PJ6UtQ)51nqFhw<(9dxVTpCZlKkwG+*gwk;~^j)x^IWQWccA1?`$#S@n4xecv>zwQV@D((1vo#v?4!O`BpOAKu{-9z$77sJS%0$&}Yn*I8W`a%AEY(zasG4gh z6cslpD|m)plRkz70&?(OF;Ya)A-ZzZBCIW+7q`swo2eWMh;sKljwaULIqA-pes{{$ zYl?vqfG&6F9(Nf!#Swg;hdn@aVPq@4#>s~vQbfKNsJ-_hP^->0GzM|Kf-OLaF?0*u z)DhN2TSWTlQ0GPP9(dM>uq+*xjsQ$vZE{*4IjhBeVMxF(tA}gT`t{4}I1?p>FMWiw zKxL&5mH|qAqJp4Fr>@2#k*%|-;5IZqPwl;>tn__pA-X9yyg2+rRqL|F(D!GVdQ~n$ zAqD9DUvD?NUteo6n7@GU7V)HaR2j$SPh_Y({C$WU++xS7GCFZ>Mk}vNTHdDkdW>DZ zQ&jX(!4{59SB6UCUYdh^zW)LK28>*Rp^G{x!)4GPC>Y4~dk58chCw||kSPX5(-Ps!Em60x0m3w2`f03hvqD%w6d|0bbZVsdC+ z%(HDX{F`{ejf(Sc1(Fgr_+H9Hw&g?(b)+!eNP|-o)yQpwC`2MdkR!EyqZB(`rCzn? zg!ut`!?+8j=B48sPsmJ-3)$X8SGZhR1tpWhjpDwr=D)NLY^2*)Q2a+|7ZZaC9nl;C z{H(Ic)X#)HOxX_NT+3HMR9vu2*;=Ae8C9>qVLbmmr}=8^;Sugr+TSy6loy*$51W6I ztZ9me!`Uy=$)y>IZTF}5#O$kv=~@S?9TSH?ASVO?*RW!-BjcXW6^h+wbyVgYDwLWg zL;kp!r()jj{EP+j37#zAe5&k+2L#F*;9i=Y%#>`TU!?XiPUjyE&~=}lY1I{=;qX?x zr;Uj!y3n-3elFRz;;B9{&s4)ivsh3~_AW>U#D=B)Z05I38VriNg-Zpm3RVCQ4wD81=RD{)4Gdw=epK1%3s2}=ffGa z3kbF+A03(y+uLfkJlT+RS>7+W$y_haV#WRoY!^vRBHBxCR^pJ0?ff^t4{6~@%xl|W zFsl%tE#Ie4Pvy}s>S-r|;&H*mz4wLN!n-82Q-0RuY3AClYRebul*<>z07p)uh2~7RDa}2qjQ21A=c@~`H@m+68Aw#KW*CgLx z#h!L@xLk7P^VxyosIx;gVl`+G3vskq>5Oe}nQm$-WRfub3~^86maN7}ivL=gtPmdP zi;K4b|5u;~Dc#Lb1XoB}p#fSaANmh{op(yL2Wv`Wx6S=qhV-PdFYybH@olI= zH52zF{3ngCT|-bI^#$C2JxSYdSQ7i{DX|>vmp$Z;4-pM_D8JlDlaH?yH_Y0 zj`O3xbNqsG-^bo8ZpsO}lcesv)X@YNO#-0aG5%S(eFdY_dV{8!G6tc79>1<#2k_)VG*UJkJLW~#JBH)=_L#D zv&i@&$bBu|;6utUsZ)leWr;2Sr_|203-~L=jLR&6yu^clYVYvR*3{)@99`m0WnY(E zF3CT<-b`v2mNgyIJl+r?%=;z7@_J>uu`mTaeFKR%W!jAcI(SWg*Q7QS!@6V?f_D9j z^B+<{oJjP%F_B@EthSY`ZnLAYHdy`tq)s_)_9 z)z++m2c)xKN>i00v1zat?AY|*spbmfYi4MVoKU9-xpntN2a!vmm0ja~ zUlB&)!u3QJtK{RZzP7V)HYX{x$_x@Fo2%@bg{5#yw7mmCW@}dwxfruwZcKcVH_LLD z3RLGwqysq1$Ld^5?y&R_TN^=TWRw5wqZydax}T?0zbRhtS$ zZgv20@iJAvXo`~DIv+>gIp$r{>_vD7!ZK{Xq+yz^6>_+^y_*mi0Uo)M27fArV%*ee zGkI1DQWQ-gJW$wxx7wWpIrM%+E(3Fj1)obFYn2g zpx@n^;?)S+;19yF8S<-DGkj~wwA#8fMc;{tU(nO{&1Cmdc2vI{%67ieKXjGPHPbQ%Kr05gPT)xW;Gccc_`;lFe zI4l?Uk#+m(^Br)DM(%v70?3HObC%Wm#(j?M4Xten$wlLW$4uV$H(=csjuFjsigttr zte=n8dcJ2j)9v?QQB{1${C>?GpIz+286n2w5!npE0jpD>eHEhT8J|v?AVOiqlurwC ziQ}haW=EKwpJKl=mPXs1KK2>jx}N>c&~Y+NUYhWob@@ELM?UP2cR-Up{C&GNDkjV; z6?Uc+x*B)R_wt5wcr)&@(}gW1?%RIkl|4e8!T&1b_7N#rJx$Ltz$AmHm@Z&tS*|)a zmMPGrp(sjP;4VMxbXAng$P#H5S_53KHMAFam*YFE1uqRO%rb^%+t<~g8CAbP0d z)2XyO&UNU-@i>w-Ux-jJ0S^jI0o(BaU21g>3{jNG031lw0U5^Yfml2KsklJ4&_S?c zNeLF6zEd%vaopLu!dj_PeX@WUxcushfe0~2V5;C$3C$e^zmMHh3iXNt@e;_t4}EVp zFyHOwC3n9wFaOy*k0g;(X+hBxZ)xt2--qJI2hFARD&-k#!yC!}dtTNGZ&w=WC)Q0i z5S-RT{5Y&lb#t<&zT=D)HZaw15qjj2+uJQJTi#6VIIgz1$xL?RQJffzH zb&XxbKIid5iFK3P*p%I8h%SAF*QDl~%fmY^^Lk6(5}tjP-a3%;!XE&TD_;pp0mokJ z^{cyUw{M)y!Ja7^mc#mi!ELaSO3g~%t`Z=HSg9FtFGa(7hxBwR+Zr^lFEe1Hf3)-o zvMMeJ!2+4(wVo4F>%>bZnJlzcirHWP&-Y(C+GAJ|$0?x=$qoTXBLRzKHa^)+3zZ4& zoeY^^*`lNJe9)q7ETtk8dFpQdLQw3%+7mv^ zAiaZ;B20*^1nio8vneVgai1?=U1UdX?JC^*Zl{@QvI(i9ymRsk^SmNbNh?MY`f2nd)`ZSK z-Q4OwGAcBPLXl=hkP?<{}e;!%=1_rt?22OA~P(js1@L4nul zUx)WQme>tD8nHWNM|?SL7>XYyGu}=!hmyMtoj}l<`D@r%as(!mPkytz6ndYpwux(zT3(eH^mnmFY_liA*iWMgY{Sxmr#bB;$e9dbK zsVcvsXzUQ0USdeHMjn5cIH=0W^V>3YXTSd=McTaPr{Qfv|{$a%#j_7MsCW3~Xq?5Ot?|q;AyXoMGuqvqlA;u%;1}8hQ2Jwn><7X;)pB zU_}Vcz{xz3xxU?)<*F{4dKNmj-z~ipthLjwE!=g;5iF}@Jhyr?mESucRG|^2bOOQW zeQh6isEP~J&klp!89L44*=G<*pEUBua(u!}U*cbl#8l$24ljk9A?bptzAa-L6~}~{ z%mvxUd`JG5r!$NCmg~_uI>`ZX7eP7dVL2yPV=M+_{KI*bPkv)9|ruS z%uzjP`9}h||0o-6naqBn!_3(cqOHN=^&BDH^yp~8vQ&lq1J)0Xaiz$4mZrQ@MTlDX z`mWY#+xFX1j}{bCLy*e0BlAZK?;T4<_#QcIN1uNSVb61ViUsBQxtS0PUawW6XPDhB zTkH*BuAZ3bet+L)x`Lnyv~2>vpx%U^e4_aH7R5}w4tFE8P+pkbhIIk)`n4?(7eLFV zE`xl>1%FXmDvr3GirrN)HqRCXxhCM+`!xF`DCs$&>2>NXZ6-!1bW?3GE<}9v4S`*Q z*Kj;t!t=)^@vlW)&e75vCqjAWlH-*kg=mPZ{l`n6zs zCU<0Gq^nnTR{Y`8ugQ~_bZmL~kCmLw$3AYf%;V$CnqGolX267a>dXd8Jd;x2&PrRYNz2R)uun%SO*ftVE_R*b3WSBCs5PLQrq*Sj{Qsxo6D%#Iw zTlR-vlys&)5%=%Y3w2;gD6i$P>P35Muat>|8ggs2-lV#VYUV=0GUg_k)#BX8?&`is z$TeuB9|ZBzgqY}}GKhj~r4u|kjAUCc1!8%1sAKug0z5QV>V_lgKy{INMxNU&GVaTL zad~Z4ao{3s@?u?F2-)o+wF|aq6vphINhDD}QG`V1Hb)H;l$gU$2oN9WYBe#L!U?|w78;u}97nWZ%75HGR4ukM12 zGbmq9j9ss71FI*@OVu(k8rlz?F{CrnEIVEdZ8KmPI`Zkxk-6gd6-i!Lr2w9DMWEXy zlXkcnaHgaFKCC8?xckQk(X-wVf7z9yAA88wn9SNZ${QHu8QdP{Wc;dLk^l#5;Ja{d zME}{+2~ap_3~kfug*907f&r`~LP2`U; z&bC)oJDi-RP?p0V3Wh)X8i{=-M{J20Yd<6NGUS=O($0~TlHFC~*S!aWKcA{2U&eBG zLUKj4Pp07F8xm*EmPwImC`RIRxP<1s-KxTMP&mMDUpm(3TGgLRt^XZkxW`Hc5s&Dl!Ot_D7Uh6yz@v$X>>lL8lDpXi%KSFy?`MG06QDVpAaSCZ;peB z@5O4|?b2jW0>|v**bvdgZsV{O@HW;YEz9&srT63;drmOIPB89n-eFQuWekaGUplYpb9}n^~jQSA>&S|6Y6~wvy$X_$d<< zh#oF`da<~-^T)BxQP;TBJsvrlFiDw)R26%)afUJeBowBE==cfmh?uv6ZrcBpvy4UR zr)sL;RSGaepkL1a73J7}y4#ojOs`mY8)Rdu;@aO;wXgPWzE!O91len{jP_M`PTDdC z0t`@fy(sW7pyG7Hr8wsXRmqVzaj8?(9kX2o`~vG{^yAtA)L-Cmqe3AMDb1d-L!Rr_ z3fwHHnErn43f&szZ2BTks-8uRj(Xh32nSY~r7Hbs6}OPVCA)|ajp)pa1skd3&wVbl zu0_9!6Xq23ULXi~v{9`Jmg$jJ`ZV8DV4#IRKa@J~k2d7xE6S*2j37&a`)5>gp zM2okn(n@jLf~(k-S1x<|7AWbpp?A;C=HVIK_Z)edZ5 zq7KcOb;kjLzK|zmL9XIGTzof{lID4y?TN8{dUbbibdX7x-O>udM?(Y}@|XvIw-IlI zaq8wRa;%D4!SlNCVVTPn%~&7G*;BLDqK)g*Z$YZYK-%L;VQ24rzu7CR{0weBrgD+A zRZrq?!G- zn?^4u%5%46U0O6ag%ab!Hcc8Lx0K zh8N{>8bJGu^O^36A;df3lFUK9^sTEi(@F6>)N%FJ=*v5;e7Z_3jf-xJA2 zoDi|X`(|sk4_j6K_;V=r`41Zu?)4e*4>U4mu65jLnV&AHTXJ7PX?1|Q@vvF}X3%Dx zj2v$k$%G*NG+g+)Pi&6P?1LVR#Gk@tj6NjFb$6HtW<6d&KeT`ImLcwgi@Vlhlr>&a zVCkdFT~?d(KaL9)krp8pAw&HYHe*m1nitVRgv6|wq_7vSUx<-<^i&v{P~)O^J=&K` zXdZ>oIKSm;+04UR=ooCr#w4K{L z%+o{qN2NwxFB-Iw&Svq0pi22%whi@mGudoWPF^{dNx846?)22m_s9#(C-rN&^4Tdr z6-{V7vf%p;@~GzC4?1w@tG>*=DaE)9iJS% zb;d-GY1quN&8hRwp2BXKb6(NSb44l0fB5-D0X=v+N~Y%;3s;s; z93Y;o=x|@)i7@Q2<%kL{wp754i4lu9$yhKxDisz>?b=27oXsokjc+v`e~Z3|aL%7nmphgMC~v%Saa6d0ks9`giE<}0!tpS>(fPXke$Fh$a$idSFIJ*F`O+K#%3FTlmE zI|#|qH2tJ0QkFx_6S;?ZVgfSG38~gZ5Fl2vuVt&tf~d6};C9|A!d=Fy?s0ySDpx{L zwWTb|x;6KTUTWCUu}!G~LNp_?oe}s+{=C#?1VM8s3tJ?$6YkoIbqTUIqs`Rlp<*Rj zyANuaeJ9}sO@1p0+|R1yM>}rKTL~JL$wzpT5Y7i<;(ktiTjcKUlN;tZw={S<00X2o zhG;DORioH4g|S(!xDfKE!3K$Kdb(*dU9Rw=B5%_O8HGzqQ^~#tIEF!Z(1OZ1T&lE4 z=trIt+dPgei&{Qmsw5?jaty`lk5l;tv7#f@WQUQN#g+X34H`+0J4-*VEvIH z=f|_`ZdXtL9lcKW-uRDwlIB*^$Ca9l zgn8+_auwUQ0B`*&#VxS(@^HEWic7ygm@ty@_dLD#Vug1{a&KpNh2ivzg?QjgQwDI; zN$m3B$?Yon{1jp8WdCl0!cZQYVbZHJ8(i18dKeR5)DR(rM2Cn z19riw;Gn`8JF_Y2m zoxj|6>1)#Ilgdia@%SB_f0qdu=S0nt9q`>07nX&D*ikqQ{r zCnrTKAC3gdkc=>imqlA)yz;V<#d>g-_;rggg<%SHxdfpt#{STGBk7V#eXk?0zKGxHMX>st5fU%{%9MNdAms)kww`ID`O7rp+OQ=dnE&axcfvY{Sq#Q>f+zDJHKKaUnd%IM4(~}sI4R1eb5#H))ce*?l zNgPxu;Jvhu9KZUend&maNWQSn`8z+GjtHE5EJV_=KC_BgWvpqcmG{VO0~mDFEJ!DrJ^ECV7>pOgRrvv;Nok%*N7Oj#8b> zOhLdKszxcl*~rh3^~())Q24@7HMDB@zr*;SVom;e&UtP9H^Sy^CPvd%jjTOQez`Jm zk7-pw8xlE^>Mx`*Bb6D*d$QhszN%tf1b>i}g+4z>5<%A}Wt475OmRG{dx{7{-@}}u z=@0D3u&IjNc)~C3OW~gM+=0y2qqz>8LSd^pVZ3ZBQ}9OeiEyWA=_B%tBm%J@d+WUF<*q>!5qD0{g+~Lw`#sxSDLAQP_@K!K6mW!=2_&?UDye3X%)v zD%h~~Kkq%9ycr=?{lS+^pz>dEZyKLI(%K8hQH1Wx@@fC0#bQ{XY_diL3W;rjtiF$O z#D^Kt+j`LrFrfV?8i2}`UUx^&Gclv{FxE{2_tPD=l`Ur7Kv$ zlRxHj7TZu564tjxrn;*OWDQ1XL_JWOr7Y2oGzP)8!i{xvfoWzO4rf9lq0WCNWb15I z`sxt9s+CL**A88F_Uv81Mh<`XMp5GlZoiDPmS2Nn#3XJ$ofzD1sG=1+p=o=y*2;%< zS7aWHbk$p8x1MyK2z8M;fa#LNKW=N@WrUYpd&Q5`HG9Qr(<_znsSW5ptdKyqOwq0P zKc&dHskmu)zw#8}vCP9ac^wL|J`v;Bk=`S>@2mKvZ`u?%6clJn2O48sm9CE8SL&LA zp+~(9S9PpGqRHSv6z3)2fm|&zXJowBAp3@~LyfK!$%Cq1YXasw0TB|$nNiM0X*icw zPh`WEf0kH5S&zRI8X_kjE&UHH%Ts9FqHcP#4hno(Q+;Te z_aER8Un`%WNXW3V@g>>lSTXaml!lC--V00T7M&~%aUp3_dh`DCTrmF&Q6IYpsw=kh z>H4~lK(=J$4_+I&&8MbXi@T=Lbd^$j(SRjo%c-W2h-K)3(2?};fk?Co*YNL(y9jr& z!+I~|_!**HWUWR~_+4y(xrm^V=6m9AdlG$gGOcaljK2!bZ^B)DODZbf(X24VWN!?v z4H9#cZ1&lyV83b%>Cj3(9b?I7>dwWzITms<%Cc2YnQ>6%mx`hw5u|0HN#sJ1?^H)~ z4{ub6aFR8=qjFzU3oOh{B!Va51%_g2uR$PYG*qvs7HK=Ejyt7nOAf;F6}c>!$jHek zi7^SMpKJX+Y`t_=NFONL*h{?~yyj@;SOI1lHFrFwaT`dVFIGKeH@+Y#=JIrMfR`Ra z3{=bCG#abfMg17@z2|3lkkn zBW>5UtU%kb0Inc4EDF|t^3h3|KKoE6jG@+YIGM169=F~>qM0UgNXrRLO6Vy24ez&~ zK4x>)5|$WoY=>*<>*l!R?MFwJw0unzoSRjrE)Sy=g$o^}@!{mjd6cOe%xmBL))XxE zbj+{Xwsq!39e=WL0F!q-otMx_D7Ox|IfhdC#8BD_%Ct&eODNMj95uY47EE{1W@3CV zW>4g$VAD@4FVe8nbE+?fhs7e|&7JsC5u8@?(!4`r1Pykt302cgAf5Q-$_Ti8t zPi)Q1D@}sFbp*Ykk(SPt3YRX)bDi`AOY=W53Ss{^tT6+vqv<4Ji;Vm@w5qCJk@Jka z$L%?`ojMgyD~ZNP2~by<^*^GJ$9sHeOmuMYKxYpU2~n9s8a&E@i8T@FzVHC#5&%dF4495C6~p z-;!N#vVR$7|H8!f?|5Obq*I=^#$$&HsaolSxv0G^2x>W5ogR^#h#oshvUhQ5w%PS~ zPF&+_E*_!LHPndmSo0e0Eb5ca&Xa6$jl<#FEjVIjdNPZ~Ds;gDQi}pL?z|m*k<-hm z&mAB>iSRB@Z<3z{S_#aZX$D6a8{p2&6ZKDd&`n9;$6+ST9bFi~8&k+=n{Q+YF%Mx; z+>YLUKGhH}M6zt1d_GH-NnY<+GYXdSUiz4YETe4 zU-A~GV#YB(+9S;Pw5w>C%u1JT^63G2gAyAVfo+1%+dgVPBbSsyWqmmNlVe)0YA0%}5?g)uuK+i24RrtqKywC~e7^OXB*ZXO3^v5n|=U0b&}yw~%_IADM+WtICG* z;Ut_~3UpZKi1AtrE`8?|hbHp&ZP+G4cKdKOi zLuoLz6JPH96Sl^IjwD{rT*5V{`7ACL?8=TMB3#h~0?rKxsF1PHWW!HsmNN2l7b=v_Mf&n->dJB z0jm>5zL$fw&wcs5Du$5hKQ4%BZsM9!rEWBSW`awx7SEqCyA^Br%&$8q-zFDrKbFx& zV_v25j>>_i7{f3F5>1#5(UFvrsi8$C4Sl~K;#zn~9k!vfSk39`#5dgwwOmzBQ~b?} zv00`gY-TZ4@%~9D2D00Rjt=IGgaXVxuTgH@KCeksxrSE!crw&NL}gb9g>O6sIYmL{ zKrLj>R0l}ooE7cuCqb$*WU0SM`t}h>{(i~^4sgsO;=D|>hzO)eDfTIk?fQ6MNq^V% za7lTPoi=ovC1G0oS`5sb|3^XoQPe3CGR6 zFX|A+}&<>9txpUq7fIn3@?(w&n=u@f5O@or{?vC7R$MlJ!3rgb6(q|wpS}$edrt+ZKI6nt1@GBEObem4MyW-T7k{VEO#`ez1=iCDC{&gbKJDA zsksZ^SR1?Ha|^wJKq(U(2uH6q@}<@joPKy1y?p3Y>r>Q+3ZdPM)l!u$B3Nr2 zkI5pu79G7{#mwlagJQt(#w241Ci7zFWqKvdXyY~K7jS_biy?%MQs!UtJ}MTIPI+IX zC34?#m^ERax6LtKa8TzL(*sUgjltoRC9iTpVS+y6Ci6Fp~FvMZ`O)3K^1C z3A{QI=TBvfMEUid5=bQx?8OWmhWN*Ogad>V+573glO}Tj_=;2XThOw~hJm$YqB35O z7@i67#~$#yF--H0$Yk~LL{^D#84+$@Bukt9j(b0!?=rx=ECg3f=ju^@lep$N5dST< z*Qsg?#w8)BS@$$|$D?#t!%u4&?a)x|QbbMi&dITYyEcAmC?jP^>uvXY=k9|MH-vl) z)jm4W5jd1f#}0j-Y~*C1&sj%>)S)2lRbA8O@)om`o{X;Vr(qqEw38vyD@+fQjonvb zgjLlklH`_$A)Kj<4R15Bxun>7NA#?!n)IinMRjY|(!CJe0oKL@b@j+lP4Tju(`qz9 z>ia%2gSL_C3t7=5Q}!A9P*Q2mI=Tvxt3h-cysQ$bBBAo~w2X)IIXayQFJy2vJtggw z2JQE)4I20j=mhuA)Oivo>s(I6mh4Qwh%J*In1j26eQr52ehC&=ScCa70Uh-rOeGV&0cbC0lrM zC>!*R#44wgc6n|KfwR5%A7Cb|F`2?9HC;~VW` z`TT%jx02&B$2s2}&XL$(j8fTY@yk(8xxnqy37sS5Tu^Ru8@7Q=b$6Q`KSX;r2V zy~s1F8MYjp$&hsdb9a$mU)6_oUGlV^V40{SOR>)IG>W)-suk$KGy@PvhChPKML_z$ zDvWRq$^;X@ev0FaMg*e0_7pct=gv6G7bS$p^X~pEeT9K$@DJJ?s%z>8u%puwRyg2( z{BF_B0uvC{esxw-2_mUAXUURGsH3GLjCCM&8gh?`Sand#m$;wP0=(carh5r4Wk%7klh6B;bX;`R*<8;v})WbNCQ+@#qV=YVjV|8l{<} z<()jCj+71tb2=}J6o_ z{SeAe&#t)_-{uI5Z^z@PRL7&!6+mJV?wH09aR~X)!FoeAx;@fCF!qd!Ds+&pGSxNB z)^Xn(S)`D@{R^~4QuT3dvSxYl`wyn}Tk^hEe@6WXUM1rwX+7Q}=P&HwOSxCzq0lc+I zHvbkE%hW6HxVKKkY`;N6H7iOtWg^cw;|H+f+<5JQSHL(VB6NWLkOWfK84`5x$#Kgt zi*le-Hw0sqxMOw#AeOS6y~O%MD3g&s({)@m%vYF%r3)vz6g>_#VVV+emIroH-TAek z6|*TV33s7zOx!mbe%$}O=TVcOG~@+0&ASVdhYRXBU!Fb=mRpH3JsOHQPA5ScVG2WF z`#jnhq&EFAY=85RCe#5LvNKy%_AzneTmD9Xmd$YdJEy^QgZ{o0h@br?WcY@++SDyZ zV5236J5Rb>g&f~&CO;=Qs$^NXv)lp<=mjzQ=q)@WLY9!Q(_hVYGM16x8iMn^I%l?VT1+>jaB)nKp2@&4;1{P8EW4NmdC*8(9|<*a3d zkUa^R&y1zx18E_%*ej`wW>XZz~)~ z=6UG{?hLi!8~TU$rGI=(b#aO9{QVX>?Vf7XmB|sw+I^0(d8RoQ&X6|a9`S>`#x(#P z4ASocew`!1h@G^?zs3`-#_4||rmZX|>8jwX>A++xB|(DuqGa_y{HoGF$%z}B;=yZB ze14zIQO48l#~bXb4XlJ;xp59HTawRhs1)F)L3+|7L@J)v+(vT8tLyA9_zCXlpk48= ziJo(YM*q2TJt$L&fYHdEk~#)|mq)MHakCh1LNxHBmO4nX0v;`xe9cj&aX>Om2u3?p zbOYD+Hd21yB-sI-u;V-I!P}o{=(Kmcd662OuInu^ZzSC3T@}#h6gzto#c%^RcIVmT zu#k!%UicA8Npi500{y*YmLRsxiH3`spw-Q3_;D7rvb!N#pUQigJdh%fI86p~$31}? zif^{%zvG_%4ou|xynFtlb3^^EL){x`N6L8Jz^{*_oE&d&A=&YD5 zQqj)_#_L)Ds%6Cd*bKm|^t};+$I$WHVS~$gk*-AFpA4T#Z@%I`=s^z54eMr+;Ic6$ zd6|+1Ul|&*dEcx(h~|AVI6v=HQmTe|os;6NzT3SGrKLqk_0l57$U|PyAi`b`6b|tE zu!-hYK<9URu9oQFZe+z}ljh$ZweYRWv-RdVHlcRQcWNn)jExWA^nOI)P%Rz17p2N0 zu261Usx~V(Uo_D0cEj}-^Et_izPI|JmrAO{v0^gANcgCOsg}xS;*FQu7rBqiTdET+ z+tbc@;Z>&|=aLD5=b{&40w%t3dIQRuHe(6I!pzjra}d0gPZ_xDo{fi>t2S9lcZ+u3 zRL@tVone8epwZ=!50ffcyf!a)z}M9coIGFw8Ba)MWD=i+id29b#SW$0hUeApa~z61 z6fAAnkKa##n?u3$*WLV5qW2|SVrOWE_O0j+rSVi#4)+tU%^K2@NwvD;Xbd z6t2jmXzaQcMdFf{x=hpML?fvwu0-M#5FM|7Eu)$aAvxyuI(Do~HdqnM%vc-5H>KvL z#?ZA0z9-|Rom}Ful-88K#Y_PlRUGn*_CVZC4Z;X_Ye;Y$_IAroXEc@jde zB}4e!c__Wf%g&b%C)e|CM3I3*iWDI=4{S7-$kEm}m{X${yN9pVXx8W199GR+V)nfQ zame~vIu%vzAH$#wX(@^ppNQ&j+E5wNOBm24rtGuGCS`Cy-B2_WOrpUEpqlxQ1uK|n z6>sf?4;85)cHG+wf)Bu&@_jWCx+K*iUd34OYIOc#?C#@{B@5A5qhb3fXpj_82NRU? z+je30?i@-MvBpN{JQ7n338g1{?x{<%vDoqJB5@xNtW-8B_mnuqliXdpcLKXRyAOj7 zzR?YjQ!xks?vIVlW8x~+flhE@Y(^Ae=im!qMfn1a_qvJXDV3nF2GmE{9J>3P*z+!&{zK0dgnmfzV#hf6iFbeyn1(&o4$9Ge| z7`U4jlC=0{RJd|W3H4KDZM+0_qGR6V>uxt7 zN!u%=z{=3y5>9p2K=kNlmS_Okiesag(OV;eRKZwcaosr7Om(CudE+;b-zvbin8 ztJYB{;$obF6DCM>?0%&-3hr=>*?U}I=IrN-rJN<2emh^l*4=;&X`WxtR371V*tdko z2m1vFiF9kTLJLt=%y{`1UR(|+`+Zx7ACjG6B!~RDtk-_h=Ssd^rU^O_4-r5&o2#EN zpVFRyNZ#Gw*l~OM&cRg;ek@%-^u>wJW`2RW@q>B4Ih`wO;l~5<51T6!XH@N0g3LCw zf?z*{Ebr(GGt)G_S)xMlv3~M`qOXU-bD0&`ZUV45FiqbWKm8}vxpuk2PmZNS7nj!4TLe8bOcaU~wW^BD z6wArMY_F*W9CX`KX33@dD!MS6_P8c1t)ZQi`^4MPs-;62g0xZx?rGBd{E*t7Dv{Q; zdyy5fhO|5hWSAC%BlvMR+x0g)yyyAA3mON1p`}QR6Qsx_gSt5{gwT3tW))JHCG)ai(T!rn$-G4beV^r- zbc~Cblnn?FGLUjut9iK`|brqK*e1oRwZ?iFaT&gkK^H5INB#w8y;tlg~EI zKV2}?O7rQ|N*yvBtPtqtOT@L@5NeTuv3z_snVr*$R32ll~N!=`1yWBP7&u# z4&c)|Zgx`mjvCAiov(2OuC5{H?j|MJ6kmO2Yt20Gh8Em0qqU^1(s}jsO@Ac8CmiYP zn0M%33@`~%cz?>xre2sFE@&wxr`3tq+Sxes1`_(eCnx0f^Uskb1M@Ve)$Aq z*F?l5edl9sV~q^FLhq(p@@Wts%$CdhP=tPv1%;3L#c~W5Z$40;H@5gqm`b9>#Y6*P@U}h)+5GxN;~Br_AuAN20Z)TIDO+J-vBtTgPTP>Dl#?O}(JS zB8KSB7#2cyF_iZOdNj1!+SR@!U1yB-T`QBMB4OluPjEiR+U;23q5LRehUs(6w0A1u zLF(gK0V{@3f+y-2c{ya!TYCz5T2W`&>H%tfpGU zG)wypY^~f-k4CiiCs5?kUn}3t?M`hWG$9zYrr{MMaT-Ri;ci}aPmL?%dn3k81IvUzBjFT);qjnh86xCET2D2kmsZnZ ztVH-kbG*LSkL<`;&1`SA!qlKc|7qP>W(d40b=EA=!mgG1m@f|kt2INPt_^uj5m{u; zPi_i@ibqd59JI18I}JdYOT`pkJcRZ5VV-cl<$cePe|pPGsJqyj;`NBJ;4m4<;C%At zM7m>7#V`J&&3-$Nx2YLnN%n)G1ALF4kLx^o`i`rVxQluy$A5DqG`(36rrtQ3g%N+_ z;LWTMUkI##ak7q4j&JY17I8nxop0FCKeNlx`|=>uYkK`M(Bo&_sRVgGu9Z8F3|*yd z*BNrLvpA}kZd-~W5KDRH-g#{J=zG#EimXv9YO_%0?#T1xjjGq9>BEzeEomDe6kC4# zG-?&n8XjCAjma?v3_5z?Yh{ljgOl?`jMYP8D8sr~d3Sy($yhe0OM`u-u2Qlv(E5{_ z2MZYy-l03D!EoO@VLzwTAu8DV>DQrmwZJ*-Kr(UwCs~ zPq|0T&w}mQt|4x6c7L%FZ4FveTl3PS1hop#8WQWMD&8+iW6+c;?T&(KJEc!fL8{95 zIrvv@MAA1)48EpzZ$2sItohEcO3<$L^!C@FHSdvTf%6O<4V!`U+&j4+9o;M#UEyeY zQ9Ulz$%k}~PNji%dO<4JL%jBtyv%`hBX>fWpA$MKu-I85W}A6!uN!rssPc4l)e=76 z#K1)l;`ngG8lp^`=+DQB4ZQQ!*bQ^$Sa^du2Ft^b(vG@^`yfZ>g=}z4?cVgsA?-lV z60Ru%8w<-i>^Sp(>Rt|I6=*Q+>TWJ6t8&!}hAN_a>rN8HXvl+-dOWZq$=8yaW}6O& z<<$roF39tYGhcpA-k#%$G3$t*kNJTKOUWNv7C?t#K3?}TIMA5Xb$p9^o_3xjq?nuF zp5A>vY!Sk;yD=R%IeRK+KD*`Jol)=0uMOd|Fc~ZNO_u;TCyL)N@3I0Pb5? zPwh>Be>B9eEqmC7etB)v*fF-9%V_<)CV2dPNGkm-c%Yr#|^ojKNolOYyX7qo1Mo2Bj! zb<|$jBQ&mI9BUXQk{A0j8xJR!6J_ri-g*HX%E}1d@kSrAFZ2+5rV=bU_iPHlx}UB2 zG@?@#9JTbX2h)nInUezhQ(kvw%$6zDDZQW6_kmg0>AlDkHN2vemoEcjzuOAzvyslT zCe?~%TKC?o*SoP*Z&|O(M;}MHtW2cz+JC0~GOWaaeT!bx^(x!2M)~hhc2pqh=nrLFXZE1lJy=aUp2T;_v#L8EK^v3 z4|s1(4N{VIr`hLn^?4r)mPPzoaQ1NuK>9n|dy@jMd>uSUW!Xj9FP{|^*+taUe1q97 zfe%F4#iXTy2T5^uYjzR1yBE^gA9(h%M><2D9etgg*+ta-eFOd2FR3)yk^X_eCr0cd z#{Tv`0e<%W&OVMIz`GE?|7@tN%r0W+9N-)1@8}%xmkbt+R5wBb9RI#kmtYr{kdy(g zY{-7u7VhhV{QCu5T!vjj`kyaE;Nr5tn@f@ZX=UK=>uBVR1Y{O5fWm<*ItL>GfxPWq zoz?#J4EfiyCeV{h#zuj_^vk7Oa9@A#|B%s4-@(J#5g^rZ_HjkJv5U(}0*y)krK#Y8 z!qg?L-n&$>dq2US3EOge$47;uA1i%;5lZ<^I;d7T)a{8#Czvq_1-}dv{Nuh71$7`K zi2f#p*%7rLX;_HU&>>2dqKi)x>**yGUbm;O$?X27Wc=W{Nb+Fs;Ai4M>pIt$0qkyh zU&C%ycvofZq<|JH@AADRiR7SSYCbav@F;mi>4ivi@W1Q!(qLOR?&vLf=0m}ibr6Co z{g~k-n#7SB_ThbiWzc(0l4rrn+0|JEXKwT;`SV|t`l;e~o?R5id|~;V(=T;2jng*7 zw%#-9AKRP!JlNL*~O**-*+ZJ3JJ+e5&xg{ zA2BJp|K>lLW7?!|?ots- z?m762GOT8pXRABKayjN`5T;(CEBIl+(b$9Q^*y<*`QX;a#KYg=3S$#LMN9dSwtGxw z8O}4)#ysyV;~pb9%!MT)%6(U5Ntgnhih@3NRkToYz zP9IA>y24DWbp780Cu z!9C&wjw-t2NFu^dZMfDq9R9LBA8Pk)%DZGO5;rWG6Hsc+{7}md@~*YJU*C{w6d7>; z5rnGJ6DHG|g7z{wzwCQ_U+-4API`a9eyVXX<@`Xl;_=J3g_CDqVN>v?w*^<%Z&>i{ zZ6UZedqf_njhb!6Gl0stAFm4prhhGxZjV&Hnpr#{^Y88@_CLFqq?qLYm%K~-f9G8- z>AI+Es^l?0<@($2n(`gF(n(S{zC@7`w)m9rlUL2l|76R_T~2`sy^m33wY5=W-AJ0h zLiF*aM?q5*T=1!>xF&Z`8H1}RxT!xp=FiwywcU~RgR-E|E*6`qx$iOco-(};p?6m& z1|vVmEILEgpb4>ZR&3Ig_TCHboj-X?&cvd1nuH^69Po$k$iJ zxJNPnZh7(lV)_3ORs3uGl@^uyZ;{txqU*bOm#TB`c}@V&tVGkwk%gLuo$@pUTgJ{a zhf1r;WG9{c{d+|Es=~Tv(DaAv+aaT&KU&;s+d59EXs5cRZ8{sq9);NWjy=0?GHu$` zRxoSHWvsk<%b4wWg4bO3p>hrlJzWJ=%rWy1r*C7P&VlBjXGO-6CdOyzkY8%;`tjUT z#Sw0@IzFi9Mh;A9-l-2Y2N9Fw{9LJu2E^t<>F*z@u*#gV(7pX}|B=QwsGIqFlhwGR zac(laC&62v`yNy+fx*``AefLZX`bsOT!amjlV~cPnF7~Dric@= zxwl9`WZ3Xq*|~K({%4JrtUtTv1_OQ`O<&{*rMM*y;Lvh6jzD2HII+rfl*qiH)KO}V ziHh6MPSeU`$lWWCb*M`oT~+z*`k462JGpD5Wml_Rh~tUxI`4@*rG=so8g|~lM7Xag z{8-`XF^Z~M+xgH~`DpLP=ttW1(-kFk)4C-Ch2y#ED68ihQ><4I&kS`-c$V!B){|*%xs;{H5BMBWnILltf=iYt8~rBop!TrjaasNE)AVwV8-UsUSia=@E^(2B@^1;`@m zG60T|`bVToP-|e11Q5E7Q~_=~~~0H}T$ z>VO$85y#(){U`KrM+O);`$K%a{d|2c^(o6P0`c|o^*8dfcXYl4{hAPnntgz?(IEg9KF;+zI zjPb94Y2`Bt&2JUne_(mq=Ylg+P%4cLh1-1-%w73eur*md1M1ZJSpSNJsTvRLS~{3? zkYe__;a8`Z2O1v!{axiHi!}{SK5exz9a#Fi=VxZzcTVU7^p{|w}f(^>?wM$c;o=%-?t}L|M;|Schk>6C0 z`$XTb7siy1!7$cE>(>1as{y9p{mPWM@-b6yRl)L|FA`>2#}>KiSQgEsR}7?A%;Z-z zvHO%4L zhA^Qb4R>k!81e_frr-DLKTtQp)r08N1FHnU@-0k!roB#C(s>c%R3cZdJRWR6IImwjV_sm0`OzE<=N$gZc&jTry7suB1*w7m%A=PP%RDl;{kHdr&SCg> z2A~ElJ>bdn86!N-nknh=rPR&P<*`4o_NwWx9nX40-OJ*0l+>}y__Wr+5V;O2 zv_OBtLYPMdz3tKg7r0wQTknhYH2wloIvyzexoQWee=)Vi=q~lF$@w6gF%e{~h0+s| z*1US<%EtHhs4jZoyl9l(9@@tqP9J0st9s=C;|I5;fzXTG-nF1acET%HG;(iRzdWyJ zzutytIqkXSg5+4OB}Ok{$~H#~o9z$aTv5Pv*)x^>m(S;=0A_VRU&iyCIY!PxLvK+e zN?DhdxuqE)gHn_^G=Qt7eJS(Ycbr=rM6hU~@_YkdJwk4KFR)P}o7??bTl~b;5@Smh zGC;a86pHDQp{*FO1W_R9FX4y2*q(HWmrzZ-qvhW1<%ehd+4LMOi;7(BiLw2Sfb#EX zp|ms+0lDdIM|A7*J`0z!OWwD{5BO@}7r=QTKj*U)!s!7bI{EkO$L9u?>+$zW>tJP7 zN`}oJG_6n4+faViugs1<5r6?jI)v@C$$3gEpGh&;*uuOX;?}?YoXKh_0P!XObkl__tRc` zaP)gcioJe<2lhqxQs2K`ik2q!x!qw}w3eK<0EJ3qfC3FsCW_V1!VEnt+;s1?=ItVY zKun5? zso;mm?cGujORdc#IQza4u{kii#NnNR00T6jQ|f3mV)&wz-0ogKtFJlapRXf_CR$7Rnik^|3vC5S0-;? zhC5woY3}GI=Zoqye@%oT@|zI+eKpyYD@f^Q5KVk}MU{%guO4QgL9Fyd?~6C;CV-a9 zHb+6|X}3o+vaPq?{Iw{2srg znO3h??s}FDvbIODj&%e|rURW`TsilJp>JIZ^9F3O9cp286g}4t2vc{yGBfemhtu%z z8(u~O0d1xuZ=qK#n8B3sgP9(fHfwdP#E=DEz4BQ3GaSfwqo9^q6Aw_+a{*46CceMS zO?QUClmRf;CZ@{O^$!ila)hs3F)-~A0&I6OcPqE+Od=OQgI|flbe=$VaXxo0yTw!HHUn+( zeN&4#27K{xlwNCnI(AqC5#h3b0VJH3sddV4V}JB?zFewv#K?Hstu=263A99M;JM2; z@jBm=8&zz|7GIzHD!lIr0tC=CMwv8<0iuF79vp@5Y$eYDg96I%5UrptzIS`v1#Zg4 z@@)-hU-wrPeP#U2mwpLjdv$sljFOt*hq4O6+=-0V=$!!l%REr#_QtSzWRc;Kz!@3k zl`AQtUBwTyfu8=gd1&-U?Bb^1&D{VMuL-uxF7;Jb?YVo;&^{5f2DBS}!Uf0#MdjVu zezB9xRNWx*2N4(A1_3-;64Q>QjTN!lbJU@~a;3_yXbI?4bh+E?ZfUNSO_}nKjLiqT zgvlB}OHHuFZhn=kBM@Z#_P^T$0AuZ^H=}T2! zQx2kNxRaN6)w)aJSGX`AobIKmRl!*buskO{4?CNHSg;KOf|^clo$1%S)Lm2sJ1p6G zMJ{VBseWXUj7=9vDq1LB2^imV(X@-q8$fDQ4$#i9#%EYrI?Yz8q%&GOCxC>)pn!u6 z>mzVt7S=En5E7LZqhLVbNbuGKIqSzdVbm6&8=>IlY~Z>^>DbHF<#!bRVarwr2=4?f1fn$e z0i~-%>9dl~ljLKa2SA|Mp`Iq(lZT^(6=1n|Acs>14$RQ|9i?HxdidUj9xn6I%^LVl z+-J)ZP1Lvs-X%aPWH7IjqnF-CAaR9`C4Z4&86oZQ>&@88k7>5d=^dWFGTfZ0=kO(JYP=ca+N$BEh0 z3w&WY2QUpVT|3_3X1E80w+!r28UK|lemVW>{NTJb5Sjoi(WaFvQTWUgbt}%Ig9`xI zsn>*9tdF^*M&2lB4Z^~+5*~YV!akO{dCx#Qx&Z?;VDv|qP|6&z@-jD*ed3>+0%g4{ zUK4-nt@l9QU`D#8)(;{{&B5w4zk(@jgVj%dJ@s}7o!*btz?)xhyY#crwC)?14s2Z9 zT3_sM%?B{rOdV}kZ`wOu_DT|Pu>E}@$3@{(&lA z&X8mlVBCt-YbR0`1MpC0CN})RzL_w%Ccg7z^##51I|-Pj7TmHE0#pfOJeo<9Zdl06 zT-7!-=o2dt3~Qp5R@Yt7Y1ns$hkh>mZj=&js2p0%Vp)~x`EY&Oy2+jas`%CB!e(7 zn?<=BdN0)FGO1kXTAM*pBf5Al^9Pja*zuPy*Ord4uPm`zl~oU%D*2q^C|mjzC2Q^h zIqpCU2wJ-bS55c8rhlfh_`w1au>J&mdt6g4K2Z9{8*H3KdDS|l44u%Q7|d`1d?iZIVG{cQ~(L)$r4 zy7~a_mu4inO$pvYrq5KvP}^@^q(JkA7tC=)!XV^3>Sa4{WE3Jg|dnGUEFp0<4=6o?qz_uJxVY2lgww^QrGQ2DuLSYcNbF7&S6qBe zb~jaiv^!GS^~<7mt{z!=^n2aZ^!NU=JH>juU)XFDw+sR+ump*Og`(q!v^8`y;;g;xH_G(`E<>zq- z;Cwk4d(`P0->(m>rhm3~30sxo|2iovb=o^^p%a%i_I2{z;+H8Y zi$9}AXAqp(1j@5Gb6WXMb%=@8k5Qu^Ny>zhbA_`@g~yc>(BN<$lRWc6peMStGbdj~ z>XNqJ}%qV+ddK8 zeLL~)^{M3U_QdG%j^5eUlx^72S5MmsGYPT`5DZn=ToEwWbjPC|q*TDDnAe+B&(*(Y zaAb%qd)3FtB49Ypyz-4jM(aom@3Govsl59%(W3|}VN!OtIHZ4qt@CICwLN<8Pi@tD zi2cW8pN}y+$z*pO%-V~WfsWFioZNe0k-RxMS08q~IA@dy3?AN}%Hk)t%c>}h4mEB` zwCT}xLGEeeU3`aB!5*`2(*sqk;M1&mI$#h);82w&7e79ny7nJUEDt1NPrnqkxw4Mu zUVA!II6GB%?EKPgV(43C6~5}68)zO%BlqfeTNT1^Iu^{7i+6UM4w2MCG{K!!_IRjR zEaZJQGq5w9u;P*M{c2#8Nx=p*P8*#)A%1uIh4p*#gmc8>E4N%szGQxDem+LID;AM! z0{}XY2rPul72vK=v6)({FuEz9stjH<6c;?R7s*8^`((r%Y2sgo=|^nm@4E*j2!q?A zK~mXt7?ZfXuJg_6KdHQgJMN7#bxH=FD$^DK!!2%3m;?Zhj&%|D9S(h5c_rE?OLb9{ z3gWOkZ({YIgN{z#{Ha+;0yyn}3U?-pQFXRk;WW>(ev~~9b8#H68Gr5~4B(?ca!>i6 z=|^Q%bwUVj6F@f9K`Y1>U(_O7KLhE(?J@A!_4=)ikL4!@Rl2p8LN*jik(uhLHY^$-w813mG zC|-bR_U0tuEij4+B? zq@T>xq55@f20}0xdc{y2b~CX*sa|3;6FdH%PRa=BH9H2YspJPd=n_!2C{j$2F&EM2 zXdm<4lr?-{vG>J2;xz1N&Llb1@f>xyu2+?PFj^X+vWR zRNiwop_&N9*SK)wJaY#n49iW+|@Cf`}Z$zsve zcPTwSqukBDSKnbKk#fxUyt*WkiO?k{Z%FCSR`%tzQ5x2Q$`Z>sH=~W{^4$Lw%bd!% zJSH=(jo3cG>IsW9DxnRV`_8}K-x`A%Fn|SAU}M11Eu6)>2)i_?)U*B#=(m#@AO>o( zjp{X`YqGI}GAsM-M79sVmVeCmdDIH)vBq<`#QBG$UVP2O0wb9^agFv$ z{_M-Afsw-9IQ7tfU@>trqx5C$uf~_-uLV{EL4vG5>iYg`U@6?xU>Ky77ZL|*QK>U* ze#H$%y@}O8Se93rp;g+@^gbRS3zS#v>&1ZIGa~&K7d$`_;K9GPrPTTQ4|1U7A=pFr zi^U%aSey?q>pGBB&k1H?oVrxyZ1W{HAKiQt4nU7`x9MXy)sM-IUF>(a3T$V7oJ_l1 zmJ=R3wa-M>w(j}gec&NKC+-S2Ed)jn7R3SpUDkcg!UE)gFrgK0kqa2|Z8h2t_b`Ax zfspxPdK6|4OaflA7(IPGRj*2DB>BHsqy=V!T3&@H825m@kAdQEi38?cfOWY4N;qS# z@c8JHH>s6{2%m~-bw3{#AQaL2=w^O~Xs$g4|h%iwsnm<&W= zUv$1$xQuTKWMbo*zOfF!-hR*|=3$#YT&;`JvnhYO!tWIY3WTEcD7Fnt4ImFJe$qb^ zDTp}2R^fyH`rfIW5GOJyt|k>5Q2AGudw?4%1PcOsd43!=76cmud4EsZ5oD5jZ@-Yt z#ttjYz^2P=zh2wqzrAa?SpMUg2(mKJ)@+&fW7t1x&hT72ED%CS8A<}q!{Y%rZTV-Q z2kOH|EnifUY)eNf+yXR*{Nf&fl8j1Io?gzqp){@Wm=i!>Ql#o_hX>_}&xEbD+L88| zo0lqsH5+Z;P`*F*&4A8Oa{NEJriJ`8_`E!>BMtW+*_n)Es&LaD1{f%?!&tJhv;H!# z{d^;O8iWfz0cs{=^?AT&f4 zeYJYKkyH<)CvE_1dsyzqK)$aE*94=0pDeamJiv@T$NrVV8-V`uvD5swo#2;~PW+#V zTOaB_-&4uNIH1NA3O#cR@b^SvTzB#rtrbwK7>hEXq~cO>j$oRk25)VG%Hiw8^ke4* zfBmTcwyVVHwfdDDmaRijVTAnLhX;fgz^zdE*oB_n4!h}kVEUhlM2tcWRZslRoChvh>XOUVbouQbx3m-SeC zN3xs}DuV+?r-ASQy^#7l?Su*`0D>XyzS0V^9^g(r_3GB2ily*-4`6^7(g5+GApT6k z1-+GtO>f6?0oB9jcLqi$IqM(&t+`piHE@(+X#?h;+&=m-{b)|VjVMzG->>sUj~Xl= z5|ZiVBaExucc^8HxAFe47*8$|xCO&L^CPF%1VO+b_&PVsagSL0+;g%ET`$ka<2 zK7VDj?l(NtFxl4#n%t{^d%N29ykz;t4wm=aJ)|kqAT%_t2GnSOGrRUUEc24OVX8jT zi1E5d#U>UA06b7xmT#^L{xhsBef7KXzp?k;UrlCF+wka&l@Uh`A~0A$N$R`FvoY!4b9Q{5R1VJcFyhFL7JApGu`V>dx|V4gAjCv zWiPesa=tsX-|9Eid=8UOb4*u*5G{qdz-N zPpGn*mR+);`L1_YQ`>X>!*BE@!k3(cZ-Nz7Qmm~~(kNt~*LnN5m(P8a7N+BvF7w~< zJ=Nl#cj|Z_ZeGP!=pVsoHzSA{@KNdQ#BN`|t^;UDMrf;^=ty6kO+~0vEWqGou^IDV zS6^I9iTjazLbqO8xZHic9>5A2R9s5*Rau(|0-M^rS(y^r0vjP}Ozz&)Yjp=B5mLZI zb9Zk9!7UIeazlwnlc|Am_J5E3XvV-kyF+qfk+Dd>vn}*{+jaN08ZlD9!)Wv*_2eX( zrt~4s;di_)Uv@8!!YMYuDRSuu=a&08b)i=Hz`~ooYq4BCU{nQHSsw>p+hF*?l0*5< z`$@xdX>Ulnfy+CFOUG*8NN7{ z87-1s?&BHxLm4)#Un$16liG18QVm@r=;2d4Zz0E4AkQk1G+T*i=0eT$chiDrGJx6d zlno^Flf(;?aCU+2@$ZeBULkbAVKeU>lfZwwoGVan-bFK#W=k673jZXufc&Vj>iawnetxzF#PlmxCUj)1Q>zHAYY8FWAp&w@^OrIAY!L^{cSq> zBF&s1Sjpf5SQ~CE*d1aPous2F)T1CqyV)gjz4>6-Fo>WJcPR=fX}xDT#iSII?4<-a z#Z>NC__yS-Vzgf)cGSmPCj-jm8h7h&A-i=@Sh`!#uLO(R(o|lc6bZOCF2^DavIYp! z`)<|5(S?$1O~T^52pq{tB*jL>I)SMovPTf2iy!bF>PX)i)P7^HiS_^;R*@>_7@AOO zryBpBDz?>{bxunJrFVm9dl#&wJhpR@`7AhBP}AKc=8eCQvGH(L-k5igj*OSRJ>`)t#rNk?K@ir%~{ z`>#F?ixn62;1}zSQ6}_jc#kHnlP+Myb&%{`d_U0DBRQyuz1GIv~Js;jVXiE@f24_{FNlz z2e0*}!%0`LI2#Fj4yj@S6zttZ-^&RTG`@ zyg2Ee{I4P4BO=(0D`=2zqrVa@_$+YXv`ID2)1K~cPtOl-W$x3<4M)a?fUW*1R!-&*2QYNd z@H^4fA9Au<1R?8+Xz2hH^!0BHfBu^Ddl)G;mH$Dx{+}zwBqov~P16J&-FAw^UgtWY zg;1|AGxju%Y>+K?vm7>EHTHhbjp?jLN|&)Wy&rmxcl0gO&##fuzl70VK@clzs8)R= z3cUt%0NSIQF{?FUBte&U2@in>Uz@h}@nFT3AtLd##IYz*wj$s3{P|d#;k#jC>@zAEC(B+W6hkXuaJZ{gHA%KN!`h zG;O__$Qmx4?NK$^TWmt%bK3Z3bKl~QDY~a!LB>|XIa~*yL#E!xbk;YGlSYa?&xVs; zLiA8XP{&w(uUgYHT{HFFlU~etS8goq+lxHuX ztXQa4xj}FJe?;~rVjD9kro8{k?|sV6`8gFXv#PnblqvUVq0N6`=av6mgTUPl(~aGd zYZ3z6ja0i-OT{z{GPaPh8vzz5tJi}TQm@SE`tYo@9h zd%Bnvc_($UY}MN2jfcmO0=j3Bczxj-=ewP0!^o{qJ=MF~Kbwa&O)HiGAoE@Cj|Si% zUyki+Q_R|qB|+c~=?f$pv=?*3ix0f|7D_7a*8P!YY;<1%FAXIYDP_Wyu;jJL#rzs< zTP(Fry5MH>PWW&g z7s+|Js#Bzt(M_U7JQ?@#Zoxl)ZgmvO`9`f<9YqM@1a`KjSI-;)$gYD_q5#I){@uQP+V58g&WNbccR*BMVvw%0?gftQ1`rFFwp$nNHFglo3Wg;8d z%&{c?e1LI8XHXP^yP^p2I*z2g)kYI!FQh^=bdvg-}po-pBlUTa7gSJY_iK((|{)K zUWL6ZRc69D^{9M^-xC_nTrDtZM(lWuH^0J2fFYAf%GAbN27@v0M4HjoyNy>o^zhLE zE2aBPfRTU9@YXfjQ=6w5`)JduOE%g|2o{HjfSCjtU8JPb!}!*Z(^{#iX(KE@F9(1n zyGswKFGwnKT4=x>&5)_up}N~2Tq8%H3)uGs_>kmhKgyVPYM@=J9I;6TGa9qiKW0z` z@+=x?Te*mm!t>J~qteO{YLo~~NOYU20#PI)WyAMv3s3JH7+fj2`@+X+b#sQCn^PW%pTIHh)_o(VQng#@ft?kE@Tp@DFqeZDGMJy zJxVx%(H;dth!4gTIq7OE@U~M&?elK?Eq6GM1Xj(L(}3gHkJrW7h1g8CH%1Gij%t5F z%vke?c^h?P}m>Cffz0g{!WE?rPvQ5{^%#7?E50R%fl+xeZBh5Lwek zs;l&9{L2LDW#`P<{?~Htqfpqgfg~tvo)U{s&98B%8JzyN&|sylj)samSFwVgvF;^Q zs=Z+N4lXfTY`O#puT1Rj19j!lnuDct8%@6GOQmZ-}GFNf0v)@G4-D)j%BR*)Aw6 zHimGm(?DDSpFt#bpR`i)>|!E2bBHW+z#gJV4p)*gPf-&0aCegt$?_K(=?c229SHyA z%*c>3QmCVIUoT)fzZe8RUq`&SKctJ%UPEN3`*4}8VQ7q(3$Mxq*{v`=Uy!kU-E!t~ z#utfzn+mdenV>=QgFkO-Nh40iH&bOeUA45|AtE7If%Id3Bx^axnh!bS$hqL?eJd^7 zvHHF-M*9hbxu&JMmEQxBl0p@6)=e%+EgBU6Z*2b2JJw-1R^6bUp!KvX|Ju4)(-7P6 z9izmg*E#R8)4yB6X>-tQD#zjv<6Du~&Y$vquh;~6ygI}>XE^(f5lPA*0hmH(Qn$1; zB${U_iLP>|yXEwFY4}uMD~qzbQ&&Jjv<3_>=*XzQ7-P!SpB`qyai7*5rb?9$yrti ztR?|n?(B&jgLV0U6pf(uIXwx~BQUFQ2;(Epce)VsO-IkR9N8M`OydIL*&U5nKy_(I zv0e?|Av~*YB2dl+&-h_@pcJnY@9LhzUO^gqXc`MYmJ&L?8vCSUb_?Yv5JM`4K>df* zFi|uqQy*_RvQqKv&dS_!;XCKCRqN`jveFW{s(68TlEe)gL_0!U!8mPp6*2TaBxg)` z?{%q+-V?-**_z%^CJNu+M{4VtF8V#S=M86u8NS~Na7AxLy)p!g-ZZFcMo`nN*YhUU z>QE9sCC!19f@cp97ZdJu^}|oH%UN-Vn9FHj3|2z(xS=XKyl$AP2j1olBh7-&8-i+D zHc`QOZ^#rpCB}57J#Aw49c1_X9f`~^!t0`wLYvAzC=n3Nk|y64z8*-jnb{PPjow4H zC%)7`i$)6;D|nmBp{cWWTWexi&I}WLza8xDfui1fL{(3WGCspjF*KZnPX?%~4`Lmh zAHKS8)g7a)BfHl+k+9c3zKXCAXLWPr-GSN^3fpN9Mu<(UTp)#igF18mBst-enOihM z2MGbfXWh;puRnQ=t|FQTmR90q{M>*bK}tvyLQkdeCzXW?(==|_UvUUgL`wp_6!q#5 zEP{d_SL4`qOuzm4@Eseujtmr48#ilLpyRySAl%;n3S90|>IcQtRO$#6(WH(^Dzb>L zv9nI4SZ`#SipDZcw^$l6m3pPhfR+?ZFqWmz;amm04b(%wj7O0e#Lzh|6!9%&?tr)O z_*Zzw<g|nRz@1N;`Xzt88uUO-9@!C2-#2U-uCQ&Yc8imT^QVYaz-Kpz%38y zo|7Q#QmC>@C715bg@L+P?w-$K!I$cknT#W~tU0+{s0+8ywJw^qE_|tJ9u?NYQmp9{ z%Z(il2v>8wA_$5FZN)5Vv!4#OvjsN!2JSgIt+b4vkLr$1Dj(3XOQx>!B9Sv$i0m96 zjNux&exqtG_hjJ%x3msyL`iT){ajlkB%4l7!Xl1O>{5IFjKACCuRFBQI1U`{Bpq4q z+xWTgm2w?}5J5SFR~ug+oH-Uo(ojJ=B`$1q>1f)PemIPb9{KU$$!o0mD_AmlDw0W7 z#1!}a@j|AlZ%bWS-V-s~LmIhkT9T+oa*QxTAMa*)==fCs4)!L#$V=WK8VD%2p9A0g z0*V+0S02mCCYl}`(cpm4o0bM5AkQ|E>%KxDp54_3@0RMjvpJJ%E{FP>EH-GpUokPfsaG-3os8Cv)Aqhn!RuoM4w5A-7Z-#wyiqb5Zjtpwi)e;~q z%}jUd{7I)bg>_C7;3dmFH*pTpzdR!O=9nE@81ho?4{|&61BM$F;|HRzCg5$AwlYY-g zNqYv^kzW^f)zR(yUr2oNDQpFek;5&cdRr#=j(b!H)M}NWzT08owhjY$P5Q zNOhi!1oG1irtr#1a(>N;Hl_QuD?82YCUI$|_t1DfyYE!q%U1oC?HK!l~ z3){fARD8^_j$a#1iF4|ioOZpQe=>^XH-QzG>Wz`dbKP&^Ww{Hr`Sux3E)}#KD$ef_s4|zVZ<*Ww?-!oKb2g(go-@d z26p|F&npD#ej!nS4)T@rJ-DDgRhQuS(McX;fnc_M(d){%aj76UdG-9 zex4958aT(1q(uDi{2Wt!EJ;KOec+={dKxz-;u$ILnF||4Z%~R>rl?Ep#5w#BJ9KJo z`iG7trDg7`ci+azwbI9)3a-{^$#&*eNMtM-;VZDqvUmoSfsp(uK3kfWgaN?kQ}8A) z>m4%xA=LdtQ&&JyInJX_6$*OQzWw(ZDaunCSS7w9Q@c+F?*+yY&}0qOJ|&lj)>aR# z1EtI(2y^^As8g{dk|Okv^P2m&w4rW|YX+=|#J?eVs_%U*P22x>9O-XFfR9!88u4xq zFl0%X&YB5JGwf<|vp^gn(MQ5AWaCYFaFS0{k(vFMFKAYYIC_~28K zwt~^FgtlV6VCe+F{^nINi1rv{zZK9JV_zU7Y{lQbrCk3+%VeKjd%siJegM-vLMBt& zv8&UIO+4Gr0#1J%KoLE4waHXwOy|Tmz@lYt|I!PP;&mg0|nTB2YY>#nFr z0PQr1P$t~2PUn4e<#^P>d6Zr#$pIKSESb_!w5n`H?HhVH6m3?e-MNcwAfiGSjJ9sl zXyAhCl)ZsOAh^0HZbbDX`(xOAM1m0kgtc z&;A^fgSb;sBt!eNBRE0Nw>{g2_Ej|~h(9G_Ip&%!pzgbe-8WuLyI}H%JiaBGG#Mhi zLFHmOI%`$g8UVWrCH=P?-&k6Im-0snq@CBRm)w?bbt(LT%znnwh?%HY2C{&LKMWzI7rd4jO-QvBR&2l0vEA=pWmL zBGirW!_w6}cMqXbn}`&EF^^9kI6gV7y8hsglY%G77DTSp@2KSiL<_exZs5%*6O@uM5#uDK zeHcVO90-PJBIammyw^uFHKHJclS|D~KVzPK+5Jj$>CvPO>B09qP&JQH2-KywT;*Rz zO1m1ZmQ)`(_X!ndPUbhifO?WFT~NHY8e4Vi5w-Gq9Xk#~g!`8m?jm5^Xi(y}w_U)nvULPt{xsFM3yBJV zW)FMe+Ze`GoaWBsZBL{z-*MyF;~W?NMil9bmD{9R2g>}=7?!=Oc}D3ZC2?Y0ar4a$ zWJ5DbNs_TwGh8+&@SSL1xs!7%2x$XiS}o{xe*1j|@Es85+IUf8Urb>v0u}!2MM<`g z{ClJ^;?M-+Gk&bbR%^^^Yd1<}(E)u8b=-19?u~1%7?91=AiECeJp&b_Yl8p#aa236 zw=A$r5@xlu?3-WKIlHpik(1ijP%aDZmIp@~%^o0*=1VGa6e^?LP+{7PyEs5pUkuKH zri2OP%!qSG&0S|&QxMAt3(M^L_jU`EfT!?_^Rrj}-9FuO`T|($&$sdWS0K@8O*WN@ zYss;G>Wk>(=VVY7hO{(z&3w?ZTJvl8~Rihu?wpx*W$gvD!NScuzEuL$YGy@_K z9?5>!^SHU(!|nd5vo@^AE&knD4T@}llioncnupE2ut6sfxf0lB=RGn#yygYY29+3) zx?4!0qs)zd-;Q)Z-{qOvvry*LKl$rLrOhSEi=5k};k1E?INA<$q3e-90^C$`6u%gkg)$nyKO*$suDuBZfRyemr+D z_s{EqydD<0wy`laJnJ~Xv-ik)m{~^v6<3wW+nP2vMZ7#v54adQz=lmfk4=?HKCi^~OE}{wQtlB>6_yQh*>q$F4AR%uG6N zSW4=)GKD22&A(BdBZbP?z~w1FE6eXyKva6rVXIfD5Pv3e=kqCU;QNFl8*=!=@pN1H zS4ZD!HLXt%`YT?=L7At3Z~<^Q9R6&R=YLF!hb9{dVgE0t}PhfD)HF=-k zzCZAi+Qubo-v$iMXlMZrI*RNs6;cd@EW{y*16K3cy-60_nYrEpPUMO^-66cM zHY7!Pz^&4{C!cw4Sjasbh$)e0QKLkKkHR10I(Ygg{>-rBgS#QjI>M;3g2T#p=x&g< zR{wQF*xE9tbMffe5l6#ytBS|4m`yTuXU7ww1S1piI7_5-KB#uxD6(Il{j@}e7hX3` z&O*+P|0Uy|g}%!T!T}t_<%+okxg|>)w=I4f8mD9&oXv2O%{fB& zpGirkm;0evS}O&htGcx^r5p4syIGhMl1c0GIHFD=l)Q8(y|7(i9PtL&E6LUiJHLA# zA8zJGS&6+CGa-Qa41?MabOZW9?}p^>|Hnc9l`Xhq(^Gx}BmNFN-Z5z&)B`AzM3JsF zQS0;g_C|-FdO$~$I%Q1D<%?2qPuSua36)Rd>QjIOcU41!(cS-zMO6L^ft2b<1!?4m z@w0rnVN}pH8s>Pm3A#1yLR#|q_Rw*L1;&(ctzc;JuYSRWitdRXAkmBmXclw0i57Np4tM^)-?U1Qz^iGQ+Rmx;Im^CSumtXvT zsy=uWWZ%Pu;`0Nd_YyDb|Aa{R(mZ}5LfsMXS2;1c$Qem;vBJS!4|*R0w|pf@=Czv@ zjk70wWPbIZzr|B*wf`xJ4iZAkVpfq3&bN+2UfR$y-BV*Y+;>DyV3RbF{hgZ_UiBJcqepHIhp!#v9#du7lsh!#T)jx z3-7R7pck7r?F4;-STwPaz9x^8v5=gUyDG$R5DxUJDWTo-;`z$qRm}(=3p8 zRicb+?Mfl>i1T!(r(nVt>z8c{W*7KL5bFZFdGf|zV&!E`RE^*c;KQYH+jOS=#o2$g zFHxFIU2KAle@$eF&*L>_)>&6*1B3jpmhe)I7IETJs5>o#U%kuV!rDx}TRSACAZ@1D zC4BBD`S^Hy0)GR7kXvZ-LAuHRuRM=x)ESl5kK9_S=g9@ULf_+2Le-5ykCj?N%d8fy zCX#{lx~w^9dU0EMpt1Vrop-~+8LD_io5HJw1s>Y#cSIlA2>0+4DT(ZGNQTvX`RC*c zZ_;(`@XzuR+vcL2B43+S>X9DTm8q|vIHI}}Yry3-e?XQ$v<$Sr(xb>{td9_aIJ6JZ z3_y_k^79X+E^u-qT&9zOA zX{kCXjpgO^9?ZTR=-kLBqg{aTZInVcbD+XbGQyu63BA_rS#FdljpEjTjCI)?s`Tcp zyeHl;{PT|Y>M#pIZ6+$D*hA4R>UnI#r;vz4VQ5LqH+$}c{CD$!W9#Al_GCsjkbZM* zr|HLSEu3e0Q-Nx*hSgqw?Un#BZ6sEF!w&*QW|1?5e5pN3Jex5ma895XEx2f6j?R6%WbgHucK)S;JE|vN-2b{GXaMAja<#HRtPb$5M zO;p9cxV@n!Z=9XZ_t%XtQ@^Q;Xgp*bhuzT4U(FNL%Yc8!xZ{lj<%QWq3>Q? zkuW_jFykEfLzAGs@T6W?s|qV_q>kqb__e;V?Un*Tph~bIimLLWfMf_!sO(>!pZJl| z*}!I*+Rc%Diy#n5*i71FkYn?gI3*es-6EdHs@!RoI9=tYAQTo=op*uVZTTGQyFyh; zLn>6+-GwnP=mx!z#c|CoyQ;gW_${LD`b+Cj(jn(_e}67>KM!%|!|g#zG;0`X2_p`e zTU(igbcLES<%}U|EOl=0_+t~s1`Um;{Y7oH=Z(?Qxa601Ro++WxmA__d6`nVKmz3< z^wb^1MZYGAo<^2OASCt%@8G$T|L57+oP;=Oo(yZe-yHkZQTEUsGI9QU)YlLKlrwPt z!@d|?6u91blsqt@W7`pH>YciPhC+`GEw}SJO4qb5HdKI6SI2rrKh#{ z;*+_+N8GRJ9Jh2;G+^vgAGpYW)8&zxZriMbPQs`1ca#N*LcOI6AtAGRbHTUo_<%`2 z)7g0fAUe>KYlH9pQJtIZW#)MQ1cu=PS38R)XUbebwQ0}NYBfU$*-#gM|KTcTlgsQD z%kx0?MaG63qnDVY0U`FHGEQ0?p)Yn>=C+O+I>qIbQZS;qYGjnTx|T`N>Lk+O#|t1p zy-pyFjSccu)*isnO?SZa^6u47Ip}0e#Ppy-EWi@dsN>&cJ)&7dTFmLKx6qGU+ZBH@ z;38dZ6BBbJe9e$V0A+c*!G84vs=8{zCsr<2#L66_cP0!BW;^skUX2!_B`mZ9EI(2? z+*34Z(390u${$U8FrF9LKh1pB`~fayodjLj#|Kt`2PJ+N*-%#&%1DfH9YracooQoM zfT5^YLak&5)Mx7blj{o<;-k0Q1I+I92I4T1M0Jp~a7zFqI!=syoLOS~C~F6bEbu+% zVCvcDK!1Jn~Z@@6I@w$Q)O_*1GFF8QORgxi2_- z=gPO9J#X2xa}B%w7WJC}wz}*uzIEwH;Saq(vew+2%TzZ-kghXcURIX4GnGj`3p-*yW{$VdQzNVy4; z^a1I0vx&O=l+xS8O!T#;oib}230N{ZZzx8+hZrXQwp~z0wO|9z-bSI73Uyga!tkQG zq7<`}b>UYT+72Oy=FNbibsdR$r|3~&+pVu_N`X+thu1tmO^apbafgmiiY9UN49C!@ zRx~V8;?)aCcFg@fpRh45+*0W>Dq=^WT=hID=>N2N;Yv zGW97;Wnk)YQa}_l{6zy3c@Nc@=J7hX0qNB~$O2pt*TgS((N0F<+oMn77eNXPZC9?_ z33~DS(WU|Xgl5|S+l&uIIDWezx}}X^)pvKzppjitT(C{C6d((`)C|2{$p$OsZW(yP zMi9vQlwSHYh*}*~o+$l@v<$!Ybo*JuFRQ@8&On&c0JMzZW=JDE2Z&THThM73XCWb@ z{WD^R=fD^P&?!1#vKO32`NFItK~qs#7e)6`W+1eUKv2zUK?}Q~Q3}GTwLd0lC@ltI z!<1FVuJ5hB3EHKHuZ?kM6-%NO(`j;c-AOZRZfgEFG-P+-qz=_})>Hbw(QlmpQl901 z@hv*n;U$q1wDt@X)WSna^b7!m1r=imG`>lsz_#F#OANFSaazAa#0JO~@Sdoarhm&s zGyLd2d?Bv#9`0Qh+YpU|3ti(o7Jr-$pr0G<5x%H{@clWL?zk+RHL-pGlnM#kRX?z7 z!MxIiRHrzre-K^Jrkv2N-InOczy`E*?h#oM@yDqNKz?#tgD7ZAI*MbpqDYCN;r{)+ zSUE)CY<_G(E5RVN^4Eb`7HdjX(0`J0MR-mKZ4*cNsYk}7Xpf4oB`52V1K>xad zWebf&F%;u+X7|#n^PRev2g}=rp{sEY$W_e8dUOM3eed^~O5bB(O1G8A#*A#~7QO%d zQ@DI`+O?#{da85b=^Lk!23OVa08v2KzA2DaY!p0Ia4fBU1hk{G`_qA5t5>gCR&tO z0c|pdZ~PVYvJpFO{tLgu(|t|MoHj%(yuAQU>hA^`DXNwS<;V!?wKVU|cl|fp6QKzj zGXG$g%@{D7L4X@7IdhAwtu>!`7T8}v&NLyi5BKOj=U{6H5MUg#C|Kx&CNNuM8+TfBuHkWTsHkYHqI^fOF-#i#$$d;3N{&pfWL&ZX8Igtm}T;93;)W_G2pPT`WVDhv;fE{CcM{ zl55hHNpaxl9T*WsP8-4$RvRf;t53YPk(5v5XKY#d>)P&ru}}QzLyTVE2F282D{|p>!%E?b`SK8FrN=%Y@7#z*8RB~$hWjDV9gcv z02p!*HdBUbQurrVdo%V zC>`f`*F3MKgT?K|ZCn$M-LD&3%_*V;gG*AW|BRj*__ye9rT|OEj*sorbD+rw`7?ZUI)`;J@4IS45{?OZ9P5t!8QygaC5rls$$4C-(GL)5ZngkPP1DebBL z*R{O}26S@@FqTO%DAIL7=(gkN-%wXnKmIlUtn^wZnN*WrJ@<-Sc4OfL% zQ4BkII4ceqYIgW?Xr}M@mPP#rtuO*ls9NuM1SFN+Bd-rnTtG!9kOn@iv2dX{1U_=z zPQ1prv729es-E<$DS>PgZzj=Uxa@S@#kK(+`3gJ=54qH^Fk9b55GNEIvktT9jqB=9 z$s@JC@?a1r!$?{;zpmB%;V1h*8mbl+(mfZTS^|D^F_e^FrQ#Fk+I8KJ)MpBt*0YsUk?XQpt@vyD<$&YxY~p@N<4tJ;ZPE@nJbk7(UllX@kuCp%9L{r$!;}KZ(I=Wl5Xq2 z>g7_s#{3CIls8Xz|2U`h4y+ka9RSjuG@D9JLrdC65F{c3j^#$aeL%1nCyX8cqWQ}b zf0$Odms53`8`YzjN|nfzuh1P#wCY(SD!+;*?J&7fr|VLwTW0|Hy#L@x7PD-)=agf2 z7NSbVKk%%94}S9FLfeJ{e%R10@a&sNlBbi*>d^IfN@zZtHRikCNix~YMSii_0%L{d z<(l)MB(CeKC~x)&l5F!OiBmexOkiHyqD@D&pSqOS-S63Trv8G$<05 zVJ=M6&Isb>pZ_B!mw?ZuE#Cc&tqAXIWloUvzT+O7`LG@zM*;=EFJ#)w&oO{zzx%wX zf!F_?p9lwwTnT~ALP0Q8`qv6=cQf6squopEWGV|TUet9;E4y0QA!burO92qOv!VT+ z<)VHFyAYuwW!a_s%0Nd3Wode(QC{(`$MU&5+)f6dyMcs;%i9?@uP|`W-);($_~}DQ zyP+lb;Tki_tH8Xltaqy1n^M?etXs@b~$HCy~BWo38HqWb5;T zLzjDo{*6r6zb~ozB%Xna{`R>4W3|;hvB!q5q!a%gaUi27&0pZc_1Dobuwy>wt)bB| zgMTDjfc>i@*VA=*pzm@|mv~QI0y0#H;b*>l&M$D9-RyO>|F-G!sUv5?j59cE<;!eZ zHNLs~2W4!D`?+m^exQ1H;^*?eN_2U1Uac10Hf6Oq=U_fbbRAiInbo%7npmRVE$kb~ zn`L`sR>(J7N?(S1wtPt-IE$0l*4unY-)JIi&2mP^X{8w-=b&x0SG$;V+*3aPRms5g zW?8bEbAf}i>b&_|f3sjsoHZ_4SZg4~dTz$%%_)igs{@paz|V7fdFentBTp4zL+%d1 zuJ>LQhs%ij5`;~Sp3|o7L~z;|B?+F6_9UcCxBXzR^6;40Jkk1QPX6Veb0!-*GEAJY z@Vn@))?`J3G%iuG17}^%En<#bJ$(nl7sfo?}2y@ zvh|ZHU72)|cWcveURA>EWUQfC^fEFdyG1dKL_F62m%}stp=096dyI0B_LVU<4$s}V zu#p58dHmVc7ZC9T{;gY8wXhw)t|NRFaPb&lAVQlPzC5|}$=tQF4P$)@$xb2)k&X*g*_}LZBN|RLMpwE28x3<+_ zPN#%jd&_f2z1RBjnn$U>;#32Cx!KKVHseEm#_U8|#x|1nWAs>x%Sw8#<(TUTvB%f_ zqfXF_0>0Wr@HEl}(tEvUZZ{rcOOw!-`f>%%Gm4C9cSg>*%H#2D#>b&W^!(AnPR=QO z)QCsY&y>0G?35cLowLIIVAs4HQL-IW|)y`x}m=Q(CT^hSz|Kw zBvw2{UMBVfv3WFypf>-3!1y{@l6-WTncgaQE6Nf#FXAT+Ax71b$iZR$(|UaY{fy7n;cl#UQl_tv_?9+ZRWqhaM(#? zM($+AqkSjH@GQ^&JUdoH@Tebz23Ok2E18QEGcEDeXg}Z29O1r|obpX$TfD{HYE+2~ z5lkl%*+1O0&acgo#G|J;%YSl2lc{$Sm;$e}nxAvNbaFe9XQT#8+I_shF(I}4ACT5} zs)MroV-mMuKFQ2SM3-LNRqs`M!w%WLMdZC-@Z=-2o9;1!nAOm!4|m9EL~2JF2=@gC z>Tzh_xcu$dab5M}+M0Ow?6TK+O6aL%>lGh({+)99l6~kr`sy$B5`yWw5*ar5vz?N( zE4b92>H?wjJ08eO5BTl|J()?r;NX#ohI7f`Xxo1_JXzLjtt_E*6`*j5=?sy+#T(~;r(f{sLGH$uSC=^WQ0O!7I?C{= z)@(={n}5AXHD0$n(*l6M7pV*~Tb3mp&(O-j^Zkhpsr+K)ZhygBobgdZJ}x`zeTN2K zKCc{o6e;$*&T9jL0Ra5k$q0gpZi&l-H|zo24CGTay2DM8OM>bo88mVR}autq4XapaE64DK9~G6Z4`iAZO)IA zQE>nZT`Z<0E2<^I2BS|q>)_izh|=}<1CK(Wjno;P8=yFmg7B(7giyt%;Ihjm z@qTD0ufU39k~p7KVBjiN==QB`Wk-aY`ooSnq&TX7Q?pl5nQ^a%m4-0Sl=_!9chHRKuIJK&$zN$CW zO&=&Rjwy5<_pv>{oH@6FyvGo$L3tc?x!@DlE+iuyrtdUB^Vc{CrW$2_LTdP)s(Af9 zLeyKGQ%v+i3p6ciB|UoLoj;QOm_blInD-|bT2;!t z+Eo33!8OVh@k|=@_fy1?8C}+;M5Yx=!9Ve{ z6N)*|4IEB7jV(;RYot{YpnB%L2IF0i6as~1ya&IBprN?IHgucuWK2ufF;Dq{48Jo* zK-mTmDVD@hH*ahJT$L223Wg70m9B1Lsep4m9o~n_F+*mId_k?hFAjJVY4+?Y2mur& zZb32qScy|Rzuhx>UTsAEk-x&-SZ^FkdrS#H7>u^^v#ydunSN(p^wCGWHi7m%6#q{- zDenMXVI40}5}$Js28lee)(%&oMar%6J)#fDl|+_1vT*k;+Lm%M6z263jS>bgs7_93(cwk8 zM+^;C@21Q>6EgLm_y)1p1L3r^duhZ^Y&lMpl?;dA838sc1~Fv9 zYooos6lIs^WtLZ8N}FYXJA(Ae4VY!UCBQg2AxdJ+4zInM9tB*alz+R%6kw_{H22mU zK7GQbm_FyEFBJv`<(U2v!w`q&mm+(Uz4--nE429Bz(}up(EEb*ufEGDyE&o@8hp z4rK(HgKBi`Okx$mNTG_@j3pIan!sPMBexEAl6NKjTc1mw;8;czuiCO zz{bmpO1^F1XX+@^(4=rqaG@;V;)-7!>>;z(iMAuWx5jkT`yqukHX$1SAS<5}ut z=WuwYE&ymm(riqNuUX#K`n|44pjbj`_+or8RI2&K=^y!+s^zPwH;w4B1!atHOL56v zK%!{@cjf5Tv=JqdHbl)J&6pCPY}^O*M+n70KyHqlVNr$3grbz*>a@`Wc2!-J=qO4-^{?xt;p#$@dhmaRNnsH|AftzgIOkLP_1&!kA#z#5TriW{U28rOQ+F z#cGG!652Coj#HyXdKp@A_XAAY&nU5Ks;A;KYt=Nz?b^t3h0MfbTUJt=+}=sIPNa6o zt`)>(xu$VowJSU*nNKPX_}A1{F%~Z$uN(Q>Z$FPX@uH5=CX66X z(r@kjjK@;ngVwitH(*9$4i~Bb0Y2Xmzp(t=O*fQOaxil+js(Gfs$~kSa`}#-cB)$o z63IRUgCWtE>2m!fZM-g+#+0N!=^6dlX&az?VVf&v1t$E$or% zz{+y0p2pqO##wj7A8xOIh$-Z8T%7pN=P_*P55|U6aMnwGzaqsU)}_eShONaq>n{qCbH zF1S^IcHEYH5F~UVSbz^`y*B@b-BlGo!&zP@$FuSEPVpTM%Q{zrQ9LR4kA)q>dnOCE z`=S{R=A(4=n8Oy04FFcf?PQ9JjykBF+LR4)rg)$6ULmKnxPY_o&@q=Bb&B5aa@8kG z`LKNgfqiE{VEkj5xrc87Mhc{uq40gu(Tm+WK#WIQMM+;$rppojg8!X}vFu zX#YIw?Tc&ZP8Os?{FW;kqkzM&MUs7>Wmm2V^q+N4rjmN{e^2K{8v^9qzB(Z;v*CV5;sjvo9lL~wb( zmB)lFL=7582(n&SWZce|mzU(+Kl(g?N*I_8?y%{>=!jt!<8$fgzC(u9?=uDlG6utG z*IZT2))#pF7$xyoe;3XedNP#I2u2b0d|%ka)XR(;|2Br$D{^%JiHN$sJZl#;Q~0xT z0)F4XDyX|x7RCArXBsz^MA0wbdDE7qGO&cX+wbiDgUXwI0 z8s7lpx2C!FW6nFuI;&39I6B!{_59$6dj4fbOm~m^V`ZGX5kd2!LIzO7y@qnQOypqk zZ{~`m>0A8?Lz46kjw0NXOnpV>UnbB4k9$fu>I#%pA?2iu;eZ(C<@?ENVf5r^0^*og zZJeFwaaOURH7Aaw1trR+-tQac=RAJ#M(<7PzjGqMij)P+FcD2Soz z1g6tM{km)NKh;rCkaz0i>iZ<~;C+4BJ#4Qma!a7(G-{UtZeyZrm&HS>V) zk0n)9CK5q^6kjmAqVduWdJwATD5Dpqo>ns49NE#Qt`C4Jy22d|>L?RPfmuwpG7UNN z%gcKxg+H}NpoKK2;=Uv`1u@|#{8@^ApEr-fMq7D|DwV2e7peva3={iy>pAR#>d&N= z%YF?Pq)JPoo*i>}Uw>CBnSaCOmfx>Ep4w!CDlIMgvi*2Z8v3>&e^#RC|E^PVu+I4w z-UiAN9#-7F;;eRmR$M}rIiFZ&)Wkyj-;FILWza8F>21rXNm`l1bLBEb{~@Qb--7kKF=R$F)g;`PJa4hszqk=)1V8|| z*)LJn*IART=Q~fo<+cT5nUvWA2KU#MJSlv6`mKzCkH$PgHg9IkuNBpIr{ART`%ja3 znss9#TmQ|PoaSKTlFg0PHY!W=6V}(n?=NF8Vw41n;4y=+AL!2!A16a-66!;Nphc=G?@e`(DcqN?!!WA8t^n%utd zQ5bcrTT$3b07VfSVn9Hp2?(ediZlsTs)|DB0s#aBR0Je60qIQwgkF>$nu0Wu5_(6P zgf6|qnK%Ca&vQP&d2wDGhmJkQ9?8nR*1gu8b6xYA*Bk`$#U*oQqKJM8(UCCF^~gnc zB_N-5H34TiBX1cUuY%7{b7_3>93~#3zBv3Pf_Nj1-Kw8Y?@i(I-WGNEi=t!?|L-(W zoS#aCqI}=OK8YkwU4nI&>GgBM;&WWdopm5`a1nFdBsa$;v$dicCp}D#RQAmu|0LO9 ziZ?LxoSc#dbnt%_A(|INmK>@M<5#`CnQz2z-mkzzLAsU;9Jj`k0>6l;jOc;sE?s3B z;lJ#ZY-(8H`&r>U#4qYj zVrAi;PSZt^HZy8VAO)2f#-$Ii#$Wb>GU!&O}?QJR7ND7W2Klt&KG|X zn!j=K{ti}Nkm&{{9Uu9~-Z{x*l^>5_V4WnP`ln-OQ(~YR_Qn6qo$XVpf|pxiE$GRG zy~lxa<89yQF*C0SmSpQrB(S9UyE9J<=MPWcI1$O2lpJY<58Asd>JBt(CnOiWN$uU% z>x|+eXW!_ViX0e@40N8}SNnHk)z;248cE+aF!{fIEqbie&LO-}pna}X;Nipn%McA&G<0b69G-zdSB$qoMlP&T$I`;^!K*?Y^Zj@MoIvPa4px^}Dx^MLJgk<*eEVA(E@gh);zB?H^nGrdi5_#;4*wL&1Tbt-hP5x|pBu4_- zP|Ci^o77sAnm|2{V3@{6rxrZ&)pqU>2x_9NOG;*`v9rce#}D0dLOo>oyHui{p}rgq zNR?zJ90qLLOXQ~JoVK*lh@Bk@+_$Qie|4RXcW0tuXX5esk`xz`r-SYt%-^svot4oz z#f88r5zj@k(JvvdVuBCj?LUI$^}!uP!fF*&eX*UCbMsU3{;ujPQwPq6!Ui1%^#LG5 z;A_FwVfZJ3O5}w(Ju1w{K1dPGi|7Cca*IN zluQu}xEib5lE0u+|M<+t1kPOq`5zKBGY}32&VwmahyN~tg@iNvU||y0-*&48<4ZH1 zI=faBfpR~_5wp`4hu)~mNs{&sqqsk-(THM&J3tKaK@)Y>dHx5C_EC{yDk_&X!wIZB zgBwX8;cf_dk>kU|5je%-i&v|-<}yoD@nDhlszY#shte#0qd>)!B(H34-gBK{$EO8(|uk& z%hfQ)E?Adjx9@PutPb>+LLD^hid#{lG!e?qLk0T{Ak>hOiG1X_jBS^f<}v^Se%{#t zFD|J^vdMu2Rv@b3JjS47x*|iS`|`nQ#Vp0cq^lauYHuV}mRc{)j_=oQ7FkM%+u%m8 zGx+~v)2!4|E^_=*b)@__&l`|c!15QP7)@IbnFpzE8QQga2sd6nXjXgX6{PD5idGhLxPJseuKdf|AbyThE1Xb#K%f=EdkdOgY+cC zBYIBj{dpS0A|QOx4ya9lU5U$F#+wIr7@HX4Q)5<ofz~(C=kMB%OM1p|r6y7@ zb=T0#*>0pT&?!)qVu$d`T~$NRN2EjGsX?*w+>%aT`GWwIv*nC^r73S(G*R?{upGb8 zp|mUc0YnFRiu)M7>D>oG``uMqt;)%lEacjh(Ho#i^IAnI=9W3$RQYhi)g4k|1+j|z6t2Hs1MN!OQ zIDwB>`}+hjJJ^7W#|JDzG?DO=YSLOXSh`94f+m}8=S5${6g^gMG)vohawiRNnK?8( z(m~b!_47mbl|h)17j!KY#T^zt8mKJg5P8KNR%p9D|9g3__!||IcNiZGmJJ+}BBcOy z5hj|Wdej{ZYR_E6&_)pFbBg=V{3cgb`QfnVjlQ!&Q#KKPOgE#Nr=;a?Vg|1SWd-c$ zy*sx!pDvbEpi`lSQ+)4seI8?DUVElR2*}eFNjUp$9r&xU9aW~px%1hIr|Wxz?3={Y z>5WIl@u0G!+NX+V5Moq&7mvgzT{WMBN8mn6Mo+Gt?x*5`TnyA!@%I23jV0oq3H-Db zz$vi&YcE8&GGlVIHQ|mOXYo08TM;`A{x!C~I?QR00w&uB5bM%zo|@OWt$y1@egb8? z;bVbEZpZya;!8}d5o`w#I8?!O4;qrv$bOQUqld?7jOZAR=twi%J^Jh`b2mN6%Y+taH#Re``!E7j(GW1%Du}x99_o4br%wMBU>yT7SSMVUKPW)%)C*O%HdI}(FZ%*Lh5tMzy5tBUe>X*$c!Vb1tz`M zLn7J^Pv9~0v97*4%77+sML}7X<#NGhlwf@1^=N4SP?os;q}#KbJD0AspADg`9>9K7 zz!vH$bXG<*9u}}-oh$^`%B{Too^G4jXpS&xb|!n>)Fi+z%Tc-%TIgmv;ZcX^dfaW;Oavx>p|}}} zi8?tlcZqjmtzQzv7ssxKwz!L()f0DlSp-(Wayjvd64gyj;~AS_+TWq0$KnbK?JT~T zrPnb~|RCG6DVg`^yn+}mqxV|VQ^j0s;esT_Rt3l;zQR2a)V6Anfg8m@oU=V4BCURC7xii`YPNqjlRHp zu4g)}4}|;b+IZTqt;;!< zPvqJl3X-cL>6gIDV3KxQC%UGnV6XCgDZJ8ES^9P2#23YqM6o8&#cvF!IIkwo9XC}4 zkpC{>0Z8gh+PMOH4Z&bLPl%my{O=c?Qg2b5$rJBKlUh}B--;4AXWGiI4d}KNL0C-H zh`n83ef6?vuJzWZabg8}5-vgZc|=tK%<@DZYeKSW0A0of$UIVtXMBN9;7eKg{lavy zpXn{iZ_Lz5wRPuVmU2=O4sDN8i;$tX3Mbwnm>7`t{g@z+^Gt+V^irnZ1``c6(leec z_+&_8REz1D-JNURhlMBB)mh|z^MdQ{QKN-Ju(VsCz6pKwXm_xH?2{F@>(K&sd$Z21 z8i2vb!+lTORoag5ks-{7xcLa$gxS%P?gKG35%=nY#bueH%WBa*YBr*%Zbt5LL7r6a zftIQX^oDGJT?_66hwnX7JXfRN%W9OO@@5ki!hJ|^SO$9_mdP$a2ev*ZgmQ)_5@ya+ zMgw_)BiYzhvwuFDv~7d|GIg~(O0CZ;NkYRwV=3rjsZ==&w+NpW|CPx*rRY*#LY~xJj&cAPdB@T>99#%D7aOP}_pW$aU&dr%aVX3n(ANKE@w+>0Z2&o&@ z6)TL3^UjhHgo!^As7XYr8gcZ7){2$86FboFLx?Le6js65y&OsKy8$g}LXV;uR5nZ^ zKBS>QV9>nx)a+v?)JnX5YBG7`+fz@@0OA*at_6!++|qZI*jN{E{JP1MtXsyYFPCA& zP@)}-=rS>xU5C#+iFS;h(CLMSMglh;VhC`XH*Z*kY_I74AwPKCLIcnBm{%@{i37~3w(gz~i%v-L{st$r$TRtBdQYEW;B_d`maYqxVnJr+X zds*%7A6M-^q0zbwwL+;R9Nx=8H(&Y*y;bN>&>0ACw58n^0fje^{wwlB>EF^yw;=S` zN@>J4IxF=f2v0r~I^~n>apjf-6o{4e3O4459Toip8^*3m=cYy+@Z_yUm6?Ut+v-%5 zVzGz@pbSK=n%(QGHk~6WF{+niU=d88)z~8qoXPuO5!PPnK*f07Xhs$fzCF}n~BmC6GG1mDIs7H zm=FjO)d#)L5}PD$JQNccJ#Hz$*1?WQD|G;W<4ty9lrqAf5H0l1nh9w7v-NO130IWQ zK6zX`(Ah`%7Dw!Dhnv_>4-%;rGrHAM-a8L`i67{)&Pq%xBU!Hg)fxWyGkZ9_y|F8H z<%x$H!t`m!yDncwr`i#u)LTnCNb4Pj7Rztgdc*N+mLNCK=q6(xw6{So)_I~*AXHq_Jbo`Yi9n}rpYEp)zVzNXO|ER#~d3EqzDrd&KSpBU}g11Jb=jH zEWnU}BM_+ z_H=ZBb4gsGTZ}hI1+hJnCHzLvB*@W*Bp=-{fz~6`&bQD;N&urR)L8JIrL>pn*FCA) z@E*U-vX#xU{Mc7ddEn-i@vrz(xwgFfp5hsU?U*6dw#gIArDGZ$m@-x^VV7rB4p{yy z$U}hB?gyt0`pEC;mKB!PIb@XGRS^1t_OFgB6MB?(tXHbw&2#d zS-Z&;hNReyzJtI8`dp5RUJuKW4iNHG_lty!d=Rn4lppdWrKtWqp4>>3+ItYL6?HBX zeHsgbGHQI7c!8dKz8AGO!s7&H=wF#jwCC5@CBy4bBn*3T|x7V#_ z<#5kB!a!jqaDZb_Ns1Mj2}HGb;wY!zq8zNBRTWiMCE&^~DHC51@NS6`qPh zL)$}ad~Hm??&b{}=ZMLf=2 zV!fBGE&P5mE%qZFhDfbWmQzvHcJ0VCy&SPrlqKOZTVH;Abqq%_?#?KTr7R2Us+ov|)XNInVarIgLp4qpjuJkR)Cp?;@JdFG6Z z?vxTysyENIO{6UvHv83MUUbe{ZOM@;{9jybe>XKnuditsNqH-pIy?SufJ9pbtfon}TL45D_DE5t!Rz2Bj9rE#jqI3WSVH&q82%?EF>9eek@ zyy)RAqLB8^qs|Q#^ECBO=BpUre6eKhwHll!SpYNf@RaEG&xuw{Lb42{E752o)`k1Z z%iXQMPS=h0)1PBnUA8sm=Rym2#*2vl&TTcd3E6lVAHxph#N}rm*14nxS03ebE)QGPD-|G0JNuCkvUp? z{^t=8MuaL-c%>T}Cz1lr>sotGa#hl`hbqH=gXr2d?s@JM>_SOw`-K1^B%PQFr93rU zc}?&$(E1KgvWs5gdBur_oYdpqgF(R zj}360q6;gM`h_A}!;ElQ4PBX|wYxoZ-;n?Ue3PG0P!Bc6+=dXVvY^K8SvkWK@bj^^ zjbEXWl41AfTAnc)LKq17f4A)9h0@wwA0gQ=$}2aX#2jM6;=eRW%xm>8F%4cuPrlwG zX2mO-!k-&!A)g(?;-O3nsXwH5%RW*$HgW}V{hoQb!B_#%-y+tS>d zaP?-}c|8#R#gA>3==q#E)*+aa7<$&f#`{HukWlCItuCg*IayubeS4DN|VW%HlA}th^Gu7Y8 zpVlu&is=Kqz>7UKz$d1nwLYEhA8OYaMqCauH=g&bE#%skNO(WG1oBIH5dJqO+>G$P zhU?@NnO|1{$PK1sg&%taB$6r=ceBszp9n4hh~QoUoKtIg%ND)C+(KG;@_BX)Z4_}M zY&LE7Oe;I4KME%DQ$b$=z zNZ&clIoxFNOX1&X()*afgo3O__T@uW>I7>Alnmby$pRbuPrNCro{G~^?HcS zy@TW#y3~w7QPx6EIWxjrM|gfTrM6TT**oE_jf`Sh76iSW#|?=?TOhyz9!-JL{~Uky zGO%;+CgA*CIjOPK?(1>{rYjiz<6CQAA{(K_jV>f5B#XffHQt|{xd*(w+8=Slv`;hye=8`)y$^{9yP?yyZIBg@JSgcy85Gdb9`p4B)$G!8Wa(*PT;m{F_dmzv< zh=+|=oNyGnX5oWWE!sp7vkv{%KmN1epV>N>XxcX@Ti|y`cyCcemr%&5ut846iceYu zaUHS-5dZRG?2XIoW={XN2fDa9ptdx2>`deQ^lSAb;_G@!bLL7w45 zN8Aq*uJJDnBL^na=4IjQx3U&kEFKig=X}XSnLH3mpjmvjI5$fVRZWCm7n$GtX+E}$ z!ao5-xS8PrduXcCVNC;uQ#&>n2n8b(3S{(e7HI@NPVH~UY$Horr2=j{&WFj@g```t zcOnDa{syfA7*8?gLH*#IGd@=!^ASSS^8G!jx$k6^&InGBO266`MC_i1r-d?MWQ-@q z@DR&Ib+G>)5GtDQHeo(W(GNU{*$|W3Zd~3oFl-sBc6Wq4`N(yUc?3&^#iBTAHJ?BA4kEG#urz#&Jd%Bb z5~pDEO$yuglt6%D4_+VIOJ+W@2iR7)MV`c>EKst_ z@xYv2UViXvp#DvHy-OVA_SLu{kmx#uNM)sq0y^;CNWLAVyMdUoIRq?{rJMw_UC2~S zL}Qo6z7FauI~wf8j_|Ex$RZN~RvZc*r_Z`RaLU$^z~d~nDn^MjAyH=on?-BSl@~eN$EMNseK z2Nx5IpYU{DpV~mRuSx;SHDZ(&sktB9iF@H!xW_y`bpu-OT)^Z+Q-JoDb_YoCv|%R@ z1`=>4Zez6fOXMdzk--8&XGY1PYv4siY!~W+koPI+dHbRuSgdJ7yb4&H55(f|#)Chh z4M!~PMx}11BE<L6Ld-oB`IXn@>;jJjO3TFh1`b?K`cK50=!XRpZ6bis3`_UUK zA|famb}Dl*@!Qv@zGPm^xOSVEE=0>Xf@3lD;jQ*MVoTw-@LG2+#6vIgd&oiv2DF*_2CU_|!Ak_j=Pj@igJ42b7L`^$J-BSW@jIDZ@sUH7j@YWr=_jK(%&z8{0 zJFAwK1@7q;3?HnVSo9PX)vx=2u>Z7-c02_AX~@+5QSFL!+u?CK$)h<*O0Ek(nd9LC zvcivid-zh5J2-0CS`l({SvwY82Iy}~A)nWbSf^2o#Y$rPaFI2X3sqD2Nz{#!4; z<#3lEauLHd@i5smmzt&&BL--b;R_H^fCgDDU>#;e$RnI2>KFvN+iDu=XFYRUiy9Ru zx?sQ`P#>N*__pyvV_V0lGCd8*d;h5~12?Q~7R|XcAAnqwCRw;yHkZ2jV#ODq4`(Bq zEadip;PIz$;2%)v)%9Im+wIlq?)6OQ06u*Lee{_u9=9E($@7512JaL6rK1~BGVPWy zis#eushD%zBHP_a4iDQl=I4ljY;E$&rhH_C#2SGF6WN!C4da)+I1sTFi67#VFu9&v z7&djgZJj#9t9{Rqlx9=Rj%sAvHo_U!HT%wI_iSvvl8XmI&K{rHN&f#cnEd#DIfit4 z4!Cm9pwyNj51cFp_m|T>%MVx1{PW>gj!~Ir-#H`}EI5gtROZ7-XgaNL3m6;XGvvpS ztk21VAwWvv={jX6ODH>AxOx=k4i0y@p_xZea>yiLhGL}Ts(!f#X~d~ZO&-_5BmG{T zhgx=JDJVWNQ<4p91QG>*4P?gy3uNQLubNPpIR7sChvC)#rv7H8(kR3mH=u7vAd!a; z3hhc3w&EBckZ=*Fb)o#rPo5Ik9J7qS`r!ca&KV=!Kw{Plkm!nNLNSKc%{=2n$v^x#!pNC0u==4kYq^Vp1eFi=3BcFufD z^{P#cIhB4x^MC-uww$ImFvU$~m)hl}LM*>z3A!yi&WxHeY4nep?$mJy2(WLy9QOei zTLcN8$@>Y(Td0{|H;eADY?RD$Jk?u8wk}zE$%W@A2$bzbhjXQmjYT@W&>M;=$;wA8 zuY_$nw}1a&f3Zx`lG_d!Y~?v=3YAB^(2COPc}v^|P>FVGdxm3sut|ypo<6X?w%4($ zPYLR_JJYn{slz`XevN3l|AFApuLMRC+r|xMLLwJ>`Upe=MhP*bKnU=zK`_!(uA=u} zw0Wz6ikVw=CNRH}1$DQrrWEn!8J}~9v2Dx+dP3TH-cxx!=$t%uyLN5}>tuoK7Ai7j z6fXo(RP=kKIEl2smu%wjB2Et)=6O?Wo zHzCLumgifO(kjM)|E!&DGQ$qazJ!t)4s+m_R&qhYtyKF0$ z3XlUz?dJuhEuYML=m@B6*c)tE5Mm>4z-(t%2drfY7V}ExnJPvaxy2XGmVQgFKxm6| zSx9|^Aexi(!c^q_!}I02blX~Ta${r^~@uPZ>_ zx_iWFGCRg;%24$I<#9Y07^gp%V4oR&B$oNbI-C2O^sregUVSJ-E0C%*<8l{{kja`% z@i)*safEXm>d|@M1pl(Ze#47+l!Sx65~i{UXl9WTIkDXEPbnm`ZVUAV5uxA?ZE^vV zCVH+TS7K=|yD)9a3`{k~Lwzz+56xfLe-=T^)i?14omTD;Ju4XRC!f6R0KAZqdvMxJ+y=c_gmvxK?8S^^cqH z_S6RFv23eV)AKa8_ce|v#kS?Knadz_gM zfV37K6M?X1g}#s3=)O4EA95!QERO5W_jf5 zO_k`^s0I;?sez!Bsqh)pi??ej{k1EIOA)C!(NqL%P5^=%s040`JCYV#iVmC`?Za=zw2dd(h81FH@}oXod}@=# zh0U+LvKls;Z2-Wjwll!-ibs{sF_(+`{5ArxQzQedg*wdwQ25Jt5~)9Hnw*!%$IG@f zxmqO{qt^>%Xq#Nc04O^N*KEu;s&a}UsE{n}un4FuMPrpAiV&3#)FX!t{ai%eo3StO^zgfmjwK0CUwh+XwB+0Y`!bocEvc?u{Si_+=fBF<@ifULGN4 z?Oq#Joomh#cTt>b1w5=Z3q#nE)pm86{TaI>-~i=#pKEn>;n1yiPL?b4VC3#Ob?`+` z(E#Hv{|DP1k+BtcY<^|ma7L9txrI~AiJr_xZ5vq=EO1W0^ko#w?aGWYm|`3W9eD#; z=B0C{rA?#UuXFFm?o4L6?zDGa6kJ9*TMP+>cT#s-G_by;$%oE~>6GtuzA2Pli|k`2 z{6!GMi>}q$41E}X`xd?NHUd!$aw{A+LjEA z{Jb@6LcY7b^)Q}AjUVG`hNzRgHV4TU8MwwiFIV{x{^p1Ff!RLB_AHXNfYBn$@&D2G zzf+(bQ#A`H`R717<=#{?Eu1$M{3r0fa) zgFEW#Q5u@*@$B&u7dKdBkH5A=M7eym<4&TSO51M%mYIi@|3a=u7#RIDU5(03!2Ldj zHfcijXS63zum1bx!o}Q{L^MkVWgz0Twrkt z*$g~|nqY8`@IK9(gEg8J^q}C#aneXopz+Xw77tsuH!refbCZ%O?sT?F1QQOz7j|S? z)c50XH}pZ}X%I3EL^|i0EGC9$QOn+p$KDCGH!ZEPADcRK#&9{V@A0;dnJ1Y8qrbQ4 zy2j%Kt$v6dpcO?ia-ee9C(S?&4Ye$-?(do^y(Q8*63hK_p1z~W&Qz`qx2;p44KILF zan=U5g*@vYom;<(?htx7FrKAxrO(a0L?Y{(7!_nF?&qTc+~s`BPi?BNwaC^pdwpoi zXt_O6I$2xg+Io%Shzzy8WiToZ> zFB^2|Op@DizHb|+GwxJUP&0P+$ej*m?T^Y+BFsKwb~IvzOX8_N1K`dtVi>UeWJkgG zr4)syL8^m%d1P(Q#%;5hnR%JKCpIx8s`b@9&Igx^RPnql4p9=CkR?3A@%a* zmp&ZW9?(V>LEr%;CX9XOvy0XsH{)~iUHzO$dG+kOI)NI!M-4mruCD~H^KSC) z1Cbn-O|cPmB>z&8kUU**z}hg|ItB1`gBEWOL5w>H@w6 z=|zAQnxIG!J_de7D;p^~{_zMg4YFN~!BK$W{BU7Dzq$mb2uN2lgho>%uf6q-ddEfm zAy2W@u($aJ{CB8_<+P;h0H=o=Q2EFWoB!9t&D-O$%4p!9o6;9J9`Cy4F-fm_u&b04$#m%Gw9+A84lrr z6dP=ncCo4MlWI{NdzG{WD09EI|P1( zmw5}h^Vk0Og#_FMWY-t$5$KmCr`dgw-`)H>g;fEVf(7gbO(1PHs^FU-bna7ZbIw;A zc+Uz@v@9iEC71gTWV)g*!uqvYedUXJrNNBl=YFWhlq6{Qp5M)to-qjaRaT;2I(-QT=KsFJevz z8|VI3mq*qP_X7n_?^XQXnsAkd=HcmLq60VqAdqk!({AQ{(x#6fpA*>Jbqh#q{rh6? zLubbcztNb%NA|Xsb!y$byk__D$z{m$VhD#SK$_yN;t3FL;>m8Zi9t0u5a>eRt=x?E ze(6Y{`)&p(b^^|fknbh;+oMSJ1P#p#FM6?Y4>5xToP`QL3lI{0?JhqTe+q8z%?=;! zGwpv_;7bPsX5N@S-CLdw`|S5+3>3@sYyZIW_*8Wu3p<&nfWI306ZsTFsUHtIA_%$5 z4saWYFq4RT+M5(Q^LR-(yPF?~!t#{Tsmy6^u$G%@?ip~Q`rK}m0*I130^Gop*Sxl9 zw8M1jcIV6zraKwvz!~2!cZWq)Qvi?ymJ`)5_8hL3nyr=@@HKXo+>D7BJqXJ@z@^+Y zhFX3eF--Yj<;?wnBc)QCCRn6HupS}*U8n)VNMm9&DIi*zCHs*Uwm@=|ZnZd!J=s)pC-SpHvSb(#a`*KHc-GAUF=r6^*HfSe$c=+@>r=9t%mC zvafiah3BTr&qmdG+f@>hw^efE(S4M&vw(=e>?JqFn1M7cOKC%kOdpxit%Og@M2Tq$ zx9W@a&qZFum?P|^VJU8q&GEZ(5%~&iRVg%5^61n_083B4>%3i-lA-m+B7+?>6HH`P zSTye$^AagChgp6-dG^mMu36Z#TC$YDw7JaZBFyd#GtHp(W15hB9Gjbg?(4YRcx>z@ z_(dAI%h)y>FXT;B#xxi6!YuDiEhtgtFt zYeB5F=tC_(NI#a4l9}QHTJJ@AA#0{1k_|k`G+7EBy)hgt#(N{0w(hB0u0N{5lu&&i z$DHI2CS>&68@13CC!QeUMAoOxVaDz(#y{`QB{+H_abo~+T}F9t(!21HIiov5&k2Ny zK4xJ#)XEo3WLrO$k8#OEKdo32Ig_H1-?tyVM}E2D7L=y#v@;``6s&q@9HGG!_rcPk zfys#m0hO$F=ycWz-B!}ExyJKC(K=!Of;oIhmrj1!EJ=s}zCSOruAKW)-Yc}oyi_a; z$(4LSh{(KR&SZZ9^Ss;#R%(_AZEH-Th;t@#D{}v6=6xUrc`HmtUdAwJNG9AVj;PRW z_&E%-lYzPz0kjE!wDw8IId+oG(Cq-|TPqaNwj$3VOObgaXmYUU{u}sUZBi5L>uOMB zx*kn?xOX_R#RP9{(~w(Otvr*E27(aVz#0cn#6baRk-FEJ)69o!kI%43^OXv;YMXF4 zIbW26>>+?ILY;su9v^yK+I46K*OvLd9>oI-qC2ywv(Mj1u&LD8 zDU+xf+|k3^Lzx@yt}0N9z7lWc{s~d)I2eP}aXGAiUOD(kWpjpym zX$5~CJY(br49%#SwpGcgs`3EmTd?_PXin4a6{JBSTbC{+W+VLZoh9Qrk8oV<%9>GL zZ~?0SI){sSb83$G+2h!G%cU!cV#wF-=zhCXm}Hfobiu+Y7e27i^w0JaF;xSNW;226 zYd4f4o8x*~RB{1H{rZ&~`I+;|&1@Y)vIe5LH4>$D*^)x?ho_iDa-T@Sh)0kQ{C|J` zU$O#sJbt|OUsfwKwhEp|8@KA=_1{h%Wpw_N>mL$SBfFLA9z3D+WSf@3PkW(Nar56g z`mp|bd?#3FUy|y)C)^^hI>El)o{&n^fE;=3Sh3VXj%uk1Kn(Ge7U74mr7Pk0A zevcXZj|L8^GU-!O^z456lh=j6UxK$ndfp3>;F-BX@v?KrMk5%7ct(jFu%D6GNu|ce?9j~X0{7rMB zjL|`rL|jk&1-*~%^ndDNXSkMj^AysG@OMqN$Y&DY3^he=I7(R>_O90n!XTXcT ztG}8}df7F6<;0h@@3=Lz2#3GH*_+*o$?MEKA>P4Bsbakg3I5+m{!ugaajRN_Y$Hx5 z{hvum$3Gpq+w$sCsru3&xS=#fBnJ*vBN`}4IZ`0rk5#f7jo!* z#Yl^m!VYJ>W4~r>p-47y=Kl2}*FMVqOl_7pWS@{lNh~?Lp{^LhHj*Re<9J@<+0qO- zr~53kXChbGB_Ef8Yb!ZFnCzms#nz)roPut0k6UtjXML(l3Y}2m7@+Sc(|t<#JuH@P zWW3;n9X#c`spmoee5U*qyf@8@&cCl$9WKc|6Mx#(V)}+lSJZ9A4z_CrB!cV3@K|hMW7nV|RVUL$A~h+r$r5 z{vNfu=CZ$FLFJUolV{g&E+(0rQYms4UU169wNS3szmnkRIeJZ~ZP?~LTWiB30t;&{ zL4nrDlqFh(yku|LXH#1l`D1vq`$ud2>>O$6j#-aUaN272L^bsuA!6sv&%-6~s~_AK zaz|c>1vFWvoclgHGB#`^5i}v~Eg5%O%&$u6SBER%odn7CqrlGfbXPxfZyn9L=@e4o zQu9fDIybH#5wQy4e+)=vZ!@h35tfgGxnG6Wy8HO-_$+%6oJPZ5HwgILT-ko+xPU$90U&#yLS}b;^jL_1BDYS6KcJtX!?Z&!yND7|va; zs*w{ro~{#r6L#f1!%LC`W>h%rI|j2PX|`HHO{qKFe>A>+Zggery;DVZwbsV7>)l^< zZ=+}juZqm$`W~LP_*!+y%mUj+6=*N!t!kXZHfH86{1dW6`m*-wr=LxaM97+b>-AGX zWd=;r=qU~1_UdH2p=>J;?XHWE$9>wkkS9v;c`3Kpa&|I&u4oYaL zyfE9fa$E3>07_Ix>M)-Muk>&$kXA@tUlq#msYB7&oS0TWzlq;BFm3_$Us(>zWoCs2 z`@{6d4eUO&?%d$o?R?jVQpmeuV*Tye-Y*`F@7v1vImCt+&5>8$p1oXsMk)N5yVk3y zMAVyL`j+b6FCMGEWmp8Rbru-NTcn4lgF^k1pEU>! zLe1Rl9+-Jl^5jGCy&IxWJ(?tjXcy;U-pt>o|JB}_V2Tafw!<)6wiYDhJ*6zK^upjM;4>I-qG#wNu z^7QUjHjfIQ22ONj=k>4fd&-pKGuCx-cTRq+(wVOwJ|XwH<<%1&FiX1^H61)Ab}b^N z9p#iLs##e>`doX{Uf^9Qy0NpUSydrz;r8tMZj|B1K0R$lso0HcG5sM`BhTi6Y{|^x z@;1-qx8YIYSHi>R1hdc)LvhzjZuu{7)?VJJ*Ga@_kH-BZUYiX&qkFDq+BiwmOFzsL z7Q6gk^_V9;<&lPw<@qwo=I_qWY&&+HgfQyrsY<@KrB=q{65&Z}$srWaKh${c?M5FD z|DY-(-6?(Cyp0o+^_ul}PHHBOEcyAnipTLCXC5qnPwn$7vSC}qQyn;|Ic+ZeFpB?& zpTqk9cn^w2mPdkJDN||tQEh)vn+SW^ojCW;X`OU6`dCFbWzFpb;Y#WHHNMok!{uO7 zm||_gq{O6NDBzXuyVT2xX~kSbziG;V(cgMI5kq5zZceb{khfhsbh>rOS9ZR z;XwbNpIU*a`b@lshBXp-iJ$6FsH!+^67WW|()+_T2mTv@j8be{;BFqh>d4!1C&iLO z^J4>hVao*2MiNtE11F*~f=?^P*Ds&4WH$;XdVgyPHaUO0N-1JeHzK#iHEyPfQ9%21 zsMC*)M^!%>s#1OmNkNJk7VdIonuiom)0gaHS=Uu8mf|QahugYTX5_^kz+Qb>OE=x7 zZLqjuT$p%LA+k`y4F9>cuk5Uqe^fb2prkf%UFBvmeM&GFl_bJ(L%Nt~r6f@JQiHWM z=X^1rQ%{NtKO5L-*AqW?h>z9{s#RKlC$;{NS6=i59vvLYqt*OJTQUd=>MHzIb)><8!QN|r zSVe3be&sa+cD>$z(`UaN#1;$T7IN$V#rW6MZQMD=A@u?q?CKo2 z=aJ5ZDmY#B$&`!~$1txf%d-i3qXah4OoM_~I8Koil&6xsf3GMoI*3d0mIkYZ)Q!4z z^EJ&@3AnsLpmiGdkCFYT%G-7)ceC@o7*@lCH(rMZ)ztmEWN(M=A(F>2Z-3&;&OrT4B&XxYpMp{Rmge>$U{*bGhSzKU~ztt~6fvtFAdhnK>`WtRuhJu8Ljmqu8)`MPU!b}||=2ZF{Pz1x^h8`DsEHI=Z{ME&=& zzuNd81x9ue{(iNXV|vW-(sJ{}`%T6IYX@XIdB5xwn9bLIK;2dC zXz}w+1zx(0ZgI`$3X*W6zwlCTYp3H~swx~(#$*eee-6SXVqaIH6xNSML_K;mkn>{l z`Hx6N!=;RdLl1MjKh{>I6GM{)$aC`H0~9IV=ZaW<4ognA!_x$v`^gups^WVthF%eL zifZE}bSper3X;u`@SBj6M6yP=q9(Xe4H7=5U$rR}a7C=#Xc!%}vJNIPl{-y8HtMr= zG~oQ1%dog;eff6jyY;#@R~NMOrTpK+beP`Zu;k!Z**h70Vl2j0rA#+83OVU{#LKFZ zqIC&UG1VsrRIBNecmKURfA9UIPmy)!u=@)Yb@LwPs`LeHY(O++(_|vcI&()33>!_? zg9?n}a|zb);Y`&ie8s2j#Iia6D5F4FJ3L8aqY3%U|1*DTGrs&Xa1OR4q}P^DxI}#m zrKTCp%Mo{js)GM;r@xY25K=JQVt?dZ+@*G6SApAwx$;u@$ z!i`sc_vEQkwJ#DZP`T?QU#7e|@};rnxw-MV?`spMS*u55g=Tui*_6aRJ;mk&a-2D+ z3s#pic6{?!jxBCqGTI)D+P{?m^D();by=rlyRfgs?T6rLXIZ7YD!D}I&93gnLbIR= z&u5i2Xuby}J~1X3rD2BrHQkf`Llt~k?-jyg!eV)F0>e*Zy`FSZ<33KV<7Pfgq%lpT z{|fY%Y8vKPBqV%FYu@b?_YYbg)&3JIc>C5G-Wq*z(s|2?WkIh952ppt& z$zpI$gnlTnnfl)fvGM72N3)}2aCN1>Wz**t8<2 zT(WUldX(cz_sTMlggF#1s%$PdR)sG43DA28w%td7)YkX7kFz!E=24?Au zGtt_$(qFEpPy9*eotPRNT#?1pCvs zZ>hC)XTQn{)N@fov@U5|uee}BRiZLIiX4R7%A52ymkD~2pH;urtHENI#=LXkezeAQ zCRIg-qrTrgI<;gr8d~Ym&@_$zIpGr&^i~@uv{YzbkE`%W37w60 zx?LqP(m8r5ap4;4x!*T;$5fX-jH*cHTkkep2t86`?qVBxrB|hKGjGHfv+&H$u`wnE z7k9?AjMKPK|Jkj{FHt^y^gJ_R1Q(zBG#73v3;X>si!9%Ry;HJON}vFJb-j^w)?!`E z_TI#^VB$(>-PdClXCL1dS+f+t;G}5J> z(!Ws`48N>%apIxg1-%37mk3euDduqlDL7Np@7+@)lVXdlq*8 zhI%1aI0qVwgcfbK@QE_;A;e5K1 zLw@?F$f}?`b}#FYyn-nb{|gcM!O4Ze*%X|C={uXLD-v|iLSuGD^irr(6({-W&GmFl zsdkOWQ>cE(%lyB{d+)a?!mH#5pj~u5i z9rHy4j?oX8rm{v97in+F(mM*v9JEy!=P{@ruq?)|5v#S+aa+AZ*4ve=PvpIMn$o?OP$w=D+uXW5jtAXuzGV)c6fXG7?$sh^8dq87bQx+Up)aEFTjM zM=p45U54ug7_0R1gwkrZfx!;(x1J2(R~Of*U41%oRAnG+BLBES*34Jd5j5aY!|*&? z;?I%x@VD#nF_RII}oXMB%41&$%F47m|lw7Dtb`R^I(ajHwn%5sQ zy>Zh7FYUeR5eUeTfE_o+gnwZ!C~wii_Sh4mr^Z))42)2|HLyW{t-P*=Wfw?kjBb@S3ep?@qf!eaazo4z9-05^fbW&luO z;d`?1P5K=U8|beFUKUpcMeVeO(e0~32_wY~_Xl7H5}F>jJf6Jx3d7bo<-QjQeOvIT zAU;|_Fj`4>dPequorOBK@185@j*TrsM zk8Akq78K~w#`evQ-k7Xl|JC>w9bNIskkjCX7roB23!d5%t?B-BfxLIZt(c?PRZhHq zCGkg5qW1WoRGc%cp1tM!l@tG#)oPM0tKv;Z*Q$H>_kq>Ey8TfbzCi6@!A)1@aa;eS z>TtGc&q!7{+55IC3osmTfVD?Hc+^;)qjs3uMnlbI0_H@Jl27hr9lC+{_A- zC%a${H~K%UxUNs0V&Vl$JS+pKuF)>I0>g$3Ee1}8R&~~S?VH^Ep4A$_E1;8oeImTq zT>k!bf)b-h(t#BsaqVrEn36lGrTH@_uppbsj{rFn#W75C&TzcLue}F{PG2T?@@~cc z85V5n^f|5q#$%0PMvUk-`6$~K5dZP%FuUCha{rZ6zq(B~lwyR7Ty+DEwNja(`tdA~&QXNzT{^6lC4x7?gze z81jr>&w8X?KibL782V>*xn>37yJ^__CH0w*;Rx|f&qmvs-}>V2fM5CA&Sj24v<@`A zjta*tK$c5h40i&F;M5JL7ZX!fu5@1@oat6L%l&MfGOLl6vBSo5Jk!nlW}$&Jw(DoB z0n^j4*22YatjwYp^mDns$*?e?kDQDhU)6=$n45mBnzLB7@-lWH*bGfhwc*VA<~A6; z|2hoid!rpNWM=#~PH^g@kAEcqq?j>FpgF5#Be`8d%%jMtFUmK&x~tC*8p42(QCAe@ zxAjJgD{qG0Gy4_zDBLHry+L&7+^@$I60h?100^@ElabSM1#1VJoyLNt^@4zJE9g*g zO<;HPj#tC_;6SpPMw6s0#7=N#=`wjY22S^h$RrpI6qI@YQE==7=0m^rytWQi%hy7f zOqd>KW*Jvm@s#_GPPTUay6)d;#oXGG6p%%i{9I$;H|hz0Cqd|3R zvXrM`++k>Z#;-hfSD=pFF_)TU z!tSHLqMUKDAi^K?FAcY-GWP$?(&7J7ExXcx$(l?9Y~k+qKEB>?m>U)F&BNA(N;2PerKn^i= zXM``@8~8-PeBo+vI}dx{gr{(4M<-tnIY}uFF(W@)-#|~`pr#wl5%@6v?}xd*tqa`F zmqX0V+1}TQLqbwofhe zt-leb^$yBeH3?_JCxN6S(h}i8)=-oa=Rgyml^_X=t^XsnF~Rz#sp~85B&30cH+tDT zTEqlp#x9z~mT7(msm_u_bFe1|t25sG7~0C8KbiH_3?c9-W44ziZ8K&zE8`7uir*tz zq@w9!cIx`G2Q>!jKP6A##V{tL3G90}60>iqb~5R=)nZF-8QfhHu&Lp0Mv`dlaMSdb z&N4G0iA_&yBGogO_Kr!e&T}Pp*8m5zu4~%%fgk!xpvhQYa_SV)bQ5Q@m{MZaQW|+p zJ!B1ELKW5SMAx*4iLeFQyOEBPe~USBvinxSJjCznT14~yR(-7MH+Uv46l!sCy%zLR zs++%bW(iZd0Xj>4LN9b8G)&SJn-kl(530}Z{Q~cNt?yDrG81Q{*Vt#VF%gPyZ}e#o z40a`1i&Y>C{2Cgl<-lvTmXa|*%lqeoG|UJp9yPZK(YM4|g|lLSK3dXO@EODGA=9=`lIAlrb@ z@F5seNFuYCWPTlP(i9g|ZJmgG%=< zs7#Z99%#vnOz|)lx$@unlo^P+ZH54;7_?%cHBTqVo<4Nf7O4=lpZiWBL_sogtf^c) zn4{*^8eMm#=x#GO)1+tn6KfoNr;R)r=}VT(lW8)vHFZbYAV^;N(__PQqium2onV&^ z<%UF5J^2;#G|5Qgc|{b4Y=r7T=%+GGIUa%PO7y3w2&El=a?<9P(#yudRIYno5Qmp; z)YKH>wxh?9B9)csaS~#tEjRzP@VDQSdlyRU5K)^duU%2p)7l`abhS7$h~x&( z5!y!6ZU`uXnqm4wsjuuOE6PLlEKEKNp@R8iV!Y^r3w|2K=csirq=;Xse1qfH{8(Tm z0XHeGxr-2}nIwHKE-+Aj%ur{%YKt@d7JTio##?biPPobPq+wKg!ws7EoEleMSOM%x zgSI}@QK@U>k3iHcOmhFY89p0yp?Mk0aPgqP@HMj^9SkA`kGP%Moadr{g?p$kb&Uyy z5Eu29=@5Nh1W*0Vj}fO@;xfDYC2Z2^ynQ*FVVCR5w-k}L_MPAOLg&48wmv>3@%@R+ zH1}Xw;hnP6;FKF7q1rEgZ<%!dz+B|7m1x$NtARX~s-#Z+1^_=#8Mqwg_r3STABj@y zubw2p50f9WUN-UeU#{)&@s{Rm4RY1f>kN&*J8pMIqOLj&ipQ4HrsS>FX+ul&B@&%s z5M2^0-FcFh^*S_v>c2qjt8a>n6(uk8oJhz50aBXZbnK&0t_~8p_O+1gWEUk)C;3a* zF@WkeC(TN|$I84>QPj0|{x=a;Km>2-a~_hhG7suIdO>Be5xFFS-c8FAic!hh1Mp4- zy&z5z9E`!fW*-DG<+)XB&8Gi`?oY$J=cMmB!!w$u>(DKyDq=Q#aVaqK(XeWgsnm~! zAE#4z-FuGxdL%V(z@^$PNjY#T5#|+elSQtV6|W(;&#iKY?_NuO4omZ?Fu1=x^Erbu z_?%7%t4#9GeC?q_V^7SnV2u^`h<>>q;W;8bjGf>QY$dDYqp@3&F0Y~J#GX$68!jK`HBm~ z+otN3H(H4t62dR$@w^?n1wI-%wZ~ycK#J?|*-oB&>p3-3DsmI|g5f5kzh__JcqbF< zqP7e8LhD%4W$>!!L%EVRwNZeIV?4U(O8=|Bns;wZtOh?|!iH+ z;$rW^RA(%+MZHTD?K^x&%yY`A)~hm1G^5;{jJ1XC=0^hAl55gmrPA6tIQ3{o28PtP z-sH9uIxUHG>wJc)Ip`MvtQ(!h8$nlEkjFpU0}OH})2h{p*`>);$dl^Ez$mv4VE-1= z!7tL`Y-Ym)%u!5^ts$~@a1%qARFgCpZxg1D?8UqSPuvyP@0qO&FJ>B@>N5t0_TmHp9ETvYuev# zMV8oVw=V&=q?s{N=7M4_6_r}P2D~-8iHtBv_zcxJuf0oYo2@#Go~L!IfGdT$vC+S* zrG&J)6yX2>B$+9b9#5QYaW$!%BQw~T=JYJuN0oT@gQpt$`~;EgushCrNcKCe!vYA@ z>Mmxy6p-T4<28@JQWs`My1nrq$NT#z)XiNtV9r}2EzA#rz)d%~HvLE{wENA58M!C*Q zyEKuSu!9-A zJ8!)?En}UlE*je5@Tow6rc|4LHs42iqoZ{!Ck6?C;-90o8lw(ogmytB+;ed)|M^8(by>zlMH>8C7jC6q?IHBH*^{>lbVG3)?PWQi?@9GzSBJp+F>u&{dBk&! za)Va10xCCBIxY#HFe6Z*Rd=+ts(MEHwE@GrPr_B=<=qFjZ|33JbKasTr_)ssQKlo4 z#J?!QMh$(_Y9sdvjdv;f$PH|{iIw|QlY1XYc~Y{Af@Jz<>QsMj#;{6Wq1xibY(EXx zHa1FjI4ElU;g3hB28@VQJd_Fwlbeik+vZAb>FTfUXD|B5hk7+r_wW^9hx1;Fzrmk_ za${{5D8aONe%i>G5^`HJOy79f*sW6&059F77#bQR=EL*39dl;EW&%#LP5oU`##`%l zD-KXVd0eva*YU_fV=~yzhHyj4s0)Mj(x(675$_~Z?3bmO!EBuq*nwVY&aw{k`r<}L zf&37k$(in1nnsPpziWELh5pT^a0`Z8ju5n|0gLdYi_cm`PE%1};IyEO8kYk7a^=s% z!(Yx^%(O_a zm+{`WRyH_NuT3+^X_;+)69{3&Iq)4^Xd$vX?`wuYj9oLWQ$i<%dXnAx8Q={N1s<%pilSI*z{wJ}?i}iCcCBZMbvdOq*Fnx?@Y2KqgF~C-KD_#kQrD`2I3$ zOTD>9uY{oIVLQYptU{>GpSY4b+JYD zc+BwH`G1TpbBFJ|q}_~ee?)jQbF9wuaMh8jPOiROGp<;ic++(ZBys>2{^#NE))FDR zX%^-GuL9L7p;TfZDdysOWx)1+C5jkV;CRdcCfdV`gxiTU8u(Z&W@ZevG|UMyd*E~HC>5@Todu~Ie^pyxez$QToMGZ7QH2;T*0pFd8MUm# ztbHFE^VJP-JfCL*fIs;?ZHhe_^{L!8ZHj$nc=l>ADmcE{?ODf05VPEu^l@X038p3d zicqwn9a;)LiEG;Kp9u=d@EKCl{75VnzGv&1J`Wi>C;ZsyumZ1;4MurD3_3I)(Y!5& z^}FPqFR)G@IC>@L4mlE+rjzhcp`IH)BM&}X1h{btm$rUl#&uAcE4xT@29b&}L=QqV2R2}>hnhtV$Kfm>}v z_2bJ$6P5iNZf~v=ijc4(UsObw7_hRN^tqO zWZG0trupfvT+yPHz1meXNc!5qKJfRA#}1TY@4n)NG3(3~&F|jc8++kFvBa|9Ws~Qx zD%aJIWz8Qmw~l`=e>KLOi#b~{d57?Wj)w@__ZfGRmQZa{i%&_Mo`LdrC3g2` ztM9I@=u9P2=P-*n;Upefs%#idM>{yrgkhqi36(LlH5#D)YGhr~P=b4oh_D_pk7@Eo z`vf)uLE85f-#pTpKO2l*YcKN}c(ywKy@X;;^2?gEF9$p0DGQ(^5flj?zC7Lq-!4%&6@{rohmq^7$TU&aiy_yGDP(43q zv!+WDQO~4>$iDn;fF$eu<;qrmyf3T!% zc)0T5FZ0g2SN+lBN6ODk&z^aH`hGm|20IPC*8cWY=Yx~=7vhynlMP?)Md}zw4`$l8 zoPxvkn`+cu=;AvQL~bNJxC26TEwU^RUmNDEf2FzzsY~MzbqM|E@Pw#k6)D$;StjlB z>U%=}XS7dSq0Srqgv?J~%;j`qCM}pWf7~1MTPqsw%BFYB=4*X#bp>Ky&eXMdEE(vR zQknc{-a+1LQ=UA~psm8N>vc@nyE0)p|CY5Uo6i01P6luj_E}N;^{A=uo`0S{OP<^L z!;-%J1KyB_(&pS$y$IG{1^*e8anNVguKqpStJJmM;aw0a6md8M>xacu=AoI{-$GZw z)}dx&hy+UiQhqb3wXmPcXQt$okQB=8j;EV1&Xbc6iE1>IbLqxGupU%`z9L#?`x_f4Y%c}&>5o`-eNvvsp^(yg-Xi>16 z1>gZMJMRQ2Tp8X!=P7`2*U*|VeeO7aOHyp3Nyk35VGZxeI^uW3%guqA7!%UvKpLZ} ziPZ9Rc)w;mX$|aoX7UeIZ+B)HEzDs_qd}vkb|i=ZVgSvn2g%!PfqXrmXQFP!Du~J3 zTa2SIG;A_0`pQhs^u({#rg)r27&TZ>v0MMi;R^URmJJZmIS-T%i)C+m>$mIGs;<k|7%SKL+<)UGK~A)9`^(4X-}-_wsCOlVEG*+^$L zlUIeiar;U|Qo2U%y{CXoSx!n`Y(qqT{BvmcAgF%*cK3`lQ2=TjM#={^sZQvn8?XA#^U#&Gky$clZDF+C`isfV+PC?-kFP`_)KP# zq>NiRBhCR874(VShXWMw&_#$u5d7dM2po)3gyHn?8F90VT-1sejIl5m+N zg;THQrvX(ijpV$7`y>$+GMBD=!0?EcwsPFpS_NwuoBBORL+|)y{CWj=&wy>Xcwm!i z63xsWDZkAIBc@&a1TNlJ={%PGpU9_s+MjD7f5kO>j+=1Z!7(lB6X>#xtQpEjoOk;1 zXsk|S+*I}G6~Mu8T&91)&w*5O-_@00!J85O_-M@bm(YC?4ur{Qrjd2#N6|dpR?E@N zg#Sarc&Q9n^d6vqf9~i=;jM2$m#Yv|W+@?yz4w?M(%0L|YTC~_pV~mG^Ft$t_Og&4 z@-}eo)E}7HVHOjgIzDeU2OZxA_1ULAV>@BHZo@LO0L1_rRXPSnJQFQeseGWk znqUeJh#vv^EEP<BtM+?idKw@O1KVd2B-jSX89Jb;;`I)auX)g|5U`-+A6h#5UCTS@Hayy zCTu`twEl|>D`-?#$nIBOrCSLnWt~7&qI%l@^vdMbR()XgP%;uK?QM}^N_ZeynU~Iu z_#bKJIAGJtU+NC0pOIv>jb@S8GAuXI2lRkqO#&U@tY38HaDuw~-iNC4)N7j=Bjlgg z30Gj$UJnqLz7BKK2aWW@OD9pqzH{#2?wIkHj#iwQr*aVt|f&D z-IhzlL^a|9m%j z-NMlsWqUZ!@B9QHB?V-|8x0c+`M{i*`=|!0#A2`B7)9GTd6O2)28|Q}BJ=5n6!J*UW!Vln_jKz^cmPf-+b z$Yn+)lDRhn&wCRkPhHE2kjbM!R_D1)c>G)V5LXMp(O4-M-Sbg>x@4n=(~%PtSrttW z8=Fo)Mb5a<291=J2x=+yZP?xyJN_^q!~~?hQ(DlE-Gq-cdrW|7mZprQS5I&cKD8)b z$on7s_{o9bRF2fm%19P25k5p2bb(WXNHm=p7k%DTtKHkyS<86EFBHGHjWy zgEvJmYr&JZB;uFzc!D_)epVF7XAcbJM!eh0+E1T=09m<(=jkLtj#WA1VZ2i=r=iWs?cLR*MO3CsV5^6QVowo@GoB zgdR-T2%rVQXkhYuf=4I=K8{)r&Mlp%)Ft0no#+Oq0asDcM zxDxHv!Q{E3LzEXE*OwO$-$V`Y7({MIjz;OS{P}`0F98I>)_qkhy0J}}--Ce;0Eui` z{|HKZ4a}`C%Po_qlh}ufprL>~{ej~ZF2(Qn3w1cz!;WjiX#KQn@&KfwsFC7+(%Lg6 zb)OXX$p#g(4GPNd(F2{}09A?oX=EG-Ii@zv5>lxRzhx4b!UqJ5UN1n>4N_#BKp6Uo ze^@9$+~y$%aDosb>yn)tb=JXl7nO@<>K)sEp#aSp?2lw@*Vx^u!j1WU{LN+% zS*16El%Ks$*((`l8LNRZ^4y}N3_qOGN96$BhQ@iD@})g zC~!=M)fh^4E7MC;oqIhk@E~$)Ab+I`A#j0uE7fRxizDhUBaZ-)-}f^3l^6l$RqtPr z2XB~4sQ88wzMQkfR0A0xo)H9-Gda%lUH;8C(UYF~74+Kgzev{p7fE1KwmW&H$gtt~ zvTFR_xss~@(k6s-cHezwB7cWd-OC@wfsMFQ02;7S_Y$@9tx2_=cyU!yk13<3zPUv^z_E*(zM7Hi{!e@%Y12!$U2 z&H@sgXX9-?!JVuW)hdrHyijvy&E7a$B)}maDr8-43?Ms31r8Dv+Zw8RGuliqX=*@7 zukMSdpMaWF59j0*yTMk8I+w1ZFqEVd(YbzjzpG~Hfmdw<>^5lUZo{3K64vn+!`nauU?&SRI{sHDahk;6 zQI?Y$KW&sAK;%O+U1G$CPXCp#gdZ&N@haOC9K1<%Fw zp5FnIA*tteTr}oNGbv1!Kr;IZ7~mv3j|sFO62MuCJ1-SzL6J0{*eUMd$iLtG|L^Ia z?j3NC&8`|gxCDYcdw4YgK(@uIQ89a9nP|Hw{&6T274;H`Mgb5FZaa`oyXZ&JAoT_2 zTZ2o(!0~&z!0{#6-$QKsxu&%U^DUhPOJJ@;3wru_>&KB#|2GB2nuOpLcU=xd<8_{s zFE*dMl7C@_gLf+AmURO|>u1dl^vCB#>+)AmL%_3ozzEi2z^*6%+PxNRSHzPS#yIVF zVJc-*Q6GZKB)`=00MHTPt96ik;j%G%(b9VHu=wfJX%LwB7GM;Z3hBG%STHsoXacqF zJzI0rF(JOjvIAP<89?P0Qmf#My)pz^DL6HHV&*KQ?)cAt*JUGuV(w() z#$@iPCE=VYEdm%6f{0O)w(_YCU&-9rLU?LpcxA7M8<5mK;8vy*1bHrm_F5d%8;=OZ zG=L^!0`F+0zV_0Sbv2u@{Bt8yi;KPufo;Y+|0@;eM~5W&-3T;THMVsDg13N5}_C9^QE-KcY7FEvI&UCUZo022kf6rMm%^nlPSBkspzM)pcEUq)|{v z>PM9HWzL~OHuPvj&lK{e>q*CT+cfE+#_MWklq*6$g&^Or`0l1$^8d~k>bTV_pv9N_{dJMSuBWps!Ef4hfnVh9Wrn5PVibDC#jRdvccbb!|C=xXKKP5FeNnY{f*Fcj zxeYE6aRQ)14(@=dy-_`<-$d-5T^>ZhjQ%^Ap(pKbmxS{jdX^Ru0N?x>3;bM^UY^e>fM}H-*KPwNADlG(}Elqu%oPSUm-0%Hi?!eGlGIL)eluJhYT}_ z?=l8U%T+qsG#IzN_8dt7y>?87aqRf3Z*l5Yb29Zp`+gyEH|qh2dZ;0q#Y@}#@0{90 z+EIyX@+bSxtN?24M^(M28}N_!L`B^hX>^r}2W$~Th_;t~i|cKRer=|9VsCx=mI~0^ ziP5Czkqk5dYzJ+ogW~W}#0&$V_V5ZL;AX`uhHj5^nz1szg$0>H$eNiKpIzc&@z;~DNz89&ROIz?cA@jT1oDT4Y`#v8B;^s$q zG4oLJt@i*2;-lkDJL?{9ygPn;lhfo~G;Wl_O};PoPrT_s z&!69G?;Q_Hr%nZY^zzRIDUe@l%vr8!ZGoe@nq~RUk7n|MBy803JI)}=K&aa(klxdx z>qa%g$k+_4yI&k+Rx8vWEfp97k7HS{5QOfqz~{<%@n`X3Y1KmYaOH_%>m* zzr>5_X@{ExK%vvyAb3KOJ+$E(pWrWZU*{l1I(XU%$>0E_%sp;|R^rnYaFom4ZKQDw zLDb_0qv~|~L;@FrGb~c~?3C{SrNYNnrSo*U_W(bvbvu0sg1i1-wITg%FOEwbZ{g5j zH0h9LJ@xW|N=8OK$7SK_DIqpJ+Jx>x3VZy(&;qqeOngbf?9U zd>BXo={34upEA{0ON)HBO$ihT1L#1@v^uuNk$Te51c_yrgO}wPMQy@ZS`y~$Z%|Yi zPaHF&i+a2AUqf(9XHU)S8~II898hea1Hu02(urBVrk@avzxmB(dvL_Mg�Qi;(^* z`x?}EO^ti!K-fC@F6!fk0J6sV6e!`D;YtvDDW4LkRyl5u=@vKUszRABg%hLzQ?oFX zkdOzvD3vs3uYW;vnm32y8MC@B&`JOYLV)>SkA|<9Wi-9X3hgbcMcS$Rr$L9eL0=c# z4WPzORa}!;tuaD$%cH$X>e~zCm$U6W;Er+mZw0`y#j6Fz1oGa^9;mTjf(|e(l%>aV z#fvSMvemyQrefj-_N>a0oV zW={tSXD#}jWRX>`#rZg(uolyog~P(dIFNLbInjgef0rhKn;uT%e{Z#py+MDpgxz7A z7^Q;D-pRTwa~50zq=u*y%rozGBNJl8ekeU}HC{xQ0K;sL4}oL4f7@nVo{z1iCfk@` zmGcM!xb!ztmoU$Za!6lPYs9VWI@e#tt^75hzuDs?st-g6bbK0vedRvu!!8A61XURD zmS8OC&Zr#l4@k2!h;T=UDl5QQFaAsABMvNpa)qnaj36`Wl*ZrkoWk3H?GQt<9ZQWwNI=HzO*_$_^*1)TPc?G6YQra?O>NgV+*sxGf@Ig z6=Ntj#R~y+=@aLTbUMfsjIgqR-J(&t1TwC8<_WoxYc>U2Rxi45QoUvP?|h4|n^VA1 z|bfvye0t@odbXsEwr4Fu#xAq z)q78&`=aKTg`~65YhXTFGs}0Mx*lr0sz%?4ofJ!Ow-AYK02ZMtvs6gY6_I?Fb>7Eu z-lyEc2|K5_Bs{P>{c5_CmJ|gTVf;AW2jyjY>v-yALmbP#h=m(s%b+r*a3DL&Qu!Ud zu8H0~$D`-BMoT^yx~UR!zcrpF>m~Z?Nn7k%LyZ|!(IE2)U@ITd|<+}qY>bg4SZE@#pSUq~e)5DKO>55jMB6=G;MgqO?+ zIza~3OjLqQeg1_lXU+n&U$@9syAA(1B=di5%76ELO&pekWLx+6wb;_+M#c}e%%gUW3=;3JXVrVda`^L9cf@4UgIYanIIcurnZZH9 z=B5D0D$8Nso%uDtZ^j(fGJZk6^fa%2GjFN+=uLyfJvME#r6iEOAm0)E9=9Dn0iWlT zX=YHu4_QW+H@nyoAbp-LLzrI4{Eo8fp1$X20QZD#%v)R0{!i!J9L&3WJfTCFiGZ(A zJNc5k895h+3M>SP0mSQhPv33c>jNJL2jG@HbUR!Uv5e(y zGSPm);z~8F$7KP-BQi^ukegLKJ=AOM;G8vue~)imA9*BR^?7gqm8i7zw@Z3spRflW zL?i_CrS7nv;w0E@@5{Q}5Ieo8p7~P76EErm{Jrv92f4Iqz4z}<-@ek%Tz@?NiRBEx zHwc|__x>g;xDdx?!CF=4JNx;=L)EE1?}BhXRnoS%rHIz5r{qJ^a6M^P(vF72>7Y*y zZflW4o=+z1n|}aX;wvI5)$zkz9+gvu*=~LPrEaQOzHfffhyyReACC5m>!@u5wtIXF z$?YKd@JeDT^`_{eOecku?Cl9(3NKn-6hzW*Xb!$HIer!Qs;PDbOB0596Ek()Q9oC2 z>`rvl(bH);`xiGSnP`vSjHTQRbG>t`mQwxg!V#&pU3|rYdu!#N-%@G9bG{eiy`h@d z`xJ+6U3@kgHTla)Px%gQr6iE-?CQ>UeoKLo!p}4zMU%K&gZo`}e~0#WuEDh7`~=k4 zpPUzpiSv*C7~dpO#eL(}eP+zX%INSda}kYwviH= zMJ8+TrQzq;`a$w^LXZ!N{sNDcJfMn==K57a!iUbuG_RGn^$ixbUIxSU#z(_ca$dZU z8z@~!KcGp~S-+ZB#_v-{LHY6S^zTJM=M*^uBe^n%gX!bu<3c)Xq0ez>`J^*rkag>C z#t87Lnp>iAA@EQ~=Wo3kX_>aD8~#HLMac;r$$3y?hndPy8L5a4WtDclnUY)un||95 zWi!N?-4qTXm5;ateDueb*#7ZTI$Y2ni+)1KjS;J96;^FAHSV>!AFg^+i%W}0ZXXmA zH<$k8_8Q*U$}mEZ{MjJBRxoc9dX7lnvIu2r~c`x>o*jzgjRvi&rKf)a>1BE8H3Nfq%H0Q*R-g zWBlPT=g|rEIa4{UW3K#hkIerLtD6PuyDjK&)eetsXOBJO55bJ42k)(<0&?D4hJ7B+ zL|43tq`!^|iO7c7{ZeU~%4>V@UI%J?T-#eQx6;deTah2>`=J+MU&y+S95XA@Wy)(_ zGvPz>=h`5{G3+ive=YJ|%$%v(?vDx(gF1YFYQP&4nF9@`wI}uLl1vfW5EysMunJPb zoDiw22>0P}tMgCG3K*%C9bqpiuCj-xEf5ynqXY2A`ZMwIlK#nEm-$2B*5d50q>8`^ zX4scA+=k&HY)pUp_m(R!@MQig<_zH8M&~O?8(9%pkhl$rtZTgbD>4j!oOBZ7t!^rW zzFzbZILAO+g!ii?eP4vHxn7R5{V@Z)vE>smr}UZ#2p8lCn~OsTjt~>x4#({TVsic% zn9|^W%S>7eOSV1`epGgF^jBIeU?p=t0lj#Y=}vGSXM6;kj(}fb{RO!DIotqzU4zSv zrv@mY^;oIRC=|wjKAvEmRzW;D!fTW;mAZ}e9s-Yt-D66CZ;@rINU{4uvby=U-=%1V zeJyVn_N#un`P^rQsp98kPzNH4%O)-DDu@=HeB9eVqk9}8ZTw^S>btd9*Im!#mvnD1U#ECm-SRQN24RqSwXx7Ok{#LoP#u)D zEhB5M*HG5j&g*VNV=*cVzS~0qVU-aU$^PZi%C{GqQpIwTt6HAtlwzUbx3e8dWRj?^ zVSx#qiX59oBc!OYGe2Rq-*Ur1ArEnwzCfbWdNx!0@_ z9()vAUxZ51hy*ZJL~ZS1DOhj8DIh=8eGLckPW!}E_hLG}nVvtclj4}Lm&}|9QQm*x zqIKSnLUna-fQg9ALt%7nAJ44leoK7DZ#RS2nDrWY>Pf>+!7e+>yf<;K{`$phzP(GMZI8EFRiV=b5H4O+|~fbyeGBpmiAV zG@}bNm@w`h8Y4V;+jGq?eW(+YFaN8mCg_7I1|2si|C}iiT@@EY=v_rX zDvN@eQh((4uhhPS8ZWD9yKi}M#x?5R^^_DtM1f$gpMyY6RcEt5*x!dA| z!zOOU{>Sqq;GW6d6E&0c5x4^o)~VoQMaqQghRMNZOiS>S`57qNke9Z-h_bwTG(N7? z2~aHc2b7!WBqWcZhJ0wd>kDhUt2`iLaCY!E(mv^VN6Td-Ak=qxyNy|v65=2PLCIX1mNn?#@&%%ML@ zHwt7laC95J`=lPXVm@_42$D~{4GHi>$ur%~I?7O;M`KzhW!mtW>;7ukcy!ygaQVKx z!yX+mU2mZbBR3^e4~X2$EJGS}%8k=*6eL(M``mXOEg7_I6hQ3w4Q=Gu`KRhHmH?>lH=~l~mBk6B%;yq;c4P@ltkI z$ddVk8ECF0hYtHyVsbHus$sc}2F-Mz?~4P9xsL^+lMn9vU92FZjXMVA!y^QZR81&Y zJtDLgTyNdhljhwB0nH8ezQt7aGC>t=``$XVQ=%mdgWni?BueDQ-HSE*==*_R3J21< z)9UB|_mf^yde(Sa7HBY{5Yc;YDE8r%6F$U7;(P6-FTF(~t0K=BImj>RtTAs}$L@Bw z2Z;%-`)O}Cnt5=uEZ&h+ES^5`jlU0)`XU8K^IPS4 z#5oW;Q~uo>$ka(iI#z&1WFgCelTYT4zc(e06U4PyjV;GG0P3Hbf%w{XYc$Jj&*kn=#u4-_Ld z!iPaOY`bA}l-JB@SW|#=nfgxM52*qBw8_rcrIC>jfe z0pHs`W7{A}n+8HcJa1<-TdGgXcGS|%Ag5hzHF7Urn}{fbt{WxFYTv3{OT{_~UfjlpH|@u@Hx2|m zwR{WIcI2`?XLe(()c1&@rN$(Kq0yp`A?{`QD2tn~ z3LU+n*3(ysyk;J1lhqEHF7ufeDkjym1d% zpA9~Ye3j~rU4V#gJ$QKjT;8U=&!}nEjPDR7$minPsEzzkv5P{>9k(*TE<%D;#3$Yk)g$re4^g8oz+l0GJ&(o-5AyetDMPOb{W>a^I2{ZOx@3!P8C%Hfv6^O<)Z zELiUdjb>1n>9mRPq21^nq|m{w>pibnav^MpAC6khXTKUqvqUPx#olubl-J*XcH5 z&COqsJg5Cr^ixYm=9oawc?~Fz>h_3ns35-I@tgbBNO0MzVmR$NSTWBBH5xpzH za)>!mx*+u9r?-0Cc@ZsKw@73p7N0WPRn_+8^Ft38imFb?9)SspG<;Nl<7E8Ba0pHR z1|`-DH~YV|#nRXKsJJ=y!qB?rekg<0dYc5PS3N{?$lRhD>>A51%3s5B7Ifv8e$@;p zsp&&<&!zS=NQn8{vu@F$(;%BcRX^l#0klU+R8^QMkfi_1{9>2)AfK-Mpi2wiljonD z0OK>awt01%a>Z$1kJ~QOi z2*isJ=kms$Vy0~+Kj|QU{1AslNTk%x6$SFSa7I~>1+#xD>t6#8fsV^K<|<_Qequg1 z_cN&ra^ISNTu4He={iNimF)I2^Y-ChZ5T%KqaNvd9<#PDCX{;PS_;D-(rJgUC8r7~ zL*K|r)*+{8sm#O4Y17JkV&<6AWJ;E6-mr;Tlg2*IXS$yW(V6U@BZZ5z7_e|#I6UZ) z9oZlA)r3VDq!x44@xL(k%}!)AVBwRq3`sX>ksX?Ca;NRNCUvF3o&}2qlD;Rz9Yo|h z=^*V_i)Jx&J}x7WMM`cc0M^YXWM-LXG=3aA3Smkmr=flI^Yh+SdfIqn5Yx@)gAeXE z@VsrhI`G2`T%|-Bt2yUhH#msiPfsK>V0jqVhhR-q(&N{irs^0X5u|Iv@XMgAGwVLM ziU*~xIA;@WShkNra7`wM1%klD{7&mv~)%t{<*6+*0ym$$G6^H70WL$);le z;wuo1?Hx04&@wCW!35qIeg1Koju#$?xgJ+_5x?=Jv;u_RTIbCO43UoHzHgWkdBFj! zOD+2dQFY2yd&{du?(+P@pSM%ST!Y{bI?gr&i+j>v^{!CCq)g-hOS=eZ1Z%%1>Ev)v8<^k-)n#ZJJY*T=Sjp((GxBUfrBqpIg~7wE5igpQ7mS~QfSe6KOqH00@qG$(w5Ta*)HcYGXG zg@5Ij-kg`*diTVqHHOa@O@TlAydB$rVDs~`&~tR>32{yxptM#)ORQtrx_u>cHejXg zbeWwjTG4ooORqB`cZ^p#ccLng`0Be_lpCWpc?9|JV{6in*eU8COG$n556NwQ)+T>d z_n~8J2L@XV@@@-mosZ%g$;rumTYarBJo32FMGNv}W-obC+jw@%Z$65Soom@I>(Rk( zF)CImaF|<8=XL|r^(r~5=1!Q@Zs!jlPGOmU25kIhR=b%v`)~@ zg?;sGSyF#vhe--{<&N-`(`bH(qB&pdPU^+$bKmC^z~%l|BEGSM%1n;+R|T!bD{E^( zHdm0kjfp7H%-iy`w&nU#1lX_OpNg}~&w65LVFuIJ=bA1im2wlcEZI?|JN*kaE4WGh z`)npgEr^5ZeOlfZs;WsN&F+lWW9jMGmBsVdlXoNiH>BCt%ybTi8_a9=DL;f@0&ZB9 zeRJulWx-t6)khqj$U0khc6H;kk~;&o9>K`OV&s*9M~!Pq!)mZuCztAq>+A5+2Cnc4 zGCFpCCTlv_FWF_clLx%loY~ARmES%#ZXw&Ee;oB7Y6#ltXm6=(>>JQcM+YFpfk$q< z^Nc+EeCxKiJOj@H?nR1nQ9a+@mV4fhGTr50HKnR+GEtKBy&Pq_Ph@&YG5Q?|3)yjX z_^X!6_}p~#d)K=ODaw~xcG#c)+~5uxk(<9|rJzwVCfo=x0ZOqX0|=6}xweG^3o>)Dk% zhVi!p+^N;~1E62BWW2hV(8?ekJOmYdN=SBXS~u$Mw0o}^n=K*VpFUUAW~Yry&2>1m zKAHnH3$X&MROeNF+&l7HyRxh&RHp=$#I)AH4ZjA*4*xQTd9aOH&Z%ns+*sGM4$$

Xt)z>i@KP7uAGR9qs{9)iisv3@Kj)Zl#I#E)PF?~T!A~DG zr;X#+?cRIP4c*Pb|!LCInouDh*s-)Tnv zI#wfI$}18AZ7k3nJ8BLQYEUGk4q+N{}! z$geTdo%td-V7#h%*NT(`7<)?$b5C$16DBa_J*$Gf9i3uGGSZ0o|4!y>_>%>EZX40+oenm5gr z#S=13yAL8o-91WpL}#wo50*djG*0Xj>-c>4y4Lmet-nr5*+0s5q}92-$~)5AirIU0 z>tc6(b;WMpQF+n6w(lO{J*;q7f6_YLUwJixA#-taJu%u=eB+0HcDp?U{AjOK-*MQh zvQgZfRd^aPYZ#b*Bh08W*w204Q@L6b)lr;x8}ik8JyA!vVku1pwyPcKT_?)SH=G_v4$n7o#&CVnYtdC(+=M;M&q_A!Mj~~)@nC8 zmTg;y@zpKm!*-Thov>;FcHw?!qeA4h?wrt<0`=n8G@^~$r;Z!9eC8Lu3D!DDz`>3(hugA6c$B2$x0V~rSm^*I-jr=txEO| zx&ldka_cr(U(#Douix5=94;wRh+ciWBu4usycWdFcc@SR9jN^^fFT%cbF`#)^0{kO z)PjGyM6odKaOqu%8|gpFL#khQ%V0HI+3+-&-t04gEvH@yN>B0xde*6~?M)fd)1s|g&nzP;TJ-+BL6L8u~2H6>f1VO}>Xf`$?2X*JuD@(pncaymR-@-*0*$Z>bX zs=Z6Ia;#bi2j?XZDxA4^y_x+1vPz_B+wP+}24L=-&cPqUL-eibp3Ga zHv^`4cPKK$uFpfPU}Nm%H$CZeqH{ML9Y-N`A&oOEq$xoI7}rywJ5fsJRUoQ}qta|R z)hOe+yBcP+=Do6x5*?tUJpUnTAqX}Y_47Kvko6jbc-Q+3^mEyj*+!xv=1JvdOx~ml zbk)1!+j@pss$RK?o1d$3Q_z_?LH3Efmh}BOu<2bfR~u9;zVvCKsI*uxcxO!k)fES~Klyhtg^i6@ z?V{66w)lP>PeW`Iwx^Eiitn2a9!loj6!JQ%6p~_3C_)TVb8zquD(0u)Rhr=8jBk7c zf6b=l20}<7{7M_Ntr}gxHZ5wHfVz(7Ms91;)ms}pv5Xwl8F;Pt`Ru%slxYRc2N^St+{{Md86eT`lk6Rr&Suaht91PG!|Bwq*AM?1yC z7GmzEZ`b4$x-+}$DW9BaAwT?(!0qGSaj(IXCed5OJC{>Gy0h;~=D?CkonU-mq?N)dBqhmh3K#f>A4YzVO{qELnIeGSSH9bzRp5NKpDqrZ_ z<+?Hcebfl%9^ZXeyPmeqG-Op1#?Wd!Bb9*?vWj9#(7zqA^ZBYLlxH<=Taj&gom~gFs*!|#?V-qTJD24< zv$yBxeAhPvx3HqQt4PoX6I$Jo+UQAi$H+y7>3mO*>Vt#$q27^Bd(brB04-}Sx%yGO6jMDW)8*_KLF$11vYS5zI{ zNepjWE7Y8*Os*5~_c$h2{by4HL<25^=nwVNyxf1@t5EkH8LOba``&aEBAe-HkL!ZU z6p_I+#$jV|1nmIQ^m5J=_TkSbBHvqaYx2`4JU}R@wxmXGbMeZ}riJH1Iq{n}d~-n@ z=AOWPcipr3%&F1{4LSRMV-94m+KnXNhL`Rrd~uDo`ibou1XkI^0%+*wQ{cq@*1 zKSvAMMP1(%E{Ru6O67X0>xg##Vh+ECclux~>l6#@gH6 z4S9@yTU}?g_P;Oz|6fSb*>vZ%g_iIixe|H)l`B!)&YeOBe85J*&d$eA!447`>i$n? z5oH|hTiYz3Jy*#Ua)2rkS!6c(+;F+yf0mvgO`Gn=kEw5M>```6K7CN zRwYSkuo4q@ka_VpAEWqRSBbx_a-i_{W&M-2QQFSY<{x7HleF<4M2%d0VB)`N8Y7~g zJcT~Nk~;GatrfE@DA;m4YriPrTv2gj?&xSG z@8Z!*NhWzjffTqxi$^@}iX>rt!n^CdLgW%vVb0fRvo}}MBP-V~)q`x#S39$^Pq$7? zXF~c&YIS;+GcIV>9i2ZfqiB4@Lzd-AZ^=mJ?)yR+pz5DNmwAzhxbUg1m|C4#6&mDr`UCx9U!{tTfgALAfaZfw+GD@!O4%4o znSQxX+_YBT)FoAty;Xgm2CH_x9e%V_y>EemX)tBi%Dc*F*83m*<6iUs&^j6!O6w{Pp|nu|5zkOs#IO)R=Wz4ybsk8#5bJzI9vFtSIYVJ6 z_BQLs6{-Wni|W_)S$VJ*G_7?{;0tPN%lc3O(L>neUrx!PAwK=v7u4yR|;T zO6mDTP?>&3YCY%pQg?y{udH!GLFbfoxvlpqhy7m{yynLVS&_6To2Z)LnwmAR)#2gs zuIzaMHto%s6C^PaiZ>Z3PekA=T0{mjGG6i$X!1#7&}pUM|0+CwAX6w?k|keGFDXT7 zdBAZU0R4>0MByPGbNvkqK^IR*;iYoDCISB&%`i;ZEs@e&P7L`TONqmtr3AQF9|bed zCeL#sOh58NTQJKNeih3^WWX9{klBs$sSHagXdq~s`N_}E$|uo}kt0F|c>be%-FLtL zWQ5>i=lXxiyEy&_@2ZHC4~2Vz7JSCvUMHqWcVdRmg>F<8ii%KSn?aA3Hz9CFo{%^j zEyX+&EJUXFN}Oytd;&mRs60@o&1lvm51x!dR|3zpJgi>R?yxR-fI@g z;UepYRfy^4jr4X`39Kqv@Fq4t@Tp>z%&V#aobN!EKc-q=S&<94NtWdJW zr?xg_>As@GO8=Bnmw`Kbt$Ii?1>G1v%*_6d;cxKKe>&-xxqR-qr8goC11fb`@l?_) z^6CqTw=BOzJw$%?T-WHghP4~T%ssz-V?B`OKR>}Q+O|G+>s2xxa zt?=P6&9X+|j<-`wRBInaAhIbJr9ffj^NUnDl;h3O^Mnet z7RU!3ZpbCdTf-+e7NOynz1Dbev@5lf9`#HiK0**U@d ze{{eq4GuD#Jb$%98YKSa1YPaEwO|Ync=Jak{{|virMWro2c|!%xIx_cM^E5$aKQSb zD=^GW0m^xw=Dup*|k7*bN;E0Rf`)0!+$AN3&bRxfAWGN{>Hf=4mWcCVFGg2t3b zVGzg@4|zVR1SGnNZIZ9{0NxRi60V2)t5%xox!MhFgR7mKsC07HH#Y;TfIO#n!W^rg zaIfi(;qFwwye3XFv9n#|>j7j53VoEpotF|jXtiflOz4lWN!`w*CAD@ZooscB-pD(Xh53%K7| za7Acd$rfarm%L$P$MMY`yxVn+UE}b37-DQ}begq`KDn6B5Wn5+e*Gku=@}`-ajV*n zi9b}EM}_u9qz%vc4_mOo%RouQJHck2De5%Avs|LKzd zHFH0>0F;xE5I1l#F{a@7)9HT?Z6LM(?`5dz{bG;p@71fMgxdc=>CeRmM*nkh_+L@_ z|4#Xj$&8PSjs0I-97kEhh~?z{C6?;2&_ehCT%C@uF~>URX{`u(yW zJbDhWv2}J-krAiRdZA4Ln*^W$F@O(H1LOuqPWJ!F)&N-EKR&19_oV~C$nQhK8P0`& zeK}MwaTmW_?hfQf|3|9-$ra1k#K{O0P!f#yFa#?H!%biq&rnT80t}A=01}$9jj=HR zAkTx(-nII(O{U`(8}H!442*p@54c0nAgbM08E2g4~8HAksk~J z0J+n>0_CJ6c-Z-Qc$hhu*(nUI4UDWPoQw>t?@Rsf{@mN@Pnpyi0DuX~Rykng;^_M4 z8T|bP0YCvT0X%>RAOolXdVm?=0C)jGKn#!qo&t)18t?*m1sDP5fDPaXxB*^(KM(?h z0ntD_kOZUypMZRz1o#S60rfyL@B`=p27xhP8kh%GfGuDjI0ddC5C{x{4#9;GLC7IA z5GDu*gbyMDk%Byjs6bvo^dV*tTZjw93lazkgTz9TAeoSSNExIC(hTW>3_&I#3y=-S zA>I2fQ~@tq1(_4ctm(ycnWxC zctLnscy)Lqcn5eN_;C0n_&oSZ_%`?v_yzcV_*(>Y1QG-$1OWs&1T6$J1UG~bgbxTg z2o(tJ2xAB<2&agMhy;jqh`flhh%XQ=5nm&QBc>vLL2N=CLR>;Tfx%!zFeaEVOc7=P zbB2Y$5@AKKM%XZH1$K^vibRgYfh3Kjjbw`yfb;>W0O>o@Fwz>*6*3kw4YB~TBC;{E z2XYkhC*)e>0pu0rD->)LIuv0PH55w}f0P825|nn78I&VbRMbbP{HV&P7N~xx3852IP^Bd*><~9~G7A=+pmI0OzRx(x%)=#VxY+P)1 zY(;Dv>~QP?>@Mte92gEQjuehDP7qEuPAkq5E)SV}zGP6hu-)RzxvGRYbE7;U6+SRDS68FzsRc!);dPMg~{ZYW9FOO!aP^kE*OsU>ewNUL-lT*u6 zdr=osPthRL@X?sle5C21Iisbc)ueqxTSdE0M@T0}=Sf#cH$#t3FG}w~pG7~)fXKkd zV8xKiFvtkU$jxZZn9Ml91jod~WWkimH1rtZG5=%R$61emGNUm+VRmIMWL{t)V0q3G zz*5Ds%Sz3v%^Jhn!FtQa&1TK^iEWx4hy5vg0DCR_AqOLe5l1q|C?`6nG^a0THRk~r z6PF2B8rK9jF1I}Q8}1hF8xU_h@|5sw@KW>Y^QQ3rCuAb@NoYyMCL^)MGZu=L>I-V#Eivq z#MYiLJh6OI^ki3@P25quLi|iZK*C$1NfIh4BN-~$FNGteE|nzpOZt(tnRKD_z6`g_ zYndil1leb@F|t49Nac*=^5yoQ@;>!`+V%|Xnd-BoXN%7npF2LUm4}mmDjz35qd=oz zt5Br~D9S0uDb6aQ}tQ4(st?sNft-shH+34HU*y7k)*|yn{ z*}2;d*)!RP*v~r%IK(^bJ3e#Fae_GMI#oO4ffG!x3%yIQ%Yv(jYqIOPn}*vrcWifC z_g)W1k9Qtxp312qF{gGht?f|i11f(t`1LL5VWz7c$r{uchN#oPXOobM9f-G&;6f@Gp$AHuG~ zjl#Pl*dr1m?jlVi`=fZG(xMTgZKKCyL}T(|v12`Bm*V8(D&JGQ4}E_euNU9-f$Ky1 zN0g5)ALkRECsZd=Cq^e;Cz&UWC5tD2Ng+vjmvWYBoI0E)mR6EZnjV&ZnPHJJktvf| znMIrRAsaE0mnx)g2{y(}6m zmMpF=VJ^x1LhvQ56ex8m-7M2D8~^(3Ys)vjZzbh4KD~R zHBW0=Y6WX6>R9S>>nZD#8}J*VzN35(`hM5w*?7`q-?ZIq*1XiB*D~Fz)jHay+}7Xz ztiAJx^pDn#CmoHQ!kzV90$nxTeBD(&JUx}Y+`Scj+%5~~$+HVG7CUh2S_QNldUs-bu zb6@6p<{K6y7kU>}7pIqumbR9imakWWR?$~KtdXzfuXC)|Z%A(pZt85VY}s#JZHMe& z@1*R~@0Rb0?e*?!?XMg-9^4&<9}ykp9&;VHoG6|AI<+~yItx7~I?ub{yXd&oyj;6- zyM|pS+%VkK-afmXxwE;u`xk7&0>ToCzj2AAiK&5$wKK&%V7Whd%EggF_4mEh+s3I00a&Sz+)p&;;=tK#C@b}0K?;O z@TU@w$wb2ER4Hp7qLwgpT-Ya|Q4KiY;*OOx3d~Y#83s#w2-X1w@#;UT0aqAcJqUI2zOAlsJ_akU@==P>t~=U)d(0GQcHuxYs6!JrErMvhewXJ0m{bP@8uDlE~c@bJz zDy0;}p6{?AKG3BQ@5d;j*w!;{8{?ybc>jKSl)UVcV~7}@YC9v4z0x4$IfzIPjb}7= z`5YJuWQEehh0wtUP=NTq@5x{BK=pSPF=WPs5}}iP`fbYSc%tfw8aES*|47Oqxf9 zVclido8?|44`V+Mt*OO;tYxa1aEPfC{397CFY`ksm5}r=h60BZ2y?|K=(#qOP(r;q z75s8S-LuIBAj*n(HA;A_0tL~zV)(MeV`_gq093LH*o^!kDIiZ!S;5aJUdMHvF~=Gj zT5*y=2!EVS&X|u?dWf$TNRr^S`8bK0Gz7v|U`5fEAZiiIZ{(nnh;o#V*Ub>hE|v)q zn|TNnmgcQ0z*41RuwKP8z`^MmaS9(hF4b|_GnS&$??!t3WW|3??dt825ta3hzqMQ$ z-w#AfS#7+CY!?;6bMX=#;0~xqi5n>&5qfTuf6ZDVRW2F9P@m|+MH0e<16vo=k&$fgc@nLG|H8y#!vl+nMrUj; zo;94z#ijF7#b3fqT07|mW>uQCR<^`S_F9GR!ZHa1+WjP{$D|1=c}mBDzdplg%Y(3|&gkv5e6V4^@(yNMuW!%oVlDE>q=Pae zS+(nsUpXR!j1=y)Rv|lW&hh=FzBdzHY~$NB=j-&9~E| zZ%cfzDlF>o9VaBC{E?}b67#Os(>HYZ7n@dEVgf6@885{!{Rvmzc0AwH3GOi2rHr4E zw8v=vn4VvR8b-Aj@{6#$vzJGCKbYvcD|hy}ufhFnsdar|TZDd?;NIdndEFxE~{oo3}q8R){Sd7?g z?d5Qfoy|w(JP+~uKeaz>eTW;hTh^Xt=G#)m zq{|~H8&9>+-<=Vu%X647YZJ?jQnNswYB1KQ5KM!gty#XkQ&tu#_}=2_5>4cC_|hGK zZ>6$*($F5x-?U%)sHpxqVanRtih@7S0OytRHq~^# zm3!+KqytFkf_7yh7j8L6Qya7racyP1Vdsl^=_Zfk6AlKAe$LK^M`jfm9f~=doaGK5 zBhL7UUH{CFlJ^EB$ze@e4GHX$%j0MvY7oIL$CPFxa(1suYHL#}FQ?66L_yRWyR7h?n~P z`~B$QQmMq7rNEgU+8s{_j<#^?7DH=K!GY|4Y`&j#;(_%{k0f1rKv^t@w-4~+FUZUC z1Ey0|=@`GnW8?;M(LCy2>!B@?=8W$35ij;{FrJobo7Ok#FPJpXdL~`DltS`B7?H_! z*jn9inRo7^cF^`Vr5Gc0e91ESLC_K397$o4^-ep^O>neDyqevG#^h&<=uSL(LV(05 z5ufOj4!%p<>$KeS@wLwsZ;V>nPVoC;Wqb%JH>Lz+9cB?;CE`<0J=UFU^O*BO8;vM> z$(Rctse_VK6-dv<3#C9=wMl(SKgc2|5PN`uj}S6RQo!a)FjI6S9ZdGTP%b?FRrMvx zrcF*!RCF%?fxd=I&PTkMgjBw4gBEFF25T1?vTfdPc0OgiZrBawn#KYQGiP4!Jy~f zO_cfL4k2s>p(EnJ4S9dT`CD$o_o{^aGfp#}8qX;l*nk)fd@UR?=8YHQOHHT@nBzr> z=t}XxDtn`ZTDkk$3q;B&Y@wqHv;;Db<9td&MZ#qf^{gwoL0pwmXGXp^RDSlp@y6wtiQ!(#dHr3zgd`nC>t(S$%57zGqlw>SYMAS{ z&4`O%X{ix{{!p2^V0zieD=jTO)iQp4$u)}gQ4V0I=!uS>nGiXqn99LGnkTC)_A6Wo z>5%Jk=s5GquOP_hz(7UBPzWT+9q*v*6Ra4CdFW{PtzanRtQduTmF|`Rs{ZmvAg&Y`{bbrbx`ZZFS(w4JAHJ)|=qQOt2Xrkvb*jFE?}r$4 zrfb)zFL=wm36|?XBHB>TBJh4kG4EJlq)tsvAZ7fc2&w5Z^u6h%BVRzC(9x?~tY~S>4r90%L4O1|2T z#F4pL6(!voyeX`(g;BY7oscyCVoExFqhLT>rM{~T)}n0(-|hg)ML#zB ztO_;){-j*uF=r(_5JnRgd@sjPqt5V`7AnYM@Ko|w79&|-n2Sd)8(wwIKr;iuGZOpd zkis9d8NBkefFuvFX238_SdjwIhNQT+!~hR48lv8*KrSM&U+Ch9hRjGF^hGX=TVan+ z@JLu*_C*VU7~I;H9}}@+RBPOVUK)^ZZX`r6Ez@1I+@FX0(2EkFpx@Go3`z_yg;6-I zXqTkp+SBu0x)j%aGec8ML%cyS;QWSNZo$){g-n46HM+4h{lT)x@#)-;Na)b&fwX)y zqDtM`&+bn-DzWkB@qX}!?M}j}VUptsa=~nJA~NyMErvo|1j9){lj@bm*yCej%O^T@ z=jz9`5y|p5P4|Br=GN#saftSzD&<>dl!j3h%%>b3=Y@&AF4vfAtsyoZtqAjLOTiHs z%Th0p_9_ct6Vfprr;mh>a8t(VY$MblK-yI9eT{ zB&lx}L)2&b*#GvC$4(`aRs*3N$3X`MFt?&{?#h2$@RhTM%YWc8oY&@4W`c7z9}={S zaqbql;&9V%9;y3G4^6t(LO;cPGPV*}M$sf)fDeGcm9q@$fXk_L_V6^;bzjEy%VnEc z5ze&4t;1qe-Oz={xu$_{(f3o5e|ncS>M^$0n%u}F-hAz7=L!!+0@4UbIeW zMeKea^rMHj7!u1M0KvXX2KxpG-*r5a^vy1mz!d?;`}_5i6f706*?NwqLTXt6WO%J- zkmkXa=%Dr29r4`(+Lahm+|;D?>({6wmLp3Ta_{7ntBCrZO-|!CsT(RR35J$UY7s1` za8fi8tqt7V0pOug-y$h6k(!7EH6Q=#-&QU+nxsSX5R7YltkIk)H`@O1#{hcv(wfFcL;K_JI{`o_K!s#~2buL`TJ6BogS5 zJNYIwxw2exQTQTx zZt(+j_|ym9#-*j77k=2BdCj7g`gIy5U{)Q6Cw!$!1bc0OJDrH;5P2@u;04uJGa*X5 zOv4P+72A}n*%bIS9)~_PHs)dC*XEMr_?3-WFR4V|Jk6bFshi^77KL|MZXG0WK!T~{ zlr*E9yg+AAQ;6o@MI4@bfX{UdG4noO|nJ-n>Uc1!Nt<@vm$IY(iuxGmxI zpIipmW5;1V*z~=o=1*Z{Aq|w%==5{1P0LHoA*xQqmuM*@&KoJd+OwihPlvb$jCk2L z39@vO6SG6w%+O-jgnTJ7*4A|0zwwQ#9D}SU;Y$ov3yU!gtO9vXTxGgz3D9_!@}}J5 zOqC=y-hvRPXLvMtOO}@Gip0vHSa?wa{HhrYS>ZNPkcj&|i8Y1jHHF`M2^pa0b`%3; z>UL}3R)mLgI0}Q0Goq`%{#05qLNv8o&~l_Zl=iF3&10=uE{7lDW>DIX#HLXE*_Ec>D|NQnqXgUAb8|ht2-PJLA>;5!1pVsJ)4V zl1&6%BzHiBEst>Jkg1wlz0wlN0E^ew1A>V6BLd=rTrY*F18S(zgXJd)7M?@W1%}I+ zEyvHY(F zu<(uID8AihV)-TIYEY(JImTpyX1=(D;+dMfipkhh9`!EFUY}qhrq^R|6Q4hYHQta^ zn*I4Vn7o>n0~zGEpYMtt7y`W94 zz*j_6qVHN{L%3pVE6?P;XdpnbIEbF(j8r_i&7ZhnbNSE zn8`X%_p*f@6!(=5#bPoSe2(QuD1OiB6LY%3=!Y{U7otNV5j4LPlczWGVM^{Mb^XjC ze|M)szeH^LAuUu?S*PuENNT6>d7UWn#%`#)N6Hec$Fk>!@=B;7^Hgd|o>?{2-KODk z`uc#3bsnjhlF{OQiY?B&qYaB;;$4A}FG>f0wyH9~Z5$P$bttz2|46R*XTA*83=}9q z@Yd6$6Flgj4XrIP?iGb-!mQ5#@yI7cM20~GXiNtB#;6h&jjRbD#WK0}rYHAMeN9z$ z-22Kxs>@h5U*W9}OSH9b^s`^sP#ASR9`t!^MRH436|_;V|AL`%r)?i$zpEM=O}^(j zV|3@xmK$t&7gq=KQ2c}%%z z&XrfEJn?fVtM^+n14r*Chuq>#rs@2|-oCAZ z=O~ZqZ0~G>PeH#fd_7p9S(6UYgFo7Mx%0`HUN7Xv#i<#aIv|&df7vSDb#qN4_WbHo zb$G1YD{nT@2xr462V}G$GSX&lVwc>y~|5^(}n)+=!(kY^A!-{SJ8c(3ot=NVRz&E^7)SPh55=BBBQwI zEYZz1Pr3ulxZjlv^K82YN*EeNPOV3ta&7WmV5hw}EQz0NGY%27b4_(v&{}SuKknRk z<@I@7&C`ywWy|;`B9`hMvY837@wU*GFkW#DnVDss9k%S4mXXZ{u73arj8l3iv9(ox zjB5TgFjGN2l*>uFFV&woeEh)I27l-M+a``K;+EUY(Wo`;v~RXYTLMl$W**bHz(}9s zUQ1c0CZ}2Kr13k%REbil68Wh0(V&J|&0i$vPZJBP?DmDA*B?sCd_={*E@+z2Xx`zV zgq8aYOCrK;RuK~30lT=`H=g?kWQbBKCc^Ug8VsgIO6(Pk9^49U8KgkqGdjFHD9LGV zD3B{gi1(&Dl@ZHOf3Vzmu)$nxJ;MuX=C5r0x)wkFn(T7eC_kv4#id1dR5-XvT zbf%#7pm=uXOkz}%d%K&t{iLOuCYIIGXKhnI9$cI|n zF+OdQwq=(Y->1{B5kB=zj>nfzyc(Q=8}5DcZURHB&hEH)sqy>q|IBatD*Usp7+$BQpfrDB93FAH0tbv@L#O-;R>nnW*M z=}F_|#-AdlsVR@ej}kR??dNc)I?R{ndEVNZCXrBJrkrMcJXfqfbr5^>GB3`O!;11vYAtg%F>1Xo6$1tlyZ=$Y)mPUwnGd@dr?dFyGAy~n z<@B$G4CBITB}Pcza;Ff739}6Lpu}?32qGn=E_Tzt37}IUY$@jL(uui9E&S%HBUL@Z z#pi58lu9u7BCf8t z%fDRrUe$Iz(v@EDr^|I8Lt)JSY!&v-%r{h%#m6}AdNb+tQ9ijKucLw5Ne&`?yPUF- zwMx4>_{!z6jUqWCn?dlI z_U7Z7T4xDuHQl(YwdSt#jd>>}cKf4p8~^Y^G}0~mufKkvq2}VEZq1iV1aJP9zcx4qDFM6SW8?Gdl73{1QyXGIIehQxvI^mqdIJDHJwWrnh z&`65iLZY5=iSd`jLcX`Cm;&2IOK~NJgQ|c_Ij3~@ke}P)h1uulS{4SzFcRv$bC)8) zZ<$6MH8On@T8<{`-2=MEza) zggd~asEWQRiZN(#l_ha;ZGZ|;OOgxFik21X&@ONd?M4@5d5hmlPwX)&zZyZ@h$SX0 z)~+zk#*n6ST##!_0q1doxB2!e^6_|f>6vc5m`#IOQ!@$Kqgf1owV)UV6}SM!R~4Z) zezxo}$9Yq%4~RTXnifJ3eY6U5gwS@KwlsF$e`({G`|(u?EoIH+3Y{EG@r0jLbpZeoozGM@KqcWDvSTVW-*ac$- zQGVil6MCPuJh@`e-fNgjm>utF_7+dM_x_!<7`TB-h35=@Z;26`-Y@^KO$ora(&BKT zFdqCj20i*h)z_KBU*y4GHhS!b3PLWRJPl6TK93m}@Ey#?baPAIwu36)2X!K#pjHA{1ZtEE2MN8=p z1gL?C83P%pu%U-|Ih=B=tv!NF4sc1x^sZ?muN$L$x0PAf8(?f!wo570E?J4_4QSeJ z!A2t|IW@9a+y@G-agmdc_x|%-(^PiBsy0C)vV|v~rslBjxKSEH31gF=Oi>j44!QAX z4W3nxsoVlMNdyi502;{AM$LC!yx_Kx!O0+Exqh#3W|@FscuwT(MQz=$yJd<)#<&9< ztC?TlGZrd5MDnhjQ8CQuleLLV=*Pq}U8mXX3b4TOfChX=sQOn8(p}2K$GPIocF$)1 z^(06m3_&~kRORrVH>~Q~UH5kwg_k7q^XF3b_YB+jV+U&1G;14|zGR#gBmskru)^b$EEDgBP5P> zR6ujj^{Ws{9Y->H)#YV8w>hFH(?#VQ`O|U$Bn|VotpTkV5Z*1Z%C3qrOh(|G zV|tI&aIiV^+}3w6RQc^u+K-7slg!|X6i$yNew1Ce?IxM+3G_`LThuh$RI`h|j^0v% z*yQnTzb&hRJG_q1BQvucmSRaK%$~K-zevmPefGhvjOX3iE&l-cj$fT~+*hH3DM21y zc{etnf*WR-+)ya3j&WxjQwKEZb)g}SbOD1w?jK*^zb zRYPpmKps@rtuB3N27s$ORHtNa1-EEzByG{3frpqoR9!foqL4_u)P^51P}QPh>7C9N zD#kY9Tm!Q8^Q?%rx#P(IZRt^(Wy0J+1=h@DRcz;$NA;;S&Pnyg)x{)w*xreo8G|+f z8P4^xX|guzbCH3+TGXtM2_?=lIr`ScWZZe;CxoW>=tW^Pc4KD21;Y>t7{KZLDvd;O z!WbW(^+l4NF`Sja-y3GK?qd%L002iJovWRrt}NtzzL=sq@SI|_y%H05c_N>OHX17U^UK2;a)IG}A7$%fWF1@ndFEHX!=fMky*V%Nt~sww}mA5tG6OHm;rQgH|c1 zwX1*+4%rpRwb|QMia2exDePSc@CPV=E_Jp0I*(VkxQMKeddhHJw{!LD^{dG#B9MJg zOj=HcVA~D(=CXBtZqm*nHT~=s@$%x9MM073O=xy{jl^azevn%S*;I|&{o?XmCoGjQS1+5 zV$iHJ<}y5rPhS)tMt4TYwKP zTN&a4A!XItNol17W_@2T=BLbSCWb#8@U8-BKvzW@b23vGXJOR<)|x!c?fi=Z{}Hmbtu^c%%VX zw+StQ@e{T^Dk}6#C9^{d7|u3f=ZqSdM2TcM_h@Y6TZ5gjM-B)3$*za&g&az;PH-Cz z3$`{Kxo`BSD~$?!hx>KoA@IB>JR@zh>Cfw3582L*AS&gGFM&SSf z>HU3bLOa;mNLSx;oF0`9wyN@R!MJbQ+!0!}uB2LAT=1dd^XvQ7F{Zdz;8rC#h8X6e(<`!RSP{NQ zUFo}LeYV_fR(Qu41a0U#RZb2-T$~-M@iCY39ZeXbiUHL-Z&gu1EbTx!qMZP`(Y+Mt zK&Uv)I#dP#=T3?!Ku`q~P!&+UXrXx;kUA&_G*p19s+wav&;g-((i@s%tpL}Ns({5( zzExdA0Z$^836gLIPHF*m(&AfNnC@Y286#lIeMNSS15}Ro#w+w8#KA$qBUxY6nbAUZ-m8~9(WNZ(1WE=`k27e? zZx#;u{{Y2rx)p*)ZnMk6RmM(oIeFJK^mRsBEZkT{rs?xtG+ptHFmN(iyuCKATdwx6 zS+<^eVC?)(q?HH0ISbQZE3j+R@mdRZAejL;9$z}=w-&fA(kLK!K?9i0R}}Y5mk*X| zI)7^WLwO@Z2AOLcKZLB4Hc9z`TPBxx+dFtyyV8pnI|wBY{BUZxH0WiKWJOqH3>-49 z{{UaYx314RTg4kmD!iE_VYz0tn@4XJFrphq?SE-|lWliza};2xS9^9LiO$2Rsm)r zZ-b|q#ZTFu?Qo-Gy;UT@;>ag6l`Rxr#jR0g$qv#-?$^A{oovh;JUl3J-e#!>1zDRMAa%y|Z;UF84gT@P zW8B>Ylw=2T*vaLOAzH;8^JH&r`%Pil&d%Rz+J(v_HnI1TFBa#R0DR8hTKV_dJzno# z*RQpk=Ph%2GfMmC89ONS0|0so^atsMtloa9(e&74QK#KpNhaGDG3~#Y$^5fkZyVQl z9yF}rol_IZ(J)~14y2RA`TWZ$&v&aY8 zN~e(gPs7dD;fA7u#)G5-MZ<=h|pTWaUGmhxI%Nd$uo zhac-xmK|8dJ4biYZ)Uc(FwA)I;f&{>kSETjRk4X&V2zFlJvnBzEgErkYi~Jb;b>DJ zor%EfQ;|=ID^1;6QNM-#N$OwO_TpaO|u!1g`=Y$Lus3E6TT9opx;w@~Ac za7W($nW@`-HcMz7%Boc!-%8QZc?iI=c<~+{M5@XT^h`F11eWn#L)b z)zz)##p|uTvF>}o#Hh(5=ls8oY?=;>e3yOcR~#S)@O)mQ&bBQw%@oE&Tt%=+Y`yi)sXleIQG}W2@6y|{SK8H% zm3O0v=95admF2Ql`%?=LIMIIaTy6&VuPZLXy}j*2RJXM4#ez*6w{>gAvPY2WIFArh z^6A$Y>s(LU&$7k0w*LT)`z*2CX_qJ_xsC7WQXe{XS|JMzj#qKbK?0LJv_qND=yr%8EJsR2z*Dr?q&W1UnvRW(rbr~{&kC<^VNY3^fzJ}DR| z`kLw1@ffY+wzk5ufRTDQ0!aS=60SbArS>k+&!|1g8(XO>w>H7Y@U7L8jf`tYRoBLjtmVxu(L=liJHUmlmNOw=J4sF*esR7}rD|QO(Vb&{A`I4yB9XxO zknbFyA}el=UB$#PWMS^%h>mJ}HxOf~2XHEhqKRWa-@|VX3I71EV&`VhoM)N(R(9!!OM9TvvdBhpux>;iXZN~|~;(U|g@Q|eXdhbRW*F2&!z6){4hZX7 z`s;!iTnuB^#YKGWJBHMx8OK?*WhikdR+ZMwbuR#p;w!vc#QN%Q(vn_w?H zNvY13Gkd+9ZX%vyGs4P2@cFj0z6`+DEbc!hU3ZwG%`P8WX%v^&@(_qsq)(b^gpo=TOyOWc-Cz&Lil4?PZ3|u5B zkmHw^^`{Ig96U@HCy@TWv?`-N8BPs+o|jF z`Be8|Z+n@pw0U@1+E|Uu)UuEe>MC!s5X-CSb~?SAm^E!Y3)?9`@XCyMU08DABmhUKIOkr+22_=ve=a?fqmcfP zUd-FE+QHTIq~p-?Q=*EJL`Tk$^N`#J;6i}&yMHF?Q53K{9^iT$B zP#zDRF-0J8QVM|E6i_Ij5Zj+xsd<_}XEjh8&;aLEFEdCAVBtM*pyb$JcC zbCJM5DzZS``z3DHS~PO1W>?JP)UF#JRSi;RBq!a(oH3Fugqg<(C%m_lK0`b?s_6B$nZa32Rv{ZZ_weO+`9?`3FuzHDrh^8%22G7D#9AV>8$(+|O>` zw72EFi}_$w4ew_IN#1E}4|yMbW`6C&W8#lJWKLUit-97TaAFYu0A)8bpLQcZ*zecl zgE{zQ>V0b_J7u~^yO7pvcW_0yQU3s-)K@u$ciK1e{R_} zT8=AgcXFx+gyU@PKh~^jIwj?Uw32};r^4I>ZC5P&)?tF!2O}F}%pCNqsTsJL(`%ZX zoC^}9aR)3FVr-H@@a?uYrKcxouFLOmUnj*Jd$9wU^YX<=>2D%2MdD%rZZ0fw51_5{ zv)2$9(kVidp9u^3eCiyl;Es&d^p41Oiu!d+xn;GDnRtYfgW){z7hrmNS5EBTWHenS z-5a|%Gb(}J%7Br9jfWvw+H#eMv&IKi;>BmT5QqnJzwWQ|s+DCSL3U{K%XY^q%d}G* zYqm!qr(yG~NMa2cQ0y^)qd6Z+kc1tS0C;(v@)ZVzqXx#p2^ZH#^J~#`-`EH08+jZJhPrvse69*a-F;E;;op5 z9bVD@0JFS|FgL@-#Aj{!`EZ)d({3(p`${5$KX|&bx8k+H$keO|%O?ETE(l}g>s#b9 z#XYi!XA{8DE5k1lVDO!h^NeLl;BQPC^_(eFJeNJ%JQv!}X5F{!v16?EdiFR*{rpMZ z#z&tL^7_`ME9rfm+;47d?$ubT@c5S_8SC=pT5oH;jr%?AO!A#av(Q`JF(<#XV+@(c zJ+?nu;GY?M9dXXt;2JsCr8{%_E8oH1Ty{fSTcyv2+Vyx}=;LGc6~p^q*iP4WN>)vO zLcFs;ao&{TjQp5wSW6Us#?(--QpG*7M&4BbSlCfd85KyV zDqzt?6aX<*4XT=Bl~@N#U}v2a`kDZzid9trxl~*{)h?*Av^d$W=%ao5;aIK0`dsNcK3X*89Lv zED*GtE^-Dlx%AC+F5JOmrD;-W_AR9%q+u7`Z5~%Y{#MxTHzKtT%xTS~>Z)&)ag-)_ z&%}|o#2;J|a5@d^zxrRc(m7+FyjwP&2^F|w$9}ED5zi^%$xoxkaZWFG5wwjNYbA`c zFYj5*d_!;gZ~ZFbTilSbh6dyINZxlg{wT>mCX}1@PHw#v(Rv?rx*> z<;4F0(xo)}4&hKnhfo%_z66ga^`4mLbWOR(zE3^9YE3Mf6i)2^vuG_(yA>z?Z>FD$ z1l!|}&z|13ym5Zao=PE_%ztWKRa5{{&sh)Xs32CmZ z96mJu=I#u17#vJJe5y*)IU?>o&o}P{u{K3X{{Wh4$K$kJzBv5(?doeUPl8ozVWzmd zmfqQ)Npg0*u|Ku2+;1vpZ12m~v`|RTyCcoNa@Vh_DqJ2b%_RL2dDVHvjh0p(iOr`gD&o#(MYtj7jEKpwlEM!Ix% zfE3^ZBX5TreJY#XIGA!_3|E$Z@UJ0g^={5g_A`ukvB;94%CArKsVzQRsBTrtWd`{N zne(mc+fIa`j#x+xJVCL`p!2Ko_I||Vp=Aed5;Im8Mg0>|@1asyFAv=UrqG!HJ%2M; zT6UFhZ@QD7qzq=JtwJCmDL%ZYQS7D|a6@p8dzRj>MIuk$MwxCF!yIjzxfsXZzu7X8z!?1tM?ZQ$#JZ$T!db z02h9gf@bkU4cTJZ_(W@kZ=-OU?&9J^KKUG6Q$h}-6j;w1{1=ep{{Y(^Ihx>pz%9nB z?LS)7rEe}77 zouZg+b82z0$jJlD8q~Cy;*KfpVYoatct|A&;<35jCfnlf(J%{98P%o|Cdh1d+>zl~))pq;Vk`9P`b0`GZ+L_i^t~ zBFGsK;4#OD5#T5IeCpIsZuY`xL5>y;Bx=x=;2d5gJLkaUgP*$9VcBi&qK;Pn&nYms zi{K>eNh3Qj{xu0$PKhg>LCh&7yhKP!oHKwi%lPe9CB4(N4K0P}ggbqlkW7H7Z{5k* z)+|Mlq)7;6XFMP`!zkI)IOM}|SohxR#?32cITUw{22MWgoB17$6c>fNKTdtxpJHCk zduIgG!D`)`)iQF{#3ue_J`xRZF4%sLy|vOB;(ZMw?G>CYhHF9utMiQS_!C~JyH#nO z1~Rx;B;*2lWd7@PJu2nBrOYlaZKai2ah#K!bqD2DmmU)ILo}n|^Xlf_;?j4wx`Ie1 zLPJL)m1RCe9qQI=-F>6%$7i+cd&_NmK)1hJhRJ7M36;FoLAYV%*0^VCKSwQ9V7k2Q z*0FDRv9T#@a(lTMJsXidFl(154pH28bYtYFsT>@6Rah03t7%%6lX76xtZpqN1dK}= zT#@8?AEjagk&5G#TwODzG}WN~HBVDj9mOuSQb_#MqKxl~0HAZCn)RtbH>$eQ0|uQ) z0m`bXaA}X8Y5=*_N(ndve@d?28E2JZg&Id=g;g0O`c}nfrKOqRXIHuy5;!2NS^J~> zUVc@iAmmn4Q7v{?v)5X_vu&qBtkcgRPy+FA=dL=RPsY7Z*sjW3>ADm;Wxb@@jj|pY z;ev4;sBW!uKEg)M{0oo(#`Vj6k62hitUR+@TwJ74E6WTYv@x@VcPE%p&9S)|9c$2S zXF0fAYx`)Y5zN+45rc-@viRX;j5ZZsGmK-HuV0CYL0RQ;vN<|9_qEL`?^Tl4NG>M3 zXy(L|#G)${;K@D0ftCS&_brcF<@(&qZ>ZYcG;1BWB3O7Eh)HhV838Bnb0@A%b^h30 zYMRcsZ((h7-aoo6#k^S9NedqK(L#aY$KA)w*F5&0X=`O2t-X{?){>Kdr8}MA_Uc^yvZTmxRj7M>Ef!yj# z`>1>*^?dYimL80meqLq_%i&8-3m{E_-^^jiSp0!Ie&}ac5>*g~2CW z(i`tL_@n4Q{{U1%$!lIL>Jw`y*A62~PSQmX@m|5oE9d~^6b;DoJycfDWG)g$itvlQ zOGt?f?QTF9mOtHHt9|KX-y^Sxa$!)K1XA0}XZpI}-`qiLXVETBbF1m+9p#?=P#v@6 zr_QD9;w7}`^eGcDhq~#i zT`Kj5Xp$@QYjtUL1WtxX+GxTIDa49*ICMV}^&TOb@VPt(Hsz1g-s1g5D5&ISbhg-b zBn)))ssivg2+8u=rXDnS_?3ezZW&HN9%It6%przB3_1~BLrrO()MlEp)G6nlTh?4r zk+1}hGAfizYz<^Why5xFwpSOWUq#>7%QT}vGlDkhS6cydin2vpG43296VkYU=_jp= zPRLy(WQUY+YnAZN_#_mVM0{BdW(Ojz<>JBvt1;yf97m^7~_bLX_-NrEg05zU7pG~~$6R|oG z(zG2PONBesPUDAf1Bq4EWj=WWiwDRWm+aNe!&%!w9%PMRh{=`lu@by_W7oi=@ULPC z!WuluH7N&WZ2j=TY>oYsGwAZk&+H~n_Sw(KkO4m-QGL7ikJ*mK*vBRPrlWg%ty?U& zHqel%4b%F)LX2a5v0O{^ zmA%t1eWT9~k8|%<*0FI+;Ncoc4rNsH3UT$#dU#{mQ#{PS%<3J9_WYXnY0jH<*_%x~ zT+Ym_WDGmThlGQWHhzCVE30Z+#-9j=8~D~Zu9SB(r-gICxCfZxI4#pWhV|hKZuZ`2 zveX7-RWZt-E>!g+9!EI&iq+wY*+$=p>eG=o z4-C9w?l94@WBX{v*aMb8{Hi?0l1zZ*Qgsr+BMb#&u?Ia4;EIaSroOQ+qTWtqxrB)= zdPs1F=4Vqb!cPG&D|+H z!1&;1K3v61*@(nw++E~lLn$oYCFS_zWAdofe(qL+>RdB2nCIu>8>EAv$k^6$%1WU{ zDp}Z+3|OR}eRkLb%vEJ&sKsHX z+eveCGjO6H$u%X|{>f^+qtzhO>}{RpnD|$g-B_MVqp3C6Z8W0v(k6Ba;7h} zFfh(DxT*B>%;R&CG@jV$ zmsWS;)#D2*WI~4-W*-uRj20bnu;eqjuGv9GIymDuC$p)3j&_!kYm;8cyf-%RhINoP z1;#DkVlM3)iU!LbvF-G(cltC!BG59^8SG}5 zy_}CX43SC(CV{r!i3uY+Wk{}*+SHw_<{``6!xUPruX#5RGg`NIGJrQEpa=fy=*Ox# z^7`4Q>N*fQjJGx&;JDPCwQViWgSx#znXTE0&KPfj=6tJ?`(ut4v5xyokA~WJ{bOPx zLOZ5ATtHa)9r5aGzUuaI%^kt83XxAFT9%t|ZLqOO!-_ID#tU&HdNp#dYqlwUqg|{q zG*RB6)wJcA_`ry>~p>lq<0G%8Lcv~Sv> zJxUxlJq>n?TR+vsnplpgEv*$U(|`HKl-~rqaxo9C-nHkh&tFTXUfbVV0PSfYytY>u zS58t!7p`|0uSfPgCEc~8T11hxyQ5!ra#@&gkVa;*nZBDZLH=6L1hi|OF6|kyiJ*~M zDGsM`XJ&he2LAxAw1(KkgRGH*&-&H14{mK!On9#)v9>oFJdQz2-8r|C(aHGcKz90i z)$KYgy__0MuWj!V$#vQJSYhq%mp%Q14EQ4_iv!C(LaeJL+S`pfMbqHCxoeFn$T-q< zRL^;9>&A2Gx$_meIe*b=#vbb8!8BJ{+8Cbqv#mK8xVAsGvz(v2G2v6o1IX2vjan-& z)W_`QFL~MKxBwF4{{T^AK7JJEg+5-DoeXf@L}UK|+hEi$c*47X?7F%g%!l`6BbOte z@m4OU!Fdec_nRctu9huAJb>DMs-LsC<=}<(`R(RvLL#illiVZGln(LaywE%F7lvj3 z0MuB`leBvt75q6=o`Mo&u#ZP>?I)G)`#$qv7_OK0_A`F$XT^Yee1%5cmAZR@e~UkT zyAW!81Oa8Kr|hnm_h5ex{c=3bNZH8=j`DqTHn#WEtQyR5FjuzJ5P=o!XC4?^Ds#&i z=eIEdMcYlziWF{rFL%G^y>1V z)h}avZBpF<3U1=Zb#og4M0wcxkOstx)NDPjYr2-I!rt4nmov?FoGToi>oclw@v^oK z;9#=;6|Z~!%Ztm&?q+7Swpp%>cSTv`j!qdc7;k`8fH}w_u&%WCYm+P&_g518!@N<< ziQR`#9b^onE0x?6TK$Nny|ARw=swAIz}#PH`gQa%+f6(|GM(puI_Cd!GDKGs(aZj!qbC4sdc0TH3vpcHN}ClR(#88`*BkS;|;_ zv_UhIo}-6j$nkTp6PdvKiOMTz_IRA%w$vu{&Xs_<8}GecjgB|PCgCU^J=B0h4z-G9 z3JC;{JlBHNX!g@m+B2h(P-i*wsxB{8V=cvuR5jK3P9-OVeCt{5Cut+MwsIu#0BDPK zvmdveri#&KV&f{iZ`QcaW|r$;?YO-bQ(iPdnN~iGK?+Zp%`VbvmwMK!V2C`=BVkb# zmTyG^ner9deUWx4^i4P3bvt;H;y`f|uZ}bTk{FGNJkB=c25@ue@o-<{&Q4Bcjy+eT zHkoOv!3TG8QaigFbeu6@RUOHTs=npURV{wEv}~=OB%m}yYA0*8yjZvg>`D$05E+;bjcvk@YR*M)<{5%+gw1c&WA_lSPU z!8~YiFze56&*W*^u$y3`jASbOSo2RT9%7|5wu-g;K5AoXVvXpp2=#)PJ5n6^)?S&X z&wDol4iz60o=g2|(M{>pGfSTSAju4-*$5VueRG zW;k>E-aMgrW06Q} zk~b304=Beqi<@(5^e}NRayWDHt5G2hjgMn{KAKjXrsDTfQN*Q4miT99am_8k_*7uO zU8??%piXCvXP!1Jc%^LROM}8$h(8MFgaNTW73ymrM;3Z^vHIt<_tHGK6XNDqLfkn# zIKVq7CwyQHlw)!xyH|T{Hk$F@So^(B<8s1Yhj(Wcp#9=Z!EHu zc;qCTd!*YLJC$r_px(OniKj_;k0!9BNf}KuTTrC&aSU7D41ET2KPu(Dut$@&(?_VO zNrQW};Z)%wc)l4qlj2YgeQKGb_?qBpNuBTXcZrimxtSt+XO?t}Qndv@j&L&!>z-kk zC~>yqsIHZ)7PDCO4i`VGZezH7Km#-q{fy&0xrJj|XR(WEE%bO+a31R2Rw*V}`_Fo^ zl;#Nwas?a!K;@I?T?bRPvzAC8xLAGO;Jt+5q-6moTq(z+p!{kZrctZ5YMN!d7M86}l54o^?e1C8wObjqYqlR`i+gNIjkC`r1Nl{2qerc1i+bfEYs*1(Awccj+(blk z^8{oNkN*H^t?rqE@bR_KTRl>7ZIj(Uy<32IoW$Q6c?@q|Q`lyxj`tmny}cIp6V8{K zP2U$8u)1TI*+A#SM-P^E>sqI^oh9_H&^^}zFWNl4*mb}>Tr(g8rx%ESg@s{uGXCF6 z)T4X8@$~qQcW_e*O`ON#Qg`B3!voWXsUN~yI@|l0^m-Rtm%cX!@P4k3Q@C4gRTZ$> zZmO8>?n`~te-AEud77{|CywUpS68==`em`#mL&?-cZ-hZ?iKs0*i65uJq>4fV(Uh_ z{cf?{O=%L^YoQ0(-C8g`#p?BUT;!3M==wbzy2C)nng}SJIz67aoNN zFgMwUQC%1CaQKIE6(ZCm*CLE}d=@>Xg)$>i{l=h}J|^UHKmN6YtH|*+`|B~a+uK04 zdi;BXePrLUzc}PqnFD=~kf{rqWz(jOBPpp}=~lRasNzjqNpp?_AAUs7Gv%MXQ8Mvc z%LF=0uAx1pyUnGu;g_&@|I-iynzePdKO5+nIyM2GHQ$Z&PXjgolZ3*oli{u z>g<8byYd^H8rifBE_HadZF)qWIAf09S!9Wt9dAvMu^Az96vv&qdF*Q5g{A5GJXV^G z#Ijt&V)5STrCChzT1@;hM|O>ZQBO{vF}~|>Wp2^Urrj;Nt*ygpw`*%}vA3HoZ!pHo z!dn|{&!uN3mdhqUYC>D3he*_rL17${=rsk!jo`V$XE<4EQbhuTGR0$N~b;0w(&c2}e z)vtSglBKO0G#Z2|w)dq`(o2tdosfks1Fv=%uP?J~D}m*nwMC_v)E45#<{N0586rsx z3K}$-$sAZC5rRO+2>^y3Rkdq+9nJQ+Yi|Zc_>shx&nia?PE#^Q2>X-A;vG1L&b2#@ z2T{^4gjQ>DHLNM$Acada*gIjAvEPmd$IBa5kZ7dQ*u9o^!LMy1(={8mxtV}4%={p- zd@2Y8@b0BR^9MDvYPSY8ZZ4bWmMeh4cXtUETC`BK={wk5NX`LwY)K56UP}8Mj!(G8 zO>P>0Y~N9^ir-PV;C7E|xkv2SHvviUQdR?MDR)mKyE~IAo3ve zBDIde*|%xCZ>DLERHenrh6gwx9Fe!myc{@NpH`2f$&xXLWb}F`*hgU&(@q_t)nZe5 zax)BbM~>|}VD!&g>Qc&WfL2#nm7~ruaID1%-=`|R1Uhb?-J)>C1Xv0;Tqyji9`$0l zGFmB%5*aNC3eS!(B#FGa*S8h$ygqXz+iky1Z&q0~1MX6>5?n_vn!#oMb{7Z&6x&eU!c#mjlS}Qg=wrZwztn;doG$U=ni0T=$FnL>O=WONRPY$X-R*96FFxWqu%hJjcyXp%rl&;P8U7 z_pGH4flzzICvJbdwP=(Q2_t3@$hjC{@SdA>>GKsf*hv>(xojk*dyWnU4=#SfL$<^B zA8M{8xMtu5)>#K~?1~Tzh_^<`-^8?pyd)VLiEzQxNTVbB!OP1IKC~hkIG2hxnSfCK zCni|;iTu1vR3xlP6pP2ip%{0-cZ|d<97wx<>u*+(Ojiara-i*z)A9Nmx+E%EU?lE= z7igr2)W-f9S00CYS1^K{9pbabcsPTzX9FsJtNbXLB~uVS(ZFDY$Wh;7hr=r1dhb}t z7XTLXvEV{%rDNbyjl56haj>krd2)raPXXc}6&YM%ho0kqrDNQ}ra=jH`$hLgarTX$ ziYM|ORVapEweKVWxLC?YTY@|e_C1?(`^!|`>5;U6so-GT3dQ%q97u7Gn5)`sjVBE9 zpb|&~tR!raDtKIAY%({j`;{UY7CtT^5i7!-V{DDjp{hAF%Oz;}TT7nQeQRLs_h;q1 zZu;d)!Z!=mztX&@LCMlR8A(N3Fm!z_?;E|7i694{-Mt6(uAA)t0J0KmcRkt!wXnDG zPdgkeW9RpY<$<~6H|2Y=y_T0-yI9ps7LlAYpvl1dsydv1vAM3br>>t3mBp>K#5#VH zqg(sb!ap3c;NY@=M|mbQmKX{)2XarV#^a^7k28_TZPGKesV!i%8eWBL-OaejUL3Qs zoCkH>WFLio6+gV&R19|!_ItIr535<+UEaqMO?McVg{@$A!%9vGqmg-LMU2-sy7k_ns>L15T2dQZyI7+NlWC5}hC~BwrgQl3y-sUzixDba z=JGu%B(>BC-`{k(e`PVo#K)b^dK$~qwD>d^c8M0|Jqg69+Yxo7+;bUij|ZSX4M|IA zmRD+L{?P`2!ro$cTa6~?;B28)cPs)|Z>%a%G^c6uC^nv0pmq75eYV66T1 zjN>-bkUS)TpPg`>9z9F`EV{W=GHOm|Xt^}7B?2(iT z_>>OzA_@Nh5-|GIPiE{bY&$bFdTXm$Lj;!^agH3~2@z*h1nziQ8x=9G$g$hWdk~1U zQTx;hE|#zyZdGC=DN4H?G=*9+-@g?g`EP8vw^tv zHJ2US5L{|fWVNg_!>!wiCMX)#;dm!d7of`=dWw3Z#i!gf@bH*4jZjJi5#Tk2=-(`Q z25kK*GeAYtZ)~itTf?Vb&7j@z4kl}Bj}#2de2GzA30zKPrfELe`!(-2b4HFNxq+Dw ziODZ4E0r6s_qODG%2x){E#rxlz8*VP?xZ10mbRCX-){-py>qMDUR>#m0g=-G0JwW~ zGF>i3?U5}R!2S6052bMZd$YDM_KoI7glU(3+Yo1F3vG4|IS;ugHFz%S&0{{A_%@GY z+U?xdvFVc`m$ZGFM~c}cA&#M8w-vZvMZ%ClJ#p(>JP07ZjvXo0-UT=Po|aREytI=& z^_0!#xL_Baz~f_F-$T;%3roE!_SREtsYNqstvFuoQt}*_vU%{zxmNUHjvV6&Q{+d=un%Jess|OJ+^mARZB@AH_Ut71@BP(Zzhz>(;e>%#yFv9X*X^|^M9|pB#mho{GhF=ZTJWaPe zoK`ZQ!DPNjPSRKej%%6S@8HvBD>Jb?6KR)!c(L9180SCXtiH`o^2cp!sLLeWJYApE z-Cw(m{p)G7&pfby#ZygVX&lDF?8NraJ8ANnrQg>MYe^UqQb%o@L8s9b6mk?MBKbn;$XrlS%nh}CYb&kWJ;zFBkl zRp}bm)?+DKVQpu0Ck9tC7P7k-ZM=gY%DKBV=-DLIk$0Lr5BCW-n~LX6)NZtU&fwfk<`DBrTnpQAlx%EO5yr2q2Mdv%t#SP?MkBekjkQ3dVv))Rt-EvXJUlEcfu)$UC*pcrPu8 z>-*UM01!1brrxv=-N!6*HMaulmf_?H{hnQ?O}}xne+s9x_D088U3X7QX1oMk1CqvB zV_zEJbe0|dYgJQe^?&$Vs&TYLU3M_8vY7?7-MTfq+eR_mlf?^hbumAOKf1%p zv`*Y;FQ?0>-S;IppiNmLn&Wau*Y5!W++qE?h{eW6Q!(YmFTvoUTAfW+em$k#L0H7kR9 zmTx7)GD9|)?9LEoCM^;A3?1vz{{W(Hjv?$Ey`z#cw>re!MT7Ak71-zM4Q0#24&QMj zvyGl`#_>1l)-L7(L~P0jdm1=J%9L_fJJbdFxc3)Kzr4w4L}E#?n~P>7Y`sdd}-yps5@aFA@5aSmQ-9GapPMJBz#c zl&lRjI=#3oB2bbJ375?8l74k5YXnftwrSn)#XR;uXAxo}ly{MCeQJvfSS{riOWl~_ zx{}i>hDPpg6uNGD2B*hx*4^s~nprH8T)cuY-&;N#VbqGWM0GhC+ ziKH)V%`(R2t;00xxJd_j6MY+M%`;Y=79tazVHniCRahNS(=Ld+26uPgxLeTRnjpc0 zySqyW?(QB4ZowhAYtZ2C5FGZN&i~DSX68BPV$S8c0-n9;UR|r?t+%RIP10JB;BR4i zwTkt0ru`f3(R;>L=>$+guV!*r=69Pp!aQZRr7{;l@f72B=2R4Lyc;j%x zQ~W1zn0LBqWjbz8e{Js*TF__==YCFnhFF+3mcp-a4UKvs#IJ43S5O|KuowK1dp3Jt zY5kN=#s;W*;r%4GJBNXzDXQoKkdaww$(d%AN+N(4p`gg*qI?!=lK$$DX-4e+GF!M|b^x%{#WL-$`yT`OgsNRsxuZCJ_ALspfNQ z?4obQsHOS_!biaduN^@#+h*+~efF*!rB2o#g+Z(&M8`d8J5}vbqlnJG#%Mq9adS$L zdKKCC0LL)=L74Wc{MEofQqiw)d<20Ss)*oAC595Ppb5i^;ljXBJ4_dePTk@-y8OfM zR}jp{E}+hd*Nu#zx~rj4fld^lctY~^nUgs%sM?m7R3_7j@N0_vOEBfObMW{t7G~!` z)ZjS!nB8#hwrk8STPD%;xJ1ax|2(zt-}Jrzp4#`noCB*u$xX@e-}Cc$fx)Ez?+J^| zK(3~FjK6W1^H=JFgizscHF%h)lo@JfnV+!V4QU@8L*BDxzTH6cg(y zisUoG?R&YOGQY9SWTYLU>uxRa5Tk&?tdaCO@w z9R4-CaRFkMF@mh0BrwF0BjIwtLq9q2_sZD(bLd0y!S7k+CvZNvvuQOH%)d%eNRPXZ z1dL~cVw8{mrV1q?1Ra!#i#G}{;Q*Cj)vr{D6;ursWn~i8N01OK+bd08Mcq81XaXft;sxD6L0PrCBwmT%rgm3PCNni_?Z0J) z*i|;L!$5gTG8-XDh(beoB)jVqe5U+8IXW;Idp_Y|N@sBee_TxpEiNs1mmhIc zL(kGE3RNWoRig{1EuT)x4H$F6MXAL^rKI?4HJbhBlAiV+%M#MX5=~+fMv8)hwDS~2|BiSaD8fnbJnj@mWARipPFCm-LnX_gYPj#ePU`5ZVNd&hn4z4(-($=5ayhY*k{pJk_Q~wRwaK(u zw4t}ztV0{H{2=ip;}0Sk^dAILJ1_lChP=r5f%2`}tHDRbS1~_SFe#Wm00|N&L1~4} zihL1*l1XLplTb%2_Iz9rpP0R)L{!wvKWcO` zsi*LaDJtTXeszhv3A%|;EX`6At-#jea))n@_Q~)G7Ls_ApD$RMX>0Q45wxeV7q3b7 zNWYIzDc7IzKSp*V@~7zv4oCw>fhEHWO>6r#v8z~hE7h&Fk9EB(6?J%Z?=%eyetvA$ zxT`qPUL>$F=SAiHL2P87sTaHI+`MLEc7o>4aL0M4bccR|xX4k3X^X|n$^*k2Ml3_@ z%R6O*2I7oh3LVGd)ZsoMIwX`d}QngEN8)CF>+x`aD7# z5jfDA(frZp(OA$_iQ)*kV#-Lq#xlpKkcgUDH@to%s%F;Vw_W(SDe&u~gMsb3t%!rE z^*j59v67X&LZ-nKvn)G3lT`~Ln=j^k-I)Hr?W8r83ondf)iI znS8MSkhgC-E<28>Gn(Ufok8=Bb zvOiM;DyF)Yp4rM~FZHe~v1ib}Y%iJj-_O?0jD#`-X$9;&j+`G)j!rVRKVEumDhyah z%rlo`l>Y{1TfrO>ACj=UrBkNwv!AoqmaVGbDR1!J#jy;yr=9BkX8+CMaN(fQO5cj@ z$^G#Df$XAHP)S9=6810z@z21fS^F?@e0-im9%z~-FVMTbYpx5!2VJ!>hdxV3+5 zSN5ghX-&pdR-SB?hh6sJ)1hy> zYdBHJT*xo)h7J&>HiSH_@=iN64*or5nzV&EAFs@V59M6#k(W0XZQ9y2M1 zYIo!5u9G}yV^P{d>_ZNvj7-9v-tVz76NoC`tFWt*t6ZzBB!QAnlJzp5r6%xnzZsQ= zmz=Bk=98y&i~Cd4@D&Rtr(|Y$8x&C~q`O%Xec89Xvsn8=V9A2-&A$56N{g6zBRzC) zV%j>L%VMR0#f9aG_(|g8?|RlcrZ<j%B1=5;sk*_%SVJ{FAXl4>QRrx)g7?fvh6e#9AWsGF-b6*9Sy2iD~X@3m?OS#U)AK4Z9&9aKDPmA3fb}wb; z`QJ6aJ1#x`=DD2NtPdD|$?ea5>+tjBJ?C3C{P{9Zew`=W+}B*=j_;o8i|p(AAXXV) zdHIxi>pCE|;a~dFeU^TvOBy9Iv$6GO#z_rg{E23j(UDXTxLmUlOn|kcDgPp$EpIw` z#K6tKbb#{f-BRKVjiH>NTy|V0#oBDY6_d4$9;%+)n#LOL`SrQ~uqEl`$<>L~(tCm@Jd@F|4*8qzSH4(9Zq6LuPfv| zdGiFF964=A-q(+GQ>88A4(a-}ZJ({5HtrtMKDYi^`hKCiR_kqWdX&B7S+!XXnYar& zJ#@TsFz6P1`LbDar0?l4-BHs<)5-0}zkBiBxBX%0veqjoQ0+$T++?5TP0l^=BV@MP zNi&BOiLmX)Yijo;G^Fn^@Zj~yyW$A>O<`ZNxEy_8YJfpDMD~Yh_KV$-_xHw0anbZQ?R0BQJ{g4YAbTv9{?(l-J=QzX|9Pryj4=Mu{N)M7dUIn`q18tn` z@{4Ixz`-2%6p>;%vB*48ixxZTBbTXq-p8c=oi7SurkMgC`rm!{2(g$Kw;R9|^P8Rk zsdt~P<$YR#*Kk&>iWy8Ed9Q(N)Q&B_yLKv{DtutBU}5TAMmD}OI}1z6urla9#{|qA z2FHK>%8w8A3nhrd0taWe83)Jc1gh=@D)%N37DasJ{(pv-{|2G|H@uYk-xvzb4a}4O zH%=WG3;n-DrSca4H3W`Jfb0L~7-%j|V9@k`<5+GkUQX`+50E|gpSHyt$G^+JA@8gY zF@rBxb@o7v#*strt4#8iDti|ujJ0Q8z^y8g;|+37!}0Q>+Ci4WqC%uP0?s-zr(D0> zt%<)oZ~boL>F)mUlz1jXb-h>8@$=_T+jB$P%eRM3jL3m)Cjrv`bAFhO)&;)qHVNf> za{P}~53^ovJw*;AH+nzx|Bt7cfH|!dYlm!ZJ2mxfkFE?5B>(rPa`<9_0Hen)KpM9{ zG!EeUfSdgP=d&dv|13`eQjB32v)#%1+ra-4P#QdmW1Jym*GXX2_-&ElH{`!WR?qq| z@NRTBkPJhPq`K#MPx$M9$&nRx1R@^za_0g$?d$;lB@J^5LiX>IkJP}o!mzfw;x`|} z0`fgQfxFy5U-xt;AN^+!W?59e-@ffqa6I%Bo%_EAAU6s=QL@7HLi}N8x1CsFFot$> z`?ikn@8{3YfnSV8epK1~$#oIHNAjiU=~;)MbpJiu7^MgV^Inn*o?Jhz)mmPvkc&XB zE*T(C56KV_KQ8b4i@klY?w;|}?sQLH=bOv6*-w8ge3U&1Pq&ls!3Ia28Z2*3}692vAPqiY%d3Xox&GRZfHl;8HqG@!1cC>4Fm6xS+U6%#KEsD z&uPF^neSA%eZS(Ki^=R?9FzR~wvPl$87f#Ofo;mD`p*K^%s zNkF5HchLI{g4j|4h5mi1YSbhC@1kbp-P%q@z=lynz6D;lY;Obyb6&Ez3XqP+zIa}e z#SF_Ok2bUDLhj-NFEAptwa+mkRa;vK$w}3i4hG{3WR;UkT#g!6`MW??QQFLc)Wz@lc?h$vd-8ifNFO%E!a*fe%e7NrT zISUB4H@Cmq>(Mj>p{g_R)$EV%6@NJkozg7uNRhzS*KX!VocLqFlrb8NJ%w)3OAytS zCfPJ|kP6^44)1ILm+AzcByZwI4yeZ*yZP{BlEw@hKkAcY1B*66s@v%Cy_~991ODz9 z*ajY}m5=Y=lkM2rvV7-0+WTYmw>I$A6@kIU0HHG=5Cx2>qCz0Lj3N5egmF|k(D04p z0|gl|Mu1*!Pe9<$hil<`Y{2C2p4K>2FGS@?^KwMJU&57G$MPYMx3$32R=N+P1vA|5 zgMS12X4|c^HhsHExt9@~^fQt)@5KL8&IJrwe-g|k%5hgZY~JoiubcZ1R_|wwxGqos z?Lc()Z^u`_nW}*$);Kc7R{I7X7rmaj;%-K(X z!DoBm?~f5_#^lVCxemznvIp{q2yN>Sb5uMg1h8>HL8OV@crq#FW^(mguOkt6oonCT z5BrFQ?DkkWwGxDlbB zJIj!Ba?3s;G^TdjvOCc@Qw+GBe(0_Q>Ru}loKm10AUzN;iJ#aYr0{-wDd-iDFY^uj z-Kr`a*@F+t@P06>S6B-mC;Fh6ZMn=I4*WmGAz=V6fCjzQ zPKqd^sKeM6w|BbtSFxMiJ^DSRBi9?)4 z(`}3$RWFXMj$T>X2}De24*^mOi9HUov)Q4KP&a`i;A?K!Fy9Rrub*B1hfC++xXZS^ zf{|eG+)OIU51A*p2c$N?=@)8J>@y08L`(_WK!GaniAZ^CXHNimUJg-km(l|AXk=E- zV?r*RZeTkEkL2UuJ-G*5d>brwyo5b&n-G)UcHto4prb+!KkwJtfo;YCKnCv~OGd;q zAxlGFczB?mDeSQR{#HGLbR7j1ivuc7mY1U-w%IiKfOUAr#^Ta8RH? zse6w3;GM|NPvZT_*i~Cjf1&r|XnLe9J|5hg+x&70HO6juFC>+tb6CD8=s4f#$uRvV zcO*NU(GkyXoL>C6_#J+eIq2am^pGNjjCrF|o@UxjGHGTXU?`@q+j!h#~%B92=5$)@pv zuTQ$nPkSL~A)$%Ho$#z=MSu0SYs}F`{_i^jfvGR48?-Ghrj?an6FUjm7Z5qB(Sm_r zRLkeVLJD9A;Jt7dr0#;jQ%7w%34f89aHLUETxOm=zna3VxYT{6X=h(fq193v?XOTe zV!z_%mUM?#Xt&t;dog3yP`ZzQFK*?A@gv9Is3xDJ30 z7=!80IU!AeSz3%D0MKJ(cxmWh%DDHhnARiU1XQ)52V{Xc*S(%s3|$_eJ&159^oMr> zq=qJt$H>1Y<1i*In|LYKe>OaSL4R%T%GT76sa!MorambiP=S|3<%{Me94JvnvxnMm zAhSd{rRvwF7PD0u82b}n07#IS$%s@nLRQcK(;x1R90Ac(m2ehxUo{`e89+sTF1POykY%tGN@WEu_a{VdJM2IGY6CsfuZ zrv6PSdRoL_>+mn!NEk32IPSjzBmo2;#s2s)8kcfoK&%~PqySE&j7e7k+v@%RkW9w_ zRonBFu|#6L5}0NjIw4>Ucu4gDd%ZT6V3ff(%#2;?0gO?eJ)ArOi$nn8JPZ)v9E*il zpEe2Uj{UH5K6L1+ei;@wmIn;s`T310=j4d0as#j+08J73kZ4C!FFKJbO&w86n2Wtg zI$@b0@vXmTOyd0^u-g}acnXl(2laji+0ep-AY&=|_s{iaTJ~KJ&`?%W>KRemy&eD> z)8`eF_n_xL;aq8a`g)9nJ_&~zYv43e_o-~yGT89!uHb^()7vS%V`Js(++7M5lIYiW zj$g|5-7C*w6Qs>E%1;9%5&Ee5M2QhfcBlUNbZ9qxr{G?E=@)MH6U zCzA;YhUzHrX1b^axh-|30zd$mf>BNh$8IOVy>S@9pvq;N$Zv$?T1^0`0=z{b)Y@$z zyI4`BmW_VvC?0_Dh;zw?U`|rPqtdw%x4F}NSKO>Pop1eB{L&AVpftCIo zrO!03F+jt0*)2?(4o@K5xxfhxxCiW$^W!iMF|v>-rUTt_0N;8j;x25+2$Mo!^_A^; zY9SrCkFV$Hxvz((H>w)vNbIkqSLx2fPLGXH&~B1| z`iVeHh+qyOao~hcNxTM$hL9fCM{n?2+>LRsU2D*8E_NH1yRq#*JT2cX*o?LD1UUSu z4(JJ6EK(|3NV;~AEelA*Z+lfY(hR?Cc`DGqQwUV(fdD&=wPOXF@Ht;*qn};Kt{h5; zFrH)7BgSkE>w+=m;x&L94>`tJ7F8j*r@?1(XqG1AAi@vIYr)K9q0D zXPD&(R0LA{e`&zd5dB}~+l%q={tKtJmWH1#4MMppmz!O!!ldLe!@k9{^XK+i2!+&0 z*D!|G38WbC+S$CTSOiQE)TdvaFJcrTzMeZ&Ma^DsU|i_z96`0!k^{oWJj`miqVj8w zTW3S43bsNmuBZjsz0QuF87TV<-|&LsQFBiL09AHz6P}?VAnw+`Bok2h7OQ7xY!;9H zs)@j@fMD*wsjtLOp#DSu-kzJzT#1>5qA5^@dT$UALUcc#_&B#B9-==OiH~6gl|j4K zFzbzyXAsDdux!ni6#=!9j1Ap~zk|4e#Q{`g4PkmrL%iD% z9p3qeE}b4mmy&I9kKeYZ<)mb+_!44f>yUCF9N0Hs=Yf?76{gF^l$&~T??M_W!t?-K zlX!Kwyv3@~xj;g_WkPnE za+M4~eqqv~RrC!A0&JGMpc@E~KLZJ^E?F-y#N8Z z7E=K&ev`#hlrTQl@3^ot_}2k=!xzYPH{0EPZOvS}sY|P>1i*613W`CKZ@48PoxRLu zzzWkmRzNp_DNrL%^wk?XIF*0FUQ`uN2)25YT>!K%CDE3{2*`u{5eEm~VT=pCUOf`U z^#KIKt4&98#Il|oH6(h~t#MG_^je%5!j>ANM>T)5d?G%3LQx!+KzN+M6}kQ2N?;Psg@NhSAYc28pbylF$Q!fIZg$ zkn9!TDb*UbGh0tjp7O8GPswJelq=mwp%!l9(T@VK*P!{4?MF!K*})wN0q?-On~5gD zeqcZS+?79oRZTI!3E+;HAOPXD5NvrYyNLZypD9}a+JlxsSm-G!X(#N)nAtk}8Mbsy zeBU?5qZvoefZp*dO3`Y57up`=!~37cOZyYCDiw}j)D+w_?)a-1xi}jo)dWNY*SuVn z8nb?96FpbyJ<3lFa)EDO`CII;%Kv4+kVizAG@|Qkfb{`i#~*>q)@}CqBK>YFYz?j$ zFeWH2E{aFt&YT^2O!3s~lwGy}G$_XcmbZsm;Qde9o5)S;W5dLJBmxKZ+Z}Sz1!(G4 zF9=jGF;{&ClOb<-r?U;1+3K=^{wIJQY11jE<&g6>t+&U%@D$njb1@LmXLtNshX9Dt zBj`xG06LkT{oXojov(9fSSf70uWgf_*&g*&d9)5+IlP77wzn#4>l zBuG!Mv8U+vIpNA+Z@>XHMq=qQ1{ScVh5SiTkv)GLh$^rp{%oZdHAD1KTidHwg=e72 z%H`wRTgO9@NzdFzAkemGiH+QQR2b=-3Afb7(Hf7 zes8jErOUYQ#-i4C8j*5d=(T_ic;Ui$xgS0ytP zHFw){d9RsVam*glI|_$R!KsqC*}L>$FIn6CDzf)GfEZ%}(S(tOf`gN4)U*E4XOj0t9cXoO z=DRwmji54Om+xO}n*Q+`&u^7N*t9$X>M4~0;QMdCN#bC$V|IHPTo9@pZ-grnzLlIJ zp-r=6!O~*Yo@*%5gLg4*?R`ht(7k76Q;>j#RdujlDUs5x>C7jyL2LP*Fv4^z+jskQ+AQ{$%l%5+NbU2 z(3BR1K_d7Gl#!f-;Arnpv(SF_wq}~LvOy@ayTx>wVT%&%=JH%j;8Fc?jai3TcV$6Z$-Ma#y z*gXt*YMR~(fb|Q%$xLE?C3qjAkIeX4_bhr0{33Ct zc}F7b?aB{!R45~y0-vYihPFpPtwa!j);QlV=mXD*2wbt8sEm&_*2&3<=*f$WuF*{C z#Q}6w|Fyy$&3EtaMbn_Ux+TFe&z$F^aHiioG`wxBEg4%$pDBJpqAdZV*W5}j}}EeIwzuuF-mnO#0b1+9xJAl zmp4RO&m-jd&>#@Wv%p? zSQrHT8JkP5ziBf3ohf)w4|lWXri2Tb@!4r5WVo6{yY2`~}jhx`V5Csg6y;pw3w zZ6*6^R6D4357sb1)YPA%dxo}R?mrr6HXBB~q4iduUGW0kYE>1ZUq4OnJ7goL7i)*neUd=L}UL=@oBBgJeH?C_jjmggyXvj7)32YEF+I z_0yu2%d}2`C^iln`dl{?vN&19VYuX#%IP|=WdrRK10E04bMrS_L)Co) z2pX=;X@G!G(wic3psr|->`9WMRB~VLIUh6=pAMY=&f%E+CXY`D@03Is7-i({@ViM) zTieMy(buUm7R0!(rIZ*pgF0!o1GK>|_M8<-z+SBXM8E01O_J~Rl*>|F)YR6#LX-lA ze&FvzX%xZwns^G>Wqq*}$_=qLi<0V3Q}|AZ8bcwWA~h)<|K#SYAAkr;t$ zNo?QS*`_Ub5vljXG`KOjS&_TAZ%H1#;O4aI<5yXRScEDq?QqU>*%U%<9pzmIk^^z2 zcLK}xm@v8?hvgr5vnJ5!lOD3}Ir=@YR{FZg>2b4E%FV&cm_^#(N$)by{JL!@re_c^ zm0gHC*WC(!VY5Nd>nMBsV`cJpVj1D3fOyRM+hHbXdNUwb=TO5EW+&J}G&R|14hnzX z`|4HtJQ|t5SOiz7w#}i9hu{=KLPTu*l{2L1FJ-db);oy`3F{d0e)|uJnD+z~ZwamM z>=1jB#6JJkN$OHt3Q?x!ea!U5nuANA86YF|nBFo=_`LOb{N#fbnr{64>(yQipY_OX z@euAHn_z29Ap4*cKnxKG)dBqYSidSCa_`+z z3Z~j0tSXKp>14DV8@N$dS|eum7I=Pvv@<;z*|~7>U`ti7tIpltZ?cST&>tef zaNP!HJzH}bQ3@6XA+db9DggCv9nRJJUXKfuk*M_}MjC5zJ|L=m(5ErC$Ks%(>_y>B1?9dt5j@ z{H73%xQ?@Jo!0oSv_^(85cRU4qId#5>itT9h&2aPsswAMBnvegD0~#@48z8?e7=rK z_3cPVVJX`A#%Rw4_|8@Lx+gI(OqBzqyg#|C@C#}GcOKEwuA&kfx zT$09VCt;Ge63ewK=I_}beL41W_vzJ}sK#yCtV@t7=}uj;sEB#cm{J>T4*bzav-`YC zF*?}`5Z?=!xW=cGXA6t8)`Qq4(DzzMVmbWoW0)N(tyGiEXgS^=PkIL3w^!~ zjX7lIhG5`h$r(fgu=a-z5us_D8i}ZNbs7rpQvUELt5tdOxqO(Y(v*9?2roOb3Mb4Z zUQCBosSt4+wyF*tUjippXa2?HkoKpB(R`u(|xKITM^WLEZPHz-SpLo|BaI zNELOn^TyH|rznMKSNiP<10ItqLb(rbEtMQ9pwH2-`(O9KGBw@A=3mV+tg(QK-@zmZ zgWa7;eQxA7Vu8I`L6U0-D7{3)eWQ=>+6ax{2xY&4@n$rer!6OX;OAYHH8B#*{SUF0 z0|IhXE;PDIiR4g9_uV&iDO`;Tnn}{X!46LC35!1y-hb zQBOpT0S5s)Zz_{Y;ZVOZB}oLs6nAPY3_H!0lb$URb!|_Da#RO))98J=X^;W+dV6op zuv;p3n04QyW7AQP{UjA!fxk%`P;inxnlcU=wgH&YPAB6*W3=@81_XTnB#4%5M+$q$ zsn^M)ljm<{M^`J2C@r*xJ>%J1z9QL{eA2v$1l$!)5Mq+ekDllE)g=6Yh;!MAGSG;0L8Jyw z(0x#J`A!t~B`ZCwd|ZmT1UJn&(+jK9A?O$AjJYTkTXoXQq|F|?vT)gsO_NtvHpymX zZ^D|#$`7tToAHIo-Jy;Br7nkLc_QRpo+tF0zR4rs%QWNJ708*u`1m#tL>-aI$8;#| zL%m1IoT1_ut&I%ja&zpK<)e`Tqxc#AkT3TYgpq6Zv6@Ot!i7qHP|XMvfeZnCx1|JG zyk5omcV3Bn%?prlnY)YtAO&bB2*dejS!f|`&Ns{@!ve#{ z#0VhDFKMd`p^f!2J;pJ}Y`E?cG4JlSx9b+hN~IcxzmoaHqxY{bQu0twSH95Iyi@Q@ zv_kzQAl{Hl%@~0>evFH*J{@Dgrx-l*1KI4}S+&+HJDgGGs?lRPm-HxIr; zaK*FOsJFGO1a(&ARlR>eyG>x2<|wR+uIf=q48rddmsK+7sH!bk?9WZ$aKk^e%q){! z#3+jgtHzPzDU>U_zpmE*JxSVleCGRFSFTFAo56>Zsb$s7o5T`zi~wzI#mM3^Xa)N9 zI;_&L(scWSEg3wpu)r_@SvB;N=vlVigSWr+gi_Oqi|luo{Ml7=oT0f z_-4gYanPHX2v1NaPA9$s3OB&40P= zy|Tr$v@K5OZr`j0L55GrgUnCqQ2S1d&bpz}$kBa)T9Z0$-HXl{1YESb#_uzap9}SS z+04K=p}>3!9Rz3TW3A5ApxZBT+zE>Q#b`rXwt6DO*>d+y3dcL+l&#z-NtPh z`3$8L1MJ8m)9R>NpG;2l1P)DL3VynsHxAVhxi_tf7Tkx=E%;k!X;(@sV>l+@mb+V- zPLPkW;3@mU^x!k%R8%srCwsFWp!P!#Yze@jj)dR+rxJ}`Mr(^!Sds9z87PKiC9Rkr zK&-QLQfksR7G>E<6k|ZtRD%q$KV&M!_Tbct;#LbnkNS$cChJ*CGz}Ls7zru7ZKg`C zKA>;ez5BfuN_i;-{u|~q}zLoI)RuWr%_8d&-~1WpV339vPEa3AR91r9qP|ZJDH!eAl34Q zZKjQJpwL9ymH6lP{K@(hTprUXl71Ov6C+%Q3tK5WlSa>K&sn=B26DK$IU~yAh_Xyf z*3;=fhovbjtQ1+4bhvfMco#x0rb&e7QWJ7brNNxI(4Ilp;6LUAk0x~x@cx<-sNblo z#KCwhn;HvIvOS6=hvcY!2`~lq(x>zLAA;U zsF!J{gR38GabUzIHGeAs!**1O0C-IEmptR`h!4s?ww_)o*c}#4O8#1+*=0CXWZ;dI z8qqOp1xH`~WI0AfdI!liI#qO@%K1SZ9P@5(B%dllc7%-sdgXnpv;gizq@n5lr{+PZ zd^VufocM$k;>|NuSP2o=d`hcYD;PEeE$Ld()4GZZ-J98OTKsF%DVMcuLsHpPk zrWJggpN`s<5?-Q551FQ&Fu{1r8G}zEAJ85BD0Aj7!Sik-Wt8-G!HL&KV=?}7;XPN} zs2(h>%TXf=v~eNhU{s6~a=Q%7mq7vB_g_OEuSY!01s)?=S%EY^X`!q`{26vB;OY(48DA)o;&{$mZXQ zxJG*Il6t6;+5SBnPQrNp6b-#1@M3yA8WP#&VPhLrTV z5LqNo*)Q#(=(bL9&$+X{^@3dK19e_thPX7rkd*m6xr=DXhxpRH)@G_+z*(Cm$(O(9 z9hBNh$)i=A8n8`y$V&OjMcJImJV0E@iKU^(>cqXP!~9MA`Fw3b&xUvbilv!#C4lXj zJPgQ27r)rVs(cMOg>RL6LgUq!$TMjlSnBnBWG#vN%0&CHRWz>;uWalD2D*q9z8jHx6nNb)Qrz z2HBH6CwamwlxC}kC#$F>{_km76|K1snX_NTS96~4F0+w&hZX+nb=s2iXeZaQS_yM0 zeh7bVz-1WZ+B}two1Fony2FZyT4jp}yybR0q2FCysdxt#OOjj)Li#F|KQ1JLDUjIu zIOSN*HM6L0hTN&8ca$Y3yvAn^o}|1N7s!Ra#^yf$OgzY}|2da}6i&^EA3E+l^MT5863FBx1HB*a4jhI`U!hW3DPt6j$@KK0VPvLvt@!yml5MPdRID9YYaKJ zcsG=opRlf_&4oG-Iq!#;1Bi)=if>U%uqaZD7aK{~>$+wY@8krg30@S}a}0#|3r!vq zV?hyO%Dy;ZYR>!$9oBmWJQu0Tu_4i-&^*_nb3H$nKaB;}% zOqVN=wHrHeu2y4)5Dg;7WX;Y_;pVWQXu~P5Sa`^LRVlfO6$z%N@oY0#H||vo6(Rg& z-?*EZq`vg;CgGIxlM+&1X*@sGxe)t8A0`XmJ&Aj(M23@ofBWj`OrDYRXqrlnB~Cd@ zee#XTRW?@RAcKSp$HqldEp}~TY>jIZnRW{OgAkvvs`^R(NEv9|v zwep?#UrvJjSy>e{_iIXA0s@wKNS$LvVcCv<41N{~=-x;rLM?`X9GxlSW2XR){66kf z@2aYvSc^ZDm<^a;DL83m^{_isNrsG1ZigB*fY(O(ZaZkA=&O@nDMXc5zGf?#R=vqg z1>2Bi;|?fcIojLJWm&CScKA}pR@am4Pcv@HY9qJcRlpQ6Ve5FpXxb3dBM({Zs zgQC9|(OP*f_*@P!8k*;7SMv&;X_V3Wp)+gllR|3zG$n2gT~oEl zS#HqGNR!GOYu+KdeJ@9(=C1UZYDx_wM-kKKP=i<$Jl`>7!I~{mVy*T+h-uI@~7Tw zPUkbwE*Tre^HFo2Es4>Rr3K5m7Y5SvvoL9#iw=mbjJsbdA3aGaw)eKVlZxisjtj~2 zwBI>dGctWMP*wUdo&X&x!c9$6K1#*R@^x@$s?w+9g#D^t7~ z4=Z!E1Zv6n#Dv2U{O={v(^kbjl2Lm2tRpPn^}e^O4?$wdB$z{r z@Dbg3XN&tL5Ni^Z<5U!k;OFyh?~M3V>(4x zFM7Z>d-6Tw( zWH-_lkOHUP8Jh$HjUSFB2#8^~fcW8qq2P;S8`Tyj{S;$*B#;}ep3_181W)4c^r*97 z53Qe}EUy+kcM+9!Ag zJmPIDP@hd)jo-_-x?>HBZEBHoI~f#lHL(|H1%$G7gX3d0;3h3n9Mhmx2rbYI%qhRt zAbRLs{sZ(bTY)6!Xsudl8*3(Ga6M!<;PDid^s9TB;at;-!@S|s1so!I^ww;-_nJrS zR0vrJ#Y`Gj^z@4<#ptr~KJ>NpYZ-DL<8hFXMs(lYq^eTh=`l7Aq7l|IiQI5{V^zmpUaNz>eV8SBA2-eST5Qjhut2dgW))VK^>hG`D$q`vum-u>LwgSo z${@fpc`Zd zt5sWngM{23F7FnWu%Ugf$PGrKs5?(zaCEkY=clfMq}M9G^b;gNfF?sgD~&%*I4kl~ zbIbp#=O)~%?R4{9Z7?a}HLP4L)-srW{<9GXpg$d(L@rYhu%zae6o8A~H8`%M>697ejFg{y_0woDnnuVd}cR z^3&MBO|xVhchu}WRvS;(!mXPaig)?oQUDMhKVsvd`a`g(?ofIXjFPDj^=JbdmB;xQ zc(JN_Rxzb&ZpB6PoXZMSh?O`Gu(-Sbwcoc96j8m_eHtSrsDoZij*9(ocU4udr}T#D z#7Qn~7jMB{nmKLmbFUY3ju49e1tmgL!+y6j*FY*8p(~nsh?wki@pquL>iije7}9~D zT#mS~s;sJ;?KEd)alK(d_rvD4H%!W3?;93m+~_=37AdlpjO&-&`&c6|Y3{v+ud4v= zcjT~0Gd=;3-xI!KQ!A0f?!eKHt(%a0{N;W#x+FJl_L- z4kTQivQ`f&> z04Z>L@!28qY(+_0=W`njKG!#FrLWS;S1v_reRhBzi3_j4oh@gDyf+aG1I@b>QtDF6 zucNCPX9Rv83p&i3C02O-NQ(;}n$bOE9Pe5?I6s%Iw-k63h!SOBKSZTO%UN%=&f|b( zR|<54fsj8k6E|5n+Ak9+$1WX|AQXkF2?w4@a)J#m_=#dY_%-i{5hpUwQv|~w2!tsU z9$dNO6a`bu(0pZQPR4J6w(Y)0HXI06m7`x^*_qKv3Vs^IOd2v z$RG~jc(KS&rhytttSF3rd5R`abQtv9(P~tL-T_T+(e_cL%V?B7Pn-u&W|(vCt9hJu zWC3Le9QA7dyU{@~#IK(yphn3R#-7QxCi^QEGfE z6CGEQ(2;hzuU0mHLW-dg<~|}uv+3LCq(COtIHeIP`3*A~_0zYSErT1Wv4)*i!Aj^# z!DDl*1n3D)SUUSSjPM-s8v#Z7u+~U4F5?7HxlpL*BkUJ3mhkIG-1CY_)HF!)Vry!g zdP_s4JmchN@ZXQ-;P~F3W$a=N>1n=*f3K;f<8tK~Q+M>Q&y|KM{=U0$RYWT3f-)2e zl?F-`l_z~YNbk(qY8Wp~FK}fhBcg&-Lmg1fsjA-KB)cMDD+xCKwJFt_vl z)l>CU-8XRmN`+KSHnnyGoITgny=E&MvSq+fL?QK zNyMY8x-)z1lX4em!Z;nPUhDct0f>hBo;Z8vBKsbjI}9kl$%J2YKDi6OA{c{IywhgQ zZmQ7&o5n6x7*J#@)Yus=@RT_W`cw9kYKQdgms^1_ zP2&KX%8)|Jg1p`3kZ@4dIYNe}XYoIY;G)#}b8KRn0qSi5kMkk5q+bZk4U=p) zxlXQ5L-WwOU&zkc%7vc;J>Q48&TI&h+Tz#IuNFDQ#|YXow7F9jgYI!~$GAvD^P zBZ?x{7?Ne+Z4f)WZCHr2(UK3mKeAWBsZztglHGt`h+yqpB6jSTA3t7$yDYNjrIvFF zIMRp38SmQFW5`;U-l+SXswMvQ7Aeooq5o13)zh!f0%9MdRu#ht6eQxH6ZjRj;dzgx zgV&=?vISyfQNk=LS3Sipu6H`N?XDBhp+8f@JJ6)zpY{yl+!HeLlA}+($gg03%%QSl z9@FAeDEgfw&?)!a9BUmY3Cz6-M)=8k0?ichtAv*7< z@@73In<8}KbLkdF#IuuM`CZ;_F?jWz>nnYYMHnNna6`C`)F!2wI9$F~P`WXpy6&Bi zZ4RHCiR}S1qY*;fO=Q5WfEP7bI~o!GF<92u)$e)e`^{Qgp?;3ct~*g4l=sA{IVaud zd%C&qCra}E@9sr+QhfOd({E$GXpT1l>hv%(&2JL*$PqyAh6{a#l+?%xD%==@cWdhPSTap#? zQBJ8%q~AP;z9N(%4+G;tF_TCWZ@UUbHzD6Yl%a}$?<{A`FWO+=_w+^EH-acnACrh=a+>*($mFp z4#y(bL`1q-d%bces}3^cJTOI|>`qbuEgi`qo?{?yKjyItg1V2vW}rZ1)dxDqG#xzB zUR&@UvQ6k1b^NGBNFQJ;x{pR)NxeJeo__>w7Ujx}MyG{>l|CFqq>VSE$p(K8wkg@F zLay&~5%z?yH$+@iLp;B74gQnKv{AaXz-P@b)i+jnKt&oTNWUW5piPj0qZ2`vV8YtPq zJ{N=ABRPOV+0t5f|OE)f-&e%dR$n42PL!cTZ}2*-$t(F} zo!w5!aO#nB>S0e6q_HU(CvY*SI;vAYOjn;hh@&1&H)2v81?kdG;kn(?$p#|+5G3WyL2O0qX97ad*oN`F3?v*T=iC9PYBSzwv ztsj!HOow1rJV3ogT>TfwMcB8-Ue--eWp;hTn~(#z0hw3a%SAX;R$VuVyxM&_a0W96 zV#xLbW!`#Xv#F^gh6FBLx{EOQY~xU6fLkWxAI`pif;&4rZ$z_5w^(0BtvAdqHX&LS`wjpuh4pJFUW-Jhn2sQ z4t&TpB$>b@3gfum(go+^w6K^pR5ExDSFE7^sR1XFh;+yW$9XCqB*(Ig6v>WH`!r}d zg&=~>4^L3OM>BHCof}CJ$f;d_meSH995r zNZEjGk6vWK!UAz!bg!!`J*UlQ3{?EbqU*KH-cScWSPnt~2Fw77-yZ9j^O%qaa*9JYhyE7fvGlZ#9n>vb5cV?ASedyk3WhR3=LAYm}KF8l~Tx~ z8A3X-I>pTrZWQQIv6oaAP1^_-+w%c;KzxblI9yIb)^0F76%2h)OqQ^*b&DXLcE1f1eC6<7O?#R8P2gb5>bv}8SY41ZI?{+g`i7R4cc=U#G*De(3xO`%7T|?4pha$=M z*HOj;wDgv{AHeK=@d@v;(}s}+TQ|^KzxZ*`ZK)Gf%F0efZ<1<0@g;$$P8;Xa%R!B< za-|fdCN!s?^Sczk2;uobj_9D8ld=X$O-;eBu;^NTS3prijU>^GstzYSetzb8coKkcfbx3E&{g{4rxbPw&z$M>TYY4?#f=e0HBpu`!a zaf$G#2lGU^_I6N%Be=pt7hApoS}Wi0MNKl8#{0$c?cx6L6Ey^#-)yJR2tsl4hj@3O zOD}RQ#!7)sWZs)PrOB~vYk-Hid(hSH-+59>!B|c1h#rmszqp({=Y0+!dKsS`hWUsd zfiZ_wwm=QJi7E#PUc!C0DdLzK0Ny^Ec~*`m?Mj@dX4`r?&->L+?sm5oZ6t+@?$tbx8~b=? zLa7hqH)gzV#Qim~M)vYtSP&ocR8grmK)R0vv95&picPbFg*x~>aX%+;YU2kpG6gap z=Bi!`MH&EO1E69#Y1LKOY^dMPO(8=zDL>s9n-yik@@=iw_5XLQsP{brZ%BcUl4**q+} zgHDpx@hk|O%ho-D_o?JM{1>H_2!t3a(>E}xyQP}mLJ_*+9y8~#Z(PK9CYI!JqJBzL z5n)EdxuCLnV!wu$w!5J+xnj?{#Z^#B%=1{mt0!uQ5Q z`-sugSaoh@C%*O|I_N+ju(Gru7KTU}0lzGeSNVhEe0yKP9m9z`hAjKp*1QwD4Q8r) z^23P0jD2D_{~AZgj->-hz04@&y-L*-*}zpu8jQBUxlHmb+Os% zYUk--6G5BNs7Is^mCV;@h?W&gdNfEPVG=ZIR+gkT*r@uW%|4+``fVwb=O@-D4VUXE zHst116epSOh1>R5EUF9;qckejd1RHup6oe<>VY(0k)L}kxbQfm(-6685v(Mq;{3;zDONgZUzlpmyBvEFXLyp&v+iDCqS$P6H?pSvKZ z$Y;BBU?G3;up7YH&67sDf}fx5w~82vEKu-M5wq>+nIwULmGku{s0aEo|oI?b-{5Lv@@uEO19NU;S{^Mh7sHb{M{r0B{%ak zlOFJ&H-4D(_4 zg(n(aS_18GmA0$bEmG^TZu)GQf$2hG4bPN4eW{V%CDb4ir4!~z;9QOldGJ%}=2zA; zC*m}mkq0^Vzf%vAr@&ba%iIka&jRK1oI=tR<&SLj*`rvX&um=lEZzarz-@_U8nXu` z&_Xg!QsfxB`Vo!KkHMq&)kP_u41*<|2V_Z|k>88~bYquh&;;1(|K0(P9B&7pRl9)e z!aPh3JxU;cJB^LiVW@Cc%_uHrJt9gDU;Q4|_%Pgl-B{Vgk&`L5X5~WC8%{yw&M)m3 zk)+V-JkuW3_7eVedGI@wemvx=ce)q?QK=5Ae@%&(5*oM{oCw&3t5nU7%Rdv<{svgi z4sYU3QRF2`**Y(!j7%6t@TM|;ee;OUX)RcQ&_;omcv4;{|8Pv9khH+w;1P0jiREl6 zXb@Dz)r;eg=y>BoSu0B{cews)4UlYrK1K-goS|q<$s<2+>52PJdjh2}<}cfu1*`9T zneQ%{_ENOAvpNAYysB!w@!z*XUfMVZ;wRuIV))W4q^%Rg^z_pC)a9`Au4qxf^pQUy zYpuq!0hEadxJ4DS8bZp1t*><|Kj+5>qgIFTZDTxN0k;$D&o*A-B6uu9x5k=!sY*{_ zg`uROcfqfoCqszRHy%#wkH%MEy+S2lf>zuxgd`)%&uTcIJ6appM+y4@-i>Ys@xy*Y z6Wqr*HXeCvcB2)cRQTGjHCDd}>~mebj3+}I-(NHxLACHc104pm;AqowFzaHouAZKN z1aEE2mgk`ooMpyV0q48c6lLHQtfgU2hO*(B2`rs|MOXp}(kxDGIv8{)R!Mlx3c_s!;7C>(7r&mxSJ?y*Ha(CG81q*4pFmej%g8Bl3J!L_rEE zP~e>^iV#=5Nr91hANbEUg2ppmX!Bgs zVwsA5GOf=$Ec^*dy=7JvUftK(7lt*qz~Y++7C3aXW>EaBE-z*Z_+~TPi z+i7J5rL9(+jp9<=i)=gp;Erwg@y(y62bnPvCOvGfW#}-B&x$xfwynNv$Dm3HnGY$i z24Qg>%Vl{Df6|bw3<{DA5zw3M@+=!tL_Gp$VQS?g;Aa|x<_Y;>h=UBtCrJ<@jYw=y zPt$Vo;j(xiu4IlrFc`TKnqcO|H|a*u?cHiTfG0qookHx)VWo_WcVBUulp@~hlQgl< zyc69UbC@9~Ua2t*c9adn(IE=@@)~RC>j@*B>HhAFSM4M9ify&vFFDFkKLwIBR2Zqd zNv$YfmaYWpVxXY|Rj;P?Ovw9~t;M2IOEcOx)aX3?L}~JTelHmr#E2#qfwShSk;9TG ze+^D^|5N#^6-oM+ewF=z1RMUnrZxa*fKsbs+Fls?hXT)f z6c7lIuK^BKh-e8u8~g3T*j(J)13$#}o=@(^%v%(>dm(L7q)$AMo0%7j`gSi?{*4ad zC0ZNtJ3m%kmY?R47gb#hrtrc+86*GR_{aKaKRLDW!X#$}jXhCgst5blKRy_T@DT|U zH{`IEOvb;yu!Bko%-JUEBdKS-rXX2~mf&M4b0Z3UBvLzZr0gqr0%SzRFoLZ;5CUp}z$!npLzO-&(CL{p6z zsf)`5=&Mjk9wcg)7Daty5CTJR%sa_-EX}qifWhDt=h2axPv8^v54FS zgwo!WH1>4%rXie08lA7(9#Lum9E$X3IO_D#%2E&*`HT>#aL2AK6LkU?+jX8S}Rh&|q|y7qJs1 zfo7>?iLcADg8?gn*cZU0NYO|t7dL?|uZJvT6T}vlE>gkf z3GW3OZCh(Jc{<1>%LWzW39%fuoeg6Zl{OQ zN5cPOa13XRB~7;7k>#GLrv@WB!=>ATN&7dmVDUcV=^KK)T6&?I#}{+@c_(;!oV3wq z*Q8f%m-676%17Kr4Tjm_{_W9A%>p@93hsK$eZ^lLlLushp!Cn48WZFN^FEsuc)DXr zA^$_sm3=oSy#b#~NZDC@lU`w==jjP7evQi1WMy>2bDA(ltgF_tV(Y#txG^S;wxcN_ zHNW-{#@fi^^O7nF(AzS7f=0!Re#Vq(S5A{eUO0Ak(u|^b23)G1hswIp5qy!9s*O4v z8~V^JN|YK+Au`GO@Qd}SYAw<~MX1}i4iYan@ z#fTTi(Oa!VL9Al<9x86C4|R3<;#mfNlWla3h|S9OSk7Lu@xb5p`S)kd^?6C zuRn1PS)m!N9HMhHrA}{6_AX(KdgoVSG)<_ZJ^&WsND%*S zisaFm6mT+EN1qcW5oCWmx-Vw?VvYg?(WPXOAuzHdYVRqa9m)4$g_yioH{J~DP+mG_ zcKh%(K4g6~4}Ej5bQsk*w?c4`1TaL36Y1E_TOh%%s=jGq-DI=SSM%T3Zq^AZXwpBV z+gEN_TY}N@2T^G5N$H^2r{Ka4ftv4Z|1Qsbm1)!%ke0 z>(v+DCXrrq-vt3KT<(Fh$%VF^efBe2knk(C%B<&>g*ccSx&GY-mWR2sq=k1elg6{cODKKpV!#9z3^Ayv( z7n%Kc0d&!a_5lnmI>PTS4&S&8gdfZD{ls_;1mIO$jxhQx{1l5#8sTuAb8!qF0O-IH zNah#pBFZmC#~rG2<=m1lmNcV4@5%?gvo`wwl;Ojk>G*gUrzaK+0%T%Gs%9GsLJBr>^&&}uO;!7c&^ zas=a1^ysR<*m4?v%)o@mJ~vOJQb|cEBt8WW;7V52<&4V{xDe<(XP93#3+>>*K092w z%=CuQ31pANvhCy!b@9mWXl+1z539ny^e=EN2l83u5x}6LhpflKLa}Jg01%E~z^nVW zwsr1~;bo3EMfC3^@D?pYN`kPbw-C(;OvQ!hn#9%)m!E8G4zO}(Tg0dDNiiRcNd}b# zjV5L{qZ^p`1N@i*Yz6f#AE2dRrauTC<;aT2g3MR6enFWfh)sj&B)BEQ|pvQ1+>Ez}uj`$U^m^m3B z7aE)9#J#QF!Wp`oVT-gC%d)jR9Aij}`Q2jes{M86Ef3a)+6@wKYyRV?GwrV~e=!!gs^dNiA7~}2<@LJV;*5)7>oGfuu=!CUJwS0BOgm0g#pJmhQ!a#Q_4*w3_atCXco<% za>;e7!%KMH;-@kU)bO4oJn|&BjK$Y2OUPN)@Rbx_UlE%7sa7p<)ckZ}JBx3OrbR$P zAVdEU1ek+a%Ef$grQph`r7`9J+==juT(#)&<+LRxLJkz)!hYPPP|KImhd&L4-*yin zC}T=eL)WH|W&aP=;u&Car6dZW`q@F;JHe*BK$QZH#n<*=w$Bl$qNup( z-|X-q8!pwEUvtWtX7g@_u;Axv3_~H#%G19?O+m6n@(tPIn%)nKbXtFUWM328UI`sY4E3ax zPI{S=qXvh5c;G+N(g~vE*O~Gy)Mw<qvA8t31bTZE>wyQlC=)$1I@9GvnQ^6lA|JrJXH9%cF(Pdd~xRVXGxhm1c zX$ujKxlO zVDX@|Eb~_&Ay~-VCYJs}ZeCXhjLu z8ZKQwK1aaoCtl?`a&3ca7bTzYTy}b$r$@eb+i>j_UXVy#H=b{$$ z>wvcSZrLC9>$2+}{!n^fTyISWH+B}S^zP$=kvtz0O)OEBP8hTNT143#aGD2fwl8*k z5q_?4d$tUPu=g@EGZE*+S!&P1ggs4nT`ZJBR(!`Re_t+$s;bY0TMdY*-HwLD#Dphn z=!TgH{3G=+Otjq?N@gothQoq`4e_r~kwVt*6|%Je=xIim#VTm<2q4}by10|z5$6Vt zjV!ua)C9Wd)G-sHDIMHu{TPMOdyh?^&iO$yTj)zGb(7}X0ooQ2xBmP5D@oZT&Rf>j zxR`?&N}pR_`PYMT<(qB*hY>!iw3Ceobq+)l)=IuAQ*(6##NjsY2O^Od?vIp2We6!g zA*&X%<%m{B!?`!lBXvnz+r1UoLnINzJakHk+U#X29XHMT=|{qUXbIzBh$6GF{xx3x z*lg$fh#Us%B6U2A6-SPW`5dL3cz?`M$KbJNjzxQA66TmD9bq{aJODF z;O2sBlr|k~xb~%6?Ov7wr{uKXotG%cM+#RGxoMJ)Ps>_b%TTjMK~brJ>ZY8l zt~%{Nm64@8lxn|PNb?-$YNyHuK0w`x%&3C5(fGMLlTNjGTIP4|V!VTfh8i(?MV>p= zNU`~rkWlaEwAPVArczKVG0ngvV#vqB3B-^MqzuZN2WdDme(b(f6(I ztXcJ@i!lbJ5PwUn_&)?Q4VW=K8+ZbD z9v5qH*O*VZ5g9B`bO&h3@vwH!iyGnj!QFfceG@6l)jyjaBvNE=U`46@m;v!JPY!`U zV&}Jb>S0p=Yge|BmlO3Hf3hm*dxcgaOoo!o>bNC+2%~xVD_ztwQCmheXNMpWssE#A zox>;gH+Wb+v;p;66DGfH#XozY0os~D8s&<*U1YT6D;;o%pDZFifYw9-!Q-1z+UkRSQ+ zj}mhz&?17B1$4(qyQ6vG`doSa%~?#tmnux@uy2y`77$nIwVs9iIW>1&j)+Qy~o#*CtP8XRMlydr=5 z(yTUR)t12v=}S<~7aP#MT@?03`~%%AOqkzK3oh*h(%` z=QjlDY ztpkCtMz;=9v;B$-Vlf_9m6%Qn{LBxD?lyE_Q@7S(W9hRbr1E?K$^$^~xH^)v874b? zb#>~8_JC?s)m%trN7rnTDC{Q1ET+^z%aWA-;QM=D_}jdVOxs8Hy09>RcfOo1C6J+c z$yDl~o$c5DcgJB4dV1;1xdY_9(R|w9gZIBE#h9fF1LKvH-e$!)lI(m57p*QtZzD*Y zk%nK|^g0Q;#auPwGwHK_J^$cHLI1-=^~A-z&ESK--WD8#z(`r;nuE2gZF-j-q~o@a zejkg0PxY?sTYnSXjMnI@vsZ*HtYw}hHu z&6+P@S6c#{z_>Gb%dtmewm&hB{bW-wl2d5SV{cl4c~lVMs9mn;ZX)an<$MWTENhOs zy^(*Vt#*+EIzKASTxaqfSp~+%wgbHXM}ULfGp}S@Iv5OWpf|o><^jeF(5!PP_pAlz zt3ZXZup{GHFcUU_F{avYQ4zBm>Niw!(xSR4RW=#)YrX{#+}`yeyB-Y(j!>w=l*w3` zy+42%`3|R@&hydYIaS7g>xSxaxSPso$A=o|Si;$ZB{x?G=t zOz}^^3;q4Wjd_k==Hhw<&eG`d4Wpjjgv}C#A`P+!7tkb7WMX&(L>B&O_(QG3MF8ht zmgmkwAxcAUT+kyK{Iout&nXs&O$bl-l9tDg4~@d2l+-a75AzTkMS#mD$U9p7yGDXe z92uNnw6%+ULX$iM=3XOewiNzh)5^*MCNxx&dHvBAGMf}Nd<}&we&0FvoPw!{|1YLu zT`i?$%s!HZdBTcCgbtWpiBv1rFI`E$gHO8RH9s!72D^cqHWz5Th(~F{P%QhyEs+7| zY+6y1?k_7IFpUmgNuvtKaM)toZJ~RL{2sLU0nGd>bEw#&GWmpj$+Hb*vw&VR|1_nm z7s!NwsX2|9JCC4&;%bh_h}9#-g(RjzX8efM^i3(Es3-M964~ z45|1VqX{6~Y_l#;g7w!blwcd3Q)It+;r}mzBw;v2%K(#qLNDKWNm@S=QI&V>P)p;# zFc6SZHTR_%5Er7j@MykKhEmkn)Oibpk^n!6I066fpGJQ)>Svm2iMXhVlTH)yT~2mB z075bVGj~s|0y9&s_}>Qsw6pUIKL|pyS;ji~mPn1JIfo831WXU26__S5#U1 z9esBtdFg6xJmpB}4H4mC>A`j7e#-$|@o5AYqXH=qU%%Eop^Y{;00LSQTYwRhNh9i6 zFGxzgd7mPrRl5CLB@ar$y6(H41~ApWdXZC>!CGVsOEL!sz~5(DoF|dk@LV$Y*WBTC z^D?I?Z&finsdjF&fi#mQxW)+12Q(dh+M7(hfN)jNy8O)_p6~Z5NlbJXKtB&4BJyAp zyMbTOe)Q5nnOXZWF4jPJdK_JPdfZL{wWh{A;XbVIbcUqsC%TA$hyw)5JkgEuen_Cg3`-7}IZQ+xk*NNZ z1ac+g46!!LNkuFpadLZS4+y}>suO70zwK+x;%Y82zjqTr=$RTpW~HY zpe4 zp%*Cf`)l{15!r)hMwl&lUYHO*GgZu_Y;@E-E0a9)7AL`Kt?&%+`cQ*3Z&J5)up^EU z37AQ~7kb{IjyS6}v65nLvezd=avDw+kDvbwBmvfKo=d$gzzHrmh?QrzKTeMels1hs zVrG`dadCosvJf)^-(?ZSYLouPT=y1{pAmPgw05tZPniAXfm~iFhAEOHyi`p@@j)XV z?GlSv`y{`AdYu9jAYygT@$mNpkMFh*&m7952HAxtz+DCeyN#-TEmm#K5C|ZocQ_S$ zJeNb_3T!{0)H2t%|5iHs7#v);G(Xs38kiY7F6&((kHs^Jk}VS@1|z7UUVpEcXy3{d z#i`a^Y6EsM*WBIG{o~-ym*PGd`k4I~sVlx41$3{GNa`kD3~K$COK$_?$Lzfj$^HOk zbkEvDO7jmTW_-y(;I>Ls4r0K-gX+z2G>hRh(4zh3yC1M$GYG^Ko=pil-IcF&oZ5X5 z(tY#E+Pr@pTsOuxZP8pCT3|z!?o#~@$ov8H0S;E$X-T}bR(9O?p2D)4-3>Syrzz+$ zX&8O-GpS3q3RuxB0>9&Dm_4k`li!EoYjbuk4LpBR4L`|^`)orw(JmTDa@a2NPyL+v zfZ)@AWvIi;{=`**DEwrb05>73&_&cUwX`{txSJkJL6iervJ<{ie^<9~`CMI`-^;Mo zPd-p^yTeD+XIXgG(+PVH*n7CcqE}vs08YH!X-NrDsQCcn+NV!;hn@!FA3J-303>7= z0RCMzia{31?-aGDKfQfb3(k|LyI0`R?1y@ptpMv`gcdufvSD^UwAHc^pN5|;8-dnH zVr7I(ucx8}%i!&}*$xcgs~@%)WYL8?Q$BoFh><^PtBolr^H1@wtLUwh*(rYsZ=l}1ooA(H#y6x@%O-63YZ{$Z`i1>L5k(u zxWZv`uN?w*HU8@ImrHE1Y2zoS`(Odh-?Z%Ja+amn^yHoMou`Pur5-U20d%VL&k?kw zko~;2-9O8V5ORH?>b&1U&LJ{(^naX&ILes>-B3xfh6AGfK0eyU$&RIdfuv+ox>;FC z8uVhIo5f@<1Kef6@~JN?p09D>Jm)J*@H+!W&&PfY3J{XnN?tB+j4Wg`5P4HI89yPD&eT>bWhWU{kyeQ&=F~>j)r7z zun#h^J`>XUJ~&}#EAx*yuy-M~2OcQ~@)}X2t7X{qXKAHquD!I1FL`E^pf;+uq~P8o z)|-x^-q<=^5srt%ze-6t(arP zs=zkg#N%e+hFlMq4xU->scXiU!y|xdY_#2|@IskHL_lHliMr+Ra7yiw;e_8RtuE)c zdl|Ov6BGc!`_=MhQcF!s9T>ApEebj@&bH*}j^rJ!*k$+tjL(Ii3eEE_GiS&lin6^N zO7->@Y47PVj{1Qkd}YZ~-V$G6#w~MmVE*sU4~6EO+P=(Sd1vp${TYjkE~Veys|Pc- z>$MiRH(HybqXh&D+F3-<%YBU&Wzd4eN906{8WodF zB05F&+y`^BOW=U!V#US?uzz`=5!qgq>)q_mSXofU7PUBMw^Q5Py|kp$^^#pUjJc{P`Tb@`=^e80ulZ`UR47`n$Sw9Jndz9sj*z@%avuedN`Z8 z;l!t-B|ZGuSof@jkVMy+H{a3C(jNtc`V9(uGzdgLwy&h(?a^kIs+0?LO3Sk_trTltH0>?C^V&wDjU-G+(2u`t^yzX$^^B%>~Qj+sIE8Re2rUW zdfTZQMc?r>#yaf1BY&JgqMgWI-McX!$`mWz4(o3b@7t=D-GWq>dXr_E!Qn$!s|r|3 zj0tteF!obWuj5g+#S0lh1pckiZedR0E4D8kAw*hlEqADuR1R2WY6mBJ;4)=a#g*N3 z25uV1w-#P&6J`x&PGu)2-vs)0oydNpw{x}Sw~zK5t5i{7B%>K5y#^a%>;nfyFJ>{u zj|ey2$``) z!@>AsgO)ihjkd_goAeTjublZYyR6O`wQ)cN1`~ul_dECp$

T`da6@B!=`Qw`9nG zMy7;;rN-ga0U#O*z>w@9evx!~is*Q-nJb6nEk{FDpTs%widw_ryGUPM$zD0PATv<= z$2Qz*cF?C@O&_N`s3_E6t4r*~y!@BqeFJdmc8eGD8`iZD!%iM4^at}HpTlD;$RI_k z-~`sd$C7)7r(C-IM=Hs@Y-FtD3M4a3EypT!q)9Ck?}B;07=_%=n+a_#br+A4EVp*8 zRfyWg>%9}9(y>eFP1kw0E0-E{&++conD1DR3cZQD6yccth3Y+&$ z?_W#LiCnM)fyw2O8P}F{aZ%v(%>}phS=>>CAi*XsUgRuh%x5wU15zBcbPdQn>ZEFY z;h&!b@sqXz%mxe?OtDaeLox)Hunfn$8I`S1lX?r=4i2bC(8nDikAt5BMAIMj0*T5( zviG)=@wymim0!_#n|O(Wp{hi+eEP(3}=EB*-K9aGl=WvlfUJT9bLj*j8iIrv&w z)7mT`8fFha7@f)s65)Z`YJQu#j%rNE-MNa;vT7fQrAN1_{>^ayGC;$_ivf!^3Ej}~ zeiQ>v*l1@j?oHhDeElZ9)BZ-ZH|ALjUmOE3tggT(TPpE^r8GRl7H>s9(ndJkJ=p&u zwB?XJ&59j@ZuEIA5%yc15>xQP`9<6`>|D$j&inu|(jAF0qx!eJ9yhoajNOae;%YK9 z8dw<`KSm^(tbD2?taCun!_r>s^mLH=H0TkgFtZK618Y+_gZbSdM-CH#X(*TGt5Jad zWSjr#Vai5jhH7PG!z#v>!U0Q%ftJp1E*D zVbIAtig_P7J(SBt=%j(%v!HhL%wr#$X`9JQ-?SHnOlKM4_w?N?me2HocCnPlgv9+~3ycL~o`^t#*wX(&{*X3pm6uKIi=^sZba9(29jgWPq~?sc9# z__xrtTu>v8wua9nlWOwIw_gG=^<>79HyK|g{mJtsfl+vziqe)LEs@;2Js*p3zANNP>Cs)B2kA0p9 z|0*6p79uSR1fXQq)vSD;U=RM^JFsv`v~`{bo(&V~erpnyMD`u+Y{Fv-6!_`DIgc;E ztVcz>lBNGgL30Wl5RPaKfa#rK5FkLIsP|&`_8PW+VyH$A;5*0@pm+Bi(7NoWCNm$? z%R1{~iO@ru?mk;?JE6=-YIfsmA69>ffq7+>9eChPAeA4_q$ zNu2ZUwzfKaa{p=_zDdNRINI9f>XQj_?I^i=TUH1;xyvAmM#2EMv^J93c}--?#3XRk z`04TV1J&jp1dz54#T_fi`+Sl%tKi9bD#gf}nkTZ0IjgAYerYQgm%R4Xo))smIyN)K zFJR`6y~3|@q`b)L)UkBd&HI9}-wg?(E!TfXcj12b@WoQgjZpaQzD!{UdU17bd5-vF zF_Y%BMA2UrN8pRqJg@rw477RXlHH=d&mek2Dj`(MPS0fY<${|;>^OGDfV;rVRsV5` z!LD==Ls*!m#7A3OG1i|wtxjki5a3WGgq;_t(WDu*(v|9bt?UU__-y0cmVI-%1)LGI zjolyHY6KdMpMI6JiFOAH&!{gVlbKaF#(is9?8>0srFskvSHsu{OuiK(t?QaXKUJGu zMjHG|_#Bb#`6%FTOnS>3D0;xhUssZ!>?L%MUnT+&5){of|GA+*^{q`ULm)gqQb)+D z=T-7aGuDqNx{OBH9sEn(XS~+Q;pUP_tx=Xm<#@SY##0zjh<~Pw8W%1by zoj=QKSnXtC)c1ZdM4I9KV;B;}7xCayvk{+4Ad$Yb)Ei% zU1yOc++5_trm1GLLtR14XaY=YJY8}YqdKo0or;iKNC1RE{tn-XuC)3_6llSRq78uG zHvv!D0hJ<^<{NlPN>ouRGr~f)xkvs*1&D079dK z7-UpR4SP&xVsq37Pw50fGt$sit0%G1)!{_tr~WA4lBibNR=!1l@5{oJj(ZVz3ch1z zA{{im1xvBh#51TZj!OEFJNUJKk8&SYm`s{?IzSTdnFFfMei}w@k150=K_^%XgZCWC zeL&x>Avo#ur~DVGU5{`krsMN=x~y2&|H67l7eZW|612216(x>$T+Mgq-w#N+E`**D z|CjWeMO$_Yet(K0Le4yPtnp*wgA&)$Og{9#Mjo-pQJ*!pbh5CdFkqr%bA3zlm0~j1 zR@rLjUsG_DEd(9THwP0d$7_nBkyxd9O%IJC6Q+ek9cW#xD6V_`FOL|F<;>A(KJSAd zMJ9#sa$Ld0notIsa5+gJZU4XCV#0|x3m$@EZe3P_JP5KHrJS4pC<-d`;>&R+{qF|< zUFyG2`hWkAgxDA;+@P8J=>Hw#E%5(~@s?GV({)!=mQ%O%pyE`vv32uy^!`Z2DeGYA zsp;u%?L{RfM#X8*Ma9eaUxGL1|6%Vfpz7R`v|-#exE}}-+}+)SyB^%#3GVI$_W%hR zoIoIW2pS0P4uRkn^gkr`&TuE)J-27Ap6UPVhQ;EX_q?)C?b@}gp8Zs9b5;%x0PDj> z;L4yaw*idecEFD2~lTtr0dJ%02o2OEHuiw!`}2HM&EVOMw1XJV$##!i+FF7{3U zHqgfp3i9K)JkZ6-^5H55CMITXc2;JV2kl`3(EpeBpxej+e|sD=6Z@l`;2&DX3TmLe znw=#`+e`th4;l=*{m&*pJRHENVQJ!G@t}4O?RvQX|4Y9Q-%0Obi+j*uwl}guVBrLP zy@wYMqw`M>;fISrQZr{^WdTX)_cxr}09NiFZ~g_x^Mfe`e}63kVEbwK{{=0{UmHXJ%*R0;`HwMvAg%c0jX6dBCx(QLo8zw=lAlWV zF!}$FJdFRwj{Nj+|KIg6{yq!!U_XA^vxhGEgD3LfI{e+1|Gsxgq6|&7bjOxY@!14_?>`u&JMtb7!wqw{`CKUp7=23D4ROlyE;8Y zpAUYqxQC0RiVNtDKi)~Q0$5ntek$IN*ybT>csNZ0)CyL%|MY+#!d?|q7f>X@s3;}@ zdWfk9D7=ui1)7_R{Pth;xBt>VzUCu|OV~Tv{@yH21tTj{W6-5?rgr8o764{;?gtOv z*~Q5eXp7*Hl`gwzK}y*L}!*WcI#m%5^HPudpQ zN3l({*xA)0jw^yB-^J7ArVACJHFc88W2X1Kl+s|K2}awK2uc_ZAGA>yI$eq~Lf(V0 zEr6`|ktfkqEvGu}oRy`LW+$?F+yfi@NAi>qS~ZofUo`Gz68CcRpi{dd0nin*`xASH(t$PHek zRC{2ryeOE&CE^(#G1*O4K7KyqAmCsfjRRGVwv3(!=1{FBh6N7ZBQTE)7ESNE?*#=Q zi5FE20gwc014%3t6)Op%XbH)}FzAL64%Duq3hSjR#WPEviA9Oj^$Z*$q9ikv`>(@` zACHJ&x+ooTIf@_YQ#+wlVUwWTu;!te6LQd(A@?)J86$YK%)`GQ>E*O#YZ=5t^UZTT zt|Vp;B))N?>W+RD8!jv?1A$wq%$dG#Sxc~up_n*g{i}LC_>+G@z1W!9{*|0T&NZ?phs5gw~YMSA=B za5%CdlW$osH?2jt(YttQGI+|K>5ig7>=yPrP7*4sDU=ebdXmQ7yR*v-{q1WvUOVh+ zqEKKPuBCpdo;Z2(Q_${Q=x~y-=*fs@g91p;%$+E=vVs~7lOeq}nP?z*#jB;!Z)7l9 zVWx`5R?d(<6V_^bG)%1ZUL1U~#yM@C&Ch8lli&ZcP9y3JHKf#@n74819b}rXplv64 z1#|XcaN^gle+VCb@A|(u6Z~dCSvXn$D4lOQ3vu%e=zdG>fpNA04(3uQg8o4PE${UT zQBe{v{Vyk)W<#T9Er*|f7HrQGQzmRyq zb9w8=AOepi{F}aqH7QQrHYEyE3%wd|>gBVG2jhF?Sa#(|kL3ZjHO>{n_Z$ICG~MrO z?|USC5jf9x^5Zcs65uc|dl#7FGKKu(XX+T@Fg%3d(&ZOoNbKE|#fPHrmm=zjTD`ma zmFsJQWm3U|m5Y-$T#cT9Qt!b$Ri>s+)grJ_ioI@$KT7tzT}pJnjrweUSph^?)E z6NtnEb)ZTQq)LGR8|*?!T&5SFE#3?vS8p}(F=Va0cBHl4vX*OkY7gSGMaaaji#RmZ zkRqFYmYNSWC2qbYVZp*e53OSvR#cG6U}9yeDulD)KtmPxcGTVVy1NUe6fIrgRLn_K zGAk-e<}5ALPo7hu2O5-f0oOdb0`#kba=wsl#~lv&FG^`h4^fdwCfdLW`(SwxL7GD> zs4b7Wa>#*!>A3|*V6h}%88~xk*O;CkPgjP^SP{xb^}L}Sn_UgSop}2$Z7G5FSMVY zp?#Q#D3&avN=U}FrV(yD%K{CdQ=rAMkLv_q?wBd|d7r&wOhyzxdZaeV(R-&JRs*bO z54MUjgMCa$XtXENrA$k8j26NmaYr^cJg70RGZJZq#@+xu@GNG_Wegg!$e~8zP)M;; z?wRU`K;-fFvH7dZXym_$@{3A|-GZ4x0%XA)Yn zRgM#;BS4Siy-_>6a(lVv2d_~91r18eVGHEg)K|)QMGQH0EK+f`OeKjK<;DAMK>@Ev z`$&gja7oK$eHWl)YJ#^vU^|;+VHq=(s~|))HGnmgd*%pk5W?e_S&*fqF1WsS0G`P1 z<;v1=WePB^I`hh0C^BzQ!U6YBo$VV3JgLowOiMV7C_efV)0u?5?>Vsfob{G=u?a<) z7*zK$VZ;#o{X3bQJ}=nk@~otX;3??XfACIZY$%xw! zpJUR$*mRf#aY{G#eV{us_NUMMdUY_Mjl@FORarZYT)``9?NyS7UZXg>lplv|in%X^ z_Y%c75`MSvva6hMc=qy|c|Ab?vm+_W=fannU8>vwye#Niw;TbZVk0D>G-O?~kMp>= z>J}W7He+!Kvro`c$EQQbx0km$vL*7XmCaW>hIJ5xomT|qqe7Sa1K^_kD&%@lG|G(8 zc2)(O*8Rf0%t>1KD!5bWrz9}VDvXMvz9UZ*lUSU?*b0y#b!NorZt3BxvE{u-vmFUR zO2fP3&|5-spNvb&NljDsj@%tbvWNj!EmmcjhZ1?eGxsFJiQU!lg&4@;63pezwTWy9 zsx4P48iEq1^kC`&3YNU&@o?yACSUqg!sAfi5Sdc>qzcr)-<$#Dir-XjGWvSXy zYH2-(HZ?Y*DMju03FkHptgAvxcshuetkcSoixL?^5_z+F5j%{rDp7uNVju-3 zvf)EA;9F6|E0c{>^OuqN4JX;Cy5FBLK`rU7o{3j1mz-I&wQ`nH>HYE}GV;7r;fh60lDILa^($;uUDaXn99og0(S4S@fiJ`#_l-5DZpO{D^{Mu_^A8oZwQW(oMyVJw^$F` zC~MnOuVr9zg;ZTUOFSMx(8&FQ=pzn()1r9kK}tN$xtC1L@cFVm>@GC# zOhRP3KGqgLT*X@q{bS+2%$eYPhLlB~KAy;bT)A*^|Ym5nV*yqK*;>E&PMu;rzS#m>` zp6#p!PoLZGt!6C}J38vyuk0~uYQ1GL=KPpwls_1Fzn6WY-r*Bau2#KQ0|Qghob_=~ zJMi0DuCr_oMY$Gu_jZaD{S0^%mwIHmTx?uu?g@_H3;Ch)4j)HUH!bDd4#owLv050Y zC_VQfGj#-?K;XDM7qb8#cR5oFT<4uAmxga@(H^6#w8Sh(SV<$ucS1%b4WVFNuS*~A_I+`KaagCTt@c2BK}UqT3S^9l2QBF%{O(7&lm|k4b`x`L7i*s}E%} zQhL6h=}lfMqo6muB3ACEyn3SgZW3w$X0jA(;aDLBb+J>&)LIi;+pSJ}RORjo@v(5Y zx1cgF4r~+`*oVt<&JP`5@Pi5+L6}5Q3=FKCH-5H8hr-m``Ar{;cx_EMH=>hkLo#Wc zS$07dtJNfPUu}_I)r`gWU9)rY#1bS+WMA1^8O4);3y3*qTXoKE>YE$9XW-Agb^33$ z&gU`-w4>@a>$?l;MV!Y5x@SMK&@T4zH*6x_5sxxOOSQy zWr7R35C~yd_CxBdIw>08DZW^8t9DE@!$O4AKzpYB3#dY9V=NWT`)wV^X@YvpIL(20Bai4Nox9$zB3zNYw& zMTThKbk>mNfLGQjnxvu^Pt3172vuNc%|+M?R)m^yzVTdRl|oclc-hZ4k0`4CwFbhA zhC_jivH6ggQF|%s;-q&r2Jw=A$FXjbzw&^OFYDkGR{S^>@>iihrjh*3xDB*g{Ra(J zl(+6;LVCZeu{}*3IUb7)L#n8YAg~wYc?%v}VG=6N5$pW1o#b2umRIVq=wj6SiLxH% zb@VDfbQ$&9@(e{rS0Wuyq0pQwXVf#3Q?(^q4vKU_yvn&)`Uox07QF{H#&_7VXJIBJ z=Nzz@Sh()ly&(UUAMSnkr96gXFU&g>B4ogNR78~-8K#<>Vl3BnE3uvOJ+r_RXn)De z%iUfWNoTgy#Fd0R+YFSs-Fir)3;Raus}A3EsBh!WK!J~apB9S6)e;xJO;b>;>aJ-Z zZZw&{^LrMmsrt$n3^v^E*{`B{yj=e`MfLB&{@)Mw$7`2=Q<$9pb+Ah(LXpCWUt|R$ zYIcx+_1xPo6`#CqBnr1QZ9x|ZIxMG?lG3arnB2Hw(o|T1v;tvUq}#G;6N+P_XgVWM z>l^6LOYzj`zSb3bHlxy68DB)0PdIk6(gY(%DbGpsRe#*(60QRR*;|Ed$}`Zqm2}%$Saj;$|dsz z+8#hR1|#;quP~QJ)24rdCfJ`w zh1=L8zMo(MWrYuPYsN7zxVgH7=wu;$b@h%aT$(0P>da5z!iKBeyL|=c4yIYrY^oxiIM0OCa*cK4Un~|sySS!G6P9ytpb{^plXNOQ1PvuL`(8Gc zuD?Fg8z<;ytn4cCg@OKe8Ur&khT=p%)X${-5=qxqiRC!o-|Y5zWcsTEE_z_soryeM zEenDbldf5?Fpp@8ox__|sba2c1W0lRSYzv~GwG+{_GxJLZIjlaWTY`n-hT@Al$A>K zN#aXrAT&}4A@oEzm`k`m+H}5cmPj!{_}o7*iA)e@i+a_=gM%L8#%$0w;_L*Br;=`?*|G+3y#=5@K;T>6Gw96g5jsi@0mX@nDr^7m}%tLE(9 zkpf(=Z1*z!2D9$_uGBrp*^38bIk2VHN;n-oVfy&6$<$q(OakYp>TRJAY>d5*P-g8$ z)0UESLgLd#)*@bU)bL?CP?e0*L|I%qW#^oPO~J~&I%-G;O3Cx)yfZrGUY2N>ntnzoV&pAgnQ ziFIUfFlo%CG1l1_M!nD%C=Eds^i7gJa|XG*v`syYYUd#ro5J>2U=FEF1HY=npM}NQ zIGO%1h-_7)W7mJ!<0~NqY-;<1e#6nQ)B7q&&nWNF5HRt90x^1yvL_UuOf!1Q5lH>m zE?;N1K{Ah?;OBP1y>Plm4x+p-VQZ$tZiXc4MwQOk0%ivLmQuPO-YA4C_lcuNZVm%f zGyI)kCRM^dt^8zi zoHy3}rfG5vY|lGmXA7euB_`gk{^K z5xbM0^L=8~dO>-@W#X_4IOPH3eLY$mBarR1D3DX|e#RR~z{DVn*~BV4NxNaIj{Eqn z8`o0}EF6)v=X6VgN0lEc;%^}vL&0t4+6vRB*b ztxnV4x#MF{YYoLmGzd_e`C7cTYHwa;S(G!sAfx&+MykKfFFqUSCg31^TF>tH=2?SG zSc$fHl6b!+6ps1=)9q5Xu?! zAiE6Lhdca@UtN>>*Y;hUcm!9Gq=ee@e)q}oL#??c&Y>N6iQX;(EbfG{bwMRnm8`vC zWTYZeoaYVsK9Jq*@U`(f9Tl7{6rj~=>XY8V7i`c*eU7O;vj;)DxS&1gkFf-b6BZNe z_Wi9F({c08FMWx>Ak(&}U48NCy+uA%8?%9+*|6!5A5Ef=?0da7V<#hL(diW$-eR*? zW=>bl!=|qf!2^qK@uJT`rl&RU^ZXXm*0b5*k=lwEuSw^iNf<@od?jAa+VUZ)F zpM{n<&O=n9bOwM2I6zeNK~}$?^bh*-&L3rlA~j-(HLGtMYKL$DnWFG2IVdGV&Ah5m zZ@YhNL)D_lF_V%_`@87ZvG`(px7MJiT!;to(;8~#=M-8XgXOJQDBRNU-h?ceq~kO41vmGIa=^|rV`r2<|wb6=58y|^6_%1AxX z!)7LuE<1foW%>3ctBTO+xHxma(r6(i45$DcgKia~{dI%fJao=e1e?YWk^UTccnkht z@G?SjopUE~Xr6sNfucVaLU`gflC6?9VCfz4nv_kX$}XBgp(6|U!v6jDiMhr+BTjq| z<<9-_8BQ{`peSg!Lh-}E=7e{a?oVJ*z4M3k<}vY&Uxy~;at?2bPHCM75W;t?>|%PP z${j0#x4SAw#onDt#nO6yjfM}s5m^_q2!7LHaI1i` zPYR!Tr@dEefrs__3V!W{DO|bJ$_1SIAX;?pY5WjHph})WAdtuA;&Evw;#PNnx|t>aE8;(D(98mY{vnf zsmrapUA-t@yG`-VYt?t!@lkJcw@$uzcAYI?-mBOx6p}2TSm;JtwNES=^tIvjS!2*& zO&bN=(CmZ<}3Q+a%&Z=lzs6wA>4!Rby(3A?D;A@2g1j(Yn^$ zqFXS(+iB5)}O^_SU`NzKRAVo10bgmt#z07JdH4L4>J)vI8Pn_Fdy~nCZvhw zH-xV#@f$(+ZBp>mr_}>=ysU!^8sA=1y!7`Iv*(dx;;KP6Zx;(1UE2)@`F>TdeL{O4cXZ?c*Y)cguRuAEFu4tMM>>R_jfwH#M?&iCYq~` z7rP(3^HTx(D6UV_xrl4uc&XxXLJP9@to07teP8vKtL+X?{-h&QNB9YSQ4r_F$2Yp| zi7d|Kzl!cL(jp3UkTSJ2w{QV5BOl1?AkLJzGl1=9u7w29*3!lk@a#uQgs?k^4rOZ! z-~fn#SW_m>)IZO84g?)z6c>K@p?x^Tb zpMDqUyFPenKX_Sx#$Efj@B81Qp+5+fe@2+hOdtl{514yEv5;r4De1^jJd z_~*ifyV5taS`EUvHR74Rb9bkUye{SMrln0bi_fRO?8|QNUT1Y*PKk@s@i;ni1dpy* zth$k)59vyJ)hQ%W=v-oIz3Z`0sE-|bS*-p(!)v(S%t^A9ifJmXj!Z^}7+Xxsff+6T znRM>yvk|ER4LbJ*Ce6OyNuMqgTi7u#Agh;&7Jv>>Jll+t z$b3rG=ZaTL4cEo1hWqr!bzRN2DEb&TiKSJu%T}Bi+4Bu)mz?^X>zsA`7vK(npcHrO zB*y?Q5t|3?vlzp+6;68(Uk2W3V^UNm21{rJxJau4&-1*g&dY{rAqyhwsHK7+*4Rnu zYxd891fWVzVNIUsN@%uTLbFI|j^2z!wUm~+`<@Co+}?H8sit-GzERH?3x;2!gbmAR z@8V~UE)`gFD?D$j&z&>3jIfPKbwbvUnn$RztrjUK7Apxer^<#Qop`}bI6^-OH^{E2 z&^Y#0R}764)?c&OW8f&o#<;-wEcrYNtvo&9Q z+^{s)l{c!ZK`rG!y_GJ@aK7ZidD0LK36FH|8yV-+r^#S$-d>w`eZIZ(3ys);IF`$*&TpKkY>11nUAXB3 zs@0@IUW6JOn>Ae%h4ansMhvJPWqMrQxeiYTGTH@~L2b2ci;IfwXIm1ZFBYpVYA$S>sfehlUollUm} z@Cvmx=4!E90X|tE~lNs@%)g}>6P!RZcyRGltUMThvjNW#K)g`HcaYguop^y3h0nxwUDTp(vT+&da<>QWQGgr*-KHmhX#`c z5#fv|(9~KuyI_+P|Gq85wx7!yzfciD$afhtb&!CNK>)=A^EigzDGwgyVv#U}&01!O z>#3=Q*i=BD(#N}=Vh!G>A8B|k)6f0FGfINy5>^nt@bel@ z5K;O^tADcfe>fRG7}OxvA}hyl89@>t#wIJrZz(|%prs#Hj{hWGD*|0WL~pwvylX{f zX3%Fp@BKi?{yTZsjKA}%A6fun5P<~qvzeNlECBZ38l%a{3Sj@OEt;Hc0QUb#PkMMF z$hmPfcKInokmNxw3(&~d)%AED7c6hQS{tIIw9M;(aGDbxywY*7r_wl~d}MLN=0rLNEk|y$F|+tl z_re&)ekZmL{nrzx*F9cWL^Sf6I*qh=pXaK1FnZN7BZg#Q7(c6M6E?=mYrQ(#zrra< zgGvaoS7oB5ymo&YeO`r>S$1(t;rBj*da<`#yh?jLI)p5jP;a3si40+N13|qDSLNNi z8G9}Q+O2jBc`OXi*+Z{-yZ1#h&g5c)JqJ_QRJB-Gr-|YVD^5spz-GKo)Jx&aj$cj1 zUtvf8t0z#%B6JF&L5=$47BIx8@8hwOz-g@;JD>|^6Nn+fDSh$qBW0jKbQkB3^omzA za(YOh(0VCp68h9QO$s^z3@htIk+i1cM*@YkJN8=C>76g{(8vW-;WHP51AHkVEp>T$ zHL~}va8fvl8>|@N9swsPmIZ-YMiDL)Wk%7=OSnv9c+jkKSZF5~omIkZLYdn_wg%&{ z+RFTVzxLr{JomBn_;&)u|4sr0`Tr{k6oy?Rw!f;^V?g+kdi^_r;=d$Nuz?aNM6ofX z#yB0qJC=jF&To+$+$Ey)O{i2c6)5rzoFr_(f*h-Ow#xG`q81Y5o=7uM_kvTJHh3(p zHha#hw7X8Q^79K7rGH9#&GM++P*65;ixOh3v{d~NO3_38bm!ZvAjXatV>+!u+ z8AqjfkgQbnLfO~{eEw?@b>L>P3)S#Lhnont+TouA$N)g)?L;ZKyiI+V|&tKSVxY33;maMZuf_E#hy#}-qL=t3hfB7~6 z{5Do@e0F;|%(2$u^Xm0^{mN2IQgV>HJ^4Z27_Z?v5mMyGhQ+tC&khr~Lp%93Yw=LR zCVTVH(`P8gk=@3IC&%EY_Q|Lv`v?n(?2BmYTozYcPoHjx9$4T&%ubLBUWzV$4%Z}t z1B*vceW@U`8$7IZ`_Vx&pqCV+XFZZicIbZ{y1k=9?W` z+kS^WGs|-wTi{D}FfZJQU!ZFrZbUDRO470NTdCB_*~eCaGTutVW=_cX=tBZa$OT~D z&bgI50SA+Vapa2j?30!k%|ae2x6GE5ZWzHIAN5E(dD1~dKF3Y5lM$zs#y!!&Ji)7V z`Q^j60nZOF^##Fq_g72fG`~sW7fSEKzUc?*BBf`%P9&;&W+Ac(25gN&ZqbzKfF^Nf zou7N_mhLNR?lameDMVLoQXfQmy@$jb!Z zAp#10hHrz~zV?It+eL!Jsy^kYe9SV-a`w9)B~2;c-<@oHo0-{M-Mp)M>9=Qa>s;05 zc{|tm^+tC>1z^F8&{rJdY>QXW;40LqNT`bkR5z0$^(8`$4H{MK?N7o8ToZo7rdWVV zU7D#R@&vS}k_2n?u<^oT4jbXz=FK%BB4u-MS$$ejh|{EtV`;WgVhK;@JEl}YaT}zN zGDE^5v|JM z`8{-Mh)1E?+~$uQYuyYP?~LBj8&{v{-=12SUi^AR5@ET1(*wrVYz;jy23eaBK5q@~vmaKHGgUkoKZGgyLhm zoUawM=mR0mIG^T(;yv|X!kCJ;Gd4tDmA|y9lO#heb31YN-%~}QV?yREZJZOO1$TeD zTb91BsU#YWHYggS)u-VE4=%O5mt2XNwD}Ynn{Ie{wc9+b1G1T%C_f2it>b&pFwRVB zD6eF^b*hU{pQXIF1)9^5pdou6GFP};;IlrI7yCG)Q1BJCnggifA}-Kd^WV(Lf~}u+ zYv5`LW{9n=%iN$vam>3}K3hWRR!qvPk%XD;1v;w(a-W3g&E%%e&MSu*XEW34U>lI` zU|B^Pe>=e9uXKzmL5z&iK*{8wYPRGBz9blsJqDlvtU5_T zac6nuQ-dxyLuc?w`FVPwq=^aN2to_8$H$L&rmOy8`mL4|@{_#0`E^fO-I#;`ew~m> zH47y|%L$+IUJxu-<7iEtyS+Fj8-Tfry`nxhx4m{y>!A(Ei*tQymRPSDh31s011R*d zeliNCfCj2c#|55{QDKleg4}h}H&&d^38Ou0@|50Ez<1W9@%-y%`_!|pW18=VE)HlC zRfxjQkh3Se)W@!ioI+E&MpbrTdNsq zucgN#gAr@jG?*oy7ui;cRb#%1&0v|kp}ql*-K4jrm~jVwvsUZSUfE=H;|2c=c{JFTy{XtMmG%wq{52Vb zXr*-vjcucSTgT`XAx*R}dhgXP{3sH?-zVB;rV8AZ926!@h(Xw1>Ekuwj8zr$eFrkvkM*7w+k>g833LP{hE-prI^ zgrGo`QqVTIkO?kfa*InpW;TX<$!9SKo2zyYv6dGj{;PlRhvlQ+fu`T_ntu|Y>Azr0 z|2UwC6Ttpk^$AT-btCql012Ze7ZU)KpZ^2r(&SPs%&_+ADQ`b$fj|D(M?gU=j_r7g7~W!8(xdjS|nm@9@Nm-cenKq zkS~KXjKI(X%)Zgo;Ac>2z?d+DCh-0I#OX1kbDkwtHD=wt^OLR36=PWQfj;L_Ypy}G zIMVbTjVbXt_V>iRO5_~lU-T@oBMlP^W0@@9j*Q1#ig}{Y60>LYOaoVKsF}rTPt}MA zQdtWSxKtI!LS*J*~!uE;l<1e0WB4I!VQVA*a!ZWf}h_yK@ z3lRzO+n}bds^S*1HmK-E`Ppqxb9f}JyB$hc+~J18F@!`xY;^RvJq7Ruh1h(qKRG73 zu{Z)T!lLaF6%R@NEIzS8{yR_KckNkA=Q!oNR#W=!rPFMgl_5i56KbC~*WP?grRaq$Jh(uMC}wWR)JDzBaU#X$Eg_ibM27N7D^rwv1iu8keS=ML79WXG1~u;5 zGiUKO8f~m{c8cj)WKCshbn-qO;cALWvm6vz^M_4r$D$8(a}Y-o5}pS>4WA9W5g}MJ zvCwWW$P9vP0w~84GAavDNpbj5e(A#>)6`!W<^QhA^1oD-Wvy~|3i2#HgV|yIM(kKz z13t~NHw<;yU zj={O1)ZmUuOR>%aV4yeNy#-b2apLM&EkD$M)y}0IwXR(k5h+slOiZU0seM^!rxQUc zN0I!VPD~gFIu1hv^B{$6>(J_G<%1w3f@3dmyk<83=9sJ4zi}XY^xEddxJ2zh7WfLR zHr2sbrKj5+jP4?XnqR|lF^kCkS7=<5c5*mc0tCQQaz{9SRjNj7Zf+Q_{Azqw*K7^0hKwpG-J$f1p zX06dGt2R)AE>?p@n!KY3*PMyEw#PT*erQMJ+ozS|A~)}LBK`5HqmW8#&Mq%8p{0?& zfX$FuQ!x?lq#H1T00$Q|;b!H&J<+&h>EZP(=R@phCy_ov7;(cAI1cJS1FOKP5XrD^A(vs{6N_Q)#lzi^M%~AvDQKy^t9R;JY*qH%s;LPNM z`M>u3;}xgB=%4;xlm)c({CI+`kCz1{_n`$JT+?pqmcG){Vua)V!cZKROfJASWjH@7 zs%sQ>cW0C?AccXCkb;6=;dV}t91&qDEV{;V?N(o2YazL?wvNL_*G8+;Nj3`8KjrRvhyIPyC|A=U54p)+#ykzr5pPrmDE zWl`Ki&UFQG^KflZMQhu|^)(zQe#x!D`;v&~dXzStzaynaw*~WMYGXY)dZj`loVxJ& zE7uU|qUa}*y|)E``Xk~E>x^6ArY>EYvwQzA>Fq&ppGuh{hsddEO>UNOE{`*8>XLte zA6U#GyF_|4trsk8`AgAX<@k8j=RX$tL95a~B8`8N*z2z?@-s?ug9?9h{$wOPcxiv< zia(R&jR~mW|cn&Wz-%SRd7_$$EPhvq5YZ_MYKJWc&apd ztw~#<`pu}IMdz~Sk}v}=Z^y@Hgl~y~ibQXH{b3?kZP4*{2~a3wLfCk9nw;ojvTMq8 z(mgX~o;p`^CvI{OI3LnF>rl(}WQm{X=^~!c+r{)qt2o7&rc-0GabH*1;c$?;o-y^^ z-#0gjJ7=092rrm&zkhv*l(_)qw-%%8_^Tawyhih93wDDDD?iMHIfyF@^2&dE%>@8e zSN-{#74T?q{vDP0K_!&`&nokSzRO>JIEb(E_Z8Em2N8&vIY46x#6zZMW&;6Q4+NY) z@{QSlR7zL=dHivmSSEI+A3qPq>1QqaKOOOZQ{gYp^wMo~>rB>ST`eiozrVIu#t z7(Fu+$kaSMfteMA^*p@zpZ39HxruBy>n! z{|hYQc*$#$#ig98lc^m9TOE??Yw+OwT{lsCxBf5J%fgsrQ7iN1xXJ!OBJa{tZD4mM zqWkljC?RCX!RwwIqu4L=r5{b->!b)yR99a47p?k^&u+1CZnMY7LkRPTuAB*UJN0Oj zY9uQw*(4hw*)h+@Ba6QZ{n!hw)5Z>+jb%iw8!A6eCMmi8tzbT8my*_NpgUk-!1%jT zT~3@d5KUoF#L0Vr9S*#4RI<{zpm|0QM4HeT4OO9)B)!WlvDLybg6 zg4qWT^f`FFqR~lCDbNPlsqc1fWqTd-YBSqm% zoM#i*J?a%Yhexkwiu2A`g6$K(`z9$o{Wu8@F6@WzPzwC8jyK60Bs>ABTzRfavgLq` zs-rRl-C$7s&TomarOR)_sJXcq!x&*pBt{ANs(5O1BdeQgwUm2}0tGUKDjRnVhMlcx zq_a3(Yl&?X!T9kr`u8VhT=W_Y1T@y54cjXKV3ziQTB z!5vvagz$f2&HBe0oIh472^o=nFgX4z@1N%*nw0lNn*<$^HDJ7x%KtVG$PX3K{#ty& znBE=57Gf8CiE}kdWnm~SCFL=ruFG4gS-5fsm(Sshq*|P{b%K4c#wT2_merQ$b>rd3 zJ+yR<(O_G@O9F%0SE+-_U(TwUIje+pLhAskharKRWGEm)I|lR(Vit|ZBtROAHykyQ z4>(xm>uB1&SKTG3zpHo$L&fjcx=f6?2<1$QE#CR!gL-J979?lH$Cq}#JIra~Mkm%9 zdhbfaL~fR{hf*fCyQvp*@L2g$aQwh@hjn~@QHLL~*I)2k{?%dVe<-&#Exe{YBjb&j z*DhK-1NneCCE5|h7SWg(bge4ISW0;$bMFh|4^rlsgEksMgG-3*FyDVK4sQ6CU-H*J z{3|%&za9+z$4OyAb?AZH+BTvxh)6y&GqbQS0+&`tO-xgI4MYF1m~eF$_?|osRae0a z@tXPMc2I6n%KB{%GC`ZK8Uv`b*ag*_LaBA0(CSqlO5^XqfhCd=NvnoWeePEK`Ub>| zTXDA`a}6`djn?X2dQ(-fUs>6Wmp^`wSdXfDf;~c(rSJvcI4t&r)iPUIW>JeH3w0iU z4H}#l$^%LhjBA>vAkyF8h-4oIOhPuhg&6!J>^hn%>Bq1<^=Vjq%;eqPRfMpQD^O9j zo!%*Ts}@-OYIPCVA)xx;^!lL&4tXv>XmW*TiGJ7xc~OCV5wwvPpC04T`IcI?Qof#q zDj#;8s7?h4mg+w5v6u^822A$1oRy-VF2Cd@HKTJCL&E+e4*d*!#Ozo7dW=Rsc1Hfy ztAop1K{A7IXr7*y4<6(LZZ^0u8U3hwO<7||3^?Z=I&1bPz6HJ&T>Pa=`iuu7*IRcHz-`X)T?iW7 zzVAi_p09jU;+5jam%5(=vM|X?&GFMj36%t;^r&BTFL#u}A`LpSK&gu!&Y*REdJ+iT zSX{I64e2c*W5wZWW}p0hdzqmgQ?gl@=d6~s6MIr7(f~TWeFQGzW;z@z^8V(9wxoXh8QB{81g;$vkul92@3*mHjFn5P@T%A5&pm zRGMw}p8DzpQHG2{IisuaEFzmy|HI@MCilg6Gbu|Jz8j@Hp<6XZUst#cJuhDmzsv82 zY>5PBLkg$|sHI~g?p0qd4=?u}jy{#Tlc4VWB)1YT5&Lqz@V@lKWhX75EPzjW zzqw`n+QrJz+;n>+`1SaBwJfuJfku&0Uw3KIX8(qEk4RN9d@tn!IKR1?$*G`VPa;^F zIkj=Lvev^H{`G8Vs;ixZM1YV%pVXHA@G5Eh%Q_vcJW^4eV-Cj9Zb$mvOM?YMhPJz% zuHBM81LB-WOvl94v)h$blo+zAeLt>c3zE`!X;@=n5PN8gp z7zW~n$v1PE#O_yox+-{`{zeRA^>wH=qq27xXG6os5GaYYZj0yGLK`v(lQb134Ct}k zsF$DSC{~_lc;6myk}xnbRubps*7f@w=ZI+&+y(W11}N`p1z@JR*RNSEwOEkFq<8{v(v1Hbk}C}mZ)esIugLu%V2>=k3T zCUh0vAiWSL1m+XyLJT_X>H-DfO2l*XPYcSCuFcDc!CK|U;H4frx^dZN<55>JVDSr) zGYIe9Q)b};oNG7+hh64fSOW5>Ar!&g|3CJ=GODgM%NBw=1b0YqcXtc!?h@SHEx5Z| z2=2k%0|a*q4#C}>^Gw5iO7e6>-!#QVvy1upNnrkl6`P^`Sl}(LQ z`YZ(XR^7&ly}bny<2GKx$`@}xRR)*_({GLi)+`*a;FmsIfD*+_El{3nVkE0%&oXlP zy^0~-n5+RA>yyz5*G{_8u7cy>PfzA%@ZW6UgjQy-t%>o<# z5$bNzRa&*@;IXv6r6zZe8{YZzZE22Xm_5M>yS*GGxYv0DSI3;Lc+l6O6%+KM73bQC z*QS`Y%-=cs$*QyR)X!H8`(8!!Zl>15s@Td&E0c1-Jg}~;EFC`o1^#yO{8`poU`pD=x6onbD>IO8talVzV^0e>QuFa zR`Bt~d(iUU2DI@RJ3b$=+T@e-{_DY($`~DOPxYla3L)(FX+sj6vS9y1_j+Y|N%Sb? zC<$-3+*pqelCoEOjtd8z7AX@YI&G6*_#lhQ^L8=m=}$>tZN~fUse+4CQ5I4YxC1iE ztU0)|NVV`0KpH{@#h?g5WWbgu&B6(gg(_s{0zr|}jmWEr5nmPrzMh{!sd7Ztg~3nU zbRj!S4?ki&*DGVBVy0pADlIsrzXjQ}pE5en`-<3AIpI927%eUa72)?iM>squ&KSq0 zD!T3nE&@7nc}1pHDG0JdW<9?`l&G~-^mWc8+l$=C3UUUmbaBKLwlhJbl-`jCLt1$6<}Mw6BoO+hVg?#}ktk65+qdY=}(cxfI+f|B(md1bTMb9)jSAL!MlJFl{Yg!F6FJY=fbDLaYTTS@k_U$D8rpu zgJd$-G51iYkWp?`iCn-1;Z8|^^VvjP4I=|N^#G3BNl@ED!7PXCbxDUhg6y^EtF^r> zhoQc6VGR5!Y1Hmgr#<#$^5ccA)(sgZ1x|ExkISnnc{X*Ifr>Q$Iwh=_bf(4fkaf&z zavDA_i`|IUc9UtqxlNa-aHjD@19KM=UuD<)$=7A3wst+K0XH_+2$24nW zABy3~kjN3oQ|RH^-1X&}jPTo2fgkV_X-70tzO>JJXnqu#b0mFM>r%^LyO> z)`<8r@0TzMNtLo`a-7OlQ3_L9+Ssc0$HZr(hj|P1Q!UjGWj|Nehu4G(KMa1+(aZYdBVNgH?iB3NS8a;0MlkQdXKim zvNIO<{kCVk5>BKRMZjyTUFd8TMhHT-%C=^TT8pDrju1(c^qX=}U~Fdo9`#q{50*

4$^-0mtG`T&;X@?at{g8( zc!d!30_mccSo~!Wy~bCw^3!-Le)7TT`zh%fo<_9dj3ew*brc5ir=T$2`G<(>5*doN zAbSt%ZIgcF>qXfB0eVg<43*sbWGpeB&xRfe8=SNY);8^USWoo0! zfpzRy`3g4(Tc=36B!-q=l((vo7dpmnRqy>F-+e7Eh(UaJRULlj_ttL4*v5O{QQwY{ zV|n1oh>*K6K7*ago((xtEiDJRZqGG;vC{EbW}ts5n<0%3c|OnK-r(_dkgTCiyLCrDn^u4*t1~D|ID$L z5FzR>m<$1pUJL3p&L2J}@?HrB;x_$i=grqaN5_q$ugiXsD`|+4uIDxzBwv&GR_-&# zE@BbrwuobLfX_$5;Nne{IAzJwj`d748S-s-;F7qh5#8HSP1Q0AaMRkcZdc=`leg@; zzN344lEHfOsNjxp8ggP_nz*{Wyc?h`DCgXN-sq8#!dCcPOx!V4fDAENb74^>VG92c5}l*Y$S| z4`0U{T>(dVa&I%`F8%ay{lhxoP(0s%2K3#>$URm)BV{urqyKqB{TfOCM;q$jN=2zC z3PyinfNs5n<%@*{^Z(9^UvV>W4{#PG%d)W5-^9}D>VLlhX&2zhpdA>b_pu~P>vo;J zK+XnPrh`HUk-7FwXp9PZ(T3o3bSU(eaz$0&U49^4ozI8;QPjr^pyJ)l;eX0b{b{otu1>ZgP&Hn^ngA*4-z)Z-Q+wsY5-Opo|TS23@;0 zntDto@ant4+GQYAOUBd94N={GBe>UcvKv8EjUYKJ)S!p;fulYtTn?jUJt2LgkE8QX zU-V{p3Cek!3@#)NYPueb+L?`1tfaAOqu2Af0vx_QF6`P(GCa?5CjhHUy@13LS)=`V zFn>)A`A37v0Zf|s)jG-it`s#uedjmz1@UySp@DPe3BUy@q~Iu-4`S*lzbPAnVE9=+ z5`-P*V>h8!JPL*(!_y;){a|t|1tG1*7V5}Rtk!NYAM6_W)R@Lm0ML@=5}NS2^&rc> z_0E}SY7~lctK0k*-~NJw@9H}kz1zRu%dM|7e2nIJxm2GmdYz{<-4e&P6OYqo}~5uv3?BRY!`0>9v@dfqO7)r^+&r4 z&Sp^02EF~#1(Dv4!;z_Ct0IC~Rgv^I^~1Ja@<&eG3O~H0Q z@VD&1d+|Xp6sB7gyxj9`s(v^tfKfH(fS1)!U!7A~Pc$V$JWutjBQvr$Kym3yL{tXx z=(^y9{fJ!7!)nEc819c5WJ*Ul_S%6`l(2!&#{5 z8yng6Sa11soMTrk{r2oM7RWH~aQkbui#NIto z;W&Q_-5?n;v_7{X4&B6p?>z6ueN84$_BoPUw3H?P1hy1Eq~F76I+lCUvv>S?mbCT@evzNW1*j=T-<;(jn4r zkjQ0=gT7rYdG1}j#-6QUqTg@ERv3P4^CxF@~+c&#&+_yL|TmR1+^w;S8KiZ&7%>QPC zD*P0?Zv$GpkKJVJo~1^Hh^&B4S#jD1%mfisadpQx21fn;Cecgtz87L7|sjyJt!{Nr8ps!cGv-<4NR1+gd<3Ek42s^HWRz_RLZo>Es zGqb@_o9(^jZhib>LdHu!Rf}XLcF5KBmb!a^r97M4!vsBRLHSZ4BTOdj+>Zz_2EO$8 zGz(p=L#n)Xvntzjb>H9_%~+X+sGsgK?op|~T1fkr04&WsS$oooo;Giui6r?ouA0_% z$JmmVNl`_!%h>(V;hpXyOy?OGpiIrI_|Jp(YwY?T4jQne`L9;(4-KlrpBhvy@eNn{ z@T9{+h~5)U{9V;aGZPE__K5e7hNg=`NUxd2nIpe^J6Yz;i1ik!@|5JzG<`$s6P0fF zageLnf3dFM2v6D7zXDo^!P~d$I%OYtX0up^ck`wq10fOiu8IShT3v{`j z@Lg`2wh*G?r(6{E$I_mRbQq1eEG}WX#k#CYYe3_9Jw#8-nT1?ldoC%3j6!pmfE}HJ zHr?y5X}+~4YVdh4swm*LB(P(IR4|_^;e4!^d{)nu&YP@F8@Cw3fkD%IynN%;IaX8<9_gV*noL)zrFs(=mb)V{=#VG_?@cu zzsYF*oyhjzPPPhI;(+-NLa7*#W5)a!>eAmxEd8_St&Bj1+wYS=ug(apVe|V;{J3EH z!P5Cjs{&s9PGx`6S(>>jmQ6+BELan zKM6n(6Ya9+^y}3uI8lZAZK213bc$x&?BZr0W0MQ_pWzy&WiS`R26lbD;~>KzA&r`G zD5J?FyEmi-KfMn$+XoedBX2u8Bcvy{a1Ebkub0aqtePJl-w3a?yzSkBme_k7<(Mc` zY>kS3Uu;WqY4Y|f{6?flA)RE*gY2YmxJ`O@@jIsjxT3D1Osj1kTC46E8E<2N5$y;W z^%6&|xcCqr>#Al$#4ZtzO#3qSD05ke_Hxa##N#pMSpWXqvH4EP6tm2uzYnOGrxNI& zw*Jo*_3upmzryf;m6(#ajZ8y=|GN@X3ZLM9*67v(f1eHpl$dfyLE5fx{zo;skt2Q! z!{5*Kywwp;9+xKC1fSE$4|`KP0}R7Q!V(7>=5>pkikPrb6Fr;;X$2VivrYPc>nKFh zRp%A?^Bn%2FzNriF#O-<>-<`y`>Tnm?P3tJ*;L`3yxsn&1 zhrnda*yKV?HSD}x)Yp-*F@UDDUS4r8$13>5)( z@)NT4In&bzumU)0B6p#9NX`(o2qdT%Z23@T#Ej(G;O{8|j1X-) zCxNS`TN!NWIy>;t{1aU6?7!CN?)FOrXIRd+Vd9-IVV@wEkNbCObOXs*f333iuP8iF z8QZ`b)-ChTHM;*RB&OmS{z(#3*PZ`PjqacB-5;mJKlZ4BIX1t#)U#SkHYANG-Z@q4 zMz4vKRn9g2hy-w=Fx)>IXuZmu4{B?*i%l}B!25m)=8|wkRwTtsYi_*&d8EPCs$M=^ z(rZyk*4xVui&oruxJZcq!6e0J&3E;=g&AiMp|()(HpjJis*}G>X)9(xuC>-x%=@86 zYW%0j6aoJc-$}>XGgo9fvOdX0vsIYRIxf5V zYZN|VY#<=vCB*iowbs_xy~*3->G-8Y6Qvft>cqvA-3-m$`PM$f=r@@u=UaDIS*P5S zmwMqc|5pOijwe2fyJV4DVo>3J$^-Uz0k>jox>Oyat~E1C&OKb*D;lx*#qqgoI4ZD zGu;ud2+9(BZ=#lmQ zvpSW8FK)F=bmA#aw|Qt)6~@u515ZB5_<5f4s3YDJ?+1Q_-9ePPq+Aj)(0A3qz?k0o ztS-tJB6(Ds^x_Gp*}LztzMCRTi%_jtz2j2mhE>f8s|HbiOS6?X&nOyMOCJtDsEtje z-uiw8ncHhmCC9pCu%O%%_mxh0MR3=95W~~}l?2??t5l?KU0!l(YK!2>@fj8!G1z$Z zwkm7$DjBgW7S(tXjR1FmosW-;JK$>R(Ra=JZY|+qcpwK*N=K(G#8?J4zQ&Yii+V$B zaTw29tg~lFE|{kgBKEEmiY488f`jvuzd-kA&ZmIFZl|nv&&YWFhr=HG47!BWG;bvl zrKn}?s~YsD#%2+ejfBp2C~b}5h?tWQKq%?n{hKw6G$BR z%Ru&cZ#i+M$RrhqY=kbnCJyec^R5S3-hAi@6E!(<$Po~0I~|H*IB+L$YhM3V4=xyV z`LCmC7h-R8Up0|0LvUBf8pdv3ZaS_aTcF}!c|Gn?kWtb{NqvJGC}7XOx2aFYju^E^ za|(q?mnj>;t9qc|2d(1BXvfFE>PwV4cFWfuY_WL62u;_SnN}`|g_&;5CQRNSCg(X^ zI5PlUAW=zP?8416G8^F$bl}$gh|kiioo0=TzK|gDx{!iN#=r&x!Kc8geBcvQ@p8>8 zPpNmfdeY_mw&EtAe0V*1W29N4EyS$fIMxda>dlz#dPzY?S9v<6EK}`K6s)Rh@{npI zoGnRzMj;@C#2}x{J z=Lg#e5{h1|ws2(ei$M(!b1L(LzWSB>eE6L3?gDIZ=Z}(e1ZsyJ&IX}t-jp^C#Hwgg z>P1EeC~3ZvoX&Ib={ZWxWCLo(j%9(Zac@#Z<+tTgII)9>DA&gx$~G!p2=1-F#pS#;m|Hb<-nifu}2&V~AJ7%!9G!CcBl6}LGL zJqGuZoD~P+1Ch5<>Z{(dB@>x`=_7KeQ!Qn^lL%cQ4=0yt$ z6o^H;xuNNtav^cv2p=(iwLn6VMkopR%xKVJ1}J+2IT=ufFZn?;)E~tHp3WAAaez@B zq}T1@Q!u`p+H|hVAT*4dP*mzI_#_x(rIqtyhn-Sc8!NQ)sK+U&QM^*)_ZqYsNNtAW zGiLkgH8_oMT%(<=CREnGG8sCJIbWvgm`GHR7e)n0^l4!tXjc3D3du0CC@KHoHaxg^ z`|Ox`(+|0wUe$iFV*`v>UNB#vK{sc(KfrJK({da{YnS7zLpM|jz=+28syY_?>yk~mzZd670j zjlYmLHP*7xvwE&icVBYpze-u8jc0pe-Ne%vi!ge7v-dD9t3MSjV+XsHiuyQwWNgFd zAlq8xB-%%KKgu3hztj_?4N2q%p=k`Yh)o-48D{q+QVpC&Ci)gI~dlst8&aO4z4 zO$^++=i#TM?E316S}l6HzR93`1K0Hi9gf}5OD?(_X~7JVpqTu-{*y9d(_SG*fHQ8^ zs~Iw#<;nVdQIUPt6#WuNb*r1sQ9wsxscLU|_x#o>E4-6n z%T1%NpL(#+45VGV46q(HvT%IiUE9MBjZb~w__e$kyJ@wEMhlPPQRjr|hX}c`aELcB zN)TLx_9zfEdjMS4c9t)ey@-z!n}L;NBpfey`;>O(lD|(bXRm&kuWSIBE6QML$19b~ z${trFr&3zDVbL*)%x5Ve2w=l{+8gw-dw2wSo8n4k(JQQ0t`RKY&R%I?QDhtjUysS= z#YH``jWrS1ouITDRSEi84V!7IW^NV{wCVG`e;k3^2B@wSlGz~`wYl-}oVS&4Z*#?` z^7pSjV+p=gMC>9CeJFn3VHMFjpX|JK=O9;e)i6_ zXF^=eg`Gb?M*bRM`wPMcOa=dmGX1}W@G<;IF8n=pR_s3|Q~%FPT4!VgqI$o#O`Q># z%nD4A{2j;x;!nUF$v-ZDsNN4?_V1v2oc|%J_iK>vm*+M{PG;8sQLr8}!{0ueWW^8v z;7^O*zQ8^U;PKK71`|i{?7s$w$`&YAPYxa|U^YQ06k-hd?1>yEid+FA1c1#_8NsQok?a*hSE~C!!KANO zU-w?5fUNr9#%ysG2cv2qO#wNfp^hCU-Ee3$Yb=$fl(=wsgc~EyM8O`Nkinr|pXSro z=Hs4a8nJLMPtn#zf_oEBOLMKpK3-}`oX>RBg+J8m-|_MiGc~-pQ+%1+^8(oCDu*|g z%-@de^9NO`J$Z@@3`se;8WRpQCpv7nzT|Fo2u_ORLRAXUL`er{W;9XlRO-`7=muD}Tmt9iJpp#t2ia-tn?YQZmjl{2E#b1`!zhtET z%Vnej-L9U!@XU0Jb;L*#nFo=oQJ~*Jp(Ii}kMLbl zK|{+`x1U}JRHi4=il4#5D}M8Z5cJiTafb`F0HVdfH8sN4 z@vM09!bTil9q%LgK>n)i@Qs1vR-0SpFju{nGhpsc;5CI!RcqtQ@QEXTY34f#G35Bu zqL%g(pJ$0>9{sqL#Yg_W$;p$&eR|VZU(U}57xy=Z)(ou4GX>sLmpk_|wPMbMQ*NQ&<+(DVLeiY1)pyGG_o zhz6CAKvwX6IpM0#M_F!?K@q>ioAd8HY2S&|Va)s|Dy*EZ`uw24qqhW}o08_#K@x(G zMfs0Nsr5}d8>aC-Gr+~`!Q^vBl*L1W7&TNKq*mxjhv?SQ)%ceWIc1)5OMu=?``)@$ zK-sR<`$@9O=YmiL5KV!}t2j&rUKA>aeFX)7o~DU1xf!E30C^*g#&nq)6$+Y2C2gaE z4w`6|+Flhq5U-*h7Edq#_&OWDV8P@n^&2)VzM!8#5<)B)nvLl+n-_m&+4DON3-ia) z9G*tDe&ZR)*c>q-8VUO=aeg8K&8#sKd-#CGk6hZ z+23w2q=jOZ$`0nGzfMT05RN(!I4#bqlBzfSFz1jbIxk0FRm1ad(5sQLk}bdSaQCD?MN~L#Wa-|dBU&C zORglUgc}ZaAQ|^my2}L+z6fZ9fRj6uhU4HklSvyHl6^}mKrERvp=3bV{}x*uT*Mb$ zluxQ7cgZ3PT3Rn9AQeGCvWnaBWoWnH8mFr~{HolS5k!0T-Gn>X$9U(dSXoUX@da1EOKglmQ#@J+{1<)#i>XU%8Z z!qTnP$Aadz2vRP-pQfa~U~u3#c~5Gl@Q94jTmR@Z#ZOkKE0FEh=vv+sCxVU66tKwT zxS-&jD4|&`Nuot~@j7yB2^$L^q!ithK>HlAg(1=5%vWi#`q2aIwdJMz*IC5*;za)Cy|L}WNsp4lclM$g|{BBDrfH<{7# zr22#;FZ;D7c%6806j8Fp z%%rq+F4iT@;gH@dz^VrjAU2cp*W`cu_Lf^7oJSRji4Jxdg;2e4#r8HJBwV<{*j5!iI`j2BKsK-(EwtG38uh%iWJ;q>tkzu#{(_>^<8Rj9B3J zSQ2v|c3A?eN^9Vx*Qk+z(t9gRAE_UPyUMzVD13&}BSp)n%*4J%vok5Wm?S5ke80@1 zDw8PO9>ySq37b^3I0_DXxO2oA8^jzn$c!bWrZ~zn6*L9Mx)H$QBAJPaX`ZgJ3fnr@ zM(fBvENrF%L7YH(l`QhzF9Zjn;geY9iI;IP5d>S9bgc4T;@lC6_U_|#uOLSobJSIr z;{L0`sJ-vpW`Z$Mi6&U)sTUrF+*|C@Qy*+1-?#1tey*2~tq~o-Abq4%Hgv&QYx7EN zbEkB)fNWmubO#-T_<*w!<;twcFe1Fu%a>P_19G9J0Ujtz4xS-0wDl4)n zX>zDHiRY3RGo~ zv`d6_%lqhtX$I=D3LJk0{>aY_51quJS;2`=b69&}A0s=vt zKLon}F5CkIjs61`*Uy{$;dK4tZZk3hwZH$n(YXF;bqbl-{#KhIXyT^~A>{hc>T&5F zF4tYLqS;NMAIA{hKn7CuyZPFiaAE1ZpZ7w$Rs#@9#P#|6>3fYffsX{j9mT+CaDatt z!4(I=6EvO?%7x5Wp(Ey$H2eB`a^-Z~nC`WhG`4AhVy2E`mKkeal`M+;abD4fg^XYe zlj#pl5Gs-LguJjye3WQ1A==ByoyJ;>P5kP$*+#H9$*OI%+4LFX&2E@CD+6=->oCcc z8f@OTWldtuDCtmhUD`d&YpKy5aK_|it-Tf|3*%v2oP+D5Vv^QjpH(cEigjY=%QTjhWt9R~7jh%jU%1a5=0Lh19LmPP21Dxqkff_WwH^kN;tK4zLu& zuOx<~D4-e(1DfcrExIe1%&OEk7XK+hehet|nInN}BIWA2XECa#<*$1Y%2%qDBDyvkOsz{ zqA3*m=Q;c}&rt}vZ%?|q2ze` zaN)-3dqlt7Fly7JQ;YNeOQk`=r*Y#yFRx$2L%%Gqf1x@5^=J3Lfmn1NBNcqJhos8Rstkqv)0{ z{_RAL??jsvv-ar1AyGS|8T$b|X&lmENTL`nZiX)!g*;#;q0<8#-}}KEV1D~JX2H_o zZt>&{Fb|=6zCW+9@a6GYK3>zjKEI@U_GN(%$C}-GTnSl0YF*1vz{RRRANsfvxIqvnAkMJ+6}|&3b8_ zl;FI(Q&0@1Oae_~dP8BPod<99O~S4^U&@uDK)eC< zi~7;*-V~1epbSoAVrvsuGKEl{^#_H|5m=<-_fs*h@khPHK_5V)EgoW(O+3+I1_)Z+C-PM{9XC6v<&|4hJky^ac* zuw!u896Mr9tkD7~p%y|Sj62wz)noQ?f2OJgcW`-WGbsxH4Y9`T{W6?5vrG<#io`L8 zd5REh@N~i|yw(MFVyVQdc^a`;hrsY=@7ZOHCKlK9#c$yfvIB|F$G)q)+S*4|Cpj-} zw}&f_{5dmgd{0lV&h8~s4knYW=*evU>U)nPao!QQ6*AVZYD8wE_QpS?d`DNTTjMD6 z+vS=DiHzHVZ_;pCNWN;kzswCu4~XP4!Hu60pBp7Bs7q#8k_QpcGGfGzL2wz1!vjgx z9U|#oz=Ar9=3=K5$;~-NE0WSi-4$XfvbQhfATPGe(`7=drkuL{QZl@+7W?8+smIV) zH<5b&Btcx?(1fX>j1-P^#Z$I|*B{>kzsMP@5D{ zGeSwFAd{!x4sZRqT{I({su=&gbN!ysK;x!c+J&F3qtv@6^3XcaU^YwBa*WZbM?<(m zuBlKsm}i~g(0Uf^9RX}9npSH4K@R;s$$RT&za*b;wQ#G;E{X-olwFMcj&n3^k3q$6 z`}x8ACU;@^pq_URa^sm7Y5-$i3Xh>6#^5|Fx`Jii(#nPl7x|r=EVWRfq|}t-c~3`y zVRaJG$DV!fDH~QKsQ97blaG4$*WvZylO(_*TYQMA!&Fo^y{s}$J7Qpjb`Rl9iY}cn zgR;GHYUT1wG2G=?cKe%vJTjX@e3c+*+LxX(B%`CW22I_1dTN;m(r8DrJ8Fo^^)E+U z1+^KQBeJDInEe8Q9!Ov8UDKD%{pyhdgC)Hy4nW0^p-U1^Y85YRk-qnsp95^$Q6#=P zycMJx2vT&Nai1()sQa?ouGo#|&ofKY(smQoj)JvP7I0LazzB1C{8kosK)<>Pt){sX z65glyHs2aHDp6aDAe=$5L7Hn{;oT__ygg`(LNEO4c&g?U`Y7V5+)Z46e`wuviMN$I zzVOlhcV6DXjF1&iTYcz?MW23L5NsZEvy&x0L4PnDE@fdsNNN4eWP;MH>uJ;WPurta z!$-9QTO_qbM&3xPV^>>m0`f%FUO%M_sYKB!RSH~S<@a@QxO8x>yh9-K+ZF}j%rXn{ za@ZL^v%=9E#l8wY7pS(Z_QVGhwA-mmEJezH;l<8@vwgfRY#A)1>wtSgjiJ^? zEkgKiNjH=B-9?S0gz!9w$9HN|ls6>}rbm!4Uujcdwgz*+_Xe>K?`@)uo)ODUAJuZ< zwm1i=Cm@I&r6^k*T%B2C_8jYUW|gaugR59NZ5po@Jhj>!MbnQG-+3o_m0;7h3T*dP z(COp^`6s4CU}8Z#&&zN_##?38R1jKOKYV>>6F(Cq&WBN=5g_uFaw)!a!Yl4;tbls{ z=2==}J#6XhCPWrw1hOTkbF3jqci-leoR9#ExMYZUah+?&{i-G30x=OXHAz*Q;k3_P z{l-!m#MOJ(q{Wo9HzIl7b=}nO>0XPuj6a&#t@IHchtnrimN5Iel(w|w#t#nRQYEff z=$&w?ZR(+4b#Ix+ckqip3{7b7NcE78c_&$spENYaF<5d%03tS;fLG8qPLRH;pOs(`lcjfExobe)V*4Q-}-emeB~fzZMRs>7D=;U z3=H$t-NxJ5Uc2G-FSRQv?q%7>d}*4OR)F@=Cm;nD)SQ1AQje6YTu;pR)?l0I0c?@= z)8oyli@~gwdjFe&S$)yyvoL#a0(G{uc}+Z2&{&{`4^%WP+FVw zH?j&424rF(`jPheJ3`0=WNHEPKL5A^Ry_bFe*S%oknumn2!BnH7BY8ols9$|wzami zwK2AFA_69g3fo%QIw;v07#RaIfaxWKg@p_pjo<&E)BM)lzenv6H#Rpla{~4Q_#H}r zaAzc}4NQ%JO>(yb{#KVWv@kYuBKoaJ0uYb{qMh`=R}*4nWMlp}xtB*P?%L>T0lNUe z^opF^ZPo7n$^L#C=jasCAyEVt1PeveI;2e~&KC$#h2>B7n3(d)ZDc1Rs8NjR#r9$S z-f$$0CsLmn?W3AD!#};c-R0R$yPTP6&ul5D8{d7tKq@)TF4c0DoxN4fs#yXB`9Jw{ z*23jkZFif?+=`UNX?L|eOgD^sII+KWga6{bwvi(T@R((hw0T+y8Pjf8xQdsA`g!vM zq5g6e+xC^+ipIy#CIk9b8r$**3DoamvUs&!98WjxAr5z1wznEJKBvRfL_a@Lf4H#~ z?`y>*p!*778gi?hQ{C3~SHQMnt&~#V{Vd!^WO!n>RYkoQ82HU1NmDN@phA4MefiqAn zq6N&ScAw^(5ORB#*bKw{Xn?@zA)ifL3+&6u_bR$E=k+~K*7;V{k+iN>)Z{h`V(Fug zc&ty$1wvc#Fa`$#=t8N_@5W0Nc>C!qFW-Ru_yYM}wqyQMI_Gy|&&z$y!QZ_~!%!l_ z2B@)mp1d~F?FR!Hoc)j?f4tLgs;0&_3Y&)B8IWR08F;Rd4_NdtGuKEn|Iqct-r=a& z-SWL_Ir?*}-EnfncDbfq?h&7p7@ym$r9-wk8nHBf@wYAU3dnJv!(%?cve!gh4*i_9 z`_FkVMh|dQErr|ofVxXtwD!0qXYsJnoWm)5Ha-e9SeKpI5J*2s8F5lUjK)qw`DaRf|z?jhs zacQS(PqAzspLX^3QoQMS8Ai`?%cDS)X4?q>TP46)xAAcx8x;e}3Hvcd2GWf@QWERF zdmsa8$eNYZHt#7B_{lnL#Gl=!d$>N3@n)x&1nd)*QC6)|IArP{j}d-XuewuURqsi` z>d|g>ZtR8D5;Q&Uyt zd*gb&#(J{r1e30&vEnVC$#4NyAx*GdE7UT(zRZ12JdJTFYB;ni|+MDWjO_%09LGLJ@s1rnJ>rPdE_c|tHZDcKJ6aU zdCyG%`yxQy+yEM3U$RaqaqJT^h-l@1?|LPgi(vZ=MddIZ`KaMv6TR@8T<60{nmU*=(9`*APD$iEboNuX!>RYa&2l?H zOB|UO>EFM`a`2<`_@-(|J8jo4IY8rt^UnI4?@X!*#|b+7$@1+XPvMPFDpjI;o=Tc6 z1~0Vq({MX)Aj6O4>W5S0!Ds&|_1AiK|nWphZ-zuQgKOQT8T-|*aBdbgAYA-r1N&bKct47tJdszc|=Kb+4 z;L>g=E~hrd_CAKKcXq)yOrq2I)<43yOxbSI#H`Z%hANODV*XeKuFYXfRun?Xb(q83 z!1a2*FA2FH9WZAYIz7{aWu{HlrZag|I=p5N*P#rS!{dDu63V~ETi{Dnmdv$NA(WQG zOaB}K;BI?t5>00+(~bY#II^A$PMi8hzFacX3!7FkMag8>DMvp5&zbS;6xF)eo~2v9 zmGm{Er%fIHOcy-QTS0sEaft(1F4tLhy5x!z;nd1g`qUhm*LLeN?gb z$faxFcjLOH?aq@S45Z`PF*`Tu+Q@SQ5Dd4g1J6&vRES&mt!(4vfuf^D}onZp- zG1W_S?n@Y9B4)KyIqs`n44yNaqzxt8@LrT1p3lY4uJ#+k6^>4z=hBegX$=9jJN7fywV zc)2J%0@WZ~Yrg$ze`9e2v&Ax@epj#|i*<}IQzZ*+)P`EP*O7owfc*PBEuA~2%&Hu` zyyedj0>fPLGIR@@#QFYQmd1uMQDK~;m5QOG;Y z!Z{4PdI@|6k+^`PJ|USjnBPuo=XGCKTzY!`ZA;_$e!4_ov8%Mg9Q*T@_KOWnBVVTI zxzl?oB<2v`mOaV11HQm8i44jRcDW3N#hB@`MdY0_?|0e~=oW7S89U7P(7m|hr z#a5%ie~gRUzDd{(m(hRSt>+h>Do zwr{AS6^ZIG31AbL7Iha_J;0_bEl04ZSSn!t(MbJ;SN(GlDH=Ps-nC z8xiPK=C>5!XVxmd?4IJ>PIt=m+cb_pdWB@(b#^eHJ!Cz~7EuDtI>am5Dbr^4{1zmG zNc{P$u_y7`GoaDXv)gPt3@TYfHrbx{l_2rqc+Qx1=V!YL)D9qyT(LRje>Or_L0|3I zby~G-Jb8&x71oPG-sy{LF2wET1t3p@ueXFJ}~B^R9tW3{fV0*&=`?sFln?@il`{ovs(-ixqEXJ?GG zPJwqr!NZ}V0`%op8k~i>?3!--_B!Kr!4JcIl|~(9REBMa$L%RGx@vtSG=P1&?1?se zOP_JB0&NhDGqimD3=z$|>Z!iW!YU;r{Cm?>hS>-hf*5j6?^ctr9o4+^Okm{3w1L*) z`eGBcQ(FRPjH03rxL2+(+7gj>uBy~#kCA^k=*PNBEv(j>U<2$x0zyuz3N%wE*nx-Q#F0(1lb%3ROXyQD&ZCD6jwy$j#GT0?>tY2fj8B z15dth701w9MV+w3BN5~HsqLRWG3}Nwl$wzIZXx`Er``;A`kF`UIM9RObAK2~!X6$P z0v_AUI(OVJk3fT2Oy>LMP*r9 z;5-?~0Njh$Ku_aJOA7)H_^=Rlsmed$c5#(<-hndU3-p|d2n0Mug;IfwR3(L87VvDn z)!}Q^za{=-75j00(ha|wTk?L8)!BK71fJ@}Htd-%mT7#4K&L2)Y6R#F9l1OL{cASq zv2rt=7d|HEo=?}ZIm)GrKkn_)>aFz>2EgE6Fo(eyw8nf5b$%)Cjpx`z1FhBPlVRNr%x{|_?NGKwCG@@|M}gl zafz31o+6!YYgVnHCGZ=6^jk{V7lr*OYv!o>vXe(yaJSlno-r`)hLD%rC==0S z;NWrV@)qbSt1PmVBnx3J0*=d*w6yZaFUs;vTJGp)6C=P`21h;M-u^& zRS;Ei0>Td#YjHr=_R*E#5=r6tkTmjy<)9Z`tHb-@sCmVPkkxh+=nRV=x&ZD@0!jOs z=+~SCRNt z+Z(G2ipI0Yflh$QhwY4)3zyFcyHzs=lfV6Q6%Xjqbpkg+Sj2ovN(y&0uj_rw!FH1( zz2a|=mVOt{C3>?ubOyZS-VGH3?LNtX(lHFs&z^Wn~Z_#bY4ijLUNfBCTsnrkfXE_I$V^xT}% zGOq$xDSvyy&b+&HtAQi`qSu+hc|wW~*Kck8*YE#EBQWcHwfDc+d(WUMvu<0sTU*71 z+k|99KvXgkBr7N?Ny!-`2T>$vFrcCW3X-FOWCh6?TGUMj5fI731|*8)AmAMv-&3dV zsr&Q$^WD1su)1hqKhIio%{k^6V=k3v*o%vc^HWf|b_qKUsl$(c#uytGN^^VNlN4U$pel6B>>%7U(p-?q2sIcv?;4>lS-RS<((IG4@ zUZz`kQz&|>!_eoAWmw$8DYc=lySr3AoLe2pw;jwhY?Cfm8jqY8{5BAWgSlr)4;NJqWEnAMc zee6wDPJGUOC5lLO_;CKsULB>kX7ypB+}#;8RUsiE0=9j6N>VOAdIkrLNnf8F;W^IE zUZ0JBG6R?ZA?>58Dew$-V{4gN^s0bPq710`A@U**P4?~uDRlcB^&BAU9p=zMMktvKYEHA8X8`` zdbNEoZCjS16d#{mPm!Hcd@K#`wcCVa$Bs$&aR*06b|%Rm>5RXDFc7}c^(uL7@CnbU z@$17M9v!r&T@kn%FXo}saq{tU0EXjgM{mc#d^=f@RG9LIvKMCgQUp4E50HM&Pi zp%<|?ZHVAw5Ow^yun_R*(O7@wZ}xak6%7si3w6#vdLrZEHk!nymzS465Q&sblAhCj z<<^rP)8*eCqksMSm0>mBp23b$O@$C2rI<6yN^`AOq(r=99#1DLMvoL3+}pA5W?xxx ze7xbW#i@(_)Y%rzagQJGB}e1GbVpfOWDJfoNqOs??%cuTd6d1o!mHG7ImfKNr?)rO zptw0kq&1H~Q-ziDSzld{l#~q2H8nS{JE_0VsKj}yEAiq!K_ND_Bx^GV3E$3alZzL2 z^F4a}_<;03+qcuI?x(5BvuaH?sSZ>k14y*Jt1B$Mf3Gjy z>@5+A-RO1c5A~wZWcC&DTz+d_nx^}}|7me=g_mxxmC0a4`{w!iNqpuN?ds+x;j>Ye zGnc7bsAM4K;pVm%>)9A3h`*@?t<|nwdqH1u?cEmAJil)c0=OTGr5G)AqpwVaoxS?~ zdl^b8r|}Rwsz%Z!qKgR9g40x&)8b?&jzES^r`|rJoZQ^u5TeJW7?r=nXCATARHe?F zw5O|kEd7X;^6?Jm)*t%!*|TS*F4O5_9J`GAe13b8q!*{U$!9r3lLuVrXbbU?ZBNmD zdV0=_Z0zhjdPTRY0~rwREiEnf-~9Ho__tnXyvR>3_Y(a4DikecZVuItbn~s*Y-vco5w9Qvu zk)QQEl>(qmRe~cTPF$q1y`Qc|k$BTZ#AETbU0uKTFGb4VKi}_b|2HOvUgT3-Y!j*a zshRP?{ri>gixbEjd0R6ct3^n_0SS$@`|?_Q*1GF!_>P0({w|j4jJlpi6#X0ylSRawzN{Q_qw~_)d#$oF%Mj?757+F z=uE+wRB1+$p^?VuS=q!2uV126vq&EHtFK>k3cgig zZb*_3ANqhpDyUS9;1SVta&%bwp)cZronr_uvm?ohl#c}oZ-!ytp4r(lr-?72v3x>8 ziys&4-#^&PF&?AQ_mw~(T-DJz^)OY;h~9%UyL-yp+gsWX0Zy|+=K-&h;c2z|ImL`s zsU3`weF{^Sh${O!!RudA@2nQGq*=rwy&Qjd<^gX>7B94>rYO(O%?&>**=dxn zfjy02mU&QfGE2WSIbOx94%MgatQSQhW2lOLG8SY!n?Zgy_96lx%%=}I!SGrVYSdJB z;V_pvIeukKIY|QpcGG>|RA?bVa#EECQoH}`zDDCzbeaY0HFs5+$z2Rj7V(SZ+*PT$5c5A8yy=YI% zj4SbyL@SipF}dvSf*TXYBAYePHQ-fBN`ZsMpP0X~?^Q0fkZI*maUfftQmpbNguO4@&pJ#%zV^H^s5cbj0(S*T_ ztO|am(>J;VL>k9hQ}j7^Zmy=SKTpN7w84=p5xnP4M~+h@y?uL?GN|yA@56_hZ7VmB z#W>peY!$(naYRorH(<#;y}a%d_Ru(=n_j$d(73 zkdV+fRJ-idFfp&Mj4tHo!2506wh@mgAR(VTd2(iEX1{bpywvZxW~n36C`J(lPfH$F ze^vfN=KHY4NqBrIvNK`!EiL^OdD=ctH}^H*x;nvcsKNdjg7 z-m|~k7%iMJaN)uQ{_R#R3HQg$8k^&#rhAHWC&L#|%B)?X_gs-$S8K{~n$XZp&a&@3 zb+}5e(p$fx`XWU(5=ra2&{IZ<@s6x``d>dvr=vzfnf(dIc39?u6Os|Ju*T73P!mMV3IQEYhvEIi!_g2YwNxXu!KbI z@blX{4$Vx<|GX(WSsX%?;9BiL63L=5YN1iM|FwRp(CO2sPo0vZwEg_*kx43&6!Up| z`&k4D&OAaq;@PvKJ09G>Ph;pkB|r`X;J#iU84b-CoWRF~;K z`7qAf=H~uvlZOq7^!>XeTz=?@hy%;v5Ox>ZYA#J#N=JPDtg@2BRZJCFxLV`MDK4(3 zbQ+KzPgftDrInqaoG6>~)Y620GbQ{RZ81=FpXm8-O?9=!>iigX$Uf%!$H#|fji@e) zh=?RV${qKTdnZHlUA)eg)we3(NZ%p#z7j_RtDk zk}NYhKpA_B)PKE5PL*`!aDON8=YOR02n%aI;O+NX>aFMA6e<7uH+p2K_W8=n%EXs98HSY= zla0jr%o~5cU9CTuP2N9iFRhsKWIgx(%`g5-HwyGJKR@r`$0#6<`SErRUS3{q?wjLnX~>7xA%tUs zg87v7yNh1s7WMmv08xt)3nQPI!i#b^#QYH7vo0IsGwBO+1V7NXZ{OZF| z^jIQCkG`nOMPs5%k?lD4nU*Ug1KD7GeSKoXVQIRb$G4`wK4bQPo)wLhrsTBoG-HDeZ@Ig3b>>Xvel~H0-1; z>4BjkAzy6@(14ds-aQi(AJ25)K#uXpU7E);rw-RPHin9Q$10J7w~li+6(_~cog(%_ ze#0Sx)KzLeVlh%aedf6gV$KSC-O82r_&Z%na%Ps#(0HR$=9+DHsnUBrAu;i~M}6C* zPMZyds<7_aw0DGL72W(OW`7PYlUTcQ19z`>MK%o&-QbKzNR8bSYu96rXrT}@b zvd37j%(cb*+w?Tkp+lzh_G6!ugwObrE9iX!x{bq%z@p=0V>CyOKqVe=+#($z>I`JV zd_JJROPR%cd0>aIa3NAj3BTQqtV{UphYzd4hUmweZLFqc|EXuF2*d!y4xAm*68 zme1^v&&n!E`(SM=UvXLUpi`D8v%d-3?_~F4W`ELt9gBs}2+Fp@+E_ZHKt*Xg#1QE5L!X2s;)HL0ri@1q5*2G6W1 z?lnSDIPR;JZ>@geAoAlyilCq%<(7ZovY1q-G&+@3pvlV3%?)lNj7o_@^`3PWrQ7MI zW;gn@UFkGcS_S^8+F2fKi^ug9+a#o^HR14Rkk7VmKgImvh@qzu?MAX>;QZtGp9ibT zDh#R#=HLtfj?fyTX2y!U&4P4k`zI+WY3_UT(|~|Cnpp;bef<3V$m22IAFA%}ZdXnB-7yl3F{<(;RO)`<+=v#po?{Abe9Hyr(a6mePZ32yjnOjCMG60 zh^0;w1=rr)1t;-XZez41vDo3e^LQJO?+FnRx0TspqW=s!O<+YbS+Mp3*^vzCm1noO zp-z%t<2R}YZOh_Qp z5EwZV3Y;;2iFR-w4L>VZ<;00ppsb0GEMe~ibA!$h`ZKq#4b@=7 zf+{L1E?>T!ZkD}P_X=1pB{^AER(5rh1u-`>3k?esRT2UWU_S5dT|qlL*?HQ~upj4F z=cZ{&^aaTti?W^!OG78UpoNK!-OTn54((;b!^1CMz8n}BP}*%<*p0q9GAxYhz<~oy zO!3jtzeZbFNJ0Yko>6CikpC@f7FmCwPH#E6$Gtb>MI4f6)UGQBB|g>D(-Sf4F+Vy(CTzG~LMY+j`1S4HK2gWfqwGJvyosKPGp&Eme&U4Xw}0=T z8@KE&$7 z35K$n830E^0mJGiTtY@wzF)t7{rU4JwpYK@IZc^}!@2UddkQVCyn+IlEKBrh*4E<| z@m}Vf{&u^IRMZ(o>|db|w6_96`%! zx9btE*jSwaLIFea;>8OfB`-XHb%+^-s+yVr`YxdxUB374C#9s&38y`2pG2eSzBoxk zOG~?dKX%=2`KJ*{OOcJorD^@wQuW7=#igZ8BKE8&Pu6yHEP-FMUS#rKK1adlv1n86 zez~$xZE?>zQRHbWo}BI}q^wyDpCd~~jU7S3!N+`gzYHOE!*N^2DZa+B0JFV3OQsjW z1m&!4H*E6|w(X-Au)GR*y}q_4>hgngNw~4y*PK*C{DCg#%H_*DckPn9bg8DcmM`wi zShdFYSM?vA(^WD^a{0x0FJzgzEfyP(j{Bxr9zK;mv>^6?v#%@v`t#sm?5(MKvMot3 zZ99k4C-t`FOub?i3OQ88n%1}2F`2^Pmo%jaj1d~Lx=2Na5&OaX|(>M0x2AQaRou((EBiIa5>B{>9x~EplqDF z`FTgcScC`Kh?;ElGK(`aV{K{A8_nw*8vGwU+AnR>SJpW;ZqrlL0@#3d3_T+KX>PN-IPQy?OEC8`4d3r_aWU#mc>FIA-V0y=#{GZ9`LKSs(+F7`u%} zwcmJ!Pv@cRTV8fe3IB?n_YVwQTv}p6x^Z@PM&%Wd8b5yDxpT*Bb)H3(V*`ZoMSFLR03nXFy$bQhJE-Rt6{rQNp7;m$j<9l}PvhFUJN>|UQSQ&{P zc>i!WvyD(RDI}c7kV@L0PFQJgkd(9MVy8tIUFVoNpFW$_qI&h=KOMala=p&RQ>l&A z;w@1ER>6b>=mE&JOyaJ$u3fukYC1GrA8w|vbM@*c5V_yJeY-1V*Hb;DG&nrmUSvnQ z{QUThuW#SYypnccrIm@Oe#%77KaGuwQ`c4*{;e51qNAtR15)_Pm1dM8GYgBQ@%H-O z-f}E!bDYHKMgu)Py{lJ`@>m$y4BWlDr8Bwa;8x^f1RWAQ`u?5F{@u=~O|z83(Tzg( zLp7g1UG?$tDPACR1*jdq1Z{0?u&@RNHrk1@0q9=UNoH=#|7_a^t|i~L-+N)a9g7#i zYjl?|2zFVW>E%wN`Gwo&nouJ2&Ye4#Yu6ZC?d@ zi9<;4GkJJ;NF6iyada4<0Rqs|Fr2*p<#mt=$Kk3NNv|%%DA)*e>M=q$bbvvzOY_YB z$?4)=t9gZmE(ldAge+(trFhBSjtPC2e0)4OTf2MLX({TfA_~&W zu3eUwC-=2TC8dsI#{MA-%nhJ#--Ec8mVN-L8)ptBh=O^fDVC#Jr@$XtGg=>MKSl|6 z;9DqEV1i1Ei_5>34{Ld`@ht7YaYOsq)6-K`RR!oDp>tw|BedtR;zF>uZCV@6-9b5u z#Quj1h7Xa-?Ael~%Clb&V27@I{uCDz)Ac@Cxv`otEW8ZFF*<6=e17RiZ*FcbsFkU) zu{5kGT}oM*xS(KrV{NI%i$AKYDpT^IbC|??)ijc z;^Lmb1US_G{{A6OA*}@2++By&XIB|ysG6~usAQgz z1`mGEw_dq<^X52p2;0))Vi->ixyH@U3*6LNFOE0sR#uMHXxVR_9zGwME^b0DXe|jJ zp{C3lXQQC=>dO{OGgVm%1!fOqynC|0-dfJ*?dX;GQ=$VM^s|Abg;q{64|t;z)%$zY zPWfiP-pr?iu5JnaH<7vk;AWSW3Oj8e18L`&UN$v-<@r;wN%ua1*tR-)eWzQq47NdP zW#~C-YwhA_tV`d{-Mi@!fhhPuOevc85tSPHcNOcQZR>cY9}Oz_lLJ;c-LoruC7i2?QH$Jj9bHn;zM;c zq{>SRjx*oh-TV3T7Ku3v+SdDyjzV+@<6Un6nBC?^fPXXxa$h?M3hVcmxwUEypsK7p zpK+g0B^V>SSicr;7U+BQ(jRe6thcU#jMw(A!n8K{NXmqLbr{i~Cb7?mdFeOQn$Q=h zD!Z7s?_->FWH1x7EIat^2~P!Y+|!4Gb_3*lr7C_t7!*Rlg>K=6RvI@g~{gm;S$Q=a^Jex=Frx5CaCXyStmZ7^;cR z+?n8>%RpKFE|L*Srvxr0>@tF^Vk&PW?l&)X`w_`GLewdpV2pEST?1In?HeI%8`tWT zHmc-JIy_nv#M17fsirnWB9YUfphiKQ(v^pSOj6vw)F?!>#$C)@`{Gd`aU5xV%!8f$ zx|*U0vWEM#evAjYq|?#K)tA@IUVH7=N*KZ3SZ^V{RMXI)Vqmx-t^y&E_Ta&TkcO_m zh2ewD-neL|?lk@MYNwHa`Y?Fc-rnAT>LT$ZN7|}2tf{mgmLfe#zr^w6(W7U*Vk+*u z<@C48SjE3oP9&z6)C*)w`a)3)sI0763@4a=@?_8^^$g(&2@LTkjI3??rRjkd*=l@vEZWkF#R}&jv z9UskTgk0?B=eN2r0U)g(=rucZSz229LjRLtx5TvI!X7@;nd1r(FK%Y%k`Ma1j(wu_ zM3jgOAePySk9~dr0ip+Pp%u2lZJ?)CkPicf+l2kXZal0|auAnRy!hNK3AmA#p5CS` zy33Vj_!tC(&NIXZS=)JJ=i5Vu-x<5D4!L@#N)0i%*dBx!bm3x#nS*K?P;b}kru(6f zNW+gfx)txs=e*Z)aan?=F!{?xL-`uQ2$|V+r%7mv60FZF*2prLs@uX9ZBtzxG(RBI z`^lF#ojVu+n8o+m(!PBRqHT?hjmtIfdrMvJ6Htik^+JX&L(QBR? zi~2Ig$a+=CW4Kndsw6U zV94vitcJR({?K4q;FSVKG3N#?JN1G6%AEpYeHV=iyN45Z&7Sc>B7<;fUP}y^bj+pB z3g%n_HV|?B`GR1KgFo90W>4t)mj0RNCuh?e*fM9)qllDk-}kh-l|&3CCi|EHQ}5Odg!6}FfJ0x zouZ*{P(`pySHM|W*#{6T#Vww9P>lNteUV=+Pg1dgTS>$*a5m-c3;z2O(Y|)s2(5g2=xyVqRC20a zsklOP)q1WW^0c(y45^yVqGNuiiCdp#`Vg1P9!=4GeED{()^AmI#Bu~=>1~U==D9kS zVqL^p%y;4$oklFb2*1#uW6}DMH&ZP=(87O~Uv7^68O#5EAXJI>KF-e9&WLOK)ad@` zQ<8~z9H>$M{5jH4Si89s_iF`u7ol}$I&=x8rKK}Zo|$F9k!s_`iQ;y0;A<7F%PX)$ z8CUZ3UYI?fqOP*!b{qGfV3?yV)I#NpmDKAgv^A{0pzR$B>FDpj|CaWHo(TXT zJNtLQbnd1JEw;Ebc2z~9nZCSm>?q311HDC-bzZUW`rKRT(+^y+v5V!NF=_0MIg9QC z-mqWkq{ra?g)KiFg*Y#%G^n-00WbpqpL{1dH*5SMZxoAi6XSsc$9z*Yv*K2jue`Z* zLF{&G*1tszL;IIDeoaRocPI&$%bd3=b{td5H>~xbWB_^;;X+wAQc_Y%QHmW}l{@A4 zR@@T;ATT#g^LrQx^wM_BmzGHSX7@bd+(&$jnGa%?31GjpA8NjOo&a=j?ed75D;YKv ziRpD{oJ1GvGLfNo-X61aHK9nfJ<2(8qg8|J?)UWU??wa7_a7$rs0L5<>zkPPcIWkNsv3wmq?;)SmMDT|~ zOub}OpOskWQl&QkC@e)7))%Su`RC!`nrKs~)D-C~wD)R^zi>#J;o{+${+gZWzLGO2=kdyl zz{MjW;1p#>L6S>Kuk^PMLZn3r1&&=FiYlQ_GyiBwPVRB9rG_$?s;CR2hiflGX7b9{ zj@`|1F;FbpyY%D7j~C9LKNI#QS(>_Dr)oy)nON|Q1!eJlvvSkov-J|Ke7-Guvu%+$ zx)7Z3&OEoilhx>uj#hQrc%Dn`U%XzK&?O0$1UxSel+8D=Jz-tZ&YS|mzoq}NFa z?hhIsJgUL@>mYC$-v90PKCZ5rfkD#qYisLiK0am1CJnSWVo|B@2*-~dOGqG$pd8N1 z+v%yASnLPw5)Cc|t(0lX`0^){WVMXInf;K9h zg=Jl~V2=?}bqYtq&5I!^qr{DQe`90g@uR*i^pDarL|5{>kzE;lRP0K&p5ec-qjR*w zn&LFNNVn>{V;;(dd!rv8Iehpq4NW9O820BbSH@(hNdqKI9)V28z(Wq>+n)9XX8&OW zHDTrkO+&BY`PV9GII(NzDn*$aAPo5uU{2r*%->_AQ2iRKC`^D80P<6LS($lr-1<~u zf8B7+_rzf>MGBUThi!+q8i1NiMD%;GG~% z8NRjxSvusyYEu5HU-y*LgKKK*1liwCZLSn1Ztf)Gz3_sp!@Ka$KmSmBY-F!(M`jp$ zy6v%~Z;NdVj2)Ve;fWk38E&74jmZ$C=s;C!bp>mEA&Zs9JGENfAJl;#TMO;N+OH*1 zifYpK=j7yo4_L8GnR$7je(_TO(GvSHbP(n=RYfXk6)MaMiu(R)xyE_oUiRWwzA(+A zTx-R}s0sPDs71FIzqKDK${j1zMHh=h%22PN%It5(r3|^*o~&~Vgo`^RV>-~@J_pGD z$%g}RGojL_8QH1gLmDH z?}YnLL&mgz;;Taws4O$4Ug8}xQh;TlHpSEQU)PKjJC`@!6mvfZWZ-84$Od`>Tbw!i zvK}leU4MwOippmIKjsf$A2`3`TU*h~qmMIrI%seB=7evM*jJo;w3hzsCZobRW=PCg zqWVFG-YXXt^Fu-6xt;XHsw)aprAw$f-O_9%$ojC>b?%^~*D^5R&N}WdJZSCwSN+rr zH~N#OPSuT-s4cFVy}P?j+Apheqa-1~gw=LPXz@Fb%Oyn$6Hz2QYPaUlVbZ0rh1#Q@lrkpSFc_x`~H2Y-)G;> zosS+pvP-&?I{GFV)B!NbZ22W3(@X#VYJ^)rFlHRA((-0VOH13_?Y<)FDoADW6h`jl zA;ZEEVPPXHn(Z)q~mv|6Rt*dY+ei&|K%;47~AfO0WNlJ5gqZy$1h>xTBV#u9rP;cthiRRh^x2 zb*y4#?-1!ypc%q$I4yjmp)MyZm0VW;gxGJd2-2zq=S}A_v2C68J_z2!FyQl^{XK2sFc)i(o-qtwHM(3R{=FgKb`9}%@94I z>Y>w!-#c~GryGZUCLr0_$e((>aLw*2&Q^ujJ)0 zLNX_O8UXO~=g;6GVH$~Ox;szT$&c!&$)OX3--pAolNt6SgBDS^JX@{8(}@K+P}?>x z2~;qom6hpjG-bpMkuhmtw^3J~m6F)VI_UM7%qO1D-nkYeXL*}_MtonhnM9vb@#}|J z_5J$fYS(9V%*g~<2QrO>>X9nB7i81W?k#FZOjiTl1j#|$2Ttp-;U(gO&-Og&(d6-z z*XXnN@83_1R|G8wl4U5JMuysJZsu;8exoZlS8fnWOpdCdiE!nt^AQwU^!=bv{ZpQx zMB(SgN%MQpqjmEbvtA67i)E&+rTgjMtk;9Kf7zUBUD9U7sfO+^ z|8mN@Q_8We8U+V(#mnv3e1jw;q8Ky6=lj1Qg(^0;)!4kVLLAwdc9asGd}cy-GE1(G zvef_2)(*Tcx&2-Gxv~CB^AIwlaMUTcdWQGeu3UQORXRR+*ffrN9EOTC~k!O6+vZZVD>BLEj#4(NUTR{rsyrSffjLKrH zy&3W!>?~Ss3&CbYckR}0OeYX$+vI)B&9vo_kFxS7LFfUXS))c2D>(ZcSy+4 z$cPXaTY$%>lB=meQD}LIZA!&ZiD7@Rv>XM^20dcF&ttl_us1D>ADne#;|(-YvyG2# zbmf7>P+j;6!4-%SM(TV!5)nKeK<$_J?@hpRDZQ6jNw2`FHN)}*bBtn?0AEEq2ED+r zxI)QjO;)^j_b$qejZinh1R{f0$i~uBxpc;1Sa*PI!prT1sy>MAmac@}0fPn1A4lQc zz!`ykLlU#OjhQ+W2M--$m6DI!N6o}*x3;(&tdf8w0qV6)XAY`yQ=CNUxqI7zPwn-U z;>1rHT1LPp-On&GFc1_IGg()bskbC(-FAYN^@DkCWQogjsA2aBaG0YKql*Qj7(!P) z<{V~v%-Y&#fqcg7%nY4Mj?J!BV>Pr2&jf$J07eJj4ZbKje0N6;=~5I+3w2dZ^;wvL zwrtrl6d(h}H^@rt(2*nTtgNo??t#>NRpz;SY4~3yXsXG>@#CsI3DWYbjgZ^*B(nuE ziza%vAt;V6uocgKzviZ4s{(%~7&4H>Xn?xW9BtV~ir&V#kBKI&e6C3hyik;w%T3e( z1+SeYvyZJ)$VU-^1+SY)sC7h4MM6nJ`6VCTIwrZ8f~%psjM{XMLJ)>JZIasw%8JwX zYmV6y`s+YW(NEEb!RIY-{J3o2OodG+KPdiF4|(ma5FWGL&;(xeR2?o)&|xftAWQZg zRr*w}y{ua{zN)xYIStckd3lIt`{wLU8z`obFM@1cLk^bCJ{|{04l1VnjP;P>FCt?q zr!Mh|+3|fb5KeqoSe$TUm5`JkQn=Jazq?Y_*(0rO6qp=A3}s*O0e# zGOav^GoE{Sd705Uf~|+1lyB84E0i2Yr_p~@r+{Hqv~h;QY4x$SA{oZ7!UG3+#lha5 zzA!>Lz?WChl~1MdaSORGUAyX2(}5D!*|S;eKKvI;)0EtQbG%S(MUiYwj^kBFNnO^8 z(;mD22&FD;cb?7JVcSxenZO0`o3=jO=agv8?5~hC(hy0e*|M0Blm*y+k3`!JvBdKq z2+xXDF&u_(0BN5rJyKJT4h*!Qb5(U2hK6xPLBY|%!NcwXJrz}0Z0sAiq-*f-l3}Su zzGX{Qo3a+_U|9FSmp8hgsbL72pPk*cXOAaXw*XthX<#5ZB_(J4h89-n57*)CBT|t~ znX{@`O;km)fesb9(W?fYW@y)SG<{x6`lQT><*9nE=Wr^3hB(4?*OR84@1+Ei7s>(I z7;e}mi8Diz*Akd3IZ$QOUBD$S-ZL|Dg^h!wzPnqOq6J+9n|v6V7$D2$agMAc_x7%m zoFM(3e|iObvYFNNC8vIgn!z{70}G=q@7r!`NRgWc6uiu|loSh`uAzPZ;3$8v6N7x= zi0PBr* zV?9{uoTf+q{yim5*IiwUCO|J$Qm)Kpzm|o89YZ**@%6lM-D)onw8r#lefc>%>ilZe z=acXZU^)#AjXg^>k;o|Oh{XIVLDGm*Sjoz247#9~rzae&&<)Pm_KA}oPmq;o`BtS` zI{w(c@+?CJ%_bwbD9z4aMWjH3tF|UT z&uk0pint%gf1gK3Ur|t4a_T-b>Q}FR`|;yu&xlgHT0Ad==Kq|mlq#~@^<(GG4Rp3!a zvOWMT5T7zJ&9j4A@VW8S@bACck6LflWXj_FGg|)twFB|nUMeQ0>FH_1mamw15KHV$3QPUewp?@Z*ssKN+bkO zm^7eSIGGv$=UK-M{y4!VW)B)B5{P+r2Ezo58j#&bh>=VMg+F7+XM0(ETU-OABjlL> zjQhUeuH~>xg4k!>hMu_f^Ji!SFb%?u$|T|bO1lY;cTAnIu(04b7@L@Y`<9cJZ~qEA zEll_l7^#95hUx|f9_DENrkUTQdMo2ZoNHGc!B)?VD~% ztcG#>6_qO>2>L#p#noTGTqeHUKpa4Q<_>JPrKhPyaG$TxC_<62k3nGCx^*iS3f=RhBlE>TdiYlU51xQ1^0XI43w9M#b--e6&CSiwl<)I` zVh9Wjq>^@o;4LNwLA?*^Z6LEh#A`h7&6}ADThV55`@)F$w$la+xo7WQwA|rr=tOQn zc*6TP#lz4pL$RNUiN}F?U8_ETMTQ!xGoruz_r@=HL-y|8eNY;X4&^2%*hEK1M?uYg z9~o(i;9~(xM!{z{cwS@?rwgSPAR535T=0#~oFsooy~vIacDYDG>lQSd(-Q8kt{B18 zxNrjp5Ecih-e~_2YM63iW@bkFpSH%md708*8&&fk8iCe*32=m3*WhHsj}7fDwy6*0 zp7{gXu(oHwm4cR^&Tjn1WW+&f$Ehy$-WEF;DR1BY>u}X;gL0iezMWstyFhu{bmd)E zy!zkDAiQcU(tg<{)fHN?z=FG&k6(#oBz>DpLbip1t{$Y>ZVTle@Lar1EW74sv4D&zfbo1&&|)nBm^q#tNpeRR?@o+7DKhlxT|0+)-2$a(WLn@4tGxc|58& z$GBk^v=G>Jb~3~8mqv_Q^$oH+he3#_vm-)~3pzkT}&rVUi|K;c5I zK&K%AU%rp~!7>5*g#0GE`|#-jCWU0rYY?l) zk=llaL((x~E=_03`Ft@7p<38@DGX+JEh3gWKIR%W4b}jJ0hScp*XEGl%4+s%04dMJ z0EGoypWBnb*1KR0IJIH2#4$D-J;cZu7ZVfn{J8^(xVM;4@21EJ*Of(DCm1nb0-{im ztL()Kc#O|dv|yWISwPCN68d8$zZG=S!Vk_!H40GS?7q}|#vg?HJyn0Qqe~RJ&x=Vx z{wCvHMwk-_FyWGkz|Yr}Uf;E0*zfbZJZc1jCTatSC?pqt3*N*|6rOAfJH`x9&qD zxSN@r66D@(#>3eQqRx}l1j36A@^`fcx{>WpO^npk)C>&kfC($#5s+9`bqa^6Em<({$aK1_!Zz+4&V} zAbE0h@~g70yO{lYj?z_BT)YnBl>Hrt(P}9Q|$}f#v4A1Kh~s( z6FzId`|WQ&9}=qdXD!_SsOZ9h^RFl_*aRIj&L9N5Y2&{8;&5x1Tsj@k;q?6Qgb)Q` zIj6)o2?hz4a+hxet(26<^*0ymPhU6BjGPRsUT4n~acC^goQQFVoogs=YR5owq;7&R z27{Z1?N26wb|F{Ck0(APTzGx(fz99 z$U=hR{&3~Z6{Sz)?}yxL4bcxML8WfY5&jw4l*Bcx5&XQPu=tjZyJPu@N0haFI!=TL z8gY8pAM%}XFUS7*IBwfVf9BhQ`*eS$p@xQ#Y0a}g=G`Eci_r5GQs_k;En(U{w|N`U z=0g9!zy5!=0?jYTv%kO7Qd2F*%EV>C4zQ#Q11Y$ZkV(xECAm_v4czW`x*? z2rXUR>#@t^(a{eeABa=j;quz)nVFf_i7+Pt3(k{q-Iy-M<+7U|k*!J_p$Jj*!=q4> z+}Rb6__lP4!QbH|Cz9kOv3C5hJHZ?VMVyLww9kr)itSzV1^6j0k_pLrZrCM>jpEpSv@f5yb?v#GCn>Ti8Kc;77|xb>+ko%6efpgXo_zQ zR3RnhISR!~qYV#xJ~`t`TTz&rdLl^;qd-=_n0(flD-SR-_WeZfglY2R0=GGHnvcNh zy~jF{4jCvPs?-hKqP};ka(yv6(57fBxhZsl!P(Ol19+fuJExpU)Wv=0B4EUH+al&L z;{U22B%PL4#QT9WFmCqkJV#wAy|3!f;ln4Bz=8Rn)O}1@MfTC!FTn9L4>Ae2Eo1`= z%(i@bDT9H~*3TkdT>@7K$pr-kaJb5)g&Vl14ODKH0>w8aB{~TlsPj~+TfiT1%cP?W z&=taBHhS)6`P{b|SI2MYIn0m@Kn(2NS@lnVz1C3*QpdrPJ98JBZda4+iuF)megl`8S<%vn z9rU&8*(30w^@wkf8`-iQ`VZO#t4Dhz^C_yxXXmz|yHGtgWBoX)v@9qMm2|W)$qOC} zS2LLRIfCbyfHFhm!iTp+O2J#(XUX6z0++`8SSt|Xl%psttFyR01A0m+F2}IxnbiKr zXagbP(&uIYcOrn1vuG?Z4+ym`=qN8@6`}-cCl-*=Y``vq(gDI!P*h|9VGYS{dMO3t zA^MnyHLW3p*SCX;-_IiZS|@*ey7D)r#3t;b3)nsPh37O}f2X*(7{p!Q)(@j?32vyV zI!E>LFw17zUjH>+i4G}L1;McteGM%LPvx3DuGnyNbVMNlY`lEA7K2cn-td=7ah*6Z z3Pbw)0dzbO;E<=q`3k$aXvFLWeWw{8P%>ESd>=v^7VHgL4^`iw!gJ-V(R<(?XawzO zDlj7gPU)hGhMF4i2l)+@QgRV0cx@brJI9Oh6t-wP&`K%D$yxW7ETCXwkP@?Ci1V+{0QAJh&nDEqZXhr3Zri;^xf2dx8SUS% z2F^v`Wx)9_H)&+%&Qwkg1NM=kn*eZvs)@^PihmvOsE6_j%*{t0ALiIjN&gj>2c@)jA`$?;1%~Y6s(C5qfCOq5L7@W$&ybV3 znHhPEI{=E%^$(LPd#h~vE8y=tnS^UpO03({v4~{d0e4Zbv0ZT1#k5}O!4^b22DHf| zQ3y0pu+IW8$&qX~jA$871Zl#foihY{gSjU1;8>t6-2vY;RddI$)e$rd-unX%_>ym! zdF2Ms@86w*A>D5DzHo+=B0b?aUTmfSVGf-?iElmLXCv+6Ish%wZC|C2&*jUHDA{N_ zRMTAuvIS2W#1`Rymv9`tiU@{z$*s1qx;S=iM20Jlc0h z(NGnbrf?%k|GE@pPAKoQ$EHDMjD1*59S&8&qR*oL#RWHHk5nW}N(jHAMUE?dS|(fP zsvT?Pxd?nOj+5M?5Qb7vaJ*(~+3|Zs({TyVb%m^Zyo1W`yuZh~pyK5@Pw9v-dpm4i zjQBDyAj_t= zq&;E-WnR?Z4KsM1TGL1U>xcQvf0gFs@I#Z5RK$~bub0fUqWv68nD8*4bS|~B#m+r{ z`(VaPMwFrzNd`S+Z-hZdc!z;UV^Qxh3e}Eay{AY01HVNk)RFImak&0iZtSRnfGds@ zU+>`VmzdaL?awh+<0>Q}(YwU=m@I^Su3Y${>u!SdJA5u$>i1gf68n5z1InFm9F52T zrUboDKZnv}Xccm_0STVl3gT#jFb0{<^8Z8^wd{SNnZCQsE!U>leIdPJCk%rnZmx~2BRa-F&uA++OVOxV8Nh|_a@ zp+nTm?_30V^ofep^B2obQP7GR1D&ULtxsKo#u=QYSK@ftHYCU#B&}!bMCX3@bQL^< z4MsJ8{yG?t!)xmoS!_poU;|xpDVjz?%@%6~JY*!gh_kC>ID=sg`Qz_LpFQzb{0cYl zy0;n9FR@0Z{2ni|$edy&Mp;!~3I;zM!T8|`YhK+0h_EH$_0kNskT<6E|xDh}I?C>h01=+3{FJRU&jy8>Xw7U2EyX`nO^8~dk1Q+JGlJ;$yeHf#;%ypv}` zAWq8%d5&F-r|uGG%c>(pL0aN!sF>%!h}TKG ze);$&-Ty7^KUhM-yXDIL(U)?un^&UT^gM0r$Cz=nAtm1Xl}pb~#iHju-q6s{ z9E!{4=E>8Z(GTzm6Y-1>tAiYQ-?}kg{LJCKhU$_toaRGM9zu4~u`1Yqk9Xljt@!4Z zv)`lNItv(!WAdkGAd<8zKT$u-V)ULT!_QQAS{^GtHF47oS z;($cFeiF2Hs$nX*bDPF!2lp|V&Ize7Pn&c6J}$lgPQjESnUe~ieH zBM^jVtGku>>eYFw8?FQQk8EKxC~-_<-GCnMDW#uhsT?bPOcsZPII)1DsBNI-Ib3(R zvh*|0+>H?OV@t06lv&A~J}4?ED2PVS>KZ||Ign!h@i^E^^W9bdcwJZk7NBFJ09}+A ze~SO(Kc-_k58n^C1RT-7B)R-;Yv(KmUAk-v&fZBx&|m&UE>$^ZungopM1Za)ha1|K z9Bn{NHhp5Sz50V%+{Aw0mXw;1B=->0tPYMlIVBYdI`KCW5h8FQL>u(TZeAdNRz7IJ z8M9FSVq4y{oyrOgdT9p9U~KperbxryDWe+!BFif5XlsK=ENRKeSa{T*QDkwtzh8im zk(L%I;$RNy1&`LJ)j7AfDn{H*r6M{q(hYKTIT@EkVtjAa$KN4roObEc#6D1Rv^pSiGwdvJ z%HZ>Ia&p4+c{;8w+jU}+RH`lvmz0t2%ID|j|6XbK8A?Qs0snJJuVtChdI~TS$%KoO zvyJ@?SD_(($6-&kNGzhbHEztM_~LQUs;5Z(CACC$?dFI9p^AvMeV{(gmsz^_Aym}aK>0162-*U zmS*lq%D3oskR^I5eSQNQZZ1L{B$_$sbPr6brT#t%~=dFYO)CzAV*Ho!-ED*Plrzdfo6a5P@U5O;2D{4eg_ zJf7-({~zt_UD7N~hA1gRgha}aP{=$~GH1vX=y^rlsRINOl3$JOBpNk5JH7m zgpzTY?(?JbJ-_ew-hb{N_wo4Md-vl!&N+d&1f&UzxEbp8oy-#PLFCNu)eHI5AOyT2Y?=a!F;sa?yldaNd{BR=15 zGjU^l!%z-9X`zNYp4@v6DuDS@Zs#vtK-Wy91EIRFCf&k^#bI&^%LL+L7C;~9=YyD` zEc)zF*ypOu5-L?L!=!uG4ShG`0cABcq6gR2?L_$t)TBFZ#q;+^F;$6l?ay+uR}qNP zcuXAHB%Hs7IAHdK+P~NzWS;uuiJ~PJFRwL%>~JoTOnMVm827>ANO32PEBSA@?7~H}U#F zj}+X*L9osR1%0Tg@jxT&hO5Ut>;G>^uOu%B{{=ut&96KzA_w&h?*%|I6H@pIx43wb z=COdZcX%`rS}6W(sX>wg&}m9hTJa-&an6up)cm{@0%$7o{RNywDIGr$RV~x7#9=bt zTUy*gRRP%_`(<+QJ$i)tni}vepzK@GNn}df%#Bey%{6^cg!H+nYRJf3*TQtQB3`%N z;czV?2Zd^|CM11i#D+rH>h#1pSIT2zVvzI!fl$D$TL3CVnsQo;Cp5XS;w~t`s8@8( zZ}3-Z?jZ7%wDJA9yfRQq$M1ci$gWq17A%4Sylvf<3Md93!2e!4+l%O{^}kSi74?h* zJ{>s%DT7T*>c=}fxMRKzu{aH_H5nQD#eZuzKFg?EF>Z|u6Kkh`x~w-DaZ-BpU_a5< z^*GEz5j$FXD~*f3g{SSQ+Lp43+I^5E=;`SNZVu)X+Bpw%upSClAt@BxLSRJ$XYYwY~wK8Z+2Z%m~f5 zA56UXR`k4Q@30Q8b6sBaER=!J8(pshz+TzL{e;Z~L>01Bm%e}WVn6|_t;8(YjzmiM z-u)JTRj1CqlK*^CCW_`M`93KCuXUKhzwFH*A|oZ)BNIi6YqmT{e+;=Klvb!~M*imm zX@I5|$_)_jETOk(x-aaawMKv=U1!Whd?;^$WdnQpqf@amQAi#DP%UP@4e;i#u^Gu% zGEr5fNwL|NQ8Qo(#*RDAp4JxH5~*64WWhe|QQ8aa8{%}B%0!!%E5iVfDtcK zI-UVCrIe1aT~Q5x9D;`_1SDAg2)NEZf1xC+qUr}MzU!{ti4jV z`m6K5^eX~`y`W_O`Q`I@KiW}qK(h#Xgn(u5Rt3DFp^vfdX!qyOCs+$_9mUlx3Qh?b zVFLpLP$q*hUr(#VrT8IMOb}S9xHt)(3#`c^#8Do71LOcYX1tK8={KBVel#j~e;QF( zD|7%=+O%=w*1abZ7Z&C5&HW~o5-sqBfu~QOg1DGPvJMAF5|n%irHr{@xLzP%&Bd-k zzmEoG5wM(%t?d%~ZKt6m@4^=^W^Qadg}kt9uMB`T;g4lKeHt2~Qu-MRKgxMk)!^lE ztcvL{Q=IoW383pzQC7ZoVlQ}x9;9*b67_GM^I#otWJG`g9Ria#(zkJtk!cAqH1IcN z*r^O5sX-V)o1+qQH#~zw0|O`a-orb4KZ70neQ@v)w9-{osDHYrX4?rY)N~yjA@J}y zUtE>piyS_D7@mqKBF>LC5LK7taw=r+Nd!s5b;`9v_=sAid!J8QIH^Ba4D}Ic(l|9s zpdMm&pFrrrHMa2iTEofsdgSmBf!N+B1KITU+<-p8Y&#N$%cyJh4$c9H{{8zmsypEK zkMIhp*VY#q;X@-p2HX$01Qe!hfFt~tfA7<_FL<)9!tuza!Mj9=6) z=t}WoHv8Tp+^c}W< z!xpZ8Geau<1I&8@Mllf3ac~$%6?VkWbHjN>|BL3@bSmy)*ehAOdGaj1P!J)ar93yc z`P;zkXh*|N?rko}PdKBWzwP>XP)z=Hc_MBQb$U{G437DfU#Q{Ee-d}4V>gTkZi~f( zFR5zKS!!kRH*psD+BmgrrlnU-7i5#1_ccLdoIY#ab8ICe#(c(p1p~3$GAXimrX6?kCYbCd6^oEcLY!&Bs z$ZRiUw{0&?J*}!BRbPG%l?njrzo)xz^lD_X9vU?@^U-ME5;J`?hUSV|8-W+8YPVB< z85$fIRz0qfQ^5X~;bW2Ct|=BEY_6bm05931{DVh~GT%0MvF~P#U#nSD4n1v0YHWH= zVz6amHj2x8E!2{0L-*9?fi3bOlDUjAiN{)83>FCF<1^zVm~70^Kg< zv~gvwWE!LRn@B>9VDxqYLrWRE8-bB-Lmb81P3dy&6i; ze|Gr|mIb26789DQub*W=?5o7ydsyPT_Uy4VH^wTaZQ-?w?A3uKbacEV+3%c}>>B^&F;H)6bFV(`WLQ+xC$K5F<9F}b zgW6S}w*aN^Qo7dR{^>2$eW;T8k#q;1rJ-TlrcH=f3gm=_@H`HMSjTfx99j#=BgH~Qni+z;Y;!ui&?w(}+XUZMVRx2bC$RnC zhh7jk>O(yP+yEX1yW{!*&{4xf%><&PdHu5!yM)&u)D;1Domh16$3UAx35Sttxt6qb-2IjJll{Gdr z^f6yREwr|m3%l_(SKVVPMy4I)=_trp8$w-=JbQ8_$zc123harJUsbH&kPQkQ3?VE< z(FM8&cRq^oQV7+-vrxi~5>bA$A_4>Sx8RW@h9w?OZf-Ark(HC2Um1WE_i9}rfjc2Q zSnTY}eJjg_y=muXz|TTWsJoh7#ISvP(kyd+W6UM)`uh48-DARs=b=9jDpjEF>l&MZ zk!1p#1EmADu~Itt#hY56_+y9%pg_j1|s9y-W36MS7 z(NL|rF}KkJhb;*J99+s0ltJLXd4hYPg+VVy2z1dZLLDpR{}L({RE$U!gwzb*e9BIU zFl!&*Uz=4^wRx^r^^ zw@J6U%M-D{>>-v=g)&A?c}U_gegP0w=ToD^-{MNqj~?V_hS-Y6(sCrgT zj%%9)B+1qNRKzR4ADr}%q}|nbR~tF+bC4d{@l8M+QGf5*y}QUjAoe3yHMUhy&yk*g z39W1V%hfC82O42yh$G0G2iE^4T~&4U4&(e&49SVp4(R`s(gz02sT?Ipr(?W3k41Rs z`ujm-#zCP2b6`udsSqOND6Lo{)9RPjnq*D@r@P(9H_S?YUiMtCkHo)rOmv-%_=wZ8 zD!LX_wh3P2uW-w|4`4aJAP&yg%79g~m z8lu}bfs?0QHBN*JB@sBm6&zdUYp2L`Cg2TRO~B9+Uz6{1e`-E)|M240_p9|oe*11_ z=99ok`g%~i7AmD7F%+kXj7F1Vn3+YBl9A= z#PH3V?JUJfU!^>QlC)-@Zi+?$$}0eERpoaGMfP=>D0~sa@7mL3{e^H1&|09#(`2CNcWHk^&_2;H=Yn*~;cb6A@`Hu4T;W^3^yT{t8M8stfVE~3-Ax!LPvY;}2L znEEBuxnSn z+sAFnpR1>@9~&1(NI6jK*Q60#;nnCq%>mR~Xaf*#pI%5HwFuCz($?AzSO4^-A7IX^ z?g}{%C{n@=OqjI`6cVLJqTw0 zSsIJ`6m;jP`rtTxnJmKttP33NmN{ywE<9s5fbmPqGWqO=J_CoML0I<37!%&P6TPgG^mHLZ>jPMN5R3R$1D`-}p9T#=<{VyVZFX1{C4 zj(&HUq|+gs%$5SRh8M=WP&6^-_nu>@I-yRm=vAZNoL^x9Se8_RfPP=q!pK9vV@l1u z=jNP|ObY|ARpkcK=!SzkzS+O z)L2LDlHS9sef`b;?Jj*rwtwH^XkW@m>`<)OUe%e0n{S4dd^BOmf^}Mw|Yzz&E2%57=Y$b3s9hm-~?~E#1isT_u`DSAF}< z%B0d>Y=_TdZtqi0jDAQvmrIGUl&Apdx(N6uKfihAD z=#VQ4&j9N0kfYI?g_f4bh`I;q>@O={a;Y@xG2}-EFp`f(UdKUAGrCgTlkFZF9^MLr zQGeRxyC;%SU-X}t-=aBafr)ogwEd8R24_q%{2l2vB|P+257}UowzcPUo6hu>`l4sL zV!UNeYeqAP97?5hgtakC7kCKhcl}HI(q*)l$g=I&^+qJ~s(5^A%$0+3Pf1@S7>jj7Be0PNR_dzwS%BCnIqn`;jpN5>8KLStSuxX4lBN)->ENpivoyzBT> z{XfP4G+7YKv)Elk*7vjV@wstPs*j_@btomft$HFxX!68OgDEHhRC%WX?t7N@qOU%t zasQwOQ3SIpY!rTPIAh_nUxs-!erpBO#4DIG9HDh%e~YWMWyBve%PTFV@WZ)5rJdrgJL+&9knh(#mV z@}tG?1x204m~pQNR^iPXy2>|_g3a3>{}PF5AAh3FklLgmRR$1eiLBXJb<9dI1LgvU zLgo7k2YhMdOMO{EGEo}Y@vgSt(HHO+HWTBHE=fD(0V3+}HQ%tr&}VnW<^s#5Y?Too zrKRkb5T89S>jOE)zg7Etdkp)w5B2rFvOu3Wp&ttu&`fP{2Fel5-VQ1V2PXk*@80$- z2kKypytDH1-vDX-}xnIG5leL&t{Vo?Uoy9Gs&AZFW z!k5RMiUJbOLcrSmEv5mj!sW&}nVHZdSYwZ)MoMl`eid3ggG2tW_>FzS8XMwUpD zXrH1Kf-gXV2xB?{$2(1`E;0OP4TGtb;j@bu{~HIO4=RFNo0&u7;xcEGV~s}{9hTCk zr?==$d*Axm9v@b8aUU27&qVp<1fFBnDZd5Tl*@l7${Ivj>~Cp?j}TDEs%`$?U$LC=->qi+eb$+TWEpzlENkTH$J6avS}3UDi(2WxD&4 z`vOu2Ls)RTW@lx=ytHj9$oqdTSVG&K_X?U9>nY6;M}|~iX_KA#zczQhr~Sxl7;w^y zPJ?nr;6YWQJD(W?SGcWZPYi%vrtYuMPPDo^=|OV%r)AZe(AF#8A5^&{fc4@L1+wGk z*ofpN8K!wo0>uV;i+UTAb#WRD>I#($fX}~p@df6oQM1sqzW2F?X21D3X<0CO^9*bR z@AcfSyV>^aJ=agwuQXRJ2knf(GYe7;kJ(X9bh)SQS0Rx|2(zueCyu+@Dp=X$4s1gTiFmvWMQ9sCWVoO{k&=~m; zcKgC^W3RCS0PVGE18@B1TZ_o+ms-Ek=(0#n!<+)x%=+oFV&5QA`uk04)Ies=j$_`Kb#=gEu$J`OoCY zGV{YE%_MEF__aVMLq{A^us!Y=6nMRCxMW6KMDD`?h;@3X9!fIp?!8z9=sC{#2I zyQPJga!PntsaIiNrjl949><-)GtjFEb9WYyhX3efQRitP!I#L7W6Y`oC4(3d+`U2}^X$?Yt?%iG>D9dUiNM8?yW2YL=Qr z_BHGz1LU(-WT>K@2k~oG`Zkrmq6F|sD(^d*%=vO<-YS%FNMQT-A@_lHw^fvYbNeAH zcAsFky4|#h6)J1XsATFnZqz<IwJd&jd*M zKI5wYMKWQwgYDWlopbi#Y4D!oZ|6q#n!O_Z{Bpgd_}$z!u+~34B%xhO`*XC}{am4q z3WiiCKQieku!DnU(ir=Cx-&z22bKU}?R0Z6oc*|GCC$ zi#}c27w&pv_Y~6-or(GVPk1C45m4OYVDPSi$4Yg!v~COY&9!63>q_MTR1k$c zj4E-;^wx^CMSX3&^qhHCr{)KCnE9ujBEFCvNLth@$c2mq)O}fTgsIsNmGQ0uW$7?< zYUMQ>)v87zVV!}hu4Z3&OG`^wSXi)MNPTVXIYq_$)8giTML0#7+2kN90tLI--lDp= zDukgwO}` zYM!~_CjWNfQ9dnb#g<*oG=70$By?&!*z>s!LbPp4)rmza@(aQRq}p?g+L!&T*c2iV zm)+4UEpl-HZ5O~AKXG0a@CXUjP`VT6-aTVe_Ux!EAA)=}wRYuMN$)w0-s=?Q0!2835@-RfYKa@;k2OJw;lV#FW}At7wUttbY#Gy2cu3gG0? zIN|0Z>bb$QZ^u_29Qp^C?_hB^@P2pzn+BZ`7hf~xCWz^-;JUy?(d=CqH$Y@Og;@$j z%8>4k3)}bxdamMRzXaV^_gEw)WxCh_eCMn}+Y8i24u$$$muNn^@Ns^I#GakKuR5BVzi?P9GrWG;mGn8~d&47RO-(2G zlA)L9rMPh9q^Cd7nLA?e^4a6Z-?9pOM^K=?{d&LLYHjISdBQBdZJQ$kYY4 zM?}(jGRBTk04}F?j~PLRhCY6vaNzNRZz&_1EYOW;digerLxCe6aRJRyd>@%R+436YU+11 z?f1J&@$9hc-+t9lqPk~ZdU%z9Q5_qf&JG_|!7NxVo004?^oVM03jRWHmK%YItL_IR z?}+Dtw#Jskbf%~i9*wOoUl-lHG9^}Iw!P!ADh(q9JfS3RxinBrqn9FGo=UimOpRpZ z5C!V^o+{TaJPPr~_?n_Eze@eD8)>pV`F5#~Yha?rmy=t@OSS!f?qiw2;7S=?F)Nvn zqZ+^iUeYd9`mW2O`g&#kxv+GNIn$>F9@>JH0AvhyG}q{2;(nE5AtcwLbZZ>y*o%|^Qennm#F0G8#tm@L@;3jo1_fdPDvvsTB*^Q_n; zVW|QVrS%$(fvVrK1o%^srL#|dfF=&wC*3RJnVX+~Ufh{6^|#Mm@Q7Nn4?|+cfvorY zA5>*Q!r~V=w?Li4y^SsjV4tg@ol2>}{4oa-iI(h-JL0Ir=M&K!2vRzus~g=yJ+D+* zT@6#P3Fx&d*=6wUu>At#A{?#y*fPI%@0(&|!h2PoX@Qpx5^iK>h+w$w)MDyS{RMNW zd6fKs$aS((Qr^vJy#O#nL?-Ye^Yi4Dx}DKANjHRm`!OS`0%I}>?r8?JT!g+6QPpT` z!bUK?RgRYqERCv)%2fQURs3bBNSc@7=t0}Ep5@*hkocIGtG&?^T1v-N^7(P3uJHrh zo(JCo9tE|p#GBTlieHM|rngA$I0L4O8m-ETk%=g)4-a3+GL3gU%3VmLOji zwp3T^qkIVCRqt-zVXiXZB0kM`BP%51@nhM(JYv{^&M~Z?izmVTCY)B92+j zgmtiAs;2OMYXPwhiE(9oe5}IeigtE(7~YM1hv2ciiCVE~IsSSh!`R`(F*yjz0aBu+ zMQ1|#Fb(KleO=ukDZY4Ei*l_9AkE5@PRN)KYYfku?2azslLOl`zK< zXHPidOn#T1Zq_w?<$NV^6SqoFLSp<%;wr~`kX~C;Gim)gyq@TCzRDK__vf{qA}*u% zcg~^#@N0NX?7T93TX)TTVqZe3Ho<2oGHMj&+M=2E+mX?QZ0aNT+#x(OFnF5SdhOLr zJoLY$41W4fM2Irvp6>JnaRJgPW`q%td7V?Fh@`^vAGoQFQC7gq+b1p=d_%l@($&d-i>4Qk~`=tzA($I zFj#F5@oa;`=?d-{t7=^-n0mprx7Ofb)~Fng&z;5U&K$NdJ3&c6I!2x+7K<Z>ciQZPV_qldmZJz5TUzE_)h7Nw{9j*c+weUA zD2l9Kw-^`_G67MG_K*2h)gCxKvC8^Y_2fS})d%UXAvm$H+XuHnWWAyy!UYhPei0(f z75kzOe>|^izNG((T5E!1BPU!OSq;jT2M>Z_#d(NPo!1u&slw{3()2a|q|wPl-Q@g} zK=e9~5ZytQ^*{7JQ0f5*0Cfm4H_kR{?I#wt1wM)>F;w9MgJ&~;9eN=~0dF@w(PwdJWXyXni27gMtjrL=loLa9fEt$RnC)N{Yw}gxDk%6cg}Y z-0xA+e!kE$H`)Uu2jl5&f(7~#j_<@+P zLvmtD(Wb%-jjO5={xG)eF#P7~DtX9^s_`hG4J3*nXC` z00;lPNcjFBYWN7wsSh|_DXqXur?PuVKqX#|tKa@zzngRU0%&_fEUx z@k2mlU~YVh10H2P(z4J>E2V>hYo`dUI>vvBgx!9F1%wB5MH&9Dw_g!1Lsq-??cIj{ z)4g!xsd+;&PH81nP5S^tpX0rtrF9^WD_jdZtHXE^WPi{#>4Pd9*DMHcc7&ENGgmk_ z2}KCL-D$tsvF@~R*rm6`j6v^(`WfbP-0;e$N-<6e3=gy<&USZq59kaYkPw!dHGy2E! z?wQR~I}RD;xC2g8N+)2}DE?!|@&NQrIzr?m?t~T|%L$>>Jl$8~ma!A(KHec;G4h$d zFrTv)b|P|#(Zs5rNF0`}MZ)T}O1ON5yrOKMuBEmEMJz?~G>E+KWH?t`iIzhUy_FEI*!z7u1^hqf*$P2*B-UtikTeWr4=T-IdwF<7 zKN6b5aM0jk^fz2zTsd&}o!p|$-TfaRtAe5X_I6H;5T0-m=T?dOGMjee`$uv5Fl3fR zMGgPr2xNS3-Sqx@lp=#Xdn^pjFsIBK-W`H649^>NxCP`uNUk(W|MR%##zgP9vq{{&-#LPdE>TiD<~t)`(YuB(8Ahpt0g4o@|!Cbp?F{qsXn3KkCRd< z9kOG(k26qECx@fms|x-DrcP=gPgEs&y~)6R94UuBI1_@=LA+ni(IuMCnfIg9#Ara? zLBO@FKxP-f?T+sMfCd^H{}6?Lf)k3ML$&Wf<04KnCEWDXpLy#QVy64A>7d078m)_r zi0}bwOl$-$E7K)N4wx~7MmY6oS&M?>1}S>ZZQ{fjnF*(JiVCs<-;flfln%qlx{otR z3it!gO@Avi$`J#o#=#-edmua^p%<2Rsck8UvLFDCjTLhr7tsnvXbC*zBb@RJ39_}Z zt_y^@>_j}djV0K3KeM1AZi;!@*uBfBmMHUbU*j-95 z21OhH1HvGzuSClREoapP9`t_$F3e9&5qE+#k(DyqK520%P}w4044W5c+^VQYAI(0B zd40#yHmsamZ{!c*E0sHO?(>7^U;}EZ zXFUVO4Ma{lN=TI=Vy&=#fC}&&J{+okgU$rv0%PxAXDQ(=)K>MA%$Rgio|$O};U1XG z$*Lh7odF4BxGbb+KVMTyCzHv<+?jpNs5t9kWXB;MPWbl;SoVx8pwYE;C7Dc%816pD zu6ElqZ)=6(6T)c*!H)BHg!#H$RwC@XBgMGg0Vre}9jL;GSGbR_3Y8^C*i{T0z6H5j zO-dqeVRW-g@K}dxu^S6#2me{pjsB>Pdg0SXiMaXV&qfevH@J2#nIl50lcQ;d8)+r~Um;+TRymm~Fif7t+|$!F%-2XBPS6 zi(9ki<3IcVJm1sD_W!Aa*EDYa6ZQgA>fir+|JWCRFyo1s3B-{ULG- zNyblB(ohs(HI{tq8WA(2jPvP8o$i3a~U3}Y4{SpUOmXo4K3s{K8#UL zAreD*FF*_c2^6AU;rE=PCWnXeiV6R130wjiS1_EI*>V#4%3c9Nkf19o$^_i<=voiR{h>KH@(4HY5G?Q3w7DD3 z-qo7lg+ZRT4RSVsI*<=Q1rKNoc00;>6en<&bY$swV7NM^6=ee|AFGWO$PZGQydM_U zg85*SRx~QaD@4S`5^nGLS*%3;DG`|Q7X5zo%Azz{TCQ^i8UT}db`W>@NK20qVsQ*B4|(SL;l(HJp00D`<^2_xA*&RQf`L%O3*P2Xh&-xr3)2<4dj$_~GRY@5ITWfR z-H`!-`c{SA_Q$)?{m9UtgkKRY5IqNwd8l47^`l`y!O}9V*8Bju(UPUyd%k&WAH-D@ z4i%sTwzhnRcgto4~`Fz%5uj$9FN_=0XoIj#-`aykLs4v?3*920!$^}$7gtO zQwRy6E;M|K4Rxpabx1E`1I z1QvskKfuJAFUP7jnG9#`CH$`muba8=p^Dos3w#+>;s%Z>Zgdrk4 z1q3|bjWz|l0|QRoAIjs-CHiCwFQHZ&Lj^mFKbl8+JQplkIfLF;(U1V3uK8~PG;gOLukiq5U zT|z#Vn}#tw|j6*@su!Hpp=2tJmujV)Gm#W=+m|TQW zUQHE@F4I(Chcc$2t(Dni`fRuyLMeE>;^-sGLbp|FtOkv^HI~aJ_iJ@p({pa zdE*L7IOvYwfXK^g2V~Kx&_6Ow11ljWBGNdE;JlMOJhvIXegDq2aL2}p5SXasSYUJi z046)!joq$p7L9PT8rdj3U@$G8`}!U+JZ`fAbi=~R+Ib^j`=5Jcjd!GZ+Vh=KeIF1}Xr|llM;FP%D5c?zg-=BKTKMZuVzy6aj&P*0+ z+{5timt0e`|4%A6cI(xD{nv9^vqk{_&gvFkv*z`>|NP-KFW3C%W!CID{qHq`EBG&Z zlYjr|H3n-q{?r{niZ=c4e(@rf|N5M3PR~whn*KXmd(E27|KIu?|F^$^M0X?&8N)KN zk96eqS)&qPN}Z;0=GRxPSk^+#8E|fS3bt`FL#Q@64Q>J}4>x z`${4bYt`vAx=16Y9H@9t0- zySlBdqXRW1G22?|(FFj1m_mb_s^jhPEY=9)F6L>{HCoc}G^si%UUs9GWvW*|dsEW` zsMQh@1Uv`>u7<|_w6vl1jvuv_n?~~}XO{pL%+!5eD|J@==3q7qmBIyjL}Kw9FOR=> zS@-h~Ytx1mAC5Pw=W{NX#AD_=Ob7_m#&|;Nn9mNzv{t@$9EkUpe%M4<0+|x4ejk zYPb(a^yJT>c)v_%2q$2U%iWmBM(kH`5VCRby#pRh3a{l0~ zoubw8?EMaGkU6*tK=~#9NF2&W##_=8bSk&WlBQ}8m;9i}mOTFmSh%FLl(4898u}nI zltv?omu7GTW%@5=(6jLU%gB~c@5t6b=a1SQLyB~@wdK-gr$6O{%v?4!Gz9n5W-~T@ za(3OGTS7jqTW9aL*&uY~N5p4-QBhZv8B>ndvF#V6Hk*)ghePi2$wfKr(bL!0KYjW& z>|kG}%3*$)OUwXJ((K;QEDvz-VFcop0K{Azd<1NqL-rlKV z%{_BxP^IDSu=||J&NhiT<}|vG0;NM~V(zFh1}p z)@*$0$4{QrToyVJY=j`h6}olnUR`DjpG%R8%HH~(?N#o_6`*SvIRYSq6@nv=*iZ)f zr(W@nIvn_zu;i)6op?}+(!LN&mD}aON^O7;7Td!ntMj2Qq9P)=hq3rB?5$`N#HF|} z(ZEGc>L?u;8p`8^z6%%l)C8gtpgX$p=F7yyqo}AFhtrLt(|A}Rn2A0)8G8ICs>%Z^ zI#yOzkb_`cXI2*F5fZ$kGC38`oimw$-PP2x41hTH-qf#O7&}TShA_SFr4uJA*p3c& z%+dnT?sDqhwaZf^sf9gk!Nb!u+@Wx{0b_-~s3bEpsFaAWgwqYLuwm;~LTv#jiNy!anLI zH#I&4a=dBtW+KZF-yz0Lpkr$J^vUXY?2Q{Y@V6L^(K#LMZTYn?E4irtkURIM8VpBFP?N%ug#{4ZD2^Ko`Cwo+WWtRY>hPoH? z7EtNH771FI)38wB!dauQ$MTE&km-pI5MzAc<3kfuX?w}Q0CmA@XaS_9%K@FXoJ4sX z%pwY0)wVh192Acb<6SXu9ueUpUc3u39HXFki zcDh%uJ~PSzo=Hsjv9mKP(4#DTL$o@tpddFn|HX?sS*G3tJk=YIWBE5WYRu5(b*ea$ zk#Gt}T0G!nOoVxJ8N*C1t66e>B9)*Bj*lB}5<5oIRHBhVv!j}&=0rT<&cZVv<{+j) zz#iCGW`?gPDJcm5Vw(w>E=|seJd&!_yP` z1%OCRcXE%>8zpzOb&9t&H4#a_n#uBr$A>2&ZdYI;Z$?fI@fjXH>I3`>-4rl`z18z| ztUs~nkPC7DJ_80|pf1GV_sP1rt&~d=nI%^g@t3OVl~F7r1>?iU=Xle`(x&VT^*GXT zea*hu(25o9Vg<;(khwmH5+H$%Sv^y%TwT=b$V^wHSz5Nl6Go<-PmlG>&<8&W= z`!uf<;^NeXq~Z1UmMUB=sKzV3-dWTC?$zeF8jQ||dbJdZY{^aDhxhdP-sSj!zC1|2 zAH8RMbo5EsKajtATX5LNkzUS6jU%YX0jREkZ8SRGPZ~+3r9P18VC}sE1P+!4uBrDo z&tboJbRhF0c}m2fE2hb44!5|A#~0km2nwa;;HhCz)I^SZ%>RqS9QuUaffQsj!1@g= zHf@h6)ujl8xHOatU~hql0lHBe+CS)VC`c_$0ts1_rky38$2bPCJ47;DYznZLQSC$c zbnW!%fBLUo$1p%;`e<=isP7aI+(Ja!ix=b2d~*INTHogs${Uge%~`uASZ=)0fZPyrSM)5o z_Th#bv<(eaB_3jkH~=pL3-naEwC(JEps{=;#7d-MM$KiiAV&3^KoJT3UXiT0L^)2;Tqf;S$Iszqi_YhxtwUM$7{U< z7aeA>R2bETGNctRpa<8>dVy($`05~ckd*X>!Ed7+6V5vGCZHVLWV_xH;;Y7;2VB)~ zi;0J;N?Hr%!_A>l!CF8_$PM}AB$>#>^6$Y%t>`iG5x!Ln%@{r-vr@yykPZ%qdGk#a zEMmux15;^!|2}YBDXrt+=Q5w}mKKbD37%jx#kt>PVQhiljSIb*vVQGaU_sw;WT31B z(2}o7v8+Qe1ko36&inN;jmAH>o;GSxZTN;V-}L#Vd%z{zYycW?=$kmv_q#MGHFSc; z!}!IYvH>ECsA*7V5(=jjbHlao1* zACKJ1FTD#TEH)?Gu3e%){;*vU+|Xeqa*z3#{MF=-<;TcLW4}=nP-i7DY&O4E9GS=> zC1C&AIf$v__jHOTWtob5PQe*X^0z3^!*Z~m8NLHeYCbJ2DjMM3(H|2 z@dFcw`(|$n`JYuh#~1a{f>qMvCl1ff9cotRkj~?SCjAE|ggET%>=!dGXw2b^!IgX@ z-WL}k_2O&+SuOL`Y+KR2f7lQpx?y(_=6MoVzQX>;SDBh;~#{c z#k|I0NFeVE6lHL1&M9uCx`6bt+y~ABXHsrr`R<^j!~5+q%L$j1&rtoS&)RhdV7)a) zBE_BMp7wSkuIbZyVoD|`k=PSX2Mi-UZWDjtq^~U}FjZ`$$lR6s=wm}rftXv?{rLHS zQDnO0@B1At@Lj1y30+r(r`!F*;YyC67AZa{%ZA!oW(;AJV1#&BJy>2YXZyDTosC`_ zJDlp?)Iwfnz?sxYv=y3ge@0VZZLeC%X)Nz{2=>Trn;qI!~~1= z&jU-{7I~1uRaaKd(`d~h_}?bKU&PM+{PX8k>P3E|l27KscV=0L$yRLLc_s-zF76rW zIek0ggO?mrK(RBfL?UY`_9HlXwTb2nmv*fSXo%gFB@IZMAv4L&DfeW}O{wOGILGx^ zuUyQ$WRllO&(W;-w3}nI->>pBqwi$>L%u@+f&S0df30fi)Z#r&#)_ZfoB@IN0s~R?vd0ptBo|Tg*MjEUp%;Mj1IT20 zn(Z4VxtxxcH=$FXA9XCyZ#*-Chk|05gTn;INDx@2Eo{X>z?*PlUgY}5aS=tXw|7ZD zm!cd~5v5t-^uvb_Gumw2SPNRVCnl!5lh$mEap*i|5_gL8?B0qKJ$cR7+`?)htvf*7 z%z5Cz@a)Z!86^{S4z|cm;_G^~igs2!E99m6>;;JTEQ6@VFq4pK|BwImyNOO087p{l z^qNopth>9XqGT4=3kKCFCO2VJ)Qnt?Vu$x#j-XZmal!J*U)CStrLtQ*}qZhU@G{^pWt2V}0228Eqo~51W#v6QsOIN6G)zqT4B7 zF`I*?Qn}i&`S&{68Z-`{%9lZW%GN;Tj%<1vdK2jboNaFzG!NBzqNmt0ud~%=8U;#cS`k~t&)pocA({Rld+#&g z!uP*%qqFd9?rfukDj2iM06%C{@O$x}j~yL4H2c&b4=&W_6US9a51wY8w+@zq+tkqu z$}DAi6JvGdbM6_5-+$||c7E<67II|%TQTqE|q+{{@z1zJF8g~~I7Op^Z2I&%# z6_5b1rgW?Jx#X_kPVtC@1a@ZTS{m<-H~Y7m3}0FKu>`b8TwL7W-yhm4h3X-~%P2y2 z()+$olI+ywTUXz1jH~<6%Ax|zU~7QA|HFrSicPgm7=;l5oL2oZl;LIvGq1rE_|TLw zxxN4)z!GqD@0jZFKYG(B2Pw{ekb$bD5pm(eXN)E|c^IOrs;W@Rp<%g2Cc_!uB5=C> z3UHMcxJ9L6hf9|xp#_WEx|L0ii5gahg7W;~h!fr1Q3}F)(NC-@9b`GbPEIS_LWBzC`R2BzsPz zGrat;vOFsdgcU-y39QM7KF%B;u!Dl-Ig7Uwg1@6I!Td@-Ge4q#EUC#cRc{^ty~zY8 zmmEFhT58B?(QUv$AdU#7L-sMBW{t5@i}qkV%E-_Vx6g6j>@$aS%juYajQ`;i7{+zLG;MP!*8f$3mzx1{Y-~FLt>7}W#ejCIFDXMc9vsKXV z<`_KT&9<^FLaEZ`;SVWPwkR>syq8q?K{je+#GYX|m0v^M^X{9J$JdH=wB#okf%C)U zPOcWE+?n{vn;C$N&n=?>4dSe%xhB{ZPX4JboFziPe0luN%l?}*s{OLLZ=2EzIX9fD zmrx|E6F$PP3A(vMzyAY?h*$xkD#$YLiJ^q^FoH zF~~*PuRat1Bxfl+J`49W#xg7OJ*_y-aqu9yhc{DbLo|9iRKA@qEU)VhOXsXzttC)l z60wUt26BEH%}2>!rzf%Vp-CX!q0b=-31Ep!PDWw1B1o>G?KfCmvsD&(IDDU55l!!y zu62@OnRjPTk0ELPqt~rV_zvAknqea3q=pG8=K=bK2_!rZ=M2%yG8t(Lo>=3lS{TYe z#G^Dz@zI-nN{C3vLp`HN($mz@No%qKu(ob2qJls#hFmw6P-_IU*;DV5w3iEj-3 zC}RU5l1)KTZtf(?Z2zMd5Wa~qlAU(Gko2Np#LV6lu@x;5I|ye2+iXCuP!V)=se2j2 zVgS2k)<2TYX`x;c3y+Dh5n=+t2}}TELcfoXtCiD7iC8y-L9#m@+h#-2`QXM&Y?Ks3 zKOp*0qYoEaL(tW1Q-DXEcZnan>~O^0;9tb7R&?Wml@$rRGR1kIpx3QkyBS05v4B9Z z5}H-Ltkl@#gJf$5hneYVRb^#c2M2(K1)X*lOWz^N?ZbTyH=}M=J07Bffkiy}VQ#L`s{y6@W;(gTefT%X;hFwTw-gyNJ#8INI3}u(*m!3Emst81RB|%%tz?A|ZUQT87t=3ju(T?<9?_0MPOF z@u3bLosvlfpnfr98bHtW>(_t0DJdE2!LUp`0M6$?W2B{}Nf!@fn3co`TG^+BlZE_m z1b(%z#CvPgf4=^Pn1~2bRQh z8Hg1g-uMp)YFsz{E+0XBjQ9GWKaO)+7WWp)*Vkt$W_s`u=P~9SKxXvH;PKY!miz-7 zTx|^8-3#!EI&FR(0{a1}Ffzhb@@po{M%q`B>$IMWh>307umNJHN*Qh@BL_!EVo1Tz zVShYY$j+x`XJrsfnB-1R5z3F#w^=h8dUYR}7*nH4dR}8+0PzyIK-{;vX0ZdKXxes)M3;*%vel*DKK;vOu5!S@_-|Homzg|RC z6!r+kS@sx|w`e#*R?hK;DTN(L+k!zZ)M|p@6EhH!i8M$c| zPhze;e3_amw(~*KafWr5@#ocYzjf~% zV`6HW<|D72tdZXK8R3$0N;Wp%iH>I)uok9zxwyJoWNN3kCAEy?Z7=5T7OA)5!xV-q znf5EVPLMl>{s6Jgm_~;GjQ(X#gzi&OsVAJ9mJ}S?L4aBAM$`71D+JBw;J$T$ zQz`VGo~y9yJWwd{c19J7>A9Q~a80oKzP_3W#`2;j4k}OZQTVi^23UXu(~({-0h_O zg$kY*l6V+hWKq%;7!)Loh(^p4nvn%Ur4{^zVFjvs;uh6@2^C<>sby>;)Znb1H*1Gf zpnn+!cS$!4MTj?r0yeBx4@WAXMS%CGJbC{LH>b*if-Xqr?O!WbZZ$}7zF4@~?2XQY z#Q09U^DcnY>n<*7WLvOuI2ZC%vNk$6CBYA-nN+cS87yFe&w1YR9qH>x*%K|xwWTmi>jH-cIr zE+FgBb;}~w_sPpM>+XGs(nuUS{^d8f0Z{>j-{%3^wHb%+(oP-{IF=>%He&e3ykcK!NWs-d4VJX}+a!MdZu#SIiYZKWs zdRkh{tgNRr1xNOElZx|9By3qWQ>o~YpV#%_x94{xCN&VGi& z7^fb!B{3H%Uc?amG4U@AIjsqj!o>Y<##Hd`A*#ej8Do9H!FwqF;Z$g;l?AQW?kKCS zcC>uPvh>5RIi9Kb?Z&zOs$H-%&G+qiJ8;709*eky=ZaK;jn}E3&9-?wm>jprd$O~H znxW^LqGFxz4&`FSK0GEOjNVPPMe*d~=M|_`F+crPUZ9JdV?#yJJD`ZJu?eeX%hYpx zWlCyZkPloEVls9b`{Op5@|S=!REHmoo=Cfj78Gs$V(=&Vz8u&FAfTf?aw^tdLZE%O zuBr!YB^k=-f%i0|^Sb5NhARg6M2zyN;s~HbjD&h7b`r09h=b$UY_w?SthMC%BFygs zU|Y1X5FS#Z z(*jews0>}!%Q4+3RES&}o{qmOE2@#0i8Qf`Lba05u}GS9+Ukmi&n<(OLCG~uTY(JA zD>XN1RK1>Q{+1)%(C3;zZ#(~~)lziy>Y6oP|F6Y0gv9CpJ9!h^F^pYDdlmg8{%5qN zsY7qs7C9xLovEM3E}0&D0)S!ld5he?H7r4eKQXligj{mN5X_OF`BEZkR#CN39^!9j z+%*1F)y#YS+Mj-sP@)V)$@1-BIZFikDk*{c1kyc{=Qo`Th7z`2y3FaqLw3Do(Bsc^ z{)9>51j!jXjnq%ce#2bS8J-{?yTZrJpv{Gkmfzo(i) z4%=AH8ka|EJLQ;cn1QM(a6%~wjJ|lJ#aM5lNQ&bBDE&rKEfQ0Zyy-F1bXGQ@z%bNqu}wAn%ones=-QPQ`aoz#XhXOJ{Q zc}Q60ze?!|-Tay?D)(6b0H&pa1T0)pN|h%yNMq-iLtIKrZRql1;K7Zv__Z8c&z>0Q zJycHjt*BK$Y8rN228FgVX$hoZfZ-qC;0FOg#b64@lH^F5-(R?Zm3*%T{;1Y z7}0fueSOIGNeA#`UXq9EtqiA&S`Bz-Jm?A5+w42*~~K z>WY$s8DLJJ{sHf=ps0ve>alxFObiDP&xypQoew@@rrWC_$Uv46dz7hdg=yTp%FVlw zK=7B6Bt|V5O%9huKoTFH@PyLV?&kDros-cG$44vs%_p!QxD4T?MOVuqed}% z?p*I1YT!S3hN4#*x$!a(fu!$^4aaM%Z%^G`&DOUw^FPs*) zbon~+9oZl6r7W9vsg$;K*f>)gOcx^y3yL-vbWjNn3sYc#B_t1m-@blrJsDrR(>jn< zQ{RoRcJ2_qW@k-J5HN`SoOW?Pa^wg`@mg6Wf1_$?X@OI^v!=!xhYN~)lmK6|Vw00k zMc4g=Iy`!U5M}G9#`6bvUS&IAbWBy1Hnr{=%iSq$^LU2-f|W-x)JMIxpWD@CAOAE+j-U+RM8?rJO&GPY z`Uku53(7+bH+)BbGh2^pqo!*1nf}gJ0ty2)fFGj}{R7$rA~^Ah3YGv$;?b83`lkYE z<&4WqfSjRsN@*Cv+|A3w>+ z3GcwnpA*t=Vxo2TS?Ps*>748X8}jvia@-+~3S z<)!og5(GSe{24R6!##{4)yKTs>)-wG0e3x6Aj&g(IoKWf7%L$(y?!#tUvCpIJZaag z4@Lm>t!U zE5jqhm8XrVSr~oR{5?Y4RxVbZaQK2-CsZj+G(bS3BMD3V#ovmu;3%&BRkPoFm8O$e z#wRxoW8Ah4B(^)WB1iWhurGy_u@mW6K%-FI&rD4rNumge=I+c)Os#cw?)#-hpKm$mkuj#9N*KtXnF74Z zDs`{p5tNHKwHy2}Klu^89CdzSVFbM$R^HKQF4nu$+UELRTN>50Hrp=#K;S{}38IpN z-~xNMxf5~iOG`_1yF`=V6E%9R0zc1=;x~DDU?k>Hg%B}qB+@fY<8sGG&jxX^A;$|D zDYHPm`USyu~{A>+^Du46hUCRLhV(mO$nOJ{)0=E_e2%TAit9n*6v{ zI_W|FrDLy-p9q!gdPF60TA$%7a0uV?LfQ|nKC{=jx#2G-U8TCeYJp4gGge}p_N~>U zvemr2U0qnW%|rHh5T0mu5lM&91Vel7>f5_OwUYZDE@O20voWq?gM&~^qDOShD~OH# zu*`-X=9sq(SB!Qt5QyxXA1u3Wu2*owl06;my4BFRsoQ}$zR5BvA9{90m2u3!GG0{w0gFfi}V)W}wn)}FK z-y@dl`-ApKTj~1EZvrCL%WOiWB@18?AiikWgTl{PZ;+{(vrh~Rlom2V-Vom~hVdZr z12CbUTt&8!Bfi(=E=Brc81k}6U0Y3z$=>%Y zZ{JGd2v;zEP%Qu%;3pEjXA_`vvw{W!!?yYJzT~8*H*|J}KM0BGLpI!{A?a7RF-9f! z>i>!k0>AJM;Ms0~5~fu@wTc}?K^FgQTW&NyOq=Au zrzca8BB%K^wh-}ci@}OEHbT2HBxOvGDU(VPQ!q5-$Ly@Bfg|Q(+;ivpfT^(ISNZyY zails$jVRM`+Y;OSb;DkX(`GFTwIS2gJGd)1h@U3Yo{dgLQA}J@tx&!w3p@@4hNl z>yztQxl^frfQBgLVd95X?dYwyk^(WP_2QbYw3Q-8&`GWgoYp#%4;^8G289_H_<(fB zHQ<{n7vN$-lAmYm=v*Vb_Kf~#(w2I{-Z_valS0)1wnLP z{_cazUK9cUvEiIIzbXD_!`0uLdkmdZ+ocOJ17C2QYbO&E;Bf$7+_C8%Si&US?a7b7 zJQ1o7PDoA`39CZ$zVm^1^)S8#97!mu~cdsx+@U)`a)JOC1jL3pY#m_4j-G_?*l(g07!4P&vOP1|egT zC>(J7YiN8-+3xU}xL2WPc%_}}+cBS#7r%6}z2Wfq_M@TxIGw~hAl5l`x`Vk*>yXa1 zT*(+Z4n9FaO+2rB5g{QPu!}fTpt^H`LJC~#m;i=7e0f9Khf^vS02$hh<$gj<@Yz^Q|vO9*4k-D;vd!H3GtDy`A2jJ?4t`(IP$_|7m;0WW3|0?2Q z$t`d>c0Gf)rmRWd+a>YTyz{r*W2i;gfmh#7`Bb+~ZVXxN{~YP9Oc(o%6*@2se)AsCpWi z(sbo~ViT6h&9tqbW&v5EV+7$cy^JNH3T0@_#xmSS0M>_;ZPjvHK%Q)7K1k_52S}K( z1|B_q`7-zBNN20Ui^T16y@Pw7QCIMuky|jCzg;1+Vz$Y_$m))8A4dj?3Z498ls8-C zz$V7>s;sr~B7Z`qM_6n%Wq$=A=_!*?>+kKni@+cdXU<|f4}*LIGlVkt-ytzUU&-SSO_Pwcc~PirR>Za5x1qiIHa6b1L%-;GhRudp z7D4|0Ke|^}LVQaRb#&(RX(0p-ECxThj~#wm58^to8>N7)(HL)L61t&hQH2P2K+9wjqJDOo=c>l$ z?OFU2s=Gn3;06KM4o!pgavBRnZCiap)@3yyV2cK{N+cQ6Z zeU|!z^pO702ajp$5GX@G=Q}r4R*pbwlGOTZ#Rk!&tn1*$d+ccvjwgQtFuI96dO~!+ z7U^3?H=dO0l2hAW2uHZ3-WdDc-jVIlxhq?VI#RRr`o?FY-|{!;8rJ+7xemxtBrf;1 zIU{?ia*JN%L?Wl7rL|Qleifia5-(7GlMoRqSU0ws;G@~wRHkf=an}O2d!qRo4#s-P zKV#OyJoX(flG#)uF{X7DwHJkcNF)(GLR|KPDXP5$m#hBA~_svqtBUjnpF@cN! z33d`!?@entLedc3;!x?>{Vy@Y_ml}*YU)5v1{82~9??h~X@5ak@o32Qf>^h28WQ!b5(BiHfF9IV(;Bg-H5LoOj!7LQz+S6rQ8N8AMr`d0^^5c&4Do<3kFFILD$?x!oL%3Q% z^ATQxI91a`&e-vlRYzd&7z^)glYv6I;j(Z>@ge(%e5~7e%ykBjw}UVMiR}>r-T{`S zIQ4|CjzML?69bv`H>ucPMBe}MEq~nGgZk55P3TE4To?oa4591w7n66d;uFBEa%qQC z0gPdSf)gMe`_C)sXZDrGYWpZXFmTr_^P!QAaF3A(d*7}WU%8`+3V+dVI*3i_@026(o_7ty{+M>ufaDpU_ z5rC(Nm3q6gYoc(;mtIb%4BgEL3h^M2cDLT)R(DTq$_2zmIN0z1Ui*SC0K*bNgwPn` zKH9utZ9#^F8jH_;kVz zG|EumQRpQ;2UzV)4T?$s_lDB1Fg^(6;k>3M;^V%eyP6)~di3vlC2ix>q+`Y&N)JQa zGYQx#2+4#ZH~PL>`WoA6>}IH=VsEA3qRq?6sry~TYh`hs@bz+9TZAXHnN8-i(Q7#3 zCNYT)H7Y6tC_tPSr_C|u98ThIivOE3q3xFQdMoOsy}=JuhcdT~R;=?v9Tv=Zj_K&K z@jA8v2Ql~vfVjbLgTF!TEE-mYswKXmu0J;_su&8P#f$n`>FbWq0Tw}jf!;O~K(d%v zO{fSj!dfyjgEfCO+{-X$_^vOu@EW`%J=h=)*&G}8$KpYK!2}M7KlxAWl<%S)Hna)~ z*v)>EU%meGkF0aGe@(tbE70QrmB>x|wXx}2g-O_5a!T+DLRbUl73njsLV~HdRHU!< z(=5+$-}@l9kp~eI(!RH36yz5VdEqW;OWr&BV`ay|B2D%05$=m8xvwUcoU#?RS8cS-0i ze^j=4dvB01{r+#xUO4iS_gmh53eGqeU(6G@*iaV2+0VzS*NGT6Dg3(I_9+&OvgiN4 z+xEXuo#uKul=4){c@l~zT#g`^0M>4}bu?BT8D@TLvJsuWz0()IS*3leD4M(QEItyo zIB}&JfS)I5@wFc*lyw?DvB-Fgz=$991n8SULeH@wwp`M$UR~ezed)W(slGwkgdx?=sU|&Q9NOT_SC0}r%^KiUR z%2HCkHemm|t={Aj)oxDo)k^O z>Oo|p1qIb#=Sd6`?c8fDThll;9vq=~lI=A7FeY*&*QD3ass^k=iivibnK)|V@KfNS z4w4bPy)w@l&b`@i-P#!VPeN4?n3N6GN5khEn|D2(olwU&yl-QOeNd&v+SuF!SN&;= z)?cEF-}vlXsq<#>R5P%TMnxX$iP8><8#nXH*Q{9ye;V=B;~a?17}>(LY?Nnfm**1^ zt|u;sY>rrB9i7CV>qfd(l|=yxy!n)e$Y6QripESX z1Odt2W9!M3p*!QrW~eMsSs@Al7JO(P|NQgMkA7@LI6UE&FVxlg{Z!|J9;*uiKBp){+wniZU~nV#G#I zMG-m!xK{JUdPb>HS;viBe0@Q;$R2>K95VfrMs{re_0zuBAxiAI*%e@0H?w~o<3k+M z2|?aGNXFQ4Qgl)rw91E(@6$tPZ@oJ*0O4K+2v3L?@z5FRXHeEz9Htc(A7_m}Dt0QIMM(s)~7hqq7pwW8A9lMGp|NY=O#r z+5j}hL^vHaF>$MFEchs?K~biX-n;1$hy(K=Md(TKg#;A#fNycns;GuU<<}FKC%s;} zkAQ(4U9J%6g)3|WU}V1tIwmiB8r1}>aHKo;?p^z7t*GeZ=U0<==i+BV$c&sWJL>(>%LuI0t zeUZzB@J;p910Wrr-V8j9lk%czc&_>-ObXu;C&e5LP4rHyX~QEDKnLDQg3SpuU9 zSxPWp3S4B%hzq(3;WeCDFziEs3HNO&IzrJfpd1`wcf=_<0ASiIeIGo4TkIm5=u?~x z7=A6F`)1FDM7(*7OA0LS9UEgs*~i8PP1=<%b~EUh(N^JsK*I*i4GMb1n~rxCbTrY! zI)Irt*O9b|fL){50(60;c^$ZQyT+#B&&uocKzEqlCWT=h$jiI+PRQfuJmOJgwACDW z4dDCxVuem=+6vN!;N_DGh4Zq=7c^*W{#v?P)F-v!`kJ+6myBorxbqXHbiB+oN<3~Adz|^PHQSt@EG>d6>B8_4|tVDP(l%OD&CWFg`_P8_Nx z^7*(@6B8}0tqI2wq1lX9q>HX2=8U0sg>&@?a}MZ3+M-;9O%@3eYv{{nFvbFsskPH{ zQ7~utq~BY_CfP)eijFQ=AtK-^Q!W**uDJTJ-)A|jPO3}R5erElZlsUP%yjs0mw{GL z2tINQ9@q8I+bEBLzQvzDsVrGzY<)h`QCv7B$SSBok!w(r2_a4J@+3j1qa$<@FDy6C z#i(Obx5Oq1^LmaYe|%X%VF{l%86wQG-^RoX3GmF2LJa$x93ke0gSDzK8xcl_-^^U8 zg{1USbdG7&m+=-uqRq#Jr!MQfDe}GQEd;urkDJ>@yd8yoqd_u72#2VhS>tVA-xb7X z_m=&RM*E@;|9`#)9PfV1@h3Ls;DD@iJEyD5N5QC1H>Bbr&;VhrNacKm!VUt8RxZCO zaJrQwBP<>P#qmaZQ_voE^ElSv7qdvkZ8OGd?M!9A+UvUu6f?AaoFI zh3SXkXpa4pq-4h~~n1V|>G2c!+mr;k-v?zVN&a`QkXNN7&#v+;-anMrjr z>L*24e^UaQ2V6cl5^fMrydbD+T_oghbxY{@V;{vInhrwYi1<)TG*5{1qs=Dyu@h_S zhA%+TvU>?QUaJ(*Y)(c)&eWmyLf7kX;}02SXrTGcOu9!B3aY6MAsUX>wY;*sEEI~6 zpJgVg;;eLr!mK-xCCHPV06&QW^SBUY0YqHydJn`n_QypNFP?pN{l<;F*}|w5@t`hL zm#!$k2CQA-C$l_#*5nIf=C=c8cTH%@uNsEB3_}^NdheQ~-3DE=G6R4Ys6u*Ga5N;+ zX#RN@8|%uV>6xs!TsODOr^pGAyN!YK%XOp9ulc3)6qkwVRq7t+&Yq3ly#mJqc88kG zTnxv_VR}=@yoMK7ans~vKuQ-X?)$q4w#IluqLS9l3F^qS2w6UdQ`BTmwTRK``SJWHZTHgKOXU0cWRAUizvB0V3Z9pH z3E*c$P#-%EdYe|iRnW(QQ-b}ey8%)z6O-|9K zDKj<;m2c9=jbz}_hJcU=a9uv8;Oe>r(xdk?c1n=VTXtdwU4FwJGPwsJ`nXCIMM$D> zWzoXKO-%kV{Bo6KtkJBJiQwlAfTCu0q~0QbLVd%cnuZ*rs`Ib#$z}2yaYR*xOHt)K z&$A!;T0OgnfS@tKPkk)72UtD4)Vh4_zr6k9@U|IN@d~}Yw66V-(6oFm?Mv(ns`&#^ z-Pdy&^)0E@TF!7$+On-9S+FV`m$ZoZr^&OiW=#7iwyhSmuxE-a-8=R>H&FtnTN9s1 zRBjb-p#Ul8O#+SUB0-FBuP`6$&i-1DG7Ct{e$U00iJ5cBfpU-0HCB)TOFCV5dXRsI zn~zV$^M?csR1!u+$~TJjwJnj)*-@@FGv?)`?MWwcJP6jwN%dW57k{{bX6Br0^^;EuV?d1X)Bg%k)l8Q zAfjE=XGTkgM+7(B;X)76x1=|}FZ?6jIBoi7g6hwBZ?(8yS2+%7!y%>9Udm-!X?EvM z78bYB)&p}~qcJjuK^uj27eR?R6sF)K0Vk5niF+hJD$f*K6N&0bVrdu*bG!A($BznT z6Se+9^l=FZ%7>1XMAOFsrh~sjqI<-F^sS^1$Kq6!8q-9U7l<=hQS;6|!HwNJ|NE$} zWe%$5?hVsIHD?kch>Or^_A|v7a|w=DS4HPtUV-Po?T?cH4CAwF?bS)qQZM@Iapu|+ z?}};PsCsVA%z4rjtlMQyA#exb6k7$PL@YJ8aTRA4z2byN51hr)Ry%^3)(f#|C%~*V- zr`{}x2h^Xso4Q+3`;EJ*2(=ol z{|H2&l`X(sU7Z;w4F&bNa~xc4@WJh%?p7v$LM7Sv5S@tNqZ6RZd99z?TxaFSecG0K zGmLdg|BcO2+Pa~~VlpyaZKqC6ZV_@Ydxdgu((1!3dxwvZXjn4*eR8)E(G8q+N%=F4 zSWu}Ki>VWib{w$7^A>ec$0ecx9aq)`#sAE2Wt5>YeCqIS41#H*ytUujr*#MQ`imFb zX4VRicyLdZL2>$eH6uU&^RiM5(wi`BZ@1pA_K_H(vWtz2qaw@6%ZC@lgNi8cYr(u8 zg=%NqO0Fdr@a|y ztvit&_1GPI#i-|dQ_V#Fl&@sZM|^il+lmp6>xhS6Zdb7@ySMWcSO8dA;toj?W?g}VLs26P=v`k5UBdI{ zM;)iW9{dbxg`GQ+2~fAi(O82OPDt3Ys#u^Dv0=N6ma4LI=QTiorW#lcv9TtQh1#u~ z`R0HlR#5IS)>ox6;@FayJy8HmMq_|YQej^3Ve@zxVmcf--!!)y zrE7hUZbShfcB`<&Bm;^Qh%KG3u5`3|cFpRND!k58=OB$*j7^Pk2 zdAAgoDIUk(nrqgvUcX^Og^v~$6%{1P7~uW2x@A9vVsFq!f!2%1!0HDdp(911j@%nm z&|N+A!@kbA{iKnZ4cX|zd(7uPOVpsu23!;n*eKy2Bc3rJ9k>Y8L__)A#6(RHet}Mk zG|UH$VcVIca>vm*87mvQj^n#=adB`%ppoVPIs~gC7Z*erFo_HmWqw|^ z>gklgNSzE+z>cq2cJC%^gER5)NaCdR&$dG}7b;pvy@{E4P>HMi_3M$?*>n(+c2hSC z`b(X77Gh1Uxvo4|#JcI%->#AQC!74s#((mvJ^qQJ{vZC)??3c^z+Z2)1k)o8b};kj z@aX6$;5M^J?c`>Z^h9dHh7CxTbm}t7=YYtu9c9#xg6-FDH8wS&G{xBf2Dot0#My9K zhpcr1=ggh^_dk95#0Sf_rR6yp7v4M(r2~&PG*Eevj{Lc_9|f4iKo7p9aYS3lbv zUZFPs<0)}-qBj;pDBbPbx1nx@J#r>qa6s$5g-XPp!}efs!>TlpgAovb*l4~|&r9-; z@mq4%fDxQ;DOzcAzDLf?fWGk&a7P~b;gJ!L-%#GRw;Av!2oB<$LOX!TTQA*mpWEK{g^vF65dbhQel`6Po}2{NS-`qpoeO zV#UMqz0`chRW}QU$)75<^c?K-lcC(-CWm>%ZgAG&=S>gQ7i^c9k$S&!r1r;2p{3^X zJ`zPpkWP*%H799dC9(&VC~%Ig%*tSLv0GLIhf}LVKGKOzZ zjx@tBhAIK7X^$nX6YfV_@U3K8XwDQHo0t%hs0VapQ@s>LEnDfCnC9WXSvoFQ7Dkk~ zau?QRf*uj%*l@}6{W zyli1{&AD#bZu~NM%pGz>cgY-ec(%ZDbeG`_d2&5tn&~_J8T$Udq!bB>)@D%cRAfkZ z-3oLC{Z*yuUdz(k|J?ei(82ETpLn>p=s#KrSQM_BU57*E$r;IA&kt#@F+luvKD`kD z)@p_8hvb0xVY!B9y;f|Ao{4>-1e%ix9{9>9!buID+IBYR>C{c#e(FmM@7QR4n98Fpva^4 z*-?e)12Qrm^WS@hcRg;}VGq1W?lz#nqMBMLlA0=UEjJ;IS%^vaI9V~>^FqA`Kag|r zD~&IZ_Y9y4yB(-UtM#8Ba7lhLy#~WDyg;A{;v+qVEmf9>ITGEGj{@{P*Kthy^yz0( zS8V$#7!IqV6T-MnoM*V)ic3n6W`c7M`6d9Vcq8MG;^zw2yo6Y-pt=?(o8K4a^YwaGC9LD= z0w>FtHC_O+mG;azguZ`dqA2*P;i&v$7|wcod&}CzA^(S=&BYeJ?h+2I zRT~VV6B5iJ{XlYs--8GI0sC{q#1N@%7eJmMUPgs8Q1bZLD-QV75DPYe znRPzi-nqIf!^2m|@6j-0aYZ6~8H28|2^JR@(Kdl5ni;Gsxh!mIX6A_|X?T6@ljl3E z!k0?5%+6PaR}iVS_yUA?idnVy+Vo2>d@@;XZ2N&<#mEF^v{@Q>E@!%gwOb#oa#n&@ zyYBMO8qbwLz z<%Tf~sOkOtLxT;=<=ClM>8@r*SRynShZI9(e-8U7;Vl;{l{IWTFS|M+8Y zr@^Y5ihNPTpzf=@&wYBLUnDvjm$mDZC76m;F!PCnBL=0~%a>P>8IIN!{W|SLw<8w? zf$Y0sm;^Qew^J6HO!9ja!K@w*uydh$06dShMw~;iWNrgAjoph2r*g}0VaV~HEGjHKJ=%7Nhv#LFXRr2~Yv*C?Bw8Tw zPG|_=jlqbD@4#0dv9H34fn5jv4QwNrzxhzjuyXScOt6E(MV(|Q8it6@-fM=T4I4uC z(Qn(g zS@_xk!9bk}@%U#xb?2z9Teqqsf$#iz;>dh`VI_qFz^5joB*K7%gic?x<V%=9+CP?#FJ)ANtNn$MGQEsLw_#sLk{upOeO*O z$C&hRdL_#0^#zC}nIX->q=U-OIJ0~_2swPf!-oXpfg_{z9(W}>#v`$Zv^thvG|bV zOra;@`6GulkNZ4$RY|WfVDlxh{j1G8-DcvfLD6lGlM)*OC*I^~;(GAuGcD@K{aneZ z@_3KtEOr4bfzYdqFwwAXG6b`Zy92i|s;Mt_3w`^}BO)7RD0(3+r1fGh%Fdmkh#tq` zMc9Iyn)-TsN#r1zb<<{p$8`o)Y-h3Nus#FX6B8dv2Fr?ziz6mGD(Wk$>a56g)%Dl3 zWM`b*oaC6QIMeA2jSX~w^^Bv)!;QUzh2<%P$DdA%Hr`|8$9RTTY*)}YOiWCJ-$NUF z{yOpqriR<2rwTCW7?V~y#Rs3JN?3$%uU5cKjvbB@8hb#1pC1=p%jo1d+dC5yzJ)Uy z8jkRwq5Z>%x8E_#iPW{r1@$I@QHPQ()vzw`jzJ@K;Yxs~5tHucXB&^_UK{YGH$s3< z1-*08llJCIpNvRBMKkL<-*kRD) z$5KHAKt%@g`_;zyS4jjqdT~H%iJlY4@!<>TCjbE~Y>PQ~M@nQF1>NWU>N#Psz#m~g zy1Ok{dl|vVXfAzsiB)?ztjwf(n(yun%C0G=83sH8t=uj|L8oOvI17;nxW!;+-!Srh zmo}I}qjSuL2s|e%O>wDEDiOZfCkK16;ISWvI~Dcsj7a%5zU!=7VRTgVmT{toW@&Q~s3WRbw0BKO;ZmDgQdO_k(-AXO*ueYy zl)0pgz6@mrqGM`o%pF+CA3OBgpkB~(xxP8IhIT^nJlm3PvtfwH>1ecmxE+R*l=TOf zry^JF<9Tx3SjuH2Y7eu_XJv`Iu_(vOpjji48^tz58p=eoVWvmNu&86$+G*(!kqW@P zEup0`nx6CELG`SKalWGb81?QveN9cSwVV5Vq!wbH*UuEJ&=g!Ak&>uxm-X#6?K8-@ z?B9RYct*;B=W*p?LeaOpZN-;GpOnz|1N}Lt@EFy+9q$BgG79}6(@&>mtjx`oPn@uG zymTYoXA98mph^FDl?u)VS%aBH+Zc!rV&%;fn_dd2`}ux3NWr+Zdk1^bT~AhM>)jZi z2wpsOSJKs9Uq8a`bK_I0#qW*Btq{qKgRo*@0N4}=MpSB#XlU-|;=}m#VLsjZNQVos} zW^1#Wtku25iM1^W2seWq_k`Bz!d#?1bQ!%aXH{FNU*!vZ9 z9t)|8WR+{z((5i`u>7l^PGIHX80k5*J~S{Arm8Edky2ZC??(3c$anVT;oetae=gB~ zH2mXbqp)O)qxNpN$UvZ7& zRBG1b`%Ad##(i+1f?(IhU=9QZHdq60z(5aDwDK8TEJ3qJ z)1zbKY6go+-qk)nxNIOs<|7b)7{ZONx3#_?F^97FstQ9n=^SGuV)Z zn1D2_)_2N)Hc~XR+iE5|&vF-Go0(DR-TYwET2PMZl=843R(V<~6B239scl8nhgWv!;}oILCz3RVjlsiEEogSp^H{%=#;^hxT9|AiP+!#68?v50 z8=30DT720~bY|0iMMayOZRT0ls3@*qf0NHQX`k9?tv(&^aD9@Ikx>*4XY8Px!*JB> zk5V??9WE${Ar%P4MUykCrL-#dF+8BIduEh3>*vrFC{2c)D|WBP zJw5V)rht1}syve!|BXuGhLCPw-0dZ_D0$B#J*j{4W=llwANDzwBi8m#SwqxxhQ0jb zS1O|SL5QND;9at&v`1}0pCW`qol%ZJ=ck$`jf_$7gr+`pV&&cS6-O?*Dq`RyqUau- z+TCC>(=2tcxsCh@vVx$y(*%tu`90h{9F!^6rC3Co&Zby5O!tF|!iR<#Q!tZ*{OtA) zoPl-yE*1?6Fuyx@>PD~9w#aejP8Q~&DaFiacQi2)tY=Y(yW#JkMZ$2@bBq_-HjAKs zbRys9J2JDiqCqy+xkXUjhx`d~3PCT9$+Qk8t%EOV^9Ffb@@-uVw11i?&23tVg_D9=uszMCjgIzdjNJpf<@+^42P_Cq3G#4I}LK9WRJ`KjFwpAx&mgeA4nMPiRq=mFOW?B9Q8^-A1xgO$bD zWP?aOZy|w^SCubrK{9OgS=-&r=p@m9e)v{?uTxo1LC|bovZU*i z{y1AU{F#vMm4Fi(G^ZqXAY|XqMBrCxRA<{PL-`RkY4IlM;^NF%&(ewe*g{Q2@VKYt zP*5 zgKRe=F}nlWuAm@@N!TkD`+w@=x4f9f3F0|bB_?+pZd3_f!6jd3kbbEA5ZM60$T*dg zHj*1&UNj77D3D@BU~;;q3-qxi{xgYZ%_u?w_ZkgJ?0%!TSA$uHxaUG7h|(6Y7Q(RG z_8^kI!b=Ome>L)tA?OQVs*q}*1IV!KLJ_J*?}UQ(6@(ORUZHm4fB|PtmN#gWMbn$& zXq^<@Ri(+BZ7_U}OKgFM;-6g)?2yR3G)>nc!Cv|$iI*XKvPIBpd2#e0#a7Elnu?f} zI`KW}$U+#^jjJls+KKhi!(%ZCCMNWU8YA>08~F&-k=URyK^q zZw`5yow~b{A>bz{Bjr%XEg2THsULD9_|n@qPdk--7G^Sp(yveAS^QA|X5S7dKxdenZv}@6O^f)nlDG z4|Mg9y6!CIZkY*9ZO$p@hx>k|0~aAsHiwOM!@QRl_T1?Iu~|+2F~TseyPt0bc)L`J zs|^P~q?u3lxh#tZsQb8#W*?xLf}Dai?Q67(DhSppEuk(Zb`q227k4^1!niAJYC ze?qB+TOVa}R^;g}skj^y;k|o{m+2Ms!X+?ESStqn<6$YZh%)zL5(4iMlY-E8fv`U3 z4ZA3Bjj6}?cN=FLz%%L03ePxo79zhdo~+{G;eqR{Um}rce($+tOu!_fe@!iV>mF{_ zL%B#JPs__;E`Gxo3y?QaGS=GMoEh8}eQ}#iqQQxXEIAy#lShgCqr*>wJ#dYw$q_!z zWc+A!sTGgY&PqD$xJ|YEzb%czn%9A?frYJ+um?e>SUk%aK6`bzp~^Zy2W2N(GTH6IW|2v>5UNmSk0Jli+o?wg-&G|H%3-8K|4`Q%joz{VuEyY(d6%-U+=DmX47JxFMS2H3{NAM&{mO@6Q z4h5$wDf;Z+OAY-?+t~ARV^p(t%_BE0)f+XX5mb7va2zUL1d#3$zWlJB{ZajaRHrLXq{ zg%d9op?FFF>eiB5Y`==pe^G?{#Klc6qSW@SL5frpx4 zf^KzfLsoV4wSG zla+;+CC$nu9_yC(&J2=pGtH5B&Tl8sh!>RaHaG zzJ+2@8h;$%_oiJYR_Mn*ultn&wojg1=5fTZBC!6LfC|M~u<}Y*;fd6`i0ayV2W^>) zuebj>m>N{M;d6BI1j>`5^g*%8or^Qa{#mUKTD%f!igL(Nr*U2UWC+wb_2$c?lB~86|RTyptF%_m-BYq zfPu$)R2wtEJ{V~gx;bMJN>D?w0D)`P1-{AhvrC%iMnZ0^kl!HV17Zev*#OXk0Zf~+ za`2p4B!7a&vbVCVk+r|_>9J)a5!cYn`N3#3EGW3re)_q+wSjD6b{oi7VrsJlTn4Z? zUJ~BvML#_E^2Ly5d^HJQbV53zcE)>4nH<|%T`>ls>0nzr#;)@S3Sw3%{y92^vF7A3 z^~gTnmmndU@hyWuMHTSE;0(WK4l=f0BqU&byD`dUIk}so)}Pzb_D?uJJ!oi>JM2KkVddxp<+*SxBc1?D3@2e-e6iw8a}xG37;_eqM#K0f}H@( z9zB9hWM4N2Frdegk*O*vZDx9p0u+-U;!ILELakun_TvMp&eHqL(NAv=YjQ1ol&?~A zn01>GuLr=lc|!@jf+p;>01;;@)taU&4T>^mM$+x<#PNpjeb_tkhvWR+D`pO@4fG0y zhYs-Y5Y@P6i?Z`n@?z(+#q)KB?4u5(2LE;=wR9Z9@>uJ-y1K}Ru(BeQ7dhbDAYsC_ z=rfhwZKXGEGAT+>);PPMe$|fX+>aYK%26v|v2x0Xl0_Oxbks%Z!nC#G^admiHKs z{JI|eXrKLVP%5VkMV4Kny4OHGW}9!OWbnt*9fF;PhaEZ!K_jI-E_^wRy=YIXPO&q8n(KYycy`vU?vqrFjjI z^Rry&I1FNNz3jU=4@B^PQTN{QRR90~aAkCqIQA@iBqAiE64_)FLWNTZNoGb?IZ2eP ztjMTP$V!T&sO%LgTFRCpEwZlrtKOgQzOLK#&vo6tzt8P+`+VNFcR9{EujhC??(30$ z`O4%KK%<9&$KyXpI>Zsw`(RrM8p!L4{ z2s#14ooMB8-Gz*1`1OeR-zo$g~bPyg(x@WR)a;0#{5Yyq)j{0|Ry^tpfXl6?&z;|-Fka?lg@ zUJ|)4?V2ohvv$Gu;NJ0$&gg$#N!`s;vHyU|3qWhYptY!s4h`{R4q+wQlkAwND9DE{ zfgQP^bFF-9FF)x`p989fqmwKE9>?blW9@FGrOyJ3^A6FdLVb^s3 zvuoboUHEKtcJ;2Sl^)XlBhA-Pap0y>6_SeY44@m+>N6oBihIjqQv( zK4;e?JYek|hrJG2i_pe8$k&usK3W;3&QkYC1XlnMOYGd8AZ;<41mckAU9@fC{v6fM(BS=izZVyDPBPt! zcTk*66CoEsHFhF(H~cXU^JP%fr+&o@?(gAag;)6hi~kIm;L_#LB<$wevXNK+gYf9y z4d}#3p0M_F)d>Fi)dONPUJ-Ig3G;{k>~g5xI61eZL{3cX22}Hd-tI0gU6lq1q34sn?&LV#la}y7sF+@KJyz+Gb$P6P;)FkKObWR*nHoh zkv~6|wU4E4_TcD_7zcsBUqIOYvslRUljWe4FuM=A7O8Dcd&IplKB&BpfBkv{`QlKT z#*{%<@%ON5^ts{uzz~zNJ~uovsPT}E-O|`dVrDimG~9#?UUzp)SDXYn3iWFh6xe(B zdLcD&ei-vaIi+CgFd*%-w7iQ6t+;-{aWiqtWkDBOQ*$V_)3pK_!$LcD>`+v^gQE=F z8(ydO7r+0z)&pY&=k!Ql+tsEpL+txRuVKveyHiseyFp|&TO?K9gD4CP6H0#_9t}1^ zjsl;E=Hh2WhT=tm_u?KQWD6kUW?+YY4d5QIJR)uoQHV;J(DBWg85v!ua!8W3b1&~h zij@pC|MqRmkP+X`SIdBn?zZ8`9+;00Cs^5{e}bO zC>`CO?>$I6R}xSp&PQlh@n}$%!4sptyim?h!8fQGiJ#q|;zcBs;o)mWV$%GNAsp}c z!az|HR6QdF01oPva)1+PE%$&~BN6(OKUwOb;H}Ykz{m)$_myl1JO;eHyodtEuv&1I z1WZRJgl+&sf$L#aK*GSGIr+ZUF4Y4+ig$*$1r0l3KBz(9_VSq}cVe^P$5EUDX@hJA z3Q!**D)8ORX0o`lvOg4>Sey&ryG;=5c9skVKNd0oabe*cxH-|HArw*H&`^P!k>ILC z#?Hxs_S1|+q&7qa&=D(u^oDwLgvevSLz%gniDmn5M0AtlII?|F9$qKcAruxQ7e;{W zq~1q@4%~~F1db}!z|as+O_XW{BdeCpY8h}o`k!C&J2swOLW;*wvJp{{5p=2-Ymmo}@ClULD zVM0CK^bkODaP+y|1>mq&2tJ#y1&za1f zFamgL-UHd`E!$tn0yuYo5R0!^F&k@SmZ)~XP3bkjEh-s!w~vxOvSkod8|c+GXoyV> z(c^>=&@v9q1=xg|W3ial2q`kRNCHsD8kz6}B2Uk}L3;Tr6uFP>{bz>G&y4?z^Ei2p zap}F4POgqTwd=b&F}#nmJYo5`NS`arxDUiy4Yj3uWVTHu*|i{ud) zt~4X@HeE+RgQg}Vh%Da)xSsp9iSN#zZ##@BS;z?fI*8}tPec#*a#|fp)sAZ^5C&k_ z5Z@%BJpQRr40nJg^fiN^)xGYZIGi{q2YUTCQv9u+Ig*ItONjd0Q>a41f z)6+;d57pgU=0BJshTo(b{UaED;DH|uO40siYJyR<&wZ*IzJhZY*~3 zqY5K2SoXVsE@WArqn_8HvnL7R)adCBLH!D58g6>Th211;F3xPcFY|_x@&}=6hzt1_ zLN#3buiq$%z7mgbc#lYP9!|bBB+}R<*$EXYwxrpTFHc>gnoiH$ZV0cnwa?bC4n-BX zZ|~kjE(yr8l|j|A)#ZoBK+}QXdLTP}YNd>nyY6pqUGNxb)Ut;}%kX0?&aZ>Oc+ zyUVA-V_*Cx2h+Cmf~3w#3bo>R6gy>RsnhAxii|n}#UMNxJQ^ok3m)7*|JQXG#-*)J zg%uEWc`VlwT1gy1I@iodsGmQ$c>yMYV4h7Alck%I$pAzDr0pniGr~KLOG6-NS_9x4 z=92lPIGbBoFbEMkR8B*j&XDLjyxcUir&FHFqKQeT7RD#ZT%cizXw|q5IiXZ-#5*LRZ^Z5szzk7W>=){zf z5hpRk8UD!^;QW(X<2<)H+jtGpm~^4P6{1eIK5-;wwgOhg^~1-(A%-Cmi~zCkFV@?l zGy}Lm&cUq%r6|J62-9roc}5Dn7H}C%VDs*%_Jl~pTBfzzx#X_ zRZhOCsjcnuYsjl65=?fQg;s=+x;s0`WOCM$>fckq_+yC)_tta4|I~7iME)Nn^M8Kg zfA#Zl3ieRNy zu~mQm$bTKeG2i2|T>QF&m*?*bAqMg9KdAp55wl{&G|m66f93yqcM9+i?3}w574TW0 zGFjG^jZr5E@P$l>N;X@U4Z&IxGW!mlf5Vd}sIQ+d>Vw3A$`wfkFn7L8jsBB=;~&t} z@(MEojnhKGgg?-EcQYc zpCbU5t43=n>t+qcM66+CL^U=03sXFExY~06n%hDWN4o9FYCPqeu$j&`=|IboWJ!?!NqBJ2X zeA3W>z?Jg81uTp3hi#KcDui-5q1QY%6g}_Q9sRM2y6NPxMa!y0Aj&w$s6%FAM1a6T!rE^^gbT zk2SyE{Z&Y#Pv+9Z{NcL~9vmcLgb7*>+`-#gmLVsHvYkQ5A@f-+0w+3`aY7hH$f1FN zC~4*Z!$Kv)oD+q|f^ITWgyg&YEb zCY1t(+J;QTzyNeQcKJN~`l-qW-o3F(~$`0WodZgPmHE*5Dn@;}><^>3N zxKt93=oB!1b8!~}9pVS2srSLWJt)>mrJxQae}uB?vXBu9Vg8+9bhiyP$rEqVpAEHH zqOMR6LQ3%sL3w+YjBYJSzXcVs?=uPNxEn6ypJGs-&*mhz2uvQE!n1ZQ&C4V>Sz}69Iux4Jw(h6R= z=@dWItHtEQxY1DY!JfMRiz;6xIk)`KeJ@9}aG`cR5SG~k2S!%``E1$lt1qwS{tN+k z4OP&2Er6Kh!}zT;-8j0<-enQ9Wul+Xfb5kzahX*U53EtyFosA3!eGPHwh`#C{4`Ur z#v5-A?GAuv*doyAHyV$vLalHr0BJo-_BywBgKm}AFrsUS@8`j@^s{oD(b}Xq%uK+& zai#4ib}sYI*v$Hts*=ZmuU_5KS?^Sy0b%ir8ps3D21ABi0&t&LeN4BZz(Y~v@j;2jJSCJnRR- zXj$}I918aWB#eL;0)-wrE(ba!zL=EEVsQBIN6_|)>%ZZ}4w2$wW1;H392X}?=xIp~|4Cz3zfE&onVcYS_ceYk zSXGvwPsia(C8Hxq1Br4@4m`n(dlJfV3`so{bMn&*8J?E!fYI3Mh>IF(0da915(@%n zpkvO>6~A$W^7mHtmvPyAL@c0&IFq?JIf?JFfS7zFxi1*nPEFEZEwy7-J>K_pVE157H0fAZ}9_x`Kx>nMLd)QW)&V*|Ip z|Csf^wfy*h_rCl&cBkM_Ji4?@3~l&%jhNYjc>)>m4&$7G9tF;A-;p^$Ux4(XDZLFe zP9eFb8yZz!#t1k$+NQC-;O)We_HCp4u zz9K}+FUV516O1P`%6x2W2`MS}-1^FJsHhy=SlaFl`3e|GG$ZKR=3TE6Gp*j$%o9%C z0v=U`522Iis>^Hdbw|vetUXmf&hC_VcQji9lE zAf_3KcjmvPNUbfy&!WBK%Ja;5`-WhAKbn!~(;tk{t(;!Qv?WV4R46duqr6n(C1iB! z)G5rPMH|hPPvi@wbs=>^4pVhd3qp$phYJR+!0MvfN`a+W^E1W8sL$&5i>d44Y}hybu+` z0r)VS3-w#b^~pFit+l`2okINQeg&Ur2r+M8`e@9TlX|J0lWM4XcKkJrF*kqFgx<;Szr;*{*9W6Dwyr-{kJ}dX^xPAC;63qj1+(gL;n4n@* z7W2Aw!8o8x_iv^KV8$T66yQSNb&)C%_fl&nX!kQ|+(6|5L^+1$>rjPj?=iNzNu)uO zvL70~MtTbQBhZI;ZPNwC51+T1zUSLe=M(EhXUDF|jZcY^5FPI6#p!k?3I^>U#qQ+i z{@wt)uA8_}zD(z=6QX|2ehIBm9v5HT0~B{)88Q^TO*+VezM@pmb6gf*e!NB~_oHKz zSQ~)6iCNU3v~emAp!Pk1w+p!Ihprk@pzt;@(>}B%ber3&*woZHh_d@HVb9R;15Zn20#rc{Y~b} zRK13vKV)KNp2ELHZHsi1+x)p`bhmp95V5b$omn8=n!jSw^uB%j_7~Y;>lFiM#KkJ* zYm{KKFetEW`tUHqqEJAfen)}dyX-p8(c0K(^)Tpu`gIWcNc|8Jdh8&NqL7ewC)PvT z0CNf|S!cVtDEM1Z^ETGP#U@R~Zpm5jgEXfsP?GO$8=0UvQ69mTxOJ;9)=Be2%%_9j z(xuick^Ib227o@!D{Kx7XM-mJPcWEZB`%?oL*$_V7uQRiPr#UgCoFzwp9n&EX>FbQ zW(~e>Kx2?l;^1l)$LBGXeU4}hYBS(m&dmq&-}vS-QPP74A@zSB_^AkC2RH%o7w+D< z^D22_zg_U<2OiK0a&2ky+7ko+tI=d?JVi7`+Ep*QAfxj8abMd$D+!VAw zGRwU#6E&~)f;5Rbf8H#Y7)U-dg`-v;!WQtd2~CP1tTDI8nrXky{){5GKjQ{pAf-;_ z^BKCeXmBUFdWV_vUG&y}8G*A96*ab)iHQken^SZ)4GykZ^4NNGm^cp;zdZ=}){`*C zKbdav0B;T5BN{%;cs$X6N8dX_P@+dgG2cW1r8BOD0|yWCFRKI5WkzJ9vgctGT3Abo z8I656&$O35i>}dc>wAHjPj$=n?@~jxJ$;s!PmC)l@H^NKTnIB}k{4>sc`lrgl;6uRaG>p?t}xn3x!}o`%N8;=)FDcJE;l z3Jwawh$#%)(AK64_=wm;EMb-W*LM_avwyy|EQo(p`UnZ>Sy_UBNzK^xpNTnc#fb@_ zO1vS)PBSjW#&}rmP%iLr9->W1Vmi0)nC0hloD^u4e*`XqoIEafiCu%dQ?l+=1a6JU z9H@!wuwF4|61$aI^>S%>IdOO9NIw5?n<}eM-EyT3Fq~lU7}!$_DGncD==xzOOF<4B z)<5pDC38!P65yoX=m1QT6eO11&1DO|0XAzB$)^zQ%&BLHM6zF0mmFWy3BzURL zbUCBZzN+Z*9QiG)6VeoU+iqDD5LGCYkKEkEMOfgMRhrIlt;-qi-itbeAQEUb00*n@ zDnv?Db7LcNDSu;R74#vvB1J22-M$_1s2Usm)-BBVtUI{TKM#)gB7V&{Pvq0vJD4(`SCF5Nj1|l`kiE$+T-R7iTnPx325JGA1@C?B8Pomy zS1a+8$t4Kl2W+xcQBfLm4Ix-s7?i&9(peEwrfPgyp!f*ZdhbnGubXPEzDb%(aqzsg z;-FZWVA46f)xaW;9Y0=!@I>3<$~#TyO#S?RficH)0?fIqkej5fE*y4aJ~)14lohRZPa1B(r=4$P3Ms_L15l9=w2=J#$&u+^Lj z2(adq&nrK|vw?fp-o5c%&a^7gNdEiGJ0>Ths@nhb=`hYj47egDEJ6>0!9LN^(Xada z2PD`si1e#4uzW{N(pnQc}h~ ze-4Hw4Br9_%K5#n`R_q>oz?UN^MECSnS%xH363H4W7T378%sAAaDww;SiSljwgiG* z(9h!ohS$d>T7Zo$DA>e)#Lutt+OS#?EZ` z3|-i?X&RTTZRZ+W9QF_RPv<3U+>A80+qZAa#U^ei^qXe{4?YY^6{`bO2G7pvbYkQo z^hX{W+E@sF2s_0k9EaMwckck7oMt`g?JbgPXplmGW_8Lhx)Upe#80@oveJIQEA8f> zpoPAR`D8QY_wHHU*sF2SpqS;;)D+(BIfLwEk#(-xIPYj$XmLV3-ic2mL0V%z3}?jA?`7B=F=x1a^VEADCih!4}1pmMcioT5}uKkCasWo9!YZM_|kpy?yHY zSe(HPEQgQLa{S)HxT+ia`cfYpK&Y#rkxYqHoiuU+^SY6;F_S^B5#x)T7$gNmA7o`= zS?O7p{NYSBfO@(eQtSt-89OM_XXPa)VHJu+HCa{QkAi?Kk>KH3>m4z>0M$*GzwS`0b z_oIwoyN^y(_(HD@MpIvF7zdS^Bzz&AUQcbWu|g(lM7;M8{uoE>?!MV*`;qk$9?hYq zEYDnzHpp+6TM?KLs!x41^>+vHULb^ioT-U)>R{TMnK`V2+e{Czt;;)!cUNTG_c29m z4^-5c%z9tpYYo8BHD}MbHU9M5Hu~X%CsZ9R7U`%jlm6KkD#DB{t1x|WY)lo}091=f zj=j&H=j^>1g3)`Cw78BV)32{93-mDlKptA15T99SbEJ=1ISR--@~SZmHdaEIG~=Sd z^32J{&#!)LMU|l$`-k2zvBkwjh#lm-BU&HcZRQfM0~GEb7+81p8>&d0bVB^VoJtRR zdLY@PrOiTFxD{#x%GXA?)Xb$W4@WsIU6s4j=m9+>Dx?})=8a}I%`K;P)xT$pVC00J z+tFC8_%Zk+p)p za_kClbl4t47`pMEk`fbU)Ae{Bdl0x{<)wU%ytT#);H*GOs0HUve1t9n<{*tP76ftB9 zY7!B%9TIAa;Wo(*iYpW9af7IEZq_B<6&vjbC{>d#+4o&>@Nf6pBYhzLV7trH!Ux_5 zQ!Ts?TPU`nu^@s%xr@;);Dy)eoZPu{C#>S#Sy+fwVK2XaH_j&7@f&58m44j9t#YnW zB6a*b0(+X8TmX)tv(2;XE79UswZM!jcOP8tmF$!u#a;bzUTJgagznfJcW@X&>lznJ!gsO-H^UdSy4V* zzsbb1sC05Q|5@AO{gUj{UMn?XJ65t&b~50rW7UrPakd&2M%b#|T6~;#DI}WcRT#$& zPDnFbu++!WGRZhkVQCq-E2BOYlT4x2I0%OxuB_flO`HlYgUhp{W~iMw8y-TZC_4v$l2p_pTt82tC?I z;Qk{->pUCy9_&<(oXhB}bi814 zMo?3o5nR9kHDX!4p4Q?%Y?vg>Sin&})9&YJ+1BK$-3`C_BO~U{<}dGSr^d!+k=j!B zwzEW=yX@^6HQQ4SQ{<})cyJ)tnb$ri{cCzGv9%WH21Yb>U+80?)XK$tAuF#%N*Bcc)c=dDl5ca zIe6$0MTT{IjC*(?v3_Xh9$z1lD0pG@lO{%3PEHQN0PNc74B>*A3`FsdX*Fi-P429~ zx;eDtS|>sme{WS$P*=BOf7;lnmm+F%Bw(n8je<-&Nm5;zV~ftE4SNn>K*=w~zDCtp zWXfbXTF!JW5$f&jeQn!Ukw$h()-_Q&TPrK&Gr~q#WJ5(!!v~{rxXIUW9;Po4HbTJ( z>>t3MbY=)K7@BO~9%jMf1UNnP*ND%JM@A=JTvHKl1sQ`rqmQQBLH>LW!o-B_{-8?6 zd21ONshkfesbWw7&sJCV z0KYy=+`V#TerDK^xPcAn+aWH14#;v@TOprRADGkSeBDp~P;E%f@W?qRp6+nDB3JFE zxv3pLOT-alDzpuOCt~r&!nbQi6LPNiLEqL%>j`-=;bwtIO-U2Lp^Ujk#GU09;^gHne@R07Jdjv3QX>T3XuJ zJ$c!x(*KmNg-*nl!rysUQopkal&!)i<={}`xfU+USbL14e-Mk4-l1?KmIyYflHY0B zcg1;Q*szbJ%dZ3R651jC`IH9xjZKNORx1BopVq>R4XaR3xiEKkb*z#b^w^S%CO$* z(%n`;1~b&mC`z_a>ZqW%etiEo!TG3LC+oU&C-zSNEJC3AfJ!v-R<$Z)k5d z%^v*{N5^yioqSW*Vi9G|1k7cxGhVV@zeQfofD|yz;2=3hG#2$BUur} z87dOAVtBHM$bu8#+xPF(H6MxNRoLO^(PN5f(7r*U@U!{yCQPH3dwi9X7$=N8I?)ra zROs{+@_n0l_LTIu$Z2s~u7fdS*G=;?JN8>xK-PeSnV(K^r`dQ-IptIq=abWFs|3*?{=J+adW|eIXXW ziLt34QB4y+0?8CK>W2;<#M=NDYx}^zlu{2CYPFo9im(y7yXnyR=r6A;J0N!0OO5MZ z;iB8@GJ<~p<;%*ds^9ny0eDG#(z0rBu^Lv-hXWJs+&fea3%50LN%ai>UUDj{dv)oCt4b0AYP3u&*`mqDCc>QX8v`}pL;jh;;e|{b^04%40KF) zf8UUy)o@!8C8sn9s2oC0Yz-D|q@Z0M+819kOVUcg!0N75v#SWvnPe2?OSw~X+EH=< zLTS3L?u4|a9NnUtT6Jyx0FIV;{p{VW6#EmETaUdc*|46A3*Cv&@wMgU3PF3W-M!1X^z^sZ543j+i;Hv`CFSMlwRn8G z3v~}T#V&;nV&h!P$w4b7T`ex)nz*qJXDA@l=V}57?iSd|#=!W4trw~>Q!U<$;#;=F zF;+SfyTjGpJ%SsE?pBQLP*DlMUYst5ToMPSQg@0iZ)K+vNo+nSXH#Z9x zk0NdAGh$OJxK|VPE3_q0(q0fGZQi^YD#xsH{rtj0MkXeDI>e{4(rcl_0VI;pbO%e! zYVHdfa&)BmB;mSU+J<4jE)`Dd4ID^L@1iZJVcbpq&@+IHe9AXkjK+JY-(0qBPWXbw ze<@t=P;u#Y*|DBuj!w83rhK;PW;9Mz$O5M?!n+S~j(Faohe3Vza~&zSC$rlNH3(6bF87ev-SB8AQ~Rcnb?@0C#@p3<ekHywXFm5s*pj|-#6ovgC zZ~&BFM-tc9>1i_U7l(d$EMAjW29{sRt@-^ zB%Ki?oeA2GAB%W`f*$f7P0dx-ZcD?bgP{=j@6D14z6lF1LZbk| zSRJR_?`o*!Wv7s7HONB=VZw~Wd-&(Sk?ZhU8pNOc{qGa{EK>Nt|1s$>4c_X%|1oXp zO3Awa@W*Fft@!)8|9Syp`~TaE;~$h(XmkJT&xn`d`#c z%Kx)J;Q!B$cY#kk1!z{}vN}xBNqGqMKMdvrOd2*TCLsp@oJ{SlMve0YWFp!xP%4Hd zCbiJsHFP}Iy$=6>wkZ^0hA|Bd4W|MFnHU)xAD9>$w}akm>;RjGQo6wW7R>#}^YxL1 z-Q!xZyTPHY5d1K?T>Ij_UDI|bG%UTLEb7uvMx)4sgA7ask3lj>F*M$N~L zHUhw;)3}Gwo8elW&fXy9be|9=#%sP97Y6hLbqU(S=cCVWhv)^_JGxZ#L$*(`Gsawv z9%se+YRkP55X=YG*cMrSGaRJZ_wLP`?Wns^$YIbJy5ffqcPej=`UnAEMDS~qr?u^d zp(CGv+daljNvnaJ+XVh?sYa-C@d^dK@RkrIW(<fyCs`%R8TUcVDwCfDTq_SsWDzIziEe#V>Ew z0Q5qkbggR^q_jpcrj{$c^<_G8NAiAs?5uzIJ`4gAuIe~SGSVIKDOyLP8V->^ZWpCg zBa!6iCNvp0;{c*HynP#t;+x@xE^Zwkwbr#rB z|E;CzVU0?b^DT$Z%f+u*Z2iD^W@l&b1?kK=`-|@Dz2NXj5+vbnhrjtZWY4gT&@=!q z?7VzAGgIBX_Nz*yoDUC?Nwwx|&h_h0oE3lm`qiDM@Ad2SMx^&~YJY{VM(0{-Vc`Y- zLx-@w`=CrxUMkg2xx~I9$nvXH zl-%7RaIuKt!ugojt)i?PG%@t&fxtZ_9z{&*n9Ji}XWymE5d0nDEiE%q*+K?DjjY=6 zIp4Z=4GK*G1WB+z1tS*P${*wd9}b;H7Dpbs-!*4U?d;Sa@V)5i(Q|KHt<8NvezNgR z{3Z7JV4Iyfx%j*yq&n!|gj9BZ6uv<1=w2nZFcm3Bps=A_%SjrYwPG3a8zm)6`tRsI z>0LI|=1vm`nbjzMd0_EnW0V}~0CmWqhrfp2#AsezVWvFREaI^6!l;onioc%Hv4)-E z)`Wr_Q-GIH;K9&={)&c}hhoMK&i$$SXRv$_cA>QihcNLAyS67}ukqc$GwjUGwQLZ zE7#_PsSd6fy3*(N?v6{sbm;8tEH>jN_9zfa_a^XmScAotl#P5@p;f2;2Kv_Y-C%7}w&lsqF>B=StFHg_Diep?0mfEU%^p#1=>2Zp0#V&>crdV6a)zvco0oS22_b`n38|?J(Jf<*={;!} zLp(Wo;nF2E=w80QsKr#`1`2of%ZJB5oQIzQqEXk1{)Pr3p>k*uJM%5NKTM|rr3And zZKaID>z6N+vEUIsUSWgmtS9ImVne~Bg~E7($XrmqgpVVu0sR&)C+7&N?&0AIs8!MH zvZh1UvJGfWktG_MOjX}z*W6vP=@?Oh4}ot(L*sGm-nHn<5?*V%;1~q)-L#ilnr6dk zX%fMQbmL-?!>8kwjB&7JVp#FuAl@Lvl&IAh8-y6&)rP8@pL=XiY*fdOLK9&L3{ZVQ zKZKn)5?CSb8XK>)vC8 z83*mk8L@^{bM$T%Mnm^_pX*2;vV_zG90!0w(amSgC3~`Li#u9c$_q7k3yk-MJOfYs z*u_5}K*sLjgUZTe^H1Pa9@NwT3&4bFj9DhLuxtUUcjDokxQGaX9~07H9J9Bcf6|Kp z6wr|I4ePi21697Cm!}&8gV9fna0WH>zN>4CvhuyED&82pw`WhE#&rWcZ|ca-O^6uw z)qNs^IhBuBky7=H+Gora>BCPS#0c%*FN^Kgo>}qfrKqscpBgb1b`{B}r15Ma0%~Y# zlX)p!Ud32sdFAR=_ul7L7H++#yM-?xf)3cyLbM~j;&nzqPzGhODJgoHM^dXP*ZF55 zj2sU{e~zqfA+`%HED;>0T~<3J6coCjK84tWPMq%&nhw~kEa#;Q^oRYKlUi;xL_mZE zod+mUeC76Xv5vD|>8vT9?(ScZ(u(beLmK=zR1J(wa28%@eOuP=S~${m>#;}w)`Ck3 zM+~La<(&DId-`cDI)%3 z;le}GdypCX>bFy3n3Tz`U9jam`n^j)8#z7fMxCAP$-L!N1lU zxjuJRME+ACb0v8ERQTr`o0 zK`FK>)hx2C_mEXmvdlImVhGW#W70f01;mLb-H=K>C)bnL$;}u6{s;gN!Lp<9TAnB< z&Z@>82NDM1yg1yJaX)U~zCBVD4+QYFA0$hlbP2D*jlCRPT;5tKIG4Z!zX9|D;U$i8 z5K!m5j_k0B*QnZ8{oh3ehOhs#sGzuaP6#q9VE#b9@KMnoanWXj&|Ns6kgyN4IgcIt zM0Df}3!q_C8VHdWXmxlI@FWot_Y|8Rt*4dYf7eksq;BMX`ClXgEk-hJc+N{9!U0qZ zmWazX1trG04U+=y#9>qpK%beJ7)JB+=TE??V6Y)ZWTpSFQUJLpx!LunnhI`XbKvm! z)Ta({`Z;BO&?w>6)$_11!?uBr(Rp@tLK95md0o!-9J>IbEvi3Cdb*g@zFF0*Y zfh6IaMElhpd=byQCPTsPsb&!KoUlNUAc=4k+TD)lnv8ClS8_NjR8?G0e&!bmXuKP^EbFF#spwQ{Dmw0RJ-pv>Y&!Wsn9#{ z)G3KQX?IY3<_iML6fW)xxq8_==9m5bgL@;O(6yJNMnt^m?X3w}RF#owd;4~M^TC*X zs}z8?p~$@i4cHcJU&vJ;i9=aghu1K9rGBp4b!>YXV?_6D>)>?$1Bd5Us(22V9wV3q zG8I)f;2Eq#K1O;#HvasZ)B6b)i6g-4?vAnOOt*);AFbk`A<1v;bqEX1|b;W$1 zqmkUm#|A<}8>Pi@bO&+;^|MVo=ehBriR2Ei&%6Bnm3hWH^&%ea4qkJy%UN_@6Iy_< z2V6);B1mVIqO7b(j~}nBazpWNG7LH1>9{Nl7W%|WZ0NIz2i)AG85gZC0rE!)5VyW9>P=!uC{dc63sC&v`G_AO@KHEmO%fl$^>fo)DkX!P zk8iC=p#L1Eqpp}k2siP$z71Omz7H!(I?unqo{NIoN&5>YWDlFQh3oF!zaN+EbDiEr z*?6zh_82Z&neC0@aM$6%`yI23p)n zdBXV6kQa}|ivLv`6n@9QP(Bo4SDEvBs5)`mX5CI zP<0aj`@6>vz>ws~RX?)=S2p0s>*|g&y1eGpIJV}Q4w%7XA|r{@4$ZB8;MjDS`i9c} z>e8T!bssG(yP=6A(|&*}UpRTd>$=G*0M*y3tFKVE$@x8#L6TgCRapcM1;`n$h}G?qm$o|qSr97)ax2kA=?iNG72{Jb z_MUwQHWA>nTsZqx(y?KPGb~&Zz2B6%p&^zo5>r%6oSf8>xCy8mcLb^oDAfxJ3q|d! zV-sw6p+DJFkz_KI-pWOZa6MhPo^^mVu<{jV-rd;S_xklF?2&Z||3#Hhc`FH_CP1iv zN7mM=GiG24_zZ#y!UJQIlPfX9GcpPyQN31$d^)D4Fc*5?twAi$ZV}g-bc0^KSG-r+ zI|NKa3XL#ch`tV@o^-!igt(AS!zfaEf1X+-aFzOD^oT=zL0*%~IG=2al;q{TfS&`x z5rm?oRqnZdJ?8rjbB4kDhf1xhKUs@P36QEIq!l+zLNC27%+&=|GA?hG^z7E*B${*k zn@V1UU(I_WPm@N8mfLM`f5`oxg{*!QSkxK8&LcYd2b{z%5ALwqoSaBOkU3P>i%*ad zhD@ODjry&#xZZJ?`cFTak;v=Sn{n>7xB8sc-OyAjmLw3%wwkFzNsR8*`}ZK>;Sq0d z*0i(B6eMBBN{Nxup-FybGA}RkG4^`(f~{A{mR{z!N>p_1kqjKtOTM-6l~l@^RD4(C zL9;6_`9`;mK$Ki2?SGI`ysi0{l%gPAJ#>RpPmsP^7|a8z#(y(hj=)r|Jp zWtvY`AivR5p)m!-w#UFAezI>B2yjqQi3Y4{HN!UvGBeJE~2;9Pzm@x#$rf4eLtDZZTLGHrD&c1 zlUpR3wUUi7zq|;k53PnWvIXup{Sj3V4Ts}NSFm{aHBUl(RM-2s!u|H0Phiz2Vv@9o zh=|w=bfrgKWKdZNYGjD&qeDjfj5w(yrly@}$Q$LOH1-*aK!0%Kg}hyQ!a1Qj59wIh zy3Xnflp#{=Q7kN=xWBVf1V$gAv_M~h z`4$G3I6=+NtV?k+-G79JC1Ox?Sg{5#Qho2<4^`TIf*Zdr$Gk+UyG?EJE%$M z*#(13F;g7kT1iP_h&U8H9v*Uxv{rxC=0NpB7SFYE^ca)$R)JKZbK&%&aU>&YZl=dns^)p9y&-r9!R z_+Zlb-Btss_ou9U@82QOobVvQoH@rW%$V2P8Q{RfSa9guHR*>ko(o~=${zU@8#nH9 zzK`W+??`;wGlH=UE`^6j{lhSI9YZSP4{mj1(J_{6Q6B}4Bv{wEY4iBr%jz4li=N*4 zXC0O-MW+f2+cpD3p9UEb1xol(tcQrvD7YuC$&@i#KP1sqV1m8>Hq3Dhro&2=%MvV~haw)2 z0ku--Q3`G}&^o4rQkN%?JS4(5T)JU3jjENMVADM5&oazWq3FZ zd))QfNZ1!5Bkj-2fkY?Mp1x`xilL!ceBK+{tYd&7C#R(uxC8IpD34Hxyxi{b#>ugz zr4X!=u^vLp^0QCSQ)JYikcRBI*ZcLvzw1E~%=hlqoJyBN^kCDAnDl?I9EK?1pw>Dt zFafzdBM41Q1iv-1aB6F77gQkS9l_lVj#-Ol8KNNmt43{hF0h|COr8Msu3zI%X zM#{-&d;?D}ktOWWe*ffW-k@Wz+uLK7ayPt9vetJDV2)`KbA+_0W^kyNmYduY7mUb2pjb8$GLBYHUq@%0bVM-`KfV z^lAId3ao-VM>pIhiAW?4XR`fd#?wTfUDi9SH`5^U#K!7jKmAv!0++C8aSdLamjv`! z4^jYNpq3eW@=;9bla2a_<0X6iu|(`HPGv+>&oU!;%4kXbA%q@Q%xZwZtX9mUibppb zmBWp2ej}k}@77F(>Gdo7*TcsI8XYb@9DIm?fGDZRa&5>7h<$^D7vF2J&#j4|f~v32 zO)R+^JzPD|@)Ar2fNGDJy*H^hC*#%h!WgPbta%>j2x)Fpk3yvqXIl)^YJ751T1x8q zxR0E!SuSbt!-rB_4E{yiFXWLSSp{~m=D;lsC?k-hd_h%Jn`>Q%gu{!g>$ydi9ZP#f1TPP`h(L+kJIk<$@kg-#Kz zK4v_1zCQFkwYk0hg|i|`VJI*@qr--_xG833cy5wT45{9LaLdSq3%_V$Wf`H7i4{>s z3c{nlzB#m=@e>;&Nadh<5b?l!@fqGZ+>u;d$)IY`)j~9l$OQ-_G-h09P-z<6kVm?C zULJ8;As-s0;1GXGX*y6*bp-_l$o2x{XJkwtt~4B|=B>J@ckqSYd141i48kJs;pL?Y z!!V*6FpNr)J*!FY){p-?p-Q4`9g%8X(k-h}C-0*F6;B>LbS?(6~msu zbOO}W)X0>GIOA0fM8Av!2$I5&tse(YNuA+m8BvGE0s?zfN3duRIstxuMi=1HY=>l5 z9I{4v1L0>`*$lqe`0m1!|GEmg?R4>tp7ihttKqV8vaetSLoe#Ld(VBU2KLb|ZTpOF ze0?}j>dEqIYOi~HFB|1&EpFd*Q+n#L=l$!9u*m%nnjXzVmkLSsE?a#zSku?Lye!=5 zZhGM3?BCv(O=(0%S{kFD5E%OF`*%^kZ)Igbe^=hv%V4JU$0W<=MlU&j*lNQHaVK=jX>bF~EOV2{kAJl{1-`hc4;rwK&eX@;xa?&xKDL zbQU^uoKqOxcbe~82rK$r9xN`*{mDe^tYj1{KcWg&_Fq{d3Ga6f-SqlQbQ5Ompz9cI z-_9tSvCAA4S>}Ti5S3N@*;2qA(HAdPl$Xy}U&HY$&SMHK>FKs&;=Kj>Kyh!hePkZ4 zG~tUnz*z7%;6Fj7-E>g=Hxnx!)*Ty}zIWbO-9RO@Tma{z9^JZ?W2XaTo58cw6n{V5 z`otZRkiholIJZgmea}I9x0wNaP)ke9j-XeIgSV?AWs3*~^vp2>p8d|nhPWUisx7t_ zPj@ymAAA;AIYJRjTultywkX>ql+Lm6r`T1O%Ab?1YrSmY!n|S^V)5RKi`G zW0=tg`({ZGI)-^Ls!6hb$~VRSG`hry43t#Em9j-w0i^EiT%~emHyUExcjye<`b)s5 zDeq)t838>5N)g>9U(-M0jhPB$1{JU|A&C-`UFbASr4Sep_q~Mu;a;ti!4Si8KF}AH zXe`||M=yPP%2o6@^`y1PJqgAZ0=B{jz^~YQ^A0pMHG#giwj12uN#1->du03{CCsW5 z5Y294m=iVv@A>|jNMCx}E&XoD8L%Afpm95@m3ADLG~%C(^Y%%y1AvCxL$n|vBF&gL z=@TDI<%+GFR=#5~{8xLM6$)O2l~$vm*S-G^LkzOIy1X-2RFwhT1C`4KzkKUtO){e+k$b)Wrm)Fn1^O z=s#`3=6am|x|n>BD+#Q|L8LDZik%{zc-?}(yUaL7rgR~!RoO$YA{8;nV05sMgO9;I zhr;pAIW|d{zSvKGJ#*qqtgd0s;erh-a-#vJkj@MsG3<2@qY2UH+UyvG709(Btu;^z zc!<Djla7AvKdJ|$WpSl6t;Uk>?5nG{KvU#(cL{XuCJ(XI%?WQmBZxw)G1h;1 zsRoCpo?e)YNNgOPb_!*Bij|^tyx-x6hz4XWeL-#}z5V@FASv+mgkGN)fdqyS7*J`5 z9}mm82OZG3Y?+VWe1gNs?UlXKl`Cm!1S*bO zpv4;q9BhLyx#j6)-AC+QL2tYJO4Eh+`!pOM5?Wc2P&ZxxZDKX`R_5%cS z0wK$nCIZ}a{>mA2eqIISeP-*6V!O~^Uk+K$F>e%0U(#c`ZkN!}7c0I>1Fvm&BFdJUot zkCaCno6P@B<{;M4>-qycZA7wLDr3_s-Mhm~&9D-HkW-%!0k*mQc)ubDd^C0;7v`Dk zC9HTcEhlhu(H2+9P*Z})sSdOge9IJ<3cc zEiLOhaG*hlFLZ<2EztDAPO7eiw{CS(gpn1eUbGy#8Z;vPvF?U1=Sg?JU+Qt#d6&>A zLyO@K_3MXA+>c}QV@~V0XRoz0&b1Q0U|A3hc4j(WCP66RD&@`_=2AG<>tHDSaA*@- z_+v6=&?@p0FzuEv>WrE89IyRVXy<|;m5O64%mIIGO69ROrOt7I@~*wJ2*(QP4Cp=m z7!NJ(12bpO%iYz8A$>cYMN&8u)Nk*Uf3|~#5*Qe$qv~7V@Kd-Ihj)Zu5kJH#mkovi zF{-~4A=C0~fP{;Jottld3+N{uq$7+$$hAN-0PqhJjyG>^@9p)4wExcKGh@UZ?2*0O#bL=@TSKzqhO5O+C4 zK0v;~Kp>RE@$xb-Zt#O67{ZNf88mFKJucpVBNFFdpQw!+gdqiCU_kQ0)B~=ACr-k| zuEN#A)HD`|exfa;Ecilfiomy4^||5I;VOi!h*g`#Ej%FwNm>E|nLslAPo09S2d6PS zvCK=o{}Y8>_7)U2d-Wd*n{%PXK_0U+-nFzC7W5+8rwvycYh`@}E$Nc=)*oBkbmGIn z;SnNAh(?J9bBIc%B~APn-d{ydZpCOx8b@|Xi3gw!82-VTAv^8xp;g%gr2=P3kE<`V zf#_lMlEiwO10`FY6<+PQrDiyIl;?Sth0)CAj0|WQC&$LP+1Y8AO5hI6HYJ=SEA%Q;urfbmO7;eP(AsIH9v4}HFQoU$^BF9@C^3o$jqGW9tw*~{(b*( zqp1eVNDE{XPF*?L)4yQ%%6bWvS@(Y@qd)M&kq!kDokog!Xb6rgjD^JnWj*FA2?>KE zBbL_IeJ@@R=3xyo5XS+_@1MeedUrQ9ZG=_=y)Wi3K(eccXyPkv;4|^GP#@!)NS3vG z@#%-h!7~p36ED8dVlM}^*$-TtFaz4cu@6%pT~}SKQyu9{3CNvmUH}t&e+@dGSbp`GmLeU zSTU*+c5_I4#_nZ*N3zZdc`5q!&1 zpeS$s5l0+NaBv(wItm&J!Ga&3uC?l0X`zCm0wWCIy@!p_MC$Ubd-qbh3!NW513m@* z8bPp6t7zppczFXMHo#SYXbCW6R##+iTE19s)!VF^xzCRkhf;jHR7BAE9Ha&itT@0X zjfbjgYWQ++oPD^1#f9r8!>&uZLnJRpWfc1ifv$PQ#Z$m?fC>T*@HiN=Je2qWW+Y$L zw>WdqcoMh8*cd6vhV*{0TQ&euJo-=$$$Ky!y&8p+;o>mI3J9T7|;Qx>#0J~XqWF+d4%?k*XqV3RmS>5VxoU4$>_NKEFq$MHfLE{7a z1n<)6@?8;*D*u@)kK2&cD~bmOOE7Fd1hI*%Mx1zX+$C@l;XpWTAWak8@_(`SCg51M z{l0L6>aNIbNJQqbWS*5Wk0DB^lvx=wPer;zqB0Z`MG8d-DMQLo$xJ0>$V@~;Lim2S zdY|`s)_T_7$6nul_qV@et#usldQ!@DU)On^=l}nk{OM1AwLrqk^8}n+Ob7-r? zMSh7Ro1715#_TQnI;@kcq;id*Jg9m}Hg_xl1fn95oGbLqH-TG+`Wz+^zJ zv}MixeCyz+v?;f51A_&;3)w8hVA9wk@i4xP9H32&*Wpzpg53O6c1|sg+cog310;NS zk8s;zcq}O{hCbKV%}x9#_c_7^SXS7O>4LID*6+Imx)Qv3c)DO`YSZ%6R^H%y*uE(u zm9hUw5W6z^3gOF8#DLy~_*Hq79>thc0=~kNV}bS-xlimVr3YzXtY~U!iKY;7r}o3k zhFci*@=0-Vw3ny5Ud;9Dp9crk&AJf3Wrg?1CT|vtB#52(r4(;xdipD|EwnUhx0_1* zW;UIH3X;wVd87FEhxbCwwbyJHl_n`3rtVp1gbV!mjs~;Qc{dU>ISH#0Pvy1U_{B3% ze#7H{4=7LvYr5GCbrCiM^A{(OlbDde9B-^Nc>atuGbA9Wg^QsH;6@enfV4X`_+AJ zvm?5--L3rW?Cb&p7k;82Gk$2bo=-F?@Fxzo<@|tItl{lf!; zc!gDw!!WPGAI^x(+smEGpAR><=4y%bx( zKXKdHT7+>ZnUe#*0abQvKt}Js+BfVztawbAgP%V%nz1_cc3BzFAyhpq5B17!V$PD` z_N#auqs)@t3_N=l$WCxS0Isn64SgNqLwJ9Z2;ON@x0;3qK}GD^?PRPvXJ_X#d7K&! z;T{*Pnb-e{EwEnud!ZZsTIgc;-=BQ?=}R~EcJuYkzq1i|5B=P2uEE)VKw^m{#|8VS zFG2Wafa~k8|Awf}5xiqAvE$ou$|63>(>scuVuS;vybv^np+Y(QfRICvlyi!{SD%@y z0qtIrJ=H#btD4tk^y_NXIK|WQUFxTHb;7b3rKl;}vIj=j`#1XK-87>$b#?D9p@Grs zqhHTbV?Lde$&2Ls-jNY|A2vI}GIV$4js#p`2U@T@KwtIh)GTLhjy&%rg7O%bA<6uF zs4EQM1C>Pq-rhgJy zvz$^`u3*Y^N)M+>EYf_qPlzPcp@3(D9%I)19e?1o$|b+FD0I2gIXOT7K(hW< zRYuL5J8-ApE-yZ7W3tP#z;pqoTt%WrrclOfpejl?8k~&+D_t*znXn8 z+35aNkEbv|TWetLi5$*!x^X1+KRg`s*4`xRpswn-1|&C?cR9X(`7*?8 zlIvx_S6VA4Wm4R@$ zJQt3+nv+pb&`gnxS4of%pNSZk{q+5{B#yUG{-w2!R8LSNuHwgi8uD(~13D&i9y*#W zskF}^@yqZs((0RHci;b2+plqXtp(l*1t@SM4Lms|m)wF2&5O=X)@uh=bMchBsIAQ8 zo9vK3E2Q?02TE|HCHX6|DjMG+d{cErEra?3_C&GdEeE!UB^Kx8Kox+1kw#JKj*8Fj za$;=7Wo2FXxc3OrF)`deyD6YcRP*I}j>cgA#}7=|zC>8Pcui-VVrh@TvcVq;x828c z{oQh*;(?-fk}k;YvC$oa$SkgXypUdh-K+$IG$fzw1T;2z{VgziVuH$)+DbSu?n(!) zneyG;Hd^H%bqF{XF9~cFTK2vl=+0klbO%l}!`}e?{TVHF^>uM9J4B<-ddAF#z80-sGg15HVtD@ESO-%-C=*?wt1;sj~IvtVMC_=H_PZuM(^s z)!KqB2!fQ?PiA;_!$rC?-L(qBf2mhs)dAX3| z3|Psz$vsDgK?;8qdm29N9Rtw4CT3NIl#Qk>=Lk}cdq@Zj6H1eB!w!YQK*aotmBKg$8d94N!FpuLR^+^X`TUR+PdV6K?gsG zDIZ%OWoM3hbQW&Mxf! zcUnkzHL2Pbs_s4Z1=d|X+x~RjsMZv&_L4TG%ipL(6L(S}shs~xuSAA^@1(MSy z)DUK5mW`C1EO;#(9BN;`Za!H+`_d0@0eUr%n$St28zBz|%JH3nkO~)pJUnky|Dabe z+ABtjr*?g}yW5}nN94St>Gv&t3S~7c(ePWRwU`_ws?039CtLq}hy69WJZcu1TL-pt z@S}o)=HT3EjWa(d)D?-J9szEAYbTK!`h&9;laX&ivw%T;l~!Vjdjb?>WEfdrYf+At zVoD-l6vRc04G(Kd4IIVvXLO$E;&_I;rzXit@>8eI?pr|~>eDiu`Qi)iVxr6`#9%nU zbMxkn`a>qoRi8AVvn|b}zITwm3LGtDMQB%X1&N#Pn>3M6_4V{e{}hctQ7S5&sQB-C z(2r-3dW&ilyEMGPDsg{HWuJX|L5F5wyaj$5cexI(~`Nu+pBJBwz@w=^kSn49YP z$rC7h1Jp!uG7A!k^HdW!F{_aU7!D1NDYlS(gm<}fuYBQ0Kzjt)i|2b zxL}U*#`Ai%VVgNG#Skir_Biah8W(3Lu{B_}e~YoN^Al0wKX;bvs7_0RG&<1-CSYsC z+OZ@1_nSLAQ|FzQ@pui{;g-ZRj|tJSv3x(foR$DGy1BS8($EBpZ}_w;vftB=yNZ91 zmV#+J;PQ;0h@Z8J*1Pp@BLNywBf2TZhw}{(F)+Qx9+10g53n<3K#PP zV*l3%?R`m0F?TG}8#cT>e%}SLI_m4k#ybPBHRZ6XmjkW*bB4gIO+Q{>ga;gtI0<|A z{t6kN6Ub{*jikJYw;Th)x)YK*J3Gw@zu&xoUWKgiR0P^I zmBzYp!-iYOCAT7DjFX9Nf_$i#U=$VP>W{nOQu>sfSqZTdP-^T2sH`jQ&H=!3x%tb% zFM}8E37P1vAMWqIfA?z)v|tc)7)N{*KJs{Pc8l%X7!plB-Y)jXQJHj2b`p5=&JXmC zj^f}@HT#--eY2v4Wv2G6Ay__>QvmOdU=iotd;58tjFinZxjhWOX{m9}NVMG(hzigk z$&0a&K%3tZNvksj1%`vI#C_8HV}-XKZl$PLqd~2D4-dl$QpOR~|x8Y-}s4^lq8q z)=!B+2pr4H11NgL)bx5E-CLu&3;k!Zc$qt+wVpaP6jneauX96YVqDSJ#l;0Hfa#dA z6h%$*mEMoC3Sqqy+zc9wiZp6A(tIuP+O$V-r5I*P2r|e(_sG5478U>Gz0hY5S#+su zCQA_$2|gmnko5d`V8Qx)f~8afcJQ%JpT3ea?KvqcrLZ-9T0xGyB?R?L=cwgaZVe_V zZ&64T_;qseQSj`)kIft`IeaMx$D?8>GuB1E=eVCgn~dM2Z8J#}`iTOuvZ_j8i37<3 z5}xl2vAupxX`x1J4#PGE2C&Mz7Ws<$_9ROFyLSeRYsT@q(xqdTXvvb3lc#9j6$R3$ zEJj5OLr=|`Wpr^o=L$_KSWE2r9qe0X`<^{(bk!ZT-Bj8k=l^XDZw?2`kP_^GfoM;C zd_)cWQ&|yJNal-gs!(v(L@vH_AdNROv?4 zlc!+r1Bi)iuH#$iDVPKx%Li6Gn_+m?co5GO%Bh7n8H`(D?Wh@9D)1USw(m&9(zB&& zeo8U~?mm_97pqh0+XO?|!_@SNf*Oa3E*THsggicbkY8`-Mg1w7te~qKOqikw}s}Nl)A{az{y6g<6vRHh)pWAq%myOdd>TPloyLN$_ zfSm0E8oUihBi0^35(WDI;Y4}NmLp4g7EIq!l)h!fG3MCybOGs@8^HPl^saGt-nb$VdBt0O zyBJFM&mih9X>6x&E2cgmx(Bfw&eSlt59||{RBUNJR~v@`7kQA!BKhY+r@8HEzfY9j z>VdgRgkK{IR;&HP6|gja3}dzrA08PSTZF*> zLYc?jz0dH>eKum!GZZnyU75ic@N${x3fTBUnSi*-+iaYQP`+gu>7`cI+2lPx-Z<gLy9e`Zq#wjt>PC-mpT}~i{W{lE`t&5 z8o(nVxuf71B<^b7;KT0t3+WS{^ zjCkDuc_}DJKVJWsgFF!g$Yh&C(vQQJw}L*Olv0YTzIO(lFsf>x>o@QGl3` z&jzjrctLAZlVYr%B|&_`k`*6EAnmBseTvJK#Nc90gOiItUiD96>;~6MmCwQY1Wb@i zSxf-vqOVnffRr|-d=0|4OA$rnO#)G=M%@JM%+3|4al?iV@j&SgAaHk^1nEauL zhWV!3({d_~7+q=H~Oeq9mWz-~Z+^Y=w?w${ff!N1vlVhgfvjS`~Iu zygAeY{jRf+ukndnE@m4@Q*V5ABcqtop-zQxWulrr+aD;xX5iXnh_6?AU?RvSDuY?ZC>uU=atxNvVV^ z;igo!KKLLZrNe8}WCtJb`#MRy-H1Avfb0*NRCw;;N~u(4G*TW~96+i)i3B8`Y++Y8 zeO)0fKi?g)bHEue+#&w}wtHx;$iZDmj>cU8BQn%tx9uaOfG9K|neg5n*|-*3OH9U8 zLrkT&H*x~5dWFFA!RFOfHa}Keruz*qAYAJ=v+OcR3mVtzmsEHoZ3|0ZiLi6q zSQCB_2!L25^crMPZrlhjX2HG1M;GIg-U9Q2+(2Gd7UVi+p~Vy*e8*ObyuwGC4p)vr zM#sXEsn3t6(snlD^5vzzXgyQ`qeyeZZ36t2*QRr*hPYLJ0P`4OX*yd@uXa+}pXvPduyhN8&m*AA|SsxIL_|o z6BCQt&Ek;;=yZE*jrvhN(3Ey|=~$l_h6YZvuD8|=L(_ky&EwT4r>s&_xAfnBmrK@^ zU)BVn1fxCL-l2de9JN2Liw!5vW0%XC7c&zw&r<D?d@k*uHX zm^aFwuHDF+#T@oYB(8XPbUZ%Qi*s>!a{oNL**UH^55mGr&u_}y$H`GE z6L!$f5xUu8x4}&_92}KJ9mK6YVQ*{&Ry)V}5X)VwTaz z#>V4f@u<%FM@MxUHhE*-eW8<`9Xknk24P|^UZ~;ZP2i|ST|wp`MxEh8ft1RsA`15h za2VPjEQ@_Yv3q2Gcb{SDcJE2km*#?38=-3!WqZ2v$z)59Zf=v*1=H323t`xf_ zQ$hLypc@lVd83Dcfg#P3Rg<;Uj9j726}CA*DFJNwGTR!zk$sHd>|=j1d#f1Z5zZgA3?S629~hqxdN3WiJp8P;>O$u+t_F%)L|=;p`?0@h+o z9W=N)tLiA6J=o2h5wd`vJ0($Pb9HEJ3=RQEhmfABcKZ}!Np2ficJiLGKLa%)7|5rm z{UGo~Fz}-DREMgke(3VnqU2%O!$Db9OdCujGe;6zq0dnG@#);2$xNl$XLU9 zrO2B%oyFoI?nMMNCNHRj?M;1ps>x~+I=HE1jbRLnMZp8ZW^!TS3^sC{ms3|ZBqnOM z2?%hI=Uoyw06@Z2gZ~efcB+@%m4_^Du@-BCVvX!LK6Who?a4NGY1)xEY@^Q;G0BB< zUwmc#(ToFl8yF*AAc*>1>?!#*$+XE&oDjB%i32bj)Sadu$A%KNpIJH5>~Q)h>AK8? za};A=)l#`Wm6C`C%Mci}nx$~6MW{i9fh*IU6M+s)!7$y?ilY|K2FG-jZkyU}1*L-) zEXo^`)dCOi7`niBlvsbXz`hC3K2KWo1hUf&i|rS{T+T zAa#1f5&*({oD*TkR<#6c-`AwK1 z4R1aw)NdO`B;=sM+}44}TwibRoa{c*0||z$^{@eZB8J4>96E9wdQ`JM6;_LY5Fr({6sDaV3i+$plHeM)&V9BZ=R{(-b3rlVB4hoWM?jN$Dhi zc&OfO4%Fr*nRmPc(`bTv?Xw+G6itpO^Z9GpF5| z6XV1#Zzorhhg3<=9(MY2@#)`)Y98lNXskw8&GLp!JkM~-wJ8!I4 z3n!-ZNddy!h(h{u{;RLCiL`_qJ3YPGk>|0xvDQM@6Sp)tfBn1>8sK{CAPpEjJP%{BXLX1^fevO^L@<8OflN&( z77008*_OA1Md(hv=Jp)Jho73QsHnhTjFi(%g@(lKk;q)Z%lfb%r_;N6{?2oGr_RT` z&`)h;*e;*UtJ}kVR=$L0nBXmpnEFxj3`;x==a__qk%0lVC5DsCCkUwPn4qiiEX#@M zi#v2;_VXO8BUZsK1_;>eN@`J z!$^Qb2WA>fY4s6~Y9t;?SI}nhuBbgnv>8bLG6>0rk&)3OyzoeYh){!+HtPEI*SZ`& zg%OvzNZm;b0Ht%2A6Hpmvnbn+SRojF_Aali{!wNF+YJ<8k!tNZ7`HcyqO%q_zytW^JyTfaNkQ83q3JmkM`LPp&`o^X7rBkz zVz+2EhH0aUwfAG@pqw$RaEyO)^Y#9bGPCT#q(U(zRd$1}$0#`ThbgJ3Xq0pl<*Z9r za?S{Z7a1BT#UVfl`Fa@d`RStYQ;Y=SoSD}`9fAqj;fMn1eu>*sY_;+FnLeg5)X#B}P<_+Nm>aBQI}kDSz*ujzkB87f zfRg~MZtM=BVd_{fsWl~Y_!uki9qJw_8SL=-emu>-AFXzS8#xi+UnPeP2s5qw`YKDe zMQPiG?l^FhXH$v!fFePh3tmKM#!<Do^R%ic#o?Wh6YKNX4PFn{oYABCreD%I!W-ANq~S!_2`jFcSToYJ z;XQb_?#h;ONYqa)0fBj^x!(MNS*aEwhKS&J znUZFDGG1?UnaQ4@{Bk=u6!#p(8FxE7@MeykCGnf`$=WeiazD@o#afoWmLvnUxt)gv zqWJe__p=@&SSE&P2(J;a@AdWLs7;^VgSafew$)q*D0(-UJ6x;BFfvVodDk7+3pWxY ziVSH7Nr0e#LRRYa<-=wcmR-=UqOxu3SK^@LAkCYVL7BkOhdwfzv0NudfZ2Y~XVBn6FoRM= zU<^?$y`hJ8xj~7gEe~beJ@P#6hpSeqLTE#zQ(h#Ky`qj50a3kfN})}5fD!VOR8+0p z`QGp&i7uX4eufZb|3)D+c5Xw#eWfo~HAWnx^&P~XT5P5^KZEJ3fV$u**x(rcmpxD| z<=bSnmDt=>CsR{XOi$6_wPcz`dylGoX|A>Gy*9c^JXEm!o^Hf#H^aAiH=)c`Yr)wHtigkv%v7#7e>Nj5jeNrquO{wRI@t=ZJ}3A?&*1?7rIkQlaMzV zRnzaFAd%O`!pNwR{rTo`f^xRNoq~(Skw=tN+uyxYBS0xB=r@2dIOx$U_xP4rj`j9d zY-2=dK=a09FSnFSNJ#-tCZGDHcWoI;e8N?g7=4-6&)aEayx`=}f%+1;>cugISy^ay zT8^zu$|S1!3TT)xw;tYLp8949gwT@Yq%HMue5eLZxG;%EU|XW@OPdur#)9ZYQuBnt z;l6CY$!rNzpl29!IU#EhMRfZK3WlAgl?vOG3dwr_=*fp6WSr)Z+CC$K`189CnTf?7 zIQlsazVEl77P=!!|G7Z*wQl-_Xc>)9XF^rvRwc)Vl0-NiE&cudb#y5AiIe4#dWx?n zXzu-GQ=1p!EL}3*GeF+rZu3bn(wWwGtcjdscYP#uVE;=~A}ky|Ppf_?F>YPVM8+9! zbnZ5D6*VuVh-L_q2^{V7fpFR?4JK_Zpzbl+8R>a2y_6Q`FKyVq7l$%&e~`k378HS+ z#a{qG9oog2H3yUzY(2oA9}qoX;Ltg9Mq$?Pt^)MsFa{vQX={1o zvBpnSq@nE9H_T##dY2lNHb_Vy?iZklG@?ZE3~b^Q2o5Ehsi z3I6wmoai`&<3I5~gpb?U+Pd)#^n31hH!T5=37QZU9*vS+2oG&J!BJ#EjXaGVcp+?o zmqSBy7Pm)lDK9y*01Tq;{G~MoUM^UCjwTNecS885T zNGm-QgMIPTK+R&FEWjcltosPbSM~dDw>CE`?b+&nCXk$4f?81yg0MD+ri7+U?P%6J|e#6E`}gzqePX( z40PNIOn`v~$x#=Ve;irh4fUy`^yv9a!3-f;ATvFk3@qS%mfT8}Ab8&I#*@c9osEr9 zWSEp*&m`Ie?Q1iZ_e#K4e?g;7eR%hebaJ(^^MI$)z8jT_tGv9qnrU1#Da}0(fJHx?VUuT)te+!V*5-hO zu&Il*TB!%&ryv0Mp}LECst!^h01`WYLP(H{$P&4{Ijmt6Dc)tLWOwblaqSvbu&uLm z8M3~Bh|1+A{qVQ|6`u>HtC4}CYpHB<11M@0T>m+2c`9 z@t`aj)%pOr5X^MG%$SjpCN1n1!lSgV(FWx3WaIc{5J3!VY*4A{QEx1jh;iDBXj&a! zXd~Xk;{!zV1${Zv9lxRin;)q?n$~hEAm#eUX?IW0X2pm1@7qIlhTN{K`SA0c1=$kQ)1yRyYX{-g`A-g(MEAg_rbJ+F#uYT8!Xc&@-6#9_U+(7|G$Q+WhTX;D z!;kKKF+Cozbol;T*FEJR#qUnH!Nq|Fhm$i%_v!X2y0`dE80|Pon6HPY@Z^Y)S%gnQ z<@|-u*wQiE?5Ct0A_6a7x@0rBQAr+>A&8gerx}EjiE0)C#@P`w0v~hCSI?|3A-=Hr zXqRh@5E;BS3ppAk+cdQnFc%N{X)Y4-@SNZ0oV|4XeAsb+j&P0P#`R1?^qf=c*oVpi zN-c+a?1-)goJGd`#ta!f(jKEy^hKBuC~CWxef|9&$O5<~;d)sdp!52yZe&qNN?uLO z_~!{&hoVU(b@cWW>k%zW{x|j)V-o9@+fwNgn$LvCsSWG7-blFyq!iu0t$hD&^PE8c za!t={`rd)ugmRu{;A)<~JZ&i?N}~BE41DfYTagAC1a7SMgY`^<92N>0Z4_PTv1fSL2Wqb(e-vS@p9srESmW7J_hD>7iPO~dVPLZ^ zSrjA<#1ak6%yhlNUi!{$OXhf>ar&Cr*Wmbd9F#g6##)E)qa;EuU%ot8uQIbI?C5#z zvb~7?$d^qhl1z@?vf@Wb0+VB}M2dKX-i*--oz;{(_i8{9IjyR&;;R$bX*xKbKvC#q z&m!*Rl#9zPx@5pd9|r`dmXwizj5k6%+cW_Aan#<%QMIi5zH zKdoioOz`qQ{LB=G?$M)|cN($cQwNE-miNIQl(-p3EpO`em2e_}>I7!fdWn~hPkSkB zB^S?%Kux~b8gQE=p(pF&+C=hK*pu^BIk*J`*2g|y@iY5>8z~Noefj_X6O_9K{gU)Z zKZq)zt9Zh3mm;pO1q4pQFt((O0Q+;#F<8}N&I>89Sc;i95&Z$3f+^H%QSvctfkS|NoH5br?N_#yAkj<7-j^)ey`T(C;2}Gbe0X8v()2M7Q z#soHKuWrGF!spJ_#>$LHwKFx96L8+iL%I+V0pT&M3#rS)aBXVRc92fk+wVYBNJ1T* z|H!c9(|hNMYnT6NZ(?~M@d8I}@oMr(jzW1Ba9UQZ-XVgxI6G-2`FjF2&jRWIwTAO} zv>SF1RkmijYIuPu)~y4{b)G~5_M&FTgJ!C4385Z$wDCfMnfd$&rRD2$uG)%|g!r?h zr#Wc&B_!Se6~T^zpmyIngr$P=!C>OXMF8yNDWbP8D_r00_eeKw9*{qR8-6id1P)B# zqdQGLJ=-b(S78oxGsJNS`{m{al~X^k*3HAy6D6H5hM7NpEO@kN3IYWOOU%cHHGdrW z+;2}JeDl3Pow5Bu3ZkNLjl^xUAcnX4>@#o7`69E7f=g&ITEr8MK0W!69Yu3oh%ZCI9Lj!-4h}0Tx2F{%^ zI3fk;!_a)AR=HeMlAO%J$*Ba+)7RIjqo|;)?B-Y^uyq_)u$&@a4r%N|oo$(>QeN*Y zazThttXi_W{DapB zy7Lbm9Se2RT@XRwK|2xPQo(q1cZl@nev&=hM~mLfWj#4mj(M&oywT(cQCt|xZ@AX6 z_mvFd>UUgy4K_Q!v~;1nA_TYuD5t4o1`kM)HT`Jl?*x3LGzTL5Z|S8qxP>!Vm49M` z>W_Zjk4Mpzq_#A^i0rv`N|bS2)Ew?aJGj-Zxf5m z-eony32r3<-bRsl9e7+(y+|oDCM*3!AxFPK6`Is)E7+YTr>7AMN@KG4tzi$=PiAH& z{Haj<6@%;BeaFvMgb}qr>u%rF){(Z(iF?-?>yhVmjyMTu9n=U+{ndz9`7J|o;ULBP z0GRR|E{AUjsjQ0&^XK1LZYw8e(Je@C-yRmcx}A6zRy`z;XJ=nlNXyI|g*&C>Efg+L z#9!Kd$ zMz#V$9_kOCMY?BZ))mHiEkmD#*&ieAWqBbBw1QR$gAUTZqK3&)2c}PgHF|=Wn&A zuA<6JLsea!4^q%Q^y|%Wmu?w>AH5B&DLGCg|M?LZJt2B-XwU<+Fs}t{^+c(t+U-c< zB&^OR4gFEEvB++y+PI9JIV%=nkoOUxLZ70#cK~R)qpP74e_sYq>3WVS&+QKYo%8bW z47=pyEi9OGzhTOM`lW4Z9l$td}s4zzMzdH=xuI6JgZf?AeCo(S0-qNVh_$(dR(jjPpfQxOnZ{^`HSg~_=v4D_! zo)H^+2>!9s?`r%crmb6%-i9B4_jx(E6B3XZ`OT$Tq%Gtfrxk{rE#(l4J}xfCT>-^! zqNk#KN|{lKusb7-JlI$16|@A88<4k_iw_2YX+#br4swtvKnj7B^ob>K<|%r}crXRG z1@jXm%U*^8W;&u`ViwNMZeIk+=25mS04rT6_qN4N`{auRreQw==lmExdSMe#5= zIJhy(mSvfVd>s7@gWdU2^%k1qoX3mMc7vmx2#pFbH&l2Rgy1jU%+ZIuMmm5Q>*b4^ z2JnJIkcB-62^)!mv0KU!QKX`(YO*BPOcs0y8e^avOR~wOCnFQsXKHJ$mdK&i9Hg0% zP6-cly6-qQb)5)?2M_W@R}Z~apzqiMCM!|H2MTep6D3!_S#0pt(?`)+Wr3oh`-dWf=7XHml^V7B=>^Yi}eb!ZGCL8^ugVSMh+ItUVGDL(50HXj5=_MMXysANEH!7>Rg&7kCnkn;bc|fRQC>dn~Law*Hbs z0)e68$CftycQ6p-;>m?ZUl2|Xe+Hf>l4xK&D0G$caKssbIV7JyL;hxA*t$5lX9))C zcL1vpashDzHZ2-~&Y#8Z=8%Y6={44qvtvEILAw2N_u|$I0pt}4q}8be{}Vt=|jXoJlax1HBdyJZDh~Jb`!5H z$}YfRO%d2ye3X=eI=WCfzF&)jAL9}LWi*FdLz!4|Gu>tfTs+W1+}AgO;~jGqJuj%D zyX>I7V*okBYhKX-Ih^S*S&}l%N{dQLcJ11QvhnmoCB}pk6;Af_Sm1g)g@w+DFfR)7u~{HgThBk+ej!DNou=K&&7--8f4Vg*WdNq0{IU# z?%&5s?peFpK9TQ1T1;YM-S^XN53NTJJy?DipV&5X)b0ss?2rTC2PJs>u~l<}pLmpx z;P52@Ra46{I;{6#qh-Bx@V`7Pj=oDd?#caYo7M~=4%}4cC!?WwQ$tejpq118&WhI^TLZ`B#`+~= zY*3&HhpCQX?KwNHUZVM#Wcz7jMr0)fA~ofRvNZ}{ES z;LqY#{r(yF_1zW!fBSYzs$T~pF8;WGr-8*kWaTR;|MW?YC*J?LCxm9w+}g>?&E3`7 z+;Ibbiar7q4cCN3e3pKQQR{$4d_C->z)P!p487nl0=2f}J% zGWbH~kMGiVb+$CLcE>df>#L~YCt7>EL$*$p5gRhlTs{b*VYK zI{xDtjrA-}T3h0;>R3D3y4$gfON!!~H~hX;-Zv7XK5FeyB&v4J@A$mVz_9g!6TwG= zmxhi0lI`N&{lo($3uRZ5zDLn*uK$>m{-D%;+(#!&a1#Z^7yIWt$2pFCniS&LXuJ2+ z{Xo-KpL!@3&+AE_klFv(N4H|OVxbFG+nO!LLLqr|!-U!#)2x^KO!ZE@*9?@^X}vIW zePgiBvl#OtZEe%+<3;;=jLWOVh&qRI1e>Dw@yQv7=+?hJ{dGK+t{m&u!4;-}glxydudhh8#0 z71ez4R<8YZ8I!`EUh_S*c3Rxqmk#SM@@)Q4aE>yAv}MnS%kP_VhHhOr$EICjKU-CJ za4@^IfiGZcHsWrfT%qAy^dsAZskI4v>xlnuO^S+;SK!|)N*P&pF{%IWSELkqsgmED zUrY60wFpI}MENnu9dzF8wR&Ht_6Lcx&5C;%)@^<>x;K~oK<>MRi*hj= z>V;-pWTYQz>8xGbn@2lh5K`%KoJGyRtWw!$(3PL<{qffB`5SAS6RTYKN}rg0|28F4 z%fF$cb!4rD{xzt4H*03I?CQDD*P%nfDHKw(tw&=`UMf#deC7rYlAz@AN-i_@!z&zO zDZdp)E?p{&eDvnKA3Yf^&N0cr9nmYr5DP)K5No{nG2?nAtH_;laxb=RZDbqbjs#=zlQMx_UbP zx~NOvPnF54L+dZv($w>vjL21fIUAp^E5I`@$Xvh9DPkfhaPz8Ns{~iDIBedpx_56b zwb$wux9`*+y}Y7twJYHsu}@il$LMOR4X-^cPn}opa|x<4=`Pg@IF%pPxBY|4MWqAu zDGb6D!ZP|rIjf@h=&Sc^+~27Byti_5m7jH_n|HwvmrplWo|oxu%+HkKF57iU;FHG_ zI^UZS&L8YNcLR8|v(()4fH_NLadSBQoMauItvQ@=<5AjXgZkC|3EDYPYroibIKV|xRxf!;& z_>L>8JKN9iVm)T2#M&4Be#P3}!jm`hg46^r9TL;zexAx`D{q1-LTS^*WHt; zo_=N9%vxF}&Ofl1uJ9#!Pc8Vf*qNmtRpX8kucpqWA*ipTiP_;%t1!iXvrng9cAfKc zem?hFbA1ZWu;bC3Kko2)Q$5&sr(%RDMONWtcbm~==B~0G*+&}(Plot@FmZHE<2}T5 zoy+dh+*OL5FT0opH+-?nWg220GOTU-n@2DHr$_&{<;m}ZTvSxzubb!>6GuH}b>iZg zGK)QjKKq(^dfIZ6C>|*;T;X4--EFVBUW+HxLL(r+!>c%C{Huks<_E1nQbX_Qc-sLV z&leZ@9*w;`yL#q+m-h}rXX@#vB`2Orjz*?3Pk(jyX}M(|(4c#CDd(w^P1@*#@$28+ zxGA=5?wGqb+wSl1)Wb+OEUA(v%2PWl`?_A)DiSbv&5O_0uu7H;ioJ)}G&65`}}R>f(e;M;9l zqFz>60xq`0ve&9&=9qKCcx#vNc*t&nai5ZtHhix(z0FdPjyv^)K6*j(+8%P|P@;G}ATwS&u#-kbaDZOUZE7Vw z1$TmMf77a!2G1V8(zG>uaB|2yOz2XRiK6)N=%Zjin*zyD|lMy4W*QwH?isn zatjTpvQqKiGbikKPD(ufDk>waJv1txw%fHQg(w*YWPVh5^-labmLGgj1KkgSu(O)6_eGr%kozXgO1F>9vHN zTAlMf@Xqvgty`C_F$d1qHJ#heEySL(nU_W-w8Q-A%GpR=+R+s|{oG_fXg~IMzhNj* z-)=Gc;^)me|LJfW5tabSa4D85&aJc&8Mdsn_ttK0k(+&Gb0v%bZ9vf7U>rnUQ=^`TspK)T3FP$5Y;=D**er76lcNS_wHYaMJJ)r_ z9gB26Z>y8OXT{X!^2sx}G!YEKEX!Cuj@Kk#7udV?c&YEW4DUN#9%3r^<*0wWd{+PbggTP#>tKA}VRY68o z7WK3y54P&j*7}IC51OP*&m1!Boh#x!P1^Q>%{1ZJLfu;y?Y{kjLyeLS*=|>N9Sr)m zHSB(Vrs>bs7Lwg*h6^P|QpLNc3*PP8a%p>RQnvy!_U z?~)y#dvi8-mRULaRNCL{UJ`%Wy_C`DSUb79v5SiQDk+8cSzDbj|7RyADyx`IcXlbs->uRAu(`q!AudHO#|+T8iIRILso!6S$>NLOKlsl* zn6SDus$5BOA^y9{HFrl7=(OCE>5GcuZ~f`d{@2BKhljj77yo z@YV0D!&jpC>h~waS7P|;kM3`|n?vhq>Hh0p;1-IZp)=K=Qm(x^R0_gbu^W_@k1nnYp5u=$d0NM&lEVABfa z?=(r@zp|O>K4@DfbNb0ZckjZi@2rAZvSUKUz|(a>4-U^T7qTA7>!tW??(HFA{eZA) zW7xyJ#Gvj`Q&TUIk|%MZQSl<)jApm$&Xhm5m zDo?y<){CQ%jf)>Ve?z}o=ZB4$!rcz-)T1Z; zW&Y;PB`?gsSv~*N8q>d`BUkJ8ksDKrPYd!@M{ZSXH$UaoFB-aBrMgB^T3?WGFmrm* z;;7b^vEW(80YzP=gtO0o+^y8yt|7SY#R=~IhzWf&?vTl|J2!1RQ*(m7LzYsnxp@AI zj9zw2cuM2xQpe-_e>JAg6s!|UHcxaY!y{RuHj*1tP3_7ZvYV9%CMTbV+WPM`3hek$ zzF7LImHqIoi2Sri*~3(Z6G{eu^BBoH%HKT3|L#ox4|S$SV?}3n>)*^^TCHBM$9>HG zYK}KUw|~kzMtS!eH#J9M3?}OzcKd&N$0$rN=6J^SY}K>pMl=U0DCp;1q*sWTer}&8 z>{Vb7xwS!2fuf*Xq4CzOBhn0qWK=fs8Q<94d4Fn)`hATDDf{yIRa7}nPKf;sT775Z z4t5`<$e(${HAm@p=^oi%a)?1T!j<|WZ9sB^kbThu0Knk zr!-z-NI3g+<<9EbTYvND|BR>qk2+H^37Nl~zXez7aQ+fWpVRfOsS^~-8O`X}M9@>)( z#ZM39ZLw${*&03MWpOg3gS}V&D#KIuIU_SGo)BXXpXVy#`~{)6=Zun^8W)~d9>^Y# ztE)}%Pd_etv+H2L$zZ_O`p9#Xteu0=5he<3mmRy3+x=hLh-lL$Oo}Ecw_M1`7+mY{ zpr$%5{FZg_l{wMWhysrY&B`lV)uQKB1#Gmb(mQ*m=*Ij%CriE8_GjJWt!*2SlCf@@ z_C-(SMC=_yGu6*35BgS1i-mLi`x_|wXYBW%#j)70YV%)T9E(e`i=#C9Un-UHD8;3J zU*MnXW?^+%5&X%o+V-!khNw6yXfl9>id;=pT#6lX{y)Bw##jIRGZ}nE#ygh3Qv!eO zA7A{58Ck9r|78`rI4X32YRi{kOh!~hMgOSRB~Uht{!y=kFcKC0qh6N~$5+4Vb=3J1 z68P#5*!*v*ck%ye^}c+M{@7T}-K>{sB4Kq1u@n_|=$x>yb~SfD;p}8+?Rvt7U0B81 z%@Qlj+{vB%eQuzMM8$sHJXHCrP9U;QIN5?9vO*_y!rf=5#-HdRGI=F}3vxc_bYhwD z5*7P>2Y%67%Rl)~jm7c<`+s+7zwXe7DS{b%kP+A#9N|Ib_+dbZ_t z^B-K=pIhNS(T}2HGFbNiRq01D@ST65AFp(1tyZK|8y^&yT$Qj-EPD2=^>fdUJ*sOw zx^7u0rdwo<3m1!X2^vw1mvi{f>UKt`GOSq@v`dm@wM041CcblmqbpU9uF8*O*){r! zZx`FX;yjn1B40W_j`a5b^m)9uwP1ew%ZkzD@k13KGSym~cmfR>Z&Ec#Gq2Tq)@Qye zUiS!f??sx+*JF;X2%17%`6xNk-?-Gs zo^RsgwBLBm{KXd|3jx8PrnMf^;qT5nbE#cQNm&e7bNb$OF-c8H9!sN`j6%JD%AcJ1 z{wXus4V-*$>qG8;G~I5Rf3L6aUV3W(OX=HBq!SiC_^sEMeA zB)iQ21?)AJvAFaZSFP++|;kmXV zx^L`^e0|G^1eaRdp^sZ{+~$8>lp+@CP#WT?v8Cs2yy*M99Gm@lUK(6gMLVxNs5Iiw zrXSpRy*@O;#H(%Y>+V_A15Y{krR5gcnE4im+gD=Ef zEg?O;ldG>AM*DJ8*$);?uT8xdrxwr1*EP(Da8Yzf7c-3RKj`sMKT*TEG-T%$p-OuR z%N$!CrxWtI8g%FFwx{mM!{z-h+ReOmTZf_pVplMVT1G$F(xGx6xLdJ+)QShlaX8u_oF7_&Mc}F1M{3UJMn{ zQ@>xt+x+gwoS8NDniyd?E_dmvuc2F_?!*&Rj%{VLO?V>!a>2LeZ;pPt`cd!wedFT!Ex=eC^gkwg8f4yBar*}qMdvsIL|xmA>@ zKV)Y>z%I6oHdBSChHf)+lisocqr&Zv>YN@Q&D;7{l*IoJlw_M+eS;MlCDCnjQE;&j z-$Ic|{6uqWg-gysmCY+xRw=Yotq9-gG3HCb&UQsv|2#Wekf}MFoxc79=8HR6I78?J z>o<%aoV$3tK;waGLOMSf{QRn#uNybT2xSKLtyi6FP@+e$zsxDs2{QrLP1y`=n|_Ml zBHFS@?YvJ_EqvK>gLiTJ`qG9M(vA|vwM@h_w>%~vuu2B8{&eN548LG-h|dCWs}Y(E>U|7LytxmEsC?f2g($-f>Y+5CTszwb_}ZTR<(ez}|fN7eQ}LPKjxzb=(Aci2%zmL}#A56!SfhC6jDE+i zBERb`E%zg7-dm2uSx0AD9Q|pW$!em0;zvW^%5S#vv-^n-vtWHnazkMG(r=T8k++XEecU^aJMQg~-V51E*S#-UPRp$4ooi_z6 zMgKp{y>pNz;g;@O>Z&f==(26wwr$(CZQC}wTwS(p+vcsFnSJ)2iMewkZp4jq{>g}Z z^ZgR*%Z$ie&$E8Z?F$5-#bxVjh||OQ?%+b_5-Rm*N@sJUTK*HNF#sHt&TY>NZDjrZ zVJ+s@mZz(Y^{>;Rp&Xmfa8n%XZj8^*mz$5BLr6ypL{3kHoJDXF11%sE$}pMHJ3E8D zug|fyKNBiET|UpxJ1IjkO5v$R&$kadhsg1En;oB*z6D;nH@dX$cdr{e=(`SguR0;R zco4p@pyOvgsV3Y|6T`~5K>VW@+riE@eptB_6YztVhUi?m&+FbilhOKkK)OBapSwoc zpd-M#C*CeC6>nUXE;W+wHvsafo@|rxl_?;hcHfR`Cz;gCM%t`9W? z3!pJ5xZU^{BM(G$!Q5gi@(pChpw`-Syzxj)LW&+ZSE}(yu4VRUUgX#Vws<4qpW8>E zdsG4-fNGD~2`6-|4qO8%JwV{DFePQq##gnM8lE7q+(mN@iXsD|J;*Q@NW3%Cf4aN9 zzRp)BB8FnRJ>UMEv3z})eqL`p`7lo9U^W#RqNDRakYbose3WJQ@(y5iv2)V~z{>1b zkgyNy;S++Eg~ri_fD;3W=?UZ$JyXnp05Klb#jGAcO+nD(_p3HyZahsc@c6+5Mg~eI*2A%?dPKc)nIJAaSZR_28u2?@ zEL!wm5u{Rn>P%f2!umCbEe>2G+TNY+M{0mDAmhVo)7K0Gh==ZbO$I zGdkhkj7tdbgNuuh1_);-m3yhjFO8+Avv`30vS@7^qf5^h!!o`E#pTa-er1FMd>ZjB_}x1~xN^PN&q${Jo^|f`7OP$JKf-_`awh zI2Gz2W-1i%llWoHN3Tt`Hv=K?=YPu8xSMLe;}NjV>lla*|4 z-Y_HrzK}V^KI~>$t%&}v(%CYbC-5B2Vod8rraVr7u5v!{4^_S>Fl_%bv9GS`Ru|tKx{4LH}>%?AUw8f(gcsH?5U^W zr^EYPr^w}Y4o?xnveWCq*`gEKVuZf0z@uoE(HGlRt{hM%HODFNzp{?e@ zH@laKwmZXGPvZd>5l!zN9jwC$?c?10(?0TN8F>4Orkosvg$} z4vP~kF=npJ2y}C?g?hPz4FU7w?cze?NdZfMXT;tiCRle2%!ss|gFnvW{yWO*=9>VP z066zq)?B=9T2L1kPraJ=YoFHU<+{21y>cB_yNQf+k%JCLsq8qAd9za;2CLB`AUlGp zt-m0-1X^nCI59L-X^)oFPVp?=$&jcz`Wefjb|egK?A1P<2!c_4slKji;D&e1XcCTj zsh)kep>iN-co6gfqK0J&xLT)?s%e)Io{lzoa(-05|EpIV6r6(`;c<;Z4g2O=5d0Fa zgL{8RLBIx!z5gBbV6Po7*uS3E+mzF!W1oqSDmaSucs>}bFe{rp!fCy zOOqFZ+>bIqfIZNeICY?B!|>PmK;^&=R-qXou>fkg(o2gR$z*`*$9w)H!r(E|#FpVE zrQ6a430cXti1F2TrLy0$rGqn_!M+BAIst!QQ0en%KLxJIjyB`>u z3&-5zh%lJ1U}og=_tkvDnFWPWm@WPA+Xac$pm3pPYK4$c3DQKk+QVe_#WWHGU{)F8 z1VkolyB1>!<7X67yYQ0z^~QDs9N0Clbb|Gj8Pm5QusRvSPx$bM4DYE3Su|0gpWyn@ z3g96_(dbS=N)ZcF8&}|c1NHp((K{f8DMQfm73kE5CKV6}m_>2L*f-Vej$;Q*4^jzt z3$+4d!u+C^)?j^U8H>>fAkb|(pYm<&InAXv%;>1u_pHPtD=Ua3Moy&C!2dji3CsxV z+4JRtGXo4Dxn=fHkl`XyJ;Mdq^D^^?`p*cCNp91@M8yHaa1}^U`VE4|i`>v*bcQ66 z{#LJlsQ`^%I0e?9y`$jAq2Z53BIo$vw@V*HeSa{+I`d z4T(|T<4%>WL#Z;I^P{J1K|{F}1u0YCS!SKR%Xi~s zY?;}h8moI*ik-p|+SHW8Y!KtbNngrWG-7U99F)5V2OQtSi%jO56VYqTjSHg>saZ@u zDdXZi^%AZdAI$h=& zHOAM%s&Aaze^j<)Y&D6sZgf;LrLJq6fU5%}n#TgklvIb3xC*3xZ*GwV`kOcz1yL*N ziptekjw5qmB|nK4d_>BN%2`E7#^19cv>BUm&g@ONxn8t^su*{TBl#WBR< zbDH_jA*S0N9S#5=7S;Jhyc@IC~p^KyX)Y@BQn-TVUHD{;rks z6?eR}KzqY#313rg5ZUNIEo^=oRnBLrGw;y^p&i`8_lJ(jBgi;E2cr;^n!(`Ms49js zDjuA&H0^)44-4Xab?LM_nTW!f%I2gdE~y&Xkd0e9)nx|LW!#5M$2hivoq=E|hpSAc z%VL>!Q%ly$Vyl%))Iyq>0?n3z#}w+0$j^ydG+Ql>^CGhy-1U4tL_x4K0kJNUZXB{7{do2*&d*Q(1 zJ6)RF>XVFz&_}UZ_E#|&*#h#ketKUhHgTre3R(J1b5O$MzXsH=BjH zvD8T7+~LN61E+DcNs4BIBhrI_6Yj?w68l{bTbxRg(k6g`YvGU~Dj+A#Q27TiimH$+ zSxkyNi8{VC|5aKJk2YcOOuswmDI|v{pK<^cD~BO^KII=V0+`a_WF8y zYX|oQ*vEqj9xkS~dHCdr&H)1f_7&Z#KBg7FhU0|?7<&~K>92a6Eb=u*gZuP)yWXz$ zC^(|@eYo@eZ0j|(M7xXov5f$5w>`hYZDPu44a>a7ZT~^decu2!&4CKI0Mib2_OI-h%#3Z0!sV>vJ7#96$%?9 zb!XrRa7XE}raX}^XdZCj$OHh;-DEaqEpp2H{a)k>Q>7foCeRbWA48>g4*o9B?#|GbShdquj3OvjhOj zJg^&dk-$%9M%rDQ6h0dAsy6DJLpR-<9fB(N_;N@QWwdCh<($g2DZb{R_C}C_##RrAMJ7g{(^Df(cF6zNE0zYeL zl&PYS`#q`FA}NO}MvRHAe`q^Ht1svIW((43YVeb1o|Ias;Vx zEwD!|rWSc8@Y)R&l|Y5>|Rt?$OMij$xs|GT8kF7zimoiE>dbXKVT z)mQmOBsN+wp<=*8>ZG5Ed=bM1uOW;*!D8l=eTCtA;@ZN`KKoDj)`4>&1<(e186`Bn zMr7iWUa<#lVHbD2D|;s~DYf%S(%^MBToGjU*2t$kq)Kg!bl@hz`_5GWIV1TvBS||U ze~K)p^UURSW2nNlDfVif%6xwo>7h%G!~~wsU#;My!Aoj&4oWl?c@O1}Y@}PI|5$aO zIP)P3zSNtbM)R8=*zYpzb}o1{ zdGSl(J)q#%&+bn39ae{jq>8>`inZ#@w!ZS}*b@kJ+ZE5Y5BvSw>w}vy_JR|HgKZYW zHrj^18}E;o?WwaZ$X(8b9nXcA$Ge-m_l`%-x^0ijX}xTel8WMxlD)Zao}r{p7IVK2 z_iO$26pb5paS9d6@Ej1UfDG`Do|5O$2mFB2V}x_-O-qW+tv zy$EcEp&A_2V)?m*AqOhI6jQ`15iYDoyZ9n3lSQOyP&mm(K$ukk8mk`SRbQ?~K!Zj= z_EgjF893VNG&QPYEKiaq`NOV{Cm-jdNi{%+^c{3U~;nY|%7l(t0QWiNVM_0NG@Bp(st8z#zST@Ij{e8|RRb z!ujtDOk0Sjfh3q^n01GxO#|R*i>jyR7a(qES-Y$yaxbh5LSJOCVeeK`A0%?Pw_d`D z)S5V$`X5v50EA=MX>De6oVq?AbTS#nX_l~N{-V8F6i8`Wr z@BmTYFzaEqW8davyWZJDDoP76bn#vDC94Wd*I@NQ)i>0$VuO-$8ujN7NQrx8j@xlJ zew4AX2KA`AS|yU@5pE3P3{8I0yfg$1nmkeP5u%(?ey&b);-)n3m-#^Q(!<3C{)u|} zGDQ>ok@|HNE!Ef@5%;XkkwI>^kAV>d3z1)?=*|*RM~~eupUp>`Fi(&s-LDfQp9kOA zYo5kw=Xj7O9&U#BRTq*)8_+x!r!cz<_jP{(dy%$<19I|u_Ec&bSoT(~gS*PR%DP$? zoQVt)y2Mn8KuTqKe6c$NJ+Y~JgB?9DO`6pE!lefN6@lyN$dExUq?_3Dw2G0Vjd~)k z*E1!zmR2fdO^QiKsOF zOcU_63I|49%x(Z5k4Zd+R3FY!j4HYcCyQ~2mMPv)S1r|02G7;T@lcR+aZ#9i0r5fr zfA8-8DA>`@qNYK?VIGX~9}yKUs8&S*$Dasgq?Q*XRC|wfQh_bpT?teN1+}g-SkWp;GKpHs z2I?mzRAkYJqsrk`PHWCIsJ0+q89y&rNHvO7{cUfY(8w|sVA5{AkXY>0e{C9iRNx+7Yp=7%(5b&e~vy%9gRw=6e3zOhXBE7)63Yt>67I-YmeTwvXt^zL7NAIKao zUV61YOV==uJC}$DEs}#e*~K2PnPsFtj#G0-*UDS#OD7 z(58}F`Xx>uzVyCzT>OsjgX*-i||^PahXq=lf4S*_%CBby z#F)qlM9&0yxZk~z>M(BOfbGW)vu#P2Hx^cAy3F>1AFR$6o0~!2C#0e*_JbE5oGO$T zt6QDiCT7X6;>BfNcIlV!%jQpN4>ZP$JJu}?lKE=p%u{)rhp3szF07BZFBve!afs-Pag7C&XBly)sfgq2F0!L&QNm-v{O3So^1rr-iUlp%z%kH}CF zo#@!D)>$Rz`UJd;OaEA}a&G=`gZQRG#-##x) z!DP71mkaj?ewZLH0&tipK6_I5lX$+Gxa9smVekihTme@<8GDlZO>Gt!4upe)VW@I2 zLlGGJ+H*(r1RixO(5`GE1FA_i=tx`NW#jls;};uUYggD=A`C~CI3|qD$Z^#@t6K*_ zVzJQu>JPRJl6a{G+cxBD zE+g$$j_3S*usMnj?aYaYyU-uL+_z6vV5AHJ?HgScGuEavQ2EZBT#CDtR!Nwj9fMa5 z6UL*EUNTaDm8^^6d8|S&{ci0wf)nu13ThiPI#f?V+r~(lR~=%au699h-84G<&8VWb z{tY-6bk>|ZL}uvVzlUWsxkq{>E>SniN>{IOn0Kpe0hDM_G)4gs=%x-QgW~$bxTO%YT{$5)+D3Ag`2VR28$dEW5w*B z9m}(9f<)t6-!*Ro2e%0Esko{fgqlub6hzRnDvCVT6ndE6A4}>mMnMP2DDAIQvN(-M zq2KojRN*g2eg5R6Anyvu1dzrbQq16O@`?9-o}xIp!z$VkkYuv*8vOYdTDoz8?Uc&p z(8)Jggk;@UV^I>VGD%B}zPowNB5M)t8WR#}Tc~Vb~eQWlmnpUb`Rb%9zrFwHc~R z*|M&e@)ix*V8*W|{-W@%(@{%o|0574s_JG*y6+zWNxe&01&Ug@fJk_3-ztY;y1yb{ z&}Sq23~kmWy>nJ1EFE;ub7)7+*yJG3tm`mLme$7lt5f-I)7^CJ z{@>(i{+0T`_t)R;h|9`GNB!-Q|IWhD2W?-u>?(X+5jI)T93wOS+h&o~4-qpS6jl(YG&} zM#0g@N*R}#m70~2g_-I5RR3v{{%c;hH?wuLvHzP}`VPcjzr?@$*Z<+1_}_cE1;hju z+#J3SB4%xD^KZ4gGWLew=J;>hJLx}c?___;OeSXEup>8IQoirQ7=4c@e1lXijjaAg z_b))L_6|8&fMhgJob=^NMcZ^8JNGycXL{=4n_f8mzCfB!dNf3NR5 zbN0{6#HCUBH{_HCE(;3_HS6CvfBVe;vYP&R&Hri={~ywFxb)u@5&xQp(~|A|ThrS4 zM&W1)J0R@=?YDz)t!I(81Z!(agod%gI*I4QbMAzGjvF>KhbR*x;iRniGHs98hDZ6`d6tGeX(C(iE0dN(8u-Zd#JQDBtYrX*zE2UF+!ol#}|y|u1)2O(;} z(3F1>0#6XkYU{~sD0ZFavj}6*tFz5fHn?&Rzx*_X25hvTouj=tFwp{ILGET3{HaGj zR7mL*^AW@@@5Q*_%RXLW@HA_gc1>U$LG^FUinEjypWV2)#C)50%enIDGynmT z4JB0VUuyh8;d0f!^Wd38$D_{c2_}F6!11f^HKfX= zM8HOnp32ROfF+i$5g4FzN8j(REh|Z?iRBi+sn!4mYlurvb=^x{Ker74)}#9$ab$ER z41A4gcy+GU*l1HXBdmRkDek*Iv$P|n8p`!oVz)2)xMEY1kd`_Tw%{=?TZjl~0P!!fWCs=%NL zgX)hty|bqIU2+o>uOM*s+-4F)LhjS-oZa-u5;wqd!KykDz0U~id>Rrg)rzQUE*}&x zyrgb#E_}sIFpj0rFHk!zcIaHb0Ve~BWts z;pcaix3vw7Qt7BobQfj^GgQ+X`JC=C)rVgjDPKx+)dKC0BC79OyPZHe#sE6+9#+!; z6w4o>k^^*1*D~lSr{>#B0DRE3>cFlfrsq(N3{16>b#i4wT!c$)PY7Rw6!D6<8K z4)t*k^D)L~eW~wt!G0^@zyR8+%nwSdP`}NVez}#f? zD8uP1Vhi+kgTQPEt|wTFytG|3w%i?}qhG-uo(sG+I9*c86)xv!__EuoakC#z<^N`f z#q--T`DgQ<@cGc5YuMoq3BW}^M`D169Yld^$f4dsk|NzGb%z?Zb+*6P4_LalT7Ng- z9=@PH5Ol=sKX|J@r*Zq1c}{NPyXDdgv`P z@Nb~F#t#84IdBFEp0mRtrQseX&KJfJp&V|s0dxjYJki13!F3-S#<+?2zxD=&<#>xK zWw?sJ%ITD7i@Ej5=dS7+Vna;bJ%LiJ#k$9ceAWai;PN%;N=kb6k|x4a+STNiqr{r^3>s| zgc6f;lTipDV5x+$sRl9BBiqgB7#mr~=k7X z4a!6_SZrQ;zSXs?gtv@5GaqbsoOtegzI$%H{5f)R8+1sF;fa5FXn^FZS;!9i)VQdS z%giHURj?zrCw3F&F5nWdyjNO0q>HjMKsN9)7^#~xFc}&gvX7sF;TiLMO3NL3jyysi zbnu+G*%(@RE->_*zavF-BmIP9@C=O%;SBK)Sq6ihe894__qgPtU2}Nsc?L9Q(|$4GK~IWippNl&ofk{8L!{2W%C8tg;?-RiCtaP`eqjBkioXt0|FxqrB#@ zvv&~GQ|sl;mct&`+vUvTMqG!%GYoT^i7V{gauZ375h#99b{5BbHnx-zPRVxY=?~^| zgSqUP`_xv?1RH7AO)__Of}-pPY~<|dVtJW5S)>I7%!Qwp^TY1T?9R~b37r{SBc~3F z!t2?Kp=%Dz^f-F`qSoHat%D83t-;t*ImjOB9S(gr$X*oj6w3!Y@-hx{{4sSSb4Zr% zT_;V&Eg6nkQunrqTv*g9vNF(^yM-&R&fsaXGW_OZ>x#gmKU*39!7#3i$lVpU4$1a z-M=0f)b~f5Q?YXJnua&5=+qQJN19VD)9LgDIvHtck5w>VK7fG(mYzR=uXXl*-M_KG z7}lm1{^8*T21Y}Z4H~YYHPprE@zu%uo)?bw!UAK7%Gx;UJ^P@&vhsk*t21jEEUPlI@tyhyFqQEI&7|FUpL?(YD6;9#8cY<$De zi4!tlNsoepc5Cl&&t4U5^z$H7@+NltmDPc@H{@B+AvY6}%^ef?0FN6hr4586WUszB z(8gL>&XfOeH&Zh{wyht@Q4<9*v*QIZQ$JWCbDt2g1wfAv4~O(U9fuz5`kHD>Ny$QT8X$HmpDgc{pvE zHc%tpLKb7IBW~){QeyRsCcABUJOah6KA-Ccse&j4cWIwcMx+eT^i@%ANrw=3JI~Xy zsYiVRH+lW0>}_F3lJC=^-k-8Mq?03|{f6R^#W|}-@qb*z>d7`GA_^YL_Yk^|newrTpw`GA*NwbYU_yhj2kZ z;>Y`uN0&hcFqB9~z()&RGoL_5HCFWn>IYjoGGMKe2E4%8+QbeKR4BrBr0jRzsA+f< z4G+!z<44CvDs9}Jl%*GwhuMY9%YDBiFBmLIF8l0#=(Nd1Xdyl>qzOH>0D{bg$Bi`g zskL?%n~>4U+qQl_g~ab6iGtY{OG#Xh4jH8gBH&31pF-BvBqvpjwf|-asl$_|HBdRd z*qllpkDNdSO~0$9M#hFFzl4m65zb;PDeHJsRY!tXI2EmESG@;Rj>|+o-W;4do*Wpg zzmZ`iv%Wy(a5JGfevl+2Rvg$rwZ{bpMXZ+6OCF@r9T*V@ ziMVcmqSlrO`M_xWg7i#Zq+XPXkxtThf+Sn)D$p=S;l@BEJ2{N;D3Dj00U)NXoOeGztOT01FYPd16DatU>mK(wotAqVA7TBUg=8 z5249zyNAd=ognb;JW*tR^Zt|BW@xk(dbeq+xuBT^ztYR2~YPF}TXPu5-s zV(Lt_X#s-#Qp&?kp>PCmw>6_bJgpYe{ zcIwY&1YF;IT&4?74R-Bhq>p%P9?aeckQ<sN!hE8b3@#XRxz*TvS$oUAOl_ikq@3 z5wBR&$m=#dGuA>nBp!OE3~@kQ=0ZwM76Hwib~6$gW4N2bZ~R5h>_koVaCce###|}Dek|Hhs-R~A}E&~v5b?%7K z#$2T@s3?DF{E%Jk=pOxdpES5z;@IKA38OTL?n$C70JgMtG^R}t-~H@cU!2r z`MAGYs!HC0E_1Jj8O@=|6j8RpcrkvSy*D;^W%NQ(w)ln!CfVbdomMBuyCG*1_fv1% zr;pmXMzO~NzZRi9m=k!JO4lB2v3Jrd-|52q6w3IA-Kk>Mt;N#r{m`mKW7BXDHpM{h zqCb#?-ygFUXK`mK&H4sni4w!vAtD9%Ohpp*Fo#(+5^QJroCIde<=P6L0{ymM(d=J} z86zMxHqGEkLWy;oLn<`1Q`L)DVjuJmi(zNoH=n<#y+wf=*&Zh5TjUvHaJWV}#ii5T zb_Tz7rfhMpZ1%W#g&5Ovt@IkH3Q)4{Wz%2Ni}`3dh!o)uzrShi{91Vn`9U+5=ZW@c z3>g}!I?H6pXLk|0MeH-;nMsrCC$&k$=SUz-gDWkxW;JTElG$1pO{Wu_X&1^h=9MXo zEm^raSW=#zr-J6aGX;*mY{f5gji;w(sNsw=5DTvRS{Capc##5I1wGH-cF+zlG}wLvajY}!79 z`<%jxC|kzRXsBr5Xm)%yKR@YE-uU;1-?KeZU3eoIfX44)L<|Cy%oWnLaSarQDq1of ziVzaq&k@9L?t`EWZj#e6yOxse;>`#kw(`HUX9AU8C4ZBEJsbhI-SPWm||jHty77p zuxz8#=+g@sc}w+aRK~|HzPb4FYD4TvQ-}r`8aomR9mV}Ho8aQ@s*t&+NFWA>&0ALO z%G;N0wmJ|{*;8pf^4&9Q#j>TY%?d%4zOGWK5k-iwf^N%_QG~EyL7yZl%Y3t8t~M)` zn`7VtsV>2^gpOmxnZ43KGfUFhKWk8Fyf&-Y-Z*O`$xIxCeF4|drGuTPm`$=f)s`p2 zTs}gr$_~@RjBk?^bX2I06Zi1LVARbO_Jyg&NcW}>-voEtkgcTtDH$kIto>Kp^Y7&n zru~Cce0l0zqbB&UrY_ywBPho{UJ)qA96xK8>0H0x(2QfeD8Ob=ig($gbe6cqQ@nP- zLQsSlrsKTzelQieBfPZJtq?GnrsQizpT-+m@%LoW6rYn7*IM>ACA$lH5FyAqjgbO3 z1F*-L=Vapr2KuX+H5uF+5o``XfHvF|ijx_bafj$ft|b|Fz@NN=w`d>ACDJJw7HSj+ z>Bhj6XBrfB#TGx*Nv1vhjKK{NMME?^av_qY@MDE@ zH*dfP5rLo~2q6@U;+cRtNv0`)qQD6&*sW1ZHHOQFuTzPar6KP#dA|s!Yeyg5{7@kK zrN--M8G7~nc7d8?#`WZgwq%K}5J}0VbB}ZQUCQchNEY`BweWw^;k*tXOx!2wb*cs0AR(0s@eVp*Thd3~R# znu%U>E~(yZinv{Ib(=`J%!HCYii{XY=+&!b_lo8k%;v|jbQSMdsAS@WY$qt8#Xm?z zlMvLm%naDhZGZ`9E$!nY28*iLHUo=d6Lp@}1B2!uJ;~(;8^9)HCnczV)EOr0LB|?m~UlA6-^6stIAqf8hD3TK*EW_4&Bqd~*Guy6C6t&rpk6$MoS3)SWT~_R0(!d#2W}8W3H`*FqGEzu! zX*hvOEbV*lo^Fq)V9n7`(fKG@PX)!}&}=1a3@%4}#GH5QH>Cih(CqUPrqKOzQa$mT zfb537`0a3GsWQ3xGj-z}iZWH{bH=A5>vechGu<8}0LJ-Yd2Tbpn1TMu;c)5usgb+1 z(C#!+2c#sWqPVViZs)*nJ11U*i@UF+QWN$vLZT@UMYl7$S4DS9o=K-qzdmBPv`AC1 zbZ*jZ0Z&>`;!7VhthQPVv&fjZG)~ird3Si$K=yN^TJrhIop(?=XbEoNM53&?w27)# z_p%YemSJ;&o+5QWYaSG_E=}LDI)~VDY&kkw3y2#`Uzj65Vy*=4jprT$VQlFOCbo0d z*30WkHM)S2>cZo}KRAUJhSarA()CcST4V?NfgKL~foLLUjHwVwQ(ji7$ircrteEj~ z%8pR!pTttJL}`IHbLx5&#qu=&amW%ufzou-qVd{7`vhv-{jC2surYQjHHL))mwL~3 z(Qq!OdR=`yIfp@|9GBc2#q*nt5lu62GO zR{S?;vTyGCKl8)?*T^UTK@<8b5d8lvpZq5@!T%P8^M6i0`46Jf|3~?Rf%RKcVP?k%lIvS{S~7A z_E`AV16aP>E&MM{hL!ev!oNy1tjym746JP5d!+pq+5S26F9_?ONBXZ?&c8wh{s(;m zm!9>%XgP6Hf3=*!D{lzwHG#T};t2>m+4Udx%fFHz0Od7Cpdt*go?=^m#Wg@V*Y1!= zY>`N4Dld(u1H5m*mJb3{)vfNaa(3{y8kkV7k>o}}K+aUX4$@IqSa3xFzKu2mk2wH* z`emU9~@RVT!vw0QL{m>`8DZf5X0=ND+Gw4F?b-cr=5Z0r?65zYZ?GP zcS(HK9XU0EN7(ar#HhTX@v!jB_Et-Si;C|> z9V#t21T04$CT)_x7eqQH>LRE5p!`NCPN+7om5AaV?r#Q_+-;1MIAe5zi((iuKsh?~ zm3GtxBf-@nf@#XenCr$kxci%jrM1nRo996y?%Rj{U)s9-h3fwEIsYHxO!xgqe>YV5 zhYrNZ%=n*mpei+JM}?)h&%+PVdP@nJdMKbDXJM%5SYpGtlC-+-wNxv*p+Qzf@nLm= zRUmR4H{mQY12#TP%fJWLKV+8j&{wcmci0YK7k$61;|QZH{j^-KC@gT$V1rk|F8 zwW$Gopzz8(Rb$_}tDJfE-~z9ATb^$T))aC0!0lA_27is0w4mUJUu&;Lasq12T%vyKJ2RE;O;gB|03++061N%@8oE@ zOLK(VzI?|1JYSqYdVBdo(gC}s18~zYx2S3FekH_Rhn!w|Z7Fdve98mM&0zHU;puAB zIr8NtCj0H0>JDLJPw{k`Xg#ukYisSAFU4uaW}EpW+{e=OVQAHJC)@9h$KCqe?havZ z3Lv%TfXXc|1cnc!pC$s&x1%kMCm6>)SumR6Iv>}*BQ|1>d_reN85Wt|IV>hpgw*hU zdW(dQrt_g2z=ywbhW@TSTwqI#Baa{l91KLT={Mi(0sUbf1jTglS{+5kgamnwc)g9x z$NT2W7i)Ud%5pHGBCk%N&)z(y&+~~-{}JE?LF(tXWeY&yVd1(}Cj0|26!_7+0brdN zzyu^$0D$>tk0#*rddUru_pfLkx=0IA(Y+lq?vgJe&(D#%ePROk#!JLTmOYT{$r^C_ z%ZVB`)mp0V!@8dlcNTgO!u^to2TP!dfT~dw%f8xBxIx&ZyguAu?8@kZMgyr`bmq`U*Gzgpr<^CRXM~a5 zU`=iVZ1S3D!}B3!)FIkv0)L@=qGvoPAz{1X1o-q^fI}4!#7OMsI>%$mBgt$tcKJ+D z%UKR^vHGH3gH8-l09Xxq820Jxw4)7rF#fWz-VdMC-i&&+-$Oc?x7`^U130$q2?ahLlsY~h@!5YCL@R#Q-POwN&6)o_J%g`126}$~% z&L2ot7${^x70X<0xQ7|y#2zWJbz!a08HoAVaI`Yqa)HQGxq_*?Qc(2PGEl)W_yVKS zyrR%vDG50Vi5Y$gyVzv@+#)wYB6HGEv>$h#08INLP&{}%qF*zGO{FtOO1S3ykr;Ol zAWTTYk$rC7MCOg?V)Xv96)`k%x!J`tbgv_5BLDb==A zDecrb9pft6#AinIJMoTW?qqIdU$b=*pbZcB$U7;99v+T$Z&m4#bvpAM=zo5w2SX;I z=A+W1F8{azx~XG%F|#%k#3{o%`85*R!A{R^Z`7a2=5x&X1bgIfea800HtF^I;Qn&X z^OjXDrai`CrX*g*E+m`yZ0@ooK;}+|n|;cwv2OgMKaTBkhCn6S_RmV(oJjb$o-xl~ zAqUK|;haA8Tc(<{hzVEK40^p0lutbXMLpo65fsb}8me~Iyw!}!zfoOl+y%S1Z%8xd z1*iR}?jt7b1J($K{T?o7#laNT#ePYmz16X?uhT1Is4migN)AiTOLctFqc#DX3qUFBt-7IVxPpymED}9xZlY1K#_HE3!E?ZeSvVdax%swmc9S94k z5OB?jP6wL`(Quop6aC|8TG}~rWP!tMtdWsM_B(op`_O7m*vSfv;oKn9sWJi<-ixm8s0VOb7wBhv&+$aNIHiGdP{l>CdbB$on)X8r;D*@ zPPD{{;MU9+OUA6wD}C}v!oqo9BS$+YnAucZXHv95`e@^1u#HcLb*Uoij2+=d)kEWK z)pX3tLYbvTePtdEoMnEgO4j1rK&|n+(EX+=qWn+=^ytUC!%?D#jk2-Fx^#$Cy?Qw0 z#1G;EJ|x%Z?G$vPKao$P&7$Jq6lKM}Ixrk>7(k!32x9bXL=B?x;0NLg3DolPlG3A< zoCEvwNOtjMWNB6%FlC3ar-bo@Zs^Ho8l?1Zasl|T3PY={_zl3&;{3)b_YW9eREcMj zb^-C%u0Y;uG2#)*Fb%`iUA?yTc-tj;{0^P+TNW_SbcWQGDyNXZ-nDJwUvLvz(y#s* znA-IHy^57qW3D!=3xD!0_I5y1h7x{0tI$Wx=2pnov>OJy8_#QvW;9LL>EPVPKylMk z>IuxM%op4jUWPJoC;fZ|d%51;);7MYgDCP-TK|Y<*oJ+g@1BJ-=AN){INRr*P-!6~ zb|(_Td51@vH|SY~EsW@ct)W-gbR znVFfH?J|^^nVGT7JUZv}?Y`&DeLWKs(GwGIUWDzfB{{Z~xmPYpxibH+X^01_jZl)9 zgB?R*e^}pl}g1B-lJt!IJ%T;++=F13;!R#-owgkNIX{V@hJR zG>CZ=HS9w%2VS?|yNJ1bJ;Mx$G^+s2pBEFc2g`kaA&k;}y=L>+!Rm3oLb8}-{ ztqiYAs39aIU>~%O_0NM9C<}%?k~TIg5vwws&SnthJxY3Yw#iuNu6@48_zR!NNi!6ODDSbEkmDD|{-9-ADv0!N+Qa23KQL)P5EP2Gi(EwzE zQdA=d=h9|)kNE?uB!5x%UIuv+7Hf=LV{896F*gVF69=jL!P}7ZU3z07t4yhT%{W+1 zn8W4^sZQa+Y#B=zj+$pu;4B#v3)a$Pago@RBQK`sPjE(j<@cPvxpm$V^AY2( zIaZdA8U>Sb^)gFkYOE(}a*~u6 z+abyGv+D>C?qiMG-&eJ}r!oqGms5od=YF5p4tzCKYl(IlkVDT))qY78Cq89{e(Im( zEz)>xLQ3{(6m4UhVM~=ZPl21mI5Nph!JruHV>fw5bOWJv10MCk+q%P z7cGjOVSdT-2zIzv5Y>dNjPODU8)4FOfRjvVlqB&6{>;6z1q$q1X*r?oj22{H5X68L z8T9T`I(tHzf3bEgZw@+C^TdTParIdEDUt_1cU*n_GiXPg9Hq_3S847|o)`qa#f0v6 z$$)Aq16;YLEiw#&Vf&o11evtxWSp!$lQLPKM1d^lVPRo{G8uq$?z-tgX6a*p*bF#x z#mcT2{ zY}a!AhtKJ1n`@2Ri*rW?n>sap?@^AHAzfVwavu^Ug@Svcgo!q=o@y~U(;U>`FnTfa z`%q+D1J;Q7zFDd7j~vl==W#g+zOs)Irl22LS#7g=JSw$wW(`KW_N=eYK9$*e5}J^c zJ3@0~4PL8%XtlpsLx8w;yDY701N*waJ(W#XA~7}+D>^l&Zb%WWU4N55F+ zvT$^_I-d&*YU!Rlr=h>+p$2@FT#}N{oK^c1t~wMFmdSLzk&2;TzqSzh{V+1EA$`P} zbzI)$hjalWZUO~G0_9fjH&^8|@EOA96$v^)THUIuYMKFVMN@3ljFNdHE#a$=r8T@x zuMc|zonF7G-I{Nzcq>hpOcIw*%Vjj3&L3Q#cfrYyW-B{+UT$!{&)#-2)2NbsF(d9TTGQ0x02;KawhSpqN&++@`tUJtqX{ zxQ-(OvR$TAaPD#gT-i&130%Ni+D{8YZk*$X1b{*MXnNn1VMvR>aGDMX;5bb)K;k;e z4+*@(hjWU%$QK0|LrTD7EeI?DYvOnUJBp;{R&!n9v<5G_>52h|;@#D#tSUXM z#YnFvi0WbV$N`cbW%pbCD-mz6yOvaXWh~ z-otx42V1T#xm_38KDMT+SJSl}yrTG8oj1_qw|u+SL4V$z_e88#)o+KKeh|uT!%XC> z58uQ$4UdP3)=?QS{0{P#ND;OTqm^=2%-=w25?7{*Q^~Iswv!kjK3$^YCD!E3zin&5 zFPEYs;UrcNCDh2LdXc(01tTT9%K4G#LbtT^w(2^Zq$_tI{7hD3b=jSaC6ULWlC5Y2 zJW+Sn_WYlv>i@M_=0D}q|51efe{hlhpO*=M75HDxGUEfJ{uu#`FhC(W zAUFK)$z`4YXL|WR%?SS~5dRNn{U@19K!*A6sY#uEn>a)5vRCXUufU-O23| z8?q4?j0$>snL)R^@v;dQk$nZeNfcW;6=A9VS;>16o`4{^4x7a?Q@diirCBT)hCmqD zLq$cUZ~D~lhPvH0>&23%Y!1Yc07-$G*rd=be_z}=QP@J%S&}G=$V9kA907AdyJ2ig zQ_G4GEg|Nv&`{;q)9iWuybbc{CC@5x`hSS^vjTGOe;xng3a|o{oBtdGa29_Z|LS*P z<@l@1gO%go&d2d@=L4|A|N6gwJ0D=j;g2z(Y34tO9)K;0KkoalCwlzP;qLz57#@H0 zzWlK-^%so%@7RuihH)?e;N=W}t&~4)5(UW8GqL{rfE6(K#}?QBHfRUHAO--;aw zfNua09)K|Yw-F#_8JPaMCIB$UALKj0j?o{F0j&MQV5Prf^#EN`{{yVvpN9VBQt=U__*~;|(2sOB zc@!|zrtY4`k)dGGtDig92jd*CUx|^Z@bT~TV1C2GkcNaTA%>0M*B65*;2^K-{A_!A z#z{^AnbI@xxczYL`F!(T?ze2}+|+K0#aTQn-Uuv)8N)Rbhu%=i-QzD?VIKKIeJ1KG2|V4i?4OEfu*BS1nW45V^W{0qcDp(fH~tG+jc>Kqf;Mk zT2}t`Y?%LY1|xzTNi9@kYI26VVy4G>ZGPD@v?nsG@*e8~Qp>uhP|FvYuG)kXORGND%5u9UM%p#v-TgyPJaFJ!ZLD7njcL@_D1 zGPyc}<(g8*#2OWr+05L+yp8KO*@lT|0pTGZVym0mIi;H!o~|y|`h&UeL`Dy(Cp&(3 z%)Cu~T^B!XmUZoZBG?$rqW+5o`HvX<7t`_oHf{XBBhmj(5IpgcNcc|(f}&x~`t;ot z475(-%zqLDMYt2)XaNL4mOlxCxs6O1*@>5zEqmNuvP|KG7iTu0RODmjWo6-swg9$$ zkn!_BvF(jXc9SBZ3BWQe=yx&kuBm!WZSp>K_pS8N&516`F04F3lSKtX|HXCuTOq-J zEGz%NIR5`8aeTG^uZZJ|drw*Zi~04>brSzKi{mr>y)89C#uAhP0JrBH?C5nT9&@$E zfJh%f&>@apWD^(9jSYOe`v_|8$PYr_fa3Xt~(v}>qDA0!niea z7M2$M!Ch<5?$$Tow~C#obW4}+YU=gqBh28KZSD+2fg$>KQ218zosyv7n?!e57C$?M zu>2G=eF%HLZ*04wWLRH-0s=W{xwWP4qeTiLAIET4?nfO zc75^*_}j*Y#eGXsHq2xq&FF_DVX9wO*wj=P=51-mFu%>m=l{jE|DUYgz-Q%P`MY~A zbk?GA#2kIDYD&e{zGry!00ja$ibMM@4_=0Ue^kMc`i(_Ym9mTV;Y~!yL@4VbV_965 zY@C{mFXN)DYN{<~Y--}1BXs^Yb;#QCev8R#dNs*2cmMua(v!8j5;9(Oe){p6uywq} z=hGGyfv}aO>y6oR<;y+egV(txdAk;3C%cvX;r@cHWMuP!^Bc|Ee0>3M-{*_m8bS{J za0Hv*bIrxU7tmAc z=I7Hc!ls?x#(VbXhx=#$$zTdE_hO$KU&NHtaGBlFw9fJ*Ly9anUf9s*+SW#v?%PKV zpZEPu|JD^>IokXD?%87r`jz*(;L4_-*YAG5H`Vn+Ex>I*&yzLuwbxJfAouE(4n)?L zuFsYW6Zd{&yh$FgBcaSYN4DdWOe<$zUXiJS97p&Oj+6%Gn$>ldBb}5(pXogg$RqER z2U_~~LAB54djvYYZg-c@n=3uO&dkWjM7rBEkW|lSI<9RFATI>oubMXt2!FSs*8skmAxc{Z#e?h)6fhl*WSxIoQCT} zd%%~by6)FY4bEu_M;kSbh!t(yn#YOTEB6fA&mfbsq2}W~Pr@wb-Im*rc77hmri$M+ znhiPXQ`Tjak-$ucHM?{-ZRGs0^1kO+JCb+Q_hoxY42W11G1R2tAjKVbLU=##j1XDD zLJE<+@4TLUeTpz@?;3s zGigM1_~vi;i}m$xdyNu4m4<_CS~CVLRoLQlDu*yd z3T|0ogUDVm8aglA44u87Y{_k9Px{w`e&iUu$G3|5xAxyEv-LnaFPa(hyG^nkb-GQ8 z9eLZ+avdo;(*C;9Yj>jcI+~?Aa#Se%T@`eJV=1-90j-D|n((VneA9dNcBeU(=$2sn z^@G7 zg{XyXUy@%hVU8>vRMo#v!{lN+-=X96-i38JK|KxYD8i*qZ{&oHQY*&-qRc-k+G=PQ>X9>3H0R{ zjnN(}9?GgB)b=jZ{owWSXISD%fytOPc~(}k?~XV<)5@ZRO8eZVfcCyj7`+ zIbQhQgBkb~EUvlGRA-4pi~QeF*=M}ryZ02cLJ5A&8py~ouVHQ%@x{46x2_T4Q*OZ5 zrtveM7We9kk8jJfPNT~}RZ zJ&>1C)9k6nGyu)1{B{3x7XV+M1SI z9o3(ix(8YI7>Ib#8xS6=xeTbhF7Rm~Dd)LoSL) zbk(`lDrCl^FFBy*plS1wjmVnG)&Ju!z9Ie)?~H!RykUkpP#!LJo`88Ma2-$bf+3e_ z)3WIU&|8?yEiAr@b$lG`j3KrL4btJk(EHa(ww1GJn*szUI*kr|tR3k!xa2kdLI~@x zHXtqaa*biv_~Z&uuuP?a=1gX#r=hG3WAct^2vf|3i^G8omUJJ9I4w5TJCJSZY2)p~ z8jNXCNew29dz2{@4E8w@#*7I}DIP4@*;peYifI?tGQ*bT;?pWeAqwQ$hqAE14HT-&3qGor zotN?Wikmn^Y_uKY$UNwrPX--omqv%x!E@@=%xz4C)CJNn#sf62yfCPubO;C{lUQ|t zBjs0(=v7a@4oUL-R4?;Rdi-mUtZB(rhMZ|1gb1B-B>IujHdnEMp6gA86tm z^+RmOB?n<(xqv$(OvU1R{;J2sXWWD_aT3SFxiPIPGLP?bzn7%#|Ky zda+#=Nl4ipZnd-sb%KPV`=AV**~GYaePbi?rgs3C5ksz3-$PixswlUfXSB0OCDhE$SNiJ z*;$~_3$(TnH9QEW&`^L zZ8T5sw1Iv;+|94vfWhOrNM!&T&k3zW5IHLO@b{fOg2J!ysd)^Kkl5(~6j|n7!%}H! zA?01SM&qx?g~EqBzXLhj1xpL24)GU*+K}K)WzDS9oUmRGhsaAgI?Dz?`jyQH0wtUE znVi(+%NK}U?SdTcS1{1Kaxlc0ShDN7u>A_Wt6TahS3YE$>=;;oQnv3-G%2gl5WuLa zsNzv@8uyiRqUfX+tE+@agr*N+;@Dz(5hVl?1IBTnb0`&*9YVv>S%A@+aIs9KWq;og zdALfH4g*`UEMTO;Gt)djwDqb)v5qIBHp;z;d+KeiN&Ad`O!(cKdBi+ocqSUu3vlsC`e zD{$*@&U4lKx88J+)J|peT+1Ux!?WuT+Qx+_wI!suGPKPw3Njfe}M=02(Wl1C)M-6f^>r<*gBjV0Y&U*7Hyw*5tTgPNcXVG$2 za1)eVV@OKQqemz@j2uTV>-G~j7&uJW;+06ZDeHbOfa=J2kJ$p2uI6HZ3#pAAY6ZCp z0fdF-P}bxjz*;y&hy_k^3g)Z=HA8w`0hoSDVB~3~OlhSYsjTtQ=~V*;%AST8FFRlt zl2|{4+(g{qt+(Tyqamr$HaO@N!Y^@Br@>v}rFj4kNJo)ONpO;P_D=ez6(2A9uL3$) zfH9jX6+}eK0FsL8u6C77_tiUS0Qh> zJr^beh6kx~mLAkO^N!AT!B4#>>sS3S&J7!mb7ECwzN&7G4wJow>x%>FrIHOBA|RN&@2sOsp-y z#EJw=taQM{aays7#+b7ald_K zo6>-^U%5Xvt}#-iGbu^?%@J*ec8On@tJ*&vCL~j&u@2Abt1RGe1V=<^3P*(bAHTmc zMdrscleD)pMf|ShSnU1QKy@aD-3$s4KryOd^5MP=_F2X*`3|AYK#*g<3S(bK{XlX7 z>M9E~Cn87%Oc+H-K-3Y9r2es#509&+bqvTE|LLMw;MZqf7Edl7E%HY|H6`p&lQ=Ujn3R?W+z zwMCqOHeN^}P8wyKBO%0RIy)Vc#(ejS(Zc+fG}bCZLhyq+DcnV>gb)|tp~H*`9a1=( z?iDb^A{H}jfQyP4*cx#xeRjWA^=hKGF4Bgw`r|@SZA_>!1AIiPP6_Z)Z8*S3#dv=N zmHZz;g@~IZJs7F3O4A(ZLYaB|kXdSk6^kA!!I1y?q?&g36#OwFo&I(dFOj0&W9rss?B&A6 zk$hgAtxl_&qI0kmf$f`QcuQ$eozuGEu=X92Q!x${H<86vgZ9WMdF;9Nmqg>@bOHwO6^;T+5~2<5kg|(##u%$Sqrwr0+(chvT-UsH5dz?| zK|kQ_&s;6tnB$`Q*aIHBm3i24)bJ$zKsk{xWQ_lK)+T0dUa8%bL&YdAz$W*4mS!x? zB0T#@ehrmpN+7t(F*~5zRiheb%1PZV_CQ~M%yE?9sZ0{&8ysW6RfQ|QsB#3NOs-vM zha>k?9z-I2w@Pxy2fG+$&V)m>oI7Z<_P$OIx?Rf0&);3^lq~Ob5`Gmm&5nFJg?d&z zN3wc1*BWRiQ{h8;#p0jAs8I^K%WNOt`AIv%w{KYv zssggif;y$lWJvx@-aL45qVYqcF8T1CEm&^(4w|({?}tN@&T4sb199e+f;r|yB1-Q* z1y>h)(C^6yXV6;7L^t#JXL0T{(`2jE68<3X$*;*5w zI;U3BHf>TQ@TF{S6e|o&`@YO-aWz!?RJ=m47lqx}?Q@Lw80gSL{z5b~kOGZhxWdhv zF4IwHO#$#tPq>Y6CcpL3X-e7pEjDDj9h)g@M~wy*{Iw{`s`u- zWUHQdoSmRk$nfj0$q0jD!dyDMMa5$Xsh!cZ`$AU*(ZU`$>m8v+Ll;uJ$mksEN3IT8 zI6dnMicin@HQqu+nvCl_L?l~^s!%;6dmA)Bp?31?$M+$X7w>Ly*LDF4;2_OOl=qc3@ z8%MbV*+QZCbD@EIJVPUoZb1a#*~f1@q{zc=Nq>M-kY^x<7gKfCRNY{Y#6*eVOK^%h`j z0p%BWrchX4fUVa6TQLB(ZUSsgvE&Zh(lS_8a;f-kA-8z=xth8NG$)G7YgN+1Q*0r? zcB~H5Gl3ybU@JPO=vZ5ooEd=5@4)#KkzALdWzp2phL<=PkYfqV^W;PaI_DV&7ozKm z4L^^MXLW4=6&bK%xYAlL(!^j_VTUrecv6h0HI=bzeGr4y%mczC!n?SAD+;=_J-1NW z*W#)QxxiS#YO4QY-vu* z>yhySh^_G{nt6d-n47{4^<9VFL{3ur8rn`|r7T<&LIz;Zgyj_q^#EAuygqZZ3dL+G|_WojVE@t#);YJv1!dZiEk-@E$@5p~*sAJQ%cWIhVVC2qK$WIFWTw1R z8?4!KF5l~*o0X;=lA{6*G+neD4KDq#JQ+PdyaJ6doyL-DHL^#-A6?mbkSs1Y3&+_1 z@~#sG7M9HDy9kdEX#TMVHX@en!FSKY=d2mWa)<2Oky3khM6lwS0wH~F9>am+g934D zTi$RmTR`0FRPx!y`&C%$xlRV*@6 z*+VLeM=tbaF;xvzcaW|ea_Po31Q)J61+Q~lAySN-SkE`cT&R;3Fo8PD{}0N`DOjKyqm zty21o{*>Gxg7Dhd4y9wT?>CAO%3x9?NX%~zl_li~^2UmS1LYm^VHhrxnAxr}+Pcxw z8>6oB6;ld)3F(Dwh1&8V9#su4CzLZe9?R&CUzA4EIP+itp`y5n6B!OHY^9J;6{Qt) zb(YHdUzAN7ksDeD3rbsJQ0gi#gVE?y<(EU{v7ejn!9iMgBOHAd$&cw0;}&O{Ug0QGT&AxP zCc#DZ5`(TG4o`NGwoQYKa)ZId)_lStjX0DAv#@5uP50qg1u zjReWY)?B4Rp}|s%30C1KSardXjbe+WA-bHM@xC;i2_29=qFl^+L5Z&DHiJ!%NXI`M zC$Deoq7W>39BsB|s!&%izaaLs3sRrjDv0R`vrzB@W|6gH26inw=*#(bN#7YP3cWGi6Z?mGyBsjGdebG4vN}DP z(+Zf>nJ$FMYE3mGW%VcSaI^Z-HAp49qS9zbW87+W3eeRfd=acx;k`vVm`Z*)OgtwF zTq~f0bz%xb^r#)EyO+Y#MDnj7+F7E8O0i@QTvgd$Jip#i9D8im`#lb`t7iYCe>pgv zsoL@`z%#eFYnYFg@OyE@Mt{4V%R9T0`&=n$?s}%;>v}P;k~1qjvN&AU#^Sqok=V~x zD#+GQ{{Y{4caZ0zaV|0A_06~G&cAr07(8lB(u4A zHFfjUH-EguwXwNO5Sf^a-V-@RyABe8_&p5Y`WapirYIPM=r(6Uab!hwfB7S-;EW=hF6zXNq24Z~6wwlP(@lMc>l4 zmrpI-MO}NHtc}!&+OXY6R79OR(h_jnf@9^bW#yQq^f$Tl*$6S7nik!+6*ISI?Z`g9 zGYP)zx4jcTpe;#7)Bk?UjrpGoR{xVCM1TY|8=&azAMMht900ZAe^wmc@bFSc5o>?c zx>t31)J{G51`&M5-p@{{ppPLuD1~to{%9T@9Z%3{A4oqykw2BkS5edcM(nBtC>9rp-a~gL)1)%k31}7ss3-OD7`0iFh8I#&V1w){HVa~6P*775|IXVGDitS_Oh!GU% z1qE#~rvRt80Z5z==vY&|(Qv`96TJ)iI|ER?p~Oumhndx6A@H_5P$^w{gJs%)x*O0F zJP^0k5z0i2&Da|ikY3T0o@%GJ$ZH8b?)QP?sT3YYKaEc}*S|&?rE>LFT>wz&{)s{lMmcB3HKfzI@jvMgmr!yO6n%)%^_MV2b2& zHl<0!_$<+Q@Mp`7FywxszUtO+ds)j^{Zga$0(zXekvEY(%+w3)4p9Swe;NIat{3DK zC>L!c5V|1ooyQCr4VLOVqWiYP2t}rGincKA1jKKVSM)68J5=Y9%q%Q>5YP=*iEUsA z6mEbfP%IP?K00Zy@o)ggH6nFzQ7vq8|K7z#yKWwOp&%)2ur>xLGS?AxAfeG@`NPA5 z)Mw{AsLjW=yHYZ{kYsL(SXJJ~`j7N!P$iz8$=l+)mky~IN-s-&L74$dIUBFnz%uIW zqlN20tUD@}@vDv}BLuqQJ1ic9@{;7%V7LonF6)QsMBM^1nW{YBcT4l^rHomtW%<3d zZcDhwC40ZibF8UO!6~IvrS1>8vfI}ZpzohK%{asU6xZ}8J}o>qL>H7@In^b0GZm#f z+L;krQ4f?%brh99vW$-0N&NzHQVfeEL@Sp>ZDa`GY_U3N;^e9 ztZ_|nuX_Ld(GDrJgWJ_m{JFyV_^mR``s%!=JwtEP?B&dj4orqv2K;%j(BPB~<-o(I;Q!CnzT8Rf_Wiqy{pM ziHvCWTup>Ja^@+{(iT(CGu|`?XwdW*AV%rAg4ndXbqFTTUtrwywN9006`NT`okzSK zX5$19NSwcrh=F?LQxPKc;iZECOvl4sMRjo3$HK|@WDKVqRVr_mjA zF~SXQ9yjmTeb$^F-wEVl$MjjaL11tUuN$)e$mwP!@%t7Wb5AgHZY+_E~_){WTR~tt_DCXT#*-&7#b? zVXzH|tV7WAFeb4wtH{>2o!G%lrlGk`P*Wj7w#hS1brJQ?)B~9NWz?lAPVn1-Mz@(0 z`)QX&7KNCo&G^Uhw+Zcvd3HqD!8(BTY0nQQyi2MPHperb*{%tJh$Wlil^)^{;JPlz zeu;D9LgFDYCH4legW?UzjX)e4#q6Mxmwaz9_?o#l5sy4-f|n=-Gi=GaX70J4IQ?tc zS`ki-xP%+MCjjX*Xs&iG7GoPRYxviVgJ|Ma@WxPE=N@&LJ(^vg=dvg`=18y+YoZVo zHYk??9*}d0ArSeHv^v~pIqQuN8!Z=%rau8(k736`%^K(%!9DV>1#|^Cj!}I538ZEG| z8KC3WVeW+n_~GtCmPV~*wOpQ z9Qt&G`OFOVLwbtptqE}72wS48J%}N4kLXQaeJGaadfofd=~?t$ud0^{{0Y)u@0~Z> zkL3FC=BcQ6EaE1<_p`h|q9@`2-EQZ~@FoKKP0l|D=Iwlr{3ESbuHZTW`t7NJ{G+Zn zrdjhzOu^j%?xUHH)voFK@WWkqI|MKFIRu1{-YB8>5j@*Va_g~}z_P%3v-x)&tS-^Ft{@_DymD`2^dAtle@Pe_Q zx~1Ggj+m-=x-wm-xo*?>`o`hkL0D^PMp=W@%7jWa26;OQUFqH&t@g#+RgBlK89s-` zge&{z7WcW8XrLM9t*qB(>glroGw=juTS^X1A?bier@2cLM%03p`H#L6}R&VWX zBM>~)R>z>En#R3RO^`gfWoW8u_P%5;dyh~a!fONnF)%c`tbqtBdkY1GZf7L4`(6?d zbV!G|-XH<$&LD(^9T5LpaI`O(Y)cbIP?<24IcGy0AZ9R`B=(2QFgX_eZy=dBR++pL zKTEhA(!p=RWL-nB%txA?4@y|FZ~M~ zjh;%oQ@IBEoQ&-EYcY5gw?hfwdGmon5F&Q^&+OG<;c<7jgq6%Up=RykdqT`EjNYG3FiJ<@G(o z6H0y=;KR=;W^&U&D9Hf2bm5geMSi1@70)aBtmu{xd5IX(WoAY*MDzMfxN^xM9p4w)Ut!%9>Zi;cFFLkr>F4(bKB;Hp z(|=R`h8N)gVgx?)#aZOYe#t&ET5@NG1LHv1Lm8S=B@!%2jB_UMz&?aOs?eSWQl%rS z0;?RiyvaXK3`qrVot%6v}}TLYIbJVSP+t;T^b9FFF_8@9$-_p%9Fpo)i+L|9BXg5#De@(&T???aZ4G5Xnj*B| z*aERRX$(?#4_#E4+3P{#Hpy#T`9{77CL()FY_yxTONiFWnO@m;6HD-lX{}*-%AVXq z=7&pd@w$2fw1u2>0nLA72K+wvGhA0epFoCmwXb|l{~~zUz|EIFDcDf z!Xw_gSdw=i`3|f4LIjV-nsj0J9(!MUZnha)D!sKPYR9U@GafEq_>-{_?>oO0h>YDDLw26I z2al1(9NS`;f%maRZtdDnwVw62PNtXjO;Miou~oV{=MT66K}&Ml2RL>Nov^QV>ImgY z#n6@E5wMyBI?w|rl}*lp#vx>2Z>+nw--~~+VO)eul61>nUCgBv#cZ(YXrq*fvr1%k z+ntx5j+9_y$;$b#urYC@DaV=^Q*0c9+g)qTq&FPm+I zqP##_mSKdbI;q!!W1qK|Y84qfRhF}o>b*KCDBI}drJ3C(Ni*L^Z0zwW#x+Hc9WgFt zCoLD5`&ct3#`Jl8FyfXuM=aWfx~c4DAb3HCXN_hH0FM`%Q6!n$<1aI=$$(-j8aob# ztuROo4(>QSzW$ipvhZ%a5O{H3Bf4{cV%X>iQESmDU!>3j)>raiO3k$*uTNm~(%Bin zUt3!jXch|h3VW&6cUXhv?73(Y&DtD3ZSEGG>>41ww!{Al5!_klfEeYF1hv(W$i=&8 z6T}-QKrvTkRVF~TX+i7o(SA5QTmKO@!K_!DBIBNWqu`*y9E&KC`5Xa-pghIt^YT;^ zJTCW{TVDz7etu!wJc5EFh6lW z)g(L@AE(|v;YXr<192U51DJm(JmlFh4ox4##6lY96Q+hq7N0LE-AV3-G(O*a5|wE} z#6Yf87=sJZ$g+$C>pg+Sve=1P{fbG4HJcIdNX%V&sM@W?fEe?Zu^~|+y0Sdh&rFNJ_XEODcusOX?MvFl3KL z*1D^GdW!S3$X(&$gox3;@v6)vnOq*Yb6jUUFKvcVp)IinmaJnD#Xf-|`3V&5tW+cH zgcP$LCh+f#GFQY=icN2>fUK^CgsiSCU=-D6Jwv9;`QP$|WwQWj1k{Iej4zt6;sRo( zk$v-7FSz(_r|P29Up=NU*zDF-njDN4s-y6H*A`uG*X-9??x06V9CjafWfZ7<qaSviy&1TnAmh56vti($>gC@<)ZE21-o zdCC$*I5gz)pT(aSXg<5WDlmlLHwcv*x4K_w<*c|`jQWEwUg>;Zp8cA-@(UUq-?fPB zg2lzZi{$x|iikGsiv_PwVH}FX=EsVtq-Q35&7h97njwXnC>8htH&G{0T*NhDYlUA& zwC$4INWE8>A#FAhSJWcQ)s}{pdH&`499iUqg+83HRdsV~m{!Z_vll@2RWdMqt7oHUK@p5qk}yiCNcAoOfK00h=R<$lygYLictuscM;wK z-oC&87TSm51n;f>*^Pn%-7&#-(L}0KN}|{(16xPG6a4w`bQ1SO+loWb5I3X`9Ag_gE3sU8 zRG5iXbp}kM48s)VZ}FQ2I(7+_e;0fMl8nyIC#EDa6NX@o?J&r-X1uFN!50hJ`XmR9 z!z7K*d+qoH(GW!Qqwb9AY^w^jMaZ$pkjjCyJSX<96s}pWWp>Wd2xgCA8KUjq!SIOa z*E;0LZY{FvDxf6&F;J_Xp-~TiPfr1;!Jk*%FbL?2HeRuBW2tl7$*$#FQgIqQJ`YoDFfhL90}(6TA9Wy&i+t8x zd>^3uw6Z7V+ASK5gLy4_GPTw5o?+MR1_xpE?~!Ogt4V{)6~ZUqehBKE!R`$I?nDg0>iV6`NC7Iph8%r^v(vJk)=Nt1#4gwr6k+-?9S+ zGG8YRlig;oJxVUcPP3!#;YH2pK`y<+ZMY%B^Mcy4)w9V!LPV2hg41p1XPXnAA0aP7 zguUR~&b;ocWg-icS?q@}Df9`S$11B%cmR-f={^{;Fux_aDhKQ$#I2LPVtxo_bRA+? zjQ@=3N^v%xdm9P&^s)m4T}aeV2Xy?{NOC-2M}L%{lz2jiIOnn|lZJkagM(C|kYg=1 zc1qF$N)7@L=3{ipeg1JR6i18&h&3m7MUI17@_FG4>3V-5o|>fx2r;o;Mzpzie5zg+ zAC8jw1Y=XMS944SUQU%vLbgqJ3GFP_s^-Noz2vP;$J71|tHPA(V}==!UU*5_+TIg+ zzd;kl)&Y|gVuu8nvfX&p!gT;tHL(rRBKjxAu7vv}HAQBgF=0G2O0dSlVsi2}?!3dw z{rk3j^~m{Z78Ot2s3&0-xq?VoF$1^gNMV-;o(a1SzuGJSFdZ0<6hVvDZ&bw2A$sD! z;ep@*1h4Pok-V;k8Pw*Ook&JE6l9&(D6bn;@nmVyl$pEq2^(dc8X7a4UQ?8<{gQ)m)`rtzETUyHceaJ!@I2tU6WaRAxqGoY;|jmlFfmd4OZd z_X~Z~pYE2&4t+O-!>iXxt)6RNtK+@MP46-4*~V+H7JHX-!q{@UbQwdxJU{KUPBY`d z=5f<`ywQT62CREg21=BzO3`m9^zm>S3SZ4FNR}8ZrTKTxS_L{)Xpj2SM|M8x?g5hHR!Zfb`7;orl}|ERU6xc@3xD&0+*1 z7M|XH|MQ1PJ~tt(hP}efHf}4v5w5tDZ=HElxtGsWd2H}&*5 z=fJ*!?U+-)n*&X}8?_?d}qYvPtk9?@9hOkQwBB3XM*%2EuSC0v%dAm#D;4{C> z6E4k0eNVD3>_xW8d=Ncm9HOtVOk>^`ZLB~YvQ9jd$DO)*6WE|}*)Ui@Y!;>_l`&_f zK|xmQWXZ;%Yh$YBKY}h0okBZnILDm4YyV!zX;FESTROZ-PE@f9E44fwKR8P6N%{F(-LqR#)~wv<({G$%XG~IFO8FrL9Qx(eNUN5s z$4_-yvR9B#MioT+`0)w8vr761enr6b==col)N~82DrQgoF_i%S3m_5A?Y_ z4TLYV*7}CSoOP16QgNBWM}r-7O*`Qr?QBE8=!}VS3|U4=BZ@`N``Iu9iTI|1 z=O$=#`w(|F0x;*nzk$<@}TXg_DWnr=aRDBCUW;>2%DT94r8affx1A7r9Yd zCT3QE4k+MB0P(^Pkyh3}7#RK%X$8E8m6MsB6(G{e&O*n^$Os^>W@lulV`paud=Ov< z?w@k405*Xa>IMLw_af5z1LFe_PW&6o_m)<5K6S^pCntv|R7{`~g;OEQH2 z4vz8P2(+^Nl&t+vbH4yMKG+zT=onZT*f{_^4Zlz<{2*ZX^ZWi2@RWd=`R{0{cFfQV zgA4!JGcU~^I=|NfOe!mI*gf*t(*LkL!iQ&#R4;<%xX^yL=i89YYrsN_Z z#Zu5B$`{M?ry!P8%+nTjBw8Xin$?rVt-+P|b1oftUO2Q1qUf$Ot>=yfatbzkh)e0q zOOrE}+?5dRB9`dStH=8yJBMh-Sk_69}{Kj=_ITph&}9rYZIeze3GnE*T| zKc|)03-<^!`_H$DF|q?VMgR;cKRyJ|dNId87)R*E82_6HTG#*-C@g={urRU%C{O@g z=RYn;lo3EJ1YpAds|8>N0qm^(^ECjG3V<*FkJf)1eG5A?;QD@21;o{-9+T2@w3-W zL;zpoPX-+m5x{i=Bnp09w~5HhW&bg+UdU5KtPN}oU(~I6cmOMknX$1EVE(>LS53h2 z^nerm>;J#{;9qm#|F1a!Flzc2WBy|V0EP@`y{M1;)Pw)adS6Ug)Xd(&@x?*BSnf;A z_A~xtdNF?jMn*v86)htRz(xLy@_tdDXZg#O1KuXB=V)){3UB~)3=Dwa<;TAlPtQO= z`|q9se3X>l&$BWy0c0`$ijH2$r2vP(fNS{aNPnT7qE|IDbToZ&HjE5E z9NEiR{`K?!W)CpFEQddS{rvOe@!tdAmsRM0e~J6K=9(}v09IK*9P-CX#>fDOIsjqP zOY8q&DSP?QKg{dp1ON9-3$SDZ7##tj1>n{SU|K)k{$hFmw@vGx8x|lq{Lv%-8N>Q> zeAocq;O|585)=G6G=kCu^fET~R(h5I0zv@-fd7#a0=!HwCHdpGDghm!&!nXY0C${< z0t5i=J0k*m13kcTzux5hjgaS;4+I=Y_d}`(5Q4v)@Qw4!LzW@4~If8W^dzU`y+6X_<0SA0Ec4_V9m3AiNX!s{&bUn9QZOv{&_h5 zw+Nh>03h`AZ-LT(70VnGBNNNtDq>I6IAcHu;J)sm-F5OeMPf`Q-1&zS7)5=|`z}U- z{HAVu7{{ie;dMAL6UyRsW#Z*WnX;HD#AoPC3g`yq1M^F0nQ!-3ee)>2w4z!iLf`KK zo=r~HJ35|kLTAptyFs-(#XNgr$!@o7oqbtd&ED3yn4L%ogn%n-HJYvE*qr`)rC@Y6 zee5=0>LmU_npk>EJxm5_+Bo>4gD6P@frw@zX&%gWEsliQI@z_xp3Z@>X1i{_%4AAw zbLr0lw9T)L(S883m~g- zkiU@>q?KgM_HSDI+Sl7AMJhrhHqzRc8y(TiR;AL;(l5VOIWj%mnd-M#*XS$d&i8j# z8gDO+p)Q9Ad^O3UB;OBxGo+Gh2ESlOB0sJWW6d&BTI*1$SYb__W)LnUxiuePC6s6S zp->o_(cYD5Hl$%uv_)>j@}_qpbAhhWRBMaLP0}b)Da>fN5)Nd-Dcq&$%1)vdz z8M~)Sp;;BMk_dN?8%Y;7^K@jCvWWEVn!Bh`mW&4( zyP|k;?4n~)q{>q0zm}}jTys14K{Uk--^Xat#Qg(HfC;?LG)=CG&?^bchYK;k<(Vhw z*e2g|nAuCA!nAI?;MBkzChV`w zCzn|vQFm*g`@!o-cvPX7wLHERzz2rldNZ8nzG8zLuSmaK)@1Y$-nu~pdqvg+VTzkU zJ22@=RE8y^LUTY46UlCu)r|!yb1<S~@Z`in0w0AMp z$D?N@Z}-&pX+FBHrU)Ar1YMEFZ`N%Z)MKI-^mQRvy+en(YhOw{k+w{1N#T3tav+nf zsYPdt`6|tXvN_}{voB@RQLJZxqLc4LhACQ2?6s9o7M*q6MMvdu~T@9Crvb~Qj7%_!w~U0Z-7$XdW$kM)Ko{j<9onp(O*!c-KN z)UhpqQ;Db`nda|pDLFwv-UPNY9}#-l=HJOtzD*>$aQ-|gMYT5$xi5#U+SQ>1Wd9Uo zLakayjaK9-2#hrpLfg&f0vq>Xf-$Z{0E=PmUTUiH932HuAvw>aeXw5?p#C#5dhYcIl~$=>Eb!&4 z+nA|W>TFaPIdy%@hmm6M6-P_tmWWxF{f7V${YcJP)XQhBN2l6%kPWoJyRDO$Ii zkiypqvZst^!L>w zO=qATd*gcFhnRsGhBdcyLYKB2=(4oSNNWz0S?o<4Q%dJwbBbPc%+M6;Z1%aP;^=i(rSR-slt%4Gjfcf}4ytI48r`MiX0*sa3F9_- zpoE7iWg6jL|2@TBM3r|!0!~d*80voE=N>MIv|-gKmA0qJT@w#=_8_rDoFiHfT-8%R z`(UP+kuk&eU4DD4ig^{l)5oin&UpEF@FgT$#3Xo0pGy`{wnQJ~sc_Hb@6_~E8)2ex zSP?6&GSWM#kzc`?;TXmmv@!HKaEKBZ9?@jHhtK-dfS8Il{*|kOvQ>SR(OB&@c!aKu z21*FmP;zJ_86u*&4a+zIX}f;vi5+P@HRw#b_m*ta1LdMU`0hV=+Gkz(@!PkDqYg*C=0*|J8hY`25Amt#3lEF$e`XFg+KI!oxlK(zP%VlNN^ zjT53^Yj5G*_&d1o&res4?~WgzGb1^fuBw6+P%`-VxV}Vf1eO=k9OZtrtmd*5%1gjy zGfgzsM%y3Y@hVhYVFj9J@KSNJUH)a!m?sXz#b1zrS$9*$z8eLq#kNzJjf> z>eg9jo8mr3 ztE)ZXsi3IUjOW)7o7jT8R8bCRVP4+SJ0Gg!C<9&|9!CjBkDu&;zH7R6n&N>qI2A%B;L$9 z!3>`eT<2(6XY`56OeZYt(4W`75`eGAY&LG<8qh)1qJ-)@G#hroX8XNHej|sgM|5Cec)C zRbE_LJr)ty19qvwW4+^rr`WBHYOI7V#(hmRd>rGLFXZqQwZMbvokH2DA!%f{@+KT& z)L`1x=lSgTcR=Q8-Wj4(%q2d%i2WnFfej(rF*fGZ3ws;KW9Byr*&DcfQ}6GAT?{BZ zn*vg@YUf;5QqB{00!T+`Pf2Ot9%`u*m4rR%%X8N@tm(*2ePXHbD||hH5+Xj4IYx6D z$1A_TpIINLci58Wn{C4$oUB1OvNn}tZO>Wssh#pe;$a(M4I*iCTe+yCn~pw&Dbv{1 zF*cLCa&V$v7utcfYvN~YGH}-1mTxvy#^dPt!Fub#so-ytQ>8x3Xx*vMgqYiT$wLX4 zmEG{h`OTcExtF^-AF~H%xDE8e<+3$9F=wL_pOrOtD(6=!K;>}M%W33KTQ8FE-0pYGUZy`_~qOm)=^ zJcgn&)IYto&$hoTeHN!$!1L1$Xm_A!h;&>L*DF$9Zb8(fVSKk;dfTuZb>8OMM?ku? zmRKmS;-Kt`T{^zwgY9m!^A=>o@yJNbXkwOHosA45Yt{PsZhdS!a)OWVdy~(wHOtw+ zs-fvc`-tZm(|YUZE#1{G4}Gde9&hd+_By_VIo1BgHNPY>e&d=M0r(R$0EzjZ?V15V z%deh!F0$21NB|bpL8TfFM;gy(02+0fZUZO=n6he>Pd5z}nywRR2&nq=J<*P{_8PRW z?mO!dl-GT=$|br7I2@HqOJ3%$A^l4`TjCFneKza(1$_}o9{gnr4* z{J`q|yfOfuu4E%7AuO$DOYqmn1M)uq4r=-noHP*@2Bf`yW^+x1MFEXJGjuN?6aY~B zaq1tq697+pY5X7L=K$a9Uoh0a`ru!4;J;uF01WvL;{q5l09pFg)Bso$!0-H#QvS>P z{4<#8B^Uk!W&+?u|Ftj^`#*TTzr##`rQ{zy-@jlcK$rZ#|MMqy@e9uM6KVPzlJTST zF6m4*;0}h|W))r~eDf*8i)Z(ocn}pB~@^)FSw&W&{|Ne?XLel-T?^4!`>!GGiQ1b8$7Z z32J3?)^wd#BZGdK7RPYD2Tc|nyBfn$s?%ZQv73Sq@dp~`!09>R-ITG)kx;KcnDiCL zDPN_&XG^}+12#8AyEzW5GwU}SoNZctqAD(N<1(B*BFj>d8hi58S)Kj_T~VGeN5Pk? zz$*)0LV`Qx(N8+3;8v+0X5|_{`EhcO&Y2P+l(*Jzt|f~K36P-~>mI`0=vcDFevmj5qH?kIuDhgoB-co!-X*En&t(Ru5}yu@grG4Zu~a zgF;BnrT$g1zVBb3g`-&-PKP zh@*HR(lOKyEa@Ao+|oq*jZ)$v3*1GcBhoU+>Y$PpxYeS*Wn(m0-Ivs3uS`@@FWm{K z6L~ZIKp@?sM32czf+`|8997p;Jflfk>X9Dz*|KxOLzM;9B2aDF&VIw=Ee@6>K6QS6 z^@GKI)O570=7h!NlvM^+Xi7+=QI;_pbXdYsi zo@|0lTvbF(OQZ_j1k3E^5i}>L2lAl77?X%GfxF_w<;_p0#pJ!NunK0F=TGs6=y>~F zhigo%!o!a_(*@0>RzOpk)CR9IpP(hlTU$^@OZ_mx3>_z1;r8(fZYKx!{kmry0` z)_8${W-rBC0`X$W(Mb(?yXf((uf5N%NkN=vNDd^M>aA`PdhirgIADf#vUHg_v2dEtCGX$YPVKQl%C*K9&*EOW1cOrt zN|$cmG2(cHqewZ{RBRv2I?I@-L%KXu(9df@swrW0Da=>PguqGTxMGu|M7_(=j1k|2 zbqzmyp>G*IF{f;Lyk+^hYgaaPi9j}~PJLX9Be``x*puS)^i(f~T?Te1;Y4TKSpAy> zN`1!eDG}J{5URG)dYg+RX`M_>w&AQIdqB+_u&xvcq3gN{A$U1ruI9xcfJ{2AXv?uC z0J=)`g3p`QN0PcRo9_g^on=*U!${b#+tnE-uy>TLr1-uYrDOczkw-VA!Mc?O-9>FY zJ7+{og{NNZY!@p=sAQUw1JvH2K_AEhPu~0SgMTaPEaw%qvddccAQ}}d_zmKF*qJvO_(pY+?eC94_6xYP~phTJ<7d8hjH7xL!F z@AZq+b1iv3HD?5R4Vc^lS#z9;wS&b)En(JE!-Y@#Nr$gsI(&I6z%?2okdp88VT0u8 z_2rfk^ikhQrDj5Zgmz50(>DUVBf6^S16}#)Kqe{4V=mBD4evzV&}yd)hlL`H7$rN2 zHAPA7z1>;scC*Q~V@Oqx*g`VFtqh;~l&LXncGnKD2DZ zK#J*}l=Uy>F36Vx_n~6n_Qio;dp+FF!bVp5>-iE&vTfiQL}-tOhexH*GFq``mBiEs zaH6_ZXi`vhQ?5wLuzAgi1H*B7g%h)4e9c@)aV1l4Qd)7YEt0H-Rgwc!w*nbQMKBlTt?B;(Rz*zWWURZ&Y>fjVW!vkohh&8}!< z)xfr>Z{Q?`lB7MQPkL`jhH;+kzmnSR=UbhmyiQ|Tg9&F7E$!mOWB21D!nZzpNq1ts#?XhMlM!o4+)TRLs9#b;xq zZ=Dace+&UaEC%_My%dq^%0Xe@59)R$qRtiJ>DnPcgO%M+vswZ4NhacAEO|@TVZ1o7 zN0rL)O1-(~%X{3Mg(N?y7!aTV3?rv!%$ZByGE>9x$a?0RI4M&z-U4L~_;q&7uQSVy zn<3;-4y>O{Gx1hrx(MEw^>a)Ysp1zNFFl(dn>U)Tdq$YOS%5XW`NDq3bmJ)uxeOJf zg3hh)1HY3!V(w;;=aP$$ury4bAmH3D4lZ=9h$@!gcj&fhn0uRi(SQ_5#u*+xN0~$b z#T!&PMr#VwTw|@);oWFYb1_h<*NtE4^Xb`6dibE{YAXV#h^9j*@N9B}+wl$__tXFC z;d5km&-yzbuP2PWNBiyHveM#tS*M5E!yFdHF_x7Cca~kaSaVWY z#3dT-4GKRtI$2Pfl8@awaTbA(m)F9?VYt-CUA;=fu_2b3(0c67mYNxkbuBF&0#4sw z8S1SxLC8%8d-zo24Wl~?&dhC71|If?RpA~TIiD@G8)}kS_NeU+E5c|vuQmqRzuqwe zX}?MN3_Y=#%1@4YwW|z+Yd$gqlA;-2_1a3>!tLW^%{0177n`LkB8uFOC^R)gAGJPo zX&rJxPb@C!1WgMIvA>8TX(@spTpunUD42(&P=>Vso>K~^cta!)Hv{bvvT=5xnH!=~ zpR-sb1IlZ4T7>JRiW6F?KsO9}jdQv;u-&z94nI^+=Ha{2nZZ5n>E*sR3ESnU>T5qy05 zjinz#!=eoW-WfL#K}c`69z%sC(4*PE%gm#8ICo@;H$1qhMpn)+r=Wc8Du5vpTc2yN zI@Prw=dBy7JW}et1R2^hmfM@BrB9^!U8l+z=G{u|d)+{+d*J~~@-6GlhWb3yLe5jk z7o2N@4g2x5$FsY0$sW16blAG79mCD?+D0lvpA=`wkrN12+NF)7N?KLlri=1$Fa;~* z`s^1A*XS$uj}sh^)wbjmd%udW+NA&35B|O1YX&bH6?=i_o%hk3C z9S8Pfwa=+g^M19o@kw66myNlc8#`z;nuyAouexozWP2Mk_uGLG#x#>Q6Oz2=(9tL3 z0r544(W&b+F?XewUO#2d^;a-k)!1N0p2(O1C8BRJ$%;m0tKt(jLqq1zpm*bAKe`f5 z$1nIXQnX61=;mr#}$F)fTDPZHB#uu zNll>md2*HqrCoRWh$L8NA?%y5MI)tBUij@Zgg%)^zMfMLTV@Zp8EM4oIryUT|vcIk}XsOpFGUbEI6byJsbjdgUK3GE+&5hkA7kt?qs?xZU% zp72yE5j2x%=APSA%jan$v5IOdwIh1^Wn~kZzV7yj-QIygaPpA0A%a^Jj%@W#9+w9c zRcpBM*i~F=JZisPVt3?aC_S{1K|AHycUW$1jOf%cyh_3Lo&MTbl5v|5+dBC`^40Fk zse#94`^*B*dM){QSo~fasn|LVS9P?cTTR#DYW%xT){*zuKF4?+-cL_Qm1m0WeLGiM z+A8Ci-t+O9PCF*r_v)&@Jbb2~kMHn&IyhQK?XWQVjYs}l;p8vXivY0we>`x*#_)HI z+!H142s8oM(LGczU$$o-nJPwG|9CaO)mKd&{>R1{!u(Q~IS17%rzQ4_d~|*alC&C4 zw%3`GCG_$jE@C>H&<#3#bQ*}e_54kaUT*3>5Z<4(Gj$BxpIX=g1d0jEt$?=Wm5*|_ zpiA_s8&HIsV#}qw5CyC)T0h81sE8qj_*tFs2ia$9RW6Xx^Y6{p_q-QU<5~uh8}&M& zIOosZFA@v^J6fWYOU`o-VQ5k_tVoCQLl;Po?9?%9b7oA+G7qFBAd#G>gK#0ME!GDQ zQ^~hLVH20g^aLliP%Da3!fIwS^Y!4k#zGN{9xjY7Y+6D>7nFY&T zR{%w*Kja{e62;?3*2NL^N(NK-TpTOxizf8V3_eOKVO|U|CT2*w|#4e z4DY+iOi}p=1S(;i`eRCS2SO!2(;PwhQ3WC43v~Md-DMt)7z40j9BeCa3 zE|gqW^0$7NCg3ZG$aWkZ-@k>ly*-5e=zf)KH&o!tjPsuLs<6lEohOwi7CH| zUTP8%A&sjQS{CdurDjyJ2{MU5kD*2)sMU~~Ca7OKmQ$5hDg=2P(QR}LVUiJl6>xHl z6qGOciaT0RO5~LyP<{Uzv}j7ZDp{FU*9`i((k$Obuek$tp2lY_DNR@2O4Z7eTc5Jz z+oOkTE2b)!SwbN`8xuPZV?etmb~_G;&S*8#K_GuQkZgx4B{5k# z6Cx}64HmEp4;7s^`B^lre>5kpdV-yMdRU&(`(Dq?Q54U4}*ZjTTdmZ#3efiErC9?CB`=%0!Nq z-lCi4Z=;fk3|m?z+DRy}#u24d>naHsPn7zYMF`n?y`5HonhIP~5_4g{xpJ%ci1_H> zu%e^Bk<=G{{avM>ERoNL&8{uP(Vj^MM`ZkC&R#Z6%Q+(Yk=q?OFKy{>^r(Mq0Q^l> z^Iv+@-3+LpU!J)8w6cagBvSv09<@sFP^Ye^qQ3TF6efJwjQDV{0;~<4%cJC z41Y^4W=5XN?Xq2lP9c^^_JjL!CuW?{+^mwwG&V$}E1^0sif_=!hJ7H1LKlr$uq$b) zASB^iILwPM1b;N$)&>S2`b*Y9^gs2ei;G^YK{LXdej_Z z6Q;kJU;jZp4+|p;0n>lqefod6F0s9AZ~3Ea}%y$ zCBHU7V}Ubh41ocwx6Yz~E&9xLi=ULd8YM!z62OD^PDc=LJM8l-@U2Gkv|2w=ng~@U z36icnOcMsm+CJ}q?_&poC&L?;dCndkxH>Zn7XcL(>^<)O*ZU9m9FuKwtzqI6CNcQ> z#E22_L=>urNnZQ%yhF)p4)AM!@-q8LJz0>)s9j_t=WnIYUu&gG1}-oQJ9y4^*Oue4 zfAUe)Y0a9LgTJn;UD}qBu3%yjo5Z=MhSG@WU{^z3n$l;UWIw7Lo&L?x|62F++nq~N zM%E^drhx7K04VI&h596YHFBi^sdN3d@{5D-hMn;p6eds__wv4wUmn|J8@lFzG!S>t z*4Hz7afxlYoVKG8ZP*@3*mXQrkt#n^%TB-zCPHSi7Z@~qz(*9Nh8Wr!+Uuu z(?{{_bZTg9mHxY;Y{rVG%fl_V(JcGAr-uvo@jcQvcq)qC?f6^0!`jIA-@UIua@^e>yzcKG?pF_X!KU|t=)cc$uyUrx6&Q+}IrHu?+F&o=WqP@IwA?>0 zxX=S+ptl~gC6P=hy&n!8uW;0(RV%%DH}dd{5X+sRb5$$XGBSj(!riaeQED3Y;kYWp z+^=n}x3OeSWKvCG!PAyAy)~EGMQ{4Q*x#?Nl50O(9$qh&#um_U-@7D#ZMk?#ZC{*r zZz#wtAFCy;F={Y;+aXaaONmN6)N^6>`i=S5eoS}=k0d&T*Its8(<@RlhBg_w>8)?M z>?9d!R52U1s$mBY`TH@oDqO$SX>BB6n|@O!E{Izp`qa8N(piH=j)HN2;SQSmR!U8{ zjhN$;q-{jVm&q|dhsAb=iS+YXsMll7tMn(KDp*#c3nO;eCzqWcIy4+TYTVfp=Hg@4 znmu%UsYz%9ny`dYxJif8KYG(F!s<^s&7^h}*sa4_Hm2~FC&uy|>T)31=}a$n+hiCp zv?^X16er#3-W*jZ^q79aWL;rgJeoaUoWW&Xk)K$M*7158K(k|h-PZ9CjGcSFBqte7 zAM^!%Z`YgFMVs)XZuvp{3!&81I|h*(`CQhFQjN24C!N*E)cu}h{ktYg4HT9@L*~T-k($hS1is z+I#CXVn@p2I*NiQXd1FhMxJatDL-bO-w>8ChMf2FNGji2hjm;V2{z_ccRMYgIyUs0 zgB)hL%r-D(Ww?P!6H5T%WNDr>Bz&y$o}%?NYP;aH>11{2j--WF4RpFF6WO--5>YZhEF_O>_xxFEdQv1|;%vhq*DXf}2hL~}#V^py4dBO*KcC)>tSp8V95W;sA zEXT;y;|E|!#!F&W<+)j(En*okRZrQtxQ@`st$6f@S24q(%9Ru9hWHpstkPk0)JtQ9 zjE5UPCRu^YFJ>8pZMStJItqrUaOURPrIF+Mv5itv3~*syW{j-rg% zZShbi*1@H5P{FDgIIdC3rVP2KeKQXKRL2$GB|q#E%hpw^%)1|lEU$nWCW8rFqU$KW zrjT4G%hhDq23@ADFAME88!<$N)@E!2O!ZX&Ma;ktS|SzI6L!bAFxDtAkLYlaZ33cw zjxMG#FJ~@-*v|Xa9;Jpb+6OWe&VtKVv%W;4Xt5E5T-a#txxsJpi;&F%4RaLtb8ZO1 zY?STQZNexIH~mEQ_2d2E`$?7d)0{sls%RLnxUun4I+hXZjUF0`2bx+^fY|0mD<(j{ zE~E^=l*ndIiIr8KlA0upViw2_R~Jmf4-}29J|4bQuN0CZG-@S135Bh7mOEE}a6lLD zRfkTfXXKS1kNsdQ+l9`lF-ztyMe0L0P6897m_fNy0p%n)uBJ37koqOYD8TTl#FnaM zLI(RSuO^n86|u2NcV4UmuZy_4AC9)dpr}|KAzzLcPiD*8-tZGMMGQh(?d4;LT_Aay z$RvoAgbfVl6!Q3d9$D76Zs@)a$_%lBZ+)fpM~SU+&^9v?x^lJBuFTX~>Yfxrz|co@ z=Je!|>6oL3nTt`Qm1-rfCZ(aV6zyzc6P9>_)ZK)NUgH**G;6S|x0)l8ly7^cga^8Z zri{|GCK`LxO6+2xa>G&XK#b0(CKjnXGG7jzrk{h?22v2kc^h1k&fX^u?b%)nSGX7A zfaOh;cuUfv{J4@+!+}d%2uVkYl`i@(u;tiw#3$ zHFu0Q4552FT1^C>F3ZF<7c?hQO<7a#x}dLnBdl$jwq=Ab{8ra$szKz-RWZznVqU@& z_rTZ3+j~$iW>{-~I}C=`aIgb#Tb$kEI1Dk^byajCu(@;Zr)s)f1N5?Bs^%~;OVPvX z5JeB6HOJ^yZNdqtFx6q|5ZAk(??E-OM=hEdRZ4XY7Qm`>w}9G!k@hgefM~}Xz**2^$E{#RI+ znqOZbUA5|h0#Zc9Q2hoX% zofZ21Eg!*VN0#4Z9QZ3Zm@MM=!(ar6{O<+4!wlb3DPhWEz#@)egkvM(8h627Ab>(T z)$6UF-?=psLt_J z#FH=9wL_UK;@^cMsLFE3N7RygLS<^G?Ro~u_j+m6Jq(o}<-y^%3~|BD-h2(_lRB2GaDr~3 zr=lNBP4w2CnHq&Dm8b2jO6g+JRvT+%{D3O+0i1F`WS77Nl3!n_LlB02uulsePldW8 zN~n+&4zGkwx&4FA#cLi%jir47s;_? zV2<2yleqz}fPB$$*_0aIqnS9W4z>0PQ9HcvgxPn-&Dsk6h&u@)x&x2s545`0BbgA- z!!s;iRM9*OR!pqyk+mGCcA&WvDZ@?e%`XJE?@XL!5H3kTpqGmb$+Gkw zt@-T=;x46IE|vob{Jt|;mQchlmH&4&4q*=Ls0WmG3k|tE7Xz43{w?^ZR@C-T%Lv7m z889*bE3jtOYUjCHkh2wchZ|N%{!A6g$D|K~RCS{l1s@6bYnL+k6XfP0nmCVH!F}oK zbp!^H6(0Dx1J}_LvPaGq2DGwK3q6aZ}66V{?#ad-q z+F+fwLHFWo0~5i!=_Q9te5K&f@?_wNhB}SHd&MhwCdbHpIH0) z{^?S|0GndixnIWcfI!HwE1dD$ASYwp}Fm<#*d9+(T~+-We!Wh@YQ ziqsq-^Ur-@xO4|YIaaAk6)#8iKwl)}=0abjxeG97Q$l>M7=P?Bx-}spO;K`L)x5=)mc7$OmTJ1!GrWNZuWnipNDuUg1 zd39TE;^y;EuzmOaE;(%3srSigeVPjyR%O#d#o2XQ#mNHg?d}dEWu~U3NrB?vo`vNw z{1DfPU*7?2eadrOuIyE&v%Wjm6mr{epx8&jq zHTI}V<1SC1v`gj%9Bm4&OB}K;oigs6fimtCdY_=4Y1i!Y!3VegcjhNkYi4_^Iq%;N zbX^Gc$;WS*1YvdOJuuH(OcyeH;bQH2Yr(uqNIz0n;>IgZy`QErF5 zpr=sogfSA5PK+4N4y4dsruDk3bI)nlz;$p7%WTis*FkOyl>P?8hJ|8Y5R~I-IuIUo zncdM#Mn8){n!!9<3KMiL2qs^DS@|i*v{KD0!TI*w zNv=08(h8z9YU(JCgGYvN_Vn|;EE<-)qi8N=cDLiu*HfQJADB|v>d6V_abbT}R7w2JpSvPmpml3W zVwSt%D(Zbd?{bZVu`FS?pUE=O)g!WX;?bu4dO>Ge@_7mO-sL5}?01L{J=;vbxyOB> z9s4tV_RsEd*#Uc(e!az2R(@M!KnR)M3eBb)!dH{w=wx)h_FSmFxmUmpb@;}Xg8;eZ zmEUVe1tfwzP=CJJ&xl;n$d7E!KKGAfxV1H4uKO07gIAsl_mvtNB~ z*b0fSF9^Rz@vS9t6&K0U$4M2-;!(>h7qzuyMO>o|ql>Y$6d^iaYR8+np5a30shR zZd4``%Wk&<%cXSm z<|5rt^UVe1cG+ZX@$5pb1{Ge^IJ(`vO>%AY2#F!sUej2p=$D6Y26DmavNL492So`P zP+JXaRv`{zFvvwa+6M4)v}c?UAx!I`VLbvx}?({Z#-SwnQHu0a~Dw^GvqG%cN&{81fR+9m{d#tSa-sI`4~B zmxY&VA?pUq>P`fYvjFY4Ug^!B&LxJUE$d92zd9(TDr2vrVjin(k(U8hRwPqr-YDi8 zp&2ko90+fIy0p%8#y?tDnYh+?tb1~vSag0KpDN53U=LVN7&m&N3C#mv=Xqv2dYpM~ z@G&h3ul|iC{YpFe&n$@(KsEF?OHz@jp<#zyS)gos&z00`o8ipS=KAUTJdoh^C)My- zK}iCMkU>PmZrx~e;B4@yu6JLf2xtUX&(DNn@R5+<)r9@qZL>~%EHym`M?oo2(HZ+p zdT#Z)Ba@RCGWy7u;+6TZ(V>uRj}0u+F&b(wLG8>m?Bn5>%P+&U_D0$Z~;TuZ|;Of`hUl-D$~+2fXjK$(aBLZ=6w=O7nUI&8%Xw8s%x4u0n~|OBeKuFEc3Uh=^tq zS6F5o9SMKem;{PMvMHi{&uPrjeOX4*I~kzsrd8MpH)8bx1I^RL8E*YUT9krXVnD}T z8#@O#xS;jCWufn?r*;Z?v-^UuSIaRG+D5S?QhDc+g!+jimOUhg8kqfzX0x+2teP7n z?oCXA8DbuLFp-t|`!hYeR<(X%#}b1KU1ik|CrW(lVh)MfesUF?%G*NrdLK!z(OaeS zEHZmjf#0Hi5;V?(vPHtb3e$SdDad^ zEe4VgK_r#Y1QX_1fkgN8CW;2UdQ%1heUksa)t87-JQMNNk;grqd1jGdnb! zz#^0+4H<)KOVn*%{k)kX(Q+aVD*J0oMb!yi7aK|CK~pK_Ptx*q zj+Z-Ey)0>OwKSqK$&hWi?c;$m#*B=uk`KJrAPMc72Qm;-OKxU+TWMQ_cUaQyGyxs} zebV62=DLK=7qJzvxB5-CQHh`w_(9!VbH|eF$uYy)n2}?2b6Z@asx@uOWka<+Y2w9* zRKHbghYM%7C};nzS*^~K+fAjp`)+&cx6@9Td1rE(qObi3*Md5a(=AA(7xQNDm9Xw? zjKpAm`*Tt)_Gl|tWZeEyPgKTQT`)V-YcAHK?wM%~=}aZKLX4Yj+;8g5Rc=6B2l<0@ zw*$^1K**?DzLpi`v@D&mEP{Je2+e_`n}FNN$#U|Qk}#aAr-5_pmz~wJuWP@a!1&Pb zDyBC(#n^!T!5$Bwkruy_5^7R#LaZu~-gJdFsc*buM-{YmuTtdj6d*86fNE2Vy!r@r z!Tl9LMl}R#qwbVB+e{`wsypU&L;1N46ySPu7CRNk8~&IevS(ymxzcd-i?? zDXjh!`Wx$h*~0msStptPfd)!B`mJ?81El{gFBnD@*zUpAqw<`H`**7VJ7lMLJ-^Wb zenUve*z8ya5F{o7Pk9H?eM$HZ(qM)!E!VSMqsL#udPXhtsV|$DEfnuqOxEb~QCeED z(yr~um$pRbnZL}CsRL=zkIZ>5iSiic2cTAH8Zbg4R80Tx-`3D8Wb(9}>zVK$k7zSJ49 z!i0!@wudsVm0WpE_J|i{f)eIDvjTGc74!Jn4FngF{^V~u>es@?f93|6n19fWIXK!I z=~+R$rb)|lM}RRx9yvhMML~iPZu4B#E$QDppM;PwyQf!MUV)?qL*Xdtl?3xk;l~BA z-QS`v#h*6HS(lW2=p@#Vg*H7sO=fnKXM)fMJJuv5tQ@)yqBh({^dfUCC{1!H$yhCW zu*XzB8u=n>d=oWH%f=$%bJHB67s#z_^I5zQ4<*)J?gnY(=?s}n$v3JuJ&}EeVG9<^ z>r+`L1zSv3X>U+`nh6q0$X$sCANIh?Lp}&D#5!0@Y#B3fwPm1(ki(BX9gF^FaXd!P>(^xywB*-wu9wl0NEh`s>%Sqkq<4?0}+!UzZILWr-R?Ldca4 zMOz^1q`)gBv4MAwpT0MM%$DF%T1?aeHmBJF)8lsYX5JlY%g$upr>gYg*nQb4J(H4yG|L_sKk4%mY1=ShNE3Wbtv2?KUyfdAbD*Cll~B1O%Bqs|P%R z)Na+Kv%S3wDm8S_?->Nml+`V0hhb?_T)UhIB5LEjZrj+~RP2M-wfE6-{ymqb_Jr3! zb1;YTAnr0NmCUtxxL3Q0G0X+DGA zET(YE3D$ovn~t57bR?P(nYQVF9+a1V;myI_CN_o?HrjGtQR@|NoMpOIq=nPd;+DK< zDnH=PSFyf(kWRo;T{z{8dIG-F9E)JxZ+kwHO{UV6S^z6sYPBx;81^awTOh~;++T+3 zo^66CXT-<&p5hs09y^|w(cmbaGJCR*qKkZ*QL9Xf?Kg@7eh_Y zLrZDpoj%xz9sP)`hhdNE!l)HY(f+dCY@s^sR-0EsMwQe9)_krQmN$MbEmlAuw?}u@ zs(jt`AykSs)RI9Vb=`f?=tPZ0coxoNy)Fj--4lG!`rh9C!y`ogux`|E4CL3+pnql{ zOaNx+UkyY%YSp}#05RaqE2Md)U2Rl08&#NMk!CxGk7X6Y)+q*hjG|v_`y`ZXRgfMv z@P2&s;=F*{#gO>?_KRaA68KxPFUJX4NY)%0`bJ>=hfS*Y^RbspS9OnYkl*Z-<!m1_qO4_=kp6ZqTOOW;`SDfB;$-^8=O@$dO6LTz!M)SW<3J$yA)Q?!#pq#EU^FOH!? z$<%y@TAX_GVNhufwdgU!j zf0B5Yp!;ePQqJCeTTW$Nfr}NB1TmdRC;lCWsGiyc$|kY7ab9=J(sp%3rC!um%&Aa4 zytg5K@^Bf>4hRbCrAtCNtj}JwzDa+$Thj~Tk z;X_j1$xC%r}Fw4G2TU8)q1xVOPbcx-Lr)7&C_r-!x+pkljVdTCJB#N=$J6sYa14bjap z^+0EqhEB>2k!WvT+buVmVeQVpTGIG}atq!-DQc9S(z1}t_pvD2p{PMjxV0;yLu+3$ zjgktHOETSv+KHS=1U8j|gvtXAn!ba_y#OO7a|VCOyL&zwuEW8wP+>hWq7V3O7exk6 z;RPO9U{>FV^@~`I53F0Npty%0l;2{d#Qp$ zr9Q@@fE0~GrZ|es`J8c<+Yh9u_zBo&gYo@(4-3R&o24*%Kc2C1;GFTpFkPFIYvhB- z#=|8&Z^w=GnRFg}@PZOA)TyEx&GZ(i7+VRf4qUwb_^8u44k$nQW5~T;Dv`94D+Jd2 zOHp(QFtfPc8@&b~4LtNdc2mACWx+U92=+R;!`KWPLAKpU^oE|^>^7==x8z9CkQ96~ z2h@Znt6|`^x01+^RG`bi6ZJ`mFk)#YH(a6$x%k0YunZISV#ED|+B@XXZuTwO4SDsk z_1Q5Vnh`nGpM^~ONt)pfAKpLOjGdJ)@Ud1Tz*=i_0v zjz~@L-R00Sd(Ly;Kl8kBaTt|xTN#4kG}`H9?UdvR8HS55_6ivW2^djb5hk*MlNmS$ z2#4Y}IGz(Gj-nGUj#?STZqod?;xhN@eWtqZ_M6o*xhgFs6MEjz8-GPV>}OS zyof)5|2W-O>c{aiE$Tk)c#Hpe1f9Nj?pqi61lj1+;Ku}Njk07LN@fG$rr4$<5Z%e} zH9oWLO9)SkgpiI#_Pab=6y7$aZCw-Rh%Pigg%&~`Dw!HfU#zvguTn>3E8Y_`DD3Lq zwc4$smLwTL_wp*Uj-hAM*c4jj%kOx)6Zcs=_TJnko;~+G8Q$LTZ<3^vU)q}_l?gFyN z%1`y0X*a0)=Fo{5SeLUvcwR_Y1KHg zFryaTCKoE+ba?8iFA2ppAaZk*V2`kKrKOC%6m0y zxFQ$i7hd&zb?s32;z9MnJ%Y}np)fr7AcBq6K|c;PnDHRpdiECOeciL7h49%PL9Lr+ zua2fx$cNL#MbsR}#EFPST3f zK_Wb~_B*`Afww>+a++k)R%8ZJGr2$ohVn;&uZL&{C~K^>qg}T~&(Spo&Ds*&%F!;Q z)CfJKCzLm*y@ZVPk0h2{m+m{?MP+5Fl!U0HV|DD8l3O>G9yiEX95dcIolc;M2&UV7 zQ0=fCdT^%O%bXu|CdBWFHt6Xq#Jb{N2R#;^2S33~`zjM8l{?hqPbop0sXnWN&0^kT zqdpN(|J0(1I2Gb};wtFI;E;0{we{&U;@r2KSs&wUk?WVWHXh>Tyh2gFZO4{k`)Foc z8sQr1#+CEY4C!ud$FI(Xp4F5BQD@L!3WC0W;|ERjc z;WG2`^a#OZYV!+4wI8zRe`V?c_-Fk&0FeD`-bDw~aY*TC3EyKqI0)A(D-Xr)hy}0? zimEUS7GjBV=wFL&E(pLOz8v@1JP2)NXFXyJi$=DT!0;HOnLyq(gyh8J>iYO@&&oS{ z^4OH{eJgv@P=c9dGki93?rr{O8FuPs_LlJp)NT*^1TOgImYHKzLC(Hg0U|qLNcFrt zTtP49ZzBkZ5k`j^dFN%RZ-eI+iE^fAV(G$y5h^qn=2-VgX`besH~u9 z*>p;QkVIo9CWPdHljsa-b|9|=)M%@AdaBnsh6GC5LVp=#W&>QB4pX*)V!}si+#!7W+P}``Q0xTDJ3~7 z9UfjRWGBux%6d-w817!Jrt}7=LIRYr0wR$m+OZk9Xn+VwiY^yP$9|9O*@`W`sFBNo^f?OOPO<> zKSe15?E$H(C$F}cPS`iX_pd_cFD|JQjvO>+0V9Lc)l^iF#7%T{0*@;KvDUAw-W?xs zc3T12fEHVsJ$&g0h<9THvEH2Ci`Ybawgvcv`k;N<1IjmwUD6P)pm~79F9$bO5oue* z;0>(+iX7j@p;YIf;dPsW!8fA)qyn@a3j(Js%LRwKxVk5cV{AYJv#!gJxC^qZE$s^g z0{>xi%$%i401UmT$C_VgQ6U-k>8P@vq_yWWlZZ%jyHyoxhs4E*0&gIr5L$b&XRDS+ z=hX+hmSo(HN8QCYTUfrhTK=vZdW$fK2uihO_y?#m69YC5*p-12e0y=uX%{T1$SBtk)%1 z?%5JEd{iQSe)v3wc3m0!kY+OGl;uJek9i zc#*E+d{7&_3QYJ@GIZz$hT zJXMZ_;ZCOea!@iruugzB7qxgzBfQLP9#6^abT-Mk!Ug6T1?zELK-t*9IQ`Jhnn#a6 z_4?>uv%wL!;97Qh>6A8sS=1nUe4ECniXdr5;_c>K zO@17_ppj{|*?dG%+pDKS4J>3fcLrdO~`7}`>BK@s?DS9YwBgTNeasc>4PnuYah z$)c@-c(W09+AtAz&noK{qc@%+Hv zH_LjDbsuVTyTW=K{Ib0zeQ`KC$L=NTZRP@|?Uk9y%|3IdDfRKff5|6&mx$nPV~-YQl(=>rQ%W%r2$ZQ zw`}*g>nhc+m#%4w@LW>nCSQU|SxQR9OG`;t7Sgkqr`g^jTc&8~sAw=ACZ(Gw`#1>C zNCEp83EesNupVP6bn+Bfp67=a^lXLqqM$~!(64y~a4qiCFO{P@7z?|rn}}{#mb3 zkhpOlQ;H;~M00{ToC!sN8LhTkT4_)oZ=?iv@XeAcc?hwy_MXkG8-Y%iq2eGxa#=Os zWZqVIwOxM!@qwm{p?n(7Q>&_^u*5VhL=3GI0D#SM4~ z7-oLq*pIi2H=L@v0`JwnSTT_#EW2k{rWwt#fMe{ziCQ7{wgK*bpmG2%`6^6$BsuhR z1j=x>(frQjq^(bu|Er)^G_y)rlEWlaw%Eb)+mQ4$rJTs(vZ9D-t^ACXxVoH%nC_nKT&2#Ob|&C;ePuURPK7N?s4R?3@@=&pC!XF)oWd z*0ATXV=MfzmiLV@vbJUkT0F`C&M;}RPDv$dl8>F2tWKO}uO$l1M$mv#d4E+FS}0gy&~>^&}wViHgEC z2G%#mQ(GQkgsfr{bf_3ZlpXGTU1a|}Fu?Z)WF%w#TE{>bj^mAS%DyrA2{L&<`z->} zGAe0n0T9x%{hcCdbLzy0FA>(zjKs1Pc0)zt{Pwzh>5<%Bz2eVFgZY^(c>0RdizT_{ zpVIi#8K6`Y*)<7N{Gp)PNSh1t4MhqOh-@7(-gSkL$Eu$!Lx0J1gf=1VzsjHH#H>~yTqi1V5BK7h%Qg@1U?e$d+ zE9{@Sk{fBxV0zu#VnSz1T`t+kaoNVlIc|?nD1k~I!!|ylEi?h=u!KDFo-2=?Vh*C{ z>*9>l=TnZ8Nl&Akv{I8~G}KFbveQH}FRQ9|hlhJ$(HcNzPeN;3l zG{9j|_L!x9i-MD+X$7t8dNe|FF4!u*G+GqYqHVVz#`ga4CdF6B z=IB;;1r$JG4s=OAF`?#~?Tk}b#yTPrLw`>R^0jmjH zQBKQ#ql|PrYkguF(5-E=j&2M|Dk*DnlLPyf;0LDVM&jR+anIPa(s+dg-_E{gk%A-MXfsPKI|5bj3>p`vm% zMP=hF^^TscIxS_D#u+1Sl6uWW`gmRvXP-u4stzW}TO@pa;YZLei%sGDE*J>wK(r=` z0wTJ_7&8{5hymQ>*B)R-i1c+Zfd-=_29e$e62%WWb~Hau^Yuy+8*Pm7_AX4#&%?;sIy?XrMB zUTpDL%JcB?JUHaMJ?3qh?(}##(Q0$HLEBqdo>%28qgQn~cuI9hGdJH|RhI}^yWLu{ z=~(i)whx)N;<#vAd%o*neR$w?!Mi)C%!}qdN56r-9zP+H;i`qlHs9O>Q(F#mgy}-> zNiw4Q4CJ9*ss>wtd56v1z4y7us+W;0)^KBcB4Z|Qhhkt8!qrAB3E$_wsng3g^X%Zx z01MCEaVWsU`Nnpv$GMMX97=UI}7ZyxfsaSfK)85s*f z(AK0>F8&#~0F)nxKy}w%%@>Osw+Si!b@A#3V^bs1lNC#W zC7rys*KuCy*CSOZ2$Gx15nq^uF#RMQ#7FzF8NrGY7zi0DDYamYFd&KO^goH94j#3Z zmDlncO=(IYNnGip+hho9S7@dh4io257R@}Y3$(QvS9B^o=?P~YZ|&*uYOGvPIz5q9 z`iu+`X((4|zf_D?p3*d(_H*eBz}-4~%{n9DkRnx;gJ4adK>GtmJ6-_22{NQx*5d}N-2)?QjN4PxY9A`~zMJdH zA}1~rx7EY#-Q4qe-bfpIg~tZ#7`MgK(duc*3TK-Nm5zss$1c*?OU6o*Pl7Ht44jZJ zomiC-Dk()*g+6LuL5%1E%WGwR*aFpx1Z%n&9G)!Jvhw~ip)AV^Kii7h86|P;GS(1= z0a0W7Z$t2!)?2gO58?C1*6)OmM3AT*V?As3`kVZC@9&23&Ro#bYH70`3Sk3VZ`t+o z=OYnK<;Cl2kGm{c46$IZEsc~yn>^0k+D}!QdqF>H0!Y3zc9W<_aYV~?oc$B-_ zXsVpbJR}nV5z8f$oCPLPa84E$)2n3J7rh*$WPY##Qjpc&MrbtKm7-j_Y3j zrid7qZ&#h(0LXp2j91m&@Zov0>npTLv{lE=2@Y?^LnbcA3|{yINNJu?JbSrhx33C-Z>@%_QXL zA|@J$X_A!ZC)<4!lL1He4?e2R2%MPVz3$rCl9hh5W^YaK@R37T5H=JU-1z9w zLm_y11Iq=W;yM($w3iwwP1Yb!glZn*4BoOWWAeV857LMU;#$rDtE~Vxz}02IsAxB6 z{tUze&zuv%RSW6nR$}a6E!A%+wqx^wg+9Oh~E4yfZ! zn&3GVX)|qx5cODmuw7+$0lAukHMWTQX^fS}*kGhv8)1#tsZQ(VTlYhZi`|D=YsT@u zvB%nyQaU(Hp{@bJJQ`k;XrAYI0d7rgvC?7Pf{WDh z$)Y%f>_QCTm(TbUxUnqZOcMFcAGhnHbmTIVv$vm>H3@D#Lp9i9xAzq`DYK-2%+|{8 zWP->=^I8Vqf(e*oj@bn>@vI~arotxFbqTI9%FPSbNhz8U4hXU!L6UM9wNIvub=5^0b$4tZU!?m7PK+jgx$jrnPV7AQ$ zu;ON8`))t_-FWf4|28!PJw3pln~4tKJ`eB=G;#QDRrr%9Dm60`BMmzfGk{A(%}Do~ zQ$0Yunvss4hLxEWAX?AP$_{u>I)DM-cLfoE`YnJ#U<7c31|%tds7rr8B&}x!@ICx@ zqAeU%|}*a1AkQW1AnAh%)wuM)u#0oyq=i3?Tn*e`sO`AWpgAlko$tVgxv% z;ACrSX=L@i&%Psg0NMXvy8#HQ-~+5+f9r~$Zuq;;_K*JfH{Vyl`QQ8IyKp$e&z};Y z9{j^oS_7Z;hYJxMJ_9Q&4I3lF57}Tg!2j6T*l7SN!T{|OEqr=*fJ87pGcyYfz-63~ z2_IlEpn=c8zyNpwEBp6n@+ZaTA7%%C3F!sg?$0o#R_u^@ARTh>jayh8%t<1wmdz*8T*a3Xxwb7YeQ~Yr1x-P z(FS|m6@hAuU$4*g+vNP5G2eQEb15=r)swwD@|8~ao<5@fCYdCWNKm{Lacl2oKLbHv zKLO=X?Jx%Bm5hvl^3p(6uiPbjh~#_KZNV`=8bLd;1Y|+6@yToweu)6*mN(o5(+*|0 zPuGhg;qU79g~!w^C-`+jw4_!(#MC*Mami9{C_in<0ak{a=Z@Ot0cr4hZ>8yns+*sc7K_w1fqW= z3I%8L#0IW!TCH!wN-+W5@9?YVwRLlaAHQZbNPUu1`T*N{Ky+-}1#uoZd=+f$liz{n z_{FK$EE*B9o}Hx5M$kOoq>aC%WA5lSX00Vhfe}~j67>Q;-wIu*6TIqh?3_?mWfdd>D`(+{{U@H55BLRgYJh}KP&VtLu~zf z0mb+$kBWZuI8m_=lX+B*y(IZe;P}=`82FAh^$lCEsh#L@PwYj8?)-#-@}wY|tIBm< zK#@GcC*T%sNA+NW+#^lCcFK*q z1mbP<0TfF?*1iD4!;+ki(0CL=YP6;rq#jya@hxG@8QMIl?h{{e! zK1_|FK8*M{pOp2NZ24Nd_-)xaEK;BWn$V=g8I6Vu=1b5*}+&&=WdI<`ey1h>2 zF*a5+Igr8TBLfK_?YbdQwDLibJ2Kr<@h@2jLV$GbNG1PydXP;cC=uhflICXAy(BRfbVek5OPhsOd>w=0&L4{ApgJ9Ldop@JLFRj3-@kz{v)_K{9%6uAozQgjP`+9d| zAKASnT|m>7SK(-rwpU)F1*ePCOtuo<$7t!Jh|H{=-U_P79+pMOxE7mQbcC$P{EK4I zq=iY*R}=DhY6CLnyMlxG-DuES!C)0`v|0|cA8d!-`LfpGANCL!sn zgd~G-A<>q5qPasTo!ZuTFOl*Uv2VNGzF5SF)auZuB%zPK5?c{**>r{$GQPd07=h8I z{5FT)oj7;${rSlW{^#ZQwPL$oL?IEHFjsZ_^^lrK_=eU|cRnH=@+jIN!&AXA$ik(k zD`WogqR>*8lVeZz`5P^K<7yk_9WF&sJ}$GgAsej{@Zkb{<%sG6P}?iI=o``w>2!ri zY{>*lI`vswaq$^04LV18R6?E|60)P&73@nySr>y}${&>V+chj9k#4g3Zl3S}r4n47 zSw5#yoG|}9lz-Sp{gwIg?>eZz>!ALwgZlrh4(f*w++X>2|6Shmy_e{JxLEzA{sKhP zKQHWBF=N(&_z1nH7sw9F+?ISd6^3qRb@{>o(ZH;Mai68GOE?!QUg|8*qpA2x)4W$Ix72(ABVA0#^j zAaNtKA5vbYVEZEr+@6Lj#=nDaqibV48a~(7VG06y zBoZ;H{)FCdqPdxd^Tk&I-}&Sdgo^WYYr2(w`y5&w^(zx814DU`GntGp^5@_oXm}7@ z49}U|yL?F4)*b8&*0Tv8?Sv`tQ{>m}4BLGg4n{^_w+~1!5+%wuPF1k_L{w1|IKpQ6 ztTgZ2iOuRYG7-eTBa4|U(-(bSvsQu0Yg-!5cU8s@+Rwyv$x>F5x~|@u&4?8bU!$7d z@;m#MgRG!5a}RvmX?6394bRUd^a6k+3?QrH07#|$X2DD=Wn^fk_YaADb~-@TjGmpH z4WF5wj)t9?o&AR;qpY6&_hb+Y^KUZsfRvGgjg!5Bk;9Lyl8~#Th=QY@qtTC+2teGI zk>&Td7oqw72@BBmU^~KS~K00olHvzsHHOr{W-T2tA!^MJZ@!Cyy7#&sv1odBm1zKau9nUF@zroa$d3?dZtg278P z2e(NTCxN6#%dT{E@SM109dbwX&6qoLhQP!RIPySGu_!`2i$WbcWasU?|Ag=wcF_tw zPbS+7G9xeDq7*pC%fDvTQ5D{}c-kP-CB=ZcvZQENsAd;V0$E9N+2CM?JQttzxMmAc zA?l>^h+FuCu9qsTyU17TO>PQUY|zW-`4VQ1wDbf+Zokjy96{>{IP+Vf#*N%*H+4mU z?X)m>^yxuZSm4(s62tGBSzVOF=hN* zB>&T}`&V}}7=iNVLw>dXTnF_JnYQYU%v!W0-xYojXjj%a|}SVK+BRW|`Vg5nR!2<|+c{ zLUOYxiGG_EK?2P&R9Ufn-Nx0aLg?fsN%?%uadN93S)`Z|w!IK6l%I^Pa$d9zEn;ZK z!8l~6lrF)Ok>5r9;yM1D2l(kZ{_D9J{JDs9MsY~Giw~y#f$|YlY<5+|rGV^>SbCU1 ztnX6*Aq4@7Ao)vlcCw%$aT3xp;n?C9#*!O}Mz}kR&&7tfgJ zY0Nx44py4ZPN_#v*a`j_*`^Eb7x1GU%zny{V<&!72sdllJ zFmVFo0DKMNYY_;<1WKo2o=dWTaqyLYDQ~=wQKWjZ6tF75Av%q-Y=;ZWSeR3qeiswVXZ)pSbFr8q5sITHr0>hbg zl$z4>dB$HzqJBVTA3)g`z{++~P0j6(#v@mc+q@O=1^U*8{RGh9PCxU!D!H2^3pLy< z-8lHF5J33Y&WU#1^<-7Yp|W{xf%J?A$*&r{`P|xKw#uTDtH>T57lBWVr?jHOdg_DZ zGB$76aCck9#-ZM!{!)X89~CXbdf36~6Vma)79_T!dbVMyd{vW&OLJ{4^h(IR{l3*b zfQ)9gYO7PH>LhK3eG(wVMO&*7H$g>A9}_dE3db@Q6!5g9a%g;Yf3ecj_0&`rvMqGf z?%HahY*GxSR?}uy-2(vy4bp+qCNqM#Q8WKElO3yW!G|Qd@I)S!V6h|4aqb)VVcA-v zC8-w#|4#ZOPO}aeY-M1Cbg+UL7D%jvJ6xYu4Vdv^v65vFvfv!N*gXF*QqGWIVbc-0 zPBGAzBa|SlsZCh^{pRiI{&UIMbK|y4+C2_KC*x~EoTsSebo42tA`y@h#ugd7+;!SH z4;Zq+NI^s6fEJ&MOJ^$F`t-A|hq+Wg#}nKBtv09tfSw%a0UM(L(*o)LKaj z<|}W$lsN?uFVK6W?Cphv(D^d}^MfdUqs-4zj0CeLWv13B^vyoH6ES$(6zai&!>LQ|W5n zgNM+|5A<_P)(bmD zm-DdF(csnq==jpQY{{xt=_=gCqD`4KST7bPEcqGJk2=u za}!SN+AW?IoCiPkVWAQp3W^ZFeIzk2u_F2mM>#(XAnko?@W3EWLK4y-?jY8&x>rFr zul62mI7>?+gOE@%IOQ|5>c_=+wRMY%M%lVHxFVruC~r<=fj0%A%~4upKSJqJ9jjZZ zN+rsn+*&sKPliZP!wQ>1@?*&aqQ?1z z@=32Op4F(iW5ltSt)v`6(o1rV+sy0}=$Am^uAqe1F^VUbbgrPV>-O-~#0GnoY*;A; zcG$twsR{U$R_NEMfJ*ev1Ma9o#xDPR8cbkLQUwJ%9wNOZxpHC9b&q)?s%4s*H{&29 z_L34skTF_2vJe@VtsFVkLv(rhP)_qyM-zn#`SKs%_U+wyr)YncuOeYBbi~kt4>BFb zC%N-us}kg07GTyErih}t^IHEVCbYJu&11nvXS}BNsr1MLou@)u+!N(nnxw`%83p+D zK9WjTO4{kdx58gPZLK4e`4)-qPFJMf-qEF;`e!=TxIJ>NOHRo5Dd_cC>8I(k3g{p< zs>V!t-;I4!GkeXLP;|yzJ3@uL{{jDULxD(eqRnA~r&}hh`yhQ2;!@j^r>{u@k1}@r zdL;Hd+h8RfGSB!pU^nGtyYS#d@}8nDFLbile|D?+ z2{rgV^8Nn{HJ}5)4nNqSfSCQSVF1b_*ChcN)40W+ZW zJ9`$;0B_J19q@IU5^$N+%5 zenuC9;+Dig=@Ehf+0qM;4<7_bAylCn+o-h_Wp7|9Py;Du@1OPSV%1eTpz(NL2nNa& z4C(Rl$%-)E!ZU7wEp-T>!ujg+fSMD+yI9;p!gJ1*qd41Cwz#={ zh1|UmYH|$!%uE@&4jU}eS2TKD)PPjv?WfQSF}kb^%HBxe-=hkOvpT(mlIi^rxT z{D}76#?gKhSLF(~<&m?9fWz4{sdW-3cPp}F!)s>lg$7Z6efC-wh;5!CH_X>pAMXSl zs5gnjg&QOWzMr7@T?{;bMKwGV85saLK=}b2nEVbL5YOdGDI(_z5iD*R0W7w~(Ukel z0}1a;2%uWYTr-+;U8|7ULsY`yA)Ya0-!sCcC(Q(JC->36YS%gmTs7HBXGzoAg?Y_8 z&f%sKjmZ!1-GZdwD=*TWjZXp$qf(MCc~idtdkIN~JZAih@%3|3;-`7yUk*6d?F$qJ1cI~RMWpm-3>s`UdUA(4Edph>8_Z+IX&pLGol8fGV zr=ROq;GGyF7frm@EsdXnOjvA!nIeEK$1AEuUeLY%xflXw*p2~AS>S8|;mhC~|5r_g zwHwDU04d*!v(5BAsh7?&T`jr<;}Ew+H4A&@_;i>dL~4--@!Z6%8`z{o=lW&I%U9dC z!@tmU25e*gQN#2fA_t6sW#i{{c}Gpk2AdV8W2|btg|C75O6=2X-P4c>0e@oc>=smO z{dzuZ!>#KZv`NvliD7e-IlDyxt53L7Z^XEHc+BeKko#zXLAuB6FN^qNEWcbl?VVT@ z5yyq*1s6Sx;e?$%Ju6?rhlE%=m34PD(LDZ!8=TcVOm`f96fU#JCBfhqF_N+DC1dGFBbj(@Z#@6JCtp-)*jn2@+YTIh8zTAEfYeaCzg)&I%T4Qd}XHd$b_@v$p5#4u&aThme9(b3 zv?&gXfXHkG1ffKE$?Glo6HvS?E zhVUwzTrCL^1b0I{*G>P}_rsP@Le@~!)OA_%U?iBvr%qb%NrO=xhQ4y8F>NC)luFBi zhE#J;r3DZ`vQtrM!psBQ{ml;KJRPKq`NV4U5AU{i(=f#v+ZCjHU&--bv=>AAXD-Ad zD=<;$3v7ObYDu_0Q?tmmRH}V zhoC+`=0er9i4q{hs~y_8)Vo@3m|D>4>c}B9?Vb)PD9Pi{{u)=8}?*!hyPtgXz~rpafZUGM9f>YZP#EkAy8 zpyx0P`$T|kHI2o~*)?*uK$1v`7In*xQB_;0vN~m^A%md0t?hM!?i`H&I#asn{9VWg zXoZ&=6MT);uIx82vxTxKPPRHm2WS1O`k;m(rxi8_HR9|az9A&%7>v8Sxp5y<2T7BqTWLq5q*xjs@);&Xmc~O@Ne4Q&CS$O zcBfM)$nsyceOf!Aj)Sa-iK2!ws}D`qb1-lpbDD*&7e>!<^r0kmY7b!8h~rlm#M>K- z2nk_J_U&^R>zq!ziNL#wV4cdelbo!!7tX$^ahjbAP1Gcxu)PNDJ30=;Q#NO%$;A=m zfY}?co0ZTpbJ53>P_ScjxVp{S2`W9w`jXXZa?E$O_>tzCuOMBgtwn|<+(ejWyYY0}}F%Ihvws;lm1*bc4+qaqABb)c5 z8*_G+-$J&`YCT_C*h|1OkO|ORg2`QmVDti(Eu7pL8qmP~zO-2~!GOR!N4@;A>lXs^ zm8pYQkp+_`<26B&M5)3!lQv$M;;2gAQq-7$cnlSbvMyfJR zBBgBD0l)T&^^VYujT&G*kn4S&zZsOk_mdiA6q!@Ts85aWxjA#lkbkK&ZuQ=6JHb0> zx-$92lKpd1@ZS)D?}eH_!qdMIf&VIs0Ry0-7Qn#xJ?dwmqsRY#(3At+5-c&f>S@_6iq^a6g%)<%w1D97fV7ZnshToX_!Lm zx?W8J7y7-fa+B&xIaFbAL||t+Ks$hS5X#q$S{)>WU1FG2{;vH8>%asv!nGIT z3skk5#(pPS59ao7*n!__>iD~VMvi}*oqq8c|Ar1m#Jl(qK8`62LlZA7EUcWod!15G zj!RMe08afIsOaB8oC2>Y;|~2mfAKUdxhiT=lL?FU(OZeemL%!sZE2q9Hb-#vCI_j( zo!-zI-k6Aa<6xhQ`H8j;F700QQ_y$PL6ZgQ&QGKR!5^dp6U5QC=8-i3(m`syG&#vB z71k((b>ugHUlb575Go*SOB6XF0OVlYw23 zz_zV_kJ?6uxQ|_Z*fzzYVE8)#dVosXMaw4JS`8BS7I}adT5eqE^Hw)XkB3pLgKNXB z?Rpk)5Zl&xeK`wpCs!2tx>F01dsd{)qN#H#BmN`b;r5FA^lSICp$`a*NgRaW(DH9S z*(SCQILf52@MY0akNxvLzmj$6WM1 z=Xv4EI7x6j;WlnWUw?5&et_@l+gLdxQBS-e8+iTh+^*y)WFr}`dy17!&C2^lLQ|_k zyUJ(rHA0p4ish^bw-3acG@D<)vg)BQYgtn#53kQWZ|Iemo9At-dpOz2oXzHo4qj&P z49;ZDtCJVGjDJ7}@9)OhdOE#2aFuO%cvpB&Up!rD$n@WRGiEKfmV>O-zp?uii$_NF z`cnCb2UaEhn6l=t0anMN>Dz=sEc`mAyFxCEMh`@;9 zhG=IZjMtxN*ImhvNCZI}rpzS%4KC1%W~&#)mZx|VLe>UuKhx`OS~_v{71c>QF&~i1 zbs(&4auc<)B*}jDE}3LVDc&Xwy_;&fA6fMn94ZqXSf zl!rf7gGdH>VAI2s%w#3u0`VnglwuPE%Ti?>*NQO{vyhcbZtIEDkT~vk=?mKAqdgs?t2Br-P*x>W+qNjUt+=abdYTDis{$;hJc7HYJFW*1zLu zB+H*5)xLm_JkZ2br&K43p!04&g^*~TLeIH0jpbNvl4>><3*X-ggXn$QVw-DmKeRArsH`n2$ zE(g|mTbkhK#7uHbY)E74>D}+I#=NpxXe3Dq#vOsk#k@$rN{@ zQKD6mjs&{6L83%mh*p>_uqtiLk;iQ`%Y;*woMMJj8j{Qc**9ra&?FU!3%~QOl)O2H z^I-hkO7ggyOT+Qn;O%+9Vp&4&0n7ne_a2Jc1e=PE4w^;4SS2juN9mw*@6r)xnN#=e z{cZA_#g@&R`c`5|h?oe@b!`uL3LGpp8z<7p0|dnYKl$`~Y3Gvq8;)+fh5h4tAXMa! zi)Il0xLvdk_qhux&^MP~Yj5K4MvaO<*h-e~7*<(EPM1^UR};6vBR#3`Y@ZuWcp3EvQKBn=e!Xgg`=|BzS@q`R8y}y%= zfd3YbW_P!Jl?l|n>yWYXkQDq4jxMt!5dtTA6QZ}d_F8X8Rb(6PYkvak!=Zfq+ulMn zi|??6!YF3?NyXGWCWlc23K$Icndam4eI^j2wOeT;NC_*fSEk5?n>b=7vqB`}8mtfK z8fOC5FP4L!lZ`(i62FJee(NwZBmG@PE@1B4Z{1AOwsM0E9RP{jf?LKTJjCW!gr~1K=gV zBSXJKv3T;)188$lZfdXv#(P}gGS#B{@om+w$C(mn?teojgys~gnU$;$) zx)JY-u5S18@M_NB#iN~W9O~LNmME`RuV_lIKIyW5n;Iwgg6-PeqHB-PRl*yjJQ#ML zoQ>VnEl(i(B4`x?94-Q`%b?fqi!l+8Zj#x|1S&(G2HcWby*m*{h%Bo7jkw7)P3l5& zwb-w~__MR-+&=jdbNFemQ*^n0+F>i}jJBkt1?m_|7i=ZcXo>nTF!`f}W0qJwkUMq$ z3)$r{YKgT;z@wMETRwINuG2{)C~{_S+m6ybwTZlzdZ5g z9GyC3$|G~svB44zt1VAUD;0I$T1TWM{y*$}1yEgSx-IT*!GgQH2X_cga0u@1?(P~q zcp$jDyA#|A790WuNYHmkx~J*6nVxx7_s*O9x~o!2?VUqT;NNHOf30uH+UOHq!mHou z5}d$Y;CpUY2IgLWdmmZzuC9C!K3+}G|0nDCbaeP+Z2T9u@Q-B)dIE)dr4RIrZ@}z3 zE+p2v@QlU`jm{+NFfJ_SKW`V?`BKZT;ul2`#U5aGg&ibEoUJ6a^JOATThQXK7Je5k zy?dz2;c$|H}7nMHoc-ncR?%2(spb zn?Zak{}pNhW3bi)6+O^IKBUeC%d69OG7vq6CtLhpEyRxw29LaqVwGBCY<*^<+t(Wc zZ6l()z_6C^+qSJVu=N}6?5l;Z1(8N?I6=D*Yh+euaz!Wnb&dm)E2oheDa0j!x<&TM zrf4mlKs|x@b;eD9a(z9WaXh)c{^Az?=eY&pe;2oK0zESIlcj&^mHIz+U@j&_ObQbI<OpP!Y1#j+e_4D_a36+(dKplzqr3}{RSS?$;+!z zO}6Y7e3os5LHJ$DY=M^1#lb;vF#DCWg=Yr7HE*exh{4>!&iaEayYuKijHzVjMf~Ab zUY>qBF4Cr;>5e5HEcZ?Q`0VKZx8UZ3;G1!F#D#FoR+mQWSKMe3EKBW{6{Cm-*qG|0 zmnUh}wCUA%`0!K+7(kKu)ejjNmUUBhSp;*M)bLrFXa`zI8pmK9I~HiLQ)bA^G2nT5 zB4S5z?zG~jErWJ@XaoZkDrpT=5G^c19g~KJyEcN{3*R3 zVtF?(km8K#EMlmSeSi)l@Xf8(4x?bj*t7)JlC6q|)Upmi!Uft^=1{_nP{RVCphXgr zAedU==UQkM^HsPLB&cmeVLHeT=;}r;;RDDl=kt{#N%)P8aFKIsSJ=~e>~0<) z2H*p)>RIPPvdyz>B0)tVH0I_HJ;x^mh4t$=9eEVF#a%sYv9{uHK%(OWqTqu2HDi{C z+LCk3aaH;_nIj-=wr4OiwiYnIEY?!jQb%c**@0NaVN+&QYwBk_Bp$xCCSFq5sKhI8 zYMbs+qYU9zuLA0$_QKK)4S8a_0hRX+^WY^G2vI0hG&XUPp?1dg7EfCSH)WeM?I^yaPK6_)gP%grbP7AI_T|g{axifB+OI~G@YW9WeimJ`J zOMs7+*3c|q&!a0aSJ|pg>M4;ROUfVHdXA1GLM=*o!HCi*d#p~r=ggu= z`}$2->l9FRyBxNfxR>X^V64l#1L%nnBZjM~yh`RtDg>ItQ7Ne$W+jS* zD2ZO~^5vHzvPi6c$+;;6M{a?8@q#61jtq^i459Ivt@V0tUumGZkJ4vyk1$@oEbZiY zDeyHje8Ib%^yvBdkXQL@gi^AG3QQeS9BPgO>}IxNW1XJoDgv^ue)t!ottw|xa?Dog zqJ4=<>z}M>BFeY!!V1w9r57$?qK9pC3vNB3=0ey;@S#tvyEVOSKa5_W0MF0W-O5;P z5FuQ{8O_9WMi7^!GlXT=`VP!KL*^)ZeJ*{L6{g=Bo;w@_&6Jstxaf32na?)wwIJEE z6@0bLXo;)hMzsAxJ#d<>9ZXyWk^%E=BY!II+`guISD@pocua9S-2%+r3fmPuvqj?k zQ7m!NHN;siySgzO)Jz)XPp`x;+8VO=aOJIB>ZKMD$ID%aVu1s~@ry4M*_qW)#LOtx zpycJ%M@8Ptwp}nOj75y&p4iulB_x>WVJHNk5wJ?*MkJVpM-?Q=CLUdl^l9&%>}!9( zob@l3Px~LZjH7P%<>dDd5Ixrc^LwIsQ59dgru1iZD-8lq&zA|GW1;ZEsLePn|p2pB}Iw7V$od<5FVyINw|vYw}$zx z>&=tQCUxyyj9iUtHg_(V5G&09Q`q3MMspHfi9UD*^Us^Q6H$yd$rPk>q&-xPio{8q zF5;v{vAvy*NwDY|Mx2!a?%@9C4x&(Lxu6-G!>Spc;*sJaP3wGB3sqGKfW$wzLCxVUciH z-%pVWp@(0NF-d*?fV0|63c3rUmM^^RKkjiod>Qlk<-u6YK%3|aR+;O2r-JA0P4@>E zD}V>e#;5i31HLQkd)L=|EuL4z+VtcX18=zD?oc0fDOl+P66($xf zLE0>A+D^1sX>`ySk?7s67v1DF(-9p4v_51W0e4{?dGq;23OAFQDM4(b)!nXwNOY-t ziz)P}-oWOcp`QQOodDyb*y30I;Wt`|@fZH%e;2LvuLNfN`^+v(fM^gv2LG?r5g^Xv z@ysto5+Kim32^4uBUZrC4TuKYWLa zKI=E0VXnS1pBf;c8cotL=&1@_{lmbs!)n{wlMV7G{hZgyJ(!zskkQm|p`Z%N!HxX` zZG!F?31G$eZK-`y2S3`v&Ye0yjlNp{jFozGRsZgM&)hqx&eEy4nblyoY1<7wNyvmP zt^+sdO~>W{xDd(fFa}&9>PG){R*Kw)215eO%l}%rR~d`QFN%Q~J9(Q&IWdwpBJLisAP~MPYgDAki*_=NZy)5wW;&up8pw z)q|2f)ST#oP-TCy+&x@-P4%w9%%%KQwCRe7A{pP&?zRPmyFldRj*ksv=@hzeK<(nsXiKp$Thhfsllgn2gL0EN&x9=m}N z;KvBb2NL0jsq5mK$jO!Agj3@Z1*6i8!JH^xhv(Lc0|GHj(RL$jqm^lZvqjy5+Ur%RJPp+>&9fS1u#+Knn21(@V zTi6Y#R>t%&l?ir@Cj%^a?R}PE0PyoZ+j||4Ly~ay5xT9}?JcrtL{4HhpH7!ok@l}9 zLV8_@;)PM9!)!s~nKTYxxmasQO_$+DwNG2Mjo%z>TesvKEM9zO42HV)V#7Ci^*s_p zHV*PJ62sYBL1voqW+K-kmYH)0w*@>GcY-lk0C}F$?`7D>H>n?48`u&N%8f%lCC_$M zm*TPCKa{mN3A`S^B$8Cr7K3}$v=F&rsw4STB(Img}|gJ$P@fNZxax7vHlT>gyAOzT<5 z7Y~SS{xC4|EoZ!6tNCuv*OvP_H~+%2+48COwX&1u8PZ8YP?ZNtnU`Z> zlO+6-I6I_$E%dmXYi;Vz#dA8x<#_mQI($hq8!^4-TJ=r*xdX*3mccK0q1_>^oNsOq&g+L+dp~hiGBJ}tq zlz!#KsNqr<7`o0LDCOX<@L#rsC^rD^XvF`rh#xJ7=!sJ#wW-Wm9P1c<#87 zZRtE3%=7z36hW2Ez|g=C6}w4qDy?yt!K!=VGUnUCnWDzW;+OaNk<^&F2Q)o9{H8*P zHeiHBWo(t+sR{5mn~;B18UOGjwEs-L7TUGaUh}E#-MJJ;K)*M>&2@I8>&mgrc?PqO-)gl z`&I?6clSNZI%37|=Hup;hafTiET498d$~!|saDgIA7}^O@v=Z|GC8-VlS#i|C35(X zdv~(ONzEzdXqhyQ?St_^-#L(o<%WP~Y%n-Nvj_qX4E^9bE$%BFJa4DeTEA8-Kg9Fy z@?j@PMVRL5h*b5rK?JQ3A-H394zPP)hW8wfMWzm~-bdC*4c+>;- zE`~FaOMl)3M;OzH{n>{x*=LA+7`arYQZLwr6^|%EQ8&c-k;l+m8!&Ac)AY3cg)V2u zOBWdeHK>CuZAD|FQu4D0^aI6s5-`->einbn8+~PCvRgZaUCa>5IF4T^I0E{0j|FRR z8>SS8$amvoM~_ z!IL8t-`IT34|ea?S#j$U=-&?(B7`{V!*|0C&eMw&}#0tdqg>hEX z5*7YUJ|y@1%iL}s9Ao*>M2J|NS7EaF0y68S#Qn%+y3I4?qA1gIjhjUHVsg2ej=OD@ z(1>rvH|Da!VwqFvecw4b9iL0s*tI98j5LdR``FIlYGDDzwaQ~vZ>}8f*EL-qY~BqH z?jK&C-t_Z1vp?{>e{02eS0W>;j4Sc#h6BtaCC_u&7K+G3N9#oTn+Y19|D~`{panW% zzjbQd0sM^9iIxk|4V%**<>1xs3g=I%EQXF#Bzp% zCPm!Y=Vck=A4U(3svUw?ET=OH#(GvI2__`9#qmGzA*H6*-@dqF1W@e81PBWK1^NS^Jrm%} zuSWp?3*gM-(a(th#(z!({KK&^pmXm(O;Pf1^SCep zhIt2s5OFmBtDL|nzS0j2kS`In0e;O!!&W`#WgkWZ0R}d#Yv9eOuZ|H>p8%A_=VCnDkLpHJ}`Vo0NZ*5Rm$lMl*JOmYe zgo_@T-ar|Oa4Q9vIJ3g3;?6L+9ljpVn)s;b$lMKBZ9q`%CrkKru=@m&{e}4dLj3<7 zi2wVu=_f4nUx@$zf5iWNEBNc${~_XM00eeFeb~;ZN?GG@!nFaSENq>9XJV$~eRK&< ziFdO_G;mDHec7SaS&nCIpWS_fH6?L1I^5$hbrXjp(GMb`JiDQ=C83Ps0|5(ZH#{i* z9%b>V?fMmEs6o!`x~aWRHq_fIl^oak73GUW6lX-`uY4$e6?nbJ1x=-^%4>g1zZqdA zg0E?FR7Y2P+7Z(%m30U+m@2OGIY_Za1yMkuiz2p>&MQA7J#1W*ykGNJDZ6YwN%I^e zDxlFWD|QQ&j6pwGg2C~~svwxqsB9}IJMUF0;ZrdoaRG7=FusdUrukTdOEFYh(+7en zqt_hqBju9hRas?D9x(*E30Mpa|C-6`bt=1y@jmzG*E4 z(bzzg@G1Eb1!RzYA{l5{^edkjX8ZNrWpN0Q&%~~p6PuITf-DnGZu4=vh#x5iUx3vvdXQ3kbyJ>!MRyaRgwxUzgn`~6-8EU$riC8QqZF;&~O+b3Z zd`wSDs^>)jI5Bd{0$RujED&w=4xM9aOMgu57a*YbG%TexOS!8>3dk3NOs0(&vf;h!aPJZ}kV*)J3{Y*;jz-44I zc&N4nU&tBnH4o%uQp-}1r4gob_3unca3ET+z*~r}(tUI~q`-MHthzu0v1zW(@~(l% z5Ht8>WGBKs8_Jwo%KCWBwN3+P9dB!dt?>Ews=`E@WK^W!4z=L8Xg@l$w%J4*2vX+$qz~((bMf=nvBH-B0_E-tqN1 zP<55n)X!Oui=!Th$5uL@4vE$8h8UbNZ9c=6?1SB&O|rmW1mBvZh#rktv;*8w1=*DUX#RHz*I>mP-b$&j&6s~k_+SlR(oYt;Ibs(lDSl2aCS?w}_ zbcR=Y)n{54d}UpX!T)ua!}N4K^#rT_0GQy74KqNVyU2qv z`l64a1am4RrjTB9Ha=xd#`8QDIdP#$hX+!pzKMnjK3k5a$ro7RG%#RbQ%bfDa?oP) z&*7>nAkiG5Cq(T&SNW3ioV;wUtaxC$m^wYbu)AN?$}-)zyqX84t~qKt8R1I1769Q0 zytQ&^QDbxgAw&H38atGBE4monI>`_X-4Pk;42NYaT;8sS7&TUs(SQYo3tI9$_!9Ek zPM~g2&KyymW(5wTJ6zPjHO}nJ+d6nuC-J0##CYE2dSsC^$@7bu3KLXD)8zI#9#ZCO z;T}WTYmutgH3B=m-tnGP$~j?+Uv72?(~OxdxX(eSXzj~?ax3@;Bd9+aW(73RJl$|5 zMhQG(R^h9M$4T`A`6avWq=*JB9ommcwfw=INOJ<+GW@yA$nqeLEdaAp8frfa8?iOO zg=7*S=>VGnArp3*cm7I?|6*Y**E?=ywJiAblq-rts@ZgwR#;xyaY-&?pbQOoPx@?S z1dK?XA65jr&>*QruqlR}u`ih(7jrKFaRRHuYs|(Qrx!O_n-=xRq|tO2J}Fx;!#WxZJfW8^Pna6q= zJ6$V#o5vC#eOJKI_r8@MFMKpG{b8HWlbW8#*Zx+<1NdJsv;3gx9{=Kh$_2#?PzXI; z$fpsE14hQy3xP-`lLY{lYK70FlAz|%>oEU&uY>5T(9;sN^P@+v17izcY#33jGF-MU zdOX{0!}dw^8{!#_;eO}$CpzP@bHn}jLzWsRLCvgE-CA?yko(Lt`X2|rrEGT0$x*M=&(-D`=j=+K80Wk`2zr`rjgZR|_%U%a~m=8HfmZwa&exUiV z)C8`AvA5Mo;96)rGMe%&DiHr-1S2~hs~_I29eGbgepE=OPXZXja-J2_iwPt4339pE zar2*CUr*WXC)d}X9=A%F0ZewnS6m`muif(QU$V1+UVatAKoy^4w+ZR|7{GCP2Vdtb z8m?_Xu7oB_nyq6eY60YLTh6spl7$++5-W`&!9dvuOlDZ;vbNFax~SOhIR7C3aD9Gf z%d6#NoG>{)H4GES5H&m_JS=%fMwIOpyBw0i&%qUvg;&II!;phFkdkhXu<9qzC!gG% z2X%Jw(XB=p z5ox1TuMjdRd8ax0B8)I-9`NZ7@yX(9t@Dl(eT^x&W&Y)cOMhmHbsN_BHA&IL9WnvG z2dx+%HW-%lt;dbidB3Ox$kS%u}8-{?L7+%m)~aCxq&xsZ|$5}o6jIs9|5dC z`fQU|%8@fYKA!fuv{FO4qXjrXp< zf&U)Hm~Q`7BK>IQmP3yHdl+K?i$!^}F1^1WlAmn%(1k*R!xk{5ROOAA<}d{~<+!t< zCL|~nS7e%&dLj!D=J|lKCA$noB0Im4Y143;yg~M1@17NhxCm6?FvFMX-2N8?2E&?P zt(FIXz&<`ZY*-pk%fQ)LmansV-I5}pjLIX&=zAhx!Dr)>Bf=l6@H{KzY?9w9kHOe* zhQ75`G$TK5+62gBb)}bAmJ;?mpfwB>(w;E|fwSsF8q~Py7FCE?K5f?;sP(_H=9ns+ zWsyrE^C1XsHN6#|@k)v#i>p;wcS3%P%ZYphY&B#8Eg^NL(`Yk3_>Y)igXbr9m5G7 zoN&^<)_rVI*j@zqg6Rw*)iWORtp zF-c}-DzrW(L#%_nM}Kgs^&zVcArm?7&NW3O&xQ`-qDaLv>HLDrU3p%8gcD8AM3FoT zQd;o#e6)Xn{Vjhqo=-A2) z=yzms;$vR439&2)8Hjx{MoEGB)`KAwnncAenvEs}g<^smJ7Y@aTIOY!(%D#QGtGS2 zBS#dqj2l@PmZOZ!lu(xb1to%aQNEsBZB~0|%pLpv9$wh<&Eq8mkTmu|P&v6;b{8Z2 z;gL@>s0=uFH`6zR)5b$(G*4XzZazVehCk8-=ELs2+wR^!l#(M8xjBdnkD9 z31}39?||+$^htv?(9Rl}FVHe5X|;NFyERhWZfn>v(;a0u>rm6oLQEURSTwCavB;tV z1uZyVowxMh;wpNWG83eY$r(Wc?C7xXJEJ+tg1N;3kqg-9>yGst%r4ZV?^?l`(b4SGVrH+S z(Jt<#B3a2P&m8LvOjp@mD+68@Vuwf6k$&ATnWGry(S+h}P9eMMVd>=h}BNskKLy@77Vclkzx)V00%-IoAMTG6j z`EbE=p+#74M*5Qy`})KS#5z5y*o+Ndq*dWR<9V0`3bZV%5eIPt-U zm>N?B6ynS&BO3+(h^mYx6}M&gLIWtIgpB0|7yRD7%THHtoQ;i_!k2>ibne|;F0TB) zZd{D(gq_5D!W1{uk;f>OQZL{x;%GZFTfw?xDmQ~p15jGF<~ySyZKBm3+MViWtY!Ehb3FC z&Gd{o7NdEs>0M)a#cSuFBiXPa|6_!x_)eLsOL;p;Qaef{N1hPzke%q&8>A(+C zkC~znA3fjZ(8Z*>IU~ZUZRy$|3uNF>Km<_qxp?ckExr_7X2tJa^H%XD6~TZ6@pDtR zVN`{B=E6y4unvS)k0%F<#dGu#MK*Z)2n}Ja$o=cB3-4Pm?J)+p6)(?rV7dy;GPZ*n zY(-~stPx!gDV~+a*H9n@KBvhLlv0>$@l0Xi8o++1=s~42G``ZpbjruVEwbto4=7e_l?>OhKaP+N( z8}r3mmB7M{o;73R*}5<81cmL(kg3!YdH3et3-?hh_?OG{iy*_0&(sN~xo{Ws*Q}IJ z(We#qzyGgygYQ@5PcEB38;kXO@*^>7_y>!1Mg0jfbvdoZ6eK^Kmxhk2@Ed5apIoo{ z13*Td2kYDo7tG9FB`FO7u^EqYpb!j@Uf_xctZ*A1R zJpaNmLIJZfcL0GRm!zzyh%Ql%%d-)>btDZ&L>D~#{Lye>K)R7q0z();!}_|1SX-!# zp+bvjWUVJ|^9B&vkq?OMfKJK%NeAhVd&y7M@h|zs6Zu6Iv-=)hfR9Alh7h>pL)I@V zSwRo|$>$)xE%3!i`tZnBqy_E%LdE)l$~K5fP79y>a}lCB#sKs=My%~%T5oS2{GtVQ z-Zn-1tLrltPVYnd<+@R;2CZuB<0h{ca&L>UK*h#nNpw6CD_k(vJ#uC-pL30k8yqAk zoXITM@Yi92JYouh6jrHo8v+*kO1HB4;&YT6o5d`9~GntbR~ca zQjxQ9!5bI>7(^wT$-1mTLBfMmOm;;vmDRLp3+zX0+Jw@ zWeV&m$EMXdyQuiLKdB)7@pSsh_4TKtv3`G}__xG?qW`-hJJvIQQbEe}eP{UV(*Gfg z#Q+FNfBNYCmBm^Euvlo&Ya?Il(L^Na8bgAKB#9nbEGPhrMY%C9wp!b2esbONCeM)*Wc-_&q9*>U>;ymQt<~4V>03DU*R(d*h(TtGtaMKNr!@IoV zkOtdnwd#BiNCcJEFmSeRs$VHS9@nOd5RnN(jyrnSW_{v}4n>};5 zujTCEt4TNP>(=;5-4tlsPxZvDa$Cm7ehi|Lp_|4Jr^*M- z_=B$U;2n*){2EE40}PTuOmTI^_uLNO;(cwIfk0*c_xV;ijD9R68Y3UE`oRgar1das zJbP#fgvZn8waXenK`H|A*|`%4x$>ntg(K10Ydgh*sFPEfcnj??I^<$B4!3tySUKcT zWk`e($#WW5Vp4dlM*Bge*a;rPJNiDSr;p!eab`gXqTYTxJh){=3* zM6OBM(p=Oino#CD!is>2g{!F_fAxY77Mb~_@JE+SCnR|fyTxHrb}(KsKMpdBBD{($ zjvRX#5y*ZYAaMsOe`)gI8s&(ZHikP)|%Un*8U z_wT16KS~c>bihEFfZnkXw6#17YqI+Q?AZur#z7VXX-1cC&!$`c{_O~`!x-5v{Gl#~ z*|=)W8t6w9Sa(M=PL90z&7ma|Np+E^N&gPd9^69z@_gg1e~ z&B)=h?-NH~7TG6RkQdm?rY1N0qo9rz@Ya#2SHADiAfdkdBGW9IFCEdX6Wd->DOW2`{n^&W!%Kv0B}77({L% zSuPZl>>$NXMaez5LCBUF3|XA~(pMj;Db+7>P%056>y!j}2;eJ0ehRWM;J48Nown;m zlZozc)J)zewg<(e?%lZezqqhy4D4hbRj&?Yv`kPt&7;WeR!^36=IWEYc4e@vf%F`$ zjYcn}=V^dQgw*5C9tSnBNaLq*w=1c-TTeBqQG?tlN%DrY#K^Rr#PMaWr$*#acet6y zj|iq>P%cMtu6l8hE=)aT!8}F6Yxay!H%6_!*ci_4Glrni$6_bt#8Sa{4cK&AAullV z0?$H5R-1PqCXwYBO^kPYrWK--3Fc;XC)Qv?U`ph}rpvFZprMAW+(fX7zVslj80OZ~ zCk`8hZu~7OXvE(sBRD)d?MbNB~ab5@E@R<)@zw)b>#P4Vy zl1(^`;a(&a(`bDOnIH{{6)}ynOxPe>(ooRDJEO1~)s{zOouQpl*$YmkWxc3`K8?=*pQkCSH$4SXo&j&-x{Um4Y$8yg3~L6pnNqc^ zS;A~lWu_)MdR%l%r~8)~E=jTU0ZXsGZ13-eXQOM7tziefJzsrc&BQB0x`Z0MXSwI$ zY*WL%b_68zk>eN{yK_>gA2YL7$6>U@@HW%N<6CjJO+pkiA@``%aS|If!RaRh^nDZ| z3Fa3jycLwt?g+z{PU|1c;@_e}T}=5+4DCR4dEb2PC;ebgwz;f?8z*5aH?>rKnLUN_ z@g2CGQyUh2dXkKRmun@M15LT9GbIm{rt!&_BjfZJDJGdLsOa-MNuh612CI!2W+3w@ z#i?(G4E3yuJx>X=o=r`&DFoMcBCgnaB<*jupD_BMVW|&7l|C>*e#yb7oBy2sFbUE4 zr8M%bI1u+uE56nZ7u4mIO1DTt1;LGbQA)*IHFZAwwTrkE!zjt}Z0o7!6L*L1v`TY_ zO>XOAhi)l(z;DI0fWz(ELT>ob35AAt#5#@-K&dNLem{YaPel+<$fRFbkN-6fqi!#O!%OwA0?9DFBE!~kX%X0{*F zA9^tW1H#Pq%ReFZWSmYf#sYX5fED=hH2}2`Gwa`sE>8ySjQ`PkDCS2Uz~3}a%#Yv2 zFW1UU06nFMh80M0xf0eF^2sznhXP|$afd(D*02ngH8*mni9cO=X+g6L5gEJ`>B9=UGpFIXLBYyvFW}MxYu%sR z3jTr6;m^h-{k!L2spTIfcf1N6?08K>SxM(84hPw1O0q4&li*AjeC7*}@Z4+I zlwd^-PIj{S=7>YKd@3Sm!n4(qAmU%le!Ycx-E5TH9_ay3Q@$wfZg!Kp8aFB!@RMbH zs#*BmNB_^Jhx)xDV@7FM2Jm5TxuL!Vm6%->bIzwgkw^;@iuJkkC!!)m7p8oO&Uzzk zK$3*IOfkgpFc&Zi zAY2-Bc~L;G41zN_kiJx6Gaj%wj=}-q zaOodR(iYtafJst28<+mUB#8o;B!yp?Bm&e&CdnBmP6w|a?Xy!ON*I7iqW!@nO&pMv z;i3Cs-`bJ(L})xm_6KFNCG$p!Wolk{lh3B2O$ZRS@Y zzc5B;f!D7O14MUNWl_Kt&U0PiC#S5$h|n$v^5E%c3*v1>%mYDe)|;hQ`-##-sW3^9 zbmn0iGf-CddIdg=?g<_Zt)JyNxwk*po|-!iEHh{Cb_-Dbw=qc>KV_00cW1wDEB=T{ zVtlkI|BgvgTe1RF(t5rvpRo5ek&sLf?qGO*QWnWeBEA8hI;VGlN%yo^|lysrk;eAH;e3509ss8x8=pK?EX5s%&Rnd@AuW! zGfNlaINLjmpPjvcc*)&<&f%EfUX%>!4k=s73$2!sP8Lr2bk zT@3q>2|{2WKwtl?f`FVk1og`dAbTDSZa8G})Te*$yO6 za|kc6#+;C_1r`)(m6uHz73a}1@ec$x%o`7;Fc5ZmYkoLEn!fJ6SCppAvvQ+1Saq03w zG3M-X{bEocpTSmSru?jD#FjxEVHm_Hl6+TO5UB-B6hyS)?})x^VzF{m^_c|00_P)5 z(K4>pG@H~heq8s#=~|5-b13r2{^D+gY7(`5c}#K5q1=&Lc?KT06BCh}aEKeX8fYjk zgNV*OjvI^0u(PlB30JvA3((i~u9tL=eLBypKz!}UV+s@z8Pn+cfrew9#sr#4dCv$L zX0b832p<$k2qB16qe#C-%CxVVg?Y=HXSD7!QR=!O1T()yl|sDZf^2W=a|CDewMdzF z2RK_TWM8tZnD;dhW40Lz)=F2AA|8f9LZnm|cx4h7b4L>09Ac}1whSn5mU(WHWjlC1 zNN-52FqaR8xVk0Y3E_HtyjO0$8rRAkg0>(8LjAO47%t)=@LF$ysX#SWgnRzk$N@O_ zj5vt3D6=DO6!TGOPljR+5?6jJhf*r-JE>fKU3u`X*u>CY4w^HklN{_OYyxTfPRXX`r z1U}fWfWtm&oPyw}Npv1dYINj4(09?!*_{DvefbtaDw|A*b$Xi$1VdLzCcyKeXlM(S z(A-)y3O}dO8-bRk+BTx{8D%dXJqr|MoT zGXh&+3yF0ZECiWwBKzJVBR4GDmrBi#@3N8KkT!jDsS>YWkS-O=W*%$e2-bz+d3%5Q zIW%ItVOynCQCzWHci<#&-MtTq&P{QjolnUdm`>K~;lJ*)0L_=b-3xz1&Mdz`y#HOu z`9CcFk_8~HVELQ4f(5_@0M7h^j#&V{BEXqnj{v?Rz?pxHm0ABOR{s7*zdqES>}MER zIseSfu777IaEuuQY@d;YPtMWrKuxchUW6Nb`)IL&MAG4nButX$1GWBuj2EqjVpaN1 z!BM%DQv?GP#LteF!&MdP?^7>Gd7f)lD|56of4aQbUiY}3f17QYwsK|!j@(qHL#xHt zU_^}E()oGI#RDM10Fwp|$~7l-WZ>a8L_M9YXQKkzF z@9z-BCM&V+85NyG6X1zMaV-vdg>Ek{Dx;%j6tC%pO%_GggL-n)1=?qj*EZBBtefzb z1ML~3G+9C8hAJa?Zll+i>iTylyj4_Yop~Qhk}CXCK1hwJZ3H%w<$N|yG=(XWS1Mj) zN$p#UH?AQlQ1T8dXQdTQySgne80m~pE-04hnweKGC607?(ZF55O1nb-K`H6xC%28K z2E-><+g~Uf;5zyxAM?K*Wq*|aA=j`5$Tb4DxKp5nH4)x$_r$^&J?3Moeb2}2c+AIC z1-6)jJFkx|_uW>;F_pE{nZnT^6V&|4GX9m1`Q7;NN3J9B|3SHi{l*iJEqo@T0v-ON zy!EkRMf%r<70~)V7l95KU_4+LAV>`nC1fPI!|oNJj(LThGBKbtU`{Y)s58Ps^h;j| z@a?9`hAu)oj?Rse&)WIz9O~g)>NTNZf;AMv8ZB_`ANlvXV8k=!NFHc}1)hONqpF~t zBogg>HalJK-~)xR?bDsAT8z0p<0$Z{AI_M#vGAA@tsYJXUWZgCKiQWj-tDA!793IC z55YvsBYB#S*@ipL^ONiADKG!zHu0we*}o@oYUBSMuA?r@{%x}y!+bB)Sh;p_s~#Bw z+~>k_(MrjlnDU5Q(qo*E)}4iKDMoY^z?{Nf#}j>xBy)i;dzs(8gq6dIQTo{;tv~Xi zow{6WV#g@hZ84j*Q8B(4ZWNhC>_*ZrY4a4~K+?J(}R~ckbB}>&orE74H2b$ zwgL)VzI~0|2qh!llkx?*sK&e7L#k=`+TwlK<}6Cwn8(Ujs^(xwgFw{nC&1xQBFSfVuKj*!2zOa30`RY@6{OV-tWamz?zCnb`@Z+&gZ_%Kd zd@7i@>87gQNPidM{b;jtz01SV-tqS5o%{Tp5Uk!bt@`;K`5v>Y+U`vJLQFJ>SIzy$ zX8L6_$I%EGK|nsd`-fhND*O^-sn0<<2K83SY$x>ig#|Hi)-)Iw6@l{f0@+)a_f5cy zc5kTaH-I{g8a0f6$;2FzkSTm=!+#vtMBj<2S6J!tBNMX}kcp{p2ugrvkVN>HiRr`8 zZCfdlR?HBL)?hNt)mn$iY6H0`7bKhk1|+M7$1up=jA6M;WI2#5jFYp0JrF%>;0v3f(EAZ;LH2j4Pvym`c7_`r2a@%@WLl&0G}{Ph(tZ zU-5Y;P9?iuo?{)6D9JR2siB#4V!v5MdVS_j@(eIg#|SyR8Rj#3S!_P$$)N#>*mv$; zQE%q9He=v+^s&<2fLKUByrvt0a&JTyUadi{dsq@Rk*mcTNt@VgN#uYHj7hxgDy*rd zqZRG%;(>hu8F-kW*msE&S7(ZEdrCAJfjRk&czvBPgEZ!JVUC`of7)JuADsPN=Cete z2xk}}aX4Wb!xR=;#DSNX%Bi?D=S04)VKpYthB*%5i{JCc)=#eun6v8ZrvYjgpaU4+ z1<_@n$_*@vRo7mpo2cN)S~eR-@}zH^@+jg#sEjB{7A#qYo~k1EH|`9Qr|R!3DU35q z8C{9J^nCBRMXLi2m8#eMd3nD^Lc?%DJ2~xE{VXn9c(vsjk(uvliD`fa-O9Nx8v_>5 zTP=5m%hLwuTyAT_+L1-Q{-YpvNA5H@wSgY;(Wwhv`_xzPLG`NhP*uQdd`DwJ7ld=B zANEO@$W|>c5Q<@sBAVLx_4Q@=6$99tzeFv>L!v_zLkW5K29R7k6ki8_$q`prLu-#A zt-Vi@sn-@@)B?K`X9KoKo%jXlGN#@l=W1z%syHI@<)+mK2{@LBGLUfEN8b^7`KeZ~vnQ z!+_y76U*O*zW}E=6X47*@D?!VX8OfDPOr)Y_~A4CHu?U^V3_TngWZ2L9b#r@`;Qw8 z|Bt#1SXqBZP&-CzNcQj}i9EQY*ZL~$f0)S#LSjIK1*Gx z;k=qnQ#4>CAQ({TjSQA-@a-NXgoWg1d<#@dh2F53UVSVcz)km|_Csm=8x)seUHRVu`IZmwe@U@rlW7dIkWl;%b02X>L!ZNEs-b87h0 zcO+=_W}O8eSgaa6B^htsn6n^=9wIsW(PzRXCUYb>kL87F)H+>@ok07t0Tg4o; zf3gSp2Sc7e8%+JZ9yT#*6vmGqE%54!atxMZl{~)_ z%DRU~`Z+)PSg0VkY$EOpUCph9STfslJ75vo%`mZ;Eet#VOggpJz;nd&X zDE=+Bg8#=&px?KGzb^eB!c(N$VnSX86$0r6z$8Z*#hLj^D zPgF?=3V9!37x3QO%dot)`Lc9jSXmfeyh6Hf^OSupqMt1etzQR_>iBkh>n(&p74#ZA ze)D)noH&_Tqz*eiH`@AD8ubV7!;_{NK&+!q(`S1UFx?knca~Re?kk>A3fnxAOnxyQ zEVb=NUN;iUZy5kZ4(ryoPIYdL_lCs$>2GzcW~-UKgBvq!Kw?WPW-q2nygaWy+cdX7 zJ2+TB|1`X>B5d30h5m4FXTMfj7V`;C^MRc2w`j+Y=h-%2yl?DQO0_+k+P&tzTU{~b zdIC1K%QRZ~Ne9AKZV=qPeq=k|%x74xYaZT1sdJfQLE`~w$*tYdjdd8I&nRUV>gBUy zbl9LQJ(E8qrG9Pnwr5C$k!o)MRH06<#@wz)#zR1c?^ud7A z(q`CE%OK--g5}RMv2@PJiy5Ed(NiRu%#UX8|NUUQT=kzLTp@lpM3DOX14) zVm83DW;;I%AEua_L=HGqV~FR_BOzi=^X1Yn`<5l6oW-B|x_<#iGQlLdbx!Kq(~e7m zZmWP^QB4XFD2ocaf+cmK8GP-O>775R5jzQCp=-bj5d1#D4$~VzdWOdcQgZmWe72VC zmuDHupEHtx6#aR62G4BGYf*d_Z2u2?Zvm9&l5Pv5!QI{6-QC^YT@qY_1qkl$1eYMe z1Hs+ho!}0^LxAvqVRmNN=VWHiz5kgxbI+ctR8enJm6!UuzwTaZJL>yDO<)gi;-XJd;?fxK6Vo0U zJScW9(HbSb_==h<=j2I83ep^7gu@ZmRG?2sHE2aN5Z|C8t#z_QaT=-L&}Z9WEi zVTO-|RB2o59c8Y$&7#K>%x!-4a-@78zZfj#UCtAl3mh~}Qi>RLRylcIIT3)HNcMqW zsV=@76tQ%HlxtR+M`GDA%KeIzOPFH2U#c9( z!%7O1OLjBO-|A~nW~y{#^L#lxK1?Cku0rTcOG$c2u^-)Tzi>UetWB{Z78v z<-~@c{hPUHHfc;FFKo|y@U!7^M%kLKbZ#Epc-FEEq&;uhxGS+iANp@4(+HK$z$VAi z<7Kerm-A``{XvKu`L>bUWy3MLD1vGB!iA|hX>og74sa03x@22QF_e{x{W?LK1|)6junk0mh)cra??74xBm=eKk^@PycB7W- zqUkngpfU75e30V0Wn7w>R_~>O(OE|71oCk)bWY8~F5+3M_nPg(R|%RHdRQJOS&yL0 zYgnPHkpdQFSBu(0N4EBXCCb@{a&BM&7O){#KGV^AygK=Q^vcEI;>*=aR@2fO{BDF( zfqTl)F)>3gJsh=z9{mqp_hhYB#0IB0U8(4t6?Ger;~~+OhH8WOLpx_`6uiUNpK}E( zz;h5PJ|K$OeGq*_GSCPO-kqt>Z<+TB%hNgih1{~* zx}GH*IM0sDl-Lzh<89al<%;ts=LB1BQv!fNr;WsZiHFV97phX5z0zznL5#cbSH#7yY~*JVzc(0Dp#mHA~Ka zEYt9NlHPl4MH--_gMa=lRnpB3l*ll?)?G4Kq$7y z&o^6^X7mNkI_#Z_AbOPVhB~M<`P*c=<;`2nlJd?o9#w@bf{NsevF{*qD#wj|_?p=^ zbKV%UCdKT4P|4o<_PI=&Ajx)ABi=x9N0?1dMR5m*Awfp`?EPRG8BucLW=h}HWAH%Je|2be|wW#xayr%wy; z7pvrt&NKXDi_X!_wAk3xVlR6;Nc1IJ(?bQjx9vZP;J!CZDidvvQzHt9DR>d#-V32h z<9nQD^qu{jt+LtrPw5e$X-&W48J@O|U(Dmbd4|8vGyJ#O7jXV>u`l2hAG7?$KJi?R zcy^ln;dqAMpC$hsJskO;<-&RRVR-TvbN^hk_}fGS@D#Tc@<_g!d((ov+4T@?tMt>M&&p~3(emj z*4I}aGUxS^`<58e=R!6-?x?>%Y+u{X>k{EP**~ZqCYZ9qNWqfkGbeSWAw*7nyJ4vB z+L2Ger5@M(`FprnPoRA2VO9d%7+=pHcuee&PLbh-%U zT-tQtQLNRmiUeoO7KpQJwo@DR9aYrjq?{i6v(UH>AgeXvz*4ow#+s{+_Deo#kdq9SEr^kuOCB&!b*-v)dOTns8%!bI&@2lnzILTlM$k_Zg|n)Qw)H6vU{?@LtwFOzrt@Fsqr_tp8e=( zU!&!etr%Cq#HhO*+(YxOqR>U8iIiR4=-9au6FR(mn9%9nv1R8w^IMT0bcA_^sg-l2 zEQDmY>1Y$odv4-@IucgA)Y*ET5no3w!`1809i}Zdt%C#O92AQfQh7 zRz?Iw(iSJp+bis-5Yn#2J~f(s^0=aPESS#Ka!$!51BS7Uon<~-mFXSaer9l6AKOahuto?@ zS`|mAxno)eqmRMPIjJy=yyXb>NKS#s9WQ>@h>!wOihWwdb|Jw3X0Y&^@@F%uVvAd# zwbIS5ELZos>Thu)Xj%R%!(ju9%uV);`I}OUjy3|T^{(QNgx+!C0>MeI+ zbHNf|tkj#>xz)dYWKaGWReA8T=5l!^R1a@m>X2pltmYrA^!dIv5TIpQpvFO4ss|b&_GaVv&82&IOa?lSg7#BB$t7g@&#!`!nOT_KVVXncqQB-^Fn0zk@cqMjXcnqVcG`yB3nFW~HGrKFW(xXq+Bjt)n zOM43yYS~Pj5ZbKE(oW0av#J+^xPe-L8oxgBuf{QPx!$VTfGeM}UEcEXyiuU)RI_V5 z8{z0`Bg}{#_{A~tT(bNNbHM(8=ZpATANv1PEBn6~a{z$s%xu4XB$~{C_Wd8Bh`(_K z?0{nZpAG$h-vNsC0V6+t_iN^W^Y1eUe@(OG07wr1YRthuFNP8TiJyxo-f>IPpiGEC zrx&OfAUr(5vhbCtuiSK+i?dH~{uD#`&||KGSl}J~JOY!cHEmr`rp}{|vm*htmYAU({6j%mY0>g9*i)&GuHHAnG5DYWV#XIWg)v)xaQ?PC%*0THYfD&c>nm z6lVH8S5F$_Br zH@mJM6%FZ@3N{4$aE9-M&3`eCKPu3EF^&Ib8vZ#UtDnAL`1Oa=x*<8jDhGJNL2t353dunfg z2xN`hG0}KeH?=d4DcK7vk^c^#fNRo}^g$_G@S#kijT?-Po_~$sd5t?SR`(qHoh<>k z>e=p8-2uV%&C0=I@m&%9cR)_%d4%p3di;rt|5oGDO~_k!C(M4ok?d!y`2PIY%RB1L|{jG|d9rw6Z`T$bSzj`Tfufip~NPFJ)5 z{q5_o*mDee_5@)i&Cs&)wDB~AsK4hdmU9YLE}XD)QELI&pF}EoSEE>W!S~aB3XY2) zLSRcajMu6q0;`>YZE@pucoE<~3{KHB1p?L%!)d$kQaOi;7x5Ne$FUR0uR4=y0Z_y6 zgJCe0C5BgmfAG)=X^@9Snj08V4sQGLcB8 zl2|Tn)Ldh<8(MpH79d}$0n>6QZ12ktX0IG&qu!&ulLaC{R)kk^1~NV7O-?XciDgpz zJc%`NnSD2fr%o`@-$xh7rQaJJKm6rm;sAYeRzCt&TaYKr!=hwS*{hfasgn#|tB~^1 z#`-Fp5^ja?rafwF6s8NZSGK8pb&;3&&J9L(ldVM5aH||))>}eIQ=81$*Y#15q(U2l3M8)C~>c4&#PN(zn%)b|A1S?}ZQ)X`DhrC8W#gwv^I% z2|CP_`^&p9Nwdkm6iyb@jSy1}6OVqi5}iOU60By3FCa20Kjx$=&aWsMT#jE9O^JSI z^9sv1-*8Crt??!QBK!;Fmap~1^fMAg@WS_pLfs}1J$lf4xWXAR zTAJr@5^gGo>5Z~@**MR3Le+!X6pgJXeBDxXUHXb{)7uzVV}F(Y3{tO^Xl#9%jNt=d zqaJ8~$U80X*EU_6ZC*C-}mbwL3%f5Y+ibz>$hhRG?J>rdSn5D+%i=tn-C$~|oJU?3d~#};alZQ-sEPK1 zqb`?HMkjEOUW<*tlzT(^!uN_dVt>nIt&0KKk+)C z!vHYy*AY6`-$m$8FZy{-K2u|um;fi}9~hx?{2rmlbjWux!Umnbh9+2NoO9hEk1dg2 zT9m^L0vm#neJe-EZs?309c`KJ0OSzfdVg(kx1wpPL`aCKj{*-*-U<8>;w`N%NLVAJ zB`8;eL8qPjV!E-F(W6n=(%fbvPi8%ys#;ar8f!b43*XBf^Ca0SL|Azp-u&>Zr5#PR9_OV@4u<`+nzyAZQ*6_0UKOP9d2Y3mcKk$12p8#2lma@9(`WL&yUy=C!X!!j1=@*G3PkEeR;|~Hoy4eGdp$~G|&J*h4FuwuxX^%Hm^aX$< z1Kyxd@f;hDjF@W)uk|RI`(hn%`@v#?P*h=35EqQr*6Y14O?jffOSyVB;rI3(a^}(= z7i!fb3aQQ5h`10pDTC#+3|yu{iPrj}hp{RS&}tLu^`~Q+3}e7YICnza!+yaHx${&S z7UJ(t^V z#4)r=Yx0KM^DDiKfXCalsCJR2dR_F2lc0gE7Y0Nf@(ZLQ5a&E~ZkVsHF~P|Tpxz{I zH$IRUgnpu8;TQy=@=63&N=ktH9NLrnoW*bMbEI>*a;m7gVnmA@W?#V}q%qV5&jW~W zEr_5SDcv&~a@{LX|BG>)8qwH72tJ=sjC++Oy0Zz%fMGS>r_0{dF2G$vQKF9hivD@d z@;_T&e|UH6|d)Q49e)?7$4BF7jmo zv2zgFAH2S>di@x-3YVe$%SL*i++$m*p&ny`dGPB+t(T5$@#(NbNOXY4_}s+J8@QxI z*V<*-OYp6)!{fi$Tb>I8e-oaw0vv*#ljS{He}?B(bc%FR-pGuw^G*7B!C+F&f=+C@ z6p~6jk;kYHw*Y)@F5a}bAcxEGB95smC%>A~k%S2HP>FZhl>m@qkZk!|5@(+xLjB5VTgaUq zrfJo;%V=6~;7%GD#kNtA2JIbkVNr3h=G)FNbfdy>5Q3+bo2tF*J9! z)|Y-~>kwK?(>~)iq7pYjOUe`zGpGsgw8{>D(dJ%vgkB-AX28ei)$*E}(pdP+Yl?0b zPzF$SJ8m?FfQk<0LBsC0GGOgZ&Hl#KlGGi@xx)fb1)!yO^bu67DREX4sB7TW9ix6V z2mr>F=@N)ZN#MsgqNeA*#L6W!d!uob21mGO%2CQnZ3V=*gCkKl@uvvR(Ut81%4)@( z4QJLG)d1hdl$;xQtQ+5$Sgwl+TT)Qquh4xx*e-+ea8&b0O6P8t%!A!<5k<_j)0GhR z2}k&O55`luC?k`h31QB}gCd}xCLDDzY08WQpK1a2xtiuXJER3+0_Yi1E{f$*2%E47 zl|Rt4XXY!`Z?>6q%=89F(^;y*!O8w81*i-Llmfivr%_YG9?YJCP3^&`T=H?nKi1~< zSL9(aLY9aSH8oc$Rzda;TJY2p3RMo&(q;>Ebhx^?dKehkINI4iyfR2%dXv?yK*0Y% zE3Y6XNOZ)WgXl8qdqBhL8%$Yeeogk091fiML?es_NifvomBP$PN#eM*Xif;fjQViv z7tc;YNm3P}e#OJPWV{__zxRRE7&EoO0ScEERv^qDk~-+XJfsA5h*C>o@}UOYTwh-M z4z~i8vBbawCB6fmBpL(WFI&@p|AJ7*N?FI`(u;_xO_HcQnkGL1C2ll|QQmM?^%d!| zGW%W3oHpCi>&$B9_r?e+44(y(U$E}YRdZM^r}!*x*IfbuLEo5MFS}F#Bf60sq2j;Y z`pmBa7ySPH_T>9}1#9dy`bnqa6I4Gv>qT^678;PSWtkAcp_bUkzPTLNTGy`gS2E!9522<*UzhP{r7OC= zQ|xVq%=yA8yx@rFAIeHVky!%=bh5K>W5XdgOHj{8MDCOgIk)&}#oCb{_EYwks|7=u z@apeM_BTF3DGW1ai!uBhpb-NHNR2h$rgif8RgXk_ZDPyzlV{P6W1AR0F}nEC|Oeh@CZ^z3gPAqj>g>5^|D7s1h%c z;mKD;4?g}o6#mF!MVkwSa`Ea? znx#fssi8`^MnJl;n3C%VZ9+!C>P(x)icD;z&glENG?ADmjajB!Rki^M(~MZBNN$M5 zk*4wn`NmX91hEYxonNOOwv3NeZ(*p-nW5$6G_cyLpgEtMT@f5!1U={!uFLHk!y zyDp6bFSL}-CD1J=wN%W!Nr~cJ+$9ecJ=|vTfH>L2^7O#G?2$N|>LCZWNpa(vQ*&1w z1(Z*s;o{MPMXV!A_wO97AC^s1{B`;fTURc*#QpSPgbDbE1zB5~P#;9@fkbp$+nXs~ z_8d5QHCK8GGPk!$| zG3H;$0*>D>?*Ch4!N0Tt0S7?9=lHYR9tS|c2aNni7H|Ms1^^>Jp8zcbfRVpS9RR}U z{+=`a(~Evi>$CeC6EhdvADB7-eB#gVE8ejyKg9jOCviVBGi#XC&#c3>z9$^|pjGIp zZg|bWl3hdXw6kxWCwRa@@rNBjaRu5gB%nzk7|k|swKJ;nf*2$%;8D9Ijg@Q*Q&6;Qby#QIMU{!E;O0u5bq0nC0w-W%58@iq zwR0Z=O=**cZG%ivrp&LkIY-u+Wbfp@0)Jq79rK@Wf=>(d7pv%x#ufYrE&o4o1yXnE z0M|0@zs40nKXC;kXsMh1obaaplD<$SWU?Vgm8V~H_&usKB_2teTJ#V$H(hX*)Lf^^ zk`cxA7?R-VkQWk(2{WYt9=(LQWVNdKe$?g@*!#k(-Iyk^JdBf21pOAi56hhoEtI?2 zDcN$hd9G9AII+UNA`6~&mS0TcA5Y8wJzV*>SN(sJSN+pr^@|1ehhqzVf4uxt>{3o(NDghGnMYDl80#uy4-;Q-dRBWz8TBOS5F2oguPxIJ?_XxhY`59w<<1sz_JBEBShH zqI^ZL)MV>wHN7(Tq~>qe@2$ET#Lay5P0Jw8kI}WUYg&7wbTbCYtmAVpk(oK7 zPv@gU4N&thwl@s7P7#-ADi8zFYEHX`0bBv^vhC^2Mv2d=S7wWlsz&(S{#pgc&B_t- ze$3m_$HXFX3o$EX!h%SXP_9!Px7!MRy2gdWu^SD9B|8oTG_hgIQI3^Yk>W_DBf&q+ z35*pnHEsA^EQV%2E#5EWOd$e|_c5glOfNvgFZsn~vhlpIj~i*0-^uRr4GDO~-g;wP zTLdK81G8JKF2Nva)?DFA1CRLXV-q033LPlJ(_B^FRoKQK)Uhw<4j|?SrG?iI&@Li^ zELx8~nblJQ%<4_uw0(g(k#IG>vd+H@g9q4`$v7ed@tS$=tyHknZHy~z#4v?&ijuL$ z5YUzd7Ve9T&02Bqt(zxF;3Sq!={X}Qi9aak3zMje zHrV?mrB)b=3Ks|$R?YP*abJGj6PGQc3bI_2vdG-WcIRwXMPOqF!fZ<(>i5h+w!}dC z;uRwOo;x=)az98!)?b#LMZRjs*!XN-mNXDMQxfu;bvp9}e~-8()6xs%n9-3L<}#lE?s)QfY@(D4({q zI5m?m)$T3d@kKf6o8tXc>#*i8 zJK1UTfqZOMM5YBTjMT?vG8~`0P538!GNBfziXx6HoEHmW62f=QM?#23)>v#$Cv`!v zhUL&Lf>!0*@{Zkr@LhdB7vi(P8O{aBh#D0$2Rp|gspKg}N15vT0y7+5oAV6~5)orwW8Y_d*l85SAdH))IqQ_b_4 zP22)=NheewQPPwW={>sna)N6lsKhHu2<36x?xsb>G6MFSBB8$UgZs}pShb-s(n2OJ zqqfT_FQz7UeNbz=?LP#-6q0giOM}LWk2;N(JJjOUq0ehd!ptnX^$`mkcsph%G!yz0 zE#c@FHqy>V-Y#fMl?Lq0V^LW)PtVKg9W7(xn*C|<3yiKkGdABQl>U2~}Ob(}-g zw9?dU+*vDNs$!NA!=9a?#_g{Z90*L3P)T`{c`Lk|K6gr6@$l(!F5J6uL}@Q9_Z~~( zT|(reK#yNDsVa>Yg`uXd7c*!^aL(!ZU_<}K-ui^9fLO4;cCD;G601gYUm0&N2UZ&A*y%|Bvj+XJPrh z`yZf~-Wud*F}?Y2j1+Sv1P^TYtkh-0cP)i!cMMpN*{Et8GYmot3h$h!g z0qMXq(r@>3-J)%)-Zc>%baog0VmtXOqTL@1t^+z~p5HSQBY#Nyh+;QRVQ>7%Swb_( z6&o!}H*)>ca469OsAoOiC?)59KDi)>b|bUv-Zo@hrMci%F^wWI5r}~z1|}~?XC$ib zat$4GIvSwo`-Zb{wcVWFd*>spwfI4+?$64;B3M4jKzxFwT5P7Xr|Ip$LJEv?zy3d0 z_MgtSpMdSz`uf9R_1|+r0IdGMU)g`USpJ;*zX{e^0gf@xH_;WXH9H)D<$YV5aP*Sz z0O?h{AR=K^rXd2|VsHC5Y*VRmBRLHYyz5Bw;QUQd-r23X5%7@3%IX57{pM4}fGm#W+&A;9Zs9UyCju_(kFkgWSCk*? zSM+Wg?=TAnUniJ?5#1I8;QPb(aQCkuB;hknZ@K|Wa?g2vB9McJN2~Tp-96l^-#Yvc zM`-o+1o&5N3A)cqcvro&n}q?&e)8Fx0tdiYAK5C)zqI1~nX=D+3Jvi%$B?wLu^k*- z+IPI0-iItEtHitJ91f%EUpBw&GQSBL2=2EUHgb1j>f-QcW#4FI2f?9Q`!pF;?9-F7 zFZIfk?Mc~}D$}iaQueFS(`#R1)e>%BeduSy5geDYRUdd#_F>8wDJc>LaR^!Jm(46t zwJ2LT@p@>{h_dO8_cVedJO%p!%D&Q*vY*QN;mW~?fgT$Z2k)clJSeBMW3*E1YOSwG zO*>Hmv3*Fj6(Pr>CQVuiM@xfXW?kI0C6JeV_X0NqRZuxtt>E5y5SNZi8qmTB7_pgI z%RXr!G~Oeg%uDL!)q3H)!W=*9CmX?>GqP`fp^0hJsDthOuvir@7a0V2q8;h*go@*^ z*q}(niJ5B#{Ki5-_V4G@Gbm%o_Z&XTqsru^wxlPKOHT`pk->R1Q>J+-Rm=4Zxf~k|Tzu;{)cbX?Ab>Ome*YbPVqiJEwO7Iui(Yj~^p9 z2%%lgia^0{D)Wl!qA7cTebc*=_23Uuk4Nukc0$rJ4&@zS=VUKgKQjdZfBU2dC!+F} zf0)*r(sAuA|7_)(TOmA?;t?W5?!692=Fhw?5d7IB)yir{VMWQ;F&mdLb#J)?Hhua- zOCs@jqVY^xVO+n+=paNeO%mplTp6>2c zLnA9u#|WRp)(Kf~N0UKF^f^}az&+5ob3jX5lz{C7vi|0wNj!3m?_S;<wv@roDjJ>HUj9+KoT`ahA~NEPlAC?4ri0$x_^B6yX_Z1Rv)Ge-4+|>b!$%kw zmTh!HP!hDvw8~}|toE@E!rS-<>!6khppBGKiD0**3O^>?>*+ptKiE4~b2h!c z_j;Jyxn7evn_6kg>e+t}X|8E45S4V$fu11}^O4&CA1hT{JJ|xtL04`EE+N@RGd%-n zRQWu6w8MeyyscX&%oWGZi*Z%=O<-h3x+&vUv-jefGX(bMPZg)9jI!ZUmdn_|OLCtb z-&JtD>y0^kXU}YhpB{^D%N#h1lTmQ7m>P6$1TT!~mdgr3Bndr7aBXD}RXWc5BDPx` zfeW$Y^?8b-VO}UJreR1j&RBfScGVmPLl-z7x_uH6rI+Y|P&7yjdH}x{kw2w}6VvOHOu<7Nx3+*WAazW9Dj z-R)QR@kM7{%-JZBqOy-hm;vfvbnn4#lW=zdA$oOalI3&bMK`>%Ybs%1vN@{WT)5m2 zoaLJw{O3C*=da!VIDZ4g|7Rlq&zAIm<(~Z~P;2DuZ02bDRJi}&OD1pv)OtW9%um7q zpwsf#}zgA-mWuv z!jdyU-(MV^1ksY0u7Ok=5~I-*IyR6+tV)&2S}1pkCar6(Z(NUxuQl*w_ae*Sw1U9x zv{u)3E}ei6O}l*dfxIku{J5J63l72WMu9$sIV9G~9a@Hp2HOW>o02>U+Aqjc`+AA* z#8tU)D2@b_F%`96Zhei)w8F5vEvqrE*W z>ozvlR@g$90SPl$L=r-L_lm+77g6*|$g>`;0hd(y2U+g!3ykddhi@7tZ&l>-kYwAygAyaCp z_*E5e5VW5h93H{%;tb&%`1f_@yM{jv%dYm%TJyrd7_?DiG$?o7q0A_;IpT?EI^e}) z`plo-^j*ZJm2YqIu(?$*L?>VLeebkcItp51E481yI`sP{JA%pS=tKOlQJOGQL%oYq zM{K^wDG*<-B0a#<)p^@q9-;wOhWHuD5a_dEX$Un4NSJp64p0c4%ZUdVAwi6YQXnxw zn6?ptrJ~{ooNyXk;$RfoQRq{(Z{c}$l7LuyOT`fMK+EvtbqrieJx$;Nl(4O=z~a5! z&kh@58!gQJT+P~EoL|O#g)J|8<$T=L_r)lM8STL^yjn;mF6D@MBf zoXkUHPU|8H`yxO8dE_3(#+d0Z*4J~*Fn-4pIrFyZRIB9}H97Gioq=efWW%+5Q zyYW1)SQf5b+-C4R+;OI0A*6XKf4Q*F$!VY28rT!zD=b2GQf51A%JDhAKYnO-70N2b zJFudt8^}!4HM5M$<~q!j`#p3;)8+^N z@ZG0PI155nLK&G1M98}E}0fXg3ToxXWrTKa9}Ah{02#oN0{AMfg( z;p_Dvji^!2kq*aIuz`UA!S$H6i$PRV@;A`jMuQfGHUrl&HSb{O;r0iCFqQb4Tvn)< z$=<5&6of$UdqCu#THE8b*JI9LASo$ZI2 z>uBgdMeejOIAFax06Qt6s<)*g7g@3Q4=XeR`_*-R>yhG3Dt#L;xDIoSjhRZMz} zhvq;+o;WVJqadk`?VylRrOV6YXr+8YN10V;BH`0#2uh;5^b+(0mIOgeJLi6`6H&Vk zx1u~W$oI8IN_mmye z6e3D!B|-FK`Eij=sfg z6lMILtx9qTGmRhFz%&$XN5yMKz+g+&HXLoZ8bjc`nnW!p$!qy8)uB>z4l1eTn?3Mw zVD$iuiZP{DlaA#S9eWe~2$Fps!MgBH54igobr=JzHg$HVA(~N$9VlTa|H}L8n0Mc# z22CC@pw-LU3YMHsQDR~)V88(ScAu#R=e;|43>$GoYg3IcBvPm9y>=gbiA6k@#c*IS!&%w&dZE zw91YN%HMy0`MzJc5(;r9tq~?PjRmV;C|&JP5O?cdNJt&}wy_S^IOuHX-Q&iw=oSC@ ze)vJr(C*>GwRf}A+)VJg!&bL<8xF)GS_wg|krVwX>BWFFryqFeP%8HbUot`%^7ITH zOGC2*hdj$mXpnZ7ZL04>>?taT<2$F#GC|Q z_z4Lk_i>4!26=iWGsFm9>p5@FlxiOY?G-Op-jEi zm4^8w{Ow~vu1-M@ODQiUx%}8Ck``NYIJDM3fEqR*v9 zw=$f*phq|g_u;+}Gc1B+r}8(j_MiK_sLI{^jwo$25B;6ZRm0gs)A=H}_XpSFqRbg` zH*3el94`NzVgsph$NQF!-0>*%biY<${+Qu{Urhav3*67GQEPNv`Qp)Kl5@;FS0 z-ZvVqd|r2TT zgoIwRnH5or;WE23Egq`kC{3^Gc*;-EguZ!Yig?d2zqhvid?Howh=SrD4VI4MQu<-q zL|iT;e*qY!57*i$uhrZCiYHDrKI@GkYsqMz0lBZeqa!;O!SFqSBLt)%DSk78OWMKt zovUY!R+sw(zJ|gK84_(T#_j2pb$JQbSq@P6n-Z0p8jv(_EP(Ty^2k_+-ow;IRS7-* zZ20lcjrCHsBwVneel^U!ZVH9mc*I}+%Yb0Dv7g6VO;4a$PIczoDFy$YC8U3aIN~{!XVUl&W zGoriDy|Fi5c4PFkE7Mh=2Gdf{Q!aR=)2)^>G{g^wSGl)ni0JH0>8y%L%WIg7&2cY= zWg1BYV!mn%(Zp(Jzg7YCb>vnoRRWC605&a&6sNH0)WW{9m3&3>9gn~mf5Ru7+}_Lg z9embcexNhc-ANCuBXavbuPgGWR557NveLS~?rZgy!$<5F;6Y7Uc3VpjSE&`y%_4~z z(}-Qu#qU2TS%J)X6VFD89bHJtu_@J{Ks~sv?snAnM}>qG z9?xz;+MH0@1a(P_v-faJ%*Gm3*Poc-XP{m*2c~{cA(NwjKXr1UK2|FmYRN=gh1cL2 z&!=-~$ErA}I9S-d&umBS0s%>>Z5U<+*8%GdSZ)1>FJzkRbZZD@@vCpfiA7{vU(u82 zj>Mm1rI0M85L;;3?+p<*xRORKaozjdT%7Bh=xlwgIi56XzG|oB6qW36I%I=EqYo>+ z66Dgie^&1@c-zNq#hyw&UmfxCf|FOy- z7eM_3G}!*cP5|`}F!J*WP=d_$=MrQtKnXI}pGuGcf6|Y?O2ygH#l%_B$kEK!*@=*a z_3z@Urx*R)JD(k!Ow7!Gu;?#V_TSyFy~hE-iV+a~)gsS?QOPTS9SPPOK5w;09Qd(O zNEkG*mR0W5pt8&sdNnk#Q3Z67p(BiFq#tIpf19iVD~mHnY1F=I3po$1_)l z2cggB$KQ&^qUY|8cb$Wc_M)dYVe=WInqE6LZG3}ZhlJi9nP9FV`B7y&I0Gk3lHk_2 z1DY-k7T_2pROa}FGDJut%E5?*^KbdT>w*7V58Q8VVYd*7XgOKpr{KNtwd$%RjkFI(#mvU|`+A!hot0?Zdbl@hZN~3lRG;*?AmFv+34qg=m*BZ}L(~L_YfQ~jTibX< zek^O=%+boHKodeO7VWUyegc7RwS2Sh7XDC$Z6zBO=t7}zS!-{&A6`#F4~&-1Dx3;r z+C#tbdCfydfG_aw!|K8QX0poHM@dK&&kTHl3?G39uWwF;*1JlvnUDixWj}@7-yggB?_V7rE~T$zwsox9I-=x$={`!b`QY>IZmt6G|0-~tp7-4t zeDD#@SY5g2e7qUD8!IZUm-K{P<&%*Yo9)k+^d&E#lZkmPqr2U9x4z?iwMme*=Iwod zb624ij#=maVBgp%!H1-P(3WLig^+e#m9Gl7@&@20%U`@y-qMibBx}o z9>q&&lz*`z%rVFe6c_EByf02mm?BwU&ytCT1=N3Z>qG8IhArA1?Yf;RUtC)+C_W%>~$L<&8ryBiAxRfDCiQ6m1*IsqI35;@sdPA2X^D+m7D zMnmUeAQx31Y(OZNqACW&)nfN}M>TJX%BR@g?iYL@i?Mqgx97MvwLUlY%BaH)_cyQJ z(4C!`jD0C)<1L0&FeGLUU*8@wM534siIRpuHPNH#r4~i1x-Fz~tkUl$VGjZxeDTGJ zH=6?BVrm$r6`QG-N5mC~8<8AW-X^6x9_DWMqUn0nnZTyqNouxWh0c0~k@nbD-#CE; z(uW%{&^8ZWEZkk9Zsqnfc8?!-DcdVjQM4%X=0hwDsd**!OW&RdXgt?pN+M8dK_rHB zm>#@DyAiYQ9^h>DU9yUVJw%7sg!*h(#760^kbMy_U*+_^d>xLVm27(A5*Ilh*8-erO z=iE$)!Kg!`DqtDk4=#I2Ewgv2q7-1R`Jt`>`2mnI&L-GI(^i6fxi{wt8B)_otJ2&F zWI(7oOOxb^Ztw+U9>BRTK1VRzEhur6X_PR5@+CEEUE77~&d#Nss@dx8dYZmghz9!} z+N4flz3yJqD0x%np7qc&d=r7S61Xa0Wo6V6dd7Rxa8DLT#UfkCdazJ;MxUCA03`KR z)fil|xJuii6kdsiM*_AQd?&QJP_&1`jc$vGN^cR@M9Zr+u-NX!_wY+asfPY zb|h?lkP90V%srYeL4T>2ZN5I!;VQBLjSgf==&+nMRT!7p5lp)peK^cv9dGr!PUTuH z8QMQOkXCdvGQM)QrSo(6&`PA37Mzc9k7D0d56)<6Bx#Z7Gj0TLfsVO~u8-+C za%I1XW&{?(mT!*8gR#>?wI;ZqqayL>Rru>-9M584%}SmkuI<4lI*pZO3!Oye5Z&8tl)x`Dur>G-jqGwKEk8d}0OuKo* z>7q*%{HU+hQUKk>60S!CRCWG#Ro6gR3n&Z7^*dTT`WCshuaqS2FXCd`40f`1JduW}?PIV$5$HSIEf$J_1`51m6H&A>|DT~_rGbTY3bKd4t`YTzNwnQhGig9);W zy4U?ZG+1d!IQk3vgKBDLIa0U9kjdEQ_j}>38z{*pB@B6cHnn&d_N4{8ClW3D$2P`3 z5%@xd^V3u!IXVe+k-_P!9sExHuQR7kQVTq3`$NkuI6`}3r}M82JtjhJj}~O zk6%8*TWag->p39dYhl?Sa>zZ*B5|jnW>yG}z$r(RO5;5&9x~f`tQSt^1XQS4>hiR-0&3%dF zG5v~$5acGJyna~_P}vHXbRb@PVs+4(C$#RLK2S8m)4W|k6De~pvfd$6k%!Qdynhy> z!{YVvu{qUaUEV0rDR?zuj@O74rILrnO||#b0kaD49J(|UvR=qKRZP@snSqz!tvg?1 z%VBpQoqzAcE!f7#Z4_3+!Q|l~{MpmI2-DZz{j@SWmfJ&@;M=hI9`O1}0Z~P09q8>C z@e}FjQl7a{#DB^ob)OrQlgi9(5?1w3YS4lwG9k zU%wg$&X%%n94J1&_i$u^sC`c%@?C8<-aHj{O*RrAujOc1_Ilpb_ZqRcOdFHuT2KJD zzneq^xMcz)GigpFoL)i0kn+8YiQF-zCYvBPF3esrSv1$Q6M75R$j}bPBZW!1xsR@% z+B!>v&IfZg@RJ1aQeiafYnki<|9|Yg1yESQwk?PR0tC05rrDvF{{A5P2O-M#nf)xAGx z>0iS2e-N$?ORvzxy?=#Wy?jzQ6nGyVD@5UbT)<*n_`iVsm{T%>Z{&s@xBA)V(kK#6`_7!}<7lym}a*mQ_J5 zayjHizqr!1SeN8%+z`HwDa1M=cMQ)S_9!R57L%{2{7`Tem(cHI%YRA6kM9`;#(136 zID4b}z78$+zCCPB!nOWR@74MkhMxXrdrfuTJto~iIFTNKkZv4A)M!hQ=EY$XM_%$` zK5MY%WVwn9uEY{0fvbmGBmrL|ZI36CG`M)2H@a&+gw!oB@Jw(z$H>*gv5$VbGLy@M zoeA~Hjb;B})8|ciCzidS5(~aS@zDHe_R;;7yBr$9Lq5^^-Tmb|@vni!|HdL@r29() z_$Q|HU*I4k-T$NO0RN}wSuoNu5c~~c^A7}&kq!tq2t4^`iU~;l^Ay3~9%ck=?7w;c z9uH*x@8N;}DCnQE`xj4+o|WN$vTFzaPf>#cVl>6U`4Ig#4^cgQ?j9!Z#%O51h_OK8 z6BYmR3kD?&rQgtwO$oXF-ocD7r0jVATmJ7oe?znW^8O(@g!sun8zF zs%dttY8`(|G%Ni;@^>7JV}FD`Or0N%HeTOD*@wtg$X2H9fI9#a^7w=QjTrxRqxD}W zhyMj5{uhk+KQv$f)&E}t2GD(*H2ydG^{=~%|Ds?2)5D1WZ(J*&MIU+FF9>Y;QW56i ziFJfz@Ul?~{+wi@3u4RljBb$=59#)kMZiejHGnD$+^Qw?PaysD#Y)PscNJ5QT}y4d zpEWA&-AlQ{SiU$h9BhXh)$65v7H_fPmE?w+Wm2swMp7FMheD zo?NoOE?Zm9*G;iy1|1(@bqdNBnGrlJ>f(T9x`^WirTe}+9 z_P2cvZ#Hgj&dm$%XKl7sXmZ457;{bMv4ivR+1d47za_25tj0|iYoz}B2dUS`#?>Gr z`+z!YzfSihkky4zE(DlAB-mjofZvVHp*~^V#so>GN(!Wy;WeH zb?Nvs%onhBwARUS=v4XY*LJ>GEU2y^_Ezow5WDrJSO7FEu;q}sO@WG5NUdzKrHz2# zy-DymGvu6*d#2kQ(EWUV)n5^ViirEM%pZfm<4L8<%MMA`?ahaHj1JCbjjN1{SzMe`ESCQz_6KEdLi+eed6s{bI!=EWELX4;ssydSS?L zwT~Q;*wO^(*|Lr%u#P9w(q9u#4m|eUo@4ax|VMbEW05Af}YJlp80P$?bT_ZBvBm zq=}Tcewvqz(U>-ajCZ0etDpgk_i>hTTXG9j!-z*I781Y_;ihN2Kl}TuJ5(3v6M`5p z8ZL@s_hgIB#)aL?xPlMKW40SWfF6t_tZf}Ff$(33HGD^BTGy4I<*1I;BR`Ij;ygHm zX^x{k*6rSbaZeN$#9 z==Bxi5v+{O6T%_)r6!(LD}HRfmXrG_?(;C1 zn(#b7y-d|3hy22n?Ho_GR_S~LQ6(W=;=S>ahI?i&W?!Zqm>RqYYGxE*6oZ9!I!@Tl zM5v>16OC%j*T5aY^G4a6t3PgP#v(AUk1m+UQ$A0(eW2H=l)%v9g9BTTYbSro$;)3b zgBzoxKUL^o3YRK%VJNGaqLd^agGY`(a68dW!(2`_GFzN3n&uXa3|43cosjA#2sSu_ zwOe0Q@u#WB&eZfxZcO_EqTYZ2r+s=O_e|BcJ)SYXbXyHGGJ(TATNWieO@t2&i(HR% zI228JTu4fjC8NO77k|H_qog5+A3w;Pa#4-&^R0`MW^k>Uml_7gVZQGE*i_G1HbL|R zk&zXV7j=l$CZrsw}8_rWk`S31+7o zo(#Ec4$!{JGKW$bs4$oTxe8Trs^7!<1>#iE5`Hi$f!pd1b5rxs4F>-%DJy5o5CTlgVRwkqUm0y%1K(9F;j&kLatMm4#{v0 zoaXpWR<1-zw@h{)s~fTKV-XvM(`zQu5(i|YB@^@FhUaU{5{cqJ)N1aKdt-?&V%6Zx z6PM-}WenFsNlOfh?T6wGQOpx*7D{!8_4ZGa##}MeifUG1zyf1^S{{CQx+`SIS{4?p z1O^K0V!qT#AD+e&Y1GX)P;WASfDEoh|F;{LjCB9XZ{V}CvIbZ)>I5wRNvdH12sVG6 zY1aQhH01t9^84T64Elc%Z@&M3gzE&*gczCs>&n6J!q!&*2sbE94*&)%{|Oif(*t+` z5clst&;wz504`wp2VC%7n4Sel`~#u+A4+dx1Pz@oQl=OIIWf}zqr86)im?3mL6QFh zeZthi{->dxfVHKKwG}|KB4GQg6&BWZ@;18qhJQmsiU|nt>)IO{01{#PN7Des`L`yG zsG+H`i30(^==v`2sOR8nWB8v@BY`UYN8+D>Bfl$~8aS8`umBzRUDD9X82Fo>g&k<* zzZyd48Ixf+^N*b$s1S=V6=-XvP4+R-5x@Pnl!kc-R}nvb^_4_#u?OqcG-A0h0z>8# z`>YG)!_*T^!!H3=3-uK6c)R_KH&Nc=(b{6rd3Bx@NdC`4Dwt9Vl+#!WTav+iT z(YW#AhoR1o%QySe_gQ=VsMp)&&PC7X*ZJu*N*KD~l*GZ>W#>j~?bm}<^G)~H_4C!X z&eryJ6&e=qIx)BX`DyImuLZ-5)NucaDZ{7lF^#I$z!V#{cMf zZsT*k`E!4f_Z29x-SLAG#I}h|&*g98VRZA*#TuN=ZgJ6z`w1wYi(rGx_5J1UObckI zJbGAvMtM1>x_Z(#jkeZy?vJds^^K0!b`N9o)3_*}jrHZ_JB&?XSI0X@l--r@UW1E^ zKgKKGZXT6?yzi3(1@z-J14XngbGkgUnBbwFA#`%LK3-i-8h_|zc--%5XKlRTGDa-g zYP|eyjk|k-=-?sH1)QmkK+fA~mQncC!duZH2tFX6nycii(@s1a^S@c6mmf`zAICs( z9WU446EFV$@#j6N(km5rHV@E<>b>swcXysnhwYu+<+Ftvp|mpg%LA76khJ`eLB+3>hgDY zJADL{qC3?S=un_B`bvZC7v--qoqygDXq2KOC2rfS*1bk1{EfT)UTEk-(Oab)3r>)ZS&nch@)vmW8PkNqzX5*_FhfUGX`Yx?DJAm4f<9qzs;Joa3oM^@G z_y9F&QlY_{G-9pXY^trVFMM-3?&-f4_JD^l-U4dp20@9^i(g>)>1V0s#zFfdAbJ~H z|5=7oy>JF!Hx+6?0-EyBog8kx_MiuU`v<7OB{x@}pkAe~$KC#;mk!SM!P{l$N7t9` zm?Ee1q)s4r?-qD#c`seF8ITm9KQAYPomD8dCRab7lGF!^4d9oLGr)hl#@b`Dw-e`Aw9+@9i_U@PAd3jo4-PCHavCVke{S+x7bcr)G^d$h6O^+mY-RGwH z{j|GKq@CV}m|`WI?fQy#cM!a&s`azB=q~EpB>Fxe_Mou5cE6+}cMy0~HVqtIf$O>0 z`##JnZd)#2nnQ512Y9Xb=QC}t0VEt(m9d%ao#2Aj*Q0)QJo>CXrY{@P^s=MZC;QZ! z>m6^yBKZ2UTEGzcom5%2i*F|<+hqMc~4`+oyUtStsM|8AkU|Zhx7G} z4B!V)MW81`xIC|y4=>wqFY2v3-gasyt+hJopZNbi*j?s@xJMuPoyU6QRF3AWdZPPL zcN}9S2Xq4i0-N;pk5lotmm*9|0(ay2xLP4X^3XnIBQ2%XA6ai<@^i^~8=8{jcRxNz zt3>VK5m3|j2|WQdzEwWk3iR;+tMxa%9Qy;zOMS>(!^iQ@?w-Kl{wq#E8G)L3aHWBU zWx3zcXU)L_JQeNu-Sb(F5hJ3 z9+QIEG6V^O2F0OQN&l^A&H?oMw#xQ=bV_CyAY3l^w!EG?y3hmG`eZJ}i4w(v)_WHt zlepZsiB1}QoQblH@0}mJz)T^XIWHz%1QH4K83<^l$1QE<{9g?Vo8&nxXiWgwrvvqB z-cjIOrhuHAYB7Y|(y`utM&$QgA$wt`wc|rWuu;oh>Q{mtsNoepY6Dc-#rAofqBW8Tgo~1miF(kb9;u#833BDM{;v86A-5D z{?I%zpTK*5Z4o$`n8(D0KWP-_RWD1&;Vm@!IK@Z?YULK57OyN~Er^2&QdVj|1No!? zN<;N1Rs}kNJaob1rhDB3%p52%^k~lb?OoIoXyClOpurpcw^8pN`PV7YPOjKIy}$ z!w*iMzz03*PmYuz-u{Z9^^HosmAotrVjm`9ZU$Pf_>mmy+|V%8^$aMbluCJW#1s_Q z(&k`SIBDE5L;=Xed|Z1!BPHq=(H028F+fSleo3|j_|GVe>l&b^s~uYaV?lbE`FhOI zbOTrs11|TAh30ji_MT5w_9!N>oH;8igfhcy6^)|i^iH`a3x>IdU1R(8ko3b+T?h_- zUAC*00QHT9drVBaBt7$J zRj-<01w;GqLg)4@{>$!o{FGJHexEn|XQ&{^8p7s>4%nbmH6EXOAY#62)FH#DZSv1w z(sC5JX4|u|H4qD4;Z$>v!>-a4CDD)S{#EQl6Y=~~ zw7k(hTB|t1Cm$#kwUa)&<7GDy?c1lErsd)M%3`J1U5(e8P9iolwh~3gk!jR;0{v@D zc)Hr=tctL@LBWfF=>Qu?>$RRLf?rzlYy|0fU^hNf=)Lzd;G=hZbT=K6e2!f_z9zN$ zsYV8>bcKRB@iCk_1c4RXD*!5*lEO$2Qa1`LHyk_O{Pw#to%=35c(t-~76xVsYh)|O ze%;f1^Sg*s(HcKd1pDtqHEd$}DL;2>>wzxhhK7@Owt|O1J!$}}fg;4Kj+d7Q=>SGY zt4A71L@|l&a{D;C;4X^pciTU`&p&cDuQ`mD)|abQVvEAxD3t!rh=+JM%fIE3zpbWC z6eMuWsSk=oW@Qja&OHOmYvi+4;Ha4IE}(QC5J=Q~$U>MgVmgo0UrOwF+V5Ytcy;?v zGzPKy5oqE?-Z^$X7V^`pXk`r2>3_~p2)4M%z~abSnULV9BKnrQ;dR+!#E@0+2Pyl-|oePG(H;(yq`Ftii+#S zoj4g`ki|Un^&{#?*5o^BdG#5hk3a~Ktpd8PASdHO8F3fYCmY}na{En zdyr)?^8AzJ3b1$pW8&&Eqnx&dDw_1@BIEJ8vz3z*m?`2QL?Am1w9om~y8y*gh%A~L z+|$a7`G)^@S*H603}C>PjIfk@NYFvvgD7}KZh8g`OmN9XKqvArct~1kgv>6i-bR^W z50}Z#VLJ3&>>_)+BS(ERkewZzf4u_cRYEec+r3y+IIMnwTn$XG zL#j$@HzArKM3N}SA>9j`1X=&}gj1afBeWJ|7wN&@Sz_r+27RTQT9{@UXDu_uL;e+G z$K0Q_>@0n&SM7F;tDZCnlli;jDUun}AjdJ;hgBe^xD9l}~AhEaU0?Yqd|v;+v>K z(?!9Tug=a+x$qXUKb;#JOY*}^M2B6?3@Qr{b>n^L72c`u==ig_+Ii(N>WY=LGKK;~ zlDq<---f-Rteu>lkei+NuM;YzPqm6#GA%Rh?&274O)nLk9QP_Buv#m(T${mdFJ&)e zFbwvo)KYEbA6;1d#Jt%XTRz?5KSI57yn*vTc_aIKRCRvW#Wgl+P_5SRrS1Nj<c+25QTMF<;)Lxp(^r*xTSJezm^88=wKC;ctDnn(-B z8W#2rIDga1__Z1OH5BBgXUu zyPa4HIQOo-0KDzu2`rOY{q>M^!vlcRRBtJ@J_$NQ-{rTp|wXkicnwC(Zg2J^-b#?-o=kpr8)zkYiOlQgnMb+dvMmCCjNoR}K?E9h8+osq&QOXd_VIa`hTmW`un z8zM3&k_bM_SLe{sj@o(%FowxvX~0z7(Db)kkA-I*u*{fw+FBw6{CVl1U@(liHOd2( zwe2A$yjG=a-rWh%Y*w4Hdu4i|W?~}&oVMEf{x*7O|G;H!Q-{-1$C9QZs@;QvsxLDU zGQ-f$FG*Ea5+YB*l=?h)jmBgxs+?+Jr+z^7pc; z>ym*+&S$l}8`$?pQXr5Nrj&JdR28yRw&h`MWwXp;yhioC&Ku-S)BXJBd7Skrjixjd57t%~9)A~@IF1b=2e$2%uv-v^Xf=MAdRP;w&EO0sf+6uX zYdccJ=7^)}E!hP!mgwl^Km1C-xy?fw@u45G;tTStRunM=@grR@$@Y1Tm*Xz+TS_$I z&)bKR7Lp;WV2O48`Fi#|sy`oUbpYIBj3UklM-7qdDXley92}Pdz91N;mg&B!8;0dmD8v~*7GpZ%} zaUg5u=y!%#=^|&7bguTE%_VYV6HF!qhteZ^Sg9F+nY>^NYOG{=hX=p!m($E-HVwKMPHW#yMF;0Cqv~TSb3#4 z{%Hbb@JlFlS1%{{AnI-(DwcFl@_p+9EBkTIpf41E@uvXJsDK7(#Hhd`IEI&sG&3&w z3QB~DPx&Ma4|^})Depb03FV66I{ z7PA3&L{XAV4@+H+dG#%K&EhL|f|E9Xq~s#y7mAbT4z3v}G2y-)*Tk0{_^%?A4k~1( zCScfp#DNg*zwRemMHfT8A_~PVF6WE=>shPaMqu|q{TZi|@M0EqG;nc-k?b(0X(=V- zNF78gVs4>%YS8Ed>Thjy=YH0#Qqe_1tbHE27+?FiA_BXx!1;`;EuJR%t$wf;lMDeS z=Q`bhtWU}lpDpzeal9g4TlU&v8btXHw0ZCLQ#n^Um;3MUd6gKADrH5dZ8#6v6HM)q zWTt`;uP!XRU#1J7DF)wo-ymmA^i9RiWMoBPetyUDD6vAlyM6$!JRqepOLK0 z*G$9#7~%?B{4x|j9yh^A-reHyoH(L9H(hfRsncUNAgzuZYOl)>!GBl;jtS|?>`n_7?K54_Tu+}e$hzW3D~c2|4Kr>M z+^<00fQZ$zM|^E^h2O%uH85KbBA*$oz(RkeriyS)QYhN5xd37luFezYF;>Q6w9Zg^ z<4-NyR%3b44ug__JRPA-3XQ+76ABewT3c7ku{zLn1DW45%##il*3XAInnyqXIdXbC zPp{y2{CjwcfdzqdftRxn3FZ-SMqu975$5l z<;^Kse$6J`W#eUi-70hS7GSbiVCa>G8{$Ia>>Jt*U-QT@ZeLZ71=;MX(=dOQHPua5~WN zSKeuTTo7nHWus(%w~Ly_lrUc0z6vJYlS#9lYe1>fP}%w}Zvfrm z)MkExREb-p96JmS+rxWgcUe-s3;{=0)kBqt;_5~5r@YlWr+f&nit`ga+Tab7!*|Qm z(`#bdj^xO&kWUo(7&s4_G}4Q;#!Xdt=RHng4G78KmB8Uy}Mbt*{k$kJ`XV4(yhe;Zrsxagt>mHP?4Mr&k>V{h!Pba+xl_LXd3 zn1k6$>X7%)2T7YLU0=b$6bT3qFF{8kc;88B7=MFL9YryvBcuxL3!%yS;_%bORKm?M z69=Cy_DL6Akcm_;AS0{ssw`GCDyUrMFn$2_Co-jNq86zzdC4+)BxQZ%3tj5K{%CqS z2b*|qE_6vzMSga75;c$0#iv9yYQerLoRYLE6VjEZ`#5ihn4d#2&IgSkTB#{^#872M z5J_pI7itDfCs-0JCwU35iLeyQUzo3|XOl8XB0{_4=!AIFpjR{%~~ z^6$w#6TM%Va;?bRb7(lDXi}}`ZOgGiK{Eck!lYyQ{aC{eJ-Q=Y*Th29WwGVrTQV|* z-JIv&Ee+Ub%1J*>KphWwJFZRizuu_+%XeL{@$o(UEdXdHF zsO6(us_`O@$Op;IShb4OMDBim!qECBmoss9Qv7xmJGcd*2BvE8&VxSGw!gK2&6K;q z6Cvd^wNbZ;3M-w|?3CyciXNv#mD^wsHGV_nkiCyE1ABhTRcA#WA*yCn{F#7~*Q^ir3O z7%PJ)HS0KtKxX&e4Y735#g~~S4&$UU3aIHjsc#5z%<~XUWc3dMSKp=K?w$9lq>rxZ%%|1!DKj{bzF~(Fa|O*%L5t)AwmtcGe^s;_-R%pFvZBa zW*oKrFicxhM_U^O$lm^7I{u9ryys(B9X6&hN{b2wD zWZkahyCZJ!9JQtmVN+z0QCAdt?aQN(rA;YRe@5PESf{YbBf#~hWUoR0i4w5 z;f<)xs6XJjrTIsD+L$iP4e-H>_U5|+wxUL4Nt^|{7r6x|63ho77c@J0EV6ffYDmzh zYR9f&7eCkCkk*lx`a9JoH@@mhqGlY#6b4g0fYnnikqKr8GB2IPsSrfX3(unPo6^FY zDO3~k)0EVis&X6@+!X;k6;{SfDLKMe>V?I~ZY-r~Gn#U!F2~-qON-(W?76@7Q250W zgmdADQWTq9Uq!8uh>mG871K(Cd9K)7CzC#w2{g6WY;bdiGVWeg7#TR&>^vuKNBZ z^nMU7a_%}ojcI{!fF>ipI?f?GKEHs7HqKaZZ;k-GiwF$EdXe?AwKxVHL* z+6!mOdX)!s6;ruycI7u6%miuO-oHFf`Naa=jw3|aDVP|E@Te2bg<`)u!Tm9e3V z;xeWN%8czIf%GeMLUw4_jLV)-Dt$sm(CT__G4#TfE8<)_68$Zru;}f1(?{xRqo!|Q zMWLQXMdl^@P&k9)GommpOz=lW;Nb4ZnqkZ;<9%W!t)`Mp5$6TDzZQhpnr7+ceP($> z)nr#+#wYY$$D%5|`9>j7imK)Q=R_DJL+n z$%Jcdc{QN(1Wq9@zqw{+8;lK3k)d5Ei%)1%O_k{KflDe){aTcmFDol0>lJ;UwPMGz z4<{uYcEg&gX|^k0Dj;emPE9FQz{O?O?qG7 zg}@2Yh$mQ0Xo_&>P>V|jGds2M;BL}YzmHbM93=GP(p&#*3O~=%yAg8`n63!^nmH4H ztFOH~u;3yQaOPnS*^X`)TVlSg6PJ&w*%Uhy51S=Xtr7t@AHEu^5To|!L}ulL4_Djm zrCy4m=HE~31>dbfA6%m4hU^Nl9G+0|?zjL6i$)rx6v*2^7(zIp+E z^rzc-kAyIy-NRtw{A|DETQ6ty z_)v&+2(yHKUbQ}gYnI+|)Xk>^H(ghE(Z_&1g))^($mHH)a@|YS zxqptDl3u1vT4Eu3vCG@s$Rws#v=JoqMM*QsXZmq_s}2LAj6DCVugu?J-vpXgDAaCP zg+}cYN6sJ#m{6!J5k}HJ&BM@YLZiXxZAx*TbYd`X(PmiN`E*df0W91tt|->*JHCJuI${Iqhj-oP@%vnHfx{s zN?&V$8&F!Q253bx_vN}^)ELpXG%e`NMmf-o+%I278*O!42 zr2hUrD>FqJJWv6q78RRAf|v$7=bTbqx;RguLu2slS>!vM6%w5gzH(`EZ7GqP(r(yD z0P08xlwq8ks{$-zeY72G=sZrf^{=u#)_xOGs^gaYP&9$Y=`i)~`XeuC7X8%20&z~c zwnWXdR~5M+F#|#4?r7Pv{Ux~(zDi+nNter+lx zW?>nmxBM~(w#XxB^~a&`)MCoKmB9ooi7|zuo<_p_3E@T+_1tiezjo4yJ>^33Bh-ik zSzNec5HhjDOO}4F0w*-@nsncv-w)WA@yUlcjhH+m4C)CYljub7ei_i!vV=xm(c*+f z%9)KYpMQ9yGMPem|TX!6}|o zzR1UV!zn#ws1c##k$o71L{*c_+6v!PCo9YjDkIJ}wNaNGTaI$Cd}YX$r18Q3iZhOp z!{JQ?|K)9EJ?FqI6zRaM0z4A77cyHxC7QX$V^LZHy#$$=`@Nu22&VNgb zXg2yZC60KqkmD{UJ7L0-8qaxVN6Hs{W?Vg*|0`S^!RhDovz0=@wi>E;BSaZ>)} zBAF3l-hArYhx?Y_UH8gX$ycN8o3Z`p;j5g$^MTQY)@s2^MlyWrVY?6AV8!gzF4 z!@uY;R2xlM=fy&JbsFu|sANXT=3+*?7pskan=RLygA54~_hP6CWryVJ?obX22W4JU zDz;-H{dR%~_2n;ILX3+B4co2W6WmdX-=jl8ZXNp&cN!1-Sq8^!F}mbR#b6O-dj#$qrbI7RtdtV)B^J9Ia*AFg-IpFrS>X62F;OZ z)(k%Phy*s;bMgi;2e|$tyuxMi{qw$WV$(8I6L^nJ%_FGdd8RS(>T@ivd9c{`a09>T z@U}e_8%vi_x`v!tbD-e8iluH&$syK%lJfa|?t$Kj$?o)xJ@RhA}V~)QW{d zpi+tn57;$wb7c#EB|WZb3UlQAMPuYb;>swE<;k~cEf=! zNrQ%34_n{{Z%G_ht5Aztk02+AGBAgW^a*!0846Sk9>j9RfD2t9mShINC^HF^ziX?8 zaK$Z=J_P)n;06=m#kdv;G$!?gSaGMAhAyj>4SJXvzBYsrEiWgAif>He7+dDkpeUQb(sX)g!Q=dL0x>D-{BhrEzyWdUKodTnQ+3lmzc*4b z;ki>?>+4U85`dN&f2xiQ(yE{!{l(4Ac{o~T-9M>j4^*Arm*!R%t9(gn7{L?Tg{}!v zo1zg0@ayTUf$h_Vg#_JJ=yEVuDQ?XKFLqq6=~(7j$~dm%m1t73Iw zY7GTNp>M7dig^sjGIMoZBAt>v0s}T|SihMPg;{#8zSwYeAWg{R;=9|7hza z9wcvoHF(<5nNeNbe=?1g;%(>P5rYmdR*#hVr)%+Mi+ev+X?K-pt%{55tU z_lIy#fg!%Q3wNTef)(@*UdeQMD%+7b`et<(QmhtAQMrU8=b~sM4=+W93=E^u@gTqG zkeT>guQFK>Z&qT}3F4uaU^b|!hv8!Wg8)CSyAGh@!PXgf;rv0}A+73ltv%2Y$aIwbKA zfSmY9>KruIk`bvVsp&rYaMOkHxsdNK!7U~~qhBBw$zLL4wK+MSc?{V)Ua(Ny<@cLS zoXnYxKhGfDnfWz%jfzKB)A%mr299TXoI=+4p*@x*3FA~>LWfSlAD3&-`Hje+FuBs@ zW%WLVL}~XB4c;5rC36h(f(Xp@xJ6%FSi*8tSm>-s2KIAhdyl{8T#ll5CHW z{8mZ5@Y3tlNB)IOym=HJCaYIads56TFiB;7&5s+oKIg2%0E0~SqN`W%o0E#NrL5?> z?*y`SRefap*QSoziC5TLysKmBR1Le4>C3$(e_iH|zmA=+Et|sON8HQowt~ME^t&B# zOPNSGdm#x?;5ZtornVdMji`J$8quT6fh;VC3#0~1Ec7V~8+@&-k00p?DT9PQx!YK8 z&7s9uS@GaHThU5K9q8yB)|`UH3UyVglL;k$nmhcp%!6qxYvmrH_6Z#I=$eH94)mCa zD|+OVc}WVKZG#F0z(8kxFxA5&;-1j4p;0~F=?M6tnAi<;z%aJzF(>At*s>lQPo$e2 z(tr_cVNvY7bk#z%q7Gy z{-8v#m=+YyPNizhJRMZQKM8{%yGU6!7K!nQ%Qw$FF5;?5SaTuv^;}#r{zazMI2&YX zj*r&E8mO3p&jw|35F&WxH=>nuOD`m;5l{5uFl5i9#pu(_Ehp`F%zk+7&yGdWzY*=R z%Z_Ki5f~ZE2PT7smX=Ty1LQf8ml__JYviIU6H@Tmc)V~*&_%jjTd|0~r9mpgd&EeR zt`*F^8W27z!bx_w6l{516uovg3&ghglJN0x1yfX#n@{zwpFubh$dL5bJO%BoP2FPK z+3)NN50UkKN#o?g-)Mz|No30lhxB1#`Vjq0WswB#!9}cXa9AAWFmirR*kt{5tYD>~ ztZN~B0F>DRq!BbPyGS>TB~o~yM*~jvWllV`) z8KC6Hf3Ie=e%&*V7#NeeU}{ke5xT%_J4=56c%?3Mox<11NZ` zXj~nL)laSk!YRZsYlg_a{WWjJHTl~+oF2xt{!(ZL+`gu9!|G_Q^F?wO1{~~kjA)e9 zh}`ojpYUya8DRfZ#GEGl((NMi%s!F$O?WbCz${2KJMi-LMqLj@i~3amkypXF=;1-S z`|AOFhPeB*QF!0Mj%L=jg{Soy*S=RoC>hjlZ_A=uuzzGoz+j@c2%267U^ zo@@+GMin)|VE;m+Y84Rm((d9VTuAA4(ESuGRF{3blCL3EzCMr`^~QbA#eaX+U63G}uY?`Z$E6ub*HUkV@ z%?2iG&>E&D#3g8iS>8>uU#1v|eF{WLGTGp_Q((*8T_MjB_w+0*@bO)07O9$Bju;BzPtI$Mge%NoVbUSenRTd2OoJWr#(i*trj$iY!T zRjPW11KbIo%I=E|*I3nONHq)zW`9uP^XGW7_a&|3r)U_oB4gWmv8Ya@l~PP-!4%y^ zhfLqXYA}I~hjAs)TXtmmxVM^8A;~?Y#-jT(4(Yfs40SZ?jooF~E$>cJ7T-EFvPq%| zNz9;g*onmb;ut7rQky-o`vUBFR!DEPw?AjIcb;Ke*O01><_+>8<0b6pDsQSv$aDc2 zHWpvQbZ06uYzAXK1t0KHPAkGhL%8ScZF<$_um%l_T^t9_!eM^GeazZ*JNyhTFf$6Hk8Q z;gx^kMEO&F0}>^AHef~aLMqID&W=K#R2VU%t^AW2x?Id+bBf60f{(ZRp^x}L2juP= zWm$9K2m5M*)?SOtuA4&BR7eC1`%Tnp>GtO%r zm(%#~+K=NuaW=hl3vEA9x#q7?s$8zle{PDCJhF9-MrP?x&q~dZQ-ezNBhLx^D)Yd^ zxSH8Z86Ro7=wl?L$?49Aq4kCAwRM(EO7?dhaA5dmMD-DDv}`y_dT zP~%QX6S}jCj|p%JyxI(MDfP}a${!Um3f(HBVT0nIRwQfm+1K{S(|$n0!K5mA0Vg`h zd#Bea{E{LZT^>&m`p*9zealCXa49t2Dq7Bm@}$EM#W5)itRa)z3r|4rQ5*Xw zcOxFXJfDBL4o?EchKTn4Q zt2`0P0C_^pRzhn>+BLbmsZIRQQQ!?~cKw>H=ZV~N1+rkiuG+a`;Iq)y!pS54Q7H?ha&wAdZST=xAT{ci8z zlo(fs^UT9n_K|VQC-yqkg<4!5Obm}5yDo4%8UDGqulET9soD|V3c8Qi>Bpk1!4yhO z%m=bRVX`twD#1}_p>~kW`J1X6YW>VEo${z@?kKNJ@n_s2Pf{pA60<3u+r{L_qvA4{ zoN#6V%=)KIg}aF;izXk*uSWuoXJ9c7(yQ}>82?5>x81aRZQRIiII9ou?}k}Nr7mpr zaBgg~DNzWeeQM6TuXu7B+(u8p+(xR$BdATYYXN5T7JM|b?&f|h4u3{H{}f2d8=frg z-7PO30w{0}tSMdgW=LyNw-#xhkcbFonkv=3zGK_Yejdtwu)_4-aN#-EyI`LgXy z{~vD?o$2;|nK3X6iR+M+8#n@k3G)GS_L@X)iYS;$x%|0;g;m|)ZjuEO8*eW*C+NeQ zZV?s-=ywOH{?H-Bl20>cU&;J76m;xhb(>k}0=#hXrE$ z-sGI0r=aK&H;eTmD{d#=T8I<*M{eBRX5qbNtWm$Q-s+@K^e5HJ#-Z_kX)Yz(pzI`L zJt8Tj#Yd3bYsLPf(ESQa^JJU%ZC?`+Kmc<%g1m@x_s(XWaw3Gq(^xm+5ck7r)!#Ic z-ZoE(A$46m&A#vw*UlSsglO}$xOtk%jWS%fEo2Wcc^7U+-;A=eT-q z1sQ1aSt8(V?oyR(04!1Lu*I@>=DM1w6ft!}s7x(C%@!*si6 zsY%NNo+>)+-{nQ7-CfOy#(0kf;*m>$g81W??UZ4 zo1|%dWp79}Av(<>La!MRvzj7>pYMsay=wP2>t$Deaj$OcM6yOx(PNfjLZGyBWA)#{ znhIo}djK?2K4dT{Zn1$wHKa1*Ik4Y>918~@k30Y3S<_lc2f`rt*>o$`{pp^Pl}OA< z*S@MM{h65hf^Y3z)%hIQ$#+EijWoc-im%3w!}HRiHBn!p36B{az#TLqSp={#Q;x^z z(d9ck8v`GZ!n!=ZAiQGRW_1@Gv{NTmB8i{0Vr2U3zfMd(8UCcu2$J)gV>uj*Q~_|p z4MEs@5g&uesyX{+P3bg)7R%48=izhU4mm1Zd~`)ZSqq!Nwqj3_QZy@MKgvem))P6~HYpn{;qBFVB<>H={vyK^^+ZhUjwR!CwO_1AQjWrj8Uwet(UW$Eckjfy!ON zR2b(5^qQsE;yA&CeURcXfrde4`ZgB7M=b9jsSafuEr5#ScGm)s?@V^d$p)SsD1^Z( z8b)Q3lL9GBZnke(d#w{TQ6(gr9Q(d)Q-3N&e@lYWE^1HQ*NBHN4*{r%%38Ew$af$0 z^1a?J1rGpzR%wTJUBhA^PVXClrc-FT5A{}(EBcf?qO0ElkCE{Cc$ zEpQAhCmrMK(4}@RorJUs_Bn5C{&>Wm|ET3kcGQl9reQ!R*ju5`I)utEpgnzIOjzA` zWkm0CxIV#+CF7c?$YMhGKoWP&QR+XOYxp9j&6zNtoCw(9C0mr>@n9cPp)ZAX6tnV}3j3-*b zigBOO>~O!=Fp%0mY@KzYtko`kebv53W~o$B2HE7Y(Z!=&v6JtqEoSXCf7cb$+_s>N zB{83@r4|TahIsO8aNz&j^rJmlHwl;?vPhvBpO&_ZS|=1YM_{J*&*4i9+-2hSw+-eKhbKGC5<93-zz|$)K2H)YNEase82q@D{ zQOJuyGMKsk6e%PRB`Lkia_|>4(wD1jwE3+4R|$syNs-}yKb*<>6y)t{8v0+zZ2cFf zhW{U=ELZ?i7IH>T)&NJb8!(C|RG zlw(Ctos6gDDoOy9Ktg@FjZf5&!lQbqTWbX!a7ua~!2^miWeo5dPPvUcP>29jiNAG&G=JVo{ z`=XUwD;SbsmPNG}6pflvgnp6?U$mBBD-Er(^oQ9fB17!QCcK0Gj6*t2l30^I92&Kf zA|_Lk`njAj$KyE)N1JZ1DB2m9(k6*6GK2mcLte8WGGvLQkJ3mQ8kSnDD5Ic5FoJBD(LXfqXMH|q3wQ({nRn6~{4G8>)usiBn( zTS`_?9^12bW1=M`1miAp`EZyv7faFQ6$?`2UOVeF&O1h$_1It>B!MG%9 zqU2*;&sT!68_N|X#3&1&7Sz9(TI^!WL(sHYOuT;e^irWV0{V5fRHEuKlC&h#U7rMa z0pBZzr0UK+c&+ix zMfV{|EJ;h+9h6|Ep+It2JX?V&_z%IF!iEP;lt8n`-_`pL#Y^aThgt$1l~On7?g~PA zyJFWJoO(;K*F52^PQR~Xjivp-|7d9AZg}!Sux5k+sj72bJ?{4eEV&Y`TXd4S(-#XsiZ$fUZOud<~XY91(zEsX2Lwbs_7U}eFNJoYrJy*9`cy9j)VE-IMz z;*?^_P5SHkZHcirgQcL4uaj*VPvqf9Nor|Die3Ms!wrX_NyGzmG2(>CQ)YQhOyBme zg%fl_Y}I@ie}sN-z1w!BA++Aul|7|(&aoY#$f7aCBm+vCOThu z;Vkvyx%lz(S^=)U7w?+lZzoz-MY}IK$JgPz=*1`P+EffHN@;^L)ndQv?c;D>`g*zq zTPNNPrt+%B%v7o5L>mAQe63oJE-fhSors~Hi@bB{H=1l`b@0wqVy4;G5yq9%Y%;+HUy2W$WR{6 z#^)vgG^IKd(~%2E4i0TdO6Sr>o^-ush&C$;W##Cl3Kau&a@;=)?H>vyl<>GV_6!=lm%qY5#bqUuGONT6se z{aIMvED2p9f!y3lkzkF=Otir)_o4>xDmpmZTXN@T@ibzgnd*RT_EI3anNjQVy`D$N zQ6otIfS4k9Z$!>dDxmoAgkbxHo(@gu3$yT(Jx;-TM)z?;V!t!GySIjTAlW+tAugxi zlKw6ZFnDktbf`YjUuaximQzizXkr*~2^W7*a-em@gdundH0Jthj20@)4#T6+v=fC5 zWb$i1K(|-#kuH&CqPL1VA&_L?R|(!O5JSgCw_;~M`BA!6;uFa6IJxb_E+D*n%R9j+ zF9(Mv&*6z#F~>wfu<1;Tg*Z`R7)6LsedtM}8&iLIx*J8qt=Lp$gC&Q%FemlL0D6~hqZuN$3_I2xnz&7Z9$0>w=@4oJ9{3oS(z$lA3q{9cbi?m zuMi^`4~J9N)8G@@<@4b$F{HLYe5waE4a{49$JYF=ptU$D*)P!N)bFVC9^?^_s5&gB zp%v24CT?QJFwZAM>gmu7nkJ){&L}70_{3+Uh)H(0Jl-zT0yb$LxN!A$%Xl@{v=*Z3tYeB@EEV-TYDnD~lhV<>2 ziLxUa!(K<^u;**?_|DDnS8UYsw3(ZXRG=NO=^LHdi}h(vA|zUrqN-|OTMzq7AFWCd?RwjfR%CS^`xzCM-lQ15O^ioq;wQp(MWWnY zrH{Zny>*JlxRS{Tc!w)fc~)bSm@IA=w&h)oLtG9m+{gKpHqcRLQ>uI@T z9X=<(6qyZi)<5LvconKfizfh6iUgW|Gm7N3fkz_&Yl6!+B_^j$k_64V}!z&e-R73QyZJ zI1ss|+up^XFmSy8`y?1ZrFy$RIDx0GqrR!8tlZZW$J@aZMATy9-Zjsi*cal!W4rBd z^dskop+>Nhy^tv#zkld75LVBrWz4PlamD(+Vfhl?Ze30#W>@iG z^UM>B5Z+dl0m5cbKGloJTek0XJ{!DGpKWzZC&*(j-Dqr`9QcYUoSV)*gJP@;`$Z7V zim641W&HQm8#lGL(bHwWvb_88YvgmtlPxKpqE|FbFn?e4d!=1(1)Kk(`A4r}IrVVT zXjg256E=jeo|l{of2m)OUzzS)#M z4Yj5@s%zTuuC8o7{G&|wsq%6CTjTXz0|B^31ZrPCuA)3zhFN@r2oP?vah0Y%_+8L(sHMoS>Ma=@+4o z=vl<}1lsTAm#@%Tm@#FvYOA@~;!%U?oWL6T8epp~7W0=zJZ#^zzeN^bB7+h1#o%#m! zf;tCfe9cFMh;21(Xn9gZ4yr>ZPgrMr()^w_u(<)@B?VQ4!73fXR+h?b(|#exr*rjF zKsHYMvcBHK);R`9)9ZwfE7;kk=_U(By1_xvuy|$p z-c<>GU-z#*Zhmcx6Xz^xe?}a_{M95T+8ou$lttG@`2}7H=}n!#nS%Q$jJSK_pHpxL zvKjGUD4mviKi7-hjx@$ub8_N2Os5%V5Y!47{~+{(K7#O9;&R?y^fYe_^Hp?><$f(V z+7jxF9_XC1c&YCF9dxqAPKgJD%4R0;w=(4BgP!@fK%HRDZIZkMg(t53UGvchsuXa- z75fS@!`lQ#7rMmPDXh3q)hp+$B~SaCoC^){uU&f#1zgF7VVM84^#Pe{{o7>rfwwwJ z9*Ov2yZ#>?BEPe$*^^8?s&JY_Sm56y=BnJr5iHR%b??wKjp`-t$ayWnM==l$Xe@ee zAtUMFt}sNjp^i}d&rjrKsivbt73D_vbszo2XD7cu2h#W6OGTQx%uuPhkKgSSw#YRw zI~hx(%QoDByeG4;OnFVTtP1Qa9hfMgwA^_RgXwp@P7a9#HP?-G{M($>;e?|er(osz z(tX;5elu63Ietps2|Jm>tukj(4d4SOVM<#GPC3N&LtfWQD7H_TzGEv$PU@mKCg&J< zUdD>lnI06UK-j`T3}8`8MJF7UcWyy?)XbB(wba=^?6`$v!eE5p;yHr!YFUxchH%`G z{i52SN3Q^`KTVFpn(B32@kB`-d6XU1hv_4aO!d^*y;;|P2WhgvuK%*%6#iWpDi0LL zjMf)-7U%oZ)UOnOfD7h!r))u>Z~5f#GLvTVw1kAqI0p&Im@zIty7>N>lOl1V%*{cQ z`O{phn5M2Vm5*5TH5U3ZKzdabhDd{&-f5 zeqVm>qj{W~gpT33?}?8z3B={KWt|-NUScpB|HYmOu<2<8c2PP4^9G_$3Lg8N#}s>c zfs7K#|J9i#)BoyhJ1zXxc32Fng64=C6E~%`k`XwLXO0{`Ed6u)JGOhh0|X6rC9n(x z`Y8z~YrMr>$@?(Z3!nTxKbFsMFPLR6B)4mPYS33uQW2rQs@Hv-J%VE02EGlII>cN- z2*K=VPD4c{o#~LLQNe)~;hSx1ziK;45mHB119*hsD)hIS2Z_?cb}$p8&m0vaqs5% z_X0f0IvX)47^NX>Rem@q9_xyNPM-ZPIM5ykMl~5Fq6T6L(xZMbs?EI6#o1IMEvO^> zSJt!L{iE|Yq~DfFZ;LsoL1QinyQb-8B9{jk^fbXo-$tka!?c<1PM zUWv^9dkE%k+)Ms0IVnsCUf!BQ7#vocNp`M=z;0z+Fsc}pmK=tslKI8b%$$z-za%nh zqv&3Zb@J&2W+Qr0Ypyi-7n#onh;D$R~jnGk78GipDUA2&w3JSonu{uI~a2b!wGuB@uGx)RLj zGeWJvHuXy@k;vjnL3*cgbjQtvrS7}ZaIcj%Go#=$egTZ#y6?X!*m?KHSq}nC4|-?_ zjnx^)DSrmAVT$P4GP^mX!}VV<yU%7sW*8pk}{u6gLL2X$Qq&D zqx;$N|M}~~ZfuZpLy-7u6VRt{d2688sHPlv9U!h7+eqi&>7rBen8mQ;#?g`?h)w5b zF9v+g^E`AJD7;;$t~6Ma#{P92+#WucDO_e#9Mk{GLs6UD3?G5r5;J{ncikZf z=)N9c&2UuRq3Z_aTz!|LB{xpU&O9f=EyV< zmf}FHx#C2&qKK=t2u`L_@z(XGCunDtqDe8xOFHBLut9K)4N z<0E5kK}-}(2H4JpcgsnrT~V42k;Q!#XiG_>y}Bz^>)c^DDga>|3xm~rIx|P=AZfL? z$XmZ~jr+VmZp8|PMd^iKsz$gp4__Af&yL4~OU5n{+@RYSH`6iG#>ZGx?Daz&^I8b$>XbKUwz8;vo{bo$s+)TLSGEacP zVX^E#_bH5jBzfww1Z)-a%QxG1v1`Mo&fEuRI1{6cHX2(beT(O%QMSYl=bH~tzW=p^1sx6W}vEljsGq?`Rx$>P@18ED68}M=5!^GcIgDF;an`rEyt?hXW zWVi!4Ak5iaj{H@E6*iH5I~zW$;d{h)lsV6o0f&NJX*m#GjSulLWe_KBnEs|7nLmA(THW}E_5~5H+~;_> z`Y!ctrm;{Y;3ZD;XA!AQWJ;qWURgG}EeK9h|I?xD`QMHFyItGc4D5t0jYC5UTgw5d zDW94X>PC96#K6r`9$(N)bNB8rlmgb`B3?Z#va>JTDw;D1)COi*o!=r(W-;HOn#299 zdj>vEKx6{u8BKosG9MhJY!#>`l5R<&L=yANm4z&EZDlfdb5s+Fa*O@IR*P^qc$oYU zFiW+>--cQb9*86}vOt!pm0~BG^snZ(`cG@7qRks;?Y)I|pD*H`Y(WGEH(*G*W-~t@ zGt1VN$|pqKyQ|M{G~$}3iHqF#i(bLgvvG&Ac|(nUMg35Gz&hIY76yAtNK4XY3TErx z^dA0$*YM4Zvf?!1zK;dE>!B;_4El0 zLS-{H`FLOv+j^4fNR<#MN(m|hmwq?)Tm5R$#;ecys|)xB69b_(o0CNhWT3Jkh1{Cb zP(7HB!B+pAsb2yXs>}{uL0e;e3p$Bp%L!_dmUd z9t+BTE%(_BxMne2Qca)Z4-_%`w18rZpJdaQ+@7yJmF<>XqLI*`R7oP$VB&i5RLg_x z3BaWPrJbPFi-$>_0eDdC#(vEpE{J>YgrCPT3bqSGEm&C&{pF~51gtf=k|vymQ7`+h zYG*(XS0a5xcVaoU36x{0O{zBiwwuWEh~j{u;q_AJ7@5TA$m;dpHY1^svBKIFj_QTm z_gb(8t$6T6lZI`#lY{`(Tsh`~BuS#nD+AWiNQ|s8m_-RQ-q3+gD6`<1~u| z558C!J^vbe9k=kW0z}6IbA22HkZG$EB6eab)XcSE&`-Hxu@646sqS~CCI%P%*lCA7 zu^(eXHEnQNIay!5j1UH-aG-ZIF?SmaWSwGB^Y0H!wA#J&IGErkil|nhn6KpPI}3@S z2Ie^p3`P!0LNfvxMNLl&M2XvZI}sf~&`pD8;`gy*&{GDFfFXDqPaorbZtb+K$^>2{ zTFU;NC(LT9w{>ue47B{u^q%O!@s7{Z;I<&o$I_Sy72d1{T-~k>rcI6!M{rJv9?Y#X z;csy1&)nTqMBOV0FoZBx2UoxO@=s@MrKUNQU(W|mZ;@9+LuYyBh ze}Zjn_be@==g4hCX*JpNP~V{fEk=|i6>RW0{vp04Lbsy|c>iqArr@#?C`MUEsL(Hs z{&T(fZiJSbn9SSdrKRKKJlr$E`@YtPd8D_o)t$`Y=T@V8Yr;*AYx(I*a_Ly-OlL2S z+x?&xN0PD|gmZP+xzo(Qe&QYTTOclTysBE-2bhzOrQ8}Cv|z)3l&0P0Ek*&U)7ym+ zN~HhI`i+vy?`}@gF|%f5p<~jW8Hu{dB?u>EIMK`>RAI-bW-XeE&CyN-P@Prtjb+cqcM-Srcgk<#Ewqn}oM|IC9wOsPke7Pu7qNcvL`dH9s8db~})v-Fpej{MJ=lt)|ShLd5ogWj$ zik*D0TXG>dC-0*@?-OJ4@9m(gYLAwuEx`#G3qlL<1=CmLEW2ct0e;|@CGJO_T_`HM z*JR>RIJS=}AIGs*xZ=690w2PA%T7$0^Ry6h&2@#qeHVF$vLY~O4B3qv2B1p@PKV`o z{N@VHi2aINF}O<{?YT-` zw1*@|dyN%dyGJ1-1XjuI+bQ=u-g!gU1!g63Li4Zdfd8!x?L?6t`h>)1k4mA+c@&(W zQXz=R*ef5u@2wb+CI9h7j^KG5c+S==`zWoRGc|##n8l#{Eh`em2INvZa~&AKcH`F{ z2UaR>lBZ{!X`ef_Sv|d76Q&J4zh6iRF4|I-dbp8%x&cZzdpQtBq^WWcj9t-92SLRQ zp$#mjZ5i>X*tKcqNAU6c=cv|49v1j-li+y~k#+Cm>JNTPzDP^DsX$iIYUk;U%>W_8 zm-ojd=5i_Y4`9Zcf43}h@rKdS#SnuF-+ci@KK{2Ah^CgYx!Y%ob+!#cUbySsylXvD z0B%{slv>CbUYoGEOJq>11zTTsUPVpOaBICo0WYG!k1>eIZ(;toDV!aT+o?)9)X`=VtV}S#^k`PX! zYN3{L!=r4lC*MPqwJJ$eB7Wd!q-R{`!c1I3XU4xYz*fj52-{W!pIXrwpuo0qZRP@u zf81t}bpODE5y>u^`N*<8ii0`P9Od{MB7^uIs(2&Iz^V0jcWAzYNMa5!)De%9Oc2MO z2<>LObwZ-xl7~$Fa95@zH+vkMF_%4#wN@#HBUh6^bg)|H_y2;Q7@Ns5^0{aq+EPFN z9n+4NX0|_7kZi7@2Im$)($2HUfnO*3Ta|tt8BeXS;K+brts7dDehrEV#*fgcvSPsUc1bYrrH=UA&7Au+-}i86`fO2HcKfao_)xvbHWg<`#61#65k3jW1{MS@~t`rz2z zrT-OUpys0C(%Utd$@lS9Tha6MuCa4n^Sykd@x&z$?29iUuUBU?oX}pcRNb8%W(R~L zx9w-pm)BYUN0;6L_lRyO*G(=@C|967qEXHX#1oIcwA`pKa;Rg5W0vG^KgW-9YojbP z++59LW8`p5aQ9=Go1zvxvV!>fxFzI(fafi$e%T~3)IdLuE9>U3x<~@wP&#E1q@b$j zXVxv^x=;c+R{CTSq^7|u%PvquNd6A~QiRX5z$|0wZr=v}=~iBw)k3#?=dqm{!o?L0 zoBc1|;cHJ(j+EHO(l^)8X;0DL<9FKz|H8;_^*DZ77siYl3I6z!EVXg3WDDQ_)a50N z8C4Rv5bXX&o60NiCw@7!U<{4+Y|HLHdgamd=Xp0XiyIW@KR$3I^P+Oh+^PX{{8u88 zsVp0V=#K7MO?4sbU0o-JIPD=DvxdMl16?N;dzXfHv6K@d4TAf4J0b2^)X6=-McD_z zZybl`@q}lT$!ge5fMbLHk|Sc{1W~nG$a(B;iD&$ur$6Ed;t`mqsq3^64VtQ^?c?oW zEy4+KMmmv#2@pTpv#+zw3EPrX${45GoBY(lteMFUV9jQ02(lK{vTyhe&9qb0=Z?&6 zVrsA|@kEw4_y#!Co$4%)bX66Cjx z&>L)OFR}{cG)ks`gD5up_z$LCW+9nevElrovquhSshWub>qgX>we-U`q#e@mGEpbtue3r$q`(JQS7h3?KweO3zu|^KSI&{` z44eC&=kQ)AeTje`=A5VHlDU2~T>=aq$VNE5fN>7FVBDluiLzeL6`v%9uQ0k^I7!@`DDI9YRN;&QG;A457mI>AN63f~nM^u&z2BgfNz#qX;Q7XUT z=J5|I>cbpavkCH)iAo{*F+Imqo)5aMMS5b_g&gqB9nw8PBs0Ukhd(&Nw;5yelWieE z@!Tcq;NP8npa=Tramvo@^d0%i9Tl39iN*FSYQy1I4CP@CM>)qF%=|ht4Sp1&mUn0% z1R`H)%0h@TK>jp=6L_b1I^n9J8B^I6DMnOXI3T5JW}eTiPW+QZD|JTU8=5K-Tq7^` z$Yp%3ek~^pxrp_-)`vtH=T0SOc014btprygM4c@E5)2($FlvOfcw5tsm>jCxaFQXu z1G+3%Y7hZK(DT;HJ>X^v?z;^$>`FXd40f z-B0`%!3;h<^L05S1Mr{xRp0toY&0#e&A`77X}hbYw-+D>RHF_~d2A8=Ka~Llx5!c_ zUU+d;8DPYM_0ZoUmK2yH+BJ}#TbedVK!z&*wGtfhhFSWX72R z1V}SJ_IflS_C{T%!oqIaZFYD02-A9}OUiV)%J{jEO!9l){1-5`eV7(s=!%}9{X128 zkgW2GO@aHSL>6M2rsV{dJhLoxG0OR}h(AucKuj?x-Yfpleum!PzuhDA+2Z;`5gEh~ z#ZM1rWc}6|jj+>DU|aDYl-*#e#kH9`fhWKkGFH@f|UVeUC}2NJa7qtFJ&-XSDTCI1n!@;xHSMF747;OqqUSdnpIga z;bIW)r>tIvzzPe^K^#xrA^WVuTSb514O?fP7)3@)gHbHq@}1R@aTA^s&sAJqMqK5h(MwqQhBHp8$l$8{z4Z%@)p# z28OZHw)He6Hhx9Eu;*@9LA@L@hlwu5S1D1L3uI`bAg`z_CxVSeYC&igeD<8gha+Hu z$Ck7K@}aCYwGM@0P=nn0$Fh)t@%D!4)h;ZNnWU=D-+mHM%55PSDP?!S@dpcgAK^@l z;)2m^X|ba`Po=k|l5j&0uE!r*ki0Ps@mUYuVJ3QP{B>$w_A)4WcT6RD6R6|i{G$6q z$;B~51~#+4yyTRoVJCkTMzx>!$3NHo`n4C_ar`*1saDowo3kLSF!!6`nSD*}*GkTn zND+|NjoP|SJn z_rtj;rqs%DQp93MUZLf!L39%BXJaO|gw3+6^)4Gg%tWUct z&?PIF_I$vG@rdPZ=WczHYR8N>>8VQaWV?6?n9Nib1O4O;22vgG|nW-%_z;6w);b^I!5JF@W%Yfv5=}!Kc-B{guk*OU?8=d za%X7cpGMI$y~{ONsT+ha{2?q`IW$hGYn~Gr<4ReecfC;d*96?>Ah!;n(fT zHRb{j2Fm^P9qK#p)3{oFH>{XP7f_k$See0m>AFv1Q>lwx4?nZerBCERG>#H4&vNiq zS9NKWmI4n*Rf@e{<;Aob6!cJ${kTvsGJL$pfn+$DI-j&YqPhL`Ts`FMn&V(*R`uRg z44TuDUgolo-G6QOD~0?+X#4S~SXmC|24lTwG+|9bNR-|~UNGCeJvI8`-aQ-a= zsD9+ZFYZqA_FY}|q*d?foilpymYsI-Hjz^7Xrr&uPE}rCmJ!~AmP#TjOa#CKbajT54P9bb8*% z+M7)N%s9!>p{m9m^PF7K`-iw-ECyA<{K0YoZfitn#JLS>aoBFo*P2NoO(ZyQb$~O@ z=GwCObvT2**XxgA+&jMR`U*khPX88<{#Y8)Ik7{a1v&eD!H~9aF}&&~r@B4+81lDv zu|q|4vUQs-_Ta~!;~Vnkh+gRbjw1h0kH-IIvi1MP5RnDoQTab$nSv853K1Rf?p=e*3fdX+V_#rXrjv|~*?X6Ss;%fhO2}=Xa zR0zOY;~R~7ezl*nnO3rN(}eGO%J9T*4P;fSpCU9xQB2xARi9vVbh=v2rU-g}A}WKE zoKdE!FV2^qUQG&0Fy!s-m#!V&lc{u8i+6$-!SmJ(O|B|;%3dS~`QR7+>zj*K)v~*~ z*4pyQ&fA%61-X(#T+S5(yC^$024-J)lpRaJubSTNwh#4(`J0Ujo@-7Q7q{nd>#=(; zuK`hKzRRmlm)ZyChb>Zexs8gNKb0NNu6x77l)o`^%Y4{zp}h&+-bY$0tj|(6R5>YCoN3T z${-=if$lK=wmB0~ib!01;|%Xj_q?DL!D?85rHv;pZ(#U9Cre)^Yg z_RI-QL|PHs&J?ktM%rld@yA!Guz^A2hq{xT#3~~y)9=rhj~GBb0Y%F1#7}m6LB*ps zB0>{2?Li4!KRA$$znQP8o2K9!z)j4+kn#2i3GNKZIKC}H#<7zEHwtPnWps2L;6_7H zPA!~yYh$$+6h(2m1$%_mZ<_S|LpfN@&5%vPcY4*av(D=1@QSF}^z6Ldf5dO^Xl2zc zaO)Jk5vL(AIRTbu=}G zO|CD1uNW;v!^IV*A{Niy9#E?Z^MGX7KHAohAh@h{)3fY-R9Zs`$K<$qamuH>*ktLq zRx||4FyHBdOlZ&i;cRC?lu~EIRWOAfB0aVoS{h>if-VOBoC;DGcqCEeo~wj2Cbvm z8ts&tCp}6|O=@J#-fV4jTY#dpfx)135=4#k17tqQ8A&?|PJIK4kI!@|h01K<=pZbU zV-{=6Ul$Sw5bPjnPz@}4BX4rE+P{^L+6)IM1+;pFd&YYey}i99g_C&F*%K;2;h!Tk zzKThe_sWexhQS`!X6Sd(;w)osT-*_&TNkHORNpYe^2mgz0||<+P4B3(N$710yO2^f zEDZT}t_D%OJ|fl9=H;i3Qqgf1!LsCon<>0a-hzWxImic}u4&apWZ!}zQr5)#m zJ37SoP1H&!QS`Knj$0ZVA4I>!&W~8aj{wv@OxcuOk^T^;C)#JZjSN8pOQC zctoiMB^`$ST)5xJ-S~2Ob8fuOZSJFSulT#=L9htkPHI9*O^raGF4Vk!Wo6JlS&rK; z@9g*;l`>G2)#)YFYZOnVl^<19$%?u^fX~d=*Ygu#4;ysH#l^s>YNB8^BBHYMwec+V zUG==a2X93EPTK#E_G!F{=iVsqS6;Iepfal}D%vG;CrG3y5lc}Xs zGxfVg`8D$b{`^u)L1vvyNdp9+Txc|~tZd4Agw#VZ5=@eyoAUT@hBU%Q}~%MEspcj8A&H^D`3L>v4^J#IFPpi0)(a9CB(pcS#Xh(4B`pL&Ytbmv&6n6q%1M@J|o8kpm(Ma}1 zG>%?)MbgFsD`@e^@6vKRgRkb?Z`u0+Se{{sm^!I`ijcn3?HUx<&A)jYz;coTWr$t# z-n7;szzAAAJ`jPaNqAtdIT*7~UK=<{%fnHLr+vl${!+86GQHO*=I&c~rD;lO{q`hf zK>c%b*1fZ_y7qGFYiHo4V5g$tCMSW3mH~+LWwo_;9}2^}%0vdKuOIV^`hMH{JhU?xvpRg3H$e3y8mGD5f8Z*9yYmiO>ueW%nb~3LZ>qagpH5Wc zEPm;{@Z7vS^Iu+Fcs#b9%pZhy`v|(a{s7|W;JBtFS6bD^8%DrfGEls!`8^(4!shSO)pmwJh?9C?d)aE1&1U7DyUdkG+atMST zi{epkCl1y}{zVm+o@RoEDoj{&TfjP&-Vh{1rC@pw>C4qXq{Q!x?+>3)h^t=?R_{kG z8jaTRd)ldib0B4Ohcu1kb;2xi5$yp+HJXM-;yJB=;b?dFwIX4wHG?{fZD`Pa^X7`S z%ZajQKI~G{>YKNfDno&T>x(2y9>p%V%I}}Ve_qtDfo>lYE%001+*0FYM`|Id`9_T!#0OKp=P8+hS z&x}n!jC{i^wJPuTV}9gdZiof52) z5$l!ATM{!4D#-UCDfY=G`z$&|y2RsZYNI|$jR~Bh5w`VM+yZ!@I%1UfQED!mfO6k+ zcp`xg@YBU>UXiT7p2W}LgB^}CQ!r5$^el$kyBogCIa`hEgJ?B#H8(g z`5mT0a7C-5^P}H)oEe8SZzJ$Bi|XKzU*9VJl~6Wd$z=te1pET;KDald3KQv!XJZpD zOKTM|AHoH`1b|q&GOcsLLwgN)w&xG|+6Ut}ovu+6Rm~Ix4c%FA&|@zlzZ^GjCpG<- z;|5X_oBfmBqFv;AA8oiJIA}L@hSMdw7*O)5+9mYAJa zzzC6d=%EP5q0)ygE`zQ?g=SEvk9qgYU0VISz0!3=3WeT27^iK29z~CVtbISwNUk4! zNcDds@2vx(?ACr^LK*~tK|s1;Xe0y#NhMTz0EbQ~=?0}?K)R(%$|0qsk#3|z>5>qT zuCv_F-us;Ioc(^^^PYb{rYW(!{eq23T zNC~#&PIYP7C=1Ugco-65j8qxXPtE0frD<;;c3{1snnb0C!CJB3K`(lI`8uQ-MPTi+ zi|mJRjr+AnIHnhdkfQLL-Lsa0o9oT3lP`p62)4tRS6{qF$-*96R68*1?u67!Q>b?K zX4O?lKkUo#8;<=Xtz_fn++;o;sW4q4U zqEF^LK1kS%CvrM2>dlKO@elab=2quRzQs`cIrcW;?OyTA94I>LvhMJ$UeVuiZM~CI;xD7yN?ThJq?Kz^LgAVR>NI&jvRuC{qpt=>I^o3qzNYaS10D`De(M<|;bM6lqJt*;#!ol^3H z>@!X-ol-rA2zH!vh_(C!4Uf(Vk`3e}MrX8auf5z_S#%(|Lx(Jp)*Y^%~aq5j6s#mnrmNV8KHSvF>H?h^mU zAJoQWciIw~o6X7DiR9Nja)ETg_;DRVC>lF(Kia^F4PYW%f_Q~nn~KfZ4IlkF5(1<- z(>g2FygM5P7(9*TeC!ug>1UjCmluDG3?FqJKTV;Jqh~{*xoNzKKZJ= z6yv>uDI&2KZbkEPTMDUYwbVi!G58{qECS@1MJtLq)r3w#y4}A#0$78gXZ6`dLB z*ZUgXGMZj=)z|x1{9Ks_iyBZBC4{Uie%C*5uE0>F{Qkp$6Y`vy{6oxp{txVm%{e3f z_WdpG)3dvIF^%R(S*3Z+sbiyn^{?RpbrKbxH7CU6I}u*skP#_iv) zWjTWEhI*-nH)NbubMoq!M;*BeYmS?Vy&Rd!+9W}iXDhFpHF__s?e&3wu8)}Tk2G-azpFGL$nGjg|K!?ZYCdYv!GjCx# z3|p^Gz(v|KwbXsjF`+Ikk(oGm4P!7>Iu#Rpsv{PWGlo|vLeFLn-u*nVafRgYE*@++ z@J*_S+h=RT@xE#}0U=s0sBZnPCSV+Oq8>OS{Ntl$Cy{C<&z~lFm_%xxihb}x^wmlC z#Xpi#rHvS_gvwv?q&{@=c=D`$Uz$Xx4y}+btB>tQ@kqVZa(nxvjF)(c>;VkjaTvQu-}s%sLFAmMYL({M8TF&o437hk%@8QE`+|f}|M-jbl{$ zzO9>ap*0nDZSpR}dr)-Wz{q*$JIRs0^vT7a4B==$Z%-%h<-JReY?+@I&k9+F^r(qq zdCl5%$&hqfA@BMS$L_oXy=qnoDlsK-Nhn-TCnQ_RmHEq$*@^WiNY`-X?7WTpdesSd z)y5p36+T1eUD3&I=k^?9% zqR1Mjs|X^KiQA{6)3%n2PE#()f)!Ir$_a?_q2`60jkT$f+)hjeY9&+#OZ!+Ol`VL@ z`!9kp=?35m7_h!;IY{STwphgU;H94UG0+S8?AX%)qI{s5oMB^{P0!I|8l5vxbA#$d zJ;KCXmtYu4c^3&Yd%=TJVk^FBAO%0tN}=JAMkY5H-pjtc)gYVYT8s}-?9!Kt-xGyK zGVi|r^lJC#zVLms-ds6{HSB7QecG!+)#9TBQrPwN^_Ab@fDWgZ=BcWRs%#8gl?6|S z!#6yze7^Ipu(*f)*Y6x}Lsr7e!BqglkdwF~8Cyq8N zaA7?g%r?S7*;%pl2*jK!388@u@YB=ZPJ6}CbSGIyiPtFt;WIQ`d5-i>}VfPWx8s;?@QG<@NjU04oVzxrrdP;qju&mA@NYv!jHfBF9NpL*{ zze(n96s6hZ9i2M=pT(AUd%sBc_dm@}bFaQ-U@r`W6Fe>a)luVms+hyv35g=hU5IYE zc-ykU=-TCkI{m`cdfMqjj9QuyzcM5W6TmTIU7Sqtiu|)ITX{XagzzMQC$(7V`pT5Fyu+O(FldvLP zm@0h_tqW-vbBl(WKGf+9(Omm(R63U|(Z~3ZSL7z8{ zWS^iO?lRH8P9>JM+Sxv_7ta55&uYC79+O`nk}_)AHht`{#}+kWv3|pY2Qw^%iyyxv z*U+ZV{IMsL+u8G%d+YLM$B)-n>6qB4o!}~9bL@<_&$^pyflTwe&WqMyb%@QwIJx4$m(YZ9Irx_jr?U6FY*HO*Sg-EsDmb#FNETG%r+32G>VhCu9T>mVtk-#aglNN*&yUK*i=>SWiz*3U;2*e!Fmy>4hoQTJ;ZqrMI zP2M_YF^o!I61}d@tLLyu=;z)WF=vk@R0FSn~3ghrl> zqNV~0It7>eFMae6>>s}$a;z4;q{;rgMW2GD19~-uzw2hSKlLxUdK(F89l{T~6sv|n z{{5X%2?3S3enB?;L>30RS<#? z$4PWI%vyWUS?AL|^O0~|H^-F#9+vkb=mghEQ}yc_!6SLB7vqixDU2#c zO}jRpyhN7lQk~&SS^-Mm1uJc);m^v8Lg!dMw1BOcbF48(E`A@;5=jiBx7UonmP`nm z)^5{oHYZFl&EkZZLb4f7J7Jm(DviUb%SD2E8-k_G*Htgtmv{ zfuEwr(fU?4o31guepPSf#w9^HvHc3~9!A106RdX)v@)y2Peuk3>U+7|W#o|VadPWa zhK;{x<=Iv{;24=Enc&79+DcY2WXbCxoqwUorrePoyby8aqVd^^jcsY8^ zzy3)@Tbcr`<2xE<|xSaw+Jh4(8{k6YJM_?!<)fHTVF^75`H+(ugPdisyy2loXb|b5Mzq zoXB&bT3dr86AwE-(*An>H>E_+EpY0I`&(s1tzDnBKhw^ax-GOz;c>87!fmA2xxq34 z&3iHyfW}3aw4pS!y<&QIe+_XOZ0fdmb8|y0_T_0ihixA%u_d2<(AeD&%D|sulbX$I z@V571ZX1cq#qr!4G!+_&Y;So-K*#m&aWGs;fFehX3$`xTkz>Pxyz|{&mUCRvkpd{` zMH@JDAS*>|+|VNgivnaI3>5Bi$UEU;jK8_vb)28Ne+CMb%Wh8Uw6E|{9?$z1!Z<4Efw~n z;BUrQVx?`lxqXRWxS_vsB0OD(irK#}J~EeaeIr6_S;7AH)r4Tu=E8h1 z<9tExGa;%aE$TwPg^%!HkGLS^j5Z^i+ip0!peWho^WCBogF z+aHw;5Lp){Hmy6F>Kk9*A7bZ=ZV}iuSrAtDDcaKyV(Ur|)}H=m$kC!E55%ooZdwA} zvhfYii8WdkuZOs->~Gu)rEV6@=NvF(Xj4{~i-aFQGfLjglw@3+a0+uL&*qrv#}0`N zq`I;}DZ-Y_9!mN=qF5-7_Vx*LRqpfB9A~EvoFSJ6kT^@lDO*&E-KnIJ_1q3+c(A@h> zdoh1meW86d1R3J0yCly@uR=)woRRDT;@ViJmN2^*3z2avDZ&QJ8?by|sz|802v*b( zN?7McNPlk)*L1=!2U^RvhNU%6V_cb+Mfs$^JuLteDbbHy?83myMnj@}Ql-h(pd|-f z^(TVhqbRAXeN)B&mIJ!P%$~J-yZ9KOe_!wNs2!!bAUFK(qDSB+dv*dD!Nf_6=k%Pg z%ZvFtE!Y&u#TF2L%{S7s8|g*Wq|AM=eDA`IN{+*aJ3hS1>D-a2TnephT5h7xtNH~^ zE~&a3CZ|Kpq9pUc6m%-7II|-lYgkK{78|9MxA5QEFMafUNP@_=v9#VGw{+4J(rZOJ%d>-Jqj2@H73a9m}FQVNhN2h1Fh*lV3|Fn;6tc)yyPU3`p;9 z(hg?ac`;IW_U&r=h#l=czQX)-xoivo3D6)W6bj?7=xWbJ9zm%pokB)UeZKdZ)mRGY z6xa0)i3Mocnup2AISBSKl3oZSwsCDA4Twb~$86vhQ}-#2{^mVRo+U{S{=8V~|48d) zkH$L3BUs(_nI9fzeZGM0e&- z42Y36^1?89tB`_~rujsL*)%n%Q~#6blLGmmvaqo{!%EWK1Pqq&bZBU4!BE)c^#J71 zSEWlkhQ~5;3GXO=7lO%oI(=45tQ2WVO@_7tzyz@IDyE%7ngh+9tg9FP?X0slm83Fm zc*wx^!a5Tm2+hjDG635$PkDqif9WF{oorn#>W)O+pXah)Ld9-QbwqdX* zrcTyk{kE+mQ&Zs6oH1b1pgiyI?WTob|Qj9oTY{k4u;^?mSA*#wh&Y=H7bLUyc=j z7%)7fBWS+dzGi)5>7I+#kg)zifRG=KGvd!e*g?sK4^c+xtS3GS0GM{sp~(p}qhSu? z)fQyA1Qlla>1fla)z41FBENNl)+7kRUz|aj@LFnJDg(MhfHgunDfh1Y6Q;~sUYb~Syr z?l-DWkd@%wA^P5%8g1f@)=nGf!LAWEz2Ym$a(}In#Jr6gbh3T4UpGK@vhC)9q`Qx6 z1j)ch%tCvD%&9mlR?~z0YILJ5*_||nlt%#!-QrS4l7*I&T(_K^+T1ZFFf<^Rn_a3m zs_%1?UQAU)3ggxHw9WnCCL$Nl28;X1mBQ~+wAMsrlpLq~E|CqEM~4ii)kR6TL_F+y zTj|&-v-X*5_)rdu+z}^)9)586hQy>@D!8QKf+cji_jOiXQ)*RTr+SN>NrUEhbxN-D zGu%3c(#i7B&#l)+g}zNzJWv?lB?~i6`DBJ0e80O-(;ROFiK~h<1YHDK>PxIKyjYck zg9+`IO_1T?RH@%j{QU>qj;~+N9&1WJ__6ymu!g9i%zBd^5C;J zddo+)hp1W7s-ma~{4jA1_<)4tM$zZJjqBjMy_-JRu=UOKwGj(;8jd#B$ODj`u8SMO^<)c@9q+O3p!ihLAz`m;`XjrsBdzu8!r6fEpdYka- z{ZU^-9i@oSgUe$1I4uene%kWE(H_*{KkuKw>S! zp2!X0Ccv|!q2eT8rNqn%o*`LYzB&Xl*>S2SfTJB-F;eF+fJSM3l4ff!yK6397ih=+ z0nJCh0E)yPUV#>J2O|M~59ls_l{7tUE#VkU!1Q6z5v)C3#P0i2aPqFJS5;O{u)INkpjOZD zj2foJbF+dPS}J0~Q>ng(r{r-J3?tGy-&W3Rp4qnbNV-8jU2thf*&}9fEcqND2YxbH zl$Dr1XANpMR?#JYC-}hm#fdGCj!Ba{tx0wQnAwN)xCD)nAv5lbutT8yj^Y@4FUegD>Fy3FfRfQ=z zJHUD$_xo~hNaHyP@+t(Pcb2L-p{Yv(Xq`y|0Y}wn(W&U(wtj0xyEMMQy>+(zh5le- zn9F+mW<7FisS)m$q8U5O>^`hjBBgN$v-i(vx|$+~{=%Ez z0~Q6DJkr@nVGlZ1s-2&u6X(3iEkG;l_=@E#L%mhYB^?kI5xnB8ts=v-xFZ35RJ!}s zDveA<90wAU!Nc~LkavjU6@cwZ0EYzZ10X1? zj6~(ogad23m6mSMa3c-bBs%tz

GTii|9CN9I*(Gr=zTaeEdOIe2jYY_2JY|6Me*zm)K0ucM(eNAVNq z;z$vgu`h4;@3|bI(OC3F+^&ZATdS3HosiEGn4?(8*K{XgDl{uhLTR4gtVJ6D&7yAQoIy(oQOHxQkV&rLbC--n&OkEv4EhIb zTL083Tj3ORh=VtId%gMEBEYKLaGlr0>UWLuW@P>L_Ff8~B+Y%A@L4GTH;FbLV^H(T zY$-RJ9Dkc#`02IHDXo;yL}?!iqCwu>hutP-x=6s^00Vo;lnvEYR{8!Xx-X}S2Y(ZSy!(4L=7^T*yQoIt^rdYCq1l{pmc zbi-@Aw0se@>+&*Ob;#+vt}-bjtXu-SUo<+;(fqx_9JHcN&r>n99%QaE3EiRGq9$G# z2MJCWQn)zPew4Y)OJ{ZdaX4M(SFEdstFQOkTIlDM8SPM7!^^ zK<9hohSJnccN6kxN%aQX;8L+t2q?YzN@jQlpQNw$CN4{uVT^2Cj?~0P;1&k?ZO>I69pSG+Lx*N+hJ7!OtFv^822 zYPEqZf=>lVJ13@>A`+*SxZcYsW(CT&l7UT^IA#TGg{F1VDhHYbFCOHFTfOETZjF7j zp-#}kWko_}Y=jhIvRGEc8%SpS#^@BkzPJPfjJ84)S@1L8A;t!-ze~(`Vpg0XHWa5B zh@C!r57G=Ij1VFwYrlAeSpU4(w8y|5)Bv=Qx1m=LWYzzAF)59h)2zBGSK-ZexpGrs zAg$@T;zO1DjsRU5s)^4fD_@^H0pJ!OEC2(0mk&q}23)Y0P4yElT5w=>h2dm-`>e$y5owE&((w?yzU2rxNjI8dEu*1KE07KZL*ohQH3q z7cRZYO)$BLV7B{Mzx;qstcFzQ1Det9S<0{H04V?@g@Vx7C4{obyL@S{7xznVpV}o9 zdbyk(Rh9&OS1hZeeadc!RW0<9igAsLHay2|2LD$~-!Nm|Ym1kWyskXR?&Cs9vo25Qt)7!Bps z0cB#^H`66my}5T`hd3Ts_NfEmVC96;3Nk?cIV#lGH65R`Qu~V*f$Mz)xq)=Oe9rRm zID%ItrO+{x;ot&#e%yB0=LzZ=ONTGsEzLzv%b?+Z(Zlp{?8AtBJ*GT>evd#q{Re8| zxa0BohgW)JS)bd>-6Z|ASfvXA4Zu97`K*r<-Fdfp0)I_-D3|%*H(I}h=elQb!3SIS zj{-`M1Ii&xtIw#B55*CRJmkhTCOJfMWzE9p6Q_XhxaQsdn=}GgQT1oZk7yK7e8@8e zt`Pu@Jp%NnM)y_xhV31%uLmE81)ebLvobdPq;SIM-cdWw$vJmb{gV~(gCeETID{H6 zv>SvxbRDxlN{1K-A&$U6scz4NIG~)T@ls6dcthO6$*fYA#OH z-QG~~@QlPtZ1Ue%dY?<^Aa0;*7(Un#%Lz=?uDQq+mT!`JJMiyLm)VRSk0 z=ZR~$S!08*@XT>*sByA68lA8vzS9Y4KBiNI$2jI7#8lS|jFfqWRx;k4sOnj}mF49V zOVU0a$@I&_cg*}j_W0a?6}aZnK`}VXFrCW{orJ&rc3NHUx5S7;?1`r=IC{Y@4xrjf zfx)T2c(eex2rSZ(AmY%=;rU-ky$@iPsJt$R0ZaB{paA@+&{Tsn)>)%;bv{y#SZ-$I z3w_Fm209yU-k?{HGFM>JMox2UbB>eV0dQ z`q1fXLTqAy^s7;p%1i_TBV{XzLJ z=`}XRzmRAahAIWJfuw)`rT%iH-eTp@ZSf*8iae&_4=GuN^v_?X%ig?$ z7THB>{2;8f6`RnMA0;%dZnb~^mYXvDyO_nqdc4fYg5Hs(oh=W0nUX?3-&dPIzAr!flVyDiNJk?bU4RD{ABuZj(ccyDo6mM>~@f4HjX ztL*~zk26S<>H2I6a6f1`GMB@ya3hT+DRywpip%qsT@S@Cq`KDW4sap>%F(f&PSBe& z<6*H~_T8rC^2s=v-ynEg>=Wh!z$pM-Ll+tiXjATRZg~@wr?Gy;31z5f7*(r*HLf@j zM0j2tpB^Y?MmW4v{WdDt(qKeqJhg|#jtqR~(9MlvQf5$h?JLtg`bNx3w4ui|Xw!0c z@3Bj*wZ*r9DW3Tgwt9ToZ1i-BFtuvft^f=64zIkaz$?8km(n{6|e) z^X@TTtpT!G;3%TErM(9tm}4O3_?n1Sk@Qm{F^o3_G7(iydkBn0q(3&5uy0MSv#wnQ z6^2>`dn|DJ7TvrIfOqErhXZKE``*!W%GS?q!>ohwJ%LlM%=$MmoH6ajW#rd%r8^)_ z_a?kqrOFi70|g!+i1J0Z5I@NuBSbjLDRI+3SaS!Aa|d2A2mR&4CPEmI`h@|)bM!jH!>C2z z;ifUjF7gvgjC1Qyp2hcQb3jh4*kBx&wJY4YdAu^0lj?rnj+*n5<|c7)IH z8teE3LEOIrEwn(%F`R1gNnDcM>?Q2fP$oWuQbfvmE~_j8}W!q`feD|G{3 zF=;r+Vd|3VrXJzfM3xx}S}e~`s0{N07L)#hlTAJejUcsN_|G}}#~pOKCmV`6#0GqZ*7EW|Lz+H3C%k`K!yR`vM*6a zpd8g`!N!>Ct#jYbe#XKpqEDMb`o-fdFqb~)&tA%P1MC-wcOVCce;YjpS^(xhC~iXO zPXX>2EeuU3F5G)Sv^V|!qf(34H5$K)%K2-q$JXnLzuWd*oVBKeyc6|eViQS{>h5p< zHVLq40S%iYhFw%Ff zqH3$HxL>l-cS(r!nEv~nlkHkL+m}hc!bcG}Q|Y+~- z>T*f{=|)ugg8LfGO5}>#**AtZ-6sm%kM-I0)cE!ORuF;CiE16BUhR01k@OMhOpMg; z)=|b7R7ThfGSo!hL&|?8<8Pk`otBobqrCU32OGv{j7PC#C2K>^2!9{SWg1v=uOjHb z|70RfxDJ2mr4@q5?wdtLXVc84Vj4 zmN3clkpL8STmU4079mV`hWImMw)ad>9FFd?V%&NIKo4L}kJ+dto zp!`>dNnkx!;um;TZ2=8CM^me>x#HWmEe8#~P&!9Y3D-POiLc1G04iv>5!2}T;nkdE zKT^AvPY>YlCcankTS`k^YzwioT|Z2i12U?PhEx=NK|}>Dr|MAwL?0mGB2DTF5zA7l^7I`dCBKpq6$Uv7hPbtz?d8Z(HjW43jP*!X8?Al^GWLW zSpjl{ogd_l&0l!abK$u_ivgf}0sAaoEByu#$?@M_wkD}ktLq7O*#h((5d3#@0f+zya2!go_>M~HN1r6sY((g%Nia%u>rVW(H zY5&NwODK!+r&GzovTB1dY%Ie4jJ&ze2_gbbOtV2C0CExO(x#(+iW8>=UO!@qUC(gq zy`3hKJgCD!b)Ph;4t6#!`Ld));8V}XKb5V31O4x%1Kd!JG!G99+4h0XK{4<6rOFPZyAFIyGHvJJ_OBjFPcv-!JskZ| zWLFUf5r29D44w{yH}T}6MD`IkSG7Wp>3->3P;t^5B*w-bHZ(48g97fAdekOk+#(!* z1V;`#1A%)T6W^4&c;6^==0?Xgh`ACFBe#o;I1Q?v{+=EI0pop2oqgBU88FODGgv%q zvWh7kI1BJi=cMWJ{n>ioyOM|iW~|CS^8H85Tv(OD@hM=qdrkZa2XepWo~J+MpqGG!`pVS(YS2jj^nbQle4%?e3n*J2mL zE@HU(q~V>uOivV(F?kptt`O1mILQ@{PQq1>NXya&RfjB`Js-|9~b{puDVmq^_M_ z0{RY(=GlqR!=l{*NJ^F~2eKS|q*gI7_R(Zp;669K`%>!1%*%Fq0lE&z5lcj57At*@ zUd$Ip_w`&VF+foU?&;X+m}rhbqleXe$q}$mNOzMLN%7BuB@5Sx!pMfO9K6@osgX1K zODaEH;bt4@_uixY6D1Yr7`=&@356E1m+!{ge7b`8O4$$u(h{7U(+ylmy-y_EMu6Cq zLk3}ZNPnV6C@p&o z>ODfr=90fVR}B*L=?eom>bc%Q_s|~Txftm^sZ$mLu%@;nK^mkaN*SRv{{<+t2zOho zqxB$Mr&GVT&X;uqHy8wwg>JfWoYG6YxQ4@He3chjI$7&+4Qvs>Z<{3^FO3;~vG?QV z^oh-zSzcv-a4yBpnzJh?=oEBK=aHAS3<4)fB3jX@l6jbH3{;6D8YrToUNyKMVBl*| zdndo@fc9L?Nw|2#tw!EPkf#L-Sq)$Fq z1?|VYKZLo~z?fj|35;aN?NnB!A890RG?s|Cms7=Uaqh74!}-*{M$Ur-ZQPR3QssC5aBlMtNC+3BM%O?mLrkT%+$g>6+a#x#ZBaA_DaW%jG; z%O!c9(DP7z|BK)&+|T}rS!P(soqa5`MwHz19DToe+ppR`>=F)5?A1UJP2jn0HCh6d ztYODOau^={EUR#Fxs9sdTmSCbyy-3p-;wtDAYJ6@AliypWdH1f5B{M_uM@^h9v{hl zE0RdOR1g~ut~+z;>b1T<`3Typ-Gl7%iKW!fJ}*J^5#z31Z~4a@%dJ-5Lot z6F`Q5+6zn7N)hdnJkMjb!~P{(-Tdn2`b+uU+Vj zgo&?sH0IZaOY%j#{Js@XPYCj?tGW1S4IAKGXFWcGA^Eu*rDt)Obm?TrKlcIK4}20XAzv%Fpg9ae+9{~5V`*EB(atJ2!5MfUW$Hcc&TN(lH+BC?d}kI0vr*AP2d znMY{J*8MNh&FUN-z2p|I65i;_PQmAW@Y@&Gtm-Rsnqn0tI$ql7g_I_i09IeNLJY4h zpfE@$3R+)I(Z7Ouf%h#BRhU6_eDH-Ct^;lU!~YRuYJ<|nF5_z9mNvhU=4du9wRjg6 zY%g;${>T9YR8zk4js?QhSzqil2;LXMo)5KTu*phTxg|!YWIKDX&xr@P=kRJnV7(hC zU|_#L=T_U&9#%yY11(iuuH9Bm&=$5l78JQ}qxVVsnK?*?LM(vIio9dJ-@iH&z4dl& z72Zboleb7a)M4FN_)j}xFqu{o5I@EQUNle|*Qh5Ttg!N_@P5u^E0b%Og-h=Jwy_DDSx1bwg`xktzjx3zR+9V`y~9WH9_-=uF+9ZH_|eJbN*5FgkCM* zW3heZ>xmB_pq2kl^q8JIEwA0zf66)`*L`>$zzaYO=@0yeaY{4VWXK+$(+9BvZ+CWT z;Cn945<9z9WUy0F(Gu$ipl|M<0c)@AjpaJ8DZJka2WJEX>dF=w<8RK3fe0h`8YByU z7#0%z3X0%yWhXii_)3u5vDolgoi}UD8%EC;y>B@`7hp*6yN?uGX~A{(odG)pdE=Z(+*XWjG2-YFJgu=*7Ss{T}NMDUak;Kr@h8qRX5xN;r`wM`q~p*b~i;792An431^D&NPy`8mL{l=j0i>S>7c;z4*}4xlcB2YHeewgG+9XkG(x78q2v%L%YM zppQV9iqGGJzq^?C{^&CRx;C+JMO&{TCPBTI2N*T;(P>55>Fh$~<9MKysTMqb28ss9 zV=7`&d#SK=lcN62|rzpxk zfE%>C_QQi@m*%YPY(wx=hl!Kwk}6L?^XNB7gHFTtQ*sf1kj_FTe{9a{8a2I~cfFSeV%OxcK;ZxOjL3cZrDz z?%unLhet$4bdQ7-0)gNY-X|v`B_}3@kp3A26&<|h4h9Ye1`a6!9s%ip`|Gw9}FyK@Kq4%VM_p`y8g3;o_540=9HVkuQD zBL@-&em`td>6q+_HXKF)wONr-|Bt^qt8j02TCOn&&NMESfsPneZe4Am7)iRgbFVD((3qanNH)0 zDCzk92RL%18Xv%~pZu+hO(ZWT`LSm5wyxc_?myHBmIdVSpY%R82nha*=k^XC+_t36?A zFezZm|52X*NmOb9v#|)vFgXP)3525Vrk416s;dzg;6LdRwhXX18Yo$*n`-(Llo-KQ zB>H!h^`FlvK(AH%#y(MO0kPCM0-LT$we-(zKvRGHd!cEY$$2!r8jM;R*$Nc-Z+jy* zwQsLACSxoFwOy$HYgOU}g6h5xOm0+Bo*fE4iY|%24#)%XZ%O{kJN{RXDzDiJf`BS@ zk18}I)+!%;qUG zuV)Eg>w03UNd6~v@r&p+&p$$<_&=3VO$9~%H6iJ?d{L|@+i=z_TTX?T^xtqA|J;Wx zwDjls3%YX2<5B!0|4=6ypfUfj2h`_A-_sSIO{Ue8&$2)3WHug_82}4>@^>uyAJ54e zQ%zG>PI;OFw8?H8YG>-;B_xVqD=_{)Mu@Lgt>dB|`PRuS67kKN0!kC~=!h-{!SVdR zv62F`fENYoB^pDNBUS6tqjC^=)PHG|pinx9I;)Wl>dg^~Y&lh;{{I~Tff+v!0pr!L z|DVza?%`pXrwcP{Q66*O?|(*6Pd6A)q?mup@n7=%uO5{efYGVJ`vzRN9#Xp4q--dP zm#O3+*rWd;r$F;W1o`s0URMS?`{46ZiY<9~AFvfQwm-`DcP}4ORXwcue~jlazo`0j z>vtATPGwz+@KgNAmhYNO>Md2smW}T(FIT6w+;#|mee0m%IAcljM83E7aXLw)vFT0h zo@|c4MG1PaXmCNc6LN)ei}K# zyMC}SfOdznbTnZbdWxrUM!OibGdGw)RjI{WhtavI3n@l|_ku6K(v zT-|coTe$u?aiOOFf&7pELD_qUHMMrzqj9?x6$KILN>o6Q&=e4m5)}avF@i$qQ4x_Y zARUseNRgHe2q+>^kzOJq9TKS#X;MQqBtcpz2{okNwZC)D?|kRn``r87|45!^EwbJ< z-#Nz|W6ZTy4#QXVm@+fg8j;$r=%?6zKc-Sv+q8O1?uEhm!Lq#1&qF`E##}9i-dOH% z3urUWo$sAB2s1Y5BnU{WsctnG846}cUR=``OSbPvyn6IzaRT?94|?t&DsY_0?7|&028eGwz!ZKFDaD4E&OR;0MRE3;~S-N+lKPGd1iVs@3LFQP}9XoNt542Ij(+(N524qRhqK)fHMkiEkss@a_Z>oLp zDfKTZyKMr8l6Y1ejodEcM#t5a?rRsRhID#`R%P3$d{detyf1~06Hyy0O5oM(Rj51n zBFUE7L3VVk%Zvz9cQs3H5Xt7oBAy%V^T}`0c^FEag;E`70(KuzX5akwHxnBqFAXo) ze43rbJ{=`cg#UjhQDPxC89HYq$2;RD%o0F_LxulO_8s891D4)s9Ys2ef5HcmO_`#+ zm_~K>43Njc^t`5ne9+bDEG`|@iCzYRL<7}+^8+7rd2P*%JpbRn!|Zc?viW2AZ?yGn zZX0wj=f97tLnkBlbHoZbstncM+PIZ7x%zri@;0Z6CyC|P*27HIoF-)k7_u>*l?9*I zY%{t2ot@weEzq>EY(YUCg>qRyCON`yd5En>!-KWU7aIu1wfE>-V4-=nBiKP)hl~YJ@v9zSNhYWs6dy}lV$!z2NGWMmYyL@EaYvQ z?ZGLJWR;9U4(|hpG&OM0op|Ph{v@0WW2WoI7G<5p2c^LED9~{{Mdt33C#$ zS2$`KD7o7{dy9ECYzv0hwhLXNBhj36XMh}S^{^Fj`QmrXPvV@!3Ye`$LxCc%{B|mC z8gTcXL?|<&$D5CYhBnm{NH`M%w~S6worI#GrTFQQV^Zb5s)4`OoI-&;K0JGiFyLcTMCm(ySPzR}i{qb03UjV4=c|+ZR}pha1D{>o zI(0M&KEwyrV3rBs7Lzi6wgs84#i5V3CvOZ4w%vX_*5(hs&7|N}o1$it&B&yL>XU+ZUvz|c zoHOmes@Wod7i&rQHr!hJomBy*lnEcLZxaquTE)2L0CYpI(a(Q}V*duWfEE~8!3VYI z?J^I%1}ak_wnTWkHxkPS{W-@6r5yxwqYR_0kt@iT(L~|BOj0}_H0$>g@$2CQ7c(J) zE|EQpnH?IQwmsKH34Bo0A!Z2gkRjF5ul3~zwe(`xJ$b0k-|RrdVN~lJqmX+T&Ij#m z*PWNj(b$;voF9ESCG4ovVkTLtv=IibNBPzALAeZ|{yun*8&>Ve;e+t#RUHQU21g&* z9=%i;OA?D;TLIJSo4lgYBBT@&%`$)w@;2Lr1sh3GL}4_+RiN_wMcOs28yR}uS+g!K z_C4JEdD?3mLeBjdg!yA3D`samvnY_Zp1@JA!`C%7MHJ_I_&V2WB?XvoVJFbzA=Z}) zzmX2~5dyW-_A(D86?}YWKUq9N5f>TwcK<~66TsU%oR5yQRzt3*A`&sx74Nti40cEG z%)O}h8Y~gS*Iq;_xV9knDIU%0=+scF`K-HLQ8uUZ{tcPwXP;od@c9Z0~)O5Q%(nvacX;McDcG+tN##A=V5pQeNxfh7Lrpknqsu>v0alDxh z>G0F;=6bf)?(|~zc9lY;3ej~#NU)^Xz3vgadM9r~Qb=zR@ex74sVW9HAqE}Q=%HK~ z+gw4si)ak)MScRpL+dN4iX+ife=aU_m**WMwqAcNtP=8_%Wl8)t6LuPHo*w*n_Io> z!w2nC9@#hFscN*(JKpDi{cqijTNSs8at8W;*X+Iv;e#2#85%lc<_DNWxM#A2j_S za!ra4`o1HwWTG&5RZ~v+FjZwl#?zLdo2|(Q?G;;h=NxzJkjBU0q!%?8Lk7pb6W?02 zj>)^`BcB#_VrAs^%gW)t8~)brPw2^uDO;=#9RD6FT@&$)H49NHn3!OL>l1aeRxf;E zrI%E8QaL)U` zeY|CbpO_$bX%lxHMiawaFRUg|&L%(GJcB>NQ}GaCq9|rBpDx4>*W%JNK-5_6jru;> z^RGP3irG4`Vfi;eDV(93HS~TtWjTcJ4B6l`HQx#AcoFHY=LLn_S$%nknW<-nO|^ zMKLh#DNN{f5rGD04}>*;E9%sTYf^>dc_*0>_qXv!J%d>fWvh&YXCM()4URH0FUKC5 z$XrM5$>z9ni;Pq~p~sDsy>vvKd$y1ExYky?>$~nv$sne5M%~H|Zj6u>K1iRW7~C!X z5&4zc$Q2$|Ro`x6!b*Q7S|B9tntCSxNHc?Gg!g8C5X$pAvAr(;^ZEs>%pV7^->y%m zei0fy@m%)|-V{2M%?F8Bt47=!iG-9mYq#4*xDdk>{xUSR3}c=cpeVC1B@l@IW_zrE zXuxEmOJ?&Lyg2BFHvykQ2o6j>hT#@1guHEgs zb~oqx&lzIV!3z5+_19?*<^;~4#L9$ErFZ-vbA}Xpl-=IMs95T0Kf?M>!#eTf&B2@i zdZ+=omXO2s+NP+DF!SlBjk?)anE_`sL~RaeE_dR+PWO!%jZhz!W{Se{ptl&8ZrJr` zW!WJ=H8wD8W{1zjJpaD*f)5J&tN86IaXy4|+>4OC6VrtHXq@kvC4RoTV$RN~;#PR} zw!ikMEJh!y`F;J(yxn*5X~@MlEGg~>KR(Ei0`#IC;0bX)XycbUdl^nHcqkeWo z@j{!#*FDhGk^{`701TnArN}Lns9M`ArFD{ETLkK!de|2zvaX(vkEV(ay zUTlea-a^n~LOXCK)b9-DsO#vl3ty)3ax01GNg1+OHPr#1E@UWDooXr5 z+2DzIOr(2?S6q;lm_|Iu-3R7eh+>=2WgA8uoG#IMMA0IJjIkVf=;(1eOlYM438byf z{aCS;snr0c*xg9xXX{Kp;-G!K$;IK!Y%sPl;wjdMNv0RxVph`EYzEX-so5Tg??GNQ3#$4rV5NJeHc99yI_ql;TpvP48=KF{e84ja-K5fp6OI}0)* zS^MN(>*v>9eqF89OnHdbJ+i3{7^cR&X7Q7y+kvo`F2X2LkBjeV4W3zksz?ti!FaRc z@Q}dD;zrxkD8D@nnIDy?J6QGUyBw)mC>@5HxNg^j7v7pIyEe7Bu74lS&E|^OPWS&3 zV@ee)!E>cXRk1#=ClU6&&5}>7o?*w-$2Fk@}hwXz{WgJS$ zL9eJ(ozKrEpH6(g`Uy|&1PH^v@DKk<`R!f!n6O~*{^NfT*?YG_cn5p=Ao*iZ7Au_f zi950D`0rm7GQBo$O0b)RsVQPS?2EaNt<*k-I$GhO~J3pa;|M*&z=*vELUf3HxtF#2!1Tyf!wTj0E*QV~G;-5wpSQm22k&0vGd=L@ah*=S*g3~f7ou@Ps_8Wkpi7~fv^25=$AMnV=O7oj+6!K6>;9WDOfdfgpFLZh+-SibR@eSFBqYuSvI(p(886dd>~9B_cBZ> zF5J{x%*`QIB_w1>6^?+jXSEGeJYq2(d5lEA-X+M^&bH_v^o!Bn#XMhw`Hf5A37iH zDmTn*;~fGZpgh)u55kfb5w9ol?~w0MEtdG%j0OA_n+w@EhI72g2Zd*SghtVSPo8;> z=vD7oL`r}E$z)#*B4@4~fF>j7LgA|9>GQAWFD`_!;N-YA%&zQL7>kA8C9cNBKxgd- z@xar|GQ#c84jF+vbn^{#dH{+HlaG`~4v820G1@v>_Uj<@G3^_Onw1^LMZ`;dwE!ne zT^vQE@Kk_WQ+n`$Mdz@)uRi~PeAqyqx?gB)SgNP0@CZi}3rY-b z9Q1p?_w03NGs-78nb@f=+)u{5l;*vA8mk}giwLN763ylgcvJBDsF@GYs;KtxH;nBV zPqzfv?g9BQ^+q661wH_H6cn<#_+g9Zw=!w)lyxDk9%>^jq7 z(!T`rcB0smR10ep?3LvmAJLR+T_{cYR4lf8x_|e0{Z&+K!k1O3&@{?Mnk@`4_Z|04nggM|)bNFK)Wa zalagog&nR&pJWq%*K$P7cox3z{rMoZBLKSsUwW{Gt^I+Y&MM~MDZ-qTS$w0&mw*Di z49e#Z7$GW<3q&~Li_gvx2(U@faAH*dqDrKK<38J?a9?#; zDm(uHY5-uYp4z1Ec+J`YEHYT=L+!QoRb5cj5brn;m-}RyA>(TMq2o|8;yvMH+!v<> zo>A5zcc)&ig9DDxjiFm@2{Jg0uF9lzg!0oJ>=P~)r|tok#wnjfnW*{fD>2zP9B_#k zf8vBcLLezEBkYF0CaW=a!KTekH{6D(^2)mE?9f`_kT1EuHsfQi#4)+zmOoDQPiV)eif0a<8xxaaPCJ1x=Tr087+@if;&R^aP}nsH~%_tqr1m zW|8n)h{RBbnh4EK%BpNE>M#G;jQb^gklgl;zxQ^5rDyHYE?}_NH{agzgTQmh-fuXq zA>64@1dOOvKT7$rst^>!3NWf31UGgd|H{s}lhVV37E2A}wM67Db;7K1sp$mDeXGJ@=ZHDH6>rze+^NA7sp90V#GMY z#Y~j-%ZC>6{h7TS;S_1S1P&6ZGmI1qC0hN|R(dC2^Y^arx4#y14`7pfG}c>2Z5EeN zH=iK=E#kj){SKXW7xM`x%qDQ}CDYGr9P$ zS=&)RnWze< zF;@o79QHWdAXdiigqWd60kAlEQ@niq#Dc{PR=9akjvD0#RLmqItMn zT(Lm~^> z8%!%rBRZ#{g3v>0;n~b?-XZ6Y+&nV!U9szH->XlzuvJ3An{&7az!_e6z)B$c9 z%e+co$A0c4V1(sSdQUoFt~vLA553(mI>C*7YFrW-HJ~VnsX8{x@<(848S{GBZa?PP z(KKyv61++TQ#B#M3Pcn;SB=(viC-tDuSUV*ZR$6W@a+fD1`p~`$kqWERg}e|`RC4Yaa^rxe#u|5Yrj*)VYh%{+*GP}sa5-S=cY_q#o&^O+#^F0mgbm*@RBso%{lJ|odNbWXlyk>h|%_srFc-tnek50};=2GV_)j8w0 ze-c+ZqrJ9I%Jz{Y*U2_q$XtNkdP5Qy-#&G<*h1jXokk6$il<;9=OROXH8`d+D~DAq z#&kyV+_u`brsYoX&f*{OL0*=DJP|(VS*~2&bnW@Du)a$SMB=*9qSMX;%fR^n?(Bnb zocMr$E4=)ddDM3<0I8op1V|lpDS+{;5Wc};3@}Gjk#{W$!D~oh2Y$wesPjQVFL$B; zN&Q5+0*Mm<6lpdefg{#7u{}4q`oKxvqPmm^P_!Kud`=;<#)r41ehs-xCUW9G@Dz97 zNwi^iWjA3g_Wwc@NC}P}5Yx140DLLpgWe$*LhtZQ-a&ZH>AUd!R6eM?jnZ_N`I)rM zC?N&mGMMk!w^3aI40kRPx`CY(XP0kc+t((dc@|lTP#OdO?x{PX#q2E^#pa^u*q)h4 zMT!Of05hS@?#m;`w|cgBTRNWvm{Ac`q$*;kr4Ci6jSGcWWnXL%DRI79_$HA(3oEMH$+az1sc~Oya&Lo9j+t1;G49iM zD+ntVvbnr1nC+mC_FJjtwf8AYqi*B!)*xe{j4qBMvzfe>Br8=rs-^$6&J5fX2Q~1S z5}9aBdj8GzPvUgzlVTadUDVmpJorKTp^_XoiG?AkCf*A+20S5UM<-X2ZrPO8U|g9Q zA=&95JO6kSoA~?XhezgOslzj+hefsk@K-)a5l^wPw~8HwOZ^G&Kvjn&==jY^_BTEw#f2R%e{)(~DD#%5zZkgrt`oQZ>2B-NT#3F~b zJ!epY&PSf%_3}Z$x8VQ$b`{zHS-xQDVKL0}W>`2y3DfaC{=SfnINl*E@-*Cm8S|kz z1>^tpIdR{Iq*}dg?7;S-{mz8YyOJAUoX4*O%-qu|lG)3^x=O^cM%3LacL~Dt!lwy@ z6CZlryuvX6Uqi=o%mH=EVvS8FkuCV31Hvz%3jzS&f|TJvcA&hYE5f{I;)oqGsx^9M zMex7=Zc<-{u3<{Qi|v?RnQHUI&OxQTW6DniPdQJCRK_ zMrFYE09cH~-+a1*vOhl1*)$B6>oFP&}R^IVJ3X{$NnZz2^BhcZ+3!wn*B&Uoa8z?3C z-Mq7yA2EkhzRt_Zv!2*brI}KfJe11%K7@#xn;bvXU1W{@b^KMyjhqD6p+`|zHi$Qf zp(oJVTBLt}+;m##P8P1$0R z*iyWoKO^1fN1ER)7xO^}g>s%l;;XuqW}s9A;uSS4>vJy6b+^C$mdw*aE;bh3F#V~C zrMWP7A_$v?@+FP;BF{2SI2QSivBb@Gl}WQ+72}*eG=!7JRP~XO5+}#56N&Xw!Kq2J z@Smf3(!*2oNaKu0HUVW$=kGe_AbvIE(RD0wIQp;ZeY1zRcSh4!YAUUjy8U^&1T%(_R{3E^)rL$;T=Ig?~m5~)4gvJrLPGv%S%mDI!U)`4mU==u0$ zB0z^DJ)Du1?kl!b z+HHhgTakUQkN>gmKTE6zVvWx&d+D^goc+QGj&UztTrV5VvMP)3?zhUG@Xq))L!4Yx z@J-@5zH&FUv~;l8gv#N4VB>SJ7e+=|)I0M}=uqRejE%Ae;qQSV`WQPzh^hAf?yr>d5`azU2?kZS36;YLD`o*|;h5 z;Z809N^75mrs&m(+%LtG?f~fG*aFY&yvcEREb`+&79gVprHbeu|K)Xq!cj9hr1dLu zKu!k4DcJPf{{kd>lO4#oXg(<98OOgJv#!(52fa+{JO9iW`T#Q9KN+zd%P?z^+{~bF zT*G^id!n`1f#`o86M6gO*=m3pg&e9+me!n2rTxy4cs*BVlhC%l-tC1c^T`R&TtsAo z>DG^?854);$QD^cnmSKbi~$Y4SyPz9{lP#d;w7r_$+BmiLtM^tD_uqQ9Bo|@qf#q3 zE4At$Ad_30PQQLwpVslfr~6Tg+$J_3fA3@jTY_5sdAfGx_G^F49fTIVjQ4|8If&E` zwXF5AuNc*25|dwKsXoSQZceSojb8Y%NwUL#=N8-R96f+N#Vyl9te~Iq+KB#9VWJs=r^YiPcFE~H9c&Ru-xO9A5}~_*pVAoWSMhd zCYTcwwi__pTDps|>9jGb&b8r#YT+|s63ZJDBEzhes=wqMllu^Yaqo$I}(s<|7yEbNQ?cHfIA9OgXly^v=Jit||$Tr@Atr@uixB0~q)RmhXbRfhhY(Ck{XlqxML)#?q4!L3z zp>eERIgb06to>;ToIdPc-3*3muo>-_%)oY-a@K}<)n?WI5S{?Kqa8)RiP;s|La~-0 zD}Ajv%)h`06ZXHs2s{tK9ia*7&wqd^! zF#ujh&4v#^X-m*~M1w3qs-?Q$0CvGcp3UMz)H+W%GU(s zaReHud|fzN6ojF({T{$ZzbXAJ4r<<6ib%JbVTA~4)5s3CBl0^7(P?>T-hNP3u8LvOAZ~v2-YrnyC?6!vDI$K=?-%l{ zz2w6=;uq#Srzhv1Br=MRlDdj5!uF$?N`z%T=;Rkg^k(9d(!aCF`}c?M#|mnHD^~Zh z^hDNvGqABvw#lHLB&)~Z(3R_c%fFx$W+;@09|FjY;i!E`Ib`n?=LtQIiz)q2CrOF!Djx9DABxLPuZ>NO);bCJAepzmup3RvAg7URzRwnqU z)@i>WEzrc%j?>{>QKlg^eU8WL?>|tw18IV5RCE3 z4;<>}cWDj-Kx%WIHWLQaxw8OPz9NHVb4XMGX&e+UG2^_bz^`qfl0yXzcw`op{^cBk zhT2u@Xsdg;9lQ5>y1|C*3go#(n7>K=<485`!#>lotq((uf)XinzzWp|#FOfB1n zm4V2_&@I8cs>FHlhOjSc#)g%JFv&nQn$02A0rmy0z>|#T4k429HG!y(Z6bAS>m0x6~(pbR7Y)Z|$_uCcb9WCqKfeRX2iw}xR zhTVE4N`RS=JlgH2!h8L{Q4Qb=B#tO%#&RyYaEeK?-YCzehXrp}9N0Buz<;2=pug#3 zQ@|psAJfiCtEQLLTKnu?7g(Ji#ozyGC{DaGxbl>(n+frHXqRVm^0*LW=|Ym+D_o^v zD$_51%0&7u{!3A$HM1$p?~du)v%xvHd#lZ{irhTh#WButW=KS79{_IeoGg>)?jE4v zz66Qs>UDqM?8LMUcRn~B`w@FiU+y;_#8j#!Bx(;1k$E}y>+9YgbJ37Ge~-Rr3meT5 zo#C1ha+QZREtSP{SC=j))_zP{w=|((k0U}S+q1H9`I@~UA)43ODNoF24sn4V?m6(9 z+%9tR;m~>KuYyItuq^4%>{Qmw=2_h7bB{tB%h5}E!)^47SH8akj3ZJ|weKvzk;68>v{$0vX(xpQ}v9CNSw$ZSikUXTDNo0Y{o zB*He|1%Unmfw)zk%`SE>rVhHi)NdsxJZ2!G4P6tX?iie z;=9jrE5t?Q=>I43K*jzq;K7pytU$cAy-aHSzf3WFkSNp$ATx_j8W$)0&`!Rbf|T9-`rnF73U}{6J3p_T)4!8SgObIhPnZfh>0q zC_Hlf2dUf%tdg$B(BhU$b!=IJo5NKHng`2PHB(i9GVr=6(#BKWK&RL-HC0}y+0ev| zqtV10V4}#hr1_pNFZm$GfV0XE`Q(xMKOf+)qnm~AqC|(ey}?;#yP9+AV`f*P_O|3I z$6f>Yn90Cr=$phQjzyCrIF5Jv-P?N>Qn#XvjGfk6umZKwD?!X8q{Gybbszq!XWWW@ z**no0eEj@$)y3aB?k7zl2Rf|Us>ik&V$iRFDM8!6!9ST)-oZ-B{wzvdf{N6}T<6ft zj(!7ifdN)U0^7MoKj>KjC!+o^in=sHr2%--#&#v8x+|j>CX~I}k3uV5l4=_=H&v$_ zUHi#V8pYQ-^9tazZ()xFPSR-A+H;oVebH2>OQejR%%t2$&>NfFIx%8w;qq=)aO9|8 z0&A-1D^JoSiZGAjh(T_v7lj%PIL6r9$3%)CT!4RXZg4qBJ<&EBxzgGv`(`nF_Ye+z zA@wKgum6%i0AS(s@A5|wEA0P9 zPwaY6a+h4mHKz|vCUMXXirgqO4sA!j)tz^)9AF%Vb`NnbFrVs#t{H4q*doaXnZbU$4kp&Fr7#g*eDOglg)-VBGq9uCK{k6s_CWMjtpX_;TcPdwwm+( zo^ks={jG+&va02T%C%b}e+cjnF#0=5m8f=f98ao|s2z1lvaHr|SaoUWWeKC+M3ixt$td@MT=kbyZpyn4Ivq*T4qH`&gz28fS4qTu zjK-FWJUu1?y9hsZ$=q{!kJI}5R8A?rjC5?DpYYOY+}ikTKVbP^Q8u}ustM?3)_1*H z%T8u{@DwS;Z!)Ma$e*&3aWaw3mUqCWXYk&q7a)v0ayS9JV)04d>C`A7BH((FJ;p!b z{j(ESKW;$n8Olz~92I;$3+>m4cmt3KcRKl?#Fy{Utf&1nM1jC6aW0N?oQ~>f{|Vz> zLOCn}$!_}Xh5Bc^UkdePM;3A?jLLWj#zF0OU3^gRncANJ zQ<~@h(M9kN@h^x})XE1bL<(!}3fL&X?4*~|2FQ*dgpyE@lj!^y@eQ zyx7H|^;?EZEc5blTA`MgyL7s~v54OXGfFzt7I^WUEm1eBvetnXr=ilhhMqM48~me; zno_+l)1=8UR_Nz>Tj&eoqQyg$utjkH4|S%}PB(*@f?p7!;B2O@6FgaYyhC~ydfAsX z?xfY6k48Y?^SV2cH_Tykf8~gZ4rJ1?@+=D=4stJT{z@03jX4y3U)7z=dOVYKPj^r77 zEdiISvvNY~?cN#HL-RU;fl>078>Y=!4D7Q=kr}Qr;g=Fnzb}XyZq0twwptC-UVl?? zZa8aX5rd}-2ov_kh4r0xpjm7>^W3YEozSW&k`(XMm7oYwwPyu&Y2gFqVRT_WfLGrV_nS27RtVcb;w$+J~?LeIKLpJli$tWbO9o<`yk zOQSMQZDQSX`|W$bkDP0}4uGs4XM&#?1yv0rL?D0#@?CvV66E#jyhE$Z+*If^6JEwl zY!`Qt9PraNyy{l_wL1Az>e$S^!$fM_iV0(aM$KyXYTS@h%kb@l=td|*pR)V%HaH8|zXE(} z`e{F&BC6tYjN4 zsu0fV$!hlBlxAI4MWW-fv?ZZ(OuSy+R%BC%&Vf94STP_><(p014(9hIM~ zn@bC~69-mEVvIG;@wbj_aI1clL5Q@k7tSUV@2F!g$C^wE9J%)Hi_Jb5{ErHuo`O3+$O?flu2n(K` zX0da@#eD&(H1M17v#7?ucB;#=Axr48+Wx(+*@42ZhL#}32BjWOe9)nE7JM)alen}A z1w(y%Z+e2i!sGv_nSEgzy*`JF#NOuSS7TQIL%*y-qoP0C;%wle3j*<);?`?xz2Uy2 zW^T5$>vPCCPmBr9$NyXHtf(^}{`!29{^(ptM;g0u~B>@3>+ z^P5MxVWNV6g&!s^A4xjXH>zv(BsDpYE++o&!`K2Ne!2WqbrS0E`4T?pH2l!B4fp(T zNrMwlo_OfjM50Cg6uPh1e|j7 zi?sxwtG0-OB`zG0doS2?&M_@Y9=S=!evkotQnme=l2Zcju>`Ngm+ETr*>Do1GT3+C zsCs7J=2gD5$1)O2j&-(vcZoSy-s=X=oL>;;9OHvJL=Hs4@+?msTQxsp9i9}J0Oa+a zBY-E`ikr<-2cED@$;>JjzyGN3be$8YQTR{l1m2CKPSFR8KOPOQd3V8S!r8PU?Zfv| z37Y{qSBs6uYfFrv?KcYw1hqrEk*kFWqkLGrtWY#TR%ArWG5z)GhljH5DZ=xJWU!>s zzR*H4G{JY13%gmTAtl)sc;ecp#M}dC@V;+zHB78k)K;SEa?Myt;#G@$h+7c^ZK-N~vlmZ!_Ly7hwvPN(e?*y!+7iSU1ZdAsb1z4w!U47L=M+v*jS3nWHq@)>>F(bj+WR<7f?-F@5qC)+rI z72#pq2gezRY&`vroqHWK`NM(tso%bKxmlYza8o&}ruFmcid=yOODV4z0^DbBnDW5OxsE1M9d-zh&#;dXzWq7(pcxOb|r(aEEjNRPOh z-zPNvmi5 znA3nK+GeFMgb(x$g0Ou+2gKg?8r_14qFVjQ>~rcXx#v#~YpC52;n-n+Qco%R-5few zYyR>4kLP#qKd;!czq#y|tZq?&=7vhTZh4xkxN;iav@wr<{;S~?`SZ;gKkz{sHD-$l zJ7hb!NKpKa#zz#GBzXjr-q-exrrXER`tGD zm1K6d_2Us&l_n6!=FZ^#%Itj#!s(-%;=D2tZM%<^SHQ&s#kBx$!?*){zj zYfVr%PmGHCN+KN5nIW`A-B@*epIzQ#DVB3NdG4yN?j|-o|N3BbPA*~gwTgmM@EJ)@ z<@NM0P%Wr8R{9FnFC}|+dp^LSzDAx^+=4yg6LcUL{I|1jMJ_6&>Ef_Ih@W7R}ar^Jcyc#5z7JG`;mB$A))(i!`n? zbFv@6vGJonEu@^KyI#~`x*Cd2;%iOqqlpe_2) z=Ln%?t?v|@;j>n%Q}4_JEF?~1hr3+sX%I_FK2jEeGbJ$4ffgDaDysU5Yv-TD3BwEtYJOy6d+1LFNt~I@ z?#w;iG_ob-5;0kCQKhF?ya3s}!#l`k>!1%V;OTE^nKPd7?!@a;?hjGFwzb!HmR;Ef zy$lTHPo3Jz^Yrc46!Y0mW1ZWt0k?{S@7w)Z?nlbMsAyb$CUX29NFSd1itIGU&=wwy zyh4#AFRHv1C`innJ~l3T;Jfb;gPJ{`01+*lp*~Sc9l?GB_$_#d`I#E*(*l|6BVUYD zcj7n2Hn)_OZwCT7GEzvW0xEJ??WBu!IQTr!`Ci3)DAf5e;ViKMP$Y5Pbo?;19c*_iDEbTa26BKNVJ)&ZA>nxN?MFXXxC*@u$6> ztky~WrqYPmYyA~_N-^{r12jQXelMkXIEQ~M4D0{w5AyDiK<3=jS8tU+63Vmx{ z&<&$upw#DHPg9TE{*or7dy4o?th6Gu%7LNQzv667vs&k^O(>|N`@WQRbinNrDm;9V zZ~p!r@I&KhOZ`T`t{pH5HEZ-j>A2M<<*%V)77FNtrWk()augaqd)VBRP$8Rl?!kUG znmmNw8u(`z3BUg-Ov(!<1Gj|OHVvij-uKfy1^r9A0I3=}#EVV71Grf*9Iu6iNA$cK z8lKxwsoqGV@;B6y2V`fpkSNS9ra?VSNJHT!mEDR1a^mxkUM4<~3a&EG6*i=X!8ae^ z&Vt389!-Idd%gzP{aS#+CJ+taWuX~=FHO7~{pc!b9C$7Ye{)o~Z2W;zgXcx>weJSd z^7J{a$}O*AC6WcI?|9ojJYs+QQ*n^Z!xBB z%I(=F5h4=}@yK&b+%NeA=rK=^<6hMwzB&73U-$aYoTmvq9a)W16sMOl(PQg2v;KIC zRpd%kh58zH{%&=%sZ5kC%QWMzicr9HU{bve!E|&1VAlr>!0CL;EHG!lJ4HDy;_3$gO_TU)L1^R0%@zJ$3x?U3svl-t6J*>F@wx-8chS%{Om>yYnp*`>}2A=LhpUzsERm1Nt`3 z3tgOS7b9krQ_d?~t)2MDWAUEG&MC}Z;sr4QidfLA6Sb+igkc^Vj-wEgUc2&+`TTR2 z9XVckY=6{gGO8WYzSWN901V$7_M0fm5q*mny&+-yn(jUPnzAp{y@NCfC-1abUPQ@R zp&f@WpH}rAJKvAbN8X$cWw&RQ*v>l-y9<2Hx@9(N`M_NBMn_In=LbHY&z+eVhl!|#ip}v}m4!qM!u#$P zD+3&Oqx*`kld6iCx3cL9-E+Z?6Abk2u`uDyg#$9&j`$$wkr zm@DnaAJ1pLq11mn7K*<6uvWiXgACuM7v`5g|ZeID7Ra^nysL6z4Xx!n@JX%=d)D;pD z(D6IdwCijYat-7{tLHb>{a?;~IONl8SR*9N#jL6Mk>wZQg0lZv!*W)`;YVVpL4+ zzkfnOXFoO=7!-JteCrG#Zh0vwl{yfIxx?&-dQcpi$37laA`6X@g#rTza3By}fk4#q z#50cr84(b71l|Aj8S}5tF8J*p)GH2~cREuJRilr9P&D=pHn}jelJFX-Hg?KLS8AVRUoZ?w=p-710eZ7gtK0CFqodY| z%rq-R9G+g)k+L#E+wAUTWtnBKQL6*gnUQVy?M#rE)mPKnr4ymaF z5+=6=p-Qam%)s`TC{(;W#}NPYJ+jJc<60p%5AhZcST~qxD(q$c$QHXGKxnLdi0cFy zJ2X=po^X@3;i3jP>3Dp_P=tjvZnY1-y1SqV{WP3CwuS8%^C>&91SzZnnwN5;QGGAOQBPaCsYa?m^R5amm&ZLDnJ z*X(*?yPmK5#TElu@sh%*Ny{4abWFBbr@Yn5t%#y+%sbS1L=1vn)AUdL82uAJs#iIV zjO@>H?X34kL>0&av{sH2N5wD>F%X-_@pK8E`!s@n8#ZC}v|OKe)bI})_w3B0^~ZLR zrPIRo*yjdE{>58CKL7kW_M$c<;Lp9fGr70CAl4(kTZ#1**b4cE`d6!AZazJP;dG1q zrJZaAiu0ILmq(D)4@*Ix`%Gf=%Z@0|+OL_@=&=B&SUuUjOQG&-llEadP%k6U|3%(= zKt;7I3&R*tK@m|hNJhd886<-U2n>=PhCGr)z#&RbN|wx!1PMxxGvpkUoCK95SzrKV zh(jFWxAB~N-+A|)?|=8LfBj*t&$V#x*}JQ{x~jUmtGc`PG1oWW8^^MxU%~CZp6^BP zq}n6p$L=-pt!YIe`IbQEry|E9YOK!fx$G`(m@)i3Z1CaT@9_)mO4H8uNl|CA|M(r* zT&@s>t_#*|OgQZnXwy1lXrq?tTpH!JPGen^r0w(msQ!-*S8TVs_R%KX6*=%o($Cqhog_X+; z1-Wz6km%3b3{I&1Oe?W(x2ID=mym0jkR68pHTBXVXJ$R=UsLKx=t%+VNLdaIZZH0E zvK#XFi(wVJ#rU*3<$lU}=DGk|rW~+_Cxnxs!RWk@!POSwc+I9-uZ!Nc)IoQJ8N6Ltl*qSGZ8?kia#@5aS_D7E6^LVq5J8g zl{W%J*Ywl8*8iLjUcdl1ml}W#Jg?6)61^;~%W`2SziJqs0^xjb+;|>yx283wx3{0Sfhh}`|#X}mbJcC-{FdU*-1Sq(q9pxvO%A%c&^5Ix!4nJ`lI;2C&ip;qQDTJ%R^%Kz?a0CAnjjwsYf z0J1ylcBSwBODaj^D@tTyY<}#^c})AX%K2eDF1BL-f9V?kJ4yb2u4KZQbE!%Dk#iC^ z`3>!_iZ2{QeOdtoF@H!EawV?zj#>_fa6&}#&rWX810Y|S>c34rXU^Vx-mKd9ZaLXG zCG*h|PD@EKfXMpKE4cX2KQ2xJDQ#K^h)bwBRU8Vu%m0sLfBzkS&h5)}K+6rr=_xqe zfNsJa@$gT?54G)bY!LFXlaDB2zqLjAf2u8ae*q%BYm@X9&;UdFPe3{{g3P~k?`)gj zW(AU=%MMtsyRZLZjefKC|LQk{kU)Dh7C0?jCI0d}joXKIKrQ}ABN;d!_Rz-Sb3t1& zwv-maS*(7V`0q0uP%9&Cm-*By+(^L!nI}8|;S63Q(?S15jkQG-BDvaigJOOhS|V^IcrgW`Xs z;eXe)v|pzXx-^jA+yVCMG-@pm7=6P5h?C#`XZf*T3VZQSQ?tB zasaa2{iigmI;z@nYWeX|g#yjR0B5?f|ET!ix@t;(txiO7E*9xzo@b&}mj){NV<=Qs zBM;7fJP|LRo(Zg0y_r29LI17Pq<@rCpM;T{>w1TMQdOiV__XwQzL9t z>whG(e)PihrRBe*vlbHgchgym{UxWlfS`zg;9t^NyQi*ABkBUhMyux%ZxJa!xOh9} z)n$673xD1QD!+AOOtW&g4dW($SYCc{3~!&CXT|a1nkar=_Uxb8r2mms`v2|ggO}S< z8VySx>c)?Ns$CK-lXD9;j!@V_KN|B>@xhY@#H6dSXcX($>jVT+AyuyQN=doLnZW1c z_3x_jH&RD9&wN0)=H3a*v7PguE7u;(^EcMb#4Sc&0wHT^^=R77ndu^n?TLo7QaETZOo!a;7RpXf7N0Bxu zYT(_;U12xMNy**1{^V%t`!D_*(I+`|Tlw`UbKwoTq!(R|kBzMr_mq@pI#ogosCa-6 zDO_11Q8lycH<;XSdO$^MG$ibaI}=u07vVrwBTg801hZm0-{xAkABH&6vxn#ze?b-) z81U+_8{Ph4aP(UBqJOcYNN4RFnJAA}nQ~uwt=4*JO0JfZbXZN=*me5h}cx}CL%c3#A9W_!5Z#ZQp6xEUc(mNoH94V^gD#A)6+b|Sl1&14w zD{jV*>^B9&SJSi;2lRG3Ng`)fxfW)~*}8}#1@cDG>O9V=g#> z%k=Tbb95R|sESGW4yMSIddFz092{U2Wu5YEKo3D_Z9BUx}Od zq{UjnU-DFh_x;8wu)ippI^3-l9}Edwjum)rniOKxIWFO=SH_rjtfy6AGlOb5Er3B%@^bawv67&f@RZ9)r`-_EwdjkcKji1a6l z;Iup10zap0W2PGhCzFZlFd&l2oFOEQ{Kq1X^o^RzjW85;zN*^0xmVaoTvDU$dqb=F z(B}IwS!N3PVY=gDZ@y25Q89|mv|X`Xz(+#c)9+iI!wPO;N&5u5AHj>>C~oEL~L~GZsbgoVQDWh|6Tf&yuSB zgXwgMXR=JAm)Kq$L)YgZNHby8K~NO3>Er@tc-0Nx-Rs*sK!{;t@jF5^fB(E zxlaPWnInbzmMz8#WiH!Ion?A$KhbU*6UpP=e!CAQ>g8ydC)q)(8G%t*XoNPY+%CHY zv%-rwt!UfA5-kJa`$LXy8Mp77z3B*eO!e7UhrGjh_IkT#-I3xDQy?qlH2P|^>(ZES z;PC;ziKnl1+DG?e+juRuX&OgI8THYTq(5ObzmVJYNK)T^Nv%7p;JlZwNKO4vO@lbN zd0pRSWrLgcMGkbx*B+`YDW*rh@RdqQ37M8t)GECNx>m1m|3UW>61}O_$P8XT46t*q z-aI)F5hKGgK{;A2!*WWf2$L1wM|UX22A5ugbtz6)`u61nm^HqeHt-r#B)mXlF6<`( zkxeuvbo61S#1qe6hF|*>y;iL3MdIEIf0?tzE=o>qURY=|S&glCq@QLMpJWU;+URmz ztw&kYk_5ciiW>Iym%K|8|7ACIkd<^caBZF%y?4hPg}Ksooa<6{lJy8|{&+~Zjo*mo zxN#sU+Neki17}(JLX1~E1~<9y(m1$Pe@ItFepo|+F8);79yjH zsyj2QidvP3BgEI;`qdJ|B)D3}xbfEH3gg)j6xtzKwZPP~ELJo{3XyRi5mt-YWt;SL zF;4OhdIR4t5{H*ahR+65PCqb%LiJlB&Wep!E}mw9tX_4uXiz9JZ|YSKmBn0gN!yK`k#8~#4F!vfMM8q91I`!&IS4i7pO651PzEz8$ z{dBKJd4?{5EPHSFVP20fI1_*N77aCAU$+X&XaZEP)y*^C#4Y6>Nd<#FukK3LN$5y* zNntE~+1J}QTP0XV9?KbzwaWH2Z|Fo8xxZ}j#6k5FXY8%Er9jE~C%J{(8zBqAYDBin zKJ7UUg7G(CQQqx1lPH#{lPjc``pWYm`WK4!R?OSE!yYbkL|dlcU1gDa==;@Q;NHmd zm2$8OLnwn5T)tVb(?~Ydq-UkMgsDZ|7STH4L9XY%36U`p- zB4M%IwN2V;L;1ATo|YvE)@vB-=bbyve7)t5PcN|IuV!{BWyCEPm4h$M$V{;4LZKHL zx}H>R*FHc7z&cStyw%>L zz~osCroq3W=)#bzt^g`NeNj(9_a>Wul#A=Jn)@a<-dq{C_|-f)r++cV`&!h(TUYyV zJ+*{5ai1V|y(6|ka-Oh}MY>hsmDcRb9E^ zDhzE%*JqmvnA-V*KIT&8dm}dw1Ia)tJ}yZ7Vje2T1bI?2!1s{Y&u?w`rAnbU#StXu zZfh7VZZV`(-RDdlM>SH7XmpiP#5D-znJk-Af!8M9KAA04*Rw=eth)uZ-GhXZ+`Ehq zRA57%d@Kl2M|!jKhrHVqO1j7luXWACC18paaMEBym+NS(l|jG|gP8R-ZG z+&dZVF+H+m;FIz~I<(#Wmd_a)o!FLDqLUyp@HZvNDuRlf_s!Xj8Uk{V^m;?pwuW=< z&xgwhrFHK2mH%wKoBm+Q3T>MGgt<&JwgVPMesi&B8B`|8-Xlk1CZyZCv3gaN-9!6z z`f>xS2k0(+R#c6%=A^s7gKT1b{RMCz?r?ml^Qj}bUee-ljPY$VtW;x@*Nv6w11KveEjuL zHe_SIBxvZq`=YX|WdZh3)+m0Z9)*}JEMyaXs|=a$r|r4?3;_~w?FMU#%cO9pqS-<` z7Pk{HH?Pl4+~v}4m3~LM<4iC1ty3Z>02YPWw4O-e?VG=nTUhwbA+bE75`l{A_q_2N zL*oJ?qZ-8kto16TimqDiRn50(T$)e!*Fm{#WqF$v7;ShYOD_zepJ+;*l3Rz}9M+J~ z@i7qO$*51{2yL>s3yyYZzC9Dnq%Sgex0rZ)#MvZA04te-~yuuKF&$)sg907neE3p;bYiv_AY`$$W6?HOenBDi`j5?LNY9`D$+>!oW z?p)9!1%4&6pOvX0?VaEd=T%bTTL7u%jY#O7^uysqw6;$Hrfe@u9RT!j`qFdg?CzK5 zI_46g>!Z-@+17(%>`_PwXn7Pgd3*`ES`g?LGJ#9j^nJ7nk5^8TKNAQLylb# @n zLWLWl!;L6Ke};9w{f;<#O4oPf_}DNVrS@a}6k)oZ;z; zhb;Bv^TT@vF-Y`7ygmaip)swG?AHPzv)?DjZf^m$Ct7jd<}5nn(m&1PemU)u>bEe% z-!Q|2a1~PhcHNV8U92ZK`LnRBP_3;WYafrg^)W@Fh4)%_nEqMHvHQ*dtZtQ!*kr2& z)bVavA19PnBiHOH-+UPA%^vJc(L0EXL1WgY76hvImXYYozF{+#biuE6sE%XMGyJj# zWO&F8Ja>G?A~U=PsL=da95>R7e%k*54q&ylobsN`RYu)=+^`GMIa5sb=m|9y1i zHjNDOO&SJ-gFcY$lW#_HNXh1(ZMrHwb%|?bnKp4HJ^XILaN#hT+?Vx^HF^51dNZ-I zVY69YozxzwFL~BHY~pon5mPtJ{y=6xNw8+}Q)>+Rp@)03SxcQ1z-|HV_34|4N#gir zBB0EYN1`=;m_k};7!p$)~uMXc-%r6tL?N)WS>Mb6+?=jCNffdLD)!-;Ut#T02Wq@x4- z0#48#kLuC8vI`bV3sLb3+hOgQoPW-qOsR9vCPrHgu%}=7Z>SBCE5;V~ANqOWEEpWR zLTr(7btlnhL z$H%co79|O(y#4cJe2-TFXS}1AjPA3f2^$W|i2?QK2V`=Z$;y;JD~TM&ox4p_Ftg~R z6Eij=4`9-TVYu9566#$=v2lM8b<)v^(&(W61CA#!B?AXhm@v%VBX>(q3m8xrU}N+^ zM+m6Mbbu1A6J%#~$li(YcRu&cq3~*u-TetD`@?3W(L8F83$4`1*fO9)%eGwT8pces z4GhLPo_lZZzK1j)D&q(Yt0oQEGJ+Sx82G61+~hzv6;j`R$V4(fJwYs+%d{ZS|GKh>< z1y>B(^X33Rq!`(-MvBLizp<7qbE=b5Xy(!Hx#dlE-5 zcY<*H&0RR(bATc?!Xb}aiB;9swC0cX6Nxgemxbtj8_>uhhDp{0Si}m`Yq8)DnBZ&5 zE_`e>?TKfuubgd`-^-u3r|S0Uwc=|1*0r$rfo;Fa@@)IcOPCo16@r@H(-H#zW_ z_nXxhaU)TI88`9^Ax`4Dv-_=v%JeOBX20uBIQAr9w|%{rWLSd$F)Cg*c@Z?UAT`)} z!53>d&L)|P5n5;^OY*MbTT^qyWEoSD0F%oo-{{}^Q3S)Gse9nd(^-CgKk7M&=ejcc z!)(nXx_;pG{qELoio<5TL37Tygkwo^ybT-~fPmAOr{ogJBwCiN9mya(cTBFyows6_ zyT_Ry(Vmj~>uF&z*1(BL6^wmU0-LBA6P+dI8lSs%dE(qy_`POyvD4Q6DDGGSP9v590Im~`I*Gn3GuAerb9$o{b zr%j7~r%gV*GImq1G*+E*X`i{t*-{4wym8Y{bfm9p`e?^xZ8b-1M^Hl>*tn`HBT=PeiRAgF?VkIHd_HUo-CpK>oKJ%Nu`{TXE zH7rB3h!gU{q&u8DIafsk%mKffhoO!uCd7*o{)QB_wjz=>uqw#)Ym!MXu3B%Q5B`9y zXWQ0|y(yu5Aea1Z+#2&lk+|W9CbZnC86GX<@J$3=$ZojftANd`YIZO3 zV(+AXclP0)iX5_eOESd*Piy_`tC-)W@muD50`Bw72N!Ny4gP9XlH@6#gSOt?boU-y z;=h5IT#0~!a3lJw>^nM%miej=e(PEsGDy!upfk`owgXygm*-JZRiL^rJC*)9n(qE~ z%0m{o#}A*CVx~TnE--j>!(@NyW7CsLMQ`4@I<{8BFJC1PgFfE0mEt|nCHt)>tf6`g z{|Gof*NoPy7B8G z1K9$<&2JP7wX@OJ8yJ32(0rU6thT%c62py9ysSH7@%a_-8w2_JKI{D5yFKi+^UB-z z&YV7djzRO5j|$o}Sw;{!4UZ`OCe=#cR-d|5{>Ko90$BFyq%Qu=RS#x3pXswM6PW*|_&B3ZfC3CKwA{h?Scq!}RccXt{sk6L(hLQiT2?ysJ(jMAdI zVfxskQ>{z-7oGjlzvb)izVtwMSQ?!7cqo3Ma5a!q)dsQWy(DONzkRiSeTJ*3urR+N0R1*s{jr!PcMdsnZ^5z^%VM9;4U*8^v-F z;31uedcgDh%{8c0P2FO`)UK7as=n+bzv~5mVQb!&<&5hvi!ixnqy=CgO-79UjEu)1 zhkAgLv|{5J6VUXwCDm6?xYUL?>#!#g3vZ7bPXZ9s4b*ZILro&>yeo=Iz{iy11HBUh zgBwnn%pXrytBmUVu;Sk)!khT;ZMRG^UzAXIodND?xsB}S?I~e3Ui6t?$#RtG?*NVocihgG|jl-ipGU zekRh=n)=-?_2n3@J;aP=c{RB2JhsoV;S!$tg}zAlqLL^KnqYJFP-;-?k_A#nM7Ipa zo>MaIxFA-ID4N@PLasPjtv`6lvvl+nT8FLAwJt2g9jPT+;;D@5QFL8f^KHVdK__RK zC}-t^-XGtJm6FZT>~T^KbX|3ZGe^Grn&g1H=QF!}FeB0NVXmod_e>xgrQcqtHk7?$ zl*>AW1?($Qetcc6*FJl(GtpAtPuY*F=?K0c*4gkT(`3D7NQBi9eWT2;6U+2*S5n%9 zk33(I>}xrALCn<{Hs*P&+VSg!o6)~v`rEqvz1n#Rx)nP}7T|USn z&kn1-oCs++`8xw?*)H$Zxl7$>!-hkvwhlEyOqrfsN_Gn1UVptoAEox`~#6mZ+mbPqZ#I`(Gs>s17y_O?jZ( zNsZ6>Q8u_~wao+|yW@4Zsy3|A^Mc5`#H3t;fPm?`+3aPF+sbBsh3Oq@1O!h(d*hmh zX3#s-jW(0I#pflcL`wT-&&gAj}ulQ>EVS>_rLAJ*#NI1%T-*|R^y+(M@ zc?EasTH(!3i8{qEXRvkUT>MZw11@$?O9vrl_iZ(f4vW!+E9M;iYM#It?`I!nJO+gV zCUXWssW`_w%6|jb1>`HVE$LfxF@}rhmKPS*ql|;cTw7-E0Zx(SsFC>Nn=J6r33sKW zcuNmy%b*pnF_x0S9k7X45YT=00XIP4;)sm-<8y6tHfEULc<5$KWxublMSkuMyl1wZ zW`&cq-8xF$6J4cOXg0Gi*_ENUNLZJh`7i1$+^r{c7>70X8NtKBI$g0HBXm=x9^*a zap6@TDAZ?G)(T~lzFdu13@MBf>J(PXLNozQ7mNfxrfimxx0agL0Gzip;goJYNyXT2 zTIyqtDzS_TCQ21Sstl#X54bNbuQRkLnfd9T#-Ce)G5(TU0bXN!PrmhJf8?FQyGHj}(BcyL}8mdgqjE z_&~?1sz1enP7jMvSYcAVlX#2cxk!skp6vuZ1^F3n`{iKku3}eVUcG8wnvE=KTqlzDW5XjkseG z;#w9{AVPtmQ^@7QUNP65y-edLrg{*YV%;28FCZ?q!HC2NXhyg8f-t<$=9FdeS-IUz zPT>t(FQFT4JaHqv)T~n!acC2t7su8qIn&}PwEfu&V+s5gcD?7o%X_N)8A+DU`>Cm)-uWxHsvH*!l( zF=&(N)wN$Q+F9U)%RUw?@53CL>xT|k5@stON{t#wcNulxsinsh!O(c_eTT)=lvJQ# z*D{?0DH6YuIM-WOOUU)!BVB~vC{A~^5Af-$mWsRrL3!Z50J3mz3QD1XT9PvF-9Qr{ z3R4N&Rwu2+&btf)_;}&d8*lvsLinUVSl!WqCUl)#`^h#0T55o97PEB`itTJ0#tv|> z!JBL*M-9CCI((HL$<=K<f=KYNMJ>6iF2|247&|VtzbqRJK3t(}A z`&x9`yH`$_B5Gh^WzGh^8LHUq8I>W+kRlN(=@W1Rn0Ca5DuP=_$V^!&@he(;HCf+= z#}*H?Zv5cDL8UI{)!sryU8gSVhDDd3^?fMdV=V8Z*uoo@p2$0B3#0&AF85BmUWA+?ib`t zl6znp6&0~DxqF&pB1!^30AJyvzu)y!@#Qxi4nD^8_?6eqJa;k+Gz2y_xR%%AmkXU}zi%#`;5nl22iqMrz>9f@v84f>JhqOdFVx`M0b5nJmH--W1C z_nR-_Mubi*ucUZ}2mnF8<_&T83*DT6XE45hl2G%(BOO>kY~CI?YS&6rs%nUBt4B5P zO;nFap?-=6DmK^WgZoKTIPhTqPWgMDVP zL#yuzE)~_I zEGZuu*e)_|`9;6e33@E%PJ!t;sBkUtUpMHgr~@1tBPjHPuk7dqhL08s#Z&mETj3e& z+^jDc> zcbCLeHJTx(zb@OBVA@WeBI$$Wij~zTuE*Nk{P`rE4Sqs?MCVKdTlZ-3j6uIr(n6ve zHF&P63Yy(bl^~n3$-_MCRw~wkv$4U~?i^6C(~P+^QU%5VCBMd?FZv!GNZ6M2-_K#K zqBI#tu^EZC_LZrtks;Bpm+`=7r6fH0xLM&BqLEU7W)!ShBzUA-uAEk|Ayqvn>_l!e zbV$f-$Tv@rc|CJTu({TEQ~|+&erSDL0+~k)==fQBwq^{fl_}nvfrq_;xGPR=E#Jeh zyaP>QrP#)uJ#D!06nJ9y_)0u?=iZv;W!ZW% zx_Z5`le`I~Ag$ieM9YLD|P04DwrQuuSWjl6P^^Q+u)W5yl z=9uiO+aT`q_OLbSP@3OUUmXvz-+Bbr!r+1glS|^ShTH=pi&iZL3^5LW)DB2WRIHD# zOTb3Q`&|sOj+chexNPI{U9KB|<3AVC^3P&U$@DM7i?Z%_)UXa&)|)}ER&Rv+FzYH^ z*#R)lQ}g$}7e!kP&`RHa29(1TWpu+nW_2%v z7Q0LkipKbD9(a$GV0=dZ=A(Pg3^YdUa6&E%AeL0Rc==YKceD1c$TDl@UYPZE!b=?! z)`~l4-C{uKRGC@6hrI@)txh1cUAJ4)sfVX7 z{?3D2K(%I~U%O;!cljjr>9-CcOZ~*Sgp9!1tAl@{i9!3az<)7+0b@Y2=`i6yBkp&q z;ukK-0_i25SW1*#iC^-oW$txHhtS+!7-|q&RiU?fEcl?A|lhCnPUcijL#F% z`3A-m@eG1!AMz%A&PgTkXM&$7G=Gy69qkE6?^D5Mt9c7M@USlF6|M9?iAG|ISTo#*SXFcs zPO?B-)r|^EH52@^==Wl_4gZH?~*GHyu=PP%ZKTtk08G-mS^m1bp*$Y#FU| zN-o*+J2;@N;eT?-thlO;f7k^PAr3_s79KXk6WLuzUP%Mck61ahx?)|Oavvw=V-2ds z`C@5?B(-k?wGUE|u>EGog}!oNqIF*vG2)Wemvxymo*QntWf9%<-ZPKPqJBOiv9=Fv zC;OcV5J^Tjt@3Y?Xw_LzRHs0pvE}bI3%z#-WzT*xPDe_IR#rd}^j-OWo(X*>0jAWK z4HkYRQ~VV$R?pTvgFXK&*-_=0J!-Ep~{VM|``2a*Y<|Xju1ykwa4I1hmrfE=0K_=%*!bZ_Mt@;x z)z2ZUa6N)$qFKNx*f)C0AdhBkF<+J;j^hYnGu5dCzi`cGiz5a38qE_DKE`c5Ipw&; z$6m;a&B`B%14(XDA;I1`+-5yHL`pJFh!P6U9>}tO7Ls|}{W_rT>hK8%C*V^*;?X-o zv78>|7CR-krlOGz4^-N3d(BB4a8eoiFLLUWGys#=J<0)C7l#VKfIPIF7|=<2AlYor z78l>4qlZebkql;Y!0YCw0)>{4s)RRXdV?e_%p=l6fu-|^q`a9O0L)62T9Y?H4T(mA zKNVsPnsaB#6+b-$vwh%(*LlgEx|r)z_9)@Epcl;Yo|g2M50{P_iy5V*F|flCX*{M6 zfErbrk!RnFs;zoYRR$hN5pNJCJ+Mf}tt*?(eOT2|%B50d*1vxqA)i}Wy$JyrIDY#| zysBj!283q@myvLF6-ZyZwx25m7grlYy<}xIlw#Hdp<)@L4!XnZ2JBHU|OZ#rqb<+mR`Q97e zss(InNd@~2&ZORZ{V+3C&>h{)JfmjI=t*F{)x-^KFf7cquHOKbYYQQR_f0o~ZuOwG zw8%|EZox(;0(*M5-iiS$I)8Es(d>j))rzi*lPVdwWMwL+hqKyuHX85FGVRG1$hA(< zRGpm$BXB#|8et%`?@}FjVNrV=gYU&-L+erD0*MJWzGv?P^GfEEyJ2Ri2=$`+$Gp#X zef;j*stpaFJEJ}3Bfa(`Ai&aQ(Z~Zz*V96^oy$q=#;S2v@5?OQcxAo8MCpeZlysf0 z;qR7Zn;gSjlbm2pkiB`kDxDt%g9MI)Py6yT1 zZjh0>EC$4M4F`R3feKo9Xk)XE>L>r_>mt|0Ghi|S7)?j`@j5-%+RRAM7BO*2 zyn@m~Ar|0bnF_kQsQl30WaAdgnf_kIW%bglKxkJvGu<+&!?09c?$J4-F~bo;Z6TSZ@x%d}i}_kJ7Orw=U+z zp#8UHs&L>aTQT;h8<6G+;*n~G@}gp#Bg2Mwj<=EYN)6R(9v}?*N%Y1#tJz(0*K^7! z3K7y4F#SbwOfQSW=b}D6Z$eW{(W}6=1Vb#!PtDrtQ=TnA*@bueL-!oUW}7}YDOEPL6tTgs~0&Zq(H?VwOQphfONY!I2;d|`!XdK^?{ehA=RR}-m+a=WVP6JE1)s|1F$+ok@JC3Q$Gl; zI7TWCbJ3JH9(#?VaELm0Z7p>56I+YMqp7>JCi}7)ztfcgZPKDWq)8Z|Ec5qPc+`_r z+@aogp&GNDkhMbCB|ql!2KC*(uYBr7%w}yS=jDfd0OKL@vOsi(MK{Jf2P0(S?Qn}I zrx&(<>n*+c11OX@q@!`2%u zRfJ`BV}sLjxw$5f70?TCpyz#2U5s=MjK| znZi3dAW1cy*4?>JV_+3KI?>M3C1S|W9#~YBEAC31woW!b(=PB8`YiTuwnU`O?A zA+l1q<#~6=Ue}CW;b8e2<;O@uwTrbg@qv$W0l_b2;qaEOO6#7vn zuiV+z<%@2AqpV!1 zUk9S#uPEMs7FP3_ZK$QN5Qd)G7V`2kq|Wh#Wm?mk)W!r&VnBg7Dut|p&UMbda>S$~ z{V%BtvfEM(qP^=u*Po(I&a8o8AzbBDVu5&e-)Fz2)6oKTVVoIm+9fsE#$P)i-uVU4 z(ev%&qH1@Ni3uF&Fd%xXlC<2O5Gw($3ri z_~qdMJpQAgj0_W>wxzSZi<7yf^KURk_m@gKFM*RBzkewSF$oF@ivl%k1LrY-I_>RV z{(kXDP?SmN{(rpCbh01mkRSegT%k1g%2UOs0M5)}AP2SI{j=WH$t+zLEf=Gr6dU$ZM8zkE|} zL;V-&b;Je%pGr&^~wMfwQdX^c&^v`DYH!Libnh>DeUPo~$uUe37L$<#mlM6C7H+wo<0>Mgd* zt(O-@tNL}Q;dhk=3vbih>a=?9lCS6cP4j1{j+NeRvm0kW%*3v%at2dfecWS9dE+Zf z)|`zQuUrZ9m3Gb=-t5*6OjrUHy0F!=UGGfgr|K=Xfu*Rt6*FrSMIfau=^WL6Zv~h6BB0= zy#N2bn%zIwKkYY13ev-%ZwZiRUx|M`9B8LD7pQoe z%__s6LEx%${b;{cLr$Po@M~hCv6_84{lkR65##;87oz|_AjSWK1S#|{2ggR9OhVco z-15mlzhzV|7xMbW8~94)-Ml=Z%h~%5f6WeqGk7T<(b6kyTyv0ge`;SpCh`T(%6RD< z7Pfd1mf0w)bytyPOdybAOn_!FgvZZMim_naK&Dy8dH)dSF7CI=H&y-FuGY9hVZGj0 zS~H`7=91EY1{>Tvq12sn&O39I`mV&lpanKw8>c?*Amd;gL3O$K)(^7x1P-N81&Rw7 zI%K9u2qJh~);%vXF~-Pi1~D=E8<;Xa*VIJOg@fo>LhgVEh&P~z;aOG6D8+aAoC@I& zD?9o&uiuR4Eq;X|Qp62DB!8*3DdwoSWy0lj6HUo@^H}KpEi3x_JVhiue9`8_?hR8! zO@p1H2;qi)np?i_U2rG{5r2kbCyw@roTyMaImkt7l(uN{x^)HJ&pUdBgD?I@zs^m) zy_pU1`Oxz4KL#XW0pb6X)JyPR)T=5^E$pJ)ji7z;j)n&?j$JDXVG{G2ueX`BWN2(F2xTkU<{45?dm6`bkaN$S1f`bKhNa0Am$8`}*Nvu|Z2_T;zbxB?cuwdeobv9$ zXi`|8M;#_y=INTH0~4=3FQfTMho|iy{TtDX{YCVDJL&jytQG_YYoY%%TCX;#qU{-O;ru>z^$kqq)NlpJOoPy4Jx_-&l>Gr)o_{X3-uT-rPLiadvtHH#zNM z^xfZUgXd!1&W<}<3@aT*?8X>R*Vi^?PbVj3-=rASNG5^|Ry~K$AD-bg#x~AK_<&D> zoo%+D;HS8dmcy-<<3r*xwC^re%jwpT=ozECTf>Cq{S~O~_So?z{A^bCbZg^u^9bA3 z;&FP68Cj(TiSI_as4@r-W;LxvL3p11AEmIp%h zllGy`PT5bMuBTZ%hxW^|J0eyMOYSeO5f^7W(axvh4*Z@;CLMEm9# zZG2t%G3uT~8E4FuB#EcG*AVh+^zu;-oAwQ^MUZ6!T{Nj1!?6xz!4A6L;aD@^Q?T`A zE<0v|8U|S$u#Wdtq^w*rK*xVeD||#ZiGbEjq&cJUVP!LA?V9Lz=MJnuqGSXT&6azO z*;pXA!N%3R$+kZ>sZ(SQ@BHkGnHYA_LXg7UVgAQ)} zl4qFUtg$ZUT9#y!aUarq@4B4mMJ7^du?AtEYI3E^Tudwu>&wJ9VAEbSHw-uI#HZv- z=X6h>tbd)IUZ>Q{sn?tB6fn)19X+n-%WlTTj$bUI$4NW+mqD6Uty7;f&yL#iP#sHA zF=sc}EN<6&bqiPzcwXlx@lJ8>&rG=0-e7xA!I?7J4dpXqpp96=kxcH6x{IocheIpy zCBJSC6rSAVdBUhnTg892yDkt3o(Ro?mD!J^Y?4)>NBZ1IE}arj_&bIc81gi|VKlQ^ zmaCw@7+~#2>$T?0_oipXjpp+q;pdd0&grAfGSAISMDs##*iI0gp?cG=UMbJ8c>~qY z-cs0gr{!Y9A!)E7Rl`{JMxUETGTmfmyjSI|!o8kG^fc1r{`wQ0XU|Vi;-7vBOm(t6 zU*ZY;;yqLn{n>TQz_89txJ;^?ZJNGS-tfKwq@zRg+K2EZ@8t*?8-)Im&r3x4?aGvq zj)!0G%oSlaP{>>N3GMs1-u2O3e+(@!_;Sx9-ZN_cWcQWVI=uPf=wgh=lYY}<0U)Y<_=DMlgPLm1~mB$0wIzw(=LrrL}cE{O7z*!+>^BE znY3}^%A}Za&-qrF#KgofCYsk#nlqh6ipcYQS2kx(11`9)G8*jQZyzf0kU^bW+3~&t zZ^4me8Ec0rwG483-z)xee1TP3_z9{?(bc$CwF(34jC%Qiy1M?+{-*K^w_cu`S`~`z z`r!S1^`d>{CJnOnZ!N=;Ra`+r$2lrLp+Xc3#@vqyBYOfm$Cqjnxh}Fmk{L(W7)S&t zv1#Mpu>OUc7hL?AlW1uKk%eK2tSK^h9!dk)tc;!6{aRPqVA0|}rH|aj8uAufr4}39{wB8UnDn!fmk0qH zP+U>Ac1w|ZD>RvD1)tZlU4^MHR2xMkWj923FMP=^OzgS6pVPiIZ5&>q`!ZwNM~r7S zGL9+F0TwCytcf>jvc6jS`t3&zPOEO~*5t4pn<#nV8Oq7K@9eN{c05oXxt_zfV(WSp zXDnnDe7gIK5jK(>g)9V^$T(ak)8S4yMoGdQ}m}qZ2d87ifn~OqW zUQUm#4m6Eo7(YrZ1>e^!s`HOit8rvlX^U$vU2KT38Chlt(nC-6-nCu*TJ_#UiCk^p zRNzGAA?6+I;Ic!`vs}%0^%EZ^xp{Hu0yU7+_#h39;zIhpfX zk4vG%qrT$u%9fv=qxE#mQ;!^Nc-|0#Vso6;K(r~8#TM4qP*uL(x@q=ug?q)DJgGAa`<7fn)Er*9y@82h0BkEh!Ete8h| zBT!49l^)tFM@M-1O^1ow{&)kOh&?m7C#kMUC14Ihn8{94W5*j*nix@97J-=kN^GhNjxcvEc za(;m7M5X(_X7bKAJKHjnwSg&Q)UNB;tp=5e;s&~9J{_%ffkKM0Fq>yTM%L}jt)EcX z>V=r>8+Il3WzYxtDpOkcedBVVN3utF=?$?(H$17V_Q$+==Bpev3^pdT?TRig0G0n_ zX9A0h9~?~aKNJ#lZ0~Ge?D;{%1wWn^Y)!R%RDV~}Z2W1w)8Yk4?6_y$bk#^aO6ot{yu!WkJ z=TMElq`>IdxvbNfYc4;WoSrK%TSR?or|A5N@{iopg#0f6Pe8E08kHNzb7Pn{Mnfrz zzTd2tUao>s6>6{g2D8%ZRbswlcs^C5jRj*xo2_!5*LW2GmPyNZtSOGGpw7%&BS$Z{ zVs7ZNG&tW|zX~Q+YUtAmi$0o(7WeY_t&8+5V!;+4yxm`qk`R9^ltW`e{Q%dfS-11&Y@~$E%mw2OLf|}d*AJa(yJ7OBp5F>L_%+O zlzEJ0S_*7fdY2Y7G+`Kk=_-B5Vo2={$;Dn7cBi3TkdR%vb;K#=1zE~HR7S=OmI9on zWx(C&+P<%fc38j4Xm=hJ2G9MDk!P1N?qIJL!9Ghr;Jc8I<`(wJS*T?viH0bqiT{E5Q z-3Aj}dJ%eA#7(|!dXhcu+o5RUN(YkS{EGswoo2#=x~5u~X=&*3AXnNVn$^;@aBU*I z`6{igR|4VqeHBT{!7t0x?<XXFzvU4%9K_}rA`F#6B3$q zo_1!zH0w1E*TMt#NU1LIOtc)Vl#6#b??Q`7gFzWucw~s;(-tt8liLj=UZr8wuU||# z9st&3UC`Uy+6;>~aVq&P3E}QqVut4P7@i3lz&@ zRt8go%Mn|y-a{gluiigEj!K*VUVG{nT$Xaoep!#!Sc#!u zB}`uGNQl-abPrT>u^|?%+${yT0evN+3#|LFGF$GVh6r4*MXW75GT4jL`r3o>*{b*+ zq%s)Z6SP&$D7ZCh{U+H1f%=`0dSzVMN;_W~IAHbCc8^dn2SU5Y zh}GAug<@GYUTc*zq!)kzG1=mPj;X~W%bH6mSIL5w16+X(WEgA+gI<{jSV@u}fQXz_IdU*IvQHgRLvS9wfl8_qQrz z{KF4~LgIJn>*7yHev1&s*B^SBF8=s_*MA#snJtkfICfBRZSlP3SU4ssP_NXx7Wz8G zBB~KvriHR*$u^$fg2^t4j>sFLzm7fy45n;uR}~&o9q!{fmiAy9_MY9 zCAa=l=8+7N88CZ5s|GgT^cKT9L2+pYV5WmV+H|%wXMOFaX@0e>z8#mfiHIMMi{tJt zSI!rwc-JZRp7Eh3G@U#1BLFZ5th_%wH(|}^x97CxSu>@VqGWf*!Gs2p(BGzGA>TD? z5ct|O2wVm_qnlvIx+GJ-8qPe2Zgsg!kAr#~|DW-Ta}q{byKecT@GBR^N_<27!|&cw zvx#C_tvB0cpkaZ@*Lu=$C78Izs{2fE;^i*<-9(g(bXOHe5KdbIiW#Z6cPOL+l2sFj zhT%evWu1=|%~}dCVD%#7PDJ;WcPK~ZiQ}%P*5&B35#h0V*IEb&z?WuPFgzoQ^_gyh zHevj`xWbIb%{pBqIh5>{?vC#q!w~ilF*Yubg{uC5SUz&DXTyGrx4iS;n zZz}?2GJ>ywCZ%wvV70d^TbMVa$F?z~?ErMkqDcbiLDFpCuj=Cxr-{TNEcZYz$E}z& z@>m1a$0}rpfi*uT@lFX{duU?K{j+5`o`5H!q2ttg^#r(;K#FnA=@UoLZQ%~`IB@9m zU%eQCJ7PuyQFGe3tujL6%%0G0E)j0v#0h|@!gfO%gh2rH#~>hjq5H-M*JYS*a%yt7 zRulSM{WUm}Sbe5$Z4E2#`wv2<10F!Jot|l0$kEqMkT5LQr`vUH{)+K`rBeFQ;UtToM-mNbDbJ2iv0$$tpY8(`iR?$({5C(W+v zD!Y4|9%>nP^U${>^jaFfTMfE9=rFbmt6||EjFQ1&dEYr`G5MM_L<_}cj* zMvT%K9dMd7E1CeL1dx$VIAh~4-YfbR=?;re2#V6FYN5z-tV6Q0XP@m{Ipb0*=j4C+ zd`%`8NE}hV%m_r{M-ifLrccb)u2Lj)xCnqIrfl&lutM>f;hy=T!a-Fc>t}c9CaWYD zw@QovjF4rP1N*73~{Sm{S`PNQDAg9QjfI^Pd; z9ICujRdBStdx)uKoX>of$@_&TC5-vqz_~dXRx0><@60X8Z68@%!|qT^05fI@T?IHN zTz-(6@t?6cxis+dVs{Jp&sfD&z{*6^P3Ar{U4ug&mWb$b*}W=*@C2FLEpY&Xmq^-! zZb+u1gV)gpCsydWwlYYqV>0u=a^TssyR?w0)Vql+NI6so2NP=|ei z#2Kw=8b@t#H&R#598LB-MA?C{;YVUwtY^l{R@GM2`i){aUB_mYosTjvU)0>*`?mmT zi4Q>BoG%=t9&c8xPfi(Oix7Zghsisx99MmYkiC4dR5AhAyl(^{0khlrqE!L_#(Qd0^ z!`B6!ws@`bJVZ&JM@6cIA(iI3R~eyMzG_KW53&OQ7jZ9MRdI1{LfGVXS<;2zSl7pd znN$?&7<(77N8%H%N(@YP%HsBFY2j>}T=7j0&2TO98wCe&yG>C#tr8$%3^LyB3n?IO z$j5^yZF*$Q0!6sHoOdIi<#RwwgH)W-5tD)u zgrHqn!;14XMTAYL+v05nz*bsIOUV#hbum5eYldQ1CA?mDEuy}*Vqv{pOCAB%R9M6; zD}%-Nzo7AbLra~&&^1<__4>9(C5cVPw`++9mgD zV{f&taEVy20oLTd2lxGyVQ-GzWsS@v=W$>}cmUQ%%DYn45 zT7eXcf<}RZs*JIo2>-H-TQ z+vuz;eht83yz780@#;kPMjnrKxlGc|vnoM39anSYo{rHG3rtSfgAtO`V_Ll_pVORiQWzPyI8wt;@msvbH_Xloc=_ZrrZ&n z#CN4Ju3iJbVwn8ZYXL>Tql;!U^x(H+nv8Ei{A05i6gMVqo)2{PpVdip`Vn{TTWNUIo4un%xCEloT?L~ zr87iE*n|>#)u{$=SqnX0okLUt6%{CkY~|`TPCyn~new<#XJS66UFfK;EO%-;BRUa0 zOG(oouwhUAE+~n>DlkT>^Bn*}>())Q8Lz29Z*sJ|I;O`1-I7H$A*z5;WJHHdAdsZJ z=9ReE=qisVL|uGO?qFJ+58Yv*4)f=Amh^=cb+l+($4x{wbE#ARWaV3gCT{E#licTboupr!O5VTkyo79{az^OEM zo6O{Q?Rs7X1Rw*V%ygv%0I0WF^3yXlD~K{gRVJ1Qqm+QSSg%g@ia!9)bzTo3 z#f+pWnWwRXU0&VLM>&}U(hL%&B!bYvx>Q?WYyX7cA@cAKUeeat4MZ;XMyMuus~LGY zpUObja0mW;8DwVZ`g;BjQ>p3K2*9Yw>fu5=*)>9**mLi9g~>-Co^1r#B1R%py@ruL zHL%U(vv68ju%X>4%q=pIl$k6F0Jff(gCU13!BQOJ4U_sB1nTN;o%{1s2KiT^y3ER< zwAQXc{>dP#11V@R%MuIov^pi@0BuZD0h!d%+Kl5TXpTSPHF}wfN(0+kBbQDMHiR>< z32Ymq6VuTEmGwZIB)MknXkAGNA?w

fPWwDepOYMX zhYZGGxGo2Q5=9}o(jMyQ!0lrq7~p^N8^64O!qe;ancAeG`2# zLkw(8$Q{dMv~Z`As$*wy1bqRqhj~GjkJdeUxI?ZoB*$H{0Xz*(I;+eRQrkFvNAEM9 zg%5a4@MT{QfpZK-vq$0ya%G`y&XjEs`y%*U@;F@GlJo@PhOogk&!4)E(;5El)9m5j3oHt*=HJa1JSq! z@JR_HO1{=waPbauc-{CZt|pm=AI5Dh7m3$u9mm_i9t>vFcp90|`+=Zy)G|pV2NNIR zQSH$j{Ug;;QV+*LDdzjij0~Gs8H!vTRY6;Zm)c`XzKYfZFe|Ytu;sX*r6wAOSj&yS zmNhi;+PN$SfvYteI(-PKG+#6azWTtQ8xe4|OlU)K46I>oxbEbxCnahi&xjF5)54cm zwWtV=C|x`+<|#y}8$Zx^#$Kx`x3*)G(NPkY($S4*eWZhcVmN|&Z z92~hL#hG+99QE;mlSE>*urOd^1}X@9c7h3q9Du;!NKKsjzQS!EBOh1YO%UNC?pL#3;Ze1V3om&H*v&7{D6Gll}88!DyhZRTn!5mh0hA1@C2}FpVn@sP*8Sf8CjyS zO0BMvLU5@vP7rr_bR-)$rqG8ZO(6FND}rZ`o#~ell{WgA&IVGS<@RiM?(-#t_37mr ze$kM425dk?0N846z{S-_xK8HyeXJxprX2ae`AyB?ww~n6nBOl~TJ5cw+J$|h$3I?&z^@R_j{EmM1pIk%cs?vy029qB=M4XNXI}(a( z9lr%Ey_wf=T@c@J^0@)<<$=rW*b{(;$x`uc^=u$cme`t(mc7@ALv!2U+?bTRNE|La z;@HJ#brSLCez&-m{uB`}J~NIK>Iw7TYuyw=fl z9Psr-SSP2~?3l3?j}9)Hh*$(Eh&u5>%U)&1<}(%@8zoP(-sveKZD994lB^ICJSu#Z zmBP`asNzQKkz+IymY>Oe;n9RZh1^U#u31ZS9eXb(qX_qL4|CPah&j%ETnj*`<_#;P z;;LcK*EEu|lhr~9zr;hU*sCy~p$vBE6CtE7-2+yQR#5VspDf7r5#{BGE~N&A3!K?2 z3E5Sg8qpX18B&Bhj8+xV4+rCt8z_w4yTgHshzHdcZ6gqIv z%FFTdXiO!#woo+&?5(UYfKN`jFCPy;B1dc1=||OwlxH+)OnZjp5 zPY7_*bi_uKRm7T&d7T#|U1vqY#nc#TBR(v3k8(}Mrfi(6NIH`9V+%5st>FYH%FvhF zpC#-;fVctygYXPP{|}X1ChEx4=90FTJ4g055wW@T&{Wr@btMxS7)n-Mh=7RHOUQZ7 zS`Uh?q=Je}oNP!%85^jAg)#%7-8l@KRW5o^G$p13dLVaqGOo-+na8Y@K&+Kv#ljkO+iH!wf@50_|Gc9>P7kKtB;YXbbV7=`D}Y1RiEOq7_$_s0uXve&vfbmwI*dHau7y;heR##t5U& zx-R(pGMUY>rmWlB?VfjbYe_lHG|C!dH0}5{Iv*lpj?v-8P)aE40ky{1r`c?Ecxi`{ zl}(I~zoky17Ri|*upD^3vempE5T*}~{942w~B&j4Wjv+S|w$L%}ja#0Qd)2avSF#8|#V1KjgGaDrfnD9U}9<_{Uq zVHA`i)SYVqwSrE+AZMHQ1}`lXK>=bL7BjgX24K^>n-95%q`j^xHzq4}+`-LJRR>87 zL|ZiV;A}sXdymoB+uAe{)EKic5(AuE6!gfqV>7m>av504ff6K05l(PTy#k~GBf5^6 zq$uN}B19N$$WEA<826Hk$=K^*INM_vCA1QO{ll7PU$@x$AWowdEd`k$HImXrhV}r_ zm6R!Wi5-s+Dq2SF8R40^fxQvpRXP9_!G;}Bgt!+=HOi{#1l&fFkT^e02VGa1H%KBu zt;zCb9ekZ6K}E**F87vU$acAA@CRfa@eTYHprewL99$H@B;dz@7QIddmNeDQp&(5* zr97m>R{(PPCo?Wh>EOT=>FO`=d23mLj;W32wpL4n2T`Y^)tntk52co&NF59Q z*-H84@IhsXy~z|(d{GhH8M^!>rtI!S^g>bgTWNI~lhLGXC>5@UsfFd9@H3J_G-5PY zr^N>2UaXLdTPc}_6lr~&djo1U-4)~uH$wQTsLmoDTmQ5A6 z)s7xoJ*+0XCJRt&aw#{yEj>iM&w0BC4>HGtPmQa{@`V)O@E(*ezFt-p-Zi|`-7_#8 z&-W;~k1`cxKEmXM4p=v?3G=zNKpZ*rl+USA+6s|PQ#1ee^pAu43!LC(x}aWpPQ9t2$nr(CH2oiO~?0CMOwF8|bdxea4@YUX&@f zM-%|z=}0ZqNWe34H%fNoft@YT3!ht)E261rf;)Wrh+SF@sS3EV2QFsS4ntl7JAmuS z4Kbp$F>0w${cWhsA({}Xtjc;Ag-me1YTPU$1uqnE7HVtJbuMt9sCuuiO$y;N)6$y2z{lpZwtA=odGK-@GDNF#pKp|6?AEnDH z1I{#cZYB?aRX9?XcOPO7d3by*5rTf=jG?l0)g!o3)rZ&2YdY^$a*X1dPOLHwJ?>_yoew5)!BJRMP_o_Nz5jrw^QO1c@N~k-cqNG;4C&+~! z7aUNlKNMx6nLB?*&BZahK`D^vKJZ$j+$xl7=tbBWxgJrN?ohZxcKCDT6lEU3sg{Lr zR6xV5T7oJ7iTtDL1$CfIDU^y5Z(iHYcP@VWE)9j!Xev(Fi9S|vS<9@LwiD(82Nhx1 zo$?WGgSIGeqhT}Qvtcu5;S#MYZ!Bro+ms1Gh}cxIy5hz8i_qk0{JOWOt2m9uFSS(K zn+iT<$2r?QZz&k#a2FCR42_>!a)k(nres0TmEQ1PREKHFSq~bIGJ(xO*3$BD!GVd9 zrJs!=z=rhuR{WHyvP@OT2$MI=XiYd98+;fgPtD`E$h8Vy+cd@IDi)ELguZDxQxL|D zAH@h%hDbcs3aL=$=s$xOgK!hxq2QUT)0rpnKUr!toI{SGe#k`5J%{48Rq_Eh?hPw zO>m=}%ZQ82v?Zw@6dqF2`OrSapO5E%%tDw=i7Ch#D}m!rgH7(HB?2r9k>;~%X%2{$ z6ngPGoF(}BtJqH~vks@1K~(fju0oaBkV6hw*~7KBxdyek$RLR^x<`TaO8Rb9HtnU% zl~olSw>Ra?6c2>vLN_XLjz}%>i|jnkgqp3u5O9_?>AMX-HgPdx!ZP*BG`bYLK9DnQ zg4C%u-@camj3tPp$Vi6&F^zRUhi`4gw{;lu?s6aw)6VS#m*SM+=)_)t1K52@wa{e6 z=0OoP_9^b{q#(x7m9VD`oltHRJ<h1#lkSdxl}zGlwx zGWx14c(@_>$wJ6S!@yFmd__;wapU|-Bo)#8CdXB#=-g;g(VV>rh@u`xmt90)LhPD* zB91(Kk#IazPYLZTyNE1}E)^oXkE_*){OB0vL2`oQHcch9Hv#{M8jj`wPjfAiZHf*f zd#AVZN(?Fir2>whl3$54jo<^Z%*3=!R*>QQL7>o%OtS7($6~s?;(>xIvGB9(I~JvKXRsN!6DkF##--3hBRstmlin$a2g6%89|;8z0(mh;)q||4LXd!=kORTg zk=;W`TgrX3>u#f@(d0G7P-EH$72kWVSmQ(wb*dR&GwT;Q)cOj-Ql#;U#soLCk7Po+ z(N54v<|9Da6!|eo=9%xx6=N0GP5z-dq&WPPc!hB`qo&y?tH zqb39g$(p>Z*zgdQcB?7I14{BlWhS1*P!QM8WT;`(BzBB&-fkS0*viYzubQ>x0N=Hw2=h@&Sf@-?8p)e+vTDo*OIbn-59Qeg1tQQ_NY1Q!5BK&iZyB)-` zHOWY{z!CZ^6`32LLkGhgY1VkmLS?`MdMV(p#NLFIJ;wD;$-3%l%AR0HE5^2gd{S{S zld(@46y;vC*ZWW<{I>znlT`gLkePs;n`KipFDYUaiIeR+aC`xzHo2k+`Qi&yvWIgw zNNZ40q>{SV1Eq$I$C{fT^tdE?YpxgJ1Szeld<_~7Wu;B-8Ly_UOgf6XfH)WO`n=e4 z%444Ej%CWtM2$-^31CsRAg^1v<8Y`awqD2dW%U%|M0Ggkx>u&?bp*%Ji7sms@QyXq znWftD@?w`N!_V+kqr>G|t3)ws1v z1yXk#hF3S^^d&AIBNZX~6op?;OmdT7a7nKgpaujRn?$|JwbXQClXp+ZD>wN!HfbPL zNcnhxlgy+a2L}X)NwZFl1D({D=#V+kNwN%i{0ll+)Q!R=<%v!TP9);}Kqv9Ud;}-S zI()??ZFr8vaU&Hy>;;pg{*8HsDqF+JD!Y9Xgf+kC89J+M!-J2Xk0eNh^(-$FLLjZn zsy%f$t7<7JU&kaz32H^2>;=Jt6tlbMj>W@|UKNOaEHn959uIl2gov+rq?6ud<;3Wf zX&_PcSw@m8A*4Fi8Ge*;&$DSePWx_;mDVYpbx}L21sCl&%vFL41O^RzI-7GC)NMcw zOg5oJxmf8|;R$M}wTLq;Zvxc1nrwLGFsfZsQ((CB0!PJQ!z)fa>iEE(=7hSa71K3o z()}CZOscFL>jdMd;{xu6@s&f9m4(}p_(7$>^-{;I>`M?JHBVa&WnnRd7XS z2;iir(Y@{_A&)4rsSaWrzPwS;ucqp7aVaW}OgTT?Uh?+gur8(|c(sx+j=4B78N~;9dk3vut77j)b6c607EDWTP6nPUgi) zfqi8zD~g9&LwW$}b4%`L$VtJu5bG0oj?R+3_B-~nP9B-tnspXB%Y&<0k5;1>5yu<^ z59pQR_9AguHGz?NG=WztG#I*~fC)ym?8WHar=C?rb(N%r&x=&Ugd|Awb~7O^h4_pT zhu4%O0M>1`8We4z&$J*cPlbZbnVq5!YMUYN9wpW0^p%ySGK91FJPQk@M#^Xc?o`2k z$c2e}bW|@9nlojDgxnLM?6uJqo`_XW&Z{$y7awq2zfc_^3c-=iqKbT71vZIlLcq(% z+8i*YR$|DC%|vN4_0Ax6zSQg>DGe07ENn7W3MO+jn^Z$~L8@t%IA<$)*+XE@;ejAt zAuYw3GlJTcvtU1VUk}nd0OifhOSI=y)e8f!N=&X)5ai@l=1wy9b(^;u(+QcaZM$X+ZpHW{0pf5o`<($m46 z$%qTX5ipCuvROKJ=d2|!Lxx^M0?3p@9+&3Pph8?Ynbc_^Mj^tAdWf?~wR!CiYJ{o^ zYNjM#Ds_f}QnY@S97gs!(m6QEy%!J9V@M}pR^e`*TC;=W9IFY(yT}o( zP~MXiM=rCfHWh^Ad7&0z@&*MID3n4=+z);R7oxTI?*3}>1hN+<9$DxiyxTKnIaJ0p z29H8T(tIYZNWRWU_(Bm%u5AUN1EF?zJXKG;dXf_lRFZ9IN0~rr-2#R z`5?8)ZAHbaQp5vUpKNwdq7Kfbva~^QX+c$aRmz+rUKlH@(YhjYIlEgD9F5soIz{)1 zU@VGn15zw%KA^P6E?5;!v=6TYMxYBCkh~(DQ&^=jqTGK(0K}mhSL8RcM*sm50d*?( zM2rI(lBx8%*Qx^RaJLVY1u2G-}V-D382*M(O z|Vm?y#tE-lX2Nm8XwInxVLS7 zL97>X3o0jt*<*nd>|*RB24`@vMs%S;UIW zGLhyQ(kscs(ly-AC2lc{8fA?^N!rp>)a+Z>Y1{4%OlrJ&JpliS? zKzb_37-}RKCkkCo(sZy5sOA^1ScUJ*vQdhBjFtXMLR^Qi8I)0FxtUVXaePLz2T zHp0$RF;_52a~+QgH6suPAad_sdkztfGNyq3@VN2dFKCvB16P$)WT}{xP%=-dr6?=K z-b4)Q-G}j)l#0N2k~*4atSJY5(v$!mC6834RnirSi7-M*O;u@#4P)v@C^^l*sZcRZ zS*0SYKz{0`U}&l<)X`S6OCiHemXn876Y{UpNpJ`?d@yu^kyH~E5kZ!W5)3M`3Wh7@ zcpqrEMYtm34{5S`%y|>;Vu6Ap!r66A>OLVRaYmFA`Cw`-fICDjCsoZ97!)Vj6-3DXK!R3jg=6fA0vj z?1inXS$EqYqbEtN4HGfRl6W3{UrIIaPh%xS2d0R~_r@~~PlL?UFx)r6M8!U&mllBo zQBz8N9`Bx%I-y@oeW&r7cdsm-v%!X?wX0W~Pb%Bab`23W7H+5Nj8WZmm>opBJ#yM_ts|f|k&9kq-qI3bc{j zGe%*j2{UyGuIA}av6*QDD*QXoFqvFbrXSaWL9k zVEO>-&C(3}pg+sSr&1wR;f0ol36W)5a+TjD2+kCI(BNlbXOuK2v#CljgyAkGBvC64 zF%qRtsR7_Wg83yt$q=WO-|&T!s7$kmiIS;n^2MXC4O!pJW39?vK=>QU4Nc`wi1Uk8 zjUlOjQRJ%klpB!KN<|-v%ydNn#i~5-VOVd}KV@@cA4JmG@jm1Jbcjp{QdPB~+H%XY zw+OisWOKHZCur6Z5(L{lO|j`bC)wO zDhh#iI|=5^DiNO)i$mpLIYyc`H{*?JUJPm$!@{XX&pds27c1|wkP@nu%4=6kwt5Lh zDK-W0sm)X)YT|)tp)#xbHjct9*OJOs3J_8j2a&;e1_>MXqzkY;8kkTWu~|&BDO~Le zZh{3<3kqkY_LnvRW%#w_;ivjiBhN=ajjVg@=06&K4k)&cFECmV-a{SM_h0PSnOLhrM&C@e=~b#7z9T|5Q9XEG@3pDb+;KNer`i*3`Yhw2A~TaWQlr%s7%vrtABFo$|nxQ1*>!dn2vIVTfrALSu{M!)Bz8rHEYgfCQ`lU~6-Q0iAc%b;vr5|grdJrO;C3?*Vt zvPwbYf)11)CmwE=vL6J*K?XpsYGkNR5_}XnRhe@98M9OQ{XuAc7to&7v`^{xp$|o{ zcW-2u5r7sr-lYc6Q4(Ylz#!P{sxv$NC6b^>*aq{AtA{3K^31~x@O5QnoG9uYYd!Vs zb%?tvKFfzqL3>bmdck4WEA?E>g|Mv1L?FC_gHNTGB~9pV7mEVU6|`EKN)aQAk~_wg zN=2Q}Apf*%1j1PWZB;aux+gNJg>)(Iqo^Uchevj~mHQB}XHyCQj?FZSX4Cd%WZ?y5 zt+t}V$JlLNsgzz{1;d&Cb1jlvXL2x>miz&RlB5FVl=j0#eyOKjsg60RSuc>DXS?Z2 z>P*m-L35xQ#~|P8jTnhQrEE6cHF*HOqfU-7g?LLUDpZ4nGUe}OLdPnmj-eg2h+mk- zr%6U0Egz{?nY|^c31PE{PSCn@F_T=Ca~?S_Mph$GqIC%0u*7WWgr^TEqDxttFkBMs zr9PR87r@6xeUe6_-l$Se=u~+AJ1yNaa8?N_Z^yxCN#P3WmYjql(CFDRrzBkuifS{{ z=$V$k^`ccp_o^IpdLGT)j7c4aNqe^rm3=&eTVAuE41>AmV0(iMlTDCIG$%cQ6l1GUX> zO+ipdGP?&oERDw5*v;umq>UCWfvFfE%7zLIuBl#9HxeG2al2b0fjWU!qH9(a6<`I? zt+JFte5={lx-~i>qr{QdK;I;BhL=u?-VGRTQ3NHDNNt^C)y^PnKNa^j(nUKfl2#_A zG)tJA1a$aHMNNs0M;9aR7se((P(EoaHYyt_2Sv?9r-NMu-+3r5okpN5js~iqDjJ*m zT0QvvIIR?h=ehsxl(1Pwz}&gluB`h6>VMuZv8gW4`$bC7HIE$HV^WH)C4tA!@D;va)umy7=t+Dg#r>FzO#ijU z!S*gPg+|K1g8YFPQ=8cWCsDe?m-&Dud5r%!S@--Y#W|{3u-D8~_EM7zPo9O=(#l+J z!o-0Ayhf#?8(s@cKL0R-0+Sl6N){)Jy-j?hsN%0-R@GRdd!D@14%upV_MC6>&|7J9 zceUWvkQfcoKnO(^_|dr;?=t$T|O18`tPUQdE{v&5n{MnpLHDxyV-S zW{fS7t6Ocrm%Zz|D0xE39(4vO+ELjUUwH5rh%$LmR3JjZzJJ49+;u+@=f}feRc?4L(81QYJ@I ziz6}%Tn{jvf&_fVRBg5ch~3M?qHZ>lx{9(W#gGZbG)fiHR+kI~#HIPIe3)JZM{G(U zV#d1=ZC1xLfwyuJsPC*?sS@IplWnt;Lnw}eV3HXgO?tE@2?$x-3jCnG1GFokk4ivMEoS>|v%XOylP|}j zzO!K{O;jawWYY2g`gNKffbZ8R?!;$xb3K_BqAZcO*$ocb;O3t3B1L6_L?s@whuI3l zh63sY@F@SUs5Yt!Z7HW!ZBAYD#Lf}uBi}U5L&$MaP%^Ve)veqw`gPFX9`zrfO`wI^ zG*H%z5d>nnBeD?1uVgP-htjXAGBlZw)$5QGQ5m&|vw&3(Hz1-Rk;Xt?H83;l?I?vAq+I3I$`S0Nmqk zp{-EMDh!6LN=s*2i+y4OW6@(D|I?d-Oxl1MG2bcal&E6m0qeypNGy~5%U9X>fhKeQ z#~*(8_QPMM>v#YB7ChG~_iRpw6(8ULHV(&8{Q%3q*as!2L{19hwwkp@aq zEGtE-x-PGIQoU;S@Xw6n7n}xiCd`DGJr?}0UitMHOQ6FynWDd-{8XY!*o6()t8%?m zCpcsAl3Pt~fH+1SU+nUR=zeJ9lp0uFeFQa&3BNl?Sc{rH74EU4~s5rS7E$eyHQ zR)HtVr6iM$sR&1kSpCd6RD*W9z7-4pGc%$&aU6!$>kEcaVblr3{HMt`v?ER!&CWM8 z>&TY4Z_ZzP`cMb`eRk8889 zTpXjz&TqL)4ou(m#d~T4v2Ci&Z>~f0eUNpr{FQ8v->_Vn>uo*Pzksq+zGy)5`wsjXy~jZ``NClQ^nPO|DX&3eRw)18`q zh*>T*kfLWzDKPKXlwCF)^Q(QJzRR~3KTt8s^2WC{ek9idiX%)p(-`?;r^-@*|T`%1Mzt1qP~1SuC-4nvruE(6q}d8 z9U;v}dC!(MODv`1H*-VdflYBU(>~sZZZIEBT`o` zzP2$2>by4YXXZrDPsCaZFdQIm*uUAYGK4y_FqOtpt9@vj3NG($V7*OSNRv&S zmu92In6^lm8~R<;XUETmW6=6y37fBod0qF=yqm8dcANSxYX5L;j%)v>y!y_((2i$5 zJ6#_bBXbPgTt1=XbbO0b^1SNG_;}ZbkMo_W`BcYeUhFvW;z}jVmcOA=e+a?p;uNFj zIeGIMy?Zzf&qh;s-RH_hl)-co-Y4+=;ku+M@l!$3Tv~c1 z9#4G8=NBi14YHP>Q{(wj4|TGg5r)^=%fbN^0oeG3oA%{X&YnC^S)b!D=&B0jt2)J- zG=5-KfCp*nF8L&S*VFou{Qia;EGz-B z$aGDddd}Qy988Op-!sHa+!N1mt8 z3$=M;$97N!Irvli67ZWw?#@!FHr1Xh-w*1%wBUqX@9}Yh+3XQ*8s8M3LvvC6o8pK2 z%M@#6X$s&Ko487C*Ev!1(s>dU=aX+)Z8p*i&uSr5z8-}1Tw15RK7~%9jKw;MA3;=V z{^rW}x8i9AzEJD_DRIvCY?=l`=hQ`b*$fYL&O3LGW4G;5Y#PlW+oQBBDjgW(H`net zm@lAIXE>OB4&}?o>0?eyZF5gf)5bVy@sZlplsM)^Q?d#4 zelO$cs6Ka_8V{8%EEbU^D~Gu7VU_X8?ey$+9-4L$FzrK>(4kxHL#TJwv)b+X%b=)N zq1eRv&7aKHY;9_7efgsSd_Aa#vOp5Ul*05mC4&FdF3b~e+S+ap_5H23N0Ht4H}5Lf zE|zrvqMX4lZ?dR!-8bRbHvaJQ_}!y8cTG*-?xlBi*PP<%QEQ-@IBtB0x}Kmx&B^+l zdQL2iyPhGItV>s`rTT)^b;gmWxqsK1C$FS=KBt2g>sBi^6{g)!d#Gv7uU)mqePXRc z-$(MI1yt49KlBRbY_$Z~H$ER`@zE<@h;;5s!Cl8kMfX%)mOR{Tbl|NR+d(?zROMwYG&G2wz^*X&T4Lck!f!G40jXW~6MK zxB2||kGgbckhwW3kF1UBXIYKsq0K>V^lQ`N@re($?oSMP0-p8x9JO=sbL{04+XM-Z zE1xN^?c3?a8$OfX=Z)hTbX>4U+sOT<#jPXoIQu|-KdH9wUob`s>&i92biC(_;N0X# z*m$m-Xsl>c_g4tT2b$;7``K|^8S-jrJr;Tc}u+cqv* z+*|XZh4mSGk4Y4^bvR2Deoj4vs0(3-*{hpr3dCF+%wg|`FixjOxceuRHg7rpsK+Mq zYrdiMG+)$S{>NSnBa_u`wa zskTR|Kl??<#T-3)0i?5@vI~T2% zK{D&x+$DM7#x$+Gz$4+~Mffn3p@epk-9>3q$@2BM$zYkg4mepJP zUgCvtZknRd&TC5A=TKM^xoGP9@!a=N$H^d*v5v*c^ExWc@4L&bhTjh}EI(gQ&wFc} z+j!I5^BO-;<)nSIB;MN(S{v&vn#D!!i|Sh}ExqQ2`s~i>Sqip!3fZ#>?K!vK4{EpN z|Asc(hCkX~@)4({e54Te7gLk$y>(n&OSbQeL-1e;F2UV3IKkcB-8Hzo1$TFc5Zo=e zy9D>(?(!DN-rd=+bNb%n0x-skzo%RkNx_%~`)1qrT=@1)SUi3&yS)l6L-# zdyN&bsn|+bqq?y|B5s-M66aG5RuxlK@vZdW(VG&^M_prD(I%h37tG(`W*Bi+Gs7!f zWX;s3-nrWWd&y>iYuYO$GS=zyJUmfoL?0_5l^<%5LH_Ry> zqW@iK-}^E-^%ePhu8!c42r&>E!%u@OV+Rj5q_dEhz~-5^t;Sn!-*XkNi$T(j!KXtF zmg^T~!#^i&jV^rr`o?|5ZRNFgm3WIq3XfT6?b0WkHOI2!ru*gNbIz2R2;wYACaa|A z=KcPCD>b3`=jF4I)4I!AGO6oiDy=Z}B)ST!nFRT-3@yaMo{_}phnN_)1;@_GQ`f%i zLhp+x@>lIl9a8HPL^x4!G@nv$?D*PDqqt-vK9I-IZOB4@x-3e06@l(*JlYk%xm10g zA{BR%80;d=jefJJg&gw5C?c-@5@fi8IQ3X0(EZ|7O_>_@-TlqEv`~aASDq-x*38rQ zQGU*)l{2eSC= zrTMjh5V_LzICuF;z0^a@ZU!07jR#H#P*)k1Q{;lnPYzqG8J}?P#}TjH_0Vg-@`mNL zSo$l#w1nLV=}4F+ofP-9w#njdImp#P!ysQUN%Z>ES;;FCS9oOdQ3N9Gw@HD2lzPJ8+CCW4AQ=X_j9N3@Xp^@@4Q^q|V)dBBa_M8+y*yrj;bUR#cJNGcLW!MH zkw0XVGGNoGVcbHtISAryK_!et`~ zQ4Q&ls)SP=Lx*FEuoGt>ajaXiv&5P1*lPjLC6;nUk5hGV@I^2F)8mc$d>e4<`Pch{ z%cZM1VaW3eypatvoQ3@Wr@~XW(Zx_#;ta=Qw(HAqTy5=E!yJ{-09Fq=t#d}sidU!K zj4bRf-S$cL+XMu^nWiNYc+%qAddN4Y-ZP^rs*B)=`NC0rb6-`K`E9Ex{{oNyYuf1}f~ya#~@_&4wWevfjEVyiNxywrjYfA9+McOrTOQgcKKCqIN5e*^H(#Tz#cS5|g$wCG>4LXXINgm%1_i zmvUFeReF9NDRR4Av&szRgH!9v^P?}oD=pUF=08$eFNSzjHV?J%%Td>YJfeNpVvIfQ zJC<-|HeDGFqXF!nqlnAd;h_E{uLrUv<<-H8@pAFQDKMp?;(m6E__N)@mV={a&azHq zisFbP_f+LdOZG}#ExZLr%g1Gngtsn?SIu#4LI^Z#r|sAn91Iu6*rTPKm_%GvS3}pg zM=b$MR|A_Z4udZ1*%ClKN)+$SmTC<>r4eX#PseUzU7(Z5JV-0*z)Z+)y>wBFt`Om! zeEe3*4BW&l&Sy3vK%-g9?_6{p=GQ>Xz!N1~PDOY= z%~$7Dyay|y%ByJaE31v|MOiW(y8}tgrQ*C$j_pZ8lY! z6+D)z^C=Lov*s{3MZLMJmucaBqQ`q4rr2Th$rGY` zov^DeAD1Cxf?(Xa1C_4Y>Bt?E(2sXs%$FDXC)>SOkA5zIgu}g;rtxTEz&p14l#Iyx z!)F~FE*FPS=o}B+Oq)!4-__C8s&CUVaEQL2JR?$YUSDlIJ7;lOj|8V+nB`}0gug9mZ-5?>4q1+H^Jbo z!EBj4E3cMERwC#Jj^XBJVy}7cDDP}z(gz4@3O<<~Ag<_0Y-Xp0tny-$RQYWwd7_zv zFJuh7ExpPF4W-kadkVU=gyv`o@E+f8#~NT8$0CXBQbIc2Qv{9Huj28zHZ@oi*&>h2If8}AzM3^esw;oAvRmR)8@E)AytMBiYo z!L_prS8B$NgdK#W(tsW{vZvN4rkUGgW_qpoLzv6*K1SEzaYC@0;0fDhv(mexO97Hr z7?WxtA#R;pLkr2f<=o+g+Qj@?hcS2*Te&*UmW+DTPmf3E;#Tq8pWpQ5A%;U5TV8#7$$$?X^7&P6+WM*3~EIONX0j((y|liHbYG1*}O_?CUVLS`XsTXEOjaE(Z*?L_pwnHh8$vjR4o$!{LhPF^H-Lt%6V4XNs+i1{a-zEhk6vpt0)qf3VW@n0@ z?h)A_wWU#N!b;=f;R9+$Ay%(&TqVc&b~H+uRS<6R&BG=4)05THO`zxPS#Lq4RFc2j z(|SQ2u7}u%9GAz7YpeX(2Olsd6qY^er;E$OgsT)S4em#&#=Klr&>E7i%gN_@4;4=e zb}AOqc?IHz2h~l{{!yN$EoTQ*HkUVE^?l*)}XFfn-w zH>w>JPu;BH7b#sTxZdWkJP>jvqo%v9c_HkQi+SKKNB#4D~@k)c2C zdrrANAu#CQ&(achv+4A`oh=On+z)PcNa*KvG0vm+J#|kPs^-@8lVfq%_g~*X8>~I! zD!<)MhAlBQEpw`qKXy>y7XBcLG_l)@URkJgaJlwTfn%RZW9qHM8&0xNC60UHhg zY}3W2NQ}XyOtO_}wtIUzN+zNeiXy?E<|{AVWNaqcHKvh>_CJKf=92X=jn&zB-j=lpQZ&iAAAOh0Xv0S0C>O5SrP#uVsxqyjVbUt37$Z8zR~b6W&qdNJ zp!O;Hj3N$cI8OD^3%pz2$~lU%mw*`v zdS<3Yqn}GrU4AN5G=IdF#aW)uRi((4lyzv1SN=r9ZJb1&(p?h4IrSzUIE%g!-y_h4 ze&aOg4Sh$4#8L+Q({tGUJnEDTso+Nc2EG;oJ&S62e6uov1yVM_I5$z-r_Cy(b6Ewj z!XOM&b`W%b$&O_nBr()zg@A~gnfjT!CkQ%8=>LuqjfqU zpSyn_la8f_qA<90T!1-iEW&gWQMnvN+$ac|_NcJNo^Y)-ExpbC6$$+rqdVe`MfTyW zAY?IPjLYMOit6>{V#LCb=hJZGx-&ydxm3-;v#H}V7ihO6sDY`yn2s6#!~9IJzeRfD zBV-bZA?`e5^B1zpwL<+jBvhsBv#t^#ui0=(crB1N+8i*}>EOO|n_^6iO7Vl@#fU!L zGUk2>tl7yzsjz#nN)B)n=hvKE1B??iDvs~^A1KAmM@C7%MwX6 z-~*CSFo(Xc_>c^_m9d2`?Dq)e_0qhds1js`i-A5cb^DDmQ)A!>m1^|fQ#|MSzSOJMY@)DwF z10;T85NLj7a?l8|000S0KfnA1sv)goZ*O30`Ge6RO-Bbf>zDWb&lnvvf3i4UwtQD+ zpl1YJ`yW>UNHGIa^goLVNC99V^bCJX0ZI<|^pDE`yay;c{R?E`2SMZq_yYhY(X;E)AXOrlz$bof*w$FfJ(Bnw>8kQfObl?7!@-GrGtf7ZIQ}?5zrHCE(ZI zwjZe^uw&nlyhcv>e(kUYRkqLx?3+wfocb_SN@^N!g@I;(LN8WiyHb%lBwILCEkGg2 zBv(#pvTZonph*>`IV8X57f}~nqr`J=$QGD^-^SvsKBos|nDlH>^|1n9&IZA90pSSd zbFjwAKN>3l6Z4C)iU`PC35f_u=vV`oGx`7nG_ePOZ}^RMY+oAVC+NnA7SJz$0&HlE z=xASh_ut#>gQcF8zKNyL4?7YtF*G!If#(1aIWHI<8o;Ul`1|q|fPVOsuJgC^U;4YC ziLIUeOXe@5bI0a4S^(lP;l0Y5L_K#NE94@Uq65!d-6Q>I@~J1?bU02Ilp| z1X%!P$?`MtW2F2)8x4O9T>pE-BG$i{Wm)vn3xUM{_!_VwYhzMITABuw|I@|?a3(A1 zN<8_>nd<~b5erk}*Uhii^jPgi=5MXngHaI?liOZL`Q2d>n139R>stj!cN>dbvjI;q zZgc1s)xQ58a(`V{(Dh_y=k*4DYS#T?~oV7j3%&LJM*e>6gZma+y)+vo)nmEkZZR2%gM> zxhLKt$_aZ0N6eSHhB3BXuO_D>)l^}tkwP8(JBxa zt=oyY7d=`*-8*KX0jqkP(mycUd(VQ+bS*(me!YsepL7p#KsEXJ8;gIr-~6Wc{kwyU zBz}O4Rv$S4;G%x9iB@9i#@&c+KzC!2ri4-`y?oNu5PfqLaQk+fR}wwNyW=MRs|dL; zC1j5Y;a2#mv?gKTnKu39V>IaCoVFq~69 z!v=BKuqdo(m~~i-U$%u|);dVgl zdYpLMp@DILp@AUPKFGgDls@QM0&1U=-6`aJtA*|Z0`Yo z#F@y*W~$u@T9_?gFBZfH?E)xfG9N8dpV`#~dG_XX{N#-sv~-Kh`qRgzvjuSX@{ffD zY171xrnYfeY(CqCS|Ve%4=o+pW1rAcyjy|k2#2zM)AYYG(f%p8i0Q9S(lwF8rd_m% ze#iGHcGU6{<>rq(eOVvrICBY4vl`Gg0&v!mI4*8O4U*#-v$CYWXO5d1wegCYi^D)b z)a`v^GRo2A+A|b#{SrbXrJ+?k|5|TxA3A2YE|((okY|Gf2D83>SIs30^-ym5u3gj? zN=!KCE=8J7aMp3i&_(8bEN$ZG@xVIeE$$o+&d_)V8@JBI*{!wlJ^Tmv*x^jT z2A-k4_V5xyjk;_snXS|$1^TeH4ZJ~Qxgs?V{vx@NNJ4#&*?29L(OGU{lMx?l(GwXQ z`$zE~PkKT)E>#oQf*OXdG88>chq07BgaUAdDcs^1Bu7x)fn1{#)qYcxztX?{SxvIA z{Iw<(6eK1tD4`Zzp{XNL`YLw%)wG6nx1YXM2#BAR=1=n`=hOM|1M#wB5$f_3Vk17u z?7v^dLkiT|KSFNGFf@c+Jk5Qzmiftz{Bw7a-Sn1xeR5=4#}NIsfE4)YSJO-%|MGkt z=bb|A{nJtd`PPB2@PHjXW0I1{zkP)tNy0vqw@xuaNfmz|-LzJOSg*XrcKsE8oUQ>` zR}f50k%cYugKj`1y8j}DUU}~-dZcuj6S$Rq7Qa0rsp2UVs>8jyoR`c`)u&r*Q!LN|V|2g@BI zs(Z{w3M~ToOyjst5`qe8c{|Yhx0d1QVQdART>#}>@Si|Wq)!JPC>ECjUAAPIJXxy( zw~p{%`|GHUMBz-*xx2ugP5bu7`;zG7aKRC&ji|firrOEAE)rl#mGj3oD|`KYqWj&m zt5nnggIXcHsLZY@eeP%0m6*^E-n{YPP^eYF_M_Y(GXnZ@ufVU9FSZH#`t9u24*C}7 z(OGwx%)Cn~2UVjK4b07k+Z)HH>$hdD(5c=LRkfB4C%&Fob7?VKxiZ0mhD7eFz?18? z)0a~bBwEdC(22h!^eq2Q7dihHN3&7*4J+7e*egt|i6Z+nNve^~NqSwbH5W`mCndaF zYx0RIIvx%xYo@JA%w&?r9Y-PRcSk8qSNAf`aL0j1fH z$VBKCpUWn^k3Wj#zuD_sbaF8NV90&lQej!q{5_zbl=Dk{zN;blR!Kpp?UG`q`YmZ} zxjRbpqg#zsQ`=r!{K{p`P3>LZXr1HpL5|eBRH<_>Ells=R+!hW`k$Y>ZzH7cD;^Qj zY2#6UV^P0C)&Ah8F*5!h>iX*>pP`abiB_7HkzQepiLsJaj+U7P0g+FTcpF+< zP=;Iy;| zlC?G(18tsl1mBbUz#sl&$N9DumHdVP7;mESU9kC!0 zpc{8f`6X$HPBGZ*5%PR02#yv{Z?(+$See`&95%9h*;E4OCxXPGvv@SAL-21snzLXRoEdDA4(g?8u#0{3eiEckcho9J9z|5S1`DNY?I7JY^Ze(Eo zL$><|pzps-NCXg!85sVUlq)kZ015;+@}oe26rePLG^cx|O z^?xZO{>b*vX8nth2#`Vkr(u=b&Uq1+F6O-iSHf;{gT%sj7Tq&zusj+rlVPV!5MSx3OC;BxB6lE%HP&bCJVaQE$ z_lgr2UyZ_h58lh0(J!^$7Gul_kfZ z>Xesx-V4}F`uS~nh2Ql}<2mERzZDM79)9)3Ot)yKT}AvLfAgd4T`-ZpLueIy_<)18 zBXZjcFMS@_lzZn7kD{+e+fWxK(2;u+jnltN*_5W$T0M&zm<)^9qE5$8F*1vL+ zhvf%NF?kW2kClcHjHiy%f$<}&qx(C&3GX4{>A+GEdvBjJr-xLVz7Poou6~n7S(;W@ zIxkrZ$^{1T>oV&p*9kDkIKoL5CT9~E;KBc*3ZG%sNp|D3GGxWN_-wh2>-ltZc5$haRI(R6IMmYY z=hek7wAZg=Yub4@DWf#Jl%Wq~=i=c6Y`q<(yP#gjwbRe6FK@76AiY&5m9)@#N5Ps4 z@+}{Y1j%}fj%y`PeJ5R(hayk)olL6tQps7ZundWI2`%oB==dTJQv@nbO=^gSMFIBf z9O3}NX_P?+95k@enu6OwVt7knQbc)HY{G1Td@z-Z=1_Rf1G;0oS`ieiD#T0`D)>Ao zX9zJXoM)FVXDD>k)PslO_pU+4tL9b<+e!uUh$r}&RMYDOK!s>aVy)85(YY{uR4Z_Ny&9><|aJq3Za7Z$JWD%jb-R}?Obh-3hPZ!c((I9kL zr?%XAX`Q>OSEl;5j)y~?InCED&0EbNtQ@$urLOTo0moi!W)f#il#eA{V|G73XHrkr zF{MilUwxc>0LLkcXZ(#>{6}>IQ0f0UF1-I)Ng*#%{r7@o%) zCLQp-j*1}680Evu2F5_S6=$k4_H`q$k`*liL}uK2u~Z|sdzh|0Y5I{Ba*Y`*NYBbH&~65dU#4fZ+~A8Ub!p62K<+V2>#g?PCT)gRAfb&Cq)JVhS_FJLhf#@>61a z19=Yu3xs8kD)WJdrxKwK#H%)ML?Z%d6Vw)}7;%$dn&JQy4tl^r&&HpB)7qz7WvxZj z)214&zs49D4thKr(c+Z;!3Q)Ch62x-FY2KR5nKc1y`;KKvl0Ybpi(FTv)}Zu z|EO*+-Ru9&!>)+|EYb493S6^)(9m|teUe~d1iiZ9M?)5#V6hJBSoLGQdW5TW6b#kW zCy_^yBFfUT6*LF(wW(m=Da}LV;wBgeD zXcRj!Iyndp*f?!)T3}H0k(eOMBWf`yjfa&zC=;iM_MSEyr!Ohh4u083hFd1FD;Mej zrGxmx38usehI)!$>i9i{5pJaYu*v!{|~Q|9O}{AD%2+245KS1-Kq4Y--OWn)e$ zd+^J)q3PeW{r|4)M#l!2fc!eooL1F}Kw*LP%#e!O5glHzS^tW}=hMPD6{sk!NM13G zDow#V?R#~ul$50ZbY~dIA=xfMYxMrp;T-q3er2JFCpzu+2VM5`|~W`7*7v(oyNd#*TZYzN!J<456`=Zuq2FiRw<6dCEFSCqI6jf9jx|6s1EnF zw}+7Dr!Z)2>W{Y>&S#q^=cfe}pxfUkca(ak~9PgbcqR^-`$Aa9~Y!V0J3Rh07xO0CZzhDl%kbc04%B*jy16?) zY-7nNc~g14er{)1FG&As_*TPL!!1*XHgPVMn^B6ElWC_7Lx>pyYzH>+9Ctgo$+UmB zlofKfuz;c3zIFtZ2g;ukyQyxRgD2SEV`(Dh5(T(2GK2Ft504JWRtm@d^{7`XNnpt( zlb#9#4+xmEvW8?@thNjRkQE#8T|D&+I0WUQpZ_;KAmI|bk-{OCjg!m7KtP>Ij^na|==nvC^TZ<$-QlaM zwx5FtkV0bLp{>afimXX4B}2v2H&GmrP=*?kA`4HpoHMg~b?hrCHO)zV9x31TI6Tt7 zj#s<6RAVO7#pxjqf7}gdZ$dGRZO>6z)ky}!VW%At!*rJBqx1^g4TaH7&y?35c6@@{7vdOBqr1-}n&b%&py@XOn*53;M#J6V=eohV!MRDyTUJi_3{WE7k@M zZ0cbt0b=?I5$mQNoKCd@z$GWm?~&{_&T)dO;UiVHWnm5a5Z2zYLZvpT@80iGteV(> zAc~?;%`Dl^5rRpEOe2h*Pg5ioC*F>jfKCHsBLv!zhM`)@Eoj#`XI?fWj7#qY?~`#I zeC@mEF*GU!1IEj&phW8xVRkN!v}(;JNrw2@4qAqCAweXB{N7e$TKd&f<+@D`2gcrl z0J5&iyYq+4T)V96Q0abYb;xjevF#S4f@(GnXRq?wnWL1+8%iOz_3t{2BgBEr{<^-S zi`^>V8ap{N*R&ia2P-oN)sw^qQ!efEBDH3*j#)4*IQxArS9r}1eqa1^c|oi>HKxh$ zm#g9?j#>4!+vqqByNW7QwOdWQs_b&z63byfa-Z&@3 zJnSRtT9PinInC9n-esjkd^AO%eap^fVjZ2YId!k?7v5Bi#|%5G5Me`ARWG~85=8|W zfN#AQ9*r2(XRdGYt$z9KmvN$Yd`lq<^Xx((+>cnL+5#=mri|$P5y`WZ;ylbaqegRI9DWb`_}yvuR=GFQO}iO}bzg7oysZ zhhy&aimv1_D)R#{d&%VR)9ewN0>b&7O|)j=sTB;t^t%E6CJ0%(8fNIdi=$uR_7&I_ zhV24n@6CK1?zkK)DM~b_A{5EK>V0vM8Oy;{%TVg3!o9dnpsXOVp{PhlI7Eo#iwZ>hjCk;_Oh3^Fwvs!$_6^nqpiw zu#2j4XBqyxW~?{VR(9R|N+g+LFtfhew+|uCsDrP*r!=u**+|hEFQW5!wlkCvrX-f> zcr$NSfKHBxUP(xt_oIq+y_JvnaQS^i!v~RHeKC9^G+VZ1cd1^M9ODYotwAIu7PQ9e z6NQ$&zXnI$JY`qf8EoZ zyJDzHs)a>w*oFkFCY?d|3qc;y2EjMT3y7|MTlkDu8|^+2t=3l0dM$>PeEUw^ zZFhaW8JhLY@Ka7M(S69S$3e5S{cYr`?A4R#1>l8!7pZ$N_{2YZkZd{cK*w^2RhksS z_bYEGiuYB?3X8ynvP|drwZNPux?SUQpyUKk;k+%jQlgr#5SSL zlWdj-*K>t)?u?Uh-{0KBe_inTyZ-sZW9fg6@8f@^f4(RnKRlUUJQoH3CrF+Eb%x=m zcNxHwk`W-zGW_9o1xNv$GyzBc5IF%g{Bq!jJi^!`A-=Irym?es?P{ov_I3mcz? z(*A81$Xuq0VQ52&L%FIb7}KsMc7~LO~+7&bX zMLk>?MMA0E8NFy^!_I?nl@Q z@3-u#tH0$ZK5Om$!n$TkR)nhn787x`W7HiH6_cp^_WXRMJ~}L0cs&#qP9jVoP!1oV zi4ghxR`*R;t^m>*oa-=KfK6U&;I5O`dA>m?tvQ_q4TVUj`S_+}`x&prPP%$idJ}F% zX@2Q%hKXNSlz!=I|8725w14SZal^bne6YqIxnF#+o`WAHGVR9|Lt*~#!J2aMtfbC^ zaqM~@&=AA2ZcF=iCDvJkl)g902CEM&3J6&qCJ}L7XJxI=ib z;u5<%R!NB-)!2DN=+y4=R{xxFI zkNeqg`q#gm3l_s)hKYX*G3dt=Hg3!XcjIX=)6 zg;d&ex~k0uY?#a4Pd3S4QCS z!Q)!zdgJI?XDT3Q!O39kt4{IGbyLQ3c6zIJ)Z^N$XGuxPqoboI2dVVzY+Yc}a9mr* z0x!6KUv5xm{m@gOBMr@QM#j{V`{T`x^D}66W81yQ&GAle!O{~|a@ngRt*rv)<;sbG z4pIwFn=@xl)?3eqBg?wyr@DgsgdJ`iEmIUaq0=j!I!|9kbXf%4kF4vUsNS8zdux+N z1NCN?ClS~f7Vkj8WHWJ|%FBnc!m8-JdbVxo4Hjj9z%qI*-u9Nk6N6w3ZO|^bVrN5s z&Vv0m{@xe_G@sIRkI=+cjhLlU`Q7=zf(aPHT&XaIxozq>05Vm_4{~9U)B8Sj77>^> z*2L2CoYD9dQ0VR2XA4awA}OHO(me#{IaZ((1Adf{{TW2B!7d$f2(yh>pATZ{-$EJz zv88I#V}&;8A+SoMgGS<^1A8YVac~_}i{Pa{yYgsp+&swmq?zbI!pzZ;>Ma6s455cF zAlg}rO;s8WV)2K!YdByhqPrWt7h3ub1*BaW%x-!yL>I5%4o|!5%}P}__d(xKE59#m_U2bdn=}aY9v+< zp*q5jWDwt^hR$UAb2aYG#}Kk;z`KUigIr0@BjA4Bv+d ze7a#(rC{0nGZo>OHfN;TcmPw8P>6&@`ETh2oLdmDkNH!#pG2-^oI`;N=E3H*sUe=^FFxVIq6e;V-FG3 z6Q?V+Uo^k~#s=vjM1gwcC;iEg7QS<;X&Fj;K``9UH`&UnqZ__y3)!D3%X@Vrp+Pn< zjUS4q!j1@!&-(NtI__%=%PL<*sno=5NL8yKXUG&Dt#}$XsZTg~$#ahVK_TRs9xxjN z@VDq-B8f^CwP0Uuj&W5myz={sJcdDt4qppizi}VCngp#e`BE;Viw>q+*-@ZT9LnFKBK)2#@{XE&$kj5n7B2yIU)8d@c>O{ms_H+f+N_k>P`ED$=_ zMc4C&oZl%&T{Vf#8Xi5q5Ne{$#10M8>VXyelci#)l=7X?Y^HptJrZ*N?u2wLa~{Gwt`^~TeBbXR6$jo`Wow2K8??)m=A463>Fl( zvsPQhaAbU(UQ==As={gP2Q}AO7U$;LSjhyni{Ttx^A2(q!=ZXQmnya)CN(Ud%}prI zXi>qGprtY?t2-}B)op{fI1PdATb3Q_f&&%11b%(` zbl;iicLrX(J{E618g4@!q!HCx_ed|RJ7;O*k9F=j&EV26B^W%;dzU!?els)q z)!X3jGSnaOuK%YYxPSPZ{eL$E7vQJG0B{ohQz`-k-7@~+kO+{G0Ny|V&!j)!0|-ul zBY&g-_4UjA=^sTUzy$Dr6@vRC+drSQiA4f7=J8>KcwQ|7F~tNHa6SYk#FSh?7tknix;1la(X8}ROgT6hA9LUt zCtJ)m9`?nBYD&hZEDCU7LrZaPP;0E zaq$j3c@bM358h`V&0+HKO)hD$B{CuS9bIcO17UaX+9@tR?kh1rD4W!BB#_>cSeH*b zJJuKSYj+PK%x{DzMa-g)-A$=hh;$hWE5uAYQBKxEs}^rk@TJQ_alRWhJjU0PqkDK#W5BSQ#>LLF&gi($a$}j;jP>I=jw=gEm(B4G&g$ZZ z-3M3~b*zkqD;mFH-{oVm|asp|lAJ+V2gVMt;07@*wX#_*(`&%hRyg3u66nFwk3;pn} z5DB=lm?$VQ7cizH0_9d8^xoIHmKbd5zT~8Q&3*mx;P?Zf<0k%yLsugjGqh46<<($S z5}My(3^|UWQKx3~Y6L!uhP68Qg!`XMpiL>-h4WWtX_=YBiS&};j zGS-k1oG{UVRb={@)7h{$z2~SPS2KB1`y`EuyFagfXttNn5t{WllP!^K_%^A9^#sE(i#n$g>kdA=T$@Z^Q_-al@k_iy&4 z*{we|1a>(`z7|yj=;d+f2^{*#?=~2tp+v!hR#O9^qL=_N%cCZE^XRZr(SM6sjs(Ok zYsY?CE6}6?0L8FIo}~UK^B&XhgbLy z=SlTKqbnUAwipJs9js>X9IP>hK$+KbWIhrht4hhMO!drh@D)Zu+lkYiRb@CVtv{V7 zrvc8B8Ww+Zp1gZ;o?OACgmIs+<(Ob$Ss2Rs$EN==wf*xc^|z0se*_EC19q$Vbskdl ziCe0R7Uk>pHJPO#!6|3&^EQD2zXd~kNcLD!QS!w-%)AT?xx77)>&fkWTT{tY{ugcS z6J_@X_GI#g()$*yZbf+|5BFjZ8iD0+XrYN8W$VzIRL(f!Ah?hw@s7Vl=_M^7sucOk z>QyE~I6JrB2;n~?A|vt;BOG@j$yKaK7U*D9?oofq*k=m1yi^})z|FHP;zqZ>zSK7n zjO@TS9wL%RvQVSUj-86--&6X=`W`#v99&_;uDYe0K7HPLSarpzP-GhobHun=5EEhV zIO@AvuEH`udsQUnEznoq=-A&>*2|3kf1|SK@L1?sm;qbj82oVhW@H2GWbOze0qiC6}kmehBsoCdB7P78Vxf5q{@?0~y5l z*&^pl2%Um}DN~+tPJR5$g^5OuMLMxV*%!*rnOe-(s>PP6i{{6KqzjD}*Yki4GgpQd z?T#Fe*j8>wu3L6EK_S`$u<_)V>nUmGa^aJKuN;6VW|$Rfq$8KX=b*frW|nLFUCq}V z^MP&A06;0TBC7>u`7iLRR6wl?TGKNips+v}S2K4#SB9;g;UXd}w4Ov)@8Jo?}HdsRXp-f>_Fo}AhsUO2CG zmh}lzp;#9}bwG_Vm_rkSL5-U|Xnn>As(m`>2I7y22MOvBj=73*+aFyh4dPm>yL#^J z&|JZA{f--D7)HLV$z(B{=bB4)mhU!Lk0oArAiJU)*#`BhkM9<*U6$nN0%EToc@@n! z7^S1(rr98LA8o2VRNY)gJvkJcma&o{PP?E-N`iSzXv}Ck`N9hZ#tj3rJS@pAl8y1hHyxqHa9q?l52x7(@2RFBeA+6}P)r$UoSBMYL>#%H^H4%_# zGZ+5xr58{7aaJxPJH?vQtA}0dt%)D4o^Ni};|N5`_hS0pQE0D%y`C@LkV#36lBqRM zd~?+8c<9%BBR`UnE>~-AfQztOb6eup`kf7CTgc%q)17{d1QdqizS*p6*>&3WvFcdC z%t&f>SmL>a9!BgbyV_mQUC_y!+h?nmuXy*~Z@>1m6+FJ#U%k(m_p+r6S{~d>ONbNuy1KGB zTBeJ*q>C8Hech}IyG}+IR6fe7<&xCunmzR31U_PCzu-2yaw?TAY%=m4V^Eyx;D1wvO)&NJ@&! zOxEm`eIKa#J^+{Qb8n&#Gca3Nf(=GnI~yA%E>8tkeAn4~W_oNj*;tQmgA)KupodhE zmPGIr^dWv$nvL^odAFD-Hg~%gTAa*xAnQ*F=YT-If)7L-K5`*2E%nHdW3bezPHBcA z`=_soXQ+^|gbJ09(h$+K1t0j}&)Igz%3^oMKb+G+dLeK#T#z%z8_iLV>L6OMTd&Om z!77)%OQHpKdUa1c2&-8w9`EoKK`Q>$B(38YN@@x*r${;##YkXnF4IbQ1!eDHbj-1^@Ac5b#sYAPnP_F614jXcJ)wBEGC@fh&fo6)@0X=qPCO>M^6s@Z-fbPBSA$FoeHH$*UX2QKC^?NgI9C5YeC1Kn}T%C=kV9W>KtQ-WV9IEbQLxeF7 zMHBBap`=!=7+SmQX30-w8VPg0Q>q$jJym{ZEJjnD{pdQ5nC1$@oP!Z=+^*^*<7>#6 zMPAHseU6^;4xRL|HN$x%!o6T2JVdmH08w{A@KfRH_$H< z1y^8Yt*|&3?84pTbA;}DA^A75ccLf^Mwu@9;_Oe>GT+yyFBXCkFhyoj9ZT2}2kYtx{X zqrpM3S-w$i7C7fD#dB1enTBs8<#p6LNPR4s*>qrU#IlqnV^l`Y;ajceTDmC1|4r{Z z#Zq-yfTflownNdEcfwlb3R?-jQ%6~44n?+Ra2Dgc%;C&6-F>xhO_vfW)R-0$#i#%u zG{9tXHRhkRY2eMt?}47TPfh+9)Dz%kUYgkxsoa)6!vwb3xG{x@fgoK^tq@>V*h;N1 zGb^o8M!qjwq?m^hK4U6hCNs@kJheN6LEhF)G|1H0{h`FS+O$!w+;&owWeK*RStSRR zw^1Z#Ymm~mL3EI^+CEr~`Y@j;RH5OkM5sceOb#a6bRTA;i42@Zg-nv*ELB+Ctixod za^uI?a`ZeJiyZKCy)7RLM(+6XtFbud=a=N^ z2MNU1i}V8%4YE}5>Fff8Mp8u>@;SC(5m4Va>)W8CqBiPB1ww0}P@eQ@!=Z{h4uBwR z?KtyUCUIw+y^rNsBD0e-arwkA={RxWfdic+AX%%i%}QF3@lGFUe$t%&o8@+_32!;c)5w(%-}|YPa0oN%gzvVa z-$;I^%C06%5Esjx0=!O>63r9I`NSS%=YCaA+RP^8WDzHz>%d3WBeUtu2g}hQW+mmV z`);^qBjbkNuoin{8ImGW{{OJ|Ch$~tUH^DVNs7u;L?S~O56&@#%!QCKB4jw3$INp{ zhDaeYD;dia5;8@Z2@xUlEJG3*{`)#py6^7pdfxYbe((E#pZYlG>}&69Uu#cmt^Hl= zT04rYUfF1xMc~@7(zQ1**^@EK`|k7>D0dfz?o%+icorsI9CVg3qnhJ!nqkh}!wM$6 z7m`~QYWxpVk>&ATs7+{YIZkGBCm<@!gF=w$p}(Q11dG^BOL|&{6X8yKVf>78jQsvf zdH0K#bEh{uDK|)7DQuUyFh!xia%lIi<2Nz~8Cf`C4>CvboOeht>{RlTz9GF}KqDek zJ~rpOlinhXY{l_$kKWhu<;SuVkxdz|Ywn9F#aB@@HSAB{Fzq`dvMAs-O<*4SS?6u$ z3_(@Re1>H5kzExu+&1mIcPWU|P#vOT@p75ZcZ)4-iDhOOQ>Yu*G{=h{*D<`5d)vyp zE9s0e1y{O6GJ}|VOrn42k@(<(Ghd&)Zh!GeIAeyO^Ih!t-Kq~`{i2D|2f!QqJS;F}t#Bx%Sl00^ z!Pt@cyJqID)dzIBoiBzr*=pLfhE*mA^@Y~2O~}U7$JQuEiCp^>BrkI^I#QjfO@YR6 zP<~y}taGpG6Du8u&d&xiPeo13tVGCP%orN9y{+zCd=ede)NP5+xv0BLXFZubaE#-` z>#|7=zdivq?U#EZICY9AC%ehqpD=nkohFtLQ(-CRw_%|hBn^H1%6{9Oj@$G%#TJfF zz}yhFBPpS-h%Y8x(gqInmP=>yCwL>HqoN+}4@f;NKEm0WI|%L)Lq3kwZq1g z_ad=k+){PIksIXAH^h}gnext#YZ}4qYS=0AE^|>mye<8}o3ya9PH$f%BQwK^)SN?) zDe`LhZMGF2y1m>jX{y6U^K5vzx%*4)y0R@z?}@`1yBp6u;64A!tWn4Ka5JgAr5r`Q z(xh|OvnEw!TA`)B?x=-rM(*92!R0r?gS15#-5V@4* z_|Ug>nW^)uqmb6n$AZfEBZ|ZRup;&%lVJxVqtwvQPI`ul1O}1&cu3|dd0~w~YXy%5 ziMBxH#kPe~sTYkU@FyLmM8#bkc1Z0Ma8z#Qt9ApCVL`G^($1k-|Bv&}STFFd?zzS@ zn(bAkVQ#STDQGb1@C$L_$8X3b=C#$wuP#y^EjCz6IwusVE2Qa`I{LMWilG*1tqhq9nGhvyZPT1%{;H(T$?VR_c5cOXr_(5Kc6L7XCD%O;363%+nJgm zrGO5FIDAsynMc;z8Saj69^pTW6$??bVIEBxccu-J1WGn*G!Rv!#&!LxSgfVlzq`AI(jauCJGZKR0P9-_Le4nV+d= z@+Z?J0^~x6B%xrdSq<<$>WGSYRMn@eqr@F)21+?0YmdoCsQDr^ zp5~SxeY#v9qQ>Sr8PQ`^zhThaSpZ>`vNu0n4?4=yY@1auHDLE^LQv+;@H#WP!0clL8_Ot ze92Sj<)vg&rk8qJEKQ~e2mScU;sy&Jwgz^6L|1#_8*lG36JE6H3>AS4lZuN5?!>w= zSr?GoMf^U3x6i2%06v<2WdZuDeN25z(my3?^ zEbOIb)ury(r<`K&a(%_m4GJ*^d`;@3T}Yv|NhKgyoHgT(R@hnN{TKq0LJz13EvxwP z1gIsKZ6tisZaF{5a-tO$=xglatKmYPRblq&eu;4wBPU05EM@#yt=wz5Cb?Rbd5;p0UI&6#bwyQ>TUF3TK{xpu-i`mlUnr$!l2%laIAB>4Y6BD5|XKEl@9r z|D4SKK0>d=D_Zvk?c}?>dsQ;0L(-qsTMzNn&ifFP7xm^d-{|`?Kgpr)PI!(uc!_ni zO0A>YtlR2oUUxHVm+x8r?S~e3TrM8>BGNo|uThGLNBbecR}s6Q+I?~{g1q~UVvwA{ zd-w4(>9GZn@1hR;`jXDEq${q!DD|@94Q6%Mz@51vmM1J&lcr;0SjUWcEe{3WtV>~~ zR=%?|O(n{ZD@DLP?{q~WD7=TwBu$!>FH)sVc?VM-*G1(v{J@?e)8*?l<|N%x{MkLN zg76N*vvS;emUns(Z66$xDK`tlst4BgnnfLFmq}SYbW;4?B`5Iqn^6O|QB)qA=G)9j zwu=hpajcviuVTYv!taFN504m$os7P7SfheN%z&zM;?`hUOy97SNlQ>=LbL+Av$4_D zMo#v6*B3UU<}*qv9jt|KvsinIhv&Te_dQ-=h9QqgRWs&M5Y&dx55KVT?D>d{6exab zsBZF{=YgZf#~fZR-W^G&X(ieAh|`+zbf*y!7c_SnA++SR%O49`aM0|cPu@{6zDv+H z$6oLFIE%lJVodXZt!~BOr}gH<2Y8}&1!l2CR)Xtd!>ON%<-!T_kH*moX*i5b$aq#) zn;?%;0(M>NJzawtPv}lu;*$iD5l+$jas%7BlXy{9buH}OJkKj~4Ho=hbE$iychMNW()VN}Q(EwAO7%Hs5p+ZSKr^oIddbaBph> z9x=#Iz@AQko1cRlL?;7So`k;j86y+q6?@<^z|X-Wzz;=FL;Dlh)3Jk?_#FJuMU*Wc zX-5ZwU_*v>jLD6imlweSVikhmQtUheyc{5&8h`}(cwig?AjA|11;xb+NlT za5q#2Y9aU5hSG6rpkkh1mVYQK0j z0&kKUQ<8eO#XVohr42O6>?~Bf2>VSZX-L&BI!+zbGo9heOZuSgR(U1jgT{va+eLC> z`4ZQCeO;lVI_b0Jl8$z>1Wei9a_SMpEt)w+TVoS`u<*9} z@rYSkTA>_s__)whpAQvtUYU-M3+<@G2g2S%L(j*Bc3k1(Lc65#0goE=b+j8AA9()` zm4>0;b>stwQ=rr6slx|e(?q8+^}#Up!7%l~F!h0RG0^2O^yF9l#=ht_KtKpAQoVpAQxK53~mpqK*#}oQ@9@mJZ?>sOMus(eZ)T z7SL%-eVF$=0pHl-u!yGh-|Mir#n0%w=z!4ThSnyEJ4l1>a`b5KN8jb$7EcRefq;Mx`boo9va zozINkZ^T3?2*}%~PooYWSPv8oqi^C^w&v%{m5n~Kw+6|m&MkJCpNp8`L{`4v0zGjZ z0ix^b7m*b2H%*tHsXQ;b^m*|Ue*;Uv)2z;YF%p{U=gz4;v}c^V$^7P{aZ+MF|4q`D zz_nsV_9c%dx%h5p*6>(YBeNNa_ea_2nJ6W%OHOH2doF05kDA2*nb== zaE=xKWLPS`(Bdb$B<;xbSLLCLJhha%jBIgI{PC$B-Fs=qD05FHhn4VT3LJgb(M^O$ zh3|xaXd8dm$)o@;ugga*cW$$gi!G+z{+eKTzv{8qehKPb1XN^UQ#FHo{9X^>2j*3} zhHngBVZUS6%0xw$Bz3HN(CEuf0$ED+(+k(>SCGf{JZEu=d6wjqwbzz7i{dEp8c)K0 zuu zCCNFkTZZ637|~LL$X*ttEz?-cwL-nH9WJ9>C-H=&vda!RR*nj@5kj|#lJE(P!cmcIVuxcZG16gz^*JZ)}lejPQl+nAfr;lr*FxewR%eGuMrR6VhWw89ueAy+&h&`JY^={$k$`79Y`h_H`x@BPCcP20vDxot zQS)+Ut!!<*=idGRLcJHFo~IW@Igbs`?uZc~BYll$xJNa)D0la=yfCGNUIinI*aE4# z$P~eixWHq%A5QGjT^y@R>gQR~md7VLq^)pA^zulahu(Nmr|~`q*uF;zgU+Z#qT$r@x2})<*}neurg@o)P6G`!^5NriXYevbv{M* zER}1MnnoP+UcG)@YEMjVBlfYXdtmem?vfX7q zCU$}JczxtHcRb{=`Vq$b#e{D);7@tKchIH(Mudx>O))1do>VJXxNz?R5n<+XU+1GH zMzV;#J0xCZGEW^)&X_+zq_G~CHgs8gmxEU}`CL$C($PbL#=@FMm4n$mDW0qftGudy zh8N+=uCYi-MzLPr0-LH`JtS+EEsM!?+BQY{cA9oB2)X2yeJrrnHjwn!aYn zdE!jYiw=HBvL#x535vT*$xm-|7i05i*=#%27G1HGCIyN-UDJFvxhzjZIdp){RxEYp zfUlG&mwkgv?rTpREnl`pl*Sr+p4M+Afrg6h;B|+!+rAkd&Fwa@xN`cDH`C168ZXNa zU)*5RUP4iFfbG%l{N6cSm5~zm-|EDtAbPI;g>+9Km~)X!hVSN0Iz^2J())R?Y6msz zUE9(B#8VpcKyzz>!m0Q?>yD36f*duJ*%i#@on;Bx;{-Q?H5Czb;STF^n2w?I+IQ@_ z%lZMOFPTRVgD!n{y32NqRBgsANxC{=2X)eeZp%ao{qv}1n4j5}JkngLR)(B>cIcB{ z(bu#Y3KwiUZp3I?u3(wq~+dmTGHmQ;T~EnGA7w$(E{*0O|Qsfp;iW`etqkj+L$ zbrIJ@LObek222z8N@tUGcLX}ox6baS%DKaKpf!SrNMi|_6Y0*RiugR-|Am zE*IVST|5`+nhK}l&R_V1noe>>PtU`_$fNqZ0-d)JG z4hP*f`i?fc^}OAu9SL)qqTJBE-i@Aai}Lhc_$|hRc!`){jF1_aSyjQ_xf@ZW+PxHlz4M$%fqzS6^Mwwfhx-Bv z3C+cQA_Nk%U!%uAXXp)|cj*k94=wcs<6WzC>&y5jRf|4a*OZxLHY$Ug5Od`DP)Q1t+nct(l|H?5GlE zEbFC?6=D{n9sUls;urbTq`2Net}EjPgsfsTrbkso3OiRv?{pvXzl`ZRCA^DtmPUNo z8w;Mb)X0XRXV2)(16_kTG$KQXrAlSGZdV&RKkKbiXsT3u0j+?OdIH?7TY87E=+@m- zL-a7Wat04SQg>j$O&&&NYG$d|=(Q91I&_#!>)kD4Eaylzb4sem6Gd1cZ`GC1g{M5FiKS0@>c!?<;n5fC6GNLG zU(%|}Vqcb(Ic+YCvQplX8(r7E^j;wMqx@V7DgENc*L%&|wAbF3Y<|4Q*P06>seQ}zl!I)Fp!l)?`taMVzE=#BkqZO*#?bL)6pz}O`oN;MW>BZy`OH< zKRmSm39MW|mz{;O{(!U<37eFC_<`~C17*}!5_7ZK48cYF=1&ssPT#4ko&BNY#xUKE zH)^|HD(`a=qAFLoaH`4YR8D!UxZBcN)x=ufzT~hYceXEXi0k~i8Zg`buWS=7}$I-)3EX6m~+k1kTFP|fLnLXLf&~wOGSmYu_ReLT` z-02!S-K#-5Jc{M9^cE_`98SB71kDIE5q1ZT$W*Mg=W=VQv(R=K6-D)w-*D!GPy6r< zl(&YuM@6rY&XSQt-*>2Jw6@keALD%3oFY6;lQM>6jO$2uyv~5fTuDi!G|{ZzP`D(4 zmV+;e592xZ;t$vOFR|L{AxE>U#eD)*+QxlM#@B30qsl5bcb`$I;`nluxGj-^-P3o+ zK^FOQ#UH$$dC3r0tdVno;PUy?K1753{C0Ytqgiue;`1tP9AD^y$Fp0(-8+trJu=o= zI8A>8mj68_H=J2lSqsK;O z9Ebc((oTwAisO3~NBcpL`fo3f% zI^sgAnO66`=BE_fnXB{zdS&sK@SZsOJ@-r4Xz%&jaUs7|y{tucU{y11S2{9TeM9l_ zSQ}f}^D)=pWKRAlq*y1r+q|i>I`x&A)n26?wC9n*pQ<`tmGcAot<_B*B=lAgsCOZ? zOnmQ72+bOH3$k_$_RlU|U0!X0oA5_94PWe4e>kvkYIoYk_3r!W=RT}fs4;6d!ff#3 zOxS4^M$J~5^7EZcvmSMl=6@EMwav1xtiN=>&ob@Rg|g$OQEGBUE)Sj_aVgICIM5-N z6gTTaoImeqKrUphb|v!VUKWQ8@y!Y9n((tXM-K15>ct)H;rXcgnf}4Ffra+BgXwnG z4_C)co!`vn&ziIM)2(01kXrO;4PJ`ye2f3sp1wY>#>KAmR8Yy#t%a!(S(?!F-e8yK zrQYjDjuauv-3vO#^baOUcCw3Tj7fH0M7YyhmVQZnbs=8mS^pKeWwF@{lFT{6`I;_| zQt&H}_r0Q#bv^Up*!hJK|82rgZOS5M;&ZRiu13m45>OYWoND(;Lx@ko_?A*W_2ixE zdZS~ybf{kJmP`Y&D7~c9rdO40@W_|fG&%_yubf6E$Q%y$m@F1pGgli)e2r<+xnylU zM|xhLHsw9-%~gvpYhhJmz8o9D4CT}jQK?JT+>vfc1T&S#rE8axg^^?N?+$35I8sm3 zE#a28^m=0T%8ZFiqHY(N$a5Nx4ih}jcTdW@OkO}V=VS5 zb&}#bo1@m0w~o8Q_yLZY9j3vw@>-%_Y_FVYp0`}dd>fK;uvuWCVw@|)-l|z@YRSx9 z?BS%xW7pG@s(q_2FN*uenKME!&A8lKzei1#He!$|gg>clQcA9_BWQsqqCLq>(zlbY zp;OpAdfWJt(~3*R)V(GB_SJ=DA&~^TvV3xq3Fdg`)@mLLaIWJMHzMJX?DeP?_18ZkgUp^wm#1J9SK)Q5 zZ3`h+j6!JqG9t|KrQGAHbx#@*e4LS9ywX>Y-?NX=LbxHNz-zMoTDLhn!RyYHhfBd8 z0_It+hwm9L2lw)ajEbdO^p{WvH12qmJ1d}HERvtw*PM|d-NE^GtX4GE`%6VJ>zh;0 z@+_V>Nv!CGc*szt}adSi#;>+)~lpkk-w!Y_Rw~wNt&Ju1BrYZ;VJ#_E(>6@xRq`Nh+PH z(5kcgnE_wzt-IyBdkRV)spea3ZtTsO`QR=wWH=gqYwD7Ix>jM9l^CKz&?)d0f0U(g zRAK3RRk+pW$$dr6GG#0F+^kNymag+@roA37^0XYsiS2E;N9?#QT~DO1-kjSw+%@Ft z!|OUDIoofLJ&1cyUzY;$zXpWSz9^`sA578;cIxj&-*>8@v0Z!n|eO&)2taq`YwKTDV{BDoycm z`FRR;T$irsmmLVbwi$l9GoI;m6WZY=cSmF{vJ2irBDr?;*%Zf2?vFWGw$dFV8Z#+t zdUd2fw58;0Ptgh`*rL+9?@CV|aQ3!6GO zGl_Zl1UR_(p*M@!dEq=9Jp5cBU>iF>j2j$<&JRpM?A$OI2Y}i51nA%#z!U@Lf^z_q z5cZIC)S=}lb11MDs$9{>oxLn!Wo~7wVy$lgOs$ee4kiXh$}-}RX~oLc5PcdmI6@hK z#?brXPT+)gLttG*y`+u$fQ+|SEe-5Vtk5T-OK^c~4sLL2I0qcqBRKd3P|@uqV9;f7 zlolNa448R1xS{GKtt|9SEK$Zv7|IHasR&D@0(dUUQh}xxa~ZmV`iVP%`B|aVl8ZTIidD=7@pHIOQckLpbGSQJ)$hR3|uOUY-tos)%7;JU7rsJrws&JL)7S zY=wVeu>JF?*TCY6vb!Lm^Wj102229jXTWQym;^A-023`H0jx6u7{fObnBRB=FxFlq z41}2wK-=xW8QS6?fi{kTgcL}i%}Sg|U^oZkj;;)t>v%w~V-kP>V0gzQKrsONvmKqSPl^0{b1jQuicrivykdOumY~O&{&kMs+0~Z4cEH!XI4H!>! zbAZJS9HWEz4XD9bIysSGIC(MVPLKeN#@IYT0#Ji7e1Zh@7;N7l05upBD9Dil30&2H zG>kEn6A6N2fLV`zCO9&T7h@d-8N48YrHl`{A3JKG$9OTuQcffwm=}8(ITF;wi!qym z9MEeR+bKwZ+As!GP9&HdAQSyeG0*^vMU@jN28IxO<`+^7v<7?R7g7v#8pgm1ih=RO zSXnudU~+-V(Uplq8Q3`l7B4RtEOd?ppbQ&m7byWc02^l)DGBb!woDR?1~%j_QWCTo z6LFUlDG6@D202E8DGW|!M^`KbI)fM67%A{bY#bJ(6nG>iXagrw3UmfGCJRyubOtsg z3sMTS3>%RJDFryFZ{6pHVxJ?x*%A`sPzjzAX>nZM6J_bs|8!zKlu%K1Bxer52!Z)4?wN` z{~CdSNBp<~z%MwFfKU85_h;<{{N(pu3V6r&7XZ%y>Iz!vz{Sjg^blziTRVG5`~x0_^7z2GMX>V$u?u`YxVZomWQW0l zQyZixeecr6i*@OOuH)1^4lXX>vW5BwNfU7UpRRza(Z%YM2<>Ux8FR7#HenN;r_HFvwp7dK`=!s2e~>gV-_*juLe+&;Td} z1AGI<3sfv{9b%_&l%mQHSTl?V$TZ+W09^$I`GMaFrVI>$(j=gIQ9n>=7&lN2VO%I_ z0fV6=HPBljsfr>4gbG6a=0on6l$P;F zI>7y?ZsmgFd%;1I1%TED;{pv3K&e%KEdTpyexM)nf^mfdT?EW2I$l2Xl=|zM_)roU zn-2#qgZ{ATKYsI}r1~GPV$+~|puYUu4{Ui%VRRC8-IWVGT?e8k(VABK|q70Tc z7-UqpU{g>hVHFp!BtQzQlfZzo%8PZPLc$>J5#vM!Y7qlE4vH!j>35$Ue3z{cB)_*{};IM|D-kcPtpQ))$gre@CE@;0DyJ~-sV8ZAN_*{3$jr{ z^p6@WOaKnv9e`viT7TV|-m1LtrT(@Yj;{V+ghx+CFnGCfTJCnb?OM(i{ zDaNXH`KqP;Ra9h7@M_3abFgRlL2yo9ux*8U6m$|!pZLY#oV*AOmbRt0wj!gDPJ^Rv z3o;52PYzU|BdiN2iUe%QUxhq*0c3`n3J~PU`wjmDx)lzX1V9H`qlOkPz&W6!t}*uj zv<3&B0VNCU$Xq601M%gH~<#tmM9e* zA^=h*abPS2MdH9%FaVIYj_v`_uW%d~3*ZYl4vYm*Bpe6E0w@EH17iWr*kj8fcmr4h zFqHv03CDr40KNe424Ql*P6v(yW5Kwb27u#0S^x(?n;~><02YAbfLQ9=tMi}YJ!Yw=(G{X=9BEb9MS zt^dmXzlIC`o>s&T7Ap@>K)E3Riya0D4p6}#z&$iV2Kdh(Riobm_n;;F*ZUec)^@Z- z;%^1_P|^vKi!ij=5dbVa(0+^u#R0#8dl1_MC>F%YVQ>_r14l_Y)O9YDeFx<5qXZ=Q zfxy6EK$nL!4seAVdIlFt$^noLx`et6J(U}vg4i^8-4~q!P(C^VlwYfnncMyVy?XJJ74I&zw z2gfuDoBo~eExX{KLU`Y+z)*+(uIdO!4HG1)Av_F@vvfkZ7#wHngzz!2sQ~q(N&+kb zjxlilhKSzELjDZCZO#49?|(nD{!gF(xX*tdcmtR{VA3dF3TiHIIM(an zX95b%l%PG*HyPQZQ~j&m~sy8$@P%>>$Z!Cr*Ef6>Wg>n;Dz z-+%34@>f*+WDmLZmj5pA5~xmq$ozQ-wm$6t;%e{Tl`HX+;qJi>0E!0zFnl22eu z@v{vS)+GEh`Gf`*f6in7K6lH$i0g-&B6Jmhw;%fZ2mPqT4|hV?g0LTLgV343u>pei zg(#R2TkU`S8`|@HC$~`0>2C`dlwS*K&j5fxl;;2{0rnPH>jmV22ggKc0h@xr?iGk!n4&d)tkR1|NIHv&syuoq!H^3U<-|%Z7A8?Q}*yq4;@Gm6Qa3C!=kWe`E z6gb(!akwZX?{M%Z5O+A&1h6rJV=zjvqQoYhqD9OiF1trn^ZUsbBClV4s(a3Dh_9dq$&<)hrnzc z&JKauIGi1lw>X>~+>i6QfMhQYbBAOv4s+)NWa2P)ND$*NcL>?W;p`Byjlk&Ad z9kd?psswcuXg!FXg_#3@W{jH$3NS<4grQR62v7=(d5cSc1P;xX1PSaM09L^3p z5NnM_N(z7sjL`-u36;XyP$b3a5ID>oU|0wo<_=9ktX2Vf2?Y*7v`9;XLTHMAQ^WW> z$QmnIAet8d;}j5=nq4`3W7#9pezB@CJ*F7;qNfH08EB> zG`I+=!u$Yo5aU1!ka8R(&J7p>OaQQY;5!P)0Dh&=U0f)8CG-ObSOJt&06)=SHuOZu zG>Q1m_Yx2YUHsMmfCOA^Q1iJ^0uI2-DA|OrMF6$QMYRIbO;B9`k%R^PA=*&10>KI7 zB|i@LN5>(=k^!Z-(TCB`i54aeu1ulaPt59f9UO$@6}$&Uj4gjF9K&}2XY#LGo}NL z2WMpmG8BO`rUMy@z!}qlI*Gs;(}6mP08$#Q4+C`)fitE9brOLyrUP{nfitE9r4fNM zrURuBfwfdYuVo-`Z#e;V5P<{#fjWr5VgEn_MBt!*p!Fee$Um5h2n_HK-rbM_39LCE zD0&E#vocD915LoeNsw-bgOk8+6@i13fTyEBL;d!f8ri?f(Ep^7{i_xI>V5x9w6GsF=l4+`s1`7L z(ZU(b+;74j_fiq62&5l_8T&08`VD67_ZR+H0Gs}S{sm=$8T@PaW9#{MeE;`44g5PO z{*`C^t;@jgDMR2@RKSN|(C+vj_7wng^Czkh7R>$&RS4%R@G}AS%`M<(rGAtLR3EhA z8U=9uqqcuY5Tk?&*!QD$*MFo3YqI}?$se-t{|okhNCiRxL4SPAzm~>oF@JC9|JUmO z{;oghFh5FuuZlqG>2IqdIMWGaa!257Cy+%Sfis>!Moz@`5msy%N@72Ht)ITReLjQ zg3wVcx82H@e;kSGZv#=G%)8k7eimGv4`3634oqBrrx-Ogxm<%|yJL&@AoK!6bK~r< z8qM`>r05KeJ>nsp6t?E4JNSH?50$<00lJ6y*G1dA_6vp{Tthf`uBWGd3u@d`70fGST{=lFr zvDWyj?~jG$KB+yzG(Xb#@zBEj2Xn6rHc!RJDaC0dCsx#V(oXeWAKc8lx_uuXX;bR6 zyvb(%b(46ei57vw9`{bT?HbZhAR!;|;z&+6J>qdkhIpUv6BfPkdMCc2wz8?=6S?%W znp%vZ+U_PEmh$mDPL1b@L>MDrAC<3;BwcpSO5^wLJ*L#4aa}--`SfQ=y65{J(Nvi* z1kF3g4o9c@)ti^J z)}F3AG{1A$XlhMK7UT2nk7zPlXA69|tN+vn_taY3MuF#*^jkT94zGvujlixXc_T}t z{T1jnbr8(O+}_9*e4Fdr8%Y`&SQ#39w~#=D6lE^2Dl!Rui+!*(tOHvkpML%jYOit5qpgHj!LMP{4#`fxS z4Wo+bOeK5>yTLi4qVMEYduNwn;%kqOo#4mZ1?E6IQ4_>f{Y5k(p``z=hp5zr+PMb zgl=!o7}<+$ClsCdo2MoxtG_PyJG?u+z;{BQ>x}qy{+;_-@OP!{-hXv~M2BM6wMUiB zBeI1zcR%)#sidoVVsqO1md*z|U-BU5=qQ2XZ)h??&(9LpdMF-ha8UfBEil5AXL`Bu zzT=Gw%iiSMiCp*w>V$1lpq4))I#>uJup&#YY9bco$CfYet^hgXv96*5o%kRDw zFYfc`y_@uZh{w-uJ9SLUiazBd>1&q;yNqMv*AHl}3F}>Vz8kL|`dXPh`qgeh5u<|k zx~u&K!pG*%2_0J@ELGIHH~!{QjgU%Gwv|m}Co5yp=l1T#B=d95-S^LVCr*@l$HAnt z*w|K^s$nkH-1{4+k6vHk?g`)R z{D%lHz4QIeYMWKELtk~*HtLL$KYd&}O3Alr_=8yn*;;>PmO+NGt+Px`RqW0O#O{)> zbshqh_k$|xmg)YYz1DIL>mq^5p#x4fdTH8NqWPTMi{9=83(rYVk>%)Hf@(*4I9%ifP|#5uLloukX4nbMv){ z(M^k%vvVDOJK4@g=E*ir9-uz&bHfJV8Tg>AFFAson{YqX3E9ZNU5Cz{=i28LF6ri| z=IW|t~A5xG7w5Y{j}BJ_Yg z{2KAB{oSJC$4!a#ithVMD5o^T=`MZAE!kPVb61G^wq}R98v3EIQ(i`|b}2tcve^@y z&eS;RwUV=anG@b1tL)LRhx=<2v*(+h1TXur=DXfA1nIupf^Dz+mhWS{`MhqBJ?`u~ z`MRJUmRrSBIyMeHZ^refSgxMN8y40#624dO`dr@A@-aVqcP-sl#_;Cjs<5dRcyGv= zjCe)T^k|94r>IsYZb%RxHeFN`ybz`uC9PGf{H{;HU+Io2RfQe(#kUq5nkf$h_>H>k zm8C-RTFPTtIIcac?E)07=wIJ3{Ye9X{jl#Oy#mMD--Dhl=4-rKx3%s)ciw{$lC&leLlsP#d!G93UeI4~|H4BxV!Kc+%4uX%@D8x_g-6M8fdHbB&Dk?(=(9YvF0vKEIlW2%ev_f8yZw%-5@!urup~= zySQuS+?w*0L7@P~-siJ{6`yNPEDLk=pXwZ7Q!MVZ=&=dH9R6$tIwR>kvvC7&`JS_wH&nJ=ziZ}Bg9=rW%n6xbQ=HWxi!FKfm4I-j0Zv=E=_14IT+hh~{wFp20@H z{Rc!s=9XV!d%!OB9g*NTJFnAwC6uq=`o52jp$V zqJGwg2(Y8wN}rnA**iyIyGuG*zjz6TdF?Mj9w9zjvsos1TJDzOtt;El-bqc^HAyDB zFI{YZEdB#sr#kadG0(z%gsUFqc1nw9Pk$jWW@@+B9K|mexkj~!Z0Wqlv1)T5>iAUM z-aRx&4;(N&q0tbiYA1^Q4eWH0z?_!8UH507qd)VnxY0 z^4dyP1~@Hi(ZLwjSY=XT@y{7Ir?;^jf7C7=GFbP#^CQ~_6M_B+FO_FINqmCS`_8*H zbdgiH5X{fEEliiJ41btD{dimbAp&ZA_qMc3zil^{>gahdm@4_#)7_IGZ=X3!YCzKC zY&kV$vuUGoO?=u|LzrQ2)`c9Ni|>r6!$J-I&K#0+e2y4-e3<-ETa(7%_f2VTJt{K(tp;-IkP-rjBa)LMdH zeF=-lVPWN^8rvU7l-7uloGGty?OpQnQh&_SuIKJrIj~pwQbL1EQ6WphS`!P0lDg<= zSKXj7x4f}%xV(n_0g5$)=uwk~v5dVAw-<9>#HFp5Z8nU$78C_u)SZ+*cI2{#b5IWT zd71O!tQm0E>@179l6T0@CnRP++s{&4a99WC*fZ%gFFafBwVS!Oyx7-nGh-W7Bb`fF z_c&`H(6I86%Ca(tJ~ezMO_oq(`-!%tc+;IWY`y7U2``7Q@7dRAz{maYRLR(+i!yK6 z=$s>o*b}ofTS4KzTRVMMXi}L}q|O{fx*}JHGa@zl%H2jN<#wdKs9kZp=+8NmnDCLA z_sNO~@x<A8FlvD_=0=%Sqe@q^B-ymcxsMO{eV2k z>kCUBW-|h$$S-Vtc$B!5xSn#Uw*X}vp$@#w2o_ZK7VQ_m5y7-aPx|~x4JyiQgT{oH ze(=n#Z=3yWsq+9YqpeFFl4mr>_V(EA(J3d}@M&&SNnCLn?bozl2j6@rK!5PzBOSGl{fOdghWk#j8-7ks-+M5acB#UyRE)TH zugVA5B(0spt2XW7k+>IaMiq~)$vZIaJH&jGRIyE|i;((w=aVo-o#Up?RIgZW=Qcn3 zP#5Jqy(f-o!}j)qpQTU9)3ZKRQ++d+u9r&tS8*+7D$0p~Lpo!R5$~!WIr->v*<;26{ASjxlsAHi>Xx46gfAcP zUvFdXo$((scIO|hRU5x=rBvf(BV53Csi5;$zZM=|_Oc&6 zSC~wv@`A4DAkpmMb&(w_qE7_YEj@eUKNDqNySen|kwAIgV@Lm|BLN&8zZ(gav$ikk z_LeN}aoLsgMrL~d-MP!;?S6mQrGE=T{mk8lyci>*$%Qd`oL?SgbL?iw-DWy_+h1}Z@9`_07 z(&8Fd`J<|QOx26)X{S`SQB#kHW*(r6aBn_!M`*jXa_Xs!?Khv=7Yv5(p@n69Og+J> z_LTfhP1$^jjm5ByR9VodeeR9vn_Kjl^7QaS@0#)H}KYYZZ{Euyu8np8#p}h(|V!K z2YzQOad-F z%iH6Be6z8tfi2m8UeB1r!%*D#;BBT)iD6VXRhPEA@AZkiMCK#XLTAWfU662L&UAKh zAi+EORE*e%gBf4n@lQx5zm$bP=o`whomr$CF=XLnSX<{Peo|9)iB0={kGy)uiwvLH zeCKKgi@`KbgV%ADBaL?~FNK|?k7?{pWObgU*`;H1n(pWe1Vz8aHI{g>hIvFK&R)CteZjbJ^x?HZv#S#sbyw~qNg?uFhW6v2%E$~@KC;23(+AEj$NsUl4 zww~Ky^?R`=vw6o&M9rc19uiOK1d_FK4W5-?lfaZbG(Mz zviIUEUp&OKF508hW0BfI?w`^!pQ|rkc&nz%Qq;n{Ms2+K$(y5wXUIQl4!ZY~>Q=v) zuVn5qHh(PnRy#HB5PR`1?lYDtKBOIXm*M7Ejg;nLN%vn_X)!^rgb(vveV$ zs6spulX&4tQ3*A%7EAj;GY3Z>@$s5S8}*op8(k05PhRty4QcCTM>-yxJ2WpXa}Fte zN>)K*`?=54(kw?C<`;{)pK3h5+pMwLI(E$99NZasgfC-ACOT+kl43$MVs*{N+~ei; z7)`0SLbXl-L82O}5}&RfJf~t!jK2d8v)pk=K>0-VHsQ=LX;|akk<$Vj0&L>$5$@wb zb}}MdJ7?ws0?*{9H|GysYRL3894gL)FZUW>dgh>GN`ar%a@o+C#f$h_b?4{!FEkU! z<7Aw4?L|8`HMGC%6qu@zzWr{TR)X-2@9e~V{_dNB$1gFE&EM9*cX{pi!YsUi%r8LU z1IOX}H#m9m9&|-$TWvmKvS=B9wOB68pWfV2rZ9Q#VoYPl6ls4Ehe5m)!&HRJv`lpJ zIQu0TIgOcDiO<;<#l8kezB|brrQB+Ce!}>jp;DY}G||Fzp$O%5@xpoS9>H1lF-8YM z)ri$2g+w+NUy)?^Tsk^YcbVc4QmN6-XRqLpz0TQ`LOa4I_On+Cv*1ryo7k<$cUDDc zWtLd(Nwz3p>G3D?w$hdwZOVHx4GkBl zcRf!`50&d-W*Um{I4tdXzq-Wzfcf}iwP|@Zm_?pW5+cZILeXwnOWNGht0})pMr`lI zy^Q6Qov$q2cQ)=b&?>uJw~JOYa{q8f?2^|}XRn0F_c~^Hdk0k|TyDI)T@-~F*Y+Q1 zuYV}6Xdv_@-`Ztqb!ooi#oMHy4NI!k*>E9a<>ls3K{pQgU8Pz4a7{f$N(mw&iy68) zg!b&U<3mSkF2Y|Y?^2+yAwHhRlo6Mmq%V0Z#;}}NK=J;a4D< z+QVMa#5NGXCQ;`(;HJTqC7NS&Gk%8P%;#8>AB@m1??eBD4$9qOJhuD2>mH5|M0Y~! zz+z9L>|O3xxTzjqT19gEIN_DOm-nRX$)j`PyL07}FMXn_5Y;+IUM-zb$|S|nr*C~! zebSe{@astFq*1*>rk*?_)2w?dU2rTp^n{3ln&zA8=O6t}T7E5-bK{jztq5qXl}M$( zZP_@}cJQ>+#RG;)l*Q{GWUm$4gtxw0Iry1Y*O6=P(Kg4%BQ8nX9>yzq2NzQ9USp%U zY{QK=vHE7GzlSa1$c5vaX560PMkH~qqnj}MSN?1kBirgr;wCC2xRWgHy%uC6KX{8A zR7}Z}-rar9JF-PhA>!da!LwoBjUS&ru~ineYT9+KzoV3V`HB^jFt4> zImDy8v4-IWv+0rz$szMk{%zIV9-YEs9rybdcngbec9%w)zjP6=CqCG~BIXo$3E=q7Mhm=i8jzrL2r`(~bTt+ZkyvDk@{p$TwWIvd&Tg}Qp)8V0) zm$tGLDV4K#UUL0^jJ*SQ9qJY}+}O5l+qR9yZe!cFZQFLz*lg@Hw$UU_-hIw}$M>Cc zZ^t|O2a>&?h5bBp&ABFICjid=MupzkO`)RVc>Mn141MmDOUyVdOgTvHCrHF-9{%aZ zNbos7-=9$zd23*hy=hj)@MWGxH0T=_cfLE-#y~c=Q~T&7GH^G_SgLTC8sfe#?$VUe z!{=wRO^1*>|8Q8Axm|oIm(Q(P?Z@Bt!B{{z2u*6nhl4tEMT*qUUlRmrgQR4qI4V-u zhHJk0$%Y?w@mIece|bab>tEUuPNgUc?Q6r2=~w95@T+I9=}O-ou)Ci0T22FLH=~g z6x9+ZDS&3Yz~zNH(cm7PC4oVro=hs6hGKDG!@x+(Z!S#!(uEZ?<>&C~K9e3lviw~G zt>~6Q=(!E~HMg#g{U>+tcoPee(CmQu+7HJmIKzycmV?5ccp-x;1qJ%?9n%UsKQ3u zW#YrpprmCC#1KPfMw{J%;16$>pxK>CY}*l=4AOa(l06@o+`uOC9!6}Guf!>P0;jXJhS=_bx{iZm@>-My+qE!|#(7Z*G6dEC zi0M+q8XqGEZPyD&zn1{#b?e_wVeli9hc+)<3?^aM9kzN6bgQSY33e2^ja4&B z-ssg4xacr`vw*qjyGp3&bpq3yPuyFchou!b5OXU`#9H-_0w)kf$EhcwvAx6MLlRX1 zEO#p8S+Ah0z@Efr1>q4@Z@aKyuUp-y?-LFpXrHhycFHp{lBDIJ({=QcLbF% zXFU(c2iMBMO3L--)lIR`BOAt9z>i1hDK>w$V7r$Os$FF2qB8JE_NB)8;y_Dt3d5zv zew_k(B?e1NYLH?RR&C#4XWoupYCPnn8c3&Td;sw3f&%F;( zmP4M8%C}M|KJ)tb_^N=``%2P(HeURqXu?M5@C*5~49qJTr+`>*uKvu-5rcWdAn|YN z`cKg?z|x0*mNg4&6Qe5NMbEDIe-Su z=4rSqxTNHxqqu2Gl(=C9ur;jopOjZHC;#U&{m1z2k8mM?RPLW2O6{*}>VMw#gjoE{ z!$7+OGB zBf0I@Di@H~UE;}IhVr8Mm;n{}dBd^WY{9uE(2(Y|a7`xfzO&|zD+Qm7z{j0S&i4bp z_VIhqy1+NjtpBBy{KtmxPeQ{CkWT(HG;&HZ31CE!fHywduLfsY#&*K#&H6aAfNmVq134Mu^PtB!J-JJjdrLn^xyqMZRps#6^? z;;Y+6*p~(|2b+aA#bv)#=sK5{J->tC7bC7F3mZlD=m8)2jW~bJ(cJ{ivLOKGMp!z< z1~YJO%SBmZQY>-}i^>>Rw8wK?!AWC6>`7WGn0=hSyc!a?ml3!}$SnDq@S8;bQ-JC( z_3=MXOIMXEVS^EN@+Y*HpvqTV(wm%B2QJJH0cW5h&IXcQ{thB&1jNJu`ZQ`N9F*?} zT2d3wrF|mdC*KXi$m(1>zU9lrYg~2H=zcm&=|g8wK;cd9LB+baG5B6=Q536RQ9%M1 zlh_NpNh9>IzK3-uS*^v4uWLd!lrF5!`JRbtY#v(tWuit)kYM z+nr#Q^@}?PL0P+Cs&GYHe5`yb==P~eN0COQx$Cde-mpn83WW7VeW|FCTX!uUjJ zlW!TXoBfy0{B*pA3u&H<*KHC(H?;1Gu(ZdFl}eM17C=$JoJP39iQtS@kz*e_4DP%m zT*=U2dzPF@Kyd?@gxlZWmBA@}r$Si-Uy0z@_s!tkWf2SvR4^=ZZgu>YvbAXy^eXYf z=%GkBX>^%M_p)Al`LCyMMGZ6@CpU-0E}utmb9^U^AXUy4gQ&pNKNCZ$(797taoLm| zzL(#99)<4ty6R@5co^5I+Q{i!r(%_GQF@SdXpJ||`B;+zg z`1hmE03QU{Bj^6XIeyD`onmf(IhtjMkuYv4T&k>~9Jz>#$vZ#DuLA6tgXp`O?2mR9 z=j7^6=pP_Y_Q$+5#95Lrb82joc8>f})5Hm|4&OGDMeW-_Q~Dd@!k*gy2o69Z7O5_UKtyUqY48Tk6br#53F_{EQ2 zdBPw|dGR!|RR>#tuo6alCgHSC*l&G?o_(ln&pcLQ5pRqvFq9*KW-W#hD<~3F_4vV5 zRCV7**zgTNaFBl<%_rk{#gg`|2yYjjDJFu7s{AmVN$dhkrSVkjbjw} zVWT~t_lBrj1GPYBf4_)S!WA=dNJQ~V*{VrnNE4l(*}&&!>J@vz`hb@u+=Y3EcM58! zf>^B1U9TVqT?2Q#!o^sEOQK>9uG1_(3JGsI-+wOXFn9Czxt=f?I}UETuo~$8bcfh`Sxj&g zNB|1snB?wU{G$7LPCz;DQ&MAh#}1y`SU9l^u+9|#c)rqq`c-C0ygkvxOl zo2ro}NDBuzi4RdTY!w&$lN&v`$k`rpbP%V89Lc7!ff1{8eIcJIlrH$f?c!jQ`gugp zPnRxlBupF=zDIyZJezRb1RoNR|HK{a+{#eiC|9hSfqDWH5zpPrXGj3$^Tu%b;lRCk zzzf;zI&2J7t=7-OSRm@uo5jxe9MES~F;eq$?X)tzr}MQ;3M0~1Mu|86u*C~EE$DgX z83EMV=KeRu^QS1^U%sdREFLu#sfG>3zsDjw?P;NR&l=Q`)4y7&t{Zty(cW>5ygWV(n2040&Fe;Cl8p0^bV5562!TVKBf=$8!+MMNHoZ`7}(#C%aLd*�ncd-iV4!V$TLz!oQ#@G6rl zIkVf2@+w5Kl=hDBNSXO9f-f5qb1dwaL#>jOFOW9rCuTe(+TVr!B+(|lN{DAGDs}^W zlHMyqJ}n#H1NvLJk|36{eriurrDdDXt2kH(dd^7mjZtJSlVH{3(KRHG-e14;yHCtE z*PkTX9b3X1GI)bsomP3(s1%Ap4U8-O;2yt7UeNkQ?X^YIe4<6%JCdC!VLt*ZD~lX;u6*bw2IHP2(VXoO8K;(uDok#>p#7xpGGF9*d+ zA@zc)#h~N1^)r zDp31uY*Iv-teZu6i;9-PBPk<_Ck(ujo;g#56t%?!#idQS<)*DiMKRxt;Gr9WjT6vN zr2g>FwThbE&?7-30u?y0ik9f=7UvF7=&0duJ+Z+BI$LAL;oPPeTT-W#jfRND`kSdBMhg^+;Pzd8wX?9JKcOBw6A zo4H=APkYaBu}Ynh{^m>PfL%&uojRkAkNoFTw$#dqd3( zEPlFJ5w}T5IUMt+IhGNaqu%f<=N5Y<$TE9ML0_G)N#9Gb zH2g#PV#8LyHM_kn{#Q|H04WlqL^QuE1;*Jk33Gnn(@ARZNxg zY#xD0yRT!Yn4*?ZIz)7alga+i8O=Mu5+R0OZ^XxO2?=~D=bftl_TMYYZ{ld^+DMy1 zMlFSn^&TV#N% z<#l_Wrn$>}5`_wEBsW~6I!EO3tawasxV%5Lof6g_d-ZY=+r$jBg3~5aw&Wm28cj7> z>YQ!yikjmgEvIVSy2-}v{KUKd#p7hot&tw(&Kp1>yi$|t)0ijrySLn8H*zEW29D#3_+&c z@r?}H#cXS5&L6<30pmViOHZ$V!@?wPc-bEhP5y2h7-x8mB~6HoDO(>g1Rcn{#0m6y zyj_TjX|zM8Ia~;N_C7Stq@R=hStsQ&Y#D;y2NbucVau*xqcX5SAM{MgZdQp3@tu0I zA>RONWEHpz-$(bOro|=mt^0a#Ihn|FQKBdOjVZ;=k(p?fkrds0+f4xG1Iw5^;LUsl z?=pyJO(@M4Yv4YgBKY#akxB`qegt~!2Tc)(NOQJ>yO-)37`&OgNdBvq&?3I#565`x zb}KHiPIVy}wuVCN_$CWF=ZB(-(g~g13+EAwd^b><5xZz(c%{(fugx;^nRR<~?LE;E)7z>3R&Af z^SZ0pqz7(us_$Dv`bN`LgJ`rxJddqLEG^fjIUm34eE`X5Eh+sbJN^`N{A)4JKf9Qm z>I4!k2V|E5Drp|wO{m+_!R;>BM`!p zEm#sb`2;badz4F2t%w@nn~NG0To#Q9MmnBNU+&2*B)V97i8&6jSqy@V0?Ni~#p3H1 zni5#_4I5Cnu~@hVDc{P!K_9|9T#vH=UqZpGl$@a`HokZfjIjq<7P3^k13#5T+7b2# zScJ>-`c)0^dzOAWt)?fv0ChUk&yD8FW27Y(nCJ^gXoxY>&){b8*Ptb{Z&*$d9!gj*l78|bOyb# z8ar;Ygr3uU&*~)NF1g+&nva9$68AZMBUtCkKLV}e2QjFYg~-f*iCZFU_@KL4@1zbALWR%i;iOQV}jH> zrDN^RiXRtDPn9O#cD|k9r9&se`nrR;J>oN(G9XL;GU{fz%%Zi1=(XJ^^Jz$X^Fac| z_4%|)T%;u78>SfcyDw?0{1zoeeck3( zC7-PUUzo4J2T<-9m-25C`A8?{THXO{HA&f7-@uw_+5Hu1y@xYat2gM}KEQ3(OaXbCBn^E9dgY7inXv2uNr?A)OwHjypu<5L~c z+SV=)7oC-86@6@8CoScy6m8lxMKL!+OI=TSv^|nntGHTI7N zp0OLt^#hyN4Fqg00oCpm;!|(=-50M|0fgbG|7EhX{=LEUPr$3cTt5C422}t-gt zPM%6w?v4A);sUJ)fcgi_bCQ~DY6XNYod<2yAjF`_DbzQ3A1LC6_`O$8A1iN$DO-;# zieI8&mQyW~;I1k$={uF%E_647#Fbgr7905p78294eA<>oVfp>%VjrRFFdUI+P#QCnwBi}fN%8Pd$Ff_mVlEZQy<;$2Oiy#D`a1{43#~BL4?Q3( zZ`5A1r&jr>!0cS}U~ikEw?aGlX9iPK9G%F?zUamC$>Y3=(+`2CYw(x*TRbr6rNgbV zC^5Had+)a2oi7-D;k;Vfy*mIzk zKv)O24H5Uk8_ZBzrrGVZDv9Ks{)9#0zaGadQ*)5Oq(yHD^OLl0Z8N@1-@B0(1jvcaGK zx55EKum7LO`u`e_vHUk+0T_c8F~R~=Jujbv*e%@=@K7Af-anc}8vK9!Pz_*i#w5=6 z%Y%X_M=_x$e490p6@0$9gCu#5a^mbq<0pAe@~DEemECdE;)9j|%|(fVIpEsGR#6vM zGC#5!5j{)NK_by9RD$+Oxx*k`@M1&)QgQ0gu<{8B`%f<YJdsx% z|OsvtC}FChfx_@D_Qg`9$9B zh&JD01ZbF#E{1iz(Z{ zXjy6k*Y#0w`cSq_=VSZCgVdH_`Dccgqbxtjg4IeTMyo`~Y$&dq2(Yz<+)y_kWBZ^t zFHGMDS0dva>)SVFkg>Qgk@;hpV<~&q8$K#2vh*ji7E&IzJKZPTmipaz3Mj6(G>nb* zzAD(BXI*6{Vi8$%a;GO!kMFCpu2JM#O_aEfK_=KHC;ejchtx7H@91fM=k3iU1gUID zB}9p21O?9;6*Wv1Po+de_kGH?feWfVO^J~$uOw>)&Db;Z8^PdP>J9FjqP~|8xtn@% zNN)nwG@_X7o794S<{j?tL}ERi$jhi}QGZ(i16sAetAjB7LAbV9<@KWn>RzbQa`|jQ z#M#TqAh9FLNO~BA!Jn#{k`YX@i=8qLkBVsI-pnASP=YlB_nR`4Qt9Pg-Sh>{Xw2X@ z8$s8&OHW_*k{ML>7aNQd14H^!6E=RUi@=e7fdHYIKkRmvUsQFBFXmu82Dg z6I!lqK#8(ihI{;e2Ba&>KMTI@uULy$gusI`TNxl}5JA|%gAL?mRt8Q3Tf{Gp(_KG> zwe8M?A%SDT(y$9@ITxoYOU4Hhy}AFGFjZ=Gs$Jvf%py~-)^hsp$lWD#>DG;~xW-6O z2F`&VeK**BN5&+_N3|JE@-!ZJ?JR0apyT1gF?Ly!f~-!lzFaoQW)TWe@$)gKhJN?1 z>_yD!Lx`S_-}48gOhY~cL$c(~uNkj(v5n9OgYY?`3NN*ycZcnX)M~TvEeSMqh`>CZ zTjSmWyDurRn+z5hGI}fOc3z*MP@&KrMKnRtRq%N&QjKrYWq`#waRLo9g0uEg961(y zTrnfx?;24d;562WzA()e=O5#kkEl34dnG4FQKH zDSsJN6)Dn}r1PXAb7lX)C$A>csF1l%U7z18n@=ZpE>urjAR+y1%Ywge9oAJefg6h2 z54vI>C+`KJdrP%wBJ%Z#vepEaoIlnzQ^2{hYM1;&%r0Nx7-sLD;ZU^-x z=w~*#X&ov|<^v>bKaw6>Fy)>YI(UK4M9~q3C7|hDhLA&4T<)$xqZh_&n@9yBVQ6M_ zn>E6hW~mv-sjg{}Cl#bv z#4ir)Uc)G=xK}n??k>>7Z3My-{oG|QmmL<22carE#DhsBMXDPwrMaEf;?V@tULAQ5z7hHf2Uz^DKMrXT#}Zuz#1GopDWj zclQza;QIh!aa4HvO}G2w=>uTd@4s$6$}%=!f9V|}bUr1;eYlrYbfj(hYRCJ}ok63Z z7zc!pe)12>OXL&@0bD-Wav=G5cUtQK9BA}oF0i2EO>B6UM$r1^XunFTReBfUd2X4! zOC0C^bOR$C-KqF@`x?$;wNa!Y_v!q~09Mo*blS`ltS+4X?Il%#p{T|5#7d^p?BTG& z9OMxZNt?9cS&$Ly<)xy_GOjJU*{$X>IPdwTYf4A_rp*reOuiQF z(jNm(JZ#^W%{jl0gVdA==SJ<*N@){NWg^ulB(k{)(JHyuc*53;=N~XnlTyRegKLl( z^O*-9Rw=k$Qn2N^ksaFzTy*{dY7qyh1O8i6!}|B4=s&qevH*70{_{X}0l)R2L;wXZ zG`}Jmd3Z`sDL47c?A^y%khau}6sU3nXtiiKup+!>MZcF+5(aSdxIg5$ZEK+yFmjIL zAV2*T%2s|KLfqFf!@w`oTq z;6G_etAAp4dP9+Ls54bswu7U?m1D3orzGN)Q#nU&W{Q3;afVo2(eF^FU30q_L>um06f2bj19i9c->sa@NL zECHtwz{X&c(=hb1m`Vk{#9_PNFP}VlpBrJ;T+Xl7lC*@oiM!SxgT;0R@8iRFSaPnH zmdQx{Y`seRW@g=D`Jt}jBjdVfnb<09xttnzMq!nIr0;%M|1pQRwM+2^)M(o9zv`j? zti%43K>W2@`CowmOo;%5^S|{Y5an=gu{`82ihwwP0$W+glYQ2vPEKkO4t4-DEptY8 zMb>x`LcUB=BE07~x44G_shimBW`>eUlV@y?0u}yx!Q7FE+9N8OlqM0CX}z7alHP{a zfg+Q6AsK;^>e4)l{5S!bETJ!UAM_07%0W?&bonM|PnIp<`h(eU%2e*4*rFVdOLmZ{iNXV`{(QI~_)$xy7qM^feJ0ar|n zh{MrvdpoY!!>WBpih~rtN{EtSkzl=Laa7=ty>LwJ2nJzO1}q(mzGn7FsJ?8NdNILi zOSVnp>ax`pN5ZBcKPpaoYM51>Y@A**owgZmql#!FJ6pAkfv4J6wN&xkAS-Ov7od!( zL@ynsrulXJnDOEyPF%;()Z{|%PvP^uh^|KVfdrlq!rwvZ5O@Q=9eTe7i^p%_Uzu^R z-&`>YX=478MOgGY>>|80-}|Vnr*N;MC+2ctB$fPOtkgUbseAK496Zev)m!3D65Z;# z#b7j&91EWxxcZ?w9=WT!80lwBAipUj;H#SGgPhg0eHJ;g5& zUwH(`-<0*AV&=^Mu_XKd7TU-q$k+f_Ct^o>U^sT5yS+KQYIsGjx#}xzr=t+an-j5d zu!xe7y1~QD0$*g(4tpL5>_ZQ zCmz6zWxTIwep!%A%h))ya7SHeRw@>zL1POjugH@x{e)({P-ZS`sw-wOeec*O_FVuz5{XcOY;ou|juE4KCqCYZp# z_BSW~$LQ~WU&H^Z-~S7Xz$3nTS{NC@vwifs_=&0IW(gaOfy$CYLz04G?8*}sGr#4l zu?KyeZ6FPJT8A^Z^rWXBXu6mX4X#hp8kY7a+gxi!0ckvkJQ>a1NJH;j&nP{(NfU_d zHk0PqElCw^BU4Vezo1r|Lv*L4b<+I|4pLOM_UO~U*sAj|?VTKH$f2Pljj0PLf`+3~2OAG~+e z$wL!>$tITj*f{!EE32@-t}+J5H9@doK>!>r2+Qo6B@N1qRL{%|s>*?h1!j^I{4pqf z(heZw#STm#C#0$6435D-(_UZ*PA5vWk^V}?PF6S$mE_`pY~&((A0CGxx0&_rz|0beK*Ucnsd{A~F4x!=)?O8kw8=-NB_fHR zHp~dJOx~WGn_c6u^JvIjL%*$&=uwF45i9tbmCQYhk&TZ}HXRtFwM^$YtaPUOlaWt) z>b{T_m-PVXNiqKeYizM5cw#IpiGt{JrQgLbpBfGd4*}j63O6EIj6hGTHi@;fm7~Y- zUA~k-0+&m;s?msB6i*Qi8-*^dN9^8_r)TWmo;~4!Y`_x%6aD8*9I|O-SS~GZf2cog7ouB{v7ZU&VFns@~ z{v~gGtPN^C4DuJcn#H26%qbis7OX7S&QXm_aPTP`1rx^IS>#L<94hE(f8O%sUCfNc z4$BDTQEm1~qq}v~2uWV3{OjmJ7 zd0{SLgsT}U`Pbr<7&EGl;UuAiWzPa0dFNelvoiPMciEf))s65UzPYp^80OGYS~GvT^Mt-a_M zRJ4b(xJY1>FO2Q!4I*`=?i|%We_L7}ysVaQgE+oe8z3G?v6xntlV^>R^aE{C>89#ZNgV`~#@4k(|56`{j!t0;*9t9QBt>9wAwt1HRM(0*aZ zuzYj;1<^!!lJ>vh|J#J&Pi|a)8F&1%00C_On0-cA0Nek?59DIPvw|s2Wagt5#9iv3 zXeCK3krfGrFb-K(n1~P+M9H538!*jP0{}UDBd>vDVT9?iVPXBG42tk+CZM_bHW-q` z2AYiFXp=@5xx3;p4lV)C*^98WOEFxcn6hSpGmMGTFP}u96Gjuo8J2i%(<7RZ2Snsp*<{9t6E*FwuQv=AxwnmXn3!ixC0$eEz9&RhxQ-P7|crdOnlDw6@_ z;1TT*FBG^jO0e2sX?|#w8{TA=`_iCoGt5iepd0>Cn$!2=q#`khvC@bt6@B?2;!H+; zqeq!Paxtw+$NIpQbN(JzXAzksM^AXN$D>kV6#jdl{Bp!yQ-pSP*tr&&J}Qpv4X+l8 z3pl8=<7iC5kNS#9+bT*Nr3D>|v3BzxaB9toRH;u*(|Y^2sooS3SLU()oj_Ey9UcL~ z&>2o)&b>8UiI1#Q?MMkFL?zxI7mb&yh-*?}0_WRvwZF8RO?4X&TjAZeU2E;=E%nFR ztGum-w!NHJ-lIMwqUIZalN5i7eX;`l;r^Kva)~ky`+@+4A~zU@pwineuY>Glf%ivs z;LE5UTZOplEwk7l2zU|5JR)F>tK`qn;ecom^z8{v&riywvlAm|l#W=~uiWQ5@4fOj zr*62M2{~5=v)k;()pC7GaL3O>jwe=B;8eM`oCaE#HwEyRV%Iu4>;S?li`U{pE%K*31jea7~9>48*IIswYhT=IX0`-@8oz1Xhrm|ogK7yt?6(ilA z)u&p|+_R6x8e%vLhS-7J)m!Z;IDU;43*A}NfZ_PFrZUbpHhC>|1a9H4<4y#?evQ}&LgJr;StR^^c@vIq# zpTQ|TfHUqI9y%LXDmnA1A)KNwJ}FToES-}6LTrH}UDl9<&Q^p6pDfc;IJHtf&%`dJ zv+_I0mW~hcS2HfIF_~UAm!VLadR(@k?L5_4tkFICP<;hwIJMtWI_1^4{u#GTSMMY^ z|3;5v;UEKfW!F_n7;QfvhuvFB8b{RW@jh5R@O1S8#BR2<_nR#FQ_z(KVBGW1ED=*~ zkKO@rVb#EJ;=bvd@af^wUq9y3Q_8fU#D>gVXX5$^O3y+C8zg+{M_?lg!VkJ$7sc|J z#04O%$W3v=3h{<{xU-J8jBOe6czXI|q}br(O=%m*DG<6-SguQ<_CrWVQ}sVUH|$r8 znv8%Uvb~%tZnJWsZ!C&XhzAzQ)fsZ^I21zhhbgE}%c1#ifHY{Dv&}y{q1)Nf1K7%8 z(A1hfJ%%oHgc9Ju#(Qx)7J6$gHtYUtqTe z;;<;}wBSK*idhamN0s#oX`Yx^ayxCy$RLUz*DRU{1$8dkXZcR4@7Pq`8Xh?!MDChz zgYB#$jI<)idofVPGM9FnFxo9Cxzp|Q4R!vq{a7R5{~8$bn?wIo?1vMuR{5WYE~hTj zKt=_beMG(D$FYxa){ch9SGM)h1TyGln-u1-?>WgB2zOX#rxGCX7m;!V%P<)8?TM4A z$^gKmB;mY_P5;~vja-*R;zbaNG<9+m7W=gYM*J-A*{>QAdk#~8NqUn2OyvD5-K~mv z#!DYi^D|}HUE~k;7HS|G;TWi2&+)8F2@>YTtccNoKar1Qx@QaH^3i8HiO!eh?f z!+3g=vHPkh&cHc>5YZ^Zyt2O(VI3`h*nA(>M`5gKQ|rw@_WCt^P_Sp+Y#VxtOfBYW zpwo5AiZIP37e%wgEm`?Xo1Hs7i>A1(>PaoKEnX0EinaC3klsqg!cC7ubzKvlvPJ7c zDd$?dQYE!zk6f|G9wV{lxDsBWZFTa#i|S7022c-NiYT6|&+Z^_*Qf||`m$d3I0 zfOV={^{!v#X~ZY9;Z180e=~UOL(>rEax~CaNxb5=J#uhplYc%90miu*#c-aWO-lR3 z&g3me>hWod?Zlo+aDu(Fonawq7-g{QP@`q(=#_DTFwZ#`_lm}$-=&2?obOr-YA_bq zCiH-FaL3ssb)x3_Nr*Sk3hbNpi684{6wS0Fa`3A7{&N{kZFg4pseRS&Q0Ugcv;@-6 z{9l*aUuRiv4 zX@<9K8jG#q1*evx*9R!ICPa^XIa!pYyM2`Dn1ommL^)9iMxf ztAITV+LAAr*!!bpwpvYmMDQa*zES`__t55o(Z*&17br${(mBV>&z?7$gLl%lW#oD; zuXn+B{tx~S-Vcx+h0^oi6z89koLT-$9iRsI-2^OF6FbrZ!>N;gGvt%+_6VGQFQtmx z$aZr=M7FCnkq8CrwhJQns`P6%3KR3)&>!eS}M=NLXoG2 zW^GLvzov>wevR#q@N*5!ngKKC1?@$YMMlw|CabicZ?Gd+jP3x|Y#3jFm?shM;K!QI z{$hxFe{y+nhxB=b8TIfdWg4(ilg(uRs3&L@S8{!d7@IS}9_=-zSY(9Fz`fn&L)nmJ z##Dhext&;o=%PpQ{R>Dt8(UC%*bVVO11LtT`uiO5mP%B@j4PEc!36dV5qs|v{XCPA zDP}|JGTiR1TeSn7k>L5Cn^c0`f@cwIR{EW00+6iP&@FX=?AQ1$MxogvT+1%`5SZ0) zPmF7cdt-IJ?DIE+q69x592gk3C(pSk-+4>*7bUeQVeZ@N51_Jd-%ZF0@!x+UUEcV< z;RqB&XM+DGM1M-9{maw-pZycCVI=172WLcwAKp($x11bVvpL6)3(%%JW*f@-XH-d1 z6cExN`9RPKG?V9ol&`NoFbKSKv@L2qlauJ+0T(;+UQ+nvpa@R(8+0N0iP$-Z!^abm zgFvMmGP(9j{eDw|M{VSnW+D+XdB4tOn4GgHnag5XT~+39we*G#(TEG`8VV3oEDKQ7 zjA9ZIvzKKIvy=Phj>Jn09PTySaKx;f%kLnkEIL6UxL220;8?jPn4+VSs;9BCk5Xzq z51E(NU38}+KWz5QnU{RCl0e*}S?~=j9iXD6zdq1bz7@e|li+a39>QI+>k3q|V9J<} zohINgYNOdGt2ky9lbpm~`3xd*H-6KYZX`wJwf5zo|L(Kq`U=8h={o$IbN*xO?Y~sS zYDzK<0{~{mUptww_=iL8itY~S=3i}j>a&YxXJK(h&QJ~?JL2iDUd0ld_{KUN)4Nzg?#xHdWdV)X_anhT6|K$$x>pOw> zC#7_q`QMz+A0uS|-^hREA%MBE^M4g25#UIi3MD0G@$Dav$>ND!Rck4>B0*eXQpwbq z;*4-cFM-T+gvsw1kZEZ(z?bcQyT{$GWaM>++^RdXH&Ec!s?Bqs0}?A>j;Z^&ts(Ng zu>*M>^G`!a&{xYno(7I-b8g#$@zZAaoF_D&@UtxpiXPmuw>*8bwt1+%nu1&dK3^;S8Xd(8Mmck`V5;5BO@cT1l0WRy4N z7QeJLw8l_~$CUFDAIU51VmTOtYVuE_J^CZsY32&Ne$I7t?!+;Fw!(~diJj5n{;bqz z?0H3a&uL5l=nc30#vrRl>bW`=IdWP4BRmT39N9TX+hJ|lwr)}tx2@_dur3~4U)e41 zpBlghtna6wc2-0{O||2na<;9afDza4fJj~LU*%0>L`~@+^DHGV+6r6O`(Lp!W{sA_ z{hIl(%Er0{mcJ<=V0k;kUA)qjrMqAX{aTW}RK@PvJfud59F&Q+w%tJI?TwvLdr$5? zfZ!9^%ll1Q{4pK|FpvIcTF5DL*?=;^p8bOM{uXk%$A<$-MgCz6LcoHhfoc-ZT1^cB zihdkKsz~H_EoL3KoigfY*F1^|xKTqQu{-S2!-NUC!3N5+!t&Eqfwy}Kl}7UtMIneC zVfMfWfjdDxv(kms6xgv%X>p)+G+b8Zou~+nh4`0L0ehdA|DY`{fr9HTJs_G-vq{|j zu4yHu7tJ-&^5HNjJ7M3|%`$f89>w#?9Zb+P6vp2nggsf^1sQ77Z2;wd5%Z3Kh2dxC z1aT{qaQ`BW!O-VI1&fCds3H{F^#PUQr!=zraV}HLSvLKd#ZkpzWzKLG+Gt2@>^rsANIzi1bN z&Viy`S-~6^4N{$t7i@{p2y@bk@YS(sN6fs`A`&#ib%JZ;b!J26# zSs~G~MNJH$=p$qvg<8aBL*rf$zME$31cUFR*Ln`admh0fK>L4JoU{IIo%tuY5fi|x z{a=Y1CsPCH?_x()KWsitcm){pmFH{`ZhkcN%N0j)BC}`7$c+rf8>Aaa=BBwpvDvNm zzluK?nvqLtlW^FF6Hg5T)o|G>Tfl{f0e>M^zIY#OUkcllg0d6eC5;9{r_o8GR>*2Q z9@XDH;3&GJ+6|*?mZL@70`kJ;q~eYmM28wVO{t+X@?Y3W{59RxU8S*<_()b`dr9%c zMgLMN@bYQ8nuqm&6Xb7m&_DUQoQ(fomhhK1!X_tVwkMj^x7uft>JeRCEYjE95Lja-&~JNKk}J1TxVM>0pva^PK&T zN=B=~G)!TsAK&JAf@@A!)s`cG`uTx^BDAIdEecW}uMF z4JV|HhHp%@SlYscTL+WaVP%`DKJ0;)fSX@>RmaiYNl!7>9qBBUAbFo+yFxi(dE%L-f$AX(T1{ zoy8WvlMOpqniclu;9iyHLjp}aga||~*%4OK}xSivsu>JN<<^fi7xJo4Gr_?M2BeS4-|JI9 zcq>djX;8MfDjlYMBNU7+5jJ-NzZDej=W6K9Img5MEqs(hGYp#qdtdzGL1A_)eGEBJ z)R>={+~&x{Dy=J#L)*&o@O)vc#kSRArzJQ=HxauSvs-!B>8<&w?aihw_{|0VZ|B`V zsWcXVq2#|Bi;7Ic%6}-m->_tM5RRluzl(VSmZOESFhs5}2?M9EFrEbT6e*RKwc82# z>;|~xE4}OHZL;8_oOZC`0}(}`(HBiP0?CXLeM4D;-7oBRWXi7+4q92=;hxHhWP~9b(Oln z$5nXNb47$B5xCkXN*+gKCRQS=GM`BXhqO#o&8oJS6`VxBaNI>PMt{qBFxhGf`ue;C zc1M#>w2<$EU~Zwty>wC*UB+1JT&pDnCu*&g=uMey7ym3>-rCdc>3-LEj;T7l)OGXZ7JhQ8l4&p*Yi{<2;EXGnEbW&YYU zvoQl8XR6#H?eiu|o5pYWW&+y}@6+X!d1aJj3&G;Wp=Bt55B9p#5t=1@rcDW2DIF(C!KUre?(WkVct?GQP8kG{M~6)s!f)?A3OMr z_G*NALA7nbtQKR^!=OdrK~jbTU9Mj%$ytEQOG*VH=D&89qEs8XukHCxI*aJ|c_uVu zSYZy$J>$=6B1^_;!8H%%6E>M!iv75ja+EA7g8Bk0zkyX=dZ$4jB279Q#s*Y!qr*Bu z+FB%MEEAj-uW{_iG{qZ*`gMpAMtwQjgYb~FCBHUCv%U@5&c3#%GS326vn`V0Y1I{O zKMhj>zQhEJ{$yZQ)zA8JLDtd<+KOphz4=L0n!=tzPiWk8W3n%e;f7HQjA*qIy)^(W zfE49hdOvQr8)4QM{n(0wixe2&70#RYua4Vj`HLIE?@h^AK&!6p?Aa`lAkyC~wtfk? zbB@8wKCpjTXG$Tl8%vXFpX=H5Cb6o~3k`ytqI(e3YP97qS027w6>8i^83u@yESBVm zmRT}7ug-Pq4yvZ#sILabesn@CX`tz+>g+l=^p#}N*4%o`W9bhE-Zd}gTpB|6VM&mH zVUs`3FK90+GeNLtIvKU%zRzXCZ8P$tTUFWO(5J{Qb#l3}=1{?g23qdbmmm&1;@yp9 z+J;CtO}ZTks9qCMR(o;ENU1Z+XM5}BIOv!pX>ol1kmPRH$-oGB!sA`8Jv(~9u&9*E z`b`4=DXzl`a8dqe0-GiZ0enONmz~eSIFizWVoP@&9Uk+qx$nrRqpw(42h=+7|A(=6 zfUa~~n?{pP$F^;=W81cE8y&l2+qR94laAf7ZFZd8wa+>C{%7y6@Ar4c2wsepnVE_8 zR@GD0wWtWKPv0`G5a#8t``%Ne1=RGqDYX~6$Og6bRX?&<-PZgLMhm3L4Ahk}2U^pc z3~`%=&7Rr9pA3s>Sr}Aw0agLF|5>1v{A)9=8}Z1-faX{f`{<$Ik=LzgAMUr$bomOk z;k3Ny(Rtf8InoJ{DVhguS$^DWdgM5CH{9U|W&Y_n3d$1R&&6H>{S!nXP8K&#_e86< zAMz@-&rO2bBX7s9C7RD|vjs9!M9hNUolK%@`wAH91}T03+mI_|3lx{y+u+MSRIA#bjm8DLXVP!g4+-qg3%W9qU@?~NG@|Iq%3eB!|Q z_^}A?KEpTIPI?Giws{5JOx!3O{AgYYWdZ4fc^?#t$Yg9s_1dR*HD()R{P>fd`qk<> zKu_+|d!g>t>Ur7ywWsO8t#VLhNRYa68aoUK#3Ze0|E@s0^d;Nk95p@ebJ5q< zlbDpN@l?s|+aj4NXA*jR)(Gx_+!uGIQ~S zLz^-+Tm>2X4 zQzxr?N8ow>(#oul@lBLHGBDx{Yof;f(v`C3=9Tng1JJ`j5>xAlmo;ZZpots0#2nVqsF5{=&?r!ob|9 zJpJVhlLElEH~>0bJ)Ht09g7O3$nh_W;yqT#|LMQZ!u+Se4KtuU|GgIc%WRzSU$yvt zbP+id9-aWn%HI1bN~_n#S&tuSkaiT=K1m4INOD5qEP6;Pawy3gSKfK6vWftbCm~UQ zx{VGhsl>tlz^5Xw(&r|Xg|MF&l*@%&Kk8TeN4O!Oo#7)6<6@7@<7kf=iPKIU>(xn? zQr!5med799*pPS_BuzyJAMmiuQZDoCkp|`nrRd0)xFNo1BPcL4RSdCzv58(Bquas# z%y*B_4(|LbxjtNk4Oq6a_SsuC)x1yRL?n(r>rJeFRC3EpxzV)yQn&t`{IteZ7#NK| zo!9L#Dkl8wGartbXaC0vkouAO@wze%mN-5p236CVLU>*qmaRhBNNtgv@3EJ*Q;cHP zw$hQ;JP$_l`?&YTAO&)k)uLSJ=HVg?^r@#08O| z)mZIQCYlYBE_98rUdQI{*R)g}lTp^dW2upyT%bh=kyH*W`|vB*h*u`*^i z1uzyqUot3GBH^eCVac0+mp4p%$q{A?P{SEQJinXTaA5Z2PJ4~ztwV%}Ul4LXO?1|) zPQT8qZ@1G>dKokQs@F77wu{8Y7mj@I<-!Vg_N)=k=zX;SRmYcQ8TA0S3uU(S3$bR& z*xb~*SpJ#0D;zjz6+4!sM2nA@ESBaGw}ye_TrE&daL094H7!+ZcNjugK@7x&Al?Ze zul*&@D!?^nC6Jy@Yvew}eK44MrHPF@cWa&s7YBOd(*n!hr9T-6;AmOKK?gb!S$} zBoP4~qaa{$Fz}nqTnc-3!p_>6{PTC4DDG{`La5Lh)cE!de4J{mS%2Y|ETRGSLh=+<;TA8pZ#li()b)5c^Ul48w`=QU%DWsi;*=fVoLs1GU+hBohf%mWv3%7c$AbZkJJ)C)Vy!4e@5YvP=dt8frBO)zWcC7bCt|MisDj zHjq;dQ7PGhfTcMflBN7|$&bDR;%oM;`KW=c{{V)ECB2-W^D2haYELstN7ha|el(4s8|wJRmocpUjV zZ8i-WO%i4R?1%Fv*DQX~fEnDU_nXN|^KH;~g8&dJb`(d-fBU^#MuC*!fL8vhf`RdKvU#g$r+4 ziAxTuRjiNC#ahwrEJ{amHCfBwNPoUsEa@xJbhWl^!!KN_secRte5SF-8Pb0lkw#IEYkEC>!tHdan9gPOgiIqnS{s&1 z{iL$07$y60oiwv(h~s?!BTi)?zGF3Eb_d_?RoQ!%&3gvgGF7JbH$CyEsu$LOdhw`8 zR0B4a^}i|&wWLki<-`=w_#QSzxAGEIjJ|C@UE3pLeiEdDQIsLbba@w%3+X42dVE31 z2Nwh3rw(&((I5R&~@j+OvW8iGfc;_xVG{dmzFG`Rh zJXa^KmKae1>xgudV#E-3w9faq4XcsSo*vkK8E3#?2Jyk$J)v!`F=L(-nb=33@F(rF zAD;@k+?5W+`uUUx=L(B~_xS>XxHR3JDKhnwKO}MfY#^j)y-N|rui3)acyCIM ze!`$j?l5$^(A;NPr)o#`%SejOI7s(LGc@=Nd~h}$ycxl=Mp-2;tsV(Gde=1<8q0Z{ zr7r7k&#i%|VTxyKhQOA4@8Zc8UGIViFLDm(>_%^$G z41}Dh!rM~u2O1jURHB2g0KS1L)8?A)l)}=yjYHv+TzN{n#3C^XiuYg^dB& zkW-!FvEH}+X7npuav~?1nMLNwJa0Lnzs5PRaBS^a>a^kpZDoB#aVj`2fVDD*kj@c_ z^z{lQq@>+dkmV3=r8@F2wD*Z*(>j`;rBY82hxa-iOT|pcY)*a45{DV9ag-6)%ope( z6FTck5t!{NAM+SJN%CjIZZ0kede_40B@VoaLnF0e?i&OeA+?bSjBTTze8svHQFTMd z=R#spM9VMNrvehhp=Iu7r`{Y3x7+xqHMT3e+)AK)-4^LXx7(%QBZT-X5jBON_SW?= zwq>0%7>beEQwUY`8gq8z6EfYJ^v()sM80-O$xr51ajX*O+>Z8DzNi{@YFR@fKjaKQ zyx~82{8jhqdnv;O^P8dkr??EqKlf5V(Ja7?<6lLyoT&r$*{dBs4K33}x~5UN*9wD*ezn zaqVlX2aee*K(N%Vaao-8x%~oMezC7?4zHRQx?Uj!9f` zm2rG5O0OmLGa|{3h|Uv-DSO{dCCR{au)c?ONe}FpO&~hzS2tJK&A`l9MfH^6?~k2q z>|9`iwu{y!{_9_L(#hLAe+qlIpAn&Mmq{X4^{hx}oI7JWLa?iY0<3Dp#_82snMPT=vH(->N)zH7*h^j~(D$zO>nQyDQ6L6h(Kvs{3 z;DZ;*U^K&kK2s#ozxWkP16H@A0da*VT}y(|ddXBJ^!^Eb9hpdMlY*wl18Rv4idA44 zQj&%YzY=UAFruwp*vGCAM&24_kJqqpu2i&&h@Hyu-dag*O5e>+Qf0(knz>s>fzJ76 z|8{^SQ%YMiHirz!p35-_ID5jx)F$oNdjo>dp=~%DA*1}){6Gh7yYN0s=A#xMs2FY9 z=)~^6oX#JiBR!OgC(oo@P#WyGaiQ(|iu?H)!^VV(b6i_zVvCwBZTd}fog-<=^_cXK zO~-dPjy_S2p$Cfw-8YY4HI|+ST^Y|8Ja?NhngdnX%9CoT(_65>C;^IH1Je2{74wBxB;9>2ig^DVJo4`aKM{O23tlca$`+Ro2!H-O3Q@$T~uQc~9) z@tfKGr=S(nKi>z&N!boDKm`3OW(4%$`1Vz0K?Fc*20I|RBpC#Z5Az#CKqTZPFn}O3 z5qwo}5T`jI_ggmn=c&y1D=MX;rJ^KvzuRYTW(URVCF9m z5pSX#%j5G>Nrs_Rgr^=L#DauxeqdZ9*YIB)M5lf{elL3*UiZ$QimNpMEQTUEdkj;! z+!INg5qn{A-?@ca3(TOhlWCv>rsp6r@AAAEO)@h%4u+?Vn6g>F@U|iM* zk1-;k%$c-s^N%~nO!>8U` zTVclas$i3*<|yPR&mbGT>?bWoUMkM`rpVJV8~RFNoRBgF-UKgi?;$3$V9{Is;^>pL zuLK@#O9z5QMPbmy#kx}+o9FOTF4-ng>_kc1$JMrxDQaOoQU%lTW1HZ)p~y7%4`~eB zxZE;U<*4OVmfK)OZ>H)tQF}}HpJp6v5Is3YO7q9|R!8U_Suq{)`t34)_zoKWitsok zNzH2!iI00+?0B?`DpT8#h+G0cm2)4 z{BMx!f3qNA0?^ZcgPIh$qCpuUP65`;u@E4Hd)&8;D~7+`&%co{duG*H--2X@L*ghK zl!x<6<0l5QK0TnUBwe(~+m@FH_7H2zL787%q%k`yFoElUo@o&h*8I2+qc+|{@FsIE zu1Iw&&t9*5al}wL9orH${S`Y(%gQ3*`>XAnK`57s-I90-9&&=G{4d0@w@V~4W&hZL ztQ596hFus;@9xST3fB1Cih;1COfy8}Z;$0(eAvTlFGV1@;G3ZB386SpH!?65Sp-t} z>Z`yn-%d{ZG6U`fO?>ccEl1klZ#Q0Es@$Gv`S$UnQVmgl(_eoI&9O24-2_BLMWWsq zz%zYUvInLH*kme;4ePyje>8*4m*Y|uQj&=8K|ln7MJPi<3<7P#^JIRCh{brf=~&ad zxB$((XHp-0&tFE^+ZgFf>3u=0*GTVH6owFX=Eha6$3v;Zp&x*gz|#vxHK0#pDDsEx zK(83GF711nSt}77UQdnQgkoiAvFXGoUoOr#$KW0BWDPrDfX_||KK0OG_hFbLsL$d5 zd`W)1(V_TBkvIAnxD2Yo9*4HtC|tlZ=W}+K29japVY3aN5WxiegorwK;%CKBCPcf* zA08ugM4OcG;^SV_3d;hKlvGZ)P!VIP>fW6o0px=Nw&2HwVeFO{PF#4Tp>aw^5Jc(& zbsI6^I9gV=w7g-KjP4oVnI^nFrwi>djtxi>P>U_o#3#M>I>pQv>3*WSn1OA;!^`X*u&nVVjH<{c#4w`>c25} zB)kV+fIdkA@swS|NRC;;>7rbAXsjuuLAI7{aA-1GQ65;8R|Pgy5-vHGdu=R;0D3{w zrmwOZU#l)s!W*S6JkI4Mtq6y^(6v#IR}ij0gIJl}4oaG#VAhk|!&oRIjzrrMfO3?o-zvnlx+36zX25M~Az zBun+gIz^N}=4<*y@s7NRoy5y%becq&H$6zvNVziaRCLKp%I%UBF1G9M)>lKprBr%= zu5RF^t-PjZ2s-9KKPKm8+^_a?+y=VzXw_l9M1yv>(>po4R{8~Vu|N#d2fu(8GkB28 zt1ow5q4E9%GF=C9#i)e3@hNP4s@^IJP!7?gkIw)21{bz@c=+`43SKm-AN!jL@~5Ea zKeewD0#JSoFv2t5vW(~y#*H%9yhL;-Z!LzQf@@tpW`ZI80_0Gbz@F?-UV{>Ih`QJ6 zjWRepDKJ(WzRC=TNH0E>1PRWbbfu}-XhBWP4oT~+hhMbvaS*-^;fj1 z&;!8Nf?vE;^?f}ATOH-%$oO5;&4K% z5a2E(y;i6z;m5B}bbh3tT`DXbX0M#=kDfFjihBuNPB9tZRADHj(4FTnci&?j4x^Hp z0VrpU$dyEh?%Tl}=l?3Qixy?87l(9`>t8@atpdJHGZgQk3A{Nyup+#`u@WTHE#BDH z=(*40^j`X9%lrPz4<-?nOSfT>f|4qJtlI9*!m3#9w>sRNjytnnj1_ZmbQv$PCk_P) zwkdy)p(V3O86NNrJ!f8gr{s?tHQu^ksx!aol|O}qSpHF6uanSgTfl%2a_IwwzbX`5 z7brnGhUCD%Grhhr%L@cd9?{4c7Av&T{mf&lwgPelV*37M24+^x(`>Nf4iM{yPTIY4 z2Rq!iJaxlm=e(Lg(WHFM458&2e6c@APj36Q#ABQBy?L9P*@%70=Vi=!brIaReCTN} zN8^_h?i*(?wC}V1I`dfjOa1G;8a^vsYSY&{v*flGpQjl;o+-l>DX!;QnbqC>ewPoT z4g82hCf>t6(^N5Et>@kv?^buypxQN-C==eu4{s&VqRh$u93K-=@v$fbMRn7lZ=GYk zH3M8%{;jp+dmPu)>|J&}E_8;i6GD>5lA##4bTZimXYnvI*T{1GTU~ojNfipWPfGiKLXET-_s1N<<=p;_xd>zR^933X~UZPrHB^7N4^U zE+4BZu`vcI-|LDO7AGIhlkUyiYit~G@pQgf+(s$qG0I`SdurHTPYu7>9d9?S$09Z0 zgSURHlK}cBxq|H7Z$cCRl}Z0+J_#Avi?OeO}hU#)N=gP~fi*>i_Q|t)hvUi?xB{zwc3Ub~JG|GAE#y zwR5yFu>SW+wSWJvzYC)@2(^X|8#rsAl3Wd8;tcX5$iL!1n;TyFKkDp7muF9;j7k#zCa z)*?h#%UvFW3TSQlqS2@Lfov`Qx7dkwyXRk!I<=OMsT~6RA$WqREd}?q^W}bmV{_q$uOBC-L5<{EGi(;7V&1AaPdKAm`%9IRU%3#;zGCU&|%t3 z94*f5-vbH}#Lrfm)Hr99z0NY$;<<*{tDH_KoBs*GBk*D;(Hx%a(i-B%NQ^-bTPGq! zw_cu&>}>=&5Haakiwtgrro zLw3DCafxwry=CpE?$9WBgf56HeEg&eig&smwDZy60u0NBJXzY>a5BaIW|2d7Jk5dW zlS26wY*$Sd9(CW3uBhA+$0uG44mP-&LjP#Yoo#pS`{^EKJ<)}RCTX0uw}p?bbPluo zgaR}#X)@!bqRW21p+`*_yZ<_&{J2^WhYC6WFJXdqgks!&3$h5YF-=F*uW1f=IrJ8;0@eZA%AS#$jc=|~%dYQ}GbKd=Y{8oV z3jd8Jq7ZD8`%<<|BYGvht_BLYfZ4Qb~gEIT3Z`9n+Tg2*%_Ps z?SY4xkqr=4#K6L+HVuk21T`dD%^Nefnqp z$D1M%6^{5lc9^?+sIPvgtuYVt149@*A8u?w@s=7Av8~7mal`}&WHf-e3j^%}@qHbf{0|=%hI_0L4CUI$w}C{$+VT6jx|01=V)f{+ zhLV_Sbe^C=#P&Ev;%P>@2?owppTRy;R_X^_?ryUMAb_BI#f<8UV1LC|T9&Vny`vV6 z2D$eUXS_&yO4J9Pg;a3#+*457QsQRAB1Oy~)=LoN6gSYALERy-G%XltTivUTtTu=~ z!I}#dk_pn%w_g?9H@+2~qjJE1N6tbZe0Q26V^ zFWqIdG$npPNVQ8wx-MwaZZ*nhJbRx>dF|~I(mf*m=EwGmpyK*rhUic?B^2!ElxQ7m zjWH~-3_uoE$1W<3k?9{G9M+mGun(3%SGD?3AHkZa#Z59&+m`eByGvr6N}41@+xsKC zbdIFcsc8_or87)uT_{<^VAH5bX}r*(8M}Bri!fue7YJ5;29{#rx}1!Qm9~;1hk?oa zsWNekZ}BODa)u{tKP2jWVLj4>CB6Ki+%KM#d7+VgeIZ6WaJtA&aVOuQgJ%WSXQ|(w zaOZOlFK;(*`M%6Z{6;|oa4r2moAB@E7yWeT|rNYiw!B zdilOe*%P1H0=4u>$Sp9S6a*}&H;M=tklus(-fQ*jhb^%^RaA(tvTy`m{+?z}JZBaV zr4hY1^}v+pXoknQ8^g@p7gcP+q%NGD%ShE@;Zy5`ERhCASO3YvRIuhNn}_dUlq!Nz zw}X@u9r3e#4=qv7Yo*_+I>%s>qvSzmP*#HXerCf)!38*PZ>Qw6!E*71u_Ul4aLee4 zaNzdha?=S*tIDC1E@OFaBukJWN7UsP6Pm=+i7mIx(yUCy?H4Z`g=E(+*6vg$7I1|f z`hDlBDQmB^C?js=qTx836v?ZP%^bI3RhbiD@LwAS+0`aZ6EswNwliHiU3#mjkIcoU zquUFgv_=zp3Pyi)%F7Pg(gMh0JOgH;*EX_M-V`|!LzNKj!pE(FZbc<||L>~;^`>+D zAvqx@X8wRaE()5ue6oBaFSa=20BaXI~tIq7v{B&HY$TUEda|n0$b2KR`N)>0ikgnyJ**jEk+;&IqhD^=82vb{L z1=>3M_^QyE+oW{|7QB@+kybL!wJ+ta#SpDy47<@q&K_9(jTamaCss&iN^!FvJQk`Z zCX`zf8V(=_x1yIoizE6aIZcRZId&TZVbg&$HRsbKMF%Y{QA%a6<#RQY)+#*bZ`gp7 zkDw1Uuwa-x^9yf&e0_huN^cFXFQNR9y=N)9?^5>JT;AHfgkiNgbi?tw%*6V7qLdSQ zR!)3eqbukjW}>(4jDWEl>D9{|>kE7a4&T0yvq$`E0M|8NK^+Bb1*=A=;q-!}sP?Di zMJix?0r&2I%KFWo_NPD?BLmyt1*1PT;2aGKr*WBf!t4i87)^sixg9ix9w|}cp{WEGPH2fOHsipX zpIZY~fY>YqSHai&P?3WdY7)MC142c*A3z^W|6D6^OQ5ZP~iiYDgIo}W^ zO=6I&Oxl|y>7d>HECw> zv!dFfbNJOf4wX*jnjr5$(h*zNA<|>g)%)O^@#BNQ4rv-XsP`;nXgVl40p)%GNwJb# z5i}b=)>rN{Z$KcxCi$Av^`Swi^noh6dl{$1_mzp5Pc$GK$5GonMHErhJ&oGw4`_y# zvH@Ve7o+d)dGAME<8!Al8Dvl5=cJP^dhe4Jss_=pHv;2}cjBlWG9f59T!!|i6WWRIl5^wNciqF?YR#`S!jF;YVpRY9N z5lBoyn?lxx!boNzAE?M!@hk{pjQ$68ovm(+`|jiohSsP>N1{h1`mKxxk(ca@>dw5k zh>78u)T;aH^LN4MoE){XP_+!~uA_2F+m`b4CONBf<|miS8FVq>47)7#F8i?;SBAsv zrAb#Jg25Q0!Qo=;dx0&GbI~QR3#{}LxnP<6vB3apDf(>9MLir=%RxKMnZU-kHf_YY zQ0EJGVGky!yr<~ho?gVC*LjP+rnzFjJ~lgeN!ALA#rgM~+e#f{zSz@=*3mYv-%Mu8 z4gm5kU5mfgQVT_2LH88}_i1V_yJ&wa=cHc%1<(7jbD(I=fUeoCzRu~k@bUHv&SGx& z8|$Die+n_Oefc|Qp##9+u?b-Sslv{{9V9G{cqNJ&dz-!)NJ#7KTn7A}$Tmpi`~*tw zab7@-Sh4-|?U}H;g`fCRRUYe@OLlGNdBH{kNav zMvUmc5>qgp$C;$lA{CH%RhZc825a{U+%H4A?Z!GP*Q^B+L(0M zF9hOju9hPe-k#j%b?#N4=+PdbRCW1exb!G|Jwz8UA@R6P-491bv)=*2mC(pLOLv7f8YZWZXH5sGH47A!NIAg**TDJ!*IE&pjhrOtTl#3?Jj zx=ZNMr6Q`#r^JKfoP{mU`V@K_Gg4SDugyXwpY?EZ1+B24b>CAlJ&jbkOQ-|AEfoL;r)GWGA}D= zU=ETpH7iqiGrZlyWsCIzcc^MY_7v?Z%#rNn;U2z-z7q5|TlSw~->eLO*DLG%$2s$_ z)OENzh+Z#l#+lHQ4?S`q4M!OrD8f1uGEu_-us-|z(oaM#{K0(g`piLK-$U6#z;a&s zWI%brv3=6!UD8I-hvAnPY5kF5=~Whh13r^e^?5@maelFE`6>xE>n-8{;y|^_%h`ON zjqN-;mWsJ6t`qil=b@Jb^9)fS#a++PB;fW#|6C2+CN*@1DS@@Z zXd}-UJ~F4SkMo?J=j!1(#OP#7{g<5bkV!^ak`im5 zOoeHZ;yheKmP9#3H`rP@`omceas4JN2Y|MCYhlxzGR3Xss+vE^lHBa0$$*c4i!1*r%+-ly7riszJ-znCZQF-hPRH+DPJQNwcy0WGqU5 zXMLB{0@N&^_c+C@)h*lcK>otzxh334RlC5px9-o9z1G=*I*+Mw3$ftYZH8vSeA6pB z@X;^pX?+%0MZrVSH5~)*%!sU7`;<@neZ$VvEt=Aw>Y6lReK@7mwO`6}N?Q+Uy`P@Y zE-`rtpW%UtrZFd2qp)-FnAa!z`!Judh0t#>8h{VrpFKD-vHfF(j~lb?CqNK+_&P|F zAoAH2i#!QI(U>hB-MiG57pQ+pq@1zOefxV2f$Fom-(;BAAt>!>c{3T1_iceC1HW12 zFZQSgH3-^YL-91=Hp=P+&J_Zjf@AHL$&_32tF|PWAk%JV6DY5rG8*u-){vf0zIYmW zEoqOLN|`frJp_ZS07XIoV{r+NnH}ry`SB;%s981k2AR0gX5bGF?;zZun6=o>mpV8q z=A|@?^}yaPM)cNDo@1p0lZ+8g}9VxAXyl-et)^rXS3d!5A>ML5LfB0R+bvS%da_QlU* zV2h=w>o;;q@Ed(vCRXZbny!tS(@O71csBxJUVMsN=-?6TKs}F@Y(2g6Sb+r&3>ce* zQDETGURYUby>dV6)(*UpV>Q(wTybw-^ob?27t+v0JH#q$#m)W3U)j^4Gq!W0Leh&C{-IQ zRGTDuSkNlv%Hx?>&@KghuPh}*RWp}!;HWban@$hj>rubvu9>Nbuxof0{suE_)n%E}DDrSA-^2Rd| zkB21szTXU!87YZgDu7gU8Q&T=lDjiz8{6}VGIvMPFw31o5tn45bjP9cl`BbhClee` zN=^K${EYox!Z%>?G|$S!My#Zn2Baj(L2U1AKS$MPUdsxI0;WR+>&%q#^d&10!*56_ z=Gz1Vu1(fBtG3W;geqbu;;uZfp;b$iV{STyUzr4B8W%~w;#m-{(k#l36~~$f*7nDV z%NK}dU`m$@L}kAr{fKTj?HYG;6#&Ql)z2J@flu7o(*8(NC6=qt%ucfqEt8@X$?%R;~&vOw;OQKrG3@`ww+k z6jN1Yx1inuMaYR~ARr7+t~Xd&aY8R@UM@T4)Y_2(K}LILWyUuvuoB!L9`5> z@o#pa>mdx(ziUp34h&j3=~%f)U54yOge|TZoJkCa#H(}adm6o-_e@ef#1vxDlx*6^%;hF43Tp?xw9OE zjaKf{Kyh*M`SPTq(dGOI&;peG^rQdH1o>0aiizp(1|B-{y_Wq9FkLUy&ergQ7Q;(} zpF@OtLS2n?`FiS-#%o809N?Z_4CtL}13$}o!grC=sg#VEZCz5TM`4P}(QP9w8Y6;b za@XC0X0~{UHLWfS4;7uJw@P^%Yu7OP z>_#T$8Q4I>i4E;93}mDsx+i5N3XSsGm2}MeMo!TZX;bljwAb}+BSj4wn+uYq7lY0` z&{EfI2`Zsa;*KPl~i}kO2XqD`& zEsXz7JpOO&CCC3idkOGW|G%)8%uN5H~{uYw0F)N53$hCeHVr!E-nMUXOrrG+>TEOmv0ii&UwCVvk&#}W)+J5(~C|oGP zJbF>2=3?~8MxEEO^*(yZ-xoP0JH;O;bWf=oYF@=_kXwyeiQ&wTrpEc$zT@KCoo%gl@*eD(eVe*a zp98(*PHl*0G=G6NwwW%BdQy%Gnyd0pFe4 zsqW5?bEH39)2C!Z_tu)r%BLS71<(apnL67}4lW9%zR_`aS{%4H z(AGJc3`x8+r_8FPxH_xd)pDCt07+bW#xM`r0M&B>OZ?MMPt0%^b*U!daJ(L!R=FzV z);hH+r&|3I&BHj63Qc;Bk{B@E#0nSMQd_(sFzrxk2ij^OJhg2}?O+nHI>eMMPVHz3 z?Z7WfVO9*mQp?_uO{D_JmQ!A;oVSg4c_l?3*H5=E-go9Ytx#HwQC9YpbiJn9(2y4M z`EV|=)4>vpr;^&=A{fHQ2n{%@2M0_22TmHjiK_=tSa%G?&tTCTp2S_%T6JO@LuWS4USFP`s$@direqLFG3H zA`;ocVpb)asqOe{Is+f_z!TkgZ%6}Ss!f}4{Lt<`9T}eoVho`)Nb3N3&IF%h3|Kl7 z4tv5H?%?BefLF|X!j;)^NqVTHe=v;mx__v{aO2?g~TBXMrJzce$% zUw~M8)FKswrN1&W1Qczbr4r^_Emes@AmCb-0J!z21-pUTI~+RB=;pTRG)T#foBOun zI~;zXPixY5VxXEEU`b4vzLKwgOpi(M2!`^4WjDZm5LB1MeYugbH@u^Sl$V6xYH#oi zVN?n7J44xx_j#0=)PqZJ@Q`3siHkc!NvIOt6args=oCwpH$-U50Y}67Sdja;#`0C2 zfg<8mm$`UfM!C%OYY{2;ajDKnSItGUZdf&ARX2tVjT2jDzIpE3&=}Oh!j5X0ixu3U z)x)^vN~8&qrzdeZGcH99j^cPumyZ*Ml0r2Zq5NW63S~8c8=Eff4EJfIwln15Ok|5Q zvj^o&Vyi{c8O2r)w%vz?$rbYmylJ@s3&GHiDjMBnh}7M;QxD|bw`&C&OZ;vS)T?ku z?c1+OqxK%c2u42uweJ$i+zLmX^s^4HBJn4qKk&Ybw4uBQE;d8qD=IppJEJPK@1Q6Q z;0qZHbX3VUF3)oFNOvN1eL zXqR_J>amR$&=8pInESy2M!$y0Oto~Mk5|Sxl+^bL@ZUkVtzzsB=PM^!T4adQ1}jc z!}x%DCGzc7EERP6)fk9+0P79gj6y%6pQ-5fuwiuKw@~}`vDL{vA-}_4D8C2UF+SET z)x1J}po1s!Z3Dk1+=#tmUnstZ*)gm4lq4NGAh=Oa?Q+5JhD}jS?Gl3F51Az$Uh907 z^}yTgKLlJ4>+OFGa75ZPy8?gAcSPbF;G-tLCI<73q^BgmM*gbd0mnD!J?iv`8OS%R zmUwst{Z)p;pBUyHNl#673-L9=@zeJ{wnXH|FBgF0P0UyLuSy*Ln_F6=4ep7(1&?a` z8r&ft72FY{{}kv0{gcPY6` zafTVW3vq_=uWB7}!2Gi3KY{-F~DLE3s_NN7Mm1%(h{ZV5&QZ{kvMVu3|A|a~+Mfi`d zE(uRsImzIqJq}o8Pzyz>y~#_ZSTc3C}6)2aEhkBZ}MR zEi|}9R^Xz>W%gn%+*GKh8az`cq>Qcx7s+D%+r~{K_wH?$`#XbQ^Pyv4Q%axq@C)-l(Ni|Y~FX3)eD-}0sCQeeO;up z3XjsbqbOU@RZ+)ks&_>>W{sIcfdDy0kp(6aMe$}aK z)54&VlN-TWUzMp6g@Zq#pP!h>B!1H^^HZ4(>r}u?Vv`C!D@SZ+{bnV)`A*p8tA7qr z&^$_7G1Wn}VaMqtSB2VIy+9nSO;pRT}lhbzg|8Vw>QIc)jx^`t|B`a;)wv9^L zwryut+O}=mwr$&1rN3NzpL_ON=dO0{YF}&dD`rH@KF92HjM00v_j%u^FFFI(X0`Y( zaaP5J6BhvRE-ol^bn>GU3OXbog-YKJ_t*W?)8dI_M=vrs^VgeouX-$;t`;*xCa4@R zTdsCHZl^`ee@R-~><4y3zp!(>h<=_<8a(hpXMh^gGuY6I8wD;#Vj=^W8a)j2MLI;v zT|QYQzLwOU#ZVUxudubcUiFh2S~maCsP7gM^%=G#wXs{{>ot`G_G_=H(~0LWb?30O zrfD=cZIimBgk=$(J=a9XC9$26KDYR5^el)TunebJ^ zNXJYNLSP?)vSD+|35%YZXjTyH#XfP}L55Ujw~YCXVxA0Q(el4hUoM_r9h|I*nl)B3 zpU#iMJv8KVU`O`v#n^DFE6K|vmzDtVMbZE4oOu7nxnCafIuv$^n;r)nNrEY9R!Cn0 zDO&It9KywdSyJ{eOlW^adjt9YgNM&Pi)l1%AI=K>r%QDA+ExYP1Ttk5wwx4~2_Ltc zi0eBa!!6zeyMu@;*BK)Lj?Tuq7MyF7fzYO_2-`!nV!vGsHy%C>wjB19TKTZL2~L=a zkXCjRzM1Oas5}g?uL^YPa4A^4-ZMb7Vly1*wS0R2*))C`%Y$Cm7XW^++=JnG_h?aH5@>MHt^A@}B=aU7!k=5(;Pyq50&w&sG&UV_RkNRS#6_o4(u!Jv0|bE7arcuF-xD|NsI8i)Myf0 zj$1)`0+?ecwTX-N9-SsrNN0#XSRsNgkc$+FQ3+}y=}dfHWsq) zxy+R{5mm}3*<~hsC8!=7$}OZi5lQZ%HXqD#Y8$9F%7K`TI^!48{vE4gd}7R^aeMp4 z^Q*In)k=!Ws`lu4g{3TOm^R9aL>)fKQwFx|^;B+M!k7i9s^#sXol}wo5iLRHq(tP< zWJB1LiBWS%N-|c4!#OP9_s3wq-pUOI$B~n&6^nK%_?wBwKCL{;M$RTbKJ61>)SUIi2gJMLq8Y zVC5F)7Ph9fnk{Kno(%M&?#1*}OX6LE69smn%;brDqq&gQ)qwrO=d3{oAc0y9>F0JY zS&2v!MJF zHA5#EMGcMSO!2w#Gk<%!F=tSd^V4&4b9Z`qyt`;p4Pvah z5OddxSHd9ts2Yo3L#9#BP+3@NGW$TTlIc6@VHY{hri1@{+LY~PSm09D)qgU zB-u-&D(1yAzm+>-8X%)FAsZ3eZ;0PlQtFgqD*kD?RD6Lx%JAa?M5*&5I}?0XbTvvI zI8w`ajA~dI|I*W=Abbrdc7+l|1Q&Z5W_h2ZfC)LwvdacQ|JS3cyS-Ura8!7ays0ho z#PKKIz!7U!u~6@ljosJm=rn@-@!E8G%>v!zBCi-Lh1f=a6Ii`4=ONprRJ6k;_aNMx z6d#?DIyOXZ|2399DzyqWYXY{;`JL;s8CPc!N0cKDP^^rk*0EW(%Dqv9AMdoI2}^a* zKW@FMezix@x6xP$ZAu=5g!+jK!6m@AIyh0`TIUtWQazL#_>z{!l4Hwxi4}M8?y#OMmB+RMqL4(VOXibf=lVERv9~$4psagv-LrlJxcu zl@kg)C5{SMq7nfYGAyUdT`Tb^TO@swTp;d_Z5*QBa8uYBRKbYDobaxY%O z%^U8MdRyDPwfy^Xb#19YG_qN43_TpVgc~J-QWJCI6)0|Gn^x(5KFFgc{)@9~r@_JN zHLy>Z+MxajpfbCiH7jYBXs5&ma^tuYtLGCFyX6%v&jiI@lR>UVOd9XGfrF?_ z3dRlvhm;Q#^=d;ID zFZm-VG*C*vBf{GBN2^#Kz<%d|uj%tiNPIuU^T%2r*9Hf=F;hHYTolnz-UM;t*tF7m3cvm^S&9W&qc; zBml86HI9M+DAza>{>^Vx`@g#6CQ0T!pM%3$ey6Eom*93aOc?e%zUGKHim>&H+FmydPnnrC;Z5CRH%x!Dm zmKp?u*8$RrZyX)mf*48(uBVnhMx}r9$NaX@ErlIM7^|LYP~voOp5V|Hs2zNM#^rs{ z;7}E}+b*eQ?r)XW%0{|#h_$Z;1M2zhjp+UR#+gv>`UHq7{%N^xD~o+{VqyS zjmiSFW2v`-aFUTgXDYpEa4EuwuZIR>N)0E!G8$Ymj$p?Eu;gxDs^AoUv@;oj+`WN% z#Bi7bSI9j;hYr6M%^&-2HMKfMiJWpsOD11;^45IAqM63JQj)qjnDh8(c2B*=_xli4 zd~Vm5{+V2W-(buI@!9wm(>g?{aA?Y2;dnsf1L?KE~nuxJgttqYN8<-?^VsR@xd zQe%~VS`{td(S5-~{62Cc4D)MBZZN6plwQ(RDFrq~kb-zQ)I%q|nau?wwp{l$6s$Kq1P0xF+N42n;(=}Dmp?L zrujaUkgs86f?QQ`J!rq19d&5GuhtrBzn*qvq_2NO#56ql3H#jwJOev3y%h^0I2nLe zO2>`O8ngy#C<#!9T?E^z<1Yy}t9v~CZg%I~CuV6`{=Rry zX`fyn%Fqz3^i<4*9i?7@lz^l+Q97U-Msq%VZ}Cc`j0VA^4C;{p)w6)r>9BrAE&cqC z<6YI!qB5^>P)j0rs} z0mHgIPX)!}GIs~L0CLMrKL-!D*c?Oso2goGjv|ldZ%iTcg~`w6%v|?UW}qA#re{u; zaj;*~eJu42-rv&d>edt2r`!&+ioC4k9_%BE$6g}d5RI8liX4b1>K9`9Z7B zKorp*59e92l0_9-D-#VY=wFR2(Cjw0x7YmqtnJmMwgmE@y) zc7|?bimqioW|ZF+jNGgD2r^35N2Qi~t!Z5?rmz@W9?rXa1+{0h8aw$S%E0qxZZ~#E zJrzrL&(q(5W0o6O)jdVuS}jU57-{hdZW5?O)6gNrg;+3QMFW=M70h$z>%9b z;PnE>TkuZ?8-Dm1H)q0#)&S)N|A0`3^KnLHR5YLmg1JgIi6NL7clTI3$1B`VCfpEeO&!_uG*&#{#E^n5?tg_OG5_=eCE*zxfZS3 z!9No{u7JG?P3Sk9Sywqkfl5KO7&YO&4&1UdG;+a+o0qeCe0;Rc{7+kf zJE{VSEf+M0GTF#Blgr{)aRIr*?`bG@=|&5>i&Tuqq-+KNu9**qrq-X#0?RE>s(H&l zM(XBLe_YPrQ-ZngmRDyXL}i8Gh4Q)P&1K}6qLDxIl^Eh`vMj?xH$g5IfU4y$WN@`; zP%q7iq6a#amuH`vnhceySS&>5V6{14E!ViSEJ%7v1Xc!u@hloydYQeyYf;={SFu|+ z!X`H4?ZjKB70w^fOZ1SU6A{p$0=<|f{TQ@blX93IDFbY`@<=?0pC@7sjftXcGf>C4 z3Ndk{X1-HK4?+i8(wO5gktQVP`cRX1_Qr8`G$l?-Zoen85(sJZrzBc`t>EJ5$$`V| zQmnWdJdb6KSTIaQ+cSw+O1obJ-XsHSANkG~Y$bqikmjpdZ~sV+KqD2z|JW^M9n_&d z%}^jS&wO&vmbjS676(dVmM%N!zOPcwk0DEvCE7+2dPkG0e0#AN&V(KoN?<77rzS0G zHLNC!hSH?%dma3K*y0pnEJvQ)kyOKQQ`NsdD_ zj%#h2ly$qFh&R}lrB4g8K zReLe{+7kV4K`{Wz%a}Um+`+%>z2-6hDpYbO(LnIZzS5+m0!k^66GUFM9gm&1kU_

ZC8&uHxu)Hal7ejf|?s@F^P@ zXFbMxjidXpR{ZhgrQf;8W%5HYDN!lN!tZjm zUDZsrBiO^pi+lkaVL-(_be+z7C3k^pp0XPr@N7`#JW9Rz zo*rlaoGhpucq=@(ll@8Bbe%PIHu2L(+fZZ8J;xTQibd7`AWodybBiTN%A5D?j>ax^ zVe9Qy)6xL$0D%vUpo&}@0Om~K{z_B~HuLxQv86{Nt|R%zk@1w_ONgpOvzB zKw%N9XvaO6C>1ak?)jVKPuWD*VVzz(jy1IzeYS%H3pOGr(PwJo*22Mh4wa%dC^))a z@R(pEhD{%XTC>4cu?54%!}-?Ss$s;HmF7-cJWk^kBBNQ0qd>^a0F$!Z96s=c5WU%> zlE~&H1sXLqOPEUOA-6PqyS>@l*7(h&V8U8vKg)w%c(1CTWp$t%qABY~RVU@iJUKPV zeN-bZ`u%42&E$kZqH9#i-MS^W$gc73s80SjBNmFL6~P{4lCueN>N`0}nZ!n|WOo?F ztZ3~68Nf#UE0cV-pgRi8#lo9S>d`yPz%gKY{YF!5#^XRcwP@F6)0sJ$RPwTCp@TP^ zj+d-71)93%^(|qQB5(jtYH0`awGzB$Xc8=yH!y5^jhRS^wF<1uI(R%Y9HVu4P?F|r z1i9TC=4|h#5k@Y}?OZ2M$$T{`MFHSJpjJ0bw}n<2;9MB2yBNp_=yz?AwhO#EzPF5M zywg{#U7Ur5EE=U8OY(;g%;`QYyw?dsRGCi-WmX+dFpAHPv35 zr%k15!kABZ3&jjV(S1vF>l)BZqz|vQw#B6Rp_~H?e{W(q)8TSoE1i zE0=o;wiME4xS@0ZLTx*>^oFyc1WVZ#8tppxYd4vG;7!vkY8*3(W)oq=+DU;nFlHQ z_C~uq;Mv!l$`x6*qMriKXK+BbN}XkCjKM&k*AileQ6pk+#5c82S7n?=wufr6y2UGy zUbjX&Qmfgh;Lx;v1IDDtpv2v84>+~t(&2+<>}@dU5tyHnd;6Ze{~0vP$m|50*UYmb zW6iNARhvJdCN5rXXX;71+)O_ARgLYA8fcd+Y$07)GAJe(w_)y(TNlqH!k+sK?j(-e zq*)*wvS@JY(%qv`QDN=h!f%LZx3ihmrSVoH;sRglHq*v9hQLc=&vj76>XN z7U`D}s~CTg2-|QG)(^B{PN+_A#go4tZLu7XQ1=~v8oHb$_9MRx|_rmspI!K z#010InB6cB8kVWC1pvQL0a%6EE^>Tn0*QtwA1i|}A-sHb-tiM~j2LIr_BM~sYQrSe zM5h1(?kuAAaqc|z1BgkJ<~k$pICggkGv*AXDM;BHH64ES81M~h>UJ+LBQ%`MZ5A}vq*qb!C;nUg~+0^Jdy<{Mj+%iO$V4nkK7;RVH&io0}_=zP)-kcV&xy2&uET)fY z_0STo=ueFkW+>H8_)#@W$wjXCfyP=?sm{C8M4|*#=V1qbKIDn!%M9UGS&7!1V<^T? zZh*ZyV-(jgh-9Ljm2QU{ZR^|f$ufb~S67v*D=2sBK#IC%kUd7H z*1?p3^mRth>oNa2ge=~fQkvD&X*Gx(1rZjYId2?gzoPyfyd8GU(4*Mt)fXODaYoRf zg%78wsA-FnC+kR~SzA#IIYN?16QY2ssBO#|t@`slEvMUtz|mO?9d#jb9EYXteT3-X zVZM#dE2_<(jU&8Ne;>fnaji}fo=Gx?RTG8CGFa^tmM9?OQ2e5PV$j5}u)el>f0MuT zLxGvsk8O*(DttppjL}?>0Ri*+AYtarPu*LMhdKJFY9bQM~bm zT3L&UB_(@?55zEi;;Kjq{Vl3wIZOHtxkDpW8nZZ6tzzj9YEzP}I41rqE&aSl|4ePS zFpnTiVPLI^Rf1TPp<9vk!?51?<#WQckc9JNNtp>AP}6S}%2mLL>FlC4M@3qJAqmDT z#-`)BFX7naa6pJ{_mn~1a&mz7L?(K?^5*g|YrlCQKL&VIn%Mtf&l3BA_-_4LQS9_A9T_m~G3q zv!G{&t%oQ$NQfMxSaVw=XVFk6WhcRnuBZQR>rhHD(J`!l)qhPnoY#|FmVi*jK_1@kj9)*=FaI78Gf z;cd9Ed^Q{po{4B)+ng63N~_W4?}{De!C@f#gx);MIGE_&Q7odnw7xJFbEy&04duc?pQ2YGCzswPMat2 zQF<3E2L)}~1UAm%+cKtVg&)uu335(Y;O9aXo%)!uuqjMNCy-t>H=E1+m=|=YAVZ9? zY&3CQ7R0`4-a$wzTI}d-bL$JNxxKA{!Z`MB0RZLAB#Fukz30Y!Dy?*8&Q^|Ejh`J? z;Juyx-VXY#{O%7iL!(sU{6`tz#ylf@805+!J^QOR7N_t`UPrb!so^Qhv6oilpE3XUP(i z^+rk*dJC-pWTz}SHT&7uE^k8XPV5nGa9+Y`ELH=}e}~?Q#oZge0Dtiof)Eu^al)6SC-HE)Yk_ z!c?!sSc#z~o6>3Y`fxA9XafI?>WYbNG2z4t1s!F=u*#JStdysjw}62O(l+B2*SGC} ziU|$lgOn@WJ_1p+01-81#^i?e$UU=a%t(1h>Hke=P`s#rC^T$SpN-!F&Dt!=&2~R{ z!K|W8Q^it1KwoHZE_voFnQP}@!v!xMT@>h{gO--odA$1OhmYd)W9t%6D;)|KXIjgi zQ>wfkN(NXOXP%QN2=+-`G2!8AGq_VPp5&BnWm??@6S?VSAL;R|i;|e#RKuN25|#4H z$;F8GEA9hB=%o`ba5Uxxr)p~%evYTi&DNJC8Xhs$m&TYZl-_1P$jIhQcf4Da0lQLh z@f;S&o!+u*QeUyvnm3#ZQ16C{#O9N{R4lLu>AtXVf9N&%`K?`W)p4m9=$QX~nE6XV@yBmy{`>fs*36I|m+@b+3b}v3 z^>0|+za$@g6pDI|Rt}Dm)>hX4q1F98i0+Hf^Y>DYFY(`ht2h2k`ry~KH~b?+T$=yo zTmqtk@~&U)CreQ)BWqkvPFxykI|D;IQ!8U!Qc;7ii#By|{nDy@k@QUM9qhi)dwgFy zkw4Tc@{Tq(7KUGrSPozMPj2q7F%uP3uoe~-l+?BPV(I-(oT0S3DNA&Qh6v+|>bZGWZk zkbsVXB97`@7Ys~a;4PDR?-qgrHdow zGiQ{aCca_?ZeF$c(ffT+UMkd=92JaWi~V&|l2C;W z?z-7$V<9rc9QZ9?d;^)7r<}z|SK!h}QCu7X?R@NfPUz#qxR|9;DF&ifG*L$JdJZY% zXlHjk+P?jSmItqTLTzbh2OS(DiPVP%S_HxN_Q|l63AlnORLK(in+N8f%FVkuHWQ??_@`MkXH|s*e@I?G^a*q^o-L#2}%Rs^qXb-22>X6x*io{ zo!yihDs+zaLo3_w$EBo@uk}MureIwt*rXXFrb}?fw(XR_Hme-4J@rG+(6u1w{roPj z#KM*>q!$>C7O+mCUpcgm7A;fZ0&MLNPMtv8+6PCV1ahls=u&0i10pxRXR#zKc(nk8~joNtM=52kSq zaVt|jpAII6-*e@t5lf+oGJ_uLJZ7h)pcU&vb+$ie)gnZKoCI;!2GvgH_xy39ruRbl zuoBWuA8hwILLgynA4l4N&I(+8^n>8r`)>vJ0@o0;nF~SZN~PuB9y)SNKWx+hIwu95 z0(8|UW3cDwJl!B~7yO12{YZ54xS@#DCpFyi)9vNpN(5Qb*&rg%aZ1r6lEfuB>w>v8Y6VGz0~<38Jv&(_iL za!}bY9n@f?lC&N<3sVzZrZGLf%DO^b1zqYI$8WB$ANgtUNjnbSG`YnkF&Dm9*%dx2 zIZ@Slg1>IReu1>ki0dvd)C`n1snZ29wa(pe(%ea=N?Oa#imyvE2gR{M<&I>d^h)pK zk~kAD;{|@74zIg7S_m2OJatrARkfc4j*x!!NebPKfDg)wdhIrpvNfJb<10N8+uuDJ zq}#eqyArn^8h$sv3{N#Vf1c+_6QoPu{nEzp3F-U+=WbB_Iq)1M{aW=7lS!M1^nX85 zUkl2AP=7;z0=)g3AO8QVA6Jy)`@n-dgT}LU~?|jtvPs+U$Nf^qAU=4J)``!Du zQjt@-M6us4GF4iMS$ZxOX-j**bG29b+QE}Ydr<)B8tHVqkF35U*&jsi8xzLBpP z&b2f~^!ysfc#xLb2_SF!mc>W`aMs{I;g!U0H&NCbG%)cxvGmrjJ2ozL!PxB9w#WHUqizQ_?5dKC2WEgIMIZ&>my|5QKD^lujI*IH?) zYYE|!F8LoG2QM^oO~()df_?GFrz0R?ODlB(FFFyJAU`yi!FRtyMqFe7e;x-mdPrjb ztT9J{Db;RVRvlVUPGuEf5`Mu=10!(11zbAofF7%BjS<(NU|2{gzw|mie%G*I36TV+ zabk?79S`+)+zDNYd?^1^h3Vgfq(}@mO2cwx`Ax`{iF9jIiw3?qKh>pjdu67Gg+;QG zX&F6H5X_1w3D$466HUUeHLz_%874ggr&xz=#ONyG~FShs-?k`ZA>=si81Sv-DeGhYoRQ<;w@iiKxAs zT@%+cx=x{KGDyR|eF>cVjDQ?hx=~Xb(MfCB8$r1VLw)4%8Jc@ z^)fvlLEIEMs8^d*m0CB3ZzIPnb{t`q0PyB5_=5kZ@OTp5s=#n?i_;|{k$>B zRIV3o2=PRbcV$veFy0;at*0il`lwX6Txst$+0#o>ePVO#j3-Iu+WK#v%YQ1gX8zLd z{+a9WMI!hQXpxDh$CZ8F4b4PQuy*5`sNi7uXh)-hqfc~zx#s0PZY^l%$!k+@%cxw;c<4WWaRAJ5X$;V|V{8rLo2*C2A3u9t<wGA-I~06O&*rOlb;oPLmZ{4{)@O3xVGGGQI&*)4gLm6XM5Xni73m9$E+<4=_Ms}S`HAmIq zM-Z7^pZ-w-v;tFO^k(p}UG8xya>k!SHA`BPUX+O|=C1E$?mlwX`3Ri}r3LfEVMoip zP8@T?Ipz$Dw1SS>bD{WwGkJ|mhTgJf)heCZnCTEEhy6-kBI!PGBXKyVM`ezkCQ}bv z4_6N;_f3jif0Ousmd*cf2o8oXfc9S!U!E`W0vB@a3+MlfT#EnKox}YDiuGj|77_0& za{?aSGPDo^EW($8$>I09pAtNzA!aBATM<|pIYeLtdHfNvw}eE5XB@$_2LTo%l$mu1PbfOc zyn07mf+XAoy2d^Me|!9lcDY6%U2XPV5P;6+Qj+&<^Eq;xEWW+A%=Jyf?6Fw+o|!h# zzAl_dyP3W+*tQl`H4_St{k#r_dYEvY<^o`vhP zpP?P~pz9XY{;*K_Z|>ATWB}l@{k6zajO>B>@`V8UOzHiBJ0O|b%MEq|_UbKL!h3LF zZ!kby#@~aB+zMJek-bc2^{!ODjoywPQ>*%_izpn~?H_AaFf5^9=G?$Z}MV ze-JNV6?K6Z_%|W`xpM#ClIed;qM8w+(0_z@sHTX-h9 z{yQ*3%`}&v8f0k1F0<7LeB_8C7GA|N=+Y|e-4377u+1jh242#;@*scvB7f_-9bj=d z7WCi5_vb?Ve~s_2rmK>Xd=TBVuz**cy)fVPYBg`O<=jL*y{QPr+eko>WP?Hy>}rO` zOSs7?q;+SQas0XP$oOtHS#>qhl+U{^V~P#2CprtpXGCF$tu$N!aN%$_|0cFS7t#NR zs{IFG|NlkRZeaYESvJF$M>ZoJojffa^Y>eM$QD@spNG7_xIbmdmC;eY?V^FJ{mnW5 zapCyalwx3{ZB+OJ<^A6$Wu&c^p_TbE=mxBFhzJiyv}?)EWz)b7pheHc3mWTR{+0kW z8|RnL6GY)h5%J?2oiifd{~gYkW5|DY-G6u8{|9Tq!1`CHg{HiCEXBWFySp_LpHV00 zK-3|v6SY=dE3P}9Np>gTOv;a> zB+YBG(yH6IAwf?jNBkC@@G?Z%r!9r!G}ZU51<`;=-}8UOI)CX5r{nAz>r~c_bLO-d zI(HHi5Hz+VhSs!h4P*3bMTohG|F$%Gl16YHQE%X=NrN5K)BHwCC-0Sl=4sG*9gsK6 zhyS4j9Cy6mP~Yb%(~t<{_WMSAXhoSZOANde%ch}duIQM1!M7A}?bo(#BFQBpeR1f7 zLqi_E*GnpB&T*1le#R)3E7z2a%9Dy~4~}y(!xS(T2kt6P z74GSpVDJb|79J2z*e}S>Iwr_RzQ*)U+Zh=Td}(|-r*Od-wa73HnF5@(~}vKvXdG6KIy zjEjOY=|tdIGZ!AQ2fx>(UHQCPX!h)Ss)lru!e%A^xfburQKU!%i1@*$JYh_m9EpaNF6U6-ye>F2WD@kBW(GzSg8ZmzhB<6pB;T3y<7ppymkbJD<4t8E;}?? zm@j(Z&%Y^#`Y4k z$IhHhwCjaF$X{?Ss?lSD*i?;Dv|;`<)4CnARE$8BA7ocHoT-N>?f-qlcox!9#F}eIrKK|1}k>P)!mKDEdmIK=V%E#}^-L9MS^OUns zTT(mHt?o$Ou@SI7Ca?$~#XT0V(P9$bHc-G!!m~?EzSfFdz$l*bCoF@gqTI=;Wm_5C zNk`2?lq^l{`o01l`e{+ULPHxRuD65%PZ1UX6?cqgy1-)C^SzdU2z*p6l_GRzrj4(v zrV=s%Ix`!?gg)-$8cPw|`))1RfZy-XztrD;z(Pr(9=Z8eyb!K0F`zrinjFuVxx;dM zcBy8t2_+h){iA+?naB1iw~<*$OYvFOpqXb|VueE5Nn=m1is0LxWAlx@!KWLzOcB&H z0t8J`w4u2hEWqm>5H>Fw-^?2h_PTRA9pfjH{4);-wv+3-Gev-OXxJRlal0VK%CYk1 z3}|@6Cf)IVVKieR?o`CBzVw9G34|}n0hHyz-*E1G{{z@C9J$r zo1<*j*_YT)8fpQrwLv5~N=zww&plK7W#T+0qWL9a@N{^sue)8dTr%ZB35dsHF$ zmY987$a^$k_-qKt-3a5#%Ejr!E2|qUaVl8rJRjtr60|Y_!EkEybngN)kfoJ;T?2&J z40ReHV~>JYSPC2aCkSpw!X>R7o}ucT%K$MPiwse8%PirG!YcJ1@!UlH(x);Os74BX z`pOV6r6X+XaV17PNca(EZak5DD3F<%2t#i65Iids)d=@A;ZJB{HupF~!9Nt1_ ze1n#G(lL`5T|Z!2H)#^ApUKj8wg8by3Y&hR^~WCu8GbKdRYZD0jFVE_xko-@rCx=( z3mhv8y>QmYiaQ?9b`4VG*eLV1Pl*kst}a5gfud7qT)%=JRbSlx!ErZ;Z6_L6Syw4v zETIR?{**3B{mz9lkwL$De`@58w|zJ^KZM-V$*Gnp1X#Y-k~R5gBC=lBR&(fe6RLuK~+1Ey!eF3blLKa^A&0mVW9F%%3zX!?(-!= zM`MN!hi@OEwtL&E4x+Tsu3^$RZSe{KOr8nSFz`jT!d7OTpd{7Fiq5xm@@wmE_c}`8 z)Z-5&`DOP&7r;uaT8a($sr~V-V{3u*Z*t(D)+ww^f9-KgDv8DtvVpY^QT+Zj+Yfy; z(%8s0|Mtla!Y^wtmjBJzUS?M+2uiP7Cj1)K?-Q zd9?abAUDJo$?T-+xu4M>Yz~eQw@WXq6oF^fbaNAbgiHPIYHY^`I+nBdNaWGrb_0!Q_$i7zYq!=lf_p9~NNs1R{ z+B(|=+YT7PRq&b^5;2q{^d`Sk9NTqg=n4fP4p(zVs+nN1#{{Ph*_FHyTdG6`m6y1r znaI+fOf-e!)&0L)WF0Y% zJzoytC4?f7Qj<#@i^>3ZVW*5yG6p*GH^xy_tE=)Bm_;}{tRr0+q09P_(g_KfN z*<4iIjyJ}IzDfR7PpogN3+FTt53TUct^1Y@A{(}xlgWY`I@AXxz?hnB65ftXi2Qou z`VLngXkk<*KLo;1yKJBj1Zci#ehc)%JCG9zn6fwC8j`E`DTgcd$d`7D;D8sw_<1Ri zI6@t3lXV!;dW6(sbd*CU=8BwbECV5RXD71(m4I8*F?z%N*RhT2GD)ydv$Qauo^laz zyl^pH?bv-QE3%;eIo7C!>{6{5+R>#V>kR=|qgdGJ_Tr8RSTiG*mbLNdE9R)VnyOPS4lx?9zd`n6%>P%%qt z%Lc(BU7NR60{}HFREn9Q&9@6RBqg%k*8*STZr2^9`(%9Q7dYef>++!dk4AAwPQXiO zyZ!N%&fupFLEgrcyVU`g!XG7_f*rc??AGW=2Q^|hp2b@%nX>vi_fLk!TwG0?Q5>%J zCq#Imo6d496L(cityG>k3|?DJt+u9AAw5tQJPNIF0mIhuWFM=wi{uv~ZB1RD6keI$ znO#%f#r~N(fAfU?)B2RJO8$&bEK7-*Fj}K3rP?jhL0=`G#1Lxl-$eCKOHz7<|1odKipGA& z18e_kxM%keZ@ZW3>p?Spc1ej)HKN1`B8aHi@BB z_h#iYv7lUW%t(U^t4f9d4IK+L+y#K&^voErK~#zlpNP#JR}`?{2B?g*jNS$J8e?Go zL1A)Cz|r>FZ$!*RGg}8^@$-zmn}DKcnXx>R!_5dOV_D%&HZ4RlcXzd^Sr7zzZT(W)x`^=?< zg|MZkt&d)TTNbkLul+k*H7o+VChZS+Y$*xvX`}ksPYiy)E|VS{WJ^!JqMK4#g~1pLRbP&{cy!?7kXhggWnqzS zd!Ew=a-1H=*t@luuNhIjE#4&0jM7O-`YPHC9%@R@m=|kudk+3LD;{c?D$9rSWCD%x9WpPh z`#NoTaz@@alx9Wkef0c?b?m(RbgPsDdyNh47gR3g??`~`JdlNikKozl)NpT~IvEp5U z@uT6(pW11>_`06G`EXJd6NB3ljTlMc(0^)gG3s%%CpGgS#azy?=w{b^zprEAV{Oz_>B zl%``tb|66rHuW*znvkG+`X4r!b~ymz^GEO3ZwEweK`oaYut-Gg6qiD}sKZA*r@af{ zAX9#@N;3B7MOeEq+FaFq$3CWS5ZC-Nts4jWrF6%e6|?cVX5JOZT+AEG{tgC;gE39^WOm?-E;0KOR$w?Ce9w)P=tCG>!<0F^?7X6x{rUFRCo-HK zMM8##RxQ~CDC9LQJ+6*b%{7an^?Dw%N;eiG(<=7j)5XEdYgKT@ujU-wWB2Ye`{lDX z6ss5$tBvoxlQePWx}6LEAA9c@T=};Bdv|QRW3yx1w$rg~+g5j+j?qcSwyhPjW7~G$ zwg3Cv`<#7FSKWTz-xsM$tzgv}bIjkI<1_G$otp8|11{N`*~mTS5OPOHJ*W5>eMXL5 zuskuHD~PRo&v)TzG|ST7%feWY&}=N;xYjQX^37P;h29sXwEPh_35Z0i;wUQ|1IvLu zCt;wNrTW-?_yVF`GK3FLiN`^{GPQy|91^3ScH_OGpQ zg5e{Ge>&zpx^gbL*K(9%urY5D6+6xKWtYH^h*0LC7wP2rOB*@El?cMlI~5 z9aBaew7D8Nnox6#5pJ>|$4*gEXo}E)7TX=1xLUbXpqj>x${Z~Z-m38q+YC#)5!a8h zv&#Sj&nMv3J5|V{u11r3%a7LC%RAA&*`ZIITJ}n3E7Gkmc{yXQXz01@#UcoQx#&bJ zdOHKByf~RL7$+|ScAz4&ycoqjG(F6~HO4&cnX;NMT;=6EVl8B^?6O?xp|nGqlG_)I zjHnI2h20?h>^0_E71)-I6DoBSzZF*Ran0pk^rJeRsx?b}m@XBlF`Q z@C2^q<{`WOom9^x!}};xZ|B_8Q3vK?G#69R0z67#L;CVr8qxbKrKc1{H!zeYRxl{g z-y5bw%#lBL-?rV&9-U9}XUs)eX^+R9h76&nCBRJ^z+OeYjdqtRmgLAgBgy2sz|nZ; zhCUIu&%1=Wgjv?hP>`8bd0Jb-9=J2qrQX}RPQ3H>S*_{ad{`!l4x$b``}wtJwMz`H z{_{xeey+9J4|mxDd%&?MUecRl&T(p<(MJAJd%*WgJNaGuO`;xmHCjP{A?lsOcl!#8 z_He2m^mcU7+uo^l93|w1?;0#j{%0sFr#6BDeAd1ypp)f(Iw#F`ZF#M}`PKTRe@S4*b1w zAW@#)hbJsU0a2ruE6N9L4>#0T&5UnN353f`B9zb4w~hwE$-6@!8|5Q@YrO8Z)Ly!) z?t8@r7dyputawl}>KNtL)>|)Wj~OfI^-g8$h7@1z)a1`-YGsZTS<^A%D}Esr7TTTa zY`#PglA)_dtS062|9lk_DOBT$g1|#V$`lp^4tTqFOh~s8 zXkHFARO+YK>+WbZ8s&8U)FMb%y0i}>#O;VZ#MCJ5%2^1uWR&OVob6N2YF7g_D}LpHaaVDeaCDIUox% z^{_IDfJ5p5)}w}u(m&f_FWk=OdcvEeLfCz$>P+y z!QUl9fiQZc*te?9g5(W!)sNpP>84sUXCPq1+Z93I=BbB_zmpHTWMy;TNl-J4>@X)X zu(bCFVA_;iUTBE^NRH$&%h9(nO7T;qd(oJE$NP z#UR_Zy$_twy^6*)kCt1Vk3LA6wGx$&ganoaB?lb^R12CVh%nea;y}FYUX^gU+sJ1Y z^hS@S$7NA|$8|QdtGk?Wd~u?KehX0}%?i4=B^aZqyx}XpXe}gW^xy(7lFG1rGiTp! z;R!{rNu9hVOk&FxXwpgSW$Q7cuaalX~nsL7xLtUnd_~8mT@L3Y-!7h;u)TxO+oKdPY(Nms@>i5w!`# z(2-pIvZt%rgGDe}WXf@{x!qu_=Pk@1b5~aW!I(F6M9_6!DPs*3^E*qjOBiUCFs+@I z0!kW96CUADQR<4Hs=4Z1Ot$or+MM1!ei7XoZ#El~BG;%j^-k=iEL)|Ye*RuJ`756m z;hn%AMDOEH=Wo2{Pw^`|>wkEUs!S~&*WWr1-2H?TvvHAHOAi~|fMR9*2;u%3LDF0djXG|G#Xn>RAeDz@U)N-F|LEa1jNt!LkG42c})k%Qf=#GF-#hl!S> zylyXkD_dQ$thS+j^!x^z@-#NEUY&_lA<6P=^qdS++Ng#R`Y3n0s6pmV<0ub8%SD-3 zTRADc*w(fj+}k0e9AwVGE+(LzA&ll(nQaw!=Nt2=CgDl66u1JVk}*44I0J#kqZ*lptXKWl;9w{W!+W=vo&=;)S>wu})8>V~+h^8}2-|8Xb=6 z1on_WoJZs&AUSGwee@*XRQHm(Q$V9qe%*gkpN){o;WwWArzn~QSV{fwC|XUqrD9DG z9?%5KP89f{G|2)FHThNy*+T29If7V%vn~VzE$#3XQpfqfR>a?YDX@F8i+>6>vgP@{8%ehR7Kx z3aEtwzPej9M<`u{fdH0{B4an}G@X>iy=e%(k2#2LD<#`25c#Ay#C{)^Al7TUy1zz~ zDA_4J=XZzDE#S^+7SGT&2Vgo*nRD3>)PX*{*61q4=>f#7;BzpRrbE#>X%+Pv6+3Nw zZeXTw={M(H;g)UsqxHx&#^J$u&*+Lf#&09|Mz$+%xN$op>L_dXHCu>6AIx)Q>p$_VQNeSLJ^LQDOa?W&2Zl z%<>wn1xFLw6k2X@Iu8J+doM3k{R;J_G;G9wugCm z2hFU4NH==ZsopYLxFiG(p zxaIk5IT)eh@8u?&e6bcSEjM;Og6UU_(AHF{_Jg&~8ihNGPz|nuW*bTvc}0MxgXqbC z)Ir;PIB{3@M`rbTkcOv?P`q~L1FxLVK{Ng@_@=S)T6gLu4uH#K&t5v>rxvA^Y^ADg z>mTK2bG?sdi*Z-w^{X{bT~oh!G=B|hD6XW@O>(Kgtc!S8 ziv1}~WMTsLg8chV0|NhA{C}MpdJ#BT2VC6k)fZi7A4H$3U`xP_BvH52gAtqzwlG0f zMZ3c;;Rv}9WwSl3EuMN$_HEC{po(r;vT>a5IM{c>*JQ5oU?56a)1D6^IKA2z`iRk?kLBWt|u~xsmY3L zg&I3#<~P+EbTaFl?a6mFDn?txK(N)&DdvauDa5qD1MlEy?Io#rSJO=X^g#!h(2&hQg2vDyDHHuf z>zRRsK>Lw%-HGxA7t1#brlZD-l2I^U1p40JKQ5ErGdVUXFw zu@;mDqpkVqK_=Ca3w$ylHcj#YZpTevgiyB=S&FNhOx1iKOt@K!iiOX9g!6}4EcnUX zu!GQtGZ0P0xaI3j!A;pe^iUxAj(umQi~Peufu2<*}0f#s;;0?@AXx`|ylJJI{Y)f6NyFa1sze zqoD0{dVT|3%twqp<$^s_q2>vv9wP+>2dd#B_O)Uzr(a~@wflraPkoj$4;VirtNSY! zH}_b%gVh_OV)9F(3OKWTHtAo^`cCn_W(h+v|I{jkY~>48)u67Ck}SZ4P=nPZEA}P? z%&HSpjkQR&E=ak-M=#mQJdTjNT0<@xZMeZkr~Yc}`-zJw?zX$tGaxL%X(fm8#3i>8 zu?AiY)83th{5BHbAn#|n#cl6E?@ol5?I*y7_=TmAlqq)4afkbdMz}*OFRzMtD=m9F zH#+as4a+QYv4vh{#!hv2v2n8NXo~ak1Xo|FoFCd}^KK((8`kC@y;t&Osi1ohc*)`3 zU|6fu(8Dk234&N}hf^e9W%2PZ6$1?(3GQSYcRwV^^Y3+2YvLn=mPNO|dnFXtb=-HL zS%Y=dEQ89(`a1k2wewGBc$P`@KVWiNTE**wQ3z`6-_++cpQMv8Ezp?* z)0%Hat1NJ|>tbZmHMpbtu;g&ceV3o7tHn)&m5R2@EvAmnjNAMG_ksw*fuS_`(%I)r zn2p%W;`bt^Pp3QcpwvTaJvBz!wxKk4UBB@HI<{hUx-jmor!T+WclBbd`0nW^@Qd#k z7&5YU?Qb4=f1Ijd`=`33oU)9QC{PUz*v69!aV;>JA#KXk@{67Pn2c6C7Z;cK8wfNj zrAq=M5gAwr7F%OTw#nrzIF>2_005p3&len?t`$TgL@63xT(a96qjqfYBYY0VG>D7f zmNmz%x{aV>AWMY!2ji8Z$LFPXn)KQk9Fe@@r--P7Ti8pA!sS-+{oENj24Ra;K_>|4 zXu$}zP4;*rgnXW@qxOp;oq4uGcjvK5troDXN@9(ch1FeFh66oyAh-5J*TYaT5xpv+*k6*E1S=SYlzrKJ!~a$J>4N40b&mnH@=^6 zY9&hg;;IqW{A*lzM1;8Lr(tU@; z444+Pjt}1ZoS+)nhjeslEuHTu`?tk$+_A%_@)JA03dOBUU$4hAo5y1#=vW3iF)3|~ zr_sY5=u7pV_x1?B4kZ>C2*&bje@~m7o7ej$@sbt1Jx(k|GgercFw*ixJ*c7lG}C31vG1mFsp;t?0De9c~V9G>?UxbHJ)5_QlC!&!Cb8PIDx%I*mN6wcb_ zNcdFLF~7z1rnSD;^a|pBlK15|_W#qI0yEb?OZootWr)9hc{54!hG()+Sxff3OD=Ds ztU1rpRxlu(9ATTQgrzrv<7z;T4(Xw-CUR!B`#G>Tb^a%K0Iewa-t&N23iyB;=;e18 z4(tUnsoWDTw05#63_2L4N{F>_@)C1szVWXIo#xyvYTXmYk9lh~IF+IVogG{ZT3SY% zxkj-@$3pHqc?@r?sV$|noY(W%v|8K-`D5d zuf2Z=5cY%ljlKUETmw5||NXY4t143ofM@9xge(`H=cUMhu zD|yoO;^s$%)6W_&omq}_@}Tjh!yC;BIb$)M+pcGVbp%njr?e&?tE}*?l5A{bAx7b{ z70GZE;xD_52_E{gB|7(&sSC$ber$<$4Y_i$4k`Udm!8n%+^YroEp;%ySD(>#of9MC zxLwmtMvk=c>|}Qvw;D(K+fk=k-yV#zm>WpbCVkm$*wv4MOao#>gj#h4!icV(8NMS^ zH`)xr7T#RLu@LPk`+|#^mt_;IIi`DZ9*GyNYS~_0%(5~Z&IV^~R~r`2W@^WVc)@|z z42h`hN}>UL<8H*!10`Q&GcDGwe8X_U9V6BqTU|BUAxoXSvs1BZ*QxLoP?b-%S^%0d zPOFEGZ^?^a?S|GH8v9yYWCef|G0o{L5&MKWEU4j90^~jYo8l0BvxVclJXeqRJGiE! zZ4%6Df=mUh(!woAzFSF1eHy|_()Irhm8nSJ4b>95A%Kdi(351C^zWtjx>e;q_1*NHc(L;ZAm8~!UGRvpW# zL1bS(OzQxBNtiMTCd35jOR>p$P$aMHZUiZWw`rP;0V3hTNO3i3>4Fx?BED3-av`HG z_^RMc6_SAjfr~g8Vi9$k(tdi}#3ND_B*j*gnat>OqPsQud=bX?mlpU34WJxc)k@FgDp0 z2A2ihdsRGFigczMvJ{-7AN1{^xOIgpFNRll(HZviK4zP3X{>H*uO%_qQU`_EU9!%* zW8MkttJqa-KIIUvzsjv$3T<{c0Fv zhq)aOz>>lg3?x>=sB9Vj;xtydaj?JgZd8JItD{3;95N( zqXbzawv+cU9cXjTFYL{gXGC1qb3JRb%huh13!61RXO;yi;#bncDv+K+r@lNoLG_u= z`sIu;a~NTaaDzH^pMkq>3GCMx22F+ZAL4%EI`Fv37uEsvD|CiHa1I;}Ox~%| zez5tpqe^3bd*q*#Ei<}r9SrRB9fBG?3lS@9cXC*@lov|HenDaam|?lO%MnLxzA~Q}RoNrn9+v`|Kcu+3$>NWffb|vRF0nKYfq}w9c>WsM^dkK`(`(Xfk zlT4D2{GHLXWu0_mSK4D5R>o@fsG4pzZP~YnO!9V5hf&vp2~D)(m7unn^i2mq#B+`U z%2H1RFc7DcfJuu4uUe56zbxOE*~$(a>q{x!%vZ3sgpOmA-CkVzM{ofE6#*eyB$UGQ696-aESmaMiHLfuoykfihpi8k zJi<3I!RIJ6P!dNhn7xT~M6R?5C2bS#ORo3&imwD82{pCzLR-uf89blCU~mMAm$ZqJ z?sM{5d!cQeB^Z3XT{hy7mZN@Zswr%QG@6q!lDjc1pF*lIYJl@iBqmP^(%xBy&g8jB z#TJsbCac&G7YcY~4yFoizjN9~&+HyuF<*M!3qejSRC%Wj;Sk|q?=dxQ^L-Y5yPKI- z%%q^O|LSQ+o_@OQN=tnPUE)u+QSghN;akY+@%9%a%=+L^-%sBJ3mcO8e#XOVC;l2_ zh$G!w`;FiHDS>4B&uWb%t~g*ZteA7ow!R?5dEtagY!CSSg922N$)acx-LexjZEdxc|Ih{YW@bA+ za;9=2Ou)FMjr-jW*CX&XL%6sbemTOPkwGh)U9NV<|I#PIF6=D_IZx69(Ab?GPzB=Htd6g=QGd*pu6^@@ZNjGIT&B)sphy0-Q-5woh~MK8{?Wlls_B z_pRxE?j<7&bq0q6>;_qbtD(V~DGPof@EoGpH$;BRikz_meag)sXyDbW-6_E1-Gh`_ z09(6`jSN4#-u*82-KXrBbp2Q@3^Bze*g0)P0O+q!5t&QWe>7$>O< z!p~}iGCNtZ<+*#MXt?_hyn4TGvE+5Y?J5n~MIfzgQ-xRxFP0uiXQO|tE7D7s`mqDT zy@%t~#4LmGQUoH{)}RYvsHAoW`d5X-<{D0lfa{w`uvr0(=lfc`#!3#ByLq-dg`(qGHt-&UGkRSvrF#9Fb4bA-c z(!3d-j$;UZjG47ZApc90Frj#qF!aGu2Z%Qz`WBxJBI9n-o}8*1K6?7;r+a{NbV%K5Vi)vZZ}Ff#!=T ze%Jop+BQKN{$%v1=qKl>c6CkRF?*A! z6A`wzk!XL9Q6y=}j-HM4-;O)mRJ!aw{J44$8GxIDzDWZ065$*8sV4{deEBWF-lB~i zWalHYX~)OV5d;Hy+Nv5ngS96Ax?kwH*TuSmkmLjt;71~l0G zqrUtEg-fVaGMh}J$ljog{Hb*EIV`2AZJn0pt|SW#ukNnvp}Ois9(wI}T!y8U0htL0 z@C+mdHn@tj&=zjGWP%ErynJVKVf~NECxOil^y_uGI8fZR@|D;gh!~W)UQ9R#Wq|;9 zZ&hdeUB>lq0b;d)34Dt!h@f_f%M^F6 zDJOZ(3>+pc5A;77Wv=Q6#T^6`D?6!=HKU~{1g+ui6;*w3_shtpNGiG`!cD}%z@I1s2G$E$GZ;4(NQCdOl=-8>_)n@!&_I*ge#Q(!%o*0FGHeKO^bg9(`hFeMs2m}ST`LSxS5c7!Ur@6&dVO# zzCOR40EdPnKl!hDrK3c$+bAeCQ$N4TOpjk#rIQmymVN*DT(3)l#&lCs&1O~;I3*q@zKAsI>eo>imW%5V?S1pv;i~ ztHqpOvDN(_3)uDkt$+{Pg}QylxIKG61;ea&%rsEr=Jw&lgyfMUbB|bOI@E`DFyH$^w=kxteRkl8J(;Zt zz?|$K^ZLZ3@nV&82K8CbS@<`m{bQ8J_#cJ+N;0*5z*=x;Slw=%_rU|HgK_P`hYh!D z$K`T(Vd%h6(jIJ!-fzhFh=VeR5%QOENAQE<^q%dBonNDTjT6aPobO8>#Li#K5iDZJ z-9+JOEmOY(0PZ2aOe|;?Ov~7A#c}LWH3_NtEk|}{hs5a?6EOy2b>(nyhOBkH(!`-= zt4M4T7P*#_QmjHMlUWvT%um`69xmZ)t<>?6S>_L0=G?j^3cqmgN~NC97bX15^?A?1 zl1F!ZOdV?`NHq>ID!Tj|rv=`op$6uUdv-Wq9d^ZjpAbv7Y zzBu~!eFd>GG1dOrZ3&V%1XWYTDkL{*P-x1*>K4va+|%;5DF9*akj8?7=kN>}WyFQ` zJUl&JaUco+jUe9O&MgCMvvO>eu2y1mg|!P;W@{o91xKIqWICNH@9}Y80%5^LA2*Xw zbY+U7P}Pl{*fuWbA@rR;9K6MbQ=u%9(C2eCZjCo7*rgv~Ok~A8EBi6zP1Mi`!>TNW zKSAPqf}&ks#(0YseVXPC*mfQ4$4hEeXNArR)m1NUxAbk=HYhb7c4jRlt#wr>r$X=gb<4Hf|8@$dKV@gkz;5?{2eD%R@gT|=DO_6Z8c#FT z{}CdP@X3G~jCd-Yth*2`guxE#tx*cRcg+bF8ixySP5dPUngZtkyVgIQA5fG+$4PS+saY%jrZ3I^BE=< zP0~;HOi=L=wc6qi7F3^QNBfgC8h;^P8<)ZsRH-erL3%YO6%3>LfD3XigZw&mWc#Qc! zPiJMBxI^H;k^}V44-v0KTnahaX45Ud+(bX`&ms&WuQ2az#RWzVicoko3(a4}mt2bY zCwvzXc1RpJcJ}`Qs4TUr#>k3RNjb0PY7+@<+aYm2QF>4v;-6O|82o%9Mxu2{fhMjE z$B`w;5qXHjPCeNdQFR{L;t>Y$z)q=Xzy66(G6(ZCvB3wTXY8VNpCU4IveJ0XVc80w596#(RsUWe|_0U+EQJgzo316#^)z)M>;dF zN%878+U*g)S!ureCj?{3BXbOca8qwMWgT?pvG5I4!s2R2-m?A68@$DfU)x1U&kFhw z-|YN;W6wY3P)zL1|8Q8jFKq~YjPRn~a*l9{$X)sSj>v@$_x4~TN|{j?5j#*E9=Sab z{c@m3D*Vl|xx`@)SlV+D5rMZKOyhEFa!;cQ3UR3TN=s=-T|de-Dix{rD5*k4Nc4G* zuX2`+(f7-7)KoNlbkN2n6{73dpO1w!nmy)}e!NG0`GJR`J9T&NCNj~N&KdP^rI2Ra5F;q;tHBo6{ZIY5KJas05`6#wnwLlQ#3$BbD5SJbAD=%I zN<^&@PR$imTVDjU;Q}>KEziy7lKOC1ZyjQ&SykV zMU0SXT-P9#ti7ek*@!X~M|_ZK_$Hk{^e z5GkQXi9IJ|(_jDSC3u9D@{D)X9#kxRa0QMA@|G3TGAl4Y_6f@ABupA~u$#KAxfo3f z=sO#UNSvhRzINJB=>#Sf!KnF$R(`X7f66UbS^gPD%c=gI zmskWQxiAujhi=+|b)+sE{yc#{_;`er6TtB>=cr>o_DX?Ci^_Cu~qxjN5@4Xt_LW5#Jevacuk?Pe+D>o9!k0&2Uew2FrGR^duCjMx!8B%E&$^ z2L)(HpdrtZ6+D-8!8m5te#4*(=3yhqU_#u1OcEBN^Bd;qNrt92$4%i(AvK@%R6CZc zZ<&!TvZcsL^EBC?znC+n)F~>OI@x`LRtktfHS7xQ#L+;^y{(`)e?`d0?U!`+FeLLU zn`;Rm&5%T3*O0g#tjIT?Yyq$y-dLmu!)|f=5Lk>4E^!bETvfqwRz}g4{nw^b2&mJoG?BFnm9=Po+iG- z0np?x=7dCz5hOCk=9YrwhW2Q%jK_*4at0taZ)P1m@HAQg9NRqAWB8CGOTqS_s;S;D zcgDWg+P)%LFa0J-OY-}y`wzTGcBDX2OR3|#=-bQZwt4<2;bot!$rM&}kxHw_>|dmG($I0+$p^?( z4)HE4uVHAc`VX?>;?1u`Dw%$6GrEjz=T=OF~eV zW&a-j{%a5s+h3!C|8IkcIDo^4fHQ$um8RG@7&RDK*p;W)*cerTLxF?J%ko zMDW4K!9p>4u=0<$weK!8uVSWihDNvmzzOv-I=7L^53>Sl-tX=phZ zaM30ex3VE;(v~KOaYbE;DHkHqAK9CtbC``Hu7o`-f&EPmPU{0I784e-GP0gsqDnhs$`yEB9ZKaz3Kp7 zVo%e}d9uNk?gd&SIpQ^FXZa%SJRAAki5{9uY3nmSC!GNml9k7{k*@s(JH%sa?^Ldb zHrKuL`2F_ivjboDMW^)zm|a(Ij#^Ho3aM-wSFo+?Nc`Uz_)kMQ;3TPkob_tJ zh-Hrmdi4NZkBIsSV3g|MHm0hlU~6RajqoE*t?p)k5(<2erraZJhwUtx@qb6g9}wU0AP zoSAFItluG!dCCz4sfr@9Wk4;&n};tuEoW>*n>~_@G@`CxI@bmX$JCR z-n9&kr+VtlMoevQ;C4Mgyj>?*J8OamQ~#cqng)u2WNbZSul_y7NFe&***ksMixlN! zT&p?nLMft7UT6@zbp_c?8UloQvtM(b^%g+^)+y83kytF`0w=J~YfUO;*c3&!6%8T;Tzb%Kw95MinE znU`2`sy^bj{?&qVb{|-7@m><+$rJi=EW9#*_r+g-o{d9lOaZ(5-xZSDNQK#JPU7OpAMmj z3d--O3sxE~O1JbaqeL^OC1YADYzH5wC`~Y(hvd3AGV&U1hMl`aQ0^5TZ1oO!Z^d$M z!3ZTJf3wYiJ@J1A5ZPJ(nO~7pllp6z=>Ozb==ZmHkB*PUp5IsWiAJ7&f|CtC2vRtK zhd4A#Wd%;5A;0I9C2X1rJ^mu;_gG!C&O&zLrzQd6U=e@}DUI(L$ByqgAaU^-UW2eJ zHQj>YfKbTgY~8OtFWjJgeO(*T{-Hwvuap%uOj%1?I2m}jONTS=A-!{&KRAzJckNZ^ zFBs#XLgPbU7qp_a<*oJeXew(kshf+ZP$NK_!z~=yhh9Ij49G(i0xyk`9So%)r5zQSl)#@Z356LXkqa*WQ}C9?FldqUQ$Uack1dZYSCuntgR$h&sxzzOZwbQ z5e=Wr;>)Qz+%1@xz(NY{QmS8s5g&DQVj+}2Al*y0@*D`k;F!aRs|Q|)iP9d#$pn!) z%Kt3(tp$m4GLho^15wn>!*EzOcvXp|AwuzX{( zR5IYTe*jZ6^U0U~fpEkZRaRi_5q~P}k@rgFu^gT)uq-OZi;o;3N_^&cyvc_z1e^vc zRj&BM*5-(6a2@zlsdf!4-JoczjS};`G4@tWuy4-{mlHQ5jPjGaOmHW z1~7Y7OULoA?ya=&8{Y7~=z|w~e4>(P@A(8+?NIZ}pe9RIS03gMI%+Xt2O} z7CXV!@gAWIwG~#vdv8rNEmv6hsnn;ISThtJ1BABE9Rce*YY3`mQ>LOtbwYJdB!?)v zNNH~r^zeDsWzU6+P!DX2;n?xBr)NP=wT|PpD&IW4%o=`6j2*0ZRXfUIgXWHpE9puE-<+J_scjay%V5=OF}P-S-Ve&SbF_E+9Ok7cVJ zQrLG)1w_m_0fBh+Z17>B0Rvo5bjc3a{nhaB1NJ94I z^$aknULzY7lG8694x{2IwkCqS%S7-gsC^fGRH=ibUQcB{QbT4h0g#LnZ&~!NE!Vjn z=ufLuS%Ml%dsppSObLBW@?y6HR<4S9`_;`lYMbS_)zd~*J7wdZjadm!_9osiKiE~U zREFlTQy9+=7Ci68<_np6H0YvwcptV8uH?H?E8p2hoC77m9h7R(!nl>y+QbT>}yE322&P;?HZIh7Ve|oyzK{f)fW-87@;<5@2eX? zZSuiG4a54#gL;`d{q)XxMNoO zh45_jvpE6wgzSPyC`+J=T}z#E#X8JrpK%ubN%_5wdZ|0=EWk|6lT?XH()R8MK=!Jf z{bS_F|1?qv&pe7PB)^Im`EzEgm|omuTH+BvY`8*RXCpEmz5A*H_NY_j#LxS*#OW8{ zmH!v7zrZh$*~CV(-)!bT#XZc7|HM6Ne;v-m@c(l-f2d`8cgQ9X(_#d+LRs)ynhw+< zh_$4}3PP(A^!3Q1g{bH`p5QLaD9d=FrQDVB8cn!>V|op*X54*%On1$yT;uG9K}|B>#NdZ2da3 z_y9neB@A1i;gjz>!p3cjsW0%haLm9t=(GWeza@ERr97}=zMqLJ11}w2UoSFw9a1?HFI)` z%qXRr5seG@0+OhT58V)e=QpkBk~RSDA1=)vGqlzr$cJUsb!nVC?^iRli9dK15uuoI z&BR!j$SH$DXBzC@jIVv!N~@q#*h}Z)AwkmzNK#>jv#($cLk&sqzl^(XT@+_j#Q+$1 zTZo}4_uS@+eN}u03Je0rAr*5G%z1HJ85XIeI#6dCt>gMeJ|`I$UICe9w^Ya-wZ2^zhq#_kDqpi6*@F&~@`&PK2$HHT zaX5!zJp;!|vw_GFQd-mD{)~-6k^14Gnbia8ME&ECv8zNPi=AFQM}D77m4};vqGXj9 zJKvtDPe)K?_Roc%mhA_!f-{{nRPx_u{CH1SRL_c(o}^}XWdftRm)JeRA=Xjsf@kB6 zvuzgHK7Lv&IHzaac-fIH%&rs}&K{k*!!v9pz_?jWsT!`PXCgpppg{}q5>eTp*TAtb=gv9f9D>}@7SXQ4ZlKsgWZeHj{#evd6)YVY`4VPHT(b34GoKZs`Q}+Fn88*-Zbt zSB8!GPf-v%$3G)kF<`y>|8D5~^uBpx!s->x@mE8qn->}eld6MK$S?}BvOxkjSRMq? zYaVeBBTVGh1~5ShoS#7y1{^XFn%?;lb$C0zM>a0Lheh>PlMM`4l^;wYah(d)(367p-f$T&O zA^~O}md6wy6;*viSdKH#~wgJ6j4}9>ogOe!i02FBr@`jWT_s@cHx*le3k=I1clU@Zef( zVYnH|_~}Mx9IMx5*G)pGwGU3`;dz3C?}u=Oi^5Cx&i7f^75q53q6YJ9!(=lpdXBhb zGC^xc*rY9_q`A>H0EwOp8`s1t;qqF|ax!3rI>t3yn+~?!2x6X^It8xxd=Nz}u}QX1EYeC;Ja4`0cxi&xGgRmR1+kg>_r>sG;4 zg{&!WCFOncQQ)ADK4(-{nTUYRdVv+F8a%`?q2Ey6-y3Su(60<{T5%{Ut_v<1W36B zfA@I!cNq6O0{6d1VzaXTGi9NhI38EPh#Yd^2TN#j(Ykl{Eb7tnjVD!Wb0%+;}_mp*K3k_r_3-{ z@2H2Z1qPCmw*A}oDwmU2Q_Kme^w<0o7yUk!&ZHfmB8{)F(4?Uw`g>y%zFrt3M>TZ* zhvI(8(&(XhMu_GF13rxmy(RkP1NFFzE1xwQ*mC2;c>pPHpfv@*O2<~?Yj z%9jYYHhuzsy6SQlzxsM(`nU$Ql|)~tB3&lTX-aaTd>QBoRhh=(&}Y;0>82BzUM?MJ zGo}UdA|3Zqy%>U!)O>25$IQaA(tfL_nlRcmk)oWjp0_@^_uYmE4k_iO7QA6&GmxdvPr`8-T{Uk%=6b zeDYPGOAUSJ-0dR_k<|EoUGoRHZ{EX3lT$2s%>!}p40Q=uxi(63c3*q)#k{#*0Mm;E z?Hizi(~w*ES_?nMnY{ba4QILrojpPX{bIXB@TA~(c8^Ztwe}&39o`^1GnauHZ6^N` zssVmyZ)63_#{BPK^#4=A`^3Zw1PK39zWZxbJW!}j+|bt21}F$8Yv^JR{IawIio*T% z`rq<)qW_~gNBe(%_(|B_#^mo`PyuS=xENayG059H*&5pX{i24crMZO*5yxLralhBU z1A@Ze>)$bGO8))FOpMI`LplD>hxtWCvA6Z|U+ zELk`8s>J_d@13Lj?D{a@#x@$;{KZb1G`4N4aT*(qZCj1)#fJ4leF`Izhrp+pDBb*K{vdKxH4f1^+50Q^89Y4w_Chok}z zOj9GwhRCNn>VD{NI~vC(wAlJk%FArg=-O>^XxuEe^+`!7{q&?n90Db?)hPv7rw&HV zt;mGek-=9brH_P`yTckry`7!+vgg<|w+WnP!#414GsdUT5+jqmtyw0{zMv zm8@Z|qC0eYWrO9ax80KByj*tI!@U(aRjDk8g(Xw(53AIpiU zF1jGBzC{mm7QkT-qwTu;LXW z(*KDQ1;sA6eL4JxSO1=yJ6vc1Ev{#vf~JpKrqTCacM@FMpk9QT-4imJ^vO zG7;-y`;+Wf6W?jVgLEiD9(|I2vNiNcXN~9ql}J;5D_xCfc!>ynEGMd4YTc-^=%(Wm z!#8*cKI--ALZUqpYJo-RRb@kx$VZr6Cqk6g%AM0Ddp8&`2KMPQYv1dMujiNr*1>gt zlbxe;H*G59CE}SmGj~%Yuv%R;v_fw$Nb1z1!(3lK}VC;cG~INs)MQAz1(<7G@c^`)jwwg zYS;9HHR>G0#jew(+_|o=&rRIJ-;g81HUNo#-({KJ>vOWR{Qa!;=5xk?vi)ZcYQ*X^ z{5Sf`*Y6;;N}1r3z@%aVa5;|q>p*b5kd+WXSWkYD!ruZ<&u=lVBa;`C;1wPLOvKEv z4}wd&8xuAIA{&qF5Aa!5_{>ZYA73b#iAqet*(kr+1p3c)HWI<*Yo{qnRreTsv#@#(Bep#K8u&~yJ;VD`(7Ey+5(2=&_D4^kXEzaJt2<844AmhrZ6zCZR@pEcdC;DYJFmjv#XMWql*O*l&VM=KDmE_i9H+^``9cZl>ZrK zaxt2@ouh4ql8#dmSP&~p5p*e3;M1lwj(eavD(L04z-tPnp(cZ zt@GUSuf}lPOFBjt%%JEwVANH(l%tVj#ORLz8=!_Y5kLx9_E&k!2pJp%>~ekr0OFPS z#x^I#b6cdD5pP&5z`2d&%`jZXDPd$2Jaovfz+fyWwK@jm^qS^t2n3sEBX~1o#DqN8 zVsf6i%&3nLQ_$#3z;t*ZS4XooTN=KMuwp-WP>|0UoHbFFq33yPQ&Y9Bk5{bef|CrV z=wmJLOiN-@CT!bO?I?!eEtlB`2DN_JR39j2QBxA%Xnp#tSgMav?V9xS@kI1PVWpod6ZsfKWsJ4NjT}@YW_im zxmnn^VXIFMv*6~XFdM1vb$5LEXycL@F&oFJ`2FF@&iGZBQvcd9=)|)>ssVXyVh{Z8 z_8y&jC>l_n9jO5z+I}EfDz$PaOzhK<^_nkkW&{Xev$?D=#=XO4scK zA-M3tIuTL%dqaO8W%0 zAignO?ZUJ{6X2<+r zRCcFVH#mM>2y<%x@JSV)!(y37ZG{&5rKFdmEx{)gbfxxdijt`Obr6+NKu4Xv<*~gI ziF?a%g1Cl6x-YT;?dW7sV$msJRLybaOnt^-{-#KEMWbB_HP<%sZe{&>!~)TZuEM7&SjV7_+6``1>%~H_P{1On!M}nblj=+f;M*VK9+|my zc7Z?dD*p7F-Q>NlGUGq0!?k3G&AZ=1v5%;4l5l*tnH|*;eY2R?KjY7gLJUkTq0PiZ z?fAX6tFj(!RSwf|)f~gd&o{9enC@edOBzk|eOdCSIq z=MrG}d&!iR{2wIl|9d1Z3-fzDES5ir)<1~W{|=({t=j9Ii}??t^?yF1^{wjaeZBt& z(fWTfqLul*rr{q>;{O~@BJ+EVyFZ-7Kb*uroW%ddoJ8jLdW%f|Br*NrB>u1BB)%16 zzVGDnhm-g}%1LB-uf_BS2l)RV93abk4Xi)Ns{bpIRV?o|-5CG=wpc4#%Bq_HG2k{$ zKVg&zm@7D46q2&qVlecj$O?YFV?n5dq02COS;ae5Tx;P0@obda*mQQTY!Yw3CDrH~ z9{88IZliXNV4Ge!?3kUb+N&eVmz^06f$#OFr=k7DEZvgq5Lx)_hrKOa-08FKy>Qvq z(%I9-{)G~=Um#Dc<~+Cj`#^{Vyt{lR4)Yr-p8Y@Nep#ks)_#1vk$3b88E+99*y4~d z+b*@KY7?AKMS?Ps{9uj6KT+i6w8*Pg?)P+vyFv4@19Lc;fO}1Z_ZTD-Inn26K!^-- z?F1QOv|Q31GVSW^`6^!;3O-21YAivkDoZ#)t7O}dY@xd}&LK`sPxje;Qnk_rp~dDC z+v~$z4q`_rix_S*GqCfZe6o8TnJtEh>Y~BeuU#B0{97y&?1B!x5B<@i>5j?4F zkUc~n+h&>5*I1QwA{3w)Q*Ex|OsrH*R2kM)LZ7*#bFHh8S%jr)x$Mezxlq3q5?@yk zevRT&L*y(fl%jTLXKy5Ctt(hY;50V`@@T})-i?_?AtBPhDL{C;dHpq6O>x-9c z5)91KN0pD@hsVDh|LBc}p6ZYN8KDfJH~ZT;*~SR@O4imQl*x7n#ahA^lQ7>?YNfdcp$3S(*~4AK|rh8jE< zklUpbvBfj&?62?`R58{wr?2Mja{JL1T^j5X471;kMfGc=# zuMCEFwBo<{TH^==$A&Ui)L3&k&i-tcNp>*7f$5n@=?=c7B8`By<4u=eVvge(BLWW> zP)?z{KkUr5HT~mgo3fhdR85^UTGPYK(@HXv$$3-`hL<#f;Y{9fCr96QG4g+;dW@k)7U12D`kC$n)-~{N5PvN1b=DZ)cGiD=RwNWH^%nxp|1Wlw z?l(UE@k_E;wY$?F>AK4Y0pPNs6|&5zVd%J0KVgYDI_{9LqD@yob;MzqksN8nr>Tkb zm3z^Ow?;o#=otqqR=D@fUS!9)yycgr6rGbI>4_d#&ps#@mnh>YpQ)ZP_54Iy;|#`d zJ=*#l?drM)T^Ayi(RwST6OypSTBq$5`m(?95>v^65$aEhfcH7+S?@X=--km&rJC9e*Nwvbgg3LDq+T+L7X{Jzt~b=^Dm@D0wiJ;a2Gxn)^~j%zV03!BBCqM(zPOAdmssC zga%*2^#gjw8vj8GL>l^lK~1r$UuZJ;$^n(`i_&mMP%uQG1(k}fOPJITc~~USBLTIY zcFvK3;?5cqn7M)2frdzvVTtH#^in9x69EW>3Sb&H-nWR;5T1cEl`$Ka@%v0K;dNAF zdgn|e7zN+DO)v%nb`c!ZO&a%n%D+Q`K4eE^||znI*2kP`Rk|C?ct~vhnw}fh`63~1o4OywD#z#A;eb1^`J}5cha^`0xGA9 zCm$0%^9ziuL|$N>7TJ3uC~6y(BYT#T(DlYg9rH;ChX#U%mEFJ8`)f)WsU;$noSl$C z;kNq|Y8^{S$uJNq>mDdb8a5=!$=G^`#}1hO;0B7JI|Shbn#5IAkqt%ELrP7qz2DK} zRXB=)dWKDD+9OA#ssqt?M0+fT&Zqrs+(4&t;(b%NvABlZ5b)Ei0rrRR#WFFdUh_;_ zUEvesz&=csGqV-VIP{!7i~78GvAg?KTB80QT7qg_4(`KL8Km3o;PRQjd%QtO*oY&p zvKP!rsCkC77B+ac^D7cGo|M#~e%d`}P{-W82%#z88ZihWuix^y(eOBZOM=U5#Ori9 zSmSSg0q^zdSlQYBHp!IUAZOSNkgem?cix)%-)`CChY0UqS-{lEI4~J#;FvMQkjV@? zK1G9)WO{@1oip6ZQ$4w)*#ukF_}?WZbNCc?d}6udmHE=%D(=3$o5%K4ZQnS ztdwAo8j@rhVw6U2VkT1H@QDJp>&`S;!`(L-37lc>HtIX#>IGA7y5joddJkKH7&&8y z7`2I6dPM>zI9PoqO{;c_soaOcF;=>kJlFo1q3&%{E~~LVW$iKQkot5dNek6@mfh4~ z>jKkEH9U&h4#~Ucby%Lc0Z8^}84o;K4*suBfg@uWF%1&50K&$h(+^lls?YBDbs0@P zP|fNJ-Dsu3uyleno-YqsOC7=6Iu>SScYbkbBa7bE?~2)U2`x7HL@23 zrHP|mDlwPb1Ct2-!UJU@aKhpa>Wed2>}XC~rnx2v7vJsQsEkge-}cuxZ*+aUf=TT98D=o$MN6%Lb_*7>Ddl!rB{A!3pgp*80QiEu*Q0a{)Q& zoY3xgxC{VwnhO_0H+GnA|((DJ-{jSO-w8@S=H%{o5Yjg|mQ#Rcv1MZ z4}$LWI@4j=epF=hI?z5|vA1{mF>6}kZQ1{`ChD!w;JOw#ppk3=+$(#QOD6d4Anoy5(U0=pBfpKiCC+(c!fWD$#Oc+6a{l3|pUuu3U>C$=-eD@sc zqQ__#Ua%Mald$ufp7===Xuw9647LHz)0bw!C4czV$~z-w*;4XG9-7Op)8Q%OU(5yv)Z z#5O@8<10n$y!~+oHV}A zLjzs=CVTMtl&&(2ca;xJpa%$0C0_9D(>&SEpf?;F|XIx4Jorr+yKgSq$-P)$-h;kH4`T)3V;ym*Y zwxWkUh!rD6x}?Bau6fA6(n#-tLQ>a<+?9xaeUayN@4F$Co2T6}(v4QtBGAba1X;Y6 zCS@W2sOiunlt!;w0RI)U=o%*fnyPY40zp-zk#6wbagg0-(0pRw+I6L0LuCb7BfWyt zu5}0X=oguY$?mf7)@!57ZFG=@6PB5b7{Xfkh#|yhXLP5Tw2CE&Qnw+f{MDz0Q)VRn z6(uuQ*XZ2-s4bf6?Zv9y8k9jSs%gS&@ilVI$m8T&0Ajz?C_*reRL){Wb}xId*&tc7 z(aH*08es)bYY~t>lL8tL<70buA2>uhNk>4X?|~t2#hAy4Fmv6l#7gh9C?Zy0e6t2o z9a{r}rmypr2b3(T>M^c-{=+7e>8~b;Q0VcwCCl=?b5lzCNLMR3KkBil&ji*RkN$TS zi#qj)h%5``L@t7UwazUjqe8}o0NCqan@5AGV=-2$100Slp&8ZT5H9d?kqBfoydUc! zgc`@UOFw|Kg#z=*yddK?EI6I^u$-hul~j&=&2qQis^;jVd`NNQ{~CjiyZ=o6=9?SxSqGQ>n7C+2AdQ^GyDk34{h>#b0NKY7b4aW1mu=iyN4oT!p0t^rN(+}CX+q)10fUs>KaEtNnHFY7F+NlLL~UR`=|o|O73k|>d8-E+wOhU@Nc3k7dh_hOWs2|-N1mH}Bt@buWou{TlG z{QZDnG4e62$Y;59O5qHlz|xjvOpp*;bY_iQ7|T3R6YTC1VqM}*Up)+Arz!~80!*AQ z4(S_<+^%(7G>vXKC}VOEY~O($*;8b!1ltKTp90r`=(sU)!@ECD*4V0EOPp+WFx*y+ zKslAJuopl>MPJ&DUm-nG?6BVzH`DQOP}oaoGSWfla|+N67t}yap-eYY8Vcq8_|?8H zIOI~D6E~*0E>LS4dchRj8ip*BnP*TUh0A&(W)h|8I#@lTOGBr2W%0vKf<_6yG*O7? z7Lo7sL7gF2LenpooL8x3`WNVu1Wxm?Spoq}U6ZuDoIdu$C)O!|o{_x5JfijDoo} zH6oaKT=P`kWxwlok5UIjV)K zkw?78s0ImT1J#xi`L1)^SJO0HbO`&Ou;s=0S`fIIognOgDXv`G39k@8XmL5HZg~#O ztKh$-Rm6D>aT_WBrr+Kx!&(2WdS0yhE%kBvuS|9wwUM;FeEG%gmt|DEheDOwFJYiD z*g-%WK8_rUz()uMuvBsP*^t%Awl4+r>9>e9CT5R;->EI z9txtMABfC~HdDV%+uVzKNi(hqN&fI&P{vC8_<>ht*m!c!Z{02uL0aphFF_SFC;F^? z)0Av5*mvcl@Qby~&-;%KsQRFw;WLfTOu2IEEiR;RGd8Yc=BYGrpU9zHGqXq8_JH%- zV#LfHmmxV^1iluDgL~ksa2P?v+3!FE{Nit6iDi|!@(|Z1mFkhH9!RFx#X3;sTmr6a zjPY?!#|UFj0{2hvSS4rQox*&|T6`iXP+{`^3dOut&TMch?kbGMT%w++F~@QgaTNb_ zdw=QemIU<$#AR_b9L2aSsZPK8(IVIi-$p+kUWdxl;?iCP@(oVxXtwYAWqv>1B z2dZ{VqjE50WHI6>>CdvIK~N*o(Hn2M zu-wu5a)8cc$J0cH{l<$GpPwIYgG1`58?#8LA3NK_Pc~)!4bYtRy;`4%?e9m?w@C8p zx1_V5N2r>g=&*VmG7`m&HoRWHi2G&6#$yXIv49&QDv&zDDgkHpT)~WX6}xdhGpjVc z;mo>4=`;D&54z{vMEZYnCHq7iW(O|A= zG&Ta9yCm$}L*y!Ix3tJqJ^HM0TIBM(8o0dK;HfgOJJuH^JuE;vza`35G&~LUO28Z< zZsUFaVekoDXJN$2A&6%r2yG`7^N^kizaWu*c`zK|p_XBLy`^{$ea925WjS;Ah2mja zKgX*i1ifa!9*Ejw9;shC@3XR)|BZN=NAWF}kw%51&UBoLmG>k+6TM!$ks<+fFH zeGzmu?{b3k!^>J{0ku08nk_oSdG2TW3~G>ZTl-_b57^Qfc$7yTD{=^fdlYjeErsRD zRj?jZc}I4YX>fvN*|hF3B-H7P8Mxb9Zlncb#!a1t2Q%hfEn;Ioj;!L3h_gk4AMpbU zw0|t??6j2S|K?xxUe(IX@ONKTNr59`0RVe^4ej{}{A`N{-WPTCwZVsutC$;A$ebMq z#pQzl>0cKgG(i43Gb6~Zq8&2!Q^PB5b3TtBOZe9t_d%UtawP=)vqV4z`{KDun_*)% z8TSWWFn`jr(5Z({36r%Mx0}uz9kNqoD*;-rpqCs2fYQ%*8VpPtm%B))$!q34!;5V6 zed0RvQLLrq+}TlDWN;8mO#qt?Hqqgy1+M4QB$j4Z?hiaCGWOlH=Q1!i;all7vDKXu z1~zh~gF4#n^1%7my|#BMOQlG?gPBo33IrM<2xfj(qI_%bKece*&}vtTc~wlQ-xquk zph=lm0i?%Drg+T|DeL>V#>WHT5&DI#Kqa^7Vslk}y5XN(%1WK_un z+J+UYYBC&C(z45tuT%V@Q<8}t_6{o=3kO?^Qd-U#gagS$7uYFTw-E?$xcxcp^<8?`JR@kHVNW;Fqr z49;d2t#Fwu)e6zb`%*At!a%O#l}}eCX6>tXOE%aJ$8*T#CB(){RSYokPR$>wH?-@~?!8 zq%Ym#^I{Y&o#MS0-nyhK%;G*2PDU#1dP1klC<>|@nvaxaG?gW-(BjuE0@9wd`^t2U zU9+{R%^hh>M>`oYN!m%yn~nO(4fUt2dt*CYcFRg0ZVa1t{M!eWX>=ui7|QWakNzYy zm)|kswNTna^eQb?UhGh4u2b84;3Seg=}AkrMS2c{Khl=EO`()mnj&L_unBIiSYdVaJ6WAf95X`*Pjv^jk;#O-eBb-YrXafVl*$623Tc2A~ATCz#Iawxq&B~+^z zRW1ejmKzk!U**Vtnj&_`H#{RQ1nmjyBXWc z$b{_Y8c|viHP9P!Iqp_QKFq-lS3Ts}G44_shvdMvfy&IqP3x``rMCLTR*FWl>5fJL zEP~K{tbiSS;_aGFX=?8Bgnk}&AF+tg_aK7pOKN^sCin#-OQR`&$-9_NJ~JJPgzZF2 zy@HAOH5rq`;j0jQCZsZt!}N@Oc4e5-7oEf9&X8-32i}OQvDT#v9VWRX!n;oo?&Phg z5y$Y9Ctz!82|UY13>TM5zxM9;?jP?F#%;b&{$>%s*Y^2m##LD7UxE$fHMt8$F(j6m z_K~0`_xM%l6IiQzy^+F4KVL=EK&}A?3T0?a9|4Qt&nb)Bge)K-gsTr_vs)(_xr1|i z2l0iklJ22etQa7I(be!|1Rqx(nP=p-#Agev@ci~Bl zUUc~#(bC-Y-46jIEr_8CN4tnMV+`A(#&pT6+mgE!jS2S{VWF80aUe*SwP}WA){g&3WrY%LKTAJ=65NOjv+XjTf{p{&)1F~ z@R2fN7!+FvpElq&Cxvy<7&T6z;ZZ6}LR2}l*#&U*F{S6?d@Nht_4Yd}+EuDty;vqQ z0$=JT|8xa^Sr6kZ==BIzv>Hf=n;F4xYji>g9r*QgO+G-;88XGqSb$`+o!X55xTU+A zHCb`h~W>fdTefu$+0QT_xh^_SgQ7Hq7vZfbISuGEIPMQTG|*(fE)H+&@kM5 zefaW^EbDtM&-fql58J;vUwPFj z{IqOFE)W#{C141MKio&04TJ@<^IQJ6tQ)I4%DkN!CF4YodUhfrGSKO*H=VKWGBy#LcB#Y`SSoW2TXc9e zNfo`l0ud#xeMmqfv-v~a^Qo>xu_MW96Z2Og4_Ua{tI_ybHO4Z@Y$!Rm+9#SN+;ydx zi!u*4ch0$ol6qXffE}&r=CUBohGY1nb}+-l7l&yAttDt`*?wfin_Wguq;i@4Tqpm% z^~#>Rwe_SR<01oIF_FX6oMeBBd6|qC!G2oZV4&Wm$(Mut#?>-a=gh~4=KNZx@olZ9 zn$mnXBDdR9s>1AFc#a1(T*k55QKcAUL>=-*aH7ex)bHveBkt;^l_?c-&Fp%tH5&Nrq)Q!>n2jV4>CWo|l0DA(C=6t#n{ljM zqleVElNkB*DF|%!Sfn!}FKtbzHTLtHHN_`+4DQ;+QnnatNq6TlfW%sp6Zo>wKCW zByOWjL_OEMlSL4}vA!q~_{ zh^f%kNCqu5pi)9g7h_7&+^qg%ARFI(WaV|THiB9+&H0qWhw!T{4x;JV>8Ku`yo9JbY`PIy3`OLmaFBiy~Er^ZvK=qS2(fp7uq zvF*I!fKUgo=@oiS;~yOdmbJ?&a8HUtKIVQn?TVzP%Vpm|sdhk~u@&n1h{Cl|8LyuD5arIBu^iKuq`7rApe8G6G}o2T_ahNp<)X$; zwmrPw`U>9U-k5>ubnXj*Co1rA5KI}`)V^cehbp!ak2`&yCi_HYA0QY{1oES^96w_p z+;M%Z@mBgUyh<+U)~uosO_-S}yUKR8q0R@67vKOylFHvq*7y2nEdRKt6H*i_fAi0N z{^g%#zU5A}QVebGy(~joI=N1EVb}nH`J;R5f`u}JQUQx@eB}AbX&m?iq0m!M5EVV& ztCbINN(L`~y8ja_-<;ml+uat)^Jjx5(Fg5hJtXR)9rX4{^h}#vK)p*)y-aAD?k>vP zm-IdC@~xoG^}GsJY=7!5{aT>S7jUEGQycf7>l(>}OnAFWB!CA-0`t6`U# zO{cFLU2YiQH1%QD`X}p6I~xo!!RNpvEKs@|N2M7iDwnf+G*FcM(5jeJTo;k-qK7(5 zE8WGZSXpdlN8y{4G?iD#30vhPF&iNhjP18cH^(pckWNiTHqMCE&sxyP&4P=+3>o>u z!zjD5Djv+MY|xgu;y1yYmw7AIQ|f9~Qdy1dx|=EbEi5G=+Sf?#?-1Cj^m&|e5Xwee zd8EL+o*+*>3^v!6Tgi&;X_2j@!PJr43u&HlG%I081U+DBCmKDZaCJ?Y=jFQ~6|LqZ z!s?J-*5(HZ6LPhcVp@%Hf01gC;F!CSN)}L<{o0XOYq$~%>4{c*fCWp~qEkf*!-X;>=QJg3eySh16=QCJG7*GH=`W4BNKSnyiWKqyZ^d`{MHD25Is7Xe5_&Y2J zy5+>=+)UUPI>z*8kfW$kGz>KKX}Hfj5Hv<-AwGn_sCMp11E5&n-V(G=^wO1{E-5Cd zfApMD-aS8oG>T#n{$^^v*AQd<$2nL?i6iDMGHB!;+TELK6MQw7Hqr0;RpFyEB^ILo z*75GPC`J|#E(C`^WmX45eaA1b&L6v-2uw@@B1ks4w?WKOtTvMS8|SPrULzyO%^S6n z9W(Hv=W+n~eZ$DEW#;=2mF>kFevh!?+H}sTBz&DCz(EAfF{<&@N!ORG^-3u-(IVW? zz=ls04$RKjdiR{zx?z~%*{LHAWZs;+vkb<1qFe3<1NGG~d0wkUsd7qA`e_u?XbV{i zvS|1d$p-Tpl*OZ|+6$@e1~A%X*(5V8m-3|2{SCy2kh zEOsAKn&?>8JYI1~Yx94(N#!bwXsecjbX=QTmfWUm=jQEOS^l)bWzVpmY=NFpxRkM5 zL*$<%!kb4mb{*v1&`W`g)MXuN8w++gww3%1({^v2;}$!Y$T^LsjmT2+ahP#+ z_v>jXeF=4(*Qg}Kq4_rtykI9}@;2vPkS=kO)`h6VyKD$!yaoiW${10wTPfm%<={Oa z_zE?sqD#irf?5w`_pc4UK{KRkRI&UT*en|&KBHsTDN6;SlXFHPX8S4VpqezvX$iSx86B3W zjGrh@>h(q#qi)jd^I=GuqL8m1;1cgPxC~a$hI%jgwf_7B4ZB;8m1ZL zlvl}lPm)vYX(fwg6Mcj_{uLT{dP)Ot#Hn|ht@hyRPgaH`!x_`d2VUqJ9oK0@v-PFi zVQW6obz1a^K%9aZKjG2oeEFrG?}QJr8$kM-$@^X}kmVomw%({d$VZ}o>5}G8g(-Y# z{s1Wn$t1m~K<@&8=*71T$lf6RCl7(kty67`!QiZ?2{9?@ z{XzV0(a6Y+$HoV8A%6hlfxq5SgH0^+91*n5A_@-_2 zl8SquP9pMcRoNm_{^-Gv&}L;(C^>e`2%ElfXX}p?d+@V+8bn~UodnB6i?eY#y68@9 z+_%u632kwmLvC!SPHZ?XSC=3^0RCry$U4P~jP3YamVEY7zk`T*0)ON{+T#i@&+#AQ zzh>(f*2u#F7jF74XSe?Q2MkDx7!d?rS;wpj0K=~DBF6&r>8@Nv6sg}fZtoV=W35~6 zqhF$;rAJeTj-&QYj0s0;Sgmc7>YV}`G+7f}aTqPkFU61N^7+MZ^jCMegaGi|zED;h72eAR1aV##&BxEzRr?(A#+P z6vOsD$nHXAs1zsN$+7A(m$z1AXqHoM@UbWbE;(lgjs`j<*Vy--dCK!8Kc}k8n9HlS z(lA*V1q}629nIA7USD3UcW-X^#=SNefUf_2?!5&!zfT>p|MLK<)D%s^0Xs7c&E5h3 z6v^XZTh&$edIbG}AnxZV5PHOC9+rfvMR!kPb;>NA*iuB^|MLf%;S3pu^?4qbqupi8$!5nBNP&@J4Dw|5o!mWDjg z2}4;V>(w6VUrQiaxknC-GZ(+ev89$<|r zug4&gXpf#nPb95>A|uVdQfR)Dpa`Q`px!h1iO^xJ9%d|K)^286G{q?O%VIj2RWI5? z5ecqIwr8MVdlhPB4q}nHEJ@>IWvCS@VWrG^*9&AsF7o2{GL*blzH0lDS_xdn3jc-m znIeyzP*fD|R>PI=(e07Lb!%*R*F-P}L;MUG5ZX6Z25qfqi%mWG0X@D-OYCFir3;bz zSlXp%t93)grbf(`j8|H%4SrJj)R& zJ6M6(X%yN}^C5?eI$UcUDswt3nJrPu)p3|@6`IY-fAl8$-rLl6$e;RL1zhWGl|({d zh}W;_QSKhOMARzjK}}wBA2m8>^)-F-fc(V1SH!{|?9_3bC3Q&aj$igO2M&U6Q|dZR zm(?t$Hlx>bZq&9@H=bTE&Be}l8vdxUN&44VG_Xvvm7lsex5q_C`h!)Fwc=&6+*5%b z8IQ2rP^g+t7uP|hX7?QsD>Z%$m@c07^ z$%Q{=347`D+U4H;8#rC3Eu`W%i|)OaA`{!+^N6(+Bx3&4^<4+uOXj6BReXT`>lf(l zy+K0*HhJQGVLQ@KqP~7Jr~<&MFzu#dm^cUEUg(Kkguu7@a9I<=@`WvKAC!RYGbo9G zB|WhKW?oIweijUyV%WpYivrEUH?ZKH|>TH5PP}BDj2;<-EA!lu3e^^jga3Jm^=xgJj*dSo7MbzovPG?}mPT zh#b-hWL%%#c@hT|&ZYpwh7S12X8Sbe%sG2lv+$^GX1T+})GgAq^fh6T-*Mc3D3#t# zdmDb}Y8QE)Jh2&Tw{nvAV?V7m^(T z$488+*JYBV!N&tx4)7UYuLYq5qbm^D^ezuzw`O937y->`^h?Hsd{!oid)RTI=Jwld zt+E%pQ|?G&tFTP>E_rqrra8wH{E{mzh}_sU48BRTuN4~ABsgR&iysxGgfZD4So@jU zC+_AO;#~}fihuw>GZ<)GlslI&;$uixfI@ZU)Qu-05wMyA4O(gg0fxui4rmVOzA zPC8d*c{1uS#kbLvg@97Xam0+1=30)3dgu0d-?=1ywHEn>W*4cSxH=T(;kc5H4Xx-s zgKVyWm%~(awA8e0i_!JfEoY6+YZ1N9T)~5>osMv()N?=S^sR?~?S6|d%R5S&urKay zI~0C=3FVoFJyUHxY9!yc__5}BpGsR*K+|l3)s?y-zkc~rrdyJ{ii%nI-bV0iKMo6o@nTg+MZj97d|Gu!@B>0zf zmn@sZO=#4Z=im~F!*|OED{Q+{E708bAm%9LjH#wQzFj8INS!VE6!bN{-%O47n#@dW z|8Tt&B+A#{Oy)h*_D|I9Kx5N|lQf)fL5QL`?NSD&AFv@6NFfIs7g{@*(Kh|@@zi~& z3%Ayy7&WP!zo~k6W1Fqmk72G;1#PF7lpsbd6IwniHRFyW=A_PRF|^^PIUKd0fPU54 zW3uye3KE?^4WS97?#5zd2}2t$S`s5GmsA6Tp7lxoZn>n-&c(mD*)RH%CiEykh^At@ ziHWO|FQMx>f%7re$Y3w`QJ>6jWN`o_CO9+zczmK@XcK5wedZwnxlA=6a4lV-E)?rh z-{b^Jry6({yKdg}5`o>3EVhZHd7OAdzeY12HTLAnG}2KR_bM!kom~JO;__29eyIg~ z6D>7r84WAKCF2TfM%A1V_St~L)v>QpI_9&C%X3ZmC5c!)36s;Wnq;;&kg zM$fG{Kq$OxpCQKr?RaI&4(&*A0>Q-!tNnc-(F}|QksG~hQc7if+1q20ql7c5BxC%z zrL(PP52~{}u9vV^%cxwY-;CjVEn@}-_P^J}2`P(}lW;(;^uIYB3dVhVgYw_ef1LjK z;zRgCRq5yAe5cwGm=6xa29~zaL3R#-zX2jKv#~~8o;dR*Q`gvsluU|hnEbW>g~A=5 zX-P zD(0`M??S?B(44v$W~9t@W`d8^MDV6d92%b@v^F1uPTF%RG=Qli>g*Ot#m_w!n&{w^ zlNvNiTS|i)J}}LJ*@ox}w?7HiOb1KP*{#`Q?o`>kO5(+OtmVdO>Ly#D`1Vp%GHcr! z;bu-8<#ZWTQKczxjc+uJS)cqEU+Xsnp?sq5s$nd%Opo-f>LO}VGPJBfpXW=_q&WeF z!jR)kLo0G85}jjdRsy}-zCMB3O}{R!T=f1)E`rIqRxsqSxiJhHiVIl&P!?A60s1o; zVzAH7Di#4FMudh7XL2h^6as<$qCAKLEi1&;vBFZk(Ka1~Tq>{~=q3n_`r28yZ3r^w z31^)?L=~(zn?|U}#1vq!1TkmWIl8(BHu?w?0y_W;StT<*Km_n)wizaG1jg zYM;ua69sh6*3WC)HqdcmV~^u&L8C23#L^7w&ke)fZpO_8Wi13g8QoS!(NX+3+>&!@~cPsjwyK>F14JyAzJ3FPN&tov$?#*%B_6^|%-d1dKm!ggllvm z=%xLT-;DwSdzNQZ37410qq_^7CwJLJ&v{n9qk3*U5+!dnnd^q_vuYg_7%W_Q7!O z`akn6yj|JC26*)KP37BMDD3DzOm}qWfN;4~uX$Bm?2>D#)i2YEmJz0(@aG3`krDLh zFp0kCR~nBG^x9hvXe}7!f6&K_>klM`X!eNAfa_zHi8!97qfkj`-h~x#j%={m!?Th? zm59-3zzR1m6Oj*7n*Eq#I^9usmrl|WMEAt?#f=7XN6;K4us6wYy*6ooe|OY~3MhA7 zZFa3V%He#a?-&#-4N#M6n_xQ@oRyEvwy6ZkGZT3y+9zb-tep}&bog~CKu2%dICwE)Z?YKANG`iVyy z#4A*+;Uzw@r%wB#LnTcnDo!)-Ub+EFy^CwHX5EdGak9v|%Llw`%n}E)a?d_cx^=Zb zqv6N?2gcq4D6THu8V&@9;O_43?hxGF-CcsaJ0!TfySuwP1b24`E`Pr>bH6+DPU`-l zimI+YU8hg){cKy$v(^%b*{*7j*sgs`kU^rz-oN-73M3tzP0RZwby>o@`N+|gLHx2%$*&Zfjkb5Sy0iP_F%_3pfbM^)w6sxmKIfK zPa)TIyTI_9zJm7iQg=~^nK%tMJB9NxY*;xiKVS;4Iu0K=vnqa`5E|&^lS&v9ZpsU7 z=9@=cn#wOJa{5s4c#4(BX*|!!GE-U&0v%95y3*SBh z8{6vUZopBOyq$KwQ~z$Olg`tumHrwId!O%PC`0F%?d>y^Ps#aj`r}U%8h=j>ODh26 zvd z~Mr7`&CTVC}bSj6R8_Pk} z2A8Tmoot4J{8FtSbThYz6B z?+P4diA>d`_O}&i41k)qnbHBy2_Eez|0%B>k=7^AgU!7Qqcru^@SG>pDgUmaK zMKZiETF&9NFqpKLv9#Pd07RHh(cpc5&>gjc zfM=zjyx~1lTXA5HES>u*a2Xp=rF@uUcd68uG^k6)87+vWJKOeKNx$j^Es7HDa6GSN zx+~9AzL+F(vl|$}ubC*7)lMKX%xFrXoo({tN#{MhqA;0>KE@>aaSOUv61?Q)0r-qP z3|~c{Hw#N99EbJjYiTqqiZe&d&4aU1FXLXxb7mbQ?`(AJ``oIY1QPq*rUfi%BNB#C z)%#OjtW&4`66ebMtT`^jRdGBV)${jHx_(@qKKwd;hR(fOf%{EN{3!~~ME|!^rtgvt zfKsO5hfIIyWzZYmDXD_mBS1_b9*eU=QR4C8=MdnV^%83Vm4HClVoCweEo_@sgO0dvt?jv3=mS{EU^KBAYZ2s5{Q%RnPeaFB-|VLXtR>S;6eLnApy-oTZVh%q$`ff! z3VM}R6i~D7%@#!kSnT{f%5mQtG4Rq(%k~YGc(P*LVlJ;)yn!TgLy-Tw@j3n!2L8+X z`af1CCCN&FmEYPSvQ~H8Q=i+jIdd8y0|6npma0>a&w#9y5Rmqn)vUKy8mI)A{3;-c zyiZW!vBPQC`j-c8@e$5=WOeMWiAmw7FC8eTslA7cvse@5D+h{ada0K}gqPFZy=9Tu zmy}N29d3d^rkALY5feR@j5)kEaJ;?W_3YTxD7lNc8qS@o1vfop+E`0pI#JS3d_dh} z^m;N<*PsS%N5UcG(zYBaa1~DcmfL2al70#l>kH;`IX+s|`* zJ%TO}bel$0cd0h=dTB}f3nh%^6I>FQ^hJvKGP|+kA_m!EJ|2KHrn)#jvrpQ z5(pCv9ckMp5D@E;pi&?_vM>wU@KJCXdC-??j+$?ezv-(TFbZgv3Go;eoHYpshTIF6 zXkvZwswOu-Lu}oImNn`#vNHE?PrtxC)bxKH-F^wuR*_1!QhOE4wYkK1qB@Eem)FDA zJa}__`@C;=NB^6+`ctHnh5bM2ZUBqOXkr4G_FE_)-*{E4E;7wL4yBI|PDV}h6NNZ_ zSIA!Y)X%^iPJ*yvF7POiIfIGQDHz^ZA-sfyP#Ff?dEWT>Sk9Pt=%EBov)AbD(!I1I z7OE*1z*NNpz_xRHSfMD9Xg^Tv@WGR#Ft9gF+5*e_*>jj8wPh;6c)^4aIP)eP2Ac)c z4{Si38a)jb_tdf|ZmS*n(e6V`lq)%95u7j_P-$=jD#appxY-a}N55ctN+?VXbtC0q z?dIlZeYZM66PpIV0UNz)g!Gd9y0y8;V$^#c7_!}ik3yIH?br8T=DaV8l`-+_ZK-%{q+_)5 zKeCHVMtZ(3WqN0;V@DW`1}AEGA?!#ngT#D=NMXg@Jv~U}|GHjG?f-GEJi<1SvtREj zTcR$(<#l(pn~HgIkr^VF)mNGVDt{@^nmF&_iSIOVg3nT!gVNMZq4h*!psR&A0UGx6 z+g`g)^s*}6?qhi!YLk_+pfN2lZjy7YyR=2~B=G(oXMp7SFSQ*`9eeAUApOWP-3g$D zABr2yd{usaBOF3dm>NE|iYeKt8Yat?cOWxRbtXccbp)#yKxYp;Sit2PO`x`U{ZEbF zm`^}G&JFoj=4Y-o(>;W0cc06{+j!~bKFmKpeHz004cQS;Xa8sEE>@PmEiy`6wb%?0 zvmXLv{Y!J0et?Zy^9TWlU(hxhZzV7l;r8ZkI-QA0 zAd0vl=Ll7$q7GE_OM&xrQtwMmJzA=I;+PH;s#0NqI`-}x`V(7SfT(9of^>t_!({O= zU0S3HUHDfn7?n`zd@-D`?KcPqF3?0%8EWuNe3x`oH5`=&^-KCo+2wn4e;1URar+xN zVXkH!!m{ZC3PsS8JD!k&(H{ZAddIv~@L4*#L_vBv3p9g!no15peg=>&N2s z$x%=Tj+eS2^cfOxrRtwKL|B6awcgi~?CrrfAthUAz3v_W%&ug`4#KNThOjc=6-E|K zGEFlM2y;mr0$KeKyftt$sA(W3{iyJCeuOkpDkEUJ?@1KEGj9ST{ME~p1A(x@K;`VL zQ1lvJ8*pw|{T#LIefqHVIE!&0tyQuAuytU7yL4*G z0#DF9>Y?IS7vXpoD6^-JYh@bXBtWZ;n9Rnc%Y7Xz>aXGv-oADmbvi4}h`M;-vr(Y7 zr8W>v87#WN6(wg3yiMX{BzLEz%5?Se{)n(Q4=)#7=EOe+ffy~eFHqiOu_8K*oXu0P z?TP|NPNJe)TTemZ@4%s{`sJPe3#y4n`T9Z2B2od|ramBgkj=KrcQ`P?tT=Rk5^pWqpW4aYX!Ps{K>onUVfKPxCyn0uBJBCgF$7T)J#f z*6egs?}FN7zy|93cz+bc`u*H8m>*f|sFoTh!J}CoqL=*j+%UF1>hnt3D2O54*UiWp zamr-%DCcKYrcsWA_#ESEeD`P1y+mjp)%fKSGF_dDENYa7ZHN?QQ;L8#G0WOBzY@2a zEKOG@P1v>mb#4x|6tAz`uuDm8wrt60=MsGj%@ypE9_IK3ufe!;cpqzFHgU}>!~_Y7 zX*O?$L+b~9-z-Ky=u|?G@5Y<1B)s|FY&Or!-hky8WkP<_EPsmSvNQar_7cEE91({A zV*Rh8wJxLJTPMl{5eGo74aKL{LRcVpsLoI(nI0ZY2FlKvKLGEM9WhcakS|8|B{_v8 z5*{q;QQt%qz308B!O*;6FQ)fJZPJqeDa?6U&;moxM$;9quIg|_{>7}NCy!;OVwiKh z7S-U;ort?BW_qQrC1w>?DDM(?`%Yf&V-V%`tVEc`FfDdtZ8q9v#5c~-KiPWQD=>zf zDRF9);@9I|g5~4QNa~nr33rU_fto@}N>*|5LAY+qI4O;-@t}Qf?y%*zI z1&gL@_M-&1Ducu87hhjj5w0_$*cuavvH6=&g>1;6H$BC|)1#p0CImb=lM(CX(6iq` zoH^$MxYPcumxZv1+Jmr#3o8OY&}g|X{Te5r#>A{c>P1-P=+dLov8)NLOTb})pU=7G zZU(_>uXtir14CAj@^f3c^i&7lnF6?$@D z!FdCgk#x}P%wKYgN~T`Fq8)j|dj#}Zgi~{zmo>J)L$toHh(*+(&5|Cz;WP2WAQvHU zp3SzG+WV&crML)l?8vHf!`CAj^2&o*9?G9Rp_igRYeSn+ON|5 z5{JW^*9X6fpg6zmZkV1AL{D6kpaw$k_`te{Y()Nq!8zXyFMs|3!eKFAsvWwKfE#>! zC6eQ{EMAh-La&-D$%o&(e2(W&BXwf3j}mVs(@1JgEmO|65C2sDV5l5QSv*hoMbm{P zFKq}s#nI+KuWbrkCelQC9J;3kfA6b1-hQW^CG+KO7*d`mUwt~wy`(%HnjP0NO{zE9J_FQzTfEDgti<5}Lmsd6V zE~rsQy7~#4!MvL%=Mll#Xd)QC0O-Dof+cc~jEO8rhyrVTW`Nj^0j-Muo{{>kqWl0V zdt4(*TYoV?JVaicEEdhFFy4?XY;8H&bX5+^Vx?5wym4b+@U`eCafaEI7Nw`>6;t@C zm~#_Cf{ga)ygO=&2-@*%X)+L3j%+Q(reJ2&&$S80TlCeRDLwMCK~&rv{e(!iS6W~k zoqbdqulT2RJHx$&6V#k=!}FaOOlqqB+{BtPL=OEXu7=FdJOqY(F7(2hiW54gq#B^Z z7+UR9jzPu=*Mih$-ml@N(j0 z@0I|37!qT?X%9bq7E^3F`t*{k$|S_fBqn9xqUv2IvrN|YQ~`^VTj1wLA)n&wg5V^~ z57{W6lIxH8M}C_q+Uri{^$G#`cXIc9in!ikqZm7oBqGV&4~@JtqM( zBRE?<6be`jlNyQ15}ju$OAa%JDmP5nDuR$>fhpz*js8@#_^zRvB};p0|X4uR3?X5}$$O1N9$d++>zA1X@Hm2oPKtGtu)=y=cMUZ$m3UkrSWYWyY zNY+m!niY|(nEvYp>_r+I`{uU5W&1CFxU8e?>=4;IyXih89_+j7>A5i6%p?7rB{KKr zzpg~#^3DLRc;- zuNug+MVyBjXc9k@)`;^U1*G0h=zrc+i6q;kZX^poPwOu<%@bR!;jm&0uGk*Y-Sy^r z9+Z`a^MX=0Zr+A=v?nW;eKb1qll5&w1@CU255sFRZ-3P1fVnZCe;4P*-}}6s1pwCI z7z9cpe>0~37~^L8Px_OHf_U^EJq#e{@ap^7vf(b18O%}a<6|ZETxo%XQIfDED3}CH zaN0Z;zsL`nZ=P~x*%lfJhTFRJoNjLaLZ`qH#;H*9Wa#BMyiJosPYH0;K>WEHp*9uS9SkYR=*h=gN4A+?2E*drKqX>Ig|&BdsUnf@w2J z7>}i%%yX~9+-_vtFuAg7C*#QWc(4=gpZBkT$uV4h)U0F^O##Vs%5a7W-hj9$E+%z; zV)-CGF;&KF;G`NF+|-uwD6)3uPciLRdFW@fV=IF4!v3PFAtdcI*}|HAwJzmWuIx7Y z9578X2}^JOLg<9TVWkM8ZMfL5@8Y^S=e6>2U-bqQix`#nn{N421e}raKewgQ@&XQj zrGjpuyt*-n3}G(Ci{^x$KP-pBGAii6z6j#if>Vl$%#?n?V0u$X>G}K?E+R5OQgQvh zc_LYSAI1^Qx+%DPfy!d5Byh_`CZo?5FU7UCj&vqF1JWlzCILG{Q7CNAtYvUQKHkg$ zJD1cq!zz|L?Z9XbO`Tsc68Tw#X_HyrX_?x#bM<%@oxV;r!1{-K8YY8yW!2zTroLx4 zj9R^EfTHMg-4cns^G`-L9aiBel!S3_r$AoRn)`; zPbj2XYQJfuKZS&u|0X_b{V!A!u#xCS;KO2<70pvOy6E!qUp}tCs}=tVrYM&XdjbOD zcofL&>jZ`WnxjI_2Kvq>XwToQkv+e<{;6jo8wuw-98xo+lRSIcmp~gSI~GO0gLJ0s zG`j)B{LDHVH`GYc5eN%R8i zC^YTcQ)h9Qy4>ZI_~EB&(xZmTy_bAJDhGw}#@WhvC=%l!3{gxgkm6gzv%iinfW=@@ z+}U}ses))5B@W1eCX>gg6#})lPs~ZtsP>F6CuJCwRC zXnIRBAr?~WIndI+^uns@e$w(BvKh?#*oW8?vT>eHQ)uhgYi8;l41dp_I5Bq6V$L$m z=(c<>4%-q*3qMIA47`qLyr0Bwo@)>NV}nv_1s-v66dPh>(+R@OMm|(=>h5R4<6@W7 z%6E8hw4Al5S5)!XnALTyGx5+eD)q!E^vju2ty&3I|zXtV2m^}MxA%Thll;>;K z@E_$c3$_saY*Pu~wc_V=TqcQ_90g(xaa%3#`yK>fIYdvl^I^CO+o;qWKSnjgrZoMm z@z=X~?Gyt2h>+2O$k@x_8@qG-=s`o!WoFU!;I#5}G)rKtt{KIO$N2bI+79KT_+LNchprcv=cfrCseFtY>GFdyH>0qu9Lb> z{CrL5h*)@?!;8T7E<%yimD(B)BY?W7NLP|>H-Xb8kZoSQQ(g*vDB~=}P5g>f9`4C62|?Lj)buazcs&!B4h(`=b|k`) zS~#V4C{3+AZq_X*Sarpw;tDnTRM3Pu#6C)LiZr6Jt z8V)MM&NmQfL$Y0H;h z4T|?xF*y}->sE1x(lQpYDq78aFm?L*<1wXQq;`nZut2F>d1bhOej(jKC$oSD)W#w4 zWH+cXrpqoV>qh(ilN6}sfAfr4>Hid3WME_Yj}(e@tU$EzU-%0^Dccu8j(X~r?1wu0 z!=_CAxpBYg9VUi?#`G|AJsF8yPzoybxzaw6poxZ&9G4V>5Anq6Lhog z$J6ST$F70SsF^k-ZgDIZ5c^vL3`nEtuKg1^s7R8*Kd~IYDN+AiERs1g!_pxl%)ZM@ z`Lbf$Y`o*yXp6^FhyAzTzk!;u{t2WZhC<6SZ3umbS=UI8rS((;7ou(-pdDbFE(nx*pIRC%z}yO zr`#haAPJWpFmMJb*39qJy9v8}c1sW!{dK&`*!(GQhuNQR7Qa$adHo8R7tv72v4nDR zuFfzt7zR#4OLpz(g_(HXFRa+U<9=_M&freZ4p=6UoS*+b5PnfOvDsJ~-c(2huKA2h zZ6#mO=ci_3J%{uCs2av7`ayKn5cMIG=2k7d$HN{R;f=zB*1IX{R&932LCXz$A@jJI z8;`s4#(tk&%SEbJOnvdaVDk=0#XaG_32v+aZu3W+^m6pf%nH*i zOl%7D4fLwhEG&$QVhnqX%&fi;2M&Hg0^``UicFHB;n=j*wB$&ItRYkZR8i2MI=$hI ze$(H7e7gS|ty@}A9B~=Ir$0n_{)Djyy8DnncbxO~(O`&g&Y{06QX9lH&43eS1BnME zz5`A-!_P$YepW_$DG#3OW{Jbx;LX(!BW*2sH{`e6sI^m~C!5@X zyP#BZ7|-kAfXs#lY%1eHC`IOPE}@a1^Wqveff0=(&i#rX)fMwjM02N8%&2G7k4?pI zTC_~p+qNF|8!fAv*I0lr7FG|u6`NHX2a3;nT4Q`_K9sNC-6eaONixS~d0$UpZ%gs7 zbD34xjzh%b6DjCq8+bxsjkEVxOeqQ{&SJL^w9>rFHxVR1#&13DGWMqxMxQ+@-ROO~ zZd$yx`Kr3YYZ{k+)7O7`AZG@6kNtaE7{K`bPRsz&c1ZQ;OBLBoeK`^x_Lp)!r(aVm z2LmucJg(JzNtohpjyR>LSRtM_yeQ4`@h0yIKv0~7z$i0PqZUx`({Lwq`FSZOG*n?1 zHpP@Q*~c}f`Nbbn|It*=FfmN&L%2Yd7DynOxTscLn~j*iumvqmTOZ7 z0;TXl|5klOK4(UD)GCjaHeaGxQ@}!Wk$sQD(_|vDJv36GF3$|q*4PK{*xq=?2yt6n z9j!oH5p1faKO&!9cP0?-YgkqMH22Ini7`k=%uN&LF1-qJmW^n5YTZMsq@}-7+Nmu< z4V=H5`Mj3FrFucu{^|zmk6cBpyyvc%dv3>*0y=e8=vee(g0dSa0dRdwwl8(v`$82@ z^-i*@JONWQlE-w+gUn|y%(TPVn??GHF#fdK8JJF>QTPI11Y#*SjFy!Ak;Pl|B6qnk zKy-Fl)NK&q)uNBXZ6DGq``u;*(mijs0IWmXE%WMUQyK1zbjUZ@l^-kQF?EZhMju)d zXKt9@DcLa&0^%Cy1WgT(J4u1|0T!l0)sWaH(9ID`nIiX@heBJiFYsq%J6`X+KA9hD z&a;xgiG)8rMl$}*ELk~D5-`9ZL=G$cznG1vs>v29V6>n4q<&vqWCuoQelW|K2I>$J z(FehTVhP=XhSn@!-RvEgLkQZUKn7y*G#Z{b@WV8TO2P2+EL?HnG#Le|5`2mky$6Zi z@xZu-(h0iau`ibx3g%k(LSJ*55?(q;f1Z?a8V|MAK6W_Clup7~ImjBjQS_GRRr?gV zJEyPB_9;p&w^9VtDMG%8Mg@FbR4GY%zXpgrGpug*EAS(@3?b|%NU2W_m&kY+BNdW2 zhKRn8HF-vOb3->ESAgXoP`w`an+E#h1Kr=;yhZ*J<^0EijyD#<4tV>2L^;D7%^kyb z^$h(=p`p`YY&f^l=~3S)QOuzB`6M!^J>`@$nvQ=tPb05RS8>_1AsoU!b7HK10=B z=ZU}>vH5AL5AHLZ<7F)k!Zmmr*UAIGHsAjwq&7;EbSnUHt`njuy207pv1c?cpY5)% zl_DdE5eoI4zy+9}w)eT*q3;*Ai?><3`zB#SI8l=D>v0EeO1s~pL8#pr^LwoHVd0K^ z-&jXv0O~;i&q3y|y7U0=+7-?Yu2p5s`V{xdZNuqLQo=Y+`cK(XSdo#}J8 zIa$K{D|moe*sl8_A};K@Ls|9xNnwy7yGxwkgJfm={RXdI#8azM)M-U(+k3_#J}>A7 zA-gqTFPB}pDeMn;Wi)h_>3Z}goid2gq)`|Xz#w_!PI#yEOjGwv?QcVPOMkWFVg`ak zKfZDkjJCj^#1gLjf{24rq-q0`^)-MhS(&-jJXMMw8XfhK@(~$brf$qJgBQc>wJ~)<|uQcN-M|bFeKiX#~oYMCXasnm2q*d z!vh$1V={D-u`t5A%iK>zPIM5wa9_t#Ur;YQar)K9#`c2XBsV+FZU-&RaheZp8G8?N zF8bpQD6V(>T)>(Q<0=t^C9|iMX;c~_%N~p%%e5W}fzjmS3K$VC%&$Nobpp8QcG|zD z6^9tRq4Kg|>PA1jSKrYrWMfwxjtUsziaOYI)uLn66X9{+aPbW5uhKSP)DDpZbe8Az z8K%#@6Hc{TXn0094p4x%vw%?X({-n2G#gYEdnF5ErQipopfs ziCwNNr4GxOy3UqDbi^oB9qluD-uwhnxaAtRi!tJ29LMQzU@gj;u}`P3$LM$5hTxkj zRa0R_?pEoh+Hgb_ufIW~G_ppD<~Ony)8qrT*XcccX?k>f_j&ht|75+)a`oRq3`h_D z?+)z$QjcQ)o6@zmig+z`6I8|_<+3m3QQEKg-61^gOP>>dLANR%N@2p(&)_I=MEJ;k zgbN^o%J?B&NBU4|fhSiFeS~-}4~y_KUxkT%X?Pbg>9)pcm{2_NayZH8;2qV7h4B+; zN_rmT2NLu6=b9>VFVKNWhpHI+9%`=36_Az^nvA7q{n%$8AlnLr7eaKX(%VXyJGmmH zp7KMdqjizGTn`f=jWrztFBMyi_3?$>v>o@GN!yh*4f)9%Glu+((`^IMg%<)$5>rW}HofEn##|4Twdm@7i=Jg5&WfHQ7^-1Q?O&H6CErgl% zMRw3h3Cit)t`@Ouf1tf@wFW!q(bD0{Nn)$Glqpuk)@ZA6KPt;+LT*I96gM*2$j{mg z#yxz4Q+-h-CsI3edaYZ7aedy6#jq`s;=RAml2MTV29EzMRNVc2R~MTb6m@{r8Fl(r zpy!oP7*=DEZ}aOD^TG?c_q58<;7Dc(QhdOWl{om@0Br=4pI?oKn?&B$xx~HQxxc^P z9e?ixCEp$c_=!QXyHQxQp{kk{>oNRJ8Or>OO|$iso*q%w)nQI9mf9$pIVrbzW38{- zt)fLzq4%sMD3E3&RXTdRP^%Tp)d2q&*Ok@Hl%kGwpolRzGv^v@uZMb7lSR!EPJF0` zIIK_dEjA@q5(r%h)KDFxC%cthZLV}9Io9;WV;+(akw*}lL**OJ#31jM9OT|Go}!Z{ zQa+$g1grC@wzpYd z+aw2Xh{araMS7gZ_hk(&R86@i$=)fEz91vIv2MZs==dyY2Q^~GNw6X3SPAwz+z4yedt$bDMQsQiE#W#+ zkUJ^*U!3L&+a5pe29>x!$dU8!yQ0oW9~Qfmgxab)`{9!0WhSoF^WSAaJIG25FKbtL;C)e zn02fOYCqkKaqpoj6MUlg3wxzpK@!DDQ#=bnw3lLwCDXSX8&2Z2V;Frmy1wKSSigmi zAge3ywHw6fmOxvgk7^dN7-N8#e(1s4l zsqwlf!#pIbY{7XzCfT`?c|a?!@0KG@i@?*eekYXK7b%GCc*JSMehC^cpP=mz^cW+0 z3zXu0McN*EAW#uL5?K8)vUILzWC??WqHIzs8?iH;5@IQqn$1pwOAHX?<;6)Y(ex$1&5dx1HA&K7tz z!Ti^U%6ji|5f7>hL1_@#(Qw`*<@t^FX9up_tJc&RIB_`t0oL;y7&V8+HT)Bsnz456 zf>Q3n1AW{VC};BFkrJ4bh=M3(6y=F@)zk)}AZP^*Wi9rWs)oj_e!)qO!08>Iv6Z1Hla)HvC*iey zJvFyR^gjr|pSTw=u*d-r048~WdjSKR3Oz&pCkI8C7GFXz zs1_|z(m}ZtY}#1tNNXc2$oMHg^0DpFEs0&=PoE#Zy#3}O{uJ!_yQi-9j|rPHdVqbV zHx%8fNDzab!bmN0wixwAjLix-KD~GxW&n2W@Tx8j-1(b2h*xY1$I#F>1sCbVB4tv( zK5lHYgrboczsg%07~&YG%yzK`>>~a3jUC74y9lw9N{+QEDs4`m)Sw0h(yk+J?IpV; zxEFig**r1tz_{MMshjNzUheQcJIzG6)>z#F#L1C38N!mTUtBM-4Wrz8%5$2A6hHPxz+Pa^!) z1DZIl^p@*Nx;5#zlQ|tA;Yd6HTFVziWsezNiPP&?Ixi7OjVsOey^C5^Ijhw+!OxAx z6`WvgB+2h-hlR=qD!4Jo12lP%!i+=k+x@5|_08v|Ym{Pjom|1Q#q zJLy}Q8~*bnicSv3PKIXqbTYOM*7{ced{gzG-^C2b4$%Gc!vZ#@R>t@=Z1{AFPR7aMj_6rtXBn!TV~Ju+&X?;etSFAw!_hCjm}uVgvqS9Qb$nQ|>K% z#1P%n3#7Iz6BC%V>wL)V>}XHQ>VXo+g?**w)Yy!kamEK>SvChI&e48YRmZ&_DJhhz{jifMIOj@sX{N~OQrzF$woBlf)%H0a`eA1nT96DxK_pe! zII=|yf@3j))~F0Chqf?cz77``#K3;Ns|mmI zC9<10w(%Nz(X(S!@f|R9mrj^2$i59MVhrvvz-Z&KTgv0R)`o; zLcZaL>oG_C`KzvEXe(25Jr-D17E2!Dbg^)9q((+HgI&#e4?KFToCxsq@ z^ff2raOW7j++l7O0)`R;$n^7gzmRB7YPsj9J1QWQ2(zUt2H{v%ARNyQ5Pf*a#*H#* z7Q;%&A6YQwSF>;ah!F7;NCbsIsRMGF;tO9CHd2HHeMr4KARHcXblg50Ui*o`e#m0! zS5`Bo5vO8oWjWE^I0)5@|Yp^CpxZ9s~8$P$WkOE7WQn3Q-%!9WbYiK0q?du7O|@;{*xW$Y#jqX z7mXduehpSCS?i(8S6ZTrG?x1pdABc@As70l@f&MvhXGmwvd)9oP3}LESPS2(918DM zzR}cqLB4Fg5EHeXlGa_EYZ$3)(54Gx>zujcrFoD|m9&B zBylHR#0x#146nI5TZx$PJ#;K<+r-okffBZ=wfdAW{lofE3|2>uc>&DE?e{kalW`L&;Ju{QiU&|tc zB0U2u$PHjwgclS&;0MJQm8Vq2MEkUZ0jcquAM>YB58K}=Z2_X4-vLGB?Mnbul(Qf9 z(mbRuB=bWTC%fQKDO3>RJF$IkFNiogy9hxMFy?E|kdz(-_$znn9V642gIF5as4m%n zqyWH9wG(+Grn)mZWtBx2D*YRFI;0hBK%QWVR}uCZMC7*^cidg|hvls|xgF`iPHCth zf#cPy(Ke~U4F6f(nv0qAb0@u>q~7jqO5vNJQ)A|fapZ1+B3vaP0`e|gjkK7-bFz5&{d~i8E!@_z|Jgn!Xqwai| zLyb{Za7hhg2GzZwWEN=qQtK2d66d|}Yh5yBl?IfNMi*4q(pW!zDzKm%&H?3{eyJk))=HHN(X^cyCbKTEsoN51GhRTTWfFSCnGXBN59}MpI|n+O?%~N`TO+o zIXrQhtdvw@eQP!fFFt)i2&Tzqwy{u`G5~IHlQf(rMN_%r9><2(!bx=@qK`g&$am7a00}k~0IwqFh*^ZQ z1EToT?f!*>n0=js6+4_9rf&@W3*{mHUTmO)XqTGEnICmuh}*_g-Z_EpZ|hbp*6>$zeM@ONSX zLd4G?2EpQ~uz?r+U|nXRXj0!ovItP<)zRa3jp;Fv=4+%WgG|jvIEnr3JB5WINP~P^ ztamY@Yo(K1<2-g1=c%}`*9>=AW|`UzIEu^8uYC2~o@9(BlLXA_YSbvUy{R1CJ$~3W z+x3Z3NL_1fhkffySV@~N9C|K$G4sb+DLfU4*h#}EFG`>fz{p918mLGwFG6q$N(t6; zjx&w8o1}vN&ZYYe1I_hcELFlerPH} zc{v@y$0Z*;q$`u58gal>dPZ7!3rS{V0f_)n&@dBd3a`<9*Y<1f_+pATZ9d#Wb0YdI za0og1JM@em)OGmVXm_bxNtTQwoMes@G^Iy&&=W!Xf>V%Fuz9^CDX~eFo25C_p$lDI z(!I6wd~6<0rz{@o#cjCrLR5 zo4LpBz6Dn{GJCXJ_&qMlRQ%)mh`;O#Y%56HL&$rO+mVIudZ#xqXr2k$h?>ZiN-ho>J?}7h2zyQ@x|2x0`U#J@^<9`y! zq?Jby0CVlDEHZI6%>_}WbIWV>?MG{D|1#gS9qSjxO5ZJ@2ssQ1^x-XV9&;e7nyslH z8UVb_ABDw$(x)8nk%&+**5HNUbEm8WZqQ)*%}Pb6zc5$t!xNf5pRmEpHQ9rv>o>$# zwY1cx?|3T=LS)YpclLS#34238o8=?k>)bBZ6z=9M6Q`F>iR?v7T2QFcd~7Jll| zQ(v+m1ITMM$q+C|*Ngkc`mFXBBaTO1r~_4vGDZT`i14q2YQEpU?wGX`gM-7w;Cb z-C&H8Ky5%e!=^Pa#FkQF-9&oUp8e6$tSm}aGuYK{arW>LKn)&A4=idkz_|UKbz^o* zy2;l~>2O)F_k@slxaz@Te#!V>F|)Yrepl8H>oCRFGq?2_N3|-sy4l|8haB^g5wI2o zJ&l%>3U~}3_Z!Wx;!l(NMNrZQp6IJQI}}oGy7v_|K35xhO@OceN{^SNIdd@;pt|1Nb~8ZW@$!rx7pt|Nv4`O_umAM=X= z8(l?+Huu4(K4K6+GN}maaf30X^awRkz+T!FoTK~aB_Zf#TDSLs;JH*$I_FSvs_@YI zOE6a=@&GuJObA)X2*BzPO#XNPL8wE~vU?@Gm2LyiIpA9z${wdBnO*0(^ser5`iZ5< z4%%&4)np5Z-j)EA!t#bV9N}6p)QG`FZaBqZnP&FBz5G+sUZXl0HOL<=+raUsQCF=e z^yd4p3wp`%o%$d!C0f8p=DRqF?qJJklj_IyLtpHcfYDsP>Mg`YqlRLJYftI0?)q!^ zCB05PGBuKG;PIW~dx~;CjJS9}0C@eR0p%7NOu|-vC|Y7`vHRL;J!rV2g~n`$TRRPg zIv#?&k-y5yKN)fdjqp1!$fvCXqZTkFI0XY&2~ydp%OWIGHeuua6sD;7sg$k4!C*}* zrpfNn;~lDkKWj1+p~M}e+LT3dIUK=0P}yy%WxQz`QHiz%-!V(Mdtj=obP98DvWrY% zEF_nmO}&%*i7OT})}m9)n`Q`xr$Z znF<-2hra5o-vFGtduYbC1Mz|`cN5fh7)$qCE(KkUFY`uQvM zFy>&jLRnfFzMMftF<4&$>FPsSH~=JK#ouCZLaK49HDQVx4WT{pRE|fZitr1~B=w#a z)BL^JpWdf$U!FeniPaE6d~ihrNaBBt=c5G&w3z@Ueu)riD|2@n-8)}z0cz_etb&;I z6=~&C3)MqN&|PUT)68QOv*VyI5JG9wg|UzVR}K!c$>tE1=PXRgI_fJ7*cYGDp16;I zzO5hFYP}>kJIrrZR280(-JqZ~NUi7h&Jg^8I*&<6^2kf@42%WqtnX?nWdeUO^vE0c ze#sZ6#qZ)E{)+-;lT1-Bhw;^W_Ur(kfEcTsViD3o@wkNo23l>70tv*$M~nFd0WPDa z`CbP(NG2&ou`VUCm1-`+uBCn}mQZii@^HS!TcVjGy!$(iE(MOYD==4wEYk&5mS5v1 z1)qVmAqsvHh5S5DY{YujP5Z#G2`*`ASw>BAGMWJ5=(7uD*?S7k_!H&bgUwL znrVVaZk3r9(Z9SRAC%h&O~w=+rkMd~Rd(G}l=B zim{VVwNhroXG)g^kHPLYk^HBCA=BTL5*1o1*7;$^o1j?n{T}3}m|(!C-ip9lsJzrh zU`sGI1b`qU?Bc)#^niNlG?btqd=5Jl5IQ5Kw(x1If(Lh7WF(`l6JwDP=#oVlajT5yJ5vFeY|AyJ)x`OJMz zUDPpg7s@lTQ*q0Q)frkxw%2KYyT*Dyv0yEY-IL{MzNG~2m1x}Yt8r-3g#CEl*!>=( z?K$&kS*M7rBHioIkgTb~^PGGJf}}e(KY67>~szo z(Vw1JWCQBfT|=4WqHg zGlJ?}`=za^RJoYB&Juw$98Vd#fpQ025Pp@9vIGA~kH}8bboj@fRB?Lsg}2Tapgd94dY6Wh4cRL_12EKQ62YNmYEj%9JV$$aml$x`%ndHq_AL)Y{N zm)ggms@!Ta^%RF9FYo%1_J*DhY`Z1L7_dhAazOUA!R>HxHi{wmP<3$x4y zz2TcmlQ3pz`CuhEA*RyI#=;^<1%hBEbNWt?Py9I$jioU#)97jr1WgHd9H2M~!xIpa zqV7*9KqeegRI=9_seGbW95N4S?9YLF$DH-8x(&BtAVY|tnEqPMRb#oGGNpDFLnx={ zDKz}>4(f_Df2CFQAbVDtPS9+P-vJaNf003hd<{I$h5nOBB@^&4eKlZ)^oXT(QyNNU?l1hVwQWATc z_TGk&p+u6YNrp_3d6p27A*o0yp-~YPO$ZrE6p}O%B}F14MX0{@Onb`t?`QA-`+o2D zUDtcgb&gHzS^IaddtCQ@uk}PmMd@g*%GvL)+!!-8EJ;{_u(iQNWtWdOH-CPh;lnI% zzDIs-V(soPlc(g{7mW*SCr{X%`bkPEDZltPfBV3tIHg0C-3GO7K^rd>ygJ%nb2_i) zP?VJ1gW@?7&NfeHN4iUAS`L5wD17u`!g(w8L#wx6OnTDr+~U;Qk(B-KYnJFrKE7}@ zzAFESS=g)@cJ+hnC38drNO z-+Y)Y^U-2{s(tI`H}AJMACqxe5q7}!tNe4nIp5b<8oOS5FSL5a%O}BZ_DfPuhb4>G zc?~4re{SP);BZ#q!;vS47VK^G4kn%#t`0n*RdTu`KlevqLE4Xd;HX9S$RWouRv&MA zQ=Z6l&;s02_YQht*3=M@6}=^avI+_(e*U@jSaHfg&Az$1bF`GkmnxfwKT;=yP4`TN zu43swB$9=PLqS!u!|8yQo}LLol`bCpxi>Cw8sy^-+dZRjX*scDJNfyGj}2MLQD1LT zhPNx~-}p9ZjeXwm=__G|i>^vf-6+=0b7Ex3b8@-ev*5HUS<+6yDpF*opp1XPaDUdD zq^g4{<>O-uiqAx^b#K1OU0!Nll=*Pw3^^5-#}B{1kqFPT<=Z1+(rn8+pqVpG{6*rI zNj|M=?K#$Ab>a6vEm%eA@c(vhjd}I`jm6ZRR0Zr8oFQI*fp6_s z`99pXb_G{+OM9-$bLe+Hljm%Y57Pg74-&+p#SqLG$bz z*@d6hlx}R|8+IERpQ_f9KL(rertah^Oy?C$@;$zQSEg*`ntz6SaMNLxkYKC9v_0xZ z8_mvfO_92q7$|sZ5Jwr`X(khp*{2`LMTas9&dec@Y+RFSy z6i?{|KEe~;p4MF}{9*=~sv$$+E^;@Fo zIlhYoyZjchw;$H~Kb@-Q^sMu`)U%|cQsYfbt(U$ffvT2n(Gmmkl3cW&cuN1nLCQq}6Oy@#w5^cL+rwCv0l z!Ax&nyT~m$dfy#HcRwqgF?e^Nw=X1$QeBPEZcbT(l!(tt-i*7oey@CfSQ?HB&tJS{``L(mdqbIk;fYg( z)Goc+E^_Qg+S!6K9v82*GJ6BP-^R^sjCsAqbmQCb+YaJ{rM@za-Q326&68AX6B3`O zul(*9QGeE3_s|8gf<$BIB^T88oUS;b@%}g2Dv?jRLI1MeQf?)ZshQ0S(zNOiVY?@p3QV;(Qa>Ub@NikXHQ%q4 z=z6CKKhGo!-%_#2Z9BhE!zaZw8lWC$>}%ypa^| z4PB{!CtLft%3O=_#kWHa`OF--XZG2h_lLhnU+puQHLs#(Ol+<2UL3J*d(rHp8xs<9 zuB+O6u?C(kw=d+_Af9e%5k z70T|(`OE!=!lvX}y_+4T&Lt000eU4ovO^rC*`BC!5^)~@s}Pgju`YX zUo3ZntNi7#Rdn39q@SMGZ*B8mJngN6^hkeHfNOHiVYADHlD8+uskdlknUuNguFSZ) zUVC$6zpn9)M<-A3G|8E9tY21pWsYiB_b`{vywD+MaDmD1k+M?3=KA?}6s{as*70AQ zUb}?XRbn33fysX^eXj0WYBa95VETb4S<(50jq#F4>=xZ?|K9vwIBC(7gOAod)2fTp zOL(Tmf57_m#Mv8A=o$tEmHh`^I>N4>$cC{D?I9~Z3zvXvD(JZmtUKc5w&nY zBqc}k=i1WOk6z#8K2|evdi3`^8v8(frhd z&*DPf$9;LX>1)ZS`ENR+_boU+`<>|Ik*J{1Ri$ZsJ&nKix$U~EIKFK@pIy=Xh$>zy zgO%5E7FwMRt={%>(0aSF!_6|CjlQH~T>j~IdcGe$f73*|HiD%EWUNKLR*OrCj_C45Jf8}8N zp~%`r2P|Aba-ST0b+!U1^AACNUnbe-0oqKVC%&Vpc zdbRG8l4r^&Ow0Zfk*_3`D4eZ#_MDf)8q4{KU7>mI(k(a62u)VXHMly@e}(ooOy6q^o>J{*vTcx$+se{KSC520q_Ugv*1-mOwcxGBGZ?sb5 zo2y><#Pv6{X7!&d&)TAWXlc&wyBoIpm0XznbGMzBqry^yo4@A2=K9_J(6*i{=(j^< zVtiA#r(No+`?ZJ|2GIc0%iftd`l`>$`rA7LTfgq`rNkCQ)`{`55LA zZ|Y8t>19r)3Gkc9w7pU%%smtHD)d|BN6)(A5GAf7pL;e9tX|iB?qJD;IZ2hdB`3%8 z{(i@oaPH6k9nx2>iObx*{-BySOnv@|vWCLhJsNpet?Um(uO!X4BI^$n<{jP^&-La! zaZ;;7m~ieZirs>SJ86jx_LHV0ot-fF?pl*h&1=<&t~=|mKAs?VBi_pXdDQr88Zm^U zo;Oa*O33cKG4ZvMS5jqo&GZjfe9Ss76$vkEYCAEM^C**FxFE7H`&#+5MHc0oN842s zi~A#H59`?Rl?wamPUZW)ZJM=%XYiazT@Vb~hiODBzR`UBWba_~)gM=MBThfa%#MlW zFY@?ac_p>0b-juB5+-@chn0kINRb>`gD~T#EIt zojszPa>D0uNL%mF`0SX>F^+D6HYI#TCRy+@S^8s6rbf!(>a6KqlnCi@ZTDJLWD<09 z@Eu$8=qnfJ58vD&DnR^}ab3YaC$vs$?jqCAa;^cCm)s}vc9X4Eclj%btvDlH z&R>4^=7G&k*b5N}8pMK+TM^5cgr#y`KQacjdq%T(cf~IC)tbK2@x;aIYQOLx zqMX1kV&gpDOL2-ZIq@gX<#)Q;e_C>KS8c47_KmD*)2!uhl&xP9VgF{P!rEPD9G~dQ zYZyOC+4W2I=k`H=@5ttY6^El!90pq*ly+on{IlSDrtWah%e5g{mMT3H6Cbthwe!fS z72EttF#BG}?WbzLo=$$?y6yWI3xhXb!`w;fVzQyW8F?9XiO{s_!%q?nEMsG<*-TEB+=AIP_G=A&h%w7d zb{wjGZbh5)-bJy`1fks75(3j)wkyKXF zo7X!e+1j?&BK9|zi+rHZ!l4SM>-RDa@2x#s8>ZOZGOsRm<1)K(B?8qa%+`-{TVc0n z?z>xZxJw1UrPSCf3#27^NO3>ng-#K zHB!O;3uYCD@OKI9i_Izj_A4a+QCk1q(TQe`&1c3C3cQIYS!U;91YTq+G97w(%($pg z5z5B2RQsp-e|)vJwLjyn;A@io*culaU7@+mKTqR%-{Fj}nj!HQHP^T&JoxMta-{ld zrqgx7l!L~{d#+RNYDU~`6ZPuaG-&d0^>b6hpyy^?P40C^{*tVteV$sg>`m zf}gEd{qd96W?iQPcoV2y;4~xi*|Lu#-_BZm>AHu?mG-aS7QXEL^FDp%@J36nQ?9{d ztS8rkX6{0T6tPye!_UNvv+@I&R?!Ntk zE~knsANE?T-FWR$3|G??@okA=`?g03@HL2^AI`Wp#p87DDM6|I$_m2C#2Ibe$JS^_ z1y_$*Pt;@Pw>YL@lA zh+?75GtLZTFY6iQJ-6WgIxl}~@!%^B`TN9@*YPTDUfW-hea_)Yezp9kZ@W(JpV|rz zHSDUXctsLEXllEe7$jujB5-wr)HJ@=k`e;Wxv~{8M?^)OlHZ5e#k}V7U3lsI%}ncA zhbP*WpFC@Rt)lI-g<{97Y@2z}BLU_f4YRk~U6)xOY;q7}4u5>u+atuk{DHo@+AyI) zC`pWFPv23XSYvyR7FO^i$CC(VA_c3UbT=kwI^!YLG@#F2g>11Wyvz# zO|Zd;5+?$#d;JAouWjZvuX}J{*R85iwMC&avax5E$IROOb4ZL|X)k7CcrD~WB zrEGe(*7P~gu)mVr4TlYjX9^uq<&})%wk*A)`su-h#3K%iMQ%rl>e)CrsxP&66PQZ) zY?!gZYP|C=`=Zk6l3S~VT+W(&o*v%ms9qR$t*-3IcblO8?LnF;Blm5Oy)tN*Zy!{d zxpYqS0jruXVJX>L)>@>bd}}xm_&7KJ&DN%$_J`Kb+;n@_Q;O~G#Yyee_hz*z&J5LZ z)cySZ;K0}6yU$n0tZCev^5nSuY|X1qL#cnnq}KDqy-)1mTkd|?yJ_@*fV}0PevMAv zXu9#~VBh*3gu6XX#Grid^|eK74&1#~-Sorqr{(WNHR*9Dr;nj!cr!_$(~>cK0{96()mqT7~-r3!)!sq996TdteL=T|mA6Z$0gQfIyWTj>i; zQh}D42FY{Fj*v3Mq6X3vhh;vuB~8`7Y}K{XY-(x2si3WGp1%TqzVtgU)<1RP>VhYS z27{M(EfVC7ax~tivc$0NX4JsV(OnYH+Lwma{LY9CP>vY+yr${-_ah-2SD()9OFZeh zzuYaby!=%1!RxO5-dh6Ygnqo$51DCG9Iy5=rc;S{SDNCRX2BP$uJmn?j9IzLecefqk1@VW#l76C!c=Z&%Gy38m}gL? zlXSOCHaoj3aLwK#ji_vii?d!hZT8+YAf5k6q`o`j@m6Dnj`?*GwsX85Zn#HEK6}f# z((9fk|BsD>E*2ds1KMc=6Bn;tw`hz7z?%nBlxI9ey}?v>Ru>sbyh*pWs&sz-tUdg@ z$x@{1=j%!06@%)_JST;_=jo<|)(P>?QSZH#&0MaTcCAxLTpQ1j3)*vgF1%eiI@(;d{j$06^i3&Yl@hrtFFXnT z^g&9f#(#ZV_qmGag0B60E`+GZx*JRGmA(+8_iZQnM)K{I zwu~<44f{Iu;Ob40Nv#IfL*{31?Qib9{lGnC&eWc)#+~;?wunC4aKT{lB)V&?9( z4Pu=iws;O*m>ab)iJ&-<|9o1>>Qm3{3DY-(?jt7KXp?*s$_YO3v%#B5mQtdtWMk@i%)ExGs0m?t9Bizxh7hdgaK(txHmG z7uH(;;K{#b+&?Y)p7r^mh1-^guXwXewWaY{`MR$~4WFII3-m;8+CAU;bAfY(-MyZo ztipzTJ&U*FCCtk@25${n{MqrxB4k{^8HHtIh%??q2?d<(Vc2v-=c!3(k5f|QHGoi$pSp1E0rF<-1UMA$sBX(nWJJ`wVP#PhRdbBN%bzWUlY*GY?> zXiJU=A4(dz#C3&Al(b~@)9*3(kYIVQHDb1-^4A{71*`AmU_xnVC&9l9I%QiJR z#!0d+N9JJ0jE%Pwe-C@rbMbl1ee|AJFn95Ywh5Usm9J;w#XpO!UXZ^Ws-+bDj@mJ~ z^+1NokKH0qH(a=|Dsyk{k}VO_1;?)}_v4*=Q9gWDz@5{EyROGyFO4Q?&DP8;i{Yv4 zN%>mZ>#b2bHQ)O2=iz{W^QG6#J^D>lpG)gCFUpT~of>$pkpI)IEp3i_i}Gy4?#L)h z9q&H%xhUSVN$J?*z~v(;VP^}PRt|of{B|HnErTH57Gb2g^!}1jdBstcQ2$1!HnFL{ z=WLuYr$J5auvzM)N{t6r3j$`ZyR&ukiiOu-{fL}o5N?;(CVO2pt6NVfC)sWR_hQAy zmgI@LWjmdXMZ1sqyFb$5cd=DhX%v}$d{%jH`SKGLkM{h$vRC(^{m4FULhY{g6aJBv$Cs?29I3gz((Rc=s?H}F zU%C3iYvfpk#+Xw>b6odai{9HjKib_jO!3y5{>MkdOEwczWL%mjJIq}$Wbxc(oS(^v zra-L5-4%g-->P#HI|g%PTB-)ku9!(bZR^Pn%kX--t1+WcgwR_g)SOOSlP60`|21c` z=%pp^AOD`E)F&on_S(c^VErzOl!Hz!OFDOSs(i`H*l45G{DsG?vYPus=bT2(*6Jy0 z3sa1ZugBgP4(Ps8Khm`L%cE@$!t-kNUuZ_ig?hW@-!RHxa2nrr)e* z)%Mx}Vw;w)bNSv`Ek0_Ldbz4Iq&r$;p+k&9__=E;eA`YJXj{ZRNlNIf)~?JpFn=3; zcy>u&_SDW|&930U?hMaA)uXHbsD!Bf8UHNdw*45&j5~t{u1RB1X2>}&nGRomHZGU= z+dWlSdn*An4DC{Jw0m%aS35uHkUEcvaCxb|K=|Cb9dVhOeXA?)hkm!~s;Sn0mvy=N zO=}A2WUFNJx4u2zWjH$^u5_F7n={0P2Vg?lir{y_$@tesbZtTtTfxA4Cg*u9z#~&UL z{Vgxi;UxQ`KJLn-%ttLP>9(T}ThvxRRW1E8FXYkWa|?~1kFg|pGhYhK_Z5OypS&SV zFYE#ruTJlI9Jp{2#rt;%?`1oCPtWM&%;oi3ar=&pPcT`;b8Fwi;HQS(Ne?E4M6Oqi zeb`*2t~%H0-dCG5&x3OwzFSn$7Zqig+)pIjNFeL+OWE!B%UiVlYr)Em<`>GOy#3co zmRBD$mYwF7Eq`EE_{sZUJUr>tE~ceX$u&Y4xG_GYB;Rb_up}lYL&aE@7|@^6T3PMGRiKLJQR6sJ*#)d#bwpbUb7d48T%!uEHQg! z+qg(+q21l{C9*PNlh1z-h#X!~x7MyWvc`0_xKP2Sb0>bs$}E2L{;Bw2L|KXO_8!ri zHBIB6DLQUE^Jw=#qYhX9^J7`fyQ@C(9MJWTA<2a4=4QC}Op*UGX>O7;SDMDAW^<)& z^Z1vY7&n+F??1WAZ2m(VpS1~ct`;{*=gRf2`TMFFuDiBJQT3zN-lDLpsjpwWb}a1B zSFbOwUv6-!K3Ju@$>dA=rk}dcKInzUl)O^(kK}6McisQ&uuZD-ONIHXn$P!06W)%r z>0d~_s#%%(sP6kh>jGiHKElB>a@NM-htI6rx~XgFTYfuBo0vVb1g4~a{?f79{;@^f zsB4f`i*pB=@ZxaWZZXwgxjeZOQ;Iilo0WBEq=Hpw0u`LFSjLV3a;M& ztaf9M+>5uZYEtXp&LjDRKI*=8XkUL($p+tEg@fv6-%5zsACOo5w8+WhYsZM?uuw=v zZ{N&ihSTr*w=**uBFzd7K8{K^apU&Kg&9m%RpPzQE`bJC_u{-zDZ{fYa)dr;0KHeQ2 ze^|jTcZ_Ajn}3s2VA^BESGn#d@Ezz4p1L?e)AoiqU)7rRTf}GVFgXQIw;NvAdBkHz zVUU9Gsr9N>L5gyJvP4(iFq(P%pr4$A;FcEN0)^}PGoOvSr>VB9{b%8#`FES&ypH`| zt+mbmdBK)>dd(a3SJXb3JW#%~=8@kC--7bgXwtJVA@3)CcWySyZBlLjxj?7xxZZK` z!ic!&fs3h@UHp0Ou93N1E|c#HyE=Y%=*zDy3Gy3Uo^0=AeX@&NKReKB{iET`igxy|I$(K;inE zY8IbVby~a)zuo-VUYYC`dRi%t5V>5uV#_9j*qoh@maIw9)2Cdj+`O})x@uXJdF%Fw zR=1+v z)H>FEHBS#X^>o_3#jk9$|GpboQ66t)4TD!4|uLm9zTC{|6!fT13g~{=Y2nX@^#V-;}L?KnEdo% ztwyWXI`_)8ts~^&8E0G<%gark`+K>(Xyz_%(uzp;1K}@9^F(>iwFO6rKAO!VzAJXd zTZyP23#1D6FF%vhG_w3v*Pc^E-*c{YCKY?i4xQ=z6rp-Xs5fRqP&q++xmo?t>PAOZ z;~D&W9`;4095romBR*SDr81{NR%VaArJsdh?tS}x3X1z4^W7couhf)z9QLDWB7dXX z8-wU?UoQSg>3r_;(L?;*jI}G@cHCRK&~yL2wGmH>2A03q)oJM>O`cM7BTnn`-S`9I z#yZo>1hzjQ2F;$-X1uAA%Xp8Bvk>X5*U)!zwtn~d_lBY?yj22@`nOu^tr~2-=WtDU z!*=&S?M40H%Sw9!=38^coIgdBfBV7uZf@zerG%TI3HE1mPDUTi(3)wQBTiJ`t3EB^ z^JCq)1#7i0YEFCl`lx&{rRbUbM^z%JY=WOoZ%(q0rFYN6t$F67=X{k{IBe+Iv+~Co z(gNW&?ZlbCmw2We{9u>H?SFr(`kf6HYmyInt2MoU?));ZWmd$rVy!mscQRW89(Gas zr?m#>>NMSgSWJ%5%!}VyJ;7#nY`zH3 z8s~>O`!;IZbVjr*sS^l^rfRkCpRPZD*Fc`{hr(`d6+0uxc>zyWOfx(lWGOMgHEs8b z9VL~Utn**q5Yfti9=AFzUROK#ZTz`WWyh6We5V9uGPx{Od0J}Dn%}+SQmwdPIB2;< zgH3P#itITT_F1fyEPVIm+FL7b@yDlj&VQx)OnakO1+N;12hrLsHgoOofSL3`$T;Set6{0tlGK`?xDe-i&dQ;kI@OQfH&!?h}@v!1@36E zcA4sb8oa+T9-IRy91+}GBG?@^*l=HK@t)ryDdTi43=EE_>rPk}H=gI5dwj*XomwK1 zYTkTX7yVL>=i>_=2|O@sRCwF?nU&Ua<;R;2hp$Usct&wGw}e31VBM0%o_>)D@fyZz z#npU-_9?}YRYM@LuSD$5lQLE=+D9?7j~N0vlkSP1-vkBiJ5-o5V@|^KIYN3(xB@igVc?E8^5ZW+sgF_R5ca8H(5+kC>YvXFWhy1wOqYZ?w*k1$k^sdo_qt%XHKh6d9}XvS#E$_ zt7zaX1D^+>J48LR}n8iyvJH;_q8@!aGn< zuPmb2YsLI)TuUx&s&*=}&}kl`?3vi%^+$T*!}n{B-F~P0=DfbK-;ex>T4Hmu6SmxN z%kxWUG|gVp*0LbIn=iV@TjIe~tAd5ca>JsJD8-hwZ=dJAG@WQR{j9O_)b-L^UOIMb zxNL5J*3wGp@6%DTxEGqd{>6NSm$M6}>h_yjpR>?Y(~cV0+F!py^y;6g*|KXax5?Zc zDZb9H(q>yHc0=5t;_w~8F7US6*M1Q-TYZ{)w>5ab{Be0pvt{O|I-zfd2K)W?r%o8` z-TTP$`iI`z`hU)Q93E(EMmin_DXbd0Te;-mP_M&F-i>;n#?1lD(#c zu!k{w52v;D_AP$7XZ`5k-b4X!h8%RJGwgbH7(R9?C-4>aZtf;hCROPsgXFV@V@c%d z%gHm3T)egNvfYx$lm7(e?5uxiePWTX{o-a?xa00TDAScr5-C@T$*NnN^!2~FT(0{^}L$AJPVsWdYW|y&iz;w`p*0u zIc@2YJAd}vy>iaA`cj<8P?1*YPYYeX(IZ{W`zLwqeWcJ4P*EoR+i7lXYuvYAZEh`v zKECZg;)HC(({h7;M*Q^e=xlfYRGxLJZNYiIV23f*5pQai#N2Ues+ViCgeL_YUbc!+ z%T4w6vHRNc`_hj09qDpYKC8NuMP?O@3!Cq4#4mDTQn*^fD?X*8v%mq2ke{P9i*Dp{ z`G4B|zVh2r(ODwPcRLUYlL^;MKkG!T56Y;EerjQJ_K{3Nk@LBVyqu&j+7Tx4xlWt? z#Y}TWug8{U%A|d?{BC8Oc6q*)bJHHuw^z5@ViIqqANnp3dPCHIo%WfX3zOHLQQ2}K zTgTm5fv;s%taQAyv$p8h*F^yjHqFUDrxVw;ct7b*=(h#Oa@xKq%qraex^tyRSSXKb z#7d_%AI#5fd^z##;mTju{vN{Z%2rzhJ)&fm<NCL5-&5L-_+Iv$!-# z5<`wkO@Ya>X98nozua6e;%ZqSn3}Ajd%5Dm-KbB+Gvy{G+dW&_n$^AY;(2j%?I2Q( zPp|-?KB4D~v1r0Y<+*NmcgTJ?_9*>y`G;`_)+|mnuHE{DXwa8pyIr-9=R;OqLPo>O z^V=kakJQfb_~~}?#?i;(wp<-~H3xOxjSSluMyG6iwk)*s^6}IuZMR!oV!YN)n|1l) z4x1Tqu!-`zdo~_%K9yJeg40hE|lk>0HG;Q_LF_lpNp(Rqlm%ganaoNGOkGFXW?mg)toF*ebQWdn;s^*+G<$6}2(ANhETQ|(zgT}>jCWO5$%z-=IZ`rQV zXTNWU?8-cpGlnMN&5J6?GMC16J;4R)g@Y@H)J>zbMOthg-Zviw0d8IUYTemWbmN`C zK^dp7Lxx8V>|0daC%}K7Tg^u_kP~5dBfDn zaVH5`eESZ`z6(|VkjHoX{E=kDMM(vEnyq+WeMRBNK}&TZN*vtrInPF zDkKu0kXI+}l6a}bZ`gICQcOe5F`ezkM{Kx1rY3A}DqY1*+P;(6FS)0xYH0I7fsLMe zx1^C`-Eh;D^xJpV);db|ec4%Y(`lJknMg4AH>Ks~QyUbwstA65-O3ZSZ|iX1aYeJ59_#fITT8mXlbgz7#XrW+yHmI;xzjq^al>Xy zjhN;w+l<{;RZOmlZ*XyQUw-7fQuqqT?9~(A)Mk=S>6-c2zwNxM?ALgvCPA~}RA{za zU21$}_q!KiZQ94TbSL*8mHQncUDK7Bb4qDy>7n!T!3_(^DIo=?I$oC7a5ulHDN}#x z{36IhO>&D{zOhuIzHRaK?DKu=Y{=%@77RA7S@{0XeSU% zoAdFlwrQ&UbK_>*YR%KGl{1XzH|~BgGriJrxfCJdMUi+?7*Fq#4}_nUdRkfmwcwSK{tP4_fsu znWN(=`^x@E&|K}XGt0SJG=-GED;<^53>Lb)rzFMNr_UuTpx|R>#K1n`=xvqqu{*AA z+qGm~{g=C8)60#2uC*1b32e(vxfJ`PVtkwFJ5_y2zVFfEH*Q{`EYLS_(VCTRa7yF3JxMx<9*q?Hk|RReT#Z6;EFL zCChRA!8hi!o7Yc&+OT3l%l@ozhiUE7kL<=rOMF;&^5UY<+&!Js%tnW|1u%&+bvWz6#9qN*2y9^esv-x8?p}>n!pd=gqbGpf=oiW-G z`Xi@Q%NFc8-`3Z=;T3<9!{lh?+L?Y6?^w*PZhKP^Sn3_yA6GW8>Z{Pgn|YJ7I{8(i z2gQPvh=v)0t)K7gyZ+K3t}HMr%VMtA0MKdCe{C~AI?ucIQoPvvdZlYh5UA$~ z$F2CccVjxP9_Y8rCOu8;ebrayt!n?owZCUmg#t z3(SAM>&=d#`KJemghC#wO*cI#K87~o&Xa@e2z{P>$B`PR`y#U=23J4WQ7gs0VcWK; zqP7dUb3e_z^=+Jvo6*@#MEj$6WIW0S9M1ZGRes|&Gx1Btcj<{idZo*&>y+ID46F^f z&z6@47(KU2sY;f-Bjh7)a$Dk-zR<%LgQ4y-)Zcoz8yigPp1(lpjll3Jsbw9LU+uWi zD3IAc@1DC>S}6aLlARkb?|spyeVFIws~OqaX*(=t%*_anI=oc0L3{H{`DI&9pHob_ zx%h~C#iXy_w(<@9cxxHt<6ZQ#A^Pk3sqbQ&6~ex@Z)u4Ye5+#;^7BwYp+k3TC+UvC zwx+yntM+4c9Y$NDi@1G--LfnAHox3cJU-&u-uYuJAbrMM)6K`#TLfIUspn|xC9+*a zR!$!Be?}ruTy7)+4F#W(KLLLS{RVF^!4Kr$KvygD#~mUvhSr{TU@k@Q>M7_i=mnmJ z)(&=F5FY>#_@+(;`YbT>*MpaYLeGNMKIjJp`9ccx1V915PzU^kuXTq|p-92yfzZFR z0f9bk#teZ-Mu~=BJP*Ex0*y8jkww2=7X5nYtr_s&Wf6L1Wsz}gz@X2hF~b0iK&FSA zsKD2Q4k7sKz+G!3i5Sw@VniN zMC8DIiO}EWz^&WxPx!1M_+1WR8XGX^cY+8ES*loKQYi;^fza2mF)f5252o)1XtmLKNA$7anSGJCkgz-#*)CllfX037UKuj^5yo;C~)OXJufmpt3^*V!pA63^>n_jb09uCV;s+u7O5__*6zd)vwQc)BV%J1SWN zk@W>?p+u6ClP4;GSFtOSNec47UdT~o)WE;Gd1|`3xLdmh=-R3h39_;Zz~qqFms)v6 zJW>np3CFo0kV$2m!~gRO!luLn8-Q~?=-vMRM*_l*wkY6T3^;0GTR42&o!zW$rTrXt zJGuakv6go8bdZ65bBBJD0ruO)&DBfBUdG;5M%&BV&DGJ`($UpY+sD(*-A>xe7dRBw zrko@PEVlw#8a8txWDt|el4KDZF}BSE?{>r|0VMiRhouC#SUWmtrJ6hNX z4FDf;5<;fWOW<}aAYiuk_O!OyZRaWNXyZ&lVLt`QYlx7@fP4b# z{Ks z`yuHk63}19WIyfz3C{krZPfo~$S0xZ4w8NXw!IpYeB3b=nWLD>+RN8V+Sbk&*X{$h z+_JK$>jKp#kdc%p{uA?X2T~M{0x3?=qcH_!cUgeP9Vx*zK(-~16Y!YR1ac!QNBM_D zk1Xz32rePA4SsC30d2Z=W5o=3!U7O<%c5!lIHRZtCGh3I|HB#mG2;SI%*5##DF20V z(Z8h;wft~0A0hD{Y80}#Lm#;2`TqzT$%sh+Bm(P>=JUp`!GKCEUKVl`+fa3E0~)>J zltlXa7@&aVHXdB2ikA+Kf)tMFU~dN{hdb7Q`yJR8H;&0*W48po92Q>^6>gefn})G1 zAAP)NY-(t@(a1#G$XMFNmVJSfC4qQ|Ro)16Uf`vYqqyL|iApxb5pVcFf;&C_UtuLX z!iqP>Ac0tmmdpIRz7O6%>@6bWi4&XmSN!=JgMW5_#O- z0`88)t%guBkQo-xJh%}DHl}h^kYg?uZW9mQ`ojhb!Dt3ph$6~ieOw4KD$X&H;WqO` zw#+;j&43KjL~4o)mU$}3F=630@^H^Dem?$f8mk)3sPas|9qACR;R+W5U91=80^Xc`%w;6J>$!(a9DSOkYmEaZRp`c3bIL8Er+t|yp714vyf2|l$L3$CR;T#hfZgUS-pPd!^JF2HpQ`ImhX)wpch1=f4 z2X^r5u-AxRFF=-XduUgh1=dUyhMzpy@!&|OokOG zAf0s4K#mCux4mb0)fQ`5f7^Rd>Y=k=G>~J$!fo$CwwDbiLb+l3)sh1p_zHAsB}I7( z^!q<1mK1T@e1>=DuwF7In~!3nW^GVx|Cn0>cTV86uJEZh+&T$mYR6bNU{R4+8pTG% zIu=hs2RdGCY*~KLJw6sTYWfDnM#VZNHr&QvjxFO4Ml)gqtF$kpx~%r#{`Gl z0l;Sg@iUdl0U!cL%jKZhs949uhT91+yl;ZFGB7y-6dSOy^a4l2Iwm&Uo&dbzgl0tO z^3U7RbGb5Gwr&F>6o5lS0%`a-8f_o}97sbC&$1dygwC#^CtO*Lm4(Klr(ju)m4n8j z2X$GEm50Wnhk03zRe;8#Cv{nkRfNW(r+Hb8CBb8%ji8YTtFdG-7CRNpYAgjBi*L=~ z<%Pm>mI%P63YryCeb!?k4$Govm06$#qoA?4Rsn1Yz*zLKGOKwZ4$Gnknpus7IE)>7 zW;GV#FvtSnS_g>3;8+i?u`q|x1J4= zYqJ^)a~M6-&1x(R7d`jQYAnQI>})uzu@Hx`^W&_>LLA1xq!SYk^?#Mb0ssfZilv1YlnZWSaIz13Q0jJ-YxAkh4P%&LhX4p$ClI7*01M zQ__D0s?Yl1NSFwCZRaXeV{i`K5PUbvT4NCzEjJq<7wFarhS{~9?Of>2O_RX4(}M>K ziC%I6`%7p>j2Z{Xl%cj4n%>cu#mw~S6FrDUsQ)6t7uy+$kQAZKFZhY-B?;9dGJ4?v z1+L{5TjRhu*?L zl!N=Tz+dFiZy?GmAOsTSQT+$=L6I#OqX4fI^Z`D60X`_A_c{=f+nb@kz^50%2c(1u zeLxvPBw$$%fDK_j91 z1_4Ah7nfwfkI|+9wguc^58DzndLf~gl8{g{fT=5(7`q_=SjSkWgnvLX8&s z1+*nG{AZTKI!l`vY`CGNK$Qf@5NdtdK+32zh*18k2^p0Ik*0q&A*0%mP(ub2j(^=4 zRRu@@dL0dPoyo?XPT*RazZMa>o@V2k^+wPUciKSA$Wd4OKMlmp*nb#^@*XuNfMxVI zmLPVC+5IwHFr+6Uhp?Zfs%*0#mV25!k+2)5AgQ7)E=$u3KSrAdY|Fs}s7^s9gneAl zm(wOBQMtn=E{LhLX+Rzc!i5sX5iTZIrHJvEO5fT^v)F&>2+Q??AEV(ytTd{`oZ({JrIO$S z$Lw1}hI7ggc{E+aazjA2Sd+)-gh*IM0dNlkhF?VChiPjCR2NO%lF%(ExZVyHS`wP3 z#jGF|Jn+VBcy@Sp+V_#*)0@arVsrrTtjr+8nNQ3NVmW8X57Q9g^a>2eC?Vcp<^_C2 z{U|QpFnTJ)gkZ@$j({;75d^@ntPsR)Hh?i4*28QF%33(0Vtd6HPS8QX&>7eT20ca- z2*ikBB>~P>j7dKzSRBM&>;gYV14g2tjtkI-WnA${1pFBNG&CQ80mHAY4CjyF*af`; zm5g5cNk)^aWOTnxMz^(OH2Q|#`~$flOpB>Rfph^asAg$`7|swuyr*dkR@K6x#qd+K zrGYL|ffkn*0nkChr^d)K(53|GR`>)7xVIMWY{YUlbRhNrG2lWTXPgj8J&*~Ayu)z@ zw)}9MLA}Uw%n**uaCii@T^LG86FDH7QH3C)5zj(KuYg4{(iqH&Xhsbp6Q~-5QH_gG z=qcLL!L|@X#v!4M@f1WTqD^Ep35gPlS|T8V`mC4%Jx{|Z2T35dY8+x@jIAJyh;oqO zMt4XO5qM-YwTog#tqX*ig+wyC7&2D6gn*-}gM)DRDH`Fh>S0JZBb=d+Uk{K;P0_K1 zi!s!KV>fK&IK;)M9b_~Q4>OvL^Bc!!N~l0#gK>Osbe#ccACQ6)fw26!HoEDmuo zsss>VxceFsTttxBws;KP+dwi9jF=zf#NshDUPFG64EH<(jA$913^%Dlzax4@rn>?h z5Q2U;Yh`0-r3TP3;|wh_>ho|Y8~hYa*+9z`cpgQ}8Iu^AmLXiI$zu~2qiO(~00YAm zmlMt~GzUY#Xs&~u1!L3==+FXVq8NCAVF)*-y6HCFNBu#38lA(o9GTJpn290!3FiA#llqbVoQQ&v9XiG*@ zg=DmjM@EZNumK^_#bB)BP2`JdP{?o(C&E0en*gZcKWC|shpntHPm58)aDie}C5VfNv{G|( zSjvZP?lDqn^dzuMr6J!zTMFo)5JUxL3^=hY46TZ=%}1LWXoR2v?tdvEjNu$~vP z-#9OZ-a(iUv`SAS*?>~J22LA21W3K}7Q zPtQmQZRFqH{6CHSTdf&K{^f#Mn{?*34rI$n-`Bym-Z6D`kg>)HC<}zH3J@8V(E(Fe z2M9SKwqXq&blw2J{4sTSkf{v^Y$9V)am1Npm2l3GF{(Hj>t&(N`qk}v~Hx1gK0ZRs|NBG5osZRo!BeWTT zj28dNXrYmUW(6r|%8Y_0sL*^XjTi@N!zvyLXKJe;)7mP?7+qi*7F84EDcX{tK^a|J z1=jGz#=vF8C?hvdJO1Xx@o^TuglwWLh5uJL|>NM}hb;4O-5^{WVE=1 zVn!oq)*8Xo?f`uOVz9|*p8`4|8UW(Z4)}Q*WW)a3sJ?4G<6u z(8vj`^s_G~j4FZj4Pf2|+PiSDdW`x3fkZ@tg7yy}AhC7{9CE^_9pD|IupfuEA6SC} zYjz+{(U^*6sHxo+98ikTLz@yi>%%TE#v~k)rN-8ZBNiY#CwgG0)rA6KS^&i=89-sU zY!avz>}#-X8HdOix7-x8s{&dwwvaJyxsePkwo&8|8KWjpum%8jkugd?l2XOCt{fs` zl7Cv40z1h73R9Z`1?`~#OOGAT!;=g^9;1^jT5kgK4WN_+v=QG{kODtUn+!UriR5gd z_sT-`FbY~b5wQj35EqkjpluA0>|p!{OlQ69jLIPg zZDBDEa|nz{H>jNe>;Z!xqpcXchs8vWGhobp3TQJ0yDP@joB;1RF&*F#7~|%eLhS@# zE47F`Mq4ootvLZZY3l1_M_6i@dOj?B9JpmC*GZn0?4pWl@>S3ro z7z~hbnjMDAxS%pB1ue2u(7G@Mt$k6@~h9@I(-=`LMI10Cn_PRXcxNOA99PRUpm zK|x{xGAFVCGlI6D6tu+wCY}~Mvf?)+&h(Q&k`J6Jw1S9Z$HiMleL?&f6%R+mF*+bf z&=FCipyhT7T3%sa4jCO0m>KOvprGY+R1P5kU?K1uHKt|*q>zfihFk#qa>&$d01Pe6 z7*y#vo04%8gLro8O&J`4WKA&2lobaF_$1p#9;9yx@cqRoOV7Zndj z#4+jzBrS-BP|*E01ueO8@R1U$o)nqoG9NC5%{(B%7(QPN5anF{cQN&_74yOl5TnwQMbdF&d8?GF8%% z<)Y%@L=IthPFpS@Eoj-Af>xZtjcdq03@vT4EsspMB0%4OggO-ZYZkD$f(^R}PeX$a z;vYzO=&J4<2oICLLGm5{Zc0XngM!4;F&wdsQE4bx+5{q=mR!fF)bPW!MMMeyH;#a* zybkz{7T76h%@~m&I;bp6IMe+F6pXEaUaZ`XBTR&!q7e!g6EI|)8Lz)8?G&`qPC;wU z6tw(IL95yn`l>ct*cp=oNWlSHP7c8{`X36lybTtWeIa608>H5NtpbPm7}W+z>QkX{ zWXEAH&`AKT2v40Ce^AC$i$`+%7^68OnW-3$Wa6pNI3k&;GLNLZsk=7LreuuD&}22X zd*y6O#w`p5Ez?8R9GjO7#xUs$VsPn-^qBczV@gI{L9^f(G|ot7)EEl&pg%_>GwBLq z+vrO29FWZ9W2hx?27D~jeN07pkY#|FO1&Y06Ys}Vp{HO)X+~jTjf`o#0yjQm*&fdH zm#HpK!7APCB4gABkZ*w249!1rh>TGuD711sTlE9xdOWq_O})+!ir!c+J(KLyittom z_;r)%ssRvfpe1e!TBs!w(1HQ@faHb12P6XlK0r{w-FyTzJ&2|EsFXQ?7FFtgoi$}l zT0^}O0H8wlV9)}wO7AgO?vdRlUFDt*63!^^ugX0IEss;s@+Xl%f4Z3-EsNlcse}*K zA1&fj=z9V%X5iW5FqiXT@u#cib3i?#MnM=60idA8b0i|gz5}p`712!kgjKSEo?_K~ zXp(N@{!~gwbOt>^6;{mNwcuxIGeZ_-H9B+07O$D`@;bP81({NQ%yii_}~N5 z=#H|0*7eR}_0Sn;;T)nRbk%&eVWL=QQ^Ghgn}OZ}fa0VXg?|4936tcA{hxzSCLU+z;vj1z^jN(&C;r%k1>iLTInYe&{{n#eqbcco3PXqrm8=@ z!>5DDk=(#&n2=(Mg4XFVr1&-EuT}s+HKHrv10<;Eg(K9(z~N2MDQHmP2o(GkLCYb- zVKlTkA<0C$6~G5XL{ajw@4>-+cm~>}U?xl`q3IF&@lnjEH%PXCijY&18TAHChl(I1 z<7}a0QWiM81ydl)#wj{R2Ls|ctN;d~W5dWYwE-Y$2QUSu&>U$CQzrnLE5IT`&MY@m zTL7S#>Q?BZw|_pxjXp&aI!Kbysyp?d9ChnQqn+{i8*L=I&~z02r;&fFALB?=eb9&< z7JEn6-T#I%c)Ritx~emgd4(ql2HLBNKIE=&p@JqrucT z0Is6Pq>`;h81y+hbOh=J13;ayegRxufFER-3AOu>mBrw(A-r&J1#Lb^z0vAB_<&ek zA^|PKfDZ^uzz4+KfjjvTjRqeO>w@l&!NZufaiG3~0Uv?P+C(kpL(phWj>R4sjAe3i zs2jn03xEm24hpcdT#QZ*UM_4+(84iT97IY`3q^;S)lL8|S~D>NTWGXZ0Gkwbh5$Ot z@Q&#M1Z*8p?c!`5m^u!ibwGON@~aV$m41vg}aI=#J1GGzt)M zA{+<~Q@a5$511UX3681D0F4gNMdK74q+v7`LxO|$9e@vrfO8-?Oic)Aq(Ik&z{xT) zsttgL$svRpH552xg{j#9JWGw%s3hasL@_lNpaBOJ6=$*n$tsN<=vEZ-ARNjcq+YZ+ zvCZDUoRm>ffcvN0PGM66Zm4<3_Npf(yS=W!-6%*Xi&*vWYIu9g5~F@<0RS`PvEM^u0DNeQE3fTywW z1!zA856pzuVZx8olmfDQXbT3Bfc9X37dxUZ6#NOO5GVp+FJA&5(69`=iwgZGG!aFO zf2pK8fMW*m7|5#N&0z{4SP|voRZI|ZZJ|ri~&+qNC@aQ z7%T`X8w9kPimnU>0nf@nlhe^apuUCxT6olGK=ZJQh?#B?KqF#m8wF>wz^s$B76mrJ zF?uLDBqFBkPT)jPnbnAzq+)aBm>LvN1B<0PIMX7g4h2Yz&?W`&fnoQ=4v*m}Xu^U9 zuc#1mDDX@j3jiJ}bkLp!n;M58Guvw`I}DfYBGSbgWXBEPIZRU{yWKyvbb5#XQiw!u-gHNRshiR%UYVnkyRu zyf#lJ8H{fR|6~SoVT&Ty_u3>q30|n0QsjhMfH*Vdx-i=%fzcv7?_IDIbHt6tQFXQX|qyjsZ7lQ0=NwTzj{qj@}2G z2~5QnbxPm_Pq@S1O!A>n(S#hxWCm32JG$N?kQ7tcBele?IKx0vY|uJ;ubZWZ z?AH8|T~wr}5Q^u{dG$mu$zNV70<>3Urt_S(=- zvyhnc77JnFKk$y-%Ay;MtT}bg=%%t zH9}rp5+R3i&gP{tIait~=_G&x3%RaDu#dd4L|}()>CeOQoSf@&vRCccK`*{$A9-UK zu|uj*XD(qbFSIW(59C>ZN4R?cqmYq|V}A~r*tBrA7YCAxRu>;tdUEp6x2;a9 z!WUY9#h>~nKdNG~<%e%4^d~;Oa+3v zY;6~DW42}~&>`yPlf;eIQN zNY>(Bx`x2F=_0R~<=ki~h}Hdb3d-v_c)|ksHeF;pv*eBD0eOAO)^dgoz$3^4Q<(Cn2@gQFysTjM<>2+bX0vqEMU6l!;6ygev%EO; z)Gh3TJbKz1B<1b_Xp8JBKxv1-q8%KIwj|oiH26YoR2a5RBb!Z!5jb?m(pNL>gc0y$ zw!;YYbZurzwwiYHKkRXaZ=2_6HJ)ZVV~f#Dk(aHeg9hv)FF^xNmLPV>fEn^KG~m!d z19p-(MiaMbSHfBDWoW>mK?C*~b-H_i6|fmjT@D96V3U?)IKUzH+e;7$^5|)+{w7pF zNws{loFA6!vP5+=KgQnsF}B=~URYVoe3=;f8a1YE6U&Aab(K1?wvt&j^ZH)r_BvQsI+h0SG?E9#2U_Ak2Dgg^*AIwbLkO#7_Rf_q-Ty9L9vRX~~p;0`B=1 zEW;?OtsF@}0qE-jRrI|>6Ej4>^YhrCFAlI%sLfQSf}6RmAaAzQB8g7L4jmF8)MCr( zJplo#{EHbBbc^rbyHW)>peWT^)?fGP8+9k2awMCRd>o@wCDq--A)pn9VY_@`$`(Ty ztqYUtRy=`Z*fRI00D(gX5SY=Sgb;wbCAVATw8;*if&zklHAqcpct!;rmi_mpMcb$w zO~w6Y-~lF0B|!v=-uMj9;}YTmS)eHwFp@IY#b@- z;ph7KVe!P3VaLX`blPm`tsyq!5$Qr6J#AHy1Q{TJA00Hn4|99$?pfSmx6(WV+kh75_~HL_ za@AsE%#!PB@@onBfFA{{`_d3TEs4)0GI7RM(25 z?_9$Xqta=P5w|cRn_hgKphzyz5S!*c2Bk`-8Q<|G$TG5L6(QjZPR`v3qLbV$`rQ

C^^D-<{G zbc3NCn{|1#Wem90FLr5L0yh+H`(}J&p-;Eu%;9!MzO+X}<{KV0nGQNU_8Q#o{Ko1X zA4YsrL(iEO?sRnR;C2F5R3?Sz7|OPG-lL|Ka2sj)pf!jNxak}iGFx#OV{4jpFRqa4^SQkwfJR4a^oSSljbyQMKJt5U} zjUUDa5OG6(5<_p$;|dmOwAW$6bRDee90?%E7Nt(GkJ_u*#3N$#f>N1ePqJe>wQ=k& zidcLx1aA!+b;gYwEN5zXel4v5L5V}NxmjaJ2?lQ z1g<@NEqdB>pu>vn;y{9m6b?89gOyxxAbi6d2QqNPL*zp7WUs|Q8wV=kVP}qb2=d)8 zZ?Us?`bnF4JS&Py9 z2yOSH&S{E;Wj~DpJ!Z_walvyGRq|Y56YJF$-aKbGDd1hymHLUfQVx364@ZVCKhy&N;9E zXeMbL{lWn+^oUlN?BK z?zr6iu$Kd4Xe%6WFatG{;DEWUA=TdDENg!q2iyfO6wh%WV^EF@uwy3&67HmOzzm9| zy>lS0rkK=$1Vy0;RdryYc#;F7Z6UbOR5-9>RZ(AS@~I3k?W9YyhG2tvhfT}hghgSA zZgUPAC+DnT%i$cHREhP4@1)Zb@iw-akG{vs*&v%31>+tfu&{7LD6ZoswpqAf;9)Tq zmtAa$%N1HO_UhOb>NX*U*V$vjv`{rL$-FMsB~S}VmG$~cTF1N-&UUeG4__0ir6{@M zTBvq7Ul$n8oNlITFsM6J4lEQ;_L^hea^pmC)uzRp3^E~FDhKR!YB<4x*I8%6w{XR% zao}~aE~8wI%eOH0azJC97n~@U1P5NHueHBszEm=d1Fy5KglfTinX5Ak+o1#LMvS5Z zju4@aEfY(l1Z$x_P^nxfp0k1sayfP&mt9tnKrWR7rk+$uf&(7rCZl~qyin6I z4!q8`YQSomh2TO{cUnPxuXR*8VCu;!rQm?;)GP-^L!&HZ90-c1big8YBb?A3CE$G= zu=iR=aNy(!7%G#-fk+D`b6)GO4MD}MaG+5<$$=95TCbIG(^a}QEp`ER>E8+t<&-`G zQad$OT`Ks`jCZWHw?`vBcQgD;k3KQ8@zIcl_gV6%)e8P8UH3ta*;xN%G&4J^I8H$4BS5RJv{Rp*(0@dP3M9E)@%Jy`q&7_%P83i?`p9Yb@WXzZke2u-FZV@)bqYNz!8OhkZ<}hiuI0NVg-D+^J*^#SI@R|Y&%7=f z^Q##Uojs@)o$c1;4J#Qvf#-X>0DSzSjCF zA`V!~$?*j);vKLS>!S7QV2DQJoU^O+v|cN%X4()PdKtHaoqTgYsP|-egU3&}7W#JA zSy;ORb7Ai_dPy*=*n3FGM5wQ?v|cM0EY*TK%Z+@_yJ#Kl$M5+Fwq_OG>Ok`4ChqiO z){|ygMVvSg317gPP7b=5VZ|7z$YV`xVf&NHJ4PxJ(YNR|fm$45aavG9bF?NLOHnb0 zg7CwPVS=xsobZ6;PJ-r@P{Yi-UX%{FKAR++j@ zo8UL& zHcxR3HpRaT)%DNdB1e0OA7%rEo7%f-&zw)u>!CI$`PUMO)(r>E7$d;*ww z*0~^JM!Gh0XN*6UJC?n0CtJT`-jlkP=T*c#B2H-9|?rLHFYY24fqV?(v z`yO4=$z|*O6S}058fo5g=*(~FfOylFAbxwAm#`=F)TMa=I@!d8@?K+td(j?XGQ)&y zavi`V1h!@C`IHbQCksIF@r9Cs%}|#OC^o}OioA<=W2M18=yCRS8Y(BmobEWOq?(aHv$;tpH3lm7 z^3yQdQ$mB#Qx}#32C~KO66V889zEn^X3Aq|f;wAL)wFFFb)$)RvKtqT%<9f)E>Pzx zQZ%~@Tt~-7GgzHJ$*|~l6B``-+5El5!oM*^jj?=Qcx|e?m z%@J$+9>6idzXafbe~WGG%l$HDM>xz;<8<5l)M3A>bMG``z_>=_?=vRJl z+pakme%N6AundhKo(i3P`(Viiml>iOAy(+xFvDzA9lB$gEj_Jfg9+UcWj>!?b;2EC zTWu;`Xad8|j+^AiP}vU2KDVk58ny^7#iw(314{5_ zOTu99H6EW_a7OzyH+QAouz`IdehX6#shUrWZFsHXfT$wg*{ADH(G@!Tj38&vbEpwTI^|j z^u_&aJIxl-U1ZV+o7J#&t}iz7JVS~=InBvzBeBn4GR&Aeerlb*3`wwcam4Rg`fAkg zW_^zPFZRy+!XMy>JPc?dNf@oXqS3y5bm{Y(f2_c6}GX;Q}!RizWk>j(g7UNpV0 zo`&=)pMSa#a?baFoEJPmQ3qqmHhC3;YOFn3Di?Qe)aW-MuWUiF|6kIPUDQ2IZ1G;Rl#Y?hGO$;7I$Ddb(qG+cHka;;D@)&awDr(cUu@#>%F?;t((gjyR`**& zY}e~~xs;-WZ%+s|(U&0y?ruDW&-&a1IpF&@oyqK@Z?qZKDRl+a!we?)mth9y_#Vj4 z?=sqZgCH!l7?D;MC|-YEQ4+QQmbn;e5vhp6PX1g&8wQ zSOuu-!qzV8#;E0)UTmdLN;chn0d>Br*elukUeh~I85h9BoMaO+0qQ2LB3*akx#t3y zn4~US#j@?c(<;(k6`sT{fQd=!#)uP1Y=oCdeM!)SD0aNI*Wyu|@S@%FT4G)EXbp$t!ZOIBb3C%w<-AH zIrJqiRlme0;-zjB@mZ;hZz3+~^)fLuBDS`+O)T3|AOwmn#U$xzHN8&w1^2|U_fj;W zqiZvpMoX$}ij>Uv);%TbNL|aWGpykpdmDAi9wwRcYD!k$>+HxXdE8 zgFMU*V#<3+9Zkx!>kghUMd}!dAoUXPgp0!yXj!z`97_;irpdCa@cE~UrPgQ1=1T`y z2$pPFV%U4Fqf?bvkX#pl`&HB?+B#*zT`<~#QLy(~M;3~LkJHqR1_X6oDB4Bc7>O(p zg>a{-D=N{Z40Wy*)e_z5Z?HsruXSW$=(6A=rkszt-`1&TzTs%*Jes-k)+wI6Thm0} zOnEgV*^8|wOD-c+%u1vNnAR!eb&HyPCcBU@&-XMr(8kg>Vg$)xO0}3QrI4M=fg*-HFV@$T!8)e1o2QcsAz&t*7 z?NRy?S2kSY%7%+?*F@@ai6d3jpmrpmHfke;Pjxp_S|-WF)>0RHuXSXpOH9f%q0zOK zO$n_~*c8_(TpSo+p|B@)Efm%s8l`mEf=w`gQz)$ObsbqKTmTitVNOhWG^sk}&;zgI z`;=WzwvjrTl%+1g!fEN0*|qssQq92NsRbUC*z188->nYf-Q|?Pw3511tUw!vzB}9N zwl>yMO?$6(baHuxPneX~n7=XM&Vcq%m*5AUy2NIFGVHAel%WWhWoy5fQq#^=-X-{f zr!EUZVvctSeE{!TAlgUWXf&R>xW>(@cfuD~>asYRS%Hi;!<0k)N(gYp#wgZ9Qo0nu zQHLI!b^~|%F;S;W&r6X)J z3r8!fER1;R`|KVjJ6hMmWJV}lI)p+9W>c<^0SZ3la0H_)woWQehyJa}G=Bl) zvLFBo|2%Ci{j6+!+IvlpPbSjeHhWCM28C3FvgUMA{?S`d*W)=TNcrKPlO2 zV69WA>mu4N>c&-(uUTW;d6v2ydzKCSoqG55a)iqQeVDV^>WT*5ORwAs>czh7?xU2!2Lj3ZvLmAo z+~F+9h)KC;qgnR%chfh<62H+Ya?DwGoj?ers-4;F9}E{-as z?|tizbPvMevTWlci0+nxbw#N!_A1u_3>NZGxvgngf*F*wEP#?1-zz^{W25ZqTQs!z z;^G>oNw2XZe2pF9t8X71uCX!}2L@Zb}8hZ=mE+H57YlG9{fNsSfu zf_?Bkd5E_Gum&qm^1~jE>9{v5oL{NNRxm;vn7+Hzu-n{Pm0-d;oJ@i})?q?v^Suq1 z1xQe2X(HSvv@tdGB}v@ZFe|jtq@c(Qsz!ia)Qv&Tmm~`WV@~_4k_?h{tths+i@MQ_ zJVS^>19QAH&F!eWb^wMw)Y*HjBU_S$VOV~!+Z@fDTBq38oK@I+ts`^gVXf2DjgiJn z#o@MR1u|L)F|?}jYkN&5;$_*__Bz^&LnxOZJIjHhCrwtd0C+8}qxHlB;FZ1B6sM!r zUB+vBP0&;~_1E^A7FJ$0cx|s~VRh|L4~r%c09O+?d$HrC*;Ay7vqoAI%&ymKY#!It z$lb{{`bHb_OH(6*ou)6@&^30e_R}}o4g1)|b3|f2O<%H`YeO>ZS_0X7y&z(vy%Om$ zag!hteBp47Qe5dN$fKu?NuRymC?n~+I(C5{u|A1|)mPujI$V8^j31^&{IG{(4Rc*) zNahfGu-j&sjjCPO&}K_dYipQmx~{=ZYC&d7@{h_EOCc83-Xo#FM@&8l?3=& zcg>p+=&2=fA%!g|roGp7WL6NH@+Bs9qS!p;(YET8O=S;PM<&FSO$WA-I@*>kVSb z=%cuZfRYrgT-o8d*7w>pZNUc)^{*+&R>nz|g37I48{-i=0M zSonmXe0lKNPIDF)_<|aytWZ!aWIZ#gFE%CgH9-WRSvjW* z7YJXr!&C0BKzynHv-o?MsOnjXZ;d+|BY$xq*g?*V(zFOhB zTw1_H17fjF5Mw|&TsyGBHOQlBHO?_#{XFZE z87(u!UIQDnX@&{#02!_b#i(Mo^t758rO!UN9|;gaNfSD{HuGx?JC$E%R1jxA-Xm>C z>RM)$(F)fNtq@Y!6lwF#3>Im7w8G4kN874Xww!_~56R$;E#zzd285GpEUX4QL+Tih zDyfmgIZhy?;{%~ctJ29Pw_pT{LU#GoTBebp3n!nl5jZ>L1Y^J=dvn=CU3ssCAkTvq zbj6&xBp8FIFJT&!Hke=xo^`yo(;SNyyuj#o)?<0PE5TEZ1!^(L$Q+6myufbqMjP=3 zF+eZ22*~!!35WZgF_>=6k|RNMEK}bfo#u z4KmHP)m^x-OnXa6PZutD;W*}L%Fzhh%(>CFD(B2`9|F_;KQ{8K7>3r z#q|1Kr*RfFde}oJi>*^mu!l0`xK8Qn`|>emQ=LtuCJcmEI|BSrz5RaaBsfGRH4;81);y)* zw~8Jd_~&`VPF&@!q7R3TS^%+8nDn-ZCiA#CjM2p5W4D#lC zCWl*W%-npRf)>k#_+c}OJo~nMy8_ln@oUozGgjf|uuPkw*BR((t#oGZwW)bIHKtc} zwj*pS!zxo+ua#k*oZTEHYRTCm8E9Rp&fF@_v~`LMLUD^cwkK!yUe}SCfx}p*r#u>0 zopOlX@vuJSU8IgN$vkqfaGKOHCRI{RF%LK2a_5IJlpn@re#CTqUl?^ZsASB`{n8du zW&`z`9jf}qMGd8&l|tLCzSl%~a#7lBX8BWj&^l%2j*2Yad=GUA+~DylPz@#aPuNx! z%s`!4)^6UVyBR!M#b(SbbwyhS>RPng$Gg#l&N*dt2E%%F zuh~YH?lt0Tf5EF{k$6n=GF!>A&A*$z(M%ku8TrsOec4XB8yI%-Z#0z1 z*cXt*oQJO4SxvzYw{`==t`fApH+0m>0=I6{Y+X?@>R_RxgtQjNAslhQ zkH{0^0QfDgcE9-^)8Xd(%u6D?z$psHJ$i4lfP8hsEl!%%iFstCr`1HbzSnr|9({pP zjC5^g(`ZSRO%`!rlV$0iJaxBBtmVP^!i8Ia0qT^E`CE#(_FkK^JGTHSRF~OAv3bg) zNtG%4ejPt7V#JhpkXpNFqB!>-C*GTXS9k~1sVM!>R^WxrRfn1D8E=yT_{w@8*C2Xxd~Mj#Ki zO>{I3dh%(NFcRd^(^hYqu1zT3)RAI`TU>E;i*3AH97n#ze%{Tuiw?IqPkQrBkR?f2 zriu!Oe78+C+g68JSf))+t4YFh$U@AsDo01yR?a2JLg8Fo1$Fb{yN90;5wxyl2^qd{ zTlVxz_r7#1{j8N(GJ3(nPrw$6x0{*rXk~TERw#hDA>!^Lb*ve9meB8C%#b?9qDrdS z9Hd%0aJa>m`pvg^U0yNt7I|fJT=xBoyxd!ClGhlWPA;!-6O;1F78IN6#aZm3F2NBz zU04tkbJQg?0^;b_NxP^UW0R)~F5Fr3&Y*%@2P)XdyU}Po@904V6Y8CAM(}k{IGRcG zuHL#jIh$fKvN=|g?J^;ZH^VE*m_^}G9~)8X#hT>L1U;Ts=!-;m>nhqb%!#w>}~ zGF4;{snfQpX6uSi0hF*2)264@#H+s7=IFNH-^qgTU%eW~MwES)Fp|f#V8n%KJzijm$htuyC5xF`28R zS{ejT&FQ1E{SM?ZA{wE9-e&1muy0l}8GLZ>zz4gitM4`5S-KT6ou+Qg;XF$U3!W56!X9{*^x95Gv+*qH zwVjS;gNcMHjxKjKp|Ka6bbL!K!o{?B#w-r{%$94y6?4b%Hqe)h#Ol`(#ir>SE#`1v zw(IxuFT)7jEiO=pIoFUd1<<#|mt6^sz1NBNzT6~$j|s%XCP5@10dHGKDI#6Sqo=KL zIbC#6Jbzr>aQ6-S!#!?nxck--Ef%u*5fLqRqVB#!5(!P4YLS84$F`|v>ssz2C`9_S z>1i#Yx#ueqtjrkmH05oCZRXr)T$OVXDhIGmPwQH!thj+eQQ8tI7M=D{HwGt9Z5ANKBy~A91qPrvT37Z>l1&H&%aKCkX4SiTm|Ed<^!Xn62EOe*@QY!!ZJ5{ zTFtH!D8ao(4@&6h+RUBNfGT&)gkaMUtV0Ztx)!X{k#U-63st(GzHfErLtXg_8+xfmh54uFkmAhI>E*N-)|*-I%UO#>j>c&XqSyq4-W~s}8$YBioB|BP=XIZf+GD%%k*j}=+LB3bA33cGH=c^9x9iHGG$OpXV`a~0;;Ba4d>+y6!9zAUhc?nBU z;)p96KO&C!hS=dA8*LBYXj^iiWj@72dPv_kpKL+P{(hmP;dWMYpaeT`?-NE-6`;|z znLA^KR=Hy)1aaoXyn66GEz!ETTH3v$t11|{o_ZoDf*gWOYlIoO= zaS%GBeY;2u8%Ks7) z;ba+44@8)ldj=xhJ0QY7>c--LXFNR&VTQWVZjeG3cmi^=Ma2^g!84w~A52UD(42_LFC>zs>pZ=q@VAFe55M<_ZyG%UD)5L6qepBQJz}5e;gzch-fdz8?=Y=x6HEEqqeB%KmA|Z47_0?v zd#}yN52nSesw#AZZRXQxNR>}!N{2_lfgWCuxA@Q#y%NSB6{FB-F1aD1Q_8FV1$Ps)ORHc zM8*~|jmE_6+tMdEv2E_70a@Y|luplmv>T{%KT(vZ+cH`;l>{NMyerr@OeoB#t%w9D%P zH?YO&MvwXie$8rDv}5?zR&L>iF=tg(VC3JWA_4Un51<~)nKJ(B}KWT?=2$9 zM$$nB9szFHGR*`T@T(>oS##4&m;t{aV#zuugJ=Q`93F83v@ov&_pUA&?Zp=3$(m}4 z=u3!Md&`#=JUXbrPWn>(aKGPQTQHFx*Y!|0>qiF_*hyb94)^>$RA7d_Y#a?Luy09Q z-|HtD+wVnD0xy7dtSd@J2Rs@&fS%lT>1pdyt-jtUE56FN)%jr=(%})?nU6S4`|wi6 z@txPB`C%)YWo^66@SB&DKU5No4KvJjgxD`Byo%Y<)9Tu`zSpKkrdn;PLk;wVZD!cG z*ny-j_H^W}E$I?;pfcWaGP<;A;Xxwc1k8Cg0jfLsZO$Ig77|BUY@YIHT$NNy&`=Fq zHt@sb&yOLmj-d-)l_pK)C=O=9rMc1kBTy-FvC4?=|X9 zrj^de;^}9!GNS|@9ZDe7X%p`fO28MJ9ZFz|x@_(I6;gdeo*!YzfxCM6W-k8} zR`0uxhevE#K73CqCfHf)iq&VF!K1?&1lu-g?o*sWOl#JzDl;1QVL`(g?4xen?eYAi zgBi?dZiX2={PPSo&IOuei;~s%+BAJ-+JOwFsLOWMfeiNXZj3*%80|0yQ{?63E;jLt z+3#ZBXiN@)2xFPmyo@(^#QxY`^6Gm{wp5_2dUU{n8SYiX?|OZ7@PS?2OYnhM?{)Zr zDe`i}SvKc)3O8d0JRrsv{A9S!0D{M|ArE;wlF0g6lS1+1zH`S9TMW2I4yeNxZ&15v zy~d`{LgQS_N%s~MS_3rj2++X87is*H<-$Sz_IQ%f1CI_p5IorwPZD|{mgF6LU`8=B zeBjZ+2lkOS1{Agfs#$mVfhqE`-E{bYedLXq8rvX7o-Gb$oni(MJURfuKJrpX@rc&} z2&TA~LrMoA=*@b45uENJU~|OSX9?IG`+Tw944a024b!#}*XZ*XyPj%L@d17bturoy z*TqwF_@X{L0?cfQNc4-*SNY_Q`y-#z4qtseMcWAh`P@okgiJ1;Bq z!$Q>Yont2WVLf{liLosVm_qsQZG0I`k)CWUrdm z!pX%F>AR8l(`!zDZRp4NU#IEv+7RvNXf(a*Z#t@qJva7mp5+$pkJ&xvCvqva5EziocjmDxJjYc|) zm{3f0hvsAhiOu@rI09UNfvl7qd3Id>)S663)hLFonv-A!c#-G!v8E#lRZy!ZbQV~L zk+@C#PmlsS3t{f#e*zKEPozfl)9>v6G(5!LYYI{Gz>cbMiktaAS_1urBOYhD%KuUS zYZgdnX8Tk6U&Be8E}hNke}W3oPZuDzAK~}+8bLLa?5LXKe}W1W&*`Wneng1%oo-r8 zb@*Y7t*fTN8?4DGp$M$RLVvF?lnf#8kn$J0+^U!vLg0z#U+8s{MQ1dDyZyh=Uvs_Y`d5WLhLEaUW<+0n@$%U}{`P;q#K&9*3;p%K{*eIskN^39 z{pHIqe(};C4ZGKIp&>{?$~zNd@}40Jo36 z@?z_Wgrlan3)o_kf1`my-xA{XE#?x6fsQ(}48#SD+aQS1FzKm_Z9(215sW!rF?5Fr z9N+nJnje}v~`laY&~&@K#4{B$Qz@YFOdQ_Fw4DcNz3m4Zt_MO^5so;-@%k{ zvtcaT|GUn&9^WNY0u9|dDex1UY&F3W=&7@YAdjB5T313O6yM{R1b&34@!I_H;OHTK zcq)7Fa>L?;mWiRSk(zCrST>{uE>KAFNz&7*6RPhuJBo~ML0XK2ZRS%pqyPsLL+Z#| zs|3~88g-T5=Ev#AT&*Wp0lr|)tBd=DY499=A#rlbqe)d#&6OYD`JVIfo$n_G%^sTz z%`4uxZrzTIaBKs;n{`B|Eds4FBEb}V*%8~s#Y=TcxmETFvH*R(&3Sa&Fy(|&pr3H= z=uqG(wun1jhH$b_u~0QR%Q1Z`;&z+@KTNJO0vYYb!$uETm=VYriz=yML=F!?GY2J# z5x0mb2c@`xpqP4~88(S&G$4;j3%p`dOgSbk2!Wl{CFFwF+!l1j9CZoBfD}4Y*~7a8 zT=2En0d<>XoF@aJOe$M z)zo!bKrgmvb^+fqpy-DSFc#Cs<7$GHk)qsD-RaIgjC_io|pf>P*9DL^8$}gNxB&81y8q z$#M>HB%rd=`(77`z1E5L&=3sEq_^yM+Iy`dgPpPbh#KG2G;JBvdZoWE5$lrq)kV9# z*n0AsW~`HHO>Vzs*y^hF3Voer?4xfCBL+WOmT%MajrkY-h1y|p`{)~u!|+G+7ZyAz z-_bbeZ;2$kYKHb+FNoNy#~u#dslatbsV@#awF=uB_STUjIAT_&s*SMC zd>U6ZFsGSPPu@ykwbvSTmEWF^9ef+!ym)YblY6V6iq@+IoJQg(i_KFWZK{&$0q5Xb z>OrdWVuMGo@P$Sxd|XV5-%T!SLDt^uI;v~e!-9^On{vV-lqowBfghGV#guoDnotQR zBeh2*be6JJItiFiN%aiv5MZoBfUyp~+kHIrmt8O?kAE8kmjMii4!{t+*`%xK<^x;F z9~M}}q~ON*#LU9;7ZG-O?+U!a-fL=QDS9w;)_G(Q!=VE)?4xcBNVe7vDNj?EleNe+ zN^si4yZT<^ovpP)^=7F{Pz5yDrMa8BF~HdJI_zPZx?*x|%1~!9v#dS#goOl3DAw%Y z4t|&_yW`n@-+_10sI%pDBXQ2uDmkswN~$?S1~g}WJox5s(Ckdv;AW~PY`xQ^g`CRJ z9w)G7$QdQ@&b)4T+FDy^K76a!trKkImB~9!fFFIKFr>E0C1%8c$L}675Ol-Bt+Zyu zz@bA7grq8YKV4zB*V>$!XqTA-;b;9#e0z@V~AAV62Og z*IukSym)tkASebpL-%M_w*4BUSFN4tbj;N%Gb}MVy%pJ`wfWMfM-0r6Jw_q~=V7eG zj84PWZ6sj^d~Fl>fLT$Eh6j0FDB4Hf7>nH1_g5dxa4&}<2M1*PT<2bb1o-NvhXhQJ zmmvX%W%GR>GRWR*HhDaBn1Dlv3D_{t(M;&cv-hHJLEa7@R9|nD6|)OGz|l9p)s zid$Egdg3w-9LcVLknT9B!}d^ndc5A6m>s9zojM zKY=-pAKo*Y65bL;R7^Blyys(7l#X6OIUb`-bM%$>@fa1?qc3@AiJm=+=k4g(@ps2# zRArBzFVGS+M+`g$D(mQO1_xGVA=*0#N8?)dl z8mIH%BL>|3wru!x@_&XQ51pzDnpF(>p@JuxQc_c>4k3^Q#TRzkwlx{3#J6638TZ;w zM-NuG=IEIYzc$-eg%%O72t&~r{Ra0!- zvVR!pe+zDn4wTYP<<^2=nbWO=4sj8@w$m}UsN4!C=?31o6=9&G|1G#RIs>X+#w~Mh zgKYNbR`Dmz5<>*9>~u^}D!1G#bN^$~ttUgh1-C|LKy)x}S!|i*RsyDk2wvG~@l8zx zg|860h6}$jYRbPbd}_!D~A$*40R@+%gq{ZN{Bui54v1 zoLgnQMgj#?I-JGFeZkqWmsuw9wN56c*uZW;I9ShsAvMgj%zqFa$k52Njw*cj|h1h4LN z4BwSormfIxCb@8{M>~YHU$0x7s2OyN8oP1pNxrg&TcdqL`7R19G_VhYhcx9Ja0qioXY})n2Jl;UN5}t@%nyOvTgtKR2qlx?e68r7d zFHf^;H1WzV(^uGKR@vBP>>Gx93wDkEfFgyl%RJ{W+8%a|Chq%GQCyksbu{tHF0%q^ zGAW^7@Lq4a{2{p;UA<+Ktn6Q<2MNdI7`RvWDj7X&s&w-IW_(S%p18?3(5{4fVxO{V zmzUIL^&nxJ9DR$)yiN$Ci5Kk(U=~HU+I3@>8Rsy8w_w-k4=5BGyPlZ-4r8puw*cas zo>9&m=CG&N(Znme%nIO}S!H9_6Z3crc8&gkU1np~6XEQc*l6Ou2OCA-S#~9`Rbf|L z8FO@qRAZO1Zy4$g*p;AJ?A2FxE%33O#7({hyGDNiM8hWbB(UsZ z*J$Fn_&4cwH1Wc&fQ20$A=TLRB*l9Jb|nlM2oIas6Vuk#4Ec@U&+5xR^MMu_l5$WmW*Y%qknZo|wm5uxs=OjB4z9BAh)F zE5tXQk)ku##o8(*yTcaZLeb#FWTkT z{qVzL)55N23y8O1*XR%6p0Vpm+Ok8tD)Eh7(EcX9j#0d_%d7x)nejDt{rhC~>4qWH z!Y1}4uk#0$IPYN4Y;>KeQLeX{xtIt)E{V){GSl~9L3!i-(7>{YXR zNAJNmiz1C(Pt4;Dj4@qk#60W70=3vL==ZQInYgE^ukCe=;#IrM3SgI6Wnv&==u(H+^G5 z4j|g-dy*aPkV?Mc>9|~_w41(UWG>&h-DxsGSTJtC;napr_2!`bn^&Cv$8vx0u|mX( z40+le;LR%sH^=MWd|h<&HQ&uwH8%(C_q~N3(3@wcH_uFNj^n?1I&t%J4>xy~eJ`Q+ z^x}^1<^bTE8}!YU_U6jb-nMUN`HUO@cXwdf-62zVzuM>SXqUSq9qx|exYsL8e))3u zo$tGEzTSOf`R+XxryRWA1E|I%SROXBV!`R=ji?#EE> zZrFF{`P~)&?p%KOQItn;+x6w)_v$_zt@LmtR!@Co>%Vzz^khaY@>ILG5_^bhCo!;6a#KjRqRmX2>3Kb)8Gect%GZhYf4z8o80 zu#IoE##d3}JGSv<&WB&R@o-If_!*mrYsSMjYT^U!@p<)!OFq6_{P1iuK8Cw|3wN>b z(}LfFD=x|S@LzoCFg~fy6=asY^23}iKP>;|hXpfkFNj;9!CZH5w8Y#T zp3XH|@r;`pw_15WaU&Zo{!H94MvKoaF7%=y-U|7}EmR!hHum*%E3f<9;vOTOcV@&D zG_?4%4=y_{ymB_jl_9hQDX!ZL7yX3X;_e^*$+>oL7s$O)sueBD@Xs##Lx?qwS|8%5 zH9u^;ets>)@Xs-(*HO6oDLVCF1q*_EA-g!h!#~CAA-gzQz_m~zmyliHftj%L!0@$L zQGhw2Czu+#6bAu$#{VgBn%oE_b6X&l7!4<25oGDz4Ur!{H%i{|PtmDkHn{)Dg?J3v z#SStTEyX{D?BeJj|Kx%`hU{X83w?1bj7=O`f{d`jV_4xaj4!Iq+=CQ@x)stA^YSCP zw7BI&S&W;Ag2lndW7y=;lMnRQCSWwqmeZmQ;XzMf(x#OBju7wS zJcWLoe20e1Y>dKw+NB?NS0@kE_#GF{Ddd0hjE8@U34|h?Jo({@pO|fk{S+#8^6<%h zHPN$+y(gupPmmI#KZl^t5m(Qi3~^(ROW+)S`Rpdm9X?LV+3}vVxGJ7Pm(HOu=LorH zO^j+kPSZK!?l}Z~4r@P0_&a-^$}KQH(Q~-$bJ+hm?Ef4RKZnH6p;YG({W&Clc8T{4 zD+&|Dg%dx!jEM(sj_0uWbGXNI$oCwEeh$BV4nsdj@I8m1&tdWBkoY+q&pAy09C7*V z7T=RwBoO5KDuk;jT`uR4%Oxa!35j3AqAy|5mqqlRQFD`}^ZODyaM9RY&Dtrrg!nJM zG~xCbH^56s;S#a=5*B?4i@tVcM6-vM!#A_B<#m8x(~2FCpVgSoOshlw6+T z=5`4izJz=)A>T`w?Iq0Z5+3~$g1$t6zJ$atVcM4nK9{iZOW63uMc+@L3;&mp`X$W! z66Sqbt*sme_Yl!|DUi})PzlM9iE;iV zufK+`zlIK6LkF%A*{@!g;hG*d_G>6Ze6o&z@~CwU2NZV(9B!c=H`j`u+%9I^LLqJ; z>{|%?7BTS_$=ofh{uWk$3qjvP(6{jOw~+WP9R4j-?G}FE7Uq9*(f3rAXynq2o0Z6v zJ$yxNiMtQnV@ExS7B~M}c-mVyji@ahqPWBl3wr&)U4*!W)Nf(=QCQ*{g&-wd{4J98 zTL?PpNnGvVLX651ue;`u+Jz-9qu9iC`Qo|orax9J&HAr&p0Ymv;=XH zH{3&Z_i(v)PwaY{x(IO(g}8_Kqe8{fDS8j@e-H0}5AS~ur+*K}aSzc)1?zBkU*A*E zx%jATv5tzVhn?R;#!=NeL|Kc6gSbV$A(w|c{cgM(WL*l6aQu&O>W`4|BT~7jXR%mx zon>?T4>Jmbd4 z8{`W!wM1|M2@iz5Ip-o;1BWl%Fnv^3%FLm7hky z`GvdBjLb{Q5cc`)!!h1c#5+PzoBpV8~VbO z%4|`U;ctc>|AxNB#&{mJ8UKd9;os4@_-cLWzv$iYH@Y|cjsCG3tINSzhe*N;Yp7k@YUSeEj4qmM@ke2qTh8-F+Ya4-CA^l?$8 zq0av4%Mb6r|M=?<@89=d^*&WLMFjiR55N8RuYY|1^4b6X56cIA{^9+{FTeisAOHB}SO4<<a`{Kubv`XwJ4fB!kZOY>)+zSKuP{>#rl{cpej@|*XcfBttre*3#$|KShc zVaz`}zx$L8GE(c-LQlwe&))NmbeQ_5&kjF3d`5RKFJFB9)#qQqmydt=Q2w;; zfA#+VsDIdB-+lXw|MK0JAHMzFx9`7x`PKWce)#b1$A5kK$N%U5{Nl4RHve2-tbh2M zUwk%pTSocQ55N7N@4x!kM)}WQezQ8tuRnbG?f2h)|IL%3{Pj9i*LNA}5qT&_50s_`NMY~KYcdGpBUZytfR+pMr0?O?eh9#rwZTy z>1S25e)iQLe*YQ&fUr(3EdKiZKmG9WpApty5=r++5pVhPpFaHI>mR;)|I_a*520dJ zl*2r%3Drf3KU++}#D~`WyZ*0e*T4J!{yNAm7XOu9e`VJ$4(xjPuiEujcJ1Q8u804s zU4LcQE)MK^`2Qd6YKxfn-?MW0GfNbH_zH(#Wr6hLhxfnxgq0acv`<(>`u|=48L+

6@oL6XBYO7VGu?;|$yi3KIMe6t*W$lqZ#-NVLVt9BCtWa6N4{d-0i)CenP_{HcJI{y8wtwZ1&GonUl+_x$dW z;YpGa|Z9w(pxpT!?jL(72O7dWP=v^sxjL%U=OuXW`TPb>s z&#}RrLJ}lD*peg&S0%;N+;KNe4H$bNJIV4-EB^Wkegqq%jCI1s*l@$6=hTL+sR51nBr2 z8@uu@x|?`Fl&R;(#&p0KV(~{$Jwh=P6f#*!N z&+cK}tRJ5P*qCgU=k7Tsr=t3XeNgHPhvWyrZ$1)b|^*Y3H435qV%_vqL1C(0< zm=5o<@+*L*v5mt{NuNpXWi5U#DSy^Uux!~6oyj8#mTw$`14CKIfdJ&Vz>&Cn_V=7& zdt^Hzfs^$XZ4c3Bz+u@|DJi_mae=l=j%6$iRPTXAW#7)By$WU@=F4(A`$Ssm-2vls zmvaG1jBSMJ%xALa0>vJmD}|ce#-b$a6_%Cr_VbC$8?ro#5hfp7R;yx{D5Z>xYRI?< zM8<^)BFi&rY@YA=!q91MXO43TefZ+cm-DRxlm}jM3{mv{j4#gifr!K|ORAj5y}aYe zMBjycBkTPIz_7ea0-fbXjWow(SWxk-%FQeWl^E>Xt4mdZdHmlJI{FFsQ;D!`v%462Sfw}mV9gu?h7 z$2&9csYZ)!ap+C_DW~0XF3+L@1Ie@iY?Lto4$5;JYLVwS`XSG0O^d^|EDqARsJQq# zI4ZH{MpTw}Il!A`gtkZwpspf%%Hc54KXTw)Q(!5Ci%B#;SmY$1LkYB=f9d6h)TDMp zdAy#G8=fP|WdCx(D)Zbfto(9*KwCYdHuOh0%CQIIsF2a|IhtsXuZ-sL8roZnxF@HwW?CiPCtw}N!X{=oeuo#eS&UI(y9 zku?)-%2SRx zZLTrmh3dsd<8$0?An&p_k@<|o^L|t*Z|HN_Z{{-}q8FZW?jh%~Z2Hxs@&kQ@{k-NR zl*wKoj--N*$9HkOd2Y-?*0+i4L0dflGWJKBEi`k3NVZ>Y%@Ers(-Xa?M4NL$oQB#e zS$nP{aq6BsR}!D8`sB4ZnMFNRGR}j#O3GtNxFi>)P4<7ufa{G*V}D$aCjH?eGGDm( zBIl>qODP4Xd2lO5IZ!isj*v>=Ruuc zXy#;pj%AouUb}D;MLp3z&Vw>xmM`~2XFPeAib=Lha`{}Z!#F5%CqA=u5gosgT4aAuJzIP%H!~>zu!Srm z?oW`IQqtngXNJgYXYK~6mo*Ktq_i&cfD-XTZ0kxK#FON8BRfyB--wph>mP=3Da%Xj zF4N7jJ>L5&G&jG$k;~RC))yHA=m4u zX4k`!{kyc)J1xdGcI1;Er`S~Q86BTv-%p<71Zv_Rn^A0-je2^c`jTTKZS_i!aSWEp z$rjiaqS~DMBOE2WjAE+&}iBgE(2jBQEDMY&~2>I}5W`W$$U)UOIENOY2HE&CF( zCbIOzKaSt!^&lZ=!;>$T9)isqlTNpV%WtX^~y&vaGeJ%UvGc^=#JLlSANndguj<$LU*DwYpgi`qhL%qY?&>$Uy^`Ok706j7-@HE>I>%6=-LAF-!EgHuKY>?$!ijkSm zto3#}mRkw?!qc0^WNr`?d%FS!%Q9!@UHhZ-m7l`| z#gCJ)<$BJoBu<&;l9*(@B59ELK~NUo$=!f?ZO?Uj6fF}^aoTyG32m-lHyC(|VJdw< zQge(dN}lD$&YkGNjq4NTT_S&$(M{_r1iX5|%}5`Z7#Wuj2;?zX9_6+34IETnAC;x4 zSN&FB~aoJh#@rb$R3ldTG5ox1Zm1RyrR{GR>6$ivLFMhDsCgYNO z3tvzJZL9ZgkMiZ}RncASSKI1smgBn|OpxaY@!BT!up9fPY9ERb=D8=jLHNl2fIV07 zoxm9+egMt)m9+{j}^mei^e?^#{SULb8GNuzGiCi@y?Wt!{Hw1HxlcX9dB z_Q?5Fsp{oDCED_tM`{+_ZZGp7bxe5#&(%AQd%n;nxO%*})E;OPy{D~SEH?H>>X_`D z=Qz=n=gS$LBo9I|D>!-XoY&Lkgq`w*MTv|7WLEf0Z7Jz9S}*%Yv^|k8EKTu}=bp?L z{~|J1Oaku;UY<6ohtVdsTH12#z7xr^kEM+YTjnVs7U6T*b(QCy@cw$qK9MolHk5bC zTBQwj(>Ap&>Zc;ho8UYERLUBMwkNhqVl3loy@_}0_Yg*X)*2MgQEJWe;KOG+hSb7& zx8B-2jsaUlPs@R@JO-*EG9oV)S#lOnWX^hDWW+fF?T^!uGOpnDsQO4=LfaGhlEjHD zNzP=xBwa!a_bkiY^voHYl6~TWTvfjdpkL+&DM|}QlX*a(R$8PE$GEa*NL&3r*&uVu zyW+2C%X@)j&uoe$TB!5q+9uD{+r`ot_0u1zP1a1jD`y61W92R5O3j1k_)ngby$K#- zhbup)xWlpp%QXPn1Yb;>O=_F8QB9L^)n|hw&b2w-tzRn~`9g6$+cak% za!r*B@CCy{8;Jf)3)_++57KrWLuyd;cNJg4cYyL5k>~0?^W!`yN{f6c4vRih%N1HE zZ-^|p~pzS8z&jH|?7;Ba}bgLh?*injW#fst3NFNJ2d%7tcjVzmvYljp{+ zm)J+y-I3=6k3@l6V=d^Wytl)18f$U8d2g2IG`|8)qw^>$kW3#@S=;JGup|Gp?nwDh z_Ap9GFz<)fGNF!9znYZBs2}1J_jA1oq?(+ErA=_9rA_@o zDg0zwNNvTY0ceX36#$I9E9Z$Bw||3eO zN}L9DBXOGBTEyR%BNAD@v`MXnRcPLuWnBKtd_hsA4PnX{ic!CpR4UsbJF~JTCc?{_ zm^P_1@T$&(?a-|EpapVW6k49lmp!x`e>wi9y1|9^!UN8mX1~icWIa>LG@@%jfP^mq z$b}X#RALL1|MWRI4*~c9XhxPLfC24~MWQ?>=N$0FR9o_M=lUVq(Pr4P(dX*N0n&4F z?vpVzc9T*|PKX+)PNEt*uIza+hU_1eD3kXR*!&O-RcTZEa#`;Q^sm^bZuhzWYSS zK{o5VvIoRgASKGIrz|CPjQTzDQ709@L2}RPD)$E(OlYAbBlBgmSD&lj*i7T12r>pc z{L&_SG0-R2GTLO{o;EpC%@!%Aq4F4|Vj^wzBLXAMPik6R&8|AmF$eL_q>jQ;9<4A+}Y}%yG3g;!B zmn$!_+*k=ojfYuCzDt|P4LqTa@g(OeN0)M(F82#$JEu+Toa=KWcO=UZJ1;oKtQ)jR zy_2H_QscqHDi7>~6@#s^(<`x&BeJrl<1;jQe-&T~K_&SEkV3NOz~^bCE>-Sb(066; zm@%|gz;?Iz4XVmI222qCF>v-_l)1z=@%fv)&(7*nunV+NxX3&JKBQyRFKCXuKRwZB zZljU@$^pGR2H&riF(~nf?W3mpE~r%LuYQGkq>qxN*cN+y`fmL=Y~O{)O_m%$Ia1$8%OkvUXv%Y72aDS^O2(U&-9~s^k>ycNBTJjE5z$=LQ?_-*50PKV+{)=g8AJD(%8_7wPR^b1p;MN?(x04lM7^^Wga9AGGC4m>2q?wE#6PH zn3*eWPh-n(UEzS0}DY&0`ewo3zRO zO%!7_w zBrtluTl<oPa-vm zd1S1@=W=Cw*0plhEz6R&d=3N6(7jn8sgmzv9l~c^qF_!y#!C*&{VKwH+QdJzMIgLq zSu1;ELr8uo7xg%|o*YQOarG?_0^hZ%E#|27IRx>x<9QRYUCN5_yew549J>>F;GSi^Pij0s z%Ot;I=S2NI?oZ}cPHE?PaB5lGNaEx<4&zCi*0e4h%hKoM+YRM*ezko{`l6HU#0o7` zmW6-hIWk`|1fiu!DbItDmveMVk+O$T;Cdn>)LChfdxc6BNn-_?e`9=q_!N=aj2xWWIz@p#>nBJO@xqpOZUk*~M0@8c+!Ff4Fw>P3(|L zUP7C!qd;gX@5!Z}JLYu^2wnPNK%W*5I)3DnkIFE99rSO>ok?4!w(ZemwJK2sni7dGf z5l`x;v`Nj9C8F2@&;ZF3@i?+xMQUPOtc1ira|Mq0Ns!axC(AKrnJ>$kY=dP9E4)W+ zqW9!i*@u;qzP>Bp{^9hm)-uYGYVD6rhb%X0Rboeg1G4X|m&WCHNqvL|Y#s{_aIrEE z?(G)6VuMihitsD*pj<5TfGsi);A={Ye3urFt?PYI4^mgAO??hUX_*JbT%iRFxIPE+ zF!Pj8Y3Oq#h4LIlEomds(KeMii+15lx%4c*`{WJ-t|ZdAvG5UEa3x~D z`AaSuQ~&bhEFRldf(hgZo5l}JLB_?o3w=0G;VDi>bn;293iO}q3+aLIit@PdO7GnQ zaH4Ai&z5kQl|OBB|#TRm<~5b0to5afPg{%4HUr ze^j(2rjUh6&QE1i`~e5)#kZHk^;tK{fp%@vI~&Tu=&T1E0G9PpS*GZ7ilyVgq}X&h zL@E5^;9}MnPV9+ZF@mh8F=?qY&?Y%oSw;!X95%|fz(E_G8|k>xj5L!zb6`XD6b!h? z91M821)u?{LxAH&Za|NOX29LrCg1jCVJhE@piS}5fJ0Ts*;>rL2{$P<%K{#h`I1ZJ zxX(#*$r)&qwN(K^2@eYRDD$3c%S0YvkA%;ZXk{MUe;~R6Fhh6>@ImJGLOZ`gQL3NCpZUxcV3I#0UeOoYL?_Gj7Bb)R>E>kTRJ|p~q|ze3 zu9QHt-0(soUsisSAAoYxaoNtx`hpgSpJdlm{3PB$Y8mAljM)#7wJWbUfG&I?zY@NX zUx_@P+!4j~AmWSJW*1*fo5Vbhx$3x_u@gRXfKcdra)$v+CdpqwJc(Tbca)gN&b!(N zAI8hRslWw#T7 z-%_d11wTz_q_8{)#&|^|>ehilb@5XSR-| zjgpb@4;7O60t65l0V@!hv$-uYDx1PtmgHA554N#&T)jt$6^_I$?j=_H;4Uelg$)p) zg-r+HODW)InxE_ivYJ*KEMMo4cPWBOn|ueWocxmg1zEBs?>AJcWHGD#g>7Fll^^m2qd?_QYAkv$NYu95`Z)B33?)P z?%>pSwSEQKM{Sz?N_^*&`V~kLsjsnu)%kLEPUObqbRM$aC%xie+c;m^xerw2I`!n-J2ewXufNq0$9xOr8clRFT3j$3Qw zIS%kko9yrNE(HmBPR@t&91c~UlQS?p_hi1*uVf6p!+?}u*2J^{Ld)Y)ze+xb=j09p z+GI^kn|wEoHo5DMHWuhIE{A!fP3}SCUAapcCob3{+T?!6(x$pw4kYGr70b@Mf@P>UPut|X6a-MYbA>k9 z-=|IPT%k?ySF{QKils9iFv}d5D6%Byl9)oyC3Xbsg;(IOWWH=0h+ZlF3i_l5Pn+x+ z(k6R`r7g$(f;`G=SlVR0U)u6ogEkH*XI^n%f$)#wweXKZu<(zZOZdk!Kx~1WOUIzV zCbS4X2bu-nUT%oW`8aJ9E^>bq280&<&R#hcs5uDucA1;rh0eQD1E5Xr_NR@+SmW8 zfAZWz?3XJHp0o)*mNJ)|Wu#5MQB~UVdXP5RGo(#w@U+R7ziNWyz9G-sOTb zd6!GT5mOK=?_q}vvD2E9x0CPpJC<%&P67pmWK$n>L-tf*=|(+kzZx~192=l9Bn!` zuIUgN5iYa6L7w;$QbNh4XcJ#tu5_3FfH=swEQ$3wxhI4BU@5#98!$4q2 z>?v@#?El!pRUWX7ExOCHHv2@5CFFfPi&ep zgXo%mr>3AclvmW7ga;fU%JH&%@>KMcL+PRiU z`hXP(EmzHLIXWUSnTRYg8FQ0*SSc$Duc#RbEgV`AUUC0{(8nj`g;y*ag;#*%#peJj zS6V=;WuMKFE}>8FIwIq0g7cEz)1>OUzX$cA`iU>64aco%h)QC`X8kXsf)7X zFY9L(~!Bb~D=kqDz z@40GHawK+GBu6^&X&o7ZY3LZb&&0J+;V%Zy6{8YOoI1C63sntU<0!^wIT zipB4;?I-b)6{6(w<+I^BhV1V{i{PJW)4fm9Fo}8P%Jdvl%5_>frm!t3`(R|ivJZBm z6fX7w>vatI77oxdxu1(R`FF917~bsoqC$rITs z7acE0LUO#st%>ghy(V!GXrsu3ijmHZ#7_A4Bz|y3isS-#9H~p;VnttA3aQ*E=g8bR zcbx6x4D++zvkRf)vQOOkx{n{e{Pw%|A6~xr;^nhnefw|kUszYZd-?3Y{q4(dzIgxc z{ps-a@prfDZ@>QX{8jll`{C=u?>M+}{`z$I?co>ePyCOUU;N^eKYjf2!^a;#y#L)N S6d*qN5C7rs{_*cW`Tqc#uz3Lh literal 0 HcmV?d00001 From 24f71176e55629a31ef70d9eef900dbec43f3144 Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Thu, 12 Jun 2025 08:38:22 +0000 Subject: [PATCH 17/93] Clarify PQC explanation in appendix to resolve #3196 --- 5.0/en/0x92-Appendix-C_Cryptography.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/5.0/en/0x92-Appendix-C_Cryptography.md b/5.0/en/0x92-Appendix-C_Cryptography.md index 60f13a3270..1c6ae570fe 100644 --- a/5.0/en/0x92-Appendix-C_Cryptography.md +++ b/5.0/en/0x92-Appendix-C_Cryptography.md @@ -299,6 +299,6 @@ Signature schemes MUST use approved key sizes and parameters per [NIST SP 800-57 ## Post-Quantum Encryption Standards -PQC implementations must be in line with [FIPS-203](https://csrc.nist.gov/pubs/fips/203/ipd)/[204](https://csrc.nist.gov/pubs/fips/204/ipd)/[205](https://csrc.nist.gov/pubs/fips/205/ipd) as there is minimal hardened code nor implementation reference yet. https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards +Post-quantum cryptography (PQC) implementations should follow [FIPS-203](https://csrc.nist.gov/pubs/fips/203/ipd), [FIPS-204](https://csrc.nist.gov/pubs/fips/204/ipd), and [FIPS-205](https://csrc.nist.gov/pubs/fips/205/ipd). At this time, there are not many hardened code examples or reference implementations available for these standards. For further details, see the [NIST announcement of the first three finalized post-quantum encryption standards (August 2024)](https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards). The proposed [mlkem768x25519](https://datatracker.ietf.org/doc/draft-kwiatkowski-tls-ecdhe-mlkem/03/) post-quantum hybrid TLS key agreement method is supported by major browsers such as [Firefox release 132](https://www.mozilla.org/en-US/firefox/132.0/releasenotes/) and [Chrome release 131](https://security.googleblog.com/2024/09/a-new-path-for-kyber-on-web.html). It may be used in cryptographic testing environments or when available within industry- or government-approved libraries. From 9a5c9415a853eca3f0291502d5558eb72a8c213f Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Sun, 22 Jun 2025 07:56:32 +0300 Subject: [PATCH 18/93] Add Korean translation in progress --- CONTRIBUTING.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 84dd7568a3..f66ab3bcb6 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -112,6 +112,7 @@ If you are interested in creating a translation, here are some pointers for how * Portuguese, see [#3182](https://github.com/OWASP/ASVS/issues/3182) * French, see [#3188](https://github.com/OWASP/ASVS/issues/3188) * Simplified Chinese, see [#3191](https://github.com/OWASP/ASVS/issues/3191) + * Korean, see [#3204](https://github.com/OWASP/ASVS/issues/3204) * v5.0.0 * None * If the language you are interested in appears, it would be great if you could reach out to the translator to see if you can help them. From 541c94d9182e92f0bb8d09904a2c016426bd385f Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Sun, 22 Jun 2025 10:06:54 +0300 Subject: [PATCH 19/93] Fix cyclonedx output to resolve #3198 (#3199) * Fix cyclonedx output * Fix cdx output file --- ...ty_Verification_Standard_5.0.0_en.cdx.json | 358 +++++++++++++++++- 5.0/tools/cyclonedx.py | 14 +- 2 files changed, 361 insertions(+), 11 deletions(-) diff --git a/5.0/docs_en/OWASP_Application_Security_Verification_Standard_5.0.0_en.cdx.json b/5.0/docs_en/OWASP_Application_Security_Verification_Standard_5.0.0_en.cdx.json index c42870ee60..add695782a 100644 --- a/5.0/docs_en/OWASP_Application_Security_Verification_Standard_5.0.0_en.cdx.json +++ b/5.0/docs_en/OWASP_Application_Security_Verification_Standard_5.0.0_en.cdx.json @@ -1,10 +1,10 @@ { "bomFormat": "CycloneDX", "specVersion": "1.6", - "serialNumber": "urn:uuid:be374acd-2d1e-4ac1-8f20-e11ace484ef2", + "serialNumber": "urn:uuid:402d2d6b-eac3-48c9-bb87-e917251b3d84", "version": 1, "metadata": { - "timestamp": "2025-05-30T05:13:11+00:00", + "timestamp": "2025-06-12T07:27:14+00:00", "licenses": [ { "license": { @@ -2670,19 +2670,367 @@ "bom-ref": "level-1", "identifier": "Level 1", "description": "This level contains the minimum requirements to consider when securing an application and represents a critical starting point.", - "requirements": [] + "requirements": [ + "V1.2.1", + "V1.2.2", + "V1.2.3", + "V1.2.4", + "V1.2.5", + "V1.3.1", + "V1.3.2", + "V1.5.1", + "V2.1.1", + "V2.2.1", + "V2.2.2", + "V2.3.1", + "V3.2.1", + "V3.2.2", + "V3.3.1", + "V3.4.1", + "V3.4.2", + "V3.5.1", + "V3.5.2", + "V3.5.3", + "V4.1.1", + "V4.4.1", + "V5.2.1", + "V5.2.2", + "V5.3.1", + "V5.3.2", + "V6.1.1", + "V6.2.1", + "V6.2.2", + "V6.2.3", + "V6.2.4", + "V6.2.5", + "V6.2.6", + "V6.2.7", + "V6.2.8", + "V6.3.1", + "V6.3.2", + "V6.4.1", + "V6.4.2", + "V7.2.1", + "V7.2.2", + "V7.2.3", + "V7.2.4", + "V7.4.1", + "V7.4.2", + "V8.1.1", + "V8.2.1", + "V8.2.2", + "V8.3.1", + "V9.1.1", + "V9.1.2", + "V9.1.3", + "V9.2.1", + "V10.4.1", + "V10.4.2", + "V10.4.3", + "V10.4.4", + "V10.4.5", + "V11.3.1", + "V11.3.2", + "V11.4.1", + "V12.1.1", + "V12.2.1", + "V12.2.2", + "V13.4.1", + "V14.2.1", + "V14.3.1", + "V15.1.1", + "V15.2.1", + "V15.3.1" + ] }, { "bom-ref": "level-2", "identifier": "Level 2", "description": "ASVS Level 2 requirements generally relate to either less common attacks or more complicated protections against common attacks. They may still be a first layer of defense, or they may require certain preconditions for the attack to be successful.", - "requirements": [] + "requirements": [ + "V1.1.1", + "V1.1.2", + "V1.2.6", + "V1.2.7", + "V1.2.8", + "V1.2.9", + "V1.3.3", + "V1.3.4", + "V1.3.5", + "V1.3.6", + "V1.3.7", + "V1.3.8", + "V1.3.9", + "V1.3.10", + "V1.3.11", + "V1.4.1", + "V1.4.2", + "V1.4.3", + "V1.5.2", + "V2.1.2", + "V2.1.3", + "V2.2.3", + "V2.3.2", + "V2.3.3", + "V2.3.4", + "V2.4.1", + "V3.3.2", + "V3.3.3", + "V3.3.4", + "V3.4.3", + "V3.4.4", + "V3.4.5", + "V3.4.6", + "V3.5.4", + "V3.5.5", + "V3.7.1", + "V3.7.2", + "V4.1.2", + "V4.1.3", + "V4.2.1", + "V4.3.1", + "V4.3.2", + "V4.4.2", + "V4.4.3", + "V4.4.4", + "V5.1.1", + "V5.2.3", + "V5.4.1", + "V5.4.2", + "V5.4.3", + "V6.1.2", + "V6.1.3", + "V6.2.9", + "V6.2.10", + "V6.2.11", + "V6.2.12", + "V6.3.3", + "V6.3.4", + "V6.4.3", + "V6.4.4", + "V6.5.1", + "V6.5.2", + "V6.5.3", + "V6.5.4", + "V6.5.5", + "V6.6.1", + "V6.6.2", + "V6.6.3", + "V6.8.1", + "V6.8.2", + "V6.8.3", + "V6.8.4", + "V7.1.1", + "V7.1.2", + "V7.1.3", + "V7.3.1", + "V7.3.2", + "V7.4.3", + "V7.4.4", + "V7.4.5", + "V7.5.1", + "V7.5.2", + "V7.6.1", + "V7.6.2", + "V8.1.2", + "V8.2.3", + "V8.4.1", + "V9.2.2", + "V9.2.3", + "V9.2.4", + "V10.1.1", + "V10.1.2", + "V10.2.1", + "V10.2.2", + "V10.3.1", + "V10.3.2", + "V10.3.3", + "V10.3.4", + "V10.4.6", + "V10.4.7", + "V10.4.8", + "V10.4.9", + "V10.4.10", + "V10.4.11", + "V10.5.1", + "V10.5.2", + "V10.5.3", + "V10.5.4", + "V10.5.5", + "V10.6.1", + "V10.6.2", + "V10.7.1", + "V10.7.2", + "V10.7.3", + "V11.1.1", + "V11.1.2", + "V11.2.1", + "V11.2.2", + "V11.2.3", + "V11.3.3", + "V11.4.2", + "V11.4.3", + "V11.4.4", + "V11.5.1", + "V11.6.1", + "V12.1.2", + "V12.1.3", + "V12.3.1", + "V12.3.2", + "V12.3.3", + "V12.3.4", + "V13.1.1", + "V13.2.1", + "V13.2.2", + "V13.2.3", + "V13.2.4", + "V13.2.5", + "V13.3.1", + "V13.3.2", + "V13.4.2", + "V13.4.3", + "V13.4.4", + "V13.4.5", + "V14.1.1", + "V14.1.2", + "V14.2.2", + "V14.2.3", + "V14.2.4", + "V14.3.2", + "V14.3.3", + "V15.1.2", + "V15.1.3", + "V15.2.2", + "V15.2.3", + "V15.3.2", + "V15.3.3", + "V15.3.4", + "V15.3.5", + "V15.3.6", + "V15.3.7", + "V16.1.1", + "V16.2.1", + "V16.2.2", + "V16.2.3", + "V16.2.4", + "V16.2.5", + "V16.3.1", + "V16.3.2", + "V16.3.3", + "V16.3.4", + "V16.4.1", + "V16.4.2", + "V16.4.3", + "V16.5.1", + "V16.5.2", + "V16.5.3", + "V17.1.1", + "V17.2.1", + "V17.2.2", + "V17.2.3", + "V17.2.4", + "V17.3.1", + "V17.3.2" + ] }, { "bom-ref": "level-3", "identifier": "Level 3", "description": "ASVS Level 3 should be the goal for applications looking to demonstrate the highest levels of security and requirements in this section are generally either defense-in-depth mechanisms or other useful but hard-to-implement controls.", - "requirements": [] + "requirements": [ + "V1.2.10", + "V1.3.12", + "V1.5.3", + "V2.3.5", + "V2.4.2", + "V3.1.1", + "V3.2.3", + "V3.3.5", + "V3.4.7", + "V3.4.8", + "V3.5.6", + "V3.5.7", + "V3.5.8", + "V3.6.1", + "V3.7.3", + "V3.7.4", + "V3.7.5", + "V4.1.4", + "V4.1.5", + "V4.2.2", + "V4.2.3", + "V4.2.4", + "V4.2.5", + "V5.2.4", + "V5.2.5", + "V5.2.6", + "V5.3.3", + "V6.3.5", + "V6.3.6", + "V6.3.7", + "V6.3.8", + "V6.4.5", + "V6.4.6", + "V6.5.6", + "V6.5.7", + "V6.5.8", + "V6.6.4", + "V6.7.1", + "V6.7.2", + "V7.5.3", + "V8.1.3", + "V8.1.4", + "V8.2.4", + "V8.3.2", + "V8.3.3", + "V8.4.2", + "V10.2.3", + "V10.3.5", + "V10.4.12", + "V10.4.13", + "V10.4.14", + "V10.4.15", + "V10.4.16", + "V11.1.3", + "V11.1.4", + "V11.2.4", + "V11.2.5", + "V11.3.4", + "V11.3.5", + "V11.5.2", + "V11.6.2", + "V11.7.1", + "V11.7.2", + "V12.1.4", + "V12.1.5", + "V12.3.5", + "V13.1.2", + "V13.1.3", + "V13.1.4", + "V13.2.6", + "V13.3.3", + "V13.3.4", + "V13.4.6", + "V13.4.7", + "V14.2.5", + "V14.2.6", + "V14.2.7", + "V14.2.8", + "V15.1.4", + "V15.1.5", + "V15.2.4", + "V15.2.5", + "V15.4.1", + "V15.4.2", + "V15.4.3", + "V15.4.4", + "V16.5.4", + "V17.1.2", + "V17.2.5", + "V17.2.6", + "V17.2.7", + "V17.2.8" + ] } ], "externalReferences": [ diff --git a/5.0/tools/cyclonedx.py b/5.0/tools/cyclonedx.py index 2f78193193..7cf944287a 100644 --- a/5.0/tools/cyclonedx.py +++ b/5.0/tools/cyclonedx.py @@ -80,12 +80,14 @@ def __init__(self, asvs_json_in): for asvs_requirement in asvs_section['Items']: requirement = self.convert_requirement(asvs_requirement, section_req['bom-ref']) requirements.append(requirement) - if 'L1' in asvs_requirement and 'Required' in asvs_requirement['L1'] and asvs_requirement['L1']['Required'] is True: - l1_requirements.append(requirement['bom-ref']) - if 'L2' in asvs_requirement and 'Required' in asvs_requirement['L2'] and asvs_requirement['L2']['Required'] is True: - l2_requirements.append(requirement['bom-ref']) - if 'L3' in asvs_requirement and 'Required' in asvs_requirement['L3'] and asvs_requirement['L3']['Required'] is True: - l3_requirements.append(requirement['bom-ref']) + # Updated logic for ASVS 5.0 JSON structure + if 'L' in asvs_requirement: + if asvs_requirement['L'] == "1": + l1_requirements.append(requirement['bom-ref']) + elif asvs_requirement['L'] == "2": + l2_requirements.append(requirement['bom-ref']) + elif asvs_requirement['L'] == "3": + l3_requirements.append(requirement['bom-ref']) self.bom['declarations']['standards'][0]['requirements'] = requirements From 763646f57931738b255892f36699f67ef468eb91 Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Fri, 1 Aug 2025 18:44:48 +0300 Subject: [PATCH 20/93] Clarify CONTRIBUTING.md --- CONTRIBUTING.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index f66ab3bcb6..1e3e222e11 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -36,12 +36,11 @@ The above specifically relates to the requirements in the ASVS. Changes to surro ## How can I help? -We would be glad to receive feedback to help us to further enhance the ASVS. +We would be glad to receive feedback to help us to further enhance the ASVS. Note however that having had intensive efforts to get out the recent release, there may be some delays in responses. Be assured that all issues will eventually be reviewed. -At this stage, we are accepting the following types of changes: +At this stage, we are most likely to immediately accept changes to surrounding text and other content such as the appendices which is not considered a breaking change for release purposes. -* Changes to surrounding text and other content such as the appendices which is not be considered to be a breaking change for release purposes. -* Changes which are considered "non-breaking" for an ASVS "patch" release. This means that requirements may be removed (for example, if they are duplicates or outdated) or made less stringent, but an application that complied with the previous release will comply with the patch release as well. +The next ASVS release is likely to be a "patch" release containing changes which are considered "non-breaking". This means that requirements may be removed (for example, if they are duplicates or outdated) or made less stringent, but an application that complied with the previous release will comply with the patch release as well. We are open to integrating changes that satisfy this definition although we need to decide on a tracking mechanism, which may also lead to a delay. If you feel there are other important changes but they would be considered breaking for a patch release, you are welcome to open an issue but please note that the issue may not be progressed until we are considering a new minor or major release, for which there is currently no fixed timeline. From 5a1ad6f6f33fcff326d3580d004581ed17cee8d1 Mon Sep 17 00:00:00 2001 From: Elar Lang <47597707+elarlang@users.noreply.github.com> Date: Fri, 1 Aug 2025 18:55:03 +0300 Subject: [PATCH 21/93] translations++ --- CONTRIBUTING.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 1e3e222e11..4170fce4a1 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -112,6 +112,7 @@ If you are interested in creating a translation, here are some pointers for how * French, see [#3188](https://github.com/OWASP/ASVS/issues/3188) * Simplified Chinese, see [#3191](https://github.com/OWASP/ASVS/issues/3191) * Korean, see [#3204](https://github.com/OWASP/ASVS/issues/3204) + * Russian, see [#3223](https://github.com/OWASP/ASVS/issues/3223) * v5.0.0 * None * If the language you are interested in appears, it would be great if you could reach out to the translator to see if you can help them. From 8518f7d6e5a2a93cbe1869bedc86c3a7b4ae0fc2 Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Sun, 10 Aug 2025 17:18:25 -0700 Subject: [PATCH 22/93] Add Spanish in progress --- CONTRIBUTING.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 4170fce4a1..d59c259956 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -113,6 +113,7 @@ If you are interested in creating a translation, here are some pointers for how * Simplified Chinese, see [#3191](https://github.com/OWASP/ASVS/issues/3191) * Korean, see [#3204](https://github.com/OWASP/ASVS/issues/3204) * Russian, see [#3223](https://github.com/OWASP/ASVS/issues/3223) + * Spanish, see [#3238](https://github.com/OWASP/ASVS/issues/3238) * v5.0.0 * None * If the language you are interested in appears, it would be great if you could reach out to the translator to see if you can help them. From 39602b20824c6af0602b1003b600bbbc1139b401 Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Fri, 20 Jun 2025 11:46:54 +0300 Subject: [PATCH 23/93] Test new action (#3) --- .github/workflows/build-documents.yml | 7 ++++++ .../workflows/publish-5.0-english-latest.yml | 23 +++++++++++++++++++ 2 files changed, 30 insertions(+) create mode 100644 .github/workflows/publish-5.0-english-latest.yml diff --git a/.github/workflows/build-documents.yml b/.github/workflows/build-documents.yml index 6bf3087549..f441f625eb 100644 --- a/.github/workflows/build-documents.yml +++ b/.github/workflows/build-documents.yml @@ -49,3 +49,10 @@ jobs: - build-image - filters uses: owasp/asvs/.github/workflows/create-5.0-outputs.yml@master + + publish-v5-latest: + if: ${{ always() && needs.filters.outputs.v5 == 'true' }} + needs: + - build-v5 + - filters + uses: ./.github/workflows/publish-5.0-english-latest.yml diff --git a/.github/workflows/publish-5.0-english-latest.yml b/.github/workflows/publish-5.0-english-latest.yml new file mode 100644 index 0000000000..c06ae21ca8 --- /dev/null +++ b/.github/workflows/publish-5.0-english-latest.yml @@ -0,0 +1,23 @@ +# This workflow uploads the generated English 5.0 documents to the 'latest' GitHub release. +name: Publish 5.0 English Docs to Latest Release + +on: + workflow_call: + +jobs: + publish-5-0-english-latest: + runs-on: ubuntu-latest + steps: + - name: Download 5.0 English artifact + uses: actions/download-artifact@v4.1.7 + with: + name: ASVS 5.0.0 + path: ./asvs-5.0-english + - name: Upload to 'latest' GitHub release + uses: softprops/action-gh-release@v2 + with: + tag_name: latest + name: Latest 5.0 English Documents + files: ./asvs-5.0-english/** + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} From e5e0404c111b17da7d9e9746d1dfd4d001830380 Mon Sep 17 00:00:00 2001 From: tghosth Date: Fri, 20 Jun 2025 11:47:44 +0300 Subject: [PATCH 24/93] Test output changes --- 5.0/en/0x01-Frontispiece.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/5.0/en/0x01-Frontispiece.md b/5.0/en/0x01-Frontispiece.md index b6ad6346a2..c28f698081 100644 --- a/5.0/en/0x01-Frontispiece.md +++ b/5.0/en/0x01-Frontispiece.md @@ -6,7 +6,7 @@ The Application Security Verification Standard is a list of application security ## Copyright and License -Version 5.0.0, May 2025 +Version 5.0.0, May 2025, OUTPUT TEST ![license](../images/license.png) From ee0350d750d355fb59577501e2ef11292079bf67 Mon Sep 17 00:00:00 2001 From: tghosth Date: Fri, 20 Jun 2025 12:01:16 +0300 Subject: [PATCH 25/93] Add more detail --- .github/workflows/build-documents.yml | 2 +- .../workflows/publish-5.0-english-latest.yml | 23 ---------------- .github/workflows/publish-5.0-latest.yml | 27 +++++++++++++++++++ 5.0/en/0x01-Frontispiece.md | 2 +- 4 files changed, 29 insertions(+), 25 deletions(-) delete mode 100644 .github/workflows/publish-5.0-english-latest.yml create mode 100644 .github/workflows/publish-5.0-latest.yml diff --git a/.github/workflows/build-documents.yml b/.github/workflows/build-documents.yml index f441f625eb..6b4a462393 100644 --- a/.github/workflows/build-documents.yml +++ b/.github/workflows/build-documents.yml @@ -55,4 +55,4 @@ jobs: needs: - build-v5 - filters - uses: ./.github/workflows/publish-5.0-english-latest.yml + uses: ./.github/workflows/publish-5.0-latest.yml diff --git a/.github/workflows/publish-5.0-english-latest.yml b/.github/workflows/publish-5.0-english-latest.yml deleted file mode 100644 index c06ae21ca8..0000000000 --- a/.github/workflows/publish-5.0-english-latest.yml +++ /dev/null @@ -1,23 +0,0 @@ -# This workflow uploads the generated English 5.0 documents to the 'latest' GitHub release. -name: Publish 5.0 English Docs to Latest Release - -on: - workflow_call: - -jobs: - publish-5-0-english-latest: - runs-on: ubuntu-latest - steps: - - name: Download 5.0 English artifact - uses: actions/download-artifact@v4.1.7 - with: - name: ASVS 5.0.0 - path: ./asvs-5.0-english - - name: Upload to 'latest' GitHub release - uses: softprops/action-gh-release@v2 - with: - tag_name: latest - name: Latest 5.0 English Documents - files: ./asvs-5.0-english/** - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/publish-5.0-latest.yml b/.github/workflows/publish-5.0-latest.yml new file mode 100644 index 0000000000..7618e41d00 --- /dev/null +++ b/.github/workflows/publish-5.0-latest.yml @@ -0,0 +1,27 @@ +# This workflow uploads the generated 5.0 documents to the 'latest' GitHub release. +name: Publish 5.0 Latest to Release + +on: + workflow_call: + +jobs: + publish-5-0-latest: + runs-on: ubuntu-latest + steps: + - name: Download 5.0 artifact + uses: actions/download-artifact@v4.1.7 + with: + name: ASVS 5.0.0 + path: ./asvs-5.0-latest + - name: Upload to 'latest' GitHub release + uses: softprops/action-gh-release@v2 + with: + tag_name: latest + name: OWASP Application Security Verification Standard (Bleeding Edge) + body: | + This release will be automatically updated on an ongoing basis with the output files from the bleeding edge version of the ASVS, i.e. the latest version from the master branch. + + Obviously this version is undergoing constant changes and cannot be relied upon for stability, but is provided for convenience. + files: ./asvs-5.0-latest/** + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/5.0/en/0x01-Frontispiece.md b/5.0/en/0x01-Frontispiece.md index c28f698081..a88101b845 100644 --- a/5.0/en/0x01-Frontispiece.md +++ b/5.0/en/0x01-Frontispiece.md @@ -6,7 +6,7 @@ The Application Security Verification Standard is a list of application security ## Copyright and License -Version 5.0.0, May 2025, OUTPUT TEST +Version 5.0.0, May 2025, OUTPUT TEST 2 ![license](../images/license.png) From c1f05b5ef343b5fb1e88605505699409ac383c2f Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Fri, 20 Jun 2025 12:19:29 +0300 Subject: [PATCH 26/93] Update 0x01-Frontispiece.md --- 5.0/en/0x01-Frontispiece.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/5.0/en/0x01-Frontispiece.md b/5.0/en/0x01-Frontispiece.md index a88101b845..b6ad6346a2 100644 --- a/5.0/en/0x01-Frontispiece.md +++ b/5.0/en/0x01-Frontispiece.md @@ -6,7 +6,7 @@ The Application Security Verification Standard is a list of application security ## Copyright and License -Version 5.0.0, May 2025, OUTPUT TEST 2 +Version 5.0.0, May 2025 ![license](../images/license.png) From e6ce450780599c665d98e2fec9102f3d20d1c214 Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Fri, 20 Jun 2025 12:23:12 +0300 Subject: [PATCH 27/93] Only run on push to master --- .github/workflows/build-documents.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-documents.yml b/.github/workflows/build-documents.yml index 6b4a462393..de00e86347 100644 --- a/.github/workflows/build-documents.yml +++ b/.github/workflows/build-documents.yml @@ -51,8 +51,8 @@ jobs: uses: owasp/asvs/.github/workflows/create-5.0-outputs.yml@master publish-v5-latest: - if: ${{ always() && needs.filters.outputs.v5 == 'true' }} + if: ${{ github.event_name == 'push' && always() && needs.filters.outputs.v5 == 'true' }} needs: - build-v5 - filters - uses: ./.github/workflows/publish-5.0-latest.yml + uses: ./.github/workflows/publish-5.0-latest.yml \ No newline at end of file From 4a9848d9893ea81ca2cbf2f865c8beeb2d38b74d Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Fri, 20 Jun 2025 12:24:56 +0300 Subject: [PATCH 28/93] test --- 5.0/en/0x01-Frontispiece.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/5.0/en/0x01-Frontispiece.md b/5.0/en/0x01-Frontispiece.md index b6ad6346a2..606a431251 100644 --- a/5.0/en/0x01-Frontispiece.md +++ b/5.0/en/0x01-Frontispiece.md @@ -6,7 +6,7 @@ The Application Security Verification Standard is a list of application security ## Copyright and License -Version 5.0.0, May 2025 +Version 5.0.0, May 2025, TEST 1 ![license](../images/license.png) From d7cbb08fa370df8fb7e130ab4920f12c022533fe Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Fri, 20 Jun 2025 12:27:02 +0300 Subject: [PATCH 29/93] Clean up --- 5.0/en/0x01-Frontispiece.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/5.0/en/0x01-Frontispiece.md b/5.0/en/0x01-Frontispiece.md index 606a431251..b6ad6346a2 100644 --- a/5.0/en/0x01-Frontispiece.md +++ b/5.0/en/0x01-Frontispiece.md @@ -6,7 +6,7 @@ The Application Security Verification Standard is a list of application security ## Copyright and License -Version 5.0.0, May 2025, TEST 1 +Version 5.0.0, May 2025 ![license](../images/license.png) From 5e96ad7a0c9b887a7fa3060193089fa53b19c151 Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Wed, 16 Jul 2025 17:10:40 +0300 Subject: [PATCH 30/93] Changes requested by @ike --- .github/workflows/build-documents.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build-documents.yml b/.github/workflows/build-documents.yml index de00e86347..2ce50817ce 100644 --- a/.github/workflows/build-documents.yml +++ b/.github/workflows/build-documents.yml @@ -51,7 +51,7 @@ jobs: uses: owasp/asvs/.github/workflows/create-5.0-outputs.yml@master publish-v5-latest: - if: ${{ github.event_name == 'push' && always() && needs.filters.outputs.v5 == 'true' }} + if: ${{ github.event_name == 'push' && needs.filters.outputs.v5 == 'true' && github.ref == 'refs/heads/master' }} needs: - build-v5 - filters From 803e92404aaf5911cf4d5fc69eb75f06aadd625c Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Wed, 16 Jul 2025 17:18:05 +0300 Subject: [PATCH 31/93] Test output (#4) --- 5.0/en/0x01-Frontispiece.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/5.0/en/0x01-Frontispiece.md b/5.0/en/0x01-Frontispiece.md index b6ad6346a2..04c46b6f3a 100644 --- a/5.0/en/0x01-Frontispiece.md +++ b/5.0/en/0x01-Frontispiece.md @@ -6,7 +6,7 @@ The Application Security Verification Standard is a list of application security ## Copyright and License -Version 5.0.0, May 2025 +Version 5.0.0, May 2025, Test output ![license](../images/license.png) From 6ac37cdbeaaab9a626f7a75f93ca97d4e3fae168 Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Wed, 16 Jul 2025 17:24:22 +0300 Subject: [PATCH 32/93] Troubleshooting --- .github/workflows/build-documents.yml | 2 +- 5.0/en/0x01-Frontispiece.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-documents.yml b/.github/workflows/build-documents.yml index 2ce50817ce..bf38303f51 100644 --- a/.github/workflows/build-documents.yml +++ b/.github/workflows/build-documents.yml @@ -51,7 +51,7 @@ jobs: uses: owasp/asvs/.github/workflows/create-5.0-outputs.yml@master publish-v5-latest: - if: ${{ github.event_name == 'push' && needs.filters.outputs.v5 == 'true' && github.ref == 'refs/heads/master' }} + if: ${{ github.event_name == 'push' && needs.filters.outputs.v5 == 'true' && always() && github.ref == 'refs/heads/master' }} needs: - build-v5 - filters diff --git a/5.0/en/0x01-Frontispiece.md b/5.0/en/0x01-Frontispiece.md index 04c46b6f3a..3e6b2b9fda 100644 --- a/5.0/en/0x01-Frontispiece.md +++ b/5.0/en/0x01-Frontispiece.md @@ -6,7 +6,7 @@ The Application Security Verification Standard is a list of application security ## Copyright and License -Version 5.0.0, May 2025, Test output +Version 5.0.0, May 2025, Test output 2 ![license](../images/license.png) From 8bfd18913d2101cddfc11fbac476fd36c7eb48e8 Mon Sep 17 00:00:00 2001 From: tghosth Date: Wed, 16 Jul 2025 17:36:42 +0300 Subject: [PATCH 33/93] Debugging job --- .github/workflows/build-documents.yml | 15 +++++++++++++++ 5.0/en/0x01-Frontispiece.md | 2 +- 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build-documents.yml b/.github/workflows/build-documents.yml index bf38303f51..39b59d3316 100644 --- a/.github/workflows/build-documents.yml +++ b/.github/workflows/build-documents.yml @@ -50,6 +50,21 @@ jobs: - filters uses: owasp/asvs/.github/workflows/create-5.0-outputs.yml@master + debug-publish-conditions: + if: ${{ always() }} + needs: + - build-v5 + - filters + runs-on: ubuntu-latest + steps: + - name: Debug publish conditions + run: | + echo "github.event_name: ${{ github.event_name }}" + echo "needs.filters.outputs.v5: ${{ needs.filters.outputs.v5 }}" + echo "github.ref: ${{ github.ref }}" + echo "github.ref == 'refs/heads/master': ${{ github.ref == 'refs/heads/master' }}" + echo "Overall condition would be: ${{ github.event_name == 'push' && needs.filters.outputs.v5 == 'true' && github.ref == 'refs/heads/master' }}" + publish-v5-latest: if: ${{ github.event_name == 'push' && needs.filters.outputs.v5 == 'true' && always() && github.ref == 'refs/heads/master' }} needs: diff --git a/5.0/en/0x01-Frontispiece.md b/5.0/en/0x01-Frontispiece.md index 3e6b2b9fda..914e8a4138 100644 --- a/5.0/en/0x01-Frontispiece.md +++ b/5.0/en/0x01-Frontispiece.md @@ -6,7 +6,7 @@ The Application Security Verification Standard is a list of application security ## Copyright and License -Version 5.0.0, May 2025, Test output 2 +Version 5.0.0, May 2025, Test output 3 ![license](../images/license.png) From 6ff77eda8d0c3d68ac2e9ee428ca2de9f6be33b3 Mon Sep 17 00:00:00 2001 From: tghosth Date: Wed, 16 Jul 2025 17:42:30 +0300 Subject: [PATCH 34/93] Remove always --- .github/workflows/build-documents.yml | 2 +- 5.0/en/0x01-Frontispiece.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-documents.yml b/.github/workflows/build-documents.yml index 39b59d3316..054021954f 100644 --- a/.github/workflows/build-documents.yml +++ b/.github/workflows/build-documents.yml @@ -66,7 +66,7 @@ jobs: echo "Overall condition would be: ${{ github.event_name == 'push' && needs.filters.outputs.v5 == 'true' && github.ref == 'refs/heads/master' }}" publish-v5-latest: - if: ${{ github.event_name == 'push' && needs.filters.outputs.v5 == 'true' && always() && github.ref == 'refs/heads/master' }} + if: ${{ github.event_name == 'push' && needs.filters.outputs.v5 == 'true' && github.ref == 'refs/heads/master' }} needs: - build-v5 - filters diff --git a/5.0/en/0x01-Frontispiece.md b/5.0/en/0x01-Frontispiece.md index 914e8a4138..79da27ad50 100644 --- a/5.0/en/0x01-Frontispiece.md +++ b/5.0/en/0x01-Frontispiece.md @@ -6,7 +6,7 @@ The Application Security Verification Standard is a list of application security ## Copyright and License -Version 5.0.0, May 2025, Test output 3 +Version 5.0.0, May 2025, Test output 4 ![license](../images/license.png) From 1e825ed879157a695611146e6cca4f1354ca1eda Mon Sep 17 00:00:00 2001 From: tghosth Date: Wed, 16 Jul 2025 17:47:05 +0300 Subject: [PATCH 35/93] Fix name --- .github/workflows/publish-5.0-latest.yml | 1 + 5.0/en/0x01-Frontispiece.md | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish-5.0-latest.yml b/.github/workflows/publish-5.0-latest.yml index 7618e41d00..0f69d4acf2 100644 --- a/.github/workflows/publish-5.0-latest.yml +++ b/.github/workflows/publish-5.0-latest.yml @@ -7,6 +7,7 @@ on: jobs: publish-5-0-latest: runs-on: ubuntu-latest + name: Publish 5.0 Latest steps: - name: Download 5.0 artifact uses: actions/download-artifact@v4.1.7 diff --git a/5.0/en/0x01-Frontispiece.md b/5.0/en/0x01-Frontispiece.md index 79da27ad50..e197abda8c 100644 --- a/5.0/en/0x01-Frontispiece.md +++ b/5.0/en/0x01-Frontispiece.md @@ -6,7 +6,7 @@ The Application Security Verification Standard is a list of application security ## Copyright and License -Version 5.0.0, May 2025, Test output 4 +Version 5.0.0, May 2025, Test output 5 ![license](../images/license.png) From f26e5158bf32b5c63e5db581efa3e3e9392efcb4 Mon Sep 17 00:00:00 2001 From: tghosth Date: Wed, 16 Jul 2025 17:56:44 +0300 Subject: [PATCH 36/93] Debugging --- .github/workflows/build-documents.yml | 1 + 5.0/en/0x01-Frontispiece.md | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build-documents.yml b/.github/workflows/build-documents.yml index 054021954f..8c57961835 100644 --- a/.github/workflows/build-documents.yml +++ b/.github/workflows/build-documents.yml @@ -63,6 +63,7 @@ jobs: echo "needs.filters.outputs.v5: ${{ needs.filters.outputs.v5 }}" echo "github.ref: ${{ github.ref }}" echo "github.ref == 'refs/heads/master': ${{ github.ref == 'refs/heads/master' }}" + echo "build-v5 result: ${{ needs.build-v5.result }}" echo "Overall condition would be: ${{ github.event_name == 'push' && needs.filters.outputs.v5 == 'true' && github.ref == 'refs/heads/master' }}" publish-v5-latest: diff --git a/5.0/en/0x01-Frontispiece.md b/5.0/en/0x01-Frontispiece.md index e197abda8c..83561418ef 100644 --- a/5.0/en/0x01-Frontispiece.md +++ b/5.0/en/0x01-Frontispiece.md @@ -6,7 +6,7 @@ The Application Security Verification Standard is a list of application security ## Copyright and License -Version 5.0.0, May 2025, Test output 5 +Version 5.0.0, May 2025, Test output 6 ![license](../images/license.png) From 6876b23031d92ab1573e9c6e7ad7089cbfd70869 Mon Sep 17 00:00:00 2001 From: tghosth Date: Wed, 16 Jul 2025 18:07:01 +0300 Subject: [PATCH 37/93] Test fix --- .github/workflows/build-documents.yml | 2 +- 5.0/en/0x01-Frontispiece.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-documents.yml b/.github/workflows/build-documents.yml index 8c57961835..7a180f6cba 100644 --- a/.github/workflows/build-documents.yml +++ b/.github/workflows/build-documents.yml @@ -67,7 +67,7 @@ jobs: echo "Overall condition would be: ${{ github.event_name == 'push' && needs.filters.outputs.v5 == 'true' && github.ref == 'refs/heads/master' }}" publish-v5-latest: - if: ${{ github.event_name == 'push' && needs.filters.outputs.v5 == 'true' && github.ref == 'refs/heads/master' }} + if: ${{ always() && github.event_name == 'push' && needs.filters.outputs.v5 == 'true' && github.ref == 'refs/heads/master' && (needs.build-v5.result == 'success') }} needs: - build-v5 - filters diff --git a/5.0/en/0x01-Frontispiece.md b/5.0/en/0x01-Frontispiece.md index 83561418ef..a6ac9bc588 100644 --- a/5.0/en/0x01-Frontispiece.md +++ b/5.0/en/0x01-Frontispiece.md @@ -6,7 +6,7 @@ The Application Security Verification Standard is a list of application security ## Copyright and License -Version 5.0.0, May 2025, Test output 6 +Version 5.0.0, May 2025, Test output 7 ![license](../images/license.png) From 4d793f3bd7cd9b00f6ca7391a3d8190453ca0127 Mon Sep 17 00:00:00 2001 From: tghosth Date: Wed, 16 Jul 2025 18:23:02 +0300 Subject: [PATCH 38/93] Trigger again --- 5.0/en/0x01-Frontispiece.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/5.0/en/0x01-Frontispiece.md b/5.0/en/0x01-Frontispiece.md index a6ac9bc588..b6ad6346a2 100644 --- a/5.0/en/0x01-Frontispiece.md +++ b/5.0/en/0x01-Frontispiece.md @@ -6,7 +6,7 @@ The Application Security Verification Standard is a list of application security ## Copyright and License -Version 5.0.0, May 2025, Test output 7 +Version 5.0.0, May 2025 ![license](../images/license.png) From bdd5ee830a02c2c35f69bce5144e3ede3a1874fa Mon Sep 17 00:00:00 2001 From: tghosth Date: Wed, 16 Jul 2025 18:38:47 +0300 Subject: [PATCH 39/93] Upgrade actions --- .../build-and-publish-docker-image.yml | 4 ++-- .github/workflows/build-documents.yml | 20 ++----------------- .github/workflows/create-4.0-outputs.yml | 6 +++--- .github/workflows/create-5.0-outputs.yml | 6 +++--- .github/workflows/markdown-linter.yml | 4 ++-- .github/workflows/publish-5.0-latest.yml | 17 ++++++++++++---- .github/workflows/spell-check.yml | 2 +- .github/workflows/url-checker.yml | 2 +- 4.0/en/0x01-Frontispiece.md | 2 +- 5.0/en/0x01-Frontispiece.md | 2 +- 10 files changed, 29 insertions(+), 36 deletions(-) diff --git a/.github/workflows/build-and-publish-docker-image.yml b/.github/workflows/build-and-publish-docker-image.yml index 043af7902a..dd037145c5 100644 --- a/.github/workflows/build-and-publish-docker-image.yml +++ b/.github/workflows/build-and-publish-docker-image.yml @@ -14,10 +14,10 @@ jobs: packages: write name: Build and publish steps: - - uses: actions/checkout@v4.1.1 + - uses: actions/checkout@v4.2.2 - name: 'Login to GitHub Container Registry' - uses: docker/login-action@v3.0.0 + uses: docker/login-action@v3.4.0 with: registry: ghcr.io username: ${{github.actor}} diff --git a/.github/workflows/build-documents.yml b/.github/workflows/build-documents.yml index 7a180f6cba..e121db969a 100644 --- a/.github/workflows/build-documents.yml +++ b/.github/workflows/build-documents.yml @@ -15,8 +15,8 @@ jobs: filters: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4.1.1 - - uses: dorny/paths-filter@v3.0.0 + - uses: actions/checkout@v4.2.2 + - uses: dorny/paths-filter@v3.0.2 id: filter with: filters: | @@ -50,22 +50,6 @@ jobs: - filters uses: owasp/asvs/.github/workflows/create-5.0-outputs.yml@master - debug-publish-conditions: - if: ${{ always() }} - needs: - - build-v5 - - filters - runs-on: ubuntu-latest - steps: - - name: Debug publish conditions - run: | - echo "github.event_name: ${{ github.event_name }}" - echo "needs.filters.outputs.v5: ${{ needs.filters.outputs.v5 }}" - echo "github.ref: ${{ github.ref }}" - echo "github.ref == 'refs/heads/master': ${{ github.ref == 'refs/heads/master' }}" - echo "build-v5 result: ${{ needs.build-v5.result }}" - echo "Overall condition would be: ${{ github.event_name == 'push' && needs.filters.outputs.v5 == 'true' && github.ref == 'refs/heads/master' }}" - publish-v5-latest: if: ${{ always() && github.event_name == 'push' && needs.filters.outputs.v5 == 'true' && github.ref == 'refs/heads/master' && (needs.build-v5.result == 'success') }} needs: diff --git a/.github/workflows/create-4.0-outputs.yml b/.github/workflows/create-4.0-outputs.yml index cb80cd81ba..ba4e3b5c93 100644 --- a/.github/workflows/create-4.0-outputs.yml +++ b/.github/workflows/create-4.0-outputs.yml @@ -12,14 +12,14 @@ jobs: runs-on: ubuntu-latest name: Generate 4.0 outputs steps: - - uses: docker/login-action@v3.0.0 + - uses: docker/login-action@v3.4.0 with: registry: ghcr.io username: ${{github.actor}} password: ${{secrets.GITHUB_TOKEN}} - - uses: actions/checkout@v4.1.1 + - uses: actions/checkout@v4.2.2 - run: make 4.0 - - uses: actions/upload-artifact@v4.3.0 + - uses: actions/upload-artifact@v4.4.3 with: name: ASVS 4.0.3 path: 4.0/docs_* diff --git a/.github/workflows/create-5.0-outputs.yml b/.github/workflows/create-5.0-outputs.yml index 9c0e7cbe4f..7da4b797b3 100644 --- a/.github/workflows/create-5.0-outputs.yml +++ b/.github/workflows/create-5.0-outputs.yml @@ -12,14 +12,14 @@ jobs: runs-on: ubuntu-latest name: Generate 5.0 outputs steps: - - uses: docker/login-action@v3.0.0 + - uses: docker/login-action@v3.4.0 with: registry: ghcr.io username: ${{github.actor}} password: ${{secrets.GITHUB_TOKEN}} - - uses: actions/checkout@v4.1.1 + - uses: actions/checkout@v4.2.2 - run: make 5.0 - - uses: actions/upload-artifact@v4.3.0 + - uses: actions/upload-artifact@v4.4.3 with: name: ASVS 5.0.0 path: 5.0/dist/en/ diff --git a/.github/workflows/markdown-linter.yml b/.github/workflows/markdown-linter.yml index 80a6781d64..47a46efb05 100644 --- a/.github/workflows/markdown-linter.yml +++ b/.github/workflows/markdown-linter.yml @@ -12,11 +12,11 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@v4.2.2 with: fetch-depth: 1 - name: markdownlint-cli - uses: nosborn/github-action-markdown-cli@v2.0.0 + uses: nosborn/github-action-markdown-cli@v3.5.0 with: files: './5.0*' config_file: ".markdownlint.jsonc" diff --git a/.github/workflows/publish-5.0-latest.yml b/.github/workflows/publish-5.0-latest.yml index 0f69d4acf2..dc9570c328 100644 --- a/.github/workflows/publish-5.0-latest.yml +++ b/.github/workflows/publish-5.0-latest.yml @@ -9,20 +9,29 @@ jobs: runs-on: ubuntu-latest name: Publish 5.0 Latest steps: + - name: Checkout code + uses: actions/checkout@v4.2.2 - name: Download 5.0 artifact - uses: actions/download-artifact@v4.1.7 + uses: actions/download-artifact@v4.3.0 with: name: ASVS 5.0.0 path: ./asvs-5.0-latest + - name: Generate timestamp + id: timestamp + run: echo "datetime=$(date -u +"%Y-%m-%d %H:%M:%S UTC")" >> $GITHUB_OUTPUT - name: Upload to 'latest' GitHub release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@v2.3.2 with: tag_name: latest name: OWASP Application Security Verification Standard (Bleeding Edge) body: | - This release will be automatically updated on an ongoing basis with the output files from the bleeding edge version of the ASVS, i.e. the latest version from the master branch. + This release is automatically updated with the latest changes from the master branch of the ASVS project. - Obviously this version is undergoing constant changes and cannot be relied upon for stability, but is provided for convenience. + **Generated on:** ${{ steps.timestamp.outputs.datetime }} + + This bleeding-edge version represents the most current state of the ASVS documentation and should be used for testing and preview purposes only. For production use, please refer to the stable releases. + + **Note:** This version is undergoing constant changes and cannot be relied upon for stability, but is provided for convenience and early access to the latest improvements. files: ./asvs-5.0-latest/** env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/spell-check.yml b/.github/workflows/spell-check.yml index b1b5a6ab21..e64367e18e 100644 --- a/.github/workflows/spell-check.yml +++ b/.github/workflows/spell-check.yml @@ -20,7 +20,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@v4.2.2 - name: Set up Node.js uses: actions/setup-node@v4 diff --git a/.github/workflows/url-checker.yml b/.github/workflows/url-checker.yml index 96cb4f1908..2463ed8960 100644 --- a/.github/workflows/url-checker.yml +++ b/.github/workflows/url-checker.yml @@ -16,7 +16,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v4.2.2 - name: Set options id: options diff --git a/4.0/en/0x01-Frontispiece.md b/4.0/en/0x01-Frontispiece.md index 0c34669b38..999c3edfbe 100644 --- a/4.0/en/0x01-Frontispiece.md +++ b/4.0/en/0x01-Frontispiece.md @@ -6,7 +6,7 @@ The Application Security Verification Standard is a list of application security ## Copyright and License -Version 4.0.3, October 2021 +Version 4.0.3, October 2021, Test 1 ![license](../images/license.png) diff --git a/5.0/en/0x01-Frontispiece.md b/5.0/en/0x01-Frontispiece.md index b6ad6346a2..43f00c721c 100644 --- a/5.0/en/0x01-Frontispiece.md +++ b/5.0/en/0x01-Frontispiece.md @@ -6,7 +6,7 @@ The Application Security Verification Standard is a list of application security ## Copyright and License -Version 5.0.0, May 2025 +Version 5.0.0, May 2025, test 1 ![license](../images/license.png) From d3af34547e63a59620d473bdaeaf69e66fc88de0 Mon Sep 17 00:00:00 2001 From: tghosth Date: Wed, 16 Jul 2025 18:42:45 +0300 Subject: [PATCH 40/93] Linting --- 5.0/en/0x92-Appendix-C_Cryptography.md | 16 ++++++++-------- 5.0/en/0x94-Appendix-E_Contributors.md | 2 +- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/5.0/en/0x92-Appendix-C_Cryptography.md b/5.0/en/0x92-Appendix-C_Cryptography.md index 1c6ae570fe..d4d2cc324b 100644 --- a/5.0/en/0x92-Appendix-C_Cryptography.md +++ b/5.0/en/0x92-Appendix-C_Cryptography.md @@ -133,14 +133,14 @@ MAC-then-encrypt is still allowed for compatibility with legacy applications. It | AEAD mechanism | Reference | Status |--------------------------|---------|-----| -|AES-GCM | [SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A -|AES-CCM | [SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A -|ChaCha-Poly1305 | [RFC 7539](https://datatracker.ietf.org/doc/html/rfc7539) | A -|AEGIS-256 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A -|AEGIS-128 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A -|AEGIS-128L| [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A -|Encrypt-then-MAC | | A -|MAC-then-encrypt | | L +|AES-GCM | [SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | +|AES-CCM | [SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | +|ChaCha-Poly1305 | [RFC 7539](https://datatracker.ietf.org/doc/html/rfc7539) | A | +|AEGIS-256 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +|AEGIS-128 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +|AEGIS-128L| [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +|Encrypt-then-MAC | | A | +|MAC-then-encrypt | | L | ## Hash Functions diff --git a/5.0/en/0x94-Appendix-E_Contributors.md b/5.0/en/0x94-Appendix-E_Contributors.md index 44d2436627..4b0fcbc565 100644 --- a/5.0/en/0x94-Appendix-E_Contributors.md +++ b/5.0/en/0x94-Appendix-E_Contributors.md @@ -68,4 +68,4 @@ If you are aware of any mistakes or would like your name to appear differently, | Lyz ([lyz-code](https://github.com/lyz-code)) | Martin Riedel ([mrtnrdl](https://github.com/mrtnrdl)) | KIM Jaesuck ([tcaesvk](https://github.com/tcaesvk)) | Barbara Schachner ([bschach](https://github.com/bschach)) | | René Reuter ([AresSec](https://github.com/AresSec)) | [carhackpils](https://github.com/carhackpils) | Tyler ([tyler2cr](https://github.com/tyler2cr)) | Hugo ([hasousa](https://github.com/hasousa)) | | Wouter Bloeyaert ([Someniak](https://github.com/Someniak)) | Mark de Rijk ([markderijkinfosec](https://github.com/markderijkinfosec)) | Ramin ([picohub](https://github.com/picohub)) | Philip D. Turner ([philipdturner](https://github.com/philipdturner)) | -| Will Chatham ([willc](https://github.com/willc)) | +| Will Chatham ([willc](https://github.com/willc)) | | | From 4963e2bc55e8f9607c05d88dafb0c52c10ba4a4c Mon Sep 17 00:00:00 2001 From: tghosth Date: Wed, 16 Jul 2025 18:49:48 +0300 Subject: [PATCH 41/93] Refine rule --- .github/workflows/publish-5.0-latest.yml | 19 ++++++++++++++++--- 4.0/en/0x01-Frontispiece.md | 2 +- 5.0/en/0x01-Frontispiece.md | 2 +- 3 files changed, 18 insertions(+), 5 deletions(-) diff --git a/.github/workflows/publish-5.0-latest.yml b/.github/workflows/publish-5.0-latest.yml index dc9570c328..561c9d3fb7 100644 --- a/.github/workflows/publish-5.0-latest.yml +++ b/.github/workflows/publish-5.0-latest.yml @@ -19,13 +19,16 @@ jobs: - name: Generate timestamp id: timestamp run: echo "datetime=$(date -u +"%Y-%m-%d %H:%M:%S UTC")" >> $GITHUB_OUTPUT - - name: Upload to 'latest' GitHub release + - name: Generate temporary tag name + id: temp_tag + run: echo "tag=latest-temp-$(date +%s)" >> $GITHUB_OUTPUT + - name: Create temporary release uses: softprops/action-gh-release@v2.3.2 with: - tag_name: latest + tag_name: ${{ steps.temp_tag.outputs.tag }} name: OWASP Application Security Verification Standard (Bleeding Edge) body: | - This release is automatically updated with the latest changes from the master branch of the ASVS project. + This release is automatically recreated with the latest changes from the master branch of the ASVS project. **Generated on:** ${{ steps.timestamp.outputs.datetime }} @@ -35,3 +38,13 @@ jobs: files: ./asvs-5.0-latest/** env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + - name: Delete existing 'latest' release + run: | + gh release delete latest --yes || echo "No existing 'latest' release to delete" + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + - name: Update release to use 'latest' tag + run: | + gh release edit ${{ steps.temp_tag.outputs.tag }} --tag latest + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/4.0/en/0x01-Frontispiece.md b/4.0/en/0x01-Frontispiece.md index 999c3edfbe..0c34669b38 100644 --- a/4.0/en/0x01-Frontispiece.md +++ b/4.0/en/0x01-Frontispiece.md @@ -6,7 +6,7 @@ The Application Security Verification Standard is a list of application security ## Copyright and License -Version 4.0.3, October 2021, Test 1 +Version 4.0.3, October 2021 ![license](../images/license.png) diff --git a/5.0/en/0x01-Frontispiece.md b/5.0/en/0x01-Frontispiece.md index 43f00c721c..b6ad6346a2 100644 --- a/5.0/en/0x01-Frontispiece.md +++ b/5.0/en/0x01-Frontispiece.md @@ -6,7 +6,7 @@ The Application Security Verification Standard is a list of application security ## Copyright and License -Version 5.0.0, May 2025, test 1 +Version 5.0.0, May 2025 ![license](../images/license.png) From 60c3d0282bbe1b7f590102b93112e1396df13df3 Mon Sep 17 00:00:00 2001 From: tghosth Date: Wed, 16 Jul 2025 18:59:17 +0300 Subject: [PATCH 42/93] Update commit --- .github/workflows/publish-5.0-latest.yml | 37 ++++++++++-------------- 5.0/en/0x01-Frontispiece.md | 2 +- 5.0/en/0x92-Appendix-C_Cryptography.md | 2 +- 5.0/en/0x94-Appendix-E_Contributors.md | 2 +- 4 files changed, 19 insertions(+), 24 deletions(-) diff --git a/.github/workflows/publish-5.0-latest.yml b/.github/workflows/publish-5.0-latest.yml index 561c9d3fb7..2474230df7 100644 --- a/.github/workflows/publish-5.0-latest.yml +++ b/.github/workflows/publish-5.0-latest.yml @@ -19,32 +19,27 @@ jobs: - name: Generate timestamp id: timestamp run: echo "datetime=$(date -u +"%Y-%m-%d %H:%M:%S UTC")" >> $GITHUB_OUTPUT - - name: Generate temporary tag name - id: temp_tag - run: echo "tag=latest-temp-$(date +%s)" >> $GITHUB_OUTPUT - - name: Create temporary release - uses: softprops/action-gh-release@v2.3.2 - with: - tag_name: ${{ steps.temp_tag.outputs.tag }} - name: OWASP Application Security Verification Standard (Bleeding Edge) - body: | - This release is automatically recreated with the latest changes from the master branch of the ASVS project. - - **Generated on:** ${{ steps.timestamp.outputs.datetime }} - - This bleeding-edge version represents the most current state of the ASVS documentation and should be used for testing and preview purposes only. For production use, please refer to the stable releases. - - **Note:** This version is undergoing constant changes and cannot be relied upon for stability, but is provided for convenience and early access to the latest improvements. - files: ./asvs-5.0-latest/** - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Delete existing 'latest' release run: | gh release delete latest --yes || echo "No existing 'latest' release to delete" env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - name: Update release to use 'latest' tag + - name: Delete existing 'latest' tag run: | - gh release edit ${{ steps.temp_tag.outputs.tag }} --tag latest + git push origin :refs/tags/latest || echo "No existing 'latest' tag to delete" + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + - name: Create fresh 'latest' release + run: | + gh release create latest \ + --title "OWASP Application Security Verification Standard (Bleeding Edge)" \ + --notes "This release is automatically recreated with the latest changes from the master branch of the ASVS project. + + **Generated on:** ${{ steps.timestamp.outputs.datetime }} + + This bleeding-edge version represents the most current state of the ASVS documentation and should be used for testing and preview purposes only. For production use, please refer to the stable releases. + + **Note:** This version is undergoing constant changes and cannot be relied upon for stability, but is provided for convenience and early access to the latest improvements." \ + ./asvs-5.0-latest/* env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/5.0/en/0x01-Frontispiece.md b/5.0/en/0x01-Frontispiece.md index b6ad6346a2..43f00c721c 100644 --- a/5.0/en/0x01-Frontispiece.md +++ b/5.0/en/0x01-Frontispiece.md @@ -6,7 +6,7 @@ The Application Security Verification Standard is a list of application security ## Copyright and License -Version 5.0.0, May 2025 +Version 5.0.0, May 2025, test 1 ![license](../images/license.png) diff --git a/5.0/en/0x92-Appendix-C_Cryptography.md b/5.0/en/0x92-Appendix-C_Cryptography.md index d4d2cc324b..cef83b1cbc 100644 --- a/5.0/en/0x92-Appendix-C_Cryptography.md +++ b/5.0/en/0x92-Appendix-C_Cryptography.md @@ -131,7 +131,7 @@ The application should preferably use an approved AEAD scheme. It might alternat MAC-then-encrypt is still allowed for compatibility with legacy applications. It is used in TLS v1.2 with old ciphers suites. -| AEAD mechanism | Reference | Status +| AEAD mechanism | Reference | Status | |--------------------------|---------|-----| |AES-GCM | [SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | |AES-CCM | [SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | diff --git a/5.0/en/0x94-Appendix-E_Contributors.md b/5.0/en/0x94-Appendix-E_Contributors.md index 4b0fcbc565..d03ead0e08 100644 --- a/5.0/en/0x94-Appendix-E_Contributors.md +++ b/5.0/en/0x94-Appendix-E_Contributors.md @@ -68,4 +68,4 @@ If you are aware of any mistakes or would like your name to appear differently, | Lyz ([lyz-code](https://github.com/lyz-code)) | Martin Riedel ([mrtnrdl](https://github.com/mrtnrdl)) | KIM Jaesuck ([tcaesvk](https://github.com/tcaesvk)) | Barbara Schachner ([bschach](https://github.com/bschach)) | | René Reuter ([AresSec](https://github.com/AresSec)) | [carhackpils](https://github.com/carhackpils) | Tyler ([tyler2cr](https://github.com/tyler2cr)) | Hugo ([hasousa](https://github.com/hasousa)) | | Wouter Bloeyaert ([Someniak](https://github.com/Someniak)) | Mark de Rijk ([markderijkinfosec](https://github.com/markderijkinfosec)) | Ramin ([picohub](https://github.com/picohub)) | Philip D. Turner ([philipdturner](https://github.com/philipdturner)) | -| Will Chatham ([willc](https://github.com/willc)) | | | +| Will Chatham ([willc](https://github.com/willc)) | | | | From bbb6c893c0a21f752f6969eb670f85b4fb1a6327 Mon Sep 17 00:00:00 2001 From: tghosth Date: Wed, 16 Jul 2025 19:02:23 +0300 Subject: [PATCH 43/93] Retrigger --- 5.0/en/0x01-Frontispiece.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/5.0/en/0x01-Frontispiece.md b/5.0/en/0x01-Frontispiece.md index 43f00c721c..bb22c3adbd 100644 --- a/5.0/en/0x01-Frontispiece.md +++ b/5.0/en/0x01-Frontispiece.md @@ -6,7 +6,7 @@ The Application Security Verification Standard is a list of application security ## Copyright and License -Version 5.0.0, May 2025, test 1 +Version 5.0.0, May 2025, test 2 ![license](../images/license.png) From 370decf0733d3f5ae7bb7f662a349ffc9741936b Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Wed, 16 Jul 2025 19:12:15 +0300 Subject: [PATCH 44/93] Trigger again --- 5.0/en/0x01-Frontispiece.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/5.0/en/0x01-Frontispiece.md b/5.0/en/0x01-Frontispiece.md index bb22c3adbd..f8aa3781da 100644 --- a/5.0/en/0x01-Frontispiece.md +++ b/5.0/en/0x01-Frontispiece.md @@ -6,7 +6,7 @@ The Application Security Verification Standard is a list of application security ## Copyright and License -Version 5.0.0, May 2025, test 2 +Version 5.0.0, May 2025, test 3 ![license](../images/license.png) From 6cc8c237cc3eb085b392334b1e69e26cdbaa573e Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Thu, 17 Jul 2025 09:33:11 +0300 Subject: [PATCH 45/93] Continuing to test --- .github/workflows/create-5.0-outputs.yml | 11 ++++++++--- 5.0/en/0x01-Frontispiece.md | 2 +- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.github/workflows/create-5.0-outputs.yml b/.github/workflows/create-5.0-outputs.yml index 7da4b797b3..f0815eec40 100644 --- a/.github/workflows/create-5.0-outputs.yml +++ b/.github/workflows/create-5.0-outputs.yml @@ -7,19 +7,24 @@ on: # Scan on-demand through GitHub Actions interface: workflow_dispatch: {} +# Updated versions: +# docker/login-action@v3.4.0 +# actions/checkout@v4.2.2 +# actions/upload-artifact@v4.4.3 + jobs: prepare_outputs: runs-on: ubuntu-latest name: Generate 5.0 outputs steps: - - uses: docker/login-action@v3.4.0 + - uses: docker/login-action@v3.0.0 with: registry: ghcr.io username: ${{github.actor}} password: ${{secrets.GITHUB_TOKEN}} - - uses: actions/checkout@v4.2.2 + - uses: actions/checkout@v4.1.1 - run: make 5.0 - - uses: actions/upload-artifact@v4.4.3 + - uses: actions/upload-artifact@v4.3.0 with: name: ASVS 5.0.0 path: 5.0/dist/en/ diff --git a/5.0/en/0x01-Frontispiece.md b/5.0/en/0x01-Frontispiece.md index f8aa3781da..a39adf937b 100644 --- a/5.0/en/0x01-Frontispiece.md +++ b/5.0/en/0x01-Frontispiece.md @@ -6,7 +6,7 @@ The Application Security Verification Standard is a list of application security ## Copyright and License -Version 5.0.0, May 2025, test 3 +Version 5.0.0, May 2025, test 4 ![license](../images/license.png) From 1b6835d894ca909b2a6300757df60ef0a05d6b0f Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Thu, 17 Jul 2025 09:41:06 +0300 Subject: [PATCH 46/93] Hopefully now fixed... --- 5.0/en/0x01-Frontispiece.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/5.0/en/0x01-Frontispiece.md b/5.0/en/0x01-Frontispiece.md index a39adf937b..b6ad6346a2 100644 --- a/5.0/en/0x01-Frontispiece.md +++ b/5.0/en/0x01-Frontispiece.md @@ -6,7 +6,7 @@ The Application Security Verification Standard is a list of application security ## Copyright and License -Version 5.0.0, May 2025, test 4 +Version 5.0.0, May 2025 ![license](../images/license.png) From 4cb804c5c2159f5643371b6af7482a2c3c516ba7 Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Thu, 11 Sep 2025 10:48:44 +0300 Subject: [PATCH 47/93] Updated release notes to include link to stable release v5.0.0. (#3249) * Updated release notes to include link to stable release v5.0.0. Updated release notes to include link to stable release v5.0.0. * Fix typo in release notes for ASVS documentation --- .github/workflows/publish-5.0-latest.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/publish-5.0-latest.yml b/.github/workflows/publish-5.0-latest.yml index 2474230df7..7730db3df2 100644 --- a/.github/workflows/publish-5.0-latest.yml +++ b/.github/workflows/publish-5.0-latest.yml @@ -37,7 +37,7 @@ jobs: **Generated on:** ${{ steps.timestamp.outputs.datetime }} - This bleeding-edge version represents the most current state of the ASVS documentation and should be used for testing and preview purposes only. For production use, please refer to the stable releases. + This bleeding-edge version represents the most current state of the ASVS documentation and should be used for testing and preview purposes only. For production use, please refer to the stable releases (The latest stable release is [v5.0.0](https://github.com/OWASP/ASVS/releases/tag/v5.0.0_release)). **Note:** This version is undergoing constant changes and cannot be relied upon for stability, but is provided for convenience and early access to the latest improvements." \ ./asvs-5.0-latest/* From fa898fcf6f0ba48612429839aa83fab0ecaa8f08 Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Thu, 18 Sep 2025 13:00:28 +0300 Subject: [PATCH 48/93] Clarify versioning definitions (#3256) * Clarify versioning definitions * Fix punctuation --- CONTRIBUTING.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index d59c259956..005808010d 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -28,9 +28,9 @@ We will no longer be accepting changes to the 4.0 folder which is now fixed at t ASVS releases follow the pattern "Major.Minor.Patch" and the numbers provide information on what has changed within the release. In a major release, the first number will change, in a minor release, the second number will change, and in a patch release, the third number will change. -* Major release - Full reorganization, almost everything may have changed, including requirement numbers. Reevaluation for compliance will be necessary (for example, 4.0.3 -> 5.0.0). -* Minor release - Requirements may be added or removed, but overall numbering will stay the same. Reevaluation for compliance will be necessary, but should be easier (for example, 5.0.0 -> 5.1.0). -* Patch release - Requirements may be removed (for example, if they are duplicates or outdated) or made less stringent, but an application that complied with the previous release will comply with the patch release as well (for example, 5.0.0 -> 5.0.1). +* Major release - Full reorganization, almost everything may have changed, including requirement numbers and chapter and section structure. Reevaluation for compliance will be necessary (for example, 4.0.3 -> 5.0.0). +* Minor release - Requirements may be added, removed, split, or merged but overall numbering and the section structure will stay the same with no additions or removals. Reevaluation for compliance will be necessary, but should be easier (for example, 5.0.0 -> 5.1.0). The restrictions mean that requirements within a sections may not be in ascending level order. Levels may be increased or decreased. +* Patch release - Requirements may be removed (for example, if they are duplicates or outdated) or made less stringent, but an application that complied with the previous release will comply with the patch release as well (for example, 5.0.0 -> 5.0.1). A level number may be increased but not decreased. The above specifically relates to the requirements in the ASVS. Changes to surrounding text and other content such as the appendices will not be considered to be a breaking change. From 59d37ba20c957b9b9088cce5c112eded08e6c21c Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Sun, 21 Sep 2025 20:24:11 +0300 Subject: [PATCH 49/93] Add Panjabi translation reference in CONTRIBUTING.md (#3259) --- CONTRIBUTING.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 005808010d..3502ae0d77 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -114,6 +114,7 @@ If you are interested in creating a translation, here are some pointers for how * Korean, see [#3204](https://github.com/OWASP/ASVS/issues/3204) * Russian, see [#3223](https://github.com/OWASP/ASVS/issues/3223) * Spanish, see [#3238](https://github.com/OWASP/ASVS/issues/3238) + * Panjabi, see[#3252](https://github.com/OWASP/ASVS/issues/3252) * v5.0.0 * None * If the language you are interested in appears, it would be great if you could reach out to the translator to see if you can help them. From 90e981aed5143acc229ed3c5b2dd659cf5a0d9de Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Sun, 21 Sep 2025 17:16:04 +0300 Subject: [PATCH 50/93] Update SUPPORTERS.md --- SUPPORTERS.md | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/SUPPORTERS.md b/SUPPORTERS.md index bfeee05838..8cb1571137 100644 --- a/SUPPORTERS.md +++ b/SUPPORTERS.md @@ -30,8 +30,6 @@ Organizations who have allowed contributors to spend significant time working on Organizations who have donated $7,000 or more to the project via OWASP. Supporter will be listed in this section for 3 years from the date of the donation. -[](https://about.google/) - ## Secondary supporters Organizations who have donated $3,000 or more to the project via OWASP. Supporter will be listed in this section for 2 years from the date of the donation. @@ -46,15 +44,12 @@ Organizations who have donated $500 or more to the project via OWASP. Supporter -[](https://www.crest-approved.org/members/)     [](https://forwardsecurity.com/)     [](https://en.omegapoint.se/) +[](https://forwardsecurity.com/)     [](https://en.omegapoint.se/) ## Associate supporters Organizations who have donated another amount to the project via OWASP. Supporter will be listed in this section for 1 year from the date of the donation. - - - From e657098dbe047c897086b628dc9d3109d7afb64b Mon Sep 17 00:00:00 2001 From: ataseren Date: Mon, 29 Sep 2025 22:09:06 +0300 Subject: [PATCH 51/93] ASVS v5.0.0 Turkish translation and Translation Checker (#3171 / #3222) * First steps and progress update * progress update * 0x03-Using-ASVS.md completed * 0x04-Assessment_and_Certification.md completed * started translation of V2 * progress on v2 translation * Translation of 0x11-V2-Authentication.md completed * Started translation process again, with the RC1 announced * translation progress * translation progress * small progress * Continuing translation, awaiting commit from other device * Committed from main device, proceeding with v10 * v10-11 completed * v13 halfway * proceeding with v15 * translation complete, md linter issues will be checked and proof-reading will be conducted * First fix of proofreading, proceeding with 0x05 * Final fixes for linting and proofreading * First commit for translation validation scripts * Added comments and print statements * Case verified for newline mismatch and fixed the translation file * Completed validation scripts and workflow, tested my own translation files and fixed them too * Fixed trailing spaces in 0x92-Appendix-C_Cryptography.md --- .github/workflows/validate_translation.yml | 49 +++ 5.0/tools/translation_validation/req_check.py | 126 ++++++++ .../structural_check.py | 68 ++++ 5.0/tr/0x00-Header.yaml | 16 + 5.0/tr/0x01-Frontispiece.md | 46 +++ 5.0/tr/0x02-Preface.md | 29 ++ 5.0/tr/0x03-What-is-the-ASVS.md | 195 +++++++++++ 5.0/tr/0x04-Assessment_and_Certification.md | 47 +++ 5.0/tr/0x05-For-Users-Of-4.0.md | 90 ++++++ 5.0/tr/0x10-V1-Encoding-and-Sanitization.md | 104 ++++++ .../0x11-V2-Validation-and-Business-Logic.md | 73 +++++ 5.0/tr/0x12-V3-Web-Frontend-Security.md | 101 ++++++ 5.0/tr/0x13-V4-API-and-Web-Service.md | 64 ++++ 5.0/tr/0x14-V5-File-Handling.md | 54 ++++ 5.0/tr/0x15-V6-Authentication.md | 166 ++++++++++ 5.0/tr/0x16-V7-Session-Management.md | 91 ++++++ 5.0/tr/0x17-V8-Authorization.md | 56 ++++ 5.0/tr/0x18-V9-Self-contained-Tokens.md | 36 +++ 5.0/tr/0x19-V10-OAuth-and-OIDC.md | 169 ++++++++++ 5.0/tr/0x20-V11-Cryptography.md | 107 ++++++ 5.0/tr/0x21-V12-Secure-Communication.md | 57 ++++ 5.0/tr/0x22-V13-Configuration.md | 68 ++++ 5.0/tr/0x23-V14-Data-Protection.md | 60 ++++ ...0x24-V15-Secure-Coding-and-Architecture.md | 77 +++++ ...V16-Security-Logging-and-Error-Handling.md | 84 +++++ 5.0/tr/0x26-V17-WebRTC.md | 75 +++++ 5.0/tr/0x90-Appendix-A_Glossary.md | 88 +++++ 5.0/tr/0x91-Appendix-B_References.md | 43 +++ 5.0/tr/0x92-Appendix-C_Cryptography.md | 304 ++++++++++++++++++ 5.0/tr/0x93-Appendix-D_Recommendations.md | 49 +++ 5.0/tr/0x94-Appendix-E_Contributors.md | 71 ++++ 31 files changed, 2663 insertions(+) create mode 100644 .github/workflows/validate_translation.yml create mode 100644 5.0/tools/translation_validation/req_check.py create mode 100644 5.0/tools/translation_validation/structural_check.py create mode 100644 5.0/tr/0x00-Header.yaml create mode 100644 5.0/tr/0x01-Frontispiece.md create mode 100644 5.0/tr/0x02-Preface.md create mode 100644 5.0/tr/0x03-What-is-the-ASVS.md create mode 100644 5.0/tr/0x04-Assessment_and_Certification.md create mode 100644 5.0/tr/0x05-For-Users-Of-4.0.md create mode 100644 5.0/tr/0x10-V1-Encoding-and-Sanitization.md create mode 100644 5.0/tr/0x11-V2-Validation-and-Business-Logic.md create mode 100644 5.0/tr/0x12-V3-Web-Frontend-Security.md create mode 100644 5.0/tr/0x13-V4-API-and-Web-Service.md create mode 100644 5.0/tr/0x14-V5-File-Handling.md create mode 100644 5.0/tr/0x15-V6-Authentication.md create mode 100644 5.0/tr/0x16-V7-Session-Management.md create mode 100644 5.0/tr/0x17-V8-Authorization.md create mode 100644 5.0/tr/0x18-V9-Self-contained-Tokens.md create mode 100644 5.0/tr/0x19-V10-OAuth-and-OIDC.md create mode 100644 5.0/tr/0x20-V11-Cryptography.md create mode 100644 5.0/tr/0x21-V12-Secure-Communication.md create mode 100644 5.0/tr/0x22-V13-Configuration.md create mode 100644 5.0/tr/0x23-V14-Data-Protection.md create mode 100644 5.0/tr/0x24-V15-Secure-Coding-and-Architecture.md create mode 100644 5.0/tr/0x25-V16-Security-Logging-and-Error-Handling.md create mode 100644 5.0/tr/0x26-V17-WebRTC.md create mode 100644 5.0/tr/0x90-Appendix-A_Glossary.md create mode 100644 5.0/tr/0x91-Appendix-B_References.md create mode 100644 5.0/tr/0x92-Appendix-C_Cryptography.md create mode 100644 5.0/tr/0x93-Appendix-D_Recommendations.md create mode 100644 5.0/tr/0x94-Appendix-E_Contributors.md diff --git a/.github/workflows/validate_translation.yml b/.github/workflows/validate_translation.yml new file mode 100644 index 0000000000..08d833eef7 --- /dev/null +++ b/.github/workflows/validate_translation.yml @@ -0,0 +1,49 @@ +name: Validate ASVS Translation + +on: + workflow_dispatch: + inputs: + translated_folder: + description: "Name of the folder containing translated files (inside docs/)" + required: true + + +jobs: + validate: + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Set up Python + uses: actions/setup-python@v5 + with: + python-version: "3.11" + + - name: Run validation scripts + run: | + set -e + ORIGINAL_DIR="5.0/en" + TRANSLATED_DIR="5.0/${{ github.event.inputs.translated_folder }}" + + if [ ! -d "$TRANSLATED_DIR" ]; then + echo "❌ Translated directory not found: $TRANSLATED_DIR" + exit 1 + fi + + for file in "$ORIGINAL_DIR"/*.md; do + fname=$(basename "$file") + translate="$TRANSLATED_DIR/$fname" + + if [ ! -f "$translate" ]; then + echo "❌ Missing translation for $fname" + exit 1 + fi + + echo "🔍 Validating $fname ..." + if [ "$fname" != "0x92-Appendix-C_Cryptography.md" ]; then + python 5.0/tools/translation_validation/req_check.py --og "$file" --tr "$translate" + fi + python 5.0/tools/translation_validation/structural_check.py --og "$file" --tr "$translate" + done diff --git a/5.0/tools/translation_validation/req_check.py b/5.0/tools/translation_validation/req_check.py new file mode 100644 index 0000000000..950d4564ec --- /dev/null +++ b/5.0/tools/translation_validation/req_check.py @@ -0,0 +1,126 @@ + +# This script validates that requirements in a translated ASVS file maintains the same content and structural format as the original file. +# It compares the positions of blank lines between the original and translated files to ensure consistency. +# Usage: +# python reg_check.py --og --tr +# Arguments: +# --og : Path to the original ASVS file +# --tr : Path to the translated ASVS file + +import argparse +import re +import sys + +# Arguments are processed at the beginning to allow function reuse +parser = argparse.ArgumentParser( + description="Validate that all ASVS requirements exist correctly in translation" +) +parser.add_argument("--og", required=True, help="Path to original ASVS file") +parser.add_argument("--tr", required=True, help="Path to translated ASVS file") +args = parser.parse_args() + + + +def extract_special_chars(text: str) -> set[str]: + """ + Extract non-alphanumeric, non-space, non-markdown special characters. + """ + return set(re.findall(r"[^a-zA-Z0-9\s\|\*\-_#]", text)) + +def extract_table_rows(text: str) -> list[list[str]]: + """ + Extracts table rows from markdown, returns as list of column lists. + """ + rows = [] + for line in text.splitlines(): + if line.strip().startswith("|") and not line.strip().startswith("| :---") and not line.strip().startswith("| #"): + cols = [c.strip() for c in line.split("|")[1:-1]] # drop leading/trailing '|' + rows.append(cols) + return rows + +def extract_requirements(text: str) -> set[str]: + # Extracts the requirements' numerical value with regex + + return set(re.findall(r"\*\*(\d+\.\d+\.\d+)\*\*", text)) + + +def check_reg_count(original: str, translation: str) -> bool: + check = True + + original_reqs = extract_requirements(original) + translation_reqs = extract_requirements(translation) + + # Compare sets + missing_reqs = original_reqs - translation_reqs + extra_reqs = translation_reqs - original_reqs + + print("=== Requirement Validation ===") + print(f"Original count: {len(original_reqs)}") + print(f"Translation count: {len(translation_reqs)}") + print() + + if missing_reqs: + print(f"❌ Missing in translation ({len(missing_reqs)}):") + for req in sorted(missing_reqs): + print(f" - {req} from original file: {args.og}") + check = False + + if extra_reqs: + print(f"\n⚠️ Extra in translation ({len(extra_reqs)}):") + for req in sorted(extra_reqs): + print(f" - {req} at translation file: {args.tr}") + check = False + + if check: + print("✅ All requirements exist in translation.") + + return check + +def compare_rows_columns(original: str, translation: str) -> bool: + + original_rows = extract_table_rows(original) + translation_rows = extract_table_rows(translation) + + errors = [] + for i, (o_row, t_row) in enumerate(zip(original_rows, translation_rows), start=1): + + # Compare all except description + for j in range(len(o_row)): + if j == len(o_row) - 2: + continue + if o_row[j] != t_row[j]: + errors.append(f"At requirement {o_row[0]}, Column {j+1}: mismatch (Original value:'{o_row[j]}', Translation value:'{t_row[j]}')") + + if errors: + print("❌ Content mismatches found:") + for err in errors: + print(" -", err) + return False + else: + print("✅ All requirement IDs and non-description columns match") + return True + +def main(): + + # Read files + with open(args.og, encoding="utf-8") as f: + original_text = f.read() + with open(args.tr, encoding="utf-8") as f: + translation_text = f.read() + + if not check_reg_count(original_text, translation_text): + print("Please fix the issues about missing/extra requirements to proceed with other checks.") + sys.exit(1) + + if not compare_rows_columns(original_text, translation_text): + print("Please fix the content mismatches for validation.") + sys.exit(1) + + print("\nAll checks passed successfully.") + + ### Question: I think we shouldn't check special characters, as some languages may not use the same ones but + ### still be correct. What do you think? Also, the translator may use different characters for parentheses, dashes, etc. + ### to make it look better in their language. + +if __name__ == "__main__": + main() \ No newline at end of file diff --git a/5.0/tools/translation_validation/structural_check.py b/5.0/tools/translation_validation/structural_check.py new file mode 100644 index 0000000000..735e1cab5e --- /dev/null +++ b/5.0/tools/translation_validation/structural_check.py @@ -0,0 +1,68 @@ +# This script validates that a translated ASVS file maintains the same structural format as the original file. +# It compares the positions of blank lines between the original and translated files to ensure consistency. +# Usage: +# python structural_check.py --og --tr +# Arguments: +# --og : Path to the original ASVS file +# --tr : Path to the translated ASVS file + +import argparse +import sys + + +parser = argparse.ArgumentParser( + description="Validate that translation has the same structure as the original" +) +parser.add_argument("--og", required=True, help="Path to original ASVS file") +parser.add_argument("--tr", required=True, help="Path to translated ASVS file") +args = parser.parse_args() + +def extract_newlines(text: str): + """Return list of line numbers that are blank.""" + return [i for i, line in enumerate(text.splitlines(), start=1) if line.strip() == ""] + +def check_newlines(orig, trans): + """Compare newline positions and return mismatch info""" + min_len = min(len(orig), len(trans)) + for idx in range(min_len): + if orig[idx] != trans[idx]: + # Report the index and the actual line numbers + return ( + False, + f"Mismatch at newline {idx+1}: original blank line at {orig[idx]}, translated blank line at {trans[idx]}", + len(orig), + len(trans) + ) + if len(orig) != len(trans): + # One list is longer + return ( + False, + f"Extra blank lines in one of the files, starting at newline {min_len+1}", + len(orig), + len(trans) + ) + return (True, None, len(orig), len(trans)) + +def main(): + with open(args.og, encoding="utf-8") as f: + original_text = f.read() + with open(args.tr, encoding="utf-8") as f: + translation_text = f.read() + + orig_newlines = extract_newlines(original_text) + trans_newlines = extract_newlines(translation_text) + + ok, msg, o_count, t_count = check_newlines(orig_newlines, trans_newlines) + + if not ok: + print(f"❌ Newline mismatch detected at file {args.og}") + print(f" - Original count: {o_count}, Translation count: {t_count}") + print(f" - First issue: {msg}") + print(" To see the other mismatched newline positions, solve the first issue and re-run.") + sys.exit(1) + else: + print(f"✅ Newlines match exactly (count={o_count})") + sys.exit(0) + +if __name__ == "__main__": + main() diff --git a/5.0/tr/0x00-Header.yaml b/5.0/tr/0x00-Header.yaml new file mode 100644 index 0000000000..008ba53ddc --- /dev/null +++ b/5.0/tr/0x00-Header.yaml @@ -0,0 +1,16 @@ +--- + title: "Uygulama Güvenliği Doğrulama Standardı" + subtitle: "Versiyon 5.0.0" + date: Mayıs 2025 + titlepage: true + titlepage-rule-height: 0 + titlepage-logo: "images/owasp_logo_1c_notext.png" + table-use-row-colors: true + toc: true + toc-own-page: true + geometry: "left=2cm,right=2cm,top=3cm,bottom=3cm" + CJKmainfont: "Noto Sans CJK JP" + mainfont: "Source Serif 4" + sansfont: "Source Sans 3" +--- + diff --git a/5.0/tr/0x01-Frontispiece.md b/5.0/tr/0x01-Frontispiece.md new file mode 100644 index 0000000000..10cc928d18 --- /dev/null +++ b/5.0/tr/0x01-Frontispiece.md @@ -0,0 +1,46 @@ +# Bilgilendirme + +## Standart Hakkında + +Uygulama Güvenliği Doğrulama Standardı, mimarlar, geliştiriciler, test uzmanları, güvenlik profesyonelleri, araç satıcıları ve tüketiciler tarafından güvenli uygulamaları tanımlamak, inşa etmek, test etmek ve doğrulamak için kullanılabilecek uygulama güvenliği gereksinimleri veya testlerinin bir listesidir. + +## Telif Hakkı ve Lisans + +Versiyon 5.0.0, Mayıs 2025 + +![license](../images/license.png) + +Copyright © 2008-2025 The OWASP Foundation. + +Bu doküman [Creative Commons Attribution-ShareAlike 4.0 Uluslararası Lisansı](https://creativecommons.org/licenses/by-sa/4.0/) altında yayımlanmıştır. + +Dokümanın yeniden kullanımı veya dağıtımı esnasında bu lisans göz önünde bulundurulmalıdır. + +## Proje Liderleri + +| | | +|---------------------- |----------------- | +| Elar Lang | Josh C Grossman | +| Jim Manico | Daniel Cuthbert | + +## Çalışma Grubu + +| | | | | +|---------------- |------------------ |------------------- |----------------- | +| Tobias Ahnoff | Ralph Andalis | Ryan Armstrong | Gabriel Corona | +| Meghan Jacquot | Shanni Prutchi | Iman Sharafaldin | Eden Yardeni | + +## Diğer Önemli Katkıda Bulunanlar + +| | | +|-------------------|-------------------| +| Sjoerd Langkemper | Isaac Lewis | +| Mark Carney | Sandro Gauci | + +## Diğer Katkıda Bulunanlar ve Değerlendirenler + +Diğer katkıda bulunanların bir listesini Ek E'ye ekledik. + +Eğer 5.x katkıda bulunanlar listesinde eksik bir kişi varsa, gelecekteki 5.x güncellemelerinde eklenmesi için lütfen GitHub'da bir olay açın. + +Uygulama Güvenliği Doğrulama Standardı, 2008'de ASVS 1.0'dan 2019'da ASVS 4.0'a kadar katkıda bulunanların emeğiyle inşa edilmiştir. ASVS'nin bugünkü yapısının ve doğrulama maddelerinin çoğu, başlangıçta Andrew van der Stock, Mike Boberski, Jeff Williams ve/veya Dave Wichers tarafından yazılmış olsa da, katkıda bulunan çok daha fazla kişi bulunmaktadır. Daha önce katkıda bulunan herkese teşekkür ederiz. Önceki sürümlere katkıda bulunanların tam listesi için lütfen önceki ilgili sürümleri inceleyin. diff --git a/5.0/tr/0x02-Preface.md b/5.0/tr/0x02-Preface.md new file mode 100644 index 0000000000..685fb10e54 --- /dev/null +++ b/5.0/tr/0x02-Preface.md @@ -0,0 +1,29 @@ +# Önsöz + +Uygulama Güvenliği Doğrulama Standardı (ASVS) 5.0 sürümüne hoş geldiniz. + +## Giriş + +İlk olarak 2008 yılında küresel bir topluluk iş birliğiyle başlatılan ASVS, modern web uygulamaları ve servislerinin tasarımı, geliştirilmesi ve test edilmesi için kapsamlı bir güvenlik gereksinimleri setini tanımlar. + +2019’da ASVS 4.0 sürümü ve 2021’deki küçük güncellemesi (v4.0.3) sonrası, 5.0 sürümü yazılım güvenliğindeki en son gelişmeleri yansıtacak şekilde modernleştirilmiş önemli bir dönüm noktasıdır. + +ASVS 5.0, proje liderleri, çalışma grubu üyeleri ve bunlardan daha geniş OWASP topluluğunun bu önemli standardı güncellemek ve geliştirmek amacıyla verdikleri yoğun katkıların sonucudur. + +## 5.0 Sürümünün Arkasındaki İlkeler + +Bu büyük revizyon, birkaç temel ilke göz önünde bulundurularak geliştirilmiştir: + +* Daha Net Kapsam ve Odak: Standardın bu sürümü, adındaki temel dayanaklar "Uygulama, Güvenlik, Doğrulama ve Standart" ile daha doğrudan uyumlu olacak şekilde tasarlanmıştır. Gereksinimler, belirli teknik uygulamaları zorunlu kılmak yerine, güvenlik açıklarının önlenmesine vurgu yapacak şekilde yeniden yazılmıştır. Gereksinim metinlerinin kendi kendilerini açıklaması ve neden var olduklarını açıklaması amaçlanmıştır. + +* Belgelenmiş Güvenlik Kararları Desteği: ASVS 5.0, temel güvenlik kararlarının belgelenmesine dair gereksinimler getirmektedir. Bu sayede izlenebilirlik artar ve bağlama duyarlı uygulamalar desteklenerek, organizasyonların güvenlik duruşlarını özel ihtiyaç ve risklerine göre uyarlamalarına olanak sağlar. + +* Güncellenmiş Seviyeler: ASVS üç katmanlı modelini korurken, benimsenmelerinin kolaylaştırması için seviye tanımları geliştirilmiştir. Seviye 1, ASVS’yi benimsemenin ilk adımı olarak tasarlanmıştır ve ilk savunma katmanını sağlamaktadır. Seviye 2, standart güvenlik uygulamalarının kapsamlı bir görünümünü sunar. Seviye 3 ise gelişmiş ve yüksek seviye güvence gereksinimlerini kapsar. + +* Yeniden Yapılandırılmış ve Genişletilmiş İçerik: ASVS 5.0, 17 bölümde yaklaşık 350 gereksinimi içermektedir. Bölümler, açıklık ve kullanılabilirliği artırmak için yeniden düzenlenmiştir. Geçişi kolaylaştırmak amacıyla v4.0 ile v5.0 arasında çift yönlü bir eşleştirme sağlanmıştır. + +## ASVS'nin Geleceği + +Bir uygulamanın güvenliğini sağlamak hiçbir zaman tam anlamıyla bitmeyeceği gibi, ASVS de bitmeyecektir. 5.0 sürümü büyük bir adım olsa da, geliştirme süreci devam etmektedir. Bu sürüm, topluluğun biriken geliştirmelerden ve eklemelerden faydalanmasını sağlamakla kalmaz, aynı zamanda gelecekteki iyileştirmeler için zemin hazırlar. Bunlar arasında topluluk tarafından oluşturulan uygulama ve doğrulama rehberlerinin temel gereksinim seti üzerine inşa edilmesi de olabilir. + +ASVS 5.0, güvenli yazılım geliştirme için güvenilir bir temel oluşturacak şekilde tasarlanmıştır. Topluluk, uygulama güvenliğinin durumunu kolektif olarak ilerletmek için bu standardı benimsemeye, katkıda bulunmaya ve üzerine inşa etmeye davet edilmektedir. diff --git a/5.0/tr/0x03-What-is-the-ASVS.md b/5.0/tr/0x03-What-is-the-ASVS.md new file mode 100644 index 0000000000..0802a8a406 --- /dev/null +++ b/5.0/tr/0x03-What-is-the-ASVS.md @@ -0,0 +1,195 @@ +# ASVS Nedir? + +Uygulama Güvenliği Doğrulama Standardı (ASVS), web uygulamaları ve hizmetleri için güvenlik gereksinimlerini tanımlar ve güvenli uygulamalar tasarlamayı, geliştirmeyi ve sürdürmeyi veya bunların güvenliğini değerlendirmeyi amaçlayan herkes için değerli bir kaynaktır. + +Bu bölümde ASVS'nin kapsamı, önceliğe dayalı seviyelerinin yapısı ve standart için birincil kullanım durumları da dahil olmak üzere ASVS'yi kullanmanın temel yönleri özetlenmektedir. + +## ASVS'nin Kapsamı + +ASVS'nin kapsamı adıyla tanımlanmaktadır: Uygulama, Güvenlik, Doğrulama ve Standart. Ulaşılması gereken güvenlik ilkelerini tanımlamak amacıyla hangi gereksinimlerin dahil edileceğini veya hariç tutulacağını belirler. Kapsam, uygulama gereksinimleri için temel teşkil eden dokümantasyon gereksinimlerini de dikkate alır. + +Saldırganlar için kapsam diye bir şey yoktur. Bu nedenle ASVS gereksinimleri, CI/CD süreçleri, hosting ve operasyonel faaliyetler de dahil olmak üzere uygulama yaşam döngüsünün diğer yönlerine ilişkin yönlendirmelerle birlikte değerlendirilmelidir. + +### Uygulama + +ASVS bir “uygulamayı”, güvenlik kontrollerinin entegre edilmesi gereken ve geliştirilmekte olan yazılım ürünü olarak tanımlar. ASVS, geliştirme yaşam döngüsü faaliyetlerini belirlemez veya uygulamanın bir CI/CD boru hattı aracılığıyla nasıl oluşturulması gerektiğini dikte etmez. Bunun yerine, ürünün kendi içinde elde edilmesi gereken güvenlik sonuçlarını belirtir. + +Web Uygulaması Güvenlik Duvarları (WAF'lar), yük dengeleyiciler veya proxy'ler gibi HTTP trafiğini sunan, değiştiren veya doğrulayan bileşenler, bazı güvenlik kontrolleri doğrudan bunlara bağlı olduğundan veya bunlar aracılığıyla uygulanabildiğinden, bu özel amaçlar için uygulamanın bir parçası olarak kabul edilebilir. Bu bileşenler, önbelleğe alınan yanıtlar, hız sınırlaması veya gelen ve giden bağlantıların kaynak ve hedefe göre kısıtlanmasıyla ilgili gereksinimler için dikkate alınmalıdır. + +Tersine, ASVS genellikle uygulamayla doğrudan ilgili olmayan veya yapılandırmanın uygulamanın sorumluluğu dışında olduğu gereksinimleri hariç tutar. Örneğin, DNS sorunları genellikle ayrı bir ekip veya işlev tarafından yönetilir. + +Benzer şekilde, uygulama girdiyi nasıl tükettiğinden ve çıktıyı nasıl ürettiğinden sorumlu olsa da, harici bir süreç uygulama veya verileriyle etkileşime giriyorsa, ASVS için kapsam dışı kabul edilir. Örneğin, uygulamanın veya verilerinin yedeklenmesi genellikle harici bir sürecin sorumluluğundadır ve uygulama veya geliştiricileri tarafından kontrol edilmez. + +### Güvenlik + +Her gerekliliğin güvenlik üzerinde kanıtlanabilir bir etkisi olmalıdır. Bir gerekliliğin olmaması daha az güvenli bir uygulama ile sonuçlanmalı ve gerekliliğin uygulanması bir güvenlik riskinin olasılığını veya etkisini azaltmalıdır. + +İşlevsel yönler, kod stili veya politika gereksinimleri gibi diğer tüm hususlar kapsam dışıdır. + +### Doğrulama + +Gereksinim doğrulanabilir olmalı ve doğrulama “başarısız” veya “başarılı” kararıyla sonuçlanmalıdır. + +### Standart + +ASVS, standarda uymak için uygulanması gereken bir güvenlik gereksinimleri koleksiyonu olarak tasarlanmıştır. Bu, gereksinimlerin bunu başarmak için güvenlik hedefini tanımlamakla sınırlı olduğu anlamına gelir. Diğer ilgili bilgiler ASVS'nin üzerine inşa edilebilir veya eşleştirmeler yoluyla bağlanabilir. + +Özellikle, OWASP'ın birçok projesi vardır ve ASVS kasıtlı olarak diğer projelerdeki içerikle örtüşmekten kaçınır. Örneğin, geliştiricilerin “belirli bir gereksinimi kendi teknolojimde veya ortamımda nasıl uygulayabilirim” şeklinde bir sorusu olabilir ve bu, Cheat Sheet Series projesi kapsamında ele alınmalıdır. Doğrulayıcıların “bu gereksinimi bu ortamda nasıl test edebilirim” şeklinde bir sorusu olabilir ve bu Web Güvenliği Test Kılavuzu projesi kapsamında ele alınmalıdır. + +ASVS sadece güvenlik uzmanlarının kullanımına yönelik olmamakla birlikte, okuyucunun içeriği anlamak için teknik bilgiye veya belirli kavramları araştırma becerisine sahip olmasını beklemektedir. + +### Gereksinim + +Gereksinim kelimesi ASVS'de özel olarak kullanılır çünkü bu kelimenin karşılanması için nelerin başarılması gerektiğini tanımlar. ASVS sadece gereksinimleri (must) içerir ve ana koşul olarak tavsiyeleri (should) içermez. + +Başka bir deyişle, ister bir sorunu çözmek için birçok olası seçenekten biri isterse de kod stili hususları olsun, öneriler bir gereksinim olma tanımını karşılamaz. + +ASVS gereksinimleri, uygulamaya veya teknolojiye özgü olmadan belirli güvenlik ilkelerini ele almayı ve aynı zamanda neden var olduklarına dair açıklayıcı olmayı amaçlamaktadır. Bu aynı zamanda gereksinimlerin belirli bir doğrulama yöntemi veya uygulaması etrafında oluşturulmadığı anlamına gelir. + +### Belgelenmiş güvenlik kararları + +Yazılım güvenliğinde, güvenlik tasarımını ve kullanılacak mekanizmaları erkenden planlamak, bitmiş üründe veya özellikte daha tutarlı ve güvenilir bir uygulama oluşturacaktır. + +Ayrıca, belirli gereksinimler için uygulama, karmaşık ve bir uygulamanın ihtiyaçlarına çok spesifik olacaktır. Yaygın örnekler arasında izinler, girdi doğrulama ve farklı hassas veri seviyeleri etrafında koruyucu kontroller yer alır. + +Bunu hesaba katmak için "tüm veriler şifrelenmelidir" gibi kapsamlı ifadeler veya bir gereksinimde olası her kullanım durumunu kapsamaya çalışmak yerine, uygulama geliştiricisinin bu tür kontrollere yaklaşımının ve yapılandırmasının belgelenmesini zorunlu kılan dokümantasyon gereksinimleri dahil edilmiştir. Bu daha sonra uygunluk açısından gözden geçirilebilir ve ardından gerçek uygulama, uygulamanın beklentilere uyup uymadığını değerlendirmek için belgelerle karşılaştırılabilir. + +Bu gereksinimler, uygulamayı geliştiren kuruluşun belirli güvenlik gereksinimlerinin nasıl uygulanacağına ilişkin aldığı kararları belgelemeyi amaçlamaktadır. + +Dokümantasyon gereksinimleri her zaman bir bölümün ilk kısmında yer alır (her bölümde olmasa da) ve her zaman dokümante edilen kararların gerçekten uygulamaya konulması gereken ilgili bir uygulama gerekliliğine sahiptir. Burada önemli olan nokta, dokümantasyonun yerinde olduğunu ve fiili uygulamanın iki ayrı faaliyet olduğunu doğrulamaktır. + +Bu gereksinimleri dahil etmenin iki temel nedeni vardır. İlk neden, güvenlik gereksiniminin genellikle kuralların uygulanmasını içermesidir. Örneğin hangi tür dosya türlerinin yüklenmesine izin verilir, hangi iş kontrolleri uygulanmalıdır, belirli bir alan için izin verilen karakterler nelerdir gibi uygulanma biçimleri. Bu kurallar her uygulama için farklı olacaktır ve bu nedenle ASVS, bunların ne olması gerektiğini kuralcı bir şekilde tanımlayamaz ve bu durumda bir cheat sheet veya daha ayrıntılı bir yanıt da yardımcı olmaz. Benzer şekilde, bu kararlar belgelenmeden, bu kararları uygulayan gereksinimlerin doğrulanması mümkün olmayacaktır. + +İkinci neden ise, belirli gereksinimler için belirli güvenlik sorunlarının nasıl ele alınacağı konusunda esnekliğe sahip bir uygulama geliştirme sağlamanın önemli olmasıdır. Örneğin, önceki ASVS sürümlerinde oturum zaman aşımı kuralları çok kuralcıydı. Pratik olarak, birçok uygulama, özellikle tüketicilere yönelik olanlar, çok daha esnek kurallara sahiptir ve bunun yerine diğer risk azaltma kontrollerini uygulamayı tercih eder. Bu nedenle, belgeleme gereksinimleri bu konuda açıkça esneklik sağlar. + +Elbette ki, bu kararların bireysel geliştiriciler tarafından alınması ve belgelenmesi beklenmemektedir. Aksine, bu kararlar organizasyonun bir bütün olarak alınacak ve geliştiricilere iletilecek, geliştiriciler de bu kararları uygulamaya özen gösterecektir. + +Geliştiricilere yeni özellikler ve işlevler için spesifikasyonlar ve tasarımlar sağlamak, yazılım geliştirmenin standart bir parçasıdır. Benzer şekilde, geliştiricilerin her seferinde kendi kararlarını vermek yerine ortak bileşenleri ve kullanıcı arayüzü mekanizmalarını kullanmaları beklenir. Bu nedenle, bunu güvenliğe genişletmek şaşırtıcı veya tartışmalı olarak görülmemelidir. + +Bunu nasıl başaracağınız konusunda da esneklik vardır. Güvenlik kararları, geliştiricilerin başvurması beklenen yazılı bir belgede belgelenebilir. Alternatif olarak, güvenlik kararları belgelenebilir ve tüm geliştiricilerin kullanması zorunlu olan ortak bir kod kütüphanesinde uygulanabilir. Her iki durumda da istenen sonuç elde edilir. + +## Uygulama Güvenliği Doğrulama Seviyeleri + +ASVS, seviyesi arttıkça derinliği ve karmaşıklığı artan üç güvenlik doğrulama seviyesi tanımlar. Genel amaç, kuruluşların en kritik güvenlik sorunlarını ele almak için ilk seviyeden başlaması ve ardından kuruluşun ve uygulamanın ihtiyaçlarına göre daha yüksek seviyelere geçmesidir. Seviyeler, belgede ve gereksinim metinlerinde L1, L2 ve L3 olarak gösterilebilir. + +Her ASVS seviyesi, o seviyeden elde edilmesi gereken güvenlik gereksinimlerini belirtir ve kalan daha yüksek seviye gereksinimler öneri olarak sunulur. + +Yinelenen gereksinimleri veya daha yüksek seviyelerde artık geçerli olmayan gereksinimleri önlemek için bazı gereksinimler belirli bir seviyeye özel uygulanır. Fakat bu gereksinimler daha yüksek seviyeler için daha katı koşullar içerir. + +### Seviye değerlendirmesi + +Seviyeler, güvenlik gereksinimlerinin uygulanması ve test edilmesi deneyimine dayalı olarak her bir gereksinimin öncelik bazlı değerlendirmesiyle tanımlanır. Ana odak noktası, risk azaltma ile gereksinimin uygulanması için gereken çabayı karşılaştırmaktır. Bir diğer önemli faktör ise giriş engelini düşük tutmaktır. + +Risk azaltma, gereksinimin uygulama içindeki güvenlik riskinin düzeyini ne ölçüde azalttığını, klasik Gizlilik, Bütünlük ve Kullanılabilirlik etki faktörlerini dikkate alarak ve bunun birincil savunma katmanı mı yoksa derinlemesine savunma mı olduğunu değerlendirerek değerlendirir. + +Kriterler ve seviyelendirme kararları etrafında yapılan titiz tartışmalar, her duruma %100 uymayabileceğini kabul etmekle birlikte, vakaların büyük çoğunluğu için geçerli olması gereken bir dağılımla sonuçlanmıştır. Bu, belirli durumlarda kuruluşların kendi özel risk değerlendirmelerine göre daha yüksek seviyedeki gereksinimleri daha erken önceliklendirmek isteyebilecekleri anlamına gelir. + +Her seviyedeki gereksinim türleri aşağıdaki gibi tanımlanabilir: + +### Seviye 1 + +Bu seviye, bir uygulamayı güvenli hale getirirken dikkate alınması gereken minimum gereksinimleri içerir ve kritik bir başlangıç noktasıdır. Bu seviye, ASVS gereksinimlerinin yaklaşık %20'sini içerir. Bu seviyenin amacı, giriş engelini azaltmak için mümkün olduğunca az gereksinim olmasını sağlamaktır. + +Bu gereksinimler genellikle kritik veya temel, diğer güvenlik açıklarının veya ön koşulların istismar edilmesini gerektirmeyen yaygın saldırıları önlemek için birinci katman savunma gereksinimleridir. + +Birinci savunma katmanı gereksinimlerine ek olarak, bazı gereksinimlerin daha yüksek seviyelerde etkisi daha azdır, şifrelerle ilgili gereksinimler gibi. Bunlar Seviye 1 için daha önemlidir, çünkü daha yüksek seviyelerde çok faktörlü kimlik doğrulama gereksinimleri önem kazanır. + +Seviye 1, belgelere veya koda iç erişimi olmayan bir dış test uzmanı tarafından mutlaka penetrasyon testi yapılabilir değildir (örneğin "kara kutu" testi), ancak gereksinimlerin sayısının az olması doğrulamayı kolaylaştırmalıdır. + +### Seviye 2 + +Çoğu uygulama bu güvenlik seviyesine ulaşmak için çaba göstermelidir. ASVS'deki gereksinimlerin yaklaşık %50'si L2 seviyesindedir, yani bir uygulamanın L2 seviyesine uymak için ASVS'deki gereksinimlerin yaklaşık %70'ini (tüm L1 ve L2 gereksinimlerini) uygulaması gerekir. + +Bu gereksinimler genellikle daha az yaygın saldırılarla veya yaygın saldırılara karşı daha karmaşık korumalarla ilgilidir. Bunlar hala ilk savunma katmanı olabilir veya saldırının başarılı olması için belirli ön koşullar gerektirebilir. + +### Seviye 3 + +Bu seviye, en yüksek güvenlik seviyelerini göstermek isteyen uygulamalar için bir hedef olmalıdır. Bu seviye, uyum sağlamak için gereken gereksinimlerin son %30'unu sağlar. + +Bu bölümdeki gereksinimler genellikle derinlemesine savunma mekanizmaları veya diğer yararlı ancak uygulanması zor kontrollerden oluşur. + +### Hangi seviyeye ulaşılmalı? + +Öncelik tabanlı seviyeler, kuruluşun ve uygulamanın uygulama güvenliği olgunluğunu yansıtmayı amaçlamaktadır. ASVS, bir uygulamanın hangi seviyede olması gerektiğini kuralcı bir şekilde belirtmek yerine, kuruluşun risklerini analiz etmesi ve uygulamanın hassasiyetine ve elbette uygulamanın kullanıcılarının beklentilerine bağlı olarak hangi seviyede olması gerektiğini belirlemesi gerekir. + +Örneğin, yalnızca sınırlı miktarda hassas veri toplayan erken aşamadaki bir girişim, ilk güvenlik hedefleri için Seviye 1'e odaklanmaya karar verebilir, ancak bir banka, çevrimiçi bankacılık uygulaması için müşterilerine Seviye 3'ten daha düşük bir seviyeyi haklı çıkarmakta zorlanabilir. + +## ASVS nasıl kullanılır? + +### ASVS'nin yapısı + +ASVS, toplamda yaklaşık 350 gereksinimden oluşur ve bu gereksinimler 17 bölüme ayrılmıştır. Her bölüm de alt bölümlere ayrılmıştır. + +Bölüm ve alt bölümlerin ayrılmasının amacı, uygulama ile ilgili olanları seçmeyi veya filtrelemeyi kolaylaştırmaktır. Örneğin, bir makineler arası API için, V3 bölümündeki web ön uçlarıyla ilgili gereksinimler ilgili olmayacaktır. OAuth veya WebRTC kullanılmıyorsa, bu bölümler de göz ardı edilebilir. + +### Sürüm stratejisi + +ASVS sürümleri "Major.Minor.Patch" ("Büyük.Küçük.Yama") modelini izler ve sayılar sürüm içinde nelerin değiştiği hakkında bilgi verir. Büyük bir sürümde ilk sayı, küçük bir sürümde ikinci sayı ve yama sürümünde üçüncü sayı değişir. + +* Büyük sürüm - Tamamen yeniden düzenleme yapılmıştır. Gereksinim numaraları da dahil olmak üzere neredeyse her şey değişebilir. Uyumluluk için yeniden değerlendirme gerekli olacaktır (örneğin, 4.0.3 -> 5.0.0). +* Küçük sürüm - Gereksinimler eklenebilir veya kaldırılabilir, ancak genel numaralandırma aynı kalır. Uyumluluk için yeniden değerlendirme gerekli olacaktır, ancak daha kolay olacaktır (örneğin, 5.0.0 -> 5.1.0). +* Yama sürümü - Gereksinimler kaldırılabilir (örneğin, tekrar eden veya güncelliğini yitiren gereksinimler) veya daha az katı hale getirilebilir, ancak önceki sürüme uygun olan bir uygulama, yama sürümüne de uygun olacaktır (örneğin, 5.0.0 -> 5.0.1). + +Yukarıdaki bilgiler özellikle ASVS'deki gereksinimlerle ilgilidir. Gereksinimleri çevreleyen metin ve ekler gibi diğer içeriklerdeki değişiklikler, önemli bir değişiklik olarak değerlendirilmeyecektir. + +### ASVS ile esneklik + +Yukarıda açıklanan belgeleme gereksinimleri ve seviye mekanizması gibi bazı noktalar, ASVS'yi daha esnek ve kuruluşa özgü bir şekilde kullanma olanağı sağlar. + +Ayrıca, kuruluşların uygulamalarının belirli özelliklerine ve risk seviyelerine göre gereksinimleri ayarlayan, kuruluşa veya alana özgü bir "fork" oluşturmaları şiddetle tavsiye edilir. Ancak, gereksinim 4.1.1'in tüm sürümlerde aynı anlama gelmesi için izlenebilirliği korumak önemlidir. + +İdeal olarak, her kuruluş kendi özel ASVS'sini oluşturmalı ve ilgisiz bölümleri (örneğin, kullanılmıyorsa GraphQL, WebSockets, SOAP) çıkarmalıdır. Kuruluşa özgü bir ASVS sürümü veya eki, gereksinimlere uyum sağlarken kullanılacak kütüphaneleri veya kaynakları ayrıntılı olarak açıklayan, kuruluşa özgü uygulama kılavuzları sağlamak için de iyi bir varlıktır. + +### ASVS Gereksinimlerine Nasıl Atıfta Bulunulur? + +Her gereksinim, her ögesinin bir sayı olduğu `..` biçiminde bir tanımlayıcıya sahiptir. Örneğin, `1.11.3`. + +* `` (chapter) değeri, gereksinimin geldiği bölümü belirtir. Örneğin, tüm `1.#.#` gereksinimleri "Kodlama (Encoding) ve Temizleme" bölümünden gelir. +* `` (section) değeri, o bölüm içinde gereksinimin yer aldığı kısmı belirtir. Örneğin, tüm `1.2.#` gereksinimleri "Kodlama ve Temizleme" bölümünün "Enjeksiyon Önleme" bölümündedir. +* `` (requirement) değeri, bölüm ve kısım içindeki belirli bir gereksinimi tanımlar. Örneğin, bu standardın 5.0.0 sürümünde `1.2.5` şu şekildedir: + +> Uygulamanın işletim sistemi komut enjeksiyonuna karşı koruma sağladığını ve işletim sistemi çağrılarının parametreli işletim sistemi sorguları veya bağlamsal komut satırı çıktı kodlaması kullandığını doğrulayın. + +Tanımlayıcılar standardın sürümleri arasında değişebileceğinden, diğer belgeler, raporlar veya araçlar için aşağıdaki biçimin kullanılması tercih edilir: `v-..`, burada: 'sürüm' ASVS sürüm etiketidir. Örneğin: `v5.0.0-1.2.5`, 5.0.0 sürümünün "Kodlama ve Temizleme" bölümünün "Enjeksiyon Önleme" alt bölümündeki 5. gereksinimi ifade eder. (Bu, `v-` olarak özetlenebilir.) + +Not: Format içinde sürüm numarasından önce gelen v her zaman küçük harf olmalıdır. + +Tanımlayıcılar v öğesi olmadan kullanıldığında, varsayılan olarak en güncel Uygulama Güvenliği Doğrulama Standardı içeriğine atıfta bulunulduğu kabul edilir. Ancak standart büyüyüp değiştikçe bu durum sorun yaratabilir, bu nedenle yazarlar veya geliştiriciler sürüm öğesini eklemelidir. + +ASVS gereksinim listeleri, başvuru veya programatik kullanım için yararlı olabilecek CSV, JSON ve diğer formatlarda sunulmaktadır. + +### ASVS’yi Çatallama (Forklama) + +Kuruluşlar, üç seviyeden birini seçerek veya uygulama risk seviyesine göre gereksinimleri ayarlayan alana özgü bir fork oluşturarak ASVS'den faydalanabilir. Bu tür bir fork, izlenebilirliği koruduğu sürece teşvik edilir, böylece 4.1.1 gereksiniminin karşılanması tüm sürümlerde aynı anlama gelir. + +İdeal olarak, her kuruluş kendi özel ASVS'sini oluşturmalı ve alakasız bölümleri (örneğin, kullanılmıyorsa GraphQL, Websockets, SOAP) çıkarmalıdır. Fork oluşturma, ASVS Seviye 1'i temel alarak başlamalı ve uygulamanın riskine göre Seviye 2 veya 3'e ilerlemelidir. + +## ASVS’nin kullanım alanları + +ASVS, bir uygulamanın güvenliğini değerlendirmek amacıyla kullanılabilir ve bu konu bir sonraki bölümde daha ayrıntılı olarak ele alınacaktır. Ancak, ASVS'nin (veya forklanmış bir sürümünün) başka potansiyel kullanım alanları da belirlenmiştir. + +### Ayrıntılı Güvenlik Mimarisi Rehberi Olarak Kullanma + +Uygulama Güvenliği Doğrulama Standardı'nın en yaygın kullanım alanlarından biri, güvenlik mimarları için bir kaynak olarak kullanılmasıdır. Özellikle modern uygulamalarda, güvenli bir uygulama mimarisi oluşturmak için sınırlı sayıda kaynak mevcuttur. ASVS, güvenlik mimarlarının veri koruma modelleri ve girdi doğrulama stratejileri gibi yaygın sorunlar için daha iyi kontroller seçmelerine olanak tanıyarak bu boşlukları doldurmak için kullanılabilir. Mimari ve dokümantasyon gereksinimleri bu konuda özellikle yararlı olacaktır. + +### Özelleştirilmiş Bir Güvenli Kodlama Referansı Olarak Kullanma + +ASVS, uygulama geliştirme sırasında güvenli kodlama referansı hazırlamak için temel olarak kullanılabilir ve geliştiricilerin yazılım oluştururken güvenliği göz önünde bulundurmalarını sağlar. ASVS temel olarak kullanılabilirken, kuruluşlar kendi özel kılavuzlarını hazırlamalıdır. Bu kılavuzlar açık ve birleşik olmalı ve ideal olarak güvenlik mühendisleri veya güvenlik mimarlarının rehberliğine dayalı olarak hazırlanmalıdır. Bunun bir uzantısı olarak, kuruluşların mümkün olduğunca kılavuzda referans gösterilebilecek ve geliştiriciler tarafından kullanılabilecek onaylanmış güvenlik mekanizmaları ve kütüphaneleri hazırlamaları teşvik edilir. + +### Otomatik Birim ve Entegrasyon Testleri İçin Rehber Olarak Kullanma + +ASVS, yüksek düzeyde test edilebilir şekilde tasarlanmıştır. Bazı doğrulamalar teknik nitelikteyken, bazı gereksinimler (mimari ve dokümantasyon gereksinimleri gibi) dokümantasyon veya mimari incelemesi gerektirebilir. Teknik yollarla doğrulanabilir gereksinimlerle ilgili belirli ve ilgili kötüye kullanım durumlarını test eden ve "fuzz" yapan birim ve entegrasyon testleri oluşturarak, bu kontrollerin her derlemede doğru şekilde çalıştığını kontrol etmek daha kolay hale gelmelidir. Örneğin, bir oturum açma denetleyicisi için test paketi için ek testler oluşturulabilir. Bu testlerde, kullanıcı adı parametresi için yaygın varsayılan kullanıcı adları, hesap numaralandırma, kaba kuvvet saldırısı, LDAP ve SQL enjeksiyonu ve XSS test edilir. Benzer şekilde, şifre parametresi üzerinde yapılan bir testte yaygın şifreler, şifre uzunluğu, null byte enjeksiyonu, parametrenin kaldırılması, XSS ve daha fazlası yer almalıdır. + +### Güvenli Geliştirme Eğitimi İçin Kullanma + +ASVS, güvenli yazılımın özelliklerini tanımlamak için de kullanılabilir. Birçok "güvenli kodlama kursu", kodlama ipuçlarının hafifçe serpiştirildiği etik hackleme kurslarından ibarettir. Bu, geliştiricilerin daha güvenli kod yazmasına yardımcı olmayabilir. Güvenli geliştirme kursları, yapılmaması gereken en önemli 10 olumsuz şey yerine ASVS'yi kullanarak ASVS'de bulunan olumlu mekanizmalara odaklanabilir. ASVS yapısı, bir uygulamayı güvenli hale getirirken farklı konuları ele almak için mantıklı bir yapı da sağlar. + +### Güvenli Yazılım Satın Alımına Rehberlik Eden Bir Çerçeve Olarak Kullanma + +ASVS, güvenli yazılım satın alımına veya özel geliştirme hizmetleri satın alımına yardımcı olan harika bir çerçevedir. Alıcı, satın almak istediği yazılımın ASVS seviye X'te geliştirilmesi gerektiğini belirten bir gereksinim belirleyebilir ve satıcıdan yazılımın ASVS seviye X'i karşıladığını kanıtlamasını isteyebilir. + +## ASVS'nin Pratikte Uygulanması + +Farklı tehditlerin farklı motivasyonları vardır. Bazı sektörler, benzersiz bilgi ve teknoloji varlıklarına ve alana özgü yasal uyumluluk gereksinimlerine sahiptir. + +Kuruluşların, işlerinin doğasına göre benzersiz risk özelliklerini derinlemesine incelemeleri ve bu risk ve iş gereksinimlerine göre uygun ASVS seviyesini belirlemeleri şiddetle tavsiye edilir. diff --git a/5.0/tr/0x04-Assessment_and_Certification.md b/5.0/tr/0x04-Assessment_and_Certification.md new file mode 100644 index 0000000000..fd9eb4016b --- /dev/null +++ b/5.0/tr/0x04-Assessment_and_Certification.md @@ -0,0 +1,47 @@ +# Değerlendirme ve Sertifikasyon + +## OWASP’in ASVS Sertifikaları ve Güven Damgaları Konusundaki Tutumu + +OWASP, satıcıdan bağımsız bir kar amacı gütmeyen kuruluş olarak, herhangi bir satıcıyı, doğrulayıcıyı veya yazılımı sertifikalandırmaz. ASVS uyumluluğunu iddia eden herhangi bir güvence, güven damgası veya sertifikasyon OWASP tarafından resmi olarak onaylanmamaktadır. Bu nedenle, kuruluşlar üçüncü tarafların ASVS sertifikasyonu iddialarına karşı dikkatli olmalıdır. + +Kuruluşlar, resmi bir OWASP sertifikası sunduklarını iddia etmemek koşuluyla güvence hizmetleri sunabilirler. + +## ASVS Uyumluluğu Nasıl Doğrulanır? + +ASVS, uyumluluğun nasıl doğrulanacağı konusunda kasıtlı olarak kesin bir yöntem belirtmez. Ancak, bazı temel noktaların vurgulanması önemlidir. + +### Doğrulama Raporlaması + +Geleneksel sızma testi raporları, yalnızca başarısız olan durumları istisnalarla listeler. Ancak bir ASVS sertifikasyon raporu; kapsamı, kontrol edilen tüm gereksinimlerin özetini, istisna tespit edilen gereksinimleri ve bu sorunların nasıl çözüleceğine dair rehberliği içermelidir. Bazı gereksinimler uygulanabilir olmayabilir (örneğin, durum bilgisi olmayan API'lerde oturum yönetimi) ve bu durum raporda açıkça belirtilmelidir. + +### Doğrulama Kapsamı + +Uygulama geliştiren bir organizasyon, uygulamanın işlevselliğine bağlı olarak bazı gereksinimleri uygulamayabilir, çünkü bunlar alakasız veya daha az önemli olabilir. Doğrulayıcı kişi veya kurum, doğrulamanın kapsamını açıkça belirtmelidir. Organizasyonun hangi Seviye’yi hedeflediği ve hangi gereksinimlerin dahil edildiği açıklanmalıdır. Bu, nelerin hariç tutulduğundan ziyade, nelerin dahil edildiği bakış açısından ele alınmalıdır. Ayrıca, uygulanmayan gereksinimlerin neden dışlandığına dair gerekçeli bir görüş sunulmalıdır. + +Bu yaklaşım, raporu okuyan tarafın doğrulamanın bağlamını anlamasına ve uygulamaya ne kadar güvenebileceğine dair bilinçli bir karar vermesine olanak tanır. + +Sertifikasyon yapan kuruluşlar kendi test yöntemlerini seçebilir, ancak bu yöntemler raporda açıkça belirtilmeli ve ideal olarak tekrarlanabilir olmalıdır. Girdi doğrulama gibi konular için sızma testi ya da kaynak kod analizi gibi farklı yöntemler kullanılabilir. + +### Doğrulama Mekanizmaları + +Bazı ASVS gereksinimlerinin doğrulanması için birden fazla teknik gerekebilir. Geçerli kullanıcı bilgileriyle tüm uygulama kapsamı elde edilerek yapılan sızma testlerine ek olarak ASVS gereksinimlerinin doğrulanması; dokümantasyon, kaynak kodu, yapılandırmalar ve geliştirme sürecine dahil kişilere, özellikle Seviye 2 ve Seviye 3 gereksinimlerinin doğrulanması için erişim gerektirebilir. Bulguların belgelenmesi standart bir uygulamadır ve buna çalışma notları, ekran görüntüleri, betikler ve test günlükleri (logs) dahil olabilir. Yalnızca otomatik bir araç çalıştırmak ve derinlemesine test yapmamak sertifikasyon için yeterli değildir; her gereksinimin doğrulanabilir şekilde test edilmiş olması gerekir. + +ASVS gereksinimlerinin otomasyonla doğrulanması, her zaman ilgi çeken bir konudur. Bu nedenle, otomatik ve kara kutu (black box) testlerle ilgili bazı noktaların netleştirilmesi önemlidir. + +#### Otomatik Güvenlik Testi Araçlarının Rolü + +DAST ve SAST gibi dinamik ve statik güvenlik test araçları doğru şekilde build pipeline’a entegre edildiğinde, asla var olmaması gereken bazı güvenlik açıklarını tespit edebilir. Ancak, dikkatli bir şekilde yapılandırılmaz ve ayarlanmazlarsa, yeterli kapsama alanı sağlamazlar ve yüksek sayıda yanlış pozitif, gerçek güvenlik sorunlarının tespitini ve düzeltilmesini engeller. + +Bu araçlar, çıktı kodlaması veya veri temizleme gibi bazı temel teknik gereksinimlerin doğrulanmasında yardımcı olabilir. Ancak, iş mantığı veya erişim kontrolü gibi daha karmaşık ASVS gereksinimlerinin doğrulanmasında yetersiz kalacaklardır. + +Daha karmaşık gereksinimler için otomasyon yine de kullanılabilir, ancak uygulamaya özel testlerin yazılması gerekebilir. Bunlar, organizasyonun halihazırda kullandığı birim ve entegrasyon testlerine benzer şekilde tasarlanabilir. Mevcut test altyapısı kullanılarak bu ASVS'ye özel testler yazılabilir. Bu kısa vadede yatırım gerektirse de, uzun vadede bu gereksinimlerin sürekli olarak doğrulanabilmesi açısından önemli bir fayda sağlar. + +Özetle, "otomasyon ile test edilebilir" ifadesi "hazır bir aracı çalıştırmak" anlamına gelmez. + +#### Sızma Testlerinin Rolü + +4.0 sürümünde Seviye 1, kara kutu (black box) test için optimize edilmişti (yani dokümantasyon veya kaynak kod olmadan). Ancak o zaman bile bunun etkili bir güvence yöntemi olmadığı ve aktif olarak kaçınılması gerektiği vurgulanmıştır. + +Gerekli ek bilgilere erişim olmadan test yapmak, güvenlik doğrulaması açısından hem verimsiz hem de etkisizdir. Bu durum, kaynak kodun incelenmesi, tehditlerin ve eksik kontrollerin tespiti gibi daha kapsamlı analizlerin yapılmasını engeller ve süreci uzatır. + +Geleneksel sızma testlerinin yerini, dokümantasyon ve/veya kaynak kod temelli (hibrit) sızma testlerinin almasını şiddetle tavsiye ediyoruz. Geliştirici ekip ve uygulamanın dokümantasyonuna tam erişim ile yapılan bu testler, birçok ASVS gereksiniminin doğrulanması için gerekli olacaktır. diff --git a/5.0/tr/0x05-For-Users-Of-4.0.md b/5.0/tr/0x05-For-Users-Of-4.0.md new file mode 100644 index 0000000000..cbbe7a5279 --- /dev/null +++ b/5.0/tr/0x05-For-Users-Of-4.0.md @@ -0,0 +1,90 @@ +# v4.x ile Karşılaştırıldığında Yapılan Değişiklikler + +## Giriş + +Standartın 4.x sürümüne aşina olan kullanıcılar, 5.0 sürümünde yapılan temel değişiklikleri içerik, kapsam ve altında yatan felsefe bakımından gözden geçirmeyi faydalı bulabilirler. + +Sürüm 4.0.3'te yer alan 286 gereksinimin yalnızca 11 tanesi hiçbir değişikliğe uğramadan korunmuştur. 15 gereksinimde ise yalnızca anlamı değiştirmeyen dilbilgisel düzeltmeler yapılmıştır. Toplamda 109 gereksinim (%38) artık 5.0 sürümünde bağımsız birer gereksinim olarak yer almamaktadır. Bunların 50’si doğrudan silinmiş, 28’i yinelenen olarak kaldırılmış ve 31’i başka gereksinimlerle birleştirilmiştir. Geri kalan tüm gereksinimler bir şekilde revize edilmiştir. İçeriği esasen değiştirilmemiş olan gereksinimler bile, yeniden sıralama veya yapısal değişiklikler nedeniyle artık farklı tanımlayıcılara (ID) sahiptir. + +Sürüm 5.0'ın benimsenmesini kolaylaştırmak için, kullanıcıların sürüm 4.x'teki gereksinimlerin sürüm 5.0'daki gereksinimlerle nasıl eşleştiğini izlemelerine yardımcı olmak için eşleme belgeleri sağlanmıştır. Bu eşlemeler sürüm numaralandırmasına bağlı değildir ve gerektiğinde güncellenebilir veya açıklığa kavuşturulabilir. + +## Gereksinim Felsefesi + +### Kapsam ve Odak + +Sürüm 4.x, standardın hedeflenen kapsamıyla uyumlu olmayan bazı gereksinimler içeriyordu. Bu gereksinimler kaldırılmıştır. 5.0 sürümünün kapsam kriterlerini karşılamayan veya doğrulanabilir olmayan gereksinimler de eklenen gereksinimlerden hariç tutulmuştur. + +### Mekanizmalar Yerine Güvenlik Hedeflerine Önem Verilmesi + +Sürüm 4.x'te birçok gereksinim, altında yatan güvenlik hedefleri yerine belirli mekanizmalara odaklanıyordu. 5.0 sürümünde ise gereksinimler, belirli güvenlik hedefleri etrafında yapılandırılmıştır. Belirli mekanizmalara yalnızca bunların tek pratik çözüm olması durumunda doğrudan referans verilmiş veya örnek/rehber olarak yer verilmiştir. + +Bu yaklaşım, belirli bir güvenlik hedefinin birden fazla yolla gerçekleştirilebileceğini kabul eder ve kuruluşların esnekliğini kısıtlayabilecek gereksiz derecede kuralcı yönlendirmelerden kaçınır. + +Ayrıca, aynı güvenlik sorununu ele alan gereksinimler uygun şekilde birleştirilmiştir. + +### Belgelenmiş Güvenlik Kararları + +"Belgelenmiş güvenlik kararları" kavramı 5.0 sürümünde yeni gibi görünse de, 4.0 sürümündeki politika uygulamaları ve tehdit modellemesi ile ilgili daha önceki gereksinimlerin evrimleşmiş halidir. Önceki sürümlerde bazı gereksinimler, örneğin izin verilen ağ bağlantılarının belirlenmesi gibi, güvenlik kontrollerinin uygulanmasına yön verecek analizlerin yapılmasını dolaylı olarak talep etmekteydi. + +Gerekli bilgilerin hem uygulama hem de doğrulama süreçlerinde erişilebilir olmasını sağlamak amacıyla bu beklentiler artık açıkça belgelenmesi gereken gereksinimler olarak tanımlanmıştır. Böylece bu gereksinimler daha net, uygulanabilir ve doğrulanabilir hale getirilmiştir. + +## Yapısal Değişiklikler ve Yeni Bölümler + +Sürüm 5.0’daki bazı bölümler tamamen yeni içerikler sunmaktadır: + +* OAuth ve OIDC – Bu protokollerin erişim yetkisi devri ve tek oturum açma (SSO) için yaygın biçimde benimsenmiş olması nedeniyle, geliştiricilerin karşılaşabileceği çeşitli senaryoları kapsayan özel gereksinimler eklenmiştir. Bu alan, geçmişte Mobil ve IoT gereksinimlerinin ayrı bir standarda dönüştürülmesinde olduğu gibi, zamanla bağımsız bir standarda da dönüşebilir. +* WebRTC – Bu teknolojinin yaygınlaşmasıyla birlikte, kendine özgü güvenlik gereksinimleri ve zorlukları artık özel bir bölümde ele alınmaktadır. + +Bölüm ve kısımların birbiriyle ilişkili gereksinim kümeleri etrafında daha tutarlı şekilde düzenlenmesine de özen gösterilmiştir. + +Bu yeniden yapılandırma kapsamında şu ek bölümler oluşturulmuştur: + +* Kendi İçinde Taşıyıcı Token’lar – Daha önce oturum yönetimi altında yer alan bu mekanizmalar artık ayrı bir yapı olarak tanınmakta ve OAuth ile OIDC gibi durumsuz iletişim yapılarının temel unsurlarından biri olarak ele alınmaktadır. Kendilerine özgü güvenlik etkileri nedeniyle, 5.x sürümünde bazı yeni gereksinimlerle birlikte ayrı bir bölümde toplanmıştır. +* Web Ön Yüz Güvenliği (Frontend Security) – Tarayıcı tabanlı uygulamaların artan karmaşıklığı ve yalnızca API’lara dayalı mimarilerin yaygınlaşması nedeniyle, frontend güvenliği gereksinimleri ayrı bir bölümde ele alınmıştır. +* Güvenli Kodlama ve Mimari – Diğer mevcut bölümlere doğrudan uymayan genel güvenlik uygulamalarıyla ilgili yeni gereksinimler burada gruplandırılmıştır. + +Sürüm 5.0’daki diğer düzenleyici değişiklikler ise niyetin daha net şekilde anlaşılmasını sağlamayı amaçlamıştır. Örneğin, girdi doğrulama gereksinimleri iş kuralları doğrultusunda işletim sağladıkları için artık iş mantığı ile birlikte gruplanmış, eski yapıda yer aldıkları temizleme ve kodlama (sanitization & encoding) konularından ayrılmıştır. + +Önceki V1 Mimari bölümü tamamen kaldırılmıştır. Bu bölümün ilk kısmı kapsam dışı gereksinimler içeriyordu. Sonraki kısımlar ise ilgili yeni bölümlere taşınmış, gereksinimler sadeleştirilmiş ve gerektiğinde yinelenen maddeler birleştirilerek açıklığa kavuşturulmuştur. + +## Diğer Standartlara Yapılan Doğrudan Eşlemelerin Kaldırılması + +Standardın ana kısmında yer alan diğer standartlara yönelik doğrudan eşlemeler kaldırılmıştır. Bunun yerine, ASVS'nin OWASP projeleri ve harici standartlarla ilişkilendirilmesini sağlayacak OWASP Common Requirement Enumeration (CRE) projesiyle bir eşleme hazırlanması hedeflenmektedir. + +Aşağıda açıklanan nedenlerle, CWE ve NIST gibi standartlara yapılan doğrudan eşlemeler artık devam ettirilmemektedir. + +### NIST Dijital Kimlik Kılavuzları (Digital Identity Guidelines) ile Azaltılmış Bağlılık + +NIST [Digital Identity Guidelines (SP 800-63)](https://pages.nist.gov/800-63-3/) uzun süredir kimlik doğrulama ve yetkilendirme kontrolleri için bir başvuru noktası olarak kullanılmıştır. Sürüm 4.x’te bazı bölümler, NIST’in yapısı ve terminolojisiyle oldukça örtüşüyordu. + +Bu kılavuzlar hâlâ önemli bir referans noktası olsa da, böyle bir sıkı örtüşme birtakım sorunlara yol açmıştır. Bu sorunlara yaygın olarak benimsenmemiş terimlerin kullanımı, benzer gereksinimlerin yinelenmesi ve eşlemenin eksik kalması örnek verilebilir. Sürüm 5.0, bu yaklaşımdan uzaklaşarak daha açık ve uygulanabilir bir yapı sunmayı hedeflemektedir. + +### Common Weakness Enumeration'dan (CWE) Uzaklaşma + +Common Weakness Enumeration (CWE), yazılım güvenliği zafiyetleri için faydalı bir sınıflandırma sistemidir. Ancak, yalnızca kategori düzeyinde tanımlanmış CWE’ler, bir gereksinimin yalnızca tek bir CWE ile eşleştirilememesi gibi eşleme zorlukları ve sürüm 4.x’teki bazı belirsiz eşlemeler sürüm 5.0’da doğrudan CWE eşlemelerinin sonlandırılmasına neden olmuştur. + +## Seviye Tanımlarının Yeniden Düşünülmesi + +Sürüm 4.x’te seviyeler L1 ("Minimum"), L2 ("Standart") ve L3 ("Gelişmiş") olarak tanımlanıyordu. Hassas veri işleyen tüm uygulamaların en az L2 seviyesini sağlaması gerektiği ima ediliyordu. + +Sürüm 5.0, bu yaklaşıma dair çeşitli sorunları ele almaktadır. + +Sürüm 4.x'te seviye göstergeleri tik işaretleriyle ifade edilirken, 5.x sürümünde tüm formatlarda (Markdown, PDF, DOCX, CSV, JSON ve XML) basit sayılar kullanılmaktadır. Geriye dönük uyumluluk için eski CSV, JSON ve XML çıktı formatlarında onay işaretleri hâlâ kullanılmaktadır. + +### Daha Kolay Giriş Seviyesi + +Geri bildirimler, yaklaşık 120 maddeden oluşan Seviye 1 gereksinimlerinin, aynı zamanda "minimum" olarak etiketlenip birçok uygulama için yetersiz görülmesi nedeniyle benimsenmesinin zorlaştığını göstermiştir. Sürüm 5.0, bu eşiği düşürmeyi hedefleyerek Seviye 1’i öncelikli olarak ilk savunma katmanına ait gereksinimler etrafında tanımlar ve bu seviyedeki gereksinimleri daha az ve daha net hale getirir. Sayısal olarak örnek vermek gerekirse sürüm 4.0.3'te 278 gereksinimden 128’i Seviye 1’di (%46). Sürüm 5.0.0'da ise 345 gereksinimden yalnızca 70’i Seviye 1’dir (%20). + +### Test Edilebilirlik Yanılgısı + +Sürüm 4.x’te Seviye 1 gereksinimleri belirlenirken, "dışsal kara kutu sızma testleriyle değerlendirilebilirlik" ön plandaydı. Ancak bu yaklaşım, Seviye 1’in güvenlik kontrolleri için minimum bir temel olması yönündeki amacıyla tam olarak örtüşmüyordu. Bazı kullanıcılar, Seviye 1’in yetersiz olduğunu savunurken, bazıları ise uygulanabilirliğini zor buluyordu. + +Test edilebilirliğe odaklanmak hem göreceli hem de zaman zaman yanıltıcı olabilir. Bir gereksinimin test edilebilir olması, onun kolayca veya otomatik biçimde test edilebileceği anlamına gelmez. Ayrıca, en kolay test edilebilen gereksinimler her zaman en yüksek güvenlik katkısına sahip ya da en kolay uygulanabilir olanlar değildir. + +Bu nedenle sürüm 5.0’da seviye belirleme kararları, esas olarak risk azaltımı temeline dayanır ve uygulama çabası da göz önünde bulundurulmuştur. + +### Sadece Risk Odaklı Değil + +Belirli uygulamalar için belirli bir seviyeyi zorunlu kılan, katı ve risk bazlı seviye yaklaşımı fazlasıyla sert bir yapıya dönüşmüştür. Gerçekte, güvenlik kontrollerinin önceliklendirilmesi ve uygulanması yalnızca risk değil, aynı zamanda uygulama çabası, organizasyonel olgunluk ve kullanıcıya verilmek istenen güvenlik mesajı gibi çeşitli faktörlere bağlıdır. + +Bu nedenle, kuruluşların olgunluk düzeylerine ve kullanıcılarına vermek istedikleri mesaja göre hangi seviyeyi hedeflemeleri gerektiğine kendilerinin karar vermesi teşvik edilmektedir. diff --git a/5.0/tr/0x10-V1-Encoding-and-Sanitization.md b/5.0/tr/0x10-V1-Encoding-and-Sanitization.md new file mode 100644 index 0000000000..f010cc04ea --- /dev/null +++ b/5.0/tr/0x10-V1-Encoding-and-Sanitization.md @@ -0,0 +1,104 @@ +# V1 Kodlama (Encoding) ve Temizleme + +## Kontrol Amacı + +Bu bölüm, güvenilmeyen verilerin güvensiz işlenmesiyle ilişkili en yaygın web uygulaması güvenlik zayıflıklarına odaklanır. Bu tür durumlar, güvenilmeyen verinin ilgili yorumlayıcının sözdizimi kuralları çerçevesinde yanlış şekilde yorumlanmasına neden olan çeşitli teknik güvenlik açıklarına yol açar. + +Modern web uygulamalarında, parametreli sorgular, otomatik kaçış (escaping) veya şablonlama (templating) çerçeveleri gibi daha güvenli API'ların kullanımı her zaman en iyi yaklaşımdır. Aksi takdirde ya da bu mümkün değilse, çıktı kodlaması, kaçış veya temizleme işlemlerinin dikkatle uygulanması uygulamanın güvenliği için kritik öneme sahiptir. + +Girdi doğrulama, beklenmeyen ve tehlikeli içeriklere karşı savunma derinliği mekanizması olarak kullanılabilir. Ancak asıl amacı gelen verinin işlevsel ve iş gereksinimleriyle uyumlu olup olmadığını kontrol etmektir. Bu nedenle, bu konudaki gereksinimler "Doğrulama ve İş Mantığı" bölümünde ele alınmıştır. + +## V1.1 Kodlama ve Temizleme Mimarisi + +Aşağıdaki bölümlerde, güvenli olmayan içeriklerin güvenli şekilde işlenmesine yönelik, sözdizimi veya yorumlayıcıya özel güvenlik gereksinimleri sunulmaktadır. Bu bölümdeki gereksinimler, bu işlemlerin hangi sırayla ve nerede gerçekleştirilmesi gerektiğini kapsar. Ayrıca, verilerin saklandığı her durumda orijinal (ham) haliyle saklanması gerektiğini (örneğin HTML kodlaması gibi kodlanmış/kaçırılmış biçimde değil) vurgular. Bu sayede çift kodlama (double encoding) gibi sorunlar önlenmiş olur. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **1.1.1** | Girdinin yalnızca bir kez kanonik forma (canonical form) çözümlendiği veya kaçış işlemlerinin kaldırıldığı, bu işlemin yalnızca verinin bu biçimde beklenmesi durumunda yapıldığı ve bu işlemin girdi doğrulama veya temizleme işlemlerinden sonra değil, önce gerçekleştiği doğrulanmalıdır. | 2 | +| **1.1.2** | Uygulamanın, çıktıyı kullanılması gereken yorumlayıcıya verilmeden hemen önce veya yorumlayıcının kendisi tarafından çıktı kodlaması ya da kaçış işlemi yaptığı doğrulanmalıdır. | 2 | + +## V1.2 Enjeksiyon Önleme + +Potansiyel olarak tehlikeli içeriklerin yakınında yapılan çıktı kodlama veya kaçış işlemleri, uygulama güvenliği için kritiktir. Genellikle çıktı kodlama ve kaçış işlemleri kalıcı değildir. Yalnızca verinin anlık olarak yorumlayıcı tarafından güvenli şekilde işlenebilmesi için uygulanır. Bu işlemin çok erken yapılması, içeriğin bozulmasına veya etkisiz hale gelmesine neden olabilir. + +Çoğu durumda, yazılım kütüphaneleri bu işlemleri otomatik olarak gerçekleştiren güvenli veya daha güvenli işlevler sağlar. Ancak, bu işlevlerin geçerli bağlama uygun olduğundan emin olunmalıdır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **1.2.1** | HTTP yanıtı, HTML veya XML belgesi için yapılan çıktı kodlamasının; HTML elemanları, HTML öznitelikleri, HTML yorumları, CSS ya da HTTP başlık alanları gibi bağlamlara uygun olduğu doğrulanmalıdır. Böylece mesaj veya belge yapısının bozulması önlenir. | 1 | +| **1.2.2** | Dinamik olarak URL oluşturulurken, güvenilmeyen verinin bağlamına göre (örneğin, sorgu veya yol parametreleri için URL kodlaması ya da base64url kodlaması) kodlandığı doğrulanmalıdır. Yalnızca güvenli URL protokollerine izin verilmelidir (örneğin, javascript: veya data: yasaklanmalıdır). | 1 | +| **1.2.3** |JavaScript içeriği (JSON dahil) dinamik olarak oluşturulurken çıktı kodlama/kaçış kullanıldığı doğrulanmalıdır. Böylece mesaj veya belge yapısı değiştirilmemiş olur (JavaScript ve JSON enjeksiyonlarının önüne geçilir). | 1 | +| **1.2.4** | Veri sorguları veya veritabanı sorguları (SQL, HQL, NoSQL, Cypher vb.) için parametreli sorgular, ORM’ler, entity framework’ler kullanıldığı ya da SQL enjeksiyonu ve diğer veritabanı enjeksiyon saldırılarına karşı koruma sağlandığı doğrulanmalıdır. Bu durum, saklı yordam (stored procedure) yazarken de geçerlidir. | 1 | +| **1.2.5** | Uygulamanın işletim sistemi komut enjeksiyonlarına karşı korunduğu ve işletim sistemi çağrılarında parametreli OS sorguları veya bağlama özgü komut satırı çıktı kodlamasının kullanıldığı doğrulanmalıdır. | 1 | +| **1.2.6** | Uygulamanın LDAP enjeksiyon zafiyetlerine karşı korunduğu ya da LDAP enjeksiyonlarını önlemek için özel güvenlik kontrollerinin uygulandığı doğrulanmalıdır. | 2 | +| **1.2.7** | XPath enjeksiyon saldırılarına karşı, sorgu parametrelemesi veya önceden derlenmiş sorgular kullanılarak koruma sağlandığı doğrulanmalıdır. | 2 | +| **1.2.8** | LaTeX işlemcilerinin güvenli şekilde yapılandırıldığı (örneğin, --shell-escape bayrağının kullanılmadığı) ve yalnızca izin verilen komutlardan oluşan bir listeyle çalıştırıldığı doğrulanmalıdır. | 2 | +| **1.2.9** | Düzenli ifadelerde (regex) özel karakterlerin (genellikle ters eğik çizgi \ ile) kaçırılarak meta karakter olarak yorumlanmalarının önlendiği doğrulanmalıdır. | 2 | +| **1.2.10** | Uygulamanın CSV ve formül enjeksiyonlarına karşı korunduğu doğrulanmalıdır. Uygulama, CSV içeriği dışa aktarırken RFC 4180 Bölüm 2.6 ve 2.7'de tanımlanan kaçış kurallarına uymalıdır. Ayrıca, CSV veya diğer tablo formatlarına (XLS, XLSX, ODF gibi) aktarım yapılırken, alanın ilk karakteri olarak çıkan özel karakterler ('=', '+', '-', '@', '\t' (sekme), '\0' (null karakter)) tek tırnak (') ile kaçırılmalıdır. | 3 | + +Not: Parametreli sorguların veya SQL kaçışlarının kullanılması her zaman yeterli değildir. Örneğin, tablo ve sütun adları (özellikle “ORDER BY” gibi) kaçırılamaz. Bu alanlarda kullanıcı tarafından sağlanan veriler kaçırılmış olarak dahil edilirse sorgular başarısız olur veya SQL enjeksiyonuna neden olabilir. + +## V1.3 Temizleme (Sanitization) + +Güvenilmeyen içeriğin güvensiz bir bağlamda kullanılmasına karşı ideal koruma yöntemi, önceki bölümde detaylı olarak açıklandığı gibi, bağlama özel kodlama veya kaçıştırma (escaping) kullanmaktır. Bu yöntem, içeriğin anlamını koruyarak güvenli hale getirir. + +Bu mümkün olmadığında, potansiyel olarak tehlikeli karakterlerin veya içeriğin temizlenmesi (sanitize) gerekir. Bazı durumlarda, bu işlem girdinin anlamını değiştirebilir; ancak güvenlik açısından başka bir seçenek olmayabilir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **1.3.1** | WYSIWYG editörlerinden veya benzer kaynaklardan gelen tüm güvenilmeyen HTML girdilerinin, bilinen ve güvenli bir HTML temizleme kütüphanesi ya da çerçeve özelliği ile temizlendiği doğrulanmalıdır. | 1 | +| **1.3.2** | Uygulamanın eval() veya Spring Expression Language (SpEL) gibi dinamik kod çalıştırma özelliklerini kullanmaktan kaçındığı doğrulanmalıdır. Alternatif yoksa, kullanıcı girdisi çalıştırılmadan önce mutlaka temizlenmelidir. | 1 | +| **1.3.3** | Potansiyel olarak tehlikeli bir bağlamda kullanılacak verilerin, bu bağlama uygun karakterlere izin vermek ve çok uzun girdileri kısaltmak gibi güvenlik önlemleriyle önceden temizlendiği doğrulanmalıdır. | 2 | +| **1.3.4** | Kullanıcı tarafından sağlanan SVG içeriğinin, yalnızca güvenli etiket ve özellikler (örneğin grafik çizme ile ilgili) içerdiğinden emin olmak için onaylandığı veya temizlendiği doğrulanmalıdır (ör. script veya foreignObject içermemelidir). | 2 | +| **1.3.5** | Markdown, CSS, XSL stil sayfaları, BBCode veya benzeri ifade şablon dillerinde kullanıcı girdisinin temizlendiği veya bu tür özelliklerin devre dışı bırakıldığı doğrulanmalıdır. | 2 | +| **1.3.6** | Uygulamanın, güvenilmeyen verileri başka servislere iletmeden önce izinli protokol, alan adı, yol ve port listelerine göre doğruladığı ve tehlikeli karakterleri temizlediği doğrulanarak SSRF (Sunucu Taraflı İstek Sahteciliği) saldırılarına karşı korunduğu doğrulanmalıdır. | 2 | +| **1.3.7** | Uygulamanın şablon enjeksiyon saldırılarına karşı, güvenilmeyen girdilere dayalı şablon oluşturmayı engellediği; eğer bu kaçınılmazsa, bu girdilerin mutlaka temizlendiği veya sıkı şekilde onaylandığı doğrulanmalıdır. | 2 | +| **1.3.8** | JNDI sorgularında kullanılmadan önce güvenilmeyen girdilerin temizlendiği ve JNDI'nin enjeksiyonlara karşı güvenli şekilde yapılandırıldığı doğrulanmalıdır. | 2 | +| **1.3.9** | Memcache’e gönderilmeden önce içeriğin temizlenerek enjeksiyon saldırılarına karşı korunduğu doğrulanmalıdır. | 2 | +| **1.3.10** | Format dizgilerinin (format strings) beklenmeyen veya zararlı şekilde çözümlenmesini önlemek için işlenmeden önce temizlendiği doğrulanmalıdır. | 2 | +| **1.3.11** | SMTP veya IMAP enjeksiyonlarını önlemek için, kullanıcı girdisinin posta sistemlerine iletilmeden önce temizlendiği doğrulanmalıdır. | 2 | +| **1.3.12** | Regex girdilerinin üstel geri izlemeye (exponential backtracking) neden olan öğeler içermediği ve güvenilmeyen girdilerin ReDoS (Regex Denial of Service) gibi saldırılara karşı temizlendiği doğrulanmalıdır. | 3 | + +## V1.4 Bellek, Dizgi ve Yönetilmeyen Kod + +Aşağıdaki gereksinimler, sistem programlama dilleri veya yönetilmeyen kod kullanan uygulamalarda görülen güvensiz bellek kullanımıyla ilişkili riskleri ele alır. + +Bazı durumlarda, taşma korumaları ve uyarılar, yığın (stack) rastgeleleştirme ve veri yürütme engelleme gibi önlemleri etkinleştiren derleyici bayrakları (compiler flags) kullanılarak bu risklerin önüne geçilebilir. Ayrıca, tehlikeli işaretçi, bellek, format dizgisi, tamsayı ve dizgi işlemleri tespit edildiğinde derlemenin başarısız olmasını sağlayan ayarlar tercih edilmelidir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **1.4.1** | Yığın, arabellek (buffer) veya yığın belleği taşmalarını önlemek ya da tespit etmek amacıyla, bellek güvenli dizgi işlemlerinin, daha güvenli bellek kopyalama ve işaretçi aritmetiğinin kullanıldığı doğrulanmalıdır. | 2 | +| **1.4.2** | Tamsayı taşmalarını önlemek için işaret (sign), aralık (range) ve giriş doğrulama tekniklerinin kullanıldığı doğrulanmalıdır. | 2 | +| **1.4.3** | Dinamik olarak ayrılan belleğin ve kaynakların serbest bırakıldığı ve boşaltılan belleklere ait referansların veya işaretçilerin kaldırıldığı veya null yapıldığı doğrulanmalıdır (dangling pointer ve use-after-free zafiyetlerine karşı). | 2 | + +## V1.5 Güvenli Ters Serileştirme (Safe Deserialization) + +Verilerin saklanmış veya iletilmiş bir temsilinden uygulama nesnelerine dönüştürülmesi işlemi olan ters serileştirme, geçmişte çeşitli kod enjeksiyonu zafiyetlerinin kaynağı olmuştur. Bu işlemin dikkatli ve güvenli bir şekilde yapılması, bu tür güvenlik açıklarının önlenmesi açısından son derece önemlidir. + +Özellikle, bazı ters serileştirme yöntemleri, kullanılan programlama dili veya çerçevenin dokümantasyonunda güvensiz olarak tanımlanmıştır ve güvenilmeyen verilerle kullanıldığında güvenli hâle getirilemez. Kullanılan her yöntem için dikkatli bir inceleme yapılmalıdır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **1.5.1** | XML ayrıştırıcılarının (parser) kısıtlayıcı şekilde yapılandırıldığı ve dış varlık çözümleme (external entity resolution) gibi güvensiz özelliklerin XXE (XML eXternal Entity) saldırılarına karşı devre dışı bırakıldığı doğrulanmalıdır . | 1 | +| **1.5.2** | Güvenilmeyen verilerin ters serileştirilmesinde, nesne türleri için izinli liste kullanımı veya istemci tanımlı nesne türlerinin kısıtlanması gibi güvenli giriş işleme önlemlerinin uygulandığı doğrulanmalıdır. Güvensiz olarak tanımlanmış ters serileştirme mekanizmaları, güvenilmeyen girdilerle kullanılmamalıdır. | 2 | +| **1.5.3** | Aynı veri türü için uygulamada kullanılan farklı parser'ların (ör. JSON, XML, URL parser'ları), veriyi tutarlı şekilde ayrıştırdığı ve aynı karakter kodlamasını kullandığı doğrulanmalıdır. Böylece JSON birlikte çalışabilirlik açıkları, URI veya dosya ayrıştırma farkları gibi sorunlar nedeniyle RFI veya SSRF saldırılarının istismar edilmesi önlenir. | 3 | + +## Referanslar + +Daha fazla bilgi için: + +* [OWASP LDAP Injection Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html) +* [OWASP Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) +* [OWASP DOM Based Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html) +* [OWASP XML External Entity Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html) +* [OWASP Testing Guide 4.0: Client-Side Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/11-Client-side_Testing/README) +* [OWASP Java Encoding Project](https://owasp.org/owasp-java-encoder/) +* [DOMPurify - Client-side HTML Sanitization Library](https://github.com/cure53/DOMPurify) +* [RFC4180 - Common Format and MIME Type for Comma-Separated Values (CSV) Files](https://datatracker.ietf.org/doc/html/rfc4180#section-2) + +Ters serileştirme ve parser konularında daha fazla bilgi için: + +* [OWASP Deserialization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) +* [OWASP Deserialization of Untrusted Data Guide](https://owasp.org/www-community/vulnerabilities/Deserialization_of_untrusted_data) +* [An Exploration of JSON Interoperability Vulnerabilities](https://bishopfox.com/blog/json-interoperability-vulnerabilities) +* [Orange Tsai - A New Era of SSRF Exploiting URL Parser In Trending Programming Languages](https://www.blackhat.com/docs/us-17/thursday/us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf) diff --git a/5.0/tr/0x11-V2-Validation-and-Business-Logic.md b/5.0/tr/0x11-V2-Validation-and-Business-Logic.md new file mode 100644 index 0000000000..3177eba8c3 --- /dev/null +++ b/5.0/tr/0x11-V2-Validation-and-Business-Logic.md @@ -0,0 +1,73 @@ +# V2 Doğrulama ve İş Mantığı + +## Kontrol Amacı + +Bu bölümün amacı, doğrulanan bir uygulamanın aşağıdaki üst düzey hedefleri karşıladığından emin olmaktır: + +* Uygulamanın aldığı girdiler, işlevsel veya iş gereksinimleriyle uyumludur. +* İş mantığı akışı sıralıdır, sırayla işlenir ve atlanamaz. +* İş mantığı, sürekli küçük para transferleri veya her seferinde 1 tane olmak üzere 1 milyon arkadaş ekleme gibi otomatik saldırıları tespit edip engellemek için sınırlar ve kontroller içerir. +* Yüksek değerli iş mantığı akışları, kötüye kullanım senaryoları ve kötü niyetli aktörler göz önüne alınarak oluşturulmuştur ve kimlik sahteciliği, manipülasyon, bilgi sızıntısı ve yetki yükseltme saldırılarına karşı korumaya sahiptir. + +## V2.1 Doğrulama ve İş Mantığı Dokümantasyonu + +Doğrulama ve iş mantığı dokümantasyonu; iş mantığı sınırlarını, doğrulama kurallarını ve birleştirilmiş veri öğelerinin bağlamsal tutarlılığını açıkça tanımlamalıdır. Böylece uygulamada neyin uygulanması gerektiği net olur. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **2.1.1** | Uygulama dokümantasyonunda, veri öğelerinin beklenen yapıya göre nasıl doğrulanacağına ilişkin giriş doğrulama kurallarının tanımlandığı doğrulanmalıdır. Bu; kredi kartı numaraları, e-posta adresleri, telefon numaraları gibi yaygın veri biçimleri olabileceği gibi iç sistemlere özel biçimler de olabilir. | 1 | +| **2.1.2** | Uygulama dokümantasyonunda, birleştirilmiş veri öğelerinin mantıksal ve bağlamsal tutarlılığının nasıl doğrulanacağı tanımlanmalıdır (örneğin, mahalle ve posta kodunun eşleşip eşleşmediğinin kontrolü). | 2 | +| **2.1.3** | Hem kullanıcı bazında hem de uygulama genelinde geçerli olacak şekilde, iş mantığı sınırları ve doğrulama beklentilerinin belgelendiği doğrulanmalıdır. | 2 | + +## V2.2 Girdi Doğrulama + +Etkili girdi doğrulama kontrolleri, uygulamanın beklediği veri türüne yönelik işlevsel ya da iş gereksinimlerinin sağlanmasını zorunlu kılar. Bu sayede veri kalitesi artar ve saldırı yüzeyi daraltılır. Ancak bu, verinin başka bileşenlerde kullanılmadan veya çıktıya aktarılmadan önce doğru şekilde kodlanması, parametreleştirilmesi ya da temizlenmesi ihtiyacını ortadan kaldırmaz. + +Bu bağlamda "girdi"; HTML form alanları, REST istekleri, URL parametreleri, HTTP başlıkları, çerezler, disk dosyaları, veritabanları veya harici API'lerden gelebilir. + +Bir iş mantığı kontrolü, belirli bir girdinin 100'den küçük bir sayı olup olmadığını kontrol edebilir. Bir işlevsel beklenti ise bu sayının belirli bir eşiğin altında olmasını isteyebilir, çünkü bu sayı örneğin bir döngünün kaç kez çalışacağını belirliyor olabilir; büyük bir değer, aşırı işlemeye ve hizmet reddi (DoS) durumuna yol açabilir. + +Şema doğrulaması zorunlu tutulmamış olsa da, HTTP API'leri veya JSON/XML kullanan diğer arayüzlerin tamamen doğrulanması için en etkili yöntem olabilir. + +Şema doğrulamasıyla ilgili aşağıdaki hususlara dikkat edilmelidir: + +* JSON Schema doğrulama standardının “yayınlanmış sürümü” üretime hazır kabul edilmekte ancak “stabil” değildir. Kullanıldığında, aşağıdaki gereksinimlerle çelişmediğinden emin olunmalıdır. +* Kullanılan JSON Schema kütüphaneleri, standart resmileştiğinde izlenmeli ve gerekirse güncellenmelidir. +* DTD'lere karşı yapılan XXE saldırılarını önlemek için DTD doğrulaması kullanılmamalı ve çerçeve içindeki DTD işleme özellikleri devre dışı bırakılmalıdır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **2.2.1** | Girdilerin, işlevsel ya da iş gereksinimlerine uygunluğunun doğrulandığı teyit edilmelidir. Bu işlem; izinli değerler, desenler ve aralıklar listesine karşı pozitif doğrulama ile ya da girdinin beklenen yapıya ve mantıksal sınırlara uygunluğunun önceden tanımlanmış kurallara göre karşılaştırılması ile yapılmalıdır. Seviye 1 için bu, güvenlik veya iş kararlarında kullanılan girdilere odaklanabilir. Seviye 2 ve üstü için tüm girdilere uygulanmalıdır. | 1 | +| **2.2.2** | Uygulamanın, güvenilir bir servis katmanında girdi doğrulama zorunluluğu uygulayacak şekilde tasarlandığı doğrulanmalıdır. İstemci tarafında gerçekleştirilen doğrulama, kullanılabilirliği artırabilir ve teşvik edilmelidir. Ancak bu doğrulama,güvenlik kontrolü olarak kabul edilmemelidir. | 1 | +| **2.2.3** | Uygulamanın, ilişkili veri öğelerinin önceden tanımlanmış kurallara göre makul olup olmadığını kontrol ettiği doğrulanmalıdır. | 2 | + +## V2.3 İş Mantığı Güvenliği + +Bu bölüm, uygulamanın iş mantığı süreçlerini doğru şekilde yürüttüğünden ve bu mantık ve akışın istismarına karşı savunmasız olmadığından emin olunması için temel gereksinimleri kapsar. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **2.3.1** | Uygulamanın, aynı kullanıcı için iş mantığı akışlarını yalnızca beklenen adım sırasına göre ve adım atlamadan işlediği doğrulanmalıdır. | 1 | +| **2.3.2** | İş mantığı sınırlarının, uygulama dokümantasyonuna uygun şekilde uygulandığı doğrulanmalıdır. | 2 | +| **2.3.3** | İş mantığı seviyesinde işlemlerin (transaction) kullanıldığı ve bir iş mantığı işleminin ya bütünüyle başarıyla tamamlandığı ya da önceki geçerli duruma geri döndürüldüğü (rollback) doğrulanmalıdır. | 2 | +| **2.3.4** | İş mantığı düzeyinde kilitleme mekanizmalarının, sınırlı kaynakların (ör. sinema koltukları, teslimat zamanları) uygulamanın mantığı manipüle edilerek çift rezervasyona neden olmamasını sağladığı doğrulanmalıdır. | 2 | +| **2.3.5** | Yüksek değerli iş mantığı akışlarının, yetkisiz veya kazara gerçekleşebilecek işlemleri önlemek için çoklu kullanıcı onayı gerektirdiği doğrulanmalıdır. Bu işlemler büyük para transferleri, sözleşme onayları, gizli bilgilere erişim veya üretimde güvenlik kurallarının geçersiz kılınmaları gibi durumları içerebilir. | 3 | + +## V2.4 Otomasyon Karşıtı Önlemler + +Bu bölümde, insan benzeri etkileşimlerin zorunlu kılındığı ve aşırı miktardaki otomatik taleplerin engellendiği kontroller yer alır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **2.4.1** | Uygulama işlevlerine yönelik aşırı miktardaki çağrılara karşı; veri sızdırma, anlamsız veri üretme, kota tüketme, hız sınırının aşılması, hizmet reddi (DoS) ya da maliyetli kaynakların aşırı kullanımı gibi risklere karşı otomasyon karşıtı kontrollerin bulunduğu doğrulanmalıdır. | 2 | +| **2.4.2** | İş mantığı akışlarının, aşırı hızlı işlem gönderimlerini önleyecek şekilde gerçekçi insan zamanlaması gerektirdiği doğrulanmalıdır. | 3 | + +## Referanslar + +Daha fazla bilgi için: + +* [OWASP Web Security Testing Guide 4.2: Input Validation Testing](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/README.html) +* [OWASP Web Security Testing Guide 4.2: Business Logic Testing](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/10-Business_Logic_Testing/README) +* Anti-automation can be achieved in many ways, including the use of the [OWASP Automated Threats to Web Applications](https://owasp.org/www-project-automated-threats-to-web-applications/) +* [OWASP Input Validation Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html) +* [JSON Schema](https://json-schema.org/specification.html) diff --git a/5.0/tr/0x12-V3-Web-Frontend-Security.md b/5.0/tr/0x12-V3-Web-Frontend-Security.md new file mode 100644 index 0000000000..6f1c2907b2 --- /dev/null +++ b/5.0/tr/0x12-V3-Web-Frontend-Security.md @@ -0,0 +1,101 @@ +# V3 Web Ön Uç (Frontend) Güvenliği + +## Kontrol Amacı + +Bu kategori, bir web frontend'i üzerinden gerçekleştirilen saldırılara karşı koruma sağlamak amacıyla belirlenmiş gereksinimlere odaklanır. Bu gereksinimler, makineden makineye çözümler için geçerli değildir. + +## V3.1 Web Frontend Güvenlik Dokümantasyonu + +Bu bölüm, uygulamanın dokümantasyonunda belirtilmesi gereken tarayıcı güvenlik özelliklerini tanımlar. + +| # | Açıklama | Seviye | +| :---: | :---: | :---: | +| **3.1.1** | Uygulama dokümantasyonunda, uygulamayı kullanan tarayıcıların desteklemesi gereken güvenlik özelliklerinin (ör. HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) ve diğer ilgili HTTP güvenlik mekanizmaları) tanımlandığı doğrulanmalıdır. Ayrıca bu özelliklerin mevcut olmadığı durumlarda uygulamanın nasıl davranması gerektiği (ör. kullanıcıyı uyarmak veya erişimi engellemek) de tanımlanmalıdır. | 3 | + +## V3.2 İçeriğin Yanlış Yorumlanması + +İçerik veya işlevin yanlış bir bağlamda sunulması, kötü amaçlı içeriğin çalıştırılmasına veya görüntülenmesine neden olabilir. + +| # | Açıklama | Seviye | +| :---: | :---: | :---: | +| **3.2.1** | Tarayıcıların HTTP yanıtlarında içerik veya işlevi yanlış bir bağlamda sunmalarını önlemek amacıyla güvenlik kontrollerinin uygulandığı doğrulanmalıdır (ör. API, kullanıcı tarafından yüklenen dosya veya başka bir kaynağın doğrudan çağrılması durumunda). Olası kontroller arasında; yalnızca HTTP istek başlıklarının (ör. Sec-Fetch-\*) doğru bağlamı gösterdiği durumlarda içeriğin sunulması, Content-Security-Policy başlığında "sandbox" yönergesinin kullanılması veya Content-Disposition başlığında "attachment" biçiminin kullanılması yer alabilir. | 1 | +| **3.2.2** | HTML yerine metin olarak görüntülenmesi amaçlanan içeriğin, HTML veya JavaScript gibi içeriklerin istenmeden çalıştırılmasını önleyecek şekilde "createTextNode" veya "textContent" gibi güvenli işleme fonksiyonlarıyla işlendiği doğrulanmalıdır. | 1 | +| **3.2.3** | Uygulamanın istemci tarafı JavaScript kullanırken açık değişken tanımlamaları yaparak, sıkı tür kontrolü uygulayarak, global değişkenleri document nesnesine kaydetmekten kaçınarak ve ad alanı izolasyonu sağlayarak DOM clobbering’den kaçındığı doğrulanmalıdır. | 3 | + +## V3.3 Çerez Yapılandırması + +Bu bölüm, hassas çerezlerin güvenli biçimde yapılandırılması için gereksinimleri tanımlar. Amaç, çerezlerin gerçekten uygulama tarafından oluşturulduğuna dair daha yüksek düzeyde güvence sağlamak ve içeriklerinin sızmasını veya uygunsuz şekilde değiştirilmesini önlemektir. + +| # | Açıklama | Seviye | +| :---: | :---: | :---: | +| **3.3.1** | Çerezlerin 'Secure' niteliğine sahip olduğu ve eğer çerez adı '\__Host-' ön eki ile başlamıyorsa, '__Secure-' ön ekinin kullanıldığı doğrulanmalıdır. | 1 | +| **3.3.2** | Kullanıcı arayüzü kandırma saldırılarına ve tarayıcı tabanlı istek sahteciliği saldırılarına (CSRF) karşı koruma sağlamak amacıyla, her çerezin 'SameSite' niteliğinin kullanım amacına uygun şekilde ayarlandığı doğrulanmalıdır. | 2 | +| **3.3.3** | Çerez adı, diğer sunucularla paylaşılmak üzere açıkça tasarlanmadığı sürece '__Host-' ön eki ile tanımlanmalıdır. | 2 | +| **3.3.4** | Bir çerez değeri istemci tarafı betikleri tarafından erişilememesi gereken bir veri içeriyorsa (ör. oturum token'ı), çerezin 'HttpOnly' niteliğine sahip olduğu ve aynı değerin (ör. oturum token'ı) yalnızca 'Set-Cookie' başlığı ile istemciye iletildiği doğrulanmalıdır. | 2 | +| **3.3.5** | Uygulama bir çerez oluştururken, çerez adı ve değerinin toplam uzunluğunun 4096 baytı aşmadığı doğrulanmalıdır. Çok büyük çerezler tarayıcı tarafından saklanmaz ve isteklerle gönderilmez; bu da çereze bağlı çalışan uygulama işlevlerinin bozulmasına yol açabilir. | 3 | + +## V3.4 Tarayıcı Güvenlik Mekanizması Başlıkları (Header) + +Bu bölüm, tarayıcıların uygulamadan gelen yanıtları işlerken güvenlik özelliklerini etkinleştirmesi ve kısıtlamaları uygulaması için HTTP yanıtlarında hangi güvenlik header'larının ayarlanması gerektiğini açıklar. + +| # | Açıklama | Seviye | +| :---: | :---: | :---: | +| **3.4.1**| Tüm yanıtların, HTTP Strict Transport Security (HSTS) politikasını zorunlu kılmak için Strict-Transport-Security header alanını içerdiği doğrulanmalıdır. En az 1 yıl süreli bir max-age tanımlanmalı ve Seviye 2 ve üzeri için bu politika tüm alt alan adlarını da kapsamalıdır. | 1 | +| **3.4.2** | Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header'ı, uygulama tarafından sabit bir değer olarak tanımlanmalı veya gelen Origin header değeri güvenilir origin’lerden oluşan bir izinli listeye karşı doğrulanmalıdır. ‘Access-Control-Allow-Origin: *’ kullanılması gerekiyorsa, yanıtın hassas bilgi içermediği doğrulanmalıdır. | 1 | +| **3.4.3** | HTTP yanıtlarında Content-Security-Policy header'ı bulunduğu ve bu header'ın yalnızca güvenilen içeriklerin veya kaynakların yüklenmesini ve çalıştırılmasını sağlayan yönergeler içerdiği doğrulanmalıdır. Minimum olarak "global policy", object-src 'none', base-uri 'none' yönergelerini içermeli ve izinli liste, nonce veya hash temelli bir yapı içermelidir. Seviye 3 uygulamalarında her yanıt için nonce veya hash içeren özel bir politika tanımlanmalıdır. | 2 | +| **3.4.4** | Tüm HTTP yanıtlarının 'X-Content-Type-Options: nosniff' header'ını içerdiği doğrulanmalıdır. Bu, tarayıcıya içerik türünü tahmin etmeyi bırakmasını ve yanıtın Content-Type header'ında belirtilen MIME türünün, beklenen kaynak türüyle eşleşmesini zorunlu kılar. Ayrıca bu, tarayıcıda CORB (Cross-Origin Read Blocking) özelliğini etkinleştirir. | 2 | +| **3.4.5** | Uygulamanın, 'Referer' başlığı yoluyla üçüncü taraflara teknik olarak hassas verilerin sızmasını önlemek için bir 'referrer policy' belirlediği doğrulanmalıdır. Bu, Referrer-Policy HTTP header'ıyla veya HTML öğe nitelikleriyle (element attributes) sağlanabilir. Sızabilecek hassas bilgiler, URL’deki yol ve sorgu parametreleri ile sınırlı uygulamalarda hostname bilgisini içerebilir. | 2 | +| **3.4.6** | Uygulamanın, Content-Security-Policy header'ı altında 'frame-ancestors' yönergesini her HTTP yanıtında tanımladığı ve bu sayede içeriklerin varsayılan olarak başka sayfalara gömülmesini engellediği doğrulanmalıdır. Gerekli durumlarda özel olarak izin verildiğinden emin olunmalıdır. 'X-Frame-Options' header'ı, tarayıcılar tarafından desteklenmesine rağmen, artık güncel değildir ve güvenlik amacıyla kullanılmamalıdır. | 2 | +| **3.4.7**| Content-Security-Policy header'ında ihlal bildirimlerinin gönderileceği bir adresin tanımlandığı doğrulanmalıdır. | 3 | +| **3.4.8** | Bir belgenin işlenmesini ve sunulmasını başlatan tüm HTTP yanıtlarında (örneğin 'text/html' tipi yanıtlar), 'Cross-Origin-Opener-Policy' header'ı 'same-origin' veya 'same-origin-allow-popups' yönergeleriyle birlikte yer almalıdır. Bu, tabnabbing ve frame counting gibi, pencere nesnelerine paylaşımlı erişimi sömüren saldırılara karşı koruma sağlar. | 3 | + +## V3.5 Tarayıcı Menşei Ayırımı + +Sunucu tarafında hassas işlevlere yönelik bir isteği kabul ederken, uygulamanın, isteğin uygulamanın kendisi veya güvenilir bir tarafça başlatıldığından ve bir saldırgan tarafından taklit edilmediğinden emin olması gerekir. + +Bu bağlamda hassas işlevsellik, kimliği doğrulanmış ve doğrulanmamış kullanıcılar için form gönderilerinin kabul edilmesini (kimlik doğrulama isteği gibi), durum değiştirme işlemlerini veya kaynak gerektiren işlevselliği (veri dışa aktarma gibi) içerebilir. + +Buradaki temel korumalar, JavaScript için Same Origin Policy ve çerezler için SameSite mantığı gibi tarayıcı güvenlik politikalarıdır. Bir diğer yaygın koruma ise CORS ön kontrol mekanizmasıdır. Bu mekanizma, farklı bir kaynaktan çağrılmak üzere tasarlanmış uç noktalar için kritik olacaktır, ancak farklı bir kaynaktan çağrılmak üzere tasarlanmamış uç noktalar için de yararlı bir istek sahteciliği önleme mekanizması olabilir. + +| # | Açıklama | Seviye | +| :---: | :---: | :---: | +| **3.5.1** | Uygulama, hassas işlevselliğe yönelik izinsiz cross-origin istekleri önlemek için CORS preflight mekanizmasına güvenmiyorsa, bu tür isteklerin gerçekten uygulamadan geldiği doğrulanmalıdır. Bu, anti-forgery token kullanımı veya CORS tarafından güvenli kabul edilmeyen özel HTTP header'larının zorunlu kılınmasıyla yapılabilir. Bu, tarayıcı tabanlı istek sahteciliği (CSRF) saldırılarına karşı bir savunmadır. | 1 | +| **3.5.2** | Uygulama, hassas işlevlerin izinsiz cross-origin çağrılmasını önlemek için CORS preflight mekanizmasına güveniyorsa, bu işlevlerin bir CORS-preflight isteğini tetiklemeden çağrılamadığı doğrulanmalıdır. Bu, 'Origin' ve 'Content-Type' header'larının doğrulanmasını veya CORS-safelisted olmayan bir header'ın ve alanın kullanılmasını gerektirebilir. | 1 | +| **3.5.3**| Hassas işlevselliğe yönelik HTTP isteklerinin 'POST', 'PUT', 'PATCH' veya 'DELETE' gibi uygun HTTP yöntemlerini kullandığı ve HTTP spesifikasyonuna göre "güvenli" olan 'GET', 'OPTIONS' veya 'HEAD' gibi yöntemlerle çağrılamadığı doğrulanmalıdır. Alternatif olarak 'Sec-Fetch-*' header'larının sıkı şekilde doğrulanması da uygunsuz cross-origin, navigasyon veya medya yükleme isteklerini ayırt etmek için kullanılabilir. | 1 | +| **3.5.4** | Farklı uygulamaların farklı hostname'lerde barındırıldığı ve böylece Same-Origin Policy tarafından sağlanan kısıtlamalardan (örneğin çerez erişim sınırları, kaynaklar arası etkileşim kontrolleri) faydalanıldığı doğrulanmalıdır. | 2 | +| **3.5.5**| postMessage arayüzü üzerinden alınan iletilerin, mesajın kökeni güvenilir değilse veya mesaj sözdizimi geçersizse reddedildiği doğrulanmalıdır. | 2 | +| **3.5.6** | Uygulamanın herhangi bir yerinde JSONP işlevselliğinin etkin olmadığı doğrulanmalıdır. Bu, XSSI (Cross-Site Script Inclusion) saldırılarını önlemek içindir. | 3 | +| **3.5.7** | Yetkilendirme gerektiren verilerin, JavaScript dosyaları gibi betik kaynaklarının yanıtlarında yer almadığı, XSSI saldırılarını önlemek için doğrulanmalıdır. | 3 | +| **3.5.8** | Kimliği doğrulanmış kaynakların (örneğin görseller, videolar, betikler ve belgeler) yalnızca gerçekten amaçlandığında kullanıcı adına yüklenebildiği veya gömülebildiği doğrulanmalıdır. Bu, isteğin uygun olmayan bir çapraz kaynak çağrısından kaynaklanmadığından emin olmak için Sec-Fetch-* HTTP istek başlığı alanlarının sıkı bir şekilde doğrulanmasıyla veya tarayıcıya döndürülen içeriği engelleme talimatı vermek için kısıtlayıcı bir Cross-Origin-Resource-Policy HTTP yanıt başlığı alanı ayarlayarak gerçekleştirilebilir. | 3 | + +## V3.6 Harici Kaynak Bütünlüğü + +Bu bölüm, içeriklerin üçüncü taraf sitelerde güvenli şekilde barındırılmasıyla ilgili rehberlik sunar. + +| # | Açıklama | Seviye | +| :---: | :---: | :---: | +| **3.6.1** | JavaScript kütüphaneleri, CSS veya web fontları gibi istemci tarafı varlıkların yalnızca statik ve sürümlü olması, varlığın bütünlüğünü doğrulamak için Subresource Integrity (SRI) kullanılması durumunda harici olarak (örneğin, bir İçerik Dağıtım Ağı üzerinde) barındırıldığı doğrulanmalıdır. Bu mümkün değilse, her bir kaynak için bunu gerekçelendiren belgelenmiş bir güvenlik kararı bulunmalıdır. | 3 | + +## V3.7 Diğer Tarayıcı Güvenliği Hususları + +Bu bölüm, istemci tarafı tarayıcı güvenliği için gerekli olan çeşitli diğer güvenlik kontrolleri ve modern tarayıcı güvenlik özelliklerini içerir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **3.7.1** | Uygulamanın yalnızca hâlâ desteklenen ve güvenli kabul edilen istemci tarafı teknolojileri kullandığı doğrulanmalıdır. Bu gereksinimi karşılamayan teknolojilere örnek olarak NSAPI eklentileri, Flash, Shockwave, ActiveX, Silverlight, NACL veya istemci tarafı Java applet’leri verilebilir. | 2 | +| **3.7.2** | Uygulamanın, yalnızca hedef adres bir izinli listede yer alıyorsa kullanıcıyı otomatik olarak farklı bir ana makine adına veya uygulamanın kontrolünde olmayan bir etki alanına yönlendirdiği doğrulanmalıdır. | 2 | +| **3.7.3** | Uygulamanın, kullanıcı uygulamanın kontrolü dışındaki bir URL’ye yönlendirildiğinde, yönlendirme hakkında bir bildirim gösterdiği ve kullanıcının bu gezintiyi iptal edebilmesi için bir seçenek sunduğu doğrulanmalıdır. | 3 | +| **3.7.4** | Uygulamanın en üst düzey etki alanının (örneğin, site.tld) HTTP Strict Transport Security (HSTS) için genel preload listesine eklendiği doğrulanmalıdır. Bu, uygulamanın TLS kullanımının ana tarayıcılar tarafından doğrudan tanınmasını ve yalnızca Strict-Transport-Security yanıt header'ına bağlı kalınmamasını sağlar. | 3 | +| **3.7.5** | Uygulamaya erişen tarayıcının beklenen güvenlik özelliklerini desteklememesi durumunda, uygulamanın dokümantasyona uygun şekilde davrandığı (örneğin kullanıcıyı uyarma veya erişimi engelleme) doğrulanmalıdır. | 3 | + +## Referanslar + +Daha fazla bilgi için: + +* [Set-Cookie __Host- prefix details](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#cookie_prefixes) +* [OWASP Content Security Policy Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html) +* [Exploiting CORS misconfiguration for BitCoins and Bounties](https://portswigger.net/blog/exploiting-cors-misconfigurations-for-bitcoins-and-bounties) +* [Sandboxing third-party components](https://cheatsheetseries.owasp.org/cheatsheets/Third_Party_Javascript_Management_Cheat_Sheet.html#sandboxing-content) +* [OWASP Secure Headers Project](https://owasp.org/www-project-secure-headers/) +* [OWASP Cross-Site Request Forgery Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html) +* [HSTS Browser Preload List submission form](https://hstspreload.org/) diff --git a/5.0/tr/0x13-V4-API-and-Web-Service.md b/5.0/tr/0x13-V4-API-and-Web-Service.md new file mode 100644 index 0000000000..b86db010ae --- /dev/null +++ b/5.0/tr/0x13-V4-API-and-Web-Service.md @@ -0,0 +1,64 @@ +# V4 API ve Web Servisi + +## Kontrol Amacı + +Web tarayıcıları veya diğer istemciler tarafından kullanılmak üzere API'ler sunan uygulamalara özgü bazı ek değerlendirmeler bulunmaktadır (genellikle JSON, XML veya GraphQL kullanılır). Bu bölüm, uygulanması gereken ilgili güvenlik yapılandırmaları ve mekanizmaları kapsar. + +Kimlik doğrulama, oturum yönetimi ve girdi doğrulama gibi diğer bölümlerde ele alınan konuların API'ler için de geçerli olduğunu unutmayın; bu nedenle bu bölüm bağlamından bağımsız düşünülemez veya tek başına test edilemez. + +## V4.1 Genel Web Servisi Güvenliği + +Bu bölüm, genel web servisi güvenliğiyle ilgili değerlendirmeleri ve temel web servisi hijyen uygulamalarını ele alır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **4.1.1** | İleti gövdesi içeren her HTTP yanıtında, yanıtın gerçek içeriğiyle eşleşen bir Content-Type header alanı bulunduğu ve güvenli karakter kodlamasını (örneğin, UTF-8, ISO-8859-1) belirtmek üzere charset parametresi içerdiği doğrulanmalıdır. Bu işlem, IANA Medya Türleri'nden "text/", "/+xml" ve "/xml" gibi içerikler için geçerlidir. | 1 | +| **4.1.2** | Yalnızca kullanıcı arayüzüne yönelik uç noktaların (manuel olarak web tarayıcısı ile erişilmesi amaçlanan) otomatik olarak HTTP'den HTTPS'e yönlendirme yaptığı ve diğer hizmetlerin veya uç noktaların şeffaf yönlendirme gerçekleştirmediği doğrulanmalıdır. Bu, istemcinin farkında olmadan şifrelenmemiş HTTP istekleri göndermesi ve bu isteklerin otomatik olarak HTTPS'e yönlendirilmesi sonucunda hassas verilerin sızmasının fark edilmemesi riskini önlemek içindir. | 2 | +| **4.1.3** | Uygulama tarafından kullanılan ve yük dengeleyici, web proxy veya frontend için backend hizmeti gibi bir ara katman tarafından ayarlanan herhangi bir HTTP başlık alanının, son kullanıcı tarafından geçersiz kılınamayacağı doğrulanmalıdır. Örnek başlıklar arasında X-Real-IP, X-Forwarded-* veya X-User-ID yer alabilir. | 2 | +| **4.1.4** | Uygulama veya API tarafından açıkça desteklenen HTTP yöntemlerinin (preflight istekleri sırasında OPTIONS dahil) dışında hiçbir yöntemin kullanılmadığı ve kullanılmayan yöntemlerin engellendiği doğrulanmalıdır. | 3 | +| **4.1.5** | Çok hassas istekler veya birçok sistemden geçen işlemler için, taşıma katmanı güvenliğinin üzerine ek bir güvence sağlamak amacıyla, her iletiye özel dijital imzaların kullanıldığı doğrulanmalıdır. | 3 | + +## V4.2 HTTP İleti Yapısı Doğrulama + +Bu bölüm, HTTP ileti yapısının ve başlık alanlarının doğrulanma biçimini açıklar. Amaç, istek kaçakçılığı, yanıt bölme, başlık enjeksiyonu ve aşırı uzun HTTP iletileri aracılığıyla hizmet reddi gibi saldırıları önlemektir. + +Bu gereksinimler, genel HTTP ileti işleme ve üretimi için geçerlidir; ancak farklı HTTP sürümleri arasında HTTP iletileri dönüştürülürken özellikle önemlidir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **4.2.1** | Tüm uygulama bileşenlerinin (yük dengeleyiciler, güvenlik duvarları ve uygulama sunucuları dahil) HTTP sürümüne uygun mekanizmaları kullanarak gelen HTTP iletilerinin sınırlarını belirlediği ve bu sayede HTTP istek kaçakçılığına karşı koruma sağlandığı doğrulanmalıdır. HTTP/1.x sürümünde Transfer-Encoding başlık alanı varsa, RFC 2616'ya göre Content-Length başlığı göz ardı edilmelidir. HTTP/2 veya HTTP/3 kullanıldığında, Content-Length başlığı varsa, alıcının bu değerin DATA çerçevelerinin uzunluğuyla tutarlı olduğunu doğrulaması gerekir. | 2 | +| **4.2.2** | HTTP iletileri üretilirken, Content-Length başlığının, HTTP protokolünün çerçeveleme yöntemine göre belirlenen içerik uzunluğu ile çelişmediği doğrulanmalıdır. Bu, istek kaçakçılığı saldırılarını önlemek için gereklidir. | 3 | +| **4.2.3** | Uygulamanın, yanıt bölme ve header enjeksiyonu saldırılarını önlemek amacıyla, bağlantıya özel başlık alanları (örneğin Transfer-Encoding) içeren HTTP/2 veya HTTP/3 iletilerini göndermediği ve kabul etmediği doğrulanmalıdır. | 3 | +| **4.2.4** | Uygulamanın yalnızca başlık alanları ve değerleri CR (\r), LF (\n) veya CRLF (\r\n) karakter dizileri içermeyen HTTP/2 ve HTTP/3 isteklerini kabul ettiği doğrulanmalıdır. Bu, başlık enjeksiyonu saldırılarını önlemek içindir. | 3 | +| **4.2.5** | Uygulama (backend veya frontend) istek oluşturuyor ve gönderiyorsa, URI'ler (örneğin API çağrıları için) veya HTTP istek başlıkları (örneğin Authorization veya Cookie) gibi bileşenlerin, alıcı sistemler tarafından kabul edilemeyecek kadar uzun olmamasını sağlamak amacıyla doğrulama, temizleme veya diğer mekanizmaları kullandığı doğrulanmalıdır. Bu tür çok uzun istekler (örneğin çok uzun bir Cookie başlığı) gönderildiğinde sunucunun sürekli hata durumu döndürmesiyle hizmet reddi oluşabilir. | 3 | + +## V4.3 GraphQL + +GraphQL, veri açısından zengin istemcilerin çeşitli backend servislerine sıkı sıkıya bağlı olmadan oluşturulması için giderek daha yaygın hale gelen bir yöntemdir. Bu bölüm, GraphQL ile ilgili güvenlik değerlendirmelerini kapsar. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **4.3.1** | Maliyetli ve iç içe geçmiş sorgular sonucu oluşabilecek GraphQL veya veri katmanı ifadelerine yönelik Hizmet Reddi (DoS) saldırılarını önlemek için, sorgu izin listesi (allowlist), derinlik sınırlandırması, sorgu sayısı sınırlandırması veya sorgu maliyeti analizi kullanıldığı doğrulanmalıdır. | 2 | +| **4.3.2** | GraphQL introspection (iç yapı sorgulama) sorgularının, GraphQL API'nin üçüncü taraflar tarafından kullanılmasına yönelik olmadığı sürece, üretim ortamında devre dışı bırakıldığı doğrulanmalıdır. | 2 | + +## V4.4 WebSocket + +WebSocket, tek bir TCP bağlantısı üzerinden eşzamanlı çift yönlü iletişim sağlayan bir iletişim protokolüdür. 2011 yılında IETF tarafından RFC 6455 olarak standartlaştırılmıştır ve HTTP'den farklıdır, ancak 443 ve 80 numaralı HTTP portları üzerinden çalışacak şekilde tasarlanmıştır. + +Bu bölüm, özellikle bu gerçek zamanlı iletişim kanalını hedef alan iletişim güvenliği ve oturum yönetimi ile ilgili saldırılara karşı korunmak için gerekli olan güvenlik gereksinimlerini sunar. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **4.4.1** | Tüm WebSocket bağlantılarında TLS üzerinden WebSocket (WSS) kullanıldığı doğrulanmalıdır. | 1 | +| **4.4.2** | WebSocket'in başlangıçtaki HTTP el sıkışması (handshake) sırasında, Origin başlık alanının uygulama için izin verilen origin listesiyle karşılaştırılarak kontrol edildiği doğrulanmalıdır. | 2 | +| **4.4.3** | Uygulamanın standart oturum yönetimi kullanılamıyorsa, bunun yerine ilgili Oturum Yönetimi güvenlik gereksinimlerine uygun özel token'ların kullanıldığı doğrulanmalıdır. | 2 | +| **4.4.4** | HTTPS oturumu WebSocket kanalına geçerken, özel WebSocket oturum yönetim token’larının önceki şekilde kimliği doğrulanmış HTTPS oturumu aracılığıyla elde edildiği veya doğrulandığı doğrulanmalıdır. | 2 | + +## Referanslar + +Daha fazla bilgi için: + +* [OWASP REST Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html) +* Resources on GraphQL Authorization from [graphql.org](https://graphql.org/learn/authorization/) and [Apollo](https://www.apollographql.com/docs/apollo-server/security/authentication/#authorization-methods). +* [WSTG - v4.2 | GraphQL Testing](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/12-API_Testing/01-Testing_GraphQL) +* [WSTG - v4.1 | OWASP Foundation](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/11-Client-side_Testing/10-Testing_WebSockets) diff --git a/5.0/tr/0x14-V5-File-Handling.md b/5.0/tr/0x14-V5-File-Handling.md new file mode 100644 index 0000000000..6061a1488c --- /dev/null +++ b/5.0/tr/0x14-V5-File-Handling.md @@ -0,0 +1,54 @@ +# V5 Dosya İşleme + +## Kontrol Amacı + +Dosya kullanımı, hizmet reddi, yetkisiz erişim ve depolama alanının tükenmesi gibi uygulama için çeşitli riskler oluşturabilir. Bu bölüm, bu riskleri ele almak için gereken gereksinimleri içerir. + +## V5.1 Dosya İşleme Dokümantasyonu + +Bu bölüm, uygulama tarafından kabul edilen dosyaların beklenen özelliklerinin belgelenmesini gerektirir. Bu, ilgili güvenlik kontrollerinin geliştirilmesi ve doğrulanması için gerekli bir ön koşuldur. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **5.1.1** | Dokümantasyonun, her yükleme özelliği için izin verilen dosya türlerini, beklenen dosya uzantılarını ve maksimum boyutu (açılmış hali dahil) tanımladığı doğrulanmalıdır. Ayrıca, dosyaların son kullanıcılar için nasıl güvenli hâle getirileceği (örneğin kötü amaçlı bir dosya tespit edildiğinde uygulamanın nasıl davranacağı) gibi bilgilerin de belgede yer aldığı doğrulanmalıdır. | 2 | + +## V5.2 Dosya Yükleme ve İçerik + +Dosya yükleme işlevi, güvenilmeyen dosyaların birincil kaynağıdır. Bu bölüm, bu dosyaların varlığının, hacminin veya içeriğinin uygulamaya zarar vermemesini sağlamak için gereken gereksinimleri açıklar. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **5.2.1** | Uygulamanın, yalnızca performans kaybına veya hizmet reddine yol açmayacak boyuttaki dosyaları kabul ettiği doğrulanmalıdır. | 1 | +| **5.2.2** | Uygulama bir dosyayı, doğrudan veya bir arşiv (ör. zip dosyası) içinde kabul ettiğinde, dosya uzantısının beklenen uzantıyla eşleşip eşleşmediğini kontrol ettiği ve içeriğin uzantı tarafından temsil edilen türle uyumlu olduğunu doğruladığı kontrol edilmelidir. Bu; ilk 'magic byte' kontrolü, görüntü yeniden yazımı ve dosya içeriği doğrulama için özel kütüphanelerin kullanımı gibi yöntemleri içerir. Seviye 1 için bu, yalnızca iş veya güvenlik kararlarında kullanılan dosyalarla sınırlı olabilir. Seviye 2 ve üzeri için tüm dosyalar bu kontrole tabi olmalıdır. | 1 | +| **5.2.3** | Sıkıştırılmış dosyaların (ör. zip, gz, docx, odt) açılmadan önce, izin verilen maksimum açılmış boyuta ve maksimum dosya sayısına göre kontrol edildiği doğrulanmalıdır. | 2 | +| **5.2.4** | Her kullanıcı için dosya boyutu kotası ve maksimum dosya sayısının uygulandığı doğrulanmalıdır. Böylece tek bir kullanıcının çok sayıda veya aşırı büyük dosya yükleyerek depolama alanını doldurması engellenir. | 3 | +| **5.2.5** | Uygulamanın, içinde sembolik bağlantılar (symlink) bulunan sıkıştırılmış dosyaların yüklenmesine yalnızca bu durum özel olarak gerekli olduğunda izin verdiği doğrulanmalıdır. Bu durumda, sembolik bağlantı verilebilecek dosyaların bir izinli listesi uygulanmalıdır. | 3 | +| **5.2.6** | Uygulamanın, piksel boyutu izin verilen maksimum değeri aşan görüntü dosyalarının yüklenmesini reddettiği doğrulanmalıdır. Bu, pixel flood saldırılarını önlemek için gereklidir. | 3 | + +## V5.3 Dosya Depolama + +Bu bölüm, yüklenen dosyaların uygunsuz şekilde çalıştırılmasını önlemeye, tehlikeli içeriğin tespitine ve güvenilmeyen verilerle dosya depolama konumlarının kontrol edilmesinin engellenmesine yönelik gereksinimleri içerir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **5.3.1** | Güvenilmeyen girdilerle yüklenen veya oluşturulan ve herkese açık klasörlerde depolanan dosyaların, bir HTTP isteğiyle doğrudan erişildiğinde sunucu taraflı program kodu olarak çalıştırılmadığı doğrulanmalıdır. | 1 | +| **5.3.2** | Uygulamanın, dosya işlemleri için dosya yollarını oluştururken kullanıcı tarafından gönderilen dosya adlarını değil, dahili olarak oluşturulan veya güvenilir verileri kullandığı; eğer kullanıcı tarafından gönderilen dosya adları veya meta veriler kullanılacaksa, sıkı doğrulama ve temizleme işlemlerinin uygulandığı doğrulanmalıdır. Bu, yol geçişi (path traversal), yerel veya uzak dosya dahil etme (LFI, RFI) ve sunucu tarafı istek sahteciliği (SSRF) saldırılarına karşı koruma sağlar. | 1 | +| **5.3.3** | Sunucu tarafında gerçekleşen dosya işlemlerinin (örneğin dosya açma/decompress işlemi), kullanıcı tarafından sağlanan yol bilgilerini yok saydığı ve zip slip gibi güvenlik açıklarını önlediği doğrulanmalıdır. | 3 | + +## V5.4 Dosya İndirme + +Bu bölüm, indirilebilir dosyaların sunulmasında ortaya çıkabilecek riskleri azaltmaya yönelik gereksinimleri içerir. Bunlar; yol geçişi (path traversal), enjeksiyon saldırıları ve dosyanın tehlikeli içerik barındırıp barındırmadığına ilişkin kontrolleri kapsar. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **5.4.1** | Uygulamanın, kullanıcı tarafından gönderilen dosya adlarını (ör. JSON, JSONP veya URL parametresinde) doğruladığı veya göz ardı ettiği ve yanıtın Content-Disposition başlık alanında bir dosya adı belirttiği doğrulanmalıdır. | 2 | +| **5.4.2** | Sunulan dosya adlarının (örneğin HTTP yanıt header'larında veya e-posta eklerinde), belge yapısını korumak ve enjeksiyon saldırılarını önlemek için kodlandığı veya temizlendiği (ör. RFC 6266’ya uygun) doğrulanmalıdır. | 2 | +| **5.4.3** | Güvenilmeyen kaynaklardan elde edilen dosyaların, bilinen kötü amaçlı içeriklerin sunulmasını önlemek amacıyla antivirüs tarayıcılarıyla tarandığı doğrulanmalıdır. | 2 | + +## Referanslar + +Daha fazla bilgi için: + +* [File Extension Handling for Sensitive Information](https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload) +* [Example of using symlinks for arbitrary file read](https://hackerone.com/reports/1439593) +* [Explanation of "Magic Bytes" from Wikipedia](https://en.wikipedia.org/wiki/List_of_file_signatures) diff --git a/5.0/tr/0x15-V6-Authentication.md b/5.0/tr/0x15-V6-Authentication.md new file mode 100644 index 0000000000..9b01cbe2c7 --- /dev/null +++ b/5.0/tr/0x15-V6-Authentication.md @@ -0,0 +1,166 @@ +# V6 Kimlik Doğrulama + +## Kontrol Amacı + +Kimlik doğrulama, bir kişinin ya da cihazın kimliğini kanıtlama veya doğrulama sürecidir. Bu süreç; bir kişi ya da cihaz hakkında yapılan iddiaların doğrulanmasını, taklit girişimlerine karşı dayanıklılığı ve parolaların ele geçirilmesine ya da dinlenmesine karşı korunmayı kapsar. + +[NIST SP 800-63](https://pages.nist.gov/800-63-3/), özellikle ABD kurumları ve bu kurumlarla etkileşimde bulunanlar için geçerli olmakla birlikte, dünya çapında kuruluşlar için değerli olan modern ve kanıta dayalı bir standarttır. + +Bu bölümdeki birçok gereksinim, söz konusu standardın ikinci bölümü olan NIST SP 800-63B "Dijital Kimlik Rehberi – Kimlik Doğrulama ve Yaşam Döngüsü Yönetimi" bölümünden esinlenmiştir. Ancak bu bölüm, yaygın tehditlere ve sıkça suistimal edilen kimlik doğrulama zayıflıklarına odaklanır; standardın tüm yönlerini kapsamaya çalışmaz. Tam NIST SP 800-63 uyumu gerekiyorsa, doğrudan bu belgeye başvurulmalıdır. + +Ayrıca, NIST SP 800-63 terimleriyle bu bölümde kullanılan terimler zaman zaman farklılık gösterebilir. Bu bölümde, anlaşılırlığı artırmak amacıyla daha yaygın kullanılan terimler tercih edilmiştir. + +Daha gelişmiş uygulamaların ortak bir özelliği, çeşitli risk faktörlerine bağlı olarak kimlik doğrulama aşamalarının uyarlanabilir şekilde yapılandırılabilmesidir. Bu özellik, yetkilendirme kararlarıyla da ilgili olduğundan "Yetkilendirme" bölümünde ele alınmıştır. + +## V6.1 Kimlik Doğrulama Dokümantasyonu + +Bu bölüm, bir uygulamada kimlik doğrulama ile ilgili tutulması gereken dokümantasyon gereksinimlerini içerir. Bu, ilgili kimlik doğrulama kontrollerinin nasıl yapılandırılması gerektiğini uygulamak ve değerlendirmek açısından kritik öneme sahiptir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **6.1.1** | Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırılarına karşı oran sınırlama (rate limiting), otomasyon karşıtı önlemler ve uyarlanabilir yanıt gibi kontrollerin nasıl kullanıldığını açıklayan bir uygulama dokümantasyonu bulunduğu doğrulanmalıdır. Dokümantasyon, bu kontrollerin nasıl yapılandırıldığını ve kötü niyetli hesap kilitlemenin nasıl önlendiğini açıkça ortaya koymalıdır. | 1 | +| **6.1.2** | Parolalarda kullanılmasını önlemek amacıyla, bağlama özgü sözcüklerin (örneğin kurum adlarının permütasyonları, ürün adları, sistem tanımlayıcıları, proje kod adları, departman veya rol adları vb.) bulunduğu belgelenmiş bir liste mevcut olduğu doğrulanmalıdır. | 2 | +| **6.1.3** | Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, bunların tümünün belgelenmiş olduğu ve her yol için tutarlı şekilde uygulanması gereken güvenlik kontrolleri ile kimlik doğrulama gücünün tanımlandığı doğrulanmalıdır. | 2 | + +## V6.2 Parola Güvenliği + +Parolalar, NIST SP 800-63 tarafından "Ezberlenmiş Sırlar" (Memorized Secrets) olarak tanımlanır ve parolalar, parola öbekleri, PIN'ler, desen kilitleri ya da "doğru kedinin veya başka bir görsel öğenin seçilmesi" gibi yöntemleri kapsar. Genellikle "bildiğiniz bir şey" olarak kabul edilirler ve tek faktörlü kimlik doğrulamada yaygın olarak kullanılırlar. + +Bu nedenle, bu bölüm parolaların güvenli şekilde oluşturulmasını ve işlenmesini sağlamak amacıyla oluşturulmuş gereksinimleri içerir. Gereksinimlerin çoğu Seviye 1’dedir çünkü temel düzeyde en önemli olanlardır. Seviye 2 ve sonrasında, çok faktörlü kimlik doğrulama mekanizmaları gereklidir ve parola bu faktörlerden yalnızca biri olabilir. + +Bu bölümdeki gereksinimler büyük ölçüde [NIST's Guidance](https://pages.nist.gov/800-63-3/sp800-63b.html)'ın [§ 5.1.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver) kısmı ile ilişkilidir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **6.2.1** | Kullanıcı tarafından belirlenen parolaların en az 8 karakter uzunluğunda olması sağlanmalı, ancak 15 karakter ve üzeri uzunlukta parolalar olmaları şiddetle tavsiye edilir. | 1 | +| **6.2.2** | Kullanıcıların parolalarını değiştirebilmeleri sağlanmalıdır. | 1 | +| **6.2.3** | Parola değiştirme işlevinin hem mevcut hem de yeni parolayı gerektirdiği doğrulanmalıdır. | 1 | +| **6.2.4** | Kayıt veya parola değişimi sırasında girilen parolaların, uygulamanın parola politikasına (örneğin minimum uzunluk) uyan ilk 3000 yaygın parolaya karşı kontrol edildiği doğrulanmalıdır. | 1 | +| **6.2.5** | Her tür karakterin kullanılmasına izin verildiği ve büyük/küçük harf, sayı veya özel karakter şartlarının zorunlu tutulmadığı doğrulanmalıdır. | 1 | +| **6.2.6** | Parola giriş alanlarının, girdiyi maskelemek için "type=password" kullandığı doğrulanmalıdır. Uygulamalar, kullanıcının tüm maskelenmiş parolayı ya da son girilen karakteri geçici olarak görüntülemesine izin verebilir. | 1 | +| **6.2.7** | "Yapıştır" özelliğinin, tarayıcı parola yardımcılarının ve harici parola yöneticilerinin kullanımına izin verildiği doğrulanmalıdır. | 1 | +| **6.2.8** | Uygulamanın, kullanıcıdan aldığı parolayı herhangi bir şekilde değiştirmeden, örneğin kesmeden veya harf büyüklüğünü değiştirmeden, tam olarak doğruladığı teyit edilmelidir. | 1 | +| **6.2.9** | En az 64 karakter uzunluğundaki parolalara izin verildiği doğrulanmalıdır. | 2 | +| **6.2.10** | Kullanıcının parolasının, yalnızca ele geçirildiği tespit edildiğinde veya kullanıcı tarafından yenilendiğinde geçerliliğini yitirdiği doğrulanmalıdır. Uygulama, belirli aralıklarla parola yenilenmesini zorunlu kılmamalıdır. | 2 | +| **6.2.11** | Tahmin edilmesi kolay parolaların oluşturulmasını önlemek amacıyla, bağlama özgü kelimelerin yer aldığı belgelenmiş listenin parola doğrulamada kullanıldığı teyit edilmelidir. | 2 | +| **6.2.12** | Kayıt veya parola değişikliği sırasında girilen parolaların, ele geçirilmiş parolalar listesine karşı kontrol edildiği doğrulanmalıdır. | 2 | + +## V6.3 Genel Kimlik Doğrulama Güvenliği + +Bu bölüm, kimlik doğrulama mekanizmalarının güvenliğine ilişkin genel gereksinimleri içerir ve farklı güvenlik seviyeleri için beklentileri ortaya koyar. Seviye 2 uygulamalarında çok faktörlü kimlik doğrulama (MFA) zorunlu olmalıdır. Seviye 3 uygulamalarında, donanım tabanlı, kanıtlanmış ve güvenli yürütme ortamında (Trusted Execution Environment - TEE) gerçekleştirilen kimlik doğrulama kullanılmalıdır. Bu, cihaza bağlı passkey’ler, eIDAS Yüksek Güvence Seviyesi (LoA High) zorunlu kimlik doğrulayıcılar, NIST Kimlik Doğrulayıcı Güvence Seviyesi 3 (AAL3) güvencesine sahip kimlik doğrulayıcılar veya eşdeğer mekanizmaları içerebilir. + +Bu yaklaşım MFA konusunda oldukça katı bir duruş sergilese de, kullanıcıları korumak adına güvenlik seviyesini yükseltmek kritiktir. Bu gereksinimlerin gevşetilmesi yönündeki her girişim, kimlik doğrulama ile ilgili risklerin nasıl azaltılacağını açıkça ortaya koyan bir planla birlikte sunulmalıdır. Bu plan, NIST’in konuyla ilgili rehberleri ve araştırmalarını dikkate almalıdır. + +Yayın tarihi itibarıyla, NIST SP 800-63 e-posta kullanımını bir kimlik doğrulama mekanizması olarak [kabul edilemez](https://pages.nist.gov/800-63-FAQ/#q-b11) olarak değerlendirmektedir ([arşivlenmiş kopya](https://web.archive.org/web/20250330115328/https://pages.nist.gov/800-63-FAQ/#q-b11)). + +Bu bölümdeki gereksinimler, [NIST's Guidance](https://pages.nist.gov/800-63-3/sp800-63b.html)'ın [§ 4.2.1](https://pages.nist.gov/800-63-3/sp800-63b.html#421-permitted-authenticator-types), [§ 4.3.1](https://pages.nist.gov/800-63-3/sp800-63b.html#431-permitted-authenticator-types), [§ 5.2.2](https://pages.nist.gov/800-63-3/sp800-63b.html#522-rate-limiting-throttling) ve [§ 6.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#-612-post-enrollment-binding) bölümleriyle ilgilidir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **6.3.1** | Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırıları gibi saldırıları önlemeye yönelik kontrollerin, uygulamanın güvenlik dokümantasyonuna göre uygulandığı doğrulanmalıdır. | 1 | +| **6.3.2** | "root", "admin" veya "sa" gibi varsayılan kullanıcı hesaplarının uygulamada yer almadığı veya devre dışı bırakıldığı doğrulanmalıdır. | 1 | +| **6.3.3** | Uygulamaya erişim için ya çok faktörlü bir kimlik doğrulama mekanizması ya da tek faktörlü mekanizmaların kombinasyonu kullanılmalıdır. Seviye 3 için, bu faktörlerden biri, oltalama saldırılarına karşı direnç sağlayan ve kimlik doğrulama niyetini bir kullanıcı etkileşimi (örneğin FIDO donanım anahtarında bir düğmeye basma veya mobil telefonda bir onay) gerektirerek doğrulayan donanım tabanlı bir kimlik doğrulayıcı olmalıdır. Bu gereksinimdeki herhangi bir esneklik için, gerekçesi belgelenmiş ve riskleri azaltıcı kapsamlı kontroller içeren bir plan gereklidir. | 2 | +| **6.3.4** | Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, belgelendirilmemiş bir yol bulunmadığı ve tüm yollar için güvenlik kontrolleri ile kimlik doğrulama gücünün tutarlı şekilde uygulandığı doğrulanmalıdır. | 2 | +| **6.3.5** | Başarılı veya başarısız şüpheli kimlik doğrulama girişimlerinin kullanıcıya bildirildiği doğrulanmalıdır. Bu, olağandışı bir konum veya istemciden gelen girişimler, yalnızca bir faktörle yapılan kısmen başarılı doğrulamalar, uzun süreli inaktiflik sonrası yapılan girişimler veya birçok başarısız denemeden sonraki başarılı girişimler gibi durumları içerebilir. | 3 | +| **6.3.6** | E-postanın, tek faktörlü ya da çok faktörlü kimlik doğrulama mekanizması olarak kullanılmadığı doğrulanmalıdır. | 3 | +| **6.3.7** | Kimlik doğrulama detaylarında yapılan güncellemeler sonrasında (örneğin kimlik bilgisi sıfırlama, kullanıcı adı veya e-posta adresi değişiklikleri), kullanıcıların bilgilendirildiği doğrulanmalıdır. | 3 | +| **6.3.8** | Başarısız kimlik doğrulama girişimlerinden, geçerli kullanıcıların hata mesajları, HTTP yanıt kodları veya farklı yanıt süreleri gibi sonuçlara dayanarak tespit edilemediği doğrulanmalıdır. Bu koruma, kayıt ve "parolamı unuttum" işlevselliğinde de geçerli olmalıdır. | 3 | + +## V6.4 Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma + +Kimlik doğrulama faktörleri; parolalar, yazılım tabanlı token'lar, donanım token'ları ve biyometrik cihazlar gibi öğeleri kapsar. Bu mekanizmaların yaşam döngüsünün güvenli şekilde yönetilmesi, bir uygulamanın güvenliği açısından kritik öneme sahiptir. Bu bölüm, bu mekanizmalarla ilgili gereksinimleri içerir. + +Bu bölümdeki gereksinimler, büyük ölçüde [NIST's Guidance](https://pages.nist.gov/800-63-3/sp800-63b.html)'ın [§ 5.1.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver) veya [§ 6.1.2.3](https://pages.nist.gov/800-63-3/sp800-63b.html#replacement) bölümleri ile ilişkilidir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **6.4.1** | Sistem tarafından oluşturulan ilk parolaların veya etkinleştirme kodlarının güvenli bir şekilde rastgele üretildiği, mevcut parola politikasına uygun olduğu, kısa bir süre içinde veya ilk kullanım sonrasında geçerliliğini yitirdiği doğrulanmalıdır. Bu başlangıç sırları uzun vadeli parola olarak kullanılmasına izin verilmemelidir. | 1 | +| **6.4.2** | Parola ipuçlarının veya "gizli sorular" olarak bilinen, bilgiye dayalı kimlik doğrulama mekanizmalarının mevcut olmadığı doğrulanmalıdır. | 1 | +| **6.4.3** | Unutulmuş parolanın sıfırlanması için, etkin olan çok faktörlü kimlik doğrulama mekanizmalarını atlamayan güvenli bir sürecin uygulandığı doğrulanmalıdır. | 2 | +| **6.4.4** | Çok faktörlü kimlik doğrulama faktörlerinden biri kaybolursa, kayıt sırasında uygulanan kimlik kanıtlama seviyesiyle aynı seviyede kimlik doğrulama yapıldığı doğrulanmalıdır. | 2 | +| **6.4.5** | Süresi dolacak kimlik doğrulama mekanizmalarının yenilenmesine ilişkin talimatların, süresi dolmadan önce tamamlanacak şekilde yeterli sürede gönderildiği ve gerekiyorsa otomatik hatırlatıcıların yapılandırıldığı doğrulanmalıdır. | 3 | +| **6.4.6** | Yönetici yetkisi olan kullanıcıların, kullanıcının parola sıfırlama sürecini başlatabildiği ancak kullanıcının yeni parolasını belirleyemediği veya değiştiremediği doğrulanmalıdır. Bu, yönetici yetkisi olan kullanıcıların, kullanıcı parolasını bilmesini engeller. | 3 | + +## V6.5 Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler + +Bu bölüm, çeşitli çok faktörlü kimlik doğrulama yöntemleriyle ilgili genel yönergeleri sunar. + +Bu mekanizmalar şunları içerir: + +* Arama Sırları (Lookup Secrets) +* Zamana Dayalı Tek Kullanımlık Parolalar (TOTP) +* Bant Dışı (Out-of-Band) mekanizmalar + +"Arama sırları", daha önceden oluşturulmuş gizli kod listeleridir. Bunlar, İşlem Yetkilendirme Numaraları (TAN), sosyal medya kurtarma kodları veya rastgele değerler içeren bir tablo şeklinde olabilir. Bu tür kimlik doğrulama mekanizmaları, “sahip olduğunuz bir şey” olarak değerlendirilir çünkü kodlar kasıtlı olarak ezberlenemez olacak şekilde tasarlanır ve bir yerde saklanmaları gerekir. + +Zamana Dayalı Tek Kullanımlık Parolalar (TOTP), fiziksel veya yazılımsal token'lardır ve sürekli değişen, sözde rastgele (pseudo-random) bir tek kullanımlık parola gösterir. Bu mekanizmalar da “sahip olduğunuz bir şey” kategorisindedir. Çok faktörlü TOTP'ler tek faktörlü TOTP'lere benzer, ancak nihai Tek Kullanımlık Parolayı (OTP) oluşturmak için geçerli bir PIN kodu, biyometrik kilit açma, USB takma, NFC eşleştirme veya bazı ek değerlerin (işlem imzalama hesaplayıcıları gibi) girilmesini gerektirir. + +Bant dışı mekanizmalar bir sonraki bölümde açıklanacaktır. + +Bu bölümlerdeki gereklilikler çoğunlukla [NIST's Guidance](https://pages.nist.gov/800-63-3/sp800-63b.html)'ın [§ 5.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#-512-look-up-secrets), [§ 5.1.3](https://pages.nist.gov/800-63-3/sp800-63b.html#-513-out-of-band-devices), [§ 5.1.4.2](https://pages.nist.gov/800-63-3/sp800-63b.html#5142-single-factor-otp-verifiers), [§ 5.1.5.2](https://pages.nist.gov/800-63-3/sp800-63b.html#5152-multi-factor-otp-verifiers), [§ 5.2.1](https://pages.nist.gov/800-63-3/sp800-63b.html#521-physical-authenticators) ve [§ 5.2.3](https://pages.nist.gov/800-63-3/sp800-63b.html#523-use-of-biometrics) kısımları ile ilgilidir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **6.5.1** | Arama sırları, bant dışı kimlik doğrulama istekleri veya kodları ve zamana dayalı tek kullanımlık parolaların (TOTP) yalnızca bir kez kullanılabildiği doğrulanmalıdır. | 2 | +| **6.5.2** | Uygulamanın backend tarafında saklanırken, 112 bitten az entropiye sahip (örneğin 19 rastgele harf-rakam karakteri veya 34 rastgele rakam) arama sırlarının, 32-bit rastgele bir salt içeren onaylı bir parola saklama algoritmasıyla hash’lendiği doğrulanmalıdır. Gizli bilginin entropisi 112 bit veya daha fazlaysa standart bir hash fonksiyonu kullanılabilir. | 2 | +| **6.5.3** | Arama sırları, bant dışı kimlik doğrulama kodları ve zamana dayalı tek kullanımlık parola seed'lerinin, öngörülebilir değerlerden kaçınmak için Kriptografik Olarak Güvenli Sözde Rastgele Sayı Üreteci (CSPRNG) ile oluşturulduğu doğrulanmalıdır. | 2 | +| **6.5.4** | Arama sırlarının ve bant dışı kimlik doğrulama kodlarının en az 20 bit entropiye (genellikle 4 rastgele harf-rakam karakteri veya 6 rastgele rakam) sahip olduğu doğrulanmalıdır. | 2 | +| **6.5.5** | Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının ve zamana dayalı tek kullanımlık parolaların (TOTP) belirli bir ömre sahip olduğu doğrulanmalıdır. Bant dışı istekler en fazla 10 dakika, TOTP’ler ise en fazla 30 saniye geçerli olmalıdır. | 2 | +| **6.5.6** | Herhangi bir kimlik doğrulama faktörünün (fiziksel cihazlar dahil) çalınması veya kaybı durumunda iptal edilebildiği doğrulanmalıdır. | 3 | +| **6.5.7** | Biyometrik kimlik doğrulama mekanizmalarının yalnızca ikincil faktör olarak, “sahip olduğunuz bir şey” veya “bildiğiniz bir şey” ile birlikte kullanıldığı doğrulanmalıdır. | 3 | +| **6.5.8** | Zamana dayalı tek kullanımlık parolaların (TOTP) doğrulamasının, güvenilir bir hizmetten alınan zaman kaynağına dayanarak yapıldığı ve güvenilir olmayan veya istemci tarafından sağlanan zaman kaynağına dayanmadığı doğrulanmalıdır. | 3 | + +## V6.6 Bant Dışı Kimlik Doğrulama Mekanizmaları + +Bu mekanizmalar genellikle kimlik doğrulama sunucusunun, fiziksel bir cihazla güvenli bir ikinci kanal üzerinden iletişim kurmasını (örneğin mobil cihazlara gönderilen bildirimler) içerir. Bu tür mekanizmalar, “sahip olduğunuz bir şey” olarak değerlendirilir. + +E-posta ve VOIP gibi güvenli olmayan bant dışı kimlik doğrulama yöntemlerine izin verilmemektedir. PSTN ve SMS ile yapılan kimlik doğrulama şu anda NIST tarafından ["sınırlandırılmış" doğrulama mekanizmaları](https://pages.nist.gov/800-63-FAQ/#q-b01) olarak değerlendirilmekte ve yerlerine zamana dayalı tek kullanımlık parolalar (TOTP) veya benzer kriptografik mekanizmaların tercih edilmesi önerilmektedir. NIST SP 800-63B [§ 5.1.3.3](https://pages.nist.gov/800-63-3/sp800-63b.html#-5133-authentication-using-the-public-switched-telephone-network), telefon veya SMS kullanılması gerekiyorsa cihaz değişimi, SIM değişikliği, numara taşıma gibi anormal davranışların risklerinin ele alınmasını önermektedir. Bu ASVS bölümü bunu zorunlu kılmasa da, bu önlemlerin alınmaması Seviye 2'deki hassas bir uygulamada veya Seviye 3’teki bir uygulamada ciddi bir güvenlik riski olarak değerlendirilmelidir. + +Ayrıca NIST, yakın zamanda [anlık bildirimlerin kullanılmamasını öneren](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#fig-3) bir yönerge oluşturmuştur. Bu ASVS bölümü bu konuda bir zorunluluk getirmese de, “push bombing” risklerine karşı farkındalık önemlidir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **6.6.1** | Tek kullanımlık parolaların (OTP) telefon veya SMS ile Public Switched Telephone Network (PSTN) üzerinden iletildiği kimlik doğrulama mekanizmalarının, yalnızca telefon numarası önceden doğrulanmışsa, alternatif daha güçlü yöntemler (örneğin TOTP) de sunuluyorsa ve kullanıcıya güvenlik riskleri hakkında bilgi veriliyorsa sunulduğu doğrulanmalıdır. Seviye 3 uygulamalar için telefon ve SMS seçenekleri sunulmamalıdır. | 2 | +| **6.6.2** | Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının, oluşturuldukları özgün kimlik doğrulama isteğiyle bağlantılı olduğu ve daha önceki ya da sonraki bir istek için kullanılamadığı doğrulanmalıdır. | 2 | +| **6.6.3** | Kod tabanlı bant dışı kimlik doğrulama mekanizmalarının, oran sınırlaması ile kaba kuvvet saldırılarına karşı korunduğu doğrulanmalıdır. En az 64 bit entropiye sahip kodlar kullanılması da değerlendirilmelidir. | 2 | +| **6.6.4** | Çok faktörlü kimlik doğrulama için push bildirimleri kullanılıyorsa, push bombing saldırılarına karşı oran sınırlamasının kullanıldığı doğrulanmalıdır. “Numara eşleştirme” de bu riski azaltabilir. | 3 | + +## V6.7 Kriptografik Kimlik Doğrulama Mekanizması + +Kriptografik kimlik doğrulama mekanizmaları, akıllı kartlar veya FIDO anahtarları gibi kullanıcıların kimlik doğrulama işlemini tamamlamak için kriptografik cihazı bilgisayara takması ya da eşleştirmesini gerektiren mekanizmaları içerir. Kimlik doğrulama sunucusu, kriptografik cihaza veya yazılıma bir "challenge nonce" gönderir; cihaz ya da yazılım da güvenli bir şekilde saklanan kriptografik anahtara dayalı olarak bir yanıt üretir. Bu bölümdeki gereksinimler bu mekanizmalar için, “Kriptografi” bölümünde ele alınan kriptografik algoritmalarla ilgili rehberlik sağlayan kısımlarla birlikte, uygulamaya özel rehberlik sağlar. + +Kriptografik kimlik doğrulama için paylaşımlı veya gizli anahtarların kullanıldığı durumlarda, diğer sistem gizli anahtarlarıyla aynı mekanizmalar kullanılarak saklanmalıdır. Bu mekanizmalar “Yapılandırma” başlığındaki “Gizli Yönetimi” bölümünde belgelenmiştir. + +Bu bölümdeki gereksinimler çoğunlukla [NIST's Guidance](https://pages.nist.gov/800-63-3/sp800-63b.html)'ın [§ 5.1.7.2](https://pages.nist.gov/800-63-3/sp800-63b.html#sfcdv) kısmı ile ilişkilidir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **6.7.1** | Kriptografik kimlik doğrulama beyanlarını doğrulamak için kullanılan sertifikaların, değiştirilmeye karşı korumalı şekilde saklandığı doğrulanmalıdır. | 3 | +| **6.7.2** | Challenge nonce değerinin en az 64 bit uzunluğunda olduğu ve istatistiksel olarak benzersiz ya da cihazın ömrü boyunca benzersiz olduğu doğrulanmalıdır. | 3 | + +## V6.8 Kimlik Sağlayıcısı ile Kimlik Doğrulama + +Kimlik Sağlayıcılar (IdP'ler), kullanıcılar için birleştirilmiş kimlikler sunar. Kullanıcılar genellikle birden fazla IdP ile birden fazla kimliğe sahiptir; örneğin Azure AD, Okta, Ping Identity veya Google gibi bir kurumsal kimlik ya da Facebook, Twitter, Google veya WeChat gibi bir tüketici kimliği. Bu liste, bu şirketlere veya hizmetlere bir onay niteliğinde değil, sadece geliştiricilerin çoğu kullanıcının halihazırda birçok kimliğe sahip olduğu gerçeğini dikkate almaları gerektiğine dair bir hatırlatmadır. Kuruluşlar, IdP'nin kimlik doğrulama gücüne ilişkin risk profiline göre mevcut kullanıcı kimlikleriyle entegrasyon sağlamayı değerlendirmelidir. Örneğin, sahte veya geçici kimliklerin kolayca oluşturulabilmesi nedeniyle bir devlet kurumu, sosyal medya kimliklerini hassas sistemlere giriş için kabul etmeyebilir; ancak bir mobil oyun şirketi, aktif oyuncu kitlesini artırmak için büyük sosyal medya platformlarıyla entegrasyon yapmayı tercih edebilir. + +Harici kimlik sağlayıcıların güvenli kullanımı, kimlik sahtekarlığını veya sahte beyanları önlemek için dikkatli yapılandırma ve doğrulama gerektirir. Bu bölüm, bu riskleri ele almak için gereksinimleri sunar. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **6.8.1** | Uygulama birden fazla kimlik sağlayıcıyı (IdP) destekliyorsa, başka bir desteklenen kimlik sağlayıcı aracılığıyla (örneğin aynı kullanıcı tanımlayıcısını kullanarak) kullanıcının kimliğinin taklit edilemediği doğrulanmalıdır. Standart önlem, uygulamanın kullanıcıyı IdP kimliği (bir ad alanı işlevi görür) ve IdP içindeki kullanıcı kimliğinin birleşimiyle kaydetmesi ve tanımlamasıdır. | 2 | +| **6.8.2** | Kimlik doğrulama beyanları üzerindeki dijital imzaların (örneğin JWT veya SAML beyanları) varlığı ve bütünlüğünün her zaman doğrulandığı ve imzasız veya geçersiz imzalı beyanların reddedildiği doğrulanmalıdır. | 2 | +| **6.8.3** | SAML beyanlarının benzersiz biçimde işlendiği ve yalnızca geçerlilik süresi içinde bir kez kullanıldığı, tekrar oynatma (replay) saldırılarını önlemek amacıyla doğrulanmalıdır. | 2 | +| **6.8.4** | Uygulama ayrı bir Kimlik Sağlayıcı (IdP) kullanıyorsa ve belirli işlemler için belirli kimlik doğrulama gücü, yöntemleri veya zaman bilgisi bekliyorsa, uygulamanın bu bilgileri IdP tarafından döndürülen veriler üzerinden doğruladığı teyit edilmelidir. Örneğin OIDC kullanılıyorsa, bu durum ID Token üzerindeki 'acr', 'amr' ve 'auth_time' gibi claim’lerin (varsa) doğrulanması ile sağlanabilir. Eğer IdP bu bilgileri sağlamıyorsa, uygulamanın asgari kimlik doğrulama gücünün kullanıldığını varsayan (örneğin yalnızca kullanıcı adı ve parola ile tek faktörlü doğrulama) belgelenmiş bir yedek yaklaşımı olmalıdır. | 2 | + +## Referanslar + +Daha fazla bilgi için: + +* [NIST SP 800-63 - Digital Identity Guidelines](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-3.pdf) +* [NIST SP 800-63B - Authentication and Lifecycle Management](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf) +* [NIST SP 800-63 FAQ](https://pages.nist.gov/800-63-FAQ/) +* [OWASP Testing Guide 4.0: Testing for Authentication](https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/04-Authentication_Testing/README.html) +* [OWASP Cheat Sheet - Password storage](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html) +* [OWASP Cheat Sheet - Forgot password](https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html) +* [OWASP Cheat Sheet - Choosing and using security questions](https://cheatsheetseries.owasp.org/cheatsheets/Choosing_and_Using_Security_Questions_Cheat_Sheet.html) +* [CISA Guidance on "Number Matching"](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implement-number-matching-in-mfa-applications-508c.pdf) +* [Details on the FIDO Alliance](https://fidoalliance.org/) diff --git a/5.0/tr/0x16-V7-Session-Management.md b/5.0/tr/0x16-V7-Session-Management.md new file mode 100644 index 0000000000..b600167bf0 --- /dev/null +++ b/5.0/tr/0x16-V7-Session-Management.md @@ -0,0 +1,91 @@ +# V7 Oturum Yönetimi + +## Kontrol Amacı + +Oturum yönetim mekanizmaları, durum bilgisi olmayan iletişim protokolleri (örneğin HTTP) kullanılırken bile uygulamaların kullanıcı ve cihaz etkileşimlerini zaman içinde ilişkilendirmesini sağlar. Modern uygulamalar, farklı özelliklere ve amaçlara sahip birden fazla oturum belirteci kullanabilir. Güvenli bir oturum yönetim sistemi, saldırganların bir kurbanın oturumunu ele geçirmesini, kullanmasını veya kötüye kullanmasını önlemelidir. Oturumları yöneten uygulamaların aşağıdaki üst düzey oturum yönetimi gereksinimlerini karşılaması gerekir: + +* Oturumlar her bireye özgüdür, tahmin edilemez veya paylaşılamaz. +* Oturumlar artık gerekmediğinde geçersiz kılınır ve inaktivite durumunda zaman aşımına uğrar. + +Bu bölümdeki birçok gereksinim, yaygın tehditlere ve sıkça kötüye kullanılan kimlik doğrulama zayıflıklarına odaklanarak seçilmiş [NIST SP 800-63 Digital Identity Guidelines](https://pages.nist.gov/800-63-4/) kontrolleriyle ilgilidir. + +Belirli oturum yönetim mekanizmalarının bazı uygulama detaylarına ilişkin gereksinimler diğer bölümlerde yer almaktadır: + +* HTTP Çerezleri, oturum belirteçlerini güvence altına almak için yaygın bir mekanizmadır. Çerezler için özel güvenlik gereksinimleri "Web Frontend Güvenliği" bölümünde bulunabilir. +* Kendinden içerikli token'lar, oturumları sürdürmenin yaygın yollarından biridir. Bu token'lara özel güvenlik gereksinimleri "Kendinden İçerikli Token'lar" bölümünde ele alınmıştır. + +## V7.1 Oturum Yönetim Dokümantasyonu + +Tüm uygulamalara uyan tek bir kalıp yoktur. Bu nedenle, tüm durumlara uygun evrensel sınırlar ve limitler tanımlamak mümkün değildir. Oturum yönetimi uygulama ve testine başlanmadan önce, oturum işleme ile ilgili güvenlik kararlarının belgelenmiş olduğu bir risk analizi yapılmalıdır. Bu, oturum yönetim sisteminin uygulamanın özel ihtiyaçlarına göre uyarlanmasını sağlar. + +Durum bilgili ya da durumsuz (stateful ya da stateless) oturum mekanizması tercih edilse bile, analiz eksiksiz ve belgelenmiş olmalı ve seçilen çözümün ilgili tüm güvenlik gereksinimlerini karşılayabildiğini göstermelidir. Kullanılan herhangi bir Tek Oturum Açma (SSO) mekanizması ile olan etkileşim de değerlendirilmelidir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **7.1.1** | Kullanıcının oturum inaktivite zaman aşımı süresi ve mutlak maksimum oturum süresinin belgelendiği, diğer kontrollerle birlikte uygun olduğu ve NIST SP 800-63B yeniden kimlik doğrulama gereksinimlerinden herhangi bir sapma varsa gerekçesinin belgede yer aldığı doğrulanmalıdır. | 2 | +| **7.1.2** | Belgede bir hesap için kaç adet eşzamanlı (paralel) oturuma izin verildiği ile birlikte, maksimum aktif oturum sayısına ulaşıldığında uygulanacak davranış ve işlemlerin tanımlandığı doğrulanmalıdır. | 2 | +| **7.1.3** | Birleşik kimlik yönetim ekosisteminin bir parçası olarak kullanıcı oturumu oluşturan ve yöneten tüm sistemlerin, oturum ömrü, sonlandırma ve yeniden kimlik doğrulama gerektiren diğer koşulların nasıl koordine edildiğini açıklayan kontrollerle birlikte belgede yer aldığı doğrulanmalıdır. | 2 | + +## V7.2 Temel Oturum Yönetimi Güvenliği + +Bu bölüm, oturum token'larının güvenli bir şekilde oluşturulup doğrulandığını teyit eden, güvenli oturumların temel gereksinimlerini içerir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **7.2.1** | Uygulamanın tüm oturum token'ı doğrulama işlemlerini güvenilir bir backend servisi aracılığıyla gerçekleştirdiği doğrulanmalıdır. | 1 | +| **7.2.2** | Uygulamanın, statik API gizli anahtarları veya sabit değerler yerine, oturum yönetimi için dinamik olarak oluşturulan kendi kendine yeterli veya referans token'ları kullandığı doğrulanmalıdır. | 1 | +| **7.2.3** | Uygulama kullanıcı oturumlarını temsil etmek için referans token'ları kullanıyorsa, bu token'ların benzersiz olduğu, kriptografik olarak güvenli bir sözde rastgele sayı üreteci (CSPRNG) kullanılarak üretildiği ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. | 1 | +| **7.2.4** | Uygulamanın, kullanıcı kimlik doğrulaması (yeniden kimlik doğrulama dahil) sırasında yeni bir oturum token'ı oluşturduğu ve mevcut oturum token'ını sonlandırdığı doğrulanmalıdır. | 1 | + +## V7.3 Oturum Zaman Aşımı + +Oturum zaman aşımı mekanizmaları, oturum gaspı (session hijacking) ve diğer oturum kötüye kullanımı biçimlerine karşı fırsat aralığını en aza indirmeyi amaçlar. Zaman aşımı süreleri, belgelenmiş güvenlik kararlarını karşılamalıdır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **7.3.1** | Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde bir hareketsizlik zaman aşımı bulunduğu doğrulanmalıdır. | 2 | +| **7.3.2** | Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde mutlak bir maksimum oturum süresi bulunduğu doğrulanmalıdır. | 2 | + +## V7.4 Oturum Sonlandırma + +Oturum sonlandırma işlemi, uygulamanın kendisi tarafından veya oturum yönetimi uygulama yerine SSO sağlayıcısı tarafından yürütülüyorsa SSO sağlayıcısı tarafından gerçekleştirilebilir. Bu bölümdeki gereksinimler değerlendirilirken SSO sağlayıcısının kapsam dahilinde olup olmadığına karar verilmesi gerekebilir çünkü bazı kontroller sağlayıcı tarafından yürütülüyor olabilir. + +Oturum sonlandırma, yeniden kimlik doğrulamanın gerekli olmasını sağlamalı ve uygulama genelinde, birleşik oturum açma (varsa) ve tüm güvenen taraflar genelinde etkili olmalıdır. + +Durum bilgili oturum mekanizmaları için sonlandırma tipik olarak oturumu backend tarafında geçersiz kılmayı içerir. Kendinden içerikli token'lar durumunda ise, bu token'ları geçersiz kılmak veya engellemek için ek önlemler gerekir; aksi halde bunlar süresi dolana kadar geçerli kalabilir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **7.4.1** | Oturum sonlandırma tetiklendiğinde (örneğin, çıkış yapıldığında veya süre dolduğunda), uygulamanın oturumun daha fazla kullanılmasına izin vermediği doğrulanmalıdır. Referans token'lar veya durum bilgili oturumlar için bu, oturum verilerinin uygulama arka ucunda geçersiz kılınması anlamına gelir. Kapsamlı token kullanan uygulamaların; sonlandırılmış token listesi tutmak, kullanıcıya özel tarih ve saatten önce oluşturulan token'ları reddetmek veya kullanıcıya özel imzalama anahtarını yenilemek gibi bir çözüm uygulaması gerekir. | 1 | +| **7.4.2** | Bir kullanıcı hesabı devre dışı bırakıldığında veya silindiğinde (örneğin bir çalışanın şirketten ayrılması), uygulamanın tüm aktif oturumları sonlandırdığı doğrulanmalıdır. | 1 | +| **7.4.3** | Herhangi bir kimlik doğrulama faktörünün başarılı bir şekilde değiştirilmesi veya kaldırılmasından (şifre sıfırlama veya kurtarma yoluyla yapılan değişiklikler dahil ve varsa MFA ayarları güncellemeleri dahil) sonra, uygulamanın diğer tüm aktif oturumları sonlandırma seçeneği sunduğu doğrulanmalıdır. | 2 | +| **7.4.4** | Kimlik doğrulama gerektiren tüm sayfalarda kolay erişilebilir ve görünür bir çıkış yap (logout) işlevi bulunduğu doğrulanmalıdır. | 2 | +| **7.4.5** | Uygulama yöneticilerinin, bireysel bir kullanıcının veya tüm kullanıcıların aktif oturumlarını sonlandırabilme yetkisine sahip olduğu doğrulanmalıdır. | 2 | + +## V7.5 Oturum Kötüye Kullanımına Karşı Savunmalar + +Bu bölüm, aktif oturumların ele geçirilmesi veya kötüye kullanılması riskini azaltmaya yönelik gereksinimleri içerir. Bu riskler, örneğin kimliği doğrulanmış bir kurbanın internet tarayıcısının, kurbanın oturumunu kullanarak bir eylemi gerçekleştirmeye zorlanması gibi vektörler aracılığıyla ortaya çıkabilir. + +Bu bölümdeki gereksinimler değerlendirilirken "Kimlik Doğrulama" bölümündeki seviyeye özel yönergeler dikkate alınmalıdır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **7.5.1** | E-posta adresi, telefon numarası, MFA yapılandırması veya hesap kurtarmada kullanılan diğer bilgiler gibi kimlik doğrulamayı etkileyebilecek hassas hesap özniteliklerinde değişiklik yapılmadan önce uygulamanın tam yeniden kimlik doğrulama gerektirdiği doğrulanmalıdır. | 2 | +| **7.5.2** | Kullanıcıların, (en az bir faktörle yeniden kimlik doğrulama yaptıktan sonra) mevcut tüm aktif oturumları görüntüleyebilmesi ve sonlandırabilmesinin mümkün olduğu doğrulanmalıdır. | 2 | +| **7.5.3** | Uygulamanın, son derece hassas işlemler veya operasyonlar gerçekleştirilmeden önce en az bir faktörle ek kimlik doğrulaması veya ikincil bir doğrulama gerektirdiği doğrulanmalıdır. | 3 | + +## V7.6 Birleşik Yeniden Kimlik Doğrulama + +Bu bölüm, Güvenen Taraf (Relying Party – RP) veya Kimlik Sağlayıcı (Identity Provider – IdP) kodu yazanlar için geçerlidir. Bu gereksinimler [NIST SP 800-63C Federation & Assertions](https://pages.nist.gov/800-63-4/sp800-63c.html) (Federasyon ve Beyanlar) rehberinden türetilmiştir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **7.6.1** | Güvenen Taraf (RP) ile Kimlik Sağlayıcı (IdP) arasındaki oturum süresi ve oturum sonlandırma davranışlarının belgelenmiş olduğu ve, örneğin IdP kimlik doğrulama olayları arasında maksimum süreye ulaşıldığında yeniden kimlik doğrulamanın gerekli kılındığı doğrulanmalıdır. | 2 | +| **7.6.2** | Yeni bir oturum oluşturulmasının, kullanıcı onayı veya açık bir eylem gerektirdiği; kullanıcı etkileşimi olmaksızın yeni uygulama oturumlarının oluşturulmasının önlendiği doğrulanmalıdır. | 2 | + +## Referanslar + +Daha fazla bilgi için: + +* [OWASP Web Security Testing Guide: Session Management Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/06-Session_Management_Testing) +* [OWASP Session Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html) diff --git a/5.0/tr/0x17-V8-Authorization.md b/5.0/tr/0x17-V8-Authorization.md new file mode 100644 index 0000000000..fe8b46df88 --- /dev/null +++ b/5.0/tr/0x17-V8-Authorization.md @@ -0,0 +1,56 @@ +# V8 Yetkilendirme + +## Kontrol Amacı + +Yetkilendirme, yalnızca izin verilen tüketicilere (kullanıcılar, sunucular ve diğer istemciler) erişim verilmesini sağlar. En Az Ayrıcalık İlkesi'ni (Principle of Least Privilege - POLP) uygulamak için doğrulanmış uygulamalar aşağıdaki üst düzey gereksinimleri karşılamalıdır: + +* Yetkilendirme kurallarını, karar alma faktörlerini ve çevresel bağlamları içerecek şekilde belgelendirin. +* Tüketiciler, yalnızca tanımlanmış haklarında izin verilen kaynaklara erişebilmelidir. + +## V8.1 Yetkilendirme Dokümantasyonu + +Kapsamlı yetkilendirme dokümantasyonu, güvenlik kararlarının tutarlı biçimde uygulanmasını, denetlenebilir olmasını ve kurumsal politikalarla uyumlu olmasını sağlamak açısından kritik öneme sahiptir. Bu, geliştiriciler, yöneticiler ve test uzmanları için güvenlik gereksinimlerini açık ve uygulanabilir hâle getirerek yetkisiz erişim riskini azaltır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **8.1.1** | Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak işlev düzeyinde ve veriye özel erişim kısıtlamaları için kuralları tanımladığı doğrulanmalıdır. | 1 | +| **8.1.2** | Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak alan (field) düzeyinde erişim kısıtlamaları (hem okuma hem yazma) için kuralları tanımladığı doğrulanmalıdır. Bu kuralların, ilgili veri nesnesinin durum veya statü gibi diğer özniteliklerine bağlı olabileceği unutulmamalıdır. | 2 | +| **8.1.3** | Uygulamanın dokümantasyonunun, kimlik doğrulama ve yetkilendirme ile ilgili güvenlik kararlarının alınmasında kullanılan çevresel ve bağlamsal öznitelikleri (günün saati, kullanıcı konumu, IP adresi veya cihaz gibi) tanımladığı doğrulanmalıdır. | 3 | +| **8.1.4** | Kimlik doğrulama ve yetkilendirme dokümantasyonunun; işlev düzeyinde, veriye özel ve alan düzeyinde yetkilendirmenin yanı sıra çevresel ve bağlamsal faktörlerin karar almada nasıl kullanıldığını tanımladığı doğrulanmalıdır. Bu, değerlendirilen öznitelikleri, risk eşiklerini ve alınan aksiyonları (ör. izin ver, doğrulama iste, reddet, step-up kimlik doğrulama) içermelidir. | 3 | + +## V8.2 Genel Yetkilendirme Tasarımı + +İşlev, veri ve alan düzeyinde ayrıntılı yetkilendirme kontrollerinin uygulanması, tüketicilerin yalnızca kendilerine açıkça verilmiş izinlere sahip kaynaklara erişebilmesini sağlar. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **8.2.1** | Uygulamanın, işlev düzeyindeki erişimin yalnızca açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. | 1 | +| **8.2.2** | Uygulamanın, veriye özel erişimin yalnızca belirli veri öğelerine açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, doğrudan nesne referansı güvenlik açıkları (IDOR) ve bozuk nesne düzeyinde yetkilendirme (BOLA) risklerini azaltır. | 1 | +| **8.2.3** | Uygulamanın, alan (field) düzeyindeki erişimin yalnızca belirli alanlara açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, bozuk nesne özelliği düzeyinde yetkilendirme (BOPLA) risklerini azaltır. | 2 | +| **8.2.4** | Tüketicinin çevresel ve bağlamsal özniteliklerine (ör. günün saati, konum, IP adresi veya cihaz) dayalı uyarlanabilir güvenlik kontrollerinin, uygulama dokümantasyonunda tanımlandığı şekilde, kimlik doğrulama ve yetkilendirme kararları için uygulandığı doğrulanmalıdır. Bu kontroller, tüketici yeni bir oturum başlatmaya çalışırken ve mevcut bir oturum sırasında uygulanmalıdır. | 3 | + +## V8.3 İşlem Düzeyinde Yetkilendirme + +Yetkilendirme değişikliklerinin uygulamanın mimarisindeki uygun katmana anında yansıtılması, özellikle dinamik ortamlarda yetkisiz işlemleri önlemek açısından kritik öneme sahiptir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **8.3.1** | Uygulamanın yetkilendirme kurallarını güvenilir bir servis katmanında uyguladığı ve istemci taraflı JavaScript gibi güvenilmeyen tüketiciler tarafından değiştirilebilecek kontrollerle yetinmediği doğrulanmalıdır. | 1 | +| **8.3.2** | Yetkilendirme kararlarının temelini oluşturan değerlerdeki değişikliklerin hemen uygulandığı doğrulanmalıdır. Değişikliklerin anında uygulanamadığı durumlarda (örneğin self-contained token içindeki verilere güveniliyorsa), tüketici artık yetkili olmadığı hâlde bir işlem gerçekleştirdiğinde uyarı verecek ve değişikliği geri alacak önlemler uygulanmalıdır. Bu alternatifin bilgi sızıntısını önlemeyeceği unutulmamalıdır. | 3 | +| **8.3.3** | Bir nesneye erişimin, herhangi bir aracı veya onun adına hareket eden bir servis yerine yalnızca erişimi başlatan öznenin (ör. tüketici) izinlerine dayandığı doğrulanmalıdır. Örneğin, bir tüketici kimlik doğrulama için bir self-contained token kullanarak bir web servis çağırırsa ve bu servis başka bir servisten veri talep ederse, ikinci servis izin kararlarını verirken birinci servisin makine-makine token'ı yerine tüketicinin token'ını kullanmalıdır. | 3 | + +## V8.4 Diğer Yetkilendirme Hususları + +Yetkilendirme ile ilgili ek hususlar, özellikle yönetici arayüzleri ve çok kiracılı (multi-tenant) ortamlar için, yetkisiz erişimi önlemeye yardımcı olur. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **8.4.1** | Multi-tenant uygulamaların, tüketici işlemlerinin izinli olmadıkları tenant'lar üzerinde asla etkili olmamasını sağlamak için tenant'lar arası kontroller kullandığı doğrulanmalıdır. | 2 | +| **8.4.2** | Yönetici arayüzlerine erişimin, sürekli tüketici kimlik doğrulaması, cihaz güvenlik durumu değerlendirmesi ve bağlamsal risk analizi dahil olmak üzere çok katmanlı güvenlik içerdiği doğrulanmalıdır. Yetkilendirme için yalnızca ağ konumu veya güvenilir uç noktalar yeterli olmamalıdır; ancak bu tür faktörler yetkisiz erişim olasılığını azaltabilir. | 3 | + +## Referanslar + +Daha fazla bilgi için: + +* [OWASP Web Security Testing Guide: Authorization](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/05-Authorization_Testing) +* [OWASP Authorization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html) diff --git a/5.0/tr/0x18-V9-Self-contained-Tokens.md b/5.0/tr/0x18-V9-Self-contained-Tokens.md new file mode 100644 index 0000000000..2754157502 --- /dev/null +++ b/5.0/tr/0x18-V9-Self-contained-Tokens.md @@ -0,0 +1,36 @@ +# V9 Kendi İçinde Taşıyıcı Token (Self-contained Token) + +## Kontrol Amacı + +Kendi içinde taşıyıcı token ya da self-contained token kavramı, ilk olarak 2012 tarihli RFC 6749 OAuth 2.0 standardında belirtilmiştir. Bu kavram, içeriğinde bir hizmetin güvenlik kararlarını almak için kullanacağı veri veya iddiaları (claim) taşıyan bir token'ı ifade eder. Bu, yalnızca bir tanımlayıcı içeren ve hizmetin veriyi yerel olarak aramasına yarayan basit token'lardan ayrıdır. Self-contained token'lara en yaygın örnekler JSON Web Tokens (JWT) ve SAML assertion'lardır. + +Self-contained token kullanımı, OAuth ve OIDC dışında bile oldukça yaygın hale gelmiştir. Aynı zamanda bu mekanizmanın güvenliği, token'ın bütünlüğünün doğrulanabilmesine ve belirli bir bağlam için geçerli olduğunun teyit edilmesine bağlıdır. Bu süreçte birçok güvenlik açığı ortaya çıkabilir ve bu bölüm, uygulamaların alması gereken önlemleri ayrıntılı şekilde açıklamaktadır. + +## V9.1 Token Kaynağı ve Bütünlüğü + +Bu bölüm, token'ın güvenilir bir tarafça üretildiğini ve üzerinde oynama yapılmadığını sağlamak için gereken gereksinimleri içerir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **9.1.1** | Self-contained token'ların içerikleri kabul edilmeden önce, oynama (tampering) saldırılarına karşı dijital imza veya MAC ile doğrulama yapıldığı doğrulanmalıdır. | 1 | +| **9.1.2** | Belirli bir bağlam için yalnızca bir allowlist üzerinde bulunan algoritmaların self-contained token oluşturmak ve doğrulamak için kullanılabildiği doğrulanmalıdır. Bu allowlist, yalnızca simetrik ya da yalnızca asimetrik algoritmaları içermeli ve kesinlikle 'None' algoritmasını içermemelidir. Hem simetrik hem de asimetrik algoritmalar desteklenmek zorundaysa, anahtar karışıklığını (key confusion) önlemek için ek kontroller uygulanmalıdır. | 1 | +| **9.1.3** | Self-contained token'ları doğrulamak için kullanılan anahtar malzemesinin, token issuer için önceden yapılandırılmış güvenilir kaynaklardan alındığı doğrulanmalıdır. Bu, saldırganların güvenilmeyen kaynak ve anahtarları belirtmesini engeller. JWT ve diğer JWS yapılarında 'jku', 'x5u' ve 'jwk' gibi header'lar güvenilir kaynaklardan oluşan bir allowlist'e göre doğrulanmalıdır. | 1 | + +## V9.2 Token İçeriği + +Bir self-contained token içeriğine dayanarak güvenlik kararı alınmadan önce, token'ın geçerlilik süresi içinde sunulup sunulmadığı ve belirli bir hizmet tarafından belirli bir amaç için kullanıma uygun olup olmadığı doğrulanmalıdır. Bu, aynı issuer'dan gelen farklı token türlerinin farklı hizmetler arasında güvensiz şekilde yeniden kullanılmasını önlemeye yardımcı olur. + +OAuth ve OIDC'ye özgü gereksinimler ilgili bölümde yer almaktadır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **9.2.1** | Token verisinde bir geçerlilik zaman aralığı (validity time span) varsa, yalnızca doğrulama zamanı bu zaman aralığı içerisindeyse token ve içeriği kabul edilmelidir. Örneğin, JWT'ler için 'nbf' ve 'exp' claim'leri doğrulanmalıdır. | 1 | +| **9.2.2** | Token'ı alan hizmetin, token içeriğini kabul etmeden önce bu token'ın doğru türde olduğunu ve sunulma amacına uygun olduğunu doğruladığı teyit edilmelidir. Örneğin, yalnızca erişim token'ları yetkilendirme kararları için, yalnızca ID Token'lar kullanıcı kimlik doğrulamasını kanıtlamak için kullanılabilir. | 2 | +| **9.2.3** | Hizmetin yalnızca kendisiyle kullanılması amaçlanan (audience) token'ları kabul ettiği doğrulanmalıdır. JWT'lerde bu, 'aud' claim'inin hizmet içinde tanımlı bir allowlist ile doğrulanması yoluyla sağlanabilir. | 2 | +| **9.2.4** | Eğer bir token issuer, farklı audience'lara token oluşturmak için aynı private key'i kullanıyorsa, oluşturulan token'ların hedef audience'ları benzersiz şekilde tanımlayan bir audience kısıtlaması içerdiği doğrulanmalıdır. Bu, bir token'ın farklı bir audience ile yeniden kullanılmasını önler. Audience tanımlayıcısı dinamik olarak sağlanıyorsa, token issuer bu audience'ları doğrulamalı ve audience taklitlerinin (impersonation) önüne geçmelidir. | 2 | + +## Referanslar + +Daha fazla bilgi için: + +* [OWASP JSON Web Token Cheat Sheet for Java Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_for_Java_Cheat_Sheet.html) (genel olarak yönlendirme için kullanışlı) diff --git a/5.0/tr/0x19-V10-OAuth-and-OIDC.md b/5.0/tr/0x19-V10-OAuth-and-OIDC.md new file mode 100644 index 0000000000..4da598de62 --- /dev/null +++ b/5.0/tr/0x19-V10-OAuth-and-OIDC.md @@ -0,0 +1,169 @@ +# V10 OAuth ve OIDC + +## Kontrol Amacı + +OAuth2 (bu bölümde kısaca OAuth olarak anılacaktır), yetki devri için endüstri standardı bir çerçevedir. Örneğin, OAuth kullanılarak bir istemci uygulama, kullanıcı tarafından yetkilendirildiği sürece, o kullanıcı adına API’lere (sunucu kaynaklarına) erişim sağlayabilir. + +OAuth tek başına kullanıcı kimlik doğrulaması amacıyla tasarlanmamıştır. OpenID Connect (OIDC) çerçevesi, OAuth üzerine bir kullanıcı kimliği katmanı ekleyerek bu eksikliği tamamlar. OIDC, standartlaştırılmış kullanıcı bilgileri, Single Sign-On (SSO) ve oturum yönetimi gibi özellikleri destekler. OIDC, OAuth'un bir uzantısı olduğundan, bu bölümdeki OAuth gereksinimleri aynı zamanda OIDC için de geçerlidir. + +OAuth çerçevesinde aşağıdaki roller tanımlanır: + +* OAuth istemcisi, sunucu kaynaklarına erişim sağlamaya çalışan uygulamadır (örneğin, verilen access token’ı kullanarak bir API çağrısı yapar). Genellikle bu, sunucu taraflı bir uygulamadır. + * Gizli istemci (confidential client), authorization server ile kimlik doğrulama sırasında kullandığı kimlik bilgilerini gizli tutabilecek kapasitede olan istemcidir. + * Genel istemci (public client), authorization server ile kimlik doğrulama sırasında kullandığı kimlik bilgilerini gizli tutamayacak durumdadır. Bu nedenle kendini yalnızca bir client_id ile tanıtır, client_id ve client_secret gibi bilgilerle kimlik doğrulaması yapmaz. +* OAuth kaynak sunucusu (resource server – RS), OAuth istemcilerine kaynakları sunan API’dir. +* OAuth yetkilendirme sunucusu (authorization server – AS), access token üreten sunucu uygulamasıdır. Bu token’lar sayesinde OAuth istemcisi, son kullanıcı adına veya kendi adına RS üzerindeki kaynaklara erişim sağlayabilir. AS genellikle ayrı bir uygulama olsa da, uygun görüldüğünde RS ile entegre olabilir. +* Kaynak sahibi (resource owner – RO), OAuth istemcilerinin kendi adına, kaynak sunucusu üzerinde kısıtlı erişim elde etmesine izin veren son kullanıcıdır. Yetkilendirme sürecine AS üzerinden katılım sağlar. + +OIDC çerçevesinde aşağıdaki roller tanımlanır: + +* Güvenen taraf (relying party – RP), son kullanıcının kimlik doğrulamasını OpenID Provider üzerinden gerçekleştirmek isteyen istemci uygulamadır. Aynı zamanda bir OAuth istemcisidir. +* OpenID Provider (OP), son kullanıcıyı kimlik doğrulama yeteneğine sahip olan ve RP'ye OIDC claim’lerini sağlayan bir OAuth yetkilendirme sunucusudur. OP çoğu zaman bir kimlik sağlayıcı (IdP) olur; ancak federasyon senaryolarında OP ve gerçek kimlik sağlayıcı farklı uygulamalar olabilir. + +OAuth ve OIDC başlangıçta üçüncü taraf uygulamalar için tasarlanmıştı. Ancak günümüzde ilk taraf uygulamalar tarafından da yaygın şekilde kullanılmaktadır. Bu kullanım senaryolarında, özellikle kimlik doğrulama ve oturum yönetimi amacıyla kullanıldığında protokol belirli bir karmaşıklık ekler ve bu durum bazı yeni güvenlik riskleri yaratabilir. + +OAuth ve OIDC birçok farklı uygulama tipiyle kullanılabilir; ancak ASVS ve bu bölümdeki gereksinimler özellikle web uygulamaları ve API’ler için tasarlanmıştır. + +OAuth ve OIDC, web teknolojilerinin üzerine kurulu mantıksal protokoller olduklarından, bu bölümdeki gereksinimler diğer bölümlerden bağımsız değerlendirilemez; genel güvenlik gereksinimleri geçerliliğini korur. + +Bu bölüm, ve üzerindeki spesifikasyonlarla uyumlu şekilde OAuth2 ve OIDC için güncel en iyi uygulamaları ele alır. RFC’ler olgun belgeler olarak görülse de, sık sık güncellenmektedir. Bu nedenle uygulamada, ilgili gereksinimlerin en güncel versiyonlarla uyumlu şekilde ele alınması önemlidir. Ayrıntılar için bölümün referans kısmına bakınız. + +Bu alanın karmaşıklığı göz önünde bulundurulduğunda, güvenli bir OAuth veya OIDC çözümünün, tanınmış ve endüstri standardı yetkilendirme sunucularını kullanması ve önerilen güvenlik yapılandırmalarını uygulaması son derece önemlidir. + +Bu bölümde kullanılan terimler, OAuth ve OIDC spesifikasyonlarındaki tanımlarla uyumludur. Ancak OIDC’ye özel gereksinimler dışında, genellikle OAuth terminolojisi tercih edilmiştir. + +Bu bölümde geçen "token" terimi, aşağıdaki anlamlarda kullanılmıştır: + +* Access token'ları sadece RS tarafından kullanılır. Bunlar ya introspection ile doğrulanan bir reference token olabilir ya da belirli bir anahtar malzemesiyle doğrulanan bir self-contained token olabilir. +* Refresh token'ları, yalnızca onu üreten authorization server tarafından kullanılabilir. +* OIDC ID Token'ları sadece authorization flow’u tetikleyen istemci tarafından kullanılabilir. + +Bu bölümdeki bazı gereksinimlerin risk seviyesi, istemcinin gizli istemci mi yoksa açık istemci mi olduğuna göre değişiklik gösterebilir. Güçlü istemci kimlik doğrulaması, birçok saldırı vektörünü etkisiz hale getirebildiği için, L1 uygulamalarında bazı gereksinimler gizli istemci kullanıldığında esnetilebilir. + +## V10.1 Genel OAuth ve OIDC Güvenliği + +Bu bölüm, OAuth veya OIDC kullanan tüm uygulamalara uygulanabilen genel mimari gereksinimleri kapsar. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **10.1.1** | Token'ların yalnızca kesinlikle ihtiyaç duyan bileşenlere gönderildiği doğrulanmalıdır. Örneğin, tarayıcı tabanlı JavaScript uygulamaları için bir backend-for-frontend modeli kullanıldığında, access ve refresh token'lara yalnızca backend'in erişebilmesi gerekir. | 2 | +| **10.1.2** | Authorization server'dan gelen değerler (örneğin authorization code veya ID Token gibi) yalnızca aynı user agent oturumu ve işlemi tarafından başlatılmış bir yetkilendirme akışının sonucuysa kabul edildiği doğrulanmalıdır. Bu, client tarafından oluşturulan secret’ların 'proof key for code exchange' (PKCE) ‘code_verifier’, ‘state’ veya OIDC ‘nonce’ gibi tahmin edilemez, işleme özgü ve hem client’a hem de işlem başlatılan user agent oturumuna güvenli bir şekilde bağlı olmasını gerektirir. | 2 | + +## V10.2 OAuth İstemcisi + +Bu gereksinimler, OAuth istemci uygulamaları için sorumlulukları detaylandırır. Client örneğin bir web sunucusu backend’i (genellikle Backend For Frontend olarak hareket eden), bir backend servis entegrasyonu veya bir frontend Single Page Application (SPA, yani tarayıcı tabanlı uygulama) olabilir. + +Genel olarak backend istemciler gizli istemci olarak, frontend istemciler ise açık istemci olarak değerlendirilir. Ancak, son kullanıcı cihazında çalışan native uygulamalar, 'OAuth dynamic client registration' kullanıldığında gizli olarak kabul edilebilir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **10.2.1** | Code flow kullanılıyorsa, OAuth client’ın token taleplerini tetikleyen CSRF saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Bu genellikle PKCE kullanılarak veya authorization isteğinde gönderilen ‘state’ parametresinin kontrolü ile sağlanır. | 2 | +| **10.2.2** | OAuth istemcisi birden fazla AS ile etkileşime girebiliyorsa, mix-up saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Örneğin, authorization server’ın 'iss' parametresini döndürmesi zorunlu kılınabilir ve bu parametrenin hem authorization yanıtında hem de token yanıtında doğrulanması gerekir. | 2 | +| **10.2.3** | OAuth istemcisinin authorization server’a yaptığı taleplerde yalnızca gerekli scope’ları (veya diğer yetkilendirme parametrelerini) talep ettiği doğrulanmalıdır. | 3 | + +## V10.3 OAuth Kaynak Sunucusu (RS) + +ASVS ve bu bölüm bağlamında resource server (RS) bir API’dir. Güvenli erişim sağlamak için RS şunları yapmalıdır: + +* Access token’ı, token formatı ve ilgili protokol spesifikasyonlarına göre doğrulamalıdır; örneğin JWT doğrulaması veya OAuth token introspection. +* Geçerliyse, access token’dan alınan bilgiler ve verilmiş izinlere göre yetkilendirme kararları uygulamalıdır. Örneğin, resource server’ın client’ın (RO adına hareket eden) istenen kaynağa erişme yetkisine sahip olduğunu doğrulaması gerekir. + +Bu nedenle burada listelenen gereksinimler, OAuth veya OIDC’ye özeldir ve token doğrulaması yapıldıktan sonra, token içeriğine dayalı yetkilendirme gerçekleştirilmeden önce uygulanmalıdır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **10.3.1** | RS'nin yalnızca bu servisle kullanılmak üzere tasarlanmış access token’ları kabul ettiği doğrulanmalıdır (audience kontrolü). Audience bilgisi yapılandırılmış token’larda (örneğin JWT içindeki ‘aud’ claim’i) yer alabilir veya token introspection endpoint aracılığıyla kontrol edilebilir. | 2 | +| **10.3.2** | RS'nin, access token’dan gelen claim’lere dayanarak yetki devri tanımına uygun şekilde yetkilendirme kararları uyguladığı doğrulanmalıdır. ‘sub’, ‘scope’ ve ‘authorization_details’ gibi claim’ler varsa, bu kararın parçası olmalıdır. | 2 | +| **10.3.3** | Erişim kontrolü kararında, access token’dan (JWT veya ilgili token introspection yanıtı) benzersiz bir kullanıcının tanımlanması gerekiyorsa, RS'nin başka kullanıcılara devredilemeyecek claim’ler ile kullanıcıyı tanımladığı doğrulanmalıdır. Genellikle bu, ‘iss’ ve ‘sub’ claim’lerinin birlikte kullanılması anlamına gelir. | 2 | +| **10.3.4** | RS'nin belirli bir kimlik doğrulama gücü, yöntemi veya güncelliği (recentness) gerektirmesi durumunda, sunulan access token’ın bu kısıtlamaları karşıladığını doğruladığı, örneğin, OIDC ‘acr’, ‘amr’ ve ‘auth_time’ claim’leri kullanılarak doğrulanmalıdır. | 2 | +| **10.3.5** | RS'nin, (yetkisiz taraflarca) çalınmış veya tekrar edilen access token’ların kullanımını önlemek için sender-constrained access token’lar kullandığı doğrulanmalıdır. Bu, OAuth 2 için Mutual TLS veya OAuth 2 Demonstration of Proof of Possession (DPoP) ile sağlanabilir. | 3 | + +## V10.4 OAuth Yetkilendirme Sunucusu (AS) + +Bu gereksinimler, OAuth authorization server'ların (yetkilendirme sunucuları) ve OpenID Provider'ların sorumluluklarını detaylandırır. + +İstemci kimlik doğrulaması için 'self_signed_tls_client_auth' yöntemi, [RFC 8705](https://datatracker.ietf.org/doc/html/rfc8705) [böüm 2.2'de](https://datatracker.ietf.org/doc/html/rfc8705#name-self-signed-certificate-mut) belirtilen ön koşullarla birlikte kullanılabilir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **10.4.1** | AS'nin, istemciye özel önceden kaydedilmiş URI’lerden oluşan bir allowlist kullanarak redirect URI’leri tam dize karşılaştırması ile doğruladığı doğrulanmalıdır. | 1 | +| **10.4.2** | AS'nin, "authorization response" içinde "authorization code" döndürdüğü durumlarda, bu kodun yalnızca bir kez kullanılabildiği doğrulanmalıdır. Daha önce access token vermek için kullanılmış bir authorization code ile yapılan ikinci geçerli token isteği reddedilmeli ve ilgili tüm token’lar iptal edilmelidir. | 1 | +| **10.4.3** | Authorization code’un kısa ömürlü olduğu doğrulanmalıdır. L1 ve L2 uygulamalar için maksimum yaşam süresi 10 dakika, L3 uygulamalar için 1 dakikadır. | 1 | +| **10.4.4** | Belirli bir istemci için AS'nin yalnızca o istemcinin ihtiyaç duyduğu grant türlerine izin verdiği doğrulanmalıdır. "Token" (Implicit flow) ve "password" (Resource Owner Password Credentials flow) grant türlerinin artık kullanılmaması gerekir. | 1 | +| **10.4.5** | AS'nin, açık istemciler için refresh token replay saldırılarını azalttığı doğrulanmalıdır. Tercihen sender-constrained refresh token’lar (DPoP veya mutual TLS ile certificate-bound access token’lar) kullanılmalıdır. L1 ve L2 uygulamalar için refresh token rotation kullanılabilir. Rotation kullanılıyorsa, AS refresh token’ı kullanım sonrası geçersiz kılmalı ve geçersiz bir refresh token sunulması durumunda o yetkilendirme ile ilişkili tüm refresh token’ları iptal etmelidir. | 1 | +| **10.4.6** | Code grant kullanılıyorsa, AS'nin authorization code interception saldırılarına karşı koruma sağladığı doğrulanmalıdır. Yetkilendirme isteğinde geçerli bir "code_challenge" değeri zorunlu olmalı ve "code_challenge_method" olarak "plain" kabul edilmemelidir. Token isteğinde ise "code_verifier" parametresi doğrulanmalıdır. | 2 | +| **10.4.7** | AS'nin, kimlik doğrulaması yapılmamış dinamik istemci kaydını desteklemesi durumunda, kötü niyetli istemci uygulamalarına karşı riskleri azalttığı doğrulanmalıdır. Kayıtlı URI’ler gibi client metadata’sı doğrulanmalı, kullanıcı onayı alınmalı ve güvenilmeyen bir client uygulamasıyla yapılan yetkilendirme isteği işlenmeden önce kullanıcı uyarılmalıdır. | 2 | +| **10.4.8** | Refresh token’ların, sliding expiration kullanılsa bile mutlak bir sona erme süresine sahip olduğu doğrulanmalıdır. | 2 | +| **10.4.9** | Yetkili bir kullanıcı tarafından AS kullanıcı arayüzü üzerinden refresh token’ların ve reference access token’ların iptal edilebildiği doğrulanmalıdır. | 2 | +| **10.4.10** | Gizli istemcilerin token istekleri, pushed authorization request (PAR) ve token iptal istekleri gibi server’a yapılan backchannel isteklerinde kimliğinin kontrol edildiği doğrulanmalıdır. | 2 | +| **10.4.11** | AS yapılandırmasının, OAuth istemcisine yalnızca gerekli scope’ları atadığı doğrulanmalıdır. | 2 | +| **10.4.12** | Belirli bir client için, authorization server’ın yalnızca client’ın ihtiyaç duyduğu 'response_mode' değerine izin verdiği doğrulanmalıdır. Örneğin, bu değer ya beklenenlerle karşılaştırılarak doğrulanmalı ya da PAR veya JAR kullanılmalıdır. | 3 | +| **10.4.13** | "Code" grant türünün daima pushed authorization request (PAR) ile birlikte kullanıldığı doğrulanmalıdır. | 3 | +| **10.4.14** | AS'nin yalnızca sender-constrained (Proof-of-Possession) access token’lar ürettiği doğrulanmalıdır. Bu, mutual TLS ile certificate-bound access token ya da DPoP ile DPoP-bound access token olabilir. | 3 | +| **10.4.15** | Sunucu taraflı istemciler için (kullanıcı cihazında çalışmayan), AS'nin "authorization_details" parametresinin istemci backend'i tarafından sağlandığını ve kullanıcı tarafından değiştirilmediğini doğruladığı, örneğin pushed authorization request (PAR) or JWT-secured Authorization Request (JAR) zorunlu kılınarak doğrulanmalıdır. | 3 | +| **10.4.16** | Bir istemci gizli ise, AS'nin güçlü istemci kimlik doğrulama yöntemlerini zorunlu kıldığı doğrulanmalıdır. Bu yöntemler, public-key cryptography’ye dayalı ve replay saldırılarına karşı dayanıklı olmalı, örneğin mutual TLS ("tls_client_auth", "self_signed_tls_client_auth") veya private key JWT ("private_key_jwt") gibi. | 3 | + +## V10.5 OIDC İstemcisi + +"OIDC relying party", bir OAuth istemcisi olarak davrandığı için "OAuth İstemcisi" bölümündeki gereksinimler burada da geçerlidir. + +“Kimlik Doğrulama” başlığındaki “Kimlik Sağlayıcısı ile Kimlik Doğrulama” bölümü de ilgili genel gereksinimleri içerir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **10.5.1** | İstemcinin (relying party olarak) ID Token replay saldırılarını azalttığı doğrulanmalıdır. Örneğin, ID Token’daki 'nonce' claim’inin, OpenID Provider’a gönderilen kimlik doğrulama isteğindeki 'nonce' değeriyle eşleştiği doğrulanmalıdır. | 2 | +| **10.5.2** | İstemcinin kullanıcıyı ID Token claim’lerinden (genellikle, başka kullanıcılarla yeniden atanamayan 'sub' claim’i) benzersiz şekilde tanımladığı doğrulanmalıdır. | 2 | +| **10.5.3** | İstemcinin, kötü niyetli bir AS'nin başka bir AS'yi taklit etmesini AS metadata’sı üzerinden reddettiği doğrulanmalıdır. AS metadata’sındaki issuer URL’si, istemci tarafından beklenen önceden yapılandırılmış issuer URL’siyle tam olarak eşleşmiyorsa, metadata reddedilmelidir. | 2 | +| **10.5.4** | İstemcinin, ID Token’ın kendisi için (audience) kullanılması amaçlandığını doğruladığı doğrulanmalıdır. Bu, token’daki 'aud' claim’inin istemcinin 'client_id' değeriyle eşit olup olmadığının kontrol edilmesiyle yapılır. | 2 | +| **10.5.5** | OIDC back-channel logout kullanıldığında, relying party’nin "forced logout" ve "logout" akışında "cross-JWT confusion" gibi saldırılara karşı koruma sağladığı doğrulanmalıdır. Client, logout token’ın 'logout+jwt' türünde olduğunu, 'event' claim’inin doğru üyeye sahip olduğunu ve 'nonce' claim’i içermediğini doğrulamalıdır. Ayrıca token için kısa bir sona erme süresi (örneğin 2 dakika) önerilir. | 2 | + +## V10.6 OpenID Provider + +OpenID Provider’lar, OAuth AS olarak davrandığı için “OAuth Yetkilendirme Sunucusu” bölümündeki gereksinimler burada da geçerlidir. + +ID Token flow (code flow değil) kullanılıyorsa, access token üretilmez ve OAuth AS için geçerli olan birçok gereksinim uygulanamaz. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **10.6.1** | OpenID Provider’ın yalnızca 'code', 'ciba', 'id_token' veya 'id_token code' response mode değerlerine izin verdiği doğrulanmalıdır. 'code' değeri, 'id_token code' (OIDC Hybrid flow) yerine tercih edilmelidir. 'token' (Implicit flow) kullanılmamalıdır. | 2 | +| **10.6.2** | OpenID Provider’ın forced logout yoluyla yapılan hizmet reddi saldırılarını önlediği doğrulanmalıdır. Bu, son kullanıcıdan açık onay alınarak veya varsa logout isteğinde (relying party tarafından başlatılan) bulunan parametrelerin, örneğin 'id_token_hint', doğrulanmasıyla yapılabilir. | 2 | + +## V10.7 Onay (Consent) Yönetimi + +Bu gereksinimler, kullanıcı onayının AS tarafından doğrulanmasını kapsar. Uygun kullanıcı onayı olmadan, kötü niyetli bir aktör spoofing veya sosyal mühendislik yoluyla kullanıcının adına yetki elde edebilir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **10.7.1** | AS'nin her yetkilendirme isteği için kullanıcının onayını aldığı doğrulanmalıdır. İstemcinin kimliği garanti altına alınamıyorsa, AS daima kullanıcıdan açıkça onay istemelidir. | 2 | +| **10.7.2** | AS'nin kullanıcıdan onay istediğinde, neye onay verildiğini açık ve yeterli şekilde gösterdiği doğrulanmalıdır. Uygun olduğunda bu bilgiler, istenen yetkilendirmelerin doğasını (genellikle scope, resource server, RAR gibi detaylara dayalı), yetkilendirilmiş uygulamanın kimliğini ve bu yetkilendirmelerin süresini içermelidir. | 2 | +| **10.7.3** | Kullanıcının, AS üzerinden verdiği onayları görüntüleyebildiği, değiştirebildiği ve iptal edebildiği doğrulanmalıdır. | 2 | + +## Referanslar + +OAuth ile ilgili daha fazla bilgi için: + +* [oauth.net](https://oauth.net/) +* [OWASP OAuth 2.0 Protocol Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/OAuth2_Cheat_Sheet.html) + +ASVS içindeki OAuth ile ilgili gereksinimler için, yayımlanmış ve taslak durumundaki aşağıdaki RFC'ler kullanılmaktadır: + +* [RFC6749 The OAuth 2.0 Authorization Framework](https://datatracker.ietf.org/doc/html/rfc6749) +* [RFC6750 The OAuth 2.0 Authorization Framework: Bearer Token Usage](https://datatracker.ietf.org/doc/html/rfc6750) +* [RFC6819 OAuth 2.0 Threat Model and Security Considerations](https://datatracker.ietf.org/doc/html/rfc6819) +* [RFC7636 Proof Key for Code Exchange by OAuth Public Clients](https://datatracker.ietf.org/doc/html/rfc7636) +* [RFC7591 OAuth 2.0 Dynamic Client Registration Protocol](https://datatracker.ietf.org/doc/html/rfc7591) +* [RFC8628 OAuth 2.0 Device Authorization Grant](https://datatracker.ietf.org/doc/html/rfc8628) +* [RFC8707 Resource Indicators for OAuth 2.0](https://datatracker.ietf.org/doc/html/rfc8707) +* [RFC9068 JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens](https://datatracker.ietf.org/doc/html/rfc9068) +* [RFC9126 OAuth 2.0 Pushed Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9126) +* [RFC9207 OAuth 2.0 Authorization Server Issuer Identification](https://datatracker.ietf.org/doc/html/rfc9207) +* [RFC9396 OAuth 2.0 Rich Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9396) +* [RFC9449 OAuth 2.0 Demonstrating Proof of Possession (DPoP)](https://datatracker.ietf.org/doc/html/rfc9449) +* [RFC9700 Best Current Practice for OAuth 2.0 Security](https://datatracker.ietf.org/doc/html/rfc9700) +* [draft OAuth 2.0 for Browser-Based Applications](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-browser-based-apps) +* [draft The OAuth 2.1 Authorization Framework](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-12) + +OpenID Connect ile ilgili daha fazla bilgi için: + +* [OpenID Connect Core 1.0](https://openid.net/specs/openid-connect-core-1_0.html) +* [FAPI 2.0 Security Profile](https://openid.net/specs/fapi-security-profile-2_0-final.html) diff --git a/5.0/tr/0x20-V11-Cryptography.md b/5.0/tr/0x20-V11-Cryptography.md new file mode 100644 index 0000000000..df3e8138fa --- /dev/null +++ b/5.0/tr/0x20-V11-Cryptography.md @@ -0,0 +1,107 @@ +# V11 Kriptografi + +## Kontrol Amacı + +Bu bölümün amacı, kriptografinin genel kullanımı için en iyi uygulamaları tanımlamak, kriptografik ilkelere dair temel bir anlayış kazandırmak ve daha dayanıklı ve modern yaklaşımlara yönelimi teşvik etmektir. Bu doğrultuda aşağıdakileri teşvik eder: + +* Güvenli şekilde hata veren, gelişen tehditlere uyum sağlayan ve geleceğe yönelik sağlam kriptografik sistemlerin uygulanması, +* Hem güvenli hem de sektörün en iyi uygulamalarıyla uyumlu kriptografik mekanizmaların kullanılması, +* Uygun erişim kontrolleri ve denetimle birlikte güvenli bir kriptografik anahtar yönetim sisteminin sürdürülmesi, +* Kriptografik ortamın düzenli olarak değerlendirilerek yeni risklerin analiz edilmesi ve algoritmaların buna göre uyarlanması, +* Uygulamanın yaşam döngüsü boyunca tüm kriptografik varlıkların keşfedildiğinden ve güvence altına alındığından emin olmak için kriptografi kullanım alanlarının belirlenmesi ve yönetilmesi. + +Genel ilkeleri ve en iyi uygulamaları özetlemenin yanı sıra, bu belge Ek C - Kriptografi Standartları bölümünde gereksinimlerle ilgili daha teknik bilgiler de sunar. Bu bölüm, "onaylı" kabul edilen algoritmaları ve modları içerir. + +Kriptografinin sır yönetimi ya da iletişim güvenliği gibi başka bir sorunu çözmek için kullanıldığı gereksinimler, bu standardın başka bölümlerinde yer almaktadır. + +## V11.1 Kriptografik Envanter ve Dokümantasyon + +Veri varlıklarını sınıflandırmalarına uygun şekilde korumak için uygulamaların güçlü bir kriptografik mimari ile tasarlanması gerekir. Her şeyi şifrelemek kaynak israfına, hiçbir şeyi şifrelememek ise hukuki ihlallere yol açar. Genellikle mimari tasarım, tasarım sprintleri veya mimari zirveler sırasında bir denge kurulmalıdır. Kriptografiyi "doğaçlama" yapmak veya sonradan eklemek, güvenli biçimde uygulamak için her zaman daha maliyetli olacaktır. + +Tüm kriptografik varlıkların düzenli olarak keşfedildiğinden, envantere alındığından ve değerlendirildiğinden emin olunması önemlidir. Bunun nasıl yapılacağı hakkında daha fazla bilgi için ekteki bölüme bakınız. + +Kriptografik sistemlerin kuantum bilgisayarların olası yükselişine karşı geleceğe yönelik olarak dayanıklı hale getirilmesi de kritik önemdedir. Post-Kuantum Kriptografi (PQC), kuantum bilgisayar saldırılarına karşı güvenli kalacak şekilde tasarlanmış kriptografik algoritmaları ifade eder; bu tür bilgisayarların, RSA ve eliptik eğri kriptografisi (ECC) gibi yaygın algoritmaları kırması beklenmektedir. + +Onaylı PQC ilkelikleri ve standartlarıyla ilgili güncel bilgiler için ekteki bölüme bakınız. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **11.1.1** | Kriptografik anahtarların yönetimi için belgelenmiş bir politika ve NIST SP 800-57 gibi bir anahtar yönetim standardını izleyen bir kriptografik anahtar yaşam döngüsü tanımlandığı doğrulanmalıdır. Bu, anahtarların aşırı miktarda paylaşılmadığını (örneğin, paylaşılan sırlar için ikiden fazla tarafla veya özel anahtarlar için birden fazla tarafla) garanti altına almalıdır. | 2 | +| **11.1.2** | Tüm kriptografik anahtarlar, algoritmalar ve uygulama tarafından kullanılan sertifikaları içeren bir kriptografik envanterin oluşturulduğu, sürdürüldüğü ve düzenli olarak güncellendiği doğrulanmalıdır. Bu envanter ayrıca, sistemde anahtarların nerede kullanılabileceğini ve kullanılamayacağını, ve hangi veri türlerinin bu anahtarlarla korunup korunamayacağını da belgelemelidir. | 2 | +| **11.1.3** | Sistem içerisinde şifreleme, özetleme ve imzalama işlemleri dahil olmak üzere kriptografi kullanımının tüm örneklerini tespit etmek için kriptografik keşif mekanizmalarının kullanıldığı doğrulanmalıdır. | 3 | +| **11.1.4** | Kriptografik bir envanterin sürdürüldüğü doğrulanmalıdır. Bu envanter, gelecekteki tehditlere karşı tepki verebilmek amacıyla post-kuantum kriptografiye geçiş yolunu belirten belgelenmiş bir plan içermelidir. | 3 | + +## V11.2 Güvenli Kriptografi Uygulaması + +Bu bölüm, bir uygulama için temel kriptografik algoritmaların seçimi, uygulanması ve sürekli yönetimine yönelik gereksinimleri tanımlar. Amaç, yalnızca sağlam, sektör tarafından kabul görmüş kriptografik ilkeliklerin, güncel standartlara (örneğin NIST, ISO/IEC) ve en iyi uygulamalara uygun biçimde kullanılmasını sağlamaktır. Kuruluşlar, her kriptografik bileşenin peer-review uygulanmış kanıtlar ve pratik güvenlik testlerine dayalı olarak seçildiğinden emin olmalıdır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **11.2.1** | Kriptografik işlemler için sektör tarafından doğrulanmış uygulamaların (kütüphaneler ve donanım hızlandırmalı uygulamalar dahil) kullanıldığı doğrulanmalıdır. | 2 | +| **11.2.2** | Uygulamanın, rastgele sayı üreticileri, kimliği doğrulanmış şifreleme, MAC veya özetleme algoritmaları, anahtar uzunlukları, turlar, şifreler ve modların herhangi bir zamanda yeniden yapılandırılabilir, yükseltilebilir veya değiştirilebilir olacağı şekilde kripto çevikliği (crypto agility) ile tasarlandığı doğrulanmalıdır. Aynı şekilde, anahtarların ve parolaların değiştirilebilmesi ve verilerin yeniden şifrelenebilmesi mümkün olmalıdır. Bu, onaylanmış PQC şemalarının yüksek güvenlikli uygulamaları yaygın olarak kullanılabilir hale geldiğinde sorunsuz geçişe olanak tanır. | 2 | +| **11.2.3** | Tüm kriptografik ilkeliklerin, algoritma, anahtar boyutu ve yapılandırmaya göre minimum 128 bit güvenlik sağladığı doğrulanmalıdır. Örneğin, 256-bit ECC anahtarı yaklaşık 128 bit güvenlik sağlarken, RSA için aynı güvenliği elde etmek 3072-bit anahtar gerektirir. | 2 | +| **11.2.4** | Tüm kriptografik işlemlerin sabit süreli (constant-time) olduğu, karşılaştırmalarda, hesaplamalarda veya geri dönüşlerde kısa devre (short-circuit) işlemleri yapılmadığı doğrulanmalıdır; bu, bilgi sızıntısını önlemek için gereklidir. | 3 | +| **11.2.5** | Tüm kriptografik modüllerin güvenli şekilde hata verdiği ve hataların, padding oracle saldırıları gibi zafiyetleri mümkün kılmayacak şekilde ele alındığı doğrulanmalıdır. | 3 | + +## V11.3 Şifreleme Algoritmaları + +AES ve CHACHA20 üzerine kurulu kimliği doğrulanmış şifreleme algoritmaları, modern kriptografik uygulamaların temelini oluşturur. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **11.3.1** | Güvensiz blok modlarının (örneğin, ECB) ve zayıf doldurma (padding) şemalarının (örneğin, PKCS#1 v1.5) kullanılmadığı doğrulanmalıdır. | 1 | +| **11.3.2** | Yalnızca AES ile GCM gibi onaylı şifreleme algoritmalarının ve modlarının kullanıldığı doğrulanmalıdır. | 1 | +| **11.3.3** | Şifrelenmiş verilerin yetkisiz değişikliklere karşı korunduğu doğrulanmalıdır. Tercihen bu koruma, onaylı bir kimliği doğrulanmış şifreleme yöntemi kullanılarak ya da onaylı bir şifreleme yöntemi ile onaylı bir MAC algoritmasının kombinasyonu ile sağlanmalıdır. | 2 | +| **11.3.4** | Sayılar, başlatma vektörleri (IV) ve diğer tek kullanımlık değerlerin, aynı şifreleme anahtarı ve veri öğesi çifti için birden fazla kez kullanılmadığı doğrulanmalıdır. Oluşturma yöntemi kullanılan algoritmaya uygun olmalıdır. | 3 | +| **11.3.5** | Şifreleme algoritması ve MAC algoritması kombinasyonlarının "encrypt-then-MAC" modunda çalıştığı doğrulanmalıdır. | 3 | + +## V11.4 Hashing ve Hash Tabanlı Fonksiyonlar + +Kriptografik hash'ler, dijital imzalar, HMAC, anahtar türetme fonksiyonları (KDF), rastgele bit üretimi ve parola saklama gibi çok çeşitli kriptografik protokollerde kullanılır. Kriptografik sistemin güvenliği, kullanılan hash fonksiyonlarının güvenliği ile doğrudan ilişkilidir. Bu bölüm, kriptografik işlemlerde güvenli hash fonksiyonlarının kullanımına dair gereksinimleri özetler. + +Parola saklama ve kriptografi ile ilgili ek için [OWASP Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#password-hashing-algorithms) belgesi de fayda ve rehberlik sağlar. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **11.4.1** | Dijital imzalar, HMAC, KDF ve rastgele bit üretimi gibi genel kriptografik kullanım senaryolarında yalnızca onaylı hash fonksiyonlarının kullanıldığı doğrulanmalıdır. MD5 gibi yasaklı hash fonksiyonları hiçbir kriptografik amaçla kullanılmamalıdır. | 1 | +| **11.4.2** | Parolaların, onaylı, hesaplama açısından yoğun ve mevcut rehberliğe göre yapılandırılmış bir anahtar türetme fonksiyonu (diğer adıyla parola hash'leme fonksiyonu) kullanılarak saklandığı doğrulanmalıdır. Ayarlar, güvenlik ve performans dengesini sağlayarak kaba kuvvet saldırılarını zorlaştırmalıdır. | 2 | +| **11.4.3** | Dijital imzalarda kullanılan hash fonksiyonlarının, veri bütünlüğü ve kimlik doğrulama amacıyla kullanıldığında çakışmaya karşı dayanıklı ve yeterli bit uzunluğuna sahip olduğu doğrulanmalıdır. Çakışma dayanıklılığı gerekiyorsa çıktı uzunluğu en az 256 bit olmalıdır. Sadece ikinci ön-görüntü (2nd pre-iamge) saldırılarına karşı dayanıklılık gerekiyorsa çıktı uzunluğu en az 128 bit olmalıdır. | 2 | +| **11.4.4** | Parolalardan gizli anahtarlar türetilirken, onaylı anahtar türetme fonksiyonlarının anahtar uzatma (key stretching) parametreleriyle birlikte kullanıldığı doğrulanmalıdır. Bu parametreler, kaba kuvvet saldırılarını önleyecek şekilde güvenlik ve performans dengesine sahip olmalıdır. | 2 | + +## V11.5 Rastgele Değerler + +Kriptografik olarak güvenli sözde rastgele sayı üretimini (Cryptographically secure Pseudo-random Number Generation - CSPRNG), doğru şekilde uygulamak son derece zordur. Genellikle, bir sistemdeki iyi entropi kaynakları aşırı kullanıldığında hızla tükenir. Düşük rastgelelik seviyesine sahip kaynaklar ise tahmin edilebilir anahtarlara ve sırların ortaya çıkmasına yol açabilir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **11.5.1** | Tahmin edilemez olması amaçlanan tüm rastgele sayıların ve dizelerin, CSPRNG ile oluşturulduğu ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. UUID'lerin bu koşulu dikkate almadığını unutmayın. | 2 | +| **11.5.2** | Kullanılan rastgele sayı üretim mekanizmasının, yoğun talep altında dahi güvenli çalışacak şekilde tasarlandığı doğrulanmalıdır. | 3 | + +## V11.6 Açık Anahtar (Public Key) Kriptografisi + +Birden fazla taraf arasında ortak bir sır paylaşımının mümkün olmadığı ya da arzu edilmediği durumlarda açık anahtar kriptografisi kullanılır. + +Bu bağlamda, modern tehditlere karşı sistemin güvenliğini sağlamak için Diffie-Hellman ve Eliptik Eğri Diffie-Hellman (ECDH) gibi onaylı anahtar değişim mekanizmalarına ihtiyaç vardır. “Güvenli İletişim” bölümü, TLS için gereksinimleri sağlar; bu bölümdeki gereksinimler ise TLS dışındaki açık anahtar kriptografisi kullanım durumlarına yöneliktir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **11.6.1** | Anahtar üretimi, tohumlama (seeding) ve dijital imza üretimi ve doğrulama için yalnızca onaylı kriptografik algoritmalar ve çalışma modlarının kullanıldığı doğrulanmalıdır. Anahtar üretim algoritmaları, bilinen saldırılara karşı savunmasız anahtarlar üretmemelidir. Örneğin, Fermat çarpanlama yöntemine karşı savunmasız RSA anahtarları oluşturulmamalıdır. | 2 | +| **11.6.2** | Anahtar değişimi için yalnızca onaylı kriptografik algoritmaların kullanıldığı doğrulanmalıdır (örneğin Diffie-Hellman). Kullanılan parametrelerin güvenli olması gerektiğine dikkat edilmelidir. Bu, anahtar kurulum sürecine yönelik saldırıları önleyecek ve araya girme (adversary-in-the-middle) ya da kriptografik kırılmaları engelleyecektir. | 3 | + +## V11.7 Kullanım Halindeki Verilerin Kriptografisi + +Veri işlenirken korunması çok önemlidir. Tam bellek şifreleme, veri iletiminde şifreleme ve verilerin kullanımdan hemen sonra mümkün olan en kısa sürede şifrelenmesi gibi teknikler önerilir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **11.7.1** | Hassas verilerin kullanım sırasında korunmasını sağlamak amacıyla, yetkisiz kullanıcıların veya süreçlerin bu verilere erişmesini engelleyen tam bellek şifrelemesinin kullanıldığı doğrulanmalıdır. | 3 | +| **11.7.2** | Veri asgariyetinin sağlandığı, yani işleme sırasında mümkün olan en az miktarda verinin ortaya çıktığı ve verilerin kullanımdan hemen sonra veya mümkün olan en kısa sürede şifrelendiği doğrulanmalıdır. | 3 | + +## Referanslar + +Daha fazla bilgi için: + +* [OWASP Web Security Testing Guide: Testing for Weak Cryptography](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography) +* [OWASP Cryptographic Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html) +* [FIPS 140-3](https://csrc.nist.gov/pubs/fips/140-3/final) +* [NIST SP 800-57](https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final) diff --git a/5.0/tr/0x21-V12-Secure-Communication.md b/5.0/tr/0x21-V12-Secure-Communication.md new file mode 100644 index 0000000000..859efc45ce --- /dev/null +++ b/5.0/tr/0x21-V12-Secure-Communication.md @@ -0,0 +1,57 @@ +# V12 Güvenli İletişim + +## Kontrol Amacı + +Bu bölüm, hem bir son kullanıcı istemcisi ile backend hizmeti arasında hem de iç sistemler ile backend hizmetleri arasındaki veri iletimini korumak için uygulanması gereken özel mekanizmalara ilişkin gereksinimleri içerir. + +Bu bölümde öne çıkan genel kavramlar şunlardır: + +* İletişimlerin dış sistemlerle şifreli, ideal olarak iç sistemlerde de şifreli olması. +* Şifreleme mekanizmalarının, tercih edilen algoritmalar ve şifreler dahil olmak üzere en güncel rehberliklere göre yapılandırılması. +* Yetkisiz taraflarca iletişimin engellenmediğinden emin olmak amacıyla imzalı sertifikaların kullanılması. + +Genel ilkelere ve en iyi uygulamalara ek olarak, ASVS ayrıca Ek C - Kriptografi Standartları bölümünde kriptografik güç hakkında daha derin teknik bilgiler sunar. + +## V12.1 Genel TLS Güvenlik Rehberi + +Bu bölüm, TLS iletişimini güvenli hale getirmek için başlangıç seviyesinde rehberlik sağlar. TLS yapılandırmasının güncel araçlarla düzenli olarak gözden geçirilmesi gerekir. + +Wildcard TLS sertifikalarının kullanımı doğası gereği güvensiz değildir, ancak aynı sertifikanın üretim, hazırlık (staging), geliştirme ve test gibi tüm ortamlarda kullanılması halinde sertifika güvenliğinin tehlikeye girmesi, bu ortamlarda çalışan uygulamaların da güvenlik postürünü olumsuz etkileyebilir. Mümkünse her ortam için ayrı TLS sertifikalarının kullanılması, bu sertifikaların güvenli bir şekilde yönetilmesi ve korunması gereklidir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **12.1.1** | Yalnızca TLS protokolünün en güncel ve önerilen sürümlerinin (örneğin TLS 1.2 ve TLS 1.3) etkinleştirildiği ve en son sürümün varsayılan olarak tercih edildiği doğrulanmalıdır. | 1 | +| **12.1.2** | Yalnızca önerilen şifre takımlarının (cipher suite) etkinleştirildiği ve en güçlü şifre takımlarının tercih edildiği doğrulanmalıdır. Seviye 3 (L3) uygulamalar yalnızca ileri gizlilik (forward secrecy) sağlayan şifre takımlarını desteklemelidir. | 2 | +| **12.1.3** | Uygulamanın, mTLS istemci sertifikalarını kimlik doğrulama veya yetkilendirme amacıyla kullanmadan önce bu sertifikaların güvendiği sertifikalar arasında olduğunu doğruladığı kontrol edilmelidir. | 2 | +| **12.1.4** | Online Certificate Status Protocol (OCSP) Stapling gibi geçerli bir sertifika iptal kontrolü yönteminin etkinleştirildiği ve yapılandırıldığı doğrulanmalıdır. | 3 | +| **12.1.5** | TLS el sıkışma (handshake) sürecinde Server Name Indication (SNI) gibi hassas meta verilerin ifşa edilmesini önlemek için, uygulamanın TLS yapılandırmasında Encrypted Client Hello (ECH) özelliğinin etkinleştirildiği doğrulanmalıdır. | 3 | + +## V12.2 Dışa Açık Hizmetlerle HTTPS İletişimi + +Uygulamanın dışa açtığı tüm HTTP trafiğinin şifreli olarak iletildiğinden ve bu iletişimlerde herkese açık olarak güvenilen sertifikaların kullanıldığından emin olunmalıdır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **12.2.1** | İstemci ile dışa açık, HTTP tabanlı hizmetler arasındaki tüm bağlantılarda TLS kullanıldığı ve bu bağlantıların güvensiz ya da şifrelenmemiş iletişime geri dönmediği doğrulanmalıdır. | 1 | +| **12.2.2** | Dışa açık hizmetlerin herkese açık olarak güvenilen TLS sertifikaları kullandığı doğrulanmalıdır. | 1 | + +## V12.3 Genel Servisler Arası İletişim Güvenliği + +Sunucu iletişimleri (hem iç hem dış) sadece HTTP ile sınırlı değildir. Diğer sistemlerle olan bağlantıların da güvenli olması gerekir ve ideal olarak TLS kullanılmalıdır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **12.3.1** | Uygulamaya gelen ve uygulamadan çıkan tüm bağlantılarda izleme sistemleri, yönetim araçları, uzaktan erişim ve SSH, ara yazılımlar, veritabanları, ana sistemler (mainframe), iş ortağı sistemleri ya da dış API'ler dahil olmak üzere TLS gibi şifreli bir protokolün kullanıldığı ve güvensiz ya da şifrelenmemiş protokollere geri dönülmediği doğrulanmalıdır. | 2 | +| **12.3.2** | TLS istemcilerinin bir TLS sunucusu ile iletişime geçmeden önce alınan sertifikaları doğruladığı kontrol edilmelidir. | 2 | +| **12.3.3** | Uygulama içindeki HTTP tabanlı iç hizmetler arasında gerçekleşen tüm bağlantılarda TLS ya da uygun başka bir aktarım şifreleme mekanizmasının kullanıldığı ve güvensiz ya da şifrelenmemiş iletişime geri dönülmediği doğrulanmalıdır. | 2 | +| **12.3.4** | İç hizmetler arasındaki TLS bağlantılarında güvenilir sertifikaların kullanıldığı doğrulanmalıdır. İç sistemlerde oluşturulmuş ya da kendinden imzalı (self-signed) sertifikalar kullanılıyorsa, bu sertifikalara güvenen hizmetlerin yalnızca belirli dahili sertifika otoritelerine (CA) ve belirli kendinden imzalı sertifikalara güvenecek şekilde yapılandırıldıkları doğrulanmalıdır. | 2 | +| **12.3.5** | Sistem içindeki hizmetlerin birbiriyle iletişim kurarken her bir uç noktanın kimliğini doğrulamak için güçlü kimlik doğrulama yöntemlerinin kullanıldığı doğrulanmalıdır. Bu yöntemler arasında, açık anahtar altyapısı (public-key infrastructure) kullanan ve tekrar oynatma saldırılarına karşı dayanıklı olan TLS istemci kimlik doğrulaması gibi yöntemler yer almalıdır. Mikroservis mimarilerinde, sertifika yönetimini basitleştirmek ve güvenliği artırmak amacıyla bir servis ağı (service mesh) kullanılması değerlendirilmelidir. | 3 | + +## Referanslar + +Daha fazla bilgi için: + +* [OWASP - Transport Layer Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html) +* [Mozilla's Server Side TLS configuration guide](https://wiki.mozilla.org/Security/Server_Side_TLS) +* [Mozilla's tool to generate known good TLS configurations](https://ssl-config.mozilla.org/). +* [O-Saft - OWASP Project to validate TLS configuration](https://owasp.org/www-project-o-saft/) diff --git a/5.0/tr/0x22-V13-Configuration.md b/5.0/tr/0x22-V13-Configuration.md new file mode 100644 index 0000000000..87f0ba8a7b --- /dev/null +++ b/5.0/tr/0x22-V13-Configuration.md @@ -0,0 +1,68 @@ +# V13 Konfigürasyon + +## Kontrol Amacı + +Uygulamanın varsayılan konfigürasyonu, İnternet üzerinde güvenli kullanım için uygun olmalıdır. + +Bu bölüm, geliştirme, derleme ve dağıtım aşamalarında uygulanması gereken çeşitli konfigürasyonlara dair rehberlik sağlar. + +Ele alınan konular veri sızıntısını önlemek, bileşenler arası iletişimi güvenli şekilde yönetmek ve gizli verileri korumayı içerir. + +## V13.1 Konfigürasyon Dokümantasyonu + +Bu bölüm, uygulamanın iç ve dış hizmetlerle nasıl iletişim kurduğunu açıklayan dokümantasyon gereksinimlerini ve hizmetlerin erişilemez olması durumunda erişilebilirliğin kaybını önlemek için kullanılabilecek teknikleri tanımlar. Ayrıca, gizli verilerle ilgili belgeleri de kapsar. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **13.1.1** | Uygulamanın tüm iletişim ihtiyaçlarının dokümante edildiği doğrulanmalıdır. Buna, uygulamanın bağımlı olduğu dış hizmetler ve son kullanıcının uygulamanın bağlantı kurmasını sağlayabileceği dış konumlar da dahil olmalıdır. | 2 | +| **13.1.2** | Uygulamanın kullandığı her bir hizmet için, dokümantasyonda eşzamanlı bağlantı sayısı (örn. bağlantı havuzu limitleri) ve bu sınır aşıldığında uygulamanın davranışı, geri dönüş veya kurtarma mekanizmaları da dahil olmak üzere hizmet reddi koşullarını önlemek için tanımlandığı doğrulanmalıdır. | 3 | +| **13.1.3** | Uygulamanın, kullandığı her bir dış sistem veya hizmet (örn. veritabanları, dosya tanıtıcıları, iş parçacıkları, HTTP bağlantıları) için kaynak yönetimi stratejilerini tanımladığı doğrulanmalıdır. Bu stratejiler, kaynak serbest bırakma prosedürlerini, zaman aşımı ayarlarını, hata durumlarını ve tekrar deneme mantığı uygulanmışsa sınırları, gecikmeleri ve geri çekilme (back-off) algoritmalarını içermelidir. Senkron HTTP istek–yanıt işlemleri için kısa zaman aşımı süreleri zorunlu tutulmalı ve tekrar eden denemeler devre dışı bırakılmalı ya da sıkı şekilde sınırlandırılmalıdır. | 3 | +| **13.1.4** | Uygulamanın, güvenlik açısından kritik olan gizli verileri tanımladığı ve kuruluşun tehdit modeli ve iş ihtiyaçlarına göre bu verilerin döndürülme (rotation) zamanlamasının belgelendiği doğrulanmalıdır. | 3 | + +## V13.2 Backend İletişim Konfigürasyonu + +Uygulamalar, API'ler, veritabanları veya diğer bileşenler gibi çok sayıda hizmetle etkileşime girer. Bu hizmetler, uygulamaya dâhil olarak kabul edilebilir ancak uygulamanın standart erişim kontrol mekanizmalarına dahil olmayabilir veya tamamen dış sistemler olabilir. Her iki durumda da, uygulamanın bu bileşenlerle güvenli şekilde iletişim kuracak şekilde yapılandırılması ve gerekiyorsa bu yapılandırmanın korunması gereklidir. + +Not: "Güvenli İletişim" bölümü, aktarım sırasında şifreleme için rehberlik sağlar. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **13.2.1** | Uygulamanın, standart kullanıcı oturum mekanizmasını desteklemeyen backend bileşenleri (örneğin API'ler, ara katmanlar, veri katmanları) arasında gerçekleşen iletişimlerin kimlik doğrulamasıyla korunduğu doğrulanmalıdır. Kimlik doğrulama; bireysel hizmet hesapları, kısa ömürlü token'lar ya da sertifika tabanlı kimlik doğrulama ile yapılmalıdır ve parola, API anahtarı ya da ayrıcalıklı erişime sahip paylaşımlı hesaplar gibi sabit kimlik bilgileri kullanılmamalıdır. | 2 | +| **13.2.2** | Uygulamanın backend bileşenleri arasında (yerel hizmetler, işletim sistemi hizmetleri, API'ler, ara katmanlar ve veri katmanları dahil) gerçekleştirilen iletişimlerin, yalnızca gerekli en az ayrıcalığa sahip hesaplarla yapıldığı doğrulanmalıdır. | 2 | +| **13.2.3** | Bir hizmet kimlik doğrulaması için bir kimlik bilgisi kullanılması gerekiyorsa, bu kimlik bilgisinin varsayılan bir değer (örneğin root/root veya admin/admin) olmadığının doğrulanması gereklidir. | 2 | +| **13.2.4** | Uygulamanın iletişim kurmasına izin verilen dış kaynaklar ya da sistemlerin, bir allowlist (izinli liste) ile tanımlandığı doğrulanmalıdır. Bu liste, uygulama katmanında, web sunucusunda, güvenlik duvarında veya farklı katmanların birleşiminde uygulanabilir. | 2 | +| **13.2.5** | Web veya uygulama sunucusunun, dış sistemlere veri veya dosya gönderimi veya yüklemesi yaparken sadece belirli kaynaklara izin verecek şekilde allowlist ile yapılandırıldığı doğrulanmalıdır. | 2 | +| **13.2.6** | Uygulamanın farklı hizmetlere bağlantı kurduğu durumlarda, bu bağlantılar için belgelenmiş yapılandırmaları (örn. maksimum eşzamanlı bağlantı, bağlantı limiti aşıldığında davranış, zaman aşımı, tekrar deneme stratejileri) takip ettiğinin doğrulanması gereklidir. | 3 | + +## V13.3 Gizli Bilgi Yönetimi + +Gizli bilgilerin (secret) yönetimi, uygulama tarafından kullanılan verilerin korunması açısından temel bir konfigürasyon görevidir. Kriptografi ile ilgili özel gereksinimler "Kriptografi" bölümünde yer almakla birlikte bu bölüm, gizli verilerin yönetimi ve işlenmesine odaklanır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **13.3.1** | Parolalar, anahtar materyalleri, veritabanı ve üçüncü parti sistemlerle entegrasyon bilgileri, zaman tabanlı token'lar için tohum (seed) bilgileri, dahili gizli veriler ve API anahtarları gibi backend sırlarının güvenli bir şekilde oluşturulması, saklanması, erişim denetiminin sağlanması ve imha edilmesi için bir gizli bilgi yönetim çözümünün (örneğin key vault) kullanıldığı doğrulanmalıdır. Bu gizli bilgiler uygulama kaynak koduna dahil edilmemeli ve yapı çıktılarında yer almamalıdır. Seviye 3 uygulamalar için donanım destekli bir çözüm (örneğin HSM) gereklidir. | 2 | +| **13.3.2** | Gizli bilgilere erişimin en az ayrıcalık prensibine uygun şekilde yapılandırıldığı doğrulanmalıdır. | 2 | +| **13.3.3** | Tüm kriptografik işlemlerin, anahtar materyallerinin güvenli bir şekilde yönetilmesi ve dışarıya sızmasının engellenmesi amacıyla, izole edilmiş bir güvenlik modülü (örneğin vault ya da donanım güvenlik modülü) aracılığıyla gerçekleştirildiği doğrulanmalıdır. | 3 | +| **13.3.4** | Uygulamanın belgelerinde belirtildiği şekilde gizli bilgilerin süresinin dolacak şekilde yapılandırıldığı ve düzenli olarak döndürüldüğü doğrulanmalıdır. | 3 | + +## V13.4 İstenmeyen Bilgi Sızıntısı + +Üretim yapılandırmaları, gereksiz veri ifşasını önleyecek şekilde sertleştirilmiş (hardened) olmalıdır. Bu tür güvenlik açıkları genellikle tek başına büyük risk olarak değerlendirilmese de diğer açıklıklarla zincirlenerek sömürülebilir. Varsayılan olarak bu açıklıkların bulunmaması, uygulamaya yapılacak saldırıların zorluk seviyesini artırır. + +Örneğin, sunucu taraflı bileşenlerin sürüm bilgisini gizlemek, tüm bileşenlerin yamanması ihtiyacını ortadan kaldırmaz; dizin listelemeyi devre dışı bırakmak, yetkilendirme kontrolleri ihtiyacını ya da dosyaların herkese açık klasörden uzak tutulması gerekliliğini ortadan kaldırmaz. Ancak bunlar, saldırıların başarıya ulaşma olasılığını azaltır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **13.4.1** | Uygulamanın .git veya .svn klasörleri gibi kaynak kontrolüyle ilgili metadata içermeyecek şekilde deploy edildiğini ya da bu klasörlerin hem dış erişime hem de uygulama erişimine kapalı olduğu doğrulanmalıdır. | 1 | +| **13.4.2** | Tüm bileşenler için üretim ortamlarında hata ayıklama (debug) modlarının devre dışı bırakıldığı doğrulanmalıdır. | 2 | +| **13.4.3** | Web sunucularının, açık şekilde istenmediği sürece dizin listelemesi (directory listing) özelliğini istemcilere sunmadığı doğrulanmalıdır. | 2 | +| **13.4.4** | HTTP TRACE metodunun üretim ortamlarında desteklenmediği, böylece potansiyel bilgi sızıntılarının önlendiği doğrulanmalıdır. | 2 | +| **13.4.5** | Belgeler (örneğin dahili API belgeleri) ve izleme uç noktalarının (monitoring endpoints) yalnızca açıkça belirtildiği durumlarda erişilebilir olduğu doğrulanmalıdır. | 2 | +| **13.4.6** | Uygulamanın arka uç bileşenlerinin ayrıntılı sürüm bilgilerini ifşa etmediği doğrulanmalıdır. | 3 | +| **13.4.7** | Web katmanının yalnızca belirli dosya uzantılarına sahip dosyaları sunacak şekilde yapılandırıldığı, bu sayede istem dışı bilgi, yapılandırma ya da kaynak kod sızıntılarının önlendiği doğrulanmalıdır. | 3 | + +## Referanslar + +Daha fazla bilgi için: + +* [OWASP Web Security Testing Guide: Configuration and Deployment Management Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing) diff --git a/5.0/tr/0x23-V14-Data-Protection.md b/5.0/tr/0x23-V14-Data-Protection.md new file mode 100644 index 0000000000..7d88816343 --- /dev/null +++ b/5.0/tr/0x23-V14-Data-Protection.md @@ -0,0 +1,60 @@ +# V14 Veri Koruma + +## Kontrol Amacı + +Uygulamalar, tüm kullanım senaryolarını ve kullanıcı davranışlarını önceden öngöremez. Bu nedenle, istemci cihazlarda hassas verilere yetkisiz erişimi sınırlamak için kontroller uygulanmalıdır. + +Bu bölüm, hangi verilerin korunması gerektiğini tanımlama, nasıl korunacağını belirleme ve uygulanması gereken özel mekanizmalar ile kaçınılması gereken hatalarla ilgili gereksinimleri içerir. + +Veri koruma ile ilgili bir diğer husus da toplu veri çıkarımı, değiştirme veya aşırı kullanımdır. Her sistemin gereksinimleri muhtemelen çok farklı olacaktır; bu nedenle, neyin "anormal" olduğunun belirlenmesi tehdit modeli ve iş riski dikkate alınarak yapılmalıdır. ASVS perspektifinden bakıldığında, bu tür sorunların tespiti "Güvenlik Günlüğü Tutma ve Hata Yönetimi" bölümünde, sınırlamaların belirlenmesi ise "Doğrulama ve İş Mantığı" bölümünde ele alınmaktadır. + +## V14.1 Veri Koruma Dokümantasyonu + +Verilerin korunabilmesi için temel ön koşullardan biri, hangi verilerin hassas olarak kabul edilmesi gerektiğinin kategorize edilmesidir. Hassasiyetin birkaç farklı düzeyi olabilir ve her düzey için uygulanması gereken kontroller farklılık gösterebilir. + +Verilerin saklanması, kullanımı ve iletimi konusunda uygulamaların uyması gereken çeşitli gizlilik düzenlemeleri ve yasalar bulunmaktadır. Bu bölüm artık bu tür yasal düzenlemeleri çoğaltmaya çalışmamakta, bunun yerine hassas verileri korumaya yönelik temel teknik hususlara odaklanmaktadır. Lütfen yerel yasa ve düzenlemelere başvurun ve gerektiğinde nitelikli bir gizlilik uzmanı veya avukata danışın. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **14.1.1** | Uygulama tarafından oluşturulan ve işlenen tüm hassas verilerin tanımlanıp, koruma seviyelerine göre sınıflandırıldığından emin olun. Bu, yalnızca kodlanmış (örneğin Base64 stringleri ya da JWT içindeki düz metin yükler gibi) ve bu nedenle kolayca çözülebilir verileri de içermelidir. Koruma seviyeleri, uygulamanın uymakla yükümlü olduğu veri koruma ve gizlilik düzenlemeleri ile standartlarını dikkate almalıdır. | 2 | +| **14.1.2** | Tüm hassas veri koruma seviyeleri için belgelenmiş bir koruma gereksinimleri seti tanımlandığından emin olun. Bu gereksinimler genel şifreleme, bütünlük doğrulama, saklama süresi, verinin nasıl günlüğe kaydedileceği, günlüklerdeki hassas verilere erişim kontrolleri, veritabanı düzeyinde şifreleme, gizlilik ve gizliliği artırıcı teknolojiler ile diğer gizlilik gereksinimlerini kapsamalıdır. | 2 | + +## V14.2 Genel Veri Koruması + +Bu bölüm, veri korumaya yönelik çeşitli pratik gereksinimleri içerir. Bunların çoğu, istenmeyen veri sızıntısı gibi belirli konulara yöneliktir. Ancak aynı zamanda her bir veri öğesi için gerekli olan koruma düzeyine göre koruma kontrollerinin uygulanmasına ilişkin genel bir gereksinim de bulunmaktadır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **14.2.1** | Hassas verilerin yalnızca HTTP message body veya header alanlarında sunucuya gönderildiği ve URL ile sorgu parametrelerinin, API anahtarı veya session token’ı gibi hassas bilgiler içermediği doğrulanmalıdır. | 1 | +| **14.2.2** | Hassas verilerin, yük dengeleyiciler ve uygulama önbellekleri gibi sunucu bileşenlerinde önbelleğe alınmasının engellendiği veya kullanım sonrası bu verilerin güvenli biçimde temizlendiği doğrulanmalıdır. | 2 | +| **14.2.3** | Uygulama kontrolü dışında veri toplanmasını engellemek için, tanımlanmış hassas verilerin, kullanıcı izleyicileri gibi güvensiz taraflara gönderilmediği doğrulanmalıdır. | 2 | +| **14.2.4** | Hassas verilere yönelik şifreleme, bütünlük doğrulama, veri saklama, loglama yöntemi, loglardaki erişim kontrolleri, gizlilik teknolojileri gibi kontrollerin, söz konusu verinin belgelenmiş koruma seviyesinde tanımlandığı şekilde uygulandığı doğrulanmalıdır. | 2 | +| **14.2.5** | Önbellekleme mekanizmalarının yalnızca belirli içerik türüne sahip yanıtları önbelleğe alacak şekilde yapılandırıldığı ve hassas, dinamik içeriklerin önbelleğe alınmadığı doğrulanmalıdır. Web sunucusu, mevcut olmayan bir dosya talebinde geçerli ama farklı bir dosya döndürmek yerine 404 veya 302 cevabı vermelidir. Bu, Web Cache Deception saldırılarını önlemeye yardımcı olur. | 3 | +| **14.2.6** | Uygulamanın yalnızca işlevsellik için gerekli olan asgari hassas veriyi döndürdüğü doğrulanmalıdır. Örneğin, kredi kartı numarasının yalnızca bazı rakamlarının döndürülmesi; tam numaranın döndürülmesi gerekiyorsa, kullanıcı arayüzünde gizlenmiş (maskelenmiş) şekilde sunulması gerekir, aksi kullanıcı özel olarak görüntülemek istemedikçe gösterilmemelidir. | 3 | +| **14.2.7** | Hassas bilgilerin, veri saklama sınıflandırmasına tabi tutulduğu, geçerliliğini yitirmiş veya artık gerekli olmayan verilerin belirlenmiş bir zaman çizelgesiyle ya da gerektiğinde otomatik olarak silindiği doğrulanmalıdır. | 3 | +| **14.2.8** | Kullanıcı tarafından yüklenen dosyaların meta verilerinden hassas bilgilerin çıkarıldığı veya bu bilgilerin yalnızca kullanıcıdan açık onay alındığında saklandığı doğrulanmalıdır. | 3 | + +## V14.3 İstemci Tarafı Veri Koruması + +Bu bölüm, uygulamanın istemci veya kullanıcı aracısı tarafında verilerin belirli yollarla sızmasını önlemeye yönelik gereksinimleri içerir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **14.3.1** | Kimliği doğrulanmış verilerin, istemci veya oturum sonlandığında istemci depolamasından (örneğin tarayıcı DOM’undan) temizlendiği doğrulanmalıdır. 'Clear-Site-Data' HTTP response header bu konuda yardımcı olabilir ancak istemci tarafı, sunucu bağlantısı mevcut olmadığında da temizlik işlemini yapabiliyor olmalıdır. | 1 | +| **14.3.2** | Uygulamanın, tarayıcılarda hassas verilerin önbelleğe alınmasını önlemek amacıyla yeterli anti-önbellekleme HTTP response header (örneğin Cache-Control: no-store) ayarladığı doğrulanmalıdır. | 2 | +| **14.3.3** | Tarayıcıda depolanan verilerin (örneğin localStorage, sessionStorage, IndexedDB veya çerezler) hassas veri içermediği, yalnızca session token’larının istisna olarak kabul edildiği doğrulanmalıdır. | 2 | + +## Referanslar + +Daha fazla bilgi için: + +* [Güvenlik ve önbelleğe alma karşıtı header field'ları kontrol etmek için Security Headers web sitesini kullanmayı değerlendirebilirsiniz](https://securityheaders.com/) +* [Mozilla'nın önbelleğe alma karşıtı header'larla ilgili dokümantasyonu](https://developer.mozilla.org/en-US/docs/Web/HTTP/Caching) +* [OWASP Secure Headers project](https://owasp.org/www-project-secure-headers/) +* [OWASP Privacy Risks Project](https://owasp.org/www-project-top-10-privacy-risks/) +* [OWASP User Privacy Protection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/User_Privacy_Protection_Cheat_Sheet.html) +* [Australian Privacy Principle 11 - Security of personal information](https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-11-app-11-security-of-personal-information) +* [European Union General Data Protection Regulation (GDPR) overview](https://www.edps.europa.eu/data-protection_en) +* [European Union Data Protection Supervisor - Internet Privacy Engineering Network](https://www.edps.europa.eu/data-protection/ipen-internet-privacy-engineering-network_en) +* ["Clear-Site-Data" header'ıyla ilgili bilgi](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Clear-Site-Data) +* [Web Cache Deception hakkında white paper](https://www.blackhat.com/docs/us-17/wednesday/us-17-Gil-Web-Cache-Deception-Attack-wp.pdf) diff --git a/5.0/tr/0x24-V15-Secure-Coding-and-Architecture.md b/5.0/tr/0x24-V15-Secure-Coding-and-Architecture.md new file mode 100644 index 0000000000..2c1c963727 --- /dev/null +++ b/5.0/tr/0x24-V15-Secure-Coding-and-Architecture.md @@ -0,0 +1,77 @@ +# V15 Güvenli Kodlama ve Mimari + +## Kontrol Amacı + +ASVS gereksinimlerinin birçoğu kimlik doğrulama veya yetkilendirme gibi belirli bir güvenlik alanına ya da loglama veya dosya işleme gibi belirli uygulama işlevlerine ilişkindir. + +Bu bölüm, uygulamalar tasarlanırken ve geliştirilirken dikkate alınması gereken genel güvenlik gereksinimlerini kapsar. Bu gereksinimler yalnızca temiz mimari ve kod kalitesine değil, aynı zamanda uygulama güvenliği için gerekli olan belirli mimari ve kodlama uygulamalarına da odaklanır. + +## V15.1 Güvenli Kodlama ve Mimari Dokümantasyonu + +Güvenli ve savunulabilir bir mimarinin oluşturulmasına yönelik birçok gereksinim, uygulamada kullanılan bileşenler ve belirli güvenlik kontrollerinin uygulanmasına ilişkin kararların açıkça belgelenmesine dayanır. + +Bu bölüm, “tehlikeli işlevsellik” içeren bileşenler veya “riskli bileşenler” olarak kabul edilen parçaların tanımlanması dahil olmak üzere, dokümantasyon gereksinimlerini açıklar. + +"Tehlikeli işlevsellik" içeren bir bileşen, güvenilmeyen verilerin serisizleştirmesini (deserialization) yapan, ham dosya veya ikili veri ayrıştırması gerçekleştiren, dinamik kod çalıştıran veya doğrudan bellekle etkileşen bir dahili ya da üçüncü taraf bileşen olabilir. Bu tür işlemlerdeki güvenlik açıkları, uygulamanın ve altında yatan altyapının ele geçirilmesine yol açabilecek yüksek risklidir. + +"Riskli bileşen", güvenlik kontrolleri eksik ya da zayıf şekilde uygulanmış bir üçüncü taraf (ekip içinde geliştirilmemiş) kütüphanedir. Örnekler arasında kötü şekilde sürdürülen, desteklenmeyen, ömrünün sonuna gelmiş veya ciddi güvenlik açıkları geçmişi olan bileşenler yer alır. + +Bu bölüm aynı zamanda üçüncü taraf bileşenlerdeki güvenlik açıklarının giderilmesi için uygun zaman çerçevelerinin tanımlanmasının önemini vurgular. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **15.1.1** | Güvenlik açığı içeren üçüncü taraf bileşen sürümleri ve genel olarak kütüphane güncellemeleri için, uygulama dokümantasyonunda risk bazlı düzeltme zamanlarının tanımlandığı doğrulanmalıdır. | 1 | +| **15.1.2** | Yazılım bileşen listesi (Software Bill of Materials - SBOM) gibi bir envanterin tutulduğu, kullanılan tüm üçüncü taraf kütüphanelerin önceden tanımlanmış, güvenilir ve düzenli olarak güncellenen depolardan alındığı doğrulanmalıdır. | 2 | +| **15.1.3** | Uygulama dokümantasyonunda zaman veya kaynak açısından yoğun işlevlerin tanımlandığı, bu işlevlerin aşırı kullanımı durumunda kullanılabilirlik kaybının nasıl önleneceği ve yanıt oluşturma süresinin istemci zaman aşımını aşmaması için hangi önlemlerin alındığı belirtilmelidir. Örnek savunmalar kuyruklama, eşzamansız işleme, kullanıcı başına ve uygulama genelinde paralel işlem sınırlarını içerebilir. | 2 | +| **15.1.4** | Uygulama dokümantasyonunda "riskli bileşenler" olarak değerlendirilen üçüncü taraf kütüphanelerin vurgulandığı doğrulanmalıdır. | 3 | +| **15.1.5** | Uygulama dokümantasyonunda "tehlikeli işlevsellik" içeren uygulama bölümlerinin açıkça belirtildiği doğrulanmalıdır. | 3 | + +## V15.2 Güvenlik Mimarisi ve Bağımlılıklar + +Bu bölüm riskli, güncel olmayan veya güvensiz bağımlılıkların ve bileşenlerin bağımlılık yönetimi yoluyla nasıl ele alınması gerektiğine dair gereksinimleri içerir. + +Ayrıca, “tehlikeli işlemler” veya “riskli bileşenlerin” (önceki bölümde tanımlandığı şekilde) kullanımının etkisini azaltmak ve kaynak yoğun işlevlerin aşırı kullanımından kaynaklı kullanılabilirlik kayıplarını önlemek amacıyla sandboxing, kapsülleme (encapsulation), konteynerleştirme ve ağ izolasyonu gibi mimari düzeydeki tekniklerin kullanımını da kapsar. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **15.2.1** | Uygulamanın yalnızca, belgelenmiş güncelleme ve düzeltme sürelerini aşmamış bileşenleri içerdiği doğrulanmalıdır. | 1 | +| **15.2.2** | Uygulamanın, belgelenmiş güvenlik kararları ve stratejilere dayanarak, zaman veya kaynak açısından yoğun işlevlerin neden olabileceği kullanılabilirlik kaybına karşı savunmalar uyguladığı doğrulanmalıdır. | 2 | +| **15.2.3** | Üretim ortamının yalnızca uygulamanın çalışması için gerekli işlevleri içerdiği ve test kodları, örnek kod parçaları veya geliştirme işlevleri gibi gereksiz işlevsellikleri açığa çıkarmadığı doğrulanmalıdır. | 2 | +| **15.2.4** | Üçüncü taraf bileşenlerin ve bunların tüm transitif bağımlılıklarının beklenen depolardan (iç kaynaklı ya da harici) alındığı ve bağımlılık karışıklığı (dependency confusion) saldırılarına açık olmadığı doğrulanmalıdır. | 3 | +| **15.2.5** | Uygulamanın, “tehlikeli işlevsellik” içeren veya “riskli bileşenler” kullanan bölümlerine ek korumalar uyguladığı doğrulanmalıdır. Bu korumalar sandbox, kapsülleme, konteynerleştirme veya ağ düzeyinde izolasyon gibi teknikler aracılığıyla, bir uygulama bölümünün ele geçirilmesi durumunda saldırganın diğer bölümlere sıçramasını geciktirmeyi veya engellemeyi amaçlamalıdır. | 3 | + +## V15.3 Savunmacı Kodlama + +Bu bölüm, belirli bir programlama dilinde güvensiz kodlama kalıplarının kullanılması sonucu oluşan tür oynama (type juggling), prototip zehirleme (prototype pollution) gibi güvenlik açıklarını kapsar. Bazıları tüm dillere uygun olmayabilirken, diğerleri dile özel düzeltmelere sahip olabilir ya da HTTP parametrelerinin işlenmesi gibi framework'e özgü davranışlarla ilişkilidir. Ayrıca uygulama güncellemelerinin kriptografik olarak doğrulanmamasıyla ilgili riskleri de ele alır. + +Ayrıca, veri öğelerini temsil etmek için nesnelerin kullanılması ve bu nesnelerin dış API’ler üzerinden alınması ve döndürülmesi durumunda ortaya çıkan riskleri de dikkate alır. Bu durumda, uygulama kullanıcı girdileriyle değiştirilmemesi gereken alanların değiştirilememesini (kitlesel atama – mass assignment) sağlamalı ve hangi alanların döndürüldüğü konusunda seçici olmalıdır. Alan erişimi bir kullanıcının izinlerine bağlıysa, bu durum "Authorization" bölümündeki domain düzeyinde erişim kontrolü gereksinimi bağlamında değerlendirilmelidir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **15.3.1** | Uygulamanın yalnızca gerekli alanların bir alt kümesini veri nesnesinden döndürdüğü doğrulanmalıdır. Örneğin, bazı alanlara kullanıcıların erişmemesi gerektiğinden tüm veri nesnesi döndürülmemelidir. | 1 | +| **15.3.2** | Uygulama backend'i harici URL’lere çağrı yaptığında, yalnızca amaçlanan işlevsellik söz konusuysa yönlendirmeleri takip edecek şekilde yapılandırıldığının doğrulanması gerekir. | 2 | +| **15.3.3** | Uygulamanın, kitlesel atama saldırılarına karşı, her bir controller ve eylem için izin verilen alanları sınırlandırarak savunmalar sağladığı doğrulanmalıdır. Örneğin, bir alan değeri, bu işlemde değiştirilmesi amaçlanmadıysa eklenememeli veya güncellenememelidir. | 2 | +| **15.3.4** | Tüm proxy ve ara katman bileşenlerinin kullanıcının orijinal IP adresini, uç kullanıcı tarafından değiştirilemeyecek güvenilir veri alanları kullanarak doğru şekilde ilettiği ve uygulamanın ve web sunucusunun bu doğru değeri, loglama ve hız sınırlama gibi güvenlik kararları için kullandığı doğrulanmalıdır. Ayrıca, orijinal IP adresinin bile dinamik IP'ler, VPN'ler veya kurumsal güvenlik duvarları nedeniyle güvenilir olmayabileceği dikkate alınmalıdır. | 2 | +| **15.3.5** | Uygulamanın değişkenlerin doğru türde olduğunu açıkça doğruladığı ve sıkı eşitlik ve karşılaştırma işlemleri kullandığı doğrulanmalıdır. Bu, değişken türüyle ilgili varsayımlardan kaynaklanan tür oynama (type juggling) veya tür karışıklığı (type confusion) güvenlik açıklarını önlemek içindir. | 2 | +| **15.3.6** | JavaScript kodunun prototip zehirleme (prototype pollution) saldırılarını önleyecek şekilde yazıldığı, örneğin, nesne literal’leri yerine Set() veya Map() gibi yapılar kullanıldığı doğrulanmalıdır. | 2 | +| **15.3.7** | Uygulamanın, özellikle framework'ün istek parametrelerinin kaynağı (sorgu dizgisi, gövde parametreleri, çerezler veya başlık alanları) arasında ayrım yapmadığı durumlarda, HTTP parametre kirliliği (HTTP parameter pollution) saldırılarına karşı savunmalar uyguladığı doğrulanmalıdır. | 2 | + +## V15.4 Güvenli Eş Zamanlılık (Concurrency) + +Yarış durumları (race condition), kontrol anından kullanım anına (TOCTOU - time-of-check to time-of-use) açıkları, deadlock, livelock, iş parçacığı (thread) açlığı ve hatalı senkronizasyon gibi eş zamanlılık sorunları, öngörülemeyen davranışlara ve güvenlik risklerine yol açabilir. Bu bölüm, bu riskleri azaltmaya yardımcı olacak çeşitli teknikleri ve stratejileri içerir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **15.4.1** | Çok iş parçacıklı kodda (örneğin cache'ler, dosyalar veya birden fazla iş parçacığı tarafından erişilen bellek içi nesneler gibi) paylaşılan nesnelere yalnızca thread-safe (iş parçacığı güvenli) türler ve kilitleme (lock) veya semaphore gibi senkronizasyon mekanizmaları kullanılarak erişildiği doğrulanmalıdır. Bu, yarış durumlarını ve veri bozulmasını önlemeye yöneliktir. | 3 | +| **15.4.2** | Bir kaynağın durumu üzerindeki kontroller (örneğin varlığı ya da izinleri gibi) ile bu kontrole bağlı eylemlerin tek bir atomik işlem olarak gerçekleştirildiği doğrulanmalıdır. Bu, TOCTOU (time-of-check to time-of-use) yarış durumlarını önlemeye yöneliktir. Bir dosyanın varlığının kontrol edilip ardından açılması veya bir kullanıcının erişiminin doğrulanıp ardından yetki verilmesi gibi işlemler buna örnektir. | 3 | +| **15.4.3** | Kilitlerin (locks) tutarlı biçimde kullanıldığı, iş parçacıklarının birbirini beklemesi ya da sonsuz döngüye girmesi (deadlock veya livelock) gibi durumların önlendiği doğrulanmalıdır. Ayrıca, kilitleme mantığı, kaynağı yöneten kod içinde kalmalı ve dış sınıflar veya dış kodlar tarafından istemeden veya kötü niyetli şekilde değiştirilememelidir. | 3 | +| **15.4.4** | Kaynak tahsis politikalarının, iş parçacığı açlığını önleyecek şekilde, kaynaklara adil erişimi sağladığı doğrulanmalıdır. Örneğin, thread pool (iş parçacığı havuzu) kullanımı, düşük öncelikli iş parçacıklarının da makul sürelerde çalışabilmesi için uygulanmalıdır. | 3 | + +## Referanslar + +Daha fazla bilgi için: + +* [OWASP Prototype Pollution Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html) +* [OWASP Mass Assignment Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html) +* [OWASP CycloneDX Bill of Materials Specification](https://owasp.org/www-project-cyclonedx/) +* [OWASP Web Security Testing Guide: Testing for HTTP Parameter Pollution](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/07-Input_Validation_Testing/04-Testing_for_HTTP_Parameter_Pollution) diff --git a/5.0/tr/0x25-V16-Security-Logging-and-Error-Handling.md b/5.0/tr/0x25-V16-Security-Logging-and-Error-Handling.md new file mode 100644 index 0000000000..46d0624d56 --- /dev/null +++ b/5.0/tr/0x25-V16-Security-Logging-and-Error-Handling.md @@ -0,0 +1,84 @@ +# V16 Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi + +## Kontrol Amacı + +Güvenlik logları hata ya da performans loglarından farklı olarak kimlik doğrulama kararları, erişim kontrol kararları ve giriş doğrulama ya da iş mantığı doğrulama gibi güvenlik kontrollerini aşma girişimleri gibi güvenlikle ilgili olayları kaydetmek için kullanılır. Bu logların amacı tespit, müdahale ve inceleme süreçlerini desteklemek için SIEM gibi analiz araçlarına uygun, yüksek sinyalli ve yapılandırılmış veri sağlamaktır. + +Loglar, yasal bir zorunluluk olmadıkça hassas kişisel verileri içermemeli ve kaydedilen tüm veriler yüksek değerli birer varlık olarak korunmalıdır. Loglama işlemleri gizliliği veya sistem güvenliğini tehlikeye atmamalıdır. Uygulamalar ayrıca, hata durumlarında gereksiz bilgi sızdırma veya kesinti olmaksızın güvenli şekilde başarısız olmalıdır. + +Detaylı uygulama rehberliği için referanslar bölümündeki OWASP Cheat Sheet dökümanlarına başvurulabilir. + +## V16.1 Güvenlik Loglaması Dokümantasyonu + +Bu bölüm, uygulama katmanları genelinde gerçekleştirilen loglamanın açık ve eksiksiz bir envanterini oluşturmayı amaçlar. Bu, etkili güvenlik izleme, olay müdahalesi ve uyumluluk için gereklidir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **16.1.1** | Uygulamanın teknoloji yığını boyunca her katmanda hangi olayların loglandığını, log formatlarını, logların nereye yazıldığını, nasıl kullanıldığını, erişimin nasıl kontrol edildiğini ve logların ne kadar süre saklandığını belgeleyen bir envanterin mevcut olduğu doğrulanmalıdır. | 2 | + +## V16.2 Genel Loglama + +Bu bölüm, güvenlik loglarının tutarlı şekilde yapılandırılmasını ve beklenen meta verileri içermesini sağlamaya yönelik gereksinimleri kapsar. Amaç, logların makine tarafından okunabilir ve dağıtık sistemler ile araçlarda analiz edilebilir olmasını sağlamaktır. + +Güvenlik olayları çoğunlukla hassas veriler içerir. Bu tür verilerin dikkatsizce kaydedilmesi durumunda, loglar da hassas veri niteliği kazanır ve bu da şifreleme zorunluluğu, daha sıkı saklama politikaları ve denetimlerde açıklanma riski gibi sonuçlara yol açar. + +Bu nedenle yalnızca gerekli verilerin loglanması ve log verilerinin diğer hassas varlıklar gibi korunması kritik önemdedir. + +Aşağıdaki gereksinimler metadata'nın loglanması, senkronizasyon, biçim ve kontrol için temel gereksinimleri belirler. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **16.2.1** | Her bir log girdisinin, olayın ne zaman, nerede, kim tarafından ve ne olduğuna dair detaylı bir zaman çizelgesi oluşturulmasına olanak tanıyacak gerekli meta verileri içerdiği doğrulanmalıdır. | 2 | +| **16.2.2** | Tüm loglama bileşenlerinin zaman kaynaklarının senkronize olduğu ve güvenlik olayı meta verisindeki zaman damgalarının UTC kullanarak ya da açık zaman dilimi ofsetiyle belirtildiği doğrulanmalıdır. UTC kullanımı, özellikle yaz saati uygulamaları nedeniyle oluşabilecek karışıklıkları önlemek için tavsiye edilir. | 2 | +| **16.2.3** | Uygulamanın yalnızca log envanterinde belgelenmiş dosya ve hizmetlere log yazdığı ya da ilettiği doğrulanmalıdır. | 2 | +| **16.2.4** | Logların kullanılan log işleyici (log processor) tarafından okunabildiği ve ilişkilendirilebildiği doğrulanmalıdır. Tercihen yaygın bir log formatı kullanılmalıdır. | 2 | +| **16.2.5** | Hassas veriler loglanırken, uygulamanın veri koruma seviyesine uygun olarak loglama yaptığı doğrulanmalıdır. Örneğin kimlik bilgileri veya ödeme detayları gibi bazı verilerin loglanmasına izin verilmemelidir. Session token’ları gibi veriler ise yalnızca tamamen ya da kısmen maskelenmiş ya da hash’lenmiş olarak loglanmalıdır. | 2 | + +## V16.3 Güvenlik Olayları + +Bu bölüm, uygulama içerisinde güvenlikle ilgili olayların loglanmasına dair gereksinimleri tanımlar. Bu olayların yakalanması şüpheli davranışların tespiti, olay incelemelerinin desteklenmesi ve uyumluluk yükümlülüklerinin yerine getirilmesi açısından kritiktir. + +Buradaki olay türleri örnek niteliğindedir. Her uygulama, kendine özgü risk faktörleri ve operasyonel bağlama sahiptir. + +Not: ASVS, güvenlik olaylarının loglanmasını kapsam içine alır. Ancak SIEM kuralları veya izleme altyapısı gibi uyarı ve korelasyon sistemleri kapsam dışıdır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **16.3.1** | Tüm kimlik doğrulama işlemlerinin (başarılı ve başarısız girişimler dahil) loglandığı doğrulanmalıdır. Kullanılan kimlik doğrulama türü veya faktörleri gibi ek meta veriler de toplanmalıdır. | 2 | +| **16.3.2** | Başarısız yetkilendirme girişimlerinin loglandığı doğrulanmalıdır. Seviye 3 uygulamalar için, tüm yetkilendirme kararlarının ve hassas verilere erişim olaylarının (verinin kendisi olmadan) loglandığı da doğrulanmalıdır. | 2 | +| **16.3.3** | Uygulamanın, belgelenmiş güvenlik olaylarını ve güvenlik kontrollerini aşma girişimlerini (girdi doğrulama, iş mantığı, otomasyon karşıtı kontroller vb.) logladığı doğrulanmalıdır. | 2 | +| **16.3.4** | Beklenmeyen hatalar ve güvenlik kontrolü başarısızlıkları (örneğin backend TLS hataları gibi) loglandığı doğrulanmalıdır. | 2 | + +## V16.4 Log Koruması + +Loglar, olay incelemeleri ve adli analizler için değerli kanıtlardır ve korunmaları gerekir. Kolayca silinebilen ya da değiştirilebilen loglar güvenilirliğini kaybeder. Ayrıca loglar, uygulamanın iç davranışları veya hassas meta veriler hakkında bilgi barındırabileceğinden saldırganlar için cazip hedeflerdir. + +Bu bölüm, logların yetkisiz erişimden, değiştirilmeden ve açıklanmaktan korunmasını ve güvenli, izole sistemlere aktarılmasını sağlamaya yönelik gereksinimleri tanımlar. + +| # | Description | Level | +| :---: | :--- | :---: | +| **16.4.1** | Tüm loglama bileşenlerinin, log enjeksiyonunu (log injection) önlemek amacıyla verileri uygun biçimde encode ettiği doğrulanmalıdır. | 2 | +| **16.4.2** | Logların yetkisiz erişime karşı korunduğu ve değiştirilemez olduğu doğrulanmalıdır. | 2 | +| **16.4.3** | Logların analiz, tespit, uyarı ve yükseltme amacıyla mantıksal olarak ayrı bir sisteme güvenli biçimde iletildiği doğrulanmalıdır. Böylece uygulama ihlal edilse bile logların tehlikeye girmesi önlenmiş olur. | 2 | + +## V16.5 Hata Yönetimi + +Bu bölüm, uygulamaların beklenmedik durumlarda güvenli şekilde başarısız olmasını ve hassas içsel detayları açıklamamasını sağlamak için gerekli gereksinimleri tanımlar. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **16.5.1** | Beklenmedik ya da güvenlikle ilgili bir hata oluştuğunda, tüketiciye genel bir mesaj döndürüldüğü ve yığın izleri (stack trace), sorgular, gizli anahtarlar, token’lar gibi hassas sistem içi verilerin açıklanmadığı doğrulanmalıdır. | 2 | +| **16.5.2** | Uygulamanın, dış kaynaklara erişim başarısız olduğunda bile güvenli şekilde çalışmaya devam ettiği doğrulanmalıdır. Örneğin, circuit breaker ya da graceful degradation gibi desenler kullanılmalıdır. | 2 | +| **16.5.3** | Uygulamanın hata durumlarında güvenli ve düzenli şekilde başarısız olduğu doğrulanmalıdır. Bu, örneğin doğrulama hatalarına rağmen işlemlerin işlenmesine yol açabilecek fail-open durumlarını önlemelidir. | 2 | +| **16.5.4** | Ele alınmamış tüm istisnaları yakalayacak şekilde tanımlanmış bir “son çare hata yöneticisi” bulunduğu doğrulanmalıdır. Bu, hem loglara gitmesi gereken hata detaylarının kaybolmaması hem de tüm uygulama sürecinin çökerek hizmet dışı kalmasının önlenmesi açısından önemlidir. | 3 | + +Not: Swift, Go ve birçok fonksiyonel dilde olduğu gibi bazı diller, istisnaları veya “son çare” hata yöneticilerini desteklemez. Bu durumda, geliştiriciler uygulamanın beklenmeyen veya güvenlikle ilgili olayları güvenli şekilde ele almasını sağlamak için dile veya çerçeveye uygun desenler kullanmalıdır. + +## Referanslar + +Daha fazla bilgi için: + +* [OWASP Web Security Testing Guide: Testing for Error Handling](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/README) +* [OWASP Authentication Cheat Sheet section about error messages](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#authentication-and-error-messages) +* [OWASP Logging Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html) +* [OWASP Application Logging Vocabulary Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Vocabulary_Cheat_Sheet.html) diff --git a/5.0/tr/0x26-V17-WebRTC.md b/5.0/tr/0x26-V17-WebRTC.md new file mode 100644 index 0000000000..8706b284f4 --- /dev/null +++ b/5.0/tr/0x26-V17-WebRTC.md @@ -0,0 +1,75 @@ +# V17 WebRTC + +## Kontrol Amacı + +Web Gerçek Zamanlı İletişim (WebRTC), modern uygulamalarda gerçek zamanlı ses, görüntü ve veri alışverişini mümkün kılar. Kullanım yaygınlaştıkça, WebRTC altyapısının güvenliğinin sağlanması kritik hâle gelir. Bu bölüm, WebRTC sistemlerini geliştiren, barındıran veya entegre eden paydaşlar için güvenlik gereksinimlerini tanımlar. + +WebRTC pazarı genel olarak üç kategoriye ayrılabilir: + +1. Ürün Geliştiriciler: WebRTC ürün ve çözümlerini geliştiren ve sağlayan özel veya açık kaynak tedarikçileri. Odak noktaları, başkaları tarafından da kullanılabilecek sağlam ve güvenli WebRTC teknolojileri geliştirmektir. + +2. Hizmet Olarak İletişim Platformları (Communication Platforms as a Service - CPaaS): WebRTC işlevlerini mümkün kılmak için API, SDK ve altyapı/platform sağlayan hizmet sağlayıcılarıdır. CPaaS sağlayıcıları, birinci kategorideki ürünleri kullanabilir veya kendi WebRTC yazılımlarını geliştirerek bu hizmetleri sunabilirler. + +3. Hizmet Sağlayıcılar: Ürün geliştiricilerden veya CPaaS sağlayıcılarından alınan ürünleri kullanan ya da kendi WebRTC çözümlerini geliştiren kuruluşlardır. Bu sağlayıcılar çevrim içi konferans, sağlık, online eğitim gibi alanlarda gerçek zamanlı iletişimin kritik olduğu uygulamalar geliştirirler. + +Bu bölümdeki güvenlik gereksinimleri, özellikle aşağıdaki gibi sistemleri kullanan Ürün Geliştiriciler, CPaaS’ler ve Hizmet Sağlayıcıları için geçerlidir: + +* WebRTC uygulamalarını oluşturmak için açık kaynak çözümler kullananlar, +* Altyapılarının bir parçası olarak ticari WebRTC ürünlerini kullananlar, +* Kendi WebRTC çözümlerini geliştiren ya da çeşitli bileşenleri birleştirerek entegre hizmet sunanlar. + +Not: Bu güvenlik gereksinimleri yalnızca CPaaS sağlayıcılarının sunduğu SDK ve API'leri doğrudan kullanan geliştiricileri kapsamaz. Bu tür durumlarda, güvenlikten büyük ölçüde CPaaS sağlayıcısı sorumlu olur ve ASVS gibi genel güvenlik standartları her zaman tam olarak geçerli olmayabilir. + +## V17.1 TURN Sunucusu + +Bu bölüm, kendi TURN (Traversal Using Relays around NAT) sunucusunu işleten sistemler için güvenlik gereksinimlerini tanımlar. TURN sunucuları, kısıtlayıcı ağ ortamlarında medya iletimini sağlamak için kullanılır, ancak yanlış yapılandırıldıklarında güvenlik riski oluşturabilirler. Bu gereksinimler, güvenli IP filtrelemesi ve kaynak tüketimine karşı korumaları ele alır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **17.1.1** | TURN hizmetinin yalnızca özel amaçlar için ayrılmamış IP adreslerine (ör. iç ağlar, yayın adresleri, loopback) erişime izin verdiği doğrulanmalıdır. Bu gereksinim hem IPv4 hem de IPv6 adresleri için geçerlidir. | 2 | +| **17.1.2** | TURN hizmetinin, meşru kullanıcıların sunucuda çok sayıda bağlantı noktası açmaya çalışması durumunda kaynak tüketimi saldırılarına karşı dayanıklı olduğu doğrulanmalıdır. | 3 | + +## V17.2 Medya + +Bu gereksinimler yalnızca kendi WebRTC medya sunucularını (ör. SFU, MCU, kayıt sunucuları veya geçit sunucuları) barındıran sistemler için geçerlidir. Medya sunucuları, medya akışlarını işler ve dağıtır, bu da iletişim güvenliğini sağlamada kritik rol oynar. Medya akışlarını korumak dinlemeyi, kurcalamayı veya hizmet reddi (DoS) saldırılarını önlemek açısından önemlidir. + +Özellikle, hız sınırlama, zaman damgalarını doğrulama, gerçek zamanlı aralıkları eşleştirmek için senkronize saatler kullanma ve taşmayı önlemek ve uygun zamanlamayı korumak için arabellekleri (buffer) yönetme gibi flood saldırılarına karşı korumalar uygulamak gerekir. Belirli bir medya oturumu için paketler çok hızlı gelirse, fazla paketler düşürülmelidir. Girdi doğrulaması uygulayarak, tamsayı taşmalarını (integer overflow) güvenli bir şekilde ele alarak, arabellek taşmalarını (buffer overflow) önleyerek ve diğer sağlam hata işleme tekniklerini kullanarak sistemi hatalı biçimlendirilmiş paketlerden korumak da önemlidir. + +Sadece peer-to-peer medya iletişimi kullanan sistemler bu medya gereksinimlerinin kapsamı dışındadır. + +DTLS (Datagram Transport Layer Security) kullanımıyla ilgili gereksinimler burada yer alır. Kriptografik anahtarların yönetimi için bir politika oluşturulması "Kriptografi" bölümünde ele alınır. Onaylı şifreleme yöntemleri için ASVS’nin Kriptografi Ek’i veya NIST SP 800‑52 Rev. 2, BSI TR‑02102‑2 (2025‑01) gibi belgeler referans alınabilir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **17.2.1** | DTLS sertifikası anahtarının, belgelenmiş kriptografik anahtar yönetim politikasına uygun şekilde yönetildiği ve korunduğu doğrulanmalıdır. | 2 | +| **17.2.2** | Medya sunucusunun onaylı DTLS şifre takımlarını (cipher suites) ve Güvenli Gerçek Zamanlı Aktarım Protokolü (Secure Real-time Transport Protocol - SRTP) için anahtarlar oluşturmaya yönelik DTLS Uzantısı için güvenli bir koruma profilini kullanacak ve destekleyecek şekilde yapılandırıldığı (DTLS-SRTP) doğrulanmalıdır. | 2 | +| **17.2.3** | Real-time Transport Protocol (RTP) injection saldırılarının bir hizmet reddi durumuna veya medya akışlarına ses veya video medyası eklenmesine yol açmasını önlemek için medya sunucusunda Güvenli SRTP kimlik doğrulamasının kontrol edildiği doğrulanmalıdır. | 2 | +| **17.2.4** | Verify that the media server is able to continue processing incoming media traffic when encountering malformed Secure Real-time Transport Protocol (SRTP) packets. | 2 | +| **17.2.5** | Medya sunucusunun, meşru kullanıcılardan gelen SRTP flood'ı sırasında gelen medya trafiğini işlemeye devam edebildiği doğrulanmalıdır. | 3 | +| **17.2.6** | Medya sunucusunun DTLS içinde yer alan "ClientHello" yarış durumu güvenlik açığına karşı savunmasız olmadığı, medya sunucusunun güvenlik açığına sahip olduğunun açıkça bilinip bilinmediği kontrol edilerek veya yarış koşulu testi gerçekleştirilerek doğrulanmalıdır. | 3 | +| **17.2.7** | Medya sunucusuna bağlı ses veya video kayıt mekanizmalarının, meşru kullanıcı kaynaklı SRTP flood'ı sırasında medya trafiğini işlemeye devam edebildiği doğrulanmalıdır. | 3 | +| **17.2.8** | DTLS sertifikasının, SDP (Session Description Protocol) fingerprint özelliği ile karşılaştırıldığı ve doğrulama başarısız olursa medya akışının sonlandırıldığı, medya akışının özgünlüğünü sağlamak için doğrulanmalıdır. | 3 | + +## V17.3 Sinyalizasyon + +Bu bölüm, kendi WebRTC sinyalizasyon sunucularını işleten sistemler için güvenlik gereksinimlerini tanımlar. Sinyalizasyon, peer-to-peer iletişimi koordine eder ve oturum kurulumunu veya kontrolünü bozabilecek saldırılara karşı dayanıklı olmalıdır. + +Sinyalizasyonun güvenli olması için sistemler bozuk girdileri zararsız biçimde işleyebilmeli ve yük altında erişilebilir kalmalıdır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **17.3.1** | Sinyalizasyon sunucusunun, flood saldırısı altında bile meşru sinyalizasyon mesajlarını işlemeye devam edebildiği doğrulanmalıdır. Bu, sinyalizasyon düzeyinde oran sınırlaması uygulanarak sağlanmalıdır. | 2 | +| **17.3.2** | Sinyalizasyon sunucusunun, hizmet reddine yol açabilecek şekilde yapılandırılmış bozuk sinyalizasyon mesajlarıyla karşılaştığında bile meşru mesajları işlemeye devam edebildiği doğrulanmalıdır. Bu, girdi doğrulaması, integer overflow ve buffer overflow'a karşı savunma ve sağlam hata işleme teknikleri ile sağlanmalıdır. | 2 | + +## Referanslar + +Daha fazla bilgi için: + +* WebRTC DTLS ClientHello DoS hakkında en iyi dokümantasyonlar: [Enable Security's blog post aimed at security professionals](https://www.enablesecurity.com/blog/novel-dos-vulnerability-affecting-webrtc-media-servers/) ve ilgili, [WebRTC geliştiricilerine yönelik white paper](https://www.enablesecurity.com/blog/webrtc-hello-race-conditions-paper/) +* [RFC 3550 - RTP: A Transport Protocol for Real-Time Applications](https://www.rfc-editor.org/rfc/rfc3550) +* [RFC 3711 - The Secure Real-time Transport Protocol (SRTP)](https://datatracker.ietf.org/doc/html/rfc3711) +* [RFC 5764 - Datagram Transport Layer Security (DTLS) Extension to Establish Keys for the Secure Real-time Transport Protocol (SRTP))](https://datatracker.ietf.org/doc/html/rfc5764) +* [RFC 8825 - Overview: Real-Time Protocols for Browser-Based Applications](https://www.rfc-editor.org/info/rfc8825) +* [RFC 8826 - Security Considerations for WebRTC](https://www.rfc-editor.org/info/rfc8826) +* [RFC 8827 - WebRTC Security Architecture](https://www.rfc-editor.org/info/rfc8827) +* [DTLS-SRTP Protection Profiles](https://www.iana.org/assignments/srtp-protection/srtp-protection.xhtml) diff --git a/5.0/tr/0x90-Appendix-A_Glossary.md b/5.0/tr/0x90-Appendix-A_Glossary.md new file mode 100644 index 0000000000..1b1a1856f8 --- /dev/null +++ b/5.0/tr/0x90-Appendix-A_Glossary.md @@ -0,0 +1,88 @@ +# Ek A: Sözlük + +* **Absolute Maximum Session Lifetime (Mutlak Maksimum Oturum Ömrü)** – NIST tarafından “Genel Zaman Aşımı” olarak da adlandırılan bu süre, kullanıcı etkileşiminden bağımsız olarak kimlik doğrulamasının ardından bir oturumun etkin kalabileceği maksimum süredir. Bu, oturum sona erme süresinin bir bileşenidir. +* **Allowlist (İzin Listesi)** – İzin verilen veri veya işlemlerin listesi, örneğin girdi doğrulaması yapmak için izin verilen karakterlerin listesi. +* **Anti-forgery token** – Bir veya daha fazla belirtecin bir istekte geçirildiği ve isteğin beklenen bir uç noktadan geldiğinden emin olmak için uygulama sunucusu tarafından doğrulandığı bir mekanizmadır. +* **Application Security (Uygulama Güvenliği)** – Uygulama düzeyinde güvenlik, örneğin altta yatan işletim sistemine veya bağlı ağlara odaklanmak yerine Açık Sistemler Ara Bağlantı Referans Modeli'nin (Open Systems Interconnection Reference Model - OSI Model) uygulama katmanını oluşturan bileşenlerin analizine odaklanır. +* **Application Security Verification (Uygulama Güvenliği Doğrulaması)** – Bir uygulamanın OWASP ASVS'ye göre teknik değerlendirmesidir. +* **Application Security Verification Report (Uygulama Güvenliği Doğrulaması Raporu)** – Belirli bir uygulama için doğrulayıcı tarafından üretilen genel sonuçları ve destekleyici analizi belgeleyen bir rapordur. +* **Authentication (Kimlik Doğrulama)** – Bir uygulama kullanıcısının iddia ettiği kimliğinin doğrulanmasıdır. +* **Automated Verification (Otomatik Doğrulama)** – Sorunları bulmak için güvenlik açığı imzalarını kullanan otomatik araçların (dinamik analiz araçları, statik analiz araçları veya her ikisi) kullanılmasıdır. +* **Black box testing** – Bir uygulamanın iç yapılarına veya işleyişine bakmadan işlevselliğini inceleyen bir yazılım testi yöntemidir. +* **Common Weakness Enumeration** (CWE) – Yaygın yazılım güvenlik zayıflıklarının topluluk tarafından geliştirilen bir listesi. Ortak bir dil, yazılım güvenlik araçları için bir ölçüm kriteri ve zayıflık tanımlama, azaltma ve önleme çabaları için bir temel olarak hizmet eder. +* **Component (Bileşen)** – Diğer bileşenlerle iletişim kuran ilişkili disk ve ağ arayüzlerine sahip bağımsız bir kod birimidir. +* **Credential Service Provider (Kimlik Bilgisi Hizmet Sağlayıcısı)** (CSP) – Kimlik Sağlayıcısı ( Identity Provider - IdP) olarak da adlandırılır. Diğer uygulamalar tarafından kimlik doğrulama kaynağı olarak kullanılabilecek bir kullanıcı verisi kaynağıdır. +* **Cross-Site Script Inclusion (Siteler Arası Komut Dosyası Ekleme)** (XSSI) - Bir web uygulamasının harici bir kaynaktan kötü amaçlı kod aldığı ve bu kodu kendi içeriğinin bir parçası olarak dahil ettiği Siteler Arası Komut Çalıştırma (XSS) saldırısının bir çeşididir. +* **Cross-Site Scripting (Siteler Arası Komut Çalıştırma)** (XSS) – Genellikle web uygulamalarında bulunan ve istemci tarafı komut dosyalarının içeriğe eklenmesine izin veren bir güvenlik açığıdır. +* **Cryptographic module (Kriptografik modül)** – Kriptografik algoritmalar uygulayan ve/veya kriptografik anahtarlar üreten donanım, yazılım ve/veya ürün yazılımıdır. +* **Cryptographically secure pseudo-random number generator (Kriptografik olarak güvenli sözde rastgele sayı üreteci)** (CSPRNG) - Kriptografide kullanıma uygun özelliklere sahip bir sözde rastgele sayı üreteci, kriptografik rastgele sayı üreteci (CRNG) olarak da adlandırılır. +* **Datagram Transport Layer Security (Datagram Taşıma Katmanı Güvenliği)** (DTLS) – Bir ağ bağlantısı üzerinden iletişim güvenliği sağlayan bir kriptografik protokoldür. TLS protokolüne dayanır ancak datagram odaklı protokolleri (genellikle UDP üzerinden) korumak için uyarlanmıştır. DTLS 1.3 için RFC 9147'de tanımlanmıştır. +* **Datagram Transport Layer Security Extension to Establish Keys for the Secure Real-time Transport Protocol (Güvenli Gerçek Zamanlı Aktarım Protokolü Anahtarlarını Oluşturmak için Datagram Aktarım Katmanı Güvenlik Uzantısı)** (DTLS-SRTP) – Bir SRTP oturumu için anahtar materyali oluşturmak üzere DTLS el sıkışmasını kullanmaya yönelik bir mekanizmadır. RFC 5764'te tanımlanmıştır. +* **Design Verification (Tasarım Doğrulama)** – Bir uygulamanın güvenlik mimarisinin teknik değerlendirmesidir. +* **Dynamic Application Security Testing (Dinamik Uygulama Güvenlik Testi)** (DAST) – Bir uygulamadaki güvenlik açığını gösteren koşulları, uygulamanın çalışır durumunda tespit etmek için tasarlanan teknolojilerdir. +* **Dynamic Verification (Dinamik Doğrulama)** – Bir uygulamanın çalışması sırasında sorunları tespit etmek için güvenlik açığı imzalarını kullanan otomatik araçların kullanımıdır. +* **Fast IDentity Online** (FIDO) – Biyometri, Güvenilir Platform Modülü (Trusted Platform Modules - TPM), USB güvenlik token’ları gibi çeşitli kimlik doğrulama yöntemlerinin kullanımına olanak tanıyan bir kimlik doğrulama standartları kümesidir. +* **Hardware Security Module (Donanım Güvenlik Modülü)** (HSM) – Kriptografik anahtarları ve diğer gizli verileri korumalı şekilde saklayan donanım bileşenidir. +* **Hibernate Query Language** (HQL) – Hibernate ORM kütüphanesi tarafından kullanılan, görünüm olarak SQL’e benzeyen bir sorgu (query) dilidir. +* **HTTP Strict Transport Security (HTTP Sıkı Taşıma Güvenliği)** (HSTS) – Tarayıcının yalnızca TLS üzerinden ve geçerli bir sertifika ile yanıt dönen alan adına bağlanmasını zorunlu kılan bir ilkedir. `Strict-Transport-Security` header field ile etkinleştirilir. +* **HyperText Transfer Protocol** (HTTP) – Dağıtık, işbirlikçi, çok ortamlı bilgi sistemleri için bir uygulama protokolüdür. Dünya Çapında Ağ (WWW) veri iletişiminin temelini oluşturur. +* **SSL/TLS üzerinden HyperText Transfer Protocol** (HTTPS) – HTTP iletişimini Taşıma Katmanı Güvenliği (TLS) ile şifreleyerek güvenli hale getirme yöntemidir. +* **Identity Provider (Kimlik Sağlayıcı)** (IdP) – NIST belgelerinde Kimlik Bilgisi Hizmet Sağlayıcısı (CSP) olarak da adlandırılır. Diğer uygulamalar için kimlik doğrulama kaynağı sağlayan bir varlıktır. +* **Inactivity Timeout (Etkin Olmama Zaman Aşımı)** – Bir oturumun, kullanıcı uygulama ile etkileşime girmediği sürede aktif kalabileceği süredir. Oturum zaman aşımının bir bileşenidir. +* **Input Validation (Girdi Doğrulama)** – RFC 7519 tarafından tanımlanan ve bir başlık (doğrulama yöntemini belirtir), bir gövde (iddiaları içerir) ve bir imza (gövdeyi doğrulamak için kullanılır) olmak üzere üç bölümden oluşan bir JSON veri nesnesidir. Kendi kendini içeren bir token (self-contained token) türüdür. +* **Local File Inclusion** (LFI) - Bir uygulamadaki savunmasız dosya dahil etme işlemlerinin sömürülmesiyle, sunucuda hâlihazırda bulunan yerel dosyaların dahil edilmesine yol açan saldırı türüdür. +* **Malicious Code (Kötü Amaçlı Kod)** – Uygulamanın geliştirme aşamasında uygulama sahibinin bilgisi dışında eklenen ve uygulamanın tasarlanan güvenlik politikasını aşmayı amaçlayan koddur. Virüs veya solucan gibi kötü amaçlı yazılımlardan (malware) farklıdır! +* **Malware (Kötü Amaçlı Yazılım)** – Uygulama çalışırken, kullanıcı veya yönetici farkında olmadan uygulamaya enjekte edilen çalıştırılabilir koddur. +* **Message authentication code (Mesaj Doğrulama Kodu)** (MAC) - Verinin bütünlüğünü ve özgünlüğünü sağlamak amacıyla bir MAC üretim algoritmasıyla hesaplanan kriptografik sağlama (checksum) değeridir. +* **Multi-factor authentication (Çok Faktörlü Kimlik Doğrulama)** (MFA) – İki veya daha fazla tekil faktörün bir arada kullanıldığı kimlik doğrulama yöntemidir. +* **Mutual TLS** (mTLS) – Bkz. TLS istemci kimlik doğrulaması. +* **Object-relational Mapping** (ORM) – İlişkisel (tablolu) bir veritabanının, uygulama içinde nesne tabanlı bir model üzerinden referans alınmasını ve sorgulanmasını sağlayan sistemdir. +* **One-time Password (Tek Kullanımlık Parola)** (OTP) – Sadece tek bir kullanım için benzersiz olarak üretilen paroladır. +* **Open Worldwide Application Security Project** (OWASP) – Uygulama yazılımlarının güvenliğini geliştirmeye odaklı, küresel ve açık bir topluluktur. Misyonu, uygulama güvenliğini “görünür” kılmak ve bireyler ile kurumların güvenlik risklerine dair bilinçli kararlar verebilmesini sağlamaktır. Bkz: [https://www.owasp.org/](https://www.owasp.org/). +* **Password-Based Key Derivation Function 2** (PBKDF2) – Bir giriş metninden (örn. parola) ve rastgele bir tuz (salt) değerinden güçlü bir kriptografik anahtar türeten, tek yönlü özel bir algoritmadır. Sonuç değeri özgün parola yerine saklandığında, parolanın çevrimdışı ortamda kırılmasını zorlaştırmak amacıyla kullanılır. +* **Public Key Infrastructure (Açık Anahtar Altyapısı)** (PKI) – Açık anahtarların ilgili varlıkların kimlikleriyle ilişkilendirilmesini sağlayan bir yapıdır. Bu ilişkilendirme, bir sertifika otoritesi (CA) tarafından gerçekleştirilen kayıt ve sertifika oluşturma süreciyle sağlanır. +* **Public Switched Telephone Network (Genel Anahtarlamalı Telefon Ağı)** (PSTN) – Sabit hatlı ve mobil telefonları içeren geleneksel telefon ağıdır. +* **Real-time Transport Protocol (Gerçek Zamanlı Taşıma Protokolü)** (RTP) ve **Real-time Transport Control Protocol (Gerçek Zamanlı Taşıma Denetim Protokolü)** (RTCP) – Multimedya akışlarını taşımak için birlikte kullanılan iki protokoldür. WebRTC yığını tarafından kullanılır. RFC 3550’de tanımlanmıştır. +* **Reference Token** – Sunucuda tutulan duruma veya meta veriye işaret eden veya onu tanımlayan, bazen rastgele veya opak token olarak da adlandırılan bir token türüdür. Kendi kendini içeren token’lardan farklı olarak, içeriğinde anlamlı bilgi taşımaz ve bağlam tamamen sunucu tarafından sağlanır. Genellikle bir oturum tanımlayıcısı içerir veya doğrudan bu tanımlayıcıyı temsil eder. +* **Relying Party** (RP) – Genellikle, kullanıcının ayrı bir kimlik sağlayıcı ile kimlik doğrulaması yaptığına güvenen bir uygulamadır. Bu uygulama, kullanıcıya ait olduğunu doğrulamak için kimlik sağlayıcı tarafından sağlanan bir token’a veya imzalı beyanlara dayanır. +* **Remote File Inclusion** (RFI) - Uygulamadaki zafiyet içeren dosya dahil etme işlemlerinin sömürülmesiyle, uzak sistemlerden dosya dahil edilmesine yol açan saldırı türüdür. +* **Scalable Vector Graphics** (SVG) – İki boyutlu vektör grafiklerini tanımlamak için kullanılan, XML tabanlı bir işaretleme dilidir. +* **Secure Real-time Transport Protocol (Güvenli Gerçek Zamanlı Taşıma Protokolü)** (SRTP) and **Secure Real-time Transport Control Protocol (Güvenli Gerçek Zamanlı Taşıma Denetim Protokolü)** (SRTCP) – RTP ve RTCP protokollerinin, mesaj şifreleme, kimlik doğrulama ve bütünlük koruması desteği sunan güvenli sürümleridir. RFC 3711’de tanımlanmıştır. +* **Security Architecture (Güvenlik Mimarisi)** – Uygulamanın tasarımına dair bir soyutlamadır. Güvenlik kontrollerinin nerede ve nasıl kullanıldığını, kullanıcı ve uygulama verilerinin nerede bulunduğunu ve hassasiyet seviyelerini tanımlar. +* **Security Assertion Markup Language** (SAML) – Kimlik sağlayıcı ile güvenen taraf arasında imzalı beyanların (genellikle XML nesneleri) iletilmesine dayalı, açık bir tek oturum açma (SSO) standardıdır. +* **Security Configuration (Güvenlik Yapılandırması)** – Uygulamanın çalışma zamanında, güvenlik kontrollerinin nasıl kullanılacağını etkileyen yapılandırma bilgileridir. +* **Security Control (Güvenlik Kontrolü)** – Bir güvenlik denetimi gerçekleştiren (örn. yetkilendirme kontrolü) ya da çağrıldığında güvenlikle ilgili bir etki oluşturan (örn. denetim kaydı üretme) işlev veya bileşendir. +* **Security information and event management** (SIEM) - Bir kuruluşun BT altyapısından gelen güvenlik verilerini toplayarak tehdit tespiti, uyumluluk ve olay yönetimi amacıyla analiz eden bir sistemdir. +* **Self-Contained Token (Kendi İçinde Taşıyıcı Token)** – Herhangi bir sunucu tarafı duruma veya harici saklamaya bağımlı olmayan, bir veya birden fazla niteliği içinde barındıran token’dır. Bu token’lar, içeriklerinin doğruluğunu ve bütünlüğünü sağlamak için dijital imza veya ileti doğrulama kodu (MAC) gibi kriptografik tekniklerle korunur. Örnekler: SAML beyanları, JWT. +* **Server-side Request Forgery** (SSRF) – Sunucudaki işlevselliğin suistimal edilerek iç kaynakların okunması veya güncellenmesi ile sonuçlanan saldırı türüdür. Saldırgan, sunucu üzerinde çalışacak olan URL’yi doğrudan sağlar ya da değiştirir. +* **Session Description Protocol** (SDP) – Multimedya oturumu kurulumunda kullanılan bir mesaj formatıdır (örneğin WebRTC'de kullanılır). RFC 4566’da tanımlanmıştır. +* **Session Identifier** veya **Session ID** – Backend'de saklanan durumlu bir oturumu tanımlayan anahtardır. İstemciye, doğrudan veya bir Referans Token içinde aktarılır. +* **Session Token** – Bu standartta, self-contained token kullanan ve durum barındırmayan oturum mekanizmalarında ya da reference token kullanan ve durum barındıran mekanizmalarda kullanılan token veya değeri ifade eden genel bir terimdir. +* **Session Traversal Utilities for NAT** (STUN) – Eşler arası iletişim kurmak amacıyla NAT geçişine yardımcı olan bir protokoldür. RFC 3489’da tanımlanmıştır. +* **Single-factor authenticator (Tek Faktörlü Kimlik Doğrulayıcı)** – Kullanıcının kimliğini doğrulamak için kullanılan mekanizmadır. Bu mekanizma ya bilinen bir şey (parolalar, PIN’ler), ya sahip olunan bir şey (OTP token’ları, akıllı kart gibi kriptografik cihazlar), ya da kullanıcıya özgü bir şey (biyometrik veriler, parmak izi, yüz taraması) olmalıdır. +* **Single Sign-on Authentication (Tek Oturum Açma)** (SSO) – Kullanıcının bir uygulamaya giriş yaptıktan sonra, ek bir kimlik doğrulama gerekmeksizin diğer uygulamalara da otomatik olarak giriş yapabilmesidir. Örneğin, Google hesabına giriş yapan bir kullanıcı, YouTube, Google Dokümanlar ve Gmail’e de otomatik olarak erişim sağlar. +* **Software bill of materials (Yazılım Bileşen Listesi)** (SBOM) - Bir yazılım uygulamasını oluşturmak veya birleştirmek için gerekli tüm bileşenlerin, modüllerin, kütüphanelerin, çatıların (framework) ve diğer kaynakların yapılandırılmış ve kapsamlı bir listesidir. +* **Software Composition Analysis** (SCA) – Uygulamanın bileşimini, bağımlılıklarını, kütüphanelerini ve paketlerini analiz ederek kullanılan belirli bileşen sürümlerindeki güvenlik açıklarını tespit etmeye yönelik teknolojiler bütünüdür. Kaynak kod analizi (SAST) ile karıştırılmamalıdır. +* **Software development lifecycle** (SDLC) – Yazılımın, ilk gereksinimlerden dağıtım ve bakıma kadar geçen süreçte adım adım geliştirilmesini tanımlayan modeldir. +* **SQL Injection** (SQLi) – Veri odaklı uygulamalara yönelik bir kod enjeksiyon tekniğidir. Kötü niyetli SQL ifadeleri bir giriş noktasına enjekte edilir. +* **Stateful Session Mechanism** – Oturum durumunun backend'de tutulduğu oturum yönetim biçimidir. Genellikle kriptografik olarak güvenli sahte rastgele sayı üreteci (CSPRNG) ile oluşturulmuş bir oturum token’ı son kullanıcıya verilir. +* **Stateless Session Mechanism** – Hizmet tarafından saklanmayan, oturum bilgilerini taşıyan kendi kendini içeren bir token’ın istemcilere iletildiği mekanizmadır. Gerçekte, hizmetin belirli güvenlik kontrollerini uygulayabilmesi için (örneğin JWT iptal listesi gibi) oturum bilgilerine kısmen erişmesi gerekebilir. +* **Static application security testing (Statik Uygulama Güvenlik Testi)** (SAST) – Uygulamanın kaynak kodunu, bayt kodunu ve ikili dosyalarını çalışmayan (non-running) durumda analiz ederek güvenlik açıklarını ortaya çıkaran teknolojiler bütünüdür. Uygulamayı "içeriden dışarı" analiz eder. +* **Threat Modeling (Tehdit Modelleme)** – Tehdit aktörleri, güvenlik bölgeleri, güvenlik kontrolleri ile teknik ve iş varlıklarını tanımlamak amacıyla gittikçe rafine edilen güvenlik mimarilerinin geliştirilmesini içeren bir tekniktir. +* **Time-of-check to time-of-use (Denetim Zamanı ile Kullanım Zamanı Arasındaki Süre)** (TOCTOU) – Bir kaynağın durumu uygulama tarafından kullanılmadan önce kontrol edilir, fakat bu durum kontrol ile kullanım arasında değişebilir. Bu da kontrolün geçersiz hale gelmesine ve yanlış işlemlerin gerçekleştirilmesine neden olabilir. +* **Time based One-time Passwords (Zamana Dayalı Tek Kullanımlık Parola)** (TOTPs) - Şifreyi üretmek için algoritmada mevcut zamanın kullanıldığı bir OTP üretim yöntemidir. +* **TLS client authentication (TLS İstemci Kimlik Doğrulaması)** veya **Mutual TLS (Karşılıklı TLS)** (mTLS) – Standart bir TLS bağlantısında istemci, sunucunun kimliğini sunucu sertifikası ile doğrular. TLS istemci kimlik doğrulamasında ise istemci de kendi özel anahtarı ve sertifikası ile kendi kimliğini sunucuya doğrulatır. +* **Transport Layer Security (Taşıma Katmanı Güvenliği)** (TLS) – Ağ üzerinden güvenli iletişim sağlamak için kullanılan kriptografik protokoller bütünüdür. +* **Traversal Using Relays around NAT (NAT Etrafında Aktarıcılar Kullanılarak Geçiş )** (TURN) – Eşler arası doğrudan bağlantılar kurulamadığında, bir TURN sunucusu aracılığıyla veri iletimi yapılmasını sağlayan STUN protokolünün bir uzantısıdır. RFC 8656’da tanımlanmıştır. +* **Trusted execution environment (Güvenli Yürütme Ortamı)** (TEE) - Sistemin geri kalanından izole bir işlem ortamında uygulamaların güvenli bir şekilde çalıştırılabildiği özel bir alan. +* **Trusted Platform Module (Güvenilir Platform Modülü)** (TPM) – Genellikle anakart gibi daha büyük donanımlara bağlı olan, sistemin “güven kökü (root of trust)” olarak görev yapan HSM türüdür. +* **Trusted Service Layer (Güvenilir Hizmet Katmanı)** – Mikro servis, sunucusuz API, sunucu tarafı, güvenli önyüklemeli istemci API’si, ortak veya harici API’ler gibi, bir güvenlik kontrolü uygulayan ve kötü niyetli kullanıcıların atlayamayacağı katmanlardır. +* **Uniform Resource Identifier** (URI)- Web sayfası, e-posta adresi veya konum gibi bir kaynağı tanımlayan benzersiz karakter dizisidir. +* **Uniform Resource Locator** (URL) – İnternette bir kaynağın konumunu belirten karakter dizisidir. +* **Universally Unique Identifier (Evrensel Benzersiz Tanımlayıcı)** (UUID) – Yazılımlarda kimlik belirleme amacıyla kullanılan benzersiz referans numarasıdır. +* **Verifier (Doğrulayıcı)** – Bir uygulamayı OWASP ASVS gereksinimlerine göre inceleyen kişi veya ekip. +* **Web Real-Time Communication** (WebRTC) – Web uygulamalarında genellikle görüntülü görüşme amacıyla kullanılan, multimedya akışlarını taşıyan protokol yığını ve web API’sidir. SRTP, SRTCP, DTLS, SDP ve STUN/TURN üzerine kuruludur. +* **WebSocket over TLS** (WSS) – WebSocket iletişimini TLS protokolü ile katmanlayarak güvenli hale getirme uygulamasıdır. +* **What You See Is What You Get** (WYSIWYG) – İçeriğin nasıl görüntüleneceğini doğrudan düzenleme sırasında gösteren zengin metin düzenleyicisidir. Kod görünümü yerine gerçek görünümü gösterir. +* **X.509 Certificate** – Uluslararası X.509 açık anahtar altyapısı (PKI) standardını kullanan ve bir açık anahtarın sertifikada yer alan kullanıcıya, bilgisayara veya hizmete ait olduğunu doğrulayan dijital sertifikadır. +* **XML eXternal Entity** (XXE) – Sistem tanımlayıcısı ile yerel veya uzak içeriğe erişebilen XML varlığı türüdür. Farklı enjeksiyon saldırılarına neden olabilir. diff --git a/5.0/tr/0x91-Appendix-B_References.md b/5.0/tr/0x91-Appendix-B_References.md new file mode 100644 index 0000000000..125eda58aa --- /dev/null +++ b/5.0/tr/0x91-Appendix-B_References.md @@ -0,0 +1,43 @@ +# Ek B: Referanslar + +Aşağıdaki OWASP projeleri, bu standardın kullanıcıları/uygulayıcıları için yararlı olabilir: + +## OWASP Ana Projeleri + +1. OWASP Top 10 Project: [https://owasp.org/www-project-top-ten/](https://owasp.org/www-project-top-ten/) +2. OWASP Web Security Testing Guide: [https://owasp.org/www-project-web-security-testing-guide/](https://owasp.org/www-project-web-security-testing-guide/) +3. OWASP Proactive Controls: [https://owasp.org/www-project-proactive-controls/](https://owasp.org/www-project-proactive-controls/) +4. OWASP Software Assurance Maturity Model (SAMM): [https://owasp.org/www-project-samm/](https://owasp.org/www-project-samm/) +5. OWASP Secure Headers Project: [https://owasp.org/www-project-secure-headers/](https://owasp.org/www-project-secure-headers/) + +## OWASP Cheat Sheet Series Projesi + +[Bu proje](https://owasp.org/www-project-cheat-sheets/) ASVS'deki farklı konularla ilgili olacak birkaç cheat sheet'e sahiptir. + +ASVS ile ilgili bir haritalandırmaya buradan ulaşabilirsiniz: [https://cheatsheetseries.owasp.org/IndexASVS.html](https://cheatsheetseries.owasp.org/IndexASVS.html) + +## Mobil Güvenlikle İlgili Projeler + +1. OWASP Mobile Security Project: [https://owasp.org/www-project-mobile-security/](https://owasp.org/www-project-mobile-security/) +2. OWASP Mobile Top 10 Risks: [https://owasp.org/www-project-mobile-top-10/](https://owasp.org/www-project-mobile-top-10/) +3. OWASP Mobile Security Testing Guide and Mobile Application Security Verification Standard: [https://owasp.org/www-project-mobile-security-testing-guide/](https://owasp.org/www-project-mobile-security-testing-guide/) + +## OWASP Nesnelerin İnterneti (Internet of Things) İle İlgili Projeler + +1. OWASP Internet of Things Project: [https://owasp.org/www-project-internet-of-things/](https://owasp.org/www-project-internet-of-things/) + +## OWASP Serverless Projeleri + +1. OWASP Serverless Project: [https://owasp.org/www-project-serverless-top-10/](https://owasp.org/www-project-serverless-top-10/) + +## Diğerleri + +Benzer şekilde, aşağıdaki web siteleri de bu standardın kullanıcıları/uygulayıcıları için yararlı olabilir: + +1. SecLists Github: [https://github.com/danielmiessler/SecLists](https://github.com/danielmiessler/SecLists) +2. MITRE Common Weakness Enumeration: [https://cwe.mitre.org/](https://cwe.mitre.org/) +3. PCI Security Standards Council: [https://www.pcisecuritystandards.org/](https://www.pcisecuritystandards.org/) +4. PCI Data Security Standard (DSS) v3.2.1 Requirements and Security Assessment Procedures: [https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf](https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf) +5. PCI Software Security Framework - Secure Software Requirements and Assessment Procedures: [https://www.pcisecuritystandards.org/documents/PCI-Secure-Software-Standard-v1_0.pdf](https://www.pcisecuritystandards.org/documents/PCI-Secure-Software-Standard-v1_0.pdf) +6. PCI Secure Software Lifecycle (Secure SLC) Requirements and Assessment Procedures: [https://www.pcisecuritystandards.org/documents/PCI-Secure-SLC-Standard-v1_0.pdf](https://www.pcisecuritystandards.org/documents/PCI-Secure-SLC-Standard-v1_0.pdf) +7. OWASP ASVS 4.0 Testing Guide [https://github.com/BlazingWind/OWASP-ASVS-4.0-testing-guide](https://github.com/BlazingWind/OWASP-ASVS-4.0-testing-guide) diff --git a/5.0/tr/0x92-Appendix-C_Cryptography.md b/5.0/tr/0x92-Appendix-C_Cryptography.md new file mode 100644 index 0000000000..a557a175b3 --- /dev/null +++ b/5.0/tr/0x92-Appendix-C_Cryptography.md @@ -0,0 +1,304 @@ +# Ek C: Kriptografi Standartları + +“Kriptografi” bölümü sadece en iyi uygulamaları tanımlamanın ötesine geçmektedir. Kriptografi ilkelerinin daha iyi anlaşılmasını ve daha esnek, modern güvenlik yöntemlerinin benimsenmesini teşvik etmeyi amaçlamaktadır. Bu ek, “Kriptografi” bölümünde ana hatlarıyla belirtilen kapsayıcı standartları tamamlayan her bir gereklilikle ilgili ayrıntılı teknik bilgi sağlamaktadır. + +Bu ek, farklı kriptografik mekanizmalar için onay seviyesini tanımlar: + +* Onaylanmış (A) mekanizmalar uygulamalarda kullanılabilir. +* Eski (Legacy) mekanizmalar (L) uygulamalarda kullanılmamalıdır, ancak yine de yalnızca mevcut eski uygulamalar veya kodlarla uyumluluk için kullanılabilir. Bu tür mekanizmaların kullanımı şu anda kendi başına bir güvenlik açığı olarak kabul edilmese de, mümkün olan en kısa sürede daha güvenli ve geleceğe dönük mekanizmalarla değiştirilmelidir. +* İzin verilmeyen (Disallowed) mekanizmalar (D) şu anda bozuk kabul edildikleri veya yeterli güvenlik sağlamadıkları için kullanılmamalıdır. + +Bu liste, belirli bir uygulama bağlamında, aşağıdakiler de dahil olmak üzere çeşitli nedenlerle geçersiz kılınabilir: + +* kriptografi alanındaki yeni gelişmeler; +* yönetmeliklere uygunluk. + +## Kriptografik Envanter ve Dokümantasyon + +Bu bölüm V11.1 Kriptografik Envanter +ve Dokümantasyon için ek bilgi sağlamaktadır. + +Algoritmalar, anahtarlar ve sertifikalar gibi tüm kriptografik varlıkların düzenli olarak keşfedildiğinden, envanterinin çıkarıldığından ve değerlendirildiğinden emin olmak önemlidir. Seviye 3 için bu, bir uygulamada kriptografi kullanımını keşfetmek için statik ve dinamik tarama kullanımını içermelidir. SAST ve DAST gibi araçlar bu konuda yardımcı olabilir, ancak daha geniş bir kapsam elde etmek için özel araçlara ihtiyaç duyulması mümkündür. Ücretsiz araç örnekleri şunları içerir: + +* [CryptoMon - Network Cryptography Monitor - using eBPF, written in python](https://github.com/Santandersecurityresearch/CryptoMon) +* [Cryptobom Forge Tool: Generating Comprehensive CBOMs from CodeQL Outputs](https://github.com/Santandersecurityresearch/cryptobom-forge) + +## Kriptografik Parametrelerin Eşdeğer Güçleri + +Çeşitli kriptografik sistemler için göreceli güvenlik güçleri bu tabloda yer almaktadır: [NIST SP 800-57 Kısım 1, syf.71](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final) + +| Güvenlik Gücü | Simetrik Anahtar Algoritmaları | Sonlu Alan | Tamsayı Çarpanlarına Ayırma | Eliptik Eğri (Elliptic Curve) | +|--|--|--|--|--| +| <= 80 | 2TDEA | L = 1024
N = 160 | k = 1024 | f = 160-223 | +| 112 | 3TDEA | L = 2048
N = 224 | k = 2048 | f = 224-255 | +| 128 | AES-128 | L = 3072
N = 256 | k = 3072 | f = 256-383 | +| 192 | AES-192 | L = 7680
N = 384 | k = 7680 | f = 384-511 | +| 256 | AES-256 | L = 15360
N = 512 | k = 15360 | f = 512+ | + +Uygulama örnekleri şunlardır: + +* Sonlu Alan Kriptografisi (Finite Field Cryptography): DSA, FFDH, MQV +* Tamsayı Çarpanlarına Ayırma Kriptografisi (Integer Factorization Cryptography): RSA +* Eliptik Eğri Kriptografisi (Elliptic Curve Cryptography): ECDSA, EdDSA, ECDH, MQV + +Not: Bu bölümde kuantum bilgisayarlarının var olmadığı varsayılmaktadır. Eğer böyle bir bilgisayar var olsaydı, son 3 sütun için yapılan tahminler artık geçerli olmazdı. + +## Rastgele Değerler + +Bu bölümde V11.5 Rastgele Değerler +için ek bilgi sağlanmaktadır. + +| İsim | Sürüm/Referans | Notlar | Durum | +|:-:|:-:|:-:|:-:| +| `/dev/random` | Linux 4.8+ [(Oct 2016)](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=818e607b57c94ade9824dad63a96c2ea6b21baf3), , iOS, Android ve diğer Linux tabanlı POSIX işletim sistemlerinde de bulunur. [RFC7539](https://datatracker.ietf.org/doc/html/rfc7539) temel alınmıştır. | ChaCha20 akışını kullanır. iOS [`SecRandomCopyBytes`](https://developer.apple.com/documentation/security/secrandomcopybytes(_:_:_:)?language=objc) ve Android [`Secure Random`](https://developer.android.com/reference/java/security/SecureRandom) içinde her biri için sağlanan doğru ayarlarla bulunur.| A | +| `/dev/urandom` | Linux çekirdeğinin rastgele veri sağlamak için özel dosyası | Donanım rastgeleliğinden gelen yüksek kaliteli, entropi kaynakları sağlar | A | +| `AES-CTR-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | [Windows CNG API `BCryptGenRandom`](https://learn.microsoft.com/en-us/windows/win32/api/bcrypt/nf-bcrypt-bcryptgenrandom) gibi yaygın uygulamalarda kullanıldığı gibi, [`BCRYPT_RNG_ALGORITHM`](https://learn.microsoft.com/en-us/windows/win32/seccng/cng-algorithm-identifiers) tarafından ayarlanır. | A | +| `HMAC-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | | A | +| `Hash-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | | A | +| `getentropy()` | [OpenBSD](https://man.openbsd.org/getentropy.2), [Linux glibc 2.25+](https://man7.org/linux/man-pages/man3/getentropy.3.html) ve [macOS 10.12+](https://support.apple.com/en-gb/guide/security/seca0c73a75b/web) sürümlerinde mevcuttur. | Doğrudan çekirdeğin entropi kaynağından basit ve minimal bir API ile güvenli rastgele baytlar sağlar. Daha moderndir ve eski API'lerle ilişkili tuzaklardan kaçınır. | A | + +HMAC-DRBG veya Hash-DRBG ile kullanılan temel hash fonksiyonu, bu kullanım için onaylanmış olmalıdır. + +## Şifre (Cipher) Algoritmaları + +Bu bölüm V11.3 Şifreleme Algoritmaları +için ek bilgi sağlar. + +Onaylanan şifre algoritmaları tercih sırasına göre listelenmiştir. + +| Simetrik Anahtar Algoritmaları | Referans | Durum | +|--|--|--| +| AES-256 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | A | +| Salsa20 | [Salsa 20 specification](https://cr.yp.to/snuffle/spec.pdf) | A | +| XChaCha20 | [XChaCha20 Draft](https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-xchacha-03) | A | +| XSalsa20 | [Extending the Salsa20 nonce](https://cr.yp.to/snuffle/xsalsa-20110204.pdf) | A | +| ChaCha20 | [RFC 8439](https://www.rfc-editor.org/info/rfc8439) | A | +| AES-192 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | A | +| AES-128 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | L | +| 2TDEA | | D | +| TDEA (3DES/3DEA) | | D | +| IDEA | | D | +| RC4 | | D | +| Blowfish| | D | +| ARC4 | | D | +| DES | | D | + +### AES Şifre Modları + +AES gibi blok şifreler farklı işlem modları ile kullanılabilir. Elektronik kod kitabı (Electronic codebook - ECB) gibi birçok işlem modu güvensizdir ve kullanılmamalıdır. Galois/Counter Modu (Galois/Counter Mode - GCM) ve şifre blok zincirleme mesaj kimlik doğrulama kodlu Sayaç (CCM) işlem modları, kimliği doğrulanmış şifreleme sağlar ve modern uygulamalarda kullanılmalıdır. + +Onaylanan modlar tercih sırasına göre listelenmiştir. + +| Mod | Kimliği Doğrulanmış | Referans | Durum | Kısıtlama | +|--|--|--|--|--| +| GCM | Evet | [NIST SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | | +| CCM | Evet | [NIST SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | | +| CBC | Hayır | [NIST SP 800-38A](https://csrc.nist.gov/pubs/sp/800/38/a/final) | L | | +| CCM-8 | Evet | | D | | +| ECB | Hayır | | D | | +| CFB | Hayır | | D | | +| OFB | Hayır | | D | | +| CTR | Hayır | | D | | + +Notlar: + +* Tüm şifrelenmiş mesajların kimliği doğrulanmalıdır. CBC modunun herhangi bir kullanımı için, mesajı doğrulamak üzere ilişkili bir karma MAC algoritması olmalıdır. Genel olarak bu, Encrypt-Then-Hash yönteminde uygulanmalıdır (ancak TLS 1.2 bunun yerine Hash-Then-Encrypt kullanır). Eğer bu garanti edilemiyorsa, CBC kullanılmamalıdır. MAC algoritması olmadan şifrelemeye izin verilen tek uygulama disk şifrelemedir. +* Eğer CBC kullanıldıysa, padding doğrulanmasının sabit zamanda gerçekleştirildiği garanti edilmelidir. +* CCM-8 kullanıldığında, MAC etiketi yalnızca 64 bit güvenliğe sahiptir. Bu, en az 128 bit güvenlik gerektiren gereksinim 6.2.9 ile uyumlu değildir. +* Disk şifrelemenin ASVS için kapsam dışı olduğu düşünülmektedir. Bu nedenle bu ekte disk şifreleme için onaylanmış herhangi bir yöntem listelenmemiştir. Bu kullanım için, kimlik doğrulama olmadan şifreleme genellikle kabul edilir ve XTS, XEX ve LRW modları tipik olarak kullanılır. + +### Anahtar Sarma (Key Wrapping) + +Kriptografik anahtar sarma (ve buna karşılık gelen anahtar açma), mevcut bir anahtarı ek bir şifreleme mekanizması kullanarak kapsülleyerek (yani sararak) koruma yöntemidir. Böylece orijinal anahtar, örneğin bir aktarım sırasında açıkça ortaya çıkmaz. Orijinal anahtarı korumak için kullanılan bu ek anahtar sarma anahtarı (wrap key) olarak adlandırılır. + +Bu işlem, güvenilmez olduğu düşünülen yerlerdeki anahtarları korumak veya hassas anahtarları güvenilmeyen ağlar üzerinden ya da uygulamalar içinde göndermek istendiğinde gerçekleştirilebilir. +Ancak, bir sarma/açma prosedürüne girişmeden önce orijinal anahtarın doğasını (örn. kimliği ve amacı) anlamaya ciddi önem verilmelidir, çünkü bunun hem kaynak hem de hedef sistemler/uygulamalar için güvenlik ve özellikle de bir anahtarın işlevinin (örn. imzalama) denetim izlerini ve uygun anahtar depolamayı içerebilecek uyumluluk açısından yansımaları olabilir. + +Özellikle, [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) uyarınca ve kuantum tehdidine karşı ileriye dönük hükümler göz önünde bulundurularak, anahtar sarma için AES-256 kullanılmalıdır. AES kullanan şifre modları tercih sırasına göre şunlardır: + +| Anahtar Sarma | Referans | Durum | +|--|--|--| +| KW | [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) | A | +| KWP | [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) | A | + +Kullanım durumu gerektiriyorsa AES-192 ve AES-128 kullanılabilir. Ancak bunun sebebi ve amacı, kuruluşun kriptografi envanterinde belgelenmelidir. + +### Kimlik Doğrulamalı Şifreleme + +Disk şifreleme haricinde, şifrelenmiş veriler bir çeşit kimliği doğrulanmış şifreleme (authenticated encryption - AE) şeması kullanılarak, genellikle ilişkili verilerle kimliği doğrulanmış şifreleme (authenticated encryption with associated data - AEAD) şeması kullanılarak yetkisiz değişikliklere karşı korunmalıdır. + +Uygulama tercihen onaylı bir AEAD şeması kullanmalıdır. Alternatif olarak onaylı bir şifreleme şeması ile onaylı bir MAC algoritmasını bir Encrypt-then-MAC yapısıyla birleştirebilir. + +MAC-then-encrypt'e eski uygulamalarla uyumluluk için hala izin verilmektedir. TLS v1.2'de eski şifre takımları ile kullanılır. + +| AEAD mekanizması | Referans | Durum | +|--------------------------|---------|-----| +|AES-GCM | [SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | +|AES-CCM | [SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | +|ChaCha-Poly1305 | [RFC 7539](https://datatracker.ietf.org/doc/html/rfc7539) | A | +|AEGIS-256 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +|AEGIS-128 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +|AEGIS-128L| [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +|Encrypt-then-MAC | | A | +|MAC-then-encrypt | | L | + +## Hash Fonksiyonları + +Bu bölümde V11.4 Hashing ve Hash Tabanlı Fonksiyonlar +için ek bilgiler sağlanmaktadır. + +### Genel Kullanım Durumları için Hash Fonksiyonları + +Aşağıdaki tabloda, dijital imzalar gibi genel kriptografik kullanım durumlarında onaylanan hash fonksiyonları listelenmektedir: + +* Onaylanan hash fonksiyonları güçlü çakışma (collision) direnci sağlar ve yüksek güvenlikli uygulamalar için uygundur. +* Bu algoritmalardan bazıları uygun kriptografik anahtar yönetimi ile kullanıldığında saldırılara karşı güçlü direnç sunar ve bu nedenle HMAC, KDF ve RBG işlevleri için ek olarak onaylanmıştır. +* 254 bitten daha az çıktıya sahip hash fonksiyonların çakışma direnci yetersizdir ve dijital imza veya çakışma direnci gerektiren diğer uygulamalar için kullanılmamalıdır. Diğer kullanımlar için, sadece eski sistemlerle uyumluluk ve doğrulama için kullanılabilirler, ancak yeni tasarımlarda kullanılmamalıdırlar. + +| Hash fonksiyonu | Referans | Durum | Kısıtlamalar | +| -------------- | ------------------------------------------------------------- |--|--| +| SHA3-512 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| SHA-512 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHA3-384 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| SHA-384 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHA3-256 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| SHA-512/256 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHA-256 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHAKE256 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| BLAKE2s | [BLAKE2: simpler, smaller, fast as MD5](https://eprint.iacr.org/2013/322) | A | | +| BLAKE2b | [BLAKE2: simpler, smaller, fast as MD5](https://eprint.iacr.org/2013/322) | A | | +| BLAKE3 | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | | +| SHA-224 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | L | HMAC, KDF, RBG, dijital imzalar için uygun değildir. | +| SHA-512/224 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | L | HMAC, KDF, RBG, dijital imzalar için uygun değildir. | +| SHA3-224 | [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | L | HMAC, KDF, RBG, dijital imzalar için uygun değildir. | +| SHA-1 | [RFC 3174](https://www.rfc-editor.org/info/rfc3174) & [RFC 6194](https://www.rfc-editor.org/info/rfc6194) | L | HMAC, KDF, RBG, dijital imzalar için uygun değildir. | +| CRC (herhangi bir uzunluk) | | D | | +| MD4 | [RFC 1320](https://www.rfc-editor.org/info/rfc1320) | D | | +| MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | | + +### Parola Saklama için Hash Fonksiyonları + +Güvenli parola hashleme için özel hash fonksiyonları kullanılmalıdır. Bu yavaş hash algoritmaları, parola kırmanın hesaplama zorluğunu artırarak kaba kuvvet ve sözlük saldırılarını azaltır. + +| KDF | Referans | Gerekli Parametreler | Durum | +| --- | --------- | ------------------- | ------ | +| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1
t = 2: m ≥ 19456 (19 MiB), p = 1
t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | +| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8
p = 2: N ≥ 2^16 (64 MiB), r = 8
p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | +| bcrypt | [A Future-Adaptable Password Scheme](https://www.researchgate.net/publication/2519476_A_Future-Adaptable_Password_Scheme) | cost ≥ 10 | A | +| PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 210,000 | A | +| PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 600,000 | A | +| PBKDF2-HMAC-SHA-1 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 1,300,000 | L | + +Parola depolama için onaylı parola tabanlı anahtar türetme işlevleri kullanılabilir. + +## Anahtar Türetme İşlevleri (Key Derivation Functions - KDF) + +### Genel Anahtar Türetme Fonksiyonları + +| KDF | Referanslar | Durum | +| ---------------- | --------------------------------------------------------------------------------------------- | ------ | +| HKDF | [RFC 5869](https://www.rfc-editor.org/info/rfc5869) | A | +| TLS 1.2 PRF | [RFC 5248](https://www.rfc-editor.org/info/rfc5248) | L | +| MD5-based KDFs | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | +| SHA-1-based KDFs | [RFC 3174](https://www.rfc-editor.org/info/rfc3174) & [RFC 6194](https://www.rfc-editor.org/info/rfc6194) | D | + +### Parola Tabanlı Anahtar Türetme İşlevleri + +| KDF | Referans | Gerekli Parametreler | Durum | +| --- | --------- | ------------------- | ------ | +| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1
t = 2: m ≥ 19456 (19 MiB), p = 1
t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | +| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8
p = 2: N ≥ 2^16 (64 MiB), r = 8
p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | +| PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 210,000 | A | +| PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 600,000 | A | +| PBKDF2-HMAC-SHA-1 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 1,300,000 | L | + +## Anahtar Değişim Mekanizmaları (Key Exchange Mechanisms - KEX) + +Bu bölümde V11.6 Açık Anahtar Kriptografisi +için ek bilgi sağlanmaktadır. + +### KEX Şemaları + +Tüm anahtar değişimi şemaları için 112 bit veya üzeri bir güvenlik gücü sağlanmalıdır ve bunların uygulanması aşağıdaki tablodaki parametre seçeneklerini takip etmelidir. + +| Şema | Etki Alanı Parametreleri | İleriye Yönelik Gizlilik | Durum | +|--|--|--|--| +| Finite Field Diffie-Hellman (FFDH) | L >= 3072 & N >= 256 | Evet | A | +| Elliptic Curve Diffie-Hellman (ECDH) | f >= 256-383 | Evet | A | +| Encrypted key transport with RSA-PKCS#1 v1.5 | | Hayır | D | + +Parametreler aşağıdaki gibidir: + +* k, RSA anahtarları için anahtar boyutudur. +* L açık anahtarın boyutu ve N sonlu alan kriptografisi için özel anahtarın boyutudur. +* f, ECC için anahtar boyutları aralığıdır. + +Herhangi bir yeni uygulama [NIST SP 800-56A](https://csrc.nist.gov/pubs/sp/800/56/a/r3/final) & [B](https://csrc.nist.gov/pubs/sp/800/56/b/r2/final) ve [NIST SP 800-77](https://csrc.nist.gov/pubs/sp/800/77/r1/final) ile uyumlu OLMAYAN herhangi bir şema kullanılmamalıdır. Özellikle, IKEv1 üretimde kullanılmamalıdır. + +### Diffie-Hellman Grupları + +Aşağıdaki gruplar Diffie-Hellman anahtar değişimi uygulamaları için onaylanmıştır. Güvenlik güçleri [NIST SP 800-56A](https://csrc.nist.gov/pubs/sp/800/56/a/r3/final), Ek D ve [NIST SP 800-57 Bölüm 1 Rev.5](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final)'de belgelenmiştir. + +| Group | Status | +|------------------|--------| +| P-224, secp224r1 | A | +| P-256, secp256r1 | A | +| P-384, secp384r1 | A | +| P-521, secp521r1 | A | +| K-233, sect233k1 | A | +| K-283, sect283k1 | A | +| K-409, sect409k1 | A | +| K-571, sect571k1 | A | +| B-233, sect233r1 | A | +| B-283, sect283r1 | A | +| B-409, sect409r1 | A | +| B-571, sect571r1 | A | +| Curve448 | A | +| Curve25519 | A | +| MODP-2048 | A | +| MODP-3072 | A | +| MODP-4096 | A | +| MODP-6144 | A | +| MODP-8192 | A | +| ffdhe2048 | A | +| ffdhe3072 | A | +| ffdhe4096 | A | +| ffdhe6144 | A | +| ffdhe8192 | A | + +## Mesaj Kimlik Doğrulama Kodları (Message Authentication Codes - MAC) + +Mesaj Kimlik Doğrulama Kodları (MAC), bir mesajın bütünlüğünü ve gerçekliğini doğrulamak için kullanılan kriptografik yapılardır. Bir MAC, girdi olarak bir mesaj ve gizli bir anahtar alır ve sabit boyutlu bir etiket (MAC değeri) üretir. MAC'ler güvenli iletişim protokollerinde (örneğin TLS/SSL) taraflar arasında değiş tokuş edilen mesajların gerçek ve bozulmamış olmasını sağlamak için yaygın olarak kullanılır. + +| MAC Algoritması | Referans | Durum | Kısıtlamalar | +| --------------| ----------------------------------------------------------------------------------------- | -------| ------------ | +| HMAC-SHA-256 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | | +| HMAC-SHA-384 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | | +| HMAC-SHA-512 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | | +| KMAC128 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | | +| KMAC256 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | | +| BLAKE3 (keyed_hash mode) | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | | +| AES-CMAC | [RFC 4493](https://datatracker.ietf.org/doc/html/rfc4493) & [NIST SP 800-38B](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38b.pdf) | A | | +| AES-GMAC | [NIST SP 800-38D](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf) | A | | +| Poly1305-AES | [The Poly1305-AES message-authentication code](https://cr.yp.to/mac/poly1305-20050329.pdf) | A | | +| HMAC-SHA-1 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | L | | +| HMAC-MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | | + +## Dijital İmzalar + +İmza şemaları [NIST SP 800-57 Bölüm 1](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final) uyarınca onaylanmış anahtar boyutlarını ve parametrelerini kullanmalıdır. + +| İmza Algoritması | Referans | Durum | +| ------------------------------ | ---------------------------------------------------------- | ------ | +| EdDSA (Ed25519, Ed448) | [RFC 8032](https://www.rfc-editor.org/info/rfc8032) | A | +| XEdDSA (Curve25519, Curve448) | [XEdDSA](https://signal.org/docs/specifications/xeddsa/) | A | +| ECDSA (P-256, P-384, P-521) | [FIPS 186-4](https://csrc.nist.gov/pubs/fips/186-5/final) | A | +| RSA-RSSA-PSS | [RFC 8017](https://www.rfc-editor.org/info/rfc8017) | A | +| RSA-SSA-PKCS#1 v1.5 | [RFC 8017](https://www.rfc-editor.org/info/rfc8017) | D | +| DSA (any key size) | [FIPS 186-4](https://csrc.nist.gov/pubs/fips/186-4/final) | D | + +## Kuantum Sonrası Şifreleme Standartları + +Kuantum sonrası kriptografi (PQC) uygulamaları [FIPS-203](https://csrc.nist.gov/pubs/fips/203/ipd), [FIPS-204](https://csrc.nist.gov/pubs/fips/204/ipd) ve [FIPS-205](https://csrc.nist.gov/pubs/fips/205/ipd) standartlarını takip etmelidir. Şu anda, bu standartlar için çok fazla güçlendirilmiş kod örneği veya referans uygulaması mevcut değildir. Daha fazla ayrıntı için, [Kuantum sonrası şifreleme standartlarının ilk üçüne ilişkin NIST duyurusu (Ağustos 2024)](https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards) adresine bakın. + +Önerilen [mlkem768x25519](https://datatracker.ietf.org/doc/draft-kwiatkowski-tls-ecdhe-mlkem/03/) kuantum sonrası hibrit TLS anahtar anlaşma yöntemi [Firefox sürüm 132](https://www.mozilla.org/en-US/firefox/132.0/releasenotes/) ve [Chrome sürüm 131](https://security.googleblog.com/2024/09/a-new-path-for-kyber-on-web.html) gibi büyük tarayıcılar tarafından desteklenmektedir. Kriptografik test ortamlarında veya endüstri veya devlet onaylı kütüphanelerde mevcut olduğunda kullanılabilir. diff --git a/5.0/tr/0x93-Appendix-D_Recommendations.md b/5.0/tr/0x93-Appendix-D_Recommendations.md new file mode 100644 index 0000000000..a0e1924ee0 --- /dev/null +++ b/5.0/tr/0x93-Appendix-D_Recommendations.md @@ -0,0 +1,49 @@ +# Ek D: Tavsiyeler + +## Giriş + +Uygulama Güvenliği Doğrulama Standardının (ASVS) 5.0 sürümü hazırlanırken, 5.0'da gereklilik olarak yer almaması gereken bir dizi mevcut ve yeni önerilen öğe olduğu anlaşıldı. Bunun nedeni, 5.0 tanımına göre ASVS kapsamında olmamaları veya alternatif olarak iyi bir fikir olmalarına rağmen zorunlu hale getirilemeyeceklerinin düşünülmesi olabilir. + +Tüm bu maddeleri tamamen kaybetmek istemediğimiz için bazıları bu ekte yer almaktadır. + +## Önerilen, kapsam dahilindeki mekanizmalar + +Aşağıdaki maddeler ASVS için kapsam dahilindedir. Bunlar zorunlu hale getirilmemelidir ancak güvenli bir uygulamanın parçası olarak dikkate alınmaları şiddetle tavsiye edilir. + +* Kullanıcıların daha güçlü bir parola belirlemesine yardımcı olmak için bir parola gücü ölçer sağlanmalıdır. +* Uygulamanın kök dizininde ya da .well-known dizininde, kullanıcıların güvenlik sorunları hakkında sahipleriyle iletişime geçebilecekleri bir bağlantı ya da e-posta adresini açıkça tanımlayan, herkese açık bir security.txt dosyası oluşturulmalıdır. +* İstemci tarafı girdi doğrulaması, güvenilir bir hizmet katmanında doğrulamaya ek olarak zorunlu kılınmalıdır. Çünkü bu, birisinin uygulamaya saldırmak amacıyla istemci tarafı kontrolleri atladığını keşfetmek için iyi bir fırsat sağlamaktadır. +* Bir robots.txt dosyası, X-Robots-Tag yanıt başlığı veya robots html meta etiketi kullanarak yanlışlıkla erişilebilen ve hassas sayfaların arama motorlarında görünmesi önlenmelidir. +* GraphQL kullanırken, yetkilendirmeyi her ayrı arayüzde ele almak zorunda kalmamak için yetkilendirme mantığı GraphQL veya çözümleyici katmanı yerine iş mantığı katmanında uygulanmalıdır. + +Referanslar: + +* [RFC bağlantısı da dahil olmak üzere security.txt hakkında daha fazla bilgi](https://securitytxt.org/) + +## Yazılım Güvenliği İlkeleri + +Aşağıdaki maddeler daha önce ASVS'de yer almaktaydı ancak tam olarak gereklilik değillerdir. Bunlar daha ziyade güvenlik kontrollerini uygularken göz önünde bulundurulması gereken ve takip edildiğinde daha sağlam kontrollere yol açacak ilkelerdir. Bunlar aşağıdakileri içerir: + +* Güvenlik kontrolleri merkezi, basit (tasarım ekonomisi), doğrulanabilir şekilde güvenli ve yeniden kullanılabilir olmalıdır. Bu sayede mükerrer, eksik veya etkisiz kontrollerden kaçınılabilir. +* Mümkün olan her yerde, kontrolleri sıfırdan uygulamaya güvenmek yerine daha önce yazılmış ve iyi incelenmiş güvenlik kontrolü uygulamaları kullanılmalıdır. +* İdeal olarak, korunan verilere ve kaynaklara erişmek için tek bir erişim kontrol mekanizması kullanılmalıdır. Kopyala yapıştır veya güvensiz alternatif yollardan kaçınmak için tüm istekler bu tek mekanizmadan geçmelidir. +* Öznitelik veya özellik tabanlı erişim kontrolü, kodun kullanıcının sadece rolü yerine bir özellik veya veri öğesi için yetkisini kontrol ettiği önerilen bir modeldir. İzinler yine de roller kullanılarak tahsis edilmelidir. + +## Yazılım Güvenliği Süreçleri + +ASVS 5.0'dan kaldırılan ancak hala iyi bir fikir olan bir dizi güvenlik süreci vardır. OWASP SAMM projesi bu süreçlerin nasıl etkili bir şekilde uygulanacağı konusunda iyi bir kaynak olabilir. Daha önce ASVS'de yer alan maddeler şunlardır: + +* Geliştirmenin tüm aşamalarında güvenliği ele alan güvenli bir yazılım geliştirme yaşam döngüsünün kullanıldığı doğrulanmalıdır. +* Tehditleri belirlemek, karşı önlemleri planlamak, uygun risk yanıtlarını kolaylaştırmak ve güvenlik testlerine rehberlik etmek için her tasarım değişikliği veya sprint planlaması için tehdit modellemesinin kullanıldığı doğrulanmalıdır. +* Tüm kullanıcı hikayelerinin ve özelliklerinin işlevsel güvenlik kısıtlamaları içerdiği doğrulanmalıdır. "Bir kullanıcı olarak profilimi görüntüleyebilmeli ve düzenleyebilmeliyim. Başkasının profilini görüntüleyememeli veya düzenleyememeliyim." gibi kısıtlamalar örnek olabilir. +* Tüm geliştiriciler ve test uzmanları için güvenli kodlama kontrol listesi, güvenlik gereksinimleri, kılavuz veya politikanın mevcut olduğu doğrulanmalıdır. +* Uygulama kaynak kodunun arka kapılardan, kötü amaçlı kodlardan (örn. salami saldırıları, mantık bombaları, saatli bombalar) ve belgelenmemiş veya gizli özelliklerden (örn. Easter eggs, güvensiz hata ayıklama araçları) arındırılmış olmasını sağlamak için devam eden bir sürecin var olduğu doğrulanmalıdır. Bu bölüme uymak, üçüncü taraf kütüphaneleri de dahil olmak üzere kaynak koduna tam erişim olmadan mümkün değildir ve bu nedenle muhtemelen yalnızca en yüksek düzeyde güvenlik gerektiren uygulamalar için uygundur. +* Konuşlandırılmış ortamlarda yapılandırma kaymasını tespit etmek ve buna yanıt vermek için mekanizmaların mevcut olduğu doğrulanmalıdır. Bu, değişmez altyapı, güvenli bir taban çizgisinden otomatik yeniden dağıtım veya mevcut durumu onaylanmış yapılandırmalarla karşılaştıran sapma tespit araçlarının kullanılmasını içerebilir. +* Tüm üçüncü taraf ürünlerde, kütüphanelerde, çerçevelerde ve hizmetlerde kendi önerilerine göre yapılandırma sağlamlaştırması yapıldığı doğrulanmalıdır. + +Referanslar: + +* [OWASP Threat Modeling Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html) +* [OWASP Threat modeling](https://owasp.org/www-community/Application_Threat_Modeling) +* [OWASP Software Assurance Maturity Model Project](https://owasp.org/www-project-samm/) +* [Microsoft SDL](https://www.microsoft.com/en-us/securityengineering/sdl/) diff --git a/5.0/tr/0x94-Appendix-E_Contributors.md b/5.0/tr/0x94-Appendix-E_Contributors.md new file mode 100644 index 0000000000..2aeab65e98 --- /dev/null +++ b/5.0/tr/0x94-Appendix-E_Contributors.md @@ -0,0 +1,71 @@ +# Ek E - Katkıda Bulunanlar + +ASVS 4.0.0'ın yayınlanmasından bu yana yorum yapan veya pull request açan aşağıdaki kişilerin katkılarını minnetle kabul ediyoruz. + +Herhangi bir hata fark ettiyseniz veya isminizin farklı görünmesini istiyorsanız, lütfen bize bildirin. + +| | | | | +|---|---|---|---| +| Johan Sydseter ([sydseter](https://github.com/sydseter)) | luis servin ([lfservin](https://github.com/lfservin)) | Oleksii Dovydkov ([oleksiidov](https://github.com/oleksiidov)) | IZUKA Masahiro ([maizuka](https://github.com/maizuka)) | +| James Sulinski ([jsulinski](https://github.com/jsulinski)) | Eli Saad ([ThunderSon](https://github.com/ThunderSon)) | [kkshitish9](https://github.com/kkshitish9) | Andrew van der Stock ([vanderaj](https://github.com/vanderaj)) | +| Rick M ([kingthorin](https://github.com/kingthorin)) | Bankde Eakasit ([Bankde](https://github.com/Bankde)) | Michael Gargiullo ([mgargiullo](https://github.com/mgargiullo)) | Raphael Dunant ([Racater](https://github.com/Racater)) | +| Cesar Kohl ([cesarkohl](https://github.com/cesarkohl)) | [inaz0](https://github.com/inaz0) | Joerg Bruenner ([JoergBruenner](https://github.com/JoergBruenner)) | David Deatherage ([securitydave](https://github.com/securitydave)) | +| John Carroll ([yosignals](https://github.com/yosignals)) | Jim Fenton ([jimfenton](https://github.com/jimfenton)) | Matteo Pace ([M4tteoP](https://github.com/M4tteoP)) | Sebastien gioria ([SPoint42](https://github.com/SPoint42)) | +| Steven van der Baan ([vdbaan](https://github.com/vdbaan)) | Jeremy Bonghwan Choi ([jeremychoi](https://github.com/jeremychoi)) | [craig-shony](https://github.com/craig-shony) | Riccardo Sirigu ([ricsirigu](https://github.com/ricsirigu)) | +| Tomasz Wrobel ([tw2as](https://github.com/tw2as)) | Alena Dubeshko ([belalena](https://github.com/belalena)) | Rafael Green ([RafaelGreen1](https://github.com/RafaelGreen1)) | [mjang-cobalt](https://github.com/mjang-cobalt) | +| [clallier94](https://github.com/clallier94) | Kevin W. Wall ([kwwall](https://github.com/kwwall)) | Jordan Sherman ([jsherm-fwdsec](https://github.com/jsherm-fwdsec) / [deleterepo](https://github.com/deleterepo)) | Ingo Rauner ([ingo-rauner](https://github.com/ingo-rauner)) | +| Dirk Wetter ([drwetter](https://github.com/drwetter)) | Moshe Zioni ([moshe-apiiro](https://github.com/moshe-apiiro)) | Patrick Dwyer ([coderpatros](https://github.com/coderpatros)) | David Clarke ([davidclarke-au](https://github.com/davidclarke-au)) | +| Takaharu Ogasa ([takaharuogasa](https://github.com/takaharuogasa)) | Arkadii Yakovets ([arkid15r](https://github.com/arkid15r)) | Motoyasu Saburi ([motoyasu-saburi](https://github.com/motoyasu-saburi)) | [leirn](https://github.com/leirn) | +| [wet-certitude](https://github.com/wet-certitude) | [timhemel](https://github.com/timhemel) | RL Thornton ([thornshadow99](https://github.com/thornshadow99)) | Thomas Bandt ([aspnetde](https://github.com/aspnetde)) | +| Roel Storms ([roelstorms](https://github.com/roelstorms)) | Jeroen Willemsen ([commjoen](https://github.com/commjoen)) | [anonymous-31](https://github.com/anonymous-31) | Kamran Saifullah ([deFr0ggy](https://github.com/deFr0ggy)) | +| Steve Springett ([stevespringett](https://github.com/stevespringett)) | Spyros ([northdpole](https://github.com/northdpole)) | Hans Herrera ([hansphp](https://github.com/hansphp)) | [Marx314](https://github.com/Marx314) | +| [CarlosAllendes](https://github.com/CarlosAllendes) | Yonah Russ ([yruss972](https://github.com/yruss972)) | Sander Maijers ([sanmai-NL](https://github.com/sanmai-NL)) | Luboš Bretschneider ([bretik](https://github.com/bretik)) | +| Eva Sarafianou ([esarafianou](https://github.com/esarafianou)) | Ata Seren [ataseren](https://github.com/ataseren) | Steve Thomas ([Sc00bz](https://github.com/Sc00bz)) | Dominique RIGHETTO ([righettod](https://github.com/righettod)) | +| Steven van der Baan ([svdb-ncc](https://github.com/svdb-ncc)) | Michael Vacarella ([Aif4thah](https://github.com/Aif4thah)) | Tonimir Kisasondi ([tkisason](https://github.com/tkisason)) | Stefan Streichsbier ([streichsbaer](https://github.com/streichsbaer)) | +| [hi-unc1e](https://github.com/hi-unc1e) | sb3k ([starbuck3000](https://github.com/starbuck3000)) | [mario-platt](https://github.com/mario-platt) | Devdatta Akhawe ([devd](https://github.com/devd)) | +| Michael Gissing ([scolytus](https://github.com/scolytus)) | Jet Anderson ([thatsjet](https://github.com/thatsjet)) | Dave Wichers ([davewichers](https://github.com/davewichers)) | Jonny Schnittger ([JonnySchnittger](https://github.com/JonnySchnittger)) | +| Silvia Väli ([silviavali](https://github.com/silviavali)) | [jackgates73](https://github.com/jackgates73) | [1songb1rd](https://github.com/1songb1rd) | Timur - ([timurozkul](https://github.com/timurozkul)) | +| Gareth Heyes ([hackvertor](https://github.com/hackvertor)) | [appills](https://github.com/appills) | [suvikaartinen](https://github.com/suvikaartinen) | chaals ([chaals](https://github.com/chaals)) | +| DanielPharos ([AtlasHackert](https://github.com/AtlasHackert)) | will Farrell ([willfarrell](https://github.com/willfarrell)) | Alina Vasiljeva ([avasiljeva](https://github.com/avasiljeva)) | Paul McCann ([ismisepaul](https://github.com/ismisepaul)) | +| Sage ([SajjadPourali](https://github.com/SajjadPourali)) | [rbsec](https://github.com/rbsec) | Benedikt Bauer ([mastacheata](https://github.com/mastacheata)) | James Jardine ([jamesjardine](https://github.com/jamesjardine)) | +| Mark Burnett ([m8urnett](https://github.com/m8urnett)) | [dschwarz91](https://github.com/dschwarz91) | Cyber-AppSec ([Cyber-AppSec](https://github.com/Cyber-AppSec)) | [Tib3rius](https://github.com/Tib3rius) | +| BitnessWise ([bitnesswise](https://github.com/bitnesswise)) | damienbod ([damienbod](https://github.com/damienbod)) | Jared Meit ([jmeit-fwdsec](https://github.com/jmeit-fwdsec)) | Stefan Seelmann ([sseelmann](https://github.com/sseelmann)) | +| Brendan O'Connor ([ussjoin](https://github.com/ussjoin)) | Andrei Titov ([andrettv](https://github.com/andrettv)) | Hans-Petter Fjeld ([atluxity](https://github.com/atluxity)) | [markehack](https://github.com/markehack) | +| Neil Madden ([NeilMadden](https://github.com/NeilMadden)) | Michael Geramb ([mgeramb](https://github.com/mgeramb)) | Osama Elnaggar ([ossie-git](https://github.com/ossie-git)) | [mackowski](https://github.com/mackowski) | +| Ravi Balla ([raviballa](https://github.com/raviballa)) | Hazana ([hazanasec](https://github.com/hazanasec)) | David Means ([dmeans82](https://github.com/dmeans82)) | Alexander Stein ([tohch4](https://github.com/tohch4)) | +| BaeSenseii ([baesenseii](https://github.com/baesenseii)) | Vincent De Schutter ([VincentDS](https://github.com/VincentDS)) | S Bani ([sbani](https://github.com/sbani)) | Mitsuaki Akiyama ([mak1yama](https://github.com/mak1yama)) | +| Christopher Loessl ([hashier](https://github.com/hashier)) | [victorxm](https://github.com/victorxm) | Michal Rada ([michalradacz](https://github.com/michalradacz)) | Veeresh Devireddy ([drveresh](https://github.com/drveresh)) | +| [MaknaSEO](https://github.com/MaknaSEO) | [darkzero2022](https://github.com/darkzero2022) | Liam ([LiamDobbelaere](https://github.com/LiamDobbelaere)) | Frank Denis ([jedisct1](https://github.com/jedisct1)) | +| Otto Sulin ([ottosulin](https://github.com/ottosulin)) | [carllaw6885](https://github.com/carllaw6885) | Anders Johan Holmefjord ([aholmis](https://github.com/aholmis)) | Richard Fritsch ([rfricz](https://github.com/rfricz)) | +| [mesutgungor](https://github.com/mesutgungor) | Scott Helme ([ScottHelme](https://github.com/ScottHelme)) | Carlo Reggiani ([carloreggiani](https://github.com/carloreggiani)) | Suyash Srivastava ([suyash5053](https://github.com/suyash5053)) | +| Mark Potter ([markonweb](https://github.com/markonweb)) | Arjan Lamers ([alamers](https://github.com/alamers)) | Gøran Breivik ([gobrtg](https://github.com/gobrtg)) | [flo-blg](https://github.com/flo-blg) | +| Guillaume Déflache ([guillaume-d](https://github.com/guillaume-d)) | Toufik Airane ([toufik-airane](https://github.com/toufik-airane)) | Keith Hoodlet ([securingdev](https://github.com/securingdev)) | Sinner ([SoftwareSinner](https://github.com/SoftwareSinner)) | +| [iloving](https://github.com/iloving) | Jeroen Beckers ([TheDauntless](https://github.com/TheDauntless)) | Joubin Jabbari ([joubin](https://github.com/joubin)) | yu fujioka ([fujiokayu](https://github.com/fujiokayu)) | +| execjosh ([execjosh](https://github.com/execjosh)) | Alicja Kario ([tomato42](https://github.com/tomato42)) | Sidney Ribeiro ([srjsoftware](https://github.com/srjsoftware)) | Gabriel Marquet ([Gby56](https://github.com/Gby56)) | +| Drew Schulz ([drschulz](https://github.com/drschulz)) | [bedirhan](https://github.com/bedirhan) | [muralito](https://github.com/muralito) | Ronnie Flathers ([ropnop](https://github.com/ropnop)) | +| Philippe De Ryck ([philippederyck](https://github.com/philippederyck)) | Malte ([mal33](https://github.com/mal33)) | [MazeOfThoughts](https://github.com/MazeOfThoughts) | Andreas Falk ([andifalk](https://github.com/andifalk)) | +| Javi ([javixeneize](https://github.com/javixeneize)) | Daniel Hahn ([averell23](https://github.com/averell23)) | [borislav-c](https://github.com/borislav-c) | Robin Wood ([digininja](https://github.com/digininja)) | +| [miro2ns](https://github.com/miro2ns) | Jan Dockx ([jandockx](https://github.com/jandockx)) | [vipinsaini434](https://github.com/vipinsaini434) | [priyanshukumar397](https://github.com/priyanshukumar397) | +| Nat Sakimura ([sakimura](https://github.com/sakimura)) | Benjamin Häublein ([BenjaminHae](https://github.com/BenjaminHae)) | [unknown-user-from](https://github.com/unknown-user-from) | Ali Ramazan TAŞDELEN ([alitasdln](https://github.com/alitasdln)) | +| Pedro Escaleira ([oEscal](https://github.com/oEscal)) | Josh ([josh-hemphill](https://github.com/josh-hemphill)) | Tim Würtele ([SECtim](https://github.com/SECtim)) | AviD ([avidouglen](https://github.com/avidouglen)) | +| SheHacksPurple ([shehackspurple](https://github.com/shehackspurple)) | [fcerullo-cycubix](https://github.com/fcerullo-cycubix) | Hector Eryx Paredes Camacho ([heryxpc](https://github.com/heryxpc)) | Irene Michlin ([irene221b](https://github.com/irene221b)) | +| Jonah Y-M ([TG-Techie](https://github.com/TG-Techie)) | Dhiraj Bahroos ([bahroos](https://github.com/bahroos)) | Jef Meijvis ([jefmeijvis](https://github.com/jefmeijvis)) | [IzmaDoesItbeta](https://github.com/IzmaDoesItbeta) | +| Abdessamad TEMMAR ([TmmmmmR](https://github.com/TmmmmmR)) | [sectroyer](https://github.com/sectroyer) | Soh Satoh ([sohsatoh](https://github.com/sohsatoh)) | [regoravalaz](https://github.com/regoravalaz) | +| james-t ([james-bitherder](https://github.com/james-bitherder)) | Aram Hovsepyan ([aramhovsepyan](https://github.com/aramhovsepyan)) | [JaimeGomezGarciaSan](https://github.com/JaimeGomezGarciaSan) | [ValdiGit01](https://github.com/ValdiGit01) | +| iwatachan ([ishowta](https://github.com/ishowta)) | Vinod Anandan ([VinodAnandan](https://github.com/VinodAnandan)) | Kevin Kien ([KevinKien](https://github.com/KevinKien)) | [paul-williamson-swoop](https://github.com/paul-williamson-swoop) | +| [endergzr](https://github.com/endergzr) | Radhwan Alshamamri ([Rado0z](https://github.com/Rado0z)) | Grant Ongers ([rewtd](https://github.com/rewtd)) | Cure53 ([cure53](https://github.com/cure53)) | +| [AliR2Linux](https://github.com/AliR2Linux) | Ads Dawson ([GangGreenTemperTatum](https://github.com/GangGreenTemperTatum)) | William Reyor ([BillReyor](https://github.com/BillReyor)) | gabe ([gcrow](https://github.com/gcrow)) | +| [mascotter](https://github.com/mascotter) | [luissaiz](https://github.com/luissaiz) | Suren Manukyan ([vx-sec](https://github.com/vx-sec)) | Piotr Gliźniewicz ([pglizniewicz](https://github.com/pglizniewicz)) | +| Tadeusz Wachowski ([tadeuszwachowski](https://github.com/tadeuszwachowski)) | Nasir aka Nate ([andesec](https://github.com/andesec)) | [settantasette](https://github.com/settantasette) | Lars Haulin ([LarsH](https://github.com/LarsH)) | +| Terence Eden ([edent](https://github.com/edent)) | [JasmineScholz](https://github.com/JasmineScholz) | Arun Sivadasan ([teavanist](https://github.com/teavanist)) | Yusuf GÜR ([yusuffgur](https://github.com/yusuffgur)) | +| Troy Marshall ([troymarshall](https://github.com/troymarshall)) | Tanner Prynn ([tprynn](https://github.com/tprynn)) | Nick K. ([nickific](https://github.com/nickific)) | [raoul361](https://github.com/raoul361) | +| Azeem Ilyas ([TheAxZim](https://github.com/TheAxZim)) | Evo Stamatov ([avioli](https://github.com/avioli)) | Tim Potter ([timpotter87](https://github.com/timpotter87)) | Gavin Ray ([GavinRay97](https://github.com/GavinRay97)) | +| monis ([demideus](https://github.com/demideus)) | Marcin Hoppe ([MarcinHoppe](https://github.com/MarcinHoppe)) | Grambulf ([ramshazar](https://github.com/ramshazar)) | Jordan Pike ([computersarebad](https://github.com/computersarebad)) | +| Jason Rogers ([jason-invision](https://github.com/jason-invision)) | Ben Hall ([benbhall](https://github.com/benbhall)) | JamesPoppyCock ([jamesly123](https://github.com/jamesly123)) | WhiteHackLabs ([whitehacklabs](https://github.com/whitehacklabs)) | +| Alex Gaynor ([alex](https://github.com/alex)) | Filip van Laenen ([filipvanlaenen](https://github.com/filipvanlaenen)) | [jeurgen](https://github.com/jeurgen) | [GraoMelo](https://github.com/GraoMelo) | +| Andreas Kurtz ([ay-kay](https://github.com/ay-kay)) | Tom Tervoort ([TomTervoort](https://github.com/TomTervoort)) | old man ([deveras](https://github.com/deveras)) | Marco Schnüriger ([marcortw](https://github.com/marcortw)) | +| [stiiin](https://github.com/stiiin) | infoseclearn ([teaminfoseclearn](https://github.com/teaminfoseclearn)) | [hljupkij](https://github.com/hljupkij) | Noe ([nmarher](https://github.com/nmarher)) | +| Lyz ([lyz-code](https://github.com/lyz-code)) | Martin Riedel ([mrtnrdl](https://github.com/mrtnrdl)) | KIM Jaesuck ([tcaesvk](https://github.com/tcaesvk)) | Barbara Schachner ([bschach](https://github.com/bschach)) | +| René Reuter ([AresSec](https://github.com/AresSec)) | [carhackpils](https://github.com/carhackpils) | Tyler ([tyler2cr](https://github.com/tyler2cr)) | Hugo ([hasousa](https://github.com/hasousa)) | +| Wouter Bloeyaert ([Someniak](https://github.com/Someniak)) | Mark de Rijk ([markderijkinfosec](https://github.com/markderijkinfosec)) | Ramin ([picohub](https://github.com/picohub)) | Philip D. Turner ([philipdturner](https://github.com/philipdturner)) | +| Will Chatham ([willc](https://github.com/willc)) | | | | From 721dae6a94ca2da888e60c6e93bde34482d3286f Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Mon, 29 Sep 2025 22:13:23 +0300 Subject: [PATCH 52/93] Refine translation checker (#3260) * First steps and progress update * progress update * 0x03-Using-ASVS.md completed * 0x04-Assessment_and_Certification.md completed * started translation of V2 * progress on v2 translation * Translation of 0x11-V2-Authentication.md completed * Started translation process again, with the RC1 announced * translation progress * translation progress * small progress * Continuing translation, awaiting commit from other device * Committed from main device, proceeding with v10 * v10-11 completed * v13 halfway * proceeding with v15 * translation complete, md linter issues will be checked and proof-reading will be conducted * First fix of proofreading, proceeding with 0x05 * Final fixes for linting and proofreading * First commit for translation validation scripts * Added comments and print statements * Case verified for newline mismatch and fixed the translation file * Completed validation scripts and workflow, tested my own translation files and fixed them too * Fixed trailing spaces in 0x92-Appendix-C_Cryptography.md * Add turkish to make * Add to makefile as well * Output all languages * Trigger CI * Refactor and make status clearer * Fix workflow references --------- Co-authored-by: ataseren --- .github/workflows/build-documents.yml | 6 +- .../workflows/create-5.0-outputs-debug.yml | 2 +- .github/workflows/create-5.0-outputs.yml | 2 +- .github/workflows/validate_translation.yml | 26 +--- 5.0/Makefile | 3 +- 5.0/generate-all.sh | 2 +- 5.0/tools/translation_validation/req_check.py | 45 +++--- .../structural_check.py | 31 ++-- .../validate_translation.py | 142 ++++++++++++++++++ 9 files changed, 195 insertions(+), 64 deletions(-) create mode 100644 5.0/tools/translation_validation/validate_translation.py diff --git a/.github/workflows/build-documents.yml b/.github/workflows/build-documents.yml index e121db969a..9d59045d73 100644 --- a/.github/workflows/build-documents.yml +++ b/.github/workflows/build-documents.yml @@ -34,21 +34,21 @@ jobs: build-image: if: needs.filters.outputs.docker == 'true' needs: filters - uses: owasp/asvs/.github/workflows/build-and-publish-docker-image.yml@master + uses: ./.github/workflows/build-and-publish-docker-image.yml build-v4: if: ${{ always() && needs.filters.outputs.v4 == 'true' }} needs: - build-image - filters - uses: owasp/asvs/.github/workflows/create-4.0-outputs.yml@master + uses: ./.github/workflows/create-4.0-outputs.yml build-v5: if: ${{ always() && needs.filters.outputs.v5 == 'true' }} needs: - build-image - filters - uses: owasp/asvs/.github/workflows/create-5.0-outputs.yml@master + uses: ./.github/workflows/create-5.0-outputs.yml publish-v5-latest: if: ${{ always() && github.event_name == 'push' && needs.filters.outputs.v5 == 'true' && github.ref == 'refs/heads/master' && (needs.build-v5.result == 'success') }} diff --git a/.github/workflows/create-5.0-outputs-debug.yml b/.github/workflows/create-5.0-outputs-debug.yml index a5ce5c6de9..c8e4d40857 100644 --- a/.github/workflows/create-5.0-outputs-debug.yml +++ b/.github/workflows/create-5.0-outputs-debug.yml @@ -13,7 +13,7 @@ on: jobs: prepare_container: - uses: owasp/asvs/.github/workflows/create-5.0-outputs.yml@master + uses: ./.github/workflows/create-5.0-outputs.yml debug: needs: prepare_container diff --git a/.github/workflows/create-5.0-outputs.yml b/.github/workflows/create-5.0-outputs.yml index f0815eec40..4872f674a2 100644 --- a/.github/workflows/create-5.0-outputs.yml +++ b/.github/workflows/create-5.0-outputs.yml @@ -27,4 +27,4 @@ jobs: - uses: actions/upload-artifact@v4.3.0 with: name: ASVS 5.0.0 - path: 5.0/dist/en/ + path: 5.0/dist/ diff --git a/.github/workflows/validate_translation.yml b/.github/workflows/validate_translation.yml index 08d833eef7..f1203f141f 100644 --- a/.github/workflows/validate_translation.yml +++ b/.github/workflows/validate_translation.yml @@ -23,27 +23,5 @@ jobs: - name: Run validation scripts run: | - set -e - ORIGINAL_DIR="5.0/en" - TRANSLATED_DIR="5.0/${{ github.event.inputs.translated_folder }}" - - if [ ! -d "$TRANSLATED_DIR" ]; then - echo "❌ Translated directory not found: $TRANSLATED_DIR" - exit 1 - fi - - for file in "$ORIGINAL_DIR"/*.md; do - fname=$(basename "$file") - translate="$TRANSLATED_DIR/$fname" - - if [ ! -f "$translate" ]; then - echo "❌ Missing translation for $fname" - exit 1 - fi - - echo "🔍 Validating $fname ..." - if [ "$fname" != "0x92-Appendix-C_Cryptography.md" ]; then - python 5.0/tools/translation_validation/req_check.py --og "$file" --tr "$translate" - fi - python 5.0/tools/translation_validation/structural_check.py --og "$file" --tr "$translate" - done + python 5.0/tools/translation_validation/validate_translation.py \ + --translated-folder "${{ github.event.inputs.translated_folder }}" diff --git a/5.0/Makefile b/5.0/Makefile index d24def836a..423741d869 100644 --- a/5.0/Makefile +++ b/5.0/Makefile @@ -1,3 +1,4 @@ +# Testing 1 PROJDIR=$(realpath $(CURDIR)) BUILDDIR=build DISTDIR=dist @@ -5,7 +6,7 @@ TOOLSDIR=tools TEMPLATEDIR=templates TARGETNAME=OWASP_Application_Security_Verification_Standard_5.0.0_ -LANGDIRS=en #fr +LANGDIRS=en tr # Add the language directories to the project directory # Create build and dist directories and language subdirectories BUILDDIR=$(PROJDIR)/build diff --git a/5.0/generate-all.sh b/5.0/generate-all.sh index 7e0f0c7201..7566034ed5 100644 --- a/5.0/generate-all.sh +++ b/5.0/generate-all.sh @@ -1,6 +1,6 @@ #!/bin/bash -ALLOWED_LANGS='en' +ALLOWED_LANGS='en tr' echo $@ diff --git a/5.0/tools/translation_validation/req_check.py b/5.0/tools/translation_validation/req_check.py index 950d4564ec..f3f48f0221 100644 --- a/5.0/tools/translation_validation/req_check.py +++ b/5.0/tools/translation_validation/req_check.py @@ -11,16 +11,6 @@ import re import sys -# Arguments are processed at the beginning to allow function reuse -parser = argparse.ArgumentParser( - description="Validate that all ASVS requirements exist correctly in translation" -) -parser.add_argument("--og", required=True, help="Path to original ASVS file") -parser.add_argument("--tr", required=True, help="Path to translated ASVS file") -args = parser.parse_args() - - - def extract_special_chars(text: str) -> set[str]: """ Extract non-alphanumeric, non-space, non-markdown special characters. @@ -62,14 +52,16 @@ def check_reg_count(original: str, translation: str) -> bool: if missing_reqs: print(f"❌ Missing in translation ({len(missing_reqs)}):") for req in sorted(missing_reqs): - print(f" - {req} from original file: {args.og}") + # Filename context will be printed by caller when available + print(f" - {req}") check = False if extra_reqs: print(f"\n⚠️ Extra in translation ({len(extra_reqs)}):") for req in sorted(extra_reqs): - print(f" - {req} at translation file: {args.tr}") - check = False + print(f" - {req}") + + check = False if check: print("✅ All requirements exist in translation.") @@ -100,23 +92,38 @@ def compare_rows_columns(original: str, translation: str) -> bool: print("✅ All requirement IDs and non-description columns match") return True -def main(): +def validate_files(og_path: str, tr_path: str) -> bool: + """Validate requirement presence and non-description column content. - # Read files - with open(args.og, encoding="utf-8") as f: + Returns True on success, False otherwise. + """ + with open(og_path, encoding="utf-8") as f: original_text = f.read() - with open(args.tr, encoding="utf-8") as f: + with open(tr_path, encoding="utf-8") as f: translation_text = f.read() if not check_reg_count(original_text, translation_text): print("Please fix the issues about missing/extra requirements to proceed with other checks.") - sys.exit(1) + + return False if not compare_rows_columns(original_text, translation_text): print("Please fix the content mismatches for validation.") - sys.exit(1) + return False print("\nAll checks passed successfully.") + return True + +def main(): + parser = argparse.ArgumentParser( + description="Validate that all ASVS requirements exist correctly in translation" + ) + parser.add_argument("--og", required=True, help="Path to original ASVS file") + parser.add_argument("--tr", required=True, help="Path to translated ASVS file") + args = parser.parse_args() + + ok = validate_files(args.og, args.tr) + sys.exit(0 if ok else 1) ### Question: I think we shouldn't check special characters, as some languages may not use the same ones but ### still be correct. What do you think? Also, the translator may use different characters for parentheses, dashes, etc. diff --git a/5.0/tools/translation_validation/structural_check.py b/5.0/tools/translation_validation/structural_check.py index 735e1cab5e..3c2c238207 100644 --- a/5.0/tools/translation_validation/structural_check.py +++ b/5.0/tools/translation_validation/structural_check.py @@ -9,14 +9,6 @@ import argparse import sys - -parser = argparse.ArgumentParser( - description="Validate that translation has the same structure as the original" -) -parser.add_argument("--og", required=True, help="Path to original ASVS file") -parser.add_argument("--tr", required=True, help="Path to translated ASVS file") -args = parser.parse_args() - def extract_newlines(text: str): """Return list of line numbers that are blank.""" return [i for i, line in enumerate(text.splitlines(), start=1) if line.strip() == ""] @@ -43,10 +35,10 @@ def check_newlines(orig, trans): ) return (True, None, len(orig), len(trans)) -def main(): - with open(args.og, encoding="utf-8") as f: +def validate_files(og_path: str, tr_path: str) -> bool: + with open(og_path, encoding="utf-8") as f: original_text = f.read() - with open(args.tr, encoding="utf-8") as f: + with open(tr_path, encoding="utf-8") as f: translation_text = f.read() orig_newlines = extract_newlines(original_text) @@ -55,14 +47,25 @@ def main(): ok, msg, o_count, t_count = check_newlines(orig_newlines, trans_newlines) if not ok: - print(f"❌ Newline mismatch detected at file {args.og}") + print(f"❌ Newline mismatch detected at file {og_path}") print(f" - Original count: {o_count}, Translation count: {t_count}") print(f" - First issue: {msg}") print(" To see the other mismatched newline positions, solve the first issue and re-run.") - sys.exit(1) + return False else: print(f"✅ Newlines match exactly (count={o_count})") - sys.exit(0) + return True + +def main(): + parser = argparse.ArgumentParser( + description="Validate that translation has the same structure as the original" + ) + parser.add_argument("--original", "-o", dest="original", required=True, help="Path to original ASVS file") + parser.add_argument("--translated", "-t", dest="translated", required=True, help="Path to translated ASVS file") + args = parser.parse_args() + + ok = validate_files(args.original, args.translated) + sys.exit(0 if ok else 1) if __name__ == "__main__": main() diff --git a/5.0/tools/translation_validation/validate_translation.py b/5.0/tools/translation_validation/validate_translation.py new file mode 100644 index 0000000000..71b40bc0cf --- /dev/null +++ b/5.0/tools/translation_validation/validate_translation.py @@ -0,0 +1,142 @@ +""" +Driver script to validate ASVS translations. + +Replicates the logic previously embedded in the GitHub Actions bash step: +- Verifies the translated folder exists +- Iterates over all markdown files in the original directory +- Ensures each has a corresponding translated file +- Runs requirement and structural checks for each file + +Usage: + python 5.0/tools/translation_validation/validate_translation.py \ + --translated-folder + +Example: + python 5.0/tools/translation_validation/validate_translation.py --translated-folder tr +""" + +from __future__ import annotations + +import argparse +import sys +from pathlib import Path + +# Ensure we can import sibling modules when running as a script +_THIS_DIR = Path(__file__).resolve().parent +if str(_THIS_DIR) not in sys.path: + sys.path.insert(0, str(_THIS_DIR)) + +import req_check as req_validator # type: ignore +import structural_check as struct_validator # type: ignore + + +APPENDIX_C = "0x92-Appendix-C_Cryptography.md" + + +def main() -> int: + parser = argparse.ArgumentParser(description="Validate ASVS translation against originals") + parser.add_argument( + "--translated-folder", + required=True, + help="Name of the folder inside 5.0/ that contains translated files (e.g. 'tr' or 'he')", + ) + args = parser.parse_args() + + repo_root = Path(__file__).resolve().parents[3] + original_dir = repo_root / "5.0" / "en" + translated_dir = repo_root / "5.0" / args.translated_folder + + if not translated_dir.is_dir(): + print(f"❌ Translated directory not found: {translated_dir}") + return 1 + + if not original_dir.is_dir(): + print(f"❌ Original directory not found: {original_dir}") + return 1 + + md_files = sorted(original_dir.glob("*.md")) + + # Collect per-file results for summary + results = [] # each item: {file, missing, req, struct} + + for original_file in md_files: + fname = original_file.name + translated_file = translated_dir / fname + + if not translated_file.is_file(): + print(f"❌ Missing translation for {fname}") + results.append({ + "file": fname, + "missing": True, + "req": None, + "struct": None, + }) + continue + + print(f"🔍 Validating {fname} ...") + + req_status: object + struct_status: bool + + # Run requirement check for all but Appendix C + if fname != APPENDIX_C: + req_status = req_validator.validate_files(str(original_file), str(translated_file)) + else: + req_status = "skipped" + + # Run structural check + struct_status = struct_validator.validate_files(str(original_file), str(translated_file)) + + results.append({ + "file": fname, + "missing": False, + "req": req_status, + "struct": struct_status, + }) + + # Per-file summary + print("\n----- Per-file summary -----") + for r in results: + if r["missing"]: + print(f"❌ {r['file']} — missing translation") + continue + req_txt = ( + "ok" if r["req"] is True else ("skipped" if r["req"] == "skipped" else "fail") + ) + struct_txt = "ok" if r["struct"] is True else "fail" + passed = ((r["req"] is True) or (r["req"] == "skipped")) and (r["struct"] is True) + prefix = "✅" if passed else "❌" + print(f"{prefix} {r['file']} — req: {req_txt}, struct: {struct_txt}") + + # Overall summary + total = len(md_files) + missing = sum(1 for r in results if r["missing"]) + translated_count = total - missing + req_failures = sum(1 for r in results if (not r["missing"]) and (r["req"] is False)) + struct_failures = sum(1 for r in results if (not r["missing"]) and (r["struct"] is False)) + passes = sum( + 1 + for r in results + if (not r["missing"]) and ((r["req"] is True) or (r["req"] == "skipped")) and (r["struct"] is True) + ) + overall_ok = missing == 0 and req_failures == 0 and struct_failures == 0 + + print("\n----- Summary -----") + ok_emoji = "✅" + fail_emoji = "❌" + def mark(cond: bool) -> str: + return ok_emoji if cond else fail_emoji + + print(f"Total files: {total}") + print(f"{mark(translated_count == total)} Translated found: {translated_count}") + print(f"{mark(missing == 0)} Missing translations: {missing}") + print(f"{mark(req_failures == 0)} Requirement check failures: {req_failures}") + print(f"{mark(struct_failures == 0)} Structural check failures: {struct_failures}") + print(f"{mark(passes == translated_count)} Fully passed: {passes}") + print(f"{ok_emoji if overall_ok else fail_emoji} Overall: {'PASS' if overall_ok else 'FAIL'}") + + return 0 if overall_ok else 1 + + +if __name__ == "__main__": + raise SystemExit(main()) From d5295a023c080156a8d97538d0330f946eb37889 Mon Sep 17 00:00:00 2001 From: tghosth Date: Tue, 30 Sep 2025 18:53:18 +0300 Subject: [PATCH 53/93] Small bugfix --- 5.0/tools/translation_validation/req_check.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/5.0/tools/translation_validation/req_check.py b/5.0/tools/translation_validation/req_check.py index f3f48f0221..f477b0fbee 100644 --- a/5.0/tools/translation_validation/req_check.py +++ b/5.0/tools/translation_validation/req_check.py @@ -60,8 +60,7 @@ def check_reg_count(original: str, translation: str) -> bool: print(f"\n⚠️ Extra in translation ({len(extra_reqs)}):") for req in sorted(extra_reqs): print(f" - {req}") - - check = False + check = False if check: print("✅ All requirements exist in translation.") From 1bca0a27f041e2c4df4fc93514ba7920db800fbb Mon Sep 17 00:00:00 2001 From: tghosth Date: Tue, 30 Sep 2025 19:00:29 +0300 Subject: [PATCH 54/93] Single language list --- 5.0/Makefile | 2 +- 5.0/generate-all.sh | 2 +- 5.0/languages.txt | 1 + 3 files changed, 3 insertions(+), 2 deletions(-) create mode 100644 5.0/languages.txt diff --git a/5.0/Makefile b/5.0/Makefile index 423741d869..903ddbc071 100644 --- a/5.0/Makefile +++ b/5.0/Makefile @@ -6,7 +6,7 @@ TOOLSDIR=tools TEMPLATEDIR=templates TARGETNAME=OWASP_Application_Security_Verification_Standard_5.0.0_ -LANGDIRS=en tr +LANGDIRS := $(shell cat languages.txt) # Add the language directories to the project directory # Create build and dist directories and language subdirectories BUILDDIR=$(PROJDIR)/build diff --git a/5.0/generate-all.sh b/5.0/generate-all.sh index 7566034ed5..1250140ad5 100644 --- a/5.0/generate-all.sh +++ b/5.0/generate-all.sh @@ -1,6 +1,6 @@ #!/bin/bash -ALLOWED_LANGS='en tr' +ALLOWED_LANGS=$(tr '\n' ' ' < languages.txt | sed 's/ $//') echo $@ diff --git a/5.0/languages.txt b/5.0/languages.txt new file mode 100644 index 0000000000..ed3b016662 --- /dev/null +++ b/5.0/languages.txt @@ -0,0 +1 @@ +en tr \ No newline at end of file From f97d07d37d1236e76cd98c0507c9658425d53edd Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Tue, 30 Sep 2025 20:11:26 +0300 Subject: [PATCH 55/93] Fix doc generation bugs (#3262) * Create dir * Filename fixes --- 5.0/generate-all.sh | 6 +++++- 5.0/tools/generate_document.sh | 2 +- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/5.0/generate-all.sh b/5.0/generate-all.sh index 1250140ad5..3252e3cff4 100644 --- a/5.0/generate-all.sh +++ b/5.0/generate-all.sh @@ -14,7 +14,11 @@ for lang in ${LANGS}; do if [[ " $ALLOWED_LANGS " =~ " $lang " ]]; then vers="5.0.0" - verslong="./docs_$lang/OWASP_Application_Security_Verification_Standard_$vers_$lang" + if [ ! -d "./docs_$lang" ]; then + mkdir "./docs_$lang" + fi + + verslong="./docs_${lang}/OWASP_Application_Security_Verification_Standard_${vers}_${lang}" python3 tools/export.py --format json --language $lang > "$verslong.json" python3 tools/export.py --format cdx_json --language $lang > "$verslong.cdx.json" diff --git a/5.0/tools/generate_document.sh b/5.0/tools/generate_document.sh index 8ffa30c773..0bbb920c56 100644 --- a/5.0/tools/generate_document.sh +++ b/5.0/tools/generate_document.sh @@ -13,7 +13,7 @@ if ! command_exists pandoc; then fi generate_docx() { - pandoc -s -f gfm --reference-doc=../templates/reference.docx --columns 10000 --toc -t docx -o "../docs_$1/OWASP Application Security Verification Standard $2-$1.docx" *.md + pandoc -s -f gfm --reference-doc=../templates/reference.docx --columns 10000 --toc -t docx -o "../docs_$1/OWASP_Application_Security_Verification_Standard_$2_$1.docx" *.md echo " done." echo -e "" echo -e "Note: If you got an error 'Invalid UTF-8 stream', make sure you are on the newest version of pandoc from the project website (not just the OS package repo)" From 4110dcc4276fb64ebd809c44c4e5394c11779b8a Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Tue, 30 Sep 2025 20:20:18 +0300 Subject: [PATCH 56/93] Fix URL checker (#3263) * Fix URL checker * test * Test * Remove test --- .github/workflows/config/url-checker-config.json | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/config/url-checker-config.json b/.github/workflows/config/url-checker-config.json index 95351929cf..6ccdec269c 100644 --- a/.github/workflows/config/url-checker-config.json +++ b/.github/workflows/config/url-checker-config.json @@ -2,6 +2,9 @@ "ignorePatterns": [ { "pattern": "changelog" + }, + { + "pattern": "https://github.com/*" } ], "httpHeaders": [ From f60beeefa2ae51ee805218757e1375b3ac4597fa Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Sun, 12 Oct 2025 19:33:07 +0300 Subject: [PATCH 57/93] Attempt to run en by default and allow specifying others in a manual run (#3268) --- .github/workflows/create-5.0-outputs.yml | 16 +++++++++++++++- 5.0/Makefile | 2 +- Makefile | 4 ++-- docker/run.sh | 6 ++++++ 4 files changed, 24 insertions(+), 4 deletions(-) diff --git a/.github/workflows/create-5.0-outputs.yml b/.github/workflows/create-5.0-outputs.yml index 4872f674a2..d0b8dec5c6 100644 --- a/.github/workflows/create-5.0-outputs.yml +++ b/.github/workflows/create-5.0-outputs.yml @@ -4,8 +4,20 @@ name: Generate 5.0 Outputs on: # Scan on workflow call workflow_call: + inputs: + languages: + description: 'Languages to build (space-separated, e.g., "en tr")' + required: false + default: 'en' + type: string # Scan on-demand through GitHub Actions interface: - workflow_dispatch: {} + workflow_dispatch: + inputs: + languages: + description: 'Languages to build (space-separated, e.g., "en tr")' + required: false + default: 'en' + type: string # Updated versions: # docker/login-action@v3.4.0 @@ -24,6 +36,8 @@ jobs: password: ${{secrets.GITHUB_TOKEN}} - uses: actions/checkout@v4.1.1 - run: make 5.0 + env: + LANGS: ${{ inputs.languages || github.event.inputs.languages || 'en' }} - uses: actions/upload-artifact@v4.3.0 with: name: ASVS 5.0.0 diff --git a/5.0/Makefile b/5.0/Makefile index 903ddbc071..9cd273185d 100644 --- a/5.0/Makefile +++ b/5.0/Makefile @@ -6,7 +6,7 @@ TOOLSDIR=tools TEMPLATEDIR=templates TARGETNAME=OWASP_Application_Security_Verification_Standard_5.0.0_ -LANGDIRS := $(shell cat languages.txt) +LANGDIRS := $(shell if [ -n "$$SELECTED_LANGS" ]; then echo $$SELECTED_LANGS; else cat languages.txt; fi) # Add the language directories to the project directory # Create build and dist directories and language subdirectories BUILDDIR=$(PROJDIR)/build diff --git a/Makefile b/Makefile index 7dfd31edb1..b90f8da9fa 100644 --- a/Makefile +++ b/Makefile @@ -5,9 +5,9 @@ all: 5.0 4.0 4.0-LANGS := $(shell cd 4.0 && git status --porcelain | sed 's/[ A-Z?]\+ \"\?4.0\///g' | sed 's/\/.*//g' | sed -n '/^\(ar\|de\|en\|es\|fr\|pt\|ru\|zh-cn\)/p' | tr '\n' ' ') 5.0: docker - docker run --rm --user $(id -u):$(id -g) -v "`pwd`/5.0:/data" -v "`pwd`/docker:/scripts" -e "TARGET=5.0" -e "FORMATS=$(FORMATS)" ghcr.io/owasp/asvs/documentbuilder:latest + docker run --rm --user $(id -u):$(id -g) -v "`pwd`/5.0:/data" -v "`pwd`/docker:/scripts" -e "TARGET=5.0" -e "FORMATS=$(FORMATS)" -e "LANGS=$(LANGS)" ghcr.io/owasp/asvs/documentbuilder:latest 5.0-clean: docker - docker run --rm --user $(id -u):$(id -g) -v "`pwd`/5.0:/data" -v "`pwd`/docker:/scripts" -e "TARGET=clean" -e "FORMATS=$(FORMATS)" ghcr.io/owasp/asvs/documentbuilder:latest + docker run --rm --user $(id -u):$(id -g) -v "`pwd`/5.0:/data" -v "`pwd`/docker:/scripts" -e "TARGET=clean" -e "FORMATS=$(FORMATS)" -e "LANGS=$(LANGS)" ghcr.io/owasp/asvs/documentbuilder:latest 4.0: docker docker run --rm --user $(id -u):$(id -g) -v "`pwd`/4.0:/data" -v "`pwd`/docker:/scripts" -e "TARGET=4.0" -e "FORMATS=$(FORMATS)" -e "LANGS=$(4.0-LANGS)" ghcr.io/owasp/asvs/documentbuilder:latest diff --git a/docker/run.sh b/docker/run.sh index ec03a062ec..990ad2fa2d 100755 --- a/docker/run.sh +++ b/docker/run.sh @@ -6,6 +6,12 @@ case $TARGET in 4.0) ./generate-all.sh $LANGS ;; + 5.0) + if [ -n "$LANGS" ]; then + export SELECTED_LANGS="$LANGS" + fi + make $FORMATS + ;; clean) make clean ;; From b6e59e7e03b266854da8ee22c0da5ba56588e576 Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Sun, 12 Oct 2025 19:35:56 +0300 Subject: [PATCH 58/93] Add docs, update translation details and add script credits (#3269) * Add Turkish docs * Update translation details * Add script credits * Fix link --- ...ecurity_Verification_Standard_5.0.0_tr.pdf | Bin 0 -> 545992 bytes ...ty_Verification_Standard_5.0.0_tr.cdx.json | 3029 +++++++ ...ecurity_Verification_Standard_5.0.0_tr.csv | 343 + ...curity_Verification_Standard_5.0.0_tr.docx | Bin 0 -> 223892 bytes ...y_Verification_Standard_5.0.0_tr.flat.json | 3073 +++++++ ...ication_Standard_5.0.0_tr.flat.legacy.json | 4437 ++++++++++ ...curity_Verification_Standard_5.0.0_tr.json | 2750 +++++++ ..._Verification_Standard_5.0.0_tr.legacy.csv | 343 + ...Verification_Standard_5.0.0_tr.legacy.json | 7183 +++++++++++++++++ ..._Verification_Standard_5.0.0_tr.legacy.xml | 1 + ...ecurity_Verification_Standard_5.0.0_tr.xml | 1 + 5.0/docs_tr/tr | 0 5.0/tools/translation_validation/req_check.py | 3 + .../structural_check.py | 3 + CONTRIBUTING.md | 3 +- README.md | 6 +- 16 files changed, 21172 insertions(+), 3 deletions(-) create mode 100644 5.0/OWASP_Application_Security_Verification_Standard_5.0.0_tr.pdf create mode 100644 5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.cdx.json create mode 100644 5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.csv create mode 100644 5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.docx create mode 100644 5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.flat.json create mode 100644 5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.flat.legacy.json create mode 100644 5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.json create mode 100644 5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.csv create mode 100644 5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.json create mode 100644 5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.xml create mode 100644 5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.xml create mode 100644 5.0/docs_tr/tr diff --git a/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_tr.pdf b/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_tr.pdf new file mode 100644 index 0000000000000000000000000000000000000000..b494b812e8afcafe714550836e3943fd8d3ba27e GIT binary patch literal 545992 zcmZ5|bzD?m(6@nrpo9o0jkKh~(ku;%ERB?;LayG^;W`6~8E1KC^xLD%xKIZ{} zz+gOQ7bi1gTRe~PKWX7QlRdvAx`;)E0@>w_h;KS!(L6DFe}nm!B9;W!Jz}1i8yH$5 zL%AK+5rXGWU-oOQ1GsbZ)zO5H0Ew+^405kv5emZ$UH9XZv>YwpN6t2g9@)~DN;!Q zqLFq&&Yu4(giBi+{}mqsT0)JH@R4bNJjSX?VLG<(LbHZ+8$+WLifBBBkzbbOSZ%?u z=db|Mi=bld7v_&gK%j%NdOHsR%(Q2E<|p5NN;lP48{o0nW7fUVtC3yL(2ThxB9#4V z`0$y&gWg5q(`ib8A~Bn=)SP$ES#NzkW``L=$TY?8AVL$K)5lmxN!0O)n5O4#uvPs!1(xWqj+zMxg%k*1D9)mC#DsZD2;N(RouJjyn>6f>9Y47)wm>c8y8cH=PRE zTLQxyH-t^`2dEB7^2@$r^to||S^7xP2BVEc$j!2pvag6&hqkwXA+9RbLh|0JikI-uLJReCV1sZoL-m}vAf+Y^Q+`f!be46mH|mmC1Y?>D-Y zVqOZ%V`khSf|z2!xiN%w{TCZSC_^%aQD!i}luo%qh=~$oA`xWp-7k6I;sgH@X?C~` z20+XA%!1Fl(ZU*7#|qvy?h($Pe1 zxlQM-*AicJmnqOl{Z=u<=s(XWBD6#wtn50xgK;Mvzu=bW18rFVynx@c4}0EQ#yq9L zDBaQC&E~oC>{*K15XP=2S+!3+a2+LO-GRaTpg;SJr{4Kwdk5CLWv*xYwBoD#Pi^$L zF0cIYzxJb7?UVQEfO)tXmdJN7a~A>V#!}0n`X7@Mf5S?Skq=vAgu2|oeJqF@IDGSC zQHb$t<=t10BZ_}scIQO8jL3sH9|5=9%zQ|dg;n$f{MW00os-JGzASs+EqE7$sYJP{ zmZOFs6xIMQm|A*6?zsz!eXG-y{<`WdX5F|)QZUVnyhBEH{JF_kx;9ToxhV{uxG{s$ zFk4@((deT*jReEUa^HArOu!LQNrv$ig_!ftz3KlY&>KKYE`sqn9cvpz)SfI+C&a_} zL`pzM&D_dAcFLW^_9k#->16H797&q%whqC@3gIpx4+>J zC|Z1TH%{?ny;O3;c=wpTWHECChTtT^l_d58y2{69p4t4~qM5I4Xv^7w)+5iZ% zFe0)6I2o}F!0vPG@}44LdAD7@-5`sSfB=Qaacm+Zn?gg@rGc)IbO)D=# zPj3T4c{-zUO04>q-!Jp`sMB8h^DT5^$oa_0T4h{lzY1)M`-l84L(DZwFGU%#G%ZL6 zn()ETgI`?3Ei}o3MGrIXHNUt&iiro}ilS#gX=n~vqyt7Do+0$QFcY5rH240lhw+c~ zn+&30%O6it7_%`8amJ_*5F_53#>-$3FK@S9_Y{-md;1YFMjT58P)?nlwsw+K<<$e` z8(oek3U5Cc0<6yD=8B~HrY@t7mB)gsx{oO}Pk12x!sH!GW2*R!~y0Y`YC8? z>BM8wn4DFw!@G?i0gWhm(b9w@d4mae9)v1y8oG7~C?i@e5w|c2V-#B1wz;`Pm|jh= zq#0ukDE<8d#F?Lo@&%!V9={`|jN%UPv5l1~x`7?hk#KTR8-TPLn$ylY!Fw)qrJvp~ z=G@yV2@nVG%ZI5}xNU{TtFw^cTrb%646&R)ui8K_PP+gDrtmN#MbBE}-NI7dxLi*N zX?MxYr&rgui@&?we!d#$5AF0K8MD_@BIaM$;P!VWSWuBIuulsD z+Atc!HYGcG3GQ!J$jkGlKLbdDfJFfhPS8zT2>nk@}UWPMP7gs+TR4Xs_>u@E{t5o z@O~exgR#P}lUL?)>fcZM(dPr@D!^)8#lM}`WcECmA7Hsbk(#=3VH4re6=*JWmdpil>d z?7g@@H886R2ru}dz+a$l^Ff+^ZRX2HJrt<>r3`PxsI*f%G@cfw&2!>0!+1zR1MCRj zGga90b!an5`67;@1NSiS1xc0k5r?IBMd_xY)+q^r)Hf20vQO~i`DFXV{*i9CB;P&2 zlDW*+%kP8fVAv2~b)#9+qq?2}+t_8%$yLg**G_{q5n&i(aJO7d1BcOkZ_w~Bo`7r# z`-HuymtuMEZ0za2WMTBak-O+D^MtxzS;LRR3R8U6)Tay2e~&#xnhICkCg8XO?89m2 z22Aarb@^+}ab8FRh4BSt?)iKrt>}2wAe)yA6sWrrELrjlzyN9D!_+wu}SvxLAMAi=J0-Ve6=88p^vU%GkA_qt7kl!GpcygG_9ydMQ2|C z%})T|kRTH-a=-7`eD}d2%;QZw8KCJ0W{QxyUF@03#7OaF9AWV{oglVDLV*6HcZVFF z42Kq$C=}H)%W4Ca;Folcn+SX@L$kR4BAb+Lm^D_m8&E1>QRR1jxE1#Ix1~u2CN+W9 zzZ?KP)TE7bnA?c3VksF8hYdmltt<3_8bJ4wwv~^>^qZdgSN{6{XiN|Jp(e1_#>pAN zt8DEuwN}s=CfPm^?NNfBAsmh!>(47svX3Yi_2UmQDidJnApt+P&`T|;7lUV{0&mwc ze!2n0B0z)H{u$y+@*Ag)1j)}nH_(;a%p(J%AFfQS1;$&M0(DvPAeNJoZ?OX^I07|w6EXf_H1LM-FJi+7Os zk~FoQy|T{qUZduhEDyD%fKYi)y7uUy-o`C+fJyZ3#m%*G9rSGjK!1tU7qle6!icBA zC4SfgPraVvgkb}U%52h@IMl!TU99$fKPUJXVjZ6Z=!^m$5gUM4K4cD_q;X%J7u(wX z%GK4mmQTF4cBhwbE-b(wUhqiiQj7Cnf~T$( z1(Ha713JJ;tjWYc@u-B%&)Ol6#f8p%D=H}>Ff~>t!15(TEiilD9qiQbfD=a1F_#C( zo@3Bei@$JIjk_|qT;og9;{(0FuJx@9$s`>g&EFI^4wRI?Os7~}PGtb5uMRvdXTnm2 z*Ltuzq5RxVMPzeUA7Zu&T&nI=I<>&Jspfrzlb0j&uem_)c`&H|ezA;I=a$GPRFJ9} zsaujEQuer9_`W*!^B_Q+l$;YNeth#e&2s;5tuPs1x65%x_PR<703bReM(035R+Ye+ zy2|HCofmt`gkLSY6}C(89b+iAw9zrvxXj3W+)VBwhe1LMO5K)piWlYRpRN(VW9_aKe4|pflbV81{sv9wTUV} zcrCQ^K=c%|zXk_R@@y~ECd=q_o)l|3>#3l>eq4s;d|C0KsO#W^V_INidM)c8?T^R1 zE1YDkZ=N?y%{KGJmbIMBpZEzZb{_>m^?*r|^kl<~>85S5R}l9W(uw;C4RB&)WS8Nh zc#7QCAl-T`U=~*Jn*+DR0mME3jnXzv!M*q;?y+XS=E&e73sat+fD5%cb4* z^h*0i;=p~)$|-C9$kCa&Z_wrV_O$IoWZ|g%`bA@p1o?fs_I*cEW>} z*sEr9rdy#u8kCvY>wTWP6FQ^2uEGx5Uk_yw7EYhz-@EfQleu>VURcL@eptI_n*}>r z`_eumTzhwADx5Pb&(NueYUyMZIJZ%s?JY@KSe;j{A~`m#ALPq99NimuclJw-lU(;i zxfwZHW9frlX%$f&=pe?2R`}Qz!*T{T4znj^Kvre= z4|Rl`_7sbT^!1Qej0a*0cRp%^1f#nbZa4@n?#<+*`nzzc?Aodo>e zeLqsj1^dGp8BpDpe&WeD)+R$){h8c_6tlTH@I$)PNoJa!$F{$jPCQ&Z zGYBRp`N;W@5+CcgLcFT;SHNZ`O}IN1u$~&bY}lKlPy>6a;l4k0lo472NzPLo#jl{` zu}J4~K`6=xnn07?VIqkr7ykLegY{SQT({VW@Om67V``U=^d2MpP$>%FofFE z{IM41fe)UK1Oynd#kd%cc5^e}`+NL_IIop-Pn9As_2+ay`sv9=$Mzx;?sN zQ8ye|_=?yO$vPd^bKrf9aw*ybG}P#Qv|b_1=TtWRt1CtPw?2!i-CO?qbme0LPbvL# zI0(8tIYx!A);jrBA*CY115rKvZ`XohC*Q~?6cs?U<7P|qk_vY|2s+o37d_o1M{>R` z+%=Yr#ozW#nNq!B6|dF_TEMe5kGI4|kZzujH}&QK$n~=Df;nHB*Cib-YB-M%%?p3zz7f#4uG;C_mlb0%vW>|{|evW{4US{MM! zn+=xd*&pltb#%hmRiil$%Q1V zD_YF&Ts#B)sJcol@ZXvN;PJ( z`Ljg71^YlGUwU2+4XYIo}7WM3YjuSr!G{awQpN?jvWtxO> zLu$Fjqj&mv(FH*k(NKcZdUVnAEN(c=Yd}tU{at@Q)xN}S708+tpWB^BhRf!LL_aPk zixnn)-bngWsU7v5KFJzuXAJ>OkfuZEp8+#klzdC9nj+^@y_IO zW4b2=A~$f?@La8`ky85bJ?~QWJ&k}q>=P;h?@s6}Obuixeczf{01D=#I3T&9f|xUK zchqD&>URaofW7he_aJ8Whq~JDnyGNar!0v6t9DW8=?&B5TT7rpt6=mcE1u3CAo!M?6IlT^M^pLb!; zx|!;%XjzMib~^Fd%Iw}q#l(|MxiU8D{AIc_Jxc)uQOoC>{cf5WE14S3d@x#_r|Bxc z?u5j+A*hoYSZX%CdR+Wt1UOA@Z zPOp=;&*d)@m5JCsqYyHb=&|eR$jF$$CtP<1vEDDJiS%A8*pA11MoIK>cak=9}; z>F*_u!~E)|viPg=?`vPo|y6O$pC6oIOUho4nEppW@pDMtYa=s}Tr6-J^ zw$qo0DzL21Ny!GST1sHrUoG)F}myR4u=~AA1M@T_wv$kHX2Ryk^8W4 z^WfROBw;YL-XrmO2DiK##lc9*8?@ELpA~`aJ*G?41>arjcu#_wW<8;@vK7R{-M)>0 zyg|?3&y6AN(n;@Gf<>INVeR!>HMNaU>|JVOK)S zuI?18CW^K^pL^vv6#39Yv{>?73Ltau%qG$rd;s4DMoqRp488vbM1*<=Uh= z)q_lGE>6eeBaYL(`xH5m&PyORZiX(r^1ZCFo|s>E+-f=3lYMxP7De^T6<>2?N)gF% zSxaeqVH(jl#gZeIFD!QGbJ1kV)n16V1=c|QS=xM(BOr;`5=B`VZorgNKr_avd6Ok6piHMV`y9}jYwY=@I6q@!IZC-Bh-ko9c^t^sFdnSvVNE zJRrqga+c+^%Xihil=EXxY|udy>GMg!v;kWZ!jRtRIJG>Uhk$MG`5T0w>r1Z+?K=wk z>krt`*gMVF^O&Z_I+&-WFhjod^yqZ9}5cWH|Xx%Y0VCQP8RA0 z$E7sE%1StThB`ysy}5d2C?XhiATVh!&nls=75Pm43fjA8&6e{6$9arh8ieCKCH1Vf zlYC(|zB|&yu;arBmrqFU)+@(R-!HGcllCBMH2DqCbkB3Ut8RHbJ<)qd?(dIrB_YVx zGd7X)9BXjHRfEDp*@lmco>UV4?P4o4-gY!XSt&y!qzFsp^rr)z&jtiFq*Qh_#&@-s^RCv#<=X1!B>Ou9WZFD65ahnk6#K{>|3WUcSa3r zpe~H_M(5n`!!dVm{79(NRA8EpNDF$W+jQaL>rxFDHE`N|)JbAH3GUB6x8vMy6H`$v zJUQniHN;QWS7kP=dlB_M6D~9$*+aD~>%TMkQ$lnR~I{AHEW3A;d{v$gH`$Nm|=&lmQRIUcM}_xry#IBc+3 z*iMY$n7G}U4=ch}@gpCE1bvA9IbswD69Xr&I8#h3SEg&O>u>dJ9PHTXdAOhhy@L6* zidL&(EDzoveST#6O{~5-)mzER%YUnBz>2L<=)*?!*uBMz`0gKFWI6Rp_~mLxC(0Sh ze3Z1~_iQS}RH_Pv9)#DqXW)i2-XR|T!$dXUZ8lAM-@}h(`|?a6PuSIK`FZC_&Clgz zD>sN6h(;49aVp`bt*7F>3PF8)H|n*KCFatJ*FMM6E3nXPxKP+N&Z-5QsJNN)IF=V6Y%MgxjTeh z^VdZ2iA^I8jd{(JPl4x5*asQY$&2Ugyh5AoDcL0I8qSYKr@Y-B_p_i6gFz&GFo|to zFHq=F!hRP&E#fKTo%vf6`P^Z)y2qWU>%8+Px^GWk>9F$3FtzEVaAuLyU03R=$gj`M zcX4i(I<6dELlSg~4Z8gR!akOenhccT+O2eI9oL7ySmHB|@afosL1);Ylu8}J0d#JD zcoz+;ALMR8oZ;`w=dgq-FC}W1CrH6z7Aw#5Vjq=U{EIcJU;+RFkgR`9CzSIJfE=AbZFCKf4D|&@<8wp#EnXDjokUe zpLZWs5H&0EMaLO3OjZL-csa|SUwqUJ&OL?H1U4m}*$k?^!1#mRP^O+B}0u z-J6ea*Yi+UmK-ol6>&-Vpx$TwL09)aF2SeXN{IXwyWD&jlNhcA+M>X2Gcpug(J`gO z>S9}XpM1u750Zshna1$! zJpcZFqz>5}Pc!9Me8XAa@J5h?MMLK&PeR7p>`xz{htb6Dp0J}^AW;!_HrdyvSBtN@ zT@=1WyyJ&_jvGk2d$w_3Xxn%3CI8H(j#uiRW!YVjw`ZyC)TNhj!t3SWvz^pUChwU* zZm_U2+J0*)bZStp-`Sb)!-RJzlwh{ro1@uN+iJ+;y@I}GEdGwyVu%kRV@>v_kI=*W zHd~h?vOhMah$EhGUv}$LF2n0|8t!>UqATS3tF{d+$>eEZ%iIe8DLAa1^?@l;cpO)gv(V4ToQw)ee% z_6}Ay)y?$iOD^o<(ESgAwL)>JUB>3a++pJs;c?HJH;$zfM$Pf$6FxdR{+Ba}CkfjI zIw(8+D4p}#`JPrzkN5O17)4KBSn^&j2MQp--nTlIne&%#lume981H~oqx9AJj(+*n zQ=Z-ixx0VmaWp9u>akNm`&+IkzR1pBUe;oESdU{*Y(CkZkL~HT_n(Ldk1fO2WL;lB zK6(JznkDcNOp#eQAc_Vx{lQhN>fOu5ukO3&FKX`y@DV}ve$at^Vs#zA=FrQ8Uylgo;}sGd?Zv~uZ5>Xcfomf=1$B1| zlP_HcII?`T0)_V6GE?v>U-t zS9CJ_glJ6XsBcu*1CeOLH%Sq^ed2_|afi{zGbxaFUjq5^%}+;d`ISzDlO@k0<48!` zOHgsCBDSZZxy-w4h315#lN2H!w8dvcO&GIb12cNw0)_j5sVBSRo7fPtZe}dng)A9r zmQfP7cI%igNroocW_nNegQ3j+Q=y!_?YAQ1&pxJ*rj$rjc|)iMkUZM#r~{S)*m7yz zfit;af>ZB3wfUdDJC?B1nR?V}Uq$=^$Mnj)nP`IL_ZY3g`!#8ss9nCB?Zb3ge&i^{ z%X$RGYpS9q!q1$&KRF#f%f5q?e-%}(41MxVUlf9Rlf?S#%u#_#p>C;R%e@E6SmlbA zpA>wX2;l~_)SlkOs~}{ha+p2q%is1mGaJ&I~@N!9*}&3pNxx; z=T$CPYaIGcJLHE2gw^VZnkEEUHGyDXeXy}I(be|N3UyZ<`%_-~L)|dNd zscc?e`7v8cmPs6i$)~QA2$mc?C`BoU!c>Z?R7=LAz<8P$mhw^+g;ua%Ezd4F%l(?I zs~*9uOR=)*tSK6ZR*q|<{=j`vi^Qzc>n?YuEH|H4XTptDB+ZGWLFz4b@%Ew>neZ_? zNLG4JKCavwNk}`*3%QGrfND(p(GTbVdFnjaYp^14S?N{Dsn!CA^1?@mA*C0i)4-e3 z%oHD&ulG~nNUh{x4h`Oe4gRlTzx#e##;LL5Sybf;!+KPGz37rtUTJ~uGYF-O=XH!P zY}Ix+=sU}z&ezydRlDIW9J22^=#pBc<9nmwUT5rzBg>{5K(b%dLn;DIdW=24vvwSJ z?@~rN5XPz!G9u9|#jsGFRZ1Tfql?B!qkB^zEyBVJ)LRk@KjH8t?2Ch)Tj7#iT7&U4 z{PO0K6v-z*3Ld+r{M7a_H+Av)tQc!lQSm?-f&hzsP{fC5gYHL?+Nij{J3uSN2hKBh zfoSusk+>Ed6>E+>4{`fNis$VrrfG*HCCi%Kf^3W*b4!3oFsL!Nh1`g*tLRH4A*qXI zXZu-&^D+4kyclNw$xy(?@T<5$#ezY_+_32SNMm&3FdFH2tZLkq%Qo}m!=uI0h=y)8 zDW97mOw1x!GF}E6yt^CxcZ+3eiHsgpxl)HjI@Mbb-tJa(Q-2MqEMGodVRIN%SmFGA zi~qwTTm7pw?f1Or48iO6V5HU?e$!Ay+UH`!@JV`%os?Cqqj`PxuNmTEdYUFeCvJz= z8vZJ@s!H5LwmE2TLeyh#!?8Lfid@cPN5TXlzNojT*q zhbYDK`uh(Cb9%)EsKRB*d?3w(kMbIrzv9H5z0w6CWE?k7XAP~rpFPI!rTiGguPV^u zR+4YQ66TqyHA90CGkiCfj1BE?FSq)=+fxhV6rh+5XH*%{=1)uY=%4$@*(2GwJSfjpsw+?Wl4?mg-Ea6uB47*+wjg4%zi%R9!HSZXl4RLg|kXejjVUskn zhCz5!dRQ(LWfcPQBGCVk{L$|1Rx&j9sVejdmPty<8RG9P+5#aidzS zuFHs8!lZR{x6C=VmEdOFQgMeS@`Wh4KLo3>)8`#`14V46bNB}Fo=81|f zQq?$XKMaynD*NRQpbGqpVDPz&ev!G4CdhZc0ysq+DxB-WeoBP9PSPtb#8ht8wsGg6 zB}=T{K~CZfiAxo(f7%Y$k^Z#mrHZI3o1jymv0&1TXHD&(cDn-S^x-{s64y|7ds?-e zBJg?4Cetv`#!*(tT^)9+r7v)6iNS15`@48~v#!(p@Y_O^Zz%a%xz$KbChSektOWUr zS6Mff#(bPG*)u|y8EV#w(vS5}SZd2Yz0{NP#otH4q!mG@;rb~!Zn8H+ruviybR$!I zw)evjajNwE;dg{JNKg-Ll)&|6TRC6#P*LBeVGG@M>xEVoN(aVnCbUmBX!TYU_xUCT zQZwNlo>+EXD1cY>yB^TAbZGL9C<^E8t!Uf$8hscEfc6lS(YAFMgf0KsH^ur&q9L&8 zy#COE_R)E-1P}{#j$FUc-xT+_uoA28CvLpu+}!YR``8GDnI1N_$eyXm*usnzpZ!rA(d9UKrrr=`NM2$pDybM$Ug-(dx&V z5xxIzzF0NW_LRqt7ViE$ozUnvU!fag+*vR*8y4r!JH>993A;IMvR7#36w%gz4K-Z< z={0~`u&PQj{wv}FuRh)pN>pey`0V9R+`@2Z>HBK1_L2PhYtUN|g9dV<79_kX5;=Z+ zdxfBd8#j7K*!7Img?uT-1oZ@f@SY(k=fb>RT}bqJ zf-(F_%TswGhMQ!q<%W{t4i4$wM;BMmir^CsG9YC0)=eK?C8Rd?hoM*~-dmO0(-J5} zN0O_4Pc^SS-0MpfAc7js1V}auaFj-?(n?2iU@!CGlDE^EPLvPx ztX|0mRG{xJlTjKUu8y#;ayd0OxGQ`ec`ON1g%}n-2DtL!HLc%mA?Mnf$V{@03HzOC zeg^q+Tzc2oCplucmC`jc{(mwpPj7@m0J~&Bs)(Bh5^F{9ZezF@sq1a@?e5Zz&zde* zsnl-jmt$4;(b#_mB;AQ#P=!L>W(3%W;xb|R%m9AbFiFutftk#UYW^|Fdcujc|Rk2`Mrl7v^x6td})oBO0Qc>C$Nv7a25zt`Z4 zZVtUK_`4V*G@p5Q9K~Fx#zU}tZypz@6gVuFI z&O~fv$m;?DySvDY?V2>zZIvlWr^M#7i@$Kq@!MP@dt$DFm<_$9 zp{@!l2@>~e2q{?IBE~Uel0K(O1>gFgDGB4Og>{lE#WheU4Vivw62nelB=2|EuV9`R zzLkHG_Tk0gN7__81U}3;Yy4fY7XDdz%D@=N%2V^dZUhzs-U6b?##cCPB=++&UCYgo z_`76(eA`aHXL=E09Q}8qRaRo5mHwJ;&hU_4MLd$Ymie-g?#xMkd`S(EfPoPRCB(ia zT71HA{fRH5c-pKVchy0~@dy5lY=5N|=U&=OeJqM=fz6Kr21Nr8CPP-9qNiXWu!{ z?C@R51dQ((a*>P5PZp& zKu88CRA-0n1Sk}x0V=7f6w)`pa7=Z3?uCrnO7wU6AiB{xcQYT}6w6L47V|gI?g60* zFNKXb(jIv6Y?mG}N{&rFZhaGWX%4ygb?c_>_$4a2YQXlR*_!#$niY0@dSl3AzOpx0&{_?}S zn-6zo<6g=XyUq;2xA2PRi~3i~4S)1>^M8Mb>VMa7`009Hp~HE3Wml)bHJ4OYu2eQ1 z(jLqWDxNsXlK^XD{8az=rz&LHAhpn{0dK>j$Xu~P2j##1nzyJ!IL8|2?w31b@|&)- zxBgp%xiGmFs!Kby;!|Y)uwv}ByJpFyo*%2dE<_SkB4E9~EC=Mmf0hDU-ocaN0of4= zv&!Tvmj%m1d7r#8*a#^ZaF+Fd!UWh_g?W~bcG_;3IUgeR(-WLb2J;?*y(fBL^&&F= zCWcFcE;x<%4zsl&6UBGsaWd`W5DPCQT=`Qr@RM}ZdU8SWDv%9@ql~s=Bf#nL8|HLJ z1+ek1{cPCXBDn4A!SnBDVqxmTO+qO`m(e39s5N(v5j`1=8sh6x^w&35fW}JIbOZ^& zR|h9Vvg$&`1#g-riAN}PHB$ut4+hmx-J%`?>L1a{G59Uyg9ct}m!Njo-PBig9o38p z>)1>Hv@)O*^LZ5nU$sUS46K0^W@k;6*QALRyF84n9O>OgDM}HVQ5bhen>DDU_57ds z0Ccd$b5pu1<#QydocA9xG9YzU|1hYR zDr7=|CreX&ry^!LeXW#lW#M8kM|yM=ZNAGrX3yC~K)3J;YXkBGcF_2bb=NZ%o7xml zo-_w$pn(?eopI+O+`RiRtW-J$&4BoZKKDqqKb=|cO`d$#9sS1nY3$#yS7a=F zX$;Y|Y*GDITXXK~hhJ-Ne6>-+9j;e%GHaN0IXVd^w?svmP?*6BzS1k63gaHv} zRT6aETrpU*o9)M0?%{TR-lud+H!YQ06&B4$quXBnsPY|w$=keyb{wlRv3D0PU%7K!>@{1SgN z7gpWyyR8?`DL(~mMG|NU{Y8TaJ6I}{|N5QvUo;qO4;j_?qwmCh2|0YEVcRuJR~a~> zl5i%=b;dxNlvEjyG)hmk^J-$SvCxPplKYq19!>J`zAoXZ8}Fd?nve~w{m(QS27kzN zhY67!xk5q%x4dlFu=s7!fe+>XgROCTVX^RRCXL$oW0lHVRMk`mnc-Sc_POqFa!-41 z?qL((PS3}`dDSObi6*sI8@**Qr8?gJ$A%cpL*k6-QyXJGTpCqH9mp`n@P_Q_cZWbq zZ}Rvk*{|`FSKHY>6dy0~3EdS!{yH~m#+z>_bWr`BDuPH8>1OOm@ilM}I33$2o=r7m z=VDFL^87$pBn&mV+^cL!EWHp4_@B}l?aepVr=%TE1}%kEuk>{onz9e{UXglgwOAKr zICpMyh=|=i5R#?&eQsTMrnx=K_%AHZrx)tFze{5ni(%Ca4$tLr7V$5&q9PCjITTZ% zZ+3h7j+$8K?+dLu3c}|43;v4??^tF}$sD&bNoK38E4Ir`!Y|ryt*uh*DGS83wsWYoRwv@}mw0ZgFu!@gY{1L(qM8cfIiZo$K0W@4Envc&xBl2Id`E6t2 z!<6IyB52nqw#7NVMJ!qr@(|@x0$WH?!I^D+*4$%K+gBMWSQ9*VhJ`u<^Rbz z24oOC03@utbZ?v}zT>>xLpjumK9w+;uxJwK0SX!HYKf^_$CS|XEVoqfz0t(5_{r6O zHFC609{FIRmYH+-MrG4?TD=L2@dRW{Jp(c_UftW%_cygFP0Z-|moe9Le?-Jo3q$Iy zm(^jU`FD2y!^b!FhbJY#ud&9x5rr4T(m?U*>gVCBlnlMA;Vy;OW5=~C>wX8$(~Jw~ zYlX96YdsMsWDI*i4bbQ8dah;SCX-Sjn`?7cAsCK#BLCPeM9rn)eo}RO)C<#D;|{I{3BB7zS8E6T`?_=3TYX#?Xqa^P#q9DR2TG z&d!SQxbbGw{{ng@XGm!ECxC1g)Gzzx*oUbEsQ4MvY-+T7D1S=t*y*bi9-c-{e~p@h z7FWub@^5uEUzCjhx6|I7d^;1!hhpkYsZv1~-9edXa!QCD8?Z>On zz{Pc6L^;L}NAoFAj<$D!7sCE~m;Y19++xMrVZBD32gSxRc_GjO=5H~@is;wqK{TOc zZT5NdoUOkVe@#g6gBBaIFy-_J+TXiE5FDPl!rScHDjXJN{#vxt-F50OB;!vjH^;5{{_ zO>Iu*+1i!cNm!)EXW@K^x)<=L+F?fz%r|!iX*qZ{$8=B*U+Q0sWJ`N+UCG&c75uo< zq*MgxY5%-~0>4O_$bo_@?+Cs@Qf;F2^?o1|=y%J_GY`oA)t$SGG@ts*^l&YZ8u`l- zn(@G!Z&o`emX;OizLOUHsjH%L^E0Sj!_&~~f`e(mnYq}jJF9Dk_}p(3E9vHcf%;9} z$E8+8^E;y>r;E%TTh{EsW<+K!hFrG%s_w-OUDA1oe}SK@vZd;G_aet(#D86QlSx%K zfAKt|0!E**jDwnNz2bnY$lgKn0!!O%gYIx>(0-pldE>H(T-)HHZKb%ewnJyOEq1xP6-&G`RTc}^vI zh0^k0L9gl`{yOK{3+l4L=VIN|`M1q5XL=7$me#2XA{Es0LYiAEPVoyLS6IRFm-pv) zXBzRWX%Jw$@q(g__YFZ3)_;SbTYzLxOt>&^?_KcvlOd_IOH@hVttp3kp54}{>U%Af zIk8EC;@S;mRcTkLgtJHqOb`ISbI32Q?Pb+wNwvLYwSL<&i#ZGuDzwiW8N?81fNox2 zOPo70bMbfeTA0t6DVOvyPO%-&xY8w9PA|i|PHPQhtC*K70_RCtBwqj-v|Pc`o0Siv ztDj}t27Xn`RRgz{C*MTHyrH3dts`$={C~Z~-3^+HhUMEs@PZte*wwo3A-4Oth9dmr zO>6$E1%J;^-00XaXo`4@z@gyonE7Wbhkx}M%Psa@?Q*=sC8Z8bxR9*?Mn(3p+zLEu zwmp2DMBGP6Ua$L(yJwrSYtx)Y6GnuIMw@)*iU%py;KO^wC|L>#e9#LgIZ)aheeSmJ zuaS|O3+N4xyVlLe7CKw@6b&gGI((IoS16yC>DlU17?5~vb?y#;v@WD6rD3Nxbn{!| zSl=a9{os>b_0t|~n7a@vKH=vQp5_*ql;LAvOC-IK5W{heE^rpw=-p=@VU(e?>Kdnl zNcTt0{fxBg*=fF$k!pX^ySd`3bP5g=V;5L6ccqqA^7?%LZ`d>^-`IZEz}D_3HwP~u z%nX^1QiUiwBVHpm?avNg3Jxsn7g48{DY{&kc!{)>O8FCGumOs5zPSbPi~KF_R9nky zXHJQXQJ@q@`NT&?XQr(h4eb00to;U2`cPN!>_=V#!lQRnp! zEgi;zjV$1ojuXyuNA1k)8oc_*a}T4V!=WPt?#{WExV>su_HSS~r?9YnF<}_6Q zdbfAeZ~ZiX><`0Exo~HwB=9%=BC89#iC1r?EO+5f0{oC0Xr1nn(#)3Ty6j2r=|0=> z$^d0{OvoqP2ZAYDPzdqF+XeW@^IKz+k(@ea#Eo&JPUsl?!FCGF;_R|xylJE*v%NXtLtxzxx0T{v z6mRhNDLeF51>Do^3Oo~RJrhrpIi=g!&=J|M$@{J@Sa^GeLlb@B$VU`qRjSi5oeLvJ z9&F}cCVsHiErcsY{#U7wy`!}F zuVj%i#paM{cl$e}_^aWt<@(I!t=1!7=An&<%mUMZ3&bs(-G5oz;T+q!D>yO;=N(gQ z3W3?6QfV_`FJa54(>^P+XLA`n{Vd#utEvymIy1qyuj2_|tV`TI(zZpaLOu=at-g9L zpJYF+20HrnlKf>4-zYZ79cO(2JxR_6EA~vp(Jm~#$p2AOd4RzdS`bo_QN*?q1ri7`F1p%$NqPbD&ir; z`J(j$HS9;;X3a;bcR)cH9;=A>_pFwB^!d}7nNNK|OGLT{K1fI05c7^9)5;FF$yM;u zdsAHd4e8xFcrJAP-u6ELWPD=HfdA(p$Ez0jKyjk-yXl3`P*x7?E^ImUU40O=l-nv{ zN;GzSm;Cqtn6lIjJgXXXRC=T5i$)3>LZH#{`!*upq7 zyyCtBC``iRLMnO15ItDqP%R&Ulan`9bj6>n_y?5_Z~L+}y&Y`lt2CI8e5SU!GIdE+ z_rIZ|#JV@1(RlB;m5m1S(WT5T;bGN2o`(7)pS{??B7fq-+Vev{JNFr_$x_TQA}b}} zSz$&)Tnpk=W~C;lp_fPNa*_zMRyz$|5OT6=s$$}IL$1wYZ?~js!}TE>P`L}&{A@V( ze8d|esZh;WwJlV1AdE2Utp+bg{8#wc#PO7i(1rH~tAkT|!2jyi%)0la7?P^XbpDSa zPazvt@dhGl_&u@QG%2yg7c}SDZr<^~YMn9-^!iJ&MSWR>-91`2mqdg;B+^h%AV?Od zw=n>3yTuI0JiGMtmT3H6mQV@0kT{n&yi*2ZXSRIu9=JwXu*)}w3-MzU=PjRV9@y`{ zgy*gsh)^3wH)&J6gJ78EUF=S~z+h7J=f=fgP`CN~IM4w}%W*3soFU(%;YK9np96s=i&Spfp- zUrxXKxUzI5`cO_SzbqMAW~VFUqqB~S+CRRvsMDm@kd@iXv-1c%bGh+A6OtCuavh`D zu&9oKoC0*)3%v)>HPnm)FaOz@JgRf^L#vyDVOm+uS6wJL|EI4+(Y}gRTu2Rq7=JfpK)w!AY<$09u;yAJXN$6+jp}$AbbbejlDhvoA{bL*0HVtl{PaA=bDuh1XLi%U7T@)p1 zL9;_9YoQ3|Kohw%qCyV|wf1p#8^z6=U2lk0_8;%Rb-zhBx@J3IGU9H5UCnb=Dp)z&5 zE^U+~s0m5XxbC;z;u#~wZHMCV^7vtY=@GrT zEbMap91hXmKzg70lq`>YIoe zA8fp&d0J2=!R1)3B=_aa(mz3=YJTj{m>+%0U(45$-WxgAC_qmMn6;uOv2H$(>_M-p z^myy`9C(t~=XW4=h%ygW&$@j!EpdtoA$r`goyLEY;$U9F0?n84HSd+iaKAwRndOt@ zg6DgZdJUv=EP3P7eE#=3x9BpgcGF9(Kkwswxq*5YKr7)D&i?F_d{philTzN8yU3tD zxXb)rD1DXvsdU2FFAu(`RqAl{mqqXg@qbrvq{xYGp9?KpmCN8K>#YGqUp_K5gbIrX zOo<6x&^&|*{vbQxE73(eD1n3m_}%o$nLFZqF3sGYPIg&c-n4`-{c!!fb5yM0%3m(< zN^<9hi2n`X!O~`U`bA)dyGp22o(o~&&rzlVIEB+xlN}A@EKGaENk<#8LW9;(TxUkT zZCCoZ+yVY+x^jf2umhnEL?rn`Eo|@w1Eo;s@6#>+=3K3Mji#@+4*LHc6GhDMhEbX) z%v6YJBIjXYqjk4W_;kki`Q@-*Vo90&Hc9HLBx{SYm;BE_lDY>xEGG{m%HXtL0-wZn z$kW;;IXB%%FaB1+v(Sq1Liiba2f3deMVP|#B78$W?C$w8jtjvCJ)bRM zx0+y~^$nc#XcN@`yp=dMrT`n{R-u}GQ^g6>mtjBW$*CURdEH=9l+^j3A@7WeS(`x< zPd{P82A$k$WXrq4UQPY*C_qN07=C#TIDFx-D{X@IXKW)sZ2NNGbli!gi~+++ ztorenfxpn$$cbLdGcv?X_GalFXEVQDR*Jea$w%Wt&WBNt!14>}uK*te9I4($ltrms z+=12K8`PRovC3Ryeyk_cQY*kWE;M_mLvh8lD!px|VSwmAd+uc+@czE-3ab~}y3BQ) z3d4bI_v=r~^F#Mf6yc<}bCji%lj!b7NvOj=EyLy(zfoQsWjj0Ns&U-zn3+nGY6pL5 zF`gxhB~gifw@q@vM&2%r%7-uK+g-^nX8B&^T09*k%SKN${sVE!Z}0E~=lPnjU=58rZQ zuy{?1`^8Yj?=tqE&Zs}{D?&uHOoj~)*^7(i`5#6Gq)a6Hv`b;saXkV%3N9UZ|J!*B zwT~cikcCVMbY+TMT-nX_z~7g8uap-SNA@2_t`>>Ds3CY*o^tKFP>O(kaLP$Yw--hZ ze|D}M_XaU2-fBH@{uunQe%O+^4=>CK??#7B$UjD+?6DCU&vd?DL>2ly^&S?cd1H6< zpnWoC>Eyk)Uft6|%70@NxTp}@*jc`%ylP{>t_}bnIXH??12?avd7Bq4I)5>AT$KN( z=Td9gi9ufeFSi4*2ybeL$;lVbuv|$F;)QKzJ>b3fcP|bY8fiOQhVOL;TPv?BXARHS zW+@uqJT0t(2f2q7PCA@H**b;FI+W(HJo^j_{=?1HFxn6EC`*0zMP_UAYTsnIPsnZj zAc>UK3NBSG-J$Q*ed6*T@O#*x;PZIPA1Sx)4D?4V@%?&D%9I=jP-_r(!%fkf8Co4vzF<@J+{&MIZRbKSR@>pS@yTllBkD>?J{)~epCQ!f)>gP5 z;waVr(k>_oKL^<6C~4&GInsYH$jAGCgY)H$zKPReL65(04;RkQGHhU(s{juc0GpVA zYrH;*FRXneryu14$kgM7JXd%7@Jt?)ed|#tN#~8Hu$R=NASio1hGR^)8 zaJDOs?9h%DGr&hCckI+y{{gg3E$)1V1>0wtjEV90dOh6dl*ckUv7Z=d_Tug94#&ny z9<2q|5c|*S6Tn?Tlqyk82xm;bFeVr_)+M~4WrF)jlT6#dVGS%>pay$V703^^yOVi> zy1>~E@bNFuM){+O`n}N#v2~)7@Hk7-kXNmjOaqJ+>UgE%42TVF$otI>a~Hlq57rutTqdAZt%>ya&XG7X9-9+VIr1kZ#n+irF7?{~{W1^kEODy;a%hK}{CcLd-)AyvJ<{ptR^6Z8t{4APPe!n za|iPdVR_R%Ny)8xWzsWH#oFW6=qW&_zIvF5j5>So_z!@Jtk;LN^Se|aQ)Zcz$@(3; ziGc=ZLvK}Xee|1k?hIV=$Q+n^OSremWAxDwbL`cQzxX`DT3;%#0J zyDUxExXh$hPN=UTks|B;=@&DwccbAHSEPO=R|c2+pGi;j>*Ews?}TpXs!DaJ{fNw6 z4XM(e(}d3WzdG>er=h$OcPc0?cEV{&?G<(qM=bIL0vF$VdbeOaY$CWwp~xvU zOKO_-{e)z0ppP$`wSdM#J}+veH9tC$A>STc9I`eVj6*en30o+rVq*Dudy!w?!jqOB z`Qz2eAcl}#b%r13pmttCf`;+@1#u`*k?1RhJMPr zVMSj*wS#~AT;9O%eY4s}1oi8>jEa&l&;F2ib16{|a^Z_G!O7*$I6+`rtRXAw$z`yo z?vtAg$~Xwj%B;W^0ccskjY%Cy!}qp0?g65O;iBZk#2u+X)xfkU`-rzcO-Hu+J@1tk z|B@;;nV)i_Rf0^J8}CcxS&SINT&6OqZl&5qi-a6eY+;Txoau(PK-*gku}Rp*4!w6b z6dnr~7~3#1+E0itVJm=9KP+Ln@CIY-Mmm`^tUv zh>WJ#fe(r>J~s$ta$>^-f=~)g6LPcOMae+3^60~fqH&WJ%tLB2 zuU)@jlW|1)b)DE49hfy~jg+gx?m~6qa7Zyirs#^o(y~_;@?J~0-dQxOCHDn$0o-h{ z;N3BaO$+rD(EZ8jk2ucT-^LfVi)s@j8cZFkxg41$#MgaGDa+9?t!bv)s=^K>s2A8C zT55P%;Argx$yy-8Zi@})p+O#$z}?=ktof-(B3c;ELinPxEJ|r79Em)kaRb~bn$zRrI_T)~H8QznFgzt_n`A2!QeDMPMW&35w zVWFFFk+Y^pP+|L)#@jyuy(;7FJ3uk%J zw=BY{)&043A~E!bPLgASs0bqcr+T8DH+xZtf^Tv0c)q6Y>xbAxd5>-)4@%+u&Qu}> zzeqFu^5GbyswE8RwSts@{DZdIrvMIvR z3=MtdL1g?q&WFrgDB>e~{pzhT3|Rf-pg(#&vbQwM_Dr9DE)BKq_~aksUJ$J|t-gs( z@KZR!#$KBHmL=OK*~B6S2!bmx{&yg+VH1aiKxuLBfTz?A`lq9$mAS=939G8-xdmjm z91Oc2b1Wb}nHlo~_us?F3X3b)U8HYY3Fc6Q^HU4Wl!FfeyWc?RWqHofN?;~MtwRyQ zw%F%KS0NN}i7U)G7tVr5sXOSSAs6r=$Rsl9rD>fz&9^7~e)x|`>5^JJs6JbF){rUh zv_~CKvFYIAzP#1&NBf3*RJ*`^;X$*3)^Kl!TY8 z^&|Mt-tMa&ug6+Xl1ymA>JDdg=@g&vZHN>}bNofMt~(M-=$N|kLKFH<>`=nI`aP#% z^4>{ame}od+;VG-!}6cyGGf#Nu|1=|w;lN4@71JS3u3=8Rp1`Y^pMH>e6qYSx{oAA zCU>e7?6NhIKP;#m?BqV+adQn$t}*jr4o&x4m5+Fk#5r~ZN|2qcvnYlu%)w=fAW1h`sKKK z_u`cCD%0rI(`tPo3?x|>O1P?;;?X9y31F?AS^IU0V*ggFk7hl*b@7VrDTR<9^6gix zCC(a$)m|;Or60!`Il?x{uU4cgW}2>k(@zRLXiiW+RDtyEj#k|KAT*h|K&?`OurS#c zUnTeamTN8HC4&`NZv8VHvOP6y3|%BpVkr(< zrhU#Zco!_>Kl-yuAd^5%iBc0U-?<&CSX8DUmmL>h(N#TsYf=4kb$*Ueq{Osv~;=6lfM;R)?stJa)D%+5v!I1erE zBUVjlxWCX2|9i%rSiQ#H5UbKv;h$gV`+U1!X=>JYwEyxu-a}CLjE)Sg)-$?MuWo8x zF}Y3&J(Z#~c`bMeZkHTo7~XjAakg6Uou7dRtBn+<{f%KT4WjT2YB64@96~#A*P&1J zyi$d|R7}F*d@-Wk{)5qbV^fL9aj5Gt@cFr?iir{VB4e`~9tP1uTCm-z8}vI~>x!}w zO#3^-pv{`xGdZbLos}INB+R?2lu%$}&ZeqBe80*HU~B)k1_qN~iQIy8WsS6L$VKUp zf5k2J>L|sUdvd)(fz8Ff{wed3G4}TJ7V*;k8nPXvC$T3bY*Rl9;629sIIQIr-N{A?D1hkV&+nXI1_D5fgs-Fwd=Lzu)~l zP~7|2Lc14}$q-n)zK8|W{=sl|C^x7@K3h+lb4-n7Q{T#m&(&7@(Hl?JIcbjDutA-W zul_WH&y4R34YRDD{k~c2|J~}X`1agO&eFiHSwvjO$qyZ#Gt8~BOr|cqpX!bB(!dU7 zywq7P5Z7Si6ZzT&d)sS9X+(>KfN7wqre_gkJBzgtFS{G=CV-%}P}sS;>`5HF%r6_C zJ|)QJ>D&yu7tl8Q6DCtLGoE18RFDf7Kb~$Qx@BcIj39dbP+bwy$B>XYQ!cJ62X*O+uvO%fHK02{TWX=URqu8zT{?jWRemX`>9md zn0sfc&pgEi`D*W1NusJ2l#xrTL-<|C=DjtUz!__4>9_ZJir#*lGhd&e5sUd=n_>GV zn?^WPJ=;c1Z09O2JZ32mZg^~)QZ+hMC1uS+^;~~fx}Nc^=1bhL(EPiVGiTGs!AHfC z9ww?+z54O^B%CRmETUg|V}4{i=?<0P^!;h``l4Na-%8N)uIdvaj;?f?Y6x;la6{Kr zBu?EWKpE1oGulXGzZ&FNe=gm)b&%PSO0h}ug52}tA#UZY&2Zs1XbAiD!RiD|o0;;f zx~v{J)9xEJGFxKd{^yIwru_OYFPp6Dj0C%qV#to8FL)xlrQbh4^xzSpW_ZrK{lRVH z7bc?2JO1dN{Pua3y^(ZT`?>R1JiOgO705HDnvfl{w9F@B9y+kzE_-F)!Vc9z9t}37 zo7R5i?1o>Fv+u&&Igjx3q+Ujg=^v5nu03nG03tzTwWn2am-t_-K7t|U4|^QhmQrf~dQ0lY0iUoKu*)9-M}EQLRr9)^60JNqk6{faxC z_wm$ogmOXGFmSyfpSb<;V9#TL__v7Xhu+5(oLv-wFW)0+w01Sx%AV_ZeT{U}3gBif zuI_P2DlOiWIuaf7lG--!oa21t6T|$Kx2VdiIxk#Y8C*pIHP?*iGi}bd%hq}Q%KjGX zO<(m$5(D|?_p-JZfXivj$3WvyACUmy>h|qRc0r94&bTkFjQt6ag0h92oc3YqO{< zr33M+Iurkt`>Q)1{?Wr_y?G+>T3cG^V#Q;y^zv9v>|T8}>yx|Vw$GEv4Ua44O(I?H zmnm;okA7bKsuIiCE-+m5X3C?6t&1{pkf-X;&hOV>O^)|oGgkd^5PltGbc>M`QRW-J zCsCW~RDJnu=BB}`oS0PuAUcWADbvXdLgf5~^i{;4Wf_o_Zlqp6>0f$T;iS76#sQ zd#dXR1YgDWA@E|1^iO6~>v?lKu-q<>Az?kOg!0aOsez_od-S&OU>nO|+Mn6#UaenG z-|zJ~y_IX$%xRES!?=oPAIsD%3w&w6xoGirpN3t5|Myf-VT_#Ct7O*R=c~2@nM4ea6e`9Gv6f}8gG4@Sg4TI=UtUU3NLFlGsnw*=g(SWqB7Rf z3{&&$-+uSP$xQeV8!HSPYiiY%Z&f@DOHEh_Vum1*X6(jG zNR!f4kIdG*SrhRT(>lqIIn4U4q;V|FOk`qHnbEJk#SPH>Qc~#K(8Qx7Gkr(Luw0KNkMGtr@v-;-fG<)?_SX84CO?e#D&?% z`4~x1I&5dVE&GKHs9459pX#FhAy6`@c?OHiSjtPuI*5sOp8 z%LlhRwxI?mKkU`P!$=(>4$^pGRm${rfgGr|{k^EWYl z>5i$|9EEN6y_;Ql^%a*b7XIo!pM!r5x?`IXnvAw%%9}yvnD{l9#tPG|3-ojiF zlOMlXdz$6Fr11Cc9)(1X=|A$?A1AgPcS;cjKAe!>t@ujcyqJ8`<PI|R%wLLA~t<)S?eqrzi=fM|u-P##Lo%}L^g(Y@BnKtq>TS`CP|82O-*4p96i_p91xP45O*LZ56bnwDAa!hDn{Tt4T8B29_ zA|3MfHwGY&N-mK=d38CwiSqrg3q8wK23>uRAH!}ro;(x1+K-_bcB7;B8#O%JO(G}_ zZOhvbaXatb>@&B|OFqN*|C~){J58oEE!-&uzKTjuV>*)kqNeF3;^OO{2(I7dt*BXb z*OLu-B4k25gdeQ{QF?)b^7U82R9# z0Qc#SpqQmM0G1pg7cDVe#nQ?SkqN|f$6QL zn&KvXUz*b$$a5ub7T|rgZp%e2a339OCSyq69tc=VVY~to|Agb#L@P=u{uC116wkuj zwHm(g#rblA8-lhN;`6-Jc-d3iU9aJ!q=T= z&tm!!5aoXfCy#38U6#s5bTp3V~qQk@$Hv?B84NDT+8moKM#IXBZG40wLf*0egDvpPClG zYqiR`*IV}^xV*4AlE6TeX)73;y^@s>jO5L|m8*tm}p!kZ~WE-qodg1W~3 z0ey_3CJ+9TGlGk40t*6gEy+SY$r`kR`_5t{R0mp?1*TyG&^{~d zfoD;#VCRLt3)O{|5tN}}+gT_kR|dcwWXGS%i>J9sCIF6q#l!TINI?r=n7526GWqU0 znid$;+XH{~(+x_XydMg7(R7Rfp`;Ejod03_;r)aPV#Tu5BlP@D8IVRm_CaJggsW-; zs}?h~$CJO7%s&JUh-?OKG^bvVb~IO|H)1Tdk4Bbqpwvlx%RGY}$Ah6*T+OA5yiE)Z z`wmROVS%@BQ!mL=XWv@#!SO19AR<~{KZ(r~M-`cUd*s7PoKMLCDnPv`K+Qn@*$Yi` zO&m193d+E7aCyJ(E}gMxM8y!NGFQ=vS02Y_C^?!V!IQ@+g7;PGV@kqDZr;LfOZ!nb=&p&+0!Ua$dQLKuSXs|v= z#Kpiagu5dfr|$u#oKVvtDR0UZ5hW*z;G%k5;s z#zkDGP+`MN`f=V|P zdE?UnIL=w?4drw=4we<79el$3rlNa@&>P3d0=qEwU=_;U>7^m+0mB`%| z2XimW1Q%p-#loX^KyL->Ck))qf8EBTtHc#pUTnF2q;(iO32;t~bNu=pJDDtbW=*jT zk_?Ks42A*Vw#3j$FhmuoT`dVSq-H~nw&ic_gqk40O&2wyoeB;Tjg*1DLrhF!k)M22WS!jes2lLHl@@{=fOe1e-^ht{*fgaJ_O5{M)l+y|07~i| z{?zh|Xk{AAmLkX<3IyHw0UcK`1e_-*(&Nc8TmC3GORgRAAX|y- z-Oo?jgj4+~J^iqS%5*~+I|gYk7G3a0A`r!K zcEbLJXl=e4%I7T4?@4Yle!H#iS^Vk4QviSOXz7Y{J}h6z_?EU^m6ApkkU{603-DlK zgN$$M8(dpg`R2xBBOstf%EP23AnSwdDW@G)c#G18rjfP=1QLA_uZnUlRM_HWas{Wk z-)277wl%NL#P`$SCIQoJu$*i4YZ}F&mz-@|+xN<>y|u?A0d;lDvy11{IdPJz&|$HB z9AfjNN5T+VOUu39z(ZWj><7Xu0`tuPvdSm$S3 zRIWMGn8!4ywn8$@$L~kgfoK-lq3SBEIe>?`O;B{-f@G9!rZeo4D_>a-HIzU!ESMP| z%pHg2({!N?VYymu9}fUfQ(Kw>b_&bj$XX|j%7Z)WebAv5pc>R`wEwL5us|$WGn%{B z=G%6>J)Yb{Dd0gwl%a8EI5vHah=#RvO$*lMx$GY0g{V#&&O^YwP1BQ`>}6WTOb1~n z^lG}U!&M*bpUGyh0J_M_*WI%fvIp`qRb$b7?o|$^$7vCj{VAzzV8mLaM84< zd54h!w9g4%;1@3fSUjK6#9gj9&SK8qVujFN*#6(FPrqBN{WX6FZ_jA{RxPan^m?~3 zm^U48b=@^BykyUtEjK^A8qj(>%EX-i+*5Y>orRu-bM-$5_9m|Tjo-+qgGWQ+_)zO7 z&1a~*U3cc{oZE^OCsQ_;TP&ARiPZ|(1VU;eormF@@NxXJ9KV9oWv&IlnSj*E;t33U zM&*tIDjrxd3c!pdKcZylPILe+UB0PhW4wDapz+}NyjZit6r~anT?_k<`EB1cnu&ng zGdH-^obPv__7_Fp_Yua@cva=b@5V=y=iQqxvo$=cQ@?Wp$d(|{AM>h-RV}ES9WI9o z8Ekx0EKmb2A=yD!g+OB_LZprE=zf0h=M!0!)F2;MXkF-v(fD#j?lMBN^AVb^WHY-B z&P?lSJ=;-}*kJ;DF)*q@Z;X<xXW1kqm>_EF!JtE}hU0=x0!%5jF)Yy2lJn<~k)*L6 zofLm!=dC;jHbD9l>p^B7@x#U6>jY!<7iw2+qnIG~A$Z^EU9LZb1dVFiK*PmNZ{g{J zQ)KME9FUJA;@umhu__!Sdt{)UHfUUycIZm96?Dvt1zM`)sm2M=Z#69cL$EBbD%n%^>E~;3>6#5l+s|ok@`aBfT(Olw zSzbCR9FTYAxsWnqLvO3_=qvw<@!E4*5}XiFuoTs$>qye!gSRKT2VGfd7LrY8;4@6n z8DG!0T#iS$7ayr?Uc3qI!juDb1AD+8BlwxZR~aY6TZwPlo3#Q#rY1cl_JthBm0kxn zKYsX9IS}(a_az-*ZEKz&N*VjNvK~x_^>4i-Wwv8n_^Iy)`N(kkYUoxHU-3XR5GKo7oe``Ok z6@F&@mSxSPmxyBcMsS``(~o`^;@voFrVcTO4^@roKqXV`)Zses_QIXFi)BNZd`A-N zZdjn(PCu0nN^VaqGJ4{EX0mCGCIL~s{}Z$RGFy1RKLdr!ZKWnMsMJm{Ez9mV9f%4_ z7_&ayXt(eB2oF+{u`-Y!N%_f!5cI0>5@x;6^ZSxm9Go&}kgWl&mOlM(Blu3zs8iDD zT%ot%#*amWSh@S%HKl`aOi)3qQK~_QMqAVZtAfABtflTJe5bh^!L>R~I@T`9%k0H! z$QrRqk9+z1vLIQ8Ju&)&rsf&vWg+$-o2PGwb}O@RFhF%`>P<`^r#4#$Y(&1ae&)A! z=5`K1f@Fm=HvCdIGK-wY`{+#WPjJj|!@DdGVunNrK$fiWZK0hk-b7+hmsFiVLn|X5 z?l@5J{0j1Dz3bF@yl9kTtC4HJ@RkAP=VW$JLO}(Ga98BQTJ7X``CUt?w3EKU6bcoP zY@9m~XZmgt^udB_6yg?At(090?tCZkBS^Nmn6LIk=WEfhao3ckPRgN+4(>R$OdHUz zSwH;AF51j%XD)$wt2P}385~wRk19yKfw9=~CInfeDi&+z~!Ouq{(+Ht#e*Uo)nEsjy48dPd*Nu3+fgM zpEJC(mr7B|3<8lNjc}Cu(;7TLrnAyR*-FDYZK}~g#zRB>Au=YF1?IaLAU@y2I^D4O z^%+7CUG$6qr@U^J^MNA{h)~Jb?u)hZq@EhUgu<=NDM6)vh4yHmH67J69cwubC}@dK zj8Q0Pq}}iy2FSG(7<#erVLf`VD{ z28)3@u;VSj-}bPFu!Fiy=!i*xsVi*IZfp@3B)V54R!t^1f(4o;n$p=(YPG)!1qB0f zT*=IumKOk>fZl|i47eRE*y(8jf1W1S`)Y<8uRnP?bOUr*nK2dp>#1EsqY^1-iPmv8 zprqNJ{03-AqN1QHJH-POoMSgctK=g!7z+XgDWzxQ==h`@8pE(a!6p{=`{Z;tF+e`_ z+L>L&E>K$xQ2SF4VeK%+EnRQaALz`$J)J*qCaPZF1%cYL!w+2QT?s)o_{erQg;SY^ zV+WvDrejwh&Ia7sbwsgWHj{Cw@?^m{6Lte+I`w&Vdb~Ib4^*R~(*BxZ_s2s}a7W3Y zINd_L^X@i~agR#T>nWpF*I-blV5}JMiY@QqM@B2s<}*d@1SDv48n+f*`8xISEd911 zs9ROu!;o=REN@3z`8z&{udY?Pl4y&v$eT190|V5r&;rfGao6PRiv=!i2cIun>%;&% z0zcI{1~bR!+h+Qp9M%{h%PPd9a<$6hQW;Px~|5kk1wr zN~9z}-G%$sUL>3Ci(FC>1D1{;5TQJI;|sx1f-Ekl$I%}!K}$?9 z7$Cal)@k-3_gt}|$q` z)TD)$V|3>|)`uWaC%HtfD_c8NKX)r_zeg|&KL-mjOJ*5qu%wT;kCUqtKm_dL9V&eP|@ZZ7=P;nv;6V$-W8vb&>tp81%g@8d>*R!z3k~hz`Pk}z*!Vv}d%%2Mt#}_> zdANAFTUY_$EdLqrz|8QA}GYquOuiZ%*UrBDyl4^B*rfwCkFY~R?XSN)6Chz z3Plvv*6x4W3jTk#6<2V#GV^qChq<^o{xcOdM@KKfyiwI)1#Mw4C)CWs&e_w&!FFDGY@Yowa)R+e@aC_CVXNK5l7+c|n#x$`PJnt57X zWBljS1o$8jf&cMpKC?d;9Gq!CHezckFUdM~Thx8Kb89U9_O#%rRySS5xB405c;mK7 z`Jk0ITm7((HkqBBE@^3LZxA%#Y|pEL=zMF~r32W-0}5Y!2RkU5iie)}P+e^Xcq0VL zSVAtQhAMT^lmqEEadb_$KI?k7SI?fG6Q==c#|PM5QVSu({cpPO-i95gfo!?92*8NuCdCxk$6(Q={M@y#o9z80kNr$ zn5jPY*tv~o_m{9Z01`2g<)xsMi+U#pwkQ&?=$A<{v;)9uzXtl9-cUiRg_~!m7?exON-h_p5!|*!B^xpDu&HNTsQxk(92bYmK>V%M6}48_WZS+4OREz=6FHD{$Z zq9*T6IQ}T$A4oJ-_P0+%@0eZxQ2v#vCJ`(9#iyYcUm$XE*PT?sE@z`!=dpBo3jWKm zE+7-tj95)TWx`*~8h{Ac@5E~SHvZM%tBpiG@+KrRP+qy_xLbk5bNO{PW?vfFU+S(O zW7xs$zr{4|oNC+AQh}OEVx+qK${$`}u9K(OG6GxZO> z=-i6`tDI?HBJl-Z4t`=w?lE8w2?ayr*_x<#;|3*L-!*YQK|FDKpwSY3^4~_Qta2q> zGh%!r=4{te1<&{piEl>^zxbxhjSr;o2FgRFkVp8BIZfBeAF`k;x>+UrvRhd-WZ^{v z3JYjq@&+2pXs#8uEzTogMu9v=~@70|k6f!>xpGhJ^2v{94`)x(YDa zY;()C?y#6QfB6ykP4?_FaSo=g3>v`H(|%;;fghGW_Os|~xxqIf>yFIQIHFZAQx(xL zRM}YBDV9ngy(wj2nT;yn_sE{TVQ0*bLB{tBn{U*q`jrBQHb8l`UL7A#RN3v`quNNz zY#=m|VOe@@6D6$c_t`WpTc|@61Tp>&<-Nq*`pB9Db$7X>n@PYXD^Ol1=I#fJCScyl z^$k-4j_-i7p*GT@@>7IEEay}B$u*S6>s*g)AD6q#Qi6nn*ZnsQKs`uLdjlG#>!rJH z$fGuLLeyfcyDUx$6f`a$)sUgCLeEdQYXjN?+UTk!E)vg6rqnNTG&ZZ|tH90^P|DRt z61xdBjv`tdnXlPbQXR43aHmbKA=satxb~&dNx8%7AB5>fX{=i_u9<+b$>k(#I)Rsk z2K?$7(5P$`LZn&bW{DMT^|9__&|Ld48lb6?BSlvCZ3m3WYi8F~L!|F$8R*LkR1oQ- z4yn*i_Vj+Q#SOd~6M!1I&etK12DqHkX_gs$q2WL=-> ze=AO6Yc}|}Ip!6$-ym`@& zkn$zhPrLsBT?H6lppQ8s)e>g5c%4hTI&II~bg)PxuneHY9 zPdRV`3Y3TPA=0c|FxtnQH6aF_=ql5@BnQ87bL^8OUla{IzU~3Q42YChVJY2s75@fB zdInY?Yksj`*h5pd`p#=@lN|6zrfnv2zX%^fB?boyo$3eB$iT9WMubVBspr^7X(W6AH^E&fBE1Jq1xM z;Db9gFCe7&s6AH@s3I3z>Xw$~olR{s#7WhipVH`B%~YBLVl1k;Ph;IA(QLr^4p4+& z=N@yM&8Ysu)K{-8x&{j?X@17OH>0|ONvDU2A98W+sZfxtRnzi@*ha?GLLtVeJzEe+ zcc1Lo8H>DJtsmr20lC(_y=Lg*OIsVrC}E9jWsT8v9vX7VfaHKMjC8C2eK7e}gmR4r zTD9HoZnl6ZL2`wCy^g%qt*^muPs8I zF@QjZk3$zD2UZOPXmiJA&3$X1Ut{DZIiTnz(nxf!C-ZggH0?VjXMrE z26bui<2r!D9iR-Uj%<;L-RBs@XswW>c^7wW6)GeL(P0E%@M?qOw&L0PJFjbTNDd5p zZ{vTe3I;nQD%Z53sRd(o+`92zp7|blBHB``?jyRAPYln`H$R+>RY!Ijsm3yWJy)iu zVs-H4^^joP?WVEny5=hQ^7PN2ky}NPqztdsZ|HiJUr&f(Mc5rwa$gieD7q0=yVs!o ztm{^h#0(^gH$tn7Q+Xx8XaV*Uaw)-*%^H_jtok2?LITmFE0|h!q=|%fp2HghID)vg zF{*H^K++fQ0x>wiGjMBzdJeRz6Ed-~@2)(QT|R`e%rh&ZZQIn7 zJuxV=%9*IiyT+K}rCV0k&(AQU5On(y6a2A_pP<$?-W9ccRJp?rWch6DrY>p z9>&TXa?j&bm+symF(v4YLmQ4P2FU>jE@l-8{SBYk@IbV04W?sVSC6{EqxK3kq^lHb zdW?2OrnV#pN?4#YEG5vSvOgzU>QAa81`3K;rr}19BGG=co0D}tzGe5hvMAOs*X*~j z*@tKbsS>d+Zah05?hgaqPe->*NWr>b_@wki+9>J|5@f&mRT_Ny-MYp zeRMT(0@eki^D-l@7pS7?$OMhAm`!fYWSI_B?(8pry*67;$h{iuILij(bk723z(5&K z%8ePmV(+<8gE1F_mS72(N#iq~KX3Z^tcNx?X;&tQ;p*aI+iP#KhH)ky-6&F);PhuN zxh!SL?~@-_c91to)z{rPvM_ zU-n=kAWk5@sFBv_RGce7lV0!lAF%<}8a0|K?AKP6n?_A~@M-r;%BRrP7<=<@D5EcM{2eolb;y!+EZIwT*%^^Ndr{V+NF~eI$=H{& zgpe#FN?I&YL^NehmO)5%Sw^;$UFrMIJ3gQ1^E|)b_j$grzveFIo_p@O=bn3(OGXRX z_K0y@-fJJ)u=qO{Sh4G>7}MHLVk||u!h~9jfcWA%G(L}qcnLu4E=aqk(`y=rVm!-T zf9|g#g`Y6IyKEcR*4~2HMuM{?hq8b^R>UVZ5Fmk=S!6%GLfOa7I1udjE+Y zh!-(|6VV09JA8)v-1UP8nTI$&>lY*WOVos>hK9y9`I5^sh8>p3q@f*bW?@^e3;A_V5=&_rKfH0_>=O_F2 zbYd^;D;-4@!^har?ZpK4w=Q6eJBiTJ;G}<%X#j|oGEy}5Q@_}^Ex|sO>dP?{GO^zm z(J5S6eGAT^H+pR4kRzPp5RPFeKw*vj5Rycz^%zW0NQfe{UdV<;l>=zO=g*ma+q0md zfX%!4AXCC{s^*k~`pcB$YBQ)hhV31EFV(LM{IAF?TTKVsRz^b;!QAu&57<8d zLF-kTJcZ@oa4G2oM(_byzpqesquu2WhzP&}MQ2F@&mv;W0^knvmr|7G+BClH4_x;pDo(~5zU6e6R3T9A%-@52Y=x5!P5`-g6jWGKTfflEn z`p>MQ`BQfITo#V3Zsndnq?X2&97K4!`qYe{AsL>$%d!g8Up7mQ6-(_#uyb2ryp+x| zE(vXK+?+Ro) z!cccf=k0E9z2_`L+v1%3nRA6)4*sB5-au_M*c)ja`?xR|^TAwg`<(KmM$JBXsD>|y zIV8fD!3F#$=L6E5rRvU~A(omdBGT<`2;-r;GYn{ z#@tc}gueraw2pa%fqfXt8~Z}t7UxwAh^Ek@*{E^c*Iv3iPfXA&0y4)j$x)PHSf21DvT|GX0KBUKIq4V$Do8HNuRnwGv z%Q1|=l*_ygO%_!K4?Yt^S07(Sg&o#X&mKZ%Yw5*L^_vq!-{bAI0bKM0YwnzbbK2E( zC~tkH5a9qp+NVL>d!&~~7Me+%7oDuW6(`D~ls+bH$pymzWVK-OcbB-u!u?_8_DH%j zMnu0g^HW@cDzQ^zldWTCsNyFqc?Lf40^YKIvT(omXNw=qV=fD^VjmvG$iS-os7bIn zRNwug@A!ueAI^IF%}(=|a^7Y8-l8IB#>mQ}Sf?75xVFdeJF25=QlVhRtLwuTv52&W zem{WoQT1j*vnrsHGi?)>nEC)E<*dDs_j$j=F&&4dqCIgV?Dme!@jm#fM<7v%Y^#JDw8D>@t%`z%PclmDy`h7~e4$Lol8H9k;5I!BKexI8Lgk1N08*d#d zP_hfCD_gbEfUoYla#`Z^-u1Ib%_AL{sN!FX}#HBAN^JMP!+kp3}<}ya>f~@Z? zVaVzRZn}_5=e=_*Qrtr7XtIj~C)YBIG8S`C&)ZWu;6PqCt-LQ^muav=EbMBa#EBFXfOv*NF$DSR@{`ispf-ct9 zVGm`@Wa!EY>N5CG-6J_hJQ14?@fziAOK74^$x7 z8YP2+s)e3qL~I;vh494QJ_yYlPGWP2?t3LtTIk(!u=jiP3SD{f^fb#RwF9^UgtD$o zrI>7?=mMN;=^9NBbpA1*E=6L@`P>lSzSX&3&g*6*2UQaBq>H4pmHu!h^IvE zwRoIF+70t!;eQ*wQWzjm9xq9cytojMv$J3rIR4%1(*TL6Z zT+cCI>7;d>&CLKucGF|R8cPp5gkRqH^-^Sl>nrTLun5bRPrmB@?6L3QgNd*$sqkG>Y+BCSb*?ZLzP6 zdUL;|q3QH6PL2@=hRC^`q|ukL@Q%s`=f|XVy$NOEg6tj(CWfSKtWOtDJuX>)$xyA` zaPUK$>Aj{T2A6lMG+v_;kC*7=Qnjp4eA?1f!_&T=G9k!uOk*}4>INiY-K^5R%j4A}w*O*GRqJK)U>dC}yugi1E{4|yWD6n% z{lY4!3y(45oWNs!O*_TjrVG8~)jp|2>p9OGhS0^ z%^E}6MZwLeXzuGgjqvw*Wma3sE8dpqb2;y8gMWRGQZZ8^ok0T1pMz$8C)|^GvRIb& zKFJ2{nEbCiUbX)6M$Rx-54?PxPmA|oXZZ>!L%TkJe~$&`Z$EVI-sE(#*Zw-ZuUL=p zkO@kV{+?Q9TiTUY9KnB&ityf25MHi?1uM(=?cEax;4u<(5D1 zNxWGoo3np~)X*=v`Kxg2XY}As&h4cBwOj@~~oEG#ILXq-duJ>07Q^qJP-sEt}5gc7B?eyZp5cOHB*(Tt!_y z!lTel>$91CKu?wJ;&RMg^ZU)oq3!!xF*iA$9-n9EbImH+zfE}Q^p*N^ALr3xcu$7L zjakI7u-7mZF8V^sQU1T+;h8mm{(a&aYgbsjdv<5owKeMjkde}?KV*Ul2`h2Wl3}S&~}F%=iNU4{=%(S57#WNS>`X?k@qA< zMshIrnNVkaj!402=X&(|D{Hun`Mq6QsnmSLPX#>Dq+xkxkk=`@bT)vnyn1Ci@QM@m z4Vp7yEZeRO>vVwZlLKsr9D20&hLN-g+^nR)e4k;*QnU2W)@ zPVEa_nv=R4uhySc9&Pwh7v_^zB*Ve=cvwmaJb9iBd()%;+Vt9GjGyD`s(h%Ox454b z!JRB>GXG_>-{tPfh}hr{awGGxq{mJhTD^PMx?$Nb7%Escz7RQs$}aGk&?-KHa%iG>&I!hF(Z8v1O^}#vXfmp z8|dLTNSkB3A$dF-Paak+AAb;!J|4Ps`I1?fxUqA-;;k136}5VHVL((NtB-%}UJ@9^ z(&c@;c=^*nW_ws52hAxgU5J0wiN=Wg-i^;nkNtdZxtHa;a;(=MDP9`sC0&Ql_1y48 zTxSQm#O8ZQAUn@f5npr7tIKv$Y0dD-WZ=c^$BkFoU-=C&F@L(gZ6^7v%kKmx*Yc9_ z>Cn~w{>F;&CKzt&;cI>Gfc`&Nq!RNV=KYZiJa**p(-liC{&!!TU+116q){s1f7E-GhU>8Vb9Uds=IwObXw zSnrEel~yp^OK!*1+XnC9QdLSi=3Dvd&lTQw^F9CE7x~Oas1A!XVFCcNhvlt?L;K|) zUD7!Yd|y4+sW5bCXL*t|I7gbQLAX4o0v^hPr-Y0Bd)=s2J{sHEltE_IdI_||=i2n& zO2y4W`cxp_@W4vtt()oiT!9?#+_ij;XCV=x`CD@Xvwo^M2Fyjwg_9z4(}J+P?=Vnr zf&+rjZ#g#=6sQj3ZM73joDHQ6%IZU~hHw8-l{mZzOXLQ_xE4&6>1A07im8~Wi74-s zGRE985bqTcdoWfukA*rKM(P;n&+&72F2vg_6&!oudKG@v;K81jXZT0{SgA$B&~AG)dtY*-MFtr zda#PBUE_*+eVTcZ4T?WTUGn9dwxiY*{{|O0yH#KEeRB0R$>RLOWB!|@#7{kv{ue}JV_UMB zz4Ac=MRLX)eLyfpiLO3WpPH_(=vnpdIavYC0|{%Dfv6YIJzfws=}ME)c&AZ%(MoM1L6%X3SZPt^K zmMA0O{BZ#A@M{~Q1?AD{2g*9B?@pZ1kFS)z^QHUz)Ny8C=$g&d_t`q)+i+NJa75_2 zAN1>qz3q;!N>spiUvP0i*8y9p$l@8Kp4fL7fgfboI%y!fgmtn9fiscG6;u&Y!})V~ z5SXA#xQn=sK$LhroZZ1v>2%n&C{yQI@(_lEv-~+XJKt+;miqnq7Cn)jy$2x;02ine zeFpKVdU9%nwsSVZK-&C8@bZ{f4#U&X?FE4j!lk3;$y0l8HG6l+*U+yW$|rGcphz5e zQT<2|xGn~Pu^8${I8vX(fc~(f+X;eVDaf-y3o5f z&>>!Sk;@s@av>M>M#jR*4+4tEH;NgWr=Sqd_>`;{HphOC`~el`>|GCqenlz(R}ESN zm*3eMJf8K1&iLCtrYHP6i@>X_nL_ z`|-{nz5$AjLy(D1ZM&n7JA8xc8aPSy5BpcNBB?Jh$XV{Aee5P9er9C0DBRF{!E4Dz;ptK)PWp}JSdW_QBG^z(o3eix%2(@uhl3Ag? z*qMj7H-Da9ycBN6+u{Hm-P@XbE({rnF?Pdj*i^$SLaKWjhrS755j3?>cl1?nNkSk1 z)44Nj7MXq~v!zFBn3;kORH5o~k6-Ep#y4_ql5_+4C>^>?nbgibb>)9v zialS}_Jx+fI@uI9NSTS8W0_8%ZMM~y;`TL)9T22DliFaJZ_0@9w<4=iPsG#iI~3%f zin~XxPK207jS4p6Db_$>>RF>0UM@9YZS>dJD=$;0H$N8sT@K<6C66q%zVg|Y!w1k4 z)+tSOeI$1M#>lt45v@Nd+B(8;FNy!MwjLXN%+zh)|M`swGT9&#Mt12C zSZ@E_efa_f^ngC{Bl%C>f9yEs>!U@2ti@g!zrvG@k)&(NTa^rk+QG_n+-*DuDo(Y|B5H~^ z?&**Z1j0S!TR2PS!HsO5zuQ%xd#-&`bYu)R4%0gC&fN%g!(cp#pXQ~qO!A)53%Zl$ zHX5&Tktb7W9f!h*uwv6qxSukhGyF-jnjRYD3hV|bUlFOL)VL@SQr8s{#*rALA68H% zz;p|&#eI_0MGDf=saZELu3V0L^|4i`J~27mGw=5c#N@re>(H2jxi;WoK)eyC)V!2F zY|M7+Na4cj1!1y#*yUo=brc5SNt~|Qzc;akv30A<+X;)4J|ztG#5o=S_qA_6~_o zxH4aBF)3MXHl=uWdzw7{BRXE2&}d#Dd1VEI;Y+$3_!xX5w^6q@Y9UH=@g_OR6Tq#a zj>KKY0^fdu_j&sD-Bl4^vy9@&<1bRVADeWOfqeX>7YKXEoW;hvb?VRhG7oPD27`k@?i12>$~*bP6AF_G8e7lnr3csW|8^8bTw!DPCrZn zq|t_u)+9+$LwX{oRQu2GN%erNyLm>^n~vnvD3*526_We#aC>hB8|>@pC=^yuE8?rx ziQ{jgYkyR~hj{#jH_tzl0hpam6skr{OTcWBVqE9ptzrC|u878QY`NRhV$MZ<{S@lV ztp<(_I6CMH$@>H4R?(;$VJ(4ddF(Nh-;F_FjrZH}bW=3$xd;iv@Nsy0@3~b~9R=LS z^fGv51|H6o&^xSjv8Ln#1d3pzv3U~=?#i)>LyQMd-}~h7mXDR@7-o8WmQS2hCu^vsio=4HsY0=E;4$=(3mPG(U>u?^bAffb7f*R1O( z%}Qy6K4j=+$zo}weV|5m31Wh0e)HuADGfTMr&MqO?f>*Ldupq2`)!TeZ9dI(E=>eZpyF@Goy_M`33YdOy?ibI7E&-H9P(H=9DCWW-n& zP5g7sW9N}}XTizhb~LWn9;JKsIgaG6Yes32!xBzwJP13_tEE#rqZN`fYQQ6ay^(geY`Z+W3y6P_iW;-gQx}a zdUad&ig0p)rp3cyC{(gDht$tnNw2j*-ZsCg(v2cE~avr6{a} z?4eU>NN{-I7-q=jN`{${QCywEhxWikq5i~sWF#NG%|S3ElVmEb_)dRt79aYR*@|GH z9$0Pibj0M9Z8QVq;|ofX$mf_PVMM{{3e1?&gV(H0GcuC^1)|0a7fxgGb$?0rWzsRn z5D(CzCotOkgZ!wM%>ssFkRtHH``teofw`h)!F${~QHgvpJXlQF#6a7u%I(SEM^H?b z{ZnIiA!dJM(hW6rIyJ$!C0i;-AiregxSTQPQ@?l?^jEJ6I+v^RpPS}`vAgN*Zv|*d z+TW6quWY%NAgwr;8DHOwA2@}gQ|mGbGc$?z2>W!s4|2*Xutmd8I9z>vlufH0$AY#q zh(cws76vN2o4qUHa)i9G1by3L>#DsQF(d*Q-I;T5=Uu}Cw#yW^qoc&R!Za3iTuy1< z8!-OT)F71_7>7A7(Q!9yZ8tj!owLv@kA)AR38{r~lJctz4i}$dWpZ_SW6MrG0 zS6Jd9qIA)kf=zKoS?cKol#iI}*IqH5cuBB24W@k~PaS@aG7~$E1GI|;E4ITt%$@6u1bnqa z*zCXIrdk^9a}UENY$eYjAb7)F%s>W|adr;62W7ne{X zq_lWLC0hS}s7k(6HKVi%ZgRKbydhDDZatUJOEX+C+uwvlAQl~1)H zn0W=N1+M}2v`lQB8-nyoB-vB{9Sm3OW72=Ws5$9^0*T5WjKQT5(_#iA5y$|&2ZhRh zWnm2^m%ePV2jb3xK4|i{UG^i+ttot0%_FSIO%*&pi>+|{A8OWj7k>U8B+DVdS?Zk&Z^MxB*KP3pE|kj#TFQ-Evbaa^uMgN*@~u9W7LO*ASl$rCC8A6`Km#KS~~CB zB8HHe$Fx#G9|O6Yh2AWSBh?v{{IBufw^Bg!{7=OCZr`?m_G{>ZQ+dyLBbek7a#Ftc zKwPFt3tnu2o5&|{k-OqmE^x4T1_$?f%Oci;0}qEXjvL_S0JEVr;}yIKpUEO z%K|#Fm&sOtHe8xqu`8jA3^~azGbD(EuTySc1ePCH#=!7_s;8utGl!$FIIrw^oBPCL zS{51;$PYV^)zM!pSJqf!M$XeHkqFBz3pf)Uuz3E9CMVXC5kqj)Wm3~C0vZ_(!D75m zzQ=;P<2JygFRrzA$Zr74NQL%$UhQf<&@Ef0^Zhr@`OVM2%;W*^tf_nPpKNi`cW~Qy z-3Y3VEt^7Jo&sHnJf#|b09De@*~DxW0qXe@pi%BWV=6WljNCS2Qri&G zx&;Qtkih~h#x&Q~e}*0-(BCZe$1t5N z!-rkoSPxdmAkZDUOp4H;Eg}t9*ky8oZx;Fv_Cx=L>@lxR7ZO!*TO>&IxFns8obSBJcL``bRg;G3$Yl+RjjDM9tedg(4s)f>f11WBFZuMC|ErR|;CS|zs}BeS zJe9jdt@GM9D7*-`a+nes!iG44o`r?2jziW;0Jka4hSmN=2dC2!m-`QvjLv*iIeKAQ zx*5w3>jc*(Wr!jKk=sZ#NJ3QR^m9s#Hy9v%iC&20-864oE$8reXzyx-hk?pN+-uOZfDqC_q6Re7 zw`U-GQg<)|Jr1`jMpC+6GO+rY%9n_~TR`DjmNagxi_*w$Jg3Z*ztTj~^Yyq#Jmjj2 z>xRhsd-!JiS$qX6D6zd~RN3(lVI&uTB^iO;#l0CX_lkyk_SO<5K8AP_X7%^^M z1TXFYb6Iik0yhfCu}K^2twOkP(-AKbbz9Y+TD>n|XgVOD8(7{1uJ0tN%ii1Jn`*Jm zhF$)pfdUAdTtHq1zL~!*p%y$QDjj2#88u!*GrlN7;*a}y8C({Q!pYhHFiJ;(2uVws zemDl73T9VSy`w{t3|(4xx50rc?^e{oo4GWRb?x?vz&#`V4|~+)QNg~ob2hdIkOgVx7FT4v6Uy~1Mx@W;Xb{hV!VnX?3*kd@c9oUeo)W=yAh?6eD^9(T+ zpL$?8v3CRT^LgY*Wui_oH&(e`HmlDMm;5d@X9@GxBc|X*c%?6lIB3ZM6o$2;-^k-` zgGn28XQ{9vU>5+)DS=nWg`hCOudIOZul!(!Z#{#@b?d0rfnpcnFPQoQV6GJqBb69% z6DUAn{3`J#q4MD}pNqh)WA$EonjVrDMW-$^W0c{~;f5`?W7BWv;UxXuDsPpTKdeAQ zYW0+JLN$PIE@lOWMsx9@pJ_tC43SE!r`OGDm!6WXiMY6L-T2Uh*5}`P`gk;L4FTLJ zQXJjxoUd{KkbXaf;dz~Xkka5x1C5J!l2WY@CqX_MyEDBEe``pbz8B}${K^mTUP`Hc zUm)NkIDQXwQ~!w%dvpO+}FbXoBy28>E73=G}ogs!&KN)`%=L8yDWTzGLFY>0jP|2 zS4NvvRo^|gCU}Aa$qm>8J@Q0{$%?wA4h@S?z%d}@F@hmzji@AIR-W}p*26#Oeo`|7 zE*WRMFzm>sxDZGzI#RrVvln}n5LWukVpE|0W%%4Q;W!8K)bMM1%%_8^g)i$rt5;)8 zWyDFVED{y7UtTQp0b{ejr()D-C0OIXOwOfIP3bc>Xb?(=6i7UZV6qHs=yzMu9V6EK zmYoGlld4&?X+*vijIdcc{z3W{2XJCHN&QdBSD=2G&wEYJNpjV;8{?r~b8$cG-Q$H@ zHDj!fkAbgZ-g`j6Xa>H)9Jd2*WJ2eD1X5^R^0V*ISlESMSq0id$H8YFVykH??Y6nG ze{=nmXoy!9fOgivO^uv%R(E>kbQO;SPb3qeG3RqAeV!C^08Ts1hZfKHK{ahpt5XMW zD%vnICBZ$h;8BZ38TkcT>Gl^|mTQ~jYgm*z~HCk1l zt>1&=TIHPr3JyL<%NOS#$+2-f+AvsZlSz*Ym1{Vu^d?9Y5hfpvS_FldvW-_wg2U*u z)3^G}xBl)X_TXEcLj7!y8=vu`frcP~>Ue~)8lRN9cBh6Vi-hZp_F_b=L1at&-FTM%uo<50*4J!%1Ji6s`b2fvc zIx912o)O11e1KvZIzTk`n->i@l*6zis#DT;;(j;=8xJV4?0s=xQS#zG&heOP%BkyQ z&S;hV;A#z(_*J41(}*fA^yPef?T_ZbRNpQ1iSCw(@11zyk`YR*H#_rcV`yo}TzIItd`{Ub!1JET=x$tca zhT1qEwW_-+3+{3t*EwurKjV((h>yKaZ*0VGbM-L)Y}Kh@1NmF3)M4+R*-svQ3P^v- z#UA8jyPpc=)vPSw-Y5*9O@8%o3Qmret+jU$aJO7q{HA1bR_%&fVyyPHPw#AG&p%SL z6wg(_nY@}F^{UtW=yab>&A@1B&Ra>@;9#nqW8B@-Ok@fXL?wU|fyjN@ zBm^c@PZU1pO7l1Up2~SpYz5dWJF5J8>W2JKHIqhfX$czh8I>5lK?h07F*0?lW`MDc zD4u{8V4Mb1h!|whQxMaU8S=SXq;Q|S8TX=o_>U!6aCOqf!tnNwykO-IbmIL%@gSfz zol*__80r(YGLjI_MBoY%lc?(ib>4S#gnGx@9{fP2vC+DBv`7x$;gLeN6(GNy*)?M_|fOd zkGJP7kJAG$Is9p{TUUZ?)797p-odaRQ~|vv_W=LS$hif<7ur)<@01=tB0h#WcxDCC7iG5zTW?h5L-RVepBuqvSZ{s^X@6w}Ho>*N{CXYCm9}~eEI7b>`fZ})@FM^xsrR$8r$k4ttWfMgt$L-0N}bt&}_OC`r75Ot52B( z2Q{vn{h_+W;0wffYHnI4cGZt&i(t0UT9Qw?BsOK#l@lQWL;I*)Gx+|>V()tx_UXRRa!pWbVeR0zx^ZWZ7_^D zt!F<^ZgmFcqTSkq^1e*-SE-H27OaMoR!8R4yVl1R&z5bolnyRFnGUXPJ6RPO@x<54 z45&NZ+=CJk)hQJoQ9Y96y8!L(9KIP<#^%q+*DOk9Jo>Tbp$pqMiSMY^~SC*@A> zbdvY^=tW+Cw=d}zsR(CsZ=wZXEt02^BC3wGdvBsf8zk*w*`mQITlq-p<_WKkDl0>J zI-u5N3yZ^b;jJ^K_<+Fhn3n>~SgCVA2JJ`vZ;mr*;GWR}4y7Xlu&AB6_EZ6e1LfPy z98=#~dzrq>H)e@Fo5=pQQ57a-RQdEIMzkabsO-J0i_A^KkBZ}(4T(Mso(=Im!~I$O zS=ILw_FzE6%W*zIK~P%(#@tVPj22!fv5VvX;G$|^-+KN^NUM1uyVXy7F17t>2KVsa5YZ~tKBc{C19 zaU@2`Mr+-rg#n$iIOu*z9Dvc)8}tJf(Y5VRFNrqBJ;NyQIjIoppi#;t`K2o>miY<>HS;s7u#SBXf4I27)$w9?uxq#I+!bOg*P$spkCW__3F>R~cCHUVF8&O>BuuF!I7i;%1xmH5Uo2$G=XI==vUh34|E|bmt^GNmHCCIk;9PE3h?zX zssWXW%FPr+*LD!&Tx!7AJ_j%)1pHVcxi=O;yPm$*EamF!{ep$A{(}sV&;?KsKdbjZ zXZvIzP)W)7AykF6h96mnSH?2GZN5xHv5ly3O6Y9U@&b?6X&{pg@G?io*?<;y;}RoU zeOP{Cf_yarrcS>=H2#UcahS~kVC=3EVISq<%n*lQJR}^Vyug%^<@4m`fH$oI3CUst z5ULm{W;Ji?7R0#jO+dhR0W+}y-RAHo6-ezYW`Ik)T2kO9)U8h3BWhy0?+pt&sEbRj zt_>=5ky9XnkN&(Hhxh>F=L1rb1hf&WPQ0zBG*S(5agR?Zfg`#|HR2* zxmpiNVSdJ(sJTpo8+rE`0s|Cw;o}AC0e;!I6irh2#3yK)E_V=gAsGe}Ah2bva#0An zN*4D91|+j4$b3-2(T;m~UNjsxeK<8jtfB&`X$}PhP_CLeowj4mN3H?NyJ_lMx#+`I zKhsU=LJH%jK+xWE5FA1XNW*^FxE_{?0f->D&~#BUixUoJa-pGcM&SS1W$26Sxm)Dw zPALfvYt>Y=M0%f1NYR{=JY=@z40)Yfn|2N$LzY9ia)6!i5@UV*cZ_=*G5G#=6@^R; z&OYXtWf(5pO?d4q1ny@_3tj!KxA1&!-F6g&1JL|H$6Oadg=_pScL@ERWMI_9iq2aW zw2C_;TFsdf(;=(7$BhNq;j26aI4vj<48cX)-nk9A1%PD>Asyv76p$ZCe`q=?W`Cf= z`3Qa!91OgHkw5UN6MCMC6<9_I9P$y@Gqb3PpD@tYzT?K2|7JgG2O=u2%9ua2dp?!lh@)RSlAFjvw{^4lBojqi_7u+pc+Jz7$c!3?0G1Qn^ng47q>vLwr zQ7t#lN4kD(#LZy!!&zI0(SUvl9O{-iWF^EU|A=S>3l!ZL9dA+Wh5k{UoK#LclSFt7>yn0L?{ z(xBZoLk`QNp>#;)JDbMDhuR4sB|OFhZbI#X@Z*g2ERKD;%56j?N|8%(in9;rqvxR{ z{e*JI(H9VTTo~R*PuyccV~SG_EqesZTrm=VH$z_$uPZ5WuX@LU8-nPa*`z??CxR=2 zy$TgfIV@GwG4!2LA|}aUHAjX(lL+{w?xHtV5vPbrERM?m1vy35u<1OhjklRumuL7^t~c z1>wySkN7LYKN-QgfMEmI!hWA@y#WA+3@{5)_mBC%y>{(6HK1DkWwgrzwEIEB+Mc;a zr}n*7OfX0iyHIILhcvwNFU&u^HuxM}-)o8_o61A{r4iaoEJ3=s7!3YT3g-e{F!PtI zjE*vn<`gR^#*TGkRAWqAd?)f-45|Jp`X~fc%ZRL+{>$4zV*b@ovXd+d5Py#_@Ad9d zJ49!1^I(RW;uYxj&Qsy8YgsdT_i>;R z4dM`TWky72L7F)+#xW$(Mpi_UO&kU*V#Wl#G_$M9>9zm%=m^FXK2Z1yMXwWDsCK3wCZw}$~@;H}G9 z&+PZ{YfO0Y>mAS_l{wrSXIhvm(r>{sLhfu`{&#rnbm3)0-;C%4!9f?QEY$MFC7N(a z%NEpW8H{)p<>(>sTqQCKc8nNg!9Ctyq-+?|D>Q$B%ZcHCLgXroZ>i88#-e>Si@MD? z-Qx92*2T4gD7_5%cYvSAoqe>^u?uKAlpWVzcB4ZyTG|ZG7_B;eYbd8K$tbEIefApDE*r_^8|AH+nqxY> z#)#K<1?d%~!3cfw2kP<*VksB(k5Q}LzY0kMV9tm*z;^bfNG=tVaVmuiK8lbyI-U-( zSw}XNkRQ`02W+rz9E&*@&vGFW{NMGIB5+%)A#4rqIYu5Wp{5iuv2J+A*dfzhix%)J zD`N=Ew#`fln}vaw^<7!NbjU5qS~XazKlS&f00NqiGt9jZ`ZT^5lR$A-}0N_bFK2Y4z#JDZa|K>GFRRo%ih)3Q$7WZww_$Cb^ z1WrhV^ykdh`Dm7&&el!}odYuPzm+W=C{q#~@8^b~}HODF`N-Cb8POah|&#xx-$VXPC zMrD*aEr^ibnZD|<+?u<0JWFp5a>@gICQ&_RRz|popb3Zkr43i0VEcczxBnR>0_CB_ z(NHN6Y(xyc^MZEj3-fCVCLODHbO{f&*n|cAk-4=xP%Av3K)Nf0p~6x;M}q1KBt};* zw8z&Cs2XQ1LShs%K;|k^E--k0XCL>Ze+LKJbZi!{->X8dZ@}U{B0mv)mZGZQ$x8|g z-fWubanSmK%Di?3f`bXZO1$u4N-V8D`mhgp2ITvfSYYbQANx@HoB;b+fqg_gDF;0$ z^sy-LWvD1+2@0y>bZYVUis7(_tk7@bgGrqQm)lplX#4LR@(zJfO(@3znX*Ee4IsdZ zJq`9)3Wd%9fB>$v_biE!t3{!%_lGq+TV@zT&KLU{%4VJ7S0J@q;X-pwSV3a|{Apm| zDIc1vU!U^3ARV94ED5kZhN~YkKjA1C3M!Y5y0J#l!vPuay{vRTbkLXprAt5>J|l+@ zUAIaRaXg5SM|sesB*f@g|S*8{7=mg?wmwsY?(99JL4uJ3X+P7C1uLjNtw$MGG&cUA}kt zTO53%N_dean4-%7e5a$#0`>caI^-dJ08q&TpC5A*L8mx|P*4K5?zFgm|D}=B6v8Ed zmT6@!qxiBD6oEz#?b0}A93QzvVF*DLI<*_%@4%xJ!ei)Ju|dfa=r=Ny+YrtHd^l~u zT_23-xpRgxhcqy3aKe|L+jyXg!sUP!=mnG2`f1i1MUgTRx>2a_iT#q!qZFh>K`-Yq zOSRVHlw%ivicamt)I$F!r&>xq8Z<2`MK6{-Jrp)^;45of(TgoFC`*ZZBSK<{`hZ2f zps+Ro>V-l_qZg%4P)=Mx8Vpe>zf)ZFfb|QmYdw^e19U-O4o_rAh60631aDTX#Hw1r{W5V)is}JoE$PGuxc!hcJDl?p z7?3-<{?aad9Y&e-6xe6#RMlRID}}P4PK%wQWvKMyI&fo~#`Ut9&BG5o(jN2nmD_`i=4-naVf*^FU)w|!y*K4SPS8}T8& zU#zB@ z3oMMz$Njd-$$R$6(|v>OckORq^RD)zS=XtovPH!`kQP2U97pqBnM4+?Oxh-7vV>#Y zPU$t@Xlg8Czj3t0Q;OYfj5|8_h8X9g6gQONs}n(@2G#YSMkg8f`ADAE23z+-Bk2LAWf}IDC;^iJD>dSBjT|=l1Q8CWiN@IxvjGj!@4iOilkn( z^)-z(n7m}F-mK!<{cCKZZ(HH1T4!X*YFaH)XFw%Tn_l&bB*W`4RUwV=k6RN}xgJd*`hT zU;jlCO6kvst;_#4A1{ml!nVx3x~9rsD5&`B^Y@Vp-R-yF(?cE8lk(4VEw&Gq1T&BI z|J*oOo8F%OygNi|n0)YW<#!_UKcoH_m`dLm>0<7xe8Oun=L*{2e4^7=KYvL#s$M7$ zpFZw)E0cEG<#}jE8&l%KL{OT4rs{L20jY|O5w5w<9;3f~%umCLo-G>vTJUq#njgzw z6I;Ar=sProQ5^F1I!d52XH|T7uRKjFwN>c_nf(FNLgpCV1 z8{#x^K1*RAW_mmM&Wb2;oI4-&`I#HlwO=wyNvZ{bt?$gL7tROYd|+8{`oZzl>5i9Mp5F&dqdsn_6gmFaQ?b6;?T4A-ixta>WL)c3c7&w1Xz zJh>Na#$6rrEx>q!`6;@xh%SVcv$=1eNP$cLZWdjGd&g=6Z{nRJ@7iWw32W(h8)*d~ zJEmN%rGMRYd1mJrWPO{TS9+|Z@=5G-3qSFI-$VN=bLazn%DY zcb|bci0RkiL_Tus*`ltNynLA#+hwkMW4T#e(~i?smUp>OdV73$5+(C5wHiPSwco?X0{ht_MJw5VU%5Ij1R@dss#Gty;zqLfCTXj5_Zud<|( z^<3ZMt7xs$LE}{l5nuWgW_J z(7G>4^)cEr(%WnP%-O59GM>_6#TMUrb+^Btugf_Z;%SK6m)psIKH|&s(D3-^F!Prqcshe{FkyS2r(@~Od0r|(R+R` zqgRgmt1#TB`DionCu{!g^~bS#Bi#>dVyFMSb+yJ7dXP zr!OU)p30TVKl}N%oMXOkXwQiAcl@05^S3!-C(CUHV}Gu< zBz4abs!Nc4S8kd%(z<&X5Bp~Ma*yrw6O~_tUYR_%eUY@l!b5c-HGS*clI-@yy$&A7 zKl^c2aAn17u-fL3*J4ja1Wi<@9=RyMtQVf$l788JbUVtEHQlg0x9H}x#gjw5^438= z;MUeiYsLi9nP*n%?v8)zr@NcqyYnWBjC6Aj>q(9>eZ9n8SwELt*&xQ4_=;EVQ{t5; zyj63G)Skh*%jHLOA8jOP_Muu7MO}_iL_lYrbtoGU87wfFpCGQ?P{q*yR8E&c3FCvTY-mFxk?iCb!6OSg$ z_&DIi*M922N2lICKB+~mA@a!SrI@5}uCb|;-MmwItINOYqtW8|b{wuHH)|L^Rho+P z{Lx=H*`Ijk%UN-*%l9!R7B}VGZ{8~P+z%*!S$eHH*X~}Ygv;PxFPCuSt z&9T3_VzJ1_@)lOA!Ml_d>vYjA>eICGrdcL>COBLt|H41t(ia!j^@iVRs`6n!^23F8u55Kh57`|5nMbKl^6hm2_pO zy<~LG%KR#IQQIl&E!RcOuxsN|k;kNe7)tGyBD@o~JfMQmdLX;X zxt19v88kMuymISQ68V%@)DEUMhEQe1bgwE30ZW2Ez=eR6BwwX+P1M_aT+u!N*=bBK zMeq*hF7~Y?Qb;B428leFc>`lv^(y8%#>p=@KL;DELKmIdW`9(+xt zmJSZV!m37)f>8+!0!1}44v?^@h5fJj)Jk2%{jto9rn-J9O9l5<9GSkPDmNDSS>|jo z=TD)C;}9nY{Gzdl1{qww+-CtM$&6|xo`PnthMSBnr;odNU+cU?k^c&2IR4RY`~Me9 zGO{wW{TrCk8jreQh1)!)`T(vB^?+_E83Y&wsE3|w$A@-Rc4v(jQMrH5%|g|7NnC7g z#$yxB-=S=_mN-BZ!BxQh!q(e)0S`n8WXa;-%lPg={vMk4wT=4r!1ei1hwn)}#tl9; zcLSOvZU%+`6NQ;h-tMx4J0j-5E#wTd`vuhP$i0Rfv~9vZ>9xh%>4<8wGC zLVs=a&y&NS>aNSk{hlzJ{M~75&@-#Y zlxCIg5>oyU(T!A!a|`O#tj-~zf{@!F-_XpAqF`O0yfSr(KP0!XciLELpxF;}h$URm zp7bW=b_`jkHxu82IRa=l&M)TSd4JmFMw)83U$MYM_9Otpp5Ya9E_q*7H$${aHb??jk(bjefk=IGTEZC9IqV{dR*hU}ob9JIY-NEf zVC7Jm$hBy~+FuVZSJBcTbNC|Z6_C`R1s_m7Gc7%|HI4hc^5njmI`J12gL`a*^O#0~L1F0wz8k@8*JmY23 zQu-O+bgN)mNI5F19|5&o?6XjpR5MYXf4jDz8TPy*P-0!_!ZS?Ge00JHwFK_I=jtBf zRH9$k-u+_1Dl2ll*#Yi(@d-IkKoRXGK{(f|g=ZVzxM#13`AXm3dcot{YK6*qCt1fL z3|6{D$f6(5H37rIIS3`TA0L+cabp4~fH4%1vMG6%!Du29NSwm9S|_I%qZxWQ3=fd< zuv2D$B5AdQif>(6l@xh>&A+mz^wkol59ulQn0c{>;ui;ZJqYBYw%pE?;AXudX5#Mo zT9G6dOWeM)2!lWUe<4OBq4KqH#Q`0r(8Th&%G88zvOHydPw_*%`Slz5ZnIa#?k?eGHwbC%>@s9!|COXzSUaW^yh4 zX|`+z_7oQJ>{abV2A3X@%;mXJZ%#$uiA5;2N@)eAt(jnNHG9W1Cf_dHgcC;`bP^iV zEb7p<8?ScOqv{!ozo*I9jKII%SqG*aU+j9IV(Lrfz&-3_?VvCnbBYP;sPkH7(_A?m zK2m|w(;5A9!aEdk!Vi1uMP~sbZsJ@BW^Dh9iZDp6A{4fePU~?>2RxX`I1}1k+~;XX z2o;0LOw0v&)XSNzq5R6)v)o2#ul$s#H2=#4)u@R_dru6p& z#`JmXx{9<)4CAG0eNX+-4;KSs7J6%K+q}ugN)8t)(l>{A8t&<;Jet;11I6P(NBBls zf&!9F!6iIccN{mO{!q7e7wUXbdK#+r6mADz)>U1Z1e^wiC`HR#Ba;Y)m{u+3dtd)N z`T%J`1D1SMSF%B<`Nq@0m5crqOXQ-owMA=EpK$YM_eHsgvNBoi!6FOpX3Go;`b8%? z{c(kMLfBk>C25efT~8M_qbJp!4CGjpkHcW64rC;XT=Zs#+^%XrlDifgYW3lYYUz}* zRQhB-!_*l@Wz3Z&u5t z10W2#_yLl2R^S2^fKwAIl+9HP@rlo-!o9fBk|dQHJhq$59t?~bos2}5Im-`)l?x?` zIK}tc3DQ}W#)oh=Wz_KMf{V@IO>^4YbszLv=K4YySv7eFhap0z`Q<2jIX_dl1A~EY z;oufvbz!AWRB0f3$jE1u;woz1IO0FNgI2012O2Fd_UZ*d;kSy;rRpIUa6^s1AR4rJ zWP5h-m^OENsTLETc(cfjY<3iRaLo{t%8UB&&$-0PQx%eZ z*nB+9^0)%Eou+A};v+u^f~1OH9Mn5B;K+#rf!{eTNX!&t?qdd)RQaoT;7nXe=4VI| zVOtFPO%FX+lzpTIvwMw8c64eH)Q07;C2Y45<^ngFVc3juc*4GilK;mc+KHZj(qDviw z3e~0ufL&0`faS5hyaQ3jR}HIyPnQ7YzlUfUZ?4(2uvzrOL!)0!@iy zzlGemL9`@h<)sLb)H6<23@~yoc2LA4edH!P(cWM7_;-5~?D8%?e~gQ22K7dF61|o! zn1>)C)!2?TYiFFI6lX%TevuAp0yw*)Pe5ArEB71O#0s_B* zrhyoecebGp_xvjz$^-c#|EYB5Xg2$FiPdNY$_lSdr#QA0CxjpL6L!+-g3P1APFmnD zl^4S7J`p6>!jno)KgHVVi`AhZ?Y^h2WgD6`l^M{CYxyLzR<`mgg4YT_n9r3|@7F#G z7Lf{?@)yC@#(LYQHiPYX%LTu{a4zf*eb@6#Ik28EbteE*hI-`^fJ^73X|{!b;+g37 zzBO(E-7sr3d=PzJiv3wx-qI4|gW56zt2YU7!}q5|w7TfrCa}jf98X@9{TXH1k`AN( zAk>4-h)=^wV`M=bJGH{4r#I`f?+sn)1{JTNg?_7~({<@YbDTu?$*2E7bp#dRhO8FG zRch6tfh}5OybHXr7oK>5Bu;T-UmebDOKdR4^}5-{Vp*7$D^xO)LN7lQ0JiE0scY9z5-g58*O%yI(xT#XJCAfBu?^XwKZfDdLbe+=4SG85 z%@OMo@xvLfUiMtdJ8vBuU>Ud4e%3tE<`~V}7eOt|wr1i0BuutoXCFGf%hm?o<$jss zyAUf>b)jlknjgcYvbnAReXw#WK#mqu1~ho??{SM{RC7s#uRP_C3!kc$N&9qsAE4r? z?@#{~oH8)|i>K6o&vY^}F#T^-8&~u`D}vwq2h^v(F}oKsdkaJih`8&BivU!20;#H2 zVmDsbV60iXWXINhRt-I|CrNC^D|-e(2xb=?z5FwHph=)g5;_-lcMG16b9OiCaJEhe zo^LF$yg})oU1w|^ek9pPfCxW>{`1plxrBf<`?DymixfV_qp4D^Gn|)eyA6r&ddOnB z2&U&qOsF+&z0b%Pn+G;^-~4w7D7}x_?cPtEIq&siUAaOC&r%SCU0}14pxt6@~4<227uYS4)nRkWZ%197FqneL_Ayo#cyNADjp_ zk=S1p3X4H)*ScW2zhZ-nuYKXW;j_7%fP*A?S||}MWmFH-NzFo0gv}X{YQm3p?O%bU<^;7G0@pDp63Ajyt-x+lB*Ru2O!F1+HVTtIO@Nrw z@oKfcF=$P@&hC50J{%Q3ItDxKaHyw^{LPRsg%Dt2=b8zK+X(y7G6y#Xhf05+2&Gc0 z79;x2zDO6<{6@yT1kHRk!S#83V&oPg%UFziQgp_1+n1)HUE#wSnyXG(9&{_jqo)bG z25UsmM)~sDk+%f4tH5HP3|*=N#s1*iffDq`5EJ4=JA`UNZgQcMJvFmg;oNnaK&g6T zRpCWqCw>jY+l<=m!H~)r)9k4g45ooIV?^#f=)u@^+?dQ*VE4d{CD`AUn0f&1X2-Q= z5Z)qw^A&1{N{)>WKnH8NTfcdG${}zEpLx?}&55H&TVfX9{{x>2?7vsfasM;~Y>je6 zvevIm5YB#Vi0PINd~~=Q4Wu71z1Fol)VQL5>wcB-zBq{kymuDcx-SvGnizmH0@*07 zWM4^3@l`j6f^Z(eKtD_508ZD^u9+P-}3*)VDEg zQnong9F%oh?~vRR@5sd{4Q1R>*GiXD{Z^#d49sR=Ef|SnpkgHQ-L|j+#T%NUX0w?V z*mOgF{M=mZ+mD{esm#mY{GylwlXmOR>ZymG-{>`h;&6Bt*p<4wN6Yqn3&&-sMt!Z9 z=~Rr}vV#c=qDnJ6mmIEHPu$E0UP%uz8)WIj6f$M=UaVVuI4H`s>Thmv`GcdEaxTt)DPVEn? zdZ0_mcbw0LrP{MeYT%GSw?B*TiL_ zu}=`t*%c&OXKHydC%FhOmr&AHx#D$lwxQyO>V3q{vQRqof4uhLRrJgxPJO;(u{+Ze zlzW3UK~&Q@7koEpo>l@|A5D=k)fahh>s9+fLR!;E3nEhGfGR>3d5^`;H@+-17_PFZ zWh=R_^NBRB!)!L6WE-G>zNuI(Dr7LjuC62|JDUE~TR2Fm*e=#Zt}jX}_uUIuj+~&Z zArV*ymQv<)(XnzCXBCeMt0u7zf!v^Hyrd->s+EY5*dXdGVL=+Cij}rK#k+M=LD`T;xcier0^xLw}@$ z>=y&ViJ*~_O6Men=PpwMm{jCGTlFDh1Uyx{raJi-4PLJN1^XcQAL%?K2tt`0X>x?| zka^GHqs;S<2!*XK2GhwHLWWN-7B^-`w2wm71ur`ux1;B~0%(YH8m%ZK8@#-1@F-oO z2YH7SKvc@u6vkPWqY5F+nQLJVpAr{%#M|lFD|NAzSQjr{vpBVc0ll2U;tmCa$NmO+knDrqm#8VbDzsOptvIr`S zPH(ZhqmYIRTm@`3!+b`%o)M>7Xsp^tXmQO!V4EzXS5gf+sV>Oh#!uNg zvK=mIWPhH}z`9Gl2E4pY0ZZjN2t`4#$Kt~K(qg}sHVQNwGnWHFaY;QnTC1z}QKY^F z&DO)*^0oAHYw7j&9{wAs7oVQuKVTE~f3dUsAFv4{@FjMze51yDC>oLN%`EAHMEy}}EV*5WqzE#J>{m=Ap93&KMNJz_3=u5;K9ykdw_Ns_UBjOJiL4eQw$<1Jjo;Jbd|dw@bGCoW(1;|(?=f+sNX>baw!^%4 z9`~aLWP3d{RxUey^BgX4ZF~1kEHlR5{$8RmOmSiC{?>i2zFLO$29B^?*N^{U&72|! zQ6=E|S(+-ugUM=zAyFmTD37JQbmU*%ZH-f!c&cU!kjGOy}uw7NWidjB}- zo*R*fW2byeDt-*qR(%mll`Dv6S(e@R%r2>6DHZP|)$Re~feO{lTN z_o(mu?bhK$E@DS^)5e!xh)T2vS>8n%-Kn*lKQ3~)E_Lm~d8dRM`tSiFNp@7`I`F)h zgE=>{(-V|*JrUL`wrON(%o_iIf!GVK0jlBrkb74P6&&Rv$flI3d5s3J?*SdNCXx!de)F=uG_ z63RR?v>{6j>TvwNG?j=Ycgq)bqct8^!FST|6s0vlFeI(UI6ukw4m0)C^LmI30prxe zXcb#8b)}+b8WiQi4^xg6=xm^K=N#U<-;ncp@f$8`dkPulKqsd_Z>$GN-f&-Bc8EyM zY-M-`tW9+^L!4f@KJU@|s^>sBN#GqFTpGSNJe1jhq{*-lyZ*05nMWoEvp*cPy+4OMq) zT89WSOVf^*%3Y6U16cD@X)iKibdFh8^hEKnV5-b5va}*Q{VXp9WU84Co0{6v-t*AU z+#-nkbPo~*c6H>n7T7eXe6Fk;RLSgzxehXIzi1WD1zT78RL}a;4&cPHL+RY#`fcQN zAqFF6@lMa;DWh{=A4v(<{Kxx!aoGRhK`yRwz74Go_nvERNvEH*PXZ-=XhM z;t&%Q24I$pkt*_l0av}AofD%usPb-ueQPzlRT#}pXPxJ~^$sBJUXjRZg2~b%vRx5X z5oc8!G9-%kxhEoCWB6q>9_Sr7k`9;n~%-$hs)-Ky6 z>ZLG!5y7e|90I;BGijNF)4~@x?-Ur}uc0Uu6I5>J4V`}u09_kn8h84ca?UNmC{q*d zIV38gTYM@~^U>I@ci~?>KA^Y{1>U&E{BUp*Sk3W8-0@RYv8*;BrGAKcZFv<@l87cP&|APVteA*(dX^o~R*Yw}9MACMsb0fvh@**Y zG*tur&PhRXfMpYKk;)+3RH~6`0VJNz;Vdyv22vm5wW6O8w}k7zxJNf>FeEfwuYZ(u zxX`H`N+FIY%n;KMUy#;~dC-hc!?xt+8W!t|5H(emPo^-XsG7VA^DLVt2P^3`uZIWu zW^M>gdCn_@xrgHAW|TSOS$V;YHD4=@9cZQo`OQj>zy~jrZq6V+*|_^ds26m3lt9x7 z8`0AihSHKXKv@d$r!nJ;6bx@7njdn+4|y92rzyGjd_H| z5^9IY)p1NuUgeuV7->g?=EAPoA-|$}6unFMZmC*`Q7RQ9|F| zMA)h=jtn)X(-WjWp1{=Gf0B8%6|G$>CM9Y)tnmw-`E(v5*%!dQoyoZdh=gFQ(A|#J zoS$Qo_ke9UE6k|>i%s@IKo^vK-GJ{Qwm`EfC|%{kLR#et2jcbzzcK}x-tt}U(EmG! z38JKj$h_ZW?uItJ9A$3mGAq=}Lu~(X#6+gLg=v*0NqY?k4A{AP1QK5Y@ z;>j}bYY}+RHfxiu7Q?6a-JIB~&>ZXO26NL?Gy~X%(+HH`XthO`CBf23B$ia3EL@=G z`0lG-1#k!I?08i`hVh8OsCo-ZbKK1Y!_6%u)x`RwnM+XnGv?4Gh=7;ElXinWy_gmb z&jfORnTk7CQPPu5n&CiKwp3gVQ;dVgJ-ag3nUKe(uUr)LK{{NBogyI!+Tf$* zn-_5%cb_5T<9W4*?1a45f*7VYxp}QEz19e#j!hDoVZ9f4{tkvy9YY5xjY3Jf@_>?suUq=-2ngIPm4TU_-Cb z3MVWy$BiOqTLmvS|5#{ni2KkR3%A79O%CVNZlIFA)S$kPO6u8+sciXqde)uA555A& zTEeMT;?ZPRb9R5dCG!E;tK<9!hi^v4|0B%vjHIPG1{b&;#R>gT5d-MZ6-uf&x4cJO)eD9uvL-Dbg^ zZ|r7gU?04w$fpqN7gw@^9v&Nx1vmeDHo>;p?SqfV7e(xzx5{pzH!kL@%lTQw?I2AH zKqYpvwq0&sEY7u3#kEWJ(5lz>$7o5&zYekF{_NaaLppmn2qC9*gPQ9LNEezPIQvfk zy9C``w2~~g-Kx@@<>kJfrAra}U(J#j{SArc-`Qu=XHq|C)LvV4h2$t>vaGaLwRojo z@wmD3!x#&GL~Wqf#TqmJwAxjGOzVvNIH#QUG#ox4;(foJpRJwTumc7E`oW{} zd{(io#2pzCK~q6J@7NI44;@TGERx9DMWdhVlWZ%$5%TAKs<6SNNCjB}M}7(1{_`q` zW-ztq5~!&y)*8NPA|GWbQ2og-OgtvWX|sqb50+HLoc~K-M9vF zxFtPw7nvVsNibr>lw^Rpjh7z7fRO_wt7*p12Ll_f17SM~LXy|)Y#+_p!mm|h-h?k& zGP`!u0Uaq541KJym4h4fLouOm#_ZSWMTOB&S?{sA`AtX^Xof54M+$zc9QwqTG`=J} zpjRJU)Ht|=v+wJLo;cfwp4~|UmPXc%YX^G@$GSrl2Z^JaqqGkFlW?(oY4-4QCr#vL zO(cq^a$Z=tEltKh!A}O5 z0a5*5Nw|p_Gx#OZsOJ89Y}Nf*>lTejD#9*5D&;6DWA)CHLh|C#k7iPL$W(k}M?~It zL^-ggdRuB-Q0ED!lHoOF2k1U}Q&R1XncJ<4U^5~=ndHDp@&hazKx=T`mZAfvHIQU! zcyUAlF!9F2m^l_;s$~4dB$|T_zvcjRMNHC$l!sd;+EX5&Mhrbbo4q1UPM|NvBHeFi$}da5M!a@z+-I=3F^ZL8m`A21)H$o zc!9_Ag&xGXFRvD*wap zI4juD4Sg8#QsQtmN}Dg@CWR0I{B zGg6x1I4wGY3M^IWJ_aJ{SyWe6fhq^hvxphtIvV;VAIg2sPKRUGq2-qtQc1Z1MXWtCT*LE7tGAkgN^UhC9zK%(X zE@IYHQsRFOn<3n^Rh{=Pv^2SHBjvQQXBs{xdKdP+N9~SiT3aTNDKCLD;8`YHxJZy; zrE|(0o}5pP-pc4dt_g;5hqk08{2OXP(|~O{w?bl;SQ(Loe+mS=ztoM+c{+Zyj|*j) zk!voi{L6wPy1eXxnQbD}1JZWWx(a5be6~Tu3DZGW{b_<_q#z#)eVc|M#!qa~9{MIo zZz&CQCo&E=kS^Vmz~GY7mh>SR*(4 zDS<~Ts0mVv(qDG0I4u%VnjM#-q%&4)fURS#=c-T_jHC=7XHHELwLg%@RPoHj%}Ym>Y;jwio^dv zf-wCr^^lUgoiUx9frX-zHJvOzBR&0(Hr>I|3I9h2&GtXY)R~#+|BWD7)c!qf#0Kkq zthyn#L!fI#CQF!`s8J?JLX1EIRJ!M%gaR}`OQ{L@#dB=bmAYEl9qZO=6Z^D2Ifx!e@kQ;Z_fKZ*RuqaTzkUTZvOPoDzH;{U@(UsBAp9MIs6BEF@*O z%vl`Er3Mv^Lt5S$D};hF`;&e_9_8A;lzmO$bLd=NQLkR5+U@n+VDzr8=`CeNu;hK;t9QO?a=9fT9udgNUheZz4P*2H3 z_;-{#1FIp9;tV=(n#$`@3T!6BV+zh^G@`KUUL%g9AiGxsB^ZWwUBRss%#VY>utkY2 z?TN^+@1t7R4drkeI(BFqD&}Cm1j_CrIeA-%g%YgLPxJ3PX?pcC2wA4Ek zIark`WHxlRI^`Ksyf>eumyMF2!ggXlXRb{SSi+GWB#ULDHk#y|x*%5BUy={=e5g9> z%RrKb+`#1=R}qe*K2&F!rEpf5?RuYtg`Yu7E1VC|oU>|u+DGvu3+C~zIm-h{^&}0m zPmcC!%%OfrYi2DsD~-)l?>QlJ8|r%xsTatyIl%-u*dY&NTrVIk{?>U#Hd9DzexwSL z4S?DO2WG%)BS>F4(bT(8X2k0oit*mlYucICdAzn4BGSb6O5&^X0SXGN2}eGd8`tCN zg5HMFzp8QGS2^tmNTo8KGI@Gq(XTXh5=<%+&UHS(@GX=|Kj=>B=$8l_?|(NMo%GdpFF4wH3L*IL8i-EK7MfX<_w};Av2^ zGOQX(NjFYj0?7d~ZUV{6yCCw%K_vbPxTs$i%beg+0F0#<5)a*Dg{}Z5N({U#l96kE zVUR3^2_VX=`>c@Ro*Sh4uF+VeMQ6BdW*9?0*7zc$tOa?z)`on1lEPXW!E-whI~t3h zR)2dsvtjRl`L$=K%~&p&?lm_yy@M3Wdh2LGfjR%GSMe{L+5!|`9?Rm#ihRrW0>?Lo zv<6UgF*Ss=ZW!F^{aBo8EjppQOi8)mN`SyS;Y#2{1DVhT6|Xn_ zfm~Ug^DXjDNjKo+%1?wpQ~UWEn%$2(%5)ZJUifW9m&feFm&=ur)Oo7emHZTtG>G5hQ8?Kn9(nvO2}^LDWuZ+D9B>wbD!4zJVw{%Ldm zc-!YO>e}aVna$Vt?d6iq*XMIGxuX8-_H=*R{`6R`+w<*{z-%{JE}Q4`<84#yy5eS7_BEq)2O=8YA4u(p} zT34aS27;0qPV|xS=rte$f8@k?TB5_XP_NM`@t!0WQ~0zTJ-Hj~w;6qeO3nsko*4ot zp;8rKC0g<2yeXhOY3N)4x#Z*uzA^;nRzXBkPW_(1uUs1dk|eY>@T$%pCvJDt@sBI! zD`Y4^sp>?~lyl33q+BvgB~%1$v(;Q7n7 zF7ED$-R02R&o9#cELj0p$a0dywn>@VRWW*w$BG6r^Q#mW!l~_>^~TfEJ2(`W3#5T* zuQs&;o$jzd0|xdw7Tn^)=43}@&`7(DkQPS85{<*uDVafjMsI~18V6ab7ESyz*O<}Q z)B+53nbD^Pgbl{=db&S$f$p&crUX)zzdcLYZ^{wm*hE@DyRt7`F9f<1OxUe4AQnr> z>9niX+jDt4`cnb?p^46zMkF(%t7rz%xm(VxMz&j7EIyzAu zRUWyeOXnD46NI^#wSx+}E&!ew1QL)en(W4+*3JR25eU_vOPk(b+evwnGE;#KawQNL z=G=yn2A5nrdp%qi6WD{xtOm>3H)sx3Q7-Wm=wceh{5ufTA|RHrLNZaMMljOBZyFd1 zS_eyl3>`UgAW_Ynr?>EFrxp?$$+#z11LGimmvVHhR}UVO`bJ`@rwydsg2}Ny$(RG3 zI{-{7KWe7#v<8ROSHtT-?*;;sT9hPJj42MUAtYBg&JaAhq)(6saBsIWR+Xg?IG#wx zPrq~qxdn`WpXGGMnUfyUNZsy$R4Is=RS!(wu|j0~P(6l9Vk~9g4@u{2q1LjG_`pep zKgOn-NT23dz&_JWt9pO{PoMx#0(tMwVNb`vyJ&(qeuqhos3?gr_1uebA0>ul=tyb; zlQeJya-|0f3~Wq*kxP6A2M2Hx*9Ojza7!L}!JSCZNNuD_kAo}WK-4F{HC@G%*8PEb z1JLn-C};MRUPz^Aol8&N)4j9nr1+A-8$eiAsRVdHb8O$am;qi+UO~4gRfI7Yvl_`T zR4iuFn(S5z2>OJ3S``j`R~tzf^3vK>JxqE?r3O0e_QjKh#2!e(X=Zre4)MS$h--aT zE-TaBi0qb>KFyP4Z-MxbRvdcT84!y7(ba7<%c>Ex`WR6s4bSZGCZ(&`?2EScQ2=7JXY)iZqzHmp;v; zy|f6?qwNfG5exag5<)T4Njk^?W~*;#?*-wY0t>!M{qKp(3%5N_#PVa~b(L*Ba;y%3g2?$<1YZ0)LP@peHP$r>K1a+nP?Y%;E>g$Rz+gS@bVjwjMplo*iP%H zbw$!x(8)!}%bCn|h-)M3;C0!*JR9+B0lJlH0A?LAXP8<^dKZNgN9ZLAIp-SZ!PHPf zwvRCLRU&D+sRIsb)=v5an4VOHnt5v~2HjS+J+2P=e+JV59jry$l45lNw5X;Y1RkP| z3jRpI`%wX(?Ka&E7zhkfF`C| zBr)>Fu7TfBA)96wGc8@`CB^0~1#SVoQY{}q#TfE7i>tGdet!F*ed3?fOn^A#j}>T< z>X~tgl5u3s&VR*VD?70?qZGvE@4>JB4xU?IxL=)Zr)FTe9gAFxqRyO(+!6^JSZ87? z3%FAM^fGxM9S@yYPegMLlyPCDd-JEJJ6K?JGhjn7ZL7{kHE4lGlHX`Yl0Xa=S=Yf~P1MN6;X(O6w z0!8?STl{d?)RP}_;@1R9v3=e=o_*f(s~0Vq2O4ofV6!pTsnAZ+e4MGrr5471y+r|D zrycN)GcVJ9voZQ4Rf#q56P2sEfNFvfo}oh0Zgh1{6YPraAyWH+4Wr3tRV<(*72^Q$ z>l?|(y!U0sHUS1bTA)*8Senth*X1P6#EW&Ov6XQs%zB~epw*_$+tosDoTH_JGRf|&=!w@l;NsJoZ z)^Cg^+GPUZCrh9`3z$ju!qI8iSaeLGW(afI(HIg1D`ZCcUTZ)HjJZF~Y}AIPaUC%d znys70Wd5!;a+x?P(nHMQ0vvTY8|1b(=yaMYuW5jejCiv-L)468aUy{h8@x}_foBD| zH15nLL!X9hm=9wq*^+@{Yh!+`=zrVia@ri>JaA#l7*L<31LM*) zH!SYDXLI=Q?-UJ{t|fiaEK=XelZgMhCF*1FTEZ-C1RkAbXqdOY0 zjmEJ6au7R&ynf@eKg)mu82MeVjAS=BI+yT8nttXGf)@DQy)+?Meq;w(3|^9aFm)^( z*qv(DtuVBeLQ`<=KPDXzxCmN)gR8ik3Z7p%Kdk}bv7VtRW=?^;KN4u*zK{SIUVzCB zjzr7`x74ah2CQZP5VhW#a#xjE06Qu=VLJ`*jqYa&u+j?8pvh%ik(!{+G*OI*g2w7# z+B69V6=!u(*!=TGFth`+W19^7Azj4EUp)nrfkkJeHHCAvhr2z*L{xn1RuaJ^btZJ> z=whQOe!yGId%*krwUs#HJ@pjx?lrWb*gD;g4d{>vE^`yXcciJpQSsLL-g{jqtPtrA z>eGzkq>O8ugf9itOK}f%wlQ!c+ln1YmSH@Cq|WjX5-UUW;h4=i!8OjVF0c&Ek(_@s zBY?rRAZ%OE1e5ZYfE}d-9G)iQ+`$b%$!+4FdyX`&_J1E!zt@PQxbhfcs(TY0$8pVB z$z?afH!-8LQwgDZ4|rork4-6^5ns(4{JI+R-kRf+JLJ6%02x6^-I!{Pp31AW+`x-v ziXuL4dHr`PMVW3h=AR!hWOh}76o1=$WXWQ8}Bv?Rmi=$U>X)WYuHl*=5W(( zdN9Fia-WAL_^u0YYkrR)X1aqco^9mX_%^HP5xoCr(Eg^ITo!XE3UTCfgB#pIA zhM;;!aVg&(kFh@KW9rYDA`X5AIcTunxyk*F?YItkW}X-8AWK%lO8duU_PupGiU&{D zBcF|E6PmcU<_#V$$2{+-DaH?YXhgTGI*NJmG#zQLU;U}y=nwDH*j!D?{U;50DksG%$W;D#&sbren=^d481jT%-5<}Z$^G4JraD)r z<6@{6m;2k>Om#Xc(=IDW^Y@{lrTj|NLua&8QDV9szqjL1A~?RC%mDE99KgAd6oyOQ-eSPs2F{?@YX>XbG47Mo@363A*$0UsJ%M4oCnz8xlZ z?|`n`G{GdK(;2BveU8%y7`I(+pYF*U=V(QAZmLaFA%6g#zXld!UdtUs!)h(s6IH=uDYI&_y+AQ>v#UId>eBO~j-ms^cS{Rmn+kAG_SP1FW)%uW#S zA!9USxZ9l=G`QuMF*v97v zZFpOu@^*20Y=7e;Y`P`1lO`YgJraHUHL6zS86VCxjkK1Iw1zi^H|)8gmZR$rp4uhT zjsNhMd7fK_qQE`ejPu!Sf5X^F8>wyY(Y^mfLu2lwPya~NwbQ}R{&2VeHoj!6Z`XX+ z?~))6+w7@ECN!u`iC*YgDJkH4nq}v)JRm39y7?IOA9TopjkJNq#wgpA|hw#}1ufWdmao<+q+q zff%YKU~}jQXbr_EH4x5h`^1~)?$wVN`M0GBxmRu|3hl6|)~LobNvUF2KaHVT>LgE=}a{ zuo+{D>DNbc(gBjBiuD(WN+(Oi&lC*+XeeND zBCaqQ(z(eQujW7=;wBlXs6T!&{BdDCnywUNr55aKsDq03YP=D%Nj-Q|jybYU1b}#5 z*is5CUo4J!d365>NNaQCp z+EDddnn5xG0@b3iOnhw`-Ujt>9^;e~P<__mF_FP@D2v}|42@Q?T*c%jo z$2Y{nZz()^46vplHU>fxbTfHFN@O+JikgTqfU*)4wg3p2c@^oC7bU1`?YB(;21W)H z0|VfJh?^)0=VQw^y3k5Y4s7HV8S>IJn|LEPD4wh`u^8ml#?s5ed{R6lb9ds{VSJin zK#N#&BC`Ay{a4BvLTYaajV(V$YztxzP5zu<2krngDP8iv zuGj#imWT5<>O?>eyc9$TtQSNm)(Xb!PPI`>R9m{WYE2qz!Ykj19;{N;y4nnCBRKaL z!g_@^(Drm5xA9Y@9y;`uUpJch!`%^xLyi|v{5*)*6*T&0NB(L$h0^+6gtz&Gpg8+B zV*%4dLTot^^yG_!LH8burNm5q8%-CB6~@&HF@&NQ(=rOSB}qy&0HJC?*5VhHMoG7# z25yOgJt*eDam0j@nL?AlB35ujY|)R6Jxn!4xFUj&DIQYha5kvhu}+Bhmt@r5z16Lp z%urmCVf!Xuwnfvef9qB`v#AE&(Fm(a0LS=Wnfr+-A*%2MQCgx?KE{kGK_UYh=aSZx z&J<4_ocG@XVzdf6H&v`CAHy~vf>{e_s$|AN7xCLDWg50oEDoF?9o8tXYL(1Ei)#H9 zO??)o9{O0O`2B4}P*{SAlC(om&1S%r(k zhlJfpIfh|L>>y0IYB@|b*+u~>A-;k5S|s?lrfbJi==G1%$V{(OhzKo0l!9dBZ1r;J z4O?vkO6#}^2J0G?GF|jLx$Oz3)yH72#2g!o4P$F8v~01}iRCj+Bjzm<7c%Q+cLho! z+by;9%9lPfK0#T4xwpWdg(PKU-oIr^VzlW7{6a41D@I70b0N@)Tw5(MaV{;;S+;cO z0!P<~J%cSyu$$R=>!`^e&IA@v-SM4BB)sxZ*2R7GA$8GM&tZ59VRto)5W;XU{ZHtO zcQ|k9{$eYtu_5qEd8(#=b=oO4wHmWKa`A0Rb=PS5 z+B1G>1P2H|8C9x4Gem*9Mg#60K)&NfPwNHDQDo~%-j~G3NvKYM6{o{S9GfKThckG3 zR+{uE*paLT4O_sIO4UOh=x^B4uJQccSBYj-W4bb)aMT6CZ2r~p&{X2a=Ni-eC|&=UzC|R&I(mk6^_&J9zcuOVA$e6by^Z5z#7X%v;PHad z&mQ`X;WN6?F{Ws>`2r-!q{N=V+{nhX5)lG!rDbDaVPM0jWnkc7_!+{$PS5a24qOFXQ?j0`xye@F&Fod=?z>nf{vyGO+wlA;f23WM=#KJ_g>9cACrX zw18R{0JTU1W8T{mVGCXAbw=Y=)*N(F!`6Ejnad`bQEboXzZmyV3_vg@f0_Zchp zR%EsN#7#yNNhF$0)W4yhy~%n}-UShe`7f@yo?{S5B%7$?Bu)0PQgd^lHypq2zqg-1 zztwvr3Kf8XKV^#@U0mS09oaJ?g(%aMTzdu%B!Cqo~S|4K!E(! z2qj44TaJ;LKErfx-SYD5`*Ya5p6auW*VfiHbX+Nk3TG`8uzSSswoQzpXI zR7T>-f|(ZLWULQAtFY-6VsJ-I>PHLb!-WKLcs^Zh3B6NupyrQ?W7${#Ka5>tb0}ex zjcwbuZQHh;+}Jj5?BvF_ZQHhOJK4OSwzg`wYUdBkRLx93-3NVqI_3oDhnjFZ&cvyn zMlSGnHSsd0_qIjvZP4IV@INfjUz0Gf*Mrm`XMm8=4vq@ z+I8r_4kE?k_$84@@u|6H)#zfscg0eOrTd2NIK$kw!}N3ABqkj=#!P-av3Xvanp(Ok zGIR@8td%Xl?y2uEQB)0lD4KW)Pu=bB?eFxn^r78-BL<9UQNi{{JcCF9lHG^5^z?L1 zt}HwhTb4B1Vhff?_WJXyY!^eY0rT6r+t{Iyq3UP3u&KQ}_rQSN`FSNKN!!FjGkeU? zJ?J;6qJ9%5)3f?WsVGz^QJ9$i42K2XVCP6tY8aFTAd9n$YMo%=J_NAH2H~tp2^ugo z#K41s1J_JrLJWW8LZr&5!tf}GL8QkiBrPTDMS-;B+1=ce&7~6aP5t!Fc~Bk>tcYNt zz4Ws5?rgoxDLkl<{5=U8#0iNl16i?N0)#=Mx`E?=FCTziP@-h9hO0Axr6ku?pu5OS z{qBAgdySl6AKN8^Co!8lVwMDdNCCL2yF&}ykhe*_c|$baolEye+cM|VA*pd zEW==+j$(WrBh(_1lxA%8pLvat4^QNy|LF7$+d9j9IXOJUkOkX?68)~4zPP>9iv>r3 zxcg7t=j99`lPsE#tgp{l&#>v*Hem`9FI2*8_y4%7x&1pdG_-bh)|W@POSZ^o-_TIS zybBLHzO}M6Q3fc=WR^r$q{;+6iPHvUO&f?(W>FsFK zv2`u7i#AM^0)+^96BcZ4tOPfoJ_*`@vW6)ZJUzWI2oY4@dtA_*1u&_y#C>J5^y`nyWIZ;AS_>=^*)wr!oWg@Lq`soH1&M>ux?NMzE8s7@k498P3Qs0r&8&7UpAe1ySn&l z^#}l3`0jSHDX1vx507g_dI-;?61SVJZ6zvE=4FnrX)=MZH_T4-Joii~Iy6|sA_)p# z`vAEQHE783{66DH@R+fpllaQk^Wh5BDh%sI>I=)tAb0zeWM0*KK8HHcw>!4yfzJD~ z+)d3KkB`vxp1r=BV4FmTL@BS27pPJNw0K$(yl=Lk@k+oIV$qM7D2L5nu6bMMOJf+_ z51w{-KN52YX6Lec-ZFbU_6H#!;e-H-1yU=@%e%j_Zdy05_x23kVcK7&-`sZZl-f|* zzQS5?(%zTLc3xbb`;_+(a=tcCb}_-9Z`8|G{HdktA=wmVqOh&xbx?{B;==H~5$0a6 zL!fDCY3Vy}1GmhqyS+iLI7yI9FB;ZJC|!QS!R%u5va&PI&aT0%iLi;+Y{bA`Yl_?3 zi;Ih^o15$E>InGt$x?T!lcdMV++orrsHSpF8-w6+QpT8{zy?B~(FM*$N=Wtre?E76 z2~HtX#>bj=^D-%1EhYo6A1AxJ?u`{Klq!_dw9o%uHj;dO=1N{iZ z_SnC^zPw(pRm~Ej)Pn4pw*&Kr{F|DajU@iLl0R}7NS3KM{V~a7X9cJcAy%|sejNqr zM7W`)qS>5VRMArlrHL3&Q!&Ij-M_1=o0ytq2^ zm_z8C2-NoR;r*MClXK(DB~URMD}hOso`%yBDQb^Mm<7A4qT4?tKt~&b(6NxX03Z}P z;tz%I@i;d=F4d)%(+%GOiiTFL`v*{Tp0Q!gChjm!*}B938lTe}gBaG-pk)Ic2wE=8 z$x?Nfz%79DykFxzUK@kn=<*PfVCx(%)EUbMSnPS)3R zo0B_n+QiL6s%lDk5*6Nn?g0^XNQ#1mdhPq!E51biG=9IkOT@*MRjz6UZBUr?q z*G<<;!%5E1%+GtxSvuw`I1fM$GE~@JI4&-(@PIH>2u^jbn)N9FAtLZx4!0j2f=0MV z%3j&6SCblSQrig>Pf}3|!o^z1?A>I*U7xKihpD@^F;_v_1Cl zZLv(brsr;Wtz`!+F7BS?!&QWGQm8>F({}m{NQ;x;?=ER!^$^&`;UP&9>t8VZWb^So zQXxVlv*T?Ux2PxvHv)|Lsv~<4_-m^hEdo5OKIu_Q!?hrAc%YZr`VR6`ctYIAW`_^g zzp%4Nm;|)QQ?fH~&+tjANp(m*2M-@Oqb3537|1%5NKk+lfBDYj)ZdvX@_FZ6nsS65FBKoD$mW~P0kK%szC9HAWQVg5~x<9Ok->A{)}!6)NhBg^9c)k{R({- z%410aqvC`7@23T@u(08%S{|FDGyqLZ!)2A7I2bXP07`IRLfe2t472Q|DrK^06J#>O zCiea~dM)M-gyHrol*y{9OAL$(R9m20sFxQPSLf&NU)tt`)v0J@LQ?$=xsvf2nlxxI zRNt1g%j3+<*v+=o6g2i8o37w==JpQpdk;f4UG7EUy@U_17(AbXDS-|l>s6(t{-M&) z1g~iG$h&}ArEwF0x~8V4;rOeV#(r1pP15+@{_ts{_TmRqshRk`uZFfMaMOe4X`!|o zuq88-Q&W92op?1f7s?cN=Tyi&m(okUA-H4S+nhwzj*7BEI%g1c|4t~{OtK2+nY?BPd08XPvPUv>PGObt!#qr%!hO#$_7Vg?Hvmu zlPimW@n|N&jp8Xv^BOB*j2nEHp@l_NfXzkCE4!{2YaX!)yIk6BAjbS-?J-a9(OTq+ z!=d29gidW04dZplj5U7335RfTdEK6`^gBQA_xF*Sh8-~&>t)bXD!GVs0MnuG^-c-B zTNm~?-i|Zl0I8X6MdATGnJjT#9V`)V%vUb$n?Xb^sQauCWC6TCQF%vRuQr=5(7HnX z{ab}cQi1>>YvCQuUC>z5$f!?9e!nJAOSv1RujoSYu~tBHw;-B~!W(>Pf< zRkig;Vm5f`9`|dh{TL!A;!O{i-03E#HuIEx$;l<8FS);v{Xy2a>_c{@4>(>9*JZciIwg{#*u%v}O}gZ5u-y2IbWzesr1XHy2GP%e1F;Md zp=Q}Ig+L=0QZKh6GXnMZ zT-gqTp#j$`=R%%3d7}WqH5a>tY`l+jRfP*1AOP)~4DJuYE3u>35Lo0JGKENrWf{ix z^(jnRq2x(Ily`RWWNyL12Q?v*Q+vFgXM->WkcJo}7PVPs>k@!FAJ$10#dY06eiKpzViHy_L*MZ*?`v)g=PpoGJ$GDi_p*TpHoepcWnGO`Z2{b!?}7HgLDt zLjI1AH%Yy7u%jRhcA>!Ozi{p&`waR^9VO{bECjR}*7zGXbF~AIqhR*)l5W0Cg(pPH zgV!0%1?a%zrC`tF*kSjlkI~x zMsi*F09PnYOnkaj#=i4;(er&HL57XhJa^wLL&uI8ZJ*@J1_+j-_outtYlluYC50Yg zQ`<6~#^J#66k(s)$0q%{`9QWrXc@X}2_?&Ggp_&jOWaH%gvATCqeGA6gW`BQo z13@l=1@rPg{9A!JaLz~OXo zfA!Fy~nu>SO{P8KFb24JTW7xr(Nebr7*JPohu6&G?`o-nr{|aqBi~- zD2;I*!w{4EOB%LmpJ>h^4q{I9oX8mvxI-W~lkR+1t1Kc&>@4AsHlu)$Q^TGT7uf_P#0Zgiw}G3gR7=Le1BW9=f(R{K1mU%Sn3w_LUCtQkCaYe{?>#Z6^XL2HwIicS z-uEDLr*O!6U2gDja1dlOd>V4pbpHOnUZ(9|3s)O3*a$ukd^e2WF>~P5`dHtl(gjRd zf8X!O>_FJWmH8LlFsmu#JpJsfVx=ZJCR!*%@Lx)5vhUS}Uz70&TwMN=)z`IK4{?fw zqoZRCo(BR9R4w38Z@q^{n>_!QvyYFDvN5t!z0=8b7N?J=z5VTAqWtwv5B=|-P_;E^ z6t5I7c_JM_2R#|&7V+6G{z&4a<&DR$Om@Nyvuowq4xf6!FNt^985XZM*T@2-b6ig^k_7jnj*iu0!UZdtjf){@k8R3^F_m08>tm1X!Qo zqFT2q#g>$AS+8-cP%;9{AqYZ-d{^UpM2%_Xl5u=XWP;xbGDXH2(C5B?H)84HFLxd1 z!kLHgOBWhPh)lXNG>y>(Dnf=4-6GY>wBG|3V5}A)u@v4Szuj(L+ECz#ts3sSU2isd z&ESy`+mqQ3^8Y;a7^D$G5(@3`csN>FLD2xCQ&LfFH(9d}Rw@-GkR$z$(RB3mBjSRM z^^U5|`HJp5@e08-`1b+r5QV}d&HrS!4w?~Nk3hitHUEsK#Eu25V#xX9z(g-s)AlY% zx;EmRL7tc~1{{wanJ}JdT}o1m0|>jx&pbY|q#^E+sGB8J)v)WtbwaMzECbjsox*LR zNQ5fVQ__(^|G@y8R8rESLX7GYyv=sFIFzREnM51>3lI|U9bmmut=r|9yw7DKD=X__ ztc<)aQZ#uBq1lXNqzeL)R5nS%Y?s-HAJyhz70MHvH5FY`CDXv-P3*b*?GLy~x%+?$ zMG6skd{IeR6wbyq|H|>odWsw_1q!PZkdOE`f8p$w8&8CvM^~KC2vm}QX>Umo$Tks` z3cK`aVTo43l>rAYm=Rz-;8lifAxy>OrdUtt;jO!yZxE)D#3Wya}J zC)v=@s0meMw9W7LKE-ZsZbn5-byz9ZJ(Rc1PnRxJz4I*SgnSz0_c`*z%fb@ukUVbk z2Kq*o3`Cbe#-v5sOARU-GP_kpTlM-mkxJLc;o{;FcW#m$G9!NeaVGEg{_>~GrL7G! zrQ>$nOT9*y_>3_Y+JsQc+yfI$IJ56e{_9A;{=z%r>{h;HhX>XIgyeuSWfP}Mu||aw zscx`XCV_z+y-1q(l(kqy!By=}ej2K)e$ICYL>Kh+cwKQxa8(YeXyB z^)C%?#E^lSiJb~?HO)Jb>Fnsf62(@RY&cl`1V~a1MHNL*o_r1$tRVy~C?t%B2}{PQ zUT~~eo_H$X>+WRw0*0K4dEA~TsVG=t0QoNQjqH%Jbyw2N(aGWQz93%e$9NGn#vDY4 z<8GAxdxBI^zT{>J-xsE|ot=m15Oz(^wZY0}Nd(lW0TqS&>+7Adcq|$!YPzhMm3_;` z*KwKhinf*ji%|r|WrL4-fli*x9IlIY01=4~Dg*{!Vkj&F{8}$Y1ccfJTet*QS8(0G z^sK9kGr$HQB+Jv!?@3H&c)smcAMSgCxQWkC9tigsQ~g`$5X{sCPCmYv+_ffaa|Z{9 z7*g?mwVBcWd||>s~VHbqqe=jqq5K1Opb4G|udB-S^%3ej^4ZL!YZ9bwMa{ zIi3I!u%O0f3@Pn|Y4Vkn#rc%8iz}a(Ew>%64>oEWW*Ic6foEH*o}RvU6Z-q;_7s-AF<|cS1NMaOE#-9eN`=5+_I3s|{lE6a%HHTj4l3Sonphy4GI;%gM$YXFdxBW6tPgR4x#8-n3WG2}AROgV zEaLBk=rywWTH+<0cGj@=1h@apcK~2GK*v^0icv6&7A%4u1yVh&e(WtJUD#yd=@i&+ zojB6b(g{2R0|QIK_@=4P)1g2ir~m>RSRZxVBWm;&J`n(50|f-+rz!H6M!<>Gr{hCkW{Zuws@V{wV^!+H((#>P2zGvTs`RCliMOZ<87=LO>N;QeT}Vxi|@$Reind)fR9V zC<`4OZP(YcM>H9<{ny|@?82Hj6E;yQaV}!NGoDOlQ3zW;s)JPgC~gM5{`V4fje-9i z_qM8vj>>O{ZJ#*^OrW2SG9_3%C0BB}rF`PVRYrP-L)%t~TozP)T$}j}Uf>Q7-ejxs z$uzf1@H#l5^VfRQir)*jNk20)vxR_%sE3DX+jMS0yCw1q(bhSUP__b5!Yt^A^N9lq z5^heKz_J|!#+mKg+naa{4kjKRpT|831|a7Z_U|3I{qVp@O?Qt>gMnoJB__i622%+4 zL+p=~cKTfNA#}oY1;N0H%>HU`-g(%A?ca+k!!{tWLOp-Mkl;|Z>(xEt+hBx5Cti~UP^LQ-h zX19JCjLWq)&RYpxTUlLQA4yHjN6Oe~v^r%XlXfZ`u!dhgJ*Xf+FV~$%x=1a62;bvV zu@k+SXaazV&Ep5Lfo?Iu#I{8a+E5g&)x*bPbMleJ2E@K#>`JPvq!47abY?m`vjMP< zINp>k88v5AkjNs+IaQ+>K3}gUMZCP1W0P|id%U^n0I?qiz1T^0; zt5EE-M=oy~*;clq84Qd#HXu93R)|AZG@yQ%*=aUx{Kv*#Su-#D)U<(xP+>m!-iDMpS$|ABMR z(#99X?ecdlKnBz^IZ2zv9_*Pi<%IZ)wDxn4y(z)09RdP^_zFr$n;^Mndt9{m0K>-J zYdO*`HL?2E__=zbjqYr1!McKcORJv&R0ZJnd_VOBI^>DiHn%aX83{vivo^UH)ltxz z3TOb#%=lb8{btF7^BsI!un?g@?4iwCcos17g32F1=PS-Wv@SuN1}-3A)~sMoLMVKb zU4wxq2x?9+F+)d2jZ=@)b-x6-cpF*RL);_#sYUKHz1AktooT?(3bqs?<8W1g-#MI) z0+SvU9pfkyrMzlz%N*Q+#O@Ko!Q=6QfJTc4HTme#>pZVFS*OzLi>U|L3kCSk6vO?( z5=<8}bS(tp%Mc)%YnlQV_vQDUpPgA9u6qj!m)RqKX{EQi5saO2APep%c&zbh)r)b*XMHmD#js0^W1d zv)|Oo^MW-W-M7{qt@0-Mj-3f%O0HHo$SYqxYgwG!?cG&R(+w6*oCOLKXjy29d!(DW zGPV5;M-A$3?*8S;Zizb>SDkE_nlFv)ehq2ygW>1VVA6JQIw1812KET?Zl?j@A{E+w zcCUccRQ!%xuvh0i6}#4jvOlGS44WP}?vSGP8SllyW+61cNinF=Zz(jaxX@A+_TtE^x) z+S*YpE)CC;3h@4ZpSNNB-giUjYqox)jhD(diEkhih6?8V>U!d z)6-CM3xH=J9HDWhV)d3GpCJ=#kE=xp6DQC~Qs32G9cM_U>u}G94550?+OwW9+gj*| z5TFpmWg=Kd;+!`72-1U`WiTN~fz`XG10!_*{8H`caPcs|_;xZyfxQ*9O0 z3s;z!N@XO*PnAoLB%c|U2~}*uU>$O5wUeGC4v1k>G4TRM2?Sm<;j3U7maJHS1L{<$ zsH&(10|Rnl(30rx4u5%90NRLJ5!zmPZ_bKt0%iVKT6)~{heV;%CqyIK(1N%_)23vm z0`sECllaidb2LtxeQJ9H@3$H7h_+0-&sviBX`Vqs&t^XFs zJ+$kqgG1u5c~)jQ+ILxLvrn{@wNPUo0YZO>7;aP|v~L`3-uQV1!;3<((708k+Srl&&{ zNkuHSbk_j}_FQRUD+B}ej*gBt%zT^J+uQGKcZrG)nI%dRB}ej|m(q34-8{(3$pW!y zX>a&`ty{aZs6JtQMwUyNd^W+lIPc9Ax?r8*m(pTI6f5O;_YC=Tjphwq7NZ@fAe0zN zMIOrXCvuiVWIWA394x@2YN=4Rmuwzjtqug*Y(3i(x)@M*VHRTnlc8ZZs!E4EDVnl{0~ z!!Gn6p((<6J^SuA`-?08ee6zd;-uoP>n%8mu&p&bD@SkANYH&AsdhQqqEN0HtG1NB z2Hq=viD$s9s2E*d79QJEB?%`VQgTq#tdpQnvu3$W*g{Dfc|2U)thD__wZnzfX#Ym< z$+bcZx7L}+GUGNE6_K8b0Eji~?X)^| z{Aw$F0Tq>W)E0L(b{4iaR+cVa-pm>C)Q*yz{^Q>IQWEw%NnC01_f7#9Kk@`?(VcA8oSg;}et!sM1{7T|;( z3zp-?Lb=54c3oaxeO77lr+f9XmUC6u*yt>1-u%SIHH;be{j6Z& z>^*h~2r-97LYb<FSRc&>EkA~QXk%jq1(0s_e->XR6k0>Zz>=d0%Y z+-k}UnWQy%Ytx`%BggAm^I{Q2;O=AR=li1P}Uu|L6Vt#r86#mZs`id*>5P z2btpg;dhb4P^w-=c6!^%)mi2-k##gg>8aJtpaP{Tb&*?lT+Y}iH8nM%tsqDu^72|b zXD;yvEGo4?mv0YbRqibGbbMxxx{8X1lA;w$M%-!O`kutZUiicw20kXZ(;TR*wm74u zm3o;3@ zn0R_-q@1wl2CBtS*K5!i<;Bq;o}W`u)7Si7RTV)EN{s6I>Zz%z<_0q#V0_YdT-=$h zXHEn!`$UaD46^!eHBv<^8Ka-cajF=tlbmSjI>i&?Mkfv&0U-dd+=$YC$^yS3jwcS7 z&A~D}GQBI4UNf1dPX z@i-lKdjotvo>^@+(4a!DT*cMhUb443eg_4_!EkpNB|m+AbM=+i!9iR3+*b|?AsiHA zcqKiku$dhGpXm_jTlhlvSe|=`XbOlVU2Zok6{=6vbH%EqaVF+?wm{gQUXg}nQ483| z_v8y^jlw$@95}Pr_;X9wfYo0Av%A?&Dl%^WFs+{&zQ4w z^W^^5j93HAc_4d@iiApJn65{UUwV4))}nfJI<4PJXzxfgXUDQdUb7^ZC$5tNcY4Ea zb?02V7o8wIC#_bm-FvN9Pk|&lI$Ad?Yfk|}Z+?4QPgy%E8x9su&(coJ3hdvGd$sh8 z9pD5=P~UYn-lriv{%jd*##YD6=P`Q^Yr2ff)00x!qR8?VWcAWYcHd9O;yd**wkDmtX6iYFF5Iku9?hm24?B+H>KGFY(r@JD8eEp zM^L|ZnPrPxh<5U_z}(I5n6%i{5w3tBKNv5c&E+y~#I&G%1&_z``n=Wv7e;K+;?@8? z6+rY_R8<9QNuFi5X}~m8d(w}3coa~RC3nJo(<#h$vAlR`Va0WKm%USM47iB zIcQYM^9j_$824TnOc&V!-)zK(#(*@JBoiuZFu(wYiVN&Aamz1S%qA_|ql?f;l@dOm zOmTh_?(dPabMX|KB81S4mx|7h4g|<_gRGG|l<-l;zpRJxhYFif%j4}WWJpwkai3;w zP6_p`zWvCwzIyrS@wJoiStl-9-`|v^J$Y&AR|4tGw#daPNr{mnf~TOP0z!Xg^QULi zd+o>(xF;6ZYt(`zB_)~F#=6z<=o}w?uJQ?0D>CE_!Q@by%LC>knI-)fbo?g#4fzq$ zO4a!a<=n)H4O$O^hOT85u&{KX#47*~9bqs1U?YK8?ULtla#df;Ej_Ttk)wc2{V()73>dH` zx*a0-$C-b+eXjq_T#&v_8uLA*&!j~UgTwL8&d+=Lb(6=mi67Lj0w@ZdFJK~;cOn2j zUTS}jr|e=U@(DPeVnFD%C;r80OKRV<_p42(dd}2eWyasi#jaAz?90Yv;a~s|j07wY z7arPY+ytHjn3C&Jc59#u9s~Kn)ogov^9N_~r)#&cwGD|!Lm%~4``OK1vI=SFcgrgf zbdsuXQg+`NO=~;3$uDquZ&V^=hMt(%y^Mt;fO8{84Ve-_gfr(u;P@5V_3aTx4atr^o9vb%cWjK zuk27z(2)32rnWRUfvUBX3c_?fuUq%>^z7tFY{!OFh@c366NFl{enRR!ViaTR_jZ?$ zuNZNp@=Ao`J*Q?%Yz#)VcovZl-z7b!dp_y}YHJCZpSP@Ycy@i~h2a^wUakWEk-ZuG zLGH9m*VM@&D-3YGsIStl<>~T#OQ8&JYO!tdkE(-2VWKJS?%qCmsB&47*EvK+&pR!e zv-lO?rTs^cM3ta6%%_R@KGw7>I%wper?>qBu6oYy_rF<3*#6r(@_%onXXIr0A5NAc z&HpwRAJ?`b|C)H)nkwL9sq&{ z`7t`NI-`gN_r61c@$cTf+pt1tKYkVQMDq0jV1wfhhpxU~3j~=#>Jon+7}B z3Z&eMZW{(W@CkVbd>Sn|4r9@aQ2E9P`VOEOWkE91$c9)D>4^b_+DkCGrfOfEi{{Gg z5b>`7$oxuDo_VWbC$vf<@X#TxFn>J1Y#FF>by>7>OUX}&NT>bt%{);{rW=uU%sa1- ze1keiXKLW9#$RTFW*JxadaP9GN%(qThdB*{ickDP`9tMn)sYRp&VO$3;lX<1*bM<_ zJK?%t$jS+gU@B{-m+AEsw#>)S3hT-=bjJQzPI3n^fDu>ktby&Z*b^86gk07m!Q21g zKAutjz6N4^6BfgAc?+~I#p@QhTM?@sx$}mk2n!$w)_Q*db53{Q%YFEe2Wbq}+;>)J z)Ogm`T%4U4Q_&tOX56>uS5K}o^@x3P=nhvN0KDO_#%1~#LVGu(yH;W1Neg&z*9Hx`HV#fTr%h0|{ON_F0LHD<8GEZc8{$dytzh9HQ_U-xcE(FJH33t7r_(y0jru%ishw;lTsJdZ9hS2`Tm|z@CYL6|iFV!LC6UA8b zzpP4-6f!=p8*J7r5DwZzJKYbc5K}YYZyS&Q&NUrb1IGr9KoXN+waO)SrmM zYyX%&K_@Jqwjo)WggOVA{OwQp9p@fS{@I0W`H)Y%^MKGds&1QyRtR#$@|gPr5D}?% zQB;JmQQd99_jLE&F7)75jGvDfKh4qBJL;Z^n_{SN2+qRTIDv9SMDDV(BZfHmKJhCz zUhSq5)92!)>1$JR5J(X<$jd9&8S`5|HYjGJ%0lUl^|YKPrm#nLFMy(=IVJ{Tx1r!J z;bc{3N`|@GppM_0z_P6$^w<twSD`>Y@W+5f5MM*dp(A zi6+>1`KBeW8PS2y{iL(T4$*-JBTnvomRi4vw{(BLW-0!+`ITO$%W=svR$plj#IQ<| z7a~~S5H_@05pg0Oa~n)WodCa#I8zKHMOEW#=Hd_d1l=&i1p-VoYySb=bd-OShM~(q z+7A=_L^DQ>QX8asAj7<4N-MF#UOhwAfJl?0x1K$Z5ftz&NUT`tsXTNw0R(Qp+%5Le zQj@T_F6kfInp(c9Y3D1d*$^1dvA{Mv>@gG4#Ut#6eLSHfB=x^6n6!infA|)1Jh>&+ zi$syViWkTfm`kv}x9U!T#d6P$nXQgBQBM#vw~KEm4V<-4wWCovmpGV}@KKirJb<=$U5vL{XsdGsv`{|7Jb7=h4*r z*QyucO|^Y5SIaB}f7E$1T=^eZ0t_OfTA6t6jJgr#HUpvtREaS;S4EWVOK50J4DJPXUwSS%bTA2<7NIF@ zr(=oq%iyZ(RV)9t{X z!I~1qc(n8jV0p3^bMxSeV|q^iW#Ki*4oj_uGUe$3Zn5j|P1viB=tPIRc)JwoAy3lB zJJ)V^=p9GAsajL@EpX2cJfrZoQsp4Q793J}R2*i7!$_~>D;@KRD z_Pm!G3Tih8rSaT?Xlh(Xjai_@2%3d}3Yat&0RP5>vh&mz4zY8DHsQmEW&-?Rf zFYzMJ{|Rp#>+JTw9q#|XC_Hx7|FL>~OG`HPp%u3KMg0(dkosJ^mmmyi3)FMN)lL+i zInkYdYv8)bujieBay*4u(p7#a$^&-;NmS|6UE=L=15%FaCrEj=WOo5+;p}4NbGPL4 zW#amM9f>k5AJDxeAe=7ylxa zt{*oonW)=4y)`Qh)y|J+{Wd)vR_D*mSx!mLiwfF|-_NUM>sQxo=n$uNc#x#@sFzD< z=hn2zJ=nc;?Wc*3LC={?-ykVThdMMR()iK?+{XKSchgllc7;TUs$_0`FoMPcf!Si! z`9}eN@ZO=I>Bq+MPI+|Pbk1@ltaQ1QdDU)W+j@oTZqkTWW|nyCAm{Lq0LfLWS^wPw zP`u2C=NJ{eOht{E9N?AmhYe4iqz(**cskWlTRCfPUkMp+o8(v4nc4ePJeA}SiB8u9 zKl{JjM9Mr%>PA}JI)`q?^MhIYX}ER_T((Gm3JHBn=7wEa5EUVpC86S}=b=zuHz-O!aro+LPwn~+x5hLM)<_2^-5kJR;P&^+2U#sJ$;sS2+jiU!@ z?&C0z_r8m@pfWPl&Hvd?Ctn`w5(PB3S|V-8b8n$jLHI^_kv_kWp#~R=2k%>_kui;Z zh;sb}hvvwR>I_ZCsV};?1z=&5H|j~Os;Xvz=|TxM#L5;co6`Vw$g=^~kiBDqXIcXr zJBa^$3GmjJDbnRp>Z^)5e_YclJR$>h4fTX-^^yl@?E{yBn)CeCT7N}XkZv#!C&-id z{%CAqC|UqI9_#8$LK@Ey-JUG0o(wGpD%~Hh|88m**7K`xZjgSw&DUj7&CO{4=g}q4 zt~ntz%tpUKaJ{9g$iL*H804e0NUy{QdK`VLzJHO~8yz|rkV!POMxxO;zu|wUB{$?h z1sHaTSLs~N08)>(ZB=Q98ERpl04)(qqJzrUbnB-rA1)lhd+MC2Nm48orX+7Z`wxZcB1Fp$d zb<&ih7PCyL_DaA%Y!tIiN$krL%wQVmX5<(#!&PC?&tLAC4dPxy?iz=$Qb%LRN_i6{*^%A#hw zwV!*4+6LE;z`dKYe~lJViJt{9E5ymUcWyc|l9w1#DKpPQgVg1p!uw3QZ2-|jf2<44 zK5k#Otr?{m7-4w93N{mnP`ma0y_~7%K7m5S4`SZ!-L%ltA3!gE4E2$*lP|9FLEWv= z8-q$RmelZ~i);Z~8}GQ0DWA9V6mE>u$dn}kI9&8Cm`|mJNz#5bg}Cg<^ZUpxn?!~~ z#Ye1sbB*;>w1V-1pyPW*ce$U9ug)8nlEy8p7)ra%4jA<`Bl*oT@adK?O(1Re0xh($ zs4s}|6Elc;S3=t86Z?2e+=7iQWbIwc2#vzeJjiu>rN!gu<6WXC6ytyiH6Ay^)Qc96 zb&~iI!7~_2M&(Eg@t$IrQ|R~(`#}sd+N<#!f&ivT>zg@&KQHb&1KQ%?;c=Cd%ysJT zTKF7`-B#-=s!SgiO|*QCqep3VuVBwaO@3`vwzwn3x71Tt^X~A!Ub4$zX-Dw(`F7r2YN|}u-W(gv9i$EzldhF|JGA3 z=uDQ4{v_FsdJ|DtS0E;u8Q?3%6)Hf>e5BT;h;Uqg*YGEv{KMnv`)0x1yx}N@Ppg_g zCRw!WVrz+%YN6`f5K{r+%|7=JdLvj%-9w;lQyznghJ}I5>5_Q!bBq`r-go6Qp3wJ{ zFLug~E8C)KmjnS2%8z``Nr%hEYXKzIKAy{_L5GD+$uMjIA{O0e47&i{(#FurOfCOWPvokfZ1kR{X< zk)1bIh^2FYAbPhEb(j5(#6`MS^IT{P9bgXok2S!8J4*Ue27IPN2rXJ_?{=*NTHVYhHFpaXKjV9*oDbszMK(0h+q4k zJ7b}C9@7G(W!gGe1-BOuClO8jY`YlOTxwrMSTS?z@*kCdx0Y!>7Zg?5%1LY_xzsSS zVoY@AuPqnLx9xs4q^(o5_PtW9QJN z3A8Thv~5+|wr$(C@nxkdZQDkrZQHhO+eX)2J?Y!)49-8;!`SggJW)mGM#tpgVw)>B zkAKx-0Y?jgyqP|aKah#`n+b(GB$frv0kZ@=i8cir`h)s&@H#$IsX=7vPAZDwU2ZyH@CUJ1yS>=6j4PC6&V1r z$+{%JZ&SW%E(pWFgIav`dCKR0rwvwv-WI(E;Jxi>R+oU@kj}3?7bTtc1edHcx-9Lf z;Q2v`9FYbZ{`mm3{3D-VIgeOJ<6Q*^6BE02NYw zk$MO!eNSWOn(pH+09l0r zejn)U<9sXke*FGm@C_MN>iM5YG90Y`jmyRS|G8X4IukLM&B$9PH1Ck&=66K#y?K}r z#-M9lZ5@P>=~h&ke~cXNKZvx{OyfNo7ddK;bYB_=E%+3E)jRZT?H2F*0x}=%a0Ye< zt}a$ycTZk#b}D8FdbWIC$F>CFg}__Ab?hB>Aqt9dPl3h%opWAKI+Pi=qa$*Mw_V;B zxxcISPn<&^e|2Be^F6=KaM(G27Iy|vu|t)SD2^;r6~^4A9%VJUmR^U*TwiwFY*N$UVObjHm0lzj*Roc0G`&vYQy+`8?tgHE9vF|v0UFD z{WA)qfuBzs)v9j~EgOabZY@6;W%7X$JHB0Oj(Axdk6!{UzMDR6c_b`;EiJ8$L}0O= zen%AsOYH=`NW*nkX+@Rj_E}G5Y~Cp+!Y=q~9P%$52a{Z4G<+$`2GPO=u7+Pt9F-Ew zzhZYSKe1g1e#k|X83(?m+H8Heal@t)|&GdFgjeVq&Xlx8Cd;E)iCMV5zRB717NnrA`Fa_$g%`w% zY?cKOvx?QvEq{~IxBQ74f?ZU-n;lH`3vr3-8D*;;^_~T74U!sNPIzKW zcu84*g4Xq+Z@T$_vvYbON4kSpD77%rc%wJ~2eatguxGSXw71u+&bp!SyCISoK0fhD0=3js|C^Yh-}OPotyKSq zwLwW7&OXe>gNS52CTYfU&I!}hjoD~YfU5_Mg>lwW*FoH7QCVJ_nX$p4oT>c??bf49uhf3s+C?CM)T4`6B~M!a_lda2kOC5oUCu(ZNm1N8pontADo=VazB$eYhP6i~C|k zG8(64e&Ce4lO2N&uEpDurrT44txp;2O=_NqR&1G6vxgu624;<6c3_IB!F*;Ebcu6Dx13^blwL1?< zV62fNPCFcQQ#7QFHSbC$>r=F8kEh8_`MW-Os+EPtJ)H+W3M!5k54ezbxV(IYNU{8b zRSY5a(1%$h?jqb6`9*?VE8jGdLy?(8;j3=@TaCKW8x0+nXfZ8g`dqh6(lCuJRq$z8+j-N*{=Lm;H7*yi^5l z=C*9LCas(osuOBj^(*Tg|VZGR!zWV+D0?OLj2Lu03EM&}E%Wpowa z%`U0s`iQ4QAHhHAx(q2*D^XJy=olQbl-A{MVfqLk$LuEuPg3iO9G=PcZg0*Q?m~a6 zV|>OL3b$a|$GG#PT7ddGV;iB+ptKbp%Y#iJMagoiw7?Zb{#rxM4~BmLMs14HN@{oR z4h);hA7TQ*=2iK8$nBf&l8Ov=`Se*^HuFJ-_fGtDVn!>s>HsyPg|c6EAc-N-9}G>tBkvnj!ZlHqx}?rBjB1~#uOVw2kLq*kx_#)Vjr)B-C!<2v!t;urMa15Zdrnirj@6@y@XMa z?_r6%6A9tbrZkrq>u&hmG!;vIm@K9S$+Abw`NmM4a)QTczSr&wN0oIl&B0w+TP1g< zk-;xDg+H5Y{fMoUd3Mie(tgr_=<_ptoxNfq0(q*!?^L@*<4g91Jo7!|!Vs-9m9(42 z^%_Hk7*uM%v2LKq_74k8uK)3uSv~OP;^)tefCKMm*Kb(!w5Z&Sh|P6I*)r*!1B`7# zQ))mH?GbsGThEmrNbNRUUrfywCaLvHzqb(V`@FZ1?a#Qk&?U@76xqG}`T$Ask^LGh zK)4|CFG{rHwr+Sx2jm!Q3INip|53~pnqjgNn2+{VO*{y81mHWk7uj?W{BLS}`^mWO zn)Z9t$-Bm5JnF=$-e60B><~@ABK&R9TLX&@SxCQEw|81mk7{e=L~ijGDQx%k8AIga zLN<4>waqJK7q1;Q;a1c*)70G<#3(b|fit5Weu2xclaD1;-P=c?3E8vPE7m)kA@ooLu(} zD{Zw7wf8wvhY1zCAGQ8B&5^ttJI}-!&Z-I~;M)h>hzn z^h;pm`-O2Iv9XZQVaHijFT+m1xTC^a7<%&yA_qb*ciJC^@Q{UJSpMv$PG|7)fCD|M z>tBIcgk;MUW_IloL}4H0l9jZXFC#T1D}fF4n3ub~U(gnM2Bx67r$oBiBT#pH40w*w z-1dSSCif->?OC{u%M23SpbP1eBk&i0Aymq6A*BF&-Nt`B6e>3jn*OwzivDngX2xYq zKaRHT!~tT@P+mvqI4FQ9s}qj|yA0z_4LFV^`6AW^z2nLjCmlR+J`Zy?`IpFf%}|3G ztwWvM4oh9Senah98B=#nuSues4$!o~Q6m~CNVqg4+;36jOoiCs-Sr2=VF=yUA2E+ovc|xxy4^tf!c$HgiTnS7oxOqWe0HPuooyOqYca5O zyR>Xw-x&{|jBL(iw{(X+!S%_{YIc9>|u;%M0|!2JME|(Z-Sf?NuiQZN^K)c~vt?E7;N(Z|+vV*m$d*`128srHgmm1$1TgAhS>$&U z#n&}?eHYc=W8ofl1+0KRzroh!(wjPYIx~n$4wpgQLMv|78WVPZ^$WA>AbNRTS;pfpUY(23w)gv z>jNx4V5T46tGW@K(pLFQVqM-G=85plH&= zaXo%SDTcigdmcC1yQ(R=q$sfocvmPLm>8O)FVvFFYEN!SPp8iIll)DzI~O z%YMrxCXflJK4UU}!dg>;F@G`0g?l=?+X;tn6bu_xNg5o2zn!hbE(VUW4OLo|<=5v~ zt}Lnvj%}O-;jl=T>+f|2P zAooH*Y}y*m<>niJ9a$xLhksofHrfW30eH3Z=kx$BHIG@?NXl}vE7E9%5C5i?w6VBV zC7-X6WJ#E%2Mzv+BeAHX3UBeuN*k2FHE;59>W1ahgXUnmVNcP;@ciL&>pz1o2T#H~ zBnKc%c?9g%p5yf`gw=4dSN}E3^@J@m_wy|cUB@`Dkp4TBz#A%0nD57ppQuA$TsSoD z8lSFikJ8Y~;eHtn;^dLp>3Xb|z+fo`f|C*W-uKT`OtUeMcv=XeZTX$#0Y=K|2^%I4 za3#u9TN6c~3di7$HWV5RwDhui7u#S|DGLyXu=m6an@Gq<;|fGxCCoT&G9>!uLSxhD zX6L0e2X&Wjy1vNt+6gAx&4xwduy6I+CY+rpX#Q8*#))Kb*7h0-9RandQnA2AXTKIdW`;303u0#djypY!S|`3_ESQG2KBR@6a>CGZzE{-Q z5P7@Va^5dP{uw0St;T4`hv#18=J%C;({EmPyRSU}OPG@(1rkf|%|``25Aq^A=G`az za?E{F9M(B%!p4wH`FFX`8FVuV(MiV$vhB1%x;LyF(Q+?oDmjdu`F znsMn=0+ZVzZ585k>_eM0f^Y<(-m1)M+ti!N@F58-x3`VPo-s*8&f8w`)~8*9+^3_C ze5TjMpca`Ry3a14NsX?#EdpwNJST0GNiG_kfhK&?M}=Bj#H$I4st<6-At$6dnTINB zXPj(6vb~Dp>qg#`v-?^lf_ow~mdUv#C8hD?(nj|3C~b!Tg*dd*hl041j{Eo7Z$cZ< zoXfL~fcF!R`CC!g@|g>QR&6zoGbkX-81E*a=X=b<7VL!tub_r!X19Q2QgeS)`x@hd z^GB{4G5BgJ@>?<15u!ltk8;6^A$F9+Ulncr=)v|PjJ=AddLeS^ekuusgWRxRkdJED zR!Bi5?)#pOqTnQ)gD0!YAgTME%D3S7t~PLvCw&vpc2{8xn?Ynssev?Iop3MciDk)x zfmkM?O!C+-zr1tn)6ALR(~aK}B2aJK6NP~pMeWr+(d}->Bl>y-WJdP2q{WBA7w@3Fn<*yz?66d*xs=gfwqIn_ zw;7OW*X{=XX?a&+4gUIVRWz-YN7|_jZSgY3(v=$LT6F}*7aK!8EuH&4*4deHE7iTc zppNCRd}pmE6BLRC7`qn7;6Es?jz#=oY-*JQd?jT!NjW4I0W4_Z`-CBVi2J1u?}<|E zBGJp6)tXa8L?xFtmBI=gJ)EDFy9UQ5Ut!hoO30Ow2BU$}`jgIqfQ?0F-p1n!9E9_e z7Iq}T>3qE7Y2PH0J^L93$~+{T&^h_7BC4m!--h3ITMQQePu^ZV6CR_x&TfHW}f@t!!X)1|y zlD}_#(0e#dCtNUJIAQ+joM~n7VGsTmsjiQ;?!f4;@K~*Q25J_IX?citjl7NFy~fda zo3zy#0q;DZ^FE+WY=-JQNx0r^1)U<^(Vs2_io@VsV4m4!fnL!|_)Q*Use7Sc{6@t&C1Pnj-&lOUF9R0fx!i|`wh`Vy| z0j{Nx{LD1Xq9i$2R@aX%8kr@iHZLwVN62C^^*!S!(_9xNZ^2l9=7yL5mN;wl9rlse zu%)K#)?({GWe`8kT3cUWY5!eK5F|3{aP_p8{>UjHtmh4qdE(d1#9v}nf1Ks*2~)o) z_FPQWS#aKJk4RY_xo?|U_JY?Lhws`}AV1TNUbiKTyR+-srzJYnl%dfnpsMFzH_^SX ztmtf&l}SCx*dG=Jj%kyz*)rzS^DTf~zOe9Q*_YASy|l(O_&V}X=U(ABd7OyZrC9;D zk=0YenGLlFZK=XL&Dg{Sx(Aw@}{wDb{F!TA+9zf!Q6IoImTW zf*Q6V<@zB5r-`^=FS@F>zL-OVomOjw za0I3I+@CJqCQI<(bMjZK**OV}^H}*>@0(G-c>El;k4hejc{C4Qs;Jt2_jTlfIuy() zW53l5>UnSK+JLBX!tB0UL7!bw@4$r!CJ-;9T4gVXj=WsImdq_jfB99|!K3v<$+Fe{>N?%Y~%$bLV1?lJRtkfs&B&t*y0 zI51#+n%Vhz#uOv(N&XL_nUnFq5zQ=2jEw)UXm0vnqM5D@2>ch^AGlX`zz!TixwNza zZz$K>iySisM7k`Mntj2XB2}VI_)>n?tg|fLiL!`$c=o zNZt3FdF9xSsw(#(M49vAYMrxmk;(T>(sG?w3V!pW=0gjjm&XCs{2bi+lAF2B&BLn4 z1*XeDP3F9L$3Lv!4*m2XEoLSe(1wberrGshqs$_!Ymbri#}U4tpMV(!J;=9-Sdp^% zf3F)VZq@%DP==2j-|_9?yh&x#{`|g~*kS1D%FFC5B`XT6;2@|yCstYSP!nTTi~DED zi-0)Zkp3t+*6s!EtEp8(3|6eaYFUWoNuBgLY&=a-i+EJ54?NcurK=vA%4*uOdo9+qx!W#EEztVdu`3oS7t2vr z+jeOEp`i=dR(H=6ybFH@9x5Iiej?{^ylNRU9`rUlnN^-$n`rdCVO7#a8bUp#!QzJl z&zZA|5FHUIo>pI#mpxgXqK_D?|63-;l}I8jYpGc7&nXRZXb5Cot^pX#$23|Bvd9Q8F(TJuQm!m1!D6{yC4l49RsX|>grL#2d zidp|}CN;afQJ_r-!Dc*;X{+z^uhQJN2U_*0tf~X~>QgU~r7I%!=t7^QPO<@XfV(LC zavXX21kLQtYU)b>2H*Q@VDz&^e+EV-#N7k^eu0Qt zE4gO9?)dE1h8!hAC=yjPJWQwvc>y;WlxE2rwH zI5uyPk{{Q|tEJ`^E%Q9S1+@md#8~m&qw0a7`TU%)3i23|Is==%FrkYN6q2h19t}Vbjsu!5lUpVnN9Wx&oKw7;{LU^>$SNbuOnaS!YW{cC$}y>#{!fB&(A=tA1M^X1zKG1WTHa|B5&JM_}ehWAlNESqJoQT9nqZCrzt*)yIQv?=05;A#Us) zrh|ekSZQ33(Zz1_gBpLy2`|{3b)*&*Y`h(_A-Iw?jaa0+Z;oBC&RgbdQiLoFc=J_o z6PqekcXJ-Yo<92AP;-mYr(M}r#bcqVwog?mQNcrtTjmv;4OQWl+14^%b{X{njI2tS zT6(wp6;x?AdQ|xhbmqyb6(C}uAXUsqC^+h`Z!I8U;mCyY2lJ+kD#a91JB?mrq-f4k2Z-g?A1iyOL2bF zI9vg37zPs$r4mL2#sz!(1;p{r7EibKD<#)znkaW$uG^{ZaW5opyyeVv=GC@W!P-G3303|qRd@T zwaBYEDi*(B32}P4h|$?HdfeIO+>tIB=Q-p_6(f;tJ+%Y?Ww|R6VoV@2Vs59FIBL;*l zCz+k0M^Emshv|3k&ies+%$3)+sBSogw=T(9gXwAvUy9ewiql?~iI@kad%B^4Bns!r zu^0tQiZK4(I?BW&;c2U;X*BVd|4}h6c%j)I+jjGrR%hK$W#PV!*61a#cW#Nb1Lnb6 zgj^nDdi29paPG_=V%ig5jH?M22yW-ejaM|iuS{KGS0udQ ziK0YbL|f$}4{V?*t6-o=d`Kr4w1Qs?Ow&VpKyJFb(eUtJ9>B_t{_XH`ZXf2zafL0A zj*LNLb0gl7j#S&7ErMav@O`-3J1Ar6A@swQ!XA5fs~RT8Fr(|&qj7l^AqgiVZ^DHo zq}6YOd6yFQ2ENuI?w|2rc+YgyEcvbY__7T)tZM;?E-qvCJI8Bu%2?7N4tSqMctbB| zvQUvq9k4D3;8lhM8hCa7c06@^hjlWA+hGpe`KU)y^jci<&zg@7)Cuqqi4g#{ZpTqb zahId6NLR>YxVdZ(KF9g<9>>3cAgpjQikJdJ=ijXx4}U12nAfIwUE}4t+#@%ZE|dlLM*#9XmQ28O)xb3)Fxlpg-T(UzPW;$IsN13E03BQiDGV#s{iZ6|c7F7tbU zM9747=g4oE4K0(d#OX(hpZb*EepKqHMwPGHAoNuPJKHMFqgY5- z^~ao&NmbreTC=$M{ll1|pStjE;NSb;)lW=am+z)rTFFMn>L-j_kJt3*dO$T=#kE!) z$aBn#jvF9=Bm}MwEu)V;y+|saeT$(O-{ywkkV7_kFDsug^mIf9%#VCVTbl}Cv?}~| zJ=oh{wvH6|M8UluKj2c%N3WJG4dD2<8X^5XKOOrH!7SZ=S%iss*r&6!V!HyIQhU1P z!f6%)XmPqd1sDBeS+LbwC5d@^v5F|fR1<3T4p>?$^{F@aaD2wyH-O+L`@FTmIGy}+ z`CQ}@#20QtArNLDzvQr|?#jT3OA*m#UD54qUP5y{d?)ty+HPrlu*mMOt2@6Z7qTb> zcsDf)w%Y0WTPJjCJ;D(jyv|~kC%dBuu6%1=F`~4SQUtUPB_0guVsd-F&U#o@@`V4> z7lY-$`eLv!|F4vJl`c>0MLY8K1I;Jo@}3MDG!{JwDe%1Bp|cRojka{6&L*|50NP0( zk=WS0hann%;lke+i=KO)7hu-&l12A`v zqqdl8@Ngu8s8KN-$*yrVb+qzez){rLqm#^E)scC$koKroG;>#-y7PX)Pn#<8{ccn# z)uXEDA&WR@mN)D_k=F_*`;$G-O`AIb)e(g?UjwP{eUIX31AcY??{@WJWzV-F%6E5C z*_eLw^ZgVX$wG8DM2^t=ya=XRjEvLV#+wl$-8^bKW`|+=;{u8H`}^i7H+4sTlpNV5nhEJC-A1tO4t6G8p%>+KR95?$bntbw zMIdTM0c*FInwKS_cxZ+y5?=JwFr8K!9AqLtXpD9ysrogzOoV)FOZyxU!vS&lIO+=O>&QJ+NbPT@7QwllG&37tT*0jnQ|By@(WF(r9Q?k9x4n3va z0*Ej5+7%fDC1jYZw@i`-dDdVNt>;!hd~}g_8bp?b9xI|j7h<}6;Eo+tC8F!VA;D1M zoP>^-&}N+Khb7;dYkE7|SXbkfBA!6&uJK9Vs0X@8_5t`9?w@zQVktv8F(DCwiMcv{mqM2)VA31&!A7TmZg_hko_{^ z+qsRZgy}TBqJhC9ymnYlC)zxloW@X#6*i*Eo z>szTw!2%KvNti~ToY$^3+`LhjgG6voOH$vX(KeW0#g-7P~(^lL3}CiSbz@`9~n z5Wya@>$f_>VRQsRCx1GD!DWrS6>k+fB;)30Xk11xc-6jWd1GqmHX9&4M%yEff>mxy ze67?Mo96>wGIlmRjio3)xK$tyDNYf~l<3u>@=f&yhJMA`gBBze+EOVAlGf2qEqAY4 z;odIrv)R`H{$NO`$La#UUrSaQ;yH}yLFdxsma%Kld$SnkWnw=bcj%C#XhE&64y&`U ziX`x3W8GuWonz}<{qk&=oHo8JOmcN+=|}BfoP<{`Lr?5@f|E{=R6O{dM1SvGDk(loAibtE^cnWp^1 z_x*#b<`@JB!z8UzL)0-ozz)^adlTmv8<+YU=ZpsfCnz6X*biz(nJTGQSm!CE08|xg& zC6r};@&mofkRfnL^6pBcQ0z8~J>sZ4DX9Nf=GNg%K5Arly|40FGg;`kF;j>-q}<8w zeX#=4qH&mU!()aN1y6sV{IQ%0kQbw#z z^{+9a96@P(n6njNhp$bDkabl@O(jg3h)#eIIJ`7>ZH_IShrcJgp4pj6gcsU}X?qt% zK-CdnH!#EKS>Lh*Ow`mNQ0#6dhyk$6JBMmNp-ug9Wj!zmvJqA0U0PPA7#j(cO0)&D z&x=x#2_)W!xf(*C+2D1eh*E5s)i^1urAh0k|3Zl7sK=oVQ@v%KQ7vD;;lxzf4jg1h z4vbf+8{fR6a6U;&Gx0m2YTls~Q5Mr|)rr2GJ_ywq#zV9;kvzObO)7oC;Ka6yKniC^ z&e!p@;50~Rm9Rerwc6!J6}dPOYqd=IC7_fy6)jfX7oP3U`P89bjx~)(>#&aWq$UtW zqFW|;0L}pY{kp=xGqEc1o%*LtO82CWS*SzSu&cB#8z2!KG!DYBtgO031*g2kzUls` z&hnLAMF#p$unObi#c8auQaQtin)h02AWr-T$Ok37fm|JZsHc+8XJt&@E?~=H?Lz#@ zCvdjS`ofX9JSaOo#yp=al5t!eT!IoWrJlUl(8XaYC(9{vrMB3Y_VX>^8}Vr7MKW%T65$ zYGTVl1dki|z6-RQThI-0RrdrfWgZ1xI_h&)X+5}Pqn%$;luBw<4~QYE6ezNMT6b6; z7~MI9Fg8G0WP)0rHU+8!YnF3y}So@{K_}(o~Eif8_hgAwe`Hp++ ztoTFWeDkdF0*^8(Wz!iu=#^M?j+o~a$7GsDZji9;R9cN4#acc5SN_R&UxLk!ZOlTj5novP?lK+WXp6%Twyu3Yw)iUZ$v$ ziZRJVUN+c0#p3XZY)jkU2Y)Idf0g)_M4~6mz8E!dQo#I0j$hKv(JpWIbZqBlh4~IX zAk4!4q|YiX&R3aVI;^NvGQ3_vbW@fsH?Vzt^DAU4@-GM)7JdtV$Qb3+uViD&vHAo1 zUB$Z}>fX4+KeXk=!m;e+yE9{17dZk-KoBXx%d*PJ*WhK_xqyGUj}PQ8r=G!EI-Ggd zrkm{kM{lR;Nk5~RUELdV#wFAYva{fR*&;c1DiXH#VqU8KMY+$%7t(oe8`L0g+0fgD zdA3zrjRFBuUX}19oa8SGd>$W0fV+dHf)^-pLy+h`EV}-gON!X zl}8$z|3?Y2C`m2k&n3YWO%psp9=OC38gUBIPM$pf;^wSy zciae3K)a0$J^4#^MFAKc2_8UHPj#u4hgJ>_e1gtDafB6gxCf%rM1F93^WI`qIR|JdHT>+_tuxfTSF=)DQ*) zM07Q4c8`DEQRAal+lDZe4?Au3E{O}HZ^ZDS+gDIS2ku;l3u2N~gUb;C=aC~{tULWhW|Vy4`y$-FeNn*SQ>fE-9ZdfUIc8AG|8m7mIn@R|B}4?;_wj`8M$H=h`ZF)1 z=Vf+&`24ti_xtAx&)ZrVT0uiVH5=$ch zMZfm9bcWY+($brUuBZ$UdCfF+5&N_9V7O~=KpqdS7pth5+!73VfodukZ=SSzO+A-H z{^YL!3K0e|NuNFMf-g~}PB9rA)AiAmFZeZda_JrL)qc11#jX^eM%1_6+#zAbCri zOSG-_Sp|AnNiclljBrQ04gj7CI=rIP4FVS)W7vQq&D);{?q0E?+o|b(VjvC9f2d-g zA6f*y2m)(vOaIds>c66JFmrJIuPaTJj#TUgJ4*LV%`8D}znrdL2qGvc=p>!wP5_tl zhC2NiQOVoCdV*Me>u5qwbSUHoN~-bI6T0WS=RWGg&#UR6X=7$proHbQvD&nf@U z7uVP01hXSM&++SHn>=RsWI}p)WV#KL_qOkkVbn#1>9&>KZ1`T4*+f{qe z2)j=g6xAn#IW~unA1o@DJY1q~+UXC?a2tHCQ3xCh#?J+8?)C$Qy$xjbK2KfBi;rFR zvgp>`$#|<~&Ckc@O<~ZJS9}gAfcF`Q`U?(W1Wx2@5%PMl2mkvAp1;Rk_wZy!uDW=p zr$mdpL-uDzmyPA2=O-g+`N5d%``hW=?)@pqmRG6438M@%wpXJtOTy@< z=`c4HNaqWi%LkKQs{a8AYo9=R{P*8GDgbIIEIb@s{{lI5^-8Syi74W=PY<_1+RjQ! zPdq9wK$xm#ISEyJlA5Y4!eS{MJ{}x{6RJ zYbx0vLjxGoJP=pX0076dqsSMduR9#yX5=yxLoSQ~OWY*`h+x3AOqG<;$$BoUMaNkh5jY@rl0Xp3Q>SD^PLx_q3X7Uil?+Td8S8Vk zhk93yl`sOSi6FB6{XFimVgNy6AP^L$I-EWMX}VRgB#>jiC1O|%KScs26Lj35=DusG ze{?=b-5OMW><^*7teLfYmt9soCSGB2XQsmBFnQ@>V;6mR`ymm?HNUR}1s;Phe7VbpD zeYbBnv_MDXCJ_6cLI(VkWa7=>pJl{mm0qWGQ$O%T5jI$tU}$^)NvM)$su&I^>asgwM?;=JX08;&WR-YDO98na$Bn;+h!D0BV9&*CX zp_rdL7NQprmA?^g3QFlo^w|8xex_{V?AV3Z?ws7Z?%bJS)5jEWqC39Q z_|kPxOr|Iyf7rlBi0+t%Auaypc?>JnzETIV8$=wKWu=o*8tM#*^0eJ8rPqYwE6tVJ zs#gR|jMm2D-cA>Su!JyBNk?1!u{-6tbfc^vhc=&J`>0R5sbl%ur156DaDaBqb7-alRx#I)X+}BI?axv9)26x?v{N232QQVoV1nMbJbhN54}hm9vHB zs(6%+Boy3$DF92&DT`x3`INXy&ios_MX6MWmf6NOg`R7UeSsdkiAg5>&3{3uUiy%P zRn26A&!$<nxS$?9rA#I5RXIwC-M z*h$>5&>C7y;k-TBs^Tx^5ri~ADgW;5ayXZ3lRR`J*_~9Sz3#0%%pOz+Oq7S_abuzN zDJRK2FIO_c057kF3KR%XSX`H(BQl>{EppF7bFUGtRm0{#monEcxd`Qfc+%0-J^mex zl{Pv}EWS#XO-<95E9v%#kuJ>^NnCSZmrs5jKRskCfhRVpus_EvJ1^#>HoLt7?bX(3f`|7=y%FnCl)k^QwvDk2T}2JOEQP&FJc+_E zUc_+2e{?|lF9n!Wj!DI;N`(^wI!`d!$>?Fu>=_n~iQlt>32mQhLPh812QFSMfJ%cI zMg&=ovu1cs5o7S!FzHO8Cv9vh5`})X<0lPsS|wL$lMSJ~Ga&7W_%}m6IroH7kHIlE zfp&9!a7dUF@;W{&4!Q;_q1LYN+&m}nO7NV?BI}igpYjVF#S%{#89=W?h|dpK%rm&v z6!;b7-+kN%%*+puFvLb!aeE&!kX&|~S_I0xKu$=}ua;iq*tTYNGiX)f)Uk+Axo4nJ z9JWpTUQa!h!mf>N&5uNm?Uy)hW2U7Q40OhOWpr}rA4 zn3WA_0^-ZcnRvUL|AL#0P*T8`|1(QpxL z?cbn471T`Dj4UgmMb3E$5alg)vK%XJtOi70_NChp5(ZQw?AgMo4^X7n^iMDDY zcVNcOzZKpx;2S$9{^e(-ed6^+o{H{;K^boObBCl|Hb{km7*8M4AI9!<-7NR(Uz>~C zCwRO?ppF)~K*!>i^;9@00n%T3v>IG(f4CJ~Jy8rexL7JiuZ{IK(|js0WFrs?iyJ~j zK>ruh8^EoUf&*+G;3_mT0k!Y(Nn{*;AJ)W^Va*R`We+cH-u-%$ku>S5%3R@&eDqF# zUyX1SzP#xj=4LA{)}GU*Y$oDnI1p3w-FTtae)t>wC+|FvjO?B8dOJ%5@Xypbe8128 z-i^U%I%Dot_lz3ta809Hf!i}J zy12nMZl^3K;JS|{5(wFrA3dJd5S%oerx z-p)Ojg>%@8&LJ{oD!QHXEh*utnu2@Dx8Na(6v}G#&G#N-!yIPOAUL%i(xv>%Ee*QP zI<-FWhd0dBjoSY9>yD*cIgZD5RJ0R0I5rNYXXYp&U#Huz$Hl8EZO2*)`uJ~T&0C?2 zA0gLXpY7~j{sbpzr)c4_=|vqjsFj)k9Lsg8e;!IBk!{VhzJpbLSiecio*!0xzd)Is z=luVZSpM&*Hk>T~s|V1eGhu((`hUy3+5;_;y{BS+vVNBkcl4wASN2on4QXmV0;ClY zwETrB-VXmJsC4!Vwq4344Zb@^Bg1|U&D2ttf`>vUP6+OXb`E}aLQf3-g@Zn=8I);- zz}($;=ryb`>6Rl^Bc0Fhzh74}k>`|qI=988s7YM^{+eM!jkKRL3Cf1CB`D12BU;H^ZA7@*?X{zZ1l`Z zWl<8x$a>&tl5Pn4>&YVCIRQ>-241>*Too*t9K@b}75mqZ1B`vex3DP9wg9bw3(V9T zw}K@XA`02&Dc;#kic?5o7@ZA{2R!=LWCjRhkrWn$c2I%f^4Fiadvz(^dVKk{7`Y&8 zA#GDKfr$Gw`8mI0Rpu(bOyKzGs@MBPFlL=iC-@b%p&hiNNs5fNWh`otG5bXh9`fk#rHCv6&V_+2)+{X ztr0*#rNhfvWetsm28Eng*9w*bmkhG^Mv7I%ZJ&WrHrPX)Y@|0>;bFihbf zTF@%>w9I!*aOF#hxS5xHm32_J!4DX~sO6%R;+PykX{oG4d}Vg@2o7i&a2P6UIbp92zYyT6;GpZ90KJ?=bP$YocV|@Z}mO835aq86J6$arc z>$r5r8CC36#B@8z1!yyiXJRkT5Bpb%LGG1->8@d#Q~=M;7UufRG}al6SV-QpJ9=oZ zA0#>$n0L$eFpg_bIKeZ|#INGNvYE3V=pSuP@)^e#DwE4+=}H+y|jWAznA0`$M7gLP!!Zde^15gn8f0>~SYgJl3aXhwz6|NcKpY zNeU_2&m`Dv+?%2+pp^xP@eoTJ?q7bfK(K>JA&Bdem7zxW@6{V{EN(+_dMr7SM1$%xgn6F*sz0FT?iI$ z!p>L5uO3V-Y(!uI^8Sz-nD(4f&VDQetkxZByXXNkF?eER%c>=Xx7T_fjMIZ6#)GPW zsUWd;^@FVWct+Lp&aC5FWfV6!h1ya?jW6q;2}BjdaXaYvY-e5Z$J7km3m8|XiG*f6 zmxVxn`y*QSuK^+O?pOT8er~6R7_GaZzJ+IfUke1#5yRpL3wWfAvYq;`+GKdSdZapCIVirf+)T=4nB zPkM5j(wpdIT}qqjgbwkYSp#=DpP8;Sw`-BANW+Mw(;)oWNbV2C&bI|Zd0M)qyETrXuL`^>3 z!pG>obj4_eXXvT18e?AhbIkHoXQdC)fJ(6mSV#qTQ;=S9{7SBn3&a&D23Mr4 z1yslQmtVmRyBICuS*RyRe=eHEY`09@NS!8Es0S>bxskmS8+egZ)uZr<>mP69zFlbR z4c`8K!>+J$(>LrLkzuTIb*Rg);34BZ*1{urS#LZRDNM#ZcFVw~$NFdhCDJfLM~YF| zSzIEP2+LCn8pMH?D3#^<6%h?{C7@#Zf#dKLmv|i7FWOZz4%Q3HG|2Hn*&zuQa~I=` z7gl88opsYd)9#=CrQVo&1TZ5#_T4kF2ry_UBKz0kPMGvHS;Ia|SZ-cH63!qm*Upjs z(R<1UX*xnl*!*M7x_S8Zn>QUl^vS9hA3I}VHk#Hj$m`A%oySHRDBxtL(%WLyE2N#y zAegcpGJ@nBr&BB{G|#IK$IvvfConDjmt@G-W3P z?97a=Yti~jw9UIuw2-n6RC!rJ#p?Hf!(#N$QNX23h@JwcWd67nx})5j_HzJB)kJ?8 ztO|=N;Xjka#eFq4jDa1xyUsth3u=*YU9s{Q*nF%cZd?cRcN39F?e{896p5}>!t(|) zoCalA^SrE|_7b}&f3F?WEL%fI^W3Hex!OR6YBeeD6Kt?@d+`7ZZUkN@jST`z@dVaH zG(0t2ZTh_d57+n5&bJsxqYTmQg#Ewpy(Ddw@I4wddek^B{~RlVJWSqs1y?$ATM7mQ z%I#*LyY3oUXwuP2Lg9G|sfTxEDV#%jIj1zrjvBCV>gem-=^MlU)0LY!EAs=p#*LcF!JQxil`uIL@IA8Uh9b+Wi-yXojJa! z)@oio%FC-Gm+A<{SlP?~PasFKIgTBo%-UO58x;{SaFvVXsVaT^dxFDI-&JdxY@Vru zAUb@-2CI)`Mc9vme@d;BV`aX7=@Y0-P$v;aC(@$h)XZDwt6)#V#Lz3f1|I}sqb6{$ zuwcbmsAWSxFsS>b;o0^j9JQ3BBWgpqNHX(*=mGDVUJVPIg~biSmVcc8lcWho64Mg-7Mu3fqN9kdloLJ z(jn`qAUAjhpFk-3lNI$0{ z)jU6m^zC?<=cc1hN@Tt7x38!-^E+PT_w$nW3s_}O`S3ps*PQ<=DTkSvh5f(g1!n#u z<+Q{8lX5P=rHWpG&6kM;%>1v&{sZOQ)Ht_C?8tC}H&gi5fNs>CfwdvH4gA?`(n-%o* zd$)h@$x0sBiT5q9WKXMB@3aS5w^Vx7^Vrky#~vOlV?wzxOP~}8jw2(fPNXQ+gZZgb zBHuHu(shOgwz+wGoX{=mz)h#PdzxS8TeU_7x6fS@r0CoHd_ONoE+8Bk2>`Qmz4s^z zLI*8Q3KgCOc`IJQzkCj!g;T_S9&FSrpFb`|(^0mM`Ds=NNVa|*8+M@4VYh!jA6}>C z=+DL>P_IEl$&?~Fz+1d)#an91lK;Wrs3l+B7SExTlS%q`@9Z)=yR}qk@2li)onr1u zCO6AVb=B4?H@K=q4UFa>b#aAu%RQpJXxRN!EyNKiKCetIqsuu|;GK@54D>5*(5{s{ zRLyMHkGQL%(*5trR;&#c=#gpVS`Y!+1oyyY`wl(J3u;BdIhKo!e$p}644s&+2^ zMbD*%-Q587oNp=fdQJnDJ4n+r(AP*7?OEI{K}ntTZC3SYYi+f#D-A0FPnX?aq3fCP zC0U@&^+u0N5{>x522(I+y{jeU^~+hq5>P!C(u|v>a7ZCwgHp@QgINozpbrwe4GdGQ z>Ux0jf()9QY8gH@hX?@XmD}b)mIXIF5qmk$`Yu{CO|u72{bZ4&mDj}0q zHPfJsSHh+##IgG+_UNe%%XzP!W5+i&UyWNbLP;KxOu=%3Q3zY;^A&XvJ-Y|PLmCyQ z{U(SL`Tj)Sjf>v=d?_crz#{hjnuZ=ZysGK6RgEm0f<#3kpfOxDoV5(u_lRUlys}2b zm$g12Eq=9*6^``o#uomq$d>1RP=cLw3+s-&B|!(p{cv?`yg}Yk5exml zMEvFQvdS)CxSksUa&a=L&^Me^qo}9Xe6`8<0WJW&eKyYrlHjID+MBoFmL&JJtcKD$ zela{pwi*&{c%L!_^8tJ_5ZowKo{nC@wr+w={58{d6>cXJ))o6p9MT3Jt|e;bv{+uS zdi>bawR_K%LGuIsE08rlL4)ysA>BCqjqRG-G9uZ6s1OSqoij&PCB-wV9heEuI5cfq z!iR|L6aYctUp>C~zcA<|IjWQgTYD1d zw@!7cHP;e;N!kTfbqN)4rGRhfm=aTa@Rs=Uz`*hsw$%~o#fHI5@Ql@oqWC89NCf36 zE2f|%sN+{d-)mXyLtjuh z=rMca-dyLRRsk%dQd?*svCNS&B0|R&J~Tqa!0I3Xici}m?(5&rx*BZDe9o-kmLlA? zN{}f!#3CJ~bS6q@;_#h}r%u{B^4^TfROZ-9GXyxxCvoLlu!Z1}ALv$96V$PrUM%yt zDGFNh9TSJoShNipL-p7xxHq;Z>$>B#L@Xx#qdIh|@Gg#SH_zoC_&}0Zb|z#siRdt1 zw4$sIe#Q3egvY@TYjkOD+46YrDkTII<~t#UZ=7pK6>rQ!sBFRzo+4P$jBLc8$!O?j zz|Hx-^317;#L~ZY@lF%tJ6VD2a`J|*JsBmEx}`*B^%n}rMY6=G zg3qXupi$8#@BT)KkZBQ($PRv+U0W;$|B~ZyjH~9oflq>AVKZopAC2PxxYNX5>_OH@ znqIkB*OFy|SJkdO2T#LBwD;o#g>@H8@Zf`7#wQi(`l3iBs!zz`$#pY?Kv`^(nMWzm z%8RN;+6q$!ul*JRifv2XVjaBe!qi)`L!8MS3A$^v$4jUdjG(OjgHRHMW>=X%o zqP)D5UX~2~^EXS^(zRByN`{UW(Ft#&(-=FzY(O;n&KbO{`|CsygN-P*5!}$XZfCx} zM2jYD6TCMRi3@|{pSbrH4a9_HTM8tnj@osXXO&Mp+(Gj=XQ43tZYKpjr$Dj9?bN(+ zzhq2^_{c#Kxb0$D)AkGCP-{U@u$yael`x0)@LSq)pMY1rLznNJBQN(;Qaz`4oz;^* zZe8gdOj2b$cdJbbL&!VN3pQg9QCSmHEps!kVLQdI6%kSZJy!(_A2=yqF{xpQodJ;Z zjo4lz>G=SrBcus@rq+x>l;I6Frn(flqP?jU-_O?!gBa9N=5?QAgrMhnaur^lk$NmL zTw{z%JdHJ$$~7V>xbI8OII*wkU^%+Y97mhOomF9RkL;gVYggUIk}^pXNkT2?e|$61 z2jSR0Q!XyM;U6B(4uI2Z=U_0s9|KLG$Wr;nWXc{ZJsDn*G-f| zwkd03&PbGJX-vk(=G^Y+($%5!_zFYqTD1>0S+;CJ#B>}O9UoB9&`NMVb1F#cz!%=g zvs5FpZPlKhv<_-MW99BwzJc@PR8n=9E4z9m@@cVo`m~(wA&zs zu@rKCjt@I#Pe?x_=Tq;^6z3+bgRyv!pSj{@L6TpGa0$S90YAjV*&sOyBF)!6fSmX% zC@~?XT~Oi;$PBssa35IFkGxI29(0D@H4qVks_ooFH49grVUmWUuA-N)2Y_$~c~Hj| zxybg}u0Dvmi!HCXq*(E*yiQ-&zX{HaE+8Hwna}`{8~31OH}%S>i^m&OsYl52Pj3=~ z_1;nYysi3!;b%j4zq`JfJYTea*hK+UJ;^`l){w@j4Jd(r-VIGnTfO zv7l-zy%U{O`{Putd)5J(kvi@5Fs|wPc1K+z~q9oIB z0Q?S0iG`}sp%jAD? zV6P(6R=wA>bQ}dE;BnD^+17d8vj)R;hq|$8q~mI3ebJzvmcx>lQ@G>Yz1Pl8t;kb3siGzK&YUAyoYnHQ zBIEm%3Z(kS>~<72oq~@pwa&(#uPfEL8nxf&Bq_$2*=Xd$503Qj6RA)Qz=AN5_GJHA zvoq3o|E-@Wa8g+gba@7wHbS^l3ktN#^W#LUd_-_902+HWmT*9O_Az; z{|HjPTc^&Rqd4{d5Tt0Je7y)t!ug>UiW0DgeX0P`ouz1GE$N4C;M+c_go8T}29L}= ztEUZi8k>^5=a-cNb+3NkZ=WLb!RCl%m?x zG)MZ2N{4UNk*D34-%QMGw3^5$ukGQFdH4Rzd4($loOH`GK&y)^vMGX)is z!{m_}MGvUpKsGgM`iG_})Ulm6jNaY=*O_5L4$vm8<#Gq7b?VnNv=tj#)RsHA%Tl)* zYZimO8%tcw;LrJfw|t!m_6R;A{8?)b2)Do`pW6K7 z8T`k{9fhfvX)1e8yzr3Rqq-3uJ8+rc`+@*LqdpSmI&3v)@GLBxrb0&8K?uU_28!M{5io9P#G4>9n%hFx_2#x#Q@~(iFA|7yUm0) z7^U;-4*^1%_cd6BnTncDIwN$bDIR>NE~_ZknKX<$*3jl^R${}FBNDm@KutfF5?0D4 z_YnB7CwM{`eC7}!@h3Az8oSiIOlL$JS_y2~(n6)ekhh;`t9)a{#7V|+JTH-;=(5^1 z4gej$^Zp2&Tj-X{%nN&TjQPcMW| ze&%k@tG#83B~sT_5iK`%f@n4fV?>vvX3}!adBjO2kN^tB~eBjgTHmIhuTXE z){O$2x`r)?w~?X+HtVIqE9Uc45sL=&I>3~)}N_PYxJj4+j z=r4?=m7R(awB(|3+e78yqh2zj@aZ1(?|Q7Zy;>}Pe?{OL0V417p)Hd?j-W5Si56n_ z@MJQM*_v+5e!{uD#Vm<~@aIvsSVQ!%*DqP};($+DQOam{S@9d_iWaxLwv7T~F2s~% zb^<0uj-*pjM2k{pPD2DZT9uLn2cjZ_F)9d_6tPw%8xk$~TZy zZdpRcnReB6#^IWv;evU4$G!_-_4pm7_J&HB4N!e-3=Pa6k0or-*qH11I-4W4`QCIL zRvb(x#Y^#06WRRj^9sBGFLfIk*Go0Tfb7LFlg7u^%M(2LVLx zJrJit()(&XoH%@atDvyRvH*d|01;57o9C>+`)lU{}-f{ z<|Y^d=7f?iqogI=HbJ;dC8Cj4+XRFaB!~PN)z}CZyreJ8phDYe9WxOF#w7L=l^w+k zM!2x|u&!kWM1$y%7gGiw7q$QaS$UNG>S-*E^cwe5-TTC-=My%GJRi*crZ!8ZTNYfo zJhYQFBA=;$OnQC$1WoNy&17h06{SNf8~X`d3K~jTjC^1Iaky6Nj4rD2^S1%y4j)R1 zLY_A*un)UFX)icdC=qPr9%I_cmz+0c_d!%R@Jj>KPx)9xe5hY&)_C?2n5av}f&DI# z#JaFlk9_zpDJDm7LWdAjS{3WmfJWxQYknt46surjM=PC3Z){kCD8MYWrYF^+5h>1? zS(u<$P(~_49#BT^GdyVH$SB|85Nt?PF*nJ%0_eKQ;Ixk3mh_vg4?Gl2B9QL(mRw8m zjb_PaeW5`iypy84bQ~gf5(On*jxu);jz`u&ht@O;U0{-9!$HuF4AaUh4En{yL;+1n zh!w)}gJf6oBu?GI2o-3*Qob2PV^fU?4|Un%GIGAgTFRIfXU53}%I>H2j!T1Ql1vR9 zS{Hwg&?-uVo2LO!HJ&4=t{S$|3e!Pphjo-@S?HS>!U;9x+uvx`62 z#;}?2(B5jIX1qmvNepHTR9o%E;7Zgi(M6>D4)_Hu_j?wR@QNVFRL2p!gD-5;$|Eo-V-3kEGz->)SePZT+IA<8 zA#OcaACg#4rir3Mcy@xDyM%dC0y(SOX}M0lviBiQGvwjilmtx0(l>2yBFbpPmYjS1 zCE+Z(1#1CeHYY?P7}bgn?$*(ln$KTWp_)t-`6orUt{M>7IA#=yx)6C9N}PWcsZO6b z-A$@2=Vei9(tqe%W@8&f<1DFmC8e~`A2gvyjkmnmO0PhGDxZKmTm!uvp%MlypA%Te z?FNuX!svS~g?cg8m5YyPy+{~Pm0+cd9K9UHq`30CUIuL~`sEc}9&;{*%IvpH*AYZb zdOdOxw$>km_x6@OguH*dP9eEX6dB(0;R&Kr$CY@fYf~SU-eggT@{zO6!Na2Pns*Lc zTfGW_PS=k8mbw}Z2GFdP#&@A+N7hEGA=NPk2r0Q z{bCbh%N5G_A8n!%>eG|n(~5JV@XiojRO4{&R~2c6(Lc~BZ$Mc%9$J2A9i|^mlE|$6^0~fJuy&!`@Z6DXNdOA z*ka;(-qfNmvXcR}W%3S(y>Al!5z2AM&`ES>8|#RRJ(l2sH81n(2MtfiLdFT=qU+nN zV2NdoL}nqPY}BBOS0dj;C}RvBGpEj6cXY5{=T_@~PuOq0&5lXF!=0|-uO%KDR(idI5v-*l7s>uM7_wn8+8=21WJ;vV>}FVe6wVscfB(j=>dgL(7P(-*IOc=`%UJOTQ%B{u3j;?N9tmBqDal=+D7}O^1VU!-eBw-%jaiH!fRFe z>aU!DHry#h?^PYe}IjWMS)g)oR5wrRzfb28i&y|JfK6m}+i$clxy#pIq?1G6$a#2NQ2-ht$KZuIW zJ8=rV6T7peesRaqE!bWa@{qp!-#QM0X!x1va3y`uUH*-T<(8!DaV%7D_yycSq=oJX%MXQ?GoQs)@@L zVBX!li!S^`+wGW~(+Ll+j*lm9Y3QfT0q5>x;n!^&KR?fBEm^1|d4;K(`#Ocs%R0Yz zV0J-x)&GBGVrKZ?;Z;m*od5M0)$`x+stgi^`2qhie>>pUnY)6@;_QFqYuWoZAtrQ? zv{XfI=z@89@&QsbFCH;{pZ=3*iQh+K#?;9n(!ud%+tXg&`ET9O>29B{?}tZ^d5Z|@ z^YNyy$I_+IitB>e!j4Yw_RnK&@{4-aVwsD25`T=OU)58GuFFqtU#*od&Sak5Xy%hF zXh|Cj!AS%b`H3W>{QnJ>AIt>{tKpy<&>!_sw-&_2cWi@h`^e6#n#zjpF&I z9s22aBUse#uiN|UaT>ZwQn;283`sV9$qTpARh`|c$DTW9lH$9hS#U3EF0*hXOrtfs z_l-sIJ3z1P@ZE#k2_75<`W*CG4^PA`ONjaYGuVJRmi8-~e2Z8toce1nc`?5Yt_FpJ zsQ*K`XhmZuY?(lVehc`A9@%J-V=8%mv0SzT2UjHZBKfU*msH|ILF5+H{RqVKP1H|C zF`O@>l?bc3ER=B(lqSgzh~?wdVEF-%CVI;%s)>YP$%4+lSdn zqCV)nDWErU+>#5%^G+%jh9$$)0@|CpT={b^vn@5W$9BKVIBUl2cL%#5g^*ORzxiLd z;J_6-Q)t3ei_OI=uZ?3WZ+NfO#VDpNTJ~ihBkYG)BI}8~)wk8w6 z+Fy1pbd79V)gEAf_P%*&DZV4N3gJYL>3SohvD4_Jxh#%65S4+0E(Wv%BB!Y7;X6AoQbi{MNlcX+Z3zh9u-+E zUiBbofO$jRlCmi~*+pCBIFtRM5RIX^NR;*eVkyQH73f01;7BU(hj$t12{z0bs&}F+ zOElE5>Iq&^!kHD9x_>g%CJ1X&=^gS{ihjHrF+t%aCRTB&{cL ztHI!miO)r3Z)rLs4EL0m=y=Y+Q<8K|AGhXYQcwGF0s?q60 zxqEbyJcemD2}v>yKmRW!vA{unx4$SZvd|<5_bH%`w<{T)y3svL$?;KdnleL5wBwy`DbiVE<)q>Z@KCxM}CQiMW)aVHP;($~`5CMjJNGb1>E z&-w_6{NIocP@LspiMHy}18mBMxI&r6OB3B9v=kvqdh9&Z5 zv>QTzN8T^<2=0dyoK+mD>r5E!`A=`W{v_8V2*JiQdxLOb2xS--V1^Dhl{zx{P!TeD zqNoSMsO-_lH6qLX43aH7-fly~3dGj|<=;7@i{>YK#(|ot6B-i?^WxG;dZG=|WQ8>3 zWskQtdbVc98{fg#B$x3t&Et9c;$-OxI#8862gY0Kw7AzxbTXKORZaZ0H}UeL<8!&O1GRddhhI#8zDvBo7!aH65pqV&RYKrY&+l5*g6%*Tb~ zYiiU8AKu1e45ON>ha;f`{<-m_38Ok0ABozUS2vwR3nii&GyZ!_%N77F10q?8r*uO? zFfQzuZ(E-)g;`9MLbF&ash!0|gpy&}#kPjDyd0C;$gELv9Z?JivLia*(hxnNmvF1q zd{_e}zMp4IJ%NK7fGD@|r_?+fl6kOA?uV6}Pc0Xun?@E%(IaJHBjnf+lf5d@>kBPZ!-v#%0Jo zjufyU->!jkUtjge>~)QmAdKx_kzS}k%{p3B0zS0G=A7doL;q4V0Mahv;w~@}jp6tFejb-M zl1eZKMM_C*{{*MWyYRhOSLsk_l6}#3t8%>$-ugy!e?NPr;7E!Rp6-p_)yC>F64$0! znQB|&E0NAI9`SW9{L(S@U2-;I?E8;b5}niLWRLjB#FUolCwwUNDA(#J>-V>jk2Q#a zJw$<)nk(Gh>6DBrGvO}|E;-O=Clb>yeL~58`_ZY zD2KeBE;g!_PYFMZ4k;H>+Ck2Z5H)|C-4n;g6kNhZ{)nzrlhc8}z)q%Ry13d4@W<~F zn47O)ImP>^&O(nHp$OPD9bn^RbJ`X~>lz&|re3|7Lsf1-!3}_{#X=yP5003;mWw@;Xq(GM22(3Dk0T}9nR1L|3ic_85Lallhv1mN#}1DS@g`B( z{uz%lgAlrSv^oyQE}+d!n*jQ!;$Qgp{)fvk+E=0dHpvb+<(p*612m?pHd9)D6KdT< zsREdx>Ij?k91fW*p3=q@hXIJa)L#%=x^p}JLQ7DS%`{M^L6nZlU$M>JC-BWUkA_@6Iymw>O z`lnU+ZKPHjGt|d%KmL3$Qjh%oeS?4Y6ya2?gj%~1xzvB=z6q+N4(>io0!qKvfn+~VL9t?tFznIIt9Exb zU&gfN3IA${@pO{W6OT5=wfWF04@kCN16b7|h{z+@U({t^c^8)bDUcqV?QPACdY&$i88aD-9*}Pc0xvD ze4g0$W#dt*G4E>|Ad+Vz{~-BrEkC?L(NQRjxhr0iUDjJ5nk_|}p~f0>WnAId`OFvv z#4p84dz$2S5;~Mw;TUtg_i4ywwFxeUvu(Kt@C}}QF+RKE(=B3rYDLvRW#}&5+@Lc% z!*h?v#y_ItI;JCR9bl@JmXV$^&=e`nIuI2;X$l?Oh^~>9sx|}9()Xx0O zCpWkh-TzuRYK=7%F8y#h=U{#4@1`?Lx~6dXjSTuX)gDNU+l6hC^K-+HsXmG?LlH>7 zf8|EuzI1M|o!paRRE2ffdp|ab_@#V$z;e{$AqGr#89J-6`K>k?0#L8~s0WTop0Q$4 z7Pe{cmZAaLI>M-B@8_n|{UfobC^a21HPs~HX6vudMJm!-v}W}2CK1iHnJ#XbUR}W~ zj5X3U^1MM(;p-0>fa&sf7F~+V+o9%2Xo~HZ6qegC%8mD_EL>u}yl+lx zAJqE_K`=e)nV0&Wyl1}2lKpZIBN6`@nR_JAR;Sy;SJ0~zPVa}&Sa2kh7>FQ*k&mBf zz%}qfV}UFpK`1@k0=XB}+_`M6AQ#@TpS*~2cNDs;RW)IkfSo^}*LC#-5l6Rnosq}+ zNXF@HQ>TmWS88L{OzHB5;l3WgiTox#d#}uA>v5?n?QYqz_@lbz=bZk}3wfCVCFuXO z3;nN@t$(Y~e~XB>X#KwmyC>kHJ5oM>F?yh3utq1Qe;@O5)u^-F_pKj3$^O$|SJ=7Y zgp0A3nJQ7K5vN=hndzH#L~`Kg=xFK4Hq9sVs(%=hci885TkH3p{qwcNB*_Slc=XgE zi|?4xVxOea)NJ{o^Xq{qwDGU~qViw+Mb&@WFY0cnmh3$G=+0Z`{Cp{D4(RtooE-!t zkV)lal7uobelZD4gIL}(HZC69Teq|d)V?|(D_Sr6_=N6=zudwu)25@oo*xyeoWE@{UGAoy`U+LqquxH( zCN#L|^$u@;Wq#9rIrVH(qpW^@U-Q7(f1_5Dla`y7b{womZKes`H|!Rh#=TO0E~$7m z%|xdl7EM}_wq8AE#l68^oYC6}h1GHlrRP~9)T78`ux8|v_1&fEJxZiD60>6>YNy+p z-_|W9@vwGtw#Xn8OcD%=In>E+*`nl~T5@_`P25_vu!i;Xix!0LW4Z$bKIx{4)HB^) zZ|^$A^dDF}%4RUQq`Vuz34r-@>|;z2L07r;v_8Cf{T2lH)6aZk*)%=IdY&8+n7Q)eHp1kN$zJ zemDD9!~;CIc53>t>$wj+P%%|yooh+wjLZVX&Jzw;R~Cl&OVnIYLdXCVCO$waJ!RD( z%#vfUk|N0N&(tm+Fu|V%i~i z6>e_JT}7(Uz6{HvAVse+*+U^EKryiw<)55PL0c_A3^OeabO~y685v_pE59jJ<1HZt zOF6eilHrl22viap>GV{{N_W*=J6ri60{d2k z+%UHVAePNcM}pz*YZZ)W-U|#+*k+9bWBDZMoB%igF)V%%EFk5+7Yg0MiM;PZ(|f*i zAjQs(BGk-KJ}D7fuE+bCDU-{qH8nlUf~A+77P>PR4ttc)gN=}Z(T~mPJIGEMnkA-( z`b`eF{35^uIw##GSt9H-o^^vpa*6Wbfl%Lm!LDmT38g$_za20&*8QW`;W= zG@u=n+6-EezEPEu>UVx4U{NGQeNW#Nv!PjOJM801jvgqwx$U2s|R zZ2)z_KB#<25l8j#CWY^TU9{EY?sMnB7=|f>t3j!D-g3V+3@;^UI;&L;Xs*j9PQW$E z8PBo3n8G%x$Oc5n5PYwC=EGTo@*rSCrFMwrg%e#sGpcmhDPAGA)mXZZ)!#Ri{(R*s z|KYgJMWeT=^Js|93nTw82_2zWk0-!-5_y}3#PB_T<^RKpU(SKG4B!mE`d+w^Md9TD zL3)LelQ168wNtrSNE0~HY>b*7&ww7@Lhq(hV%dB~!3Q%MYj~%a4yr5$mWjh0_zpHb z?9)-UGbA!X(S;^k60jMS6DzH}u^xBD)S1a(V-e|g7Q|9F z5_pVIiCP_I1PEDN>jB7~ty*cLb_zYT&UuMct;+e(cso`UOg5#Ydf-NxT80d@ElS(b zZ@okc@ji6J-uxP?jsIr~coy5(MML>{CcJ2Z^4K;`XI0=rSNh}lBrrTa3?o{)Auahz zzi@OuKW%XJB^ZPO6g+`JZma(Dx|D%lOz=^=Tr<>km&gvOKJ&WJGAet3Jwaswx&zmy zh13l<*8k+Fbpg+vCb3eA<{+lPXo*gVXL_d{j}}UD`;P+$r%?(P%9$I)A`Lmw%Zs@f zPQ7BPb>zNY*s@2cS#yRk?VUU`ivzi*>q;bF^_s*@4(FIyGJ%3SFYg19u0zU?f9K%RhL>l z{}mR#Gn1T164R-K%k>rJJ5;0La0S?)^h;68$m7{9k^J?<^7Vz*b3+m?%GNUSxc8CF znDw#{&anr!S=sE-`$vX|rTI$R;(ij1OLq5pXvta~_a03~*$sJDpv?7hbX@y*ef_fgYB`}>AuoP~q`90a!ki^`1%1l9oTq8+@b=VD4fm8=G`Wk- zI61gZ$1Jn6%rt?Al^pbWN!>6XTYr7Imnm$O29tDqUgfUyaIAcL4&KZ^vrH5)+D=5C z{kVknka`J<$>y%V7q%s&0%N!p>})!eJzdOw=G_q4&!EHZ_%4}&ci|YATFmjK1wA&t zmlF+}O}j1gTq>nR|CWN<=CUKXq8W#)%0*H)wYZa35!^n@Q7zoSnvT`8*XyV>;q$0* z`<1r;Bs($|RGKKpd#2Zxf5gQ@c!w>x>J=ESJNdW3PV@cVU(9oP7fOw1I?? z2vS#I*FtZz{TrMzzqUV(#PRR`_{WJj@`@?8*=zCjl8?y(_+%_WXf|S~VnY-J zw|)4_RW49h6R!8G^XSta25*H$U-#*vZ zXu+O!`;)$EYT3*_&~tQNu6xX0hbEG?D@4$~qYjM#_hd8SXx24>+>$Zk?YO#$r=wEi zWdq6)Kf%?%LQ~x-gHy!ASZIrU8(Pd4RshQT*dqkI+|OL_(Z(h?Zm5cVi-jfI5|2-4 z1nUbZecipmo`vq9TM|GvvSX<#8u{3Cam2-^j0lT z4Xrh*(4bvLoLt->+?c zI@y|uI@XE*hFRW#si)vjn-lG&B6%Ij-Q4qEx3}&~p(DFp*Al5bKOHjcwD$-8RLgXg zkDt#G5B`~`k=x&%ug8bYd(3lhvDp$~)IZ7TSw=eM=oCH2bR}tSs>h|qG@m0$cWa<+ zF^$rH3a?~dqfYTHZl(KfeXifrx06x)Ihq7W6=%io44w7Zn&Rc=Q6|9W;jhosjrXio zc?FB^mJUymF~~-lmqZ&-AoAa7%?1IV_EHi>3H{4VIF+^X5{(k@Yn}n9sLwh1OFe## zD38i0G6QEk2kQCBA&L8#$qO8lW7YT<;i@wSD4;!iSdN;iL3edQbK)rQ1~Fa*AH?Rk@^pDeI&<>O)liy3o>&M0IHvd`@}nIBsi*t zzusV9n;gPEkW;d5w_8N>pGdX0R)UF&NF}pZAtDtiuv`be-}fgeOD&fL4@R1$A_P~#m+{pp zhlIhN>m<$w!m9In0s~a;K^8@&R~h&W>CtRsLX*j*3&+RHj|7^DZ#8V9XjuXzkjhfg znh}{oF2IM>+eQ`hoSTobfV-FRGXZTmlK?q`9gtrCnZW!gq#CIALzW59#F;V7e`hP1 zg%4W1j+&Om)pS@CpFNIscU|bh6;_66nTL{_^?NwUYP@coK=YaEfzLpx(jWoEq8?)Z zGRYSIVwxh?ooJ1MWYTo6Qerg5Az}|8Y#A?y$F35{5$DMU$9k}FZw||~6lx~PGe?F1uxWqq)1mRZQQ|CMTh1u8kwz#T6nfVENrhI1t>c_@v!Aw~V@Cu(7Ef;T$~ zhMNj1+MfvG(ak2-s>(d%JfNN}<5q~!^lHs+kob{G|?-XE% z;X?0;zJqg_X945y=xY+6#bh#C?5oadBe$UM}d$ zF4L_U7e+C-rEYQd!i=Qou18$Wt1O zC(4Kauv8Sxu0ug!I9mpC`I^JI_4u|36&gT06(+#ZbYu0y-~&eMiqF-ox}HV*fa{n# z0M*PTy))gg_#tDsh_y68geV+ZrAQbA8L8tsV^H$e#1>xMDFTX^vz`NQn`r--$7GV1 z#KiD8D$IVseXkOPhUfbLs<+gSsL|OzXAztM2RaUbzYE&Nw}!J z-7|>Jq#uwU`4 zEB#I08d2taY~jF7tELPTp>z~`JyybiMH)><_4{Jf-^E0UYCNjH*MTKAntu<|@I5oY z&9+&35+FkK$GdifJ1n!zQHq_j`7tpCV&~&JOAnR4qV-6K#W#YgZ~WKWXIpthw@~FS zR^Rrog2JuK6g=;>%@yqTLl*8EOhV^V&qjOnuxdVH9j~cIDEA6q7Nuan@P6tQS*q*Z zjH*q#O@MTC*a@2#a(c$;>K}#6INDB4R5;w^z_h&hEl*_3mjX3+1f#=c&grELR2yy; zT%7#PaM(}hFj!4wkuWW;GBZ4@j(ZvR2A^BI#uB~O_wn4|+(8|`jHeabbQkcm@)#Cg zackW%tPEGd8Zm~Q=P@C&oPv*GS&dIp+?oFmW9JYZX~3=P*tTukHafO#cid6OsMxk` z+qP}nNe4Ioy?1cVT4!)ZHK|#x_0`_re&6R&f5g)LoHowIMnfjb_hp|K#?a7nw!MJf zb1{i&ApZPJPaJ`VD33wR$#B6s1L4djIm2Ryn^t{wI->w?Z?skg>55DQU{N2GhEO{+ zGYR1youdE&H|??NBc8LWKO8MiP6MQo@NruMPp^X-=!=cAG9tNwtrq(_aDF+y#Z_R1 zm$?oQ)zeU%p-&fc%ED@tV45jS&A?314a6F!ofxr7^kYfUZdTVwh%<&*HNu|FcKGmhM4gVYn%cM5B73FEM;o zyvD_Gy;VI$1&Z>CcpkQj%wszO>gh$a0p;nc;^Mp|y}2RnssiNGSWNO*=pGo}%}q=# z?1ww({$!%~a#1|=K8)8Z#ABZQ^8?05j}o?M8L`LTWDq!R&~fY*ZC{{It;-Wz?hgv{ z7GoFDg^k#EoRsh&DZi!?{!`WMnj2Xy+_XLslt}Z7ZM&LADZ(Tee@g?=kB_!qkyHhoZCw zLyr0=qa3x{$4-N?Izd8C*{@9s3J9f-bp~)4<`vv2A2c5nxisB0L{nTPy^|T_cPN zT1yt){nIi49%-WLohh=|7E}Z*y=(z#g*ak)c}Awxsb?~4r^(#jtuiM0yrFl>^^5AX zD}b2SWqRDr`FxyhyfMq$l6wC2{MxaC-v(E#Oo4H68mcEO-PrccTSYVr&xSDimEbU| zZYL?}KxD%0Lkr^p-w+a|Yz9H)=U>PN3;R)p2xkKsDYEo8os^eP7jy&@+ML5Fm1 zEo(3$Qea6hDV`)B9=`oD#uW(dGkZuyYz_pWuvXl9i|f22Y$(_BTzhC2qj?czw+|M` zj#t5FlwM<$iWEyXnSInnjyvXcwu9{rQ>s$TF~!+} zpU*DyoG>2YxnHg5f4&VTdfRSWz`lyyGXmmzx3g(Z?r;%o{-C3u(4bTso&##oe1lA| zJ10?oCGZ+p8Rrx11ghadY``9t@RYURMH1=2NXd#+vyq7MHJY3pUr~sHTGji0mmW`l z0)Xb)yhZc=NIhj+9rsgXAY9O0`;MFl+ zaSlBvrlB|7Su#NbOmivXb_s(qEL(vuoh?N@87E_q?r%`)3V?!j!Ii_8Hp&(s{tr?t zc53<^q!ZZ@#_)v`2fsH#O0>Db|7k_~-x033x!M2gid6Me!l!Nd58>(&)cRqK3|JTd z)a-xx6LuIC!71ws$9(?j;K!?pV-Qx2Z1xRpCbzGd)@_$W@O*g2LLz^U1*$-{gbala z{1C2&Ywm7d_TFD&1{8W$1JPuWgb4(i2b6w9*Y2^_aTPq?n_oUCBGnf3`)U~tG8#qu z7C*20=@#7IJez-B^%KU(RJ_W05bON_t^g4}1w#QM7 z9KfyaS(}zlob210{u6qlC|sZZetRA1qau9ECxtZh+DA|w<|MOag^#M)b|Uv|8|hJK z)i=vNJc-e(o`0Gd$Pa7@{YI~D7azRw!<%epSho52+8O9U=((C{mb&=y4!&I+9ve`} zdB*;6TIXe$YK`sqDD0bL5={;ua5{ImVc0M%F z>%r?Q*=O(ZJ)Awje^%qc2nz`YB|AQ`rlq~RK8Yu}P+EyW63!!+^kn`Zb))T4=8KWG zPRT-|KQ@$VNt&s#%qW9353hYDLHojbvoSl@G4z%cIr`U)Uu~t}adfUSC=StDt~16f zr3GFr`9=&}jsik=M#GPT@&ijT{sIOrnf8u47ygLy9E4+0>o?VmM*Tn^1}GBMja2Cc zCrbYPV2Kk=%4qxeFF&?I%rk{?ky8sX`r77j+1Q_k>{-$z9?wTMbjAsPU`>9Fp zdTImexsZI|*{l?3x@%RPu??xO&R96mj9f5YYTqd#rr45U1yk}aJ2FmkOhyr#`mSgK z*LlYJ5j?DWbc(k#Om`>%JB=4QuAsGap2U_q-U1g~Q)P1qX|Q#TM&Ld9F!>3PyFX|b z)!%Bo!h9J6^zFUQ5=YI#p8Y5NF46Az9oS5yi6)dQK>#iqj>Nbu3`k2o7gZ5=oJ#(X zrE$?%uA*ZL3EldYvq{v7>UG+PIG!{JY`3%7@560=o$V>D&9}M zplznX(*M!!RbQ>nWR_qJH6g5k`TU}uc*iobaMh=T_g&nouS1tZR3JqTZe%K`7Cw3M zDv1v$11PEvhvHJ7-AhPNoDL)>p-N$6I?k>N)+i*Z;yN^Hf7O!K(a#Y&DzS*47uX3E zqZ7kARJFByWv(&;j`RF+HSpfw-3l`cj z7Ln0X*q_18N_+MOP+C)R8 zKQ{I+usm}K4=_BA;kgzlPBmRyr}0g!KWOkn4yV9m#^~99Kg<#GV*Be^*!JlqTgI}x zwC6`^uCNoT8(m7NO%OPTSBE4Xm&-~>0G_Pn9oP7S-r5<<`fZ~4U0u|88DfFf$Q3R@ z`I;D2PwP@9Ql>2Q(kSFd0i4~bqqU_>wy4D+@L~P`P)a$bv-XFWjFOm;3Y76o<9G-z zo;AsEFqFy)`y+In*IeZ*{}|)Z!}bR3Q)!3m7=&+UYR;|lP1nYtIeikQ!2en#y9#K- z>w2!nJK3`Y4R6CdnM4|B)COl{;+3TPoqSP-U6&%YIq}%&-%@v^JLrF=yhe|t#6q_M zGK}*qius&37?L~AgczR4#I$67$=<5*#co#r2?9jEr7133PR~%53o5d89x*ro2QCy- z-K0CujSjJNh+5cu&ajq7)TqkfMLU>$nq>j$gPx_nv&KK8q!35ityec3D>YtxtZihM zQgi=UIBAVFiC`%BQ(OHl9O|Gu#X9^t*jQ8^x2GLCME!*RD{{MVZzp9_-v2kx>yUWD z#jhFHrmW$*N3UrG0@^fy4#&-rQ_;M#yKUwhhUA1bk=eW=2_$sSa8i6?IFVkqZ+eulkMB!VQ$H|E+9RQkpP%L3-a;bXa#K3Uky#p5%++VO97tTqR`A zC=7jsgJ>xmBw&vkjUOTp$5hFDXKNxXRBcsdS64a`jwML@gD;NYESZ(l#p0=7LA%vI zGMFc}5W{4(@(lCXim6WFs$xbNk$2_6PLLn z$Y@u=Qi24p*L=Nl{89NXL2|Y`nAsu362B|{=L_?<*w8t-F1FiZ0eDfBNfv-$3ny!u z0A4xVds)z)8Kmnpx3RF~3VY<~Ae1nqSV_2*clS+2pXDof~1hvhU%!x!UMyY3UJ0wn$ zE;7S{*S_!-Y$s}b6Si^YsJ;;FlN^%5s8tNaJCRui=Ct8DoQDo+IeBOwD$fVV-DQjpwTLpZ4jXPgpLJ-9lwiWM6L7`F6 z?{vw?p&IGwjuYAvlAc;0fjlL@1P)Oq>Mlj8KU#Ul%2@xZo5*1&yp5+0HUDtJ@tF%a zz*%^V(>-gG@&a4!-^#hXy15>mLVy#8Jb+FJ@;6i}1PpsT_ogrKp${D(3i!6wr_N>S zjcHK~w?dSH8XWrO!!r8FP_Qc4j9Wr>myADQ-A6H*1!xy~F3+lx@QK<{3|4x4DwDF# zY`cTh+jOJ34hkEHIlsjU+Xcq(Kg7$0&vK5mXLHBjJzkyevivTTe5=RL2;yVq4+43)hP9QTy z*vV^PTB5zO!x~cv;kzCpj>9Fb-|Tc_S=EFaB}IuG7+@T#*zZUH0as^=?XOanl9u6? zWeU@}Hs$cL<0s3v(_Lg0JlG2Zf+RFcG3lC*J6*?5NRV?T%H&QFeJHbguZmL+j@ZO) zG*4R5857XAh9J?>Q)#7qu98@}d{rDoj383pl&NXHP+X)hsj7$6z5)=8y6vH3daY5e zbrDgd<-oDoVUA=xBALg7uhiM%5@HlT{7MIw&op*9+~}gc;IsKPea;$S&115Kf~gOU zc>7@b7|Uq_lac0jll7UQW=Vvdy#ku1lJ8AOs)6PFEe+qi7+ER|z7jQ2&@jj^Q3rOV zrx=IeZ#7-Kxqz!H!t8R~jzEZqKq>W#$2*Vx59C)8t;H3$q1?!R$)dAM zau{O27$Tgfk=|FE%x}JC`ER2S2A*ek1`V7}8@?Y5TO=E=DosO*EM6mWDwI zL7XZty#0=J7t|LDyNl%T%VX zC%Mg8um!6fXbFAEtn3FS({}c;q$=$7f?k4p!)MBBkP;h{z=5&gxxJSDv7GB`?$QA4 zE{3P|wH)=48gJ6UTcL)p)PicAPYz^oNAYPPswa+zha7|WZKiO%in1rM z|H8rVpP)tAUd;b6`7^WpuUvY}+^qj~^8Y!GL|^>h${dRP} z-%Z|+G)k=xc9@h4PuH|Q`H$+qbU!(?m$ud{B*>5nriQ^Llkbz!fH7K*xopsmUm2ce%n#H zj%=t&HR*qU9uOud35<(NLigSef|_INNNJk?VdwDKmAZcp`|jC&r*@|F`&UP+*8ask z#pA*I*&^kdCf@mN!ZJOzY}5HY^Eh+X^0VW}TO;%xTm}xf3dVaIfsgy^x{kWXG@@!1 zJ3h67k^m_Gx+t6265U8+DIsx8&?2cZ-!dTnYk|j zlGEMNB=okpw&^NKI~tQrYOh%gR&JPwedF)3m?B%TEF)?$He-@r!p28!jq~(k``Rx9 zG{^)I5a8H#5K9hS%ZtNZ)_C;qk1tDFlup8(8y35A&eQ9HFcH0o?E;tXRkerUo6#&r-UecXDW(wgfFB@vE(c4 zIMb0@Slid43ihLu6jir;J!WA@bLq%NNp>U>-nfz>fZCykKhMD0w~nE~uwloM{s2t02b4mo4^HWt z7sF9ux>2?V&y)Ho;_00?_-^FCzNizxP#I=GKkhGBg4b}8hRpjbvxtLgt`T;u zLev@>%1wcFweX9`t^bB7wcM=rrZ&aYvX>#Sy6&`E-HVpCh6v~NQpP=7`M3~|M@2G} z`D5VYIiuT39Sfo0rOdoY&dg^(5d>ufClE2V`SLqpp>uPsG@&W$%FQ$7Rnr`J*5l(d z*STc@+t}qrjdSnQmpwhjFHOU_`9eE4Hn%_gZhUZ4XTG6%%aQ0&kx8UPqP@bv(z0z;Lb_ba#Tr}0@fjVXIta-fcdVx)Zicaeyd^+bJNatc* z2N;}(g@ygaq{!S4cd*U`gEBf+X;*JjjDp(}leT>TBrw2+C#ka5)>@<>llLGuNdw$H zPdiK99#bAj8~8>;evxFXIEM zOj>~lv{`cZzF$9L%`X8x$e%lUo~I|79UIO*kQf~nNg~{^XtTl{p<{LM8~2~x{<LWbi7KgSo4Vhv%%(}}@Bk&Hh9vx1kSp)~*opa*Y1jZ{J_IYN2qxp+j!6agZB!^x&%9=J_udEyexF~}EL z#`pe^F#wR7=`y4rA?rw%i*~V?s$7i3ZC|LRCn6Lf;yp8?Ga;@_`oFEL#MA=kuVmo> z0}e33vohMegvnq+%5xZ1qed82W);F44|9_FcNg*?>ut5ne%N2avP9NOLn~xWOU;7)?($d=2 z?f}q2^@g}-Fk01_5HCs2^W|xYvyxj89Id@zJA5&HB$2xDnSK_;c{h(dezl8IDFt3b zK`gH}j`K*^!4#ap4ooA&`;2)zv)Dc0m-1@xVHedC*%bWPsXAG0UfwD{_68kFu z`unP||FWMx^Veb^SAypw z(8}LHx#|)JmgyX3BC8~o^ewIuCLIM0ps_#Po)sqdVcJ`g0e~WEi`7qsUhJBgXVx)f zX)Ld!?}U9|Qj{rMl(|fIUoxJFMX|MR_kli_^93s&!LYSfF?`LNdS>w;NVJ&7yGwOyGx zHLT&`U$ID8WZr)#bz#4o+@%XP_fP#{c6dD~Cih$njOaJLO*Tout@hGwK(|;a*!U3R zb7S*OEokF@zFSO+z*6_%0Ecn4L&0=d*A2qZ^8P2om?b+W{R3bsE(Vje;;cmlSNZsj zJhV-WC7+chwkrvE3U=l~baSF)KvRi;KJTn6#55iT7T1%(k^m1n7JC|)$$57jlBciV zapYkdXfK1L0wBwD7C)vHwR~JI#HYZmBgpDkhJ`%fv@z3oLU%egHk9%KOpfF5!IBfM z*K5ljs-cgR=#{C;Mb&KbRAZlv0H}m{)n*eTB2J!rGPMgOgEp~*_}A7X*WvNTZz4&Q zkO8?Y9CkT^)o+zgl|CtwZ9o`6rbGgjqmo3mmiAqj8~%-B*G=)dN0Xcc2;6j{V@m`c zCpZ#~0V7!pIe~AiUr|XK%-3+30|@lV*+1fIo^`)t1>NHSH?5B>@xSCQM_e*v7LYnJ zzu)?@PK17_6~ai_QR=ZV@fNIyC_&S2Yvp}#sWjs44~FKlSvPkoQ5}p99NF?t!DTuu z0&g^cJs0(FrGOIRi!+neMHzs;hy;*8o0|a4Ait z7Rqvde<&wVblw;e2IgD$CaIHSX=lYvH$6|~7%wM?p<{*rdJ{7OU+?dd8lcf2lvVGRnjaFb2pZECgH3YdA_UzR*m;dG;*2Z|*P5A1)LH^pn)jGN44>|5MjS`Tuq8s92Umi|o7yxQy=q zs5$JBW87kkKZ={5y|i`g`IQhq+J8z48$Es>2ga&W-gDtUD!V$6B&(1hljA(A^9bIt zf9YR-eGe+h;$P1Pu@#RW5A~;5mq$HG6~4%4|4+>kIDGTn_McdnGxiuD5x^{+{!1df zm3&yJq_%hA)-%E1dM8GrZFcPpE;NPx}_t$;XumU{)9Tw zZNneN%{PkfVzzM=H%(=+C>@wy@B<+)sMIa;z`ep!C*Y_lQCu77z3vjJg?~?I)5nH+ zL-c+hKWen(#`*FESh2qW5fa5iw2H4uEf@4LM9hQ-3w?O7Gh7FWo@m(9aCA$ueKkE>!~k!`sAyka~#1eF5Z9zA|gY=h8) z{-L(NL1DK~GA>HdZP@U3n2Gq!md{a7gwsp}VKk|DFsI0gu5`A$SR8I1bwnRu@RA|~c!H9@#YNzD(CZpwo!3x2#y20hg!d#c12HrVQroU- zm~Cxkq^Eo_qUzAqdM#AEg87HWU8I8fy;r$kri7ZChz)@i_Yg<5Ri~Mo+avDL%ARr- zRg}hxGLFxW0@C0rVlaSEIyLQR9j;k2BC>Ga1x+1y4aE2Yun&=OUv+8!;6zx)^-uS_QUB6vQWU1I~u{)H}ojU*}QKzk6-Cj1}$;Ra*EJP-1eeGBA*m*oe z?2>RdI))cj;Sk)_OL7J5X26sU>Y7nrdfo$hM{XdSU;?~KBsPlnPV~V=i6-w{AuUnC z5xftcpb)ClxyKH)6GNH!Ab-3Pns_Az>MdP{x$>btx7!#9>YRA-cHPg^!5ONfT?fyl zPrcKib2ENP^(~2j(0~Yl+LH-B+|~PDKnJai<=XzvsUh~J<)nhcbVM-K3+746qn_K} z6e@3rQj1m!=+p?E^GbFf6sH)x$Cy(Coot}m3Qw^5GbdFLFRabIAl1jVp=xKf?r9MR z30#u)Qv@!1Id_19K$CM~^3c&jhMr$jrs!MEe$8AeTB^2;;hp)os1FsYrAYLo9Jv5e z(=igl1a=>lwgPCnMY&$%+(9NsIe&}kxFy4g#TJMj%OIKN5V09{se|aRGQwF$Y9x*Q zjlCT$tro*Od)1G2llK{zXsz-h=|87JPb6RcU5}2CW(cwYc_asXK>d3u+3T*nMTID= z_PfZUU$I;XdV+e8Qwp`KZ9Fep2UfH7of{Dj`Z`dU9wvs?3o}()w2SEEP=Xer)~%~dy)6+B@9F;nS5UNS-Gf>Hu6Zi*!1jTY9#m*oyu8- z5Zfz;#i4~2IQQb@u(uYt-c;#))Wp>&?mQ}AuD6S8y1?lAE7_>|`C$p2a5GRB$q*F6 zu6hz-Y3a{V$$U}ecC8d{;Sv!;NOA%r%doT>A%G%$Nnew#Knb3&v^TB|f~)>9E@zzeF`58cF+ zqN!d7!V$;^J@T4eTP|O%9|%%`pOv$Td5Xs<{)hC3f=!D=lwnV_Urd5-oexJl1)!Kh}# zZ+B(et!LwScT=833p%8O>A)L^7DPj&q}V#P4y3r(gIbXAL_d!4gO02gK|qi^=l?e3X(%omXSG}$rO(~W;&7Nc*~ST*8N zknH1Pub66zA_2##1(!G#0c9R1+%*KaMgXgwc-!ZHOoYR!SmM>ivSs)!7PQoW{hn^X z#0s><@Zr=YRrFqM7;zd&Ip)uhULkJf1R*Tujp_Sd*{6kISc!Ue3j-6VZ3GSPW0 zXNe9iRAT;sW{5@4k~y4bkAI0t8I+)97mMP415xV7BGX6cLjv_i`W%>!>FK`)sV$Or+Cfgfkhb!?FEB z>!z@%$y8cMk&G>;x#`Wx(e(oS5fOlguR*0>52zL$j;A8_ZhUP}HS%~fw+DGa?I=D8 zYtN6lo|5=G30hcLKD0W*eWvYlY}a~ianso}H@mA1NOY1l`cF9;GBxXCLnFvJVWT_? z>ObgehE8et{6D(8>b(t3f22b1G6r@uS3?uuxUhHJxd?ir>_exIL{n?*qAl655cJ#P zd>&)~+9Ol6_)Rt`>wznUi3wp`N+PKTc?$`w{Kv1oHZ|A$z=N;m|G8hqVlQQYS zg#2vdN`(_p9|~k4RnU-zUdoLW<%#aFyZl-L#2mBhj1>^|^qG)oN>S0X z_}5zftoZXTn>%jaym^7g>(x%mnhspzce8NxQT_1k2T$$e24Q3A^2*SY_D={I%h7k) zxi0?YD&r0hozqaKYMr_X(NPQ05V3tb$N{>Z<8=bvvKIsUlo7Cnwb1lShL!Fv{1bTg zifXr-^^@zFy8pJ(&0loiNyUFZ2b%7roPhn?So}mz=ikd03xYbg&(p_ZW*N_QW~pLs zSsAw6s9_J|_AC34lglN>fVJIq?O0UFj2_JtzOTk}xx7JDC1?V7lL7?D@$cqcSoa|ppO4E=317rEL;ft=j{gU z`EEb#9`D5*%hSs2lDCW>YH?7kfe#1fs%mc9m zQHM+$&L^)qG_evMY`UMz0GRQQTsT}yiZ7jQm4`3i)J)jy64H2`RWByzaAm}~F4w|qBijV#97W2DA=wk*s6 z9m5x-`jeII^?zecE&c?1$qPit^w4FV*!eYo>H_#>^+Jg{Ov_~P^)3;zh@EFdITa^rlr4u%x&gvB zz)B|gDI4EfyGyinP-EXLwcUTdM*JT?t{A^Tje8Pw{--VKf0h4YWoG_w+^eb|?iE`L zeD?|UJ9u%W4={ue6cX;})YxVK-k;(M?{LIv@)|;EGIE)s^XlghCf}7slJNcaI8}qM z)=_}e_ZUC}^Jf1)*sGVv-IT|hmaV56!jv4}W=!g2s{BrG+Z4_p!{LW`xj2vOTkH3Q z9@JU2c3}mFMpBJTQIB~0d&T6-{e|_zf#R39igpn%a?s;hU@D{xUMl1eAJZqR$arjx zXV5gMZF|Swf|ni%K^2jlXG!z3z!ZH;b}8?+y-4}h`%O%bK_pB#BaahMGo^YiOH^#_ z)Q1&L`@YP5bFrU+<7c8-e2)*_@1$x!T@3udu8*4EON=C2-@eS#^cu_B_l!kWON796QFP*o^U!&S3DZ&l+kJ-bR3rFxujHo=B-K9O( zAz|bi;3GH_$MfGU%yoxFWTg4hG0EG{iy>XtOX%^{(z#9cC;DM4Pr}4%y`oxdirUrN z`K7QM#Fo?uUktRCEENlz_1I%xy&5G7)YcN}O4gyvag@3SwDhKG??7yK<@k6i*VcA6gI3*2WB-(DR7zho z9$y8HT2z@WDb(mvm+Cdyq_RDnSe1KL+Gz+kgX&#A-}g0xedDNzHL|7^+1qU0@OIvh zQdZq2u8qy8b*ziNqSMEj%=L-70RQ1*i{K#6tAv=juItead=0jQsY1pkR?6r6b^Y>( zY3;k&;&R3=g=7x%xo38cZ>fQgZ&)e8B2 zLuT(QNLh#r=sDh45y~QhIp_|>(JXr-H7MJoH_EMUZWibH9DmGWD2t3ef%!&->vl*C zs@=!a;^k2P%t12n=;|CEnhyFx!e4Z6#}m~^<`s`x$_$f|P02pu`O>x*XAUoW_74ec z1+yNCuTHbWgosViUIXYj0A;rJ3j+Y*9? z+t7X!5OKzSW!wXad3pD*QA@JzWx%~q__NrV*IBf1j`3i(9H`iXc8&@tq2>9?`%5G8 zlh3$GX>%u1)j9=}E<>0lD)KJ|9r0jZzP5{hfLS!y7a@NY&YYEf<_zl9MiF|osYv1&6wBSf7Kv2`-n2~Fva{I$hPY6%eP)n{>| z_A-jYKs-R)E9Xs_kcV-PT?XEt4C zPRfj`ZmqP=N~Vt8sGNS`3A1A??=9Gn1jA~Xual$SL7h>4QEFu~-H>GXMwXAwqO1iA zPwOswDrR_Q4`U$8BB!ay=guZ2Kb1+?`J!ieZrg(Nvz*y?VtLOc=2dFv&IKcpoJ4ZL zUO?GKs>Mb;Q`w)k2J$|gS=r?RODX|J&4yvzTkFz@1u;-8Te3o8u!F<;Y(;d_7zZ(O zso_@RYf8ri{QmLvs2^Bcwii&;-l7YrB^@no+)mrLB(ytfm<|p}!KYqBY7%ucncruv z2DfWh&gJJ+Fhv@brb8fN9Vrq3l|9?~-<_<2z(x?N&<};P`H>Lfut%S|WnVahR|zSX zFL%31EOtY@rY^T>e_epX8B|x1mDQ?#O9NO=0u{b?IYh(%#@{?d1U4%*@N3 z+RG755`;5oi&nT6^|!r{lLGny)ohHrABwb! zyprn2YelEKZ8@pG$peedxE|X&V%djVwibf|p16EyTY$>!(~*?!!Co80nG`L!o8g_R zyOvtu-H~Q%gJ?GMbNncKaT;i?g`sXc)v+S&{tpa=CXYHF##))zQ6%aE)-M3d_IxryF-za#<_x6HC~q9u>Xm0+ZnqAo}^o8 zi2npcfgxm=X&U_-SBAG;u#y>|#Tp5pKw_^*D)VXbQRHfd8Q6S{oF1-K#D92X#YOg?BC*z8)w){} z*wTYFP>w+KiMjWOewI6z+TlQ20$%NDZv2u%`xrJ3R-FcqCVN;x{l+Gi%MC0VqeVB2 zmSL>K>8iDR(Lk96es~^tKhe`&U9z3Bznz--$SeK}{h5{KKpbK`gG^<~ylEYr`Fgq& z=njuNGlsfmz##>VBh>8>$-^1)^S9pzi|6Z3GR*1F#V&8EU4WiQsRcn-Z9B*D&c3P^?Ks!s7TGFdClj3iQt+Wh24Rdo@P=aWygQB8Mt5-dFpJobHpN?4;xT6{KA zN0v4@1}%MCTMaG2ng|Rp7g(Qsb2sIMRhJ7|-+E&y3+hfe+%f8yOxwr+3&fJ{XM-bK zxYvgiVK2u6m9d+;a1g(4!&8{!wQbBaC)KFD3Cjc4EssC{cylSCFe>*~>pc0-GrDww zc%#M$+`Z;qq@i<#QvqOh?XyG4-&fRK&;wfN=Kjp_Pb!>z*kVpRNhQ1lhuvh+kG04q zCsApc55?Su8b+Y6ts|9yz>O;jQ&7ZYD{uIBkKP}8O|39E8?_{A!bP`}D@V*NXv;O2 z4!Ll{vL8|OR2Mp-+6GHf(q9sUe_WmW$B034W&fH9jzjSsw4A!sGjc7OFFcW{CYzH5 z#wA&@ZU&HQw%l0xjgI&zO(I~|UJz84IU(6k{BfNR>2!E2ugL15=ssz0^&t}Hn%zRM z30IGLOCtVQSpQXtadQcpTuDw*>)!I`lqd(K40Y(%LeI!jlRR|bSCxwHRawpPBh={; zGEp+jE}ND%orYNP-6m#>cXv`u7k`TidWhFR_gwP6iV%bwNo+_QT!fsOxEEJamYUMB z?Zj__MU>G<<66^LL{9dJrbgdjBUQ(gavKLs8gYN( z;N2_QL_w9*=h=HAT2eiUeq2lr`7LUKV(#I%E_9bnx4l#l>iv(hBER9|b4o%EDv6yJ zJ{wNO$w^sGKE$XX6yeCaVJr zgCnambz^*lbG(Z#*M`r_q7EBKZ6Plt`7)U4WU;aE5j2_sw13M5Yu1@Jnd6@IX$0ff zyo63k)!YmiI4d`?AgoE8T%Chvx2Y9!yTo#DCU&nbvY2+ntT(L^j5Aue@&kD}R=H18)_taJeYgA)ZM}QHF!(}rS`|0?AGQvb|5f&k zg_GmI2}+i9q+@=vXWb_nr-+&ZKEQBX9ssRv?iOIWUvZl_9OzqP(2N|jhqC64>cLl0}P*kkd=cJCYkLAzz8va zYhq!(wK9EB4YvViT1AG@dA!>PPC;XCy(k@%x>0RD1umynl1m}Ib+Iuou679hauOZ= z8Ce{O3}Wch#%lvkY=+B>&Oj*d{-OAG-#;Xj$bCK6O)TAin4}lE|9NNpy);ed{pF)P zJh?9Y`jK;%vrxl0N`b`gbp!Jh9y%q?s?bH7BY&HC7rey~FUfr?nW%bP1#E=g*Y=3+ z&`9i~fdH2;KMB{+9|r!GcttiYV5^sWa&^ze0K>Wr&f%Ac9+Wy#mA(IW-jP&Id^$>w zgprp)t6z)IA2s__H9hH7{Ac*I5twDyrLp*j3wd88aXdWWpV;`Aow62Hd`~;cDLtkc z+m;smOmyL)n7r%O1X(m>gj7gEhxiMY@)nYXe48D6D&R!F6;ngTbsbgmfqqXLuX@O* zy^)Hg3X-L$E$mpI=ZuUYRDd84Ys?yqBE6%LHO@#t_OiR2P}c(zUX zOEVrOVl14htbdqpQgEeMQ+!Hr(99HA|KVX<{JWWz$D^svC(!(LcwW1vLEBwdy&RR+ zYn^=}H@qthsaj!-bSuRGz4tZ*{fI_eaN1Z6R8fLK+foq-*Nx6^Sjlos$OyFTmxB0T zng7l#c;B>W_X;fFQOyUKNWww`rK7&p8ZgMLBMX+8h$#ATXHq4I_$b(?@QCxMa9!hw z=l%kJX8uc~RXckbd4xRaUBXlwL8>O5x*PqdU{n_OXSPnh3j-M2Hxs8eN2Cs#D;bbd z&cjCzZ73d{gIL4(@NHVFkH1ko-U0n8JUqghXk`19G4mS9fi`Ahu%=j`P5w@g1hzlg z5Wq#p6FKPY)6j02Oe(M$&zy-*=1QGS(B*w+CH)=Jf&=MN-Cw1uL>Ko4<_LD>Yl;$| zVUcgU*qslW+$k3QI&UiE{`ZI6iTfR-Nu(0+2lx0w#i_I1k86*PUMnqZAwWt)6$9F` z02-VntHLli#3Rcx^&GZ`7>gWVvaRJXO-buj2Cbx(fZb*J={GJxNR%r%>A#T?j_Sw1 z=>1ON%BGyIRb=_dDJId}+5W=o#~CD6Yqr!vbbBy^9MPq3>p^`K6xjA1KMrjlW29Vs zA%{G1KUqU*7xFHq%5e7q%`EhWU>SQ`Y!M!z87Nj~jN}B$zb%==e~i=qsypJTv)xhM z?D0CvefVY9n$5Mld`uolDQX@Y(weWTBbD#vefwWr#xv-keFm6!t)&BF^mji%aar#fc`fJOWrr-NjIHt<{GZ++mN&{fH|T~ zELI;^B~f$8a{2+@7_gq@KSOW;D*Wp!#pZL}6W_GV&k?5g9W-E>@xXM9AffBxV~O#C zN2-JmM&!!kq{CO}?NYk|_@ii2I_*FgoPR#45`hU;(SIW{5rIz~mCIdo2K6@d<@kNf zdw;O1C%#rT<&zg-;hNjS(U-E3oq7y3e{bD_)@XsghF9m)tO|A!{v{R+}q? zSkYa3@wIn(x7HgMxADQbsx__QZhz!F-#{)J)$}K zD-=jf(h2laRu>DVSY551<7yK2c5?3REnX&0{@Q(!Ol0+0*2yW6t0U4<+GcuxFb%9gb$EtV4^Q?OE7_#-{&SX zYAgueJ!eYhz=*4=?KOL8sbprJ(WI^3IaVQPTU4uqt~@vT)R&F{1371eNSi<+d}g81 z5n*WzXVephHjKHXVNX;y`Z(a ziO08gLXgsex7u|@ot>fyfs7CM`gyjqfj31^P9PTX$IGhCpi=Ph z5IZiF@u~Tsh56@>J6r5!yw6Eja1cgzl#J#O$T^smf!NK}z({agxmCNC!I*UNK#VA+ z(4oK0H%SQps*tTzV^f<>&gLtNkD5j zu6}}YAg2HZof)5X<3!*;^N5-Fl7ZNapuZ`;bf_b7*zLyQva#-CxLsP7K&5-#zddUY z*E^AYxwB{Z07*=`Kf^y-4l~9!7c5K}n{E!B*j!1!*nGnT+|TM4A#Yag-#+6*%#(=_D=eSVp)VJY_sA%jTLH9yzwI=E&WfSQx1BZ@68*tw1zf(~49&B55!L@2x)|hqI z+AaBx>Q0Q?$^=CY%SqCQ`^vm`yBKMi4$qstU+Kk6I^f*-wK$4v0b@ovwSQ{m;@3!$ z<3GcqVn*~`RoEG&{gyLIH!>hLMO1e$#KH?Q^|xu6(KeInV=i$KHZCKBsJ6iGI$CP3Fe((t%Un}(C}A7ii|Wfi z2FmwqDfbX^SXTyNbePM!&&h6n)^H>h2Vd5Xw4o%}Lwz8{ABcBGNBjM}^w<0DgsN8& zE{4ySk?$s%`?iXG4hHTCm6uw$4+-S@*(8;)yZS}@$v&po&K0^y!W-&jD31?z*Kac`R#r0x*=O(LiXof1$<)+P5!FU^z3(oT~kQN!M0J( zzMl{3L_$zhq2Ynchi2u7bT2{@%y())MTr?>DCn7)Ayu{*`4lCac6uNvyfFCywwrCY zgroN_?;Y^IXaVjQDypmglpBEBj(!R4O`DW=SCx-sNzH}wWoGlTgBx{*+xqYa;)YSj z(C)!z!Obz7mQhB>w-jlS$F(~ywT~+IJ8oW|I?tt{C{k_wjJ#82FUwaOwUqsLq%3pW?@f30NvAI8ohNVKR+vuWd{ZQJ%s z+qP}nwr$(SOWU?>8=ZewPpYE^HM`?;BTjs=&$riF(i*dQ{7)>Vcmy(0(-Q7I74$Rm z+a$fC8ST4DaTvokp>_X4ekl;5>2^c?yrpZ^D2N!+=y{L0zkL7z9`U7DV^BL-Jq@YN zy&Z&qeaKz9qr)4>{V4(8owNrZ7~$^nH%Zt41OX-riQV|O%>nKhj~%O^9mEIa|Id+o z9r|_V)_Lyx5#8rkBC|`z>rm(B|G@UQV{Yg0Gy1iVz4tWs8}968_VtV@yE|F5t(wda zYA3wiC)RLa6Utc<&lJv}=kw#>CJ>S6T(|&i|M3;Mc#!KCP^KHvDsv`&%dt13%B@2H zbH5TRU448o1Dt5HIPeppLUZu?Rw{ro@JPOJ@&osS?V}ajFZK2|0zWmP`?=cNq~dhT z7H0(_88TzK4qk<}RX4Z)r9fXfQie<*lvd)j*I7V`faZ{s5HXp85|k-A0HYz_gO$YQ zFWD4Ucb`|Tepj#-*v^#Y&g2X#MIl_8GwoDzjp>QjCSu~Yz&?Xekag>R@Vj2&Fk<+} zDxc*D{j>rDM~X8;Z%K&VxM3(_#;o4OxZn@(yye_kfwBi%n{^camow`-zg?>4Mf#l< zHg0H%3qvM z>dn()?*Yg@lq;}O^(t!fyhh5U*Xgie)k)Kn0|zsBDyd^++U*(A817Y(LP_iRUNalI;~d=g zr5U4-XM!&8ynIUBE8-H#5s)^4=t+b1$+Mzk7Sp^pKBLy7vABb65PJVp099Kfk%>Nt z;X6s1yF^@{^pH0t6X3lxXA7$4so2pHc9|Kaxx+F!)@HI_;yx@PY;#=n!-a5>GP0LG z7A~jN#xSLv3Y855>8tG>2W>vW?w!2XHAW1z4?mDXy^kvJr(*cGF$E9&s$V0NCm!?| zkP!A5bhe1dn}yr-ymNtNQvbIG0w#Db1oED-2ss7q-*FA`(=7kSn~N+(S&$UXzB+Y% z2x$jI-IE3KVHQ>7%u0kLc|j8fe{{1{!1h&a?TBO?76i`sRG;yGVIB_2ttXNsXJ-{m ziNjf(uRlyDqrof4+-WiH3T>;leXv=sf|KnecPx1fqw=?jG-H)$y*IEyf9vHtFd>tT ze+@_cWz3E$HHA);?CW7Q^wna4vXTQYg73+As#JP(sN0=tjo@Ky%ZG4Tn}KMKjNKcA zCfo!OqJ%@Z^(s$u={w}FyVrz39@oBHrM($-OVjL>e?Ygz1MC=OZ8(hEKrf!bO0<~U zkZV!vdaw#>vk&cSBHBEK4cV)i9>1xX*r!nHaIjH#`rQ-nSt~h=3K7{Bn79!>39)oQ zD}L7$M~bmaw#7Fy18I(+{pvWBAjeKY!U}FnD8r!{zK?Bz@zZ2s9hsL*|GMzG~9=%y~j>%^ZR@59G}@N4b5GMk$TJmnsZ2` zNW`tN3we-+U;qu<%LJ-}dNl`B8-F#;`xi+PhvJU=*qNF9q!=?ZsWeO-wO5PUuj3=F zKwnX!2eXqGCkp#1MJVsrjsv?rLRC|Yfj7I!jR4dN*`JA2J9psj(Bxps?c{gw;R9{O zBdoG=At`|P+B^z`tGw-fkO}21%!s4zZ|uEOe{Pu4e4_o&oZ}~elN!8A^rFs~o<}~^ zTHaFCz5vcsKuE|9!tj(|8zz>g!;P-%*E)Z-m%@?I5_b!Hsx$9lbc{D2Tn59(g0bb_=ZfxO{>*R)H)N>$!r!rmh#6$DSWR_1l$C>ouy0RTwXGI=?Q?BORh?2(?mNdNM^~~_jl+L9B_N< zfM4sq?c&ka?&3korhu-qGtMT|!h&#!i#h@wtAKh%vAYG3qRl~eoz9zt!EI+=+;K=g zF!!hug<<-}rm^eN41PZGTA`3KQO3?BT1Pm7`-{spNTlDsFiP$U$n*{xLTy8F5JB~n zp;s35AXz!~`|Xa?AL)FMcl`Yph|_!usj^w6_U2?iN^FMe^K+u%mo9nK?Tcx8GZ!JF z^)e7J1m*H5_fr4e{TB6|A=Du2?Q&>!i1A2!iJavNtVekV69hh1y<{-bU=Fi{kC|NEEo3@$yAO>J5zva?>&Sgas-94uddSLVIgT7e)UhOM$mFsz?o> zYl{`$nP9xkcWGNbV5F-a`1&SA&jXKLT<`oeEe2UyuWsbah2RaE?#eWO#@byC&)=_i zt;Tvr+>;^(tog7NvBK;4VI&}&d4Gx;A7JyKQ`mz)uWh!P6meV|m9u+M7wQD`#WxFb zjU>fR4jJ7B#tWvZJ|yXm$F$A?gk}xO6f5sKcZP=!$)9yc%^7SI2+)pCVnUQ3+ALjc zwyTrfHcCg-3O@Kln<9g|5N*lbwk;2o$M-GV7s_6xZ@T^hlm1vDdi}`?db}SQd+#Wc z2Ro4{0X=4EvN+vF>Lb1PWLc3)z=WoAJ!gsAN|0wLIlpH6n@!C4#Aps7T9a;ZhU_c; zR-5Mw<+fuRsK%aA6O|1+YjfSy6=uvlbMxwHHicr!#%wgD25Z;wyC{rcU0G8&NHZVA zRf=oWqk{c-7x7oVe-!)o&B4j%PAl^)u!^)#1P=>$uGVW}-QQgx&{_;6_(v8;H_~> zy4(&58VUgMIy!3-hDM|Zfh?hja5twlxhVR?6U+X><_OuG}PPX z?W}b_@OSYiTsz`1!DVjxO~CRfluI^IC<0$}C)CevaSRt=&=^`|uD*S|0Fi4hEw|s8 zz;Fmy=Ah|9W4+xH z7s`UMiZF|n2S(m&T?vY`oBS$SBcW7_cRT$mHH}_r{-scC<{YfB6{CD2Hpao}+~)tn zO7i33VfPG!k{sJYP&u2@c2_`eYTO}wSp%5w($^;(Pc^Tb<*2?lgOxt+e~UNpB2#&2 zu$W>CNSXFH8EmfLSTFj zot}`lYw3U)qXCwT)OyH>Z;zACc3xCjCNk5k?}Rxe$4;w*?Dp!cpx=NLGVt{tr+B0M zh>(SL_EYCNus-Na7HuoJr7ED?jioHmB_VBX(UHpSbB*GTimy+$>JJN)qwb!(!+#?`|pu z97%N~+>lZn^&jvsLu1JKssoRB!#>gL_HB&4RlCF96~` zC=lvqoTbAt{*~E+c{FNZ3aa#cl?SeeyliCcWiDBlYYr6=OmWB7_JvwAEb-EoMxZdM zIfGYpsN{}@Gud+=uGjvYf{ub4$b^g#y$Qq{b$axbk$2F0At3ZDc<&yN; zu7CLNJv8Hq;8x}gd*<`cWN$L}8Qo?_6*M<3mVj$bG-zgbjDS0tF-VA*+KPXCblAq* z2qBu-KKX*#?(udOnBTOT04|?)S;7>BA9xxEhR;t@>1!Uvq5$Lu@03|zjK4EN&8Wcv!Dra98qWl98@4dLTR|%IxIn-8pl#t; ze}5j7o}bwI_f7CSa|DBrLoGaH4V`GR#Pd1GaZS_Cx}H)V6a(o(G??Mx9cKv@E1Q=I zlJSlVH{#F~SuS$MnJZy}wBkZ+b9^C?>Q3ndZwi|8dUh-oF%-7`DnXxjwxbIDL_|Qt zXEQVQA|C^l3;jY9acN+FHdrsKb-ahJP>3~9X~B9{i-6tL2RH|uM=mr-z5khsL`|;| zrsu$hnbd@<(6rYV25OZfN`ru>rjqot64!_OXx)ENeCIUQLxVAL&BrGTXHe=rBKBSM z5q%JNXa-!4lhHWROTfOfy7#L0hfGRRVpHXl{i{P#JRL!O(&!Iq4yO;KF#5iwSl|YH zj)}P&XWs?1;Koy0sl25Z=h{CUL#EFsP~#r!?93q1Xd%l-L>Q^82}dD=NT-x-7Czeb zV}oJ~ho6_#D&lsfY{Pa)(U}S>a~;sKrN`DStK)vH_W4AEuIMU(!fq&%$4V%=c8!q`5VUIosux zXVQ1NolAPTp8QY`(Zw(TTVsCC!cgC_m;YgiKDi#2dSb?kE!4SV6MDl1NfCOIQ22#y zX2*axfms^2X5q|dsU$Kym{r!kKzI%V}hEuunv#Ne2 z>7w`J0@4|JO6gE=a}{qnVXLZ99hn0oz^lS%sV{FUI!l~KM3tZ@LGtIw>|{1~kK=^N zr`q;Jt2R+A<`gWKxaN+igEHR!-S<4rUW%U9FygLyb)Yf3Vy`i-29@5Bx_luny?1ty zz<;9Vum*7I49u1xGy9;hX;i#xCV$f*5X_EuF}&G!WnQED+sbUx84lR90Mll$2_AnP z_o7R4+R|23Ney!nl?bB}@+2b%cvA81FzlBs^_Gv&ns)n)h?IluN9}i!D78B2!~9(}IUX~@-4`U@WSVYAqRGBm z$a$F@Mv+lATS4O1f0z*<1vj*oI|Dy7KF2pubdZVBWk>li7M7t*Hez&eA#A>xh)OQI zU5r+n;!IUDI7r!j;nV{h3xg8Wk!AZ}r{b!S^qrE`w&vjp*mx~(Ht^}#?%~~$q(DHr z(ZoUT24u(W?&z`#dY4!V*^WCK3+M~sBVO}E{m)A8jKrtBr}bSuIkbkMzLSmF=A_QK zLZhX%@=8s4bP7x5cx>T(>ej|3J@=aA5Jw@;4i%bXHvdw|xGX))g^0R#uYnVsYGjG! zk1E0I%3RMI(|tmQy6O?HYYt{9Fh!YAZhDxB0G}xITv_rB&XT6dQ%i2!UI)_#@J)&W zmjR#B5XYLpIa-7bj#E2$v#x%+YNaa4G}%8`?Y6`KUR2f+WT5#EO=XA-LeGmRa=Hvb z+IH^7pps)k2Gy|n^Q6SyA2&2yWzXPbK2q@5|-f*Rz?%LJQ}HD$wJh z4ob06$>+0Ov6Vi?sOr~6f)I@udwVcDyR69-kf`~3hZO*YdQ5! z>`1Co(#zbIT|B%9+Z3+U2Ls4jS{9h5EP)=?9cNI!%iRTkMw$v9{%2A6(4lkel~W)_ zT%N+=e2`(8*X)LqgXJCl3raA53sq^?PJ^S}OmKFY7)YYJ+-nbSM~D1z^;*R8g@QZ9 z>osV%TUulMA1Rbmc>7O({;M^ZJiyJX<()I9j*OBy&R)^dBX+Fx&T$UFi|f}D9$T4k z1a<&E9MRTy-@^qR-|yc9x*(e>{y!v8CWilA0%iXHN*EI{)UE$Xpy%Kk2v5|2fja1R zFh(bb*8$YO-S39~Vt;m%%Tq2Hdh8#94Y%2-HWNn>!o!c9pRGWWUjGD+MT}vNn6P<& z?%RGI{(RTBf8ScaALKrQWN}>Uy|>7)%}P0N`RnNoK3=`GvQ77GlDw#vUlVEt-~Jqb zTipEN9T?FL-EjOokrvzIyGsvz(zVmaKlIm+g9iS}-3R!Mpa_gnv)>CuJKiZIo7+%% z`%LxACq6c6n)x|z2jc=&FaLZ$9*PDpp9s6b=AT~^iXMsZt(m-*;I;21Zq+__L_2x} zvkpgWJ2i$bYLOCcmKXm0XW;z(K$plEa;APf^ON<>`PG#joPPh3nwt^(FSy;`y!!O; zci;>rSu(TfP^axCu>U=%c8xb zj9j&l;Q-^bG}-wxQ8MCukM_;4h$6{+r5AnO>z|`uS&eak4F+z#*?(k@y7bQ(IJBjT z_Z~=c(e0UsZmy@bg0mS95Ej{v(REYx(`B8s%7|W828VA2(9(x-$M!ZQM?zYpjS)IP zm>u$3cAGw5Tg4~2El-vcZY4*AQ<#gxmcKt(FlqaFf*_(41E)z(M74<=(_YxMj7)n{ zGp(q^?YcXi?+*wYKWHZKORkbI13hbjn(_5-o}lAewu+W> zSjLYi|Cz0bT05j(e`er_^Z@_)7{u_GpgED)XN%MY2|ZwJ=Q{k30Mb{4RRoizG>Y`} z_(VyJk>%XDo1JR56~Uu&WjYeM(4$%c!*3n1{RxYvdw%HzJJe6QZZJZ~5*!}XaFp2UoFBL{?nX~-U|p%sy_tT zy`eCEmGFSJAje3+ALqu2j^o5MT8o@jQngx3-2_yN&7nBG(c!>fvSoT%^FKqBmvZi} zRqcV3k&)4^=9AGZJ0ee2{w8guCe{k!MkLSrdM1r96IfTdP)AWDtxk6#;`%wpWy+z( zXwb!PS)wj@CjKp=L6`-h>bhTPQC+lM0Opyv8K&?DKQA!UYqHntgo3S$zfL&i)m>p! zS~*uCD}s#1tDL~*<5HhTYW+D#Fzuh58@?bYeT>QD1%gE+4?HHD0IHb-c<=kSWcrBx zZcGuZx4)zrVZMHkdOvnsy01jh2ZZ|6UKHEd!EpOdbnF83`v!fbZLRzT>G6Wwj$}-%sd~w6_*fS6Yt}QA?uV zU0PxF_>I7~ql6Rxia(v8*3-2jh=)QLM_1IDCuD-`uHX-;0j^>q;qWQeEazau@0NP1v0LTCPF5qI^Z}&Z86l2kyYH zwnD-3t12(v5*_y%IY+6M>@DO&gJRz|Hqa2YQKy>1=AzsnWs+S(Y0`BVbOR!pUVxl? zItF#YcHXdNrudGUX61Lzu>HmIS`cYWnci$1e(Xj4%(+5}4Fb;GPZ|s%>*fHH*-a`9 z5!aacM*|0gDT!g0gu-n7h9ydqd*7-_Dr;yL!?yO(D`aSL(V3z(bdx6dwrRyQrq2an z^W*kk9v`w4!I^csjp77HZE-23iDdm%32Chb6Eu^cplvFhfs=YmxT_?2*l9DV;B2iR z4{jJX5~5;!9nI*Ny`L#O&lz^XGkf3KTYotTe8PANucpju-mKJQMs zNvO}95d)TgWF{Gb<4p~|R9ykN5x%Z@b%Kms4RS3*5Gh9lB`<_g7{Z*nn5+Vvhh;t| z_y>(^1;HU1N61X0V==4&=>ilA6l0`3C(V{1ZfoY>V_h01VEWuzUIal^J z72j5kv|*Tq<&$cdpQp*}z?2S+%&8y>95%09tub4PSbiy^H9Fxtms zmku7t6rV~$j@<-|r^ysV8=4MeX37dO^XkqKcooTL5ynu>49aa{z# zv{u&S1S3vG#6pk#iqR4%)x4N6)|8{E%2TG^QeAG!f|BM?&~=kOs37qU40jf9XM8DB z57!-aeC~8ti%6o-gOr9VD^#v#2`LR)8Bcmxx}8_z@+uoBRt_d>SvcK7u@&S3 zP-%uS4C+8elnPcB3b~|xQ67Jb_e~Un4*md^(`}p&AyU)uQ{0421HY4-cEg^?Lq04@%p_6jo!9!#+TNICbm00S zN=L&TBQrFj0=Pi?MYxv7Po*dHiKoRmQOQxrfU(#>h+t?d7c4jnlX<^|`8$rC&h*YH zaQ6FK(<@V+#}DW($GOOj8m>9VVwI{fxC@E5{O1)hR8m9Wn$#M~$R_C#HqlQBwyxjd zlFUn2@NNceK3+Psbl%O#NL||2p_8uF7}gEuw0aTOFa!8GlGBLz42J93^gBvNU;)7v zN1U~kYnfHCm<)8L;~38e@gY6kjYIgCL=qQ_#Mguw7p?w!@us+ZVf|*Y^jZSCS{Gq| ze)C-aN4PPPcqr|=R7h?wxvjgmuyj$SIopu02DEY;#aoNFAv`8jM_-w7qF4-zhm1;X zGG&a8FRLg``<%TKtU_x%^zSd%1U4E-ExBmBcHY^6-Rt0eJ;rfH6rjG+X{`-Lrm0}n z-Fc!4_xaNyz(7mVJy7VPENqo;U*nyjFp?7a==Z!XUmpDw z?hh`@fLt+_qY0`M{yci344LaSS^8uJwY~a$KYC1+kgznV8u6hT5ISnb+9Ts^xKXn4 zjc{xXV4Arr6LY)B5aavV+W}1q68j(GDf9o%Ld(Yf-z>C8znh5<|E~<8(xwQ4$@!o8 z=>P2quhLMYPU;^gtiY#IHi*eLT;hT-LHInGYEi{aQ&)u*)@JO13(~8;*+jD#y0XN*7On9qQYJ^ZF_%uDP zbvfSS`pIx^;~9!&BMAN(CLONE+wB*ELmD7PBYo!^V$bbonT*p9dEU9Ua~;!cE5vDw zm>E>b`DlJqL2B+@iMFqw`uY64$QwL7BJ2i1^t6&zddJ|d#|U{Zr@9=xsr>nnSOJfX z{Cs_*`Eaiw;IZQ+->(yM-Va7kOP3M< z-$rTZzwHw&S6Xv{I?+YHEeZf|dmhbb*;My;v91BZV0gW8a4C4k?1aODCgdo{bwhg1 z9bpZB-?vWgvqU!TVT=TSDxC*?{5b^Bp&9W&E(((B67jx;Mb*s>+e-%gIz(}}+<_t|VHJCC zVGyLWS{Dg^1m>wO&M9){3i(YWU>c$vM}6YtrGyl%hrs4aucDUbQ+(bY4_0ADEWqW- z)fR>7y_mMCmIPxIZqOejQi}z@>P;dq0{7F(4v1}lT5%mM#bA-pu&#-&*2OuCw=K=W zfMBrkkF}gqL!NmrGA%$v*Iz^yF5K-^x zW2XmOxGiE2oGrZ$eMVZxcFQ#LE87xf&`xB`H$r4}9X#9;*^`WkzOwcNhf-ZJkfG%{ z`Ltm+iD?|+e&*XPD)W-M`gWEp5E8}%T<^LLvE>HtOkaBS#{VvWPiRBCAjxvxHZv4a z_%al!H;W5CffvHM9DV`%OUk0V$_epu1aR7RGf;boD5lH{Mup^IQ3CJd9o@_n_8_!@ zA3F3RQlktJkB8H>1x^WtI}THBODjD9v8K^T6{PERhbIJbW9)%|AxJHlSJ+$_h~Pkh z1}BS456qxC@zuII;cn*0(HbOsP8b@l3@Ljpsf4N0FK!G%P#pw#c+%e=8}Lgjx_|8l zMXOP&W4anP&8CE)io7ao;-4vcFvze}(n{tSXIpRI;hMzI@Qxj1iEA?QR{dMq-5Cq- zlIf>qj^rZdx)OuyD=%Yn-ZDH*y}QjQulH0G31X&i&wtu{JejT$|K{GZ97~%W8RFwb zp{M(vQV|@q{utx5sMOR@W(yJb(iM(~{}uGxNzFTzgD$=BrqI&;EyK=fD2gQ}-Zzyq zty5-GF=3heHV3e3CiO+9Jlxq&3dZ!5n{rQr^-jo&i8w}V5 zEvhr!*b6~SBHdAk8!lB4hmn#4deBOagDsaZnH0YKRA^+KNYEg-M2^3sMZT>w{fAJt z*FAWk6T9hJ5TJ^S-X7Ss00Xh`2COG(`dz;~-j!CsB!(D0fsQh)`O)H;)LG6X4h(lO zWzapK7_Czjct$T0cbP%NqRDHF0g^iRRcB@K!KD5RLb}EWdOmxYUyd$1fDWKQ4tG>b zK*(5>>eZQF$-_zIdX5uufv{6yfjl}=yT0xdu&I{5eS0igD>W=bqdTBG(`@`Cob(CU zUdcUNm6C4hLSXJ0u9~^XzPZwYIg(&oqPP-)TsiGw{lU9lZ!U;5BINBa=VN&oJgw({Pg?;VH}o2FU0Ce1*%9|<&&858EZ;eVHvjlVT($VaJ5L0dWPZUmc-Y=zuE_x zZQ54{cB|-Zmw!3%ftz=y09?4Ko>Eg2RH16C1V7?%kt61k9KB{dom0aTAAn<-OEMqr zDR7b{OSIyZl|-OYdo0y&*|dM7SDfnua>*$5=W+Ho7b4j-p!M=}5A>qKcxh+E2igXdNp_En*TAQ;kuP`l(Z(0e}qL z_pEV`O60jNKNw*pN4qlxd~%}8L21ZWg;1s|9><6vd}T7Q-wu&DX$H+u!UAk{XUIJK zIcw)UO#IeXYYq~@!@^nv*b!!WyNXl`({iLSo3ZRmYZCzKR(NEbT-`(~oz^)=>W`W# zGVoj#+*Uyw;D9&Ko^R=?NugJYDYv)~ldpx%E8e-iii-`ozvP*V#9_iMr=#~5!6EF3 zNV-QSK0}Hx>xECxaKsnVQ;VxlG&?|@AtxGQZs5I>t5Q$CuYWotsze=ZcH|MV-Iax( z{4;`p10Dj=-94gix&GW48Cw5@gq=-J5I&D;XNx=kwq)XVDKw~qy-1QG>SOOv4w7ar zImW>oPtKL1Y)jZB6kW3u9hCh--YT@t*+A5$x?qT6)n^-L;_{ZyJR3v+{JF$|8pAyI zZnlRfFM$47A0l{-e$8-2^Nd+g5i1>A{uS2N)NwV4E?H-B# z`UYyC{AcQMSO#6LnbHCtRiv9z^;lk!awC>9JxEEco-84Qj2Q@zf=%HXU?IMpZLncC@dUdu5%R6=(tzT&THU-C{sUXBJ zS+%oN>sxBKy|&{TIqhlN?yk7KUUCDE+rv9=UUIBz*Gz5O_g_9wwCT*EWpYr8u9@wT0LaCGam?{nY^-p{SBf?0al z{}hq`SMUx-R_6bPK%CMTi#ZrY=>DL31uk&Z1rP`Y90q=6b=iW!`yElD&FH`H@3_(; z#K(&(NS9md&6bsj9V323h8;eB5R=7!kBwE1b+U)Ddw-?iekOc>H@AO3GJL(!xg;3G z5RRYy7s35iyh5Fm#hd%v9_4RGChA$ml=M-h!da`Bs&C?(j?b2r5BB&>yf$Z&hMyp`;0e?&ftYA3|-tTR2kMS_=;8dpq_oV zjdwaJ7}F~fTE{Rb;U2!TC^To29bso*kU>#Y*ci8s^?R!*Bv_$j z5L;`^ZUe1|&gms!m@Aq=zgTw5c1U3gT%~Y@yN(qp$?H^UXrzy$wV?^8M*(PcW%$*I zsGOt~>@lBw7y#U1Fi>6W{K3mrE34v0CDbMqRkc*eRSps6e6a|-_aG){j*ok-O0kWI ziTDU3jpm%w$}F3mUBao!z2dm060j_*=T^nKC-ZF_(gckPJ5eEDDQH{hZyozC_7r^e zGDv_Xiy`z=zy}n_TFa#1ROkO5ZPdaU)10eqrcFOyam#D-p~&;Px_~V}Y?n(Z;WNh9 z%1VYM-VyK{x8yl3rxrp-J03khgazvaZHqc^#>p|bUd?^zk;li=>%G3jw*1~L?c zg=v(Q_ADVXNzaP<`DxX4!Sw+)j89x_TQ^faoksQ{&v@rYz8KCH`qE~Z|FW+mM4omP0<6+g#dfc?hXpef0 zF1R~ji%0Zx)Mvf}JqTA!xuBL5vy>58tu4Tdcp9;nOBbwYLrM{2_CB0>b!k<8v}_W! zu7G5jk>%fP3h19K!XyzbD%*$M&f~BMs-tX=lj$bq2ydb?6PD=JZji7+6&C_o8dida zex$7Y$UkncB`y7rP#3^7k=!`v$qnpan+9og)qYL>O)k}5jg=C zNviZan6J{yP_ICWt%q~ypb?4p8*W!og|93Fi5=AP%51xTVk0?Q5JGf;C7!d@#Rr5> zIM`Wt0R2Nqm1yWahd)R|M?AK{lG3YNZdL(uDHM3}E2!eCfCkW|NWix$j=PVforx1} z=F?f%AzpdAv6TO%3$KG9*fs>ssipPcat-%E>gEOu+btm5=_rUx7G(SJAjcqkE}MnK_Z56e{WmOgPvB~R zFSs8x^|V?qp>wFwk3*v~{sAE_N*{JhYkwSy|KWQv5k$_n_YuUUUFaaz#g@;LNQ!#) zfq<#XNCA<>VMm3I>(j=Xh#6z#zgGh1FG>z`?_-))$s>jtN|*qqkv-sXmH#VxO%{88 zUUwz2W-%6D#iUFjmUbA zPp=)j>ZV&@rT zInQ_^ujcmZ4B5mICgBQWIMm4c6H!BuK~h$i43Y`%Gge~$9&2w0qDI%O@rwL$DgzYey+fknUwo_o{>NZpkVtmpY~RBj%*C4fjoMSH3b3! zOgJ&`w+F8QL)f}y7*U{znp;}c`}UWPjX-*uPV2wSTP`#lbi!I-u_;JV=*-9?@e2}D zIo=H5xCvzjLP=_D{6gqQY~C0)cDl_G<$I0yO|+j{g)`qIpyNEQ?6j(Q98qZeVvhzZ zHMT$i%<;&-GlHdd`%$#Xf}Y_31ZJ@Jcy0l2JDG&Y@1YiN$ppm zuNn*g%_rEj?%b#6W>vF%&fXX#s*ZpPw1iTZBHogME!K#5FA@aHLoZ%9SP9Fb%j zR8TIMsEO`1O2OH<$jn)pXRI4Z^I7Hg<{0_POulStGK3Dop5Wrbg6Ebq$8G%>f8FV? z9Tgl_1!U8*vJoX1Wn~C^q_-vL$nK<=;~ZgfK`21F-K*zBHmbOVWyHGTVW8l-S!?B% z(kLEk6G?+7nla6oT{zinURGn6dEUT$`vzJWYNo&RJqtE?kP%Y_#b#dvc2L4D>g9!_ zfR<)+;O5Q6aA;NXs(JOM#^bzGCs|&*2rS=}lE=ew(U)I#K6DX?JprI*+8~Qvh{t;G zsru=3LqFnBoX}I)tY7fqk2yk+or@<&WeUMyl}D^Jv%+%~TqGhD(1tVfT~@LccE(X(ol9EPL6NOA;K z_GQ5lfgi;!vTfj+UIITK1A|J~vOnV?>9QGv13QyE^GL{!S6eQffK-AYvcCh5yHx*B zgla#cn!0b*3hMUJ7$4^u0@EIt)*iZVN`P8FdH`3T2#Es7Jl$4luUAvo#{6;fAN!KA zPiZNp^_4Q>R)xe#=K2A*;-MCBgjK*2WczLOhRrhe@<`gyyEcR=@F@s6QxCyf<%*67 z=K0{<=JX=_m^LNR+2VudM}cAaum0QkRg`OiK)lSFVkxEd4`*E$_F}DDldogt?MD zvg_!#BLt`NMBZ7(E2ocRuAaPUa?Hsl<;Mm(uv_g&pM@KEA0YnhwT14M>w;EZ`Bg9^tJPoG61Fy_1pOJj_d z-~Td6TrhD7@HLW&&G9w;4wA4mJyGns4WG~>jx^47v3jxP^Z4gRVnV=`a68A5;PbWM z3#dF8^FIN)S^ig$2POuN|CUadG&_GAt_V|KDDVDr_awZ2BH&@dX{l7-Yl3y3&$_>QyJ@l+XXkr@wO1vGTDs`VV^VZ&ce)M82PO?VnG> z_p=k@1Oqt2(X$cO?lI%#erbiN`HHiV13Wf@qHars+VxH44oZ|C)VuR*M(@r2Sr!K_Q13^sdz-{TSK3a5OU3uE1=MBDIV!NoCCGzH)j`XO zt0ViaD|!Yd<|zHn|H`b*q*#&d1Y3?S5MB`an`bfS9*J+|jBVz*?`NRCf)(WjNMhIB z_j$b^4XvO6*KqK$1Hb+wu0j%37+m)Clau)-@$cdZW5mRu9X^2Q@jK zLC-~-0fm$Oi*6WmiFG^$O%6(;L>`hDudN0e>zh?MC@2{2o)FEN3?Br|m)9T68LSW{ z{=T0VyEN9%%LZxR)1>M)_QM5!>=M`g!rKZgKPRNIHrvFyzMZ2V@oO+KuEOHs z4=F0cXX8=|YCzDKn9E3xok%E?@tn-bB#(Np6ad8|$E;JVo{IC$ZV`)4K_{a+w-xZc z7}!rx@N(3)Laa8Fu#^m3@RMCF7bV}I=3EUe_=}wgCz93K#8yC0(-i-%vA@f+W4p6B zXu46}=dKZf7EfjEgyFFp9~Ww$O5sr$ulurce!fO*aV1N24AzK&=SKAZGq*6 zNxK?N2#eHVO9Op+m;+BB^5oTq!YCe9xu(+gd`Y^@rlm4Kia&egTtUzDf#n-K(OsCY zn%BrQAh*WdblblvX4$}*RQRh{N-<~#vrX1YPiR=3QMA3ls+L&zer(L_??O+uk6=N_ zK@U(r-@D5O<4SXvM~Pri;xD7Ix8!pz+Qwpab>nE&QeM}*Pa`bitb?i}q14<~ zK8#JOX0@Z2?_Qu{wX!^rOVos5vFZZl^0e*Pol8Rji&9pqB*rDYNoxo4^9Bb~4fK&I zRS~rhmb$*vc>HjGp2mSyc2vzqONb^ygklD>&v3(2_lwcnIJE$BF#@t^fo7_ex3bg< z>j=%R+0|+PV3x+7afq5WYUwL5v>&QZYTZd%LE##>9u++L09G8F$!~3Fgjq3Kf&h1qV>+PLzGM8ml@G`uwy)FU-LYuxYKQ@N z#4@w>w}BS}W@SlE>6Q8B7SL}Iy!dy*71|EY26j~csd#TJ3_|ix(03RO2UuQ{^1G}z znah0h?~OG}_IQZCcAq^8n{!J7cn>O%zToZy*N%v32XY1{pb=Wy9^55QBgdUKWXiGe zjz1mDYOq(&O5A8aeOD5oK&Ck1ga;R~m;xc;*&oK>(n@mhDF7FLCS!lme5&|yJ%ikQ zVh(|9Xmt}mo{eRFuV2_x?@5>tN&sei{o}j`bJ|hk`QRw&;ME^5-_h}ct|TWk3q7Mw z=4;__L1XF!p%T!}4pwAO1&fU2&Zy+kCT>B(sXrrP^SQyS(=+QKbbqm6PUpM(4c=hy z03V5ANcm}oTx1EA8P)lB%>%rZfy@#bC`A@D5gBYlw@Dgjf#Q=>9UnDh85jqMNaU;M zH%Y+s0n&5JHPFkjsto_^r7k^1*UI<6Quf_8(U>mhQPG1A2)#xf9OMZ&i8+}Xvm~$D zZZ+Nuby`>Sm(dcLT=FlYoSw2biI%R7gk^{!Wm+`IdCy6#*#Fg8Dw9p3u7tDFqCSdN zKsF~-be9qk?zsj#RWI?90mVyJPQc=w6Nz(xTXrEz^e;HDp?;Lc5_S#8=}4|)eOI6Z zG$HO%Y)C+(DF)lV@>UP}dMH>bri6Gk5(M1+H*Kp~#@*8b5>SMX@V7v@hSqBns)Lr~L!&|1k*Y0tkA-`>_HR8?X`j@^0 zEWMcqGOrn)P;D|;xvgIjti6NL0vdn6B+(*FmU1;&Y_VLp8~|Q{?b?Rk>LRj7TwI6t z)uJ|ZZ(Ayu@`>;|1b^qQPzTdGG#EQCYRPP`2Gh8wmm;EZd5Z9FL{0t?R^AL{rF0v| z0b+AFH2Du`>T1+vf2wKFKdLuD9-}DteZhzR!hSok{W3{N?5{H5Hd7A;$3=W=6JN;i)-jCsej^!3F3Z>qGLYBs_JH$uvEm z-kZTNu5Ikgz+r^kSE049Igvqk4d43aW=dt0I z3uvX=coa#=Dqpb}c)mCF0LgfxmZOJO-Hck_B1d5d9n=AM)NYLOlRu8x9xY{?7O`ko zuuWS6L@{`1hF>dtXV}Xe zooX(8J65GC2t}1UpqZEI*6%nt?@-c#Aba$@;}JFg)I`kpUSDCBhN)B*!>RF~71nj8 z*Y&o0r>O}Pa69Cw@!0ssZU-_+Owm;$Fsg2-MlxPnmiOARHqA7VRSG@UB2}E$3NJh{ zvTKr1V)BRN*u& zov{>$TDYUnH07w1a8)}*4CVqjadsHbug#Qp=vG>JodNH^CJ3c@Y6^wH(Kf>?aM}M} zhCkgN%K2yRQyhumRPoT>F9-HXM7irU7X)sW`oWh3))D|^kNVs;Dt`buxjNLXj#Uz! zUDA(*J7QaVHH41XM+jo$2>for>G0(2KJ#W`;Ej5t%)3%PPH%7u&S2`K?9xFy(ZJQd zkjBy07Vq9F-5#Ab)wbzh;=sT7KI6N!ft}I$b*5>#<4|@)qLm(k+L@+suy+UMz)N*# zrdhx=ZETx;1Lt+XMW*SeNCv;A`cTa0{3%?0+rT{2#{NsXMfATiQ)BW81cE&e*nX+qP}nwr$MVwr!s5ueF1H+PYX* z;~(_5_fb_((b#S->p9aLDv!9zRPortgoKQ`4?Zk(X+j`$_hPk&f3vTsvj$Vy2Rao4 zy7lm>tmGus!YjZIdq1zhbdB}PE#0jh(Au-BFYhhe6EH`?h0)7R`2-b@^wP$CQm^z! zjf&Y3*#HEQiXY4M+fbrqBNhDkpqXt_@Q+7L-e8#Vs5|K(#SRF=J46izU;SwGFpz4g5>6ac(k0!R^W*Uhkvz$$ ziFUPY&f%#@f3GrQ*T}m1UD{9rvIdZZu!4AzN7Ap7&vL9>H4G%|JKM_!+)u-*-9zrHAXA*&aWN59W#5%mvi zIaj`sFFz=ul{4sC?Z&5p+HSy}q_Nd|lGMUmM*1$T}Wr+skJlCi%sg zeVizu@&}_ZdbJ-mJl6(pt^i2COP1fcYG5oS7kPZONy?t?Yg>C|MQFy*qOrwB z6Jv!)X8fF{=#fi#?`7<~cXvEJw()824>o93&)znOn{EKU!ZuN`h+h&8ycOmBGl#FWQ}XFKgA-dR|N6LH=f7VWhXup7x45Gs%YNVi~ z#ce;HK^Mo&j$`k<6bCbrIIrnk<<7hh0y-d|!TM$G(uXwHbkhJ{TWVJTF8^&o$^mg#5H5un)4E-Ho3v5+r5(U zG(L(YJ}tR_;auEG-<&5EW2MT_8J-yt?*mr%c#`?IdI?)ao#i8%0K*spDao{PXaY60 z30qoT_-ZVAFYU4E?QQowb;Vq%(V>M=dJ7V%G4^rHsjYUnA(+Ou_jA$fi-(;R{=urv z)KlF=zn@`8#8%^`#Ti9~8ulcRxy|Gm8B!LPe2({94ZB$aR?j=G;F`mq-MxOm0J?BZ z4>B@v9^X{&SVuUAr>n1!%@k}_0ONXfvT~*s$~OOvuV$w=s_^vLqpJmt9-LGb z*msmAp0LZ0>`u2uP)7$^H=pLGQ1;c+LZxlNc^GQfIWA8N>BHD~Bf?JZ3hVN>WESo( z(64aZjR)P*WgskLsh8-n;gIv*udr7jvrlo2PjGYVP>hEPyjf5Wf)wqxRi>!B7O(_m zLN>5?421G&u2WKX>fc3kHm?ssriQf%XXGdzQC)JCoJ+`~5pm8vZHNB(_lV3G0RfYw z?@y8FiUHPD`OxqwBG*=4CkRBm0+wN=5iN4;x)5dgG6B#KWu6nCc6 zhbqjS)sSD!Xs$zNkqxCGsirS`=7Q|N!wRVmY59jS!9Zw!r#+7FoVA1c zX-_gd6+C~W7e8w*Ap_%2^lXHpPhKS}G*|Tzhy(`&H0QoEqUsou%2h6^M(CN1+v6Ig zPtbyh5~v~3P5uuuQxMf9IsO7JP%7#>&xk&LLZxnLEWFe*yN-G0s!0$%%YbCh2!@{H zDOB{N1{6Ych^L`Kq5{B4^0zKnR(KoBo*W3&TLCdfp-h8nf#SxQM2g$}!zj;SMCs7=f{w-8vou^J(@G19RA9CeA;P#2q9|dJHfC$u+B> zb3?k(0dudKY+*^*p>zeuz4R_kgncA-BfP1{bm2@F_+8Tpqs-|v$jV|uvlz$3h43_n4oJ_oA3xrrqWoSc9XO@Rq&9^O{igxdYlou_xqXPxEXw7Z4{JASa z<`n6=ypHmL!)}KR@D+t=6PCfEbBYmpb!(q3!Te|`9wH%FOWDk@xg(2>4t0k@9?~D5 zzlt{gB`O9XN0xpiIwnpsIey0mAbC{WFw87wd#KGPuzO5@6UB(~-2ZOCo3S<#$fKze z64(A%H!)O7#xc_2+Z?>+Do(B*x`fE-xp1Z^hr!ftFm|Q=83wV6%(5y7{V0mCd4Vdo z9Beb#Pnswm+|+!qwOerPb5u&887qY{>xn;V14r4>Qm+q{nBCF3sOT9@#a%5IV4g&? zsJ&7`AWeSn#jt*wvR#)vaVUb>C3DiPic;yoDOXjbFr-j^PwV~~fwW9n{>`2}wa<;C zUOvvR6Qgnw=rFJ!x;>yYm@tOV?(#n#SjThSrSA^3?aFKPaiwgstw$)(U`dtnUQ#=b z#}nKtlyL3U^NK~dy#%vlSc&^f)+g=B?AWeCfnG<;jhHXn<#(fQh8)K`GU=vF$c;^w zPo0H{mP?_<@Xf`~PZAbAc2Nn|j^Mlm%6PUh=0#&Ruk$po6Hs1(V6UCb<98LOU_1c7 zj={`E6J@R^{j&~VKO}X0N_r+{ zTUfS{05Iwap`^|kd~RNdPj08Fbx+PnPO-(QE5lxs)FYHsLaW!_z{V840H9B8Vcah2 zUFkP?A?WL5tDC!eQOaSlJ1CBmp5*A|SaZlJMsvITnM`?rmQmZm&e8GapLBnI)u(Ot zya)z!D@;1~Ytffjntirr+h8qYB*NS!*}FE8%l%Ng{8!xo zNGo`wD5)*$k*iQl4gwJ3zIi->4V_TcAB`OaVv$*CU6aFY5LfAa5pWU-2F+l+nX_F@ zLsJ;Z+bIOScQilJl+C%muK$(bm#Ze}2=r8!!#gjImHlk#_b2rCq%UCKc4Os#Sm0Qh|C^8-0~6c-Uf|R^ zYc^TouO3j|0q3xLAkZm+hCt^z+O^{hUL+)t&}0&K{!Q75#ecMQ_V7pasa;6ybN@@< zlUrzoAdUXfi!g~Gs7xwdseRpL`u=X~_6Ovl9{F9_j<5^X^n+%~ zvlKzbQE#GY?FGA!u+xSBCEiUhXOCloI{Zz&C^4s>+k zV1_X_-Tt08U~OLW!w9{ZWN9 z3Wz(p)ZqkDyaq`RtM{(8xC9(;CC5Kmrka1$#C6^<(v&Ii~#=9fR9;^Z*X5r}}TJDPDbf>Mj!Qc~)Tet7G>=<8|>9idblA1n*g$!Zr> zR}6n-hmy6kZ1$Kzo5->d%5a?#fu>-H3ytw<;oa2;h67kh%w6Rv$B8c*Vaxzp%P|5N zc~u2lot2TIsy#5s4FHzbHHY!?^>j}J-ox$fi=1#9u!kGZnEO)t0M1Gw+VG-v~@4SkOY z4N^P!(YONm)-0f0p$q?QHta{6vuC?wd(dn5u)uLv8@QkVU7G6OUJdN5elm(a{fX{4 z<1!I=)FII}CEq+Os;6eBX(*>}L9vQz_mFeZy{-c^;KQ#WhMmuT5bnKYoh%B!$Y`*^ zvsgP}=k?@XIhho^v1;HO@!zxtV;Lio7p6d< z6hd@rm1l=9`|xVD8Xvda$9s#j-pjzLMhbU-KV!(8cgjg`I)D|qnh zXV-iFWWJobO1_jC%omQH0#TK5)&fG4f!}-wI=N$C3GpY|Re(YJ+p?gSUAAZVB{iF- zyZ5id=tZTrV++5UiE^0T3V1z~NoVj2X7A19N2`#`tkQz+9NtQ6TmUA`V4z7|&(KKW z#D8gLuFQI9SF!E)BU3yAZ&+SGPXugnoZ2X$Jtpf5i8(>QCTNVG)U)`yxZKLSEo}X` zdR*P}z8<)Ku%*I)R`gucUUH2t9O|EihideKPzg$;o4dK{5_%&xzdyt`wOV*%AO)|Y z8)*|(MssdiXN%Z+Vc#1x)nY;3IE*afw@)n6M4(eDm!SVLsz#< z?VOmSgQDmWHWUV`R)GlPILi!mQ_8$LYdh&2A*HxT0ecs#tynA z99~IUX#BT)AGz9@gH(;m`_!v=T=gQ_`|zfiKOQzsWHzY(7+H@@5Q3+Tw^qsViYqkL z?Qv_3M$FRM*Chudiz+d6>!-jwi`r8Pv*>w^MhEi-#EnW@LO?Vtw(XR3d9J$LwQ|}# z#K#$2P)pYf0P1)TCHF{U^lIwg2I#Vw;r?jU#;_JuoZjblN0d``j)(`VmjJ!`)F4FH zBCRqH2McOKKQcd|nLv;tCZq$?YzI#2bF(~A0m>%1aFddl-3L#!L4*6mGwfNitOIRg zpTDbutp^9IpA;C92c^KaKazq!WLAF#m2ByV4b{U@^dlkrd@)c=Z^Rbjq>K3(0~}~4 z^LRxx92IQyO?i8}K(FMsdcxV90d(|+6!cfY%qG>pVopYJF+O(0WzF%y0t_0NQ*oh5 zZj59$ISy=_oH744hQHqR!^c^q&CuD^#U2Ywu@;!frio;`k z_TPdS*3?PBFjEGP$ux>7G>nzEGp%V7tQ;X4py@L#Djb?8-{#RC-!vTOS=CI;7A&vu zwjrJp-=u;_5h95E3}Vx~cWKCcjTpH=T%HAaz~X~Q+y%UUOPJRilS0a#X<@}TauTiv zdnlfs84#+wUJ!IVT7-(Q=#KncvsaqU*s?-JLI8X5OoEQHR)Z|EG(v1}wOFgYDv(qO zxIe}94LDV@Yh}82I!0KhJ$Maj2M|l^w_SYL1t5YT4=@NMCWxT9Dpa+zy~<%caYjo)|+A zS~O$)Yu{Qs9hni!a?agsRE;&8r*dv)rHng9{uSTmk+?-YlL5TraSC_2j2R95oFYp@ z&zC!$8s=Ut#iF4UCNA!N*mTQe?*vE4OmI{=b^JEbRYlHLg~hjM-v^-g@~hP*+7LPX&SQBA*35rM0kvt4$}TXt-b?Dl+qeSQ?# zlWHLo^lcHl#O9t14&BjKRTP%%6Wv!%C<4#x79|56fGnq z4?}N-(15zYtct5&Zw-p?Mg_HRDx?o!M0W!B2WAvn2{b>DKsCFu(wSZE?6!p0xNx~S z8wb?dqjCB{SITbpO2N{nQ2VcYH!XAIJlpfK zWE556D{mubkI@k30n-q#E(Rl^pmFRnc{+8w;<{H2em%GH>A-@gaOH!@L>^DOf1_?* z$Tt0ID~Pwtbcfr7;C|#$L6IqD3>APTg>C>BrO8^9KZP_<>dVXdX2RVgPKfx(1AUQ( zAEzbNw572mGz3e`YR2=~$_K@SxZ=VhuCEjaYBjO~t|JS~trfj(yf|&UtDeA%!pK%5FM`T68Pr&PcW881?H(uS zwbv&ZiH5el&2@8)vjSE0-ZaN3_=;Dqfash^0(^0|bVcZ_f@>a>LT5K(DAvy1C5i); zDA7PMtpFcla$i2e{e8RPFkQ8xGa4ke*LDN%ih;AHCdJ{mEx6Y;9m=M$jH)qiaUgVbGd+2bhK0xy{a%yH~Gb9XhOBlWS+IG!8m(X z>Kgst%6e^5E2^58;3r2tq~1F85WCxvBy8<4Ad7=kXOa?Yu&Wzy-#1n55i~ZKn(gVh zEmB4rDnhX-`9P_X?9Nw*8egq7b)N|(r!3RGItipXyPqQvvV*K+sAb*l<-EJvsA&Xb ze78sZo{~tkzB(zXxhPdz2wfT}S*kSAQl(WRd=rJf(v)76J+ly&|H0MSk^FG6)aCvF z6+LD-@yQuExFvlpzL$z7J1H4v%ocv763u(e3M91Z5@q1`+UQRAV58gQD zFBFkf5p_5~4pnUg&Z@d+U3;1M*o&e5^|aE#)#l*f)8hNN$4ig%!2M4T&wrQfrf2%! z;3194nhjR?--qY%j{&<@=S>`?ZX0cghiN;ev5GFa6L3sJ}1l z?CE|3>O@Z_;edQeJV+k=GxNYq7QSZht7y;~?I$Z3*=-mHEE4XO9>L5Y?Ql@&lN@$; z0NrGaUhrTk{aR-N)yEc0?vAT|@y6a-%_E=Isof5K^6X_Lmy87ae*pLMcdsns;Y|2A zOxzKQwM|G_wXg272UtVGJ|0_37P!4KQXZwH{|7hZ_GPRvLVrc9{loFa>8(@yi?{#0 zFYo+BT?Q>_o`{6fvH~5)UhV2~Ig;t^Uq4-E@Uln=P|re1CJYK21ujmjkFF7#UveP9 zN#|h;YozHwNE*)zfQm~X$iQ{FQ0*#vp4r2|?dIwPDoL{VC*ulw#AuuM!B@k(9pyO% zlt#}E>FE8cE=btzQ$>rTCGg+pxQ=tsPCfIEOEeIwKW+%eeMLnLp-?qqvmkN_) zq|h-MbYTTco}5yVN-NZH8%mTdK+6&EPoE+nxt4;~urD;U);dpdh!RpZ4C-JDl zt^#Z@=y~mFTV{Y5L+Cya2|WXoo9fzLTnEM2x6qyAtjrS4EMj(woXPZ{8(+xe5c z%y>N}K!B4yAM2diy1Cn=GLkxIL;m&sx!BAqWr~YIjF6(QVPZ%#G*bAEl)P3nsw@c5=I(SR0rx>F~wKGI^8!I?|qUB>JErYoO#y^XQ`D(e0g8 zgkV(N1t+K2#$a}InupYx@7fx4^m(J-{GLN_^DUKHDF%u>M?gYHSe26(sAZoD<2H-Y z#FtT%)l)&xKJwhW!C7@4e7)MS-OxtyHG+5A998y2Py?Qr6}k-@=SYHn?oIWn@f_Qz zH%W@mtH}(gIw)3Mm44b;CT8E@G#$1CgsH`ztKxh4COmCjx6;u`T{z4wMo>Wc%h-u6N3pL)>+OdfoSqi=^ z=C+4MzKz-B?ohI>MnR0R#$t zVYQ%RqTNS~OdM=9j2~t|-5d+U1BEkhfF<67cgV*OY1cIhNX9momZl-y#w>xDo=1&y zUZ(YR&m|d+O^L1&8S!&|wW;WkW@?E=ZX}84lxk-p0Pd};SK`t1E7;03=$=6&OgzDf zbHbox?XJDdS%*|yvq^G6J17n%;sT-LcfLP3e! z7EL*rU^a1j#_)Tl;i^5EY@`nV4Xi5-k*2gk zT;{oQa{}b6Msn?6a`Lj!RL2AD@q%=?r%}eR%w{65Q#Entq?#8Vk7qir3Z)cr!(4e| z2hD%fgjc&QG#Hx3dx1Rko$3M;etkc~K=;3V3$mUbWHF-E-s{I|AH{^unXFE#GESSgkv981Q~;UwJ!~5uKO2 zop=hpS2b-UdU-7};tYGT2;Jq9w3wPLT%WT~B-%Gb5go|bI(#D=kq4&>oo z7Fz|kZ$1$Ms|xH|g*a7Ei*2e6-0HWtZ(NmMJ}5adAHVK>N!^2Zvj?DI?~+TWcD=kw z8xINl*wGwyWT^d#{Wx|0pi|7{Ug{LQ_MrK~fwLt6s1adsh_z}1RlS+U*rZ>Ty1ZJ^ z4xAl@7R{0an=cJxdXsf)C0aaH99Cak)Xt8sMsI7+07~~3Uv=2@Zci%P@;~(Dsq#E# zm4jQ{2nj%}O^1PR!F!CRut;2G!>q?f?Nf|kj{8hwxsLa=X{zHh%p3Hbf~o(EMDAhn z{PWFK0XF_pOk9JUVQ=bXrD%2Wv15$N z^?k*i2{SKxE$&R_$1h8gXW?cc^^0;~dB-+4bmMm&fgd?-V4pW&BH!yzK8miD9f5h4VbhsaZ4}ruQ(=T8 zBxT{Z)YmqpnrhKNYl-g$3uN9vh{}@z#Ubbu2|4tj=czGbx%zViQqFr?!*5pYx%D>g zf1SUgElM4CA7U^ph>AP|obtyKWQ_}Ha-3$R%;yw{L6BCNNb5B&8nKlMzRAde z-@KR%d&h>m3v60W0Lx5BtA-*sWR9M9$w@B6PyhvcTmM1z-PM35Z#PAZ-k4ocT zZJ*&i_a!h=MM2oD@~+2b9me*>RB=M$98U7Q6&L)9#VUzkVXqGr6}*=V#1rXTK4UoA zj*2KTB5Lm4ad?9XO{G*@Wr0W_a!nLcrUS3>CO;O|pH}sPKE?Tyi~gtrP@#&iCXj&i zm$8EC+_b7+VPUN80^3Zp`)-;mPBHT{(J5#t=eVqB5qnnHw567Nb2&jH~;nQGtN^{-K~&Wa1%MayS}nP=}OBuS^La9hoUTq1@A z#f{uPK_fXu(O`mdYRYzC@Sd;4{YEIo(m!w@8fCJaD?cY$@){L^U+ve5} zv*xgqZ)5F`{0)J1noN%X0BdOQ%@dbA&6V_{j_A~XRC_cMK=Z%4gM92F&Zd^@I%T(s zfK*KTqX(zeHhe(EI zTI#0Rjq8jNIm42t_Mr;dCmX<>ZWX(#-;F;O6e01quPj8~2eDv0kKYuYTzV(+yCeIU zG2SK~(268LkcNfYYHY_QIMnQT_Uq(jy{W2A)|j)8%)Gl=GPG4X$7B_%Weqrc)6uq6@M54p86!$V-K zRg8Vw3a`RGNHn<$l2hZ5bdVkExJ_ZYPNtDg2)&ws&P$?yYIZQ&8rZTdLAG0}mf*1I zY;_l@Ze?`8>>xm3bQt85))1%|&GKvW=TM`%#Bm%A+10gUq%~%ImPR(&|6~>c9)8R^ z8CAp`QauNey;0zijINLrRzEfK@Ok5>YlN-vaD(0{gbmB*6k9*ZKrEEa&|q0_Sgdve z=5lG-Tj&gybcEo(&KK6IRXluk|r z+H>A1?%s82_g?XKAy+)x#JqW$%ijJl`Me+OrSuCx|4$Fpe+6Y=U}E9;|4LcYzf#ub z|0`u_^clc{%mZ{6Z)wgAUarm*a}cL?`H0IW7>_qLZam6ScVTWI3i}ZADWK~9-(r?1 zhp7EW037fBll!ljh5CQQEDUAfyRPv6N6h*+nJX*d--{kxSdS)MxcsWQhfe$V#jcax zgS#|0krnf1u?l}TNDPXAu1Gi@b>A4JPl~9TzG+}@i-k}79QAG+R&Rl;`|3uX)k?HD z#jBHIcH^k_WG85eY2N@IkX5$2ilhdBHL+xWp5+F31*H}%mM$*H%dIEU0;3nweE)Lj zCE{1iy6FY~6|)-0Uwk9^hDzll9-rR74)&h0#(%{ungJHbUoi_q0O98N{jjb7)QL?p ziv@$`PmM&LS#@H%UiD*szXX%YMh3(E%K&~gEV_ssT3|8!7`~tbPaA8EQt-3?9ilYf zstvz}rRK&%BCHk$5B4|N+1FsxXc51KY@kTEh+pgcaF}7-^1uBJ$`;(^)d35NDR|XT zbM`-m0IE@gAhl@22hMBOKAkpt(aa`3xej2tf)1S6&5FCU89=;p0W&0XQqK!H#+M(~ zk6#J8dr8X5lwsocLre^lfD$uo98wgqMSr1`$CV&Zy)TPh>{saR5sp}}oeI39xlU7u zh?tE7IK+2a4G{}?5W5d~%zYKZ!0Fr6O;u>ktrD$P)#@SiW9OVZ?nbQSRzXVV5-W-h zVC57fJ%LtHq8l~p8GjdL#E9ME{6ln}!q&ZTHiGU2llaD1r$Ai3Onyvw(Sy(7^H6lM z2OZkSf`TmXFhpDfsSFMykextNL_m53vYumydZmtDm?L}_y%Kj62pycF$d z%8XlqnxOPg##cXR{Sy((M>gRRo_C{+W$AOC$-OUzs*S}I4IA&5lh)qQHCvGu*LOp# z!EcYK`|1bB9V2+xO6$?nmYx+rS49s*7ejc#u1i?7n=hw)pE@lY z{VT-Rcgl%7&Yqh}yGuoIG{Cq>t~@W+jZ1YZY`eXMmDTS|4)~tDP-YF@3;0$OF}eyI zX$pUX2Yez#)2S-x3}aYWus$&RmT|um+6cs`;*)uiZwCBQyN}>UM_J$A70X zeE0tt`3uyCap;}E;jzZ1$2SA8J46*|@A`WVUlcdd#F=>hfcejK zNo9Ta8`&|gGhCFM)IRPqd4F?i`TAt=dMO~;9k&IZndh3wN!c+0GS0H|RQq}zV*hH` z+QC}0x(H`nrIqS^JA)4epN3dHGvsmCZAW^iASYk~n5SSId~v)9f7E=Rh=TC)Pp?z{ zN9=NK1{%Bl6}xuKZB{)Cmz_Et`+i{yXDi|bBwD}(@LLC(O$j1@ofdi}1Y4UBH(B4g zM=x*&heVNJ+Dl7x+Mw2idoLvx}Cc)Z?#za(r@ouub(lynH@3w|rh4|0qfv zkH?c{^3y|+%GO%B&(qm$IvHbhvp^aBHh#&$Gqgb{Fj`|)(Hk_|LJ)bQfa*8p|Bu#H z1ox|T1yzGBjiAuY_Uv;Lt#Iv-&{G&+czQ7UO=g8$|ImND(pNDM{SrJPg-YT977{2< zNS#7ba(iqScni)ol!{{+1C-@aHNxQgq6h4X|7DL}Sl80>*L0?>XCIc}d+Em$VNjBP|TsGivZ7OfTtyL||szVxJOb)Q2$O@urU> zG@NpK2+)U;hO*Rfb}#TtVHHYjyPb=R4PdHO9?AB5wgJD?0^=6dhF^sV3LfjbE0{>w zh>PsmU8jEh+l1tD22TL?ia^ZY2UR*RfppNuHp0Xy#D674E>suUG1|>Pl*25`?0-w= z>ZfP;0(v(zO@no%P4RD|`gg*ty3d^^#xjgHwJo449)(fm5KlPxLZg{>v8!i1g-M8* zG`RSoV)ty~$I74{Ail<&xW-PMywCt4vf0pyY|UX9kx3-N@Icf^q>SqMi=BhL=V%|Y z{3`YU>hkZgQSk5Cm_cvwEJXss%t_8hSAnJLp~le)6ds~B4`|CEi%Ygc*aQ)uwTZ%O zAImCZ1;P&#engLNEfbsK5BMts<(=cUd79z&Onn!&O9AdcL1ULO;aq3(0$KDjQt}7k zS;Q>wov;GoTA9eK0yz&jWEM@&tx`_;c_s?ifG@J~Y6yQA16&nGp>|$=vqlrPCy_&* z(eN;n+~y#;U6K+6^|=I0)q-N6N!g5B@I*ZpAzna8mF&&Rrgxj~io9EL-MqTRqz zk5rO#2Zh7!ehP@dqXAWO-7sW}7Rj(-7TtZ1$c1oSqWzf&k>gX-AF=HExIGQoA;l`E zm#Ka@Ky|k|l8Pdus0ojWXTl9_%gfEhBuad@ilNv?*I39N&`lA0bkY$mc9pa$8aVKA z73629c8s8!M{H+3&cx7;vkcP{tJI(Ja{5j?wCRQHTm)SBet`9L=L(SS1OBiz2kyH- z&ukSaSP(yr#rhq$u%CV!#*{Q;7w=NyTFzqOU(ohFwf+qQi&h53`pxLpFB$$XsL zCjPk1@#1Q2a??fxcR(hmBFkcIS3PHUyJkI{RIFg@{MpVZbLo;4_Tn|%N)}-~{SBn1 zl-JtX*mo9WKocEvZuyL6O*)TC{X$DQenY90`T`4ZrtLCk;JnV-ABqQL`R1@-{G>DH z@CJA4uR2sAi4PpilF6B)E}R~j4OTYO$s+fE7(>n`&B538t01sbemJ zsbpy}m;40wlqXwcPB;9iMBMb3fVb+!naw3*NNiQg)ch)vi5L>PW*8W^Yx1!+X*DVqXN z=${b&39Wz5zQPFAOYK(IR6JlbxPNQ7&Bq^$LRE-H#-Oczl)jGLwq${and8yfhy6Bm z#=34R`{WVDg_-1ov!Vg^&z{3xX-Cgu_(-Qhf?yF89y|ryo$e9`?7r?7dSeEfyZ_V6 z^j}5H7})9mmkncBT{`ynUg&;NeT7p)c%so`2nCY%+n&F!KGkq|euO*yev z=Vuzf0t)a)n0z>jC7bEbA|7p2B14!F*tLx@^$f6ssU^d)>3nrWQP@Rs#ir)n9sHa3 zTfYJK=S~j0FW3>CU=Tc7)wIKtLh`i`k#b6T#Z!hm~OQo5y?Ey9#6M+Ft4j^pfnN zi{8|o)PE1uQ%MJ{vRg;3^lbFi$~juQMpRa^f^Z$fD0DU6h7ZuK+gI9viW1G9rCfoI z>1?xKc&2!^BP=R_Qs~_7j|C1;=)+Afk#aHWM5(qb##meDnynQ8Oplc#%uaD$0H#BG zAhBpNCy=FJR)0v+ldc&KI?@7Dp!>Hp(HON~JDIW-XaNELtswWp;a%-B2n>Vxo20Af+Q_<`Lre6E}brGkxWxCW0o)EFVqHIiM`qL3H+alhyD$KypDc zCt(V-Ke#*|pCtdoz3Xc&Dmr1(N!utk{B5zA0Y z)SWdht2tsq`C4;G6$Hy4FJ4pZth_?mMp0Y?qd^hS1sZ7gE`rNlCSKpKkDI*x!BXy& zVty?;>_sx>vhN}MHVLiQHvhOUrW?uA7l=rXq#XPyh;!|KtsSiAQ^Z_DK9l|h%2;Gk zOc^<*LTycPvD;IDN^p>l&i^S!lbGPXhf5GeIq7f}`$1W@-5`;MrU~=C{LT{q1sk^C z^nOZBeJ;yV>}7IFdN2b6rS*c0<}rU7T9%03FtN~Lj1aAGrpS_PVx?xPkyL2XMW9Z+ zbb?UeP0yHDUav3nVLw;xtc7{8ZbUvn%O)OboTqf%F2QE)Th5{6gQ8N^UlcPOb0|*r zK=L?49>48A$21XSaM_-eelQcZDCO46w0OL(nm~OD`S&6$=p+z`(aCLJ3I2G1sXVYr zIzOvFnDB4xl#Av2Hqs~Lj<~Ve|0Jc4@kdr zZUk+sE;z{g>VZo^Jvf4S`h!Jnwr!+-;fwVkjAxRf3=r+ z<>vK8(seg6_((f1W7(nSo$j@>=JUGYf_CtRmrPaj{TgO9Dv;)v(i z=5L^XMvIo$HWBGqO|JweKp*&7%U#BDVs<>A-g3wr^g(-bl zPj57ZJi?0@?`UrWAh4eg-Gpn3AesT@M)$5C?eoXe@$1a`^$v~C4{Oyc zPT0>3z>wE8QwjIrK`j+u_X^4U9OUk4w)XN1IaZ2FIoFRC^y<<5%0_KqBf=G9KFGxL zRH0coQ=SzQ+;BOZ4nz&yr!UVdr{>~4y zFLbYUaa8{I&v)_Ln{5hA;fqX=CbCO_c@%x58{S2ti+}ZkH@5wvdBZ_e;~4p}#yTlG zTZsDF1ga(tT#Gz=0N`{Ef`}Yh;3T{r(VuqQu94*Ok}tgnBAf2D&cHd2(w7-om*5 z4)TF1q{Y0k7r1nMdqYX5c-d921v4!XLG)_bDvcbmy(HRe>Uffxf|cRS@Bkt6SXgmXHw2(~C!fbj3|{<;tcdGj@(OP%JWxtaP7Zd%mh zKuf+7j`hx+hYp-T-2?x}v6|e|ZJ_TuB#d+&;d!6V zyayts!&Of=dy>)J_Oq@xj7e>3BP<%U(AYhF7bUJ>2xreNbV>loR|slV5h_AUh)df+ zT>Ii6`h+v@x%t~=DQB$mtgUunAjxqgRaQX?B6qwsa4wr{_`rT|JyWSfKZb*kwDe`G zWCl3NC9_Tiow1o*`!c0Ml^DE}X2x!#M=N8eS}w^9e8XB15?QONo>nL9Kd-X-4%HV5 z9CYwAEMKl|K!H^3uQ}u&H9U-F+Zg1I7;MSFQa9jMKqXi={blH$m;Mtog`u|uWmf2g z;y7h(i^-Qw0$o%vklQRK9SR(1Ol6!0NyMJ^5IXpGuE7h7poe!5T< z*7TbG(7z($#CdiE!wC4V{GCo(2XF{Bvu`sJ3@CD1G|FL*BuneGCTN&ff8&e~!<;e1 zbKrxB5ix@~E0m$=enSTFg~=h=*%#aXb7Z?T2-&tk@jnRT`UmeDC0c~L2sI3ATq>{% zRj5~~um1ECyPs}ZIi2FmV)kuUM=hdU(ufo`7AYr0eoLVVS`r`_c2``L&>0qZg7Te` z=b5ZpQEBDXv7QIb?H%grP+8Q>eZo}7f=My&P!t*!Sd{O!l~eiX#>(VOtI-+it5Iez zLh1}m(hS7-HUp8ThhOcxzEPQ8L6Az}bD)%m5*hmXZ+c$*09u|b9JRz5G!pm?>9A$e z-`oXo>`$Yu{)*Y{5mJ}z$##J~2x#Miv@adddt7P`1}tYdkwwaDmOtam7jEUn1yw7B11a-V?c^iF);K0_4X|Z> zV;8&<3znEFZq^*=)MrEXC#*Vs06!;ZrBFZ`vZ@HnD%E(qjotNmw|L1pD%-5Ws94?< zIT$Mi>>k_7Bx;1%8iMj-#aA!1|6bIsOzA6gG1OAsQuSKgLqh*%!%fK{LO)-``s?VW zFz%?WFO>tU?G!sHDz|>;xGd_dKvm}lSziTA>!|K2=+jJ-3`KD}|3EgQl=5nppUE0l zS4C(+fTVWZXyODj1hy*>M%%9_<0G~y37Sltu|9ZrnvARpJR1V*Qz*FP+MSIQKfw!23#m0`V7xJpH>su)hN7O_5uaEvw|Z)7cNWl@&(4TlqdpU&Iq)O;$#o8 z30gg-qrPflWrn_M?!HrWZ%39IQ8bfX%1?1_KN@crW$C1ZFJ4YiMN{NY)j+&PU)dJ$ zX@Zhqkl_V2z!HE{qb$($fL^PgCq)5H75hijbv%LO_WYvjbxUrD_6?5@SEBS26h{ga ztI#R|%jnRk$f0u&8<`{Jrix46IH%Y@;OjcAs$u@m4Zx z4PFqv)1zYvwAbtP6vv-v#;ln~;6o<|KsG#Pon6m+O}H1b^~?nTpOalY950sJ+CJ~Q zJ~3}%(f`40u>V&>n)FO;|Muh8srG-e%xdFp^^Xq@nB{n97sk7icKiyV4QzqC z>uVt!2y!(8*x5%@Ep6%B*<_yHIz!nt1)Vuf(^_{(gg!4_px&+qJaB(~K9wyl6742? z_?1SAGKZl0D-B(Dut;(Xyc$x6mWf9Y;cj?7Pj&ny$qu-Mt%hx>3JvIb^m;#rI+Po$iefxkjSNlf?Zf5Z34Ke z)hVln=+#`iF6KfWqi_*s9_;MT3_VC)0)7yVRE}zX+f(!{mNc&Aa!=z@=cSvmJq;{M z@VEFISK1Ss_|DuO+)Tt8V{Li{T`u6wtEK_Q ztZOH8#&$KP>0r`b3_0rn78Fg-3e+06$|)dL*PSw#B9bamic_JD-6@ z;_=))1gu;1U7vj(QSgSnnScr!a?~r>8!@3IElF`k6~Csi-5`*#%2o%uT=rW7g%#IIEsfK;e}*gQ9zg;$ z#V$cBrQVk;2REzG1V^tja>iXpK3a{_vQ83!MTM+a6i=Q&DI6T-0$=K5Yz-4=cL3C~ z%(amWPi}5ma+C#9PI3d(MF70Bf&Bhx)P}iKgpi`4c5zSjU}!$5xe!TLStd(W#aLNJ z^FgqaX`Z}AS*ruxY1WoUXIU_fZ#1CTX8ahy6nq&CDe)dbUY&TEj(sS$%gSbPlrBwr zBweexsMFun5#Zckuzu9wVmv%X(@9_?f)f0W=!#i}5l);a@yuQJzbe&Ys$2jQ(!+wl zw0g2Z73!%QlkFD`8$hR4^JbI>>|C$qiT9{CEa`@hCPrx{W~uFkClTZ4AzB+ZWa5AY z%Ca4Tl*9?jWBA11_A&XWz681>1EQGgSWX?jGoJ1WH z{Ov#|TpARXO-kNct6+*5IWX~hX0S1=<1>dXlb~3jpniI)G6qV0)IYrmS2+gjXINP< zNH{c~LR4eCmJu$hxA;>i7w5Ejap5r0jKj zJC~21R)JukbFp(MTg$;kaFe^isg`vYjR|i&rA}d!TS7_{y8$Q?G%!vW+;*`@6sk7R zWalw(a6_3^P|0Mo-W}IUY0K$(k@{=w8J^G5k7RX*G4X?(LCjo? zWnPF4df(XABbTAEX$3t&*0VF{p@ z@bOiD#MCNoaPsh6uS-mah@37?JG^AFUlE!oKwaxmAujnD2GuCbm0 z9F~$y72ogXc|U3T+Sb!|i%X?Kwd8vAarXvdAU0Axju7sOK6>)Fb#O*fsel*nK1_?4i73`za3(3FG^juEQnS z6Sez=Iz%TJjE+%5X9u=@M<-_~kMYbzPi@+QkJ-kfx zugH|c%IAIialXW@r(p!uO3QojEgRsNwIQ0c=`Wg-kY(x?c??=j?)%R=zj!H$=TzIQ$=+Y}IuCPp zR}N&r&$2lW+@RWEnhE|4B6jp982dzRs6MoDGS99$U{N?tfR7TXGgA=JfAasxgbE4d zqV&?`dBq_f&K)b>aSlNHMiSUvrRxDKNBXBzSpp`%giaf59QBK~yFO6t2H0nsjJ01h z@0FjX$prYLYXbqzSaCXsc{(rKa1O%vWZg|eqAahHoQ0RlJP3$+(vT^l=H1sGuP_&2ORM$akYiWj+C3 zUcQ+@Z{dlk@&iPhwWot3nGLLJ-?)^_ z=ZP-j5&0=DMiRXuD@M4(oFJwfLD-`se)O8VVHY0$z*TS>3Nx=}1&+q3okb1iUIqrB zB|1yLIRO;UgmM(-PO(=IH!MPcnFtfcT=qBd2ne3Qr;q0lA6T5c2(P8)Xy3wOSBc7dsrMU3JP9rQN;@O|6ScG*z&!u(`I{*dfI>A?-<*k|fuB{A z2!p;O^o!J;y&zds3}Aiot#_GOF24n&3YqAUj6A+hiHL6eaD)RG+t9*xdfpyWUyqmo z^^bVFJ1|3kx)Bg+!?&C*T+I=_gdQY}-gG&hDBGTdNbIc(K)qMvpXm0CY-%8EOymGa zlWO6k(V-mITtgi$=dLV>(LX#fAh{OG0^WYXd~Iut{7IFmg;F%+*!||sybA$W4Nujn zIpe#1;0rEhsdup6Dd~Fwei-1im7{_V;Sw8IRcW?VTjT0#iI!M;j2;GKhKcHT3F4^% zL@lyCj4ORY-3crNzi7=(jgcO}+^qGEXh>f}%sgejtC1jR&M%XQ$oRbhQU8`(3h@i9 zmqewTlL{azL%2yy8@R`y*;4KsE3Q27-Rm8awi@BA?!8m;o>I+k#5kEnFIER~kHVq* z=EWtWf+}A?<_O#A6>2bpL)d{o$%#2zv2V*aOw9M<^B^$_e8^9-7UeQ7P3m3Fz2w!5 zw*Xy*n8)w^^)DPv`YPK|5Q(=SbnopXu`mi*HyU)MqK*y2xsPoFC%JPdvDdVhc+bUP zhT9?SldJocvnv;!p%tX^CO$!+FAIle7IRO?Zp!It^%kgtOPEkao`(LCjv*;hPG!$a^eno*FGN?~MUdVA5DM8opmiBHr>8ct`zH=0 zCE>+CS`ma8S8`P7q(qC|$gm1)WFlH71NwIPK&q}?-ks!g$>cIO`HCoTWVPO%B^}lg zokJl?gC!gZ-gQ*QXQnBLT+jfYk*DT*l)81l zj5r$1guU?>s+72$&#)qS7~-LPo$s}|8xMhYPIToTt_Cj7TLp_;{?`wV+y=;{GoX>w zV3wn)s&mdjKHI`*5HAS12RcSqHE&Zl0_uTUWMR{j^s+0$sM!fC$Dl!F(&pyJ(_3@MZKOG8OG$!q!g)tNqV5yKowLQ z0`t`uMj<|9{wB(1<+j)cj5Gper#qc-7j~gZ+UTWj72V)!oOPx6b#cN$ z0%6jS|ic1{1|}LttYeJlSIvkV82DAY|e36r+TUW z!5j(t$bh|%+15b%7`affb=qH?P!x6$e?E3)ZusHE=)hj_LU9KHw9omIF5l( zWbiY9vQ#WrcbuZK;j}qJnM^9sMJT`{;R|h$kPSv!)gpjbco9ZUBw-4fMOXt1qbb<} z0HW{B23UWFqndWtxdm%pKUMpZ7p-;9X8>p&K|6jIJlz^;8KCq8_7W!=VcY@~q(0&J zAxeqUd#x6G1uiz%{z!jl#SooiES)ds+in{uYrgyvcegbr*=V8Twy~DWkvw0-76+4! z9S^8EkB%_FxP$L(J98FuHUk zf&jN#SKtK0Ky3}ma= z4@{&PF877|w!pT9DQo{(&pk1}haCaZsy$Kr8J66i<*vb3G}kAHf(ycgur>Sbn}|ytZ!{&$!^s^ESP89WiIF~{xQjpqQ`dUIkjr|hBw&W*em zx3&~E58WE=mL%r*lQMDrhd`OQSM5Nv0@UESN(E^zP77@WvycW-x9En;Zvhw(U#o1A z?NP3dVGxjUDvNQ85;>rIViq;x2>WoMES&);A`9qs3-ii$zbS+(qg9vq6Ti#3A#Gjw zw)id(YmMQHCii5&*HDOi6|0oQ$&j%L(7e*uJ!Z^uKARf@Qz3#7qqXq`$sniX>U*(| zicl`2NX6{hHBTASSGfImv}HiDk4Y_wz&R$ZN9oH}3C>XidfXNzcgo8Nruj+A6vR1; z#BMOnDWhE#wcpPH*KqkIUorh1=nbgqBvB^f+|NRYM|$U|O}U?)&Gg+&Sqq~JXBpey z7zdQ-yiLabEu0hd!ecEK$(YIa(yS8jSuJx%A*ep1Xv&7kq*7@WFojs=C>!Q0ql6{= zqQ_i{FhfI)=v*18@;RWJzkXx#R~E4*m6D6}Ow7n2L?N1CmSevK)gmftr>r)iP$XF# zsQ5m_S=3>jM$G2S?nL&HX%|FBnGtatE}PqAE)GDg2v883iLjC>{ePhP6c0aCYwc)N z8Hjawy0&(gJk{f7jlcYU;C+XY_m@%omF!C+TSmFm%X4;CIBYyOe4W!ex0M+&TPWoy zQ)T;Lo`5FgY?HB}i-i8ELkmQ~*E=}+ShUa8HDV^ze^L8si}J-)VNO1BwK<@P8k*K* zgpL$OfmE^+R^+CZC%`%4_Tp`JDvP9tuJ!#p|NQxYS*43(H?>*w+X8Y3#s|1_{P%*`Z#l5TkQ56 ztZood5$UR5*<(w}xB$HtxV?jMYw~9-95}*g?PzNe#~F&@{eZN!^D-C#?bBCdSRsgnt0on!<*AvThYI``=a&_&Y6EiX#fO))6Wpb zlB7nvbso2t`A3v;IK+FYuEHhY1%&AN$&D=wDB~O(X$lD)#-aDDe^kkcv2+Kp&@i+Z zbn^|Fw%iMkOK_HR6`8I`iIQ^@J#oCl@9JC3s{?(S4P38pXHPz2Oj-|VeoIz>-8d@q zOQ+aLslsNl+&?2vhdDSepb)4f7kBEVHM~LRh~nOEi%*=S$RoOS>L{0(vDhT~{#-rP zP&_WuG1xIH5>zsLLa)WNma@tsTKoYt@(nE!|IO!6=ZbzvQsdRfBB!U5ohbq<@l~S6!zCR7YXfZ<*t-PFJf+k%EtLvDx|&B+ASJ12 zsspZWxSLsTCt)$1=* z0rH5Q>9!lq^u7D6_W&>SUp!sciw;&+i!mxHEvCv22TMy#Sz$yo_CBCtcgaQb3R6&i z$R?&BZ)LKXTbVmcZ;qD46b3JHl`YR4SRxKl$S2zOR#Q~q!e_B%v`5RN1n+QSu+OW4 zb`a7dc?$B<(B7bYB~dk*93>$jn=psd=K=b=OaDGca-HJJ5CtQ2BlIZpKnQmzKm@Lg z4OfSAOr=0$ns4V;aEgV$Hs;qUwMukBp4h%6cYL5+=^MIUJ55=rWFK%ZTAN+*vl z6;g2CoL(q4>Llkdo$LV(1d6@QT1?7T{xHomu+U-rylpO`kX*L1OZEcBA{92erx4Id z6$BCEY-WjyMP62YQMCkx1>WDn!ub{5_o@U!60{j{A<*XDMhZ(h&qlJCT3_3AM;pX# zI**!-b;-4p<4MkUh@?}#Y>K5I;w&wDY=DW6_ zA%wp`QlIC%qa!K#-_6+81)%XpM>GIcEqL$V_YMC%QMSreODFj^l!w)k$g+ENwl_{D zsT8HFo$%yiE@oeU-GZ2vtgUHn#YZ7f4~A=nWiV;*QlQnm^R~_Q>_UF=MVv9Pa0IDe zR*8lK;xG6MpY||0v7q6s0L?gO>rx})idd1=Yb+7kVgwv6bR-EBu-7GWIYqgSA$;Ep+sk`hz=i;*_M-X(zywXb7i&duird?gP61x9XI8a9(x zy@T<*KFZPY50G5+0`ai>vf%fjdVQAR1roLOg?&pJ>y9;Xu?X0t%Evs8kflWQ(xM=B z{M@+&*}zG-RmdgCj{>nm!0reIfd|tXi|a_T1hy8qw>Tmw1ETYOZ)IblIA;xbtSJ+9 zz9^*9bXDlMMeLGKOvnK`JYEk7VaWaEvRBdHFoBfqaBCFuc?U+d+Z`@&& zN;8V1;2!7izR<-=3~BwFG$un^Xl3I@wE1uW{8wR;Zn?|VfQWR**;Q<{Qw$s9bbnV< zT(Nj(AydZ;(Qx7E2A%x`AI{PfQTjfAbRyK}Ck#wk$Tp*#6i&Gr*;;7ze$j)Jb*ABx z(D=B!N}=MZnbPPnHd-rvLWicdgqtH1+EJssi;gDKw@9T{NSGCiDFq6TSChVLo{%Ma z;LS>7a%*QQH1|Spx1Pu{Dv%~zToy?>$6!4DQF2W3Bjp_h@x5q7+dyCqA^b- zd9Y=B?2DK2(C>&*I{JtMo8luQS(h=!na1K*zOjqn#j-_{@d;#ad2di&^s1HG*3$!h zNej?NYf~|oOY5f#7lh@Hamitccyp0mCr5L7#QEED-JItdk&(rKFf+q-_y`J9FmkSS6bw>l zBsr<-(&j*_T7{+7-SV_C^>jt##OUt#DtL7~x6aL6J?JrCvt9~_*KYQde^d8p)Vf^6 zDl*R@2UnXNE*7xTWA2pDtD~n}HYrO!E5si>o+fE~r`4a5JmGuIT=_gSOGoB{0DnO z|KHggCboZ@9Blk)7CQLfa~+elFC;T3K>)*i&N9ZRhO=J8Mu@ar86V!^hJVE*&Ps;S z9!?|(A_f(&^NY7h|FzWdGlxwkklE$k58AzR&D(x1yItJ1ne@4P_w3`)J75HBiZo=S?KZ7w(`Jsz$+_3*^$8SKMX)G4V<1zGROq) zBLW!cD9z}Yu77(aA#0*Tu%!tg<^8jTjbql&!N5F!Nx@&0;^XuFZm7hk#Y7nkZk^R^e$o^#PU+^XD**DpvHGRMe>(C)9{)nrG%4Z4->A&IiR9#tn~0Z9HuAU_?99t(HMOu>SvD}C^#jEx%#s({FHvw zZCZuhUa%AM88SC{6W$v)IB{_Pi9|n9nyS^gL_iVkZ|*F5%Li`4US=v_g*W+1^C|{r zd7A|skMMl7Xs9CeD(7j=p4+87VP3?}#%ZWFJgSc0xIeNiVCzWtkpp!5qz^Mp3L>CS z;Glp2?3x6;c+K zAo`*JIt8<82-nC$LVi`X*Vb3Rjnga@|7nqU{kPEX#HP zro>Q~Ih_jnSee;iD_~r6l*ys4^SK?VOHs`%`XC7E<}p_jsloVFu)$2BR7Ku%p=sp2 zZ?3}FP|Qe5GSU>&JjVvQZK!oKCxggqZzvHSpp*HXem_X{rVW!(MX2VP=V>wCLf4ui zEE`GvB)t0Vq$Ph+s~5P80rKxPOJ*XyKtTp^Av3rbic;Q|F_LmAyEswK&Z+m7%F**X zCh4J_u&Sz5Rfv=TY&yuHnX_BvPGjSQ2xW>2N)m{J%2>!b<)S3Xq3!m$4O(pFs*uA%DLdy}(8PmP8q*f$ z&R6KAP8kXoe}wEw-Vxk2!1%P|cLL-45(AY5lQfEL8S5r+Zwx3q$EqZp>$8S_Xcg zxQ)?CEV#y!|@Ba!M;(erv6ZNFi`7*aS zUuC80Qm#3ER$*w0<&?6;EG~=PWf2mA@#ld&oAt}~*WV+1!Cv~c4ZRzm;*v-m-`O0o zq8#=2z^WRv-^X*nd6Wv0g6C?BI87jj8_gi>^Tb6VZV!zcbR96nM?0eRn>H~lz-qi7 zIS&1o{nym3^L^(#Axh(DNfx#Wx-qAub-(CUHieIAYeo`@if#;RjKI!b!Nnx?s{7eG zdr7llky^w&?S<~~keRn22`x~FyCqtCt!+170JpCTkG{&TT7y~Z;o=YxAm!^S2?q@$tmAdeqr3 zM3hsGYsRq=7ptG03zxWi?()OUtK0JE;ECa6h*OnpX!o^=Cn}y*(2QkLPTrJ@EPGLs zeTE|0+~0}HG3T42qQ2!gSBN7fs#5! zfBGFvSaPE=WQ%r@Rxs4g14nbcBjd76>Ub?rg;!7<9`3apU zoDRBEB2=5d3G26s?dG%4uFjDtI5{gh7@Imks0oJ9j6gevF{AvA+O5>HlLn`AAc$|G`-)*dQvvON(1Xi zIR<{7xlU~JVUbCn_-cz+>4#ve2-vRlHMGZ4S1;p%qG1D9D?W(TClM$VQqz|w;@L5g zH?N?1LmImsX)-ziV8z}9DehtKwD`}uT-jW2l;EGDF&`&WE-@MBH9oJr2-_T6|H=LR zcfFFVO#fCQ->E4cbKU~qb^Oo0MgN{m&ka7GvF`@Ssb*|IJM|>7Lu%{6bqHrfgyCup zJlDx+d<&ArXZeWEmzrMQ6)sgewTAkii@V2mkK2fLZ_F#7Pc`p1bsD~~B9!D9t5#p4 z%rg))fWhRL;qK~0|2Dg`E3J*xZpI^TMVDpPo9P>;gs(<$UfM{;XCY{iOANJbcm>hz z(YNR;1f-sq_Um3R*wgH*)5`)W{b%D}@Lhkayj=|Xmk=JsVlY9PHorb^pM~l6U;3~? z_wG(G${e}zXy#d+w3nF>H&k7`2H!~o`M;k2jxTzC8{ltXw0<<(DkGj{`{)KL2w`Mr zf7gFFygFe8mD+#qrySkN^0L5@gW!AsW}?lQzI+sC=^?cdh_ruY!c$8dLKsj{C9L06 z)rJf6TU-2zTbuWvStZNQL^<5T>wwtE7Xcm(7%&%xG|8#VYDr?1MCA*Fb3Hwk9@hMW z%=8^H`<|j74GGkj>4=562|J8B2W3F^*l*Wvy%ru26wH*~bw8ng-wkX(Q zUJiINR2OHKEnqO^cZcT$%Qdyi7L9yBCeW{u99M-H^L6>dCPy2~tUif*Dp}4Z$Z;fo z10lTgscHI(v1@tL7mQ4+9nB*8HER3!%qE2${f{0bogjeO zRsw~U`W`ura=u70Yb=H|2>M-l%#yGxGdIR&Bqo*$*=SJgZhcL`7Dx!(LaTzE{04*N zaw{6PwZe9#kVQ5-Hc8YL_)gJlP^NNsGXxsjl*sE2gOw&rKz@4D#q3f-R62ENsn6^r zS1_3{jToiC+ z(L4bbJJz`7=@3l_*eo(x2vK;uETgwwjdw`(rHHWo19Ei|Gy zLzv`I9HU3x&q~zuKN$5}oSd_8lMr0`ut^xqJelysl!0N!Y9D=ua?(V(^ploS{6vBV z#kXv*-RQNeEqs;2`)eip?l3X?VxUR~ln3ngWbX=LT!;$>0@?T%$a}Tz7^3aAG+~aL z7)IQ=DtP7v4>4s%f$H}NojBnhi~*n`a|Rt_a#b+$hK-8flcgEE_(*^x7IsJU#$NO*{Xj<#cAJlh}H1Y%P~ zBD(J&x zpgO^S({DjGRFXB)&8Cr#Y=?-UWj1Q=5HV)GS8?9Wko=TzT-z$rI|y%q(dE{BnrZtK zbNXqr`ff?rrD3CJ|Dfw-W>`vKroWC2_K3L;s~!XKB{0%5G70b;1as^&hM|1s!*JMG z4#!<Ig4?u02y^TalZE7@@rP@9P0dT>7MUzh3E!|l;rl>ddhxu&(#V{rdt<;&)%(;s322_4(Zi^zQ!{5 zf-9xrGgG+)(FKX?!2?HB7Ey=oBtMSb_F{y;`X&9>o&$c$8?SoGl5Cwz#B!_n)diQZ zhCXka6@1D6z#?(iODo zO<)=jbrs0dnqCDlJpGYizXJ`a!`BZqkC>Z0a2}DH!%^@TK!Y+gU;$-VIds7t zxQbio43x^yF?mq+7i&)q0$<+(5LjY<|N^-?_?(f9?(NwoiYPy|naDpcuXrB@lJ33$6nPSR{3X8{;mA>?rUPEf zDLw4r`qwy7CIbxr$=CRTm%jSJXk)z3Bg^Vkc?Re204peRz`~A2`GrTj^k-zv3QTdC z-BWSZE=iX+G^ji#tXzUMqCQ1GW>ea$Ijt>@NVFC8Rs%O&#ozBx2U~+^8RE9z3eV;W z6m$Bx)zS8NRcsPratO2_%2FJlKEs&LW>A$xTE!aTQB^S~7_CgFaJeqMTtN>n&gGN0 z^QDspb@6Bn#r||g_c{|4Txlq{ko=E@6qf9F6G6O*WELk@eWF}NF4Tty_;guo!9ALV z(!h3(uLS~H(poSfSygI|<&9-I$R~3GG#TgInS!jjRzNJUb7_)TE79M3J+QI3lLaj4 zU?*hS_{RM>fYYHBi$IDpndT7Q?nXM2zsL(Fh5HR1|GqmivYDA>e}xKK=%|51*E{$N z!dupbxus6vDlz8A&Ztjf&r`KyvC|^UletNDYlFhLIF-Qes#$_*HI-;P`Pf?3Vq}ts zZhp1~@GhqA5R-@9iApnp{sEps;#KF}ctOQMog}lX96TZGUVG(?x%xWS{Q|`or`P>Y z{`bGCMrB}T{5StQsW};a&;s3cO#T5_giO3z=PQB@XoxyumCyykuGBc*Y6#o@(>+Hd z&s#{XSpf|Hmlj2Pl{_zs00NV{qC-x2dyW%$|JAM1^KI``$>i2!kQ3!3Bx{@Bbhn(1OV^((wf1?*4|Ykp zOXs}X-yCSn9-XE&09x6exrtq%I}Cz~+mCU^{_FkUo;&w2cCpqg` zzqd2%W6aXHUXYhVh}&4(+K8ZwuQ7-H( zE&XzdxCqYcGht z%0|PIs}gEeK1aOje|iq=Yzbsi;V&MHDcKL?PKy3=0ig(tLgOi1@?y5Zb|8vYf0iNMaG5|X zZ-D(krjsEBgI0o5sj*@&y2U9~QVVmUG|%)N^=7Q|BRP`8@N{Havc z_i~IS4Z2V%7zXnCea{%mgtJi$y-+wplXl%Ec^s9QFN(<|!M57t`bP#}c|#L3a?E`A z{3P~J)^|pa*!#+ibH}j{IQGzCZCao>9d0ekR}6t}=3Jor4goHP^Pu#~wrPX;Q8z72 zP~OALmGUT)HCtM#spV&w?}BOg4mw3|BvwH8kswUxA5?-*_H>BuE17> zH7(plIgmel0gVxoJ7~1;Wa#pcIR+;bgH*4w)zIGd85|Gk^BdjMXt~yMc@z%->3w@eV6)TDu zGMFZi#O#eKIyO#WFV&qi2+ohrBdeXMtz-{7(^UNcQcAAmLcDGwNzv>Xgk8A+6G6~C)@Xc=dy<&2@zr=HwjID>emxF9kntpbz^Gblyc4}IOvh* zqNrOYlXoVzt5&zd(`f!--L#+OW*uz8<=`GofdbS_!!8sFYrc9pYuuRzmI_OnDV6Am zLKaz3PSD(fsWl;Uy+8)b;-DsJsgG{Lbsx|%gxD^IxK&K}pG0;U8Oa#}L3@p?yI+9z zy5sXO6_R<0B@{2HRI)eX^q(F^c@2q!`ywEj-lZ2a3D@z%mIAZ&b@0OzfBYBuo%Q1b~Mh58a4xm#alJY<&r6D?C$+mP#hR@%4&2*0+XTDJCb%5*{ z@|OwUxVttuz1dvcb;kdpeY9lT61ZfvwVyd)`?dHx9odlNW;Kd39rBCbi5Uv7&rIGN z?S_xj84RzJDX*HAy0_{oQ-#fFHPM)z_0X+_t}IqLC|sEcT4JS#sx;ve{LE@=GRi#q zK$+rWEv}iod`W^`{}XckM5}sRa#aIKgse^xmbyHv`SO;F~WfcSKKJ~pY)vb5Xq7? z*8;WWT{%$4%46D1h#C>AeWygc(JF^OdBf@x-YL zNV=h3*39N_QMw)F{F9CjaQsts8PsAYlTxzXPUjDHYI?^Ek={6<+gEvV z9+}Dk;3H3J?{MHrpRQa)9rA8RR-xI_)l81Uu?vfPQAPYm3^e2KF?;dG%lKHG*9?OlT@E` zS4hy@RY7_8iK(EYW?9=Mu1ThNtxK;avWZLyB9JWBp;oHfVD{`4g2_8O)IL#{Gp3as zA&$>8F{hZYg%wABEsoa@P4RSRuOiPql>6|qN`TNWvep;4l+Y5g0kmmVHs}bD4xe7- z)RR(8?LMC53L800w3E)u(?8o(qh0GRbVcU*8{Qe3t!N1f1GSQBM)m6^g)zfM9=2^5 z9xMaiv7RE4Z-($djAP_kS;|Nt=9_}pc&XHO7Op-?ECL>okUTa?jUl@IZc=Kv!y6Yq zP&0D&ct#>R%^Lj!g}B+QmyRcDWGTRjS$qh&-hSZ~t_~9hTaV6T-&OES#s%hZPE%NB z(-8E{zW)fpOpUSSND3?+xDJVWUMn4m$|y8(R%O zYiQju?6;&imJE**Tls}?TJcTz9^+`&xXgvNVsPU$f_rmH&a%EbxRJ;Gxi~qM-$>`p zicrG3oZVZE`~+M0=o`|KIb3~S^T~A^w)Oil3Tj2+O)Eag6hgsuDdC}9odn1omHvEfP zRzz=!1|%)HDP5;_uB!Y|l0(WY{!&t$Te6c7YS#7%%!!Y@y+!?69+x_28AY$mSg=8dw?HmDSK5^OG{&2w zT~IoZM=N%}8Q$-V)%OdNX7I8S6jTZmNos-uL-dryS5H%hnP}6}e@o8cdGTgp+0vDd z0XTt>Z15w}GU{A=jSq|0D+KOv8j)z=P4W<0#Wp|UnR3P_SMjOR$9vHfDM~~CFUH=n zNwje5vP|2yZCfYvq;1=_b<(zN+qP}nw%vKFJEE#O?uYk3?1;VAdgdG>ClA)&7<~h9 zZ4bBBQVzcU>^&kog}Ys&Y7o4x9SDCNBxWD1{-~II`ncPJKg+sUY~M5HK1-*4am)@W zAxon)L-|F*WG%H4m{lg9*U@wmTMzqOF z3V_h|p`AMCJTF>SfkTeW97}rBBR7)7r({$`ZT6CC5j9d|FQ$N5*XnqtpsM^B784GM zDam0NyE!0etI%((RL+`1lP!e*sYySgV6&Xtmasv14R*TvRPkosb+ehROUx5Pl;5=F zQ|rN=p^S9gChJKVaXm46b5X+Fd_cR4c~HND5=aL)NA2Xcm5sQ4a;42lMqU5 zr1Wzxy$L*~Rd>z+Nu6a9ZQ;wM`yTI{XeYi7HqV)&O$U_pWZO%q=3O|R|L}cL@wEL0 zr>Zu0S*xDrrqL2YDpxjn!hT%EWgj?N4f8G*k&=Gy&#ZW~zxz3fvTHmUX&x$pDQ#wW z!2(yTuhpRr;I%k2iLRR^cNcZGk~CEbCF9*9HWK_OPh(LbrI=~F(|39eLB3LRBnC}@ zYLHDig+KpAFHk{t%G$Zlv@Z}S;#gzQ0Vf4p5|Mq=5yQU^LOT^)nBY$uV1sQR#@4K< z#gyEuaq4-rl>wcKT_BR~0Hbqbyj*Y?*V1oN0eU;d0R_mN$sP%+*qv(){!^)^ z=JKd-#sm#*c21~Mka5_aDKH$xq0~SZ%is_ zOp3|^S|Zxc!lbIo=e&)RsY3NYikfpRuK2|289`;&HW|c1m{s+;$KmKRVT?j}I_gQ` z##!g-)vL=~nVPj<{t!D5CjqcaTjfar7RF{9kcQXJ^;A&s1dd89*$_M!x{_+t3UQd! zYyi!b0;QJC)0z_zr8Kjb9!2DSBWbkVb4sdclnV+@F!6T;pYza3W$MAJg<5jGy?&XJ zXm1IMS0>SQZUTH$MKJ#ACz{;lL%_u}Pqjuod$x+a0@GzmP8ds9QJP|`KWfDO5@^~+ z#$qGfurP5w;Ro(ztKyDJw5JZ(^w46+JYLy?F?J3u!vQdAQ}n zIU86to#G*UI`X1?3>&>kbX6ucB)|%Bqno{z^acJ!Oxv-RL3!t<8`q9Z3p%xxUiPgJ zi}QTJOKHgy^wAs_(4!&H8%&}R+{XD)>7>AIrA`y^r!uLhX+xHb4*uD+Q7hmT&~Y@) z=RV0LDT4vi95y%jetHF25V0$a2vRN4%>v~K?J2E2oW?%A5 zb(&_F3%e2-)WV5C$B9F%F+<-9|K6&*mew5x;fjmmDu=82>11sY#t?rVqT>l|3Xm43D?NM(8qxxvema*F1$?Y7M0{>8V1+a`nOSU?tSCA;+IR>!B~ z!-#m`@n#bm^*cw90dbzgF{>JTpC=^Flgy;6c`rBGRi*VsIxjezpVb+63IzmZl;T+? zO+(r)%tLUYm*s|VU-AZMb6c*ckR?KZZFB0>0V}a#D_!sr14H1ZXtA~3wvVwk%l5~H zToN*OcXVaGsHb;rkr$PNyqr|d@9^-;i>hUv$W<6p_E_)T0h{d>`U_M-VgVfA{*!_e z0){?Vo=V+Le8V#nC`4p&6WkzU!7%fDz?nC55;8q9(=Vp{@mX$EJ=>9vf&STD{B}%WAM&9)af@Z|(KI2^ecxXOYHV3Y z!ym`!ycQhqH*{Y=F9b|wyq}U;$DPJbq9Yqj?YEZZd7{Ykb?k=?^4NC% znj7k}kU4nV_`aorXDLA>APtUzNa=Z`xQ@tCdgWkO3)*o$3NHv7%A*;BZVMo+M>{A_ zeW6C|nn zeJR(5ij5PAuQs<|UD|Jn=ly#j_R6boHcS@M-7{DCjO7pD^+)x>4vLuq950Y&oAMFQ zK+;e3=yc1_|D4raq!dDJNyxzl1~l#M*@J+A#k~gu(yTmxQ){v8#Ezxnva}gCpla3w zicgaUH{#|*5C)vfQQncu%C=1RPnPJh|Ctf*GqW1!J_4~93f-A3MxQ8?bw05C)vb-} zEu{u;FiUe$6+W*2ymb<0TCalP!K(S@5nx@udsWW1KbnC8(hQ;nY((z$Bzd znAzJ7uGW=9`xAbtz$n;b!Rt(KTZb%$XdHOvoF=0elg*a*ON{ve0XBJAdBt0BKN}?8auE z;MnkC^@AscNpP7EFxTXtHf;WsB+= z=95Gc_Qg7nw%lG`7rlwaJ&wzkfIIWWTzy2Q&3;mh4*4F{)z456uVCVj#RQf_{vu}0 zP>`|9?5B9^Y;cLRT}H!*M)(zR1a8vFK<}a!D(+zFmf%awz#MoW+cc;Wbur#UE~J??NMmALM;{t) zUfRg9%YwqOK)*Pd?sZO2pLz95rDFHtAeXRZs6y7=H#cFP*FynS7Esy-RLgi}6|Wv5 zH?4Qla6w>92xqRC0-I|uggCgJ1m(mtx<$e7LaNuQ#qp|gEIVfzan%*@uJ-dOz#|P+ zeQG|GzQqPBhXO&Pxl24K90A!xjPQPd;Q4mf&USJEdvpX@2|;*T3Q~{4_?xU`=I%Q$ z=kM9RoMhR5Snpx6tb=*Rl;Ug#5`{h1>ceX%Su+A=MuVM^$2GbAgTc9jT+4MevEt~l z?6X2f&O~EE!~yCd8_j-8V!>DvNvsXJ<5eYtKA@MO=R`0!ox$Gj2L@SJ!!jq<44Ca2 zod5X!#j}5@=j$wz#gQ|s9x(?dAbHz3kWeLc z^cT6?=6lIp=H~rzHnHZf+@lvQ@+DI9qQVIWB$)HGaCqE3S~p&B?irMOne+g_DiR;GIPU62K3<;1-ziV2j_;93Bg2A^}j_4h#CB zQM?m*_t8nFyDk?SB{UgY{_Xi@`);MGa#A8dA?G0fdJ#%RN&*K%2$C2yeq-R~>J_YT z0yPW`{Zb;tHSiLOaF1}A>5C{u;a{)Ekto|8&Fr`^Hq)D%n|8-wGwbO~#~dE@TaKM) z`Twf+3}I?jOdf&mOg8sFN(A&HU5P%rg?gwqgpQ~<5JlDe!(q{#_6lUEKXx7|@xpnru|-sAE{mW52u zJoJqNu()r=K2@;1T3p%CXL|ESsEl5cJ()EjMcgu))U=_oeo%PY;lbW|>d$#DYm!e~ zymo%18FD3od2kK%m~PN6bp)!)NVof!}PUV135n-tHC zEbu$z>}dulKpm2d9u%pDIkT0>iM%=l5#I`I931@Xs&vPR0A5vif4jhnP<0Y8obNg= z`)LcP@K9E@psDFZdDS}3^e>w|P2`Ov@3%Q)tjDxvQ=nJvob$xxDgZpwMO77JRCz}X z1h$5sV>6)RY3JsiA%&<-bXGehlYtI*C6S%9IVc)*W7aMJiUUSQ^+1XZx>eP&lZhYGJn-})c1MeLce`(xB zO>SclXUcn~b@_5MgtRnNbAG_pP;?<=e@gDeLIJ^vw`)ECz5J!K<$==Mlkroi@Z1!o ze(2{^(0%ng_fc|N9Nv<=3N8%S#fn_QtK!254JUy`;I2%^&W>YgGmsM({1XXC=^|7H zYoTmc5wT4bVP-huj~(@18W~2gMyOZZB6a3HU_PJyzTPvqi-wQEu`C{kq+K${DF?T zNL?_(V|Vy6t&YGBvw~E8VZ5Gk&6tk>+v?JEF(Kp9G1Q=vzUuj)dLO^V?we?ARch?X z*&<0mAE?~%s)791Bh4{YJ4ZH;zOR+h(1&O=YJ3yrQ8PHc{azNMxhLe+rtQHuZ|D;A zZv?&zkjYR%hzs7^?F=qLRN%v@+;7?tY;{e3(X}Jn<|88_L6$xs_h(Jmy8UYcy4&Y_ zPZ!BJspG#463qX@stF^<|Ec*}(wvCCWP{t9QGErMAeN}d6DU9fj0adVE_Mx2S8`oj zBZ)9#?%`j|h&N8Dc;6Pbn_IaGAqgjfho^jcJOM!-@nyhd#Joy%UO2&j-8KDuvv&O2 z^L{^(eE`Yiyw>y3ErFhta$xq;%N=_3`I*5!$*qY$P%f{yRVBQ2jaGF8^@Yz_S>tcs zTZxDTx@kSqy9GYM7PL6U=G;N>MFFq)PZb_;D^=LV_6H=={I4~(BEgh9U-J8KR znAx`YKb(it#f5~vMQy_ypcOIM6wDKI!tpT4$-VC3qv#a^wG!4Nj7evknpcR;0DL!M zX+8kUTfoMyS>;(-)0EoVd7mp@G7rfUAUfX|9}F5?)+~=se;-eRxf5k&ejw}7{y#3U z&TUYa7>lN_^L-gBn@>as431{VBHyP*Hzruu12ikFzGp{&0wNsR7UNCdIw9X(>|%mZ zov&9S3cSt8Oj435a^asXkj<1pEZ(26*3VmY<0|FxN>Z8*^M_X=3C_;%o8}y~s!oMK zaNHY=z=55v6=`Xyr!$N}W?2N(`L-*EwnNw?fPsybSJAjIm!iT||EX@yKdlLmeIXZI z!TO6f*#4%8qFGWrHL!t0tODegt#{J;!FkLnGfF5m$~=fGG`FkyIFLv&x%kHvSCz)H zt+ln)o9w8elZ_+4@tp_{+^G0)&3&Np7K0rIVQ$KXWolfSs#Fl0HGB#IpPs-tTcy%N z|A9v2vLUQr1WuVaV4wv)%)+4UX?4I%@AJg~Xfg1rqQ%ByGP!~GC7;(IYR^(>tAF&3 zHW-yAbJg-O*2;W;$QAqnHDd$GVvthZlx9 zzA80_Lo;+|kF>N@bnS1j|6G2o5x_QE%a_7d$f<5rNOc`HP2E};Mn~d^l>!&w8lv{ViJQ{43W}Y%J!0K$o%J-+0tx85>?fx z#(*_QPUSNaWtocM^W$Aojr4SL!f?q;$ACX3ch)=y>f_Fn1!(p>NR06S)(;Au0J>f& zV9Gp2B0o=xUc4&=b(c;@>7WpTFH_8ThjNx1su|?ZmcNwaz8gm8pe8zFW1JWs%UMCL zLaJZtm?j{ZuBNQarbghbMS=7A@qz|aaizKnH-=j8yD=B^n}`Z_{P>mn=7J}w7dZ24 zxCMBic}CdORZf=;rwPTr!S?v+KEr)+l>0P;Y4yn)6X>#XZ;r)UOoBIQoS4XondCH9 z^AAe;YxK5RO|kNb5v|&61ok9YyFo>~#dy?ZauM~*7)y$SzR z&%jWF3|nqE&)<%a$#0dp`CQkVw6JFU@gokR+vtcbg!F4wI2tape%Qn)X0Y}`UmZFtRPFwdg6Dk%F_N@Pf8ol<*s<@}5{~+~} zmf_#sp87y=8U|ciG;)vq>Iq`)RjJ}VPM}KR%&{nyT1ZbVYHgHwwXz9YSD*veKUU@o z@p_uKb>}!fWs(c%hTceg6QW7kGP+tJ^}&zQ`Esrt-oU&YE@J*s*WjP67Dt!aX~Q=4 z-4Kdz*IL)x&vcQU4cPx^Wa8SN_DZ*pi`k646 z4T+Tp1|=RQ7rUrhyud>)xE|kN9wGbk!``R$ume&I^=p6QdF)hBdxhF|`FbFT@P((L z%};*thK(eCC4syvuTKa3G~yz6qX-IZ4RXHhKorp|t6a)b8;hJfzv2-^l+|HpA}%f=Dp*5{)tiVO8;{5> z=QlN1HX;h*)KJm9NQ1_&<;oVn91W+rvSMB7-Ke^B?GLKw9g~4f(}bDjRXD&6|OO{Cc?o85MSC&psRFXWIq16hH$7FSV*&*Y>d1Y%v# z|By7gsjSZ3%ZurSf_uAYtT4mDDVI3P_7YDe7yE@T`Z$Wh%@TEJ$1LeGEWGk#d@WFZ zzDc^E4Ih|N#Oi`tNPsc=a3<{`U_J4%1vI{NfLT=Ae0Rmf_M?iD_4@AJDbc3-WOl!q zj-OBXbOEfr=~13|kd{->6=x_qnl`qcQNJK?2D3Wx2n zp__52gMA6ea8(pBV8~Lt=`=(Zcr@(P>Li~19RkzX%dilJFs51APHHbvUDS(l*mP)b znFMoTRLKklU7ITHbaAy&i;?Jh)VB0*5SW(nggWTzkseVp|Ax^|!hy=k@H2-=Q$qPj z79x*6GQYxf;KIXIj~Y^b_eh?wh8?6e`(s#W$0BTADtZ^<^3f3gzr%-_8ce<-u7S7N z2cdFg_AAg{MtxVEIUrz?_QqjkyMguDjlFgMRQ$PpLIm&O@Xz}_hA;BRTPaQ~wGYc6+xCuL5~|X6wwCeStYuFp zZ=Y>8=7@(n^GBuj|FTrRmGLdjJmgmn3fGwsOQ$AWV^Wl3*@S|VC6qjX4l^t2_sJdp z-GHqg?^Y*AsRmdJ(l2AHh7abC7obJ63+?RmoR)(752^by?++s?5)=UZN4K4F+Yei zI3lZ$GK1W2HHIDUW7(;uASUBgoHlByXD-KM`hY7;c=9)EO^diEQ@+^Sq#2auJuh(} z*^&cp_+U6#GsQZ?T`mAQED&NAgQA|%TF~;jAd$o~uNU42hLf|-E5nlQ0+;1yB-7=C z!K4}ex0x*cZ$%!1mxGk#+oZ`Z_3pbJ=0fp|CNiP+K%cLpTPQuw07pAdN)}92It58sw0U*iH8MAU7dFt3OqpZ!x>u^$Ov? z`u&Gi{5Hwm8iAs4kk*divtkx$fitLd5Wopc-(tX{AK`PS>#T0(OO9WDi6K%;d5W`% zG@i`Kds=`01{9^*6YvM#t|5~kZL}=dh%o6P*QF>CuF1Aa9?7RXaqu3mI%3WB%y>%t zut}V7#72{AcXsq1Rr*a zc@W^h>fuB8l52krBseD#KY0!Bgk|r2)GGW=`l_ZwJ80%1PoF++l`uJBFnnpWNiLlc z?*V8TqRjC{J&&||o<<93!+W+ybe({F`(bCI>{avk(r=ZrJ-#$4lkJq)MnUuz{6@z6 zUTqQK2Ga?(zdeLJL#6Qtf6~TMUlSwLVXr*pRmuJs|kbs?`eg#I+HwY zhv9Ier7%)zt4YRsN;J;qGIr|2bb?h&<*4|Ua*kb!Ixb%UVW;+1phrtiZTft|Mm zE;6~r8bgs+58QwTDI7oA6*lAzRG1n&8midcl# z%zw0^!b6(!!WZHge~r*o?h8!W0j(fn&wm`y1&C+f}MU*k_ zU&rArbC0t+_8d}EuE|I1B!KsGfl(AKy&TSkgp9eeSl8GX0kZol; zm}W-PM~#Taw$n!A9pYaf;yvTyKW=tlwB}`xSD|H%XcvnGsHtQi;!1F{v0A5u6lr>< zBPCyr!Efhs<(2XO0E)S?kG$7527T;s{!GGs+kCJ2!-My$VhgKS>W>@`8u>ilg9YNU z#&em7U&JTS!4=q2;!T%N=!67Kh) zf>Y?>v^6|LUd|F$SHEdeCUT_eGXSfk-iY6W-t(TY}whek1(0VF0 zIwV$Q%1{xD&!XeDu<|7C*^9TQB^TV@U7tMc>}%&#UTY_bWZ(U3c}~y^<-A#&cysnUTV zzl94_+YCGeaeD#+LQ$>>GIv>jO&%{Vg9KxVR96XcZR+bZ8-}$E72@WD$tnUn01v$7 zqSx`G88lH^*lUp;68d?%OON*Z5cmD4+uZO{`d`LGmjBUxkC}mq?f<;*HT}lp4*pXn zrhEiC{!cuP4`dW3c7wzl+TnI5`8b|a>Ng;_ryz_*DUsYkZr1vgv9D11R6*4BSr-~K z;%i{HF~Nt17brW!B3Oh- z=Hn@F(Lje7t%AVSlc4E|e}bkdyNKLvqcwWiXO@H9x|lH`L}saKtjErXq_>d&5$$8dxshfwOdy-aHJ^42y#e#piL%h@^9gjcO;I0Et=9GvC^uKZl$v8C z=V<~W50IMAa5T`dDHgB&8YXM-qc}3c4$a7f)e;XUz%oB3SldD;O98e4+0#m>cwpj6 z_S?2>!^y85K>31lq#A~bl}(a%<*$>)k>x(hoceXRR@cQzTK^E~)5UR-HXfGIj+>_% zs1>=5%AWFw5$&dr;uy*46rJ29oC>#6q|8oI)*+ut&s45Tl%AXGtCo&yZZ-TJh8vGw zAHC?P$14F6u%=ng28&>GHryz654Nc7nkb~s$b!=0GO}J%Jrq$V0!Pl@nne=+Q#yWw z_hPjx&5;=6a_F5FwDSedl*=YjUY2NCQ~+*M1>6Evq{JvmK%xN(Ym`fD|6*tGBnT5^ z159j;$soTj$5NaLn*>d|K3-%stE#~aIemNRz_x{E z7Yo@fU*g-bn)00RzZYYdBfekE@Vm;RmHll2Mx zg$h|}{?*fLM1gEIu6Zb3W2G~bcj$vH5w%Dr*gO#6E9334sew{#y!g>E<%3EC{vJ0lt6(V{&~F6aUc-* zj*C;6CyAt>lsR80D}em3J8RH&u!6->;>UpByV}wnRY%Ft>9lv_c-C>iPiUrIis<{y zv<1YZaWXA&@Mf65WR9&(vk;Zs>h<4Z7G2b;9%mu?eNLn9l0-Kx* zZz&J9J9uzC0Dcyf2R@cvCrE`{;9w~1Mk_2QbN<)!>aU`}zd(>{f_aEMgspfIP_4>SgnER>{gF0xNkCavPL<)ftcg zvTC2IP|a93(M)F*nk_BaAcUdtT5@uhRx&U*OL(RSv=cg&2qs0TZ!`_RUyr7ZA(FB9 zqRrgb7>i_U(wwU)XsPQGaWtCFDi*Z> z$XAs}vGbZNif&C;XOPVO(V36AnUZbMUfknw5h8)~e=dZd$|6}o8%ZP2T67AH;n?c1^y)f%h(MVW2d2FX@h%Ff?f8Z?X**Zxu z*}m%4-L+PGI5UMD> zyf^#w&7!}vK2s&E5E)%Dh%7mdGEId~_JXV&(QDUh9SFQ}J1=K>cH5abA^BeH!|Ms2 zQpLTdA4m4DEil2N4Mq4buP!HXHz(5#ytnph6jxBAdseXq7=$!tGn9Fvp`rR_N3ok+ zaO9ftT)L;T`6aP{ogz0TrrG1tN^1{>KIw)=E(<8vKxuEe=th?7on9<5CcTBn3X~UW zDSv&ck@414E?{uFV3uNxmn;ZD5snCjOFg*HA@p`y>0Or+tSF#u@$Bfss&*bfKWx$` zn`@q#gqyGmGb&j$!D&@EqcWlbB%#(P!?tW|%ghVdrZPNN8Sxco`1Q=peyy`H5Yijv zo_{dSE+7L#oe{uVV|c;c4L8iby;V5)agufv=-XI*Qg}Xvy7Axz6CZqsw%%kZj-+;o zeT(Br@ZHmLL6FOflk;*Ss(eN{>P#JMH)blmm;dleR#Pt%`VDpBubIugBvmZik~TAB z*o+Hmj(3AO2Et)Wbx0$HG(`xMkV-m~5yQ$Qc|1vXZYDKgJAC zcTx2@(9hpp?e_OW5Ypw1wc#~-ifxIXjhTGYaJ`aRctv8?$8V~p|isb90B|F}u=i=|sng zMmg?S{z^Px0-iDLV`nQ5+JnPl@Uoz5?-ec*kD0eWPZZhx{OO&~tts2+`8IW9fDE_euW&OOyPtqV>m$iBs+bUezf`%o#c)wKF zFKKhHz4BLVzzZ%o@@8_lM~GUY8YNl6CQWW}g5Few%qlj`%X52O%;pAvOyMUmtINXW zKJ76sWLi2L&tMhv0&I4PM~`$m=)`t~-0j-Qg?WhHhM)VuC&s0_qf#Y{yYd&h0gsyv z_$v}m18K1uFjes?vQ-B^;OEvmYfwT-HCkc|Uds5q=ox509^(&m)tAfHblrcB-{j3t zBImG2tDD_sqxHxF{H4v6XcSo53Z=3%9Wg1XHa1{{Oe&lJlxwIFN3RRR6}s4xu%I;H z?hfkeK>QRJdkFIkIyXG=1UScH-h21#N_Gok3NKjpXtckGHu>6|vhp;($Bo;XF&p#< zmZHSWIV@(?>P`~rR0*qYP;X!F%U$T?igD#9(7@?rbTQ7W& zw~pGdJqQ^f*4f@zb=%PM88HWHoW0$&>nlm3;2E3DOO0UnZ>|6b^5ue~0uAjggphRF znC5)Ex+v16f9l>y#lf|afjqt|`Ma+;S-kNBb9qc+sx_ zIkR_RnEcw~OPX0kms0>_-X+&po;cXoU2-k=cXWTYW_~_jFN_jJyUZ2^bh5ST6JJ3N zjfXYw=87gkQb2$B9xhPl34GsHm#DhF`5?4mLS7&d@~}O44&J)zF!_+&Q`7{ z`j>lpzUI9@iKAf+vSIOmfs<}_R&MR{vb9@I)SUw-O-MG+>XZ^?jZ(PtuFA?(wuj!7 zRP~-Jv3SoaYK=r5SW+y0j?JNs4-AeC@yZRd%XD@}Tl4=pBkOv!)z4Q!ptbuhoL)qj zM<)Q~*}2L9hy)^#RRj*w&y@kCp2Zlq*Cb(a$ttvdxNuFC{()Bqwo^v3F$+u4bnj{* z#YdkK+sm|$H@B5zc@S%~>4_SOV(T)y;pE(mCl;lLUKz!j8CX*q!mgP+bg8I4qH5GmRv@pa%4!zm4npv=T z;Zu6)#ML>rKJ)R5iD}fN)%iuR&Vpab6Runw2&x)801vvY!;el@O+@A+m^)DK4NZ=U zxDyVRG74Fy&pwx>0Yaum;IkelN-+QfR>lpvoj{u|%3J^miY#;wW(=pm?DZVrB{5yTpN!asw>;RHS0?oq64;EX~ z&}sXf)n1Z22VhmyF!9Bx<37Grx7&4?KFiz)VI=~cXj?~m&+65+h4WG8+UWxzFCIpK zqMI}xli25dO&ahmM8Xr04gxe8Bf9;~LD5#kKqb;<9S4qikvZ$KuYDnn`wuudwzYK; z^eA$od4Etz|DQpp{Q+?dS$)O=+3*7<$`Z)r8X6d5=to-d2D=*emEFd@Q)lo?vk1I? zgtMZ_J|ImkI-MsXw~pcGiWu6qRWy83!ssx-!#+k?Tx6otUlFz- zV_MxXNmsbQyU)U+nYt2lA(iX(QyEfW;Dy`H z_v1zb7~gR~sZFpq_i9ZCvz*4O4r_EY4THAV=j^PyY9&S^{j$Q1a*hXIhKMF(XRyx}GieMMJd61?V@#QNv<3e?6E zgm_9%!4Vr%tth3<^bI$DyUpzM-@DnWe&|eE)p{^ zq!-<#Ntetex!%SVQH+z!?5Gi<7Ge!&iLGQlrAZry?cQCz^|^yW`vAR7^#g+91<;6X zC%GIBEt~I6XZ89=lnYKNDutsJ9y*MZF$2bfzD@W2m~LUXaSzHUU2!xo>CEI2(KZ6@ zCx~%^7_>ACIgdtUGrVGP{3t^cBH)c+c>_=qk_0-!yMx_&_`CfG4;t!Ts3})}mP$Ac zxgu}aNQ=@wDOZG66T6U^1?Umj**(qTDBxXbkmj~LbjJDraG%cnU zfdT>l&P4!|Ot3_U&RwK$j_v1eIclG{Y@UP^$;kcZNQlk$%8Lvpnn!{DKqEU1f>WZn zX?Wk|D?1xOhmSvEuEa&!>q~cCQUsqkH{rBe{k<`9(U@GWA>k(ijEmJSqPPhX7U{ym zDrJIIRb$mTbzZ|~i4H=stvU<+YHN>c&R)rA0o^p|=E*oznd0$QJo9R5FJ-)Gn0`1X z(&kzRZWK|2_(_o#h_BY0cf4vG z3M-i1KxCpJ@^edLhbn}3nG)uLZc~Ib=D~jpZsoztctdNCcS=K-_D?!^X=t3Pn=I(X zG0{QK#b{4OH5Gxr2(3s&wNg1k*_L^?fUIw}ue=iCQEykV)FcPJdp}&W{L+KJTha4peB% z;OS|81jWnL3Vf&QkM0|8na&l$B|?`%L1UR4;bgQYp6i%pl&40?xl6l6Nk0tyow`u^ zEFZ!-igVsrYm6tZwP;q#m^8ty2N9qT38gZC-dv$M{J~pih#4_ON*o%eWrLqOm+XA* zDMIzNi=e|e+-UB28t3gfg$$R=8{d~!fHajqQv=DurE3{q%!@PwG2Vw%@Oj62F|Fpm zyJ43+KgJrraeovGt@ngS&+ULrY3)2fiLdh{J@EVe{ToqF)n@}h0yOE2GCPUe3hEg1 zr1_>j7rjMO$BPvKPiE{Y*Sq;;Su0fk|$h)MRMO=?pY-rlFW=qDcGw1M=zu$%`)PddQ@xtKw%p*P$uR z!o{zSk=+~)eN?&1cTgKoT<*;?#u~I@;5w_ZlPU({c3{D~g;d1gp6Ghcvc3>{(q3Z! z@Sd>K+drU&P>>fm6NBxE8(LW-WTjPHxxb_@yGFKqa5U8}-a@q8tV16RECpb7Hw&KM z&bOr) z;}W=TL5}oaam__%;df(q1bh>4x%cp&h;0FkWRERn5kR&sR z-KlD)s>Zt=?++joehXwd3#AA1Q|(XMUo@-~tUW-!;B2PLn9N?!3~j#sEl?D-opt#s zD1CRGg4r<+JPf*F>c=C*(7^pZs!KC0z~WsuN7!D}l@e4X-~KYc8lw!$EWG%hFUrDS zt=94VTJQz59}yM&FY`X@|7hN4W@P`rnDW0t-|F9ofUOhiM_>~*65;UPAauZZ!1|0r z*FR{_O_|arj16NqAu&|-V)FHyEvAfSt6ity4sG7Mw4@MI-qrd?{Ek8hH# zcZ#o{rjB0|EoU>n8RW73lJE;HCr*CqW@lt_K$Yp;yx&iRq^lLld*xHgLlp{pwwTq| zPICCmxB9vOUTV!{Eq3~Ocsz{bAG_?o(@w=!I-fvm?6Ps)O?UOmaksN7r668 z|6f_23-T(({atsj9GS`M$Czn3+ za(HHRYITkegBzmD&b4+x{m4Dd5$=Gh50PzU4q|TYpX7DOK$_|XrYS?{@s86MsUulW*+_fq5Y>|%^!?DOCi z32Mba!88%jV)gd9j@G@(iLhYN`P<({0(vENNKWA}3enlFF^4Sm;$>LTFW?!ewLf8b zsxuN~uQfSNkIz2QR^<;LsmyBSi}^K|MvM#cC3-Z;uvVXsoo3+Vs1_`KX=JEobg~?x zWR@ig`8QffuRs6W=z?2Hve~O$SMP|qPUPzN)sez!&ryOs_5mb`d~=@Zj7-d+%$}n7 z3+%kMFUhz(#l1~zzE{U5&MPM7ty{kLy`W!?|5ZAmHTovrQmh;F)X!MvBYT2;8wCPY z>H)L>i-$|S#OSSIE9|;-Pu0RhBBh_6vnlV*TKt=*8M6Y1DYdx=qaT~&UroyjD~7A$ z0%?hj3|QWTc9Hg*`f>?FmU5}tzW8Et>o|MDL}*EM@gpvStWwe_-df|uzZ(2Dwp$=Ltd**E0to=&49r@rEUM%0_ewE*)n|uuPmWdlTrE6=BWF+~^dx%FEHS2T3{7NvH?0ZmpZ1^R#ml#Nu zy8a*%oPd&kAPs12AOtmpe;{O!&Ad`bSC@o5-(R6<2<{=!aAw(qK{NRvAC^$u=iTy) z>n4OcMNGT0bsH(z3><*QH5^W+0?Y1jrEhoB^q2)KJf8-VW)qtUt&4o% zqeZPnqd_zq_ZG>n;>;v13Ms_Q0x&gzVocAj?MIo}wqqRqj0}r!0ikNXfW71L?Ffz< zLkE*MrFz2VWiU&&UhN|`z=l&in-=U}Q<-}VD<8W4AI9FP%hs^lvJBg{ZQDC++qS*K zwr$(CZQHi3UGe3qYMEK>T%13!F5ZjP=A6$Mz0bv00Sk>Tj^qoBj(Bzl#8`MZ8DFe8 z%{jzH?0NAZCiWh#gp7mziE&PYzj0@1!kE{a)zL| z&Fs2pFS`;yO{+k|7z00*4|g0* zezcWZ!L!N4F=-XFku3qSk9?1Z^)VL-M?#sDS|+Osl&WZaPOi}6NCZ_}X~xuO`Dzw? zZ@5@=?JIQpM5~p7=yTU#fFLg)@nUt!YM++=o}=n#8>uhKT8*5amOuhBOL)tO0WdnNu6LxTr%&U?(PA%3M%ng|V z^5d-kTQ`V~oZ^=8>O{?p&I};i4lDm2xgBcUmhy*LR-d^ouZO9DAaY^y*;*E)3mrzl z&ymBqr|OvwluUD^YPC;K=5~`$AKOf9dHsunvLQZPrH|)7lX0~qBy8+J>k#u!!Ic{4 zq!ZogrFqOLt<8J=R+ZXi9L3NSv|=B`{g8y27hkOS*mv2O=Ai9elw7h2W#uR=?(^Tih_#)p24k9d6msLnPjOdf&OCir2TF-C zpkpQSSA0-*CQ@rhG^XY0Hi7FkbAlxED9$^a_f@0W`Jk%euKMtZ2?LB=jyIZ6L^y)j z>_gyZz`dCxoYonbG0Mptj%J>RXeBA+1bik_+0)c%MIQF95-Djgp2qa?S&oL8I=I8( zd}4Kt2PDq&8=gjH7##+Hs{F}RxL2MRC#miYd>j{GF~ z4Y&a+QX4(9Mw^?(4k+k{GdR)xZ9!$Z9|tYwn8Xt_+4)$DI@)eYjy1F!6P)xnBAwlu zgpqz^K`li8toEr$XBy?~Ok$@{Y7?@*4PB%{oU5meZh0QJSq3B((3fjtBwkGaPQr0- z)DK+^&_d_82)o!|o3V=WuS3SYv^(c6){kp1k!gX^9cII%kph9GXP^1zdIS`W$ z$It~m)|HGxm}YMVduVox>ps_QAj_Q3Q34`(WdJ8j$X;~wI~_pNJa+Rlic3e$&7j?@ zQ6~*$_qI38Iu=hxy`fwVpG~-KC|-?O;my0vB7pD$OF&a5*8u{ynfO2z#=aBR`%97p zPj$C(Cu`8BIZ{V^*6eXMh=3?e4mMpdQ_P7@`=75#ST!ZP049>+HICl>M<*pM)%$M$ zoOE%$g#Ni2j`{#|3$)qFoo_$BP!=wSLgPUg>t}Gi+OjmxApw>ZP3;!+haIAzhV}pb zF)v#xn;YDqHpdQG7azliZ-R5aOm!P)n(LHAKA70+6hp`0?2K$h^n)8FD1r@#LY}+k4)`sh(H5Ek zwpzRMC`Jt!mgvxV#S+({;DUbKHPtYL(m78iB&tN`+cp6YLfoh=7TIyKi(s-`geJmy z58XwRlADQ3_m-0C{kv)!@0sx74=3YHFWy38Zp#XOU-LMfV8h%ohmtkt2W@E=9UE1l~WrZZ)oD=z`wa@fQ=hk9;XJ8|xZ!L0)9>@!o#*d{)Cabv{S zU)ea=imut|n`-G??tHgh;bR|VV|$EZA9BZ+(7{)`%!jP{AfCqCYm5C6ZCkpmk{e1g zYwm8(y(-kBZ!UnGqzumj)bef!Qj*Bli}hOV9y~1; zKh?>fag$!Ia|#u93Oq>nvj?nS8wf6sB<%vS%`MkvPf=J@6*R{s?hb4uF%ar?Y*$)o zZC3{-p^kU9T6V3fzC7Jl;LS^gm7cn{ld6-ARqvm;H~L8-E(27YxQ38RFto+(tX(E; z^n`jiNJaeGw?gNtv(@4|FK2x}_=V7X4*#2dg^lrl_CE1{6Aq@eBx?UxaOpo5g#8`> z`2QVTs>`j?W(rN0`tfN)87C64xmiuiyVq=?NfYAP1ai^qgYDmApkm2wz(-}A8(vM;=j@W+ zbawFV)nmFbV>KeKecwgnIx?_^aD-=HnBZO$vz-bn=r8-`Sj}Hyt+TP%sRO= zvJb0vncCBGpe^U`35 zZRFu$)a09cC2-nh>C}_LVuT)PSKrqeq!G3q}@`JaM_omq-kAUJZNpb z_&WZ7#$>0dCv;IsF$~GABWBRCEK$kA_f%#YDBV$?{BK<_C8jYPx}~n6N{#5a(uH69 zdWCV`q9WmDV}l0m{Y?W-E52N0aw#5_KW4C<%-;$}McKJh1G8~DrKh#gH$oe?1sGJs}MF?jbn<(Nv zWafb#3~la)XdVfGf6Rg!~xW~2GU2-hiG2Xs4F<9 zGyV~`JhKxIY;!yoR1Pd7P?AkUKKC*bhAS=J)>?3aTFoHXKA~07-pZ3vGWtwNr`0Ve zk-bt_HOu@ZCf1su&urDiTxnpLC|G5X@;Zsffz~N870C(c z>^~w;m=rd;b7_#CuA9k;@7O3a`%k@CX)q_@I)7*SWltynRUU z$Of%`#G|H*>j*YSpS0yTh zr3XqfEj~@t_2b~~*fXm=W~3C;q?jOu=or_1@|Vk%RtPM8F49aH+D~@0?SuZJZpXLvxCtjckO+m2AWCsU=r{|q-W?m z-8F&c0cBmnGVFI+(<2H81F3tR$0*bY1@L5=+fecMA%~GAl%Q93fpyedAc-NVIRd*B zr({&2G5EP5|LSTR*5k1W+)5n5mg48>ST-qp_P{wudSLaUvS^CnA0wamiD;fP`*Q@PGDdIvfW@bh~6cNpY z(QA^bq_Ee;EyCyMNLmlB4%bd3Li71%*0p7=m{xLvF1u*~KB)9iJ@uc+Jd4|BKhZ(` zbcnS99Ga?DAy)dZJ)Xv4Q$Slu z6h%T!khK2MPp#jvf!PT)h}Oo_W3Wo-LV`Gf0hz6`*RMnoV&CK+Y^9P(s`W6>c%iU& zg|i5y&9XadKdW zDzsoLEz+d3Uz21lUl2mG z;>H@`#l|3`Ux}=M(<}1^Nu~1J0ShxLo6Hub$b8ovMsE6T1OQ{6lTmg<#R&llw{1ML zZ~+a4&~f{{*%w@Nx#)vi)Z*j(@s90{BLw>jUW7>e4o3Tl`2tPz0j55N^fe$?t9#)8 zP3?4hwqc_pA7L=DNpob)@3^crS|%g3i|Z~qmXV{er@dEhC_)4=vREsV!rb8pfWc>2 zV8t4!6B|tWlY0Y2tZ~(rsZkdFDX_d_kJ{WczGRRudm%+4)`zka+)HEUsf~8N5=?#` z3!YSjK&>Z-Fkd8;&b8gjLQJ%NZiUlH@w83 zx-`n1jNFbaiV?W=$MUxGVTSkFpYj4=wsqwCd48ZiJebYl@~#q|z4%+EqJa;qVknX7 z`d?6}`pH&~l?AU+6* z1^VfAV|;1nLEdTfr-H0na!Mx^FVJ;{R#U}f|A#!zaUMZumO0OvBPIOu5HQv6Q}tms z{4>V@B<}#^O*dT-ve;iv%QeOeqU0E4v-MZRbk3rWg=)&?a|PDT0=~9(O0S(Dr68tx z>@DqnRGIxA`gf>(FgSrOY!dn;q2Z`D+z@w2M z*+^Dxa+wgmd%SA2k9m$o?`V6Qj%}~6BMn}sD&YH&`#AT7QteqG|2W$;Zyg`C&CB7p zu4k`-3Az87Q~*ssZii%2%r_X8G(=J|vS;^Td$am8n{}Ue3+!FZ8NX%BCV+sf8Im4U zzVv27-@9%Va**6EOlw}FeW@UUYPgV@98DQ z>u7bjynFL8nfn9o7+_EQ-wpFD|D$1^o%#P)R-KIbRhs>Oj}OD(b9Y1nOaiWnPjq7g zwo>cHXw3gH+TIe0j9a?x5(Gl)wVKo`SB;i~PcHrv%W(en8xI*b8Li0R_wEJf-aXe& zf9CF#^8c9R_%V;-O5a{O`=?9Tk|Dq}rS0JVb3ep+QgQT3y`cK)M0jH#b#ns!hsjsd z*lRtQi%tmYbCB{o8D!}}Smf&+eF=F{!s&l^>JffNVDfJ-{1ViIHva;Z-DRs^zKZ|0 zRm;Ub+8hxspL1`0vytakkkaWN_tUK>CPqWweFq~cW)8GzTUmnD&D_W z!zIj4&-q0vLL9!nCV%z8jmhVay`{Z!{C4FGI=a4}ry5FGn1$443slB3xb-V%S{BMpmKu>0_qC)Q%6BT6 z-n5+Ql6atkyKn3y+!!1=)K+%$a*5gE@DyYTFmyi{g%UcoNQP%oC=)l1!TJ{} zvR*8a785LZBEa4-g3SYk#7>DD5;UN9SKHem(RW?l3JxW+(kD=Opiyf0Uj?beK!qmI z)y)``$JP%$9SxH*a=jx>v#P6EVGz^LRthtQ z^l{Z9D6lLJeLexOCbcSOGg*DzD1yb;;+4YCg%77QDsF2p?REgp}H+M+GYN z4m6+1z=kPY5GiV*6OBsuw(dmy0S)|8IyDRwUUowAWeT{6ykL!OhjkN}*N)Z6W6ihy z=TI6V?s4e4&h*Vz_|b}%O`xoz$q4YQMV}(j{3;298liD+iJ%gK33zH$mXSV)z4?}N z;E@YOVUoV|RwtlyMG7pXxy3iem}Uh9nmP3%a7ZcGgT5A!)@5?L1sR(Qkr;2l%qcw{ z^!NotL4zylN{i>(M$HDT;(E;3h9PdXkC`ws^Nqp4fGw>d;@!i2|Fs!Y$ksD2runCj zX5=w{W1M0r#|)1S_2 zj8CH0^OF<(TY{k#^o@sfmOH+`)xf994hPw9N7DGkP*oQStSY;XiV}2?CVj;6*ts7- z)$sh_MZoY|ayU+75_J&JZZIN$zxoMOe(_Ojg*+UUP48v?QHiiJoYoduZJ(p3gAe1n zNNq@`)x+oA6o(C3$zQjlR6ocs3d^6SEEcwvuh#cw`Rm_McI2Zs31{>NlehiZ1jl_9 zVUyORHS$Rqfr`=rMdNOUSSU@c=sPm4Mkr^gnO6r?7-EN1 z6m3EZs(l5^XOx)r*0VgU#b?C9(+5mM3i)-fvy|^POSvMVN~kn>nOk)%eprX%@dGXI zx9(-pKLb_bU$#ff%s)$2Vnjun69mf2`4~?5(?+bL9@o^?H6XolOC~GMO3po-v}KmA zccb7S@gbK=8@7)N#XyYY4afb={j1MLC%ej+5krx<`FKsQ{AajwM*5;+Xdu zxAHHpDQQ95zQLUuY?19GL}c4HnD_5t4>4j)0o0&Q0IYypTiv-1*345WT8 z+FUPUAN9U3MO$|HnN8SCY0kYk$f@%GoU-cm+OQc;TzMV4CfeZzO~@d<0U1>rZi&{) zMKVw1UKGAkxZhY}hA2y?xZ|^G1__Ieb6(=bEdZ|#HNU1LmJox(|2TvbEn6l>{kq9| z8CHTb&y>(>Y51utbdlIdcO>~r*l1p=9lXM?U&mMkdJEr=xYiE`nsjE@L9B@)R}+%= zhx`HwadECVD=@__kYaKfH1jxZ97*jmz&rnfGs}DcibdkV$ZeNY`n+R013~8eL_5N0 z#0)HGGsF4{G%oQzz_lnbApTnlmyi?R&%AZc!bNBUJ@TAVM#iP~4^~3PrB-JEjs6tF zxWwF->9T-kV(w&}##y@m6Isex{6ZY@llFPbSrL1l6xy z^ICJ-&!LJ$cN0@pLZ=r~izSN|yAm|}0P3}TXhk{x$wC2*S?dzrKi|EUt-7a8S8shtDE+=Xl zii>o~Jy-E`RKJDB;`T6?vlre$rae8U==8?lOw{&++a{NP%fUz5!Kop=g&V_AplTxu zDCJXz-(DjU4yZQJAvIEI?&JuwjoT#@RE6XGDH_GuWs3PBNTm(8sTT__{H6DD27$KI*kj2hQyh( zuHEmlRJYP&GAi=h@AQTbPV5z_T~69iG^1J38p~-8LxFHt*fwDk#qwy5HN0@?ZJEJN zgV9@S(K-Yzwv^@u8;bIU^ePCca|CXo4#e;DSjO&Q$EH5 znq0JyY9gYzKqLE9h)so?nK?(MxDeBkZoyo+TFXX~73YFU-Kha@EJHLb4eFgdc)6nVl&F%SAkn2l7 zge!S9;qo_4*n|WDCN6os?A_r2cS^yjRm=|Vh4Rnk)V;?1a%;*Hq`)BUt}o{+%vFJQcKA_bT~tfKd+y= z%_5Vi|)~T)qpxf z%7HpSA>QsQ-CHg~1TLt5Ddj$~yn04(Jpl91ke}i+J`W|^281ZYngRS#kguZYkiNp_z!E)faJFMXD*ErMyx}QACUoDf?9L~6#Y}UWT9Tj8Hgr=hCwzM zR$qeG$7sZ?a&X})ZyWYd1cMmF_NetpN_%%un>1u~U z8{sX#1s@^@@3FwZ_Z}_>MU3Uv(tJi{PcrzNHK_fbz&29zcri(<{|0 za4}Y4k8e-$V47yR2HPTtA<6fxKAi;_^KM3!2-pPu{6W}Eo>lx!+#t@HomRDs-Fb9@ zwZyE43HX4x0Y60r5dgse0t83_BUEl7JPOi0e3=994>h@lQ*tP1`6&Yh6{#@i@mLHn z0T6bX4Qx7iVuD24LL`{sK{VU`k=EsyK|#WB;|*5!^84ugmO#a=_{(~-DQxU)(lfo5 zd4zi^%Lf{4dcq(sFgzJTcafZ7xSF8(JhITriH%Ru$&llZa1mxR%zmI2(JxygV{#+WZkF>A%_SACWjSCX4EnFbrLXj}r2f?ig zhN{9eaSDe5k`0B$gk8`$l9^ziQfnebyLrVi%kS(Y8LbrUDRn@)(V#+JfP(=Bb99m& z#N?X~o~%C$>tp1T3BqD+a^yAyyH_5d&DQH4BXYj3A3Y9c9sh-!I_mZPTJrjycEjoyUs;HXDMO zSV%0opvWi`l+Y29;6?wrlc;%^0#BTStpHo?hF6q)-FUv7UXsOuuSOr}{)7_m_r=u{E5BvG@>pgHq70=aAg5o)sBhF5iR4&hVOyd0)14r}nH za3(g-DTVHDZ^IPS+U=JlvzZBg8U)LepmceY{%uO(3M)IG>`k?$ZO7LT zsYcC|ljuUKKd=v+lG&`#;wSD}ot?Uew>)z^Ov@F6vhLOTJIxX9ngl_HadBi>V3QMo z%5f%ap6h-*oXl?ZF75y#pl90;5VcOTuK5f%ZaLZQ*-ig^1*797jWu;kij|2oh-0_9 zmDAspX@^N7@Y7-IBqkkqunGMwa(~s)FshK4?+r- zPbZNX1#7m6+y~xoJhFzn9io8p$A${bR}CeS0fC2fn5D{cU2q3NjFon zwER`g=}8`?a+TqaShLD2*99g@!2)N<@>7rti5zc#Mf;sH?eQl8fizV~lo8z0kD;Wc zzImP&gRw_(nq*P2<;CyYhGj+mb*;LLx68Xy$0D^Huj)0-V>xFRuzTK%1rU&2=iH!< z{cuu)oNdF)ee=vaU~Bse&S3J!eM``we=K^YM;E5bj8~J#w(}<3FQMjY&wm2;6xq*Y zJ0EO@9&=p5C(nvYeBll0gL4TAm~ZWG`P{)zq2%${{09c?dz5xRMQe0{GN_m3<+t|C z!1Bv5bU`o~d5MlmO+_?BUM0*Yia$KxD{6CYVVUC}&)}$`dNYQL-gR zupL#Xo7k-~TxP^zPv!)#|RgHAES`~g( z`5~BBv)MUUsNS_wi9fwchHqBEyHb}jLuu3wqMGDMv}4j&#q7X-NQ)Vq?$?hNAh!JF`&+Y-oIyD}g=(6y zA1Ns~*>nFQSm5*ocoJ9|8K-6TWzWhAw)e&=<5#ZDC=s4J4SB=T$J@538@14LJEyQm zorl)_%U_Yc#G*mB(EK6dS#0u82fGqm)Z{I_XE*8b;d2%O#MVdUDq$Xrqs3Cgza<{4 z%ds=0G{~|~TsEAx)YHF!?WXIst)PxZ{JXcLGpb@Aqr4oX$wq;08P86?j;)C}LvVRF z6?NHy#OhCo1Y<5@H5}cvzvVQ1z5L0;sXQU2{pAnvGOJIFaCeNfNmKoG2MctsbdFI& zq1~MQ)w~YdA9{T2;z{h$DwfPc1nKbS%PC7k8CpInq4>7vNO4uKD0%1nh!!%K+^4Tt zY%TvB$ELTzCoollCPG~&F5%tSVtYy9Y+N66th`NeEJ5H)O>%e+3(WK%ty{XJdjkIa zep5V03v=iKeAfl`nL2c*Pa&F*FRMS9cQ&u@;o9XD7ir~^s&t|E!CVrnIyyxL@N~Hh zR|(YyiYo0d@2QzD%fXeYnJokxhpCw?$mZFxdbSgt-me84clz~n_To&N24!qD1I!lB z2)oR5e4R$O&ebu(st0tqz$&j4MAArUXW2Qq=2x3Qq6$DVns30)R7%2sU-o3NZ7Rol zKfm>gS((uS3zIpL11{!lQLEVX?0GeOE3h*jQ_ff3SXX~O9(RA>f$Bx+|C^DVgXw>A zi)Lov{J)4e{|Uk$wfxsDy84ck&o5H<*BEDfYV0bAw%uB6eGuF|ep@Q88ZQ!Yp*kCN z4KkwMN*YhI@~B+T^35|Y(dX;vXz9o{#V4K1-ye;?x7+Kw%I}^2^OkCoUZ6@n;g&!s=ci;vitDZF|^6|?V+IAPro1Rd?yqJ zObQnjD1-y?FDho4G3ZvV)AIdS z5dM#+s(Nt)K`W|;acmO-?2Btlo(PL(Mj6m*6{5t0XDNp^YgDlSvsVvU=u7zlA#%1!g)W(=^61Y~9GS7elW-9{(r+W4fb+Rn#{+^{S+E zyLKCw%+o6lO$=Ja+DeL`N^-m*6nZ2#)L~))+^eb-0VI#4QI`A}x2J%vh(y5k{JN}{ zO6+>@C>2qv35azi>=C$| zzH;-4)6NMvmOpC%pE{`2!la|=#K^!5h}!reehk!@WQS(p`2?L~o31Nr@CQlGjqLf5 z%I;P;P>Gu2JnT$#ctGa?U$V4w0O`vzgJ=2)q(@wH1tLCt5NPJqV0_d-#wLaoadT%+b#cZUq(1 zSJpLI*Ba1{Or%gONPCI%N2OVUCkDrXAxw9Incv)WR%6~vgT0BllGatd$Vr?QQ9RFF zy|e0q$`pjDagV7SYD>h4+7la4HN!@sNnD1x%LFVkge(o_sk8oe3GCy)hh43P+_|-qn{}NUTP-9)7v2~x#J95YI*81Moq_qyo<`T>DsH36(TR zKuA(_rdyzargef1M&ZxsWajNj$#@;#tmlIO5&2@SBLg($=LvZu!>Kh6FLsnE`D26A z5y}9GN;>j+uz5FJ!3+#rJ{BrAieY4G(~nEdN^LWat(DeidI!5xLy%U~!}hdBy&ZpJ ziJ((iB-a{Lb8jKtariN$l6PA4+JCPSRvVX2N?aYs&Kvon|1CC5kkWugp7Zwo_0+X1 z_LJ5`-DF3SC)8(IwY;sOiuOo|o+MsIb31gg-Zh2C2pjnh2=Rzv*{tbM&t(HelKN|a zp){-^*(+z`eVB2(Yliqu&}J^jC;NvI_=eg$L=>7^KmDEOm`SNpQ_GOx#|nyu7YS*S zh=e_k46dl{zk-NHA~~S@^M|S?8wfdwMHljM;U4qmZ3CvsJ-{1De$PRsGKu^T#^=8M zNURDwPaGKK&Tt=Db*nc7Cq=)B`~5RO-4WW*ZODcCDkR<;tQL!E?|Cpa%$Fp+mwt)I z!AR{1cSxpptLQBsk|MX{Er-)AicNVJFu#S{KzBX#}k_=cc=NoDMg4s?BEs7 zLYnZ2bU%eFTz2qXw$8jc%KooN6`9QFcU9*syNsF1oI#}Vmu5MD`NG$jB_M7+xbIKT0u*U;F zS%SykcIz`$m2}`zuc_*9==rg1ykM*?B7o^4(WDDf!#XEa!PXFl4-xgwIHGB&rIeB5 z)yqqww%aU$Sl%?;=2G3EoV5$Zm2M`~(VN0h>An$2NeZHavrWD$07OWHS06Y7!a*bd5W>T*gZB$v7tV!XcEX{= zLn)FXX!t50pDw*>Bl14mPH8#n*+HN1D$oi746jb5;j=6xpEY-f)C`%d!?dRf~!kkD1c_+Idrqtca_zIR03&{Mx#T_ht z?zexYukMxHHQ9m5)BhH~zNeceM8-8d5Ka#K;`LF{Oq=ebR%g-FUnjY2O0nFckQ+5z zv$-Q0);q2rhcLtVW>hzt*afmYB(<%?&`_40hlVjOHgFz&OPj&D_i|pIvt&-?*j%5^ zyKbO&!d8q=U`2xscd0YUf!U>HnR5hJ3ncaW5C)J{s9@y^%Xi>U<)Q=IijQi8~Z? zZj8AE4je0q*-Ytm@jcH5W!qxVfc09v?cG&L!HA)@?|kF9C^3X?;y%kuqOkfEnC~XP zOk)}W7rKWMkty@iKvh3h(V{%tyZ65TynP4@HZ~1k8{6A|{G)Eo(_!(PN)>^*THXQtI#n{MOoIyEU`z?>waafiuR~>Y(9vFW>- zoN8Srl4UaL*p;ZQXWp%I87kly&NfcllF)2yW``Qd^;+i-M%*Kx!AofhcOEyD-PQLB zN44iuKOZ1k@N@W`7DNvKn?>8CWAvVh6**Py*^U=)M z)GZo(PxrLJ8{>4e*5VI!m=1c<8;7Xm<$fu+&5tgBFol;5P3_*P)S1EMickK$*YJR5 z9h@P=>8XQ=BmN%`4|f>X-pq2P+d4GD*GSh~ykkDi=nz-*&c#Y#z%aJZ%SoYE^0jt5 zU^pA}JL;-?QC6#^1jZP!-UH0^H`gX9UFi86i&7E&*5|UR&fFjURhmg_Tn>TK<0~1# zfd;RZv64;Scuxn(r)8ZEmpdIxx9@xSf1o?~C>a0UdhtIp^D#5AvizSH|Nq^y{Q_2f z^8xtJ!T1IP}L|Fh}(>yag1%sgMqVk zkcc#IV$lGt$wL%*Sa57cN^Yco=_$%~``s@X|JQyozG75*OEo^0J;Qd*ES{(2LqT|p z-3ep>yeh3-RQ;FvwW_NR@>pCXd1^|4uQ+|mY*GA3iw((h6Sa|oMi{xjoyGi4>m*)` zoU@-M-c$j<&sX6I8)AO>SIylqdJIFej7WN>o4tU@$Q?jb5l%m{D)p(Vu0Z2XtDR6; z)+ARxC4?YxW~;!KAiM2Q(Kj|rC%W9On&eMTFVE%|>sJY*)gGe6G*`G!Wg6 zxxt~8eKM5Heg0aI*@ef6N#8DwJtZl0V>?>kj`w`T9KkcSqwW^{kN^uDJ&45D;C6XUd84s`t#IOuw**x_lsP?mWEe zjLH^n>E)(8CJB4K0foZZ5N0SAZnweK9Eh;Ii9Y8QU2v}`(Jo9WH;$+k9;3d~QmE^I zgecsB-Wdkqc0yR%Cgzc_?h-P#-=|^ftI0YBUCAHha$cC|WjsZLkQ+sfuclIz7R47A zUe;iM8Yd{p20v&#? zitkERSSzS19Ttf=6}IQK+|fzNuKhJ?4|Wwx;3YC(lTDB>o{@)_&IlP~=&2ukUed{iTa@mCqXS6GZ1)}K4E=$ zp2`>f1N+DtedP+u#?>58XGq1bglIVb}&u#-C zk8>bf2i}F^EBcJ`OTe3nI%+~`K_q%yeZj`y23*Zu8wU!=?Mj)25y+u1!@(-gLQu`; ze9wD2v_I3!`d>8_3rx3e?i;B7lKPo-@EU!WSmRI0nhP|$>F1QkxhgLci|kZ?C#I?X zl9sCCHw}-xb%<1Gs37I}6zh_jx8)ha!J%p!5dGs_$Be)2(cB%V$9QYf|AJQH7G+Rq zS4={4ZJ197i6vd6sA~ZcLFAH@7ja299j(NVAAea^vMmEFWDLu}NWo9Ll_I^!fg3xa zOzN}n{6g8KxocQze2`UHnqTTs6WQ_hhkBhf}ZCMB872kG%2 zK76%{IH921D6_K_N3KRe;`Tq2pLuVJ6N*L*coXBovLJP|8Lpi}&4?Mb|Td zEr`ycqmxi%2gSj^o6im#QR-c8(JZ(L-rSE-Ejz`X!&=O9FD}ME+*$37VfB+EIr{oO z8D7rgw#bi#KdlN{UQuqt?i)s7iHGS6ZOtj@hLnh#K4j0%zdAgp_^GQqhps{AlNB@I zE*P+w7Y{;vYy7l;m4ELZpPgi-4duh8P9yZXQqA2$mJ#B(PZ<-oZEm}FLGfX#c6 zW@Z4#P?rMucGB<=nLGp{0N8?fl~j;gGd@(wYX7!+#jT|-ynRP&kG7Eryd7c*A~BM z#ZRV5@fyt+s4GN@1Z1L-eAf^wJm*T)Fm9--M46zRicc}k&^0g@PrYdOHuyKKLMCL+ z*wQ0BCowx~9kO^Ngx)f?Vu|1{LNb-?6%)MiSyuwU2(ih6g(p5AL!;SfLD_rirKLTx zqrlF9+-}7AtQBt4Hn7OWg@BGwx|Pwx;=ML}m~SQ_IEla=tCD{Sb6kA8@ieiU@iAE! zIcLD(7#bW*PZKOU(rnY{y0>y;W^B78zdBFKQ5lkE2}h{OE{T1gCLuni#0MNZu&g8| z5K6+nv7OUuIkO21ZI`56_dz0nrs-shXir;g#f{@W+c`Z_2x>o<&doH`gQ)T$E&=0K z7US~AI$Nu%OylD&AodOn!P)i zER!Owm(Z$M8Guq@l|j`OpClhO>VwgQKxMS@3-EK=Rcg+HEPzZdDPrxS0{!0V^j9IlDk!d%DXd=n0IF+ z<_>5gZNN%D|1YMyCr>)L!3_LnPooGezCx-m;=6$)W4CICIKTJjeu+l|j%u?veYnW@ z6@*dWa(o2*3b-2ff7Gy&5c{BBfqfD|H(rG&|9kbB0f`U48Asz-SDamGyl@F)wxjpU zJCmF#mBV;8l~AVbf`-Ll*vk#Xsq2^Ci#>fGcW5Vfc8RMq{C$Zj2Z+-VPeE3GnAowP z6Aj8?BG$l9zl>r=v0)_DR^PR4m1UTwRSj_5>4(bxFvYyRyP~?DBCaHL8jRo~Lq!G_ zwYmnY-;>=e$rCYg;n#_@t%yly<-P4^hZ`OV=H)SqV1*vlLyO_?GG!(q_Tfs;7BvcG zdPFMKp`fae+>J0k_k#;kUMm~JB}YG3ExN%K0*1-wCZp$ndnNdM$Wp=Py^JF5`Cip7 z9KYWF4L{-}7})>I@Wb`rl~Qpq{SU}c_y1@Uy`aliiUG>_KXIpW`_2E9i6-qP>=c@= zn`!Lo>OQ%p=>a68d3lSM7jIEym%c)znxtrCVsrQdTsZul1$u331-cY|KGU)Tk!9%q z6Y~d^;#@{y1c{cref-&>1a~`K((7nv2{4=blHXR_?GFf_?R;vJdwm|^bjd3($lu1O zCV;ZaCougId?BF>yw?y2{yo`oH|Bsa9}KZj5cxCQGLGZJv2@0k`|FbDhgn&0Xmh`tTQ;8T3egQd zB)S;__tCHVGV-^Gs*(sJ78v8>M6CA+by*Q1Ut*hih|lcG!SV~^G^V#yT^Z6WDpYAJ zjDt1^e!eZsEEW_9M1d&FxRjgF;n|Y0JHL^_U{oQ>jXxmCkL2w3^oy^Kd*i2-P)%)Q z;z^Nu1{CuRfut@*$Ae}N!Ufty2dTNvJ8q~67H zsd#F&!y&*N8_mh+6MEOu_ zs|!5_r1$n>sdq3DPTg1Ipv>&d{EkMtzy~oCb!7i)khO8p+(cwJiOhab<~|@RLfQ*? zi*wgNs!Qmw_S0thdT$@fPa?P} z{w;aUP&Ra>MEMw!;PNi1yB&Z+{8=4_gPM^B;KXh|$9oRCBPz{_G#bYLj$beX6f}tc zWNHA-#CS0OS<@z^un)+)2`vIo7HI#K1ufK$ebV2g5w=*f8uP`gjh zAzhCU?22!na&c~HmOTpnw^Wmo8vTjix~^uH+$!o8cOUwDB<6B8{;lsNjYMa4CfAWC zbFF8w4T#PyOFpVfvJYz`TtI}(p`CI8PIntcZ(vki+)qu zUTfYE7RoQ3CXsa>MHtTUksZsC6t2d zvUeEwWv;&pw>!045CL%6l(AS9S2`bmB}=0}*k%0b{~A@in~4<(y><-{q!Wg3N)v{X zXZC}C6OuM$dK{fJfEjt?lZF!MYAHw^KJlnhCfI8s7f}bN6Utj1-@c zkT7EZV+fHDFi6taOj3r~jvN-J<+&qHxkN}~JWzi*wsoH@>>`bVKOL6MVydQw{2oYpCBNAsh#AxjX0RI}C}vO=^pfeKJ9*FmxOo+-Npx`!F)90 zj+W4%98Q<80xP6TV&Bw--!MP&f+q`eMg`6(=jRi1$NIt@8-s(-G$lspbZOy`jc_!B z;;p^FKoG1n@+gpMwsAd8_iNe9F#U|+zBIY5p^!vRBg?Hq>+Ew?T|}a(D2WgbloEE% zDG5$BCb308Qq}ujCP+4$DXCfkDQeclUtUETFJobsn>~W`CGrKQ=ROF!lgs{P=hB0e z#=G_(YgMYZx-G*?${tWHqAsgTH*b2W`E>XT?!4Fc?nl*TKRymTJ@Mwdfp=z_lA*V( z)TTYF!YeETX{7{*n~;7pFZwo81?&S`&8+N9jk6S97n(f_JY4fG-ss`8+VT><<#rJ< z_;Kzq!lvQjux{HAMuJn6p8vYsuhjL-?#{tAyh~24@Perm_QD7^Ilb|y{v<)UNB*1O zG!0ZYj~egs#6|2*n*78!Td^Wcf1hv+)V*-tb*721g{yB`0aXvO6Ndy3W&MRWUjxtH zPJ%}6o1?gj(9B#ozE(TYp+kb@~cI5HZw7y9E@j{TB}@^@;A5`gB>l9TWDpOaNa%| zvx|}wktx$r0N=~KEjn4CA++9BE)N=Tim9Wd;J%pQ5D8(>tSM8K^-uzCzub?679d1!hJ(m zOkFA0bMENh$X#&iL-metPV zz+k7RRc+9Kf&a#LeH^T43yrX%G}>~Urcm>7FcZ8{5Qh}#eV-7A))wIH zx;Ujo-521eY9AM+81VH*5CGgEH~RAb*SKtqEdNb@h?(nuf;6Xb#{b>2-sjfMA!rWz z0b~CkF3m0a(Vo3bhberLjK2VBRWz+KfbOFkC?vw)UPjk?*XP|2kRR(@%fyL*|!QEz62-)NS8Uf-Qd$tL+?o^oI z;$C$?RR(e}Yo7@AGgmI8MU+#w&wLU-O&d#)eMv;Z=AvDb>G(5YzS(Q zW=TcRvy?k9hKh9$8WDJL2tpTT4+HTZPhG*OReadjf^s5(x%LJ)&DAkuoqF-fu$x+H zXeQHL!g`y=P)$Ygdci{~+o5_Ln0!hLg_`xAwZ?7%^?WCvZ5OIk?01czA)ks-LTA2)mK%@LM3rJsZ z+PufyWK);Tc75@+clx@L!u#G%3;wEnJAx`ViKfkhV~qiH1{jVBK#hO;WemRZNo8@{ z5YapV_u-kYxdl*V{^S z^~XWZa@#-l4;du-{pz2v2JI^s)x><34`)mK-<;}vO=WU67{Z_}jIgb4PbuxhUeKl{ z&wg6ws%baTt?zc4nfadN5Z%$No#STfAA^?Wpu^pR-;$zI^G3@qkD9d36Nm0tA6pE@ zfLCyTYP!hbz9N?DH#xTAaAk?SL*a$O7V=0l32!Yr+WXeqjEnW{9Q@HU4cG z*3q$hO=(*Z{Fn%CIiTZ1Zm4~@ucWb<@<3{2<=LHMi&3c$-Yd%8Dhhi%1X34!bx?TI zi?ZEr^09+z1VVz9X=-AceM!J4TD@4+*9eA*A_X~37Y8# zgJ8%^-5PL^Lo~ao2bPDm>PMT;3Io*z|46H-w^b@{Hsmd`F|4DJIL$f%#alS+rJe@dQES^D!xVtl z_@|=VgXs0NJko}bRZ_VMXt1@(0v$HUjJ~&ZSqc9H`HU86!LL9M-4J>cAfpdK#A}9Q z&bI|}nPpq9x?g29jK`Cyl*cK|j5Pzu)vm4OcyJz!tLts`qPN15@*pNZ4KmozeUPhl z+&dNXTA%>d3!#Y!HSI=T&EQ(88q4LRdg#w$J9d9WoyMJGo7s)xb&7SSOCbx?x8P;C z#JV#(h2K)>o^K~rMvZJ5I5#r1z%yjyGgE5K9HyUo$Q;rajn&DYl5l0qS-3E9A9KXI z_{ESbPZah_WxDj}y({Jfvns2r5e~xiazGXFQ%tG5cJW5s=g>K(5w=)}&m=sN%D4gZ z5J^Q2^Ior*Ita-G8u}fjL4Grz(sMS-xXJCW@-z{*)nwCa)R`E13p9(Fl%hUMVxLyuUyc=8CeFF4s zxvebXvnv-KSFpPoJXYPQwI+YS3aN^YK_=+}ZS2wiy@#_Wza+l+p>>*-F*hGvrKYAh z5(MZAY2NBp-1a``*M)^oxszGxn1+h#*puR~AR5L2Oyg3Mwk~^N&-RA(2D>rR`h~K> zh*();oeQ|{VqQ0Rrrf=RgU_f=zfj~MEW6Wm_}f@=4)3G=A4PQqY^JiS{J#Snt@`cO)12fH2o2< zG&Ig`f!T%)t-oRM`=en&ln;W315KOKcMldr&oFMTtWL(SHKziBQ?3K*oHZq3=z^f# z#W-!KHZY~Kk{l{oA^t6@{zIaj)neAp<&aGk2;NnHa7Ki%kPOepT*aqk&G*ktkaNrC zt9dMtDFSSYgc3CZh}vj@c-4JGYQ_-z2b6|y*an_L?UR8klZA<5NR1k8S(Cp_u8g_8o>P^KQ&urqDxZamIBmng>V15FU-f#iC1K_w}BnVDl}!KZs$py z9hhFZb{Fd%vi8pvZWfQ44g8Aia$lB^LW>wwN-KDs5|+XhFlq72CfM@OlL`#b*uiK7wWve2QSj(*bLt?q5G>FA)wH?C~_ z0|Lea>HgQ6%38zr@DK7k!i0h6#hdeu@VfC4JATtJx2Xn3?6yH>6aE^rDE0tfBl^dN zZ}LIAoq$SK+$8e@kDWP}A&dNm_*(qUmfg%;WQo#mxWo~aBelVB%>=K#$XMJ1cFvb( z8|H^m1-re1vQqYus6dG#7Tw~%@4IASPfqoATh6Q061(#2StQaKD3eZkGmG{*iTqDZ z*p5XvY>G%rMQz}`*3`6`E|@F$$Cmgb16qx8+f!W(ICZc6nLeel$23Ch;Q9XRriANS zuwe@JANvN~74T=ou#h4uolTu=TKaDU_($5*s3xPWGBz34)7uXx=PqxYEEl^N(A7D5 zH+iai+W7@D&Q?vD z7%P@fpE1G!5|i^gq(8FXaiPJ= zshz+=?da|$l0H%s-ZEIruy^jS+-B-f?fIZ zb#*P*J0b>zLYV^-Xgt#)1T%6^gq;G)_Q?+CGO4Pe1rR*H+-D|+qyvNR({uJLB;UzB z*KYOAW*yF8`lCo*BfPMLZc7ZLUsNKxv$%PcA z^$i@2?g5w;QLXW6y%**}BE#NQ%(1g@a zCgceiZ}KNnc$9tVRn*a+@Ys^bTui_dc<{$abVf}uH+D_z9>WvZhWBZejOSNT;|VZV zkq#{!7G^DSWEQ`%>XHfO%d&|FWOYI~&DiHF*8jpjr8 z<*^*_U=kvEd(Don6nB}92Z^^~11*!+kTn!4i=J|p#FyK_(5NF09}2!`iGGVe9q z(RE$)Y-sCALk~4v?MlW-IT#yw=p+<3g|$9Zy?JD1HJGKGDis&=wtlQ0C=+rSh8xmA ziU#1W(GVtzUb(PROe1XMiQ|40eHIjF(FJ2v&~ijD1|^GkBrswpQ9?FyM)5E4@#63v zEM^(v8077Z%}#l*5)|uBI5>)A%Uan_LdIXoXs@+KYg4Q2qE`@J>CJ1&O12blJ=MY%*=hbt$Z9;%jc*d}`>9Ggd7=MImW~hezHRyL0(UFMJw(GR&@F`mG#iD;tfD{PPL+#M9`eJzw4&86 z+t_pJhG15mgWdN5I$)Pu84D$K5|JHVO)BOT%N0XNA9%ta%oPiV|BKS4`n>Url--|C zT$DyCxE0llXUB7(X-0zjTnYTZccG?854IYT^wYqdskndJ&`y|xz`;+5Km-_FTDjC) z3flk@uQsjNO?Dh@hQ&{egd{Qbq6BZ_&$F`F=D0gq4W|3!T^i6ZmINR1@j+nT%x!iE zrq0nBrmG^>Yp#R}sfCX{VPE-jywuhawgGgx)D)~6AIB8xom2&`;|58luh^tQ^dT>!<0RW3gd=iiZmC6H?o35#{G&hZ%ESx(8whz>XfTr1u{I!PX+O%2u<#AsmW@wMhAexEO)*5(HN+hf+w!so`hpZ)EsNj5 zMmZW9DWv+cpfb{yXiILlRb|{^Pcq7AZg{7F%JNsK{?MR;pwOr9i6&ZWHhQaCo9mC2 zxtVX3@!u^Zxm*W>@6Qm|z@pQrZKiq9>`$f?dUD33p$9cyWXmQ^-rQ=ORySXa><{|D zCVe1_MWC5k1>l(?+>Dbu`n_seiwS#j#XOMge;*ad44U0-&dWP9uY1`^#fSl>!X zyE|_iFLPn{E;6r;+rQF9WJS7~HxQ9Ws#MWs*Ge|uuLDGdB&h9;a342bQpS?(O3svH zXW3tZ0sd{5@cxLw2=iT$_R@(TXIhEWP#2n#ABtXadPl(&+s4+4!iZb>%2h1eF`$+c z;@aKy_Tx<(k7)e(AN+1%(I=lzLf%l@MZ#G*D@!bv3KU{6VBYo6C!U!A8s}PaaxKEI z4xC;cdr(sL*-^eRq!ssyt?Ot8;PsX1l?z;0UV!v?!W_}lsi2Iu=0Y=_qdx+DuLn~o zIogv2ZliK8@2}@h&Ln{FQYVlH9=`z^k<+_>b@$_~W@t8CjKKns4R%$Gl78Ti146~R zU})`p)Ab>uRE0*FQE9culG8Qbnx>s~8OB!$BYdfj@Hh)_e6Et8S}UpH{u+^lGcLto zQqcFX(4=qmxm&*na8<^01Zj_n*!<)@d~4x3(hq@-diHRq1O?_D^n+ZRJjW)ha!K)} z+ve4!f9C04PP*%*lsEFWWBn$90}6 zR{-5H*rln}3t)P$yTxmtP8_3io}Q-ycOHg~ivan_)|#5%-c@29FCLuucnK#$q^(~q zzP81G+5?`>(%+JUJ4b2U>lRP~y>mjIxmo~s^1a^{M}S1?6;vY6oo1@D$ErY5s5u@~ zSPnf2!ygf0+`}3(!SFO|;f@pHG>%C~GM-SKf8Jp|S731+t#&1;!GOjGU1d+vj}=<{q0aI&a(MVCAeAmut-QGCF&Tu2jp<<1tAP|tjEG1! zfA>O0i3l*xJZ9CI&CcTw2*wcTn+;%}z1=D6{hpQ$W|{3y-&s8;hE?&+4K*E@IRE;t z2tvREcZbdKJ%bX+gxMcp zc~UHh2vXqi^wEf$vWRl1{u#ead&R*3_#0mEZ5n5ZPGbg*hg zV9bHA813wZo%e>#l*#Sv)wr(7>umnbAJ2Fp?J0y&QCgS;heIeyAYbG_l zt?*4Cey2CqMYq@xx%!^C*c^FpP{Qlwkqoxk*4s zHX4!MK`jwFWI%1LjWtr!vAzon_;X^%!fr}SBQEHy{FJxu!l*ejnhc_z94Q73pN5MS zi>hgZL&!$rnee83;?H;WF|InA1e;Ratu0O5)^~^E9T+DNCFd~>_gTiYayBHS9T1lq zq;4D8#DYooN<0-z(*79_Wg1T#iWj+T99+P_?7vwkYaqeZsZA9knOVfdS0~oFBrc$e z6RaqMHxq|iXUCC>hP^ZGM5~ZYQx_z#YZ|8IVHX^q>NW$_Um1Y4ukGs@)f%kYXJJ0E z^H3F{Dkv+=*hjEi3evX`I(EY6QpDfUKyU|EgvMW+etQLcno+cqf35TURF0a5>MVkW zoGGK6S427tHXeO?4OPH5EAD3VSuuY0(6a=K_;jZZG^JuIqN~$~DR@6Fj9i*Cq3<&) z0c;l|I^XBYrh#gKXGr`>5B1=-UNP(UE8hd&z_dNZ)uTx4lt!1F@i~;+)N#qH{8W|s z2s0BbG8T)!KaRQ8{ItJE)Yoc;7|+`ze1c4f4E_!ft+LDL9E{^z`x=X`nsnCHj1wg# zWsiII($l?$$ zsd=FG3x%&yYLjtl6YjB!fWx*$ zr5#7ij}g4h0UF?sk4XdHXl}ocLXvfwc~r~>l3_!wO=%1(vU>GfED)z)Zs-I$(Q5`o zdNj?Kzv)n8k5*v|TWssmZ*hP#$FS|gY6DoVgT03$1*xF_I}4Sm8!kj z>ww>eYB>_MO4^QKOQ~8$N|XhzaQU-X%Chz5U$H%b?)`lcY}+(dgg=#irGSp*!WzrO z6dp52)6#i#K4=WLymF(*OoyW#1g%mO1oI+pBN`za_d(`8B_)x^IH#3*iVd3Boe)<3 zRFTsooAdtD-#1sn=NP6hZD9&*V(BdseT+uu&BJ3H+2_S{uH;BF#b%i`IZ+;jrvzMf zr_L2Tz>bLQZ8V~mRF7!Eg5+WW^@U5Z&+i)umG`Z2KVO(hNE76-A$1!yXPIW@ecN1K z7VQyT4eGJpn#mLvuePF#Ow*O6q_i1pVlLDaPB;#?CKyvO;a)Hhs&qv{ zLEK_FGC8|*PdGdkio&+qvecMjr}7G?6tfEL$Qr_(w8<|hZTZ!X6+K_;suK3a$DJ+? zqsUCbaX(i9#rvd)r`r8mX~L*KhP&eCbXvB?JLeE4XyYV+5HnN(M<33SRX+c6VQHT)iU zN^T#~KRWkOp`+wRh@-i2CR1H28IGEz1EEf1TLSddAZ=Isck1iSzB7UVqy-6DV+8nL zesOV#+Re|s&5N3Z#&GN^8c+6N#7281WItnEFyJIr(8=}i5i?IuwfJM{*wap>rc9&P zZnk;`fi|FEWVMPQLRsUVL_6F;}^j7u(wOZhaJjHZ47D&!#WVI%?pAU4+` zmkTzoi@{)W69~CsYC76I0npa*GD7oe(b^N+ZkN)MYJl%Gh((KqdXu}}HVEUD(wz$* zin`%UiCvn-iW{rJm$YShZB8uyY+a^zZUN?=@|)mPf1KdXuD;J`HNv2v_9djMsV;uctb0KB5_++;5?I!+?3 zq=M1_=<=uI((#Zv2D^S;{)=AKbDp~x!ZWaKhV90-ow7guwbGqMp$ETtP6C;wi&tX- z2PI5G0n?0_CMBIxXDI4Z=}7(a70siOadDVawJ0mF+hN^^IK}OLt2;d3vOB3Iulwhq zQh=P>uDBTUcMyD&xp#oQoy+)iTdx|C*Hcw9#kn@pR~ ztgmp7lADBYW8*-?5g^91b7q?UZ1nYWvv#v}gtjk{m`Pf$!{F~4F)y|rlVyQ`&&eO) z4*XcyIW; zXSf7W2E#IZyVsPjho;*Gkq%UwOxP6IDF*XdVb*Wqs&ZAM_D{XPnEBl^_~9kj=J)NX ztUc_oAmi8|B#9TqT`EuH78@WA^6Dzb=X%jF;(+nTr%ENX8>{cg;$l8`v|)c9#;vFh z;n#)J_h~{ez4%)>1|D1BWRgcR^Isrcb8GC*9V_zot;1a&{kq?fZ;uIjHK~_%F?0QO zlL3|LIlu2e7-AaKtMwOO0vG}e{CDDsZNEM?6}DG*7uE<@mhbu%^1~oU!x=o@f3;@W zhj}#gst?rQrxYenOfC@#R8=asCnoSzjNNDn-CWhw&qqr;Fph)GSR#3y8XcRHRhb)9 z>kXxN$Z!zGGWnjnTFlizq5t`LJUg7`9hC}Fbn+-fK8z^Gs0ximILz!jKW_VYz)ZpB zR#0|&xpvkrg5b-C*sCPlDkRe<(`QI%JvuDJqRMWPW4@L{o#sWU*>o^D6wlIUr2>7N zKV$vPe>u|v*e&Wbf9W)%kdGS=YGT7=1$Msotm6$E9o^CqdKWJe*UNa>Vt_~?onG%+ zPLR!C1FoJNOy{u8yIwN8-A&^4AeyX>aU^Z5-hOC9ZYfv6Wwn{uE0mtC4sP!AQPd+@C2}Zdx>6PjOQltO)7YrF+!1Y=^SZ@6zM;H6oY_mnEl{#XTMosx)31F* zKWWvz*?eL@`@7Re93{e))pd$^8ryN9;w6o>?`9b_@vop0cUHw5jfnlqgZ#SX=0if@v1WH(d?ZL`1m~S>`RR0)3Os$4hfVD_ zs4UZIsAZnKLc3&dV+l(hI1Kpn2O!f;@!Z45Y2;)6tIQMQ=O|rW(l<+a@w?=sK)BG| zz=g)^<8((0ooOf5LCN;$%XZqA{Xik0y(XcsJ zI-J_LO)Hwj8$$4CIGx$tj0t8?%>VPUrErzdI}~&6X*Z zd!`63PfWj37NLg{^`s1M#oINJk_BpN?#d&qj61T(ypIE zbn1oFMWzc!hyP30v{{&+R!Z9}E=SwwoCtwR+H;CVY%+LwEVE98v!lNjt)5%8C>Op- z(KXhk6TytuTB0NmI-@TJd}YX?@{=@_aRelc&MiGM5_6Xm*XZk_N>r0c7NC_=PoRrYyly~2M1w=hh3&*MY`5DX;mWi4W@a}fp{bTN$vmDXn zzcOlk?0rA=^%NnDLT)L1f1cq=_)rkY7up9r*9bw<4`U;gJY5^5tdiP}f}tS3ed69)>IL~7ZIqA(sZ8j{u*CgkmH3M8zLzkOlkh;*n{GEoA4;0J$uxYlsI@UpHLBV zdgyyg158j=!YXktlWuUlf4oZ7g1i%@%!9iPQ?gQ)t3lSl+qE;P@jCs{?mmKwW zFJnbKz{b10?!%7?g zuSamDS_p=W?v!ex1_6V-X2p2fNIku4CGBH zKiST_!JGc#47>4}X2JYMJNF^QQN8+wTY*y6^Kt@=r5Wp%H~WK~yZ{i}1jDbOo1KyJ zy1$s=$f|f~oOHYK-y2hrhE}2Ob7LCmz&C6Z`_et7yuj_BPyWdAAGB8{G2L-X(yNtB zMoHZ-y`0IX&;X404AG`sEue2zm;yA!7whFDq%gVlX_qIvo3KQ7+55>@=+j!ASCKdg6%p!4-6eQ1z1lzDL zu+JpFf0M)h#%_v#R06VHHU9X&VM?XT>8J6FQ@@74EB*Duxg|)o6B~DZV&os>%JjkHfPe zWo)_5|QvUX`|f+(u~t!{2_t`&$J^7;q}8G;9v+ zWofEmvQ`X+V6HE&e$smaS$(-3F{Fd1H%R_htRMePy#U`l|JSk{!Dvd7|D1~f(=f3qaK8(gJK;N4F-n$P=hY-d~hZtr> z{D}pFI?oh8V;wlyuHnzIit=m)N&n2zZo74|*Zh#1es)jEU%3p}4akUvF2{(&raTxg zxk8o@L}KZV7D@YqyoLVxLA#1Dmh|u8RQ|*Dxgc{x@O+7BKMNmx5hOXuujOBU-7fZ) z85q>V*-H;$Zrr#n*lfO`ZRwQ7&x=2*0ZTX6%Ei2r+BC=)IC7^~Rh-zCR<4-$nA58w zVW-O}$|gd-8dsT`oUXh0veod{6^rbj-5LmZwCw^Qgfwm1p&7WLO+ZzQeHN;m>i8*w zNAKD5)r^&Lm8l)TEF^amMamCqFO~87bKbo1akCvUY3x|jtEUfM)_eOO_7Z0&=oKI2 zUDG~?o#ro-`a?ur=f3hR2nbHt=%GV}3A*-b!&s73gbzF-agnB;>@rrA${Jjx!X{i7 z$uy1B!eCzK#s@srj=i%uqVjgJZbp41a2EUbW~RDx+*a7-J#F4|*kmW%*Nl+4JVwxc z*g&HNdxmG{41vEygrhMeS5BCgjRlcg{Z`6?<`A|k{jzi+G^CRR%bnWabReaF`vGnR zcc^`9yeQ7?TG4PF#DOz)JS?@gw|>KN2y4(`5kh(!jZbv-=_CNdk6kjkLp`Js#-eWH(puMfvwB#jhz>iyBC&Nz&&w7I6(kK zj zn{qs>S2Kx{VPTie#^os&MR71ZDi%zJuHaLY zkOpFJzN6|*KpS%@hskd`PTi^*f56_xo__&lpM5ouNRbRjX-JZAJa&^eRJUJt3F?xi zI!7N14lPMG6YqGBAc;87%_BUKvy?U)7hd1Wm^9T2R|j#~22J4tDZuOqG`*Z{>$ zPs5x#ay>N|nW}-h#9>eT>9=(<`i41c-7RCaZ4MYF2KJ*knQ(0}`j3>K@$Y(r~!nnEMx8seN5; zgwYd7aAT8Ayf*NoCq;iRxZS(#&03VJ4U|vTFhv%|#W1){*Ir9obR_<^(nB;H&L-xp zKrxt-_O>=gpYG7-wZx?YFVgt-vu}@;**$JQ6U*JdWyUx|Rhz&_ul92xT)m5of%?7# zh$r0dx6ysJ+;M~B!-(6(IWDkXds?ymAsW(b4`bt9zg9ttP^?VVq&d(Jxx-9w6|7$h zh0h}!RjFug#Pyv-ROHBVU%cZqo7eFK2EgtWju1Fio|?(u{O&-|t}$2t5dRgtpcLGU zx`s6yT=zRAXhszhrl5!i7Kqn|GP$8f=VWcu&7mH)i2XrX{FM7gOWAqpaZ<}3MT@N~ zy5nR4ZY|a1gpq>?v#CmF{)-v_6&RV@9;OOh${nBJ4C?teOcWq1? zbmlOod)fR>7OFRoJNg5}yj2yu;v#0VGDaQKCF;^K;8U3R?4guyqbkjv!;|xS-2Q!l zT<5U-Bwgdh9nqkMeu7?MXZ`F#Dyf!mVu2Y@+N1GJEV8T~!ncT&PaPTtcPXowelHxw zW)B!{O&yQA;(^YM=ob8m^(b_^Gcd;V-P1@K71J808Oq2Q5wIpsjo!TIJ~4EJ+?3mp zZfj&^RM6C6a6IFg;k%){0-F1mUjsdtUn z)TjTI|5rOB2wI4o?>^jCJoV!`$S2r8JS2YoT1&6gW1VZ%;;Lvo`(WD zdA*IjUxZmj*kc>F9&K;`SC`85@4F=Uk@!t;3A)WhL9{1d(R|J&#lpC4^u4=!^UK+0 z6KHW7Yxd1~h!ebUpOIRNw{#L6l*a-zitB|x2wi`AgSt$xlQuiN!W~EzrTrP(r**qL zm1VZhNP?8y=nM$=R*FRRSymX6isN4Paz=4q&*)y)$MbN zqp5$d&44?%r)%mUC-@it?k~UkrZ+#`r1*D#O1XrgPsyCIR(r%X?*8~JyTY4W1=)d{Ens?LeWSdw>cu0z&@#fMAe(Oo`A zqlm*a6mZ-ek2~20R_uAao~sXVJ5akt83p1GlJ<>$@|B?($RneLfKMAblLprpN%(FE zB-zWzQkKClg|WW^Xq}#9;K;)M?sNEfd3dp_20!-#&=h%Q|BI|*{_o1OnVJ3vgzQ>J zCV_+vvFDNI9bu^b(^@C`JrIn>3G^hK(-dG&?`X*I={GUky6s+;ga?r-R<$mly+*%! zSe3@|$hVe*=J;F8_f6LCp;UGL7I5X<5#!4`(pYj`CJg>p@5LUE9n546F5 z4Qp>9>Fe>UsI58d{2FM$ZzT2EMHeR(P_EH1go0QPRQ z*?->J#vesUWe+ zGI0AwbaURZB>=m(N&6$rn zypC4|DWyZ0b;N&SA&g{to0Yvc9$5&5ClK~|reAbGO%ECIvwiWDw|O|^N0&4+ZpIM7 zPcLv!I37Mw%{w!w(71%`G9>qG!6tr`3+n6RCOq7ckE3IA-;VRjrXP@CuM|&H1A<8M z3{Gi8jSQ)t6ogNlDE|C+m?9v1!Aw>E>clu|A;QIsx7|%sY2_>t(Jk{4&a`-?jKN=b zVRUBYUn=rR6Tr+?llMKl^+; z1K<*RPp?8SDUFM>m9uCb#0O${-I0+^dUMQBq4gE}o~Z$HG-;U8f$ClsTOd*BwR7aY zOg9%p=;?xgE@&#G3?!KTevv$ORaw@9aH>7b)TZ`?C+>cCY^lVlW5K1p4|V2QwaMyc z`X`&ubzMsFJl-L^NKODeN!SUAK^Xe@*dALDxcJl%3&UShF!2``?4?`#3^0- z));(T<;yE>(YGNU%2kux8~9(Afi^zSzdA3e$L4<~VN(yMEI!H48bgx%Bi*63`|zRQ zFkSqv5P{+GOTn!g$K@dan*@+cN(l`|eIXZQwyuTT#c<7LF^dNKy9ceOl!-R1I1>GY zuH0JLmV@ToJ*XKdB?-V&2F*v1w(TmCwTq`upi{7hh}JHIhupxa0vN;Moceg% zLq|N*N{3o>%j=m7a}z$^gbT&{%<^r7F*P_g!A!7w)Db6^1z3VSgusWg?E*?l-eWkV z!1K}>T>;16h(|-){LLX0o_cWNb$wj_hmzYl48plt?I#>T(F8G)8LCv`Xj^I z|2~ZH&&Ybn#&Wu%cpgN6R~5&+PlMOkqoC+tQrZPxD$1L=_PxMn&AHKa% z9$xgY8-Jf7cms=zKr6~Pp(zr0o+CZU+4MWpOJeC`iP6JX+{6PEWY#KQwq(nPW*G3| zTOXSG$?OEx84hQNcnMKLC~NCdc2UJFu9zsvS%BaMi~$YKGh^`r-Hvjga-vL@UGL_h z%Ka_AILW9lmr4XA#?zw3WTFX;rIb5o8RAl~&%o0o4DNKt@k=6WwFE>q#;G2rR0XeW z8JFbYbTJH%NuoU5vLOK|YA;m;q#BA1DL!VBSdo;OZ@yK_&HKX$#J)QGOV8na7sdHt zJUTz?81qC{FIh1f*piqzG2&kNa-I9|xFCRt+w&S&KhU~@B{b9GF@mAct{z=}84A!s zhJ9F;oZKY{(=-xT6DgL4VjO|ARgjXXvQZP{=cD(=G== z6Y$QmmM2hJGhsl-^cs`Rld8??na%4JlQv!b^v!wu;|3>4q1$JWk_rI$=|Ik>tpVLe z&N{`U+mtcx76Iw!l09{WmP}_>#2Qh3Su#(~VdU#?I;XpeKt6ELSFTzPGbxm43Rv8b zoxO%Yp}nQ7Q4bPa?d*qFXRrzg43X@N8C&~Z`~=j?bk3$`Tdt!fZw2ng3&JktLT=|E z22YFUDwchXaBogL)qZ7_G%j$i9@9FITp4jvK#oFJ0B*QP*7QPh#<39H_C&Dj{e|9+ z2IOWQr4(37?~8dfRQFo(+mux9f7}a2KTeGX?`PYHEG`kGQrPv_z4Hj0_LuCmYR2*H zD-nG1osMRybxk$v*0o)6*fy56Hjh2sEYtN-7@s$_qqVeN_#+;@Lh@G!u4)$|BBak% z?<1L5Y+0yXG7KHnROw@9rx^mp0@i9x?W1~_AW8%morm+`?RlxEtZ*CMXql>N*v<}W z+|r34pZKinRm~9-!(0k>&tS(n2yQ}|qYIglf2dQAQ>iXG=5#>9j9-`$JB;2%T7vZS{ZimQM>za2NrkaCg0(_>p z(rbh^%)II3f8$BxwPg?u7I$-=I zMt;bxDaxOzRjoLM)BOU${#M%fPhsc3lM6HbZ|Kmn#$?PD3+%6B?G;P{;R#jl&cIK~ z?<(PZTMu>F+LI+wxMBSEf1pFh7d;RRZD*Ghsnqhw?rvfh@6G|?9lmttEat}H^^2pl zHzRO2x4fN~ySpW~-}t0?Lkdufn=ISEapws*%FkeN^P!frIL}08J2^7_jneRj(OH!{ z@CO#R@&7`H+zhkYZI|TcZU8QIgB}Zf$KTPmfAh|W?ic1(FaCC`Xh&xf`PDo$-hi!D zWp8J_zGbk+!fG_&=813b7aN30mQLFupB9dGVbTpu*yLkuhw3U55|_%$3qtKJJm}l^ zwOr-f`=wADv%`D0nKIHv&kqAcaTpWV|Ff)>evt_!_vZSV^?aX<{wAKjz+FEiAPkt? z+a{!|Ut?wA_D2>1wX_nXAr)2P=AEWIN+f1`wYc!b805g@FK(uatQTe=vk!}!;EGGk zN~Ou{d3+;W)4kCNKnUDFHRlF8#Rk*U)FyVxDbXeyv>@y523l|Zz~$r86S-oxe73di zG^2=f>pC0@ifcv$e}kDSR#qLBpv81;hiJ-gnJ4bEwvxWil!ml3ux)AG(;gkJhTv>q zYEO&1xX>uXUr|O@O8QgT4#qs<%rn5*uVkhs;V}lsza0y&oxtHK7bKq9dPLavrBg^i z2)0gAQ z8oYcuLiLo|EIw0Eo8k*pQcX|Z1qq)M0xj5ri2K0f#Hn%dDi9{aWc&ezPRXw&xV|9P zidMW#WT`6E$WvCzzTe~uY+EHrUq4v2dS7f)RmrF^qro(}USkacNg)TgK=;9q?TTXu ztT)23jTV#QA;iR$;!>wh_aB*<33C>KG5TkOVgTbD@RItlxeKE};pamO3&x`gY&6E5 z##J9)BMS_q#yv{!5#IT8`Y;Sim&*R0jvd|(CdU_)i(7vR0YJkq<^>ww#Fzj)_L@TR zZyl33getYPWb23!T^wp!9}DS~*ff3c7$+p^L_u*B0%&5T-~hp-x0RVF{l^>o<6 zSj%5;IE3k;YUTJ3)HzwXRFQyDDv*d|T0Gg&)YwK?w8iZJvvBws4IUsTEx{1vjKnD5 zv$XlF`ph63tzMiv-63t7QQ+6`YqOeJJElA`=U@^=8fumYI)V(SLre7IWr_+|_v{Ai zIfD&JjJ<@UsGM^j$aVDNVUpGKb;p`$NOC3p`*~lzQ+(S+K@#g#Jlhv~*=iuuKl-2F zCTYhbT1)f`#V1-wH2MlraxaBPLhb&(nx)qYE|XRG0}VXg+Y8R+l|3|>c4F1aDAAbv zMo6X&&F75-8WA!rXp++0OFZ}Ilb>u3NJEv60F*O}x)Kv1=39P*)xq971d)MJ;>Yoz z=Y%>rKp%9mVdhieHL+{&esCsJTNHrGuv45tHD0hdSa4FirYV53$S@WhFzG6yMbWRy zcF@;+M0=8qZ^_>D()fCOfe8DyFwm>67B_ZrjF0CkYhvg(8j(MO0)f|UQn-hs3lhL> zX^+hVd^1S(AXi;7N;%jiyYCsdt>YhNXe~N?bR=Q>EdptCLX2%OdIE@*?r^mbGM;2E zN8G@zn&>)M`u86BORwS@pT(cPz)frG9}W76$0tp+Fjto5>u&7Zlk|13?P)58Ueeya zqFJ(AB18#qOlaty^rKL=2D7>~@C3Y>AjucY?jv{a9rob6<@#FWR4#!MpsVUWss%J$ z?35sxj~f{cgU8eQ#nZ)mqBTaV14U(Bm@OmBIO%t>2I7jMl+Tu~Cz^)Vu@7wxUl;)C z{9Bz47C7W5kUf3WXRT!3%4O~T?S-H9N}{so8#n^6)TF#;Rff&d^(>eVITq0l9TgLx zPG;82N^#+|&hh8~34JUf$KyPPBG~?dqGm40&dekE-m?odNkSbtR)s+>x(GDF5ChcC z8Gx#t-raVe$p^Oh_m~=y)|j$zY(pOs#R)O$h8g52#|^+@{?y*sMv$f`fKoh%GtX7z z%icoYX@_R3{BI&CGqOjO3UsU`V{a6{n_tsaBo%y+_zkT1qH9VB%M@zTD$@ZN#ubsa zytf)gQ~BC?*p_B4HT>?5g7Z#mETovL$1Z0WmmS5mQ*EC+djZ!uHoo{+R)1)Gdva!# z{Q0TJ9Y5p z(ro~Lxphvfx>LlR#vDeTNg_ zT7k$gjz|(!C{p4@O>n*BlX$13yRJHbL;;dM@XFo|rjd%eS(EL-kear_MP@fV1U-sfEEi#P#%ubC5rYMEhjTc?8w2fhLCa#M+0Se zP}Hsn5k%RTmA(`D_~)01>snmG)%Q|Y?+Zq*c78QMuo~9*Qit!7{tXN~FE$LJRPU^K z0|%nTy+%_&EY|+6V23B1&^JB#cH`apzIvBtlptfmzWK!*0eiZBo!kBZJ#RRb{HNUZ z-}N9^8UELiT(!pd3}Gum&nfvkh)`o261)>QJm%Q+_*MWGQS(OX>t6fOlj1KivL3Dc zC!GGZblHk#SffW{>^v5NB>YG3!Qz1?0>1S0cI^)8`>VzM`{{o`I)LN_QFPv#B~WVl z#kqVCb{6j}KbI85ZJ8;rOD81@isYZv_vf~8JNxd9J}9zOxTrd^tz9yRhvVxxP{Yqk5%3EHxhZ_g^pLY@}9mkKeiH zxr?=%>Oq#iKd;7aUpXhB`qlf1x_ps;a-?-NM?hKxTnXH;YLo9+kW0vlA6T5Hb}=fI z5RM)QP}>Qq#{vV9V4KTgKogbrRG0`Pai~-&*V#VwZvkC-thW8=e%bhnlM$^19O&P( zjkTEnFwj5*@||et!EJw=VMDSiP@$5(zS5H!#rAcC!40m9!vsHoNne9ND3&7JUSkhk zv)+TJ5R3|Lw-nkO=tNUpgjR9Q_GCtkh$&Qj{mmL$^yNmmk%hZPt5c%|&#WvKd%w!ev8gy}4kHD_h=1Roq0!IW{@hl&0rJKA27LR25&P zxz~(ENHZqh8Yvlx_r8?HXBs1@Ek3-V+Pi`)^8zbQgyk6ylOG1F+ToN$q0C>R`0eNt zH6mC>LkMtcQOw%J%sn@g+983g-Q>#^#y9Ha3}pz;t()=1VrOh$1H@rTS=O8ha|>LG zi)dk6zzL#+|PPINPt{>9eDSF=Ltz2{bEedzfXm)2v=pIXIX z{rO|qp|-79Oll<1gyp1dqGaw#y3fR~bjLXK&UX!D8;5nElj*?|s1CCJP&#o;;TE9U zs*GRc}63hI!$xumvockU}MPzv)|*SL9bH(I!GoV-1-8 zj?`+2ktYjFY!t9i%|3Hrncfhm2kNk&I&+H=m;O+rcffzL%~SME=5uFS9;!AFH%icOs9K5g z&E1@t10>Ac{f#O)V_tEkb{>BPA92u`bTlbJDa1iq4Sw$?UufbSqPzw5LThbt^8!k{ z{-c57sm^s7g?SK%Ab9jS4t`&l@TMq65<%*u{2ZS&6NCx7$p$K)nM(|mGO=iU$U@xjcCaue>JS7&eafqLarg9rU_Jp?_H=@RLlrJ zn9Q!a%GUV2U;Ue50b)`voe$YdbE76wc%H4wMI?)ni0H^|L{>!H^t@i?h>N|~B;*Ck z#pr;6ps!7U!ppMYNLx{_nhV)t>vojqS+(tO6t@YH2!%7?YoI^8BpoIFnyd&?Bkg&t zMH91(3jZ}eIuKxdku2}Ak3i-J9Oii2M4G201=FX`>}8K;%lI+`ngLY~0IcS+7SCTH zL+0ihsy9&W%@9-MLW<9()E>Qdq9!#(3qmTScYHNS%SgmxKrAsuE=06d=bwE0v4>ND z*O^E|RVs2)xeKuYSBrop*Mwuy*kA7yj_NSa>n%a)mXk2BoH*w%CpF?A!ZZX+28y>q zLv9mAlw4Z{fI(rkhdNDOG zx0QH0c?rq8oewKE>s*!zXLcNr!>jJ-z`?j^9@B`emDPD7*+vyo82?qJkmjzRV$mi0 z4sfur1|BierFI_W?$QMSHk7F9%8iYr9qDtsc`>}cy6z>mR%r%UUYRnMorRo^q^&7S&nChJ=5RFEVUson@Rj77|cZY}N+7N4ha; zUT#_yQMt25D2w0sb`ouLfJja$B774W=1yjxkWoM` z?>^u9U6%#4VMFdD(yqeUdo zx;RJ965C9^zVTEXoXtsume{^?8M(v3=UEa zk@am5q+ovKNfW%N!50mKfb1DOOZaf}wo_o!rFsnSl z^^*M0oL&;D=UL8Q*P4T@zL%ZMifkSuAyIZFXE-xh-hbESt^Mg^T$ zNubyn&Z}e5S%N&*DNYY#jNdIu!?Zl2;QQ5*y5krh}u(GMKm|J;`xvm&ocO5nubU82lI802}Nth zlhdYUH(G5GpV;1LLG$^Z!|lb}rS3NvbI3{je+avb|CM!?ft8;9|1bS6YyQ7OxBsEZ zIO_Td;DDlI-c9Fpz<8BiC7m$vtfjtvLEP}iZ!~ORVk}oENf^o)N%WVs-!S{Ta(Cy1 z+ukYUTPx5~A-Aszy`lB%3y@DzxM&lv4nJ>Sq2dlu9te5i!I(n%=izn(c?Y2N2Tcx@k__nx=c zOx#R_Vj`T+5#ai%y#0UKE&)D^%=MrXl2(K12GqPfm(?ypsp->w@ynz?`3MCzjfG?)^l>BWF~p zb%?-;o&n6B)XY{5Rv?p@NG~6%bE83{GP&b&`>7c2SG=HrQ2s?^L zcyLkQuU$Rh+n#rpukkr*_=d@mm52x&u&l~uKa15FzQR8La-Sq_V4iHc<+DPA1< z?ss3C>r9)*(QO~(^!3eu|HwPG3f&dZL&j;zAEx9Z=}b_mWSy^lhaLC2xOrbEr7PVXM7{_0U zP36PIv4w?wsJQkv8N!AUfI4V_?~(u>(Nd zlNoy6AyD^hNAF2!NmU53=u4DM>OH-{z_KFf6c7NIZfp$2OCJn5?f|`N4LYxlfSAti z6kgmIaqHwTaMkl(%gv7+={iJ9=jlN)SsNKwpvFxyBmLA4sX= zr<3_jDgQGh$DD|nLr#M$iwiW9r9?)aL73Sx%HMLT05L_=Hy~FJcEzP|n7@F6CVzda zNEXz-ZdwQQoiv?Tq0*$$dI`c*sfo7pyk4Q9u_;EF+Uzp>ardEeldh*HIkYoXk( zdc*ne;z|Go%LM*>vH;wy^>{Mh!AvJm(xHVw4u;>3_dcY zk)@6(KQKVu#bS<(R@SGa1m>V zS)KfekL~RDD_7SbITm}$SW|;qL$t+y5%we|tI!#W0jGX!%*?*xH%vgYLpeF4+37si z^7J8Rs+`UN76kmQWxC0>(V71I6mjdU%~gZZ8<}@)YZp}(g2`#+3vg{7RC@wmDz1eN zzqaPd0wMHVI}9qg9(r4t`0=YkHku1Jo0n+Y0YA3(m~bpR2ONE?V!Z83J8ksFS-ujm zcNMvUJIKfcAq=HOkKnJ3sT_QPj4)i5j{8Mx)8Hp!elJ)~K$jQ_s~GtGw`r0jqXz?f z!t_Awqf`Z>5fk%R_kJj6FuMC)G7@0e@qWyHagG7fxl86LBj}^+6_>tV1@7}r_Qosz zed@QI5U(qqD3o11bGPv-K1D1NfA-eJr?A?C9ziF8oG#)drQmdm2Wp_na2zH-g>?=d z;v``=)^h#y(F$7ESg5(Bl*m~^0b&Op!-Lj4Djs45Mu}`^UiRfz|7-3j!tAo1*%jWT z=nLGG3(z3+g-4IpHf$mr@Mi&S$t}V=1ZK7}w1|j6qpHTXiSJ~27Y%;9tEF`piSm2QCVWMfQ|K>kG)AM3s(x z%eV4nXMbdLN1j5<7Ni^(A9w;Tr%33XLJx=$F)fq3aZ9sK270WGQ2RJYzizfy`sb}LQt1UC6T~awH_t)R4n-0TBi3aoi3018O{6Y)^`8xr56qf16$S0gW13`MQjZCTTZRgAX-5Sx;+olI`JCNnPiOOs5J}(wfH93S|+!kM#s^a6%or2hV{3W!g4B5 zIga0gkyypM<3#G8uPz(9BRYB>w1X&b`%?<@N$)f;%P&eqPj(bygIgyOicx}0CU++q z2I$^&McJ%Ku3twiwUdyeYkchAEaI#6(`v+uNZ8TSub8!#f1x$@gO_)8Pw!60l-pi6 z$nhE7LT=XC!ZX#d81ZWzyW7Y^)K>gW!ZiYfl<*?5SYZ}O#<||lZB@?SQ%7T591uP3 zd&AxWd)lvbdFBf#EX>Y$3P$F3P7uyn44F8Wrj94UNGW5~P2~IUbDf|gko^(sjK4?* z4v&SU7)eQGBZYzs2t#?FK9gJL{?M?z9Hjjy1j_ZvJEng?1%V z{{7a(Mdv9e^0?#NzO&|DyGlk*(GGwnMew^FSIDm7o%dr`J@~R3>(|Oz)oTzH+a(p-X|Mz*XPgRz`4dt7~|D{`rpa z22lQ|l>1*X6B+5~{+Iu!`4??N+5Z2~HdVi0@pE?sd?tQZB<-DeP_CU6nNtQPzy2Sb zBq4ESn$7IJfmLldZgCu(golR@Kq$B$y?TTC5ysQh+TDR@-GNix#g|-PD&DUuw7n@u zxXD=Sc0ZGZO%Pxp!W7&WUoSh@6AJg&lnaW3R``8eoStix17fIiT6H@nc@1{^npB$pL5ZF8CEQGA`}nD!g|K68NcLB` zxGM(1o2M_7nmShsp&qpypr#X2i$!PalbFey!%$T8FX!ew>p7H zkqf8BxQ28a@9@3&UU+w=R$r$h>>dJnh1N#u4YZ~RQiwt36B z8{Q$Bfa;kG@Ky;}gH*9dA25ofc!n*mbr!u~5$|cCa^YR)iAl*}%Mw-?i~!SBeVWIy z>95*1T#=RirULD$ZjYYYP(Rf?=`CR&vC*qMEMDJY0R0PTCtkt(Wrc=|to+(`tsqXK zG>m1>`l>*Rg5pVAG{WoW%^=T%=Pab-x5;I`3jg?$^+TTl&#QYi>y=6+% z?C|{Gy&U13?-lg`11{GUrKO)ZrTp@i%+Ej&d*|x2Sbkc?xyU?ZyXoFjxkQ-G=D`Sw zGLi_R;c=P8rd4Xqnb5Dy!@U+mC2o*J`cMH+MlAqtx(8V}l$EJTFf>fZyh?NDmB0^A zZ$3T~6wMgt@20>Zo!xHRAaa9&rmBwB0d^i*1p7JE0_9|t->E+jc^8(}oV75@MR&47 zj5tz=M0X{S@6-6pqpUk<2R(42e!~qiEo5CS;wYX(v)(jr&}jgGz2)i&M_#)hCq{a@ z(*yF+OVt*=@t)>d_Nk!Lh12?LorSsHK1-{lhA*jy&6y6fpp8muygZ6wb*-;~Xg`xu z$+=!cIwJHRFlavMo00{VqUlb$*{ewKbnFF2BRxFC){*DNahDDIo?K7-Xy4KGz!ra3 z-_2Fm!AUM00mlqbFUfLtxNp^Nj&Yu*j5!=pX&VyEa>?Hkr>H&OnTpogMz~IKgOFTy z!Zkt4a}G{+Y(|!Bw)VW}(g}akhtK&vC`f; z6gc6<2qPTKD*-zc+N?tTJcgXIN=1M6MmYvnG9AS>0~kEVTg%P1DcfQt{5Ov>x?#{Q zUMcc!DG*UoqG!+3AJ7x7Ni)*<;8SPb-XU0(%KKwh){0KBc@U+EeTG=Eu7H;Use-2< z%`ykta#^U#d6NRzfMzzW%%U;_=|YYJI;wi3<#ml2BX^QMTK`G#T2GEop$T)DR)`w4 zKeQQ66s^yU9^r+9fb@*VT+=N&L5Nb32{8cbZH_5SPD&bW2G%&OD+f>BQ&KpmuCxPy zj15L^h8N7v_?!ulWjq-ccVT01{8JD}Co7^!bpvlpL_la)c;KP-fe-6FGn>I*k0XyT z>~~oWF?)e*nTR9n0R)Z;G{s~O6-pNIc)_;E`ev5o{lT8z1+^uS#G-5y*_8vEc9(Q* z$|*#(@vF;zT+LC4sxWYyM#3|_`IBW%Urs`v9UDX4XNnAL<4J4RBG?}_Ebu&Ng zvhh2@rd*v88LVBZinN4L@i7nGlOfYgCFe|0I*zk{g#k6{iL`AuldjX%a(`co{!Yj70+@RTQ=ui`eH3V+;G(JJSA%j}T`n%-F6Fh};XL;q`wK7PMy@ zO10$UgOm_Lq5XhcJqZ0Iz`r-17!Og{g<$`@fwuT4ZNemF9wH~Y1f#rfjqZbb46(;V ze4Cev%4$~9QNlL4q@;9xw`)Slt}otDGcY%=Tp>8FdE*GtB4utNi52Asg$VUqwIr%6 z(h=Ks$K7-bRDAlo-H#Bu_&N*Z4hbQP_=PkvSqfi#SV-JrH`ZQ}8&$Q-tEo<1>0vV? z2f+hP&zQ}P4f1EOBOhb#D9Vgx-Hqsq@y|0xh) z8FvL09j{L9RRWw&vi0mhyg+Y#Vqe1cU}w&3c^uK^Br9bz$XXF1B2vYp;hC$6rtnCUcS=A9(x@0FgFc@SK?G~bB zfPtW``>{;G}d!Q>pUmhQ85DChdxxBQqY=)dDPYZYLp6ImNJ4 zm0w63*6{#^{GDwGpHod5n$!kB-6SOCqL>j9B4x-ukPMS{K;$7(Sm8%#8SL4vxnYcC zVc8hSazFC*kjG5f0gJxP$#wuhBFy$DzUlrZ$Zob~O^hVjZ5(Nm0Ed-0fwA$#EvT66 z35C96Hj!gY!69q`H<-iFg?c^z2uuqS?dn+X=%#%vSV?F?2`9iLrz($p4#D1o>mKM? zUfS*;FDy+YU-L9Z=AfDV7Ej6qR)q2PX$-D3pyUkJXDmAjuXN{8Um~t|KyhJA5ax7f zczzK1I!b}47UGrSnnD=MfndmKo#`l!HQ}tu(B`9yVnvuq9bZR$${cJ8{9eSQ#`4WA zb>DuAsSd1;J6^?82%|@^$nt{_5$2)YB6O2l%Ha0+Rb8Aj-=z#Or2n#>pc>)?w!jo| zIgl$NbMY!8@}iJK0X(a&$B0?Q0Q8a*#R;eu2NuX7>l{JZO{*niGRo0QEH6*pPBHU* z4ncZdL}Q0!uGj+u?yzRE8preUtI#&6lA9qCf@ve9PnxHuyQend(7tRCs7ZjH5WfxN zZi>Hr)#@3dZQ-wTM~b`RBm`ULJW3bG_(BnD#QsqyyHfzB6SLvAjB){S>dm1)uSU)V zrc*jke?ID!#RgL3AM0mMl%|G+lWdw{Qh@4!1du|&{p`Rs^e!KKmY7>Y3nvTOPnhl7ux#Q0~N`c+(-B9R!l)tO@&}&I9~X~9b0EHv7Ubd`t>7!qWjZBK~0A+K}}&{X2Qnz z%$Dd&DO3-(rO|5VUpq*5I!VjBE@c#!+ubZGn>^NAPWD{koty8jZYib$6C!^3gSVF7 z-FO4{^JU#+25X248tnB==3Uu~KYuS}#u6KL>Cd+sQ>3EuGhe zl{>QW;!+hYp}>f}g^?OGkS#(;9GMoE{JrH6amcQ+~EUSH{z={f(fbY)*Xc=jCNp3{q4 z%PME_P#Y7wr(C@snd6lW-cAqe=&Rr0__=OL1 z#Y3LIN6XwY{GEFo$&AGmlu(94Sbr%j#!&x&Ib)3_5);DJvk30k5S-0eAyddJoM z1jr8fG9|{mjn&x2_@l7>Q>Nl^TPLugTSYSU%eLLnRq8mm9O%>L83FXzfp~6Ps;gkd ze-mM5O?YYH8uE5T(Oiq6WzbOdsysVquMuAF&{rIUO)*rT56sc>Ukx^j)xwEN&9e{v zQ3MihtK`0=N^MCr{)89RBW)C1d9zMFkF64K=5gsJ;2t=&2#S@DF}$sSMeUZ2rm6p0 zxSSu-7%(n~F!CPrq^bXkQxu*wlc1%ich9DgHcsd;^~3$y3Q<1MWQK}Dnqgry<~j7U zvAYnc-Uu(TuT3)y^Qd0Z4ik>7`&Sd+7%zkUI!yhh2J?V+QI(B6P8IJ z+2)?rlF6%sTO$T;lQ%q?$wbBSa*W`DYBMjzxZ70DoN=xVOi}5bhRbRy%7r&vT zG0+{iJRFIipB*{JFB*}l42ub)-~94S2|p4>WwWg_<&=`}HK;ollgKn%mdu><543F= zvLoUWyrOfxcJV$Ne~weLz$$)(6MxRxTscbPY}tJ6SM#>&l*ZN@WPu+?5)TIT70-XW z<5DCX&L)N>m=M2`Das5|el$Zsa+XV1cj7356T`+qxh*6GeypjCn{iUWM6wB#%zAXj z#IwVbp+c$C<7?X2Bnj)e&OdXWx~gaN_(N$y6x8}B$oojPYCL!`5A6spOkvE8M&l2vwMC52C+JSf;VJMr zxI%y=+#V}61q$`U?uaHR{ZyAqA_9RR;Y55|H!4zGa^MMMKxxU>cC`{fN7Q^MEI{;h z*(a2^dj-%O&O22hs|CX%l<~w#>g0;q=O~~P;hXffb#EuNsb&}wp;B57?Z=@_^nA=b zD>aWau=2skdnuD#8ziXBb^df6u>|2qVR_+Q2U1uflNzYO3#q^V#O^~AL?vcT0XXvQ|9H99~f|I$ru(vE9e?N2QfckH01$@0gTyh8WLQ8@qa7Ko5)`&M-DGo3k)TM<46A==t45>&aDYSlPK z4v(&VH>+YITt+3n+Iwnjx;rU^{WD1AbHXpcSwg|uMGt~^MI~9KE z(392U33- zD8}gcoB;LCqt2wu4WD*h-vgbp^_yyB*23z^m3#IMXET=y z(bIzd2T3?iA%&|KZc5noPK%`uc%|ia3Ct~sG=K`7zAz{|Y>G279){!c;qvGW(-P~l z@*Pi3H2nApQH`f+xvwn#JgOMk(+;}SNdx_v<(HAflS&jd2>-kNt_*~PlA`)TA5&X* zn>Y}?zl~Ni@G?#QpBNnhkqLYqQjypk=r-2d2|P$JS&nD8SMQzI6}iAucve$k6>CkZ z&VC9fxG&_4CmiM=GJeWu>3^Gyu>{fXXEHk;GAu7P*wFiAW`iNN(F1|CI6iZOzt0hj z=0z3%DXLGHhI?tp7H23kjB%io&ep+s{`FLn;a}U&hR#~I%Ht;!L%@g|IA@bIzMoxp z1(ACe_rsLe7MFC!MY3H(*jS3+y9ZQR|3MdS=3~`H+WN>~jvq7f!2$1`-1z$bblafY zva?B5aLQ9*s12%@g*#yT!X9zvluVApl73A`xuiB>D1OgNC9Gj;2J?tNM`XEi;@75q zg?)@6m2=77XmCZktzl!zZ+JDY`1NHKrDdJd?OR^^pZmdkG-gfCU*gK*assms*rIRQ zY^ou66|T+JUUNo;vUn2Rfn=QFcJj+2SE=!=&K9?qmEdnSpKNJLj(0o&ozV=7+pgn^ zwiTyL%C`LX^XzZ(+VhTdu|pLptq<~^FYhz$TQlRFNC z9kY8E=F$ zH9{53J4f$i@kZHY0skHRJ2c3Q5qynh-ERH&Bse(hzBp?2Dd1a-L=HXSwa44X*^z(=y0J( z^#h+?C?82DWA37ZQrx`~#j(35j`Az6Uxr(3z`FExcaOr7PMC4HE^G6y)hgepu$w!! zBUZ{N**2crUNF#_-rQA0CQd%29bGbQ{*~=QaC(1IAwOckCEj_8H$NB% z82UzF|xcb#NrMj2j_xH`)7vRzdmsB7-h=Fz$3ON zXTZlR|Mul9GsDNy-|Ff6LA3+ATSb>P%WZVe)k(*~mb{Hy`*yCAyImt1H{hW^O;#tj zLWD#b4|=`_%kmFR4--d5e@CUO(smWtOt&4s*s(Co80*$UtE{B{-qpOdq{4!yH?hHP zB&|K7zik~4d?A$&i0l#-*moe}4s6Qx=5m|My$SBaahuVQYZ_jk4+GaBTVF|oi{W(!WjLn(4IL4}=qfI#=+P`}4AKflYkIzuPD#t-K5J%SZ*HD_e z8w{VJsM|{7)-Ow<7x7Ad|Ia|8t;cWMgt=2&-*?*l7*>h@H1Pd*4NNw=|8>bft=SoK z)rK(rh4Suy((sDx&kqLL1;wW6$uP)2+jKO9c}4Q=jix@FszW`k1vDb8>nus2e#@bJ z1lFd(8`+TmD?OrK)GC|6 zC<3Z4_v=j~6~eR1pTwNx=n28=xs zf}}bSI7mJ`=kEaK3B6sn63n{3xIzDivv+I`1#FjeS8Ut1ZQHhO+qP}nwwG^x{jZs<=fK!z|9NQfOmG8Y zT>ala%obcQ{6MFF{1BPxs)=>-CaFs-_ii~Oxx$b5^IfWS5rKKWFGBDu`{2L4AJa3vtc;-?Glt^I5`{s!eeeo5! zP|xd?yz37KNYhQ+Nj(dgd0$h>C~LmU!%jT6Y>dSCLx0(-zT(A)MjZ z*J)G(4H=a4hT)Q?Z&KezkM}tGSW#ISe|rGmP@*fa$@sUF4^(*blecZ+ZPmWBZs%xg zT~dNx_4_@I40XY5X4cYp8|n!6!-GbX{>96J+iEpHxL>WRSls^ehRlZ~q>(aeL^Dua zD;?6-srB3I9-a=Cpm9@H^OHX@1v|+Q>9L|;h9QcyV>UA0Bm%+6Nb*T1N!eMYWPW%} zoJ|r8Ssw5e%Z(VoX^vYx4%@uKoV~KrHhY)pBf2((62$c>4O32MQ*fn~6ym`pZz~ot zs*(!wWFl8qbp>U$HI*TW(NI}ps{D4**LCPVXgeCl350gz4Ia7bvo{Z#3a5xkr9<$D zjgu!JJ}sO%#i@6Jrp5>sb9+&M^Vpmq4??cCp!neSUxQB22(<><(#s2d^-(}ny&7he zq>+HxWDn(*Wg&M!3=BNB2KG2D5p78Hlr@TpRVzl5gGmur%sCLhs*OZl#fUsX9!c-e z-bodd%Ot#6xR-4?XDGu8IFXt?F*AJ*1~mS-_Cl$PLltR?2Yz{@9`xiwnivnQg(Tr^ zjEOGv1#F+1R(IFec2uF%03&7P%7=my1(l63aHXz0If5NwGs;AG-nOBm>M26Pj^!*a zNBYJHGu(eTouPRIMwekbaQbXmstU)qy7`94SL_QF@ZG9LL%e~l8?jJ=t{fHiD9rpj zcL-)W$RI}n_AvJebEfu4?9o#XI|h#g9hb27?{c^{MOOk2LHW>?_#G!xX+%?3U|TL% zrs??>0||SpjxP9q?vB3~{1erqMFOx4s!jO#6q5JqHDfXbbWS#%wLi*w!iKw}{joBOH#o7x^S}HLppX8uv1ob4~{@+u(K4-q4a2FbID;ce|9b{jI4dxb` zj^(sAt4|lhCkIfQ;1}y2Nd(Ci0v_s=PC`)1)-@}^;(;QhndQHTQ&9OXsXoEit*5yA zUBfAwH}5Nj?PCYvoj;3TlUWuh$ocX`IP_(Nczd8__M+(8@BmYHW6V=h9igut*LU4nuB)?Xe{#7DdUDC?*^0}#wD=-@jZAGU~Xp@XRU|N1US|KEX&$hk`v+BeN zN&s02(YP=3@=A`RtD2`;BIvsEpECNcq)P+V+%*WA=}kiO0b;a*D$Sc)2rC!&qTDcf2Wy+Q z_X1&o@SR2j8V4>-ir4I%Xe348VzjW?G#M9VEF|b2XmWM4ET5d$_ER0Ly#PiGZ50{7 zWjBUn<|nSw(cbZ$xe&687FYBwhf|VD=az~E#MaB(U{S;dDOmwKE`qbJ@xyy?UWee7ZLS`MPqYt1+fB8ZH%-QvatC!)t^=6{uIX6d|%yre`Ez9B~QxMlmxWPNIX7iI1LprKZa#+bZJ~dNLao82hbymC)xm$j!^n5D;DqU+`I{!?I5Y9* zql={&9Dy=Mc>Q~bhjVSZxhV|Y$S~Mx`S$Q*IBA^Qfgzh#pB~j22t(VA!IWs+!0YVR z)uv=GHhPT^26VqS&wp&_OG1> z>~@zbxH9A(zDpkrg+Fhux4a$wbmw2-Pm5esiXNj;+L_s{Q1n+HARAJQY6W^`2RA+6 zc~!0Nd&w1In_gs-bp_CO3iyKQb$r)?=w0X-hE~?(=E z(^|5xK*zDla4W%(lGF8zg3iJjX+zoc{VNLNpto^zS~y!{fpoS^uLiu4RZz?a!u{)- zlcG7E{&hEK3lw$Y-WHJ7jqIR=7Cxbo!C`;-UEkE;Gb$^JOqo0*#`;+V=R%|f=CU#5 z%)TBn(}as-X%$z0r~5vNkeaWDV*p`B1e_5vZ@)82=QuzAOYTDrJM|@&+e}sPszYI< z%c`5CU422w#tP&C)$HK63YjoUNnED-tvjz2v-f)qtM2fz{@c%F7@MS=Qv*4a@gnNh zB*}68l%|<#X6fN2wrd8&E^W3VIfLT}Q>E&DhS2Z8bJ-0QAW*c$ zZha++5N<+f`R*0~^tTIpXL&~(&H$bFGlHVZx3hgd zNr+oIQr(tLYWJ1M-!%6ZxA1*Kr`w~OMjwx*&4YH1$-f|6cq~Ac=omrka6BS_QTG@c zXKRD|&7d3JOLzl2VEXfn%(T-rwyEpl+$WdR{FBe!z8?>IOW_XlWPaV;><8)wkRy{( zwT5$Hq5-49S+ibW{);2IUAGd=+8^BilF%i;68iQBGumk|HnaD~>Fx6FvJ-9p;*_qB zSP!0=HUc@3$I&1wV@3>)g3Gp$ZH({ZsM!ZHjqV%1^$P zgXNDv5IjIZ@Vhjt@`vd^OS5!KbLxn)(+9%TlJ>#W0Pfts*um3k>GKcmR3BeYQOMhE zMlK%A>|76)9@E*Fp=s9Zr()&_z@moXZSsw}N1d9;l2M!4m5#c5Lj+W0)^(h6J zhKOJZRjX7t9PyDotYa?b zcC7~dS)L`AQM90OvM%J=K)g+ro@u<&_I`x0!k|8k$BWcdaa_7Yl68T za@@QXCm?1fqM}mH0_*%9Vu&(brni!gxf^G64b+)^7FmeC3=rXgW1Sj0{6=#i;;v{Nu?PCIn4LbDNB<4h+xv0XaFk8ap2xO5X!geray5{arnKFT5QZf}W z{wt_0Es545-xfUwIAbzz|1Du((^(8RSx(w@qDKu5hBr~D%I$o$>4!A0huB*>*XAo_ z?SR%Lz4?BzqIc3;)N=}tivt5F&NE7C`n)d!B`>`ecbkInx|)y;A*h#B(h1xct*3V%|JF>*v`*daO3CSgoGa=c7dL{fZ0}njN3h`EEZui% z2#kuAI{v;pvo>@g+g7*N`a*`>Y(oyHw#RMZp2l-Ww6hMZm01ZCsVcNLm+u^~SdUd^ z27aorj~}2-xdU>n9+t}@V%tEzQxg=XG>m^kdxKfgKC#gYA^tvEmy}_AGV-0b1MZ*CQ)%bvSjo-`}H9FJBQlxbIW)mIp*c;J>r35Y8%%eePY@jA8_)y``~5-aJ;Mc+u}r5Z zZWv!&BG?*2_kcw+r&OM71ofWgGhCs%H)w|DO6V2(%@=3C6r~n;^eX7>jO5xY@EB$-NHloF#(wGep!QVW z7|i@mkdw}&rbfWQm+^Fx?aD{m{H-PrynlcHGBF(jux!|B0qZnq%VNE8k0kTz`WcPw z{L+jvnYISZ0=?(H5yPMuj7e(Wq&4bAHFNfO6^jQhcfLGauvIobMA#O{^R)QP$n(Mw z67XPeCkc3#W5e}{=)TaYnZ+CpZ$Y9AgK42Ad)E?z)*q%W&}rkAX{{k1;#ytjG1mduZStmz3K!jvfgi9{fLA+WLm4VCZ)rC zW^!klg$ST=h zg}*F{;y>T+$UgH7aqW&+kqR?7YB?r_UbUIW^;7((3o3wBCBpIYKDxOt*uwhhXGev; z1rWfJm3pe3t z%rVqhXcn=K6uG{1gOwjb1yAV8_d6fW$~)IfWT*$J>$N29|KbEoEK|_}fRUM`_n6Z0 z?ruI>nH)T0!}h$fvZRnTt8Q`k#colVNbexL{%fo%9i2%#kh+(Nqz4{^!1GKn>y*4s z|1%if$)P9OCYxK+y>?D+F^{1RtsW9;n;p?$N+kOX@v1fRfFIY)rdj$rsGjioH}G{${2g${`B#4HC|l` zw`8dW+mT@kP5Qc5k7o*4*adSvw_S+^SBp}nYv`sVU#UiJd@fB+ zAACY*d%Ix*wcqoaR^HoEj%yyKKlff`swINLec&C)BZ5X_Y4uRA^tjp{NL}g!v$aIC zF?nV@t7ckmG^szak_cYVyQ;~a6TIwbWyGAv&v6;J&^NOPJjdoG7z)e(KFp8L^M)~_ zFtW#>XRP3hD3*uewz1JR{!O1wQ&G@EpMFVnv^-AE-h5o*eM5noLG=AMQk~_0R^nx6 z|G%)x%fI!8OIE~R(%>1`RQ((2f9eg60arKDx1de+n+w*7{~-;Qz4?YWlC*in4~Xc! z6DX7z-Y-=sJw1H_BaQrjq(Qs40k*Ht+l#lu&!?eTM?gvH7Wy8#MF`@3Wx0NEa@L;R z?|-5cc{NXY%| zMO}eiRK&eq!*X`-sIHf=_+M_;6uXCO_06K&2b&>)S~EW$KPHG%`FiZ0_}sWTK`HJa z!DG&42PID3NZO`fpWtIuZvwuayHA#!-@FL6G1=c!y34@_pSz?5$O)liuYIyVnZ0#l z1iw>%k6Mo}aBQsb6e2ut5bO;3Rr`x%*Dxzdwc+#bJZ8dDNZEtvk8u+|QBXze z954(AX??v5;vo{!ij}LGMHiXwE2dlM9^ozZJp1ADo;1^YbpDX^`&TlIc0GmVJsUHq zrn|^Nry^wtWo#>RmpMQYNunC_Cs{rXM(N7A35vf`G+sD2oTKJN3N=;{se??g#;A1U%AvZ=1jVv>yxk@DUr zk{zkqXHUL;pi1Wsjcc=#LHP-0GNkzXfZW`t(x0Y>k8N;K#4eO#J7zX_;%)k zFj*WIv#a5bdvbRwpH6eoZ%fbFLi&F?GlO$NlRHtLb^j~$wLKMab3zdkV_|67E$~di zD1eYt*Yuv@jnpf#FPXnp$tLRyHOchO1k1%T2UkL>H@RjE4IhQs+;2+MXw)E?X>1T9 zq5}~)fg&TN-q(DZwAH9XUF0PiUJhbc2q}0y_Q_QWtB)O}xyNl^vEQI~`6avUMr1~6 zgq%aoqW9!m$_2YaI!QZmyD|L<1UH$49>-CjVq}F=3*cofKuLuSJru8gVt72+GxL5L zaK{9i!JUM5Qs@38)I_M7W`G|D$m!RIfjmX(HgS)+tjc^K@wy$ZCV+Ov>%R^>qi6o@ z`J|#^eno(MH(?LgcFeDZSeOx}{leXr-|*A5NyPjil}jUjA?9 z8q$)C>kBwfk?#XSN7F>~(kN#7O5<}}@?xfFPJTI`CsTusF0BSdGj%8;p2JLvv^^!< zndM3o@DTY?aWQ=yWv}Cof*j4t-7!|qpPq)(@#;Y)VuY=PuHCZY5Vgb%g0=gUsmB?a zu~xGHix%qoS~2a4BImgT&mCL>2esI}o$b;J;E!6d`RMTmZyZi2`DQ012~kNRGh}SE zC__tt!cgqVP>WMd2ETARb#~@7A=m&W@P~X257@C(4Z{(F$(tr{W4S>3zZ>+M*8+Tp zw2#;1y;o>$4VCYJ5`14#La0WYOzj6%v|lo zStzM2t?@b>Wy9p}!VL6(gA>|nk^wfs|IA2DY9}e@J{3xvGa4Ai!qQS2^V|+db&qUO zYGXj!AX4=DZ=uUFFAN8L-x{`&m-E`QCbXzQ1L6z@24(enZu+mtkX$uH_Zu~ZvVKtU zIANvySa-^Km2fCp(OznlCMcFs`C#CRYj%bW$Jxuum|t9-e2Q5YHA2pM-7i%Z5jD*E zfvkgr2Pjw7PD32yz?GpP_|&fSYxg%OmowveT+A%pVy+i6 zS+HDEb`0@Llyn&(lEqWU3S=HO$I82(oYZ(gKfGHhk=!mYQer%~QpEJKtRO#XP(Nl) z3B0HFFc<*j)-p7`#!TO|*+W8mOOCMS2oIOS0870qU!qy?ATr1ht$Ri|xflH_W~I5n z@*d0RQ;0I860O$Axx0lZ6%bhxZ3!F7oj~=Nd4+YgJCJ}Y(_LJo*#}>&K-sS1gU#oJ z(oH(Hut4tkDm!Av?&t4R5V3i569856By;vj%MD?JKqC#;GE`QsCFlgV z%qa$E2_Q1R#B;!Bwe+lM4Wx(IWcu8cSr(GWL6i%tTFTg&+g`l^tk@J7rjYjs zyuYE7bmpNIJL4G^c#g&1(X_rE7+7|wKKM}OSY+r*9-$1dmVG59EU_UuB8Y)S^*Oa> zw3~yOlGqewW0Lao2QH(_hmLjN^)0}>dFYAU~} zwYEyKK|wfjs^rTxgr!E+uH`0&cVyDQ56r|ZuSEgQO}?V&N(BG#56z|y?S4@XmpAZf zJO0woDJmYou>20U&(|49mUnPV@J9E9n4>m;V;?Lrp?R$few)-V-RP#7bH1_eLcq-$ z+fo4LCm|B{C4cDp>?Oa*g@zd$ybZT96_+(xghlZxnj%FWQ&UaLUs|!UB+QV};usl@ z39+xcGw)wcJ`6x<-jdSe=n(2~Bj zuef(~i>|y%ZDey1E}ynj5-whFk*{4B4sTrGoVRC{egw@il|s_ED4gl@>4D;{>l_mjVOj>;*4GqRF(l!r>p9fP(d;LM7MGPmg@IY%2OAhRf4 z=KR>}eYjQ+W}82N6+-t(gXgW?2J^f={?U$2=!g?*z^%k?lYWw?TB@zFs zWIg0vPgB{3i&)+n%Y@E{t)6>DA1L*8i=XglC9%A~Jl*s}WnN3hi2EHe;B?8*FW*#! z*K-q8I|Or<$)NuLA0;jiB=#%H)-Y~QzKZU8qu06t6zf%NGd6H*ND%YKc{8_izkI!1 z>t4EL!%NdPUf{_uW&NANA7OhgtZ2Sth6%6sQ6n?d`mfnEY6;EDOsK>qEtcCLvL{IR(uGVj#4Ua#g%fc^RtlGj?Bq zrtudglg6|8TB_&r{Tb5(Vd^;g@1!`(|DV)+`ae><9pN`Me*!X9_eMf@N5IFx?~?FD zGd5@|v1W|Qkn!akc@;{gUiZNYit24NQ6P>|DU(HsTC_uwM*bNnUN24|8I{fJJBZ1< zzvZjC)Z;DX`;n35k0?PcjWg-=C(gcr_?W(<iW9efD#m!==%PUfja+| z+sm%?d(I-!W3D-fG&AvkS5ERs+rHbVDN#`!Gm65OQc>SVMG-8pYaejK1Un2~Bcy%?a5|NpUx2Mj$QEYI zNpf$^4n`4Ow5#!t?>61=KGZ3E{%hkXZ)!s#8|!F=dmUyRBeQA6JfR_gmX$*_8LGy@ zqGyxM03E}%WCr>Lua@q`F!kkzjNC^7=Q%*KR&%ErxQ}43*W~*!BT#o*4X6|55}tf4psF7gb(OU_}>VUn_($ zErtmcCyng+TUBac5+qrLISQ6TFNIw7QLp7=90OD~_jE$)0@C;Oy5ik9LyZyLfrfZ| z^|!=pDA9!l%9Eaz2twubWcEg3>zC;h*-c2?3Z7gb05YnPaHrdNB)FY_fTXMgGF>Pfz*v?Hw(;erjUwLuAInj~AE*!pv45zRpJ`72 zrp>Ig&Q^maT8td6FP{-AfYw-9_atsRNg8$KPtcZIN#pIbRGXW*-rT%$(2_3blzMe; zI$dmw`!Nq$y7VDIBMInG(jZI}&xUuUd&kZ_{jDQIKM>>e%ZX)IwgEbdY!p$h%T{+z z(xbZ!I2>tL3*t0_VTthUg)IfR1)gHTx0`P)$q(-fd7KK+!0?ZgVWYOz=bLXM@EHUz z)RI&U)_l%cEx-1FfAQ;)nSy}y;m#r9A#UbKt<`n{IkVxlK{?}sOTf8TbkN`K&_?L! zt^n}62Bh=?Dmlcy+%&S1oDX_O9kXVpU^s}qXp(8$Dz}w3+~IdHc>G55}435GfBSnHa{7;EZeE zUFCQGlYx#+0b*x-=zee@LEw%lEx{d=gI9-ci=f2HuJvGh`6Y;DT&?phUiCXfA2G*IT67*yw2KpqYfTJ3r)5{5zBHnjpq2oV-KizO= zK7qaLH{Hd%DJxi|w4wpovEU4MC5lU3^Fj6=&xjw7}?^Z^@>2c z^l)0Ih@Gy|K905nu~CEGx9GhG3?-ue>x$4P5nU^@P=ZPm`Ys7J55lrmS4}6#~uj&4yK88|*obH#SafM%~JEj{fLq znC`iKwwOd@qa3a7MEp7Z+B|m)%AC~^hgc|Z+`+ILx*z)SWRcP`ApUD=hdXlA#K6^c7WzEgoeK_W&xGfQkF*5V)yj`SjMS0!ksFTCY1^!_b-!yCS{X)H z%Dh3QR&`{9qe3OgwQ0jLu8Z}6$(5arz$>^ysPj>H!NRKyK*T2pd2GCpGrKoT6a3Owww{Oz^X^15d` zIXmb)pm6#lGqL=J)c{fr(|G0-6nRmn^KX$h^GL|iCA5l`lc3aKZ`Fll2eodQ)v83` zHefSdjJTqLgcAFct+1gGi)FNU`)Ixl4xD%}>bSshZo)(xU?O`ra{N`a9eNz|p_2xO zRGYnTo%mz*qAsXIby%z*e;SP5()DT1l?M)w*~4iw?z(xw$@xs>N#(NypSM;55xC_i zHD-757^m0H!CR2^_6n7!IW&(Q)p=w0&n^~oMl1Y)uw$bHo%oo z+AXQQJerO=Pfs7XN=j;zJc4jL?pwu+6hm@YHIV%^f$H`(idP(KD7#-KdUOSu>)??B zz)9F=J?oQ#8q2&3%NsZ%bHbH&{Pla>?XC3qVc2yj)?GDTISaNis3 z=_Jg@6(?d;#DD!hMn7RnLd6NUkI|%u&CqTOJq?chBF86TDS&-K_=$$SlK7m5?}&g5 zcm(iv*mPW}x;B4VlO(#;+#PoS7$eh3pC&E_S7B>-poG~#N|2K#YV!0Gi3Te(8E(?I9TK-6VIXSS)r>RKVYGZW+4 zjC+{2n-P-jss+OY*7P@-*?IS}wwgZWWOjL#T+@kKPlr>@%%;I~A#*|<%b1zL4231V zcHhs=K0d-fM1DE%OJz%sH8DXK+s|oy|M1TC(Tx8)ss2COcxIw!`@arc{*#&$b^UKB zP`D?Q`L9&(;CE%q(1{oM4-{x?WSX=OPqHwVWK-oP;|Meex2;NtGLjGu4o}xtM}Pkf z4wVYkirdNe{R@QdE12(Rt>=4x^Wl^49EAOGYv{p7i#9*w$Q59qKm2&}+RiRJs6#Tg zPEkk19R<+u^v$vkerM=ZC2W%R+Y>=?kL!kA{mUPY4R9OX_F-T2>z4}@vT7d&?Pl)% zDywF9jPSjK#6Qv(QS*(n8d`&PA!^44YuNSuZ!-^#1p7jy5Om??Ewgx-3*Uyx8`)0h zT;i_xVAjm@pMU!}Uf=ezrSCr%g9WahuP*at#@JgwjbsLCE{WTpjxU#Yk3LAI<5N05 z7rP&n70}WaOSC?JV_54Z@7@JIeZOBaP}J*x$UqVlg5m8l=ZCwImBO6kHY6w+UaIhR zuAvysh2CuC`hcs(2=_+L6`!iiNRQi$?u9waxb2N{joj->cha+#%QGZD9 zoM~n0kM$V>9lo-f-OI^GJFSakeNM$;NggLfiU99#%Ky0ck#KbuF!b<#`h4XmM4@yy4|BxNVl9$ZcsM8P~!LHJNV;3$sAu{)(;CQ6n=IW_Px~ zpIU(mQ{-m)aP(NOZ_n?*%M&setNE$e9j``1VC{9<qxET_JgF0<)Vay~+~DLWAIwN2|L%94pY)!rFhhU2ecvpIPZJ-BNcGbLcZKQ$xG{ zN11;Y6Y*U#CynlN^XE#OI&p|%LiyGXSSjZ75OqsyASU3|n+>dM{7slP!bL;|1H?>68%4YmIAEb-_uw4)>zU|;mq%R=Z1OYc z7-$8gj@}MOZi=BmUI|BrPu)=Sny2UBv#YDuPp+*`7{6~5w2A#mOl!Mg7)a|tFsf<6 zi?qL}fC;7+tTzc=I~?9o@Q9g~iGbM6f6X%;qQHlNE>EE#RJV^mq%k}LiYLAS4p}&q z6C((X`4oeP0qog6K9OySI6aLJIoMhBj&_qBQ;q_NiY!c5OG}DZgtdTh(iUG2aSL`} z>(+>)TIXw~N}P}_(|<@#+enKm8NdiC;-SY0L2MGfCa_4YxdZE+m>pEJ8}s7@%5Wo4 zneT)T2AW&HvGRndtOD2e*>(A=2BJs{3D@T7LZbaN(1ZSz{C;e>R5COLZ(AgzC1L?b zsol<#rbilIEN zs6yl6h&@&k0*rIvied*e4@#u%UxJkqgdv8tanJ-95CT^1-ri=VsV0^Hhr+l^DNcYG z_ZYQ~E#rx+nZ*7Tc6II{G0ScbrNsHw6EzhVk8q=j(NcNR9 zXOaUd1xp}-6E#ZEf{KMRB~Z?+qZ9z?BbX~KnvbO(X-$ib{i%VMZ@f1RV*PER|MJ^( zq=Nb}ubu$u?FzXt6yo60`N>@y;L2u$^>`-bi^@Nux?mERscC3PE!k7fW;G>gngNeI2wZydj&jxz6=%{^mCuV8h-fyTVJsO0qdC( z5N`G<^w4RulbU8dI0Mn`O|eZ5GQlH8sh<_#_PbFcF6_rY8I7=_RAL;vif%~g6DjDp zAaH>@4kaOouq#lxs~TJmnc~fa%ehH$@HnZ8Pw`wJ;XUzX``n=iE*ZlGTsTE2>^5LJ za3(TeQg0A#yh^QmF?|djM1m+n1RgAmP04P$JTBD*%VE`UqTyIFo2K{;nA=udh}fOa z_udj3vo-F1@*c&)uOhQ-U!Bjnr133i?ksP*FlM<+QD;AG$+KVs-6yjVn=Da}ELYS# zZHaYkJ9yyjHXJX9p$b|^xtr!VUswU>!)(9yAQmen#&AkgaE`&lFhG$RL5dmUdo!8O z=r1e2+^V2$5cZoYH;B#_oTSezXYc`EG^K!k>7}*rg$Qq%dd`zcdPEwRCWJJ@)y?n}T`J+9NrLGwf z@pukaJ0|I&YQ#Y&f9NA>w`6R}*FB|kv#2;scp2W_n+ED~gnLxBM{5b{gl(s{H>c!d zaPoWX+aP1aiP|?cMq6*M+YNq)qvNb+#UNJcVh}O0!~^_TN*D}|p!N{Reb2E_G`iKC zGG%*_);3)%Wo+*g4eWI4w%K5imiNwAW}w3h7NnFvZmR!?lH2RyNaX?Td05c*{?_e{&HuVDkKR38?_9w1rYC%wdUQ zset5z``wil0@32?c{2iA^q6^SuiK#BKFT@yVj6+CCj958;WV^nrAIABk+EP~-BbBpttJX*=M&#Z^J8&IL*k*Cg)#g9vFt-f z66Zg)9+kIDchGD8@DXL=_JC0$79^LWSceCE|FY&FmC6%Rbmcm2Py60H9t zvJfL12h0CS7W$8sxcYx@<^N+PmJIzT{;bO^bm2!`&~p73Uli^+AGcN8Wc9iuW3RBT zOS@58;fTPaJl8iz|KJUdl#28}UgF~m#O^;{Vnf@{J@5MqjR(Li*DHM|?Hn*u!j=pk zIy!yl_Q(AYdrHNzThaw(pAz_c=Kj}8@cze2Z2p&(Ap5lv*n2}k@p#a1?|1m$~Dsh51aKb#c%@^pwS@u_2{#3Z}` z78wTQyqu?Ozrlartn)vA_KCRLF3pn5I;5nX^K(9ts#J%sugT(QgN=!=_ua+avb?q? zdL`fQ7p2$xHhMPt8Wpa05Mn3&tn+i(pTO%(mDPpc$3HG z)dylTr%s|h<%GEtqV7V#OO7fdNkh~N?jyaZhip?$ty_ir7}Ywj`_I#|a8oZy3*_R5 zEb5>vt_!|*JV3j?A~M17b~G`{)S2Of#Vt34e_c2%{|$r`suSsJbdmDbYqvi&Z7|mz zMm7rvC6A=iw1eJ|q`t-l)I=8>?oE?@Dm6tUf_7T>_haSGMH&<*UAIlmT+*Z%_XHFz zygfi|x|=(Tw7J|%2Q&crY*%hQcr$kh%`WvQslkIbKpywsI9Au5@i$UhCi90C@q;xj z!0s~CeGVYI8FgWxto5p8eM5qb;c&&1Wv~;O)&vH3;_8u@yHn%sD-Tvqw#0RMyX}g1 zFSVNA#I>K`6j$5<0X@2gp=ShVaW6ZdzqK|68Y;%Tqij>?m@+sN^Bfja&>JMv$(KgX z6lYGe#oVUIEXh$Yl^>8c*u=QrBX1mbSj;0DR2dAz>l(h+wuVr$n6BRfYoC(-SZ%~) zdN!5BDO^xYcGnl#UDL}B+MNIwoWX#2d5=7Eily2EX#0nuy~b`7-VLE2m=p|cARr)Q z0(|s-(*H#=^1RJM6IO(^pO|0jA9?ct6(HqIHH!-GIWlB9F63H94r97)d5S;wn@Tw; zd1%ZDiAb;)YhnlJSpLsQal&!$)xc^R`BG-cG%InfO@GXr52G?nbgRe`>e%hMi3;Xl z4yy2Q#cSNEW62OOOJmDT7A(MCdH-oGF^DP#1uHnh0ol1To8R8pV6`PjWEQxs%C3sx>mH zXm!dA_txaNOdB-?Tb8I|vDucT<{*uvE*!Ub;gsqAPMC#;U7Hd;Wl&pkAoiRnr@JgD zX+l2*j?MJ4DN28K{B(mNqTvr;9~R8AR1`(>2|d-1%t@m;+B|v-ZD@_RvEG)lZ>P_VpiOgsjtJcS_tl< z2Fdgb%)8eF%%ma+GLZSy5G9+a_D3)ZS}@Ps6fohDAhiis?y3LHhla@!ZyVLNNrp6m z%`SSRiStE(Oj4tEYP{8`Eg8U@Zh7ygB7}V__sd=IA)JAv7&pQNlBslc3E`(X_Iz^{ zk-AO#L^DtzR|?+nU{OcY%hA=Uyxews9pCqVcd9-L9h$7gQbf0xkWf2kf`MUKAPP-t zp5FpeF#4D3w?-T`-)E6?1U9ix;;eC$u2gKM_Upd=^j9XF&fgbD05b&zLQ3xSxb_^e z%qQfkG6&N1RVi5|ua4=n4OWO{NuI(3!3lM04pQ4OM7PtwTtq+M$Z2ZvN|w>s6_}F6C*?XHfAuF$$MFK3t6=h4BPsHVUuRJGzr31 zUp&zMh-Lh7WaKi|hi;Za;D0Mso`l4SZNu4AlO`MJbrqY4+XM5#E2H>!N=^9-PbA*p zR05*7F7dz(*<;X8iVkbeQ}O7znN7XxailB(C>T#Y%ehe2HS5{~jSUo!CvwZG3nG(w4fgh_T#r+ zkc^s>b7}khzCu~%9zqN&5zjJ=fHliqeu&)gMBau-6scZ(dHqd;?2sCZegJj=192eR z{ZE(z;Hhd|QvYh2?MdFM4Bv5*`WOy~)HIY*C6K?X~FI$mm4D$-oQ{^gB$DtU4TbR#(y~wr!5E0Y2?zy^s zQ>Tj|mBL;1oXAjXxSC}`7f2zJw?jpB;-JGwcZ-s(B3t%?tM$HSc&YW_Y1^67Lqjim z73XZ`PfaY24-Cepa^GcYvE`ke)#8}{yWil=_V7gPh_f@+%KY-?QgEy$^80%b@6saXC|-uSfQj^( zUbH28{)@Hp=hRrm)kA>*zC9A%y{imbHcdOQFG5sV=eHG!Hu>|RmmAS9dR8l-} zQjLS2JECqQ(TN{CN*fWc+?LY?&kt@zlXZrb@?jPtsjF!j5CG^$5Z!vI8FFvg0k2s> zRK`l!&Qw?Scwb*`#`N0=QLi;V5;F1V$149Bi*O1U=njWoFe_<7CI*0-AV7e z*(37e0=|U?cDP#BDX>XsUuHkw*v2nUK>R1mo?Eanl{H4%&l%w}5P&}5>3V#Qn8LnQ z{U+6py88i@jGQ5TCpQMWn8Y_}Zmy+8aBB%Mp#P~@eBU@y+_Z`GrHOT9`ov0-C#3Tv za1jhkdscEeMwS~Xa92_l4z(s`8R^Z$gFD*F^N?J3Geif%V{mQC;xk31Z@OIo*2a85 zOrHyyZFSLx$5d6cO^>mB9$(BCrJgg!dSddGNv7X*kD<50${Nfs6jI*wRU$T5M)Jhm zq_;*cwWhqK9%v^=P6OwrgzLu|W~mYwAoO=f+I%`nd2v`$Pj+5+&ui?iF~{Z;Tp2wQ zk?o(2ia*Qd`b&NJ;^Q&*2YToRo$LQs%#4ixrDRpf-OiZquYrZ4lQo?zJ|jInov68k zqZ2*@2Ls!`qm`4f1D&XqzLT-Av7xPzF`cxrjj59vJ_{4${{`y2*0#3Y9BcmZ@eTI# zI`0Muef)8dr;eK@wT`&5!6It~jS$Q;+BgwKY9_uW{(kn(iML+QZyENJq)>6 zdkEj2R66iHsSymAMV{9okBrh{E8151A#G>nFtx&!vF&LCJh6b8O+5XYanPwCh8Q2e=ulBAZ-s4yC^&vx78EeDxCMH zP86^VpKQfq3YfS$(T{d0{8<4B1SU+j3Hc8si_2}_wpo7zYslFb1Q02_WZd^lgQL|g>lu*BX4Rv!*EJ$)aaTimW*w_wtj=wHDD zqB?1O?wpw1!jr~2PKLp#<#1jD0Ho0%P1qECiD*lHJHMzs&zi65|&I525{<3R}G5r{1k92+*kDPkUsF_1`kfX@s7(j-JDHbibRWXKRu z1<8O5QjZwIUMVA$DLnuV70|~&RY?jUJ9_0w4fvSt=-ky~I9bDiI%tz6eO=i5aC(R1 zTp00xXz1lKp6U`D_ISkHGGg3HhC3*TV8zlvC!^Hs8Yawe8q)Uv_=Jjpk!Ptt#sJt5 z!BZweM2>W~!7>@1qy8K^yJa||s6f;-;HGI#6HBj!MMPP`=14+b$B`lHP34?}F@9h)Hq1f9J8`H4s zi1>l(4|OvHgi^N?OH>8JDzRWH$jSN(yjK=~jPC-bpw!2pNx~D|wFP&XQQ#P3Ezq)@ z*$_NxAW2H~ga7KAg!!icG8*)2VrhY=5m3*W7U7}7Vt}pc%W~&(0)6Et4=$%b!3pm{ zOoYS^hEd8P6In2u$@rv}q4i5>;n+dD4a&C)*7D~9D3V)M^#H%ft%vV|Qd;Ysp)7Np zAEDGb=9Ly&F!kT5UZ{^Tiu!kOKB!t4Suly=n84-&3WTJLK(S9>k_XBv>Wj&(8q-h$ zI<73a5!V3M>Vu4B=bMlY<0KQYPbnVCBL}Kx6{o~}B~R=QkLeOMGoIa))prx)HbLdM z^!sNvk&PNB9%UcbrePk0lmhad*w|TP@=QFOv?EDem*>hI&1UlRBz;SbLPT+U5Ye%X!>lrj5@!vK^{{7>iBpDNySdE z9qW=_WZF*frOZx}srK^B@O|fdZ>Q{j*YM>&KYN*NEdN3ze)%3AsJ?yL_Cqu}67dioTvHHt}>$$*3Bs+jaKn+l60MV6&ch3WH z8j00e0nV@bvD0}Kn5PC%Dh-2d^wmjGiF!e| ziVMs9(m`R-g%v@}UjwHg?g|z{icw*K;^3VT?luj3*WSqD0uizgP^|!TsXiAIxE{$E>IS@`(o~e{;os zK>}oZ?#t=JG&eBJvn4jfh3K$XpF>o`*7uybbvtpQ<)jy0eov=*yC z_h(Gf%7{a8XHtkfdf9i_K%BLx1|cHBDC%0*6R+x)GoEUSS|Myz&Du)|UGWIXD& zUvGXa^mx;Jf9NzlzWn%>{@)hl{?Ypj_l;oHJPYPw~?M%qw*3#@MR!}N7|lG(sl8_(eNGI z?xy4Yey;j7XvUH0&2}oC{JP9?P~Gr}HhnT!ehOr_rkfx)-j~sDx!@68FYRiM*^4PH zl(^Fi`t+Yj4~*~0hIo>heEQA$_NeF-`Gj^@oAKwRcRhx=k@Qtr71DKub!+!leZIVE z-g+zdy5BxbT|BMKW%b#7GFH`Hs^s<>s4NldlFovi98P&e#QMm}#dpItO+w;+S)m=+ zl@Im*7w)?LJeOx$S}b&5tqL`9{!kw~$4{fwk3xzWBlu8~zyovG{eJs)Qh9#9f2tJ| z%MDIWAPlbKSUZr&6Lm9~(${-lz15Y@?ZLaSQKl*R>pyq5?`Wqu9+BsOCbomS%m|5h z6=T0y@Nl!;X|UalQgoorLxljD?b?@*agnp7nw7&g>bwrWY$c!C@+QTT$*WU~D4>Md zTR3@HTFbVYDvA0R4YrQXW6SOPxw162_w(l*;*)>h@Bk)&*F=jLqSV22kT*6Ww<5Bl zO!X11F@*>L@#macP1+EGO|Vzn-*p4V^pwfpuNuVK(v+NoPT)8Zo@kGn*x#LF zm}JU*jlpkpSq@g4#aGj{pgc5Ddg9PUC!v4x#>hrFDVEmoLNL~Eg#xce02NEKm{%;u$X{h>bg0v!B8Yk z!mD_yc&xr?wVxFfxafRKw-Ke<%3p2@*f`xDD%{?^I!!Vv$F@4%#h|%c)&0%Goc|7>ZOF<_e8ng@%-Zln~y!}%XZzm zO{LRcxTVA3ZTZp)#ywDunS@X4fqOdH@Yf9iJv1RqHjgjEb0z^wnqHsrV!)bIO+8!N zqq#E>sL!i@e%(_9cQa6b(k*dTf8@y zVo%-;J8mu#Prlj1>UN-0_RS*eUt?Q2Wn4 zfifk)3Eb5X6*_Oies`Wcp+GlRgvuDH+6HF3Z$1wVV+nA z@>ML`Ggu-v?;zf)8wO8+itDIlPZ|V8-O#68JgYC_{6(D9PySKTR`TAV&hgQ$#>bbU zJs6FADFbh4eEAMxcFz~Xs08SoF@RfhP3gg)DR_ZDz%YsJp`D>6u>zq4f~!>n3Tz83 zkI-SqgENEg9rJvvy~v$Kl$6fh&*=E9^41T`8>j}{f} zrQyzbyYKn(RY2x_)jOK50G{qNnF)+Doi51fQC}>GajJymKp!=m9iUCIfo``1f279S zY_8<2tgM-_aVoEppiRG*$VQ2$_@;!MR`5I&7Vq3KtyDeGer!=+9i1k9InYhRic#`p z|pw+j1j+;x#*ZudclI@%0#f!P5lf5tVDfr zNNTWM`g}HF@4Rj{3(BeLZ3SCV2-b=mkhBXaGe1>F%>}zEH0};+xV-?}>0jCMOy{|v z8auzGdLeEDeXkAo&E@%Vd_OxiC|N3#6&}1PO~T};dj&8v*s5V6imEH?cvp9nw{4Q; zp=u5~w2V@M;v`PVjgEsO^`uqBs8^zTC0c_P&86aosF1NKiVu2drwItNO3K?qFLT2f zFl?q=ac;E&%fZ^VE8ncar~i&#!#{%ffWlb`XfK0@!Fen{!?i zK-Xqj8ZJ<`Y1t2HticHZ4PhhvL$kJX1cgjBEjk4cnK(eCq2Br}w^RwYkIl9mp`OS@ z+Hx9y7rUl*jD=hZ!WFV5c(i)#_*JkUoH;xqknntaMVY)8Q;(>K(vR1&e=Mrm7P2Lo zB7ldsXSayH%x!yR<34MKF-bE_Q%vb4eP8P?b)%=Yi7y@5ZYzBwZsJIAFr=ySh6@pj z0(W6C-(nm2=v=S=@RMR&evRf|e$?NZT4Kqu2J7Fm=Q$G{e@zy#(UdC$eadSV_P+ zyP>RIb+NC#*^N^j9vRSWnmBtODPmW<9GGX(T9(q9%>RB?#6i=-)gIy9utv)Y_5px) znXH*4i53#Ps}y!X{i?MVo@@?#RRnE3pi>@KWd;{${F(TEKfH1(fHItezlz@|h4%+> z8|eM=X+RYn8e$JN!LHACg2<#mB{Ef=n@-Ws*Ujfi1G^hV)v2?R+aGpz%~g$zgnPDv zh_J}6&ur>uDBzjo$`VJ==ChO=#!msh5e!{*`18=9j{G;drT$8)U z7>~F3&7Z)G9aIU#F zzD_)UqRbmHDg|ESxeq;%hgO24P9y8o@7+u0CEX*7Aq5G}o;WaBLS3DH4S!&BYR5l; zo|qpUU}TVoi()M7zZ~?Rt*QHe#rS^um>174U#z<`a+`zIW)bjA9mC0=4p@fA5sl z=o=RIp=%fetmkl##R7gAkKSBft-GjsIoeugV-#)P3`kMDO)vsW7>L=ejCxMiz{Km{ z5%hhSDbrZ4l@Ckw7j1vErLAt)Q83p=9=}Hifl0Z~t&ZIVBZu+Z9zIyotbRwUCsli3 zV*;C8ov2nEe-ZRd0fBwe!)(PmF+Y93!0;;gY!mzuz5ME6$v+NcJAUXdvFFJ}i}@aG zn!FW1C~1@d2e^p#*;CEafY%;HKN{9Do>J22eyq`d4a8bbtI*RacRv9uO{au`i5m#4 zJlwPGqTh#7GESozL8lma=*%Mi^Asp_k$}bGFFe%m>WtOH7b2`2R@?1i_vh5MtK$et zNf^be6h|}aVYIioghlFl-i(C*#4)pHEL15e2t9GLu$lt;YXeLYQnsRkbIe0uedj;kc7 zWdmW3gn*Ye{Tn{dzu>rwmCAbzv+w!DiHA|jNN{)aY2Y*sQxZ^ob@$Q?EL%49?hJ1q8$W>DL?9 zi#DBsf7Klbyd9YRTY1UH7i!zH3~YDO9=h*{`@ikV0RQaD`;K3;;HP>u389rrs))6M zLA&m48&pG{ZMx20R|~cOX)!(g*J29nMI0oE5$;6{!xsVE<`#{@sBmWIO7(ZNBWPC> zP|1Vr+uGffGdI*1p0CPOzvSoZP22TTGwV;` zgyy)+EL1uqpGLRTS6!POKqW~9nsk5B8vb{MX@>VZeYHJepYYtwFqg@)9?0Q-a>`Ut zv2SLGJB7mTyS$z>IIB}!ZeW*hTl9L=h+d>Fqpq#t=9B#iis=g0kqjqlnqq9)Cm)C?v!CFA3CtIM6h$iV14Ae7cyHMx9LNz{1>ivID5{P<{L1J6fA-0-K^(@Wm- zk@Go4Mgrwp-+bz1Bg3Y09YPizZ#EQ(E}?`M*WaYjrzQN7D!XA*M=)l~*wv1mYCEUd zlghI`DDhWr_mPYt6a(2NrDNeXEYc>i&@?v0+JA38ZSu*C)r|4;{lz}f#{4rOG9nNy zqD)E6fEoqZ@Xd=J2R`5%uAKivDjidToIqH6MEPFJ*IBE=P8kfgyao^P7FNJ059mT& zGL}KZ_(7ASy!obFKS2+|=KuoQ!40)OrVRJCflxnnzI(yGxiKSGOJqv+Qwj?|Os~Zo zj3mTx))NHs1S8cRyCnH^m$v?z(pGOMSFyhYA_B#94KCnLQ!pOq(Vwi5bUu_QIN<)8 z4|u9pv;Pp=S#qpG)Eo~I51lX&bF0x6D!~d31LvxpJ;6y`e)8AeOxMQD|&6^%B;=Wqr}ughHskR6?XsbZ}6j1xbxbaEWzE za>vfoP)9a_lZ12Rs0VcRtq(fw_U}6&ZKhpxA}ZCTT=d0#XzXCX!pofzf>2zCmlvIK zWpxo~O=GeNq)B8^C47rh?dg;-3^O@mX)5s1n4TMT=xwTc7hF?|~O$rk2DO(uqE4Bn5p?EAhfj zBAE-7o5!S*AgDEL@jxv;aydgbgeH#z|FBXe#_-MDssiGLI<}Z3b&eY-v@b~&;@@1Z zntV``R~tUHtS%<_i}u#58BCWw(u5Zf(~T+KfPb|;g1;$+Vn&X0jW^}W_RjETWTHIL zDo#V_Is?>V`tdc5+@f9Xj_1wiNx^xqHoynDB7}s=B$wURe=f@YX&9}LnQpNxa~t_%2fZMr{fw~i@Feg>9a6~Xf&87pX_YG zj8oLxuWLbqa^}$Q_lGALcwhKvcQg2QcTRAl>*HpnsEb}`4$xBdifiUF{L9^zU~^Gz z)4qABUEIZDoE|<(YhqNxATCXkJ)kaWKjA(ZO+qH$S8Tj8yehf!ihbr_MC;ui3SvJ) zZPv3KBDWISwwLonK+A45?^CeAyB60M)ZL&VEIPO~DwS5$W;9ZX3@|5OP}Xn@uK9+< z5e{?w$LsvUy`zJ~;}uf4?+`q|w^$^Nh6Tv;<;|d-E#udtU>@y|~=d@0` zp9$~b5}C0$>5~yOX=GQYWL!n+HCVChM)ul+4bYnEc%5zaf@(gazP?9LTZfHhBZ>#No+|!6LNF>FSPl!qBM@@TKuF=5&f`- zfY=CwC)6{`&>a_*23QTqGRzV!j|J0jFd;S~jf#@)E$i>I|aNh79AMovlS}>)kF7 z3TyFGG;Y#rT9K7Cv)xJ|VB0#*Za3XC8UiYRK$?8D31PM)7q%xPCrgTS7E?}SoZ}Xt z(E$8|Zd!g!Hs@wfDdim@go~J0FOY$9&mJ_$=98#MChg=H2hFTSD9N8EC%nah?!+c2 z^&_SvbAsh%@&!lR+yo=M%eoqSM>QN$qk|ji=uLT>O2e5|wrb54Zel6%ACl<}$dcuB znA*avB*P2jJ6B7Bn(#8*+ zVz2%q>r~I+o2F#6{6z79*1#MbA8Z8Rm2 zRQPyGH#uWA4By?kJJ)D|5aSY0+%2!}iM5=pCb1Z<&5X0?{5~D!BQ5kgij2YbI}GQN z!!#9VH^IUx-LWTocZuc0yL+d7B;@;LKce*h;h5%pGyc%sugDbn`WZE<%0{of|MV^O zmFe{s6!l2ik&bWT0D(7++Z6k|?30t^Sl99|(cRfjO&jc$a7VH8w!ccl;0Hni8>X-$ zFK&runi52N5Jd$_>PNiJ7T$o)g*)S5KmGgr<$QNX$DNv0l#~4ub9puVQPvcbv=T0| z`Q+F+7DtYV7q#@7IdOs5JPhotUQN_IVX7V0J6V-Ywm|A}WF_6iDjSPJ36)kQF8tik zqzquga6+t1CWu<@aZ>N~csfv>X~AJ>YNiOAQYxacRg_pQ?}LYrRkv$aV%}>+duJ(b z$f6e1-qIvoaVVBlA9o&2k}?o*>y}l$UzXG-ALq*tnWUW*Fb)C-gl;eFumReq2Mz%! zvut`<0($tcnQd!0@o}8lE&)7}LjaK@$_l8*6X^6gYAH0Vf~hvntu^73T+2!o9)_i7 z+6;Xn^M7)XjSZYUacnX*>~ znr@X)!R5he!;pr2fcj5nmp$|H4rScz8D~5>KB+aL#0Vld6oFlvX{3f17!XXnAH;iW zB$#U6Jh||F*XEdFAuzzSo=qAlAoN0_6aBgWA7}gp{Wb>$ue-gtGn)n>O2%=`tz!6E+=#hs>f33+(E8~TgzrwrjN=jDjC`h5s?h~zfCaS@sVc}bhzyb(;H6fl)P z!~Na@rpfogwXF@iD&6l8Bz_GMN#s7dW<5-p=;XIoy-d9gluT^IHg-@jJPEW(IF$OP zA%?j`D1Gfw+kg)w)0=QsR}8X=yor$=u4@}+d<|rmZ;dw;^i5T~pX!=nl{5dw%b8@t zdL4M}5J&P3|AWS`&7{e-1@tDr7ydC(07lYnXXb%FA#`*ZRwnq z;AXxqeR5+i{^Zyh)91RT;x^yvEUqF1_o@qd!a3% zJJF1>wgu`{)|H7e4~664KQ^W&M)lvxeM)Capa_FL>bk=O#NI8&=O^*-73cb-C%4p| zk>!p%$RB+qZjCzjAO?1F52^~Obbt-LA7KJ~$PvRwY+%>G8z^jKnA<<3afAGO93iN~ z)IP&%-YlcI&GnTMB@IYoSK3s&@H)og4LAjR2e|snHYtFkEr1ZU*8s*#6{sz1n`4Ev zdBn7%;smT&?(2eP5J2)n4FTcfG`dxhl~BvQOs(>YGq(+N=6+31$fP2o1H-QxB%9jN zNYGH4)XC4RVVqGmd_y2K2nz|#eC?+I3nquWrNBf&Gj?WbS8FPk?+)i!`T*EQ- zmKvt5P3BPOBA)emr+_Uj7er7D6#U7KP;CZFT6FBSt1I1)o{E=`@b|_groM39(ZTql zX~*?=xp%(~`OdW})iR>MYWnC-fs?9rP;)$?clD{sd zwn#%a#j-H#%L@o&YGplysmj{REc348o>OeWk6_O6clUC%ma;Q}^oERa`ICAd$@P1V z&KB&>K*>hZ)ZB>fpP^&%%wA@{VxpsD9VK5HkZeugNt0m1Ca({tu*x%l?5Ve}T9X7# z6!4~BCmOcL@<@u|svV_fV){Mf3R~E$D2_4Y4>btwZp^Y5k2t6Hz{jl=J%G9jR5`Dd zl!cDjlYl|5wIJCvhn$;bs;>vw0bQv8$j&_MsF4$CxOqBPckJ$`19V2#FT9fXkp6Rm=j)L6*Vrho(W{2-*__a++dI)bPsn#?-R^SH43 zvGjPoPvS6vsh;NGXw5+FfqmJNRtx|#zzG`OCwi25V|bt+duw-I6)Aooe}-;1q#g@O zaa7#XtYS)$Ouqt0->>#7Gfzg8_OIKxVtm(e0VF%cb^MhNG~AgoOK4K+wt~YgdV|-n!C(7$*ofJ4v7RI zQlV&E;0`#VFNPFl`v%~1V=_bP%nnn95G=e9$6W7?Ix~I zPCqJ2i**N9v1%k;Q3i_O3DZ@Y6Viw>vUSuryhcMhZ)(4$k}!@Vo0x$Tag;d z;tL9Rc1y8E-FlnKY@q0OKxA|0QKfl)>d1ozt6E2-P4i7zEF}=AkwvV3gyL0`rtgM! zVX)+MbEHfOeypN!`&Lo~Y7&H!Zkfd3QSEY(esrP=vckJkWw`8I8)SH_=LJ)JJC?iy^kYl}fyjf)8E)-61?wHe9p4hO&G`FnFJ44M%E4UpBIu)Rv6 zl+BtE`+B?9PLw*RTxTiev#;1fHel)^#B5Z7yr^`xI1O7lb%2WQEW5qFDSJ@$TGExS zT$AVsA7hh9{=-eTZP+f-6>ri@TK;f%EM?5(Ly-Kb>+ht7evKe-K8)=t2Am#Y2553g-O*Aq={b6+l@+#t3@ zN9t1nzH@R5pIj^#kIr7?Q4#UL_}(BHI%nlam5q$1ERcLCV8?_Nvn|_BeIMDhD?e+r zaf+ob_D7sACrFEN9*_;?+A5WpNiFJ#qM^vut3TsZl3wMcg;n#2aGW&fX1|gI1zV!E zNnJ=%=XXmY@r^6MxC2VNiZP}`{mQ1#OS|Pw6r&AOE9vJ4O<6q4Ajh3Cd{VtzKe6ew zvf&(Hg;%%f6NRI`3&Od*-`BsQlrt;;je_T({~rxzSy=v`_}Bj#%ud_s`U&8{u>TYA zjIH>gH}OeQUUhWt-*%>`BIV25zW|U?Euzq^8a*EsW4<5W2FTC9_2YNrW@1&DJwA`{ zKKH%8)-`9}ssy#%S{$#wioPtW zXgBMt%E6Y~>Xz^)Dw$N^y;hD|rSEx?);F=4fQhmk)oivM& z0rWBHbhY#tjc7WpgceMu?%s=@ zVX_vYk@~fw9De*$QQ&t#j1f3qOF5C(%}xegj7o|$Ez0H!tD0X?1MGvS?d$sqy8VMV z7l~L*98??0Fhl_fP{rMk&=O25Q+0ox-OHI=73oO^iHu0wQ>izV=(9rdSNnE2eQnL6 zz&newI=#vOg*qQbfs?1xejBh^QFD(pPgSi`fP69v(W3e{wQB%fLg#3gglR%gGt`s?e9m}KOPl}G=ZT?2O- zzFgbFpv!shUH(J)+xrjj3%{1?CKv<)C(=0S%42@z6S2bB!%fnBLIAr_{3-l53lW{& zFxc0yt0(;nqL}TyK@EZ(JRyKQlBg(zie^xerIn~H1=?sb6@Ri-(1kpNzH9n<^lvq% z9QH3Vz>Ay~NTiq}UtyYJf-lq~U^^8%cr&SzydV%LWcZmsu1+52U-dKc1U4wND3Ctw zYd26rs(!O@=FX`<;gP5_^PK^egwQC^BM;96pssNvMFbUZJlT5TvRc9gz=UJ~%=g21 z*8}QG!F1R5MOPjyO*T`egZ~iLGq8}r7z@n$dj2jgXXdBLs*$;s%cn49h!@r0D=Gyw&z)HLkvDg(*nZDkC-24G4s*}_W_Fx9;$VVOb1lX58nY+aYe zo}7Sp>7>3-1$&zE>{ddTzzju4g??7k0;m>p%#{`iAXa>sdceKh9e%d(UZ`@vrs4kZ zXDV$YFhv9*jgLe8lm}BO?bP;+Jd^Pei2Xe9;oFZy8H$|zg%q+F)+mdiA~RIBHCS&p zW4rZzVQC0|bY}@)$Nlp#LvzdbqF~uEyc=7c;r*R3^$_@7`Ygk?q$aa9T*xB7;=4Mm zIv%YwzTY$heQ&Z-p~7%I8UA^J1v?2CF#}3u;c|>P*wWGZBg29jqV_N}-2guU-asFQ zIdoyYbUvVbdHc>JF$^;2lmkrE_BPd5!4BiTUJ|UNOB_Lgl@NMUd%6mA0N}=7u>$p_ z8nT0LG`p=}*k4SgKtAr7D;(}l@ZHKxw=h=(9CRl`t^kT*BY6G>hT@7<@MBu3Lcob&t^PGptEg$o@*_<3{pmpoiKHj5 ziX)7adDw_p7BUK?X6(^^*n*B1A#kpylcsO4Vy098-<|hgGZ$@r^jpBVkR z@#Se+MaRhm{UK+XL1bMnw$@GlT@STKoWU*1Vs_)xq_%3gBm%)98sNWllfIjmma z1hPBq;2Jh*ZP9jD7t^G`CUtmiItXu0sz2P~xr*&YgM?*B9hMDyvM>;s$jSgWquBYZ zFU*%8q!MIPj>PHXyt6li(ckfW3a<3k?DfPjbNV#42cT%XR;#4JR>6RY+D5Y*qRE8Q zbO0NLspn22H1j%k4I4Woexx>fwOb^m^*V z&}Lh8_?*KQ<^+DAUoaZRhsPKEI>UFLge*>j6sm*iDeEb}5i4^}n37 z?1W*9BQ6OnogrN@+%e>!o8nkXj&n1Z8!k!X@4UebdT8R8)OHIRcY+Xqe5=-A$Vk69 zP~C4Df2#Ia#XUpu3|a`JtV3j3P@$oKN{_Eg`3*?%jjR<(ivOq>kkxeAqF8Iv1``%R z7E?~nv5^hA(<8?%ud77tB zBG@TpQR`iLjH$n;j)xoV)DX%$0H%j>&EMwHwaK`)EM;@IbsU3q^IE-z6;u;mXYxl>MgcefNID&z2DAccd6vm-!ZV;F{y z-$#&w2O^1JS^N|+zCDnFlmHBK9U5ax%JAkvE=hhf*yb|g;Xymswa?|>fZUA*bZmMn%2@^R z2i4?Qyw7XT3+v&5XN+4E{HA_76wvS-vuhA8iA}c@Na(5F&Ei`E6Ax#(+b|sp5oU+o zyAYyPMrUo7yW20ims&8TLrf-4J3M??sd^umwf~x`XX?_G|2qZwKV0pzG5yyW@PAhO zhpY(Q|G@^Uw9)zP3;7xOZIPa9#szLCI7q;yOZo6^MNlgwk!&s^g8;`;s~1EJtJbo< z+`aOHANU;*H9I&;b=`-xfES zrBu`+hk(m!p#&##$Bc>#lo}RR_n>5;7GJfV-5zUmvb+R}6O7ewmnkV|txViC3lg6z@MXJ@UT}*BLPjG(45w!h z*%4#G>EoUd;%O{Ak1%U0)__&>t(k$s84G(~n2DjFadjZ{R#xswn;=nZEaxJGbh~ zQbpNo?r76uA>5JHpc4-SA*nZa^b>7L@m!@=ln#5=2s1VLY1;aklFzKo9mu;S$c#dz zTr>8&nS5bhJO#pol;)I0pdh3V1mLy?_3#}usl*Wm7t9Y@5@h;sov_Z|JdMU}E~+$m;^(g>{FKh<<={EK~;0;`n^ zf<2|r%-2S-3 z05{FtCwg7d>8SA?ViL#_o`g1+$HIk)?&hLW^OR`6-K0{K^>9zt3z+aCnF3x&1Ndb! zrJ70CU5W&S5hFn}5nU4#(?dhC-6N_1J-ytqaCrsIw$0Ib*G!T$i@U_TXwq>o-T~7# z(T+(Gh3*nPZA@4aUA&xZ@D2)vj;z?In{$NnEdlNQA*pbBH^L3JqO*`MA53&xr7LmmW`(PnlwGgcf zCQJmW&}yjZyTtWmyWtLyL;LF%(jf3yB;hcEcgL zH1xrSMGt(O+B=F3-WcI0^Misl7_fZk^wo0^|HjE%DiDSv9-C4U^Pt3n#)^qc z>AW9J`y%|(ImJ$VV5-$$CbURoAT+l-?0xAAbt1v=jQwd6Ok02DdMIB%oq(Pn>j3ni zKK7-sHy(Bz3d8Ja_*+kr(6ys|qX&gp21BZm2-MYkiKD7Xp! z9)q`|$vW7ai8prd7HfWMX}Rw9+$4JyX;|sl!cWpqMaL&`bg10~ax%ZAUxINO+tszd zcEiAJKPKaE0CBVGIhI#dX{wlf->lTc{^6)aI$TKK^&7YaHqT=Pl$g|mJDLL?d~nME zsCPgIM!W{#9j?yJ_;M&rV9WWRj(u^p&k79vLfyrHapra;1gVdMO7ql1bC!St_Nr2P{|(n zdtflhWqCOS8HJq{4oeq6}&OG??su>mkR7fo+4orCL03Krw*PBVZrB+5Zby% zA0@!OMGrN{rt}|70Fm#JJzOc~N$%v|s8^$k^(?SqBXCjEp~O~YZY5Sr;A~%R8)=lM zeEtFPAX(0EEjyOCMB9i8NVljI?QpWo{FhV5?ETigQH&Rk7CxZie^(eZo(&3Fh-ayX z5fr+4GFrZ$ljFQWPk9y`B*7_F6%;~%7aaU|8$yGUylc8>(Iv2x3fOp^pyam@cfB=& zzKy+}`So<-w~7?cI{R_^l6qE&`P?;%pefTTxU*i)R&(VbO2vEBL^0QdcuV)%aYd<2 z&Kj29J?=7eNg?HNuWhyym1CHAj{(~ACm{jCy58E71SkA-mxD}NQaZ6Meas3?&TEYL z8x}IJKGC!=bhqp8`O`M5krdT$1rL6^?Hf>7iDnS0EibYNi4pky3MNVoH%8!@)yK;* zA%^jTg);erX!F|)&j7nt$xjG3nJ02!KWyT34wfj1qmDL&oeU&6X^`G6OqAW?-z#Si zEE;(f8M~LAGH56@wc5tEtJ2;573Q@%SZA%eXXJwWbrkLoeGcB1R=GfGDHt|U8YADzx82vRf_w)2r!{da0~!VB zT8$kIQ{FRJ{I2wQF27|TMpv8s+H5gxybT3aH9SA*xSM<%x!+Y z$0V2-IU5GviL^G}s1i=z-aCB(adkvp|2w_+Kim1UurU7LdT+Ysumg7ImEsFXUPK~= zL@!Rn{{?7!+r>o$eY}2K=Jvp4ah2{_C_LeMXq>}w(;&{?KodzM9*<9fbFdZ|2I;q- zzFfaShn>&sD}c>sV3v>de=+t>UA6`6l4fG3ZQHhO+qu)WZQHhO+qP}zPTT7Is;axI zy3fVAnm=I8G1faHo`_iG^TPA_DYXZn=z660(hY@*5}Y&#AnB{v|M+aRRSf912v@VN zq0~wqxIwI4L>aJsZHw7&iPWW&r1~Vu4ua6V%_let$&ZJFxicj8gZdQ>Ls5yoJB~XY zF$VCW0Z4h3EWKmA2R9&DPID{&H0%6)f6WFez&;fy0GoR_NGKXWi7!Ie8Z45;{%Hl_ z!#nc`T^q;i#j{AR>4g>aWP|;o)yxhW+UBOd7y(xQk7Y?n~$rpeV;eNYI$YI zlwe3a6BV1YD2d}RM0*osF)|BkVTPaR1!H>ah;SXZ^t~r*|J0T zbvNG0o?BLyL=v7bQercyUAAXJ*Xn1b$~T6M_LhF?#8hE3X`5Y6$=iei@u8QM2H(fn zSc$0L5q$6!-uN~d+Wh70=oJZeD5K0x>LkUz%E&&0)4HH9D3U;qhl8f^`l!2za^u-W z{thqB@@V zAjUTxC$_XWxKrf8Bd~lBg;P>RQF%ssF%HVg(P4Nnxf0tQpi8WE^OCfEH+lA+6Hb7a zdOsmBg-i6iqcIfTF0O>GHfC9e*2Wad(^wY%{YYY$1OfhIamp>HM!P4*fH(mX!(@@k z`y8V-WPLl&p4KfUG|`WeAf`Q6m%t^vj@2&)H&we-@<%kvosqd? zacFxI5iYFe6mxbmd&;}UKC50kNf3oy(f^YinYe$5M|YJwsv?M?ZWhbP;-mmS<0NBC z?xrnia6hVs*Z9Rt5`v2{m$K>l+?cdqQ_whDF&br@aV=h)v|V(M1sc@VtT~0U)(NU0 zU9jT}dzlKjmLQ%cifW>l@hJ9-;*Z@TwTEK(?4#TO7YFKqI-&(vD$y6T$j2l(hE%W8Bl~D zCjS&Xlb_DslrytWF}INbc~hB(uY}l0rhvi6(o7%dl@t90L@u4hZ`gDZkeD?6a`Gjt zlM+YWPHrK=wy*Uds~#U%O!>ryXW{n@IKLlpg-44AvMs74yC<6v%xr$ba6J=umz+&jd>-j zMryj^7`;aPql8ylh|a}93n^iUR*=P>=+#l&!Sj+Iyy*uAo)ZHfL4WTyOEG?GZF zIg){`&Pmc`Ey9u#G|Z&YXvfv$kO>r@0YY~MCHV&X9OWfr5Pb%A;>E~Ptr6p?t(N;4 zIsmG^CV<>>0+^DX6*Sf!g-zs|eRs^w4`XP~Y}4(OHs{5A$CR_)Y~^U`0<>?agDv7j zQOrOOai|m(v1p;>#KbUF5;ZkV<{1Zvf>Yeguq-V*9vnPbeDO7A$A3trssE0<&ZMj| z90nkK(_LI(J}{PMc7t>*7hBvYC)4Nm5i2XGjC<_&XVp@kjf1mXsU!mdM=uw@F{zLs z##Tte9c@-qvfLMI*Az;Vr9YlYlch$)FlIkCNf5?B$ob@*9!++^VJslb7d77+J3k}-({Jpx5N7Nsuo5tFBHU6CrPhuv1 z9J)FF$}gG3Qyw7ZpCOrAbdx5T;?+AEP{Gog0vDtT`mJ8~LDo(I`#Xr{Z`(c4g4dxN z{1jR?*HuOp3I*NBkRb-fo**-)5C%H=xs#$EJa{zPv7WL8!5&keERCJIW#yfXq*l4vlkY%^3`56@*%(zu<2m<-u~Dd9_>i+om;`aK>INmahN%WBsSlG3qDpp zy>Sscsp#spXtzAaN^W1X;~G@93DhVGm$buEPOtl~nRe{PX0E%osjaZ9=EfH1p&M{= zeON&9ip@U}FY`4*n;0_r+`{VuSZlBJR81CnJce*i7S_#l8Ky_w5lfGoD`yy1pozPo zJg140PZITG`yEWm)O<1YQWLF{e4_33TY0QQ{kkJ_77$t|XjT?FZnQyH?QZ{qOM_HZaVc#M75Wlv(x8VaU-ASos+lmVN^7PHPVN023svG=i8g@^|^iN-1?;yI$2Z{*Y~rLzs30)7<&EwaPtl9aSC?!|34pD>Hm9%GaJkQF9~$i zhS2@-D;G*IwIPuo_51Po*&4n~-x8pWqs{7{9PF~ChT)f!C@pJ)a+?`ZB_fuu9g4)U zd~x;@FY={zWpqUn4xQaeVZKs$e>b;(pKU&l_O3w`g)t61TBp}q}Oa{sq|1L_e?rHsg3pS+c&$jC;f*PeJ2V0lZzYXPPjM3O>q)_W=PCGw#qGZ zioyETvHveo7a?{Bpkzx)sxx;b#F+RzoDU7cqW$|}Qm7jArR?_YgyM!|l#CO0jM2aK-GokY>v88Xh4Bsv=tT6G;u@hyoZ#p2Mto z%QS^g%w>c~k-mWhl^0Q>^9o1N6kLrW;>aP-Ssa99 kA44_?>e_xaJve?77)m0KB zIfRZ7AKlH=wuu77cL~LJnj%3G(BqD^Xxci|EG2|*DvFi1|FZg2G#i@KkIDbY2BLKd zF51=l92Fl19x>bTs-Ndv_H%bgZ&F8pp`FB#h`Gc4(+5|x?LU5 zxTIcVI*gNbLRGrrPWkH;WcW^H%Z)`7M~*Iq-q5Hn1O9Ay7&Yf)02j)`lOYAkwZl6O zd9i9-5nJ36rm-7YU~h~9k=XYC;V2~$UfpkUf&l^|Vxg;cc{;p4^XSyUM_rs(lRGmN zE!OXmxDVn75*e*cgd|K{bwV2G_WZ~3+7Ahf6F31CBy9Bu2q_lT%V=4lo7N1z;$@21 zfq&4UVfBzS73eNKxA`t<{65j~DI0Nc{1WF;<9+_OSPu=mqghjQXf4GS`($$tgGnLD zLA3bq3V>JtaYNHVeqEdhBDo3dKSJp7>LR?+azvrP6rA88IZ?L9xEh55(KA70>KZh~ z(9!t5x=i9D2Nl2Y#@EBdtMdXJR74pKhhlKV?dlWDY?Wm4@m*#}n8`l?StS=zQi|Zl z)TN3<3~8w(E(>t9Z?vK-XV`bM%F@e(n022W(81dS{7&4jCRxjgTx1K>qSAc5T2Go z&9g^>^Wx>I;>V0h&# zGe0X$3rM6aCi0W)PaMqk=;)p)k(}AkJoIG=wX;gqSy&LHL26z zoqEkrV>YoY)2<0y-CAFaH|q2pURDwX&e>9D(sc_tBgSGV^0-;YRd_oJZ*3*%K?yS7 z(B+O&c#7n0{`N1TN^QHX5cDxNl)-`lXQhXm3HnLp1`2tuMLo2(8fTRr?ron^nGGtD z%J&3o((nAxugA?VaDaBNIy>|rJ~SIl(6PG|ZI{A@&vhHRTF&(>rKCnB)sZgw%ht2b z8_n8GX~zdZ)8ZyLx&};*`SFZ41CXvDLQK1fi)|=@Gh50DOgSvcISG)>^&D+OnV9{z zraQC3I*D4sjkOGhsrIQa8rt1?+5J-H;Q~(^yhk^Am{#W%J%hg(mzpl5#)C1}Y$+Xi zyTF7yZ}i*Oa)h+PupGdj@m_s@C38}?u=~+x5%}8h=fq21eifya1@XLa>)I2gqKT)2 zGD`HCYf}aLSW^lA(h3r#Kxv2(c{YM&?}apxW?`#M!wJ3ovQHP!>Ks6#ETZjbUUC@o zF+{)Wst&CLBOBY*DyJId#V6B&ny~)yeQL*O5PI1@ho{417dqzyz@x&j5iLCdItfvd zi`6x1RbwKDwXdR{*#CO{!RoV*kIjE5~WN%E3(lHDfRp_DNS zy|{`88QNHwbEY0EvLd>6`=In1+i_tMyEN?;#3@B(0@tpD8chQtw-RyHaC@fuCjZI@ zedpUGwwu>!;`DajBDQEdf)YM_S?7=}Zf#%IBOFnavjWArvRAV@*t=TMipUw0ozzC| z&WhWO+D`f!*54LHb}evBRNWX;5Z2aSQ-_E|l&Hx+dD?Ba{h}fMG-XIx2)!07_%3Wf zHGsqt-~k;wIs+yx6#nzqxj7y)1p(DFb2{|l^orUnznH$>M;2L4h0Qz!HfM09rPLeB zP{~1BB`LD48i6SV>jY13$1@JpK;M|&m(NI=!k`?gC%5a?Ql)6vKnzRkJFlRddr93f zp2izXd)FF)u5>W{w;$A+!`d)> zHIeG&BWY@y$g6QZlKj$8;|1aWxB->&wX zc^P$gy@->kP!uW->L+T6Ufv*kTM8e#fylG5LR=1Cg6woYe!B<4#euS^g<{Skz`h7a z8y$$)`u>SMj{Y|0z0%dqkD2(_#dGuTWBc0BzlXQ&#bfkUg=W=N(VsCmg$iT#2w1l+ z`%7>me^&wPfsLAL6lDS_o|_tWSah|5rqs!c!)I}ixW2`+1;IPWNh}+?rCZH6iJlN4 z1&XPKNAi_VKDMUQvN`wlP?C!ixP!yv+k&o!PG$DVvDft{2$A_ZH*0pb$-hAm{-Kj^ zbWLMo;}57(%?qY5z0>87O-RV&zOKDiR{|jl2+u%4eqishy0-84pf4bx1f$D;bqxRa zv{Xip|06%Otl3%fdkjy1p}hN-Xb=yB+0Fa=KLO3G^rY|SeY6}6VOLjVUk#+wGr3+$5 zxF2Gt7z%%7LhKv0%*sEE!nm<_)7O)sv)#|e}6l=e$dpw805g{egbK_*;&0YF4)$gb)f9*dsPQz@-T={B*&Bs zd8ld>i^p9gXc)yd;mbU$sxK8VVo59eQ<)1Va8GGf8y#OpHbQZ`yE*|6pby68h=Gd1 zW%nEcG4=2sa`3=s+j-92{LbyFId#*7x51p6Fe8nxCpzCk)n=^KJE%}+be5KdA2p_A_j|I_y=!-Z77z6sOzj|qYiW|PE;?1S!C18@xqB@~gfT@yq zB-d<#)i2uQu^TXZ>T*a#teR9Iz|iZtj~66k5%m!)*Hsc0N1pGXS_K( z#h?lAtgBH&D&>)9=Io~K71xWR$`mqcu?nFQyD^{hvO`eCl2Pws^}7^Lk`B`!GggiQ zzY*Sp-^s-M5%ERCB!agN2EJ2SQnVKM3)!p3eMbAvg?}1 z3%;CqRtF6D<0A)+&j?!lrm#F#Y-0^j196vL1fXD|2Mdk{^aK9wFtiyH zT!3UDgh>v=uya^S@p+C?ML-MUYX#$~F-a*1+3;?bNQ1+t<+70UOhLC`94%z};a~Ex zj!J{d>*SXQ-w%%p`mg~GvVL>N9K^E|5r=dHlc<5=#EZvG=7WL~z@S9} zrI+NCr9dAY3Mc>7d$wZhmaMig(fa4Xg@j>Vl-3PMaw85;cp44!s9CAMJ0=}tZtC$b+P@LkldgCa(dSfmZ zKx&HdO6ul{M2=?-9?*UDzOQxb@t@CPx zYzQU{%-eQFed6`{UIU=92?J+^7UF@5UlC~ck=lTleunNOE85KsKTTx2 z$_70IP)+*K!8zw7Ox~KgATai>7=azjHUS1IBp5k59>1q0nS*1*U+*~cgo%huG%gbW z<5T|)I)K|nDg!k&98V86umZI7{^UW($c(@Ek&a00%u2+rG_6+LLs-taWcXTnXl!nl zjlFnos`*?EryYorR@-tg(qNAs;Vf+qv&bntmKa%bzgNyufQcRw2=?e2U&V~U7;=uiB>mz7!AxIdfibC_gWf zLI8sLA8y+;brM+D#LlPm1FoSyyVYhf*tYARpwrEMTbP7qyNym*d{Ztcx~rC>ON;!~ zLiw9gAZgs}Abo-R2bV@!t2nz3|z-Vg@5xJcpr)R^#mbnjcpwdTnquZwt={ z+cua=lJ_}E9_@`ZH@$`wG3tQ3x`H7*}JMXuChpT3g zzs+B&kiJc7(N7aP@wf+a(-57kfKUKA}ieAcso=?m0PKl(VhVp~plz@Aejt`k>24#x`iZ zuaXvXIOCJN7lF2t=*^A^X_}h2&Lq3Zg`Jo6OE!PNHe;#mlhBq203>HYpfMBC`IlvYQ#3(5dCwO02a zF!x~Amvyz*OY8fy^{k)>oUv?j)WcmVk$yop33cLZa`a30Mv>B$g;6KE``l@n^PBc? zSy!b)O?Q=o=eK&%cH^HLnQ6J#Cw@^#1+#Rtpar^bm9mBG>e4_Fs!~^Ha;YmO;bnB5 zl~3vFJMVM#ifWl>yLR!y#nUdHZ?8Jfs565-h@OW7AcY|m$f9)aNQo4N#CFQ-1IVge zGS}P1=yk=x(`qEWeh%$Vp~{os$cHZN3J1e<$=1)y{p{rI?p!>AMN2Aq2Dp9*N7++l zs>P-(1wxi3mgG$&CvlaLVkGd>(Q%3E%RTkn{V9r!ZXwW^QD*Cm(y*YDo z?-*tBch};WGvGuv2UB!(lG&{L zT36D`Q$1?rb2YNZy_{JtTT*TX0%p;%;vwgdd4)#rqIQnIB{toYAt`IQ4$N?+U^i)Z zMc(duL29t5H#(+T3P`JTL)=b=1(*h<_E0ZFp*Gx*q&GPLg-R2sA+K`z(1{+*G9k=_ z!~&et^+X?KyPgjFc&PqE%|p~!Cf_W7tFp{%l`n?>h{#n)!FIH0q1L&Mw}J}VhQufVz zL1P^Mj_}_y^oQ~py`?>ec9fV_`qh3FnSotog9*}WB$ueGEdmX6jBO$z&qW(roYCTU*va3?Tk43qHs`0#1;-b9Y&2s$4g9KQI=^5o;_V)bovc>g6pNAJs#NpbJ{gDYF4PsRzE05(Bb1=USo zlw6gLC}H_nepCb@_Bk9jhY`__yunbSR=$*dph-TmmbZ~zq!p148k0&eZ3ede8==;OhGjmiFw?!!J&LRwwCe_(CedhrbUt_n-4`RIF5sd57Z5HDizG?oPlFGtfv{gc? zTllPJR0EnN^)orFNV602n0QP4+-Hs5)ba%&vwM zL0ovh%%>0)Gl0`TV9|tMHM}ROpEroybjfylQk@`r8^@mb!D@Oggif^h_XxdS*y#u+ zRKikARSzA)E$$RxF=4eX^CD|}jB<2p$bTN~Tfj$r#mRJp&k-1%d1Frh$eo5+M8%w@ zNq`i7xu!j_9CLXCNCWj!w;UU62j>d{ZvF4D731D{fpt)fdXVVlXl2B9ixfDlVq-M`wGsM+nxG>8 zK@>+=$z+e1*%Xd8dF=h|xHt|3crcXS3figvZz)AA4|Y8=jI1he#$z_f_35T{ z9EE`li}S=NgS>!aZ;4(6#<^C+f!Hp3{6rjLB{y@LkDmlpoMd*UuVU=)ZJ`l z4jdEHf%#cJ9}62_slQl~(uv2OSPVwNX}=LQ7>}iEJ1a+GGLu{n`o^$I$cySj-MUzj*#DVwgDLlL^cTH2!hH@9G8Y`s!!Ne&WDG4 z4T>&T6>g?Y@?4&T+IdgSym6QNVvkGeU5zO^_4vks;&B01>A!|?v&R-ucaDgtf8*Z#y-WL(9;acaK8Kw5<8vWmRrp3#cDc;za zHSX5!Cb*GG=TztZB~2vt)**9OFmShZy4?IDfydO3ewD1wmVg}CyYw1vTi9eLa>Z?( zomxUY^VaUxYNBlA+t)Q5v4|vG+PGel{ik@Bx%jOT(GC zC=UDsXDj{yX8tP)Hf@%OD!C%=fN3)Gb~9r`u*j{tXwP;p-B4Q@iRO4VF>ccOY~ik> zn5Eczlq9dgd6p&=Njn7vSfajU@7LSYe7SAmr32(F-@eUCL zVH1iXssTAQYlCC$;)*A7=tAdLi(b;+F8{BSdi+k}3}`Iv>PTe1ske)w4P&|?plXf_ zVb=+(n5~B8XE1=4)I~kZy3S{m@$G!J%7mGI@e3Fs^D5oAlVA~dY>yN0rf0)&eJbEO+d-wQHp9!X;R=Rr7 zYx4!%G^VSWs%WX(Lo~bT_hM;9iq||fEe^PNoGLX^>umD1{PBR~cmv;bww1A+9DsQk znUlq(sr?O{I6>77>yhbaJ5OvNSp+|_Y~l0l^ZVyKao4V=CaR_&&O*jzaCM>eT-Y^b z9-q>!uVJJ>oZk>xvtiYG*6)TeDp53}rZi-%7N3|>m}vXIxe00ULM?cK^#^7PNLgVV zynR29V9|Ux@j}=mtc5bs9-fWG)EOt5^Mw>;66_?RG?!NNnDbR89No<9)|BtozrECO z(3wa(*kHzn6WneS$usLRH$0Z{ttqR_x8|J{DnMNgqVC)fo5uBUyuqj~A$kVnA*n&3 zLJZa%RaWMm?a>SEpt$%j1KL8Ww@RIvSWobX(kbVZ)&_xO$ZrDP7CP+BZ`V6UqthQ2 zB|k(l=g?+JPEooE$?MplK!ax)my$VLQd`eS$qeK4?1|@&UU_AZz@;@tdLVx}y#^r` z=dWJ`ipcHnyqaFW^glHMLetzo`m; zNK7gtl5$-hOJz6t%sn17N5)wQ_X`~fzdlQUfE6+q{tKp)mEpga;bCO^|CsW>BcQCX z+ox2Yz{Ln88gO~@kpL2YmyBoHaU#n!o~({&<0d}7Wnjh=DcUvHJ>$>;5t|Jp3dGKC z;%~6N(DdS;aG<52rh&KmulFceJ_EbGtgAP>A-VmaLt5S2`pBD{fPa-p7~7X! zouWS<|4|~{RqiT~ziIBybqIC_Q&$;SKORp-%!6GQr0iY=!*KGQqOt`q!}y2*y}Cwl zIiJz*t~E7poFnSkfYTnOrzah;u}=PTL1&Ycy*<6O=7JS+pNkZN-rpZ36%XOYrDEs~ z*C?e!)F6HL99_UH;PZ7|{UV*d(7#e7>`%F-v*5wkYQH*_Xzk=zZ>VmlZjALGU_W}$ z>T#=}fpB!lW#oTzgN$&>N2}~f zDsvL|jacQrJ7p17_)_qU3Nbv;t-QNqj2igu36r<=idVc(yP`z%e7h&PA~TJE!L%AQ zyMRL-L_{DJ*eA3<$*I{x9G4adw_O7N?&CazncGb@^d>7xAmS_xLT*rI zS}=U?#K>iLqo5vQJb^0piwkYY(>s92o1)R#olS25HpzzsdRc4kcY&j3{FL6UMw_Sn z4|Y=v{>Xl$pOWBiy)1Zm{UY-R(wCJ zdci#Q)@nN5EqXZ`1-7&KKw>L#9aZVKF``qSa3&9Piokc5-`&RAju2K+Lkz9yVI|#B ztgSSEO3Ijy1KJ4UkyEoq=$KFlH(+pXX>)ZrGgahXJTY_vG5?2@_loDYLA2LQ@AXf?ke*nWV59S+q5 zx!<{udb|OYmnmQlGQS+!*Uw7{BQM>0h*`WLkEy0!#F-d z?=Q6*9oqSaOCfp^0_U6755d745G;b~lQwbe|_;ZqTI^BT`k#m%YXipVUtCBlwRubyUYn6PYf~Tm~24VRWOH{ zH=X_d1R;^#(2%{=01v*$VRB4fa?ou=v6Jvz41@mw+GeJ7K~G_lG^YBQKcUkdJkNN- zK@Gd2<8211(uc%=N7CZG#6AhUV*iN_qAk>4Q=6lD%;EYs_bI zmJWqwH-6^2?~!8SnZ{8NMw0!C16FZyyh?u5?`Gh~Shb8nWT9moviuCGL9nnGU`bj6 z%3j3}`pikQOpFdb$MeYSJE|#esIcpnzsE*rZS2LUy%yO?x4(w<8`gYxH=iLdsPO?; z*}TnirRbh+`Vswz*x?*K;^qh&PJmA=O5&cFazg6?LC5J4Dt6mw2wh=u*PH&7X^h%O zCiOIjH{DJui)`B^K|v_ll04at^-%Qpk2X!1kb7Efmq{XEvAp(@6kZ`=PL+_d+`EWa zwOKF37ki*FK#!J;h=pFh855HwZa4J`IXxzxPAi7wW7ly zo%gTQ4GShHZjoy_C`!^N6G$=Bab7njqRjv_rP@qs%2#V11`%o>til^dyWv?DhlYN} zPNTO45WNLi)Jqb;8a`0k1BBn5q?v0I-bw7OZ$ixLkH4Gt_w2CeZYz1aawG4~%!-Aq zCa)K|FiU1(|hTK)f&M^9L#S$4I>!fU!>7vi%pxu#O?)Wz&#Zq4e; z;mAAm0TvR$z=U9stPlx8KI#PCZ64!0@Ad8x1gVbSRLJorAl|T16lnsB@<5T`nTJrXqjF)+h)vXn+Nh0_Msgh{P2aeBB7M+p zAqq9;hCvu7J^xbKg;kLDM^y#UhW#c2P#RmZcD3XkL%)N0X zk@ja!bHy*o)x+U!TdRd^y3R{u4RWft$NiG#g_)lH`mRouov-zyM%q6x5H{+NryrN# z$}W1uaGn>VVSNPl!0k>)PS=5hj9~-s#Bgl!Ub1xi#sG1(3$N^<(a$9}9#38P$j5{nHRo`lq-)R=N za|!qcpR6A2$ob?Xf9pzq0Y=_mfN}1B0*s7^_(z^O`47;UIke0kmQq87D1Aw;7FRb& z*6Ly0?r$I0oIX}&x-fzxQB5f{TSE>7VVkIyGnuFoF{E+}T@wG&U zK>shkm?xj4X#9&Wy2>a+qO|Ww2w#suP8{t8NvSHE29A^3iAIuVfK5(IvX1kvcZzf2 zwb<~Z8@{fX8zoeS!G`=mJ-OFa*(>5JFU(M+7shSS%0i^;1h5ir9FKZynC6f4Cn8$1 zG8iQO0nYog=O9GXL1Niek3 z>^o_@!sV^NU0vR|=5LN?@hSe7IaJVuq&4;5mUvMI?^67E^_BamG$hK5a$%=|x_!=w zP;u@X)&5Zn1gyNy!z;5DFj+AIQ-eeh%e8NJs{}`vc87e(UJx%*WRLMe_AdsRz!MSo zhjmDdaAWB2(YIh0^~c7tHc})dLxziA0l)3cp!0bO17X#!UWuZV=2SoGR5QH+Ut952 zy7=LnxLMl)E3AtB2j(YKBE}z`R70bNNAXxQW2`UXo%&xoJe z(IoZ1#ezDj_AYh@)Rud+69@A1u+fX?uBHXx7ZcGb7$ZfC&y5t2^3K#X(*4!HKMBrT z2dnhbh1H`wp32y^PlY$^)^=LU$7hiW`hP5_H=^uY>aq#Utr*8Pi?u}`)|n+Ml3}Ox z6}U7%dypNm3)%=qZlIqRg`#zRZMFFD?N?3PP8^vv&O?X_9KJ9h#KOKDOe2`~7>tWx zBaz4_r?Qf)jOV|{%S*id+tz`@>%Hnmdz1Xr$xL-x0PccFn-f-ji!+npLTo2RAw*sX zSOvEecHH!_9(!)*#~u2sx1E8gSSs7wr0Pck2|56nt4TJ@a(Y;JjeY_%4r;mP9;i2d z{B?@Q_C~P7!AE+C4e&IHP7o5cpxvM$iDXw|u?>m`EhB0vRBttKd*>|KUeUKOfE%tb zOudQsltckBJf|!=ZXmU#T_X|y*eKrKEtcz*>_L*r*Yl4G^1ljd=#$xJh9xMcHTu03 zC80p_E%@1tsNMqw5Ga-XqKvq6a%>&#J+uyTlVqqUb%m0v!w3Ah{R&BvZAn>v8|C`+ zyyR*6aB><;K!TJL$?<~fD@xE-PmvP&3mq4wArL=M*P|GOlt7y1a`WBw;lQ4&4n|S0 zB9kP5b&>l${mj22|2jLWF2MR3*b#R&p8$GQkINGnTAT?S)L7o;h|$PMCi!UB&4a_; z;`HCAw;L8vCZSByXCiYeeV>{34k=ew8k}uF;^nadFHO(04SGnjZ*nnF|3<=swu7w( zfnqK#wkI_t?Yi^qQMr{JqsMM97?DGsCVLhtG3VUJe1!nL4t@l_El3EO9^+2OQ+4EX zh(;|rmKiVn9&1u2&Cx8Xq~fPQ=+yB{b8jpgtfGy2liMK`hUg)(16P!2sB#G{KVvf9 zrm*`Qc;zcftv1@PJD2$T4^xKPp4jJ(b?*!%g{|QvsH<_4GPI}f8Rwys{}nC&q&H4$ zs{*dT{h&qVfcZMbEe~AmfsHNl<~!b4dYU&&sg0f4qegcfsAeWFamyCt_z*mMsAiRv z;qbz8_~3j-KMoXOhirXB3~L@5WG9_q^;$^l(Cx!~vTZ<7UA1O>DhW{u5J0CeKJL_i zW@lV%0x=akt7GwhuBl5^K(Knp&s-FvcxV~`{%NO9G*%qK_BB>fqOvnv7S!Gx?1*@N z>0&+Wbjyec6?HzJj;AK6X1XYpsu(#)%}`D{r6NgkS)OBFpv9pQ!I@D8x<>_ojmvh;Lwt@P5^_VSk(h{HAvOKxa`u{zx}*nVf{w5 zZ|f1YIU-EZ=Wl1FXq`E2JP<*mccWdqT_kU}>ly`w(s`xSy9sNG@x9?F&(zdyQwU*J z0eT`h4=wZ0)6!6%MvF%8#9-Fs@AaX2X8&94{B60diG{em4N*HLsmn_7&FEIb7AA#4 zCQEPx<~y`42wP57`-bq2q_mbhtSAF&7IJUEB5}h%9WCQe8oxOJgeHqmCS| z6^CsQ4*onTFBsz0AeO!h-{~AFv-7fXI|Bld)AOMhj=K-{czpSE#G<=&>B|u~V>J`5 zfaprzDDcq2Jh4-&OpLx`+hAh&R}b$dD_3Y$gX!+mV&1lv1sd(r8f=z)^|8lb|Mq_V z4)4;1>uf9n)`uC|7rYHqGw2Lg_@dv=AJ1m7!2N>55mMthI1P4NgUNdUX7p`Qu4ImW56&A{$_ zlBqe%xrSm}zn{(;vO0m_C9I&m2|PY$>08gU>9RT!@sK_{KQ%&NzDvy8zF&*J04%f0 z!vEEc^xqSdm|2+r_mFV2=HxHf2J=4!r7#Z-AjoF$IOw=-;%=yhGEeLOWy{V-B9ctH zY>O2tTwR0`M-alnQONYl(cAyPm1sye+D~$3WP4NgV2iQV z9sVW>vq<2eqSAaRzS|sN4{=+%#U5dHC<8y!U(P=KZJ{rru(8&k52Qu6u3HXiUtqM% zLI0~(kOEe3kfkXuKls^o_S1<%sI3rzf7sQa^2U3&u33=g&E*ikWwh7#(_3-Cqg%Yz zpP8qJl*0Qz3E|xL5=&f&oXVf>(hIC1+3)v5`AWAhZ-WI5p08RnXOpenA65#(v=+wQ zAJ_NO$BP~`lZhL=UglQcpdNqoYO_k`cQb{aFTViyxn6n2nXku3?|AM)IR4ECOOit0-|73T%OOC7#fea_R_ zTB!G}(G@45Ni3yrJlI5a8G$JH&n!BYK$``1f?UOHSY(#GvVV=cg2#rx9@e2$ zMyIv1O69Sgx`2<`==-(Jc;D~G&5U?BFeIH%&5>H{|w~i27NXbvZ^O)&8WsmjwzTqEpu4Qogw60dJYy)c<@(zkBT|kLFpOfZAy!9)v?wHAea^=)9@#mz022uYNdPtr0j;#{pGl-0nal9Pw?KWqp9b(q(c5od9DMwP zduahTW~hAIKMt*ado_hl8vjhWVB5= zO}eI~KqDM1CMD_hpZN%;&P&NkqS*W)`o9>vhww-PwOiOpI<~uG+qRRAZQEwYwr$(C zZ6_7mwt2GuGdbUX?ZG#xK@Do~j@DJrdhZo4oLW_O!yU1{Xy=4nu>Ntx)!bLwAPOGa z(2sNTK+=2uc+$KqVY5dwf{vR}qiRH`Nf91YR2Eh1uAI-oEVr>xihuIv$t{RaR*nLM{{l2Ajlm~v$oFfZ0H-lNblho)1j$jBLNWUtyH>O!EiErz zlnI*58_AhxT#!ju2OM=<4hVYjwVXJ+yYx%IA?B_gENPOn9mMuSBfb}y1653}ZA+0g zxpu#g7H*So953riGDZHj3}dw1LS}Vb40c^&usUB_=%&5)bLr*Zp;*47FYSOCaa7>xboW)4E!8_WgG4B4PjOn8u+-0UPTt=H~v!3nLz?H6Rv5kGP zR*&c!7qn*Jna&|TFwkbIU)QG2(`?#BbaKu?m^eC<1_B{hRXr%mwv7x4 z$DCWZ@e0!WWu)=S@bNcx;;Q^n9xIgXQ9k5w8FWNl5Ck}up4!>-LfGlG$^Rlj!oWJz zNp~|@8>NiuNG4UXSoBbY>LZHf%%La^b6>?ZgNHr{bWt_UYsz7jwT&5Gn{qKX ztpaIzSI~A8Zx%Q~4?1I$p=F(VD(TSSO|Ev@>CYCNLQYk7Wj~h=(%s(t+IX}^&$Q1K zt@&Xq7nV04m-#;Nn$7>J{I_t&`oA-y=^6gta5tqn5r4r9yLpfH>c^UVIcN`1qALX{ zUjc3?P;-(+X07#w>xubD#ygcUIRbI6ux(FRNj5$`5qpC5fv30ofCxYj$cD|Bx_N@w zdco!EVOh4-390G9g4mg~`!#URs-9AP!qIK}VN4;FN@2qo5ts1?{)Zq4S7# zVe8rv{q%IvtrLj)5;23#+^uIN1PNzNWQesVYVW(MV+~`j8ToRKeno2z*}w)u{w!tn z%JBrJNwJ9RZG%1N^7;4}A`pi0NGSiy+uif=2Y+##07T538p zqL%p}NT;~reaNaThHszo0@6uYrx`!Kyk6X1>Mnz%Pwy9=hh}=LwtI)==ceiKS7Fng z@U9boHAe8(sT+Dwq~e;^pb`XT6f<9`D$UDfNZ+e>vvgP{nR##Z4Cg9~cXd!9&v7T$tvj>m zKU695B-7@3$z%iTtmb|zR!cA}*B*hN3?TE0dFG#vYR3_nLG{R zz{tGJ$OX+uNHNR|O<9ruKEkw}M0ttX-!WTdMOVXh?1$8pIV2!kE8z(uiWvf3&}NIK0&1KF?u(_e+b; z#|nd|)K!uL1x7ZD0}ry+-T{sK+$3Ic_B-m~7_dvf$Q07khqf>`Fn??+S0 zt2XE_L)1mm<2C-Fj~0bRt1pmH@g7tdQJ!F66h`k&us}E#Ntx`}>U~`nlkJSGmqo}C zMnzCCF|#xr=V;6Y*QJiTq}X$Qj80SESB;DiXrhpoU^k2JZMT8=3YD_H$2berFO(We zZi}-E4mDZ8+u~a$d3YjH`GPuQ#>4!?UwrWBif~?tw`OaV6-ymuN5`Mg6I&!<;T*iH zC+QH3Q2r>A`b=k%S+lbO+Ebn!>1|y3%!H~8Yi6)+n4D-`4f^Qy z;)(E$8a_2|1X9kt03vfE%feWI<=+XeMbXxX=_js#T7CY7l%eC%%WS|q;fQ;WlrH(3 zMuFq2O{uy_QuZbI&^rY+)#AvWnV*NyZcC)gEqO8U?viDrZeDmYnppi2XTOZt`+|B5 z>8^Z^Sm2|k)p9_cFK38#Clg@l<+HvuA+s+?heqp`Z8wLKu%JeFVUDaR_l|1cpV9YO znb!LjXwG&oC(_HXI$;$uc$_UvKZtw1MDd2h~`&MesL@yyuz!X8@BiJ^{?0V!z4l8 zlJ8g<>qBRv^Yyz?A3?(bAzH%E=ui#!= zPpL@=h+N{k;PJCwNBpti<(ekgju!m%HIkFr9zm;*kwkOEuz9>uf})X7 zsBiRx!r zI4SY|snoJw?qo(;6cLx zYc^2P$R{jg7D`A-f_6NXP{owrCpLO7$erryR>Q>4S)J+@Rw25$fxs`2w$XcCDQv&* z?2WiF+qZ5v4yHLC)k_?$1HR?`#RtU8QF(_y&*%Dk?>QjoA01c$nlldEip)kCj(IwB z&ZV$;9cwE32>GkTMP+?5W1Zq56WU>vr_l}r68o`^BHlFlc+TJDoeuQf%SAcq=A+5x z2cBTzdlHfT-LR?u5|t&+_T@uy)2j15OWptFf0Rjwcm2r%R`I!Q{X_!CnLFx&Z5JFs zU^2UC@c!I*tulc8w1BIUG0;vxJtE?kioP8g zZ0|1{<(N&6r#S+Saslm>0EuFzME;~9(bmJ?Kcg$_mQu(1?xNrdv5}_uS0ZjWs{U8Y z0~-}_W8aN33nlyObNeBebCN8E!u(5;2>8L8p9@*EsH;;7#fw%aW9t*43{m$7;FtsR zfjMb03!6HZZjk#3D<(=YgTWz_%eFm3&S(!58`T9oFzZ{$yQgi7=fQQQd4B13GZ z2ieGA#T2x(TkC)?&^;lmQE_7NVfCf-^K!lbH#o8pS@@p3{%0-y; ztK-UNt3wkeJ9|c81goY=9zK7G*)Jc@VT`zPTIFFmuin`9;Wwa?YhxxcnkTe5TaHjN z+aq)S7K6=8?SprS6Ea3+oS?4Tyh=_mDj+sxImZ1|vO+yrd^b04+$Tf;7oQGHJ08fF z&$S7+yGq%%NB9PyipM&G6!$Hrk@HxsF9{qIrd8~@ITs@gg-UW3rDoKRB^$0mrT+aY z-&-*ZsFF$nn3*f^7f4H&`_#YtEaI zww`|$0M&LSQKA0mfQo@Qr954Q(_R>sWthZSy**Eiz;X!5*LzNj%L61>>Eckg{l@G@Aq@PL>SLGzh7=124hOW zNQ|~j-I&3&weg*FyZ3Q52x+9Rr|Yz;w{P$C7T3kQd_fiWO}Dehr$2})amY(_dhPv%{B*Sk$IXSTyVCcwj}R- zQ(Ie7mRgC}%CXZVrTgR$%xWy*H*ywCZ{{zC7)!}z+3E`T*3f}cegQHj@T2ccp8lk~ zst#UD);VM|q4wF^WtV! z0m6W6Q+!@8x-`JsHgZ$se-(dSjKWWCp;J4#EC@bAOIQg%Utpv(u3q_0kE^vQu;xDjxoPzFqA8W} zqwICvErlA3JW9x3{Pp|XWzW}l0Y}!>f0A&ao&EGpV6e-{5XvX2#T0{_nh$?OCqoOrSQA>LwlWMPw4JnRH0>2kV8VFNO}xz%}v$G**=#3-Nl_YGs?|Z z9NSA%JG`=qS8^KgFk@8H5Gz9}QnrB_l}6&GY)VFQXLFopa{|Vkb$;L|UD)m)ImOi( zH{R5Wz(>O zFxKsJ5(e6cB{DA6&wzr68V4-H5sF=#6#Z{hcI)O>e+siQHL77Lb~y%lp&t~tk9-?t z#>@fqc%;mGI(4eAS|WE2RjT>JJ!y(MQ2TA;h?K)3r3tCM%YF=FP7%ZxDH5pF*v1tX%RY(4u|_vp*IAMj>m$OBhP7E7mo7W0f_Pr zZxVCSJ9=}z+?tF=rnkUM8wu^Qgnq=dB%X?iUzNaJq_UKU+Kd2cbP)R1lo9mDPsfHY z@EvbX4j|Dl3deA&2fstwwM_%y#tJckG74gp0mKNEbz<2uxVwwIu~cSbpkNGtIg`6q zN$UWVgZ>i*X_n9<+LPjIVaL+@sJ7fr){XJ<<|&|ddTJQ1xmrb~VvP%Epa(O&v>Oe8 z8&T?Wo(IHc(@DL3MyQ(9@4C*V<9kgh4nzto&y9zq^iLY?yhjbcHoSy^Hutr$%!z3 zG@>!(bC?(IsB*PYC6z?a+c{Q5@1p z-9ei!H6>5cJv}y8R*|}5o6&^pR(f!;v()U9+)?XNsiGPPb)9n{7Z|nUS`+$FaZa09 zvNxIa>l0wZ&wnKKa79A3tglc+qLuw-&9vSI7ZzT0~bF*HOr4oS= zE4J4`;;}#7bfCjEkdq(If$%~7W#?DWxhdBim63Lky0?B>Um%$^-W?Iu$WbokAe)*T zh!lv|@0?l;KTaQ0bBq|2)yb&pDzhP_mW!GJnvCCAm!5MU+4e}zYdriU31Of{vD%%% zC9~M(GB%K=Vzlm^$KBHZ>;Mb42A8&@C8L8BR8m4#s}Ky%t;^lN)S*l_RQCnr$5DcS zLq!0irz($FDpt{*Y$|&?xd3u@=!t($C3u?69m;dSElM7a-*DlLZpYFA4x(|b(ME&x zcA7c=(l9k|(YkI{pDo6M4op{CV0>H@r2rJ-uOaw1`3uVAO0A?D_;Gc$-)%H^TKz-o zj>VE+&+iXaSKXH4Hgh!qlO9OV9__R?FA{7KAUqhq^g~~{1*^0;jMA{HsJzx)+pG4R z5h1o*=Up0~lVx+|kO01XpEG36Sdgl6NrZYTvU=b1ly^obrb#!5MQ;4l*r+^{rHI5% z?@Vdl+7QKsYz&1?wWsZ7O$Zhig|!&6AWW8k09|K(!#>#l4?Dlpt$KL~AqY8za=Q+l zM8e}`ML{7$adO!c6!I2qn+Pt|8}GQA6TT!Fmt!nfR)h+KY6dMrJqgy6@H(djG4O!4 z5_SbQD z1+guvJd_y)&up7bPxhom%*%~GbI{A1QAf#j8w#d3%6-nlm6gZ?ZD=VkxdF6NbCOouT2 zr=Jk7V{5UG(~g#m^56>Bc-Rn^&nB1WDzH=0Wv35gtK$ugD(wVzMgk{YKDX_!0x*7_ z&@-)a{&*CvrhE6e<$wnFKWZ*8W+&H1*OT+4Mg83>bVYBvoXw7JveO{&n3vf8FO`QU zu()&{gSdmDT$@j}<+KgRhH^&GnKw(*x+*Noy5D!YiqqF@|0Oju{qN4>tnB~8(B9OL ztf6Z8F|<`D@oFj0Xm)xdfXscb=C`!xf-ciee<+xYug^09iA8R!9LEG{yIrmkLmu*Q zJihq(hjY*bsc*eIi#ytI#F7!Z(;?Z@`<%`D5ZeXaZxgcE9~yX}#kt)VP2&wJ5vZit z_P&R=5cD5_k>|&K`B0+#q*++dCGZIu0URyoeYnYM6xlM0-INJT;sA3U$uRtr!Xp9} z^ghDne6BrRhufaE4tHh!m3o(<@qTS?r6!tZ^3nd&B7EH5{^G?zi`Q|Q=hx2GDo-qf zSTsH=E<5*U>a!Nl5%t>2gT32tQLLK3Ulu?4bMeqqtW0P0_BCOYiNb33@wI)LvoP~6 zA8485^TF)-NfYy*8X-iFFFG(cR`ymT$_3kI*p8x4RbWdVr3i&`a+%?4Rha}JO6#{$ z99M(?JO}%3Jes^M{VHfRfN*>|;LwC5!$h}IyD$ksk_|tS!SnRRq(Jlk3a}X=wxMg?4~Bwr?VFgE)K!YO4Ehu-+eI+bGoWZNu1WYpMI} zxrj-@^*Y^-GnF{YjdZhif4HcMwZI9vA0V_D(w@geAWaiG?8@RcP}=8k0b#-%y^<4Q zRqADTFK`iXKgAp_opwg7M^hsXt0+RDJ(d*s_RqY{k)q7mL2w90_<>LTgqPSQVQufG z&iQd2>KqaGc-U=Xrr0V^>ggn~9_gQlcKLcC$0!;L#nRsO-MeHZJA20Zj)5|!6-iba z#P}337B-a&W62u~d8qz5q4ec*cCGYuqf|l`rG)m9TZc|O9MAo(RVK4}-7oAKscerK z-GM+x!jlz#{U1tgYb3Ca@D0Z(g>W2wbJ%~D61X@`D1A_?$$7Mo)}P-w{|Tpaq8_@_2i5v=mkhcLq$XbzUT5qOT=Z>}OQOr~x+ zEu}#6is2x&E6X4?^Y2`L=F}%9hvp0L39}8^D*; z$pFf~)W4j#{!mpWu9;|{6-*>v$?af@ve%o;?(|QPzY$==IIqbE*)@u?&r;ucU!o#N zlKYcY)t|NB?GaY$hQ~;J4@r|Z?mCtR;x+s&ZEUfG@VD%BhU(C!OkpnJ3LxPHwNObM(us!3=WF z^o^;a7OW>q0}%IZU)blHVJM3+8+68On#&Vx%Wl)R05cOC`APouB{xzbZ`9X^x&j`1 zsenQs?n{);xaaM^Y`0&-pPl&L*k55a3bu&f#|oB82au`5(~fmVAni5~T(0n3bQE`6 za)==-h-km!=tb#)q1|E(1X)0LUSK2VpEuk|`w{yD(b}u!@5xCMckapYUiPb=Qe~H~ z_Y@DM#!Y%AOC(kU14}&1dqQNzJ8SMv@wXcu7Ixt);h>HTC+S3mJ^Q2ZI8Vb1{H**| zOm_$VCGPGJuYw~VGu#Ipt7n~82tOY;AT0mk zkV`jRF^U$_)+4RQKxG{MxHA^Vuhnat-1&$tz;(wV{i~DH_t@9U8`-ew?N&)&#ut52 zFyt_@8;%toV?CfGdrRNn`*1ZA=jWMpJa+l>!DeIc)pFKa(@J?9B#s18!8Kp8pKlWf zO*%R>hUnJ!8UKaC%OUR++&*+JQZXwjDjq?J_(hTQ_~NyNUNR&3@w;jvGTS7v`5o^l zDYv`ome2Y@^R%uEm?55>`bLA92A^1GHtgEK%D8dlJX$<&u1#7N3K_$| z4Q)0#E>sj3S(ZkvLGXA(F;1uImxpszYJJ5@-F+-)u(@+wWkLk4Q34fb>P0V{8nzhl zS3r~pSNIp%p!b#-%sYZQHit2Nn#l-_8KGewr z1Q+70X!dvIiJsQ&>q^Na|J;#a&y%)ccH{5S(CgAB{VG-Tcv_{nahl!AMWmN>ayg4+ z4!mpg6Z_w^X83ha$s&fGnTz~W+_Y3cd+o$FhcHH@@~Zzj*RO+A8AUk-&9~2z%+5KM znoKIo_b)>2VMDF0Jl5EY<2*5TUz6+i1k8C(thex}C<06C-vSWpo1(L`E6GH)m#k!H z(z!U-?Yh@SMfw_mEOQ{YnJUT!Cauy9OC#KpOz-N?{x)1r)$L|#j3r16GZu!;JWO6& zKRD$js|PoX+|rjT`@CK#{pCHx&i>(x42wZ}+lT7-G!no1^V`qQ4$q<{0_4jAYTuEQ z-DJBS+pNZ|^&|4N<)&_v^yp^va}4kh)>lSy`jJr7t@>O*I=#9#*1$|u&S4ZsFGP#h|J?nFCS0ePx_k*|9a#I_uObw(ZHHd=K+ZDSG-+T;fY`x8WVor zBX1W2SB5K{Ds`B8umHxciMJseQ?Km3Ue9?04( zi!@VwlCm>wi07}w_q@7IQd@Vg(U#3`;=*8#e*DkVNzlXoUm9tV(3@c=L+&a|dJ_wz z64H7s70V8BxHfeBJ)1C}LEt8Lez7%gOBui9*>pfHLsOq{J|^wpanM2wVSAwSHq{^K zhBZcHr>M;lNp2Xyb8l?UBtaqU22`#0jadhk_M-4#+482u*tqqRn|xI5VFIdhCsPiH zC^j!C0P1zGXbVO$h>O@2Y<`fRNOs*Dtqtqt71ZQTilJ#q>va_gIqs8xpl4~UKCvtO zOB7>|cju~0lxz{*W*N~LXM9_l_EW7$TJ-YKtaYy_yS?k<~3=|RKdh-G~LJTA|F8M1sW1D7?X zx<7K^Zo=~YDPWA`a_auL=L4@(^l$Ee3$XvY3IHoR+y7eu0Q`sDX-4|#cRu_Qy8i?M z?}9|c8l4{71XFjK5nCOE@krQ4&{h6f{rkJwO|Pf*pxi^A6AXzNq&3Z2q_@PzN>jgQ)XdPiE6k-LpZ8hoVZc&G~je)>_HfyDfi^ zF0M$t<%&`LhjQBT(wgS9eq3X#F!mDRL969SQ0SKrFBKq&`G+qZW_N)lO3pkmtmo?S zii{R1S_P4lFG14-_ZVGMcG2{+&7PoTy{G5XYi?e&t(4raA6FM9$v%+Ws#tY@wyB!< z%JRcA@m%OY{Ojq5^0xbQ{^8IXJ`jq|{>1e7s5drEx+?p8|9d^YyKjpgBm`aHv`9E1 zM;;Np$t50%s=q~Pt&4g1d?FP*qO#}bCK+8bmfNMLYxDzMYHr7{w{a%m8$FLeK8lZ7b6U=vuzr4-kH{T zy;&Ys_i{xQra+5432>*q0J-4i7#2&!Lp`IL!XG;c5;t`9NTbl1%O~_#DJ~-4wv~hY5C&utQ28s`Nim61l<$=(P87ZQVQboYn^4W1 zcr{d}gGG<~&^g_d17maEi3$cVt4uF5}7S!3$%G#lnoR-h-=N88Kw4^&ujcR8)7vF z;<0|eZ1ltC+IXn8Dj#8u#bfQ1-+y{Nuod&yY1wRrl~&^CcCMz&(u>B+7EC9hR;5O1 zn5f-CaCui6G}E#EDk*XhmCPchjua1#%Bd`3nyNh-X59Sd#=BLUji7XDo&v_2XWUcJ zk~sMI*d7oOfj9z*2HFF=sc28*!O={SU$JS`X3Oz3| zyf4&8vLHd*Q#HW~&FYlqP&iGjkQkO$PoaSL{D&TI%(dmNOAG6K8EP?;!xYPFd?a$? zOc8`@%5oxe?w6lzN=%`dG7b-E4#<>8_Fvg}9IzWpEbJJrKijVa>IrG=B93@Fpl&S} zOSuw_&kIVLyh+V5Am*hW$PV$_6u5VBhgtZ2%m+X^S*Si1)Aim>J*0@CzM@#u&Q4gMZumpPb1>LC88Vob}J&!ix@_tIgwsVY)MF8He~(!|$vOF|(s zB3b(jsANjta3UktU1Ovi%CX&28qnbAK8 zQmAN52*p(y*6?8UtCh#-LiJeXRkPE=x&gdHmE?17lt7i*p~2~*ZNYi;W?XcRc|KCV z*(t(eG(jjsM_<|_jP`Q#m-1LnBnh9USaqoS5{EDoBvu5mkVYxZpfLfvgZHj7LCGcYP83lGnuPKi%e3qTtvJ{#3I+oRM!~TBZuj`3B`{q~}{pQAI z9^(ZYhk~-it4oonqAED8)VlT%Q1Qu)1y?b_miSCAEZ>P{j&sZfi6#MO$y6@&@}Ltu z6%|KWKiL_Z&^mi&|QxCNhGJ_ z_v=Tff@|J*Sq~?lP(|8VWqMinWaZ+9hJ`D+A`Ve9uo$o7o4!wTfx)acKB=-zha?+3 z0iX0Oy%1B4dnr7OozncSU%){0S(76qU5J(;2u%N6EKCb6>uBWtB-VF{RV>E!9?zz| zuB}%Hcp4zx4epbnAT_E&*Cs}!vETo9L;1uT&zfNp=Sg%{ESq(-^Ffhe;3n`Iuc>>v zv{RE1Fw2MB+4E5HyrG{*R<^$uLuqU{T-A7^BcgLPwKLlox;tJ2TVIPZkLj(1l}r<@B|=13t` zxDF7Ef+$O}HhEqf3EdW_hCmtaW(J{6IjGu2KP9Yo7A`5&Nzy&Mnv|wEf9pS%gdaw| zLnxT<<0Ki;D`qk*l4bG+h*!>gO+83?m?y#qcs7d&XI5`+%v`?U(N50rJx~?5*~Emj zusW%s|1k0%;P3Y6+@#~Z3J_@XbQ;qAJRLNmG)#4#v*sirB%uckI6>X->S}dzjHy4^ zFw6B--S>3(p3nHa@_|hN3I4Yf`@btMF#XT+!jPtP%zZOb_x~*~+(;7F-sJIP;kPt; zP`Te!7ipynIh=0O^>7Hq)n9CqLSk1Lhha~TFwMZe%JfLnGd$x-!Q`M@n;MqP=x#>g zZ62p=KGs|>Ao!@F)UGnZEWER7^H2HHpxj_E=WJbnyBoqjDAWH#yBq&Za(rfUTt0;U z;_}o<>ap(6`AysUJ`5W$#H05a5v%h+r~aM)E(Wgm0q7z4z#8}JDC&4-48oZLV*D6x zdF#N!Vx?T<@!I@zbNP1toI^SmwGd&489HHTnK<7CY@hZe|9qBi;=g{zn{)dHtRLIc zh0v5<(<9wb`&as#Mnl`=sQa5!yvo#A`0Xp_|NaweqRspL66g8383Wg#fQ;Y`%z&jf zd-DpPrDyBJlQGmq_tHs@lGM+EFoDYYp`tWYK+wWcCKl6)-)Z$wnf3dyMZo=c>)#m2 zWQd^6aI`62wf74ZnPgi1WQDz=60WQw&An?IphH|$n=J7BOuG&)CNBGHO=h=F@LkL) zir=KLWh28$y(Q1tFJV5WInHs2o;1S!Ji-Ez;2)ceYU*x6Z|ryF)Ak@(;l#Lxz9LwI zdErk>kEHH5U2-efns7w zlC0|p^yt$+U`8je`I(>(C7Nb&^=ksHlPe65*8A2^dPFXDPeWBAWVKC>35b_z8^lF<*3?0V_%k5-pASPcpY?qt7f@<-^%&=bt30&I`7gKyYw-kemY_ zBCrcHc%o_zN2j&+4d_`!0)c|9VK@n(;cb1fEN)gfaA~eJz=by8=LHM1BhkC3tBA)A zto=)WQYJd>*zxuhrd(DH@PXgrI|I`t09C`r}^GiFc z`L&Z;N1{6$tz)z%+JzRIfq(!i0mQ}BFILklewgTSZ1^OaKBb++w1Q*_Ta;N3Af;rp zm6l*xI~S*bM#Qea=fc?7N6WTXZ)F7}DI%P|xDzZl;B*Ulk7R(dhAzc#trJHv=7s{>J^{98ykuwT6 z_ZLYKLwW7o65uyzKN#D@!J}9=tp~{+LxuRz%Ai)s8OsXBe9HyHiZ_N~I1U!|1t0~( zPPs~I0>ztNO?b5<%a0RjiwTqqo{mO*XtpYjN2?F`(-%k5>X zRk}~jh#wU0jcpmM1fz97kim*FDaSsTnS6jaJPmK_ZEa|Ec_-Onf8V--i1jd*H=iA_ zELJ9XM*PRQ$s#XIdJD$sfYXd}MOkD_UM%2*ngL)dSdFc9(0oWZePD@GnQm8K`<}ycv><|%*vO2W947kWNwlP;>xW4aUfEk zWC~$~9Z^?nQ~Mllk=RXK;DWL{MFOWZ?Be?N{;{_Y=_|f9+y-P6>czUn<{+d(nMXF_ zfkuly^}2l()(GF4;mZzL_~!AN32{MpFB&pM%jFgb@wEomg=n;gY7?JhRoy}&n7gQu z&1U&*yl2BONPs&nuF=X4@}~s{8j9#8W~5P*RSBTnR>&>!*MbvK56dYStNYAs>bg{i zP2OMa@JN|fL)G0cWchysY3&EnXWC7MtSg`Fr}hQfIFKwB$bmGrQ{F+Ov_8SKOkSy> zduWeW3TRMN|L6iNFoTQ59{G9R)jXwRKlTd#Se)--x!dsAJj@s+phG zCI7w*mTT^>4Q?#6>p5j}Pvm9mfoG1qScUBiv&!@S+)T7P1N6OSWs}J+6BnJ}*+lVa zfs-l(gk7}v8QXgmXNX}7(x0SuC{QBE;y|}{!_eoinO=M{hy4zp5-Nms3XjD}Z z#$HkuEvXxI4S8HU^<)aab8xTIo=ro)gw&tVFGG*Sm3Z~k_KruvWe?0Lw8$s+(-e<1 zZ?TvK6lqXSn{EXUX(a%@2es+kO)R-QE}VQ0R5*A?(W4Qvk2F6OyMTlAKzuj>YMy&< z`HdZ8ozto`~D&y4x2>_#vml>COS_9bb1X7OQrLw2^YskKksv+?T!mukR-ald0J@N zMTpICCW$X)gi0R=$i?($(~ZsVJ>_QYCnP}R2)#7sH*82KReN`Sk~xGhSoiIN>!t|i zuDcOf237afwO*f+WH3QEN4KHVw$JHGK!fM{v%!RW+ZF4Bw~4&#inEXyKSMs~4K)6I8-iapCw<_h&JX z%kpPzditkc`k%4sFW6h$YEvw{nbULeADGY~dFM6=5ds7*GC&YJ^ygH5l>JPye{vxM3dHcW*~e+)|cwfVBp|8AL)K(ZA0<kDQ!9yb!U`mE< zA&&t^THecHDZJ)Z`!kY~bb+!3=CD=wA908M{J|);3KG8kd*Nb#pmA8-Pp*}VT=>J^ z!Cpe_1IZ1fro?ulF`v+lTW*B~vMow#h2Vvf+lT3(OA(=Zo1Ecys^Ji#vPYh(xoY||KycNGvQl8kgZ z7C*(+h4yH%>pFKt?cxFc+=nEnO(|$L2AO>hBWV!AZ*D|n_}75d(jz!!w#GhZy0r?q zWpo!l$l#YHk(w6?^8GUpl?2m$QHQFaUx_mZ6*2T=QXmF0MWge@lz&pNFOrKK!hAT| z(B*65?%L2DLh}}9QIH0aBPkSLFIpgV>0Fdv znpX`qoZTV{LiQXGo|tGx`Bs(E%d*?n_$4~)kjVT-bGXjGhZH90ue8Y>c0(lgG->Q> zG*f>l*Rqeuf#OXUtOJRtWbR2Y%+x(yHZwb`WMHr!YO5wMTHt%u442GVn3PI2@yZNh zjY4$}`O=#LtpMT|)zc4<1$S5;;33-tM3VkoXpmv`;)N*{km&Ksq({jn5$-_uyf#Kq z<^7&BFOwg(Pi=C^+7p<{oKwhGJNVlfG?RdwoYgvlFcV{@F-s-r72iTD0FpU0t{t$l zl0!#=kgxr2dh5UmN`enSgo?-nCq0JsN5C1;Zmc7Gv4#{F-Vnw5X%RsG@@MXFN42H) zFwl+5QU_Lm0KknJ@uc$XZVkNQawP zS;;sED7;6Xl23SFw0e_CF~?}JW$*eXJ2(TZ#2|+a%emRaW(-OP%Z-t-Q_;s!+c>Yb zaVLU{_glA8eA50QW6B1$QU-2_YKw&sq5A`0bAsCNNABPc0EObG>T1W5 z^F}P-SWm9=pknbU_e7|gJ!F=Y2T7Huz+N5dilVxU?!VTpJ0YAjg$oMtxyPXTS)Y86 zu5?CGJymuwA6}|=1lKli%ap(-LKQb)sE1xo4byM=auTJ)1hO5Mo9U=AdNr#w`zUw^ zm`U51%32&cQn;%n!LkW=XrEh+!_|uK@^$wxj5I5I&r(-W-OgxV2;4`X|GwP?^CWZk zD=QOf2kCAgQvogy(AOr-7@x!)>?vy=-y3glH_TnmMu^Vucu=PwbWr(LbiydnII6I* z74G7OlkhT181;^1aDi`FdjaRS`cMDc` zLQ^Fq80rv!YL1k6bZ#IH}bV$yA(SKH`2FNEHwOp(2>LSD=gX%cz z@KBb3NkFd&Kkp1nFqK_{`OVCY#}%IDfT9J}} z>zEllYmei|GY@Qeo$MpY;%yQ)nZw7Dka-c*Fer*|FPem^%NR8-?zXHVrf+T?7Ni zc45PyjWH&Kg;x%@7$8wPFBfV8a#Kq(*_fWE@RCmY`Bhz6B#Vu<%&>A)EYqjFM{dzd z_K+A}7(Pf8^>kh9@X>DThKk2p*vLU@**+}BlfSshz()SImHiMT?qqY!&a))G)N0(J zxzj3$pI!{Tkz?0f3VOc~VEVG0cYwbxd2S;&7Mu@}cc3%@Obx(b!7qsm=K0dyq@oY< zDk1+s$3%-wSQ71g%%ic`vD33M-*}){ZG~xo${hja@(uG!bFCZDsWnX>pUkMai)3KK zhgTIdit3U~j;jKuqYO=Dhjz)04_IEV9hIoOokh={g^5P#8doR#zeOAEJ2p64UQe6`$)dG%Sp{wwmB44J=9<$}+bxP$QVyh9sstP-%P}@Bl7#BiT!L7l!)koPotT3ROsJUr zdwp3Ylr>bs)6I5!QGiu63zh~5yi%KHcW}>zet)1j@B9K-Z@~Z~RRRjUTRr9xYFM6A zu=aL2IBJADH6n69sDN!P&Qe39vyS7gY|!>@rojuhdlW5C{tmMb3FVmABjzz{5nHx0 zD^@S5TWn9-u?=fXRM3h({gXXVN?Pt}Z;WL-D$8Sgxs}QR8f5(PDUXOk=xORtM%S6? zu3%C(46@J$`PqPd2|HYl^}|*DmSEpuL&GdoC8e{Q(u)hfrK)h1Crl|RS6pmMaY=-! zM*EkIt?emS)W93M+L&N~(QW}_iz8^J3nlNxcF))&SLTTPyGpqV8`3mK3_#NO$SdKRF-rNUjXIeNxpA-i+W zh_1oX;L{c;YO;u^B)==-1(oMmM4oI8>x_eh8-mKgdFtA}*|KzEIq$y8d?_vaaz&3x zR}uM*n}1es=#bSy~vcG9~k8B)zAjAUyp`IOkjXMg%G zjy++a;T8SNXvdd?EU`QqqhUM7idqMIH2$wp$yh;h!u6H1!{d=qOA0P2YjDqJ7vy)whihOI)6xlG^vc#yZN7$Ms?QBIOc$WC(W>(zooB`yDdJ+P3THf%{y1`~@ z2hVRrEH+rB#%kJQmr`!=4z+MP9rCa;Z|+X?C6sY44xE~%jpIqhEv+qtRGMaTT>h~U zyZ!$#_Ksbm1WL1JbGL2Vwr$(CZQHhO+wR_N?Y3>(nttzK&7CdwID|UE;2Ub~ ztDw=H&kdo`4O*Wb2#P_vWAwH?P&_P0b9Ah?ReEpagUw+pYXT!E9ABQj>niBI7tvix z9;AzB?#JmB&2qF)Z49)FgFHOHoMd|eI!1GRxi}h)iGP7779(mx3!tL=vn1ZVM;Byr zIiE*HYQHcgm&_73&v&`G${dZ?ugT)*jFzO^kDY~`vOKzK8Fg{Zg03 zdgJ7Q%vq_s<{lSavp4LW)jITl=0*h>aYOeiQj(*ho9 zcT}h@fg={rKwCXHJmo<>E32mQ&ey+h)yn^E z26&Uct<4aQN_G`H6-maTW2aVgoDs4*E)&>%%b?n7G;M*@6P78PWfGIwiqNfeV;{XF zCJ*>yU)ihI#R-hu4yetA@zH^5AzCkB1zfGLCij;&n}`ui8mR&bUYm_uru_q|COQj} z?hiwNuh!YcL2be5R&q&*x;LT=B|?F^g$tx?N;G2g=h+cz<&RFM$Qv-kvBPBl-3rgr zb#erPwbM=)4=PeCbj;|y2uH@^2T&-TRAGE<$L2lJ59hSARfT7kjtuJK5i^Wyc%+F`y!hk= zIGjfEE7h8Q2UMmSDy3MF>r{}LwWH>+wt?L}B$I~fvc#V|J{FA44uKn*;4gKt2z?@e zaDi4(0E0U*3eT#DL(1wX9N+r*tY!qrhv=WeFlF&>>~2MZg3K2A5L%K3d8kH4x;YE+ z0&Qo7t7k>#xBc~MhOSKux+b+In9o-5tC!$ycHIJEly2iH`uE7H%v6@<$(6~;p-c;_ zItz?p4bMntiCtan(ZKgdh^Jq%OXz%l{H3_2*kLxJ!X$TbgE}ytd3j73~ zw;aRE#hBOg^lzytNx(M0T&x4>pK$i#-X}4n4yT{(@g*zCVKM=yPVsR)q(0T0fa2KT zb(^lVgEFG1bB0g>!`f)>5_KOkr(1r{m}-G>TEtSjGS;dMY!YBGqn(YflVUAiDCZJ} zGlJ^R_9>yM-y9cgzld{oO~-HLFXvnPlPfk*)i-{sa(ga@GS<@i-q4u&-6^4J!Q z-U*U}tX>zRWAdmXKp-R)H#_TywaC{awZb4^&}jtxT7mai8gt|#gfuh?U9rS21s;=h z1H$4RVx$Zm(?bK{MCt=5m3aa?EG@~m8eKq@PVS73e(4?I66>ITXRW4q=+*m*do__E zsp=ArbyRXt7Eir82V2#tdn#(_P&|Y>Nutg4aWgsPpFP26lx|Tp0JSILY z6sK2VBv~|#=`~dJ=t+3W3SdM0!y8w29kK{>=O-av?4&ngS z?cKYej9^)H$2TQGjj}9U)I{>DKswf>Fm>jb1C0uf?%+jb`Qv!N@mrN#yk<0ISVN6BJW6?%FG(- zlhr})Axug=4FzxmnV!HzAD%7ZompVm7B&^TwTtueg4D2q>Qo@jua7w{{Af}UEX4Oi zH0`a$YxSw7wFen*MBCkH{Eih133o|1duqZ>CG4exk1Gr6^o(IP6$VU~@dPH+x~$<- zQqeYYVT(!;xYJ=9_50x@RkU>1<9XeR7Jwq;l6hJAT9(GubqN^)G1Smr%0yIj@P^k8 z-@ZfKF5PRXoE*h2^L+&_t?tvYW1`p*aI6pyuU!NN zUPZw2}M?Hto)H7Hv-y%IyFA}?ikvOPjub}698Ml_2z`#Hk?K&rwL#d2_yrd?wb zw$ax8eM&}Vrbd59R+R%D%25HSO@eNklHjUkR-D{yO_x=Y!nCHpKQCeGzU98!*cQmy z27opGEyz^RN2eqqFhRk!WXqs`x0z^a^}Jg`F*eT&APxtLYYQNI_U=;zw=ceV_1ZG= z(d9*^=r=`>dYP5b0U zv6sO>g&D9hJd+&BQ2v<6aJ@u1&vfT3uOdO%&VYIs=CM-1IPU5KG59$gO?#of&mcW# zHB{%g7-Wx;<}ZBh^fEq#%m+tF)bAsRY-~dLm*B**LyIeMVa`1g2g`qaoib$d4OL!yKKfO>G}9%YwSdg<1Gb(7#X6F(&x z`Jk*K#mYn$TkrmbTN!yzpu&S_Kc+$j*yq~(<|n23O#ZjO$(2&bUNkb99&@&$@zbQ) zW)50|6$Enex)27LTB8qz4%Xmmvb&5^K0r(sTxW{|{Z=$HzYu-hfhe_<Pd!V$Q32}j}rkmOW5Z}JAW%?B}WYx zgMqVQ%kylh<0hUod*gOyD@S!x?$gYKE%uVBfz%Ga@57YyusDR8x0V@5-cWC594*av(?*&Z)QP1#FWDO~L03Nn0>;=Yd;Nm=Bb ze+mw<^DczqO`wc|kW|^WAh;fET7F}rrIW#~p5FMRn-p3QPwnQe)0F>J{WXIk^3yhC zkS-T;jSFpq8dIR_#|cg^*@B25P{y?fZ(xP(P^)u zRq!A5w~IBHm>;$0|HjG83l%eNTx3puS-)6)-(>a4vNDkZ2gZu5w0UIg~9p_}|+Ph%mzJv1p zZsGWTGkQHcaR8vmcBc2P9)b`pIAZok)L*)F_!!lYtVg4{E1wp5D^h&b*>~vl|AEm< zo6E}`T1lFR^c&Y03}$2h!7m2;5}M)rpWU>n-=m!Q&)@Jq-i0+S-;fP2;B2kCf% zgPWj#wzy$GrZuvH`~L$zs6jW&@%{07{kXkwMK*Z&1s^E${Tz(`VTcWd`=9l6`s%H7 zsqcX6TunNew=NY!jMHxm2&J@Ampx6D*R)je_;#thdHw%!Oyl=i>u2ySC*~_ZWTQ)O-R%#YVPm zB^jxx3O84Jd2|qEjsqA;4DL)i@WcdCvgAbW+z zU0XSOB@niOQ9^xEkf>b=LCcK%r-I>oI_?SwWLxD^7S-~(xymA(Ou9@-_G6W3r8sl! z(v#Elw4bOT0pxM08R)~*9A2xlP{>>hAL(uYD>_o)2hM1SSW}DzRF=62EB!@ z$JXw5TsSt2iS*W3{x25LxDJKw;1u3xr_`t1WJjfjU$#b{-+#Q0lklS_FHHs%n9EPS z?-<|=p_*Q}C(IoDGnita)NLo6`$jQ<%8x}c6>$DlkxW#Jb#8DG1Y3B@MfNhF`Hhdt zviFrp@vKGul9j0N#7ak$DZ%&Tc!-sJ8zAULo+O2&Lh%t;x(&wu>`L}m@XufcR1WH7 zu!91n4XGkV=tG?FmWhcYLBJ+q#ouCQ50ZO;pwJWoy*f90=t96)^pc#Cf>66>67yoF zgwVzwVP(@f#Df)lQj$Rx7S{f5Cgei!Vj~32CId*`UkJGx<{r>(da25*EC(sd;}{mx zN%Py7Zop6GmO9IT+#H5u4s1u&&?TyUZ0~8Xb@Z8*$hI1o?8x%tzk@u?I`nmDBR@!~ zV|c*MU=i3ry)x9Ok6lPP35UWk^R!`KAVlY*=9{4`opKRKf?THQn*P$;LXe6f+ zXJ2)Q9Ct|Oew^aqJ>uFx9NGT9)}o~oG%8juEfOnRTM-DIreE8Bdb*7x9EAA|$oNd| zkc3P%oi-Q1q60(E`?KsDS%1*J+G4Wcl2|! z$otGp94Hx44gJR`#_c2cEHcy;6ow;e31w!&5x2P@U8UG^%aXGSoX6g}d)qJ3F9Nhu zt;)IVsN^OFd3Bfq*gc2K;o2TDs*Z;^IwSBM3#km)rS&8rqk#CMikdTnF$aPw1FWHs z`5(9Eh0or5HI$T5}_Za2c22DlKuF+KYH>6{h4 DTc17M=B;_ss+#*>?h^1pE(g{yxXDpjBczuh&O34yP#g}a<<^znmO^fr+p+NaeGZfMlX z)w2sU>T7RGpuN+Wh-M3kYN&gQ{oEi#P?M+QI8C-oi%jWqx=G<07p6t$&XP_RjOqiT zqI0s+W#2HkO{`}y5=i^Ei#caIc3E2iD5pdQ$*|4*c z$45?~`9i4|kd5m@ckAS`8ETHafINzzXfA-1fx#9PRB||m6i}P?PKhEwz#lxCyq;G1 z!N+g)_6;aB%gN6vU&pTr#>0@>#KY@-@?!`$%e8_z2eC{ppN$?u_Ne$?Z2*_|NhZ5tW!5F7>*zUd~%#yV}0vo@rlB&5;nSTfA`= z$6Qt_5#3E(R$FSv&w&h}QYeFXOontiMb;wYj#DA39_;!nrQEY(2xxM4hR146o&lW> zxZ(&%8B~~v;<7k57dMLGcP z)S+2>#UfcMZm3}nTo3TxW`P*k8LcS!%RN%c<1yU8F!>%^a~ot{jE?roDkQ#dfp7s{ntxu~XeFfj z=9!aJUVOa(f9Hwm6I05a2k%}9qhb}_K%St@SfrLtp`--Lb!v;Bt=%ELwCuZjbJ6m$ zCZ)LvDJdi}_UGz3lp$cdp`MpZ1Dl}d>bekpKYv{rVJVZGEn$s^0>iE}O^th~J(qSS z^Xi|=J?I5%W+qQ-RjErjwv+BJ#s>g1qgP>NwS-(8;bRv9@u8ZP8fPsgy)3Cs9E zN&$w1&w(6tZ4$!l*%7QH4JvNa8vSYLU}z{w#^RGry^r0=oavbZXhQ_PRQ@sn&RKtJ zO6c<2HyTV;KXgv|!+^D(?u~O-v|iJ)(PzLRBMAwiB9|-6LpopQ_l^f5sB`rnR3$6p ze*@HFVq*N?$oa$CQgH|E2)!q2uW-z1b_x7LVE}8OjvL0d0}*G)l$|xq2v4J|ADCw%ngcZ6e#K7a0$2vpa(!dV?2wLmzp4TfXmWn;>Sn zUJf6vTid|~k#uYX8TI$izd$XwnUEeT-0hU!$yZvF*QucoN3^@H*X}I$wUW5s+p60b zF4|Q3{!uK@O?12ayOG;@ZE&=m102e2gTXeq_V;S3*B+E$*}n0bFWh5PERu5wJvQ1y z*PoNNzU^k`06I#0e7m^1j0yX&v5jbQ}J z3T+*9xE;SP3#$wV$ljli=a-GTQAR{Ig7js9OmWcw_TwHZLCtmr)^6V4^QznHYrDZR zpR@Kha?srhx@_pWdNBkybWyM~VOtPd;t?O>QWA~fg#HiPn-9!KQ)VbhdH3qZKjgT} zT8aF*0rj)g1Jz;zI`fQ%F+tf=L4ouA`Nd2U`Gvk>O(}YNk>162xUGmTt(%d}7Gfa= z^Dv||QeN$;tOSiDmsD?=H;Sautr4(UVyw%!)U-6WJ`#~x*ItKrUp{jG)bzIRu-790 zNKqQ4l|lvVwks02f{wg(%>+(b)vAZz14Gf*l3WI&N}LY{$*Pmafa!o=m@0s2NZ4#J zSKhWaJ+q5iTeUnhUnd;lyI@)(s?bJ&q$_VH+!nUCUey*g)|{E{SV3+!yX3KW`ywZ% zSY%d^W{wN=xflH`N+$L2z~@2K1vFEZwR>*r?Nv_onQnxurPV37-cF1`;-(@%RwYoWh4-Km0CW*?g@A}WH|ZZw zf=^k84Grq3>r1$>^(Zw47if&%>u5oE@XreCMP?(S7&BqFqH~j~^pwEFp&<(GzLb7x zEe*TIwEbIkPa;ua?tIP8r4b=jVnwFCz!pjTA_STP#iikSA7R$Y*9hDyL0&3Zv#{_?xb?E_Hsh8HOqZdNZq$D)*h8J-T!StQbc+kY z<0!u*Q@*7Q<1?!TLT{|Ab_Vw|O#SY$3zZWtO@)6AD_F)R!)NY3J*jq~tQ~z0@w~Qg zF&A2OAvAAQI-cuhPqbeRsJk*VQ?YEzy?V7*co=1tpm)(ecdEV-aU4;6&ZV>P090eZ ze=x8GqSH-1Mqc+VNFJ+Bh%$FPb3lSTK2gF%iag$JsLV34r!tikjDBvDBE6JpjXblC z2hp;70CgONMV-oMux^sek*U^ZdQj8iw3YBD(e7?6;Wd^hJyLQ&%A6+YAG(4m631;*5g^E|Rhr~{ng zKX$%7T_D(CFOqlCK1d7`h#Cc?v=WFw5J>D}WU=M*M0lz55Jcs6u>GMd{W(H|}+0)G83x6_JIcQHijehPJJCq#EYpSHerpKDfIvWJtNg@AP5a@)rMO^BS=L z=a*#-_|j;CfodkIX6#IT4d@0?4z--4CLEjzB^ju^9|#POg`ksWnDOSRxm0YE?QdQo z=k5!P$Rm}Wf&SprH#nA6z+ z`{@^gE8z{6&oh^K&{WhB-&6*(%VlS08B34p@WUT7^nQ6Bu|0foQjZ^TAG**k&l+JY z;RzdH7!m!$z$%4u8+K1WHTCqgwrTjRTg%U0Rx1o8yJ6E6hd0MPfiH;JAaxod zCJqD3BE!xkw6Xe|aPodule^XI0TZ?PVCHFMo~Ocdn74RSVTXBmU$7U8Vc)%$U=nQD zfUC1ewiSdp))QL!BaD6g&-lP~L^Km+cn!}FF9rE50;p%EW*IGwXLYr6G$ac=!nh4Fjs*Sln%>~V2CVv{XTXXAj z7w>=_NEP>;>#6I>@9v_>@D*0~9{$|Swmv*OTFj*4*Gc9^Ua0#BU zBy3Kgaapub$-AN_WFJT-o)9HnBb`m|^=kOk)KG++t;;hMV&_U5XyLL*r5fM~S&E4JKSX#R#b*)Qf9Rr42@t)wiV>F~Q}v&r5TBl!RNN)YRW_Ppqaq zH{Y)j<>q+rXEWNqPPt5_86ava`)OEF^3fU3*|MK;LDHjrMlViL>|n>}t`ZJ=@D<5` zQzMCihlg>>*nlW8wzn|%@ZM)$Fqb7r-=a3?a(d8p(kyGRW)L#~anh{~(y8WWk>)d> zNFagWL+~es|K%f_#2O7|twW7DhlmR#{6*ECE|xo8_b02i%M8;pgvbxOXhXq;kkn=u z!GJ!kH}k_v1Jl=2cYC_!JJjG7XaxK-(pz0FzV1$42n1%{NF30N5~zSW7Ub~8UsH&~ zcdI%dJK`VD!sP_SwbO<4M6v&3X){{|)v?Y;iT`SzS){be2X*?nbSSo9QD>l(!fUA$ zX+fzvRg3j@j+pQw4e6s8kG3B^tFCLGgv2t!SpkvzQ$Oc<9Ks8Sm4YVipE;~&^F2X%_&C1toZ>oG5r4Z>rP zlY1IKghG;Z>D4IOEn%092H;uO9JXj?Td_0q17tJnh)x+h#3=&nC*z~AR!uo-pMCRw zKXWwUBg*ig$XWq{2lBFR)poT6oR9!b#^$Se0Jo^PD_`I zZU1H=rfctkX0dFf4ZCm?RszNsG&!v^;g(G~UXVZ?M3w^5aDkeTh3hn-8R2r+Tvr8U zJPruXNv;BS1+@ZoP~rtR9SwP?zfh9(LWF}%bRpD$)B%<9H$oWuddD(-%?F+P)CF(x&V(!Q`yl4Zjh4*oV|R1DfoVpY5EN z{2cj_<#z*xVw7C>*}h2HtaOfLma-THiRgo}V-Zfm*S7GzWuEeu>QzT^vzUfpZ;32* z#>L5A$IWk6d04+BkPX6D3q{|2pj<(PQ^s^l35zvP8p(q%_SDk(gXh2Ci-iq%_JgF> zg(VXH-C}x~SRgMjP}vkDfpu^kVHlf@>SXEWT1w9egAkW%HZ7X%aHUIwb(ADTlhNEr z2d~VN<4+;MO@3}~5ut_SqWYqwsvPGlHEXK#82v4!oorLG<*i&owngnRCzU|Hm37A)BJiX`ISs%k+H z+=k;=E(*o#4(dm_AETBx+LlS_Ji0n}rbp@F9hnq)?RSV5O=0p7Pp-QdhFifiZ} zATquY;$I7)Z^RM40nLTHa!`qQ-5YQ2dcxDDBUf)tPJ379oh@^-Y**XAfa7|l@(GXh znhz5n9L1Ra*k>p?#Iw-bXDnO|!aXM^Wa3RyhZHz05Mtx87alD)N(8zujgz0=!1}y& z{p40{tvEPoKcdY(Fd9bwjf~j2MLR+bki88^)hf zjHSst4B%tOwbl&9+ZUeQpT6&{ibFN!YQHrnIK6!mgTnGa!=nlAPf0nurx=z^zfkVn zAO9khOx{mp2_?4l*4@CR#)iFfoQjtsI4&=z+4}T|^!97IkICH^u%sVPPd1ylKzm3J zEVtoG&0(!PM(Buv(acqYuhj0P#4q!jOS*qrMLr&b(+<&&yeN5D6jIUmh3{J+bn2Zn zO+JUSW8`#N_k53|F*i!r0ov6~)|Z7!KSxM@EOu9XsWhSTXK!{$vB4`1l>6 z=qfN2HviKI#q!^bP>k&K|Nl1o{|in*)Fd8B7%)H$z51uo$)&u;y9M>kfjIzfGtp#Ew!(8o*l6H9iaWZskwdKZ9ERmPJ$S^ z4h}qCrR(Zvq^Og{Gof?%Y<%BQf~2#Ne5#zWVbm(V-wf)luz~mO9oRs$*?hherablq zqtw5nX`6$u(la|26#SS2{!as$e8KR(-`4GQYM8wlk$>#$p+fFQ?_PPx`t1n;Kd#-+ z=ktn$)WuU__n-O4zq!SaH25-1-RD`??1-DLKX2kIZs9qfk5|f7&R;&6DNU1)dDTlU zsNXMkNvx*2)q^`fx!=5B>o1I1pKlv$2ooenKaeaUY$yC|L8h1uFf~8 zIO?KgBoh=zEGW_POjO33<40pD8O>DTv9y@5>_iqZo#_MGj1e4;4E9V(8cp%0e4d%= zN^1?4H6JPtazxvjnB>3kyzJ~o7<7rJ=Idsl{Bv`hk`kJ3;eJcV{w?5rI5$hWr2LkU zq0)`*vzQZD0N85L;{#^3jcg>;-c(9|bh>L!U06msPgv6B_LAwg9Iw9)FSoeMadLWU zGlKYSfxbn3-(ID5ug+~HO%@IR6+0b4OixP%{Dd0EnmhD14zCkOG@?Kc(MR7$rF`y}M=9xU*xMHze(UXra9( zt?(8SN1NBa-P*Pa9b3d~Rf>foriynTGwGPmOHFeadb8HfT&RJ>8fLtIbEuVEm-$pS zkgSg}4|~kd5oha^5{3V`A4AJ~Kk+9Y`t$MJ6iYN{ebw_qAy-cHlRx|tJ`O|zl~K_~ z`6xyr2vc!Uxd^ypl}qb-7kOOqo-o;^y2i{%^>)BzKp2kKTD3RS0su&qJduiOhmN$v zzhAU$?rqaLbZnwjVake%KT|E^D+_92HCB#lwHXqzoGrH|aoqA=CJ=%Smam50rs1}vHf zxwDa)$cLo6*v+3dIa?NS#$=G|#}5T&cp{_A{wUll!3Ql0s;tl6@dqLr;>SmzM|4JC zAXi}5>^ezP1Ye<0?vA02qU*3dHn>pDHK*g)0@Z-QVH?T_-tG}lWdo8WlYamblp%u# z2M%1_Dr2=}bf6Svl`jQ%pB6E#gWAcnP=ia0 ztMzH5qE18$SPYk5bpvYmN?c6H=T+Mi6c7ybQ7gg2DNY^2Cih|rg`qlbZ7v%%=^`e) z|Ayz&?xy@!c}N}?r;lxcF`s3!hc=xY^Z!kQntY)HYAb&5q`0GU@KX3@|uM0qg&aiG-;bkNqDlVkd?fQ(W$$fxT3 z)C5IUrK0iD*4bsd3NriH0=$Q_byxlH`8%YXUysrS%SAP*%p%h z7?}zXWKV;;arz#iba$%ucwYMtBQ=;<$Rwl+p@v|;zC;VTnLd8p2;f|}L1UF#tY@gf zzH}&+eKLwkvJZprR@D!!0zNV*qi*FGDLG&(@v^4|VuUfyeUy#LR`4nlcCZev(KiS# zzU7-HlBlT-Pyx|Jgp#efCvGKJKx>*`$YLb(^toh%CwVWIz;jY>kAbD)S{U$%)a zoQOS1Vvds7Dv(t~I>(Ep3e+DLB5+IeBfxP;C&xe|zilloB==}f_76w=)>X~pTiHJ> zFvT34r)j}*3mQraz}+B>G*Hf?E1|chbVDetaUn??@vK(=SS(+y`f<8iQRw$hv&46q zIxAqC;HuV{u(jWIBB;D}j@f>;O*4{ueKYh*@0V z)I{UP3Eo|D1U;GDV#jrk;ic9MUOBz}6mJeMK6o%6WKOOTVZoQD8?cV#1@W$BCeN+}Qq(MH5`p<^>l0G&+ob{*AXmG!1A4dbe)Qa<5rD2}CPUV;*eW_?-86*+C3iu7BB z>=mf&(VimwtU>_T<3Q-F#;5BJo3|c`jLFa}gXDrw0DVdbJ&xtex;%=`xuy6$S!r1m zM6kqu?ktAK6Q>oPs^IinU|FETl6^aNsi4fu3lR9=;Z^8gK#tAo%hm|0^E2HDC4^m_ zM6xGtl^2C@ckoU98)O%_nzgw%P!?y~zs^Al3Kcg-$!>#NTT1%J+!k6Z(c`V0l1Ds; zJ(8tH%)F5;MV-WEIi^DG<8>raaRMohwyC?MP)*KKFb=sO+8NH8syubL1_WowyJ=wx zD{}M@M}5>U0E>4hGZBA@X3k>04~V3-c?o#0m4j?}O;HSVU`8&sb70sfAOb^|%NqbW zh?i%_8{l9SYn4^6Tzy>>Pn@vVbCl&lNgn}sVLMpfwsX*|H{e;b*>R!X%EA+D-X%Ae zRH2{*tg*u9V04Zr$nshf=qvLLf9XLf(5=vQN=~yjBCeriP6g6dOti^s6lqlOyUbr* z2&qbbe^Qg|)>%eN;^U8&eN*-c{*YePDe3Y(6o`Rt4o7C#thO@brYtcZ+iEe&89%H9d{D$tJFoIFy_f-_iB-vxXM z+{yzEb8`sscpD29Jb9Q?+gPXCR(R8=%H35v;>KUG)`fNo1Lxt``&3c<{A?fn8my)m zyI(8!>^leuklYNzToEzz?DaY=*8_n$Y-|y%7I{H`Tx|rX?DaCcOX1Hp}Ya-?E3(OFoK9fjcHkM3y8X? z9dl|Ljn3Uf8Dm2qE97jY(w|mPk_JU{;RbPhF`P-H_<2T}MiR_Y$l>*+1?Wxe*mceJ zeWrhZvhi84n58^D8s%&^=hZ|eu{Ob)zTbVW$WY*1tER|ZT$lP{D)m;~W88FpFXOrC zg(-c!n^sfwDJycOLUbTn5?2d%Ag1z_HOoFVDXvQHP1b?M@_Iyhw+6XhWoUdnG`8xB zmFB)WsjOGO`2DgAKd`+?zm_j*73=7C&8THZ7}(BmBqUJV+aZtDoS7{I zNXYOj{{WGi_vL9h%;fA(cXh0$EFL?6QpFfDM{Cl>h@pD1b}a;*i|K!hYT#Bw$&N|V zy*tfZRwrd`8|Fqq0qS{vy=K>%GlkJ3Qr7fOyL4WZc2#!o8}IUEhWzX2=1le2J>m3i zQ;B{tjgwvdj5Zs_6`WpCL;hAkv2V>03?wM-KMZ@E2#A0*AjMN}BQSO-7#TKcG2`p9 z?k#YYa96qFk(>)a^EEUFIbu6Kj#xUd4O;x^qg)aZnY*w%bNDI`-idupp;c!E*5XAB%G~}jRoORHsC^e|I zGhczgWmG~u#kL{sZWE(P zh>a1`q1-Xo2l$XHY*pQ|2|MrzVuld1Ms9IrN7`d!k<$`4^z-w2qMO57u8wSo0ob3V}~^1ot*6LUo9qhx7=KZ+B7%6PGmi#u9RQbU!o ze_cO2$Ku@yZfN;JO9Sp;L|~P{;`qaRk(pQr>tmnaABQZsq6T!^&=Z9vm<{M2SrF|L zOw*)@a;`&560yK0E~E~2v8{!zP|m*qbf6uDVSzzwZ_z$-Z%kKig{HRMYE|-_-dSCe zxLvRK8RQsya;BjtiSNu~eVa2U8{v0s`&q1F*=t+H=hDf>68(3oXkr4yeiw%KwE)=7 zKZ}UuH-3ib3A}lP6r85tz&ZXJQ$fo&q$`!Uv0FyB`B$nY4aKpCC38^s^O+%(#~TB8 zp`;JNI>zUF);{|_5-umxhP}EXM>2$OVB-pWYU3sSaIU@a3=krp-rG&JMC5JB_nHdWnaK&TkMg2i_#o*Z9E5G;GA<#e_)|0OMPsM>=|p{}&(#)_JDmqC zs}QxihHF`2Ni zAb@!|#$eTi&r2_v1JU=vsSK1GF_aoSt6f`riO?rAVCQ4j`=9xRvuB0blepEhS3q${ zVEwHSv}wAvSB-5j;+p^J-hox%uokT<;G{>08_jI_T8z(0%r9M--b{Veo}NUcd?cP6 zP%j06Lifg`qH{4V&Aq=960pn-n%grV;Hf@;BA^>8?f;D$Lp+v*$Iqd3pl@4x@|3s4 zL`LS#vpc~tTZQSLqjkB#CJLv9@R8Ig7t!Lh#m7^zoD%I`CiG5e^d@|VVh3_NjC4pZ zQ8n=9;-@VVefG47l4#YNuf6SM<@ew28&~uC5wjK0l|)!fqI7kkH#jP4QlG*BRhs%QBpv?}yxHV+TA5UAR zrhdro1AtIAjB7Lv==#=722Q-W+jMY5-#2kI0y`ifGkOF`weB-UEdDgSurl>L_oY7j z2)X~->~-eIZD(_U8CGNC+3xxWn1OBL6;Tw|qr;iLij4x_^>1CC5RhG`+Ezj2;09WmUyGUu#`9OkxY@=2r`TQ+|}acHI5hI2wE6n^r4(5qpP$?K+bF zpkA7cJpjGGb{nitHsIV|;2jVm#>}iVq*(=QarJhtmOYeYyO97VrMxv+=xsguy*2%i zQVl`xj4c1f-2e)7kASyo`BY`WX~e~Yr1cBg*8-8rC{6*yychJT6YrLA8Buf%it(di z7^IohBN^<@8|$U}dToJ8Ei2)B4}iI8JzuoF@Rh>M9ANb%!6e+-KFTh`yT~kcq!me9 z)db7XRKU-=kMz%5Q}1)W*-ei3&E9kt`)KmtDmZTD-miK&O#|769#8mV^LR0(;;Qb| zP2Bq^?9kb)%$`GfSu6)gC-BgUJx|#DQrpmZ-@glJ!+BA+MUUIFvL6DT*z4UN3@73#OS#{CETx4=-uW^aaJ2EXS z-eI$}uP)EonMTl4IWo2NC%O%6>OGnpT`*pH-Ut?1(FkF-nsy$*rB;zI_dUqoIN)CA z&BQwqyc}ZotEQYAx4EjiQR^!%_UzsC9n{GOR!lpmWDhDA2A6&23{T6eqBx5OOb3L- zS9?$Bl75kpvuR(|qtFjbR6Kb(adZ7WG9zZC?h^Bx3D^^k-V!X2>ui``6TV?+MvY9? zaUF(rUG5Y_Y{@dTpS@RVyZ1(9&t9xl_UUTz0rPc(?R5ai8?K)Xpr~^;J?9HUT2_|u z{s%()|8jz0>Kw*xsl=ZlD_u6A>!V9#3sv_z{I@AJ;AA(Gm8u7GnRT~+iPL&;zVl5R z*)6@lfr6~0X>BrXKu}RVI;0u2N*@fZUO1J&B`3y4)q}B%6=uC#bxEJ_Cz|2T*rJ#C zZJ)0V-1X<1=w6W`QTJXPIr856-8Rr(Q@mQv|-!uxvJE*Xe zo__!=pdoMvM}}7X(3E(Nly^Oyua8p&VU)FN6$=wzbc3&p6UFlVk|<3do#EacUjusw zJ61Z}8a@DlKq0$8klp zdwG3P;N20?J;bZ)(jK1OK`RYpo6Jk8ioJXNY7^0#j8?n-`kCxY(~C19M*Yp9C}awY zCa|LhiV<+wCdc^QY_7hRZ9WkSk|&yH({cCwoqZ%_By-?(@^vt)GQJZ5!PU=5MSe8Z3d)^(pudz;gO6pXfa0^OtyjQxvAgbm*oc~F6KCNnrD`z z#bsb5U=mW~b!F}ls4s8?6Va88SX>5;3fRk7f0-zGHSI}aYv0B(4dLdb0FTqu&tL{D z&I|P?5s{*`P6q}>-%we-KQFxRn@oYU^k916TpctMqsKO8XQVcT zQYZ*Vm<2>fEDQ|SLXKfrD>g>bJycpYEV)GTj3}$2)Q2eO?%lGqz@@J2wZ5fY1nyB0 zQOGB@sLc;t@z6=S=QEBbMj92ST12)!m^A-c4a~3WM(uu-L$9C^2 zin#Xo@`>&RT=o|_Fi5G;a;iVF1YWT;0Cv*{s(mDVn)8-qlAf6cE9uM!66! z;rwU4!J?arFILUvdf4P%d8bN3=T20@9l&OReIw05xtuUooZSS!qfD%mMTa@WfuM^? z$MjRlQP?E=?FK8IzatvP=04+vL zLkl~@kxL$};K5SQ6_Il;rJ);%1@n1?bBNTKN)CSvcp3$JNnj{GCER`$K}LH7Z!ED( znL@TH_)u%FCDsfMzwIAMWQk0W*@ zqp9L~9LUC~S;W3iGl}({Yk#LXezh2iXSaq0<@3y}4aBs0O2d4LE#ncW$=sufzI+m% zq^Z7f&}u_Y8*CrwQbHriK}YHU*Dt>m|pAW`$_8M zDNgwcehOV?633zGm6}}ft~~C&aJ02qKf}!ebSOhXUL$;)ec=~FtZ~8C2=02Tm=w(< z_nfLhbzxmVMU_0pO*sy43B~92X^v6K*8?FvaeaFstlgV^q zO(f@mbG9J%=%Tp7x{~1e&JIVsR{@dHK8Gx0lbuHR?JvseX-EzLCREC1DhJc8ub*#0 z730JcLf`3pN?3!cc?dio&?0=IU;Q~dM)pn|QjLA}y zK0sm57Qu(Mz&R@No*&@L&hT+t_HEOX`#qgQ086$C`P zPDwc68Z{dX*a+Oh-bulw&qXki*w8v?Q9H~cJn%yKM;iyS>5)valqAc4*Lw5C2ENyd z(Fv3*Ei4+-(efFo=~x6+K2{)lQTgYDPZH-PFPHi=1vGTjWLG8R@W08SBRfz4oK1^Y zZE+j=Rk`Hvl7O&vS^P)?4W^n%W6ZLk*oCym^w=U=PteVuuflUBiR!Vj&-xd9ue*RZ zK|&N7SV62h-)NXW8DgI52A8Rzumy2E<rAHr$tu`s>WEE}#a2V>d#&AjqEhHRZL*RaNz zLEqr7$hqMr_R%I+f&NSFvT=;-u^n#B&KI1b5mv7@&|cfF;5jp}N-Z$rp6wZ-7UC!k z9EYtKA|iLqEeu;MjOY{WNx?d zo`$|2v3Dm=025v@h7r;a15Erj#hrYYCuo-c8rEdefqo(e&%ewg#=AN`ui2>!icFTKqwk3SC-wM6ZS*K%Wn2Lt~TI$$0JYy_f+q3pI6-pI{7~nDvSs9A0FC`_WnTl)5abXLc<}8G@Ew2r)3W6@Va(uVmO^=Kp&;F ztvNNQpa;`LZilB`{@wJBEy89YY@pEIDT(8Snm7T#Dbd#b z+6Tz7gb(^#M3rS`cAuDxyE7aST}D;jrPwcJHM`0hLy@(W>L>HtL^QZyVXvB?lewV3 zD@|qM^Nr_KWn*&f`Qu#V+1|78UAwh?SvjfmlG+RCsP@~hKTWb#Ek6R}wxb8=bW8Cu z<#jrI^dHl`P1-wZ5Sg?q5^QF97nOrksE!CCYvFK2-9?UMdv=-aUk?_Loaf>~vz}(t zLjRrFe*&+J4#=G1`Q`WK>bT^ESQC;wE|GbyG zFTGlQL9BLM>Hjd;aT(B_Y7Y?g_iBk_)1SM}yV(l<m+=yrdi7W(hNp)OQVP)T!^Tnz2ZJYr zw-0m(-_VsF_Wzo=s&PyHf)W zx02N-{&I?y^ddZewNUxvryl3U?ibqVq2l?)HpS)6{i)E}KKX<1n+xm2^n%s*Yvv*LES16-Ok|44y+GG&o7}d~z=R9> z1T3m!((G)%<^1iMA^PEV^$5}mP3K4lC3RGYYC;0|heRQdII=&POenz~1;J+xDmyq? zO;#?^70%&m1E%ts9-qN@@9@*YgHFC~+Po;v4HOkKld5t8yxD>8CwE4(#aihAV>!L^ zM-k?h0htj{DvNVhhXsl>2$~GuJE;&uvYeayv}rbCg2DzZ57$|W{pVCEsaW!*3K_T7y@oNLQbNrAp5lv7 zFxH=|+w?l?iV;iaZ5&OPJTnb5!R~Tj-hQ;j!cnqjvGkk!V^LqX;X_9jLZ7ad@e(2A zyFgg5Sn%_nJ8Y~}wB(W)@=?u>=rGL z8n|yyXE3M7q7iyk9QyaB7L?vGV{*PGuO+YS_}TJ(;de!3Rk3bXb%Ha~l%*Tx$1gWo z>qKOJ{s0y)HZ+n;%LU+xNI6UBVK9_26{^;Qwm?!@)VnnVfdraLD}DH<{BfIi)Iv8y z*~1vwK-{C~~TBvaf&Tui8c|;oa5;1&_h<7E3F3O;l>|XQ;}-v;KPb(e$bg z9aaFdU_&t+ti<>!;Q?OtDX%bl>pOH(mGdtf)n3-OO65F3oHC0)uqv|K>I$sW`3SAM zp$BCjzWOwgHU8WYw4eVtE-WjZ zS$|RwUK9!3`G;T!3ndwZ;9=sN{XN%?Fc<%tnQw%EPU~Ousy&`{z~-h3mY2T@LranI zKmm)FicB=RY0EKR80&mM+f;;e_RM-dDX50e`yibj0i0Wr$Hti{q?Zwh1jAR;l+1Mz z##7oB<3)22LbI!@H@8y*la;tbKa@9p;!-|koam(Vz~_w09;gp#_989`6Er%iLo1)UIQu#e=7ZT`WB2Di_0D9;XI}A(&rQR({YV4;4x7s#vqh4h49KRuFf|a zOTVVr6Nqr7QyAK$UIUa?gM8U~h+i{uH4@gjI+I3uS(&v4|%9pt0< z_3sVL6NL;Dj?8}9pVnZ#T|=OlbjREG!oG?Dj{dPIBY$T-glKKxnzvqgDJl$kMan4& z-Fz;*AUkiH9$-NlDXM<8`$$w7lnSvn9!EVzNaRDcSu{73rEq9SbN^>)qNe*M70oTdv8Qz~v`4*it&LWckWN?HR-Wx+#Bs?l^O)dOg3JI&?rBOXhpC8prOFyyw| z)%O5xsk4-}E+L?+;TV&g!J8rHGI+lSBFj)lzT3yE#O4n72n&I!)0%}tgY|)}E@Pwl zr82oxa8D#KQH$_k^K?3aZlQV9I5!+LHQFW3OmmVns>#Mu5Db3)h|Wm@bJtRX*S&%zY^mvS{0O;oG}$-NOt~eXliw@NFjbXrtNKbY zu-=R*sqVcr-LzU|)aIO^^t~R8taQlIL*8kzEW1q&VifqUnXmdKQdO(9R*Xr8rOgaP ztSIja+Xwmc4fpLTnl914R)~E?~3i2vXloQD3b_QvViy5v=ShwS2)3#jW7arMit<#6*(AI%0Q08wXl{uohw8<6{4 zea&v|SRw7D`opXz@>B236bC8=bL2)cIY05!n&z_;%58I|*?pYbP?yi?_O!k}QoFUyY|U#Nsv5&P@aD0wU)nJTHPzC&GWxsTYGDyZKuq3y zV&fo425#r)zwd`-UwbsCD(Q%(y73Qk0tY=K8!utH-BTlEDcm-ixY!<&c+S@8uLl(B z{NNoH9dPN7>H#~W4=tPSj?A|zx==M58)JaF1-A{Rvc(15vtTiNDu3<0lFWuU=SRtj zE3rVq*P863rZZ+kv�JOdWQPyjVW?n}w-$;RV^>Kn4~Lg`iq*jIF1cVXs(VPQGHd zd-AS9^f|cPfpuE6U(?MIn!AMj0~q>;;tp(?SJTx}+;eBaP3j+ar=b1^uP%J+TgNH@ z$RYCz=>hNaA-az4`}Rm(1%)yf9`fPK`y1^x;Tkn;8(b2fLXiES zr5EJFeen+8dw01l0Gfnv4=v};o(Ti~&#S4b8xrg9?qi#P1Hr+WvVwdk^}_dgo0u&S zK?wHy=E512rttxl5>!^^=Gm`D68gHFO!uFX*j)wYJH`D`E&Tb`qv`H0>#LKp>Q;6d zg@+BQjwC6jPAMGk&WyAdx27&EhL?7GYka{gn;3TrguF}1$}84rV4dMy*H#VMvg_;Q zQ!i10d0e#c=l#=Rg4!QmLOW)*p=#-LXj|AXKHwwRJmI%De-gFMcgBBmmbLzivrO?H zoMrlFzu!GFJv__Ezd`x|i{uN)^s>Q>i3y#J>w7oCnqmAt9lC^rK4Wpu$BDJ|pBeNKpcAJ}nAn3dZWOLVL4Z&xf0L<|X7x zbIL#0Rc@tl0W?RxHKCXGgsa-MhA5mDOoi=dddX;{%zFEDTa^{kY?)O= zB%ZDKSB{MK>uKW)Dw48JxwXb|(7C&+A9|l!>z0T=Xx8uLe3n+LwY(BUDtQq;miE*4XT%*GfRf~i@)bCf0 zuM;G7pb9CTtnG!DKS3zb$qJ*OsM{*uUmk|3|QCCTda77f$vK#B!Q&l|?}l#+njl505MyK8G>c!ps{ zVz0}pVu888nK?FPrEH61Pl0di9!1QS=Kyrtlw?ITk+!x5?V&=6_Xx#W=z1!Ie-K2d zc72m31UwNpTsynhuK0{qd?C=VUf?N%SVb%ig^=q8GxK8dxV{S zO@O-4Fl)^}Gfbz;X=lCtyT)M36#Vj|<$f}>x1=>w{s9<_Lao!@es^!{{ z&-nTssJj=-Om)Jtu?ZS^TEO39{*S}I{;kC*-%7gX&TBuS&ab61rv=g9912@EmRM%S z$wwa@MnN@=WgyfVlQFoQWKIB5av9li+v41W(wtD=JYZ0Cwq{at%fpp#8W_kNE|bj3 zbqP6#NYZ)&Dkg)K!a*trzry=Hlv!1O_6U9!Q??=^{lh#1@)=AXAc+ju8jvEXa;)cG zn@DFIrBGVG<5aV1F!sX#i29p%AGnUOJdEyGlNwd;HM=IDrsiW)kcaz*Z{v7Z^@-*h zKXZCS1^Ty$!}%d1FBdbAeLyVV+jX)#3o~X@0d;ulQDq-!PVKBYk=MXRoVLL(kDt?8jw4p6UfIJT%24L zy*eE&yvcXEe3#OfU_2s^TV*89paJ=n+yRpa z;T~*q;dV+-cU|F}T6L}EuR&*!YL`>Rqx`ZZSheudD0~3G`VDsqvW$;GmoedsoHr0Y zGolhor|shC30+e}&y+}8YLd|zX~?i^s@8eQ+G8={vhk*zG*-ku#i~}aI-dh@viuak zRsm2qZSLw{>ztEqd{oisO2jnpMLVeT&$dNHfxUvMidfPTL>u?V zEY0e`Tv^3>=$YCmm%o$u;Fc0d4=R?cpodtd=JCt?kG1QvR4PmJfGE*N`y|z&gTGb&E&V521)8&) zilyzmQZp}W!r*@km0*r%Hvo;$Emd!WmL$^R-&}sHBJ9(kp>gCbXa4E&bY3txI~*zk z=>~C1o%OP@IoULgzf2?ZB#X3&l__OeJZ_L6vR{p*W?#&y#?7;`MaR-3DkHHn8J$NKB+0-NJ+MF7iP-lzC zW-x96LW->M1wSb>Yys{HI%y*hep~!C^m#~4IA9sc)v)F^r8+`9_`grBN6RZpXa8b3 z_r~Mxo0G5{SW$M5g#__CN$_V8DXCAwaz&TTBTMVU3hUHDkW z1Yq4&?P(0%)$O_KBb^>w?jkcjXS}1>e;kSPXsQi1RI+JcRF(S*uca|OKdW``#d8!c zqdC#xxw_!OS(X|&t}RZk-CcaCVNm(<>ttXs;%KY?wwD;M_2s(>{{cS@&r3F{-4Pj@ zJ;6ua5cYs{&URdJq6+c+bfr<4oniErK^yau(bevGKO}55dJ^?0-KKd(&z8<9GtDR) zJvW!oE+ski+@JWKn(zCx+?{Qto;Jc?g=M4x|4KG>n`6c*ypv!a(aJ&TU=3o4zQ3%ug~7bYgo|WJ&r>+32pFb7_4+TKtm+;<;?!QI`P$knShR(0O9f zwfSDDafSVH;mF^m!%yPaR%4y|>^%hMq)<-f_JiwtXwE9MM=3imDBzb0f=Y-5bJ-+yf?C~=wY)1)zlp8)GE;84CD7NlM@)A)CV0r?W z;`f8fb?f+FvmlqE(@hAE5|8?f%#J??F^VHeB>xayxV2>Ww~W0>CNR*c3Hsi$@;`wV z`l-@4-VbSE?rq0tY-@Ju{LZBz~ua48y%V=4x6>0%(!{5PI$hw zM``sy!4mjP>CaT$wt%AuyRYh@zp5J>1L|OAU>^pv@=)qJ9q;AXT2RY~Mr9o&v;PX= zppx<-cGket{W07>P~#hZ)rmJqX zUbv==+(+)td&O>I5b&dUk`~^dqQutFDmq5X%G{@}B3cvPeE6D@fdopyPIo(k!@4mq zAmi-c2&PrLPcD#^h-P=oR2AZnHPmjZ7&h zQlZ&<)7D(V6eiISdonO^v1#RjaksaJ<5I^A=$2rW)lU^DV*je2Z7n`g-21S z-XqkEG!&WNZ@lhGcrM%nopzqLIa?z*9A~$3aWD?#`u-%ZV=#iR6*uSthc}{>&8B0O zEbZ;H9UC&*H1aD&VKwG}sx*bf%EwjVLC*^Vm%W9nk*~#P1dSY2wmAF7)8L6=EF|LT&IuJ!xgwlBBwY9*-wo+LGMlpG}a4O{3dBjL~EU> z615@94L95)lwD86;UG@<)Nmz&*Aih1p6n%)BjEj;sJeQddW`ZViOoJLp)hnYNTdG3 zl18^0ZxvU_Yo%%omyo%iHUm94X#<;OaPt?Gkd7Q@o$PmWv)gy@g$^@|&HAMEuRiD) zI%{ifV0?Of7r6^MIi=AU)!))+AoNbJtb@lC6-HNb!74x|DY40)y$bpPr$A>oY4zH| z6vG3@9}tcG10ogeUsV=%7O8<;;A!juVSAG7}cP8ea&wF*c3VL$QESyISZckfgv4L)K zG&NSH`PZ^f{v|>VhK@+bINOV*;@d5QwkgQ!8~#Fw6cS7|^%iC3xK7k*e92?yt~h{2 z^GI8C6|b1J7ZC7&(OLlCNbN;z>{qH3V zV=>d8%a*>ahzM;7eLwFwSPAM+N5F$`bIZV_fxQnM97dPhKpv7(%(pQ=`{mVPW7&m-sl^96EWaS(XEEnZ5WN{u94OyFU$6FmDIm)m< zo}}uC8qW+G;`0bMi1;Cw1p#CJmWwOIHw$Opgv-vE6ZC6z|6f=N*9*SuI8jVlx3oK0Oq=Je%x@aYBn?jL^5c>F2Atd9C z__VcREkP%}=lP@Yhtp*fK4(9GFZT8c#puv?u6-=1c3};hs%87~8Anu+Rx`?}B7?+i z3fxDNFgt-%%ixWA)V-_q2XGkfZ^dodBPvWij!Xk-krtqqS#R*fo>+hH!a&(5kZE0LO!1WidUja=ezWH%HQ3to3B}V6AesG+jG7Xd|^2Bg}!FFCNs_y zdE}R1ou2N@gBwUSNKc@4N1d{(4%F!}ajl$qeVB)$%-@<$OIhtntlrjT>tkr+G`+OI z$5a@YR)5ry8OlRh^eV~q2d86LWV(A@cBhdDi7gr|flo9u6;6-m;s01D+;Y zoHMG9ywNqxg7-QTn&Op(mcI{cpt9xL$;lHE;IXmuO_tpY#}BBOiYqZV$`&A7a{6-i zWLvvZihXl*XlkSmPcnPN{T5Ja`D!NcGNTNyi)@P3-)9x zW@3aw*wK}@$M)f}7|@2DGQS5783AF;lhlzmQkZrP-DjuEKFY~WB9K#M84?9bCK#*L zKF}wg%1VJZ6;x!pzs2EdbUQnu3fIL`IGeyA*_~euwLLbP?X99)l?($I*T}U%p9kbvcv>c(G1x!o6V3L&1K#(-RkA=N+23Pw7mZH`8|S>SokvT3Zv*E zv#O;6#toetF%vAFhn<6hiW8%}(}}to{<1@aaN|fzI$8ge?)G3Q%FjXfa`d*st5{C9 z5QPAv)&;|GzG+4Hs`faDYMb^rSHw)n(kgn9fZl~@qg2wn%?=(>qLruawOL(QI9E07 zWQuC4{EM&nGon^9;b3%tLJ&Om`o%z8!3jgnM!G>krv2_C(`=xW=fZx=glTr>13bsQ zj?MSclKJrILM2tQVw+p{4!+{yd@Qx{^mSwB3-OBW$nt*))ttZnFME3CUo6c3eNVsi z-$V6M3mM^Pey?l5c5}AYoUkd%^E~gR?$eDLisYY!qg7_$lYD2|${!oaBoRJuiC+tL ziCH2a6n{l!B4Ha47e;FChG*_>b}}#YwoCZGmt++u1%GmORV|3FYebqPSf!of6(r`w2eLJ_-Bbw|m%krajhz$+ETVGr|@6g`|} zXr3j&vWb!#wuZRK!_!eO_GIB`WY$N5;^AETGE8F*V0A zPCZy!zYWG8eqw#|?Y_}FQSf(NRa5KuWt!r3W`9vuv`-TIe!DPDPc2)0{1XNfEHG^7 znyP($eK`RipBG#Ht%W;*k&6wfuopSkjbPU7TT{M&u9`A1FANlt6g@Jy4$Vx;(5w&N z2FV<~G~;l**gHx^7d11Aez4DmcLL`fn@~(l5Rdsr(%F^R9odF&|8WIuZBBNLfqvIr zJ?SH@l$;f<+^M@KL%(IGi23S0T^&w$au?PaEX*${VN44FY}L7`jD8+|B9C)Ie5x;S zD_m#5eym>%ktA!4>K*^QKB_RH`Ns66SO6=3l*P$4U=eQLjP7#r)~0;!cP_r8g9XT zD^OZ4BAC)kMQ5}n)~%H4DBA10d|Eu(N8dP5nq42dNh-$J6(rR=RN`*i3@8|_< z0tenEDACQ%N8<9j%w+gRWDsFw2#Yk|@wS@3gvb|`ZZGJ3{LsrbzK(K!v!{4N?)rX> zB=mYm?J1#^+%3E7?wUA0CK<|X(m|W)O;V|%MxJenE4zXx(kOGwyuINmy zmWz6?#d zYRB=z<}eUNekFgEwC#T=XYc5jwQ7R4ZRk9-ih`?~b2j#FiGgnmUN8`|BF!_>V3kOy zRy`OGU1%J0=ua(AmmkGATm7D7Mi`SM55yXv!C=ubu5E~R#%gjzR_%CsCaUy`U6J@@ zJlYK*$XfMV(_1@&zIruw8pTvZ!6NUp9j*FHbgdZt7C0U84t0KtmKa3TrU~hY^uV(I z-CrDs7&wK4#2T!mpowIiK=%(Qi>Vv12FoZSEa7vR$YN*dPn7}()J3`&9~de9HQ(4ot_SsIvrRet!${f8 zHQMHQMCtzQgd5_@rbz_*s?f)VaKJ5{h$c`0hCbXh@o$JtxaV2gOqphI13bE~a)t9T zdDI4&##uJIXFj?MYQYE7SGy3nlQ7)Rx3Ua>ENJyo&zJ^7B};wJ2ovx9`C#g~9K}lc z=i?>jGzt6q#nN5L(&1L!3EiDQK14ym0c`ockh-8%h&_MrpshGyoduu%qF5RnefZoQm6W?Gr)=9(;WeMp&0XAK8 zTg(M2@O`(g@)nAV${d7ys!85(mUOW0yGxp&l$-3@O4FA-C;`7ST7)~65eMGn#YKmiKKlQmq3n#43%JwsRS3wUdQ#gEy12v-QDsazlQgcH`3|+&$XzG;1$T zjnG(v&PqE8)*|+gUl{DaY=fp^tSxH(p*#jo!-0A+x7DuR@rymt!+haat6b+Y2D1O>00B%ELe>NwP5O&H@Vz zjiw0YejE%Lpy1;{4Nt~8l@hH_%+vQpZTIBkD>YOJn04B|?wv{sWf+^1r+R4&Z3|!I zoUBj(4K9<0M&(#X?RWVK2FZXS^jDTt(}AI!<0J zS-kl@!xnS~bZ#U5?o-?BP6IxrP=ds@kyqYTEKH|hD+UxidFLsQEbYEsL#J_h@1#`- zE6CZ>k+jx*Hr5Ti&ur4T;{Yza%CpR?@*aF{R^m$lnj)B2J}P9mLKgnbdd@qn7FrcN z&hmL{?`JxVSJ|82IDkc=_sJY3rYMzaa=Fy|5^W%clS58?{(MjTWZASiVyWGRtwel4n2v-VC;g``iu;a@swtHL0@}k znoy2qEpIe94tGD@N^XN2yHC`i1OJ6-$8M?8=yX9QKQK?J1wY~DL_G%5Jq8}X0QV$B z?-?U^ZrVC$TDrDY4i+8jzsFaF&SA1wA7XoS@5|QjD_dDl&M@6#u5Dk~h7vlxL(4j1 z#4V{f?iO^ENsz8K>XshKbLz5nX@lD-l8^^gcFqim7!mV#o| ztPV!CK#IWjD45Gz(86R)W+wjNd|_-+u{42O`Poxx(?lL)Y|QM{`3P37Ri$Uz;$ChS zeNhzjF5*+s(4hWNnsNS00;4U-L+#*0w9`76JkcU8bny!XE3|0*9*qYC5eowb&naPA z1zgwg70U{KV0G39rF8?f%1CHP>i09&LfT?i3z?9X>|%Cd@_n(I87NXVe$gM<(ay`{ z6gKGiPbjXeY7e2JFWapJHCUQ4|Jug;#?Per@#S7bOPacOOmq8^W~Suja5b}Y&Fs?Y z(palKT?;P;DNM1SNWOiB$V6i1b;5{NRRsJ%@h>-Tl;}r^IEG(ngWFOt<-iRV(Sfw% z27bI9%SMo5p7HsZO3jxQvzpS+8*#H5%J6-%92#+r}$n<0`ZSUQxhU&MUkE`vP ziw64d?OblKE7>>pe=qC5)Td%9qS|2nR6zZ_!~48BkhUCL;LA*N{izDBU}Gk!!&L1TPHN#OAaD#2X>f5{q+PJ} z_AM3lW3;Ahub=XWQb|%K@6GQB)74}6ZvLnWN2`N z@6#hesvqxJo5LJwKeC_`pa*j&`eIHW9J}%o8es=$?MV6C!X?6iEqMBny}AB8+p_AJ zZ+ql=AY_~B*Zt`-Hy@;n_8(%v8VxCT;X{kzlG}4lF_aZ_K7!XbdPNHUZaho$njZS! z;C3nB%2iy$dta&ld75|hwKK7kn)}?vsKxL1Ue@tR_e7WWE5p?nCBkD*;`ybBK)>fS z#RKw&W-RMYgGzCnMFxG|O+|%?;jkG4eT{@hg28KoRvo#U&Y2}Zx;eb@zF)p!U!?)@ zcv}B>Yq3dR(~9fy-guS{R@M3Y@AgQTMN}f%@BZ_w;91(>TJ zQyyp$X2Nh#c+YrN!fJL#!l5CXiQ%Mbt;{FjzQuG_gACUZYxv)rKPy#j&9$rTn6a?Q zsVJ%iv=;X&b!(TViYJdDH*=6vqM`ey`FSd5ZwW%RSvc|GBXOlg0@9qja~ut7%V@3SqdnR(MIg1F zv*v9*(u+Hp*sRd@LZ2H{!CbzG6J=5#O0L_HotJ*a!fsbATp@iKjo{9jb$ufCU?4Jq zHZ!Pm-uVEkp#z~7;C7t7HxXwjNE&1bMAZ-GZ?UOv2*l$0FNz@`M-@D*EvEP~=>)*B z5&5@dI82$F3&rWb7pEY58tC$fRwL&1{!dMW0$hOjFZISlIuhOaEjGTXoE0tayAQ;O zeh;{Cq|PA3;3b#~bi;l70)etZ{G38@n`Tv~c{3CUp@4q?-rK9^&{;qr(r?PV(O;{J z0UxWD_RonNYT%PR&~$uZO6p8F+%+#`k(OwlERP}N5@P7v@5nkMz9>^q2QaYFvhEk6 z;*;hMtRp2TbCzH((0&})$Ov=zl%mMWsaCO}Bwg+d%V7x`KWaJc!k?i4)IZ6=8Ck}n zZo9zzNYa#LsoPAn)nv{19z>W{iY(-`oGsJ4QnWB32U7=3(_x@B0g~mnDcd^ z9MA!~utMg6L(#3SNxyIT=0rYiNlB^>OzZ0p0Bt(O?@H}NJ;AoOD`ybx`uR9=UWD_} zpv2AZ-i6M7kaCBp-UsiTo<~C^NuIs&FI68^C%?O@xsF*p#iZ_0o+7!OMAZ?Xy=&SF za?gaBNhEcoP?x8;VFrYo4v$snL)t!9A>?<`*__>Z8mWuZ`K}_nRctzuqkb_@*@Nse zR!kxwC>j#KI;g}I$&$fJ8wIh$mr)opZ=QuVBllV)v>x~4V`QTdY}OEFFg-?FfyK?2 zzL1aC#$xNm4a-zEQC{dmKQiKVRB%d46O^gP|NY>b6QmIu6o+0!04Fb8*0$B^Kmik! z3*7lUT@dqmVl;MVpopn2tdqESDo!?tH!G*moAC*Q%3OtzNmj`n)<3RuNleBJ6fRga z`m^aGl|H%4V%Kr@6u;)H1A^-HR>5m8yfTtFGp|Pm*3eJ%$qGXm<&pCh_)s;^i>P*v z{ua4U^w~wSll0|!@8hD3+l72xueTz>ly`!u`b3Mc@}%C3FKHzji;YcHoMP`KpIEs< zqM4g`gHqu7$884aH7@&yk1n?96>Uouk`!LA@J=Ww-Rbeu;)5VNjzX8HF*JSM;R;)F z#_$t?_7gTDFdQwUm>(W(bRLq_t9M@d*-c-Le_&olw-F3M#>yjKWwRjuA7)y`f6hb& zhykFuxeIRwCZ>wZSvs!d9JgSUy*U-q7NUo_GWafpqLo1(t%VS=8L`%-;6A1k>aO!j zv<_zmJ>VQDCCzsPo*+Y(Fsioo){d|yY(SrQY#V&=wH`WDxVJX=O0=KFs3|di zSdnOYHY-_Gq0aRB)pNcms@l_%u8~+mB;5N`Yr(Bd6X7uIh)5nR@LipeynC}B_lYg} zu0`VOkp=tkI(xa^`1xHE;WHyC&Tsj7v+!%igQ(CF<0Ib&;CpdeSfq>r~47;?${Y6-kat~xx?KFG5nAyvETpwnD|!b$f=0D@Zq zTVnwiyeVq$X}6J8=m1Cuwfm|Y6e4R*cL9$#ZERhwn|kI10~HY~ZK|4OwwZ&>DBdnb z+2%sI48}#Cx;nV%FE>ZdqH{Hj+B6KeR+@neXCphC%#(~}7@*G%!qLh=`x#1!eGui8 zbLy^Mhmp<}x!+l8;=@6x&upCPy3Pf3eSSg+{N-)5l?j6<5*Ur%Q4_c1JkQe%JcyzYhU9#1~8zKJeFq%Ana& zV?~Y+l^SdgLp^wf?dvIi)c{Pb2(Z0hb`J{z7e|SV$y&!v)Atla2Zo+1vZg5w5_>!q z_6nT9hl}$+pTjC63p{jFDtEk8iSHKUEz*y!(AYB2UMjA%ixY|*5(xI%&q+zA)6AQp zrSNvzd#vv^Ij-#$Sf54*xaMCgmHSzuRdL#37;OKFo=KzbxhCZcQEb_+_Jjo;A3PgEFp&^XI2I zo4A)_3qX*htvm?$e3%S>sbRhA>1Aad!p&=7E8WiZ*)fLxr_~N;8E^jopDWoJ|4-Es z=3oD_1iXYZQGL;Bvr{vQD1!dj=pRH2(+K9wezk?JLrUSwo;@^K(xdmMh;%%*69!IR z``=KvnX+3le)4PuHOu)6@~^qVYyde&D5hDzpUR!B!7UaBn8K(x~$pl z___O!Lc+9#*mwT!#!&k@F1@ObG)GqQ?-D0bk2cls>*ZoBoeDT) zih$(dNlpudA!M4U@Hm^~?sJ*WwQJu73HW#&AyT_|TuH3A_?OFBs>O2m^MG$PL}?M1=qi;yWjZWXJX4=z#HRZ6@Gw*nleCFftK5zZ`T zpW%8>R(wjFe)OYOKhv64?B%!|x8J&m9jayl*M2+WLeu6h!a@9~FFEUM&gq#6yr-!) z=o+Rlr@~b8H$S%P+9Du%9xb_FXx@Ixj$oNRPq8#vBSgt0rhOnvQUHM~AdIoovACf< zuyo#`^y%!+UJ(mrXMfF*x1kVmXy}Q3Pv~_?F_IsqI5s@Nb~+gzZ&qwnuEO2|?+GML z?EwzMpK#Z;GX7jc$7VhzXH4Y7R5xJ)4!!(ya($?tZ;zGP|L}F%vO&MDGB=As*&9-u z2hIT{`!oHq=N69Oihlfr^|`91M4-gMqfKySgD~JS=8?*53e;C#S^u4lS&MIQzWHRy^dX&P?!*A2db@yVgrxW zf^Ky8_Z$IP!;?X_S0`+Mu)UvTVsetl+38{QJHh4X&6Zrq&_Vl|W$ovK)japl?_A>C z)6O$uCwM+G_T>#NK}HbmR*)mz4)sLzYi!Bw3n#aL*_oFuBc}vSbfK)xZCT+< zd&6+@jsedwX&B>{1WeP2wfgw#ydJj_@91LCp;J1hz7=J09^o zVIw{*n%e3k1DH{j?MT*#vK8mT>r_95h~$e^Q)LycEAzxV6EOlrDXrG2yjp0#XIEQ#lHsCO`b9%Xk z?{;sXLbv@rBr{hsZ`7d-{MCZ5t03^k8m76WI%-zn-Tu{UGnSn07;jsSUhTezk2=_mLp12h^tgVR_tLD zCnx%qs~#SCW;EVnUg*v5c;?^YEiI~AzoI^?3b-P$k8`>tz|KQ~+EEVU3Ul7XVr}>F z0J`kPnrFOUp3BoIpfa54R=vb8fRz7eNv*m6Dc`8H=rM<^0tdyEfIawL$+0H)eM! zd9y0=G@VS`^ySA6K)k_MbHCVlc;kpRh>$Mm!ZxIIT$6fz zH`u33iS&FHETxtrt7p}!KyoS^C=mG3r3t+FCG&wNl3Br5&&s{;Qe)ih zNf<4uhfUHE*JACSC40!D+>;X4Jt>>3?0kpnI-XopyKr3#bP3edIwb>5({0Th%Z)x` z+!&enrmFNrlY7Mo8sFPR?H)@e)5Yrgqh@Rd8FL5zj`=Va=UU4+0Xg_;WE80x@Q)U# z&Z)WcQI+aj8Q~fsOf-xo-$(A@PQNB5MM_T)kz$4LWIqEF5QbGbc6h?>{Vi#CEw4H4 zg`Vg|Th&NWWk9B~bYs1^5?O3-YE@{OuPNy;r-bVnn`N7adJ~QygQ;?T-lqVlhKH3RJKLHW~YL-ry@_00{deETNzNX!hgEY)OWr`)Gm zr*WKsZPElux&%DExInEDyHfQ#U}w>DP|5N%ew{SmhWv?!XH3#)`?3o|+`0fqL;~*C z%W-d$MUAzWlhw80$qzf4ZuX~@ZW&hr8ytFWK4VfBm_{Y8P?x`iP|l&{(eFiti)n%}*+pdU z)H)&^<$5HyT}^HGcnqi7Y)@M_^HqZ_raqSPLQ_TzOFftDNh?mo(USt^|4?_M*X0SP z?h|YTC5oAB1Ob3jy0S6bOj)kBW!v-Qi2wq(^s)^f7B4GJrfKV+hU`Au>rOXTWMl2@ zfx2UconyMIzDO8HLgUSz%!G=_^R0WvlP5ldwS#~AkuJC&;{=8|JbUgMhl)PUe_%1# zmHeIiSu)FWfDKw+P@|b|Wb)LfwL$UOOQ4xa!e`EGJKkf{*E=BSClTMb+<)68mTRek zKK+naNQX^R^PVfl5c~SzfIvM#zl3SZ9kJ_5j;MLMW>Nen<&u&_$|7gX+-|#o+oDgj zyJy1d$G!ja&1!nfc>5Wua3amv{9r2xKH8|1zhpibiHN1pY}3-bgg(!+{8i-tW9%Gz zM1i&~TQ*MFwr$(CZQFIqwr$(CZQHh8eQr9PyiV?i_a}Dtni+GB$2I)Yw-?7)iS)P~ zsWt0Y6W8t5-8As-dB?b&lIGZrrWP+59@In6WXU0{l$z}~%}wN*$&OhT2l(NbX`K89 z_!3ptBsKa%U0Br4V#yh#A^~ZR-MR_8Ob^C5cF9$QCB+ID+LePHm%IeV9-9U~0M`yp zqIxcg6su~T^EmTQE3`Cch$iFfKlTzBsZw?@m560(qBk3pxmiT+*H(!V^wMt4%{tnn zjha3)!YO9M%=lziUV#L)Z{>N>K!<#HN`n)M;7y)Yz#I86VG;u^Ag&x-*P)cN_A^Bv zGA(c~MzV_*uZHF^>l~`lZIzg5y&^AIP4PJsVC)l9@xw!d3MYX_gXp#1ub%MSg}1;8 zx3D@~;L|LEQra2tI+?mUarwNN3nL5>2_kJz)RFcxWBcR5P@C3tXJHM4s!A~kVo14_ z4mU82xX~yr9ikrNV}X8ALyK#arEGY^=o|Lzk1Tp2BV%;jIU^S|36lLTFxva~AZlfo z8^kxVySY1aThq5p>#$;OeQ|3QyW-N+oz^iIl9-gLbWsFofthRB8g4e(7UqxUB;();JbfNK;DSoCX#=J?w)T!^n5vV zNx3}fuSmH!j|a=Ho4wd9)ui!$03@sz%vxTdSNqHN_70umUT?8h%&CmcSc#LTJh3sD z<-|>5WwV)xB97-io7~a7nl%DKws%uD;^a`3JSVT=dV&6&lFZO(_Lae_kySV4m<76W zcNEnII(a3i)ZK@|UP7(+DDd7AbJRN2d|=a*jgRXgCF8|zPhlRtfE%8gH!a}*C0en? z`I5GF`F@B01+}mx%>FM|2*dx5wPEMr_@C)^xAy-_x4(dO3R@-p_C@@p{jR{;JMp32 zHj`yc87jYgiT~m2$rCjdJ&?4tTP@E;V}nA9$CG$y9tiijUG6UTw9-y(-ru-+}A3+zM<~M8=URrM-bX0OJ)msn%Pu zMR(_`DBIuOVzfn)Rs9h(J-X_Q>MkhAYsVW2c9g{%A%+a<^BLDT9SSgtiPb@svkr_! z+X@eBDHQ!}vr+^;C%JQ+qwyruu~lF7K-AlNiWJg|W=)fND&xO_8EAPKYMIFlWhUz* zqq^A?Th)%qvf4YRt-d2QZIVcwJz*J^IBdg_rc>>f92yUOc173wA(d98K#*M&Z{Wxo z2UZz6BpRKwW4K`KADU?`l=A8k246VE42`0)A~OLd=qGl5pO1pgobkddJxAFa zDMT%YO*tp;=wb32Eg^}F=PW$Qw%U#9 znFjIzZEarn`E2(s)~m*=RJob`u0DoE1c0Z2Zjs)|VM5YFcc2-<2r1qag1Bgaxyo@b zFCYMqQ5e4v)Oe7Z$&ssO$`R-=#>UA!BrczQwtxQ4RLwVFat9@eKSG140@A*|c5jp& z$s>37+Eq}aHfWqAutB0!wb*SAh$G9hiBa}2z)-XjWfsml$`lzQWrTF-ku+P9Eo(rq zNc1FuX)v~kJ5TtmBk8Dk=9?~9eb}-VWytsBgp2Go1v0a;V*Mkx)q4GMA}tm0so5)# zZkNbsjEn_nk1E$QKE5HYRF!0v(*)NkCHJXkMWJz*rhesGZHy`^y~Zi;ZmWjhNR ztfH6>fZq~81SjwL)_}3t)F@&!n7jb4n*_NaEbvW}~Q~vKf)2kTB<`Voz%V=Q~Dxy<+^8LriT6 z!F`w7RTZUMA+NEK$tRV^fdvN|{vAmFjI-2z=@32V6hY-_IloABC>jE$gn(>5CZRZM zCAmxL?5LxA<^Zbe>fliZ`Wg$H?VfST7X&+MkI8+{b`lF4q-LLF>9S+%g-OzNv;Fh0jJriIM1!7V~vvUJ^@-+fc- zPepEcw6i|h;r%o?;W#$Jr~4H5nCFMHlF}lduxE=MF!_q$T-ZRY=~NO6^^S$et6|wf z4^}E7+7ZiwPtCX(gFKY`6iT?5d@5`4>#qLd27`tA`#pyh4MGGW4=qd~(>nzQZk-46 z8fizBL`XDhOL7yA2dHLA)?LXwfgPl=$#2MRtSh~1uOxZ^(}$9lqeo0*PNh-uDLn|X zg}{o!Mkf`UPEysS?ga%|1vG(h`srKFvs&nsZr`(~Uny(g5At??&S-%dA7p8FW! zs(Go7kJXHwI#HMNiH(*w{>HcW$eXt9W}HATo-;p8F5yq<*ucjqqAUa1DQFiI7Vl;9v`pADPV9BI4)C` zr=s03Fr~r@Z*fSjnEeyM)iwv~GwzxY2)yN?FL7gxO@ty(u_a*u=Zb{BbHZ(og4?ut znLs}&_!H0jHc-BLo|gc0=C1H>M7=J^#$I*Q=wP1qp92z#&5{Z}%2ue%Ud0{Q2E3?aSBkp3gVf!|W5m_MOb&-X zyDfPu-M>^(!USC?Z90tSHJl|iS)w_e`W@eS7myAh75#T%fs^WHAy-Bd4quq*?fkMV zpU%yy-2{ew!X$~xDTzaHQO9vj;_&du2~TlBAsp~>0rYTjKmQy>djOfJG)ME!QLL2_ z6EzX4QbNQ5TW5h*Os6W3xvW3ATut%I+Fq|N4}RGhV)8Y)bXRoq0NHA61gHm1MKlT@ zHnvrxCb3Rc#i%+}9Md>@L=$8SgNm7+q$ikY=n9JCj5T7Xj!hTYoiL?2L&4{}53Xgv zgnJ8-Em`o|Ll%!{ar}&lC8*>SvP>-x*A(j{lT*-|E=Hgg=xEc=Hth%0S?Kkjj^qYn zTqaI+M%r}6j^DHJf>X}W^;V+8%q{$6J{Wyw)Y2ZV%Npc^FH{MRf~ZJLC<=1=gK|++ zvAH@ULj`IwX-Fw?Cadz1exr-1)dam25)sUys)A$I`evNWsyqB&z{2)@UEm2CaBL}c zlOF@47BNy_$Pk~0%3~p-a4j_wlQqyW@I%9CX$<31%;B#nBPUo6e;!8Ry;B#YVXHu{ zD^J1p%Phq>q0HnQFmd8W9wqv%`gIb}C(6=GZ`g2Xu}=sAvU2Ewk8y41i^SHH71cCa z=%rq4ZJSLyO*n3TK^WMss)+!{2ZbUYE^t?Q96`+Y`n5-;w(R~XeUbKA# z-hYCjApg?c-Jd5_P+%lhh^}234IO90;ZiPf=;H6E0`#Jy0Y6c#LDCcA*yC6%Jbny97LA&E8NJGXzos;Dk{` z11r_xA>$2^Qg~LwO2y6$derd=9`nTmG3aqS7rlFPve?l8{lsbc==;hJ;~@x0h1QKK zInsF<@$FAj?g$jcmVzrs=t4~ssh41)O3={h^DH@6c4vEZRJ8xTQ6(SfT^)D+2kpzZ zh9Nj4kI1Yp-&?=!`$IP-yRdJ;L1)Q89&)I%6+2Dw`hzH27T? zk{-qic%T3zP-=<9{&J$xE-xLfmyqs}V80Ify&QTZ;B2L!+(1cSZLaSSLp2A2uK9d1 z{BB#9aBV!oenjdnM{q6kDAnq~a@z&eRem5SqNX$tbt6p=>m(vQD1Uem8(9{t| z|4IIms5!d!8Eo-QQDuXGT~UGauO>P^$rIo6nPFUgVx^ic%JtHf?@xAYe{Nrx ze}QF9prLe;MNk3>nsRRtm>i~pM9ytF(jqVlU8|;%fwgij=?Y8r5e1Cy8fYNwTr~KJ z95#AK?ecRz=}hp6^ZA+VtGl7uAck{^ke#}mM?=rf;S81@ezClvQfOfy&)@n2Aq<(7 z$e8xMecPDb6`woj*!6meZNk4aHK+OkGRPN_?g^Dpy|8bcV#WG2c`7#dxbp?g5F-rR zCyyM{NK?8xu?YHfyODpey2<+JKWTwrJeIiaJ?VAz)}OZ#RJLeYrV|yZN?=|~FvWmR zlo8=SO2Vjau>>j?sW%|B{$dqmGW%L=nC+h(^+y`vlr&kvW8Gk!x4S6bHqTNx$ zGb@X6b(t!JxW79SntH2p=%rQrT$nyH1KrgBJ;;+xMQMJ^l5h6xFC(|9>n|DM7AO5d z`mGGg2DW)2P{ei$11k^Sjri?d#5X%)&MgnRkFh6`XetsgVEF@7cnD91C7}QygPCR1XQDR!QPr?H}MyQV_Usd{t*1DlO|-}~g$@hCob zQh}eTd(-z0B}5opTXw<4N)FTCDRFc6(~JE8y}eIkBywk>vpp>K`5nO!i4|Xh@~YqV zch<35+oFnEhXUi2}u#1x{+X&59xVd zg%~5@S5f)>>^b&7R+oPgO^)m=um5&||F8HmW+r;Z|9OEoYmdhewIg(YQau4r7}%5H zpXv7*^|ktcn!e>FC_3F^pB(M7jYA{|kSb}V&YPD>N|3gOq0ynP?9T#Y3x9!wlfln~ z42KRr$G#2k9{%pK<^KJ4cso{e0;mT;*tl+3mZ~?hU;|yM6_*n(&E1g{uD#j)Kam}~0 za|x?s13LSX-r0P7vu*qL4$RlO0Y3QtyvF{;ZhCUiQ{Dp9&QW(rsR!R1;XUVeB#HBji!9Q=D((;+gn`^#=_g?5PY{gXS$2jAOm&k7(__wwho zDQM5)VUcOC^G|PM+oXfu{asGB)D?nOC;#`Y)lRH4Z5thdoryQz(QC01KsK1>J@dn* z`R@JlvCI9i$DZ@lN;1(-%|QrJ4WTQ{yEMr38wmojM&5c#@~F$6FS~cA%hG|W=8(>0 zAOxu&Z?8;vv~%(|HMFh*X0JK)t;=)(CP_W2*+$5M)?t@pY8;7_utR+$bAHxcc1gFZ zAZ+3w{MBdy2|FKVO3b^U+2Ml(goQa!4IfwA;%lo@*kJ!PZ^VzP_%e_#UJNM|ySg^u zR_&s%0qItkktj$o*I@*`R~8cSag#;)-i&UtPY*$zHhyba_Jkm96O(GGMRgDddjO88 zcxVz9FIWjRA^V(0iB88M?e{|^SJ1FI#=?WKvgS6u*p45jOQsnr23zexLdE9aq@CX; z)IBazO?d^OnzHo;GY5@IUuJ3zDlq2`zuOrAdxK15RtVopdhaBJ&}=6p2QnW)0uv|^ zL>@JA&owIK^b|FLSeQw$rwcD;xJv2uq3Z)o{)H&(P^bO$9^DF+Nv(5m1k*-ts}NB3 za}L_Av_ErMgaFyNQ_$vtk7OG&vG#qTB$Ail?0sBN`!k|!kizyX66Zs~OGwjEy!F`; z(a4li)>%VHBS`QXexwoTTC_Xq1rZP^ZDQ;P?`f~l&ki*Yl61TqUuKweO&H8SFd3I` z#p0Ya(fG8RBQW0Z=_#g@GOjZw8veL_3s(CuCre9g0hlbbPvkrV$+3ef1X4mqlU-8! zGmKg2AoQ{TueTZeNZP^?QDk|;2SfxfR@sR=&(?$hNz>VqA}su6b)X_++>V}PJAp3p zw)X&dd!DOGVSbnivt*czZibY!vkP#ugqnE8GrN`pNi0Zg!=Mp>y-RQi#J!YIWAg`p z8h{ZztqOxua}ZVQsRp5QaZT0bL7;78mGnc;k)h%!zv?j(Z~?rTNp_xB$mz>8UuELJ z-2I&yk(_C;ByM2p>jcG&N7)(YMGLNEyX#6`%PPL)uu}btWgq`@Vkh*dflw*+Q#q`dn&c18=-2C|JSEuCFPD?1d2 z4B$;BTEKhSWl%AY3Gxe*=b|v%exho)>d7&9=UsM~q^L2;mi#*QrDt#2hT6%R&n(p%AH72ZCl|y3Qst?3{XXh3v$}V7Z2j4edd0jAwrExk4L)bIXU>-(JNG*e3 zSi^?HqBF_jc`S#pv{gx=jVnd}j@b-&xlEq$&J>JSBjV7G_AKi$&m7JyJZG!=m5wMZ;h%a_*z z^7vZGvSILIaaI@NTRLOW<@dkk@v7ygDSX7Zz&&X%INk*<$@|voLtZT@-B=bIGB^f= zOL*b;%X(*AAK4%Tm!!83Z`n#Cv9@U+|IqxZC07|9S2n$*?#n*U_`_qAXGc$&of-c* z*an_H`A3umMSiIXJ#!8SYRKiRNhEwn6)2sn)#q&gUU#$;Z8VIoKyV$Prg=44!~iH4 z$oMl==q?%3<~x_SZPtFh;q<6!iKOZev#aDo$>_fb}04lJBo5CoGn8| zu!s#e7?v5joS=C);J?*C@Ax|0UOB5}2SHX|wtIiTub!5`BR%rm4YmM zU{md05q^iE?uAfA*h>o3#?WVUNT8WB23}xs;7Bre4x&l{QKc?Qkl%;7X}JZu0qMPF zkmotnt4H2mkhxot2Uw+r0Ep?4BK#!5tNHW3SzvmGHA^UA0ox1eNw!o}_}3T=DF|Tj zr>XGq{!h-l$|vGa!M6-VMLj%FC(9Fkn1RnakuY`=3_!ys(D0kyZ0i{bpaK=NoBD-W zP-j{kK~tuG(`@RE{__g?UN)3G$@#A<=I+t>Fi8MeX5#czv`n&vJ4Ss=tG~iGC%PA? zJQ*ex@jSh-t?H~(2lY!b35N58i%Dp1&q;d9?P)2Pz@RYviPFw^HN2in64Zp%X&Zd$oI ze&5QXG%f~h$r-rS;kdwl%_`;}^Py=-nbUeE=7MKz6X(joX{+O(>u%5`2lJg}+I_t= zHqQI;fCTijhLQv$C!vvQVyB>Hj-=!4Dy^HsZ((|(rd!``vwpOK1tvqGVHT-{pjOvX z%05PEdga2M+2Yf|z#W=K;EmGgM`7df0Cq9jIKfL^p&QMqqgjR{X)B7hl>PVd#D6K7RG>6fGi-+>O*k6W%wruOM z-^euQxPCK2V|JkQ$~YpVM6#>;0kCoLZRF_@RFOXI zvUM_9jc$APmz)~38+aHL>|t^#3D62)$khkB)u0EwH0t3D4p9Wwm~_$N^-I2n1&wQ0 zV+_zJ2)4@)k!-SjA7fMI3uuf)c<`V}f~Fy^)*MeR(bRlXECzt^a%{m@V0GWS;{-{afP`6(V%xdFkrwHg$|v23Y%uL+l_&V zo6UZ_!~$IA;W7`)o3M5se;M8zHnI3)H1>d8Oc~LvCaw`u{uT5%$4X(DEIXLHrrvn& za-8`@Gh^X)AYYi((eozqpwz{|R4vs^N2*FiwExizS^Jn^%gX*{gMG9Wl;WsDAO?RP z*<|NH#Qs=)EW~Xe5bbs#lAW_2ZFv+ox!S(q74aVKWx*TycixY?6DLQN8OLNsKa$Ez zPybKoZBt{ZjE4O{H#V!_kAC#$uwTD8@&jcrhB)QxfluDeD@^#FurJ~WxcaW`xO1hF zr?O^YtJIPxIUYAXisoXAP%|}ka~En2g+Y+mORjn6`4BjOmW1_(YOtcDU~5Y>E1MGI zd=`zU#F}N)3YFm03@G*WS!(WD!SJH$F5g%}D+KOJJ@#veR#&I7dc@-#Hhry#_UXaD zH9ZcV+VEDNQlsY*3qZs2?2Jo6iW1(|)o;>tnd>@}GKdATPL)eH888B|zj#+^VT3au zay7X3IqmvNQAr(F3noMHg;OG*KzO(~WW4fpSUOIy=8QGSS8mFDbpF_;Hxgu)WpdOq z;19}r1JDxJytk^6F1Op9p0^FBCou@`MVo7_IYkZMdp@Wad2)*h!4kaJI;GlxXi~$I z$7JHi-p&If6D%oYpbXI#g57o#+zWHT5a&0v-)dOsH z@dx^PQREF$5E&w}a}|d=F=)H7#mGA^##1Q6)tV7QmRbg>BSLYh*DaTeFIBr%&B`8zZsK za8_5YpuFTQVZ(HUqblT<1&htBHW`g)tW+hDAo0ifYvmOudW2Xz8ua5FO~6E-0Wwtp zto~w9?-sITud8$r^)7F^6-=1`Z(!r-)mS^NR~8IvdaG=2D*8ww9z}Y~c@vJ$Eb=7E z^DReOdnRCE)Bzg&0qB{xoR}`i6E6tGywxYs;$A;`N4|dG!bPwCOyOnjugcC!G@hax zgVV_g%q7CA4`B_D*{Z5$WVdMm83(D&T@-f9_3df$hJupyQ}EWQbDrjqz_WjUAmRQ% zM<($)iQ+8idYPd1z@VSk>~#%Nu~Cn?svC#&zD@%39?8gxe_nsmG*4^cg0OTBbB5prU>n z8)FpkgL{InlBOxtjo;%Oi>Es`9CM7b`Eh;+WO&YQjG+}9p z+n&Ex*1IOu>HFZN47yo<1Ln%z-~hqHWla%QcZHS$sRuZg}oQ5Pt!y%hw#-zQI*BsO*>ⅇN zjJZLn9XZ{GyY>7sO=GNJL1jO4`tSSFF9Qe8`U5fmc-!Fh-D;0}6LDHi-mL(IckWO8 zXlGlH}SAXcW6yKLBg1BjZ~?@wJ7C zhT)lgKQn6ImOrIEBeT0d4}7xSAGrT56!~Al(acN?{~wkxtle4jFBF;nM)?42e)k0k z00M3SG=r8iWuNP|MGy3^DI(RNUin0J`M4&QBm7PztCigu zCK+0MtvwIyE&2W3==wPyJ&*lcPezeKUcmkBo;9;TtNE6w9O-=Vbodkd&()#REMB{z zt>UXf`AxG>**o#2>#Jw;!=A)9D_Qv@3qs)IiGSjc2!0~K05AO;9mjaI$}M<`z}nrp zU;5f1yrm_O@sRD=bi26qFpuOi+6qsweE2bo_m>L;1yRrW0Ki(Vir)m2z##K|p4oXg z`N&4*w|D0{Gko?&hAFQwWy;lih$+(`Q{*ngmee~ff0+l)9JW1147 zO*lgz?$M!FQAJdwcUF>=a}6GOQQOB?!do?UR-E>vSh$wtNjZ*vy*KGya}M_%AC4(+ zhcf{Erklr6mTbc*op?VQjH(_xy;Kn86FgV4CLJ$3C&jzEL5Oe@<2y^FIA`K0u-K=P zc9lYX9YyrA|42n=R<%Bwg>o{;ZKgHnR)M4VG1Mj++Lo3xzd~aFl&B~EV<9h$Aqf-~ zW4%QkNlE6w_ER{x2t^fTgy8NMoE!YQuNpe$8b7@2B?JB`ia0VlYmB;{drgv7|N7b;dNiSq**+7#tEFz zc@?6Rjmf#ngp}NpCgcYx;(exHZgtjrlOz`frk=Z#)#a`I_wkfR&XYYV3Wg_wCF%tw zPHtnNe^4?zQk+!ZRT^pB>*$j9)KrvAiDU=-6bxP(a|_fAM}h)D0Z;=&5)aA9g_Mar zZ(ae$MMcDMJBt-D(`*2RW!lbqrQ4Qh`|4)3I^>eHZMS$Z5SLHrDpE9)Eh(xLR?X@(<}zRShSNSh*oL8|$@x%i z3>SrX>lgIi0~0H6K~L48=<7U;i7fXk87Bh+Z*?ttqKS2qjroWz)&V&^dcD=g&L$jjy)Mxb5jX zDfOmAroVbXbJp;#93|Kgd?i&HaBqVJHr{1-s>aGgD_ty7ZvQbv{EML(-B9XG8vzkJ}8(YS_92>@*V9-c) z(cKub1e3g6BLeOsoKmKrgVOHPhANXL3;t%WmOTO^6aGmu^XpTp5~icADhJldjrE3* zmdJE!B;BAa?*Pe|@S5X4;vQkD9G8`;eSp&;i$%+H3IXV>Kj%BnP@`SEFvMEAX&Qrb zI}QVD;mtY>%k)_v9Xh)q#{hX2hB}Kbx)QeA+bhtvZByKsB4}BDeMt=xI0$!)XVL^( z2rvv2{Q9Z}mn;l@e>xbMGDn+9=e5`_rVpy6E6saBC@e6dKYsg$9HtwK&UBN1hcEYk zo2bj2eDwy$YF|7!Mi^~#p)i&cvK-`wxeWZ8OeH9OKMerz)Uz@DBSpMswSCu}LDDJuqu*wZ z1VHe)l?_T}c+<&gcA=7)j#+L{0IR*8BjmyI?0_O^4!MD8p6pJ3L}YB+0%^h#J*JRT2gz9U06+bhxcxY@KwEOBM@k$S zPEJh#G!MV*bFwj7zwUW$YM{)}0ODjTV?ZBBJGtTBaU9S-EJG*u|1ChKnIQ!vYZUB~ zD$-*XLb89buWP)6E##~2udOqx5Wi5fs{}?p$*@!IG|9sDkj|jwlm(oUdXU>Ngeo@ME<*L$Yi^_u8b1%S6ztcp94;gv zU}6HoS!szsMMrqbOu)QPsOIM2QU)u(N|-m7qa_3MvGUPlB1An}jPQyNR;U$Tbq;lV zTqI03)m7nOkrQx_T3MI|xxE#Ti`ASEZ~q zPHik`=rtZ_Qih&KaLK0y1ZLDLgQF^oY*jQKpFqM2dd&!pM6ZB7wX3c`wgZ%Jl}l*! zLY$Y-zII;u-smbh*6cXfHsW}B&Ed};>Y{F?4uB1{HXm&q*l0>hNlu4`hnJW|`VB@K z)+^ewG$+$pp)!y{7gFZyv%8%;24b5D^OoCDM0h(Bj6a(1tj|h~*@BSxO{s346VgXbG->tSX^B{|%KjV0GflA~kxV08 z#)OtNhQ~{Ms$Po?SHqNgx!^3ZgV$xVKy0qwn4-#xf$JqmpVpW%h)lf#Ha-v~fL_+1 zlxW6XBWS|Vj^Dhf(#|y(C9%}=;}U!H4|Jd?hWD3A3$2;wq{Jdm*gT6c=){*inmttel0B zgMVVHR|L7S=q@t7Q55RL(JRT;EJ`k<;{xW1qcn~Z;eNS8=}mjX=o*;Z z1$9@+AeroW!ODuJmr^E@+@MrYxe!{eS8d;CEjfWfa(`SQ!S1H2bowJt^zmhC73JQu z76c4~*kc>f8Cq^!Z)Q#Q#gryx_>~~N0#3OdjjXu3C)3Ic)(fl-WSR@2)hV?I_O26e zqPWGhDD?KJAQmeRX%32`*;5vsP=57t_Bfj8#Ajvhp`l55p0>NvB$CuJsuGDPslu!|@mxvG(BcjSm0~-OW*WeEHUc45DBZabUV*IMUxl^;T2B7|$Q>XTN;1j{68* z7uE{8Wo6NoyapgxC<4P>A$$k|H7-Fy{?C5=^wl`lFK@mkH$Ej&j7Y)a*=eT%DS_|! zPK5p6YcDuot;!7KP74-&hnD@&2Ha*`R=n4KYjcYN&NUcN&a2UEov0rWmUGb<-!8B; z9iNg>>V|Q)81Ra~Z-i$2IVX-a5%%u^)wBi2bwTkEWu%iRZk_dAnYx(;QPsTK+Cb%b zCkTlcehO)1&ruFd63vKyoMR=j64(eKOfqv&OD6QlnzZ~q!U8df5fRg&;7Ro^(cj*;TOrPDtw-LSKq}s47hmh`V=V0Yb`fFp!Bz8Pld+TMmr6Ms@K1n#O9i@xgLc) zN_k%e9;_aHd$KWB^4}Hf2#n>?e3swr&-uUw03s|Hhan`JH%Tin)E^tyMc^f+LC5vg zf?DHS;VO(@wlf`>X;#=&-g`(lIwL>&6dEHmz9tyLILB27;zHDRAkKZG+=SYi*BDiH zYMTMR-)YBMUAPQvmYY9rPFn)KT3-VRjJ6J%Kk(5nL?86aI=k{^+hjdO__=(@!BQ_<(2x}FG(~D%n7bWZ!aU{r^S*4j zBSxJA#P}I6|9Umcr&Wx9L8++7wG9(26;$J0Cdxp5T5&N=@sNFsSm(TKD5OR$W#%|N z+Lj(;|7}o(dqbjr*;&Hp`@nfGH?U{X?kGo42{#EXsLSxn6FiGUoFg8MU0yc%VE$XW zs!u5;MxRzb_X9syM>J#4W$l=5&i0bEMnr;ExjUKIONQo8O2DJC%@pYbG`~;SQ31%B zYR#DV{io)pOZ35Od^)teE!?%9(D%USP5i`%vadhVTVh0}U6_!YS<^nzO!5$?*~oaS zDj7h42f(=M(Do|m(^VD&wU$*^(ht#KQs^NQ3{z)O?`69ZK<89}#;IS}{plg(I*Ud} z^we_7$sO#RV9)bf-UEB)GtMP2R^Oba&(H&l&&0mV%#8Wc&DQlOY74t+Ji^A#|2gyU zvc$*$>W8%qugkF53cO}tN7&G)r+yU6g&-N_vHmfnRe047kX zNg4TN8LkR5R2hFupQ)d-mxnq{BX!Ax4mJSr$5Kjwg&P=X0ePnfr6Q$}|9Z7#2e@rn zJps!7%Fy1^UiGaY$1|{=om-^3rohT&dr_0{K%XXc6rpazy?u6Umfug+G;xN8Gv?hP z$cy7(XB2_um`$t}fscwC&Q;cV#9wFmtsJ^h!ZhmpY=jzX+-_^y6FUFT2Wg4L;4Hw3 z>=%f>jTdvnTpAK+RDRN~_5^_^hx57XoXy%AwDTseAMJhqE?^on#pHxZemGA8kKi)V zw)<}ai!`sP{%iUP-qJ-dvcToLm!h)t>!_l#DtE|Vsg9uU_#qR<-4ymV5-0uxza}(9 zu`EwY2Z3IINs~0)isH;CE|<$(p!q>VBDxE|V74@$F6dIM_AXm&RN4ns*cxaF@Go`P zkdg)tlDBK{y$9c;$mfSS9ngZf>4OBnzZn~xyf!76ADRvm+1lD4ZvXH#c9k%H_V|IZ z8(&F{nzmDY)LYhT>SPU~qA|(t>EsAnemvi^(&bGvgS*Me3~K$G#wdvs#`{C%Q{!_z z`0~pq&)HwIVj#3s=P^9Pi;G|Xa<1fs`#T9cZ8paniI!e~Ji)vXg{B;x-b#b=-^oj) z{%))ObJ~={)~<91TQ@I;{he}osb2T{lUduYXDW@%OwokUt_YH_S4v``c9rQ{+(R@S zmuAwLPmQt51In#ndCPEzp|ShXo+NjNLCuanhYi=`93a2L7k0UmcR8f`AIAWy?Ge<0 z4~I6nV=NPJPFK^`nTuG0J~>^S8qC8Ep6H)IJO{^4KD_6ozo2-RTIj_7gz+DD$eDqyA)EmAJ&^Fs+g&}I4o+8%QwJvSr z+1CGRip*MWVt#Yzp$=WN_mypp5NN~kZG{!fIVgsP5#*YmNYG^aval^v`Y*Mv4njl; z{XCAq)683UUf{HmCqmk^F(Q^ z4+6dfJc`^O?tY1(zxIv~N7m}z>^{E;bYDEazPsMP&!gw5dee|Yh{Ar0vCqz6jpX~X z_-J(x|5B3L$UpkEl0$aIwTwPe7{7D}t(}4&u)AuBw4YzQjmnHah`N4}Y(YzZ$_y-# z6$jtu|FI*tOM=Cyq(2?=%U(XhYhM4@5w`Z0-q9X|YjBs++)99U-QVv+JTe*|Z8Q`$ zfKoDC_K7th`;7CIwWojE9-BnIJ@=o`j%0s7>pLrsKW7&U0@zA_S5#ag!+L+&E&eY% zGJBp|y1TQ6&x)niZk^r7>H&?zv%Bys;$tg5iOKis2)bD!QvDsY5Z(7Ji&(#se;PBXr}nbh z7~_0>RmE-l*t|Qzc;3JWgnMra8&WeuaZqG)eISd|T3>6^)uP*_a;_8rSygN0*Nv7h zBS=(0ye5+2mx;ET%F3U5`-Y&Q_8|FB9GzYecj*??((LRaRbStIy8_PFiA1j>|Q#q>0;N9n^lDSeT6EmJ?YOo@cb z3<*eE+uqnT0qM{Gcd;j!TFC5=L{o9IO!9T+<$x|c%VyKp_oy|}TrfMq}=GGdm5iV1ixIUPtUnU<+M& zhUCckSl#VlaoKVEp4LIvm_rQ0AjhcicYwsMG`qvX7F)sT?BtBS&s<=1;+UHpRL7Fq z^zHuQiWQ!*y)7e8LEa<-P)n-5);#^Z6oUoEBE8XSR0rn4(|~|Cyd$V7Kdbp9y5%dK zu|SbSm4+7O9Km*^I``9?V$*AlgR$i$YSRumMAS}_ck2+I%=ds#e@Kel0iWAoWk%Ai zrEzjQ9IOHZYT;1H4CG+p^Qt1RKk~~&8C*0zu^h3Z;HlX1E=+&tOb_uPkX*w3Ig>7a z`O-an^x^HTS;xDrRUzW7M_Ey`^=)lk?+|tU_kS{s-ga1^q=Occq!+1TQkmW^`@4ee zI)WWUYJI_Sy$|5O$livu5P9P}I$?N*D{=?7WG0~tHy_C60O=HdvrK%GueS~F_@e}$ zCpq&POzb@-A`~LM7|dD2eNsZir%}FEZvvGvYoMNTI`yO^a%$+c>ojoba{Z$>!jz7KWu#c1qnyYOfxoiX(yUK2GitLfb=@>EkPgTU>4k;Z9j+ z2MkH?nNqK)i*K=2J&&*uj9jVRnpc`SzEC1D^oMU<_%}=9;AkA-it3i3$6uNv5;g2E z1x=gy%+Hm``;Z~P|EE>jh5}BA#f~Rs`!>5WIV$gJ54BuU3(F}cO+t=L!x&N0Jxn!D ztmjq0my?96a%u!rYq0GmyrvLn53t;yh>u&#N#chc;qmQDP7&nnbG)l=o=Vy)<;t4< zWcVMfk(~QSPG=I+#Dq#R$Ha*~PB?~E#?|;ac;3VTQS=CsD$CvWPKUa-qfUBI^9JR{ zQhA&1A=`aSSuEd7A5@e^R~(l*m=>6S*W&h-yd2rcl6^=#+1JbYpa+!X5BjgnQ6R$| zvwCQNSmM&3b*>>SBam17HmNEM-FD~Fqa9Z?#Ak$blf%e8)xR!Dp!OwD0XhLsg<43Q zwI*~lCG&;7I-TS!b@Pdj<;zr2LtNzQ!YOQVbi>+UBW6$GwHpFNg_CEv*^9a@tRlzu z=}2?af#y0%5MlL;%uF5zte3jhD)HHZ04hsR|0a(utrkh@4TUM6cQR*wKAl3{WBn#< z*Y&3&CybO?CsUe~`N!4EER;1RfR6GY`Wh#8%wQas)X1g?=tzSX#{LkBi6Jgvi1%D< z8g%ayY>|yeybRH6^M^zud+I0g#TXxE(A2lWTl23rtow<9KPHnS$-4sHVjzN3@t(Nym}UEF+oY_+%t6$VG}oEVhQ@dN4jEF zz{%fWEo*wLFvQ9x<0H{#SAvFu{&fj3`0MX2|35f zLF`k&9eH7)Dm>UyppQWO_ZIp3n6NNboje?7st^ml&M&lGg_V?V?%co;sj8-RG*3e&Gk&E&Wt5JT!4&#%i2Fo7_d# z5XR8sB}m*a5Cv2m)kr!Sbw#jT0igxW$&q~{O#W(qKC)l=uCSD?{PygNbGKoy!HC+8 zqpDighh?tkUU+Pex88G`2S}bl)C+>tjtVr%;X}_<)2AE_CkAW)*zNgmEQyPx1I0UJ zz+Flhz6c>Pf)qr)vLJ~DZAQfuC7lT74RtJ81X!8Io<;{hobjfNY^4fX19D7Jg{PUi zWe{>HY{(g+aGR#R)(B}22F|e5^L?$H9OyB^Q!<`c8PS*F7FHdRM%_ntIl_(J)D;!C z`?$M+n}@;ifo}>TMKS*4T6r?aI49a=WcnrXxjQO&9bK? z_I0yrrh^@l!ZUALPhS>PXFpr!(5x%y*BU~O+s6gWMA3))s7<8{*aD&jHk2FVDf3ss z(fme8%Fy3f|IDGbKE?0yL1? zkmOr#1(?OTm8qtLK6JlTyJ9qL22B%0@(7;_ViOy_3gTP_nu}`V0})cw^va=1o1TK* zG{Qod{>9JUiZiI80rD)QaEENFp%R(XX#N@n&iuK{yMUAY#Yov#GWvxzaiZonjk4Gi zK${Z0hGrp(sfJ;tl8FXG_Ly*Vbm#h^9kY-zP&~K~zn=nq2h5DG67WW|_lfb4>>Ay|k{EVmhW?no7(QN!9tR zi5#*c5e^UjQ@cLlw^;W>vRdHx4CH_fLoRpusq#(p9&lkC0CX6+B1H0vdRd^Sr|ES& zHFgISC|W1NdT8^|RTC}SIhAR4TBq9A&+~TU5lhjvX2lJT>S$JdLMj-xweJw`Qbd>9c*(mmFPTXzwf{Zp}e&b@|BH9`J&MUmVyc}JQZq30t z^)}aRx|{>I_dI~y(@M+yJ@Y~XUd-f;*D*kcD)TEkK|)e@McTWYCXS; zKE&#XP$=7U+#;{Ha|R-yH^W0mt`osm@=DF4RuKtA^v|U<`s`I;{Y+)A=NN8!1e4^n zV9{;X6I+Xi#`0RlCc`q`X92AlNAq5>W79+Mg`_21kg3yP&F{jwpELOkWAaDkoU1IK zoPB_?OE@P^yrzwfZ||B2fAms~R#Clf%%TaUk&77^a`%zJzl%SX9{XCH$qclV*}Z5WlHHO)imwU{0_97| z+7-^aulb&%tdzHA2C9vAt3y9ipKw}Ry5Xze^^13Tcw*j9(uYuo)hAIcnOTFGZv^0t zqHL;5Z}LXW2c4{`| zh{$l%pg`V;OZ&!Os9tyI1%UrJCIQ#xV(G^K@eVj}l$VN8Z-)_v1*)IUue~xK|GCkP z*7U_Qz2L;UE0?h6$s3*MpFwiiuha_q!G-f0jrs=>zzYGzSZv*F@Yc-#;n;+k!Ewi(NY7ie}f}C9Kq6-=S`X{|Qp(DDECyd4#b3Gy>I2 z9cF0fr<)F{cugcPO?}IBx4rUC!=4^_qR{579f`zrWePm-ayLh3=WTrbH`-v|DKtTa zkcJ+nmwUu{xgU%Y{aK;f#^(BKkuuBGP4Nghx!TNwK=_7c^L!g;Fgg_Z z$9sAQLGd7*$YgH9Yr>0xfeJf~~Xo;q(M zOjL*?J3GJ|2iEP(wRE;*^7;~CRxX0{g20Q|sGG%)^5E@zQ~w7%9H6utsWxHAgO0yK7}ZNPf&%W!)xcAqVO`AQQ}DnbS0?rT$^ zTt&@k6M48xyg$@Nc7;93>veUwqo*R!^Z&}g|8Rf*ex5w?`|181_FjobkVa6@_pVH; zZiqtr#aqV9>H6~i+)6{7+iDfb+t^b1Q6=|8KAqb!{nGl`vhl+mU#eOp{~!rUjmxP@Y7b_aZ8Ve5G5R=?s?i-n>02c7}QJN+|D?H+Re1Og7^$0sra*tNfd~>HRr1 zQjxeU_-D924IzuATS}yv{d@ZO>d8I)N`Cq8-f5+Y{l1$!E1uqKCku@0Qh#eJFVN$E zeoluuTG#UKZ~b(BULQvNyW<_hXLJ|RQZRtw^xApu)|(uXlLAzw9(8h?K%bA9?UX2Y zP$wGEU9$cDyg$Ir*-q!K>=>{#&CeJYg0-}Gd#=qf6_E2qIuodDY65dd^16(|yx zW_o7oQh-y{POA=-5y45V^luq?lHy;sRc=17M#7vpvKlF_3_eUgn`_a}yhN+ZgtC9D zv!|1jFPK@pxsI~d)zLk8IO$uTPh2h>GO*R6nZx2*wDSpC=OKe;_o-D;ue_$VX%rfz zYjG(_sv5XF$2Ia@6)aegmdF2`kd8kAx5#EXf*Fhx<0W_tEhdUuK{Mc8sQXurGren${N>xNpmt7#SfKMKX$N@5I8Xglc@)&}YFiKd- z-~_q<86jIYOl)y0!WHh}lL+o=XH|Eg#-|uXtbVk(jMuDy7@AxThankuTEq?+@%jRM zevI09o{t;gQJq&jR4t>2Rz6JZvm9?yU(rFH#C&x&1W+Q;UQ6{UYM zPP%%aqq$5wZMOVs$D0h!(AIqN@Sn?H`vqGzY zhBoGC9R-Qc!J3N~O;f9Vv%wHiE4HDlUS_T9BF^wN1y%?# zpu!h*Q7RtF-eWXGKHTX6r<>Cl-9g>TF2q8|Kl24=HMNV4t@0zmpH3(6qRsf<0nFwr zs7`sEGinM5EG}~n7BnRZK%|+>qkd24{XuLNj?V^p)AQJz%+ncJfvZCE@jebv#OeHS zPmX|V;9Y87GZsB`Gt`)Gfxt~CLTt7JF19csOun&R1@)YVYNH%anwE0N%`@wDp#_Z{ z0K|ulYLDFfjY)F)q|-{od_EwU2+E2$InO5nX5AUW_TT#~|A!hX)jzsoAgt(W+AEwbCA z71zaB^8=Q}7jnSP0t=)t!e6yhe7Q{&$|t6Rb9mR$UR+8gv~BF4Y1l|CJ6{=k96xWp zjw&=YX;(AHIbkuPg#LOKahX$6D=+0?;RvP~2ijtDc?(LyMX^8nYs&&6_(Bo+JXUmS>2GVKfwyE@Ibfs4@>>F4 z1(TG}9jZ{6T8xwKbhe;-JH_E9LCKQy17L!5$G(KdkQqk~@NQ_HLKbtv#KbV=qksIB zr5P^_!=rxla4?*8Q2-88&c<2P{sIWYoWSHD%)`MRy}C*tF}qT8jDSjH_HP!tLU}?(*V%Ny18m16 zXK^{`B0RK;iM+0d=(;-G2HpS2e-cO{(paG3m#x;AtuQngvCJ8)9weASXbM}^IUF1I z!^(#lqjpbuv;=VDK9b&C3+{%Zd}ae=SpPt`C_1;)WtH6m0hOybko8pB?PHyjV+{rE!V@(9V%v?m`&IRR4&W|@&cvF3g zoXCnWTUGQHnP|c6Iyp){P1-EN96iuNf^Towj{>bKOdmBRW^|bllxWIs56Kn+UG_lj zUtEfGbL1i2+CSWnFO!4gj4?~gaPKVgx14RUp)zb9*qFD-`w%4VH3+OBL-|vF@4Q^U zvJ}CUJ@{zXBUzP9el7@~bN)9C2g)jBW%EFmW@{<}(lW#_BVBeo1Su_cn#S!NUBb=Nx4zRaO^(@;@QE1`+&wh{~mREAJ_EWhd$c`Gf04bT= znL?{4vTkQ+(op%!Rl)+=m7z9Ry_z|a9B&^-7$}*Y)GWBp`PVH0HYKP!&_IK=D2^8z>CUax9p|bDO)#y~@!d$u9v%OAzpClSVtpz>seC zZ(^iRh@Igx#ELlmo!$+dMM8Da^qT;e#RDZlfwO=J5x@TYiZ4kSo(zf`T)_WEx+V{o z(Vb>u^moju&%4JlNOVQAhH9RJXP&SUKJ>1s4Fp+Wp(=_Ra4j73%_QO$0rbS{D+)LW zwZJ`D+TT>S7^VSJn0|{%s%Wy6V&jU|tY-v*YwlcD_hhV@cm5LIb&Ihwz~?7P4)*wh}hJ zQpRqTF5UK?K@fWS8j3_tvw~-RJ4$HTYbP#78P1U40S4Kke-&VcS)0R!N6g-Fu^7`| z$j2#MCTI7Mv~=(juU2cOM0?Z8yn!_JGFyhUh|`dYJwfsmsN!3ig28WC-;se?WdSd) zgPC*wT;=dc9cw`-ntVrWdSY&T;ogMRDi1o$G`ll2uQ~_I%Qf*`l|sm{RMq22-S85^ zfMli?8hEhWyAi zM%UL~#>@{H$K7$p!qx|4{s+nxAFxyVr&RL#9mS~XYkTfCTOFrCujE}0*2WJ*o|k5K zo=$B@{wQ-bYmEJZYF(1LflM}vN3nqu7}&AMZh3jcod9hPW4;ozjCLBDSIhmUiWT9j z{lw-X#W0r9w|>WZoL-&%FE3gpaMYF;bx`Lr%A{QR^t+@SPp79bq}W(v5P0o}VyMT^ z>y1?lVf%)U0S_A3cwBof^4fbRX18rPOOs{!fma(Fol8=y=nDBU4;K&mFg z6m>*B+FF_j!Z+kL`T`AfdgLoEpvDE5dtB?h(c~tDt2h#KhKY23O_J>u zl4Up#Rr2O{77*92f%Jvqj$I92i#RA;v`vUoK%g~|haNL`4EZ{{^@V_{tFA%_m#p&!-+pyZzNHs=<5O|4SV3y&GMt#*Tx$7f1(f&r^~L45ArVn-L(DpX9WMwt ztfQZFN(+gOw{{v0r>@}2tT)0CzLkiE3e>fx;ozG2O)(g&CcE-Nvcx3HC+0i;XhYXU zHS{86^BWFG^4Mk)%CBxubJ)nH<5=bJqM)Q=O#Rw}YFt(`A;2rKER%fcCO8&d*Uc94 zP$DAxvXP&XhREWMcCaU47p`&u_D$p75=lu0k}-12T_Ks#{fn)mul(pKRQ{~5=0vf$ zLeK+KY{fIA_^g%R5%>jHUPH>eLe!AJt5xFu8oR+hw%y4R@}9)y)dZ@Bv|h(0yv6OP zWp53c4E`R?G?pteZWqV~`mdFtf)1IHT zmOq$ObgMjAkh1)s^M6byW`Wf5u6)ZAMWmX?PSd^t6@kn65veQ^m@Ai0_=>34l>|Pv z8chXfvFTb!7Z-QSirK&ALz=P{&6S%lj?NuddNxS~RF=zmABTNW!;9bJJTY&vY*|&7 zoc3+TD?Pym3o%{9Si~1ncE72%U$RWiw8lX$x>KYXg1m0vKls_&zXdxh)rknDe==R4 z=fBLaM`rnd9_#=^V{QM-wS<}Nf7#+^aNb2eI(cZcMk#anWY@+WvXz1*%y<*?G) z-GxZ~gJhmG$b`wOXZK z$u&Pv@0dL`PQJJk*P7VbIVuW!%7JOzKrU0+MmK4`YJfrB)4Vb_jHRX6-9Af{2aTA0 zDR!PVyNhdeFCx5W4yt*pm;X4W&n7Ms-i+bEZ9L5c$>sk*DNc(^F8S$uEk(QNdbbK- z?~k#iI>(o{rQ<^kxj)+N7v#w~e%zX;C7c+ZKd=Dj zbkIk-C$iFv3o^(E;>GL1?+4u9aQJu6iU9eN-o;1soYkn2W|uwFAYvF6q=teO@I6Jt z4r8%6yF<6x*tHywCESWVt^*&+ebJbx;SV&6O*xza<=`Q=eko%aoBTDRRC7jAL(uz0 zMN}?^0DTk}&GCkFS*lWkn`5Sz6oe4wGObr7&=L8>8TmHPl=uWhYh`RxT$8;{*siX^ z?drv)$zLK$0Yo!|51}?Tr>v-F;2Oz(1ZLU6ISS7NK?8v^Y2~`VPejVK43h-?&;u2( z0=Yf+mo#mL(YsGdPyXs45*Sus&W~*LxuuQEI4)5&0NM~D)bn0j0Dm)}Sz@&R)|f|B z*YxWJ&Eq{G0M+63z*Oo{hYqonrJdyN24GqL$xlXn;qq*v#X#~!k&bYW`qy$~gBD7V zRut0}61;-lirO(!mgie~P_Kq08qi?U!NHa%;)T0d!jQ{pz(=`KXQ%KpnQeQTkx|X0 zAv)TCRK?61<-jCL_lyHTugB%0uS;w;bJlb5F{SD1P1S_oXHRbdxWoOL$kFr;(vK)a z5;C*v%&T-Ke9~KwH@(%-@osqU%lUha^rD(V6saH-Q87azi~tw!!!bhW1*jPT*vGXG z4YjNnK&tq!$g>QfSP~cGLz-cJuFvNLV{3|Wt;h+CE z%7_jsxX6PNh<0SzW8ueqfnp@)jCNgD(^oTlTmHE0zWcogJKPHO6{Ty*d=_{7EAmga zMO}CM{!0hD0A~D}8lhzZrWkA6b=lu#Uq?!?a<07>X90OzTgs2jt$XX}46#6UAE9Mg zA{y=yQCQU=T-Y5eSw($Jnqp)3So_VGbS&%_sW-ughTNPI&<8%t?vq(8=hy1u0P0n; z2DRq6vR7#h_42&i>|RA55J}DJ{l8>KT4HZ8!g0K>I70I{k>^c=&RW>vCQ?c+BvYL> zL`i%hWVM)_J?7V{5nt7~)x6LcDxG|g@6RS?-~Ohp*{1kikkf&_l-20QcZS_y(bcGc z<5a+)4HB&G* zkf1j(0IK}!F{;YQvBlMS9jD9S+gDsM>mv0; zNNHkJ(DY*gv*PcInz@9@%nn9+Vi%m#PBB$FRbNeN4q!m{Bk zteA19x3nV|{Dt^xl$%NN(=x7-LjEmOtc+MK%O*!Bf4WB|RCCyo)TmNq?R%5mpe5td zcplpTzGmmixK91^)Qf}mXiy^P2^W0fw7GY}kU!bC#M`yXYkHWZVL0DN8X>3U3bMmQ zV!V1XF}4LaErTCT(NU00NA$%GAB}Q5Dn-yO)8GXz8xb-VLWvfLARLT%J$}}S#8Op>t8KSc$3hb}Wi9D87+MIbd|4f1AI87bOjV(8G^qMZ+)hJR+tSB-3f~ja>)i{6vWN>FwPEk__-(@(D1X{I1s^%eQ=@X* zv_{0Lk)UZ2LK(x;@j?dSL`(DS$_JVDmPHyY<{>_Z<9wfZFZMWWV7DlZwhT&bMJU{e z7IBvCiEGd!=^3oD3%W|IgscUct|Yp$s;H+K7Y=z)(;|UY=n)kdioX*F3Yy)#jznBU+LK4t1ecQ?X=}^{6)I< zU5Rf+Dtm|=C&Ajmo(esN8<&6i5%3kfPE}A2z!c@Bre7bkb}vR|Sj#=G71fiviYp zc=xGIFj;WTPAh=>b3Ep)Jm>!z=cYGo%=|FL9s#L+Bvp-5DmRbCKf-3ix&1fAN1_); z`;-V#y+d`>s@ZUbDzq-kM*^?8&=9cX$dipU6IKYWTn=cw$l7FCGqzlA_0xE9c|=#5 zX5u9rhs%^NR@^^hp^3jPNngrTUs%p7Eozat))#2Zp+IG(8b>6WdGYE^#hFeNPbm7z z2ZA-*uKT5Pg9?ruq(=m4Rj!n;RU|Zk8oiWg$(E8oRDm5atO++*gw^r1czZ4OD4PlS z44%kiGO=ZdEbey@%>Y|7>*f_7wbZw$KZ4|)iBaPPDFEH0irGT2glskBp)rMR=QUyW z)Dxeqn!WHQ7h!8cQvYR-UNBD{JpW^|mu%O(aFN~z%|QXAMb9{eN=jq|(-nh5j&rmS=4yd%kK+?V4N zaTV!Dn=_{1Re#W3eq;G^EoPVh%rf*Go8J|?w)bb>??_wU=)e4dSegHqKM)fe6YKx|18rmfbBx=sb87!Jdx$Pnk>>6Q z1sViw|6y&$`dw9z6L_uZ-oGV?DC_ZDH@A_mt_=3-rAd_zGKrQ4Yk^_7egh3z1~C#M zEZV*kz3spJ6XY1W=m#OY8a#3OC?L$-bARqjSc4ju-#0rNDR)PX zcDejw%_(N>xj&h3E@u<#$@tI945yHl06~Cg1j+$UViy7Gz0o1G3A}wf=FXNU5=sIqhYFm)g%#HD9{@qYNezBI%b04PoySc0P-PE@4o6&2e{ z4J*26v$zGNC?E@KRiO^`AT~fgs+rq67zpme3{^-1&b>NDbAfG` zCj>C$b}9_SNkHh7OAObE)`87qis}GY@)T7GbMm1YuPCXZE&y1LN#Zl1yVF66JE$=d zK$t0sXSFJ5<2KByBq=hEBmt)q4Q;uc1V+k|TYQB>>)T|$bt37|Xg26a`kVNcvmbRLhS|#+ds4Qwm?BOeUaZIaGB(Q?-bNLZ`&^+`Ug!|p-J_P7mjoMt7h7wkf@B;tw zm~JMm98>$`$GW8+gxf>kqW0BwWVu-&jq){z+p$KHyXgOHO?&_?7a>>tOc>n`#||dzKs-o{}7OzSA9?Te;RrpjwHZ6 zi_0--qjp%Cj)ntqjJ=#>l%p^kLJMBz$q3$%*&K3_0p5un+>{HYr-SlHnU>ELB|!_O zuznTGwDSNDcTSWjTo>6O^H2(!tF1TmuIYk3ZXUCc)`;8jr7ux?D z?&AkO!Rdbv()fu8u~9g8C{a!`rT&fvkIgw z0tbl8W45(jshpq+1($B;(a=B03v>iS!k>aA%zOAc6cmr}LW82lBsVmHJw4@i#cBU7 z8`qSzvjh>y$0W`auN-U1U0EZqM0S=RD5Vzsr)ARjEH_H0s+NWJ$dZnAxZ25( z@K6F|PzrtcQ6|?G6oPsN6TFC@K4EX^&wk>uKdLirVlq!T3GeY*jWDvmRZ=TRFIh(# zm?$5t4UQOB1UFZcOcj>04tVAF{ds*FtVl9)2rVuCczX^XjMy@kUr~arkvD3pUYzul z@p)pY8>G(T?SP+;NBzsofrWC!80)PO4meT6Cw=N1H zP-Tf;a&zP9eAlKYO zpi1QW@r&u5)6)w&xT*&(-&QEOTRI>+6xf*HSyLrS=CPp;MgHgX<^0nTBCisfzZ6;* z>+cqej%4MG_D+XTwdpHRo~Bv|JeMjZ=Lc`rCa#ib!PPMPIdeiomEuz1?2=knhzzwR z8~G85tpX5Kw?k;^&HHb{_n5B=;HH6q zI+dM!amjX3&P5kT^>A1?b?JP&e%gbmp>wV^R*wW3oQ?PepmRi0jEVcEM4@Ge; z`0bTZC$8@_uqc;nKMIo;Cn^Wru+lLv1{4(O6l)A-QqGYu4NSCk)Rg(lj z9)GMsb}74Vsf@o|59wkH_~Wbp6ZNHm{l8B_^{R!@hZRYe-Rk2lO161d2-wkbp9~JK zvb#Z#9XYUIKou1FWqQfLQ)9)*2(ZJJ%EUrxYU%552vr&_=50fv*|8216WohXyOg>9 za(pK$TXFMgkc`%c0S{t2G*-^p>eC;lqG;+tdq6=-bhp(&*qFuX3*Dx=+AT>BTha6& zd;M-zq@74clf_+*b%j9A`w-7blvFLP7}D?Kh93&Rk<^7?)0p&cyiUw_w)1If8p#9o zV>q|EOi9VMTPE$vhql!kb6q7?Hl`a+Y)Gz^lU;lZO96Py#unpJKujxPkYlAoo=|z- z&f3~XmM(kP2?s=>QRn6Ai?T9jbx2m7r2H6%{zdjGMM~L)&7?rqII>bY2l5nnB6FFx zu*ciDRW%6qfnb@88)Kiyl{?hRYBzk|_D)S5NE@k@%#By8k|gAG@R*qG7J0*&6poW5 z3;5--H+8=P(5qs~Hk0#mHp|!-G>s#qgv6avZjx})lT)$LluudZtYJY7U_4{mMkas~k#YR{YXy;kC@z=Ae|*E1-sBgm1kk7{Z9txI$A%T8*K&bkyqz|Uo^z_>0| zhnZvBBRA^R>_?7L>eSuMjo;Zh*q(@ofk1cK!Z@;mVr5932&~C|~2HnrXAc1@@w9(D(`h?LbpJ(%vi(oVMJ7(x|KOHaYfHvnwjuVMs-M9(4alNEvUo$p!NhHn+@c-riB6C@ zrL|A(<`P-$6O~`5fW!N?nAU4tszd)%p@DcPUyFm*A?u@zL;F9_I&YAAznfjZ*Q0l< zelme-#wv>N{44vy@`b98dDCUxn7%wekL5`(=#_ih9g&i^BYozew~wNww;#Ug3&(N% zz8F?}nNU)*_QEpIth6$bMp_W`rA=_>yw!CU!yvmg&d-F}Lxs3alfCK9UvN#&8%)o6 zwUrBI-CwVx{NUz5XTt$t3jc2LsdYkyY3FJh9dmLY9etNEx9r*BU*DtoYVY5xhE0qz zgSQ3C9x8X=sr?@Oa{UXhzwp0!zCR(+S7m|Nf14Rc{xY3C?>IH9CG`q;KF?v@z8+^0%NO)EMqp@aK*qMaWQ8XZ#MYDf1EDR- z_Z0DXtw{bjX^KMc6z3QSb7J>Vv zI92in=ZMd8OYD>bfmGSW=B@VO1;P5rqMQdCUT-}p!f6^o1i*oK;j|md0i_AlLN)@| z0RtJwCLRw3VNhofmq38g5PpsG38spaurs$ocpI2|h)ieP&FKq0Mt)r2eOcpx?m$;< zd6P^s@jS3+W1TISYn5|bC8W8ccd<6pN*#ph4!+319t=IU_DYlWXAHWTePI-h$esTH zBr^JFcU<#{oZG<8kO@W)4V>csn`KbR49)?>fGa-zGMI{z0$R?%lw0^pDld~uR+XBu zo2k24ijMi9mNnS1K~<{%#paMD)3^@8&>v^(1iat^BSPnSio^$bH)dcGSnGb&|b7B~;e& z=g6fKZJ}hU`R1A|%HFYD9SqeEqokOl9M!&_tQ9AOD%}V> zp*SoPR6;^p&bDjXH>a50o0Uhrl(Yy{Mw@Luxuh;Ys6HDoC;rJS!o60pq(GFlkPLFv zPtvlG%v>JuMK1p%Vd9c9pc=?cLsnAaV!W`b%CWWwpEA1jLPC9m)ln0f{PFX*788Kd zg=~bQynD_DrM7QJwEUE?uAHQc<|;WvJr(M1wc=ID6Ie$nfg97beRe{aWEYvOgDj>K zOt`xcSbcSw=q~i9qK_}f%o_toP1zw`RhqOq$DK~M5~x-Hoga61H;`qfkzGqN0LKhI zBdk$B)!!!_6&Xd-g=L!_`6*kOfN3mXg7ktH4`1HXVUFLA^(^v-5m2;xx-6L{nDT17Op&;uETDDaDwD zt+3Je$fSZX&6(l;9H4Zjhf}6!5nLNTf4ZKWtHZ2V>8RKn23S%+s)L$Jo|fCiIe_X0 zR?QKED|Mns2K6LsRa&?&KmWz`ni>9jW_^5ukxg0KQldQK$ZArbD;&3!u&w@sJYh7%lb1eqlcL}&g_`F<<#Hi99a-k zPBq15BWb}_4xOH@eZqjigCj`}Dwl?0Pcs@K!-Q@Hu~ty;!JTgK4<=2Vn~F**RFbo9 zJR>WEGn_IIse`j%H4j`~zIG+3I<8yE#kP)245)=c^FiWi{HyXb_zGK^XwC#z?Dc_pI1BzYOvg`?Y76|-w*YMixhz&@Xq z)6xLBxa@m!>mRZdqUtOTUQ7p;cWdy;1D2Wm*75-+LEX*s?%d;+crpghKOjt?S5_xr7G-yCWqpCmpqMI#Jz z{E(L2BXS)fRX$#}Cz$gxn6xdkz9#k39@gW8(7rGS)kp8^(6QiEn^Lv1sX*4lB98zl zz0(e|45^ok^9J4Vt-_qtBO2A*X1wWaxLgXTq;vBP;8OB0`*{YpYeoNFvTi-g@ap9RkXZ--+ zFAhsFG(Lw8x>4z2r_JQc{8Lv=!`0w3%{`DA_Sa%)+Tr=UBv^4UYe+IS=d96jxq;Cd zs$fq=(;A~EOnd~8N2n%P*+C1CNCy>w_T+f9_)8Mo>?6r4{l+Ak>h+7bXGJ%=ddfGK zgxLUn+Cs0H)`Z%%t2g;9`p!TP=w7)9mAgtri`8%K_?`aR#3{5d%XD4{t|cnY87Yr< z)UOAzXe~T}aRrX<5dG;1VfdP|?!U&8yOJL8jETN=82WJ_qoVUIMOC zRQ>g86@^??i5Ijq+{3j3nxnUJTd3Uws(!w7`{b;0B{!vK6IROMLss_2X*+M)jjQt7 zSBZ-$H%W2$sa_xC`r79>6#W9@?~K~KV5OZE%@s@VzgkzuU~8dL%^!h`?N86UQTLy- ze(%7+SWK$_Mb5MTPsCj&CYJwT$qZ|a$KbHTbe~dRfNLQ(Lt{J<3K$Wzk~l#-o>e=B z!@rRB;wu%XBvg3fV*Ah6s3Hv?-^a5qrb3d1{~A14KF~!VlrEZg-9!5M)yD95%k%#j zk;f5DKrDXpT=zlIeuGH;RbKpjpJk`)ziu8XWb+agFTT?`n7{R}*>7rf<}O;yUVy4K ziQBsmmH_q#U&xaHzBeZk$Rm!PV;MMD_P@=!M7rOAGFV_{rJr@MP4mj1@#d6Pc>Jk- z)h90mx)3b{dw4k_l@2E+uuIe%&PUgSghT(zez=FQNXXr-wQR=el@S^>DD|sU>yC5( z_F$TU#Aea|W&URTehG?h`fEUjB0GfffM>uLtyDb<7}G-GB6I%X--%p_Pf zE4MBaF>OB;n0NxWE-CRIH&Sr(mqqJJRxA5n>LFpG4kE-{L*&nHocB#)_9Ql0brban zvEqTMqjN8q&~V}HzB4FE&r#>QXQ^NJ6g>(&DY)&cegqxeBPd6O|S>8Mh4mdw;dDJ277)LnQ8ot$ql zg0>{%o38lNwaPaNwW}ob2`e70d=*y06Ar8*I92^C-ElisbKMLa9@&t2OF2z+&KO2k zr$1=~bel98;k94k=e+!@N|E2}h5`CeMzk zN3FVNsK>8#ikM>c0Sj53GQ#-ObC<1TcKJj8z(lgw6%tgpdJQHGF5_sMY+KaDkZQ9Y zJ3+bxRjgp=uEGUwdEIp_BD7~ddnQ2@(^LixQs>kt>_+nb7|@g{!BgIM9b)AXE>Lcs~1CJRq?}X+zPGg3jv{gLaC)LVH+Sa$Yk1D7$Rdi^oqk zyAxEFj;m%ov^m*2CD42GkoaIh1z!6Xx3BWs$LbZJ0KEN8!vLNYNQjFMO7KhCK9Y58 zr4a*^6@VmR3g>#1ttyK05(A>dS>?-cX(JVf|<;`R7J!jsvpP%IxujvJ3tlrgOy-C9Oe4^cib*Xio-mo9l0Ymr5}c=H z4e4lO(GDd5NM%$8A6k<-4HT8@j;q#GoB&*aDWmhk5Ym;P>|ML{r(mQ{5@mT2wAN^f ziqQ1(LC;CWof`5$gOklPY$ZrfgSS@EL`-w1-oe|p??`Kd9!=~(cp#-$Y$lwyjun-2 zi0}f%y^OhFkYo2mPyv+ewNaLDv{QIA*&M0N$}mad!A`NI0<`0WPuzJjP*(uuLg7Uk znIPgFP^ZZjs|KJ_FOi(L@pQM<2X~l@gsE7;Zykp_E?pPU`eS@RTG%f3RV*UQL;JP~ zzqJrhnKG2%2WPY;G6GX(Xlo92%^;ke8Dm{8z?v{f6|hyZJ@&1Bw#y{!0*0e~h6(!m z+5|f3-DWg}%sJiUBFmoh-ma&2*V4cN4Ms37I9D-x!gJJP%sL*(>T5`H$$YQa3|s@J zctvK_j)A6(e>qycl*zsNa<#H}RSIit{Q%l>!d-0&;uw7iHlm+|#u>!CUef0;T_IwD zP%y(!dj%C{*d-?_5QFRf){(BhPuDzb>RikWoLg1vaJ}o$!q^zg+3{7gysa-pTS_P7 zT)DE2BTX7VUIN}$1p_}C9~E8HoFbDm>e$pUOIsM~Zg6p}?tyxgKSTQpsn;W5N$GBU zLaUF(VRJB;QgQ03tvT9y779ovOAGd@g3_f3)17^-%`oT`v=w_PkFHwAdIu%ieL@nl zC9wLyuD8ZY>z5@_k3wnv;k?rxuR6!Cw_KNR?a(&nKaP2{w-AAZjb8)V@4h{Jkwhss zjZ9t=2?76;LM1|jKdv|-wX{mY??gzR?d&stdhWEpFWfxI zoB&TV10@exjgBk5G!fAb3+MV)69$uUk*Z_2XXh${vG^VtQg(EGe2s8FXEM=`^eDOks32ttrRRZCFpnt9-E-SeE$JT7&M((h>Sh3x+^_DYN zjo7wr+aq=|V%xTD+qP|EXSIE@R{Q3`JnQZK0Z&!08yEd3WZAZCTt#qk{IdqwCHwno zRQlDh)t+ZGVxYYM9#SoiB13Ap^d2L*dX~|WLsapg)94Dy%J7L5^&98m3o9RcC^m?q zmjMJ*TvQ}NdcFmLl0?p|w{T_+i+@gm<(;S3HR$@2W2WjlYwtAbb`kNhwG69=W-bOT zH8*xplpC(H9YBssy}|ts+^em%r}}-M#6+%`h?0%p3t-=#?{xp+)#*eUD@XsiXvv{h z%;O6#($c}aE~6Ux)lXIl-ujeP-cx=)8uBZ=Lb9Q)AAMn1?9+&?<>6h6D{n2ScW*6{u_;*k&~66`^$qB|6zn3Oo;;^)LDSY5>@|XN$yb6 zA==gigz+g!e)7u1PTnpp^VTLQJ$ilFxCvAMbeIbhaFv^0lf(gBn|h>x%bJj6n11Ct zxqvi}-`Td!A77yloMl|y>xn2wN8zPGHE|6>5dIWg~QFNREgkq&yBSw9SkQFOE4gyG7`P|hr)rdD(ssC&C`N@qRSj%ofWS<-*vc!Q zN>Ghk3l_v!4BEWe21Ij;rV$FLI?!iG1V#~ZhTM$+g8r~1{njPL2HcHc{STjpOCJ~8 z2a~n;1r7JwEcEc)LZ<1^O9I8>M%pwBqB;lK)WghAso$ePLq|54=FWWEY_sXuTZQVx zO4b+hmF6%PzY?y7Em}0oN-Ul}^joc3zj}}mI%Y&&J7!4q z;m8vdPs<4z!+3O-h{^y~Sc4^vu>C=%=lNu^cbP!z$dS@USEJ47iTZmjn{&fTOcq&U z)xtL>g*I_b%QgK7hYq5e$i-x|at@)ea@C}?a_ux_91FD90toj%5#2|l6A3dz664}KfV2BnJI+Uu>q0Xy-A$8d-Sz&SEQM7q z*!Ohf9#*k9ENkI0mL}vs`v9e-5)(`5HoK;wCB68F5Lj4!?^#JRPT6;+zZ!vU5U(tu zs<`Y*5-A7lt@*PB&M&;^l{lAJ#RSomjKJD!;9s)+M%;^*f6{HgGpnuHDV-ONJAV5_WXpUVrk5t(;*LE`;N5#7`k#Y&`hU{pwWg@et zI5SRsYzgNpH6>prV7{qkq35R6ieJ@|U54oaM;;8O#a?DLA-YTtdtaT+MHO4#cwjwXGsmKG8+$h;Ej;A<9iywLW9B z=?ek>1VWCdVqxP^k*GEO?h*M)mw(gb345$tp&@RgR;%%?dC$To>nv}xn#Ij^;+EpT@Ehi` zQ4tX6hvfk;{=0`BQH4sp-=>TzG+0aZ9-r}IRccCD`^qd0yF^U&0JuN}@8OF4Tcj^3|`$ zs$_-1RaOtaK<{7YxyGP4f8M;RK5x?(q5^BHPyl*F05d`14hkqmsM`*4s~l!4eJi(5 zP2bk5FMn%SBX7iE3mzS(wQH2~6(;yj`<)sF{Es0S>p0XNr#tK_PlHAvqm z4$lyEcQ6;;-1@Mc)y?3`DUQ9$xC7F`L0AyY4zf@dhTj!|`pMl`gh(<=e?E)I)pUxq zwg8`gW@w+^IM}Fr=2t(uAQGfJ{N?}Qv^Xo!R!#({C$|+h$pjoV#lkAtHYa~=A6jAW z)+3<5f0^k}q`m2pZGhUA?rBioqS=4ZBeS`(?##dW$@%8}`cxN-buM&Kwk#+R-^2-^ z*CyFpr%6H%8l0guri6ynfYDIR|D>?hSe2mDz`e}^&myS15JS5GJ~CD&nPfnu=obug z&c2O@@TV@@FmXVZfP~iLkkL#BTDF;s3B&XqB5};{4@^NLUj8D@BvH+8mXrC-O=!qIJVi){FPgHB(~y$m(O3j?e1ycYaU0q z5C@uyD#*h?uWABDxtuCDqK>8AE*}Y<$_V2^Dym@iKq8T3iU59-^x9jOYCDinlj$q%rWRPPT(;al*-5Q^PIAmHdq;*#BX#$@@-ZjoSa z(0!N`Kv;<$Vhmb8y2U0Ut{AwbA3FCoI!+!_cg=BVTqht=TMBLroIU`~p3xs$pkYro zoh#W!I%ux5rrM|(JIypk(&5ZN9=WZHAGF`Ui4`4vcsP%f=KA-N2`8c>K3xStd94B# z;{X(W%ECGVy}Lm8vIDFE@Z71b{;>2MRgP*{pCV#QA3z(kS4+bPIPEkD3wu2XVxQr52FEHT4$vt||h7vk;>ht~e{@P07RDOJySW+2JFnbFh|3i-e|+G5pysnL%?M=Lf8oHAPuzW}Z~J%?EdK~h51 zeeVLYXB6^5EWoKsmtO6$LkSjsBjt<6=oLhMHi?6~VvtSLd+ZM2f@8|8|;yPwOjW@u=Rgs=k zc!Jh7iiIG^8x38M3dnm7w>i~919tfal$+Eo#`M)o&-ibWh7F+u##{V@?tmV%olfv? zw>?C1svS<#PH;p)(M^8UW%%Llc+=e(S=$$bF6DLmrWxo3-9Q>k+Vzg_$WIKp|D*-z_iPg9!w@06K)$p!5;yO48MG^1j zmq6e-r{w2DCb~%AHg`Stgr|0ivor@E8ZH4RULL{$6e3+y)A}*e4AD*~CTO3gK{Qg( zB#@U(b)7m00^V{v*HniS9=tgW-Lh{ikT%`Bpn|pLHzxT`vd@eN)s_;2b8l!->*cH8 z1BB{ReJnUSXH{-yW~ z6dQe6%CckexdsHSOo;i|6sqDlYcU@RB3S#S%57+3T10$kJ9!p`40=Qc_-Xa5`+m1u zx+3^69$J7L7|GKw#z7QkrB#xG%N4YlHvuYUZ2&y`Cu;gSMhl+7Qs1_@?JLgCixZCk z1_z-Rq-gf;bA*?6!^#kx4UR9zen5@RynAg)o1l8Y;roCj5J%+iuFo?ncTf?8%fQXY zPN{v)7DL9!j=|S1@NVw1wx+qiK_bERR%Ns$m2>&K(dSb^*Pu~pNQKcrxDNc5Bm9!J ze~Ho_?l?)emVD`|@c9J9pmHWSkm#6t7Bf-DXj-p_271t97fr>I%E<+~Cgn_VDaYT; zk91@De65isAkriu``=-`H-jKP6LEsJ2*UZ($#7qSKne#LtVs*5h;-?`*K-d4gbPHU;7$qnGcX*byTX z1_O$sI#2renwAvuI4ZmA&3)@}&NWqqSLX_=L#+>n*Prf;ZhLDk;b$9b)I{0OQJI;~ z1^1JZ<`@rr#JL1U(84FXF?E7t^ldA+ z!ccbP0cpenPNj`IO~^-xC*@+p(k--}Y_a5mBFa5QXbTTfcYFC^c8b4UFIvl`J9gna z#vgk)y>tcT?|EGyXl}eRCLQh~^rjEofpRS~cJq zqNr`hPr;-Mp9ilAK;dL4hu9zH&E&t7Pa#WnW zJ2n3n55?#G=FYnRe$e{{@U93f_vWO&v5S;Le*0MCi`QZZS?f8RZ;#hfulFwy@}%#;g-W@G zf4`CXnVtFGnX{XfrIVeWEZ^6$ECCq>5e^?MSu^_tg$Kw-5Z#>atsfr+sL!R+M~h39 z6S=AdwO-^F&UPN0@s$QPF5a?SeOY8fU5G{o`Unq$_Xa3}!sIue%8lj7H5I7zx;?V zpZyc?L>b@DW@?r1&o7oVjLkE-xO1Me$Ip#1PyROj)3=_IzgfO-0k%jAN>To$a!Azk zlK0B%b7si{W^vmZ7k-^G}y!6f%QLxzcn(rI38Yue#Al+uro=qH}6 zmFs|?B=hf5g(HU;{e{^oDlpvi!^dbMqvA3f^2!R`_$|;icCvYmuKeQEu|tQ9t|?H4 zfHm`=J<=R{W!-HY;aeL$@xC5vgCY`W4?{!?EM~VcIQR~KpEpCZF033idZvRAo~a5B zfE3YfVZ(43qttL5daQ@6A@j(bP4wlMyHoWEN(dcJ zdpw>*KedqT0}ACVhpG&6NwUKT4VG9wrPUZsy1y|a!oTBJpZpLAvSz^`a~*Z+vZA8L z?FmxqG&FU^9Ys%6iijmEP}lvd8;I_;C*{g$Q)tU?=-uc`V>p#e^P zk%I8{&_YpX?~;&53zgQ|IJjSdWmXNC6;?8}X*^{$OsrvmC)ObX>h##{**g)5cF~(p ztPIOs6T9Bh*5!GZ_ZWBye3~m2GW{Ud58LyPHaaA!CJLM5_H12^TKZ|{cvf(KZS|ij z+yJO(hAZP&KbA!A1-URU&^s!wIj;NoNy>DVFQWWm?KrVK;wr>91o>4IgEN_W44p;g z?=Z?&q-yiOlyDqEw`%$9VhfUpA90Hs(Vkz=NTp?g*{^O`w3~g+$9ULv1kPoYAIh#t zNDWFH3*59)JSbC*I${kxP&G_!;J`Cpjbue4Js7Q48Uzz0!?TXbsbr+Aq%FZU@5%N_ zQom=nqGf-ua&WcerS62R=(?11r8LU;6U}k;d{!P-(dlC>S75uil}=gL)!%xDX^!|# zB5TY)-UXXBHjf31dKteRfIfwZMb?t#As1D``6PpqRF#{x6_|{F>Apg4bb_gA<#vpR zs?hQ%QCm@xO}w_}>o`?+tPXtyo4_Er(aG>gSZi$r7c<bXuHp!G}?nYhD3WYY-6-bW& zF*N|$gdKDNsYYU7J!egDx>?k7+xDs`#^1^65U3+r8%P9*HdcYB1sg|X!p_WMjEL(; z5~{L$C{x(q|NdFe=@{W>LV!qcN{$o2m4@=rFGipZ^#7$a;=ykY13LV}*^d%t+tMi9 zk}-CjAYvxoy*gCfHPlCuPAOKjP*oIyhIO_ubV`UicjZHifwGY#x-cx z;Sz!0`kDAX(B~u#_nD`(KW!|Mb!Psuz?k%YKXA~5vm6+r{I)PpWb*;LEice(z6k`tX$VtM%BNjt9WP#_T=i_(Nl>{EWRQ zkFg=QMpOfk5OMuOQe!6l1b%T7Mx#(f-~E7u#f79X4jVXU!F*DV&?G!UUh7oNPo(T@ zVed6E>$KTt&gE@t(FX~`qiDaG&Z^CnB-5g3Hcp36S2D|Eu@uXzrCMK&8USy+DI{{U z2G#=!ca-qBAd7=35C%@!`p*U=q2t&Qd@L8s^Cf$)yF5oS{|38Ennzn$XO%QA1Z`eD z^n(0Muq&8C%Yx3+XC?Jfqz~)B1rI=`l;6VkJz_-Q8Np%!aaqirr>Uk;wHfWhHwMeQc+XdX!fL>T<+IDS8d~iSNi6 zIt5{M)$ZZ74C}lm4vdA09x5ryYA_uICJEy{t@cixdt@I?z?W@%qb0#63B)hU<&daL z-i>(X8Lsa(v%Z5OTt22{Qqhb5A$Pfs=1p>Pv$dEQIPEExeqYKNAl#0)R=fYrHI=-( zHvbqa3gfRWY496+Wnsi)Zc=VUc~X=c`hBv19nW>!T_M)E-70i}W(QcHMtTkEcwDEN z7rffKfM|~z`OMW*;v+*VrzSCsPJO;W4UTA1Fz0HE>??Go5{7M!bjmOj9*oYtbU*Lg zak=HX9j3#Iuv$b*UHTQu_Og_W+Xo1${D<3yo)7Hk)Xe&uXOA$l-F%(fODv2?l7tUN z&M#N~@1|N0H2qvO@oYGx;{-drh@`c2$7_A2=jBt75z`%YT2M`K8Wp+o?bgPOLP&t6 zls1i9c8&Qly27+$msbjUFP=y^S){}oS|8byxX8*j7ag(9Q$Q^x>__0|L~nA2AE71M zTy8L8ULA3x|MXc=5}GT%W@?+qh(%%j(xUsHEtN*_I2Vf$?s_*3o)PrAo>WG>y8*ce zO4;f2RI7?!M*e(4?32WMWqzsodi_c z`~4>nU9N<40_N1O$WTXm>lYpWWxc(jDxo`FDlm9oJXO^I(G)p2vdONeAM?s$a>3Mc z;FCc#_w!$&yu&bFLA0b9NQoee1%Gm92EJiSB2jf!XQ@3Z7sF_y@*no*C@+!c^q zm@7>#5sv|>v7H)Av~55Xd4;-GNayn^ulqO#(8t;)xJEf(&ll?(EL3}fIKMa>h_Uj- zCCLGfYJOx_UVa1iEBqCRJnlA{T9#HA_*lN2;!)|`gc2lf-rz~e2Y4+?-XjhD6cqv# zMNgD^p!?KflZ)!IdB8Q&hgy`C4yS@GXWGd|L-j2wLmsqVjIb1O~qs@pV}cG^`E&)6#Z4;wVof2S66{9g>) zmF85;CL2um|7_5%A`;0o`V65!Hh$al*HxzmZZG*%ouo-liAk$0QEb?wL!(mt9 z0&KE}`RRrQTDgAf-fP(Os)oD*SKNa?VQNwwAlqJ2PZ~7{WnDIvaSsIA!w3!8S>h1KtHXatVRJ0OaNFa z9l9{62TDh|6WVvy8NnmX3WP*<4N9fCa%6ndyUxkk1h%T}YW$Ku`~9QDyT zS|^_g~0sD=(DsQQ;4jwQGHW_i=B z2FxWI*bZs!`HT1{r1yh~<+0N?2%8JzTf;R=z0})_xlL%EQljpfdRZqvc zj+)P4&^8ClUTrFZj2V7yE?D1mfJWM~)(+@DFjJ3zo}@AV$iv`}=xjr7t{?E3x8P1{ z^0=_Qa9ku^IN<2`1YFRvsMJ5ma#>T?TG)~&j4lb3)?%^mzgFtGYnIyB|zzODz~`Mn;=i)%bi_&fzD>xjc~y zjgUI}gUvFj=Nl9>lpA;b=}|UU90I>i=gmn4$`4Y{=W6cUo3IUiuNVblN`c(~+pUV= z%Eyy&}c4N@$+JIz1QHhxW>gpAggbf!*v?o#p~L6>N+vFdW36!on~JL z1RWkbA914bdK*f~WbrMr@a=QulEb(#?wAPdtE-+6e9QhkArjXg3CYGG#z~|_%M5un z$4da`=~%0=j+jd>n##Fo@CDe^mWg3~-!6VcC1ofB<^?|m;l5089}Y0wp0KEfA2yB# z0WG-ud#bk0AeC|?mt%JhEEEh3!YKpY$v;1(&BYHXGpIX<%G_t%m)ethPRD{k}~)c@kF>YaZl7IVHCUL z2I7_*zzbDQERWGEHRctS*rycKx9v+W+y1_hj*Qr`{4Ej7%sU+fq&QA*3rVcEj2 zgn5mmm5LR6I>HURm>RLAL3Ei~mdf#9k1_S5*-VysPqE|dQ5=N}ESdI=%HDdCN+TUe zTw=-%KGUCCR*hl^L(IN+ndG`-Ht5};W&dA%lKPU=XhP2tq1?TwY$g}K%2*!U1runi zyQW);vQw3*ALqzcf1IcoY`c{1lrIxyPqT#@3j|4IAE zDz?qn^_U_7dsOH!UO9<|cq0hi1Y)v|M&m27|>QLF| z=^HRv--F3iaV!U0yK&kk@Ue(1vS8k zCVzD$x>ePs)EUjpmz1_)N_NoU<#`xdO&j3`a{N)>ruYBN| zSn5Pc2&wKg|LGMllQ9X z8oTQtgOqGfPF9Ui6jjKO$_@c7HM)g(I*f>P@Oh|p4^H!0>q@YmG~R1fcSV4|LT=U2 zF_uTzlo#JS3a{JFXo?G>;9I*z=5#&5yC+3E5t~1C0@zh&FpGcbbA{NyjrEUvSTg-^}G^ab{Z2b~A#Dth{z%qz*B7I0&v ze|rY#H5zHPikl;GB7#$pL}Ktxrm(|_?^JRDzJ>P0Ij{@i_g{m#`R;CRDxOmUU*FV- z5sdx(_8B5@vC4WONy3u{_a0Bc0UEtPH>tWxR*~))?Ju4&X6{o!UTa4GkhZ~bDx zgE$Z;2017P!#@}NPK~h5N;w8@*QCyPWm+Jl+yt_!=iIxen;oqGWR0Iei2uS?2kZnB z%z7xE1$6OXFiB^6J1033OW=-VUzu)iQa99oBbaz-U78y;g5|r>uY4X$61xxdf?Cwk zYDb^=ccHJ|HX`e1FCQhxk6Mk<^BBDB-9n_i?P+i83)}i>kGL9;^LXa=1nO};pO(w6guQDseyAno7>`?Jdz2ZQ!&bd?xd5udP#%y;&1MEVP zqKS2ioL*#0i2&vPhimE4ECY4(TI&vk@iiTC$WQR2andpa(R-}#oUCmJ0iKvNY(EKC z6VuM2xOpUSzx7!2n0i^GU8R|?Y+(+#N14Pdq2dl*(-*-Ayu)|X`It6Q9(;U5ul(Hl zyvp6dz`sTf>8jxIg~}Cl@jM1#9GS2WozYV#vb3`%@R}H=TNXevQicxBscOs@W{S@ z3$zAz^2|(s_~oZI-`S=RVp*zxwxEG~geyWRPh?n>>Rhdg`_`qTQe3GXb*~ynTP#YD zCpZVJyS;}!WmtENynwzq&(=dPUo)F1G_FCyH6v$;)$)41+h52lqy&iN76@1E)f5IdbrxMx#SZ?;S*(y zRB@bCN%5pzyKK#79A_xBE3Lp~Z+LMo)Fgr%lmfWQy+sQC9d%=Dcz2@*z2!K~e%t93 z%44+Fhi8Q{D8Fkzy%{YtfAJ6=EULaZUCYEsnR50)(AyF{^qAmyX_HPM<0ECHEZgg$ zemYGt&C6s*t6?}jX<&*Fsy;-Wz0SG|qQ+Maa>6R~y@`a}u`-{|;)lgnvVQsWO%|*x zKIYf#d^JUL#NR+|J1jz z%_L^l6z-MZ;!|D1=n34=MgWOvMK zBRz#eh39{G=ve-%D?TGD6X*Xnv0Q0z|2t%ZxqhJj1g{M9gjSbEB;X|2BHaL`bRBk0 z*LGMrya~;xSi3hG=FT7*+S^^wgnvhV3n${-T7lyV|H*wQfB22?bZnqsz6QhB?K{sub3wMEZp2mV^4 zuDX>0gTx~rY(#K3&_r1f^o|07D3hUf)-<@giuMY94|jhAWnd{T_P{Y2SPa1WjdJA{ zPvq3}xQc=iP$LetMQJ&HG*j#q_!UC|7wB z-hD}#Wg@eg`~Gx%bbWLt5o!DQek^wSO4a{Sw@U8!nkDkn3!~?~0*{H_rY0|J7NKRt zhP5q(QjDH&^az*AlxMqF21O?@>8bOFmzavEjRjBgARCsKCuJ06PPAksFq z>X$OI3rY?$zX*D^Wh*xULL~xCJdRI0`n6tdocWDyT<4{K`#XT77uQ7(@rD#xIF49M z>?*LCODxBZ)f!7<3uzLykdLs)pd^8wsOGoygEk;hc;q120NbA#eT(y@KtJP0vT8z} zEgObH+X`d=xk%g7a}~Pr7#W3>HOg~UV+4x|BAd1Zo)R^ie5ZTIPEKUT`L7R@DLr#1 zY?Rb>@$;ytUczNaLQe90L73sK{K!4iIt~&?bs^)!6&DMKLY%Jtp)muP@Whm4Gu&I9Tp=Iu|o0zkogH+Fhy9iP?e*m2u zOd*9p%Qm@PmuPH5IKAb$z8V8ZeKFTgGRlv~HVdyJ{DBDsa{$m}X z^$z;&Bv$+FHY~d!$7--H6k^^p)N*DM>7lf2P!(^B$g|!QxJx-on734Tqt;8d>3mu` z>!Lp&jOfoe$!nQ&P{d2?nYSE|R%+Su@3$P+T6uM5z(+P{Mn#Bd4GmfpFNd5sJ zP;yz8&c@Mw)AFuR=n*1g;EtN&Yhg1Qq=Psw_b_UrXdWerYs>*oOU#aT?Lv;_!oFZ$ z{=`;0#-gOuL@k)fLPtgtPX<}W+Xew5npj#{2Gbo4M%z;zh#BP4YU@cJ8s&i-ZxOv? z*Q8#G(;&n>@hoXgfn%C!tJ~ObTKcwYF8iISNBCn^z^Tt^ZbymS?AS-2BDvJ0!7>_z zj%24PWqQ{WE`i5n=h1mUp~w58TkWRm6wRgh+GIGbBizRwXbHP~|->(R|7PFKbHBuDRvqzWUBV9~=#}TsLZhyeF z#lublWK-2xjtEyN@p#igbKXG)b}d;1wh7=+U~KWT2Lst2v$JkmS7pEphah5|LmbwZ(2-Z zcm|*)r0YgE?|bSfSKE5{M)syY>4+&ij-rJ4hNXVhD?jWlWza5E!&-?Pc#y;6`L9G%@ZefbNd+u~VCubPgXLxrlw$Wo(qFoD zeKVpbT@6fjUUHYeD@XaFJv)a(xY_e&a9Athcax-UPtXl0Ko{JE=w!5oav=Va2YPjn z=62pRIK3XNNbwYIbpg`%EG~ZIoC_&4JMV8v0Aa=b_Wp1YID$l%fiS*1Ol>Q~jU9@r znO}~R3pfz(aq7+{Kzw_-Zv{2Qz?a9(2nM249J#r~U$LN$OsZQ(+?UY}HGkXDOz3)-J;TN3MlTI9Y9=F{Y07^S6VFwAXaT}CS zoI|M8J*%=!1}O?1O#Lk@EtVyB*&IF(5t=1C9*100@u0keAwjUq?4pr1+!>!~2?t~Z z1xw=TD4ALe91j8_Sr--tn19B8@+Q`LUZoy>-SX)zWzDHpBOqMI@F;u zD@*Tm?B}`rpd1l_S$}n%(&W@XmPh)VE}>*<6Tg=!L|iJZ>@@qB^qLR`goMI28Cx%7 zBhm<#rF%#0#7`!Z0>IJ)cwEg+EBsHG)fY!b>O-!3p-o~Eq; zFJ|l`-#T8;X&9%Xy-*3WHgE=z6$NJ3Em@?%M|!w&^u1hxA}5LAo2e&IP+OfC93QQM zcLLl;Q_k#{?hzYV>U0YY(S3*&d=XiU{JkyWt@cdJ0NM zxx7DlU2MFTgDK=tF5A8ywh|l7#S(0af4^3n@TGRRI-7zz^|8+)L7O>m?J7IS9VjUO#ZzJh_(xR{Vi3hp}78QQHJ6AfgSz*p}4kil}9{cIqj@$ z$e>tEyeO&G?wGV~um(u7)?;=!S|mI04{B(11@7daf=u>oRk5@GiJ3|}ja>iqUD7L| z^d1v!iG{?C02~>D&*>9hp}pn`!-`<6Ca_9OB!B<}r!oO<;o;eMV(A~E9^6q-@*H(J zsuFTC!a7kx8-|fqXFB5Az$w+<#d(1STM57AKLtDVyp7k6Z)L{@7B(~0uTG}@BWIb3 ztf?gewlVL^x%C3lE-=G}P5u~Vtq!HhM(w?7YH8YmGx=RWe9UqI9m5s#46!~j0#8@O zYBBj3M{16IxJd|sZ2n=x^OQ#JjM{94VF)wHxPu zCW013G*rN0>1n}MYMk*fAW+aTur)!;&6?TqPzZyTyQ}1uTlqB-F{%2s2Q>R!shw1z za38#9Hli(P4j*%dBacyS6|@W}*=H`X_Nvw=Y4h`KTtQ9B2&0h+&oj^J7|2iodyiz^ zBpt)=Iwy%4Q%nq!zf2935SST>I3Ez|7H7t|T012h#+Q(7q*Bl)llH;hS`D3iJhLrW zAfQ>>W5yH`#FalBrcYAI7ZR^6QMa`?iWwNXN9H4yhvr+xRi2i^U3Bc6aJSh2=`}n} z*tOnOZOtN2oAl9=vrp4PeJ0Tt*Km!?Tnb=c;h>rQfZblr`GF9iC)Cjafa0tS9Y9<1RNTht^|jlT!W~O&?{&5g+ic_MQL0{`mZR~jYECD_9og@>#e5GC)2CTEA6iMezOTES zlvU%Es{+R7qic2|FGldcfeo7&LjK=@$jb4*L>*-hdlPy&LrW!R8+us+CI$w2Q42>W zX97k}CYIly*3Kr5^rF@V&L+YpMs~&~^wK7_X3pjWtn8fsCo*uQW8<{h8u#tnV_1GI zb?;Ab2lv}?>Cx4JuGZ;Roy7h@C?TW3oH*z%EE|_-e6+Ijps&kvFaBKJz$~;=ghWq> z1k7jd%-)U-I}651Nye5M{)nf>uAsY*MK&A~9!-J$8ELwoIJ6|=jpzWIVE#CW>PQ5A zr7(+3*(3}|Yr%2=#U00XA1AaC>wEzYc9@bVT!jSGFJqwiL#G-9wqJ^njNNxCIU^ zDLOqhASpTxLqdO8Hj2&raP}{o`R5>qd>^Jf30i01^@Lxy)~rkeE;Nva>uh=WQ;Zvo z_@Vz={SRJ}&N<1q<0~+(5Fr2Ta(*mAE)(~edME|(Phj3{uqZCeUei7?j33|^j^+y* ziz|kJ9k6f2_PhR@5-%jE=&XTqAXMc6Szj%BDLT!KFe~KQ)SPU9*$!hNp}Jpx>QE5p zu!M3QKoC$tG#Kx%ESmzr8vX|{D}4~d1N=ZYHY^)h525m86rGIsi6Rc`5KjXn@>}2D z1o4kP{T=i-20Ww4q)JtmKS0B$eZU;vgP z<&>AXh(W6YPz9CLd_cXsh$qw|mE<=Nt(D@8RbwS-8PsxIx)JDnfiWsL;FZO5Utmt} z-6trASUM2#WuN#w#XhhmWXQ1BoRS62x%+KAi#N9@LXr6@)3zz;_j4|N`*4eYU13u? zada~6#|@+4yrH|oJqknj%6>~Mj*O^)M1c={NCF1cCh!r7JM;~x2#LEtslIIH5pJv} z0yOCi(i@aFAz{sgyaV{-L~}7hrxE(yjlCy5I!i+)%+0LO4JH1@Y0Q z(8y@15+tqI1QG^@B_PjkUn^664ET~s)M+$0d6M3N#%G%zZedsr1f&Rqmj%#I){Dl$}IeelV~t!_mxKj0&{yuCHR zOKy-a=w}fPtBfBGCBhLj)P3PC}@!NH?wSWvZ^Gf5MRvxU6kB3K2Il@Fr?n`($W{C*wa;#huO z&V-zzu@upwtCGUMA-7#nm?9HMWbr@g0AR;i0XTr0rE*yMjjV|vnt*t)e~x)W74w-% zpvpl|3N*pd{e;9htDr__Z~o@=bm^(SMHX9xeqJ7X@9NcD9P50$Y)n;L*MJ_M?%%wv zn3Z}a|D^t~#Oe7Y{ZRf*>e=M+s`Gptp#J`tT4JF2*g5j(s7&{yOSc^TFk!t|VXxQN zU|F*6ZK`16q#azc?|P+O{{(dV!DBE4Ry|ii1n#X8k30Z`<-5?-&|vv$^?jUibKkP`LHO52M^}|zEu}^+MeSnwpJ+^^ zqlTFeYscC79-o%$l}J}96Dw_fWIH9gTs&yG9tD$&LKw@II(_b9HtA$K7`*XY(c&vb z6@Nm1sQH6@0b57;cwSF=d0tI>`?-jh+OyQ0Yf8tzdv=qZojsL>hP*2PtM_>L5;N~~ zuzUWL3#>JjHNB-N6ID7ot*Fl>mmXZ>QmVYZr`mTAXZ$IBz%y0^F!cekz3&`mwwxIm z@Pw+X+|8{mg~abapiXL8{G%)KPrzfo9!fJ6o%rJqB1svSCFkDnhHcu54UVN7rk>5! z{5~D!zllRF^b&L%_OCLk9T`2>mx;Wt%kiV7uTUhYCVKr|sZmOuAR;Jf{saAa+|{Q` z4cV=WSa?CF=_t_l_)h|VkIPw|^Nuw0b6Zi9(tZ`33o1D=6(aM=*6Lw>!oATfI!veSw=oDG%cEC2?BoUz2 zQR%ol_0h&K{M_+t;^<6bev8i9<3uxdam~a>xz{X44iX7+XKn_dknHSj$OO^uDQ>Hp z+f#?8cFRvCdL+}6Ng#Ugb@FQ-e2JZ2&Q;%&;ws9uU#HNujD0_jX8ODDpO4%8Ztoxu zcYgGU}59B zWZ|u6s;uLtd|$LJ(zVm=`Qj{7y7$lek$ zgCXz?61iErlj|2gS%4LBfHERCD+AwZx`P83n>m5fLoAT$xIsfWrcsEuQ}9vNx?8Hy zuTxtEW4V^~_%rt&(CAqG2|s678|-frj;>E2Cl?S$6@Y3IguJKJdvZewrvbu8R9eU$ z|9ZJlFdQ+e)(zL?1#E-o$p3IPPDrD@HgwaPy=bVt++_D&^a4boQ_(_!i;alMtH%ro ze;~@0*r~oc*nk6+9DgPT7sDRXf}YS+BV`5gNV=FqUtP;Kn(!6?6OLzi%e;1Wo`qIx zFPi*LO6?4dE^Xznk(_F>G?A^`{mXJ~IF%HMw4@1A`VGpmu2BMQA80X>3hdUF6^oEH z;>eIy;TceB3P6n7VMwzl#8Jhml&(_Sc2|x4_?d}3k__A7hV@V?N;W{C8W5pUO>{vq zC&yBcuAudDY#3oB*bT&rbg3vrbxc>l>z$^p4sxy{A`@yySb2LJh5nu;SC;k{Ijf{+ zM};IES5sNkH$o{wqYan-~VBlSs#3s}j!qU~=xxW7^}J4r{3Qy&NVwr$(CZQHhO zow9A)wr!sBRCnBn>7LsY(cktDcw^_v%$3jj)3Aq*0ugbq>|Z7BN2ug6tNWpn^Uu!+ zPpk?W-{F!}PULWK;R^)hjfyvF#b>$Z10OSTzlelRCI*_srbpT~j+_W9|+w5>2v$Iaa?qSpI~ zTS%@kGH0fyvS(EN#j86+_Kq>XRe?UheK!?%&VQ!eb>#GiHG>I}rGTKSJolTII(EBht+C1M`fEYbL}Febqn==-wD?n z3jg)9tGjel;Q7!fR_={qYCxaRCW%T2-S?HlBL0~rGRpL&j+3XmlJiWZWw^F zCumnsZBRrIB9Ei2R9e0}d6w3Cpru(%bLEp*o>Yjh)p|@iK>Z&P4VEwN((}b7>z;4) z@+uj7vVnjhw7~jlDtn9uNhi1N0XK|zYp-KLBFWzpRC!$h7*m=j34!-76wX*%b(&B5 zKhVDp;8Ad`6_duus}!x)&e;!J^&3z+zJFR>evIz86w>qnP12B)$ag1!IJ1TK1yxuh zjLU1#*)>NC&x|I-7GO$jTxsp~jc+wX&8 zJ>4>HP>AU~$QRy7B2#gUh>0V-CQ#N@w~~W!O^Is&Qeh}RAcM`VUvW5g?W+keqf~Y_ z%D*Htl|0RdOUXWiU!cVWZ@S~n27Y5DE9f2rJ(0h@5Vs0`vNbFUi74OSP%^uS2>dR-r_~dcm-F%ixQGMOMA9=aq5v|B+u&5)D{AJj;b&k zdA{tx!yWip(CDXG1Wkfz9lU6|4eO!sUKYZVZtRrQUKLW~d4X-~7D9<9jjj)2DbC0< zAY>~WBuNpo*GO&jB;xy$XMJqQdd1Tp;&%*?2ctp;Qx_@d)*>NAxkyGoy}mL%=I-@) zvwWXkUw=|HqfC-Jjy9h(c=4ADi`KYGUkt*4`Mk0=VajPn8`K#e=&*I2yv~$+7Ozep zr6htr@smMXZohv%d!CeY69s_=lNLBc`9jNm#otmewCgoBqjq*K5ZvfNxL#?RXP$=3 zZR;$8>eWsD8LE0v+Mas+c{?9o&x&?cHx<5jPuzMX?HAmdi}SS?QTK4?@EmGGA+K7T zacb+=ylzXPR}$pj!rVm&cTiA?9A>@zY+~gTZEEJh9KU*DAe*E?zGo`{9Zpj2$JEg`)AiOgFbC<+K0_G1u}oX z*Yl*UOc~%<4n`%UtRS$9u_|E#Kx6S{Nc@mVIAl==y*uCn-C!ssk1=7;QkNWHn zym7hq{%m!gh|)|YdU8gZQ`zL1X$9qWd*bPF$W8{R%!En929$}~ymE%@Uq!+3q}pcB z%EMSbg9TY_P0z@%4gCsPUkqyg^SCqvJ=(M=%cR^~=x)d6n-+-0{5bJ6%3dlR6CB?+FW> zdnGzVZl)TX0JW}j+?Q&N zl*e5x>ls9x|DCA4TQcg+UJWo?3bXu9W6kw`T&Y2M=2hwJt$t>!+j)hGF74$fw}z{S zQ$n@m<)q27Gu}gL2)*#XztOG-m?e7@%3A=g_C`naJc*#Xq1&(s88K$DF;?;T^o=Ks zdDpmpN&OL)q3?yEB|S|1{?peX0SSuD8;xB%rbTc)&sXpbMbTQ*3=*!%Nn+^+unTaa zyFnXIK$7iqe1q*cdZ|M$>)^TLE<3YHDfSvLC~4YhuYx>Jm@84o3GwOC?$m{WZ_|zM zs_ipjVrNKADbudg)w$9{W)imt%W>6e80lQB4hTkrhadqw5BU=0-2)W~fu-ALT^{+) z;en@NxM53Q(}`joSL%lHdTFO`p0k6oII5^jwNiGo86F*tq$O=x_W>u-rH^ZqMRT9) zgNcPdeNcKN=Y#17kw|da&e;GM)${g~aJVdILtl!}Hal!=XlPNCIKi*tlh*edc`YiI z?)oDAD2UCC)ep=&gI!c~p;b4bQP!^WI;OW~Y9!xzD4uw{jm3-W9NfPlHW`>mu`=7Q zKJ90d(kP0kTP63z1?{G&?y?Mn!@xG>(A~v~s!>viL>29;UScyvnd4A#$P@#tLJ4{sQ zo}!nq-gv6pjd;GJ5Lr$oJHM{L{W;i z4OO76*N{hnWjyM5s0H7SX(|WW)l~;Aj|Hr4T57s2PB`f*Cp&sm;&g6dAXsNY0xFRg zR_S98w7q$CrE9nYw#lJ2`sw)R&gTw?p~?o|<7WuyKQTeFVZGc-{;j*S)i5rOC{~;> za3A{xbm;^6E*K8>#7YQ;@#Vcf-ZMIho`b!lOszy04O?Zj4ow?jy_oDQgf|0u8xI~Q zpuBSaBYwYId_PrM9cVce4PbfIY%9Fj!vgsR>Cz4};XTdts)m@d#h}wY8Q7qC)Z}Cz z4qxwQ7&v6xvH}9))@yJ}5(KS~$LnAvJuWRZ_VRrVp)eY@-U|@ zcZa^jzi@1Uw5}Aq(57mJgOfg28qM$CF*%EN+$qVYTdsR(wlzi%M3_@X06Wz^8v`s+Z^C)^X6@NWwhzZR8O^JBv`;ntXlS6O#r!!n|5UUpTFWg zG5p#KR&u0)m@OP1i{xLG`q}k_C?hRJMi>T4H^q2Iyy7sm(YS~j1MM@+Q|Y*J@l9*tP9(>J@Tcma2tal zFZJ)#Xu3zMg}oX6M&#A8S|6v;K%RYuP}PjOxP<{|7dU(m-rgsp`W!a=42!BMAjxzq z*686Pt)ODPYGrqT@$1F@=%Jz{0!Uv9pP)qI<#VZ*PV!!3pdSgplVH$qI(wlO(HqR; z*o2SX4{sjE|9c9~{$Hoy|Nnz-Mn;bR=AWF_Y_FkeN0|OX`2s4`*n$9ugkA$;$NDf0 z1)|xO|-6OdE0rftsFTwkn3lK$o39W5XIa`0qN_3Zb^K0hxn zKIHTk@qYdf7kHKN|K$R&9^?H72(M|#&IXp!hbqKR>hlFmym#Nb&Vv2uKlZ|(BtgJ& zNWaM*P4qO876iV(wxV;c>N$&$VLdU-?j@pw-^1V|GfRtE2Rn7qLfR*%g#6S&zTR(6 z3>0}KX$|JSnAZL#fgO; z=L*QA!~ub{ifJP1kg)n1&E!^Va2xy>q!s~C5nH4WbE;#$Y@>VSlA&FB>w0#xUes(a z_bxxq+=enkYqG7tw4fU0ls<&c0fczQw*2Tuo*9c{l79&~(Z6RqYr!5dewVKV)UE;$ zNcxNd{*Xy8;iSYyxv4f2P3B*1+0yP!pe1J?>C4IfInaz4aw$Wukts<1XOi^f6w!`Z z6rxKYAXb4cqB^CDjF@}I2`f?zBT1fNs`R?#XjJvUG1X0h%Yqrr&hz!ifXi>fJJd-W zg9c?xrU-^6+Bs;s4uZ6D9Y*30NhYOb74M>o@k{G!{SDaAk)WpIp@p)~!MUJ?HY~h+ zMKtrt!8w2ZDXk;!9DlKT=(EA8f0wWQzzSlbO`r?Ly&yM2^u+GdMSGTc<%6*tdf0Ex%(Za|6E-v$50kG1bTtshWV1vjC6%qp@P z)mb7yVUz&VP-Mg!)~UomKvOov$P;n4aTPDLnEqEolS*9lu?9jI5}+#a@GYraOx-Eyr8I| z-y!;7A(^>dig#moKvrDfREV{$hk1}4DAq|*;k0S6Lz9NZbwhK8)3(5(L=NNAH8yU? zcJZY0A3$+*q=Pl7#7@v1DTyeO(v^M=)hlB7b{Ingx=0Pr;mENWhym z4$HX28~ehREixLLI!C~ZaJIV9riUq;&LFBBotk}0$BKo0ZF-n zW6M$s7K@uj5_t*ZHBdP}6uL8eU*W{3j=%5aQW)|LEt0Be5*M0f0FG8OC3iHW&^t-; zse&9bPwQNy7N+5PsRhS{l3MI3lI!ByH2a_?sXIptuWRnQ2tF64BZ>fNrJI5)rJz#5 zMDcx=k4zEv1s&2Nq*eIEMPRhdCCrnLJvMP1N~!c90i8ugQQWTK4pUIAQ%o@o5oZls z%80}y7)cA=vJ#>i`%80DGaaT&Qwi|iSQVS|`qa3=w*GDV24+zDZ-LhSq|4zbFNR`Sn>=_t^jmlsz|@wm9T+X;B>GR~}4j?D)Fpi3l5{7b_V2Xk%%r20To>fOCV5!1;T4#Ivb( z%T^te41&*K+J(nOTU6ZZp4ZgLKm>+#T@UUjm{)C8v3-Z+=CDJ5*sqW*+Uk1N^9I+o zSJOTZyA-_k;LqYDMrB}qhn6Cqy)*Ll0#C@x%6Td(Rfn^?Ar$EbHH|veNr;+HL)(TP zrL2I_2IR~mei7)FIt@oj3jzisU5Oh-rk}|<@UkktU6pB-|#CVCjtc)d9h}sqIj-Wsn0BZLGZtXk?chv{sx6OL0_Fxt$49d53%JOM8 z=qC^Dj8N)ZZqGr~D<5ZeeD(^sjZ5a9JR@MMF3JijVZpXJDF}bHtqQt(4j8*!1@`h4 ziBvcYc6Aygt2uYa(5&7L=vYh-e9Z})QCBju)dVy9sijg7E98p`sEYTPRz(s0t~Pd@ z$h)39VNI4yjwF4bU*?XPY6XRRu2n<{uRk)fU_^sIHx!}1nVUGAoX9WqwI==C367uL zJb5M8AzrodpCxX1^-6iGd7Ay>YZ#(Y7FM%%9v?#h$}L(oGtMq;HPlemHGFjY6>&X_ zEIqg6)>Ls?We4y3z9o|?nvT-0#z2o2Yx-pZIQj2F-GDc0ts|sQ%&vB=joVf-}p)K^18knyx3h(d1oe&?Qs+uqnIHQY(8_<>zaq zCBks^%*!#Pe1eX|Fvf%`yDC_$HjACiW;GpV^{!b|AwkeJyFd}zn6`EEJ2oEPzm{{< z6vfZ<4623Pb_{iVem=u~{gMe`jt8KA7A^}AM1F_6nD!pvrdGACu=_rovL z8Sd6BD-%d3H(Ax4>{mVE7-E8R)5Ans;Nyw{20P0VIb#~!-wagy{9=T){y=|~j-0z? zV~vz3@a)DSF1deyT))ng`+pQVfH87&7*ja_8>j!Jg2izsX@hp}I(NnjRre=dtm< zh^AqEl*E!hFX)Ltq{-+LntJTn(u6g4us5~gU?QO#GRd7&Wn$_C*aA=+B;I4_5C+CI ze)tMWX&MO9q=inKoB_8NJjYUcp81`qZutwPo$_pB{4J92?{(L5=DeY+_|x7ud0cn| zpF4FNLVA($KtEq&MHg=-Qa@=x3PwnrIG^S{^6|N;zD41ldSZd<{H!C zy0U40qN{+yQ9oVZzE_rVZC7q?|A5h26LgS%+%dv0cRw{= z-LxN6X+e!q;&gX32BZ-wd1>5t7M8L9U%ahdUy-&(3$Pg;m@di6id6k;m%2HNQnAQF zshJd;pah6ll{SCH1TB8<5|;}u*o=n=z&j;w);n7}ns0L)AqYH7CKeV94E2BP>e1~T6_;6R_+HpEzKV-Awg_PRdY5NZm zpsBa6AOhsBh(SzbGGaBd?j;KNG8bn3Oy0oy-)OA~A`@_qR^*(}*~j?gWr;F-Oe;qX zs3QC4e}|6;FJ2X|{OVSU{a`cti88XLbJ|vQCrbSg*N00@)E}(>s+`u8N7d?K8oNCH zzOnD>jW3i3I~r`DoAO*r@Ft-{i#ZVRxI#>VQ0p7~iON!4t_p`m{Y^P=G1}q55)Nio zSrRm=F~f!gHsAHZ>$u+w1);7gNM;3CPx>1!2hx>oX2fDl<{tp!H_t$p@4HcUXr3(6 zsN|qFhu-xX)=z$U4>48KU)PfDZY9f{v&lbU_=IkuKqH#TSpLO~R!<6uqeKdI7J%b8^T;K=)1nZ8;%X5p>J17x!5L#p@-Wd`KqVZy8CLo^aY z%Vb%<=I%Nrduj6JTLdp{?iHhsbNZ>dVG)*v=6V;F5gfqsJ0fFnWsiD`2PSr(4|Q&luHH~G)~=MYlI>1z9zYhxa%AB_xV{mv+eQs_4&b(B@#^tnl{QhWUw(ynleRtVb zAyXz?DLe)R1Xk180j=g0*!JG$ar5R$ru!Y#%8X9EKP>)$*r@mZ--U*Q;eS)|{@nY=ikvh}V4hdm}Kmu|hsm-&HA3XJJ(KVR_b!VaNF;97#e0Fk85Wk-t?Vop!ucyWw{z!Zv={yI{-(oX^ zME*xsCU26DuNc^E1+jJ`Tcv~Yw^#3)F%y5i^J)2I*!ulvwdoGVzzTjMmLuvI9)m4Y6>|aLm#_jzrDKd;+J2kpL8!z z3xYJj0D6Es?K~qV`re3rZR|osR0S6cDdNzma&Gqpl;b9GY zui3oRQx3t93*!r*Hm)-uC`j{39JN6qbc3e|HMUEPz>wMaXM#o9LNU2)b?;3Dk(P%h zu;h$RQ<*@SK^QmXfXUR2!jFng5g5k2Z4!C}7GLX5iOwT=ON+Hv7>ldG8h^7iVEt9B z3aH>Wr8TeViP{;o_3TBYL-;{e#d+GDlrn%&>kU1FB@E?7GyC%L#T+N&_`?`qeGZ~Z zHX&um?9mc~w}m!AJAhcV*=BfYDJ`vVL=|Aczc>#pk21*CCvvxGW-h9LMk{CYksDYidfYBTQermhRHTW`a*?h8 zVYd3lgeBt&S&29ORi%sSbTb4x+I6l(r8ZD-;bw6d`4$+u_tB1Gc^nr=5`>yChGdsv zXNiJ-K7n8j^d#M$i~%kQTg-plD`h|Ti`mCDawtdwqys$QjF;|0k@aU~o^400}d_}h^v&gK}a6jrd2zy^K62=w5D*r}c8g1?$% z6vwpK-bzsO6i_2DhY9O9&F8k)x%Ee8odVoSCM!3WKL~t}Ldd1VV~Ol9Tp|g*sK2X> zY9=@t{9gr|{K&2OZBcOq!8B6eLv!`1@2c_rzvI(qRQbp%E%__&07-+|z~U6rbyf&{ zu_NoiiE)e-#m>sGb1Xa4EUc*877)dHn^=HSZ07|`z&w~0APCsbKd0ZLVIIiNrUi97 zeU->(pGk}DV~b2H6y)PBkz6uYW(EbMLk7%`I)kc(&?O!Zt7mOB19_SVo3&|w_D?-j zq{u>=cB<1dLd5=oHRF5y!D#Zd{R^C?2;(b}>bhx0Pnb^s1d%rRMaNIrF=8`kf}jWi zaH>R3pPI-K^$_y*o<@M5Mg(xd0S*G=PY$qQP3OCz^=HS9n9p3A%oI)4pb7=oz+*!q zMG(o~qbO-4@R6vok?J|9cQmDg_qBb&zh6MjQ~%z;UkFvtVmym^z(7+`b{}uw2URXP zna0^CB2~P)sA;M4nN-j6W9wXsr{hOX(+~h|VFCXws!4bNyR-y;h?)lKvD;d7RTjkvXzylTfk+Tx9sG=u~T`8if(El?a}%oB5W0k3aOXyak3Oub-C-RPf6_&EGh=G zPmBn(dw?U}44!kHy5+e_I$*O@y*rzmxEGvI!Ute~9i*63h;GPc`#@T8UbVp;z1rFP zRvHzwc+Z#<$*ruz9pJ2rF&rrZ)~S2Qsd{>mMDV<(I7;r5vfr%I?Z+bhTo$y28~vc@ za9TP+@ywKgDSacd=&~d1$nlBGE<2fB0-{5kUDS**9RuiJ*JK9JWojgkW=gv08zt5} zB=n|3ijh{V0h7jd>Y*AaUq(6FajggIrfm$`%3c?zbkb@AwRGZM*T!3_t$uX8qgdQS zwf3N3jtLyq!sBJEG?7%iMRB$hFUqx+NuMOe+J7Ibg74pHY2cHbS5R990}UgEryZx& z*;(sFA|OeKQGUtEp7*!x&`Gn;%g-T{*Zp_6eJyk$Y*3H%U3t6f_2L3E?XE%rc-y?b zPkU<#Qux7h*4f4n%`QLM;~hUUV$Ok7NWX-fxyu{w930OB>R2H>Ex5xeCO0Xp{1Kly z(1xoQ6V{L9SD+0--kE43gBv8<65bKmzjCSi(moFhL9%w|@u2CqFWw^S{jW>ALOlWN z;8&)}a#9<%V*6XwG8(zG8m6@97LYY6Hz#XSz3Y}+J4WbB&VRicTVrLchpDxiHHK`p z*6sxSr+wYGgDS(oR}h_f;OMhKV<0oF}N9d3gEsR9H)&rnToGVHfg z!|h%sIw(TwJ8|>0x&7T5coo`yx~Sx@PWJMB^J?J8(}I%lU;X7$h@kRclU8y#&yfqf z#QEttdxP*u>h08ZmZJas>Rse3+imTfs`>spY`wXR zYhs(4G@Lx)WcSYG@Tc1>dYKUS>+4x~gcY6jg`h^gmDn>qU#h57Y$Ek2m}%&dFVes$ zE+OuvbW|UJR@u{cFE}96)~7fLcn@?cQ&}n!+W*xks*NcwD%vVpES+p0CN>7 ziHfOt8 zJ4!l$YwwRBGV=|qsV`ctns;szOcDr9RVVjsSnkC8rTFDLn5lB^o>UCSyA zBRQ=bi7#P^Mqys`4B~DE+_Ms`y1Cyf7}&yV_FR-bp>yV(^g(_!lHi)xu5n-7X$>H$ zp`|ZPEJ;8nT6XE?qgl=f!PVTpO_@Wwc#s$Ano&U_cMrHKX&F$Iy&zcxa=yV@PGYpJ zRaobaBl5|+kJ$R%SB37b6Kv_L&FR^g%4C2OHgH#M)HHt8fuCxuD@hvinD*}P){Jy1 z-0tvg7#JuWE%1At-I+N4+y7XlsV%6{NYVgDms;pUo>vJ3iC8`YB!j#$o?xl9I`bdl zT~;&|(V2L7<~2wNbF#Ffh zh2inArYf2^*WEzkrUP9vh*+_4vv-Gr_Hd8lw{4hRGvo$~JhWG%ssj;jMZG7O`CX9w zU4PBYfhql!=H9_KV(rOM1Qw?&cRktB*blURVw~qziwiJps$mXn+W}7Gp1xKbfmn#c zrnS+mCIq@jq{wqj1Xe3FAy%I_O$%j$?JK#EDdQ;#Fw-fGD4A z##87h`msGIBi6X|eD1VHu+2CikV4K_$Yz}&z1^;Uk8RLXbvD3Uh6D3;s#wiXPo+|T zanhskc1_n(yBqSO;lmncV<9pKU%OI*rsT}3jAU$wsi`@#b%b#OWx+<^L~#q|-xC&l z9t)D_o{f$@mt7dbYB$Ce*9G=StO8q$)~PbS#%M}E>}EF^a%AxMSeB4g`(mOAc4Hw` zO}~iUIq-9v19sp5IHza|OA#h8yWTX)v$nFofMx|L^a6FuXYts>Ew^0Z(XhiTk@gP( zu_ilHygt;X9T~Erx=Fb0TCmjq|5QimUw~8*n4p;TEQwrb_W7ND8gHw%Ih2j>LSQo* zX%bUnDyPaVTzjo5a`*UyH0WLM9iXKJEF>J(%|To(N`(UnU~O3zR3&y*Q^TLZ7ZAVu zh$zouYDWBdW6LQgzpe`EPJ}rVb~@BpQRoyLa0e0n=`YL>%hzotc~HSG?CNc~$9ce{ z-%;rDHA0mpWmxU4S^>Lt_c!G0*`V7=z@jAsra+66S(`;TUb<@%@(Qh~>)Y#9*XwJeFcLmH5wVx(ej9g2aXqSrZNn_XPqj+600PCFEG<# zAqE|%6dhJ}Vl(_|8`i{2pXG3cFdTm%%V?85fu>J2f7+QCV86|)L72RdywSp_IX?=Ij};oEE1nTtdv^XAjK$@q&-*ccWrOwWep)5J~W1uc@iBF73 z4kWcqWdnp5g4(yL^VcD?i+#^ok_uiQgGwk4Zwzo{09U}%U$v4B|gcEO)LoD(MA z)+0@ZHY@r@$Dgk;Lw)Tpu(Hq%Es{2ifg@O!C2SFv8Cxw_o2;3sh(whpsS|Vr28z#g z`KfJiKnEXlqk8t?WTaX>3Tvf|^Mq7L`;Oma>Ztu9j4!|m6#|RWHv`9PbfTA7?p!MT-I1|*d_Ahj0wBeqi>%2c-%#S8 z{T7@KB!+xH11WNYIAN9af|Op8=Ooged#AP{=6OPB0?TdotbFaLF;cO-lR?o+DL8(S8on~J{e~cw4i@3nQSlpaX zb$=|26cO1++oK;H6|eNu@$UD@87 z`bUnuJmS`P==zuHVQm9?;jWg2J?dyjV^X^zO`hT<%PO=i*3wjZ?W{B^ubH+r<#P2g z1bxNunsT45L?l9dmE(m*{);MgfBQX)qh9_JGzHQR~ zyF4((BG|}RDj%+cLC%lG4vodCuVDczJ?J2raxMrj z9By{^=fRI1(L(iq(8o*+|C^-{6aD`;Z)!UBunnQ-^cNReZIXa20tkZ#Xbg1JGPV_n zy=6m{c4Z*v@fBZXSTC-SdL=<`ZchDJrvCGc;`4S0h=%ghZ!(`Y95Nm@`FeXltarHE z%R0;V)Aspr>HUWV1ZD5RsN1`b8>3m9UvBT|c=QV|Pconr6XjPUyLejS{L~&ewF|yO z@2+xmzr6M0ZJhm+@Bop*hF=iQkFZb_M>@~YXw^S%+bAk z{f(T`D!h4e_*Kc5e14zThRt!_3<*H)+|T@!htPdSr3DTbL9V~h{coScN2muvzqk6y z<%iEh#*DqwNx$^U$>M|4UAmQai!y?f|7-&bXu(?8Pv z?XCw=4J4#QUIWiW4UF9m83Fnc0ryUyrUEr&0#r98@A(qbsbGCHjYw<#0g~L<6-W^iKwp;Rs>Y6p5oNuK?x{0jW>xxP>#=I z=;2lwd2rkSSORPC_GUJ!3Y}ZUr~H7+q%nlDZGz%PXn3r^8>Df}>yVF?bp47U$V0V# zk}w+Lwr$}kMG3=u6A|38(b%)xeKZGs&k7}AudWF2yT?pT#d9s(m%6EPb_eT;;QeVz zO@`CRAU1&n|Xs*9wYuWuZjMyoxD8fP=w4w3Ad=2*~O$I8jqm-&U zX}6tg+FkznssmM@d!WziqHZ-IYlYU4AeD8EjLR=w@r>T&GMe~R1q zA}{hjUM+d$sUlMgY6(QE>k|91{$i(dXC}sn5vd0R5V2cSVB4V;)mWhwYKqD!HKPXV zPlN{QS&b(q`z)^zn57;ocK>EgO;;8@RTE5l%}82m83;Tr6q{%n4V%PfD7RV6 zIKm1g+Go(N;M?X)%;gReKQtm5)ovNTbCf z`n*SwmTT!oQAa+NXl@9Z3Y%M)H_LaO*xJZz%bc!*me{6_$4u%(OR)R8eX%wzaB_gf zgmBv<` zPfGXTP+4bi(@8=#K{NOieBVG1xI~d?D1H7OuFP6*9_N@RTL!1R*9NuM_DjAC_bhj;)hUd4Z_C^aZ7~Qn0r8u4x+gNN$nPT+ND5E;}E2A1tAvq7E2xKHCQ zGZhUMo{Y#+A#tP&K=nSLo^JeFh-!>Jm&Mr8tPso^wTU0<`scPR@{>$_N$EnQtq?sE zLi=4KxlRclTAKn+1Vn;&y2CF|s@>;{r23u#MoczYYg>$bKfbtw%xtHu-|5p#fE zMtgkZtP2%cDDd(qJ0QhGfVb#lKm$B~u#e-_W5m++iz%Hx%T%nF)8vp*>4f6{1NQ9h0m9gh@c8yW{aXQC16(Kh5At z#go`Or%FD*79He{+=`p71_rlxoPqKMUsE$zs=15=G$lN=EMRU$G$)kPp{cfLmu9gV ze@Zx4gd?<5ha^|oh$$(e#A*_xea%*G+W`||skPxbt+Ix8$C|I0n&=bjaYS=o^RKml zjN1>rBtbZhr&dI;n%NIrUvSX7%(Rx26ENZ^-C6L zFjAH+A4Pz@u24|?eq#Tx(vDCbyF)5v9Q{5NMYMw}<4ev%MTQ1vyC#l$a}o8UOyvp4 zr*CawrdvC-(;rG}MTR++>LlP+USY3vl;*z)Jh$WV_5LvD=UDM5s#9*n5Touc_|;u@ z0ngF^gh(ObGxR7*9%s6vEU0iX_as3aGQco}(PVHzMY77{Qp;!a>*hHE-|c!(-oVvZ zMu#T2S^6`+Rj?1s8d9wuX*I<+X<6OA7R&%`HcEz!4_6W*=33!X&2`?8WGmEsrvM@D zBmQoy9b9AuYJaex?)f%)_7yWT&L=`b zN%~?ou(Cb5TU;dc<)X*J=4+3#YD@6crD(dQr4BX)jHwVtWuN^vW?Ecxvwh0&7N?Fv zUE8S!Go%fZxHe5mn4D|U!ho?u-r7*3kvzF2;ZNttMrr`{P*R}?!8VCfPhYNqcA3*1 zCS~Ae1r%z0%@+p-4T?ZRYMb&@HW>TaGJ=6eg|l>#@xAtc|3qNtIf{$4Zr?WzFSR?< z&)rzdFTvoAG`^zvMiB{|*sP|tCwCh0xVGe>}4#>Co zT5ylrQT^5d>(kAE12zLRfpOllFMuJNnAzX58ft*uhMwrv*Ea?j%wdNz0&< z;L?3>P>BaK+moStOtZimW4NdeC`51#VGb}H3F&DUAJbR+;E}SNWs+{gD87G9O zGa_q0x!n?T^DqgUIcB?{X4LTg&OAIJ=Lx;i(<%y~n9 z>^mDx%;VwPuAmsVH^&UZMSLCsmtAoys&Q~kde;uNy^R%jWjA`9_PaA8(yTXz z(rYhUSKT(UCY)LzG4l`oQZ}SweA9r>{R=% z4=uK`$+@)IU@CQXU{h(ei%qxc&a^}x$|MlsMvPD8{>=6O7zy~nNqql1%-3^#*qBS& z-M2wmov~b~Z}?D$mfit8|GbvvyJq@I+|0Z4q1KdvJgWWoZ}}1LA?4K0@13p~z}@YC zXcd@Q|5vR71IK?Gr4MUO#}c)}{Aa76Lv``XsDk^`0Cm(d{@W>ZTvv1(!*!;0`4T52 zlBZO3Y%uZD-?izal1KF7NxZ#`!q^gi2W2I(nGGHcUVnRe-${9YwRrtpwr!1N0F#*7-s;u|0ABZrU|jD_TFXm6>d!U`{g>m^7t!mvoMgY^+&a) zLu6>SceklI>OPY9=k#TEvsN!YL9_2tYik2BaFnUf70<0X53CN@>LUVhDobd7Z@*-s zOY&emd%6&jJf4`6hUpT|L)5gls6S!;Zi3WZbO};jB-@(DSF&qGhErcB6;=_<$IMbu zT;`R4&m69MYB0d|A;-8Ixj3)LFszB6cREP6^+2%28==hqJXJVn{Y8rJtWtgkT%3ZA zW;a5_2GO}iHP4K;1SEbV2(RLf2oqBgMFU58iMvxANqp_zdz_SMA1G^TD0$Ub{cY2w z6p~qLX+Ex%{$jpJTEAkRjv&0r?mf9z`Wqi+d!<3u(=wbM!Q^AgT0KJ-AhTSu~-pU-xa&YRI2R+J#t8w?Rg6T~U8ZPs1 z_F&49_K_qv8DNY1VU8HB=WS%vv~_TcyYACgC77#c*i(MRo0d52LA}q-?id|sJG)u# zU6i-sL)1DNN0=sYO!p8t{{6iBauYS|mA4GS`cwtvD-%L#_&;JUag&#UqjzsfM4EgV zT1wcavXt9e*~C22C+qGM6=V^vS#(lNzQ;7{GIM~!4s^x4P~3+;DNoR>oXxq2cLAl| zJYUz=I&>PL1uU4T)RsQ*w>#!iCE9NE@%+$={s)k`J~}Jpd_Ir7cch0p63n@^xRX>O zvz>tP2zRlpcnkQEZLo812ji!Cm)N>ReR9i_(DK^}Ov^b#Z^Q&md?+E46NR6@C62kR*CL=Y*`w%^3ZY(FC!=$tJ?4$TIHELf=I)N8bMpCBpRl2fX50qE3%pTM!^ge> z^<`2s=pAgp=Y^Ll)9?cc1ZS4u5EdkvcV}xaU9;r!IqJH75(3D=e$2T7MNdk9z=)|w z#>fa|*_`kkt12s)!AlJVHkcTkOw0(vgM~Zb4XtrrT~=LE!|)AzL5*F|iBK`6(Cx4jbgM=VLw{CCaCY-P>;-xa zM-fha7dOKmI%4Wq%3RJkF@~nn-WXSmk2KpVs)s^~fRY6gM zY(ebfiE1a;~dx|R8X`pA)?Qaw@vV{ z0xyVrT<3GE(GsJ46NQ*VdIpA=W3D>Y!lK}_#>U|ozoem&S8ZT>@qoBGZ8#M2kMyR0ZY+#jbqAFll@0CX49emW82PEy zs=&mA`XNZ= z|B$*R>B-OWDdgB}eM$cFxj#Xg!gyZxs+%sUANxVFJ?z$zG^EAr#ly%+_N7?DI& z`va1x{RGKE4%MA9UotnN-O{Ya^^)VBYj%=d>$?MKpxuRbDCpHhEOD~UcaOQsNPAE+ zI&(d&$Ad;;dw-EpdH>xQyLtj9GgZ;{Af(el7$o?}WF-{-&c`!^ z&G!_>bas9!bu_iIWWf;iHm8$zWva)QQ;Oy=`Ov7JY=miPPa=dQrEO)~=0sq{UZAH< z@;TWo;Za-~(Aq9ed>WUw>cZnnB~yrqS0#9f0921<ou{|g+XzW%<)MwFsG{A)Cw?)PkCfCtaX}d@ef!~8 z@rYfab+$FFFSpgh)JUc$Z2n@Zck!06yuo6Mtp29wY+G8UO504+mrHl5 zQY!xv4US@y$KD>pxPL}vIJvepuJ-2Tb?M?l&ioD@9O%+4r?H2m8f8MgnyQATV=^9C zs3M69aIS%K?%x4>>d?*5kqElhUPlab{C_g)uS+2~Gk4cxvLfu}tX-}8_^|A6MmRyY z|GN9%8R(yg3=;UTvSR%F!);Y6MaS$?v{k~rH0`j7eNHcf^rOpb{}xFYB%U^eZ=|Fd z7*Tm_O3CtS8Xj9q*J~giW(d&FUapo_@x2+BP)c5)v(HQG&QncY!GI?arF-Qb5O@be zdKz<(ifvd}yk;f1PKyirGbDe=XF#%f8r6TD%-7D9<2x}w3P@s@^G(dBPt&S>oMBR_ zs-QC*K?*LvBbcIBVpWdhL6fF^AnAeQHqBsCzBiIdqsBl#%O!buJ)RGy)k->Reh4(Z z81BF;*_I3u3AyW`O{R;s_pnPs0(+nkq(*W#YL9<*(dLF%3m3KNPJdM*BtLxc{iO&F zgrOudo@#1|<|0K6qg$K=Ha&xxTaV9SVmU{Ew+(}e-ba&*5Fc^xM5D&K{DdRVBybD* zeFO_Fi<)Vn6>*sdUU2k1OLKpx%Y~Ywc=~j*wBr(o;w)Irli7zFUwo{aO^A?swU}cw=hNh z8ciniuN4Qj0?nDjRx2|+I?0w}sV1?Ry@o+6*bd0e`8IYGniNS2F$brUnzJHMy8G=b zl;TO=`q_LO7HbraIvlIv<@`Hs?Ed$e_7Bh@Z%g>U&M=G&jQ_0$3o{$ze@YXy=t$d9 zcm3WbtG~mGpuV6XxGU!O2)MQVo+d++zdA2GX8Fqlkv5&g|X?>EEB~W{&cFb^gAidjV1wM%#Zh=>eza4R`vIi)!t=(0|oyGO5ue*{(LIP;1A;y z0}6S{PR=E)&zESvV?kP)q;je{;FuTypqeEJD{CyhJrxycFjuM0XjTDHV zBJl%yWL?NV6vYWa+QNT-OvmBZ(>8845BIBsgOrn^qgjte3#kN&fG?I_JZFw9vjHu+RB88B5G^~qJ$L}cDTL#3np zyi%X4DrB)rtY$NLZ%cof8!_-GYOrzMz)#qcV8OFHFBNN?pg+?fXaY|`RCd7$C6g*L z##I!^`68~7Wpzw^!(%sm7}?<$;C*u=FaZ#_QA}gE3K60842k*~kwMS`)VEgZmeM>} z{E&}Sw?Kfqrq~r%o?KDCAQIHf{hDn`fQWR{M4eShQ}wmoL+e;Hr~3nzKwej-lED0C z3GSSS4B-x=^^i~^vrlZ9OQS3ZJ)%c=UwvhWX$c&xdk& zPa#7?8oL9p7AZ$SJU8-fI$z)HTIB?KQ}s8a@wSNnq;qZ#r|{ldl87W^NEVaUdeOz% z4&f>lZ%#s0JzI1R@`et-q<*&HgxiJ7-iDWd#fJRBGE3+tAp+&-20b2MmB*QFgh#@^ z(=aj`lL{f?nxV{^mC8V7Ofq3_9P$Y8m=Af5Rm#&K$@X=*vKY3Pe5J(9rzP4_94pdF z+p|ltQJ{)WZL$;+6}A8dy6p*UM5H+Km6TS;rVZ?@gm4;eI0aV)z$5YNrpyRL zWyXQj&AGXQz7~8{ZisZ#Az4`?qFePYX@0V*lGR0BDW*OoswmtA#j-jaYWCQ*fm7?G zn$$b6dVLqmD=(C#>~L{Zoi`fE3{(ov4S|YO>MF(;+HP08dsPLF0CXm1wr|8mkvM6% zwqv@(gbbCVQU)x?q9T3tBENWUu&e2bqoQBi^`)z3uA4K$@V7?SvzU{=|rbNLV{$41uG0?Z&z62rc zZe@@v)R4#>2&~yIc@{6xUF67D+MD@u5C;%U5rxn?RZ(OZ!$HDeb(N(fhz_nMt=Nl& znVQqyjjM}Cag5%bukl@iKp4I&qEl3_ktJalJhr5sKc?)q9Wwtfq3IP}r>c7*+}+;+2*kr9=EysyD&3 zO+oGKaumIGkT=Hk=ADx_Qa(^p6(ap#$O=>?wYfT>J)Vw=1s$?BlHCWEhulMoRTGCx zZa{rz04a%J#MMP4aZdX5rcSYt`dfZKg!}1)U}{K{&`v%R0JdE?7CE zwBo%5996}nyUPEHL%S6{e8L`XA!@CGH0V*}-ycqAVC9rQZWcZ|DJ z-r-=IOO#a2fGM|N28>d*f^g92zh6a%(WWhf_*gU>nS>2e+}#g15Q?P0Tw=J)gG+K% zmC1}!1PtC3$id@cjT8%gxR^6lxHqKm$4-+IIk^&42=oAWqZ|T?ru3FPk%Wwyh$Npp z991ncV(CI;3$&QWanKG&sSOI1TW$bY!1ljnN48a@Y)wGn5au2HnNGF!rq`$&@|Q2a zTTaP_u(H3I$Q}{K5@ySt;K5VkGjzS`a?~GnHZS|=|IgQ|sBVu!0YRyHs1 z?PL0bakx`zZ=qdNE92~3BkR7YcZzL(S-;YSA?%paD@(!(DK*x3z`#-D^@Ki z(xKUlZcHO5;u!VX>y`emdB-(ee(IS^lFBhvUC0+k)&3$96)Rd}0-RPJlaX%tm@@4> z1ydQG64N4p?-=BwQ)Ph?9BTE-rpQ6)l|(r?(Y0;p;&#Y-o_cY;7n&rFg_#J z_uXG?W`cT9OP1hA&YH*b@jSb<>L6>&yLg&WD10&3j7((>1I5)@gpQhTizS6td%@>q zL#sP^7=s6obj4bwSlZt2mao(KIq&(d#$Toc`F@c`#%sFO+tau%MPe2eD?0+S z8n>63n)CUA_*5~TyAWYP=bufB`l@vJ)kO<6n~O>fz(FEz#zTJxWJX+!k_gU*Iu*}Z z4@y#>&%yXU5sy{_O;X~Ka{-m%PuAa6sIM67x4Fl^lBCvC3(nm4AoC)-qwhB|r;i^H z#4zK?U4aWXtsC#r#fS$u5SMVsv@@f#57=^^7S^FkX2|h_@uI&6LH0>zQ#F4hX}vKv z>SCSW02+bS$V2YdT8JfXzOz8i-uIo+=b*}dP~@#Y zIBCwdICbb4K65g2I)h3A$M#lY5ljI?RV7p82w@)PtyV|`+Nf3ckW_{Du_{St1v=t&>dcI;9JSJ`KZs_-Gl zVX77S{+8(9>-6p~NJQ_eJRVGzlaXRIlCFnv=Je>AWAg=aXKvM(N0Qz9Gr0oY_h9V; z3U9h`EERM%?=S6-lSNMLZE))u%<7C8Vl+FlN3bnL!yveB(O%qfLSGEm-w`bo9O<4~ zp#Vl;$*<;VFq`um8PbVGCEj5{)yw*@y95=^q+b=&ri$4^$vB040f*iQY?pKvGZ;Nx z5uX}P9ZfblnsV5i2ibg=G)7WvTOcFoMt>{Nj$5q|Ee#bKcve@@@Y*MRRV1-}@@bIT8lYn#IydZ8 zz4L9K#A~1@d8FP`#UsFiV0kFn+`4g(y)i1)aCYg1<3-B8Oc@Xw>W!cZ)S}5~bDkDeS(aiR! z%n9xc8@W4KjI#$9I7kgC$JI7EE@uEPzdJic)2c&pQMFE#96+1pwp42 zH30F?2T4!Al#WwhUr#3%m<6>vEwk1Bq&$>wmGq9+a=w^^`F1ldx`j1&=Udri1HkJj zd{wiS?rY23$hdnHET&|YF=dS+Q&`t+`ph5d>y0792{yo$_Q6|nJ%M+gY{d7;ZuxjG zV}sPC6PM0fuz2N*uKXk))>PzT*3_xW61L|-4(t*t{DZ!|M4YV+QF~6_hoH1iH-|3d@qK(E zWX?0~(So3Mz^O+ce5S$xt;w+*dsRHIV(%~c-mNbYQ}$V?AyGy9>-_Iwp!n4XW&0*V zlX?dPYEh&>c^1H2KA8JEiv9k2CxEFw2g|nd0DUt{d+1ZhDwLZ;$Gq6SVJ+HbA!zPZ z$SVSL0gH~(0NuQ^N@Qe=RNGewBNC{hK(hbEg7s01m>?ZZ8V+bf{o+1d0op1+GP;F zyb#KL&BHV7-|WE~sF-IGka8gU`6>#FOZV|X>R;9nqL0XA9!h>yA#hM=UQd`FO580! zkHhv<1zIXQxZr`O8AE;)HJe%*BcD`KpQkg<>FQiBOewIE_X0C{2z!|jWPrKYEAd|N zRma>CpDQ71*>!mcl#+TPeJYT|SRqUXf`EfgQ3TRO!sLQ$nGp8)l9tj*=#OHU%;6BK z4r*?%Fs@X72%hO+3e~y#azS%}mtt6>3N}j)H4`cP(?MtcF8NS^;ej3#hOF4>L})Wz zc`#QqVFf9*qXO$Qh*a!Q$DJ21^B{qzTJ(C;CgU)h7uKyVn6En)eWw7%FkP0AeNtoaS z$a1s9XmFu)DzE``hKPd1GT4jEYUpNuB?$NrOn3#9Mzw#VQWPONpbe=p0vL@@Nmv1! zC>k)esErg!0>xufBv+Y##!$2~RUsP&Auk{lW%AO6)^e$2xbYdq;PcDa5wSB53(c zJZe$+ruFZa_rWI>>;=+;Qi22r@C=517iLL7?h})c#76>&uG6BD#)KR9fNlrN z{D|11iz<@9M-wJVt2~79SNnSKjjVKa+J3I=cJoLR^U0!kP zc(#2`UHYMYSJkQcY5DYhnttExoRsDDmG$}Uy!}*sy{%X-wP35I>CU;%99=r=xmDdZ z3n8mxK&ii(;8yw#CHcl?{Z%J0js@eJ$RN|d;UM0NWlXeqSgY&(OzRf7n^JBQvTszW zda{`63r@8nn{b&3OsM%2{b%r=9ehpGw7{jv{$LXWEI$kK&CW7_Eju9!J6S+`X#dY% zC7L-XZN7u^JW%v2%#v=%eAnA|P zWLqUzk#n8reS~wL)nzW zGa88U1>SiFMcrYGQtIw~7c|uO5(@iBn|wSy4R3x-G22Y`nyW3`sv3KL)&Fp@5i69 z8gFPPoCH0S%+QN{+PNXdEZ}Y_%3FCjVS;IA$m|Wi_#n@!cSnlCdH!_!WXB(uT z0snb8Y%3lDDEGSq?DDOaK-PN>gpy>xB{*YJxtqJH+z#%wzO;Q=dUNZm?|OrgYD%{K zsh9?*#@Qld@L$>-t=W1I-VT|0y1e!Itn6yOd|s@S)^5#P!KXw#FY(Ykhm~cf9BcpB z0q#xZ&C}Qu7+|kbR^}z%Ta;Erv9}-eL!%I#ixpnSdd)EHg))utF%piLkEN`wqoS)e zUhEwyFc#s0BmMnH`5%v!?mKuu&5+{=5iY!}cJ;#PahNS+rHE~WzRO99Oq62d^SEE+ zQ4hJ(&!uChP^*zRZ4DSK6aRXV!8+?dnVVbDl&O;yV3-^Gmx%s`E;2*kfg{;6- z2lSzBlm3&vQg0QY-=V{IF#XWVtCdJGi9Iws=dWqO3R+(H)OO`-b4mvKXlGuVWe@+1 zL9&B22~gy!F@~iO9dItNTfe%5?y1G?#`U{!xq*DBdE{0cSM}KJ&3_K(h~N-ZE^W>w zop|PCq)JcvG^JP}rzk;+7U2vGmIy&+2e04P%T$IP?G4dHbNCf?>h0>IMnZuiPZLu-a4rmK>z0j=i0Joh;5f0-+UwjwW^>>!R=b_5B2yigxiQuiVxbh?soQ8qhDw#YZp~*m1!E% zPgLxOs)o=>YT5i<+M8?_4^N#@S1=s!2y4;v$0m$%Mj(^7t)^iqhOs4<91!i=8q5to zMJW#GlHa*%{e3Grj9*y&i0AaFvUXXdHOee6Gf*qv*m^DdugAM`CI*J=-_9m*Du z$EC|OpC~`yuZE4$%4)YhAK|_qS8;ydN{AruVr0o2&_IDhM=3kz@+W9ljANuoZ=SXD z;gzl>i){V(8&zr3ep#)Y&@u7I2-EwBzo!8{mRaBcTCNA~*%!K*iVAQ6Fgh(t{#g)& zoZH$R7Fo3&cS%A1LELWY)DbVW)x^(byEUCQtm3q&)Zy>N6S(0aD!HgsN5dv>-8Y8# zTht7h9Hd|&r_mT`I0LXX9~h;I4d8wKi8phEY6F8^FzHgKl zkd390VYM`EGe^?NS_&-rwMd z5GtmYp~eyKt~dt8Qp)u6ew2@dUnYLF57k|!g_b}LJP#^_ypqmxnZE}-g^S@=9(>ke z!fo_ljay$4m6E3Iy@p9xv+0A8+v|A15wtwhE;i?iCZxohS7p3h`2WTX{>?0CmEr=v z?c8O#9>(!(Cpbe(Kh;9ia)Or3lAMM-W71w-Dd4v{3@QoKSC0%j&hBGH++=STqe`q5 z&z(oQ7VM;)Ra%;aX=KsZB&LtRR5d4jE-vY=y_3`_b{Yo}Ds1?DpU#!ODUz{<7XR5eLJ}@#bX< zLLS|5F8sKOC1%Yf(*!bdTR=2Lu%e^uFu@y;jrgj2W2Zk+g_tB=t8wir2Z-tu-|e@% z>?S+ZjB5=A^puZHA#;0aaa%4BFIK2ayNsJ-B2@!I3!yxjM04c^4KZV9Grb;=5}=>4 zuR+oC!3i)Y-|K9@U92hFz2&*4`Z!lkh?-hqv(1x!=1?D-j*H3G?HsdAw#gW>z#N8; zlU4o*h9{Ej~lN8Bof5w7XMCTJSLtLb9L4u>C{TjA=zMKKMhO@dE> zvRZ|3S>Nli@CCcH>@!>{KT(N<)1^Hcn_6Pnd*MgSTE|X)me3aFb+*Dk)cT7^ zXX*ZqNz5@5XEVOlYPKHe_>rk&o`C&{Zv8e( z)BZyFvOp5m!M}k(U^3c7hhi_ZxJYHTV$wQq2pozjycoJ zz0$BZOKv1)JUJ*+A?-wLm8Ie0vxH~H8NCeGDKFkUAKfWk&@qiUu;BP0jC_@0hn=u+ zh=U7|h^twiK#HH`)Rydx)+gy)g82O?Sq9IU3F^#gGy+zR0EU&qjFW$w+ zH+m~FwHSVA3Plc;D)-x+n6SX6d}t9BBUfU#>D$ZAq>|G}iCxf?l(10JlM-duKjuz;M4X%FrSw%KrSDc}or{8)l#mPNkr-F#$$ zEMJ_kinT~^kaOD^?d6&7-VB$vm^+tfyKXmsq1jHuK$)%6%~T+>sXp2+)!hc#pq!gv zhVVHz#4e)&&O<^y3{Wg4i`QESq_w%8=!o}gql|nRLnm!QVfdt`i40nNknV73IkAmv zsMwf&u|Ai^;*IGL)OU^BdTHFXHkDHQ(=B7>4~RappBVcx9(JYcQTOSyK6ls*h%v*y zr0KR1@DkPty<^OKcR5MdU))G3GzC|EwWVSEy2Isd8fgO{9yT^VVY4xCGj-Cjd$0K_ zIX0T^d`pa+e2E%pk;m!|bMx8FIbKLXHf3hZL3j=%w?0sFBIX8Tv+;X^l|I~}zPbz$ zduUf;3t)?lfA%+8JJuh#R&A;oF$3b0$>?;$CiAj`f9_F^jLgnV z!siX)OVaps36HcEn(RDUSX>%YBys^`*<>|i@g1ZOaqENSmV#9h2jKQ8>Sj(>mw(UZ z)n((YYp%ToF`sUq|NJ{)8=$MvlV-@Md~)JYaNr!lXciQV=F(t-BWEidXB3q)qSC-= zJ%rCyZT56k%)Z%YV?Lp@W55BXpo`V6&1sBHAW5sl=4GSc<>X*c~q=p5VF@3sIruHhyNQ_`0NW^o!PCpssG0Yk2=F_WQPOcmFn0;q9qDBzE# zMa9lX15fb$s|oH^MrZ8(A|j63Nm$!P80ABZ8hX2j!4nnN5$r7mcdeTbYA1gQu3wX8 zM*`ir1twPB24s-DLd(~DtHUHyJf1Ffh5c=D-S^K{$|9S=|N&DZI++?WxFn)CdlfRzj)5YX~<^QbFtNwkjS7%*fr zgUk^#Hx<_`WihRP-a<=&9c7I4nc~UWY^c#So={iF(GL^$GWBM44*t$U&ekV0H5{== ze3AUc`~CItfKA&5f5>amnUf1PM_Ti^N%Ztw$2Zvxt*;x`j!!H zMrzWvgN_@ea;dDYYR*LI;KM zEbR3G#?;>^l^$qD6ayck%ahSn7e=))g*7KS9Uw7biXIgL?s}&+UY3*WBR+=bMUMd{ zZbACxEwtQM2PQAWbW)u*vf$8OEMWHQeXU z1Xi{gf)k4av`(_r#!x*=idCa!O$N{jNnt2>Q!eF|6Q!WDm_0z^q=uCeNlp=2XN!Qe zoaBalpOVNj+I1mQ?mM5Mg0F)oUm05) zw&oyHfSFQCmuv-Iz8P^Y?cc`!dG@HupE;F3OEDPBULcTad7N@8&%E9qPh< zU3>OPf?N3@kx3HqIyL1`l43kWlg@n;sgN~Cy}`fZ+2*-=8sqtTipVX*OH6k{Wx$r zGaDA|oOhJ-#P-OOD=XQ&UN=W7t;jp{9IZv+vhh0@5BJC2eCxQ}1c*{n zG}86`(`CBz+65W#_6UVoz=4cc;3nAY=lMiEGkO-}qR%?z(vl@>uj63hS(iBtZ|zn( zWIi|6zCDX!2h1P;%H-skW@GF7XD|D1YKSS>ru@wIX0k>lRPWIq_|%MRwtUy-$PA7j zrz0gfc=6fM*4}N#=O4 z)iY5AbgcugCD8Rh0GiUclmGf`&dBiJ(-bqau>Gf;agEMIEp;2>&KdRdZ{;C769lgr z;t%%t?8FwR=5tSCcLe$?SzjJemN2SUJl@w}d`T6#YQhMX9PIMR9JCI}U+^?ZT{84w z__R6x`xyO)hp)?zyFGgTA47Tq(Re_*y}UGPje-+rK+^t-skg7bK1s;iQc^xEC*=oC zN^jZ+k50jFY(6`--kYVVszs=OiF$*<_z(|K@qHM5D2M0|1|I}nIjHkb|2m1>1UD1;nKxueSL0I|_ojCWLG)Txv6m>l=#+Ot=y7<*F zYMc)~DT1`OAR)+wPOWGWI-E>NCC5?^j1kihxlpSnY-cVGEt9%$TWMocp*PRKlSvE3~7HyuD z9?6ycbuOX_n0#%j<);2w;JiTi3G&N3{p&zMOX8e7?y*n)drn4fbiOA;=AcS|g0;*l zqIEvh%%moab*5^M;X>XAnBTz%zW1z^&(t#Ime8F$E9N+)Qd>ZO#H zg+YQWfUR=U;|XHB#Ph1D?R`N$>v4}EQ0OQUg3TRjY4?oLTzHDA%5tkD$3EoE>!NxS ze~Atk0&j~X_C?(L?ms+(fjL?1p!~ zA6;YNyl0%F<9baZASnX7Ttkb_i^d)>$9rI@6K6Xx$plnPxD*mNNbl)4<#a=5;2C`fSw>1` zox$~<&cb#`_tQh5LLFL7p%mFs26oQV&hp0N5eg4q#x1B2t^Gu_?6vYpCNcQp!)Upp z>%%bne+>Lh3n;)`EPaQN-RM{siSEXZp-AE2-rG7zS$&l6qxmEC2h)LpFpfIbjEL)q(Zq6 zG(7gmt{VWfufG>*7f8XZRK=NK`BTazvsJfrexX(&_NmK(vUIz_-{vdBRWXf?!hBN% z*-IlImWM^jGd$A|5hK6c4sJ;kgUNG0mCOa4Op34+lT|DrJS0p6SBXp%C->hdpA!`F zAWXLBZ7I}JMiSD?Ncy@Gj{8oMq47N0$>_*dpmMq9f>w%3AO1pdnT{GQyKdFLj&$pj zq$7d@m}WC5oyYDa9GIv&$P)SRN>;3*Qm0ldU4tcx59;m1BX!?usYMzm@^w)4b&AQ6 z=Yt=PtaSAI-5d_`k-a*E^*O30T%$`u)xDy z{$3SBVA{kAz85@p6FUEl;nI>d#0IrT7AeN$Hltazp}H-^0SCWGZDC4=8ZNA-!0$z? zMFi`YF2eglRb$)H0cfh)`r6h(7Fzu@x;7%!j%})Oy`P#~?Z-G=Vnev#jYL!gwiD*A zWnKv6DT3%vO@BtJr>)Fcow;ZM@W>WIVT z*IG^)Q?sqPE-MK!BDF(n!Zy>F+AO{!)Us0=zG0G7`vcx0E7%6ae@#{9h(Z(@+iJPc zoi6f8A)K}U(BsM#^jBjWRy4ecRF0GO0@xsFY6sx)9Vb)`Oj`uvD(c5%2WNV(O;^Oq zCVF$k>#V4d^MYuwoa#gIP=2G>rVO#Q@!DAea#f<1yC2BtL#NwPc@y_6OgeM!m`b;@ zG&oyGwsh9ee(YgYzze6#G1RSQ_yllPqK({c_F7lBRB=IGajK$g4ed7c31mu%`30<^ zQ>i}l6y&mG^mA0+V;FeLhxf}*js99gJ~d)VEs~86v{u{_8ONAfwPlNAwy3$gHdUM& z0{w=q+p3Rr*E!n_j8O_{ZXk_=(-C$^YwFL{9O+<(FU$Bc`z{^Vb|k>@%nwE*W+~{NnNqHV5NEl$;n=@9`T)}=*lks;wWJ1SO8P$@V_z*W#+ z^Sn~yNDW6|iM?AVWPG-2gE8B=neG8LRpxZ^n7*iOA~vV%==3=aN=SEMdIn{1=ElrxLBbah zyRj|C;mO53=Y(F+hA+*OuLNZ}PQ1)Am%N_14O=%0>#k8J_0sn|3w@);Gr@r(KKBCR zd(iTalrn^PByz-&cPyf40q>89CYlaKbD<>jo(;-fiJr2Qb}D!Ci1-gq@~3c9ZuQ_{x5VG1s=R16``5y7((VRguR*wu2ykrcpQ z;RX^CUf#5ZPc_fr?JPjP<=vNCY38mFe15v0tI_;$IG!;{yCcP|W){l_4J|!8Qw$NJ zCp1!4Dk>kvViAZo9x5ND3X;t9bE|E^C;t~{sMqywDj<;VezalDn!A)Ng$rUbb6!MN zB51eWz!?=NcB0Q~PVSeolGAErDbv|xOF4ytM~*{*>{ZJi90TbzYt=S&Z0PY#9jv3c zSsqUY48&#Ww<+x+CKaJtG}O)o7?kOd|=ru_ERI(v%&(BoKY5naoPH z9ohJ9c?!z6I?K5&UDD`$r*DK7cTv2z9Y?Fq z(2ZsEXZcu}wFl?i(!;>WC5q=a__xqq8F5tEdn9!EULb!xu&d)X1aA6Av*)mc3TtbQ zfSxYQOjOqx6e<$WyOp*76w8%-|Bz*=mBTul>F#dK`!%Q|E3Ng6iE}$M)lAHtTXT7p zvm@PrYS{M8U=z0YXf$@|3ks3i19y;Ud(d9THa+|XR)(%GgDtX~owlbhKF1kSH-2O3 zM=|_3S&A9z2!Ya2XXF-I&LlD^=L(a6v2zlPWSz>YK+u)F>4a)t^79Jl`tsSr{NT{P z;_dk~q!!fK;uo^V-L#B}LstNH8O{&pNNQ3rdd9$7UgraI{A%3Yg1Ex=>gJQVbIp2V z7$fm!BB*Ul?KJK52QEhpcC0OOMze~RYBPXsrO&CoL7}7?=hg{U1FJn_BY)d1PEIhu zY`qAEV724T*Y_1A^}WvTkC|scYiAGfVogFJYcWTEF#bEGA=@IKPyFn&>s?Likk8kN zQw%@(7vtwAY7h;zlo+ecS=H8Y2h_`4U1ULaiqtafb`3_RHgo*mQ3@~U4~kh^ffB`= zv5Z&j5lP zjHN3#qNjy?%*>x<#tMxgD11Nsh=LlXN>B2#R=hvH_n3bh6Hh|fdb$~4l-f0l?Q&JJ zN;sYzk~KfxyChuAj==fdn@zTr$~B<#7)aceFL|CEcMwkJa*sdT5^IwZfrdzbc#9ra zXX(jY=K6ka{>68>nEYSnIYzesmVuXyb;)ZT) z&{k!dq$$Jp@uOfTRa@y=MF)nbzhx6y_|Eam+wjxbAH3u1RJUs!Wjv+L?LEZk-#=_k zJ?a1QHs9<%fU`Vrzr2lJZGOh_D^OqnVjBLOpN~DE60uUE;Sl<)6@^xI=!02@OMDyc6hk1Z|a z$Kz~0z!O;KKk>(-EQf?D0J8XzD!}b1p_X`=gRsRzX=CG#>fpy-F5MC%w7xvh+N};%8- z9`Ocm?VJ)Zx@x@T4y5k0Gx5{%UcUTu)FiZ4){n||v(e6T2!YK;ukkF!li*7(n;$Yr zpRPf14{_5A4`TiaOTg?)!w~MMu_WDCd{{En)gN(>P!}_@Cl)4GF0+%%X1U&5p zJ|XbVsh_-f{>K+MB4@Ks_Ph#@){Z-ig~M-a`-ma+EK^;SawXQMGu2C#a3;nxfoU$T z)zge|t1T5&d(Y;q6hR^%`~0OvO#UMI`BB06>;{W$MXFL1=hxIXB0Qwa5_0DWD11|Z z5Rc!!%O%3XPqxPI*6lf{`Y~-m?~A@G;^?r6xto<)x$Xd(!uM{@$n!^>wD;IR2RTZz zocax~f5;W3ZAP2KXMtc92HJ; zA7y~YzsFXpjNw0oSSV*C7a}x8jCZ-Y7KCL?18GS32*7a z@Wt9FQSorGBkEX_4CHCVWAEreCQlJV0_2heKYXq|4KyWvr&)`JiioCs zLzr`y_Iz@V%^RK_GqThz;0Donv63pnpr*gu!6bh?l>|Z@CwRjY@#mlo<7hk-`ZNYRbn6nPz2?9?PKMXkNip33_gSCX;fn>5Tz1m z($T|*gcr_=uZHA~+uZwtH9-UoEBq^Cj8Y)$=ERX&Z1)x*kxRf*qvR-^%g>KgqZ(?y zC=zSs%o59o8C7LilCsZE&1K)XlyVAYb<_f10gM3@fQQKja1YnSf6Sf1Jinsx;PPsxpk2 zZP5~}Y|J8kJP!y>-}U4mNyYWzLjSJzQruQ6xx)xeG#W^-5=uDK|Hjd+#;|zprxL@0 zyZ#@HePfI$LA2)B)*ainZJT#&+q`4jwr$(CZQGumx4YTAP2Rq2(m6k>(v?n~(@FK| z58KdOD*Na9G;7|pgKewkgW3`B0f|d!@NLYfxHF+|@K6Y?M0+kE-YSCh1W&Uq5KDmT zO%f`tP$)NS7Z9^Y6P~TnVe+3S=!wKDuzaMLv_t#+%7B2$W9p&f<%W1C9LOf>BqEB! zIFOkxIPmL23r}VwW!%TlCtd!jwXAxR5n~fA$dtrmjd@!m2T3kaF?mvXU>2xL_Fzyh z^4ehxvyZK9MdV0Zxqj-~jtCG$1<}r?R89dZu?d4$EO4=L`d$y*J=K$slOUSWOAnV| zQdv}7Go{y^jesl5Xwyo_roEBMqoZMQ0ELDU%V;Xa?O%$p1de!h&l*-NFDOLV+V?_* zHWis6^hmCI=1AmT6u>a>?4?&h^K1MU)R<`r&KWTH^|bEZuuDVS6OU3WeCz>C$Eh|C zfPrW7Arm|z`?aWNRq%K|`m5>YXKaTKwmME{p(##x`1f4L)^ZP4n>omO8S1$m1$C;i z=Q32(%PwJM&SA?sJn2E^q*cHN#Wk^ifTvxuejPvqqyB2iTtqQ`){0*hSw-r^R{!|? z)t~){(C=H{7PC22*GJH{C${#YHXByNN*oLUsTOPM>2BoJJ-8$hk!O7*a)xA_scq`& zekeoeqG&xh7OfGe%1{c2JzH$0DjIp@1mVBdG5v;$|Dx{Rm)g#_a*Fir;^0)2|7*Ib zf+_{U2!YagoYk zf$zrpcY3^TXu`(R?Hv-lRF%e7z7Vc>)LA z9IzhU42-i0fr?3y^aN{a52**}0_JoqwktEmYITJ+Z=G8gv6tyIxHk;T*o2Jo$pWRZ zu0|HPRjJ1oy|mY;9k1L~YIiPW3x&d#=*He9b}?}4f#<7srC1HSEH2nZgGh!7dFHA7RdT`vk-5rMj_#N%5bR`QDV=+c@=o)b83006$W^kmHh)!er}nUni3re7wmV*j3Wgd0AA=HvEYKQ z;umDTOQFg*Ov>Pfl4-gCW%O$oh4dyL6nLc`X# z%CoWvp!y~4yaWPM%@Y;;PygSR_qFhWO9d9PMI04$(JH@xWi(w5!tSEX+CfPNJ2gs% z*enmHa>m&9$2V_bv!e-$pV$;?#Eeu&$EjQtE07~i6)F_zAF)ikhF%<~>!vS?LLa#d zGb#6Eef@{a5;&X+wrZcf`rYI%s>)yCgfsY8N=l`7M0Lw8@B`2Ki?rcF@C&K_J-@J7 zKTJ+@BuU3vP>r`CxF#83*Y&;g#zlFR?GkTXd{ht#)=2|J%#hjQG+yl{DtEds2!})Q zuE_R9@@HJuGgV|Gq_LGW>?Dg3i&OBXc!QlRo&a$#UzqGbUzZYFEAgfZFwhhnXB0tw zjZys|2mEFFq7W!?^q*4ps>2uSbo>(27#1P3x9l@<(oU>GT=4L9O1qUqHq>Yn9cl98 zP;H!yjL`_lD*g>TmffPQkkpO?8M})~LUH0%VhF<}r z@{i((bW{^VPDRsSAq3%yolCai6@BsPSXvP76;~tDU)*TgpR~6)C&}pR+o4na*7BeJ zvo)x}%1ugX3|6s|`D>$1HeLOH5bMG`_nfJ#Veil^T8$s4ZK5ROTuo zH2;u;413kNmILYM`&@N(Laf5Sq|}4S{o#L?v8B`aQ_&N!xU;Yc#O~H@Vp;><6W8dR z7RCg)_lI`&fKx?$>mf*iQKRnTK~gQE8w@r48${9F@T@gJPBz2<-Mfyqe! zpNKa9jV(Mq6T^Sz(p3GGiuv_5?f##V4kS-#^rLzF9sIV|C#sLJX@gx(@EcM;J``b! z#BU53rgfv7&x0sKD=%@+kJkN=r+BimveRI{R&(D;v|f2LI}rzRH48C4sgMF75bRyk z3y@LryQGOgRhc?9|GEKkd8l#==1nnT6z5%Y3%CrqM_wAjQoP?i;w9%X-1x=#AnrsD zu?}Piw#D&aLwRuza45I+PcQq`YMjGrn}E(A**JE7Wb5s(liKgkV8~A%bZdHK|9aF% z5JDeb_0d>Lxaw`2d{S(A93rr5ZGIXN)3_P?cz`Q#eul0pM>-b4{y)*cGNUR{PcxM#% zoKHcWIQuAebef3LCgVut&Xp-U4lVX#8X(3NU*Jf7x;*<(h3-lbp{(G662v5yG?PE> z9-f7xpNNU?slh(8)R04u2vijA7$Ot63yR5eSrIly8*Xb=C%-^_h&L|v9pptdViwv+ zfX}8*AVdDKSqDw1I2vmliO8S#kjp9&lexd)QAu|?ifmM3(-%-3I}cIusjns;)Sr)` zy_bQ*<{V0QL@9#jMIPFPHXS8Z8CtSC^{jNqNMrc-!FF7294czBL%4Z4~G zh+h*_RrvY$YWRt`IqBq)j5aG}9a_5+KwQ)&{Asa|9|nKU!KmjPP?Q81tP0mKhXBw- zF2mfFlJqNuTPn+aBJ-j`-J?HO*@+%ECfUq_)~=rPJ??5hmLO@mR>~(Tb-Gy;zDF6E z@RBR`C!)wZuRimTsK3bDtp?3y@{ParM-`DoX_VZAv@IF+7)G9OiZiU#I7~=tou@Cn zkA6I&hZj;#^ei??J|vHkD8@X-9U!!WAx%z>cmkF%Ijvwg5M;@^7tC0= zvsMjT(_@PEL!m2+DKnpVF0cWg!c0#>ueL^5UvYU3xOkcH%jPS+?P=yTnl|O~2TKdB zFk`a>kow+Ya6n8v2*w|~Ysh$hBiXk3U}9Ci1{P=I?-~Ak1=yR|O-prksH0R`4wnhu zn#ZXol348*>`z5LF>#X!Bo3}%bK{D1j>2`(3;m#`0H_(Ddxe@!z_yq0{i-wwx=9Ik z3@KpqY@nk8s2zbeCG=ya@qHqIJ1!wL3Tv&O7H3yNau)F_9()K2d+XzA zQc9Hu9J_MnlU*u#mQjQk;e87Vh`x1mCn@jv55@p#=<6r|h%xG2{QAo@GbVvW`bqrQ zKq*Fk43k9$0rNhkZu;`Y?jOWWxNJuEy=9J$+63L*jq50+vSwf1J2Jo^2kumg!F)U4 z3&P6{a8@2I*Q+KAkGM>HB=U*@#M*0|Os*%NGM_V?I3vXze9Ni65X5ybef-7#A;X># z#J_(@X5Z@tmYzBI$vNO4^%)kud^eS>JgrBD6m9LT(K?Ms81tx ziNS=n(Ez)!fmvo)#vyi}v9EDAg@?BEk&i0{KN^>tWPfUd)hW2C1B;XG2U*L2FypwB%fT)eLcj#9o zlqduZgG)e9XW(>$gO2;2oZ47Jr5z~h59E;IPpqwzCJF#|BD0w@%-};y z#pVNQ4PZh9>F{0N8tVsU1&Kuc^~*6s)J1yMn$Nna@bkP)ysiIy*Q%|`YUHv*_zVb! z%cF#lQT`JA@UqGO(PM;adsOc0AR{fUVf_)ho_-KYH2OpjYE{EJ<;uqbSx)mU9<0ek ztV>(0k<}qc;q9EBG74R2XI7bs0Rj{2VR;A%GP%5RR|<#%;%Bj#$P<$YiP!NRJ}4BL z!;xu{aH-;QSpsjT@N#^cu6v$E2C*QT7kV|}AlWG5#m6L1Y~1>qnU5Tic7^!t={XIL zjS2t0^b`%33@6iMqr*&+!m45PeqB!^t)@7zgpOv9S_v{KA&YS|!Z_ekn{cg=jeZ9m ze^IS+IAdt?`PloH4j8NZUmP3g+5eLg)c=#8%fQI;-|%x;IT-)1GsTp)X3PeAvd@n0 z-iQ%k8S!=-I`b?~iqnmjORSNrpY>$GxJeS~L_EP*lJeI(4<5;QqcPc8Hij|gX<+f_ zfa9+)FoE;sVcJ}URg&p&wL@8{{sZa^Gp5&&Omwii1nq1rl`#yag)xYbP)+4iOet3i zHVxq*)A2pHywr{&6$R7IJXIO@%w%QZ z7>{vB{Bl8GL((`$_B>v=dp3tA1)#L!U&XS?m$0OHq)t1<;3c+=TgoMAQZj|>)tVoaI5u_6gYN1JENq8e_!JayS#5|hf6ygVx@4Q`%qz^O= zjH*B^`f98%iIB1rD6_eJs)yY%Rh5e_^avFkhehVg>hf_Q!pV?3fnRY7xscF@J_6zy zu;~6rRsag_1y8I+opF@ZMX4)%-;a_;m8JI5jLcC6=^r}z6JTqN&)vJ8<|w8*P?ghd;M21f#6`CAAl2MT zx1bI@GbmNVRY0b}qLAn)EaohIohZS)(0kTM$K-`~GU-&zTFfEJhrp>O<}CFp(!iea zeONr(4tgP4ym(WnIy6Zw%nqK4{%lCGalni8&@BA0wu&$ahqpc?yUQ@wHN?wC+doYJ z4(f^;PW0@V)5N(!S7z+QfU*V5ebJ&Vk7^-ZC#%4$&2j1y@`IV+i7n@MRa9~^NkUR{j!B3d}L2+KS zx}q_wdX2v=B}T{%lR|{~4mMK4X+~IUMuYS~VK03UN-XIVK@1j9`QzVSyE%4WY@iU+ z2*9tkr3Xeo#+piWE2KOJ;85!A@E|?E2l4@W?iVvsMsU9#J17V%Iw9FNh23Fy7$7S+ z*Wr}W`7f$EA0e<7s(O|xk5QJJAuktO_7k~QC;<%(%w&)S%+1-c9-fqGhVE{Vn2>cc zGkuUD9lckdb<>3RG{9e^CXgo-rVHx*4}hcvh`XOmKw)6o3A)}_w@|)3cE2d8_}5}! z92C@1p@JPLIv9N}5jvQiTlelMDm~F@=C3ErPd_v04FZ5qEDR|sm|bd{JUad^_+jN@qOY*oWBKL>O|f}u8$J3iFr5ptMSl?J zov=NC4w*PV68JYM^|RPbUi>ovqi8B3v*<7cR|1CzC~-1}2MJ-)ddw*(?6H1K5{4wCEDN%s96qujZ(|t1vy#L-Zor!zBU*;yW0LGTkK2T zQZMmR!)e8#77mX?H-FDA@_YkbHcoDI@X06gD?TTmel}Sz-)Q|jZ0Y`c3F&ybR{Hm{ z(Cy~bgY*5a|9Vk!1hUz<<>6VWLy93m424DowOzK;!kA2GydYh4*fGK2a>HueL319) zu&$|8h;hhM_VSlh@fX-bg){=aKKQ+grn1HsS9h-*R}E~6Vy`45+sJNe?O2*IFsT(l z8>C19^t#{9Z8cHOjg39$sdGasBV(RzVYQ%Dh`|AcBk{|xK~pwUu;=~N=9IE92hS@c zodR*;&4$WN9%G(Zb+GzsbF=?>y7k$>#%u9rYiRDp%PLoddW>jLTg$pE^%#**RPb458Q^dv?U8JrnO)N&wM+3PUYpO0skLkxO=?at$ z)^fMigCI<-oZF*55~M@7%V@qV->1-+k+J5FV%%dc;C8iNWIZy}NO=k|u(2evNVF+R zFGr}Og>`W zJ}Kjlw^NCyC8o|ySs6uBB{1F~K{vRXO`POkH;-)D>o#tlCv?TBnItNKqmhu{IT34T z4^^)wiSyI4DM-F5F=>?`6qtyFoGuqM2}9eHX4yB1IeYW%((N=Wi&N1gfEnd=zKRCQKGOackpt z9lva~mztoF)uXiZv6f8vI#E;fA3~ER;icPTSZ(2s9ffg-f{SUXNrVr!cIGm{&UG}94r6+AU$%6LKED@kCj?t3ZNH0DLtJH+K7$`Q_xZU0KlYGgOqTr>}P ztl&gnD&-Nsk=O*;(}Lz`l&|{xy!Y{3YQOE3 zMNStU7B=$8q=vy*e1heEJ=W9tth8R2d~ZJuQF}vw_FdiL~bkIh)BF5}>;*-w|R=CAQpnUw{ zurc}5iS(9}zn*A2&O323{6~F(vdN!jMsv+NBSztI=mKe+H?imdW?OK zm@>k9Wl`d#E^LP(QuNO%%6uXD^Q)S%BeNj3eJYC-R$fKe{DG9GyY485R2#oG%#i6i zT`T^PDRgn4ZG=oh*W?$W8U^JTI*zrM09r{b^bpgGqMoL`13(6ioAyI-Dc-NO z{L;3@zIsqRE`=GwrhF z>Itx6t5UvpVy5kIL*j7O>$+wxSV%M2Z^&$fA@`?@aB&@BU>llB-|=L zny{X=d#$#pijM@^v?p6m2O$YW3v9cL7)-+orKx+8n3=8a$}KJje+%4oAWyeHW(orx z%${9T+2QS%@9uSZiWK2R9I~aQk}Qc-WuP~E*)dypdwX}QqBj6Vd?g@@#Kx(mce=Pu z&FE;jdW<9nT4KGk5xA~=vN ze0AvGkL@CuJZ~9t)DmGLwIH(e$41tLWIwp9_juQ>Gg-fqBKAnoavIMs_*VYOP{Nfw z>)Su-`8RCs{AK9KJ}G4<2uuIK;$`uMx!b(DaD1mI9HL50{;td#l@k1FGqT@0_Y*?I zp`g}y-MzY5nUm~=k87 znfF{oyptQa-UC*V{ZP8i8aU#MsiRESI_P#a+Hts z=hD)F5@Z@w$C6eT{L{AvQT|>Bwc6$B3duqefJM2}iRBjD)e2AByTRvgEG?`qZVOxD z?bn*hRA;8M9?a6hJJxA~o2<*w!*3h!t&$RD?HDTT^PZ*oCgaOxu47nr=V#I$24dT>cLhC-q6;s}CBfjc3o%lZR(DES%W}u>Ad01CvgnyY8I`pu58X(|y z#)z1{5nCWaQOZ}KDthCD!~hf#z5t5cKtTL=mhAEliP(Hc_jz7s+V!@qDs%Iuvdzki zL&*q|?*}Cz&KK`pQj&a)4swkfNn_JIWTA<2BD$>3_jZ*lW=<0Em#pw)(Y7@L((a)p zO{~$lhwuZON4#qt+6pOjAB56(5$$q`TuU*+6L|_Qo;}4MApZN2dTNay{c`WCXdyxx zd#?T2$sHY-WaZQw=gB+hg0faQg!-UoSf@gIiHm1jTCPxKYT z@bSXEUzm~{NceQPCMii$T528ID%ZE8*|=G!m(eOJiv!?4WTm0hnCEZ(a;e_KpEJbh z+F_t0d(_N=F?ubvT)cQMsAKywd+2v<=3Z)^Fq_e>OU7B3;X-Pc;0>JMw<)ni&4a|O zqrC0oRbmB$O773hI*GX3^aI}W4Xl5@pcBM}_}?wS=tVy3 zDZ+AyYxrGtRbvk8Sl(v0yL?zgg;s*A564KdEI;n^Hc_`6m2v|4a>8@aAEgzx8%k!M z=1@D2*+kR$7t34&JEbl?_-Q_%qA1D z3=)ZJWjZYrowJoGB@BE+L63wjvIR)?$bQJVqW?<(kSPRpQuoZdT)&@Xi?P0wA70N{ zW!66>J&P!b-k;EGTMq`$(I*_KVfYrb{f<{R1W_Q+IpzMXtGE8ReJVA*Jud=5p&&iu zYGX0@qk}r&Pd_=L+qHLr0(g@?jb`n|hH+Bx`hG84$7l zHc;e`V!)3p_`x^ZLs5?u9;Pv-F+@Rn3ZqtzrQ5&4S~dhQXjNt%xEl8iLz{BPd|L~` z83brY;FPGR8YhKZh|;WJe#Y z8t8uP=)5qQNX->kQf9zPS2Ls^Qtv;FCuYL0XsqCxxLMfnJUL!fl^kMl&vZxI`Xt#u zX$*6mHfUBrb04*2OLC*OWK(i~aSpDr3?H4mKG$vnZB95r+tSU`v=Sgr_;m4j7K5kk zY1qYb!$-|JKH=KRN^5KOdBLISP1~GF9qiFKV{m_RT5A|wsL#$N5?Uy=7^b^ihdw-> zGHGd6@=!h`>MKxJ=a^xzWkROo^dE2kyBfk9dUdmOV?FZSk+k#XBHa+W=gA@q4xl!8 zk0pJ$%fC|#O>p#?lHDg}bH}x5+h2G{eohIwd$ydsmS}ITd|sW~VJ1tq#c$?(7?(A*4Vi z2H*I=WN_f!wABF!tw|@|dt_&9!je;!8%YVn`5Z0c)7#hNF_t6yAY!44cW$MiKHcQd z$%g6pj5XW*qti_}4sBLq!;7{B_^XVf{aX(zl3V=I;3y>@U6{cGj$VoZ2Fy1EA} zanru7dlT$rHu@`70EKr=DR*eV1(?K`hq28dYJbk4L?|~TAB(tik45&eYD zq!Aj+Jvh1N@A=yF{RRbG_q2@aJ#U?LVIQK1w42S!ZGkS(CC85Cy2S$fFAl0|nsCoj zO9&qD*QTr-XYbEniHF$7jd~yKMqaj$y}(C~VYA3q66&fm+l=Cl{ITzB+3g&w@Gry1 z{JgT5t+@S_>Ov)W(Ds81HSqf*=9zkEly8AUN8U~Rn2FtnXkH=$Ogc9*-qMqF*r=I@ zu!Ga6-A9<8P;qJ4wLUuyG>=%M$d^3itV}6;PZ5qPGZQL8nP1;Y3|1X?QbHF^cT%Ee zb@P8osA8Fs*@XVOFe@7ad>I`lY$y#K8_YSC$u1YpF&J)9-=<)I)cH1z6Ma$t zV6{IN4r>C!&x)Ebg!9rG@eL%eQ)`ASnKd~USO7~30>O$JpT72)iWv<@R$9IZc5fh> zhp?l{3zd9IkT8$79vw9*8XYwtdLtJE+4zmbJR%H{7$%2^U+;@B0>BR={E`&kD8cZ6 zF}wG#2(CHSFy*~CwR$c(+@P97$Y>uepnqO?os-cifPp(T8p4EOoA0V!`hG#Vffw|XGBw03QVn{@ItU0!e=G};~@*B|QsfR83ZZuVMJ zw!2+GPoFRz@MlBFv01>&-&Jc*>a=>Zcao{_NolK+fEjSdK#SdplK~94k)!}1ZMsXb zdlrA2E{U9(x*`8s&8@tKSP|m(N#SkqFsW0cTQMMn?Fj74)Bst+AtZhSIRXSep$!-i z;vzZi5_#@0dlibjVWt{XDZ?}s=%O1}6$&7NyZI}SMWmx-C5~w#l0_mLtT5O>N(z8P zsir6xp`UuDv?M;-Njy@h#Dj?OYm+E6d06o*t0$D|DJF=m9kvw-4^v&?&Xy|U_PwBBt6rs zI!3~W#aTQ3%=b%;I=lxatb;*lc#mkOFIm(|%@sm!v~V}u92@|-oH90$m2*fFaYGM| zhJa6xpSUE&B_%#OMzZkm|EI*1PdtZskT;76oIhuejDTF*lCrvhoQ|G#2%}H;AWr+k zffOMwKO$3S#XqU@w*u7QH-(@E_TMJI+u5UmA9q1#F_N9%I4N2+E?+_=lvO?1gMC9J zDHud=D>$&uKj!ld`$Ixw;>P~i5DOXE=4ZsF1ccQ&r;{EUBr+&b5F}DdPEuP7;le~x zyG^*hUq=JC@vkSJdQ~Ko^Y3b3B4;+KV94ZTdmg(Bk9xC=3bFQH1W3C}Jz=E`Z$ z2R#}@Dl-u-E6i({^pRIIR~anQDRWknWLXDl%xn08B{?-GRI766x|PM|Co|EcPFb9* zWYZ3=G0Qu*p;yuS`htnjZgMs%D!oz4i5v|rmpY7%naP+JuAYjUyZdpA5T!&~qDH|i zIVIAy(Wnc}jT$souedaHP83m_Wb7-FmnAmWM*GszDwUkI(@<0aj3pp)Mg+ zT7?H&0P>0yFw9y<(b6!z{_S86Oo(=B?$?xYYVI2+<)ji_z|(N+E7cZ`8xp7Ok02y& zkFA9e<*x|r%yf#P}ana!x;1OewKxL$;U{={O0Sc-b_CIX+>bm!GPT&>h}8c6vB?O0H-HDyF+;Y{oYJWN{(slU}{Lf{P0|2LEFdLar$Yv83X^1^$5GVOgfaKmm_D8z>e9ZUVbUIbv&)N>fyfApFu~LaV3Vz><-L&=G=P)n8cHF0{Miacy|aE`=A;YW zB*lq}OljSz<6cXcFjoBl3e)8`Ip2>X|Nea+y?t!x`nY*}eSE)^q?Clv$@P2@73JjU z=w|Eu``mky5R2K_*1^@qo4-HM{dvWU>EXtyuSkhdCH!gYf*CvygNHn9CZo%RKK=Lg zkn>|)u=B(H{dET41%mmt@sQHeb9&v9RQHm?Flsmp?3a*vcz8cNpC(t3@@#>8+F8PM z`nG)Tu9F3aHiLl1ufY#rTbVl%ZPUIj7-*VgQHeCU;B~C#n{OP0^hoU)n`_b*r0{VU z(lSCP$H&9d$=l=Y{rWUPRu$RYPEvB+DRqsT z*y!C|eDpCv&U5Qg{h&0u)SM`KeKhb2TW&mI5^YU%b!-2Q7@rJR4hYU6n(XN+9eZDb zUzR)DSDZT&hJ9#YY}gZyOimyxMI13W&HHX%-{d8hKJgkiJ`%Y)M<||b<#-kr!^H(& zA~sv&13Eqg#K%$P1QD&hKta%rq!# zOh_@$nKNdZlY@b|yFd3Zpy4+Vloe-(45}Z&jrL&ptb7#k*CxkZz&OF>hL73S~9CLyEqO8sGen(!N#zpj- zzeGeNpE?N*wPHEji$+r)#6|MEyCh)97c0!5a1dipCA18kgCPIgpo=pldh~#Bp>%yp zFp1-90&fPMy9T@tXvPcPXzLozdbpR)Pr=0x$qY`GXI0teUVfLoF99v*A>14wwlK0^ zH1HhHjoPe>6?MQuwt*aC+5c<_U4H~R2OJ-HP9Rb2^wD`x6JFVuD0X^?D7`{^=F#vz z*{V#M#=|%r-F6Px1ft24+pKcVk=wY1BCIea6RiE@n_pbDL=^5(|1JvXpj36Gm0(RG zn<*$WIelF;Fn!G6=h3a;t6r2X)SqC<;RKxF1P^&Wc8&!q$fMz10MI6B?FtfTUJs^$ zL*RVXPz}$%+=p{=Nt`hJmOhdj3Bha2Y*ubZ5z>K#YV#BYW_*aTW5(~V_~tbQnL%%( zK(4l9iU4(Vjs;tvKF@}U)_md(mNfQ^L}{Q>dc!noA-Q83s}l3YEhx2Btua7CHTVk9 zM7Y?3VMJ17%QOno$n~kiCurV??A(al6m!dMt57;kD8#OC**r85X3#=|E4x^2%@NWd zYZrWyT3?C|PbRtB?8dGD#I{2fTbDh+fl9t8D3ZQ*&4hoxl*~;?&YWS3ivK5uewrmM zJ}^*+-+Vnj1cb%-p$jPN?1TVup=JvazIcpfc)ea!S#ud>bv`$<1(P_TheY}oC?r7) z<;mt@3y7Hf340E578l4ukvp5*D#I2Hg2eb?3TTk>345lS$9O<^Yf2PPpPW471~qr6 zNs0Y$OiI;{TbKi?n{u?}mOI1Qnv#CO4GO+m+0%ngk43#GQdDamqQr{m$vge`Vmss% z3MM#vn`aQ9>9ZYBh*$K9Q%vH34-R*kaSU1cdNNOTDOrZ?|GfP-nYtr;SxUF1*mv_& zZt#%hlgFB%qrVkE+DHT1uNkeUz<`S+HQueHw-MT{qPI}6jR=cJBQQafS?#_2bQI-m zHv-v#sNsp%W&`5}a^s%T#~lH)S1n>59R<6?uehgMur43evLq6m@kGhK&USEnLE)wx0S=dJ2?IwVu}E;_pGfrR|0w)j z09QV-U4}bXRsLPnuPQguQMja|1RK*9we%I+tf;_Eywd40%HP`0Cwf$w(*b&5U2^0a zv2K2j4JuMIYl;oZ3e>p9bx>#n#fp(oQWWhnz+v0eE`v2T5NmXN{Tfgtj(%(t0x4csqEE;pr9CKhvqi{6F7VPcp>?-5T%wS&fY@KIGgsfHpb1Y(<`(@ zf5kq7yN167E>yL&=UeCMBhPE#?MsaHNVAQC8N&88y;9;8q$2)h142p`J+P3K4$LF} zCV^`ng(4f`<{capAtHrT4mIt34*OTvxD*?2gFSM{m0~Ua+&v|}M3FZn$+TJfcq1_~ zqi}yC(JJ+o71ZG_`xK{o22ZTMK zwuI9TO;`VgkcY!)C6jA@uNwP~rMy-2A0|u>og#&)7&16Ggumsj; ziL6)ia`p2cd_gM>9C|?`4?OB@O8wI1!&E6F@;x7QENF;*m^PrSvOL_eaN|HwP>;Bw zlvkT@S7K0^-Rn|YoZ07sN}Sopf?6Eg{|GY)&&p@ta)F)Dsxb9tB7hEs1Fx|EI3wUr zYTdJzr?UH!l2hGz=k15m*b!9+T%RcEqQ;XeFmi%sYzI9%xaGOwZ$^JMV@g$o6Ra@t ze(^PE&grRP&YI-$M`*Hrp`&_&$`3$zvU~9chMMahMEJgW;LE|Kwz6(?cm3E%IZ;zN zaIcsd&wBrWmJ%h9HQkp0RHtEKAZ^J(~F_|M(ltEum4#uom^>;3uj=xk#k zW#{|uK~9p2&+rzOkB;;uq-E#3**(R{wC^UR60^oe9zz#bwYVqysk@TI7*AVDE{DC*uuO5-oTpss%vv1Q@silo-k)q1rv&N} zka*qa`L1>_Y(C6MDo8mCiWr=7m*$oCJ?{)^7T7jUTizdXp>10+iia~3UfHlg<(aDP z46U~~UoqyRFl?$I;Y=J9oeQ(r9BBCW|GGIsZ*Y9WNYsM)WvYc`&YbvUXU;=7SLux9^!7cpJ;cO=iP7;5h|2c4)CUe#WVJ9^vDAbc<-NuE7DtD;&TP% zbx!LZS(YT=#qu)jTvb2Ewy?iX;|12tlEH_piUXPdO(~lUbeSd zDw+chodP=-5EFMl{2m=aTr@iOb8B$2sH;F&Fi||$My8&>gCzHq*hUKVOjp07oyKG?8V4vWKW#~xUp8)0?ll zVQ#eP+5*n3UAQ=PHY`Cq|7(c6+N=Szak&QnUvvAan``4@C%o+D=Kp6D@6pog#OI)6 zz{2x71u=W2`t=<#_ab*oTR}R0ft=V4W_%Ty4U6~LRks!ADA&RbEW1IG$n14hGAaWW zk1Z!4+9s$riCkb{L{$+47EeX*r3}cU+Xy5iZa?RDnontg+jWVzs zoOi=-Ta#X2bwUPJ3zNG&0!~zN0{0~nh=7J7wU+9+mB_K=2<8BtFtY|xrP($J&Ln+`mkBM9RZZK{m$M3+q@~w za9~F!6Di(eUQP!73P)G=boe(4bYMd?vtO)<0pcQ1a(#v^zYGmq;u#cX3vuT#n>-rJ zSlJg#I2561={}(r8%(dY=1_39 zer2lANUo|J$76(X$FFy<#qT=bdiA)k6FVfbI@U(!YHl&DoU*|g=Ea(9(!URSn5DcSp+@&JyS^bEqBfycPD@i}kTlA-ZzS}~dp z>tk_QkXt^N49y^Nm4?OVM}L(Midb27lUKQ6PUJO9liX|JmA=_X-6l-%EZLMEg!ep5 z@PCXs3i81jH6}|4=7h=w@%CBo5$DOxJ{P@eqCOL@{e0cO-hQ23eM~G|JhYtH!q@b4 z?ZAmHNv(mliJ}P0>As@=Ad3`(DyZX2|cq#eu@$nq?dV08_>-F|@^ZI&! zW!<*=c>lcpynlk+aa)?GzJ+&AMDXjDrMvO4-LCY?DQIl2paPv==5;RW-LVXKrxm04 zY)jps?gDeb(x)Pti793dk~yO!=$R>pL?Gj>qB)S1$hD#&PS}Y)dg%DX(cuiKp|>rf@K0(uNM$5M%<*d8K>Fd-)0GKx- z1UMWM1{l>u&O=@x<9?o_QoyX%;akzuJ?VyfZ4k@#ihyFC81o|j&F|GB#;BFq zf*9ByeQ!jhl^H`+3Ug-+o_f{}i=P;*+>C~Xum1Z~(*=S#xAJ*02>Wq-_jdQEJf+x% zO50s^U+oJYnK~UqU@dN?R&^A$wV8VVgS2-Ft}F_-g=2JVTOHf%7#(-)q+@r?9d>Nn zww)b2*|BZg{QJC}Q~$Z=+^YMwYSpUw^3AF>=9mMjTL)LQQZurqqOhB#7<|`~S=0X9 zr>uNe2#ZTCmmK3+x!hIprRf`(C3BHwK-c16-`hz8PBSAkd@Q=pZ4u>H5V#eXc$FL|Wrz2?zhXkYh(QNDh# zxR;=Q5JrM?l%MMhWnf*b^Z!q5v$6f(*+|%V{s$Wg2M-&|ebc4PyuExNZ; zW-3IqLSy)xN1$!(XD%!uRx1y_rNZ~kW33F**8FD?zVDMkgl}-@%|*lBgtwBGzbC}^ zB@60FRYCA4u{sH60iVN+(#|fi8R|2OoqS z8x5|Xn4GbwO+8u{O(9p>e$rUP_=b9sw3&UIpPu;AzGJjJxWfFU3Ep z8KK5wJ~a3Vdp%MY3Vx%pE+UuX8U4i&%N_Nu=W*^gKv|Yr>=2bIER=es#hE3=_4ntj zSGM5@zbW1b$!`TKbjw?y_*{a0q0v)ZG{=ty8me?`c}1d7G<+QFE@b&XIdIs{RAmg5 z%&MY>5TU(u=(DPGb&D4D%83WXdT4H~U(|Nc zT&duC-yH5mr4gKFxC)Cg91tue;7dZ{y=bLJaVtrWp~NYI znb#pea_;G&KRQM5<@}qVn4#kD!b{r{a$6p$GEb_Y1u6vr!ZOZGY4G1zIEp?29`%Bh zgb)}POT+$x-=NYh^Uq zAQLPmyk(ptgHl2FoBm);&UGONm?7fd7P} z7{guOD6E+N;qYA~qQ?lO;IzjGR62Y;rfDHNNf43&=LHSN7SJ_J_8s*Rv)$s)azCl3vk2QQ0HE zFCz|ty?D(>=}&IthH46F81OnS z9TDS?Na+)fd z-*H}9nLEne1v7J|!bWn6B#)8sQ#PkHXuk0W4N}Frm#GF>u)=pU_nm*R~-+2KC z=~-Xib+$gFmaE39T_hEHb=8~FwXS;h>BbuN<;^dK3We(r51m!63#Ahp$q7(-DRJ0D zH*aP2qxdrCfuD zog3&X8F2Jr@d(;k~2A{ zs+Qla2Qd+vVLxcX2UNSPg_<9#nOrBU`8bBDS)Z0p~fyYihZ(b`+u&1 z-pj-}+?diWiYQONRPCcDUAC~#Evci)5OMTwSBM*~&QH?L?(7)~%it)&HOtr83F#A9cw892h&yT+piRATs)x4jcFbZR z@miPHFKZml5x8GvJh1=#6@RUFRNUT-IW_F$VOYn}dO?yNtxd(HK@R)i_@})fTu~ zGug2>fZEU zu7e^gOI6bK#Wy6}i_!u=LnTvxsjiv0hvf3+nbI zr%IhUIn9$!b!9cQPkWS$Lj3{z2!Sf;;bD6^F{KvRiE8D|XSsctx{K&(}mv$-iAR&_2+w>=F~S67$rU`BHHXEPG*;e4q?G` zk%pneb?uoaKd;y0u1bouzk(3!G`dD$uI~&lEA={w)yLs~4|?LC<(2dG_Zjpx^uDDEzA;2bo5QiT6CHxa-y^Vor;ElO;}iP{|RKuH-I{NC8RCw=5#CetF@{ zI#_|#d9!{yq!Mp*Up`M!d2P#p^wAh?+TJ0axT)9LNpp)3^ z+QwG=W>UP_geVeS5^QDt>HaXZ8iYr=JMZ}k)Q=AOs4}UA1r4pZ5g|GW^U*oqB{fQd zXstQMvk^pY1l`E9PnD;9O(kObsnY$!AmY{s9H4=kk`-BZg8|THn3!i*uRhvswEg@> z8l*30;1`6{Si-SEyS59%-sa3uy?pA8;zl?)m$_H7e&c;sFzK$b49R^YcE@(uQ~g#| z?VwH4zsh!dBb%0l~Tb#$f(|&@| z62q`$kkX09Kr$?l|K|1KvG5!bhIe+dlbAY@Ek+{0Sx7r9X!@vXT&9Rl`srgD8jn-b zTFrwiYFR2;yiMz(E8+F3)CK&w!tSDeEEc_y!fN3Agf~-tUv=$um3?p3+Y&M9sGe1d z(LnK$Xvo8bIsa(Q)z-U;Sz=;$Gu6tGb#Jkyeta$YCdPFfIDJpJ{b*e_o;zqj9LGQdu0vvHA4Rfp>pQ;~w8ix2icjD%B|- ziFFw-TzE$F0RbMCnZ_MAsOtM=91bGB1`A19d=Yu-HyyqojM*(o|5aKh(cKpSbwRPJ zsKxNIw_q0(;4$XQ6uYN7T_SM^`fF~pAHvS427`DBB6+}4{LYR3*$TC8dd~g61C6ye zI*OAL=7w-LqnUFk(Kl9_qhR$?7Tw~~aRJGU*~)HB?oeYC#p*z9?yrz#(&f{ewNqxb z>bc<(pife;HJ<@DA!!OG!qR5R+4AmKB@}Nx@orkQ9pqJ7XT$FU*CCe(j30gPe}*=LBp6v&!%t#%E2=&A~9R@_70dr**t~_VRN>4v4Rp+qFJe8vDjE<47no!3XOvUpx^ zJ_~wAd8oA5BhBxzW@vc2_?bA=5MPA=Sf$R66aYtdyCf~7{Wo@JzVpfQM#z`TXhGAf zvU}vG1t;}txbaxX2F8hb=JwH6?L~$#q2r`XojS~eX--GM;F^J zxYxm)W706!4aua5-NM}Sqh+LRO4{&A65-+#_t!})68&AzyNc3v~doBL^F)7o{NDG?2Y7|PS&UtRuu6t`;$f6ZU1HilTJ-vx%1xhh3A>Y zm7oKVar7h5>lHMt`os(ThH@;YL7hQCVb5VJ?*<^;|JWv8((5nUEUDs87bZ#3r#a-@ z*m2$^&WQw7((Er3cm$5+t5(W>7z)PDY#h~GmopPr;ux8RIPNuE&zQ#Z>NdY+(rFk& zJ+iH324x0%m`Y~Lj))5u*bmPApvjQiutS#LL<@YJ-C%0byu56{(WmY?cgao>jc+Lg zHNrY0-=^sbiR~4*I@ML(``lnb598`kN9f(kyVvRp$(}S9%5H5MFhok%_x+S%@i#rO zb75~}zJUCcEpAPWK?p~TON7EZ_iBnq8M6JZaR|<&V~w%L3m|CojlVru??(L;ve`20 zLTrZTmV9KdWfW7X->}rmx`K z{f5Hk_WdCDlx1Nzlm&R1MOU(x7}@n4$b>xMq0Vg|b#xUqR&}HoPg)6MK$03#z#`2^ zLJ?<};;`iUL-)9Pov@NK7Q**-~}pp@@eP#C~$8~U0(+k)*a@09TA zDiYu~c{md%PU*qTd`4LWBe<+#enT7Ole*H_OkZ$yRwCQLb~@8)!23n&gzjzS2;k9n?LZaMftVL^21;{~GFC@z_H5 zYTVQU0I7f^ z^AL9j9PNH2`=^vDJ~KZax9I$WCH+M7_-}|a4sNdhT@lL4%fFUvTbR_&=cf))-y3Ra$>N&Ij;`$qO*A$ae= z+urPo$e+Hv-CxkwRB#jGw+`d$JX+vJRz|WBsd#aWCsi|xY#B%?2$iYFi6R4MS4F(~ z{AWqbrF$JE>W2y;OqXpaaj|GTAxwnl*~Rr~tt#T<4@W0l{3P9r&~J0FLC`$CMN+MI zM8d|`2a7R@vWgDZQ*OH>c@FT8(NifIJ$tlxiZCV+%-Rx$*DAZeIR-prO&CaHsND`4 zimyciL4PE}(E_A1an&V$TTN)rns$@BNGAMH{|s8CCVPkPXpE=mtq_H9DOE&%H))EK zy%9w|?_yubmH-)tm7TB3ySvs$4eL&E65_|m&r29TS6a{?FfocY z;o=QXbgzq>_oGFUrSra%T~G~=-mx8|>9PnW=vJK9>m;7NQxZqvcsh5dt)<&2d!z5R z2zwx7YN(tpjUoXJ#S+?;pWQy~R1mmIBW3PsCUhMhorZGE;x43?Z?`Aa(@q6B{^#a| z*Q&gu?i)tD;Aq}9k|z@fo7ogC-Je6qd7H*?mn>m{D;s!+TCvyC(I*k2vDG3l7(`a0 zkooXmaDSMvz^%`5%6@i|lFXu_3y6tvx|WM%)FPnD2oWSuOb`CVWat~EfmLJ>l}Z(V zod@^mQ*mqzo!Ez`!>+6LhM~2Z2j`l}oKV;Mu0PFF%eM>#i&0FWMV7@B8{VxKDdP1!E0s;DE;N$Cm01NOzgl>aT{Ey*mN~S4~%k%ZM!iT z3QdSp8rU4(hMJ(Sur-!`8_(!Cqr=8;2NqoaCOUBhC29omiHpP&xQ)JUSUq?jEA1;wUr70RDfR0KmFy_*9$Yb zQZ6F2l2Rw&>#7F$`94enS+4I)Lj;qIqlJ3q#)hsB<{*6Xz159Rww@H-;NIf4RG+Hm zeF5QhZ}2MSo#?^yfCM`DL$zD~Ldp@xXJr_!dk&l$S{8T=0|lHmGRS;9I|Te5#Sx~z z&591ftb`Tr-)esLq~Ex@I3t5ry05p_y-;QJS-%TuRN2c$?)=Wo_7ofOT+6m9$nRNw zTqg8p*3Eo!;(-){!btYCljl{}+7jGSed!cn(8r(ut8K|1?kd#lV_9By?(MN>fOb{k zW9c5OHlll$`9oW1##9D$tl?{|GX2%^Xd;9y_(9++Z|@m5=Ub-p_PG1B>m}uW@f#Q* z75gC`;(DO~wmZAg;UzK?|DoUA_}w)>L4WRyH~I2ry_^IvdwDYJhg@?l4uDalJWK1& zBUqe(_Th1=-k_zzdHFoM6`po`S*{HSj?qtK&v=MEZQA}|)=wqA7(aS8QrF$vGRhIm zTl;>|NP_VpDgGKtm(A>*(1zc!eO;nVR)F-0(SH;oStS-&!cV($b$}+}?;m zyu13@YMUH~^06=sq1fI_&>WTTXfKRCM6UP|^@`_c4;XgVF80#B>4#dA`dTJ2xYmt$ z{&4jhv`)+R2{hN$jEM5`)wNT1-#E7(xhngD6!PDC6BIC+(cK4ZOMR4V&N)uf>Rlb| zjcMFY0GrI;xjy9is$IvQACyUkuXMhAd(3lhIDyfhfYBrFyfe=@x%ZcaUE>@tOV=8b zmN?VS;%Hm`(<4_(PVRbO*^@2*m}#4LU`fpZ=eT>4)T8~j{2BNC&E)gySbuF+=Hm-H zpx77EUgxcXVNI%f?SMH7WLMvKwC4IK^VRGPtbw(^zPEnQWnN1gxw-{5T}{8se`eP$ z$5br4^3D}?b=e&tJo679gKw)CuY$Z|(HA-0WT;>AShxRRwK~ z54+gvDGE2}w{fJmw4sp-mA zZ_@Rm(YH<8X1V%ik^gOQ-I4Pq1cgTP1GKtQcj0q?Q6MFdve3F)GoyUM+1vi0e`uOdQXr^uQNF=NYLt1H&pPeEjZLV|*M?Pv$gIc{rw z3c0|%W;z;9s0x}`x_AhDKQ--?9a!!D7}DC|Z!_Y{KCVB4JyXHktDLs=EM+>WGb35& zPbop!az#8&SKKmN9AB#jhE$E4+7Qh<=K=ny!@T)`NH=$H54T*{?e<%)Oyd`ez3d+) z@5@3+?FWJj)lb?w`3Y-X$p*Fud5vB%2NhQ( zUe*RQPeQuaG{mtI4mCQLQ6$Ih3`|~Ubl5T8?ahzFQyL7!lfu60&tT{L!0lBxU+iUJ zxohoCU7fv*-nf{Ai!Y*R$M*jg1^uUXl>bu--T#JySh@d8bxM+^OfzK}+WHx$BLtLC zA7^9yydw8;N!BGZyRRCIa9Clxx(v)VkKG}L@j{Jf)3I-vu6&5T(fh?xXa!Plp)*qt zaGS)Y$D9c-C3JUuM2^s)YK%&-jfdGb(BNLho^ZK{C_?YebduQ;2~tjB&=g+FYVY>% zpxvJ~+C{^Vk~@U?@=<@iyuiR#@}u2O^x?)>*P^MxkFlQJdrzvyfka(B0$9%nC55I6 zlp`GA-))G));bi06V4&sNP3O53ZwWjdaGdg(@qL5PJPkH5U$K%7eW_Y8YGB9yo22g z5gp}C@p>mBO6v*^%EdBASaVKCrN~#)q~u@yhOB8A$*ITU14fn%CyhtzKg7fxurZLY zwM(9-X~U`Eb{H-=LYaFN^rtOu?hBbZt!U8sBxYd5+xyA$McN(|QVF`Fu!Y5u_AL99 z(Wm|nVo7}iC0VI{1FI>^q`EIu!ijdi^mDBJd&UwkJ2yzVv<~h-d59cc`WFmEnXDJi z4`vd|CHNkTUAmc;xETUW+%1|f3{or<)PaWS_QICnK8%IV5a$=q_`?+*y)keUUFL%) zgTo6(iqcp`KR%2IS0?AzFFpthvQt8NHW>3!$zUbCgy`1X$W+Z+g2@%|Y;`hDGLZ^U z7ooBjWcOiNjSfw<{peg}gGK0!Yw`E~T}T!q|56U>1sRaJcib3=PnZpa#rp>=RtnRPzSN#^xh z3RpKVXe!1Yaqlx{K1hisipQQn)E|-s7e9Q7?zuG)DPA-D3DgPD#0!5klKJ~XoUhWN zkQL96{lxVx2JWzJV}p9ywujgAaC^6|tBk|}a(`)xfV5&Mr|aOOd>=@Fs9yA~+NEM3 zI5+z&#Ag7S5_B2snL*}&e$Hp|yCeXE1(Be*-&iV^BQ{w1NIyH-89kVn(e@VQNj_B% zuHL2nHyGR55K(Q?!|(SYXj^Yq?6bd)QhyTXAWvt~++3)c}09{yz-PwCUxX`a_| z5izikzcjIFW3>1cGZ}#Anhb0wkJ@L2LE8K&dZPv9iWx4lAG{FKEGbdx{5Z&$2&nVNC zOd9%xM^olQV;Aa_5`#zMABkdK+5bZbw-7cqj85FsfdkK)(B&`bVY#IJ&u8_XrB>vy zN_qR=vI!?qJ&XgzzV9#%CPcFY^6SNzgYm-0wGXeu|L{)@U@tn@-IKZJ9QgHi2l{%y zK(W8NWAOmT7d|XvzMFa>)X!bD?j||H>c6^;3qx2xK6(Lrc@t2g&wT`a)M)km^3%~~ z{7|=VZ1C)Pm-oJh=<9qOb_7OrU%+NUyLUdu+&%2jl)Pvj0d#@bt)K)C;C6-jy4{Pp z`})w^XEpTxo5v>%umo#V>cxrJRQiPZIdy&WASRyqjis}5)L#F#2ta!5on!Bk=)ObX zQxM`AhvVD4g5t8B4~TSoSDs|NkAQuZy9xAe(icU!vm3N~sRvny37ijq*n7J^iQ|9w zyp!Vk5R)A-f0-<@06ty4$4dY(QLpaU#(X}SD^Qqy%7!zaU}6GFEfG1n$(qBHpvL(TrUe6+V+WW{PFPGUP(p1C#La9$npYz=_ zOA!YY-Z48DdH^X`o^h$?NYE>wE*O&ie`Z4hn4rFrc5uyma>D16+ zyGu33lL||<8lMTF_4M{$JNuygZcr~oe;re-?C#nXJigKxDz^5ioKAvVlY5Djm1#R3 ze#}_Es;R3=1-QF)j>66<3n6!eXDolH+)CzE!bo<^XA%_yK4=K8Els82NIZ1-T$|i# zdc22L+Ri8rC$|+aRkuhLj~Kh{U_9{Hd+qjjk~DvjUlqX9ub{l86n3>`(c~}6xH3!t zQn?xNb3n+8n4d51jkt!yT%($qDE^Tg7)y5^Y<^ zQP=1V*#mFfXSR+-d1UT4-3tu{7q^fjXMN*Ny5WLFBEXK_9l7P3PjbM9Pz=(zm#oB< zmba1bmxRa_GJ~W2R!p&d+41t`C6U-B)}Fpf-p;9O4+#}WCEn(! zMP&4T%!Bvb|HDmxXZ(Wovci@s!^i47@SOd39jK-A5%Y=rV^sykwwn28xLeB!FryJs z*-55+?ErCmOwPAPN9l>-4^2|&7DqN2$A(P7QahE4LHmonM1P7Sdy1!y$@}38-ycT& z+w)A6C#fGUK*{T-xAm#hLxED*wIf%oUT^vG6@aSnq^5DhqXDMghA+1}!K*)Lj@)O` zMn`^HlHuTU(+=L)%NKiVI&v$|2;~C#=E)>5*lv=i9r|U0394Xr_-Ggz{M9UEIKWD- zrFA@qs=#+KXOU>Hj?zca_1L)k={R=!i^%e(k?ro>iK=At24HG*wu3c13QG|L2Olybv)B_MQy*1ukl&_3*^=*ZUhcdA-(IXl>z ze;cHK>3`@?F>?ZTfAe$%Fz^$Dgp;YhU<;ybmH%6u^M8@H`@iBG&i~^7{fBe@gYDV) z$M*RDjHImDQ9}W7A0K61ZGEvfh#@Mg{AMhVCqpIu8{?ly*PbLlZ_K{&%X4Fv+YwZC zL_LW$ASt>=i9qX;5M86@tvV=dU1v%8SZcf4+NP`x-j+BiI=aARt>E9?Mk!N&Loe-f zr#?cgBSIAGj8KA2rt_BP$v%eZoEM<{C_@BCzVu;B-ROO#WXMX>L1zB^TnAvfl@Q zEI*6+?wCmytU4k>KT$^$5&u}x8{%i$;1CQb<4ELXOdzd9tA_(BITue)1)_QXkMd9& z%7n=wGjDe7OYvN!ad0G;1G6BVtYoii0>+vFQCy6%lD+;s98fC}z(;m-m8g#{I57AXW+h`l@clF_Y?}KM0W*vm z(O{W^N(;){5HIqo*{_#zG?l#qU{FOT5R}f1o;-HoDPNE5+qvItKpHn6Dz#Wp<+na=htQ4HA zfs4Vgn;W2E$?M!7o{YnTcF1PEGfGOB)Pq=X5dDfSIZm&Hj(l@W9xD*9NxOol782h> z@E~>uFNz}JU%{ndO+YvbVHJ(lfaVd7h4C}0E3mnjU$d8M0P-*nGst2aZ$8_GL*dkdn1yWonAl{{o1Ibt`!Qy7rZMQFAX+WbszS5Q z=$ndwOCntmLy}`f))sC{v}?vtt6JlZIG-JW4QK2z2k`ayMpEl2g}Uwy`vUm-I;;8m zJX6fRRY;j2dN|IQI{dS{)F-^^~vN_lt9*Le4@`Wi_wfAPl! z-a+E=cfQGkc*a5DcNZ?cylWcrk18mhna8UxPl21`upfIX!Ye7yiCy<%zF(w3!7+o2 zew)T8*cX_udmQ1pbD3_YPvI93=yQBpF#4JKSseT7CLD!kI02BZ_#Eb%9Annhg41d1 zpR!zif!=L!j_&0_MB=J|f|4_#b6{S>AEe)Q6|qVBmE_x<8iU>lT*e5#D)c?gest*U zdF}69cyBqbe8yM{h2K~_8BUb9uKg=UK{{s#FQ6(nTlrRg;K~xy z?p*Y}>xbzJ>&`#h8G~ZyxZtpG^80MtGpOoC>Xl0SN%agAFms>hwp-7=5Yn>gf%P@$ z`@>gpQs!;ei`BDn{P2>&Z*12Vrvj86%yRX*T60MZ3d zL!QeRZ$`Tw<-C0jki793w^rwp-c1{m#Xq9F-W+1LPJ=_{z zTx;YHY%jXQGom`@LF&mXv^1Yhf>w~7YhAv@yiHq8-WI)+c^mx*OKW(Ww*J6=AJ469 zN0aQarScrVuU0Mnk>TUYrvif49sTH&{8y6)?T`j(M01qMwZoaKe#7=?Gk@WQ%cg{T z_zs+|o9lDWR#(!i>vy)4_ItrA|A$LFy=v!aR{*J3svThdcCHUa}u4@;YdB5o$dt(=zh&*0UoisUAb)23#q zmV%1rH-wrVA)rDE4h8%bnILaMe?j@R-mMsu;{~B!(2=F-)726Kl?XvVUc-CfUORb zX^ltPXUgYEjK*WrIZe5$ZOY3Bg|~FZxT-;Mv)|`jguF*LXHc?1BM7~vJH^wtIy(GR zo#Ze6aM2W#d3nWg4LhwFah=?K=d}5fA~w$LQd(on#|~=@hF0U-98w*l>XP@+)N3js z?&$8Ps1@7=+Uo-+ovE*_wvVC(VV(gEzCzF=ozKR(@otzepu2#BXmMr5OW(F!SL4nu zE!%0a+b&;f4d_1ll&W99v@M?GgD-VvqGxa>8+^w`oDJb0RbW>shGZ``XQK5sosv>V zvF_@%3&2_cf`gds%KuwP!~6e!fyK?v^`DjB|4~Y`A&s?pN8brWx&FWtLq{7Pgxd>~ zhc*F$TPN+-UKA%8miQZ0IOnS3%u8>{w1WmRf5@wl$w$zO3-J)5RO!Y9Eyrf+6vq;aZsoK8gzeAD zkn;rY%RptQGA6jM>CzzCHvFWE^Qv{o)FmB<;L<=!Fb&zZNx;KQfKZ{rxqtlWlbc7- zR<00D!u9qm-l;)Bf?lz?Y`&RSfzvcQv$)*WDb303+T#RoN_K(mT}Jyl}+{GV~`+;hJQJnz%y zhrsns9oV{x7YlzNQT^B+un3#YmE^FU?J@f$ww-(&Moz)SAE_7{t!7Dhug_6^y#&Ff z)T`5ZO9Y9AmlKQ2bt*+w!Ty+shO0S12Mt3H1+$JzS#3;828SZ=J)ESBx~u|qxeZZ{ zu(qm9JJZbItw9iiRvt%hGwST>kAm9%SEv%|TC7$CYqv(F5Hs7DMa|OL)EyI5tTETW z-I1hJvKj1{+N71R#cVpP zv5Iczr-RyI>aHIldRC|#uSGxg>~~B)(KM}}jKMi*S!Ns>jBTVic1HT5!1dhx+V3>x zm?LYsDsd3J?6w$&;Lm8%`v>6eN1AAe-#)foJRz-qmnXxi^9VSSC@52>_c3dop?`O8 zJqhs{(v@Q&>52A+MK*6nD_PNLCnH`-vkG_b!G^)q@>k+Y+)h*>Wdy@+YxWj%|3fv6 z(3fgG&Rt1~3h@qUhDzWN1VwYd?HD%jyBAzEcaLaH!KN8}EFQN7; z1p@UAQ;RVi)lRNDes7!(dH#JU%N8A6sZFB4aAA=T46b;Zy$HHGQbMgRrepuNbnOU& z@q(t-8FI0vf00hR{=}lmVFf})BnqwtIhJVS+=V;)@oOIL8rnX^9E(5B`$sv^tfj@v zs=h&JsObETJr|K3-}h6Ch;&j*N6h(`qCZQa4rT3^gs%n9StO%sL#SIf@;!QXKT3?| z`7hfxA$09C@+@0LFm)v=4CN{ z4YGz16<%^Hr0%LeYqm8KWsa3a@l1$9^znaG=OwIR~l8}e(lID0{>Kq<; zh6w;%1XCcVS`*(MQ%RxC`>k6OuJpOnP9<*V2p1SDSVPWz7-GQ;N1u_eZhQwHukSetw+khOC|0a{Uj5Wdu`khjf`pmDB*{GFddJ=HzLa^|TsTu%O{y@Z#=n{nGH&k81t;hF zrkuMsUcgE_%0N9reWCr*|aK>#k8~{ zkKOkiVWn%%E|G~0WGT4$w>hv+GiHU=?y;K)0fBAnBj}RvY*JuiT*u}whqVChPfizG zj{!UVq$jc(=piir0v*`SxM;bV%!}3v!(UlGMQ7OVP1*G(LfLo!l;jIz`fqV&-wBx7 zNVH&l!LR2P)8oPUg!yaSp0AF0S8j)cmN$>tqIFf;<189U5*{;`$}h$Ajt}FM+kUkh zxp5%7g|_YQO$Y$P{Lm@LX8zDqi3W6u3+U$es{$;v30BD;Dl z42~|I9tBi=Pw53L$}^Z;6A4-~BD%?2r!9Mac5Gj*3J-wBwCAPnC=^$&Ecuta&eA#< zy)wVgo;$i_Zm9wMq>gt+V>I>#c87OWBc0+lJe(Cj+FcX_US(VxOi}>Hbn#|&dd`=Nu2WKwfUWTXNlmf2;HL4sefT5b6k8y}`IInf2y2+9Dy=PYN9e;+H%UNaR}} zX4{_-r1%PeeA<$6`1Ao-NF=cFpcyC!Iw5{`!r* z8y3FsZmwO8i|SDKL7P+eKt229--JAJqk+{5SuZu~=RT(#ZcBz!GC~6}Orn;I0035 z7wr8^1HRPTPc>ZkCttL?>#6LX8GWe$Z+*?L!&CM*{H8O;+-OmsMrIzHT~e116J)%Y z7(4h|>3@q;Iy-1Cy?-Fird*)ArXOl+4b{K})EmrRa<`fi)_kZro?ye{A zj+k?_Dl-Z;yAL|9e4lUk?lMx2Qc_SkLbglcuy4GE?6thwJBKNxwT@#hh5?!9kKI1c zf>ZBn{W(IuPd7Um27u3#o4dQY6cQod=Zi|VedBYfRbu}$0sOdoaWsp z*u8Z3Dac?D6rHr~)iVCsY`$~TiNF6M{$oq^dQB1Z)%|WQR&yEm)iC@+J^~sT3eMk z`_7)?^ts#O3GNm7FBIo{g^;nIJU61Nzx6Mu=3ANlzechR8Os$S(5z3#=OoB;8aoAZ zmdqm#&`mmwsqC%KL_7Ay_FpDDV)Vki8LMe8v>FFo(uisviy%>kBIJ*g-HUs^(q^11 zvlxAA5)P0{%$t}-(|loxf$B)uuQ-(-8)((WC;m;#9bndN4$M7ckhRs@z%!i`dmw+5 zpMPlzM=P}}!uDGr^~wwBRzdZq+OySgtKIho`C`?uVGXEaL4S>sEv$P_^=Shp@W*=u zn`CyZODlUu;BQwCiO#IBC;l7rV2KWux7MG;KAxQbiKsutk|*=qUrapJy{ij`8}r*w zOYLr>zxW3y>yI2C_AlC8seY9?HBe@zseOg8IjJ!?t8TtQ2HQ~`cEea`Kw{Tia-^hR zWdaz*zn}v}T0#E}DCT70_}@V>8!HF*|DfvP;%4Rk&!BigZ!MgI_fPke>U@!H?N=h^ zHyIX0T!Ocu)WJ=hcbA%8h zjV+Fo3hr*O;ECT2gkr9Irvr`k9Q)~hWE9R$A$HZVEF(>k(lEV?idk2Q;x~Z-de5?k zld8|c0C~_1LSjUXD#y3wXQ2ay)!=)a&)^6Nni^)jcs|!7&;~C{+-5SV(qk%8~XT&nrB2&N2lvHRPsDLfdnM zaevURgu;WMq+V_2#w|FYva+KpC=>#kvn9n+zEi+py^5#Bq*tSh6~2s}aDa=`o&fUw z4^??{C{HXoYS1${3iC7K^wBeKnHXC|I$uzCd$O4VW$8qOD-7d@;vVNJDWUV##NJ<> zQzQ|{s;LO5YNyeoQtt2aecI(X7?rb~WjGl1i)M~FBas`C$#ZR z(J81nHL`Add+_{EV4cB7zW9PCR($4uPE|Lo_HUyJw+WH_=fY}BWEFM_BIMZa=Y?X zJea#1jf8uBy)IZoE>d?nzo<3_DXT`_U(>%+{1k&I?zrK^Z9>8DfX85=%a8*LR`$=7 z0iZPvQLT#we7m^KnNgiG@$~bRXh4?`#my5ey=U_bY&p}zpX3kaK+UvJ#K&MhIf`vW z*|S1{kBW5=4+$0iHv;I86H^WaX)8s>7^akBVw&-nvlhyBbyW7{~GK6KF#N_PB>R5iYP*uREUNI!K`T@3Mu{rW~wKfp(+C#fah zAWoQ!!u%WgVrvKdV8%wXpnM&)Ur1~CO(MjcPRyrBq4cHR5@BN5!}ngNlA|H`%TK$*W2yf!=ElDgtXP* z#xUZ1fY>kKgL&69Ft$3W{m}fF+P7-SeH4iD^7${sZwtrw^G1Q`tf9`lcd0L3kQuun=6K48)dpmuZRuukv=XOK2 znl}^?z`sTT>V49D77kuN`tLj#x^EF|hVI<>@5lq(JMRCs7`wX(2)N@b9B8@G!#i3m zkwzpO*(|0X6Y1fY{`!2$+5&r5vI|2gUJ#z9$zTVFaq`!R`a(js5 zc&EUk%3fPOL|LlQH|;ab0)Hck9twSB6f;+5#>LKZ%p_LKcs49}-euyl@ycT<&gCuv z3Zx^Vc}I*@&s@-tq_D4`b~ORwN;6rcBdYB6V_oiuhSe_bDc_YJMk%^41U{J&m6lXg|MI_j7}79tvYNH%5ICish6DF+(a zc<^;BxGwx{&Qe@ea42cpV}*EJTK4GqI?+Lzi_zCczs5so^E=oC{bggEsaA~xWApMh zoL#WOOqxf3ySH7!%=g*h60Vb1MgL98?%=U>*Li(aXFbbKRSs=CP>tl6WUWGm#rMI^ z-xR2|EuZqK6C4z}Uv>-lxW;{JZdD~gKM60UI*MCc7`L-tX;{0m!?uXB<5XE?tX|vF z^B=^y!()o(ZFrnq4H3K%-syKmGQoZ~`@qWJP@7O4HYEQOm{wPcJHcYk5*%2WGR)f~ zckunFjM*?L+j3AG2PV?2rwK#7YPZDv)}C;Fm!2K5)kSHnHXWfuoL6hPVjVf?!lM*U zzx7SKsVdkda-Rx8V1!evp#d6@E)RBz(YsLTF2s#}2qxAH)`)Ai z+ctM>?2c{Qwr$&<*|E(X-#zaaali9KoO9!i$f(Zf?x>Ea%&M-e%={&|e?)~H@&4P* z#2VG(CG;LM_PGc0xg|8kSpU!#mG_>GJH^?|(%+~k7DW>L84T+;F-95`Y3(7Gj^GR- zdcxIbzqD`J89j-Qd~Mi)-UYhvbC11kQ7%6sW`NF`>(*E$BBFRK#`Q$y`J z*pnzRuFM=vQCkU0!-GTTueI+DFV??Et&YHrL`x=`QbNszekPvHPs8u+T}J)QL6w-e z8iDI62lw_Vj~P)oTtx|PbJk`)(Gj$RkTTj2VAuzobcJbf5#}eOT9SXrE^b)0Pyex> z=rXz?NH3P!U_7hrFc+%qYw4q4zBC$Rqjix2y16-xI7X6!S#)A+)m0$@6J}TM!-5Aa z!X*>&SALW)jrf*|R8LV7UL34h$Uu)U=h#GHnqIa9PuJo6YEVvKI-K>BG7Uqm7<7ce zRV`tPon&?*zfO{(NJihQjIfYMt0X(d*?Uh*xiQiFI@UeXf{8)9NpZZ8P429RdpLKX z?q>0RuQPdPm!Xh=a7!&{mbK0`?zN%0SA&TuQmQLGse(8&MH}sBnt;X3Bvl%|CSj_)GbxN=Zi_?4Bn75CxObVshjmYEzhZPmF>j0aIDEoFiwWo|XUgwVQOOhH@U|kRdy0RiP3`f;_*v?)F zb)JnM$mVoUbzX$&2tdlg7+|rdP*WpU7jzXaxVT0sQu9vUY|;^A4pOG;HjE={(jDQ< zw9cN+1gM(GNVNs_0mKdU6RO$4I^KQsT0W3F!gK3 zS~fn0VL-rMg3TZETS@$|2;7L=3ZdSKdCb7c+~pDJ7>#oP2ByRUIS!l1UO<2EEh5bg zJ3f+86Lm7%YX}Uy3XIg zm?2J_Gyl3akF1z56FMxe8f(?!BZl%t%IV`Xi_tT#m#A`}s7fbV;bjCJ^qQdu?HT>) zfCi9d1oDP*Qt@?Cq;ooazz}FX6O|<&uVCJdVA_+_e3w^k?vNOhEcu}~Ah!e-Z&*k2 z+96$;N716F;598=j%#BzIGO8O^E>mpoW~R`fYJ-$3&;4ZyrY zNtq0R20pD=vV3uQPU=6RU{h9x^Io95>|FObc(@*bRYQl-fQ$HmrbmU#*eoENI-64J zn@VtdVa)S}gBpyn4gij`N}|ifW$r)zrM=MKlSAdX1X%4f>*dk%o4sF}lDK&vQoE}| z!-1g$dJ3Am#24oIF`%8^G^J(e-&kxkBLd$?zyd-!FUuHc>z-r=KBo#^!^Nd@e(bS) z;<|mYmSEhDzp^=(Su$$+Ag+!6&NMhbCcP&tQd@mZA3NE}55^FyH^b;yrfBuAOb6YTwV?dwDsIr#)KW847#6Fsc0b{#T~x!efGU!QWLd7^FHY2PWE7cYn$~Pfcy+G^pFD+qQ#G zmg>qVA_4hikAGxxFefi|jar+8`2vA5ZBg%d#r8FI3&v)Ni6B^h^oW>;WzIz0bSgX3 zaO5$4oq0WSYm9KvvX3BNx$+Y%pHa13{K+y^@;9k67Bl8fn5mbRS5VZU^NX?#$%=N6 z9@1oZhXG~@k_g4%X5Ci~b+06*_qy4`a1w0deUPQQzqU;6sw{WA&Gqj`W< zcW&7FK6y)9t{al8nyV%<07L*06)dyo5eoxiX%jkRFF0zCV4;+eK#TO( z2YDMc!}nHfJr6;AtZYclIRPy(jL4Ova9B$5O^vJr{I8__ z4NT~-KTzf}fj8G;bLeD`VANS)HxyvuB-yRNS{UL|#}%mor?fGrmmp^#WvrTh!bCCU zf6ZpCHF}K5r$6;cH)u1A>s4x)MZpgTgF%WPY5lqYrHKN>Mi<@$0f4u+rU#$VDgDpL zG6BHNBbX~Dn8d@a6ZRE_p3Ba-yu>qHAeD!z%p_Y5q0zN(TEATzK;GEV&n$_D5 zLeL`}wQZR4hfdvr3QGnkF33G2@H9hZLe*J^_eY`!hH;MbinUr}b(-XC!xdS^Ct{;i zeA^vZdx=i24w~~yC`*{!a#TjAm@nQq6YK_Uei?F-yVAi)z*F5jm*3Bi+jNARa>E) zg7i!7DC}u2GEP+V6IDP2N~Zrw(L;NUSWAD#y(|D^PX^kPJt|Z5RQN;7>gFz&r_Xp^ zuWpKJ8ER;1n?)5oV9=Wf2=T2sd&fCWrVV;WfHnd8DzTRWgwhP>nw*0!i>6lWChI8( zp;{@`Pr&C*lravLWpVn8vJFun#6V*!ZdkxUv@zb6WdjUReutM~{7d296UKipXNF># z_18#d6f?^5L$*(ByAzdHs~4k^J(9F25>tx|;SSQnx`?XPj`i@V)D=2%85diE#s(z5FdrxV+lsYJVB@XEDt z>j_BL_oE@mf7ofUFjcCu@S9?omDQS^)0|D#S-1pyTX+IguH5J0LI0M!LvG%M?|>(wm`O~ zxES~Z(6!(qdPqnR2EEI>?>hn62}dGhzpwvL!P$=7*cvuxl!sJzseRHxsJp%WOU6-f zm;G9AoiDo)UdG8zmQAJ|0&4Rn1}UrP&yg6=q*Yf%jMt}Te6&^e0!wFd;#xi$EVOWK zBU0upRhyGLe`e1rR5rAp?KV2f_0oZM z=tT5z**0VHqk;W!F-Zdz*4om56~c13q6{{yBq$v=)Zn|d=Z;sUBZCZjC)h)Q9VFXp zt6U$x3e93)?!5Gk_u!j4rcFWYzl{+VhX@;A;jaq`-HF!fFeJ+YZDneByTYy{<{hjrW96x;EwUeg?DNJG`rlhU4~sQbPzUF1U7VViVKf9i~aYW1C~}y z8sxSl78jn^J(T?8a?jz3nK&fP=3i*LdeTUESROIlAW)-AGUvCFESul5d?4%wYIy5` z44ghv&cm_Knv1+UjW^yop#gJzLQp3IyG2A0#U;}!L~0TWiu;S0!w`tre%zxbrgsK( zXnT20+OORZO{VjDa${3IQG6S}cy$ELF@R0QLDp3v8)$5qzIcAhYS0?2SzxULFP;j! z86hWZ_Oh;A4&I$d>l8jA>xiiYWrMSg7u8s+N6YG*Bt36=`3Ne4hU5=2hGlV_N`=TR zcODnQe72n&9tur_E-;Im#6s62b6Ce{umRep*YvovN3^4oy%u6OV=de7q#yW>hZcUY z4|_vLWE4w`Md=bQ>{2+ElrFPGL`SO!IE zx-faJh7*xa&cX1A(TV~g_$9O}wNK*9#;&FUs4KCNesKm#K~OAwO4yND3YAHiyG<1V zG%C~4MmBpI%eKZa9NCCj?z{gA<(9Evfb_x&0+Ht_x?tj@{Itd?ox9RN$4} z$DgSe2r-Ph`Nt=|JeA~JEhdJ7Z(Qv(vj|+N25#`jZ9@4rci5h z;#6jMg{kxH9Zg%I$Es?vIr<)nWDBPhr)))onO+Y9%z3Q&fu)S&rrio)(cn6?-@dV2 zdW!}aN}{iaji_af)KvWWHwdBJBZU5$E{2cL500ZZsoqIHnK@nb=5T(8u);j-lX-8@ zidw#UuP&2k`k)%=gDNNt(Qi&sw(&oGbha#;OiJ~j-G0UN#1Tw^J#S&$V6+f;L&2@k5$&Op9KWxeA zT^p5RT`!S2kEN#Lw)Xq^<+wGHllak+_^mrvFJpAxr}Y+}WRyotiRz#XDJfps%QTuW zi7v6XO)U+%Nep?EdjD~)HT@a8eIB)E}he3 z%>5kZtQTlE8`P4l$%Z554SOd z+kaHPcLnt~#46#{vC(UkSyzjqQlmxB)GeRFO{5-ZD*KK!)pzgs$_$Sym`9&fPU1bL zp&E%*-f1}>ubtesd3!4wHauY;90fG#wlK^bt}!Sp*HDu zfAI_bw#`{>)+y-)yVhLq84aqds~)kJfP^T8{%LlGyi0kj!Sdm|=5mz=$l{z|gFnIP zG^})fD{W0zw=xu_1l)(dOT!R4y{j(#^+ZEqeM^CEtlD!W9EOYLZ{(Yg9??gPbeQYmA!EWgAo@z1YBEK@6>xyAnJClDBASy+ms!^VFenSKw2 z-cdA0*iWn$`@*j5=J{$d?Pd+4-8{EixhUnV+TuGcaD3DYr3%TU_kbL}ctI~!08Cb> zOF!NYm?PH8%S>I#{Ky?mf9fSDeG6MGfTnvn)=Rpw2IwL%+>1Auq}f;0_budIs~#Ya zfK>jhw{6~VmrEKVU$4qrkE|+9C`2WkmD(*~2^)mI5q7wY<(z56eGF{5v#Qu^K@;TH z&|S!!Wldq=yQ>~MPe+-sRF_DTf7~;iL=jaWM&k=^$cajg8RD_bygJ15H21o~7mrk- z>&!Nai^S|SS~&+Cg3v}q~^6xEe1X@UM54Go)h*5S}TL%@Q{3QozIa)ZE?53n`9g4kC*vxXjmJdIQ zw?_WK|L{<;a5DbGL)EM!7fIHR-2JX`IM2RT9Y-RJ0sxJS_N`-@^!hP~cU(9M zmxkTQXLIR)19etTqmyjy1mm+t?P`8*=F_c6rHtzwrn6>@U=^9*ON0yiPGmcA2)ZrZ zu&HZVh;*KEDN(RZ+$osEu^+9B+>3IFs7AQ1f?}4~p;R+oyQV_kXkr^5(VGlMZry3+ ztlX6OB`tSl4j~(^19Mmqw^r8SVrm?>R%FT1&POc$~V8BeWMb)B#l7cz7LVzA$gjW})Xkd2QECu`dTcRfpUVuTvoqd1zYjab(C z_)i*7{T%$7^RTSn3#@rS`(=LE8Ql;(VY;ksbP3ff-eD48GfbA!vNO zX1LES(N2)RZq&rJdx|Du=_#TEdQ)IL2-y*ks8?i^ZX*Uyo6eYkKXGz&`OIEl+-A&$ zEzCAb?%!n&Dd)Lp$dssQJNGEXPU77AYP4vHLk3G8-P~PjpRu%Kq5`PPxE&V%G~ZHP zlAy?xKep(o8wWiNd^jb|L2 znb?R+m24Y`QBTqJd9t8+XyypJVi26*^Pez{-|0qmJ z(}qw+G*K`RTK~-SRW5{XM(%`J|6Ab9O(j>=3#mhPxrk#&>kXEon-W(hXnGdIkG<-v zWdB7^k;xD@{fW$T;;;nf3&3T$KzgDa1aO0opVTtcLNHqzV}Qxu*8FCGkf@osxb!8A3P-UJXu!rSe3v znTLB;XA_w9r>_$~aGe45IwOUuI#pWCM3LS)=yK{hB>}bI{R{~fRPKO86AaAp59_oP z#BjdViq1Hd(MPoy{KmBf(M!ie+G@J2l8%U3rCFzupIPdp{nJ_F{Ye-j22x58i8YdwjmGZqlDP zYW4X(Zl6y^XAQiEky{7}{rkwUJY-?#ogujo^+x_J14Ph>zyJb`0^Tira|YQjp5a=G`G9v$l7hFjp)38HE}%B*HrC= zhcOBNV6ruI5Lc^5i;`69Anj<(|D7@CTd#IQFMRAL%agEyM-HRUZ$?9n=)5Vr(BD z$Sc$(>D=r&{Rar54;fNIpCkx5bQW1$LZ37U9duWb{M0!3613L{U=)mL+`$%z#z$QDd9nnThrhiQ z8CZo8h{%A2F^GzQX-ph{F^+)+sS1vP2bl_vK?J!7jzI202bF4v|uq@CoK!oK*O#P&4v(@^#YA~7Y zr<#xqwSe8OFTuw~kuF%hL6rvhxQQ-CyBLiXrb0n(0fO3shYv_zu?S_9CI-Cr;AIz@ z8H;9GY55aYVO|;lqhFE9*T!o^mIPW{u}yHmh^pEW7CCC%F*9hV08yCILKSzf<$A6v zSm2d;Epy-n5R%-`IUW~DDspAcXORL|mlds_!Ps7EjxYiHdfbNI-J8#p+}ar^bkper zfQc^F;_Vi9NbEt+F|SxRs*#1p=2P6ZRLI25$4X%ii01FGEoxmV!vw?&hDlq&UADJm0hASH5R2JPlNPa2I#qsFtgw2z1WK;&QhPRUUuT1z(q=eiR;@XnZ43qi|cAC zlUSZ*J#91Y*Vu$^(Tz8tLy{5WOinT+X4zw-@mSkj)9GoUVj7m z@?{b*GJ}#*yNra8JCV?Gliz<;vrf7hp|X{dMzsV}&B|5|Jde_ttv!alDvou10H5Ge;QvmovdH z%c$Cp<@BfZI~KQDCYbMV`Zp}*Q2gDq9yOp1L$0|-l7IArRtO89MlC;?wEd$t(gu|( zW31@jR5MtntGS^io)}ScLuK7H1M5wUxM$wGYVO|eTQCJ{A%-boMkrxo4j#6Ygofi4 zddX(M)oPh~lx&)c{yfqf8o#W8NA(yJM2kUfMI${au9HgyS(u%~29ty;C7iOFa!+C> zd2Z{UzBp|;LbyT~0`^>*Bo3Qm2(!g9U&5FtG&R$s5E$U@CP)6<_T%0G z;n~L}I`|(dOfdBUJ@mms@x(^qMpw@IA-vy^YL?^^#R3#10>s(G-0PzEYo`kh{q(w+ z@}+4z_%-*d(YLow1S^M9!(biDC+QFw{V^VlIY zTk*+h{pgijerz`kjz3eHQ+vW}yLft0nchf$!kKr!x~j9KHO}HiceZH+(pbyI&TPAR z+6rUWnloPnw3@a9m$8FsjuYWd`xaS?im<0B$AA1ojCrzMe{?4(U_kR0URP57nLDRc z5I;M5@}z~A8;xsw^#Ut5ip8Med@bS3u~lW?>1rJHifjQyct#{k&*om9LCA=XNe>hO zUol)FT2$(Ss-{uWnY147TAr+UF^+ntn7rU)1DTzSYw7RF#Y7gF{rMCMLz6J6=ASYu zufK7`fAq%NjF`U2SFR3EN>U zxxd86TUmb5n8Cr&&Q+;(!R05gh+}b?6!Tg=IbscMgh53|bpLnB7}&N zjO%`8WS{6mpnOx0ff$VeSZ(gS2lNf=eS=1s&kg(s8=8}i?f;MR6t}W_)Nw>5Gx z6E!pWVQR)8Yi4iZV)=JR$o%hdoO+3RHi3+2Avd4s?ORyGWbD@YQ0z2G^@ztU-j$`< zbK>F81>b(hc&m2k1-v(}2oeTA8mp}&j(az1=#5O@S6DGZu5E1$c{rO!P!rhf_-2A` z-c+A*YI7^T+PQ%rTvN<)V-d+il9RCmhD&(ZBV%8LgQ|Y20|1w7G9Y+V!;@_g(Y5giCu~zmsP5MMZf_1)PDoYPiG0`Kkq0 zPXTwa<>mxcN1jRXGEPVPN-1^veyVAmRPT>xI^&basOOU+JCM=Mr36d9!r0M_b~!^l zCEm1l4H4z+TTnBm*pSr|I|ddIDJ5VflupHg(BMm<1^yHjGv;*{WDD*{mkQzppLL`_ zHt{2dDPk>wuFn|b^uplGry47nQ*k=4oRhQ?(hIrHYlzn%*X9-rMk97E@Z^gvr;M+7n=0qu4w#G9lRTgooeh0QHv z6kQ@VZ+qiNXp}LD@;zRyP9+hr=iQR0r;{C=m?@px8-KOptAeB2aO>${g|5>WYFP4I z-Nh|uXAlhZo)_PJe28Qytb;zpdU|qyb*W>iOYucKL2tZLT)jE*-=;0k&3!#=1Hlr~ zN1pS`&!u)?Yi4*wy~=2E$Uo1hcY3uAL}tD>u&v3r+PaR@W|f0&Prh;9-#;%If$$x6)GtY0Bye4$w5h9r%y(riwYbrPa%w=hUAe#)j$Zy+W@LHa&dY=6=b_`~Cyspy2i$v;s1t=ReBe-@u{%yA0S^+5R!jl4K$a z1(8N?{37^g8sO?DG(d=VQJvPZ&8FeJ**3;uP|-~gUY~7Nd)?uXRsEKqYOeK*-)(<4 zCu)D`z}d$THK@Vs5Fu~}WXWX*0EIVHG!;2??hy&bZ~QHT@)`#giEtk|2sysb zhe0huIVh+(BGL{k9EF$eIYum@t`8#YBi_t){-9`Qw12-PtVlBiCp>Fwa2bb<53r@r z9F1Rm7^6-hRt)f(F7ZyI2Ul1$6W#$Jr_YU3f#*l`p}Y+diHPN9RFR@KFbKxX+n_Ji#Z*424Fh|Zs#GNe+a0&HTVy_n z#ElmewE)*<_$>crM!Kvd%U{Mnk4)UtwEQHTqcBksG7;X@{e6DLf$$KWVdq`5z~^uo zxZhA6bnlDe*X=ww%SN&t?RB{Qo|#&kUFqPKSw;rKgTpj zj0Eihr}{?s;(5`tTotNe%RZuah5zJNRSFx9xY)c^a5NVx{RRw{f>zEnMjZO#dq*!$|dKqm0^#R8BH1V%@vtT;f;)F#dCQ# z?|9Ra4L&Wz>vM$8wCsuJe;a0wvLJ(!07_7ct<4+l8rZ@P`N;01AHH_#NluXQe9e1U zGb57VE!^L>JzJf5UatXMk*Ei_^( zPR5AcHAfpDmYPh|mWgI4*7(b9I*(OB`VFZesYHr+U#H7~{I}G3mLkkYv*nJB`2a0y z=nz^FotjkHVGI#@Q8uMDL7>tUmEjOVIeMX(nePSW);lwgj{JLCUm)5FaAPmwDA&n)@t z8aQ2JlIBMU7J_nt4z>ksp0~LFt+ALo!rtOM)|-0}LO@X`sBkmxC0$WspY#~_p*c*p;2gTwWIv(k~b#$oDB^eSTe?_2o{Ta)~vi*0^2ukPwlq}E5&h)<-JXQ{tfBwpZYy$s+=-zxq z@UF7_`Ucx z7AoQKta^1kYW$AloGW*ZS1q{8h^PMGIPnVGH`YO{eM%SYs%1BLpB|ia+w9b*h$VFC z_*(jM{MM2t)#fJo^S~abIJNBM-WlamvsI5dX+|c>t9LRNb-Ll0*Ip*oDGu|8na4c=bRKIpAjq{N{0}dWuyZsmaQ@r zs_JVJKZF?aflNwM;UfKN<&ZiEW9^+$PUHJ+EeON^qOm zQJ#}!teiliQSPX|vvrLB~2h^HD#DJ`WOyg7; zyP*s%-V9ki$lXXk#dG}It*hNjpj!72N|0I3OO5m6OFh<`Q4hLbFUu>0%YU3)|CTrQ z-`7i~f2c?0x4>f`Bv9Ya#_s>v<-Zvz|DQ#|M8v|v%*pou@a!=$v#|ZcXu0x*_R(GT zyy1G;(PGUs|4Z>M5*jRpW=%2dHuVxXQZ1%-DP5L*BMAVVovSrwc0*K@6eJUr0BANc zIVkdJh_kU6ToK|pR;fL{g{2(Nj_UN!8bIYcV>z1AR!ZJ@BGoR6DmV0r9CvWI{p`;AG&{9NM z^~@iXqNkKY=IJ~Bi#4hC-jJyz`d*sevU zFTc`JV^fZQx?NlZdDLwBTaFIRskVm3#TzlsyBqEg84Y^Sk8D00?M^~cB3w549*gw- z4k>UU;BR=iZ58l2Hxk|nHm@KpP^93MbJ;y<0zw$`dXoP^0i$hFm9D6I~mGzO? z22K|`b`;FCMujyxBR-&s{XxZ-bEP7OX!cIG9~_;!C+?9RyDILsC+vT}?}PX{<0F%z z@0YUU4>B|NKFbS}WKCfLEs)+58;Z3UnUqRe4MAziN* zNrwv(wn~srELw2QQB1(QsghmP)F$|?mX2X8EeWkwGMvWiD&*2GWx;$UJ8^K3-55Z- z&V`GSXhqz97nIdP1(blQVrBJb$WsVOkOF@L8?Juift}+DZUQKI=0W~kG&6x>(1b_j zgim!BRJy)NGv1AIbj`y`fw`O*?2wx4bIUX3mmo1edJ)xWgO!&(1}D8a9cyVU zZ{)7egC-e9P{&HfNg^XEs(9Qh1aH9E(6=K_DENYsetjGv#8FCuLZ!SsTs1?zNI3(H z+7srUD!Y85iT*E26*Vt#I^6hPeUs3cEN-&ACXn6;?V?wWy`^wY2AizgL{)q^uHw3d z|037HHqS!GJrYjhz11u0NJjO1aDG0#$-&^S@c5;)1eoGO7h@MVJKz$`=;Vne;*=RF z^(@K&YjaY9WO?xG0vGwB;Bh^x4$!C~_@m^rthA}NW+6bh>_n6>H&c!=)q!4?j>@G^ zOf*?1&!mXfDAQ;PcY;{4Fm0bON%sg;25<}y9&s>(En6r@rRU-CuMCr@eW))XFb^YFQD zM?iL|%fz-7?$&HY-x2rG-R#MU%07|&!ut9+>#i_vcA6_T?ZS&HSVTTOqN$69YDss! z*2MMe97pH7aU)6RyGbKTC!}#Bw;SS!`O~F7QYKrSw~_72*tJ;wI-Xl?7&Z21>C?en z6NyIg89TcU&0@V+bdK!-&(g?*SaiJY0dliaOuUQzu-Z|OBBq*BdRF8StPnr854s4y zn+6eKXR08-8{%I+_U|=TnBR>d*ymCo;&rVX@4nt!P1gPZK?i@Z?)88Al&|2=oF zX!EZs*?@%%q$czokuz+Ci^R#&3(iQl^9nNZ(bA+Qgh-l<;zLoOTh2(A$#>bGY(xIV zknHM=!iYNcvQqpor`3#M1tY3_0Z>u-frDo?c`y-C;fyB2Lk4sS^ikjvmXoK#;??v8 zXTny285@mqR;WL2lvWyq($O_6)W(98*s>{bM=K850jE*k)yn2RRwa@bgC6I4S)FC# zx_?VB+E7m&tpfJR(wSB{WgJo>vzQz~?g}HU>M5_}V&Ea`N+#^eE7oz&2fD5_7r0Td z^cObTjem1o#77nD(Cpau)o6A!@3VTC@I&O+M8E{97u(DgW=2kZuoPJPfk11Q(r`N~ zf-jcBuqYJ&M$Ke1svdWFCD-%1+B_PTrN9{7Knto6`$Cbn@~II6vM(RAG{eu)rWKAT z!IaCWg7L}+Y306(k2Vb9sa%LoJMz^iH$Ze+I+Eo8zK$){*kkW&T7!3;U;mJ_8U?h=RtRT7_cIzU6gU$L0hFBu55hKFPY@srf&(hb zl@y_uXT9zEbE)G3o4{;NJ!CZB4lY)NgOL}(&cehE6wAVd*)Sk_{HGK<1*jWimMc)n z-%i|^@gOdZIpNZdeO!SzreBTc2xc$?pPhQJnqnV@^FFf}Ans>bE_!t${NxmOa2wCRCk58(IdB^J9= z`tP5*mlKKj$Nqh(b6!QnqZWoaXpv?N={h`{<6(-u8Zj#stR6R$BB)>0LTsarg)Rjy zcMPzSyvApuz#wbPK$n1*Aafs<$x5+*`^Fo(ZHOegfe0H3f?OIdSY8(l1+q;KTp$v( zR>cjCFBU3)Qys=59OJ-?qXs8;S3)sN%Pv+v$Ot%`_Wh{0OjlK>NS-{2u;1y)M%W_a zy&d_wfTW=GZ|ZJ#y(U%QXLD!ZdqexZGAlq_MN&90IV4-q_*PycisUC|38ODU0p zE*LH(F|`EH=0k7vS~#MLVO`=Fx!|==<=0h17e`i4rj_QRwJqfPR{4-J{>}=lswPpY zfK0E_?F62MJ0-i6iiHlONE|nE;>6<*-8rvyz}cUdB&#@mDqy)*CEEDCc{AP&QI#q!2M)A!>rK42`8kgeAct zCmL@%ddmVTnsDmI*Y%BsPgbN!5B29k&-2s*5xYvZI4&aG%;6zZANjyF8vY4cObE6Y z(WlkMpG1A7spDd7<7zv)+4YI9kfXUd7RCa`Yh?-HP zQrR=v3w;r?0_JnCMPxAt7 z(DADZ7V#J1@0~ds13%$bfSjG&$MD^0|L_RTPJdn|YgpDe93Nh_@_IP^dbZhGoj{4F zwYn%H!%xIo$4eM2V;0cK;}#TPeL3j;)KUECPW<8EHKndsr-pncMV4L-xGnafkp^c> zU5dp9gmYVYrLR9?H-dxu<&F-^X^2L`(Pqdu>IN<#xt~5g3Z8>zwrsVUUD12?t?KRw z^gMZK3^jZkMEtHd6o|dKJzO$MJi85V{}EEb>;#+HCZ7&Y-Bz%`N&zrkxd2n*rO+>* zY~zU`M%M+k_&)vx`6bTz(3soJBy#1P+Sox>8&D$Y1C6MW8+Qjz;3m3^IF~8M$L8l_ z*Awj%sZZg?zNnRl!n6r~yfO-zhD~uNyECq8!i4)YB!7jHv`-f!n#n5*51$8FN<&RE z`IMPe0&=6}xjQNT>8BKtGVh=5%&xzhlUD&A{wPV=kq=IFkX@e(LMI$ZrM7}d=llP zT5z6`?9qd04t91fBeY`@xrqKeq5@19`QVcRr!{Xlu7ssJ*M}!Zsfl@! z01X&zv-akn7`;pnBA$~NuXnj0hmLOFM(PCoz1>A*$PpjvqXoX^-XT3v|s2 z@EV0P3As;ca98o%2-ZPjfG8yCrplBK0v&4PI#X;q~H1undU!}>4G^#Vg z?IL(^&kXe3t4b|Oyazi_!&~V0WL+*4zfGSE7UQ??oale#-a;L+B|@FaRw==Ng(oQr zp}e`K0U>F0!0$(*Dh^Ep2B5=`0~`_=Et?flXzn}ckZnZuG_{hT7%*@WO~R$&2cFe6B%QE+FM&~;N;HvYbFI|SK0zBSH%q|>HcCz)m~p-%u6 zIOShxF4_APo4Yahdtqk>gb*$kzGm|{`+XhJPjJ-6#+qbH0R2w{bO)`)MSiR?brKj& zL*K6_MYLdO(b!DSM@>yc*g$=beF-kQ)s;cnkFr?NLbU;O|C7Hw}%q86W;xy++{*|Qy(GKrRRCVEJ#n*^tEP1#SA98D`)U)n@!23UB9=( zCGa6o`79pEj{Xz6Vp&f>ASjC6WY%&Fc4=LO${2!k$SfTfetBypWPb-0IU*cqWR)Y- zbubc211D+YoKTCuOm$vF&~dd({p!J>oVZ@#$i6aLrkr?pjux>61?E4CnK@wz1oQeL7(i82jhm$8(EQp6PnI&B|CND8&s2?l>~n&o+78CV9$U z<@3h>+&R`&vx|NFlBso(c*8HUw5P0W$9ZyV(K+?{aTFHz;EN~!fzZT}M1|+Y61F^5X-gigP!mCx9x~ zKieKeJFFuqB5O89n%zhN{xseu9$Jag zK>?wzTC@bZ@hxqoMg^ZQ*#R;R_&xdOz8ja5ocMkre_#fVAv4FFr)}81)|DI86t^6} zYCrr2vm@k&lQt;{gM8p=`CYr^hTACNkRXs@AJ3My!B&f)g?vH5tRBTlW}YN+|aBZ#)yp{b&VNJ4FR5Y(PK}DqA?_>KwQyEYWN$gGO8~$ge zy|!~f>37YJ0eiGs^d2HQhX&ewnnuTtzU zu*x|fhN=Kr;RM6dqh=E8)J^FF-Q^k&bRD{|)`Dv0Y1<0D@Il)nH{$P?PSe&bn?~(A zO|J6Av?t4&L@JrOhMp{?xn4WIrH<~Ns`XL_x=C!@Qx*u;3Oi7T7xG$B#@JT>j0<&jXP3R9yxU(6J1X(-8 zuvl@@R6P0IGV{kY$-+eyo}!c@urX_6!(>pIMaB}D@(c6ElVZ?n_!iQ)es?^F&`71d z#}wCgmFH7*W$&OyOB^_R8_vM9*sNS$IE75pF}-s81IHR6e551m6TO;}7&Q?2X=x!{ zXxJ&nX+0?*oc?K;c+MNmH|qXMBX~osbHQof%0bsw3D<>-Q@F>UaR?tYYJzy(*le1D zUw4~z)cf&c+@YatN8j*H3naK4jn7pO({fGs$NWwFkYds8>DJX4&foe(;GmD%a@taa z(+Zksl|*OWkHRrAj<(>VOf1VHqh40Azs%@SZ3~Bzvsi?job0jd6bs{J)0Vmw1YJi* zYzd7SO*^}icZeTr3^sTUDhJ$LD_xU&!Z&O=So2mS-FmFP@!Fhd@|#+hR}>eP=T}yD zARk&*T2dq;&3YMrUpU5FYul-P;`j}0rGa0DL@j!(k7!SqL>BsdRa%I7IV#0mEGdfz zG4X?H+gs{iz>U3rHKgF;80SY8*1Xl11Qc}bH|+f%#@+%Z5};`l#$jQB#a$M67I#?O zVR3hNcXxLNcNQJo-QC?C7Kg!IjyJi>egFMmE|;0EbhT8v)5#=LRnJqEXgZXy@CCCF z$#rcatoV;1bO8^k?~}DnildsE=%w}29y%B{!bK@Qi2@rNT83lyoVS`u*N7^2Avbl3 zZ)0OeQz=g!t_l;6&@7| zztV{5%b=vIbq0z!rJ1#O>3NNyo$O~3V`J+>cV5~MJIxRd^ey;F9LCgY?bbJJ`wrqP=A->r5{ehLYUI!Q^%p)m_gKdxgb@dpUBd_O8vm z2;e#V3_3J;)1Gsim8y-I8FEE&4W#a1m}e-5ZS0N&PU&Cf`*ge$rdx z%A>3MzM`KD=guRg=DE!`|0xD^aHP zc^ly{mIXDQ4nk9;VW=0So|A@{ zhj#=~-4QLHGr7P*n(lcRof+;3H%VtlagAdwQTZ7{T+sN#U5W1`U#Hn*epQvQ)e`>s zDR)b8U3qz3d7a`o#G09ycx)pPk%aSIy|(|6HxHR8SY<6= zBftdUdHHMN!7LFiOGijOW&oHp%u2#KPAWtQcj6m@N;9WTuA+WbpJv)oBLM>N8Dbj zl+9&a-}g3t?%M8=M~Ji&K1U%~P@*~$$j7a6ft{*5j%3Hkn97ITo~uT!4isjldNwNU zhQb(A%R2ZXWyd%sTN9j~x@~yBwFKf1CWEw1w%VVcAzz%1VtpHV=_KdHqS`2}gSLES z7>zPOs8}Yb%rvB$GUs;x`LC8Z{-ki`h-w%<_z<7pF*Sj%FC+ zMv&+e-VvbUg}AVWc4=VTq1mSg~NWqcW)i@=)dORv9qr;Vr06E?YJZ3dz)(xGhdwTZT)mf?#9w)DNc=|7$5oHZL+HXyrwdeT%pqJt!_r{vg5y_4kHO661#X6vNFyLf zV`1GB3<^!e+`47iFiSRVa!-r*Z z^1$yP^J;aX9k{RN;kM|IqH8)UOaS>DbH!^8aMA>phAp=Y+ z^-o{ggs?s|0S^A%TM(`D1fT!uhJ1B^)FX&2GycnM;N#znt!ge=Mj%YbhC->X>bU~U7`WgzZ!-lOW0ey^5i{yUfd}@P#&;sL z($5=xt4q(2S+vCJ<0*}dN>CT|P!E_(JEa>c0OAYN>0M*we51pcE%kg+XNSJx&Xj6G z;u}zIQkQkxaJZWu>-V(C-KulDMUXLr_|`ArN8AC+WFXnaU(c#%hSGb{096qX5}v1p z4qlMn{CX-5Luk3-a=O5v>RqI3SH{@QD$u=fb0SXk{xnSFb2l&E$6>u%*Vy8ImO{@_ zV@Ker-_eb3+nXWasW9B7B^av_)|7UgI z@deqUd>ksbD*X6(d1*UaQzO_|raP5mCVJ>0+=gZ}`O8?lBu-B78vFHoWxSPi_LOPp zPJb)836(g6!?rkS8Vd~`7xm9Top#JT-N2&_PXU*i2RNbe+_y~o$#4JrgyxvK(iZ8# z#ZE3+EHV@R)i8-ZiGyu0bIJ9*egR;MkRl=-Xp*zJnDD1%#!u((-plM7VVp6M`X;w# zulLwDLErCQhs6ALGHLNdbxAxV=BD>G`;L*aIGdA*K%b#rcEn$g*$9=I!ZZdf=`svx z=jlhy_0y5X)eVt17X$Qn%Y|Zd@r0jI~O>08uDkhvD0|mZ7Dll zF1PxR(tJB-K){{KaC`}3H7uxXojFuWh5hRI<2-!=wO{g+sWfSwfByvSIb%8~IMM9> z9XK+{HCtT?sCtkbMn$t<#NQw~p*yCjw6TbV?uX9yaDEiX5KbsQ%j9{` zJndh9+ihFR;MUURy5RKSZT6N{n^xwVcfmP$rsVgN9(@_$W&{j)SD=ep7wJFG5?_Zv|fx&UZVNMEdgS4^=#qb!9Du$%ExS*i7~6jF{l z$rChNml$}%F5ObxQn^52T{{rENAL5jXs@HQ|L6H3zr2xfl%u8Cwk2{)Qv zDXJZ(e;Q*ICgg)K=JRD$yc>5@6{H;O*8ua;{7FhHDQ}08vNH853%&YE`+) z9%NjO#m4Ar%}L(ioNC%5Bqp;m8s+!A(!bu)bxyon4lh?R$oG9s7q`_(M2VEdK}7kw z(gBN4O;;BAZnLO&`ecN0dFr?YMTm$+voHldnT@#bIm8|Vnf3uPj3pt(M#eRNrTy)7 zp?b|7YU{#P{S2HCUKxZftfLne?cV3|fTY?AxMinj*jxcwvA1HMD&eOOwRWauIh&GG zbor^~YHj%>EQ|sS-WgA|ENe->Gz=gSv?h1vz+0SAQq&&qgPpZZ16nm?$JBA%5O@Ts z)qDQ%`AqM*ilpoN`@~|0Ly=++5HXm9T1Hl2rZS4M&swRIt@nG%H*^qdV^`SQ{Grg& zPw7){)jJJeSY*0?7uFCLHVG+_cxZnaJC%CT>IYhuXG(qe2m+IpV4%*1!`Gy~P(`A~y_j=rJ09O6)*2g90lf3km~)h4b4Qy5}a+zMdAOGLy=kA=9-3F^UY$Q9(N z2yvier~ViM&JW>1EXjeDPZdp&ubd7vDS-Hz~`{44vbzCPu7 zns~kb8`pr4p0U^S^Zj=$lPLJl<+n8cQP2+ZN8%f(kM?$R+w$XA$w=ciXz9%(-RJX8 z>oAPa_vP+W6`8?z=zg7tgVy);yg|fIopPI9qjpI*Gkw{&o6QLXdH!89XddC}tAx=1 z@d2spno}Ai6DI$NgdL376Qvf8$WJar|8z@=8j|3V!f4lIBveP>mk2Q>Be=~Ebn*U+%GmizYMK=ciyB_f%Mw9 zV#hzg+VNGEtE`qA&(`jFdzOhpb6#3vDDXul8&0Z?&is0BF7vdBt3Uz-R+EpG* zyF@K(VXv)W0<)1vxSpqSP^W+H(vG(x!+QwK>qt05A+5m4oQXS9yrE90TztccGLBQ; zGE3VsTN-Nj2RkBWxWZ=*Ow?bc&r%razapP}h)W4fK?*_lBJ9ytH37WlBQs2>NwbB$ zTx8o+RyFAhIGJoKG-E@ZUq`z?oTvHTzCNipqYwWy&8AK)cuR{*m&ki7&!$e&j~NAX zCXsCdggG1a9e-tA`E5yu<4tPOkYZ(zR90{K)_>`y4qDb{IjOby>MJ#Um!-vN;w$N8 zpG&e@-qBV}Yu5;>rJT;5)rX}X_4yNY>wlXJ!vpRo9;8Di@Fj#u+B^D_Z;A$yJppa%yDUot*QaC< zy>UIQ-q+iNpXI@drkto=~vWi zn|O3GuaC^Nw_4t-J9qr-^mW!}UCAIH<9d$LUf;bN!dd;}C9hN%SjmZ3?4XzpyG}-n zUvEpVYV(CruIrz80HKZ{7EP!a=*u0ft{Eglzw^f!8AaA6@=G+ph|~HbHJLe;J)A?Y&yhtN0T7 zF<*m0-@XjPH2-H&+Ag9m-diAyaC2{T)lM@s`!(dA(_U^kBPx!c*&t(-eB^W<@1W(# zKxUI%x5b%n^4!(@)4KfF0J4rGUS|#_;~vPV<3i)wY7YyXk4_hADHWV$VtDqW!X133 zzO<8yKO|=v4W|k4v-*4cSiDNHxI%YK4An;$r!>v=<9OB-8ulxlIbUpTj#w0(?~g_- zY=Ud~=VL#bkMt*v%8N&~Qy&dWzaB4NLS^-Cjge6@pUCk7$48ZG=mu|Jg~^bR>px%l z7wGIip3$)7R|4u_|FMpJBk?n3$hjWN6+;S&JQy2bZ%g~p9z%&#p7E#gk*l;V>@lVTa8NoJ$UrsAVI z`{SvwQo62+{}1A?Ux0;41acK`0Rp*yVqwf$WMUi5KMj7ZD!Iv^J-xq2)mF(2eZ}<~ zQ+`lB0;AMSYpFAz8Vf$yTaR4Fhv}kA+Pq=>QMl}QA5dRF!NLSwIiI2~9C>%wZ->IP z(`x+V(}kGcy|#9UXO>P82HJc4Z)Z~h+llVCwBniDrHi8_SItQF1ijur307$FNs^2y z_XEx;SXz*hFco9YIJ?X9I={)A#$hpH4;h>gd)c7tc*>){Po zP5&O)2hJXtB`>Dn^6?3D506Be>;7Lf`d2~9SSBk8$QB#uYMoLdh=vxu zVzn$~Q?IfXVfRblB&Gwp57Vh<1&Mz5l+@@pJQo)2%b<8!ibiwbzl+Lv%fNGCz0g{O zM>Owf?gn9x)>O2K6lU3;&5j1OW zu5t#ff>un9I45}{a*&%n64DLIqy2fgsL}VrBc`qlw|w29Sj9n~Ghb$5TZk>WIusw} zXUsRl?@&a|LDoB0-&si*=cg2AjNAC4xr;Xovs5vf2U*v` zX1e`wD7)3gmENi}ZBSoES9AcetC^EcNPW!Fy3CQSLmiz#RyN62#t3;aHOD`A%}D(& zcRnAhkS3O6%+C&e!v2sZkzEE|1?X<|={Ht}c^wcNoNakF{K6OWDk&yfG_=;mKinYt z*8$XRf&FkuJIiv=9W>b-C4c)zPbVxMmf}9Fuw@2Y6F-eQ$goJFb zW9n^W&{az4;6L7H-9E#Qcr3Q{NSqroU)nC2IXdOL-2RhjJB77?AVx8pLigSD79aHQ3h#nI#3>M@i2+>B< z9*@>-E-oWKBaDlZ88$JdC-R_-b4A;66Pv#h!XHXP;vy0#DO5J&ZO4%YJWTe3s$m3O^S zF%-J305sNf(hw|~4ku$iRwWLSQq(;0PrlnDKfcysxT{MFkJq_R7E<_qqbX-YHg0__ za(coTN;?EzgWE=tYHr>*RAsbQ{{|f=ay4YlMQZSr{>oJ=9P-_=LXP9HggW0lv!l@6 zo@jJ6mkebeGg?%*R8Sk%;P&%k(O}P&>@Ib&*oc3w*!cX^;eBSiAjXjVX3@Ct(?yDH z?ni}|lc+51Wwv7dLTnpmW2}r`!2Nx6@!unfbf`5&*jxJsR|&*9&8>P_n&iFXMFzy3 zbPr$TwKYLf@Rw*^f|@ml%2Zt6gv-AW(TdcqoFOpL8WCPuW_y4~5WX_lS?b zKP+(sa3aRYD6epG5j(2VW8zX&%ZN7E@+x)ag>*uBqT``Vvm0_If9W&RJ3E}=nFNd#0ToXmF13pKNO|wp zM=x60ft4J~aUj9PaG_;nA44>v0ASW&+Cl@z5n%V zXDa?1PQx#PSAdya`s7v7qWlA-gFKBYY}WTC=y=-Ggt&=F7M6UAyKJ%FUPL-1xo_%| z+ck*Ik}SbRQF-F~uG2U9()m(3SF=zScP0hBWeht1g(W~KfaT5b$@S>uF}<3@Lg|Q_ zXD(KV97E1d51+xz~!T=R||?wVuhj{meAm+*FBmu$+}V=N9k%!0+`_)Bjso z!v7Q4?*E5$2>wDkoJLm+{I@3m3)t*`Asv`mS$_TBkPhse?EfDQvkPqmXM8n}575MU z6(Ml=v@y|@JdQQ7Vz`PI5j80X;M|p7~sWkT0Qs>0~`aVwSSS+XD!;WwjZQ__7 zWxjqs`fYzstso7AQ)OO~0W`&inj5xu`8lH!j_hS+vboDZpBgFwVBAD=kDtz;WwmTrC|utBV?Dmp89it0Nzn=d1Cd6Z@rhsMgGydS8*}B z-8hT3o(|oD7wpX%amWmAy<~pAm=)0Hl8(KcXrJG86!L>~3ohIO^#lkrGpW!04lsEI z#Ej3=_0rNmuSuKz5|7t%`w8*NB7^uO*jMUHdmwP@F3*27GD8-wva2jAi_Yqjn?OUT zB#P^CateXZsi`h3r{X|`u*9z>gK4jedTAup%0TWB>fHdQ87{&)pdvroP^(zDb z+e%RYVE>l@xILc)+|p_-nbRHt?CO_)HN`0b)S!HbE(TV`Y);w6+*W*|cR%3UqduHu zVV5EJT&updp}uXNcP(=LbX`8}Ak#`dTCM;;d|{tQ%1V>>Yh@PlYe&@t9BBbcAf!EH z*hWh-oqx>{E#BwXC%5~JG{os)Fg1Hjyc`c0_+0A`C|ep$8~=fkmBmTQDW^#)pa_Y+ zLS=%Ng?gvBO@A3M=q`JTrYRh=E9duliPlt>>5bRGo};7)bSR=ik6teSsq~G2vocc- zk{CUcy>WJ4Imc3nB6!S>;!j$r$zK+%%xF3^29bYCpJf_H>5xQQ z`0L5g6TcJsXmU))WN2=xNZ->@E(k2zt-X?}6l>xUv~xq4P8*7Fh>J6!gEg-XDyXrR z57XPKE64qO{+mgkwbjQp9V6x}V#HLOsZp5lE&4bsWl#ZDoB%B+!kqO~utCPmeC%&+ zxTJ7aEBtiM&-%o|vHX=)?~FZsGaFW%7`fpB3ad!5B3K0<+z;&D((Q(4XZ5_rp`9dB zR$L|mv6+cqfg@nWGEcJYa2zE0^1}p4g4t-T?S$jrA6BMvck<~?Lo`2xUkbY5bgnVA z=t&v`n3+x^Vnj*B8feNh1FqrB2??<*BDbBNCMN#Oqf)D8uw0o#AtpzmM5m7(7$nK| z{+ORV=3w#RZf3`_wO}oC`ev$6GNwV%*SAKut!T;+@)8uI0t`vIkftXqArE2e4gR5> zJM)SagDqbU$L`@SB(n)gil$1^C`M;pHnOVUrV*rZpy5RCp;#r)=}a*!X(`a)9$juu z8p%10rIzgL#Etoo`OIH)+Ln&B)(;IvENsf}hug2zHIj-Dcq979c|adNLsrdPNH1$f z7OU@&1HoGumc+q^8^4mt$uxT2w|<7>>yoUth@R!Ybg71-yd7xZ2%-lN;Dsonpk>w2 z^c<-w^?Bny5B7(R$wxvod2l0cuX?w4NSMDjKF6rQ6qDBs7u-^-k9w2A%flFa5{oG% zH44J-i-f@JVK7?^qZ-K=16RZy6km`*Qs0v3rsz;S#>;XN)dlcO#4}&<}sU%x(x`$D~H{Hu9tGCPRL7TVB`@xGh-Q6gj zr_MR7>77T}E_aGVNy+F|gALBzd zn`6o>&oM{9Yx=n!#@oDs8r$2x8|25e7vkIgqvq2v$mJ?-o1r%4Z42!4sT1XE zvR)p90^L3c+gOCgok5rh7m;j;!hV}!bDgf0F+r~$r&Ws%bB|bOG0^sXYlU%icXz9q zLJ@zu@$oj2rI~%mrlLh4uy~}?S{i;@jCbAJv%RK+V2&>5Bg(~awaN;Cs3egw!iTG) z|2WdlXmDd0X#f(b!cG8Fx?-k#H2G z;N|bBxz4faPzC3R&^br1of^|c69$*L0gO$*z4$YY0B-0m)e(QX4MjFc!jepSBC|W& zcH%Fz>M&yzcVf!7CvEFgkX5N&Fl)guK4(j&1f!m0>@ad-wPi^-fV~%{i#zltxar&Xp8uaH(#19ZuEVpnf$#rOPbn`e(S2XoxB0m2R#F zwC$@q`YVd94;Y>uiDo~)?#v;756U*`ELaZ}*uH+ZT|`6z6BrZolm`qrl06|3k|QBf z)d4Sl$FLhr=PxL9a6<@DAG0(zSB!WzSGFS~e4YMhsJ4{bZ_eRgjbM2d`B$%tH`ZFF{+eBA=E-aLmDjMo!`_`PJ&Caw@wgIl*Zo z$iHuj;P{|LEY7@PDL7@H3C-1iv9noA1A5<+tl2gYoboM!=6Z$wrNrz#6PUHjfZ!O~ z-rMe^vK2Ovq~ARpnDy>PH?j&Elo`D;_?i>_YOmhXt9z464PGg%q8G#BXlwecE5@c1 zX_k}6Cj+Jz!^=+SdVq_k6jkb^n^OPCGSZpQaz^`qJou4g4nrQ$?Sa{u>EkFSew}Z`M(xcO1O#hKI|9&l zUHeFw9^E%rTEk7-d_1p{!W^3oZ#`DkjLmhR&MAR2HC@$*KP5LNW5tsWug;u1qB`1`kczbo7T!SgH^!TtrVTaN)s$@J09kWRgB7ur7f*>*2O9sWCp+Dw(6#) z>I|L7C0-uQTC1A9*?*L)PlXsk?KCNV@^2`iPfB1libyKZG#4@fDk*F<(%4DDTqX?k zB@Jb=vdp6ITaN`SRZ^*kH<%Ly-q34=7hl=ApDPDiw?cG{m04yE4-^0;dOnc6~mF^i`R3Rd8*BzvUcK6nN5C=(>tS zMJ4pPQJa_BZ7Aid$=k%mh7wp#hOfh68=)aqPU-a4LRQHVgzC=xtIBQnd=_7) z#qE13ZfBmYID01IP9VB|W*Hb3&E+5k8nrL24PJ`rX zRl%8>@SilfL{-xb%_%GVAecx12Wm8KUYf6~mZ&Z}+?w!lmrF^l={Ky~nrQ&kSUI=W zW)~i}2zboekYuUHZq&|~A8<1I*%QQ_`)Oj1Za2%!RBd$<#{?1ExoGvOo?V%mm59H|OD9HuR^w z=N*66LUfbi$Io&$Tb-KPkFKV&!@OKC*PES&uWIVe44kd=OUw+co%1Pqd3<+95+L{M znRCMQgQ9es_Kqi}6;)IWyjXB962P4ySgf>HX$w=vQpW_QKeUU2wbd2sWunYcNs<)Cf3nujH*R5c@Lw8 z<9HWrY*i~T=@EacZkXpuEFiBTt1O?qf23e`E^47!hsQpJb-I{jt4zwSzq`E4B9cz6 zm8UpX`zdJvcxZ>st3iaT%56n?rL$Tp*||#dC+qkXM-SX;O*MA4%QGNNh>tfqM0#aW znB>lm)GadW?1QGQ2^)H9S5qT2!G4W;z?VNOnIaRY4ba=Aqq1jnJ}~in-%)nO@$^wx z@)FB+wK@3=&_P&fe`h-?Xv@09Z*GKLQ+q91v`aku5TH0b zq^QcwY_FolzdSt!x$!@*m=XHDvBdG=bnJh;+I8N4yn=QdfP>QJiQUe+cHs@B}7Qrbi^#l#4H+YH{LJ$}EtTMFx(yjOb^Lw?L9 zWB}28Q8gUrE7@d2`fh?iX?!(b{N!R7HZ!M2CRd-(|K5*>mSG+B11AC1Wh=lZ(|^72 zr33Aeeb!?NbFBB=!AE~p{9K#bHcQPn%Guk;(nMlm;Bf${H;)8ni{or(S7jIXchdZwoB|<6E4;UI zmS*a?Z6d3GA9s~mCG`#d-YJDHW6fArMHQW0WF?mm%>7ifY~M?E%YH?}$0fLn|8WxI z>|m%q+8)WjX(sb@Iga!i^!dCTZ02u$Q^VmX)kAA68tIq@l56fi0Is zpBC5IzR;s(25!F`&Q+TmZ_%7;3OSSCt*N=?O4)MUpR7K`)1Rl$~+OG8myhEhVM11sFD-@ zwB)L#37%xC0m#x7v)Fu8wJ|WqAhM?U`wCq{SguuZ@~J$>hth#JBE%d3XVj&!-%khj z5CBs|wzK+k%K(=%;AR{3XpZn+D&n?O(?@2{`&2b z2^A|zN&1*3-|+&O+!a!Q(t(=IQXsJWEkRjk(;bur1LOLzSMIYI=~*uSx45Slx?JF23*!&|$^O*jsa%TwhMjC-}W74^Glv9*m%wRFx!!Vn;((=1sr%T^Ue-ZYD} zjEA~@k`rheL9n27MIOOoo=4o9BncTpfNC~-(ic2oeS?vcx+1BDd4hU0BQ#4L;Z#<5 z>=J>pzW4PcqiP$ZwNaXpaT3vNDsSH+YKtSgDI8D;7(cusqRR4&W%f`tsnSzcWC_T> z-Xd9QQ!ZlsSjsJC;GgnAm#E>u(mP5-=Yf+zuS005)}uU`*k+qvDz?knN6|p(`W#7w zLUWM|YN4&PykvA6y^prxf{jKXk&6~)3bu=uYt+}8x?sf8^&8Buh5x>#fAw;uqTB9S zrJ`3n56Q(gJ^4wPPM3`SGuH8+-fi(fsg_;We?;ehMCz9SF??;_viOe(w)s+}QAwM& zL@NF?W00Q;pK{&Pp1Mg4+u?gHv7D+o@QsU8xk{d%la~$KFD~b-En#Pz~Hx>?XFzO__VFkb131duIK6 z<>Bx&%IBl{WT^3&_`*yjPZ^V?F&{SDLawwb|3W03%N+8>?J25VBKi6DR9+RfD4<9b zSUg=S@0cFn&`_mH2&%_Z)D?p2rY;z^h?qTs@)X=*p}wwh1RMW(OFiO&D=+_(QXam{ zVc^JO9I_H}*;TtAi0Ox}@l4T>1+GV;hj@1CXRuguMEpuk?O>&tl?yeUxD!`Rx*vg# zb0(&4HMkgRg;yn~t8v^u48Z z%XDKqyQ6%vfwm>Dz&b6oXbYgQ2wndzeoQvyu_mWwzeP4>D#F-1FQfF^DUU54nZ>rC za7O@w73TEYmwyz#dmbAH?8xDd3vOsISCt@Rkwf$rTorZ3?08~s4+m1${y^b6#ld8t z>vtmrciYgxi<(wE%rI&R(%+-?Xin=Re!bdOLvV+8dP3WPz6Z3cFs;fGbKbz(q`uqz zE4h-&JR6KV+b4{|M?;1q&gj=K(h!UVq+SOP_Tn`c<(1%!kO^p%cbt4P@C;{r!Y*Pv z@sL4YlU-Hk8USp3-o+L!y9P_esHq>kFkn2(2I2HhqOecKLeG0ooz zaB{FZMiU>4C3Y~p406y~7n10t7u!?flv-jVqh~PyH@U7&ArH;`Q z@UT!kkY~V+ouL3uzj+_?xreWKqK`HW7q5 zTF!BBh-i(xT_zCDPeTNH2s|YztTa%&{SR&39Z4p0*S^C;=3=&kN>-+X_?sC!Wnkge~LE;~+ z$$r712E5t+dQ2!L4ApvKG$x;Dn+d}$0WcwlII|aqHIILzuQZ9IjXiYlOl?;s6E@LO zU%O%=aYYAQBk*eh@tBXE8$%m$7; z)GoGlg1a!2x<;f`RNNOPZ2;s(7MbW@w_xmUkH2+vPe*d|(wue~5a2CE%|P4T))i1} z2cXktIsunD_uZadoF~5SD0g5e7^_oi*3a?ea*!>dA&e!Z`FKH~=su~Xv!9mcqI^dH zgbW@0$UI(d4lmt|zbR&C@Lc?+pn!M#w`zMcqS>Z4aVs`sjl;Q?Chk4=jI!I5ut8Sy z_j>-lgS3IaND+?dFYts)i$_jxiE6B!O68u_Wj&TVv;G3Zf1yN)r}0j?e`pNb|;L1 zcUXciQN-_}@gF4aZe4KU=ErnCUUaBt=cEcr8lP$@w+@a_kgG(6>qk|a+uL&K3sho} zm@NFI^u{u#+7{bJ+c~>V3+Cw>iFXRGd}H(vXBW%ng_<*4ra(0)YJrth9UnP?BR)0H zsweH<)(xlCfC(@%(;#&i5@-f)u4|l+YVW>lTvyOXI8F;kUv5eNwdaR7dr$>9yg1+W zr1$Y^G*5&@fL93;8QdEj`lemC7MDeCllT?)nvq@8B6WIejM?f~n9M~$i_k7hlLb#m z|0m?yJek&i7bxRk{(oVi`#)oE^0f9~UNB^x!mj7+?f5qOIIJwxE|1T_KT+A#? z|CQ(N!VA`2d$93pVzc}Lc+tsW5!ImL(g@rl2Ws@y(T~W zVELkk1>be#;ywitbp*o(laYbz;u9|flj(y#%nmQhSBFA7Iv)SM7F?fa^SB+}aXB4s zSOud92{j-%{5Zvn7NPWgYvsv1!YxI^W6u@19g!ybfLpU8LHBgpe;Ks^q4D&?h3NTr z9f%$O=vJ=7%MXXR+{9}>=Z$*|uRyxohl|kSu+!pr-nddKf?L!M{sD^8qL^NvdQ0gU zYcc5XIXg(XpZEJF%rhVTXS6W9KlmCkJnV-P1`9lC+X}62P{9gBr#64s@IR*S%du&+ zI3nhzpLJin%2Yw;&%A1huiQe~-!AJ(y|Fw(^$d|vt$$^Ny?{$WZ#exR0uX;oBt=)^ zP9_YCE0h^@mWpFojPuKGhiZTH+yDLY`_k+6kp(tRc2IY?DeDp0uSX!RSoGD%!^>gExu*l?-(%KX zu0E2)#LsV?b6}WzU2m;cnI4ao(?_{;=UCh|EPU%lsIXVRSUG0S*tJoX>|Aw+1 zCC4$8l)N&F>asa-ox?}suY75*7=#&um2acl;r8+SZX9j>;vBZ8q8L_~Bd?Kb>sC>#|&KlM>l2ZQdhvWY@NOO*FVaRCQbWu;ok#U1WzwT>6<5wc2y^Bbe(52Bqz0; zy#D>JhWHEoDMl>>zea3_-CZsh2X_QkR$3|Pk?2&BfSK!p93KU?iK7L!@Z}MrO2of& z8Fy#=Jy~)8%vPODBgJj7C*{yVA`Z^eYvD3%D-aC2lVUCejanyGbGP`u_o{Hee{e~k zZAF}c{;UfFg~)vc1Xu~bWt>BI#e(S#@JGdCUGJ+8X`!?StsEIx;}2hPrA-s%rXLtWV2B$kRRQKlBju0pATRce|6(K+~^+q`d&l3vT`g2w{0L9xr zb)h6B4M!LW-m}%>s8l~_I+r$y8@15kC}HHFR^94BOEWjQ0nySCWpAKIQj7wpKHQ6f zKOE{n|NE%vbNL`O=XCTR?4@SdwI)p`i9BM9ASRqd?gRl?K!p8{_9sq45wBv0Z;zEa zP4&NrDXDV|=}sz2t>8Rz2ZO_M5bVIJPC6BMcmi_P5;iT%m8aCs@1jV8YM9ulLZwsI zE|wRfr~7F_+S2{(pNE6TR&U@}Ar1~ZD^byQ>88xBM)EAz;*N2Wkio8cAJr4W{?el7 zNbyuU*!pei4eAj@er_v(^{$i7-4DhcwqWCvTD)|TDyT2)bvblE)_1?$C!9K4q@Fef zlv9tXU;UnJw1o=e*m|spj|M~kl6yM=y-I9a;zrj1Ei22Wis<1TTu`KWV?vdC2T-U4 zc$^p}#)yZr;v^<&ZjG$1CR$Lt%K`*W;YSRLO;wchJ8`Ps*-+={MDq>+(Vpq<|9LMv z=KA}%U~^QR5=^|)rs#TFEQa9i-TE5va5hEOF2!PW^gPU#v#E^6j1ERp@V+4MLU>Ly z=Qs~&(V1q-H=*tgx$OKbPGNd-?^kc}Fw;_i%06mj&bDZkXJlt>O{srTn9TTVd@z(= zz*~$Q9l7r54$&M4g(-scjGPvA@`1@XvfDyGIb^l+s2DCB{ys)V;Rn%3~^2#IY`Iour1`AR5AbpzB zrc}e|_o4F!G4kEHi1g=g8MW^a-d)g-H2RygY<8~Vo`sf$QMsyTG#56)jW~MKYisE; z&OKAr%kDyposE*83xD1zT4lW^xfCUZWkvh)YUG@kzXwmej87@5sfC=eIfB-j)^>l* z;Mb=rFK$Ch~;h~++)LLs^VhLJd4RXk1VdoX<{CzoIpQ@^s zUGK>fj@S|X*TAjG&Rs`;9D`H#YQ!LBOYG5psk>Bpp{(~M)#%?qDhTI&b1WCe4>?|l zoQua-107x>cC+XFcSvg%s7Ko;Kr9XF(_8e{UEkXgt*{<-_vh9PENrdeTi>*t(cnua zBY83kXP=Ru!QqH$g7i)a*-R?1=Tpug>UUKt=7ALPiDFcCrTp*r@W{fx(AmvY;1)-)lm3dvgE%mBH!U`W!wW9Oo zg+&*yvpTOvxPmpe7X^%Va#MvxOE4KTy{tF$t6nlhn&O^Xt?-T%7wZbRu4WA52m#X~ z!u4${tphx+ZL!bt&*j=MR|1kV+GIbXPaGm}ys9FFfVlGX6`EV#V5OEXPG zMAYN9#~I9Ma5G|~tIbPzUt$88dz>{bI+a6xWoyM!<1OYK>!$W7lx%j&`I*omVsJ(UG)?S3r`Y^ zd=SZGlI=UPh!gsXlGxeSN1y!vn0rVNQ5O$r!99hcH0&TfV@dDU~C^eg+$ITGC58ZN-K=TaOhkrUDFQlJRrjdNQfgf#~+izew0MKHPFB7gL>{rKDaM=tc>JBx4BlD!t&yJOoa9otWAaP^}jVWb9Nu?!&Q6V``T-*leCNn^v;=C@_W>`ncJHVof}q8oH#*oJU*-EksDB^ z*`L-)jglmq+Lks}w@%{>bG`mvt5xJ!PJJ2EMtx3E(kqtbTCQp6HR>~1`i09OT+E+p zX)Rrnr8JPf^t&b{-;y1j0~Cu^)t$acZv1M3<2Pxv6oEn>S^lD1$bSUi~Ok#7LM*6-o7bdESf$?`|{pNuRLX zZ=O;4mC^)vWUE7CVPjY}P~er@&*Ufc47g%3?_iMM~MJ_IB*| zf|RM@6XZ&SX&y6Raz&;|);6I={}k6=A>--;a20hwXd0M4AL+$S;LVR_w9;BQhUIGB zJ!N(AA_<7iMqNNP5Cgw}`vzqjmqxEY9hS4Rx$_hswO zB-@_Mk$309*mQN%cUjb3-hD^R7=smT#mty?U$(or;-8_LZE?b{}~RZ+qO}Se$Mn_b*)DQJWPZoH@B-utT~<-)=A4Rb!z9#z-q34b@1h^ z(b?50#_Hr~TCb+oO!KGhZ2Z{SJ-0#8%j}vJLr zRp7M$cG9W}&sI)_Y+kN#B+IdWd{KwUy4-3XJcE@4W!BLUbrh>qwj-cMN#ni}2vyFF z^kVUk^)59yYv9hIY3SfTn0XHhLoFzb)RJ83j_aiBJQMDQa_`g8 zi{Y|ik9zkBTv1opj3rTcSSI`V1^c>HbmDx9yFg*R+~mUz*(A9kR7!k^K_rw~6A-dk_A zDv+{uv+mLXFsL-R+OF?;NYAyXp%&3e?@AU)IYK-v4|)9Jt)&`1)eW?v?#HMn9H2BT zen^QQTq#j*zxHWaHQ4?dYppmJTa9P^cxmm{6;#p@-iz*g24CN(y|7H|+)i>3pb4w3 z>bih)eZT>~wG;1LM=nTU4+bGuGX!N?5={C`KRs`z9C zzrqBl>pSJG7A@1T^Qpue{LV-3BYqSF@myQmCcjNw%Qe-cTYFBSW*D{r z_Exwa0lo+Pmp&`<)*XFc5q*<_Cg*^ z#IuT?K1?4<$+751w;ik%Jy-7>FXHLe-UzV^W#csBJtBth7&7Wp_l{*CcLu%%u7Q*x z=O$_*W187%iJ2!&J}Sr7tc;p&XuFk^SSJeGDP$P#(ESaxH}e;FzRpo4c1&R=i|JXW zsjH1qpQzDQq`;qT&&-e7&)G-w$)1|bqMmKa)OKZmfZb0N?M|3#GZ{ntk^{g$OkP&M z_x~s=!~XnC;SSsq^JlZq5p4U#DWftU`YN_#O~HHXv1++9wsSG%60NQE^=*}XhimI{3@bC`!ku!a`;x!(#dtc4{JCm>7fTt! z|Kb5y_~qAUEp;f=#+a0{k-h68$P>UU#1c28TykvVI)DvQpgOS zhf}yxe4wDL%`IFQ`6vZb`gdm$*zmovIF)#jKm-+8HBgDFT^KCJsBbIqal;G7!M>L_ zuaxU%eUKHtkULAD+1C!Y?6RXo_3m#p&40Ljw38hfe~>4sCmUf|xE{$@s! zl`uoL`$IMsbAK%PHecyRY@b$$F!dqnujWLV;~uPd!;NAo-r#?nLwx#aP_xo1^P90B z63yD_u5WG>twghRwApX4f7Mw`T-MIn%Z!ax;!&W6aNdT$^7dzg*bapgIBuQfP!0}m zVcq3AL}uIvtu@pwx(JcaKcN*wA8pdCx50?BDsy9z0864CG0vdIyk(nNkK!aJ@i=NW z)^`?vVGzW<)WmUkxKoVvEvLztHi;&}h8x3Zl*2Lu|5GNxMZ=QE@@g`*`%a88!4BON98LfIl3%& z?X|iEnK2a=*yQZ4y72_Jw-2zSz_DyE_@94sHhYMgnKldbQ21|m*z~#nm;@+6r|)5& zOvQk-1l?>3tr|E0J-BAJq<7k3d^J6i5d>{m|9J`^nEC?e+97raMNR5 zf?XAXogHR15kd@kh{EtE|RU$OmN0i z9JB^#f~z>lW1;Qt6r`!T!ma#flLDdGlmWYfb&_u zsGx8+TeD)WjyYl5*;DHXh7@GS+XF+=6nIC4R!5=WyqoYtV1G24@p9JRNeFL+(PnXn3BXj@b&O}hyJ%iMP$x( zX?t)u%#t?W2cT5?pmlB(56wZeFFrj`Z}{MMa75c*TxV5mJ4cqYY9s(q{tnJUROMq? zo*>Jh<5sq%RjtL5W#OVKrloZs9bfJDatBh@Z%v$y6d&^;R}b;)8EoTK^x>&#S|Njs zMU7y8ol}oQF7IBV;`~K_+-PNg8raVaOTk!|a$B@&+XWjq3;q-Oq#)h#??0JnCjpq? zyo^^PIEBRe6+?#lIQIBMy2aXN$*En|Y>@O1#++*XD3!4Q=4;y0aO=)0cuZNE>Uk@* zrxG|MNT?E(&-u?WNbhI3~#LpPFcRx_7grECm^2}?U&^4%geH$}U3vVT^XrFM8HG`@Fen6z;yc%OCHHWr=9I?$*v2b1G%C z=)IPe$5-SQv|TcQi{QU2O+?w;TWyY~#&br|rx0F1{L?Fb0&m5{O}d89e#9P&@6R0h;f_=q znH%ma)H0TUvyc6^$?5`(ElXmr-tyTV55T&X>ViF+7GbuW_gv+&Ldi3>HD%;f;}O`WueMZpe?ifq4Jf`YWoa7FwnJRX zvA4YQoF+lT4aeXUeOmwO@04r ztgT6{EYQb2y0etSpcQ+tfJ>?{_<>(%yMx3*kEZE+q%zACyGU_&7Gv{o(Cok(80cjEmQ@F64?dY{K z^acCIKkR8*sBY34o$V>OKvusq-8aw$q$B$Ys%w*^8Q`*JD101zObMxhZ@67zfBuE& z(mkW*s%ck7Rq&PY6iSz{LUYY-00()!ANkY``MKl&7}~wX^X1PZ0a+eNFb{4}d+6fc z9pE_FAqsofkYh{#E?9zbgZZU=6An!gm00|YaQBKShX^!G(1ToMa!Bfi%$aWH`7sru zFuG-DU&(HtmAP(OZO39__r1J|bg|L{%$)1)Rp9jfTDI+F2<8s$sFxXk2^QPxWqXKK znKipdYtQw{nJ*q<)_gnI*vh{?na2OZpL&?(BjN|?&EnG-P2sf>Ji_O$w8*E=nsOO9 za?j9)bD3Zz-wEj(?iM!2n=V6~qAaMz%NkxS^IftNPWGhTMn$41$o`Q*Bi{%;4nj{9 zFBOX#q*S;(AurOPM1mm|;vdX=UY(R0<;j<;jN29_<0*o1DM0RPG>@5F>8hL8uBv?% z(fQk>}%}h1?qepfe&FRfMQ+Mjst2=*#;! zacu_Fub?i9FxeiS%s7bsI2MUN>Xugr%DovHSPNt(4VWHkOSX8L80XM?sJS9GXjPu% z-IeV;IB+d*hfZA!3s){3O=|SG>4R441K))+tf?ilG7x%Z~a5G=<&4nKcDfp%WTW@ zeAk} zR5XI5eIQVnu+Oe0^BvK{pMMNdK=pTLkTLtnY*P0r7=&|H7+300nE`P3!HX<@$Glq`mxb!LSTH5;Ug9qCA!vwhV<% zi#4`#E7AQ8g;QP4mXQ2Tge|NDCc?h18jT4R|tTPHz#JC`Yu<)Gl{%9mGwYhXU(_oJ@y!19Q5BAiH? zfhe4vFMlj~P;gGqcBIPLp#DG_`*nP1;-KpgDFZekJmT^i5g{D$MC&#>Y6~BJX4`CJ zb$MxT?e7E>q13+=G|2_l*YHW3VUcVJ1HI1%^o*C4t-a?*W4Tq@$K!g?OiSR zor1)O0BEbe&)ET}^$P@p30h}CRR8=3NPaWcP{j%6H}4!@Q3hZ3x^cYF-LeGCFXlOx zu5pi}HzKBdalR8<@f=T~HI;NTl3NNRb&2i9vV7>;hpT1&m-`NRxklK|f*-s*F$E zCT8OV16fQ5vOd3JqFWJiX!q7}%L%b}!*u1KM+0EE?}*U{=*z+1;a}_eCzQ%r`bF1( z%nPDGx$?tbM8Q08Pqx13Be(g9cztkO0wO;O$RU-2acWazkV6MrMNYGP89P`?n8LR5 z_u|K)zra3Ga=#q*DV}cy!{8Ei7t1nU_}<>1h=k(DGUZwHqU;q9FGoEqRDPEdSC*{a$USjao**|tP2B0!CKMUG8IqYu-0HJb z0LWR!cC)RStvTm_LBHHGK+ApWL+yUgq{qGFE7WT^1nPkKfCfY#>P9HoAoo5T`DoHg zl8sCr%ANRC(N$5GxFC8D1IIr`H+vW>@&@Jm*C*Va4r-mLf^+VX(u7il2oJ+HV~?nJ z{-f~O(4rs%I?g+9%F(W>{j2J6Ts-y7C&8rBx>Cn&bJRQdh<_C7r&!60N;<2879yd> zb#lN3`tg2W1HM2n)mD^W6jlnxWS8t$s54QDK?Xd zUZqWeZ+2QSk;c-X_(&y#N?VnMLRC(2uWpY)k3q0y2lQkBW^^mcZ(ks-{F0d=c zW@eT{$HJMPIKzUr*ONcl@CoM8+#faCSdBL!B@;M97SL^(@nc_&yyA z=_Qm-mPK?X8(f-0Tj59Eq+1c#R_{15Hn3xF`=mA@PaTel=$o0dkl7a9!QYdA`@q`8 zbV4vDv<^dmsfl)`U zjEP<-)3Qg1c_nLVn%{(BI+bguY(bP*c0}9a;zTH3r!)|DM;FH^M;$4|pxF{vg4fn! zi)}5WZqDnnlCvAq@J3}mYImLg? z4a-xqthx0XX-NzTOC|96Hd0P%WA z$PGfKK)aw5#~3JJNuSrp#EYoQkUKMb7OX{Y84|bogA^w8nLL40WLIJGSbc98kp=Fr z_K&$%kUy+O3^>eSs}EE&N}gGNNEOo4O8DkL$=y%ez?QgaE}qc;;_o#Mjc1x^XO*y_ zRU~&AwUhD~nh8MHNPCYBZo&4TWN=FoH@Hao5R@3wj&R9JhGXqpmbluMyl%ph>W6iR zMe9(7{B29lJ@v(IBkUd=1ucVfXO`;NgmHmsgKJ!a*C5HRSt^1yuuxIZ+=$LWDneXB zSQUT`xIi7>mi>t=t5^F_q<7R5kQ-smnlU%)Owz&R- zDH6U-lqm555tdf2rSV7J%fRQgSxSz!#NWrsa|hTXm1dAM-Xi|SjYg(jL}%QP7IUc0 zIpqoj<;d!g73ARqKSNQ`M*%o@9+18s$K4+nrU^10ApY5V8*mq8!2-l~&swxCGx}_h zs|=nZqsVI)aQ8;+66%xgGGB-?yf*PohD4hc(=f;TgXad{6>PRpICeV51iYs?ZmtkX ziSCtsHLe&6gN!y9o7AB?<#f@l4fW2N(Q6`J#GQJcy+5=8^Bp>8-diAk04#O(2K6)w z_p56@gqkqH)ETxPv)u0?EnB#iCI@C5zuKFs3Hoo$t%*W5iafX$bXP3o>9fXU3Zb+w z%F|kv{1su{7OvgyzpCK84{p2TuLI7=KMZg;&J^Lv;Xd?A>yeb9DYxO$hYSMqPB?_R ztS5H1TqkqiUbRdW?YWlYrZEEGtCj2z{;=g-cmFLq_y)sw>h1cEkkNk$<5qDqcJ*>J zV-%GZlW?$iRsHv768%5GM$F7?|LxE}R@F{UMFU&l1=HT-=EvQjxKW8Ncy3Wj{F{l( z`afUB5G!2vPBSHsphfkYMqL~>)^vPr{|JelR=~=i&#`n(* z=e3A-a$WhXKB~lgUA-0Ez_Mx0boHQel`LG9TumyvDU_qDL^UP_&$xJb*SAl&L)Zre??vzoN^AL}jVdS!w0=|Y36Qbb_!jTeR;J?NjY)aK)|E)E9y~8?H#J@{DaZ= z>2Nuvc-6#!pDL|8L3_*kjAak~8`2D?1lxx_pxEPeq1NWBuk4wq$9epm$Go=vm*0Y8 zCr~xgbVnxKYxH02(K})<1@i1c7zEnvQM5z(gT+$`(My8rM)w&C#Uq)c zg|n!(Ckdg2t5-3_3c-c5s9FBJ6-6|wU<&PT!q-MqKi5I5Q8S_mLgISthUEq&a(po<;14YQU8FNLuTqB332P;$PNDtDHa#0>9-+}Lwg$PCy(R24z_Sgnr7LyY z-dve;Rv|Ccam(kVB8#9CvGq^``p!Y%jQU!3Iv38l++M&&Zgr|M5v_Ngi=oaPj1^R=Jo_LJ- zI`3MbO5!$&*H@;HvHeK6`$%}ss?jXxAb=BQW;*?!-CJ9>s6Mo$@2XMGVp>Sj+lKjf zkhwXugDtd0ET^&0?i?r13cu&#kpbhwG4MYM+y7OB?;f6!eHZnpoPB@tJb&NW zo#x*xYGwJMguUSk>sm17qXO!?8_a2E6=W^|Icq!a;7uB~ znF{)19EjDC9tGpA zpOl@Ly8}D@af$mtiI3+JL;g%0mV*%AGqe1leGj4B`7N@BSgaiSM@U;JVkvBV23#pC zRMAFq6Ss1LFo_AUWo|Kk+jKXpsCVc;CJnXq6fIbKvJETtUT3K`bsN?T)% zbivsudByBt<*@0~ua1t-)ARuP`vwl~=n(6iEBH54l{m~IBD%c1Rd_BC8LYga$4i${lrYpq=Q@dabv+^!IN?$^q%C= z%>-p&m~sKh619X4oy%GC6bPh{z4m7$KbErVOqh(sZb?5+sE9ZicoO zxTja{#*Gsi@q5jUB%ZvYM&YCZa&*QXQ=960PtIMZK?S^S;70c&k%Cy|}^_W|9)o4#MOxntRC zlV~1z^s4?TFCT#~#z)}Iv@yKYhe;TD51H)7w*Ll2LJ0l2{SBLI+|1W$zVDlqA+d|d zB|A!oZgMZaSSQ!hrP=L#{1|HOxR#CNRq`OpDB2(Gdlk_eK^PQz47P!oBk*!yL&WFx__vRpZ<6G$hV1D7tcTmBigcCWc>fu5) z#o|LMgJAdmzSHmj#TI`@_C5EuXOL$pxb-LII0)dY$P#Gc*jR&b41zTMxG@D%$=ih8){r7y%`Qw5jtcKP$h-W6QJ?@JA$% zuh-<=ROb9C)(6gnxg&r@)1svSKj53-6;6Z_N-(}I+G~0Nxisqo-d;a^zbP)DF}gd@ z3F|vpU&Px<1#6V?S8s7t+J$m$+C>tqP!`_?=;xHin}%5NecI4d#J;?L&sYM*|+jnODuNV{T!&1 zUwZ}7VN=TJ;K$o$;Mwm7f}L3Z5!`F)H;!t90a+8nH*Fwe>;4W3O%S6-t%jbbgE;h9 z(!$#Q5xpYl;><$IWXU71T6~~)!S6%-dq_OE zg0T2MNW^Gp3z-+uq81Dr53oILoSj%u*W3T0IcwOFatsth^yV(ITq$hX$vih<$!Ld^ zoUh%7oVIHqb7J2JnTdFikoMRUTl4wRYQ;irSytIRt;pHiRRil@4Pbi(Feb7(I-K9^ zx{V)VXdbq+-3MoA$Q9P3JUm?`3t(CsEgI2|RA2-qj*Y)Z zlqRTGWu^1URCp9~En)&ZV-mOtfa@mlxpIUKHIV5_%IVx$t|f70iY)Dzdlx<+s}!Ty z^t38lUQXhQ3%}G`Uf*`j?72JbJ7ORAYT>WX>~Aa-<^=tA2^PLoT;#*EkLT@pmiX$M zy*@zWzoKF4RZmk9v?A z)g5`Q>9lrwxOKh$T+c`Jw>y81w+r|KF}8BWvlQ)z_L1(a@Wr+(B@7zb^ollVsXB8r z@ZJBKMygE=d;cdvF2~~EfP#~w6qj7?WHJ@EJpp(Z09tZ>&+Pa~Dl@|SUq_>Nf9Ch< zg6vwneT)1ZN84o#Y<5QErLtx3&%-*M4X0nY&}fDTRPlrR=<;85!P@B;(VMO(s;D0Cz@;W5RIdvCoP(1xMEA^^J>HL5khrM92q z-x#|czf43Bv{L<&Gj2D>!*R9LU&hP*t*ili@#><8;kpV?{B)bajpCFZ%r!1bj{LW; zAHK{jJ=963EwPBF+dPsz-M^FqdoXK%dGBRapd=S*Drs$u_npwKX1LMhvg|Rq^Wx{V zn!2e37YeEES=Np9LK;wUb1}QD6w%StIQcJHX*@oM`} z82WwhE1Qe4aGCpG6{X<*?SCQyM)(AnJMz}QvtQX0;!WgdOxPwuxDJtrj2Lb+q0*GE zpgv4YP^_ef50WSURD!y6d;ghO(7dj{oNuOsk7a0EYF-vQFCxAqwBL4B>sZf`VgZ6+ zSwR9-(eWgMoV9ToT?q#O!``%$o?+Ebsw8_%8XKVW@l>dpuWE@)a$Ct%7w=Y)&HEmt zCKS3B*nqyRwIoe!!u9;h>etdJ7VmumvtRw8yCA(O)mc9xBgF#<;~{&tW?^|IGa6{9 za9q+m5d38A?BMjSHc4238jbL)c#dnWhm<^=TKI_|L^79nv-ncZIy%*6qJBy)DsV0G zq`qI!);Zc~yTUd~lzxt&yez^gh7u#g;4PIw9YLwV?|=06@3|J{4dYlQiW2X0eJE&BJi*H!|AX~ z2Q8B|=a2kInTQ2vS*@x$7zJq)`k14_06unY(FyjO7v zWoyPdm%FE09v^Zqmh353!7VLawQ)$PH}si{SNI+u-H6fA3C`6DP7P_MbZPe$vIr6; zZk?@0B<4tJJcr~Mb~QPLo0}~aTj6&T@Qidaw=INyBK2(PE7LjADgJ!FRZl&R`tI4%zw)Ux*vdYl{ z##aL5J>tGVY?CP?ENfpG5K&U62vE=kO%v?oG(a;de&+-ZEO#yf!ocA9Lgl;mY~^Ef zl^_rWGL!5Rv26Fo^_4pAvaE^ckz=pC2!9ct2A{q>wOymZ>WOaS^nM`pe`3XXURse4 z<3q!H*^sDOcBL`Nj`FEY^=`40b2Zgjs$%SrWTTJ}oT&G8p?+r+e-{_?hU~6cO4*G( zkcp=BWR~_Sm20@Ecu|cW4}H}}Y-eYy!m5sRWyz#uMBj@F8ZrG)_Lx(aw04@;(SQnY z%Ub#R0+T&kI+*VVx|)70uiEbV&n$0N1Yi@7x`OHA9m`D1(&`?YQ553qB^|({KmEH=R$zgH+Fl+GpU1w3npFGBy}u{Y9q&Fy?CJ{%{$)@q>zdeE%mPOb#->u zoF>9dg5+5$mzXAEW)3cn@h`^U>}6)r z{xj-NuS(3;exsOKm8Hu0(AEXjPZo^(!lThBK2Ph9>8JrXV>f7^n{J|FJpE@RNKQqi zYIW+deqq)=striN(Szj!XSQsvoY2)PDZ}MYuy^a=+bI}KaCcX&@vw#vtQP^k!|qj; zEF8#8U9swflU=lwF!XTlL64wTtm7EuOZMtJIC5FrCB9!D5zFt5H|yFrWZ{pHZvZ_3 z>cRf@x<(aC8mZ`bkcXmpnqQFZfN=qDAbW$hnc0y0HH?s+_v4^PbIm{!8--m7# z)}^CY@^5GDpo3SDwAZE`!RLiSSHrX(chf&P}&S_ydaYFJi|6E7= zvTHT`IC3De)Maa&DYW!x^^gO|2JGAdsF*6L!-xXrSbNnBo7DqtCVKjqB1c*@_28i3 z(f$oc26no=6^Q}l^|ScauL^*|WGCJ0n}2ug9r^w!IePx(wFWR}7eN3FfqdVIT}aml zEdpwY*A@J2kqYA8mfwr)V_@N9L=L`7ExlExq2s?X{e&1FQUwWyPoA$3etgo`X^gDe zZ|+w$ZZ@lz)WIEMVdy&$f3MUG;#8pb_9A&|Ue&lv^8fOYwY<`Mzm}v8$9S!6yQzn- z;(LwjS?t>S9NZ88x!aPA{*LH{=(`M#!q1o=`mh1_kNvQI_~>&$fUHsT7nJrYFrV$i z@#o4tY@3j8ra_b>HldLA-@bmXUoAr?d^~m+9bdPvQCx2?sFqSEdkLyeCF|i`_eu5G z=joXXVNH%}t$g1X4p4#h2q%yrSOp-$b3ATwsoO5=%kF*$etrMDwaUDSJop0~JFhI) zG_1+N!}gBSgATdjFIMA`wNvO&R;TK!pg(ISTU>xFPgZN(kcn4M!>-%qU0o4e*lgB# zcw-6X-HN-LnP~M?u_1}m(c`eF?y**pbksFqS;3u{Z?~V#Bb9OHUqjRM5MCl2F`}m@ zBfqc5+?<@=6V#M0|*xF|4h+%#UMg zFBn5u&HFVY=Vpso|AOs+3Nv1tVIBP!u#Ym8MOL^V+MAV;_t;?<#M3rgLTT#zMp{ww z(Kdlu%c-TkEgyV6TlHzTMb>7OvdT~LE;X%pB)?Kg#nHi0I?z#wP_ z`~G<38946N$+q>Y;-!>dC7^zy)U@jK_f+Ur`U` zCX^`7H4Ktw^WMx z_t5lhjFhI)Va)d$HnO*K3uWUEk7xPP+No_$O!G`BB4Pd;hksFV+0ywxEPC5(-*&ji z!zFTsb7irW-g)d!4{5r{7L&VC?ePWbKtj2nF`UX1KJsSow%HVtZ^i44vrjkgyVehm zk71=a-3zZ98TtIzt$F{{4!sP^<+d?0yWj1{$ka%}i{H(f#q-CEdj8En+xU;ZaI$>2 z^~>dD_iWl1aAjfrG+PXQ(%|muqV8$ioZO!ADW+?~Lu=iPs)hzA=QbcqS!6fbaESsU zi9-4DxC=;E+(6vE42M00cJH7i40LmWLA_I&$@;sulOI3oT&XE*jy#^=o-HiY5yrcE zrAoZYe6OeG6Zh5TUp*7p%lgz0_;(h?2DSHT^GV2Wdu&afP$$#lHJ+p9)mNJt`?9fG z_Y{cMl%qA1W5xKoiFXr?zAh#yEAWkP97{R9fw#9Jn&HeU#o9g9FUv2k9rn zy-;k&Ugx>j(BtH&3u3ypn$yQo^F6loKm@15^z!XRhb;sq>v_cntdBFsHGHumT)MZj z(b$96&9_5A)KQ-%G*8wyherXKKFwKzE=GEqD*++5NReNH0ekvp?sx(sc}0&Ij@Yyf-jo5?{u8r;JM>2e z5pMlRzOB|-bHtG$z}k5I_pcsBn7KZmoNtWp>P9IUj2*Fj8cR2p9Tz#C-xAatT zc;y|a`w^IT9lvMcdl2O$orK(JQm8jVK2}GM{x6V6#-F^siK9=KnD_KXy3U}fN%^F# z+z1c6hA{%)FnO4sgu>qUjN>9eLTWO`pAa1c6BD4y$xJa9zcAM0;K7GJp|@mA2Q)}Y zD@1S`p>P~oxArf~Cb;-E6NR1O78AD}C5^7wsxQKx=7qXchHw3XHe(c6H;4iNklpjHJ-PZ6_E`BN}zm&RX1l#NEdqEzJY6{-Ee(M|WRMZd{v#!bv+6+_RU zfD*p^PO$*AIk-n-{99@*05#hYg0BHx206vFxH)!#>d`WLG|Ok6x&Z+|gO9ukPJPSM zKrc+-DP}91h__4K3O5h#uWLKCM^}Wk>Fi1w8EFTRgEkvsM_%ovWLu>a(M{SKO~xUe zyT%}ak{N+zX`e=bwuv1(MQC#6jD3@o9$^>LIx(ij3w_A^R&0z{?EmIq*;NlZdKlHd zHfs5+K~bAHR`#zW=fF03jUn>}KIk#Ffx>+bXsnw7{J0 z8m3M}!}{F$G7r{j8L8sM2sW6i&`d@WJlI0-r9hJT`{*8ISkWqs$1W^8N!Iz=pzeD3 zRe^rokc*#PpqAEV@*wh}Hi#$IiAe7FVm^jn_Li~zm#ACOry#yJfr$*7+(=CvY|zLj zRFFD2ll`aun(VRWw#Oihbx5?V@PmZSXd5U?kSPW(U4}N!R>h3X3cjOs`&6_KRI|wFIG2dQ$3y_QO^<9J~CxJsYhKza*XnEn- zX~@%~Yf(t0ZuEXWfslCp%|E)uDZX*SOi=3A43B4{+1kRDWZ8v%Oy-NdQ63Y5R?shC zm;gp>(7aeUWJXAKimb3FIHUZwZa1|C#eiRa412qxMx|*v7UxpA_npez&ZjDz^!|*Y4g-C;em%~-2?nMQ6~i;PzEO9gxrUDH4)QuhV0i=Fk2>p|scyA1uI zpI;2bCZMJ)p?qN9HxchAv;zAHmI%%a7YwD$Fv(ID~A_pFn`jo{Rpp zp3l&}NFsgdZz!qP(7tU$F36u%=`-`KOsgZdF39qOO-SaaxUfDFDe(o&=cFIlPqH!Y z1B5SuewQXJWhqc%in(vUa9e|7o@*Q8$XhM4-U#)qOy0AhB5%S03=1^R%&>qAI+xal zbMD{b)6Dwi_8I^W;R}#W-nmaFtQZ2!o-FMuq2#@;DUE{V{_w_3_x_G?bMPs7CW4#r z9R^5`ctfaL{;A7g1D!Uk@xB$1d7LF=B@P5y!(v zSveUY?)P(Hi?G~G^d}OK`;BjR#;;ZL$&2XChc@?aA5i8Og4^N`uIIsx&8lAl^%Q>= zrWPGbK58SPz9HIS^LGE^&W-JV8>{?3GY?Gc|7~R$s%mGeqJ}L{M%3ngqqTm$LN{I8 z6T@s&OQiE09w~?&eJN@dIaoBDvDwm`tLN}nFP9bhfGF6VIV&cWK@7feCWvA_=gO>4j?Rr)eI%a%990aTrRzMeY94 zFk0SV_5AOn@>HSi;NG=^UwFAL?owHV)TnQ@Ooo2;L|rGksYGiMTuR5U64%;=D=a+x zisfPLBUN~eqieV{=~Fa`uEJ>j3MXZ#PG<6lRa=oK7-0qNn!}t}{Qx;n$I>=!!@~E~ z=Z&*1FBozD<$XC27@kDnUuQr-gSuE7k|KN@s2p;B3)REWVW}QRqvhU4c?yHIy!4jP zn9J|{i{a$vp-as``Zte^GdYI)r0|VR5DEC#bQC9DxbH}#4D=eA8d;%VEb?mB}yczy1vZB6lfJYV#lGTxS7g;YXV*FvBdXd z4Y{+b;Zns^m$SL_mrR;~0r*;7=4viIis!gG29--Wa`{X8nFQu9i>R?0WDh#ahPX>6 z@;(LKJ{?xUTeZ01^d2NhA*44_kXS5Yw5bZ_igIxsrnDZWy>Y!7S$5O>;GTZs5>`KPqV0qT zYcNs7A7VHg>`ytecr5S$%A^{I)BvoBR$qp($Un?*oGhA@NtBHVU$X6#;)|-tpGi`- zZ^pee~eEY%(;nOFnQDJu<<8v_1P|^{!pGzcUlb%E{mRB~x)ih_;5Gn8P#IJ&U)NyJTQKN& zHkUhee(Q1qU-no(Zod^9cOGbc~P^2`@LwWPgL^}*X~YxdCEXn)0N12`?N z8s?yySRd&xh=ei2y5K=+tjZR}yv+GfLv-Arl#yLn6Y%<|TKgnenP9*3AGL@5e`}9~ zm949pGoys9k*k@QnTdm`8RP##0Dk^=gy4T-35K8`^xGi8|FPtMAszl-<&2GsgX6yv z5V=|~x~giMeWcR_;9|!tQ7(RSxzo)oiEQ%HaB@n&m>_0!h312PKthHYS*!`~k$m(b zX4^_9>C|eq$5^?sx4cI+4mSEut=x3DdG_u4Fh&RWJp13gAT&A7=J?Du0rS6IBtX0j$op7SU*ZYXTCQ@;}K!*qJjk6sF0pQ8kT; zGd;h_+W0qwQpX6@LIlL}>*pud-!idU5@9+M3|sU&=GVOzR1Q8^j%6rIEc&mR>~vi< zBUpYK$1nbsK0E&NxH1aUL_9gxf-)(T$|HpKX9<$pPfaJ4d4Wc+nMJcKHZsP4Q2MM2 zF;ach%FRe-U!`oZ9JENyCxscsN0p~Uzec%s{qnHNbyeat^+MFWilj(w^6epY(lS-1 zV&#HV50h?w44l`>Z2<0f2>SvY8)bOz$L`)0Z$QsjbXAX^I`7%x)8x+@g$~IQ zBDY^qCV~#sA=6FXEOk_ngxX6+axI6rY-=2A%L5}2G z5vd`(4PlzHp2&H_JjVR{; zzfkWg#O7G%yoZ08e=t_qEn%GJ1=or8@ks%*KF6$n{4ER4Ca`%Q85TsPTt~vY9)yGw z=#tgXRY}y2fo(EbGsRUr$o}Jp69$SvkT_h)g3V_&PQ`w@-fc@k&&$g%jwVl019%-k;CR?A=r$9*bkC7m(0PShuBa<4j$F;bcLT zmh2+T##d~ktZ24wK2@2b)^6DKRF6{8G8_I@ zxs6o%s=TK_{c>-l^bo@SARAToE8DAEP_RYlTB0y2oD8|x zSc42tIqT4pZ=W(}-~{j_7fQ8FACUYdKixlb@HO&zWr}I`JmKe7RdsSeOs>=tPY{&( zS{#k#*UKDiN>OE_t9z!!dqM#QbP0>)c@hTeqU%!O@K1k4gqo1g7NOxUaOp;N^JLDD z$AM-`B_sNWtv+El6-m2o2ff$z$4esJXB6KcXb!2VhgE+#WvVc zhx0Fb?O#bfLMUx~0J>)U%U|?Yf6o=AU-2bv;-itFdT*Gv-c4Hzaef$++stFDGss7= z*%|2WNjm9I?Zz?k^DR-rNz!TIE{i_00Di{isS|7Blwe?!WJlXNv^dvr)1t`}&up61 ziRA>n@ZE5y_v;m?y)iqvtbL$MXPy=PLEEqv@{aNNhe>_X78vqM<_6VE z33rSmob41l6a`|hGbDgVVK&T!&TM+4of|q3jB(lz^r~Ci_wHEd!k7$@K+)%AQorfi zeeG+F#^yOn^NaeRl(@?PefITC;N2DBnXyC|Sz=aRkbAo|M>>+Yn7kZcwe^0}>0bWQ z(}Vu6c$y&f``N)ZA>Q{{Yr3M-`>^JV>#tPRI4hk#TktJSsV)WVQF5ZI%!9CJ>7$)J zhij$MS9g79GP+EQ)cKa?uy}FDVDdCBtZzx7rPhwJo^stvn6h4CS4mLQKa20d^}J}Z zY#2Sf9DC!ke7Z4~6R3tC!kz17yuu4vJM{EcnBI;W-JLLsq#cwg1dNq_C**U5)sN4l zjZo+eej?Jy*$}XMQD|l&4E! zitYH5rS>K}JbxpK4_g1|+~@7H229Q#t6Dgz^e~)X)GKajsccZ3D65J7j5{`0e{nu- zf}#1n<*AIXgmVH$Y&x?)bpsZfrA*3h*SAoIKi{%UqO}<6chd6yin{u@vPD;meKB1)8#eHU~kokHJ=fBdtt^oS&7ksf0I( zbhzvs2&f$*h`53mTbsFivB>(k7d*4$c7y=6DbZrxsf%9O8ShV6Itn^ix_n(1n(pGW ze$=tPO@ac&_pU1pQV+`Us(@CnF%nXK5)f6Z&F=oyBuEw<7>P4XD%QEH5EcpSt4Vca z`1{$LXZ>R4zEprE_u9rsFg?BZXy{vF{d~rk@QmaXt)$iAw^5hV#9wnedZq5)++^<4 zVe>)X&sN8b_Tzr5wB;=4s*U2X87$A;*Dn{N=pfbqBYb_^-66WxuPbZ#M#}SGF4Ku- z9`y2g5NK)DeRip}T0TzjC-OodudT`DQcMzE!-LlxQn4P~Ay&`VNxaVej)hZrll0rT z;%V89m#I*6(1+lW&{P3Vb{2l4JSXKUc5aT>H8MQU+KaYWrY(R`x8$7Hi71V0t#@3l z5@cs>?px6W^1?LTiTp#ZY`FD!$!erdr;bNsOyXFi7lNrC=48ED8zv zy`YVsZ-D=v4SgMNa5GLnj>~wTjF2ww_bo%3!wH=>2Wf)fdm3VHi#t<6?_;^u^m@Ss z9CXNG0#3~WcXftzM-(VzrXtal>au+POK43(nXOjUkwpc0i<}msuG2gh?KD_96E!`Y zDPs-iU3}w)OmA9`|F%7v*`L5j0IX}>y${ofZ@I+^j{&LW@-uQ(s%@TwoLoj&!fxrS zh98D1C0YTSyhq-zQ;sg(6@sbCX>h-F;|MPe&BzFi^*7I20#x^)L#Zc#x@^j7Ea4Lx z-mm(bG!2{2=2)aGYgk20VT0xB&6_(hGb7dd5EUGXCZKC-(tP@&6pM80b0M!DbPS5i zMufjb1dw%|UZ10bu}}yk_gn~O_EKSF8|S_*VH}G~_rqFHf3(Kmi|O(Wj*8*L^2)buZN-(vF>g3pU$T6) zs=^G&4-nz(&|;8&PMzivac)CHMn-Qor?p3KTD<6<%Zb^3=-7Wl>7_Z8$4^&S&d=rF*AS zyzFN((XGq3y(xZ=zsUUs@1cM|TAGhmyWyJIXl&<`@#oK6F@>`+D9i*dM{xmE5h5K; zfuV>Gts3s`h5_QsU%$>lPFNi3&^Y~RA24D{f*}|QKI$DU_b*HEuAQR4zZ!X3c`qM5_;9gy27xcb3M*kR&-9v~9DG_+-OP~I@|hmG^C2ScZVl|k&`Nma*x{Tl_>RUpV$x~UdYFMsp&nmplLlZ$=DJzczcP- z3+1aLt~n;8Mr%@PMP}ygh`6zFtIJ`?Q1&R}-Khs_ZFJJRSm#dUYdMi~M4^>3xH%#pL`U!o@HdG(pNV>1Zb z^xjxqJU+8Wka`9S2UEwe+h3l(OW&h)>_gnUBd5*ff+Ky@?0o*77oatqh!tMkpVV7d zI}f2ZdHgkU2$Qn?tD#aX=EpYUyn_)MtQL#~FZ+~POA?kZ3=&)CSv)8lB*>e<=L55) z)pZS}TIwlN#3VtUrt$`{4zbe9x0rg~PdkFymyMRbuo92VieO!ReVt)af8KN>(AG83 zD4j850kL4!wj|l%t0h*lJvCDuSfU>`S)gDkvD#*4=Tq8P5HlqcdEdImllC@X@#p}M5M!}4<9(-{E21+1U_Ay{h}A`$vfPd^xqcicEn(f<62-_LZi zpQRRYIsOrxL)J27Sw01MlTkN_SJkhQRrdcVw7IjalC(13RuA*qE`yGf|wG-x^4MAMLoQ^pQe4^1Gb@qb|!}6#+t!q znC$hLa=MK$o{HE}MeH%z&Y;YSJ8S#(How6I7;Vl+e){O28jUpbIRlafUf#1xLye13 zm&bC?Z;`ZvPPOG@V@~J=1K~eS@2&JqUih!hWOXJN2~iF?Z^NFRx5R#Mdm}U)EMF<{ zH(zdYS9ktWCGNw_>Jl~U2p$gTjwUM${e(0V)H3Iw273C2!E5!a%SA=*FYVLK8V))j z{!DkG99yne_SZT@@=1B=>3PGS=I<|$IEKmjIym@mM@OjTxUm$DM5;-Man8Da>xGW% zyxv^0tW6cJm2F#aa>_CRp ztX^I0t~u8?9`o7r&(l#Y@#sjR&n!8{My(-gH3A$UFXOnNk9v^SW@2Hjt_X`c4}=GD zT5SRR{Pq}$T@quxO31x^!*oX8n&`1y3xwz z-NX77Z{&G0TYl(FO+%sL1m$Ys6off~^X^tINL8g9F_L9^GD2eJitlECD!+A>(RX$^ z!6j-G?fgpdbF1_A(MUl=WvTe_1zq=DGL|HUs3$;Cg$W+*4`Vt7*ldYIQ%?gn_`SZWMzx4$y)xCyGG zd9P8D?V*UHKiahrlDlQxj$xoO3d^sdlQNh9;H!)GV#e5`Ncu4K;7YSKVa=VcHeew@ z9gT{Um^IkH*-8Dlqv8Md~Yy)Y*waurV2aLMY_)Clku&KK z1yX=3<=FnX*!#9rFEbDKb}L0s&Kqd;z_UM3U>JIaIyoD;bdl&A7**vOED}jHF7McH^7JpVZZww105_u8`1e03Y+98*!YPUJD+h ztLVYb1m7jf8dWPcjVnV*l0POh*EL;CFQ|NTa8RE4_1V}^G3e^GUtORk zR||ZG;t|Mj^z7N=AiCFoHxAE#D&PFi*-LI!Gh0nJ2W}O5US6T6<3KL1ZuGo7qN4wY zlR*LkLj3=k&TG`SbA{?8-gkAsr(+OH(^#?EekFryGG|KBW|cX6G_xDB$VKiH7+pIe zdw#sL`PK5Pu9o*-fkgtx<;3dI5y)Ufq0$>D!thNQdn4A;Y^>SjbN4(*?o6=pjeK78 zN1jHHvbePDHUXntE-Oj(_V>D~&tgy>ZmKmh3EJPbB-=rBY7|x#O*-Sn6Jm%!1yU8y zP@lhk_U@B>&==y#gobFz!l4&mur(O5oz0J^ewuu7zkWxPth2cAh49t$DZ2wiMy#yr zy4)*b6;tNCHDcMrTOoFnes%e0g+JRVL2~3f=6cF`6%?}?`r_|enDI;2^eiVe;|;1X zdw2?jGKDbczl50vU)ZMqXzd+W&>*|D?4&1;>;=z#eCrRvfBR~(J%|XUazN7Z<3uv! zU7~Ftx8d+r4i_z!Y=7Cp049sb^L(N6{-uwjICSJMqMZp_8nSvDWO+FHrrz|2j~Pad z5Xi^_@!oj6S$}02PcNLwLepc(k*6fMn-xzFO8lXzUj0+$T|V>D_AD2YB^W(e=Bs(% zXu3-ur1e=JhH|_)OznvGMI@Yk#i~cP;(xXBlAh8RxY83hs56u6 zwTR}vH>(zlONPmK_bf4oG1X0WP2{6uSLo@y1RDTReoZLl@_wu=hhR&+u2BrZI4Q@f zcj*p`&L9X;TU_{!sc3^)n=3;Um93EsAR#i(K`=8%tIw8;eF9dZn?!xQH*)WfDmBgU znQSMxUc(^9;K4N`_$%Spa^>#c`rreoYm?3R@rS*eYsK%jPVWwJRq$|Z<{lupP2PFt z<{uD7lsfcc8DQphvAfEOzvcX+0|nH&PRQT25#Hj;)+lbAowdQmLoQv5KhL`y&PYZ4 zIf{zdMCh7C;+p<8cjfJ@R;}$@V0_~YL2ezx*GODNT#QD;=M-_deO}Z%$_Kj0woq%c zF|oF9r&o7={_did-+#5N=j-7{bWDFV-5Cvld@Rb4v&m-qdWnf&^5SI1*`9XC1Y!*l zuoB@yMlxY~>Tp`~FyCdpNPsh~d= z*++@6C=59C6;GrIp(&tAqN%5errD2y*l|Z-mTZ}9oZisTHlNHi?U3r9t1u=l6AQ>K zhR0KJJEC@(K7P8zpeG`UynMIW$1s^ky-{V9JX}_w1$>rlNh9Y=LwZy8S~KEh#*l;H z)8HunsUC7YJah~T&4)zv$}i{S6mX_Z=3_}2CSoW!-{*f+Xh4r7W#Ap75Sa-Hi?py^ z^D>b=&|^!}$+Q0&UHpmfYhqcVa`HDMvnGpfEnB@C-xM?dXTA=5ulW;~G=3Qs-_P-^ ztbYKu!S<}b1<Qd1k_(_PxYJ;I>3PA0cDs{35uGFrduLpCmifHl3jEngg@7q4Z2}Z-_*P)F>?`#DM7j`O0vQ1>fPQ|5NuUl zl)OKxROQ~ErEOq$A;#UIraSi%7?$+30y6L8YSN*(|RA_^qGrkXAX_ zq+G`WL?vGE&Z-hVyq*;~myQr4Dur2lO`L2{Z;2cg8T@i9rgl(@#V$$UHiWzZweLb&N~ua@rITP%GG(+Upz z)ck zc%&&MfS)(VC+05tL!N?XJ?x(^UJ!LA#4YYq0h1oN>m2&&LoMN7uslm zN}6cQ?fLU0D{9k9DidqJ5;n;T{M!X0W=a_ym~7P%BU9Qj+cP*I_zbR$VOj*Jh~|YP z6Sd_n1yS%Hc1W6eAcSjb0`1Fnc=6d^nGL+FB>zEz0y3l5!e&mhsqDnJ3m&Ko(UD8x zAxkH`l(WoW=ERu#qntVX##}5X7~;%xrGw_tv%h@Ez9}@P#SHqyNJ?y$ESo<+eIp4% zd->1x&u8^V1?lj{3m}J?Y>xR=Gnnxdr>wFY2Hniw$Z%vu7rBDmxc$)}E zGyBnq8#4-B4yI^}Zy+OM4*qBhOVBV!O8Nj_y^ba6(6E^UNJpPzhBW$Rybd3clBL<8 zGDmu3r$9m+tt`y;ryxFw^2VLYA6UdJ_C9bqNH1zp3{T2NU{XeGYD)%PPf9=oa ze`)o{BF=iaTTI(3`UOkh<+0`Bk{k~6q*_#Z+%c;)owI`Xi498DW-uMA)@Gs{t9JiP zBor{o%g4r2(};?>xNYwK8B9oGVv|>i{Y5P*>f*Aw`7eQ${Albi8c}fUQYz{--J;p1y+84mPzKv=4#lh9!4YFwTPvT?f*V^AXI@phU z1Mn+b|I?E`cpsXZCEM;m1Fw>ZB{ju8RYsfMi9Xow&{H~g2=lub88XFs7B12Z_wHT= zN0oKEM<`_y;piXNzz{BVu5k}ijR@tY)4PI!%=!vd_9St0qhx}D?L&jkSqqhx%k}=5 zA=X>Pq>$ad*Q%Mq@Tt-1S~_m|B#T*Gft3(mjjMtIWA2#}V^u9OWPtQNWIlBYFX#L5 zg9jc#;)EpPd;9nA0*~`Ice_`%?#H{Uh(w{LKfm5gKXyvr?51*8oI}{e97MZ(y#qW1 z1vEPJa;iz4xV5|eI&a)OaAS7|yQv?WZrmbo10HU!UFOYCd;k}_1lP~9jqm*KDAXw? z(_Bacy0a-hl&U)pEy(qiK(rw_GjxJD;TCdr?63dmB8&FGRLdU=7l+k+-JE0&Y;tR% z_goazvrb%XC9+7AZ_K2Uq|o)4_qpGFKF8gh2{S!z=f;OJfpy*{pO)&Vj}>5BF4q^f zm&AW^_g?;5;soa-bdf9SxntO}ke&JT+9iQRuPEk2v4z&4T94))+BVAtx!O?5XU9k- zbdgZ8bc8KN3@Qyc8H1?*7Jq>P1NW&Qhx6dFCBS65i{s>q7JH%`z9yt|i?w zWY+z9=vpix+D~(Ia**36Q;d=itpeDk{EE`zxR?sw=Vpfh1z3_1vq+ii^ zLqAW#yKq)pB7&raNrp(XUaB^Bf@Qf#Xwx0Zw*`Zu!-a7tRsvF>bG9R)I`I}Zl38z@(+WhZWw7JnL6y-2^d9A;uiw??r*ze z5ihl5G*jI(GukkWly{3X7PC?zuJoA!&O_FPZuh8=FLR>3#>`4TR_@RU(1>-@aO6n% z*n49-*U}*7;fVFr+=l|%?L)vO!zBO%@Ja-=IGKT!A`brjM{qZTmI=>~>Di*Fcyzu} zZ#DDijF(bS2etR8Y{ZqTcx8X9Z>e4q_Q@#pVLT{)`OR=e$G4NsD=bW6ZtqKoR!A8y z+bq&634%ENSsjHLF;H9RCP%#C6orF0Oj%DyGp}(lZ;X~7f_h(&?Md}4N#)3GNfZak_~;p%!<$`~ zW%5~VYhykV34!_jD zXteBUt@M^dj@NAim-fOXTWakbUzj5*OyrWvMNt`+bclQZFeZ0^UJIm{>?P3raI`>6 zp`KUg(_t`q=NR+s;t#5h z+Ffw7!(0HPx_!8X_|FlZ=6V!`eJjjE#)Ai(##K)n@sAH%#Ey128FXygR?Cn55(TY z#6)|lbf+WD-ahPn=xS~7X3C}=VeRhi0=Rq$9B%c==lc#9!!@r=HskV zwaHeGB&7@=o7%dswl>_{0Ui&hE76()URK(xM;`*Yjisuj?7C+Q{?K+tkal=UJ30yu z3-3RA0WRQIL%mLmd*{{BbzXkn`D!;>4tXUANC^4g4Z%X6+4Tf8mg}J$Z7aG*$9mdF z80@xws-k=U@-+NX*0&oiBk8H&U-wN5%i6-m%TL$ygRt|s94*6cuZO)WrgHxt1nutX zxQ?VOmUCB^f#dWLXJ;U|@req4Dq6LCa(6KGNq8zn z!UkR=sy=q{xZpcBsyb70(hL5D_h8>7CJENC^Utlt33Zxr8XM#BEpoW6vKu4X-I^ln z?(*~ejOx6xUjmD!z)hxuaFCRsx`g4n9A=^h}1Eed^aI%`8M)yoJ7-g znUS*m2@gu;a}P2^3zzN9vSp33x04e_=Z@sxxQ#tr38rWi8a=~8bT)mpYbF$qvLmw} zZmzlm0)+D}7sg<`dLwRN>dy*Z#lAV zxJeS7W>N0>D=mrQOnW80E9w>xTIuq-d^oJnc{qbl-}rsL$E!3Gw&CACVcHs*!{epv z&(`xE%Ek`{mHff=b{iF1CbyG6D^!M|q;^DjME#m;l>5c?WE&Uvc8u36dPUUMInV#_1m_JC= ziAe}*bDwq^9lX8_?lk%M5rnMEyk|+z%37Wuyh|K;$})a5%vzs$;21E^T<@KY+_@UF z>pB-j8f7nzN+Pe?r6c;*ul9|zVo9Y%_yE~sdJ(BUZ@9n`!-BZ-R1tk5O^~Z)!I9&! zSW#+~h=Rr%p;5<&h32q#DPxeW21>VltmR!9?pG%CuS~I;)B@QR^~~7qfjx7tKJXAP znu*)T(bO_|^p4KGY&RnhH%Im8J0g#itYwok z`(;GPBTP8J>uS{DeE`(hes%J=0suCv31jR4K!lcUP4-u)Vp>cR0JGTSt;&Fn2#pmv zMEaqAc|ZN2aa4tJwAbwy(3J;eXG3DRpJNz&ofd-S%)r$<(1Mz3#>Leq0VQd9ajrf) z`Ih7Nbjzz*GluFuMuWHko!}zyX{Jm2EY+NyVGtF7$Pvu96s!-RN`ZM){-$Xm@?3YU z?0>ryGOZKh3!poKpm^cqt(#U3FnJO0pODi+h`b0@*KH(1tbi~)!vmun^BVV>EQn7> zAlWIQ5t!YJq-Nc{BS;wZ+-cpRBgFHRb_F8m7l?OCAhd4o7d&!BoU`ug7sP!^(gha2 zB3-3`80#(G`;R@8vt0+$oe~9rxuv>qZa#Rv7qas&Lf(ElMkcQuvv;m)`*hb_1Q_q# zcTL{@a|3>S@7L6?HAfi&!U;Ed-8A4aM=Ne3e-N4l!txm4!4@uFR=%}knuDl-Lsd_a zaDtB)aOtaKtegtn;!Iwf=EJjP-L4AWbU~p=W(@OdMh*d1=l+k}6;vL_gG-+Vd;JZW}xD43l!R)+e69Asy zUTpiI5Kd(^N0iy07{fEV+uf*0J@^_H<7=6e$9xJ-7Xh>ODG-)Mz|g593wUVdVdT)W zNU-P@-GK+VE(-*OIZLSUjLtt=rKbPkg8^OFbu*P2PdPPf=U5e)lS-2Se8p?T$^&I! zT}qqT46vSNO#MOh=i;P7a;t%6$t;--{fhEIR-X-J{?U-{wThI3*f0qXC~LifCFM?f zmyjY`y2UTD)x~c@ifw?EgKtTq%oN~x9h)TV#8&Y2=C9A&iQg!9_I)y~sgo^!<-A&C zPGXJ_!>R{Jy)_QR0we$)3~LQNdH1<^Mva^51_=pQ`5wM9xrwjpQ9wWCGahxJm_?eYMPk2A0;CSxVT(0w3# z-CPstR9kEtsuBRjvHx=m#ZZjhyJ|yEtbI~VrvV2YM}t#`L%v1b;{KMz0E;9{LI+p0 zqkh8{Ds}*#mT4oP=zh{MFP!tI`f*=p3mqQ0_NZ<9rc4U7Ml3V}$o}YLZ^v1+SQfXY zUfE~vMXgG%z1Q5n#%#AIoYOny^=gb#d!TtmM|IN>+}J(Jx}*3OxPNtQuc4YR*=b@x z_OP-|HfUGMy>0<(LxebVzOQgn&78D%N#4u_bbhKG6in2E?|b#NNIgz8trQ}D0PZhl zg>2|2j8^%okGl_#9nOfLo+s6S`)&R2UU4&;V8qU>P^+rTLd(eGTw%hd1Omm+da0^r zaYnvjhRQS5Ni~TzF&ezQ@0%&X+WKt?;mldnfGsI-OD>-NoZ8W3wxq*|IEfR+5z~+4X1GXk1fdW?@guY)wOC z#3oncY)iA{yhPw#Hb6V8L6LqC1x{}t#0g3U%o;T+HCZaIf+X*2gfLib_>SyQ>?gxF zG2GF^&GhZ9mXLLaiHEvpWdPyS#X^)peprC;Dl3hm5hYSpYp#%J&<;KdzK?blI)48! z)AGG@oYhcqg#vk;Z%-(9mLT?`4@BhwQ8);alD?mF)MNsxf?-$oM8GE> zty)nev_~VrL{x55RqMHhlGdAmn z4s`_4({$@sObZlRFHv**=d!Il}Xhx6_OQq1|_>N$6v(0veUG>BMu z(9V&#$PJ7odhoYe_OHvftg*s(R6 zbAPn$KMa1J&l!~$5!DIliqMM8s!zSRy|HJ-&55rU9hJJ| z9P`_8j)n;++&%fQOnbMi2>o~U0ZYx1-I{)<4&)WVM_V_6abkkLf0X>r=U#d0NMq)T zxO@Zs03gSO5Qq@Un@YrjdD8+TMP|GzTn|zppsg~fSUHh1qwV)3wQgHJ6`A|&FHq9r zb+=zZ{Jc0;redRD(X=2}0Ij7NsU^&BxaVaHKH0jNL9i0Fxa#xN?se}5EL7}5nbY;JK#WauMw?0c+VBkzjUvHjtuUy*wIIFR<;?I7BGsRE|CkG0_H@nR z-I`T^cLg(Qez!TpQY0CkIxdp zDWN(}WxBK@qaPZNUFO~5=EBu+Bf2Yj2 z|D)uVro1nI3TXJbgwnp;8K=Di|2{1XU0fSovj%eQbx~dQ=&aBTWse?HneU|DXFE~H z5(E$Hq)&23umi1SRfN4aUsaoZgYlEt*@BHt2FDu2- z&DD{&0q}&UxKiB{`F!Ru(2$3ETArr=19N9BUOCw$0qq}diasH{^_O~f*NsdH;JQr| z7n<|T&3m2Va9QM&(_>2Syp+s;7DaJur#G}~pXQ+~Tw`h*u&Jk~8_2rZo zt@}*2nsMK&j%Z+m5KJ?XwW%ZVR)HzS3TjFosb0zpc7>Bu|DaUr$fb>9nzMY~m|gx9 z(?0#ea38a-Vk4j(KoV|)2=_s8v>ei_i=AnPvZ;^#^y!e@7yr_I|6F>~holDf`Aiks ze8S}!dK7Ed5Wu>s%9nE^a!qycM5i>joI9^*v!Xr%Y?=z z)VL*$;&O>Ga=>EN1Z3`LU$Rc1o%M8SCI0NXlElY~*vRZaAMjqJNBWG>9F_amjsaw; zB)l&h{%~f3rDr^~koxTzc*EKS$W91&!CF5` z&Djt?`iwvcDMjHSV9TpM?-2=Q#^L9QkVxr1i~PntlVANBcwLj59o{A`ure1&8I%fB z(TiAjPF&XMYn#|)QlLD+7206Zlh=@zJ1nbSbbeZk^ppp#_?k=W!PIxmu&=3qMWk<1 zif*oH7{sz!Pq$7f)X;J##1+jbd@v6uk5v@bgRFZcu9VK`xFFU)07T&awoFw-Wz8EN zP(hw}tt`lFDStITB5a0Pd3)Y;9C#y{^pED-4t~)S{F@a;NruCs%J2q4(}GoDJ>90K zWS)l&6)ZmNUw4KArf4Ly#9nHfVmKDNze3^W9mC*Ezm$BMGHll$SQ^%k-0K z@@OO8G>qnDhv~MY8F+@Se2QJes4Q{k8f9t?qI`-(tXu>Z@@{s_pw}b$GdibSLiyDm zh_NxXZYyH=r|dXU<^pvmfx%6zQqSBKx(a8yDxVLtnKfvgo6)8EChXV)Tn%vRU5Y&3 zX*cMp@h3?tejX}>--LL;b5b*cDlucq%stHRKp&}B6B!XhfS1?o0U=b=uG^aXK-RQ2 z?CBlr7&kh)HFFn3n}v*(?)TUG=GN0ctOX;FR=+5-%_1}-1-%HlC)-l0+|9c6%+PJI zwG@_d3V3ODCfab_{oKB2uRnJIez7}6&))W89oJKqd~zq0-WUk`fN7CS?c-kfprF|V z(GH_6^J;=0lRK)MsWjBTia>=gGB(*V>aX>(vSBRcV|QYgbn>UcB#3A#~jU=NKNIhrwzfVkLAu0%2D;=Q7T zYDKm+C0>IJ5Jh}SFY+sM##E^sFbJteC*S!7)m&e%qO1=@Hp)}T= z%?a_sMA!-9xrVJu6C|m5Zas&$mU?s2P#g}(z$u@AH7H@`gBQ8oVCE^w?MkYF`B^|I zMJ7X<%)UCD1KJUl&6g1|AC0E21gG%Fj;lA$fGkF~52~u!b?razmWKh^8{iVQT>IqN zGC*uqP~i%tn3*F*g0cDkAh?RX-y)oLNvo%WQyi%DIyr#7YhdUMlsJmBNbcG@LwqO7x%DiTBk6Fgd7wNp^W#hyYWb zujYM-r3l_+dC4V_Uu?~(WEE0fb!W^T66v!uU8$smE!XL}|HGz9i>Y%^B-!AchhL3} z2*~J0D$q1h8J#_=owy|CIJctBpjkIBdMWEtYu_cx&E^08KfgXaka6Xx&^qRVJsb~S*A=iwceh&d|1vgfRz6dqRsujiQiq#JYcU85= zqk?(zkv56G)T>v5`}yAXBSQPLmbu`Fn=SY?qS@`^7k^UXg z+~Y+m$T}-nELD!9sBN1ikH8aGfKHV^LYK0RwyqnVKpE7}l5J+X8)p5hEc;Ud7I04R zd(qQCOK{ysYVmk7bvr4|&h+gvv3$AP5Vc2Jq0kO~+lx{P8{qE6vGENub`jcMhN3IC zqpnKbDQvT%aqcb_a)T^zhAOA7&~OzzZIlPyQQCHv?I|{6wZ*JFlwRJ z+(IOmo4L~eij39l!>V}67fsNc2DqMRseg-%@jM0`|1B~Gu{}k`G2qt+VVwY;%l||P zzW5JHP~v~11YiCKCCK`JQ-UT!Pp17}NRr=~YqU>!xYyuUoM_84vJFOq7$xU7)x8#J z|5(^<*e8zu7Y0B(XHG}(zu+RdQZ2FYn%q)odo6bJn$}YIRtpWg^AkBjxdcqs3G=O` z#Df_vMcke~qwW9TMg3$;X$Qn4!go$kv->r@D96@xJEC?#wA^bSJ3>=WF;{x+yl9-( zKHL9Zyuv?TGwg^!f(YnxZ-DZ1p>d}a|3Vtvr=nf&5MOFe1iK*3SGfOh5VCk>UAtI~ zUBO6%wzs7Hp{(#DXM7h~X3Wid26O~TcvrS{P*p7roGMD~Am&Evz43?LA&4^+nRZjG zv8n)HeCNMd>O_K|$?sx>lKmKbLTfM)>X67%r<)7JY5)`oC@bYgTx?}^6%Kv$$4LcZ z0i@uWg8s|JH6;j#1wI4dbt(5mlrs*g*_&#Je`!sh(1s;6)mR@y?FqwOivFrIGC!fs zZ*_`KJJ45pTnj%D$(Hf2aeIz5;Z*h5ok z_yH*xuXT^;rtK9@+fT*2E&A>p%P!j;x>nDUE_XS5IEd6H4#qqiYOnc*g`NXb@4R7j z4qY#HG6Rnp@2)*pyV8upL|NC6(#W0fZC2-kEx%Fk=J&=PC1$txo%1lT??K#n2Wj@_ zX2$-1XQGu&q#r#$1YvZoK0a3FZz=pg7av^ROkLc(Tr4ax1^GpVd3Z2cSU#%CVg6r~ C9Fc4Q literal 0 HcmV?d00001 diff --git a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.cdx.json b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.cdx.json new file mode 100644 index 0000000000..0a861097af --- /dev/null +++ b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.cdx.json @@ -0,0 +1,3029 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.6", + "serialNumber": "urn:uuid:43ba8da1-08c5-467c-8d5f-003dcc94f473", + "version": 1, + "metadata": { + "timestamp": "2025-10-12T15:34:49+00:00", + "licenses": [ + { + "license": { + "id": "CC-BY-SA-4.0", + "url": "https://creativecommons.org/licenses/by-sa/4.0/legalcode.txt" + } + } + ], + "supplier": { + "name": "OWASP Foundation", + "url": [ + "https://owasp.org" + ] + } + }, + "declarations": { + "standards": [ + { + "bom-ref": "ASVS-", + "name": "Application Security Verification Standard (ASVS)", + "version": "", + "description": "The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.", + "owner": "Application Security Verification Standard Project", + "requirements": [ + { + "bom-ref": "V1", + "identifier": "V1", + "title": "Kodlama (Encoding) ve Temizleme" + }, + { + "bom-ref": "V1.1", + "identifier": "V1.1", + "title": "Kodlama ve Temizleme Mimarisi", + "parent": "V1" + }, + { + "bom-ref": "V1.1.1", + "identifier": "V1.1.1", + "text": "Girdinin yalnızca bir kez kanonik forma (canonical form) çözümlendiği veya kaçış işlemlerinin kaldırıldığı, bu işlemin yalnızca verinin bu biçimde beklenmesi durumunda yapıldığı ve bu işlemin girdi doğrulama veya temizleme işlemlerinden sonra değil, önce gerçekleştiği doğrulanmalıdır.", + "parent": "V1.1" + }, + { + "bom-ref": "V1.1.2", + "identifier": "V1.1.2", + "text": "Uygulamanın, çıktıyı kullanılması gereken yorumlayıcıya verilmeden hemen önce veya yorumlayıcının kendisi tarafından çıktı kodlaması ya da kaçış işlemi yaptığı doğrulanmalıdır.", + "parent": "V1.1" + }, + { + "bom-ref": "V1.2", + "identifier": "V1.2", + "title": "Enjeksiyon Önleme", + "parent": "V1" + }, + { + "bom-ref": "V1.2.1", + "identifier": "V1.2.1", + "text": "HTTP yanıtı, HTML veya XML belgesi için yapılan çıktı kodlamasının; HTML elemanları, HTML öznitelikleri, HTML yorumları, CSS ya da HTTP başlık alanları gibi bağlamlara uygun olduğu doğrulanmalıdır. Böylece mesaj veya belge yapısının bozulması önlenir.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.2", + "identifier": "V1.2.2", + "text": "Dinamik olarak URL oluşturulurken, güvenilmeyen verinin bağlamına göre (örneğin, sorgu veya yol parametreleri için URL kodlaması ya da base64url kodlaması) kodlandığı doğrulanmalıdır. Yalnızca güvenli URL protokollerine izin verilmelidir (örneğin, javascript: veya data: yasaklanmalıdır).", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.3", + "identifier": "V1.2.3", + "text": "JavaScript içeriği (JSON dahil) dinamik olarak oluşturulurken çıktı kodlama/kaçış kullanıldığı doğrulanmalıdır. Böylece mesaj veya belge yapısı değiştirilmemiş olur (JavaScript ve JSON enjeksiyonlarının önüne geçilir).", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.4", + "identifier": "V1.2.4", + "text": "Veri sorguları veya veritabanı sorguları (SQL, HQL, NoSQL, Cypher vb.) için parametreli sorgular, ORM’ler, entity framework’ler kullanıldığı ya da SQL enjeksiyonu ve diğer veritabanı enjeksiyon saldırılarına karşı koruma sağlandığı doğrulanmalıdır. Bu durum, saklı yordam (stored procedure) yazarken de geçerlidir.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.5", + "identifier": "V1.2.5", + "text": "Uygulamanın işletim sistemi komut enjeksiyonlarına karşı korunduğu ve işletim sistemi çağrılarında parametreli OS sorguları veya bağlama özgü komut satırı çıktı kodlamasının kullanıldığı doğrulanmalıdır.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.6", + "identifier": "V1.2.6", + "text": "Uygulamanın LDAP enjeksiyon zafiyetlerine karşı korunduğu ya da LDAP enjeksiyonlarını önlemek için özel güvenlik kontrollerinin uygulandığı doğrulanmalıdır.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.7", + "identifier": "V1.2.7", + "text": "XPath enjeksiyon saldırılarına karşı, sorgu parametrelemesi veya önceden derlenmiş sorgular kullanılarak koruma sağlandığı doğrulanmalıdır.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.8", + "identifier": "V1.2.8", + "text": "LaTeX işlemcilerinin güvenli şekilde yapılandırıldığı (örneğin, --shell-escape bayrağının kullanılmadığı) ve yalnızca izin verilen komutlardan oluşan bir listeyle çalıştırıldığı doğrulanmalıdır.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.9", + "identifier": "V1.2.9", + "text": "Düzenli ifadelerde (regex) özel karakterlerin (genellikle ters eğik çizgi \\ ile) kaçırılarak meta karakter olarak yorumlanmalarının önlendiği doğrulanmalıdır.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.10", + "identifier": "V1.2.10", + "text": "Uygulamanın CSV ve formül enjeksiyonlarına karşı korunduğu doğrulanmalıdır. Uygulama, CSV içeriği dışa aktarırken RFC 4180 Bölüm 2.6 ve 2.7'de tanımlanan kaçış kurallarına uymalıdır. Ayrıca, CSV veya diğer tablo formatlarına (XLS, XLSX, ODF gibi) aktarım yapılırken, alanın ilk karakteri olarak çıkan özel karakterler ('=', '+', '-', '@', '\\t' (sekme), '\\0' (null karakter)) tek tırnak (') ile kaçırılmalıdır.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.3", + "identifier": "V1.3", + "title": "Temizleme (Sanitization)", + "parent": "V1" + }, + { + "bom-ref": "V1.3.1", + "identifier": "V1.3.1", + "text": "WYSIWYG editörlerinden veya benzer kaynaklardan gelen tüm güvenilmeyen HTML girdilerinin, bilinen ve güvenli bir HTML temizleme kütüphanesi ya da çerçeve özelliği ile temizlendiği doğrulanmalıdır.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.2", + "identifier": "V1.3.2", + "text": "Uygulamanın eval() veya Spring Expression Language (SpEL) gibi dinamik kod çalıştırma özelliklerini kullanmaktan kaçındığı doğrulanmalıdır. Alternatif yoksa, kullanıcı girdisi çalıştırılmadan önce mutlaka temizlenmelidir.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.3", + "identifier": "V1.3.3", + "text": "Potansiyel olarak tehlikeli bir bağlamda kullanılacak verilerin, bu bağlama uygun karakterlere izin vermek ve çok uzun girdileri kısaltmak gibi güvenlik önlemleriyle önceden temizlendiği doğrulanmalıdır.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.4", + "identifier": "V1.3.4", + "text": "Kullanıcı tarafından sağlanan SVG içeriğinin, yalnızca güvenli etiket ve özellikler (örneğin grafik çizme ile ilgili) içerdiğinden emin olmak için onaylandığı veya temizlendiği doğrulanmalıdır (ör. script veya foreignObject içermemelidir).", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.5", + "identifier": "V1.3.5", + "text": "Markdown, CSS, XSL stil sayfaları, BBCode veya benzeri ifade şablon dillerinde kullanıcı girdisinin temizlendiği veya bu tür özelliklerin devre dışı bırakıldığı doğrulanmalıdır.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.6", + "identifier": "V1.3.6", + "text": "Uygulamanın, güvenilmeyen verileri başka servislere iletmeden önce izinli protokol, alan adı, yol ve port listelerine göre doğruladığı ve tehlikeli karakterleri temizlediği doğrulanarak SSRF (Sunucu Taraflı İstek Sahteciliği) saldırılarına karşı korunduğu doğrulanmalıdır.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.7", + "identifier": "V1.3.7", + "text": "Uygulamanın şablon enjeksiyon saldırılarına karşı, güvenilmeyen girdilere dayalı şablon oluşturmayı engellediği; eğer bu kaçınılmazsa, bu girdilerin mutlaka temizlendiği veya sıkı şekilde onaylandığı doğrulanmalıdır.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.8", + "identifier": "V1.3.8", + "text": "JNDI sorgularında kullanılmadan önce güvenilmeyen girdilerin temizlendiği ve JNDI'nin enjeksiyonlara karşı güvenli şekilde yapılandırıldığı doğrulanmalıdır.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.9", + "identifier": "V1.3.9", + "text": "Memcache’e gönderilmeden önce içeriğin temizlenerek enjeksiyon saldırılarına karşı korunduğu doğrulanmalıdır.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.10", + "identifier": "V1.3.10", + "text": "Format dizgilerinin (format strings) beklenmeyen veya zararlı şekilde çözümlenmesini önlemek için işlenmeden önce temizlendiği doğrulanmalıdır.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.11", + "identifier": "V1.3.11", + "text": "SMTP veya IMAP enjeksiyonlarını önlemek için, kullanıcı girdisinin posta sistemlerine iletilmeden önce temizlendiği doğrulanmalıdır.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.12", + "identifier": "V1.3.12", + "text": "Regex girdilerinin üstel geri izlemeye (exponential backtracking) neden olan öğeler içermediği ve güvenilmeyen girdilerin ReDoS (Regex Denial of Service) gibi saldırılara karşı temizlendiği doğrulanmalıdır.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.4", + "identifier": "V1.4", + "title": "Bellek, Dizgi ve Yönetilmeyen Kod", + "parent": "V1" + }, + { + "bom-ref": "V1.4.1", + "identifier": "V1.4.1", + "text": "Yığın, arabellek (buffer) veya yığın belleği taşmalarını önlemek ya da tespit etmek amacıyla, bellek güvenli dizgi işlemlerinin, daha güvenli bellek kopyalama ve işaretçi aritmetiğinin kullanıldığı doğrulanmalıdır.", + "parent": "V1.4" + }, + { + "bom-ref": "V1.4.2", + "identifier": "V1.4.2", + "text": "Tamsayı taşmalarını önlemek için işaret (sign), aralık (range) ve giriş doğrulama tekniklerinin kullanıldığı doğrulanmalıdır.", + "parent": "V1.4" + }, + { + "bom-ref": "V1.4.3", + "identifier": "V1.4.3", + "text": "Dinamik olarak ayrılan belleğin ve kaynakların serbest bırakıldığı ve boşaltılan belleklere ait referansların veya işaretçilerin kaldırıldığı veya null yapıldığı doğrulanmalıdır (dangling pointer ve use-after-free zafiyetlerine karşı).", + "parent": "V1.4" + }, + { + "bom-ref": "V1.5", + "identifier": "V1.5", + "title": "Güvenli Ters Serileştirme (Safe Deserialization)", + "parent": "V1" + }, + { + "bom-ref": "V1.5.1", + "identifier": "V1.5.1", + "text": "XML ayrıştırıcılarının (parser) kısıtlayıcı şekilde yapılandırıldığı ve dış varlık çözümleme (external entity resolution) gibi güvensiz özelliklerin XXE (XML eXternal Entity) saldırılarına karşı devre dışı bırakıldığı doğrulanmalıdır .", + "parent": "V1.5" + }, + { + "bom-ref": "V1.5.2", + "identifier": "V1.5.2", + "text": "Güvenilmeyen verilerin ters serileştirilmesinde, nesne türleri için izinli liste kullanımı veya istemci tanımlı nesne türlerinin kısıtlanması gibi güvenli giriş işleme önlemlerinin uygulandığı doğrulanmalıdır. Güvensiz olarak tanımlanmış ters serileştirme mekanizmaları, güvenilmeyen girdilerle kullanılmamalıdır.", + "parent": "V1.5" + }, + { + "bom-ref": "V1.5.3", + "identifier": "V1.5.3", + "text": "Aynı veri türü için uygulamada kullanılan farklı parser'ların (ör. JSON, XML, URL parser'ları), veriyi tutarlı şekilde ayrıştırdığı ve aynı karakter kodlamasını kullandığı doğrulanmalıdır. Böylece JSON birlikte çalışabilirlik açıkları, URI veya dosya ayrıştırma farkları gibi sorunlar nedeniyle RFI veya SSRF saldırılarının istismar edilmesi önlenir.", + "parent": "V1.5" + }, + { + "bom-ref": "V2", + "identifier": "V2", + "title": "Doğrulama ve İş Mantığı" + }, + { + "bom-ref": "V2.1", + "identifier": "V2.1", + "title": "Doğrulama ve İş Mantığı Dokümantasyonu", + "parent": "V2" + }, + { + "bom-ref": "V2.1.1", + "identifier": "V2.1.1", + "text": "Uygulama dokümantasyonunda, veri öğelerinin beklenen yapıya göre nasıl doğrulanacağına ilişkin giriş doğrulama kurallarının tanımlandığı doğrulanmalıdır. Bu; kredi kartı numaraları, e-posta adresleri, telefon numaraları gibi yaygın veri biçimleri olabileceği gibi iç sistemlere özel biçimler de olabilir.", + "parent": "V2.1" + }, + { + "bom-ref": "V2.1.2", + "identifier": "V2.1.2", + "text": "Uygulama dokümantasyonunda, birleştirilmiş veri öğelerinin mantıksal ve bağlamsal tutarlılığının nasıl doğrulanacağı tanımlanmalıdır (örneğin, mahalle ve posta kodunun eşleşip eşleşmediğinin kontrolü).", + "parent": "V2.1" + }, + { + "bom-ref": "V2.1.3", + "identifier": "V2.1.3", + "text": "Hem kullanıcı bazında hem de uygulama genelinde geçerli olacak şekilde, iş mantığı sınırları ve doğrulama beklentilerinin belgelendiği doğrulanmalıdır.", + "parent": "V2.1" + }, + { + "bom-ref": "V2.2", + "identifier": "V2.2", + "title": "Girdi Doğrulama", + "parent": "V2" + }, + { + "bom-ref": "V2.2.1", + "identifier": "V2.2.1", + "text": "Girdilerin, işlevsel ya da iş gereksinimlerine uygunluğunun doğrulandığı teyit edilmelidir. Bu işlem; izinli değerler, desenler ve aralıklar listesine karşı pozitif doğrulama ile ya da girdinin beklenen yapıya ve mantıksal sınırlara uygunluğunun önceden tanımlanmış kurallara göre karşılaştırılması ile yapılmalıdır. Seviye 1 için bu, güvenlik veya iş kararlarında kullanılan girdilere odaklanabilir. Seviye 2 ve üstü için tüm girdilere uygulanmalıdır.", + "parent": "V2.2" + }, + { + "bom-ref": "V2.2.2", + "identifier": "V2.2.2", + "text": "Uygulamanın, güvenilir bir servis katmanında girdi doğrulama zorunluluğu uygulayacak şekilde tasarlandığı doğrulanmalıdır. İstemci tarafında gerçekleştirilen doğrulama, kullanılabilirliği artırabilir ve teşvik edilmelidir. Ancak bu doğrulama,güvenlik kontrolü olarak kabul edilmemelidir.", + "parent": "V2.2" + }, + { + "bom-ref": "V2.2.3", + "identifier": "V2.2.3", + "text": "Uygulamanın, ilişkili veri öğelerinin önceden tanımlanmış kurallara göre makul olup olmadığını kontrol ettiği doğrulanmalıdır.", + "parent": "V2.2" + }, + { + "bom-ref": "V2.3", + "identifier": "V2.3", + "title": "İş Mantığı Güvenliği", + "parent": "V2" + }, + { + "bom-ref": "V2.3.1", + "identifier": "V2.3.1", + "text": "Uygulamanın, aynı kullanıcı için iş mantığı akışlarını yalnızca beklenen adım sırasına göre ve adım atlamadan işlediği doğrulanmalıdır.", + "parent": "V2.3" + }, + { + "bom-ref": "V2.3.2", + "identifier": "V2.3.2", + "text": "İş mantığı sınırlarının, uygulama dokümantasyonuna uygun şekilde uygulandığı doğrulanmalıdır.", + "parent": "V2.3" + }, + { + "bom-ref": "V2.3.3", + "identifier": "V2.3.3", + "text": "İş mantığı seviyesinde işlemlerin (transaction) kullanıldığı ve bir iş mantığı işleminin ya bütünüyle başarıyla tamamlandığı ya da önceki geçerli duruma geri döndürüldüğü (rollback) doğrulanmalıdır.", + "parent": "V2.3" + }, + { + "bom-ref": "V2.3.4", + "identifier": "V2.3.4", + "text": "İş mantığı düzeyinde kilitleme mekanizmalarının, sınırlı kaynakların (ör. sinema koltukları, teslimat zamanları) uygulamanın mantığı manipüle edilerek çift rezervasyona neden olmamasını sağladığı doğrulanmalıdır.", + "parent": "V2.3" + }, + { + "bom-ref": "V2.3.5", + "identifier": "V2.3.5", + "text": "Yüksek değerli iş mantığı akışlarının, yetkisiz veya kazara gerçekleşebilecek işlemleri önlemek için çoklu kullanıcı onayı gerektirdiği doğrulanmalıdır. Bu işlemler büyük para transferleri, sözleşme onayları, gizli bilgilere erişim veya üretimde güvenlik kurallarının geçersiz kılınmaları gibi durumları içerebilir.", + "parent": "V2.3" + }, + { + "bom-ref": "V2.4", + "identifier": "V2.4", + "title": "Otomasyon Karşıtı Önlemler", + "parent": "V2" + }, + { + "bom-ref": "V2.4.1", + "identifier": "V2.4.1", + "text": "Uygulama işlevlerine yönelik aşırı miktardaki çağrılara karşı; veri sızdırma, anlamsız veri üretme, kota tüketme, hız sınırının aşılması, hizmet reddi (DoS) ya da maliyetli kaynakların aşırı kullanımı gibi risklere karşı otomasyon karşıtı kontrollerin bulunduğu doğrulanmalıdır.", + "parent": "V2.4" + }, + { + "bom-ref": "V2.4.2", + "identifier": "V2.4.2", + "text": "İş mantığı akışlarının, aşırı hızlı işlem gönderimlerini önleyecek şekilde gerçekçi insan zamanlaması gerektirdiği doğrulanmalıdır.", + "parent": "V2.4" + }, + { + "bom-ref": "V3", + "identifier": "V3", + "title": "Web Ön Uç (Frontend) Güvenliği" + }, + { + "bom-ref": "V3.1", + "identifier": "V3.1", + "title": "Web Frontend Güvenlik Dokümantasyonu", + "parent": "V3" + }, + { + "bom-ref": "V3.1.1", + "identifier": "V3.1.1", + "text": "Uygulama dokümantasyonunda, uygulamayı kullanan tarayıcıların desteklemesi gereken güvenlik özelliklerinin (ör. HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) ve diğer ilgili HTTP güvenlik mekanizmaları) tanımlandığı doğrulanmalıdır. Ayrıca bu özelliklerin mevcut olmadığı durumlarda uygulamanın nasıl davranması gerektiği (ör. kullanıcıyı uyarmak veya erişimi engellemek) de tanımlanmalıdır.", + "parent": "V3.1" + }, + { + "bom-ref": "V3.2", + "identifier": "V3.2", + "title": "İçeriğin Yanlış Yorumlanması", + "parent": "V3" + }, + { + "bom-ref": "V3.2.1", + "identifier": "V3.2.1", + "text": "Tarayıcıların HTTP yanıtlarında içerik veya işlevi yanlış bir bağlamda sunmalarını önlemek amacıyla güvenlik kontrollerinin uygulandığı doğrulanmalıdır (ör. API, kullanıcı tarafından yüklenen dosya veya başka bir kaynağın doğrudan çağrılması durumunda). Olası kontroller arasında; yalnızca HTTP istek başlıklarının (ör. Sec-Fetch-\\*) doğru bağlamı gösterdiği durumlarda içeriğin sunulması, Content-Security-Policy başlığında \"sandbox\" yönergesinin kullanılması veya Content-Disposition başlığında \"attachment\" biçiminin kullanılması yer alabilir.", + "parent": "V3.2" + }, + { + "bom-ref": "V3.2.2", + "identifier": "V3.2.2", + "text": "HTML yerine metin olarak görüntülenmesi amaçlanan içeriğin, HTML veya JavaScript gibi içeriklerin istenmeden çalıştırılmasını önleyecek şekilde \"createTextNode\" veya \"textContent\" gibi güvenli işleme fonksiyonlarıyla işlendiği doğrulanmalıdır.", + "parent": "V3.2" + }, + { + "bom-ref": "V3.2.3", + "identifier": "V3.2.3", + "text": "Uygulamanın istemci tarafı JavaScript kullanırken açık değişken tanımlamaları yaparak, sıkı tür kontrolü uygulayarak, global değişkenleri document nesnesine kaydetmekten kaçınarak ve ad alanı izolasyonu sağlayarak DOM clobbering’den kaçındığı doğrulanmalıdır.", + "parent": "V3.2" + }, + { + "bom-ref": "V3.3", + "identifier": "V3.3", + "title": "Çerez Yapılandırması", + "parent": "V3" + }, + { + "bom-ref": "V3.3.1", + "identifier": "V3.3.1", + "text": "Çerezlerin 'Secure' niteliğine sahip olduğu ve eğer çerez adı '\\__Host-' ön eki ile başlamıyorsa, '__Secure-' ön ekinin kullanıldığı doğrulanmalıdır.", + "parent": "V3.3" + }, + { + "bom-ref": "V3.3.2", + "identifier": "V3.3.2", + "text": "Kullanıcı arayüzü kandırma saldırılarına ve tarayıcı tabanlı istek sahteciliği saldırılarına (CSRF) karşı koruma sağlamak amacıyla, her çerezin 'SameSite' niteliğinin kullanım amacına uygun şekilde ayarlandığı doğrulanmalıdır.", + "parent": "V3.3" + }, + { + "bom-ref": "V3.3.3", + "identifier": "V3.3.3", + "text": "Çerez adı, diğer sunucularla paylaşılmak üzere açıkça tasarlanmadığı sürece '__Host-' ön eki ile tanımlanmalıdır.", + "parent": "V3.3" + }, + { + "bom-ref": "V3.3.4", + "identifier": "V3.3.4", + "text": "Bir çerez değeri istemci tarafı betikleri tarafından erişilememesi gereken bir veri içeriyorsa (ör. oturum token'ı), çerezin 'HttpOnly' niteliğine sahip olduğu ve aynı değerin (ör. oturum token'ı) yalnızca 'Set-Cookie' başlığı ile istemciye iletildiği doğrulanmalıdır.", + "parent": "V3.3" + }, + { + "bom-ref": "V3.3.5", + "identifier": "V3.3.5", + "text": "Uygulama bir çerez oluştururken, çerez adı ve değerinin toplam uzunluğunun 4096 baytı aşmadığı doğrulanmalıdır. Çok büyük çerezler tarayıcı tarafından saklanmaz ve isteklerle gönderilmez; bu da çereze bağlı çalışan uygulama işlevlerinin bozulmasına yol açabilir.", + "parent": "V3.3" + }, + { + "bom-ref": "V3.4", + "identifier": "V3.4", + "title": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", + "parent": "V3" + }, + { + "bom-ref": "V3.4.2", + "identifier": "V3.4.2", + "text": "Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header'ı, uygulama tarafından sabit bir değer olarak tanımlanmalı veya gelen Origin header değeri güvenilir origin’lerden oluşan bir izinli listeye karşı doğrulanmalıdır. ‘Access-Control-Allow-Origin: *’ kullanılması gerekiyorsa, yanıtın hassas bilgi içermediği doğrulanmalıdır.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.3", + "identifier": "V3.4.3", + "text": "HTTP yanıtlarında Content-Security-Policy header'ı bulunduğu ve bu header'ın yalnızca güvenilen içeriklerin veya kaynakların yüklenmesini ve çalıştırılmasını sağlayan yönergeler içerdiği doğrulanmalıdır. Minimum olarak \"global policy\", object-src 'none', base-uri 'none' yönergelerini içermeli ve izinli liste, nonce veya hash temelli bir yapı içermelidir. Seviye 3 uygulamalarında her yanıt için nonce veya hash içeren özel bir politika tanımlanmalıdır.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.4", + "identifier": "V3.4.4", + "text": "Tüm HTTP yanıtlarının 'X-Content-Type-Options: nosniff' header'ını içerdiği doğrulanmalıdır. Bu, tarayıcıya içerik türünü tahmin etmeyi bırakmasını ve yanıtın Content-Type header'ında belirtilen MIME türünün, beklenen kaynak türüyle eşleşmesini zorunlu kılar. Ayrıca bu, tarayıcıda CORB (Cross-Origin Read Blocking) özelliğini etkinleştirir.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.5", + "identifier": "V3.4.5", + "text": "Uygulamanın, 'Referer' başlığı yoluyla üçüncü taraflara teknik olarak hassas verilerin sızmasını önlemek için bir 'referrer policy' belirlediği doğrulanmalıdır. Bu, Referrer-Policy HTTP header'ıyla veya HTML öğe nitelikleriyle (element attributes) sağlanabilir. Sızabilecek hassas bilgiler, URL’deki yol ve sorgu parametreleri ile sınırlı uygulamalarda hostname bilgisini içerebilir.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.6", + "identifier": "V3.4.6", + "text": "Uygulamanın, Content-Security-Policy header'ı altında 'frame-ancestors' yönergesini her HTTP yanıtında tanımladığı ve bu sayede içeriklerin varsayılan olarak başka sayfalara gömülmesini engellediği doğrulanmalıdır. Gerekli durumlarda özel olarak izin verildiğinden emin olunmalıdır. 'X-Frame-Options' header'ı, tarayıcılar tarafından desteklenmesine rağmen, artık güncel değildir ve güvenlik amacıyla kullanılmamalıdır.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.8", + "identifier": "V3.4.8", + "text": "Bir belgenin işlenmesini ve sunulmasını başlatan tüm HTTP yanıtlarında (örneğin 'text/html' tipi yanıtlar), 'Cross-Origin-Opener-Policy' header'ı 'same-origin' veya 'same-origin-allow-popups' yönergeleriyle birlikte yer almalıdır. Bu, tabnabbing ve frame counting gibi, pencere nesnelerine paylaşımlı erişimi sömüren saldırılara karşı koruma sağlar.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.5", + "identifier": "V3.5", + "title": "Tarayıcı Menşei Ayırımı", + "parent": "V3" + }, + { + "bom-ref": "V3.5.1", + "identifier": "V3.5.1", + "text": "Uygulama, hassas işlevselliğe yönelik izinsiz cross-origin istekleri önlemek için CORS preflight mekanizmasına güvenmiyorsa, bu tür isteklerin gerçekten uygulamadan geldiği doğrulanmalıdır. Bu, anti-forgery token kullanımı veya CORS tarafından güvenli kabul edilmeyen özel HTTP header'larının zorunlu kılınmasıyla yapılabilir. Bu, tarayıcı tabanlı istek sahteciliği (CSRF) saldırılarına karşı bir savunmadır.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.2", + "identifier": "V3.5.2", + "text": "Uygulama, hassas işlevlerin izinsiz cross-origin çağrılmasını önlemek için CORS preflight mekanizmasına güveniyorsa, bu işlevlerin bir CORS-preflight isteğini tetiklemeden çağrılamadığı doğrulanmalıdır. Bu, 'Origin' ve 'Content-Type' header'larının doğrulanmasını veya CORS-safelisted olmayan bir header'ın ve alanın kullanılmasını gerektirebilir.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.4", + "identifier": "V3.5.4", + "text": "Farklı uygulamaların farklı hostname'lerde barındırıldığı ve böylece Same-Origin Policy tarafından sağlanan kısıtlamalardan (örneğin çerez erişim sınırları, kaynaklar arası etkileşim kontrolleri) faydalanıldığı doğrulanmalıdır.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.6", + "identifier": "V3.5.6", + "text": "Uygulamanın herhangi bir yerinde JSONP işlevselliğinin etkin olmadığı doğrulanmalıdır. Bu, XSSI (Cross-Site Script Inclusion) saldırılarını önlemek içindir.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.7", + "identifier": "V3.5.7", + "text": "Yetkilendirme gerektiren verilerin, JavaScript dosyaları gibi betik kaynaklarının yanıtlarında yer almadığı, XSSI saldırılarını önlemek için doğrulanmalıdır.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.8", + "identifier": "V3.5.8", + "text": "Kimliği doğrulanmış kaynakların (örneğin görseller, videolar, betikler ve belgeler) yalnızca gerçekten amaçlandığında kullanıcı adına yüklenebildiği veya gömülebildiği doğrulanmalıdır. Bu, isteğin uygun olmayan bir çapraz kaynak çağrısından kaynaklanmadığından emin olmak için Sec-Fetch-* HTTP istek başlığı alanlarının sıkı bir şekilde doğrulanmasıyla veya tarayıcıya döndürülen içeriği engelleme talimatı vermek için kısıtlayıcı bir Cross-Origin-Resource-Policy HTTP yanıt başlığı alanı ayarlayarak gerçekleştirilebilir.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.6", + "identifier": "V3.6", + "title": "Harici Kaynak Bütünlüğü", + "parent": "V3" + }, + { + "bom-ref": "V3.6.1", + "identifier": "V3.6.1", + "text": "JavaScript kütüphaneleri, CSS veya web fontları gibi istemci tarafı varlıkların yalnızca statik ve sürümlü olması, varlığın bütünlüğünü doğrulamak için Subresource Integrity (SRI) kullanılması durumunda harici olarak (örneğin, bir İçerik Dağıtım Ağı üzerinde) barındırıldığı doğrulanmalıdır. Bu mümkün değilse, her bir kaynak için bunu gerekçelendiren belgelenmiş bir güvenlik kararı bulunmalıdır.", + "parent": "V3.6" + }, + { + "bom-ref": "V3.7", + "identifier": "V3.7", + "title": "Diğer Tarayıcı Güvenliği Hususları", + "parent": "V3" + }, + { + "bom-ref": "V3.7.1", + "identifier": "V3.7.1", + "text": "Uygulamanın yalnızca hâlâ desteklenen ve güvenli kabul edilen istemci tarafı teknolojileri kullandığı doğrulanmalıdır. Bu gereksinimi karşılamayan teknolojilere örnek olarak NSAPI eklentileri, Flash, Shockwave, ActiveX, Silverlight, NACL veya istemci tarafı Java applet’leri verilebilir.", + "parent": "V3.7" + }, + { + "bom-ref": "V3.7.2", + "identifier": "V3.7.2", + "text": "Uygulamanın, yalnızca hedef adres bir izinli listede yer alıyorsa kullanıcıyı otomatik olarak farklı bir ana makine adına veya uygulamanın kontrolünde olmayan bir etki alanına yönlendirdiği doğrulanmalıdır.", + "parent": "V3.7" + }, + { + "bom-ref": "V3.7.3", + "identifier": "V3.7.3", + "text": "Uygulamanın, kullanıcı uygulamanın kontrolü dışındaki bir URL’ye yönlendirildiğinde, yönlendirme hakkında bir bildirim gösterdiği ve kullanıcının bu gezintiyi iptal edebilmesi için bir seçenek sunduğu doğrulanmalıdır.", + "parent": "V3.7" + }, + { + "bom-ref": "V3.7.4", + "identifier": "V3.7.4", + "text": "Uygulamanın en üst düzey etki alanının (örneğin, site.tld) HTTP Strict Transport Security (HSTS) için genel preload listesine eklendiği doğrulanmalıdır. Bu, uygulamanın TLS kullanımının ana tarayıcılar tarafından doğrudan tanınmasını ve yalnızca Strict-Transport-Security yanıt header'ına bağlı kalınmamasını sağlar.", + "parent": "V3.7" + }, + { + "bom-ref": "V3.7.5", + "identifier": "V3.7.5", + "text": "Uygulamaya erişen tarayıcının beklenen güvenlik özelliklerini desteklememesi durumunda, uygulamanın dokümantasyona uygun şekilde davrandığı (örneğin kullanıcıyı uyarma veya erişimi engelleme) doğrulanmalıdır.", + "parent": "V3.7" + }, + { + "bom-ref": "V4", + "identifier": "V4", + "title": "API ve Web Servisi" + }, + { + "bom-ref": "V4.1", + "identifier": "V4.1", + "title": "Genel Web Servisi Güvenliği", + "parent": "V4" + }, + { + "bom-ref": "V4.1.1", + "identifier": "V4.1.1", + "text": "İleti gövdesi içeren her HTTP yanıtında, yanıtın gerçek içeriğiyle eşleşen bir Content-Type header alanı bulunduğu ve güvenli karakter kodlamasını (örneğin, UTF-8, ISO-8859-1) belirtmek üzere charset parametresi içerdiği doğrulanmalıdır. Bu işlem, IANA Medya Türleri'nden \"text/\", \"/+xml\" ve \"/xml\" gibi içerikler için geçerlidir.", + "parent": "V4.1" + }, + { + "bom-ref": "V4.1.2", + "identifier": "V4.1.2", + "text": "Yalnızca kullanıcı arayüzüne yönelik uç noktaların (manuel olarak web tarayıcısı ile erişilmesi amaçlanan) otomatik olarak HTTP'den HTTPS'e yönlendirme yaptığı ve diğer hizmetlerin veya uç noktaların şeffaf yönlendirme gerçekleştirmediği doğrulanmalıdır. Bu, istemcinin farkında olmadan şifrelenmemiş HTTP istekleri göndermesi ve bu isteklerin otomatik olarak HTTPS'e yönlendirilmesi sonucunda hassas verilerin sızmasının fark edilmemesi riskini önlemek içindir.", + "parent": "V4.1" + }, + { + "bom-ref": "V4.1.3", + "identifier": "V4.1.3", + "text": "Uygulama tarafından kullanılan ve yük dengeleyici, web proxy veya frontend için backend hizmeti gibi bir ara katman tarafından ayarlanan herhangi bir HTTP başlık alanının, son kullanıcı tarafından geçersiz kılınamayacağı doğrulanmalıdır. Örnek başlıklar arasında X-Real-IP, X-Forwarded-* veya X-User-ID yer alabilir.", + "parent": "V4.1" + }, + { + "bom-ref": "V4.1.4", + "identifier": "V4.1.4", + "text": "Uygulama veya API tarafından açıkça desteklenen HTTP yöntemlerinin (preflight istekleri sırasında OPTIONS dahil) dışında hiçbir yöntemin kullanılmadığı ve kullanılmayan yöntemlerin engellendiği doğrulanmalıdır.", + "parent": "V4.1" + }, + { + "bom-ref": "V4.1.5", + "identifier": "V4.1.5", + "text": "Çok hassas istekler veya birçok sistemden geçen işlemler için, taşıma katmanı güvenliğinin üzerine ek bir güvence sağlamak amacıyla, her iletiye özel dijital imzaların kullanıldığı doğrulanmalıdır.", + "parent": "V4.1" + }, + { + "bom-ref": "V4.2", + "identifier": "V4.2", + "title": "HTTP İleti Yapısı Doğrulama", + "parent": "V4" + }, + { + "bom-ref": "V4.2.1", + "identifier": "V4.2.1", + "text": "Tüm uygulama bileşenlerinin (yük dengeleyiciler, güvenlik duvarları ve uygulama sunucuları dahil) HTTP sürümüne uygun mekanizmaları kullanarak gelen HTTP iletilerinin sınırlarını belirlediği ve bu sayede HTTP istek kaçakçılığına karşı koruma sağlandığı doğrulanmalıdır. HTTP/1.x sürümünde Transfer-Encoding başlık alanı varsa, RFC 2616'ya göre Content-Length başlığı göz ardı edilmelidir. HTTP/2 veya HTTP/3 kullanıldığında, Content-Length başlığı varsa, alıcının bu değerin DATA çerçevelerinin uzunluğuyla tutarlı olduğunu doğrulaması gerekir.", + "parent": "V4.2" + }, + { + "bom-ref": "V4.2.2", + "identifier": "V4.2.2", + "text": "HTTP iletileri üretilirken, Content-Length başlığının, HTTP protokolünün çerçeveleme yöntemine göre belirlenen içerik uzunluğu ile çelişmediği doğrulanmalıdır. Bu, istek kaçakçılığı saldırılarını önlemek için gereklidir.", + "parent": "V4.2" + }, + { + "bom-ref": "V4.2.3", + "identifier": "V4.2.3", + "text": "Uygulamanın, yanıt bölme ve header enjeksiyonu saldırılarını önlemek amacıyla, bağlantıya özel başlık alanları (örneğin Transfer-Encoding) içeren HTTP/2 veya HTTP/3 iletilerini göndermediği ve kabul etmediği doğrulanmalıdır.", + "parent": "V4.2" + }, + { + "bom-ref": "V4.2.4", + "identifier": "V4.2.4", + "text": "Uygulamanın yalnızca başlık alanları ve değerleri CR (\\r), LF (\\n) veya CRLF (\\r\\n) karakter dizileri içermeyen HTTP/2 ve HTTP/3 isteklerini kabul ettiği doğrulanmalıdır. Bu, başlık enjeksiyonu saldırılarını önlemek içindir.", + "parent": "V4.2" + }, + { + "bom-ref": "V4.2.5", + "identifier": "V4.2.5", + "text": "Uygulama (backend veya frontend) istek oluşturuyor ve gönderiyorsa, URI'ler (örneğin API çağrıları için) veya HTTP istek başlıkları (örneğin Authorization veya Cookie) gibi bileşenlerin, alıcı sistemler tarafından kabul edilemeyecek kadar uzun olmamasını sağlamak amacıyla doğrulama, temizleme veya diğer mekanizmaları kullandığı doğrulanmalıdır. Bu tür çok uzun istekler (örneğin çok uzun bir Cookie başlığı) gönderildiğinde sunucunun sürekli hata durumu döndürmesiyle hizmet reddi oluşabilir.", + "parent": "V4.2" + }, + { + "bom-ref": "V4.3", + "identifier": "V4.3", + "title": "GraphQL", + "parent": "V4" + }, + { + "bom-ref": "V4.3.1", + "identifier": "V4.3.1", + "text": "Maliyetli ve iç içe geçmiş sorgular sonucu oluşabilecek GraphQL veya veri katmanı ifadelerine yönelik Hizmet Reddi (DoS) saldırılarını önlemek için, sorgu izin listesi (allowlist), derinlik sınırlandırması, sorgu sayısı sınırlandırması veya sorgu maliyeti analizi kullanıldığı doğrulanmalıdır.", + "parent": "V4.3" + }, + { + "bom-ref": "V4.3.2", + "identifier": "V4.3.2", + "text": "GraphQL introspection (iç yapı sorgulama) sorgularının, GraphQL API'nin üçüncü taraflar tarafından kullanılmasına yönelik olmadığı sürece, üretim ortamında devre dışı bırakıldığı doğrulanmalıdır.", + "parent": "V4.3" + }, + { + "bom-ref": "V4.4", + "identifier": "V4.4", + "title": "WebSocket", + "parent": "V4" + }, + { + "bom-ref": "V4.4.1", + "identifier": "V4.4.1", + "text": "Tüm WebSocket bağlantılarında TLS üzerinden WebSocket (WSS) kullanıldığı doğrulanmalıdır.", + "parent": "V4.4" + }, + { + "bom-ref": "V4.4.2", + "identifier": "V4.4.2", + "text": "WebSocket'in başlangıçtaki HTTP el sıkışması (handshake) sırasında, Origin başlık alanının uygulama için izin verilen origin listesiyle karşılaştırılarak kontrol edildiği doğrulanmalıdır.", + "parent": "V4.4" + }, + { + "bom-ref": "V4.4.3", + "identifier": "V4.4.3", + "text": "Uygulamanın standart oturum yönetimi kullanılamıyorsa, bunun yerine ilgili Oturum Yönetimi güvenlik gereksinimlerine uygun özel token'ların kullanıldığı doğrulanmalıdır.", + "parent": "V4.4" + }, + { + "bom-ref": "V4.4.4", + "identifier": "V4.4.4", + "text": "HTTPS oturumu WebSocket kanalına geçerken, özel WebSocket oturum yönetim token’larının önceki şekilde kimliği doğrulanmış HTTPS oturumu aracılığıyla elde edildiği veya doğrulandığı doğrulanmalıdır.", + "parent": "V4.4" + }, + { + "bom-ref": "V5", + "identifier": "V5", + "title": "Dosya İşleme" + }, + { + "bom-ref": "V5.1", + "identifier": "V5.1", + "title": "Dosya İşleme Dokümantasyonu", + "parent": "V5" + }, + { + "bom-ref": "V5.1.1", + "identifier": "V5.1.1", + "text": "Dokümantasyonun, her yükleme özelliği için izin verilen dosya türlerini, beklenen dosya uzantılarını ve maksimum boyutu (açılmış hali dahil) tanımladığı doğrulanmalıdır. Ayrıca, dosyaların son kullanıcılar için nasıl güvenli hâle getirileceği (örneğin kötü amaçlı bir dosya tespit edildiğinde uygulamanın nasıl davranacağı) gibi bilgilerin de belgede yer aldığı doğrulanmalıdır.", + "parent": "V5.1" + }, + { + "bom-ref": "V5.2", + "identifier": "V5.2", + "title": "Dosya Yükleme ve İçerik", + "parent": "V5" + }, + { + "bom-ref": "V5.2.1", + "identifier": "V5.2.1", + "text": "Uygulamanın, yalnızca performans kaybına veya hizmet reddine yol açmayacak boyuttaki dosyaları kabul ettiği doğrulanmalıdır.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.2.2", + "identifier": "V5.2.2", + "text": "Uygulama bir dosyayı, doğrudan veya bir arşiv (ör. zip dosyası) içinde kabul ettiğinde, dosya uzantısının beklenen uzantıyla eşleşip eşleşmediğini kontrol ettiği ve içeriğin uzantı tarafından temsil edilen türle uyumlu olduğunu doğruladığı kontrol edilmelidir. Bu; ilk 'magic byte' kontrolü, görüntü yeniden yazımı ve dosya içeriği doğrulama için özel kütüphanelerin kullanımı gibi yöntemleri içerir. Seviye 1 için bu, yalnızca iş veya güvenlik kararlarında kullanılan dosyalarla sınırlı olabilir. Seviye 2 ve üzeri için tüm dosyalar bu kontrole tabi olmalıdır.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.2.3", + "identifier": "V5.2.3", + "text": "Sıkıştırılmış dosyaların (ör. zip, gz, docx, odt) açılmadan önce, izin verilen maksimum açılmış boyuta ve maksimum dosya sayısına göre kontrol edildiği doğrulanmalıdır.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.2.4", + "identifier": "V5.2.4", + "text": "Her kullanıcı için dosya boyutu kotası ve maksimum dosya sayısının uygulandığı doğrulanmalıdır. Böylece tek bir kullanıcının çok sayıda veya aşırı büyük dosya yükleyerek depolama alanını doldurması engellenir.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.2.5", + "identifier": "V5.2.5", + "text": "Uygulamanın, içinde sembolik bağlantılar (symlink) bulunan sıkıştırılmış dosyaların yüklenmesine yalnızca bu durum özel olarak gerekli olduğunda izin verdiği doğrulanmalıdır. Bu durumda, sembolik bağlantı verilebilecek dosyaların bir izinli listesi uygulanmalıdır.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.2.6", + "identifier": "V5.2.6", + "text": "Uygulamanın, piksel boyutu izin verilen maksimum değeri aşan görüntü dosyalarının yüklenmesini reddettiği doğrulanmalıdır. Bu, pixel flood saldırılarını önlemek için gereklidir.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.3", + "identifier": "V5.3", + "title": "Dosya Depolama", + "parent": "V5" + }, + { + "bom-ref": "V5.3.1", + "identifier": "V5.3.1", + "text": "Güvenilmeyen girdilerle yüklenen veya oluşturulan ve herkese açık klasörlerde depolanan dosyaların, bir HTTP isteğiyle doğrudan erişildiğinde sunucu taraflı program kodu olarak çalıştırılmadığı doğrulanmalıdır.", + "parent": "V5.3" + }, + { + "bom-ref": "V5.3.2", + "identifier": "V5.3.2", + "text": "Uygulamanın, dosya işlemleri için dosya yollarını oluştururken kullanıcı tarafından gönderilen dosya adlarını değil, dahili olarak oluşturulan veya güvenilir verileri kullandığı; eğer kullanıcı tarafından gönderilen dosya adları veya meta veriler kullanılacaksa, sıkı doğrulama ve temizleme işlemlerinin uygulandığı doğrulanmalıdır. Bu, yol geçişi (path traversal), yerel veya uzak dosya dahil etme (LFI, RFI) ve sunucu tarafı istek sahteciliği (SSRF) saldırılarına karşı koruma sağlar.", + "parent": "V5.3" + }, + { + "bom-ref": "V5.3.3", + "identifier": "V5.3.3", + "text": "Sunucu tarafında gerçekleşen dosya işlemlerinin (örneğin dosya açma/decompress işlemi), kullanıcı tarafından sağlanan yol bilgilerini yok saydığı ve zip slip gibi güvenlik açıklarını önlediği doğrulanmalıdır.", + "parent": "V5.3" + }, + { + "bom-ref": "V5.4", + "identifier": "V5.4", + "title": "Dosya İndirme", + "parent": "V5" + }, + { + "bom-ref": "V5.4.1", + "identifier": "V5.4.1", + "text": "Uygulamanın, kullanıcı tarafından gönderilen dosya adlarını (ör. JSON, JSONP veya URL parametresinde) doğruladığı veya göz ardı ettiği ve yanıtın Content-Disposition başlık alanında bir dosya adı belirttiği doğrulanmalıdır.", + "parent": "V5.4" + }, + { + "bom-ref": "V5.4.2", + "identifier": "V5.4.2", + "text": "Sunulan dosya adlarının (örneğin HTTP yanıt header'larında veya e-posta eklerinde), belge yapısını korumak ve enjeksiyon saldırılarını önlemek için kodlandığı veya temizlendiği (ör. RFC 6266’ya uygun) doğrulanmalıdır.", + "parent": "V5.4" + }, + { + "bom-ref": "V5.4.3", + "identifier": "V5.4.3", + "text": "Güvenilmeyen kaynaklardan elde edilen dosyaların, bilinen kötü amaçlı içeriklerin sunulmasını önlemek amacıyla antivirüs tarayıcılarıyla tarandığı doğrulanmalıdır.", + "parent": "V5.4" + }, + { + "bom-ref": "V6", + "identifier": "V6", + "title": "Kimlik Doğrulama" + }, + { + "bom-ref": "V6.1", + "identifier": "V6.1", + "title": "Kimlik Doğrulama Dokümantasyonu", + "parent": "V6" + }, + { + "bom-ref": "V6.1.1", + "identifier": "V6.1.1", + "text": "Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırılarına karşı oran sınırlama (rate limiting), otomasyon karşıtı önlemler ve uyarlanabilir yanıt gibi kontrollerin nasıl kullanıldığını açıklayan bir uygulama dokümantasyonu bulunduğu doğrulanmalıdır. Dokümantasyon, bu kontrollerin nasıl yapılandırıldığını ve kötü niyetli hesap kilitlemenin nasıl önlendiğini açıkça ortaya koymalıdır.", + "parent": "V6.1" + }, + { + "bom-ref": "V6.1.2", + "identifier": "V6.1.2", + "text": "Parolalarda kullanılmasını önlemek amacıyla, bağlama özgü sözcüklerin (örneğin kurum adlarının permütasyonları, ürün adları, sistem tanımlayıcıları, proje kod adları, departman veya rol adları vb.) bulunduğu belgelenmiş bir liste mevcut olduğu doğrulanmalıdır.", + "parent": "V6.1" + }, + { + "bom-ref": "V6.1.3", + "identifier": "V6.1.3", + "text": "Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, bunların tümünün belgelenmiş olduğu ve her yol için tutarlı şekilde uygulanması gereken güvenlik kontrolleri ile kimlik doğrulama gücünün tanımlandığı doğrulanmalıdır.", + "parent": "V6.1" + }, + { + "bom-ref": "V6.2", + "identifier": "V6.2", + "title": "Parola Güvenliği", + "parent": "V6" + }, + { + "bom-ref": "V6.2.1", + "identifier": "V6.2.1", + "text": "Kullanıcı tarafından belirlenen parolaların en az 8 karakter uzunluğunda olması sağlanmalı, ancak 15 karakter ve üzeri uzunlukta parolalar olmaları şiddetle tavsiye edilir.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.2", + "identifier": "V6.2.2", + "text": "Kullanıcıların parolalarını değiştirebilmeleri sağlanmalıdır.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.3", + "identifier": "V6.2.3", + "text": "Parola değiştirme işlevinin hem mevcut hem de yeni parolayı gerektirdiği doğrulanmalıdır.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.4", + "identifier": "V6.2.4", + "text": "Kayıt veya parola değişimi sırasında girilen parolaların, uygulamanın parola politikasına (örneğin minimum uzunluk) uyan ilk 3000 yaygın parolaya karşı kontrol edildiği doğrulanmalıdır.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.5", + "identifier": "V6.2.5", + "text": "Her tür karakterin kullanılmasına izin verildiği ve büyük/küçük harf, sayı veya özel karakter şartlarının zorunlu tutulmadığı doğrulanmalıdır.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.6", + "identifier": "V6.2.6", + "text": "Parola giriş alanlarının, girdiyi maskelemek için \"type=password\" kullandığı doğrulanmalıdır. Uygulamalar, kullanıcının tüm maskelenmiş parolayı ya da son girilen karakteri geçici olarak görüntülemesine izin verebilir.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.7", + "identifier": "V6.2.7", + "text": "\"Yapıştır\" özelliğinin, tarayıcı parola yardımcılarının ve harici parola yöneticilerinin kullanımına izin verildiği doğrulanmalıdır.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.8", + "identifier": "V6.2.8", + "text": "Uygulamanın, kullanıcıdan aldığı parolayı herhangi bir şekilde değiştirmeden, örneğin kesmeden veya harf büyüklüğünü değiştirmeden, tam olarak doğruladığı teyit edilmelidir.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.9", + "identifier": "V6.2.9", + "text": "En az 64 karakter uzunluğundaki parolalara izin verildiği doğrulanmalıdır.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.10", + "identifier": "V6.2.10", + "text": "Kullanıcının parolasının, yalnızca ele geçirildiği tespit edildiğinde veya kullanıcı tarafından yenilendiğinde geçerliliğini yitirdiği doğrulanmalıdır. Uygulama, belirli aralıklarla parola yenilenmesini zorunlu kılmamalıdır.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.11", + "identifier": "V6.2.11", + "text": "Tahmin edilmesi kolay parolaların oluşturulmasını önlemek amacıyla, bağlama özgü kelimelerin yer aldığı belgelenmiş listenin parola doğrulamada kullanıldığı teyit edilmelidir.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.12", + "identifier": "V6.2.12", + "text": "Kayıt veya parola değişikliği sırasında girilen parolaların, ele geçirilmiş parolalar listesine karşı kontrol edildiği doğrulanmalıdır.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.3", + "identifier": "V6.3", + "title": "Genel Kimlik Doğrulama Güvenliği", + "parent": "V6" + }, + { + "bom-ref": "V6.3.1", + "identifier": "V6.3.1", + "text": "Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırıları gibi saldırıları önlemeye yönelik kontrollerin, uygulamanın güvenlik dokümantasyonuna göre uygulandığı doğrulanmalıdır.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.2", + "identifier": "V6.3.2", + "text": "\"root\", \"admin\" veya \"sa\" gibi varsayılan kullanıcı hesaplarının uygulamada yer almadığı veya devre dışı bırakıldığı doğrulanmalıdır.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.3", + "identifier": "V6.3.3", + "text": "Uygulamaya erişim için ya çok faktörlü bir kimlik doğrulama mekanizması ya da tek faktörlü mekanizmaların kombinasyonu kullanılmalıdır. Seviye 3 için, bu faktörlerden biri, oltalama saldırılarına karşı direnç sağlayan ve kimlik doğrulama niyetini bir kullanıcı etkileşimi (örneğin FIDO donanım anahtarında bir düğmeye basma veya mobil telefonda bir onay) gerektirerek doğrulayan donanım tabanlı bir kimlik doğrulayıcı olmalıdır. Bu gereksinimdeki herhangi bir esneklik için, gerekçesi belgelenmiş ve riskleri azaltıcı kapsamlı kontroller içeren bir plan gereklidir.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.4", + "identifier": "V6.3.4", + "text": "Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, belgelendirilmemiş bir yol bulunmadığı ve tüm yollar için güvenlik kontrolleri ile kimlik doğrulama gücünün tutarlı şekilde uygulandığı doğrulanmalıdır.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.5", + "identifier": "V6.3.5", + "text": "Başarılı veya başarısız şüpheli kimlik doğrulama girişimlerinin kullanıcıya bildirildiği doğrulanmalıdır. Bu, olağandışı bir konum veya istemciden gelen girişimler, yalnızca bir faktörle yapılan kısmen başarılı doğrulamalar, uzun süreli inaktiflik sonrası yapılan girişimler veya birçok başarısız denemeden sonraki başarılı girişimler gibi durumları içerebilir.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.6", + "identifier": "V6.3.6", + "text": "E-postanın, tek faktörlü ya da çok faktörlü kimlik doğrulama mekanizması olarak kullanılmadığı doğrulanmalıdır.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.7", + "identifier": "V6.3.7", + "text": "Kimlik doğrulama detaylarında yapılan güncellemeler sonrasında (örneğin kimlik bilgisi sıfırlama, kullanıcı adı veya e-posta adresi değişiklikleri), kullanıcıların bilgilendirildiği doğrulanmalıdır.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.8", + "identifier": "V6.3.8", + "text": "Başarısız kimlik doğrulama girişimlerinden, geçerli kullanıcıların hata mesajları, HTTP yanıt kodları veya farklı yanıt süreleri gibi sonuçlara dayanarak tespit edilemediği doğrulanmalıdır. Bu koruma, kayıt ve \"parolamı unuttum\" işlevselliğinde de geçerli olmalıdır.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.4", + "identifier": "V6.4", + "title": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", + "parent": "V6" + }, + { + "bom-ref": "V6.4.1", + "identifier": "V6.4.1", + "text": "Sistem tarafından oluşturulan ilk parolaların veya etkinleştirme kodlarının güvenli bir şekilde rastgele üretildiği, mevcut parola politikasına uygun olduğu, kısa bir süre içinde veya ilk kullanım sonrasında geçerliliğini yitirdiği doğrulanmalıdır. Bu başlangıç sırları uzun vadeli parola olarak kullanılmasına izin verilmemelidir.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.4.2", + "identifier": "V6.4.2", + "text": "Parola ipuçlarının veya \"gizli sorular\" olarak bilinen, bilgiye dayalı kimlik doğrulama mekanizmalarının mevcut olmadığı doğrulanmalıdır.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.4.3", + "identifier": "V6.4.3", + "text": "Unutulmuş parolanın sıfırlanması için, etkin olan çok faktörlü kimlik doğrulama mekanizmalarını atlamayan güvenli bir sürecin uygulandığı doğrulanmalıdır.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.4.4", + "identifier": "V6.4.4", + "text": "Çok faktörlü kimlik doğrulama faktörlerinden biri kaybolursa, kayıt sırasında uygulanan kimlik kanıtlama seviyesiyle aynı seviyede kimlik doğrulama yapıldığı doğrulanmalıdır.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.4.5", + "identifier": "V6.4.5", + "text": "Süresi dolacak kimlik doğrulama mekanizmalarının yenilenmesine ilişkin talimatların, süresi dolmadan önce tamamlanacak şekilde yeterli sürede gönderildiği ve gerekiyorsa otomatik hatırlatıcıların yapılandırıldığı doğrulanmalıdır.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.4.6", + "identifier": "V6.4.6", + "text": "Yönetici yetkisi olan kullanıcıların, kullanıcının parola sıfırlama sürecini başlatabildiği ancak kullanıcının yeni parolasını belirleyemediği veya değiştiremediği doğrulanmalıdır. Bu, yönetici yetkisi olan kullanıcıların, kullanıcı parolasını bilmesini engeller.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.5", + "identifier": "V6.5", + "title": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "parent": "V6" + }, + { + "bom-ref": "V6.5.1", + "identifier": "V6.5.1", + "text": "Arama sırları, bant dışı kimlik doğrulama istekleri veya kodları ve zamana dayalı tek kullanımlık parolaların (TOTP) yalnızca bir kez kullanılabildiği doğrulanmalıdır.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.2", + "identifier": "V6.5.2", + "text": "Uygulamanın backend tarafında saklanırken, 112 bitten az entropiye sahip (örneğin 19 rastgele harf-rakam karakteri veya 34 rastgele rakam) arama sırlarının, 32-bit rastgele bir salt içeren onaylı bir parola saklama algoritmasıyla hash’lendiği doğrulanmalıdır. Gizli bilginin entropisi 112 bit veya daha fazlaysa standart bir hash fonksiyonu kullanılabilir.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.3", + "identifier": "V6.5.3", + "text": "Arama sırları, bant dışı kimlik doğrulama kodları ve zamana dayalı tek kullanımlık parola seed'lerinin, öngörülebilir değerlerden kaçınmak için Kriptografik Olarak Güvenli Sözde Rastgele Sayı Üreteci (CSPRNG) ile oluşturulduğu doğrulanmalıdır.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.4", + "identifier": "V6.5.4", + "text": "Arama sırlarının ve bant dışı kimlik doğrulama kodlarının en az 20 bit entropiye (genellikle 4 rastgele harf-rakam karakteri veya 6 rastgele rakam) sahip olduğu doğrulanmalıdır.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.5", + "identifier": "V6.5.5", + "text": "Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının ve zamana dayalı tek kullanımlık parolaların (TOTP) belirli bir ömre sahip olduğu doğrulanmalıdır. Bant dışı istekler en fazla 10 dakika, TOTP’ler ise en fazla 30 saniye geçerli olmalıdır.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.6", + "identifier": "V6.5.6", + "text": "Herhangi bir kimlik doğrulama faktörünün (fiziksel cihazlar dahil) çalınması veya kaybı durumunda iptal edilebildiği doğrulanmalıdır.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.7", + "identifier": "V6.5.7", + "text": "Biyometrik kimlik doğrulama mekanizmalarının yalnızca ikincil faktör olarak, “sahip olduğunuz bir şey” veya “bildiğiniz bir şey” ile birlikte kullanıldığı doğrulanmalıdır.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.8", + "identifier": "V6.5.8", + "text": "Zamana dayalı tek kullanımlık parolaların (TOTP) doğrulamasının, güvenilir bir hizmetten alınan zaman kaynağına dayanarak yapıldığı ve güvenilir olmayan veya istemci tarafından sağlanan zaman kaynağına dayanmadığı doğrulanmalıdır.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.6", + "identifier": "V6.6", + "title": "Bant Dışı Kimlik Doğrulama Mekanizmaları", + "parent": "V6" + }, + { + "bom-ref": "V6.6.1", + "identifier": "V6.6.1", + "text": "Tek kullanımlık parolaların (OTP) telefon veya SMS ile Public Switched Telephone Network (PSTN) üzerinden iletildiği kimlik doğrulama mekanizmalarının, yalnızca telefon numarası önceden doğrulanmışsa, alternatif daha güçlü yöntemler (örneğin TOTP) de sunuluyorsa ve kullanıcıya güvenlik riskleri hakkında bilgi veriliyorsa sunulduğu doğrulanmalıdır. Seviye 3 uygulamalar için telefon ve SMS seçenekleri sunulmamalıdır.", + "parent": "V6.6" + }, + { + "bom-ref": "V6.6.2", + "identifier": "V6.6.2", + "text": "Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının, oluşturuldukları özgün kimlik doğrulama isteğiyle bağlantılı olduğu ve daha önceki ya da sonraki bir istek için kullanılamadığı doğrulanmalıdır.", + "parent": "V6.6" + }, + { + "bom-ref": "V6.6.3", + "identifier": "V6.6.3", + "text": "Kod tabanlı bant dışı kimlik doğrulama mekanizmalarının, oran sınırlaması ile kaba kuvvet saldırılarına karşı korunduğu doğrulanmalıdır. En az 64 bit entropiye sahip kodlar kullanılması da değerlendirilmelidir.", + "parent": "V6.6" + }, + { + "bom-ref": "V6.6.4", + "identifier": "V6.6.4", + "text": "Çok faktörlü kimlik doğrulama için push bildirimleri kullanılıyorsa, push bombing saldırılarına karşı oran sınırlamasının kullanıldığı doğrulanmalıdır. “Numara eşleştirme” de bu riski azaltabilir.", + "parent": "V6.6" + }, + { + "bom-ref": "V6.7", + "identifier": "V6.7", + "title": "Kriptografik Kimlik Doğrulama Mekanizması", + "parent": "V6" + }, + { + "bom-ref": "V6.7.1", + "identifier": "V6.7.1", + "text": "Kriptografik kimlik doğrulama beyanlarını doğrulamak için kullanılan sertifikaların, değiştirilmeye karşı korumalı şekilde saklandığı doğrulanmalıdır.", + "parent": "V6.7" + }, + { + "bom-ref": "V6.7.2", + "identifier": "V6.7.2", + "text": "Challenge nonce değerinin en az 64 bit uzunluğunda olduğu ve istatistiksel olarak benzersiz ya da cihazın ömrü boyunca benzersiz olduğu doğrulanmalıdır.", + "parent": "V6.7" + }, + { + "bom-ref": "V6.8", + "identifier": "V6.8", + "title": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", + "parent": "V6" + }, + { + "bom-ref": "V6.8.1", + "identifier": "V6.8.1", + "text": "Uygulama birden fazla kimlik sağlayıcıyı (IdP) destekliyorsa, başka bir desteklenen kimlik sağlayıcı aracılığıyla (örneğin aynı kullanıcı tanımlayıcısını kullanarak) kullanıcının kimliğinin taklit edilemediği doğrulanmalıdır. Standart önlem, uygulamanın kullanıcıyı IdP kimliği (bir ad alanı işlevi görür) ve IdP içindeki kullanıcı kimliğinin birleşimiyle kaydetmesi ve tanımlamasıdır.", + "parent": "V6.8" + }, + { + "bom-ref": "V6.8.2", + "identifier": "V6.8.2", + "text": "Kimlik doğrulama beyanları üzerindeki dijital imzaların (örneğin JWT veya SAML beyanları) varlığı ve bütünlüğünün her zaman doğrulandığı ve imzasız veya geçersiz imzalı beyanların reddedildiği doğrulanmalıdır.", + "parent": "V6.8" + }, + { + "bom-ref": "V6.8.3", + "identifier": "V6.8.3", + "text": "SAML beyanlarının benzersiz biçimde işlendiği ve yalnızca geçerlilik süresi içinde bir kez kullanıldığı, tekrar oynatma (replay) saldırılarını önlemek amacıyla doğrulanmalıdır.", + "parent": "V6.8" + }, + { + "bom-ref": "V6.8.4", + "identifier": "V6.8.4", + "text": "Uygulama ayrı bir Kimlik Sağlayıcı (IdP) kullanıyorsa ve belirli işlemler için belirli kimlik doğrulama gücü, yöntemleri veya zaman bilgisi bekliyorsa, uygulamanın bu bilgileri IdP tarafından döndürülen veriler üzerinden doğruladığı teyit edilmelidir. Örneğin OIDC kullanılıyorsa, bu durum ID Token üzerindeki 'acr', 'amr' ve 'auth_time' gibi claim’lerin (varsa) doğrulanması ile sağlanabilir. Eğer IdP bu bilgileri sağlamıyorsa, uygulamanın asgari kimlik doğrulama gücünün kullanıldığını varsayan (örneğin yalnızca kullanıcı adı ve parola ile tek faktörlü doğrulama) belgelenmiş bir yedek yaklaşımı olmalıdır.", + "parent": "V6.8" + }, + { + "bom-ref": "V7", + "identifier": "V7", + "title": "Oturum Yönetimi" + }, + { + "bom-ref": "V7.1", + "identifier": "V7.1", + "title": "Oturum Yönetim Dokümantasyonu", + "parent": "V7" + }, + { + "bom-ref": "V7.1.1", + "identifier": "V7.1.1", + "text": "Kullanıcının oturum inaktivite zaman aşımı süresi ve mutlak maksimum oturum süresinin belgelendiği, diğer kontrollerle birlikte uygun olduğu ve NIST SP 800-63B yeniden kimlik doğrulama gereksinimlerinden herhangi bir sapma varsa gerekçesinin belgede yer aldığı doğrulanmalıdır.", + "parent": "V7.1" + }, + { + "bom-ref": "V7.1.2", + "identifier": "V7.1.2", + "text": "Belgede bir hesap için kaç adet eşzamanlı (paralel) oturuma izin verildiği ile birlikte, maksimum aktif oturum sayısına ulaşıldığında uygulanacak davranış ve işlemlerin tanımlandığı doğrulanmalıdır.", + "parent": "V7.1" + }, + { + "bom-ref": "V7.1.3", + "identifier": "V7.1.3", + "text": "Birleşik kimlik yönetim ekosisteminin bir parçası olarak kullanıcı oturumu oluşturan ve yöneten tüm sistemlerin, oturum ömrü, sonlandırma ve yeniden kimlik doğrulama gerektiren diğer koşulların nasıl koordine edildiğini açıklayan kontrollerle birlikte belgede yer aldığı doğrulanmalıdır.", + "parent": "V7.1" + }, + { + "bom-ref": "V7.2", + "identifier": "V7.2", + "title": "Temel Oturum Yönetimi Güvenliği", + "parent": "V7" + }, + { + "bom-ref": "V7.2.1", + "identifier": "V7.2.1", + "text": "Uygulamanın tüm oturum token'ı doğrulama işlemlerini güvenilir bir backend servisi aracılığıyla gerçekleştirdiği doğrulanmalıdır.", + "parent": "V7.2" + }, + { + "bom-ref": "V7.2.2", + "identifier": "V7.2.2", + "text": "Uygulamanın, statik API gizli anahtarları veya sabit değerler yerine, oturum yönetimi için dinamik olarak oluşturulan kendi kendine yeterli veya referans token'ları kullandığı doğrulanmalıdır.", + "parent": "V7.2" + }, + { + "bom-ref": "V7.2.3", + "identifier": "V7.2.3", + "text": "Uygulama kullanıcı oturumlarını temsil etmek için referans token'ları kullanıyorsa, bu token'ların benzersiz olduğu, kriptografik olarak güvenli bir sözde rastgele sayı üreteci (CSPRNG) kullanılarak üretildiği ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır.", + "parent": "V7.2" + }, + { + "bom-ref": "V7.2.4", + "identifier": "V7.2.4", + "text": "Uygulamanın, kullanıcı kimlik doğrulaması (yeniden kimlik doğrulama dahil) sırasında yeni bir oturum token'ı oluşturduğu ve mevcut oturum token'ını sonlandırdığı doğrulanmalıdır.", + "parent": "V7.2" + }, + { + "bom-ref": "V7.3", + "identifier": "V7.3", + "title": "Oturum Zaman Aşımı", + "parent": "V7" + }, + { + "bom-ref": "V7.3.1", + "identifier": "V7.3.1", + "text": "Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde bir hareketsizlik zaman aşımı bulunduğu doğrulanmalıdır.", + "parent": "V7.3" + }, + { + "bom-ref": "V7.3.2", + "identifier": "V7.3.2", + "text": "Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde mutlak bir maksimum oturum süresi bulunduğu doğrulanmalıdır.", + "parent": "V7.3" + }, + { + "bom-ref": "V7.4", + "identifier": "V7.4", + "title": "Oturum Sonlandırma", + "parent": "V7" + }, + { + "bom-ref": "V7.4.1", + "identifier": "V7.4.1", + "text": "Oturum sonlandırma tetiklendiğinde (örneğin, çıkış yapıldığında veya süre dolduğunda), uygulamanın oturumun daha fazla kullanılmasına izin vermediği doğrulanmalıdır. Referans token'lar veya durum bilgili oturumlar için bu, oturum verilerinin uygulama arka ucunda geçersiz kılınması anlamına gelir. Kapsamlı token kullanan uygulamaların; sonlandırılmış token listesi tutmak, kullanıcıya özel tarih ve saatten önce oluşturulan token'ları reddetmek veya kullanıcıya özel imzalama anahtarını yenilemek gibi bir çözüm uygulaması gerekir.", + "parent": "V7.4" + }, + { + "bom-ref": "V7.4.2", + "identifier": "V7.4.2", + "text": "Bir kullanıcı hesabı devre dışı bırakıldığında veya silindiğinde (örneğin bir çalışanın şirketten ayrılması), uygulamanın tüm aktif oturumları sonlandırdığı doğrulanmalıdır.", + "parent": "V7.4" + }, + { + "bom-ref": "V7.4.3", + "identifier": "V7.4.3", + "text": "Herhangi bir kimlik doğrulama faktörünün başarılı bir şekilde değiştirilmesi veya kaldırılmasından (şifre sıfırlama veya kurtarma yoluyla yapılan değişiklikler dahil ve varsa MFA ayarları güncellemeleri dahil) sonra, uygulamanın diğer tüm aktif oturumları sonlandırma seçeneği sunduğu doğrulanmalıdır.", + "parent": "V7.4" + }, + { + "bom-ref": "V7.4.4", + "identifier": "V7.4.4", + "text": "Kimlik doğrulama gerektiren tüm sayfalarda kolay erişilebilir ve görünür bir çıkış yap (logout) işlevi bulunduğu doğrulanmalıdır.", + "parent": "V7.4" + }, + { + "bom-ref": "V7.4.5", + "identifier": "V7.4.5", + "text": "Uygulama yöneticilerinin, bireysel bir kullanıcının veya tüm kullanıcıların aktif oturumlarını sonlandırabilme yetkisine sahip olduğu doğrulanmalıdır.", + "parent": "V7.4" + }, + { + "bom-ref": "V7.5", + "identifier": "V7.5", + "title": "Oturum Kötüye Kullanımına Karşı Savunmalar", + "parent": "V7" + }, + { + "bom-ref": "V7.5.1", + "identifier": "V7.5.1", + "text": "E-posta adresi, telefon numarası, MFA yapılandırması veya hesap kurtarmada kullanılan diğer bilgiler gibi kimlik doğrulamayı etkileyebilecek hassas hesap özniteliklerinde değişiklik yapılmadan önce uygulamanın tam yeniden kimlik doğrulama gerektirdiği doğrulanmalıdır.", + "parent": "V7.5" + }, + { + "bom-ref": "V7.5.2", + "identifier": "V7.5.2", + "text": "Kullanıcıların, (en az bir faktörle yeniden kimlik doğrulama yaptıktan sonra) mevcut tüm aktif oturumları görüntüleyebilmesi ve sonlandırabilmesinin mümkün olduğu doğrulanmalıdır.", + "parent": "V7.5" + }, + { + "bom-ref": "V7.5.3", + "identifier": "V7.5.3", + "text": "Uygulamanın, son derece hassas işlemler veya operasyonlar gerçekleştirilmeden önce en az bir faktörle ek kimlik doğrulaması veya ikincil bir doğrulama gerektirdiği doğrulanmalıdır.", + "parent": "V7.5" + }, + { + "bom-ref": "V7.6", + "identifier": "V7.6", + "title": "Birleşik Yeniden Kimlik Doğrulama", + "parent": "V7" + }, + { + "bom-ref": "V7.6.1", + "identifier": "V7.6.1", + "text": "Güvenen Taraf (RP) ile Kimlik Sağlayıcı (IdP) arasındaki oturum süresi ve oturum sonlandırma davranışlarının belgelenmiş olduğu ve, örneğin IdP kimlik doğrulama olayları arasında maksimum süreye ulaşıldığında yeniden kimlik doğrulamanın gerekli kılındığı doğrulanmalıdır.", + "parent": "V7.6" + }, + { + "bom-ref": "V7.6.2", + "identifier": "V7.6.2", + "text": "Yeni bir oturum oluşturulmasının, kullanıcı onayı veya açık bir eylem gerektirdiği; kullanıcı etkileşimi olmaksızın yeni uygulama oturumlarının oluşturulmasının önlendiği doğrulanmalıdır.", + "parent": "V7.6" + }, + { + "bom-ref": "V8", + "identifier": "V8", + "title": "Yetkilendirme" + }, + { + "bom-ref": "V8.1", + "identifier": "V8.1", + "title": "Yetkilendirme Dokümantasyonu", + "parent": "V8" + }, + { + "bom-ref": "V8.1.1", + "identifier": "V8.1.1", + "text": "Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak işlev düzeyinde ve veriye özel erişim kısıtlamaları için kuralları tanımladığı doğrulanmalıdır.", + "parent": "V8.1" + }, + { + "bom-ref": "V8.1.2", + "identifier": "V8.1.2", + "text": "Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak alan (field) düzeyinde erişim kısıtlamaları (hem okuma hem yazma) için kuralları tanımladığı doğrulanmalıdır. Bu kuralların, ilgili veri nesnesinin durum veya statü gibi diğer özniteliklerine bağlı olabileceği unutulmamalıdır.", + "parent": "V8.1" + }, + { + "bom-ref": "V8.1.3", + "identifier": "V8.1.3", + "text": "Uygulamanın dokümantasyonunun, kimlik doğrulama ve yetkilendirme ile ilgili güvenlik kararlarının alınmasında kullanılan çevresel ve bağlamsal öznitelikleri (günün saati, kullanıcı konumu, IP adresi veya cihaz gibi) tanımladığı doğrulanmalıdır.", + "parent": "V8.1" + }, + { + "bom-ref": "V8.1.4", + "identifier": "V8.1.4", + "text": "Kimlik doğrulama ve yetkilendirme dokümantasyonunun; işlev düzeyinde, veriye özel ve alan düzeyinde yetkilendirmenin yanı sıra çevresel ve bağlamsal faktörlerin karar almada nasıl kullanıldığını tanımladığı doğrulanmalıdır. Bu, değerlendirilen öznitelikleri, risk eşiklerini ve alınan aksiyonları (ör. izin ver, doğrulama iste, reddet, step-up kimlik doğrulama) içermelidir.", + "parent": "V8.1" + }, + { + "bom-ref": "V8.2", + "identifier": "V8.2", + "title": "Genel Yetkilendirme Tasarımı", + "parent": "V8" + }, + { + "bom-ref": "V8.2.1", + "identifier": "V8.2.1", + "text": "Uygulamanın, işlev düzeyindeki erişimin yalnızca açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır.", + "parent": "V8.2" + }, + { + "bom-ref": "V8.2.2", + "identifier": "V8.2.2", + "text": "Uygulamanın, veriye özel erişimin yalnızca belirli veri öğelerine açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, doğrudan nesne referansı güvenlik açıkları (IDOR) ve bozuk nesne düzeyinde yetkilendirme (BOLA) risklerini azaltır.", + "parent": "V8.2" + }, + { + "bom-ref": "V8.2.3", + "identifier": "V8.2.3", + "text": "Uygulamanın, alan (field) düzeyindeki erişimin yalnızca belirli alanlara açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, bozuk nesne özelliği düzeyinde yetkilendirme (BOPLA) risklerini azaltır.", + "parent": "V8.2" + }, + { + "bom-ref": "V8.2.4", + "identifier": "V8.2.4", + "text": "Tüketicinin çevresel ve bağlamsal özniteliklerine (ör. günün saati, konum, IP adresi veya cihaz) dayalı uyarlanabilir güvenlik kontrollerinin, uygulama dokümantasyonunda tanımlandığı şekilde, kimlik doğrulama ve yetkilendirme kararları için uygulandığı doğrulanmalıdır. Bu kontroller, tüketici yeni bir oturum başlatmaya çalışırken ve mevcut bir oturum sırasında uygulanmalıdır.", + "parent": "V8.2" + }, + { + "bom-ref": "V8.3", + "identifier": "V8.3", + "title": "İşlem Düzeyinde Yetkilendirme", + "parent": "V8" + }, + { + "bom-ref": "V8.3.1", + "identifier": "V8.3.1", + "text": "Uygulamanın yetkilendirme kurallarını güvenilir bir servis katmanında uyguladığı ve istemci taraflı JavaScript gibi güvenilmeyen tüketiciler tarafından değiştirilebilecek kontrollerle yetinmediği doğrulanmalıdır.", + "parent": "V8.3" + }, + { + "bom-ref": "V8.3.2", + "identifier": "V8.3.2", + "text": "Yetkilendirme kararlarının temelini oluşturan değerlerdeki değişikliklerin hemen uygulandığı doğrulanmalıdır. Değişikliklerin anında uygulanamadığı durumlarda (örneğin self-contained token içindeki verilere güveniliyorsa), tüketici artık yetkili olmadığı hâlde bir işlem gerçekleştirdiğinde uyarı verecek ve değişikliği geri alacak önlemler uygulanmalıdır. Bu alternatifin bilgi sızıntısını önlemeyeceği unutulmamalıdır.", + "parent": "V8.3" + }, + { + "bom-ref": "V8.3.3", + "identifier": "V8.3.3", + "text": "Bir nesneye erişimin, herhangi bir aracı veya onun adına hareket eden bir servis yerine yalnızca erişimi başlatan öznenin (ör. tüketici) izinlerine dayandığı doğrulanmalıdır. Örneğin, bir tüketici kimlik doğrulama için bir self-contained token kullanarak bir web servis çağırırsa ve bu servis başka bir servisten veri talep ederse, ikinci servis izin kararlarını verirken birinci servisin makine-makine token'ı yerine tüketicinin token'ını kullanmalıdır.", + "parent": "V8.3" + }, + { + "bom-ref": "V8.4", + "identifier": "V8.4", + "title": "Diğer Yetkilendirme Hususları", + "parent": "V8" + }, + { + "bom-ref": "V8.4.1", + "identifier": "V8.4.1", + "text": "Multi-tenant uygulamaların, tüketici işlemlerinin izinli olmadıkları tenant'lar üzerinde asla etkili olmamasını sağlamak için tenant'lar arası kontroller kullandığı doğrulanmalıdır.", + "parent": "V8.4" + }, + { + "bom-ref": "V8.4.2", + "identifier": "V8.4.2", + "text": "Yönetici arayüzlerine erişimin, sürekli tüketici kimlik doğrulaması, cihaz güvenlik durumu değerlendirmesi ve bağlamsal risk analizi dahil olmak üzere çok katmanlı güvenlik içerdiği doğrulanmalıdır. Yetkilendirme için yalnızca ağ konumu veya güvenilir uç noktalar yeterli olmamalıdır; ancak bu tür faktörler yetkisiz erişim olasılığını azaltabilir.", + "parent": "V8.4" + }, + { + "bom-ref": "V9", + "identifier": "V9", + "title": "Kendi İçinde Taşıyıcı Token (Self-contained Token)" + }, + { + "bom-ref": "V9.1", + "identifier": "V9.1", + "title": "Token Kaynağı ve Bütünlüğü", + "parent": "V9" + }, + { + "bom-ref": "V9.1.1", + "identifier": "V9.1.1", + "text": "Self-contained token'ların içerikleri kabul edilmeden önce, oynama (tampering) saldırılarına karşı dijital imza veya MAC ile doğrulama yapıldığı doğrulanmalıdır.", + "parent": "V9.1" + }, + { + "bom-ref": "V9.1.2", + "identifier": "V9.1.2", + "text": "Belirli bir bağlam için yalnızca bir allowlist üzerinde bulunan algoritmaların self-contained token oluşturmak ve doğrulamak için kullanılabildiği doğrulanmalıdır. Bu allowlist, yalnızca simetrik ya da yalnızca asimetrik algoritmaları içermeli ve kesinlikle 'None' algoritmasını içermemelidir. Hem simetrik hem de asimetrik algoritmalar desteklenmek zorundaysa, anahtar karışıklığını (key confusion) önlemek için ek kontroller uygulanmalıdır.", + "parent": "V9.1" + }, + { + "bom-ref": "V9.1.3", + "identifier": "V9.1.3", + "text": "Self-contained token'ları doğrulamak için kullanılan anahtar malzemesinin, token issuer için önceden yapılandırılmış güvenilir kaynaklardan alındığı doğrulanmalıdır. Bu, saldırganların güvenilmeyen kaynak ve anahtarları belirtmesini engeller. JWT ve diğer JWS yapılarında 'jku', 'x5u' ve 'jwk' gibi header'lar güvenilir kaynaklardan oluşan bir allowlist'e göre doğrulanmalıdır.", + "parent": "V9.1" + }, + { + "bom-ref": "V9.2", + "identifier": "V9.2", + "title": "Token İçeriği", + "parent": "V9" + }, + { + "bom-ref": "V9.2.1", + "identifier": "V9.2.1", + "text": "Token verisinde bir geçerlilik zaman aralığı (validity time span) varsa, yalnızca doğrulama zamanı bu zaman aralığı içerisindeyse token ve içeriği kabul edilmelidir. Örneğin, JWT'ler için 'nbf' ve 'exp' claim'leri doğrulanmalıdır.", + "parent": "V9.2" + }, + { + "bom-ref": "V9.2.2", + "identifier": "V9.2.2", + "text": "Token'ı alan hizmetin, token içeriğini kabul etmeden önce bu token'ın doğru türde olduğunu ve sunulma amacına uygun olduğunu doğruladığı teyit edilmelidir. Örneğin, yalnızca erişim token'ları yetkilendirme kararları için, yalnızca ID Token'lar kullanıcı kimlik doğrulamasını kanıtlamak için kullanılabilir.", + "parent": "V9.2" + }, + { + "bom-ref": "V9.2.3", + "identifier": "V9.2.3", + "text": "Hizmetin yalnızca kendisiyle kullanılması amaçlanan (audience) token'ları kabul ettiği doğrulanmalıdır. JWT'lerde bu, 'aud' claim'inin hizmet içinde tanımlı bir allowlist ile doğrulanması yoluyla sağlanabilir.", + "parent": "V9.2" + }, + { + "bom-ref": "V9.2.4", + "identifier": "V9.2.4", + "text": "Eğer bir token issuer, farklı audience'lara token oluşturmak için aynı private key'i kullanıyorsa, oluşturulan token'ların hedef audience'ları benzersiz şekilde tanımlayan bir audience kısıtlaması içerdiği doğrulanmalıdır. Bu, bir token'ın farklı bir audience ile yeniden kullanılmasını önler. Audience tanımlayıcısı dinamik olarak sağlanıyorsa, token issuer bu audience'ları doğrulamalı ve audience taklitlerinin (impersonation) önüne geçmelidir.", + "parent": "V9.2" + }, + { + "bom-ref": "V10", + "identifier": "V10", + "title": "OAuth ve OIDC" + }, + { + "bom-ref": "V10.1", + "identifier": "V10.1", + "title": "Genel OAuth ve OIDC Güvenliği", + "parent": "V10" + }, + { + "bom-ref": "V10.1.1", + "identifier": "V10.1.1", + "text": "Token'ların yalnızca kesinlikle ihtiyaç duyan bileşenlere gönderildiği doğrulanmalıdır. Örneğin, tarayıcı tabanlı JavaScript uygulamaları için bir backend-for-frontend modeli kullanıldığında, access ve refresh token'lara yalnızca backend'in erişebilmesi gerekir.", + "parent": "V10.1" + }, + { + "bom-ref": "V10.1.2", + "identifier": "V10.1.2", + "text": "Authorization server'dan gelen değerler (örneğin authorization code veya ID Token gibi) yalnızca aynı user agent oturumu ve işlemi tarafından başlatılmış bir yetkilendirme akışının sonucuysa kabul edildiği doğrulanmalıdır. Bu, client tarafından oluşturulan secret’ların 'proof key for code exchange' (PKCE) ‘code_verifier’, ‘state’ veya OIDC ‘nonce’ gibi tahmin edilemez, işleme özgü ve hem client’a hem de işlem başlatılan user agent oturumuna güvenli bir şekilde bağlı olmasını gerektirir.", + "parent": "V10.1" + }, + { + "bom-ref": "V10.2", + "identifier": "V10.2", + "title": "OAuth İstemcisi", + "parent": "V10" + }, + { + "bom-ref": "V10.2.1", + "identifier": "V10.2.1", + "text": "Code flow kullanılıyorsa, OAuth client’ın token taleplerini tetikleyen CSRF saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Bu genellikle PKCE kullanılarak veya authorization isteğinde gönderilen ‘state’ parametresinin kontrolü ile sağlanır.", + "parent": "V10.2" + }, + { + "bom-ref": "V10.2.2", + "identifier": "V10.2.2", + "text": "OAuth istemcisi birden fazla AS ile etkileşime girebiliyorsa, mix-up saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Örneğin, authorization server’ın 'iss' parametresini döndürmesi zorunlu kılınabilir ve bu parametrenin hem authorization yanıtında hem de token yanıtında doğrulanması gerekir.", + "parent": "V10.2" + }, + { + "bom-ref": "V10.2.3", + "identifier": "V10.2.3", + "text": "OAuth istemcisinin authorization server’a yaptığı taleplerde yalnızca gerekli scope’ları (veya diğer yetkilendirme parametrelerini) talep ettiği doğrulanmalıdır.", + "parent": "V10.2" + }, + { + "bom-ref": "V10.3", + "identifier": "V10.3", + "title": "OAuth Kaynak Sunucusu (RS)", + "parent": "V10" + }, + { + "bom-ref": "V10.3.1", + "identifier": "V10.3.1", + "text": "RS'nin yalnızca bu servisle kullanılmak üzere tasarlanmış access token’ları kabul ettiği doğrulanmalıdır (audience kontrolü). Audience bilgisi yapılandırılmış token’larda (örneğin JWT içindeki ‘aud’ claim’i) yer alabilir veya token introspection endpoint aracılığıyla kontrol edilebilir.", + "parent": "V10.3" + }, + { + "bom-ref": "V10.3.2", + "identifier": "V10.3.2", + "text": "RS'nin, access token’dan gelen claim’lere dayanarak yetki devri tanımına uygun şekilde yetkilendirme kararları uyguladığı doğrulanmalıdır. ‘sub’, ‘scope’ ve ‘authorization_details’ gibi claim’ler varsa, bu kararın parçası olmalıdır.", + "parent": "V10.3" + }, + { + "bom-ref": "V10.3.3", + "identifier": "V10.3.3", + "text": "Erişim kontrolü kararında, access token’dan (JWT veya ilgili token introspection yanıtı) benzersiz bir kullanıcının tanımlanması gerekiyorsa, RS'nin başka kullanıcılara devredilemeyecek claim’ler ile kullanıcıyı tanımladığı doğrulanmalıdır. Genellikle bu, ‘iss’ ve ‘sub’ claim’lerinin birlikte kullanılması anlamına gelir.", + "parent": "V10.3" + }, + { + "bom-ref": "V10.3.4", + "identifier": "V10.3.4", + "text": "RS'nin belirli bir kimlik doğrulama gücü, yöntemi veya güncelliği (recentness) gerektirmesi durumunda, sunulan access token’ın bu kısıtlamaları karşıladığını doğruladığı, örneğin, OIDC ‘acr’, ‘amr’ ve ‘auth_time’ claim’leri kullanılarak doğrulanmalıdır. ", + "parent": "V10.3" + }, + { + "bom-ref": "V10.3.5", + "identifier": "V10.3.5", + "text": "RS'nin, (yetkisiz taraflarca) çalınmış veya tekrar edilen access token’ların kullanımını önlemek için sender-constrained access token’lar kullandığı doğrulanmalıdır. Bu, OAuth 2 için Mutual TLS veya OAuth 2 Demonstration of Proof of Possession (DPoP) ile sağlanabilir.", + "parent": "V10.3" + }, + { + "bom-ref": "V10.4", + "identifier": "V10.4", + "title": "OAuth Yetkilendirme Sunucusu (AS)", + "parent": "V10" + }, + { + "bom-ref": "V10.4.1", + "identifier": "V10.4.1", + "text": "AS'nin, istemciye özel önceden kaydedilmiş URI’lerden oluşan bir allowlist kullanarak redirect URI’leri tam dize karşılaştırması ile doğruladığı doğrulanmalıdır.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.2", + "identifier": "V10.4.2", + "text": "AS'nin, \"authorization response\" içinde \"authorization code\" döndürdüğü durumlarda, bu kodun yalnızca bir kez kullanılabildiği doğrulanmalıdır. Daha önce access token vermek için kullanılmış bir authorization code ile yapılan ikinci geçerli token isteği reddedilmeli ve ilgili tüm token’lar iptal edilmelidir.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.3", + "identifier": "V10.4.3", + "text": "Authorization code’un kısa ömürlü olduğu doğrulanmalıdır. L1 ve L2 uygulamalar için maksimum yaşam süresi 10 dakika, L3 uygulamalar için 1 dakikadır.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.4", + "identifier": "V10.4.4", + "text": "Belirli bir istemci için AS'nin yalnızca o istemcinin ihtiyaç duyduğu grant türlerine izin verdiği doğrulanmalıdır. \"Token\" (Implicit flow) ve \"password\" (Resource Owner Password Credentials flow) grant türlerinin artık kullanılmaması gerekir.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.5", + "identifier": "V10.4.5", + "text": "AS'nin, açık istemciler için refresh token replay saldırılarını azalttığı doğrulanmalıdır. Tercihen sender-constrained refresh token’lar (DPoP veya mutual TLS ile certificate-bound access token’lar) kullanılmalıdır. L1 ve L2 uygulamalar için refresh token rotation kullanılabilir. Rotation kullanılıyorsa, AS refresh token’ı kullanım sonrası geçersiz kılmalı ve geçersiz bir refresh token sunulması durumunda o yetkilendirme ile ilişkili tüm refresh token’ları iptal etmelidir.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.6", + "identifier": "V10.4.6", + "text": "Code grant kullanılıyorsa, AS'nin authorization code interception saldırılarına karşı koruma sağladığı doğrulanmalıdır. Yetkilendirme isteğinde geçerli bir \"code_challenge\" değeri zorunlu olmalı ve \"code_challenge_method\" olarak \"plain\" kabul edilmemelidir. Token isteğinde ise \"code_verifier\" parametresi doğrulanmalıdır.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.7", + "identifier": "V10.4.7", + "text": "AS'nin, kimlik doğrulaması yapılmamış dinamik istemci kaydını desteklemesi durumunda, kötü niyetli istemci uygulamalarına karşı riskleri azalttığı doğrulanmalıdır. Kayıtlı URI’ler gibi client metadata’sı doğrulanmalı, kullanıcı onayı alınmalı ve güvenilmeyen bir client uygulamasıyla yapılan yetkilendirme isteği işlenmeden önce kullanıcı uyarılmalıdır.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.8", + "identifier": "V10.4.8", + "text": "Refresh token’ların, sliding expiration kullanılsa bile mutlak bir sona erme süresine sahip olduğu doğrulanmalıdır.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.9", + "identifier": "V10.4.9", + "text": "Yetkili bir kullanıcı tarafından AS kullanıcı arayüzü üzerinden refresh token’ların ve reference access token’ların iptal edilebildiği doğrulanmalıdır.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.10", + "identifier": "V10.4.10", + "text": "Gizli istemcilerin token istekleri, pushed authorization request (PAR) ve token iptal istekleri gibi server’a yapılan backchannel isteklerinde kimliğinin kontrol edildiği doğrulanmalıdır.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.11", + "identifier": "V10.4.11", + "text": "AS yapılandırmasının, OAuth istemcisine yalnızca gerekli scope’ları atadığı doğrulanmalıdır.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.12", + "identifier": "V10.4.12", + "text": "Belirli bir client için, authorization server’ın yalnızca client’ın ihtiyaç duyduğu 'response_mode' değerine izin verdiği doğrulanmalıdır. Örneğin, bu değer ya beklenenlerle karşılaştırılarak doğrulanmalı ya da PAR veya JAR kullanılmalıdır.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.13", + "identifier": "V10.4.13", + "text": "\"Code\" grant türünün daima pushed authorization request (PAR) ile birlikte kullanıldığı doğrulanmalıdır.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.14", + "identifier": "V10.4.14", + "text": "AS'nin yalnızca sender-constrained (Proof-of-Possession) access token’lar ürettiği doğrulanmalıdır. Bu, mutual TLS ile certificate-bound access token ya da DPoP ile DPoP-bound access token olabilir.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.15", + "identifier": "V10.4.15", + "text": "Sunucu taraflı istemciler için (kullanıcı cihazında çalışmayan), AS'nin \"authorization_details\" parametresinin istemci backend'i tarafından sağlandığını ve kullanıcı tarafından değiştirilmediğini doğruladığı, örneğin pushed authorization request (PAR) or JWT-secured Authorization Request (JAR) zorunlu kılınarak doğrulanmalıdır.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.16", + "identifier": "V10.4.16", + "text": "Bir istemci gizli ise, AS'nin güçlü istemci kimlik doğrulama yöntemlerini zorunlu kıldığı doğrulanmalıdır. Bu yöntemler, public-key cryptography’ye dayalı ve replay saldırılarına karşı dayanıklı olmalı, örneğin mutual TLS (\"tls_client_auth\", \"self_signed_tls_client_auth\") veya private key JWT (\"private_key_jwt\") gibi.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.5", + "identifier": "V10.5", + "title": "OIDC İstemcisi", + "parent": "V10" + }, + { + "bom-ref": "V10.5.1", + "identifier": "V10.5.1", + "text": "İstemcinin (relying party olarak) ID Token replay saldırılarını azalttığı doğrulanmalıdır. Örneğin, ID Token’daki 'nonce' claim’inin, OpenID Provider’a gönderilen kimlik doğrulama isteğindeki 'nonce' değeriyle eşleştiği doğrulanmalıdır.", + "parent": "V10.5" + }, + { + "bom-ref": "V10.5.2", + "identifier": "V10.5.2", + "text": "İstemcinin kullanıcıyı ID Token claim’lerinden (genellikle, başka kullanıcılarla yeniden atanamayan 'sub' claim’i) benzersiz şekilde tanımladığı doğrulanmalıdır.", + "parent": "V10.5" + }, + { + "bom-ref": "V10.5.3", + "identifier": "V10.5.3", + "text": "İstemcinin, kötü niyetli bir AS'nin başka bir AS'yi taklit etmesini AS metadata’sı üzerinden reddettiği doğrulanmalıdır. AS metadata’sındaki issuer URL’si, istemci tarafından beklenen önceden yapılandırılmış issuer URL’siyle tam olarak eşleşmiyorsa, metadata reddedilmelidir.", + "parent": "V10.5" + }, + { + "bom-ref": "V10.5.4", + "identifier": "V10.5.4", + "text": "İstemcinin, ID Token’ın kendisi için (audience) kullanılması amaçlandığını doğruladığı doğrulanmalıdır. Bu, token’daki 'aud' claim’inin istemcinin 'client_id' değeriyle eşit olup olmadığının kontrol edilmesiyle yapılır.", + "parent": "V10.5" + }, + { + "bom-ref": "V10.5.5", + "identifier": "V10.5.5", + "text": "OIDC back-channel logout kullanıldığında, relying party’nin \"forced logout\" ve \"logout\" akışında \"cross-JWT confusion\" gibi saldırılara karşı koruma sağladığı doğrulanmalıdır. Client, logout token’ın 'logout+jwt' türünde olduğunu, 'event' claim’inin doğru üyeye sahip olduğunu ve 'nonce' claim’i içermediğini doğrulamalıdır. Ayrıca token için kısa bir sona erme süresi (örneğin 2 dakika) önerilir.", + "parent": "V10.5" + }, + { + "bom-ref": "V10.6", + "identifier": "V10.6", + "title": "OpenID Provider", + "parent": "V10" + }, + { + "bom-ref": "V10.6.1", + "identifier": "V10.6.1", + "text": "OpenID Provider’ın yalnızca 'code', 'ciba', 'id_token' veya 'id_token code' response mode değerlerine izin verdiği doğrulanmalıdır. 'code' değeri, 'id_token code' (OIDC Hybrid flow) yerine tercih edilmelidir. 'token' (Implicit flow) kullanılmamalıdır.", + "parent": "V10.6" + }, + { + "bom-ref": "V10.6.2", + "identifier": "V10.6.2", + "text": "OpenID Provider’ın forced logout yoluyla yapılan hizmet reddi saldırılarını önlediği doğrulanmalıdır. Bu, son kullanıcıdan açık onay alınarak veya varsa logout isteğinde (relying party tarafından başlatılan) bulunan parametrelerin, örneğin 'id_token_hint', doğrulanmasıyla yapılabilir.", + "parent": "V10.6" + }, + { + "bom-ref": "V10.7", + "identifier": "V10.7", + "title": "Onay (Consent) Yönetimi", + "parent": "V10" + }, + { + "bom-ref": "V10.7.1", + "identifier": "V10.7.1", + "text": "AS'nin her yetkilendirme isteği için kullanıcının onayını aldığı doğrulanmalıdır. İstemcinin kimliği garanti altına alınamıyorsa, AS daima kullanıcıdan açıkça onay istemelidir.", + "parent": "V10.7" + }, + { + "bom-ref": "V10.7.2", + "identifier": "V10.7.2", + "text": "AS'nin kullanıcıdan onay istediğinde, neye onay verildiğini açık ve yeterli şekilde gösterdiği doğrulanmalıdır. Uygun olduğunda bu bilgiler, istenen yetkilendirmelerin doğasını (genellikle scope, resource server, RAR gibi detaylara dayalı), yetkilendirilmiş uygulamanın kimliğini ve bu yetkilendirmelerin süresini içermelidir.", + "parent": "V10.7" + }, + { + "bom-ref": "V10.7.3", + "identifier": "V10.7.3", + "text": "Kullanıcının, AS üzerinden verdiği onayları görüntüleyebildiği, değiştirebildiği ve iptal edebildiği doğrulanmalıdır.", + "parent": "V10.7" + }, + { + "bom-ref": "V11", + "identifier": "V11", + "title": "Kriptografi" + }, + { + "bom-ref": "V11.1", + "identifier": "V11.1", + "title": "Kriptografik Envanter ve Dokümantasyon", + "parent": "V11" + }, + { + "bom-ref": "V11.1.1", + "identifier": "V11.1.1", + "text": "Kriptografik anahtarların yönetimi için belgelenmiş bir politika ve NIST SP 800-57 gibi bir anahtar yönetim standardını izleyen bir kriptografik anahtar yaşam döngüsü tanımlandığı doğrulanmalıdır. Bu, anahtarların aşırı miktarda paylaşılmadığını (örneğin, paylaşılan sırlar için ikiden fazla tarafla veya özel anahtarlar için birden fazla tarafla) garanti altına almalıdır.", + "parent": "V11.1" + }, + { + "bom-ref": "V11.1.2", + "identifier": "V11.1.2", + "text": "Tüm kriptografik anahtarlar, algoritmalar ve uygulama tarafından kullanılan sertifikaları içeren bir kriptografik envanterin oluşturulduğu, sürdürüldüğü ve düzenli olarak güncellendiği doğrulanmalıdır. Bu envanter ayrıca, sistemde anahtarların nerede kullanılabileceğini ve kullanılamayacağını, ve hangi veri türlerinin bu anahtarlarla korunup korunamayacağını da belgelemelidir.", + "parent": "V11.1" + }, + { + "bom-ref": "V11.1.3", + "identifier": "V11.1.3", + "text": "Sistem içerisinde şifreleme, özetleme ve imzalama işlemleri dahil olmak üzere kriptografi kullanımının tüm örneklerini tespit etmek için kriptografik keşif mekanizmalarının kullanıldığı doğrulanmalıdır.", + "parent": "V11.1" + }, + { + "bom-ref": "V11.1.4", + "identifier": "V11.1.4", + "text": "Kriptografik bir envanterin sürdürüldüğü doğrulanmalıdır. Bu envanter, gelecekteki tehditlere karşı tepki verebilmek amacıyla post-kuantum kriptografiye geçiş yolunu belirten belgelenmiş bir plan içermelidir.", + "parent": "V11.1" + }, + { + "bom-ref": "V11.2", + "identifier": "V11.2", + "title": "Güvenli Kriptografi Uygulaması", + "parent": "V11" + }, + { + "bom-ref": "V11.2.1", + "identifier": "V11.2.1", + "text": "Kriptografik işlemler için sektör tarafından doğrulanmış uygulamaların (kütüphaneler ve donanım hızlandırmalı uygulamalar dahil) kullanıldığı doğrulanmalıdır.", + "parent": "V11.2" + }, + { + "bom-ref": "V11.2.2", + "identifier": "V11.2.2", + "text": "Uygulamanın, rastgele sayı üreticileri, kimliği doğrulanmış şifreleme, MAC veya özetleme algoritmaları, anahtar uzunlukları, turlar, şifreler ve modların herhangi bir zamanda yeniden yapılandırılabilir, yükseltilebilir veya değiştirilebilir olacağı şekilde kripto çevikliği (crypto agility) ile tasarlandığı doğrulanmalıdır. Aynı şekilde, anahtarların ve parolaların değiştirilebilmesi ve verilerin yeniden şifrelenebilmesi mümkün olmalıdır. Bu, onaylanmış PQC şemalarının yüksek güvenlikli uygulamaları yaygın olarak kullanılabilir hale geldiğinde sorunsuz geçişe olanak tanır.", + "parent": "V11.2" + }, + { + "bom-ref": "V11.2.3", + "identifier": "V11.2.3", + "text": "Tüm kriptografik ilkeliklerin, algoritma, anahtar boyutu ve yapılandırmaya göre minimum 128 bit güvenlik sağladığı doğrulanmalıdır. Örneğin, 256-bit ECC anahtarı yaklaşık 128 bit güvenlik sağlarken, RSA için aynı güvenliği elde etmek 3072-bit anahtar gerektirir.", + "parent": "V11.2" + }, + { + "bom-ref": "V11.2.4", + "identifier": "V11.2.4", + "text": "Tüm kriptografik işlemlerin sabit süreli (constant-time) olduğu, karşılaştırmalarda, hesaplamalarda veya geri dönüşlerde kısa devre (short-circuit) işlemleri yapılmadığı doğrulanmalıdır; bu, bilgi sızıntısını önlemek için gereklidir.", + "parent": "V11.2" + }, + { + "bom-ref": "V11.2.5", + "identifier": "V11.2.5", + "text": "Tüm kriptografik modüllerin güvenli şekilde hata verdiği ve hataların, padding oracle saldırıları gibi zafiyetleri mümkün kılmayacak şekilde ele alındığı doğrulanmalıdır.", + "parent": "V11.2" + }, + { + "bom-ref": "V11.3", + "identifier": "V11.3", + "title": "Şifreleme Algoritmaları", + "parent": "V11" + }, + { + "bom-ref": "V11.3.1", + "identifier": "V11.3.1", + "text": "Güvensiz blok modlarının (örneğin, ECB) ve zayıf doldurma (padding) şemalarının (örneğin, PKCS#1 v1.5) kullanılmadığı doğrulanmalıdır.", + "parent": "V11.3" + }, + { + "bom-ref": "V11.3.2", + "identifier": "V11.3.2", + "text": "Yalnızca AES ile GCM gibi onaylı şifreleme algoritmalarının ve modlarının kullanıldığı doğrulanmalıdır.", + "parent": "V11.3" + }, + { + "bom-ref": "V11.3.3", + "identifier": "V11.3.3", + "text": "Şifrelenmiş verilerin yetkisiz değişikliklere karşı korunduğu doğrulanmalıdır. Tercihen bu koruma, onaylı bir kimliği doğrulanmış şifreleme yöntemi kullanılarak ya da onaylı bir şifreleme yöntemi ile onaylı bir MAC algoritmasının kombinasyonu ile sağlanmalıdır.", + "parent": "V11.3" + }, + { + "bom-ref": "V11.3.4", + "identifier": "V11.3.4", + "text": "Sayılar, başlatma vektörleri (IV) ve diğer tek kullanımlık değerlerin, aynı şifreleme anahtarı ve veri öğesi çifti için birden fazla kez kullanılmadığı doğrulanmalıdır. Oluşturma yöntemi kullanılan algoritmaya uygun olmalıdır.", + "parent": "V11.3" + }, + { + "bom-ref": "V11.3.5", + "identifier": "V11.3.5", + "text": "Şifreleme algoritması ve MAC algoritması kombinasyonlarının \"encrypt-then-MAC\" modunda çalıştığı doğrulanmalıdır.", + "parent": "V11.3" + }, + { + "bom-ref": "V11.4", + "identifier": "V11.4", + "title": "Hashing ve Hash Tabanlı Fonksiyonlar", + "parent": "V11" + }, + { + "bom-ref": "V11.4.1", + "identifier": "V11.4.1", + "text": "Dijital imzalar, HMAC, KDF ve rastgele bit üretimi gibi genel kriptografik kullanım senaryolarında yalnızca onaylı hash fonksiyonlarının kullanıldığı doğrulanmalıdır. MD5 gibi yasaklı hash fonksiyonları hiçbir kriptografik amaçla kullanılmamalıdır.", + "parent": "V11.4" + }, + { + "bom-ref": "V11.4.2", + "identifier": "V11.4.2", + "text": "Parolaların, onaylı, hesaplama açısından yoğun ve mevcut rehberliğe göre yapılandırılmış bir anahtar türetme fonksiyonu (diğer adıyla parola hash'leme fonksiyonu) kullanılarak saklandığı doğrulanmalıdır. Ayarlar, güvenlik ve performans dengesini sağlayarak kaba kuvvet saldırılarını zorlaştırmalıdır.", + "parent": "V11.4" + }, + { + "bom-ref": "V11.4.3", + "identifier": "V11.4.3", + "text": "Dijital imzalarda kullanılan hash fonksiyonlarının, veri bütünlüğü ve kimlik doğrulama amacıyla kullanıldığında çakışmaya karşı dayanıklı ve yeterli bit uzunluğuna sahip olduğu doğrulanmalıdır. Çakışma dayanıklılığı gerekiyorsa çıktı uzunluğu en az 256 bit olmalıdır. Sadece ikinci ön-görüntü (2nd pre-iamge) saldırılarına karşı dayanıklılık gerekiyorsa çıktı uzunluğu en az 128 bit olmalıdır.", + "parent": "V11.4" + }, + { + "bom-ref": "V11.4.4", + "identifier": "V11.4.4", + "text": "Parolalardan gizli anahtarlar türetilirken, onaylı anahtar türetme fonksiyonlarının anahtar uzatma (key stretching) parametreleriyle birlikte kullanıldığı doğrulanmalıdır. Bu parametreler, kaba kuvvet saldırılarını önleyecek şekilde güvenlik ve performans dengesine sahip olmalıdır.", + "parent": "V11.4" + }, + { + "bom-ref": "V11.5", + "identifier": "V11.5", + "title": "Rastgele Değerler", + "parent": "V11" + }, + { + "bom-ref": "V11.5.1", + "identifier": "V11.5.1", + "text": "Tahmin edilemez olması amaçlanan tüm rastgele sayıların ve dizelerin, CSPRNG ile oluşturulduğu ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. UUID'lerin bu koşulu dikkate almadığını unutmayın.", + "parent": "V11.5" + }, + { + "bom-ref": "V11.5.2", + "identifier": "V11.5.2", + "text": "Kullanılan rastgele sayı üretim mekanizmasının, yoğun talep altında dahi güvenli çalışacak şekilde tasarlandığı doğrulanmalıdır.", + "parent": "V11.5" + }, + { + "bom-ref": "V11.6", + "identifier": "V11.6", + "title": "Açık Anahtar (Public Key) Kriptografisi", + "parent": "V11" + }, + { + "bom-ref": "V11.6.1", + "identifier": "V11.6.1", + "text": "Anahtar üretimi, tohumlama (seeding) ve dijital imza üretimi ve doğrulama için yalnızca onaylı kriptografik algoritmalar ve çalışma modlarının kullanıldığı doğrulanmalıdır. Anahtar üretim algoritmaları, bilinen saldırılara karşı savunmasız anahtarlar üretmemelidir. Örneğin, Fermat çarpanlama yöntemine karşı savunmasız RSA anahtarları oluşturulmamalıdır.", + "parent": "V11.6" + }, + { + "bom-ref": "V11.6.2", + "identifier": "V11.6.2", + "text": "Anahtar değişimi için yalnızca onaylı kriptografik algoritmaların kullanıldığı doğrulanmalıdır (örneğin Diffie-Hellman). Kullanılan parametrelerin güvenli olması gerektiğine dikkat edilmelidir. Bu, anahtar kurulum sürecine yönelik saldırıları önleyecek ve araya girme (adversary-in-the-middle) ya da kriptografik kırılmaları engelleyecektir.", + "parent": "V11.6" + }, + { + "bom-ref": "V11.7", + "identifier": "V11.7", + "title": "Kullanım Halindeki Verilerin Kriptografisi", + "parent": "V11" + }, + { + "bom-ref": "V11.7.1", + "identifier": "V11.7.1", + "text": "Hassas verilerin kullanım sırasında korunmasını sağlamak amacıyla, yetkisiz kullanıcıların veya süreçlerin bu verilere erişmesini engelleyen tam bellek şifrelemesinin kullanıldığı doğrulanmalıdır.", + "parent": "V11.7" + }, + { + "bom-ref": "V11.7.2", + "identifier": "V11.7.2", + "text": "Veri asgariyetinin sağlandığı, yani işleme sırasında mümkün olan en az miktarda verinin ortaya çıktığı ve verilerin kullanımdan hemen sonra veya mümkün olan en kısa sürede şifrelendiği doğrulanmalıdır.", + "parent": "V11.7" + }, + { + "bom-ref": "V12", + "identifier": "V12", + "title": "Güvenli İletişim" + }, + { + "bom-ref": "V12.1", + "identifier": "V12.1", + "title": "Genel TLS Güvenlik Rehberi", + "parent": "V12" + }, + { + "bom-ref": "V12.1.1", + "identifier": "V12.1.1", + "text": "Yalnızca TLS protokolünün en güncel ve önerilen sürümlerinin (örneğin TLS 1.2 ve TLS 1.3) etkinleştirildiği ve en son sürümün varsayılan olarak tercih edildiği doğrulanmalıdır.", + "parent": "V12.1" + }, + { + "bom-ref": "V12.1.2", + "identifier": "V12.1.2", + "text": "Yalnızca önerilen şifre takımlarının (cipher suite) etkinleştirildiği ve en güçlü şifre takımlarının tercih edildiği doğrulanmalıdır. Seviye 3 (L3) uygulamalar yalnızca ileri gizlilik (forward secrecy) sağlayan şifre takımlarını desteklemelidir.", + "parent": "V12.1" + }, + { + "bom-ref": "V12.1.3", + "identifier": "V12.1.3", + "text": "Uygulamanın, mTLS istemci sertifikalarını kimlik doğrulama veya yetkilendirme amacıyla kullanmadan önce bu sertifikaların güvendiği sertifikalar arasında olduğunu doğruladığı kontrol edilmelidir.", + "parent": "V12.1" + }, + { + "bom-ref": "V12.1.4", + "identifier": "V12.1.4", + "text": "Online Certificate Status Protocol (OCSP) Stapling gibi geçerli bir sertifika iptal kontrolü yönteminin etkinleştirildiği ve yapılandırıldığı doğrulanmalıdır.", + "parent": "V12.1" + }, + { + "bom-ref": "V12.1.5", + "identifier": "V12.1.5", + "text": "TLS el sıkışma (handshake) sürecinde Server Name Indication (SNI) gibi hassas meta verilerin ifşa edilmesini önlemek için, uygulamanın TLS yapılandırmasında Encrypted Client Hello (ECH) özelliğinin etkinleştirildiği doğrulanmalıdır.", + "parent": "V12.1" + }, + { + "bom-ref": "V12.2", + "identifier": "V12.2", + "title": "Dışa Açık Hizmetlerle HTTPS İletişimi", + "parent": "V12" + }, + { + "bom-ref": "V12.2.1", + "identifier": "V12.2.1", + "text": "İstemci ile dışa açık, HTTP tabanlı hizmetler arasındaki tüm bağlantılarda TLS kullanıldığı ve bu bağlantıların güvensiz ya da şifrelenmemiş iletişime geri dönmediği doğrulanmalıdır.", + "parent": "V12.2" + }, + { + "bom-ref": "V12.2.2", + "identifier": "V12.2.2", + "text": "Dışa açık hizmetlerin herkese açık olarak güvenilen TLS sertifikaları kullandığı doğrulanmalıdır.", + "parent": "V12.2" + }, + { + "bom-ref": "V12.3", + "identifier": "V12.3", + "title": "Genel Servisler Arası İletişim Güvenliği", + "parent": "V12" + }, + { + "bom-ref": "V12.3.1", + "identifier": "V12.3.1", + "text": "Uygulamaya gelen ve uygulamadan çıkan tüm bağlantılarda izleme sistemleri, yönetim araçları, uzaktan erişim ve SSH, ara yazılımlar, veritabanları, ana sistemler (mainframe), iş ortağı sistemleri ya da dış API'ler dahil olmak üzere TLS gibi şifreli bir protokolün kullanıldığı ve güvensiz ya da şifrelenmemiş protokollere geri dönülmediği doğrulanmalıdır.", + "parent": "V12.3" + }, + { + "bom-ref": "V12.3.2", + "identifier": "V12.3.2", + "text": "TLS istemcilerinin bir TLS sunucusu ile iletişime geçmeden önce alınan sertifikaları doğruladığı kontrol edilmelidir.", + "parent": "V12.3" + }, + { + "bom-ref": "V12.3.3", + "identifier": "V12.3.3", + "text": "Uygulama içindeki HTTP tabanlı iç hizmetler arasında gerçekleşen tüm bağlantılarda TLS ya da uygun başka bir aktarım şifreleme mekanizmasının kullanıldığı ve güvensiz ya da şifrelenmemiş iletişime geri dönülmediği doğrulanmalıdır.", + "parent": "V12.3" + }, + { + "bom-ref": "V12.3.4", + "identifier": "V12.3.4", + "text": "İç hizmetler arasındaki TLS bağlantılarında güvenilir sertifikaların kullanıldığı doğrulanmalıdır. İç sistemlerde oluşturulmuş ya da kendinden imzalı (self-signed) sertifikalar kullanılıyorsa, bu sertifikalara güvenen hizmetlerin yalnızca belirli dahili sertifika otoritelerine (CA) ve belirli kendinden imzalı sertifikalara güvenecek şekilde yapılandırıldıkları doğrulanmalıdır.", + "parent": "V12.3" + }, + { + "bom-ref": "V12.3.5", + "identifier": "V12.3.5", + "text": "Sistem içindeki hizmetlerin birbiriyle iletişim kurarken her bir uç noktanın kimliğini doğrulamak için güçlü kimlik doğrulama yöntemlerinin kullanıldığı doğrulanmalıdır. Bu yöntemler arasında, açık anahtar altyapısı (public-key infrastructure) kullanan ve tekrar oynatma saldırılarına karşı dayanıklı olan TLS istemci kimlik doğrulaması gibi yöntemler yer almalıdır. Mikroservis mimarilerinde, sertifika yönetimini basitleştirmek ve güvenliği artırmak amacıyla bir servis ağı (service mesh) kullanılması değerlendirilmelidir.", + "parent": "V12.3" + }, + { + "bom-ref": "V13", + "identifier": "V13", + "title": "Konfigürasyon" + }, + { + "bom-ref": "V13.1", + "identifier": "V13.1", + "title": "Konfigürasyon Dokümantasyonu", + "parent": "V13" + }, + { + "bom-ref": "V13.1.1", + "identifier": "V13.1.1", + "text": "Uygulamanın tüm iletişim ihtiyaçlarının dokümante edildiği doğrulanmalıdır. Buna, uygulamanın bağımlı olduğu dış hizmetler ve son kullanıcının uygulamanın bağlantı kurmasını sağlayabileceği dış konumlar da dahil olmalıdır.", + "parent": "V13.1" + }, + { + "bom-ref": "V13.1.2", + "identifier": "V13.1.2", + "text": "Uygulamanın kullandığı her bir hizmet için, dokümantasyonda eşzamanlı bağlantı sayısı (örn. bağlantı havuzu limitleri) ve bu sınır aşıldığında uygulamanın davranışı, geri dönüş veya kurtarma mekanizmaları da dahil olmak üzere hizmet reddi koşullarını önlemek için tanımlandığı doğrulanmalıdır.", + "parent": "V13.1" + }, + { + "bom-ref": "V13.1.3", + "identifier": "V13.1.3", + "text": "Uygulamanın, kullandığı her bir dış sistem veya hizmet (örn. veritabanları, dosya tanıtıcıları, iş parçacıkları, HTTP bağlantıları) için kaynak yönetimi stratejilerini tanımladığı doğrulanmalıdır. Bu stratejiler, kaynak serbest bırakma prosedürlerini, zaman aşımı ayarlarını, hata durumlarını ve tekrar deneme mantığı uygulanmışsa sınırları, gecikmeleri ve geri çekilme (back-off) algoritmalarını içermelidir. Senkron HTTP istek–yanıt işlemleri için kısa zaman aşımı süreleri zorunlu tutulmalı ve tekrar eden denemeler devre dışı bırakılmalı ya da sıkı şekilde sınırlandırılmalıdır.", + "parent": "V13.1" + }, + { + "bom-ref": "V13.1.4", + "identifier": "V13.1.4", + "text": "Uygulamanın, güvenlik açısından kritik olan gizli verileri tanımladığı ve kuruluşun tehdit modeli ve iş ihtiyaçlarına göre bu verilerin döndürülme (rotation) zamanlamasının belgelendiği doğrulanmalıdır.", + "parent": "V13.1" + }, + { + "bom-ref": "V13.2", + "identifier": "V13.2", + "title": "Backend İletişim Konfigürasyonu", + "parent": "V13" + }, + { + "bom-ref": "V13.2.1", + "identifier": "V13.2.1", + "text": "Uygulamanın, standart kullanıcı oturum mekanizmasını desteklemeyen backend bileşenleri (örneğin API'ler, ara katmanlar, veri katmanları) arasında gerçekleşen iletişimlerin kimlik doğrulamasıyla korunduğu doğrulanmalıdır. Kimlik doğrulama; bireysel hizmet hesapları, kısa ömürlü token'lar ya da sertifika tabanlı kimlik doğrulama ile yapılmalıdır ve parola, API anahtarı ya da ayrıcalıklı erişime sahip paylaşımlı hesaplar gibi sabit kimlik bilgileri kullanılmamalıdır.", + "parent": "V13.2" + }, + { + "bom-ref": "V13.2.2", + "identifier": "V13.2.2", + "text": "Uygulamanın backend bileşenleri arasında (yerel hizmetler, işletim sistemi hizmetleri, API'ler, ara katmanlar ve veri katmanları dahil) gerçekleştirilen iletişimlerin, yalnızca gerekli en az ayrıcalığa sahip hesaplarla yapıldığı doğrulanmalıdır.", + "parent": "V13.2" + }, + { + "bom-ref": "V13.2.3", + "identifier": "V13.2.3", + "text": "Bir hizmet kimlik doğrulaması için bir kimlik bilgisi kullanılması gerekiyorsa, bu kimlik bilgisinin varsayılan bir değer (örneğin root/root veya admin/admin) olmadığının doğrulanması gereklidir.", + "parent": "V13.2" + }, + { + "bom-ref": "V13.2.4", + "identifier": "V13.2.4", + "text": "Uygulamanın iletişim kurmasına izin verilen dış kaynaklar ya da sistemlerin, bir allowlist (izinli liste) ile tanımlandığı doğrulanmalıdır. Bu liste, uygulama katmanında, web sunucusunda, güvenlik duvarında veya farklı katmanların birleşiminde uygulanabilir.", + "parent": "V13.2" + }, + { + "bom-ref": "V13.2.5", + "identifier": "V13.2.5", + "text": "Web veya uygulama sunucusunun, dış sistemlere veri veya dosya gönderimi veya yüklemesi yaparken sadece belirli kaynaklara izin verecek şekilde allowlist ile yapılandırıldığı doğrulanmalıdır.", + "parent": "V13.2" + }, + { + "bom-ref": "V13.2.6", + "identifier": "V13.2.6", + "text": "Uygulamanın farklı hizmetlere bağlantı kurduğu durumlarda, bu bağlantılar için belgelenmiş yapılandırmaları (örn. maksimum eşzamanlı bağlantı, bağlantı limiti aşıldığında davranış, zaman aşımı, tekrar deneme stratejileri) takip ettiğinin doğrulanması gereklidir.", + "parent": "V13.2" + }, + { + "bom-ref": "V13.3", + "identifier": "V13.3", + "title": "Gizli Bilgi Yönetimi", + "parent": "V13" + }, + { + "bom-ref": "V13.3.1", + "identifier": "V13.3.1", + "text": "Parolalar, anahtar materyalleri, veritabanı ve üçüncü parti sistemlerle entegrasyon bilgileri, zaman tabanlı token'lar için tohum (seed) bilgileri, dahili gizli veriler ve API anahtarları gibi backend sırlarının güvenli bir şekilde oluşturulması, saklanması, erişim denetiminin sağlanması ve imha edilmesi için bir gizli bilgi yönetim çözümünün (örneğin key vault) kullanıldığı doğrulanmalıdır. Bu gizli bilgiler uygulama kaynak koduna dahil edilmemeli ve yapı çıktılarında yer almamalıdır. Seviye 3 uygulamalar için donanım destekli bir çözüm (örneğin HSM) gereklidir.", + "parent": "V13.3" + }, + { + "bom-ref": "V13.3.2", + "identifier": "V13.3.2", + "text": "Gizli bilgilere erişimin en az ayrıcalık prensibine uygun şekilde yapılandırıldığı doğrulanmalıdır.", + "parent": "V13.3" + }, + { + "bom-ref": "V13.3.3", + "identifier": "V13.3.3", + "text": "Tüm kriptografik işlemlerin, anahtar materyallerinin güvenli bir şekilde yönetilmesi ve dışarıya sızmasının engellenmesi amacıyla, izole edilmiş bir güvenlik modülü (örneğin vault ya da donanım güvenlik modülü) aracılığıyla gerçekleştirildiği doğrulanmalıdır.", + "parent": "V13.3" + }, + { + "bom-ref": "V13.3.4", + "identifier": "V13.3.4", + "text": "Uygulamanın belgelerinde belirtildiği şekilde gizli bilgilerin süresinin dolacak şekilde yapılandırıldığı ve düzenli olarak döndürüldüğü doğrulanmalıdır.", + "parent": "V13.3" + }, + { + "bom-ref": "V13.4", + "identifier": "V13.4", + "title": "İstenmeyen Bilgi Sızıntısı", + "parent": "V13" + }, + { + "bom-ref": "V13.4.1", + "identifier": "V13.4.1", + "text": "Uygulamanın .git veya .svn klasörleri gibi kaynak kontrolüyle ilgili metadata içermeyecek şekilde deploy edildiğini ya da bu klasörlerin hem dış erişime hem de uygulama erişimine kapalı olduğu doğrulanmalıdır.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.2", + "identifier": "V13.4.2", + "text": "Tüm bileşenler için üretim ortamlarında hata ayıklama (debug) modlarının devre dışı bırakıldığı doğrulanmalıdır.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.3", + "identifier": "V13.4.3", + "text": "Web sunucularının, açık şekilde istenmediği sürece dizin listelemesi (directory listing) özelliğini istemcilere sunmadığı doğrulanmalıdır.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.4", + "identifier": "V13.4.4", + "text": "HTTP TRACE metodunun üretim ortamlarında desteklenmediği, böylece potansiyel bilgi sızıntılarının önlendiği doğrulanmalıdır.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.5", + "identifier": "V13.4.5", + "text": "Belgeler (örneğin dahili API belgeleri) ve izleme uç noktalarının (monitoring endpoints) yalnızca açıkça belirtildiği durumlarda erişilebilir olduğu doğrulanmalıdır.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.6", + "identifier": "V13.4.6", + "text": "Uygulamanın arka uç bileşenlerinin ayrıntılı sürüm bilgilerini ifşa etmediği doğrulanmalıdır.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.7", + "identifier": "V13.4.7", + "text": "Web katmanının yalnızca belirli dosya uzantılarına sahip dosyaları sunacak şekilde yapılandırıldığı, bu sayede istem dışı bilgi, yapılandırma ya da kaynak kod sızıntılarının önlendiği doğrulanmalıdır.", + "parent": "V13.4" + }, + { + "bom-ref": "V14", + "identifier": "V14", + "title": "Veri Koruma" + }, + { + "bom-ref": "V14.1", + "identifier": "V14.1", + "title": "Veri Koruma Dokümantasyonu", + "parent": "V14" + }, + { + "bom-ref": "V14.1.1", + "identifier": "V14.1.1", + "text": "Uygulama tarafından oluşturulan ve işlenen tüm hassas verilerin tanımlanıp, koruma seviyelerine göre sınıflandırıldığından emin olun. Bu, yalnızca kodlanmış (örneğin Base64 stringleri ya da JWT içindeki düz metin yükler gibi) ve bu nedenle kolayca çözülebilir verileri de içermelidir. Koruma seviyeleri, uygulamanın uymakla yükümlü olduğu veri koruma ve gizlilik düzenlemeleri ile standartlarını dikkate almalıdır.", + "parent": "V14.1" + }, + { + "bom-ref": "V14.1.2", + "identifier": "V14.1.2", + "text": "Tüm hassas veri koruma seviyeleri için belgelenmiş bir koruma gereksinimleri seti tanımlandığından emin olun. Bu gereksinimler genel şifreleme, bütünlük doğrulama, saklama süresi, verinin nasıl günlüğe kaydedileceği, günlüklerdeki hassas verilere erişim kontrolleri, veritabanı düzeyinde şifreleme, gizlilik ve gizliliği artırıcı teknolojiler ile diğer gizlilik gereksinimlerini kapsamalıdır.", + "parent": "V14.1" + }, + { + "bom-ref": "V14.2", + "identifier": "V14.2", + "title": "Genel Veri Koruması", + "parent": "V14" + }, + { + "bom-ref": "V14.2.1", + "identifier": "V14.2.1", + "text": "Hassas verilerin yalnızca HTTP message body veya header alanlarında sunucuya gönderildiği ve URL ile sorgu parametrelerinin, API anahtarı veya session token’ı gibi hassas bilgiler içermediği doğrulanmalıdır.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.2", + "identifier": "V14.2.2", + "text": "Hassas verilerin, yük dengeleyiciler ve uygulama önbellekleri gibi sunucu bileşenlerinde önbelleğe alınmasının engellendiği veya kullanım sonrası bu verilerin güvenli biçimde temizlendiği doğrulanmalıdır.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.3", + "identifier": "V14.2.3", + "text": "Uygulama kontrolü dışında veri toplanmasını engellemek için, tanımlanmış hassas verilerin, kullanıcı izleyicileri gibi güvensiz taraflara gönderilmediği doğrulanmalıdır.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.4", + "identifier": "V14.2.4", + "text": "Hassas verilere yönelik şifreleme, bütünlük doğrulama, veri saklama, loglama yöntemi, loglardaki erişim kontrolleri, gizlilik teknolojileri gibi kontrollerin, söz konusu verinin belgelenmiş koruma seviyesinde tanımlandığı şekilde uygulandığı doğrulanmalıdır.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.5", + "identifier": "V14.2.5", + "text": "Önbellekleme mekanizmalarının yalnızca belirli içerik türüne sahip yanıtları önbelleğe alacak şekilde yapılandırıldığı ve hassas, dinamik içeriklerin önbelleğe alınmadığı doğrulanmalıdır. Web sunucusu, mevcut olmayan bir dosya talebinde geçerli ama farklı bir dosya döndürmek yerine 404 veya 302 cevabı vermelidir. Bu, Web Cache Deception saldırılarını önlemeye yardımcı olur.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.6", + "identifier": "V14.2.6", + "text": "Uygulamanın yalnızca işlevsellik için gerekli olan asgari hassas veriyi döndürdüğü doğrulanmalıdır. Örneğin, kredi kartı numarasının yalnızca bazı rakamlarının döndürülmesi; tam numaranın döndürülmesi gerekiyorsa, kullanıcı arayüzünde gizlenmiş (maskelenmiş) şekilde sunulması gerekir, aksi kullanıcı özel olarak görüntülemek istemedikçe gösterilmemelidir.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.7", + "identifier": "V14.2.7", + "text": "Hassas bilgilerin, veri saklama sınıflandırmasına tabi tutulduğu, geçerliliğini yitirmiş veya artık gerekli olmayan verilerin belirlenmiş bir zaman çizelgesiyle ya da gerektiğinde otomatik olarak silindiği doğrulanmalıdır.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.8", + "identifier": "V14.2.8", + "text": "Kullanıcı tarafından yüklenen dosyaların meta verilerinden hassas bilgilerin çıkarıldığı veya bu bilgilerin yalnızca kullanıcıdan açık onay alındığında saklandığı doğrulanmalıdır.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.3", + "identifier": "V14.3", + "title": "İstemci Tarafı Veri Koruması", + "parent": "V14" + }, + { + "bom-ref": "V14.3.1", + "identifier": "V14.3.1", + "text": "Kimliği doğrulanmış verilerin, istemci veya oturum sonlandığında istemci depolamasından (örneğin tarayıcı DOM’undan) temizlendiği doğrulanmalıdır. 'Clear-Site-Data' HTTP response header bu konuda yardımcı olabilir ancak istemci tarafı, sunucu bağlantısı mevcut olmadığında da temizlik işlemini yapabiliyor olmalıdır.", + "parent": "V14.3" + }, + { + "bom-ref": "V14.3.2", + "identifier": "V14.3.2", + "text": "Uygulamanın, tarayıcılarda hassas verilerin önbelleğe alınmasını önlemek amacıyla yeterli anti-önbellekleme HTTP response header (örneğin Cache-Control: no-store) ayarladığı doğrulanmalıdır.", + "parent": "V14.3" + }, + { + "bom-ref": "V14.3.3", + "identifier": "V14.3.3", + "text": "Tarayıcıda depolanan verilerin (örneğin localStorage, sessionStorage, IndexedDB veya çerezler) hassas veri içermediği, yalnızca session token’larının istisna olarak kabul edildiği doğrulanmalıdır.", + "parent": "V14.3" + }, + { + "bom-ref": "V15", + "identifier": "V15", + "title": "Güvenli Kodlama ve Mimari" + }, + { + "bom-ref": "V15.1", + "identifier": "V15.1", + "title": "Güvenli Kodlama ve Mimari Dokümantasyonu", + "parent": "V15" + }, + { + "bom-ref": "V15.1.1", + "identifier": "V15.1.1", + "text": "Güvenlik açığı içeren üçüncü taraf bileşen sürümleri ve genel olarak kütüphane güncellemeleri için, uygulama dokümantasyonunda risk bazlı düzeltme zamanlarının tanımlandığı doğrulanmalıdır.", + "parent": "V15.1" + }, + { + "bom-ref": "V15.1.2", + "identifier": "V15.1.2", + "text": "Yazılım bileşen listesi (Software Bill of Materials - SBOM) gibi bir envanterin tutulduğu, kullanılan tüm üçüncü taraf kütüphanelerin önceden tanımlanmış, güvenilir ve düzenli olarak güncellenen depolardan alındığı doğrulanmalıdır.", + "parent": "V15.1" + }, + { + "bom-ref": "V15.1.3", + "identifier": "V15.1.3", + "text": "Uygulama dokümantasyonunda zaman veya kaynak açısından yoğun işlevlerin tanımlandığı, bu işlevlerin aşırı kullanımı durumunda kullanılabilirlik kaybının nasıl önleneceği ve yanıt oluşturma süresinin istemci zaman aşımını aşmaması için hangi önlemlerin alındığı belirtilmelidir. Örnek savunmalar kuyruklama, eşzamansız işleme, kullanıcı başına ve uygulama genelinde paralel işlem sınırlarını içerebilir.", + "parent": "V15.1" + }, + { + "bom-ref": "V15.1.4", + "identifier": "V15.1.4", + "text": "Uygulama dokümantasyonunda \"riskli bileşenler\" olarak değerlendirilen üçüncü taraf kütüphanelerin vurgulandığı doğrulanmalıdır.", + "parent": "V15.1" + }, + { + "bom-ref": "V15.1.5", + "identifier": "V15.1.5", + "text": "Uygulama dokümantasyonunda \"tehlikeli işlevsellik\" içeren uygulama bölümlerinin açıkça belirtildiği doğrulanmalıdır.", + "parent": "V15.1" + }, + { + "bom-ref": "V15.2", + "identifier": "V15.2", + "title": "Güvenlik Mimarisi ve Bağımlılıklar", + "parent": "V15" + }, + { + "bom-ref": "V15.2.1", + "identifier": "V15.2.1", + "text": "Uygulamanın yalnızca, belgelenmiş güncelleme ve düzeltme sürelerini aşmamış bileşenleri içerdiği doğrulanmalıdır.", + "parent": "V15.2" + }, + { + "bom-ref": "V15.2.2", + "identifier": "V15.2.2", + "text": "Uygulamanın, belgelenmiş güvenlik kararları ve stratejilere dayanarak, zaman veya kaynak açısından yoğun işlevlerin neden olabileceği kullanılabilirlik kaybına karşı savunmalar uyguladığı doğrulanmalıdır.", + "parent": "V15.2" + }, + { + "bom-ref": "V15.2.3", + "identifier": "V15.2.3", + "text": "Üretim ortamının yalnızca uygulamanın çalışması için gerekli işlevleri içerdiği ve test kodları, örnek kod parçaları veya geliştirme işlevleri gibi gereksiz işlevsellikleri açığa çıkarmadığı doğrulanmalıdır.", + "parent": "V15.2" + }, + { + "bom-ref": "V15.2.4", + "identifier": "V15.2.4", + "text": "Üçüncü taraf bileşenlerin ve bunların tüm transitif bağımlılıklarının beklenen depolardan (iç kaynaklı ya da harici) alındığı ve bağımlılık karışıklığı (dependency confusion) saldırılarına açık olmadığı doğrulanmalıdır.", + "parent": "V15.2" + }, + { + "bom-ref": "V15.2.5", + "identifier": "V15.2.5", + "text": "Uygulamanın, “tehlikeli işlevsellik” içeren veya “riskli bileşenler” kullanan bölümlerine ek korumalar uyguladığı doğrulanmalıdır. Bu korumalar sandbox, kapsülleme, konteynerleştirme veya ağ düzeyinde izolasyon gibi teknikler aracılığıyla, bir uygulama bölümünün ele geçirilmesi durumunda saldırganın diğer bölümlere sıçramasını geciktirmeyi veya engellemeyi amaçlamalıdır.", + "parent": "V15.2" + }, + { + "bom-ref": "V15.3", + "identifier": "V15.3", + "title": "Savunmacı Kodlama", + "parent": "V15" + }, + { + "bom-ref": "V15.3.1", + "identifier": "V15.3.1", + "text": "Uygulamanın yalnızca gerekli alanların bir alt kümesini veri nesnesinden döndürdüğü doğrulanmalıdır. Örneğin, bazı alanlara kullanıcıların erişmemesi gerektiğinden tüm veri nesnesi döndürülmemelidir.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.2", + "identifier": "V15.3.2", + "text": "Uygulama backend'i harici URL’lere çağrı yaptığında, yalnızca amaçlanan işlevsellik söz konusuysa yönlendirmeleri takip edecek şekilde yapılandırıldığının doğrulanması gerekir.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.3", + "identifier": "V15.3.3", + "text": "Uygulamanın, kitlesel atama saldırılarına karşı, her bir controller ve eylem için izin verilen alanları sınırlandırarak savunmalar sağladığı doğrulanmalıdır. Örneğin, bir alan değeri, bu işlemde değiştirilmesi amaçlanmadıysa eklenememeli veya güncellenememelidir.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.4", + "identifier": "V15.3.4", + "text": "Tüm proxy ve ara katman bileşenlerinin kullanıcının orijinal IP adresini, uç kullanıcı tarafından değiştirilemeyecek güvenilir veri alanları kullanarak doğru şekilde ilettiği ve uygulamanın ve web sunucusunun bu doğru değeri, loglama ve hız sınırlama gibi güvenlik kararları için kullandığı doğrulanmalıdır. Ayrıca, orijinal IP adresinin bile dinamik IP'ler, VPN'ler veya kurumsal güvenlik duvarları nedeniyle güvenilir olmayabileceği dikkate alınmalıdır.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.5", + "identifier": "V15.3.5", + "text": "Uygulamanın değişkenlerin doğru türde olduğunu açıkça doğruladığı ve sıkı eşitlik ve karşılaştırma işlemleri kullandığı doğrulanmalıdır. Bu, değişken türüyle ilgili varsayımlardan kaynaklanan tür oynama (type juggling) veya tür karışıklığı (type confusion) güvenlik açıklarını önlemek içindir.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.6", + "identifier": "V15.3.6", + "text": "JavaScript kodunun prototip zehirleme (prototype pollution) saldırılarını önleyecek şekilde yazıldığı, örneğin, nesne literal’leri yerine Set() veya Map() gibi yapılar kullanıldığı doğrulanmalıdır.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.7", + "identifier": "V15.3.7", + "text": "Uygulamanın, özellikle framework'ün istek parametrelerinin kaynağı (sorgu dizgisi, gövde parametreleri, çerezler veya başlık alanları) arasında ayrım yapmadığı durumlarda, HTTP parametre kirliliği (HTTP parameter pollution) saldırılarına karşı savunmalar uyguladığı doğrulanmalıdır.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.4", + "identifier": "V15.4", + "title": "Güvenli Eş Zamanlılık (Concurrency)", + "parent": "V15" + }, + { + "bom-ref": "V15.4.1", + "identifier": "V15.4.1", + "text": "Çok iş parçacıklı kodda (örneğin cache'ler, dosyalar veya birden fazla iş parçacığı tarafından erişilen bellek içi nesneler gibi) paylaşılan nesnelere yalnızca thread-safe (iş parçacığı güvenli) türler ve kilitleme (lock) veya semaphore gibi senkronizasyon mekanizmaları kullanılarak erişildiği doğrulanmalıdır. Bu, yarış durumlarını ve veri bozulmasını önlemeye yöneliktir.", + "parent": "V15.4" + }, + { + "bom-ref": "V15.4.2", + "identifier": "V15.4.2", + "text": "Bir kaynağın durumu üzerindeki kontroller (örneğin varlığı ya da izinleri gibi) ile bu kontrole bağlı eylemlerin tek bir atomik işlem olarak gerçekleştirildiği doğrulanmalıdır. Bu, TOCTOU (time-of-check to time-of-use) yarış durumlarını önlemeye yöneliktir. Bir dosyanın varlığının kontrol edilip ardından açılması veya bir kullanıcının erişiminin doğrulanıp ardından yetki verilmesi gibi işlemler buna örnektir.", + "parent": "V15.4" + }, + { + "bom-ref": "V15.4.3", + "identifier": "V15.4.3", + "text": "Kilitlerin (locks) tutarlı biçimde kullanıldığı, iş parçacıklarının birbirini beklemesi ya da sonsuz döngüye girmesi (deadlock veya livelock) gibi durumların önlendiği doğrulanmalıdır. Ayrıca, kilitleme mantığı, kaynağı yöneten kod içinde kalmalı ve dış sınıflar veya dış kodlar tarafından istemeden veya kötü niyetli şekilde değiştirilememelidir.", + "parent": "V15.4" + }, + { + "bom-ref": "V15.4.4", + "identifier": "V15.4.4", + "text": "Kaynak tahsis politikalarının, iş parçacığı açlığını önleyecek şekilde, kaynaklara adil erişimi sağladığı doğrulanmalıdır. Örneğin, thread pool (iş parçacığı havuzu) kullanımı, düşük öncelikli iş parçacıklarının da makul sürelerde çalışabilmesi için uygulanmalıdır.", + "parent": "V15.4" + }, + { + "bom-ref": "V16", + "identifier": "V16", + "title": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi" + }, + { + "bom-ref": "V16.1", + "identifier": "V16.1", + "title": "Güvenlik Loglaması Dokümantasyonu", + "parent": "V16" + }, + { + "bom-ref": "V16.1.1", + "identifier": "V16.1.1", + "text": "Uygulamanın teknoloji yığını boyunca her katmanda hangi olayların loglandığını, log formatlarını, logların nereye yazıldığını, nasıl kullanıldığını, erişimin nasıl kontrol edildiğini ve logların ne kadar süre saklandığını belgeleyen bir envanterin mevcut olduğu doğrulanmalıdır.", + "parent": "V16.1" + }, + { + "bom-ref": "V16.2", + "identifier": "V16.2", + "title": "Genel Loglama", + "parent": "V16" + }, + { + "bom-ref": "V16.2.1", + "identifier": "V16.2.1", + "text": "Her bir log girdisinin, olayın ne zaman, nerede, kim tarafından ve ne olduğuna dair detaylı bir zaman çizelgesi oluşturulmasına olanak tanıyacak gerekli meta verileri içerdiği doğrulanmalıdır.", + "parent": "V16.2" + }, + { + "bom-ref": "V16.2.2", + "identifier": "V16.2.2", + "text": "Tüm loglama bileşenlerinin zaman kaynaklarının senkronize olduğu ve güvenlik olayı meta verisindeki zaman damgalarının UTC kullanarak ya da açık zaman dilimi ofsetiyle belirtildiği doğrulanmalıdır. UTC kullanımı, özellikle yaz saati uygulamaları nedeniyle oluşabilecek karışıklıkları önlemek için tavsiye edilir.", + "parent": "V16.2" + }, + { + "bom-ref": "V16.2.3", + "identifier": "V16.2.3", + "text": "Uygulamanın yalnızca log envanterinde belgelenmiş dosya ve hizmetlere log yazdığı ya da ilettiği doğrulanmalıdır.", + "parent": "V16.2" + }, + { + "bom-ref": "V16.2.4", + "identifier": "V16.2.4", + "text": "Logların kullanılan log işleyici (log processor) tarafından okunabildiği ve ilişkilendirilebildiği doğrulanmalıdır. Tercihen yaygın bir log formatı kullanılmalıdır.", + "parent": "V16.2" + }, + { + "bom-ref": "V16.2.5", + "identifier": "V16.2.5", + "text": "Hassas veriler loglanırken, uygulamanın veri koruma seviyesine uygun olarak loglama yaptığı doğrulanmalıdır. Örneğin kimlik bilgileri veya ödeme detayları gibi bazı verilerin loglanmasına izin verilmemelidir. Session token’ları gibi veriler ise yalnızca tamamen ya da kısmen maskelenmiş ya da hash’lenmiş olarak loglanmalıdır.", + "parent": "V16.2" + }, + { + "bom-ref": "V16.3", + "identifier": "V16.3", + "title": "Güvenlik Olayları", + "parent": "V16" + }, + { + "bom-ref": "V16.3.1", + "identifier": "V16.3.1", + "text": "Tüm kimlik doğrulama işlemlerinin (başarılı ve başarısız girişimler dahil) loglandığı doğrulanmalıdır. Kullanılan kimlik doğrulama türü veya faktörleri gibi ek meta veriler de toplanmalıdır.", + "parent": "V16.3" + }, + { + "bom-ref": "V16.3.2", + "identifier": "V16.3.2", + "text": "Başarısız yetkilendirme girişimlerinin loglandığı doğrulanmalıdır. Seviye 3 uygulamalar için, tüm yetkilendirme kararlarının ve hassas verilere erişim olaylarının (verinin kendisi olmadan) loglandığı da doğrulanmalıdır.", + "parent": "V16.3" + }, + { + "bom-ref": "V16.3.3", + "identifier": "V16.3.3", + "text": "Uygulamanın, belgelenmiş güvenlik olaylarını ve güvenlik kontrollerini aşma girişimlerini (girdi doğrulama, iş mantığı, otomasyon karşıtı kontroller vb.) logladığı doğrulanmalıdır.", + "parent": "V16.3" + }, + { + "bom-ref": "V16.3.4", + "identifier": "V16.3.4", + "text": "Beklenmeyen hatalar ve güvenlik kontrolü başarısızlıkları (örneğin backend TLS hataları gibi) loglandığı doğrulanmalıdır.", + "parent": "V16.3" + }, + { + "bom-ref": "V16.4", + "identifier": "V16.4", + "title": "Log Koruması", + "parent": "V16" + }, + { + "bom-ref": "V16.4.1", + "identifier": "V16.4.1", + "text": "Tüm loglama bileşenlerinin, log enjeksiyonunu (log injection) önlemek amacıyla verileri uygun biçimde encode ettiği doğrulanmalıdır.", + "parent": "V16.4" + }, + { + "bom-ref": "V16.4.2", + "identifier": "V16.4.2", + "text": "Logların yetkisiz erişime karşı korunduğu ve değiştirilemez olduğu doğrulanmalıdır.", + "parent": "V16.4" + }, + { + "bom-ref": "V16.4.3", + "identifier": "V16.4.3", + "text": "Logların analiz, tespit, uyarı ve yükseltme amacıyla mantıksal olarak ayrı bir sisteme güvenli biçimde iletildiği doğrulanmalıdır. Böylece uygulama ihlal edilse bile logların tehlikeye girmesi önlenmiş olur.", + "parent": "V16.4" + }, + { + "bom-ref": "V16.5", + "identifier": "V16.5", + "title": "Hata Yönetimi", + "parent": "V16" + }, + { + "bom-ref": "V16.5.1", + "identifier": "V16.5.1", + "text": "Beklenmedik ya da güvenlikle ilgili bir hata oluştuğunda, tüketiciye genel bir mesaj döndürüldüğü ve yığın izleri (stack trace), sorgular, gizli anahtarlar, token’lar gibi hassas sistem içi verilerin açıklanmadığı doğrulanmalıdır.", + "parent": "V16.5" + }, + { + "bom-ref": "V16.5.2", + "identifier": "V16.5.2", + "text": "Uygulamanın, dış kaynaklara erişim başarısız olduğunda bile güvenli şekilde çalışmaya devam ettiği doğrulanmalıdır. Örneğin, circuit breaker ya da graceful degradation gibi desenler kullanılmalıdır.", + "parent": "V16.5" + }, + { + "bom-ref": "V16.5.3", + "identifier": "V16.5.3", + "text": "Uygulamanın hata durumlarında güvenli ve düzenli şekilde başarısız olduğu doğrulanmalıdır. Bu, örneğin doğrulama hatalarına rağmen işlemlerin işlenmesine yol açabilecek fail-open durumlarını önlemelidir.", + "parent": "V16.5" + }, + { + "bom-ref": "V16.5.4", + "identifier": "V16.5.4", + "text": "Ele alınmamış tüm istisnaları yakalayacak şekilde tanımlanmış bir “son çare hata yöneticisi” bulunduğu doğrulanmalıdır. Bu, hem loglara gitmesi gereken hata detaylarının kaybolmaması hem de tüm uygulama sürecinin çökerek hizmet dışı kalmasının önlenmesi açısından önemlidir.", + "parent": "V16.5" + }, + { + "bom-ref": "V17", + "identifier": "V17", + "title": "WebRTC" + }, + { + "bom-ref": "V17.1", + "identifier": "V17.1", + "title": "TURN Sunucusu", + "parent": "V17" + }, + { + "bom-ref": "V17.1.1", + "identifier": "V17.1.1", + "text": "TURN hizmetinin yalnızca özel amaçlar için ayrılmamış IP adreslerine (ör. iç ağlar, yayın adresleri, loopback) erişime izin verdiği doğrulanmalıdır. Bu gereksinim hem IPv4 hem de IPv6 adresleri için geçerlidir.", + "parent": "V17.1" + }, + { + "bom-ref": "V17.1.2", + "identifier": "V17.1.2", + "text": "TURN hizmetinin, meşru kullanıcıların sunucuda çok sayıda bağlantı noktası açmaya çalışması durumunda kaynak tüketimi saldırılarına karşı dayanıklı olduğu doğrulanmalıdır.", + "parent": "V17.1" + }, + { + "bom-ref": "V17.2", + "identifier": "V17.2", + "title": "Medya", + "parent": "V17" + }, + { + "bom-ref": "V17.2.1", + "identifier": "V17.2.1", + "text": "DTLS sertifikası anahtarının, belgelenmiş kriptografik anahtar yönetim politikasına uygun şekilde yönetildiği ve korunduğu doğrulanmalıdır.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.2", + "identifier": "V17.2.2", + "text": "Medya sunucusunun onaylı DTLS şifre takımlarını (cipher suites) ve Güvenli Gerçek Zamanlı Aktarım Protokolü (Secure Real-time Transport Protocol - SRTP) için anahtarlar oluşturmaya yönelik DTLS Uzantısı için güvenli bir koruma profilini kullanacak ve destekleyecek şekilde yapılandırıldığı (DTLS-SRTP) doğrulanmalıdır.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.3", + "identifier": "V17.2.3", + "text": "Real-time Transport Protocol (RTP) injection saldırılarının bir hizmet reddi durumuna veya medya akışlarına ses veya video medyası eklenmesine yol açmasını önlemek için medya sunucusunda Güvenli SRTP kimlik doğrulamasının kontrol edildiği doğrulanmalıdır.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.4", + "identifier": "V17.2.4", + "text": "Verify that the media server is able to continue processing incoming media traffic when encountering malformed Secure Real-time Transport Protocol (SRTP) packets.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.5", + "identifier": "V17.2.5", + "text": "Medya sunucusunun, meşru kullanıcılardan gelen SRTP flood'ı sırasında gelen medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.6", + "identifier": "V17.2.6", + "text": "Medya sunucusunun DTLS içinde yer alan \"ClientHello\" yarış durumu güvenlik açığına karşı savunmasız olmadığı, medya sunucusunun güvenlik açığına sahip olduğunun açıkça bilinip bilinmediği kontrol edilerek veya yarış koşulu testi gerçekleştirilerek doğrulanmalıdır.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.7", + "identifier": "V17.2.7", + "text": "Medya sunucusuna bağlı ses veya video kayıt mekanizmalarının, meşru kullanıcı kaynaklı SRTP flood'ı sırasında medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.8", + "identifier": "V17.2.8", + "text": "DTLS sertifikasının, SDP (Session Description Protocol) fingerprint özelliği ile karşılaştırıldığı ve doğrulama başarısız olursa medya akışının sonlandırıldığı, medya akışının özgünlüğünü sağlamak için doğrulanmalıdır.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.3", + "identifier": "V17.3", + "title": "Sinyalizasyon", + "parent": "V17" + }, + { + "bom-ref": "V17.3.1", + "identifier": "V17.3.1", + "text": "Sinyalizasyon sunucusunun, flood saldırısı altında bile meşru sinyalizasyon mesajlarını işlemeye devam edebildiği doğrulanmalıdır. Bu, sinyalizasyon düzeyinde oran sınırlaması uygulanarak sağlanmalıdır.", + "parent": "V17.3" + }, + { + "bom-ref": "V17.3.2", + "identifier": "V17.3.2", + "text": "Sinyalizasyon sunucusunun, hizmet reddine yol açabilecek şekilde yapılandırılmış bozuk sinyalizasyon mesajlarıyla karşılaştığında bile meşru mesajları işlemeye devam edebildiği doğrulanmalıdır. Bu, girdi doğrulaması, integer overflow ve buffer overflow'a karşı savunma ve sağlam hata işleme teknikleri ile sağlanmalıdır.", + "parent": "V17.3" + } + ], + "levels": [ + { + "bom-ref": "level-1", + "identifier": "Level 1", + "description": "This level contains the minimum requirements to consider when securing an application and represents a critical starting point.", + "requirements": [ + "V1.2.1", + "V1.2.2", + "V1.2.3", + "V1.2.4", + "V1.2.5", + "V1.3.1", + "V1.3.2", + "V1.5.1", + "V2.1.1", + "V2.2.1", + "V2.2.2", + "V2.3.1", + "V3.2.1", + "V3.2.2", + "V3.3.1", + "V3.4.2", + "V3.5.1", + "V3.5.2", + "V4.1.1", + "V4.4.1", + "V5.2.1", + "V5.2.2", + "V5.3.1", + "V5.3.2", + "V6.1.1", + "V6.2.1", + "V6.2.2", + "V6.2.3", + "V6.2.4", + "V6.2.5", + "V6.2.6", + "V6.2.7", + "V6.2.8", + "V6.3.1", + "V6.3.2", + "V6.4.1", + "V6.4.2", + "V7.2.1", + "V7.2.2", + "V7.2.3", + "V7.2.4", + "V7.4.1", + "V7.4.2", + "V8.1.1", + "V8.2.1", + "V8.2.2", + "V8.3.1", + "V9.1.1", + "V9.1.2", + "V9.1.3", + "V9.2.1", + "V10.4.1", + "V10.4.2", + "V10.4.3", + "V10.4.4", + "V10.4.5", + "V11.3.1", + "V11.3.2", + "V11.4.1", + "V12.1.1", + "V12.2.1", + "V12.2.2", + "V13.4.1", + "V14.2.1", + "V14.3.1", + "V15.1.1", + "V15.2.1", + "V15.3.1" + ] + }, + { + "bom-ref": "level-2", + "identifier": "Level 2", + "description": "ASVS Level 2 requirements generally relate to either less common attacks or more complicated protections against common attacks. They may still be a first layer of defense, or they may require certain preconditions for the attack to be successful.", + "requirements": [ + "V1.1.1", + "V1.1.2", + "V1.2.6", + "V1.2.7", + "V1.2.8", + "V1.2.9", + "V1.3.3", + "V1.3.4", + "V1.3.5", + "V1.3.6", + "V1.3.7", + "V1.3.8", + "V1.3.9", + "V1.3.10", + "V1.3.11", + "V1.4.1", + "V1.4.2", + "V1.4.3", + "V1.5.2", + "V2.1.2", + "V2.1.3", + "V2.2.3", + "V2.3.2", + "V2.3.3", + "V2.3.4", + "V2.4.1", + "V3.3.2", + "V3.3.3", + "V3.3.4", + "V3.4.3", + "V3.4.4", + "V3.4.5", + "V3.4.6", + "V3.5.4", + "V3.7.1", + "V3.7.2", + "V4.1.2", + "V4.1.3", + "V4.2.1", + "V4.3.1", + "V4.3.2", + "V4.4.2", + "V4.4.3", + "V4.4.4", + "V5.1.1", + "V5.2.3", + "V5.4.1", + "V5.4.2", + "V5.4.3", + "V6.1.2", + "V6.1.3", + "V6.2.9", + "V6.2.10", + "V6.2.11", + "V6.2.12", + "V6.3.3", + "V6.3.4", + "V6.4.3", + "V6.4.4", + "V6.5.1", + "V6.5.2", + "V6.5.3", + "V6.5.4", + "V6.5.5", + "V6.6.1", + "V6.6.2", + "V6.6.3", + "V6.8.1", + "V6.8.2", + "V6.8.3", + "V6.8.4", + "V7.1.1", + "V7.1.2", + "V7.1.3", + "V7.3.1", + "V7.3.2", + "V7.4.3", + "V7.4.4", + "V7.4.5", + "V7.5.1", + "V7.5.2", + "V7.6.1", + "V7.6.2", + "V8.1.2", + "V8.2.3", + "V8.4.1", + "V9.2.2", + "V9.2.3", + "V9.2.4", + "V10.1.1", + "V10.1.2", + "V10.2.1", + "V10.2.2", + "V10.3.1", + "V10.3.2", + "V10.3.3", + "V10.3.4", + "V10.4.6", + "V10.4.7", + "V10.4.8", + "V10.4.9", + "V10.4.10", + "V10.4.11", + "V10.5.1", + "V10.5.2", + "V10.5.3", + "V10.5.4", + "V10.5.5", + "V10.6.1", + "V10.6.2", + "V10.7.1", + "V10.7.2", + "V10.7.3", + "V11.1.1", + "V11.1.2", + "V11.2.1", + "V11.2.2", + "V11.2.3", + "V11.3.3", + "V11.4.2", + "V11.4.3", + "V11.4.4", + "V11.5.1", + "V11.6.1", + "V12.1.2", + "V12.1.3", + "V12.3.1", + "V12.3.2", + "V12.3.3", + "V12.3.4", + "V13.1.1", + "V13.2.1", + "V13.2.2", + "V13.2.3", + "V13.2.4", + "V13.2.5", + "V13.3.1", + "V13.3.2", + "V13.4.2", + "V13.4.3", + "V13.4.4", + "V13.4.5", + "V14.1.1", + "V14.1.2", + "V14.2.2", + "V14.2.3", + "V14.2.4", + "V14.3.2", + "V14.3.3", + "V15.1.2", + "V15.1.3", + "V15.2.2", + "V15.2.3", + "V15.3.2", + "V15.3.3", + "V15.3.4", + "V15.3.5", + "V15.3.6", + "V15.3.7", + "V16.1.1", + "V16.2.1", + "V16.2.2", + "V16.2.3", + "V16.2.4", + "V16.2.5", + "V16.3.1", + "V16.3.2", + "V16.3.3", + "V16.3.4", + "V16.4.1", + "V16.4.2", + "V16.4.3", + "V16.5.1", + "V16.5.2", + "V16.5.3", + "V17.1.1", + "V17.2.1", + "V17.2.2", + "V17.2.3", + "V17.2.4", + "V17.3.1", + "V17.3.2" + ] + }, + { + "bom-ref": "level-3", + "identifier": "Level 3", + "description": "ASVS Level 3 should be the goal for applications looking to demonstrate the highest levels of security and requirements in this section are generally either defense-in-depth mechanisms or other useful but hard-to-implement controls.", + "requirements": [ + "V1.2.10", + "V1.3.12", + "V1.5.3", + "V2.3.5", + "V2.4.2", + "V3.1.1", + "V3.2.3", + "V3.3.5", + "V3.4.8", + "V3.5.6", + "V3.5.7", + "V3.5.8", + "V3.6.1", + "V3.7.3", + "V3.7.4", + "V3.7.5", + "V4.1.4", + "V4.1.5", + "V4.2.2", + "V4.2.3", + "V4.2.4", + "V4.2.5", + "V5.2.4", + "V5.2.5", + "V5.2.6", + "V5.3.3", + "V6.3.5", + "V6.3.6", + "V6.3.7", + "V6.3.8", + "V6.4.5", + "V6.4.6", + "V6.5.6", + "V6.5.7", + "V6.5.8", + "V6.6.4", + "V6.7.1", + "V6.7.2", + "V7.5.3", + "V8.1.3", + "V8.1.4", + "V8.2.4", + "V8.3.2", + "V8.3.3", + "V8.4.2", + "V10.2.3", + "V10.3.5", + "V10.4.12", + "V10.4.13", + "V10.4.14", + "V10.4.15", + "V10.4.16", + "V11.1.3", + "V11.1.4", + "V11.2.4", + "V11.2.5", + "V11.3.4", + "V11.3.5", + "V11.5.2", + "V11.6.2", + "V11.7.1", + "V11.7.2", + "V12.1.4", + "V12.1.5", + "V12.3.5", + "V13.1.2", + "V13.1.3", + "V13.1.4", + "V13.2.6", + "V13.3.3", + "V13.3.4", + "V13.4.6", + "V13.4.7", + "V14.2.5", + "V14.2.6", + "V14.2.7", + "V14.2.8", + "V15.1.4", + "V15.1.5", + "V15.2.4", + "V15.2.5", + "V15.4.1", + "V15.4.2", + "V15.4.3", + "V15.4.4", + "V16.5.4", + "V17.1.2", + "V17.2.5", + "V17.2.6", + "V17.2.7", + "V17.2.8" + ] + } + ], + "externalReferences": [ + { + "type": "website", + "url": "https://owasp.org/asvs" + }, + { + "type": "vcs", + "url": "https://github.com/OWASP/ASVS" + }, + { + "type": "issue-tracker", + "url": "https://github.com/OWASP/ASVS/issues" + }, + { + "type": "social", + "url": "https://twitter.com/OWASP_ASVS" + } + ] + } + ] + } +} diff --git a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.csv b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.csv new file mode 100644 index 0000000000..487b444c7d --- /dev/null +++ b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.csv @@ -0,0 +1,343 @@ +chapter_id,chapter_name,section_id,section_name,req_id,req_description,L +V1,Kodlama (Encoding) ve Temizleme,V1.1,Kodlama ve Temizleme Mimarisi,V1.1.1,"Girdinin yalnızca bir kez kanonik forma (canonical form) çözümlendiği veya kaçış işlemlerinin kaldırıldığı, bu işlemin yalnızca verinin bu biçimde beklenmesi durumunda yapıldığı ve bu işlemin girdi doğrulama veya temizleme işlemlerinden sonra değil, önce gerçekleştiği doğrulanmalıdır.",2 +V1,Kodlama (Encoding) ve Temizleme,V1.1,Kodlama ve Temizleme Mimarisi,V1.1.2,"Uygulamanın, çıktıyı kullanılması gereken yorumlayıcıya verilmeden hemen önce veya yorumlayıcının kendisi tarafından çıktı kodlaması ya da kaçış işlemi yaptığı doğrulanmalıdır.",2 +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.1,"HTTP yanıtı, HTML veya XML belgesi için yapılan çıktı kodlamasının; HTML elemanları, HTML öznitelikleri, HTML yorumları, CSS ya da HTTP başlık alanları gibi bağlamlara uygun olduğu doğrulanmalıdır. Böylece mesaj veya belge yapısının bozulması önlenir.",1 +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.2,"Dinamik olarak URL oluşturulurken, güvenilmeyen verinin bağlamına göre (örneğin, sorgu veya yol parametreleri için URL kodlaması ya da base64url kodlaması) kodlandığı doğrulanmalıdır. Yalnızca güvenli URL protokollerine izin verilmelidir (örneğin, javascript: veya data: yasaklanmalıdır).",1 +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.3,JavaScript içeriği (JSON dahil) dinamik olarak oluşturulurken çıktı kodlama/kaçış kullanıldığı doğrulanmalıdır. Böylece mesaj veya belge yapısı değiştirilmemiş olur (JavaScript ve JSON enjeksiyonlarının önüne geçilir).,1 +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.4,"Veri sorguları veya veritabanı sorguları (SQL, HQL, NoSQL, Cypher vb.) için parametreli sorgular, ORM’ler, entity framework’ler kullanıldığı ya da SQL enjeksiyonu ve diğer veritabanı enjeksiyon saldırılarına karşı koruma sağlandığı doğrulanmalıdır. Bu durum, saklı yordam (stored procedure) yazarken de geçerlidir.",1 +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.5,Uygulamanın işletim sistemi komut enjeksiyonlarına karşı korunduğu ve işletim sistemi çağrılarında parametreli OS sorguları veya bağlama özgü komut satırı çıktı kodlamasının kullanıldığı doğrulanmalıdır.,1 +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.6,Uygulamanın LDAP enjeksiyon zafiyetlerine karşı korunduğu ya da LDAP enjeksiyonlarını önlemek için özel güvenlik kontrollerinin uygulandığı doğrulanmalıdır.,2 +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.7,"XPath enjeksiyon saldırılarına karşı, sorgu parametrelemesi veya önceden derlenmiş sorgular kullanılarak koruma sağlandığı doğrulanmalıdır.",2 +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.8,"LaTeX işlemcilerinin güvenli şekilde yapılandırıldığı (örneğin, --shell-escape bayrağının kullanılmadığı) ve yalnızca izin verilen komutlardan oluşan bir listeyle çalıştırıldığı doğrulanmalıdır.",2 +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.9,Düzenli ifadelerde (regex) özel karakterlerin (genellikle ters eğik çizgi \ ile) kaçırılarak meta karakter olarak yorumlanmalarının önlendiği doğrulanmalıdır.,2 +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.10,"Uygulamanın CSV ve formül enjeksiyonlarına karşı korunduğu doğrulanmalıdır. Uygulama, CSV içeriği dışa aktarırken RFC 4180 Bölüm 2.6 ve 2.7'de tanımlanan kaçış kurallarına uymalıdır. Ayrıca, CSV veya diğer tablo formatlarına (XLS, XLSX, ODF gibi) aktarım yapılırken, alanın ilk karakteri olarak çıkan özel karakterler ('=', '+', '-', '@', '\t' (sekme), '\0' (null karakter)) tek tırnak (') ile kaçırılmalıdır.",3 +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.1,"WYSIWYG editörlerinden veya benzer kaynaklardan gelen tüm güvenilmeyen HTML girdilerinin, bilinen ve güvenli bir HTML temizleme kütüphanesi ya da çerçeve özelliği ile temizlendiği doğrulanmalıdır.",1 +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.2,"Uygulamanın eval() veya Spring Expression Language (SpEL) gibi dinamik kod çalıştırma özelliklerini kullanmaktan kaçındığı doğrulanmalıdır. Alternatif yoksa, kullanıcı girdisi çalıştırılmadan önce mutlaka temizlenmelidir.",1 +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.3,"Potansiyel olarak tehlikeli bir bağlamda kullanılacak verilerin, bu bağlama uygun karakterlere izin vermek ve çok uzun girdileri kısaltmak gibi güvenlik önlemleriyle önceden temizlendiği doğrulanmalıdır.",2 +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.4,"Kullanıcı tarafından sağlanan SVG içeriğinin, yalnızca güvenli etiket ve özellikler (örneğin grafik çizme ile ilgili) içerdiğinden emin olmak için onaylandığı veya temizlendiği doğrulanmalıdır (ör. script veya foreignObject içermemelidir).",2 +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.5,"Markdown, CSS, XSL stil sayfaları, BBCode veya benzeri ifade şablon dillerinde kullanıcı girdisinin temizlendiği veya bu tür özelliklerin devre dışı bırakıldığı doğrulanmalıdır.",2 +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.6,"Uygulamanın, güvenilmeyen verileri başka servislere iletmeden önce izinli protokol, alan adı, yol ve port listelerine göre doğruladığı ve tehlikeli karakterleri temizlediği doğrulanarak SSRF (Sunucu Taraflı İstek Sahteciliği) saldırılarına karşı korunduğu doğrulanmalıdır.",2 +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.7,"Uygulamanın şablon enjeksiyon saldırılarına karşı, güvenilmeyen girdilere dayalı şablon oluşturmayı engellediği; eğer bu kaçınılmazsa, bu girdilerin mutlaka temizlendiği veya sıkı şekilde onaylandığı doğrulanmalıdır.",2 +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.8,JNDI sorgularında kullanılmadan önce güvenilmeyen girdilerin temizlendiği ve JNDI'nin enjeksiyonlara karşı güvenli şekilde yapılandırıldığı doğrulanmalıdır.,2 +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.9,Memcache’e gönderilmeden önce içeriğin temizlenerek enjeksiyon saldırılarına karşı korunduğu doğrulanmalıdır.,2 +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.10,Format dizgilerinin (format strings) beklenmeyen veya zararlı şekilde çözümlenmesini önlemek için işlenmeden önce temizlendiği doğrulanmalıdır.,2 +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.11,"SMTP veya IMAP enjeksiyonlarını önlemek için, kullanıcı girdisinin posta sistemlerine iletilmeden önce temizlendiği doğrulanmalıdır.",2 +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.12,Regex girdilerinin üstel geri izlemeye (exponential backtracking) neden olan öğeler içermediği ve güvenilmeyen girdilerin ReDoS (Regex Denial of Service) gibi saldırılara karşı temizlendiği doğrulanmalıdır.,3 +V1,Kodlama (Encoding) ve Temizleme,V1.4,"Bellek, Dizgi ve Yönetilmeyen Kod",V1.4.1,"Yığın, arabellek (buffer) veya yığın belleği taşmalarını önlemek ya da tespit etmek amacıyla, bellek güvenli dizgi işlemlerinin, daha güvenli bellek kopyalama ve işaretçi aritmetiğinin kullanıldığı doğrulanmalıdır.",2 +V1,Kodlama (Encoding) ve Temizleme,V1.4,"Bellek, Dizgi ve Yönetilmeyen Kod",V1.4.2,"Tamsayı taşmalarını önlemek için işaret (sign), aralık (range) ve giriş doğrulama tekniklerinin kullanıldığı doğrulanmalıdır.",2 +V1,Kodlama (Encoding) ve Temizleme,V1.4,"Bellek, Dizgi ve Yönetilmeyen Kod",V1.4.3,Dinamik olarak ayrılan belleğin ve kaynakların serbest bırakıldığı ve boşaltılan belleklere ait referansların veya işaretçilerin kaldırıldığı veya null yapıldığı doğrulanmalıdır (dangling pointer ve use-after-free zafiyetlerine karşı).,2 +V1,Kodlama (Encoding) ve Temizleme,V1.5,Güvenli Ters Serileştirme (Safe Deserialization),V1.5.1,XML ayrıştırıcılarının (parser) kısıtlayıcı şekilde yapılandırıldığı ve dış varlık çözümleme (external entity resolution) gibi güvensiz özelliklerin XXE (XML eXternal Entity) saldırılarına karşı devre dışı bırakıldığı doğrulanmalıdır .,1 +V1,Kodlama (Encoding) ve Temizleme,V1.5,Güvenli Ters Serileştirme (Safe Deserialization),V1.5.2,"Güvenilmeyen verilerin ters serileştirilmesinde, nesne türleri için izinli liste kullanımı veya istemci tanımlı nesne türlerinin kısıtlanması gibi güvenli giriş işleme önlemlerinin uygulandığı doğrulanmalıdır. Güvensiz olarak tanımlanmış ters serileştirme mekanizmaları, güvenilmeyen girdilerle kullanılmamalıdır.",2 +V1,Kodlama (Encoding) ve Temizleme,V1.5,Güvenli Ters Serileştirme (Safe Deserialization),V1.5.3,"Aynı veri türü için uygulamada kullanılan farklı parser'ların (ör. JSON, XML, URL parser'ları), veriyi tutarlı şekilde ayrıştırdığı ve aynı karakter kodlamasını kullandığı doğrulanmalıdır. Böylece JSON birlikte çalışabilirlik açıkları, URI veya dosya ayrıştırma farkları gibi sorunlar nedeniyle RFI veya SSRF saldırılarının istismar edilmesi önlenir.",3 +V2,Doğrulama ve İş Mantığı,V2.1,Doğrulama ve İş Mantığı Dokümantasyonu,V2.1.1,"Uygulama dokümantasyonunda, veri öğelerinin beklenen yapıya göre nasıl doğrulanacağına ilişkin giriş doğrulama kurallarının tanımlandığı doğrulanmalıdır. Bu; kredi kartı numaraları, e-posta adresleri, telefon numaraları gibi yaygın veri biçimleri olabileceği gibi iç sistemlere özel biçimler de olabilir.",1 +V2,Doğrulama ve İş Mantığı,V2.1,Doğrulama ve İş Mantığı Dokümantasyonu,V2.1.2,"Uygulama dokümantasyonunda, birleştirilmiş veri öğelerinin mantıksal ve bağlamsal tutarlılığının nasıl doğrulanacağı tanımlanmalıdır (örneğin, mahalle ve posta kodunun eşleşip eşleşmediğinin kontrolü).",2 +V2,Doğrulama ve İş Mantığı,V2.1,Doğrulama ve İş Mantığı Dokümantasyonu,V2.1.3,"Hem kullanıcı bazında hem de uygulama genelinde geçerli olacak şekilde, iş mantığı sınırları ve doğrulama beklentilerinin belgelendiği doğrulanmalıdır.",2 +V2,Doğrulama ve İş Mantığı,V2.2,Girdi Doğrulama,V2.2.1,"Girdilerin, işlevsel ya da iş gereksinimlerine uygunluğunun doğrulandığı teyit edilmelidir. Bu işlem; izinli değerler, desenler ve aralıklar listesine karşı pozitif doğrulama ile ya da girdinin beklenen yapıya ve mantıksal sınırlara uygunluğunun önceden tanımlanmış kurallara göre karşılaştırılması ile yapılmalıdır. Seviye 1 için bu, güvenlik veya iş kararlarında kullanılan girdilere odaklanabilir. Seviye 2 ve üstü için tüm girdilere uygulanmalıdır.",1 +V2,Doğrulama ve İş Mantığı,V2.2,Girdi Doğrulama,V2.2.2,"Uygulamanın, güvenilir bir servis katmanında girdi doğrulama zorunluluğu uygulayacak şekilde tasarlandığı doğrulanmalıdır. İstemci tarafında gerçekleştirilen doğrulama, kullanılabilirliği artırabilir ve teşvik edilmelidir. Ancak bu doğrulama,güvenlik kontrolü olarak kabul edilmemelidir.",1 +V2,Doğrulama ve İş Mantığı,V2.2,Girdi Doğrulama,V2.2.3,"Uygulamanın, ilişkili veri öğelerinin önceden tanımlanmış kurallara göre makul olup olmadığını kontrol ettiği doğrulanmalıdır.",2 +V2,Doğrulama ve İş Mantığı,V2.3,İş Mantığı Güvenliği,V2.3.1,"Uygulamanın, aynı kullanıcı için iş mantığı akışlarını yalnızca beklenen adım sırasına göre ve adım atlamadan işlediği doğrulanmalıdır.",1 +V2,Doğrulama ve İş Mantığı,V2.3,İş Mantığı Güvenliği,V2.3.2,"İş mantığı sınırlarının, uygulama dokümantasyonuna uygun şekilde uygulandığı doğrulanmalıdır.",2 +V2,Doğrulama ve İş Mantığı,V2.3,İş Mantığı Güvenliği,V2.3.3,İş mantığı seviyesinde işlemlerin (transaction) kullanıldığı ve bir iş mantığı işleminin ya bütünüyle başarıyla tamamlandığı ya da önceki geçerli duruma geri döndürüldüğü (rollback) doğrulanmalıdır.,2 +V2,Doğrulama ve İş Mantığı,V2.3,İş Mantığı Güvenliği,V2.3.4,"İş mantığı düzeyinde kilitleme mekanizmalarının, sınırlı kaynakların (ör. sinema koltukları, teslimat zamanları) uygulamanın mantığı manipüle edilerek çift rezervasyona neden olmamasını sağladığı doğrulanmalıdır.",2 +V2,Doğrulama ve İş Mantığı,V2.3,İş Mantığı Güvenliği,V2.3.5,"Yüksek değerli iş mantığı akışlarının, yetkisiz veya kazara gerçekleşebilecek işlemleri önlemek için çoklu kullanıcı onayı gerektirdiği doğrulanmalıdır. Bu işlemler büyük para transferleri, sözleşme onayları, gizli bilgilere erişim veya üretimde güvenlik kurallarının geçersiz kılınmaları gibi durumları içerebilir.",3 +V2,Doğrulama ve İş Mantığı,V2.4,Otomasyon Karşıtı Önlemler,V2.4.1,"Uygulama işlevlerine yönelik aşırı miktardaki çağrılara karşı; veri sızdırma, anlamsız veri üretme, kota tüketme, hız sınırının aşılması, hizmet reddi (DoS) ya da maliyetli kaynakların aşırı kullanımı gibi risklere karşı otomasyon karşıtı kontrollerin bulunduğu doğrulanmalıdır.",2 +V2,Doğrulama ve İş Mantığı,V2.4,Otomasyon Karşıtı Önlemler,V2.4.2,"İş mantığı akışlarının, aşırı hızlı işlem gönderimlerini önleyecek şekilde gerçekçi insan zamanlaması gerektirdiği doğrulanmalıdır.",3 +V3,Web Ön Uç (Frontend) Güvenliği,V3.1,Web Frontend Güvenlik Dokümantasyonu,V3.1.1,"Uygulama dokümantasyonunda, uygulamayı kullanan tarayıcıların desteklemesi gereken güvenlik özelliklerinin (ör. HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) ve diğer ilgili HTTP güvenlik mekanizmaları) tanımlandığı doğrulanmalıdır. Ayrıca bu özelliklerin mevcut olmadığı durumlarda uygulamanın nasıl davranması gerektiği (ör. kullanıcıyı uyarmak veya erişimi engellemek) de tanımlanmalıdır.",3 +V3,Web Ön Uç (Frontend) Güvenliği,V3.2,İçeriğin Yanlış Yorumlanması,V3.2.1,"Tarayıcıların HTTP yanıtlarında içerik veya işlevi yanlış bir bağlamda sunmalarını önlemek amacıyla güvenlik kontrollerinin uygulandığı doğrulanmalıdır (ör. API, kullanıcı tarafından yüklenen dosya veya başka bir kaynağın doğrudan çağrılması durumunda). Olası kontroller arasında; yalnızca HTTP istek başlıklarının (ör. Sec-Fetch-\*) doğru bağlamı gösterdiği durumlarda içeriğin sunulması, Content-Security-Policy başlığında ""sandbox"" yönergesinin kullanılması veya Content-Disposition başlığında ""attachment"" biçiminin kullanılması yer alabilir.",1 +V3,Web Ön Uç (Frontend) Güvenliği,V3.2,İçeriğin Yanlış Yorumlanması,V3.2.2,"HTML yerine metin olarak görüntülenmesi amaçlanan içeriğin, HTML veya JavaScript gibi içeriklerin istenmeden çalıştırılmasını önleyecek şekilde ""createTextNode"" veya ""textContent"" gibi güvenli işleme fonksiyonlarıyla işlendiği doğrulanmalıdır.",1 +V3,Web Ön Uç (Frontend) Güvenliği,V3.2,İçeriğin Yanlış Yorumlanması,V3.2.3,"Uygulamanın istemci tarafı JavaScript kullanırken açık değişken tanımlamaları yaparak, sıkı tür kontrolü uygulayarak, global değişkenleri document nesnesine kaydetmekten kaçınarak ve ad alanı izolasyonu sağlayarak DOM clobbering’den kaçındığı doğrulanmalıdır.",3 +V3,Web Ön Uç (Frontend) Güvenliği,V3.3,Çerez Yapılandırması,V3.3.1,"Çerezlerin 'Secure' niteliğine sahip olduğu ve eğer çerez adı '\__Host-' ön eki ile başlamıyorsa, '__Secure-' ön ekinin kullanıldığı doğrulanmalıdır.",1 +V3,Web Ön Uç (Frontend) Güvenliği,V3.3,Çerez Yapılandırması,V3.3.2,"Kullanıcı arayüzü kandırma saldırılarına ve tarayıcı tabanlı istek sahteciliği saldırılarına (CSRF) karşı koruma sağlamak amacıyla, her çerezin 'SameSite' niteliğinin kullanım amacına uygun şekilde ayarlandığı doğrulanmalıdır.",2 +V3,Web Ön Uç (Frontend) Güvenliği,V3.3,Çerez Yapılandırması,V3.3.3,"Çerez adı, diğer sunucularla paylaşılmak üzere açıkça tasarlanmadığı sürece '__Host-' ön eki ile tanımlanmalıdır.",2 +V3,Web Ön Uç (Frontend) Güvenliği,V3.3,Çerez Yapılandırması,V3.3.4,"Bir çerez değeri istemci tarafı betikleri tarafından erişilememesi gereken bir veri içeriyorsa (ör. oturum token'ı), çerezin 'HttpOnly' niteliğine sahip olduğu ve aynı değerin (ör. oturum token'ı) yalnızca 'Set-Cookie' başlığı ile istemciye iletildiği doğrulanmalıdır.",2 +V3,Web Ön Uç (Frontend) Güvenliği,V3.3,Çerez Yapılandırması,V3.3.5,"Uygulama bir çerez oluştururken, çerez adı ve değerinin toplam uzunluğunun 4096 baytı aşmadığı doğrulanmalıdır. Çok büyük çerezler tarayıcı tarafından saklanmaz ve isteklerle gönderilmez; bu da çereze bağlı çalışan uygulama işlevlerinin bozulmasına yol açabilir.",3 +V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.2,"Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header'ı, uygulama tarafından sabit bir değer olarak tanımlanmalı veya gelen Origin header değeri güvenilir origin’lerden oluşan bir izinli listeye karşı doğrulanmalıdır. ‘Access-Control-Allow-Origin: *’ kullanılması gerekiyorsa, yanıtın hassas bilgi içermediği doğrulanmalıdır.",1 +V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.3,"HTTP yanıtlarında Content-Security-Policy header'ı bulunduğu ve bu header'ın yalnızca güvenilen içeriklerin veya kaynakların yüklenmesini ve çalıştırılmasını sağlayan yönergeler içerdiği doğrulanmalıdır. Minimum olarak ""global policy"", object-src 'none', base-uri 'none' yönergelerini içermeli ve izinli liste, nonce veya hash temelli bir yapı içermelidir. Seviye 3 uygulamalarında her yanıt için nonce veya hash içeren özel bir politika tanımlanmalıdır.",2 +V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.4,"Tüm HTTP yanıtlarının 'X-Content-Type-Options: nosniff' header'ını içerdiği doğrulanmalıdır. Bu, tarayıcıya içerik türünü tahmin etmeyi bırakmasını ve yanıtın Content-Type header'ında belirtilen MIME türünün, beklenen kaynak türüyle eşleşmesini zorunlu kılar. Ayrıca bu, tarayıcıda CORB (Cross-Origin Read Blocking) özelliğini etkinleştirir.",2 +V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.5,"Uygulamanın, 'Referer' başlığı yoluyla üçüncü taraflara teknik olarak hassas verilerin sızmasını önlemek için bir 'referrer policy' belirlediği doğrulanmalıdır. Bu, Referrer-Policy HTTP header'ıyla veya HTML öğe nitelikleriyle (element attributes) sağlanabilir. Sızabilecek hassas bilgiler, URL’deki yol ve sorgu parametreleri ile sınırlı uygulamalarda hostname bilgisini içerebilir.",2 +V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.6,"Uygulamanın, Content-Security-Policy header'ı altında 'frame-ancestors' yönergesini her HTTP yanıtında tanımladığı ve bu sayede içeriklerin varsayılan olarak başka sayfalara gömülmesini engellediği doğrulanmalıdır. Gerekli durumlarda özel olarak izin verildiğinden emin olunmalıdır. 'X-Frame-Options' header'ı, tarayıcılar tarafından desteklenmesine rağmen, artık güncel değildir ve güvenlik amacıyla kullanılmamalıdır.",2 +V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.8,"Bir belgenin işlenmesini ve sunulmasını başlatan tüm HTTP yanıtlarında (örneğin 'text/html' tipi yanıtlar), 'Cross-Origin-Opener-Policy' header'ı 'same-origin' veya 'same-origin-allow-popups' yönergeleriyle birlikte yer almalıdır. Bu, tabnabbing ve frame counting gibi, pencere nesnelerine paylaşımlı erişimi sömüren saldırılara karşı koruma sağlar.",3 +V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.1,"Uygulama, hassas işlevselliğe yönelik izinsiz cross-origin istekleri önlemek için CORS preflight mekanizmasına güvenmiyorsa, bu tür isteklerin gerçekten uygulamadan geldiği doğrulanmalıdır. Bu, anti-forgery token kullanımı veya CORS tarafından güvenli kabul edilmeyen özel HTTP header'larının zorunlu kılınmasıyla yapılabilir. Bu, tarayıcı tabanlı istek sahteciliği (CSRF) saldırılarına karşı bir savunmadır.",1 +V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.2,"Uygulama, hassas işlevlerin izinsiz cross-origin çağrılmasını önlemek için CORS preflight mekanizmasına güveniyorsa, bu işlevlerin bir CORS-preflight isteğini tetiklemeden çağrılamadığı doğrulanmalıdır. Bu, 'Origin' ve 'Content-Type' header'larının doğrulanmasını veya CORS-safelisted olmayan bir header'ın ve alanın kullanılmasını gerektirebilir.",1 +V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.4,"Farklı uygulamaların farklı hostname'lerde barındırıldığı ve böylece Same-Origin Policy tarafından sağlanan kısıtlamalardan (örneğin çerez erişim sınırları, kaynaklar arası etkileşim kontrolleri) faydalanıldığı doğrulanmalıdır.",2 +V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.6,"Uygulamanın herhangi bir yerinde JSONP işlevselliğinin etkin olmadığı doğrulanmalıdır. Bu, XSSI (Cross-Site Script Inclusion) saldırılarını önlemek içindir.",3 +V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.7,"Yetkilendirme gerektiren verilerin, JavaScript dosyaları gibi betik kaynaklarının yanıtlarında yer almadığı, XSSI saldırılarını önlemek için doğrulanmalıdır.",3 +V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.8,"Kimliği doğrulanmış kaynakların (örneğin görseller, videolar, betikler ve belgeler) yalnızca gerçekten amaçlandığında kullanıcı adına yüklenebildiği veya gömülebildiği doğrulanmalıdır. Bu, isteğin uygun olmayan bir çapraz kaynak çağrısından kaynaklanmadığından emin olmak için Sec-Fetch-* HTTP istek başlığı alanlarının sıkı bir şekilde doğrulanmasıyla veya tarayıcıya döndürülen içeriği engelleme talimatı vermek için kısıtlayıcı bir Cross-Origin-Resource-Policy HTTP yanıt başlığı alanı ayarlayarak gerçekleştirilebilir.",3 +V3,Web Ön Uç (Frontend) Güvenliği,V3.6,Harici Kaynak Bütünlüğü,V3.6.1,"JavaScript kütüphaneleri, CSS veya web fontları gibi istemci tarafı varlıkların yalnızca statik ve sürümlü olması, varlığın bütünlüğünü doğrulamak için Subresource Integrity (SRI) kullanılması durumunda harici olarak (örneğin, bir İçerik Dağıtım Ağı üzerinde) barındırıldığı doğrulanmalıdır. Bu mümkün değilse, her bir kaynak için bunu gerekçelendiren belgelenmiş bir güvenlik kararı bulunmalıdır.",3 +V3,Web Ön Uç (Frontend) Güvenliği,V3.7,Diğer Tarayıcı Güvenliği Hususları,V3.7.1,"Uygulamanın yalnızca hâlâ desteklenen ve güvenli kabul edilen istemci tarafı teknolojileri kullandığı doğrulanmalıdır. Bu gereksinimi karşılamayan teknolojilere örnek olarak NSAPI eklentileri, Flash, Shockwave, ActiveX, Silverlight, NACL veya istemci tarafı Java applet’leri verilebilir.",2 +V3,Web Ön Uç (Frontend) Güvenliği,V3.7,Diğer Tarayıcı Güvenliği Hususları,V3.7.2,"Uygulamanın, yalnızca hedef adres bir izinli listede yer alıyorsa kullanıcıyı otomatik olarak farklı bir ana makine adına veya uygulamanın kontrolünde olmayan bir etki alanına yönlendirdiği doğrulanmalıdır.",2 +V3,Web Ön Uç (Frontend) Güvenliği,V3.7,Diğer Tarayıcı Güvenliği Hususları,V3.7.3,"Uygulamanın, kullanıcı uygulamanın kontrolü dışındaki bir URL’ye yönlendirildiğinde, yönlendirme hakkında bir bildirim gösterdiği ve kullanıcının bu gezintiyi iptal edebilmesi için bir seçenek sunduğu doğrulanmalıdır.",3 +V3,Web Ön Uç (Frontend) Güvenliği,V3.7,Diğer Tarayıcı Güvenliği Hususları,V3.7.4,"Uygulamanın en üst düzey etki alanının (örneğin, site.tld) HTTP Strict Transport Security (HSTS) için genel preload listesine eklendiği doğrulanmalıdır. Bu, uygulamanın TLS kullanımının ana tarayıcılar tarafından doğrudan tanınmasını ve yalnızca Strict-Transport-Security yanıt header'ına bağlı kalınmamasını sağlar.",3 +V3,Web Ön Uç (Frontend) Güvenliği,V3.7,Diğer Tarayıcı Güvenliği Hususları,V3.7.5,"Uygulamaya erişen tarayıcının beklenen güvenlik özelliklerini desteklememesi durumunda, uygulamanın dokümantasyona uygun şekilde davrandığı (örneğin kullanıcıyı uyarma veya erişimi engelleme) doğrulanmalıdır.",3 +V4,API ve Web Servisi,V4.1,Genel Web Servisi Güvenliği,V4.1.1,"İleti gövdesi içeren her HTTP yanıtında, yanıtın gerçek içeriğiyle eşleşen bir Content-Type header alanı bulunduğu ve güvenli karakter kodlamasını (örneğin, UTF-8, ISO-8859-1) belirtmek üzere charset parametresi içerdiği doğrulanmalıdır. Bu işlem, IANA Medya Türleri'nden ""text/"", ""/+xml"" ve ""/xml"" gibi içerikler için geçerlidir.",1 +V4,API ve Web Servisi,V4.1,Genel Web Servisi Güvenliği,V4.1.2,"Yalnızca kullanıcı arayüzüne yönelik uç noktaların (manuel olarak web tarayıcısı ile erişilmesi amaçlanan) otomatik olarak HTTP'den HTTPS'e yönlendirme yaptığı ve diğer hizmetlerin veya uç noktaların şeffaf yönlendirme gerçekleştirmediği doğrulanmalıdır. Bu, istemcinin farkında olmadan şifrelenmemiş HTTP istekleri göndermesi ve bu isteklerin otomatik olarak HTTPS'e yönlendirilmesi sonucunda hassas verilerin sızmasının fark edilmemesi riskini önlemek içindir.",2 +V4,API ve Web Servisi,V4.1,Genel Web Servisi Güvenliği,V4.1.3,"Uygulama tarafından kullanılan ve yük dengeleyici, web proxy veya frontend için backend hizmeti gibi bir ara katman tarafından ayarlanan herhangi bir HTTP başlık alanının, son kullanıcı tarafından geçersiz kılınamayacağı doğrulanmalıdır. Örnek başlıklar arasında X-Real-IP, X-Forwarded-* veya X-User-ID yer alabilir.",2 +V4,API ve Web Servisi,V4.1,Genel Web Servisi Güvenliği,V4.1.4,Uygulama veya API tarafından açıkça desteklenen HTTP yöntemlerinin (preflight istekleri sırasında OPTIONS dahil) dışında hiçbir yöntemin kullanılmadığı ve kullanılmayan yöntemlerin engellendiği doğrulanmalıdır.,3 +V4,API ve Web Servisi,V4.1,Genel Web Servisi Güvenliği,V4.1.5,"Çok hassas istekler veya birçok sistemden geçen işlemler için, taşıma katmanı güvenliğinin üzerine ek bir güvence sağlamak amacıyla, her iletiye özel dijital imzaların kullanıldığı doğrulanmalıdır.",3 +V4,API ve Web Servisi,V4.2,HTTP İleti Yapısı Doğrulama,V4.2.1,"Tüm uygulama bileşenlerinin (yük dengeleyiciler, güvenlik duvarları ve uygulama sunucuları dahil) HTTP sürümüne uygun mekanizmaları kullanarak gelen HTTP iletilerinin sınırlarını belirlediği ve bu sayede HTTP istek kaçakçılığına karşı koruma sağlandığı doğrulanmalıdır. HTTP/1.x sürümünde Transfer-Encoding başlık alanı varsa, RFC 2616'ya göre Content-Length başlığı göz ardı edilmelidir. HTTP/2 veya HTTP/3 kullanıldığında, Content-Length başlığı varsa, alıcının bu değerin DATA çerçevelerinin uzunluğuyla tutarlı olduğunu doğrulaması gerekir.",2 +V4,API ve Web Servisi,V4.2,HTTP İleti Yapısı Doğrulama,V4.2.2,"HTTP iletileri üretilirken, Content-Length başlığının, HTTP protokolünün çerçeveleme yöntemine göre belirlenen içerik uzunluğu ile çelişmediği doğrulanmalıdır. Bu, istek kaçakçılığı saldırılarını önlemek için gereklidir.",3 +V4,API ve Web Servisi,V4.2,HTTP İleti Yapısı Doğrulama,V4.2.3,"Uygulamanın, yanıt bölme ve header enjeksiyonu saldırılarını önlemek amacıyla, bağlantıya özel başlık alanları (örneğin Transfer-Encoding) içeren HTTP/2 veya HTTP/3 iletilerini göndermediği ve kabul etmediği doğrulanmalıdır.",3 +V4,API ve Web Servisi,V4.2,HTTP İleti Yapısı Doğrulama,V4.2.4,"Uygulamanın yalnızca başlık alanları ve değerleri CR (\r), LF (\n) veya CRLF (\r\n) karakter dizileri içermeyen HTTP/2 ve HTTP/3 isteklerini kabul ettiği doğrulanmalıdır. Bu, başlık enjeksiyonu saldırılarını önlemek içindir.",3 +V4,API ve Web Servisi,V4.2,HTTP İleti Yapısı Doğrulama,V4.2.5,"Uygulama (backend veya frontend) istek oluşturuyor ve gönderiyorsa, URI'ler (örneğin API çağrıları için) veya HTTP istek başlıkları (örneğin Authorization veya Cookie) gibi bileşenlerin, alıcı sistemler tarafından kabul edilemeyecek kadar uzun olmamasını sağlamak amacıyla doğrulama, temizleme veya diğer mekanizmaları kullandığı doğrulanmalıdır. Bu tür çok uzun istekler (örneğin çok uzun bir Cookie başlığı) gönderildiğinde sunucunun sürekli hata durumu döndürmesiyle hizmet reddi oluşabilir.",3 +V4,API ve Web Servisi,V4.3,GraphQL,V4.3.1,"Maliyetli ve iç içe geçmiş sorgular sonucu oluşabilecek GraphQL veya veri katmanı ifadelerine yönelik Hizmet Reddi (DoS) saldırılarını önlemek için, sorgu izin listesi (allowlist), derinlik sınırlandırması, sorgu sayısı sınırlandırması veya sorgu maliyeti analizi kullanıldığı doğrulanmalıdır.",2 +V4,API ve Web Servisi,V4.3,GraphQL,V4.3.2,"GraphQL introspection (iç yapı sorgulama) sorgularının, GraphQL API'nin üçüncü taraflar tarafından kullanılmasına yönelik olmadığı sürece, üretim ortamında devre dışı bırakıldığı doğrulanmalıdır.",2 +V4,API ve Web Servisi,V4.4,WebSocket,V4.4.1,Tüm WebSocket bağlantılarında TLS üzerinden WebSocket (WSS) kullanıldığı doğrulanmalıdır.,1 +V4,API ve Web Servisi,V4.4,WebSocket,V4.4.2,"WebSocket'in başlangıçtaki HTTP el sıkışması (handshake) sırasında, Origin başlık alanının uygulama için izin verilen origin listesiyle karşılaştırılarak kontrol edildiği doğrulanmalıdır.",2 +V4,API ve Web Servisi,V4.4,WebSocket,V4.4.3,"Uygulamanın standart oturum yönetimi kullanılamıyorsa, bunun yerine ilgili Oturum Yönetimi güvenlik gereksinimlerine uygun özel token'ların kullanıldığı doğrulanmalıdır.",2 +V4,API ve Web Servisi,V4.4,WebSocket,V4.4.4,"HTTPS oturumu WebSocket kanalına geçerken, özel WebSocket oturum yönetim token’larının önceki şekilde kimliği doğrulanmış HTTPS oturumu aracılığıyla elde edildiği veya doğrulandığı doğrulanmalıdır.",2 +V5,Dosya İşleme,V5.1,Dosya İşleme Dokümantasyonu,V5.1.1,"Dokümantasyonun, her yükleme özelliği için izin verilen dosya türlerini, beklenen dosya uzantılarını ve maksimum boyutu (açılmış hali dahil) tanımladığı doğrulanmalıdır. Ayrıca, dosyaların son kullanıcılar için nasıl güvenli hâle getirileceği (örneğin kötü amaçlı bir dosya tespit edildiğinde uygulamanın nasıl davranacağı) gibi bilgilerin de belgede yer aldığı doğrulanmalıdır.",2 +V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.1,"Uygulamanın, yalnızca performans kaybına veya hizmet reddine yol açmayacak boyuttaki dosyaları kabul ettiği doğrulanmalıdır.",1 +V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.2,"Uygulama bir dosyayı, doğrudan veya bir arşiv (ör. zip dosyası) içinde kabul ettiğinde, dosya uzantısının beklenen uzantıyla eşleşip eşleşmediğini kontrol ettiği ve içeriğin uzantı tarafından temsil edilen türle uyumlu olduğunu doğruladığı kontrol edilmelidir. Bu; ilk 'magic byte' kontrolü, görüntü yeniden yazımı ve dosya içeriği doğrulama için özel kütüphanelerin kullanımı gibi yöntemleri içerir. Seviye 1 için bu, yalnızca iş veya güvenlik kararlarında kullanılan dosyalarla sınırlı olabilir. Seviye 2 ve üzeri için tüm dosyalar bu kontrole tabi olmalıdır.",1 +V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.3,"Sıkıştırılmış dosyaların (ör. zip, gz, docx, odt) açılmadan önce, izin verilen maksimum açılmış boyuta ve maksimum dosya sayısına göre kontrol edildiği doğrulanmalıdır.",2 +V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.4,Her kullanıcı için dosya boyutu kotası ve maksimum dosya sayısının uygulandığı doğrulanmalıdır. Böylece tek bir kullanıcının çok sayıda veya aşırı büyük dosya yükleyerek depolama alanını doldurması engellenir.,3 +V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.5,"Uygulamanın, içinde sembolik bağlantılar (symlink) bulunan sıkıştırılmış dosyaların yüklenmesine yalnızca bu durum özel olarak gerekli olduğunda izin verdiği doğrulanmalıdır. Bu durumda, sembolik bağlantı verilebilecek dosyaların bir izinli listesi uygulanmalıdır.",3 +V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.6,"Uygulamanın, piksel boyutu izin verilen maksimum değeri aşan görüntü dosyalarının yüklenmesini reddettiği doğrulanmalıdır. Bu, pixel flood saldırılarını önlemek için gereklidir.",3 +V5,Dosya İşleme,V5.3,Dosya Depolama,V5.3.1,"Güvenilmeyen girdilerle yüklenen veya oluşturulan ve herkese açık klasörlerde depolanan dosyaların, bir HTTP isteğiyle doğrudan erişildiğinde sunucu taraflı program kodu olarak çalıştırılmadığı doğrulanmalıdır.",1 +V5,Dosya İşleme,V5.3,Dosya Depolama,V5.3.2,"Uygulamanın, dosya işlemleri için dosya yollarını oluştururken kullanıcı tarafından gönderilen dosya adlarını değil, dahili olarak oluşturulan veya güvenilir verileri kullandığı; eğer kullanıcı tarafından gönderilen dosya adları veya meta veriler kullanılacaksa, sıkı doğrulama ve temizleme işlemlerinin uygulandığı doğrulanmalıdır. Bu, yol geçişi (path traversal), yerel veya uzak dosya dahil etme (LFI, RFI) ve sunucu tarafı istek sahteciliği (SSRF) saldırılarına karşı koruma sağlar.",1 +V5,Dosya İşleme,V5.3,Dosya Depolama,V5.3.3,"Sunucu tarafında gerçekleşen dosya işlemlerinin (örneğin dosya açma/decompress işlemi), kullanıcı tarafından sağlanan yol bilgilerini yok saydığı ve zip slip gibi güvenlik açıklarını önlediği doğrulanmalıdır.",3 +V5,Dosya İşleme,V5.4,Dosya İndirme,V5.4.1,"Uygulamanın, kullanıcı tarafından gönderilen dosya adlarını (ör. JSON, JSONP veya URL parametresinde) doğruladığı veya göz ardı ettiği ve yanıtın Content-Disposition başlık alanında bir dosya adı belirttiği doğrulanmalıdır.",2 +V5,Dosya İşleme,V5.4,Dosya İndirme,V5.4.2,"Sunulan dosya adlarının (örneğin HTTP yanıt header'larında veya e-posta eklerinde), belge yapısını korumak ve enjeksiyon saldırılarını önlemek için kodlandığı veya temizlendiği (ör. RFC 6266’ya uygun) doğrulanmalıdır.",2 +V5,Dosya İşleme,V5.4,Dosya İndirme,V5.4.3,"Güvenilmeyen kaynaklardan elde edilen dosyaların, bilinen kötü amaçlı içeriklerin sunulmasını önlemek amacıyla antivirüs tarayıcılarıyla tarandığı doğrulanmalıdır.",2 +V6,Kimlik Doğrulama,V6.1,Kimlik Doğrulama Dokümantasyonu,V6.1.1,"Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırılarına karşı oran sınırlama (rate limiting), otomasyon karşıtı önlemler ve uyarlanabilir yanıt gibi kontrollerin nasıl kullanıldığını açıklayan bir uygulama dokümantasyonu bulunduğu doğrulanmalıdır. Dokümantasyon, bu kontrollerin nasıl yapılandırıldığını ve kötü niyetli hesap kilitlemenin nasıl önlendiğini açıkça ortaya koymalıdır.",1 +V6,Kimlik Doğrulama,V6.1,Kimlik Doğrulama Dokümantasyonu,V6.1.2,"Parolalarda kullanılmasını önlemek amacıyla, bağlama özgü sözcüklerin (örneğin kurum adlarının permütasyonları, ürün adları, sistem tanımlayıcıları, proje kod adları, departman veya rol adları vb.) bulunduğu belgelenmiş bir liste mevcut olduğu doğrulanmalıdır.",2 +V6,Kimlik Doğrulama,V6.1,Kimlik Doğrulama Dokümantasyonu,V6.1.3,"Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, bunların tümünün belgelenmiş olduğu ve her yol için tutarlı şekilde uygulanması gereken güvenlik kontrolleri ile kimlik doğrulama gücünün tanımlandığı doğrulanmalıdır.",2 +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.1,"Kullanıcı tarafından belirlenen parolaların en az 8 karakter uzunluğunda olması sağlanmalı, ancak 15 karakter ve üzeri uzunlukta parolalar olmaları şiddetle tavsiye edilir.",1 +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.2,Kullanıcıların parolalarını değiştirebilmeleri sağlanmalıdır.,1 +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.3,Parola değiştirme işlevinin hem mevcut hem de yeni parolayı gerektirdiği doğrulanmalıdır.,1 +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.4,"Kayıt veya parola değişimi sırasında girilen parolaların, uygulamanın parola politikasına (örneğin minimum uzunluk) uyan ilk 3000 yaygın parolaya karşı kontrol edildiği doğrulanmalıdır.",1 +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.5,"Her tür karakterin kullanılmasına izin verildiği ve büyük/küçük harf, sayı veya özel karakter şartlarının zorunlu tutulmadığı doğrulanmalıdır.",1 +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.6,"Parola giriş alanlarının, girdiyi maskelemek için ""type=password"" kullandığı doğrulanmalıdır. Uygulamalar, kullanıcının tüm maskelenmiş parolayı ya da son girilen karakteri geçici olarak görüntülemesine izin verebilir.",1 +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.7,"""Yapıştır"" özelliğinin, tarayıcı parola yardımcılarının ve harici parola yöneticilerinin kullanımına izin verildiği doğrulanmalıdır.",1 +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.8,"Uygulamanın, kullanıcıdan aldığı parolayı herhangi bir şekilde değiştirmeden, örneğin kesmeden veya harf büyüklüğünü değiştirmeden, tam olarak doğruladığı teyit edilmelidir.",1 +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.9,En az 64 karakter uzunluğundaki parolalara izin verildiği doğrulanmalıdır.,2 +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.10,"Kullanıcının parolasının, yalnızca ele geçirildiği tespit edildiğinde veya kullanıcı tarafından yenilendiğinde geçerliliğini yitirdiği doğrulanmalıdır. Uygulama, belirli aralıklarla parola yenilenmesini zorunlu kılmamalıdır.",2 +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.11,"Tahmin edilmesi kolay parolaların oluşturulmasını önlemek amacıyla, bağlama özgü kelimelerin yer aldığı belgelenmiş listenin parola doğrulamada kullanıldığı teyit edilmelidir.",2 +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.12,"Kayıt veya parola değişikliği sırasında girilen parolaların, ele geçirilmiş parolalar listesine karşı kontrol edildiği doğrulanmalıdır.",2 +V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.1,"Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırıları gibi saldırıları önlemeye yönelik kontrollerin, uygulamanın güvenlik dokümantasyonuna göre uygulandığı doğrulanmalıdır.",1 +V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.2,"""root"", ""admin"" veya ""sa"" gibi varsayılan kullanıcı hesaplarının uygulamada yer almadığı veya devre dışı bırakıldığı doğrulanmalıdır.",1 +V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.3,"Uygulamaya erişim için ya çok faktörlü bir kimlik doğrulama mekanizması ya da tek faktörlü mekanizmaların kombinasyonu kullanılmalıdır. Seviye 3 için, bu faktörlerden biri, oltalama saldırılarına karşı direnç sağlayan ve kimlik doğrulama niyetini bir kullanıcı etkileşimi (örneğin FIDO donanım anahtarında bir düğmeye basma veya mobil telefonda bir onay) gerektirerek doğrulayan donanım tabanlı bir kimlik doğrulayıcı olmalıdır. Bu gereksinimdeki herhangi bir esneklik için, gerekçesi belgelenmiş ve riskleri azaltıcı kapsamlı kontroller içeren bir plan gereklidir.",2 +V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.4,"Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, belgelendirilmemiş bir yol bulunmadığı ve tüm yollar için güvenlik kontrolleri ile kimlik doğrulama gücünün tutarlı şekilde uygulandığı doğrulanmalıdır.",2 +V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.5,"Başarılı veya başarısız şüpheli kimlik doğrulama girişimlerinin kullanıcıya bildirildiği doğrulanmalıdır. Bu, olağandışı bir konum veya istemciden gelen girişimler, yalnızca bir faktörle yapılan kısmen başarılı doğrulamalar, uzun süreli inaktiflik sonrası yapılan girişimler veya birçok başarısız denemeden sonraki başarılı girişimler gibi durumları içerebilir.",3 +V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.6,"E-postanın, tek faktörlü ya da çok faktörlü kimlik doğrulama mekanizması olarak kullanılmadığı doğrulanmalıdır.",3 +V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.7,"Kimlik doğrulama detaylarında yapılan güncellemeler sonrasında (örneğin kimlik bilgisi sıfırlama, kullanıcı adı veya e-posta adresi değişiklikleri), kullanıcıların bilgilendirildiği doğrulanmalıdır.",3 +V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.8,"Başarısız kimlik doğrulama girişimlerinden, geçerli kullanıcıların hata mesajları, HTTP yanıt kodları veya farklı yanıt süreleri gibi sonuçlara dayanarak tespit edilemediği doğrulanmalıdır. Bu koruma, kayıt ve ""parolamı unuttum"" işlevselliğinde de geçerli olmalıdır.",3 +V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.1,"Sistem tarafından oluşturulan ilk parolaların veya etkinleştirme kodlarının güvenli bir şekilde rastgele üretildiği, mevcut parola politikasına uygun olduğu, kısa bir süre içinde veya ilk kullanım sonrasında geçerliliğini yitirdiği doğrulanmalıdır. Bu başlangıç sırları uzun vadeli parola olarak kullanılmasına izin verilmemelidir.",1 +V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.2,"Parola ipuçlarının veya ""gizli sorular"" olarak bilinen, bilgiye dayalı kimlik doğrulama mekanizmalarının mevcut olmadığı doğrulanmalıdır.",1 +V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.3,"Unutulmuş parolanın sıfırlanması için, etkin olan çok faktörlü kimlik doğrulama mekanizmalarını atlamayan güvenli bir sürecin uygulandığı doğrulanmalıdır.",2 +V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.4,"Çok faktörlü kimlik doğrulama faktörlerinden biri kaybolursa, kayıt sırasında uygulanan kimlik kanıtlama seviyesiyle aynı seviyede kimlik doğrulama yapıldığı doğrulanmalıdır.",2 +V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.5,"Süresi dolacak kimlik doğrulama mekanizmalarının yenilenmesine ilişkin talimatların, süresi dolmadan önce tamamlanacak şekilde yeterli sürede gönderildiği ve gerekiyorsa otomatik hatırlatıcıların yapılandırıldığı doğrulanmalıdır.",3 +V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.6,"Yönetici yetkisi olan kullanıcıların, kullanıcının parola sıfırlama sürecini başlatabildiği ancak kullanıcının yeni parolasını belirleyemediği veya değiştiremediği doğrulanmalıdır. Bu, yönetici yetkisi olan kullanıcıların, kullanıcı parolasını bilmesini engeller.",3 +V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.1,"Arama sırları, bant dışı kimlik doğrulama istekleri veya kodları ve zamana dayalı tek kullanımlık parolaların (TOTP) yalnızca bir kez kullanılabildiği doğrulanmalıdır.",2 +V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.2,"Uygulamanın backend tarafında saklanırken, 112 bitten az entropiye sahip (örneğin 19 rastgele harf-rakam karakteri veya 34 rastgele rakam) arama sırlarının, 32-bit rastgele bir salt içeren onaylı bir parola saklama algoritmasıyla hash’lendiği doğrulanmalıdır. Gizli bilginin entropisi 112 bit veya daha fazlaysa standart bir hash fonksiyonu kullanılabilir.",2 +V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.3,"Arama sırları, bant dışı kimlik doğrulama kodları ve zamana dayalı tek kullanımlık parola seed'lerinin, öngörülebilir değerlerden kaçınmak için Kriptografik Olarak Güvenli Sözde Rastgele Sayı Üreteci (CSPRNG) ile oluşturulduğu doğrulanmalıdır.",2 +V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.4,Arama sırlarının ve bant dışı kimlik doğrulama kodlarının en az 20 bit entropiye (genellikle 4 rastgele harf-rakam karakteri veya 6 rastgele rakam) sahip olduğu doğrulanmalıdır.,2 +V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.5,"Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının ve zamana dayalı tek kullanımlık parolaların (TOTP) belirli bir ömre sahip olduğu doğrulanmalıdır. Bant dışı istekler en fazla 10 dakika, TOTP’ler ise en fazla 30 saniye geçerli olmalıdır.",2 +V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.6,Herhangi bir kimlik doğrulama faktörünün (fiziksel cihazlar dahil) çalınması veya kaybı durumunda iptal edilebildiği doğrulanmalıdır.,3 +V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.7,"Biyometrik kimlik doğrulama mekanizmalarının yalnızca ikincil faktör olarak, “sahip olduğunuz bir şey” veya “bildiğiniz bir şey” ile birlikte kullanıldığı doğrulanmalıdır.",3 +V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.8,"Zamana dayalı tek kullanımlık parolaların (TOTP) doğrulamasının, güvenilir bir hizmetten alınan zaman kaynağına dayanarak yapıldığı ve güvenilir olmayan veya istemci tarafından sağlanan zaman kaynağına dayanmadığı doğrulanmalıdır.",3 +V6,Kimlik Doğrulama,V6.6,Bant Dışı Kimlik Doğrulama Mekanizmaları,V6.6.1,"Tek kullanımlık parolaların (OTP) telefon veya SMS ile Public Switched Telephone Network (PSTN) üzerinden iletildiği kimlik doğrulama mekanizmalarının, yalnızca telefon numarası önceden doğrulanmışsa, alternatif daha güçlü yöntemler (örneğin TOTP) de sunuluyorsa ve kullanıcıya güvenlik riskleri hakkında bilgi veriliyorsa sunulduğu doğrulanmalıdır. Seviye 3 uygulamalar için telefon ve SMS seçenekleri sunulmamalıdır.",2 +V6,Kimlik Doğrulama,V6.6,Bant Dışı Kimlik Doğrulama Mekanizmaları,V6.6.2,"Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının, oluşturuldukları özgün kimlik doğrulama isteğiyle bağlantılı olduğu ve daha önceki ya da sonraki bir istek için kullanılamadığı doğrulanmalıdır.",2 +V6,Kimlik Doğrulama,V6.6,Bant Dışı Kimlik Doğrulama Mekanizmaları,V6.6.3,"Kod tabanlı bant dışı kimlik doğrulama mekanizmalarının, oran sınırlaması ile kaba kuvvet saldırılarına karşı korunduğu doğrulanmalıdır. En az 64 bit entropiye sahip kodlar kullanılması da değerlendirilmelidir.",2 +V6,Kimlik Doğrulama,V6.6,Bant Dışı Kimlik Doğrulama Mekanizmaları,V6.6.4,"Çok faktörlü kimlik doğrulama için push bildirimleri kullanılıyorsa, push bombing saldırılarına karşı oran sınırlamasının kullanıldığı doğrulanmalıdır. “Numara eşleştirme” de bu riski azaltabilir.",3 +V6,Kimlik Doğrulama,V6.7,Kriptografik Kimlik Doğrulama Mekanizması,V6.7.1,"Kriptografik kimlik doğrulama beyanlarını doğrulamak için kullanılan sertifikaların, değiştirilmeye karşı korumalı şekilde saklandığı doğrulanmalıdır.",3 +V6,Kimlik Doğrulama,V6.7,Kriptografik Kimlik Doğrulama Mekanizması,V6.7.2,Challenge nonce değerinin en az 64 bit uzunluğunda olduğu ve istatistiksel olarak benzersiz ya da cihazın ömrü boyunca benzersiz olduğu doğrulanmalıdır.,3 +V6,Kimlik Doğrulama,V6.8,Kimlik Sağlayıcısı ile Kimlik Doğrulama,V6.8.1,"Uygulama birden fazla kimlik sağlayıcıyı (IdP) destekliyorsa, başka bir desteklenen kimlik sağlayıcı aracılığıyla (örneğin aynı kullanıcı tanımlayıcısını kullanarak) kullanıcının kimliğinin taklit edilemediği doğrulanmalıdır. Standart önlem, uygulamanın kullanıcıyı IdP kimliği (bir ad alanı işlevi görür) ve IdP içindeki kullanıcı kimliğinin birleşimiyle kaydetmesi ve tanımlamasıdır.",2 +V6,Kimlik Doğrulama,V6.8,Kimlik Sağlayıcısı ile Kimlik Doğrulama,V6.8.2,Kimlik doğrulama beyanları üzerindeki dijital imzaların (örneğin JWT veya SAML beyanları) varlığı ve bütünlüğünün her zaman doğrulandığı ve imzasız veya geçersiz imzalı beyanların reddedildiği doğrulanmalıdır.,2 +V6,Kimlik Doğrulama,V6.8,Kimlik Sağlayıcısı ile Kimlik Doğrulama,V6.8.3,"SAML beyanlarının benzersiz biçimde işlendiği ve yalnızca geçerlilik süresi içinde bir kez kullanıldığı, tekrar oynatma (replay) saldırılarını önlemek amacıyla doğrulanmalıdır.",2 +V6,Kimlik Doğrulama,V6.8,Kimlik Sağlayıcısı ile Kimlik Doğrulama,V6.8.4,"Uygulama ayrı bir Kimlik Sağlayıcı (IdP) kullanıyorsa ve belirli işlemler için belirli kimlik doğrulama gücü, yöntemleri veya zaman bilgisi bekliyorsa, uygulamanın bu bilgileri IdP tarafından döndürülen veriler üzerinden doğruladığı teyit edilmelidir. Örneğin OIDC kullanılıyorsa, bu durum ID Token üzerindeki 'acr', 'amr' ve 'auth_time' gibi claim’lerin (varsa) doğrulanması ile sağlanabilir. Eğer IdP bu bilgileri sağlamıyorsa, uygulamanın asgari kimlik doğrulama gücünün kullanıldığını varsayan (örneğin yalnızca kullanıcı adı ve parola ile tek faktörlü doğrulama) belgelenmiş bir yedek yaklaşımı olmalıdır.",2 +V7,Oturum Yönetimi,V7.1,Oturum Yönetim Dokümantasyonu,V7.1.1,"Kullanıcının oturum inaktivite zaman aşımı süresi ve mutlak maksimum oturum süresinin belgelendiği, diğer kontrollerle birlikte uygun olduğu ve NIST SP 800-63B yeniden kimlik doğrulama gereksinimlerinden herhangi bir sapma varsa gerekçesinin belgede yer aldığı doğrulanmalıdır.",2 +V7,Oturum Yönetimi,V7.1,Oturum Yönetim Dokümantasyonu,V7.1.2,"Belgede bir hesap için kaç adet eşzamanlı (paralel) oturuma izin verildiği ile birlikte, maksimum aktif oturum sayısına ulaşıldığında uygulanacak davranış ve işlemlerin tanımlandığı doğrulanmalıdır.",2 +V7,Oturum Yönetimi,V7.1,Oturum Yönetim Dokümantasyonu,V7.1.3,"Birleşik kimlik yönetim ekosisteminin bir parçası olarak kullanıcı oturumu oluşturan ve yöneten tüm sistemlerin, oturum ömrü, sonlandırma ve yeniden kimlik doğrulama gerektiren diğer koşulların nasıl koordine edildiğini açıklayan kontrollerle birlikte belgede yer aldığı doğrulanmalıdır.",2 +V7,Oturum Yönetimi,V7.2,Temel Oturum Yönetimi Güvenliği,V7.2.1,Uygulamanın tüm oturum token'ı doğrulama işlemlerini güvenilir bir backend servisi aracılığıyla gerçekleştirdiği doğrulanmalıdır.,1 +V7,Oturum Yönetimi,V7.2,Temel Oturum Yönetimi Güvenliği,V7.2.2,"Uygulamanın, statik API gizli anahtarları veya sabit değerler yerine, oturum yönetimi için dinamik olarak oluşturulan kendi kendine yeterli veya referans token'ları kullandığı doğrulanmalıdır.",1 +V7,Oturum Yönetimi,V7.2,Temel Oturum Yönetimi Güvenliği,V7.2.3,"Uygulama kullanıcı oturumlarını temsil etmek için referans token'ları kullanıyorsa, bu token'ların benzersiz olduğu, kriptografik olarak güvenli bir sözde rastgele sayı üreteci (CSPRNG) kullanılarak üretildiği ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır.",1 +V7,Oturum Yönetimi,V7.2,Temel Oturum Yönetimi Güvenliği,V7.2.4,"Uygulamanın, kullanıcı kimlik doğrulaması (yeniden kimlik doğrulama dahil) sırasında yeni bir oturum token'ı oluşturduğu ve mevcut oturum token'ını sonlandırdığı doğrulanmalıdır.",1 +V7,Oturum Yönetimi,V7.3,Oturum Zaman Aşımı,V7.3.1,Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde bir hareketsizlik zaman aşımı bulunduğu doğrulanmalıdır.,2 +V7,Oturum Yönetimi,V7.3,Oturum Zaman Aşımı,V7.3.2,Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde mutlak bir maksimum oturum süresi bulunduğu doğrulanmalıdır.,2 +V7,Oturum Yönetimi,V7.4,Oturum Sonlandırma,V7.4.1,"Oturum sonlandırma tetiklendiğinde (örneğin, çıkış yapıldığında veya süre dolduğunda), uygulamanın oturumun daha fazla kullanılmasına izin vermediği doğrulanmalıdır. Referans token'lar veya durum bilgili oturumlar için bu, oturum verilerinin uygulama arka ucunda geçersiz kılınması anlamına gelir. Kapsamlı token kullanan uygulamaların; sonlandırılmış token listesi tutmak, kullanıcıya özel tarih ve saatten önce oluşturulan token'ları reddetmek veya kullanıcıya özel imzalama anahtarını yenilemek gibi bir çözüm uygulaması gerekir.",1 +V7,Oturum Yönetimi,V7.4,Oturum Sonlandırma,V7.4.2,"Bir kullanıcı hesabı devre dışı bırakıldığında veya silindiğinde (örneğin bir çalışanın şirketten ayrılması), uygulamanın tüm aktif oturumları sonlandırdığı doğrulanmalıdır.",1 +V7,Oturum Yönetimi,V7.4,Oturum Sonlandırma,V7.4.3,"Herhangi bir kimlik doğrulama faktörünün başarılı bir şekilde değiştirilmesi veya kaldırılmasından (şifre sıfırlama veya kurtarma yoluyla yapılan değişiklikler dahil ve varsa MFA ayarları güncellemeleri dahil) sonra, uygulamanın diğer tüm aktif oturumları sonlandırma seçeneği sunduğu doğrulanmalıdır.",2 +V7,Oturum Yönetimi,V7.4,Oturum Sonlandırma,V7.4.4,Kimlik doğrulama gerektiren tüm sayfalarda kolay erişilebilir ve görünür bir çıkış yap (logout) işlevi bulunduğu doğrulanmalıdır.,2 +V7,Oturum Yönetimi,V7.4,Oturum Sonlandırma,V7.4.5,"Uygulama yöneticilerinin, bireysel bir kullanıcının veya tüm kullanıcıların aktif oturumlarını sonlandırabilme yetkisine sahip olduğu doğrulanmalıdır.",2 +V7,Oturum Yönetimi,V7.5,Oturum Kötüye Kullanımına Karşı Savunmalar,V7.5.1,"E-posta adresi, telefon numarası, MFA yapılandırması veya hesap kurtarmada kullanılan diğer bilgiler gibi kimlik doğrulamayı etkileyebilecek hassas hesap özniteliklerinde değişiklik yapılmadan önce uygulamanın tam yeniden kimlik doğrulama gerektirdiği doğrulanmalıdır.",2 +V7,Oturum Yönetimi,V7.5,Oturum Kötüye Kullanımına Karşı Savunmalar,V7.5.2,"Kullanıcıların, (en az bir faktörle yeniden kimlik doğrulama yaptıktan sonra) mevcut tüm aktif oturumları görüntüleyebilmesi ve sonlandırabilmesinin mümkün olduğu doğrulanmalıdır.",2 +V7,Oturum Yönetimi,V7.5,Oturum Kötüye Kullanımına Karşı Savunmalar,V7.5.3,"Uygulamanın, son derece hassas işlemler veya operasyonlar gerçekleştirilmeden önce en az bir faktörle ek kimlik doğrulaması veya ikincil bir doğrulama gerektirdiği doğrulanmalıdır.",3 +V7,Oturum Yönetimi,V7.6,Birleşik Yeniden Kimlik Doğrulama,V7.6.1,"Güvenen Taraf (RP) ile Kimlik Sağlayıcı (IdP) arasındaki oturum süresi ve oturum sonlandırma davranışlarının belgelenmiş olduğu ve, örneğin IdP kimlik doğrulama olayları arasında maksimum süreye ulaşıldığında yeniden kimlik doğrulamanın gerekli kılındığı doğrulanmalıdır.",2 +V7,Oturum Yönetimi,V7.6,Birleşik Yeniden Kimlik Doğrulama,V7.6.2,"Yeni bir oturum oluşturulmasının, kullanıcı onayı veya açık bir eylem gerektirdiği; kullanıcı etkileşimi olmaksızın yeni uygulama oturumlarının oluşturulmasının önlendiği doğrulanmalıdır.",2 +V8,Yetkilendirme,V8.1,Yetkilendirme Dokümantasyonu,V8.1.1,"Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak işlev düzeyinde ve veriye özel erişim kısıtlamaları için kuralları tanımladığı doğrulanmalıdır.",1 +V8,Yetkilendirme,V8.1,Yetkilendirme Dokümantasyonu,V8.1.2,"Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak alan (field) düzeyinde erişim kısıtlamaları (hem okuma hem yazma) için kuralları tanımladığı doğrulanmalıdır. Bu kuralların, ilgili veri nesnesinin durum veya statü gibi diğer özniteliklerine bağlı olabileceği unutulmamalıdır.",2 +V8,Yetkilendirme,V8.1,Yetkilendirme Dokümantasyonu,V8.1.3,"Uygulamanın dokümantasyonunun, kimlik doğrulama ve yetkilendirme ile ilgili güvenlik kararlarının alınmasında kullanılan çevresel ve bağlamsal öznitelikleri (günün saati, kullanıcı konumu, IP adresi veya cihaz gibi) tanımladığı doğrulanmalıdır.",3 +V8,Yetkilendirme,V8.1,Yetkilendirme Dokümantasyonu,V8.1.4,"Kimlik doğrulama ve yetkilendirme dokümantasyonunun; işlev düzeyinde, veriye özel ve alan düzeyinde yetkilendirmenin yanı sıra çevresel ve bağlamsal faktörlerin karar almada nasıl kullanıldığını tanımladığı doğrulanmalıdır. Bu, değerlendirilen öznitelikleri, risk eşiklerini ve alınan aksiyonları (ör. izin ver, doğrulama iste, reddet, step-up kimlik doğrulama) içermelidir.",3 +V8,Yetkilendirme,V8.2,Genel Yetkilendirme Tasarımı,V8.2.1,"Uygulamanın, işlev düzeyindeki erişimin yalnızca açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır.",1 +V8,Yetkilendirme,V8.2,Genel Yetkilendirme Tasarımı,V8.2.2,"Uygulamanın, veriye özel erişimin yalnızca belirli veri öğelerine açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, doğrudan nesne referansı güvenlik açıkları (IDOR) ve bozuk nesne düzeyinde yetkilendirme (BOLA) risklerini azaltır.",1 +V8,Yetkilendirme,V8.2,Genel Yetkilendirme Tasarımı,V8.2.3,"Uygulamanın, alan (field) düzeyindeki erişimin yalnızca belirli alanlara açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, bozuk nesne özelliği düzeyinde yetkilendirme (BOPLA) risklerini azaltır.",2 +V8,Yetkilendirme,V8.2,Genel Yetkilendirme Tasarımı,V8.2.4,"Tüketicinin çevresel ve bağlamsal özniteliklerine (ör. günün saati, konum, IP adresi veya cihaz) dayalı uyarlanabilir güvenlik kontrollerinin, uygulama dokümantasyonunda tanımlandığı şekilde, kimlik doğrulama ve yetkilendirme kararları için uygulandığı doğrulanmalıdır. Bu kontroller, tüketici yeni bir oturum başlatmaya çalışırken ve mevcut bir oturum sırasında uygulanmalıdır.",3 +V8,Yetkilendirme,V8.3,İşlem Düzeyinde Yetkilendirme,V8.3.1,Uygulamanın yetkilendirme kurallarını güvenilir bir servis katmanında uyguladığı ve istemci taraflı JavaScript gibi güvenilmeyen tüketiciler tarafından değiştirilebilecek kontrollerle yetinmediği doğrulanmalıdır.,1 +V8,Yetkilendirme,V8.3,İşlem Düzeyinde Yetkilendirme,V8.3.2,"Yetkilendirme kararlarının temelini oluşturan değerlerdeki değişikliklerin hemen uygulandığı doğrulanmalıdır. Değişikliklerin anında uygulanamadığı durumlarda (örneğin self-contained token içindeki verilere güveniliyorsa), tüketici artık yetkili olmadığı hâlde bir işlem gerçekleştirdiğinde uyarı verecek ve değişikliği geri alacak önlemler uygulanmalıdır. Bu alternatifin bilgi sızıntısını önlemeyeceği unutulmamalıdır.",3 +V8,Yetkilendirme,V8.3,İşlem Düzeyinde Yetkilendirme,V8.3.3,"Bir nesneye erişimin, herhangi bir aracı veya onun adına hareket eden bir servis yerine yalnızca erişimi başlatan öznenin (ör. tüketici) izinlerine dayandığı doğrulanmalıdır. Örneğin, bir tüketici kimlik doğrulama için bir self-contained token kullanarak bir web servis çağırırsa ve bu servis başka bir servisten veri talep ederse, ikinci servis izin kararlarını verirken birinci servisin makine-makine token'ı yerine tüketicinin token'ını kullanmalıdır.",3 +V8,Yetkilendirme,V8.4,Diğer Yetkilendirme Hususları,V8.4.1,"Multi-tenant uygulamaların, tüketici işlemlerinin izinli olmadıkları tenant'lar üzerinde asla etkili olmamasını sağlamak için tenant'lar arası kontroller kullandığı doğrulanmalıdır.",2 +V8,Yetkilendirme,V8.4,Diğer Yetkilendirme Hususları,V8.4.2,"Yönetici arayüzlerine erişimin, sürekli tüketici kimlik doğrulaması, cihaz güvenlik durumu değerlendirmesi ve bağlamsal risk analizi dahil olmak üzere çok katmanlı güvenlik içerdiği doğrulanmalıdır. Yetkilendirme için yalnızca ağ konumu veya güvenilir uç noktalar yeterli olmamalıdır; ancak bu tür faktörler yetkisiz erişim olasılığını azaltabilir.",3 +V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.1,Token Kaynağı ve Bütünlüğü,V9.1.1,"Self-contained token'ların içerikleri kabul edilmeden önce, oynama (tampering) saldırılarına karşı dijital imza veya MAC ile doğrulama yapıldığı doğrulanmalıdır.",1 +V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.1,Token Kaynağı ve Bütünlüğü,V9.1.2,"Belirli bir bağlam için yalnızca bir allowlist üzerinde bulunan algoritmaların self-contained token oluşturmak ve doğrulamak için kullanılabildiği doğrulanmalıdır. Bu allowlist, yalnızca simetrik ya da yalnızca asimetrik algoritmaları içermeli ve kesinlikle 'None' algoritmasını içermemelidir. Hem simetrik hem de asimetrik algoritmalar desteklenmek zorundaysa, anahtar karışıklığını (key confusion) önlemek için ek kontroller uygulanmalıdır.",1 +V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.1,Token Kaynağı ve Bütünlüğü,V9.1.3,"Self-contained token'ları doğrulamak için kullanılan anahtar malzemesinin, token issuer için önceden yapılandırılmış güvenilir kaynaklardan alındığı doğrulanmalıdır. Bu, saldırganların güvenilmeyen kaynak ve anahtarları belirtmesini engeller. JWT ve diğer JWS yapılarında 'jku', 'x5u' ve 'jwk' gibi header'lar güvenilir kaynaklardan oluşan bir allowlist'e göre doğrulanmalıdır.",1 +V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.2,Token İçeriği,V9.2.1,"Token verisinde bir geçerlilik zaman aralığı (validity time span) varsa, yalnızca doğrulama zamanı bu zaman aralığı içerisindeyse token ve içeriği kabul edilmelidir. Örneğin, JWT'ler için 'nbf' ve 'exp' claim'leri doğrulanmalıdır.",1 +V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.2,Token İçeriği,V9.2.2,"Token'ı alan hizmetin, token içeriğini kabul etmeden önce bu token'ın doğru türde olduğunu ve sunulma amacına uygun olduğunu doğruladığı teyit edilmelidir. Örneğin, yalnızca erişim token'ları yetkilendirme kararları için, yalnızca ID Token'lar kullanıcı kimlik doğrulamasını kanıtlamak için kullanılabilir.",2 +V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.2,Token İçeriği,V9.2.3,"Hizmetin yalnızca kendisiyle kullanılması amaçlanan (audience) token'ları kabul ettiği doğrulanmalıdır. JWT'lerde bu, 'aud' claim'inin hizmet içinde tanımlı bir allowlist ile doğrulanması yoluyla sağlanabilir.",2 +V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.2,Token İçeriği,V9.2.4,"Eğer bir token issuer, farklı audience'lara token oluşturmak için aynı private key'i kullanıyorsa, oluşturulan token'ların hedef audience'ları benzersiz şekilde tanımlayan bir audience kısıtlaması içerdiği doğrulanmalıdır. Bu, bir token'ın farklı bir audience ile yeniden kullanılmasını önler. Audience tanımlayıcısı dinamik olarak sağlanıyorsa, token issuer bu audience'ları doğrulamalı ve audience taklitlerinin (impersonation) önüne geçmelidir.",2 +V10,OAuth ve OIDC,V10.1,Genel OAuth ve OIDC Güvenliği,V10.1.1,"Token'ların yalnızca kesinlikle ihtiyaç duyan bileşenlere gönderildiği doğrulanmalıdır. Örneğin, tarayıcı tabanlı JavaScript uygulamaları için bir backend-for-frontend modeli kullanıldığında, access ve refresh token'lara yalnızca backend'in erişebilmesi gerekir.",2 +V10,OAuth ve OIDC,V10.1,Genel OAuth ve OIDC Güvenliği,V10.1.2,"Authorization server'dan gelen değerler (örneğin authorization code veya ID Token gibi) yalnızca aynı user agent oturumu ve işlemi tarafından başlatılmış bir yetkilendirme akışının sonucuysa kabul edildiği doğrulanmalıdır. Bu, client tarafından oluşturulan secret’ların 'proof key for code exchange' (PKCE) ‘code_verifier’, ‘state’ veya OIDC ‘nonce’ gibi tahmin edilemez, işleme özgü ve hem client’a hem de işlem başlatılan user agent oturumuna güvenli bir şekilde bağlı olmasını gerektirir.",2 +V10,OAuth ve OIDC,V10.2,OAuth İstemcisi,V10.2.1,"Code flow kullanılıyorsa, OAuth client’ın token taleplerini tetikleyen CSRF saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Bu genellikle PKCE kullanılarak veya authorization isteğinde gönderilen ‘state’ parametresinin kontrolü ile sağlanır.",2 +V10,OAuth ve OIDC,V10.2,OAuth İstemcisi,V10.2.2,"OAuth istemcisi birden fazla AS ile etkileşime girebiliyorsa, mix-up saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Örneğin, authorization server’ın 'iss' parametresini döndürmesi zorunlu kılınabilir ve bu parametrenin hem authorization yanıtında hem de token yanıtında doğrulanması gerekir.",2 +V10,OAuth ve OIDC,V10.2,OAuth İstemcisi,V10.2.3,OAuth istemcisinin authorization server’a yaptığı taleplerde yalnızca gerekli scope’ları (veya diğer yetkilendirme parametrelerini) talep ettiği doğrulanmalıdır.,3 +V10,OAuth ve OIDC,V10.3,OAuth Kaynak Sunucusu (RS),V10.3.1,RS'nin yalnızca bu servisle kullanılmak üzere tasarlanmış access token’ları kabul ettiği doğrulanmalıdır (audience kontrolü). Audience bilgisi yapılandırılmış token’larda (örneğin JWT içindeki ‘aud’ claim’i) yer alabilir veya token introspection endpoint aracılığıyla kontrol edilebilir.,2 +V10,OAuth ve OIDC,V10.3,OAuth Kaynak Sunucusu (RS),V10.3.2,"RS'nin, access token’dan gelen claim’lere dayanarak yetki devri tanımına uygun şekilde yetkilendirme kararları uyguladığı doğrulanmalıdır. ‘sub’, ‘scope’ ve ‘authorization_details’ gibi claim’ler varsa, bu kararın parçası olmalıdır.",2 +V10,OAuth ve OIDC,V10.3,OAuth Kaynak Sunucusu (RS),V10.3.3,"Erişim kontrolü kararında, access token’dan (JWT veya ilgili token introspection yanıtı) benzersiz bir kullanıcının tanımlanması gerekiyorsa, RS'nin başka kullanıcılara devredilemeyecek claim’ler ile kullanıcıyı tanımladığı doğrulanmalıdır. Genellikle bu, ‘iss’ ve ‘sub’ claim’lerinin birlikte kullanılması anlamına gelir.",2 +V10,OAuth ve OIDC,V10.3,OAuth Kaynak Sunucusu (RS),V10.3.4,"RS'nin belirli bir kimlik doğrulama gücü, yöntemi veya güncelliği (recentness) gerektirmesi durumunda, sunulan access token’ın bu kısıtlamaları karşıladığını doğruladığı, örneğin, OIDC ‘acr’, ‘amr’ ve ‘auth_time’ claim’leri kullanılarak doğrulanmalıdır. ",2 +V10,OAuth ve OIDC,V10.3,OAuth Kaynak Sunucusu (RS),V10.3.5,"RS'nin, (yetkisiz taraflarca) çalınmış veya tekrar edilen access token’ların kullanımını önlemek için sender-constrained access token’lar kullandığı doğrulanmalıdır. Bu, OAuth 2 için Mutual TLS veya OAuth 2 Demonstration of Proof of Possession (DPoP) ile sağlanabilir.",3 +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.1,"AS'nin, istemciye özel önceden kaydedilmiş URI’lerden oluşan bir allowlist kullanarak redirect URI’leri tam dize karşılaştırması ile doğruladığı doğrulanmalıdır.",1 +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.2,"AS'nin, ""authorization response"" içinde ""authorization code"" döndürdüğü durumlarda, bu kodun yalnızca bir kez kullanılabildiği doğrulanmalıdır. Daha önce access token vermek için kullanılmış bir authorization code ile yapılan ikinci geçerli token isteği reddedilmeli ve ilgili tüm token’lar iptal edilmelidir.",1 +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.3,"Authorization code’un kısa ömürlü olduğu doğrulanmalıdır. L1 ve L2 uygulamalar için maksimum yaşam süresi 10 dakika, L3 uygulamalar için 1 dakikadır.",1 +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.4,"Belirli bir istemci için AS'nin yalnızca o istemcinin ihtiyaç duyduğu grant türlerine izin verdiği doğrulanmalıdır. ""Token"" (Implicit flow) ve ""password"" (Resource Owner Password Credentials flow) grant türlerinin artık kullanılmaması gerekir.",1 +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.5,"AS'nin, açık istemciler için refresh token replay saldırılarını azalttığı doğrulanmalıdır. Tercihen sender-constrained refresh token’lar (DPoP veya mutual TLS ile certificate-bound access token’lar) kullanılmalıdır. L1 ve L2 uygulamalar için refresh token rotation kullanılabilir. Rotation kullanılıyorsa, AS refresh token’ı kullanım sonrası geçersiz kılmalı ve geçersiz bir refresh token sunulması durumunda o yetkilendirme ile ilişkili tüm refresh token’ları iptal etmelidir.",1 +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.6,"Code grant kullanılıyorsa, AS'nin authorization code interception saldırılarına karşı koruma sağladığı doğrulanmalıdır. Yetkilendirme isteğinde geçerli bir ""code_challenge"" değeri zorunlu olmalı ve ""code_challenge_method"" olarak ""plain"" kabul edilmemelidir. Token isteğinde ise ""code_verifier"" parametresi doğrulanmalıdır.",2 +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.7,"AS'nin, kimlik doğrulaması yapılmamış dinamik istemci kaydını desteklemesi durumunda, kötü niyetli istemci uygulamalarına karşı riskleri azalttığı doğrulanmalıdır. Kayıtlı URI’ler gibi client metadata’sı doğrulanmalı, kullanıcı onayı alınmalı ve güvenilmeyen bir client uygulamasıyla yapılan yetkilendirme isteği işlenmeden önce kullanıcı uyarılmalıdır.",2 +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.8,"Refresh token’ların, sliding expiration kullanılsa bile mutlak bir sona erme süresine sahip olduğu doğrulanmalıdır.",2 +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.9,Yetkili bir kullanıcı tarafından AS kullanıcı arayüzü üzerinden refresh token’ların ve reference access token’ların iptal edilebildiği doğrulanmalıdır.,2 +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.10,"Gizli istemcilerin token istekleri, pushed authorization request (PAR) ve token iptal istekleri gibi server’a yapılan backchannel isteklerinde kimliğinin kontrol edildiği doğrulanmalıdır.",2 +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.11,"AS yapılandırmasının, OAuth istemcisine yalnızca gerekli scope’ları atadığı doğrulanmalıdır.",2 +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.12,"Belirli bir client için, authorization server’ın yalnızca client’ın ihtiyaç duyduğu 'response_mode' değerine izin verdiği doğrulanmalıdır. Örneğin, bu değer ya beklenenlerle karşılaştırılarak doğrulanmalı ya da PAR veya JAR kullanılmalıdır.",3 +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.13,"""Code"" grant türünün daima pushed authorization request (PAR) ile birlikte kullanıldığı doğrulanmalıdır.",3 +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.14,"AS'nin yalnızca sender-constrained (Proof-of-Possession) access token’lar ürettiği doğrulanmalıdır. Bu, mutual TLS ile certificate-bound access token ya da DPoP ile DPoP-bound access token olabilir.",3 +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.15,"Sunucu taraflı istemciler için (kullanıcı cihazında çalışmayan), AS'nin ""authorization_details"" parametresinin istemci backend'i tarafından sağlandığını ve kullanıcı tarafından değiştirilmediğini doğruladığı, örneğin pushed authorization request (PAR) or JWT-secured Authorization Request (JAR) zorunlu kılınarak doğrulanmalıdır.",3 +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.16,"Bir istemci gizli ise, AS'nin güçlü istemci kimlik doğrulama yöntemlerini zorunlu kıldığı doğrulanmalıdır. Bu yöntemler, public-key cryptography’ye dayalı ve replay saldırılarına karşı dayanıklı olmalı, örneğin mutual TLS (""tls_client_auth"", ""self_signed_tls_client_auth"") veya private key JWT (""private_key_jwt"") gibi.",3 +V10,OAuth ve OIDC,V10.5,OIDC İstemcisi,V10.5.1,"İstemcinin (relying party olarak) ID Token replay saldırılarını azalttığı doğrulanmalıdır. Örneğin, ID Token’daki 'nonce' claim’inin, OpenID Provider’a gönderilen kimlik doğrulama isteğindeki 'nonce' değeriyle eşleştiği doğrulanmalıdır.",2 +V10,OAuth ve OIDC,V10.5,OIDC İstemcisi,V10.5.2,"İstemcinin kullanıcıyı ID Token claim’lerinden (genellikle, başka kullanıcılarla yeniden atanamayan 'sub' claim’i) benzersiz şekilde tanımladığı doğrulanmalıdır.",2 +V10,OAuth ve OIDC,V10.5,OIDC İstemcisi,V10.5.3,"İstemcinin, kötü niyetli bir AS'nin başka bir AS'yi taklit etmesini AS metadata’sı üzerinden reddettiği doğrulanmalıdır. AS metadata’sındaki issuer URL’si, istemci tarafından beklenen önceden yapılandırılmış issuer URL’siyle tam olarak eşleşmiyorsa, metadata reddedilmelidir.",2 +V10,OAuth ve OIDC,V10.5,OIDC İstemcisi,V10.5.4,"İstemcinin, ID Token’ın kendisi için (audience) kullanılması amaçlandığını doğruladığı doğrulanmalıdır. Bu, token’daki 'aud' claim’inin istemcinin 'client_id' değeriyle eşit olup olmadığının kontrol edilmesiyle yapılır.",2 +V10,OAuth ve OIDC,V10.5,OIDC İstemcisi,V10.5.5,"OIDC back-channel logout kullanıldığında, relying party’nin ""forced logout"" ve ""logout"" akışında ""cross-JWT confusion"" gibi saldırılara karşı koruma sağladığı doğrulanmalıdır. Client, logout token’ın 'logout+jwt' türünde olduğunu, 'event' claim’inin doğru üyeye sahip olduğunu ve 'nonce' claim’i içermediğini doğrulamalıdır. Ayrıca token için kısa bir sona erme süresi (örneğin 2 dakika) önerilir.",2 +V10,OAuth ve OIDC,V10.6,OpenID Provider,V10.6.1,"OpenID Provider’ın yalnızca 'code', 'ciba', 'id_token' veya 'id_token code' response mode değerlerine izin verdiği doğrulanmalıdır. 'code' değeri, 'id_token code' (OIDC Hybrid flow) yerine tercih edilmelidir. 'token' (Implicit flow) kullanılmamalıdır.",2 +V10,OAuth ve OIDC,V10.6,OpenID Provider,V10.6.2,"OpenID Provider’ın forced logout yoluyla yapılan hizmet reddi saldırılarını önlediği doğrulanmalıdır. Bu, son kullanıcıdan açık onay alınarak veya varsa logout isteğinde (relying party tarafından başlatılan) bulunan parametrelerin, örneğin 'id_token_hint', doğrulanmasıyla yapılabilir.",2 +V10,OAuth ve OIDC,V10.7,Onay (Consent) Yönetimi,V10.7.1,"AS'nin her yetkilendirme isteği için kullanıcının onayını aldığı doğrulanmalıdır. İstemcinin kimliği garanti altına alınamıyorsa, AS daima kullanıcıdan açıkça onay istemelidir.",2 +V10,OAuth ve OIDC,V10.7,Onay (Consent) Yönetimi,V10.7.2,"AS'nin kullanıcıdan onay istediğinde, neye onay verildiğini açık ve yeterli şekilde gösterdiği doğrulanmalıdır. Uygun olduğunda bu bilgiler, istenen yetkilendirmelerin doğasını (genellikle scope, resource server, RAR gibi detaylara dayalı), yetkilendirilmiş uygulamanın kimliğini ve bu yetkilendirmelerin süresini içermelidir.",2 +V10,OAuth ve OIDC,V10.7,Onay (Consent) Yönetimi,V10.7.3,"Kullanıcının, AS üzerinden verdiği onayları görüntüleyebildiği, değiştirebildiği ve iptal edebildiği doğrulanmalıdır.",2 +V11,Kriptografi,V11.1,Kriptografik Envanter ve Dokümantasyon,V11.1.1,"Kriptografik anahtarların yönetimi için belgelenmiş bir politika ve NIST SP 800-57 gibi bir anahtar yönetim standardını izleyen bir kriptografik anahtar yaşam döngüsü tanımlandığı doğrulanmalıdır. Bu, anahtarların aşırı miktarda paylaşılmadığını (örneğin, paylaşılan sırlar için ikiden fazla tarafla veya özel anahtarlar için birden fazla tarafla) garanti altına almalıdır.",2 +V11,Kriptografi,V11.1,Kriptografik Envanter ve Dokümantasyon,V11.1.2,"Tüm kriptografik anahtarlar, algoritmalar ve uygulama tarafından kullanılan sertifikaları içeren bir kriptografik envanterin oluşturulduğu, sürdürüldüğü ve düzenli olarak güncellendiği doğrulanmalıdır. Bu envanter ayrıca, sistemde anahtarların nerede kullanılabileceğini ve kullanılamayacağını, ve hangi veri türlerinin bu anahtarlarla korunup korunamayacağını da belgelemelidir.",2 +V11,Kriptografi,V11.1,Kriptografik Envanter ve Dokümantasyon,V11.1.3,"Sistem içerisinde şifreleme, özetleme ve imzalama işlemleri dahil olmak üzere kriptografi kullanımının tüm örneklerini tespit etmek için kriptografik keşif mekanizmalarının kullanıldığı doğrulanmalıdır.",3 +V11,Kriptografi,V11.1,Kriptografik Envanter ve Dokümantasyon,V11.1.4,"Kriptografik bir envanterin sürdürüldüğü doğrulanmalıdır. Bu envanter, gelecekteki tehditlere karşı tepki verebilmek amacıyla post-kuantum kriptografiye geçiş yolunu belirten belgelenmiş bir plan içermelidir.",3 +V11,Kriptografi,V11.2,Güvenli Kriptografi Uygulaması,V11.2.1,Kriptografik işlemler için sektör tarafından doğrulanmış uygulamaların (kütüphaneler ve donanım hızlandırmalı uygulamalar dahil) kullanıldığı doğrulanmalıdır.,2 +V11,Kriptografi,V11.2,Güvenli Kriptografi Uygulaması,V11.2.2,"Uygulamanın, rastgele sayı üreticileri, kimliği doğrulanmış şifreleme, MAC veya özetleme algoritmaları, anahtar uzunlukları, turlar, şifreler ve modların herhangi bir zamanda yeniden yapılandırılabilir, yükseltilebilir veya değiştirilebilir olacağı şekilde kripto çevikliği (crypto agility) ile tasarlandığı doğrulanmalıdır. Aynı şekilde, anahtarların ve parolaların değiştirilebilmesi ve verilerin yeniden şifrelenebilmesi mümkün olmalıdır. Bu, onaylanmış PQC şemalarının yüksek güvenlikli uygulamaları yaygın olarak kullanılabilir hale geldiğinde sorunsuz geçişe olanak tanır.",2 +V11,Kriptografi,V11.2,Güvenli Kriptografi Uygulaması,V11.2.3,"Tüm kriptografik ilkeliklerin, algoritma, anahtar boyutu ve yapılandırmaya göre minimum 128 bit güvenlik sağladığı doğrulanmalıdır. Örneğin, 256-bit ECC anahtarı yaklaşık 128 bit güvenlik sağlarken, RSA için aynı güvenliği elde etmek 3072-bit anahtar gerektirir.",2 +V11,Kriptografi,V11.2,Güvenli Kriptografi Uygulaması,V11.2.4,"Tüm kriptografik işlemlerin sabit süreli (constant-time) olduğu, karşılaştırmalarda, hesaplamalarda veya geri dönüşlerde kısa devre (short-circuit) işlemleri yapılmadığı doğrulanmalıdır; bu, bilgi sızıntısını önlemek için gereklidir.",3 +V11,Kriptografi,V11.2,Güvenli Kriptografi Uygulaması,V11.2.5,"Tüm kriptografik modüllerin güvenli şekilde hata verdiği ve hataların, padding oracle saldırıları gibi zafiyetleri mümkün kılmayacak şekilde ele alındığı doğrulanmalıdır.",3 +V11,Kriptografi,V11.3,Şifreleme Algoritmaları,V11.3.1,"Güvensiz blok modlarının (örneğin, ECB) ve zayıf doldurma (padding) şemalarının (örneğin, PKCS#1 v1.5) kullanılmadığı doğrulanmalıdır.",1 +V11,Kriptografi,V11.3,Şifreleme Algoritmaları,V11.3.2,Yalnızca AES ile GCM gibi onaylı şifreleme algoritmalarının ve modlarının kullanıldığı doğrulanmalıdır.,1 +V11,Kriptografi,V11.3,Şifreleme Algoritmaları,V11.3.3,"Şifrelenmiş verilerin yetkisiz değişikliklere karşı korunduğu doğrulanmalıdır. Tercihen bu koruma, onaylı bir kimliği doğrulanmış şifreleme yöntemi kullanılarak ya da onaylı bir şifreleme yöntemi ile onaylı bir MAC algoritmasının kombinasyonu ile sağlanmalıdır.",2 +V11,Kriptografi,V11.3,Şifreleme Algoritmaları,V11.3.4,"Sayılar, başlatma vektörleri (IV) ve diğer tek kullanımlık değerlerin, aynı şifreleme anahtarı ve veri öğesi çifti için birden fazla kez kullanılmadığı doğrulanmalıdır. Oluşturma yöntemi kullanılan algoritmaya uygun olmalıdır.",3 +V11,Kriptografi,V11.3,Şifreleme Algoritmaları,V11.3.5,"Şifreleme algoritması ve MAC algoritması kombinasyonlarının ""encrypt-then-MAC"" modunda çalıştığı doğrulanmalıdır.",3 +V11,Kriptografi,V11.4,Hashing ve Hash Tabanlı Fonksiyonlar,V11.4.1,"Dijital imzalar, HMAC, KDF ve rastgele bit üretimi gibi genel kriptografik kullanım senaryolarında yalnızca onaylı hash fonksiyonlarının kullanıldığı doğrulanmalıdır. MD5 gibi yasaklı hash fonksiyonları hiçbir kriptografik amaçla kullanılmamalıdır.",1 +V11,Kriptografi,V11.4,Hashing ve Hash Tabanlı Fonksiyonlar,V11.4.2,"Parolaların, onaylı, hesaplama açısından yoğun ve mevcut rehberliğe göre yapılandırılmış bir anahtar türetme fonksiyonu (diğer adıyla parola hash'leme fonksiyonu) kullanılarak saklandığı doğrulanmalıdır. Ayarlar, güvenlik ve performans dengesini sağlayarak kaba kuvvet saldırılarını zorlaştırmalıdır.",2 +V11,Kriptografi,V11.4,Hashing ve Hash Tabanlı Fonksiyonlar,V11.4.3,"Dijital imzalarda kullanılan hash fonksiyonlarının, veri bütünlüğü ve kimlik doğrulama amacıyla kullanıldığında çakışmaya karşı dayanıklı ve yeterli bit uzunluğuna sahip olduğu doğrulanmalıdır. Çakışma dayanıklılığı gerekiyorsa çıktı uzunluğu en az 256 bit olmalıdır. Sadece ikinci ön-görüntü (2nd pre-iamge) saldırılarına karşı dayanıklılık gerekiyorsa çıktı uzunluğu en az 128 bit olmalıdır.",2 +V11,Kriptografi,V11.4,Hashing ve Hash Tabanlı Fonksiyonlar,V11.4.4,"Parolalardan gizli anahtarlar türetilirken, onaylı anahtar türetme fonksiyonlarının anahtar uzatma (key stretching) parametreleriyle birlikte kullanıldığı doğrulanmalıdır. Bu parametreler, kaba kuvvet saldırılarını önleyecek şekilde güvenlik ve performans dengesine sahip olmalıdır.",2 +V11,Kriptografi,V11.5,Rastgele Değerler,V11.5.1,"Tahmin edilemez olması amaçlanan tüm rastgele sayıların ve dizelerin, CSPRNG ile oluşturulduğu ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. UUID'lerin bu koşulu dikkate almadığını unutmayın.",2 +V11,Kriptografi,V11.5,Rastgele Değerler,V11.5.2,"Kullanılan rastgele sayı üretim mekanizmasının, yoğun talep altında dahi güvenli çalışacak şekilde tasarlandığı doğrulanmalıdır.",3 +V11,Kriptografi,V11.6,Açık Anahtar (Public Key) Kriptografisi,V11.6.1,"Anahtar üretimi, tohumlama (seeding) ve dijital imza üretimi ve doğrulama için yalnızca onaylı kriptografik algoritmalar ve çalışma modlarının kullanıldığı doğrulanmalıdır. Anahtar üretim algoritmaları, bilinen saldırılara karşı savunmasız anahtarlar üretmemelidir. Örneğin, Fermat çarpanlama yöntemine karşı savunmasız RSA anahtarları oluşturulmamalıdır.",2 +V11,Kriptografi,V11.6,Açık Anahtar (Public Key) Kriptografisi,V11.6.2,"Anahtar değişimi için yalnızca onaylı kriptografik algoritmaların kullanıldığı doğrulanmalıdır (örneğin Diffie-Hellman). Kullanılan parametrelerin güvenli olması gerektiğine dikkat edilmelidir. Bu, anahtar kurulum sürecine yönelik saldırıları önleyecek ve araya girme (adversary-in-the-middle) ya da kriptografik kırılmaları engelleyecektir.",3 +V11,Kriptografi,V11.7,Kullanım Halindeki Verilerin Kriptografisi,V11.7.1,"Hassas verilerin kullanım sırasında korunmasını sağlamak amacıyla, yetkisiz kullanıcıların veya süreçlerin bu verilere erişmesini engelleyen tam bellek şifrelemesinin kullanıldığı doğrulanmalıdır.",3 +V11,Kriptografi,V11.7,Kullanım Halindeki Verilerin Kriptografisi,V11.7.2,"Veri asgariyetinin sağlandığı, yani işleme sırasında mümkün olan en az miktarda verinin ortaya çıktığı ve verilerin kullanımdan hemen sonra veya mümkün olan en kısa sürede şifrelendiği doğrulanmalıdır.",3 +V12,Güvenli İletişim,V12.1,Genel TLS Güvenlik Rehberi,V12.1.1,Yalnızca TLS protokolünün en güncel ve önerilen sürümlerinin (örneğin TLS 1.2 ve TLS 1.3) etkinleştirildiği ve en son sürümün varsayılan olarak tercih edildiği doğrulanmalıdır.,1 +V12,Güvenli İletişim,V12.1,Genel TLS Güvenlik Rehberi,V12.1.2,Yalnızca önerilen şifre takımlarının (cipher suite) etkinleştirildiği ve en güçlü şifre takımlarının tercih edildiği doğrulanmalıdır. Seviye 3 (L3) uygulamalar yalnızca ileri gizlilik (forward secrecy) sağlayan şifre takımlarını desteklemelidir.,2 +V12,Güvenli İletişim,V12.1,Genel TLS Güvenlik Rehberi,V12.1.3,"Uygulamanın, mTLS istemci sertifikalarını kimlik doğrulama veya yetkilendirme amacıyla kullanmadan önce bu sertifikaların güvendiği sertifikalar arasında olduğunu doğruladığı kontrol edilmelidir.",2 +V12,Güvenli İletişim,V12.1,Genel TLS Güvenlik Rehberi,V12.1.4,Online Certificate Status Protocol (OCSP) Stapling gibi geçerli bir sertifika iptal kontrolü yönteminin etkinleştirildiği ve yapılandırıldığı doğrulanmalıdır.,3 +V12,Güvenli İletişim,V12.1,Genel TLS Güvenlik Rehberi,V12.1.5,"TLS el sıkışma (handshake) sürecinde Server Name Indication (SNI) gibi hassas meta verilerin ifşa edilmesini önlemek için, uygulamanın TLS yapılandırmasında Encrypted Client Hello (ECH) özelliğinin etkinleştirildiği doğrulanmalıdır.",3 +V12,Güvenli İletişim,V12.2,Dışa Açık Hizmetlerle HTTPS İletişimi,V12.2.1,"İstemci ile dışa açık, HTTP tabanlı hizmetler arasındaki tüm bağlantılarda TLS kullanıldığı ve bu bağlantıların güvensiz ya da şifrelenmemiş iletişime geri dönmediği doğrulanmalıdır.",1 +V12,Güvenli İletişim,V12.2,Dışa Açık Hizmetlerle HTTPS İletişimi,V12.2.2,Dışa açık hizmetlerin herkese açık olarak güvenilen TLS sertifikaları kullandığı doğrulanmalıdır.,1 +V12,Güvenli İletişim,V12.3,Genel Servisler Arası İletişim Güvenliği,V12.3.1,"Uygulamaya gelen ve uygulamadan çıkan tüm bağlantılarda izleme sistemleri, yönetim araçları, uzaktan erişim ve SSH, ara yazılımlar, veritabanları, ana sistemler (mainframe), iş ortağı sistemleri ya da dış API'ler dahil olmak üzere TLS gibi şifreli bir protokolün kullanıldığı ve güvensiz ya da şifrelenmemiş protokollere geri dönülmediği doğrulanmalıdır.",2 +V12,Güvenli İletişim,V12.3,Genel Servisler Arası İletişim Güvenliği,V12.3.2,TLS istemcilerinin bir TLS sunucusu ile iletişime geçmeden önce alınan sertifikaları doğruladığı kontrol edilmelidir.,2 +V12,Güvenli İletişim,V12.3,Genel Servisler Arası İletişim Güvenliği,V12.3.3,Uygulama içindeki HTTP tabanlı iç hizmetler arasında gerçekleşen tüm bağlantılarda TLS ya da uygun başka bir aktarım şifreleme mekanizmasının kullanıldığı ve güvensiz ya da şifrelenmemiş iletişime geri dönülmediği doğrulanmalıdır.,2 +V12,Güvenli İletişim,V12.3,Genel Servisler Arası İletişim Güvenliği,V12.3.4,"İç hizmetler arasındaki TLS bağlantılarında güvenilir sertifikaların kullanıldığı doğrulanmalıdır. İç sistemlerde oluşturulmuş ya da kendinden imzalı (self-signed) sertifikalar kullanılıyorsa, bu sertifikalara güvenen hizmetlerin yalnızca belirli dahili sertifika otoritelerine (CA) ve belirli kendinden imzalı sertifikalara güvenecek şekilde yapılandırıldıkları doğrulanmalıdır.",2 +V12,Güvenli İletişim,V12.3,Genel Servisler Arası İletişim Güvenliği,V12.3.5,"Sistem içindeki hizmetlerin birbiriyle iletişim kurarken her bir uç noktanın kimliğini doğrulamak için güçlü kimlik doğrulama yöntemlerinin kullanıldığı doğrulanmalıdır. Bu yöntemler arasında, açık anahtar altyapısı (public-key infrastructure) kullanan ve tekrar oynatma saldırılarına karşı dayanıklı olan TLS istemci kimlik doğrulaması gibi yöntemler yer almalıdır. Mikroservis mimarilerinde, sertifika yönetimini basitleştirmek ve güvenliği artırmak amacıyla bir servis ağı (service mesh) kullanılması değerlendirilmelidir.",3 +V13,Konfigürasyon,V13.1,Konfigürasyon Dokümantasyonu,V13.1.1,"Uygulamanın tüm iletişim ihtiyaçlarının dokümante edildiği doğrulanmalıdır. Buna, uygulamanın bağımlı olduğu dış hizmetler ve son kullanıcının uygulamanın bağlantı kurmasını sağlayabileceği dış konumlar da dahil olmalıdır.",2 +V13,Konfigürasyon,V13.1,Konfigürasyon Dokümantasyonu,V13.1.2,"Uygulamanın kullandığı her bir hizmet için, dokümantasyonda eşzamanlı bağlantı sayısı (örn. bağlantı havuzu limitleri) ve bu sınır aşıldığında uygulamanın davranışı, geri dönüş veya kurtarma mekanizmaları da dahil olmak üzere hizmet reddi koşullarını önlemek için tanımlandığı doğrulanmalıdır.",3 +V13,Konfigürasyon,V13.1,Konfigürasyon Dokümantasyonu,V13.1.3,"Uygulamanın, kullandığı her bir dış sistem veya hizmet (örn. veritabanları, dosya tanıtıcıları, iş parçacıkları, HTTP bağlantıları) için kaynak yönetimi stratejilerini tanımladığı doğrulanmalıdır. Bu stratejiler, kaynak serbest bırakma prosedürlerini, zaman aşımı ayarlarını, hata durumlarını ve tekrar deneme mantığı uygulanmışsa sınırları, gecikmeleri ve geri çekilme (back-off) algoritmalarını içermelidir. Senkron HTTP istek–yanıt işlemleri için kısa zaman aşımı süreleri zorunlu tutulmalı ve tekrar eden denemeler devre dışı bırakılmalı ya da sıkı şekilde sınırlandırılmalıdır.",3 +V13,Konfigürasyon,V13.1,Konfigürasyon Dokümantasyonu,V13.1.4,"Uygulamanın, güvenlik açısından kritik olan gizli verileri tanımladığı ve kuruluşun tehdit modeli ve iş ihtiyaçlarına göre bu verilerin döndürülme (rotation) zamanlamasının belgelendiği doğrulanmalıdır.",3 +V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.1,"Uygulamanın, standart kullanıcı oturum mekanizmasını desteklemeyen backend bileşenleri (örneğin API'ler, ara katmanlar, veri katmanları) arasında gerçekleşen iletişimlerin kimlik doğrulamasıyla korunduğu doğrulanmalıdır. Kimlik doğrulama; bireysel hizmet hesapları, kısa ömürlü token'lar ya da sertifika tabanlı kimlik doğrulama ile yapılmalıdır ve parola, API anahtarı ya da ayrıcalıklı erişime sahip paylaşımlı hesaplar gibi sabit kimlik bilgileri kullanılmamalıdır.",2 +V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.2,"Uygulamanın backend bileşenleri arasında (yerel hizmetler, işletim sistemi hizmetleri, API'ler, ara katmanlar ve veri katmanları dahil) gerçekleştirilen iletişimlerin, yalnızca gerekli en az ayrıcalığa sahip hesaplarla yapıldığı doğrulanmalıdır.",2 +V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.3,"Bir hizmet kimlik doğrulaması için bir kimlik bilgisi kullanılması gerekiyorsa, bu kimlik bilgisinin varsayılan bir değer (örneğin root/root veya admin/admin) olmadığının doğrulanması gereklidir.",2 +V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.4,"Uygulamanın iletişim kurmasına izin verilen dış kaynaklar ya da sistemlerin, bir allowlist (izinli liste) ile tanımlandığı doğrulanmalıdır. Bu liste, uygulama katmanında, web sunucusunda, güvenlik duvarında veya farklı katmanların birleşiminde uygulanabilir.",2 +V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.5,"Web veya uygulama sunucusunun, dış sistemlere veri veya dosya gönderimi veya yüklemesi yaparken sadece belirli kaynaklara izin verecek şekilde allowlist ile yapılandırıldığı doğrulanmalıdır.",2 +V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.6,"Uygulamanın farklı hizmetlere bağlantı kurduğu durumlarda, bu bağlantılar için belgelenmiş yapılandırmaları (örn. maksimum eşzamanlı bağlantı, bağlantı limiti aşıldığında davranış, zaman aşımı, tekrar deneme stratejileri) takip ettiğinin doğrulanması gereklidir.",3 +V13,Konfigürasyon,V13.3,Gizli Bilgi Yönetimi,V13.3.1,"Parolalar, anahtar materyalleri, veritabanı ve üçüncü parti sistemlerle entegrasyon bilgileri, zaman tabanlı token'lar için tohum (seed) bilgileri, dahili gizli veriler ve API anahtarları gibi backend sırlarının güvenli bir şekilde oluşturulması, saklanması, erişim denetiminin sağlanması ve imha edilmesi için bir gizli bilgi yönetim çözümünün (örneğin key vault) kullanıldığı doğrulanmalıdır. Bu gizli bilgiler uygulama kaynak koduna dahil edilmemeli ve yapı çıktılarında yer almamalıdır. Seviye 3 uygulamalar için donanım destekli bir çözüm (örneğin HSM) gereklidir.",2 +V13,Konfigürasyon,V13.3,Gizli Bilgi Yönetimi,V13.3.2,Gizli bilgilere erişimin en az ayrıcalık prensibine uygun şekilde yapılandırıldığı doğrulanmalıdır.,2 +V13,Konfigürasyon,V13.3,Gizli Bilgi Yönetimi,V13.3.3,"Tüm kriptografik işlemlerin, anahtar materyallerinin güvenli bir şekilde yönetilmesi ve dışarıya sızmasının engellenmesi amacıyla, izole edilmiş bir güvenlik modülü (örneğin vault ya da donanım güvenlik modülü) aracılığıyla gerçekleştirildiği doğrulanmalıdır.",3 +V13,Konfigürasyon,V13.3,Gizli Bilgi Yönetimi,V13.3.4,Uygulamanın belgelerinde belirtildiği şekilde gizli bilgilerin süresinin dolacak şekilde yapılandırıldığı ve düzenli olarak döndürüldüğü doğrulanmalıdır.,3 +V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.1,Uygulamanın .git veya .svn klasörleri gibi kaynak kontrolüyle ilgili metadata içermeyecek şekilde deploy edildiğini ya da bu klasörlerin hem dış erişime hem de uygulama erişimine kapalı olduğu doğrulanmalıdır.,1 +V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.2,Tüm bileşenler için üretim ortamlarında hata ayıklama (debug) modlarının devre dışı bırakıldığı doğrulanmalıdır.,2 +V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.3,"Web sunucularının, açık şekilde istenmediği sürece dizin listelemesi (directory listing) özelliğini istemcilere sunmadığı doğrulanmalıdır.",2 +V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.4,"HTTP TRACE metodunun üretim ortamlarında desteklenmediği, böylece potansiyel bilgi sızıntılarının önlendiği doğrulanmalıdır.",2 +V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.5,Belgeler (örneğin dahili API belgeleri) ve izleme uç noktalarının (monitoring endpoints) yalnızca açıkça belirtildiği durumlarda erişilebilir olduğu doğrulanmalıdır.,2 +V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.6,Uygulamanın arka uç bileşenlerinin ayrıntılı sürüm bilgilerini ifşa etmediği doğrulanmalıdır.,3 +V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.7,"Web katmanının yalnızca belirli dosya uzantılarına sahip dosyaları sunacak şekilde yapılandırıldığı, bu sayede istem dışı bilgi, yapılandırma ya da kaynak kod sızıntılarının önlendiği doğrulanmalıdır.",3 +V14,Veri Koruma,V14.1,Veri Koruma Dokümantasyonu,V14.1.1,"Uygulama tarafından oluşturulan ve işlenen tüm hassas verilerin tanımlanıp, koruma seviyelerine göre sınıflandırıldığından emin olun. Bu, yalnızca kodlanmış (örneğin Base64 stringleri ya da JWT içindeki düz metin yükler gibi) ve bu nedenle kolayca çözülebilir verileri de içermelidir. Koruma seviyeleri, uygulamanın uymakla yükümlü olduğu veri koruma ve gizlilik düzenlemeleri ile standartlarını dikkate almalıdır.",2 +V14,Veri Koruma,V14.1,Veri Koruma Dokümantasyonu,V14.1.2,"Tüm hassas veri koruma seviyeleri için belgelenmiş bir koruma gereksinimleri seti tanımlandığından emin olun. Bu gereksinimler genel şifreleme, bütünlük doğrulama, saklama süresi, verinin nasıl günlüğe kaydedileceği, günlüklerdeki hassas verilere erişim kontrolleri, veritabanı düzeyinde şifreleme, gizlilik ve gizliliği artırıcı teknolojiler ile diğer gizlilik gereksinimlerini kapsamalıdır.",2 +V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.1,"Hassas verilerin yalnızca HTTP message body veya header alanlarında sunucuya gönderildiği ve URL ile sorgu parametrelerinin, API anahtarı veya session token’ı gibi hassas bilgiler içermediği doğrulanmalıdır.",1 +V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.2,"Hassas verilerin, yük dengeleyiciler ve uygulama önbellekleri gibi sunucu bileşenlerinde önbelleğe alınmasının engellendiği veya kullanım sonrası bu verilerin güvenli biçimde temizlendiği doğrulanmalıdır.",2 +V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.3,"Uygulama kontrolü dışında veri toplanmasını engellemek için, tanımlanmış hassas verilerin, kullanıcı izleyicileri gibi güvensiz taraflara gönderilmediği doğrulanmalıdır.",2 +V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.4,"Hassas verilere yönelik şifreleme, bütünlük doğrulama, veri saklama, loglama yöntemi, loglardaki erişim kontrolleri, gizlilik teknolojileri gibi kontrollerin, söz konusu verinin belgelenmiş koruma seviyesinde tanımlandığı şekilde uygulandığı doğrulanmalıdır.",2 +V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.5,"Önbellekleme mekanizmalarının yalnızca belirli içerik türüne sahip yanıtları önbelleğe alacak şekilde yapılandırıldığı ve hassas, dinamik içeriklerin önbelleğe alınmadığı doğrulanmalıdır. Web sunucusu, mevcut olmayan bir dosya talebinde geçerli ama farklı bir dosya döndürmek yerine 404 veya 302 cevabı vermelidir. Bu, Web Cache Deception saldırılarını önlemeye yardımcı olur.",3 +V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.6,"Uygulamanın yalnızca işlevsellik için gerekli olan asgari hassas veriyi döndürdüğü doğrulanmalıdır. Örneğin, kredi kartı numarasının yalnızca bazı rakamlarının döndürülmesi; tam numaranın döndürülmesi gerekiyorsa, kullanıcı arayüzünde gizlenmiş (maskelenmiş) şekilde sunulması gerekir, aksi kullanıcı özel olarak görüntülemek istemedikçe gösterilmemelidir.",3 +V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.7,"Hassas bilgilerin, veri saklama sınıflandırmasına tabi tutulduğu, geçerliliğini yitirmiş veya artık gerekli olmayan verilerin belirlenmiş bir zaman çizelgesiyle ya da gerektiğinde otomatik olarak silindiği doğrulanmalıdır.",3 +V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.8,Kullanıcı tarafından yüklenen dosyaların meta verilerinden hassas bilgilerin çıkarıldığı veya bu bilgilerin yalnızca kullanıcıdan açık onay alındığında saklandığı doğrulanmalıdır.,3 +V14,Veri Koruma,V14.3,İstemci Tarafı Veri Koruması,V14.3.1,"Kimliği doğrulanmış verilerin, istemci veya oturum sonlandığında istemci depolamasından (örneğin tarayıcı DOM’undan) temizlendiği doğrulanmalıdır. 'Clear-Site-Data' HTTP response header bu konuda yardımcı olabilir ancak istemci tarafı, sunucu bağlantısı mevcut olmadığında da temizlik işlemini yapabiliyor olmalıdır.",1 +V14,Veri Koruma,V14.3,İstemci Tarafı Veri Koruması,V14.3.2,"Uygulamanın, tarayıcılarda hassas verilerin önbelleğe alınmasını önlemek amacıyla yeterli anti-önbellekleme HTTP response header (örneğin Cache-Control: no-store) ayarladığı doğrulanmalıdır.",2 +V14,Veri Koruma,V14.3,İstemci Tarafı Veri Koruması,V14.3.3,"Tarayıcıda depolanan verilerin (örneğin localStorage, sessionStorage, IndexedDB veya çerezler) hassas veri içermediği, yalnızca session token’larının istisna olarak kabul edildiği doğrulanmalıdır.",2 +V15,Güvenli Kodlama ve Mimari,V15.1,Güvenli Kodlama ve Mimari Dokümantasyonu,V15.1.1,"Güvenlik açığı içeren üçüncü taraf bileşen sürümleri ve genel olarak kütüphane güncellemeleri için, uygulama dokümantasyonunda risk bazlı düzeltme zamanlarının tanımlandığı doğrulanmalıdır.",1 +V15,Güvenli Kodlama ve Mimari,V15.1,Güvenli Kodlama ve Mimari Dokümantasyonu,V15.1.2,"Yazılım bileşen listesi (Software Bill of Materials - SBOM) gibi bir envanterin tutulduğu, kullanılan tüm üçüncü taraf kütüphanelerin önceden tanımlanmış, güvenilir ve düzenli olarak güncellenen depolardan alındığı doğrulanmalıdır.",2 +V15,Güvenli Kodlama ve Mimari,V15.1,Güvenli Kodlama ve Mimari Dokümantasyonu,V15.1.3,"Uygulama dokümantasyonunda zaman veya kaynak açısından yoğun işlevlerin tanımlandığı, bu işlevlerin aşırı kullanımı durumunda kullanılabilirlik kaybının nasıl önleneceği ve yanıt oluşturma süresinin istemci zaman aşımını aşmaması için hangi önlemlerin alındığı belirtilmelidir. Örnek savunmalar kuyruklama, eşzamansız işleme, kullanıcı başına ve uygulama genelinde paralel işlem sınırlarını içerebilir.",2 +V15,Güvenli Kodlama ve Mimari,V15.1,Güvenli Kodlama ve Mimari Dokümantasyonu,V15.1.4,"Uygulama dokümantasyonunda ""riskli bileşenler"" olarak değerlendirilen üçüncü taraf kütüphanelerin vurgulandığı doğrulanmalıdır.",3 +V15,Güvenli Kodlama ve Mimari,V15.1,Güvenli Kodlama ve Mimari Dokümantasyonu,V15.1.5,"Uygulama dokümantasyonunda ""tehlikeli işlevsellik"" içeren uygulama bölümlerinin açıkça belirtildiği doğrulanmalıdır.",3 +V15,Güvenli Kodlama ve Mimari,V15.2,Güvenlik Mimarisi ve Bağımlılıklar,V15.2.1,"Uygulamanın yalnızca, belgelenmiş güncelleme ve düzeltme sürelerini aşmamış bileşenleri içerdiği doğrulanmalıdır.",1 +V15,Güvenli Kodlama ve Mimari,V15.2,Güvenlik Mimarisi ve Bağımlılıklar,V15.2.2,"Uygulamanın, belgelenmiş güvenlik kararları ve stratejilere dayanarak, zaman veya kaynak açısından yoğun işlevlerin neden olabileceği kullanılabilirlik kaybına karşı savunmalar uyguladığı doğrulanmalıdır.",2 +V15,Güvenli Kodlama ve Mimari,V15.2,Güvenlik Mimarisi ve Bağımlılıklar,V15.2.3,"Üretim ortamının yalnızca uygulamanın çalışması için gerekli işlevleri içerdiği ve test kodları, örnek kod parçaları veya geliştirme işlevleri gibi gereksiz işlevsellikleri açığa çıkarmadığı doğrulanmalıdır.",2 +V15,Güvenli Kodlama ve Mimari,V15.2,Güvenlik Mimarisi ve Bağımlılıklar,V15.2.4,Üçüncü taraf bileşenlerin ve bunların tüm transitif bağımlılıklarının beklenen depolardan (iç kaynaklı ya da harici) alındığı ve bağımlılık karışıklığı (dependency confusion) saldırılarına açık olmadığı doğrulanmalıdır.,3 +V15,Güvenli Kodlama ve Mimari,V15.2,Güvenlik Mimarisi ve Bağımlılıklar,V15.2.5,"Uygulamanın, “tehlikeli işlevsellik” içeren veya “riskli bileşenler” kullanan bölümlerine ek korumalar uyguladığı doğrulanmalıdır. Bu korumalar sandbox, kapsülleme, konteynerleştirme veya ağ düzeyinde izolasyon gibi teknikler aracılığıyla, bir uygulama bölümünün ele geçirilmesi durumunda saldırganın diğer bölümlere sıçramasını geciktirmeyi veya engellemeyi amaçlamalıdır.",3 +V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.1,"Uygulamanın yalnızca gerekli alanların bir alt kümesini veri nesnesinden döndürdüğü doğrulanmalıdır. Örneğin, bazı alanlara kullanıcıların erişmemesi gerektiğinden tüm veri nesnesi döndürülmemelidir.",1 +V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.2,"Uygulama backend'i harici URL’lere çağrı yaptığında, yalnızca amaçlanan işlevsellik söz konusuysa yönlendirmeleri takip edecek şekilde yapılandırıldığının doğrulanması gerekir.",2 +V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.3,"Uygulamanın, kitlesel atama saldırılarına karşı, her bir controller ve eylem için izin verilen alanları sınırlandırarak savunmalar sağladığı doğrulanmalıdır. Örneğin, bir alan değeri, bu işlemde değiştirilmesi amaçlanmadıysa eklenememeli veya güncellenememelidir.",2 +V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.4,"Tüm proxy ve ara katman bileşenlerinin kullanıcının orijinal IP adresini, uç kullanıcı tarafından değiştirilemeyecek güvenilir veri alanları kullanarak doğru şekilde ilettiği ve uygulamanın ve web sunucusunun bu doğru değeri, loglama ve hız sınırlama gibi güvenlik kararları için kullandığı doğrulanmalıdır. Ayrıca, orijinal IP adresinin bile dinamik IP'ler, VPN'ler veya kurumsal güvenlik duvarları nedeniyle güvenilir olmayabileceği dikkate alınmalıdır.",2 +V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.5,"Uygulamanın değişkenlerin doğru türde olduğunu açıkça doğruladığı ve sıkı eşitlik ve karşılaştırma işlemleri kullandığı doğrulanmalıdır. Bu, değişken türüyle ilgili varsayımlardan kaynaklanan tür oynama (type juggling) veya tür karışıklığı (type confusion) güvenlik açıklarını önlemek içindir.",2 +V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.6,"JavaScript kodunun prototip zehirleme (prototype pollution) saldırılarını önleyecek şekilde yazıldığı, örneğin, nesne literal’leri yerine Set() veya Map() gibi yapılar kullanıldığı doğrulanmalıdır.",2 +V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.7,"Uygulamanın, özellikle framework'ün istek parametrelerinin kaynağı (sorgu dizgisi, gövde parametreleri, çerezler veya başlık alanları) arasında ayrım yapmadığı durumlarda, HTTP parametre kirliliği (HTTP parameter pollution) saldırılarına karşı savunmalar uyguladığı doğrulanmalıdır.",2 +V15,Güvenli Kodlama ve Mimari,V15.4,Güvenli Eş Zamanlılık (Concurrency),V15.4.1,"Çok iş parçacıklı kodda (örneğin cache'ler, dosyalar veya birden fazla iş parçacığı tarafından erişilen bellek içi nesneler gibi) paylaşılan nesnelere yalnızca thread-safe (iş parçacığı güvenli) türler ve kilitleme (lock) veya semaphore gibi senkronizasyon mekanizmaları kullanılarak erişildiği doğrulanmalıdır. Bu, yarış durumlarını ve veri bozulmasını önlemeye yöneliktir.",3 +V15,Güvenli Kodlama ve Mimari,V15.4,Güvenli Eş Zamanlılık (Concurrency),V15.4.2,"Bir kaynağın durumu üzerindeki kontroller (örneğin varlığı ya da izinleri gibi) ile bu kontrole bağlı eylemlerin tek bir atomik işlem olarak gerçekleştirildiği doğrulanmalıdır. Bu, TOCTOU (time-of-check to time-of-use) yarış durumlarını önlemeye yöneliktir. Bir dosyanın varlığının kontrol edilip ardından açılması veya bir kullanıcının erişiminin doğrulanıp ardından yetki verilmesi gibi işlemler buna örnektir.",3 +V15,Güvenli Kodlama ve Mimari,V15.4,Güvenli Eş Zamanlılık (Concurrency),V15.4.3,"Kilitlerin (locks) tutarlı biçimde kullanıldığı, iş parçacıklarının birbirini beklemesi ya da sonsuz döngüye girmesi (deadlock veya livelock) gibi durumların önlendiği doğrulanmalıdır. Ayrıca, kilitleme mantığı, kaynağı yöneten kod içinde kalmalı ve dış sınıflar veya dış kodlar tarafından istemeden veya kötü niyetli şekilde değiştirilememelidir.",3 +V15,Güvenli Kodlama ve Mimari,V15.4,Güvenli Eş Zamanlılık (Concurrency),V15.4.4,"Kaynak tahsis politikalarının, iş parçacığı açlığını önleyecek şekilde, kaynaklara adil erişimi sağladığı doğrulanmalıdır. Örneğin, thread pool (iş parçacığı havuzu) kullanımı, düşük öncelikli iş parçacıklarının da makul sürelerde çalışabilmesi için uygulanmalıdır.",3 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.1,Güvenlik Loglaması Dokümantasyonu,V16.1.1,"Uygulamanın teknoloji yığını boyunca her katmanda hangi olayların loglandığını, log formatlarını, logların nereye yazıldığını, nasıl kullanıldığını, erişimin nasıl kontrol edildiğini ve logların ne kadar süre saklandığını belgeleyen bir envanterin mevcut olduğu doğrulanmalıdır.",2 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.2,Genel Loglama,V16.2.1,"Her bir log girdisinin, olayın ne zaman, nerede, kim tarafından ve ne olduğuna dair detaylı bir zaman çizelgesi oluşturulmasına olanak tanıyacak gerekli meta verileri içerdiği doğrulanmalıdır.",2 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.2,Genel Loglama,V16.2.2,"Tüm loglama bileşenlerinin zaman kaynaklarının senkronize olduğu ve güvenlik olayı meta verisindeki zaman damgalarının UTC kullanarak ya da açık zaman dilimi ofsetiyle belirtildiği doğrulanmalıdır. UTC kullanımı, özellikle yaz saati uygulamaları nedeniyle oluşabilecek karışıklıkları önlemek için tavsiye edilir.",2 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.2,Genel Loglama,V16.2.3,Uygulamanın yalnızca log envanterinde belgelenmiş dosya ve hizmetlere log yazdığı ya da ilettiği doğrulanmalıdır.,2 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.2,Genel Loglama,V16.2.4,Logların kullanılan log işleyici (log processor) tarafından okunabildiği ve ilişkilendirilebildiği doğrulanmalıdır. Tercihen yaygın bir log formatı kullanılmalıdır.,2 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.2,Genel Loglama,V16.2.5,"Hassas veriler loglanırken, uygulamanın veri koruma seviyesine uygun olarak loglama yaptığı doğrulanmalıdır. Örneğin kimlik bilgileri veya ödeme detayları gibi bazı verilerin loglanmasına izin verilmemelidir. Session token’ları gibi veriler ise yalnızca tamamen ya da kısmen maskelenmiş ya da hash’lenmiş olarak loglanmalıdır.",2 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.3,Güvenlik Olayları,V16.3.1,Tüm kimlik doğrulama işlemlerinin (başarılı ve başarısız girişimler dahil) loglandığı doğrulanmalıdır. Kullanılan kimlik doğrulama türü veya faktörleri gibi ek meta veriler de toplanmalıdır.,2 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.3,Güvenlik Olayları,V16.3.2,"Başarısız yetkilendirme girişimlerinin loglandığı doğrulanmalıdır. Seviye 3 uygulamalar için, tüm yetkilendirme kararlarının ve hassas verilere erişim olaylarının (verinin kendisi olmadan) loglandığı da doğrulanmalıdır.",2 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.3,Güvenlik Olayları,V16.3.3,"Uygulamanın, belgelenmiş güvenlik olaylarını ve güvenlik kontrollerini aşma girişimlerini (girdi doğrulama, iş mantığı, otomasyon karşıtı kontroller vb.) logladığı doğrulanmalıdır.",2 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.3,Güvenlik Olayları,V16.3.4,Beklenmeyen hatalar ve güvenlik kontrolü başarısızlıkları (örneğin backend TLS hataları gibi) loglandığı doğrulanmalıdır.,2 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.4,Log Koruması,V16.4.1,"Tüm loglama bileşenlerinin, log enjeksiyonunu (log injection) önlemek amacıyla verileri uygun biçimde encode ettiği doğrulanmalıdır.",2 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.4,Log Koruması,V16.4.2,Logların yetkisiz erişime karşı korunduğu ve değiştirilemez olduğu doğrulanmalıdır.,2 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.4,Log Koruması,V16.4.3,"Logların analiz, tespit, uyarı ve yükseltme amacıyla mantıksal olarak ayrı bir sisteme güvenli biçimde iletildiği doğrulanmalıdır. Böylece uygulama ihlal edilse bile logların tehlikeye girmesi önlenmiş olur.",2 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.5,Hata Yönetimi,V16.5.1,"Beklenmedik ya da güvenlikle ilgili bir hata oluştuğunda, tüketiciye genel bir mesaj döndürüldüğü ve yığın izleri (stack trace), sorgular, gizli anahtarlar, token’lar gibi hassas sistem içi verilerin açıklanmadığı doğrulanmalıdır.",2 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.5,Hata Yönetimi,V16.5.2,"Uygulamanın, dış kaynaklara erişim başarısız olduğunda bile güvenli şekilde çalışmaya devam ettiği doğrulanmalıdır. Örneğin, circuit breaker ya da graceful degradation gibi desenler kullanılmalıdır.",2 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.5,Hata Yönetimi,V16.5.3,"Uygulamanın hata durumlarında güvenli ve düzenli şekilde başarısız olduğu doğrulanmalıdır. Bu, örneğin doğrulama hatalarına rağmen işlemlerin işlenmesine yol açabilecek fail-open durumlarını önlemelidir.",2 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.5,Hata Yönetimi,V16.5.4,"Ele alınmamış tüm istisnaları yakalayacak şekilde tanımlanmış bir “son çare hata yöneticisi” bulunduğu doğrulanmalıdır. Bu, hem loglara gitmesi gereken hata detaylarının kaybolmaması hem de tüm uygulama sürecinin çökerek hizmet dışı kalmasının önlenmesi açısından önemlidir.",3 +V17,WebRTC,V17.1,TURN Sunucusu,V17.1.1,"TURN hizmetinin yalnızca özel amaçlar için ayrılmamış IP adreslerine (ör. iç ağlar, yayın adresleri, loopback) erişime izin verdiği doğrulanmalıdır. Bu gereksinim hem IPv4 hem de IPv6 adresleri için geçerlidir.",2 +V17,WebRTC,V17.1,TURN Sunucusu,V17.1.2,"TURN hizmetinin, meşru kullanıcıların sunucuda çok sayıda bağlantı noktası açmaya çalışması durumunda kaynak tüketimi saldırılarına karşı dayanıklı olduğu doğrulanmalıdır.",3 +V17,WebRTC,V17.2,Medya,V17.2.1,"DTLS sertifikası anahtarının, belgelenmiş kriptografik anahtar yönetim politikasına uygun şekilde yönetildiği ve korunduğu doğrulanmalıdır.",2 +V17,WebRTC,V17.2,Medya,V17.2.2,Medya sunucusunun onaylı DTLS şifre takımlarını (cipher suites) ve Güvenli Gerçek Zamanlı Aktarım Protokolü (Secure Real-time Transport Protocol - SRTP) için anahtarlar oluşturmaya yönelik DTLS Uzantısı için güvenli bir koruma profilini kullanacak ve destekleyecek şekilde yapılandırıldığı (DTLS-SRTP) doğrulanmalıdır.,2 +V17,WebRTC,V17.2,Medya,V17.2.3,Real-time Transport Protocol (RTP) injection saldırılarının bir hizmet reddi durumuna veya medya akışlarına ses veya video medyası eklenmesine yol açmasını önlemek için medya sunucusunda Güvenli SRTP kimlik doğrulamasının kontrol edildiği doğrulanmalıdır.,2 +V17,WebRTC,V17.2,Medya,V17.2.4,Verify that the media server is able to continue processing incoming media traffic when encountering malformed Secure Real-time Transport Protocol (SRTP) packets.,2 +V17,WebRTC,V17.2,Medya,V17.2.5,"Medya sunucusunun, meşru kullanıcılardan gelen SRTP flood'ı sırasında gelen medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.",3 +V17,WebRTC,V17.2,Medya,V17.2.6,"Medya sunucusunun DTLS içinde yer alan ""ClientHello"" yarış durumu güvenlik açığına karşı savunmasız olmadığı, medya sunucusunun güvenlik açığına sahip olduğunun açıkça bilinip bilinmediği kontrol edilerek veya yarış koşulu testi gerçekleştirilerek doğrulanmalıdır.",3 +V17,WebRTC,V17.2,Medya,V17.2.7,"Medya sunucusuna bağlı ses veya video kayıt mekanizmalarının, meşru kullanıcı kaynaklı SRTP flood'ı sırasında medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.",3 +V17,WebRTC,V17.2,Medya,V17.2.8,"DTLS sertifikasının, SDP (Session Description Protocol) fingerprint özelliği ile karşılaştırıldığı ve doğrulama başarısız olursa medya akışının sonlandırıldığı, medya akışının özgünlüğünü sağlamak için doğrulanmalıdır.",3 +V17,WebRTC,V17.3,Sinyalizasyon,V17.3.1,"Sinyalizasyon sunucusunun, flood saldırısı altında bile meşru sinyalizasyon mesajlarını işlemeye devam edebildiği doğrulanmalıdır. Bu, sinyalizasyon düzeyinde oran sınırlaması uygulanarak sağlanmalıdır.",2 +V17,WebRTC,V17.3,Sinyalizasyon,V17.3.2,"Sinyalizasyon sunucusunun, hizmet reddine yol açabilecek şekilde yapılandırılmış bozuk sinyalizasyon mesajlarıyla karşılaştığında bile meşru mesajları işlemeye devam edebildiği doğrulanmalıdır. Bu, girdi doğrulaması, integer overflow ve buffer overflow'a karşı savunma ve sağlam hata işleme teknikleri ile sağlanmalıdır.",2 + diff --git a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.docx b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.docx new file mode 100644 index 0000000000000000000000000000000000000000..17f91f91bee1f780c3d84af2af21621c8de993ed GIT binary patch literal 223892 zcmV)WK(4<~O9KQH00IaI09brXTf7#JoU;J{0JaJM022TJ09!+EZggdCbYE0?aAk8{ zE_iKh#g^G>!!QsN0)1%%O+P@9#)+u4AWgQv@7QikNki;3F?liA znz{GrN-`RZH#&<};DfSe826HH9Dxy5Dl;F(pVODleLNlwrdtOgqEZuv@dD93Fc!oD zG!Kb&U}z+@UUQ^ZKWC1MFFps>?{@E)um-_k2Xl>hG>_EbDTs zVa%P&l;B9itQchn8$D#LMyq?4?^$a}KUY?_puBQmCg%KJj zfwcdieD==fC}iqAQ*xN{Sq7J%cqM(5g8C=ky1>ZoYzD|rk_6cy5C+YH*+>4k2+f2DA7f@(x_W$HnM)p>ObQS6kP96*c4 zVjJsGN!L>>fJ^Y_|8@Q_l)_B`Zm$i{zaBuoTCF5d3O5C4A%W8XTG)h50W?U(nSYi2 zUgFGr4?^ku3Rrxv7b%MCRakKm9eo2(O9KQH00IaI09brXTeo+l@8+Noe~dmdUru;%oQpS5O9KQH00IaI09brXTNav8 zs+p_-0B=JL01*HH0C#V4WG`fIV|8t1ZgehqZEWnl+in}#nkM)vfoxPk>LG1XXE|$E zkI(6CJMFfVC!m1FB4bgCWH3S<2RX^By4w%Xz(yA^GamGfF?Ty}^2%2&=Zn;n%zs*^ zAVrH#k*0R3YQrgs!H5;>@E^bb`~T^`{4z?Tb6u24p8e^o?w!t8kwlA)7yJ--mgbGt0K5QEAPGi(^sceb$0LW-LikGN2M%*I-R|{Bb8)d$!$hgxlKM8Bz^rz24HSdotm2zpL>%+r>cVY zE>DxQ(%dco(^qwo-IH6jM@hfP%Y0C^`}yb|-$njozHvV98|S0cT=%xyxx&41(#$v1 zRo*Nv)Z0s@_blmu#vR~WRbANEdwcd7_XwB%5r6mYu+GpVX-uDZIR*FMaYW z(E`^#z4&mhvo!hmE?LqO9_1h370Y~uqe^A5D&mj724A{sR^ig6II4Tqf~)a8%93%O zE$LNu?{w~T7JQ3Gs#@d?UaIlOU&|$pf2*^#J9GGDT*-fUgdlKVtD<_<``P>LsY+8_ zjO|HLJ$TD}5IxMZ3dCATZ)vaoE=&Gwl2``z`P13$>OKXEEwJ^V&1)C&tt<S6RRdGwF} zz0RwzyX|fMA^Mlo=wBw$ztlJcdxtp#DD{~t%r3h0DxJk8tGyzGS9G_|8dslB96Uq!^j!UcNfAG~ET(=7Il!nd>rZh+EzeOBO3t z`&12wAAg0PuR6}H1;#1DtBSrcPg(HzKS_$Rg1xU!3Uzk+8Hy$HR6yi}b>zfqD;gy* zQ>iLi(TPrz-``b9k@R7D;SZHAtEirgR0f~pwI_1BVFW62pi7XJ8qamoieQu%@1s&x zAAjwC{FSZ;>ny4+J`8omH;iC4)PN=;v$u+B87qGU2KMpS5&k}GMM?JiI~D0_q=zyX z`Wf#V+m{(e$;JC5i-vWY;+Ine8&LP*GIMA9ES!ZCUFadG_GE>%7-G)c0tX#(KJH{u;*25WlK~GxM z4m8R%BDL3wST#kLDv`^F@KBwhsjK5B$q5;E(_;`54t_iXp_nF_rXN8vqTS#B1>A#f z=Wu5qrmqh|c&D?qy}ieC4p$8Zx?er!YkPnC3RW_ue+&AzqJQ~P)I>!T>#`4@rC{@B zC5(scj6Z$#RYYqI&)}7QZH!U)uDVC_m-M|KLAR@@E|NcB=l=6Q!B1!_^AFiMJQJq{ zf9ZdF?#6oOE*$a`UEY;J-#J5NNaNj}HC}TAzMaBHyvX~*GRksL8rg}yUljSoUZz(_~QUB zegjXSyL+G94ey4(m9Rmg-rJXX4DY7uD*p;^@XMeW;eWwpiGHD#9h>!4xL@XOmb>oz zXK*Z@>U3ZRDQXO z-;&oX&+KH<%HIukl>a-P6L%o)dgtV-XYU#A8aaRq9Ddnl3m)_b;9sFNv%rHM=4ay~ zIXSJO|NZ}gZ0Q`dQNTpUr#gD|!~LVz(UZIeZG*#~Ey=HSG!JS}OT&u~pfCS`4Sot1 zSpiEngwv47QP}y)-ldRngzCY3$69f(=T2LpVNO6NJj_RcIb*nefN{v`Aw7@dW-0cjWPHAMTkU&i?z|;JX#ytk3^~ ze)`19!108cujC0o_s!o^Jy>KXKZf%gy#W0@W1a50@vL}Mf6mL(=wbA<$jh=RF@v$) zwG;PcrtiE~-Te~(~DI*lII)oD)`)hFlgu04`7WXs+>*|P6s%f)*XTfe^> zsrE@x_v&Q`my5rcXTauwXZ(kiF5Sa}nbPI6|GpN|=s52s3QUgE42>dOrc9Kb9>k3bDn3W9vC2KN|E@}E=z|CuvuS5bfa^VHvgQ-5*t@trQ( zV9x7NnzVjjUL#i{)bhOH^Trw`Z?D{OeXkH zkHAx2t7G)6RH`4n&~N7{y)Q1l;Z#NsRgvlOT20;&?A{`eo~pY42W8N~JQ;N8WYCX$ zTU)BLr{Z33r`y>*(7nTMtPeYby`8=8;g0U@@AM8k@%9oW(F_TM8HPt1Kjp-n&eECN zeBOXQJJ}$^GU7OL;uwQBUPcGB?Bikd_}~Ba-^M!9!&Jw~a0Q{H$27d%JHN~tq8(d| zLn@OY4S1OR{w|5mRZ%KR%wa;S(!+%Aa&qw@>to_=q$zC`^UGu-xQ%4P(u)t(0Mz5t zr23}r!3*Ov;l6pQ#*w;s4->P37hfa~iQ!uur;hF)eSZ{n?{sL?8GO(^7V{7V#aX>@(R)6mHz#m9>Qc4FkkSxlRId0^l{gf@W+b}m@=LI zzD#+gMrJEF_8>hLZbE5$|6cGX+{b#HT(TKwh{?l-m~s1N9tDmoE19$x5zV9PB--8`i` zuWB+s{w*D%d@R(Egi$nx)5qa_JQHwPN+Pt%&r;a=!wANPf1p{%0kBA@5Q31AkZDDu z91c=xa52#f@|L)}8ImsLV6UJ+;EU zE7B2O$%l7jbW4yq@GY4}){$^I=B+B#ht)+fm!zO+czIH7CL32&oI9G+m=ZUmD9b^R zmhNX(pkdCznMsB`tEdb!Q3;|5VCw6B9oJXRY;AYv z3GOWqwq*qu{I3lcO1f>Bw3Bp*)36LFgxl`Oe{yu+dvb(gL$A=-eNaa|Saduwg+5Ov z<2-BOW*s8_szQ@6!pXQa@ksK`moWUpy-$umt4I7plAfp5TbCJ!51+;6kKInkDoy#; z6%BdZw%_UsJPZ_VxCdXsB;WHC8SP!W5n2)2H@p!1?y-WCu7=H^$n|BV|NUS8uLZ6) z8oFgwG?;~+hK4sZFu{e!@P9Aq?Go6bBs|#uMOjjh>rq;xW(;H}DXbtTA3gOI4{S=< zWS|{kVTM^UY$(7S z-ZPz>LyJbJ4~^O#qPNQb@}KNuM+A6)^~p5e5nM5tg1EK=YFr5axp==AL}3L7>VZzt zdCW+&*&PVSt02rLjQbH77U(P8i=5WsljK%nXfLOQ=$V`HQp5_a4}a<5H&z;zMhs;H zBCAwmn8qlX!1r`7p^X7cTvQx7=&6tI=sd*r7#;=V@^%ZN*eY^x@gc1!FHRI#s|w+# zqI29>QO2PeCW{0@5C!6Cm5fn7!lR0$B;A#fhy;Izo@n-Erf{Q!0D%$Xkk(@vpBlx? z3wZ=`pR~R#8d^}OgAu3;?~GPWid%UIXAE3B)DLhjMkOwp-S`*@NEPo@-ok8EmUMGx zE}~s9r7iBr7@}^=xYOgrJY}Tu0ic9PI3qGftm-L|f$M?SmFgV5Re1+qxl*=-bz$X+ zTPngGAnnaMJSxF+b@$wklG2zvG{Z11)UYMkJu)BssJ?Dk*Eq}g zp!L`%KZ*GJ34<9h(KvB7gaGgKlq|v&PAA*CAOCjo9$sSTAO7w>*cZQn?><6#ikkHI zcOd7Y?cI*|?&O1L|BUl@Nbrkf#Baev17NneOL+2W-x>6_5!~^`hl$Q)qtixvs^J0* zX*70hV3DGSfvW2qjWx!qq2C7I98|E9pgCa8aUW=WeX(g}i+xID&oEfG<{7Np&R|vL zc?oBs%>g`k?`7DhUO4NidCtm=QJ7M5^fF%%qc4`YGaQ}5GUNPD@Is0eVc=-Q%hyY) zkskBNqm!hUuuzH6ZZ#hbX)}Z_ps|DT#w2Q7n9Ors=nJ}^!0pcAxl}^nDJH&K%Xg6Q zh6%_`|1Pkx$qe97tNneT#<9XZq{@ca!cd$7(`EwaVT_;9tH&yc<|gCBZbwv{d>AHr z1pl6*4TEYI$4QZ5x3O&u!jBi`DQLcmZ2Zg>KZLQ&LL*wp1|3+@JKG3j1rZ)W(vM#3 z6kT#yj$97$N}XU^D&o2P-tzLC@kKZ`4${z@nHl+{<$5gh*_v52f>VWd#Rz<76hpWf z2S%x(-I#J+3XcT+6X#P~ojBIb;Oz)p6e3-JNgA3PV+6{n1CgEelhk3f`N;CZ#i$id6O;(3jp)Q_&vNB2 zi4J4gK~@7UGrABJxjR=mhW>%t=}wyh=53d32|Sm_tm=5pSWi;PsNT&naQUcv(E@Ri zJJEM+gQo1J&@t2g!IR*hf8;{@5Q~$VrGJ_12$ZmFdSr6OPF0a$EUm6;jCml!KO;$w z)~g0>!ISIjiZJ5NJCe5%Ce?=Y7_@Gsrl2C(ITP3t4h0MtgO?87FdtGJi1ngTfh@c~cy)!*1G@z@LF$r1(YRpw~ma?m1*(VOMyfb5l~S>o&(6h;?+Ei$rt!0!6? zi0+k{aIYP!8W$2k1>gCMM@13D^AM?o$>eH9fq@4)1LMHD^S&9D6kxL?M&L2`L}d;E zx!M?*gdGNY#axAkig%IBsf#4xto7Ml5~IeCt&j&_Q0@rdN>@WV8OaEDHT*3n03U6E z(6-{$@=jM0u1T=a!E?wFf&*a@f8KgE2is4=T>`5WOWZwti3aya5-hJsC=vFbfC+iQ zhItjM+g`=0m4(Z&qpa{>l_B+wmULK}uy^jsdI|N!h@xWwnQ=gk&lv2Ul4XFAQ_+K@ zc{lu+r6?t8)x?DsdR{n|;^9UIv*cs*#lM#*3%*^5BEmcw?KRK?rPVN*5#Bsj%$H77 zTCGyBe*7B=pwjv1E!d%PRH6V9t(~Vyl?yfiR=a}3TgWg^)JSy__n;;$1i-CB&(gyD-PM!0^$f0k4TV(d1uB?*66rOrze zrAF6NYH}zUdNK>aZvu6PSXl7#(FUag5L!6Txt13D=)f)bV z1<|G55GKfu?w(Gk+*=z;A3Hj}HCfI&SVj1i7R;@dAl>y1TdfF#PJV9j7~kVL&i#2k zsjs?l%NIE$KS~wrzV`7`mgSMbQ;z5eq%OJlcon-ILxOB@G`$t&!+KozDPqV1hu}S# zPt7O*P?FPQIi}`V57l|0BufX9%%FSV^FG{*0EVSHP0r}qr3obx1Y^Oh_`CwkZLh%6 zZO^5+qxSA!z)l~+q*KU1G-a$MDrjPT2C9X+2CFitG!8a5f046$1?A$54Z$m%X;Jyc zh@25(ZUn;Z9t_QmjZs}zo3fSYY=JrkBjopYb?WSo^HQ?H(MEZi*J-?I@MxDrC$2XF z1#dazddgUjDIV5}u=K64@&PO#n7`j99xOyuI=jtoDa^Y=?kPkG*~@lQ$7 zmvu(LR*nNT6e67unPWaBcBMvY6_YYE8E9jj$}p{px*pTcJE1hmNKwFB1j5X;E=x+v z2ho-Y097*q+KO?>2Bgh;ki)AEt?i*pAJkJYt%f!0*&!aF3T0!ZM@g8T!4=k(iJ%3k zmzV=7Q%3Do#aOcdG5{R-G|V3KyKN`6?XcX-kZu9qd=`LwRYLElORB^Cq@OFfpFOH$W=Q8% z6yL)&CX<8%dKAj{&lx;(0J|Nh@l=(iDk&cB;e-71hQN0;O1#_}rZZOts=x#)__w9% z38r0?z*<<~6!?^6LiGE)WKeK12jL*r!rZ1Xt;6pp14Z@sVmJnBk1?qzZcmW`BE)_X zT$65t3dogCx@sd2!Q*`2l8L};3=tRJ7V_ZmBS#bvCg}`=Ku{x-1l3OJ6F49bmt;Zk zNG*$^go|i#%j#%?va&FYkQqdn za$qBZP<`Zdo-M4BN%6s$&fHl3Y&@E~#qh8&6d#Y1z%miyfz>#eU>6V73e9K(zvA$l zO1wfj9EFONEode@ z4pnTo8VAjQT4?+Xr>IG>B#DR1Wpy@8B>8OsIo?;i<^!w4&dwGRl@wdq`d2cBZNTsj zl_&EbTQfH~?Qk!H3}-{7vRrBIHRll{LlcN;Fmpo6hm5hHUc6 zjids|6fKKT8d(AfKjv<@aX2F4m~lu(p~pB9!D`G7?|`z6ZT8m~?tLeEU8pKCG$t(@ zba49KI45b?n??IUK8ggkJZ2$!dHZB#Wv`GCfLY@H>3MQ#*z8Q*DrytjS~M*@lm80nc2o6k%w9Agla&s3~egyLsfS(!~xsT zuzSeT#9)=F%3J1-6k*H$mP^2ZqqsN`Rn(oMNV^= z+0|xDJV70M62V$QPiKUpW-S=r_`H^Sc%DJ+z}JmO-|y*(C)9iidRW&%l%t5|unl@{Nfq*yXgDO} zlM$Y4FA$fSP%>F;zKcsw;Sdq=o{lNn#P$#+*tra{$s4 z)@Bv&{!@}^7ObZ{?L`;zB?*-X+aPtx5oT z=XhQ?E`YF2Q6s|X(PIp2xEf;F;HOhL(R5%?t^qZl=r>+1iRA+7{M@wH4$|HlhgK?r}aWjV9I-%rX~_y!xy< z*g`lLVZrGt7UVf7Zw`bJ%_yHL-qF4#>Ltuf5(ArACKKQ0rwT5VdT2hX=pVYB4kZP~ z(q>hHTwKP2PJ~x#+X4f8sElJQWGzgfoN>{TIS!skZvs=f#ac=y&_e=;&{HGPP02sz z07ILGoi7&hbY8=g9x#H9g(<6k#EDu;DC#0ZnbL`kJ%zMbF6umO zb0;$$5;p9m>`kiKIOAh*37Au!S>21W$`WIlbMG7BVlTxBMY09TcPd>*P*7)?FleR97kJ z=;#d2L&eM-ba7%#0*+Eqd3%Z(wGD#ppw?dtFbkS9pz5o7p(iX0xI#0x*#cGHS5vMF za-g~v6CfImwc|D!xdI{0;erKEJ5BDdKn?Fqso||9s^P6wso{&iph@YRjb7~st|Y($ zBC5t|bsCGjFBAJQfounjo-+7CwYke`6JtsC5wRw517|OpM#%XW>Yym=s*l{qN1{^M zppfy4E=94nru6$}fJ3EEzX$@y*RrNod6ouDmEk*>{!AI)*o0Or3K2nmla!n#nEe*KLfIdlmzrToI%_o?!|(Q2JK8&x;$*IHdDf_;z-u4(XM9Ieo?<-Tnf$ zvd*jyZk|)|(e0r$j+6@}IPMZWVN^uesF-&TLh5plgftAkOo?YuegCkHM-09A)g_aC zUc9CN2u{%K*h7d?<`AmzVv(y)P;*pAK^$t5`^ZKNITHf;>P;JV=8-$>c;pU*@oAed zYrD2wZs~F$=-&{g$cA-;=dFxwlKLhw#=OU*+@%X{&dGwzVjqQ-IgxltR+~O1mz6OH zDygY^PQ6Kq7Xm7AV!`F8gW+2)b&PJPG?`Ech&$Fao{x}igwYXsKaxi=f+D!eOLY5e z^A?ke-*tRQ9MrwSi&+jWlS)}pX|DzOj8%$B>V8n%JW62EFi_>g*^$?mOm_||5j&Wo z*bGIk6SnYMq}Upj)E@JoaTP$6X^K_Tu^%fA{^65YUl~J{!wK0C;X&{9c>z8I+=u_f z7^#MoMq4g*cq#%sxr>AeNPDRk42cl5j(lpW4X+dmq)!xH&yYb)>J9Is zd4>PG+fAZdf)%v=^0#I2a~cSP|E$?!X{KO3m}V3;q^Qdfrd~z8dCY3l;dCHI6rsL^ ziQdy)f};#IsN=I2IxD{|$TtqujJPM2R_0goubbDez!;FhoHqx9fw-})tYjBb0&@Z5 zkL3}Qa$YJlbo{}CB&`YqOK&pjS50&xo?7@jobms)Q;+ajWS9|k<%SNq^n7i5Isk^EWnO7IQ zb2!y~s$Euvs`Ssvl5(*8l*m10l?Tp;psq!H=cW2NFYdfdGWhqks`{sE5$D-h+WS7> zEZLps(iQK{Pm3`pE%wfvu2&3p=HYxHT9$;5l$~h!K243crMg7h6jb?;Q;1aEPgV?d z196=hg*vcU#cscK zc?0RI%66UPK*YwXoM6>$S*KAHvJ-+i2$^`%xoGuM5Zc3hRAMe#^_t$w{A5B6wx=>i$A?uojctt ztk!ka#MeU<8RAX~XO>qFa%mXanw4?V?DChe$B4Aan7~H=-t@>R0=h*@M#bDzMrsck zzuyYmu6iF@f~y8=`*?2k!3;BR9&f^Kr{NI7)U*wXd|7@Knd{~uE8hb)rJbql@_HMK zA98U<3a{Y8a+a5n2ZR!G-88(KAu3JMc7kaf62o12%bT>H{ z{E7v5%8Y9)oO2T!4jHEMKtz_;SUc!a`SD#MsivWaDOgF3 zW2{wbK^4qzz&j^Ev&p$5w23!cY(S&jE|ZBLNC?!?lzSaLMTzoXU$oExKg#<xQL~4!I98@c7~#zA^nP1*W$q8ObIV+VSX{Jsd_VX zKjAr(!P!8`P-xjCLefYOp&v44O>|BPlsPD+X+^W!ER6{ijn@(AN8Q=k+uA+Y@5DR1 zJNw)5;ZDD^-QVrU2U|Nko$mhNaB#R2FC{}yOB5<{5M1AKX!1V1?x0f918h=;H32J2 zn^@{>8Wr#Pi{DPPFmj-)NIsuH%>JmzDP%;!;J?>JPgTk2;i)Rj(B;BQ?){Hx^|hQY zH0$o*@7$!o{qEih|Fk4o$>r^qr_k1zQ$}U1Jjw(Y<6DzC1VP=sv%SDzuGz=g{(K*2 zIlE|Ck*ofxI;+qjVuLzq0QNxOYCkB>dJwmHxq}Re|^OFMERpIV8@Vt6bep%SGw;0SHe+QXv%v{w z${tHd#9Tf%;1F;9M?A!9d~)G`YcW-iv!8{39=2|_h7%QE&O&^{#oJ1Z){R2{_c|$H zU9-xQay^#_7b)x25MIU!@71^aS!}-{b0!g3KdH1vGH`cEv;6zJ+Q!`C%c{EOgfG&( zKU^?=@m)~fPaGrIVI1+CNZ+52>MGLqaMzhb`f|8M{PNguJT!fui}!F<;RD9b!0{Yu zL^&kWmzQ~gqq0y*Zul@NRVpJY74sI_R$*9QVSrB@q44<-9nF5WvN-;6;MY;A*4y4* z2HzuA^|F6bv`M^Q5}Y>`C9MdCk{3*tgQ3YHXcib03mRwB3n9@QSyHFz>cKB}w9ZkS z$;_ZEYcJJjN0Eb+gn#($FV$-QbAhYnwHLbozb$FxerPa)gNgiOA(`OX>=;rL?L}pB zYf8PWiyd`qa^7^4(*pz=xZUoZ!2ThoWZ~1>cu=oPaBrscb>seTVW4t}wx(nWFmF;h z>aNX2jiJSJIp5~hz353^j8tX4b|VHEKw?;&33^~!<9fup7BB^~9u~YTfArG^$N7>L z=;Al9N2CQN6Gn+`VQen!$a<~{0jXKGLncQ;7)bOlz;^1g8!X4NZb(aXsKM8GmFY_DuW#I2xP}9g^+O0i6uy z?I0eiPcUWA$hysAo!i|C;T_|o4Q@k)WTqq4##HyRx^g;9#Km9C1EY;6^29|2&u4oK z&mFv>#XNBySzAK&JJgS+(8I8giH~k5KaFje!ZP5>4qbB#JgOFDgdEG`Sb0>14}@~x ze6ck<6VGRp`x_(u6YNH0`ibR)UHmr2oyOV!CewAZebJ|J0XHYtudtFI8=HP+w!i#T zw*QI0m?P8I+N(A)B;-P^WOx8&d_k=jlRudaWh%yb_ia<*QbNeHxe{-N9B9(ecpuFx zjo&?-F08TAtgTEn#j>h`q{ha{Py57GiHJ)I2mS6j$yECXu0X*Wk6}o?C6zeH$|^0f zvVwvJwt>JjpSe-x9tXEng$T08o2U&gW+6GsTu?rcoLz}c+JDGxk%P*nhGDZN7!lM` zA()wd8*?{Xux&g>g&+H!Ztw7LZ)bn28+W$U?w;!I?sfd`yM39!fRS6}jXv$6FnGmt{9HhHtJ+*wx5;pQg@V+u0nAu4vXoJA`AmT$d|6&n zS0B!Rp{f3M0U5gmz+y2(5upFj+??HAePpKA$wPx5@`^mkPK^z2DH`eXeqF)Ercig* z=!IaYFt9VO(J*k#sm4gAP$;zx&Ml3CP`3K4I0=<~*``Qb947D|LSPO#h(2Zk4yQK< z87@uL;IUvBdvDq}^><{$ao_KG{YM;+yN5sat;M;m1ZK$gd5j9X9;3pKz1{7DuIhIV z2K{)ubFj7F8SHH9!`;4CgU+DS?W&!<-QE5&4k_<6Zad7qeTd)DoQcRpXx<=WIF)&S zsq@O4b9Q$FSQQggwkJbE9ev0VeBJ2V>n$c;}>5FLwY)8v(8|W224=zd(s{I3} znX7}ydy6ev)KQI@rjzpqG1OUr1P&~(05X^bFX%H*c$WznQM#q!x=ROD1I_eIK3@=A zd^pADmJaoJsgx*4tecKFO}1zfv_(jKbVrMZtZ;Y;}h)`i}Hm{*W zCwE9NsN``+II}ey(3YXBjJZ1T4H+GjxCA5ZaXPTygj)vHLo7ryt z`aG#8OD&aHqmo|w`G8s&DdMSy;f<-^pw*DD%x4OdV)7SwfV_s+L)H(M@Q1N(MM0Mk zjBeUIxV^tI4E+FV_%&&afvqdgnw5>%0u=jM*5~KCa=cl@fc@gp{nt4ENB{MOpVP-b z{djcb4t_GLZwhlg2IHkNR*I5aW@17#!+k1k-@}qb+I!R!VajR2=+iXnjj<7(8&JzV zg`+{H&~U^|-Zp zWuKFr8Db8hWf~*{Oj*E%XJW4j{u`6?@Oht-4m3XJc_%$p=t_Do&T6AW=f{6ZTt6l* znd($GHVb68q3>?k2e(W`yb3v!wd=9g?VykxmGy)x-leIMi^21r2&2&KGEgQ7E42fg zQyKCkGemMB3=z%(oX@72Aa%NA?)63kl@VFvL)X{uj3ZNXYawUIoVm0|9(mA@2YZKG zgTem(e&-Mz-|qH)r@ObkyWQ{Zc6JZ8JA;0&qYk!~Qha0=+BNAu!t`4f-Io)t#C}C5 z;4zv#=qF$Ng}R4=c>bbR?X*Z@%ould9v@Nek5Wp@3f}ARqIiuRl>aQW&b2VI(AK~=;?h7 zZe{ZynYf&b2b>#H<4VERQEyShm%o79)@1JSKAKnUz1NwJ^`BAS#7eh)mc%7T`(Mj5 zC1uUeT-9cNA|k2Mr*TrT*fwHnlvl~QX`6?Rw`rrsP8s-g(oO@psL`0C3RB^KAulaY z^Pdw_J!x7xaf-_22geFwm$hZcn4%Q7^=ivcz&#IQA1wxsGFLvj1fse)S>@iDvZD=a zB&6vy?xP9cg7-mRVkqnMEAtbWK_ci6L^Fi%% z-G=F`Y}3W7o}cal3-u@@PC=i;f8>=jH+vo?;K!YKKaP9*yPa*-)w>5-yr z-RkwXy1QFS>3Dz8S%y4#^~3$6*Ic76*;IKO8}njy89h>?6ZzwF)9i4VM8|bikLp!P z4H|7L5dJ-a1dllHOc|F#@`9);EAD$>li6N|o2fgwsF!a?%upVrn*U_Dp{<#85yV%)fKVKDe^+hmyeuc(`? zux8hoEj9}fSVXm$+3?$yW!Su?GkXoL%(k~V4CAK_*)5at^E>xkQ)2(fd+y4r>rGb2 z9T7uD>LQm@eXnU@D=)1uL}kQI3OHVs9$AXuiOtk=NLCus3qcG8p6bHmp#Bt_#>_?a zs9U{Wp;ET6kkz(`%i`s#-*}H&)yh4keu+bDD~)n?q@+iOsn%fk*pLhx5_=NKX97X!s$er7t@hJ5OTvV~t;=9xI?v!pU# znx-1ULM_*3)ND?WnZHdgKA5@{jLyL@z0?=uIBnGR!Hj%B&=c1WI|T43Ms4<(GsSjM zx&QhZ=w}9pNeGvErDJq#Q-;moqaZyr=>Z)fHaFpIO~?f+aJvvTN& z^;^X|^;@8~LeLU-0xu0G+!Sf}to}q^mve#Y+NME0Mo~C;UBD%0qEESvG(HL}m}rPp zWO$CfX&EMP&B zxMj&cF${6>9{WiOCYmguNitR#xwn*{jl1^LkW#sHcY|!Vz%K7mmVnE;-P0XiGd8BU zlaW_`r&tis#UKDoIVg1|hi40pcy(sdgW8c)kED{Wj`CrRuVn1U=GsgBp)7u80wT)C zOTxyhBwYlekpsq~t#2alh2XR&D zKM%~bw?9+*hfs+n>wuTR!&apUSg&8w(9l}2LC>C~V3_$NRR%o3c>|MjFpWq3EU2Nz zBIZgtB(h@D=p9SPA{1d3;=fFhZ6 z4-T^B1MNJtwe8w))j5?Wb5mf52X!ii)s{{&qxiC`m+`VC_yW>-SJ@mp%v_dNV$R~p z%|x1K6`FrkdV*;wA*v?vaU$)18S0+qC*`K)LpJ*OCuw2v}K~*boPOvE8c^3XiP1XV)d$l4gn{z>R&-@`}}7n;JF-J`=;@V`Re z3-iT`2PYZF>+pHBcintVfoFO({3kj~&X8gr%~T}-9qnwz4DCo&VhcFM3cAq(nr-z< zI!@ENKJYA|6AG>dy?X!Up^Cn9)lA5j5$kEzoW zoZ_>5l7N&TYBf9^ewQ=n-{Ru(@X_)?xr3;ew6d*ZsnhPI(Xi{bUClbSW-?!p`@$`X zO!2tS0?eTvU&Z=9M<74A-MF9Z3|9`tAZNoV62}2CqmH`ISG#%LvA!hA$?+HZ!}JrQM_SDwt|jsD1b(u+rO@ldYO#l@=h_Fa21E26-N=gk3P(z1rBk$s&-jJvRA#A=kCkRUnBa@FseM!)*}FWaD&LVCR@fr#sq{+G zL+h$*Yatlo2bF)2;3)d=`gJt6~VgmwY`Vms4Mq^~eX`2&|c6MzS~x~%|A zLtQXRBt`Ji=3?*#_6r)B+@=-7Nk)I4dA;7ODM)5G`}kPFv$7eVm3}gZi(r;XYkG&? zZEjMs5@F>wPLp1dRGYKzrrb-fS%lOQ01hLJ0UrnDliX+gK>sRjqE;2QXg7w zf%JswM3`{Xmb^S5GTpl8%F^@l_LX~09H;lu<*2v4d8oGozf^hqaCfi2y?-$1?DzZK zt!=#<>w~?n+TJ_t$Ag{jPG772xO-Lcya<5jeCN(DH2u#FERZEfK=Km(WY*?U*eK@8 zzW%-k^5ed#?JK{|A{qXtbnjK^7Ace_;3v+b-+2h;5qxz{_=cTyiIgnVNp|nE=hkS) zlbCirEfG)BkJ5N=Fp6lP(^3yK=XypWM6nu^DWBnN6x3vrNj}hzFqJE-acNB>MQTyT z&{r@`S}ZHTbj#WV?;|EDkqjc!CA-+_<;8K8un2%Y&6m*w1vy1PMF(kLml zcV98F992-k$SBbBoN&ff-~a#t{H7bg9h+9D-Oizp&E5Ei?SsvTHpOsyp&Rh5ATDVX zyeV)AAWS9;zuO_g5fOg)+9l?i&^T$qL=wVxOdUcqojH@i7S>Qi1h&sM6NCsSL$fwc zDr9YCbS0gp5^~XJAq>LEP60MnU^c{K2P^`I=;38cwp+64POzrI z>r_W>%S#2)hYnSB7S&K zJ6fB|d?u|%IUA>04Kl#S?m44kA@S5*mixqhHD8H+2_j$nb{jI=2jSmkF)Ryk-cH+a`{oTV|r8`?&+i_=m zptj=9?!lq%9V}yC`PuF0Cl*F7NAnFYGyV1AuNnA>-)qT9eSs~=c8&2_{MJbgYt6a9 zr{)DreVnOBpIP}vJYl#mrwj`;Z-TwivUi&GFkKk{^;8zd6WlY0;vpNYRRW49;+h?U z4;Vdv&da__OYuHTMITq_lND)bvS$2Un+18hF?K$-L!)Z1~y0e1j8a(sb+K-jN`LBO)4z* z4BCz|#0BGth5(E^R63Ldg%3@u;-(R<&kOwV_jfdbnBEggilDPGqnc+JC9TNfqQNXr zn2-!n+h8vXXp!jV8Vynf^Mmj0hh6;;Xp%*KjU|@8!aLyoN!ZK@g2v>eI2doGQhmlW z9F-o&$qHl779+-SV+#iXaQx8_;N*|!ezh{pgM*se={{vm8vm&qZp-HxwVE>r& zIB+u03sa&Tvhi#j9lhFYu;g%qlUTc0iI32;;htIi7eg1?R@Mwdpd1VbK}m2kRg80% z^W?dWRb~kT{G&+6-$t|$rjuf8Ta2&LUv=~{hbQ1mJV%n!Qv=Gbl)Td1D7RmUZx1t$56HaO^( z76aBZZ7SEDW}7Zzn&gG$%M^*t3yYKI_;0;xh`Chf%K%bOwbnAY-K0RU&zMXM*jLU6#0AZO ziO)1oD?uP||9aAUH%OydYnbi#8CeQq>~OE`PIQI&nMIHgUwE&8FhqAC`Uy^IK+L@H zqyT#z<}o_b{kll1@g{AUW0-W=OO@&o*fn%nGTap^^YD$SgOs=^jucd4Xva{NGTEZB z`a?c~%y)vC%?wrAl(w@-LUeK!^o7irKhJ`%_ z!J?s}6Nhqo&r2h-=%lF6W<~72pj9iaLyVq5BE_kk9L6YN=U^GKb!wc7QW?kFrkyZk zoq+!!9@=x5JUYiI7VgF#L`#u^WIixHt)!;jbtN<%4u?K(xro*V5IXVYkE{m`t`+HW zn6U7)65HL=;k8lUo959aNb)L~DC{j9{i7P4eI04rPukLyk;J9*^!aQ4S$J0tQheVv zJKl98H@?fvv|9Ul#GGMXVW|3n>YQ1+tRuu}$wHHD$=+xne91CI67sO14^H zHHnZa{nsHY%YhN8G}>jWFWJ`!;N*Nw&4k@xtmp%k54QO_#d zpVZa0tISlQ6=*;_{NXW9(znk{eN(tJW~a?u8j;JfK1U#7Wl$t@-*4tw+xMxb_IG#V z?XBK+=WwU9w-xVf@96HJ*V{kbI_!70_Vj-DP}_>&Yt0PMBs@xfPAZi~&p~8iTEM5d zk2W49C-mvF7=w`2IC@%x8->+eP9@WMaPjj&}?-OMd^xB!Vwyl zHW;9y!1u*(MTKFfiw~@{R}w<-TRWUy{IB%le+5NBHpA@ANr@hgX-US>GdLPVeZ(&? zqQ6!Ip|rJul+mTYWMJ8NA4`PN(3w~)7ugsXT#+P@<&!72TCUS-CW^!Yp&SBY)>+uOhw_+Y%$pEVuvy#h}Mde_TzxdRERn z2Hbt00e82zyS2T$v)kJq><#vJw)O^{ozDL5;bCvkQ)=sAXM1aFtG5)!ZBes7Xf*^W zQ2IKS+#A%iKY*tFP9|`59Jg~u#$#%Eytlp+K2Za7v^+uKfWN%&VIK}$9 zix3P|rB8CW6Ss~aOF2wop(1BirdETiHbC=Mnrr=0?W4M~fJ5BFBW;tF)`;<=x955m z+EJtzraKW6F#~95oK(+>z~^hvW<``F*4Agf;hHI7y2%$d?Juth*q>Vy;K37^XtZsn z+0?&F;ItjHyv-zEungN@>ZFdt5l|uxXXQ~if-i=);)%iqf6JKJFVW1Cb*a$SFnj>HR|<}kz$(QRoP9K8wf(*84td)uY2H?VW9=s zrb>ghRAiYAyA-}Ev^SqqV;-*2k~-YgX$~r1=}}dIV5;oyA4c7+4u||$;e);hGr?2} zPv`Ls!jZD_v06aFEU&hGv}6sn$jD7b5Kbs=-Yhw@sAvn$^4OZta${T`Q$4uiov<(_ zBZE){{hvf6SWre&#GyPxSt}M3SHX!lGp2xU&@q`Zu$Zr~X-$kn;B#6+dI3ByEuz}zcYQi0`9lf*}ST?d@!%*=D@3A z!J^={Bey`b?wADO3B@RuA+?aTAbRXSGWyATb(ec~%#$VWVNAZbX7i83Kr1>ddq%JM}o^vEfo* zsewUIE&_Y0HwVgU1M_8y4gQw}1NSlTNUa_;V-w9Dn7L^^M>I@i9rdNu)MG0YBx3Mo zK^0DMw>VN=EjMg@uZaEiiU$=3gVXbhpT>CSbXD5Ol!bYIuSrIDbyB?0W0D=% z1(E~yM4?)7G>=voqz`pw=WXF6D*8jx@ezd}5`DU`^w>dNM+P}d-WQf!ReDaXgEjBG z)TYl<04|ze33k%FId|TITsxU7c3#kRYs_Ejy{OESm*mMJ3>47vf zgMZC>2GrU?zv)FY6$j12G4G?xOCt{El}2utn zZ9KMkB3Phf^VF+H4!klCIa6)6QI-*Vel86y?$Z-iCfF=q$w&~~Mq_QttqN<|p*2N8 zKypk>m4y3vYGL%84>4h@7BPH}KoB*$Q82B@80XHVTuRR7ZO&yPHq0JQFJuApvk(#i z?QO(-D5h^3Cgk0jGu=#PHw_%q{0hlLedaUyO?4|bMMPG=ax?ULnxkbcJo!ffFy-Ul z;N4$ZKJDwX0LXlXQlAISJlOMf`W>g$eP!Ne1pRUnv){v0eHgk`<^s=MT}a&_ z{DwXZH}))W%V^>bsTUt{s>f;5Oj}H5%U5K~_vEWO*VXs30x;=1jkhwu>BD=Yfu_~i?qA6$B;#0H;nmoNyv)t6da3+JKzhA2*ow!XdyOd!pZx%Tuf}Jv=~P|i zc<|o3q7V4|1sqWL;{Z4Cn;br)a4~p|{2OJv=);HDPdt;q;OD^~vizF|uqO7m@4er+ z&ZM)|G3UY``_m$c@y8SRFWiyGx3#xphPc?@?*{j*_#uUT7>WwmE;6L5sI~o;xv0(uoj*sj>uj< zsJm{xmpww+E4_!MD7h=aW8{mUlYy88_%dpGqOp%amZOhC8TDwRPrvp-vf>{$ zEkzLpfj-)9aK?xZt!7sNATrz26T!ocfrvB_u2y|$z?_Z-iDB&?y|aJ6sZyrPO?sk3 z#PS#$q2lt%}Rx2$9dK!+v@5u!UesFt?03R6xJYL8W>!H3-LOyREBKgUYEdWzn%o`koTKMSvR%K zE|ui2CF!Lx4&k`XOk1`Y_nviUR1lnIbSXBk$C=Rz6l=5H=Ym5N9GuHMBW>EC@Q@{h zW1JeRJ_ur?i=htanp!fI@No^6%+|P%3^$qSM6)((2|E|a;^2ZBJ|B@r&iTFc4 zw0(H-p}P2R1|As)-vUp~#q?x$L;uW6uXwFu?VmWF!}X!uLB_VtuHAPDrpj` zgtadBIom@bf+W9NmX-! z@SJ7&IYvB66!S~b3)!+nraH9xOhQnzb=8;L_H%a3jo9()<=#A!9+;x-zkBn-qlOYt z+w6R)YwvAf2QG%%;v}JQa#AmU=&*bEtSOJCr%JuIQx~cC(WXRSLHxT(}V7?_C~%hP6}ac_^r=O2mfwK@`ihHY>}+rU}+ z(FRqSQ2XUg+c;JZP2<2!X@tAh)3G6gd0Y9@qI!0-j~aHfH+Jx_Xw1&@b#;df=+oTG z2K=ZE7n%&eXF?id=; z*=UegZ(f?RWnqID;AL;~V#t4=-u^7};VIrOt*Ly2$z}X8x+}oBG+|`H$rzvlb}bs2 z_N8<6g==|NGVBx4*lHAQlvQ5n7!^lf!xefHJ!eJdI@Z>2y#xz)dt^TU$n37wk@3U6 z9;q2u_QO6K)zy?_4fkQj#`w9O{`$px*r0a%!U^yX)T^VZqiTaB!urUMFQq&1Wgf_t zw9V}%zSd2=x4xVB#iRSLeIe?xT4Z|G&Sl};_?qobFHv+;j@!hJ%%;V^IUDh2C(*X< z?61{E{PDG_POqZDjpOL~i&9lE7DC^c6menDF-BB2TCQK&5V+lT*ShTv)@s|mP{;a5 zNpAFQnZtBesL{2_Y!^Q^@bCZnKgv^`rfmW^W8KKOPy$5F{8X@fc{Ah%4*HCc`X;^v zS00aOixka+F=fkKAN3ohzHj>WJzT5p`-u5}6DH!|el{D0KGDByioV5)ouO%p7j2xl zgez95M!0veiC8i@NuvM#|H9_mj2w881SJSrWpC5SsAi@DKtcu<;&ZzZm!1~stkq5o z49SN_-=lCt_}9gU^lDzvEEn9|l=xx1P#YDws|bO{a6j_A-#mF3?Q{=1rs+%smNt$7 z>>R9w^%&Gt7J1P&Q>~LJA`G{Wwoqbz7qoOa;80d_O* zzHFM|8D@VTXp53Gw=RryhMUT8 z7!dQif$egcOBPO)LkKV#)7S7}UrjL$l&19<9O|JGt{E5>lHzf(>72uR3%s54_q%Uz zfwzAw=x__XU0#G~d(D8iKm2s`?1!J8qPZc|Ok9#D;3w+tFjV6Vfp`=*XC4XS9}eM( z1g9m5Xz689gk{WgVYLQII=a+V1A284Wg^*6OH&ewIZA~t6klb5eNzIWH#@Puy=JJ{ zARemW4jaOEb94rK?j(Br3tn4dXNeaoJE_$PT8w9pUr3$50T6yXzYVq50YI_lVDMKv{e0b~k3NtrDpCfdreEeJ-#eCe zm$qIJ_b+3ju<3y3DEs6Cm+o15@|~zO7;gB=ATM-slD+Evtos53e*= zP^hk(#=|4bK_0z`$|^~bQ)r;1Tu`GruJsVC7q~TW293;xn-@8qu|>h(Zmm+TypJ2xpgKZNg~g+n&%mfQWj?ESo6sM$Y%`{bXi_s*~;BD|w?^$yTtPJCV&lY6@vm%SO+3j_O7kNT>As$u((&d*{;rzOV2 zbQX;|QC+oO@K$TDD&w$TnARr*@&xB-a$-vZHW>K{P8No7%gqK&Ht5O;by)GWrAL6s zjn$f^QHG7zZQ0wv)rxoCdL_G#ULL>Z-Sq6`Rf_9o#_(~wp5FvZ#UZ) z+-&QWs(ORfxCeL zQVBy^6Yo-E@Qr?yA4MBHj7M+@HeVb>M;Hz0Yr}i(DQKsiZ`#gX1hP2;_||N69su7C z1K`_EyN52|uua+v+470yy^{Gy8vP|<;C7-1^yF6bh^mTU>3{Mcja>ROreWSdu7@$d zK|jwz5kpFF*AZoso`IuIN#w zZNf@`X;TQXO8x#0`>Ybk&(H}(h@X?zhGW65A?pPk_RXkJWrfHJVS5}=11jp$J*M7s z)kvH01N_8owQO#Vs4p`|6iHRO8Rw4{iK?YlC;*%(p3X{Hy!z3Z`FR=PY(xR0Po=Kdi7wS3qd7WIZvOWF~zE3+TUQ*n~{dtSIITcHKNr8>zZPea_k`^uu+xy*;pCk zXD6*;#0fk^ny}nR#+sY$uI#KCu>B}~#4XNM`0=p$S$u?=@6GiGqp};yJ?gel` zkRQZr{=mKVY%7Y}t+wi|wqBUG2J@*J7tH5tWMsx1^@2I3Mv%JbVYlfi*aNm5$ze-k zdu4kIZlR|@jusk3vC2xnhR(@AHg%^uqwr-^&KUMMnS~jOVcVw&JUz=3TsN}wOWjrj z_@zB4w4P1(bOYf-b6x1eIWF{J$GOlyZf|uvJG=32U+Ke6Z+GYLV9+_-+S-ei?rz1Z zKhXQ}zHM54-A?pw^wj9bW8~>LBB+FMxi*f}Ku3@8`b4FxE;0MQ(OhlhdSOazF`<@c z=<1A0MAl<)$Toz?beS25hG{EZk?$xS7o<@MMU#l6r1W3DMZO+BqS9WQRP@h%hDd)i z)8T27ub3DLn zb^b5@YEW8OiZ`L)S#xepZ5`8&JGVP)MoA3amZ^Q9ey92H;=@Q~6*c6h)=MrPVlcyo zgu^z8oQ@0%Dk#-c3fSEei~279m#ykU#Xq?dJ@*ET#l`YAViDLC##K$QFF8gi%&Ok@ zkGOTkZ(Z@fKUaKr&0KM86G4WgDXr-n%mGDN&s0&OQ$8exQQ4kFp8~y{3*;2akQ07vU)V&3e^ zq1`oe*q_eC{7##8+;A(yZpLIHl7ZzlgAfQXA$)^&?`(NuGN+#y3j_Wf-h_-mbEq<} zZLc*bBpkpNq4u&CS7WCYgZ)xtXO_8TTcit6e|C!0w}eLOHukWjQ?p*Nhx_AA?)(d!VX0(Zg~=1w8`zV$MB%KY9N<9P337C zMPsv+kO8N-jOt3=E2#MdSmU5=Do1I`d=d?p3J3m7c=+-X{`E!%E(yK9YkXvzWD_od zN&??Jk*^b!zoEQ{j<2keas=Pu#9W!IZF{3X1|m2#*8HppNVl`?LLgpHY8g?EH}3YU zid;Ox#KS;MQsgm7Peila`{d)Zdc;2@>3M3sE14Ad@L6pB*zI)o%z*5-F5d@k*r(tx z!luuLQ9&zFJc|#zUp2*A5l*`K&R16wa<6{4fApH!+Mi`uDTu}AuM2eF>BonsT2;}} zsn%6I&(k^q+hgZW=U((MO<;=JNB9T%_-0Jd-ZCZ#dw0R^>E|&Y zvK*!O&6tn<>zxmfKdFgXp`gD(Vt<`Xf~- z);Kq0imur!xSt^xRhk!eZpbZvhE8b?cOrKjtd;NUG&8>?3yXsP^Ycm?Ly%c1|bACp2pPsR*u*HMguNZsF}3d4s3VQ-=JMbt-$aYZW6=wb>+3*i=S{{sIuN>Z%&22rA7 zI3^Lo@Jy*nUgcmPC&Na7*em`xbJZ;dYRZ9cs_j5Lplxd?b?589tA2tRE#Y-yVhZ76 zndx07aroiIZ`H+zv6q5_8PCAO%5D7+UlL^mz)G+W4imOwrPRch?BI6I8r`u4nngE( z^GOTg$aPvcsO0S8LrM^%mKge2as#)jxbZbMRl_nPtVe>kO0gj66WxH3;6$Bb=<3QG z^rU&_gwZ_(`(r=e+1c+YwY#gkdY}&ay&bjJ-`O8*b@zIDYj?lf-|uhrmVzYQy3?Jn zYvI!XwzaZQd@!iShHF5{zHWZ*P8|Kv@-f_AODDnICWXr|Cxlci5?iL4aPbz=Qo=T| zIj~feB5r?5LtVUAHlsT$ndK$sGCg)FV@Wlm(xD;-__U&?2)9tPh5vr{?Jd;o7HYQa z5q=(o03_|2LCuVDJOi2Ank58@$V6uhF&iu4&&yDLrJlFZ=ccB%nmLK<1_ZbI)Fm;*K@ z0%|*mQ_==96hRj2m~kbN#sGke;Bn>obO>Y_AQlqm1?YG;VK!b zG^waGtEf0^V?zWOH<*9}2hS?FT$8(IP;abW&6bm4{Gf(dC~|ei&9@sgm{KJLs-Ys2 zN?HO3B$+%<4s%Ix%1r9a&TN-OA0%yy@V%B`$!V30F*1y=pTld#%GQitDd=|{ea~zc zh~R1SzqY)FjI<9Iy89yC7{6w)0g}j=ri!>?Zyp~V6B>QU+g$*+W)<;I-y9#mrtOnD zcq__cJ)xL&oRmXGxyom_<0{pYM@Xbo708=&|25L4(%$2aM{}C7UGHLJ5nZS!tgS&b z5D4L=yoBvN*X?wu6?f*sxYSLKs`>M@J`1|#xf@1sY=ziIo+<*tXdjqvjTM=6ClM>| z`Dhw(lR!Mps1rSU9$cs~-yPQgL=TM3-YarF9`H_Bt$G5NU={|sl%t`ZIM}lIMW}rF z>Epbx?!(tn@8ZMQyfOz`TbQL`nIlC9W3ui}v5f@QgvTI7Hy-6jo6OmS9W#;Z9G*O{ z=iaq0^Y8zUCac(p^3s#7VB6MMkRUBVOO#2nx$U-;xICtm?;-}yQfNsxbvPI(Z>1sx z9xy^$C}%g|^Ek?m?K4=tn6l3KeM6T$4b10-Z9c+e+i6|aC6Ux|!KqL5bj|s+!)wn3 zQ0o7ve;U4R1l|Um8!Q39)3p||eN1QF7T1(yH;gVmEKS@m@+z3Fs*({LWi-RFFI}%r zWg}pz12x)Qi)nf zo+bql+@PVknq_p{XUz0(q;JL8+Zey;>Hu9m>}9pBxAXzGIh`*T`?<~OEHBQtwPrb; zrR}Rf}suq6fvb5;$EmI zyYy(IqO*LGV2e@Dip0ivJW}ftPUW27wq7jVMIKe-MO=r+u*ljZo=o=2g511LrsPwk z)6_2!@7Jg+`U8VKj^D@P$A-l3Kh^g{`R#e~n3$2oKQTAnB7O6rtZX$ecPF-Avyg!` z4VT{Rq|?@#CY{38XxK{?qaxG`4K`cF7noDyA1HCe=}^et83&SD&! z38qCRiV?7hhBoNvIprheGeb$OHpXu$Y0Cidg1fB!{_Y$OP9R)N7}dX>J7YG2WGEDT z$LY4s@KVmidgZagGvWBsr&F$1)c_*}yLEnev8w)qq^tJlrmGHubk%mF5TI?2DNNOp z5?9+(;KZlynF|K_t^sV{NL4knq8Q}4crQ)Zn@JoY!w3ET@f~>HF)`nu+!O1D>?Z+l zJMM`9n_8;#nj@f-VCQ-;{W^${RwyDH79ia13{=3aU%K$$Z~f9+zjS@|_V$|jrJ>#y zf*=o%VoA9#sVm4Rx@TIiTelE}-iXUtN)nE&(@}WRCs@X4{P0YvxBa zi=rCU0h!a|Q}8|sD>%LVX`Z(=+e$YZMz_6Y?#I+tB27_pV#PJFh&HJ7O!b*TbE;7Q zSDiG)o#C2JFx-WBfQqmL_!g#n5GIu=3-0Yf4w;d=Ly0dz?GYqEaf>ztCd5pk9kaz5 zZ6MyNM=hIfH}SGJ@y=RrVy^t9J&e9|MQN>&dXmMY5u8Ns=XEt;5{shw` z2K6;nuZ%^_zfBmePxm$yu*rmQYv~E61T>b`BqKqRGOi@nUS6V6YQy>g-+oBY)okQf z#+crJY>~tL*RrDu*VGWLPlpw&F5IVM$zEY_^<2y*{ zyp#ucmGWbR0$$z)^EOa*8>qSsRNY8xV%=IH+Dbo0PY6oFR-4R{WEbzj{%mxf{+csV z7@X$^q3568&(tR8~b^(jUoPGK#p;_O}%Ct?~mH2^Lo&AyB?*P$H2ZEKC{154)(6K zjQ%i#V0S5ult1WRbfo)rfy|0c+T*Qz(X;HVu8@Q^iJ6vh`P|3XIcG~DuK(1WJ*Y84 zRhH3<{3PkG?~Kj0M6)Vsqti0tW$%+a7ODPeqR(|4G1b60daK4Ix@-NkCRWMnl)8B$ z4<-B-0w@F*q@RC zt6}rK&Uv|JDt)gc<_Z%qL-Tf zpT^p2;#Wvu+NJ+&wcOk#_c!=l^k3IQ|NYoG*x8Qvq+dnH7=Jj+K@(Z$ZsVJy>T%N?A>}_t z4O!XR>|};)oFf_?7Sh4NoMS&#rF!Mo;G**Hzkb#V5M{33Hlt<*T=Kx}jcLf1VX)wo zFO`4E1BgG+B&ONO5R$N1ZQhAqrA&C@AU29iC}Q=sS7<@AMr3s%A6@2PpJ05opXjQ8 z+WyZ5N^GW${Mp~&+a`183?fgP_)14Cy0)?C+G5ek!==9M55%wMUArJN5-e#i|7D^3 zFN+$9;0eVEYFp&=bu2cep#wA%`zQfhx=biuyoQsis!H`wM=;X0m{(@{o;9fqNV}!} zUWP7NGVWpF`6L?8F#~}{x}wTjVjq~Yb;VjHhuBHD788Lo(V;q5+y>ba%%cio9})#E z+y{;2nI^VTJRx{uEe>uUQ*;_x6Ti(D8q)F(FV6Q`%uNNeBJy`FCWbbiF;^^)*&xq` zWirmWO2ah=yD6ZXn=bX1TWSYUjQTOo1s32al3eZ!O)j1`tT z45^rCh(_+khr;7^F)TH7$w`{`RO;Q0Irj2?jTS5wShSug{&bB&1Xl=XAY}9STx5yCJ z@b1EZgs4_s9o&Cl_js#5(e)#<7Y?jy7Q6aG5>KeP6t9 zg?HwhGj42KrR+O~t~VaRax;ViBZD-e=*FfpiVFN}RZw4hnQ7*=v^EI0E1Xz+gNzoc zfiCNb!)wZsw1o4StB|_1N#1RQ?>54B8{xa5_Q}%uL>8V@)(9lDmS*Mu&jqfgkkw+I z&%Z5c;8{{>LVIPJ8<&EX;GzwX_EaS+Du!56A{fYj`)}XmWz~kCP>x4PB#;R00LAgf zc~PnsU&$}(UmL_nZjQ-xvpt5Tv#cyUpU=J6we)QOi+*UVwdpRqNCN4gPu#&odTxY` zeW$;=@$l%)lg%pt?poCInYa78ND8o{kKl-|nXK>*@kr)xn*RoUrd$4-6&~_+3k!%N zhKi$Q@HLph>BBC7oe`ZOQ-Rbg+NSD$hh!$4btoC)Nd%YVaxJv}xR#r~$(GDdv+#Uk z8z-?)nAIbhia_;rB|R5>ZDNDjn_WfAnZxtf? zZ$>!&ri;WSa~yp>BDd#cqmBJx?7bEEbm!V0L}dQW&)~aJJ@Gmu>~s$Iz`+}1jX&(U z(LDaF=;AN=&~g>o@MLJcJ1JaJ8OumbD7q-E4pVI_!PAkRd`%?pN^T}Skukw(+U0ri zPLGNKISBGeZ83+R?05Gi*X$3*lNheZ143Bx4T$X=3M0D%w*BzquO;2XB)-g3TpnN+B<)mXCyDo@Q<^92b7f&y z;(|4S<1h{-0npn3{NjJV`}Q^fe;a^bUyEevJV}c~Y_T_yFTSo=w-cS^X#&pMtXA9@ zGhpG!cWK+ZSV*XdL`mvrrZVAjzQxBNGAB_t8e`E7MH{5??@0a9RwvE)0t)Z2AJarU zN8&%SqvzgCDy?WFV0Bq=Fm`>yt_o{wo8Rof_tJ@x7M{QzVI^4(@rlD2UL&bJTEOGwg_HTV0ULUxeGmI5yWaM%6mU+Q1NBa zUyDFsmS@Wg0k)!^Ds>yS?ce{qeop0zc+w*DxjD73gjx{{xv%+nf}S|#ZdPK+5!lXs zIre&LZd-lod~75XCdndJUGvsVeVwtJPY-ZL-)$~x$%<&*a#7^wOlc$d-&!2xAKOML z9*@s-`_&oIqTPcnU1rH(uoh?B*TA24*B;bSi9~@cRV2UjP`3$$0#&95#@{={-`>raWhwxtlO_x`1 z9)KqhItnU|9;A7H2wuXbi79d<&yOgsUtIg9i0t(PLOf$}CNb^LmVJP0Z}js39lsXyPK3TN@tZ1Z7^F)YM#Mq^p9gOvcP*_= zx}J?tZn_}eTeJBLyHs8!+@R8Gxz+QFNRI(-^R@zKrmXU!Tnp*pQxlNq_5ZW?F3W9W zS-SA6AkN@~cn;~*U3TS2zNX90w2$TNtn5h!NPr>|AixGdIjQ&uHR}iHh>q@vKH-R- zcv?Nlkw-_)7pW)t*KOYbkPwI83Efwm2S6=*_|) ztkh=wyugqu@%0F{P+-81hrSZ^9$$S_LrKDrHQ#qV!%Af0P*ZT$C)dXul+O^l2GM|8 z;>wLV;FrqGanop-0at;pgOV^j`qe~g$GKPNTpb3E+B#ITy8m6$HM zVPUZf&D#upO2fL?S}~d>*EeXh>U)0K;5_DFqKpmB@wJSTYJ2a-5=>wWD~1#1!9*%5l<) zqoRx^ky)@#I}%~LVgmDa>xK=Dzf$;}7mRqqtYvq9X%!TRs)E}Q@lj)=# zL7Lr!A+>49_oKKBh2^SNob5wC-bZKy_&~}zyg@ciNpA(YWxC!3Ne1$e89GElO%Dc* zG3(YGwgtuO`OT>GH}JT{KjtHRm1t8l!gt?c-8kx*__+tc@gMKQsE7Z~Nz-jj*xn-> z+xtD=)jQR9ZTS3)p5e0ryk|6GX5|d3`lGSomPj8VSRkPw5mCQCO*}{?86!V+GJJVa z>hd$kNP0vl-kEO$X7IA~0654dr@a|?raVT3-Nls8g%?|8Ii(M&W=ZPS0&KDKNgEn7 z2f;gkVIO9}4B5Aq#6)X)OJ_9;0ylTP7{cUA=1k0(I9y;NVg8v#T#3mYmsN*ZKDHuk zj=0q~qM1W>=svN&CL;dj+e3HK>2h{%k&b}JG1|;&WP>)eSX`LepN5#VX#^~w=>pG3 z`9`=C-Ql_#-^y1$_enXDdf4LPVAZ-duadwZ(Ys2+NYWZYpr{E9^D3Muw)Odl<*QLy zLN&7~EET_wz%m}@ocXhJ+6C-*qawuS)fr7>3Qv=vPA@D`YyHEnHw0IPUS2bk#-&R~ zswYGBJSZ8_^y-6`X7FNTLUE4IishIATm|lhLYnZ`&$)*`_bx=(ll!^4V8aNybPSx& zzU8#u0`9+L_^}1tudfzy)H=Yu>P~bUPHXI^>G%hW)GH+%zpyh}QAT;y zrqWU?R>VfQwPIZwysu?ZHmxL?XyFe-Lih%h0?%Xs#X;>Ow?rbjxid(TTH@gCL}+Zf zqix+-$l}Py=v7Fyp%r`d^{cbDYulUcaLliN{OUj9>Dx!&wZg-;rm6Ax$;&5ipR{64 zsM^I`b=-Ibk5KCRAfFl*z=&Q`Ou`}>;vh0f8?ts;JLD8pnzPgm)}RL-kv@A z+MUd+*KeP{`r)hs%owQ1u z9#gk%!tJSaQrtmF-C$9Wc*PXp^%>5@buSyWd-eMaVRY1v>bXrTm&<@L{b_|H34do0 zQi{$@kOCUAk2mj{32o7>qlqaTn1WYY`gf%=k=buCRfc7tbV(4eHEvN?^EK%OUX*=H!ujHrJtD2oSbM zv)VfZTR$y9$_V1ZUPPhB_uH zN*@DxoL{8leT=%hGJepNcTxP|xn~J7FByowjz^~bTrr+LhfjLWOuuJuo_DIOpM>I{ z^6Unk9#RT7QC^pVg-?GI#;3iAT#~|rr#EdJ_$qi0j7KbAT3&W8^CmcEH@fd+UtEAQo z*1k8I7Sn=Ea!sMhiT9Z27#buAFns+^Kfo6WQ!0D3VLk&N($Wb|Xq!+q{EzohiBuK* z`7A3m^={nN;|xyJw0ZQSB3!^x(>AQxhBYgAo+KPDGX%8_YStIjoUA*jS@OGfYTzak z8D0Hna`m5v{Dn%9O%VSut$WTePO~KYl?s;?fX|#T!04_=3a5_`g#{Y>YN1E*h$fQz z;q3JFbB`X7dqZ9CDY&Ik*E<_!gZQ0)0rAA?po}iUzrfF;0g2ra|gih8yE^v$8(6zTi7=%M6pQ(}X2Wl8!w3zMM8=@o zeJj(o>*vkZ#M9PP%Z|C}$sCQd&@v^%t=6@EIu0RCjAP;IrSW@aZo+Cj?1)^|=k3R! zyZ6!6!`>;Q8HBi#(x>_VKF^yQ!cVWjELMaBc-<&tQ4Rx|^?9*-H5*&y6Sd?CX zRfd`4_}pGpm+Hy)$|UIAQ1M9Rb7`31NLP~i0lRe~yQ9!zabL;VU2k8W*^`ni3YYqe z==JEbOhJ*V`A1Ebtpt2gQ`Ar>p&nu2))p* zIItU5G5y@~g9`jbty$LxEA}2_@zqCUwje-jO_DzFFLD$6TP@>Ch%}uM;RnS&ntn)k zGdo{}^Iu%ZJ6u%AJFwV>h=v-x0PNzPYDTWKQ1`~%;I7JWkNuGkVew_+8-b}P{nNF# zPp4!43nX@lE;7lYz%QQ%>W6!~dwc4E^tzj0wG ze|ib|6J+jva7l%DqVWxury(vnsN${c-z{u@9v)fE&%>TSiFy}d?_JpM;gd&2bko>r zZ;3$W9}Yb%NJHxOQ`m=1MK@{;W18bUt6?j3njZ6~_YQ9QxXXlkFN8DhlcA{({7BqbvEH;YrkV_gt2NS%@S54LPse1 z`3nF@K)1h(xsHEA8pU@(cle@8@7VRSk{BI{x1q#54EsJX9HU*N-(saOMIM}lBq!t^iWO5#qE8@{F{%e) zY3L6|!eGjHDX3Y2-%?SeL?2EqEBJl$+BSKa#hIDoW$x|u$b@V+V?!*~f~$bLde5kQ zW%(Q%S8-SS+TILYPeUY>EQ5`qz?;d&sO?EIH|E~7-#vCsj?Np-c%0dFzPQE9x;~y3QqWlH>Ptyvx8gH? z^S^&vQXynrL^Nxp+*@iv+Oi%D`__{$y3NQjZwn`SH<`HuPm6Zph8G6<)(B4~(%oe4tuy$0=mI$)AuSD0 zh@^BQNJYa^l>G>hRC!1^yM{x5=w8a5032TjC0WrdNy|?tjK=iFJSt*rleT_Pf0Hp*xUJiX zv1%?%vB(IHDMMb1&FgR$4Wce>;YptTHsifC%qiXr6x_)lpsI=Nxkv{3BVx~iK(8EE zluCH!7V9exV+HLH8PSa`a7-7C-0?yVXSZTQQS{pc8yNU=vAS3PO88rKBg688o9HjS zH=&>Op1F{zQCw^RSQ~dtneu0p z?6Gm?b&^Op6ekW{HlG4ub=vfVozDyWQIvEnY$NQes}Dr!!dHx(O0q?fW&IQZw)O)k zD9U^!Sj&uflkrq&#O=aUUHx;W70s3Pu|b1fU44LG78J~2ltm6TH4;ed&_4~b1Sx$Pij6LehfG_EpCdZnp_51ALq@MJ%+}C@o@7u5hYp>UHd`(ZJ zRw5O8cPFN3B#sAr1tT95W2IC?kyjJblCE%|#PD}N#$P6ieMqs2z$1*quDMN^{)(eO z$oos|^0;rXCpNuQ1j3pL4nvQDz9e!(a1cerZW2kk{6;!pFYijn%}h2CKMprWtmS4; z5t4M+$DBKEwPL}y6=5yrNR|fIg&g?HWaw3=_|Ahif=*twOKFU9r;NSL+ zRBK~YdKF_q(UDMBC1Le!Nx253d2Oj1gAJ4<)YDD^%Swmpl_lG5ZeERm3=!D__FG98O zc-AM_^};i~oR+NqXn-OnNV`Utbz4dJeCN@wih3ok;aCZ_BS{C(w?8g{(VHiER%S5` z(jwuEWpv}vR0l%YEwa~BO|TamtE3V<^3Xu=c9Sx9gHyPkcT*@vT3A!w?CQdPOKZw% z}7BdDix_DojoaOr4}L&G^>9h9aWW9ELDAEI2a zJGMr>QloBX-M7Lj(qMqtbQBOExb;VGydCF*EWS;r>%Dxs+&e_y?#jeOTWat--$?DMJ?jR_j_MOSJ;aX07g;j><2?emXIaij zG4jYtg!IQZ3Vv<*d+f#-ksREMWKtdD=3N5gxOQTkPRmi2N0&Tr#v6;~7(1$qX{C5N z2asxc4c~7lg>X*|C~6A)oC|*l45&=8J0)=k!j6I5rBv0-TtQ?0cMUHQ2`W>GpPoWj z{~aw9^;^dB(Hy50fp+wlp}909X-(lhnBEbS+{iC|8MD^>&ImO?lX9w>^i{XBcY53E z{qe%;{fSe(Kj=}t`=63EmFW-E%*S1o=w6046IuqwA{A*d0V$e{bJ z;!O?bPv_$NDVJ^8d0TegmYp{;ggR(h+4*}vfh9#x34sy#If~nW23sweJcc`0L` zup2J&P$9g$K7zpFugrWGhsh@k!{qx;n0$z{s6_@5V!5V3`4Hz$&*%i%}Q=gU20~j06W0r79+CSkjvnwWj&G=^9{0cF)`2-P`kK z43-6BeE#I^Q^&rs^LBiAbfnPdMG1}=zMlj#!cvq>&~)+ds$L`reL;7i$#w!u zFS@_$rBnE-eGUFV5;#G$n9m8>e1g~Z@vWMKtMm&(4C~w84e&)L1{TEf+nd+!{B(BK*~CD8vxg23TNcP`gMfH~28;ec3p)Sw zUsoSW|k(t>Fj0BTCNCTa?A-!&;4nm!+n#>Od@pdFB#nF1})wu%ziLIb1P&s&wV=W%>Dn zM%cEY96*Ipl^NTk< zPnTlTJ@OvoJ-knUIZIy1Y7;-b~kligh7BD&q**Jw#N4 z(YD}^Fn71|`SR*xj9fc~49!;ZdxJGX-W$ZfDfp1!&>SF8f2v*<2|s70bBLYp*MiUmfK_6+vpAZLQh{PBL81k-IR zX8E6g^KRRU*|uWV{e+)a06JkO$@ax3jZQHj{I{tK#aR1+;#Okd^F)46cJPT#9=XsN>h+RoV%kHCU;^@FyR<8 zg97J*YYsv_U$m;~f166y;X+)`;e98l*_WV386}Ea$eik$0-AjZXnt1P0PObD-}shy z8}RClND5G4@i%u+HrJ=ZhYF+*s~u?hhTjQ6~L*0p73w#f*Tqt=mh{AkF1BrKd^QOal>E7n90 zAtBKPMV9xx%V@%{E-)hG!RF94B~l=F;%7xsr=x56IkiSvUjZ&Fe-j=896D2|6ERVq z36UdRUBfAml;OCDbcKWidpP;0<7C=ENu$D58{MM$bRJH>^`gWLmsZyb`TJl0ZHZTp z{qtzx^=IWW%>94=>%Xt*;k7P(mk3y{KBkywKsXm6)@_C&USpvPAS=*cnk`EuZDQ6uP#jCDBdVKD9dy1WTYI{nY7a|k3idz`>X^5W91+Bay*rS@s zp#e-)GnG5-Gxgu4JVit%HrDUP=v3AQq1^q5<|MY>bS>VrUGS(g!Rgs!15T!*y(jFM zOLUKe-@0BFlpRm%2Q=zSc$2PMq|gNiyU;)fy6@B@c(1A1vQ$xtZJ~R2Z<{T{NTK+U zMJg|{eq=6E#EP?0h7af3lfjZMCSthyeTKCtJ?&%NnITm~!i-l9By`oZvHh!$Oe|=X z4rV;$UTcKGi?F}IO$f#Ly@@mn?Y880GOTb`q=L^P9QQLk-yIyjw^Pi<*kSLmGMArf zF!fv~%_hgqve4#2nljyogex*GW@eH&umpQnj(edf7hMWb+YJvcUSEwgSIT2_eYm5V zJk~miu?=UhJt--zOY@F}*Zs zYBdC_9I_&f68o8jI5a#04+%-Ro%(bC3VpOzT2u`MQH4rW?x`aOR5%_RlXr9ef?5PB zj8OhxO}j6HfZ6r{wmpDt4`3tD`?itcJaZfy>AJILGwzl0C&LfMs%9e`cPT>YR(fD9 z1)Th>`OfYz^&QXLHL7G7Sc>qisRWCHVTBS;I77f)Px1^-i!mzPPE~MRbM2dh4cP3; zSlcLT+^AIw!b)-}a*7eNEYTsPHfj<F5__`Wtf%Sq6@@W z=+&B%F5~349>vkiKLuZZ9G1SivQ>2+K$MP2AhZ8jmGO(vV#PE|Wk3wqFkyD7`-gLH zxNW_iiC>PqGWX#TAXM)l)HsLWoy9^geN}IvWg;GEZ|CLH=O|3@90^99?T+OmA{s6H zQ5g;*hF0yIoxOQlW6zqSrLf)aE8g!dtAsn&f<+NaYgTU%*Q_njn(QBJU4IjV19&F5 zav`sezMfZDk;eB}X~?G3%x{~@K3J5> z9_>1*?4g3`Ge_u}GTB27%jesCiA*+P1>%tUfG$cC>|8Qd6hqESM3#~LXhK3gTH#;% zNlDPN>vBqP-$=Ip?R75P5RX??(^S`$heaycGnN{u{Yh__SpU)i8o2EULH}`-+S34A z2H0)VyG?q(zNEKp)Jkr;@L6#`x7z=F_UeZ&{r5G8x<9^o=}q7o5RT_q;0wY|4GARq zfKk{o$Rk#JL8qz|j2=hDBr77C_O3GT1QxE!!^^Ws(Z*oyHoF7gHnt~>i8ai~GF2z? zWi4&i6k;VIO+}(Q*OlauR#93gamUKT!Lq$uQ z_Z5+5?jMU>9o6(ZTZ3M^LANW(b4!ynuYqY36$=&BO<1cjCK1*wt7AzLnKJOtimDs6 zvOGU6ql+lN`dH9`FjFH^{9F9de;+=bBNccy=WKKMbk;Id|F!bz9H^?!2(P5T*XZSG zOMg$;`-ihKEY|n*|99h79O(OfyEyIRkmsCbBM)>`bU~R=zJzaq22u?X2MC$F3 zYSE{2zq^M`=fXpP@agrEvy@4}+n*Vf?s=yq6VkVFk|NtzhNB=V!SN8F5fK4kwU7%( z1$;DL&ojnV@9JHm8yRZB&(!y_0Ji~7uzl+o1r4f^l!_(jH|CxdBX!39C5fbsCPiq8}o%bRHL^qX8TQHPalqQ(K|2@%Hc+IJ_8(D%P_8rK9|r z3BE{NO%Y_sp@tpJSO~oohfcRbF9&NCmy9jL6V3=%GHHCxTxt7Sxbx|Z)NXjn(!he% z!L90*eLhxI0H6*J;mlJ?mDYGCuexG4GxHf~E4<#%_EWdcZwU_|d_C8Q5H$tu3%UM| zY_7lKdwcb;{Z9D);LZ)FOA9FfaIdLNh~Y|Y`&gn$<+N0Cu!^h3UAww8k_9o)#DDdB zR0sft2&%Fpts9pTzpDq2ZIyU7@z_UePxmh%CwSv zIaWE1rl6=1LhPP}U5nPjd4$TLU_A(?(A?!qMb38=7XAc|n*`IGacCVav<9i7eBqCP z*^eOV;%wI1_T44}hjD|p3ncMcmDFr*mIbZgu8d8CeM3fY4#tKBkpa!daKEJ?bz#8Is@r!MP=s6WuMYk+B0Vq%jHYmY+VJK zo$tdjN(+SniYMh^S#(sDP46)gsh*hCmI(Ih_dWv#yWZ>PKOm?u%<;S`sH990SuQ=a zR(uQWB)m8b43#eymt)4%B8>$yUtInE={*IK1-9O(LfDG$s>W9*T|Vzwm`c;D70cXL z6TQ(Ttt*@WvsNsiDj#dHizt^A2?q~V$r<9k+SwDBI=i}v3M6?m-%aB##e^~myH?}D zZ5V3?cYW%bsZ<^DUdZrgTH~lTtp)3C@RzwmMbF$?AaZbFG@$qsNz*>SO8*BqwITOI z;4kd30I3dVSQ1XTTqm8;XRv1aP$spg{B*K^5H7* zjj#ISu2^~S|9$XCx1yf!u0`c8{`6l3@|JS7o+jz$av#0hR=Bqn?rnv8GYbf9Wx5uS# zZo>q~bi)7fK0;bKVn)6wFl^w^u5AT?%`WP;jb;9YqhmysSIYzyNee+f(dgrcHpfc_i$cZl>*`u0|4e)FaV>lcjPYH6Pz%@eLI1fYcVgiLX9lZ6WqXem?9n zfjS$#NNA{d?2q?;UYbVdB~BY8Qw12?oJP#1n_s)Qqved{85bg{&?eGlYROsTff>f3 zMG0_=y3XRF(K2Ofs&-8LqIj3(!BTfwSAE*y25bb-{Ai%m-I@RbA@OCYxzl7q86F!# z0Z?^VX?MXBMgz@bXxO}yP$rC&`v~V&MYkLJ^EdQKt2XqKkaL7;F_^m*TgZ$QK!o45 zm>g6DHlr59cwp#CnA+CQaSNyy@$k} zI|}oWpPomm9m=gaJ1-5w6o(fzt}HC*XClD}k(r9ulBi(+(h6FDp8Fo zAKn`Ex{SJAJ*&6=XpG7$qQc_Ecoe&Bss?DxO~ByDdOH?5(HVGFbKpD3Sb|<-?5Jvo zHkhb7WYPZfdE?EqW$ml^#pRf(@2@W~JM17P-N){z=(suLAe&bxz9nS(cp;13u{$(; z&^t#IWy9$3`Z3f8jNoh-9{vKLYI|__I&@uXV-E2E4-LgPE$1BIAZFachG0zq6olNc z#5-8kyJX=EGq&a106~{rAn1juY1-6p1y6i#ivPeylQUw6@m;ID53yNBZ z2ilEfSb{KJ9Qr}Y3w-V|KibaQdN*278yxv!Y4)LQCSKJa!esdc zg|9REwvrN~5}t4`g|4D9h!6k1_~U(8O2C6PEaF{=BO1+7EL2Uq+M54Y(gJ#nk|YLL zR>mC%b!RDMGIT->08N&pXjg5OQhW(p511uu0Zb8ctR8^4dT7hTh5`r1)y1)e?1J2zQ^6?1=LOchk?PW|;Eh z74xP3zYpGF69Dw)9C)k#fQM`NfDMX>U+x1Qtzjyl0WP@~&v>!wk&xpRGdsd+G%^CL zWi`afDS9@JD7F(4{D|8LiCaF;c0!^x^}Mzz>aLyxhzWWsKhyH%M()k#QeO*&bj z>7i8f_dL9T>SxPLceA_1ZBx))4(gLRgN9Z+y22DF@g|@mmjryqMYffq^OiWqjy&EW&h zku+TcfVqAET4G|~+BC*96bnt9@=}?_VTy2B{Jp6@nV*W1BxLa8u*~5;gt*0&oE!#m z2Rr1v;03DHzZox6pqGgjug={nW5|T(bXA1l)e>sQhb;)mU)gZMk z73zvV?q*Y=-m*Q`2z*+x0Vv>8z1y*F=+l-Ub_;*{^6~r@{ zaINszIit5+C@5ppF;>isDlc`1(LBII>PCE@aLu7Dr(jm-T>3y?C#@X z%K#ZaE5=VWt{6MrSp{XTEVatID_NY?7}tk+Bw1kTD@i<&IjLU5(j5>YDv?&1=?0@9 z*R`g_;>KgwP?#?Bfhy0yodYcbxewP$l%}+9c0xF`_r}0kWR<^ zmngYNbm>~m1Ah5DP(R$;-8)pzrr$MxzufE-oaVT&XS(dPgVp)zL~FdZ{rUe9dz`-a zSQ7cSVeBcEN`&3Vo|gXgcHX{v`?~cX=%JsM-eWUS)<(xMwY%D?%T<2Z znsgC!ZMC1S7x*KeLqAMysv@LRfQqw#>Fv-Z1l-n6sa^l+Z-^indq4Bc3bVv`KTOBS z5z5=(?dcC42sX0<>Af{4=Csc4jy40*lXWRh~IMS1hBGQEF$67HIYribVaZPaC zj)_NR;F9uqI&G(5ug&{|i)`d%`8)Hd*k2|F2OEmsHZl}>lC9|Uq4Wy`JSbgj8o0or zDz89-uhdbFy%Xfa(%!D?4Wr8lX~Ec7HIStMv$nu0fqX;?NWoH702xxo_4}pWQrVdl z;WWs4IXI^#dMEKf-w`JPuT{NVS@ zw0%{4xcLp(ZkS#oI)>AVG#dHQT=SXH$phA-{VGz=$smz}+2Ja^e*Ob)tZCPVIgy?_ z!i*5k_~Y3_*hMk^^@pdAkfP7D@nnAF5@!d^)Z_9#Qv=Ee{CvdI%0J+WiT~sSHgt}^+(%qJ0UdtCqc(lS z)l<+N-HK!Hi!!vGtcS1eZeWTrp_J9Q$ij^uB3VT?=egi2s zWVo^LP|uw5kax)myTTdGOOvI=$T@puR6Pza4dl=ChuYtF-0YTmLs-)a?htAN_WeN| zrh$c{m68;gL5wwp|Y?k1fqlGU|RO~M1}2m3v^t9dQu!hTZfiYT)9C~_Xv5B15ddVYd+j*=i$$nrk&ixE{X z()s<%XH@7VG#_$G$mc8~_4%b4inU_mTA3AazY>mM?B3xs;7zJoDtA}^k%whCh`gOgXRqJ<@T^18v+0mfopXD9tliez1s6Q6yK8D` z+|1(X<$RXx?~-FRN6HTM->IbN9p2W%nrk=Bc7X*S-Y~i*|LIsHnUgbe zt?c@<;%=oBiGjh@@8dkY-Y`Aq;nkyhn%iw}*FzQ6*zekXny3iPOAdD7Hpr^D5flcS zZu;#46Mkn?P0mGd%h>;pZslqw0f=m)q~l$EKy#7l1I|JHSs%fv$QVY-QxHb@qQ$d8 zDdc8DSC3jo`1H_j(%uA+t?Lj`9HoOOQ3fgCi7hbYCPn?04CSd^58rXSRw&{+0jt2( z_&I@_absGGoM+}J!=^e9c(#zsVR%ydDMyHSPNu9@X!CZt!%JGN zldgub8Ixlh%28*Yo%ypD++vf)M{kLnM`Zjr_U|0r{QX^YJe| zLc9`>F9MD_nh{DPUG2}Z4IZw4?Hp9=9YDu~b{2i#KfHSWnkmb)`6wTFP4&nc*T8{3 zhoyowIq!L|&))ukcRBn1jOvtzj=6TZKOhCi(mkuFS}yk%tKSHlI9V-hVva?w;?lf1 zb2F7l`qJyV+Z;n*#ibi}#VRg5H^Zs!p}Uf!Mf1l<_X4L=bJ-g=FITCMhrzQ1>O~em z(zzIS-sUPMVxg2~N5CnO>bKAS(oZu~qlT~bBFC%ageQF`S~?qhmN-qXt2ZfY zw}rX+e&FytJ^P0<1?5F;891qo>^eU+8V_+bvho|_sO7r+p+qQV|L=eOca}Nvi^4A) zvdBR6SCpm8W)(gXJCY0fD5QF)lXkty|3+ zG}`rwX%UH3G`8a>OCuo}`>u6_>7BSQ8hDYpN;3<58==`o06k636jjbTF(xdlLO0gzuC0P?tH0LZu3RNW{7 ztp!n-zP+CIlW5?by^G4hC=9%}@S@2m1E=;wSiZ~h*xSL3uTv{HNK5J_eF%#`Y&(-HzcgccP3MX+9TI2bU6|hc`o{7ZTBR-lqo@;c@C|CHlsEAfjNsPdh!GZ@CR-Pi}tcF8Y_s z!kKc#p#^9~G7dpse=0RCQuA%+IKVBtv-efb+}xerx4N_U{oTC>dnfn%M~C6j;b6EI z_ID3=`-A&?!~I|w?1ue*|8Re>rta*Ci-TX#oh|OJH|spowH!VkDaRAnG^{b685E0= zI<|;n8(xbBp|S>NLL3=Ld?DPIW@^A`2v7l=N&3#C!k=-SI<_^)?fvIaX@qIzbC{lP zT|7zkpSunB_bc=>R3U7I3mT04BthCjFU_jF5?{*wsE&I6t+XHbYceWSfj>w0fTzIx ziV28;nFf>QL(i3*9qS}G(oc19rK%Q`FkQFed$hJ=E51Wr6-Ux9-Q=l#GivC~QP#@C z5wcRDvM?oBGm$6edHBTFc)6~w6U;E(x(t)rd+(y}a*ZpLum`0@sXeB}qnW48c7IK= zi>MxBe+!F5s6fgpBK5c9+#pj^J7#K9OtgAU-erk!%%#@*Qs(@##Wp-%rg^nSi$;oC z{!&sLYG}ne@dT)l@{U`$_4{E$YUE?4!CzCxg%jblDpT`Dq9J- zZFBJpmQJ?K#r2iRPFmJnye3%eLtvO{5ghZ2db=R?;EH7gm+=)ty`jCwn(HidYP=Nj zRa2$S={RimoJqs6_C>Amk(>5Qy^S6~Mx1Wi?z|RAjDerVE zMMH6ySSbjVM+Da>9v4#q7D>Y^$dRE^m3Yq z-s$76_bM(Sd4G+)jOXy?GAd_W0C<*V=WtD`dC~|p=K4rYE$0Gnqo=SKXf|E%?K|W& z%Dd`~bdjGz*vzH5NO|=!W>ux=99}`Z$aDps4r88V9Pvv1nU_Xo z$ReHrdxt3L!p9840S@XXa>@)MMrv|eRg-H0C&MlvXG|nXT)2y-T>#{1S06%F4Gp3g ziJv_`aX7|HdLHbqtFbmER79TrvxOiOuvWIk8hUTf7Lbuf9W_$9&T6xjTeXjcvM}2OcbnjD6WonVE$+80!BtF+ z4WW|jQ%Pq54rv6L5@s(F^aobjV_(iUM)Rd%+H?t|VH{9X5IruQBo=^`J0bSjT{5EA zM78Dxn80*u0gQ^EQW9c}QQ3hwWEP3aohgDvcJro30o6XxYO^u}Q*OR>jMJuZ<)m8drwQ=Aa{vj9)_f)pRs8c+kgjhWVFqq6R|EYYvy z6zo7mq0nQDxqpq2BZ);v80c>H(w~2ND@ga#?_XM%0Hf3a4-x8JeT4iYh0x^Fd*N*w z!P&@E5PG**)Dn0*FvLp}3v*?F9)t89bv?|>!vIBKHio`w(=EAOAlZuLF%ht?B=ylN zqS6d`%~T8Anpp`&FGpvHsOX9-trJa)h2pGiocoXy&r-}Xy`4NnA)ZbZlxRowVCw@u zjJ77aZWC=61XhPWK2GA2RW($uBj{~{yXL`V-$bNTtaDn{34nqWW5{+1zc z5nRB;R!%Sixg))X-iV=vP2>|G3JdlLa`g&x1vb#l;F5X}<;}}*Ch<|d;^Dn|{`gS? z&=;P7050D1$KG2U%&^ZS=eu1c!s6eSc(p%R1`+f3zyA9YuU;Q?Y^hH;Uf(CYGXaFOpjYHuBC+{|;9|J3ot-X)O1%jk zpWqkgem>vXP)JujCaKhg4~0lQD{3@{ubru&!$5y06yf;X73Ds2*Ny`q5(!H14ajaF za5}4^Q{j`91q<6HA=Fl5+gT@l#8rnXOwQ_-s zlG1^=Vo~WM^*~E$7&k(qRxH2eQqy=n?{RcaIhyVwAv7$+ennAT6ALuerWIPTBv*yJ z2bSm*yf-e+z%QdLMZzraWi$*2vjN=XdvJ~C5TmE%hAh|dS`F&y>Hpb~byzVa*{h#U zVHMtnMTtFG+C<*rz1=_Q9}Tm-Vo4jaP%Flu@MRM4Nh4WmFVE}&)vU6P48w}Ls*P~2dt3qo>~k@O--mpc2<;)Hn0z3Gchtm)tb20x zdwKP77FK^Ly$Pwx^0&$@Kz^h!t**QO$9rOJ$4NKu>SIxQ0aj*b)sIpcu)?Jl(77Ta zVK&ix#aa9DXL;4@Z5=V7*s+A~0Ri+(1B7Mpu2=e_G2){c03aPpJ=TdI_wss-T5CQe z0rg`3b_C9Vd&hKOW7?R=twDX-6ajx1Q5jmQI=t;v87}p`>8JPk@*}sm;fJ?J{S?B~ zSR`_#&CZzzcoakm^NOS)@zsagewjzTeTki$VL}ilrXa}zo;0U{THKa|F1|$#xbeJS zYqjJvt4XUXZOgH#ptRQroUe99R9b3Pzuce#)F<``_*1p{2t=%w zmQhmr((+QC-ZyN5?x}K%jrAG1%bZvL6!yKRIT$TU53A!H+~!g@yqlrxX);acbM~~# z&|YAa#zdIJtrEkwv?%(N;c>KrxD7mv$6;!j*9@Ep?Z|+d-g%^m!>#N1n_yvPEk6BC zFUDK*A=+nYhQ1vM>&iI|xaNFtp*YS1Cm+1GSIr1}K^DVP_-RQ~1JkvPL&1HkDWdn- zz3*LxI&a~oc8m_O7N%O*IHi;Uzk~_wgjjKt)0{{Wc5xnPtXV{Sx&{QX7kQZC=$@ue zqbM(dfF6S+3ndzR@KujvZ2R&Ukd;DMS%5wu5n@VJ^pJ48l!f5FBsNTaj4;L}l<|9F zeK9)|1#@#7CL_&8kNzEGd?=Xcm@d8 zIk$7EyW^F4Y_jV_(TLI)Sxhgz9h|@nhtovyi{d|%uqZm}Q;#iHFk1(s2r1L<%F=o0 z1!Ii(FT(0t^UN>?%oO7yJm&+f6>op_#gT!{^Q(3~IP;APA1*F@7iKu>g%yF1Y+X=f zV-|Bez50L{ytA`c9rx3*#5cUtR0g~tTtrb=ij{B4#3(ud16JOVT+`&zi6tk>XT3GH zU&TwzAdU{g#sOK^i{pzNuUz1iCWF5CwGgjb52!QV%^{fBWGFOlf_BZFJQORSG3^kn zMGqQZeemG8D3NuO_5ns1I}-@`k}y%Ri*L#0F_hny$?cl`Ayde*OR!8=a3NBPvVkUS zlYlSvajMx!Qc-PF0j_Dviv!;cVn*3?!)@1?$wQf))8srlc?jdo${*0M!D_EQPyi|n zD0a6>dN+E8pG0#_zlEY^J&uo@0Aj^VmV&eVsWS_Hjjv|9T74Y+@qQ{r5ii9jOyFl( z9$;FgN2qXIU*Zy?*lavQzFv3!&ASD_+Xp8Ls}uK~>coDp#O_+HYu!6HRl+qDDE1*g zf?L-**>ek&YphY&v;<ojlvQNd>yv_Qy zS>HD6`+Bmz{g!2YKic&~I@~KR(4q6QV@_52#C8pN#lAm?vB!j0MqEveLAhvJk(b?-aKRoMHxb#^zBGGIE z%$>Qnf4@;JYjfBxH{JZ(NejTPx=to&#RXVP*qNW{2Vh4@2b;E}_K9UJe6fu&wZaYM zvvv7b=nQMGq_(CmH+)TAdU1|_e_@XQz{&9sRCZ5A%bqIUuPLoRPzn7%Qmf!p?siw1 zyxhFfr>LU8#g5MXVuEH{ghhcfm!s%c2w>qe6JwQBq~x_Vz~z{DGLXBas{Rf3R`?|b zzZRh)Iar9E8QDFHG(`KJtd!eSVd$FE)Sd$~uu;nktbJQD*p>{oC4&u(3l3UVGI(R- zm#W~KMn9!6Npm9vsyuFkX+|9|U3q05w^VB>;CSp6SN+xpw(_Bt|??aR3Yn`b+0=PSe>4! zD1=rCSg~qVL=M#%Rjz7vFb!$tN||?d_R1ljC0M0(l^KzxL3o=$giEAu*S*87<3@=P zoi7%lbU}>~O-?r4h(D}9Df}^~jWphsVSf#AovO9w^X_G+1#!gE-S|lm?fEf{QM!Ys zU`&VDW#L`03RrBpEBf{ZBj{e^iRi;7Ji6*QA&q?1RzS)SxQJcNuNy0)@fnyZ#9Ro0 zHkerK_2c?zbqV?+2&fue$6U4I1#$t!RhY0=xQ$YGBbCv_Dg+CxK{YANcVC$uWDS1LY`aI0k2J_1O_1ZWwn# zK;I8@gd(1Pk=bsOz-Qo{iMJj+{fuh&bZ4EvK4gPWw)BT%<{tQ1u&~VULqD*EoM`&f8i5w4t zTHl)vru8#LB?}(%CGf~OiV@-QLXi%h+4L}qjG@YF@U6Ab_-Sb!`5h#Xgn{9-gww^T z(`$8UIP9Vk&BOS9i6}mrYI2*S?y*Ij<<-dl%M$U2QSS7O5K-MHnW+oh>uAMTslm2T+~g7{`mZ|^u`1lrf4pbs zAOcTl+eBi`4x#EoD7>|?*D{{_RrZkDZK&<)^nYj1h}8R+!tpCK!Z;s_c9RHKx-R*+ zI;Mp{OJYsAKbGca>g|BN4s#;(7}6N)*jJ7=2Um*8J2+>=Oet|Kb#Y8UNC%LTWAy1f z%<}!yQ?Pu6oPiV$96Ti$#9^cwuvwZ{iIb(#b?w%GXToX9khUOda(z98t9I{{c7X!w z!YmeypN9kd*$~4P@ZzKg=!GcQr>aC~vFBJY$$k5wKvh!?OcC?PrS5_r$x3L|y z%GfjjORAd#6?Au*=n9zt`fiLtK8;){8KbMNN(^CDALpV-Sg;bofpJt|`E=7TP`9ho zQzd>uoqo?!{Ou2q{iBn^;r-yj$$rq^^H28r;ovaXJwDj;cZdGre&F|q{WaC?k5t|M zg~DdMFxU)8uwDot^ufM+P^-;^J*H3zrtSEiY53rera(QrpEcMbUggkgg zbt$2Cm8}aklETCQDpe1BhlW$JD2i+mA9l5p0`?f0^oNAY!$BA;t#iIQxJuTtkA=v> zDFA5NC{0mSDRlYc8w_4=$^_PCCsju+E6Tp8rbJzDhX+6~f>Ux_>hFR^i!@V zbreE>P7z7+eFRsqxhqlMYTCt2ESk9OYf8G>ZK3S|en5f0s>W7k1T!pt=HMcghcrr) zjDVViIk6ftRK>+6jdAu~Tx64#hjH^X3tc&a)N2rNjbVfR=YntdMkRs0g(ZOl2fBCM z(Mf#g<}8Z#KmGCKTko`hS6-*Qv$|AvhaUjl3!YdHMaa41<>9EWD8@<|s2p?m zXPdq*{qt@5x=ml(8z3FGEPbt=CvXrT)7*U3ZeI=F#!+<&0lZq)0Om4WbJtKBUxap< z8C84h83XnKITz3mVx}VKL1tkS`Q6P>&;qgA9Pq|wrwhj|OK5+tjFKBzn*zsI#@Dly z>Ms;;F_WBWUbw;ix6bnV3;m~_@;xYXlO{^f|y}m>@G6VY zoiCMBPLcCZQ|bh&o2f_ayB=hLVF{NO6sa}%dO=%eIxhUgn`B8;MmPltSBHy07(Q(p zl8rg;S8(h&$9G{+j^aLq_$wpP;=w^3?jm*@*UgXc=|GFl^qyt#E z(9k2(30y_7z%~3CF%-yDK4bhPk|UH04z!@Mssalt-xrg&F7-&H(&f;>k`4|wrwq8s zGhFvuC*87kWAzcCJJ&>aM&a1YV$_Afzs-CI5;~t{xY)(D@`A3?u*0q5 zrD2f@bS9ALD)dYq!lNSI_UaPB_LPfN$D0 z^={5ZSc&v+B8TZ4%B%`v(qyq0p-N;in0L+9+c}r{OB`a4DulG~uww|;pT8DJC+~ql zH1aQL3v@Q{c(@+6({4L&``}{DjO*6_Z9PKiy79?H$mfD}9yk|e!Dq@n5#~78*zMYm zRr7(ZqI8hdjb*TvBc zxAmUkZ7a2-xB9ksRW|zcH`-dfpPKd&5jmtK58Ass)iAnQ6fAtYbe*asHW?=kroc?;X0^67ltjN;a>FuP zbCs>5tL0N-AyZ9ls~+g&Y=(ubR(1*ex}3QJvfQW~X)2FWY?u7-x&pg?K)Y2?6{_$kAohMarTVI`aD?SlI4#B zj|&fD@3C=}*JBOWjp3{E`#IFIR6rj`u%yUIMQ0HH3JZl`h$&LA%DeZ+3g zu4t4o^OAsKG+rSH6C>*?Eac(M5Hj2P$F}~lt$%zy^^dkmO*zfU*?gF6Rf-zl9u?vq z?Xy>f0B}?b(pgk4;AemKFZ{CsDz0+ZTwN3S%UmqAqa0$hzG^NP6H5@2Mj53G7|B~^ z$D5s0woQ!c=Q*J%17DG#7gI4cBPRAlQrC3O*TMpXl7u%3X&=|#>h1*y2TYbJBWv(W zi)S11gkf(0rtCvX5D4Ksh1B$H!h#=~-ADRC9Xou601(sQnI#;f?umF;QF7z>qe&n> zB`~nafitN6!U>jePn~1n0-5)~w^dYX(KZJ8knx6j3fat%c*JoYOQ!frMRlk`pxLGX zVm2EnaL}?U5R%qYS!EWQN>3NIokbDOjFmz^11YPAMh$VeC=z-^I%6F~BE@COMe4#T zo%FdUPjCTFz4aFA*l0COvKMaptAEvs8+d=S5$k!gs9MldHth2XwdcFAuRaZ=y?Fne zq;9E@Fjc?8j}!aWM=wJj%YY*@2`9KPIqD=avyOTf;R#$_TYL{C)%_^9UW)WkKD;;V z@gKHsv@CLI*E?LXX#PkWypI>B-wSzq_V%6h`>@BLzzX_cG%cnDeFurAB-dLw?Dqi1Po~j}_<-p~2c@WQ33P*G( zFD+KShKOllVU$P&S?ag&yqFN9Bq>U*7=&?svNTHwWNdoS z)Eb^oy}!v(^8Ugo`KXzUW-ZhaUnv=l3G;4Et+ID;*JL!O({hyM(Irt%R+nXk{4=Xu zq_r^iI16!m>KWWv-^}}6m6pcYlKWQT`jnMd}ue6tuYfq@f>dz@lAur(=Px2_y>fZaid;6?%3a8+kr;ohjlfwtz zE3{#6|K2VRL#6@c)>!@~td>RBO5hK=Y*$otr0|SotWk71#{SK`$u=6(iS<+`)yxLI zG?{XN$V5R9siDw8;z#3-`qVyG;H)xMH1u((6w*`%dRZ7Ve4!v?WVx8?g`g+;K?%5t zz?D2q^z3TxD~a40#!z@$zlcg(_7$61G;_hB$yvkd^9xbF94<3EXC}Km4M~yk&u6cG zAm2(xUwAuz{^>1&F3(QCe+ij@@b=2h?nXMk=|kvIDzYLr5_rm2&mTWhnxteUSQA2$ zOPUfs^FB zck$O!>V!MXneam0nFyqvJKvSVwaLhBBdoN|sjZFHE_~M9f#V{lPU*8*Dk2c9KvD&+ z8gHmfVUAGQwz#=1Zf=X4UrTZGLF?FS<_9pObVyz(7S6!_G?6n?%Y}56r`sw0@dTaU zc?Vpa5_6`j_=;}O3!-16(oei-d?`}S-=99BwvsEHV+Oc4po+Q4NT3I;BdB>eH;!{d zd_PIDcS%%~)}c!x$QYj|=a7__I_hdnkrbE+PvQ&P0NpeNjkqs|{5(v&eil0qDI!QT za#A7l2z0FLmHIdCbDEKVqT9i^lzOVp*Ry!>mXpx@w29dp5sfs3Mpo+yc(hpQakz@N@I6Bh`wpR$ikb{CBmOmHQiG=bYOd;z}uqgBA zpWa%8$$$RoOg%7D(YC^={Tff#=F_^Z_=LY5t?v^q^VApZIK_T_7q?B)!P+s|b(3dAFz&xsYLc?}1as+Ltnxu1~M2XtggzD{OM`jqa>Q zH4lhtO7en#rHXc?98ZOKVwlsCxRp|u)JpLkO8Q83Adm<@nNIl6u{|VW*Iv26?#zDJ zzlP)Q>OeqEwt*NBWXdQ4ai9=jzq24LO!v|;PiF0JIw5x{-q$$-*`Z&y#wy=o2ttxJ- zircEDG+ zN_fcwkJxOhU5w8{y7R1%=?5BSRA;19%ap=_H4_543x;JX=W0dhn)ZjS2whte$%ns9 zTCp62Q($A+POYxr%eAXk{np@7hzCi5OS-j~Tzj0-mRd*9sTF*)`B2mvga)mEo=akG zk5Nvk37FMulb5-aaht zCd1Spw2nXQJB7fiP|g++-pkFmI9)`nPwMUX(;y0A+jJ_%s&-a6w?(7RbLtVbqcR7d zrd02@QpV9@m=HQD2B^yJ(yQY1haj4$ zt${gw6E4;H=3a3Um8v?n6Crq`$Wj8bQ&aQmV;WM<)>0DsTgol(EhM4e-)o+5Sqr@U zYn^b>a|5>?-q_z=$MA*=#kQw6ykV9T)6oq_I#zca?~vMo+V3-^fNtjAlpFa2;mV6= zCM;{;ud*K4zgsx#b!5$YUF_}lGJjf*5FMOF!C);DBzwCq+)5zo zW-f#lXW!c~F!O*9Fdsr`UO6?-KsnXGkCDH&Bcuvm5MJbwLaU?!sszKo&F}{uVR!%{ z4Qg0T9r*?(V^hp0iYQD0-d*V-yB%aDmkL)!ttJ8!I`0y`nA6wKIeZVj9advDJyLvu z(O~BDaW+5tTuVQu3}d2nVW{IZ8L*`A7%P*A2}KqJ-XM};@6{wsA*p_prD-@Qy&c>E z9rJY*k@^Y*_Qti<+FiNG$;56Rf}CcgmI^k5Z6aZWD&bkiq*IM|=_(t5Fo>TS^jwkSHQ0ys<;Ub;+0e^`CdKmH)=$yOOFTm%@KZUfl|SvW8( z*Mye#_5yVMS+6DIL)Yaqz0-YbY*)Bl*p1hUk$|+CTxVji~C-i(EVe3y>qd zM)D-cf&}bBIUhfYT!|g=&hy}PhtP_-*SG?ivck_{$HE5ouaV=(<7 zB$|x+1sn!*LvNt_306&CAuCygT!5|BC3mPY8#P*Lsk12;)U<8ki6(glM|PGt7~9y- z$G#d{iaq9?U|xbi)LAa6$)DOv)JpP*s4o_EmRH9E2D|qALa*CR(^W+ z4`(j*0>v9HD%M(imRB#GxN9SGI`RT)m8Ud+3092M-&J+wad`PHM{1S{Rq8MX@Fx(MEWZ7&FA7aH!Tcfg^6o2~W8!D>bgB}0P{x^5hX1EoKuW@BoOs}O^W`gZgTABbN zx+KFks8gf<7mt?0vYX2@4A!7cIT%RXdOD@@4Wd$9t`CT;` z;O_uPB>1vZO<<#sUfG67+oQUul!J^ZIqdr}MWZ(;L9D_j z_z9B@ImaUvZD3t5rRA-r$nl`mb?2`3aaOcO$*$xZ@P7W7@V_o67kp}pT&+F*spj0R^Ag{Q(Q80z5cbz}m+se&kPx;3pJGhHaqgjC-Bxs9 z#gR_Zj2%)e%+Z@O0fVQIdz@*8s;*s6Q2m;G9PyD_MEI{kG-9Zv&{f^>8qqnqK9u=? zEb(fp|15R&|GTE=CS!@ZZuX9o$s)jFLT?qFtvHWAT6vOr>b5kb8tDhPL*JY^$%g)P zl2W8ZVC#DkHk|SFqiUan!;`F#{467U1aBq8WK2Wh%;HsN&SwqRo5P*4mZI9~m;6mQ zgujp6HMjB0Svu8q(Z*70GwBtX{(%8vm(L4MIJCS zQ?dfvyf3c_AylQMbx}9R4npYOUXM;(7b(=UC?3}`l#Ms$-ftzkcxG;V_r}_-1&h+f zrs3qV{k0mwu|CIo^jTQXw3=DR{-l^!Ro_nWZl`$Hi2B}6@vaNuj~=XzW4s1vZ%^zf zb}}y-mC+1I9fB#hGq7`nbqA6>{2emtd=Y(`1ueulLlIp2eb$Ju!(gDYQDP16%{A5)jHwYIwL=Dfx zUEmg!u(I~Yduaj}8CI8Og>Q|$FCK1TFp+alX8?y$M%po~t#q->K;0zIvLTKS5qO_g zJ^XEeYLx9DF5G$j;?a{%E0ziu=NAN84x=z%+v2oi&ax=|vK4tDDjtQQ{SKOW=ifmjWf{SaOH1*vQzV2rT??16l2{wj~ zb`&b#z|;MkcMC?|_7^M2oVaQHz9jG($Fr`qeP43qPk&Q)y2Cu(NvtdAy2gmJ$WQ}( znn-IMOtAE4nuZh3&qsWAns7kt0xLY86;^sXR(Ikd|J-{D=hsse$V%(a)=chn?YLLT z12f=}dMF}za>hy)r7oYLQPa>*5(A)mN%xTS*F!t7q2y0uIVvgtmpW>w zW7{FkIfqZ5*VVedl*?}_P4bs2-;N1X7nLfvrLJwMYg_8t%v8T^jCGGNVZ<(&-Fp?9 z1$L@B_Qaf82uA%RoCu=VYMebfd-HU@2nNF7XdF(Vg{k8-Pg}r>4={nOOy1Ht@75de zoD*d>U4C05x?nSNu?b4Og=Nk}>x!`-TX{)nST;5=0ciQ2Z&!J*GN^z7b3i1*$cu3* zb3{~D!%-R7Pu!c0#4U`Y-+IW0yn>BxRl%E32<&uPv4^9gXx|R@0`zoOA6b-|q&$)- zA`KC#=m_)aw-Mb{IIb-BOr|R_Ae91x(%Lk?s8C;RTLJ6w744#}tN4nvR_E6{l@zQ> z#lt8O0&;NcdOukVBs;|*n;5R99XiYfi0_v3wbgR0(c#N3;=F5_G2T*+e1D;q<^FxQ za&;h;E1rYwsk%!qFV&*l8x&XDn=|i^_tR8ZLUDdv3~t5X%j0!}FAM*%Pjer3FY<0;$GIvLTLYL`nD~IB9=5j{^#fPm;?k!Eaqibii&;n{sZA@m z6T*%hF+tk4Ppk;--H)r7TQdb{zDort$P&($x+0Y&AtsZALBb7FE z)TVgUv8Y_>AS|M0l|JiM;M#ZGxIxI5W48QMzq8iEUmDG@$5~N ztiM=Qe%fE#7H>yWoa!vCaAPe|&v7bOzaWGqO4?D@B`}z^8=zveeerG zZMC%Gwedc@UFFv&Qjjv8I%N(PqTlxGJ1jtqGqYUOX$lflRlj421ytyC2|=yt!t8Q@ zbb)mIi4ertApoXv0z5qg);J>uP20L7D?$~9DRr+!8kjD}X)9bxTlzvR@v!SWR6kdr zEM+hv*iBg%+DW-kjLnH{M7(-$+Air9+Q@G!vu5S`}x4{2$Wru zRACVRdcuq5p9TMF$gv%x|sT9DtzhlCJ?!+wJ%rxep*ib z#C!Yl%xD?hF=8gZ%!S%=<*qKY+M%pJ8CSmiw%HUAi zFgvv52mg%88Z~3pEC|pZwQFRZ`lX1@!H4`(CdDtJZh+rRD~?(f5wDzJ^ucOrG~YaZ z%Gw zbh9O*g;nVsHRkl&NDgZrWI%kR&E|0Ltch~rvNXT2DTwWAM>A=VvXccanyF|Cj9vS(^45pmu9_>0v zG%0-sA+=Osd*l6PyE@pXHLGH^Q&R2)GabV|z`pjPF~OI6Xi+cs8&qz_eq2Ojl#W5h z>@jO|6_K~M>mhY^3_I%OLBsp@loV1rcbsx9@#q2 za~}!f&}LbSMk&Y5b;qqZ2j8}a-+t%$7)f}dl1K-zbl8don)pTWF3Xn#{jP0|-l(CU zS0sY?S{}}Ol!qdLTgdWN>=CCka}-6gaSp8>*WGwu*RKATNu6E#C!_A=aKFO8CW$|* z&hjHL=F(5fazVH1E$N4ZjqR@nepzluaT{xF+FBT34#K>QhDgj6_WId0ZEBx&Y=gc@ zTu}L#S;_H7wU+6)p=@S=0 zIexVs@wE~73uLV&QG4CV@??&P=ug3*{lG7M_*GH6MAspE%~HIUQn*y{E3u-WOF?o! zjA7-%mf9i?mg)lWtSKO1rs~utOR(=eo%y*F)Nl9NYWLdxR_(P$VLI4(1)f>yxflL6 ziSkN9R`{f@f@x!d#K@@52L|hfghS(cZ&4e^Sr1xeS)7eT)j2jt%mXrd`&Y>O zef9AYoU>LtPMb6AR8(_BVzL<}Y&u)vqW;|03|EX@*=>~_KC?;MS)b7~O6g?pdXs4} zLX>!=iT_Vi2qCEAu%DtDlA=!?5{RvZ z-j#*64PI4|(PjaVv?2pRhw63YjSyaL4kBvv4XIs_D7&#LsevfB&L{J=EXpCVtF>C! zR;gG9kFS7Lzl@iK4y_A;FLlG4be?S*!TwZ~KTr?5k7q+lT7^js^4L5&Co@>}UV(nr+mo*K9F4Zd+FHN0xd^P^1>1B&Ft+wWR8*^8@V8DClzm)Hz;h0S*;?Sh^> zv>>!fjWD!8C+AlmuRf5T(7btTMXDp}QMOqv=0>pIhy}EM5)FE&dOXNylQN?j_!*Oc zEB0*Z|N#3^CaDQ9_u7|PS;W+kx?!@J_3u|G!yb5!^c6AQvIbs=ijEZ`FRy zt=NNYW0H?-u>`Gwa|6|a?Y>;?zHApH!rGU$Q4dm?t;l5PpUtor6em$hbGxMGeR@`% z*>G^lL9nP|cFwJEJ$?-y^(4*|spf zbxML(XL_9-{bkljnm|!IR?3aJ!9i!qbVBVxV~;M99{u-BQ>ASW{nh)pcHwHM%Yvwm zo*KAFvh!?O)*ym30O}MdT7;t+W;q=8^5{$5WnGo#mXIH`Xhr-OBQG+fRxHgR&x)dl z-Sa_~4yTB0Y{fe9RFqZY`wTvlM|28x)n2ybnp$y4@?-t)W$^^-Iwb{84LPuk+@>v2 ztOxccQodgop60mPCusPTYr)er z3e~95$J4XT0I)Qx2({uQZY7vSm&lPd)7v37H2N!{s*_Fwk(x6wL4z8Y=UtN4k+Kzb zHJa`$OIUZ{>O&S=A6)oSu(*D?#YQas^Kag5u@PHr#JZpGvuhK_EyG6C&o^i4x)ovO z(n1WIrx-hk`pcpBHt!=w!7t^~yyELq#+|jpw$-XEuQsx-rOAcFz(W!Pp#k{f?Deg2 z7oX7?XxH{@kD={QUHrRQA7VA(r=PK%l|&XkU-jintzmooS5+6m;qTu zKf`THkp~M)k%w+6@}!6MN5mTNoIM=>4a;b}wh6xz?-knn&Lh5I$NO2`vEfs%r8HR= z=B{(}687Nq%%ui!j0m@V>`w|G_V#GZNJYml*vbL@THElO9Sqzxo}nuz(nn!vcjq z2z;c6?9*f~1|4{N1cN)fhnbA=Vk*Y4hD(?f7LjhETSuP~F7@X04HFh4OVf;CIl|7; z>Dt#9A#WutzyM24TZ|tPp0MG06#KhI32gVyI`&SxMlN2so}0X@H7KFWnYd?|r5H8@ zVwE7!O<*%Aa`vvpsbv`3QMy=&+`ldw_ra8#SlQl#b>w1i%nj}; z@e&e~MAI7tD4{*{FB6~rBF7AWy7qa}>6rf#B^Sy6&)&NkAJw_$A9zVN%vf#Ja!*# zV@9sb`Vg6&4x}i9?m*soWR_&8C*2V&{GGj{8vZ4?>z1RdKUE?(5dg~|e=KqVC; zQUs?$^=$Nc=^t;uJ5_o@P8vEUs`q@!li+xHR&cajD}X^bJlcO8TnwaR3qD8UcbLO` zpXKo?C(06s=y(M~bg+H9A^J9WB1H~1#Yn7og}9oDeH%J#kC#7e$2*UmA-fplxU#&? zLYV{tw&gBTaz^DOz-%N|186Xd^%$@H?WK>`(c#`Lak3==$SGD3UHAEBe|BQP2j-M@ekyf4ZuFK8l~kz14D*%ws3A;qJQR%Q*grAVmfeLmZ&9%7&vM>yN9lq&3x6hB-HCNNJ|bx zaFBLk=FRi1x|C)MUNA4iix8G}76+)d!%@%D|jvxeRtz>+~*hFqRw>e0OsG!dvmQr+bUxs3|`jRLc+UcL$3~ z6Gz)FYHX(y=Ml?6T;3WewsR+-*iP`$UZU3a>q{ty_C6JLOh*hw|I@!ZJKMLt)4P;W zUMhZ?6S~M}C+YGaY_H~rs}A)!hF{FkznKqyusgo ziH4d3i>w}}mn6KbtC?so;M(bQ0i;h2i#3S7g|*h_Dm5}h(lMC5N> zlPUDhh4xHv&4gJ5uO18p-geN-CgT(-JYeVW?c^FBlHi*>U0`j!G~(q7@1d-$FMa%- z<=_H~1;ZlHbFATi_8N94g5Tlhkt;}GkMxaYs^5h&ReCpfB`x^FJL)sqEY)5|w^6%I z-uyb1us#nZt5YIC3(O)HB>f8yawUVOac~-RT=yja7X^kVFZmoUb%S3@t^@(4j8k|u z8Zt)9A=oAFjp{7Tkeeb5P{sZE-1%3U?ZK zip3gR2w}7g{-AzX>f(mOg^;Er>yQ6=XInl#I2Qfgz1_ob|MF6Zz3rpRu-8A{J-8Hm zhdaH4o$#Q)3O5}Bibq~Z5eHAxYk}x5G>Wq9k?!wE<3H))H zXpdTJ>5a)HFzzGMt!WGJ7AZ#`aK;@NM(~OvN;kl>+Kr7(2Ho!GFd}f33A(D$CH9S> zp~Yg7;?)Xnhk^BO09VG-SC1vLEWp1V$73W$9wZ_mhjs!{lDPSR%hxjtX;n8wHv?Nk z+x#skMqrqwT8&|ns3WHlj2*6qwC*wiGd(A4Qdg+!2?2wH!F68wq#43Q1nx!N-G=B6 zO~h!Z+YXB?Mdl#b$YXl%ZP&8|OB;sL*qXLI>;Rae%fXu#jJ;}d0)MOz%gNluWT|WH z#b-R4s+TzH;k04L=M_QDIyTp`;#XS7NclWtHIZ;#A2L1~w&@h+Y>J;Jy5q1rAJ9yhYA)hjV6JgHc(=V`; zIj2Rsyr-w9tTc&G!Yk_V^Dh{d^ zBsjQz$`vX1^$*$grfG4(=ij{FG%Z%{XVbK}^gH~69WCH+H>_##WldsC?O!$=<5h}6 zd0b+#Ukbg;QI_CVgelwL`xo7dpnD!1Z*O-Fj#Q9F8S!ea%|>0gQ%tcfCS8!Do5|Pc ztbF=8JqG`2D8r6B#xR0#E(a%LggrX=sYkExP_(w4Lj=dDa56O-QB2ZB?4(djd?MIk z#C%BNTwM=el+XNNtEPQ(jr)8WKJ%K@hdJw=Ta#&fZVt{b9btIv3ns~d)+uvDV8z18 z{@X7l28Yy**>;oP@W-cLV78%?UkMYG6GLAAe0CRep+GQ4a$9-L;2HWe zGld&Pzt%hqct_+LtNu&-1xkc*tdL@D?;0yc=~YDCspMsnM~-uC>|6tBA}B{R;y?Y< zV4_K_Y?~g=)y%tQ^>B8{3RSAJpgf<=)U<6jo7yplQ^7iss4&G+!w{QBiAv~G@29NK z=&MXVl@(}9;Yte@X^WB4-l{1Ha2Ot4R?Br>#cq8x-xj?4^)TLMNnCmE8m{fma$d7~ ze`aZJt26|MpH87&Cj&}3ifMVpeq=OPhE-rhJHniUPAoX~JCVdnjXolh^rU01WtFnd zfy9lg$?fx>x885wFKBH(I9gZ-IQH;Ek9Ipc_u@i{I(p{^_j6TMfZf1gG2HCYJA38( zO8+}WJhBku_V7B%NSg(zC-j3bCmXdrmKIw>LlMPdh$BRK#2!bglk(G zV+}BAYaE8}l2N4%tK`F*kJU7plO;;qCK==;i-ao>fgx2pc+q|H&5Ng}TlM8vT>~+h zXdl!;#S^|=m30nYqQ5srT0EHkn5T~YB?W~PsggUAGVkONa?AH-EETi~PFpI!bcE3D z*klc3+}%n=@v8VXwBJZ?W;RK@aO>J6yEe(LO|olUy{FwKC%cSGulAO@)!h0|wDMI- z%B}e3Be?e?2tuj)im`H*GMr}sdxfo6!y@SXmP3fGb#&*~JQm$;SPsaArnQ3{b{TY# zVauM70y8SV^a*C(eo1<66I?;e??XfU3R(_|d0Ps=f9o%G3a7ZpV1 zY)-VGOGb6=(2BQL^qQGIwyn#aCEPxJ!Z&7VkId(pssCCa2hGy}0)uPtmguQl{d|I- z39O@)lPwRfu_zOKGD)3NSF^(C!H67gL6^iU_owl9#D7LnmVRtKRH-=(9KKL8%vpJFUhgp zEGx@iR+^RKnoTYHk%w6n?0SGG*m6uzQ)fP7rc^I)rawk4O3|&_jCAbFh%$Fv3j~6C*ANvX3y^eL(JHBJSs?6?Q z@Z0~RFBzP8m%Oi(?#a_GTHWdM6Zqfmw&qJ!u;lSA0-Kp2Mm0`)lb{ltGn;i9*&_EQ zzj*i0H~Ga)ezCz@^IpU9i(Ex3qG`}eve+h2C|T&h%ATG+p?b~~^E{WZ@PXqAUS`lz z+woR4LE!%Q{N-u)|J(_#cOD&hT3ze2=`MI_>tS`xN+SNnR3>q&#k|IhmJA+uV$8LQm35qFEZW(pYRred59quuhF*h@!(Dt7Vdr?Ylk7N1;XP}yE z{cD~>+G|)2sf*h()kBni;1C07st!^V+w(E za92Gv#Og}uu7buj@E&IIrB>H0EK{llc1qYsI&j-}y3ndRhQWa%Iis5oIF%@Gye6*G zm!`n95=(6g>~P27I_MwmZtubW9fiko_psmF+d1qX9v)uq^>+`&_D%@rlE*umJ7MX$ zu>Ihoo<$wsV(!mgdVPxyv;LA`pg5!gm4-lr_d_cfCcBgv@wGnc& z$3(H@;tHz_0;AYjn=>-uFwm@m zC*}N~OC>Pt0FQ%~%Ee%2gu2t%y)tgKcl1^zbx2OwXF#N?E!(2f(4&_5WtI;`S}@TT zsljS`T7qdpd;!^E$vuM-JrFbh7hUBP9%m` za%(=Vm48d|?e0foQ5&2fUHb{ztkl2R&2Y22il#6V93mIqc@S|=U}WueeI_$Q9+>UB zpmIVhmXn|;;qd-|3jVNRiJ>g1`68OQJl41J-JXoSGqgXm^$>P+f}P*4bo=71O`0`e zjVHsxROaE%!c^w2kLEk*Xg|JV>OHGUT^|hZr9{aKAhYz=`kC5 zhDdMtmw9SREm0KhOcQf{Vty^f05hb-z|1W>c3Gh$l_Hm-9-q9#4Vrc(E=mhS6idI| zXz#E@$ zOfgzGezsbhC-N5I#=Cbf&bVS0DKybXgQ99|yp%T+nehXL4J1ks?3CNPS~oN#8IpUZ%Vzt@f` z{Qk~uJwfI6XIgJD0hP+s%PHF`OChe6=F8O0o2$IICi!&vK)#dtP?UJj`3ME@9Mrm_ zmg1flDL`BjA1ADAFzR5b!IOrgaWt_Z9}R`%Vyhbi51)U^?=?N*GHbeT2PEsT9gx ze@g3%AmxtW*M%4&^K(MAM$1)4mmAZtGinh5K?y&uaBzzy0jx)A5l15+&D(aii3rz?UyV{o&5` z-j2Q@^Q-x`U~d3mK%c+6w)yU070q`)%3jb#Y*kcFf(u!c*y{Rh9EI{*^UupHhvQ&h zabQ`K>M%K-c}*I$!&MBL2T!|W+hUUj=V-Zu^WBT{Zm_ez-I-aJ8v6Xl%YA-d&hi#x zP`4&mJL8@2jr~)YQ=higc;(w(IuJUAFukM+az5Rk8ZG-fbT_&HizQSe~TA z{%dDvXB9imOTGw7^z^@uMiKZWT(Qqm*DVjIe%;5KBm$p$q921R5)7j0P@>qUah34* z;I6=SWi`cXenM4K^Q$=WvnP?FQqpB{Px*+lj^H1$DyduC7P`xRrasHsc=rVe&;?-1 z%CJL-;Ct?b6xX@HLN0i8V}#SA@3!Q9efJNoLW`ctP9An;se)}^aAN$^s2#xeEE0{Y z_Ur&g#CozOjr{qS@|7Rn;h33~Fl+}UF@Q0&FrBGgSpkX~nMIiz%`DT?PXTUy_3s|R23bTF39X8u&HN^tBC^tV4YUY_~=XuK) z{TkaNA%LtkM=nVVDVCI2sM7luv#q69pZli%f%)U~EX7AHW1l&4el~Mk8 zR>2s%R#Fy6$(4KycLd(YruSo%gnih`=picewL(-wnG3UzV=CjyaLiKeGYL^_N2CZ! zWu`fELOPeKz0JZ|t7Xz-iMeb$2M7UNn>$B~8=x<|9`6hbU@;YbNF}xf>>U zt#UzyBtb*Eh*1f_)#5Yb%+EwOSY17hy)vPs0{tolNuv(rl)o0sFlC2wrNQIc$Lg$D6kR= zGpR417(?sLY4>~!KOQAmJX8#Im>gCSkq!T%5n|bu8NupoK-`$as$a}2`MM3%+6V;YODDFC13(T$eP#((&!@~gF2mq7iQu&a2m{ZstMK_2msd>o zqt4}egOvMXklmYk=q%()02-6FAw&14)=EVcBQ-wA3xsPzPvnmyxs2~hWq>5 z;qK96Ev~opJn3$5MyV&=ApBex+2G92FD}lzPWkiR@}{l>!4)Iw-PPDAO32~O1tliB zm7zJ+Aub@{Z6~%=a80g4m*yV!YU%HyN)@#%q)D zT31(Lw_zEtPybXQ6{!W7H4+S zi3(hDPH4$-oJdoRhjrk-{K@V(9ru0TFM`NQQfZWdXK0_8$0UMXT0cqcj&f93Dz+u& zN5L5rY`Y*Pg5J+8kxu#6Z+(pj;p5?*yrp;JM{fMcjUV|S{m7;XHS1U#TjkMv!-YvF zfhftYK&Z9;Vl?HBC%qCzZ4C$+8qg8KNybwVml!DLya&KFy4~k(JO;eSDUogsNmT$- zRqVO)F9i~=8#r)lD5CTdxdpb`*l$Gumrs@^ixzfvM;T~(a{hvu5$iydxa3l<%%l!5 zk?RzXYklF*`Mr)E;90Zuvt6r)4rQkoBj09diw=CNAs+PTqfcoV)@S{?`r`u zbVaxG#39v!zi7fB#1~LqL3bOp3YlDXis&kp;g%0OaHvH|W@QFntM3|4=jKK%0;dOy zIaZpZ)J0@S=Hz+O#)|U zacvWJ0r(&3vzRp-sk#KQAR&GY_lYsgr8Gm|pXMK8eVD)2;(c_>gF&;+B7zixLOV~l zm4UH8v+G8?N}DQ@k}Mu`Gp!M^B6m=chT@E(%*TD0`cmtpF|}?fV|dOWo1~;*a~q{4 z&Jej!sF}y4>=20#+WVg1y}J@nucJ863QDg9!)Pc}VLy~@XHn2G7!Gt#6v!y7IvZlU z2ea0&$XRsF?VnO`7Q6%pS1tNiAGi2ouvKk<(2_5R)oQHU`K1N@g`^Tk^GGFD((3zA zNhS954SjJ7{LxBCB|58o{FQ`_KOE(251)wRqw# zx#@R_W4mOQiZ`9ExGZ6gD)sd|`$_go9AP+H6ygZa4C^hdux=|@z-4i~n9JhWZH(RP z#B?(^AHmO;*5qtJK;<{oO90u-IM2zV>w}EIh24+q&bwopBoiL-aYo zvEuwO;V?~k&r;c0;)(Qg0)dMj=!+O6yl&Pu_IztL(U3g45^q%e_KWE>RXLtns*Dfd zIfDNfRfdD2$54QyINOlC`UicQ*o-LL*O(a-P)z}%W%#&cm1WHc3~n#6byKR#MgvYe zwtbJ4##Zeyll-NI(JGFS31`>l(}UD45DPo!kG;O=3n=|=B8`V9xxe`n%4^UWTR5JVu~*|@gq{*=pj^D6Wf&hfvk|eq=dzZxm3RJfyDv6Xt(t`?g2X_7$dp zdNR49v=1_)#9~y;n|T|szy>U^0Sl~SMsTljZPuQ%L^UJ3(rRre+ka{nS^1eB)FI)+CP1*MmfVBnGa)j(X2r{f?27nD4W zEd{n#xIr-z+u$WTfvce1g>O1iiaEn zTr0Q)LOQSp6SR;uvy)w3ZdHYTbku6JcDgc+bJ$23^^8OfzyJInRJbY?r@3arj5N1+ z!_%rY}?*W(-yy#awBvWNfN49+}EWR_ZqrJ0{sx5@Dqu(Td~yvqCXz zS}_SEGlc~vB;p^Ma(Px#UU`e>hpOqaAIj1Ce-{q^)x_m?=1ID+X9!XkZ9gWLvBHFlbQq_Ajv6mI74AVB}EdbP<2r* zd3!UFlnuS`%s2nVo*{Lm#G*H5I4Nhh6uqM7h8BvB)S$aH3Ux+4*gBmQdQle)?f651 znidsqV7v!KYxo?gpkt-wOx|lXTpYV&k;s~au8&gjl*{Yra@Cd!M-XHSui#T5aGY>^ zy2GVrz`xH*zxuxT@c-7@%Lc3J3bQ!4Rd#G{S;yF9Q#aYvO*VBso!X|g@cT}!*+yOQ zgbZ=V!z#4i;nPF)GA)qc?0}KWX6g76tWaE%cdA?q`)>@O=QRjKK8=4Jc#-JYa6eS( z+M1yHW%XzOhKT|>DP*E^0|Qxzk&19R*u435h~f3k$DqvMIq^}5osa@VgLyO!53}%5 z?5*Lw+bY?@?miOWqzH1gG#b{8%1z@uc;^=)YUZe&Y^@1+kBRG&Q|1NxDA^x&!Po7%Gg`~WxpSJm z?k#sd6BXCYq;5O?2FjULigk82eELPGIiRgR5o&I&Pbzrr?Yvp3;3u{+Qj2LQV}qCyk+g zK7QNS>lfH-b90G)R)GC0Y->kjQ!LG@GEC`z$MG=z=4qQdB9kP0pTMU<3x5u4C;mfj zk@s<%dKso<=qEO{p_Xygxbj~1OusOFVAG)C_*%pG$nGyiPJWBC4bY6?BoHANRcS$G zST+{FT#Ij3BNxhHl3f_XGIlh^LbjiGQ!WJO8L1?9g?VoHY^Xk++fikvQ%$v)~lHDd}RgCqXJD;P7T>@@M^-^`B3E- zYBBfIxa=dViu6##MKpwfyB^BXcCSyMjc694VNn^?T5!8k=yj{oTS%D?ZnZ2+O=!9{ z{>hgXix$$G9q;?aqP-54_B!Mic1($XRRyBG;2BjCpHSP|U-ac_bHgjB3Gu~E8X?72 z%ziG*EemdN+yxTO)5TDOGftg~rBko)N~a~(6DHyk?+)t3el8Br?lsdJt-F zc)nI?!nxf$U1Q}X33R`7V{gp;w&28-OtWbkIJ^RO>VR3eK24Mv1vdR>A)Y1Ou*Gdk z7GGn_-jpm>=$|!>E$*Ch=2Sb-1PVj&Ve*McI5TO$3S2=)P6w3Uy7`Fdc5s(m(o7t# zE49yO2^;U#GlPAPb$7-$G`J zYcWpBty{BTTzM{pn_D12W1NL!1I^$Y94ZtPIm%1`=o0Mct*cH%%GHnJhYYin`yy4% zibqyIq5EvlyRWwz?B%X`q}Mc3Jm0gGdJ>V&vtM(F1Nc>1z?@B`>Z@HqRbRi zs|Im_Yl$a*ZIR1q{a%$ux7D;|c73p~2_cdlhC3@s4o4aSopumSvxJ+TDC0m2y-C&% zv+(94mb0C;kJfa}T&h>h*`H8-zE4DAXy;gQua@;54#KqI6QIFG4bvNpktStiwGxgs z@~diQfk6C)$~+|t0g?`ix~eDcK%(J~PrrbfKLlG`oWNR04t0FsC$RQA=mMt%-BDRA zkG5b{nXLVQBt!VZDxcMLFMMA)t(*TO9rn6BY+I+1rd)#{xiXi^Vd57N5dLFUK3Zy9 z1CgU29&UN9o9GCmczU&UKv5ea3r~_@6F#PBiRhFHfxVlLSnCM#s4&tLRl2i6Vh6qg zWUG_%iD7k~Mrj|*ZYe$%OfiBo!Q9Y#?LW+F1^34OSs30-;!-N!aM0Rn3~{nnSm>}7 zCmCbI61wK3^~PLp_rpbU^LMqiwNlu zL4(_Vi3pt1o;(UeG5t4qCs=u+nkqr%qS}_Dp@1v-a-#~s&TUWbRrCg3Of;ovMZN@H z7`$Y(zyLYVbsvI+4yR9?s!;b%isF(tkW18M-rStR8q z6S&C)ehnXFlL=g*!@1wEOrYm*KDvq&;_6Xxo$6IksfPC=n`=^s!*IJMa&9_tPdx3!4C;3D{@%<>6+48fnTvh1jfNWAE95wpR@?3QbG&B_B2iNnR) zlhdcTvtn&$Ja1LgO+?xN+Xz0GAR$sP%1V(I;4>wvG-WdscEzKBd~G_~*WS*W1u1=^ zQjBgATh(8&+-fqA#Au{s!i*SzwV~E9OCyx9NUs90rBN28WwGTnqVS4&^FdVdm=^Ts z(=V=(N4NGC*zLxLF}Wwj4MZu&0GVIcWo29QO3MDDqej^g zI&P-#0&S^Ag@;h_CuG zrS+GCh4q)CIpQ2EAu)fb;vD<>hQ65j|9HvL6HNGzv)0IQTu2I%f@i2T@ojMG2~fa9 z3eG62Gz2>hUW-&*N&2h$S#{uUCkudP_RYNSju#l{-nK`FwBNzXSBELaZ)>4<(*)QL ze!$G!OS(j@nbc1tN9Cp}2(Y(`x%71f0jLH;6)4N?U&vJClg#DrbJ-ef>xWC6+1EOr zgry(KDODp={4|kmqX*TG1~`Xv$~P5-C^Upoa&-!eqB?_ViSVp`mMvOYD*vyeJundI zRaD<}Kt(Xs;bOWXhoY^C+v!l)HFZ6UcU+}iP_Ixx-3Kn!6!j*=6gX6xi&2pM<1nZ+J-F+||52*ix^d7R<^j$Fu1j~v4hCYh1*i=p;Ur1!}ldi7CL!=o( z2kvzKRke4hz!UQ=%4!)FR!c63fCBK$qBurn8rHJF;(vvvgIb;0*=wZ*sl3l*K42@6!9SdYZ5}fWM`QLIz!oQ9cibzk{-*6Vb; zb=vNFtE=(uJB|w3h+#gnq&G0CpZ*D!_S&$?Hf~r0sdZe2$k8@`r>b+QswzyLtMYi; zbEzKfxK7pmsHnh2T{r7%NvQnb@50#b?{pw=+aJt3%l92Jw?;I(jVrHYh8dF1=Wgr> zYAGd>4o{^yf;tGF(*% zC0iHE+psf3d;qFn(YeW2Hy_JONoR&1;Eg%ZQoc1w@TcoB*sx*dWOIXcBt-?}NcWbQ zQ5sK&st*Yrqw8@@>T?>88!4Mu9!clZZW$@`6!%kdiXZ7(5Q$oeOia!m>g7y&nXXAuA6z)a4Z-DkixI-Y`T}kx?};en z;XV>nfZs!_J7=B$^y7si2aXFgR+*_g9T{Pm0#S>YsCW^sk%&oO=$=1as52W!C@X>l zFRKq(A$!IR68q-yqA+IIN~5cO*G^Eab^B^IOpLcR-=;~`*l4V=iSo5B8SXbu^5>#5 z<7TH<9e)h7WYB??L`ng3VTS8#b^`i8x{YS&tB0EqF%8=mf6!*cjyI zkgw}Q3L6WJu$)u19h1IANjVixQAjgx2e#{~Mk`iP0%-Cw)|9o^E%B7xogpST8;GL- zGxbX9h;y^Qf?b=~T2rWIEGA6rg`Pxu(^elllP;~qxX4C`O1?3jF;yfz_Nj6Ati*hq zux1n1Y{Hrc6xKA2xBhuGMzQe(!B2-0zQ2NXDGMh`_l;+eNHiH~s3|BNc1eZo14rWB z+gI$OXZh6_iDO_pELmYJ#g0Osv7N3^z%{YDui0YslCJz5Lw}+ojdelBtaaDNe&Z=xhF>LxDD-?Jir=mZQ!I|vK5dn8Ad>B@he1fBs!*@fH%u2?M zn|*8DqOsp>mUuhUsFHSF5R*?`5>6CXBKK0?NC~4XbOBpc;E>tGIruq2O!@5~g$*M& zUcNKs#T35HMJ$GPMexLei|F4__Eepr?t5Pj$92r$2N1PP8A3&5IlO_j!1IgscDCh^ zB*A?4BzBOzHForO`ZSdgMys$rn4E;umsqSL_YrZU@Z2%Xb&aagM4=62>RkKT)~tr8 z=Y9$WXMyXsRVvRqYh4O(!HE8dDzj~~Q|O-cNrbRvG+f5#FgnRjSl)ANL~H<;x(3HQ z!7$CI=*AV%gmgrLP*l)CS(y!m5(Y=>F5ni{CW>BrTRv`-Ex&Y@JQtL~_yt5^xa3~Q zO=B%Elxa1chz^zp%Vd6TGhTx;}sEdqlD2{l`9S&V{CB)Nv}uLmAZC zy|dC#va@r_C5vx^H0u;)mdmXGqF`{w)+Y*B^Fl-8ge{DL5@Q?gRH>I1acn5b`U2eQ z41x)4S!G0w`S%M5VE-z^vnRYOqPH$#56iba1hk8faT^7y_!^tnL_)$M6|;ST>yl#m zQarEbk*O#5*qy^Zvl7OPhsr*4pl|4l*=HW_Eth@9Hnv|^AwZxO z>iMHf)I>L?OBRO3hU311b-%%hBXWEW=!du_cuEA^RD*|1t3zMIU(iPo{sZuBw^IvrD#XkhXlhIVB*5H zueTDzH~MSq+1dHqtsn!x^*WO8*JRk1ykJ*`tvX!Y@d!t!$Z{~e7w8zLvNVSIG`)&a zDT#geds)8E@^~#qac_HjxuZCTWoH?uzC{vlIZsf_*t3jN*QWQDabn|#arVRzpuwMO zVum}*HN!g8+d#xIXEEOoz=(p8fK%RLcxEG2ibcPf_uXFQJ1>ge*>|h22OZs=&>{YS zq3B%8&M<87c*$49aO*W)u{P4IkHz=r6Ikxw_Qsn}U`dp5)t+iX zZ*nVa5Mu$w#bI+s$k#yg8e)9`Q$Z!=R8tXa)Ha=jVV|62ubjm6)G$s@u~+Es);Tz` zMI-cuG?lJaH3WSa3nIr`EEU605-DN9h(7bk`h12aZp^giyL#nTh8MhkbqkaY6>FI|)_Y}QP#m{sHHa41B3vytN0_LBO zwhwlX}?+$?ZAHy!sGDqG5-I4c)7RNUk!fa;L*;4mE>!2w3$1)Mo{=Q z!ZlUt3+ElbvouPpD)gz-7tfR1wLELzp@o5vEjXe_*V34VwccBHqsQ>1xdKXgDh=FH zq0ClH7Fg1%rgojfa_?M>r5wO$BIl=zOTN?PRz<={Nq$*1g~?qi#H$-Oq()^oP~Tf4 z#%!j%0pm9kIdbGFx>eI$M|%T_p-^2p4v_UBm+eZ5adw+9lC<|QUGDZ$F4n=Ab7M4Z zwVWYHT@!vNW=8mLf!GbjnoLRcR){ByV7Hx8YGI480Vz^o4wXkk&P^0Y2{U4{jtHDX zBc3Zd?05^h9|w1GO{Iv(Q~8cuCG@{S-kzyW9Iyw5PryAiEU3e7*3HM84>upv{>?|m zK$wR$NC~TQ%>I|=`l;1CuAm05(XlBx(3n7+n&LmH=ZHI)6K?fUlE=8TPr$K-^WmjQ zvJoM)g=DSdxorVo)rjBvE6d8Pw_U%P1~}Pc^){zi!MU7iC}boPzWbTi-GU=Wntjc6 zPlu8lK4R*z91TP&sgH`fR*02NHL0K@aPuo1i zYrN(`<2XA1g1xi}66F}9Bxzif#qDO7<$ICK;7ODuSWbN{O7i0iEVDj&^Lk5VAi9xSY!VTH!N^~U7aTJ;kWiNN@#$1-%)!+4igGrxO|@!@P?s4Y`G{=aZTngS z^ImIwCz^M&@SX1#tdQ(aavvAV{n65``xGXa%un5H`pj}k!Z7Xuv+_V_bl4w3SG2Q% z0!j*C#H6PdW5qJd+Ja0h%hChLU}3V8mY)`#Uk%&mXQ9gv89yypSfJp2i1Z~;Z-Qaf z>Tcbsq4i%4PXxy|oH6AremtJ!W5p!{O9fpMyV!I+!tbN+(cPrN(#ILs zEOw=)&$u-x?U)TsWxtI6^*lZG2QbGtBSe;8Q=(oZ61=y4=mA`ic3sEI3fNLa2y*F> zGUZSyOu-7bsyg*ITqJc~ZTBno(Ivk=jY5@`lsa5skyuG7%0*tpsT7y0uAn zExbl8jG|-+J0aPK0)v5e4kS~>qZ%kRlS3WIR&_Zh?h6(HElx2N3!6qbhFA2H zCd5CAOECVFj%mS}B{G)wCqX|;FUJMJS}PRl!tjqK>tx_-o^5ZMmVxJLG$Kc{2Kn^{ z=d&6yPV6rt@Ykt7$bfcfWXipjlZbeBd$`Iid5NVti6rC`|MZKiS!=RNyz`qBl48YG z>*gfE04~aB$|nj0U4_9r&VKwH+ug2_kRA_;%x~g+=RfU(mplhzBTLf#Kb;UK7w%2+)$}>3C zkV~Qw!&7XXMYnRsXe%S@WtfnSU26pJ_s0y=VX#{sWZ-VVFI$-841OA4UBS7pw%T~X zGApA|FqH!&-Ny_re})Hw&ytL}PsY&&n?=gowpYUNkxxz@53ROSEHOX+m zv5FIlx*QeKNL6^ec3T(jikFG=XjI~By0l6I&XPv&z+pL{Wt$#Rn$p&N7ONb^VwHs| z<*<1)s9kNzRZbTK`~gI=!h%zM#$~G z=52v~777Pq>_WS)qCBLAFB~jtowmI)Mq7n$O@ocSqa+`OondiQCNOqMAWFQ*??3-X z0FP1x@c+>jSXEl0SB(_3v{bVm6XMw1Q`<+@Dl;rZM*9YCC;iA{pbbtCj;aLDcnNTx zj#(F{QL6S-V!#FCLYA+qP1$Kvc3RVDy=m&>zUleLa6nG5eS`xl^x72}g%f<(-V(Av z7OAtfR1Pl|rODhSnihSLD)%(99Y6>u^FyJ+q?uS17H14sCU`wIfKJ`F*4Slw?d`u= zC9ezIt4DeE*9n30aH|*P&}VVrq(>zxg=p`m2ev9dKsc&`$6PiSHG z8Yy$fsZpnKk}Gx*hu@c_E)Z9_P2M}Y#_2evIGKNM=82`T3kKLTW+o-(d;Bz)gS+5) z&9}8^ikiGj-4OA>8p4shjE6IRCb_0? z92FM3hGv)7em*z1!l!3ktP9v`9$-Eg#ZtL3IvqQmBHEsv0yIpH82$!}0c?(u0vppd zm0Z*_3^ox zYy)*>{+-PZxbzv*EQRquiEGjAV@e;(E3{?Yx+XG5r+!k6Ii@z$P!J||;V3>1kohwg z2`~Q>Q9g)|;clH$-!F;6~`v z(3;+^6!0MM(sJQJ%l!&2Hh;SPH-V$#AM>m0M+>X#$9{Ev-_m)*e%@gQ9!8dRU~lY? z^Bi$xt17tfTSnfezx@*YU(V%&)~UVzR?V0!x}85X+XAj?Nt;yVJyF&Z)(`d}ovyA5n0+HHy(zAJy$y9! zTw9^{wBNAe+Rfjx*k5nC6*ddOdvTOD`zX?(lQcvSj9vzNKv9n6E>=XGUAo=e7lREj z70d*{6kHlm4XxW-@bgI`IIy;W9O()N&|c6f#3ckIvlrA0_Z9`gDkqJ|rjkP#++$Qk zQOF_elv%EH8!FofM85+5p`-$wh9FGFsYjXHtVZGeWM*ScdE=raUoV?#VtX5KPo&|v zFPj&1uQ?EXzhTwECx~;>@kgqVVHQaiM-H2^I~y?rs;r%XfEpa7rV!>J2RJaa%5XZ{JTAjLwT37nLq`F5 zShT#5V`=buyfn>Z>@~NUAzc`*T3HmO$?akHi%=a{n<={dDcY>c=u6%> zNO&4|j$#YhG|3>rykPsnDq}SZ)vj)-wh=1I;eQBC>9J0Fq1o<>EG@=U!ic~QHo+~4 z*!r=vi9;l|X&ol1OqesB0$ux`H(5gMyAwYs0r9(kr>1$gI{^) zx-^~uf685o-o8(qh}2@sRUPJJPr;kRILKrOXAr54EWNJ%1Z!65^(A*`mts&v1*W;8 zGKz(nF?HDhn*^AXYi^rj3B>XuM3A?J7T*b5z@8@D6zn!Np5{PYkEdggnx>7|+TVV; z`4}^6E~X-*xvK$8`=Nke8*+qDn)YDKF;ocmo1DP=()O6+MF~9Aj<3~}Ux|p_L)DZ& z)Hn3yGLS0~;XXIDrE{I^hR-AfbN4B~Ce3>25LLq8(gZep<;k~RWmi`Ugb_SPW$M3ZcE{SKyneHD#3QSstp}^v z@4k*`s~tqbq2=UHm0DsIjEUso)53gBk;Em8R>H*;QskHscC|>gcD1*u!X5uPggy0Bgz%!DFfZL(D`WJg9OPCg5;-jGgag~_zF zedEJjqnfOkt71^UGc9CN-tm}}47jIO=L^cgv zi|t}sC@eM1D_T!HcCJmg>!u*Tl>6BfkO1x=E!C)LqwRUR!d5YdJd=ijPUFrm6+i@>bSmP!YkS-mf*yyVzj?{6mBcqh$ zmgYj`*}#J8UIy+t#2zp7RKa}Z$`<#m5tYPkNxhcxaiBn;X)@|}*| z4(+7c;aHV-u^T)iK}6+Qd<{3^Y9?;vsiKQ=^Lktj&;prUG#%j(e9oD`fI7!@SThl( zGF=s1&}2U+=xMlf2|R2B3%V7sEFPzdx(CZ=RAws)l}Nz=#v53)*WnmKhdDr_$fRdF zo76MhchF^hN*lZ0d>|g(1og*su%%-sjbAkS+*XgA`?0`(>)X)F=f%-O$$XIJyg?e3 zl7oR*OmQvB6)O)M2g}f9&M~kF2TAS_{W{&eL#quqpk9%Q-iM?l4HsZEJT)D%WT%Sb zkxh!;jW8(Cdy;deHn&99a39!F<>lUR4&hpFzKjezn;uOLVR4A*(NqkJzm0Po8J24f z<^5=ypFqfo^C1**U0^UK#B1lR=X+s&xOr}Xn?7}%Q4OZ7SaiIBIsSD#tB*%4TiPur8{h#1_RL`Xj*_O z^#R+M0oEwL+ib$dK>g+!wsLD@g#xzn*+MbAvRI$s-NmU(c);}-mHAUY08e-b=6zX! z!-fO!Sy4adqza+q^aw(@3tpipBa@x1G7B(!DANg4c*kSq2Ya2;Fu|@1SVI||x|uM` zo-oZqhtA<9!=>J)E<)+cnGmp<+Sj5f%nRynz+ZqdhCZs>5PWP_;*}d#vrv(*Oftc? zolyA0g~bW-hqdsZqde=&qR8^C+I)i%5Yha;T9&xCXvw^gc|RIRH0jBeX4bR$L$?`b zW00#d$YwFBJoghk9EihfCj#pV`A{Ay5_|9tFrFwd8>XqRX=m3yhNZh(48_$z52|ge zj#*?*{x!sm54*x#PsDr%vo_WyM^fQXl39p((1kgK5V|sh2f{u#dp48PD!e8%xcwo` z5Rzd0^sfT{1=onpILTvY~p~U z(HHv~d2CY-=Ui#waNO5}g{pR3rva?>Q#teM{B$BP-Kmm%h)*945dPw|y>rD0;YE?E zi)&nwNh2yi5tGY%m2yPOpzy=ZN5;eP4-|>Zm2?RBTq!nAH_qvzT6!im7nEY8M^n9_ zk(Saj$>o&Oo&kpK`W-T)h7n5~WiiG~AjK}#RtmjBjwd>i4$Hn& zsw1Yb5$WrM96HU16K%4to2=_5>$;x)YSUQ5DU~$~54NyO+@4w*?wDwmIS2jdKzXr> z7$sXisG`YphIGmBR+#!ON5=OJ*=IXElvV0Zs~sP zCxP}6y4c~gVX?aO&ptvIgO~a;_m%k3O-nOb6{4FD6Wx!cuyavryN+U9KM}GUD!`lW zI8yx+EYAUt1gGv}b5R1pe2@AkI05OgYV>SlMeeYs>nWH0M_EgZwjvl`G@g+6Thpn8QGZadA&JXqUd zx4La;6Ktu9+xt;p+gXe_a}Xo5fGX5e%RS*=*h{nCn_a39r?rqI^XAtHI=W8HcaR9~ zk}D)jAz4S$G684?K<4#R@PY9f8t>vb@$sTKad+E~6AwBVR(B?vS7lX!;=yhBTkZ)W zpyf?fo+2a_EG;5&8xjW_dZ+*mEEg#;9N>&F#j)8YGrtXf6Mo=dH{nM!mikRmcZK`< zLBqn2C(a7U$*mf|6zvsQ*i7eV!< z6YvFAx>ivNWVS|al&y9^azT_FBZeRJH3lVB(b_JKkgL0D;Z@u}#CvZ6icZGpA*F{K zZrja@cl>IZqEfajwz~XU+1o>9-t0uqx&oR_mJ*1eycWYn5w**G+mG`8I4Xl)E=7!V zSUlg*_AkfiI$R-~j(8`Th#DRQQvn-j`06dUS<#l)1XIUMrmYfVbQCvOXh5ha~$B-46ff<`isuf6>?tN!~mG3vm~ zYe@JQ*r=l-Rb@7YPjlO>v0NSar2H%JCcMX5e9_y!Ix+f zE<`ufC#2HNhnrtxJe%sj)3{_7I4IOPRnBDwu};hwja(J(!oa?K;Cc6bbXm58XBpur zqx|Lr#Oaq=%C!K@HPD>V3%t{(17DD;lsDn9n%u0})QHLB&*&MN*D1Aq&_;$4&y`G6 zKAevAYxq3}^+L7#g+#Tpo~5K!b8fN-X^T{o)(2vCyvB?s*LW(f;%7)kYf^^0I;&Ej zGIR)(J+*+9uqQuMwSXgiLtji_zPl2Z_uCSfKh1NbF&Alw^61quS|;WD5=U$$lkip(ph$~sF$&l@>V#pMq`+X@ZEO9vYS7Jeq48<)1~>nOSvEN%{;W=EdmhusdS3_>bU=^F-9q>N3i~P$H8>KJP!N(**V+vD z*sr#wpRKno)wNg8H4;|4AOWqs%5u!9Q>9!{t1sCXIj*dWx4Ze9|3t$9 zi}bwUZ}rQfbUy($F(RB|^YYA#BVlebgbBrdQ_>Nb7*e8GiI>Sx#waVGzH zB1)tWQIL7q%7)`qZzlT7A`tLD@ayvHs4s&~aC$C8cgwspO66Uv_vB4`8+n|Zzi0>D zvzG+LRdf8Ck-C8MHdXYmJ|KZmx;M^4(1mBeM3zaoct0|hPi$6fOWf?t{8gIkm82Ka z(7Zt=Smp`Lk&`ty%t`ddmKG=q3e6fjm#OmWyxy)qF5d=fu2mvVqxd*yG+DJ3Q*SuC zX2#I4Yq$frV6w)@cQ>YGR40?F*TiV_I*(KZ4)$UW-r9T|OzC!zrHG&pFwI=TfvlF2 z5GcKFlZv#3N1D#SBstvHJ3BJBdzVXxlaQUx+g3bMG~w~F68Ejs%dcNe{p#B0SItV{ zq=HmyFgR`sQ-bLM%BL-P&v^WYeCbQLD>V&=8Rbhwa39gICMCGCvhRPnG=|9BOvVmLln!{Csdc(b& zj}z8TP2d%L3}wxIq3IRaz?F;%4oP>^{h_Pmw#Y@b4_uU}kC2y2VN7bS)KWNV=e!0H zRBm!dZJ^zSR7blW)zQ(Toer!MX$J;$+#eS!5&?qC1Q+k#ejjwzW$u5oQG_{s8?B36 zK(L0O+IIz}4Bkq3m*D5+85maZ{mI2vphqMfvyX?y;85e=J|^Nz^68Yv7L(1C+I|AC zr69|}08E8?D8mWUEs`+&OfuV*Work57;+}G{S(cXr!x>5g)h!=(wN*!(C(vA@Jh-dS62Y;O~d_60?y>(<=RIjsHOlZWi*gV!>^22Yv$!GP}O< zg_T=D?tg}Px(No!itG;?hdAd~a61J-E-n5NKQ$6JGyAx1e%F^0W?K(2S;d6oYt+zo z7cfelSG|xsV)wD{RquAlfm@X~y&Js7)8C^P?Tg^p71c|GvD4~!x~ZZfc@%WNd)E$L zpTd7)w9(Q%N`XCKb&I^uxBME#jPva*hdds>lg)P{V#_6pIUaQ7eZ?zS(^;{}Kbpx-g8f;Z8i}t%7Yx*Ub@Urh2*E|= z;Cm~HcWL5|&9#OAKtR90@$f~|AnTW)c6o?!;4x&(eG|R$<)zHG6mp69%pg?1gsnWB zzwnuO#$?=LOLy{wVr4H~Ga`T(gP$c;i=x=i#bLsO=XS)vY3gppMpjJ?Pkp9(XfT6s=9jqN zsnCT$t1p9*lzFGjI{2p>sZ-9~rk(791?vkRR!tM6Diwv3hB2Qozwb-k8X2KlXE5Th z9}I&FtU8P`*wbDKc$WsrwB<^bU`Mh-;`uv5kEo21U0JjCzC;R+3{HIs3#M&EqV{>+ z!m6eQC2^GkUR5W^8;7q2xpbc8PS;o&V%ZTIH<^``hW$;-8cdG-AP%=KmZ*Yc_XjM9 zp#3?I7CepNLq%l&{fq8J&^-^1x3_=)`TsuH4c^M@NB`gdyW0+)bYBD)Z{fr3-JR`S z_;WXC?QZWL;3qp<3P;P-dbyEDS2eW-naoWFXp;fjWPsK)er}q;9c^v!_cDUbhofKK zfVg~Aq5h0(b}F++nT?4h4%pAMioSf56}55rUz#5huX)y{X6Dm!w4NLt z)`#7s6LjBRoNwt^$arH8QoyD2qx*d~r3_MGkr8gppyYH$d3K5Xj>hf9LKHC{aRyHR~=k+!mXy=4+eHkZ|=65yX^VC|OSP{-y;=zxsg^dPruSs=&1&!c0V1)> zNl*?%3ICC3OA#6+e2Jo70Y*AOnFW0?l_(ucEvbh{g(&T3L;MT>s06R&GJ+dHZ9F6> z9J9hBd@mA&m&!1>%?8op#dm~c(Pgo*za`sWvy}5@9F;i*rjW5yU|F=JQFiqApZ|eq zCrrr~3QQ(TleSWH3n^_Ve7fGR zmFzoBB6uOsWs+o#NcK%w;aRyg4uFeFLPQ5;OB98;R?ObavlnXBiQ&u}s6P?O!xvk(mOa*^iv{!9*sb*Q`aic7ACT+;p);&ANEDOu= zI^^=kd)^8z!Q+A>)KvnN`21oAtmniRFx{uuhHh!jD}w@;ysu@+a-O z16da|O_)3|z4P(*;&ZrySMFQcJ?|DU`>#mnbet9h27Z;y6$Cao^a7c zmxzQn9m3AtRKYu6hlraCl4>v}p)O_R3m*6blFu~dQ7Q7u+4S;P>le0hHx zA`WDK7rMQZPKxj_ymP|hQG^Ki>#_PiDErK4ZoQ<-g3`B$_KtY6h%uI-o4Nhi=WD%9#@-o=h zn!dBW?4evTE1@!!Dqlb&l$a;`?M4#l@d-z@Fi6~%;S;I+ww35L)M6{(g&QlnTC;N;t&tFExzaAM~Vz3(qba-8&vEE$87_*(om z8jgp7E*-v#E+y?ct=Ho+5iuMP7j(oMu6Nx0eVE^T^tYa6qG0}mySf~@&y`*3E`Xb7 zM36-w_uvGR4#PXO{jCmpqu970HWZ=F@4#L5#w_2__8>3JB{0nS+(l*9A41;yE=d z-0fOr8$QJ#dVde@T^Y1K{S&EHUSTDzh*mju_(H6Z$A5BB($#fJ_%>WssG1}kCJb#A zK5|bRqm`60_fEI=Z!0aM4tPFSGM}&v;R;{V6U}iOI=L!rvM*6=hh_qfDhx6+PUKGW z7Jfl5jg?3wA3nbMz$_{X4oipA1eeILnmI(jR@_JBk$q}qou}0R5T*)H@TS|9rW^jI z9X5U&pJ_EV(;)%lx5}AnuIE&J3|_&Vn<6PuyapmnCCP^Ueu|19Ra!9`oW}G|BFI9) zvY0WVR`D>dbOv2h%s+v{o>&GRou>_6XCWA(>bq{eL4~*O1b6bAz22X0`u@kDdJQXMer0ZtkS|OdReX0AD?ao_{#pml0(k$+G#k&jqTDfve6qY zvr#fm#<92A*`jEo-j)tegEx5z6C6JZqoiGX8D~0L&L_pGJ|tQ_4yc{`F+gIZkrS{) zlng^rjo3(J*%Q@MmZ*@dvn>k1gQ(&MU_PS^B2sXeo+$TzmCN@TbGSK?1W9mee#DsK zj0g=PMlP^0Dv0#~dCXztClGh3x;eL#xtTB~j|fS%=3&h290jw=NF+uj=seG`hbcFH z&=bTz6j7b_$OgR{(VzmFotr;04_}_~z!8JMbC&sy_Eg*fM1tu9l3uP|V~w zxi^cpdYuNHQJ5mDaB``b5Gx}4%ZIQ_pXOOnbh?Ni=~537g#Gghq?ZaX4ZPtHE!=t@+DN2F z#iCQ>%I~O&As)u^Fku?9(ID!h9_1J=*79gH;lrDc$tpK~pS3eVIl0oMyq(a?{D#}H z>KQ&cEg~_vPRWCFJwp9kC3R@Ncz~}^B*}zPmogX?avWwI@S4JG7{KlHWKKyVhyb#@ z@|Lv-kZu~o%6ljSnCB&?j+o_LjdFiwnRIj>-hTfKw*}|!;64l;tY*WrLT$Nm_+XkY zzU{VeK68!=TBmdm^SzNZx0u_&+sq+?isK@9sq+5!QBYCnIvx3=hi}yd3VKyjboH?w zR!gAn=v$Ki;J)>dqOpTj4Rw-UbVnJayxP!9wZGT_qsV5aoGvU}0HvvcRZ zwklNM;|Z=)=}>Q!j~E%g^Jq^UfGDNMJNrk!|NM_onlRM)!GkxtrGY8$#$|Zo(nP~C zZ)S81&8?fC&rF8cVJ=+htWbo7dTJ1I%jbO8WTKdm&9M>4Q)VO!m27-iJ^1vm*a&mj zRH)C)I9oCfG*}j_wS17)3QpivT1jVLh=O1L{Z|+~X>RbzqM^W86~mf`ThBY2VBWnS z)YkPbIOz;qmCDY~)bwILW_8o?q7h6Mfgu)9qzd}Gl8ok6(q>2dMOV(03 zxCL3EoKhB}s0>gwLa$0CS|gV&Ts`au^xpm1r{D8entZ;5k<0H>*s@d2Yx=_ClcR(1 z5Q3HOz~v5JoT>cZ8`79w)%^VK#n~G@KPTBxmZ+P?iv!VBXti~OxIl!9w8j_txWF=| z`xQjQ1-8(fzusyG@48Q%H%hoN)PSXzPa*_X5qCBv>1ZOPk@sp-l%NnKg@vCOzjfvm zzK$z44L*#e{<+A*_ae6)g=*wcqlg1~XIa-CTthU(QW5CSz3HaYR2aIw#$p3GBlHiLg3BiQnlNUz4?YGu><`Mlu(jPe;L`M9j~|{6 zgkca^{L=V+b#i^__Sl2Mi{WrwLpksRS z>6f7OJ8d(uEHRs5FZRXw{$xR<{2T_`tNPX&o`b@ZSnc5iscCZtw-3(Tji! zeiHi{Tu)dx9zu5QMGB{jt|^TZ4P`bigVs~(I(vhf*rL*xx9T`wcfR?ZbrzDXHbHK) zL)Fe)6H#+FoD4(^-bbZn&UVVFPD@rT73!f3Xy75m0x!}LyvrX1xXUVQ!}_83le593 z^wGi2W6%3HxoJiO(1^o3Ah2I+HaN#cnp?M`9O8X0{r`Fm@3=*XZiD@U^&#KVXT*d~ z(BcCpZs(oO0+|>DX7842-%_dgn~ygiG)*dQS+pOkIsd2bo9}t^hNvc0p?>g^uq}je zNfpLLg)Nkj2wH_qE;}gXA)-`<{OJ~|Z0E{XSaUObmGwmue1{X$pqW;+H@y1Jpp?86 zuSMwAKd&`5)BZMkUP*7-1ZX}r=m|DMu{&K zBpi972lR$t!xGYuvT+fdW;pj=GVbd{?hn)~N)e&1s$dz0D}P!hhHRsAZ=a@J7BsoQ2rC6Z{atyH@1&*!UC%}A)d-zYEc{Xt~hO?<|y`e?575x1Go@>OD-vg)U za|NybK=$KeJls;1-G|^Fz8)vol@I64^6L9;-TW!LOe24ZS$z0A-5BBr@!bki9yeZ{1|ZL^`8MV=+AThrd?jB{6nvQJ(AUcbvwXOyw(l^2m=3$p#?Bf7(ffI1-B ziyyN*3Ev}_xE4=zo@Y24SN1-Ti-F&WaTZ<2TqT4Y3~L&>k;g=81Zo>gop|Dey5E=x zgoA(Xpe!*ucpZ@ph%L=MO?54}HGA{AuOfOiSKOm7)*1Gwge)?j5!Chh`(bv!cle#TUU__W0O-cnpa9e$^uy*n~kA^CV!c|dpx0Tj` zQ@qy-XMXhMW?R?Z>c&0TtjOA4q?hi?h+QX6P%)}v#9RH_u5nKMI{P-BpfOXGuS+XlJCN)yGSJvEo1b7)c3)I>Dc~E zZ%ehM#UKi7OUugM6}6sRe=)LedE;`bgn(}|K4&teRNTFc)2Z_HDdXh|Wg6IbsqQPb z&>mPOOXa& zbslx@wnK}6*acWy9n6`w%PGY{N_`3ZFENx_s>(AtXP0zQRQ=$YNeE3 z$PCB+u@h>k7#39dTz@{Dw=$Vv%hI{XR|el~y*;n8BzRRQCVrmeDs!jOs)d7R;+VH4 z-HLu$X*An85|%zD(Kv1T1Mk|n2*M6;bl&T55;gZzV{PtqAmuQo|H8H!d@%S&O2nzU znRopyXPCj(a6gELw~Tmr=b{~^5D-paUDFH9-4PGtDe4?*KxjKckcv510la9J9>hWKPWT6yPS_vG~}kD74C?KMs<`J9OIP*A_BYe~Go z4*3gij#L=Ox3$GRAKIZoCzR@TZmkX$K@}dsr-=9IcHeC2_TKPeWU^dAvdiddoNG+D znOuKyRE$^7kN>W|ou6^}st9p4civZKyXXs@fZ^T%>>QnVkHZ0V@-U!V?z^Pj-Fb^I z`J>gUNImgL_(FCUqDqe67QrU`R=8%MUnbmPKp_Xde%QmERXel=@;K4bu{2fjM6S|> zx`4U^tSE$_Oa@C21z$d z$BI0@kZ~G3xj;n~UH8(Y(bBEd+fA1s60jO$f~}N;Fe(*eM}#7NSv#ooHwFX@m~&iLmtAAm=o8oa&C zqnCeGM6py+Ch)Xke&&qlP-R_px)J_@FORXEDe{?8CznRI^_WEz>0N9Z)ugqYysFNk z#(IZPQGxa3X5qsYDXe5ZqMxEtB-}p4DJ*mxyly}wvt?j1gZteAJySn1Q8tDiDI$Mv z{+_3}Am-l&=6$we6xv0aF(%k1>l?%Mib8ghlk>1k5>04yaahN#~`%f-Zl0g+{F= zg#lg~uSOtsA)+aQcW;s1!t|us9BQt1LWF53j{OI)h_UG9nJk#In6*q-+V0&wn=SQe zLO$N7n8C{}>oK7oW*2xbWp|%F3swo^G9M=eyxu|180;S$9^#kcL1qm2C2~*rWhC!{ z4!p~&!#Vi1l4t4>&sOO$i$0bG*@hTyr3;tI*j4;=%aa<=!#m!me=_=hBHPaTp|?>h zGRNM6-a-YlWIhD&m3~pHt}laYp_#o(h(hc7cP&pGQcqFl!1^lWv?90KsGQvhp$;`Ch zpIoeLd%1Y0;89P};mB1^%GX8l(T{L9EHlbFNE4dP!#>yll?;N1DWM$n{_*1nyQ4(u zRU&Kp&X5HiJ2U2YovoI5gi?`}+PqbYTSOz^&QBAam`?)EJw&=Z|JyHe60{g#OQFm8 zi|;Xtkw|ec5sE)OUUoQ^&l`$L`Jb`C&Lw)9 znbCyl1O%ohoilMl4k*Qy21TiqvbOiItHb@)0!9(lR; zJXN;WA=yPsOCk)EEx9HoX4*=>ME%2IiBz9J$Xsd}!Ju^sD~&`<^p?Z$>BaDFjvt#5 zaFfJiV=*c;j?T!`Jp|uJ+YG6}6%nmYC#gs#MYKB9%IS&UE2kDDreK1-vF#-JTphvL zH%tP5BM~D|h5l(%xR|5y!g3?Xt0sU`tcSp6me)JBXkJVFJdu_;-zDbO`9Oo*B&%Wt zE2Y!h>Jp_m0r2q5hVWr19?rI>?J1PkGRa0*Gl1!GDf^Rtvbxgm*{f5nOKH@9VD?8z z%!>!Mq5S{ty<2Y^NtQ19R|36(fs8HMyi2MuLMDJk9rfQ-yGm8qk~XbHmGnADgg>2EK(7gePLT#+S%WPL;iB(H*ep_7vS-Wy3CRPeK+8sHud0bb1oAcQkrJ8oBJU;k zTg34;*b%tYC1gfArQFKwS4D^6y?viZ(pL&aYXW#`JMdyAQ(YN52ut9(bGD1HPu7GL zZ0rX7oV=iLGiOt|E!AlTZ?RSIGV z27zqV%cmFrJ=q^g8#-l>D5W#yu7CIOk^pm3J68OJY5d~uvKSVz23SfVObhWeasRO1 zx-b_v2u%Sj1aaa(7&mO`%AV=Z-mj&b^lO>XDy>8hix4lNM<=2BLv)aoy@t~rBU8CU z$emlR=T`j4bzyNYq_i{XoR)d7-iW2m=oi5^sXy1sWnN>9rwyX5u%r4I{012S7aEfY zI{J^AS8+fNDcZ04fw~;}jE30p0>Qcm=oS)bE8>kJ+w%%AemRzMjxubYGG$~$ER`_H z_hik9yH+))8jAvv*}`y9*)y#;nEI~=JPZ*O9k25~icAH9H{bp$PQ19Qb6TqS5-A?d6Aq%MU+J z!736|YZZc=mWVAbV3ml7pb;8L_MXzkw-JjC&O|R#QLFf4iPaJ>d78VcG91(mi;i;i zOUD_3u4*KK5J(DMJx<&mi%t?k)Tis4?%)cjue(gb_tLev%8}jRGDM`4J9t(B*%BN@ z$)U_`CeMy{>lSJRUxP2%nFxnBrHLekA zAA;x^Hb*bZJmMmL6o>fl!Yvk4 zY0NaX6{QApL*nc%G@Mg0L6!2ApqHpva1wU$ABIhogG`&FV~UZmuq2|7$^cPtee>fe zTWo$pNgcOM*CAqje`Dn3^g~YA2V1(Na26By$21*aKF2ie;9l4V`L3a{`kNPLX#}V< zUof!U15gOO$TdZF#1{VND2&yPxUa7v;y}qgCOu5YGLwQ7x3@oDEX?po;UXj=0;eaE z3T2^Mf}JIV2|P!g#vsCn7(%w;cTlUIwg7Ut3Suq5;KX#3bU*AE?>0)h8&CWH?zUTN zn}irQf@GiI5h5&r|9~K61>z)K9vz{&(-l%%Dxq9-9C4NE z%x^q}yCHQ|37a;HR6mDe7$;)LHiZj7#-#@>jr2y{b=lgv9-r~1E^ZB4+_s*d&Es|8 z4LnV+5lGY^pC?#f95;{@;SV7eR94rvszl+%Whp)m*%L{Lod_&!tLl4Ri0K9)lKwHI zEY3%i#1DS+*;u8Hyy>2;5z<7==U6bo!HSleOq$D;Q$E&YigYENam)8mn;i3CJGrH9 zNay_R_FQex)SZOpKeD|oTGb``D*Ohnod7gslyKHe5s>`M7HwI3Jnr8!=bZwUj6M1y z`PG^Y52nICN?y_szl-i(S@j8WHkyIu(d9zcU9iB5eBhMAGw-*4ymzInYj8C!Wv!ZRtTGK@*BPu**ACg23sG6 zUV$5P8pFl7KuDK`A)6(=D>nthBeGAHK-FABx=S0vo)CEb?@{_xkgcP!&s;>G+)sG# zat67qFn!_2AKxC%C93W6*YNiJQwaDf%AG_Uz3Dl6Y zt#?nmDbI#VvXpAvWHy&*rpss|JkXL@UEk7`f~o_{}%F6wyy{PU5DZ3zo~5#BE>RJJq~TOy!9V+>*@GvP2g4<{L? zEweyZSiN_5dClJ)AsHk z;H66)ST?gNy-KV(!>Hw?d&}SJ+jFD4@q$~4Dui=&JOvS`$2dP z2Vj8MqK_E3^X;=l(Z}=6%YrNWKwylUw;G@q*jglSZVJq)GVgA z(6q16_4T#fStG23-l!5XH>=lBY4-tbkR)DwsghogBW^P7d(wK&JpqHJ5-0OkR5EX6 zfa_YxZGv+GKjUK-BiaSpx2OG_+cS#SBY-1tJuA5_NqJZ&2oP@1VC0O3@-T^{S1gh{ zJA0vhvv!_yvjXZktGPWA_8IS0<_85`HnsZRvu=i1Q)MXElxJHOsgS!_DrBoRug4fL z91J~V3@6}o7RdPo1u8WMI40@hm>3mA^pbNqrcMoW;px)6q5F~4Of&XMpMispTv4-T z@uZUq#z1Url@%j}dbYq^1H;tjoLsU`k2$Eq@62a0 zOffnd(gc|ntLP(N_MFEKdQvY(H?{Vjl&xwpM_CY9&{v+GRD;U5uE{MVGQl3OlwU>7H0AMV#j|(HiYI1z7v_?{c?eqeZXH(kSRU5$j-gn(%68 z!h#y3F1}9$N3cX!F7%!+cw>}JdBFoqyL#MeEMZg7u&h;Ac}o_XmI8`dePdyJYZ(`f z-&KAb?OXb+PJ+2}_IR6gk=$=(%Ke?G-2ZvEwbwVQy(XnHmi+laq8UrxZi*~&DP*#>#cf;33r!6cyjOpZ-=68P{5GNKfC(mi1c)b(iTR?jPoeRWC!d$L_VWTt z213OJ2AJ`R;}?a$Q}-TAq_J&oZc$yWRk!apu)%L|IqKVi#H4_1A* zQ>pdMm(^JxnC^Wm$Q_VUJNIpR1JnP=UGtS#Sp`>CftAfVvz}(CwdWlJ>CdvlmCbax zl35j_k^&B>#EmM1%~DYQ+rbayWIAL5nql987%R})dtAk9YPyg3RdMyL2+t++nFDGv zgAr`dGU2n;5h(yJ*%b4)P(m3YB$9(5i86gUwH4g9SkmzfOOx@Tm_sk1R1!o11kc7# z(M4$q3~uJ95xf+@PW+@EbGZ}9K3E9-$i96Z!?y&SvS`1DJ+T~YER!@lfX5a@x;5E& z(Tc~#%2;`Bu((B5?1@ZUfmg0t`OO?@UDUVP}HEsIBz2R zdI~`j=1isj-7#;;57X#;8s{Y4$40qWJeN*XcjXzBX5Frq9sTzo%sj@~AX}Xmv#U!T z?wO7~MF5iNU)xb&ak6#F2Gp3$Eo|%b#eIuQL8EU2zhe@{M08z7@HQL1abqL^U<^k{ zJtr)# z#v;p%;VI`?;86(ty8O+NgcIIQbtae|as>}b4rZb~U%>ekum6klY z!$7w5rLe^kPLMC#BxXOM<|~-%nYQb){UDREJnWR7`Z*CuS4x1v5pir)N-b13(oh8L zMcXry5ij4AXh_}8qRvpvGKCZxNIY`U?*|SLwrvp&$L4=1D%RqAlOUS7U~K$XkPCi< zW{QuIKgtw5W%w*aaV~yE1WdiW{jg$u*o7L^y$s7)`?AUCE`>U8awEJDNkLl2Sd- zk*&7LrRUi{2*@&wECRJ~YCan>HxLyy`yb8%()Z!}2VnXC>6Cnk!cmkfpt`_WwUe2Q zyOU1Js_*oxjh!~@wd=e6om#VDwoTJ8b{cyPqg89~v|3fR(`y!f_2FfOeGOH9*3q}m zQp91-E*#`%Oj@}8k67cIk>nCC4i!b!K@D+93^t<_58}C^L{hFl)($xl1<4MnZIfWqf4Ni3!I5FlR{yAxdiKnWE`c&kaTI*^5#A5s zDS!L}jY1E3^Ll#Z;qy~qVtBKU8+zfvXF_wcsrsw>hxo$-&yE~dy@Q|6yy1Fp_QBFg z{`x8Pmy|NqdNrm|dhW+QH}T~F{)H#X`PEvx@u4X8{Z}({2<4>wWOA~wC|*M7M=beO z{3S#F_uPNz45!8A^$%A@{JzclkI|W??MdL3arTYj_KN zZoo}|3Uo`bz>}n&P3G8lxnU=HdYaVgP+?l$Ry0a^pzGD16{6~7_wT8!&mehAcrgvi< zuj0W|Gk8q6ua$V`^%Y_!9@ccCL%_+_Ywq%pk=LBr=1ko4#Si4L+u0_sUmw2NCTD;8 zsqAZfz+F4PaD)#SFrU1JQ9PgDNC1pE3S4v-xeZFS>{-w6+#+ZF!1Jp+IuJX2WXgXI z@@}-I0OWfw{DDjpaj@HDMBOlQQdrF~tiFpGCL-Y@?#v2*i|w{k+22PZk_ykm>0$1~ z^g-(P@Y=+lG6C#$12ZPW$W6+tN3s(}NQVx0Wy8G?k)~xDoJePJ=necnH-7L=CIrK7 z3dGi@L5O*pl{n+25O}ByH3~V5M|rNzp4n$ixoVLICZq43U6@_vK9FAZT?BXccH=4P zdH>b*(u24L!>qDLB@zeRDOTHg^qjf^-rRW=V||xwdLX$MqmM6hQis^{{TWTZ`zN^2 zviphoJaX%Cc5&`8cdbl?6gd#qxs_#}}EGgc+; ziygW1je9iEOmjly#p{EeR%7qU1bfWQ9AX1Ug7p*G9fFt1>~LV=fAy+r^px&NB9u;G z4$V8d`%seR<7G*g85cs59C)M2{v>2s8JGI@7tV@0Ho8gl5W>upNQ8g@7YhY$A=D9i zDF_BtOv&T4bE%(V0~*nchA2Y_%QP2>kmVndjM(~$Ub|6=?_KOn#eGwD!*WS%Im$-v zN$JQ;m4N956D$ZQ*?JCD*Xm>qc2eMhe}PSY`^5?vmh0IFpvJLmB=o%zmu*K?MV?%9 z+4Rx1Iuz*2Ke)W89A4}nFM-YruYh6_!Z9CwuX<xFxg!)=HMYIqMv31i3Cj97^&0XpoYJBLDTJ`0Eq?G>@JtMOkw$4U582Y@w6Le)-90$SoCPXLkt*T zpLsA5L{0)2TA~YAg3y#WaC&rtakbc=@sb=O6oiDxGr7Rx5I|M%gn$0!uM(n%Bbbea zuxlZ9PZm}PVz?oq#%gNP_)h^TT#42zk)9I$LhQv9(90zB;NL_3@^VI(+5xRUf2#f>&e+q8EG5=P>Qxeqn2~fS-0;a$ruK83!%_}T(cB#< zSsgj_X+PYs$dg#4RI)^~v-RjxhzOGIfP_Ov)Jlo#xyHjC6gJ$FkrP)AZqXbSzj%E> zcAJ?QkQ>&>)K-^K$Gy>3SAsK^0NSzP3>oPtFJ}}4xE2q-Y|7t>o|T94NO-czYH~O!}ZG{JY2HhGu`nY z8F*X>hOn1H>!&QJsED^CdT`|rayK4lkf?|N<90Gb{8x?5}5eCb4)(d+^;Yc;6838^rKThU6v{a&)l&LXFA& z+h5_m=^&BHMhWIM*$aG-ieHO$-f-98 zz6jqtETC5~We4%oWu2P<*ukD_5$RIV$z^@guDe5HS#A2xio;j1F#)#b&8uhy5Z@Sg$-izOJc<`xjO zcmn#`BVZM693c~tB^iU02>Xj-YSXYESluE@=teGrRSu~;5K+WwMKp#eu~v3lJ{10( z#`G+5`{joD=~{L1TZ&y7&N>Iv+SUMmm#(80jpS{3i~8`CUbIb)Tm$jGDwjj%Rg$pv1LSBqcPJk3Q+!cV0h;kS*D+x~$lLuDnyXJl2zY?*Q zq}2>bfEE*^(}j!T4XoKUDH$*y0TpZ}BA(nf1v93J?=YLM0yTt{ zeg_B+*0?QrgN59J|0fe_!^bxUCG93bO2l{&Kun;`5c_rjJMBk^c}eIEsnvI9zK4A& zd}hJ71Y9P(3=n04v|rX=?umqfXc9SgLMFPei;e>75L2Qs z!?`k}ub*Lgw_m<}zWw6fegPJ-LUCfSt%%D^AQQrF6MTFAU@gLMn2~KtuuOyTEDp!x z)90`twil!_+&%cPO(4(UYnaVJdyy>|TP9rmeA(S5KOg;!uTL*NPE$WZK7!{e8JMuu zV_+usGP{uM?WGcLWCeL8K-pZe*ramp)6ob{a3T3Os$RV-Zi1~7HX$F?aElU=vqpb% zB2KDdjz!e+NgyXQM&@xT-c-nOw(JFi5AZmp|r0#iOS}>-LLM+lKH3iTW&F3fy#)^{0In zUfm&Z>aK*L1r)Xvz9ySJtFGjdu>jOov*ykX#izZ1Z@Z$S1HTdQRAL=C)>ICdY~+dc zNIe)%F>DtcPfOjwc4Wyz7bs*XIN|UzMsxAvl)mB*#O;5^M9_`Qwx_vw$87xR^*m_` zK_QDKf*U|78&A8Dg=}a7N4hM&2vE85IcV`FuWO39-N-eXZpB7PR%6A2Q~R57?Gd+@==gx^Ev;CF=oGowb8%7L|t`F6{8LY{nl zc50PNnlGC_N?bvG^6`Ab93^Ltg1pQpiN68W2`5UNKhh&f6zl@(EvnA`ZoP=m@|89n zupa2BQ;mEZz7A?igvtZ4rbaPg?wDd-hpA5*f51B%md@fJKobw9|O`jV`_3b&gy>uIkmQe^o3m=AgN@BJ^ zdmA!0L?kU{!oCWpH#R-40L#39ud=jb0{KShtSO(>)Pb+&fPSpsGx9YLhXf32&*0)C zlZI4Gr*nAUguqGDPo|EHOEMs-C00?mlN>PtqP-s^m<$6=5m@@E2AyznHX+ zZ^N%#8uEVZCQ1J|MaJY2=-W+yXFlZMs`uky2@=18UlJ{j;R_RNC5DAq!nv@>wNMC| z5P?_BMRCAC|MFLbXq>X#ZJM%~rG+$v_frv*sh1byI^){QIy}f!Pf|uwh|T((1+{bE zb-&;5$tc1@m-e@o$_CjOMo-z%ZeRMLA^bIRLz)B@SIoz<)TCh?9ysqvCmNHsRi>&AY$WcM~3l zn#F%+!N8``0uc{*b>C<8tVlvF1tNwWyedftufjTIi6r#bGs7%ceb%5F+GCkaG{|a- zq;|}=9?Sf8a!GsCML%(RhBNcimpn7uEDIwP5{1ikFbVPD#%QxUnTiSh+^g5yd%fNM zZmZR9_V@Po40EsFG-`dL$69Qs)!MB!`wgRr;E=39m`2}(lT7)Q#d?>x|DA82MXy1V zTAYNmXM31rZt^Q0Qd{M(`4aL?1aZ=FJu8*LY$j{MO&3m~Qs(we97pfDlRdmXmEOZ$z*S=p)k{twl-Fn2(HUk$g75GOc$2qS-3h7nnPV z&Lt!lw7vb61d%H#+nXlsW4Fd_a&q_@-xpmPMSdpc-H}Ajq{C$@>=@<>_$`^_^_Hmk z2$@Sv?C?o%WCAu!enMsK$0BBR(@YvO=7fdJpTah#55LS;Uhtb#-3aCzgP^|4zl)2T z4&~Pq(UE+A8>VeyKDr3PB`LW{5ef$LaC+0~i1}=C5rl-FV3MRE!n`gDwLoOA-vMn* z=5%j6#_u7XSKHfN7`J=!`>(E7Ezb95womJ`o64D9*%gfPEn!9}xWRelv{d$6_f4l! zY1K;6+NN36-1JB^FsWDXEN(UYD_RZa67X4h*i3VvTlUG>tybM**{nb-4V!HQ+FCPOqdal^jX+ytK0^)dRcTmlBh=QL**1)}VYKI9w3DOKaN6ef zTvtBZKSe%!ey`|4Hq)G}E!Xw~3Ai&7!HmG6ws_IUG$$I6v%@*o94x50cZ6IT@mxmwk!xTkr{X>~X8z=Q$oxBX)f*06j%iWfIOdkdXwRS8oi&>z z>1G>KZtiB1r81kcK}Ac%-oj0@Vet)%uPuu=$|J(RKbw8S-9-!VS~*yIM}NU?qqdVJ zxU)&~n8f^lq0Z=EAMyPhXrIlhW(Y7ONV~STxyioQvwm=KK(=N8*rS`swIgd06nGKF z*b>(Ky)@Q2J1mKUQUL5itx>O*SZIAeELI9+k7iACnY3cDJ6h29%VPM?y``hI`O?wZ zqQdsHsBlDm&!&}tT9|lV5!YqqchrnNrl{~-j7_?70G>c$zwG4~5+18kHX?~4ijPt~ zQUq}R!t%LAnC1Hsnb0xCb}IObba5HNjH)3l_^v}mBcLG*=tvOa#`A6L%iu-?b`5dO zWp|7o*8YsgEW{e30H$Lj>Uz4oOoAR#P<`&N0NYdqJ>mUV*Q-_$1S)Z<6!lV80Ucur zARKs<77hy$Vf6XCm}g!pZwv-CcNG{ocnd zo0KI+ObH6YNqNc{)9l+8h<$stGW)wm@{GL~d|dw@wH;*RUB$;fe7O6FV=6mnc=qL=dogldOe3NvI z;R0m;5}iH63*<#oyW?Eiu<|`d^*(6+^$PmMD`hI7t!Ym0OE*iYHL`-E+4R!f|LyzC zZr~xRU?Qy`z!-X7iS)vNX0y;h@2+x2GKtk=v&uSd;(yH=~#oBbY*;a?w&$2|ta zHSVB#8B^u!-=|~|ed!P3)mShgSe3G%As`h@zggU=e(`dv)8z_4&WhTOO1vG<5POt> zrgv7HBk=e=#LvE?4q0W5lVxJSEn!|Ik3_v$#y&38!3xL-ZSA% zy-l{`Cfjk7?O62GHrbBLWQx{10^~|o=_1#pORnutHSk1DyPIb3tHdwpC z_S*H`y+)B~R)+{j^zAcu$QiS!%Wo7ofK0VI`eYym5Q7i#1rHpNX?67T;!LaiXQ;2Q zcAIoWgVw|ge===|8}Q$8fHQe|rk(ch>7`vy!CqMGQ{~%drYK%SsT8Dl@WHt7G$B)g1TB4W{@Z+Emic8DANsg!+4r#<%*aaGl>P3M~I0FBM%j49uCPxw^KPk zIq3ek8X4DK76308&vDrs^oCAAzbzHdJSNRccR5v}@XYG<1KvYr{f7rF8aHy}3vQ3? zL@ibnfe+uB@td`3E3vGSUp>q(*(eSs`j2m)1yn6LPCFiNf4$>qSzlQSSDZx-iEiQ0*wLIJI7u?uuFZAsu@4vcUHQ(;B??t0h*;OFU!zd#;f7u54 zIX1J}CIK@>@WS8Z4(F#^tF7qPYH#S4pKgs^#c%LpL$~~NYt?I#Zt!A5x4ct3sni<{ zLAMZISR16Vsn8@lDETUx$t=$3bCB0-^f7j|evuMB$CTdmq17_SY*?ty0da0teHb;Dwh zA{ZuwZ3y-Vg28QBu6((&6RcfpK7SM2RVLVOZEtfVb55<_H-~H^^dCvEjnIE2!8Stw zkp$Za{YMgP1%*ETbAQq0Jbr!pv)!y*nMSJU?&qCWwXs`m8@qcAx@*?<8oN97n$f7$ zn!OgS*Jy9AU)yQN&wDU;<}pQ=XDpysi%jT9w3JretYIV=bDIpfZ*t<KDW z4iKhYiF(0+VyU4_+l<6lSja6Figk!oA?EWJDtQY=gLnV=m%n1_aa@i_xD6kPV%d@J zg`VZvqKMFBWb5`f-^FYrmt3B9Uv;~uF9?iI`m@I~zQg1>h1N^C?M?%a^^KCiB@3oo{*}4;Vd=D08 z=q>LqC?z)K0|kOhn9<4Cf56U#Ds!>C3P)y1c7XvTDxSR{M9cOhj; zghi5}aXxi6@xbLgevRGdw~;o-Z*%-M$FEc%mYd_ZIey>I@jHRzSF1n2zkVU3)e3~R z+s!I)*>KzQaa&oeoDH|FJGbqhc215OWXoa`X8w6dgCTJ|lRZBK%R+q1w&nt8xmeF- zq^~-=Zj(L@Lc+$(pIi@_&o(@{be`-Sbt?xT1xvw$jRIPbG@E;OaD-Mz)h)2XxUrjs zQLs6G&v*WgOLP7-gJ8_E+a2to4ZA)2I?p|OQfpLO72vyau$*SVk;@??=|y5d7NhVL zIva&IK=In}*OF^_H8I>eEA z*zJ(5BU2QkZj&Rk+1xFMN4v43U!&NqX11hSHnWttjNxa+Dbvd3Z4y^~mxNz-_412c z@rGNTBvuXtvncpAg(fDzu}Z=#njHnI8(h28-QY^hFW6JyqKl0My5;a|HVZIkcdNB5 z2;~iXWU@!M=(ZCZF8Q5Kk7aX-xN@jF5lu@1ep8anjHc$qpq0359@D5~fjg_2*|@V+ zO*L+es2fI3CGcEP+E@AZnfK94;jl^&f?*H8dlUfsV;o&4a&XdBgOhK6iw7s&^xzAq zQHTdDo={AUbO|S@V}Ck$F^j%FGq2wtZfI)GcR*IJ)T>WV0MXq=xLH6KVMH~0@&cFI zZKA0;_^YV#bm;iUP-8|opp$dH`zRddh~Rg&NiQO)ug6_d{KQ^^6u-Ilg=40`>?)}y5KXYu0IXms$PYZGD3fT;6o~4Go=kpNj`lp}*u1&vv zb|{(L{^o|v(cLAasoAXrcRTBQpGa`~#TVh8Opj!lrN3q$%E8e0P*fyzd7eNR_OC;% zjLGd6OW;IIzW&1yNEZ?{LZC&sAfkg18&$gwvqC0B^+_5YBZSY1=ZDmhGR~w@?8BvS z`y~i{bqknmY_m|t+)zCe7#*V_buq4HviL&qY%>DchfkRTa`Zq<=5JZls?Mp<>Cb9e z>UBG%UNfs=Rzf-s_ylK|SBb7Y##d;O!ym|HGDhYCXYGJgSbG3h@3+sDdJ$^=v3T}# z>F_@){UGUpgepV|^hFsKrn*SCI^CbTFG%ZUH9k7GU&xT&eEo+n_{O)GyNw@XUmc2| zCJ6t6Kr#xXWP%+XMOQ48u;O#(3Q!i4-|(0t$4vIM!>-cewt`n*KeL!ql^6y#g?YUs z`;i;D#APP@L<|mR3FhL!gi%}i&1VFsO)NSJ5LE>k-IJZU1fGpJE7T5|@6wR>GUjOj3CYryF-s5J#QLLQIJ1aZhm)W7{zoKJNUOm0~e zm;m!H-1yXh!VQxOVE`qu1*%aV#(q>+&t^^ zFz(}#7E1a=$U(;tgqgxHrM?f(FyIN8Tk|XImIQ2iC~u`ir1>$;2G;FwmXOM>K)OPG zf|8fl%(g3*>s`Ck&$bi2VM^0M(oruE%qVzfNG(gs-vHQlgfa=|o4{)!vjXKnK*l0e zP`4-Ph{ma$1*?oau=0qqpSbE!3tX#2zfC6;&hn7Kg%q&3fh|5OU`7O5{p4l%2~1%x zm?%b%zI_hC5VTikv%dZvWw*g&%~7GFO;OfhVcTjS@L-DN4?&E9N(jeU?lNMNB|kt7 zGP$W^8Da@UF*n`#@;~4{v+$%u0tJo-;--sb$OLy6Z)P9Q2)qGIF@eLu=ca3UZsVisotfN#xA$fz706~e(VM(vozUVanZ?T8Ty-xfou z>nk+^EW)!rbL$Vdp0Iwhi z6cEq#98f7>Lwev*RHM+(m{Qp!Nm1ic z_f_hoNf{(__JQK4jB$8hHB7#HVn8*VZM&UnhhB_!t)G-%|86pBD*=K81kHfrp++|W z99N)&MJFz`@C#DinyRZIlg5VB!jf}7btD9fi9$}i(FABF@sDM5a><~Q#>k>6M-_++ z#7L$Ir%qLt5Pd&fdXatf;^35$;qfPEX%(Z}>EDdo|GaT|$n5yIg8T(D6dmETC-mNV zO5c9LEi)rGZJ7$IHUJq9EG@ZIu{v&5@<=fNZnN|`20X0<3S%?gO%{gYYMgp01thfx zHTi`aWei$E7Hlilv0Pm$r^|GSiwE8ow~TVQC0Ci!{o&e|W`XBMfv`d1*+?lf^&88e{bCgeW}IkB-#!b) z0q3Y$N7&J?BQT7~hiG28vG78LCw94;l%)7p8En*@^%tguw57E4*|3Kujz!WQ8dNqCB~HQJa|!(~MQSjDUx&$Df;iIz z9*ygea#Q(Q`I_ty@^R_{B0~B&^AEIK139K zk?Vi{<-Z>BZS;4g7q09ukdJ*3Vh)e}OmNa|HbE~H-hD_B6U}co_2z^-puYoOTB;9% z8$ZUKe~b)qsMvS%9QiIj=26T2zY8LyNCBALQ<=PFJt8((2F6aLEH_Xk7WOXYB}AZL zx(TQ9l$5rxgNQ>D11+&=;t0*6m z;Jdoxg~l48W7fj=R0|XgWLUSq0gt0I9aIV-tWBl)iv}bw(c@0xSOrtn#z*(EbU1=B z;yFF4-U}!V@yb+hy$~%&m^~2o91|9uG&w{|m6U`+lUNORL}BN^z8MUH?UZdYq!^T$ z2p2Rg3(h=D7e{?T(gaQ8v{#(lPmb(g3()JJw7bCJbpYk?mPEQkawk#<&@vxraRH zg`NWjx0U#sOrflYsOpHL5@*(8`E@jlaWK19n5<1>6)je_C|ac>AcR`{^w`Ka?9@-7 zh$IvMwnA6MokJ*chg@4Zr{?m~;L!dmx*?5Ko*IU)MBGyTX<;NLvATs$Dzkj%_)1BY zsZJY+0P^T}DwU;=z3l3Xy=czbmZtLM&}TFxXQ=RVcR&t?_-A*>SePT4QU%vfYRcDGJw~Oh#H{r0{1xa*}q3DuKK$kxQb^x0AFkzr)Qp67-v@pWp6^Kj%8;_l zcmPwxY%uXL8Yrne5-`)j&ci7OsK(rE6Hw5@zR>M&(D{zKGryfy)C?hK z_vPSgLe391dYZ7>VLUM{Z=8>&nzNBSISJDnuL)J({@afy9njV=!Pocl(NuGtvqSk! zWYHoB`s#YQs1xr%?FvXYf@K7tGUTGJ=DO*tK#jg840~jA(xueQM@-EI@#QdbP3CvK zRT8QT38UE#w5(vrLmmvXYJZo_Ivv;a*)JY(5=stHk288?rGLI4Zx#KBf7@z^-P)XKeOh=r!Tmcg$zbgzS6nV0aA#Js5iV z9K5@lO`j_<5d(%_A<8Z!jBd-tr+iQehMqeqv7Uax4TJioN4nhSgD4*hX|`p2ZUkcV zb(DUWoV`YgrXO; zFMN_dV>z#7-Mx>*1jP7HN7XFJ6{6X2ajvL4s2E<4+7IV0KBK%_xOUA(h5@I{=FHzK zb1Q)phS@bAUy_eBr>kI3v*BP}U&GKVbZ#=0T2B-yb%)G%avBMHnvI0300*!1ug!oN zPbTYQD*RqO;=6gUkM}ey_*fqvf|5U4mw3@zci@o=8s+s%?`bv+IE-KM#rW%}@E&sC zA|F|pH;r>ovo&G**JAKB;np(`Bog^I?z#Ew`#sIpgM;H&=!kQFT?D{64Sh@#IlP|a zQcqBWZ`pcqyR=7&6tGLs6Iw#k|;jgUJ-#FSX_ zQnRLbaY`-pi(9C`M-l-In$4z_Ou zT6-?UrP(AF}VWFffKL<7U37O{=EaNa*?4NoyVTyQ47$?HRiTgT|jL3A9zyY-(VgpBjHn z__h-QQJJs1d3vj+JN6LL;LbG5bw^42L;1DxaA#e2eTGr3_HNdMF%Lb&U;Fonk&Cy- zZ;mc6KjfpSW&_0MgCSUQp1F<^^@&9ws&Jih18-h zTM8XhpM^v6hD}(`3ske2F@(c5W`5|cQiZ@m!srfOj7Hqf1WH@hN}IZM{AkQAO8t<# zrH<8rHAL-vr=+P_ZI?r@qX0UjE@$@nkmk)6YiicuJE2X3Hz0*T2(6F^%9_nJ2oCa^ z`WQ#ZM^nw}J5Hc4$6phYc3{e&tW!{$uh=+WaHgqQVFz7Z4ZkKtJ*SaP&Wr=<=5vNL zH7okqt}9?8x}K_CHz$g2tEt(d=+dhzYMy(MzxuYN?!JzGFB^Sj*++7pxy;F6lyzs=jd4Hn-Mlp%E!{QQ zyK?Xq;@E{`(QLPvfib+M{>@&Qi>wYNJ?2+BqfwU``Itwu36h?`sxy#gOX8CE8a~gA z|CLG*?eoxOLGTgu%6zP(*+%He@vmY072>2!5kei#+@6=KFyoPK`cN$ZmMqfwWZr^93q458+B4bDx>!Bp+dQH{^i-;xtxO=q;p?X3OP_ zS}yG#eOU7OT)0%-<=@n|ZkX@YtMx2HZP{n%lv5|yanaoY90xx1de~hQj?J1#qSrnJ zq8&1q=kpBcZux!1Odc3vA$>)ct$2M1LyvSLJEw<0ci(Rhh7WM`6=KzebkW`RoBFm* zuiLx3trCkliLOB2c|+=wH=gaV{*~wF3&-ki|4oN5K3^ALfD6j%PkT(yYRZ@x}0KaySJjH@RSg z0nh7P)7{e>?+4FUGguR{cB2Ued$a5FF;=DIEd0~mF+32nXjNNTcoe0UeA%X=Z;^8^ zw|`xCqjAg*^4x2-E~yzE{|Z!}Q|jc!MAF@9oZ4dSH6iEm?f-`@c=mn9$2=cOq3%ZI z1Fz?YgB7CZLZWCkNBXu`>DgISDV3BvjyPCP5$HRIxBt6uV}WBnUeaun4B~lI)}^H3 z(u?|VFgqNMX-=AIwn{=Vg9;ThSQDzAFpjuDo@d%DU#*DlR^kCOBJ7D}vUN!k?{e48 ztK{f5c)WgiO?@V(u&Qe0LP}{iW4P^&f$K_aJgdHv`wTH_a;kWmEt1P2JEV~t+ALTX zJ@1_t^|(vk(O!?{YwX?D-Prp|OkqvvIf+O=y5gRd%VuutZUe5yo)pq^XW7am`^1bZ zFUaMCZR_qe9uK}IeA=gxh_e*U2eK;LN0iZaX%+TbtBvQ zSAo)Z)`Y0XwC8h%HDUh0NBQ*ew(j2N$Gu6by^hlK&}Y{o#n-;cM_A2Haadm*X4}7wrQ9bY`?9$5xMV;T(6KW#LE^z z=R5Or%^9`BTwcMp?l$BOwHt*5?4D83 z>24%`MsL`M{^ih%2E%aK*w&d=0m4(zfV`%5&cmqLDxj{(`!M)AO1pPh@SBUMnhk?1 z82A%&8NXQ$u4W+~w}o%2tmpB$95^fcswEE%R0Rj=JQ~GptYfm`FRat!v`oD=vR@xAh+L z5qAR$=d0Pss&-%6dNnKCBcD&G8w?{Wa;V?f+sV7;W$QxkX-K-%!X`uc0wvn}Xsf|j z=m2HSW}m@@;=r}`=JtO@Jv%4NL|bRib8R%n$QX zQ8(c1n44ZSu#3U8T($`94jJ|^3(g~dl#@-hx9T1WjMZQyrm#Znx{x@!(~%73N4D)% zjENETc$T@k>=XKiA+!oP@+Y6jIl{%WfE<7lWDN6VbLeidJ!CMG(YinizV(^Q2x7z7 zIZYGYy|p>cpkA*PQtz~EIrz?V>5%+VIm<^{&9=?uapjU3L%vGVFKaf3Lr}-B$UYtV zUcUC6ZQaeddvfeGA?Q2S$L1SX<9x6oZQaejuUOxa!>|o~(yr5k%NdclO>%j3cGkJb$5fi_lS>Ex?_$+CN_WvVs8PN*$t<>6wm9l~L(-+8 zm(N+Cz3;a-3~=xjXB^$VzI`_Ed)%DNJD)&tQefx{x-S75#UVJM7qV*v&EZ4NkkIOjFj~FZ(BI zoBWuE)!f}Ymo1q1HN{@Sc~6jLZJP%}?|N;z82`jw&m3SQDb2 zurYVZ3D4K)sja)$wiq5qUmEa?Ndq>(i+5oO_{9 zj&1(!|93gN=0-jw2i=XPM+2MRs0pm9G|HOVB{f+T+>no$41_Ia^HEu|eGtl7T*s4G z6CQp~1MU-QQSzSVELqpxqZ*rYu9i?(NEO|1LM#lyB&PUpR%Xw#8R(RP!TyHkZJg59 z-FOoFi*4=CR9St1rvMyW#nb1kgK9wCma!Hqu zsY!#ps-9-$KV)=FT^_6w3uVpbmnew(aD8h7@sZ$NA`~ z9fpW|_PRI%u;4U*Kcu$qzR@9fMq>2cED()VBIq&2B%2GGt6g+kce`jYIt-qPNwTu~ zqT}Ukf!o&IV%lU5M@QhAFzFd4l48qJgaOS(Pt9hHoPZdAO-Op|Q>Pc%{aobK-S!&B z1{3Cnu1jq9o#$iT=Q+3Xv8V2i*9I&jf?Fw|KI_p!@`IKwOW#q<^0@GFXI|-UeSL)! zsBm}81MaPhxwy|js^)cO=x&rQ*BZ2V^3-;1v#2E zn~y^t3h<6o+RJ(DHCs>DI0MA)uwe%4C|El-`$UfE#Lb!KrMoFNh4I&fTVEqaJQ<4) zv&_vI57XVgyN{EAIoM(fD@56a#L;XQU9rd?WKv~mE7feVfPU|tF*|qLjHQbq1uB0M z`C+~UCEdNQ>7-)O$qF5qtl3<84!MMvp6BN)J=Wdm8YU2rza}L0Y?C-Sqtv>)T$^mn ze7a8V91punxwl_@KFI0I)!ii9!CCm>TBSzo?uZ?PoM(33TsA9lx9wLjwjMuS@s1 zed_n9Pf?GfpvvXb;&ycRvhD?9_;r+`7tFo=-{gWtIkO#hba%7vz^m@6mpts~?n!OH zwM`9c#O*S79=e1_=Hwd9HUs|DuN&(U+kF!aa$!5~=!q=6R&E874pYib`oA=CD4 zk4-4c=b_rs-CDZqIn3pBU9MwL7A;~j&=#+9YB!qg88Bxolld^bvWM4%uot3bQZ9;W zHfKiM@P<(#SmaBfqwM2M4quYX$j_}V>ISb8lQ2UugS8Z`+_uTVkcLC*Dl=Ep66L8TaR259)jDpQ>!U9K_F!q6NnXX^Wu+xs8)~m+Vws7 zSiN=bE4eiKys5Z|peYaNv!J!BL__XX>#YR-f`_V7m`?A{;$z{bo~!`}P# zT5bA$ll5t2#|+)~ym0YPnhS@x|ND*mhPZ!L)#*?A+z%d}Q+@FdMuYARd@%guA8PI0 zrg-W#ysqt4tI0Ru9wxYHVdy#VSyO&Z4h35WcLe-7h(htF_)N|_`3w*I^oKql3{!uG z-YEVQcUjYCd0001YZ*pWWUvgz^b1!6X zV|8t1ZgehqZEP-bWo&cRU0ajeHnRRJDf{J|2Z-WT($;2Ev$m6X*G^`wNwRfbR3Hh7 zkVt?FfYNAw{b^7$7RL(-vJ$U*bE%O;3H%yt^bOsOKYw@M)Zc8G(p-vfUxcIai*J}H zWXZ+q+ZVsweNUz@zWd9cKd_n__=c`{tG|Jt2>tDg%9!>~L7TMam_~wqP6*J$y_;_&yYdFMeqh27Y@)kR1{97Y>)hFFzI12x$hqIT=pH z-#_;(4+41`oqa{<16ZgkKJPdmhKsf#sLHwUa5Ppgv`cET> zp0myun1jQxrxC=TBKX7Sz=t6D6u}?PiKh_!ad+SiXz8P}8ZcJFN=}3R!%=H>>X!pi z!APp+Vslj7;~|T~Ei~LC=em;ZQr?e1Py~4`SHW6KLAZcPf*UKE^O~DI*><&fddIE2 zJB;*RmH_z8J$zfxFDm5zouD`!|2si&3mCIv%xEx8K=#TV)op)|x1wbCH}hZTqssI= z_4O%;qR*mWa4ERyK*b5ei~bIaSN76kZm;#^y`;~s6Dmr=l#+@xOlx3J6pt_(F8C`Z zKq~&=rXK@!;q3DmbV%K+N=gmZ+yWll;+Ou_oE4pdwYd04$8>*RoK#2I^;CoP2sb*C zdMj&Q>~Yc=|Bk1tq}F844O@I*|FVyB@jZNpDWF)ftzEZBd3tue#OjG&^hD1K#arvF zU?(@qeg`wFeQV@O(YE5nVs4}Yv5S(*S$s8-uYZ2O$f;)K;-B+5_NO_UT~8;omuZb! z-%PKk&x#*u7PnOEom3@G`oin^^sQ(+v-lMrV2SquM$z>uw(;fY*G=DXK7w~M!8&5HghA{RJubUnwuldF~0kT~hO-fn-Q>sMLOysN3g zY2L-*^=t7xNYTZO)_f)G4N=k;#n)RlKU?1`LP=IQonB4WN9BjvR*SOh`O-_^%l7db zq@n;otO%`F;AESsK@l&A$Jbjpw@MmmU`Xp!*4=-D`UvCe$^GzVes}bvF;W+e)2peQ zGi~=+7w@S6K1M5K!{~ZxbXRd$skc$W&VQZP(Hl3uTA z?kZ(zwD4=J#!xi5o{#So6}pwmEZ)&QQ^*(W?D_}!3tRLwWcuLVK|P) z2^R29x7BJGzGXI3!g9MEyM~d4W;)3CMAIM{jRO?$GnYA`RWTA=o6$;cgSN}-$2~tC zl*~|G1N#Ki@tC9&(tZZOx!+p1!PZPkH!%q zs_)F~iA^0U8@QHJe^Cb8*1IAaFEO@6=cn*IaC`3Xt zp12(H)A%PrYrq9WBs!Dmv!u^t5-3cPCvz#S9UC>=DAo^)0_McEOrOClsi8s1U}g`2 zzaR`FG-1kk;##I2{LvHo^VkjND2 z^Ee4@TNHc!QRu#w!vi4XUBBe zuZ#W~c|XmLd1zm^zTq0apH7a6f?rqWT*EmQ{Yya`Ml`FJ#O8#9kzFul_|k6FgFn%s zNYjg48%&pwH^G7a8f$bm&TuRY*JhI+{h-wL>!Npr2K?wFESz(V88;j3_k3OS*O+m$ z1c?!vT%!jDF< zk!#EFNNXb>cwN(ecqYg%b4#-heq(v?BK&hPSq5P(QML z7rf)zEaY;rcge4BFm&-S#XFUuwxqN$Z+Z zkkyFx?i@;f#mxv*q+oSFZrkN>+a`b?cK5;Ig8fclq}tND)Q2l0`;kp`hCko&^4n=R zW!ZR=rxP#=V6n`mQBu+}i|H&YB1W@33Uj(d5iU$!C96PB)#bfT3bhogJX9$1uu@lA z!~pCKUnZua6$Y$X>d=HktTq1-y|e6t0qtb$Shqv8AP~W>!T>dOg=>aTO-=QWy{U^L z29S);udu(qyZQT@m>5PszP7a~I#6^M01m($MCJz;#u14&j1f_JQrC!T>gQwQ(APt?2{U^1pFW20#CHGruLaPasJ~W8igd z8$8qpU>gt&{pyd@+wbVCt%|waAGECF+Qt;J2XNugkEfT4nr4CDWfcFRRWPebM zi96Q7Z|}ecN8!9@6GtTL8SX6?ALxFDBJP&C{DmRfe4nBSv1P7Gogq*~<$G{QQDAlL zNe{5TeQ4-w$@E*3GaMd%<_g>o5dV$xhW#KL_V5E$1*dZ=P{4N8EIxy+L07YRQOWuN z1K`A!e>emznOgl-bxa6`LT9J(d3)$@Qiwgwui(b4a6ryn!T15>zcUcPf9DJd2cKt% zcU0*gF#t_nG3g;tPMg;<&tVv*P?%_mE5Boa_dmo1=QrWWbyoLUrKCqvcca`i`mBHatWakn8#CZLlmL(2Z zo49Ip253J}n+bwLhq=7kOJ#T`2pi9c?-cdu5d6v1FferA^-@Gy$g(I1G zH17OXa$yn_yEv&U`DBQduGh4@m7StB#{f9a&TBDna10f8+wyT!T`|o-vsI4`#otR5 zA}#g=R!@^r^kn3+A%J0pLsh#PFAs?+#^W4?&`Ui+Z(c}aeq?onV_s(-v~p>7RIxe7 z;&o0uJ0NojV{y8{fHiYf;0&aDBwBP*R&I+ zW*UVtoOrf3?yAm8;yDh@k-E}dhG=;nE8d})+00cXGsN21e?Fjq>MAfCLY2)OQ(Gx< zY&B=Dl;;85Uuj+PAGjH#u-((i`N{p2ivk9FJ;wkxb7eF?2P?}P0oECgSb91=uNr72 z>xQF{2dQU~(V8}3@?wCRP0uR@S~C>sJee!S^BGQVs4i<1teR!#b(i&cG?HCxPxuj_ z@+GZNSh8t)-r%yS^vswo3asPvCIJ;v>>Jr>65~)^u2R_{-nQj+jYDL)O3;Q-6>TcH z)vVp)&|HbfQJ`wW%P>XZ*`}U+3#wbe43-=x&%A<0u=O-3u(}Rpd4{#_?z!2c!0Ji1 zu*XdBdd;>tQbSy=ET5qT9;oXGMRI!Ps%?G-mY1?y)i{_o^JIenT8SfEp1C^Y50UQ4 zhT>RUo``r(!88<_aUApN>b>#|ZKb5dVHS+f`?EPKxvG#@1Rk%;W~qP-z#(6!=gqC0 ziM*mUiuP@(r$i;^Mlh{+T%#~xve3f@QgL0=EkWTbrlDtnf%C;tIEs_;`S?q&`yOdH zpq^h{1qGQ^Y{2N@A~6Sz{b)rwPrLf(}Y>M^`*9r0Qs@n~Gl zIG$r|I{*f&jO7$XiE!c*xr*`?(UlY^{F}_PZ)-c5q$qrGPu9r+Xz=>y_qUzmOB9ov zdTP!}+Hf$(B?`ukJt40WbS|p_u+}wGw#kj{TY*EQd2+~0P{I#P$!LtDNk!^v@cInz zmhCv)6UU}w;#qp74TFJBRvSiWhXHZwI#POwn0>Fts}%|%k+?dRJi}Tuz{Oe|wTPb5 zl9DyNWH|DCQcv`@WLp%HH}i79mMMy2N;6MTq2wzrxLBhIg{7{OHHTmuMuncDPzjkQ zMYU9L!wyH)Y3eCSFO}WH(I^5oiK`#nGpsvikW}fUo+_OZ?zf}r0Y}f}%#)wWN`~X8 z`pk8j#t^7Yqg_4VV1e+w$g=Syy5v+y6n0kT>Dt8ZS+SNlBthmnhj4&(SuoYrwIs#9 z=yHxDjm}dTvg9>yw^Y=W2^uHg|btQK=y1}KMsz9zAu31Yv9BC4s9LhD=Su1Loo}kzk%{<+R*R)}p3fAF=quw>$ z@_SGd`~d~)rk(_vH7mI;432=Z=OlnNTQ-cZw>XN16Cdj`#hQIlNfe2SnJ2Sy%{sV- zVudB19p*J}mM|C&agcf%rmulx4O#9=ERJq;-Yd7kdIEQBD~_W?Aak99^bBy9a}=zQ zc)AFzHCSK`B3?*5y<*q8gYWAN3IUdQ8mw)=mo$}BNO-{${Mu~bmj+xk6bJSto@%_! zZil5{$g^crGp>*@zomk;W=tw-x5}OrV<2Hc~1KQNn(yduB zMH>`rES-4xfEN|56)kCj!vy!Fs5V^5NFa&PdZ4bUSb@Kg(;9{LO=cb|TbZ!BN{n|U%(Y)%r{@w(=;v6%>ZCnbuU<;>&qwyT;y2yUy$Q5cOAPeHcb zZ{%%hY(x}=&QRq2q@F@jMYkM0v>Hd$#&ZmV%8>*`Gf%fK#a0q#mev%7 zg2+6_$t$)qILff5=Y4dwR7iAg;z?TtoSG}XLQ&tCdQ<}7tQeS%IC#L*tU*auYXdhy z5e3UUwwIEvKw{NK=Y@c#8*ZZ>7_g?EX0V!yhH~=LI}~6&;TfGHX{edT=Z!2~$a-&Z zv=_=eXK;WaV3geB@Mls_Dc<2gPq8W)ijYU**%Wy?f7EtL!+oOW%NzF_ z8xu{mV^3_`wr$&XGD#+$I1}5pZQI7g$;6nu=bZD?yVkwyuJ@1bU0wV8RCjgPQ{7#k z>Z%huZ@04dDDWElT-EoORy*#+y{~jdS;35~)y*3?4U`a?$sR}QYUwx;`OIT0%=K24 z1k)~qAnf-IeKYB`ZMk5gA&mE=8`i?ATNoK0JYtG<8D4vOYc;g43j5csf{Y@frFOgWN|gtNMK+t!tJ3ylGY(aPD)^|a2!aOkrI z1NGZEkA-Fuw>?bqmz}vyf~Wm4pE0t&o5}07=i+K9E{xN&`TcdZXhl<>4L#kWLe2N_(Z`C z?$V~&drD&IkyCn!6!VFax07vu8p9Bs;}}e2w$o}H-YqiEGRC(hY|fQ3=H#TmITuRT z4aqlr8z{DaWK~uS?03ADSdp^{*?^t1EE-W7g#tfWP|lmT>`dm^BZwF-fsAT0iOjQr zPW8Y!4zQPV1jwa($-Qsh_DQ(L25Huxbfj+HCd13N?nr*?=eY(%Hgr-*-1;iXQ$OG_ z7Z{8=%7^4alshBm8j~p&v+2sES*MB%eMtRe!$zT@@79x_wQ(1{FW4jdYW*o}aY z-cl?}nM|-y&0tl&fHxaHYlp&|UD@MXZ-qRlk>+=&<=@fy0Zlw3@QwDegvkfjKX0ZZ zVNEkU@)%By)RRvOMS?C=zN&)!M$@V`(9I|#+Q0`u$fJ#(hS!eES(cm(Pv09B_K0FB zjJoj)5xp3zJA;Doa()Gl(&+t~+~6|U;ERDQ`E`~icOdB(Nt5gPp_j=czZi8Z;yL`Q z1|BSPDfjBgO=a22^qvm{Y zQ_jz0LMbXOS#>nzjQDea+nvX_u%q0;s=3KCs*GrRm9L>qBa4f=TGmdase*>5BJsjF z03tC70j|$Yco`|YQr>Eoh*wFM(M-|c4QFw8peNvSWT`p_RJExMQgoh^5)D|1WY8lP zE=C7V93Ro?{m=z*LN$Fo`hyZJSoyhqNwIY9D$U_27u0n{+ES@ChAxpWzrd^9c)LGBDzt_lTl0}*DjR5Z^ zRELg>0iWAeqm_~>21z^jjAv1r>P?igD0(ln@WeX~B1&KD3@e{-!nI}1xlh2S@}dp; z-q5{9Q&MI+C>=}EjfUda$PbPXm-C;4JLF~ddtxqwse(b9i^Yc!559`hy<^^h9^Ln| z&7Rg8kTfDE*bWFGgwcg!y5IpxK@#WkS^hE)aCpE8VR=jn0xTmY{ki;CL9lI8;5XX# zCenS3aM$r?8?fvik}SG=4md{3j0ScK*D0UF?9*7`q7zsXAkTl6>=X&i7YPP(exqAb zeFrmzU{SODL5y%>tUfkE^~(yr+e|B8tE@_dgB=ul;X2vgvX&z93^5@*PN$-o1~F`R zo4$Yg06Sg{<`1H{uL(Bm3i!ag9$mmzQpi(ipZjnrnM%ORnbKu|{h;opxOZ z4YJv?lemTF5P?s%xg|UO85zr0+XksABd#!`DVZs&^`6hsvy*#Cn+7SqTch~>nL2i- zZ$!$dVF#*{pm?*_{jmi5yYUWQwapG@LQRq$D8ZziOm(L)gU*)Dsh?PSf6XMNdkj{H zbgRSVXQc28&FOK_@0h(c&g%q>>2)Mh>lx_qRV~cWvk}=Dg5CWhbu;|hO2Yo2LaQ=&D7c&as?4mY0Xvw?`+)r&Lp0viGZj83jgU60-NH0d)TH1ldcuU2K zO3T^d9L2c3FEd?n=$$lD=(cvk>K@awB0>GV={g-)3Hue$(}NDzPNV7&qS!hIW$6#I z$~%r&y56aFPutsX;IPn~U@gT&-EWwq!;~>pu)4ILrooXNLEIa2F5s2ieHx9*@{pfE4#&) zsKgaR1UxOoU&hIGGt<;jt`5^MhUD+*K;tvO42c{D=0@ zbR4YI+$zv*7-;#g*X&N?)zJgumn#fxe;?R?3j`gh8WghR;1;y(WxarmJ_zypsXV50Il5+KNelq=!dDnXnF{C*m)uIRTCANyJ_fQLXJPnwC6^y zu(|*0D%FJk0nwy3dHEAZ?H6@M|3z#eoxEkgOht>qM3&ce19W}Q>@A-YE7Ie91cdMT zPoepIOg7`w{0lpE^Q&B#R#R50Lh^pEPTt({LNWw=WD6ZrxKE>G#j!>J$v$@$P-vf<+z34+6S#Z_^u@_||%IO^x_Ugm} z6O8TQn&v}nz2)kw2|C{_w;O_ZPzzvZVD0yXb@}}b4h@-K^zkr?tZfEcC&3zDbaB5( zl{u`q%}(qJYQB&ih8FsZwC^aI1`d`*gZ;Eg%oe9LlfR(yu*UdUEe{tdS~IJI6cyFZ zNeanbynmP;ZlGvwcU7V1&zJ!ZDN_s&%b;DegkStj0!=J* zvC_a1)#d}xhiKZ1QuR%TiI;Sgluy^m% zwK7CXY{B(LS|t{kObpqS6g^r|V(44py>kJfh%=QS+0>%xvyJ__Vkh;^o`na@j0s(FVq;_ zwmk6$R(coW(j(5{&h`1=?ua`&X6Ryh(6?`hFVs6dmqUjV+aLduCX;A45pC@Z;&PN` zAaH&0;0fXKltaW(NokLZ>XhaZOB`2adFYgLL-L!E?$8aa{3H71>5au~b<`{Kvk8tV zkn&^!AT~Ib3d=!W5iT`3#F(~IDy2QvGbk**roJJDwcP7}5d1GvR}0uj6~YGrc~S=j z!TVpNZf0-qVrTDS>ipkKJ!PFO;e(p5Bj;MCi*3= zR1pKVH~N~%FzCA?KL}u@?ryr#AesXhafd1laROo%V$$tehP5^8*UO*j?-Y%-1A~G{ zpK0J?=tR{!ZFj^va4u^+4(Vu*F4qLMq+brWa_h)ttP3T_zk%9`+`uGqyb7b`uyo(e z#|E}}Ja{5_$!wO3QGw5y19{!e-L=(JnO?t^ℜ;Sqr^fS>m2k8O8{nC4pq8T9CST zrc06k&Z(6tLYnjVXM$DxOGmn{;4211bn7P9v(HrW({w2s;ImPIC!U3#=6K2^6zo(V zAk1gJ=8IDERlAEuc1ciw5oj;Q_-g(R{qGAkUN`*z5NJ6H=af=`O8cUe`Qw4ux+rU_ z3As}o3g4SUpBFW^PTe;!UKhCh!KfZ;};LmZGMUvwBCZOa(8sm^!ia(f{}Dp z-*%}_?Y<^-k#=s>J@5EbLy&3SxOg#YW`8Fz)25}OJ02$tq;G$X(d*v=oxL2 zjUv{Ii=l6JsA{Ym>x-KzMSu4Xdigp(KKlM-=681@Zd^czeT=EhZax%h1$+#I_yeH# z51cGr<{dOjmsR@ros%=MeU6mTyIFvpqT5{0nz;S~(8>B$mUcK77B1J2YQ~glI#a{! z=~DAlwwPBZS(XRzZf?)PZ`f5qEr;4#tyn2_k5D{fT;?gb&A;z}02=f!038Jc(9yn7 zp;p{bC!1GdN%$A-@v8A^ofY$6>oC~YIq+TYfdIPH9+WS@&Jx2_>U`fN6Ag==pm-Dk z{?|gg=rzdZh+iu@4HI7ZHQ|G3fPd`Ml7b6NW7*afC(ItZ#^1ywo25&+{NpaB0|yUOyg`(HByC zvW=Gsg7x=6vppXwj=H6yBF_B87@`df-8edWHFqY@TEp{9`w<5T47h8tD$kMaU_zuZ1^;*69gdx_eWhxPd%01>n(tQ0TUGmD^?W?>@7P{5YCBXqC%jmz5{z>N+T zu4+sv_6D>u_Zr`Q^_=Sm{63^=q$-}!mWK!PiPUzzw=l2+qFUFVHb^0FXM~(A# zQj$1R9AbojE6pXN^baJoWI8a^Q5Vtbw?%thQ+T0UdPUd=p8{^lIcD^YqNj!+V?uY= zZQ%0xzcd2V?XweKCfSIIIgsC6J3Pnkm^9}p7&a}&A z{;i~0k0_F8puk8rejA7An(S1(l1&sW3nS^U#L zOfSMBrOmDlZL<&S8}`R5e}9q^oqLzTF15q9J^|~!bta#JMpbtm7%qfq(r3?03%1$n zif?``t*tS7vtz0w205hnh1Xf~qsZTuWHL^Y3{;SHVMnYrg0U#0e6@wM35R z&FRZ`r}Kg_M(rJ41cALC4hIh`hS@ueS@~y6&83y#Z^0ok(yBAV zUDKtx_ZsH)|*h? zYPzG5FgM(Z%YP+Dt^umPZHUt?Vt@GbpH&y%e8aj}AlH;VBQC7Zlft4M zBc(e<6>VX7OsW9mmDNY$qGFS(8q>%h=^yj8L=iWreqyRev}G`$b&4hD8T#@xeDK4V z0KtO7c)E>O3?2;S{0oADvwq7FRvE^^8$)Uvr4h*L(=WK!hs{O)?ScWOm(#{_S;qLH zb{GecqY`wNekB?Vg4F?I96V)_!y+@RxX+-0H?)b?YfjJLgP_ami=GIW2=%cx)htjo zrPa~%j2ePhJ;}e5#<^au&lca(TlfM=aias5qpej$)p&<{DO#(|w@_%SOFob3!1kI% z_cKl0%>(Ikmr1&gD;{d8?g75^1I*Rq&Zu8Cb|QO4==N3sVoaYWJ$aVI6556~9sk@r zg6Kx&^)vji#kg+_@qpUX7uT3TtFo zD*M&PGE?_$WnD+EVpK>Q{mDJF6(|?h4E1PKcPtR|uD5>Up2*Y1<~DOBCUh=tdHHo= z{x4LI4BZLZ?R}uF*O2?MgufF5K|UzVB{-f~ggf%r-U2`^E~6v~zz-XIE5}g73~@pu zlAmw6V?K3HSD6090bh7ao0+31aUnTE}hh6;xgEB*aL zW23U077?Ofw*fO5>SJpJsTPhCXEXt7v==c}Y{wcMQ<4VICRGMBa_m?&pS$2PNh;X4 z6LHm80g%+_T`!ZyHHhtP@A`lj`bRwUYxFbgHEC*KI~#&|;6-#sk$ZwijIi@TmrIIq zLx&9OmEwfWZg~Rd&{~^6UtYjZY6hOLvNhbIW~tp3D>@&lX>kYt+`OZ0XKpdW_T$9) z#8>zf4B#g(F`zcP;}(8!YK!Wq70iIzUp`)1tTSQ}$w2(Qq=Bm<3*ZGf&@U8v3JBcqi5OTk2L2L zB~BQPI>Jp*TR^DG2ZNPg2_#c!i29FT;6pA6)P-`J1x2y0?@1uuG}ie9efALe3IU|g zyXCfiV9Cp6`mg{QZHPKSkjg$3I(i?x+t`2TbKqAG$zGQ4VSniJS?4W;ZGKW8kUq=5 z){~XD+5zb^X!W@1KlHhHvNB<`4%qtt+Qg%fr{qMP#>j1_fW;sRFaR%XMRAcU$ zXc+AHIHJewnfP#hD5d9$;~Q5omK(q#sauXW=E3057Fip&$?fRE6TeU3~OlSKcJMOkTf{UPIo z-sM4fb^yZS^}hS=3LJ}k@Zcygy*|AOFyR;)%^qfFysO2({UF`VJu4h)h~}m zAtF*H{ow=(4M=dEihji?EK1r^&2j56l4%NL5qs+yQysNp0w&f+$w8MIsjDlpXBB_pnlF-sJnA$5c1L1>F`9*aVEiq{!oQzW2@Cx ztHeN(RCt;q;^}LvNWBbIC|FbX9d#_2g@hAM*15KmF3geH`?_*aKYtTKCgVV*z_LOE zwvIIJH@O&g=~&V5#zIl?rP2*6;0V;%tx(EVk>@v$0ZxV2au_-kDP>0pk3!?l!;hZJ zI*xSb!@#{eD4MIPQw0G;bVgQmzleUJOo+L6kg}hMsK;jwJys`pN$ApAu7rfk44vH< z3Idaf^Jeb-lJwh+R0i1doHO25vNL)Wke+%#ng|ez&fvS6g6W z7ObV!f@njjwj4*G+66DN2At76;(faH9&gm zun$RHrj%^iaO!tlXvGW^>$Gk=Y|bHn!h>6y1czm@R&!R?1b`m)NP<{5*NbEi^yWc>`eo2P z#N`SrKs-WVmmBgFcBkurQiBNI1w{k5rbkPpBM#DQuu2wrn;jP&j0T=XV?BW061On^ zT8QweakYn@w#9-H>3ke)(IaCMNxE0TU|fu$DxRUo@=SmRab6oRp#|~6@-+)rm@{%A zk@!;~+AH_o?FFO3B)BK^MZtCs8geh)_T(L}W0?WszBWb?=te7t$~r zy$~#Q`_y%OaZok`8_pW3ORN~#FrI^ltFl+ITVK6 znSKU}4nim#@S?X?{e~Lo8sLZDP-SYMA|%lqMoC*ZWjCn;iFXtsl;#(3l@-yYso_(h z8FF#^Ju4kpC=ds@zcXf{Jb^&2^mI|Sz+0_o^nf(MnB=u&lGg1DIjptGK-4S4iB378 zIC!=v?YJkje{n(=+b30syLiC$RM*Bt`BM!%HCQ@>Y}BTo^2YS^ks8psbSPZ|@AAa3 z4%J8AaNU>eyeE6;qq9SSclABlEOe!K(63N?Q|V=T1(1;)**ppoWv9u(;p7e?wqU~y zC#aGN4KOaRb2fzrW~Dil=prZ_a(eYY1{K3tc`x$M3dQoA>jl=n?6BzEVMM+R@#LU_ znD_U%4D^Brnjva28q#b)h@w}(tmtXEqDH7@WPSzYXvc*rAl)-bJ5AbRFt zsQ0qH{0luJH}o-tG0rMQ5cj1*qh3ZAww;&Da^dGwu1l%eU~e+?J$1@>`%ZL6E@^Ivc9@R7LO5W zq4ashp5b+kfz;DLl<;v&X*uVYop?Evyp%Ix_2wL+ZOP?g zM4c5){)I1FxdFQPy9A1bE?jE!P8}{f4hOQ!Qa$3gE;EiAC>vdMVJQBh#!FzXyGG{AP5 zpreO0ik2Q+m^yYO{;a1&e5v0kdx(>4Jc}Ic!MAm}E60{o(VbLr%n{pCHVwI{aj^C{ zx0D?VEPmM2^-cq>QU?wsP}ueHXccZruYMLyt3@M_AJ9@RUdBss;%_AISd9j=OESvn z7a;Wl`+)07s+fMsyPnc+Z9UCGdqoE8_{`7s+FOp6lqo#Yj;YXr!tqVb5RzT;_!fg* z#>px&+IHT6!y8e7&W}_v zGFHn2XrYoRFLg50WT-a9QdPuH*$TBmuC^J;4(<-0cw|Y735xi*3k#jFx>>@Lz%UI3 zD%;*+LQmvuWk;E~^a6PUgy;U#}Ly?8TY>Bh&S zq^?!?{94d=_#J~v@+R&m9@;;Ig$0@RKFLl`Zq>%8(3qxytgGsBOf!*WlmSudhhw z`h`K>dQ(b|;H>I0FU-)OY(91)e7G(lrzrV@={1k|coSxVrIu4KEp*fkE3-`Sb+`Kf zrd8`nug7_`>3v=i2baxY*PY6A;k9{bT5Y;|Ox~3MDvjS|rt!BRhV5M|d06n9Mz=Hk zh4A%WGuB#gcpM{))!Kv^@yh|C0%d)AD1Jp@G4Enfoq%<8Jw_^bhT z%x2YsdvZ2GQ#}*P+1dam@oyWcZ-s>hiei4IhkGmg8QcE;j?PbhEOH~%WGOz2XZ`FY z6`0l792nlvUN>1%ZASg$uh}`Ng-O1hAEsz~nB)xd$VQl9spVGvG?6md zEAHPP^w~IJTig6zTT1ri6K^|}`F;z{vQMZ_a~2@*7J>5=nCD!d8tI$tbM_Q@kNiQ; zKB^YSK=kaiLz%k}_UnhSY_zH3vlYm6F%?-EK@&i#MqP5U2?PXI7qfm%K>cUaQH%`y zp31+_^F)kxk4~@;N`>`z6A`9%WgJoU(3R!JN1Ye=okclp>C}atwAS{7gmIh*ecaa= zXpY1tnh4l$%T8x(y0KZca|3;U&~vr!W-CO|Z&-*I9K9?_10**P$0$XHx`HZ?7|Qi{ z+If$J1Y>>wtNPP%w7G{qr-1|Asq9wmfXOWo>B!>qh+r1|xP6;B)Vxwt5eE%FXxH4N zMhm4#pTZLJ`Q)~~pMs0di%cnA!TW*FG2(oQCCQD@$~IB?tZL`wJ$#9uC%FX6iJ+o` z(Def!(h5>dRr4*JabNqq{fL0dGl694xe&WTz51(xg zKMnuAx!4`&5JwU4%5#v?9q;sQFEwFh8SIAT8VlM%AAT*D&~;dyx+uKh28cce?6`B0 z!bBm@zBg>B3~MiifqYh&Zc+klam040bh6`Oa(VE<(Rhg;E5yK1^G6NU ze+^RZB*AN(6xcA+XJYtT7?8I;T zmgq0?%qn?GN>2hL&%<48^>S7Ux~zYZ=L(kua)RPhj+i@^G_l{3Wh6I$ljq&4a3Fc! ztpk#0!@tRM?bYApxi~}t8Ic@tjCl5bedD{ePXf*ty(mVX-H=PTQ^{5)mJ4p2EqHc9 z+v~Z`vcQ+HhKnjsy#8x#;SYJXLpVH${EIvn9rPzm920bt*yGa%XY+TFEUUBw$un8& ztPRY1g7pP?z3nEDJXgI0{vppr`{pe>t(vQ~T6OuB&sp%zh2naOAYyv;k*@uT-F2U# z2-}h13vbS`rKs&r2rUqrCq!7a=k!)a7CF*^oltjO1$%`Z5qD|79ujfUzb;{m1ynjU z5`=&+)1M}OAx?-b#z^**@HzHr_cU-d7pqt<%fF^@YP7ObU#_##SOwVq*7$iF$2M^g zDLu4N3XSZ|01u$OLet;BX80j7Q`|+z0`7Inl+3q!Y3GWBAE}~EE>VfVS+%^5)~3VN zw{sIPwAcg|ujA}RKNL^uQ#>tkbZpUCTwo|iWT}Pdip$Dh(HP?0{5OxR-HotX$}HI)6NP| z>9mWs=*6QJ=TK$~45gV}J%SO_IFM5K-pVyUh-|nW(!G7J4&}p(Fb=W^g#+X~GVp)C zJmZxkXUulrtE_doVjR=KFPyp?msXSx8LpEt$3h>TsDD?F`9QhI_fCTRTwaS);w8VpYq$A%g+QB!d|Oye=W8I8=7 zXPkU+&+10ke$%+UOmK%Y*v1jj4PN8r-smzQ?<6hbIp!A6LPrgPMz8!ALlfFCiVsvI zV6fCFjh_FV#SZEHk%I)MG*0=_l@^wG{7T4N6L;T@@50wkQK^6?}1viyh3V zB3;vprajuGceD8LX;rZo`WJk*bG0=xb+WWG|AU<`eoWf!i=htd4>HsY zW7l@C6vRskC>{_;t=a@k7){s7#70Pb7Z}Y-(~h%7;-rbw3GO^6Ie(piKc}XlN=xQ# zNGG6O7d`)7fUTrjMYq`fI*dB_@iQYf>UmT)p?co*;pls(o1A=tO;d+N{iD6y?+-e^ z!ykTk_v!>wb!UT~37F#YaKSddY_jzP+nIW{Y~}T{7QF3JpXcw-M7hRO&JGWc?rmDJ zXzA(aHJRE*iV5J_QQT9xzf{OkBf~q+t_I`NCS#83=&0zK5pci8<*zQXY?Bf^@@be; zSRKT6w2^G}qd1FYF6u_$pVH=+aVB&EFccSgO8v6%u`}1F(W<@Y-gzS0D5|rIwK!?5 z{F2K_si$=5?gm|y-`M^A&ur>4b?FmqlsTL?6diAWPK{PXrwp?EzVW&*`)bF!S#W&H zv+1+;Qno<@JpAL;)ygP!cknN=Q*MkKT`HeFw@>a&^ag4smefzJbUoV{-`_I^JG{2T z+5GSOnYuL&$2IHpFbR5$^h{|dFE<#92Lq(}y`z$EDWk`xH&#E+^bRTtzkGr2ILax+ z`U0)D*-K-|iRgD~%(A|0drD!;Nv7_%!Oef#`MvF|AOlymRnuQ<1D^8iXvnd9Vxmk| za}%zutTv&AiKtK*CHccpt$C zl!#NeCY@Af7gt{@VCmQ;`KA&r1z91%c^RG_@_3pGb6ih9&ds>!V@5bo4J+j3#STjc z?|l-xWbG23+vUp(yyh2+?|3?&fTPvxWwra>nE@Yp?Xj)-(;d{eveLJ|o6qeXvc*kW z>3#o-#?`gYVS_uw_G>I_6X$ctXZp*SEdA-@QM0Q%-P@bX4S)ZS>5l<@v&CIcCr#{% zuIcd<7HV;C*2yhD-o%eMzIJ+lngwBCCf+Mmba@=lab}^#Q3p<1q$RgauFPvg52k!8Yy^Xm$}}wOlJ~z~pHYTKrsw#$WyX?EVN;ep z(+?=N$q1zGR@>Z8*lhLjFH*U;Qn_6-*It@^A2^(~&8`SS9X%`Sx>8EQhq;O*S&AZJ zAX<-kyP*yZSTx?kQ=t|ESSUr;VLwiAT%ZdC4;y}*#Fhy1Vj+InbR+ktL-Ycl%b{ME zyB43>IRU-H4^Gqkk%n<>!A)_ArPYA)xkH{>U)$B+Pol~oAY2y53WIjEA`agRI!-4qcIN;6HT+Pgk<)N4w zOphdU@Z=pg{!0h-n&mbkq!VNcUT9NU z&B&Zdml_H(H_{h=6=G(EO$avA!U23{0q#f9qNqsFX+}mmxIf6u3J1W&vg{6qK9|Ok ztG*erft#+&4oA@y+s-^==|^Qz$2Vj|>+o{O`W-tPn9^!w}+nLF2?ZU`W z&|xg{)wXaG!f?Rbc|Z_g&cU8Ruz+F#UiyDR>jKWc^a8t{k&dSR-eIWm`z@Dz!vSXh zR)VKnT7UY>h9KbR#VnxDef*eueLE|+71NR(j0HR$bn-8CS^(5Pp;f5#vvyD^^NJQs zjVq`TJdBnx#|KWR|46ZCWVD0-GI|DKS#AdZ9%+fqy);w7>CTI9%q{TmUH|Vv@(Y}D zNnx(oz)$XSxNu^&6#t!*KL>!$0t3v`pAg%O&h{q-$5>`Yw(a>22D@y$5`ob38(ij? z>t5fF_hmYQ4b${$cKdl6%c$Yyq+y#hvdYv)%HWs6vDVn`}h*G|}^(?w-TmqwAI@JOeTs2-y zqZA~IF;-mgk{|0tPnfnMInu-LAwU$j@nja&}I!Udd&v(pIo}I{wu!$M=3!^FP9cl za6_q|n`UTC4#MJ*9y$Ghh2x@70x{jvwvdCyqNpi}7+Ai@|EqkF!c8u)NFb&EagrIJ zlL&|Zl}sB_td1%CfjZTVm2E*xp{eslIa zK$@tpmX<|&s^EboixlLa0}U_(`uRT>9@nDkDyHa-ao^Fv*E=i{0~6E_=HJ;cL;XK= z#Q5ABcec5l=}&?zH#3(1DLs&gV1F06dPJayh&!htcwnhMpLcU>QRb~!t|_H*>R6>f zcJj?EB4^0owWn?solQQ@`@HaFS5w7)-|CM?swvO!%+$7Z`D^vIpy3TJAs5~qq{5@H^Xdn$iE^-76uBbu0ne)&qTK%v zH}p@(l_931SVT+p7Iwbjl*}IV=z{vk{lL?yEdF*c@O0ap)-LlLZlobApGUOrj~PI0 zX9PPe$lw0;r?ivj2>#<7O#x<#+sq2g{^ucf_h{W)Gk`L%^v0_T=ReNaZCDLSj^NTC%7q?Bk+8K27g*PqpNRqM{&qWHk*zut16Hd)+Z2HpwcYOiecoka z$cw3I3ywI3*dFk$);}GOW!`EQ89u$V@#IfM`u|Ze7eGwvqt;$6``@B}hnD5gc}4Zo zdo619jg)UAeZp_p8h=Q6X7$y6D+s*ssC71ZJ0)4K)i@p*U=}&@^d(M|Cs>W);Sw*( z;;Y*%+u~$;1pZH3@PlN2`cv9vA;=YQvl5w>_>8A{`Dy}rEO?r&+5h8IU&Z`!n*TlV z{B4WccABOCacrG=@}~3lL8jiPx`TI~XPer7nq~g4=zCzaOMRzF?9}6-;W&2ppz4As zlQic1^M1q&n)iFhS%7O#hj@=#d9dq1p7?;8b(rfwo%{eBb%g6c8F2e7%5}gl_G_gY z-q}}I;O`Rg+1E}!l=TXQC6rfQ;wFvex(lzQi>1;{h@ zU^ZBuvCL`hD2dFPSd!vygm;TjnaoENgf=Ld{zPW}YRL`xMjgSB6gN8qv{Hl!wZfBSj6cZMHPi57;{ORkVd7beMakX+SIXoH>){c$spk;L>?%2#&xGEzW(aDyL zjk0NVg>cQx7>%0+JL4&Lb)~3J25Z*FM%j=&-GZ&DlmShd1$SK~HG(ER+V;x?aFF03 zHVm`AZ)V0BaLm18^|i90X~5T$KW00Bn|=Ik7WTK9*dH^Q6_wPQQU=3{8ee@sKjz=- zvI)nhqO0GlS+}l!cz-QE2M zId{aQzN&NdC1YI2bbeHs?FY|)|6mkxsjOVOJ_(|w%-I8+#qU%KarM*9I@Vp{$^xp|%Jxmy+$T-|DsglSIB zP!ypNQ6vpl-TJ67anKXULRc9X%-h{IzgyP*kC1rWCwuy~-zPd61MWf5XWN~fPw!^; zW==O({_l4;&6FRf@gsTmue0{t#}|XXfGhv@j&GUXb@loF5Z-(9eYT%2&r?4TuISv| zo*Y)X9fLNvVm2GkT5qPu^@^F>Mht||z8kc=;?==q_QyOimiuF)#u7vMxm;c511@GE zE*N3hUl|-E&}UIDJJ9XT+xg}>V$6U=!JrhJ)W37T zILNO1cpHY>R~7rr+tYvjee`%1)q(TQ`u=0FV`9i%6aT*JDXCK}4@LD$nbC4-(R?m6 zG{2wsEJ1977@Nr}kpuq75m!-lXXl9t^6z$|pRPU*vTm2$?)5|;H>+1y-63|Ll)$ea z_I`fxKiO`_y}ihK>J~Ri?3my}u}$U&)XD$K=sI49MdT;5^^olRJ)Lnz-i>sL(wvwm z3*{hxK2V^k%R7_=D<(hiwS{q9;52y7pq-rdKD(l@H?fh$r!HAcerfJ$R4biFQ(C>U z`QQcjwqJ>`KhO&}wFgZO=;xVF@D?GEEJI-F2B5mE(2?NcWHFgJkGlz3Ak+i(oHar^ z8Q|0d&A>qBpFle>u<<9*4GiF=gBIJR-e-NuBw$}|w*55V_X&-fod45~O?FUi%O_Zd zG&sqx%yI~s3p1u@F3udoX5E2zKK?K%!=zUAL6wcJS4cz=>Fz(Cwj;#*y~np~C<)1p zB=&?)NZ{Nhnn+2zgcZmDD2vX%M$h4!IKpC&4|w=kH|#5<6GV>VV%1`jy`B_l`*IQPu1`+3?)lw#F0_tS$Xfa ztN#`<_Fd#;4Fy54e@qOnIT)KBD z@#E2pE9B75-(K8KB{0_&?DhhDN!)weM@FA#{XV{>*{8l(HliIe`0sd(Kj=*(mONb0bHo3$Ne|3~f+HcyZaLtAR}_-` z31Q)+cQCTBcp6(++%D;Bm;k3hVA|{GH_RKw50Bt@ePUd_2%bUmH!`H-buu?L(Nu1s zH>{E61A~2Y(dUdD_SP6K!S{>|ANpx;6206CfzW7Yf>@u{gKXTIO|r z7JKyLX>S#&6}bZuR<(alY-QPd-LV|CMk@~aa?{sFcN;Sb+GjGJ?IK-mGWadg3rcp3 zl7Fr!l0PBZd*#r#F~l+EC18y=_n{}}VRn+El#8YEOA{AUiI+=}d|8Zad1R%WO!-4- znbx7k%5Ja<@z9Iv8xN(*$gT#pyr`{ZzgGO0vatfkilkz+!P=sjL>hswGE57EtO2=S zN&4hDJ1mkV8$Iv(5gU;(EYokACQB?AMw zNP$rp_lsa?JXc4f7mPN%q$^?Ev7$EWS!{}+$Q=qOtyJjFT8m_GXvFv@UhUUhfE6_u z$f6oVNnsPQ3~eKZ;olZ&0|DigUqRKiQNXL3TuDGp-@UA;`+64t6~8X1+=v1C$9O?W z8>J}uf0O->aZ!`d|7mIXe{HGwe`lGSv|uB;aGn@YrTBUA`VNfNv(C=L2mKCS&>BY><6WBi$C0jq1~#dFF(6N2*_m|vLW!wr;nKE^fF zkZNebgupmVSJ@{lq=tp#a=58e0qgkZvOWmT862acg6A$QE?L;dMziqpP1S|vbcd=g z35&|zBdbW4rF846A_=ofs$DCj$^oO4a%9;E)-P_|aG$hB4+w{>U@Ai*X_V=3Q}5&u z4S{qhgpqym6GPJ%N2_b~Xh`!0oO1GE(I4Q>9f50QL_GjZBH*;uJ(fL=DCK;^q7~@? zOk1+lePW2zeMFijoILzt$V?~zX6;XBoq@7ZN5>d&XPpp`zm|?ulgferHslpx7#4;3 zXZh*{z;wWI09s80lO`VyJ;9lBL;;)ld-YIqe_$U$RM{jBNjZWZ(b2|39+D z`za)2_`6R$P*0#?uFoD$MCxEubi4H{hnl0$wa;*tx4+)Qy2+@EeC4N%ruo&SzEJ4a z){XbwvTLT)-!J_V$0AcNEwp##3Lf>~(KNfdn3tZ<`xT}1lF%6~DZxE!yzEn%nBOMR zW*O$Tc`xadqIt7_M%3Cm8N*MCnR*C5L0Esb(h@bx^^E&0Yi1M2gBYo3PCcxf=;*v0 zP)k&4D|J2H^_|Ag=^(#?Fg~J#(B8+-K3wxgaq2dustlHw;Bh#AkSdn|X4PMc%Q5YD z9;!&*Io@l`gpd*c1lH<&xcJh+#0kb(gP<48V)&KbY*{A!?f=8pI|ug?JbS~*iEZ1q zZQC|ZY}>YNoY>ZhZGYqB#I}<+zgu;m=iaB@KXztzw{~i)r>CcTy64j}w-*8>>HB2y zYCnb9gv>1`?+PD<(t1d+6xX5wHLa|-$_ROUG9T@@Tgb8)5yj-KVOpID!EpH+YX44E zI$y|`DgvV&!#_2+2nx;$;c+ z3O^j;7R^|m9!rwM1h&G7~_=R3N5OSj|LK#bUqbE|-&1rj|J! zSy`1A1t=;UoBWTElJtTk=Mjm;L`5`w|7u4 z?fn?V1@P@@${401kA0gLSA%bVVT)C}`yfQ8Ch>0Y-qNLzSwEfIlTsNJ^i#w`Bm0^;Rd#RT8BH>9_ z;~ENdLhnkNH9oib=+GDlrIk#YUisM zu1gx7$D{N9q((oiKyT@DP!(SlSguep&p=+JxSA?xC#kc{WR$d%DO;LK9a6HD~fkFpq zTrioZCECU_Eu&VWLsEOSDzCixeA%sn(`KwI?9twOrH|Jvh<{68Qk9rk7PHfaV?UdU zq6zzT!Ee_b#fKJ3?M%-ZU%qxpNb_490z^VUJv1zKfXmWHY^j}EQ)WNFd|w^*O! zCnulgAML+7)@9YuHEgQNSt|gfrK-a;I~{weibjd`Ph|A0cDbwDvVFgPIk!7q`>^E5 z_GCUMPALYM(Pf`)9e6X4i>E1Z57$!cLT6^dW0?l@3^+w5-C1#*%SipIaA<;4a?a}P z_!Oozb}c?tmCj{gmTYqHb=ZD74AmLL4+{O3WAFl&g{#ea>?!VK{=fJSG0mmC9L+1T zTAw=Be^`H7af}?zn+vw*bVjpqcZg=TJP7Va4mTWIMJO~+$3=mWdh{dFei+h8)V60kuV?W9&34C9NYCwx{>NN-Da8;3Ga{7j&bhF2bWd!ws4XrAgfu|`R>9DWY`xq~$J zmaJ<-x0bPJJ*S1-h6Yt*YiUlW1rICI!3-}hSv@85 zUB0E)9L*10eBf0*ks89?n#Y={HII5NszSj*l_)nO@?uM85Q(e&oY1g-NI~}6UQov3 z;MFklToFIkEiIKY^w520yc=v!jWa;RY+cvV49eMJ}!!If3e4z~u<*Q&J8Ch3H>buEt|+qj&mi-U{j4|0CbVyA0{mrs9f)_x zM>|76B#oMdY6%BTQuG%sc-81`G?BFYhi&$~fblFO+G4nNNE)A1f5QH}pjPfqYMilM zmx7c?bd>+H@}kK?;2^K^S)N5Y^eUf>nV=~pUlUUuM97|;X!}GiDX#p|mk@IUQk$0e zaCyYsxbGQEPeMU)suA^hYqlGJ9VuSNp(&^F%BV7*z=iYtp}EjGsN}DYdrXljIn9qU z!(ds*J3#N-pd1}DV`*lneR+07#WjuOwrJ_zfty#ED)K7q?NHxyenA;3vo#N?@V57S z>j1$Xz%h(TAgPI%%mc>Yueyod@82g-&0nope1!{AsTSO`sk`n8wZN!5c+iLX46Uz6 zu+mVGhQBkcw1lfrSG8rOmn-`|XuKm-7V~A4{x$kYD)EX@x<5=nG8{?4Jea8&eD^!k z(jtL5C=}WW-JMLrax7!rx+JQcw033Wut zLrzRNFc3n%qDmM}WD2f_t^`^X`ufS9cI?!tggIUTI8~9Ib>sG|6#7vrbAh+~=i#o- zaVEav4*za&8O~y@bDY6eTH#(39K)Pv;&{-m$$5vQeESy{nujxIBG}m%#*M}`ZI&Ym zFIJmBDWrBact&b{|0StTx$L!g?G(ZjN~Ce>6(xeZ>CpGO&qJxUOMnvIj^c9G( zbu)4GsD@Y~U#bRl^WZZ`hl7%k6EYKT%@J;f4CDG5tAnM4{KK}Uf$|ilCt@n;jN(y{ zT+*#TA5o*T&_biBSll$vcWBVMOC%|X+|?ym@kfN9=26m@VK;YV^buB~O+_R=UrvV1 zyhCQ1YvEsBaAhWU2A-_6G?lGQwW=hR&It1&0|Y{8C)k^N>m$CDq0@VBbp~d0)Rr2U zY@=eZW^D9;Pr_j~C5c0U0@SU6X2*}npG0GB&~{f5KTPq0I_y7bvuC!f$Y#r$LL-(A z&X3n!hT$~C*B^X9OaBCV6><}FyMF{w7=^I<!?q-O&~yJFaYT3yD>yYjfG~k~t<|Zo3ZeHJ4wKXBiQ%TAdm> z7q2qDURZ8yJF7C=>t@$(SzC{q?c!tbAjO%Z=uVOrEQfP_{nLaQA9bCmX#B{+lzcy2E0iaAW zkoM`8MP(P2%UNxh}0_4qRU}tCe@veN}-?)dk{9-a>_taYmAEzPIHDQ%fhM7lxLYvq$_QJhWeFBOkdTg^8OjeVyq z>p4HXK#+ihD;$1yB%V{TKpdT_#xQfkGxbNc?s9F*QD?akEnb4V$i7+UHM`%xFL` z!25ycFHJm(nVL(fF1-}i(}w~Rl|~YGFY&HBsg>iR-HXodyI(wMt{s$|UG%dc0#UXG z0PEgrsZok#_+D8GTWOwLK6~*~rcySi@Ve(AM_YyEYvtQlR{{8nXNpTtB`3GsnGJP! zeV>C1@I6v!le;hnXKuz0og>z-)d$KS_d4G2Xg_=2yY;sYknojrCuB$?y zUKRNl+ZDN^ih#zmB_0;wdyA1tdaIR2C3?o&y-J}uv)2o=O$kcxF*R074z{YUJT7*5 zG958JmSFr;Uow4eJHq_)pGlh!1nDnzwMb&87v9?wm--*~pOrn2qY{n`y6qVJhlb)& zqr8+MPrO!!!}Nak1AQ?$Nu&PlE7IGumUEln(givkx}V!Frl3OqrA5v9_F{K#}^fh1GR3* zTlbGL!yclSQF5;4mB0ShT8$@bQDgZwc&PgZ{@;F{CWN{7_X`}TmY?s;7la_Rl%~JX9-u9Ug&X*Vn>WoXn~)j zlBdEq1GNDOVi%1(27gsWon4?h9|k*EF)TQ*X7`>eX34{Ve1-uf2ra-uE$^>r3q;3W zG8Q$^SL|rQ4lFp(4W^k*nQWpg`$kR1N$YK=Q?FN$(LuGEHl?e48TATYMnFu8lK8-9 z2!p`vQ|J@G7=BckFdonEUlI=feLnh%Tt`l+3i|^r-r7QGF2@PR8`?FUX+zD$G1j5+ z)xPOkqLc39Z6Z=Nrvb%g@V}`@U!oRs_NkR^gFEER^Tl)dkHTd*~l2^SwXk!R-fx37d{_crV(! z9trh1oZHNfw&Uk#Mc?qNi|hnpz++<7=CxL-IxG`78CiCJ&=DT^xpR%gFTDFyJ7yx+ zz&XvMsea17tRq4p9tL#q6~?vanKhWK)32bQp+drDG$Nj}jN_wzFna7(W8ymWO7P#1 zSnrz0aDT!ZamkqcrKcFvdYkRl*PcsLL-bj+B)EID>>bR56I2|Fjy`ATyzM#>Y{86dJT4(Or^(J{4)`bs{v?<15LOt+62M-1-a3gG<|sw_8+7jJ{XUiC1ox=pp?EggpXzq2_lIQl8^ z+xMpYVq)0k!HkiEq`4Hq)vL2_gLR8c?yoe8FQW!`{)h|#Zu{^4Dj)xY;6Ok`Ko*hi z>A*isCkzS%g!sdF|A*j44i5jJcaG|$-3B9KH^zwoV)tlDjs#4wc>*`3lZ6$C`UQ(f zjZG1%R6-2W^Lba2vAUgClsrqiMR(XU*J~F0bh6l5lVWEv-~~fBc|cc)7%7Sf9tUPfiMlqLcK|?Wpj{s zxxRLNq+IlVSikiz9TDHXCPF;a-{B8R^MHyOgH2V5c&{LhIWH2Fi2SW=bLFljr?jeW zC#fvyHo~%W&Dof`fAB?=TsS~Gor)5Uuc1xAx5N7270B|6vXj;`;yF8>_RUF9ziIGW zpy@lw6V2>1T&|tj`3G*1trZ!B%8MyEaa6uUHu}ea<}?$!2tU83^~`;0N&><34OkaM zcQ5P%1p+SAyOKKZ-6fkq{`~tD`Nl!-EiYi)~EOa^L z&B@O`@>a>h6>uNScgjb|@4ositjq4v_CU~dxMp*0RL{MpWp}+o!<Da;Ng;N1lIwg8=<+Ii(;dd^z+pKfl0%fKdJ?yO_8-yV%?QhhutD=k2l?QNs*| z_r1VDO5u=7w3DBT7R#i^y>O655lJsh*27CI03w%oPlhaKlHr|tHYhy<4%Of9LtJ4O zZ&K|4C}V1b4)sr1;vt8P463M~`R%Vxrn>Y^5x|=nHDP2n{mh)N1O6Nf8NLdQ4ZPJ> z>z0C&z__%PK^M?k)2sj0p+W^mGD!!vrwb~1!#(CZo{oR1OZ49D$@SfI0UXjb=I`NA zk*&OMzBfvzRjCaiV{etoU^m``l{tEet;aN+kZW(3UfcJ1i9TnO#QzbF+SJ+hPY|n- zRy<*j=d^zqFVgb)1=>iTLS_fi;Xf9Xu8j_R@!cE&5$zjj9P+K{veT!9+(4Nb;=`0c z1FT$dD*hmzk|Ckn%i`+lp-*(e>$ZwlaBkC=Gem>c?YEJ_)*J@Yh+alNK1}*6JvhL% z=et-?0OOYQql%?(%P4l*gBJfCWHXRBa@L1E@~;izU*lCsfVL1^4rMra4BohnEDgDm z%LM0dMZMRCMjO!%wcu??ulh2p@t!r)V&@gEsK20u z-=eIT$Cn}T4ab@I2Tam{)O=r7$nK#*>&yQmBPx~2c1V5(JQ^Da2<^WYCl?DdTQi3L zDw+N>>=#;c(KsBKy%=u#mQC3q7vy9Tp5l2*)mT_k+j=O!$hgp< zOD#_e1Gl{>Z9$+OlD@KRRRE}W7?txLHsfhp02@OptwC*q+4r;gcj@! z2N`8}N*SnGlUwcQP(f%Ih3uw1L9vTB`6^ylH+Y%C&0Lu};4n&jL`%7cQr7F(Dvv&FOQu z23`Zk{3~{~LgCZ*D>;)^BEmLrA8AELLOcab0HxR$3iboIME)DQ`{NS z)5S$?8kR4@&g_la7$GUx%tnjm7v@~~+UE7%G=PZN9fOYwm@H^NseoXAaV_RV$31#o z>hI_nvMK5}zg%&=KUM~=eynob=rO!wdVoztUxE8^K4>s433|>q{e&Id>w(k>dNwo! z+N*c^wps3?QId1!+7!^}7hhpC=?Rad=r#>(ZXR@c;S@}q66X#cuaVNU@{ z)unWR9`cDAVNBp8K;|{Zyx5~mgRzHJnJ{xMRmW04yYqi?RFe_|y(0Xhbu0(GV=?gp zgwM!}hIedox;#&4umAOObm;8xb~1cgY#>h{!0-FeG<=3FOR{zL_-yd;`Ji&MdVj4i z@H!E9%>DJ8&;Ne8%5W)I2x8#-c@d8>tM7aNnlHfH@b@R(fy)b#JR$_g98xi<^|uU z?Ou}9LDADOpP70HVl>57^JPJ-emCaStE$_BQ`p}2vHigShZz8as$$D3b zn#mXT%}$T^l+c%bYj=W~1szE{448)=m%j9??;aQXjoD*{HJVuU^q2k0+D%fO>q`^a zvA_(J=F!wnXRaOxN*pyYEII;|vIbiEFct@-;7V9bw0uJ(f*}X$@QO+#;$8iGoEw8Ce!>dPwN(K-b`r_O7+V-A1c71CF$LYxbq`qt4p0#qL(T?q-pDSSO|ND zRFNIgJT3MtVWGJjJuLtoy=LlD9sSHY5v}7JXv%NtW-}*I*FK?uaZ<(3!1Q^OrH3x# zsM$L0w1uViIN35dq;*pk8NeK46tR*$%e8u`CJpDMMagc-s&h@eni)}T2_iL(&6(z1 zdnLsIoa2_$(2X@=%$)k=QI?$`YB>ruL_GH`rd1Xb&Hv94UPbTq1BDh51eC(5=G>C- zG)kvsW$MU7XuO36gTd)cMu8bSUWu@^xw^8E!QJ@MSH?lTkVWc^5I(*?VrtEn66BDr zN()G2YM42T$Q-b*FXkv$i>@>OGHlZ#MwB_?;8=8GoHwZEDJ78|ZrsUF)6|Fsi$n8pp{LgMQuw?z7unvQ&|*nF7;A}n1l_7i zJsH5I581qzCgZ$;<+xqm|5iB-AF;1rVTDsiesa>Q`|9hdmy6VorshJNkMyxGai|NW zYF$WA@oNh6iW7lafA!Hi&!DooTWGwdD^+>&d__iYwn_s+zh&Wi8GoW6g0sTwbxq`z zSL7&~gQ3#*;8I3ew}}Cal}g1Gfu6?X@u^gMF@u^?6 z^n}x++_%T^KG=KR0vHU3=TtUq(|O(+DNwUg_3it|PL1`c-nHan-BP=8(F$(&yhps^ zbTsUaq(5x^{FA-&|4}9Wqj|EpkOl#MG|vXO|7AGZxu_Z$+x(ZV|1V8WVS^EK^g8(o zuV|Bqp`@;ekkTcal@qosS8vp|df3ghi>_zD_ZY7=p7F9?s_Vv<+VPO)q9IvW31{UZ z)UsF|=eXf>_P`*|f8lbAC5_vJ7!9ra06e?*95GHz_O$-$Rq_?p8G0= z(%t>|H2G4>o3LFSzWTUw+F?|#c?OVI?jVe*oJ~xE3l1U7T(YMM&lmP@L#Z_oY%-zD zH%poCQFy1WD>Oz|LJSrhH5nvOBF4dX)jO%AfU;fMqU^{j*>#Crcq9`wgA&Z!+_H8Q z@sNXAsF`$#GEF!#a64og6-$ds6aS@kbU`Ojn=Q~msvvG$i!Ii?aIb$t3=dmlv0~?B z&O_+HZMGjxrrofgCR^;a!El5>M9W=1CPeWk4VS4UN56pWvPnA(s{_R ze>~+;%<2GZUpNscY=rW%-49NCH~W3<=G>wB6>gOU#WARaSezsu^Jov)m^F8%SebF? zJ}|~AXX?O&v|^l%K-mQngk3(-(W*srIaMinxAaRgAWRC?Kl6R>Ag%c!KczDk?T_U|G_B7xNIdR2T^ujXX zyjr1zMm!1GG9zWq0w^%8)Yw8a)q)WTr2~32ATQCw7kz$3q}~H$R`i};kxX9eP1OM! z+wv9xt29~}kltKE>eY%W8(qLTAWc?Cu3BLQ9;uEdhRKFML?}TqgLKG=lm;gK$P{uc zWnkdf+554t+vD&4xM$K(ks6z|wJ zpRK1mH6xJDHNK<>qc7Q!JdyE zvzd#_&w+98Nt$%}mzlFv!IS;R`R|)QH!Q6PFr!ro@(68drQi zpCqwiqTpo60x?+2XCHdJeV(oe$Rv0Oqs1AD#+8s`1&_-Fd$dFiuF`Jv=ezEk%=0W-_Q0B()xQIl+YAt-NC>N#2(II6uD$?OIynW?>re=WZ*M;1xB@R}TO9;K&< zE2U<=;Ti^VV%SQfor{mQ4!;cAg#@h91ffTX0Cei?7EO0-XWaA9EXd6WLIv>BZVX@z zD$F-ot7}%UXlR+Z)rY1uuba9oQa?Bqbrg4IAgMx$S2Z9ltbq0TcDk|+nRYbnw3$Z|i4jEBaiTNE`}+9`vPt;DhG zRda|Q4Y0_t;x9=}U7P`kCylXYWUk=;j)O%~uaPh4e~kW-(XC0w0v0{k^!~d?I|Ro5 zUPP2%0-b0)@UU)>({x9*=e0E)e3*QWXsN)naO{Us1fr>bbNei#9cFZwZu85esvy1kMTyDOt4dqbowtxY_~ba$)16+up(?l^s&{D;`Q4HB=$ZuY>i%x z$ezmF;>9f6P_)9)q1W=!hhfP&KLMz_TQyMma$iQ~@h{SSb%6EwAc5rM6EYcI)}d)g z+}e;Og{J%~RDxY$42~ApG3t%bXB7JG6JQJbHF42c8cLcU|*JlD2keAf>`6cBh`c_$RvvHgRlM;eusI^*~7nmoB_Q_meqPWiWHpzNF2zUwA!NqHHu(?HBAo= z3ik(JlIrLC_i>#$aGCpbN6)Pa%hJuRll3>t0WXUa<=7#v80f>qZ{+*g8zN6aqZkJ8 z+0+soXZ_*NKxA-Uf$|JNG+&l0Bpyawd>vvDF|1_Xrq z--eO9nX$_Mn7bFba`p%8h+)@YZv?PA9Qg2DBFt;1ftN*MftL^f+v})mQem?BgcOfO z0|V_w6z}B0&S*{EDY7D}dpNfEu)#w9kEgBU&a5pATaBhmV^OtnHP`XdA}4uAL8Pj~y(+g zna-wq>a6yA?q=7O(fG^hq8WhymAd_%VqIfzH+5B`za}BjY#a0C>YtGFb7ltqkdIpW zEI*4ri)d=XjV*cGPd2ObIeHD-vFO_9Q5B71{oK^);uz-HkTYg`5scdRCJ)99 zd^qKXj-WzS4TWDWIY9gd?{;0eHM1OU^}CocPJ>rf z^*%3*7oD?}Cy4jMW$by41kvYy8ZhxK{wW-7466RnRmZ8~3p@9Y8U$!J?H1hokKq^(Dzls`{iZn~3I!T5Nqty=BEQesuh$C*&N3T&n=-z7vk&3FI}vI-*I_f>MlY~Y2b`wab} zsy8&NAdMuN#2y3}k^z+hk(dGzqSB(40)?=)MzdnzRQ|iy{S0oxP5GY|l9u=6KHg8? z!4s4ug}iXMD_+L-X7$p)!lM?ci)p236+*+oALJwbNe4*G4<`g_lOf~BJuMDcc}Osd z7Ip&-aU1WYJxclqho(RfLq^9vVM{SEHn5tPC;B-pB3~73{4P^OWZZQ5QSbBDK1LFV z#j)#bBmVQed`vk8+C&ubK7ZvyG-5@Ij^dj}+n)mkyUjrV_vaH}(6Dw+M`q(ukI3uH zLbw2}IL(khQ{?hKVtyFKl4JXgoKyY+PBcK4vY!vmUJ*ZaHBQp5Dr*3*nJFMji(E%V zbLSTk(`3hY*2?$MY1Quo*%*MZB{YH3{EZ`Ym7&j+?394x-=}SEhp{9%*?l-u#Qy!K z6*i{t$Z{EKc(F0c!d{{AMJZ{UIIYT(_^TT2E$Qwrd@k{iIkkNm<8BFGZcUIA&9++!4gbeP26a#}=4l7uZ z1eQ01Xp3$)l=oYr9xoXP*rUw)rTxKl1wk1hknyA*nuI9j-TL}*Dc}g@^W3v{cG0RH zn7@9dxp$Nf3|c>dZd4Hum{{TCOIe=_dXNqbYNIp>Q7B}P^@H?#-Ce}qNQQ)~2wEuJ z#fy4)l*X8)JU)$k#BA*Stgb~~FEy|4>G6XCloAzE^#H!i zg>q0|O+AiJ2mwVVByE6%dI2>~T;teS!!*gpw7*;%CzYqp9db;%syMCIt2kBlB46gy z<2xv!uDDVy?HY;vaSHAaNpbz3}=Q+IEid3(CF{(O6GYi(tJJiW-5>8owI#|9f(t8sf%?Ky;- zZGs^1nNwb=)w5P(Q#1ZaS)QD2@;mu~3TmWR9a$={0Bq3vxRcBU5PkCfm40JV*Gr+* zHIjD3pMO`DtI=5#$S5@~<#sY=WNl;BNFouZIWfu5XLE1Yvo0QoZAo$`@!}b2VfJKp4GbSKHW+Z3jSV>VK%@4r+$_DYz%FeFQ(yXXyS=L_qE4buvmB0AD z-ej95+PCg+d-MUo1ffR#t5CmDDU~EPCIt;WgtO zApbN^!_^Vrhds-x{W-3p?sgNgj9d3O3*?(FOZ*dpQpMuO9fHj~S(aY9>dE7k7YxhaDqV$HbYu~0yVbo6e<5I4E*h>vp`fkeocx9?C0r>K z@hrDGq#%b@4BJd35)QcO-a}^hRA*$~$tuyWplS4-aXyIVE>S|~Q&Co_uDgO!$*<%w z!`arcmw?A>IJ07E$tdaV)qjS=oj3P=U?3wKR$f%LRa_yQoSoJ14%eIyab%Z7X~Y7z zCuoYcnla0PHQ}*cB5Ias3Ne;Wh^mzbAcWZIzVxWJfQL&B0R3%eG|6tU0?&1_RBNr8 zf{!+IrBL7;%(IOh65UvjXn217kU}s}3iF$%8UP1r>FK|*GO_5V=jE4T%dVyyqOQ=G*yTcv(=~?jeL*+%l%pHs z33#rkt2-;DhbkJdE1FEOOM1)>-J0+Iu(7hbPP z<(Q`)8bF%IJ@xADwz8(C;TB~?r~l6{sXJP!TU|Nqx8-*eFk6P`h6*59C{w{{{1k$2 z7w?KHJ@Zea9?mdT$ZI1+9+c>vcwByCHHj*pBtoRdlC!WwIF!NTjgUwbI(G7-vpRoq z|Iu8Fu&P2qh|$a-*l@6pr>iY%YmHjRaR|`!D!^Xgw9L?Za(S!zuuR1JOF@rOtIrSqDHG{#4YWr zxiQzwZGQ+VeXf~~M_?oD-w^=FcZ7dm%m^1rUND8)Xk8>6L8m2TwQ)6lz04KI)_7cW zGM&U25M#;i^dMO-lL6YprJg>tCbT9<${h*drd8|Gf2sDd@4!pqd8(T*!kG%wyeEcg4y=B z;8zPn85C=oLrg3IhkOv(Y$kVSen&!4u55R%)$z*ZMoD4S(pT~JwzAY`xIvN?59gZm>ui;7WSTRRJdmV;tc4K)lpiCRxI zWG@kDX6*Njg`om>D`<8e>TOn5R*e#fB8l)N-3Cp3ENd`qmbsKTsie7i8M%b%i@5FC zXCI@hj!yLDhPPnybv>q8tSyRsC=xgU- zmrZau>|Pu3xD`vL)sKebbKQjtC#U?0w=WjjLmG?4`N`z+IUY|Y2!5L*sIiW0;a%5* zOuD9?_^BycADhM-Ehgz|xPKf@aY&i2HOE66GD-w{r}J1wrO8t@TS;xpO3>0=c6u%O zGyb%kol(=!&?F-`MdN6Dv(}@bq0tY|M4Vy?62eU}tJ;-yU3ZO|&tzJDk|FhPYwq{x z8CrF-F;4h@oQ%R3TUA!*XU`NPPD z!jIaG+~t1VdhLJh-D-NO%)!f*mX>FZ;QwlbL%{%gMOO7%=2(y;49L@_nE!3 z4sV&dRoZ165F%1tKezFAs^AZ>>-%)W5Y=0r-?EpyKD6(%jpuvHumyClTLmhek)XT= zemnJ{#WEn%VjUhpOp``+R-GmJl^e9buhifB%z=OCFQ7g(s8%{ytsj zZ&ugy6;`9&10aH4Eo?J){h+oo#nrm@P42WaIApR>%B{@Tl+-d-F5l3BWzNz z@^3u(5@+Y53~w2fl8(+51DF3$BfZy3_9+G!>x#GsaimPoVkAB9JK0vNZm|G;W{eWEY5={FVrQ2Dv0pg6WbVFXxB;s)l04r$==RL9InJi+w>Lvv(n z@UVf`DcNr;QXJVn*K_r34*NW_$O1G+H^*$G`IkaumI#f5pSPkvjxm+S_8Y$(92VT zzTZ{>;*&F2I;x~yMp@4ovMzDI8k?DNICTx&Q4;TjAAZ9 zuwKbdP1moOwf<&r&PHM<%x*&%|M>;;M^9hUfY?GvThHcqyWL0(mi&#dT-;AsaooX8 zug72EuT7`DE5FlE(Ir+2>}N<2&xYr&_WRq_HZM{n%*H;SJ_r9MLZv8?YVWI_RdT9D zn|5&SUWaKY%dS+XiokLZ6uczU!8N-C)HsGYpe%Y+6Oz;Z#_-UCbNMB$()x>j5QtQ0 zrist-hwL{2O=9tyI*kO`y!a@P_pRbYvUFTU%aN(fD_7xmMqtnWp*4A$p`~~jeIO`H zh9|{1){BcDt@LY}Ljsu1Q~u^|PW=s}x*wQP%hg%0=7OYIIW@#Ek(UQDWE->i-{$6~ zKXsn&ey`-Fh0@D|?%kXPY!7&7(D%*Kwe3MC+|@)-f+SH1Ec(Ou%cy_z?8l>lj-ynh ziIMr;Au6%%5}(zB#e0M*UM*vUzKDFl)fS~VAq|pGUZEtx71>V&_L8$0k=bjd0=0CT z?WDR+i*ae{HC4KcTzXlSvA|0|!o^kBwfaBS)eYnlS3_e!-`SRXjdCsXE@*Sl*W3B! z4>lCJa2TV#Phi;6aKm0wWgV^7K5WSE1I?LKv42zX^8-d=@~ zeFDFCiD!BybFhIv1m8WF1^PD5Sgv%8ylM_oTmPq*gC~OT*ZkJ+zreq(GSIT})!#D> z&sS=i@Je|=MZh@^%zq!h^qe5%5f+>zmCBG-oDZE~Q}mcrvUxs=02QbTGOGCG2= zs&v}4A(+`&j&cD<(!UXN_Gh~Ud)~${r5o-5a!>kp^D8(G%#63M_iJ|yQr57t zc9eYoFHi5I_1~9=8v2eEu_^Gb#G3_N2XSs(E++-#e+(0wsoYSfrhS72sTmmDK{Cgu zNO23gku!MY8sbeY+Y}jmyK@%MO!6V37&lxaw`V9}W5D|Mdf@o)GkRQrF!1Y5`h&n~ z^9cEaw^2g9h_-Pngfc+c!mFr3Vd1ap6gfSzAs~ricyDVWFzLrX&;Mu|Vi_H~tb|kT5?@n7u*(~vd-I;p^ITRjBGKx)k{}IH}5d`^T@{f3hIo+VOa}`^XfI@*`vMqE|yJiE4;<%1@z|= zX&e?@2zCB84l&Rm@x>nzUkKzN3l`g5Y*O@!6dZP&dV!vYMx61-t8xt|6xdRzAft$INCNgS+%Oj(A!uZ< z9I6AGsWm1yRqTWMySQ7NgL{gXuC%Vv2R@yG$`wS zaxrnhL5YdvjBaLJ3brH2& zoyDz6S(kXHC;&C|cadrRJc{hIzUQ-;6ek?%EZqObRhHzyKnq`$It9pS&BRIfRF>by!!>w;aQLMeAl{;cglJEq91uc)b{3uXpw zp%itT{FkP4cSrM7W$>k(T)*ufK0|8Q|4-7sd(9}Qf6ar>;nfJm;ab`<{#f6mpNIx+ zE+5hwVZk&;H$(PDB})*JsFA}Jz5Ge?RNdH_gZmfzz+-S_`EF-mgDK|yQ6`Uic59<%K!Y$Y`kC)5T@;`Yjm1ZQ^$j*&& z-dIbPvNq?Wun;9FK_gmB=nR-|-zwd>=J>!ezUHI9NYspI&Pb1D% zXKT~V{NS2TQD9`QaO~_9Z<3Kg`oPToTUl{{j1e=lJR{zA$sEL{e{iV~=XQr(N!xEd zXzqFck#;3<-Ua;e*-zome~`CDjJ2W>vr!VHUoH&!)_%0}{+*^5f1H)%nPBzk*u;Yn zLSVO{d@^%kKqCeYI>lq$bd!T-6bZqvsF@!LX+fbv&l6xV$w)zNv5s!X3nCN9XgS4| zu}=kYe%%`VaoiQd5}DMfb{GdXxlRu&l#h@&{hPBFmVP@!n1m9m6X{KuifIbK1}t}Y z`61NJjM5+S{2C~X>Xa}RkcDY-q2G1C>%#&8RE~6NL^ePoXIr0u{GvdQ_H4yZ4s`_A zah?iIe#3hUcL1q$kVjOGS#`8zQim#>pR3GK;PJfWvI+-G#6*XcIVYn$^~j9K%gecu z6J4g*uoX$LqK^d zk=?ex20X18p6%~!--ke@#5dar|82X1m2_nrh2MayE5Qk>#q#p)%|>`GN(NZ}Up^zN z$mKsums>HN-YcaflXIN-6*z4PKPhQ^pH8LY3fPNZW*B>)`he47bn)K^ck_rSK*46p^3uOIAx72b~+GF=F*7<$lf4UxWm3oTB)`497>4 z3xaNj-i{7%-Ckq*7|EUppyYGU&>1uvseG^BjAfkdqDkA3GUpj{jKS0apYQ{- zIYW~k`TNc&UWkC9YzPYuS~i1vbzSw;CMe%{{59z}9carXm&z1wMw2W;W)ry~(ZbYtmj4abeG;P7CxeZs zEusKzThQx^ot;m8a5K%Z%X81b&wGQ+BN$^!@Ld^Igy5CC$n7h_$ zGS4^BbXOzr1c3fd*sMPJp)% z^fb2KD!J`&(%>ygO8B+HXo@Qg56oG_I%M*u8!4|0SGO)lW*h4Nqw6iB>WG#oVdUZt z32woii$idCmteu&-QC?Cf)fG+m*DR1?(Xh7H*e;f_07D@T77?XuXVet>s0Ms-KWnk z@E;yiVHb-UW||Edo6XrtOGJ8BX$4zO1uPsuvQZ`6kYz(%R@?#Cn5!7+%UmAZAgy>g z;2{#nXgywXWYj?b9Ju!5g74eLco?=Xwm;)wp1cqe5YW#+gKO$|uzn~;(bNSw>#oFZ zf9r@6H8|)tdfLe0jFE-?t3K#)-5f&%@`0T_XG$;94{rN}DptKABx-%@smH4G9K51I zpS2DZQilIXIu{SW%Qa@omIrr|uKn^yk-?*9p6+XX7S{NIYvH+A7bgT)Cj(&2@3%h# zaC-|%2GWpH+M@QD=nPIaEzAr%EwPtP54;v#F@P56n~q+bon*@mUl*l7 zG+p=AEK{6tLzM)}Ddc_A4ZU;UY}?>wQm#(&Xq+lE%X1ngcUYi)F7a$UJ?LsyV)Q^R z3aP6=teP3Hh$?S{I{?ySr+($*fIsg=1hxX~N8jR6n>G zn5e&+i$=_e#@s%WVrN@{(s$K3ZYU72H^F3Acn~hW%$4PnexYbgrlC*FBv1!MAwUXV z6n6aM&##Z~pAWmsS|F^a;6XDq_Fn=fh(3+M`{+{i2gP+_a(Czk2S{4IB`5zd4unRz zuI{Dk{n=Fyzh-}9uZt+7w?7yF@$r_{{Temq8Q|Jzee|uv$GpM5hhk;^{AycF26o;- zE_r~Kn{wD}*L4{L@;P9hhqy8mPeg;}TLFMnxhMj(;PeTrLi?+tKx%Fzu!AnQPh^;g zvfDCgU^2+qVEsse1H}Fq@dCe8ARtD)(y&61G2l(M`dllJIznCSZJN)+GlZXmgm$ZM znzj~;+DXCF;|t649YS}JuUcWeUL*JFOHd0l$T+A<+seB4*6QJKU4C*n13bEd_PXmn zUMD_w^Q_WhveLVmf@`Fqn_$S4E~b98l`lVoO$=g-Mlcm>#E-viOffT<@q0fzarEQh z^~3+!pya!P+pBHeML@(ZSV#sf0B{h-#^PZwMC0sVVCoNkPXN15pYWMaXOBWVp!3nM zX0#PvnMO{S39%fgrmO!`|KuI3F}vOSe%8B)wxf5KNSQEQJhNqU9$kl|^oawNKrlkE z7YIbe9f^)n^In zeAbJI_>e_V3kmobnWJlEJAByP->L2`;nE$3_JmB!@ZwVn)*R<_yB!(%W9kxJU%NI1 zC{KHzSR`oo^uszFpzJgu;Zl4rd56k_TC7P}_Sv@5&O|sDRq(yL2gTEm+AW3eJzPEl zT--Bjd&xB0eurQ=6e3!KGM&+oz?Ht_vnYIdZ8L8ao8l%`()(}%-?hY|I!qe#O9&Uc zz_PaXl;h6K`lMVI9vU?DAfn+->ZJNO<@UaoQ+Smdpqq&dn(KF;=A5VIG#}Kj`wu*F)8|#wi181 zML^Q|Z^o;8C=2goHw2lf2l41r{?S0K#M( zQ?sD^ngCWmi<$JjU{~@>neNAO?X#cd`uvIM*PGe`EHQKWze%x%91ic;V)R*G$lpGW z5D^eX0520QIK+kuCe}x_`o$K!*MNw-g0$B9PueGhHSgwx^-h%TT0JJUem!$TBYi51 zLV^~X$>-tE@aZi6u!MX2R2z9es?9M1ksM+AFFi|bQY`$1F}^pV)OBqd8Xyy}&wiT% z!@4K>h05@KXH>|BnK0LlqK~38bDBg}bPL-B?&9jeKB_(M4VK6Mn+E1jE$)U1v<9*A zS_|G|*VelIV}-D<88e=4{`U|`M&z;0IyO@MVOcIpm?7|*Ul7#+epoPL!<;+Ifz{>+ z5B}BqM$@oi#5Xvac8IGJ_h>6g1<``h>^HoyY#NJyGTz|)n+TOq#!m7cP=M?N60+a6 z6+c*QC5YLPLe1k#g<0b^TkPn*sbe7Eon)?}n{e^%)#bd;?ytKQu(IoY#i{`%mCt#x>MC&b&C$^6A$3tD_)NX4?i?lj^%Y}sB?OhNH7cV_ zy}~mOBVz+(MwkAO*a{M&F3HZ%B{kZj;?-!Kzdt<-c3e`>`5q9wj48`=L07DKaUA zu#eg$_2|`bLJ`B%^TSI$8XM_aLb;PYTXd=|k8UZWgyngx3fRC|LXclq6BfXjoNYaT z%$_|kbrCm%|@(M(GrR z)jvzs9%$<8(Xk6z?D$t*QOpovLH&VKqR>XyzUyC4sTJ~7j6Woe$c}=a9rx$=+Z;!g zu-`mu5W0dT)U!%zx_;9S@cjTYROWX>N}Z?Ds79^Pp68?`I)ptZ@-h6(jwk|iC66g- zPavJGJ6lNyCik55hBXUK%{JTIVo%hX95| zI6nEyudCIkt0453>a>ELs#gRPHh%SI6;N32`I#?J<;mw!xiH}7)=Z=3%9zZ6lc|jW z9VMENO~AG+iP8U4SOfg} zQ$>Lf8IdzbxFineC5MtvY1mlMreo_cg_KwXokHl4U)P9;-XE%S^Ls(8ybYkguO4a@ znNs*H`0P7_qzwguIY0pQnc1M1PdB>TMt#%b_1yH%Ld}3ZsL%ZD#T0xq)eERy6iAR27`o_k6PKP{5MR;C`UK5SCjs~F z;)$?7kI+*on4an;g{lYpl_H0qP}opXjQo-4(O>U02M6l6hsl=s1MfvbwU%Z^vi!=x zAC@$d5Cd?NzIXU2&tj$mOwf`%whFiC!3aC@a|smP8w3eb zBGAXV&wND$;foDmcO!SQQgQN$S5Tyei-_MY{kl6Z^O2+Q>nFyLt!-7^oyI7##n;)nZen3JLvC2cznwb> zD_pKeXRujykA{#gf}8aUppH`lYVh=I9d+LLf6WJog#fpB_;dNaP@qWAS;Ib}Epc`q zH@ctP6zqbp@;hOzxU~yq@fbxjf;|}b2!4vppjpwN8aJaCPkkd{w+iG{1d36#hnHtdOSj>a=_S>LmA zc#TMnSOq3bqZ*uELqU@A1Pp}V&+zpF+(fb?cI?e*8<4~xiGRhNHfrxsS{z#1wt?Vr zHA@aSqsPw9Pi6ry3^ar*A<468J7d3qMZ}v}U3YWN-q?};HoEl08N{s%ml))DnHr!w z^dmR7A(Tqm#%fEw%b$vE8s&DGs4m><(-cyp0??!Io}qQ2|8wlO`&FNf6r{x_s9;DZL~{bRRk-j0kwKm-T84Eoy74 z^^MwwSac_D75XoU8XOlijZCJl0y;Q82%r@!ygb17J~aC775ADl~m6Ziy@YTg0FUBBDkV#%8nm$DUTnD5Kyv%ybw@e0O zAnQE!;`JV*_Y|S~uIDncUPj9nc42l_iNA*a@rCcl%RK@;4CF~5-c<+kH#aWOHzy&O z>*=%_Bwxdt$b$_H#UlBh7@Xtx@dLr*&Odo=12Nx7e}MBuW`dT#h?(BKZsgKyoW><5 z(|o)}6GYl-%u2TmUCF6!A{_S8;wGMN8BF|XKH=sxylF%#L~!qtEs>q}LJO>Mt-T*r z%tsNM!fx5A5WRn%Uch(E6O(p5ulcxR{4nq>l673P%u23 z{DbZULt zMeZSoJLYMx?Lk~txHFid;ZNPpdz7U3%vU}q{PQ`KI+iBe8gb>!aWmy%v|-dDs8h`0 zW1GuQ$S&+2A`v%*6|8n;tIFvS$TdCaD+I*k`mA3EjEFsg{r!VwZV{vKyjD|JgwMMG zB+Y$NxD6V_*nvfIf-`>NaD#}7{dnh;`SDiHqb8?a`5j-$9`=-WmhZkR3Dm~GprAr_ zj^nb6cy)&3E!aBkcZv3}_TFr@%Za|ltodl88kX*yYLC>fV6B}`w@Iy-=qvb*#AO2{ zfHX@rDS9J?l8M|UD+rnMKXBskQH9!L&1n4&KIIP#$i4`D0XJX1HFueLb)Wtu^<2q) z^hD$9aW4Np-W2a}LFXuhw6Ol6L?u8M_>0xj;77IpXF-S=NmD?HTpEBHS;zS3a}#{y zo5^VUQ3~J0tAGJa$#9HJEZ;MRZqA_3gsAAw>l4eai{6#4nV=9+qQ7Q)FMMdF+G9S zkvMkL-lNE*!zW-GlV^yuC}9)u`>2S+C;3%TrJa}ESBKz$lF*Z%5*D@k1>z{lSm?Zr z+L;aru{Ya1xWd9_s4U15J&|ll+)}P?LoWi`GyVUAV6Ue*z~a>0y~ot#HL*x?{6?O?Buzx2MeCn4jH67{#Xn^-tyoOPZY4-9>D-asg0rJ*#bYlPTTClioQS`^9gS_r zbJTwhS2Db`&@ zvFg0?a&d@=o73)KO1-*o{aN=xf#`BCYRLr6h9QS@VH-#oV_J_l={FPyZhM2-#%8MT zuH;%T|C+pqw#KfoHt4F)>JTc4Yo$V*rrOiN`V@8Bina*{29+s7>vKl=M@p}>wf;<^$+Edj53ydrGc#skhNX*tFjPl03 zN_YqUtePA+k}(YIzX(Fl%1=^T7THKkswIKR$Degl+!)!eA3AW;a$YR&$D!1uA4S|14TowjaCi7Sv0) z4DSxP6xU$;zU~ltR=E6NU70P3Se3Hq=D9hTcrZ35vyZpxfB!N`H%Z0h?f6k*c$4GCutMK^pKNxQLR4uzzoh1A2P~Ey=%$RfOaY+gTVMF1;OA{ zKn1o#G%nD3P>c#Dpm-=h0b4?6mlKul%h)Gf_H}PUCzPK?O}q=@QEOZeg6P`Qfou`L zKk}I5tXEzGM*#!^DD201#A_viSQA`yShtH!j;WTPD74MWa=e1yJCh`YtztlVGUD^t zLu7GK7Tm5yhhXf!3T>WawI&wuA*-q1BZO2)jQ%NPiAI+<)2+sU8mN}vj3IdnOIWjo zOx;I^uUZ7Lm*SQIJl_**>5HWGb<eoT!GB? z>PIjMA-qMtvjce^efhWjg$gE4ly4W}^?lkAWNea(5{LQ`Uu4pNI_tk@G!GidOK)kO zJO!f&mWRQnBwGoASBbIwMyHN3=|!-U8rHO8Hq3AWJf86|Lm1Uo7IX96 z0GXtt{l#8d%;YD=@SK#4{dnQ-8z9RuviTlp1k-}M$W6ZbPD(H#c-^BSH4w+2vtvGj{6ciBZH*AEn~X-faVKFQB$@Tp>lV33%TQ!YgvAahOU`o9sY839V_3tp zZ5{IYc;SCs2lDX6Ch1`+L-JpVUD0LHM00ueJu?5f_rO@1mo7iaCv$0p3)+GT+&M4- z^Me$pLG~nztG7ATkI%&C?EydsD|VSEnlA)DqnC&t&uDnWmu++7N*>?f3p=PIQ%hRD zEjud$B`{!Z5vN1C;3_8@%JzO}<0+ZihgbJ?4ZcEfz`OUq20$Ua9wGh4;3h zid*#BKl$Iq~%L^xn%#A*ud(79;V>V1UhTS@b&=?zvb{SZ_m5s~#sTt3peN3G%24&^Q-8 z$$@7lMipzb(dVsTZZ3x3X#qGB4>mxa4tIG8%NI3%T)_4|{yv5n|M#+#gu46Gkkc2B7YT``GV!qpPG@yR|gM9UHx5cpbnRg0cK_h z6ljrQkN`3@e^R}y)db*!hk1%?N=E^^TGLORxOcQ(9D(HCAW08`d5H*BDuu4RZu8t$ys8MWgqOO9J{T4+!RF6k-Gty z4Ek&1RQ(lwV>90jtrbA;^Juptr8_j4mP#k*9{dyk%d4Zu{CG^v86wj2Qdla2H*fAE{%DTPBD>EPpQ9ixfYoB)*UdxGhpj7vu|C znw}1FY+K-s#wZR0wpbQGpGbQ&?pvfz-(vN~`pbBLX~YVkHwY@jc-7cov35}zU3-2w z@yWk$dtEYwaK*_KKe!2|oyK#crEZ&oOyO!;cFFGRhP$UC@k%yJx)x|35kK<0B-|2O+V+O2cr@;y&@$ZVmQXZ@fjxUh3WBR7Ebwme@KeQaljC#7Zw0T(Bp=%NJ3AQs4heCOAopLU9RZLQ7 zL52#?gm=p83D7K1DVCP)D%*QsgLmD-iuI__e*V`P=n;H}rC||Lp7sQNOr(&@s?pt8 zoOrv1%>ScSB88Z@!l~dL{TyY7cuH@yQ$*0O^AosQaJvH`gukPHgI`#c|f-jpw$b7oN}?(8dhw!oREMYJ9)h`L?9Vv;(b;_=K?ssw}uzm_AM$E{i4@lo8ejA|9 z*&b-&8JMJ~oJfU`Ucmpk4i|?6m|Fl^hwBS!^z>K6%+=Pxh|$bg-^keEKiWivDJwSr zS%ZskO8{8o{;J+!_2s_1dXH6r-LiM-o;jC#8J#2?Aep1^>5%&t>4l6y31&r=Lp2LQ zi!}V^Drd{CcZD&Oj?E<~GH9Q4rm0#sa5qg%vK=RVLwEm&zd3C9HEa?w#cA1i6igvLvWC@rJ%RYS)WWrO34bcI=Lm4S$SSEuJW`l4MTE0O?L~)3_^Z5=h(w$^0^}hm#a=I zwW#*+?_WjJ4srPM9o}!ad~I~m8{OhnJqT>`=~>EpW~$6Sw}(p0cJt1!20TJq=p-B_1*2fmuORf4wOs4()U_; zDYX+T=F|2*^i1BbDjXStCn0$iAv(J_<5!+EeV^%!yRn%#dZ|eG30=Mb7^%X}IBrt8 zOACQtU{xcXxoOqm;>>sJLaL9eir^Z~#m0n7(UL~chgRN16j%;I$~ ze3VrY52bC_?E6DfJcFGeOA+AjRU~fu{Px7peS%{VLdM+Cy43j&>R=oNj`Z7auBP*u zm42hk<5$`oQenO}eTyc2vv@$;PbXnrg4Yb?IZYdEue~3YO`Zr{-NNOkwO|g;Lbwb2iqx0Qb?J3+eZ#<^#2FRV+9jJ_CP*H)`AbS)70RQrS}N zmMh%(Pvc0J_E~u1b8>4h8^<4do1F|#29%bin0*$cDi?AfvHv~F*870?S@m(2(TQ2^ zs*F4Dg%lpyGP{I!5QzMBZopxh1a9sgZ&9c1?X{~)Mb({!VV5^AJr7ZWN@5aDlp9qG zu{<36p@Bft9`ztK)(xb920n)|^ z11W<1Ux3E)S8NRgXfc^Ukf;Fd9YNd$hT~ufl@TLm{n+=pH9o%u&Mr-_I9Z|Vdjbqt zbMtROyAT+ePp=bhCcAetlAqS&aYmA56o7Z}17xZ=sV{&xkGHQHUnWvSObQhe$PY*9 zJeIxQ>ngT+SP0dn@xEnHP%%mq7+RT+1FDs~N)*-3hN)E{%GP3(Luiee@t^&5JIo8H zYB3u;D6S>wEbMMsqf&5`{Hr0yfn(v+OC^Q?SK<9f1f4s>vR1D173a=FifKA`SKib#9?PPE^~GXmdh;1ANPnR9~egm4NddBSbJ*NAZBrla+e! zN6^XkKVsBG+`9G-BB^Rd7fD)^RX50ERuj>XR)qVCjl*%DSk{(EsC$~3R}U0^?MN$( zAOs{DpK-DO_EV=acdV%V%+Nor$7K6uAU2CLBLA&ox~tRSN!L?~G4Iq*c$eb}t55W4 zptqCAjs)4h9-Cxqf>(XF`X4hTG>nYDlHoHpZ1 zRkp`phhoQG9C*icgseK{>usIWpV;mvZS$qG?!a-LB#7o0TXB*7<-p<3tuFh#ky7X_ zGb$~|dP^a=bEZQhybiAb7&;Z?^SFa+q{J`7JN^dh`9Law*Vts1mfn|vT@xG?j@dOT zKZ80~J9#V3(PHHT#OpbudPyhV@YN9;5%u^XwG@LNacxrc^8 z9Tvd$z25y$wN!4(<-vImn=&`RdTCd(`0bpdfoX`K<$FfE8TRPtgm3HsWZRp=Zz)sx zAUf<>S!ckSjlk6u#`8Pw?BIm}kSma2 zUSz3BLaDlCKbFpFlW`m_3DD^+f=4kOEnU)+nqw34+%O~#nl_M|k8T}EgjQV4Ql$xJ%pIjW@LpgY+ znBEwoTv`FpcPha9)dOah(W$e}k_G3Cdv!|mO1M6w2#Hlh1QfiA}7*#LbzqS&*?Qi^y zg5@5}(g9so6%V1sRWOs+1b1Js0b5k~-RzqfZlYbBgf!;E=CxlMb+8wdCW;!moo5}s zoANsM0HbgZqPCLlR06S^kwrfzjg)rY$)OHhUv9jJ`@89E7JI|E3k!7w*BVX(LQ_NgUd@N}&Dmbc;no>5eZ9Y)hFhjFeDXkAfoXoH`hrTIT zs&T|cnEdf-(K_`b^QB)(X@h=DW_FgdJ#h&L;9t49y>saEiCAhPR?EDEN&BTSfICO`xDl9!(s=c+UZLvzqt zl{xpY=5bZD&mo#WkylA8j8OB9eu^bhLDQICBHGc|M$cO}FJDIHMSyar)yJ9AxmNJV zo|MKJ3TIrg_<2^wB0(=!cRTd#Dl$>BU|7uY%ZYe5jW|x6LR>CJ#69tRqh_jDbh>Wl zWic;<#m)6PKH`j>6Su`n+>vLg{ju(&?(MlQs3`w$mK%Q?NBA$6`zsx8?C>v^6CU&z z{X*+ppwd*3ziNv8@TFq;)(ls{ zng~pzCJhVJt?da&i)|wWSH~FGaPL~fNqcYYLS^8Grh+J=6%0CB3xdL=F&0f@|CF5D z7H@CO-@KeUy%XuZ#)|nf_5&-iKHsyeu#9IQ{0+D{g%tz$yETyp@sl%XCY*o z@_g+kN7OG9z2)r5gdR`A=n%)HawLQAA?$Qzmans%;9l-Qr#btu3LvPPpU{%JkTAV`Ef=zyZ1)BihF{w5W_1mm|*T(5Cf#Lm*Z)^!|fDy~LVo#uob2_a%^u16hG@=}* zh?v<&4e!|+z!?|59guG!;W%g72}&WI;i{E|Oofw`Y{E_NU^r+SWNj2Mj&RW2j(_rN zdOCVN$lUVEkb z3{CvBZ7|)KA>l3?Y(yvNnOu0OH~v@n8&f16O^DX^Ty-3_n0f$|atV-U9ks;-eTX9`g61__$uc~nTv690XV;MR)Rq zW=1xS-5GY>j<_1qS`PoQZUpz=&4bWOhMk#)$H+SPCQ&jYWhw5t<`kM_6T_1ClVHHt zi0Y&>Tgm48c@1B%gmp zc09KBYvbnCZ9cM_>O6YK{t!9K|D-k(!WBAi_#9Tq$Ww9c5%lfILrU>Lh&cjK-ahin`XCKb;uF!ZC<+v9^)7_|0 zM7KZQXx7(C8tc($w?X?vtQ;mOrkUh7&3p~|LQ8{)o63!y%wV){s&Wa>KaE#6je0hZ z&Aob}jLPfYKMyGNaMzyHDr47|@QqQ(S&PhG1`jr_3nF;Z1K)sQJ-`%NWC#qz{&<4h zmkYR2!@IA*of7`oQx2$*u`XNpS?mn`Q8-N@#QY9n? zS*BHuY`M+U@TqqClfaHX+Qu34F;`n5DTYP#d{WQhIN^`@YU4CRm)J2!Lp0q{#Gc1D ztQ`v%Z>CJ&w)TkB5I`O62dT8rCc^-8fyi25?0tNT%zz-zJ&G$e^({w68#=kh=Ronk zs}D}U5hvT1nP&{CpN!P&R3$ zA+ReN%DfV^#L-31^)1SA|ZM8xkEF?A& zvkp;rbHE@Fyf0AayxB@GsLGKA+7bnF=fJ5sqi=)k-)1DB&oKMe&}lf!@y-}F|LUH9K!^r5qzFD^VTe7FD+HySPw`p>`-i`%w;zg=IfyF73wX@EQ{;!}GL&tC9Ei@0_zOyRA^Vlk zt7~mQDaM0+iOU{ z1s4Sx#mTVZpcBM8GfF9Q&f=OjM5@r2H2C(y&ayp~LiPTs{uS!IfUOqIg;WT4lPx7KNNg&} z9-@^#tn=ogC3=j^xW&VgV5>vM7`*#uQ(Lv<*p4{{Y9D2h@6Y~K-)znA4d3dDp9@$s zO9v-qkMl}?Cj0z_Lnx!4)yac;6#&v`O~;sDNr5 z)!b9HNh_?hOJ_w%1Tt0zNW^4xt!O6;xM!Et{9|F&AtKQ-6D^SUiG%RPP!X_RtSk&9MXJquTMC3Z4 z$Q<*Ph5y*aLy+f8ME{d(0w>&?KgXqK^+PJPb=>de~g%gDRr~ISx_ktdlGS`NVori`3xhM)KC*@cRMaS6Z_pFTI#O%~l z&({~>C+gUaGl>jEntDge3ATPZfsKFHq~_4gc(LIE1NFO{wxV7XLdkDbonT5I3$da2G9>kKA*(nkghJ?%Rml;X z{$y|=b|229ArFyJ3LR3|+F%4|wOQbB?NmxB+&hGW!UuNcx3y<H!`-cIZr{6Ngj~j;STO^)FEH(F2=)8We`)^% zPt=-$uf$gyp!LlKD>n+d77VmH_rgdSin()wn>E!58=g8Q#ifH#+=@oq@CN9uGR*yc z+kTq;RO5NlC~Hph?c>PjwmIzgJr3#6mD#Ag&XmtT`KOcuxxE$Sq%Z$3XZ@#)|Bthx zCaNQPfQZnWZ@CwGbsTbElXk)qi|~!;&mdv7>}3p>7Tb5O@7bKp^LnBa9y^Hcc5-z4 z7>iCJXb&?m0oBO;)v9)FUKjj=y8%{qNHXy3!$9Pg*moJ)6x`v+NDY*)=S(Ne=ZxGIH(MJefZOmrd!2?!uat)4XB2_VKvrWtuwZVHy8{6`H|B^Rf?;34gsfr!kbxgc(9kLT zuuO?M&>>J?5fNXN(F`m?5D_7s5fNYZ$x<c&xuKt&{ zr2yFf)V4hR0hRXI7;6Bfo>+Qd8i^!tnwXdvHb6=O7FLRsIB$BJ@(Tg_^mN|z^cN+F zX{1Oe*PiLCwvVpwF8VwDqd(F;KMvgYn`$4%TQA&wS-9=jF{ZMq(ct0Y!2X}xVvvAL z=Ak5;qyPuR!^H*`-NX6XOv=mg%~pZdPKS-u-IQtBv;c)=qe^cqHKH#Q)fc z$OQ_1#uB>O;;|#feq+#0aXgq9X>vT+<$W)JK6KGUvB+L1#A75TF^9Wza{&5}9#kEkw`Y#=|@F{6ZU_0&H z_eXKKJa)sfINg=xvN`j-vz1PY<#XnF=-Z%Fx`W`zg+mY%z8H!PJ#Ls%)Mv9+8t&f-7dv#30no!+!lApDTRjdUI4o%F=O+*o<5o*GLnoCT z3`?^KET(eqq@FJHy=x0gcCTat5dXck3;K!4Zg7sL5bo_sry3npe6KN`AY7_MOn-Se z!@y>vj==~+BMmVcN)UC}8zu*NEv41{MoO-pklV#-0BPqYD8l!#gC@ShpzsFi=#CB>+O03`hWv1xw+ zjUVl7V{8wAunc}1q-&NkmdQS}Pp@V4(qN7L>C^7z`>KL2#L-OgLR4mOvVW~aJV^q( zwWc?>p5?#o+XM&M=K)qz>1=;{sHoB5(+29>WczfG<7?JicL^7#_?d|2{k-Mc=4xAM z_lGN)U;qGfKBYANp8?+K2s+udj9q3Yq-v|_PJi_ELaAzvCjG(q562c+_Dy#Pkltsi z*VDD+5wme&l%_&hn9x6l0%WNg8R$+w$3`GIHGABZ{#LIRde>}HVz*lCEZt@2G#M{V z6AS*CO8s4PIEA)2xO5;2XJ(0_k@w$Ohb;seTHz`W(*i6;oh0Ltl%eS&Y2&it*r(eg z6>9l7r*26^QJ5;;pv0 z%BL{uR^Tvy==_n(=5gQlMCCLHg(U;!Am96=VTpE81W1)_AkVuI?cev=C=D{q70zSo z{jxWU%P@par#0>KNZVnfhXoaAae6Xtjt>n;?IN5^K6_Ppt%m5|81dKhD1^6@!tD-w z5u+Jw(k5eB)B~|ZC~p`GlAYubu;PrWrAf2DRi&lMgoF|0UExSw|A{wYL157t@ts%u zIqcTUWHZI`se7fD69wY2t?s|@Gs6K&MN;JT77Hnw!<{&&sCxMnry2ipcxNW;3Kr=8H7fkA(a)ms@i{ z-qCT30>uz*fmn3H7>zAOFyOZwvCV3u=K5HFG#-M3ozg%5DnU#GGD1vrkfNgp!*M8q zoY`Sl0*=S7lR{Hj7Tryd*km+KsY&Xy`BZ+e(RkKVABr~VKT+C073A6{bkvqNIK%yI z(MY4kDt(8bKHpQ9$6vObfPC>-hGZJmgp_hk$rL(`?xg_Tf9Cz;S5ORFdq8)lHJNP* z;oRR${5Gm07O!=chf3gUW02KZe*V2ILBMo?Y5+6-oY((1RTx z@0P-6CCqS~;$YdCbEV%>K>;L@!D^nhlCG8bFXVCin?=@6>KrBA{BJK0sXw?~79}i8 zr68VBFK=!VzdD}`f7A6QmrSIXD^_gyC+6r$gM7NYSw+C*rS9=?PG9z|vcbPWB_0q( zzIk!MIF`wgDpsoLk;Q2rbrx0rPb<_DK=+ZtLpPE97qk!wdDMMg?!E~k%Yq7mP6UV& zrJ{s;g0B*vRhbB$IH>=L2kpY36hb=}@I2b2Du#iZW===&;_qvfi zS}xDroyghvDy4|=&kPoZoBU-?rE`F%+hP*!bg}+DhKT?Cb$m4t;FZ=%nd3$BgWEM_ z7aW{V#$TB7A91lk3_<|Wn41#i;@ts4UO@8LUt25C1lna)Br7*^{d*%mkJO7bV*Lw+ z{PzA{{rZc?>tprn^#~)g(IBe(1$9wbb*@FD_{@4it&R_{osq9j#s*S1u22toh+ofoUQyVj(97?R38^e7CxxxP0GR8_tzX zSBLZ=%%=sE}z7ByHo_DqO!3BoYcz-mV z+#6IrDbnLGnJuBIO8l`6j0Hhnk6_IT3J z-Qi^EnzF3$r7EM5{dzH)poRj!+5c6Hp<`oHft17-qH@-Ken;c#8tnae=^*k!Rgo(G zXKlBb`u8q5U4EG%U&sUzDdUs+RoP=RDjt%{XY(w3Q0zsAd!@EBz}oWXURRM&o{azC zuHQRNXK9b=E4fPbxZpk7=;%mE=qw>V4Se7BZP zJ=gCOgOUh5CfzR_rtf3cM+72SczwpnWsV0i1U2p>m`gS8wI;V-r4cxaBouzY+y6n= zS3gAk23sR82uMgucXyYB)B@7orP3`8(%qnxbh9)_cPo-of;0jW(%rld-+O<0_5K69 zpL%A_oO5R8?lGdwCr(q!#juWl-pPNV0Ffl=F{6B=OB$G}+>aUPS>;x9(94`1m2!~6 zWLTDhr>V#$e;WhlAvc)L{V4zJx~mJabacA9hakfWHcYLd;{E;Yxo+R}LBn#xKcj^v z6*#FQ(h%G#-^=yq1TdjaQen@0r$1+QtO~QWs-NG=G8B|3KWEWZzq!5L6(%RL#K@zK zO4H`OJ&x5ZSb%O5RahmJ>6p%Z&-tKMAe8;@TX{%Sf}~XH)ppmr4WAuXp(J{B_G&Oe zLzsgJ!}Z;DDg|~3Rm3HP6jqCbq!#M$^mDx6-QA7HapGq`!~;@0;6UfL9G7(1`*$`g zdq6E2F=$Z|8R{I_V9M(DWUhCbnD(VKnJ+V$_eBmh22$1j%l9vx-0}96oA{rz=~72N zXG@YxX1(l$QIS!$hWQc-X{+YTU|xp&Gr!1ma)a339DWB5^|&1FV~|Ncq_O<;Iu|N= zTlr?gsSn9mw)DtUwKWuuvB-Y5R`vl? z$t65L>Uo0EYVLp@0|_pjb=xE#PUUfOz_9x#@>phgxCt4;kRiO`v_Vs{V>5}xE)0>2 zmsUSYX!_Kr-u)(ZK7@Q8vy&-iw_g`O)JiuUg#?Pb}lg z|M{L96~KFV{tO^b9nZUqJo1xyEr^tl6+`7v$y5olxD!LWtT6!csg6!LC@LLZ=M|$b zJ1<4ePAp8SnX&}di0S`2aejRu7i{%DYOXASx@q?L-Ce9=(4BqWFGT7nSI!BTEHyF$ zC(dHYU)gB^8DKlh`zIh$CFDuRY%aFr5}ll%C;Jb)scF5+`uCTa^6=$6xy%xDd6nvY zSpY#q6l@Ij<^x+xE0UOMOnO2-Xo3y6aW5qy%K8>lB^n?db@ZDh22MPO2=LC;*|TxH z?mY-zc^CDM!(}WBp0=O^Fc$x$R7m5-T*EstLq7BLD=byLQTBNKU# z-Y@9hQkXJIL})5(`9>`W)QmJCMYZ_WpL5Pj^vXlcV9hx;FQ0y3%Mm;!k!J z-qDz6UcUS%Ra*MTb}_^Pt&Z-**nhoAIArZ45Cv9<3DtS-!RXt!KZZW7+*sXLa+(fM z+s@X;M+|Ub_xaIN8&mraCbJE~;;BrpDmwMq`e=O0^S?j$Eop7aUbXW;MB@@v%8%d#v zB^CahaTm`Jl`AHCw!=_oJso4ib@$K1lZ_1?xP-ru+g>_1%*Y6xL=b0N@4Aw5!^nF5 zlTIEKaHLF0w@-R8XHwzb*`X8h%A1X*(!etJ6vpKh!pNVnO$fM8sH|)M4Ohx!!1KP3 zd1Y*zJ$e1>sTi!RAu0VG@NS@xMN626z$s$@x}~8g8o@<$!G-vH^cwztqiy1x{L4#opBcEC8s};{iU_U2n}LrC!E+ zHxt>|GzHO57HXor$orJaeo+EYdfb2;N$B* zfhi*1o?8LQ_0+_p8I!pzTBFu&I2Q_ zzZyn#Q<+W~c%>|n#Bgld{%o^P9DwpkpK8p;sx0YEc@_VP8p}^1@4vtV z^l(Wnmnt%BV=aeLIMxAmmSi@ZCI{k}%?or!MfkmE{7zT3wQBcY`ZjcYdKJp8QpPl2<@VME^`ds_We#|^{l!Gmg_gl60xqE+MVTZZp(+(BrhSop zDxC9~X{9iYokcHps)KPOfjQji2sW4X@1iL zJh5b=tWzbLiGQXm_0n$SW+~?1Z&sP8=1PVq`>bSvD~iE#zc|Qwh-8JOads`TeXkPV z!WfahAfvUA2yDy!^@xoTA60T%8Me48l=vKlrwe(Eqb9MQhX+s`jK50bEg!UXkj5hS ze-1Gl&16|}+oHsvFV?_YU{%+?Mk*u86}{ zQ>BA|8?yLbyCNW+ST2`+<$JGXX~V0+?m0<+sh}bG?~+4Ov6D%NCrj9iwp_P9p)c~e zw21E0+lYA&5Oxy*Z=fr~R05)b6kKrNY^@#3!@%|7&ey$R6ssC5*&k@+W})Vcul~B} zm++ai%ec^CAMfjd&9OY;;gR*b53~x5Z@$JPzP~(fnMZU3b*MvBCt$@2!1?8b7PwbM z0!Dq18CN`uN*cWdCNKQ2Jedcvv7fv-oi-{MbX)SkNqv!FI+CtKtC&g+Dnhp+f<5p8 zmZ=})>}XSX?7D0k?HJ##8qOE zrqR4gIB*!Pa0wN+7))Yyu{Gb5`p2s_l<9PZ4tI&(Qvdl;QFoK$r}evEB`^O=QI@Wu z7NZP&y9~Kut2?LNje9Xby(}S1iV88r!tZ+VnpI{0jvQF*sea`s2<7@ss;S&|Hr&_^ zbFtWTF`Cc%Sq+WtFjCOs{GyS`jZ8z&c1`!@o07<+9xAwYlnnC~@h*;DFgNu9duvJ2&Ud;+hrE5-A}@%b&{ zCX4m>c3v`HJQw1b*=ex!%bv%lEJWW;OB*kHeO#!XgqC6~gUBY%IY z#h?z0Q@eJ2gLOa)uU4c0wz)OPX0>~--Q8Z-)H~+<@J4v<^5mI5$ zLHh)qI4(Pz+~aDe_<=J=)D_h_T)0PhV!K%TZCucPzEK5K9`sw|1vRyq>M{SwCqdtaScmScI|-CVMiQsMq9OH(0f|4^%mJ^C)> zycvi2=10LWnEI#yB2+JNYV-HEREsj%Dm~Buc%eAiZQs6_BZFktq{;{p<4!n%D&G#0 zLsj#CoC$|del*dk)|!<`Af&Yj(dW6HsIAnkeu;hVDNUe|x;yvjC0KT{e#^OUEy4fp zB+TZs`(Z|y_Wi|btZJRrRG1I%?X`3)sq7zKTN^dYMQ3C6zrdSJCliwP2+ZSjTf=gx zz0Gt5{Gb{%nvg~+60fc-Mm-8rCZ6rOJNqE#C}b@8+z&Ha2^2hORk&ud??=I9A=jA$Wuv9A=F!H@MEkWN&|Ho%5B-N=39WGWY>@U$M z72>s!=b~9^1NYe2jd->2IY`8oc&HzskYiRs|5ba?mJZ%dKwX6rASwm!EA3 z)ExhD-3|$UrctQ}zdpaaSTlFo?oT%I*`n9717Gw3nZJ6ms%(yUaBWAu?OdUTWCK&W z`{A!|VC@-=R0K{EaW^Q-@+CsilP05I{X;$Q%Y-nSOuh$L*?DhLmQ=_+dt=7gx^&WO zUlx>i&epML@qU$WA_#i4AXG_@lXyl;R`$BjT#-q9`;SjwjcDT!o(HIx8qG^Ez~0*-4t-EMu)Ha z>WmcA`6-fF4N%OPyu39&t21mJuEr**UtOL4IihMCWbv?p;rtcy{6rw~d{%b{9rxb= zTYo|j9aG*JXSqJ_A&8!+5br0AwDv8HE$i8&rb&WRb!=9#Nb|Hmu_>oa{Oj(k|`(Jz0?f0DQoaof}HZ(h(6bl#x{ z$**dS9WYpw0Q}bF+kt!fyX2XtFiurD{xO_3UT3Z4=FDfa^bnmcQE*YMv(P^Jv0;Vb zGHLc#WeIs>eYQKt4f=sW!YeI~iHMGGEYJpf_SgNxAvel(a_5;<8n&$s ztPk#OS6<(NgO~`2{6CAVMAVOr=p42ui=RP&sDh$%9)gP_M#$w^d(jtT+q5E|$}I~{ zs_Fmr%MzV9dA~)8_y&ePaV?C^#d)h0DYA&xj5kr({G>bZbyv~*PN9LNi@W{uo-I-zB_JZmk4}K=tPdYl)J?Beg-Bf<+Q3VJjNmG-# zA|f)z*D<@}HCjrQM3>uBr4nD%TeT14T)tFw^5j}? zP0=VdU=ohb=Ip^ItV214`{vSm%4k+aYO{&WU9t$!S6t-0_KWkX=Ew6*PU|&-F4Vqv zH%a4>|Gb78h>+Q&3g$tD0dio16-rr*s(v;B*ALf3cEcs+&ZWBbdD7a3oZRf*UoGNsLe7R zH6Tx|gzpjW<#{#Oar$-z$e@j(^L;`48{NuuQp1zhu%2vNw#Ciz8u_vSFu{W?+(P4D z^QNEjoeqGxe{(H;afgprCDkbxB=B^FxTDu=Q}msAB+2>ubo9FqK`qf!Bt{;+CSpfoLK?m4~kOYqg0SdiJI zL((Z6Hoxb@4VORjY&YL0CE&Nn7Vm_#W~Hjcv1Y$axRCOeX<6SfM!0 zD?K8s{+(Bi*KVHv;Ip$7twLu0E*=gJHJ~=9e>?;WgrnyU1p<{bMV}b)aa2ZBY7oOv zcDuIFhsOPH|3TgOl|oQ?th!+wuP+?5T)5tL908xnI->@vWm@zVuRjpSOW>I+HW-CG zj`9(|qaXwTy?gDbOUQL6g*U$1`KM}=+kWN`#l!)P_s#5Rs8fN6XrJW|>40sXVhxJ^`rUUo?R0Mm^+(DXkWfOytMVJ6) zNJ}pc<;gi|>DmW3^Qigc|Dt;*F?NrMQ>P=bI+zmS@|ikP4#?){k^b zNp6uHOn_K(v}$#4YymQNeQZZZhuZaa9S13Qa;0{KhZd+by35Vnc4u)_qi8`;I0C!6 zTBb7jc2M^Z07iJF^b}Vijn}1w+iFr~Syrx^?olg}VY9QWUPZBWzlMel>bXJLQnQPk z-BJ^kTh)Afx%V$qtdLjCU4KSeMRKC;eax=~mW%mbx{)bKe$o3E(%3Yw^6OT-q=TtwAB{d^AA*HH{nlvY zb2vm#ytCf2-#%doBc4xBi}zE59QYyhER!AI$AzE~3fAp|vO~OH>6xfle{+#0a7d8@ zl0gHbbQG<0@9c&79`UXT{H}V5`nMAYPq(jm(|4yt+;Ip`@%l4`y-uvg%UvDX(MdQZ zuZp|HaQ|sG zn#zyHapb*KjXe9r@Nu~y;eU)3%L4H3crRW{I$DObR2O6UeuEy)sS- z7( z$j=w0GAoo)4+WE^N~othh5z!vB2!XjT(irzplSaLuQMB@_@HpCkTRk+_|;w{+<=>n z0a2G-#+g4jh6ZGs7s}K1yYu)$lUHYd=n@$=Rvh0}AKYpR7 zAmw8^^r4-tPbi^3-kMYlz^BUstC@3^hUVb)fTDE5+Xe}9?& zP9DiFGz-{eO41d!i5Ch-l!Tt_0*z44WLekxY~iWNF-T%Rl9nH;FQ&Hve7^qhM0cf?;Qf4#%q3kzr0bn8Y0cI*E7 z6w}fCZuAG$?U4{pmmW5$%)xu-FE9_oU`5E&qY8I%#9QuuYE@clR~@8e;5g{!0)4&fMPMuW z;Lu1!*Bd|*OmRvF4=qo8%0+f1ZBS|M>2GpBd~MtH7#B4iiKB0@NW&~Dn(zex{eav) zKw1{SGWm3TcOhXsnct`gmucLn^=2zKHyQ$e=v_myQGY1H`p0SrnMajqvmw| zvROY_z9qhubhkdR$;!LltXmLBoFp<#E1fR;Q7SuEAE-QQwN3Gpk<<6?{h)h{Zg6;u z=kojgQq?RRO*Tm&jgPf*S$=m;wwk#;d>QAucO15WYPx&W`}H-0T0x6i|@s2I~&W1@BBh z37STbqeYD6mZ}^B7iH2wfsT&<5J+UoGM#FW&t_gL{+lorY_9IcttXLriy2*WFRlgL z7WLJR>R?Sy?M?n-Wkkud zWe}tt0(wY8hfC`uXM@OmF2qn6Hex`bYuTq1O;}X{RcMvhrtx4pI&;~c|4DCWlMLym ziMu`Bp;#gl@RWQig>gw4kQkZF8gkhulShjhfplFJFqF=t1}Gqk_VhmtP@BJXfS?JpSuBH<&X$?4m?4-ycuMpmv`o78-PW&yxGZ23w6hRD0@kX?L{j!RbEnO! zoL_^ah|wC_pXr=pg3@hP%E)bu(^0T1`u?I7vVJXK+!r|WZ?_#ihw$JBl|6gE%->n`!WB@Nt=&d+8l zi24-PD{h4!(F9rM<^+_AM~6JYF2U3*sq|r*p2cD6Dn(qm+k9ZqEwNhcB#>kq8-^jf zy`<wtC%-Mdsz<+1Z@g#L_yMt zY((SAGixoZ2J?Nexx0?rtJ3UePy0CFUrb6qiuwdgiTLRlaf-Cu${9zG@It1#jg9I=A1X<@tPd9+1XtOh2{ z+E~qp)u6@IT5B(N-aalX9Ty)?(*T3m-1Dv5jR@S?YwUD!Qu>W&Zc@+l3V$!;F_P*? zJ#&qDDChX);A*su>TU+gBYiCLe&_Ur)-rC!Z#ixqJ)3~>(CiDHh(fE$sIyL2G`+sC(GV@Ozw zLsxNt7ZQjd8cohGWQTQm3RKr$9qD9@u7U873~YbMj4FCMaWVp+^iER7genkvQ;Oh- ziHRMpCmRjKbp?70(%JL|mE8_;U;$kS`2zGtf zGFp#5mh4-iSLfIVNT+MuM9nmLC_?DMc7Q2UEhHq5QT9$dv1j9$ zO(gk@WY$`Pfn(xv9yWw;$DqaS+Zw}1fT|S=T+)7ge)|op`nBPw^rm;RF6*b}2u-CfGRFSTB86O0wRIv*}%vid!kd8_K~^4rKeD{fJ~5|=8a+|9=|+W@`KYXbtA?5ZKa46oLx&8(_G>GUKHobUo;GS( z(_XDt!7i9}Yu+@#6+&tg87#5#dq8-G!__2YG;s`Sw7X)E9-|u9Xh25s_RbU{Da-cn&} zDGR&+$%EGFAomaQ>er5oKx;yOU{tq4RB)4^4x1o^EH|O|Jc_i_UUgS~3QqW#5SNO| z3-@iX`9gBr*N&%=39bkKetAf0^X#H*9|lDsWR0QFl=SswFyoHnAbv7_E?cwry{U9%k;96SrJ)l^HUY{x#d*vER;5wtpWev^jX&+JR>}>)x6A?XfpFp-Tbfs!y3)< zILA*-@UbSeIKGaMIO|%IK*WG#oQU&hjqZoJ?{iR*PBafP-wedZ`57QT6lB0u^ZJ_w zRtqPOp1pi3kMbz`qH#X7-(wXTJwM`Ye#T*P&xQo7395sS2jO$rQXGcg!_!BEe#16b zrEXlu3i?z;6Zt$%^j*QD68Mm_n3^C}_3nDeGRt(1#FJs{XB2bnug?A~DG9o5?ak92`o2 z;j6gZ7D15nfEG`!rojI(23W0`p+r^pKf3x3pIP@&-R`4!Fv_R!9xQLFCn`kiQcnY0 z7J5O|heaz-AC5&cF0#tl<0DkJjJ+Y~6I+h=9;$ZF1YD7En*(#iq#GB$UL{{DyhS{6 z6?TM_HMryLaY-lKrq*7@ai0Cc#^^mr`BJoSRGq0on#Qg@`iV>WbxnWvf}$g^ff$Ox z#lxX(Pseh9{u=SPuZ{A8H1HagHrCPiFqTLwj*j#^X_+R(v;GSg!5+s&ZyV1A>9PER zJ!$cQ#JuRiP2fgN%l74q3lS&1V4)@D^W?N`5p124kGKRTA1|GF>5N|x4&upz_QaGNIq`lqh0_52iO6)MOQ&^vWfI)O^Nn==V4{>V?`CPsI z1mp0E89`7tswd5Tva4hR@X_#K`J&(_+X zvhcIgBWe~p6NIw9%Q^209D1<)!FbzU7j!QHOsY-S*u;F(3YFlj&G4ezZ*ZcvN}~s|7eL(?z^>M_>q~kKEnA47N-`*fQvUOew9O7Ccb; zessv4jpyYNygjGmR=_u=XF#xn>N9F7DZW6Oba zON}rBD2gB_9CR#g;w(Sb3=@OGFpbxuXU)j6S4qhZ_kKTPv}W3Sg8ws0b8i!l~&`^9@$>4-^h z8!N%@w_jHfBMFf|ean{$|d%ud>|f*`6O*;&@F9y)*axUrCeCl8O zqRs1cyj<9gNSp;ey~w^~BYVfbHAi8m@Kxf#f|iZs(k>Ia%vGMF04oyqymTjQx5^K)OLoKRg6-Mg$w53PhR7M?@hOAGru zgPv7nki2k-IC<7&GpXO^Sw~ZH)Wtsr)sW4N^HYHk^4R1Dzg(pu{`|i0ooyk8z&py1 z4NIOc0AsQnm&QezN83#v0Sv6xKgy6N*7mu4rrUv4(mQ3};Px>Fe51##EXs36X5h#z zroiw&NS6}J0oP?UwHI%W9U?^iQo6u-ZBssp`O{ZN6EgyjJLR7XHeG8PPfg!O_Ycn4 z+(zw?ZNQH!8)J>4b_Kr6=?+G~&@WIgL6BekDd5bKLJ?JS5Q4so8GS-zJzbFqT#VmD z8IxmlhE~eMtvQ4Q=^r?HV{U)2vtqFG(c`E++U_$G{0FM7!1)uWZZpA)0>%gnWh90W z6}(8siE`VJ@EXu3r>9x$HAHxdZVg3xk;x!f{M;#DFnr(-eQveKl^4FaAX5gJu;rlaM3_7LJae;|&|0XMIlpxa&< z?wivBb)mW`9{A~(M$aW#C`qtsgV1lUD>WsIlivw-3J=(b^%AEGI*^3P=$~~!-?!lA zTh&<|y*ssF+LR&ztqx`t@p9M{yj=mrvHe~IpIU7?=bP7?rp+X;TlLwI=2jkA^na%? zc_$04?Vwuf$T8#IrENLiNm9v^{$}5CPkV5{DSq(mzHh_G0y+eGt*s0?Tkxi4hCi^S z@i+;#E+QF>X1t(F={=IVRKVRqxv}T$`M4_0e|ewaXnXv7_y{0t>lLeqhBGaEZmM5M zl_Mc&L?ztMCf=3~n9SFhD>>IOfx)Q%GYepth$nY9`sywswVYJ&ZJ5e%jln~Ogd_n+ zN}qWaC&riwHV+NRCw6$GE2?&(B3eS&K8&{cbLb3CeR*uO#rl|f!l z{B0@5PxG#6PKy1fJ+#0{-sgvwfY}CvX4+(p^1g_7?G=G5uLab3h$9>&Pj}jG;cW(I zE1N+*KqvNguWDz24XC!iE6jQQd{GW=`o3(y1K!0d?uTRk(fk4|9aXc~tuu2#?K<#i z9brpm=)>9W>^I=Epxjxc$)jbiw>CPWkF0tU=xb4kHK!`mX#wBZl$*4BQOw-(> zxyv0!cR|%8D@a`d-Q4lR?Iuux)&t}qZ)WW(@cg5l?#>>Z3`h|^)KZ^CV@K|;8X=8tTyhkMYb`+l${hw$6#d=xiq(sluFl=H0@5f*w%lVPk>=OO!ywGdDcUF|59}Ex>6{&SW zdq-oA1ig0l@^KZ7gjaa8BYu6^v)mvD7N#|!sMHi6y-v9aH3VA++fRj2XB{QVzCj{t zhR^&qPS}6}pX_+UYli~G#I>JA>c3_ZD&%Fs)$ntM{8-D$#%eQa%i?$4Ty0+>^CIA7 z9;;v6qiEn)2OVji29fuwv6&-Kod$Q2NZAQdxQlj49v$H_<)=n;N7?2|r_g=*BSRL3 zBWa>0bRVS^!_BWHOwnM!fVFm65Z5^f!GeWXkE%C{2sN6+giaj39ON^rD;lOHoLjhK zakaALUD+j}XjKJpb2J4IqcZo4`h6-}Mqrbm7+jS;T06w{xLK=CB16S3uZ9JT%u2`~ z1foXavHM9yk}Bj%tNpq6hQ?wVyzYxC(CCQ4F4Cvud`bcNAJrsPVCMFDMTDOehx-N3LOUtPplV;2QA=F_N8T~OIJXNLw7VtsW; zF9Q9ZwPW2pf1?<=wD_h{+1E%iB_>yFQN#DUT)@Jr3*#2?t|kxT+WF(HqBH{2`Juqb z4Igm)C}f~Z6b&8QE@sK$@f9#;1U$?89*`?x(7sRE^zQe#nNWbl(`WBc*~D;gJ#~~R z>@SbjRSnl`k?_`1gj{b@mRIoqVC;#;6^&*NSUXN~oX3`~zmd>TS^!6RBwAP`r0( zULRRn<`B3NumuC<$*>}}-D^NkVXt!@?Zs=(L9M9Neu|P%bLY1kG~#8_uyn(mkA2eh z!oJwH;!oH_>2bcR-x@6o+9U|6gXLCDw;venqQr+>Wjl+IhcwUC<+BMG`X~4#Jvwsm zX#jPW!aSNsJ4VQ3^>*``6%02G>M2>7qSp_cRDz<6$faj7kN?6qO@zyq+-{3Q|padhn~c0P_ll9ind^xXI2%e zy9piAcH3AdM9lWZxMc$K6{e5Oy6Q+touQ)o_`}F_Dpg-MS=I&jN;;8JK|=zI5CR2b zIM!W5=H{iKPv9Y1u+w`-O|&nouC{Z}8`+5Aw(iv~>?B5AtmU?SQyEZqBx53;znw(qh2|9+=~#c|&qkFuOvME)tn~cB$iz6&9BSyL zR_|NYZSwKN8$hWm&#(AiFt$7N-2!_* zo*p&qoHW7-^3bij{tHM|^*J9~!nAW#CYs)?mg?nQ=mWQ1KA3zmUScXYd^swE2Smc( znJU&>%t5gF1P((b+ndR$qfv3-f#7s>_g1sKzF(kqz z9zUrpMgL;~PblHog!wh`X%61!iA@MM%LoVLI%<@t#{)A=)3i3ki%o4&0VZ_+4&M}# z=CxxT#4Ev<2SF$6r;0&-6=4k-FO;L}D5cEIf*nuLw|w!`2)_lMz5t;J94v<*xbe+l zbrmE)06HaS2U^kg3m1 zYu?qY=?nZp+!}=q`($Yw1bjIK6ChjO^y!Zy( zNR0#8^-+YPEm8ryyKqcgXD%C}PtKoR__0^P;$k;Z`<^o%kiUWVu>{|};(S`7f z$cPE{byKN8GxdbrI}$}h`h0DPbu+1x)J6DJ-pp_&jfyh237gSKWb!K<#V1o5j2Kjv zRQ>)tpH;A@8iw%JmS8%iNfTDt-_iSs;o09)p6f_njxO_rmAEmeF-VvXsHawA`}Qn{ zCu^1t8;2Bz_5Q;CqV&B4pH;h&e7^S=8xcRIh>zOvdnxMveXBJo@?4+YE8%wwo-Hca z_m5MCE)AQ`(ipTRA7237iwEN^*D3qweHZI#!XHB7pL7=VjaregZ^Uq2Hp^O9qMxN> zlxtAX{ioe*N*Ui?oqF=%7Lo`t-Eh0JJ6VL}{8}V)7yBv-Kn5^!XZ$ zPh9i%G&xBN53@UNGsYF3>S+XB3QOXYjXx7|rFD}r5|39|`?zQ;Vl1&RrF(xGV4AZB z&fN^!KO&+L$<%F6t(7Jj$yP45fxVNsz7=ua*XO}RskV4*?x{Y7M|<+=>?%!qe3M7< z(EO*U>G1^IRI{;5((>ehqsF}7l(sAj)>B*9M}yEB-15#rnn1vb6+0dTZeZYA&>P?=Lg9%}o=Rw(!Gge|WI_6NWY z@df$gsy=NKsv5q>75BdMa=V948qT@y&fA7ucSyn^NSR1-iu0BtiK8Glio-FS`Y4Zi zLy?8TpBE!_8#~Ux!k;ncF_(7@@E_^O(e$}UMYOA_i(G9|X}PY8&|A9z75sY3Bsc~POKBM??yfvb|Wb|k}H{jZ%@nRKvk3(LLVLeJ)CAOAf=$v z8!Ff*Q3%>&l%nvzI0gMoWf|1Sq{-{9877?r!>!f;bsYlpx5j;UsCq&Nx1S$_=wX%X zw`>=P`t0hXaU>{3HR&9T?|mc|i(Y?;lC69fh%S=JrB`QVD)R?OPf_eNi4-KzG5XB? zv%LkPKFx~Tc~y>D>j92w=+39MgN~&U@;8S%xR&9s2S5M`eo3P7y#@?es@U27E&>Z6 zWk%natQGgq1_b}NH2ZdfvX+S~AS6$9d){kS+~Hhf`%O~`301c;r=ZCv^Je5Lq-l;9 zza6*;dNhPB6?t%QJQhkOdx_B45ec zP{E?ts5}qqmRBX?jA>A|gD!63$H>>jkKCUTzxo!#xLaVpr) z^_lSDty>7hV}6P6&el%|wcM#XUf}H0_^r)pyY9?mn#J{-Bfl|kKG~x7ZazuP!TvG= ze8fRN6=Ovm+S`nNdo$b`TK>Ekg%0DJ_6|ca40dM_$CcHK_4{H zA0DuZ)C>IWv?fNK>zY$&%|tLNkmAmS#1P`%@{qUrm|DM(*9!eIVNlb zS-q|>&W{PAOjVFMQ1C(*_tli%vw#@JO`ufgyn!mH3-i60e`ez4NnH}0v-OA9$a<;~ z_)FZ{ets5?#C~ZvbNl4XTFyd4rHtM?5r>dP zEsOaueFUqKzAGWvqxvL7YZ2LAypS`Q0sry?^=JwiM*IyGl? zYGHR~>Q?mX;*EcD1}S`?3{W`gs@|?yNRHb@*kiw}rW{gi7m^5f2#+G*wE8lFO2B3D z=U~T~htIGJ9s%L$(bQ0ifP^cDR@wv|X%rsl$-$&1Ka;wY4CXioa#LKoe#}v;&uue# zQ(HsueHQPsi3q4=1GbBCR*|WdSLhz*UzypS?nFZsge^f|>VYjhbj=pHlpA|vKr?EW zr|}5_3UIO(NfMF@_k}riYurYCr)l@}9nBK$C}ngMeS+LM$EQ{(|L*3(@yWS^O$`?w zXY-3fj)u>Kk7m@A)jfduvbnTgBRE?kH!3u+%N{g)H#05U1VYu>*mQF9e@9QZDA@~u zHv1YzM=vsR2QW0|Cs?h$Gkcq>N)z?Vp#Z(z66}Xw+BPTEh=ibPXUYA0(w)Q_qP zRVD;1qBI?2l3(Z%9ilpe2`szK2zesG5Ph0B9z9-=Ph$5}N@N5Oddw1_!yTFx&KhnD zXV==nnM4fi&^r5R!=sHswmfJoXTIRa_^TRQ>t`=DDw8E<;+3!yr%g78(rIemeoL2n z&}YA_ngd;%+XCu{#H3XsA81Ao?axRA&3Fr?4k6o=15;d9zt4b)<%7aPeybR3arbK| z64~$QY(mGhCR9!#!$$Xb=x|u|!>fAq1W8|g8cZ38=38XX)u|^y_Xlk{A;;xjMh2Xl ztqz(@_)jYE511wMT56=bPj{X09a#KA1tRt-Gq8do^ArbT(qvn9lR+Z%*+c~@PKk_I zZ|ljk3hDA|U%_RlEtDZ*klwtaAW%9P6={uyvxCT>#F`Gz@=!cRMMC->mB#*VZ?WdZ znpZ{ZD>%bh&=Kf$`h@HbG3R2PN&Wi=*0k_Pizth)CjtLhxJMr!13$IRkV)nD-n`Lp zlSJIS_i{ymaVH$Oj8P!UWvceFpEwKbc%Gd67$%zYTJQ_k&*u}vHL8hZBXsonMci-a zmorQ>$|C#)V$Yv0&7XCGBlLI-R!pa|WK(+4vQNl)5a{oZCHy%lejj6z-|W?oG9BS7 z)v(aVI4c%2RXN{>XNRcv7rc#tTl!9Asu}d~72={D?Ts~y2)Z}>fQ8T%e9L`agu7jP zNX;4puq~F?L1QS3wakmlmt54*M={fSQT(DOKjL>me~EUQA0{*}f${5$J|{@juX49T z3av1FN1yJ_5I5@xb0qS09Wd|8Wq&BlNy3fhXZAXB=h)+YsOKPu1~HRr-fzLDI7mkc z$z~Rf?D^`q`6a0L9*y5kMYstnKKhv>KQy**md@uVXd&aMYw)ieS{IVL1mKePo*Em2 zYeMLw&!mf+h1-LslV#HNkOH_hL~R^o0w=}z@OT3pp=)k@zvdm1A}|Fz{ru0ZA~ull z9TnJr%^whBp1s9|4>Oji=4o61{0=Yjgz@+spx5&)XD?h~98c2B*PvG<9<*M|*07}^ zAK5*O9TJiz2Mr;r8#RKNf4-XuuTUKJV2E;SSO+z9uFeqkBIRi?{wCvG|9@nC1yEJp z`o6%Ck`C!EC8WDUIwS=pr4Jz8Em9I9DJ?18A&qo*E8X24{@1y`d++C+|ID7z8T>x> z*=Mh{-uHQ*m|$y*=?Xb*$K%_J1>Y$byfh&qJlato2YQr}0M9##*$~HeofPRU!;k)h zv-a0>7YiOfH*@x9Q^(ClVn%{etxx$hsFdJK|9VgvKlNdh4~f>0U0I-6E8-AJA8kk8c*X;*`HhY`rWZ&n7qhcKPZFLY7ELQh zz1SLP5P-(VtNSXT!41xTue7D)_Svf*Mv1Hq(C4oM8E(Dnj$%MwlnK6E!HYh<=3VMV z-#<-Mb&rZTly}78hp^bFvmpz?^Yt!Su2l#~)CSF7?_5GoJ)XFo3HmYiDUs(FqzM+GKsT+g(m$sKC6FsVG#ZYdK zFM&uQi`RJmU?wM@JZ0mQ@0SXygzal%70c1a$6-$VZcnLrdyy!-mX@ZvtX*{J%tbse zir6DO%QR`oXYQ^mwtv!GWirwH5M^)Ox|c960juB&9*(AjMw)QOYgzjTr!>u15~Cv* zmvHHn^wQD1?L8wqPfr@OUM)V+dBk=^W^u}D@%%b!F6jHYs@@6z@0ybeU`u>gfPw8C zd6xuOeo@%%GO{o?y1DSh7{6)UnF`aeSRm*`{KKWq2{YX>a9AH$FZ)RmmjN?V(Q9y- zM0Gs=(|Zj>jh=`6Eipr$U%gvKjQOO6%7~5)^Sia1nj+i~31cY6^S1ZDqj$@|2jQ}{ z;l6m`_(0tftNJRwck10hdhuFZpUqJ zpr~it8Ts22x6I_ zg3bB+HGjJCZZBLnhhH5w;!E>Huos>1_snK3JzSKdxgl1xU2lsJ)fnQ#KQqg5g&VRv z{3z(MhgC_j1T8%X7S4eTUr3hb%mP3z!LwiFEyo12nUIh`th zWV9KE2EJqVpRr#7Gsg~V;CRsGf+x3|tn`ABAQX!6=WK0TJ-F7{shzN3gtYS%0w{MG zp5MVXRnOFm2(~F^C9wLC4>{9B*GAEP)QWObE*4apgokJ^UvKZJ+WFpYAqpYrEZ;e$ zqrELdg)8=(S#GZ{z&#+DHj9xQHo_8@El7o=slk{u<;Gp|iDRaF*#gdVaJ9&!XhK_4 z55H%<;Q^Dwp#_`w4Ij`0ZItgyf_}FUw{-jT zj7pY~SDSq7G-$1nmj}sjiI36F!iUA0-8qQ3pxF)+Z`-(`)GBF-FoPdLdM9SG+*uNS$&X4?yBSLNE+F8*w3}UeS=wQ zaCqN1)p_g}WHmSlhT(=#h&G$$eJtmgG0ZRiV_w$bvC!>TbU~#e$!B zt#}n>et`1Cb`YqNzvgxTLqet9WU~L?ND+3}c24QDLzC{`B>@BNULdQe{`@g!?&o2k3dYPWa8ekcJs`jhJ? zYlB%tO~TwFO}GByr@)|T)QsULSG!Z_R~E9kH+<96B>Gd8QY*}0-5a4g$gsWFrd0eK}&`y z8YvLD|JRe8f+mX9*Jt}~-nBkbpamKu0k1`WRG{iO{X+emMK?Pn|K2mx(XDE-Sp7Al zW)UrbGUEcnp7sHHu+V7r^f?@YNqyBet#NL6w16g5{6U_Oezh}<;drGx26BvRvADgi zX$fhCe~fCO9|?$*(p-mMcoLC+(|o1bhmd#iJ8n#%g?)K%vGloN;yyrH2?4Is5;pPu zzpD(zpFt&kPD=ey755Nc8*n}qAZ>))*b*LhGwkZ!pZhkOso5kZz)RN%a+M~3n!U}O2YtW>15Wt=yO^aOS%&_H7r-Vx2rQ$Dmx4!Ar6+tUfDx(V#sK#H zUiD&oCD^@#Ut2UqTXN+p`(> zUtn+OTMV627q$4oqY3-PHmI7#%10D|nk`**Gh&U@@!0>d*@fVSp2e(b3 zONH4WV*nyXG+30Lf#Rp2|M~Ea5nC>Gc*m_#R#mE=@AMvcTpbK-{GJkn??r&8RU$qO zAK>f8Boi=MLZ0RNYsL62Kmb^x-)JXp%RNgD`$3}wW%&0EAo|juZH+M~Yn9TT>(LC+ z4b!%>e#)xD4D)FPGo9f1k^YBIU?-Wl&4jVQhT@Gj*!EzKffp1rtbiyVgUg`O1N5H~ zjPo?XW)9hJdSZ1P)`#cL;C;TZAadKP1~`ziRkNf&P|Lf-2zy@iz(h*BHN{^xqylR3z^S zhuHw3e*%X?0WiUS%VYhUlE9jy5(UBO;5RVG-q!7```FlMh9b;8NIm@5E8WTsZ&x<* z_WeR*e$!#AeZc=s{;`qSp=tb%T@!u3kjtfKxal0=*{C&(v{m1}Flc55?7kQ<6#x@= zPcGZmp39npQka`jyg~IuxaZX5iRPf;w~thg%b9^7KIOG3Pz!u`O#Xhd@O8o$8W~i2 z;-VMq8fx~08&P$T& z)p7_7?0^@LAH<0s>)iy`xB{**aP3GKl01Fbz-rS4QYstq$vxmS*3;~LTlF|&7|@@~ zgdiVhUKeU9i4-5_&*c9IF&nsZ1WZkS^%DK20uu9&#Yl*V@}M>cuDMM0)m9pkeBHon zfs(@at~{QjHN;Cudi$Vwzpe0>V#fE}#Isr0;q~u}Pvw!S1F*gLBAv{?SkMFJ$2rsy zNhRM_VMj6s4tR=5_tf%PxdAfF9|nP{kRJHcjy-jAkic5;qCE10@n9eBFAexXO_9_1 z=hY;@k#62i3>ZT4em{5s_j(SqJ;I36UlD=hj~sI6etsh=5pnC?=&%Ug{;3&ar zV4<&;<$?Z7(;3LLqT~NKoW>8{kW#W*J?<(x{Bzj^E3X0fijmUu_XvjB2e*S0+h~5TfIUOzrbogB#Qnd1v zc~=Epr`88hGwA`v88hFoqeqpSFc_e)G<$&=*L)1m-Y^l@UCB^{(=?l2lFiqSNFZE z3@2x^>i$T%2F#-FEC*INV8TBL;-G-7bqsyP2FoX(y=OfM{BAvl#UY=`&UqC!0cTAP zSYYIIG|;U97u8rmBTCBoq;ioAToKi~y}_uCLmg>&=%3@OH3$MMzO6#0fHyuUbi3sX zwTjU!(<4B0c*O%ZnCA{$&Go`k`NAgl2<*(y&*S!ifi|tu4%gfYlQD+y5ZDu;|8l(y zd`Q|=#?rpL6qv2{OyIH^(*StidPmyt2{L#cB_3!Rn|<^E+53O%*Z;Mez2Y8Gdjp?6 zD%s~bwP--x{3##L9O z$Qy4Brnld&k7G5^@9(|=va^0rbWl$qNiX{cAok5UTdl)rAtrJ$FMrq^VScr!1CXqi z9pY`fhwfKqr5J&z9&yvJc!BjHJAo|7hnNt4uk zc|oPPepJOOiy{t7t#AsNGnM9_(Y8dz!0_+8yI4~G+7!#%>NdHfwvRF!pVpbyMwTV9 z3n0U<*JiB&mbB(B_&G(`RjYsAV|#_J4w(Pw)_J@vyonrfCX6S;U)#(F_KIF_R@G%( zk8k!Lh8NshXYIW0?+mARnl2YSKR=~|h&xe-JpDrX#wmJB?+iyZI_l#ys*jX`SWQSe zO>a%H3rj9q%pcs7^=cY{2rBi`r`vqb)Al|8r66GErFb6jlOFh^CwG6A@fI?X;0s&d z!FmMu?<-1TiTlfudXQ>N+t6EcQ-T3rv=6Fr3D@pNgNASJ zSE21+wRg|obdZo#0@b`&%fkgzdF^^w+d@1r)bKqvPFSeK=6pS*8_R2;zrq{=PGoxJ z5067-{Ync9!jn==!aqBIfS^z_2D(x{g8%O|hqIJjQW5{{^qae-XAHfP#mv!imw}DA z7(4h_zp$=aRMkydw4U#&Lg3)yAbiG`;fb8OCs-OetRy%j+)ycyw~z_)Wkz$Ak}W#> z@SWEC@cT92G<)$+=IaIH(8-&e4KAAMzZomh6TES}O|P&xxx7*_hU~aFM zzoDjsku|xQ_1OY|`dn^DhJ8S*u5hkO2>ZuvxUgIIXYa`Pn4V7YZkgY3sdOCzJOrel zwCKt*X%&?<+PVsQT^&)`+?e8WyH&zn-`=W&|551b+k;=VpM9>+3Fhh?&8yg7WbG!j zd|vO1&suvPJ^oqrflyD?81#vk7VDTy`Obw?*nJiHrCL6dGr*n}t$nvkiG+rhHjGS= zCr2?cdMsO6(sC@9-7IiCN5Pzsh0~-*42Eov&@cRu7OO_OGd*sA&&svxM#~ZZ&!-d< z~$ii^CpAt0p{n(}bZKa=D6$A?6<`DGj;d zcrZY8LK<+Pv2>m$zwA~Rna$hAQchA=Gr?Wk2R;c-pkloNH6$7hLwBjYv|IkshwCTL zfaOI8ikX|cAS+FzoK~s6%@#NrR%F8}GAc9+wI(V|6>fHW4Auy`KZ67mQ$nue`OkQX z&ne6%Th+&7{l8)VvjiT&^&^)#ia)`=br_vCP&kYsQ;ZK?6K_0rRJ`Y1%${r0p>a;) z8oQN70`K2~I3*9JWM_pYl1Q_Kgjg#S-nxi{&CZVnJ!#;RF`e|&%IM4T1QVe8$OHBp zv2+SgA9|iI6NW@u&!%WL0#7#O$yGYqy<(!6GIKKkyXA@b!^cYh&TIWfgv&mBaa!RW z=b*D}lGtaTW&6)9mI?a5pRdR6F0WMsvtWgEuRHcQmbdXc&Burl#Qf1dz?Z(>Wj`qn z`i&L*N6FYBgOxNx9uB>PZxK5&7dW~;@|@G#$Y+KWbWQyUvSo^D`$FP0j z|E`%&j|3_0QoQg_?yemL9M+HrQw0+QT(-na`(raWaumh|4;v+E0y7+e1ingzQ0(yT z^fT)D2m`X8pBdzC#yEnNv_R@Sptit1%YYjKkASc}o{{bm2zPLj)2~q>)oUSMFJSaj zdJuerL^i-qFMVgaP-W5UR;kMSNcm!FEn6JOp(4teQMDy0#c1Eif1!Rn-?*J*^ox1_ zJs;6UYth39#y@xK=jRToN3|UUQ59Cp$PV{6&h;-=Y#q>sj-myep?!d`Rlbgc!svK^ zo3wf%30_yP0KY}0PRz9J^1I)>LtN<6b*_v0fUp+(OU{XlPy&Mg{tvEqqk_J?&*j2A zvhzC+$DK3Zv?Sdc;4vX><{T+Xtgrw464hq0T=-6=3VO~+V}#v3@^MR?vgv3_!)&6_ zUJ?^|1pc3mLafyko-`7A_YsAfR#S3iGF9M{(H>5ng2`pLQ zA6xDv^YW0l1Dzi7_sup#0MlRo{^s)gXd8Qna$BJ)@G!HnUOwOWn722Zs7}at%}OG0 z&C0;KarFlayqI+mkep!Rf#g$*$D-sEP8(-O6zu1x2oLI>9Gyz@-aQGqUnyA61nix+ z`D^i=xI@4>Z*C&yS~XuLF1hkG(Yng12jl_e-3HHZ?^G97fs};qZah3ZDPaD{!=rzp z`lh4B2!UY{>)4vL;|+X@searK$A|ne{QD38d1b+alT!9Gwjw8>YUG=UoexZR#31D} zv|jFRll$VZHegA}=XlC-;Tw^vQ)x;gD%x`N@|YNGTnO-y9UbIc$7-4_zIaG8n%5)u zIOtwW&cGV{Eo^h%a$a45Df%KOB|a}&im6oDA)w6##kD_ihiE7h&$sw4BA**NZz#HR zjdJ|+B45$_e`!-cUFi&~a@GnQ2EuFQ{I6f?4`^ z{`BDt@Oa(0!}s0=u?e6w6OqmzJi9Faz7f_I)C~q0W2`NAI5lAj-%b@3KpA1tafIDf zao!$`Iqn~TgodyQEHB#of_#7acY#s#J8J-b?I_vE9|>3k%aC1{=n^0F0?d=_BF_vL}UBJTn@LZo_v{5f?8lzoPK z!zd}2b|HLq39~D%ytEyAJgM(lQR2S|45B_xrD;X1B;qt187A>@DfytJ085GK+Vg(z z36*{~VWJ2KJ2}9JGVV$yB{1RJ;cP?q(bU?d5R*=cF2C{WCF!^1h?K62X`_0(Wq9Aa zXi`!86u0CS!{+6mI@R);1-f+{00`R3skj2DKtaOwqAKY^2ltz2=>L>blvrf`SI4X4 z9|E6Pf?%qut=-Zrrk%=L01GHK+RRqa!6RTabd#q_4=8sV80{%WXj)as_8d~yAI zIAVR<89EItFi``o@LBb!zTFTr8N2&4t;*>9b51^jb40PL7z2Q;x{>{75s->xydGaC z>}GCdJ+N%keX);?*mJqNZ0xepo16fct+F8EA>;WM;c}_Z_srXQ}2^4(|RB z_+kc+al3FyX1&Duo|-DI9Gp1vSX3BsR;=%X0Ff}m2`6T8SNd>>C%OZv(t`HPc#JR? z!XJ$67KA^!0I!H@Z-{kXnpIi=qo|jl&&mZh)?HjCd%pgDJ61(IUk6#2THpSC=P}4! zRtqVg5}t{B-=4WYPyQjNcO}KS2Pp&TOvX<{m%ye%(lsbS?QaE?@)6mEz(*|&OaE6y z>$dv$?7Y2h6d{e!9i;b~tI{nSIEDx_Gxo-ow@)hdH!d<&td6B}n*cW2ofp+GJ6yL6 zRBKYuiGeRPNO6ohecCQV>-xGMhSK?&gd(W}!w8eJFi5!hb2owdEY#RRAEjPGC~}zI zR~q34lg(#_%=DPo46N{SObVe89l6;5_7boaP6v0vrrZ4P@gPWP0K&rPV{5~He~Y{` zfKi0hf{KV}t`omENgkQT;qfx1T9%noACr&(6{R5qynpxSrBP0npGqQj*0h-vj z%Si3P9*ICsVphFP8-OeaA@uE5LsgsVo%8*)OTczEkCGB)II;G%s+{7v*VdX?I~JB* z!XpwcnF#WAbwnjI&DVE!owSjrzuDu$pnqmL&9mlAX-}W)=Go2oTmYqZ;rDVcp*_jQ zkq_WS*h6rGLhZ@LQ2u*kSW!xp5o|9&9>514)ZsQDXvOYc_}D|!%Crl@GF}2-WW*+& z77=fT@ZP-{csRI!X|G3|Ca>yof8pA`P~rZBl$HA(*}Fyr+)_BHIN;S>JV)I7`IW`0 zhOm1tUlj(gj9!dpNCqR%_S(+Zzr05}V~8wA84Z3koFa&Os1e_ViKm>@ON=}B_@C#6 z6_O+dTvRMFwLdlQ4~qt_O0vGoLXdjl4@_r6U+LZFTPJdGz5mU(V$O+-yd|{+obPDc z^Abh$1UdnEE`DUk3F}*!2xR6PzgNdm!iVR(Ss6k~z*m#yJMra2UTl1p(xq@Txt_3cOiw5~g!MY;a^4)GxX=~jXf-()%JBVc_i;Q7!; z`XYUiSpt;N zz$mj_r2R=XL_^;^{S&SJ|GZ#}bglg(g<6HuxKgA&!qokj1g9IS;2?ee-7ea%hYI`< zz{^S?1Ry6zA$|l164#wRYKgbX!NZa*V(9dk;zbQaj3)4;ku_Hc7$OTwMoZCA2o;82 zraU#^vbedvR{iB-lPUuJ$s3URf<#k1GL9(b$a*(qnI;eR&U||DV8%X}#z`Xj4LdK- zJ?liE@Z|C(y3HBt-&;RE97dQ%lZP`gkJpbclb+v^_0DJ4dM9#~NEmf0Xz4Uk);JiO z_HX!08-dXS1-H%EN6;piP8*5YCgU0k4gs-Vb~v@c!`<4Y;)f@Bm2+J|s^dBuA_fPc zM_0uBP}==pho0m~UPmO2vwkz2V>;~Z>f=ON^tx-2 zgcNNzmY2y;i3X4gd&EW}Arc4uh*=>Or4d=(Tg19V-oq!aNTKsy%Tt{I;ggrd;w)Hp zF|D>O55zVWg1pHvSWy*-(|c9cPaNYge;s^~6y8NS;um;-$2SMyp7T_z5t=_UwHBjo zbV>tk(5_hKt(SpUX0(p+1JZU-49LLAu5AmBc`InaSve@1kq0s_Q7~q{4dS|{sKilqV)z7<%o!c(%=N}8jz6pV+1g;R&Gr1^`f~a zwt{128#rxpZJrK42LUsz1g#8|hSdJ|)C9nS?5(2paZ4_M;msS5!&uBDHA0OO3kn`a zOCKOled?lMc*Q+_T=w!Vw*dnWUOl53A-8+4=$|E!w=kP?;GTGw9U5Z+9MY+OEo)`H z@SJtHdPK;hCt)dX6gRCC*TS0HDoOMA-M+zHV%}|x^IVTZ_Hd{m4bF)9Q&ApM>-g@u zpy=jRh4p-W+?(d}r!3k(qM{j84*H+5x%5Kl!@ky4ti_$IN94Z5KymK%Sn8zNJ@Sxg z5G}d>0zShAS%AGU9w4n{0duGyx-q`36p46_8vxpVLBg%G45}yfKM(hopla+0vg9c$ zH;QRTK0BOVq&rkefcqu^foCkOWb`$l7HcK>XPbWnmrmWP9|GLF*+JoM9zajRLx!jl zY`zIt@4eU(OkVD`-rgWt47%7X>Ki zh>~ji9n+Qk=2x8~gZB&F6>m+xYYdVP`G!K8|c`FTJd1s zELvol(?3iR92E5Y0|8|#WTxM4=E&&mXjwA-v09C_jz{G~^83$!rj$;FxChywCt^4Z z%8Cd`XxSjZbo@8###rO^X&%^Bx|9NbA-sI~9a+fdZYJM>1GN*IbNPRc2`rFr0Qh8T zD93wkZ{3!o4ECZ{+1%1@cwHD+O?jC}wXYsbnl|vGOSSSP*8fDPJ}acC+9iQ>MUW}% z_0TGefvtL3_xu!uxJ|we-xoPDYS#?6^D2AP%}XR~#$}HvXn-G?HCrj8@;S&>I+`*V z{`H5FS9xE(LV#iAD$VDI=9`^Djd~}`H-An&>fLwg!;{EIok~ss5}(5KEJH&#u!R*T zD1iPSlnWDC(!= zGcax;KX=@%aZgLy6Bz1ebl4c!{-V6hF&H@iKM)DUHqsAc8KV`d`b9ZB>1E45f>f?+!2v}6uEuwlq8(y8<)`jD8G zR0PzPynr)y{Ako~976v5BFJ1)_-~8^Jguca5I0kDTMT0c!7m^@Zw&a4D+2>Dru~Jc zw>l|9wk_8|b2T<$=AtP@FR%?877V}OS%9tN#iZkR!0V0xns6@cg04sqs{IkO$m{gg za)m5YcW84aLn~2@`A`axHx=vRtxJDxK47@yhM!y%|H`dewOG3gJdI4avf_jK zkZZLgR8p_r#aoU$2OtSiQ3-f$NX;+(if>><<`tfssh&S1HeiUJ5A5UrcrPt8MQU2+ zrifx@Z;<+yBQ4;22*ysVN&x;{4J-$DkTFc1-)RCX|#n^Vh0`t?+iH>|S)h;z$C3i!e>%4zheKVUM` zvDwUV!IBnoymuyaz~C?+)LI>!PG%_PQM~Fy=>e+aifLLkIdgf5ltvOv!C}q+#p?fs zQZpeRof>gte|DTbS?98vVg?6LjOpr%2`d&>NO&vA_t+X&5y@brhCAY=)`bgJDU$%r zo%FotSx8kO%v2!KDHxvu)=9n#-=cxSi-zq%-#*OXIK#0n#sFU!Vj(xS>*TLgNt`{& z`*7apbDF@9=}Q6y`XOoBj+HeSTsPt}OF#arP(Z z-a_@B@q1KSqF3iY*TjNzrct2%WoC8PBLGeVAk%Wf^S5$?QMP@3mGCkjC$wf;g zmh)e$b^Ej~J$bQA=?!p$d5(VX^ej<0-|m*ean+JTIn8@{HPA$yhrg~Z-yJx!wl!5g z(1j;WamsxD`vqE%q0G>R<97MY$EaG7UA~vFYS0%Af_-5_l{}D%SWz$5K#c2lcg0S| z@9^>AcTGf1sLk*~6JEhcZ@$O*4k*RipM_r2scq%E-(J|X8@}5Z`}Iub6WJWr5^L{| z<5jPz+s`rIy>5EHOHT<_Vt$&H`#^eQUqMO8O~$o%dYRjsfvii$PjX20_g#U%Z(vz0 zH1g*trzS1n+Vi@{r7_R`FhU4Vs#s!tpD;{<@z@>6@X8_*;wUiDvc<|%fivAs-Fn{< z7)YtCGAM@Bd{R?UO4BoJHv`PZ7MRpo8z$~4ibXFZE^%% z7YME6&f;hJb(QC8iwd~%YP_6rD{%>px+#)<$BW>-O`L74s#*DD%xSzaK)4_1BZub! zJ=p?hFLqY+*s~0yeiWEPVo0~4dpEID4|y-e`9laS22Cm1_kF+4d#`0+elUiS)DdJG zGRvz84l2?WQ;z>VgJ7`9(by3T7XyK^12$KSQ*J0XV8_e@D^6{0IzyGVWNP`DRB=1R z=m#s%s82k8m|sm0dija)NiTCN=6prtl*vv+jUK}hI3knIW@-C5OzKK9eiI+M`lK^{ zYOUu86izqo2@GR{_AN0sD5Y_!(LL|5eIgN-m-*S}{|*-~e=r@q&-c1MX=c-~>Ebi) zLYt$EPL&W7LxT6dy~q)*vCaUvimd7;Nb=FQnTUl)k4Ta*1eg_I!3%$%J5k7R+vY7@ z4ZcG32et7SKpeb`%UHuJoOh=*fCz~|g!@l%(JZ~lds5GUgki}&NwM{F?zoV1g#Q)~ zQ8JW(qoV;bZr#bgttTL7YwTg2MN3=(1^dz1Hh8C10oIpe$448UgoRa>^vGPmc0M;^ ze7;L-Ki_>;CPG)4f{OKdPo{I_DTQ@J)^n~iydGX7ym$eHb|8DV3r&meb1I4O69{9{THHTHs`p%v2L z0C6&4pQuWCgyh#ujA!EB5{UscNZW3qEq}kH;P27MjWoULF`Vy2eeSfQr!1aA9%x#J zBMn&JNRcv4X@-(vv69otMzv0Q{H zRy|<7RwsV*9Nke!34`dHyqfWK9pl*+!9P%{SZgpcEXYCr#B?aBcucM>7$ZXkGfp^S zx=3%=JtdCOv!}nZ{3oR!vFomB3Ts(X|%Sjp7i32h_;~C^pP*A>fEw4Ow zgUSamWf-ODXg+83eXS8m;{8u4>o<>lgql7w@=Bc-!{BjwkY7uSsAlmSO?mUOY1yBj zq#yeOOcRHp@%DW$4tVydzZAoZD2RYm?JQsYJ@1NK=abE0Pc<@UZu(Zya89$K5p7BS z0{f?Z0P9fSo9RmNPf^aa(A2tcJUCdPBjnC%Em`j_C@sEg05Huzh5tx;tLvh-4B*Uh zX^w(vhT7q05sqpluBY7ojMOz7VCiPQSlS?WgVv*9OlH!(x}JP(3F0AO1R;xl{>sxo z(t~J3DbJa5&^+Vk8{K2nC}UFani)yfDP#=f1yDD!Zk1^fpsS4ORVf^m_gZoTB^J6UeVdxzp78YBW7$9nFXNh>{y{U$p zamxj%s-L%S@*f|eXXRRUYlH<2r3otZzh<76ASjG|rdfe^PH-@uQmqgOBvazhT97u9 z1-=-$&}nK-dkUMo#&=m}h=knUX9MkJf7g;l^ija<5pcCo=Ie~#ugnBvQoIqyJKGF| ze8PJ!ap-)Y2dOd5!8zG26^=LzkjJ%t2aF0*txVg;BixkxM6jYd!fOP;x3uD z)t~PWv2(sI)>i@pGWPjzy~KnsOu#%I3X`3%riZU?Ty@L8k- zkkGZDBPKJxfMzA&$OC=Ks3Geix&@T)fRuC5h|T-9Czii5mV%jgQk?sr*8r3~M;`Fo zbRAWjSmppijE5ltA(e?Osrk~pn7~2ikqe(qZfe; z0o_|0D*-h7i>@YY1_zj*86c0Lj*Nd)z&t5|1-Q(|&p)2y^=}1;SokYAdaiXX+}R2< z=R$Hu|G!#0P&faOp)5us%Ffz32E!25{kBa?Lo8Y5Hgb)kSN{6=y#)oD#q#;%+2yg} z07*F8wvJUb4HSjT%FRL2Gc!Nk7|ucxS;-u-rxGDQDSwJM2pCzoB(bLbIsFMHuKpKF zly+*z+?wZ7i73dUkbg#4;1|z)5*y2wv&mtNt!985(uU=n!$7CF7n+|=Lf1qYap(lM zh@_QVu-ECf3c|xSrS@vU(p}-c#Ja`d^SWXKvx&}T1UvE5wiShOtId^piYWnFI~2|Wo6<558W zGu)Zv@ToHR9OkL@{g~iQlfycyJ$2qpc?793>t5$uJ>)ww!aR+*B5j|NSWy9_zjlNp zVR$xZy~}`s`#OHR-R2vX+c+}@>5FVG9#PQ~g17KSUlp-LML0cv&@RlvC{ z>YCWaS}!i3*VL^R)A^P|=5YqzySC|%`%(yQxOl5D(PLG5gBjRa716}skLBNufxiXH zo%satQF&y zLRT6{xJmZl-~@5RhO7n2xwp{ZFKDo8?oueEG*MX-){=>Y&8n;oACqn1KaJ`^=~*IkSGmFilV((S4*H;?kzYgJLUC+F=H}!h^SsC(-Jx9s z;t~M#$+n&##XXwnjp@6Q={~@|@;cZ&(5wzC87M^jPi z&uAD~_P@W?duHP^s>=oq67P&KB}7#)kaZ6^d3R`>@?AAOjbo~@W!Fb7^X;ps>i+pSw6U(#g62qo(=W!K-APG{RX!%S zGsAT*5hhBr;~2u+l*TRBApKH2X8lvrd_v094WsYh_Y`hLZ|)HY_KXfiu`bt_T~aRx zXpZ-BIDE#9R|R%{F~p%uQ~b=+DKiw$VWi-*6SMrY_1hhW=vUb-OKdXDx zptgz_qO0EfEmOkRhwko~qAEkJ4VMS*YQkgnm$X$xmNGndM-Kr=xmGO3ZGBF3qm;-N zVq#r~DYXpIlS^ey*=-0YE!!Li!uo2Y6n=h45b7dhwSA-ZAmT{uue5SFm_Z*4Do{WK za&o*+i-rqteC=YU`x7Xb3)?d*>8(p2p|4n<7J#MBRKu;GZ^lsh2N)dnTZ?qnX#NT6 z$TQ@6Y$9~k#}*>R3E8_z@IyNQU$iU6*YIFvB22M^aHVbm4zx9nAr-ROx~v$qfYNXj zCfBYY0m^TJa6~~&M7a3%jvB@3;i2-nGMW^cXB4>p$WzH+6sit-Gvfjp8&Ouvc>vK@ zU5u9TL!PqeOJULuyjBbO+CQ$05Kt(PWQ*t6#8UMWP+o{S4B%TNZW z6WiWW)BeQ~NjUM(76QMUIeibS^5*!l>mbS6{sWcf?Zo%YaL4Tu*>IH56hFMI+>ayF zU#vc>h_^04Ozwu}gU##L83NG`wTUjt;{(Kl^_3_;sK&^=$+l3ZR}h^Zl;5e)(W#&A#N6aWMlL2*MCZtR z)ePEguCKeQ=k+x*SdjT-V9qQ<_)ZxUfIze=VTs2b&`O3fu-YAF9t5>OfMjF4_2%gS zqh!le{_!JFil#gd;`oGY=Rm260v#YfNj_i92JI8s`n~XEyt=&;6!14Y!OV&;f**#r!l$)g6BavEYs+nYm_{ZKU#|4*urH0ula=(pl=&J3AQ}BFv}OhN~!F zfIE9bR`l!XFUNL0ttC%Z^#HWgl$0tM5MyMRaGYvyZk>k!UymDgtoOwkeKIvi{@#Qz z+LW+SlS5*0L1xKRMX9qNY4*txpj#e^jOnvcli^IbeJYna#^Lgwb9zg}#sBN7!n9wA ztUmwTln`A}a|DUx7E~>9k@aq&IP$lbRgOfw)R}>0314-$n(2o5moE8oJkQ*wEcT+ zNl4Qbs((Uw(w$)fjk$8p>SCjNC3r8d`yn;9i^?gf3ne&MSYiN^6hSB9QMBY>cD=H} zCwJp$B=|krsTv%^(1R?sZ$aU!N7LFZ=`5r)ssB)d?O9h`XKiG_=^!qT*j`+CMnLDclHa z&n@BBS!gMD!R+bE{)x=;FTLZAsPH5DiXrqxkvD`*i4c7bsKaUwK5PGc(adU(V(Y@l z({9JRlR{P-!PpOvQOCl8Z%KrJ?TiDOsO^=GLX#=8?TEuSo>x1=Hovlky#xjCI86Ka z-fHwaSdQoBfJD1{xieV<$pBaLc)_+#RXrC9zCnv zPe6PZgK0uE1%j_^ap7O#LMCtwk+6umm;?no^Mt8OE{BfKO+&~|RC)+`=c+LMWz&~H zh|YH>$X*=c;nSR8N{P*uyOSq+jc)91<}PllhleU;bFSZjMl2>gSd5AA=tNTob31JZ zK&0OxgN3CY+wRm~hy;Lsegj=rT*1f3CszN%@(#c{P^DKJ^!ip(b+WF4Nn56@`QbmW zBt(&mcwOZT58N!V(F^KJxNEev^BGLLx1qxLUZikDEzT8aHbW6Twen;D9Xf;iE}#0Q z4;6bH|7C!P5+GjWVvzG{e<G zK)bzi^-KUYJn4oMe{#BCEk{8;h0p#BZY7r<@SyE0%_b&!Y-c4%lQG|+`vZnY;({u4 z5OyAM12&*iBO}5Ig@17yf`0r_$2}O2m~z|pyYLTunQbGV;t)C-oWkAr_j>^`A>^)= zYmDD%Qz8&HDT}vP-fDZ|;RYUSL=q?sX%{p;L5FGLjHmMtK|`npxaFxDpR@=fc`uZc zT`fSU;Tk%@GA_e;grm#;O|`}6$1ZOq{SqPyhAN8NrM?nXRmy_GCqzmdU@%;g!d2J^ z{t5{%zMy?>2T*?3NM&^cxLy7ir6q;%MLD;B7G{>7fk;2VyVPLkV!2(T%@B0m=g{Mw z9OlTyL`MJMX9CZWmdZD@njgbJXBD~O?hJSXw~9zqt0`=Ha$H-d5Nd8HM;ut{jDeMa zzJrQ_qFNA8>iV$s6XC{Z_Oj;ZE1=n)X|4bKk)qnd?Pscj;G}ffk=g&TG zuW-k2FaFLJ0(Pq{-B3U_=YKuYsU{lQOBLb;zw2`&C(lqZ^u#r8kh-_$rVyDM;ab$+ zfY$AEbx4~_sTPb52>(nR4cs#QRQWN`@cE4X}?Alx8DSkl1xFI_Z)-dPm!t*CMyXd z05xUIQ%CHoaJnQZqQB~*?Cv*LEIBu=aa}PJs=d%)+sjWs)L#Co0AkzN%w)Zi95qB+ z)hsWX7K>5p=S{r=tiLsDUS&ueXhqa40H@R{bXT0>6&x3^3N<7Ov6FRMe1zw*)3~uR z!7(ZK6YLMvFLk(3;fb+&7@mvVR2=TF(q{cMvQv1hGd{GF2g&4uYJmhk zd131P-EM9x>U&a(K899>QLTqEH6I!Bi&sr=oRfsDcmO?ous!~)sKjxAg^+tPo%406 zK3!zscQt*`f329HEl>jZFrFhEG#KN6*O*fkA^k_iaPYI}7yu2jm!4%Nj*287JyT|; zKOKlypr%?HA`={VKjpHYD&YKS#_?4R2=5GWYipklEd5;3I2(q?va{>P?t^6)`iQ|h z9G@v(!8zr*mm0I^BK5m)$u*cKR5lo6$Xk-eNUD`(s>Yy5Sx&%8y>*bOzILE%6$zw| z_UP|~{Q=d*A4ZAw?pD6|O6846%j0v+tex$b!?9*laGOw2IXybns zDAVS&L%!++QvnPE2qRxqCWVa*5jbw*kYrG8;KEG&uw`cN;zQx#;br5?f9ZK&`&X9H z+75y+h5Ewy>4{`^?|M_?#MA4|4iqA99WX3pdVZMzyFvxuZ3x0js@Ng3~+deXeZ(DA`Ijy}~a zJU=5}LK*-!JswWPnWtU;F21t7LNYa?4+Fz`=3^dB>w;y$%k#sJv#aLA>O^gen^XZv z{T6eZzrY?ut%s){#E}hj(j6#UPPjS?S-yA2NY@VVBt!De4mp4=HY0dZ$l5Zoe^#ML zq3s(c%Ua=bi(Mi;?uu*NtR{>8+M}NN8|tipPM1g|I(#A;4)~af3@lUZYg|| zqk^=)jm0=uF&2aozAmsZr~$^CV@_*w^~lgF%Wk7+|X1j#S&HMMdE^=xw-4y-pi>0vVvBbgb|I z(6^JSiDWQ{iULj}6Cm8)kvJ?n4j_oqC(lLT;qH;8tR|RWmyiN@LM4BS)EB{jqF4~( z<#@eHe7<0?ER&*RqDR92j`sX;F&$8;$b1rBxA*`<;fvJ(RrPtQX#9YIIP7ick-aGz zYkcvmW+8z3E_HrZ@)QLTt3_gLp&Nijw$%pQ@+VE^JB9ps2MpW zaA^-hH$q(v)P-l#Dxr*2$qncLdI6wC_!oU3vzc)3z79i%%7g5KEuxIUBhMUc?JR!+ zPiI!ekii}5Vaym z+29l1s3;U`L1ONafyLLRJo8UwJOv+zH-Vxze`n#u2Wa>dylFiM?5SCpldJB^G9_85 zT3c8-7>YlW2}+aA)h68B?$ZTR_ZgLWe`Ij3wOu4PB~o$4W71CnY?@6=&OA)`c&w1A zyk26BLj8H1mzldJgLBoR`&}Y2$Yr&D7(vm1c&!fZ&f;LxF&_*j@W5CnM%tp(Y>(|A z`6uuG<4J|8^&CMYOmYnY;xwlyd|$QgR;f*;WbT*(_{H#MR>(f6*VNr{9{vU z`q%yOEYGFx%z9(ZqK6SwoPD$2>!~D%)c73gH-#izdN$ap^??q7kz(V+_31XJTrYVn z=8F_~f{w%2g|&?HAb?h@wkhm>iTjq^;rb9q9L#vfX$^=*2Fjh$q06)OIa(QRH4J?;)IOmCGyz3 zS)tQr3=F7cy?yYEV|4Rg1jUkO{RA_R)pMPVXLP`21Ha6j^Tt%7Z#!-^Lt7#1n?tWS zYSBpAuf%n$-5gU=!CpDq(Dv0h&>Co9^l_P}L5K5!P+j$rFD=^F(?Ei^_}DbI5ib=o z7Xiyso;tp4hZzNzo=c0fXX49Y3v7%oT<`kbS1K23i%qUjnkJm@+u}3VS#fvJ0AMhn zi2*vH+9i6C&l>}Yl7mS+IV91kczh-wYfGq)l5pV>M$;ZKm;n7vv6Jw%N9+C3`ISH; zPuAMt^-B@_&^^HYl>kxcpDR*y1l@AvqqF4(p&0vqeopZ0#N0XobJbP~uW55JuBgcS z&)#LOJv;z0Ia9A&nuac$sM{Zec0u6y6McZ$`o!vlIq|?@cY|eK^Gx90&E?|%)%6u% zSvFhO4~P;<2ntGfsDLyQf~0gR4bt7+pmZxBT_Pn)2!hg*B1j`4(%l`3`0wX^&pDsL zkB?k%>CD{sp4zi#t+o4F!lm0VXS2@5-U@}M??juuJXPF|H`QO>4H~G>;hzp=f~c~eDcU%p zKK0Awv6&Tn2!TY>I^VQ8aUDCn9l}t1i$<`mYX0r&>p<*LaKYogVvnMus9^FM54_Cr zS3)LGZ|0G}+rhMZ7C0zW#9cpSrfI|~wjXe0uuh~ZIrjDom5&i;)8p6SNsBhaHO?dw za!lw#$r1@6=njKO2ojK;0xh_n?{{wvyCs#yJHQn>O)k0VgN2Bvsbq<@m%OEh7q`CK z)+=?B3+5xixynXU6@2rArY3UC?jva$ZJdyR-RNG>J_L=g$YkHTGdwLGZZ)Uj1!5$k zrk~RiTzAwv;b)mEjZmjUe%N)jqQrvN0~Lqwzr*y&A*41TpICtlelZK* zs8*F6X>oAzU29tO;GzQ;qa<(qJ9TN+y+(o>#}+aAV8pZ{hd`+9f)uCgyHbK7;5Fv! zP1Ln|<0*J_L{X9Js&Si`eoVb}Ea`@gI!a)7&5WXraE4?7?i8+*^;AylpIo-jdXy+L znddBYkyWTtWLQzH`o8sy#L$qT311Vx`IG0;0%mEwksSd60awa`R^OpNR-okNP2`m+ zw&;EDIe~RX|g}rH`Iz{DsTouY3UF0C=ELqfm78>mS-IA(^^Fg-spd03ktaYN()a z*_G<(<}=$BLO-8p_P0G@xM$IR2?zusk>8EGXjj;tqA$JZm zBZ=b#+#NKU>j@T4Zi=ax?0u`0WAzco9B1d&hoa*Vw#(Fh4vOJq;Ho}`&=!oJcy)1g7 zbEFuM;_nBypfCt$?`%aDT4d8tFxo#ue6^Wfb?IqZ>3F~BTf(@6!Ft`SzX}_0E-W=z zZe-a0&)c6U_uN~dxbRGgsgcDeME?w0@I}853?*Ji4hD}BEZl4FGY?)rdDtDEXKxDfnGp?vrn`rUMdTo~x$6?lNxreXNWWFS%)E8(~B|p+s$8V|4}O7*1IMaI-cF;r1mTIg`YKBZ$hu` zi27{d(?zV@p$~5~<~`TeCbYRxZ(e`XX#KLTxG&ZjcF&Z;C!_|A!GaN#NHodC$@UjY z)K1M`n6;9J^3OBdcgmeu&qQuG@^(uW^yL(UyhXo8TVX{VRP>ef`k|(eQo!Tsn>4}V zuW9!`3b<`%5*{3g-afhFLP*r5aA`2uuV3O5pMgoDAz%I_?uJ*|r4L8LW#jQ2F|6=# zJ6_w0$b^uryN=e(#FId=8R3sv);nq z3Asp<4;gmSxs9d0b-6n__}m>a+Jrvdc#5^tEPr?m#1E}1j*L<*E60hrw$%HV$sP@y@@}f^bON+RATBC z6F;Vms?{+6<5=CTc|2~5*QWL+Q$Ic~(CP8G$xsR0;gu(0wKgi|8|NJpHEJa1$0Zk_ z)P4Ga?VkHgyY=l#(B-g5RZHcZ0t&QrYdYx35ew;yBrdOs3AC+ItKut&eYkYeRf>|p z6I_B$px|J1v7PY9BSxO~8>d_NOv8k)NxE=zxG{~m-%SxodV#IU$xqkaNGHtaKiRLd z=vEndMS}^fOQK(5-^++33?dQ|%A>GUEeQ3w)8K;Uc8gc<3*im*OjXyq+ofC4Ji(g* zn)0R32DY@ChU(zhfzQA`(27bJ^9t9gF9+1t@fKoi2ib%9O4<3b5|~lE+UIPmo1gHR2GrV-lDB!)ZRM72x|**O>D6!+@W9Oj zji);#Q_or6IoN7JKUutl(fwtMta9Zb5u3$0AmJte8HI8DPtKg{f#?SHl}mHGvzmnh zSuT(S!7%(Ky@Jyfg6hV%N!nJS&9gQl_G|K#>;4f^KQG^&V+i>1s^cz zkz|B^CpqbewHnKqxgCNX>-BXmlEL3iIf2KArOzFehh1Ky#c23Ssq$G=R2RC*a-~@G zLld~wt5grmQ5_OyPJ-foIfOa* zLn3l^0AgQw$!)}+;yw@@U{(W#AXPDHVtv@^Oc8}P(4w5o0vx0#WLe6p@6eeDJ)>PX+e&GF&ytF zGa?9TGI=e$w>XHKIZ%)7s;!RLyNTViT#8cPEyhL*Wl0e*yw5yBC2^e?r8;4ZNM0w` zSy6RTcd&5E0;+X% z5mfC0=oQjmwjAlVCOVnZfP!{aK7J1QO$&+8)^f5{_ZAsF)o@l8LELVEx)8}q#pbvd za5H!qy)~MP#yiyqpwo67@~tjvlNo-`H0ssxvS#h;Z8G?6krWEp%^!0TX@NpoZnkAW z^G;3HxOBo9HB>x8k-NlBTLtNSaiJY1*%lmrEq~M>$R)P=<$RmQ`~;)?IywqUHGy4w ze)}V9&>kQ(464jE4Ss)tRSxHFcWWn8Y@QV43#4eN7@-_EPtlUppcU$T->-{m{5(^vRmtLAX%u?Vvg7laP%-xtz(`|}SX06F z5OAq%p)(7RUc6r!SrvZzjIh%vJ?W2EyeWZ7N@H8f+ji@-5KN^8P1M!FN`pD+=^kc0 zPy7$m_=n7Tb*a2w=xAs){(c=2az1#IvhgpB2XTe2Bwe|;qThCMD{~tH#$WFXf-L@S zJ3~g#Y&U&V;u5#`!nJKzIagL{oG9$ak`F+(!16KOY)cWu1{L^o9ilmY3uAH}~;?yK+ z?c%!WYLTVE&ah?Eu=*(gc;-35gS>EKgT~xCT>9uZ95n}Yz}My8D^ycqDNRP8qK=C+ z7-!Q9H4GN0NFE*DDjZJG^Ul%6<-b;9Fo#t+z@nXhGxEyqhxGD^cXMP4a78CSQ(CDr zIp%h1S^}b|rpZuyp?RB+?0LZl1P-WwBxDw8RpP|*Uo18I&H^#<)<`eONcMn^fR;Ny zk8T&hv4g#O>s!Uhm7|$tE^_8xnfPn*`bIt={aTZr(23%Jal_}zg8Ew|%<&DH+cQr< z@N(Ms(aLVV5WFP6*A-g@h#9sZ^jmm~jPyw-a?HA#V=>#8A&q~O3GmVy=ZK44Yfw_+hcx-XfaW@LIamg+tu|A~{ zNw&))b|}5k2$F-_goWpaZ_ZhE+`A=nz>wi1?b!UJMi{;yx^TA>4eRnXqZ<<&y=5T&5^P8xh)G)dK}e* zw;a_JF1T>%h!v7Why&m-;KBlH<9p9y>dDV(#9D_F79+~%@yc3=_IjHjxzDp|d{`o~ z^n8x!G`U7%Gw;9BlaSnXhSE`06~!vBdBtrGV>h*gntxI3FcxnMUZ!DjC1Q>|Mimx1Q*VcVT2a z^s_CA2ZRzVnNFo?6uMXkCTCjWl?3@|Nyy!Q1u3eVajRd< z!A2o*PHfO)IP0hL$`FjcXzF`hN{wOzFU>iUg=}v-ul2>R#yIo$`MXU8r)EVZ;4NRf zX_4$}gp`Vj6~`wg3$P7(aLHlqF0EYhz)c&Q?>h?MaiN0l&Br(A6i1m+SIO87nlVO8 z9U1m0Zu$*}pt~mtgEtcyEWbbgfRz{HBFWY7`zw+ul~!5w)IKHmI(DSPO2|nG^}j`2 zjU$mFiBMsSJRHZl!W&Z&A{AOW;q%2wK_hho9OiAz8WvKc;kWHlwTEv&757-)y9WK_ z>olz}$ecX~Jeo4F8s7N$>~1v$PNm2;tX;n#G`roj9!>qA(qf9lai3J&WIR8*8MG73 zBH!BkC>_pk$vu8oWD=P?c|Z+R>z&yGpGl%*Va1CWJR8~ki9bT5 zh)k(2cqVej%9n}!A$Mq^nU~-J-ISs0^Akw%dCOevbjIAlUxh z?iqt0Sy1|RB0%K{VKACBBjsd;Qmpe_3NBehGFy0%PL3uvs+A&*5+AfH%A@ ztIm@Vn-uRQfdaIF%>OK)wcnMvNS9^PE_!(>MqR zN(mirK4L?u(o0PkzqZQOyns8=RHvB}#+~kGHTF^^FRBzG8WDAbNh?DkH)*M;onk7n z^oT6O*?2C-;@4>7Bkv&7(1x$R5N(TUbpeU|Z|*-lW^S7SOKul5OEyT$pDS(Io-KZz z&$RA8e4db?>WOf+hStT+5Bcr5)o||10Ts@ zw0jc=2kZ%aFEG=dQGyt_{B~v`oV0}12CedlJa9yv&t# z?b5h|m!mIG>fkz#tzIRi;={NjsX}z^TT*fg^?0g<2f242KOC*JwY36h0>{&0d+ok8 z>Il@f*^06fs#xqw=Rl>9S*>q(PGPK z11Xf2`n(zNCqd<>R;i+B8dExSYMw19|_<7i+= zvk;$2iB;tgSQHZ3R8q1fr8Y(4%xzaP#hy0YmnS2MMRL{kd{~bA_zB(>An%Yq0#bdi ze(BcM16JQC9n+kWDK0?j$7y&4mxV>vch`i4^Ux-hZQlj8r%icOuU9iAf~GAl^Anzw zb)UCtac!08-Ver~)8l~aWjKRvIdgbcSjFA5I_3#JBx|aTDU!tTSdwip%%;b+dG=wQ z4-}c1TiZL1cvqOf8;WdbxN|0yLf0vd>QOM#S9VtY#LWi>)#w*thc-aLR4d{j$>iO! zYK^!Wzk+%;m8M}Qw#LAp;fi}T9k(t!DfLsA(#K0h>U~|lw+e`a5CIe9=W$CG8Yw@< zGFV-4w(=t9<&LWD9A~m`+3p3@vf&JgqYoLYkC*g~8s^~{>a5{IXMDEyM3Ls6>6d+0 z!;=x4H33-DKhO>}TRVn|A(Wuqy$(uJ_BJOpC)>ArmEkD|j{xRRm3)O=)gd|76W11p=CgkwY<=O`NC+ua?Gegb=v;!Qo=fXDsz zI+HzwR+Klnr{>yylf13AenipKO&kj@MAi?jDz&F<{UFp8IVN+l>P)S5KYCBvLHW}# zS`Fs+XM)Mpi&5=5Gnx!V?p|xv%(v@zHfp11$U};wr#5`YxI(r!p3LZm{G^wSX?Tln zfPTI0ha!93&x`fK4#eJ4ygm`Q6Fn~1a0vo)H4a{+WKZ93VsA=3 zeji&a1l}D`zX9Pk;eC+yRPo)}NF7*T1busqRj@XvgfTF}0XW7F|F;<1Qci<)i{!JQzoBqnWrzDGz#;|D_e5W@( zXQlo8lF+bbSs$1<=2iqICZ|u;FbY`I9ZsL`CT1&jVVK(bP22~8VoTp3A+5XpDNB~u z3e)rX&NTx0^tNL6In0e2_M2uNJ4t?}BT0Tt5_0D@(?jZW!>ul9Jgc<+k{iy~a|TV8 zssSb2JxEc~U#Y(=yOB*wwB^YIve|ew-7Jt}RhZ zdyM?AJ=%Z)8*wOm{~-KCSeVcsjapX*j@L$98%ourMA*~h{;+fPR5`DV72e4D{GGy! zGV2~E=5Is@=u!C0Wql^|kLETM#CfKo)xndrX(-62W6Xw0mSt+VAE)lB!bCx_ zrBZx*SD!g}n^847r(d%%RH6Vbpn6KPC9|3I*NOlWq5g%+t*B*k+O{FYI*|_D2 zdLgR$3>HZ=4>##dZ4GaFY*It_=Th@F!MCe^B3&OiC2Ny#Ifjba0x6?cf`Sp;i(j-L z|NWWmVvNDS4Tfop*KN5h4%5w;$+sMHS(b%y@is$*Tcj_)*~xEu?!Obf`~DF+r(FYL z;kvrwHe@GxK3tk}OsbwKSoL4K{vSnSQyjG~-9Tu$U-Ei7hiPYKY~x$#v1)?5@$8o` zGi$<*(U8A%JT-}Cf~5Y{J)C`lj0XaTL~8x)r~jiJ{f}<}@BaKM7aUc^0fNG%riH8N z3G7Iaql1w`&Cc;47GB)1Orn3E zxaWx0{uB=L3*=B6G)JZ8jC*$b_;xsoh6d@s@ z7dnL%+%q2Am(r8j$Rgm}(hEb@@S4feNnPUytiPWU0f71#7_XER-n$n;w9>L^9%xeo z*^;;(-!7#akCI+uoF?>#Ye6KqZ0v=l3!R&Vgu-rv{~1o>?b*fi8Z`-moE>pYhW5pa zIKQoIuz@?(44S6h9bfXV6t;KnmW#gBiLy!r2l_;NAEX26L0Yn2O9Da8D&>F7W~ zxnA>dfS+F)Ca2Y~;`zO)Bho$nE1-*(#_!6qjEc2iGx(Zrt}|ZdPWK}IsgL_0REZ<> zuGx0hrfQ$mFh;-5qSL{;PTIgj7RpI{f6$mwDNxSQenFFc^L2)#yfcz>^rJ85@rLTI zIj9mv;*o|`Nml+n4=5jCp~yrezch#Q4&UEhm)IhQ+FE1A8_-!})LOqGzT-@xvTs zuv~5j^?Yr^yu_&JhfEY3*9by3@%zPE3!T|&-RZl4pfk%MR=5FrZ@SmhGB2F6F1{5- z)_VP5xv*F{GMVdZuZjhke4_pSsz!l#rafMaRHl2`JbOxXsWl7;F-{AL(l_~2Hp3#a}~+90)rJ?%SWe2N;^LnZ^^SVQ1(Yk`X%0-#-#g$g7nXd;C3FRBQp8I z`VWAdKq@YaHoLtS_c(n|yw-Lficn5o@CS063Xt&9n8MicF$BC0W5x-{C#qU{XS4QK z2gBV&Fi%?t$3=ugm11jyz&XpNYf_?-1P$Bj@&RmVe_>fPRS(P7=P8vN6to6A0a-%H#?w2Sst&tpBW$%|Kn=8e2&n{oTum06K;>VW#RUVfcKuTn2ea-l< zS!F|?zegab^rXb@sQzwf7wXIb{9aJuK=PYhYHYOYZJK{vz{Vbw=V3%cWxHthUH(gA z*n|4ee=s_5nC2)I-%0j3`085lAWLMPE9B|FYr=2eg$YolBa`6)a;In{%pOudBL+40 z>^kpnV#jzJ!VTw;LfSHLiC?CwqPI5yN`9oy_(4q|PpJO!OHvnTfQtxv>^tQ$e*Diy z_P3hunD9cPgdvX-Bd9I(US@O7U?t|V z1!)w>N0|d#X7b0rm#q@vZ(G1K;3&LRe&(+shd|Z5s0iy1aRv^VG^hjiVnv81fk;gM zflLD5_%tiV@I!>>5)#zNuH(&YG6TV)3%H-)%&*=$93Pd;Z7Bgt9j-Z8A5YtjUtyT( z56GtRabc4SsB77s5x+kJu~qXzic4pJZ(MFOm^=+a*CQ*`cTfJ+L*NN|J563C%w7RUYOty(|ja$&rm9)9G!NLMyV{Q%)98uokc_bV@ z&&&vigxr3NkOjf?Q)Z6Z8$_@f$8)Lrxf5Gc7!|a+k4zC6K7eX)DiD zq^H(f+wc99NhRnU4(Xzk`z5qL$0!V0Tbj&TrC5K*C$S2_ID_eetm3|Ew5!7Roz`&U z6|R2>HI|NJ)W7x!4HG|cG(D_!9}woufx+{@`n>0~;gkUx0kf7kOzwt9FPBp@Vw}>+ zSeV0&`R!ig_^m+@;b#(?(;i9{SWM%#W~8NUeuu?)78MJ_$)~uiK!Oc;n3XnPApra4 z8LT$fc!|4Q+e6cb9R=YO(4{6K^~VfD{<k z`;=LkoJe7)OcS|JDYSQi;>)RH%u{3DPrpn#tpaokMHe;lN}<`A=mK!_$SWV6JFOGe z(X5OIAgN`hMwuy+g!X2^XR(KhhI;~d3FSkVvA)s!18!FtKyz|eYjh%$3)Nmd>)NQ5 z1U6!>UChYcY>CMH$W7GXQ??NV2HwcW{C4ykkiCG@d6YAZOv`uhR=7jcIqXH4q`X7I z!u+TJzTVZZ#Fgv4Za>|eTW)AfQ`XFmguV2`YVm6I^Q*dTB1T~v$w-GnmOr`P$Tt0W z@OviMuVC&0OjsGt6*ME+6OzCe&!vwfA!u8D-eYA(Lak3Qt!yhe86ZBs1~wv)-k*x&U4T2Aa}cs1eUo< zJiMMT;V-VE%8=1XppOYg4EbQ?3w8$7<({lFNS(9$&Pz%{z&gw6Ug+Xtmi3eTnE8wJ z@&Bx5Ce~0PA!ouXeWT5&SdJgVGkEXvcn$%BY{{dlp59;#yZLQcLEi});GES*SNN2f zN%@$xfXRBKW@N2YQ^)?{TU}uNj4s>sQk=F>C^Wz{hEq;5)ATfQN%ic(ISXulc|kE! zA%0qV`^AX*afM8y&?mbdpN75?GqOfU0j^&QmLaFzMJ0>P`4lGrNfcJ?zRkGp{Y|m< z+n%5eI`;n_{{Mb}-Y9va6pM@D8G_WL0}!@#%1oKGk+x5v`1vZ2y%*L_LC>Hm5O|Jb zvF1xaPo@^fN?1|Xn99rWd6p}eJiPqV;@Wep(%N>mIYyoZvCq$$K!=dO&Jz zdGt+T3h%%@E#_$}ZmS-@u5`gddCc7ls1JqV*qU#fQ5Og4UGm%jb@jf$;r^v>^C`9w z7Zy^N#^f7c)*mllr-=(n+YKr@W$VZc^BcO#b=3&eK%Tj*eJM0pcBzNcg{qzrziydH z*{86a<;M?24B~sft}q=s`TArWseyrG|6wO6FBUvMskSxWh_UY4oXlTOu7ja(~G$;)M(_t7_! zsT7$iR4eX_p%OKl3Btbb1RMl5!!~6|4wLgHI_Q*1+(3kJ7y(NXJ;V4CC*N(mNmRx}#{3XXyjnRH z_ga!OJx_VsO%~MKFeRD}S4TLAVd{Fr@m1GeHI`1s%28o`&g$4P1D=57oIM!C-)2`76v1(f*Dajf+Eeh#kWgj?3a02P* zo1UjD#n?UP1^eSz^t&SXPh$M=;+|hgx1{mMo^Cw%;e$xln+|qL)VcR(17B5rEiDRX z-?P7ub<;+ZObOO>DSs2rhW(F&yvArFz~zIW$ygiBC^2nllN?6?CNZL!e^(`ps_x?XHEcVKsP@ zf@Urf#YIJR^I_HXqjM!3CY?Ry=KYt5h!)l#EY@0{-6tek2_({u`QbYMCL8j!dh89= z-&a6j{LwUdFCW4}`O}okEc-rg1#T#-Q{3l8mejHu>=pq1Xw z&a3__Si{XfgZ5VTAZGcoF8cFI8*}B@Gd0=i3Sg4z;>I8T(TR8%nkY|_Bd-uwU-*%Q zPB8#LAd;;(Puovd*~K7EGmz#wzBEp`_^uo6#fulatt-Vyh5y$Znb?6%Cn@UXW{+1p zO>ll06#rI_k&2M|Br%$hkYM?AMDQ3$gXXib>$QS3G)?ZdlR^;xd;XmE;G9Ueme>Q3 z>RFAv8a-cBDy(>nr5Do;vRF-I^iko$bVJT*+@kSuK^;g+zK@ zO7Gsi^YwnL_oqRGDJhYazpn#16v4gOSP-EtPF4!%r;wA8>4&2Zm&>X;H$-jmxbues z0|Vu$9c$f9bLHlPM*$0k%M3i-oV+{$fHjBzF|LIb&&Lc{&2O%bzL5crMIXfbk~L!a zDWXF{dM0p)pHoDTzXEPgA@c^Y(}J*1_7FI>L*R9k+pKBE$H#lmNSk>dzsL2>2M`Jq zJw1InDud>qme-~fRxUexZV6;Zzp3pM)#Bbh%sgx1XnPr{Gy;5mu8*|58&xYTEp2Vp zJc)QKNAJ&|r;5#M#&+HibYg6N_Oruo&64oMyNgsVjc<>Ybrbuq8T3#Bru}(raUGqs zr>uHK?%hHZPda*wjmtx+s#V~GkH z3|Y(aEG#X(KR?yFUf~;ke!kn)gs__H+_%U-dpI96W?*+J#Fnf5xg@!}7^HoChpT1p zItatKYOUf6=Ys}>amqH&kMCt8iX1_^G42#5ckcMRBtFT=CSKh9(O;xzJbU(Rx0yh}tZ%k`PkWBx&k=-&;Q|f#5N8eA z)?_WDd&&b-?m#7c+?<|;MZWfvC-3*&rR?$C;hk5N=2zI^%hh9&cOnPf{# zi#!uE^B}-)MFKNhraQa3KKmvPi8?_RxR&MT)PJ?LSqz;ag}J${QnI6SQx(IdLiWdRqkg^{Hp)ec z+3jOXhYWcPZBBX2Cz(3+%kc!hMVq4ev)8b}s3^p3A3sV12~FW=nS-&P2j1wXQS2~$ z0)oK`Yc10QXU~fEp2Wl};wjUqpFD}QlIYei&X3!1a13n0`Q*7FA$kGOIChQT_2Me!_|vV8Vy`B^*Bp zVZnxE$Ips8O<@x-t7>>PPgdBSoHOrwfpmCR+715?>!YAO)P(7chusZpW!k|>?ZJBW zoq_9B5B>Pjrl+TOA@R87a=Cd}M1+%M-V)v4i-Q!Djve;;-UD0T-mZ#5L3#N=CAJbj zD*44L93~Mv#KHR}9E^W&NSk%AAyJaejE-u);!MG)g^dfqBH@&4bYDd%OHd(0?GS{2cEjp9g~ICpT~p6yD5+rnIH`;Mwye7bBlvRvZU~qFV0`9 z&2uQ2aN#?oA})XM9`)6y4o9izC3;k5)|k}Pm%b@Sq@}$-s!c-O}3XA)whP`o}Jb@F#)wsOGU^j4m*p z^J2$tFfwBFk@qp9C9~p@k-dVue9OUL2e;hpTCGuypC}SCIHtgBP`ta`n79)AThbSzTvwu&A8~1k2#z(r;;l_2+`#@ zm>?EY1gw7#4P_V_H1Ee8zGpo`-}~5?<6-%Uc<}S*s+=#o9L;EauIn#-li5UpubGgR z)Bd;5`QMF4+p8N6sJj#OKVCu9Cnqcni%3#rsFpS+K0as3gkk3*jRYe#b)!ty#q)nX z!{Hs6R1`6fvO>X6+xz^**7E4J@weT6g-2O3yHw3^r$n>&12#wiwHce31gY-^{OKbg zP??!v2dCrGQ67pS<1crZleYF+AbXlyZPYn7_Gw^1RW9-7dkur}I#G0A~&-BJUCcDDWqpxca#gs9WujB3i!}bU1TtaP&!T09Dh;)^treC?g9tE=>b??wNdJd}RI zhVVAr64#s8nORxYbam6WJI{%NTZCJ>hic>%*T4hI?eL$xA4=0xA+z~QXQEp z;I0f8tDooPQp&BraC2YXZcvJMQb>=aef6W2}2+6`8h2WFZ)tdyL{Td64%ST_atp*1N`G7cEw$%fkv(twg zT99kIB#QLbv*cvrXfgL6H^FTiq+^zwkWx?!8fnf0Ms}CUZI^`Y&CSgfp%0h;TH=Kp zvSF$T@|9%a-3OQY_V-l|aQ2r%nA#LldoVfr`@8nbGlV$i8UxSYk<(8I|MJ`z1j7fI zxb79qr&@HS$u+XSk|D}T5;M`()>dp2UN~(AfX}mA$-8!RFLQoc{9fXLQ~Im?o~tT# zH#54`?!)AizBjLZw9xIsou9Vn-aBU7T`}3=Go(jI_OK9HV&J+XDj7=-yc7J#Q9!!_nR;=4eupqxX~6 z?80A;fB@yDuao>v+J&Yi9C3yD1(BEKwN@Bf`L%?lGUmqj7}{>K_Duy z5C{U~fBfxBOVrlJ$=Jq8Pu1Pd*inbY&D!eE3MyTnZ!AEeKB)HmZ-r-}T0IA2D@Rrq zP!zE>z`e>tMucWNYYb4b7j{uFU1VuU9D$h*CWi1nF0+E&gxgzgBYUgWUIHR(|*Uf66;Lxm*4F z1b-T|20>s>2sW2FgZQIy?aQeDTI9Dk__I8P%^89bXw)9e|9gi#Bm7T!LtATPfBa*B zKZ_d|Y>$XQ^M4nAL4=BcUQl$fwR2=Ov~@84@2fNaXCML=2w@iLnt&XdB4`K%-fyo? za`l(u`gV5zE&b~-RuC3hYlg;8&iy%zrAdA%ZRqUiWNZE33Vv<=g)-d)4HOP1Mj$T# z*1Qnee_r0n%-GtP^`Gx-r&Yn>MEh_Q-k=owPy5Hy{LlV2POAC_R{yiWukVmX%SIjs zeOHP3r~NbN|5M)4*vSco&j0NH>l^4E3?uBpctXa=N`L)QzxJQvuEqu`f7I~r10eoc z3x@QI-j#795Xis3*YKU?KQ&kz8=32~I!GC@v$5FOm?Fo(ug`Fm`etS}JcBO`-rqZM z()d3$m>KIE89SV6!0%0}<9ES;Az*;tOP5;wR+{59^RIBfH$)DePMCkcmu9g3tu*^- zrMrG~oj<+p1Q^i&tVYPmW9)Eh+vHD{uM(U^AS7YZ|K2vX({H6uZF?Mtafc2{FaK3q z-u<`Ir&`VYTouVKbay`tf0AFj9g*eppVI#>guht+e~Z_zo%ezsr>+Jnp!%z#F5gos z`sY>ts0i6S72?AL)19qp1OoZ@_qo*M_n(UX9Y^NY`liPJ8AxYg@*xn!@FxL&S}=r( GfcSq9TX~`Y literal 0 HcmV?d00001 diff --git a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.flat.json b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.flat.json new file mode 100644 index 0000000000..54ef32c420 --- /dev/null +++ b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.flat.json @@ -0,0 +1,3073 @@ +{ + "requirements": [ + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.1", + "section_name": "Kodlama ve Temizleme Mimarisi", + "req_id": "V1.1.1", + "req_description": "Girdinin yalnızca bir kez kanonik forma (canonical form) çözümlendiği veya kaçış işlemlerinin kaldırıldığı, bu işlemin yalnızca verinin bu biçimde beklenmesi durumunda yapıldığı ve bu işlemin girdi doğrulama veya temizleme işlemlerinden sonra değil, önce gerçekleştiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.1", + "section_name": "Kodlama ve Temizleme Mimarisi", + "req_id": "V1.1.2", + "req_description": "Uygulamanın, çıktıyı kullanılması gereken yorumlayıcıya verilmeden hemen önce veya yorumlayıcının kendisi tarafından çıktı kodlaması ya da kaçış işlemi yaptığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.1", + "req_description": "HTTP yanıtı, HTML veya XML belgesi için yapılan çıktı kodlamasının; HTML elemanları, HTML öznitelikleri, HTML yorumları, CSS ya da HTTP başlık alanları gibi bağlamlara uygun olduğu doğrulanmalıdır. Böylece mesaj veya belge yapısının bozulması önlenir.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.2", + "req_description": "Dinamik olarak URL oluşturulurken, güvenilmeyen verinin bağlamına göre (örneğin, sorgu veya yol parametreleri için URL kodlaması ya da base64url kodlaması) kodlandığı doğrulanmalıdır. Yalnızca güvenli URL protokollerine izin verilmelidir (örneğin, javascript: veya data: yasaklanmalıdır).", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.3", + "req_description": "JavaScript içeriği (JSON dahil) dinamik olarak oluşturulurken çıktı kodlama/kaçış kullanıldığı doğrulanmalıdır. Böylece mesaj veya belge yapısı değiştirilmemiş olur (JavaScript ve JSON enjeksiyonlarının önüne geçilir).", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.4", + "req_description": "Veri sorguları veya veritabanı sorguları (SQL, HQL, NoSQL, Cypher vb.) için parametreli sorgular, ORM’ler, entity framework’ler kullanıldığı ya da SQL enjeksiyonu ve diğer veritabanı enjeksiyon saldırılarına karşı koruma sağlandığı doğrulanmalıdır. Bu durum, saklı yordam (stored procedure) yazarken de geçerlidir.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.5", + "req_description": "Uygulamanın işletim sistemi komut enjeksiyonlarına karşı korunduğu ve işletim sistemi çağrılarında parametreli OS sorguları veya bağlama özgü komut satırı çıktı kodlamasının kullanıldığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.6", + "req_description": "Uygulamanın LDAP enjeksiyon zafiyetlerine karşı korunduğu ya da LDAP enjeksiyonlarını önlemek için özel güvenlik kontrollerinin uygulandığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.7", + "req_description": "XPath enjeksiyon saldırılarına karşı, sorgu parametrelemesi veya önceden derlenmiş sorgular kullanılarak koruma sağlandığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.8", + "req_description": "LaTeX işlemcilerinin güvenli şekilde yapılandırıldığı (örneğin, --shell-escape bayrağının kullanılmadığı) ve yalnızca izin verilen komutlardan oluşan bir listeyle çalıştırıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.9", + "req_description": "Düzenli ifadelerde (regex) özel karakterlerin (genellikle ters eğik çizgi \\ ile) kaçırılarak meta karakter olarak yorumlanmalarının önlendiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.10", + "req_description": "Uygulamanın CSV ve formül enjeksiyonlarına karşı korunduğu doğrulanmalıdır. Uygulama, CSV içeriği dışa aktarırken RFC 4180 Bölüm 2.6 ve 2.7'de tanımlanan kaçış kurallarına uymalıdır. Ayrıca, CSV veya diğer tablo formatlarına (XLS, XLSX, ODF gibi) aktarım yapılırken, alanın ilk karakteri olarak çıkan özel karakterler ('=', '+', '-', '@', '\\t' (sekme), '\\0' (null karakter)) tek tırnak (') ile kaçırılmalıdır.", + "L": "3" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.1", + "req_description": "WYSIWYG editörlerinden veya benzer kaynaklardan gelen tüm güvenilmeyen HTML girdilerinin, bilinen ve güvenli bir HTML temizleme kütüphanesi ya da çerçeve özelliği ile temizlendiği doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.2", + "req_description": "Uygulamanın eval() veya Spring Expression Language (SpEL) gibi dinamik kod çalıştırma özelliklerini kullanmaktan kaçındığı doğrulanmalıdır. Alternatif yoksa, kullanıcı girdisi çalıştırılmadan önce mutlaka temizlenmelidir.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.3", + "req_description": "Potansiyel olarak tehlikeli bir bağlamda kullanılacak verilerin, bu bağlama uygun karakterlere izin vermek ve çok uzun girdileri kısaltmak gibi güvenlik önlemleriyle önceden temizlendiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.4", + "req_description": "Kullanıcı tarafından sağlanan SVG içeriğinin, yalnızca güvenli etiket ve özellikler (örneğin grafik çizme ile ilgili) içerdiğinden emin olmak için onaylandığı veya temizlendiği doğrulanmalıdır (ör. script veya foreignObject içermemelidir).", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.5", + "req_description": "Markdown, CSS, XSL stil sayfaları, BBCode veya benzeri ifade şablon dillerinde kullanıcı girdisinin temizlendiği veya bu tür özelliklerin devre dışı bırakıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.6", + "req_description": "Uygulamanın, güvenilmeyen verileri başka servislere iletmeden önce izinli protokol, alan adı, yol ve port listelerine göre doğruladığı ve tehlikeli karakterleri temizlediği doğrulanarak SSRF (Sunucu Taraflı İstek Sahteciliği) saldırılarına karşı korunduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.7", + "req_description": "Uygulamanın şablon enjeksiyon saldırılarına karşı, güvenilmeyen girdilere dayalı şablon oluşturmayı engellediği; eğer bu kaçınılmazsa, bu girdilerin mutlaka temizlendiği veya sıkı şekilde onaylandığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.8", + "req_description": "JNDI sorgularında kullanılmadan önce güvenilmeyen girdilerin temizlendiği ve JNDI'nin enjeksiyonlara karşı güvenli şekilde yapılandırıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.9", + "req_description": "Memcache’e gönderilmeden önce içeriğin temizlenerek enjeksiyon saldırılarına karşı korunduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.10", + "req_description": "Format dizgilerinin (format strings) beklenmeyen veya zararlı şekilde çözümlenmesini önlemek için işlenmeden önce temizlendiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.11", + "req_description": "SMTP veya IMAP enjeksiyonlarını önlemek için, kullanıcı girdisinin posta sistemlerine iletilmeden önce temizlendiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.12", + "req_description": "Regex girdilerinin üstel geri izlemeye (exponential backtracking) neden olan öğeler içermediği ve güvenilmeyen girdilerin ReDoS (Regex Denial of Service) gibi saldırılara karşı temizlendiği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.4", + "section_name": "Bellek, Dizgi ve Yönetilmeyen Kod", + "req_id": "V1.4.1", + "req_description": "Yığın, arabellek (buffer) veya yığın belleği taşmalarını önlemek ya da tespit etmek amacıyla, bellek güvenli dizgi işlemlerinin, daha güvenli bellek kopyalama ve işaretçi aritmetiğinin kullanıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.4", + "section_name": "Bellek, Dizgi ve Yönetilmeyen Kod", + "req_id": "V1.4.2", + "req_description": "Tamsayı taşmalarını önlemek için işaret (sign), aralık (range) ve giriş doğrulama tekniklerinin kullanıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.4", + "section_name": "Bellek, Dizgi ve Yönetilmeyen Kod", + "req_id": "V1.4.3", + "req_description": "Dinamik olarak ayrılan belleğin ve kaynakların serbest bırakıldığı ve boşaltılan belleklere ait referansların veya işaretçilerin kaldırıldığı veya null yapıldığı doğrulanmalıdır (dangling pointer ve use-after-free zafiyetlerine karşı).", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.5", + "section_name": "Güvenli Ters Serileştirme (Safe Deserialization)", + "req_id": "V1.5.1", + "req_description": "XML ayrıştırıcılarının (parser) kısıtlayıcı şekilde yapılandırıldığı ve dış varlık çözümleme (external entity resolution) gibi güvensiz özelliklerin XXE (XML eXternal Entity) saldırılarına karşı devre dışı bırakıldığı doğrulanmalıdır .", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.5", + "section_name": "Güvenli Ters Serileştirme (Safe Deserialization)", + "req_id": "V1.5.2", + "req_description": "Güvenilmeyen verilerin ters serileştirilmesinde, nesne türleri için izinli liste kullanımı veya istemci tanımlı nesne türlerinin kısıtlanması gibi güvenli giriş işleme önlemlerinin uygulandığı doğrulanmalıdır. Güvensiz olarak tanımlanmış ters serileştirme mekanizmaları, güvenilmeyen girdilerle kullanılmamalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.5", + "section_name": "Güvenli Ters Serileştirme (Safe Deserialization)", + "req_id": "V1.5.3", + "req_description": "Aynı veri türü için uygulamada kullanılan farklı parser'ların (ör. JSON, XML, URL parser'ları), veriyi tutarlı şekilde ayrıştırdığı ve aynı karakter kodlamasını kullandığı doğrulanmalıdır. Böylece JSON birlikte çalışabilirlik açıkları, URI veya dosya ayrıştırma farkları gibi sorunlar nedeniyle RFI veya SSRF saldırılarının istismar edilmesi önlenir.", + "L": "3" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.1", + "section_name": "Doğrulama ve İş Mantığı Dokümantasyonu", + "req_id": "V2.1.1", + "req_description": "Uygulama dokümantasyonunda, veri öğelerinin beklenen yapıya göre nasıl doğrulanacağına ilişkin giriş doğrulama kurallarının tanımlandığı doğrulanmalıdır. Bu; kredi kartı numaraları, e-posta adresleri, telefon numaraları gibi yaygın veri biçimleri olabileceği gibi iç sistemlere özel biçimler de olabilir.", + "L": "1" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.1", + "section_name": "Doğrulama ve İş Mantığı Dokümantasyonu", + "req_id": "V2.1.2", + "req_description": "Uygulama dokümantasyonunda, birleştirilmiş veri öğelerinin mantıksal ve bağlamsal tutarlılığının nasıl doğrulanacağı tanımlanmalıdır (örneğin, mahalle ve posta kodunun eşleşip eşleşmediğinin kontrolü).", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.1", + "section_name": "Doğrulama ve İş Mantığı Dokümantasyonu", + "req_id": "V2.1.3", + "req_description": "Hem kullanıcı bazında hem de uygulama genelinde geçerli olacak şekilde, iş mantığı sınırları ve doğrulama beklentilerinin belgelendiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.2", + "section_name": "Girdi Doğrulama", + "req_id": "V2.2.1", + "req_description": "Girdilerin, işlevsel ya da iş gereksinimlerine uygunluğunun doğrulandığı teyit edilmelidir. Bu işlem; izinli değerler, desenler ve aralıklar listesine karşı pozitif doğrulama ile ya da girdinin beklenen yapıya ve mantıksal sınırlara uygunluğunun önceden tanımlanmış kurallara göre karşılaştırılması ile yapılmalıdır. Seviye 1 için bu, güvenlik veya iş kararlarında kullanılan girdilere odaklanabilir. Seviye 2 ve üstü için tüm girdilere uygulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.2", + "section_name": "Girdi Doğrulama", + "req_id": "V2.2.2", + "req_description": "Uygulamanın, güvenilir bir servis katmanında girdi doğrulama zorunluluğu uygulayacak şekilde tasarlandığı doğrulanmalıdır. İstemci tarafında gerçekleştirilen doğrulama, kullanılabilirliği artırabilir ve teşvik edilmelidir. Ancak bu doğrulama,güvenlik kontrolü olarak kabul edilmemelidir.", + "L": "1" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.2", + "section_name": "Girdi Doğrulama", + "req_id": "V2.2.3", + "req_description": "Uygulamanın, ilişkili veri öğelerinin önceden tanımlanmış kurallara göre makul olup olmadığını kontrol ettiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.3", + "section_name": "İş Mantığı Güvenliği", + "req_id": "V2.3.1", + "req_description": "Uygulamanın, aynı kullanıcı için iş mantığı akışlarını yalnızca beklenen adım sırasına göre ve adım atlamadan işlediği doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.3", + "section_name": "İş Mantığı Güvenliği", + "req_id": "V2.3.2", + "req_description": "İş mantığı sınırlarının, uygulama dokümantasyonuna uygun şekilde uygulandığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.3", + "section_name": "İş Mantığı Güvenliği", + "req_id": "V2.3.3", + "req_description": "İş mantığı seviyesinde işlemlerin (transaction) kullanıldığı ve bir iş mantığı işleminin ya bütünüyle başarıyla tamamlandığı ya da önceki geçerli duruma geri döndürüldüğü (rollback) doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.3", + "section_name": "İş Mantığı Güvenliği", + "req_id": "V2.3.4", + "req_description": "İş mantığı düzeyinde kilitleme mekanizmalarının, sınırlı kaynakların (ör. sinema koltukları, teslimat zamanları) uygulamanın mantığı manipüle edilerek çift rezervasyona neden olmamasını sağladığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.3", + "section_name": "İş Mantığı Güvenliği", + "req_id": "V2.3.5", + "req_description": "Yüksek değerli iş mantığı akışlarının, yetkisiz veya kazara gerçekleşebilecek işlemleri önlemek için çoklu kullanıcı onayı gerektirdiği doğrulanmalıdır. Bu işlemler büyük para transferleri, sözleşme onayları, gizli bilgilere erişim veya üretimde güvenlik kurallarının geçersiz kılınmaları gibi durumları içerebilir.", + "L": "3" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.4", + "section_name": "Otomasyon Karşıtı Önlemler", + "req_id": "V2.4.1", + "req_description": "Uygulama işlevlerine yönelik aşırı miktardaki çağrılara karşı; veri sızdırma, anlamsız veri üretme, kota tüketme, hız sınırının aşılması, hizmet reddi (DoS) ya da maliyetli kaynakların aşırı kullanımı gibi risklere karşı otomasyon karşıtı kontrollerin bulunduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.4", + "section_name": "Otomasyon Karşıtı Önlemler", + "req_id": "V2.4.2", + "req_description": "İş mantığı akışlarının, aşırı hızlı işlem gönderimlerini önleyecek şekilde gerçekçi insan zamanlaması gerektirdiği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.1", + "section_name": "Web Frontend Güvenlik Dokümantasyonu", + "req_id": "V3.1.1", + "req_description": "Uygulama dokümantasyonunda, uygulamayı kullanan tarayıcıların desteklemesi gereken güvenlik özelliklerinin (ör. HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) ve diğer ilgili HTTP güvenlik mekanizmaları) tanımlandığı doğrulanmalıdır. Ayrıca bu özelliklerin mevcut olmadığı durumlarda uygulamanın nasıl davranması gerektiği (ör. kullanıcıyı uyarmak veya erişimi engellemek) de tanımlanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.2", + "section_name": "İçeriğin Yanlış Yorumlanması", + "req_id": "V3.2.1", + "req_description": "Tarayıcıların HTTP yanıtlarında içerik veya işlevi yanlış bir bağlamda sunmalarını önlemek amacıyla güvenlik kontrollerinin uygulandığı doğrulanmalıdır (ör. API, kullanıcı tarafından yüklenen dosya veya başka bir kaynağın doğrudan çağrılması durumunda). Olası kontroller arasında; yalnızca HTTP istek başlıklarının (ör. Sec-Fetch-\\*) doğru bağlamı gösterdiği durumlarda içeriğin sunulması, Content-Security-Policy başlığında \"sandbox\" yönergesinin kullanılması veya Content-Disposition başlığında \"attachment\" biçiminin kullanılması yer alabilir.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.2", + "section_name": "İçeriğin Yanlış Yorumlanması", + "req_id": "V3.2.2", + "req_description": "HTML yerine metin olarak görüntülenmesi amaçlanan içeriğin, HTML veya JavaScript gibi içeriklerin istenmeden çalıştırılmasını önleyecek şekilde \"createTextNode\" veya \"textContent\" gibi güvenli işleme fonksiyonlarıyla işlendiği doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.2", + "section_name": "İçeriğin Yanlış Yorumlanması", + "req_id": "V3.2.3", + "req_description": "Uygulamanın istemci tarafı JavaScript kullanırken açık değişken tanımlamaları yaparak, sıkı tür kontrolü uygulayarak, global değişkenleri document nesnesine kaydetmekten kaçınarak ve ad alanı izolasyonu sağlayarak DOM clobbering’den kaçındığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.3", + "section_name": "Çerez Yapılandırması", + "req_id": "V3.3.1", + "req_description": "Çerezlerin 'Secure' niteliğine sahip olduğu ve eğer çerez adı '\\__Host-' ön eki ile başlamıyorsa, '__Secure-' ön ekinin kullanıldığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.3", + "section_name": "Çerez Yapılandırması", + "req_id": "V3.3.2", + "req_description": "Kullanıcı arayüzü kandırma saldırılarına ve tarayıcı tabanlı istek sahteciliği saldırılarına (CSRF) karşı koruma sağlamak amacıyla, her çerezin 'SameSite' niteliğinin kullanım amacına uygun şekilde ayarlandığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.3", + "section_name": "Çerez Yapılandırması", + "req_id": "V3.3.3", + "req_description": "Çerez adı, diğer sunucularla paylaşılmak üzere açıkça tasarlanmadığı sürece '__Host-' ön eki ile tanımlanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.3", + "section_name": "Çerez Yapılandırması", + "req_id": "V3.3.4", + "req_description": "Bir çerez değeri istemci tarafı betikleri tarafından erişilememesi gereken bir veri içeriyorsa (ör. oturum token'ı), çerezin 'HttpOnly' niteliğine sahip olduğu ve aynı değerin (ör. oturum token'ı) yalnızca 'Set-Cookie' başlığı ile istemciye iletildiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.3", + "section_name": "Çerez Yapılandırması", + "req_id": "V3.3.5", + "req_description": "Uygulama bir çerez oluştururken, çerez adı ve değerinin toplam uzunluğunun 4096 baytı aşmadığı doğrulanmalıdır. Çok büyük çerezler tarayıcı tarafından saklanmaz ve isteklerle gönderilmez; bu da çereze bağlı çalışan uygulama işlevlerinin bozulmasına yol açabilir.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.4", + "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", + "req_id": "V3.4.2", + "req_description": "Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header'ı, uygulama tarafından sabit bir değer olarak tanımlanmalı veya gelen Origin header değeri güvenilir origin’lerden oluşan bir izinli listeye karşı doğrulanmalıdır. ‘Access-Control-Allow-Origin: *’ kullanılması gerekiyorsa, yanıtın hassas bilgi içermediği doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.4", + "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", + "req_id": "V3.4.3", + "req_description": "HTTP yanıtlarında Content-Security-Policy header'ı bulunduğu ve bu header'ın yalnızca güvenilen içeriklerin veya kaynakların yüklenmesini ve çalıştırılmasını sağlayan yönergeler içerdiği doğrulanmalıdır. Minimum olarak \"global policy\", object-src 'none', base-uri 'none' yönergelerini içermeli ve izinli liste, nonce veya hash temelli bir yapı içermelidir. Seviye 3 uygulamalarında her yanıt için nonce veya hash içeren özel bir politika tanımlanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.4", + "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", + "req_id": "V3.4.4", + "req_description": "Tüm HTTP yanıtlarının 'X-Content-Type-Options: nosniff' header'ını içerdiği doğrulanmalıdır. Bu, tarayıcıya içerik türünü tahmin etmeyi bırakmasını ve yanıtın Content-Type header'ında belirtilen MIME türünün, beklenen kaynak türüyle eşleşmesini zorunlu kılar. Ayrıca bu, tarayıcıda CORB (Cross-Origin Read Blocking) özelliğini etkinleştirir.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.4", + "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", + "req_id": "V3.4.5", + "req_description": "Uygulamanın, 'Referer' başlığı yoluyla üçüncü taraflara teknik olarak hassas verilerin sızmasını önlemek için bir 'referrer policy' belirlediği doğrulanmalıdır. Bu, Referrer-Policy HTTP header'ıyla veya HTML öğe nitelikleriyle (element attributes) sağlanabilir. Sızabilecek hassas bilgiler, URL’deki yol ve sorgu parametreleri ile sınırlı uygulamalarda hostname bilgisini içerebilir.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.4", + "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", + "req_id": "V3.4.6", + "req_description": "Uygulamanın, Content-Security-Policy header'ı altında 'frame-ancestors' yönergesini her HTTP yanıtında tanımladığı ve bu sayede içeriklerin varsayılan olarak başka sayfalara gömülmesini engellediği doğrulanmalıdır. Gerekli durumlarda özel olarak izin verildiğinden emin olunmalıdır. 'X-Frame-Options' header'ı, tarayıcılar tarafından desteklenmesine rağmen, artık güncel değildir ve güvenlik amacıyla kullanılmamalıdır.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.4", + "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", + "req_id": "V3.4.8", + "req_description": "Bir belgenin işlenmesini ve sunulmasını başlatan tüm HTTP yanıtlarında (örneğin 'text/html' tipi yanıtlar), 'Cross-Origin-Opener-Policy' header'ı 'same-origin' veya 'same-origin-allow-popups' yönergeleriyle birlikte yer almalıdır. Bu, tabnabbing ve frame counting gibi, pencere nesnelerine paylaşımlı erişimi sömüren saldırılara karşı koruma sağlar.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.5", + "section_name": "Tarayıcı Menşei Ayırımı", + "req_id": "V3.5.1", + "req_description": "Uygulama, hassas işlevselliğe yönelik izinsiz cross-origin istekleri önlemek için CORS preflight mekanizmasına güvenmiyorsa, bu tür isteklerin gerçekten uygulamadan geldiği doğrulanmalıdır. Bu, anti-forgery token kullanımı veya CORS tarafından güvenli kabul edilmeyen özel HTTP header'larının zorunlu kılınmasıyla yapılabilir. Bu, tarayıcı tabanlı istek sahteciliği (CSRF) saldırılarına karşı bir savunmadır.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.5", + "section_name": "Tarayıcı Menşei Ayırımı", + "req_id": "V3.5.2", + "req_description": "Uygulama, hassas işlevlerin izinsiz cross-origin çağrılmasını önlemek için CORS preflight mekanizmasına güveniyorsa, bu işlevlerin bir CORS-preflight isteğini tetiklemeden çağrılamadığı doğrulanmalıdır. Bu, 'Origin' ve 'Content-Type' header'larının doğrulanmasını veya CORS-safelisted olmayan bir header'ın ve alanın kullanılmasını gerektirebilir.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.5", + "section_name": "Tarayıcı Menşei Ayırımı", + "req_id": "V3.5.4", + "req_description": "Farklı uygulamaların farklı hostname'lerde barındırıldığı ve böylece Same-Origin Policy tarafından sağlanan kısıtlamalardan (örneğin çerez erişim sınırları, kaynaklar arası etkileşim kontrolleri) faydalanıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.5", + "section_name": "Tarayıcı Menşei Ayırımı", + "req_id": "V3.5.6", + "req_description": "Uygulamanın herhangi bir yerinde JSONP işlevselliğinin etkin olmadığı doğrulanmalıdır. Bu, XSSI (Cross-Site Script Inclusion) saldırılarını önlemek içindir.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.5", + "section_name": "Tarayıcı Menşei Ayırımı", + "req_id": "V3.5.7", + "req_description": "Yetkilendirme gerektiren verilerin, JavaScript dosyaları gibi betik kaynaklarının yanıtlarında yer almadığı, XSSI saldırılarını önlemek için doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.5", + "section_name": "Tarayıcı Menşei Ayırımı", + "req_id": "V3.5.8", + "req_description": "Kimliği doğrulanmış kaynakların (örneğin görseller, videolar, betikler ve belgeler) yalnızca gerçekten amaçlandığında kullanıcı adına yüklenebildiği veya gömülebildiği doğrulanmalıdır. Bu, isteğin uygun olmayan bir çapraz kaynak çağrısından kaynaklanmadığından emin olmak için Sec-Fetch-* HTTP istek başlığı alanlarının sıkı bir şekilde doğrulanmasıyla veya tarayıcıya döndürülen içeriği engelleme talimatı vermek için kısıtlayıcı bir Cross-Origin-Resource-Policy HTTP yanıt başlığı alanı ayarlayarak gerçekleştirilebilir.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.6", + "section_name": "Harici Kaynak Bütünlüğü", + "req_id": "V3.6.1", + "req_description": "JavaScript kütüphaneleri, CSS veya web fontları gibi istemci tarafı varlıkların yalnızca statik ve sürümlü olması, varlığın bütünlüğünü doğrulamak için Subresource Integrity (SRI) kullanılması durumunda harici olarak (örneğin, bir İçerik Dağıtım Ağı üzerinde) barındırıldığı doğrulanmalıdır. Bu mümkün değilse, her bir kaynak için bunu gerekçelendiren belgelenmiş bir güvenlik kararı bulunmalıdır.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.7", + "section_name": "Diğer Tarayıcı Güvenliği Hususları", + "req_id": "V3.7.1", + "req_description": "Uygulamanın yalnızca hâlâ desteklenen ve güvenli kabul edilen istemci tarafı teknolojileri kullandığı doğrulanmalıdır. Bu gereksinimi karşılamayan teknolojilere örnek olarak NSAPI eklentileri, Flash, Shockwave, ActiveX, Silverlight, NACL veya istemci tarafı Java applet’leri verilebilir.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.7", + "section_name": "Diğer Tarayıcı Güvenliği Hususları", + "req_id": "V3.7.2", + "req_description": "Uygulamanın, yalnızca hedef adres bir izinli listede yer alıyorsa kullanıcıyı otomatik olarak farklı bir ana makine adına veya uygulamanın kontrolünde olmayan bir etki alanına yönlendirdiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.7", + "section_name": "Diğer Tarayıcı Güvenliği Hususları", + "req_id": "V3.7.3", + "req_description": "Uygulamanın, kullanıcı uygulamanın kontrolü dışındaki bir URL’ye yönlendirildiğinde, yönlendirme hakkında bir bildirim gösterdiği ve kullanıcının bu gezintiyi iptal edebilmesi için bir seçenek sunduğu doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.7", + "section_name": "Diğer Tarayıcı Güvenliği Hususları", + "req_id": "V3.7.4", + "req_description": "Uygulamanın en üst düzey etki alanının (örneğin, site.tld) HTTP Strict Transport Security (HSTS) için genel preload listesine eklendiği doğrulanmalıdır. Bu, uygulamanın TLS kullanımının ana tarayıcılar tarafından doğrudan tanınmasını ve yalnızca Strict-Transport-Security yanıt header'ına bağlı kalınmamasını sağlar.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.7", + "section_name": "Diğer Tarayıcı Güvenliği Hususları", + "req_id": "V3.7.5", + "req_description": "Uygulamaya erişen tarayıcının beklenen güvenlik özelliklerini desteklememesi durumunda, uygulamanın dokümantasyona uygun şekilde davrandığı (örneğin kullanıcıyı uyarma veya erişimi engelleme) doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.1", + "section_name": "Genel Web Servisi Güvenliği", + "req_id": "V4.1.1", + "req_description": "İleti gövdesi içeren her HTTP yanıtında, yanıtın gerçek içeriğiyle eşleşen bir Content-Type header alanı bulunduğu ve güvenli karakter kodlamasını (örneğin, UTF-8, ISO-8859-1) belirtmek üzere charset parametresi içerdiği doğrulanmalıdır. Bu işlem, IANA Medya Türleri'nden \"text/\", \"/+xml\" ve \"/xml\" gibi içerikler için geçerlidir.", + "L": "1" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.1", + "section_name": "Genel Web Servisi Güvenliği", + "req_id": "V4.1.2", + "req_description": "Yalnızca kullanıcı arayüzüne yönelik uç noktaların (manuel olarak web tarayıcısı ile erişilmesi amaçlanan) otomatik olarak HTTP'den HTTPS'e yönlendirme yaptığı ve diğer hizmetlerin veya uç noktaların şeffaf yönlendirme gerçekleştirmediği doğrulanmalıdır. Bu, istemcinin farkında olmadan şifrelenmemiş HTTP istekleri göndermesi ve bu isteklerin otomatik olarak HTTPS'e yönlendirilmesi sonucunda hassas verilerin sızmasının fark edilmemesi riskini önlemek içindir.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.1", + "section_name": "Genel Web Servisi Güvenliği", + "req_id": "V4.1.3", + "req_description": "Uygulama tarafından kullanılan ve yük dengeleyici, web proxy veya frontend için backend hizmeti gibi bir ara katman tarafından ayarlanan herhangi bir HTTP başlık alanının, son kullanıcı tarafından geçersiz kılınamayacağı doğrulanmalıdır. Örnek başlıklar arasında X-Real-IP, X-Forwarded-* veya X-User-ID yer alabilir.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.1", + "section_name": "Genel Web Servisi Güvenliği", + "req_id": "V4.1.4", + "req_description": "Uygulama veya API tarafından açıkça desteklenen HTTP yöntemlerinin (preflight istekleri sırasında OPTIONS dahil) dışında hiçbir yöntemin kullanılmadığı ve kullanılmayan yöntemlerin engellendiği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.1", + "section_name": "Genel Web Servisi Güvenliği", + "req_id": "V4.1.5", + "req_description": "Çok hassas istekler veya birçok sistemden geçen işlemler için, taşıma katmanı güvenliğinin üzerine ek bir güvence sağlamak amacıyla, her iletiye özel dijital imzaların kullanıldığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.2", + "section_name": "HTTP İleti Yapısı Doğrulama", + "req_id": "V4.2.1", + "req_description": "Tüm uygulama bileşenlerinin (yük dengeleyiciler, güvenlik duvarları ve uygulama sunucuları dahil) HTTP sürümüne uygun mekanizmaları kullanarak gelen HTTP iletilerinin sınırlarını belirlediği ve bu sayede HTTP istek kaçakçılığına karşı koruma sağlandığı doğrulanmalıdır. HTTP/1.x sürümünde Transfer-Encoding başlık alanı varsa, RFC 2616'ya göre Content-Length başlığı göz ardı edilmelidir. HTTP/2 veya HTTP/3 kullanıldığında, Content-Length başlığı varsa, alıcının bu değerin DATA çerçevelerinin uzunluğuyla tutarlı olduğunu doğrulaması gerekir.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.2", + "section_name": "HTTP İleti Yapısı Doğrulama", + "req_id": "V4.2.2", + "req_description": "HTTP iletileri üretilirken, Content-Length başlığının, HTTP protokolünün çerçeveleme yöntemine göre belirlenen içerik uzunluğu ile çelişmediği doğrulanmalıdır. Bu, istek kaçakçılığı saldırılarını önlemek için gereklidir.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.2", + "section_name": "HTTP İleti Yapısı Doğrulama", + "req_id": "V4.2.3", + "req_description": "Uygulamanın, yanıt bölme ve header enjeksiyonu saldırılarını önlemek amacıyla, bağlantıya özel başlık alanları (örneğin Transfer-Encoding) içeren HTTP/2 veya HTTP/3 iletilerini göndermediği ve kabul etmediği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.2", + "section_name": "HTTP İleti Yapısı Doğrulama", + "req_id": "V4.2.4", + "req_description": "Uygulamanın yalnızca başlık alanları ve değerleri CR (\\r), LF (\\n) veya CRLF (\\r\\n) karakter dizileri içermeyen HTTP/2 ve HTTP/3 isteklerini kabul ettiği doğrulanmalıdır. Bu, başlık enjeksiyonu saldırılarını önlemek içindir.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.2", + "section_name": "HTTP İleti Yapısı Doğrulama", + "req_id": "V4.2.5", + "req_description": "Uygulama (backend veya frontend) istek oluşturuyor ve gönderiyorsa, URI'ler (örneğin API çağrıları için) veya HTTP istek başlıkları (örneğin Authorization veya Cookie) gibi bileşenlerin, alıcı sistemler tarafından kabul edilemeyecek kadar uzun olmamasını sağlamak amacıyla doğrulama, temizleme veya diğer mekanizmaları kullandığı doğrulanmalıdır. Bu tür çok uzun istekler (örneğin çok uzun bir Cookie başlığı) gönderildiğinde sunucunun sürekli hata durumu döndürmesiyle hizmet reddi oluşabilir.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.3", + "section_name": "GraphQL", + "req_id": "V4.3.1", + "req_description": "Maliyetli ve iç içe geçmiş sorgular sonucu oluşabilecek GraphQL veya veri katmanı ifadelerine yönelik Hizmet Reddi (DoS) saldırılarını önlemek için, sorgu izin listesi (allowlist), derinlik sınırlandırması, sorgu sayısı sınırlandırması veya sorgu maliyeti analizi kullanıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.3", + "section_name": "GraphQL", + "req_id": "V4.3.2", + "req_description": "GraphQL introspection (iç yapı sorgulama) sorgularının, GraphQL API'nin üçüncü taraflar tarafından kullanılmasına yönelik olmadığı sürece, üretim ortamında devre dışı bırakıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.1", + "req_description": "Tüm WebSocket bağlantılarında TLS üzerinden WebSocket (WSS) kullanıldığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.2", + "req_description": "WebSocket'in başlangıçtaki HTTP el sıkışması (handshake) sırasında, Origin başlık alanının uygulama için izin verilen origin listesiyle karşılaştırılarak kontrol edildiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.3", + "req_description": "Uygulamanın standart oturum yönetimi kullanılamıyorsa, bunun yerine ilgili Oturum Yönetimi güvenlik gereksinimlerine uygun özel token'ların kullanıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.4", + "req_description": "HTTPS oturumu WebSocket kanalına geçerken, özel WebSocket oturum yönetim token’larının önceki şekilde kimliği doğrulanmış HTTPS oturumu aracılığıyla elde edildiği veya doğrulandığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.1", + "section_name": "Dosya İşleme Dokümantasyonu", + "req_id": "V5.1.1", + "req_description": "Dokümantasyonun, her yükleme özelliği için izin verilen dosya türlerini, beklenen dosya uzantılarını ve maksimum boyutu (açılmış hali dahil) tanımladığı doğrulanmalıdır. Ayrıca, dosyaların son kullanıcılar için nasıl güvenli hâle getirileceği (örneğin kötü amaçlı bir dosya tespit edildiğinde uygulamanın nasıl davranacağı) gibi bilgilerin de belgede yer aldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.2", + "section_name": "Dosya Yükleme ve İçerik", + "req_id": "V5.2.1", + "req_description": "Uygulamanın, yalnızca performans kaybına veya hizmet reddine yol açmayacak boyuttaki dosyaları kabul ettiği doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.2", + "section_name": "Dosya Yükleme ve İçerik", + "req_id": "V5.2.2", + "req_description": "Uygulama bir dosyayı, doğrudan veya bir arşiv (ör. zip dosyası) içinde kabul ettiğinde, dosya uzantısının beklenen uzantıyla eşleşip eşleşmediğini kontrol ettiği ve içeriğin uzantı tarafından temsil edilen türle uyumlu olduğunu doğruladığı kontrol edilmelidir. Bu; ilk 'magic byte' kontrolü, görüntü yeniden yazımı ve dosya içeriği doğrulama için özel kütüphanelerin kullanımı gibi yöntemleri içerir. Seviye 1 için bu, yalnızca iş veya güvenlik kararlarında kullanılan dosyalarla sınırlı olabilir. Seviye 2 ve üzeri için tüm dosyalar bu kontrole tabi olmalıdır.", + "L": "1" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.2", + "section_name": "Dosya Yükleme ve İçerik", + "req_id": "V5.2.3", + "req_description": "Sıkıştırılmış dosyaların (ör. zip, gz, docx, odt) açılmadan önce, izin verilen maksimum açılmış boyuta ve maksimum dosya sayısına göre kontrol edildiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.2", + "section_name": "Dosya Yükleme ve İçerik", + "req_id": "V5.2.4", + "req_description": "Her kullanıcı için dosya boyutu kotası ve maksimum dosya sayısının uygulandığı doğrulanmalıdır. Böylece tek bir kullanıcının çok sayıda veya aşırı büyük dosya yükleyerek depolama alanını doldurması engellenir.", + "L": "3" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.2", + "section_name": "Dosya Yükleme ve İçerik", + "req_id": "V5.2.5", + "req_description": "Uygulamanın, içinde sembolik bağlantılar (symlink) bulunan sıkıştırılmış dosyaların yüklenmesine yalnızca bu durum özel olarak gerekli olduğunda izin verdiği doğrulanmalıdır. Bu durumda, sembolik bağlantı verilebilecek dosyaların bir izinli listesi uygulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.2", + "section_name": "Dosya Yükleme ve İçerik", + "req_id": "V5.2.6", + "req_description": "Uygulamanın, piksel boyutu izin verilen maksimum değeri aşan görüntü dosyalarının yüklenmesini reddettiği doğrulanmalıdır. Bu, pixel flood saldırılarını önlemek için gereklidir.", + "L": "3" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.3", + "section_name": "Dosya Depolama", + "req_id": "V5.3.1", + "req_description": "Güvenilmeyen girdilerle yüklenen veya oluşturulan ve herkese açık klasörlerde depolanan dosyaların, bir HTTP isteğiyle doğrudan erişildiğinde sunucu taraflı program kodu olarak çalıştırılmadığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.3", + "section_name": "Dosya Depolama", + "req_id": "V5.3.2", + "req_description": "Uygulamanın, dosya işlemleri için dosya yollarını oluştururken kullanıcı tarafından gönderilen dosya adlarını değil, dahili olarak oluşturulan veya güvenilir verileri kullandığı; eğer kullanıcı tarafından gönderilen dosya adları veya meta veriler kullanılacaksa, sıkı doğrulama ve temizleme işlemlerinin uygulandığı doğrulanmalıdır. Bu, yol geçişi (path traversal), yerel veya uzak dosya dahil etme (LFI, RFI) ve sunucu tarafı istek sahteciliği (SSRF) saldırılarına karşı koruma sağlar.", + "L": "1" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.3", + "section_name": "Dosya Depolama", + "req_id": "V5.3.3", + "req_description": "Sunucu tarafında gerçekleşen dosya işlemlerinin (örneğin dosya açma/decompress işlemi), kullanıcı tarafından sağlanan yol bilgilerini yok saydığı ve zip slip gibi güvenlik açıklarını önlediği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.4", + "section_name": "Dosya İndirme", + "req_id": "V5.4.1", + "req_description": "Uygulamanın, kullanıcı tarafından gönderilen dosya adlarını (ör. JSON, JSONP veya URL parametresinde) doğruladığı veya göz ardı ettiği ve yanıtın Content-Disposition başlık alanında bir dosya adı belirttiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.4", + "section_name": "Dosya İndirme", + "req_id": "V5.4.2", + "req_description": "Sunulan dosya adlarının (örneğin HTTP yanıt header'larında veya e-posta eklerinde), belge yapısını korumak ve enjeksiyon saldırılarını önlemek için kodlandığı veya temizlendiği (ör. RFC 6266’ya uygun) doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.4", + "section_name": "Dosya İndirme", + "req_id": "V5.4.3", + "req_description": "Güvenilmeyen kaynaklardan elde edilen dosyaların, bilinen kötü amaçlı içeriklerin sunulmasını önlemek amacıyla antivirüs tarayıcılarıyla tarandığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.1", + "section_name": "Kimlik Doğrulama Dokümantasyonu", + "req_id": "V6.1.1", + "req_description": "Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırılarına karşı oran sınırlama (rate limiting), otomasyon karşıtı önlemler ve uyarlanabilir yanıt gibi kontrollerin nasıl kullanıldığını açıklayan bir uygulama dokümantasyonu bulunduğu doğrulanmalıdır. Dokümantasyon, bu kontrollerin nasıl yapılandırıldığını ve kötü niyetli hesap kilitlemenin nasıl önlendiğini açıkça ortaya koymalıdır.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.1", + "section_name": "Kimlik Doğrulama Dokümantasyonu", + "req_id": "V6.1.2", + "req_description": "Parolalarda kullanılmasını önlemek amacıyla, bağlama özgü sözcüklerin (örneğin kurum adlarının permütasyonları, ürün adları, sistem tanımlayıcıları, proje kod adları, departman veya rol adları vb.) bulunduğu belgelenmiş bir liste mevcut olduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.1", + "section_name": "Kimlik Doğrulama Dokümantasyonu", + "req_id": "V6.1.3", + "req_description": "Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, bunların tümünün belgelenmiş olduğu ve her yol için tutarlı şekilde uygulanması gereken güvenlik kontrolleri ile kimlik doğrulama gücünün tanımlandığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.1", + "req_description": "Kullanıcı tarafından belirlenen parolaların en az 8 karakter uzunluğunda olması sağlanmalı, ancak 15 karakter ve üzeri uzunlukta parolalar olmaları şiddetle tavsiye edilir.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.2", + "req_description": "Kullanıcıların parolalarını değiştirebilmeleri sağlanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.3", + "req_description": "Parola değiştirme işlevinin hem mevcut hem de yeni parolayı gerektirdiği doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.4", + "req_description": "Kayıt veya parola değişimi sırasında girilen parolaların, uygulamanın parola politikasına (örneğin minimum uzunluk) uyan ilk 3000 yaygın parolaya karşı kontrol edildiği doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.5", + "req_description": "Her tür karakterin kullanılmasına izin verildiği ve büyük/küçük harf, sayı veya özel karakter şartlarının zorunlu tutulmadığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.6", + "req_description": "Parola giriş alanlarının, girdiyi maskelemek için \"type=password\" kullandığı doğrulanmalıdır. Uygulamalar, kullanıcının tüm maskelenmiş parolayı ya da son girilen karakteri geçici olarak görüntülemesine izin verebilir.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.7", + "req_description": "\"Yapıştır\" özelliğinin, tarayıcı parola yardımcılarının ve harici parola yöneticilerinin kullanımına izin verildiği doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.8", + "req_description": "Uygulamanın, kullanıcıdan aldığı parolayı herhangi bir şekilde değiştirmeden, örneğin kesmeden veya harf büyüklüğünü değiştirmeden, tam olarak doğruladığı teyit edilmelidir.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.9", + "req_description": "En az 64 karakter uzunluğundaki parolalara izin verildiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.10", + "req_description": "Kullanıcının parolasının, yalnızca ele geçirildiği tespit edildiğinde veya kullanıcı tarafından yenilendiğinde geçerliliğini yitirdiği doğrulanmalıdır. Uygulama, belirli aralıklarla parola yenilenmesini zorunlu kılmamalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.11", + "req_description": "Tahmin edilmesi kolay parolaların oluşturulmasını önlemek amacıyla, bağlama özgü kelimelerin yer aldığı belgelenmiş listenin parola doğrulamada kullanıldığı teyit edilmelidir.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.12", + "req_description": "Kayıt veya parola değişikliği sırasında girilen parolaların, ele geçirilmiş parolalar listesine karşı kontrol edildiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.3", + "section_name": "Genel Kimlik Doğrulama Güvenliği", + "req_id": "V6.3.1", + "req_description": "Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırıları gibi saldırıları önlemeye yönelik kontrollerin, uygulamanın güvenlik dokümantasyonuna göre uygulandığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.3", + "section_name": "Genel Kimlik Doğrulama Güvenliği", + "req_id": "V6.3.2", + "req_description": "\"root\", \"admin\" veya \"sa\" gibi varsayılan kullanıcı hesaplarının uygulamada yer almadığı veya devre dışı bırakıldığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.3", + "section_name": "Genel Kimlik Doğrulama Güvenliği", + "req_id": "V6.3.3", + "req_description": "Uygulamaya erişim için ya çok faktörlü bir kimlik doğrulama mekanizması ya da tek faktörlü mekanizmaların kombinasyonu kullanılmalıdır. Seviye 3 için, bu faktörlerden biri, oltalama saldırılarına karşı direnç sağlayan ve kimlik doğrulama niyetini bir kullanıcı etkileşimi (örneğin FIDO donanım anahtarında bir düğmeye basma veya mobil telefonda bir onay) gerektirerek doğrulayan donanım tabanlı bir kimlik doğrulayıcı olmalıdır. Bu gereksinimdeki herhangi bir esneklik için, gerekçesi belgelenmiş ve riskleri azaltıcı kapsamlı kontroller içeren bir plan gereklidir.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.3", + "section_name": "Genel Kimlik Doğrulama Güvenliği", + "req_id": "V6.3.4", + "req_description": "Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, belgelendirilmemiş bir yol bulunmadığı ve tüm yollar için güvenlik kontrolleri ile kimlik doğrulama gücünün tutarlı şekilde uygulandığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.3", + "section_name": "Genel Kimlik Doğrulama Güvenliği", + "req_id": "V6.3.5", + "req_description": "Başarılı veya başarısız şüpheli kimlik doğrulama girişimlerinin kullanıcıya bildirildiği doğrulanmalıdır. Bu, olağandışı bir konum veya istemciden gelen girişimler, yalnızca bir faktörle yapılan kısmen başarılı doğrulamalar, uzun süreli inaktiflik sonrası yapılan girişimler veya birçok başarısız denemeden sonraki başarılı girişimler gibi durumları içerebilir.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.3", + "section_name": "Genel Kimlik Doğrulama Güvenliği", + "req_id": "V6.3.6", + "req_description": "E-postanın, tek faktörlü ya da çok faktörlü kimlik doğrulama mekanizması olarak kullanılmadığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.3", + "section_name": "Genel Kimlik Doğrulama Güvenliği", + "req_id": "V6.3.7", + "req_description": "Kimlik doğrulama detaylarında yapılan güncellemeler sonrasında (örneğin kimlik bilgisi sıfırlama, kullanıcı adı veya e-posta adresi değişiklikleri), kullanıcıların bilgilendirildiği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.3", + "section_name": "Genel Kimlik Doğrulama Güvenliği", + "req_id": "V6.3.8", + "req_description": "Başarısız kimlik doğrulama girişimlerinden, geçerli kullanıcıların hata mesajları, HTTP yanıt kodları veya farklı yanıt süreleri gibi sonuçlara dayanarak tespit edilemediği doğrulanmalıdır. Bu koruma, kayıt ve \"parolamı unuttum\" işlevselliğinde de geçerli olmalıdır.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.4", + "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", + "req_id": "V6.4.1", + "req_description": "Sistem tarafından oluşturulan ilk parolaların veya etkinleştirme kodlarının güvenli bir şekilde rastgele üretildiği, mevcut parola politikasına uygun olduğu, kısa bir süre içinde veya ilk kullanım sonrasında geçerliliğini yitirdiği doğrulanmalıdır. Bu başlangıç sırları uzun vadeli parola olarak kullanılmasına izin verilmemelidir.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.4", + "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", + "req_id": "V6.4.2", + "req_description": "Parola ipuçlarının veya \"gizli sorular\" olarak bilinen, bilgiye dayalı kimlik doğrulama mekanizmalarının mevcut olmadığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.4", + "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", + "req_id": "V6.4.3", + "req_description": "Unutulmuş parolanın sıfırlanması için, etkin olan çok faktörlü kimlik doğrulama mekanizmalarını atlamayan güvenli bir sürecin uygulandığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.4", + "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", + "req_id": "V6.4.4", + "req_description": "Çok faktörlü kimlik doğrulama faktörlerinden biri kaybolursa, kayıt sırasında uygulanan kimlik kanıtlama seviyesiyle aynı seviyede kimlik doğrulama yapıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.4", + "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", + "req_id": "V6.4.5", + "req_description": "Süresi dolacak kimlik doğrulama mekanizmalarının yenilenmesine ilişkin talimatların, süresi dolmadan önce tamamlanacak şekilde yeterli sürede gönderildiği ve gerekiyorsa otomatik hatırlatıcıların yapılandırıldığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.4", + "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", + "req_id": "V6.4.6", + "req_description": "Yönetici yetkisi olan kullanıcıların, kullanıcının parola sıfırlama sürecini başlatabildiği ancak kullanıcının yeni parolasını belirleyemediği veya değiştiremediği doğrulanmalıdır. Bu, yönetici yetkisi olan kullanıcıların, kullanıcı parolasını bilmesini engeller.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.5", + "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "req_id": "V6.5.1", + "req_description": "Arama sırları, bant dışı kimlik doğrulama istekleri veya kodları ve zamana dayalı tek kullanımlık parolaların (TOTP) yalnızca bir kez kullanılabildiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.5", + "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "req_id": "V6.5.2", + "req_description": "Uygulamanın backend tarafında saklanırken, 112 bitten az entropiye sahip (örneğin 19 rastgele harf-rakam karakteri veya 34 rastgele rakam) arama sırlarının, 32-bit rastgele bir salt içeren onaylı bir parola saklama algoritmasıyla hash’lendiği doğrulanmalıdır. Gizli bilginin entropisi 112 bit veya daha fazlaysa standart bir hash fonksiyonu kullanılabilir.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.5", + "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "req_id": "V6.5.3", + "req_description": "Arama sırları, bant dışı kimlik doğrulama kodları ve zamana dayalı tek kullanımlık parola seed'lerinin, öngörülebilir değerlerden kaçınmak için Kriptografik Olarak Güvenli Sözde Rastgele Sayı Üreteci (CSPRNG) ile oluşturulduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.5", + "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "req_id": "V6.5.4", + "req_description": "Arama sırlarının ve bant dışı kimlik doğrulama kodlarının en az 20 bit entropiye (genellikle 4 rastgele harf-rakam karakteri veya 6 rastgele rakam) sahip olduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.5", + "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "req_id": "V6.5.5", + "req_description": "Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının ve zamana dayalı tek kullanımlık parolaların (TOTP) belirli bir ömre sahip olduğu doğrulanmalıdır. Bant dışı istekler en fazla 10 dakika, TOTP’ler ise en fazla 30 saniye geçerli olmalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.5", + "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "req_id": "V6.5.6", + "req_description": "Herhangi bir kimlik doğrulama faktörünün (fiziksel cihazlar dahil) çalınması veya kaybı durumunda iptal edilebildiği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.5", + "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "req_id": "V6.5.7", + "req_description": "Biyometrik kimlik doğrulama mekanizmalarının yalnızca ikincil faktör olarak, “sahip olduğunuz bir şey” veya “bildiğiniz bir şey” ile birlikte kullanıldığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.5", + "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "req_id": "V6.5.8", + "req_description": "Zamana dayalı tek kullanımlık parolaların (TOTP) doğrulamasının, güvenilir bir hizmetten alınan zaman kaynağına dayanarak yapıldığı ve güvenilir olmayan veya istemci tarafından sağlanan zaman kaynağına dayanmadığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.6", + "section_name": "Bant Dışı Kimlik Doğrulama Mekanizmaları", + "req_id": "V6.6.1", + "req_description": "Tek kullanımlık parolaların (OTP) telefon veya SMS ile Public Switched Telephone Network (PSTN) üzerinden iletildiği kimlik doğrulama mekanizmalarının, yalnızca telefon numarası önceden doğrulanmışsa, alternatif daha güçlü yöntemler (örneğin TOTP) de sunuluyorsa ve kullanıcıya güvenlik riskleri hakkında bilgi veriliyorsa sunulduğu doğrulanmalıdır. Seviye 3 uygulamalar için telefon ve SMS seçenekleri sunulmamalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.6", + "section_name": "Bant Dışı Kimlik Doğrulama Mekanizmaları", + "req_id": "V6.6.2", + "req_description": "Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının, oluşturuldukları özgün kimlik doğrulama isteğiyle bağlantılı olduğu ve daha önceki ya da sonraki bir istek için kullanılamadığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.6", + "section_name": "Bant Dışı Kimlik Doğrulama Mekanizmaları", + "req_id": "V6.6.3", + "req_description": "Kod tabanlı bant dışı kimlik doğrulama mekanizmalarının, oran sınırlaması ile kaba kuvvet saldırılarına karşı korunduğu doğrulanmalıdır. En az 64 bit entropiye sahip kodlar kullanılması da değerlendirilmelidir.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.6", + "section_name": "Bant Dışı Kimlik Doğrulama Mekanizmaları", + "req_id": "V6.6.4", + "req_description": "Çok faktörlü kimlik doğrulama için push bildirimleri kullanılıyorsa, push bombing saldırılarına karşı oran sınırlamasının kullanıldığı doğrulanmalıdır. “Numara eşleştirme” de bu riski azaltabilir.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.7", + "section_name": "Kriptografik Kimlik Doğrulama Mekanizması", + "req_id": "V6.7.1", + "req_description": "Kriptografik kimlik doğrulama beyanlarını doğrulamak için kullanılan sertifikaların, değiştirilmeye karşı korumalı şekilde saklandığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.7", + "section_name": "Kriptografik Kimlik Doğrulama Mekanizması", + "req_id": "V6.7.2", + "req_description": "Challenge nonce değerinin en az 64 bit uzunluğunda olduğu ve istatistiksel olarak benzersiz ya da cihazın ömrü boyunca benzersiz olduğu doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.8", + "section_name": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", + "req_id": "V6.8.1", + "req_description": "Uygulama birden fazla kimlik sağlayıcıyı (IdP) destekliyorsa, başka bir desteklenen kimlik sağlayıcı aracılığıyla (örneğin aynı kullanıcı tanımlayıcısını kullanarak) kullanıcının kimliğinin taklit edilemediği doğrulanmalıdır. Standart önlem, uygulamanın kullanıcıyı IdP kimliği (bir ad alanı işlevi görür) ve IdP içindeki kullanıcı kimliğinin birleşimiyle kaydetmesi ve tanımlamasıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.8", + "section_name": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", + "req_id": "V6.8.2", + "req_description": "Kimlik doğrulama beyanları üzerindeki dijital imzaların (örneğin JWT veya SAML beyanları) varlığı ve bütünlüğünün her zaman doğrulandığı ve imzasız veya geçersiz imzalı beyanların reddedildiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.8", + "section_name": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", + "req_id": "V6.8.3", + "req_description": "SAML beyanlarının benzersiz biçimde işlendiği ve yalnızca geçerlilik süresi içinde bir kez kullanıldığı, tekrar oynatma (replay) saldırılarını önlemek amacıyla doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.8", + "section_name": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", + "req_id": "V6.8.4", + "req_description": "Uygulama ayrı bir Kimlik Sağlayıcı (IdP) kullanıyorsa ve belirli işlemler için belirli kimlik doğrulama gücü, yöntemleri veya zaman bilgisi bekliyorsa, uygulamanın bu bilgileri IdP tarafından döndürülen veriler üzerinden doğruladığı teyit edilmelidir. Örneğin OIDC kullanılıyorsa, bu durum ID Token üzerindeki 'acr', 'amr' ve 'auth_time' gibi claim’lerin (varsa) doğrulanması ile sağlanabilir. Eğer IdP bu bilgileri sağlamıyorsa, uygulamanın asgari kimlik doğrulama gücünün kullanıldığını varsayan (örneğin yalnızca kullanıcı adı ve parola ile tek faktörlü doğrulama) belgelenmiş bir yedek yaklaşımı olmalıdır.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.1", + "section_name": "Oturum Yönetim Dokümantasyonu", + "req_id": "V7.1.1", + "req_description": "Kullanıcının oturum inaktivite zaman aşımı süresi ve mutlak maksimum oturum süresinin belgelendiği, diğer kontrollerle birlikte uygun olduğu ve NIST SP 800-63B yeniden kimlik doğrulama gereksinimlerinden herhangi bir sapma varsa gerekçesinin belgede yer aldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.1", + "section_name": "Oturum Yönetim Dokümantasyonu", + "req_id": "V7.1.2", + "req_description": "Belgede bir hesap için kaç adet eşzamanlı (paralel) oturuma izin verildiği ile birlikte, maksimum aktif oturum sayısına ulaşıldığında uygulanacak davranış ve işlemlerin tanımlandığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.1", + "section_name": "Oturum Yönetim Dokümantasyonu", + "req_id": "V7.1.3", + "req_description": "Birleşik kimlik yönetim ekosisteminin bir parçası olarak kullanıcı oturumu oluşturan ve yöneten tüm sistemlerin, oturum ömrü, sonlandırma ve yeniden kimlik doğrulama gerektiren diğer koşulların nasıl koordine edildiğini açıklayan kontrollerle birlikte belgede yer aldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.2", + "section_name": "Temel Oturum Yönetimi Güvenliği", + "req_id": "V7.2.1", + "req_description": "Uygulamanın tüm oturum token'ı doğrulama işlemlerini güvenilir bir backend servisi aracılığıyla gerçekleştirdiği doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.2", + "section_name": "Temel Oturum Yönetimi Güvenliği", + "req_id": "V7.2.2", + "req_description": "Uygulamanın, statik API gizli anahtarları veya sabit değerler yerine, oturum yönetimi için dinamik olarak oluşturulan kendi kendine yeterli veya referans token'ları kullandığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.2", + "section_name": "Temel Oturum Yönetimi Güvenliği", + "req_id": "V7.2.3", + "req_description": "Uygulama kullanıcı oturumlarını temsil etmek için referans token'ları kullanıyorsa, bu token'ların benzersiz olduğu, kriptografik olarak güvenli bir sözde rastgele sayı üreteci (CSPRNG) kullanılarak üretildiği ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.2", + "section_name": "Temel Oturum Yönetimi Güvenliği", + "req_id": "V7.2.4", + "req_description": "Uygulamanın, kullanıcı kimlik doğrulaması (yeniden kimlik doğrulama dahil) sırasında yeni bir oturum token'ı oluşturduğu ve mevcut oturum token'ını sonlandırdığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.3", + "section_name": "Oturum Zaman Aşımı", + "req_id": "V7.3.1", + "req_description": "Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde bir hareketsizlik zaman aşımı bulunduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.3", + "section_name": "Oturum Zaman Aşımı", + "req_id": "V7.3.2", + "req_description": "Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde mutlak bir maksimum oturum süresi bulunduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.4", + "section_name": "Oturum Sonlandırma", + "req_id": "V7.4.1", + "req_description": "Oturum sonlandırma tetiklendiğinde (örneğin, çıkış yapıldığında veya süre dolduğunda), uygulamanın oturumun daha fazla kullanılmasına izin vermediği doğrulanmalıdır. Referans token'lar veya durum bilgili oturumlar için bu, oturum verilerinin uygulama arka ucunda geçersiz kılınması anlamına gelir. Kapsamlı token kullanan uygulamaların; sonlandırılmış token listesi tutmak, kullanıcıya özel tarih ve saatten önce oluşturulan token'ları reddetmek veya kullanıcıya özel imzalama anahtarını yenilemek gibi bir çözüm uygulaması gerekir.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.4", + "section_name": "Oturum Sonlandırma", + "req_id": "V7.4.2", + "req_description": "Bir kullanıcı hesabı devre dışı bırakıldığında veya silindiğinde (örneğin bir çalışanın şirketten ayrılması), uygulamanın tüm aktif oturumları sonlandırdığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.4", + "section_name": "Oturum Sonlandırma", + "req_id": "V7.4.3", + "req_description": "Herhangi bir kimlik doğrulama faktörünün başarılı bir şekilde değiştirilmesi veya kaldırılmasından (şifre sıfırlama veya kurtarma yoluyla yapılan değişiklikler dahil ve varsa MFA ayarları güncellemeleri dahil) sonra, uygulamanın diğer tüm aktif oturumları sonlandırma seçeneği sunduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.4", + "section_name": "Oturum Sonlandırma", + "req_id": "V7.4.4", + "req_description": "Kimlik doğrulama gerektiren tüm sayfalarda kolay erişilebilir ve görünür bir çıkış yap (logout) işlevi bulunduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.4", + "section_name": "Oturum Sonlandırma", + "req_id": "V7.4.5", + "req_description": "Uygulama yöneticilerinin, bireysel bir kullanıcının veya tüm kullanıcıların aktif oturumlarını sonlandırabilme yetkisine sahip olduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.5", + "section_name": "Oturum Kötüye Kullanımına Karşı Savunmalar", + "req_id": "V7.5.1", + "req_description": "E-posta adresi, telefon numarası, MFA yapılandırması veya hesap kurtarmada kullanılan diğer bilgiler gibi kimlik doğrulamayı etkileyebilecek hassas hesap özniteliklerinde değişiklik yapılmadan önce uygulamanın tam yeniden kimlik doğrulama gerektirdiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.5", + "section_name": "Oturum Kötüye Kullanımına Karşı Savunmalar", + "req_id": "V7.5.2", + "req_description": "Kullanıcıların, (en az bir faktörle yeniden kimlik doğrulama yaptıktan sonra) mevcut tüm aktif oturumları görüntüleyebilmesi ve sonlandırabilmesinin mümkün olduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.5", + "section_name": "Oturum Kötüye Kullanımına Karşı Savunmalar", + "req_id": "V7.5.3", + "req_description": "Uygulamanın, son derece hassas işlemler veya operasyonlar gerçekleştirilmeden önce en az bir faktörle ek kimlik doğrulaması veya ikincil bir doğrulama gerektirdiği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.6", + "section_name": "Birleşik Yeniden Kimlik Doğrulama", + "req_id": "V7.6.1", + "req_description": "Güvenen Taraf (RP) ile Kimlik Sağlayıcı (IdP) arasındaki oturum süresi ve oturum sonlandırma davranışlarının belgelenmiş olduğu ve, örneğin IdP kimlik doğrulama olayları arasında maksimum süreye ulaşıldığında yeniden kimlik doğrulamanın gerekli kılındığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.6", + "section_name": "Birleşik Yeniden Kimlik Doğrulama", + "req_id": "V7.6.2", + "req_description": "Yeni bir oturum oluşturulmasının, kullanıcı onayı veya açık bir eylem gerektirdiği; kullanıcı etkileşimi olmaksızın yeni uygulama oturumlarının oluşturulmasının önlendiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.1", + "section_name": "Yetkilendirme Dokümantasyonu", + "req_id": "V8.1.1", + "req_description": "Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak işlev düzeyinde ve veriye özel erişim kısıtlamaları için kuralları tanımladığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.1", + "section_name": "Yetkilendirme Dokümantasyonu", + "req_id": "V8.1.2", + "req_description": "Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak alan (field) düzeyinde erişim kısıtlamaları (hem okuma hem yazma) için kuralları tanımladığı doğrulanmalıdır. Bu kuralların, ilgili veri nesnesinin durum veya statü gibi diğer özniteliklerine bağlı olabileceği unutulmamalıdır.", + "L": "2" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.1", + "section_name": "Yetkilendirme Dokümantasyonu", + "req_id": "V8.1.3", + "req_description": "Uygulamanın dokümantasyonunun, kimlik doğrulama ve yetkilendirme ile ilgili güvenlik kararlarının alınmasında kullanılan çevresel ve bağlamsal öznitelikleri (günün saati, kullanıcı konumu, IP adresi veya cihaz gibi) tanımladığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.1", + "section_name": "Yetkilendirme Dokümantasyonu", + "req_id": "V8.1.4", + "req_description": "Kimlik doğrulama ve yetkilendirme dokümantasyonunun; işlev düzeyinde, veriye özel ve alan düzeyinde yetkilendirmenin yanı sıra çevresel ve bağlamsal faktörlerin karar almada nasıl kullanıldığını tanımladığı doğrulanmalıdır. Bu, değerlendirilen öznitelikleri, risk eşiklerini ve alınan aksiyonları (ör. izin ver, doğrulama iste, reddet, step-up kimlik doğrulama) içermelidir.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.2", + "section_name": "Genel Yetkilendirme Tasarımı", + "req_id": "V8.2.1", + "req_description": "Uygulamanın, işlev düzeyindeki erişimin yalnızca açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.2", + "section_name": "Genel Yetkilendirme Tasarımı", + "req_id": "V8.2.2", + "req_description": "Uygulamanın, veriye özel erişimin yalnızca belirli veri öğelerine açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, doğrudan nesne referansı güvenlik açıkları (IDOR) ve bozuk nesne düzeyinde yetkilendirme (BOLA) risklerini azaltır.", + "L": "1" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.2", + "section_name": "Genel Yetkilendirme Tasarımı", + "req_id": "V8.2.3", + "req_description": "Uygulamanın, alan (field) düzeyindeki erişimin yalnızca belirli alanlara açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, bozuk nesne özelliği düzeyinde yetkilendirme (BOPLA) risklerini azaltır.", + "L": "2" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.2", + "section_name": "Genel Yetkilendirme Tasarımı", + "req_id": "V8.2.4", + "req_description": "Tüketicinin çevresel ve bağlamsal özniteliklerine (ör. günün saati, konum, IP adresi veya cihaz) dayalı uyarlanabilir güvenlik kontrollerinin, uygulama dokümantasyonunda tanımlandığı şekilde, kimlik doğrulama ve yetkilendirme kararları için uygulandığı doğrulanmalıdır. Bu kontroller, tüketici yeni bir oturum başlatmaya çalışırken ve mevcut bir oturum sırasında uygulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.3", + "section_name": "İşlem Düzeyinde Yetkilendirme", + "req_id": "V8.3.1", + "req_description": "Uygulamanın yetkilendirme kurallarını güvenilir bir servis katmanında uyguladığı ve istemci taraflı JavaScript gibi güvenilmeyen tüketiciler tarafından değiştirilebilecek kontrollerle yetinmediği doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.3", + "section_name": "İşlem Düzeyinde Yetkilendirme", + "req_id": "V8.3.2", + "req_description": "Yetkilendirme kararlarının temelini oluşturan değerlerdeki değişikliklerin hemen uygulandığı doğrulanmalıdır. Değişikliklerin anında uygulanamadığı durumlarda (örneğin self-contained token içindeki verilere güveniliyorsa), tüketici artık yetkili olmadığı hâlde bir işlem gerçekleştirdiğinde uyarı verecek ve değişikliği geri alacak önlemler uygulanmalıdır. Bu alternatifin bilgi sızıntısını önlemeyeceği unutulmamalıdır.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.3", + "section_name": "İşlem Düzeyinde Yetkilendirme", + "req_id": "V8.3.3", + "req_description": "Bir nesneye erişimin, herhangi bir aracı veya onun adına hareket eden bir servis yerine yalnızca erişimi başlatan öznenin (ör. tüketici) izinlerine dayandığı doğrulanmalıdır. Örneğin, bir tüketici kimlik doğrulama için bir self-contained token kullanarak bir web servis çağırırsa ve bu servis başka bir servisten veri talep ederse, ikinci servis izin kararlarını verirken birinci servisin makine-makine token'ı yerine tüketicinin token'ını kullanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.4", + "section_name": "Diğer Yetkilendirme Hususları", + "req_id": "V8.4.1", + "req_description": "Multi-tenant uygulamaların, tüketici işlemlerinin izinli olmadıkları tenant'lar üzerinde asla etkili olmamasını sağlamak için tenant'lar arası kontroller kullandığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.4", + "section_name": "Diğer Yetkilendirme Hususları", + "req_id": "V8.4.2", + "req_description": "Yönetici arayüzlerine erişimin, sürekli tüketici kimlik doğrulaması, cihaz güvenlik durumu değerlendirmesi ve bağlamsal risk analizi dahil olmak üzere çok katmanlı güvenlik içerdiği doğrulanmalıdır. Yetkilendirme için yalnızca ağ konumu veya güvenilir uç noktalar yeterli olmamalıdır; ancak bu tür faktörler yetkisiz erişim olasılığını azaltabilir.", + "L": "3" + }, + { + "chapter_id": "V9", + "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", + "section_id": "V9.1", + "section_name": "Token Kaynağı ve Bütünlüğü", + "req_id": "V9.1.1", + "req_description": "Self-contained token'ların içerikleri kabul edilmeden önce, oynama (tampering) saldırılarına karşı dijital imza veya MAC ile doğrulama yapıldığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V9", + "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", + "section_id": "V9.1", + "section_name": "Token Kaynağı ve Bütünlüğü", + "req_id": "V9.1.2", + "req_description": "Belirli bir bağlam için yalnızca bir allowlist üzerinde bulunan algoritmaların self-contained token oluşturmak ve doğrulamak için kullanılabildiği doğrulanmalıdır. Bu allowlist, yalnızca simetrik ya da yalnızca asimetrik algoritmaları içermeli ve kesinlikle 'None' algoritmasını içermemelidir. Hem simetrik hem de asimetrik algoritmalar desteklenmek zorundaysa, anahtar karışıklığını (key confusion) önlemek için ek kontroller uygulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V9", + "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", + "section_id": "V9.1", + "section_name": "Token Kaynağı ve Bütünlüğü", + "req_id": "V9.1.3", + "req_description": "Self-contained token'ları doğrulamak için kullanılan anahtar malzemesinin, token issuer için önceden yapılandırılmış güvenilir kaynaklardan alındığı doğrulanmalıdır. Bu, saldırganların güvenilmeyen kaynak ve anahtarları belirtmesini engeller. JWT ve diğer JWS yapılarında 'jku', 'x5u' ve 'jwk' gibi header'lar güvenilir kaynaklardan oluşan bir allowlist'e göre doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V9", + "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", + "section_id": "V9.2", + "section_name": "Token İçeriği", + "req_id": "V9.2.1", + "req_description": "Token verisinde bir geçerlilik zaman aralığı (validity time span) varsa, yalnızca doğrulama zamanı bu zaman aralığı içerisindeyse token ve içeriği kabul edilmelidir. Örneğin, JWT'ler için 'nbf' ve 'exp' claim'leri doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V9", + "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", + "section_id": "V9.2", + "section_name": "Token İçeriği", + "req_id": "V9.2.2", + "req_description": "Token'ı alan hizmetin, token içeriğini kabul etmeden önce bu token'ın doğru türde olduğunu ve sunulma amacına uygun olduğunu doğruladığı teyit edilmelidir. Örneğin, yalnızca erişim token'ları yetkilendirme kararları için, yalnızca ID Token'lar kullanıcı kimlik doğrulamasını kanıtlamak için kullanılabilir.", + "L": "2" + }, + { + "chapter_id": "V9", + "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", + "section_id": "V9.2", + "section_name": "Token İçeriği", + "req_id": "V9.2.3", + "req_description": "Hizmetin yalnızca kendisiyle kullanılması amaçlanan (audience) token'ları kabul ettiği doğrulanmalıdır. JWT'lerde bu, 'aud' claim'inin hizmet içinde tanımlı bir allowlist ile doğrulanması yoluyla sağlanabilir.", + "L": "2" + }, + { + "chapter_id": "V9", + "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", + "section_id": "V9.2", + "section_name": "Token İçeriği", + "req_id": "V9.2.4", + "req_description": "Eğer bir token issuer, farklı audience'lara token oluşturmak için aynı private key'i kullanıyorsa, oluşturulan token'ların hedef audience'ları benzersiz şekilde tanımlayan bir audience kısıtlaması içerdiği doğrulanmalıdır. Bu, bir token'ın farklı bir audience ile yeniden kullanılmasını önler. Audience tanımlayıcısı dinamik olarak sağlanıyorsa, token issuer bu audience'ları doğrulamalı ve audience taklitlerinin (impersonation) önüne geçmelidir.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.1", + "section_name": "Genel OAuth ve OIDC Güvenliği", + "req_id": "V10.1.1", + "req_description": "Token'ların yalnızca kesinlikle ihtiyaç duyan bileşenlere gönderildiği doğrulanmalıdır. Örneğin, tarayıcı tabanlı JavaScript uygulamaları için bir backend-for-frontend modeli kullanıldığında, access ve refresh token'lara yalnızca backend'in erişebilmesi gerekir.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.1", + "section_name": "Genel OAuth ve OIDC Güvenliği", + "req_id": "V10.1.2", + "req_description": "Authorization server'dan gelen değerler (örneğin authorization code veya ID Token gibi) yalnızca aynı user agent oturumu ve işlemi tarafından başlatılmış bir yetkilendirme akışının sonucuysa kabul edildiği doğrulanmalıdır. Bu, client tarafından oluşturulan secret’ların 'proof key for code exchange' (PKCE) ‘code_verifier’, ‘state’ veya OIDC ‘nonce’ gibi tahmin edilemez, işleme özgü ve hem client’a hem de işlem başlatılan user agent oturumuna güvenli bir şekilde bağlı olmasını gerektirir.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.2", + "section_name": "OAuth İstemcisi", + "req_id": "V10.2.1", + "req_description": "Code flow kullanılıyorsa, OAuth client’ın token taleplerini tetikleyen CSRF saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Bu genellikle PKCE kullanılarak veya authorization isteğinde gönderilen ‘state’ parametresinin kontrolü ile sağlanır.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.2", + "section_name": "OAuth İstemcisi", + "req_id": "V10.2.2", + "req_description": "OAuth istemcisi birden fazla AS ile etkileşime girebiliyorsa, mix-up saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Örneğin, authorization server’ın 'iss' parametresini döndürmesi zorunlu kılınabilir ve bu parametrenin hem authorization yanıtında hem de token yanıtında doğrulanması gerekir.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.2", + "section_name": "OAuth İstemcisi", + "req_id": "V10.2.3", + "req_description": "OAuth istemcisinin authorization server’a yaptığı taleplerde yalnızca gerekli scope’ları (veya diğer yetkilendirme parametrelerini) talep ettiği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.3", + "section_name": "OAuth Kaynak Sunucusu (RS)", + "req_id": "V10.3.1", + "req_description": "RS'nin yalnızca bu servisle kullanılmak üzere tasarlanmış access token’ları kabul ettiği doğrulanmalıdır (audience kontrolü). Audience bilgisi yapılandırılmış token’larda (örneğin JWT içindeki ‘aud’ claim’i) yer alabilir veya token introspection endpoint aracılığıyla kontrol edilebilir.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.3", + "section_name": "OAuth Kaynak Sunucusu (RS)", + "req_id": "V10.3.2", + "req_description": "RS'nin, access token’dan gelen claim’lere dayanarak yetki devri tanımına uygun şekilde yetkilendirme kararları uyguladığı doğrulanmalıdır. ‘sub’, ‘scope’ ve ‘authorization_details’ gibi claim’ler varsa, bu kararın parçası olmalıdır.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.3", + "section_name": "OAuth Kaynak Sunucusu (RS)", + "req_id": "V10.3.3", + "req_description": "Erişim kontrolü kararında, access token’dan (JWT veya ilgili token introspection yanıtı) benzersiz bir kullanıcının tanımlanması gerekiyorsa, RS'nin başka kullanıcılara devredilemeyecek claim’ler ile kullanıcıyı tanımladığı doğrulanmalıdır. Genellikle bu, ‘iss’ ve ‘sub’ claim’lerinin birlikte kullanılması anlamına gelir.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.3", + "section_name": "OAuth Kaynak Sunucusu (RS)", + "req_id": "V10.3.4", + "req_description": "RS'nin belirli bir kimlik doğrulama gücü, yöntemi veya güncelliği (recentness) gerektirmesi durumunda, sunulan access token’ın bu kısıtlamaları karşıladığını doğruladığı, örneğin, OIDC ‘acr’, ‘amr’ ve ‘auth_time’ claim’leri kullanılarak doğrulanmalıdır. ", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.3", + "section_name": "OAuth Kaynak Sunucusu (RS)", + "req_id": "V10.3.5", + "req_description": "RS'nin, (yetkisiz taraflarca) çalınmış veya tekrar edilen access token’ların kullanımını önlemek için sender-constrained access token’lar kullandığı doğrulanmalıdır. Bu, OAuth 2 için Mutual TLS veya OAuth 2 Demonstration of Proof of Possession (DPoP) ile sağlanabilir.", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.1", + "req_description": "AS'nin, istemciye özel önceden kaydedilmiş URI’lerden oluşan bir allowlist kullanarak redirect URI’leri tam dize karşılaştırması ile doğruladığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.2", + "req_description": "AS'nin, \"authorization response\" içinde \"authorization code\" döndürdüğü durumlarda, bu kodun yalnızca bir kez kullanılabildiği doğrulanmalıdır. Daha önce access token vermek için kullanılmış bir authorization code ile yapılan ikinci geçerli token isteği reddedilmeli ve ilgili tüm token’lar iptal edilmelidir.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.3", + "req_description": "Authorization code’un kısa ömürlü olduğu doğrulanmalıdır. L1 ve L2 uygulamalar için maksimum yaşam süresi 10 dakika, L3 uygulamalar için 1 dakikadır.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.4", + "req_description": "Belirli bir istemci için AS'nin yalnızca o istemcinin ihtiyaç duyduğu grant türlerine izin verdiği doğrulanmalıdır. \"Token\" (Implicit flow) ve \"password\" (Resource Owner Password Credentials flow) grant türlerinin artık kullanılmaması gerekir.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.5", + "req_description": "AS'nin, açık istemciler için refresh token replay saldırılarını azalttığı doğrulanmalıdır. Tercihen sender-constrained refresh token’lar (DPoP veya mutual TLS ile certificate-bound access token’lar) kullanılmalıdır. L1 ve L2 uygulamalar için refresh token rotation kullanılabilir. Rotation kullanılıyorsa, AS refresh token’ı kullanım sonrası geçersiz kılmalı ve geçersiz bir refresh token sunulması durumunda o yetkilendirme ile ilişkili tüm refresh token’ları iptal etmelidir.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.6", + "req_description": "Code grant kullanılıyorsa, AS'nin authorization code interception saldırılarına karşı koruma sağladığı doğrulanmalıdır. Yetkilendirme isteğinde geçerli bir \"code_challenge\" değeri zorunlu olmalı ve \"code_challenge_method\" olarak \"plain\" kabul edilmemelidir. Token isteğinde ise \"code_verifier\" parametresi doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.7", + "req_description": "AS'nin, kimlik doğrulaması yapılmamış dinamik istemci kaydını desteklemesi durumunda, kötü niyetli istemci uygulamalarına karşı riskleri azalttığı doğrulanmalıdır. Kayıtlı URI’ler gibi client metadata’sı doğrulanmalı, kullanıcı onayı alınmalı ve güvenilmeyen bir client uygulamasıyla yapılan yetkilendirme isteği işlenmeden önce kullanıcı uyarılmalıdır.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.8", + "req_description": "Refresh token’ların, sliding expiration kullanılsa bile mutlak bir sona erme süresine sahip olduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.9", + "req_description": "Yetkili bir kullanıcı tarafından AS kullanıcı arayüzü üzerinden refresh token’ların ve reference access token’ların iptal edilebildiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.10", + "req_description": "Gizli istemcilerin token istekleri, pushed authorization request (PAR) ve token iptal istekleri gibi server’a yapılan backchannel isteklerinde kimliğinin kontrol edildiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.11", + "req_description": "AS yapılandırmasının, OAuth istemcisine yalnızca gerekli scope’ları atadığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.12", + "req_description": "Belirli bir client için, authorization server’ın yalnızca client’ın ihtiyaç duyduğu 'response_mode' değerine izin verdiği doğrulanmalıdır. Örneğin, bu değer ya beklenenlerle karşılaştırılarak doğrulanmalı ya da PAR veya JAR kullanılmalıdır.", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.13", + "req_description": "\"Code\" grant türünün daima pushed authorization request (PAR) ile birlikte kullanıldığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.14", + "req_description": "AS'nin yalnızca sender-constrained (Proof-of-Possession) access token’lar ürettiği doğrulanmalıdır. Bu, mutual TLS ile certificate-bound access token ya da DPoP ile DPoP-bound access token olabilir.", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.15", + "req_description": "Sunucu taraflı istemciler için (kullanıcı cihazında çalışmayan), AS'nin \"authorization_details\" parametresinin istemci backend'i tarafından sağlandığını ve kullanıcı tarafından değiştirilmediğini doğruladığı, örneğin pushed authorization request (PAR) or JWT-secured Authorization Request (JAR) zorunlu kılınarak doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.16", + "req_description": "Bir istemci gizli ise, AS'nin güçlü istemci kimlik doğrulama yöntemlerini zorunlu kıldığı doğrulanmalıdır. Bu yöntemler, public-key cryptography’ye dayalı ve replay saldırılarına karşı dayanıklı olmalı, örneğin mutual TLS (\"tls_client_auth\", \"self_signed_tls_client_auth\") veya private key JWT (\"private_key_jwt\") gibi.", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.5", + "section_name": "OIDC İstemcisi", + "req_id": "V10.5.1", + "req_description": "İstemcinin (relying party olarak) ID Token replay saldırılarını azalttığı doğrulanmalıdır. Örneğin, ID Token’daki 'nonce' claim’inin, OpenID Provider’a gönderilen kimlik doğrulama isteğindeki 'nonce' değeriyle eşleştiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.5", + "section_name": "OIDC İstemcisi", + "req_id": "V10.5.2", + "req_description": "İstemcinin kullanıcıyı ID Token claim’lerinden (genellikle, başka kullanıcılarla yeniden atanamayan 'sub' claim’i) benzersiz şekilde tanımladığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.5", + "section_name": "OIDC İstemcisi", + "req_id": "V10.5.3", + "req_description": "İstemcinin, kötü niyetli bir AS'nin başka bir AS'yi taklit etmesini AS metadata’sı üzerinden reddettiği doğrulanmalıdır. AS metadata’sındaki issuer URL’si, istemci tarafından beklenen önceden yapılandırılmış issuer URL’siyle tam olarak eşleşmiyorsa, metadata reddedilmelidir.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.5", + "section_name": "OIDC İstemcisi", + "req_id": "V10.5.4", + "req_description": "İstemcinin, ID Token’ın kendisi için (audience) kullanılması amaçlandığını doğruladığı doğrulanmalıdır. Bu, token’daki 'aud' claim’inin istemcinin 'client_id' değeriyle eşit olup olmadığının kontrol edilmesiyle yapılır.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.5", + "section_name": "OIDC İstemcisi", + "req_id": "V10.5.5", + "req_description": "OIDC back-channel logout kullanıldığında, relying party’nin \"forced logout\" ve \"logout\" akışında \"cross-JWT confusion\" gibi saldırılara karşı koruma sağladığı doğrulanmalıdır. Client, logout token’ın 'logout+jwt' türünde olduğunu, 'event' claim’inin doğru üyeye sahip olduğunu ve 'nonce' claim’i içermediğini doğrulamalıdır. Ayrıca token için kısa bir sona erme süresi (örneğin 2 dakika) önerilir.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.6", + "section_name": "OpenID Provider", + "req_id": "V10.6.1", + "req_description": "OpenID Provider’ın yalnızca 'code', 'ciba', 'id_token' veya 'id_token code' response mode değerlerine izin verdiği doğrulanmalıdır. 'code' değeri, 'id_token code' (OIDC Hybrid flow) yerine tercih edilmelidir. 'token' (Implicit flow) kullanılmamalıdır.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.6", + "section_name": "OpenID Provider", + "req_id": "V10.6.2", + "req_description": "OpenID Provider’ın forced logout yoluyla yapılan hizmet reddi saldırılarını önlediği doğrulanmalıdır. Bu, son kullanıcıdan açık onay alınarak veya varsa logout isteğinde (relying party tarafından başlatılan) bulunan parametrelerin, örneğin 'id_token_hint', doğrulanmasıyla yapılabilir.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.7", + "section_name": "Onay (Consent) Yönetimi", + "req_id": "V10.7.1", + "req_description": "AS'nin her yetkilendirme isteği için kullanıcının onayını aldığı doğrulanmalıdır. İstemcinin kimliği garanti altına alınamıyorsa, AS daima kullanıcıdan açıkça onay istemelidir.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.7", + "section_name": "Onay (Consent) Yönetimi", + "req_id": "V10.7.2", + "req_description": "AS'nin kullanıcıdan onay istediğinde, neye onay verildiğini açık ve yeterli şekilde gösterdiği doğrulanmalıdır. Uygun olduğunda bu bilgiler, istenen yetkilendirmelerin doğasını (genellikle scope, resource server, RAR gibi detaylara dayalı), yetkilendirilmiş uygulamanın kimliğini ve bu yetkilendirmelerin süresini içermelidir.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.7", + "section_name": "Onay (Consent) Yönetimi", + "req_id": "V10.7.3", + "req_description": "Kullanıcının, AS üzerinden verdiği onayları görüntüleyebildiği, değiştirebildiği ve iptal edebildiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.1", + "section_name": "Kriptografik Envanter ve Dokümantasyon", + "req_id": "V11.1.1", + "req_description": "Kriptografik anahtarların yönetimi için belgelenmiş bir politika ve NIST SP 800-57 gibi bir anahtar yönetim standardını izleyen bir kriptografik anahtar yaşam döngüsü tanımlandığı doğrulanmalıdır. Bu, anahtarların aşırı miktarda paylaşılmadığını (örneğin, paylaşılan sırlar için ikiden fazla tarafla veya özel anahtarlar için birden fazla tarafla) garanti altına almalıdır.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.1", + "section_name": "Kriptografik Envanter ve Dokümantasyon", + "req_id": "V11.1.2", + "req_description": "Tüm kriptografik anahtarlar, algoritmalar ve uygulama tarafından kullanılan sertifikaları içeren bir kriptografik envanterin oluşturulduğu, sürdürüldüğü ve düzenli olarak güncellendiği doğrulanmalıdır. Bu envanter ayrıca, sistemde anahtarların nerede kullanılabileceğini ve kullanılamayacağını, ve hangi veri türlerinin bu anahtarlarla korunup korunamayacağını da belgelemelidir.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.1", + "section_name": "Kriptografik Envanter ve Dokümantasyon", + "req_id": "V11.1.3", + "req_description": "Sistem içerisinde şifreleme, özetleme ve imzalama işlemleri dahil olmak üzere kriptografi kullanımının tüm örneklerini tespit etmek için kriptografik keşif mekanizmalarının kullanıldığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.1", + "section_name": "Kriptografik Envanter ve Dokümantasyon", + "req_id": "V11.1.4", + "req_description": "Kriptografik bir envanterin sürdürüldüğü doğrulanmalıdır. Bu envanter, gelecekteki tehditlere karşı tepki verebilmek amacıyla post-kuantum kriptografiye geçiş yolunu belirten belgelenmiş bir plan içermelidir.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.2", + "section_name": "Güvenli Kriptografi Uygulaması", + "req_id": "V11.2.1", + "req_description": "Kriptografik işlemler için sektör tarafından doğrulanmış uygulamaların (kütüphaneler ve donanım hızlandırmalı uygulamalar dahil) kullanıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.2", + "section_name": "Güvenli Kriptografi Uygulaması", + "req_id": "V11.2.2", + "req_description": "Uygulamanın, rastgele sayı üreticileri, kimliği doğrulanmış şifreleme, MAC veya özetleme algoritmaları, anahtar uzunlukları, turlar, şifreler ve modların herhangi bir zamanda yeniden yapılandırılabilir, yükseltilebilir veya değiştirilebilir olacağı şekilde kripto çevikliği (crypto agility) ile tasarlandığı doğrulanmalıdır. Aynı şekilde, anahtarların ve parolaların değiştirilebilmesi ve verilerin yeniden şifrelenebilmesi mümkün olmalıdır. Bu, onaylanmış PQC şemalarının yüksek güvenlikli uygulamaları yaygın olarak kullanılabilir hale geldiğinde sorunsuz geçişe olanak tanır.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.2", + "section_name": "Güvenli Kriptografi Uygulaması", + "req_id": "V11.2.3", + "req_description": "Tüm kriptografik ilkeliklerin, algoritma, anahtar boyutu ve yapılandırmaya göre minimum 128 bit güvenlik sağladığı doğrulanmalıdır. Örneğin, 256-bit ECC anahtarı yaklaşık 128 bit güvenlik sağlarken, RSA için aynı güvenliği elde etmek 3072-bit anahtar gerektirir.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.2", + "section_name": "Güvenli Kriptografi Uygulaması", + "req_id": "V11.2.4", + "req_description": "Tüm kriptografik işlemlerin sabit süreli (constant-time) olduğu, karşılaştırmalarda, hesaplamalarda veya geri dönüşlerde kısa devre (short-circuit) işlemleri yapılmadığı doğrulanmalıdır; bu, bilgi sızıntısını önlemek için gereklidir.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.2", + "section_name": "Güvenli Kriptografi Uygulaması", + "req_id": "V11.2.5", + "req_description": "Tüm kriptografik modüllerin güvenli şekilde hata verdiği ve hataların, padding oracle saldırıları gibi zafiyetleri mümkün kılmayacak şekilde ele alındığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.3", + "section_name": "Şifreleme Algoritmaları", + "req_id": "V11.3.1", + "req_description": "Güvensiz blok modlarının (örneğin, ECB) ve zayıf doldurma (padding) şemalarının (örneğin, PKCS#1 v1.5) kullanılmadığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.3", + "section_name": "Şifreleme Algoritmaları", + "req_id": "V11.3.2", + "req_description": "Yalnızca AES ile GCM gibi onaylı şifreleme algoritmalarının ve modlarının kullanıldığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.3", + "section_name": "Şifreleme Algoritmaları", + "req_id": "V11.3.3", + "req_description": "Şifrelenmiş verilerin yetkisiz değişikliklere karşı korunduğu doğrulanmalıdır. Tercihen bu koruma, onaylı bir kimliği doğrulanmış şifreleme yöntemi kullanılarak ya da onaylı bir şifreleme yöntemi ile onaylı bir MAC algoritmasının kombinasyonu ile sağlanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.3", + "section_name": "Şifreleme Algoritmaları", + "req_id": "V11.3.4", + "req_description": "Sayılar, başlatma vektörleri (IV) ve diğer tek kullanımlık değerlerin, aynı şifreleme anahtarı ve veri öğesi çifti için birden fazla kez kullanılmadığı doğrulanmalıdır. Oluşturma yöntemi kullanılan algoritmaya uygun olmalıdır.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.3", + "section_name": "Şifreleme Algoritmaları", + "req_id": "V11.3.5", + "req_description": "Şifreleme algoritması ve MAC algoritması kombinasyonlarının \"encrypt-then-MAC\" modunda çalıştığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.4", + "section_name": "Hashing ve Hash Tabanlı Fonksiyonlar", + "req_id": "V11.4.1", + "req_description": "Dijital imzalar, HMAC, KDF ve rastgele bit üretimi gibi genel kriptografik kullanım senaryolarında yalnızca onaylı hash fonksiyonlarının kullanıldığı doğrulanmalıdır. MD5 gibi yasaklı hash fonksiyonları hiçbir kriptografik amaçla kullanılmamalıdır.", + "L": "1" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.4", + "section_name": "Hashing ve Hash Tabanlı Fonksiyonlar", + "req_id": "V11.4.2", + "req_description": "Parolaların, onaylı, hesaplama açısından yoğun ve mevcut rehberliğe göre yapılandırılmış bir anahtar türetme fonksiyonu (diğer adıyla parola hash'leme fonksiyonu) kullanılarak saklandığı doğrulanmalıdır. Ayarlar, güvenlik ve performans dengesini sağlayarak kaba kuvvet saldırılarını zorlaştırmalıdır.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.4", + "section_name": "Hashing ve Hash Tabanlı Fonksiyonlar", + "req_id": "V11.4.3", + "req_description": "Dijital imzalarda kullanılan hash fonksiyonlarının, veri bütünlüğü ve kimlik doğrulama amacıyla kullanıldığında çakışmaya karşı dayanıklı ve yeterli bit uzunluğuna sahip olduğu doğrulanmalıdır. Çakışma dayanıklılığı gerekiyorsa çıktı uzunluğu en az 256 bit olmalıdır. Sadece ikinci ön-görüntü (2nd pre-iamge) saldırılarına karşı dayanıklılık gerekiyorsa çıktı uzunluğu en az 128 bit olmalıdır.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.4", + "section_name": "Hashing ve Hash Tabanlı Fonksiyonlar", + "req_id": "V11.4.4", + "req_description": "Parolalardan gizli anahtarlar türetilirken, onaylı anahtar türetme fonksiyonlarının anahtar uzatma (key stretching) parametreleriyle birlikte kullanıldığı doğrulanmalıdır. Bu parametreler, kaba kuvvet saldırılarını önleyecek şekilde güvenlik ve performans dengesine sahip olmalıdır.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.5", + "section_name": "Rastgele Değerler", + "req_id": "V11.5.1", + "req_description": "Tahmin edilemez olması amaçlanan tüm rastgele sayıların ve dizelerin, CSPRNG ile oluşturulduğu ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. UUID'lerin bu koşulu dikkate almadığını unutmayın.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.5", + "section_name": "Rastgele Değerler", + "req_id": "V11.5.2", + "req_description": "Kullanılan rastgele sayı üretim mekanizmasının, yoğun talep altında dahi güvenli çalışacak şekilde tasarlandığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.6", + "section_name": "Açık Anahtar (Public Key) Kriptografisi", + "req_id": "V11.6.1", + "req_description": "Anahtar üretimi, tohumlama (seeding) ve dijital imza üretimi ve doğrulama için yalnızca onaylı kriptografik algoritmalar ve çalışma modlarının kullanıldığı doğrulanmalıdır. Anahtar üretim algoritmaları, bilinen saldırılara karşı savunmasız anahtarlar üretmemelidir. Örneğin, Fermat çarpanlama yöntemine karşı savunmasız RSA anahtarları oluşturulmamalıdır.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.6", + "section_name": "Açık Anahtar (Public Key) Kriptografisi", + "req_id": "V11.6.2", + "req_description": "Anahtar değişimi için yalnızca onaylı kriptografik algoritmaların kullanıldığı doğrulanmalıdır (örneğin Diffie-Hellman). Kullanılan parametrelerin güvenli olması gerektiğine dikkat edilmelidir. Bu, anahtar kurulum sürecine yönelik saldırıları önleyecek ve araya girme (adversary-in-the-middle) ya da kriptografik kırılmaları engelleyecektir.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.7", + "section_name": "Kullanım Halindeki Verilerin Kriptografisi", + "req_id": "V11.7.1", + "req_description": "Hassas verilerin kullanım sırasında korunmasını sağlamak amacıyla, yetkisiz kullanıcıların veya süreçlerin bu verilere erişmesini engelleyen tam bellek şifrelemesinin kullanıldığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.7", + "section_name": "Kullanım Halindeki Verilerin Kriptografisi", + "req_id": "V11.7.2", + "req_description": "Veri asgariyetinin sağlandığı, yani işleme sırasında mümkün olan en az miktarda verinin ortaya çıktığı ve verilerin kullanımdan hemen sonra veya mümkün olan en kısa sürede şifrelendiği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.1", + "section_name": "Genel TLS Güvenlik Rehberi", + "req_id": "V12.1.1", + "req_description": "Yalnızca TLS protokolünün en güncel ve önerilen sürümlerinin (örneğin TLS 1.2 ve TLS 1.3) etkinleştirildiği ve en son sürümün varsayılan olarak tercih edildiği doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.1", + "section_name": "Genel TLS Güvenlik Rehberi", + "req_id": "V12.1.2", + "req_description": "Yalnızca önerilen şifre takımlarının (cipher suite) etkinleştirildiği ve en güçlü şifre takımlarının tercih edildiği doğrulanmalıdır. Seviye 3 (L3) uygulamalar yalnızca ileri gizlilik (forward secrecy) sağlayan şifre takımlarını desteklemelidir.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.1", + "section_name": "Genel TLS Güvenlik Rehberi", + "req_id": "V12.1.3", + "req_description": "Uygulamanın, mTLS istemci sertifikalarını kimlik doğrulama veya yetkilendirme amacıyla kullanmadan önce bu sertifikaların güvendiği sertifikalar arasında olduğunu doğruladığı kontrol edilmelidir.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.1", + "section_name": "Genel TLS Güvenlik Rehberi", + "req_id": "V12.1.4", + "req_description": "Online Certificate Status Protocol (OCSP) Stapling gibi geçerli bir sertifika iptal kontrolü yönteminin etkinleştirildiği ve yapılandırıldığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.1", + "section_name": "Genel TLS Güvenlik Rehberi", + "req_id": "V12.1.5", + "req_description": "TLS el sıkışma (handshake) sürecinde Server Name Indication (SNI) gibi hassas meta verilerin ifşa edilmesini önlemek için, uygulamanın TLS yapılandırmasında Encrypted Client Hello (ECH) özelliğinin etkinleştirildiği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.2", + "section_name": "Dışa Açık Hizmetlerle HTTPS İletişimi", + "req_id": "V12.2.1", + "req_description": "İstemci ile dışa açık, HTTP tabanlı hizmetler arasındaki tüm bağlantılarda TLS kullanıldığı ve bu bağlantıların güvensiz ya da şifrelenmemiş iletişime geri dönmediği doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.2", + "section_name": "Dışa Açık Hizmetlerle HTTPS İletişimi", + "req_id": "V12.2.2", + "req_description": "Dışa açık hizmetlerin herkese açık olarak güvenilen TLS sertifikaları kullandığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.3", + "section_name": "Genel Servisler Arası İletişim Güvenliği", + "req_id": "V12.3.1", + "req_description": "Uygulamaya gelen ve uygulamadan çıkan tüm bağlantılarda izleme sistemleri, yönetim araçları, uzaktan erişim ve SSH, ara yazılımlar, veritabanları, ana sistemler (mainframe), iş ortağı sistemleri ya da dış API'ler dahil olmak üzere TLS gibi şifreli bir protokolün kullanıldığı ve güvensiz ya da şifrelenmemiş protokollere geri dönülmediği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.3", + "section_name": "Genel Servisler Arası İletişim Güvenliği", + "req_id": "V12.3.2", + "req_description": "TLS istemcilerinin bir TLS sunucusu ile iletişime geçmeden önce alınan sertifikaları doğruladığı kontrol edilmelidir.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.3", + "section_name": "Genel Servisler Arası İletişim Güvenliği", + "req_id": "V12.3.3", + "req_description": "Uygulama içindeki HTTP tabanlı iç hizmetler arasında gerçekleşen tüm bağlantılarda TLS ya da uygun başka bir aktarım şifreleme mekanizmasının kullanıldığı ve güvensiz ya da şifrelenmemiş iletişime geri dönülmediği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.3", + "section_name": "Genel Servisler Arası İletişim Güvenliği", + "req_id": "V12.3.4", + "req_description": "İç hizmetler arasındaki TLS bağlantılarında güvenilir sertifikaların kullanıldığı doğrulanmalıdır. İç sistemlerde oluşturulmuş ya da kendinden imzalı (self-signed) sertifikalar kullanılıyorsa, bu sertifikalara güvenen hizmetlerin yalnızca belirli dahili sertifika otoritelerine (CA) ve belirli kendinden imzalı sertifikalara güvenecek şekilde yapılandırıldıkları doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.3", + "section_name": "Genel Servisler Arası İletişim Güvenliği", + "req_id": "V12.3.5", + "req_description": "Sistem içindeki hizmetlerin birbiriyle iletişim kurarken her bir uç noktanın kimliğini doğrulamak için güçlü kimlik doğrulama yöntemlerinin kullanıldığı doğrulanmalıdır. Bu yöntemler arasında, açık anahtar altyapısı (public-key infrastructure) kullanan ve tekrar oynatma saldırılarına karşı dayanıklı olan TLS istemci kimlik doğrulaması gibi yöntemler yer almalıdır. Mikroservis mimarilerinde, sertifika yönetimini basitleştirmek ve güvenliği artırmak amacıyla bir servis ağı (service mesh) kullanılması değerlendirilmelidir.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.1", + "section_name": "Konfigürasyon Dokümantasyonu", + "req_id": "V13.1.1", + "req_description": "Uygulamanın tüm iletişim ihtiyaçlarının dokümante edildiği doğrulanmalıdır. Buna, uygulamanın bağımlı olduğu dış hizmetler ve son kullanıcının uygulamanın bağlantı kurmasını sağlayabileceği dış konumlar da dahil olmalıdır.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.1", + "section_name": "Konfigürasyon Dokümantasyonu", + "req_id": "V13.1.2", + "req_description": "Uygulamanın kullandığı her bir hizmet için, dokümantasyonda eşzamanlı bağlantı sayısı (örn. bağlantı havuzu limitleri) ve bu sınır aşıldığında uygulamanın davranışı, geri dönüş veya kurtarma mekanizmaları da dahil olmak üzere hizmet reddi koşullarını önlemek için tanımlandığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.1", + "section_name": "Konfigürasyon Dokümantasyonu", + "req_id": "V13.1.3", + "req_description": "Uygulamanın, kullandığı her bir dış sistem veya hizmet (örn. veritabanları, dosya tanıtıcıları, iş parçacıkları, HTTP bağlantıları) için kaynak yönetimi stratejilerini tanımladığı doğrulanmalıdır. Bu stratejiler, kaynak serbest bırakma prosedürlerini, zaman aşımı ayarlarını, hata durumlarını ve tekrar deneme mantığı uygulanmışsa sınırları, gecikmeleri ve geri çekilme (back-off) algoritmalarını içermelidir. Senkron HTTP istek–yanıt işlemleri için kısa zaman aşımı süreleri zorunlu tutulmalı ve tekrar eden denemeler devre dışı bırakılmalı ya da sıkı şekilde sınırlandırılmalıdır.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.1", + "section_name": "Konfigürasyon Dokümantasyonu", + "req_id": "V13.1.4", + "req_description": "Uygulamanın, güvenlik açısından kritik olan gizli verileri tanımladığı ve kuruluşun tehdit modeli ve iş ihtiyaçlarına göre bu verilerin döndürülme (rotation) zamanlamasının belgelendiği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.2", + "section_name": "Backend İletişim Konfigürasyonu", + "req_id": "V13.2.1", + "req_description": "Uygulamanın, standart kullanıcı oturum mekanizmasını desteklemeyen backend bileşenleri (örneğin API'ler, ara katmanlar, veri katmanları) arasında gerçekleşen iletişimlerin kimlik doğrulamasıyla korunduğu doğrulanmalıdır. Kimlik doğrulama; bireysel hizmet hesapları, kısa ömürlü token'lar ya da sertifika tabanlı kimlik doğrulama ile yapılmalıdır ve parola, API anahtarı ya da ayrıcalıklı erişime sahip paylaşımlı hesaplar gibi sabit kimlik bilgileri kullanılmamalıdır.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.2", + "section_name": "Backend İletişim Konfigürasyonu", + "req_id": "V13.2.2", + "req_description": "Uygulamanın backend bileşenleri arasında (yerel hizmetler, işletim sistemi hizmetleri, API'ler, ara katmanlar ve veri katmanları dahil) gerçekleştirilen iletişimlerin, yalnızca gerekli en az ayrıcalığa sahip hesaplarla yapıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.2", + "section_name": "Backend İletişim Konfigürasyonu", + "req_id": "V13.2.3", + "req_description": "Bir hizmet kimlik doğrulaması için bir kimlik bilgisi kullanılması gerekiyorsa, bu kimlik bilgisinin varsayılan bir değer (örneğin root/root veya admin/admin) olmadığının doğrulanması gereklidir.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.2", + "section_name": "Backend İletişim Konfigürasyonu", + "req_id": "V13.2.4", + "req_description": "Uygulamanın iletişim kurmasına izin verilen dış kaynaklar ya da sistemlerin, bir allowlist (izinli liste) ile tanımlandığı doğrulanmalıdır. Bu liste, uygulama katmanında, web sunucusunda, güvenlik duvarında veya farklı katmanların birleşiminde uygulanabilir.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.2", + "section_name": "Backend İletişim Konfigürasyonu", + "req_id": "V13.2.5", + "req_description": "Web veya uygulama sunucusunun, dış sistemlere veri veya dosya gönderimi veya yüklemesi yaparken sadece belirli kaynaklara izin verecek şekilde allowlist ile yapılandırıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.2", + "section_name": "Backend İletişim Konfigürasyonu", + "req_id": "V13.2.6", + "req_description": "Uygulamanın farklı hizmetlere bağlantı kurduğu durumlarda, bu bağlantılar için belgelenmiş yapılandırmaları (örn. maksimum eşzamanlı bağlantı, bağlantı limiti aşıldığında davranış, zaman aşımı, tekrar deneme stratejileri) takip ettiğinin doğrulanması gereklidir.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.3", + "section_name": "Gizli Bilgi Yönetimi", + "req_id": "V13.3.1", + "req_description": "Parolalar, anahtar materyalleri, veritabanı ve üçüncü parti sistemlerle entegrasyon bilgileri, zaman tabanlı token'lar için tohum (seed) bilgileri, dahili gizli veriler ve API anahtarları gibi backend sırlarının güvenli bir şekilde oluşturulması, saklanması, erişim denetiminin sağlanması ve imha edilmesi için bir gizli bilgi yönetim çözümünün (örneğin key vault) kullanıldığı doğrulanmalıdır. Bu gizli bilgiler uygulama kaynak koduna dahil edilmemeli ve yapı çıktılarında yer almamalıdır. Seviye 3 uygulamalar için donanım destekli bir çözüm (örneğin HSM) gereklidir.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.3", + "section_name": "Gizli Bilgi Yönetimi", + "req_id": "V13.3.2", + "req_description": "Gizli bilgilere erişimin en az ayrıcalık prensibine uygun şekilde yapılandırıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.3", + "section_name": "Gizli Bilgi Yönetimi", + "req_id": "V13.3.3", + "req_description": "Tüm kriptografik işlemlerin, anahtar materyallerinin güvenli bir şekilde yönetilmesi ve dışarıya sızmasının engellenmesi amacıyla, izole edilmiş bir güvenlik modülü (örneğin vault ya da donanım güvenlik modülü) aracılığıyla gerçekleştirildiği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.3", + "section_name": "Gizli Bilgi Yönetimi", + "req_id": "V13.3.4", + "req_description": "Uygulamanın belgelerinde belirtildiği şekilde gizli bilgilerin süresinin dolacak şekilde yapılandırıldığı ve düzenli olarak döndürüldüğü doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.4", + "section_name": "İstenmeyen Bilgi Sızıntısı", + "req_id": "V13.4.1", + "req_description": "Uygulamanın .git veya .svn klasörleri gibi kaynak kontrolüyle ilgili metadata içermeyecek şekilde deploy edildiğini ya da bu klasörlerin hem dış erişime hem de uygulama erişimine kapalı olduğu doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.4", + "section_name": "İstenmeyen Bilgi Sızıntısı", + "req_id": "V13.4.2", + "req_description": "Tüm bileşenler için üretim ortamlarında hata ayıklama (debug) modlarının devre dışı bırakıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.4", + "section_name": "İstenmeyen Bilgi Sızıntısı", + "req_id": "V13.4.3", + "req_description": "Web sunucularının, açık şekilde istenmediği sürece dizin listelemesi (directory listing) özelliğini istemcilere sunmadığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.4", + "section_name": "İstenmeyen Bilgi Sızıntısı", + "req_id": "V13.4.4", + "req_description": "HTTP TRACE metodunun üretim ortamlarında desteklenmediği, böylece potansiyel bilgi sızıntılarının önlendiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.4", + "section_name": "İstenmeyen Bilgi Sızıntısı", + "req_id": "V13.4.5", + "req_description": "Belgeler (örneğin dahili API belgeleri) ve izleme uç noktalarının (monitoring endpoints) yalnızca açıkça belirtildiği durumlarda erişilebilir olduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.4", + "section_name": "İstenmeyen Bilgi Sızıntısı", + "req_id": "V13.4.6", + "req_description": "Uygulamanın arka uç bileşenlerinin ayrıntılı sürüm bilgilerini ifşa etmediği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.4", + "section_name": "İstenmeyen Bilgi Sızıntısı", + "req_id": "V13.4.7", + "req_description": "Web katmanının yalnızca belirli dosya uzantılarına sahip dosyaları sunacak şekilde yapılandırıldığı, bu sayede istem dışı bilgi, yapılandırma ya da kaynak kod sızıntılarının önlendiği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.1", + "section_name": "Veri Koruma Dokümantasyonu", + "req_id": "V14.1.1", + "req_description": "Uygulama tarafından oluşturulan ve işlenen tüm hassas verilerin tanımlanıp, koruma seviyelerine göre sınıflandırıldığından emin olun. Bu, yalnızca kodlanmış (örneğin Base64 stringleri ya da JWT içindeki düz metin yükler gibi) ve bu nedenle kolayca çözülebilir verileri de içermelidir. Koruma seviyeleri, uygulamanın uymakla yükümlü olduğu veri koruma ve gizlilik düzenlemeleri ile standartlarını dikkate almalıdır.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.1", + "section_name": "Veri Koruma Dokümantasyonu", + "req_id": "V14.1.2", + "req_description": "Tüm hassas veri koruma seviyeleri için belgelenmiş bir koruma gereksinimleri seti tanımlandığından emin olun. Bu gereksinimler genel şifreleme, bütünlük doğrulama, saklama süresi, verinin nasıl günlüğe kaydedileceği, günlüklerdeki hassas verilere erişim kontrolleri, veritabanı düzeyinde şifreleme, gizlilik ve gizliliği artırıcı teknolojiler ile diğer gizlilik gereksinimlerini kapsamalıdır.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.2", + "section_name": "Genel Veri Koruması", + "req_id": "V14.2.1", + "req_description": "Hassas verilerin yalnızca HTTP message body veya header alanlarında sunucuya gönderildiği ve URL ile sorgu parametrelerinin, API anahtarı veya session token’ı gibi hassas bilgiler içermediği doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.2", + "section_name": "Genel Veri Koruması", + "req_id": "V14.2.2", + "req_description": "Hassas verilerin, yük dengeleyiciler ve uygulama önbellekleri gibi sunucu bileşenlerinde önbelleğe alınmasının engellendiği veya kullanım sonrası bu verilerin güvenli biçimde temizlendiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.2", + "section_name": "Genel Veri Koruması", + "req_id": "V14.2.3", + "req_description": "Uygulama kontrolü dışında veri toplanmasını engellemek için, tanımlanmış hassas verilerin, kullanıcı izleyicileri gibi güvensiz taraflara gönderilmediği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.2", + "section_name": "Genel Veri Koruması", + "req_id": "V14.2.4", + "req_description": "Hassas verilere yönelik şifreleme, bütünlük doğrulama, veri saklama, loglama yöntemi, loglardaki erişim kontrolleri, gizlilik teknolojileri gibi kontrollerin, söz konusu verinin belgelenmiş koruma seviyesinde tanımlandığı şekilde uygulandığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.2", + "section_name": "Genel Veri Koruması", + "req_id": "V14.2.5", + "req_description": "Önbellekleme mekanizmalarının yalnızca belirli içerik türüne sahip yanıtları önbelleğe alacak şekilde yapılandırıldığı ve hassas, dinamik içeriklerin önbelleğe alınmadığı doğrulanmalıdır. Web sunucusu, mevcut olmayan bir dosya talebinde geçerli ama farklı bir dosya döndürmek yerine 404 veya 302 cevabı vermelidir. Bu, Web Cache Deception saldırılarını önlemeye yardımcı olur.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.2", + "section_name": "Genel Veri Koruması", + "req_id": "V14.2.6", + "req_description": "Uygulamanın yalnızca işlevsellik için gerekli olan asgari hassas veriyi döndürdüğü doğrulanmalıdır. Örneğin, kredi kartı numarasının yalnızca bazı rakamlarının döndürülmesi; tam numaranın döndürülmesi gerekiyorsa, kullanıcı arayüzünde gizlenmiş (maskelenmiş) şekilde sunulması gerekir, aksi kullanıcı özel olarak görüntülemek istemedikçe gösterilmemelidir.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.2", + "section_name": "Genel Veri Koruması", + "req_id": "V14.2.7", + "req_description": "Hassas bilgilerin, veri saklama sınıflandırmasına tabi tutulduğu, geçerliliğini yitirmiş veya artık gerekli olmayan verilerin belirlenmiş bir zaman çizelgesiyle ya da gerektiğinde otomatik olarak silindiği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.2", + "section_name": "Genel Veri Koruması", + "req_id": "V14.2.8", + "req_description": "Kullanıcı tarafından yüklenen dosyaların meta verilerinden hassas bilgilerin çıkarıldığı veya bu bilgilerin yalnızca kullanıcıdan açık onay alındığında saklandığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.3", + "section_name": "İstemci Tarafı Veri Koruması", + "req_id": "V14.3.1", + "req_description": "Kimliği doğrulanmış verilerin, istemci veya oturum sonlandığında istemci depolamasından (örneğin tarayıcı DOM’undan) temizlendiği doğrulanmalıdır. 'Clear-Site-Data' HTTP response header bu konuda yardımcı olabilir ancak istemci tarafı, sunucu bağlantısı mevcut olmadığında da temizlik işlemini yapabiliyor olmalıdır.", + "L": "1" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.3", + "section_name": "İstemci Tarafı Veri Koruması", + "req_id": "V14.3.2", + "req_description": "Uygulamanın, tarayıcılarda hassas verilerin önbelleğe alınmasını önlemek amacıyla yeterli anti-önbellekleme HTTP response header (örneğin Cache-Control: no-store) ayarladığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.3", + "section_name": "İstemci Tarafı Veri Koruması", + "req_id": "V14.3.3", + "req_description": "Tarayıcıda depolanan verilerin (örneğin localStorage, sessionStorage, IndexedDB veya çerezler) hassas veri içermediği, yalnızca session token’larının istisna olarak kabul edildiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.1", + "section_name": "Güvenli Kodlama ve Mimari Dokümantasyonu", + "req_id": "V15.1.1", + "req_description": "Güvenlik açığı içeren üçüncü taraf bileşen sürümleri ve genel olarak kütüphane güncellemeleri için, uygulama dokümantasyonunda risk bazlı düzeltme zamanlarının tanımlandığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.1", + "section_name": "Güvenli Kodlama ve Mimari Dokümantasyonu", + "req_id": "V15.1.2", + "req_description": "Yazılım bileşen listesi (Software Bill of Materials - SBOM) gibi bir envanterin tutulduğu, kullanılan tüm üçüncü taraf kütüphanelerin önceden tanımlanmış, güvenilir ve düzenli olarak güncellenen depolardan alındığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.1", + "section_name": "Güvenli Kodlama ve Mimari Dokümantasyonu", + "req_id": "V15.1.3", + "req_description": "Uygulama dokümantasyonunda zaman veya kaynak açısından yoğun işlevlerin tanımlandığı, bu işlevlerin aşırı kullanımı durumunda kullanılabilirlik kaybının nasıl önleneceği ve yanıt oluşturma süresinin istemci zaman aşımını aşmaması için hangi önlemlerin alındığı belirtilmelidir. Örnek savunmalar kuyruklama, eşzamansız işleme, kullanıcı başına ve uygulama genelinde paralel işlem sınırlarını içerebilir.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.1", + "section_name": "Güvenli Kodlama ve Mimari Dokümantasyonu", + "req_id": "V15.1.4", + "req_description": "Uygulama dokümantasyonunda \"riskli bileşenler\" olarak değerlendirilen üçüncü taraf kütüphanelerin vurgulandığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.1", + "section_name": "Güvenli Kodlama ve Mimari Dokümantasyonu", + "req_id": "V15.1.5", + "req_description": "Uygulama dokümantasyonunda \"tehlikeli işlevsellik\" içeren uygulama bölümlerinin açıkça belirtildiği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.2", + "section_name": "Güvenlik Mimarisi ve Bağımlılıklar", + "req_id": "V15.2.1", + "req_description": "Uygulamanın yalnızca, belgelenmiş güncelleme ve düzeltme sürelerini aşmamış bileşenleri içerdiği doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.2", + "section_name": "Güvenlik Mimarisi ve Bağımlılıklar", + "req_id": "V15.2.2", + "req_description": "Uygulamanın, belgelenmiş güvenlik kararları ve stratejilere dayanarak, zaman veya kaynak açısından yoğun işlevlerin neden olabileceği kullanılabilirlik kaybına karşı savunmalar uyguladığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.2", + "section_name": "Güvenlik Mimarisi ve Bağımlılıklar", + "req_id": "V15.2.3", + "req_description": "Üretim ortamının yalnızca uygulamanın çalışması için gerekli işlevleri içerdiği ve test kodları, örnek kod parçaları veya geliştirme işlevleri gibi gereksiz işlevsellikleri açığa çıkarmadığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.2", + "section_name": "Güvenlik Mimarisi ve Bağımlılıklar", + "req_id": "V15.2.4", + "req_description": "Üçüncü taraf bileşenlerin ve bunların tüm transitif bağımlılıklarının beklenen depolardan (iç kaynaklı ya da harici) alındığı ve bağımlılık karışıklığı (dependency confusion) saldırılarına açık olmadığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.2", + "section_name": "Güvenlik Mimarisi ve Bağımlılıklar", + "req_id": "V15.2.5", + "req_description": "Uygulamanın, “tehlikeli işlevsellik” içeren veya “riskli bileşenler” kullanan bölümlerine ek korumalar uyguladığı doğrulanmalıdır. Bu korumalar sandbox, kapsülleme, konteynerleştirme veya ağ düzeyinde izolasyon gibi teknikler aracılığıyla, bir uygulama bölümünün ele geçirilmesi durumunda saldırganın diğer bölümlere sıçramasını geciktirmeyi veya engellemeyi amaçlamalıdır.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.3", + "section_name": "Savunmacı Kodlama", + "req_id": "V15.3.1", + "req_description": "Uygulamanın yalnızca gerekli alanların bir alt kümesini veri nesnesinden döndürdüğü doğrulanmalıdır. Örneğin, bazı alanlara kullanıcıların erişmemesi gerektiğinden tüm veri nesnesi döndürülmemelidir.", + "L": "1" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.3", + "section_name": "Savunmacı Kodlama", + "req_id": "V15.3.2", + "req_description": "Uygulama backend'i harici URL’lere çağrı yaptığında, yalnızca amaçlanan işlevsellik söz konusuysa yönlendirmeleri takip edecek şekilde yapılandırıldığının doğrulanması gerekir.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.3", + "section_name": "Savunmacı Kodlama", + "req_id": "V15.3.3", + "req_description": "Uygulamanın, kitlesel atama saldırılarına karşı, her bir controller ve eylem için izin verilen alanları sınırlandırarak savunmalar sağladığı doğrulanmalıdır. Örneğin, bir alan değeri, bu işlemde değiştirilmesi amaçlanmadıysa eklenememeli veya güncellenememelidir.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.3", + "section_name": "Savunmacı Kodlama", + "req_id": "V15.3.4", + "req_description": "Tüm proxy ve ara katman bileşenlerinin kullanıcının orijinal IP adresini, uç kullanıcı tarafından değiştirilemeyecek güvenilir veri alanları kullanarak doğru şekilde ilettiği ve uygulamanın ve web sunucusunun bu doğru değeri, loglama ve hız sınırlama gibi güvenlik kararları için kullandığı doğrulanmalıdır. Ayrıca, orijinal IP adresinin bile dinamik IP'ler, VPN'ler veya kurumsal güvenlik duvarları nedeniyle güvenilir olmayabileceği dikkate alınmalıdır.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.3", + "section_name": "Savunmacı Kodlama", + "req_id": "V15.3.5", + "req_description": "Uygulamanın değişkenlerin doğru türde olduğunu açıkça doğruladığı ve sıkı eşitlik ve karşılaştırma işlemleri kullandığı doğrulanmalıdır. Bu, değişken türüyle ilgili varsayımlardan kaynaklanan tür oynama (type juggling) veya tür karışıklığı (type confusion) güvenlik açıklarını önlemek içindir.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.3", + "section_name": "Savunmacı Kodlama", + "req_id": "V15.3.6", + "req_description": "JavaScript kodunun prototip zehirleme (prototype pollution) saldırılarını önleyecek şekilde yazıldığı, örneğin, nesne literal’leri yerine Set() veya Map() gibi yapılar kullanıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.3", + "section_name": "Savunmacı Kodlama", + "req_id": "V15.3.7", + "req_description": "Uygulamanın, özellikle framework'ün istek parametrelerinin kaynağı (sorgu dizgisi, gövde parametreleri, çerezler veya başlık alanları) arasında ayrım yapmadığı durumlarda, HTTP parametre kirliliği (HTTP parameter pollution) saldırılarına karşı savunmalar uyguladığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.4", + "section_name": "Güvenli Eş Zamanlılık (Concurrency)", + "req_id": "V15.4.1", + "req_description": "Çok iş parçacıklı kodda (örneğin cache'ler, dosyalar veya birden fazla iş parçacığı tarafından erişilen bellek içi nesneler gibi) paylaşılan nesnelere yalnızca thread-safe (iş parçacığı güvenli) türler ve kilitleme (lock) veya semaphore gibi senkronizasyon mekanizmaları kullanılarak erişildiği doğrulanmalıdır. Bu, yarış durumlarını ve veri bozulmasını önlemeye yöneliktir.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.4", + "section_name": "Güvenli Eş Zamanlılık (Concurrency)", + "req_id": "V15.4.2", + "req_description": "Bir kaynağın durumu üzerindeki kontroller (örneğin varlığı ya da izinleri gibi) ile bu kontrole bağlı eylemlerin tek bir atomik işlem olarak gerçekleştirildiği doğrulanmalıdır. Bu, TOCTOU (time-of-check to time-of-use) yarış durumlarını önlemeye yöneliktir. Bir dosyanın varlığının kontrol edilip ardından açılması veya bir kullanıcının erişiminin doğrulanıp ardından yetki verilmesi gibi işlemler buna örnektir.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.4", + "section_name": "Güvenli Eş Zamanlılık (Concurrency)", + "req_id": "V15.4.3", + "req_description": "Kilitlerin (locks) tutarlı biçimde kullanıldığı, iş parçacıklarının birbirini beklemesi ya da sonsuz döngüye girmesi (deadlock veya livelock) gibi durumların önlendiği doğrulanmalıdır. Ayrıca, kilitleme mantığı, kaynağı yöneten kod içinde kalmalı ve dış sınıflar veya dış kodlar tarafından istemeden veya kötü niyetli şekilde değiştirilememelidir.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.4", + "section_name": "Güvenli Eş Zamanlılık (Concurrency)", + "req_id": "V15.4.4", + "req_description": "Kaynak tahsis politikalarının, iş parçacığı açlığını önleyecek şekilde, kaynaklara adil erişimi sağladığı doğrulanmalıdır. Örneğin, thread pool (iş parçacığı havuzu) kullanımı, düşük öncelikli iş parçacıklarının da makul sürelerde çalışabilmesi için uygulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.1", + "section_name": "Güvenlik Loglaması Dokümantasyonu", + "req_id": "V16.1.1", + "req_description": "Uygulamanın teknoloji yığını boyunca her katmanda hangi olayların loglandığını, log formatlarını, logların nereye yazıldığını, nasıl kullanıldığını, erişimin nasıl kontrol edildiğini ve logların ne kadar süre saklandığını belgeleyen bir envanterin mevcut olduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.2", + "section_name": "Genel Loglama", + "req_id": "V16.2.1", + "req_description": "Her bir log girdisinin, olayın ne zaman, nerede, kim tarafından ve ne olduğuna dair detaylı bir zaman çizelgesi oluşturulmasına olanak tanıyacak gerekli meta verileri içerdiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.2", + "section_name": "Genel Loglama", + "req_id": "V16.2.2", + "req_description": "Tüm loglama bileşenlerinin zaman kaynaklarının senkronize olduğu ve güvenlik olayı meta verisindeki zaman damgalarının UTC kullanarak ya da açık zaman dilimi ofsetiyle belirtildiği doğrulanmalıdır. UTC kullanımı, özellikle yaz saati uygulamaları nedeniyle oluşabilecek karışıklıkları önlemek için tavsiye edilir.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.2", + "section_name": "Genel Loglama", + "req_id": "V16.2.3", + "req_description": "Uygulamanın yalnızca log envanterinde belgelenmiş dosya ve hizmetlere log yazdığı ya da ilettiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.2", + "section_name": "Genel Loglama", + "req_id": "V16.2.4", + "req_description": "Logların kullanılan log işleyici (log processor) tarafından okunabildiği ve ilişkilendirilebildiği doğrulanmalıdır. Tercihen yaygın bir log formatı kullanılmalıdır.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.2", + "section_name": "Genel Loglama", + "req_id": "V16.2.5", + "req_description": "Hassas veriler loglanırken, uygulamanın veri koruma seviyesine uygun olarak loglama yaptığı doğrulanmalıdır. Örneğin kimlik bilgileri veya ödeme detayları gibi bazı verilerin loglanmasına izin verilmemelidir. Session token’ları gibi veriler ise yalnızca tamamen ya da kısmen maskelenmiş ya da hash’lenmiş olarak loglanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.3", + "section_name": "Güvenlik Olayları", + "req_id": "V16.3.1", + "req_description": "Tüm kimlik doğrulama işlemlerinin (başarılı ve başarısız girişimler dahil) loglandığı doğrulanmalıdır. Kullanılan kimlik doğrulama türü veya faktörleri gibi ek meta veriler de toplanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.3", + "section_name": "Güvenlik Olayları", + "req_id": "V16.3.2", + "req_description": "Başarısız yetkilendirme girişimlerinin loglandığı doğrulanmalıdır. Seviye 3 uygulamalar için, tüm yetkilendirme kararlarının ve hassas verilere erişim olaylarının (verinin kendisi olmadan) loglandığı da doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.3", + "section_name": "Güvenlik Olayları", + "req_id": "V16.3.3", + "req_description": "Uygulamanın, belgelenmiş güvenlik olaylarını ve güvenlik kontrollerini aşma girişimlerini (girdi doğrulama, iş mantığı, otomasyon karşıtı kontroller vb.) logladığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.3", + "section_name": "Güvenlik Olayları", + "req_id": "V16.3.4", + "req_description": "Beklenmeyen hatalar ve güvenlik kontrolü başarısızlıkları (örneğin backend TLS hataları gibi) loglandığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.4", + "section_name": "Log Koruması", + "req_id": "V16.4.1", + "req_description": "Tüm loglama bileşenlerinin, log enjeksiyonunu (log injection) önlemek amacıyla verileri uygun biçimde encode ettiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.4", + "section_name": "Log Koruması", + "req_id": "V16.4.2", + "req_description": "Logların yetkisiz erişime karşı korunduğu ve değiştirilemez olduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.4", + "section_name": "Log Koruması", + "req_id": "V16.4.3", + "req_description": "Logların analiz, tespit, uyarı ve yükseltme amacıyla mantıksal olarak ayrı bir sisteme güvenli biçimde iletildiği doğrulanmalıdır. Böylece uygulama ihlal edilse bile logların tehlikeye girmesi önlenmiş olur.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.5", + "section_name": "Hata Yönetimi", + "req_id": "V16.5.1", + "req_description": "Beklenmedik ya da güvenlikle ilgili bir hata oluştuğunda, tüketiciye genel bir mesaj döndürüldüğü ve yığın izleri (stack trace), sorgular, gizli anahtarlar, token’lar gibi hassas sistem içi verilerin açıklanmadığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.5", + "section_name": "Hata Yönetimi", + "req_id": "V16.5.2", + "req_description": "Uygulamanın, dış kaynaklara erişim başarısız olduğunda bile güvenli şekilde çalışmaya devam ettiği doğrulanmalıdır. Örneğin, circuit breaker ya da graceful degradation gibi desenler kullanılmalıdır.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.5", + "section_name": "Hata Yönetimi", + "req_id": "V16.5.3", + "req_description": "Uygulamanın hata durumlarında güvenli ve düzenli şekilde başarısız olduğu doğrulanmalıdır. Bu, örneğin doğrulama hatalarına rağmen işlemlerin işlenmesine yol açabilecek fail-open durumlarını önlemelidir.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.5", + "section_name": "Hata Yönetimi", + "req_id": "V16.5.4", + "req_description": "Ele alınmamış tüm istisnaları yakalayacak şekilde tanımlanmış bir “son çare hata yöneticisi” bulunduğu doğrulanmalıdır. Bu, hem loglara gitmesi gereken hata detaylarının kaybolmaması hem de tüm uygulama sürecinin çökerek hizmet dışı kalmasının önlenmesi açısından önemlidir.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.1", + "section_name": "TURN Sunucusu", + "req_id": "V17.1.1", + "req_description": "TURN hizmetinin yalnızca özel amaçlar için ayrılmamış IP adreslerine (ör. iç ağlar, yayın adresleri, loopback) erişime izin verdiği doğrulanmalıdır. Bu gereksinim hem IPv4 hem de IPv6 adresleri için geçerlidir.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.1", + "section_name": "TURN Sunucusu", + "req_id": "V17.1.2", + "req_description": "TURN hizmetinin, meşru kullanıcıların sunucuda çok sayıda bağlantı noktası açmaya çalışması durumunda kaynak tüketimi saldırılarına karşı dayanıklı olduğu doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Medya", + "req_id": "V17.2.1", + "req_description": "DTLS sertifikası anahtarının, belgelenmiş kriptografik anahtar yönetim politikasına uygun şekilde yönetildiği ve korunduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Medya", + "req_id": "V17.2.2", + "req_description": "Medya sunucusunun onaylı DTLS şifre takımlarını (cipher suites) ve Güvenli Gerçek Zamanlı Aktarım Protokolü (Secure Real-time Transport Protocol - SRTP) için anahtarlar oluşturmaya yönelik DTLS Uzantısı için güvenli bir koruma profilini kullanacak ve destekleyecek şekilde yapılandırıldığı (DTLS-SRTP) doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Medya", + "req_id": "V17.2.3", + "req_description": "Real-time Transport Protocol (RTP) injection saldırılarının bir hizmet reddi durumuna veya medya akışlarına ses veya video medyası eklenmesine yol açmasını önlemek için medya sunucusunda Güvenli SRTP kimlik doğrulamasının kontrol edildiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Medya", + "req_id": "V17.2.4", + "req_description": "Verify that the media server is able to continue processing incoming media traffic when encountering malformed Secure Real-time Transport Protocol (SRTP) packets.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Medya", + "req_id": "V17.2.5", + "req_description": "Medya sunucusunun, meşru kullanıcılardan gelen SRTP flood'ı sırasında gelen medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Medya", + "req_id": "V17.2.6", + "req_description": "Medya sunucusunun DTLS içinde yer alan \"ClientHello\" yarış durumu güvenlik açığına karşı savunmasız olmadığı, medya sunucusunun güvenlik açığına sahip olduğunun açıkça bilinip bilinmediği kontrol edilerek veya yarış koşulu testi gerçekleştirilerek doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Medya", + "req_id": "V17.2.7", + "req_description": "Medya sunucusuna bağlı ses veya video kayıt mekanizmalarının, meşru kullanıcı kaynaklı SRTP flood'ı sırasında medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Medya", + "req_id": "V17.2.8", + "req_description": "DTLS sertifikasının, SDP (Session Description Protocol) fingerprint özelliği ile karşılaştırıldığı ve doğrulama başarısız olursa medya akışının sonlandırıldığı, medya akışının özgünlüğünü sağlamak için doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.3", + "section_name": "Sinyalizasyon", + "req_id": "V17.3.1", + "req_description": "Sinyalizasyon sunucusunun, flood saldırısı altında bile meşru sinyalizasyon mesajlarını işlemeye devam edebildiği doğrulanmalıdır. Bu, sinyalizasyon düzeyinde oran sınırlaması uygulanarak sağlanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.3", + "section_name": "Sinyalizasyon", + "req_id": "V17.3.2", + "req_description": "Sinyalizasyon sunucusunun, hizmet reddine yol açabilecek şekilde yapılandırılmış bozuk sinyalizasyon mesajlarıyla karşılaştığında bile meşru mesajları işlemeye devam edebildiği doğrulanmalıdır. Bu, girdi doğrulaması, integer overflow ve buffer overflow'a karşı savunma ve sağlam hata işleme teknikleri ile sağlanmalıdır.", + "L": "2" + } + ] +} diff --git a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.flat.legacy.json b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.flat.legacy.json new file mode 100644 index 0000000000..500f60643c --- /dev/null +++ b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.flat.legacy.json @@ -0,0 +1,4437 @@ +{ + "requirements": [ + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.1", + "section_name": "Kodlama ve Temizleme Mimarisi", + "req_id": "V1.1.1", + "req_description": "Girdinin yalnızca bir kez kanonik forma (canonical form) çözümlendiği veya kaçış işlemlerinin kaldırıldığı, bu işlemin yalnızca verinin bu biçimde beklenmesi durumunda yapıldığı ve bu işlemin girdi doğrulama veya temizleme işlemlerinden sonra değil, önce gerçekleştiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.1", + "section_name": "Kodlama ve Temizleme Mimarisi", + "req_id": "V1.1.2", + "req_description": "Uygulamanın, çıktıyı kullanılması gereken yorumlayıcıya verilmeden hemen önce veya yorumlayıcının kendisi tarafından çıktı kodlaması ya da kaçış işlemi yaptığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.1", + "req_description": "HTTP yanıtı, HTML veya XML belgesi için yapılan çıktı kodlamasının; HTML elemanları, HTML öznitelikleri, HTML yorumları, CSS ya da HTTP başlık alanları gibi bağlamlara uygun olduğu doğrulanmalıdır. Böylece mesaj veya belge yapısının bozulması önlenir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.2", + "req_description": "Dinamik olarak URL oluşturulurken, güvenilmeyen verinin bağlamına göre (örneğin, sorgu veya yol parametreleri için URL kodlaması ya da base64url kodlaması) kodlandığı doğrulanmalıdır. Yalnızca güvenli URL protokollerine izin verilmelidir (örneğin, javascript: veya data: yasaklanmalıdır).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.3", + "req_description": "JavaScript içeriği (JSON dahil) dinamik olarak oluşturulurken çıktı kodlama/kaçış kullanıldığı doğrulanmalıdır. Böylece mesaj veya belge yapısı değiştirilmemiş olur (JavaScript ve JSON enjeksiyonlarının önüne geçilir).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.4", + "req_description": "Veri sorguları veya veritabanı sorguları (SQL, HQL, NoSQL, Cypher vb.) için parametreli sorgular, ORM’ler, entity framework’ler kullanıldığı ya da SQL enjeksiyonu ve diğer veritabanı enjeksiyon saldırılarına karşı koruma sağlandığı doğrulanmalıdır. Bu durum, saklı yordam (stored procedure) yazarken de geçerlidir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.5", + "req_description": "Uygulamanın işletim sistemi komut enjeksiyonlarına karşı korunduğu ve işletim sistemi çağrılarında parametreli OS sorguları veya bağlama özgü komut satırı çıktı kodlamasının kullanıldığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.6", + "req_description": "Uygulamanın LDAP enjeksiyon zafiyetlerine karşı korunduğu ya da LDAP enjeksiyonlarını önlemek için özel güvenlik kontrollerinin uygulandığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.7", + "req_description": "XPath enjeksiyon saldırılarına karşı, sorgu parametrelemesi veya önceden derlenmiş sorgular kullanılarak koruma sağlandığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.8", + "req_description": "LaTeX işlemcilerinin güvenli şekilde yapılandırıldığı (örneğin, --shell-escape bayrağının kullanılmadığı) ve yalnızca izin verilen komutlardan oluşan bir listeyle çalıştırıldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.9", + "req_description": "Düzenli ifadelerde (regex) özel karakterlerin (genellikle ters eğik çizgi \\ ile) kaçırılarak meta karakter olarak yorumlanmalarının önlendiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.10", + "req_description": "Uygulamanın CSV ve formül enjeksiyonlarına karşı korunduğu doğrulanmalıdır. Uygulama, CSV içeriği dışa aktarırken RFC 4180 Bölüm 2.6 ve 2.7'de tanımlanan kaçış kurallarına uymalıdır. Ayrıca, CSV veya diğer tablo formatlarına (XLS, XLSX, ODF gibi) aktarım yapılırken, alanın ilk karakteri olarak çıkan özel karakterler ('=', '+', '-', '@', '\\t' (sekme), '\\0' (null karakter)) tek tırnak (') ile kaçırılmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.1", + "req_description": "WYSIWYG editörlerinden veya benzer kaynaklardan gelen tüm güvenilmeyen HTML girdilerinin, bilinen ve güvenli bir HTML temizleme kütüphanesi ya da çerçeve özelliği ile temizlendiği doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.2", + "req_description": "Uygulamanın eval() veya Spring Expression Language (SpEL) gibi dinamik kod çalıştırma özelliklerini kullanmaktan kaçındığı doğrulanmalıdır. Alternatif yoksa, kullanıcı girdisi çalıştırılmadan önce mutlaka temizlenmelidir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.3", + "req_description": "Potansiyel olarak tehlikeli bir bağlamda kullanılacak verilerin, bu bağlama uygun karakterlere izin vermek ve çok uzun girdileri kısaltmak gibi güvenlik önlemleriyle önceden temizlendiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.4", + "req_description": "Kullanıcı tarafından sağlanan SVG içeriğinin, yalnızca güvenli etiket ve özellikler (örneğin grafik çizme ile ilgili) içerdiğinden emin olmak için onaylandığı veya temizlendiği doğrulanmalıdır (ör. script veya foreignObject içermemelidir).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.5", + "req_description": "Markdown, CSS, XSL stil sayfaları, BBCode veya benzeri ifade şablon dillerinde kullanıcı girdisinin temizlendiği veya bu tür özelliklerin devre dışı bırakıldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.6", + "req_description": "Uygulamanın, güvenilmeyen verileri başka servislere iletmeden önce izinli protokol, alan adı, yol ve port listelerine göre doğruladığı ve tehlikeli karakterleri temizlediği doğrulanarak SSRF (Sunucu Taraflı İstek Sahteciliği) saldırılarına karşı korunduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.7", + "req_description": "Uygulamanın şablon enjeksiyon saldırılarına karşı, güvenilmeyen girdilere dayalı şablon oluşturmayı engellediği; eğer bu kaçınılmazsa, bu girdilerin mutlaka temizlendiği veya sıkı şekilde onaylandığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.8", + "req_description": "JNDI sorgularında kullanılmadan önce güvenilmeyen girdilerin temizlendiği ve JNDI'nin enjeksiyonlara karşı güvenli şekilde yapılandırıldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.9", + "req_description": "Memcache’e gönderilmeden önce içeriğin temizlenerek enjeksiyon saldırılarına karşı korunduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.10", + "req_description": "Format dizgilerinin (format strings) beklenmeyen veya zararlı şekilde çözümlenmesini önlemek için işlenmeden önce temizlendiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.11", + "req_description": "SMTP veya IMAP enjeksiyonlarını önlemek için, kullanıcı girdisinin posta sistemlerine iletilmeden önce temizlendiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.12", + "req_description": "Regex girdilerinin üstel geri izlemeye (exponential backtracking) neden olan öğeler içermediği ve güvenilmeyen girdilerin ReDoS (Regex Denial of Service) gibi saldırılara karşı temizlendiği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.4", + "section_name": "Bellek, Dizgi ve Yönetilmeyen Kod", + "req_id": "V1.4.1", + "req_description": "Yığın, arabellek (buffer) veya yığın belleği taşmalarını önlemek ya da tespit etmek amacıyla, bellek güvenli dizgi işlemlerinin, daha güvenli bellek kopyalama ve işaretçi aritmetiğinin kullanıldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.4", + "section_name": "Bellek, Dizgi ve Yönetilmeyen Kod", + "req_id": "V1.4.2", + "req_description": "Tamsayı taşmalarını önlemek için işaret (sign), aralık (range) ve giriş doğrulama tekniklerinin kullanıldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.4", + "section_name": "Bellek, Dizgi ve Yönetilmeyen Kod", + "req_id": "V1.4.3", + "req_description": "Dinamik olarak ayrılan belleğin ve kaynakların serbest bırakıldığı ve boşaltılan belleklere ait referansların veya işaretçilerin kaldırıldığı veya null yapıldığı doğrulanmalıdır (dangling pointer ve use-after-free zafiyetlerine karşı).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.5", + "section_name": "Güvenli Ters Serileştirme (Safe Deserialization)", + "req_id": "V1.5.1", + "req_description": "XML ayrıştırıcılarının (parser) kısıtlayıcı şekilde yapılandırıldığı ve dış varlık çözümleme (external entity resolution) gibi güvensiz özelliklerin XXE (XML eXternal Entity) saldırılarına karşı devre dışı bırakıldığı doğrulanmalıdır .", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.5", + "section_name": "Güvenli Ters Serileştirme (Safe Deserialization)", + "req_id": "V1.5.2", + "req_description": "Güvenilmeyen verilerin ters serileştirilmesinde, nesne türleri için izinli liste kullanımı veya istemci tanımlı nesne türlerinin kısıtlanması gibi güvenli giriş işleme önlemlerinin uygulandığı doğrulanmalıdır. Güvensiz olarak tanımlanmış ters serileştirme mekanizmaları, güvenilmeyen girdilerle kullanılmamalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.5", + "section_name": "Güvenli Ters Serileştirme (Safe Deserialization)", + "req_id": "V1.5.3", + "req_description": "Aynı veri türü için uygulamada kullanılan farklı parser'ların (ör. JSON, XML, URL parser'ları), veriyi tutarlı şekilde ayrıştırdığı ve aynı karakter kodlamasını kullandığı doğrulanmalıdır. Böylece JSON birlikte çalışabilirlik açıkları, URI veya dosya ayrıştırma farkları gibi sorunlar nedeniyle RFI veya SSRF saldırılarının istismar edilmesi önlenir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.1", + "section_name": "Doğrulama ve İş Mantığı Dokümantasyonu", + "req_id": "V2.1.1", + "req_description": "Uygulama dokümantasyonunda, veri öğelerinin beklenen yapıya göre nasıl doğrulanacağına ilişkin giriş doğrulama kurallarının tanımlandığı doğrulanmalıdır. Bu; kredi kartı numaraları, e-posta adresleri, telefon numaraları gibi yaygın veri biçimleri olabileceği gibi iç sistemlere özel biçimler de olabilir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.1", + "section_name": "Doğrulama ve İş Mantığı Dokümantasyonu", + "req_id": "V2.1.2", + "req_description": "Uygulama dokümantasyonunda, birleştirilmiş veri öğelerinin mantıksal ve bağlamsal tutarlılığının nasıl doğrulanacağı tanımlanmalıdır (örneğin, mahalle ve posta kodunun eşleşip eşleşmediğinin kontrolü).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.1", + "section_name": "Doğrulama ve İş Mantığı Dokümantasyonu", + "req_id": "V2.1.3", + "req_description": "Hem kullanıcı bazında hem de uygulama genelinde geçerli olacak şekilde, iş mantığı sınırları ve doğrulama beklentilerinin belgelendiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.2", + "section_name": "Girdi Doğrulama", + "req_id": "V2.2.1", + "req_description": "Girdilerin, işlevsel ya da iş gereksinimlerine uygunluğunun doğrulandığı teyit edilmelidir. Bu işlem; izinli değerler, desenler ve aralıklar listesine karşı pozitif doğrulama ile ya da girdinin beklenen yapıya ve mantıksal sınırlara uygunluğunun önceden tanımlanmış kurallara göre karşılaştırılması ile yapılmalıdır. Seviye 1 için bu, güvenlik veya iş kararlarında kullanılan girdilere odaklanabilir. Seviye 2 ve üstü için tüm girdilere uygulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.2", + "section_name": "Girdi Doğrulama", + "req_id": "V2.2.2", + "req_description": "Uygulamanın, güvenilir bir servis katmanında girdi doğrulama zorunluluğu uygulayacak şekilde tasarlandığı doğrulanmalıdır. İstemci tarafında gerçekleştirilen doğrulama, kullanılabilirliği artırabilir ve teşvik edilmelidir. Ancak bu doğrulama,güvenlik kontrolü olarak kabul edilmemelidir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.2", + "section_name": "Girdi Doğrulama", + "req_id": "V2.2.3", + "req_description": "Uygulamanın, ilişkili veri öğelerinin önceden tanımlanmış kurallara göre makul olup olmadığını kontrol ettiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.3", + "section_name": "İş Mantığı Güvenliği", + "req_id": "V2.3.1", + "req_description": "Uygulamanın, aynı kullanıcı için iş mantığı akışlarını yalnızca beklenen adım sırasına göre ve adım atlamadan işlediği doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.3", + "section_name": "İş Mantığı Güvenliği", + "req_id": "V2.3.2", + "req_description": "İş mantığı sınırlarının, uygulama dokümantasyonuna uygun şekilde uygulandığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.3", + "section_name": "İş Mantığı Güvenliği", + "req_id": "V2.3.3", + "req_description": "İş mantığı seviyesinde işlemlerin (transaction) kullanıldığı ve bir iş mantığı işleminin ya bütünüyle başarıyla tamamlandığı ya da önceki geçerli duruma geri döndürüldüğü (rollback) doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.3", + "section_name": "İş Mantığı Güvenliği", + "req_id": "V2.3.4", + "req_description": "İş mantığı düzeyinde kilitleme mekanizmalarının, sınırlı kaynakların (ör. sinema koltukları, teslimat zamanları) uygulamanın mantığı manipüle edilerek çift rezervasyona neden olmamasını sağladığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.3", + "section_name": "İş Mantığı Güvenliği", + "req_id": "V2.3.5", + "req_description": "Yüksek değerli iş mantığı akışlarının, yetkisiz veya kazara gerçekleşebilecek işlemleri önlemek için çoklu kullanıcı onayı gerektirdiği doğrulanmalıdır. Bu işlemler büyük para transferleri, sözleşme onayları, gizli bilgilere erişim veya üretimde güvenlik kurallarının geçersiz kılınmaları gibi durumları içerebilir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.4", + "section_name": "Otomasyon Karşıtı Önlemler", + "req_id": "V2.4.1", + "req_description": "Uygulama işlevlerine yönelik aşırı miktardaki çağrılara karşı; veri sızdırma, anlamsız veri üretme, kota tüketme, hız sınırının aşılması, hizmet reddi (DoS) ya da maliyetli kaynakların aşırı kullanımı gibi risklere karşı otomasyon karşıtı kontrollerin bulunduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.4", + "section_name": "Otomasyon Karşıtı Önlemler", + "req_id": "V2.4.2", + "req_description": "İş mantığı akışlarının, aşırı hızlı işlem gönderimlerini önleyecek şekilde gerçekçi insan zamanlaması gerektirdiği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.1", + "section_name": "Web Frontend Güvenlik Dokümantasyonu", + "req_id": "V3.1.1", + "req_description": "Uygulama dokümantasyonunda, uygulamayı kullanan tarayıcıların desteklemesi gereken güvenlik özelliklerinin (ör. HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) ve diğer ilgili HTTP güvenlik mekanizmaları) tanımlandığı doğrulanmalıdır. Ayrıca bu özelliklerin mevcut olmadığı durumlarda uygulamanın nasıl davranması gerektiği (ör. kullanıcıyı uyarmak veya erişimi engellemek) de tanımlanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.2", + "section_name": "İçeriğin Yanlış Yorumlanması", + "req_id": "V3.2.1", + "req_description": "Tarayıcıların HTTP yanıtlarında içerik veya işlevi yanlış bir bağlamda sunmalarını önlemek amacıyla güvenlik kontrollerinin uygulandığı doğrulanmalıdır (ör. API, kullanıcı tarafından yüklenen dosya veya başka bir kaynağın doğrudan çağrılması durumunda). Olası kontroller arasında; yalnızca HTTP istek başlıklarının (ör. Sec-Fetch-\\*) doğru bağlamı gösterdiği durumlarda içeriğin sunulması, Content-Security-Policy başlığında \"sandbox\" yönergesinin kullanılması veya Content-Disposition başlığında \"attachment\" biçiminin kullanılması yer alabilir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.2", + "section_name": "İçeriğin Yanlış Yorumlanması", + "req_id": "V3.2.2", + "req_description": "HTML yerine metin olarak görüntülenmesi amaçlanan içeriğin, HTML veya JavaScript gibi içeriklerin istenmeden çalıştırılmasını önleyecek şekilde \"createTextNode\" veya \"textContent\" gibi güvenli işleme fonksiyonlarıyla işlendiği doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.2", + "section_name": "İçeriğin Yanlış Yorumlanması", + "req_id": "V3.2.3", + "req_description": "Uygulamanın istemci tarafı JavaScript kullanırken açık değişken tanımlamaları yaparak, sıkı tür kontrolü uygulayarak, global değişkenleri document nesnesine kaydetmekten kaçınarak ve ad alanı izolasyonu sağlayarak DOM clobbering’den kaçındığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.3", + "section_name": "Çerez Yapılandırması", + "req_id": "V3.3.1", + "req_description": "Çerezlerin 'Secure' niteliğine sahip olduğu ve eğer çerez adı '\\__Host-' ön eki ile başlamıyorsa, '__Secure-' ön ekinin kullanıldığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.3", + "section_name": "Çerez Yapılandırması", + "req_id": "V3.3.2", + "req_description": "Kullanıcı arayüzü kandırma saldırılarına ve tarayıcı tabanlı istek sahteciliği saldırılarına (CSRF) karşı koruma sağlamak amacıyla, her çerezin 'SameSite' niteliğinin kullanım amacına uygun şekilde ayarlandığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.3", + "section_name": "Çerez Yapılandırması", + "req_id": "V3.3.3", + "req_description": "Çerez adı, diğer sunucularla paylaşılmak üzere açıkça tasarlanmadığı sürece '__Host-' ön eki ile tanımlanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.3", + "section_name": "Çerez Yapılandırması", + "req_id": "V3.3.4", + "req_description": "Bir çerez değeri istemci tarafı betikleri tarafından erişilememesi gereken bir veri içeriyorsa (ör. oturum token'ı), çerezin 'HttpOnly' niteliğine sahip olduğu ve aynı değerin (ör. oturum token'ı) yalnızca 'Set-Cookie' başlığı ile istemciye iletildiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.3", + "section_name": "Çerez Yapılandırması", + "req_id": "V3.3.5", + "req_description": "Uygulama bir çerez oluştururken, çerez adı ve değerinin toplam uzunluğunun 4096 baytı aşmadığı doğrulanmalıdır. Çok büyük çerezler tarayıcı tarafından saklanmaz ve isteklerle gönderilmez; bu da çereze bağlı çalışan uygulama işlevlerinin bozulmasına yol açabilir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.4", + "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", + "req_id": "V3.4.2", + "req_description": "Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header'ı, uygulama tarafından sabit bir değer olarak tanımlanmalı veya gelen Origin header değeri güvenilir origin’lerden oluşan bir izinli listeye karşı doğrulanmalıdır. ‘Access-Control-Allow-Origin: *’ kullanılması gerekiyorsa, yanıtın hassas bilgi içermediği doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.4", + "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", + "req_id": "V3.4.3", + "req_description": "HTTP yanıtlarında Content-Security-Policy header'ı bulunduğu ve bu header'ın yalnızca güvenilen içeriklerin veya kaynakların yüklenmesini ve çalıştırılmasını sağlayan yönergeler içerdiği doğrulanmalıdır. Minimum olarak \"global policy\", object-src 'none', base-uri 'none' yönergelerini içermeli ve izinli liste, nonce veya hash temelli bir yapı içermelidir. Seviye 3 uygulamalarında her yanıt için nonce veya hash içeren özel bir politika tanımlanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.4", + "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", + "req_id": "V3.4.4", + "req_description": "Tüm HTTP yanıtlarının 'X-Content-Type-Options: nosniff' header'ını içerdiği doğrulanmalıdır. Bu, tarayıcıya içerik türünü tahmin etmeyi bırakmasını ve yanıtın Content-Type header'ında belirtilen MIME türünün, beklenen kaynak türüyle eşleşmesini zorunlu kılar. Ayrıca bu, tarayıcıda CORB (Cross-Origin Read Blocking) özelliğini etkinleştirir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.4", + "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", + "req_id": "V3.4.5", + "req_description": "Uygulamanın, 'Referer' başlığı yoluyla üçüncü taraflara teknik olarak hassas verilerin sızmasını önlemek için bir 'referrer policy' belirlediği doğrulanmalıdır. Bu, Referrer-Policy HTTP header'ıyla veya HTML öğe nitelikleriyle (element attributes) sağlanabilir. Sızabilecek hassas bilgiler, URL’deki yol ve sorgu parametreleri ile sınırlı uygulamalarda hostname bilgisini içerebilir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.4", + "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", + "req_id": "V3.4.6", + "req_description": "Uygulamanın, Content-Security-Policy header'ı altında 'frame-ancestors' yönergesini her HTTP yanıtında tanımladığı ve bu sayede içeriklerin varsayılan olarak başka sayfalara gömülmesini engellediği doğrulanmalıdır. Gerekli durumlarda özel olarak izin verildiğinden emin olunmalıdır. 'X-Frame-Options' header'ı, tarayıcılar tarafından desteklenmesine rağmen, artık güncel değildir ve güvenlik amacıyla kullanılmamalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.4", + "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", + "req_id": "V3.4.8", + "req_description": "Bir belgenin işlenmesini ve sunulmasını başlatan tüm HTTP yanıtlarında (örneğin 'text/html' tipi yanıtlar), 'Cross-Origin-Opener-Policy' header'ı 'same-origin' veya 'same-origin-allow-popups' yönergeleriyle birlikte yer almalıdır. Bu, tabnabbing ve frame counting gibi, pencere nesnelerine paylaşımlı erişimi sömüren saldırılara karşı koruma sağlar.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.5", + "section_name": "Tarayıcı Menşei Ayırımı", + "req_id": "V3.5.1", + "req_description": "Uygulama, hassas işlevselliğe yönelik izinsiz cross-origin istekleri önlemek için CORS preflight mekanizmasına güvenmiyorsa, bu tür isteklerin gerçekten uygulamadan geldiği doğrulanmalıdır. Bu, anti-forgery token kullanımı veya CORS tarafından güvenli kabul edilmeyen özel HTTP header'larının zorunlu kılınmasıyla yapılabilir. Bu, tarayıcı tabanlı istek sahteciliği (CSRF) saldırılarına karşı bir savunmadır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.5", + "section_name": "Tarayıcı Menşei Ayırımı", + "req_id": "V3.5.2", + "req_description": "Uygulama, hassas işlevlerin izinsiz cross-origin çağrılmasını önlemek için CORS preflight mekanizmasına güveniyorsa, bu işlevlerin bir CORS-preflight isteğini tetiklemeden çağrılamadığı doğrulanmalıdır. Bu, 'Origin' ve 'Content-Type' header'larının doğrulanmasını veya CORS-safelisted olmayan bir header'ın ve alanın kullanılmasını gerektirebilir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.5", + "section_name": "Tarayıcı Menşei Ayırımı", + "req_id": "V3.5.4", + "req_description": "Farklı uygulamaların farklı hostname'lerde barındırıldığı ve böylece Same-Origin Policy tarafından sağlanan kısıtlamalardan (örneğin çerez erişim sınırları, kaynaklar arası etkileşim kontrolleri) faydalanıldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.5", + "section_name": "Tarayıcı Menşei Ayırımı", + "req_id": "V3.5.6", + "req_description": "Uygulamanın herhangi bir yerinde JSONP işlevselliğinin etkin olmadığı doğrulanmalıdır. Bu, XSSI (Cross-Site Script Inclusion) saldırılarını önlemek içindir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.5", + "section_name": "Tarayıcı Menşei Ayırımı", + "req_id": "V3.5.7", + "req_description": "Yetkilendirme gerektiren verilerin, JavaScript dosyaları gibi betik kaynaklarının yanıtlarında yer almadığı, XSSI saldırılarını önlemek için doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.5", + "section_name": "Tarayıcı Menşei Ayırımı", + "req_id": "V3.5.8", + "req_description": "Kimliği doğrulanmış kaynakların (örneğin görseller, videolar, betikler ve belgeler) yalnızca gerçekten amaçlandığında kullanıcı adına yüklenebildiği veya gömülebildiği doğrulanmalıdır. Bu, isteğin uygun olmayan bir çapraz kaynak çağrısından kaynaklanmadığından emin olmak için Sec-Fetch-* HTTP istek başlığı alanlarının sıkı bir şekilde doğrulanmasıyla veya tarayıcıya döndürülen içeriği engelleme talimatı vermek için kısıtlayıcı bir Cross-Origin-Resource-Policy HTTP yanıt başlığı alanı ayarlayarak gerçekleştirilebilir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.6", + "section_name": "Harici Kaynak Bütünlüğü", + "req_id": "V3.6.1", + "req_description": "JavaScript kütüphaneleri, CSS veya web fontları gibi istemci tarafı varlıkların yalnızca statik ve sürümlü olması, varlığın bütünlüğünü doğrulamak için Subresource Integrity (SRI) kullanılması durumunda harici olarak (örneğin, bir İçerik Dağıtım Ağı üzerinde) barındırıldığı doğrulanmalıdır. Bu mümkün değilse, her bir kaynak için bunu gerekçelendiren belgelenmiş bir güvenlik kararı bulunmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.7", + "section_name": "Diğer Tarayıcı Güvenliği Hususları", + "req_id": "V3.7.1", + "req_description": "Uygulamanın yalnızca hâlâ desteklenen ve güvenli kabul edilen istemci tarafı teknolojileri kullandığı doğrulanmalıdır. Bu gereksinimi karşılamayan teknolojilere örnek olarak NSAPI eklentileri, Flash, Shockwave, ActiveX, Silverlight, NACL veya istemci tarafı Java applet’leri verilebilir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.7", + "section_name": "Diğer Tarayıcı Güvenliği Hususları", + "req_id": "V3.7.2", + "req_description": "Uygulamanın, yalnızca hedef adres bir izinli listede yer alıyorsa kullanıcıyı otomatik olarak farklı bir ana makine adına veya uygulamanın kontrolünde olmayan bir etki alanına yönlendirdiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.7", + "section_name": "Diğer Tarayıcı Güvenliği Hususları", + "req_id": "V3.7.3", + "req_description": "Uygulamanın, kullanıcı uygulamanın kontrolü dışındaki bir URL’ye yönlendirildiğinde, yönlendirme hakkında bir bildirim gösterdiği ve kullanıcının bu gezintiyi iptal edebilmesi için bir seçenek sunduğu doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.7", + "section_name": "Diğer Tarayıcı Güvenliği Hususları", + "req_id": "V3.7.4", + "req_description": "Uygulamanın en üst düzey etki alanının (örneğin, site.tld) HTTP Strict Transport Security (HSTS) için genel preload listesine eklendiği doğrulanmalıdır. Bu, uygulamanın TLS kullanımının ana tarayıcılar tarafından doğrudan tanınmasını ve yalnızca Strict-Transport-Security yanıt header'ına bağlı kalınmamasını sağlar.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.7", + "section_name": "Diğer Tarayıcı Güvenliği Hususları", + "req_id": "V3.7.5", + "req_description": "Uygulamaya erişen tarayıcının beklenen güvenlik özelliklerini desteklememesi durumunda, uygulamanın dokümantasyona uygun şekilde davrandığı (örneğin kullanıcıyı uyarma veya erişimi engelleme) doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.1", + "section_name": "Genel Web Servisi Güvenliği", + "req_id": "V4.1.1", + "req_description": "İleti gövdesi içeren her HTTP yanıtında, yanıtın gerçek içeriğiyle eşleşen bir Content-Type header alanı bulunduğu ve güvenli karakter kodlamasını (örneğin, UTF-8, ISO-8859-1) belirtmek üzere charset parametresi içerdiği doğrulanmalıdır. Bu işlem, IANA Medya Türleri'nden \"text/\", \"/+xml\" ve \"/xml\" gibi içerikler için geçerlidir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.1", + "section_name": "Genel Web Servisi Güvenliği", + "req_id": "V4.1.2", + "req_description": "Yalnızca kullanıcı arayüzüne yönelik uç noktaların (manuel olarak web tarayıcısı ile erişilmesi amaçlanan) otomatik olarak HTTP'den HTTPS'e yönlendirme yaptığı ve diğer hizmetlerin veya uç noktaların şeffaf yönlendirme gerçekleştirmediği doğrulanmalıdır. Bu, istemcinin farkında olmadan şifrelenmemiş HTTP istekleri göndermesi ve bu isteklerin otomatik olarak HTTPS'e yönlendirilmesi sonucunda hassas verilerin sızmasının fark edilmemesi riskini önlemek içindir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.1", + "section_name": "Genel Web Servisi Güvenliği", + "req_id": "V4.1.3", + "req_description": "Uygulama tarafından kullanılan ve yük dengeleyici, web proxy veya frontend için backend hizmeti gibi bir ara katman tarafından ayarlanan herhangi bir HTTP başlık alanının, son kullanıcı tarafından geçersiz kılınamayacağı doğrulanmalıdır. Örnek başlıklar arasında X-Real-IP, X-Forwarded-* veya X-User-ID yer alabilir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.1", + "section_name": "Genel Web Servisi Güvenliği", + "req_id": "V4.1.4", + "req_description": "Uygulama veya API tarafından açıkça desteklenen HTTP yöntemlerinin (preflight istekleri sırasında OPTIONS dahil) dışında hiçbir yöntemin kullanılmadığı ve kullanılmayan yöntemlerin engellendiği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.1", + "section_name": "Genel Web Servisi Güvenliği", + "req_id": "V4.1.5", + "req_description": "Çok hassas istekler veya birçok sistemden geçen işlemler için, taşıma katmanı güvenliğinin üzerine ek bir güvence sağlamak amacıyla, her iletiye özel dijital imzaların kullanıldığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.2", + "section_name": "HTTP İleti Yapısı Doğrulama", + "req_id": "V4.2.1", + "req_description": "Tüm uygulama bileşenlerinin (yük dengeleyiciler, güvenlik duvarları ve uygulama sunucuları dahil) HTTP sürümüne uygun mekanizmaları kullanarak gelen HTTP iletilerinin sınırlarını belirlediği ve bu sayede HTTP istek kaçakçılığına karşı koruma sağlandığı doğrulanmalıdır. HTTP/1.x sürümünde Transfer-Encoding başlık alanı varsa, RFC 2616'ya göre Content-Length başlığı göz ardı edilmelidir. HTTP/2 veya HTTP/3 kullanıldığında, Content-Length başlığı varsa, alıcının bu değerin DATA çerçevelerinin uzunluğuyla tutarlı olduğunu doğrulaması gerekir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.2", + "section_name": "HTTP İleti Yapısı Doğrulama", + "req_id": "V4.2.2", + "req_description": "HTTP iletileri üretilirken, Content-Length başlığının, HTTP protokolünün çerçeveleme yöntemine göre belirlenen içerik uzunluğu ile çelişmediği doğrulanmalıdır. Bu, istek kaçakçılığı saldırılarını önlemek için gereklidir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.2", + "section_name": "HTTP İleti Yapısı Doğrulama", + "req_id": "V4.2.3", + "req_description": "Uygulamanın, yanıt bölme ve header enjeksiyonu saldırılarını önlemek amacıyla, bağlantıya özel başlık alanları (örneğin Transfer-Encoding) içeren HTTP/2 veya HTTP/3 iletilerini göndermediği ve kabul etmediği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.2", + "section_name": "HTTP İleti Yapısı Doğrulama", + "req_id": "V4.2.4", + "req_description": "Uygulamanın yalnızca başlık alanları ve değerleri CR (\\r), LF (\\n) veya CRLF (\\r\\n) karakter dizileri içermeyen HTTP/2 ve HTTP/3 isteklerini kabul ettiği doğrulanmalıdır. Bu, başlık enjeksiyonu saldırılarını önlemek içindir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.2", + "section_name": "HTTP İleti Yapısı Doğrulama", + "req_id": "V4.2.5", + "req_description": "Uygulama (backend veya frontend) istek oluşturuyor ve gönderiyorsa, URI'ler (örneğin API çağrıları için) veya HTTP istek başlıkları (örneğin Authorization veya Cookie) gibi bileşenlerin, alıcı sistemler tarafından kabul edilemeyecek kadar uzun olmamasını sağlamak amacıyla doğrulama, temizleme veya diğer mekanizmaları kullandığı doğrulanmalıdır. Bu tür çok uzun istekler (örneğin çok uzun bir Cookie başlığı) gönderildiğinde sunucunun sürekli hata durumu döndürmesiyle hizmet reddi oluşabilir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.3", + "section_name": "GraphQL", + "req_id": "V4.3.1", + "req_description": "Maliyetli ve iç içe geçmiş sorgular sonucu oluşabilecek GraphQL veya veri katmanı ifadelerine yönelik Hizmet Reddi (DoS) saldırılarını önlemek için, sorgu izin listesi (allowlist), derinlik sınırlandırması, sorgu sayısı sınırlandırması veya sorgu maliyeti analizi kullanıldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.3", + "section_name": "GraphQL", + "req_id": "V4.3.2", + "req_description": "GraphQL introspection (iç yapı sorgulama) sorgularının, GraphQL API'nin üçüncü taraflar tarafından kullanılmasına yönelik olmadığı sürece, üretim ortamında devre dışı bırakıldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.1", + "req_description": "Tüm WebSocket bağlantılarında TLS üzerinden WebSocket (WSS) kullanıldığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.2", + "req_description": "WebSocket'in başlangıçtaki HTTP el sıkışması (handshake) sırasında, Origin başlık alanının uygulama için izin verilen origin listesiyle karşılaştırılarak kontrol edildiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.3", + "req_description": "Uygulamanın standart oturum yönetimi kullanılamıyorsa, bunun yerine ilgili Oturum Yönetimi güvenlik gereksinimlerine uygun özel token'ların kullanıldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.4", + "req_description": "HTTPS oturumu WebSocket kanalına geçerken, özel WebSocket oturum yönetim token’larının önceki şekilde kimliği doğrulanmış HTTPS oturumu aracılığıyla elde edildiği veya doğrulandığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.1", + "section_name": "Dosya İşleme Dokümantasyonu", + "req_id": "V5.1.1", + "req_description": "Dokümantasyonun, her yükleme özelliği için izin verilen dosya türlerini, beklenen dosya uzantılarını ve maksimum boyutu (açılmış hali dahil) tanımladığı doğrulanmalıdır. Ayrıca, dosyaların son kullanıcılar için nasıl güvenli hâle getirileceği (örneğin kötü amaçlı bir dosya tespit edildiğinde uygulamanın nasıl davranacağı) gibi bilgilerin de belgede yer aldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.2", + "section_name": "Dosya Yükleme ve İçerik", + "req_id": "V5.2.1", + "req_description": "Uygulamanın, yalnızca performans kaybına veya hizmet reddine yol açmayacak boyuttaki dosyaları kabul ettiği doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.2", + "section_name": "Dosya Yükleme ve İçerik", + "req_id": "V5.2.2", + "req_description": "Uygulama bir dosyayı, doğrudan veya bir arşiv (ör. zip dosyası) içinde kabul ettiğinde, dosya uzantısının beklenen uzantıyla eşleşip eşleşmediğini kontrol ettiği ve içeriğin uzantı tarafından temsil edilen türle uyumlu olduğunu doğruladığı kontrol edilmelidir. Bu; ilk 'magic byte' kontrolü, görüntü yeniden yazımı ve dosya içeriği doğrulama için özel kütüphanelerin kullanımı gibi yöntemleri içerir. Seviye 1 için bu, yalnızca iş veya güvenlik kararlarında kullanılan dosyalarla sınırlı olabilir. Seviye 2 ve üzeri için tüm dosyalar bu kontrole tabi olmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.2", + "section_name": "Dosya Yükleme ve İçerik", + "req_id": "V5.2.3", + "req_description": "Sıkıştırılmış dosyaların (ör. zip, gz, docx, odt) açılmadan önce, izin verilen maksimum açılmış boyuta ve maksimum dosya sayısına göre kontrol edildiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.2", + "section_name": "Dosya Yükleme ve İçerik", + "req_id": "V5.2.4", + "req_description": "Her kullanıcı için dosya boyutu kotası ve maksimum dosya sayısının uygulandığı doğrulanmalıdır. Böylece tek bir kullanıcının çok sayıda veya aşırı büyük dosya yükleyerek depolama alanını doldurması engellenir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.2", + "section_name": "Dosya Yükleme ve İçerik", + "req_id": "V5.2.5", + "req_description": "Uygulamanın, içinde sembolik bağlantılar (symlink) bulunan sıkıştırılmış dosyaların yüklenmesine yalnızca bu durum özel olarak gerekli olduğunda izin verdiği doğrulanmalıdır. Bu durumda, sembolik bağlantı verilebilecek dosyaların bir izinli listesi uygulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.2", + "section_name": "Dosya Yükleme ve İçerik", + "req_id": "V5.2.6", + "req_description": "Uygulamanın, piksel boyutu izin verilen maksimum değeri aşan görüntü dosyalarının yüklenmesini reddettiği doğrulanmalıdır. Bu, pixel flood saldırılarını önlemek için gereklidir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.3", + "section_name": "Dosya Depolama", + "req_id": "V5.3.1", + "req_description": "Güvenilmeyen girdilerle yüklenen veya oluşturulan ve herkese açık klasörlerde depolanan dosyaların, bir HTTP isteğiyle doğrudan erişildiğinde sunucu taraflı program kodu olarak çalıştırılmadığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.3", + "section_name": "Dosya Depolama", + "req_id": "V5.3.2", + "req_description": "Uygulamanın, dosya işlemleri için dosya yollarını oluştururken kullanıcı tarafından gönderilen dosya adlarını değil, dahili olarak oluşturulan veya güvenilir verileri kullandığı; eğer kullanıcı tarafından gönderilen dosya adları veya meta veriler kullanılacaksa, sıkı doğrulama ve temizleme işlemlerinin uygulandığı doğrulanmalıdır. Bu, yol geçişi (path traversal), yerel veya uzak dosya dahil etme (LFI, RFI) ve sunucu tarafı istek sahteciliği (SSRF) saldırılarına karşı koruma sağlar.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.3", + "section_name": "Dosya Depolama", + "req_id": "V5.3.3", + "req_description": "Sunucu tarafında gerçekleşen dosya işlemlerinin (örneğin dosya açma/decompress işlemi), kullanıcı tarafından sağlanan yol bilgilerini yok saydığı ve zip slip gibi güvenlik açıklarını önlediği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.4", + "section_name": "Dosya İndirme", + "req_id": "V5.4.1", + "req_description": "Uygulamanın, kullanıcı tarafından gönderilen dosya adlarını (ör. JSON, JSONP veya URL parametresinde) doğruladığı veya göz ardı ettiği ve yanıtın Content-Disposition başlık alanında bir dosya adı belirttiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.4", + "section_name": "Dosya İndirme", + "req_id": "V5.4.2", + "req_description": "Sunulan dosya adlarının (örneğin HTTP yanıt header'larında veya e-posta eklerinde), belge yapısını korumak ve enjeksiyon saldırılarını önlemek için kodlandığı veya temizlendiği (ör. RFC 6266’ya uygun) doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.4", + "section_name": "Dosya İndirme", + "req_id": "V5.4.3", + "req_description": "Güvenilmeyen kaynaklardan elde edilen dosyaların, bilinen kötü amaçlı içeriklerin sunulmasını önlemek amacıyla antivirüs tarayıcılarıyla tarandığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.1", + "section_name": "Kimlik Doğrulama Dokümantasyonu", + "req_id": "V6.1.1", + "req_description": "Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırılarına karşı oran sınırlama (rate limiting), otomasyon karşıtı önlemler ve uyarlanabilir yanıt gibi kontrollerin nasıl kullanıldığını açıklayan bir uygulama dokümantasyonu bulunduğu doğrulanmalıdır. Dokümantasyon, bu kontrollerin nasıl yapılandırıldığını ve kötü niyetli hesap kilitlemenin nasıl önlendiğini açıkça ortaya koymalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.1", + "section_name": "Kimlik Doğrulama Dokümantasyonu", + "req_id": "V6.1.2", + "req_description": "Parolalarda kullanılmasını önlemek amacıyla, bağlama özgü sözcüklerin (örneğin kurum adlarının permütasyonları, ürün adları, sistem tanımlayıcıları, proje kod adları, departman veya rol adları vb.) bulunduğu belgelenmiş bir liste mevcut olduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.1", + "section_name": "Kimlik Doğrulama Dokümantasyonu", + "req_id": "V6.1.3", + "req_description": "Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, bunların tümünün belgelenmiş olduğu ve her yol için tutarlı şekilde uygulanması gereken güvenlik kontrolleri ile kimlik doğrulama gücünün tanımlandığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.1", + "req_description": "Kullanıcı tarafından belirlenen parolaların en az 8 karakter uzunluğunda olması sağlanmalı, ancak 15 karakter ve üzeri uzunlukta parolalar olmaları şiddetle tavsiye edilir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.2", + "req_description": "Kullanıcıların parolalarını değiştirebilmeleri sağlanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.3", + "req_description": "Parola değiştirme işlevinin hem mevcut hem de yeni parolayı gerektirdiği doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.4", + "req_description": "Kayıt veya parola değişimi sırasında girilen parolaların, uygulamanın parola politikasına (örneğin minimum uzunluk) uyan ilk 3000 yaygın parolaya karşı kontrol edildiği doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.5", + "req_description": "Her tür karakterin kullanılmasına izin verildiği ve büyük/küçük harf, sayı veya özel karakter şartlarının zorunlu tutulmadığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.6", + "req_description": "Parola giriş alanlarının, girdiyi maskelemek için \"type=password\" kullandığı doğrulanmalıdır. Uygulamalar, kullanıcının tüm maskelenmiş parolayı ya da son girilen karakteri geçici olarak görüntülemesine izin verebilir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.7", + "req_description": "\"Yapıştır\" özelliğinin, tarayıcı parola yardımcılarının ve harici parola yöneticilerinin kullanımına izin verildiği doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.8", + "req_description": "Uygulamanın, kullanıcıdan aldığı parolayı herhangi bir şekilde değiştirmeden, örneğin kesmeden veya harf büyüklüğünü değiştirmeden, tam olarak doğruladığı teyit edilmelidir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.9", + "req_description": "En az 64 karakter uzunluğundaki parolalara izin verildiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.10", + "req_description": "Kullanıcının parolasının, yalnızca ele geçirildiği tespit edildiğinde veya kullanıcı tarafından yenilendiğinde geçerliliğini yitirdiği doğrulanmalıdır. Uygulama, belirli aralıklarla parola yenilenmesini zorunlu kılmamalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.11", + "req_description": "Tahmin edilmesi kolay parolaların oluşturulmasını önlemek amacıyla, bağlama özgü kelimelerin yer aldığı belgelenmiş listenin parola doğrulamada kullanıldığı teyit edilmelidir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.12", + "req_description": "Kayıt veya parola değişikliği sırasında girilen parolaların, ele geçirilmiş parolalar listesine karşı kontrol edildiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.3", + "section_name": "Genel Kimlik Doğrulama Güvenliği", + "req_id": "V6.3.1", + "req_description": "Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırıları gibi saldırıları önlemeye yönelik kontrollerin, uygulamanın güvenlik dokümantasyonuna göre uygulandığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.3", + "section_name": "Genel Kimlik Doğrulama Güvenliği", + "req_id": "V6.3.2", + "req_description": "\"root\", \"admin\" veya \"sa\" gibi varsayılan kullanıcı hesaplarının uygulamada yer almadığı veya devre dışı bırakıldığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.3", + "section_name": "Genel Kimlik Doğrulama Güvenliği", + "req_id": "V6.3.3", + "req_description": "Uygulamaya erişim için ya çok faktörlü bir kimlik doğrulama mekanizması ya da tek faktörlü mekanizmaların kombinasyonu kullanılmalıdır. Seviye 3 için, bu faktörlerden biri, oltalama saldırılarına karşı direnç sağlayan ve kimlik doğrulama niyetini bir kullanıcı etkileşimi (örneğin FIDO donanım anahtarında bir düğmeye basma veya mobil telefonda bir onay) gerektirerek doğrulayan donanım tabanlı bir kimlik doğrulayıcı olmalıdır. Bu gereksinimdeki herhangi bir esneklik için, gerekçesi belgelenmiş ve riskleri azaltıcı kapsamlı kontroller içeren bir plan gereklidir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.3", + "section_name": "Genel Kimlik Doğrulama Güvenliği", + "req_id": "V6.3.4", + "req_description": "Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, belgelendirilmemiş bir yol bulunmadığı ve tüm yollar için güvenlik kontrolleri ile kimlik doğrulama gücünün tutarlı şekilde uygulandığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.3", + "section_name": "Genel Kimlik Doğrulama Güvenliği", + "req_id": "V6.3.5", + "req_description": "Başarılı veya başarısız şüpheli kimlik doğrulama girişimlerinin kullanıcıya bildirildiği doğrulanmalıdır. Bu, olağandışı bir konum veya istemciden gelen girişimler, yalnızca bir faktörle yapılan kısmen başarılı doğrulamalar, uzun süreli inaktiflik sonrası yapılan girişimler veya birçok başarısız denemeden sonraki başarılı girişimler gibi durumları içerebilir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.3", + "section_name": "Genel Kimlik Doğrulama Güvenliği", + "req_id": "V6.3.6", + "req_description": "E-postanın, tek faktörlü ya da çok faktörlü kimlik doğrulama mekanizması olarak kullanılmadığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.3", + "section_name": "Genel Kimlik Doğrulama Güvenliği", + "req_id": "V6.3.7", + "req_description": "Kimlik doğrulama detaylarında yapılan güncellemeler sonrasında (örneğin kimlik bilgisi sıfırlama, kullanıcı adı veya e-posta adresi değişiklikleri), kullanıcıların bilgilendirildiği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.3", + "section_name": "Genel Kimlik Doğrulama Güvenliği", + "req_id": "V6.3.8", + "req_description": "Başarısız kimlik doğrulama girişimlerinden, geçerli kullanıcıların hata mesajları, HTTP yanıt kodları veya farklı yanıt süreleri gibi sonuçlara dayanarak tespit edilemediği doğrulanmalıdır. Bu koruma, kayıt ve \"parolamı unuttum\" işlevselliğinde de geçerli olmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.4", + "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", + "req_id": "V6.4.1", + "req_description": "Sistem tarafından oluşturulan ilk parolaların veya etkinleştirme kodlarının güvenli bir şekilde rastgele üretildiği, mevcut parola politikasına uygun olduğu, kısa bir süre içinde veya ilk kullanım sonrasında geçerliliğini yitirdiği doğrulanmalıdır. Bu başlangıç sırları uzun vadeli parola olarak kullanılmasına izin verilmemelidir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.4", + "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", + "req_id": "V6.4.2", + "req_description": "Parola ipuçlarının veya \"gizli sorular\" olarak bilinen, bilgiye dayalı kimlik doğrulama mekanizmalarının mevcut olmadığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.4", + "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", + "req_id": "V6.4.3", + "req_description": "Unutulmuş parolanın sıfırlanması için, etkin olan çok faktörlü kimlik doğrulama mekanizmalarını atlamayan güvenli bir sürecin uygulandığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.4", + "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", + "req_id": "V6.4.4", + "req_description": "Çok faktörlü kimlik doğrulama faktörlerinden biri kaybolursa, kayıt sırasında uygulanan kimlik kanıtlama seviyesiyle aynı seviyede kimlik doğrulama yapıldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.4", + "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", + "req_id": "V6.4.5", + "req_description": "Süresi dolacak kimlik doğrulama mekanizmalarının yenilenmesine ilişkin talimatların, süresi dolmadan önce tamamlanacak şekilde yeterli sürede gönderildiği ve gerekiyorsa otomatik hatırlatıcıların yapılandırıldığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.4", + "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", + "req_id": "V6.4.6", + "req_description": "Yönetici yetkisi olan kullanıcıların, kullanıcının parola sıfırlama sürecini başlatabildiği ancak kullanıcının yeni parolasını belirleyemediği veya değiştiremediği doğrulanmalıdır. Bu, yönetici yetkisi olan kullanıcıların, kullanıcı parolasını bilmesini engeller.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.5", + "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "req_id": "V6.5.1", + "req_description": "Arama sırları, bant dışı kimlik doğrulama istekleri veya kodları ve zamana dayalı tek kullanımlık parolaların (TOTP) yalnızca bir kez kullanılabildiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.5", + "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "req_id": "V6.5.2", + "req_description": "Uygulamanın backend tarafında saklanırken, 112 bitten az entropiye sahip (örneğin 19 rastgele harf-rakam karakteri veya 34 rastgele rakam) arama sırlarının, 32-bit rastgele bir salt içeren onaylı bir parola saklama algoritmasıyla hash’lendiği doğrulanmalıdır. Gizli bilginin entropisi 112 bit veya daha fazlaysa standart bir hash fonksiyonu kullanılabilir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.5", + "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "req_id": "V6.5.3", + "req_description": "Arama sırları, bant dışı kimlik doğrulama kodları ve zamana dayalı tek kullanımlık parola seed'lerinin, öngörülebilir değerlerden kaçınmak için Kriptografik Olarak Güvenli Sözde Rastgele Sayı Üreteci (CSPRNG) ile oluşturulduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.5", + "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "req_id": "V6.5.4", + "req_description": "Arama sırlarının ve bant dışı kimlik doğrulama kodlarının en az 20 bit entropiye (genellikle 4 rastgele harf-rakam karakteri veya 6 rastgele rakam) sahip olduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.5", + "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "req_id": "V6.5.5", + "req_description": "Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının ve zamana dayalı tek kullanımlık parolaların (TOTP) belirli bir ömre sahip olduğu doğrulanmalıdır. Bant dışı istekler en fazla 10 dakika, TOTP’ler ise en fazla 30 saniye geçerli olmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.5", + "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "req_id": "V6.5.6", + "req_description": "Herhangi bir kimlik doğrulama faktörünün (fiziksel cihazlar dahil) çalınması veya kaybı durumunda iptal edilebildiği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.5", + "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "req_id": "V6.5.7", + "req_description": "Biyometrik kimlik doğrulama mekanizmalarının yalnızca ikincil faktör olarak, “sahip olduğunuz bir şey” veya “bildiğiniz bir şey” ile birlikte kullanıldığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.5", + "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "req_id": "V6.5.8", + "req_description": "Zamana dayalı tek kullanımlık parolaların (TOTP) doğrulamasının, güvenilir bir hizmetten alınan zaman kaynağına dayanarak yapıldığı ve güvenilir olmayan veya istemci tarafından sağlanan zaman kaynağına dayanmadığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.6", + "section_name": "Bant Dışı Kimlik Doğrulama Mekanizmaları", + "req_id": "V6.6.1", + "req_description": "Tek kullanımlık parolaların (OTP) telefon veya SMS ile Public Switched Telephone Network (PSTN) üzerinden iletildiği kimlik doğrulama mekanizmalarının, yalnızca telefon numarası önceden doğrulanmışsa, alternatif daha güçlü yöntemler (örneğin TOTP) de sunuluyorsa ve kullanıcıya güvenlik riskleri hakkında bilgi veriliyorsa sunulduğu doğrulanmalıdır. Seviye 3 uygulamalar için telefon ve SMS seçenekleri sunulmamalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.6", + "section_name": "Bant Dışı Kimlik Doğrulama Mekanizmaları", + "req_id": "V6.6.2", + "req_description": "Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının, oluşturuldukları özgün kimlik doğrulama isteğiyle bağlantılı olduğu ve daha önceki ya da sonraki bir istek için kullanılamadığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.6", + "section_name": "Bant Dışı Kimlik Doğrulama Mekanizmaları", + "req_id": "V6.6.3", + "req_description": "Kod tabanlı bant dışı kimlik doğrulama mekanizmalarının, oran sınırlaması ile kaba kuvvet saldırılarına karşı korunduğu doğrulanmalıdır. En az 64 bit entropiye sahip kodlar kullanılması da değerlendirilmelidir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.6", + "section_name": "Bant Dışı Kimlik Doğrulama Mekanizmaları", + "req_id": "V6.6.4", + "req_description": "Çok faktörlü kimlik doğrulama için push bildirimleri kullanılıyorsa, push bombing saldırılarına karşı oran sınırlamasının kullanıldığı doğrulanmalıdır. “Numara eşleştirme” de bu riski azaltabilir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.7", + "section_name": "Kriptografik Kimlik Doğrulama Mekanizması", + "req_id": "V6.7.1", + "req_description": "Kriptografik kimlik doğrulama beyanlarını doğrulamak için kullanılan sertifikaların, değiştirilmeye karşı korumalı şekilde saklandığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.7", + "section_name": "Kriptografik Kimlik Doğrulama Mekanizması", + "req_id": "V6.7.2", + "req_description": "Challenge nonce değerinin en az 64 bit uzunluğunda olduğu ve istatistiksel olarak benzersiz ya da cihazın ömrü boyunca benzersiz olduğu doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.8", + "section_name": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", + "req_id": "V6.8.1", + "req_description": "Uygulama birden fazla kimlik sağlayıcıyı (IdP) destekliyorsa, başka bir desteklenen kimlik sağlayıcı aracılığıyla (örneğin aynı kullanıcı tanımlayıcısını kullanarak) kullanıcının kimliğinin taklit edilemediği doğrulanmalıdır. Standart önlem, uygulamanın kullanıcıyı IdP kimliği (bir ad alanı işlevi görür) ve IdP içindeki kullanıcı kimliğinin birleşimiyle kaydetmesi ve tanımlamasıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.8", + "section_name": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", + "req_id": "V6.8.2", + "req_description": "Kimlik doğrulama beyanları üzerindeki dijital imzaların (örneğin JWT veya SAML beyanları) varlığı ve bütünlüğünün her zaman doğrulandığı ve imzasız veya geçersiz imzalı beyanların reddedildiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.8", + "section_name": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", + "req_id": "V6.8.3", + "req_description": "SAML beyanlarının benzersiz biçimde işlendiği ve yalnızca geçerlilik süresi içinde bir kez kullanıldığı, tekrar oynatma (replay) saldırılarını önlemek amacıyla doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.8", + "section_name": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", + "req_id": "V6.8.4", + "req_description": "Uygulama ayrı bir Kimlik Sağlayıcı (IdP) kullanıyorsa ve belirli işlemler için belirli kimlik doğrulama gücü, yöntemleri veya zaman bilgisi bekliyorsa, uygulamanın bu bilgileri IdP tarafından döndürülen veriler üzerinden doğruladığı teyit edilmelidir. Örneğin OIDC kullanılıyorsa, bu durum ID Token üzerindeki 'acr', 'amr' ve 'auth_time' gibi claim’lerin (varsa) doğrulanması ile sağlanabilir. Eğer IdP bu bilgileri sağlamıyorsa, uygulamanın asgari kimlik doğrulama gücünün kullanıldığını varsayan (örneğin yalnızca kullanıcı adı ve parola ile tek faktörlü doğrulama) belgelenmiş bir yedek yaklaşımı olmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.1", + "section_name": "Oturum Yönetim Dokümantasyonu", + "req_id": "V7.1.1", + "req_description": "Kullanıcının oturum inaktivite zaman aşımı süresi ve mutlak maksimum oturum süresinin belgelendiği, diğer kontrollerle birlikte uygun olduğu ve NIST SP 800-63B yeniden kimlik doğrulama gereksinimlerinden herhangi bir sapma varsa gerekçesinin belgede yer aldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.1", + "section_name": "Oturum Yönetim Dokümantasyonu", + "req_id": "V7.1.2", + "req_description": "Belgede bir hesap için kaç adet eşzamanlı (paralel) oturuma izin verildiği ile birlikte, maksimum aktif oturum sayısına ulaşıldığında uygulanacak davranış ve işlemlerin tanımlandığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.1", + "section_name": "Oturum Yönetim Dokümantasyonu", + "req_id": "V7.1.3", + "req_description": "Birleşik kimlik yönetim ekosisteminin bir parçası olarak kullanıcı oturumu oluşturan ve yöneten tüm sistemlerin, oturum ömrü, sonlandırma ve yeniden kimlik doğrulama gerektiren diğer koşulların nasıl koordine edildiğini açıklayan kontrollerle birlikte belgede yer aldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.2", + "section_name": "Temel Oturum Yönetimi Güvenliği", + "req_id": "V7.2.1", + "req_description": "Uygulamanın tüm oturum token'ı doğrulama işlemlerini güvenilir bir backend servisi aracılığıyla gerçekleştirdiği doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.2", + "section_name": "Temel Oturum Yönetimi Güvenliği", + "req_id": "V7.2.2", + "req_description": "Uygulamanın, statik API gizli anahtarları veya sabit değerler yerine, oturum yönetimi için dinamik olarak oluşturulan kendi kendine yeterli veya referans token'ları kullandığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.2", + "section_name": "Temel Oturum Yönetimi Güvenliği", + "req_id": "V7.2.3", + "req_description": "Uygulama kullanıcı oturumlarını temsil etmek için referans token'ları kullanıyorsa, bu token'ların benzersiz olduğu, kriptografik olarak güvenli bir sözde rastgele sayı üreteci (CSPRNG) kullanılarak üretildiği ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.2", + "section_name": "Temel Oturum Yönetimi Güvenliği", + "req_id": "V7.2.4", + "req_description": "Uygulamanın, kullanıcı kimlik doğrulaması (yeniden kimlik doğrulama dahil) sırasında yeni bir oturum token'ı oluşturduğu ve mevcut oturum token'ını sonlandırdığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.3", + "section_name": "Oturum Zaman Aşımı", + "req_id": "V7.3.1", + "req_description": "Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde bir hareketsizlik zaman aşımı bulunduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.3", + "section_name": "Oturum Zaman Aşımı", + "req_id": "V7.3.2", + "req_description": "Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde mutlak bir maksimum oturum süresi bulunduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.4", + "section_name": "Oturum Sonlandırma", + "req_id": "V7.4.1", + "req_description": "Oturum sonlandırma tetiklendiğinde (örneğin, çıkış yapıldığında veya süre dolduğunda), uygulamanın oturumun daha fazla kullanılmasına izin vermediği doğrulanmalıdır. Referans token'lar veya durum bilgili oturumlar için bu, oturum verilerinin uygulama arka ucunda geçersiz kılınması anlamına gelir. Kapsamlı token kullanan uygulamaların; sonlandırılmış token listesi tutmak, kullanıcıya özel tarih ve saatten önce oluşturulan token'ları reddetmek veya kullanıcıya özel imzalama anahtarını yenilemek gibi bir çözüm uygulaması gerekir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.4", + "section_name": "Oturum Sonlandırma", + "req_id": "V7.4.2", + "req_description": "Bir kullanıcı hesabı devre dışı bırakıldığında veya silindiğinde (örneğin bir çalışanın şirketten ayrılması), uygulamanın tüm aktif oturumları sonlandırdığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.4", + "section_name": "Oturum Sonlandırma", + "req_id": "V7.4.3", + "req_description": "Herhangi bir kimlik doğrulama faktörünün başarılı bir şekilde değiştirilmesi veya kaldırılmasından (şifre sıfırlama veya kurtarma yoluyla yapılan değişiklikler dahil ve varsa MFA ayarları güncellemeleri dahil) sonra, uygulamanın diğer tüm aktif oturumları sonlandırma seçeneği sunduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.4", + "section_name": "Oturum Sonlandırma", + "req_id": "V7.4.4", + "req_description": "Kimlik doğrulama gerektiren tüm sayfalarda kolay erişilebilir ve görünür bir çıkış yap (logout) işlevi bulunduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.4", + "section_name": "Oturum Sonlandırma", + "req_id": "V7.4.5", + "req_description": "Uygulama yöneticilerinin, bireysel bir kullanıcının veya tüm kullanıcıların aktif oturumlarını sonlandırabilme yetkisine sahip olduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.5", + "section_name": "Oturum Kötüye Kullanımına Karşı Savunmalar", + "req_id": "V7.5.1", + "req_description": "E-posta adresi, telefon numarası, MFA yapılandırması veya hesap kurtarmada kullanılan diğer bilgiler gibi kimlik doğrulamayı etkileyebilecek hassas hesap özniteliklerinde değişiklik yapılmadan önce uygulamanın tam yeniden kimlik doğrulama gerektirdiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.5", + "section_name": "Oturum Kötüye Kullanımına Karşı Savunmalar", + "req_id": "V7.5.2", + "req_description": "Kullanıcıların, (en az bir faktörle yeniden kimlik doğrulama yaptıktan sonra) mevcut tüm aktif oturumları görüntüleyebilmesi ve sonlandırabilmesinin mümkün olduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.5", + "section_name": "Oturum Kötüye Kullanımına Karşı Savunmalar", + "req_id": "V7.5.3", + "req_description": "Uygulamanın, son derece hassas işlemler veya operasyonlar gerçekleştirilmeden önce en az bir faktörle ek kimlik doğrulaması veya ikincil bir doğrulama gerektirdiği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.6", + "section_name": "Birleşik Yeniden Kimlik Doğrulama", + "req_id": "V7.6.1", + "req_description": "Güvenen Taraf (RP) ile Kimlik Sağlayıcı (IdP) arasındaki oturum süresi ve oturum sonlandırma davranışlarının belgelenmiş olduğu ve, örneğin IdP kimlik doğrulama olayları arasında maksimum süreye ulaşıldığında yeniden kimlik doğrulamanın gerekli kılındığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.6", + "section_name": "Birleşik Yeniden Kimlik Doğrulama", + "req_id": "V7.6.2", + "req_description": "Yeni bir oturum oluşturulmasının, kullanıcı onayı veya açık bir eylem gerektirdiği; kullanıcı etkileşimi olmaksızın yeni uygulama oturumlarının oluşturulmasının önlendiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.1", + "section_name": "Yetkilendirme Dokümantasyonu", + "req_id": "V8.1.1", + "req_description": "Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak işlev düzeyinde ve veriye özel erişim kısıtlamaları için kuralları tanımladığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.1", + "section_name": "Yetkilendirme Dokümantasyonu", + "req_id": "V8.1.2", + "req_description": "Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak alan (field) düzeyinde erişim kısıtlamaları (hem okuma hem yazma) için kuralları tanımladığı doğrulanmalıdır. Bu kuralların, ilgili veri nesnesinin durum veya statü gibi diğer özniteliklerine bağlı olabileceği unutulmamalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.1", + "section_name": "Yetkilendirme Dokümantasyonu", + "req_id": "V8.1.3", + "req_description": "Uygulamanın dokümantasyonunun, kimlik doğrulama ve yetkilendirme ile ilgili güvenlik kararlarının alınmasında kullanılan çevresel ve bağlamsal öznitelikleri (günün saati, kullanıcı konumu, IP adresi veya cihaz gibi) tanımladığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.1", + "section_name": "Yetkilendirme Dokümantasyonu", + "req_id": "V8.1.4", + "req_description": "Kimlik doğrulama ve yetkilendirme dokümantasyonunun; işlev düzeyinde, veriye özel ve alan düzeyinde yetkilendirmenin yanı sıra çevresel ve bağlamsal faktörlerin karar almada nasıl kullanıldığını tanımladığı doğrulanmalıdır. Bu, değerlendirilen öznitelikleri, risk eşiklerini ve alınan aksiyonları (ör. izin ver, doğrulama iste, reddet, step-up kimlik doğrulama) içermelidir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.2", + "section_name": "Genel Yetkilendirme Tasarımı", + "req_id": "V8.2.1", + "req_description": "Uygulamanın, işlev düzeyindeki erişimin yalnızca açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.2", + "section_name": "Genel Yetkilendirme Tasarımı", + "req_id": "V8.2.2", + "req_description": "Uygulamanın, veriye özel erişimin yalnızca belirli veri öğelerine açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, doğrudan nesne referansı güvenlik açıkları (IDOR) ve bozuk nesne düzeyinde yetkilendirme (BOLA) risklerini azaltır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.2", + "section_name": "Genel Yetkilendirme Tasarımı", + "req_id": "V8.2.3", + "req_description": "Uygulamanın, alan (field) düzeyindeki erişimin yalnızca belirli alanlara açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, bozuk nesne özelliği düzeyinde yetkilendirme (BOPLA) risklerini azaltır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.2", + "section_name": "Genel Yetkilendirme Tasarımı", + "req_id": "V8.2.4", + "req_description": "Tüketicinin çevresel ve bağlamsal özniteliklerine (ör. günün saati, konum, IP adresi veya cihaz) dayalı uyarlanabilir güvenlik kontrollerinin, uygulama dokümantasyonunda tanımlandığı şekilde, kimlik doğrulama ve yetkilendirme kararları için uygulandığı doğrulanmalıdır. Bu kontroller, tüketici yeni bir oturum başlatmaya çalışırken ve mevcut bir oturum sırasında uygulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.3", + "section_name": "İşlem Düzeyinde Yetkilendirme", + "req_id": "V8.3.1", + "req_description": "Uygulamanın yetkilendirme kurallarını güvenilir bir servis katmanında uyguladığı ve istemci taraflı JavaScript gibi güvenilmeyen tüketiciler tarafından değiştirilebilecek kontrollerle yetinmediği doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.3", + "section_name": "İşlem Düzeyinde Yetkilendirme", + "req_id": "V8.3.2", + "req_description": "Yetkilendirme kararlarının temelini oluşturan değerlerdeki değişikliklerin hemen uygulandığı doğrulanmalıdır. Değişikliklerin anında uygulanamadığı durumlarda (örneğin self-contained token içindeki verilere güveniliyorsa), tüketici artık yetkili olmadığı hâlde bir işlem gerçekleştirdiğinde uyarı verecek ve değişikliği geri alacak önlemler uygulanmalıdır. Bu alternatifin bilgi sızıntısını önlemeyeceği unutulmamalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.3", + "section_name": "İşlem Düzeyinde Yetkilendirme", + "req_id": "V8.3.3", + "req_description": "Bir nesneye erişimin, herhangi bir aracı veya onun adına hareket eden bir servis yerine yalnızca erişimi başlatan öznenin (ör. tüketici) izinlerine dayandığı doğrulanmalıdır. Örneğin, bir tüketici kimlik doğrulama için bir self-contained token kullanarak bir web servis çağırırsa ve bu servis başka bir servisten veri talep ederse, ikinci servis izin kararlarını verirken birinci servisin makine-makine token'ı yerine tüketicinin token'ını kullanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.4", + "section_name": "Diğer Yetkilendirme Hususları", + "req_id": "V8.4.1", + "req_description": "Multi-tenant uygulamaların, tüketici işlemlerinin izinli olmadıkları tenant'lar üzerinde asla etkili olmamasını sağlamak için tenant'lar arası kontroller kullandığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.4", + "section_name": "Diğer Yetkilendirme Hususları", + "req_id": "V8.4.2", + "req_description": "Yönetici arayüzlerine erişimin, sürekli tüketici kimlik doğrulaması, cihaz güvenlik durumu değerlendirmesi ve bağlamsal risk analizi dahil olmak üzere çok katmanlı güvenlik içerdiği doğrulanmalıdır. Yetkilendirme için yalnızca ağ konumu veya güvenilir uç noktalar yeterli olmamalıdır; ancak bu tür faktörler yetkisiz erişim olasılığını azaltabilir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", + "section_id": "V9.1", + "section_name": "Token Kaynağı ve Bütünlüğü", + "req_id": "V9.1.1", + "req_description": "Self-contained token'ların içerikleri kabul edilmeden önce, oynama (tampering) saldırılarına karşı dijital imza veya MAC ile doğrulama yapıldığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", + "section_id": "V9.1", + "section_name": "Token Kaynağı ve Bütünlüğü", + "req_id": "V9.1.2", + "req_description": "Belirli bir bağlam için yalnızca bir allowlist üzerinde bulunan algoritmaların self-contained token oluşturmak ve doğrulamak için kullanılabildiği doğrulanmalıdır. Bu allowlist, yalnızca simetrik ya da yalnızca asimetrik algoritmaları içermeli ve kesinlikle 'None' algoritmasını içermemelidir. Hem simetrik hem de asimetrik algoritmalar desteklenmek zorundaysa, anahtar karışıklığını (key confusion) önlemek için ek kontroller uygulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", + "section_id": "V9.1", + "section_name": "Token Kaynağı ve Bütünlüğü", + "req_id": "V9.1.3", + "req_description": "Self-contained token'ları doğrulamak için kullanılan anahtar malzemesinin, token issuer için önceden yapılandırılmış güvenilir kaynaklardan alındığı doğrulanmalıdır. Bu, saldırganların güvenilmeyen kaynak ve anahtarları belirtmesini engeller. JWT ve diğer JWS yapılarında 'jku', 'x5u' ve 'jwk' gibi header'lar güvenilir kaynaklardan oluşan bir allowlist'e göre doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", + "section_id": "V9.2", + "section_name": "Token İçeriği", + "req_id": "V9.2.1", + "req_description": "Token verisinde bir geçerlilik zaman aralığı (validity time span) varsa, yalnızca doğrulama zamanı bu zaman aralığı içerisindeyse token ve içeriği kabul edilmelidir. Örneğin, JWT'ler için 'nbf' ve 'exp' claim'leri doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", + "section_id": "V9.2", + "section_name": "Token İçeriği", + "req_id": "V9.2.2", + "req_description": "Token'ı alan hizmetin, token içeriğini kabul etmeden önce bu token'ın doğru türde olduğunu ve sunulma amacına uygun olduğunu doğruladığı teyit edilmelidir. Örneğin, yalnızca erişim token'ları yetkilendirme kararları için, yalnızca ID Token'lar kullanıcı kimlik doğrulamasını kanıtlamak için kullanılabilir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", + "section_id": "V9.2", + "section_name": "Token İçeriği", + "req_id": "V9.2.3", + "req_description": "Hizmetin yalnızca kendisiyle kullanılması amaçlanan (audience) token'ları kabul ettiği doğrulanmalıdır. JWT'lerde bu, 'aud' claim'inin hizmet içinde tanımlı bir allowlist ile doğrulanması yoluyla sağlanabilir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", + "section_id": "V9.2", + "section_name": "Token İçeriği", + "req_id": "V9.2.4", + "req_description": "Eğer bir token issuer, farklı audience'lara token oluşturmak için aynı private key'i kullanıyorsa, oluşturulan token'ların hedef audience'ları benzersiz şekilde tanımlayan bir audience kısıtlaması içerdiği doğrulanmalıdır. Bu, bir token'ın farklı bir audience ile yeniden kullanılmasını önler. Audience tanımlayıcısı dinamik olarak sağlanıyorsa, token issuer bu audience'ları doğrulamalı ve audience taklitlerinin (impersonation) önüne geçmelidir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.1", + "section_name": "Genel OAuth ve OIDC Güvenliği", + "req_id": "V10.1.1", + "req_description": "Token'ların yalnızca kesinlikle ihtiyaç duyan bileşenlere gönderildiği doğrulanmalıdır. Örneğin, tarayıcı tabanlı JavaScript uygulamaları için bir backend-for-frontend modeli kullanıldığında, access ve refresh token'lara yalnızca backend'in erişebilmesi gerekir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.1", + "section_name": "Genel OAuth ve OIDC Güvenliği", + "req_id": "V10.1.2", + "req_description": "Authorization server'dan gelen değerler (örneğin authorization code veya ID Token gibi) yalnızca aynı user agent oturumu ve işlemi tarafından başlatılmış bir yetkilendirme akışının sonucuysa kabul edildiği doğrulanmalıdır. Bu, client tarafından oluşturulan secret’ların 'proof key for code exchange' (PKCE) ‘code_verifier’, ‘state’ veya OIDC ‘nonce’ gibi tahmin edilemez, işleme özgü ve hem client’a hem de işlem başlatılan user agent oturumuna güvenli bir şekilde bağlı olmasını gerektirir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.2", + "section_name": "OAuth İstemcisi", + "req_id": "V10.2.1", + "req_description": "Code flow kullanılıyorsa, OAuth client’ın token taleplerini tetikleyen CSRF saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Bu genellikle PKCE kullanılarak veya authorization isteğinde gönderilen ‘state’ parametresinin kontrolü ile sağlanır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.2", + "section_name": "OAuth İstemcisi", + "req_id": "V10.2.2", + "req_description": "OAuth istemcisi birden fazla AS ile etkileşime girebiliyorsa, mix-up saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Örneğin, authorization server’ın 'iss' parametresini döndürmesi zorunlu kılınabilir ve bu parametrenin hem authorization yanıtında hem de token yanıtında doğrulanması gerekir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.2", + "section_name": "OAuth İstemcisi", + "req_id": "V10.2.3", + "req_description": "OAuth istemcisinin authorization server’a yaptığı taleplerde yalnızca gerekli scope’ları (veya diğer yetkilendirme parametrelerini) talep ettiği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.3", + "section_name": "OAuth Kaynak Sunucusu (RS)", + "req_id": "V10.3.1", + "req_description": "RS'nin yalnızca bu servisle kullanılmak üzere tasarlanmış access token’ları kabul ettiği doğrulanmalıdır (audience kontrolü). Audience bilgisi yapılandırılmış token’larda (örneğin JWT içindeki ‘aud’ claim’i) yer alabilir veya token introspection endpoint aracılığıyla kontrol edilebilir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.3", + "section_name": "OAuth Kaynak Sunucusu (RS)", + "req_id": "V10.3.2", + "req_description": "RS'nin, access token’dan gelen claim’lere dayanarak yetki devri tanımına uygun şekilde yetkilendirme kararları uyguladığı doğrulanmalıdır. ‘sub’, ‘scope’ ve ‘authorization_details’ gibi claim’ler varsa, bu kararın parçası olmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.3", + "section_name": "OAuth Kaynak Sunucusu (RS)", + "req_id": "V10.3.3", + "req_description": "Erişim kontrolü kararında, access token’dan (JWT veya ilgili token introspection yanıtı) benzersiz bir kullanıcının tanımlanması gerekiyorsa, RS'nin başka kullanıcılara devredilemeyecek claim’ler ile kullanıcıyı tanımladığı doğrulanmalıdır. Genellikle bu, ‘iss’ ve ‘sub’ claim’lerinin birlikte kullanılması anlamına gelir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.3", + "section_name": "OAuth Kaynak Sunucusu (RS)", + "req_id": "V10.3.4", + "req_description": "RS'nin belirli bir kimlik doğrulama gücü, yöntemi veya güncelliği (recentness) gerektirmesi durumunda, sunulan access token’ın bu kısıtlamaları karşıladığını doğruladığı, örneğin, OIDC ‘acr’, ‘amr’ ve ‘auth_time’ claim’leri kullanılarak doğrulanmalıdır. ", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.3", + "section_name": "OAuth Kaynak Sunucusu (RS)", + "req_id": "V10.3.5", + "req_description": "RS'nin, (yetkisiz taraflarca) çalınmış veya tekrar edilen access token’ların kullanımını önlemek için sender-constrained access token’lar kullandığı doğrulanmalıdır. Bu, OAuth 2 için Mutual TLS veya OAuth 2 Demonstration of Proof of Possession (DPoP) ile sağlanabilir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.1", + "req_description": "AS'nin, istemciye özel önceden kaydedilmiş URI’lerden oluşan bir allowlist kullanarak redirect URI’leri tam dize karşılaştırması ile doğruladığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.2", + "req_description": "AS'nin, \"authorization response\" içinde \"authorization code\" döndürdüğü durumlarda, bu kodun yalnızca bir kez kullanılabildiği doğrulanmalıdır. Daha önce access token vermek için kullanılmış bir authorization code ile yapılan ikinci geçerli token isteği reddedilmeli ve ilgili tüm token’lar iptal edilmelidir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.3", + "req_description": "Authorization code’un kısa ömürlü olduğu doğrulanmalıdır. L1 ve L2 uygulamalar için maksimum yaşam süresi 10 dakika, L3 uygulamalar için 1 dakikadır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.4", + "req_description": "Belirli bir istemci için AS'nin yalnızca o istemcinin ihtiyaç duyduğu grant türlerine izin verdiği doğrulanmalıdır. \"Token\" (Implicit flow) ve \"password\" (Resource Owner Password Credentials flow) grant türlerinin artık kullanılmaması gerekir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.5", + "req_description": "AS'nin, açık istemciler için refresh token replay saldırılarını azalttığı doğrulanmalıdır. Tercihen sender-constrained refresh token’lar (DPoP veya mutual TLS ile certificate-bound access token’lar) kullanılmalıdır. L1 ve L2 uygulamalar için refresh token rotation kullanılabilir. Rotation kullanılıyorsa, AS refresh token’ı kullanım sonrası geçersiz kılmalı ve geçersiz bir refresh token sunulması durumunda o yetkilendirme ile ilişkili tüm refresh token’ları iptal etmelidir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.6", + "req_description": "Code grant kullanılıyorsa, AS'nin authorization code interception saldırılarına karşı koruma sağladığı doğrulanmalıdır. Yetkilendirme isteğinde geçerli bir \"code_challenge\" değeri zorunlu olmalı ve \"code_challenge_method\" olarak \"plain\" kabul edilmemelidir. Token isteğinde ise \"code_verifier\" parametresi doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.7", + "req_description": "AS'nin, kimlik doğrulaması yapılmamış dinamik istemci kaydını desteklemesi durumunda, kötü niyetli istemci uygulamalarına karşı riskleri azalttığı doğrulanmalıdır. Kayıtlı URI’ler gibi client metadata’sı doğrulanmalı, kullanıcı onayı alınmalı ve güvenilmeyen bir client uygulamasıyla yapılan yetkilendirme isteği işlenmeden önce kullanıcı uyarılmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.8", + "req_description": "Refresh token’ların, sliding expiration kullanılsa bile mutlak bir sona erme süresine sahip olduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.9", + "req_description": "Yetkili bir kullanıcı tarafından AS kullanıcı arayüzü üzerinden refresh token’ların ve reference access token’ların iptal edilebildiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.10", + "req_description": "Gizli istemcilerin token istekleri, pushed authorization request (PAR) ve token iptal istekleri gibi server’a yapılan backchannel isteklerinde kimliğinin kontrol edildiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.11", + "req_description": "AS yapılandırmasının, OAuth istemcisine yalnızca gerekli scope’ları atadığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.12", + "req_description": "Belirli bir client için, authorization server’ın yalnızca client’ın ihtiyaç duyduğu 'response_mode' değerine izin verdiği doğrulanmalıdır. Örneğin, bu değer ya beklenenlerle karşılaştırılarak doğrulanmalı ya da PAR veya JAR kullanılmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.13", + "req_description": "\"Code\" grant türünün daima pushed authorization request (PAR) ile birlikte kullanıldığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.14", + "req_description": "AS'nin yalnızca sender-constrained (Proof-of-Possession) access token’lar ürettiği doğrulanmalıdır. Bu, mutual TLS ile certificate-bound access token ya da DPoP ile DPoP-bound access token olabilir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.15", + "req_description": "Sunucu taraflı istemciler için (kullanıcı cihazında çalışmayan), AS'nin \"authorization_details\" parametresinin istemci backend'i tarafından sağlandığını ve kullanıcı tarafından değiştirilmediğini doğruladığı, örneğin pushed authorization request (PAR) or JWT-secured Authorization Request (JAR) zorunlu kılınarak doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.16", + "req_description": "Bir istemci gizli ise, AS'nin güçlü istemci kimlik doğrulama yöntemlerini zorunlu kıldığı doğrulanmalıdır. Bu yöntemler, public-key cryptography’ye dayalı ve replay saldırılarına karşı dayanıklı olmalı, örneğin mutual TLS (\"tls_client_auth\", \"self_signed_tls_client_auth\") veya private key JWT (\"private_key_jwt\") gibi.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.5", + "section_name": "OIDC İstemcisi", + "req_id": "V10.5.1", + "req_description": "İstemcinin (relying party olarak) ID Token replay saldırılarını azalttığı doğrulanmalıdır. Örneğin, ID Token’daki 'nonce' claim’inin, OpenID Provider’a gönderilen kimlik doğrulama isteğindeki 'nonce' değeriyle eşleştiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.5", + "section_name": "OIDC İstemcisi", + "req_id": "V10.5.2", + "req_description": "İstemcinin kullanıcıyı ID Token claim’lerinden (genellikle, başka kullanıcılarla yeniden atanamayan 'sub' claim’i) benzersiz şekilde tanımladığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.5", + "section_name": "OIDC İstemcisi", + "req_id": "V10.5.3", + "req_description": "İstemcinin, kötü niyetli bir AS'nin başka bir AS'yi taklit etmesini AS metadata’sı üzerinden reddettiği doğrulanmalıdır. AS metadata’sındaki issuer URL’si, istemci tarafından beklenen önceden yapılandırılmış issuer URL’siyle tam olarak eşleşmiyorsa, metadata reddedilmelidir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.5", + "section_name": "OIDC İstemcisi", + "req_id": "V10.5.4", + "req_description": "İstemcinin, ID Token’ın kendisi için (audience) kullanılması amaçlandığını doğruladığı doğrulanmalıdır. Bu, token’daki 'aud' claim’inin istemcinin 'client_id' değeriyle eşit olup olmadığının kontrol edilmesiyle yapılır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.5", + "section_name": "OIDC İstemcisi", + "req_id": "V10.5.5", + "req_description": "OIDC back-channel logout kullanıldığında, relying party’nin \"forced logout\" ve \"logout\" akışında \"cross-JWT confusion\" gibi saldırılara karşı koruma sağladığı doğrulanmalıdır. Client, logout token’ın 'logout+jwt' türünde olduğunu, 'event' claim’inin doğru üyeye sahip olduğunu ve 'nonce' claim’i içermediğini doğrulamalıdır. Ayrıca token için kısa bir sona erme süresi (örneğin 2 dakika) önerilir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.6", + "section_name": "OpenID Provider", + "req_id": "V10.6.1", + "req_description": "OpenID Provider’ın yalnızca 'code', 'ciba', 'id_token' veya 'id_token code' response mode değerlerine izin verdiği doğrulanmalıdır. 'code' değeri, 'id_token code' (OIDC Hybrid flow) yerine tercih edilmelidir. 'token' (Implicit flow) kullanılmamalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.6", + "section_name": "OpenID Provider", + "req_id": "V10.6.2", + "req_description": "OpenID Provider’ın forced logout yoluyla yapılan hizmet reddi saldırılarını önlediği doğrulanmalıdır. Bu, son kullanıcıdan açık onay alınarak veya varsa logout isteğinde (relying party tarafından başlatılan) bulunan parametrelerin, örneğin 'id_token_hint', doğrulanmasıyla yapılabilir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.7", + "section_name": "Onay (Consent) Yönetimi", + "req_id": "V10.7.1", + "req_description": "AS'nin her yetkilendirme isteği için kullanıcının onayını aldığı doğrulanmalıdır. İstemcinin kimliği garanti altına alınamıyorsa, AS daima kullanıcıdan açıkça onay istemelidir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.7", + "section_name": "Onay (Consent) Yönetimi", + "req_id": "V10.7.2", + "req_description": "AS'nin kullanıcıdan onay istediğinde, neye onay verildiğini açık ve yeterli şekilde gösterdiği doğrulanmalıdır. Uygun olduğunda bu bilgiler, istenen yetkilendirmelerin doğasını (genellikle scope, resource server, RAR gibi detaylara dayalı), yetkilendirilmiş uygulamanın kimliğini ve bu yetkilendirmelerin süresini içermelidir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.7", + "section_name": "Onay (Consent) Yönetimi", + "req_id": "V10.7.3", + "req_description": "Kullanıcının, AS üzerinden verdiği onayları görüntüleyebildiği, değiştirebildiği ve iptal edebildiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.1", + "section_name": "Kriptografik Envanter ve Dokümantasyon", + "req_id": "V11.1.1", + "req_description": "Kriptografik anahtarların yönetimi için belgelenmiş bir politika ve NIST SP 800-57 gibi bir anahtar yönetim standardını izleyen bir kriptografik anahtar yaşam döngüsü tanımlandığı doğrulanmalıdır. Bu, anahtarların aşırı miktarda paylaşılmadığını (örneğin, paylaşılan sırlar için ikiden fazla tarafla veya özel anahtarlar için birden fazla tarafla) garanti altına almalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.1", + "section_name": "Kriptografik Envanter ve Dokümantasyon", + "req_id": "V11.1.2", + "req_description": "Tüm kriptografik anahtarlar, algoritmalar ve uygulama tarafından kullanılan sertifikaları içeren bir kriptografik envanterin oluşturulduğu, sürdürüldüğü ve düzenli olarak güncellendiği doğrulanmalıdır. Bu envanter ayrıca, sistemde anahtarların nerede kullanılabileceğini ve kullanılamayacağını, ve hangi veri türlerinin bu anahtarlarla korunup korunamayacağını da belgelemelidir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.1", + "section_name": "Kriptografik Envanter ve Dokümantasyon", + "req_id": "V11.1.3", + "req_description": "Sistem içerisinde şifreleme, özetleme ve imzalama işlemleri dahil olmak üzere kriptografi kullanımının tüm örneklerini tespit etmek için kriptografik keşif mekanizmalarının kullanıldığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.1", + "section_name": "Kriptografik Envanter ve Dokümantasyon", + "req_id": "V11.1.4", + "req_description": "Kriptografik bir envanterin sürdürüldüğü doğrulanmalıdır. Bu envanter, gelecekteki tehditlere karşı tepki verebilmek amacıyla post-kuantum kriptografiye geçiş yolunu belirten belgelenmiş bir plan içermelidir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.2", + "section_name": "Güvenli Kriptografi Uygulaması", + "req_id": "V11.2.1", + "req_description": "Kriptografik işlemler için sektör tarafından doğrulanmış uygulamaların (kütüphaneler ve donanım hızlandırmalı uygulamalar dahil) kullanıldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.2", + "section_name": "Güvenli Kriptografi Uygulaması", + "req_id": "V11.2.2", + "req_description": "Uygulamanın, rastgele sayı üreticileri, kimliği doğrulanmış şifreleme, MAC veya özetleme algoritmaları, anahtar uzunlukları, turlar, şifreler ve modların herhangi bir zamanda yeniden yapılandırılabilir, yükseltilebilir veya değiştirilebilir olacağı şekilde kripto çevikliği (crypto agility) ile tasarlandığı doğrulanmalıdır. Aynı şekilde, anahtarların ve parolaların değiştirilebilmesi ve verilerin yeniden şifrelenebilmesi mümkün olmalıdır. Bu, onaylanmış PQC şemalarının yüksek güvenlikli uygulamaları yaygın olarak kullanılabilir hale geldiğinde sorunsuz geçişe olanak tanır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.2", + "section_name": "Güvenli Kriptografi Uygulaması", + "req_id": "V11.2.3", + "req_description": "Tüm kriptografik ilkeliklerin, algoritma, anahtar boyutu ve yapılandırmaya göre minimum 128 bit güvenlik sağladığı doğrulanmalıdır. Örneğin, 256-bit ECC anahtarı yaklaşık 128 bit güvenlik sağlarken, RSA için aynı güvenliği elde etmek 3072-bit anahtar gerektirir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.2", + "section_name": "Güvenli Kriptografi Uygulaması", + "req_id": "V11.2.4", + "req_description": "Tüm kriptografik işlemlerin sabit süreli (constant-time) olduğu, karşılaştırmalarda, hesaplamalarda veya geri dönüşlerde kısa devre (short-circuit) işlemleri yapılmadığı doğrulanmalıdır; bu, bilgi sızıntısını önlemek için gereklidir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.2", + "section_name": "Güvenli Kriptografi Uygulaması", + "req_id": "V11.2.5", + "req_description": "Tüm kriptografik modüllerin güvenli şekilde hata verdiği ve hataların, padding oracle saldırıları gibi zafiyetleri mümkün kılmayacak şekilde ele alındığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.3", + "section_name": "Şifreleme Algoritmaları", + "req_id": "V11.3.1", + "req_description": "Güvensiz blok modlarının (örneğin, ECB) ve zayıf doldurma (padding) şemalarının (örneğin, PKCS#1 v1.5) kullanılmadığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.3", + "section_name": "Şifreleme Algoritmaları", + "req_id": "V11.3.2", + "req_description": "Yalnızca AES ile GCM gibi onaylı şifreleme algoritmalarının ve modlarının kullanıldığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.3", + "section_name": "Şifreleme Algoritmaları", + "req_id": "V11.3.3", + "req_description": "Şifrelenmiş verilerin yetkisiz değişikliklere karşı korunduğu doğrulanmalıdır. Tercihen bu koruma, onaylı bir kimliği doğrulanmış şifreleme yöntemi kullanılarak ya da onaylı bir şifreleme yöntemi ile onaylı bir MAC algoritmasının kombinasyonu ile sağlanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.3", + "section_name": "Şifreleme Algoritmaları", + "req_id": "V11.3.4", + "req_description": "Sayılar, başlatma vektörleri (IV) ve diğer tek kullanımlık değerlerin, aynı şifreleme anahtarı ve veri öğesi çifti için birden fazla kez kullanılmadığı doğrulanmalıdır. Oluşturma yöntemi kullanılan algoritmaya uygun olmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.3", + "section_name": "Şifreleme Algoritmaları", + "req_id": "V11.3.5", + "req_description": "Şifreleme algoritması ve MAC algoritması kombinasyonlarının \"encrypt-then-MAC\" modunda çalıştığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.4", + "section_name": "Hashing ve Hash Tabanlı Fonksiyonlar", + "req_id": "V11.4.1", + "req_description": "Dijital imzalar, HMAC, KDF ve rastgele bit üretimi gibi genel kriptografik kullanım senaryolarında yalnızca onaylı hash fonksiyonlarının kullanıldığı doğrulanmalıdır. MD5 gibi yasaklı hash fonksiyonları hiçbir kriptografik amaçla kullanılmamalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.4", + "section_name": "Hashing ve Hash Tabanlı Fonksiyonlar", + "req_id": "V11.4.2", + "req_description": "Parolaların, onaylı, hesaplama açısından yoğun ve mevcut rehberliğe göre yapılandırılmış bir anahtar türetme fonksiyonu (diğer adıyla parola hash'leme fonksiyonu) kullanılarak saklandığı doğrulanmalıdır. Ayarlar, güvenlik ve performans dengesini sağlayarak kaba kuvvet saldırılarını zorlaştırmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.4", + "section_name": "Hashing ve Hash Tabanlı Fonksiyonlar", + "req_id": "V11.4.3", + "req_description": "Dijital imzalarda kullanılan hash fonksiyonlarının, veri bütünlüğü ve kimlik doğrulama amacıyla kullanıldığında çakışmaya karşı dayanıklı ve yeterli bit uzunluğuna sahip olduğu doğrulanmalıdır. Çakışma dayanıklılığı gerekiyorsa çıktı uzunluğu en az 256 bit olmalıdır. Sadece ikinci ön-görüntü (2nd pre-iamge) saldırılarına karşı dayanıklılık gerekiyorsa çıktı uzunluğu en az 128 bit olmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.4", + "section_name": "Hashing ve Hash Tabanlı Fonksiyonlar", + "req_id": "V11.4.4", + "req_description": "Parolalardan gizli anahtarlar türetilirken, onaylı anahtar türetme fonksiyonlarının anahtar uzatma (key stretching) parametreleriyle birlikte kullanıldığı doğrulanmalıdır. Bu parametreler, kaba kuvvet saldırılarını önleyecek şekilde güvenlik ve performans dengesine sahip olmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.5", + "section_name": "Rastgele Değerler", + "req_id": "V11.5.1", + "req_description": "Tahmin edilemez olması amaçlanan tüm rastgele sayıların ve dizelerin, CSPRNG ile oluşturulduğu ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. UUID'lerin bu koşulu dikkate almadığını unutmayın.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.5", + "section_name": "Rastgele Değerler", + "req_id": "V11.5.2", + "req_description": "Kullanılan rastgele sayı üretim mekanizmasının, yoğun talep altında dahi güvenli çalışacak şekilde tasarlandığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.6", + "section_name": "Açık Anahtar (Public Key) Kriptografisi", + "req_id": "V11.6.1", + "req_description": "Anahtar üretimi, tohumlama (seeding) ve dijital imza üretimi ve doğrulama için yalnızca onaylı kriptografik algoritmalar ve çalışma modlarının kullanıldığı doğrulanmalıdır. Anahtar üretim algoritmaları, bilinen saldırılara karşı savunmasız anahtarlar üretmemelidir. Örneğin, Fermat çarpanlama yöntemine karşı savunmasız RSA anahtarları oluşturulmamalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.6", + "section_name": "Açık Anahtar (Public Key) Kriptografisi", + "req_id": "V11.6.2", + "req_description": "Anahtar değişimi için yalnızca onaylı kriptografik algoritmaların kullanıldığı doğrulanmalıdır (örneğin Diffie-Hellman). Kullanılan parametrelerin güvenli olması gerektiğine dikkat edilmelidir. Bu, anahtar kurulum sürecine yönelik saldırıları önleyecek ve araya girme (adversary-in-the-middle) ya da kriptografik kırılmaları engelleyecektir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.7", + "section_name": "Kullanım Halindeki Verilerin Kriptografisi", + "req_id": "V11.7.1", + "req_description": "Hassas verilerin kullanım sırasında korunmasını sağlamak amacıyla, yetkisiz kullanıcıların veya süreçlerin bu verilere erişmesini engelleyen tam bellek şifrelemesinin kullanıldığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.7", + "section_name": "Kullanım Halindeki Verilerin Kriptografisi", + "req_id": "V11.7.2", + "req_description": "Veri asgariyetinin sağlandığı, yani işleme sırasında mümkün olan en az miktarda verinin ortaya çıktığı ve verilerin kullanımdan hemen sonra veya mümkün olan en kısa sürede şifrelendiği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.1", + "section_name": "Genel TLS Güvenlik Rehberi", + "req_id": "V12.1.1", + "req_description": "Yalnızca TLS protokolünün en güncel ve önerilen sürümlerinin (örneğin TLS 1.2 ve TLS 1.3) etkinleştirildiği ve en son sürümün varsayılan olarak tercih edildiği doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.1", + "section_name": "Genel TLS Güvenlik Rehberi", + "req_id": "V12.1.2", + "req_description": "Yalnızca önerilen şifre takımlarının (cipher suite) etkinleştirildiği ve en güçlü şifre takımlarının tercih edildiği doğrulanmalıdır. Seviye 3 (L3) uygulamalar yalnızca ileri gizlilik (forward secrecy) sağlayan şifre takımlarını desteklemelidir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.1", + "section_name": "Genel TLS Güvenlik Rehberi", + "req_id": "V12.1.3", + "req_description": "Uygulamanın, mTLS istemci sertifikalarını kimlik doğrulama veya yetkilendirme amacıyla kullanmadan önce bu sertifikaların güvendiği sertifikalar arasında olduğunu doğruladığı kontrol edilmelidir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.1", + "section_name": "Genel TLS Güvenlik Rehberi", + "req_id": "V12.1.4", + "req_description": "Online Certificate Status Protocol (OCSP) Stapling gibi geçerli bir sertifika iptal kontrolü yönteminin etkinleştirildiği ve yapılandırıldığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.1", + "section_name": "Genel TLS Güvenlik Rehberi", + "req_id": "V12.1.5", + "req_description": "TLS el sıkışma (handshake) sürecinde Server Name Indication (SNI) gibi hassas meta verilerin ifşa edilmesini önlemek için, uygulamanın TLS yapılandırmasında Encrypted Client Hello (ECH) özelliğinin etkinleştirildiği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.2", + "section_name": "Dışa Açık Hizmetlerle HTTPS İletişimi", + "req_id": "V12.2.1", + "req_description": "İstemci ile dışa açık, HTTP tabanlı hizmetler arasındaki tüm bağlantılarda TLS kullanıldığı ve bu bağlantıların güvensiz ya da şifrelenmemiş iletişime geri dönmediği doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.2", + "section_name": "Dışa Açık Hizmetlerle HTTPS İletişimi", + "req_id": "V12.2.2", + "req_description": "Dışa açık hizmetlerin herkese açık olarak güvenilen TLS sertifikaları kullandığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.3", + "section_name": "Genel Servisler Arası İletişim Güvenliği", + "req_id": "V12.3.1", + "req_description": "Uygulamaya gelen ve uygulamadan çıkan tüm bağlantılarda izleme sistemleri, yönetim araçları, uzaktan erişim ve SSH, ara yazılımlar, veritabanları, ana sistemler (mainframe), iş ortağı sistemleri ya da dış API'ler dahil olmak üzere TLS gibi şifreli bir protokolün kullanıldığı ve güvensiz ya da şifrelenmemiş protokollere geri dönülmediği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.3", + "section_name": "Genel Servisler Arası İletişim Güvenliği", + "req_id": "V12.3.2", + "req_description": "TLS istemcilerinin bir TLS sunucusu ile iletişime geçmeden önce alınan sertifikaları doğruladığı kontrol edilmelidir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.3", + "section_name": "Genel Servisler Arası İletişim Güvenliği", + "req_id": "V12.3.3", + "req_description": "Uygulama içindeki HTTP tabanlı iç hizmetler arasında gerçekleşen tüm bağlantılarda TLS ya da uygun başka bir aktarım şifreleme mekanizmasının kullanıldığı ve güvensiz ya da şifrelenmemiş iletişime geri dönülmediği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.3", + "section_name": "Genel Servisler Arası İletişim Güvenliği", + "req_id": "V12.3.4", + "req_description": "İç hizmetler arasındaki TLS bağlantılarında güvenilir sertifikaların kullanıldığı doğrulanmalıdır. İç sistemlerde oluşturulmuş ya da kendinden imzalı (self-signed) sertifikalar kullanılıyorsa, bu sertifikalara güvenen hizmetlerin yalnızca belirli dahili sertifika otoritelerine (CA) ve belirli kendinden imzalı sertifikalara güvenecek şekilde yapılandırıldıkları doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.3", + "section_name": "Genel Servisler Arası İletişim Güvenliği", + "req_id": "V12.3.5", + "req_description": "Sistem içindeki hizmetlerin birbiriyle iletişim kurarken her bir uç noktanın kimliğini doğrulamak için güçlü kimlik doğrulama yöntemlerinin kullanıldığı doğrulanmalıdır. Bu yöntemler arasında, açık anahtar altyapısı (public-key infrastructure) kullanan ve tekrar oynatma saldırılarına karşı dayanıklı olan TLS istemci kimlik doğrulaması gibi yöntemler yer almalıdır. Mikroservis mimarilerinde, sertifika yönetimini basitleştirmek ve güvenliği artırmak amacıyla bir servis ağı (service mesh) kullanılması değerlendirilmelidir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.1", + "section_name": "Konfigürasyon Dokümantasyonu", + "req_id": "V13.1.1", + "req_description": "Uygulamanın tüm iletişim ihtiyaçlarının dokümante edildiği doğrulanmalıdır. Buna, uygulamanın bağımlı olduğu dış hizmetler ve son kullanıcının uygulamanın bağlantı kurmasını sağlayabileceği dış konumlar da dahil olmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.1", + "section_name": "Konfigürasyon Dokümantasyonu", + "req_id": "V13.1.2", + "req_description": "Uygulamanın kullandığı her bir hizmet için, dokümantasyonda eşzamanlı bağlantı sayısı (örn. bağlantı havuzu limitleri) ve bu sınır aşıldığında uygulamanın davranışı, geri dönüş veya kurtarma mekanizmaları da dahil olmak üzere hizmet reddi koşullarını önlemek için tanımlandığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.1", + "section_name": "Konfigürasyon Dokümantasyonu", + "req_id": "V13.1.3", + "req_description": "Uygulamanın, kullandığı her bir dış sistem veya hizmet (örn. veritabanları, dosya tanıtıcıları, iş parçacıkları, HTTP bağlantıları) için kaynak yönetimi stratejilerini tanımladığı doğrulanmalıdır. Bu stratejiler, kaynak serbest bırakma prosedürlerini, zaman aşımı ayarlarını, hata durumlarını ve tekrar deneme mantığı uygulanmışsa sınırları, gecikmeleri ve geri çekilme (back-off) algoritmalarını içermelidir. Senkron HTTP istek–yanıt işlemleri için kısa zaman aşımı süreleri zorunlu tutulmalı ve tekrar eden denemeler devre dışı bırakılmalı ya da sıkı şekilde sınırlandırılmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.1", + "section_name": "Konfigürasyon Dokümantasyonu", + "req_id": "V13.1.4", + "req_description": "Uygulamanın, güvenlik açısından kritik olan gizli verileri tanımladığı ve kuruluşun tehdit modeli ve iş ihtiyaçlarına göre bu verilerin döndürülme (rotation) zamanlamasının belgelendiği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.2", + "section_name": "Backend İletişim Konfigürasyonu", + "req_id": "V13.2.1", + "req_description": "Uygulamanın, standart kullanıcı oturum mekanizmasını desteklemeyen backend bileşenleri (örneğin API'ler, ara katmanlar, veri katmanları) arasında gerçekleşen iletişimlerin kimlik doğrulamasıyla korunduğu doğrulanmalıdır. Kimlik doğrulama; bireysel hizmet hesapları, kısa ömürlü token'lar ya da sertifika tabanlı kimlik doğrulama ile yapılmalıdır ve parola, API anahtarı ya da ayrıcalıklı erişime sahip paylaşımlı hesaplar gibi sabit kimlik bilgileri kullanılmamalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.2", + "section_name": "Backend İletişim Konfigürasyonu", + "req_id": "V13.2.2", + "req_description": "Uygulamanın backend bileşenleri arasında (yerel hizmetler, işletim sistemi hizmetleri, API'ler, ara katmanlar ve veri katmanları dahil) gerçekleştirilen iletişimlerin, yalnızca gerekli en az ayrıcalığa sahip hesaplarla yapıldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.2", + "section_name": "Backend İletişim Konfigürasyonu", + "req_id": "V13.2.3", + "req_description": "Bir hizmet kimlik doğrulaması için bir kimlik bilgisi kullanılması gerekiyorsa, bu kimlik bilgisinin varsayılan bir değer (örneğin root/root veya admin/admin) olmadığının doğrulanması gereklidir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.2", + "section_name": "Backend İletişim Konfigürasyonu", + "req_id": "V13.2.4", + "req_description": "Uygulamanın iletişim kurmasına izin verilen dış kaynaklar ya da sistemlerin, bir allowlist (izinli liste) ile tanımlandığı doğrulanmalıdır. Bu liste, uygulama katmanında, web sunucusunda, güvenlik duvarında veya farklı katmanların birleşiminde uygulanabilir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.2", + "section_name": "Backend İletişim Konfigürasyonu", + "req_id": "V13.2.5", + "req_description": "Web veya uygulama sunucusunun, dış sistemlere veri veya dosya gönderimi veya yüklemesi yaparken sadece belirli kaynaklara izin verecek şekilde allowlist ile yapılandırıldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.2", + "section_name": "Backend İletişim Konfigürasyonu", + "req_id": "V13.2.6", + "req_description": "Uygulamanın farklı hizmetlere bağlantı kurduğu durumlarda, bu bağlantılar için belgelenmiş yapılandırmaları (örn. maksimum eşzamanlı bağlantı, bağlantı limiti aşıldığında davranış, zaman aşımı, tekrar deneme stratejileri) takip ettiğinin doğrulanması gereklidir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.3", + "section_name": "Gizli Bilgi Yönetimi", + "req_id": "V13.3.1", + "req_description": "Parolalar, anahtar materyalleri, veritabanı ve üçüncü parti sistemlerle entegrasyon bilgileri, zaman tabanlı token'lar için tohum (seed) bilgileri, dahili gizli veriler ve API anahtarları gibi backend sırlarının güvenli bir şekilde oluşturulması, saklanması, erişim denetiminin sağlanması ve imha edilmesi için bir gizli bilgi yönetim çözümünün (örneğin key vault) kullanıldığı doğrulanmalıdır. Bu gizli bilgiler uygulama kaynak koduna dahil edilmemeli ve yapı çıktılarında yer almamalıdır. Seviye 3 uygulamalar için donanım destekli bir çözüm (örneğin HSM) gereklidir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.3", + "section_name": "Gizli Bilgi Yönetimi", + "req_id": "V13.3.2", + "req_description": "Gizli bilgilere erişimin en az ayrıcalık prensibine uygun şekilde yapılandırıldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.3", + "section_name": "Gizli Bilgi Yönetimi", + "req_id": "V13.3.3", + "req_description": "Tüm kriptografik işlemlerin, anahtar materyallerinin güvenli bir şekilde yönetilmesi ve dışarıya sızmasının engellenmesi amacıyla, izole edilmiş bir güvenlik modülü (örneğin vault ya da donanım güvenlik modülü) aracılığıyla gerçekleştirildiği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.3", + "section_name": "Gizli Bilgi Yönetimi", + "req_id": "V13.3.4", + "req_description": "Uygulamanın belgelerinde belirtildiği şekilde gizli bilgilerin süresinin dolacak şekilde yapılandırıldığı ve düzenli olarak döndürüldüğü doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.4", + "section_name": "İstenmeyen Bilgi Sızıntısı", + "req_id": "V13.4.1", + "req_description": "Uygulamanın .git veya .svn klasörleri gibi kaynak kontrolüyle ilgili metadata içermeyecek şekilde deploy edildiğini ya da bu klasörlerin hem dış erişime hem de uygulama erişimine kapalı olduğu doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.4", + "section_name": "İstenmeyen Bilgi Sızıntısı", + "req_id": "V13.4.2", + "req_description": "Tüm bileşenler için üretim ortamlarında hata ayıklama (debug) modlarının devre dışı bırakıldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.4", + "section_name": "İstenmeyen Bilgi Sızıntısı", + "req_id": "V13.4.3", + "req_description": "Web sunucularının, açık şekilde istenmediği sürece dizin listelemesi (directory listing) özelliğini istemcilere sunmadığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.4", + "section_name": "İstenmeyen Bilgi Sızıntısı", + "req_id": "V13.4.4", + "req_description": "HTTP TRACE metodunun üretim ortamlarında desteklenmediği, böylece potansiyel bilgi sızıntılarının önlendiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.4", + "section_name": "İstenmeyen Bilgi Sızıntısı", + "req_id": "V13.4.5", + "req_description": "Belgeler (örneğin dahili API belgeleri) ve izleme uç noktalarının (monitoring endpoints) yalnızca açıkça belirtildiği durumlarda erişilebilir olduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.4", + "section_name": "İstenmeyen Bilgi Sızıntısı", + "req_id": "V13.4.6", + "req_description": "Uygulamanın arka uç bileşenlerinin ayrıntılı sürüm bilgilerini ifşa etmediği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.4", + "section_name": "İstenmeyen Bilgi Sızıntısı", + "req_id": "V13.4.7", + "req_description": "Web katmanının yalnızca belirli dosya uzantılarına sahip dosyaları sunacak şekilde yapılandırıldığı, bu sayede istem dışı bilgi, yapılandırma ya da kaynak kod sızıntılarının önlendiği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.1", + "section_name": "Veri Koruma Dokümantasyonu", + "req_id": "V14.1.1", + "req_description": "Uygulama tarafından oluşturulan ve işlenen tüm hassas verilerin tanımlanıp, koruma seviyelerine göre sınıflandırıldığından emin olun. Bu, yalnızca kodlanmış (örneğin Base64 stringleri ya da JWT içindeki düz metin yükler gibi) ve bu nedenle kolayca çözülebilir verileri de içermelidir. Koruma seviyeleri, uygulamanın uymakla yükümlü olduğu veri koruma ve gizlilik düzenlemeleri ile standartlarını dikkate almalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.1", + "section_name": "Veri Koruma Dokümantasyonu", + "req_id": "V14.1.2", + "req_description": "Tüm hassas veri koruma seviyeleri için belgelenmiş bir koruma gereksinimleri seti tanımlandığından emin olun. Bu gereksinimler genel şifreleme, bütünlük doğrulama, saklama süresi, verinin nasıl günlüğe kaydedileceği, günlüklerdeki hassas verilere erişim kontrolleri, veritabanı düzeyinde şifreleme, gizlilik ve gizliliği artırıcı teknolojiler ile diğer gizlilik gereksinimlerini kapsamalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.2", + "section_name": "Genel Veri Koruması", + "req_id": "V14.2.1", + "req_description": "Hassas verilerin yalnızca HTTP message body veya header alanlarında sunucuya gönderildiği ve URL ile sorgu parametrelerinin, API anahtarı veya session token’ı gibi hassas bilgiler içermediği doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.2", + "section_name": "Genel Veri Koruması", + "req_id": "V14.2.2", + "req_description": "Hassas verilerin, yük dengeleyiciler ve uygulama önbellekleri gibi sunucu bileşenlerinde önbelleğe alınmasının engellendiği veya kullanım sonrası bu verilerin güvenli biçimde temizlendiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.2", + "section_name": "Genel Veri Koruması", + "req_id": "V14.2.3", + "req_description": "Uygulama kontrolü dışında veri toplanmasını engellemek için, tanımlanmış hassas verilerin, kullanıcı izleyicileri gibi güvensiz taraflara gönderilmediği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.2", + "section_name": "Genel Veri Koruması", + "req_id": "V14.2.4", + "req_description": "Hassas verilere yönelik şifreleme, bütünlük doğrulama, veri saklama, loglama yöntemi, loglardaki erişim kontrolleri, gizlilik teknolojileri gibi kontrollerin, söz konusu verinin belgelenmiş koruma seviyesinde tanımlandığı şekilde uygulandığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.2", + "section_name": "Genel Veri Koruması", + "req_id": "V14.2.5", + "req_description": "Önbellekleme mekanizmalarının yalnızca belirli içerik türüne sahip yanıtları önbelleğe alacak şekilde yapılandırıldığı ve hassas, dinamik içeriklerin önbelleğe alınmadığı doğrulanmalıdır. Web sunucusu, mevcut olmayan bir dosya talebinde geçerli ama farklı bir dosya döndürmek yerine 404 veya 302 cevabı vermelidir. Bu, Web Cache Deception saldırılarını önlemeye yardımcı olur.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.2", + "section_name": "Genel Veri Koruması", + "req_id": "V14.2.6", + "req_description": "Uygulamanın yalnızca işlevsellik için gerekli olan asgari hassas veriyi döndürdüğü doğrulanmalıdır. Örneğin, kredi kartı numarasının yalnızca bazı rakamlarının döndürülmesi; tam numaranın döndürülmesi gerekiyorsa, kullanıcı arayüzünde gizlenmiş (maskelenmiş) şekilde sunulması gerekir, aksi kullanıcı özel olarak görüntülemek istemedikçe gösterilmemelidir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.2", + "section_name": "Genel Veri Koruması", + "req_id": "V14.2.7", + "req_description": "Hassas bilgilerin, veri saklama sınıflandırmasına tabi tutulduğu, geçerliliğini yitirmiş veya artık gerekli olmayan verilerin belirlenmiş bir zaman çizelgesiyle ya da gerektiğinde otomatik olarak silindiği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.2", + "section_name": "Genel Veri Koruması", + "req_id": "V14.2.8", + "req_description": "Kullanıcı tarafından yüklenen dosyaların meta verilerinden hassas bilgilerin çıkarıldığı veya bu bilgilerin yalnızca kullanıcıdan açık onay alındığında saklandığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.3", + "section_name": "İstemci Tarafı Veri Koruması", + "req_id": "V14.3.1", + "req_description": "Kimliği doğrulanmış verilerin, istemci veya oturum sonlandığında istemci depolamasından (örneğin tarayıcı DOM’undan) temizlendiği doğrulanmalıdır. 'Clear-Site-Data' HTTP response header bu konuda yardımcı olabilir ancak istemci tarafı, sunucu bağlantısı mevcut olmadığında da temizlik işlemini yapabiliyor olmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.3", + "section_name": "İstemci Tarafı Veri Koruması", + "req_id": "V14.3.2", + "req_description": "Uygulamanın, tarayıcılarda hassas verilerin önbelleğe alınmasını önlemek amacıyla yeterli anti-önbellekleme HTTP response header (örneğin Cache-Control: no-store) ayarladığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.3", + "section_name": "İstemci Tarafı Veri Koruması", + "req_id": "V14.3.3", + "req_description": "Tarayıcıda depolanan verilerin (örneğin localStorage, sessionStorage, IndexedDB veya çerezler) hassas veri içermediği, yalnızca session token’larının istisna olarak kabul edildiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.1", + "section_name": "Güvenli Kodlama ve Mimari Dokümantasyonu", + "req_id": "V15.1.1", + "req_description": "Güvenlik açığı içeren üçüncü taraf bileşen sürümleri ve genel olarak kütüphane güncellemeleri için, uygulama dokümantasyonunda risk bazlı düzeltme zamanlarının tanımlandığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.1", + "section_name": "Güvenli Kodlama ve Mimari Dokümantasyonu", + "req_id": "V15.1.2", + "req_description": "Yazılım bileşen listesi (Software Bill of Materials - SBOM) gibi bir envanterin tutulduğu, kullanılan tüm üçüncü taraf kütüphanelerin önceden tanımlanmış, güvenilir ve düzenli olarak güncellenen depolardan alındığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.1", + "section_name": "Güvenli Kodlama ve Mimari Dokümantasyonu", + "req_id": "V15.1.3", + "req_description": "Uygulama dokümantasyonunda zaman veya kaynak açısından yoğun işlevlerin tanımlandığı, bu işlevlerin aşırı kullanımı durumunda kullanılabilirlik kaybının nasıl önleneceği ve yanıt oluşturma süresinin istemci zaman aşımını aşmaması için hangi önlemlerin alındığı belirtilmelidir. Örnek savunmalar kuyruklama, eşzamansız işleme, kullanıcı başına ve uygulama genelinde paralel işlem sınırlarını içerebilir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.1", + "section_name": "Güvenli Kodlama ve Mimari Dokümantasyonu", + "req_id": "V15.1.4", + "req_description": "Uygulama dokümantasyonunda \"riskli bileşenler\" olarak değerlendirilen üçüncü taraf kütüphanelerin vurgulandığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.1", + "section_name": "Güvenli Kodlama ve Mimari Dokümantasyonu", + "req_id": "V15.1.5", + "req_description": "Uygulama dokümantasyonunda \"tehlikeli işlevsellik\" içeren uygulama bölümlerinin açıkça belirtildiği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.2", + "section_name": "Güvenlik Mimarisi ve Bağımlılıklar", + "req_id": "V15.2.1", + "req_description": "Uygulamanın yalnızca, belgelenmiş güncelleme ve düzeltme sürelerini aşmamış bileşenleri içerdiği doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.2", + "section_name": "Güvenlik Mimarisi ve Bağımlılıklar", + "req_id": "V15.2.2", + "req_description": "Uygulamanın, belgelenmiş güvenlik kararları ve stratejilere dayanarak, zaman veya kaynak açısından yoğun işlevlerin neden olabileceği kullanılabilirlik kaybına karşı savunmalar uyguladığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.2", + "section_name": "Güvenlik Mimarisi ve Bağımlılıklar", + "req_id": "V15.2.3", + "req_description": "Üretim ortamının yalnızca uygulamanın çalışması için gerekli işlevleri içerdiği ve test kodları, örnek kod parçaları veya geliştirme işlevleri gibi gereksiz işlevsellikleri açığa çıkarmadığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.2", + "section_name": "Güvenlik Mimarisi ve Bağımlılıklar", + "req_id": "V15.2.4", + "req_description": "Üçüncü taraf bileşenlerin ve bunların tüm transitif bağımlılıklarının beklenen depolardan (iç kaynaklı ya da harici) alındığı ve bağımlılık karışıklığı (dependency confusion) saldırılarına açık olmadığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.2", + "section_name": "Güvenlik Mimarisi ve Bağımlılıklar", + "req_id": "V15.2.5", + "req_description": "Uygulamanın, “tehlikeli işlevsellik” içeren veya “riskli bileşenler” kullanan bölümlerine ek korumalar uyguladığı doğrulanmalıdır. Bu korumalar sandbox, kapsülleme, konteynerleştirme veya ağ düzeyinde izolasyon gibi teknikler aracılığıyla, bir uygulama bölümünün ele geçirilmesi durumunda saldırganın diğer bölümlere sıçramasını geciktirmeyi veya engellemeyi amaçlamalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.3", + "section_name": "Savunmacı Kodlama", + "req_id": "V15.3.1", + "req_description": "Uygulamanın yalnızca gerekli alanların bir alt kümesini veri nesnesinden döndürdüğü doğrulanmalıdır. Örneğin, bazı alanlara kullanıcıların erişmemesi gerektiğinden tüm veri nesnesi döndürülmemelidir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.3", + "section_name": "Savunmacı Kodlama", + "req_id": "V15.3.2", + "req_description": "Uygulama backend'i harici URL’lere çağrı yaptığında, yalnızca amaçlanan işlevsellik söz konusuysa yönlendirmeleri takip edecek şekilde yapılandırıldığının doğrulanması gerekir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.3", + "section_name": "Savunmacı Kodlama", + "req_id": "V15.3.3", + "req_description": "Uygulamanın, kitlesel atama saldırılarına karşı, her bir controller ve eylem için izin verilen alanları sınırlandırarak savunmalar sağladığı doğrulanmalıdır. Örneğin, bir alan değeri, bu işlemde değiştirilmesi amaçlanmadıysa eklenememeli veya güncellenememelidir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.3", + "section_name": "Savunmacı Kodlama", + "req_id": "V15.3.4", + "req_description": "Tüm proxy ve ara katman bileşenlerinin kullanıcının orijinal IP adresini, uç kullanıcı tarafından değiştirilemeyecek güvenilir veri alanları kullanarak doğru şekilde ilettiği ve uygulamanın ve web sunucusunun bu doğru değeri, loglama ve hız sınırlama gibi güvenlik kararları için kullandığı doğrulanmalıdır. Ayrıca, orijinal IP adresinin bile dinamik IP'ler, VPN'ler veya kurumsal güvenlik duvarları nedeniyle güvenilir olmayabileceği dikkate alınmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.3", + "section_name": "Savunmacı Kodlama", + "req_id": "V15.3.5", + "req_description": "Uygulamanın değişkenlerin doğru türde olduğunu açıkça doğruladığı ve sıkı eşitlik ve karşılaştırma işlemleri kullandığı doğrulanmalıdır. Bu, değişken türüyle ilgili varsayımlardan kaynaklanan tür oynama (type juggling) veya tür karışıklığı (type confusion) güvenlik açıklarını önlemek içindir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.3", + "section_name": "Savunmacı Kodlama", + "req_id": "V15.3.6", + "req_description": "JavaScript kodunun prototip zehirleme (prototype pollution) saldırılarını önleyecek şekilde yazıldığı, örneğin, nesne literal’leri yerine Set() veya Map() gibi yapılar kullanıldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.3", + "section_name": "Savunmacı Kodlama", + "req_id": "V15.3.7", + "req_description": "Uygulamanın, özellikle framework'ün istek parametrelerinin kaynağı (sorgu dizgisi, gövde parametreleri, çerezler veya başlık alanları) arasında ayrım yapmadığı durumlarda, HTTP parametre kirliliği (HTTP parameter pollution) saldırılarına karşı savunmalar uyguladığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.4", + "section_name": "Güvenli Eş Zamanlılık (Concurrency)", + "req_id": "V15.4.1", + "req_description": "Çok iş parçacıklı kodda (örneğin cache'ler, dosyalar veya birden fazla iş parçacığı tarafından erişilen bellek içi nesneler gibi) paylaşılan nesnelere yalnızca thread-safe (iş parçacığı güvenli) türler ve kilitleme (lock) veya semaphore gibi senkronizasyon mekanizmaları kullanılarak erişildiği doğrulanmalıdır. Bu, yarış durumlarını ve veri bozulmasını önlemeye yöneliktir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.4", + "section_name": "Güvenli Eş Zamanlılık (Concurrency)", + "req_id": "V15.4.2", + "req_description": "Bir kaynağın durumu üzerindeki kontroller (örneğin varlığı ya da izinleri gibi) ile bu kontrole bağlı eylemlerin tek bir atomik işlem olarak gerçekleştirildiği doğrulanmalıdır. Bu, TOCTOU (time-of-check to time-of-use) yarış durumlarını önlemeye yöneliktir. Bir dosyanın varlığının kontrol edilip ardından açılması veya bir kullanıcının erişiminin doğrulanıp ardından yetki verilmesi gibi işlemler buna örnektir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.4", + "section_name": "Güvenli Eş Zamanlılık (Concurrency)", + "req_id": "V15.4.3", + "req_description": "Kilitlerin (locks) tutarlı biçimde kullanıldığı, iş parçacıklarının birbirini beklemesi ya da sonsuz döngüye girmesi (deadlock veya livelock) gibi durumların önlendiği doğrulanmalıdır. Ayrıca, kilitleme mantığı, kaynağı yöneten kod içinde kalmalı ve dış sınıflar veya dış kodlar tarafından istemeden veya kötü niyetli şekilde değiştirilememelidir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.4", + "section_name": "Güvenli Eş Zamanlılık (Concurrency)", + "req_id": "V15.4.4", + "req_description": "Kaynak tahsis politikalarının, iş parçacığı açlığını önleyecek şekilde, kaynaklara adil erişimi sağladığı doğrulanmalıdır. Örneğin, thread pool (iş parçacığı havuzu) kullanımı, düşük öncelikli iş parçacıklarının da makul sürelerde çalışabilmesi için uygulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.1", + "section_name": "Güvenlik Loglaması Dokümantasyonu", + "req_id": "V16.1.1", + "req_description": "Uygulamanın teknoloji yığını boyunca her katmanda hangi olayların loglandığını, log formatlarını, logların nereye yazıldığını, nasıl kullanıldığını, erişimin nasıl kontrol edildiğini ve logların ne kadar süre saklandığını belgeleyen bir envanterin mevcut olduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.2", + "section_name": "Genel Loglama", + "req_id": "V16.2.1", + "req_description": "Her bir log girdisinin, olayın ne zaman, nerede, kim tarafından ve ne olduğuna dair detaylı bir zaman çizelgesi oluşturulmasına olanak tanıyacak gerekli meta verileri içerdiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.2", + "section_name": "Genel Loglama", + "req_id": "V16.2.2", + "req_description": "Tüm loglama bileşenlerinin zaman kaynaklarının senkronize olduğu ve güvenlik olayı meta verisindeki zaman damgalarının UTC kullanarak ya da açık zaman dilimi ofsetiyle belirtildiği doğrulanmalıdır. UTC kullanımı, özellikle yaz saati uygulamaları nedeniyle oluşabilecek karışıklıkları önlemek için tavsiye edilir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.2", + "section_name": "Genel Loglama", + "req_id": "V16.2.3", + "req_description": "Uygulamanın yalnızca log envanterinde belgelenmiş dosya ve hizmetlere log yazdığı ya da ilettiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.2", + "section_name": "Genel Loglama", + "req_id": "V16.2.4", + "req_description": "Logların kullanılan log işleyici (log processor) tarafından okunabildiği ve ilişkilendirilebildiği doğrulanmalıdır. Tercihen yaygın bir log formatı kullanılmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.2", + "section_name": "Genel Loglama", + "req_id": "V16.2.5", + "req_description": "Hassas veriler loglanırken, uygulamanın veri koruma seviyesine uygun olarak loglama yaptığı doğrulanmalıdır. Örneğin kimlik bilgileri veya ödeme detayları gibi bazı verilerin loglanmasına izin verilmemelidir. Session token’ları gibi veriler ise yalnızca tamamen ya da kısmen maskelenmiş ya da hash’lenmiş olarak loglanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.3", + "section_name": "Güvenlik Olayları", + "req_id": "V16.3.1", + "req_description": "Tüm kimlik doğrulama işlemlerinin (başarılı ve başarısız girişimler dahil) loglandığı doğrulanmalıdır. Kullanılan kimlik doğrulama türü veya faktörleri gibi ek meta veriler de toplanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.3", + "section_name": "Güvenlik Olayları", + "req_id": "V16.3.2", + "req_description": "Başarısız yetkilendirme girişimlerinin loglandığı doğrulanmalıdır. Seviye 3 uygulamalar için, tüm yetkilendirme kararlarının ve hassas verilere erişim olaylarının (verinin kendisi olmadan) loglandığı da doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.3", + "section_name": "Güvenlik Olayları", + "req_id": "V16.3.3", + "req_description": "Uygulamanın, belgelenmiş güvenlik olaylarını ve güvenlik kontrollerini aşma girişimlerini (girdi doğrulama, iş mantığı, otomasyon karşıtı kontroller vb.) logladığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.3", + "section_name": "Güvenlik Olayları", + "req_id": "V16.3.4", + "req_description": "Beklenmeyen hatalar ve güvenlik kontrolü başarısızlıkları (örneğin backend TLS hataları gibi) loglandığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.4", + "section_name": "Log Koruması", + "req_id": "V16.4.1", + "req_description": "Tüm loglama bileşenlerinin, log enjeksiyonunu (log injection) önlemek amacıyla verileri uygun biçimde encode ettiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.4", + "section_name": "Log Koruması", + "req_id": "V16.4.2", + "req_description": "Logların yetkisiz erişime karşı korunduğu ve değiştirilemez olduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.4", + "section_name": "Log Koruması", + "req_id": "V16.4.3", + "req_description": "Logların analiz, tespit, uyarı ve yükseltme amacıyla mantıksal olarak ayrı bir sisteme güvenli biçimde iletildiği doğrulanmalıdır. Böylece uygulama ihlal edilse bile logların tehlikeye girmesi önlenmiş olur.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.5", + "section_name": "Hata Yönetimi", + "req_id": "V16.5.1", + "req_description": "Beklenmedik ya da güvenlikle ilgili bir hata oluştuğunda, tüketiciye genel bir mesaj döndürüldüğü ve yığın izleri (stack trace), sorgular, gizli anahtarlar, token’lar gibi hassas sistem içi verilerin açıklanmadığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.5", + "section_name": "Hata Yönetimi", + "req_id": "V16.5.2", + "req_description": "Uygulamanın, dış kaynaklara erişim başarısız olduğunda bile güvenli şekilde çalışmaya devam ettiği doğrulanmalıdır. Örneğin, circuit breaker ya da graceful degradation gibi desenler kullanılmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.5", + "section_name": "Hata Yönetimi", + "req_id": "V16.5.3", + "req_description": "Uygulamanın hata durumlarında güvenli ve düzenli şekilde başarısız olduğu doğrulanmalıdır. Bu, örneğin doğrulama hatalarına rağmen işlemlerin işlenmesine yol açabilecek fail-open durumlarını önlemelidir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.5", + "section_name": "Hata Yönetimi", + "req_id": "V16.5.4", + "req_description": "Ele alınmamış tüm istisnaları yakalayacak şekilde tanımlanmış bir “son çare hata yöneticisi” bulunduğu doğrulanmalıdır. Bu, hem loglara gitmesi gereken hata detaylarının kaybolmaması hem de tüm uygulama sürecinin çökerek hizmet dışı kalmasının önlenmesi açısından önemlidir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.1", + "section_name": "TURN Sunucusu", + "req_id": "V17.1.1", + "req_description": "TURN hizmetinin yalnızca özel amaçlar için ayrılmamış IP adreslerine (ör. iç ağlar, yayın adresleri, loopback) erişime izin verdiği doğrulanmalıdır. Bu gereksinim hem IPv4 hem de IPv6 adresleri için geçerlidir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.1", + "section_name": "TURN Sunucusu", + "req_id": "V17.1.2", + "req_description": "TURN hizmetinin, meşru kullanıcıların sunucuda çok sayıda bağlantı noktası açmaya çalışması durumunda kaynak tüketimi saldırılarına karşı dayanıklı olduğu doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Medya", + "req_id": "V17.2.1", + "req_description": "DTLS sertifikası anahtarının, belgelenmiş kriptografik anahtar yönetim politikasına uygun şekilde yönetildiği ve korunduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Medya", + "req_id": "V17.2.2", + "req_description": "Medya sunucusunun onaylı DTLS şifre takımlarını (cipher suites) ve Güvenli Gerçek Zamanlı Aktarım Protokolü (Secure Real-time Transport Protocol - SRTP) için anahtarlar oluşturmaya yönelik DTLS Uzantısı için güvenli bir koruma profilini kullanacak ve destekleyecek şekilde yapılandırıldığı (DTLS-SRTP) doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Medya", + "req_id": "V17.2.3", + "req_description": "Real-time Transport Protocol (RTP) injection saldırılarının bir hizmet reddi durumuna veya medya akışlarına ses veya video medyası eklenmesine yol açmasını önlemek için medya sunucusunda Güvenli SRTP kimlik doğrulamasının kontrol edildiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Medya", + "req_id": "V17.2.4", + "req_description": "Verify that the media server is able to continue processing incoming media traffic when encountering malformed Secure Real-time Transport Protocol (SRTP) packets.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Medya", + "req_id": "V17.2.5", + "req_description": "Medya sunucusunun, meşru kullanıcılardan gelen SRTP flood'ı sırasında gelen medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Medya", + "req_id": "V17.2.6", + "req_description": "Medya sunucusunun DTLS içinde yer alan \"ClientHello\" yarış durumu güvenlik açığına karşı savunmasız olmadığı, medya sunucusunun güvenlik açığına sahip olduğunun açıkça bilinip bilinmediği kontrol edilerek veya yarış koşulu testi gerçekleştirilerek doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Medya", + "req_id": "V17.2.7", + "req_description": "Medya sunucusuna bağlı ses veya video kayıt mekanizmalarının, meşru kullanıcı kaynaklı SRTP flood'ı sırasında medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Medya", + "req_id": "V17.2.8", + "req_description": "DTLS sertifikasının, SDP (Session Description Protocol) fingerprint özelliği ile karşılaştırıldığı ve doğrulama başarısız olursa medya akışının sonlandırıldığı, medya akışının özgünlüğünü sağlamak için doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.3", + "section_name": "Sinyalizasyon", + "req_id": "V17.3.1", + "req_description": "Sinyalizasyon sunucusunun, flood saldırısı altında bile meşru sinyalizasyon mesajlarını işlemeye devam edebildiği doğrulanmalıdır. Bu, sinyalizasyon düzeyinde oran sınırlaması uygulanarak sağlanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.3", + "section_name": "Sinyalizasyon", + "req_id": "V17.3.2", + "req_description": "Sinyalizasyon sunucusunun, hizmet reddine yol açabilecek şekilde yapılandırılmış bozuk sinyalizasyon mesajlarıyla karşılaştığında bile meşru mesajları işlemeye devam edebildiği doğrulanmalıdır. Bu, girdi doğrulaması, integer overflow ve buffer overflow'a karşı savunma ve sağlam hata işleme teknikleri ile sağlanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + } + ] +} diff --git a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.json b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.json new file mode 100644 index 0000000000..e5bc5ab39c --- /dev/null +++ b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.json @@ -0,0 +1,2750 @@ +{ + "Name": "Application Security Verification Standard Project", + "ShortName": "ASVS", + "Version": "", + "Description": "The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.", + "Requirements": [ + { + "Shortcode": "V1", + "Ordinal": 1, + "ShortName": "Encoding", + "Name": "Kodlama (Encoding) ve Temizleme", + "Items": [ + { + "Shortcode": "V1.1", + "Ordinal": 1, + "Name": "Kodlama ve Temizleme Mimarisi", + "Items": [ + { + "Shortcode": "V1.1.1", + "Ordinal": 1, + "Description": "Girdinin yalnızca bir kez kanonik forma (canonical form) çözümlendiği veya kaçış işlemlerinin kaldırıldığı, bu işlemin yalnızca verinin bu biçimde beklenmesi durumunda yapıldığı ve bu işlemin girdi doğrulama veya temizleme işlemlerinden sonra değil, önce gerçekleştiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V1.1.2", + "Ordinal": 2, + "Description": "Uygulamanın, çıktıyı kullanılması gereken yorumlayıcıya verilmeden hemen önce veya yorumlayıcının kendisi tarafından çıktı kodlaması ya da kaçış işlemi yaptığı doğrulanmalıdır.", + "L": "2" + } + ] + }, + { + "Shortcode": "V1.2", + "Ordinal": 2, + "Name": "Enjeksiyon Önleme", + "Items": [ + { + "Shortcode": "V1.2.1", + "Ordinal": 1, + "Description": "HTTP yanıtı, HTML veya XML belgesi için yapılan çıktı kodlamasının; HTML elemanları, HTML öznitelikleri, HTML yorumları, CSS ya da HTTP başlık alanları gibi bağlamlara uygun olduğu doğrulanmalıdır. Böylece mesaj veya belge yapısının bozulması önlenir.", + "L": "1" + }, + { + "Shortcode": "V1.2.2", + "Ordinal": 2, + "Description": "Dinamik olarak URL oluşturulurken, güvenilmeyen verinin bağlamına göre (örneğin, sorgu veya yol parametreleri için URL kodlaması ya da base64url kodlaması) kodlandığı doğrulanmalıdır. Yalnızca güvenli URL protokollerine izin verilmelidir (örneğin, javascript: veya data: yasaklanmalıdır).", + "L": "1" + }, + { + "Shortcode": "V1.2.3", + "Ordinal": 3, + "Description": "JavaScript içeriği (JSON dahil) dinamik olarak oluşturulurken çıktı kodlama/kaçış kullanıldığı doğrulanmalıdır. Böylece mesaj veya belge yapısı değiştirilmemiş olur (JavaScript ve JSON enjeksiyonlarının önüne geçilir).", + "L": "1" + }, + { + "Shortcode": "V1.2.4", + "Ordinal": 4, + "Description": "Veri sorguları veya veritabanı sorguları (SQL, HQL, NoSQL, Cypher vb.) için parametreli sorgular, ORM’ler, entity framework’ler kullanıldığı ya da SQL enjeksiyonu ve diğer veritabanı enjeksiyon saldırılarına karşı koruma sağlandığı doğrulanmalıdır. Bu durum, saklı yordam (stored procedure) yazarken de geçerlidir.", + "L": "1" + }, + { + "Shortcode": "V1.2.5", + "Ordinal": 5, + "Description": "Uygulamanın işletim sistemi komut enjeksiyonlarına karşı korunduğu ve işletim sistemi çağrılarında parametreli OS sorguları veya bağlama özgü komut satırı çıktı kodlamasının kullanıldığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V1.2.6", + "Ordinal": 6, + "Description": "Uygulamanın LDAP enjeksiyon zafiyetlerine karşı korunduğu ya da LDAP enjeksiyonlarını önlemek için özel güvenlik kontrollerinin uygulandığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V1.2.7", + "Ordinal": 7, + "Description": "XPath enjeksiyon saldırılarına karşı, sorgu parametrelemesi veya önceden derlenmiş sorgular kullanılarak koruma sağlandığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V1.2.8", + "Ordinal": 8, + "Description": "LaTeX işlemcilerinin güvenli şekilde yapılandırıldığı (örneğin, --shell-escape bayrağının kullanılmadığı) ve yalnızca izin verilen komutlardan oluşan bir listeyle çalıştırıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V1.2.9", + "Ordinal": 9, + "Description": "Düzenli ifadelerde (regex) özel karakterlerin (genellikle ters eğik çizgi \\ ile) kaçırılarak meta karakter olarak yorumlanmalarının önlendiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V1.2.10", + "Ordinal": 10, + "Description": "Uygulamanın CSV ve formül enjeksiyonlarına karşı korunduğu doğrulanmalıdır. Uygulama, CSV içeriği dışa aktarırken RFC 4180 Bölüm 2.6 ve 2.7'de tanımlanan kaçış kurallarına uymalıdır. Ayrıca, CSV veya diğer tablo formatlarına (XLS, XLSX, ODF gibi) aktarım yapılırken, alanın ilk karakteri olarak çıkan özel karakterler ('=', '+', '-', '@', '\\t' (sekme), '\\0' (null karakter)) tek tırnak (') ile kaçırılmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V1.3", + "Ordinal": 3, + "Name": "Temizleme (Sanitization)", + "Items": [ + { + "Shortcode": "V1.3.1", + "Ordinal": 1, + "Description": "WYSIWYG editörlerinden veya benzer kaynaklardan gelen tüm güvenilmeyen HTML girdilerinin, bilinen ve güvenli bir HTML temizleme kütüphanesi ya da çerçeve özelliği ile temizlendiği doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V1.3.2", + "Ordinal": 2, + "Description": "Uygulamanın eval() veya Spring Expression Language (SpEL) gibi dinamik kod çalıştırma özelliklerini kullanmaktan kaçındığı doğrulanmalıdır. Alternatif yoksa, kullanıcı girdisi çalıştırılmadan önce mutlaka temizlenmelidir.", + "L": "1" + }, + { + "Shortcode": "V1.3.3", + "Ordinal": 3, + "Description": "Potansiyel olarak tehlikeli bir bağlamda kullanılacak verilerin, bu bağlama uygun karakterlere izin vermek ve çok uzun girdileri kısaltmak gibi güvenlik önlemleriyle önceden temizlendiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V1.3.4", + "Ordinal": 4, + "Description": "Kullanıcı tarafından sağlanan SVG içeriğinin, yalnızca güvenli etiket ve özellikler (örneğin grafik çizme ile ilgili) içerdiğinden emin olmak için onaylandığı veya temizlendiği doğrulanmalıdır (ör. script veya foreignObject içermemelidir).", + "L": "2" + }, + { + "Shortcode": "V1.3.5", + "Ordinal": 5, + "Description": "Markdown, CSS, XSL stil sayfaları, BBCode veya benzeri ifade şablon dillerinde kullanıcı girdisinin temizlendiği veya bu tür özelliklerin devre dışı bırakıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V1.3.6", + "Ordinal": 6, + "Description": "Uygulamanın, güvenilmeyen verileri başka servislere iletmeden önce izinli protokol, alan adı, yol ve port listelerine göre doğruladığı ve tehlikeli karakterleri temizlediği doğrulanarak SSRF (Sunucu Taraflı İstek Sahteciliği) saldırılarına karşı korunduğu doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V1.3.7", + "Ordinal": 7, + "Description": "Uygulamanın şablon enjeksiyon saldırılarına karşı, güvenilmeyen girdilere dayalı şablon oluşturmayı engellediği; eğer bu kaçınılmazsa, bu girdilerin mutlaka temizlendiği veya sıkı şekilde onaylandığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V1.3.8", + "Ordinal": 8, + "Description": "JNDI sorgularında kullanılmadan önce güvenilmeyen girdilerin temizlendiği ve JNDI'nin enjeksiyonlara karşı güvenli şekilde yapılandırıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V1.3.9", + "Ordinal": 9, + "Description": "Memcache’e gönderilmeden önce içeriğin temizlenerek enjeksiyon saldırılarına karşı korunduğu doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V1.3.10", + "Ordinal": 10, + "Description": "Format dizgilerinin (format strings) beklenmeyen veya zararlı şekilde çözümlenmesini önlemek için işlenmeden önce temizlendiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V1.3.11", + "Ordinal": 11, + "Description": "SMTP veya IMAP enjeksiyonlarını önlemek için, kullanıcı girdisinin posta sistemlerine iletilmeden önce temizlendiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V1.3.12", + "Ordinal": 12, + "Description": "Regex girdilerinin üstel geri izlemeye (exponential backtracking) neden olan öğeler içermediği ve güvenilmeyen girdilerin ReDoS (Regex Denial of Service) gibi saldırılara karşı temizlendiği doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V1.4", + "Ordinal": 4, + "Name": "Bellek, Dizgi ve Yönetilmeyen Kod", + "Items": [ + { + "Shortcode": "V1.4.1", + "Ordinal": 1, + "Description": "Yığın, arabellek (buffer) veya yığın belleği taşmalarını önlemek ya da tespit etmek amacıyla, bellek güvenli dizgi işlemlerinin, daha güvenli bellek kopyalama ve işaretçi aritmetiğinin kullanıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V1.4.2", + "Ordinal": 2, + "Description": "Tamsayı taşmalarını önlemek için işaret (sign), aralık (range) ve giriş doğrulama tekniklerinin kullanıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V1.4.3", + "Ordinal": 3, + "Description": "Dinamik olarak ayrılan belleğin ve kaynakların serbest bırakıldığı ve boşaltılan belleklere ait referansların veya işaretçilerin kaldırıldığı veya null yapıldığı doğrulanmalıdır (dangling pointer ve use-after-free zafiyetlerine karşı).", + "L": "2" + } + ] + }, + { + "Shortcode": "V1.5", + "Ordinal": 5, + "Name": "Güvenli Ters Serileştirme (Safe Deserialization)", + "Items": [ + { + "Shortcode": "V1.5.1", + "Ordinal": 1, + "Description": "XML ayrıştırıcılarının (parser) kısıtlayıcı şekilde yapılandırıldığı ve dış varlık çözümleme (external entity resolution) gibi güvensiz özelliklerin XXE (XML eXternal Entity) saldırılarına karşı devre dışı bırakıldığı doğrulanmalıdır .", + "L": "1" + }, + { + "Shortcode": "V1.5.2", + "Ordinal": 2, + "Description": "Güvenilmeyen verilerin ters serileştirilmesinde, nesne türleri için izinli liste kullanımı veya istemci tanımlı nesne türlerinin kısıtlanması gibi güvenli giriş işleme önlemlerinin uygulandığı doğrulanmalıdır. Güvensiz olarak tanımlanmış ters serileştirme mekanizmaları, güvenilmeyen girdilerle kullanılmamalıdır.", + "L": "2" + }, + { + "Shortcode": "V1.5.3", + "Ordinal": 3, + "Description": "Aynı veri türü için uygulamada kullanılan farklı parser'ların (ör. JSON, XML, URL parser'ları), veriyi tutarlı şekilde ayrıştırdığı ve aynı karakter kodlamasını kullandığı doğrulanmalıdır. Böylece JSON birlikte çalışabilirlik açıkları, URI veya dosya ayrıştırma farkları gibi sorunlar nedeniyle RFI veya SSRF saldırılarının istismar edilmesi önlenir.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V2", + "Ordinal": 2, + "ShortName": "Validation", + "Name": "Doğrulama ve İş Mantığı", + "Items": [ + { + "Shortcode": "V2.1", + "Ordinal": 1, + "Name": "Doğrulama ve İş Mantığı Dokümantasyonu", + "Items": [ + { + "Shortcode": "V2.1.1", + "Ordinal": 1, + "Description": "Uygulama dokümantasyonunda, veri öğelerinin beklenen yapıya göre nasıl doğrulanacağına ilişkin giriş doğrulama kurallarının tanımlandığı doğrulanmalıdır. Bu; kredi kartı numaraları, e-posta adresleri, telefon numaraları gibi yaygın veri biçimleri olabileceği gibi iç sistemlere özel biçimler de olabilir.", + "L": "1" + }, + { + "Shortcode": "V2.1.2", + "Ordinal": 2, + "Description": "Uygulama dokümantasyonunda, birleştirilmiş veri öğelerinin mantıksal ve bağlamsal tutarlılığının nasıl doğrulanacağı tanımlanmalıdır (örneğin, mahalle ve posta kodunun eşleşip eşleşmediğinin kontrolü).", + "L": "2" + }, + { + "Shortcode": "V2.1.3", + "Ordinal": 3, + "Description": "Hem kullanıcı bazında hem de uygulama genelinde geçerli olacak şekilde, iş mantığı sınırları ve doğrulama beklentilerinin belgelendiği doğrulanmalıdır.", + "L": "2" + } + ] + }, + { + "Shortcode": "V2.2", + "Ordinal": 2, + "Name": "Girdi Doğrulama", + "Items": [ + { + "Shortcode": "V2.2.1", + "Ordinal": 1, + "Description": "Girdilerin, işlevsel ya da iş gereksinimlerine uygunluğunun doğrulandığı teyit edilmelidir. Bu işlem; izinli değerler, desenler ve aralıklar listesine karşı pozitif doğrulama ile ya da girdinin beklenen yapıya ve mantıksal sınırlara uygunluğunun önceden tanımlanmış kurallara göre karşılaştırılması ile yapılmalıdır. Seviye 1 için bu, güvenlik veya iş kararlarında kullanılan girdilere odaklanabilir. Seviye 2 ve üstü için tüm girdilere uygulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V2.2.2", + "Ordinal": 2, + "Description": "Uygulamanın, güvenilir bir servis katmanında girdi doğrulama zorunluluğu uygulayacak şekilde tasarlandığı doğrulanmalıdır. İstemci tarafında gerçekleştirilen doğrulama, kullanılabilirliği artırabilir ve teşvik edilmelidir. Ancak bu doğrulama,güvenlik kontrolü olarak kabul edilmemelidir.", + "L": "1" + }, + { + "Shortcode": "V2.2.3", + "Ordinal": 3, + "Description": "Uygulamanın, ilişkili veri öğelerinin önceden tanımlanmış kurallara göre makul olup olmadığını kontrol ettiği doğrulanmalıdır.", + "L": "2" + } + ] + }, + { + "Shortcode": "V2.3", + "Ordinal": 3, + "Name": "İş Mantığı Güvenliği", + "Items": [ + { + "Shortcode": "V2.3.1", + "Ordinal": 1, + "Description": "Uygulamanın, aynı kullanıcı için iş mantığı akışlarını yalnızca beklenen adım sırasına göre ve adım atlamadan işlediği doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V2.3.2", + "Ordinal": 2, + "Description": "İş mantığı sınırlarının, uygulama dokümantasyonuna uygun şekilde uygulandığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V2.3.3", + "Ordinal": 3, + "Description": "İş mantığı seviyesinde işlemlerin (transaction) kullanıldığı ve bir iş mantığı işleminin ya bütünüyle başarıyla tamamlandığı ya da önceki geçerli duruma geri döndürüldüğü (rollback) doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V2.3.4", + "Ordinal": 4, + "Description": "İş mantığı düzeyinde kilitleme mekanizmalarının, sınırlı kaynakların (ör. sinema koltukları, teslimat zamanları) uygulamanın mantığı manipüle edilerek çift rezervasyona neden olmamasını sağladığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V2.3.5", + "Ordinal": 5, + "Description": "Yüksek değerli iş mantığı akışlarının, yetkisiz veya kazara gerçekleşebilecek işlemleri önlemek için çoklu kullanıcı onayı gerektirdiği doğrulanmalıdır. Bu işlemler büyük para transferleri, sözleşme onayları, gizli bilgilere erişim veya üretimde güvenlik kurallarının geçersiz kılınmaları gibi durumları içerebilir.", + "L": "3" + } + ] + }, + { + "Shortcode": "V2.4", + "Ordinal": 4, + "Name": "Otomasyon Karşıtı Önlemler", + "Items": [ + { + "Shortcode": "V2.4.1", + "Ordinal": 1, + "Description": "Uygulama işlevlerine yönelik aşırı miktardaki çağrılara karşı; veri sızdırma, anlamsız veri üretme, kota tüketme, hız sınırının aşılması, hizmet reddi (DoS) ya da maliyetli kaynakların aşırı kullanımı gibi risklere karşı otomasyon karşıtı kontrollerin bulunduğu doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V2.4.2", + "Ordinal": 2, + "Description": "İş mantığı akışlarının, aşırı hızlı işlem gönderimlerini önleyecek şekilde gerçekçi insan zamanlaması gerektirdiği doğrulanmalıdır.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V3", + "Ordinal": 3, + "ShortName": "Web", + "Name": "Web Ön Uç (Frontend) Güvenliği", + "Items": [ + { + "Shortcode": "V3.1", + "Ordinal": 1, + "Name": "Web Frontend Güvenlik Dokümantasyonu", + "Items": [ + { + "Shortcode": "V3.1.1", + "Ordinal": 1, + "Description": "Uygulama dokümantasyonunda, uygulamayı kullanan tarayıcıların desteklemesi gereken güvenlik özelliklerinin (ör. HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) ve diğer ilgili HTTP güvenlik mekanizmaları) tanımlandığı doğrulanmalıdır. Ayrıca bu özelliklerin mevcut olmadığı durumlarda uygulamanın nasıl davranması gerektiği (ör. kullanıcıyı uyarmak veya erişimi engellemek) de tanımlanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.2", + "Ordinal": 2, + "Name": "İçeriğin Yanlış Yorumlanması", + "Items": [ + { + "Shortcode": "V3.2.1", + "Ordinal": 1, + "Description": "Tarayıcıların HTTP yanıtlarında içerik veya işlevi yanlış bir bağlamda sunmalarını önlemek amacıyla güvenlik kontrollerinin uygulandığı doğrulanmalıdır (ör. API, kullanıcı tarafından yüklenen dosya veya başka bir kaynağın doğrudan çağrılması durumunda). Olası kontroller arasında; yalnızca HTTP istek başlıklarının (ör. Sec-Fetch-\\*) doğru bağlamı gösterdiği durumlarda içeriğin sunulması, Content-Security-Policy başlığında \"sandbox\" yönergesinin kullanılması veya Content-Disposition başlığında \"attachment\" biçiminin kullanılması yer alabilir.", + "L": "1" + }, + { + "Shortcode": "V3.2.2", + "Ordinal": 2, + "Description": "HTML yerine metin olarak görüntülenmesi amaçlanan içeriğin, HTML veya JavaScript gibi içeriklerin istenmeden çalıştırılmasını önleyecek şekilde \"createTextNode\" veya \"textContent\" gibi güvenli işleme fonksiyonlarıyla işlendiği doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V3.2.3", + "Ordinal": 3, + "Description": "Uygulamanın istemci tarafı JavaScript kullanırken açık değişken tanımlamaları yaparak, sıkı tür kontrolü uygulayarak, global değişkenleri document nesnesine kaydetmekten kaçınarak ve ad alanı izolasyonu sağlayarak DOM clobbering’den kaçındığı doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.3", + "Ordinal": 3, + "Name": "Çerez Yapılandırması", + "Items": [ + { + "Shortcode": "V3.3.1", + "Ordinal": 1, + "Description": "Çerezlerin 'Secure' niteliğine sahip olduğu ve eğer çerez adı '\\__Host-' ön eki ile başlamıyorsa, '__Secure-' ön ekinin kullanıldığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V3.3.2", + "Ordinal": 2, + "Description": "Kullanıcı arayüzü kandırma saldırılarına ve tarayıcı tabanlı istek sahteciliği saldırılarına (CSRF) karşı koruma sağlamak amacıyla, her çerezin 'SameSite' niteliğinin kullanım amacına uygun şekilde ayarlandığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V3.3.3", + "Ordinal": 3, + "Description": "Çerez adı, diğer sunucularla paylaşılmak üzere açıkça tasarlanmadığı sürece '__Host-' ön eki ile tanımlanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V3.3.4", + "Ordinal": 4, + "Description": "Bir çerez değeri istemci tarafı betikleri tarafından erişilememesi gereken bir veri içeriyorsa (ör. oturum token'ı), çerezin 'HttpOnly' niteliğine sahip olduğu ve aynı değerin (ör. oturum token'ı) yalnızca 'Set-Cookie' başlığı ile istemciye iletildiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V3.3.5", + "Ordinal": 5, + "Description": "Uygulama bir çerez oluştururken, çerez adı ve değerinin toplam uzunluğunun 4096 baytı aşmadığı doğrulanmalıdır. Çok büyük çerezler tarayıcı tarafından saklanmaz ve isteklerle gönderilmez; bu da çereze bağlı çalışan uygulama işlevlerinin bozulmasına yol açabilir.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.4", + "Ordinal": 4, + "Name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", + "Items": [ + { + "Shortcode": "V3.4.2", + "Ordinal": 2, + "Description": "Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header'ı, uygulama tarafından sabit bir değer olarak tanımlanmalı veya gelen Origin header değeri güvenilir origin’lerden oluşan bir izinli listeye karşı doğrulanmalıdır. ‘Access-Control-Allow-Origin: *’ kullanılması gerekiyorsa, yanıtın hassas bilgi içermediği doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V3.4.3", + "Ordinal": 3, + "Description": "HTTP yanıtlarında Content-Security-Policy header'ı bulunduğu ve bu header'ın yalnızca güvenilen içeriklerin veya kaynakların yüklenmesini ve çalıştırılmasını sağlayan yönergeler içerdiği doğrulanmalıdır. Minimum olarak \"global policy\", object-src 'none', base-uri 'none' yönergelerini içermeli ve izinli liste, nonce veya hash temelli bir yapı içermelidir. Seviye 3 uygulamalarında her yanıt için nonce veya hash içeren özel bir politika tanımlanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V3.4.4", + "Ordinal": 4, + "Description": "Tüm HTTP yanıtlarının 'X-Content-Type-Options: nosniff' header'ını içerdiği doğrulanmalıdır. Bu, tarayıcıya içerik türünü tahmin etmeyi bırakmasını ve yanıtın Content-Type header'ında belirtilen MIME türünün, beklenen kaynak türüyle eşleşmesini zorunlu kılar. Ayrıca bu, tarayıcıda CORB (Cross-Origin Read Blocking) özelliğini etkinleştirir.", + "L": "2" + }, + { + "Shortcode": "V3.4.5", + "Ordinal": 5, + "Description": "Uygulamanın, 'Referer' başlığı yoluyla üçüncü taraflara teknik olarak hassas verilerin sızmasını önlemek için bir 'referrer policy' belirlediği doğrulanmalıdır. Bu, Referrer-Policy HTTP header'ıyla veya HTML öğe nitelikleriyle (element attributes) sağlanabilir. Sızabilecek hassas bilgiler, URL’deki yol ve sorgu parametreleri ile sınırlı uygulamalarda hostname bilgisini içerebilir.", + "L": "2" + }, + { + "Shortcode": "V3.4.6", + "Ordinal": 6, + "Description": "Uygulamanın, Content-Security-Policy header'ı altında 'frame-ancestors' yönergesini her HTTP yanıtında tanımladığı ve bu sayede içeriklerin varsayılan olarak başka sayfalara gömülmesini engellediği doğrulanmalıdır. Gerekli durumlarda özel olarak izin verildiğinden emin olunmalıdır. 'X-Frame-Options' header'ı, tarayıcılar tarafından desteklenmesine rağmen, artık güncel değildir ve güvenlik amacıyla kullanılmamalıdır.", + "L": "2" + }, + { + "Shortcode": "V3.4.8", + "Ordinal": 8, + "Description": "Bir belgenin işlenmesini ve sunulmasını başlatan tüm HTTP yanıtlarında (örneğin 'text/html' tipi yanıtlar), 'Cross-Origin-Opener-Policy' header'ı 'same-origin' veya 'same-origin-allow-popups' yönergeleriyle birlikte yer almalıdır. Bu, tabnabbing ve frame counting gibi, pencere nesnelerine paylaşımlı erişimi sömüren saldırılara karşı koruma sağlar.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.5", + "Ordinal": 5, + "Name": "Tarayıcı Menşei Ayırımı", + "Items": [ + { + "Shortcode": "V3.5.1", + "Ordinal": 1, + "Description": "Uygulama, hassas işlevselliğe yönelik izinsiz cross-origin istekleri önlemek için CORS preflight mekanizmasına güvenmiyorsa, bu tür isteklerin gerçekten uygulamadan geldiği doğrulanmalıdır. Bu, anti-forgery token kullanımı veya CORS tarafından güvenli kabul edilmeyen özel HTTP header'larının zorunlu kılınmasıyla yapılabilir. Bu, tarayıcı tabanlı istek sahteciliği (CSRF) saldırılarına karşı bir savunmadır.", + "L": "1" + }, + { + "Shortcode": "V3.5.2", + "Ordinal": 2, + "Description": "Uygulama, hassas işlevlerin izinsiz cross-origin çağrılmasını önlemek için CORS preflight mekanizmasına güveniyorsa, bu işlevlerin bir CORS-preflight isteğini tetiklemeden çağrılamadığı doğrulanmalıdır. Bu, 'Origin' ve 'Content-Type' header'larının doğrulanmasını veya CORS-safelisted olmayan bir header'ın ve alanın kullanılmasını gerektirebilir.", + "L": "1" + }, + { + "Shortcode": "V3.5.4", + "Ordinal": 4, + "Description": "Farklı uygulamaların farklı hostname'lerde barındırıldığı ve böylece Same-Origin Policy tarafından sağlanan kısıtlamalardan (örneğin çerez erişim sınırları, kaynaklar arası etkileşim kontrolleri) faydalanıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V3.5.6", + "Ordinal": 6, + "Description": "Uygulamanın herhangi bir yerinde JSONP işlevselliğinin etkin olmadığı doğrulanmalıdır. Bu, XSSI (Cross-Site Script Inclusion) saldırılarını önlemek içindir.", + "L": "3" + }, + { + "Shortcode": "V3.5.7", + "Ordinal": 7, + "Description": "Yetkilendirme gerektiren verilerin, JavaScript dosyaları gibi betik kaynaklarının yanıtlarında yer almadığı, XSSI saldırılarını önlemek için doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V3.5.8", + "Ordinal": 8, + "Description": "Kimliği doğrulanmış kaynakların (örneğin görseller, videolar, betikler ve belgeler) yalnızca gerçekten amaçlandığında kullanıcı adına yüklenebildiği veya gömülebildiği doğrulanmalıdır. Bu, isteğin uygun olmayan bir çapraz kaynak çağrısından kaynaklanmadığından emin olmak için Sec-Fetch-* HTTP istek başlığı alanlarının sıkı bir şekilde doğrulanmasıyla veya tarayıcıya döndürülen içeriği engelleme talimatı vermek için kısıtlayıcı bir Cross-Origin-Resource-Policy HTTP yanıt başlığı alanı ayarlayarak gerçekleştirilebilir.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.6", + "Ordinal": 6, + "Name": "Harici Kaynak Bütünlüğü", + "Items": [ + { + "Shortcode": "V3.6.1", + "Ordinal": 1, + "Description": "JavaScript kütüphaneleri, CSS veya web fontları gibi istemci tarafı varlıkların yalnızca statik ve sürümlü olması, varlığın bütünlüğünü doğrulamak için Subresource Integrity (SRI) kullanılması durumunda harici olarak (örneğin, bir İçerik Dağıtım Ağı üzerinde) barındırıldığı doğrulanmalıdır. Bu mümkün değilse, her bir kaynak için bunu gerekçelendiren belgelenmiş bir güvenlik kararı bulunmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.7", + "Ordinal": 7, + "Name": "Diğer Tarayıcı Güvenliği Hususları", + "Items": [ + { + "Shortcode": "V3.7.1", + "Ordinal": 1, + "Description": "Uygulamanın yalnızca hâlâ desteklenen ve güvenli kabul edilen istemci tarafı teknolojileri kullandığı doğrulanmalıdır. Bu gereksinimi karşılamayan teknolojilere örnek olarak NSAPI eklentileri, Flash, Shockwave, ActiveX, Silverlight, NACL veya istemci tarafı Java applet’leri verilebilir.", + "L": "2" + }, + { + "Shortcode": "V3.7.2", + "Ordinal": 2, + "Description": "Uygulamanın, yalnızca hedef adres bir izinli listede yer alıyorsa kullanıcıyı otomatik olarak farklı bir ana makine adına veya uygulamanın kontrolünde olmayan bir etki alanına yönlendirdiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V3.7.3", + "Ordinal": 3, + "Description": "Uygulamanın, kullanıcı uygulamanın kontrolü dışındaki bir URL’ye yönlendirildiğinde, yönlendirme hakkında bir bildirim gösterdiği ve kullanıcının bu gezintiyi iptal edebilmesi için bir seçenek sunduğu doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V3.7.4", + "Ordinal": 4, + "Description": "Uygulamanın en üst düzey etki alanının (örneğin, site.tld) HTTP Strict Transport Security (HSTS) için genel preload listesine eklendiği doğrulanmalıdır. Bu, uygulamanın TLS kullanımının ana tarayıcılar tarafından doğrudan tanınmasını ve yalnızca Strict-Transport-Security yanıt header'ına bağlı kalınmamasını sağlar.", + "L": "3" + }, + { + "Shortcode": "V3.7.5", + "Ordinal": 5, + "Description": "Uygulamaya erişen tarayıcının beklenen güvenlik özelliklerini desteklememesi durumunda, uygulamanın dokümantasyona uygun şekilde davrandığı (örneğin kullanıcıyı uyarma veya erişimi engelleme) doğrulanmalıdır.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V4", + "Ordinal": 4, + "ShortName": "API", + "Name": "API ve Web Servisi", + "Items": [ + { + "Shortcode": "V4.1", + "Ordinal": 1, + "Name": "Genel Web Servisi Güvenliği", + "Items": [ + { + "Shortcode": "V4.1.1", + "Ordinal": 1, + "Description": "İleti gövdesi içeren her HTTP yanıtında, yanıtın gerçek içeriğiyle eşleşen bir Content-Type header alanı bulunduğu ve güvenli karakter kodlamasını (örneğin, UTF-8, ISO-8859-1) belirtmek üzere charset parametresi içerdiği doğrulanmalıdır. Bu işlem, IANA Medya Türleri'nden \"text/\", \"/+xml\" ve \"/xml\" gibi içerikler için geçerlidir.", + "L": "1" + }, + { + "Shortcode": "V4.1.2", + "Ordinal": 2, + "Description": "Yalnızca kullanıcı arayüzüne yönelik uç noktaların (manuel olarak web tarayıcısı ile erişilmesi amaçlanan) otomatik olarak HTTP'den HTTPS'e yönlendirme yaptığı ve diğer hizmetlerin veya uç noktaların şeffaf yönlendirme gerçekleştirmediği doğrulanmalıdır. Bu, istemcinin farkında olmadan şifrelenmemiş HTTP istekleri göndermesi ve bu isteklerin otomatik olarak HTTPS'e yönlendirilmesi sonucunda hassas verilerin sızmasının fark edilmemesi riskini önlemek içindir.", + "L": "2" + }, + { + "Shortcode": "V4.1.3", + "Ordinal": 3, + "Description": "Uygulama tarafından kullanılan ve yük dengeleyici, web proxy veya frontend için backend hizmeti gibi bir ara katman tarafından ayarlanan herhangi bir HTTP başlık alanının, son kullanıcı tarafından geçersiz kılınamayacağı doğrulanmalıdır. Örnek başlıklar arasında X-Real-IP, X-Forwarded-* veya X-User-ID yer alabilir.", + "L": "2" + }, + { + "Shortcode": "V4.1.4", + "Ordinal": 4, + "Description": "Uygulama veya API tarafından açıkça desteklenen HTTP yöntemlerinin (preflight istekleri sırasında OPTIONS dahil) dışında hiçbir yöntemin kullanılmadığı ve kullanılmayan yöntemlerin engellendiği doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V4.1.5", + "Ordinal": 5, + "Description": "Çok hassas istekler veya birçok sistemden geçen işlemler için, taşıma katmanı güvenliğinin üzerine ek bir güvence sağlamak amacıyla, her iletiye özel dijital imzaların kullanıldığı doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V4.2", + "Ordinal": 2, + "Name": "HTTP İleti Yapısı Doğrulama", + "Items": [ + { + "Shortcode": "V4.2.1", + "Ordinal": 1, + "Description": "Tüm uygulama bileşenlerinin (yük dengeleyiciler, güvenlik duvarları ve uygulama sunucuları dahil) HTTP sürümüne uygun mekanizmaları kullanarak gelen HTTP iletilerinin sınırlarını belirlediği ve bu sayede HTTP istek kaçakçılığına karşı koruma sağlandığı doğrulanmalıdır. HTTP/1.x sürümünde Transfer-Encoding başlık alanı varsa, RFC 2616'ya göre Content-Length başlığı göz ardı edilmelidir. HTTP/2 veya HTTP/3 kullanıldığında, Content-Length başlığı varsa, alıcının bu değerin DATA çerçevelerinin uzunluğuyla tutarlı olduğunu doğrulaması gerekir.", + "L": "2" + }, + { + "Shortcode": "V4.2.2", + "Ordinal": 2, + "Description": "HTTP iletileri üretilirken, Content-Length başlığının, HTTP protokolünün çerçeveleme yöntemine göre belirlenen içerik uzunluğu ile çelişmediği doğrulanmalıdır. Bu, istek kaçakçılığı saldırılarını önlemek için gereklidir.", + "L": "3" + }, + { + "Shortcode": "V4.2.3", + "Ordinal": 3, + "Description": "Uygulamanın, yanıt bölme ve header enjeksiyonu saldırılarını önlemek amacıyla, bağlantıya özel başlık alanları (örneğin Transfer-Encoding) içeren HTTP/2 veya HTTP/3 iletilerini göndermediği ve kabul etmediği doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V4.2.4", + "Ordinal": 4, + "Description": "Uygulamanın yalnızca başlık alanları ve değerleri CR (\\r), LF (\\n) veya CRLF (\\r\\n) karakter dizileri içermeyen HTTP/2 ve HTTP/3 isteklerini kabul ettiği doğrulanmalıdır. Bu, başlık enjeksiyonu saldırılarını önlemek içindir.", + "L": "3" + }, + { + "Shortcode": "V4.2.5", + "Ordinal": 5, + "Description": "Uygulama (backend veya frontend) istek oluşturuyor ve gönderiyorsa, URI'ler (örneğin API çağrıları için) veya HTTP istek başlıkları (örneğin Authorization veya Cookie) gibi bileşenlerin, alıcı sistemler tarafından kabul edilemeyecek kadar uzun olmamasını sağlamak amacıyla doğrulama, temizleme veya diğer mekanizmaları kullandığı doğrulanmalıdır. Bu tür çok uzun istekler (örneğin çok uzun bir Cookie başlığı) gönderildiğinde sunucunun sürekli hata durumu döndürmesiyle hizmet reddi oluşabilir.", + "L": "3" + } + ] + }, + { + "Shortcode": "V4.3", + "Ordinal": 3, + "Name": "GraphQL", + "Items": [ + { + "Shortcode": "V4.3.1", + "Ordinal": 1, + "Description": "Maliyetli ve iç içe geçmiş sorgular sonucu oluşabilecek GraphQL veya veri katmanı ifadelerine yönelik Hizmet Reddi (DoS) saldırılarını önlemek için, sorgu izin listesi (allowlist), derinlik sınırlandırması, sorgu sayısı sınırlandırması veya sorgu maliyeti analizi kullanıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V4.3.2", + "Ordinal": 2, + "Description": "GraphQL introspection (iç yapı sorgulama) sorgularının, GraphQL API'nin üçüncü taraflar tarafından kullanılmasına yönelik olmadığı sürece, üretim ortamında devre dışı bırakıldığı doğrulanmalıdır.", + "L": "2" + } + ] + }, + { + "Shortcode": "V4.4", + "Ordinal": 4, + "Name": "WebSocket", + "Items": [ + { + "Shortcode": "V4.4.1", + "Ordinal": 1, + "Description": "Tüm WebSocket bağlantılarında TLS üzerinden WebSocket (WSS) kullanıldığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V4.4.2", + "Ordinal": 2, + "Description": "WebSocket'in başlangıçtaki HTTP el sıkışması (handshake) sırasında, Origin başlık alanının uygulama için izin verilen origin listesiyle karşılaştırılarak kontrol edildiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V4.4.3", + "Ordinal": 3, + "Description": "Uygulamanın standart oturum yönetimi kullanılamıyorsa, bunun yerine ilgili Oturum Yönetimi güvenlik gereksinimlerine uygun özel token'ların kullanıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V4.4.4", + "Ordinal": 4, + "Description": "HTTPS oturumu WebSocket kanalına geçerken, özel WebSocket oturum yönetim token’larının önceki şekilde kimliği doğrulanmış HTTPS oturumu aracılığıyla elde edildiği veya doğrulandığı doğrulanmalıdır.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V5", + "Ordinal": 5, + "ShortName": "File", + "Name": "Dosya İşleme", + "Items": [ + { + "Shortcode": "V5.1", + "Ordinal": 1, + "Name": "Dosya İşleme Dokümantasyonu", + "Items": [ + { + "Shortcode": "V5.1.1", + "Ordinal": 1, + "Description": "Dokümantasyonun, her yükleme özelliği için izin verilen dosya türlerini, beklenen dosya uzantılarını ve maksimum boyutu (açılmış hali dahil) tanımladığı doğrulanmalıdır. Ayrıca, dosyaların son kullanıcılar için nasıl güvenli hâle getirileceği (örneğin kötü amaçlı bir dosya tespit edildiğinde uygulamanın nasıl davranacağı) gibi bilgilerin de belgede yer aldığı doğrulanmalıdır.", + "L": "2" + } + ] + }, + { + "Shortcode": "V5.2", + "Ordinal": 2, + "Name": "Dosya Yükleme ve İçerik", + "Items": [ + { + "Shortcode": "V5.2.1", + "Ordinal": 1, + "Description": "Uygulamanın, yalnızca performans kaybına veya hizmet reddine yol açmayacak boyuttaki dosyaları kabul ettiği doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V5.2.2", + "Ordinal": 2, + "Description": "Uygulama bir dosyayı, doğrudan veya bir arşiv (ör. zip dosyası) içinde kabul ettiğinde, dosya uzantısının beklenen uzantıyla eşleşip eşleşmediğini kontrol ettiği ve içeriğin uzantı tarafından temsil edilen türle uyumlu olduğunu doğruladığı kontrol edilmelidir. Bu; ilk 'magic byte' kontrolü, görüntü yeniden yazımı ve dosya içeriği doğrulama için özel kütüphanelerin kullanımı gibi yöntemleri içerir. Seviye 1 için bu, yalnızca iş veya güvenlik kararlarında kullanılan dosyalarla sınırlı olabilir. Seviye 2 ve üzeri için tüm dosyalar bu kontrole tabi olmalıdır.", + "L": "1" + }, + { + "Shortcode": "V5.2.3", + "Ordinal": 3, + "Description": "Sıkıştırılmış dosyaların (ör. zip, gz, docx, odt) açılmadan önce, izin verilen maksimum açılmış boyuta ve maksimum dosya sayısına göre kontrol edildiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V5.2.4", + "Ordinal": 4, + "Description": "Her kullanıcı için dosya boyutu kotası ve maksimum dosya sayısının uygulandığı doğrulanmalıdır. Böylece tek bir kullanıcının çok sayıda veya aşırı büyük dosya yükleyerek depolama alanını doldurması engellenir.", + "L": "3" + }, + { + "Shortcode": "V5.2.5", + "Ordinal": 5, + "Description": "Uygulamanın, içinde sembolik bağlantılar (symlink) bulunan sıkıştırılmış dosyaların yüklenmesine yalnızca bu durum özel olarak gerekli olduğunda izin verdiği doğrulanmalıdır. Bu durumda, sembolik bağlantı verilebilecek dosyaların bir izinli listesi uygulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V5.2.6", + "Ordinal": 6, + "Description": "Uygulamanın, piksel boyutu izin verilen maksimum değeri aşan görüntü dosyalarının yüklenmesini reddettiği doğrulanmalıdır. Bu, pixel flood saldırılarını önlemek için gereklidir.", + "L": "3" + } + ] + }, + { + "Shortcode": "V5.3", + "Ordinal": 3, + "Name": "Dosya Depolama", + "Items": [ + { + "Shortcode": "V5.3.1", + "Ordinal": 1, + "Description": "Güvenilmeyen girdilerle yüklenen veya oluşturulan ve herkese açık klasörlerde depolanan dosyaların, bir HTTP isteğiyle doğrudan erişildiğinde sunucu taraflı program kodu olarak çalıştırılmadığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V5.3.2", + "Ordinal": 2, + "Description": "Uygulamanın, dosya işlemleri için dosya yollarını oluştururken kullanıcı tarafından gönderilen dosya adlarını değil, dahili olarak oluşturulan veya güvenilir verileri kullandığı; eğer kullanıcı tarafından gönderilen dosya adları veya meta veriler kullanılacaksa, sıkı doğrulama ve temizleme işlemlerinin uygulandığı doğrulanmalıdır. Bu, yol geçişi (path traversal), yerel veya uzak dosya dahil etme (LFI, RFI) ve sunucu tarafı istek sahteciliği (SSRF) saldırılarına karşı koruma sağlar.", + "L": "1" + }, + { + "Shortcode": "V5.3.3", + "Ordinal": 3, + "Description": "Sunucu tarafında gerçekleşen dosya işlemlerinin (örneğin dosya açma/decompress işlemi), kullanıcı tarafından sağlanan yol bilgilerini yok saydığı ve zip slip gibi güvenlik açıklarını önlediği doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V5.4", + "Ordinal": 4, + "Name": "Dosya İndirme", + "Items": [ + { + "Shortcode": "V5.4.1", + "Ordinal": 1, + "Description": "Uygulamanın, kullanıcı tarafından gönderilen dosya adlarını (ör. JSON, JSONP veya URL parametresinde) doğruladığı veya göz ardı ettiği ve yanıtın Content-Disposition başlık alanında bir dosya adı belirttiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V5.4.2", + "Ordinal": 2, + "Description": "Sunulan dosya adlarının (örneğin HTTP yanıt header'larında veya e-posta eklerinde), belge yapısını korumak ve enjeksiyon saldırılarını önlemek için kodlandığı veya temizlendiği (ör. RFC 6266’ya uygun) doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V5.4.3", + "Ordinal": 3, + "Description": "Güvenilmeyen kaynaklardan elde edilen dosyaların, bilinen kötü amaçlı içeriklerin sunulmasını önlemek amacıyla antivirüs tarayıcılarıyla tarandığı doğrulanmalıdır.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V6", + "Ordinal": 6, + "ShortName": "Authentication", + "Name": "Kimlik Doğrulama", + "Items": [ + { + "Shortcode": "V6.1", + "Ordinal": 1, + "Name": "Kimlik Doğrulama Dokümantasyonu", + "Items": [ + { + "Shortcode": "V6.1.1", + "Ordinal": 1, + "Description": "Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırılarına karşı oran sınırlama (rate limiting), otomasyon karşıtı önlemler ve uyarlanabilir yanıt gibi kontrollerin nasıl kullanıldığını açıklayan bir uygulama dokümantasyonu bulunduğu doğrulanmalıdır. Dokümantasyon, bu kontrollerin nasıl yapılandırıldığını ve kötü niyetli hesap kilitlemenin nasıl önlendiğini açıkça ortaya koymalıdır.", + "L": "1" + }, + { + "Shortcode": "V6.1.2", + "Ordinal": 2, + "Description": "Parolalarda kullanılmasını önlemek amacıyla, bağlama özgü sözcüklerin (örneğin kurum adlarının permütasyonları, ürün adları, sistem tanımlayıcıları, proje kod adları, departman veya rol adları vb.) bulunduğu belgelenmiş bir liste mevcut olduğu doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V6.1.3", + "Ordinal": 3, + "Description": "Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, bunların tümünün belgelenmiş olduğu ve her yol için tutarlı şekilde uygulanması gereken güvenlik kontrolleri ile kimlik doğrulama gücünün tanımlandığı doğrulanmalıdır.", + "L": "2" + } + ] + }, + { + "Shortcode": "V6.2", + "Ordinal": 2, + "Name": "Parola Güvenliği", + "Items": [ + { + "Shortcode": "V6.2.1", + "Ordinal": 1, + "Description": "Kullanıcı tarafından belirlenen parolaların en az 8 karakter uzunluğunda olması sağlanmalı, ancak 15 karakter ve üzeri uzunlukta parolalar olmaları şiddetle tavsiye edilir.", + "L": "1" + }, + { + "Shortcode": "V6.2.2", + "Ordinal": 2, + "Description": "Kullanıcıların parolalarını değiştirebilmeleri sağlanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V6.2.3", + "Ordinal": 3, + "Description": "Parola değiştirme işlevinin hem mevcut hem de yeni parolayı gerektirdiği doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V6.2.4", + "Ordinal": 4, + "Description": "Kayıt veya parola değişimi sırasında girilen parolaların, uygulamanın parola politikasına (örneğin minimum uzunluk) uyan ilk 3000 yaygın parolaya karşı kontrol edildiği doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V6.2.5", + "Ordinal": 5, + "Description": "Her tür karakterin kullanılmasına izin verildiği ve büyük/küçük harf, sayı veya özel karakter şartlarının zorunlu tutulmadığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V6.2.6", + "Ordinal": 6, + "Description": "Parola giriş alanlarının, girdiyi maskelemek için \"type=password\" kullandığı doğrulanmalıdır. Uygulamalar, kullanıcının tüm maskelenmiş parolayı ya da son girilen karakteri geçici olarak görüntülemesine izin verebilir.", + "L": "1" + }, + { + "Shortcode": "V6.2.7", + "Ordinal": 7, + "Description": "\"Yapıştır\" özelliğinin, tarayıcı parola yardımcılarının ve harici parola yöneticilerinin kullanımına izin verildiği doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V6.2.8", + "Ordinal": 8, + "Description": "Uygulamanın, kullanıcıdan aldığı parolayı herhangi bir şekilde değiştirmeden, örneğin kesmeden veya harf büyüklüğünü değiştirmeden, tam olarak doğruladığı teyit edilmelidir.", + "L": "1" + }, + { + "Shortcode": "V6.2.9", + "Ordinal": 9, + "Description": "En az 64 karakter uzunluğundaki parolalara izin verildiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V6.2.10", + "Ordinal": 10, + "Description": "Kullanıcının parolasının, yalnızca ele geçirildiği tespit edildiğinde veya kullanıcı tarafından yenilendiğinde geçerliliğini yitirdiği doğrulanmalıdır. Uygulama, belirli aralıklarla parola yenilenmesini zorunlu kılmamalıdır.", + "L": "2" + }, + { + "Shortcode": "V6.2.11", + "Ordinal": 11, + "Description": "Tahmin edilmesi kolay parolaların oluşturulmasını önlemek amacıyla, bağlama özgü kelimelerin yer aldığı belgelenmiş listenin parola doğrulamada kullanıldığı teyit edilmelidir.", + "L": "2" + }, + { + "Shortcode": "V6.2.12", + "Ordinal": 12, + "Description": "Kayıt veya parola değişikliği sırasında girilen parolaların, ele geçirilmiş parolalar listesine karşı kontrol edildiği doğrulanmalıdır.", + "L": "2" + } + ] + }, + { + "Shortcode": "V6.3", + "Ordinal": 3, + "Name": "Genel Kimlik Doğrulama Güvenliği", + "Items": [ + { + "Shortcode": "V6.3.1", + "Ordinal": 1, + "Description": "Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırıları gibi saldırıları önlemeye yönelik kontrollerin, uygulamanın güvenlik dokümantasyonuna göre uygulandığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V6.3.2", + "Ordinal": 2, + "Description": "\"root\", \"admin\" veya \"sa\" gibi varsayılan kullanıcı hesaplarının uygulamada yer almadığı veya devre dışı bırakıldığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V6.3.3", + "Ordinal": 3, + "Description": "Uygulamaya erişim için ya çok faktörlü bir kimlik doğrulama mekanizması ya da tek faktörlü mekanizmaların kombinasyonu kullanılmalıdır. Seviye 3 için, bu faktörlerden biri, oltalama saldırılarına karşı direnç sağlayan ve kimlik doğrulama niyetini bir kullanıcı etkileşimi (örneğin FIDO donanım anahtarında bir düğmeye basma veya mobil telefonda bir onay) gerektirerek doğrulayan donanım tabanlı bir kimlik doğrulayıcı olmalıdır. Bu gereksinimdeki herhangi bir esneklik için, gerekçesi belgelenmiş ve riskleri azaltıcı kapsamlı kontroller içeren bir plan gereklidir.", + "L": "2" + }, + { + "Shortcode": "V6.3.4", + "Ordinal": 4, + "Description": "Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, belgelendirilmemiş bir yol bulunmadığı ve tüm yollar için güvenlik kontrolleri ile kimlik doğrulama gücünün tutarlı şekilde uygulandığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V6.3.5", + "Ordinal": 5, + "Description": "Başarılı veya başarısız şüpheli kimlik doğrulama girişimlerinin kullanıcıya bildirildiği doğrulanmalıdır. Bu, olağandışı bir konum veya istemciden gelen girişimler, yalnızca bir faktörle yapılan kısmen başarılı doğrulamalar, uzun süreli inaktiflik sonrası yapılan girişimler veya birçok başarısız denemeden sonraki başarılı girişimler gibi durumları içerebilir.", + "L": "3" + }, + { + "Shortcode": "V6.3.6", + "Ordinal": 6, + "Description": "E-postanın, tek faktörlü ya da çok faktörlü kimlik doğrulama mekanizması olarak kullanılmadığı doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V6.3.7", + "Ordinal": 7, + "Description": "Kimlik doğrulama detaylarında yapılan güncellemeler sonrasında (örneğin kimlik bilgisi sıfırlama, kullanıcı adı veya e-posta adresi değişiklikleri), kullanıcıların bilgilendirildiği doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V6.3.8", + "Ordinal": 8, + "Description": "Başarısız kimlik doğrulama girişimlerinden, geçerli kullanıcıların hata mesajları, HTTP yanıt kodları veya farklı yanıt süreleri gibi sonuçlara dayanarak tespit edilemediği doğrulanmalıdır. Bu koruma, kayıt ve \"parolamı unuttum\" işlevselliğinde de geçerli olmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.4", + "Ordinal": 4, + "Name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", + "Items": [ + { + "Shortcode": "V6.4.1", + "Ordinal": 1, + "Description": "Sistem tarafından oluşturulan ilk parolaların veya etkinleştirme kodlarının güvenli bir şekilde rastgele üretildiği, mevcut parola politikasına uygun olduğu, kısa bir süre içinde veya ilk kullanım sonrasında geçerliliğini yitirdiği doğrulanmalıdır. Bu başlangıç sırları uzun vadeli parola olarak kullanılmasına izin verilmemelidir.", + "L": "1" + }, + { + "Shortcode": "V6.4.2", + "Ordinal": 2, + "Description": "Parola ipuçlarının veya \"gizli sorular\" olarak bilinen, bilgiye dayalı kimlik doğrulama mekanizmalarının mevcut olmadığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V6.4.3", + "Ordinal": 3, + "Description": "Unutulmuş parolanın sıfırlanması için, etkin olan çok faktörlü kimlik doğrulama mekanizmalarını atlamayan güvenli bir sürecin uygulandığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V6.4.4", + "Ordinal": 4, + "Description": "Çok faktörlü kimlik doğrulama faktörlerinden biri kaybolursa, kayıt sırasında uygulanan kimlik kanıtlama seviyesiyle aynı seviyede kimlik doğrulama yapıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V6.4.5", + "Ordinal": 5, + "Description": "Süresi dolacak kimlik doğrulama mekanizmalarının yenilenmesine ilişkin talimatların, süresi dolmadan önce tamamlanacak şekilde yeterli sürede gönderildiği ve gerekiyorsa otomatik hatırlatıcıların yapılandırıldığı doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V6.4.6", + "Ordinal": 6, + "Description": "Yönetici yetkisi olan kullanıcıların, kullanıcının parola sıfırlama sürecini başlatabildiği ancak kullanıcının yeni parolasını belirleyemediği veya değiştiremediği doğrulanmalıdır. Bu, yönetici yetkisi olan kullanıcıların, kullanıcı parolasını bilmesini engeller.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.5", + "Ordinal": 5, + "Name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "Items": [ + { + "Shortcode": "V6.5.1", + "Ordinal": 1, + "Description": "Arama sırları, bant dışı kimlik doğrulama istekleri veya kodları ve zamana dayalı tek kullanımlık parolaların (TOTP) yalnızca bir kez kullanılabildiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V6.5.2", + "Ordinal": 2, + "Description": "Uygulamanın backend tarafında saklanırken, 112 bitten az entropiye sahip (örneğin 19 rastgele harf-rakam karakteri veya 34 rastgele rakam) arama sırlarının, 32-bit rastgele bir salt içeren onaylı bir parola saklama algoritmasıyla hash’lendiği doğrulanmalıdır. Gizli bilginin entropisi 112 bit veya daha fazlaysa standart bir hash fonksiyonu kullanılabilir.", + "L": "2" + }, + { + "Shortcode": "V6.5.3", + "Ordinal": 3, + "Description": "Arama sırları, bant dışı kimlik doğrulama kodları ve zamana dayalı tek kullanımlık parola seed'lerinin, öngörülebilir değerlerden kaçınmak için Kriptografik Olarak Güvenli Sözde Rastgele Sayı Üreteci (CSPRNG) ile oluşturulduğu doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V6.5.4", + "Ordinal": 4, + "Description": "Arama sırlarının ve bant dışı kimlik doğrulama kodlarının en az 20 bit entropiye (genellikle 4 rastgele harf-rakam karakteri veya 6 rastgele rakam) sahip olduğu doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V6.5.5", + "Ordinal": 5, + "Description": "Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının ve zamana dayalı tek kullanımlık parolaların (TOTP) belirli bir ömre sahip olduğu doğrulanmalıdır. Bant dışı istekler en fazla 10 dakika, TOTP’ler ise en fazla 30 saniye geçerli olmalıdır.", + "L": "2" + }, + { + "Shortcode": "V6.5.6", + "Ordinal": 6, + "Description": "Herhangi bir kimlik doğrulama faktörünün (fiziksel cihazlar dahil) çalınması veya kaybı durumunda iptal edilebildiği doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V6.5.7", + "Ordinal": 7, + "Description": "Biyometrik kimlik doğrulama mekanizmalarının yalnızca ikincil faktör olarak, “sahip olduğunuz bir şey” veya “bildiğiniz bir şey” ile birlikte kullanıldığı doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V6.5.8", + "Ordinal": 8, + "Description": "Zamana dayalı tek kullanımlık parolaların (TOTP) doğrulamasının, güvenilir bir hizmetten alınan zaman kaynağına dayanarak yapıldığı ve güvenilir olmayan veya istemci tarafından sağlanan zaman kaynağına dayanmadığı doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.6", + "Ordinal": 6, + "Name": "Bant Dışı Kimlik Doğrulama Mekanizmaları", + "Items": [ + { + "Shortcode": "V6.6.1", + "Ordinal": 1, + "Description": "Tek kullanımlık parolaların (OTP) telefon veya SMS ile Public Switched Telephone Network (PSTN) üzerinden iletildiği kimlik doğrulama mekanizmalarının, yalnızca telefon numarası önceden doğrulanmışsa, alternatif daha güçlü yöntemler (örneğin TOTP) de sunuluyorsa ve kullanıcıya güvenlik riskleri hakkında bilgi veriliyorsa sunulduğu doğrulanmalıdır. Seviye 3 uygulamalar için telefon ve SMS seçenekleri sunulmamalıdır.", + "L": "2" + }, + { + "Shortcode": "V6.6.2", + "Ordinal": 2, + "Description": "Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının, oluşturuldukları özgün kimlik doğrulama isteğiyle bağlantılı olduğu ve daha önceki ya da sonraki bir istek için kullanılamadığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V6.6.3", + "Ordinal": 3, + "Description": "Kod tabanlı bant dışı kimlik doğrulama mekanizmalarının, oran sınırlaması ile kaba kuvvet saldırılarına karşı korunduğu doğrulanmalıdır. En az 64 bit entropiye sahip kodlar kullanılması da değerlendirilmelidir.", + "L": "2" + }, + { + "Shortcode": "V6.6.4", + "Ordinal": 4, + "Description": "Çok faktörlü kimlik doğrulama için push bildirimleri kullanılıyorsa, push bombing saldırılarına karşı oran sınırlamasının kullanıldığı doğrulanmalıdır. “Numara eşleştirme” de bu riski azaltabilir.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.7", + "Ordinal": 7, + "Name": "Kriptografik Kimlik Doğrulama Mekanizması", + "Items": [ + { + "Shortcode": "V6.7.1", + "Ordinal": 1, + "Description": "Kriptografik kimlik doğrulama beyanlarını doğrulamak için kullanılan sertifikaların, değiştirilmeye karşı korumalı şekilde saklandığı doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V6.7.2", + "Ordinal": 2, + "Description": "Challenge nonce değerinin en az 64 bit uzunluğunda olduğu ve istatistiksel olarak benzersiz ya da cihazın ömrü boyunca benzersiz olduğu doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.8", + "Ordinal": 8, + "Name": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", + "Items": [ + { + "Shortcode": "V6.8.1", + "Ordinal": 1, + "Description": "Uygulama birden fazla kimlik sağlayıcıyı (IdP) destekliyorsa, başka bir desteklenen kimlik sağlayıcı aracılığıyla (örneğin aynı kullanıcı tanımlayıcısını kullanarak) kullanıcının kimliğinin taklit edilemediği doğrulanmalıdır. Standart önlem, uygulamanın kullanıcıyı IdP kimliği (bir ad alanı işlevi görür) ve IdP içindeki kullanıcı kimliğinin birleşimiyle kaydetmesi ve tanımlamasıdır.", + "L": "2" + }, + { + "Shortcode": "V6.8.2", + "Ordinal": 2, + "Description": "Kimlik doğrulama beyanları üzerindeki dijital imzaların (örneğin JWT veya SAML beyanları) varlığı ve bütünlüğünün her zaman doğrulandığı ve imzasız veya geçersiz imzalı beyanların reddedildiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V6.8.3", + "Ordinal": 3, + "Description": "SAML beyanlarının benzersiz biçimde işlendiği ve yalnızca geçerlilik süresi içinde bir kez kullanıldığı, tekrar oynatma (replay) saldırılarını önlemek amacıyla doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V6.8.4", + "Ordinal": 4, + "Description": "Uygulama ayrı bir Kimlik Sağlayıcı (IdP) kullanıyorsa ve belirli işlemler için belirli kimlik doğrulama gücü, yöntemleri veya zaman bilgisi bekliyorsa, uygulamanın bu bilgileri IdP tarafından döndürülen veriler üzerinden doğruladığı teyit edilmelidir. Örneğin OIDC kullanılıyorsa, bu durum ID Token üzerindeki 'acr', 'amr' ve 'auth_time' gibi claim’lerin (varsa) doğrulanması ile sağlanabilir. Eğer IdP bu bilgileri sağlamıyorsa, uygulamanın asgari kimlik doğrulama gücünün kullanıldığını varsayan (örneğin yalnızca kullanıcı adı ve parola ile tek faktörlü doğrulama) belgelenmiş bir yedek yaklaşımı olmalıdır.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V7", + "Ordinal": 7, + "ShortName": "Session", + "Name": "Oturum Yönetimi", + "Items": [ + { + "Shortcode": "V7.1", + "Ordinal": 1, + "Name": "Oturum Yönetim Dokümantasyonu", + "Items": [ + { + "Shortcode": "V7.1.1", + "Ordinal": 1, + "Description": "Kullanıcının oturum inaktivite zaman aşımı süresi ve mutlak maksimum oturum süresinin belgelendiği, diğer kontrollerle birlikte uygun olduğu ve NIST SP 800-63B yeniden kimlik doğrulama gereksinimlerinden herhangi bir sapma varsa gerekçesinin belgede yer aldığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V7.1.2", + "Ordinal": 2, + "Description": "Belgede bir hesap için kaç adet eşzamanlı (paralel) oturuma izin verildiği ile birlikte, maksimum aktif oturum sayısına ulaşıldığında uygulanacak davranış ve işlemlerin tanımlandığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V7.1.3", + "Ordinal": 3, + "Description": "Birleşik kimlik yönetim ekosisteminin bir parçası olarak kullanıcı oturumu oluşturan ve yöneten tüm sistemlerin, oturum ömrü, sonlandırma ve yeniden kimlik doğrulama gerektiren diğer koşulların nasıl koordine edildiğini açıklayan kontrollerle birlikte belgede yer aldığı doğrulanmalıdır.", + "L": "2" + } + ] + }, + { + "Shortcode": "V7.2", + "Ordinal": 2, + "Name": "Temel Oturum Yönetimi Güvenliği", + "Items": [ + { + "Shortcode": "V7.2.1", + "Ordinal": 1, + "Description": "Uygulamanın tüm oturum token'ı doğrulama işlemlerini güvenilir bir backend servisi aracılığıyla gerçekleştirdiği doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V7.2.2", + "Ordinal": 2, + "Description": "Uygulamanın, statik API gizli anahtarları veya sabit değerler yerine, oturum yönetimi için dinamik olarak oluşturulan kendi kendine yeterli veya referans token'ları kullandığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V7.2.3", + "Ordinal": 3, + "Description": "Uygulama kullanıcı oturumlarını temsil etmek için referans token'ları kullanıyorsa, bu token'ların benzersiz olduğu, kriptografik olarak güvenli bir sözde rastgele sayı üreteci (CSPRNG) kullanılarak üretildiği ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V7.2.4", + "Ordinal": 4, + "Description": "Uygulamanın, kullanıcı kimlik doğrulaması (yeniden kimlik doğrulama dahil) sırasında yeni bir oturum token'ı oluşturduğu ve mevcut oturum token'ını sonlandırdığı doğrulanmalıdır.", + "L": "1" + } + ] + }, + { + "Shortcode": "V7.3", + "Ordinal": 3, + "Name": "Oturum Zaman Aşımı", + "Items": [ + { + "Shortcode": "V7.3.1", + "Ordinal": 1, + "Description": "Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde bir hareketsizlik zaman aşımı bulunduğu doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V7.3.2", + "Ordinal": 2, + "Description": "Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde mutlak bir maksimum oturum süresi bulunduğu doğrulanmalıdır.", + "L": "2" + } + ] + }, + { + "Shortcode": "V7.4", + "Ordinal": 4, + "Name": "Oturum Sonlandırma", + "Items": [ + { + "Shortcode": "V7.4.1", + "Ordinal": 1, + "Description": "Oturum sonlandırma tetiklendiğinde (örneğin, çıkış yapıldığında veya süre dolduğunda), uygulamanın oturumun daha fazla kullanılmasına izin vermediği doğrulanmalıdır. Referans token'lar veya durum bilgili oturumlar için bu, oturum verilerinin uygulama arka ucunda geçersiz kılınması anlamına gelir. Kapsamlı token kullanan uygulamaların; sonlandırılmış token listesi tutmak, kullanıcıya özel tarih ve saatten önce oluşturulan token'ları reddetmek veya kullanıcıya özel imzalama anahtarını yenilemek gibi bir çözüm uygulaması gerekir.", + "L": "1" + }, + { + "Shortcode": "V7.4.2", + "Ordinal": 2, + "Description": "Bir kullanıcı hesabı devre dışı bırakıldığında veya silindiğinde (örneğin bir çalışanın şirketten ayrılması), uygulamanın tüm aktif oturumları sonlandırdığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V7.4.3", + "Ordinal": 3, + "Description": "Herhangi bir kimlik doğrulama faktörünün başarılı bir şekilde değiştirilmesi veya kaldırılmasından (şifre sıfırlama veya kurtarma yoluyla yapılan değişiklikler dahil ve varsa MFA ayarları güncellemeleri dahil) sonra, uygulamanın diğer tüm aktif oturumları sonlandırma seçeneği sunduğu doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V7.4.4", + "Ordinal": 4, + "Description": "Kimlik doğrulama gerektiren tüm sayfalarda kolay erişilebilir ve görünür bir çıkış yap (logout) işlevi bulunduğu doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V7.4.5", + "Ordinal": 5, + "Description": "Uygulama yöneticilerinin, bireysel bir kullanıcının veya tüm kullanıcıların aktif oturumlarını sonlandırabilme yetkisine sahip olduğu doğrulanmalıdır.", + "L": "2" + } + ] + }, + { + "Shortcode": "V7.5", + "Ordinal": 5, + "Name": "Oturum Kötüye Kullanımına Karşı Savunmalar", + "Items": [ + { + "Shortcode": "V7.5.1", + "Ordinal": 1, + "Description": "E-posta adresi, telefon numarası, MFA yapılandırması veya hesap kurtarmada kullanılan diğer bilgiler gibi kimlik doğrulamayı etkileyebilecek hassas hesap özniteliklerinde değişiklik yapılmadan önce uygulamanın tam yeniden kimlik doğrulama gerektirdiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V7.5.2", + "Ordinal": 2, + "Description": "Kullanıcıların, (en az bir faktörle yeniden kimlik doğrulama yaptıktan sonra) mevcut tüm aktif oturumları görüntüleyebilmesi ve sonlandırabilmesinin mümkün olduğu doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V7.5.3", + "Ordinal": 3, + "Description": "Uygulamanın, son derece hassas işlemler veya operasyonlar gerçekleştirilmeden önce en az bir faktörle ek kimlik doğrulaması veya ikincil bir doğrulama gerektirdiği doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V7.6", + "Ordinal": 6, + "Name": "Birleşik Yeniden Kimlik Doğrulama", + "Items": [ + { + "Shortcode": "V7.6.1", + "Ordinal": 1, + "Description": "Güvenen Taraf (RP) ile Kimlik Sağlayıcı (IdP) arasındaki oturum süresi ve oturum sonlandırma davranışlarının belgelenmiş olduğu ve, örneğin IdP kimlik doğrulama olayları arasında maksimum süreye ulaşıldığında yeniden kimlik doğrulamanın gerekli kılındığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V7.6.2", + "Ordinal": 2, + "Description": "Yeni bir oturum oluşturulmasının, kullanıcı onayı veya açık bir eylem gerektirdiği; kullanıcı etkileşimi olmaksızın yeni uygulama oturumlarının oluşturulmasının önlendiği doğrulanmalıdır.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V8", + "Ordinal": 8, + "ShortName": "Authorization", + "Name": "Yetkilendirme", + "Items": [ + { + "Shortcode": "V8.1", + "Ordinal": 1, + "Name": "Yetkilendirme Dokümantasyonu", + "Items": [ + { + "Shortcode": "V8.1.1", + "Ordinal": 1, + "Description": "Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak işlev düzeyinde ve veriye özel erişim kısıtlamaları için kuralları tanımladığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V8.1.2", + "Ordinal": 2, + "Description": "Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak alan (field) düzeyinde erişim kısıtlamaları (hem okuma hem yazma) için kuralları tanımladığı doğrulanmalıdır. Bu kuralların, ilgili veri nesnesinin durum veya statü gibi diğer özniteliklerine bağlı olabileceği unutulmamalıdır.", + "L": "2" + }, + { + "Shortcode": "V8.1.3", + "Ordinal": 3, + "Description": "Uygulamanın dokümantasyonunun, kimlik doğrulama ve yetkilendirme ile ilgili güvenlik kararlarının alınmasında kullanılan çevresel ve bağlamsal öznitelikleri (günün saati, kullanıcı konumu, IP adresi veya cihaz gibi) tanımladığı doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V8.1.4", + "Ordinal": 4, + "Description": "Kimlik doğrulama ve yetkilendirme dokümantasyonunun; işlev düzeyinde, veriye özel ve alan düzeyinde yetkilendirmenin yanı sıra çevresel ve bağlamsal faktörlerin karar almada nasıl kullanıldığını tanımladığı doğrulanmalıdır. Bu, değerlendirilen öznitelikleri, risk eşiklerini ve alınan aksiyonları (ör. izin ver, doğrulama iste, reddet, step-up kimlik doğrulama) içermelidir.", + "L": "3" + } + ] + }, + { + "Shortcode": "V8.2", + "Ordinal": 2, + "Name": "Genel Yetkilendirme Tasarımı", + "Items": [ + { + "Shortcode": "V8.2.1", + "Ordinal": 1, + "Description": "Uygulamanın, işlev düzeyindeki erişimin yalnızca açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V8.2.2", + "Ordinal": 2, + "Description": "Uygulamanın, veriye özel erişimin yalnızca belirli veri öğelerine açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, doğrudan nesne referansı güvenlik açıkları (IDOR) ve bozuk nesne düzeyinde yetkilendirme (BOLA) risklerini azaltır.", + "L": "1" + }, + { + "Shortcode": "V8.2.3", + "Ordinal": 3, + "Description": "Uygulamanın, alan (field) düzeyindeki erişimin yalnızca belirli alanlara açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, bozuk nesne özelliği düzeyinde yetkilendirme (BOPLA) risklerini azaltır.", + "L": "2" + }, + { + "Shortcode": "V8.2.4", + "Ordinal": 4, + "Description": "Tüketicinin çevresel ve bağlamsal özniteliklerine (ör. günün saati, konum, IP adresi veya cihaz) dayalı uyarlanabilir güvenlik kontrollerinin, uygulama dokümantasyonunda tanımlandığı şekilde, kimlik doğrulama ve yetkilendirme kararları için uygulandığı doğrulanmalıdır. Bu kontroller, tüketici yeni bir oturum başlatmaya çalışırken ve mevcut bir oturum sırasında uygulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V8.3", + "Ordinal": 3, + "Name": "İşlem Düzeyinde Yetkilendirme", + "Items": [ + { + "Shortcode": "V8.3.1", + "Ordinal": 1, + "Description": "Uygulamanın yetkilendirme kurallarını güvenilir bir servis katmanında uyguladığı ve istemci taraflı JavaScript gibi güvenilmeyen tüketiciler tarafından değiştirilebilecek kontrollerle yetinmediği doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V8.3.2", + "Ordinal": 2, + "Description": "Yetkilendirme kararlarının temelini oluşturan değerlerdeki değişikliklerin hemen uygulandığı doğrulanmalıdır. Değişikliklerin anında uygulanamadığı durumlarda (örneğin self-contained token içindeki verilere güveniliyorsa), tüketici artık yetkili olmadığı hâlde bir işlem gerçekleştirdiğinde uyarı verecek ve değişikliği geri alacak önlemler uygulanmalıdır. Bu alternatifin bilgi sızıntısını önlemeyeceği unutulmamalıdır.", + "L": "3" + }, + { + "Shortcode": "V8.3.3", + "Ordinal": 3, + "Description": "Bir nesneye erişimin, herhangi bir aracı veya onun adına hareket eden bir servis yerine yalnızca erişimi başlatan öznenin (ör. tüketici) izinlerine dayandığı doğrulanmalıdır. Örneğin, bir tüketici kimlik doğrulama için bir self-contained token kullanarak bir web servis çağırırsa ve bu servis başka bir servisten veri talep ederse, ikinci servis izin kararlarını verirken birinci servisin makine-makine token'ı yerine tüketicinin token'ını kullanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V8.4", + "Ordinal": 4, + "Name": "Diğer Yetkilendirme Hususları", + "Items": [ + { + "Shortcode": "V8.4.1", + "Ordinal": 1, + "Description": "Multi-tenant uygulamaların, tüketici işlemlerinin izinli olmadıkları tenant'lar üzerinde asla etkili olmamasını sağlamak için tenant'lar arası kontroller kullandığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V8.4.2", + "Ordinal": 2, + "Description": "Yönetici arayüzlerine erişimin, sürekli tüketici kimlik doğrulaması, cihaz güvenlik durumu değerlendirmesi ve bağlamsal risk analizi dahil olmak üzere çok katmanlı güvenlik içerdiği doğrulanmalıdır. Yetkilendirme için yalnızca ağ konumu veya güvenilir uç noktalar yeterli olmamalıdır; ancak bu tür faktörler yetkisiz erişim olasılığını azaltabilir.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V9", + "Ordinal": 9, + "ShortName": "Self", + "Name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", + "Items": [ + { + "Shortcode": "V9.1", + "Ordinal": 1, + "Name": "Token Kaynağı ve Bütünlüğü", + "Items": [ + { + "Shortcode": "V9.1.1", + "Ordinal": 1, + "Description": "Self-contained token'ların içerikleri kabul edilmeden önce, oynama (tampering) saldırılarına karşı dijital imza veya MAC ile doğrulama yapıldığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V9.1.2", + "Ordinal": 2, + "Description": "Belirli bir bağlam için yalnızca bir allowlist üzerinde bulunan algoritmaların self-contained token oluşturmak ve doğrulamak için kullanılabildiği doğrulanmalıdır. Bu allowlist, yalnızca simetrik ya da yalnızca asimetrik algoritmaları içermeli ve kesinlikle 'None' algoritmasını içermemelidir. Hem simetrik hem de asimetrik algoritmalar desteklenmek zorundaysa, anahtar karışıklığını (key confusion) önlemek için ek kontroller uygulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V9.1.3", + "Ordinal": 3, + "Description": "Self-contained token'ları doğrulamak için kullanılan anahtar malzemesinin, token issuer için önceden yapılandırılmış güvenilir kaynaklardan alındığı doğrulanmalıdır. Bu, saldırganların güvenilmeyen kaynak ve anahtarları belirtmesini engeller. JWT ve diğer JWS yapılarında 'jku', 'x5u' ve 'jwk' gibi header'lar güvenilir kaynaklardan oluşan bir allowlist'e göre doğrulanmalıdır.", + "L": "1" + } + ] + }, + { + "Shortcode": "V9.2", + "Ordinal": 2, + "Name": "Token İçeriği", + "Items": [ + { + "Shortcode": "V9.2.1", + "Ordinal": 1, + "Description": "Token verisinde bir geçerlilik zaman aralığı (validity time span) varsa, yalnızca doğrulama zamanı bu zaman aralığı içerisindeyse token ve içeriği kabul edilmelidir. Örneğin, JWT'ler için 'nbf' ve 'exp' claim'leri doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V9.2.2", + "Ordinal": 2, + "Description": "Token'ı alan hizmetin, token içeriğini kabul etmeden önce bu token'ın doğru türde olduğunu ve sunulma amacına uygun olduğunu doğruladığı teyit edilmelidir. Örneğin, yalnızca erişim token'ları yetkilendirme kararları için, yalnızca ID Token'lar kullanıcı kimlik doğrulamasını kanıtlamak için kullanılabilir.", + "L": "2" + }, + { + "Shortcode": "V9.2.3", + "Ordinal": 3, + "Description": "Hizmetin yalnızca kendisiyle kullanılması amaçlanan (audience) token'ları kabul ettiği doğrulanmalıdır. JWT'lerde bu, 'aud' claim'inin hizmet içinde tanımlı bir allowlist ile doğrulanması yoluyla sağlanabilir.", + "L": "2" + }, + { + "Shortcode": "V9.2.4", + "Ordinal": 4, + "Description": "Eğer bir token issuer, farklı audience'lara token oluşturmak için aynı private key'i kullanıyorsa, oluşturulan token'ların hedef audience'ları benzersiz şekilde tanımlayan bir audience kısıtlaması içerdiği doğrulanmalıdır. Bu, bir token'ın farklı bir audience ile yeniden kullanılmasını önler. Audience tanımlayıcısı dinamik olarak sağlanıyorsa, token issuer bu audience'ları doğrulamalı ve audience taklitlerinin (impersonation) önüne geçmelidir.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V10", + "Ordinal": 10, + "ShortName": "OAuth", + "Name": "OAuth ve OIDC", + "Items": [ + { + "Shortcode": "V10.1", + "Ordinal": 1, + "Name": "Genel OAuth ve OIDC Güvenliği", + "Items": [ + { + "Shortcode": "V10.1.1", + "Ordinal": 1, + "Description": "Token'ların yalnızca kesinlikle ihtiyaç duyan bileşenlere gönderildiği doğrulanmalıdır. Örneğin, tarayıcı tabanlı JavaScript uygulamaları için bir backend-for-frontend modeli kullanıldığında, access ve refresh token'lara yalnızca backend'in erişebilmesi gerekir.", + "L": "2" + }, + { + "Shortcode": "V10.1.2", + "Ordinal": 2, + "Description": "Authorization server'dan gelen değerler (örneğin authorization code veya ID Token gibi) yalnızca aynı user agent oturumu ve işlemi tarafından başlatılmış bir yetkilendirme akışının sonucuysa kabul edildiği doğrulanmalıdır. Bu, client tarafından oluşturulan secret’ların 'proof key for code exchange' (PKCE) ‘code_verifier’, ‘state’ veya OIDC ‘nonce’ gibi tahmin edilemez, işleme özgü ve hem client’a hem de işlem başlatılan user agent oturumuna güvenli bir şekilde bağlı olmasını gerektirir.", + "L": "2" + } + ] + }, + { + "Shortcode": "V10.2", + "Ordinal": 2, + "Name": "OAuth İstemcisi", + "Items": [ + { + "Shortcode": "V10.2.1", + "Ordinal": 1, + "Description": "Code flow kullanılıyorsa, OAuth client’ın token taleplerini tetikleyen CSRF saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Bu genellikle PKCE kullanılarak veya authorization isteğinde gönderilen ‘state’ parametresinin kontrolü ile sağlanır.", + "L": "2" + }, + { + "Shortcode": "V10.2.2", + "Ordinal": 2, + "Description": "OAuth istemcisi birden fazla AS ile etkileşime girebiliyorsa, mix-up saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Örneğin, authorization server’ın 'iss' parametresini döndürmesi zorunlu kılınabilir ve bu parametrenin hem authorization yanıtında hem de token yanıtında doğrulanması gerekir.", + "L": "2" + }, + { + "Shortcode": "V10.2.3", + "Ordinal": 3, + "Description": "OAuth istemcisinin authorization server’a yaptığı taleplerde yalnızca gerekli scope’ları (veya diğer yetkilendirme parametrelerini) talep ettiği doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V10.3", + "Ordinal": 3, + "Name": "OAuth Kaynak Sunucusu (RS)", + "Items": [ + { + "Shortcode": "V10.3.1", + "Ordinal": 1, + "Description": "RS'nin yalnızca bu servisle kullanılmak üzere tasarlanmış access token’ları kabul ettiği doğrulanmalıdır (audience kontrolü). Audience bilgisi yapılandırılmış token’larda (örneğin JWT içindeki ‘aud’ claim’i) yer alabilir veya token introspection endpoint aracılığıyla kontrol edilebilir.", + "L": "2" + }, + { + "Shortcode": "V10.3.2", + "Ordinal": 2, + "Description": "RS'nin, access token’dan gelen claim’lere dayanarak yetki devri tanımına uygun şekilde yetkilendirme kararları uyguladığı doğrulanmalıdır. ‘sub’, ‘scope’ ve ‘authorization_details’ gibi claim’ler varsa, bu kararın parçası olmalıdır.", + "L": "2" + }, + { + "Shortcode": "V10.3.3", + "Ordinal": 3, + "Description": "Erişim kontrolü kararında, access token’dan (JWT veya ilgili token introspection yanıtı) benzersiz bir kullanıcının tanımlanması gerekiyorsa, RS'nin başka kullanıcılara devredilemeyecek claim’ler ile kullanıcıyı tanımladığı doğrulanmalıdır. Genellikle bu, ‘iss’ ve ‘sub’ claim’lerinin birlikte kullanılması anlamına gelir.", + "L": "2" + }, + { + "Shortcode": "V10.3.4", + "Ordinal": 4, + "Description": "RS'nin belirli bir kimlik doğrulama gücü, yöntemi veya güncelliği (recentness) gerektirmesi durumunda, sunulan access token’ın bu kısıtlamaları karşıladığını doğruladığı, örneğin, OIDC ‘acr’, ‘amr’ ve ‘auth_time’ claim’leri kullanılarak doğrulanmalıdır. ", + "L": "2" + }, + { + "Shortcode": "V10.3.5", + "Ordinal": 5, + "Description": "RS'nin, (yetkisiz taraflarca) çalınmış veya tekrar edilen access token’ların kullanımını önlemek için sender-constrained access token’lar kullandığı doğrulanmalıdır. Bu, OAuth 2 için Mutual TLS veya OAuth 2 Demonstration of Proof of Possession (DPoP) ile sağlanabilir.", + "L": "3" + } + ] + }, + { + "Shortcode": "V10.4", + "Ordinal": 4, + "Name": "OAuth Yetkilendirme Sunucusu (AS)", + "Items": [ + { + "Shortcode": "V10.4.1", + "Ordinal": 1, + "Description": "AS'nin, istemciye özel önceden kaydedilmiş URI’lerden oluşan bir allowlist kullanarak redirect URI’leri tam dize karşılaştırması ile doğruladığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V10.4.2", + "Ordinal": 2, + "Description": "AS'nin, \"authorization response\" içinde \"authorization code\" döndürdüğü durumlarda, bu kodun yalnızca bir kez kullanılabildiği doğrulanmalıdır. Daha önce access token vermek için kullanılmış bir authorization code ile yapılan ikinci geçerli token isteği reddedilmeli ve ilgili tüm token’lar iptal edilmelidir.", + "L": "1" + }, + { + "Shortcode": "V10.4.3", + "Ordinal": 3, + "Description": "Authorization code’un kısa ömürlü olduğu doğrulanmalıdır. L1 ve L2 uygulamalar için maksimum yaşam süresi 10 dakika, L3 uygulamalar için 1 dakikadır.", + "L": "1" + }, + { + "Shortcode": "V10.4.4", + "Ordinal": 4, + "Description": "Belirli bir istemci için AS'nin yalnızca o istemcinin ihtiyaç duyduğu grant türlerine izin verdiği doğrulanmalıdır. \"Token\" (Implicit flow) ve \"password\" (Resource Owner Password Credentials flow) grant türlerinin artık kullanılmaması gerekir.", + "L": "1" + }, + { + "Shortcode": "V10.4.5", + "Ordinal": 5, + "Description": "AS'nin, açık istemciler için refresh token replay saldırılarını azalttığı doğrulanmalıdır. Tercihen sender-constrained refresh token’lar (DPoP veya mutual TLS ile certificate-bound access token’lar) kullanılmalıdır. L1 ve L2 uygulamalar için refresh token rotation kullanılabilir. Rotation kullanılıyorsa, AS refresh token’ı kullanım sonrası geçersiz kılmalı ve geçersiz bir refresh token sunulması durumunda o yetkilendirme ile ilişkili tüm refresh token’ları iptal etmelidir.", + "L": "1" + }, + { + "Shortcode": "V10.4.6", + "Ordinal": 6, + "Description": "Code grant kullanılıyorsa, AS'nin authorization code interception saldırılarına karşı koruma sağladığı doğrulanmalıdır. Yetkilendirme isteğinde geçerli bir \"code_challenge\" değeri zorunlu olmalı ve \"code_challenge_method\" olarak \"plain\" kabul edilmemelidir. Token isteğinde ise \"code_verifier\" parametresi doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V10.4.7", + "Ordinal": 7, + "Description": "AS'nin, kimlik doğrulaması yapılmamış dinamik istemci kaydını desteklemesi durumunda, kötü niyetli istemci uygulamalarına karşı riskleri azalttığı doğrulanmalıdır. Kayıtlı URI’ler gibi client metadata’sı doğrulanmalı, kullanıcı onayı alınmalı ve güvenilmeyen bir client uygulamasıyla yapılan yetkilendirme isteği işlenmeden önce kullanıcı uyarılmalıdır.", + "L": "2" + }, + { + "Shortcode": "V10.4.8", + "Ordinal": 8, + "Description": "Refresh token’ların, sliding expiration kullanılsa bile mutlak bir sona erme süresine sahip olduğu doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V10.4.9", + "Ordinal": 9, + "Description": "Yetkili bir kullanıcı tarafından AS kullanıcı arayüzü üzerinden refresh token’ların ve reference access token’ların iptal edilebildiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V10.4.10", + "Ordinal": 10, + "Description": "Gizli istemcilerin token istekleri, pushed authorization request (PAR) ve token iptal istekleri gibi server’a yapılan backchannel isteklerinde kimliğinin kontrol edildiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V10.4.11", + "Ordinal": 11, + "Description": "AS yapılandırmasının, OAuth istemcisine yalnızca gerekli scope’ları atadığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V10.4.12", + "Ordinal": 12, + "Description": "Belirli bir client için, authorization server’ın yalnızca client’ın ihtiyaç duyduğu 'response_mode' değerine izin verdiği doğrulanmalıdır. Örneğin, bu değer ya beklenenlerle karşılaştırılarak doğrulanmalı ya da PAR veya JAR kullanılmalıdır.", + "L": "3" + }, + { + "Shortcode": "V10.4.13", + "Ordinal": 13, + "Description": "\"Code\" grant türünün daima pushed authorization request (PAR) ile birlikte kullanıldığı doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V10.4.14", + "Ordinal": 14, + "Description": "AS'nin yalnızca sender-constrained (Proof-of-Possession) access token’lar ürettiği doğrulanmalıdır. Bu, mutual TLS ile certificate-bound access token ya da DPoP ile DPoP-bound access token olabilir.", + "L": "3" + }, + { + "Shortcode": "V10.4.15", + "Ordinal": 15, + "Description": "Sunucu taraflı istemciler için (kullanıcı cihazında çalışmayan), AS'nin \"authorization_details\" parametresinin istemci backend'i tarafından sağlandığını ve kullanıcı tarafından değiştirilmediğini doğruladığı, örneğin pushed authorization request (PAR) or JWT-secured Authorization Request (JAR) zorunlu kılınarak doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V10.4.16", + "Ordinal": 16, + "Description": "Bir istemci gizli ise, AS'nin güçlü istemci kimlik doğrulama yöntemlerini zorunlu kıldığı doğrulanmalıdır. Bu yöntemler, public-key cryptography’ye dayalı ve replay saldırılarına karşı dayanıklı olmalı, örneğin mutual TLS (\"tls_client_auth\", \"self_signed_tls_client_auth\") veya private key JWT (\"private_key_jwt\") gibi.", + "L": "3" + } + ] + }, + { + "Shortcode": "V10.5", + "Ordinal": 5, + "Name": "OIDC İstemcisi", + "Items": [ + { + "Shortcode": "V10.5.1", + "Ordinal": 1, + "Description": "İstemcinin (relying party olarak) ID Token replay saldırılarını azalttığı doğrulanmalıdır. Örneğin, ID Token’daki 'nonce' claim’inin, OpenID Provider’a gönderilen kimlik doğrulama isteğindeki 'nonce' değeriyle eşleştiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V10.5.2", + "Ordinal": 2, + "Description": "İstemcinin kullanıcıyı ID Token claim’lerinden (genellikle, başka kullanıcılarla yeniden atanamayan 'sub' claim’i) benzersiz şekilde tanımladığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V10.5.3", + "Ordinal": 3, + "Description": "İstemcinin, kötü niyetli bir AS'nin başka bir AS'yi taklit etmesini AS metadata’sı üzerinden reddettiği doğrulanmalıdır. AS metadata’sındaki issuer URL’si, istemci tarafından beklenen önceden yapılandırılmış issuer URL’siyle tam olarak eşleşmiyorsa, metadata reddedilmelidir.", + "L": "2" + }, + { + "Shortcode": "V10.5.4", + "Ordinal": 4, + "Description": "İstemcinin, ID Token’ın kendisi için (audience) kullanılması amaçlandığını doğruladığı doğrulanmalıdır. Bu, token’daki 'aud' claim’inin istemcinin 'client_id' değeriyle eşit olup olmadığının kontrol edilmesiyle yapılır.", + "L": "2" + }, + { + "Shortcode": "V10.5.5", + "Ordinal": 5, + "Description": "OIDC back-channel logout kullanıldığında, relying party’nin \"forced logout\" ve \"logout\" akışında \"cross-JWT confusion\" gibi saldırılara karşı koruma sağladığı doğrulanmalıdır. Client, logout token’ın 'logout+jwt' türünde olduğunu, 'event' claim’inin doğru üyeye sahip olduğunu ve 'nonce' claim’i içermediğini doğrulamalıdır. Ayrıca token için kısa bir sona erme süresi (örneğin 2 dakika) önerilir.", + "L": "2" + } + ] + }, + { + "Shortcode": "V10.6", + "Ordinal": 6, + "Name": "OpenID Provider", + "Items": [ + { + "Shortcode": "V10.6.1", + "Ordinal": 1, + "Description": "OpenID Provider’ın yalnızca 'code', 'ciba', 'id_token' veya 'id_token code' response mode değerlerine izin verdiği doğrulanmalıdır. 'code' değeri, 'id_token code' (OIDC Hybrid flow) yerine tercih edilmelidir. 'token' (Implicit flow) kullanılmamalıdır.", + "L": "2" + }, + { + "Shortcode": "V10.6.2", + "Ordinal": 2, + "Description": "OpenID Provider’ın forced logout yoluyla yapılan hizmet reddi saldırılarını önlediği doğrulanmalıdır. Bu, son kullanıcıdan açık onay alınarak veya varsa logout isteğinde (relying party tarafından başlatılan) bulunan parametrelerin, örneğin 'id_token_hint', doğrulanmasıyla yapılabilir.", + "L": "2" + } + ] + }, + { + "Shortcode": "V10.7", + "Ordinal": 7, + "Name": "Onay (Consent) Yönetimi", + "Items": [ + { + "Shortcode": "V10.7.1", + "Ordinal": 1, + "Description": "AS'nin her yetkilendirme isteği için kullanıcının onayını aldığı doğrulanmalıdır. İstemcinin kimliği garanti altına alınamıyorsa, AS daima kullanıcıdan açıkça onay istemelidir.", + "L": "2" + }, + { + "Shortcode": "V10.7.2", + "Ordinal": 2, + "Description": "AS'nin kullanıcıdan onay istediğinde, neye onay verildiğini açık ve yeterli şekilde gösterdiği doğrulanmalıdır. Uygun olduğunda bu bilgiler, istenen yetkilendirmelerin doğasını (genellikle scope, resource server, RAR gibi detaylara dayalı), yetkilendirilmiş uygulamanın kimliğini ve bu yetkilendirmelerin süresini içermelidir.", + "L": "2" + }, + { + "Shortcode": "V10.7.3", + "Ordinal": 3, + "Description": "Kullanıcının, AS üzerinden verdiği onayları görüntüleyebildiği, değiştirebildiği ve iptal edebildiği doğrulanmalıdır.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V11", + "Ordinal": 11, + "ShortName": "Cryptography", + "Name": "Kriptografi", + "Items": [ + { + "Shortcode": "V11.1", + "Ordinal": 1, + "Name": "Kriptografik Envanter ve Dokümantasyon", + "Items": [ + { + "Shortcode": "V11.1.1", + "Ordinal": 1, + "Description": "Kriptografik anahtarların yönetimi için belgelenmiş bir politika ve NIST SP 800-57 gibi bir anahtar yönetim standardını izleyen bir kriptografik anahtar yaşam döngüsü tanımlandığı doğrulanmalıdır. Bu, anahtarların aşırı miktarda paylaşılmadığını (örneğin, paylaşılan sırlar için ikiden fazla tarafla veya özel anahtarlar için birden fazla tarafla) garanti altına almalıdır.", + "L": "2" + }, + { + "Shortcode": "V11.1.2", + "Ordinal": 2, + "Description": "Tüm kriptografik anahtarlar, algoritmalar ve uygulama tarafından kullanılan sertifikaları içeren bir kriptografik envanterin oluşturulduğu, sürdürüldüğü ve düzenli olarak güncellendiği doğrulanmalıdır. Bu envanter ayrıca, sistemde anahtarların nerede kullanılabileceğini ve kullanılamayacağını, ve hangi veri türlerinin bu anahtarlarla korunup korunamayacağını da belgelemelidir.", + "L": "2" + }, + { + "Shortcode": "V11.1.3", + "Ordinal": 3, + "Description": "Sistem içerisinde şifreleme, özetleme ve imzalama işlemleri dahil olmak üzere kriptografi kullanımının tüm örneklerini tespit etmek için kriptografik keşif mekanizmalarının kullanıldığı doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V11.1.4", + "Ordinal": 4, + "Description": "Kriptografik bir envanterin sürdürüldüğü doğrulanmalıdır. Bu envanter, gelecekteki tehditlere karşı tepki verebilmek amacıyla post-kuantum kriptografiye geçiş yolunu belirten belgelenmiş bir plan içermelidir.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.2", + "Ordinal": 2, + "Name": "Güvenli Kriptografi Uygulaması", + "Items": [ + { + "Shortcode": "V11.2.1", + "Ordinal": 1, + "Description": "Kriptografik işlemler için sektör tarafından doğrulanmış uygulamaların (kütüphaneler ve donanım hızlandırmalı uygulamalar dahil) kullanıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V11.2.2", + "Ordinal": 2, + "Description": "Uygulamanın, rastgele sayı üreticileri, kimliği doğrulanmış şifreleme, MAC veya özetleme algoritmaları, anahtar uzunlukları, turlar, şifreler ve modların herhangi bir zamanda yeniden yapılandırılabilir, yükseltilebilir veya değiştirilebilir olacağı şekilde kripto çevikliği (crypto agility) ile tasarlandığı doğrulanmalıdır. Aynı şekilde, anahtarların ve parolaların değiştirilebilmesi ve verilerin yeniden şifrelenebilmesi mümkün olmalıdır. Bu, onaylanmış PQC şemalarının yüksek güvenlikli uygulamaları yaygın olarak kullanılabilir hale geldiğinde sorunsuz geçişe olanak tanır.", + "L": "2" + }, + { + "Shortcode": "V11.2.3", + "Ordinal": 3, + "Description": "Tüm kriptografik ilkeliklerin, algoritma, anahtar boyutu ve yapılandırmaya göre minimum 128 bit güvenlik sağladığı doğrulanmalıdır. Örneğin, 256-bit ECC anahtarı yaklaşık 128 bit güvenlik sağlarken, RSA için aynı güvenliği elde etmek 3072-bit anahtar gerektirir.", + "L": "2" + }, + { + "Shortcode": "V11.2.4", + "Ordinal": 4, + "Description": "Tüm kriptografik işlemlerin sabit süreli (constant-time) olduğu, karşılaştırmalarda, hesaplamalarda veya geri dönüşlerde kısa devre (short-circuit) işlemleri yapılmadığı doğrulanmalıdır; bu, bilgi sızıntısını önlemek için gereklidir.", + "L": "3" + }, + { + "Shortcode": "V11.2.5", + "Ordinal": 5, + "Description": "Tüm kriptografik modüllerin güvenli şekilde hata verdiği ve hataların, padding oracle saldırıları gibi zafiyetleri mümkün kılmayacak şekilde ele alındığı doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.3", + "Ordinal": 3, + "Name": "Şifreleme Algoritmaları", + "Items": [ + { + "Shortcode": "V11.3.1", + "Ordinal": 1, + "Description": "Güvensiz blok modlarının (örneğin, ECB) ve zayıf doldurma (padding) şemalarının (örneğin, PKCS#1 v1.5) kullanılmadığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V11.3.2", + "Ordinal": 2, + "Description": "Yalnızca AES ile GCM gibi onaylı şifreleme algoritmalarının ve modlarının kullanıldığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V11.3.3", + "Ordinal": 3, + "Description": "Şifrelenmiş verilerin yetkisiz değişikliklere karşı korunduğu doğrulanmalıdır. Tercihen bu koruma, onaylı bir kimliği doğrulanmış şifreleme yöntemi kullanılarak ya da onaylı bir şifreleme yöntemi ile onaylı bir MAC algoritmasının kombinasyonu ile sağlanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V11.3.4", + "Ordinal": 4, + "Description": "Sayılar, başlatma vektörleri (IV) ve diğer tek kullanımlık değerlerin, aynı şifreleme anahtarı ve veri öğesi çifti için birden fazla kez kullanılmadığı doğrulanmalıdır. Oluşturma yöntemi kullanılan algoritmaya uygun olmalıdır.", + "L": "3" + }, + { + "Shortcode": "V11.3.5", + "Ordinal": 5, + "Description": "Şifreleme algoritması ve MAC algoritması kombinasyonlarının \"encrypt-then-MAC\" modunda çalıştığı doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.4", + "Ordinal": 4, + "Name": "Hashing ve Hash Tabanlı Fonksiyonlar", + "Items": [ + { + "Shortcode": "V11.4.1", + "Ordinal": 1, + "Description": "Dijital imzalar, HMAC, KDF ve rastgele bit üretimi gibi genel kriptografik kullanım senaryolarında yalnızca onaylı hash fonksiyonlarının kullanıldığı doğrulanmalıdır. MD5 gibi yasaklı hash fonksiyonları hiçbir kriptografik amaçla kullanılmamalıdır.", + "L": "1" + }, + { + "Shortcode": "V11.4.2", + "Ordinal": 2, + "Description": "Parolaların, onaylı, hesaplama açısından yoğun ve mevcut rehberliğe göre yapılandırılmış bir anahtar türetme fonksiyonu (diğer adıyla parola hash'leme fonksiyonu) kullanılarak saklandığı doğrulanmalıdır. Ayarlar, güvenlik ve performans dengesini sağlayarak kaba kuvvet saldırılarını zorlaştırmalıdır.", + "L": "2" + }, + { + "Shortcode": "V11.4.3", + "Ordinal": 3, + "Description": "Dijital imzalarda kullanılan hash fonksiyonlarının, veri bütünlüğü ve kimlik doğrulama amacıyla kullanıldığında çakışmaya karşı dayanıklı ve yeterli bit uzunluğuna sahip olduğu doğrulanmalıdır. Çakışma dayanıklılığı gerekiyorsa çıktı uzunluğu en az 256 bit olmalıdır. Sadece ikinci ön-görüntü (2nd pre-iamge) saldırılarına karşı dayanıklılık gerekiyorsa çıktı uzunluğu en az 128 bit olmalıdır.", + "L": "2" + }, + { + "Shortcode": "V11.4.4", + "Ordinal": 4, + "Description": "Parolalardan gizli anahtarlar türetilirken, onaylı anahtar türetme fonksiyonlarının anahtar uzatma (key stretching) parametreleriyle birlikte kullanıldığı doğrulanmalıdır. Bu parametreler, kaba kuvvet saldırılarını önleyecek şekilde güvenlik ve performans dengesine sahip olmalıdır.", + "L": "2" + } + ] + }, + { + "Shortcode": "V11.5", + "Ordinal": 5, + "Name": "Rastgele Değerler", + "Items": [ + { + "Shortcode": "V11.5.1", + "Ordinal": 1, + "Description": "Tahmin edilemez olması amaçlanan tüm rastgele sayıların ve dizelerin, CSPRNG ile oluşturulduğu ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. UUID'lerin bu koşulu dikkate almadığını unutmayın.", + "L": "2" + }, + { + "Shortcode": "V11.5.2", + "Ordinal": 2, + "Description": "Kullanılan rastgele sayı üretim mekanizmasının, yoğun talep altında dahi güvenli çalışacak şekilde tasarlandığı doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.6", + "Ordinal": 6, + "Name": "Açık Anahtar (Public Key) Kriptografisi", + "Items": [ + { + "Shortcode": "V11.6.1", + "Ordinal": 1, + "Description": "Anahtar üretimi, tohumlama (seeding) ve dijital imza üretimi ve doğrulama için yalnızca onaylı kriptografik algoritmalar ve çalışma modlarının kullanıldığı doğrulanmalıdır. Anahtar üretim algoritmaları, bilinen saldırılara karşı savunmasız anahtarlar üretmemelidir. Örneğin, Fermat çarpanlama yöntemine karşı savunmasız RSA anahtarları oluşturulmamalıdır.", + "L": "2" + }, + { + "Shortcode": "V11.6.2", + "Ordinal": 2, + "Description": "Anahtar değişimi için yalnızca onaylı kriptografik algoritmaların kullanıldığı doğrulanmalıdır (örneğin Diffie-Hellman). Kullanılan parametrelerin güvenli olması gerektiğine dikkat edilmelidir. Bu, anahtar kurulum sürecine yönelik saldırıları önleyecek ve araya girme (adversary-in-the-middle) ya da kriptografik kırılmaları engelleyecektir.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.7", + "Ordinal": 7, + "Name": "Kullanım Halindeki Verilerin Kriptografisi", + "Items": [ + { + "Shortcode": "V11.7.1", + "Ordinal": 1, + "Description": "Hassas verilerin kullanım sırasında korunmasını sağlamak amacıyla, yetkisiz kullanıcıların veya süreçlerin bu verilere erişmesini engelleyen tam bellek şifrelemesinin kullanıldığı doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V11.7.2", + "Ordinal": 2, + "Description": "Veri asgariyetinin sağlandığı, yani işleme sırasında mümkün olan en az miktarda verinin ortaya çıktığı ve verilerin kullanımdan hemen sonra veya mümkün olan en kısa sürede şifrelendiği doğrulanmalıdır.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V12", + "Ordinal": 12, + "ShortName": "Secure", + "Name": "Güvenli İletişim", + "Items": [ + { + "Shortcode": "V12.1", + "Ordinal": 1, + "Name": "Genel TLS Güvenlik Rehberi", + "Items": [ + { + "Shortcode": "V12.1.1", + "Ordinal": 1, + "Description": "Yalnızca TLS protokolünün en güncel ve önerilen sürümlerinin (örneğin TLS 1.2 ve TLS 1.3) etkinleştirildiği ve en son sürümün varsayılan olarak tercih edildiği doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V12.1.2", + "Ordinal": 2, + "Description": "Yalnızca önerilen şifre takımlarının (cipher suite) etkinleştirildiği ve en güçlü şifre takımlarının tercih edildiği doğrulanmalıdır. Seviye 3 (L3) uygulamalar yalnızca ileri gizlilik (forward secrecy) sağlayan şifre takımlarını desteklemelidir.", + "L": "2" + }, + { + "Shortcode": "V12.1.3", + "Ordinal": 3, + "Description": "Uygulamanın, mTLS istemci sertifikalarını kimlik doğrulama veya yetkilendirme amacıyla kullanmadan önce bu sertifikaların güvendiği sertifikalar arasında olduğunu doğruladığı kontrol edilmelidir.", + "L": "2" + }, + { + "Shortcode": "V12.1.4", + "Ordinal": 4, + "Description": "Online Certificate Status Protocol (OCSP) Stapling gibi geçerli bir sertifika iptal kontrolü yönteminin etkinleştirildiği ve yapılandırıldığı doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V12.1.5", + "Ordinal": 5, + "Description": "TLS el sıkışma (handshake) sürecinde Server Name Indication (SNI) gibi hassas meta verilerin ifşa edilmesini önlemek için, uygulamanın TLS yapılandırmasında Encrypted Client Hello (ECH) özelliğinin etkinleştirildiği doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V12.2", + "Ordinal": 2, + "Name": "Dışa Açık Hizmetlerle HTTPS İletişimi", + "Items": [ + { + "Shortcode": "V12.2.1", + "Ordinal": 1, + "Description": "İstemci ile dışa açık, HTTP tabanlı hizmetler arasındaki tüm bağlantılarda TLS kullanıldığı ve bu bağlantıların güvensiz ya da şifrelenmemiş iletişime geri dönmediği doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V12.2.2", + "Ordinal": 2, + "Description": "Dışa açık hizmetlerin herkese açık olarak güvenilen TLS sertifikaları kullandığı doğrulanmalıdır.", + "L": "1" + } + ] + }, + { + "Shortcode": "V12.3", + "Ordinal": 3, + "Name": "Genel Servisler Arası İletişim Güvenliği", + "Items": [ + { + "Shortcode": "V12.3.1", + "Ordinal": 1, + "Description": "Uygulamaya gelen ve uygulamadan çıkan tüm bağlantılarda izleme sistemleri, yönetim araçları, uzaktan erişim ve SSH, ara yazılımlar, veritabanları, ana sistemler (mainframe), iş ortağı sistemleri ya da dış API'ler dahil olmak üzere TLS gibi şifreli bir protokolün kullanıldığı ve güvensiz ya da şifrelenmemiş protokollere geri dönülmediği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V12.3.2", + "Ordinal": 2, + "Description": "TLS istemcilerinin bir TLS sunucusu ile iletişime geçmeden önce alınan sertifikaları doğruladığı kontrol edilmelidir.", + "L": "2" + }, + { + "Shortcode": "V12.3.3", + "Ordinal": 3, + "Description": "Uygulama içindeki HTTP tabanlı iç hizmetler arasında gerçekleşen tüm bağlantılarda TLS ya da uygun başka bir aktarım şifreleme mekanizmasının kullanıldığı ve güvensiz ya da şifrelenmemiş iletişime geri dönülmediği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V12.3.4", + "Ordinal": 4, + "Description": "İç hizmetler arasındaki TLS bağlantılarında güvenilir sertifikaların kullanıldığı doğrulanmalıdır. İç sistemlerde oluşturulmuş ya da kendinden imzalı (self-signed) sertifikalar kullanılıyorsa, bu sertifikalara güvenen hizmetlerin yalnızca belirli dahili sertifika otoritelerine (CA) ve belirli kendinden imzalı sertifikalara güvenecek şekilde yapılandırıldıkları doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V12.3.5", + "Ordinal": 5, + "Description": "Sistem içindeki hizmetlerin birbiriyle iletişim kurarken her bir uç noktanın kimliğini doğrulamak için güçlü kimlik doğrulama yöntemlerinin kullanıldığı doğrulanmalıdır. Bu yöntemler arasında, açık anahtar altyapısı (public-key infrastructure) kullanan ve tekrar oynatma saldırılarına karşı dayanıklı olan TLS istemci kimlik doğrulaması gibi yöntemler yer almalıdır. Mikroservis mimarilerinde, sertifika yönetimini basitleştirmek ve güvenliği artırmak amacıyla bir servis ağı (service mesh) kullanılması değerlendirilmelidir.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V13", + "Ordinal": 13, + "ShortName": "Configuration", + "Name": "Konfigürasyon", + "Items": [ + { + "Shortcode": "V13.1", + "Ordinal": 1, + "Name": "Konfigürasyon Dokümantasyonu", + "Items": [ + { + "Shortcode": "V13.1.1", + "Ordinal": 1, + "Description": "Uygulamanın tüm iletişim ihtiyaçlarının dokümante edildiği doğrulanmalıdır. Buna, uygulamanın bağımlı olduğu dış hizmetler ve son kullanıcının uygulamanın bağlantı kurmasını sağlayabileceği dış konumlar da dahil olmalıdır.", + "L": "2" + }, + { + "Shortcode": "V13.1.2", + "Ordinal": 2, + "Description": "Uygulamanın kullandığı her bir hizmet için, dokümantasyonda eşzamanlı bağlantı sayısı (örn. bağlantı havuzu limitleri) ve bu sınır aşıldığında uygulamanın davranışı, geri dönüş veya kurtarma mekanizmaları da dahil olmak üzere hizmet reddi koşullarını önlemek için tanımlandığı doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V13.1.3", + "Ordinal": 3, + "Description": "Uygulamanın, kullandığı her bir dış sistem veya hizmet (örn. veritabanları, dosya tanıtıcıları, iş parçacıkları, HTTP bağlantıları) için kaynak yönetimi stratejilerini tanımladığı doğrulanmalıdır. Bu stratejiler, kaynak serbest bırakma prosedürlerini, zaman aşımı ayarlarını, hata durumlarını ve tekrar deneme mantığı uygulanmışsa sınırları, gecikmeleri ve geri çekilme (back-off) algoritmalarını içermelidir. Senkron HTTP istek–yanıt işlemleri için kısa zaman aşımı süreleri zorunlu tutulmalı ve tekrar eden denemeler devre dışı bırakılmalı ya da sıkı şekilde sınırlandırılmalıdır.", + "L": "3" + }, + { + "Shortcode": "V13.1.4", + "Ordinal": 4, + "Description": "Uygulamanın, güvenlik açısından kritik olan gizli verileri tanımladığı ve kuruluşun tehdit modeli ve iş ihtiyaçlarına göre bu verilerin döndürülme (rotation) zamanlamasının belgelendiği doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V13.2", + "Ordinal": 2, + "Name": "Backend İletişim Konfigürasyonu", + "Items": [ + { + "Shortcode": "V13.2.1", + "Ordinal": 1, + "Description": "Uygulamanın, standart kullanıcı oturum mekanizmasını desteklemeyen backend bileşenleri (örneğin API'ler, ara katmanlar, veri katmanları) arasında gerçekleşen iletişimlerin kimlik doğrulamasıyla korunduğu doğrulanmalıdır. Kimlik doğrulama; bireysel hizmet hesapları, kısa ömürlü token'lar ya da sertifika tabanlı kimlik doğrulama ile yapılmalıdır ve parola, API anahtarı ya da ayrıcalıklı erişime sahip paylaşımlı hesaplar gibi sabit kimlik bilgileri kullanılmamalıdır.", + "L": "2" + }, + { + "Shortcode": "V13.2.2", + "Ordinal": 2, + "Description": "Uygulamanın backend bileşenleri arasında (yerel hizmetler, işletim sistemi hizmetleri, API'ler, ara katmanlar ve veri katmanları dahil) gerçekleştirilen iletişimlerin, yalnızca gerekli en az ayrıcalığa sahip hesaplarla yapıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V13.2.3", + "Ordinal": 3, + "Description": "Bir hizmet kimlik doğrulaması için bir kimlik bilgisi kullanılması gerekiyorsa, bu kimlik bilgisinin varsayılan bir değer (örneğin root/root veya admin/admin) olmadığının doğrulanması gereklidir.", + "L": "2" + }, + { + "Shortcode": "V13.2.4", + "Ordinal": 4, + "Description": "Uygulamanın iletişim kurmasına izin verilen dış kaynaklar ya da sistemlerin, bir allowlist (izinli liste) ile tanımlandığı doğrulanmalıdır. Bu liste, uygulama katmanında, web sunucusunda, güvenlik duvarında veya farklı katmanların birleşiminde uygulanabilir.", + "L": "2" + }, + { + "Shortcode": "V13.2.5", + "Ordinal": 5, + "Description": "Web veya uygulama sunucusunun, dış sistemlere veri veya dosya gönderimi veya yüklemesi yaparken sadece belirli kaynaklara izin verecek şekilde allowlist ile yapılandırıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V13.2.6", + "Ordinal": 6, + "Description": "Uygulamanın farklı hizmetlere bağlantı kurduğu durumlarda, bu bağlantılar için belgelenmiş yapılandırmaları (örn. maksimum eşzamanlı bağlantı, bağlantı limiti aşıldığında davranış, zaman aşımı, tekrar deneme stratejileri) takip ettiğinin doğrulanması gereklidir.", + "L": "3" + } + ] + }, + { + "Shortcode": "V13.3", + "Ordinal": 3, + "Name": "Gizli Bilgi Yönetimi", + "Items": [ + { + "Shortcode": "V13.3.1", + "Ordinal": 1, + "Description": "Parolalar, anahtar materyalleri, veritabanı ve üçüncü parti sistemlerle entegrasyon bilgileri, zaman tabanlı token'lar için tohum (seed) bilgileri, dahili gizli veriler ve API anahtarları gibi backend sırlarının güvenli bir şekilde oluşturulması, saklanması, erişim denetiminin sağlanması ve imha edilmesi için bir gizli bilgi yönetim çözümünün (örneğin key vault) kullanıldığı doğrulanmalıdır. Bu gizli bilgiler uygulama kaynak koduna dahil edilmemeli ve yapı çıktılarında yer almamalıdır. Seviye 3 uygulamalar için donanım destekli bir çözüm (örneğin HSM) gereklidir.", + "L": "2" + }, + { + "Shortcode": "V13.3.2", + "Ordinal": 2, + "Description": "Gizli bilgilere erişimin en az ayrıcalık prensibine uygun şekilde yapılandırıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V13.3.3", + "Ordinal": 3, + "Description": "Tüm kriptografik işlemlerin, anahtar materyallerinin güvenli bir şekilde yönetilmesi ve dışarıya sızmasının engellenmesi amacıyla, izole edilmiş bir güvenlik modülü (örneğin vault ya da donanım güvenlik modülü) aracılığıyla gerçekleştirildiği doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V13.3.4", + "Ordinal": 4, + "Description": "Uygulamanın belgelerinde belirtildiği şekilde gizli bilgilerin süresinin dolacak şekilde yapılandırıldığı ve düzenli olarak döndürüldüğü doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V13.4", + "Ordinal": 4, + "Name": "İstenmeyen Bilgi Sızıntısı", + "Items": [ + { + "Shortcode": "V13.4.1", + "Ordinal": 1, + "Description": "Uygulamanın .git veya .svn klasörleri gibi kaynak kontrolüyle ilgili metadata içermeyecek şekilde deploy edildiğini ya da bu klasörlerin hem dış erişime hem de uygulama erişimine kapalı olduğu doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V13.4.2", + "Ordinal": 2, + "Description": "Tüm bileşenler için üretim ortamlarında hata ayıklama (debug) modlarının devre dışı bırakıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V13.4.3", + "Ordinal": 3, + "Description": "Web sunucularının, açık şekilde istenmediği sürece dizin listelemesi (directory listing) özelliğini istemcilere sunmadığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V13.4.4", + "Ordinal": 4, + "Description": "HTTP TRACE metodunun üretim ortamlarında desteklenmediği, böylece potansiyel bilgi sızıntılarının önlendiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V13.4.5", + "Ordinal": 5, + "Description": "Belgeler (örneğin dahili API belgeleri) ve izleme uç noktalarının (monitoring endpoints) yalnızca açıkça belirtildiği durumlarda erişilebilir olduğu doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V13.4.6", + "Ordinal": 6, + "Description": "Uygulamanın arka uç bileşenlerinin ayrıntılı sürüm bilgilerini ifşa etmediği doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V13.4.7", + "Ordinal": 7, + "Description": "Web katmanının yalnızca belirli dosya uzantılarına sahip dosyaları sunacak şekilde yapılandırıldığı, bu sayede istem dışı bilgi, yapılandırma ya da kaynak kod sızıntılarının önlendiği doğrulanmalıdır.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V14", + "Ordinal": 14, + "ShortName": "Data", + "Name": "Veri Koruma", + "Items": [ + { + "Shortcode": "V14.1", + "Ordinal": 1, + "Name": "Veri Koruma Dokümantasyonu", + "Items": [ + { + "Shortcode": "V14.1.1", + "Ordinal": 1, + "Description": "Uygulama tarafından oluşturulan ve işlenen tüm hassas verilerin tanımlanıp, koruma seviyelerine göre sınıflandırıldığından emin olun. Bu, yalnızca kodlanmış (örneğin Base64 stringleri ya da JWT içindeki düz metin yükler gibi) ve bu nedenle kolayca çözülebilir verileri de içermelidir. Koruma seviyeleri, uygulamanın uymakla yükümlü olduğu veri koruma ve gizlilik düzenlemeleri ile standartlarını dikkate almalıdır.", + "L": "2" + }, + { + "Shortcode": "V14.1.2", + "Ordinal": 2, + "Description": "Tüm hassas veri koruma seviyeleri için belgelenmiş bir koruma gereksinimleri seti tanımlandığından emin olun. Bu gereksinimler genel şifreleme, bütünlük doğrulama, saklama süresi, verinin nasıl günlüğe kaydedileceği, günlüklerdeki hassas verilere erişim kontrolleri, veritabanı düzeyinde şifreleme, gizlilik ve gizliliği artırıcı teknolojiler ile diğer gizlilik gereksinimlerini kapsamalıdır.", + "L": "2" + } + ] + }, + { + "Shortcode": "V14.2", + "Ordinal": 2, + "Name": "Genel Veri Koruması", + "Items": [ + { + "Shortcode": "V14.2.1", + "Ordinal": 1, + "Description": "Hassas verilerin yalnızca HTTP message body veya header alanlarında sunucuya gönderildiği ve URL ile sorgu parametrelerinin, API anahtarı veya session token’ı gibi hassas bilgiler içermediği doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V14.2.2", + "Ordinal": 2, + "Description": "Hassas verilerin, yük dengeleyiciler ve uygulama önbellekleri gibi sunucu bileşenlerinde önbelleğe alınmasının engellendiği veya kullanım sonrası bu verilerin güvenli biçimde temizlendiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V14.2.3", + "Ordinal": 3, + "Description": "Uygulama kontrolü dışında veri toplanmasını engellemek için, tanımlanmış hassas verilerin, kullanıcı izleyicileri gibi güvensiz taraflara gönderilmediği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V14.2.4", + "Ordinal": 4, + "Description": "Hassas verilere yönelik şifreleme, bütünlük doğrulama, veri saklama, loglama yöntemi, loglardaki erişim kontrolleri, gizlilik teknolojileri gibi kontrollerin, söz konusu verinin belgelenmiş koruma seviyesinde tanımlandığı şekilde uygulandığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V14.2.5", + "Ordinal": 5, + "Description": "Önbellekleme mekanizmalarının yalnızca belirli içerik türüne sahip yanıtları önbelleğe alacak şekilde yapılandırıldığı ve hassas, dinamik içeriklerin önbelleğe alınmadığı doğrulanmalıdır. Web sunucusu, mevcut olmayan bir dosya talebinde geçerli ama farklı bir dosya döndürmek yerine 404 veya 302 cevabı vermelidir. Bu, Web Cache Deception saldırılarını önlemeye yardımcı olur.", + "L": "3" + }, + { + "Shortcode": "V14.2.6", + "Ordinal": 6, + "Description": "Uygulamanın yalnızca işlevsellik için gerekli olan asgari hassas veriyi döndürdüğü doğrulanmalıdır. Örneğin, kredi kartı numarasının yalnızca bazı rakamlarının döndürülmesi; tam numaranın döndürülmesi gerekiyorsa, kullanıcı arayüzünde gizlenmiş (maskelenmiş) şekilde sunulması gerekir, aksi kullanıcı özel olarak görüntülemek istemedikçe gösterilmemelidir.", + "L": "3" + }, + { + "Shortcode": "V14.2.7", + "Ordinal": 7, + "Description": "Hassas bilgilerin, veri saklama sınıflandırmasına tabi tutulduğu, geçerliliğini yitirmiş veya artık gerekli olmayan verilerin belirlenmiş bir zaman çizelgesiyle ya da gerektiğinde otomatik olarak silindiği doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V14.2.8", + "Ordinal": 8, + "Description": "Kullanıcı tarafından yüklenen dosyaların meta verilerinden hassas bilgilerin çıkarıldığı veya bu bilgilerin yalnızca kullanıcıdan açık onay alındığında saklandığı doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V14.3", + "Ordinal": 3, + "Name": "İstemci Tarafı Veri Koruması", + "Items": [ + { + "Shortcode": "V14.3.1", + "Ordinal": 1, + "Description": "Kimliği doğrulanmış verilerin, istemci veya oturum sonlandığında istemci depolamasından (örneğin tarayıcı DOM’undan) temizlendiği doğrulanmalıdır. 'Clear-Site-Data' HTTP response header bu konuda yardımcı olabilir ancak istemci tarafı, sunucu bağlantısı mevcut olmadığında da temizlik işlemini yapabiliyor olmalıdır.", + "L": "1" + }, + { + "Shortcode": "V14.3.2", + "Ordinal": 2, + "Description": "Uygulamanın, tarayıcılarda hassas verilerin önbelleğe alınmasını önlemek amacıyla yeterli anti-önbellekleme HTTP response header (örneğin Cache-Control: no-store) ayarladığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V14.3.3", + "Ordinal": 3, + "Description": "Tarayıcıda depolanan verilerin (örneğin localStorage, sessionStorage, IndexedDB veya çerezler) hassas veri içermediği, yalnızca session token’larının istisna olarak kabul edildiği doğrulanmalıdır.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V15", + "Ordinal": 15, + "ShortName": "Secure", + "Name": "Güvenli Kodlama ve Mimari", + "Items": [ + { + "Shortcode": "V15.1", + "Ordinal": 1, + "Name": "Güvenli Kodlama ve Mimari Dokümantasyonu", + "Items": [ + { + "Shortcode": "V15.1.1", + "Ordinal": 1, + "Description": "Güvenlik açığı içeren üçüncü taraf bileşen sürümleri ve genel olarak kütüphane güncellemeleri için, uygulama dokümantasyonunda risk bazlı düzeltme zamanlarının tanımlandığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V15.1.2", + "Ordinal": 2, + "Description": "Yazılım bileşen listesi (Software Bill of Materials - SBOM) gibi bir envanterin tutulduğu, kullanılan tüm üçüncü taraf kütüphanelerin önceden tanımlanmış, güvenilir ve düzenli olarak güncellenen depolardan alındığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V15.1.3", + "Ordinal": 3, + "Description": "Uygulama dokümantasyonunda zaman veya kaynak açısından yoğun işlevlerin tanımlandığı, bu işlevlerin aşırı kullanımı durumunda kullanılabilirlik kaybının nasıl önleneceği ve yanıt oluşturma süresinin istemci zaman aşımını aşmaması için hangi önlemlerin alındığı belirtilmelidir. Örnek savunmalar kuyruklama, eşzamansız işleme, kullanıcı başına ve uygulama genelinde paralel işlem sınırlarını içerebilir.", + "L": "2" + }, + { + "Shortcode": "V15.1.4", + "Ordinal": 4, + "Description": "Uygulama dokümantasyonunda \"riskli bileşenler\" olarak değerlendirilen üçüncü taraf kütüphanelerin vurgulandığı doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V15.1.5", + "Ordinal": 5, + "Description": "Uygulama dokümantasyonunda \"tehlikeli işlevsellik\" içeren uygulama bölümlerinin açıkça belirtildiği doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V15.2", + "Ordinal": 2, + "Name": "Güvenlik Mimarisi ve Bağımlılıklar", + "Items": [ + { + "Shortcode": "V15.2.1", + "Ordinal": 1, + "Description": "Uygulamanın yalnızca, belgelenmiş güncelleme ve düzeltme sürelerini aşmamış bileşenleri içerdiği doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V15.2.2", + "Ordinal": 2, + "Description": "Uygulamanın, belgelenmiş güvenlik kararları ve stratejilere dayanarak, zaman veya kaynak açısından yoğun işlevlerin neden olabileceği kullanılabilirlik kaybına karşı savunmalar uyguladığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V15.2.3", + "Ordinal": 3, + "Description": "Üretim ortamının yalnızca uygulamanın çalışması için gerekli işlevleri içerdiği ve test kodları, örnek kod parçaları veya geliştirme işlevleri gibi gereksiz işlevsellikleri açığa çıkarmadığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V15.2.4", + "Ordinal": 4, + "Description": "Üçüncü taraf bileşenlerin ve bunların tüm transitif bağımlılıklarının beklenen depolardan (iç kaynaklı ya da harici) alındığı ve bağımlılık karışıklığı (dependency confusion) saldırılarına açık olmadığı doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V15.2.5", + "Ordinal": 5, + "Description": "Uygulamanın, “tehlikeli işlevsellik” içeren veya “riskli bileşenler” kullanan bölümlerine ek korumalar uyguladığı doğrulanmalıdır. Bu korumalar sandbox, kapsülleme, konteynerleştirme veya ağ düzeyinde izolasyon gibi teknikler aracılığıyla, bir uygulama bölümünün ele geçirilmesi durumunda saldırganın diğer bölümlere sıçramasını geciktirmeyi veya engellemeyi amaçlamalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V15.3", + "Ordinal": 3, + "Name": "Savunmacı Kodlama", + "Items": [ + { + "Shortcode": "V15.3.1", + "Ordinal": 1, + "Description": "Uygulamanın yalnızca gerekli alanların bir alt kümesini veri nesnesinden döndürdüğü doğrulanmalıdır. Örneğin, bazı alanlara kullanıcıların erişmemesi gerektiğinden tüm veri nesnesi döndürülmemelidir.", + "L": "1" + }, + { + "Shortcode": "V15.3.2", + "Ordinal": 2, + "Description": "Uygulama backend'i harici URL’lere çağrı yaptığında, yalnızca amaçlanan işlevsellik söz konusuysa yönlendirmeleri takip edecek şekilde yapılandırıldığının doğrulanması gerekir.", + "L": "2" + }, + { + "Shortcode": "V15.3.3", + "Ordinal": 3, + "Description": "Uygulamanın, kitlesel atama saldırılarına karşı, her bir controller ve eylem için izin verilen alanları sınırlandırarak savunmalar sağladığı doğrulanmalıdır. Örneğin, bir alan değeri, bu işlemde değiştirilmesi amaçlanmadıysa eklenememeli veya güncellenememelidir.", + "L": "2" + }, + { + "Shortcode": "V15.3.4", + "Ordinal": 4, + "Description": "Tüm proxy ve ara katman bileşenlerinin kullanıcının orijinal IP adresini, uç kullanıcı tarafından değiştirilemeyecek güvenilir veri alanları kullanarak doğru şekilde ilettiği ve uygulamanın ve web sunucusunun bu doğru değeri, loglama ve hız sınırlama gibi güvenlik kararları için kullandığı doğrulanmalıdır. Ayrıca, orijinal IP adresinin bile dinamik IP'ler, VPN'ler veya kurumsal güvenlik duvarları nedeniyle güvenilir olmayabileceği dikkate alınmalıdır.", + "L": "2" + }, + { + "Shortcode": "V15.3.5", + "Ordinal": 5, + "Description": "Uygulamanın değişkenlerin doğru türde olduğunu açıkça doğruladığı ve sıkı eşitlik ve karşılaştırma işlemleri kullandığı doğrulanmalıdır. Bu, değişken türüyle ilgili varsayımlardan kaynaklanan tür oynama (type juggling) veya tür karışıklığı (type confusion) güvenlik açıklarını önlemek içindir.", + "L": "2" + }, + { + "Shortcode": "V15.3.6", + "Ordinal": 6, + "Description": "JavaScript kodunun prototip zehirleme (prototype pollution) saldırılarını önleyecek şekilde yazıldığı, örneğin, nesne literal’leri yerine Set() veya Map() gibi yapılar kullanıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V15.3.7", + "Ordinal": 7, + "Description": "Uygulamanın, özellikle framework'ün istek parametrelerinin kaynağı (sorgu dizgisi, gövde parametreleri, çerezler veya başlık alanları) arasında ayrım yapmadığı durumlarda, HTTP parametre kirliliği (HTTP parameter pollution) saldırılarına karşı savunmalar uyguladığı doğrulanmalıdır.", + "L": "2" + } + ] + }, + { + "Shortcode": "V15.4", + "Ordinal": 4, + "Name": "Güvenli Eş Zamanlılık (Concurrency)", + "Items": [ + { + "Shortcode": "V15.4.1", + "Ordinal": 1, + "Description": "Çok iş parçacıklı kodda (örneğin cache'ler, dosyalar veya birden fazla iş parçacığı tarafından erişilen bellek içi nesneler gibi) paylaşılan nesnelere yalnızca thread-safe (iş parçacığı güvenli) türler ve kilitleme (lock) veya semaphore gibi senkronizasyon mekanizmaları kullanılarak erişildiği doğrulanmalıdır. Bu, yarış durumlarını ve veri bozulmasını önlemeye yöneliktir.", + "L": "3" + }, + { + "Shortcode": "V15.4.2", + "Ordinal": 2, + "Description": "Bir kaynağın durumu üzerindeki kontroller (örneğin varlığı ya da izinleri gibi) ile bu kontrole bağlı eylemlerin tek bir atomik işlem olarak gerçekleştirildiği doğrulanmalıdır. Bu, TOCTOU (time-of-check to time-of-use) yarış durumlarını önlemeye yöneliktir. Bir dosyanın varlığının kontrol edilip ardından açılması veya bir kullanıcının erişiminin doğrulanıp ardından yetki verilmesi gibi işlemler buna örnektir.", + "L": "3" + }, + { + "Shortcode": "V15.4.3", + "Ordinal": 3, + "Description": "Kilitlerin (locks) tutarlı biçimde kullanıldığı, iş parçacıklarının birbirini beklemesi ya da sonsuz döngüye girmesi (deadlock veya livelock) gibi durumların önlendiği doğrulanmalıdır. Ayrıca, kilitleme mantığı, kaynağı yöneten kod içinde kalmalı ve dış sınıflar veya dış kodlar tarafından istemeden veya kötü niyetli şekilde değiştirilememelidir.", + "L": "3" + }, + { + "Shortcode": "V15.4.4", + "Ordinal": 4, + "Description": "Kaynak tahsis politikalarının, iş parçacığı açlığını önleyecek şekilde, kaynaklara adil erişimi sağladığı doğrulanmalıdır. Örneğin, thread pool (iş parçacığı havuzu) kullanımı, düşük öncelikli iş parçacıklarının da makul sürelerde çalışabilmesi için uygulanmalıdır.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V16", + "Ordinal": 16, + "ShortName": "Security", + "Name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "Items": [ + { + "Shortcode": "V16.1", + "Ordinal": 1, + "Name": "Güvenlik Loglaması Dokümantasyonu", + "Items": [ + { + "Shortcode": "V16.1.1", + "Ordinal": 1, + "Description": "Uygulamanın teknoloji yığını boyunca her katmanda hangi olayların loglandığını, log formatlarını, logların nereye yazıldığını, nasıl kullanıldığını, erişimin nasıl kontrol edildiğini ve logların ne kadar süre saklandığını belgeleyen bir envanterin mevcut olduğu doğrulanmalıdır.", + "L": "2" + } + ] + }, + { + "Shortcode": "V16.2", + "Ordinal": 2, + "Name": "Genel Loglama", + "Items": [ + { + "Shortcode": "V16.2.1", + "Ordinal": 1, + "Description": "Her bir log girdisinin, olayın ne zaman, nerede, kim tarafından ve ne olduğuna dair detaylı bir zaman çizelgesi oluşturulmasına olanak tanıyacak gerekli meta verileri içerdiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V16.2.2", + "Ordinal": 2, + "Description": "Tüm loglama bileşenlerinin zaman kaynaklarının senkronize olduğu ve güvenlik olayı meta verisindeki zaman damgalarının UTC kullanarak ya da açık zaman dilimi ofsetiyle belirtildiği doğrulanmalıdır. UTC kullanımı, özellikle yaz saati uygulamaları nedeniyle oluşabilecek karışıklıkları önlemek için tavsiye edilir.", + "L": "2" + }, + { + "Shortcode": "V16.2.3", + "Ordinal": 3, + "Description": "Uygulamanın yalnızca log envanterinde belgelenmiş dosya ve hizmetlere log yazdığı ya da ilettiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V16.2.4", + "Ordinal": 4, + "Description": "Logların kullanılan log işleyici (log processor) tarafından okunabildiği ve ilişkilendirilebildiği doğrulanmalıdır. Tercihen yaygın bir log formatı kullanılmalıdır.", + "L": "2" + }, + { + "Shortcode": "V16.2.5", + "Ordinal": 5, + "Description": "Hassas veriler loglanırken, uygulamanın veri koruma seviyesine uygun olarak loglama yaptığı doğrulanmalıdır. Örneğin kimlik bilgileri veya ödeme detayları gibi bazı verilerin loglanmasına izin verilmemelidir. Session token’ları gibi veriler ise yalnızca tamamen ya da kısmen maskelenmiş ya da hash’lenmiş olarak loglanmalıdır.", + "L": "2" + } + ] + }, + { + "Shortcode": "V16.3", + "Ordinal": 3, + "Name": "Güvenlik Olayları", + "Items": [ + { + "Shortcode": "V16.3.1", + "Ordinal": 1, + "Description": "Tüm kimlik doğrulama işlemlerinin (başarılı ve başarısız girişimler dahil) loglandığı doğrulanmalıdır. Kullanılan kimlik doğrulama türü veya faktörleri gibi ek meta veriler de toplanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V16.3.2", + "Ordinal": 2, + "Description": "Başarısız yetkilendirme girişimlerinin loglandığı doğrulanmalıdır. Seviye 3 uygulamalar için, tüm yetkilendirme kararlarının ve hassas verilere erişim olaylarının (verinin kendisi olmadan) loglandığı da doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V16.3.3", + "Ordinal": 3, + "Description": "Uygulamanın, belgelenmiş güvenlik olaylarını ve güvenlik kontrollerini aşma girişimlerini (girdi doğrulama, iş mantığı, otomasyon karşıtı kontroller vb.) logladığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V16.3.4", + "Ordinal": 4, + "Description": "Beklenmeyen hatalar ve güvenlik kontrolü başarısızlıkları (örneğin backend TLS hataları gibi) loglandığı doğrulanmalıdır.", + "L": "2" + } + ] + }, + { + "Shortcode": "V16.4", + "Ordinal": 4, + "Name": "Log Koruması", + "Items": [ + { + "Shortcode": "V16.4.1", + "Ordinal": 1, + "Description": "Tüm loglama bileşenlerinin, log enjeksiyonunu (log injection) önlemek amacıyla verileri uygun biçimde encode ettiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V16.4.2", + "Ordinal": 2, + "Description": "Logların yetkisiz erişime karşı korunduğu ve değiştirilemez olduğu doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V16.4.3", + "Ordinal": 3, + "Description": "Logların analiz, tespit, uyarı ve yükseltme amacıyla mantıksal olarak ayrı bir sisteme güvenli biçimde iletildiği doğrulanmalıdır. Böylece uygulama ihlal edilse bile logların tehlikeye girmesi önlenmiş olur.", + "L": "2" + } + ] + }, + { + "Shortcode": "V16.5", + "Ordinal": 5, + "Name": "Hata Yönetimi", + "Items": [ + { + "Shortcode": "V16.5.1", + "Ordinal": 1, + "Description": "Beklenmedik ya da güvenlikle ilgili bir hata oluştuğunda, tüketiciye genel bir mesaj döndürüldüğü ve yığın izleri (stack trace), sorgular, gizli anahtarlar, token’lar gibi hassas sistem içi verilerin açıklanmadığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V16.5.2", + "Ordinal": 2, + "Description": "Uygulamanın, dış kaynaklara erişim başarısız olduğunda bile güvenli şekilde çalışmaya devam ettiği doğrulanmalıdır. Örneğin, circuit breaker ya da graceful degradation gibi desenler kullanılmalıdır.", + "L": "2" + }, + { + "Shortcode": "V16.5.3", + "Ordinal": 3, + "Description": "Uygulamanın hata durumlarında güvenli ve düzenli şekilde başarısız olduğu doğrulanmalıdır. Bu, örneğin doğrulama hatalarına rağmen işlemlerin işlenmesine yol açabilecek fail-open durumlarını önlemelidir.", + "L": "2" + }, + { + "Shortcode": "V16.5.4", + "Ordinal": 4, + "Description": "Ele alınmamış tüm istisnaları yakalayacak şekilde tanımlanmış bir “son çare hata yöneticisi” bulunduğu doğrulanmalıdır. Bu, hem loglara gitmesi gereken hata detaylarının kaybolmaması hem de tüm uygulama sürecinin çökerek hizmet dışı kalmasının önlenmesi açısından önemlidir.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V17", + "Ordinal": 17, + "ShortName": "WebRTC", + "Name": "WebRTC", + "Items": [ + { + "Shortcode": "V17.1", + "Ordinal": 1, + "Name": "TURN Sunucusu", + "Items": [ + { + "Shortcode": "V17.1.1", + "Ordinal": 1, + "Description": "TURN hizmetinin yalnızca özel amaçlar için ayrılmamış IP adreslerine (ör. iç ağlar, yayın adresleri, loopback) erişime izin verdiği doğrulanmalıdır. Bu gereksinim hem IPv4 hem de IPv6 adresleri için geçerlidir.", + "L": "2" + }, + { + "Shortcode": "V17.1.2", + "Ordinal": 2, + "Description": "TURN hizmetinin, meşru kullanıcıların sunucuda çok sayıda bağlantı noktası açmaya çalışması durumunda kaynak tüketimi saldırılarına karşı dayanıklı olduğu doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V17.2", + "Ordinal": 2, + "Name": "Medya", + "Items": [ + { + "Shortcode": "V17.2.1", + "Ordinal": 1, + "Description": "DTLS sertifikası anahtarının, belgelenmiş kriptografik anahtar yönetim politikasına uygun şekilde yönetildiği ve korunduğu doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V17.2.2", + "Ordinal": 2, + "Description": "Medya sunucusunun onaylı DTLS şifre takımlarını (cipher suites) ve Güvenli Gerçek Zamanlı Aktarım Protokolü (Secure Real-time Transport Protocol - SRTP) için anahtarlar oluşturmaya yönelik DTLS Uzantısı için güvenli bir koruma profilini kullanacak ve destekleyecek şekilde yapılandırıldığı (DTLS-SRTP) doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V17.2.3", + "Ordinal": 3, + "Description": "Real-time Transport Protocol (RTP) injection saldırılarının bir hizmet reddi durumuna veya medya akışlarına ses veya video medyası eklenmesine yol açmasını önlemek için medya sunucusunda Güvenli SRTP kimlik doğrulamasının kontrol edildiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V17.2.4", + "Ordinal": 4, + "Description": "Verify that the media server is able to continue processing incoming media traffic when encountering malformed Secure Real-time Transport Protocol (SRTP) packets.", + "L": "2" + }, + { + "Shortcode": "V17.2.5", + "Ordinal": 5, + "Description": "Medya sunucusunun, meşru kullanıcılardan gelen SRTP flood'ı sırasında gelen medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V17.2.6", + "Ordinal": 6, + "Description": "Medya sunucusunun DTLS içinde yer alan \"ClientHello\" yarış durumu güvenlik açığına karşı savunmasız olmadığı, medya sunucusunun güvenlik açığına sahip olduğunun açıkça bilinip bilinmediği kontrol edilerek veya yarış koşulu testi gerçekleştirilerek doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V17.2.7", + "Ordinal": 7, + "Description": "Medya sunucusuna bağlı ses veya video kayıt mekanizmalarının, meşru kullanıcı kaynaklı SRTP flood'ı sırasında medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V17.2.8", + "Ordinal": 8, + "Description": "DTLS sertifikasının, SDP (Session Description Protocol) fingerprint özelliği ile karşılaştırıldığı ve doğrulama başarısız olursa medya akışının sonlandırıldığı, medya akışının özgünlüğünü sağlamak için doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V17.3", + "Ordinal": 3, + "Name": "Sinyalizasyon", + "Items": [ + { + "Shortcode": "V17.3.1", + "Ordinal": 1, + "Description": "Sinyalizasyon sunucusunun, flood saldırısı altında bile meşru sinyalizasyon mesajlarını işlemeye devam edebildiği doğrulanmalıdır. Bu, sinyalizasyon düzeyinde oran sınırlaması uygulanarak sağlanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V17.3.2", + "Ordinal": 2, + "Description": "Sinyalizasyon sunucusunun, hizmet reddine yol açabilecek şekilde yapılandırılmış bozuk sinyalizasyon mesajlarıyla karşılaştığında bile meşru mesajları işlemeye devam edebildiği doğrulanmalıdır. Bu, girdi doğrulaması, integer overflow ve buffer overflow'a karşı savunma ve sağlam hata işleme teknikleri ile sağlanmalıdır.", + "L": "2" + } + ] + } + ] + } + ] +} diff --git a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.csv b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.csv new file mode 100644 index 0000000000..5e3bcb81df --- /dev/null +++ b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.csv @@ -0,0 +1,343 @@ +chapter_id,chapter_name,section_id,section_name,req_id,req_description,level1,level2,level3,cwe,nist +V1,Kodlama (Encoding) ve Temizleme,V1.1,Kodlama ve Temizleme Mimarisi,V1.1.1,"Girdinin yalnızca bir kez kanonik forma (canonical form) çözümlendiği veya kaçış işlemlerinin kaldırıldığı, bu işlemin yalnızca verinin bu biçimde beklenmesi durumunda yapıldığı ve bu işlemin girdi doğrulama veya temizleme işlemlerinden sonra değil, önce gerçekleştiği doğrulanmalıdır.",,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.1,Kodlama ve Temizleme Mimarisi,V1.1.2,"Uygulamanın, çıktıyı kullanılması gereken yorumlayıcıya verilmeden hemen önce veya yorumlayıcının kendisi tarafından çıktı kodlaması ya da kaçış işlemi yaptığı doğrulanmalıdır.",,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.1,"HTTP yanıtı, HTML veya XML belgesi için yapılan çıktı kodlamasının; HTML elemanları, HTML öznitelikleri, HTML yorumları, CSS ya da HTTP başlık alanları gibi bağlamlara uygun olduğu doğrulanmalıdır. Böylece mesaj veya belge yapısının bozulması önlenir.",✓,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.2,"Dinamik olarak URL oluşturulurken, güvenilmeyen verinin bağlamına göre (örneğin, sorgu veya yol parametreleri için URL kodlaması ya da base64url kodlaması) kodlandığı doğrulanmalıdır. Yalnızca güvenli URL protokollerine izin verilmelidir (örneğin, javascript: veya data: yasaklanmalıdır).",✓,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.3,JavaScript içeriği (JSON dahil) dinamik olarak oluşturulurken çıktı kodlama/kaçış kullanıldığı doğrulanmalıdır. Böylece mesaj veya belge yapısı değiştirilmemiş olur (JavaScript ve JSON enjeksiyonlarının önüne geçilir).,✓,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.4,"Veri sorguları veya veritabanı sorguları (SQL, HQL, NoSQL, Cypher vb.) için parametreli sorgular, ORM’ler, entity framework’ler kullanıldığı ya da SQL enjeksiyonu ve diğer veritabanı enjeksiyon saldırılarına karşı koruma sağlandığı doğrulanmalıdır. Bu durum, saklı yordam (stored procedure) yazarken de geçerlidir.",✓,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.5,Uygulamanın işletim sistemi komut enjeksiyonlarına karşı korunduğu ve işletim sistemi çağrılarında parametreli OS sorguları veya bağlama özgü komut satırı çıktı kodlamasının kullanıldığı doğrulanmalıdır.,✓,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.6,Uygulamanın LDAP enjeksiyon zafiyetlerine karşı korunduğu ya da LDAP enjeksiyonlarını önlemek için özel güvenlik kontrollerinin uygulandığı doğrulanmalıdır.,,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.7,"XPath enjeksiyon saldırılarına karşı, sorgu parametrelemesi veya önceden derlenmiş sorgular kullanılarak koruma sağlandığı doğrulanmalıdır.",,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.8,"LaTeX işlemcilerinin güvenli şekilde yapılandırıldığı (örneğin, --shell-escape bayrağının kullanılmadığı) ve yalnızca izin verilen komutlardan oluşan bir listeyle çalıştırıldığı doğrulanmalıdır.",,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.9,Düzenli ifadelerde (regex) özel karakterlerin (genellikle ters eğik çizgi \ ile) kaçırılarak meta karakter olarak yorumlanmalarının önlendiği doğrulanmalıdır.,,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.10,"Uygulamanın CSV ve formül enjeksiyonlarına karşı korunduğu doğrulanmalıdır. Uygulama, CSV içeriği dışa aktarırken RFC 4180 Bölüm 2.6 ve 2.7'de tanımlanan kaçış kurallarına uymalıdır. Ayrıca, CSV veya diğer tablo formatlarına (XLS, XLSX, ODF gibi) aktarım yapılırken, alanın ilk karakteri olarak çıkan özel karakterler ('=', '+', '-', '@', '\t' (sekme), '\0' (null karakter)) tek tırnak (') ile kaçırılmalıdır.",,,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.1,"WYSIWYG editörlerinden veya benzer kaynaklardan gelen tüm güvenilmeyen HTML girdilerinin, bilinen ve güvenli bir HTML temizleme kütüphanesi ya da çerçeve özelliği ile temizlendiği doğrulanmalıdır.",✓,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.2,"Uygulamanın eval() veya Spring Expression Language (SpEL) gibi dinamik kod çalıştırma özelliklerini kullanmaktan kaçındığı doğrulanmalıdır. Alternatif yoksa, kullanıcı girdisi çalıştırılmadan önce mutlaka temizlenmelidir.",✓,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.3,"Potansiyel olarak tehlikeli bir bağlamda kullanılacak verilerin, bu bağlama uygun karakterlere izin vermek ve çok uzun girdileri kısaltmak gibi güvenlik önlemleriyle önceden temizlendiği doğrulanmalıdır.",,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.4,"Kullanıcı tarafından sağlanan SVG içeriğinin, yalnızca güvenli etiket ve özellikler (örneğin grafik çizme ile ilgili) içerdiğinden emin olmak için onaylandığı veya temizlendiği doğrulanmalıdır (ör. script veya foreignObject içermemelidir).",,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.5,"Markdown, CSS, XSL stil sayfaları, BBCode veya benzeri ifade şablon dillerinde kullanıcı girdisinin temizlendiği veya bu tür özelliklerin devre dışı bırakıldığı doğrulanmalıdır.",,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.6,"Uygulamanın, güvenilmeyen verileri başka servislere iletmeden önce izinli protokol, alan adı, yol ve port listelerine göre doğruladığı ve tehlikeli karakterleri temizlediği doğrulanarak SSRF (Sunucu Taraflı İstek Sahteciliği) saldırılarına karşı korunduğu doğrulanmalıdır.",,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.7,"Uygulamanın şablon enjeksiyon saldırılarına karşı, güvenilmeyen girdilere dayalı şablon oluşturmayı engellediği; eğer bu kaçınılmazsa, bu girdilerin mutlaka temizlendiği veya sıkı şekilde onaylandığı doğrulanmalıdır.",,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.8,JNDI sorgularında kullanılmadan önce güvenilmeyen girdilerin temizlendiği ve JNDI'nin enjeksiyonlara karşı güvenli şekilde yapılandırıldığı doğrulanmalıdır.,,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.9,Memcache’e gönderilmeden önce içeriğin temizlenerek enjeksiyon saldırılarına karşı korunduğu doğrulanmalıdır.,,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.10,Format dizgilerinin (format strings) beklenmeyen veya zararlı şekilde çözümlenmesini önlemek için işlenmeden önce temizlendiği doğrulanmalıdır.,,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.11,"SMTP veya IMAP enjeksiyonlarını önlemek için, kullanıcı girdisinin posta sistemlerine iletilmeden önce temizlendiği doğrulanmalıdır.",,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.12,Regex girdilerinin üstel geri izlemeye (exponential backtracking) neden olan öğeler içermediği ve güvenilmeyen girdilerin ReDoS (Regex Denial of Service) gibi saldırılara karşı temizlendiği doğrulanmalıdır.,,,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.4,"Bellek, Dizgi ve Yönetilmeyen Kod",V1.4.1,"Yığın, arabellek (buffer) veya yığın belleği taşmalarını önlemek ya da tespit etmek amacıyla, bellek güvenli dizgi işlemlerinin, daha güvenli bellek kopyalama ve işaretçi aritmetiğinin kullanıldığı doğrulanmalıdır.",,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.4,"Bellek, Dizgi ve Yönetilmeyen Kod",V1.4.2,"Tamsayı taşmalarını önlemek için işaret (sign), aralık (range) ve giriş doğrulama tekniklerinin kullanıldığı doğrulanmalıdır.",,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.4,"Bellek, Dizgi ve Yönetilmeyen Kod",V1.4.3,Dinamik olarak ayrılan belleğin ve kaynakların serbest bırakıldığı ve boşaltılan belleklere ait referansların veya işaretçilerin kaldırıldığı veya null yapıldığı doğrulanmalıdır (dangling pointer ve use-after-free zafiyetlerine karşı).,,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.5,Güvenli Ters Serileştirme (Safe Deserialization),V1.5.1,XML ayrıştırıcılarının (parser) kısıtlayıcı şekilde yapılandırıldığı ve dış varlık çözümleme (external entity resolution) gibi güvensiz özelliklerin XXE (XML eXternal Entity) saldırılarına karşı devre dışı bırakıldığı doğrulanmalıdır .,✓,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.5,Güvenli Ters Serileştirme (Safe Deserialization),V1.5.2,"Güvenilmeyen verilerin ters serileştirilmesinde, nesne türleri için izinli liste kullanımı veya istemci tanımlı nesne türlerinin kısıtlanması gibi güvenli giriş işleme önlemlerinin uygulandığı doğrulanmalıdır. Güvensiz olarak tanımlanmış ters serileştirme mekanizmaları, güvenilmeyen girdilerle kullanılmamalıdır.",,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.5,Güvenli Ters Serileştirme (Safe Deserialization),V1.5.3,"Aynı veri türü için uygulamada kullanılan farklı parser'ların (ör. JSON, XML, URL parser'ları), veriyi tutarlı şekilde ayrıştırdığı ve aynı karakter kodlamasını kullandığı doğrulanmalıdır. Böylece JSON birlikte çalışabilirlik açıkları, URI veya dosya ayrıştırma farkları gibi sorunlar nedeniyle RFI veya SSRF saldırılarının istismar edilmesi önlenir.",,,✓,, +V2,Doğrulama ve İş Mantığı,V2.1,Doğrulama ve İş Mantığı Dokümantasyonu,V2.1.1,"Uygulama dokümantasyonunda, veri öğelerinin beklenen yapıya göre nasıl doğrulanacağına ilişkin giriş doğrulama kurallarının tanımlandığı doğrulanmalıdır. Bu; kredi kartı numaraları, e-posta adresleri, telefon numaraları gibi yaygın veri biçimleri olabileceği gibi iç sistemlere özel biçimler de olabilir.",✓,✓,✓,, +V2,Doğrulama ve İş Mantığı,V2.1,Doğrulama ve İş Mantığı Dokümantasyonu,V2.1.2,"Uygulama dokümantasyonunda, birleştirilmiş veri öğelerinin mantıksal ve bağlamsal tutarlılığının nasıl doğrulanacağı tanımlanmalıdır (örneğin, mahalle ve posta kodunun eşleşip eşleşmediğinin kontrolü).",,✓,✓,, +V2,Doğrulama ve İş Mantığı,V2.1,Doğrulama ve İş Mantığı Dokümantasyonu,V2.1.3,"Hem kullanıcı bazında hem de uygulama genelinde geçerli olacak şekilde, iş mantığı sınırları ve doğrulama beklentilerinin belgelendiği doğrulanmalıdır.",,✓,✓,, +V2,Doğrulama ve İş Mantığı,V2.2,Girdi Doğrulama,V2.2.1,"Girdilerin, işlevsel ya da iş gereksinimlerine uygunluğunun doğrulandığı teyit edilmelidir. Bu işlem; izinli değerler, desenler ve aralıklar listesine karşı pozitif doğrulama ile ya da girdinin beklenen yapıya ve mantıksal sınırlara uygunluğunun önceden tanımlanmış kurallara göre karşılaştırılması ile yapılmalıdır. Seviye 1 için bu, güvenlik veya iş kararlarında kullanılan girdilere odaklanabilir. Seviye 2 ve üstü için tüm girdilere uygulanmalıdır.",✓,✓,✓,, +V2,Doğrulama ve İş Mantığı,V2.2,Girdi Doğrulama,V2.2.2,"Uygulamanın, güvenilir bir servis katmanında girdi doğrulama zorunluluğu uygulayacak şekilde tasarlandığı doğrulanmalıdır. İstemci tarafında gerçekleştirilen doğrulama, kullanılabilirliği artırabilir ve teşvik edilmelidir. Ancak bu doğrulama,güvenlik kontrolü olarak kabul edilmemelidir.",✓,✓,✓,, +V2,Doğrulama ve İş Mantığı,V2.2,Girdi Doğrulama,V2.2.3,"Uygulamanın, ilişkili veri öğelerinin önceden tanımlanmış kurallara göre makul olup olmadığını kontrol ettiği doğrulanmalıdır.",,✓,✓,, +V2,Doğrulama ve İş Mantığı,V2.3,İş Mantığı Güvenliği,V2.3.1,"Uygulamanın, aynı kullanıcı için iş mantığı akışlarını yalnızca beklenen adım sırasına göre ve adım atlamadan işlediği doğrulanmalıdır.",✓,✓,✓,, +V2,Doğrulama ve İş Mantığı,V2.3,İş Mantığı Güvenliği,V2.3.2,"İş mantığı sınırlarının, uygulama dokümantasyonuna uygun şekilde uygulandığı doğrulanmalıdır.",,✓,✓,, +V2,Doğrulama ve İş Mantığı,V2.3,İş Mantığı Güvenliği,V2.3.3,İş mantığı seviyesinde işlemlerin (transaction) kullanıldığı ve bir iş mantığı işleminin ya bütünüyle başarıyla tamamlandığı ya da önceki geçerli duruma geri döndürüldüğü (rollback) doğrulanmalıdır.,,✓,✓,, +V2,Doğrulama ve İş Mantığı,V2.3,İş Mantığı Güvenliği,V2.3.4,"İş mantığı düzeyinde kilitleme mekanizmalarının, sınırlı kaynakların (ör. sinema koltukları, teslimat zamanları) uygulamanın mantığı manipüle edilerek çift rezervasyona neden olmamasını sağladığı doğrulanmalıdır.",,✓,✓,, +V2,Doğrulama ve İş Mantığı,V2.3,İş Mantığı Güvenliği,V2.3.5,"Yüksek değerli iş mantığı akışlarının, yetkisiz veya kazara gerçekleşebilecek işlemleri önlemek için çoklu kullanıcı onayı gerektirdiği doğrulanmalıdır. Bu işlemler büyük para transferleri, sözleşme onayları, gizli bilgilere erişim veya üretimde güvenlik kurallarının geçersiz kılınmaları gibi durumları içerebilir.",,,✓,, +V2,Doğrulama ve İş Mantığı,V2.4,Otomasyon Karşıtı Önlemler,V2.4.1,"Uygulama işlevlerine yönelik aşırı miktardaki çağrılara karşı; veri sızdırma, anlamsız veri üretme, kota tüketme, hız sınırının aşılması, hizmet reddi (DoS) ya da maliyetli kaynakların aşırı kullanımı gibi risklere karşı otomasyon karşıtı kontrollerin bulunduğu doğrulanmalıdır.",,✓,✓,, +V2,Doğrulama ve İş Mantığı,V2.4,Otomasyon Karşıtı Önlemler,V2.4.2,"İş mantığı akışlarının, aşırı hızlı işlem gönderimlerini önleyecek şekilde gerçekçi insan zamanlaması gerektirdiği doğrulanmalıdır.",,,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.1,Web Frontend Güvenlik Dokümantasyonu,V3.1.1,"Uygulama dokümantasyonunda, uygulamayı kullanan tarayıcıların desteklemesi gereken güvenlik özelliklerinin (ör. HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) ve diğer ilgili HTTP güvenlik mekanizmaları) tanımlandığı doğrulanmalıdır. Ayrıca bu özelliklerin mevcut olmadığı durumlarda uygulamanın nasıl davranması gerektiği (ör. kullanıcıyı uyarmak veya erişimi engellemek) de tanımlanmalıdır.",,,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.2,İçeriğin Yanlış Yorumlanması,V3.2.1,"Tarayıcıların HTTP yanıtlarında içerik veya işlevi yanlış bir bağlamda sunmalarını önlemek amacıyla güvenlik kontrollerinin uygulandığı doğrulanmalıdır (ör. API, kullanıcı tarafından yüklenen dosya veya başka bir kaynağın doğrudan çağrılması durumunda). Olası kontroller arasında; yalnızca HTTP istek başlıklarının (ör. Sec-Fetch-\*) doğru bağlamı gösterdiği durumlarda içeriğin sunulması, Content-Security-Policy başlığında ""sandbox"" yönergesinin kullanılması veya Content-Disposition başlığında ""attachment"" biçiminin kullanılması yer alabilir.",✓,✓,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.2,İçeriğin Yanlış Yorumlanması,V3.2.2,"HTML yerine metin olarak görüntülenmesi amaçlanan içeriğin, HTML veya JavaScript gibi içeriklerin istenmeden çalıştırılmasını önleyecek şekilde ""createTextNode"" veya ""textContent"" gibi güvenli işleme fonksiyonlarıyla işlendiği doğrulanmalıdır.",✓,✓,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.2,İçeriğin Yanlış Yorumlanması,V3.2.3,"Uygulamanın istemci tarafı JavaScript kullanırken açık değişken tanımlamaları yaparak, sıkı tür kontrolü uygulayarak, global değişkenleri document nesnesine kaydetmekten kaçınarak ve ad alanı izolasyonu sağlayarak DOM clobbering’den kaçındığı doğrulanmalıdır.",,,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.3,Çerez Yapılandırması,V3.3.1,"Çerezlerin 'Secure' niteliğine sahip olduğu ve eğer çerez adı '\__Host-' ön eki ile başlamıyorsa, '__Secure-' ön ekinin kullanıldığı doğrulanmalıdır.",✓,✓,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.3,Çerez Yapılandırması,V3.3.2,"Kullanıcı arayüzü kandırma saldırılarına ve tarayıcı tabanlı istek sahteciliği saldırılarına (CSRF) karşı koruma sağlamak amacıyla, her çerezin 'SameSite' niteliğinin kullanım amacına uygun şekilde ayarlandığı doğrulanmalıdır.",,✓,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.3,Çerez Yapılandırması,V3.3.3,"Çerez adı, diğer sunucularla paylaşılmak üzere açıkça tasarlanmadığı sürece '__Host-' ön eki ile tanımlanmalıdır.",,✓,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.3,Çerez Yapılandırması,V3.3.4,"Bir çerez değeri istemci tarafı betikleri tarafından erişilememesi gereken bir veri içeriyorsa (ör. oturum token'ı), çerezin 'HttpOnly' niteliğine sahip olduğu ve aynı değerin (ör. oturum token'ı) yalnızca 'Set-Cookie' başlığı ile istemciye iletildiği doğrulanmalıdır.",,✓,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.3,Çerez Yapılandırması,V3.3.5,"Uygulama bir çerez oluştururken, çerez adı ve değerinin toplam uzunluğunun 4096 baytı aşmadığı doğrulanmalıdır. Çok büyük çerezler tarayıcı tarafından saklanmaz ve isteklerle gönderilmez; bu da çereze bağlı çalışan uygulama işlevlerinin bozulmasına yol açabilir.",,,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.2,"Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header'ı, uygulama tarafından sabit bir değer olarak tanımlanmalı veya gelen Origin header değeri güvenilir origin’lerden oluşan bir izinli listeye karşı doğrulanmalıdır. ‘Access-Control-Allow-Origin: *’ kullanılması gerekiyorsa, yanıtın hassas bilgi içermediği doğrulanmalıdır.",✓,✓,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.3,"HTTP yanıtlarında Content-Security-Policy header'ı bulunduğu ve bu header'ın yalnızca güvenilen içeriklerin veya kaynakların yüklenmesini ve çalıştırılmasını sağlayan yönergeler içerdiği doğrulanmalıdır. Minimum olarak ""global policy"", object-src 'none', base-uri 'none' yönergelerini içermeli ve izinli liste, nonce veya hash temelli bir yapı içermelidir. Seviye 3 uygulamalarında her yanıt için nonce veya hash içeren özel bir politika tanımlanmalıdır.",,✓,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.4,"Tüm HTTP yanıtlarının 'X-Content-Type-Options: nosniff' header'ını içerdiği doğrulanmalıdır. Bu, tarayıcıya içerik türünü tahmin etmeyi bırakmasını ve yanıtın Content-Type header'ında belirtilen MIME türünün, beklenen kaynak türüyle eşleşmesini zorunlu kılar. Ayrıca bu, tarayıcıda CORB (Cross-Origin Read Blocking) özelliğini etkinleştirir.",,✓,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.5,"Uygulamanın, 'Referer' başlığı yoluyla üçüncü taraflara teknik olarak hassas verilerin sızmasını önlemek için bir 'referrer policy' belirlediği doğrulanmalıdır. Bu, Referrer-Policy HTTP header'ıyla veya HTML öğe nitelikleriyle (element attributes) sağlanabilir. Sızabilecek hassas bilgiler, URL’deki yol ve sorgu parametreleri ile sınırlı uygulamalarda hostname bilgisini içerebilir.",,✓,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.6,"Uygulamanın, Content-Security-Policy header'ı altında 'frame-ancestors' yönergesini her HTTP yanıtında tanımladığı ve bu sayede içeriklerin varsayılan olarak başka sayfalara gömülmesini engellediği doğrulanmalıdır. Gerekli durumlarda özel olarak izin verildiğinden emin olunmalıdır. 'X-Frame-Options' header'ı, tarayıcılar tarafından desteklenmesine rağmen, artık güncel değildir ve güvenlik amacıyla kullanılmamalıdır.",,✓,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.8,"Bir belgenin işlenmesini ve sunulmasını başlatan tüm HTTP yanıtlarında (örneğin 'text/html' tipi yanıtlar), 'Cross-Origin-Opener-Policy' header'ı 'same-origin' veya 'same-origin-allow-popups' yönergeleriyle birlikte yer almalıdır. Bu, tabnabbing ve frame counting gibi, pencere nesnelerine paylaşımlı erişimi sömüren saldırılara karşı koruma sağlar.",,,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.1,"Uygulama, hassas işlevselliğe yönelik izinsiz cross-origin istekleri önlemek için CORS preflight mekanizmasına güvenmiyorsa, bu tür isteklerin gerçekten uygulamadan geldiği doğrulanmalıdır. Bu, anti-forgery token kullanımı veya CORS tarafından güvenli kabul edilmeyen özel HTTP header'larının zorunlu kılınmasıyla yapılabilir. Bu, tarayıcı tabanlı istek sahteciliği (CSRF) saldırılarına karşı bir savunmadır.",✓,✓,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.2,"Uygulama, hassas işlevlerin izinsiz cross-origin çağrılmasını önlemek için CORS preflight mekanizmasına güveniyorsa, bu işlevlerin bir CORS-preflight isteğini tetiklemeden çağrılamadığı doğrulanmalıdır. Bu, 'Origin' ve 'Content-Type' header'larının doğrulanmasını veya CORS-safelisted olmayan bir header'ın ve alanın kullanılmasını gerektirebilir.",✓,✓,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.4,"Farklı uygulamaların farklı hostname'lerde barındırıldığı ve böylece Same-Origin Policy tarafından sağlanan kısıtlamalardan (örneğin çerez erişim sınırları, kaynaklar arası etkileşim kontrolleri) faydalanıldığı doğrulanmalıdır.",,✓,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.6,"Uygulamanın herhangi bir yerinde JSONP işlevselliğinin etkin olmadığı doğrulanmalıdır. Bu, XSSI (Cross-Site Script Inclusion) saldırılarını önlemek içindir.",,,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.7,"Yetkilendirme gerektiren verilerin, JavaScript dosyaları gibi betik kaynaklarının yanıtlarında yer almadığı, XSSI saldırılarını önlemek için doğrulanmalıdır.",,,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.8,"Kimliği doğrulanmış kaynakların (örneğin görseller, videolar, betikler ve belgeler) yalnızca gerçekten amaçlandığında kullanıcı adına yüklenebildiği veya gömülebildiği doğrulanmalıdır. Bu, isteğin uygun olmayan bir çapraz kaynak çağrısından kaynaklanmadığından emin olmak için Sec-Fetch-* HTTP istek başlığı alanlarının sıkı bir şekilde doğrulanmasıyla veya tarayıcıya döndürülen içeriği engelleme talimatı vermek için kısıtlayıcı bir Cross-Origin-Resource-Policy HTTP yanıt başlığı alanı ayarlayarak gerçekleştirilebilir.",,,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.6,Harici Kaynak Bütünlüğü,V3.6.1,"JavaScript kütüphaneleri, CSS veya web fontları gibi istemci tarafı varlıkların yalnızca statik ve sürümlü olması, varlığın bütünlüğünü doğrulamak için Subresource Integrity (SRI) kullanılması durumunda harici olarak (örneğin, bir İçerik Dağıtım Ağı üzerinde) barındırıldığı doğrulanmalıdır. Bu mümkün değilse, her bir kaynak için bunu gerekçelendiren belgelenmiş bir güvenlik kararı bulunmalıdır.",,,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.7,Diğer Tarayıcı Güvenliği Hususları,V3.7.1,"Uygulamanın yalnızca hâlâ desteklenen ve güvenli kabul edilen istemci tarafı teknolojileri kullandığı doğrulanmalıdır. Bu gereksinimi karşılamayan teknolojilere örnek olarak NSAPI eklentileri, Flash, Shockwave, ActiveX, Silverlight, NACL veya istemci tarafı Java applet’leri verilebilir.",,✓,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.7,Diğer Tarayıcı Güvenliği Hususları,V3.7.2,"Uygulamanın, yalnızca hedef adres bir izinli listede yer alıyorsa kullanıcıyı otomatik olarak farklı bir ana makine adına veya uygulamanın kontrolünde olmayan bir etki alanına yönlendirdiği doğrulanmalıdır.",,✓,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.7,Diğer Tarayıcı Güvenliği Hususları,V3.7.3,"Uygulamanın, kullanıcı uygulamanın kontrolü dışındaki bir URL’ye yönlendirildiğinde, yönlendirme hakkında bir bildirim gösterdiği ve kullanıcının bu gezintiyi iptal edebilmesi için bir seçenek sunduğu doğrulanmalıdır.",,,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.7,Diğer Tarayıcı Güvenliği Hususları,V3.7.4,"Uygulamanın en üst düzey etki alanının (örneğin, site.tld) HTTP Strict Transport Security (HSTS) için genel preload listesine eklendiği doğrulanmalıdır. Bu, uygulamanın TLS kullanımının ana tarayıcılar tarafından doğrudan tanınmasını ve yalnızca Strict-Transport-Security yanıt header'ına bağlı kalınmamasını sağlar.",,,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.7,Diğer Tarayıcı Güvenliği Hususları,V3.7.5,"Uygulamaya erişen tarayıcının beklenen güvenlik özelliklerini desteklememesi durumunda, uygulamanın dokümantasyona uygun şekilde davrandığı (örneğin kullanıcıyı uyarma veya erişimi engelleme) doğrulanmalıdır.",,,✓,, +V4,API ve Web Servisi,V4.1,Genel Web Servisi Güvenliği,V4.1.1,"İleti gövdesi içeren her HTTP yanıtında, yanıtın gerçek içeriğiyle eşleşen bir Content-Type header alanı bulunduğu ve güvenli karakter kodlamasını (örneğin, UTF-8, ISO-8859-1) belirtmek üzere charset parametresi içerdiği doğrulanmalıdır. Bu işlem, IANA Medya Türleri'nden ""text/"", ""/+xml"" ve ""/xml"" gibi içerikler için geçerlidir.",✓,✓,✓,, +V4,API ve Web Servisi,V4.1,Genel Web Servisi Güvenliği,V4.1.2,"Yalnızca kullanıcı arayüzüne yönelik uç noktaların (manuel olarak web tarayıcısı ile erişilmesi amaçlanan) otomatik olarak HTTP'den HTTPS'e yönlendirme yaptığı ve diğer hizmetlerin veya uç noktaların şeffaf yönlendirme gerçekleştirmediği doğrulanmalıdır. Bu, istemcinin farkında olmadan şifrelenmemiş HTTP istekleri göndermesi ve bu isteklerin otomatik olarak HTTPS'e yönlendirilmesi sonucunda hassas verilerin sızmasının fark edilmemesi riskini önlemek içindir.",,✓,✓,, +V4,API ve Web Servisi,V4.1,Genel Web Servisi Güvenliği,V4.1.3,"Uygulama tarafından kullanılan ve yük dengeleyici, web proxy veya frontend için backend hizmeti gibi bir ara katman tarafından ayarlanan herhangi bir HTTP başlık alanının, son kullanıcı tarafından geçersiz kılınamayacağı doğrulanmalıdır. Örnek başlıklar arasında X-Real-IP, X-Forwarded-* veya X-User-ID yer alabilir.",,✓,✓,, +V4,API ve Web Servisi,V4.1,Genel Web Servisi Güvenliği,V4.1.4,Uygulama veya API tarafından açıkça desteklenen HTTP yöntemlerinin (preflight istekleri sırasında OPTIONS dahil) dışında hiçbir yöntemin kullanılmadığı ve kullanılmayan yöntemlerin engellendiği doğrulanmalıdır.,,,✓,, +V4,API ve Web Servisi,V4.1,Genel Web Servisi Güvenliği,V4.1.5,"Çok hassas istekler veya birçok sistemden geçen işlemler için, taşıma katmanı güvenliğinin üzerine ek bir güvence sağlamak amacıyla, her iletiye özel dijital imzaların kullanıldığı doğrulanmalıdır.",,,✓,, +V4,API ve Web Servisi,V4.2,HTTP İleti Yapısı Doğrulama,V4.2.1,"Tüm uygulama bileşenlerinin (yük dengeleyiciler, güvenlik duvarları ve uygulama sunucuları dahil) HTTP sürümüne uygun mekanizmaları kullanarak gelen HTTP iletilerinin sınırlarını belirlediği ve bu sayede HTTP istek kaçakçılığına karşı koruma sağlandığı doğrulanmalıdır. HTTP/1.x sürümünde Transfer-Encoding başlık alanı varsa, RFC 2616'ya göre Content-Length başlığı göz ardı edilmelidir. HTTP/2 veya HTTP/3 kullanıldığında, Content-Length başlığı varsa, alıcının bu değerin DATA çerçevelerinin uzunluğuyla tutarlı olduğunu doğrulaması gerekir.",,✓,✓,, +V4,API ve Web Servisi,V4.2,HTTP İleti Yapısı Doğrulama,V4.2.2,"HTTP iletileri üretilirken, Content-Length başlığının, HTTP protokolünün çerçeveleme yöntemine göre belirlenen içerik uzunluğu ile çelişmediği doğrulanmalıdır. Bu, istek kaçakçılığı saldırılarını önlemek için gereklidir.",,,✓,, +V4,API ve Web Servisi,V4.2,HTTP İleti Yapısı Doğrulama,V4.2.3,"Uygulamanın, yanıt bölme ve header enjeksiyonu saldırılarını önlemek amacıyla, bağlantıya özel başlık alanları (örneğin Transfer-Encoding) içeren HTTP/2 veya HTTP/3 iletilerini göndermediği ve kabul etmediği doğrulanmalıdır.",,,✓,, +V4,API ve Web Servisi,V4.2,HTTP İleti Yapısı Doğrulama,V4.2.4,"Uygulamanın yalnızca başlık alanları ve değerleri CR (\r), LF (\n) veya CRLF (\r\n) karakter dizileri içermeyen HTTP/2 ve HTTP/3 isteklerini kabul ettiği doğrulanmalıdır. Bu, başlık enjeksiyonu saldırılarını önlemek içindir.",,,✓,, +V4,API ve Web Servisi,V4.2,HTTP İleti Yapısı Doğrulama,V4.2.5,"Uygulama (backend veya frontend) istek oluşturuyor ve gönderiyorsa, URI'ler (örneğin API çağrıları için) veya HTTP istek başlıkları (örneğin Authorization veya Cookie) gibi bileşenlerin, alıcı sistemler tarafından kabul edilemeyecek kadar uzun olmamasını sağlamak amacıyla doğrulama, temizleme veya diğer mekanizmaları kullandığı doğrulanmalıdır. Bu tür çok uzun istekler (örneğin çok uzun bir Cookie başlığı) gönderildiğinde sunucunun sürekli hata durumu döndürmesiyle hizmet reddi oluşabilir.",,,✓,, +V4,API ve Web Servisi,V4.3,GraphQL,V4.3.1,"Maliyetli ve iç içe geçmiş sorgular sonucu oluşabilecek GraphQL veya veri katmanı ifadelerine yönelik Hizmet Reddi (DoS) saldırılarını önlemek için, sorgu izin listesi (allowlist), derinlik sınırlandırması, sorgu sayısı sınırlandırması veya sorgu maliyeti analizi kullanıldığı doğrulanmalıdır.",,✓,✓,, +V4,API ve Web Servisi,V4.3,GraphQL,V4.3.2,"GraphQL introspection (iç yapı sorgulama) sorgularının, GraphQL API'nin üçüncü taraflar tarafından kullanılmasına yönelik olmadığı sürece, üretim ortamında devre dışı bırakıldığı doğrulanmalıdır.",,✓,✓,, +V4,API ve Web Servisi,V4.4,WebSocket,V4.4.1,Tüm WebSocket bağlantılarında TLS üzerinden WebSocket (WSS) kullanıldığı doğrulanmalıdır.,✓,✓,✓,, +V4,API ve Web Servisi,V4.4,WebSocket,V4.4.2,"WebSocket'in başlangıçtaki HTTP el sıkışması (handshake) sırasında, Origin başlık alanının uygulama için izin verilen origin listesiyle karşılaştırılarak kontrol edildiği doğrulanmalıdır.",,✓,✓,, +V4,API ve Web Servisi,V4.4,WebSocket,V4.4.3,"Uygulamanın standart oturum yönetimi kullanılamıyorsa, bunun yerine ilgili Oturum Yönetimi güvenlik gereksinimlerine uygun özel token'ların kullanıldığı doğrulanmalıdır.",,✓,✓,, +V4,API ve Web Servisi,V4.4,WebSocket,V4.4.4,"HTTPS oturumu WebSocket kanalına geçerken, özel WebSocket oturum yönetim token’larının önceki şekilde kimliği doğrulanmış HTTPS oturumu aracılığıyla elde edildiği veya doğrulandığı doğrulanmalıdır.",,✓,✓,, +V5,Dosya İşleme,V5.1,Dosya İşleme Dokümantasyonu,V5.1.1,"Dokümantasyonun, her yükleme özelliği için izin verilen dosya türlerini, beklenen dosya uzantılarını ve maksimum boyutu (açılmış hali dahil) tanımladığı doğrulanmalıdır. Ayrıca, dosyaların son kullanıcılar için nasıl güvenli hâle getirileceği (örneğin kötü amaçlı bir dosya tespit edildiğinde uygulamanın nasıl davranacağı) gibi bilgilerin de belgede yer aldığı doğrulanmalıdır.",,✓,✓,, +V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.1,"Uygulamanın, yalnızca performans kaybına veya hizmet reddine yol açmayacak boyuttaki dosyaları kabul ettiği doğrulanmalıdır.",✓,✓,✓,, +V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.2,"Uygulama bir dosyayı, doğrudan veya bir arşiv (ör. zip dosyası) içinde kabul ettiğinde, dosya uzantısının beklenen uzantıyla eşleşip eşleşmediğini kontrol ettiği ve içeriğin uzantı tarafından temsil edilen türle uyumlu olduğunu doğruladığı kontrol edilmelidir. Bu; ilk 'magic byte' kontrolü, görüntü yeniden yazımı ve dosya içeriği doğrulama için özel kütüphanelerin kullanımı gibi yöntemleri içerir. Seviye 1 için bu, yalnızca iş veya güvenlik kararlarında kullanılan dosyalarla sınırlı olabilir. Seviye 2 ve üzeri için tüm dosyalar bu kontrole tabi olmalıdır.",✓,✓,✓,, +V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.3,"Sıkıştırılmış dosyaların (ör. zip, gz, docx, odt) açılmadan önce, izin verilen maksimum açılmış boyuta ve maksimum dosya sayısına göre kontrol edildiği doğrulanmalıdır.",,✓,✓,, +V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.4,Her kullanıcı için dosya boyutu kotası ve maksimum dosya sayısının uygulandığı doğrulanmalıdır. Böylece tek bir kullanıcının çok sayıda veya aşırı büyük dosya yükleyerek depolama alanını doldurması engellenir.,,,✓,, +V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.5,"Uygulamanın, içinde sembolik bağlantılar (symlink) bulunan sıkıştırılmış dosyaların yüklenmesine yalnızca bu durum özel olarak gerekli olduğunda izin verdiği doğrulanmalıdır. Bu durumda, sembolik bağlantı verilebilecek dosyaların bir izinli listesi uygulanmalıdır.",,,✓,, +V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.6,"Uygulamanın, piksel boyutu izin verilen maksimum değeri aşan görüntü dosyalarının yüklenmesini reddettiği doğrulanmalıdır. Bu, pixel flood saldırılarını önlemek için gereklidir.",,,✓,, +V5,Dosya İşleme,V5.3,Dosya Depolama,V5.3.1,"Güvenilmeyen girdilerle yüklenen veya oluşturulan ve herkese açık klasörlerde depolanan dosyaların, bir HTTP isteğiyle doğrudan erişildiğinde sunucu taraflı program kodu olarak çalıştırılmadığı doğrulanmalıdır.",✓,✓,✓,, +V5,Dosya İşleme,V5.3,Dosya Depolama,V5.3.2,"Uygulamanın, dosya işlemleri için dosya yollarını oluştururken kullanıcı tarafından gönderilen dosya adlarını değil, dahili olarak oluşturulan veya güvenilir verileri kullandığı; eğer kullanıcı tarafından gönderilen dosya adları veya meta veriler kullanılacaksa, sıkı doğrulama ve temizleme işlemlerinin uygulandığı doğrulanmalıdır. Bu, yol geçişi (path traversal), yerel veya uzak dosya dahil etme (LFI, RFI) ve sunucu tarafı istek sahteciliği (SSRF) saldırılarına karşı koruma sağlar.",✓,✓,✓,, +V5,Dosya İşleme,V5.3,Dosya Depolama,V5.3.3,"Sunucu tarafında gerçekleşen dosya işlemlerinin (örneğin dosya açma/decompress işlemi), kullanıcı tarafından sağlanan yol bilgilerini yok saydığı ve zip slip gibi güvenlik açıklarını önlediği doğrulanmalıdır.",,,✓,, +V5,Dosya İşleme,V5.4,Dosya İndirme,V5.4.1,"Uygulamanın, kullanıcı tarafından gönderilen dosya adlarını (ör. JSON, JSONP veya URL parametresinde) doğruladığı veya göz ardı ettiği ve yanıtın Content-Disposition başlık alanında bir dosya adı belirttiği doğrulanmalıdır.",,✓,✓,, +V5,Dosya İşleme,V5.4,Dosya İndirme,V5.4.2,"Sunulan dosya adlarının (örneğin HTTP yanıt header'larında veya e-posta eklerinde), belge yapısını korumak ve enjeksiyon saldırılarını önlemek için kodlandığı veya temizlendiği (ör. RFC 6266’ya uygun) doğrulanmalıdır.",,✓,✓,, +V5,Dosya İşleme,V5.4,Dosya İndirme,V5.4.3,"Güvenilmeyen kaynaklardan elde edilen dosyaların, bilinen kötü amaçlı içeriklerin sunulmasını önlemek amacıyla antivirüs tarayıcılarıyla tarandığı doğrulanmalıdır.",,✓,✓,, +V6,Kimlik Doğrulama,V6.1,Kimlik Doğrulama Dokümantasyonu,V6.1.1,"Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırılarına karşı oran sınırlama (rate limiting), otomasyon karşıtı önlemler ve uyarlanabilir yanıt gibi kontrollerin nasıl kullanıldığını açıklayan bir uygulama dokümantasyonu bulunduğu doğrulanmalıdır. Dokümantasyon, bu kontrollerin nasıl yapılandırıldığını ve kötü niyetli hesap kilitlemenin nasıl önlendiğini açıkça ortaya koymalıdır.",✓,✓,✓,, +V6,Kimlik Doğrulama,V6.1,Kimlik Doğrulama Dokümantasyonu,V6.1.2,"Parolalarda kullanılmasını önlemek amacıyla, bağlama özgü sözcüklerin (örneğin kurum adlarının permütasyonları, ürün adları, sistem tanımlayıcıları, proje kod adları, departman veya rol adları vb.) bulunduğu belgelenmiş bir liste mevcut olduğu doğrulanmalıdır.",,✓,✓,, +V6,Kimlik Doğrulama,V6.1,Kimlik Doğrulama Dokümantasyonu,V6.1.3,"Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, bunların tümünün belgelenmiş olduğu ve her yol için tutarlı şekilde uygulanması gereken güvenlik kontrolleri ile kimlik doğrulama gücünün tanımlandığı doğrulanmalıdır.",,✓,✓,, +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.1,"Kullanıcı tarafından belirlenen parolaların en az 8 karakter uzunluğunda olması sağlanmalı, ancak 15 karakter ve üzeri uzunlukta parolalar olmaları şiddetle tavsiye edilir.",✓,✓,✓,, +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.2,Kullanıcıların parolalarını değiştirebilmeleri sağlanmalıdır.,✓,✓,✓,, +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.3,Parola değiştirme işlevinin hem mevcut hem de yeni parolayı gerektirdiği doğrulanmalıdır.,✓,✓,✓,, +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.4,"Kayıt veya parola değişimi sırasında girilen parolaların, uygulamanın parola politikasına (örneğin minimum uzunluk) uyan ilk 3000 yaygın parolaya karşı kontrol edildiği doğrulanmalıdır.",✓,✓,✓,, +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.5,"Her tür karakterin kullanılmasına izin verildiği ve büyük/küçük harf, sayı veya özel karakter şartlarının zorunlu tutulmadığı doğrulanmalıdır.",✓,✓,✓,, +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.6,"Parola giriş alanlarının, girdiyi maskelemek için ""type=password"" kullandığı doğrulanmalıdır. Uygulamalar, kullanıcının tüm maskelenmiş parolayı ya da son girilen karakteri geçici olarak görüntülemesine izin verebilir.",✓,✓,✓,, +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.7,"""Yapıştır"" özelliğinin, tarayıcı parola yardımcılarının ve harici parola yöneticilerinin kullanımına izin verildiği doğrulanmalıdır.",✓,✓,✓,, +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.8,"Uygulamanın, kullanıcıdan aldığı parolayı herhangi bir şekilde değiştirmeden, örneğin kesmeden veya harf büyüklüğünü değiştirmeden, tam olarak doğruladığı teyit edilmelidir.",✓,✓,✓,, +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.9,En az 64 karakter uzunluğundaki parolalara izin verildiği doğrulanmalıdır.,,✓,✓,, +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.10,"Kullanıcının parolasının, yalnızca ele geçirildiği tespit edildiğinde veya kullanıcı tarafından yenilendiğinde geçerliliğini yitirdiği doğrulanmalıdır. Uygulama, belirli aralıklarla parola yenilenmesini zorunlu kılmamalıdır.",,✓,✓,, +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.11,"Tahmin edilmesi kolay parolaların oluşturulmasını önlemek amacıyla, bağlama özgü kelimelerin yer aldığı belgelenmiş listenin parola doğrulamada kullanıldığı teyit edilmelidir.",,✓,✓,, +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.12,"Kayıt veya parola değişikliği sırasında girilen parolaların, ele geçirilmiş parolalar listesine karşı kontrol edildiği doğrulanmalıdır.",,✓,✓,, +V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.1,"Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırıları gibi saldırıları önlemeye yönelik kontrollerin, uygulamanın güvenlik dokümantasyonuna göre uygulandığı doğrulanmalıdır.",✓,✓,✓,, +V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.2,"""root"", ""admin"" veya ""sa"" gibi varsayılan kullanıcı hesaplarının uygulamada yer almadığı veya devre dışı bırakıldığı doğrulanmalıdır.",✓,✓,✓,, +V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.3,"Uygulamaya erişim için ya çok faktörlü bir kimlik doğrulama mekanizması ya da tek faktörlü mekanizmaların kombinasyonu kullanılmalıdır. Seviye 3 için, bu faktörlerden biri, oltalama saldırılarına karşı direnç sağlayan ve kimlik doğrulama niyetini bir kullanıcı etkileşimi (örneğin FIDO donanım anahtarında bir düğmeye basma veya mobil telefonda bir onay) gerektirerek doğrulayan donanım tabanlı bir kimlik doğrulayıcı olmalıdır. Bu gereksinimdeki herhangi bir esneklik için, gerekçesi belgelenmiş ve riskleri azaltıcı kapsamlı kontroller içeren bir plan gereklidir.",,✓,✓,, +V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.4,"Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, belgelendirilmemiş bir yol bulunmadığı ve tüm yollar için güvenlik kontrolleri ile kimlik doğrulama gücünün tutarlı şekilde uygulandığı doğrulanmalıdır.",,✓,✓,, +V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.5,"Başarılı veya başarısız şüpheli kimlik doğrulama girişimlerinin kullanıcıya bildirildiği doğrulanmalıdır. Bu, olağandışı bir konum veya istemciden gelen girişimler, yalnızca bir faktörle yapılan kısmen başarılı doğrulamalar, uzun süreli inaktiflik sonrası yapılan girişimler veya birçok başarısız denemeden sonraki başarılı girişimler gibi durumları içerebilir.",,,✓,, +V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.6,"E-postanın, tek faktörlü ya da çok faktörlü kimlik doğrulama mekanizması olarak kullanılmadığı doğrulanmalıdır.",,,✓,, +V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.7,"Kimlik doğrulama detaylarında yapılan güncellemeler sonrasında (örneğin kimlik bilgisi sıfırlama, kullanıcı adı veya e-posta adresi değişiklikleri), kullanıcıların bilgilendirildiği doğrulanmalıdır.",,,✓,, +V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.8,"Başarısız kimlik doğrulama girişimlerinden, geçerli kullanıcıların hata mesajları, HTTP yanıt kodları veya farklı yanıt süreleri gibi sonuçlara dayanarak tespit edilemediği doğrulanmalıdır. Bu koruma, kayıt ve ""parolamı unuttum"" işlevselliğinde de geçerli olmalıdır.",,,✓,, +V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.1,"Sistem tarafından oluşturulan ilk parolaların veya etkinleştirme kodlarının güvenli bir şekilde rastgele üretildiği, mevcut parola politikasına uygun olduğu, kısa bir süre içinde veya ilk kullanım sonrasında geçerliliğini yitirdiği doğrulanmalıdır. Bu başlangıç sırları uzun vadeli parola olarak kullanılmasına izin verilmemelidir.",✓,✓,✓,, +V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.2,"Parola ipuçlarının veya ""gizli sorular"" olarak bilinen, bilgiye dayalı kimlik doğrulama mekanizmalarının mevcut olmadığı doğrulanmalıdır.",✓,✓,✓,, +V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.3,"Unutulmuş parolanın sıfırlanması için, etkin olan çok faktörlü kimlik doğrulama mekanizmalarını atlamayan güvenli bir sürecin uygulandığı doğrulanmalıdır.",,✓,✓,, +V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.4,"Çok faktörlü kimlik doğrulama faktörlerinden biri kaybolursa, kayıt sırasında uygulanan kimlik kanıtlama seviyesiyle aynı seviyede kimlik doğrulama yapıldığı doğrulanmalıdır.",,✓,✓,, +V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.5,"Süresi dolacak kimlik doğrulama mekanizmalarının yenilenmesine ilişkin talimatların, süresi dolmadan önce tamamlanacak şekilde yeterli sürede gönderildiği ve gerekiyorsa otomatik hatırlatıcıların yapılandırıldığı doğrulanmalıdır.",,,✓,, +V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.6,"Yönetici yetkisi olan kullanıcıların, kullanıcının parola sıfırlama sürecini başlatabildiği ancak kullanıcının yeni parolasını belirleyemediği veya değiştiremediği doğrulanmalıdır. Bu, yönetici yetkisi olan kullanıcıların, kullanıcı parolasını bilmesini engeller.",,,✓,, +V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.1,"Arama sırları, bant dışı kimlik doğrulama istekleri veya kodları ve zamana dayalı tek kullanımlık parolaların (TOTP) yalnızca bir kez kullanılabildiği doğrulanmalıdır.",,✓,✓,, +V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.2,"Uygulamanın backend tarafında saklanırken, 112 bitten az entropiye sahip (örneğin 19 rastgele harf-rakam karakteri veya 34 rastgele rakam) arama sırlarının, 32-bit rastgele bir salt içeren onaylı bir parola saklama algoritmasıyla hash’lendiği doğrulanmalıdır. Gizli bilginin entropisi 112 bit veya daha fazlaysa standart bir hash fonksiyonu kullanılabilir.",,✓,✓,, +V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.3,"Arama sırları, bant dışı kimlik doğrulama kodları ve zamana dayalı tek kullanımlık parola seed'lerinin, öngörülebilir değerlerden kaçınmak için Kriptografik Olarak Güvenli Sözde Rastgele Sayı Üreteci (CSPRNG) ile oluşturulduğu doğrulanmalıdır.",,✓,✓,, +V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.4,Arama sırlarının ve bant dışı kimlik doğrulama kodlarının en az 20 bit entropiye (genellikle 4 rastgele harf-rakam karakteri veya 6 rastgele rakam) sahip olduğu doğrulanmalıdır.,,✓,✓,, +V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.5,"Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının ve zamana dayalı tek kullanımlık parolaların (TOTP) belirli bir ömre sahip olduğu doğrulanmalıdır. Bant dışı istekler en fazla 10 dakika, TOTP’ler ise en fazla 30 saniye geçerli olmalıdır.",,✓,✓,, +V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.6,Herhangi bir kimlik doğrulama faktörünün (fiziksel cihazlar dahil) çalınması veya kaybı durumunda iptal edilebildiği doğrulanmalıdır.,,,✓,, +V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.7,"Biyometrik kimlik doğrulama mekanizmalarının yalnızca ikincil faktör olarak, “sahip olduğunuz bir şey” veya “bildiğiniz bir şey” ile birlikte kullanıldığı doğrulanmalıdır.",,,✓,, +V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.8,"Zamana dayalı tek kullanımlık parolaların (TOTP) doğrulamasının, güvenilir bir hizmetten alınan zaman kaynağına dayanarak yapıldığı ve güvenilir olmayan veya istemci tarafından sağlanan zaman kaynağına dayanmadığı doğrulanmalıdır.",,,✓,, +V6,Kimlik Doğrulama,V6.6,Bant Dışı Kimlik Doğrulama Mekanizmaları,V6.6.1,"Tek kullanımlık parolaların (OTP) telefon veya SMS ile Public Switched Telephone Network (PSTN) üzerinden iletildiği kimlik doğrulama mekanizmalarının, yalnızca telefon numarası önceden doğrulanmışsa, alternatif daha güçlü yöntemler (örneğin TOTP) de sunuluyorsa ve kullanıcıya güvenlik riskleri hakkında bilgi veriliyorsa sunulduğu doğrulanmalıdır. Seviye 3 uygulamalar için telefon ve SMS seçenekleri sunulmamalıdır.",,✓,✓,, +V6,Kimlik Doğrulama,V6.6,Bant Dışı Kimlik Doğrulama Mekanizmaları,V6.6.2,"Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının, oluşturuldukları özgün kimlik doğrulama isteğiyle bağlantılı olduğu ve daha önceki ya da sonraki bir istek için kullanılamadığı doğrulanmalıdır.",,✓,✓,, +V6,Kimlik Doğrulama,V6.6,Bant Dışı Kimlik Doğrulama Mekanizmaları,V6.6.3,"Kod tabanlı bant dışı kimlik doğrulama mekanizmalarının, oran sınırlaması ile kaba kuvvet saldırılarına karşı korunduğu doğrulanmalıdır. En az 64 bit entropiye sahip kodlar kullanılması da değerlendirilmelidir.",,✓,✓,, +V6,Kimlik Doğrulama,V6.6,Bant Dışı Kimlik Doğrulama Mekanizmaları,V6.6.4,"Çok faktörlü kimlik doğrulama için push bildirimleri kullanılıyorsa, push bombing saldırılarına karşı oran sınırlamasının kullanıldığı doğrulanmalıdır. “Numara eşleştirme” de bu riski azaltabilir.",,,✓,, +V6,Kimlik Doğrulama,V6.7,Kriptografik Kimlik Doğrulama Mekanizması,V6.7.1,"Kriptografik kimlik doğrulama beyanlarını doğrulamak için kullanılan sertifikaların, değiştirilmeye karşı korumalı şekilde saklandığı doğrulanmalıdır.",,,✓,, +V6,Kimlik Doğrulama,V6.7,Kriptografik Kimlik Doğrulama Mekanizması,V6.7.2,Challenge nonce değerinin en az 64 bit uzunluğunda olduğu ve istatistiksel olarak benzersiz ya da cihazın ömrü boyunca benzersiz olduğu doğrulanmalıdır.,,,✓,, +V6,Kimlik Doğrulama,V6.8,Kimlik Sağlayıcısı ile Kimlik Doğrulama,V6.8.1,"Uygulama birden fazla kimlik sağlayıcıyı (IdP) destekliyorsa, başka bir desteklenen kimlik sağlayıcı aracılığıyla (örneğin aynı kullanıcı tanımlayıcısını kullanarak) kullanıcının kimliğinin taklit edilemediği doğrulanmalıdır. Standart önlem, uygulamanın kullanıcıyı IdP kimliği (bir ad alanı işlevi görür) ve IdP içindeki kullanıcı kimliğinin birleşimiyle kaydetmesi ve tanımlamasıdır.",,✓,✓,, +V6,Kimlik Doğrulama,V6.8,Kimlik Sağlayıcısı ile Kimlik Doğrulama,V6.8.2,Kimlik doğrulama beyanları üzerindeki dijital imzaların (örneğin JWT veya SAML beyanları) varlığı ve bütünlüğünün her zaman doğrulandığı ve imzasız veya geçersiz imzalı beyanların reddedildiği doğrulanmalıdır.,,✓,✓,, +V6,Kimlik Doğrulama,V6.8,Kimlik Sağlayıcısı ile Kimlik Doğrulama,V6.8.3,"SAML beyanlarının benzersiz biçimde işlendiği ve yalnızca geçerlilik süresi içinde bir kez kullanıldığı, tekrar oynatma (replay) saldırılarını önlemek amacıyla doğrulanmalıdır.",,✓,✓,, +V6,Kimlik Doğrulama,V6.8,Kimlik Sağlayıcısı ile Kimlik Doğrulama,V6.8.4,"Uygulama ayrı bir Kimlik Sağlayıcı (IdP) kullanıyorsa ve belirli işlemler için belirli kimlik doğrulama gücü, yöntemleri veya zaman bilgisi bekliyorsa, uygulamanın bu bilgileri IdP tarafından döndürülen veriler üzerinden doğruladığı teyit edilmelidir. Örneğin OIDC kullanılıyorsa, bu durum ID Token üzerindeki 'acr', 'amr' ve 'auth_time' gibi claim’lerin (varsa) doğrulanması ile sağlanabilir. Eğer IdP bu bilgileri sağlamıyorsa, uygulamanın asgari kimlik doğrulama gücünün kullanıldığını varsayan (örneğin yalnızca kullanıcı adı ve parola ile tek faktörlü doğrulama) belgelenmiş bir yedek yaklaşımı olmalıdır.",,✓,✓,, +V7,Oturum Yönetimi,V7.1,Oturum Yönetim Dokümantasyonu,V7.1.1,"Kullanıcının oturum inaktivite zaman aşımı süresi ve mutlak maksimum oturum süresinin belgelendiği, diğer kontrollerle birlikte uygun olduğu ve NIST SP 800-63B yeniden kimlik doğrulama gereksinimlerinden herhangi bir sapma varsa gerekçesinin belgede yer aldığı doğrulanmalıdır.",,✓,✓,, +V7,Oturum Yönetimi,V7.1,Oturum Yönetim Dokümantasyonu,V7.1.2,"Belgede bir hesap için kaç adet eşzamanlı (paralel) oturuma izin verildiği ile birlikte, maksimum aktif oturum sayısına ulaşıldığında uygulanacak davranış ve işlemlerin tanımlandığı doğrulanmalıdır.",,✓,✓,, +V7,Oturum Yönetimi,V7.1,Oturum Yönetim Dokümantasyonu,V7.1.3,"Birleşik kimlik yönetim ekosisteminin bir parçası olarak kullanıcı oturumu oluşturan ve yöneten tüm sistemlerin, oturum ömrü, sonlandırma ve yeniden kimlik doğrulama gerektiren diğer koşulların nasıl koordine edildiğini açıklayan kontrollerle birlikte belgede yer aldığı doğrulanmalıdır.",,✓,✓,, +V7,Oturum Yönetimi,V7.2,Temel Oturum Yönetimi Güvenliği,V7.2.1,Uygulamanın tüm oturum token'ı doğrulama işlemlerini güvenilir bir backend servisi aracılığıyla gerçekleştirdiği doğrulanmalıdır.,✓,✓,✓,, +V7,Oturum Yönetimi,V7.2,Temel Oturum Yönetimi Güvenliği,V7.2.2,"Uygulamanın, statik API gizli anahtarları veya sabit değerler yerine, oturum yönetimi için dinamik olarak oluşturulan kendi kendine yeterli veya referans token'ları kullandığı doğrulanmalıdır.",✓,✓,✓,, +V7,Oturum Yönetimi,V7.2,Temel Oturum Yönetimi Güvenliği,V7.2.3,"Uygulama kullanıcı oturumlarını temsil etmek için referans token'ları kullanıyorsa, bu token'ların benzersiz olduğu, kriptografik olarak güvenli bir sözde rastgele sayı üreteci (CSPRNG) kullanılarak üretildiği ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır.",✓,✓,✓,, +V7,Oturum Yönetimi,V7.2,Temel Oturum Yönetimi Güvenliği,V7.2.4,"Uygulamanın, kullanıcı kimlik doğrulaması (yeniden kimlik doğrulama dahil) sırasında yeni bir oturum token'ı oluşturduğu ve mevcut oturum token'ını sonlandırdığı doğrulanmalıdır.",✓,✓,✓,, +V7,Oturum Yönetimi,V7.3,Oturum Zaman Aşımı,V7.3.1,Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde bir hareketsizlik zaman aşımı bulunduğu doğrulanmalıdır.,,✓,✓,, +V7,Oturum Yönetimi,V7.3,Oturum Zaman Aşımı,V7.3.2,Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde mutlak bir maksimum oturum süresi bulunduğu doğrulanmalıdır.,,✓,✓,, +V7,Oturum Yönetimi,V7.4,Oturum Sonlandırma,V7.4.1,"Oturum sonlandırma tetiklendiğinde (örneğin, çıkış yapıldığında veya süre dolduğunda), uygulamanın oturumun daha fazla kullanılmasına izin vermediği doğrulanmalıdır. Referans token'lar veya durum bilgili oturumlar için bu, oturum verilerinin uygulama arka ucunda geçersiz kılınması anlamına gelir. Kapsamlı token kullanan uygulamaların; sonlandırılmış token listesi tutmak, kullanıcıya özel tarih ve saatten önce oluşturulan token'ları reddetmek veya kullanıcıya özel imzalama anahtarını yenilemek gibi bir çözüm uygulaması gerekir.",✓,✓,✓,, +V7,Oturum Yönetimi,V7.4,Oturum Sonlandırma,V7.4.2,"Bir kullanıcı hesabı devre dışı bırakıldığında veya silindiğinde (örneğin bir çalışanın şirketten ayrılması), uygulamanın tüm aktif oturumları sonlandırdığı doğrulanmalıdır.",✓,✓,✓,, +V7,Oturum Yönetimi,V7.4,Oturum Sonlandırma,V7.4.3,"Herhangi bir kimlik doğrulama faktörünün başarılı bir şekilde değiştirilmesi veya kaldırılmasından (şifre sıfırlama veya kurtarma yoluyla yapılan değişiklikler dahil ve varsa MFA ayarları güncellemeleri dahil) sonra, uygulamanın diğer tüm aktif oturumları sonlandırma seçeneği sunduğu doğrulanmalıdır.",,✓,✓,, +V7,Oturum Yönetimi,V7.4,Oturum Sonlandırma,V7.4.4,Kimlik doğrulama gerektiren tüm sayfalarda kolay erişilebilir ve görünür bir çıkış yap (logout) işlevi bulunduğu doğrulanmalıdır.,,✓,✓,, +V7,Oturum Yönetimi,V7.4,Oturum Sonlandırma,V7.4.5,"Uygulama yöneticilerinin, bireysel bir kullanıcının veya tüm kullanıcıların aktif oturumlarını sonlandırabilme yetkisine sahip olduğu doğrulanmalıdır.",,✓,✓,, +V7,Oturum Yönetimi,V7.5,Oturum Kötüye Kullanımına Karşı Savunmalar,V7.5.1,"E-posta adresi, telefon numarası, MFA yapılandırması veya hesap kurtarmada kullanılan diğer bilgiler gibi kimlik doğrulamayı etkileyebilecek hassas hesap özniteliklerinde değişiklik yapılmadan önce uygulamanın tam yeniden kimlik doğrulama gerektirdiği doğrulanmalıdır.",,✓,✓,, +V7,Oturum Yönetimi,V7.5,Oturum Kötüye Kullanımına Karşı Savunmalar,V7.5.2,"Kullanıcıların, (en az bir faktörle yeniden kimlik doğrulama yaptıktan sonra) mevcut tüm aktif oturumları görüntüleyebilmesi ve sonlandırabilmesinin mümkün olduğu doğrulanmalıdır.",,✓,✓,, +V7,Oturum Yönetimi,V7.5,Oturum Kötüye Kullanımına Karşı Savunmalar,V7.5.3,"Uygulamanın, son derece hassas işlemler veya operasyonlar gerçekleştirilmeden önce en az bir faktörle ek kimlik doğrulaması veya ikincil bir doğrulama gerektirdiği doğrulanmalıdır.",,,✓,, +V7,Oturum Yönetimi,V7.6,Birleşik Yeniden Kimlik Doğrulama,V7.6.1,"Güvenen Taraf (RP) ile Kimlik Sağlayıcı (IdP) arasındaki oturum süresi ve oturum sonlandırma davranışlarının belgelenmiş olduğu ve, örneğin IdP kimlik doğrulama olayları arasında maksimum süreye ulaşıldığında yeniden kimlik doğrulamanın gerekli kılındığı doğrulanmalıdır.",,✓,✓,, +V7,Oturum Yönetimi,V7.6,Birleşik Yeniden Kimlik Doğrulama,V7.6.2,"Yeni bir oturum oluşturulmasının, kullanıcı onayı veya açık bir eylem gerektirdiği; kullanıcı etkileşimi olmaksızın yeni uygulama oturumlarının oluşturulmasının önlendiği doğrulanmalıdır.",,✓,✓,, +V8,Yetkilendirme,V8.1,Yetkilendirme Dokümantasyonu,V8.1.1,"Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak işlev düzeyinde ve veriye özel erişim kısıtlamaları için kuralları tanımladığı doğrulanmalıdır.",✓,✓,✓,, +V8,Yetkilendirme,V8.1,Yetkilendirme Dokümantasyonu,V8.1.2,"Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak alan (field) düzeyinde erişim kısıtlamaları (hem okuma hem yazma) için kuralları tanımladığı doğrulanmalıdır. Bu kuralların, ilgili veri nesnesinin durum veya statü gibi diğer özniteliklerine bağlı olabileceği unutulmamalıdır.",,✓,✓,, +V8,Yetkilendirme,V8.1,Yetkilendirme Dokümantasyonu,V8.1.3,"Uygulamanın dokümantasyonunun, kimlik doğrulama ve yetkilendirme ile ilgili güvenlik kararlarının alınmasında kullanılan çevresel ve bağlamsal öznitelikleri (günün saati, kullanıcı konumu, IP adresi veya cihaz gibi) tanımladığı doğrulanmalıdır.",,,✓,, +V8,Yetkilendirme,V8.1,Yetkilendirme Dokümantasyonu,V8.1.4,"Kimlik doğrulama ve yetkilendirme dokümantasyonunun; işlev düzeyinde, veriye özel ve alan düzeyinde yetkilendirmenin yanı sıra çevresel ve bağlamsal faktörlerin karar almada nasıl kullanıldığını tanımladığı doğrulanmalıdır. Bu, değerlendirilen öznitelikleri, risk eşiklerini ve alınan aksiyonları (ör. izin ver, doğrulama iste, reddet, step-up kimlik doğrulama) içermelidir.",,,✓,, +V8,Yetkilendirme,V8.2,Genel Yetkilendirme Tasarımı,V8.2.1,"Uygulamanın, işlev düzeyindeki erişimin yalnızca açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır.",✓,✓,✓,, +V8,Yetkilendirme,V8.2,Genel Yetkilendirme Tasarımı,V8.2.2,"Uygulamanın, veriye özel erişimin yalnızca belirli veri öğelerine açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, doğrudan nesne referansı güvenlik açıkları (IDOR) ve bozuk nesne düzeyinde yetkilendirme (BOLA) risklerini azaltır.",✓,✓,✓,, +V8,Yetkilendirme,V8.2,Genel Yetkilendirme Tasarımı,V8.2.3,"Uygulamanın, alan (field) düzeyindeki erişimin yalnızca belirli alanlara açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, bozuk nesne özelliği düzeyinde yetkilendirme (BOPLA) risklerini azaltır.",,✓,✓,, +V8,Yetkilendirme,V8.2,Genel Yetkilendirme Tasarımı,V8.2.4,"Tüketicinin çevresel ve bağlamsal özniteliklerine (ör. günün saati, konum, IP adresi veya cihaz) dayalı uyarlanabilir güvenlik kontrollerinin, uygulama dokümantasyonunda tanımlandığı şekilde, kimlik doğrulama ve yetkilendirme kararları için uygulandığı doğrulanmalıdır. Bu kontroller, tüketici yeni bir oturum başlatmaya çalışırken ve mevcut bir oturum sırasında uygulanmalıdır.",,,✓,, +V8,Yetkilendirme,V8.3,İşlem Düzeyinde Yetkilendirme,V8.3.1,Uygulamanın yetkilendirme kurallarını güvenilir bir servis katmanında uyguladığı ve istemci taraflı JavaScript gibi güvenilmeyen tüketiciler tarafından değiştirilebilecek kontrollerle yetinmediği doğrulanmalıdır.,✓,✓,✓,, +V8,Yetkilendirme,V8.3,İşlem Düzeyinde Yetkilendirme,V8.3.2,"Yetkilendirme kararlarının temelini oluşturan değerlerdeki değişikliklerin hemen uygulandığı doğrulanmalıdır. Değişikliklerin anında uygulanamadığı durumlarda (örneğin self-contained token içindeki verilere güveniliyorsa), tüketici artık yetkili olmadığı hâlde bir işlem gerçekleştirdiğinde uyarı verecek ve değişikliği geri alacak önlemler uygulanmalıdır. Bu alternatifin bilgi sızıntısını önlemeyeceği unutulmamalıdır.",,,✓,, +V8,Yetkilendirme,V8.3,İşlem Düzeyinde Yetkilendirme,V8.3.3,"Bir nesneye erişimin, herhangi bir aracı veya onun adına hareket eden bir servis yerine yalnızca erişimi başlatan öznenin (ör. tüketici) izinlerine dayandığı doğrulanmalıdır. Örneğin, bir tüketici kimlik doğrulama için bir self-contained token kullanarak bir web servis çağırırsa ve bu servis başka bir servisten veri talep ederse, ikinci servis izin kararlarını verirken birinci servisin makine-makine token'ı yerine tüketicinin token'ını kullanmalıdır.",,,✓,, +V8,Yetkilendirme,V8.4,Diğer Yetkilendirme Hususları,V8.4.1,"Multi-tenant uygulamaların, tüketici işlemlerinin izinli olmadıkları tenant'lar üzerinde asla etkili olmamasını sağlamak için tenant'lar arası kontroller kullandığı doğrulanmalıdır.",,✓,✓,, +V8,Yetkilendirme,V8.4,Diğer Yetkilendirme Hususları,V8.4.2,"Yönetici arayüzlerine erişimin, sürekli tüketici kimlik doğrulaması, cihaz güvenlik durumu değerlendirmesi ve bağlamsal risk analizi dahil olmak üzere çok katmanlı güvenlik içerdiği doğrulanmalıdır. Yetkilendirme için yalnızca ağ konumu veya güvenilir uç noktalar yeterli olmamalıdır; ancak bu tür faktörler yetkisiz erişim olasılığını azaltabilir.",,,✓,, +V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.1,Token Kaynağı ve Bütünlüğü,V9.1.1,"Self-contained token'ların içerikleri kabul edilmeden önce, oynama (tampering) saldırılarına karşı dijital imza veya MAC ile doğrulama yapıldığı doğrulanmalıdır.",✓,✓,✓,, +V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.1,Token Kaynağı ve Bütünlüğü,V9.1.2,"Belirli bir bağlam için yalnızca bir allowlist üzerinde bulunan algoritmaların self-contained token oluşturmak ve doğrulamak için kullanılabildiği doğrulanmalıdır. Bu allowlist, yalnızca simetrik ya da yalnızca asimetrik algoritmaları içermeli ve kesinlikle 'None' algoritmasını içermemelidir. Hem simetrik hem de asimetrik algoritmalar desteklenmek zorundaysa, anahtar karışıklığını (key confusion) önlemek için ek kontroller uygulanmalıdır.",✓,✓,✓,, +V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.1,Token Kaynağı ve Bütünlüğü,V9.1.3,"Self-contained token'ları doğrulamak için kullanılan anahtar malzemesinin, token issuer için önceden yapılandırılmış güvenilir kaynaklardan alındığı doğrulanmalıdır. Bu, saldırganların güvenilmeyen kaynak ve anahtarları belirtmesini engeller. JWT ve diğer JWS yapılarında 'jku', 'x5u' ve 'jwk' gibi header'lar güvenilir kaynaklardan oluşan bir allowlist'e göre doğrulanmalıdır.",✓,✓,✓,, +V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.2,Token İçeriği,V9.2.1,"Token verisinde bir geçerlilik zaman aralığı (validity time span) varsa, yalnızca doğrulama zamanı bu zaman aralığı içerisindeyse token ve içeriği kabul edilmelidir. Örneğin, JWT'ler için 'nbf' ve 'exp' claim'leri doğrulanmalıdır.",✓,✓,✓,, +V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.2,Token İçeriği,V9.2.2,"Token'ı alan hizmetin, token içeriğini kabul etmeden önce bu token'ın doğru türde olduğunu ve sunulma amacına uygun olduğunu doğruladığı teyit edilmelidir. Örneğin, yalnızca erişim token'ları yetkilendirme kararları için, yalnızca ID Token'lar kullanıcı kimlik doğrulamasını kanıtlamak için kullanılabilir.",,✓,✓,, +V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.2,Token İçeriği,V9.2.3,"Hizmetin yalnızca kendisiyle kullanılması amaçlanan (audience) token'ları kabul ettiği doğrulanmalıdır. JWT'lerde bu, 'aud' claim'inin hizmet içinde tanımlı bir allowlist ile doğrulanması yoluyla sağlanabilir.",,✓,✓,, +V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.2,Token İçeriği,V9.2.4,"Eğer bir token issuer, farklı audience'lara token oluşturmak için aynı private key'i kullanıyorsa, oluşturulan token'ların hedef audience'ları benzersiz şekilde tanımlayan bir audience kısıtlaması içerdiği doğrulanmalıdır. Bu, bir token'ın farklı bir audience ile yeniden kullanılmasını önler. Audience tanımlayıcısı dinamik olarak sağlanıyorsa, token issuer bu audience'ları doğrulamalı ve audience taklitlerinin (impersonation) önüne geçmelidir.",,✓,✓,, +V10,OAuth ve OIDC,V10.1,Genel OAuth ve OIDC Güvenliği,V10.1.1,"Token'ların yalnızca kesinlikle ihtiyaç duyan bileşenlere gönderildiği doğrulanmalıdır. Örneğin, tarayıcı tabanlı JavaScript uygulamaları için bir backend-for-frontend modeli kullanıldığında, access ve refresh token'lara yalnızca backend'in erişebilmesi gerekir.",,✓,✓,, +V10,OAuth ve OIDC,V10.1,Genel OAuth ve OIDC Güvenliği,V10.1.2,"Authorization server'dan gelen değerler (örneğin authorization code veya ID Token gibi) yalnızca aynı user agent oturumu ve işlemi tarafından başlatılmış bir yetkilendirme akışının sonucuysa kabul edildiği doğrulanmalıdır. Bu, client tarafından oluşturulan secret’ların 'proof key for code exchange' (PKCE) ‘code_verifier’, ‘state’ veya OIDC ‘nonce’ gibi tahmin edilemez, işleme özgü ve hem client’a hem de işlem başlatılan user agent oturumuna güvenli bir şekilde bağlı olmasını gerektirir.",,✓,✓,, +V10,OAuth ve OIDC,V10.2,OAuth İstemcisi,V10.2.1,"Code flow kullanılıyorsa, OAuth client’ın token taleplerini tetikleyen CSRF saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Bu genellikle PKCE kullanılarak veya authorization isteğinde gönderilen ‘state’ parametresinin kontrolü ile sağlanır.",,✓,✓,, +V10,OAuth ve OIDC,V10.2,OAuth İstemcisi,V10.2.2,"OAuth istemcisi birden fazla AS ile etkileşime girebiliyorsa, mix-up saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Örneğin, authorization server’ın 'iss' parametresini döndürmesi zorunlu kılınabilir ve bu parametrenin hem authorization yanıtında hem de token yanıtında doğrulanması gerekir.",,✓,✓,, +V10,OAuth ve OIDC,V10.2,OAuth İstemcisi,V10.2.3,OAuth istemcisinin authorization server’a yaptığı taleplerde yalnızca gerekli scope’ları (veya diğer yetkilendirme parametrelerini) talep ettiği doğrulanmalıdır.,,,✓,, +V10,OAuth ve OIDC,V10.3,OAuth Kaynak Sunucusu (RS),V10.3.1,RS'nin yalnızca bu servisle kullanılmak üzere tasarlanmış access token’ları kabul ettiği doğrulanmalıdır (audience kontrolü). Audience bilgisi yapılandırılmış token’larda (örneğin JWT içindeki ‘aud’ claim’i) yer alabilir veya token introspection endpoint aracılığıyla kontrol edilebilir.,,✓,✓,, +V10,OAuth ve OIDC,V10.3,OAuth Kaynak Sunucusu (RS),V10.3.2,"RS'nin, access token’dan gelen claim’lere dayanarak yetki devri tanımına uygun şekilde yetkilendirme kararları uyguladığı doğrulanmalıdır. ‘sub’, ‘scope’ ve ‘authorization_details’ gibi claim’ler varsa, bu kararın parçası olmalıdır.",,✓,✓,, +V10,OAuth ve OIDC,V10.3,OAuth Kaynak Sunucusu (RS),V10.3.3,"Erişim kontrolü kararında, access token’dan (JWT veya ilgili token introspection yanıtı) benzersiz bir kullanıcının tanımlanması gerekiyorsa, RS'nin başka kullanıcılara devredilemeyecek claim’ler ile kullanıcıyı tanımladığı doğrulanmalıdır. Genellikle bu, ‘iss’ ve ‘sub’ claim’lerinin birlikte kullanılması anlamına gelir.",,✓,✓,, +V10,OAuth ve OIDC,V10.3,OAuth Kaynak Sunucusu (RS),V10.3.4,"RS'nin belirli bir kimlik doğrulama gücü, yöntemi veya güncelliği (recentness) gerektirmesi durumunda, sunulan access token’ın bu kısıtlamaları karşıladığını doğruladığı, örneğin, OIDC ‘acr’, ‘amr’ ve ‘auth_time’ claim’leri kullanılarak doğrulanmalıdır. ",,✓,✓,, +V10,OAuth ve OIDC,V10.3,OAuth Kaynak Sunucusu (RS),V10.3.5,"RS'nin, (yetkisiz taraflarca) çalınmış veya tekrar edilen access token’ların kullanımını önlemek için sender-constrained access token’lar kullandığı doğrulanmalıdır. Bu, OAuth 2 için Mutual TLS veya OAuth 2 Demonstration of Proof of Possession (DPoP) ile sağlanabilir.",,,✓,, +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.1,"AS'nin, istemciye özel önceden kaydedilmiş URI’lerden oluşan bir allowlist kullanarak redirect URI’leri tam dize karşılaştırması ile doğruladığı doğrulanmalıdır.",✓,✓,✓,, +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.2,"AS'nin, ""authorization response"" içinde ""authorization code"" döndürdüğü durumlarda, bu kodun yalnızca bir kez kullanılabildiği doğrulanmalıdır. Daha önce access token vermek için kullanılmış bir authorization code ile yapılan ikinci geçerli token isteği reddedilmeli ve ilgili tüm token’lar iptal edilmelidir.",✓,✓,✓,, +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.3,"Authorization code’un kısa ömürlü olduğu doğrulanmalıdır. L1 ve L2 uygulamalar için maksimum yaşam süresi 10 dakika, L3 uygulamalar için 1 dakikadır.",✓,✓,✓,, +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.4,"Belirli bir istemci için AS'nin yalnızca o istemcinin ihtiyaç duyduğu grant türlerine izin verdiği doğrulanmalıdır. ""Token"" (Implicit flow) ve ""password"" (Resource Owner Password Credentials flow) grant türlerinin artık kullanılmaması gerekir.",✓,✓,✓,, +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.5,"AS'nin, açık istemciler için refresh token replay saldırılarını azalttığı doğrulanmalıdır. Tercihen sender-constrained refresh token’lar (DPoP veya mutual TLS ile certificate-bound access token’lar) kullanılmalıdır. L1 ve L2 uygulamalar için refresh token rotation kullanılabilir. Rotation kullanılıyorsa, AS refresh token’ı kullanım sonrası geçersiz kılmalı ve geçersiz bir refresh token sunulması durumunda o yetkilendirme ile ilişkili tüm refresh token’ları iptal etmelidir.",✓,✓,✓,, +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.6,"Code grant kullanılıyorsa, AS'nin authorization code interception saldırılarına karşı koruma sağladığı doğrulanmalıdır. Yetkilendirme isteğinde geçerli bir ""code_challenge"" değeri zorunlu olmalı ve ""code_challenge_method"" olarak ""plain"" kabul edilmemelidir. Token isteğinde ise ""code_verifier"" parametresi doğrulanmalıdır.",,✓,✓,, +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.7,"AS'nin, kimlik doğrulaması yapılmamış dinamik istemci kaydını desteklemesi durumunda, kötü niyetli istemci uygulamalarına karşı riskleri azalttığı doğrulanmalıdır. Kayıtlı URI’ler gibi client metadata’sı doğrulanmalı, kullanıcı onayı alınmalı ve güvenilmeyen bir client uygulamasıyla yapılan yetkilendirme isteği işlenmeden önce kullanıcı uyarılmalıdır.",,✓,✓,, +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.8,"Refresh token’ların, sliding expiration kullanılsa bile mutlak bir sona erme süresine sahip olduğu doğrulanmalıdır.",,✓,✓,, +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.9,Yetkili bir kullanıcı tarafından AS kullanıcı arayüzü üzerinden refresh token’ların ve reference access token’ların iptal edilebildiği doğrulanmalıdır.,,✓,✓,, +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.10,"Gizli istemcilerin token istekleri, pushed authorization request (PAR) ve token iptal istekleri gibi server’a yapılan backchannel isteklerinde kimliğinin kontrol edildiği doğrulanmalıdır.",,✓,✓,, +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.11,"AS yapılandırmasının, OAuth istemcisine yalnızca gerekli scope’ları atadığı doğrulanmalıdır.",,✓,✓,, +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.12,"Belirli bir client için, authorization server’ın yalnızca client’ın ihtiyaç duyduğu 'response_mode' değerine izin verdiği doğrulanmalıdır. Örneğin, bu değer ya beklenenlerle karşılaştırılarak doğrulanmalı ya da PAR veya JAR kullanılmalıdır.",,,✓,, +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.13,"""Code"" grant türünün daima pushed authorization request (PAR) ile birlikte kullanıldığı doğrulanmalıdır.",,,✓,, +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.14,"AS'nin yalnızca sender-constrained (Proof-of-Possession) access token’lar ürettiği doğrulanmalıdır. Bu, mutual TLS ile certificate-bound access token ya da DPoP ile DPoP-bound access token olabilir.",,,✓,, +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.15,"Sunucu taraflı istemciler için (kullanıcı cihazında çalışmayan), AS'nin ""authorization_details"" parametresinin istemci backend'i tarafından sağlandığını ve kullanıcı tarafından değiştirilmediğini doğruladığı, örneğin pushed authorization request (PAR) or JWT-secured Authorization Request (JAR) zorunlu kılınarak doğrulanmalıdır.",,,✓,, +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.16,"Bir istemci gizli ise, AS'nin güçlü istemci kimlik doğrulama yöntemlerini zorunlu kıldığı doğrulanmalıdır. Bu yöntemler, public-key cryptography’ye dayalı ve replay saldırılarına karşı dayanıklı olmalı, örneğin mutual TLS (""tls_client_auth"", ""self_signed_tls_client_auth"") veya private key JWT (""private_key_jwt"") gibi.",,,✓,, +V10,OAuth ve OIDC,V10.5,OIDC İstemcisi,V10.5.1,"İstemcinin (relying party olarak) ID Token replay saldırılarını azalttığı doğrulanmalıdır. Örneğin, ID Token’daki 'nonce' claim’inin, OpenID Provider’a gönderilen kimlik doğrulama isteğindeki 'nonce' değeriyle eşleştiği doğrulanmalıdır.",,✓,✓,, +V10,OAuth ve OIDC,V10.5,OIDC İstemcisi,V10.5.2,"İstemcinin kullanıcıyı ID Token claim’lerinden (genellikle, başka kullanıcılarla yeniden atanamayan 'sub' claim’i) benzersiz şekilde tanımladığı doğrulanmalıdır.",,✓,✓,, +V10,OAuth ve OIDC,V10.5,OIDC İstemcisi,V10.5.3,"İstemcinin, kötü niyetli bir AS'nin başka bir AS'yi taklit etmesini AS metadata’sı üzerinden reddettiği doğrulanmalıdır. AS metadata’sındaki issuer URL’si, istemci tarafından beklenen önceden yapılandırılmış issuer URL’siyle tam olarak eşleşmiyorsa, metadata reddedilmelidir.",,✓,✓,, +V10,OAuth ve OIDC,V10.5,OIDC İstemcisi,V10.5.4,"İstemcinin, ID Token’ın kendisi için (audience) kullanılması amaçlandığını doğruladığı doğrulanmalıdır. Bu, token’daki 'aud' claim’inin istemcinin 'client_id' değeriyle eşit olup olmadığının kontrol edilmesiyle yapılır.",,✓,✓,, +V10,OAuth ve OIDC,V10.5,OIDC İstemcisi,V10.5.5,"OIDC back-channel logout kullanıldığında, relying party’nin ""forced logout"" ve ""logout"" akışında ""cross-JWT confusion"" gibi saldırılara karşı koruma sağladığı doğrulanmalıdır. Client, logout token’ın 'logout+jwt' türünde olduğunu, 'event' claim’inin doğru üyeye sahip olduğunu ve 'nonce' claim’i içermediğini doğrulamalıdır. Ayrıca token için kısa bir sona erme süresi (örneğin 2 dakika) önerilir.",,✓,✓,, +V10,OAuth ve OIDC,V10.6,OpenID Provider,V10.6.1,"OpenID Provider’ın yalnızca 'code', 'ciba', 'id_token' veya 'id_token code' response mode değerlerine izin verdiği doğrulanmalıdır. 'code' değeri, 'id_token code' (OIDC Hybrid flow) yerine tercih edilmelidir. 'token' (Implicit flow) kullanılmamalıdır.",,✓,✓,, +V10,OAuth ve OIDC,V10.6,OpenID Provider,V10.6.2,"OpenID Provider’ın forced logout yoluyla yapılan hizmet reddi saldırılarını önlediği doğrulanmalıdır. Bu, son kullanıcıdan açık onay alınarak veya varsa logout isteğinde (relying party tarafından başlatılan) bulunan parametrelerin, örneğin 'id_token_hint', doğrulanmasıyla yapılabilir.",,✓,✓,, +V10,OAuth ve OIDC,V10.7,Onay (Consent) Yönetimi,V10.7.1,"AS'nin her yetkilendirme isteği için kullanıcının onayını aldığı doğrulanmalıdır. İstemcinin kimliği garanti altına alınamıyorsa, AS daima kullanıcıdan açıkça onay istemelidir.",,✓,✓,, +V10,OAuth ve OIDC,V10.7,Onay (Consent) Yönetimi,V10.7.2,"AS'nin kullanıcıdan onay istediğinde, neye onay verildiğini açık ve yeterli şekilde gösterdiği doğrulanmalıdır. Uygun olduğunda bu bilgiler, istenen yetkilendirmelerin doğasını (genellikle scope, resource server, RAR gibi detaylara dayalı), yetkilendirilmiş uygulamanın kimliğini ve bu yetkilendirmelerin süresini içermelidir.",,✓,✓,, +V10,OAuth ve OIDC,V10.7,Onay (Consent) Yönetimi,V10.7.3,"Kullanıcının, AS üzerinden verdiği onayları görüntüleyebildiği, değiştirebildiği ve iptal edebildiği doğrulanmalıdır.",,✓,✓,, +V11,Kriptografi,V11.1,Kriptografik Envanter ve Dokümantasyon,V11.1.1,"Kriptografik anahtarların yönetimi için belgelenmiş bir politika ve NIST SP 800-57 gibi bir anahtar yönetim standardını izleyen bir kriptografik anahtar yaşam döngüsü tanımlandığı doğrulanmalıdır. Bu, anahtarların aşırı miktarda paylaşılmadığını (örneğin, paylaşılan sırlar için ikiden fazla tarafla veya özel anahtarlar için birden fazla tarafla) garanti altına almalıdır.",,✓,✓,, +V11,Kriptografi,V11.1,Kriptografik Envanter ve Dokümantasyon,V11.1.2,"Tüm kriptografik anahtarlar, algoritmalar ve uygulama tarafından kullanılan sertifikaları içeren bir kriptografik envanterin oluşturulduğu, sürdürüldüğü ve düzenli olarak güncellendiği doğrulanmalıdır. Bu envanter ayrıca, sistemde anahtarların nerede kullanılabileceğini ve kullanılamayacağını, ve hangi veri türlerinin bu anahtarlarla korunup korunamayacağını da belgelemelidir.",,✓,✓,, +V11,Kriptografi,V11.1,Kriptografik Envanter ve Dokümantasyon,V11.1.3,"Sistem içerisinde şifreleme, özetleme ve imzalama işlemleri dahil olmak üzere kriptografi kullanımının tüm örneklerini tespit etmek için kriptografik keşif mekanizmalarının kullanıldığı doğrulanmalıdır.",,,✓,, +V11,Kriptografi,V11.1,Kriptografik Envanter ve Dokümantasyon,V11.1.4,"Kriptografik bir envanterin sürdürüldüğü doğrulanmalıdır. Bu envanter, gelecekteki tehditlere karşı tepki verebilmek amacıyla post-kuantum kriptografiye geçiş yolunu belirten belgelenmiş bir plan içermelidir.",,,✓,, +V11,Kriptografi,V11.2,Güvenli Kriptografi Uygulaması,V11.2.1,Kriptografik işlemler için sektör tarafından doğrulanmış uygulamaların (kütüphaneler ve donanım hızlandırmalı uygulamalar dahil) kullanıldığı doğrulanmalıdır.,,✓,✓,, +V11,Kriptografi,V11.2,Güvenli Kriptografi Uygulaması,V11.2.2,"Uygulamanın, rastgele sayı üreticileri, kimliği doğrulanmış şifreleme, MAC veya özetleme algoritmaları, anahtar uzunlukları, turlar, şifreler ve modların herhangi bir zamanda yeniden yapılandırılabilir, yükseltilebilir veya değiştirilebilir olacağı şekilde kripto çevikliği (crypto agility) ile tasarlandığı doğrulanmalıdır. Aynı şekilde, anahtarların ve parolaların değiştirilebilmesi ve verilerin yeniden şifrelenebilmesi mümkün olmalıdır. Bu, onaylanmış PQC şemalarının yüksek güvenlikli uygulamaları yaygın olarak kullanılabilir hale geldiğinde sorunsuz geçişe olanak tanır.",,✓,✓,, +V11,Kriptografi,V11.2,Güvenli Kriptografi Uygulaması,V11.2.3,"Tüm kriptografik ilkeliklerin, algoritma, anahtar boyutu ve yapılandırmaya göre minimum 128 bit güvenlik sağladığı doğrulanmalıdır. Örneğin, 256-bit ECC anahtarı yaklaşık 128 bit güvenlik sağlarken, RSA için aynı güvenliği elde etmek 3072-bit anahtar gerektirir.",,✓,✓,, +V11,Kriptografi,V11.2,Güvenli Kriptografi Uygulaması,V11.2.4,"Tüm kriptografik işlemlerin sabit süreli (constant-time) olduğu, karşılaştırmalarda, hesaplamalarda veya geri dönüşlerde kısa devre (short-circuit) işlemleri yapılmadığı doğrulanmalıdır; bu, bilgi sızıntısını önlemek için gereklidir.",,,✓,, +V11,Kriptografi,V11.2,Güvenli Kriptografi Uygulaması,V11.2.5,"Tüm kriptografik modüllerin güvenli şekilde hata verdiği ve hataların, padding oracle saldırıları gibi zafiyetleri mümkün kılmayacak şekilde ele alındığı doğrulanmalıdır.",,,✓,, +V11,Kriptografi,V11.3,Şifreleme Algoritmaları,V11.3.1,"Güvensiz blok modlarının (örneğin, ECB) ve zayıf doldurma (padding) şemalarının (örneğin, PKCS#1 v1.5) kullanılmadığı doğrulanmalıdır.",✓,✓,✓,, +V11,Kriptografi,V11.3,Şifreleme Algoritmaları,V11.3.2,Yalnızca AES ile GCM gibi onaylı şifreleme algoritmalarının ve modlarının kullanıldığı doğrulanmalıdır.,✓,✓,✓,, +V11,Kriptografi,V11.3,Şifreleme Algoritmaları,V11.3.3,"Şifrelenmiş verilerin yetkisiz değişikliklere karşı korunduğu doğrulanmalıdır. Tercihen bu koruma, onaylı bir kimliği doğrulanmış şifreleme yöntemi kullanılarak ya da onaylı bir şifreleme yöntemi ile onaylı bir MAC algoritmasının kombinasyonu ile sağlanmalıdır.",,✓,✓,, +V11,Kriptografi,V11.3,Şifreleme Algoritmaları,V11.3.4,"Sayılar, başlatma vektörleri (IV) ve diğer tek kullanımlık değerlerin, aynı şifreleme anahtarı ve veri öğesi çifti için birden fazla kez kullanılmadığı doğrulanmalıdır. Oluşturma yöntemi kullanılan algoritmaya uygun olmalıdır.",,,✓,, +V11,Kriptografi,V11.3,Şifreleme Algoritmaları,V11.3.5,"Şifreleme algoritması ve MAC algoritması kombinasyonlarının ""encrypt-then-MAC"" modunda çalıştığı doğrulanmalıdır.",,,✓,, +V11,Kriptografi,V11.4,Hashing ve Hash Tabanlı Fonksiyonlar,V11.4.1,"Dijital imzalar, HMAC, KDF ve rastgele bit üretimi gibi genel kriptografik kullanım senaryolarında yalnızca onaylı hash fonksiyonlarının kullanıldığı doğrulanmalıdır. MD5 gibi yasaklı hash fonksiyonları hiçbir kriptografik amaçla kullanılmamalıdır.",✓,✓,✓,, +V11,Kriptografi,V11.4,Hashing ve Hash Tabanlı Fonksiyonlar,V11.4.2,"Parolaların, onaylı, hesaplama açısından yoğun ve mevcut rehberliğe göre yapılandırılmış bir anahtar türetme fonksiyonu (diğer adıyla parola hash'leme fonksiyonu) kullanılarak saklandığı doğrulanmalıdır. Ayarlar, güvenlik ve performans dengesini sağlayarak kaba kuvvet saldırılarını zorlaştırmalıdır.",,✓,✓,, +V11,Kriptografi,V11.4,Hashing ve Hash Tabanlı Fonksiyonlar,V11.4.3,"Dijital imzalarda kullanılan hash fonksiyonlarının, veri bütünlüğü ve kimlik doğrulama amacıyla kullanıldığında çakışmaya karşı dayanıklı ve yeterli bit uzunluğuna sahip olduğu doğrulanmalıdır. Çakışma dayanıklılığı gerekiyorsa çıktı uzunluğu en az 256 bit olmalıdır. Sadece ikinci ön-görüntü (2nd pre-iamge) saldırılarına karşı dayanıklılık gerekiyorsa çıktı uzunluğu en az 128 bit olmalıdır.",,✓,✓,, +V11,Kriptografi,V11.4,Hashing ve Hash Tabanlı Fonksiyonlar,V11.4.4,"Parolalardan gizli anahtarlar türetilirken, onaylı anahtar türetme fonksiyonlarının anahtar uzatma (key stretching) parametreleriyle birlikte kullanıldığı doğrulanmalıdır. Bu parametreler, kaba kuvvet saldırılarını önleyecek şekilde güvenlik ve performans dengesine sahip olmalıdır.",,✓,✓,, +V11,Kriptografi,V11.5,Rastgele Değerler,V11.5.1,"Tahmin edilemez olması amaçlanan tüm rastgele sayıların ve dizelerin, CSPRNG ile oluşturulduğu ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. UUID'lerin bu koşulu dikkate almadığını unutmayın.",,✓,✓,, +V11,Kriptografi,V11.5,Rastgele Değerler,V11.5.2,"Kullanılan rastgele sayı üretim mekanizmasının, yoğun talep altında dahi güvenli çalışacak şekilde tasarlandığı doğrulanmalıdır.",,,✓,, +V11,Kriptografi,V11.6,Açık Anahtar (Public Key) Kriptografisi,V11.6.1,"Anahtar üretimi, tohumlama (seeding) ve dijital imza üretimi ve doğrulama için yalnızca onaylı kriptografik algoritmalar ve çalışma modlarının kullanıldığı doğrulanmalıdır. Anahtar üretim algoritmaları, bilinen saldırılara karşı savunmasız anahtarlar üretmemelidir. Örneğin, Fermat çarpanlama yöntemine karşı savunmasız RSA anahtarları oluşturulmamalıdır.",,✓,✓,, +V11,Kriptografi,V11.6,Açık Anahtar (Public Key) Kriptografisi,V11.6.2,"Anahtar değişimi için yalnızca onaylı kriptografik algoritmaların kullanıldığı doğrulanmalıdır (örneğin Diffie-Hellman). Kullanılan parametrelerin güvenli olması gerektiğine dikkat edilmelidir. Bu, anahtar kurulum sürecine yönelik saldırıları önleyecek ve araya girme (adversary-in-the-middle) ya da kriptografik kırılmaları engelleyecektir.",,,✓,, +V11,Kriptografi,V11.7,Kullanım Halindeki Verilerin Kriptografisi,V11.7.1,"Hassas verilerin kullanım sırasında korunmasını sağlamak amacıyla, yetkisiz kullanıcıların veya süreçlerin bu verilere erişmesini engelleyen tam bellek şifrelemesinin kullanıldığı doğrulanmalıdır.",,,✓,, +V11,Kriptografi,V11.7,Kullanım Halindeki Verilerin Kriptografisi,V11.7.2,"Veri asgariyetinin sağlandığı, yani işleme sırasında mümkün olan en az miktarda verinin ortaya çıktığı ve verilerin kullanımdan hemen sonra veya mümkün olan en kısa sürede şifrelendiği doğrulanmalıdır.",,,✓,, +V12,Güvenli İletişim,V12.1,Genel TLS Güvenlik Rehberi,V12.1.1,Yalnızca TLS protokolünün en güncel ve önerilen sürümlerinin (örneğin TLS 1.2 ve TLS 1.3) etkinleştirildiği ve en son sürümün varsayılan olarak tercih edildiği doğrulanmalıdır.,✓,✓,✓,, +V12,Güvenli İletişim,V12.1,Genel TLS Güvenlik Rehberi,V12.1.2,Yalnızca önerilen şifre takımlarının (cipher suite) etkinleştirildiği ve en güçlü şifre takımlarının tercih edildiği doğrulanmalıdır. Seviye 3 (L3) uygulamalar yalnızca ileri gizlilik (forward secrecy) sağlayan şifre takımlarını desteklemelidir.,,✓,✓,, +V12,Güvenli İletişim,V12.1,Genel TLS Güvenlik Rehberi,V12.1.3,"Uygulamanın, mTLS istemci sertifikalarını kimlik doğrulama veya yetkilendirme amacıyla kullanmadan önce bu sertifikaların güvendiği sertifikalar arasında olduğunu doğruladığı kontrol edilmelidir.",,✓,✓,, +V12,Güvenli İletişim,V12.1,Genel TLS Güvenlik Rehberi,V12.1.4,Online Certificate Status Protocol (OCSP) Stapling gibi geçerli bir sertifika iptal kontrolü yönteminin etkinleştirildiği ve yapılandırıldığı doğrulanmalıdır.,,,✓,, +V12,Güvenli İletişim,V12.1,Genel TLS Güvenlik Rehberi,V12.1.5,"TLS el sıkışma (handshake) sürecinde Server Name Indication (SNI) gibi hassas meta verilerin ifşa edilmesini önlemek için, uygulamanın TLS yapılandırmasında Encrypted Client Hello (ECH) özelliğinin etkinleştirildiği doğrulanmalıdır.",,,✓,, +V12,Güvenli İletişim,V12.2,Dışa Açık Hizmetlerle HTTPS İletişimi,V12.2.1,"İstemci ile dışa açık, HTTP tabanlı hizmetler arasındaki tüm bağlantılarda TLS kullanıldığı ve bu bağlantıların güvensiz ya da şifrelenmemiş iletişime geri dönmediği doğrulanmalıdır.",✓,✓,✓,, +V12,Güvenli İletişim,V12.2,Dışa Açık Hizmetlerle HTTPS İletişimi,V12.2.2,Dışa açık hizmetlerin herkese açık olarak güvenilen TLS sertifikaları kullandığı doğrulanmalıdır.,✓,✓,✓,, +V12,Güvenli İletişim,V12.3,Genel Servisler Arası İletişim Güvenliği,V12.3.1,"Uygulamaya gelen ve uygulamadan çıkan tüm bağlantılarda izleme sistemleri, yönetim araçları, uzaktan erişim ve SSH, ara yazılımlar, veritabanları, ana sistemler (mainframe), iş ortağı sistemleri ya da dış API'ler dahil olmak üzere TLS gibi şifreli bir protokolün kullanıldığı ve güvensiz ya da şifrelenmemiş protokollere geri dönülmediği doğrulanmalıdır.",,✓,✓,, +V12,Güvenli İletişim,V12.3,Genel Servisler Arası İletişim Güvenliği,V12.3.2,TLS istemcilerinin bir TLS sunucusu ile iletişime geçmeden önce alınan sertifikaları doğruladığı kontrol edilmelidir.,,✓,✓,, +V12,Güvenli İletişim,V12.3,Genel Servisler Arası İletişim Güvenliği,V12.3.3,Uygulama içindeki HTTP tabanlı iç hizmetler arasında gerçekleşen tüm bağlantılarda TLS ya da uygun başka bir aktarım şifreleme mekanizmasının kullanıldığı ve güvensiz ya da şifrelenmemiş iletişime geri dönülmediği doğrulanmalıdır.,,✓,✓,, +V12,Güvenli İletişim,V12.3,Genel Servisler Arası İletişim Güvenliği,V12.3.4,"İç hizmetler arasındaki TLS bağlantılarında güvenilir sertifikaların kullanıldığı doğrulanmalıdır. İç sistemlerde oluşturulmuş ya da kendinden imzalı (self-signed) sertifikalar kullanılıyorsa, bu sertifikalara güvenen hizmetlerin yalnızca belirli dahili sertifika otoritelerine (CA) ve belirli kendinden imzalı sertifikalara güvenecek şekilde yapılandırıldıkları doğrulanmalıdır.",,✓,✓,, +V12,Güvenli İletişim,V12.3,Genel Servisler Arası İletişim Güvenliği,V12.3.5,"Sistem içindeki hizmetlerin birbiriyle iletişim kurarken her bir uç noktanın kimliğini doğrulamak için güçlü kimlik doğrulama yöntemlerinin kullanıldığı doğrulanmalıdır. Bu yöntemler arasında, açık anahtar altyapısı (public-key infrastructure) kullanan ve tekrar oynatma saldırılarına karşı dayanıklı olan TLS istemci kimlik doğrulaması gibi yöntemler yer almalıdır. Mikroservis mimarilerinde, sertifika yönetimini basitleştirmek ve güvenliği artırmak amacıyla bir servis ağı (service mesh) kullanılması değerlendirilmelidir.",,,✓,, +V13,Konfigürasyon,V13.1,Konfigürasyon Dokümantasyonu,V13.1.1,"Uygulamanın tüm iletişim ihtiyaçlarının dokümante edildiği doğrulanmalıdır. Buna, uygulamanın bağımlı olduğu dış hizmetler ve son kullanıcının uygulamanın bağlantı kurmasını sağlayabileceği dış konumlar da dahil olmalıdır.",,✓,✓,, +V13,Konfigürasyon,V13.1,Konfigürasyon Dokümantasyonu,V13.1.2,"Uygulamanın kullandığı her bir hizmet için, dokümantasyonda eşzamanlı bağlantı sayısı (örn. bağlantı havuzu limitleri) ve bu sınır aşıldığında uygulamanın davranışı, geri dönüş veya kurtarma mekanizmaları da dahil olmak üzere hizmet reddi koşullarını önlemek için tanımlandığı doğrulanmalıdır.",,,✓,, +V13,Konfigürasyon,V13.1,Konfigürasyon Dokümantasyonu,V13.1.3,"Uygulamanın, kullandığı her bir dış sistem veya hizmet (örn. veritabanları, dosya tanıtıcıları, iş parçacıkları, HTTP bağlantıları) için kaynak yönetimi stratejilerini tanımladığı doğrulanmalıdır. Bu stratejiler, kaynak serbest bırakma prosedürlerini, zaman aşımı ayarlarını, hata durumlarını ve tekrar deneme mantığı uygulanmışsa sınırları, gecikmeleri ve geri çekilme (back-off) algoritmalarını içermelidir. Senkron HTTP istek–yanıt işlemleri için kısa zaman aşımı süreleri zorunlu tutulmalı ve tekrar eden denemeler devre dışı bırakılmalı ya da sıkı şekilde sınırlandırılmalıdır.",,,✓,, +V13,Konfigürasyon,V13.1,Konfigürasyon Dokümantasyonu,V13.1.4,"Uygulamanın, güvenlik açısından kritik olan gizli verileri tanımladığı ve kuruluşun tehdit modeli ve iş ihtiyaçlarına göre bu verilerin döndürülme (rotation) zamanlamasının belgelendiği doğrulanmalıdır.",,,✓,, +V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.1,"Uygulamanın, standart kullanıcı oturum mekanizmasını desteklemeyen backend bileşenleri (örneğin API'ler, ara katmanlar, veri katmanları) arasında gerçekleşen iletişimlerin kimlik doğrulamasıyla korunduğu doğrulanmalıdır. Kimlik doğrulama; bireysel hizmet hesapları, kısa ömürlü token'lar ya da sertifika tabanlı kimlik doğrulama ile yapılmalıdır ve parola, API anahtarı ya da ayrıcalıklı erişime sahip paylaşımlı hesaplar gibi sabit kimlik bilgileri kullanılmamalıdır.",,✓,✓,, +V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.2,"Uygulamanın backend bileşenleri arasında (yerel hizmetler, işletim sistemi hizmetleri, API'ler, ara katmanlar ve veri katmanları dahil) gerçekleştirilen iletişimlerin, yalnızca gerekli en az ayrıcalığa sahip hesaplarla yapıldığı doğrulanmalıdır.",,✓,✓,, +V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.3,"Bir hizmet kimlik doğrulaması için bir kimlik bilgisi kullanılması gerekiyorsa, bu kimlik bilgisinin varsayılan bir değer (örneğin root/root veya admin/admin) olmadığının doğrulanması gereklidir.",,✓,✓,, +V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.4,"Uygulamanın iletişim kurmasına izin verilen dış kaynaklar ya da sistemlerin, bir allowlist (izinli liste) ile tanımlandığı doğrulanmalıdır. Bu liste, uygulama katmanında, web sunucusunda, güvenlik duvarında veya farklı katmanların birleşiminde uygulanabilir.",,✓,✓,, +V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.5,"Web veya uygulama sunucusunun, dış sistemlere veri veya dosya gönderimi veya yüklemesi yaparken sadece belirli kaynaklara izin verecek şekilde allowlist ile yapılandırıldığı doğrulanmalıdır.",,✓,✓,, +V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.6,"Uygulamanın farklı hizmetlere bağlantı kurduğu durumlarda, bu bağlantılar için belgelenmiş yapılandırmaları (örn. maksimum eşzamanlı bağlantı, bağlantı limiti aşıldığında davranış, zaman aşımı, tekrar deneme stratejileri) takip ettiğinin doğrulanması gereklidir.",,,✓,, +V13,Konfigürasyon,V13.3,Gizli Bilgi Yönetimi,V13.3.1,"Parolalar, anahtar materyalleri, veritabanı ve üçüncü parti sistemlerle entegrasyon bilgileri, zaman tabanlı token'lar için tohum (seed) bilgileri, dahili gizli veriler ve API anahtarları gibi backend sırlarının güvenli bir şekilde oluşturulması, saklanması, erişim denetiminin sağlanması ve imha edilmesi için bir gizli bilgi yönetim çözümünün (örneğin key vault) kullanıldığı doğrulanmalıdır. Bu gizli bilgiler uygulama kaynak koduna dahil edilmemeli ve yapı çıktılarında yer almamalıdır. Seviye 3 uygulamalar için donanım destekli bir çözüm (örneğin HSM) gereklidir.",,✓,✓,, +V13,Konfigürasyon,V13.3,Gizli Bilgi Yönetimi,V13.3.2,Gizli bilgilere erişimin en az ayrıcalık prensibine uygun şekilde yapılandırıldığı doğrulanmalıdır.,,✓,✓,, +V13,Konfigürasyon,V13.3,Gizli Bilgi Yönetimi,V13.3.3,"Tüm kriptografik işlemlerin, anahtar materyallerinin güvenli bir şekilde yönetilmesi ve dışarıya sızmasının engellenmesi amacıyla, izole edilmiş bir güvenlik modülü (örneğin vault ya da donanım güvenlik modülü) aracılığıyla gerçekleştirildiği doğrulanmalıdır.",,,✓,, +V13,Konfigürasyon,V13.3,Gizli Bilgi Yönetimi,V13.3.4,Uygulamanın belgelerinde belirtildiği şekilde gizli bilgilerin süresinin dolacak şekilde yapılandırıldığı ve düzenli olarak döndürüldüğü doğrulanmalıdır.,,,✓,, +V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.1,Uygulamanın .git veya .svn klasörleri gibi kaynak kontrolüyle ilgili metadata içermeyecek şekilde deploy edildiğini ya da bu klasörlerin hem dış erişime hem de uygulama erişimine kapalı olduğu doğrulanmalıdır.,✓,✓,✓,, +V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.2,Tüm bileşenler için üretim ortamlarında hata ayıklama (debug) modlarının devre dışı bırakıldığı doğrulanmalıdır.,,✓,✓,, +V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.3,"Web sunucularının, açık şekilde istenmediği sürece dizin listelemesi (directory listing) özelliğini istemcilere sunmadığı doğrulanmalıdır.",,✓,✓,, +V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.4,"HTTP TRACE metodunun üretim ortamlarında desteklenmediği, böylece potansiyel bilgi sızıntılarının önlendiği doğrulanmalıdır.",,✓,✓,, +V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.5,Belgeler (örneğin dahili API belgeleri) ve izleme uç noktalarının (monitoring endpoints) yalnızca açıkça belirtildiği durumlarda erişilebilir olduğu doğrulanmalıdır.,,✓,✓,, +V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.6,Uygulamanın arka uç bileşenlerinin ayrıntılı sürüm bilgilerini ifşa etmediği doğrulanmalıdır.,,,✓,, +V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.7,"Web katmanının yalnızca belirli dosya uzantılarına sahip dosyaları sunacak şekilde yapılandırıldığı, bu sayede istem dışı bilgi, yapılandırma ya da kaynak kod sızıntılarının önlendiği doğrulanmalıdır.",,,✓,, +V14,Veri Koruma,V14.1,Veri Koruma Dokümantasyonu,V14.1.1,"Uygulama tarafından oluşturulan ve işlenen tüm hassas verilerin tanımlanıp, koruma seviyelerine göre sınıflandırıldığından emin olun. Bu, yalnızca kodlanmış (örneğin Base64 stringleri ya da JWT içindeki düz metin yükler gibi) ve bu nedenle kolayca çözülebilir verileri de içermelidir. Koruma seviyeleri, uygulamanın uymakla yükümlü olduğu veri koruma ve gizlilik düzenlemeleri ile standartlarını dikkate almalıdır.",,✓,✓,, +V14,Veri Koruma,V14.1,Veri Koruma Dokümantasyonu,V14.1.2,"Tüm hassas veri koruma seviyeleri için belgelenmiş bir koruma gereksinimleri seti tanımlandığından emin olun. Bu gereksinimler genel şifreleme, bütünlük doğrulama, saklama süresi, verinin nasıl günlüğe kaydedileceği, günlüklerdeki hassas verilere erişim kontrolleri, veritabanı düzeyinde şifreleme, gizlilik ve gizliliği artırıcı teknolojiler ile diğer gizlilik gereksinimlerini kapsamalıdır.",,✓,✓,, +V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.1,"Hassas verilerin yalnızca HTTP message body veya header alanlarında sunucuya gönderildiği ve URL ile sorgu parametrelerinin, API anahtarı veya session token’ı gibi hassas bilgiler içermediği doğrulanmalıdır.",✓,✓,✓,, +V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.2,"Hassas verilerin, yük dengeleyiciler ve uygulama önbellekleri gibi sunucu bileşenlerinde önbelleğe alınmasının engellendiği veya kullanım sonrası bu verilerin güvenli biçimde temizlendiği doğrulanmalıdır.",,✓,✓,, +V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.3,"Uygulama kontrolü dışında veri toplanmasını engellemek için, tanımlanmış hassas verilerin, kullanıcı izleyicileri gibi güvensiz taraflara gönderilmediği doğrulanmalıdır.",,✓,✓,, +V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.4,"Hassas verilere yönelik şifreleme, bütünlük doğrulama, veri saklama, loglama yöntemi, loglardaki erişim kontrolleri, gizlilik teknolojileri gibi kontrollerin, söz konusu verinin belgelenmiş koruma seviyesinde tanımlandığı şekilde uygulandığı doğrulanmalıdır.",,✓,✓,, +V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.5,"Önbellekleme mekanizmalarının yalnızca belirli içerik türüne sahip yanıtları önbelleğe alacak şekilde yapılandırıldığı ve hassas, dinamik içeriklerin önbelleğe alınmadığı doğrulanmalıdır. Web sunucusu, mevcut olmayan bir dosya talebinde geçerli ama farklı bir dosya döndürmek yerine 404 veya 302 cevabı vermelidir. Bu, Web Cache Deception saldırılarını önlemeye yardımcı olur.",,,✓,, +V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.6,"Uygulamanın yalnızca işlevsellik için gerekli olan asgari hassas veriyi döndürdüğü doğrulanmalıdır. Örneğin, kredi kartı numarasının yalnızca bazı rakamlarının döndürülmesi; tam numaranın döndürülmesi gerekiyorsa, kullanıcı arayüzünde gizlenmiş (maskelenmiş) şekilde sunulması gerekir, aksi kullanıcı özel olarak görüntülemek istemedikçe gösterilmemelidir.",,,✓,, +V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.7,"Hassas bilgilerin, veri saklama sınıflandırmasına tabi tutulduğu, geçerliliğini yitirmiş veya artık gerekli olmayan verilerin belirlenmiş bir zaman çizelgesiyle ya da gerektiğinde otomatik olarak silindiği doğrulanmalıdır.",,,✓,, +V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.8,Kullanıcı tarafından yüklenen dosyaların meta verilerinden hassas bilgilerin çıkarıldığı veya bu bilgilerin yalnızca kullanıcıdan açık onay alındığında saklandığı doğrulanmalıdır.,,,✓,, +V14,Veri Koruma,V14.3,İstemci Tarafı Veri Koruması,V14.3.1,"Kimliği doğrulanmış verilerin, istemci veya oturum sonlandığında istemci depolamasından (örneğin tarayıcı DOM’undan) temizlendiği doğrulanmalıdır. 'Clear-Site-Data' HTTP response header bu konuda yardımcı olabilir ancak istemci tarafı, sunucu bağlantısı mevcut olmadığında da temizlik işlemini yapabiliyor olmalıdır.",✓,✓,✓,, +V14,Veri Koruma,V14.3,İstemci Tarafı Veri Koruması,V14.3.2,"Uygulamanın, tarayıcılarda hassas verilerin önbelleğe alınmasını önlemek amacıyla yeterli anti-önbellekleme HTTP response header (örneğin Cache-Control: no-store) ayarladığı doğrulanmalıdır.",,✓,✓,, +V14,Veri Koruma,V14.3,İstemci Tarafı Veri Koruması,V14.3.3,"Tarayıcıda depolanan verilerin (örneğin localStorage, sessionStorage, IndexedDB veya çerezler) hassas veri içermediği, yalnızca session token’larının istisna olarak kabul edildiği doğrulanmalıdır.",,✓,✓,, +V15,Güvenli Kodlama ve Mimari,V15.1,Güvenli Kodlama ve Mimari Dokümantasyonu,V15.1.1,"Güvenlik açığı içeren üçüncü taraf bileşen sürümleri ve genel olarak kütüphane güncellemeleri için, uygulama dokümantasyonunda risk bazlı düzeltme zamanlarının tanımlandığı doğrulanmalıdır.",✓,✓,✓,, +V15,Güvenli Kodlama ve Mimari,V15.1,Güvenli Kodlama ve Mimari Dokümantasyonu,V15.1.2,"Yazılım bileşen listesi (Software Bill of Materials - SBOM) gibi bir envanterin tutulduğu, kullanılan tüm üçüncü taraf kütüphanelerin önceden tanımlanmış, güvenilir ve düzenli olarak güncellenen depolardan alındığı doğrulanmalıdır.",,✓,✓,, +V15,Güvenli Kodlama ve Mimari,V15.1,Güvenli Kodlama ve Mimari Dokümantasyonu,V15.1.3,"Uygulama dokümantasyonunda zaman veya kaynak açısından yoğun işlevlerin tanımlandığı, bu işlevlerin aşırı kullanımı durumunda kullanılabilirlik kaybının nasıl önleneceği ve yanıt oluşturma süresinin istemci zaman aşımını aşmaması için hangi önlemlerin alındığı belirtilmelidir. Örnek savunmalar kuyruklama, eşzamansız işleme, kullanıcı başına ve uygulama genelinde paralel işlem sınırlarını içerebilir.",,✓,✓,, +V15,Güvenli Kodlama ve Mimari,V15.1,Güvenli Kodlama ve Mimari Dokümantasyonu,V15.1.4,"Uygulama dokümantasyonunda ""riskli bileşenler"" olarak değerlendirilen üçüncü taraf kütüphanelerin vurgulandığı doğrulanmalıdır.",,,✓,, +V15,Güvenli Kodlama ve Mimari,V15.1,Güvenli Kodlama ve Mimari Dokümantasyonu,V15.1.5,"Uygulama dokümantasyonunda ""tehlikeli işlevsellik"" içeren uygulama bölümlerinin açıkça belirtildiği doğrulanmalıdır.",,,✓,, +V15,Güvenli Kodlama ve Mimari,V15.2,Güvenlik Mimarisi ve Bağımlılıklar,V15.2.1,"Uygulamanın yalnızca, belgelenmiş güncelleme ve düzeltme sürelerini aşmamış bileşenleri içerdiği doğrulanmalıdır.",✓,✓,✓,, +V15,Güvenli Kodlama ve Mimari,V15.2,Güvenlik Mimarisi ve Bağımlılıklar,V15.2.2,"Uygulamanın, belgelenmiş güvenlik kararları ve stratejilere dayanarak, zaman veya kaynak açısından yoğun işlevlerin neden olabileceği kullanılabilirlik kaybına karşı savunmalar uyguladığı doğrulanmalıdır.",,✓,✓,, +V15,Güvenli Kodlama ve Mimari,V15.2,Güvenlik Mimarisi ve Bağımlılıklar,V15.2.3,"Üretim ortamının yalnızca uygulamanın çalışması için gerekli işlevleri içerdiği ve test kodları, örnek kod parçaları veya geliştirme işlevleri gibi gereksiz işlevsellikleri açığa çıkarmadığı doğrulanmalıdır.",,✓,✓,, +V15,Güvenli Kodlama ve Mimari,V15.2,Güvenlik Mimarisi ve Bağımlılıklar,V15.2.4,Üçüncü taraf bileşenlerin ve bunların tüm transitif bağımlılıklarının beklenen depolardan (iç kaynaklı ya da harici) alındığı ve bağımlılık karışıklığı (dependency confusion) saldırılarına açık olmadığı doğrulanmalıdır.,,,✓,, +V15,Güvenli Kodlama ve Mimari,V15.2,Güvenlik Mimarisi ve Bağımlılıklar,V15.2.5,"Uygulamanın, “tehlikeli işlevsellik” içeren veya “riskli bileşenler” kullanan bölümlerine ek korumalar uyguladığı doğrulanmalıdır. Bu korumalar sandbox, kapsülleme, konteynerleştirme veya ağ düzeyinde izolasyon gibi teknikler aracılığıyla, bir uygulama bölümünün ele geçirilmesi durumunda saldırganın diğer bölümlere sıçramasını geciktirmeyi veya engellemeyi amaçlamalıdır.",,,✓,, +V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.1,"Uygulamanın yalnızca gerekli alanların bir alt kümesini veri nesnesinden döndürdüğü doğrulanmalıdır. Örneğin, bazı alanlara kullanıcıların erişmemesi gerektiğinden tüm veri nesnesi döndürülmemelidir.",✓,✓,✓,, +V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.2,"Uygulama backend'i harici URL’lere çağrı yaptığında, yalnızca amaçlanan işlevsellik söz konusuysa yönlendirmeleri takip edecek şekilde yapılandırıldığının doğrulanması gerekir.",,✓,✓,, +V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.3,"Uygulamanın, kitlesel atama saldırılarına karşı, her bir controller ve eylem için izin verilen alanları sınırlandırarak savunmalar sağladığı doğrulanmalıdır. Örneğin, bir alan değeri, bu işlemde değiştirilmesi amaçlanmadıysa eklenememeli veya güncellenememelidir.",,✓,✓,, +V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.4,"Tüm proxy ve ara katman bileşenlerinin kullanıcının orijinal IP adresini, uç kullanıcı tarafından değiştirilemeyecek güvenilir veri alanları kullanarak doğru şekilde ilettiği ve uygulamanın ve web sunucusunun bu doğru değeri, loglama ve hız sınırlama gibi güvenlik kararları için kullandığı doğrulanmalıdır. Ayrıca, orijinal IP adresinin bile dinamik IP'ler, VPN'ler veya kurumsal güvenlik duvarları nedeniyle güvenilir olmayabileceği dikkate alınmalıdır.",,✓,✓,, +V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.5,"Uygulamanın değişkenlerin doğru türde olduğunu açıkça doğruladığı ve sıkı eşitlik ve karşılaştırma işlemleri kullandığı doğrulanmalıdır. Bu, değişken türüyle ilgili varsayımlardan kaynaklanan tür oynama (type juggling) veya tür karışıklığı (type confusion) güvenlik açıklarını önlemek içindir.",,✓,✓,, +V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.6,"JavaScript kodunun prototip zehirleme (prototype pollution) saldırılarını önleyecek şekilde yazıldığı, örneğin, nesne literal’leri yerine Set() veya Map() gibi yapılar kullanıldığı doğrulanmalıdır.",,✓,✓,, +V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.7,"Uygulamanın, özellikle framework'ün istek parametrelerinin kaynağı (sorgu dizgisi, gövde parametreleri, çerezler veya başlık alanları) arasında ayrım yapmadığı durumlarda, HTTP parametre kirliliği (HTTP parameter pollution) saldırılarına karşı savunmalar uyguladığı doğrulanmalıdır.",,✓,✓,, +V15,Güvenli Kodlama ve Mimari,V15.4,Güvenli Eş Zamanlılık (Concurrency),V15.4.1,"Çok iş parçacıklı kodda (örneğin cache'ler, dosyalar veya birden fazla iş parçacığı tarafından erişilen bellek içi nesneler gibi) paylaşılan nesnelere yalnızca thread-safe (iş parçacığı güvenli) türler ve kilitleme (lock) veya semaphore gibi senkronizasyon mekanizmaları kullanılarak erişildiği doğrulanmalıdır. Bu, yarış durumlarını ve veri bozulmasını önlemeye yöneliktir.",,,✓,, +V15,Güvenli Kodlama ve Mimari,V15.4,Güvenli Eş Zamanlılık (Concurrency),V15.4.2,"Bir kaynağın durumu üzerindeki kontroller (örneğin varlığı ya da izinleri gibi) ile bu kontrole bağlı eylemlerin tek bir atomik işlem olarak gerçekleştirildiği doğrulanmalıdır. Bu, TOCTOU (time-of-check to time-of-use) yarış durumlarını önlemeye yöneliktir. Bir dosyanın varlığının kontrol edilip ardından açılması veya bir kullanıcının erişiminin doğrulanıp ardından yetki verilmesi gibi işlemler buna örnektir.",,,✓,, +V15,Güvenli Kodlama ve Mimari,V15.4,Güvenli Eş Zamanlılık (Concurrency),V15.4.3,"Kilitlerin (locks) tutarlı biçimde kullanıldığı, iş parçacıklarının birbirini beklemesi ya da sonsuz döngüye girmesi (deadlock veya livelock) gibi durumların önlendiği doğrulanmalıdır. Ayrıca, kilitleme mantığı, kaynağı yöneten kod içinde kalmalı ve dış sınıflar veya dış kodlar tarafından istemeden veya kötü niyetli şekilde değiştirilememelidir.",,,✓,, +V15,Güvenli Kodlama ve Mimari,V15.4,Güvenli Eş Zamanlılık (Concurrency),V15.4.4,"Kaynak tahsis politikalarının, iş parçacığı açlığını önleyecek şekilde, kaynaklara adil erişimi sağladığı doğrulanmalıdır. Örneğin, thread pool (iş parçacığı havuzu) kullanımı, düşük öncelikli iş parçacıklarının da makul sürelerde çalışabilmesi için uygulanmalıdır.",,,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.1,Güvenlik Loglaması Dokümantasyonu,V16.1.1,"Uygulamanın teknoloji yığını boyunca her katmanda hangi olayların loglandığını, log formatlarını, logların nereye yazıldığını, nasıl kullanıldığını, erişimin nasıl kontrol edildiğini ve logların ne kadar süre saklandığını belgeleyen bir envanterin mevcut olduğu doğrulanmalıdır.",,✓,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.2,Genel Loglama,V16.2.1,"Her bir log girdisinin, olayın ne zaman, nerede, kim tarafından ve ne olduğuna dair detaylı bir zaman çizelgesi oluşturulmasına olanak tanıyacak gerekli meta verileri içerdiği doğrulanmalıdır.",,✓,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.2,Genel Loglama,V16.2.2,"Tüm loglama bileşenlerinin zaman kaynaklarının senkronize olduğu ve güvenlik olayı meta verisindeki zaman damgalarının UTC kullanarak ya da açık zaman dilimi ofsetiyle belirtildiği doğrulanmalıdır. UTC kullanımı, özellikle yaz saati uygulamaları nedeniyle oluşabilecek karışıklıkları önlemek için tavsiye edilir.",,✓,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.2,Genel Loglama,V16.2.3,Uygulamanın yalnızca log envanterinde belgelenmiş dosya ve hizmetlere log yazdığı ya da ilettiği doğrulanmalıdır.,,✓,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.2,Genel Loglama,V16.2.4,Logların kullanılan log işleyici (log processor) tarafından okunabildiği ve ilişkilendirilebildiği doğrulanmalıdır. Tercihen yaygın bir log formatı kullanılmalıdır.,,✓,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.2,Genel Loglama,V16.2.5,"Hassas veriler loglanırken, uygulamanın veri koruma seviyesine uygun olarak loglama yaptığı doğrulanmalıdır. Örneğin kimlik bilgileri veya ödeme detayları gibi bazı verilerin loglanmasına izin verilmemelidir. Session token’ları gibi veriler ise yalnızca tamamen ya da kısmen maskelenmiş ya da hash’lenmiş olarak loglanmalıdır.",,✓,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.3,Güvenlik Olayları,V16.3.1,Tüm kimlik doğrulama işlemlerinin (başarılı ve başarısız girişimler dahil) loglandığı doğrulanmalıdır. Kullanılan kimlik doğrulama türü veya faktörleri gibi ek meta veriler de toplanmalıdır.,,✓,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.3,Güvenlik Olayları,V16.3.2,"Başarısız yetkilendirme girişimlerinin loglandığı doğrulanmalıdır. Seviye 3 uygulamalar için, tüm yetkilendirme kararlarının ve hassas verilere erişim olaylarının (verinin kendisi olmadan) loglandığı da doğrulanmalıdır.",,✓,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.3,Güvenlik Olayları,V16.3.3,"Uygulamanın, belgelenmiş güvenlik olaylarını ve güvenlik kontrollerini aşma girişimlerini (girdi doğrulama, iş mantığı, otomasyon karşıtı kontroller vb.) logladığı doğrulanmalıdır.",,✓,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.3,Güvenlik Olayları,V16.3.4,Beklenmeyen hatalar ve güvenlik kontrolü başarısızlıkları (örneğin backend TLS hataları gibi) loglandığı doğrulanmalıdır.,,✓,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.4,Log Koruması,V16.4.1,"Tüm loglama bileşenlerinin, log enjeksiyonunu (log injection) önlemek amacıyla verileri uygun biçimde encode ettiği doğrulanmalıdır.",,✓,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.4,Log Koruması,V16.4.2,Logların yetkisiz erişime karşı korunduğu ve değiştirilemez olduğu doğrulanmalıdır.,,✓,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.4,Log Koruması,V16.4.3,"Logların analiz, tespit, uyarı ve yükseltme amacıyla mantıksal olarak ayrı bir sisteme güvenli biçimde iletildiği doğrulanmalıdır. Böylece uygulama ihlal edilse bile logların tehlikeye girmesi önlenmiş olur.",,✓,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.5,Hata Yönetimi,V16.5.1,"Beklenmedik ya da güvenlikle ilgili bir hata oluştuğunda, tüketiciye genel bir mesaj döndürüldüğü ve yığın izleri (stack trace), sorgular, gizli anahtarlar, token’lar gibi hassas sistem içi verilerin açıklanmadığı doğrulanmalıdır.",,✓,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.5,Hata Yönetimi,V16.5.2,"Uygulamanın, dış kaynaklara erişim başarısız olduğunda bile güvenli şekilde çalışmaya devam ettiği doğrulanmalıdır. Örneğin, circuit breaker ya da graceful degradation gibi desenler kullanılmalıdır.",,✓,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.5,Hata Yönetimi,V16.5.3,"Uygulamanın hata durumlarında güvenli ve düzenli şekilde başarısız olduğu doğrulanmalıdır. Bu, örneğin doğrulama hatalarına rağmen işlemlerin işlenmesine yol açabilecek fail-open durumlarını önlemelidir.",,✓,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.5,Hata Yönetimi,V16.5.4,"Ele alınmamış tüm istisnaları yakalayacak şekilde tanımlanmış bir “son çare hata yöneticisi” bulunduğu doğrulanmalıdır. Bu, hem loglara gitmesi gereken hata detaylarının kaybolmaması hem de tüm uygulama sürecinin çökerek hizmet dışı kalmasının önlenmesi açısından önemlidir.",,,✓,, +V17,WebRTC,V17.1,TURN Sunucusu,V17.1.1,"TURN hizmetinin yalnızca özel amaçlar için ayrılmamış IP adreslerine (ör. iç ağlar, yayın adresleri, loopback) erişime izin verdiği doğrulanmalıdır. Bu gereksinim hem IPv4 hem de IPv6 adresleri için geçerlidir.",,✓,✓,, +V17,WebRTC,V17.1,TURN Sunucusu,V17.1.2,"TURN hizmetinin, meşru kullanıcıların sunucuda çok sayıda bağlantı noktası açmaya çalışması durumunda kaynak tüketimi saldırılarına karşı dayanıklı olduğu doğrulanmalıdır.",,,✓,, +V17,WebRTC,V17.2,Medya,V17.2.1,"DTLS sertifikası anahtarının, belgelenmiş kriptografik anahtar yönetim politikasına uygun şekilde yönetildiği ve korunduğu doğrulanmalıdır.",,✓,✓,, +V17,WebRTC,V17.2,Medya,V17.2.2,Medya sunucusunun onaylı DTLS şifre takımlarını (cipher suites) ve Güvenli Gerçek Zamanlı Aktarım Protokolü (Secure Real-time Transport Protocol - SRTP) için anahtarlar oluşturmaya yönelik DTLS Uzantısı için güvenli bir koruma profilini kullanacak ve destekleyecek şekilde yapılandırıldığı (DTLS-SRTP) doğrulanmalıdır.,,✓,✓,, +V17,WebRTC,V17.2,Medya,V17.2.3,Real-time Transport Protocol (RTP) injection saldırılarının bir hizmet reddi durumuna veya medya akışlarına ses veya video medyası eklenmesine yol açmasını önlemek için medya sunucusunda Güvenli SRTP kimlik doğrulamasının kontrol edildiği doğrulanmalıdır.,,✓,✓,, +V17,WebRTC,V17.2,Medya,V17.2.4,Verify that the media server is able to continue processing incoming media traffic when encountering malformed Secure Real-time Transport Protocol (SRTP) packets.,,✓,✓,, +V17,WebRTC,V17.2,Medya,V17.2.5,"Medya sunucusunun, meşru kullanıcılardan gelen SRTP flood'ı sırasında gelen medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.",,,✓,, +V17,WebRTC,V17.2,Medya,V17.2.6,"Medya sunucusunun DTLS içinde yer alan ""ClientHello"" yarış durumu güvenlik açığına karşı savunmasız olmadığı, medya sunucusunun güvenlik açığına sahip olduğunun açıkça bilinip bilinmediği kontrol edilerek veya yarış koşulu testi gerçekleştirilerek doğrulanmalıdır.",,,✓,, +V17,WebRTC,V17.2,Medya,V17.2.7,"Medya sunucusuna bağlı ses veya video kayıt mekanizmalarının, meşru kullanıcı kaynaklı SRTP flood'ı sırasında medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.",,,✓,, +V17,WebRTC,V17.2,Medya,V17.2.8,"DTLS sertifikasının, SDP (Session Description Protocol) fingerprint özelliği ile karşılaştırıldığı ve doğrulama başarısız olursa medya akışının sonlandırıldığı, medya akışının özgünlüğünü sağlamak için doğrulanmalıdır.",,,✓,, +V17,WebRTC,V17.3,Sinyalizasyon,V17.3.1,"Sinyalizasyon sunucusunun, flood saldırısı altında bile meşru sinyalizasyon mesajlarını işlemeye devam edebildiği doğrulanmalıdır. Bu, sinyalizasyon düzeyinde oran sınırlaması uygulanarak sağlanmalıdır.",,✓,✓,, +V17,WebRTC,V17.3,Sinyalizasyon,V17.3.2,"Sinyalizasyon sunucusunun, hizmet reddine yol açabilecek şekilde yapılandırılmış bozuk sinyalizasyon mesajlarıyla karşılaştığında bile meşru mesajları işlemeye devam edebildiği doğrulanmalıdır. Bu, girdi doğrulaması, integer overflow ve buffer overflow'a karşı savunma ve sağlam hata işleme teknikleri ile sağlanmalıdır.",,✓,✓,, + diff --git a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.json b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.json new file mode 100644 index 0000000000..52c7591547 --- /dev/null +++ b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.json @@ -0,0 +1,7183 @@ +{ + "Name": "Application Security Verification Standard Project", + "ShortName": "ASVS", + "Version": "", + "Description": "The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.", + "Requirements": [ + { + "Shortcode": "V1", + "Ordinal": 1, + "ShortName": "Encoding", + "Name": "Kodlama (Encoding) ve Temizleme", + "Items": [ + { + "Shortcode": "V1.1", + "Ordinal": 1, + "Name": "Kodlama ve Temizleme Mimarisi", + "Items": [ + { + "Shortcode": "V1.1.1", + "Ordinal": 1, + "Description": "Girdinin yalnızca bir kez kanonik forma (canonical form) çözümlendiği veya kaçış işlemlerinin kaldırıldığı, bu işlemin yalnızca verinin bu biçimde beklenmesi durumunda yapıldığı ve bu işlemin girdi doğrulama veya temizleme işlemlerinden sonra değil, önce gerçekleştiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.1.2", + "Ordinal": 2, + "Description": "Uygulamanın, çıktıyı kullanılması gereken yorumlayıcıya verilmeden hemen önce veya yorumlayıcının kendisi tarafından çıktı kodlaması ya da kaçış işlemi yaptığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V1.2", + "Ordinal": 2, + "Name": "Enjeksiyon Önleme", + "Items": [ + { + "Shortcode": "V1.2.1", + "Ordinal": 1, + "Description": "HTTP yanıtı, HTML veya XML belgesi için yapılan çıktı kodlamasının; HTML elemanları, HTML öznitelikleri, HTML yorumları, CSS ya da HTTP başlık alanları gibi bağlamlara uygun olduğu doğrulanmalıdır. Böylece mesaj veya belge yapısının bozulması önlenir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.2", + "Ordinal": 2, + "Description": "Dinamik olarak URL oluşturulurken, güvenilmeyen verinin bağlamına göre (örneğin, sorgu veya yol parametreleri için URL kodlaması ya da base64url kodlaması) kodlandığı doğrulanmalıdır. Yalnızca güvenli URL protokollerine izin verilmelidir (örneğin, javascript: veya data: yasaklanmalıdır).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.3", + "Ordinal": 3, + "Description": "JavaScript içeriği (JSON dahil) dinamik olarak oluşturulurken çıktı kodlama/kaçış kullanıldığı doğrulanmalıdır. Böylece mesaj veya belge yapısı değiştirilmemiş olur (JavaScript ve JSON enjeksiyonlarının önüne geçilir).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.4", + "Ordinal": 4, + "Description": "Veri sorguları veya veritabanı sorguları (SQL, HQL, NoSQL, Cypher vb.) için parametreli sorgular, ORM’ler, entity framework’ler kullanıldığı ya da SQL enjeksiyonu ve diğer veritabanı enjeksiyon saldırılarına karşı koruma sağlandığı doğrulanmalıdır. Bu durum, saklı yordam (stored procedure) yazarken de geçerlidir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.5", + "Ordinal": 5, + "Description": "Uygulamanın işletim sistemi komut enjeksiyonlarına karşı korunduğu ve işletim sistemi çağrılarında parametreli OS sorguları veya bağlama özgü komut satırı çıktı kodlamasının kullanıldığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.6", + "Ordinal": 6, + "Description": "Uygulamanın LDAP enjeksiyon zafiyetlerine karşı korunduğu ya da LDAP enjeksiyonlarını önlemek için özel güvenlik kontrollerinin uygulandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.7", + "Ordinal": 7, + "Description": "XPath enjeksiyon saldırılarına karşı, sorgu parametrelemesi veya önceden derlenmiş sorgular kullanılarak koruma sağlandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.8", + "Ordinal": 8, + "Description": "LaTeX işlemcilerinin güvenli şekilde yapılandırıldığı (örneğin, --shell-escape bayrağının kullanılmadığı) ve yalnızca izin verilen komutlardan oluşan bir listeyle çalıştırıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.9", + "Ordinal": 9, + "Description": "Düzenli ifadelerde (regex) özel karakterlerin (genellikle ters eğik çizgi \\ ile) kaçırılarak meta karakter olarak yorumlanmalarının önlendiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.10", + "Ordinal": 10, + "Description": "Uygulamanın CSV ve formül enjeksiyonlarına karşı korunduğu doğrulanmalıdır. Uygulama, CSV içeriği dışa aktarırken RFC 4180 Bölüm 2.6 ve 2.7'de tanımlanan kaçış kurallarına uymalıdır. Ayrıca, CSV veya diğer tablo formatlarına (XLS, XLSX, ODF gibi) aktarım yapılırken, alanın ilk karakteri olarak çıkan özel karakterler ('=', '+', '-', '@', '\\t' (sekme), '\\0' (null karakter)) tek tırnak (') ile kaçırılmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V1.3", + "Ordinal": 3, + "Name": "Temizleme (Sanitization)", + "Items": [ + { + "Shortcode": "V1.3.1", + "Ordinal": 1, + "Description": "WYSIWYG editörlerinden veya benzer kaynaklardan gelen tüm güvenilmeyen HTML girdilerinin, bilinen ve güvenli bir HTML temizleme kütüphanesi ya da çerçeve özelliği ile temizlendiği doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.2", + "Ordinal": 2, + "Description": "Uygulamanın eval() veya Spring Expression Language (SpEL) gibi dinamik kod çalıştırma özelliklerini kullanmaktan kaçındığı doğrulanmalıdır. Alternatif yoksa, kullanıcı girdisi çalıştırılmadan önce mutlaka temizlenmelidir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.3", + "Ordinal": 3, + "Description": "Potansiyel olarak tehlikeli bir bağlamda kullanılacak verilerin, bu bağlama uygun karakterlere izin vermek ve çok uzun girdileri kısaltmak gibi güvenlik önlemleriyle önceden temizlendiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.4", + "Ordinal": 4, + "Description": "Kullanıcı tarafından sağlanan SVG içeriğinin, yalnızca güvenli etiket ve özellikler (örneğin grafik çizme ile ilgili) içerdiğinden emin olmak için onaylandığı veya temizlendiği doğrulanmalıdır (ör. script veya foreignObject içermemelidir).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.5", + "Ordinal": 5, + "Description": "Markdown, CSS, XSL stil sayfaları, BBCode veya benzeri ifade şablon dillerinde kullanıcı girdisinin temizlendiği veya bu tür özelliklerin devre dışı bırakıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.6", + "Ordinal": 6, + "Description": "Uygulamanın, güvenilmeyen verileri başka servislere iletmeden önce izinli protokol, alan adı, yol ve port listelerine göre doğruladığı ve tehlikeli karakterleri temizlediği doğrulanarak SSRF (Sunucu Taraflı İstek Sahteciliği) saldırılarına karşı korunduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.7", + "Ordinal": 7, + "Description": "Uygulamanın şablon enjeksiyon saldırılarına karşı, güvenilmeyen girdilere dayalı şablon oluşturmayı engellediği; eğer bu kaçınılmazsa, bu girdilerin mutlaka temizlendiği veya sıkı şekilde onaylandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.8", + "Ordinal": 8, + "Description": "JNDI sorgularında kullanılmadan önce güvenilmeyen girdilerin temizlendiği ve JNDI'nin enjeksiyonlara karşı güvenli şekilde yapılandırıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.9", + "Ordinal": 9, + "Description": "Memcache’e gönderilmeden önce içeriğin temizlenerek enjeksiyon saldırılarına karşı korunduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.10", + "Ordinal": 10, + "Description": "Format dizgilerinin (format strings) beklenmeyen veya zararlı şekilde çözümlenmesini önlemek için işlenmeden önce temizlendiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.11", + "Ordinal": 11, + "Description": "SMTP veya IMAP enjeksiyonlarını önlemek için, kullanıcı girdisinin posta sistemlerine iletilmeden önce temizlendiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.12", + "Ordinal": 12, + "Description": "Regex girdilerinin üstel geri izlemeye (exponential backtracking) neden olan öğeler içermediği ve güvenilmeyen girdilerin ReDoS (Regex Denial of Service) gibi saldırılara karşı temizlendiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V1.4", + "Ordinal": 4, + "Name": "Bellek, Dizgi ve Yönetilmeyen Kod", + "Items": [ + { + "Shortcode": "V1.4.1", + "Ordinal": 1, + "Description": "Yığın, arabellek (buffer) veya yığın belleği taşmalarını önlemek ya da tespit etmek amacıyla, bellek güvenli dizgi işlemlerinin, daha güvenli bellek kopyalama ve işaretçi aritmetiğinin kullanıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.4.2", + "Ordinal": 2, + "Description": "Tamsayı taşmalarını önlemek için işaret (sign), aralık (range) ve giriş doğrulama tekniklerinin kullanıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.4.3", + "Ordinal": 3, + "Description": "Dinamik olarak ayrılan belleğin ve kaynakların serbest bırakıldığı ve boşaltılan belleklere ait referansların veya işaretçilerin kaldırıldığı veya null yapıldığı doğrulanmalıdır (dangling pointer ve use-after-free zafiyetlerine karşı).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V1.5", + "Ordinal": 5, + "Name": "Güvenli Ters Serileştirme (Safe Deserialization)", + "Items": [ + { + "Shortcode": "V1.5.1", + "Ordinal": 1, + "Description": "XML ayrıştırıcılarının (parser) kısıtlayıcı şekilde yapılandırıldığı ve dış varlık çözümleme (external entity resolution) gibi güvensiz özelliklerin XXE (XML eXternal Entity) saldırılarına karşı devre dışı bırakıldığı doğrulanmalıdır .", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.5.2", + "Ordinal": 2, + "Description": "Güvenilmeyen verilerin ters serileştirilmesinde, nesne türleri için izinli liste kullanımı veya istemci tanımlı nesne türlerinin kısıtlanması gibi güvenli giriş işleme önlemlerinin uygulandığı doğrulanmalıdır. Güvensiz olarak tanımlanmış ters serileştirme mekanizmaları, güvenilmeyen girdilerle kullanılmamalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.5.3", + "Ordinal": 3, + "Description": "Aynı veri türü için uygulamada kullanılan farklı parser'ların (ör. JSON, XML, URL parser'ları), veriyi tutarlı şekilde ayrıştırdığı ve aynı karakter kodlamasını kullandığı doğrulanmalıdır. Böylece JSON birlikte çalışabilirlik açıkları, URI veya dosya ayrıştırma farkları gibi sorunlar nedeniyle RFI veya SSRF saldırılarının istismar edilmesi önlenir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V2", + "Ordinal": 2, + "ShortName": "Validation", + "Name": "Doğrulama ve İş Mantığı", + "Items": [ + { + "Shortcode": "V2.1", + "Ordinal": 1, + "Name": "Doğrulama ve İş Mantığı Dokümantasyonu", + "Items": [ + { + "Shortcode": "V2.1.1", + "Ordinal": 1, + "Description": "Uygulama dokümantasyonunda, veri öğelerinin beklenen yapıya göre nasıl doğrulanacağına ilişkin giriş doğrulama kurallarının tanımlandığı doğrulanmalıdır. Bu; kredi kartı numaraları, e-posta adresleri, telefon numaraları gibi yaygın veri biçimleri olabileceği gibi iç sistemlere özel biçimler de olabilir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.1.2", + "Ordinal": 2, + "Description": "Uygulama dokümantasyonunda, birleştirilmiş veri öğelerinin mantıksal ve bağlamsal tutarlılığının nasıl doğrulanacağı tanımlanmalıdır (örneğin, mahalle ve posta kodunun eşleşip eşleşmediğinin kontrolü).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.1.3", + "Ordinal": 3, + "Description": "Hem kullanıcı bazında hem de uygulama genelinde geçerli olacak şekilde, iş mantığı sınırları ve doğrulama beklentilerinin belgelendiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V2.2", + "Ordinal": 2, + "Name": "Girdi Doğrulama", + "Items": [ + { + "Shortcode": "V2.2.1", + "Ordinal": 1, + "Description": "Girdilerin, işlevsel ya da iş gereksinimlerine uygunluğunun doğrulandığı teyit edilmelidir. Bu işlem; izinli değerler, desenler ve aralıklar listesine karşı pozitif doğrulama ile ya da girdinin beklenen yapıya ve mantıksal sınırlara uygunluğunun önceden tanımlanmış kurallara göre karşılaştırılması ile yapılmalıdır. Seviye 1 için bu, güvenlik veya iş kararlarında kullanılan girdilere odaklanabilir. Seviye 2 ve üstü için tüm girdilere uygulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.2.2", + "Ordinal": 2, + "Description": "Uygulamanın, güvenilir bir servis katmanında girdi doğrulama zorunluluğu uygulayacak şekilde tasarlandığı doğrulanmalıdır. İstemci tarafında gerçekleştirilen doğrulama, kullanılabilirliği artırabilir ve teşvik edilmelidir. Ancak bu doğrulama,güvenlik kontrolü olarak kabul edilmemelidir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.2.3", + "Ordinal": 3, + "Description": "Uygulamanın, ilişkili veri öğelerinin önceden tanımlanmış kurallara göre makul olup olmadığını kontrol ettiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V2.3", + "Ordinal": 3, + "Name": "İş Mantığı Güvenliği", + "Items": [ + { + "Shortcode": "V2.3.1", + "Ordinal": 1, + "Description": "Uygulamanın, aynı kullanıcı için iş mantığı akışlarını yalnızca beklenen adım sırasına göre ve adım atlamadan işlediği doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.3.2", + "Ordinal": 2, + "Description": "İş mantığı sınırlarının, uygulama dokümantasyonuna uygun şekilde uygulandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.3.3", + "Ordinal": 3, + "Description": "İş mantığı seviyesinde işlemlerin (transaction) kullanıldığı ve bir iş mantığı işleminin ya bütünüyle başarıyla tamamlandığı ya da önceki geçerli duruma geri döndürüldüğü (rollback) doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.3.4", + "Ordinal": 4, + "Description": "İş mantığı düzeyinde kilitleme mekanizmalarının, sınırlı kaynakların (ör. sinema koltukları, teslimat zamanları) uygulamanın mantığı manipüle edilerek çift rezervasyona neden olmamasını sağladığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.3.5", + "Ordinal": 5, + "Description": "Yüksek değerli iş mantığı akışlarının, yetkisiz veya kazara gerçekleşebilecek işlemleri önlemek için çoklu kullanıcı onayı gerektirdiği doğrulanmalıdır. Bu işlemler büyük para transferleri, sözleşme onayları, gizli bilgilere erişim veya üretimde güvenlik kurallarının geçersiz kılınmaları gibi durumları içerebilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V2.4", + "Ordinal": 4, + "Name": "Otomasyon Karşıtı Önlemler", + "Items": [ + { + "Shortcode": "V2.4.1", + "Ordinal": 1, + "Description": "Uygulama işlevlerine yönelik aşırı miktardaki çağrılara karşı; veri sızdırma, anlamsız veri üretme, kota tüketme, hız sınırının aşılması, hizmet reddi (DoS) ya da maliyetli kaynakların aşırı kullanımı gibi risklere karşı otomasyon karşıtı kontrollerin bulunduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.4.2", + "Ordinal": 2, + "Description": "İş mantığı akışlarının, aşırı hızlı işlem gönderimlerini önleyecek şekilde gerçekçi insan zamanlaması gerektirdiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V3", + "Ordinal": 3, + "ShortName": "Web", + "Name": "Web Ön Uç (Frontend) Güvenliği", + "Items": [ + { + "Shortcode": "V3.1", + "Ordinal": 1, + "Name": "Web Frontend Güvenlik Dokümantasyonu", + "Items": [ + { + "Shortcode": "V3.1.1", + "Ordinal": 1, + "Description": "Uygulama dokümantasyonunda, uygulamayı kullanan tarayıcıların desteklemesi gereken güvenlik özelliklerinin (ör. HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) ve diğer ilgili HTTP güvenlik mekanizmaları) tanımlandığı doğrulanmalıdır. Ayrıca bu özelliklerin mevcut olmadığı durumlarda uygulamanın nasıl davranması gerektiği (ör. kullanıcıyı uyarmak veya erişimi engellemek) de tanımlanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.2", + "Ordinal": 2, + "Name": "İçeriğin Yanlış Yorumlanması", + "Items": [ + { + "Shortcode": "V3.2.1", + "Ordinal": 1, + "Description": "Tarayıcıların HTTP yanıtlarında içerik veya işlevi yanlış bir bağlamda sunmalarını önlemek amacıyla güvenlik kontrollerinin uygulandığı doğrulanmalıdır (ör. API, kullanıcı tarafından yüklenen dosya veya başka bir kaynağın doğrudan çağrılması durumunda). Olası kontroller arasında; yalnızca HTTP istek başlıklarının (ör. Sec-Fetch-\\*) doğru bağlamı gösterdiği durumlarda içeriğin sunulması, Content-Security-Policy başlığında \"sandbox\" yönergesinin kullanılması veya Content-Disposition başlığında \"attachment\" biçiminin kullanılması yer alabilir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.2.2", + "Ordinal": 2, + "Description": "HTML yerine metin olarak görüntülenmesi amaçlanan içeriğin, HTML veya JavaScript gibi içeriklerin istenmeden çalıştırılmasını önleyecek şekilde \"createTextNode\" veya \"textContent\" gibi güvenli işleme fonksiyonlarıyla işlendiği doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.2.3", + "Ordinal": 3, + "Description": "Uygulamanın istemci tarafı JavaScript kullanırken açık değişken tanımlamaları yaparak, sıkı tür kontrolü uygulayarak, global değişkenleri document nesnesine kaydetmekten kaçınarak ve ad alanı izolasyonu sağlayarak DOM clobbering’den kaçındığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.3", + "Ordinal": 3, + "Name": "Çerez Yapılandırması", + "Items": [ + { + "Shortcode": "V3.3.1", + "Ordinal": 1, + "Description": "Çerezlerin 'Secure' niteliğine sahip olduğu ve eğer çerez adı '\\__Host-' ön eki ile başlamıyorsa, '__Secure-' ön ekinin kullanıldığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.3.2", + "Ordinal": 2, + "Description": "Kullanıcı arayüzü kandırma saldırılarına ve tarayıcı tabanlı istek sahteciliği saldırılarına (CSRF) karşı koruma sağlamak amacıyla, her çerezin 'SameSite' niteliğinin kullanım amacına uygun şekilde ayarlandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.3.3", + "Ordinal": 3, + "Description": "Çerez adı, diğer sunucularla paylaşılmak üzere açıkça tasarlanmadığı sürece '__Host-' ön eki ile tanımlanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.3.4", + "Ordinal": 4, + "Description": "Bir çerez değeri istemci tarafı betikleri tarafından erişilememesi gereken bir veri içeriyorsa (ör. oturum token'ı), çerezin 'HttpOnly' niteliğine sahip olduğu ve aynı değerin (ör. oturum token'ı) yalnızca 'Set-Cookie' başlığı ile istemciye iletildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.3.5", + "Ordinal": 5, + "Description": "Uygulama bir çerez oluştururken, çerez adı ve değerinin toplam uzunluğunun 4096 baytı aşmadığı doğrulanmalıdır. Çok büyük çerezler tarayıcı tarafından saklanmaz ve isteklerle gönderilmez; bu da çereze bağlı çalışan uygulama işlevlerinin bozulmasına yol açabilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.4", + "Ordinal": 4, + "Name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", + "Items": [ + { + "Shortcode": "V3.4.2", + "Ordinal": 2, + "Description": "Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header'ı, uygulama tarafından sabit bir değer olarak tanımlanmalı veya gelen Origin header değeri güvenilir origin’lerden oluşan bir izinli listeye karşı doğrulanmalıdır. ‘Access-Control-Allow-Origin: *’ kullanılması gerekiyorsa, yanıtın hassas bilgi içermediği doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.3", + "Ordinal": 3, + "Description": "HTTP yanıtlarında Content-Security-Policy header'ı bulunduğu ve bu header'ın yalnızca güvenilen içeriklerin veya kaynakların yüklenmesini ve çalıştırılmasını sağlayan yönergeler içerdiği doğrulanmalıdır. Minimum olarak \"global policy\", object-src 'none', base-uri 'none' yönergelerini içermeli ve izinli liste, nonce veya hash temelli bir yapı içermelidir. Seviye 3 uygulamalarında her yanıt için nonce veya hash içeren özel bir politika tanımlanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.4", + "Ordinal": 4, + "Description": "Tüm HTTP yanıtlarının 'X-Content-Type-Options: nosniff' header'ını içerdiği doğrulanmalıdır. Bu, tarayıcıya içerik türünü tahmin etmeyi bırakmasını ve yanıtın Content-Type header'ında belirtilen MIME türünün, beklenen kaynak türüyle eşleşmesini zorunlu kılar. Ayrıca bu, tarayıcıda CORB (Cross-Origin Read Blocking) özelliğini etkinleştirir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.5", + "Ordinal": 5, + "Description": "Uygulamanın, 'Referer' başlığı yoluyla üçüncü taraflara teknik olarak hassas verilerin sızmasını önlemek için bir 'referrer policy' belirlediği doğrulanmalıdır. Bu, Referrer-Policy HTTP header'ıyla veya HTML öğe nitelikleriyle (element attributes) sağlanabilir. Sızabilecek hassas bilgiler, URL’deki yol ve sorgu parametreleri ile sınırlı uygulamalarda hostname bilgisini içerebilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.6", + "Ordinal": 6, + "Description": "Uygulamanın, Content-Security-Policy header'ı altında 'frame-ancestors' yönergesini her HTTP yanıtında tanımladığı ve bu sayede içeriklerin varsayılan olarak başka sayfalara gömülmesini engellediği doğrulanmalıdır. Gerekli durumlarda özel olarak izin verildiğinden emin olunmalıdır. 'X-Frame-Options' header'ı, tarayıcılar tarafından desteklenmesine rağmen, artık güncel değildir ve güvenlik amacıyla kullanılmamalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.8", + "Ordinal": 8, + "Description": "Bir belgenin işlenmesini ve sunulmasını başlatan tüm HTTP yanıtlarında (örneğin 'text/html' tipi yanıtlar), 'Cross-Origin-Opener-Policy' header'ı 'same-origin' veya 'same-origin-allow-popups' yönergeleriyle birlikte yer almalıdır. Bu, tabnabbing ve frame counting gibi, pencere nesnelerine paylaşımlı erişimi sömüren saldırılara karşı koruma sağlar.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.5", + "Ordinal": 5, + "Name": "Tarayıcı Menşei Ayırımı", + "Items": [ + { + "Shortcode": "V3.5.1", + "Ordinal": 1, + "Description": "Uygulama, hassas işlevselliğe yönelik izinsiz cross-origin istekleri önlemek için CORS preflight mekanizmasına güvenmiyorsa, bu tür isteklerin gerçekten uygulamadan geldiği doğrulanmalıdır. Bu, anti-forgery token kullanımı veya CORS tarafından güvenli kabul edilmeyen özel HTTP header'larının zorunlu kılınmasıyla yapılabilir. Bu, tarayıcı tabanlı istek sahteciliği (CSRF) saldırılarına karşı bir savunmadır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.2", + "Ordinal": 2, + "Description": "Uygulama, hassas işlevlerin izinsiz cross-origin çağrılmasını önlemek için CORS preflight mekanizmasına güveniyorsa, bu işlevlerin bir CORS-preflight isteğini tetiklemeden çağrılamadığı doğrulanmalıdır. Bu, 'Origin' ve 'Content-Type' header'larının doğrulanmasını veya CORS-safelisted olmayan bir header'ın ve alanın kullanılmasını gerektirebilir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.4", + "Ordinal": 4, + "Description": "Farklı uygulamaların farklı hostname'lerde barındırıldığı ve böylece Same-Origin Policy tarafından sağlanan kısıtlamalardan (örneğin çerez erişim sınırları, kaynaklar arası etkileşim kontrolleri) faydalanıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.6", + "Ordinal": 6, + "Description": "Uygulamanın herhangi bir yerinde JSONP işlevselliğinin etkin olmadığı doğrulanmalıdır. Bu, XSSI (Cross-Site Script Inclusion) saldırılarını önlemek içindir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.7", + "Ordinal": 7, + "Description": "Yetkilendirme gerektiren verilerin, JavaScript dosyaları gibi betik kaynaklarının yanıtlarında yer almadığı, XSSI saldırılarını önlemek için doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.8", + "Ordinal": 8, + "Description": "Kimliği doğrulanmış kaynakların (örneğin görseller, videolar, betikler ve belgeler) yalnızca gerçekten amaçlandığında kullanıcı adına yüklenebildiği veya gömülebildiği doğrulanmalıdır. Bu, isteğin uygun olmayan bir çapraz kaynak çağrısından kaynaklanmadığından emin olmak için Sec-Fetch-* HTTP istek başlığı alanlarının sıkı bir şekilde doğrulanmasıyla veya tarayıcıya döndürülen içeriği engelleme talimatı vermek için kısıtlayıcı bir Cross-Origin-Resource-Policy HTTP yanıt başlığı alanı ayarlayarak gerçekleştirilebilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.6", + "Ordinal": 6, + "Name": "Harici Kaynak Bütünlüğü", + "Items": [ + { + "Shortcode": "V3.6.1", + "Ordinal": 1, + "Description": "JavaScript kütüphaneleri, CSS veya web fontları gibi istemci tarafı varlıkların yalnızca statik ve sürümlü olması, varlığın bütünlüğünü doğrulamak için Subresource Integrity (SRI) kullanılması durumunda harici olarak (örneğin, bir İçerik Dağıtım Ağı üzerinde) barındırıldığı doğrulanmalıdır. Bu mümkün değilse, her bir kaynak için bunu gerekçelendiren belgelenmiş bir güvenlik kararı bulunmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.7", + "Ordinal": 7, + "Name": "Diğer Tarayıcı Güvenliği Hususları", + "Items": [ + { + "Shortcode": "V3.7.1", + "Ordinal": 1, + "Description": "Uygulamanın yalnızca hâlâ desteklenen ve güvenli kabul edilen istemci tarafı teknolojileri kullandığı doğrulanmalıdır. Bu gereksinimi karşılamayan teknolojilere örnek olarak NSAPI eklentileri, Flash, Shockwave, ActiveX, Silverlight, NACL veya istemci tarafı Java applet’leri verilebilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.7.2", + "Ordinal": 2, + "Description": "Uygulamanın, yalnızca hedef adres bir izinli listede yer alıyorsa kullanıcıyı otomatik olarak farklı bir ana makine adına veya uygulamanın kontrolünde olmayan bir etki alanına yönlendirdiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.7.3", + "Ordinal": 3, + "Description": "Uygulamanın, kullanıcı uygulamanın kontrolü dışındaki bir URL’ye yönlendirildiğinde, yönlendirme hakkında bir bildirim gösterdiği ve kullanıcının bu gezintiyi iptal edebilmesi için bir seçenek sunduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.7.4", + "Ordinal": 4, + "Description": "Uygulamanın en üst düzey etki alanının (örneğin, site.tld) HTTP Strict Transport Security (HSTS) için genel preload listesine eklendiği doğrulanmalıdır. Bu, uygulamanın TLS kullanımının ana tarayıcılar tarafından doğrudan tanınmasını ve yalnızca Strict-Transport-Security yanıt header'ına bağlı kalınmamasını sağlar.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.7.5", + "Ordinal": 5, + "Description": "Uygulamaya erişen tarayıcının beklenen güvenlik özelliklerini desteklememesi durumunda, uygulamanın dokümantasyona uygun şekilde davrandığı (örneğin kullanıcıyı uyarma veya erişimi engelleme) doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V4", + "Ordinal": 4, + "ShortName": "API", + "Name": "API ve Web Servisi", + "Items": [ + { + "Shortcode": "V4.1", + "Ordinal": 1, + "Name": "Genel Web Servisi Güvenliği", + "Items": [ + { + "Shortcode": "V4.1.1", + "Ordinal": 1, + "Description": "İleti gövdesi içeren her HTTP yanıtında, yanıtın gerçek içeriğiyle eşleşen bir Content-Type header alanı bulunduğu ve güvenli karakter kodlamasını (örneğin, UTF-8, ISO-8859-1) belirtmek üzere charset parametresi içerdiği doğrulanmalıdır. Bu işlem, IANA Medya Türleri'nden \"text/\", \"/+xml\" ve \"/xml\" gibi içerikler için geçerlidir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.1.2", + "Ordinal": 2, + "Description": "Yalnızca kullanıcı arayüzüne yönelik uç noktaların (manuel olarak web tarayıcısı ile erişilmesi amaçlanan) otomatik olarak HTTP'den HTTPS'e yönlendirme yaptığı ve diğer hizmetlerin veya uç noktaların şeffaf yönlendirme gerçekleştirmediği doğrulanmalıdır. Bu, istemcinin farkında olmadan şifrelenmemiş HTTP istekleri göndermesi ve bu isteklerin otomatik olarak HTTPS'e yönlendirilmesi sonucunda hassas verilerin sızmasının fark edilmemesi riskini önlemek içindir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.1.3", + "Ordinal": 3, + "Description": "Uygulama tarafından kullanılan ve yük dengeleyici, web proxy veya frontend için backend hizmeti gibi bir ara katman tarafından ayarlanan herhangi bir HTTP başlık alanının, son kullanıcı tarafından geçersiz kılınamayacağı doğrulanmalıdır. Örnek başlıklar arasında X-Real-IP, X-Forwarded-* veya X-User-ID yer alabilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.1.4", + "Ordinal": 4, + "Description": "Uygulama veya API tarafından açıkça desteklenen HTTP yöntemlerinin (preflight istekleri sırasında OPTIONS dahil) dışında hiçbir yöntemin kullanılmadığı ve kullanılmayan yöntemlerin engellendiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.1.5", + "Ordinal": 5, + "Description": "Çok hassas istekler veya birçok sistemden geçen işlemler için, taşıma katmanı güvenliğinin üzerine ek bir güvence sağlamak amacıyla, her iletiye özel dijital imzaların kullanıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V4.2", + "Ordinal": 2, + "Name": "HTTP İleti Yapısı Doğrulama", + "Items": [ + { + "Shortcode": "V4.2.1", + "Ordinal": 1, + "Description": "Tüm uygulama bileşenlerinin (yük dengeleyiciler, güvenlik duvarları ve uygulama sunucuları dahil) HTTP sürümüne uygun mekanizmaları kullanarak gelen HTTP iletilerinin sınırlarını belirlediği ve bu sayede HTTP istek kaçakçılığına karşı koruma sağlandığı doğrulanmalıdır. HTTP/1.x sürümünde Transfer-Encoding başlık alanı varsa, RFC 2616'ya göre Content-Length başlığı göz ardı edilmelidir. HTTP/2 veya HTTP/3 kullanıldığında, Content-Length başlığı varsa, alıcının bu değerin DATA çerçevelerinin uzunluğuyla tutarlı olduğunu doğrulaması gerekir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.2.2", + "Ordinal": 2, + "Description": "HTTP iletileri üretilirken, Content-Length başlığının, HTTP protokolünün çerçeveleme yöntemine göre belirlenen içerik uzunluğu ile çelişmediği doğrulanmalıdır. Bu, istek kaçakçılığı saldırılarını önlemek için gereklidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.2.3", + "Ordinal": 3, + "Description": "Uygulamanın, yanıt bölme ve header enjeksiyonu saldırılarını önlemek amacıyla, bağlantıya özel başlık alanları (örneğin Transfer-Encoding) içeren HTTP/2 veya HTTP/3 iletilerini göndermediği ve kabul etmediği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.2.4", + "Ordinal": 4, + "Description": "Uygulamanın yalnızca başlık alanları ve değerleri CR (\\r), LF (\\n) veya CRLF (\\r\\n) karakter dizileri içermeyen HTTP/2 ve HTTP/3 isteklerini kabul ettiği doğrulanmalıdır. Bu, başlık enjeksiyonu saldırılarını önlemek içindir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.2.5", + "Ordinal": 5, + "Description": "Uygulama (backend veya frontend) istek oluşturuyor ve gönderiyorsa, URI'ler (örneğin API çağrıları için) veya HTTP istek başlıkları (örneğin Authorization veya Cookie) gibi bileşenlerin, alıcı sistemler tarafından kabul edilemeyecek kadar uzun olmamasını sağlamak amacıyla doğrulama, temizleme veya diğer mekanizmaları kullandığı doğrulanmalıdır. Bu tür çok uzun istekler (örneğin çok uzun bir Cookie başlığı) gönderildiğinde sunucunun sürekli hata durumu döndürmesiyle hizmet reddi oluşabilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V4.3", + "Ordinal": 3, + "Name": "GraphQL", + "Items": [ + { + "Shortcode": "V4.3.1", + "Ordinal": 1, + "Description": "Maliyetli ve iç içe geçmiş sorgular sonucu oluşabilecek GraphQL veya veri katmanı ifadelerine yönelik Hizmet Reddi (DoS) saldırılarını önlemek için, sorgu izin listesi (allowlist), derinlik sınırlandırması, sorgu sayısı sınırlandırması veya sorgu maliyeti analizi kullanıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.3.2", + "Ordinal": 2, + "Description": "GraphQL introspection (iç yapı sorgulama) sorgularının, GraphQL API'nin üçüncü taraflar tarafından kullanılmasına yönelik olmadığı sürece, üretim ortamında devre dışı bırakıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V4.4", + "Ordinal": 4, + "Name": "WebSocket", + "Items": [ + { + "Shortcode": "V4.4.1", + "Ordinal": 1, + "Description": "Tüm WebSocket bağlantılarında TLS üzerinden WebSocket (WSS) kullanıldığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.4.2", + "Ordinal": 2, + "Description": "WebSocket'in başlangıçtaki HTTP el sıkışması (handshake) sırasında, Origin başlık alanının uygulama için izin verilen origin listesiyle karşılaştırılarak kontrol edildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.4.3", + "Ordinal": 3, + "Description": "Uygulamanın standart oturum yönetimi kullanılamıyorsa, bunun yerine ilgili Oturum Yönetimi güvenlik gereksinimlerine uygun özel token'ların kullanıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.4.4", + "Ordinal": 4, + "Description": "HTTPS oturumu WebSocket kanalına geçerken, özel WebSocket oturum yönetim token’larının önceki şekilde kimliği doğrulanmış HTTPS oturumu aracılığıyla elde edildiği veya doğrulandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V5", + "Ordinal": 5, + "ShortName": "File", + "Name": "Dosya İşleme", + "Items": [ + { + "Shortcode": "V5.1", + "Ordinal": 1, + "Name": "Dosya İşleme Dokümantasyonu", + "Items": [ + { + "Shortcode": "V5.1.1", + "Ordinal": 1, + "Description": "Dokümantasyonun, her yükleme özelliği için izin verilen dosya türlerini, beklenen dosya uzantılarını ve maksimum boyutu (açılmış hali dahil) tanımladığı doğrulanmalıdır. Ayrıca, dosyaların son kullanıcılar için nasıl güvenli hâle getirileceği (örneğin kötü amaçlı bir dosya tespit edildiğinde uygulamanın nasıl davranacağı) gibi bilgilerin de belgede yer aldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V5.2", + "Ordinal": 2, + "Name": "Dosya Yükleme ve İçerik", + "Items": [ + { + "Shortcode": "V5.2.1", + "Ordinal": 1, + "Description": "Uygulamanın, yalnızca performans kaybına veya hizmet reddine yol açmayacak boyuttaki dosyaları kabul ettiği doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.2", + "Ordinal": 2, + "Description": "Uygulama bir dosyayı, doğrudan veya bir arşiv (ör. zip dosyası) içinde kabul ettiğinde, dosya uzantısının beklenen uzantıyla eşleşip eşleşmediğini kontrol ettiği ve içeriğin uzantı tarafından temsil edilen türle uyumlu olduğunu doğruladığı kontrol edilmelidir. Bu; ilk 'magic byte' kontrolü, görüntü yeniden yazımı ve dosya içeriği doğrulama için özel kütüphanelerin kullanımı gibi yöntemleri içerir. Seviye 1 için bu, yalnızca iş veya güvenlik kararlarında kullanılan dosyalarla sınırlı olabilir. Seviye 2 ve üzeri için tüm dosyalar bu kontrole tabi olmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.3", + "Ordinal": 3, + "Description": "Sıkıştırılmış dosyaların (ör. zip, gz, docx, odt) açılmadan önce, izin verilen maksimum açılmış boyuta ve maksimum dosya sayısına göre kontrol edildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.4", + "Ordinal": 4, + "Description": "Her kullanıcı için dosya boyutu kotası ve maksimum dosya sayısının uygulandığı doğrulanmalıdır. Böylece tek bir kullanıcının çok sayıda veya aşırı büyük dosya yükleyerek depolama alanını doldurması engellenir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.5", + "Ordinal": 5, + "Description": "Uygulamanın, içinde sembolik bağlantılar (symlink) bulunan sıkıştırılmış dosyaların yüklenmesine yalnızca bu durum özel olarak gerekli olduğunda izin verdiği doğrulanmalıdır. Bu durumda, sembolik bağlantı verilebilecek dosyaların bir izinli listesi uygulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.6", + "Ordinal": 6, + "Description": "Uygulamanın, piksel boyutu izin verilen maksimum değeri aşan görüntü dosyalarının yüklenmesini reddettiği doğrulanmalıdır. Bu, pixel flood saldırılarını önlemek için gereklidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V5.3", + "Ordinal": 3, + "Name": "Dosya Depolama", + "Items": [ + { + "Shortcode": "V5.3.1", + "Ordinal": 1, + "Description": "Güvenilmeyen girdilerle yüklenen veya oluşturulan ve herkese açık klasörlerde depolanan dosyaların, bir HTTP isteğiyle doğrudan erişildiğinde sunucu taraflı program kodu olarak çalıştırılmadığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.3.2", + "Ordinal": 2, + "Description": "Uygulamanın, dosya işlemleri için dosya yollarını oluştururken kullanıcı tarafından gönderilen dosya adlarını değil, dahili olarak oluşturulan veya güvenilir verileri kullandığı; eğer kullanıcı tarafından gönderilen dosya adları veya meta veriler kullanılacaksa, sıkı doğrulama ve temizleme işlemlerinin uygulandığı doğrulanmalıdır. Bu, yol geçişi (path traversal), yerel veya uzak dosya dahil etme (LFI, RFI) ve sunucu tarafı istek sahteciliği (SSRF) saldırılarına karşı koruma sağlar.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.3.3", + "Ordinal": 3, + "Description": "Sunucu tarafında gerçekleşen dosya işlemlerinin (örneğin dosya açma/decompress işlemi), kullanıcı tarafından sağlanan yol bilgilerini yok saydığı ve zip slip gibi güvenlik açıklarını önlediği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V5.4", + "Ordinal": 4, + "Name": "Dosya İndirme", + "Items": [ + { + "Shortcode": "V5.4.1", + "Ordinal": 1, + "Description": "Uygulamanın, kullanıcı tarafından gönderilen dosya adlarını (ör. JSON, JSONP veya URL parametresinde) doğruladığı veya göz ardı ettiği ve yanıtın Content-Disposition başlık alanında bir dosya adı belirttiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.4.2", + "Ordinal": 2, + "Description": "Sunulan dosya adlarının (örneğin HTTP yanıt header'larında veya e-posta eklerinde), belge yapısını korumak ve enjeksiyon saldırılarını önlemek için kodlandığı veya temizlendiği (ör. RFC 6266’ya uygun) doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.4.3", + "Ordinal": 3, + "Description": "Güvenilmeyen kaynaklardan elde edilen dosyaların, bilinen kötü amaçlı içeriklerin sunulmasını önlemek amacıyla antivirüs tarayıcılarıyla tarandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V6", + "Ordinal": 6, + "ShortName": "Authentication", + "Name": "Kimlik Doğrulama", + "Items": [ + { + "Shortcode": "V6.1", + "Ordinal": 1, + "Name": "Kimlik Doğrulama Dokümantasyonu", + "Items": [ + { + "Shortcode": "V6.1.1", + "Ordinal": 1, + "Description": "Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırılarına karşı oran sınırlama (rate limiting), otomasyon karşıtı önlemler ve uyarlanabilir yanıt gibi kontrollerin nasıl kullanıldığını açıklayan bir uygulama dokümantasyonu bulunduğu doğrulanmalıdır. Dokümantasyon, bu kontrollerin nasıl yapılandırıldığını ve kötü niyetli hesap kilitlemenin nasıl önlendiğini açıkça ortaya koymalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.1.2", + "Ordinal": 2, + "Description": "Parolalarda kullanılmasını önlemek amacıyla, bağlama özgü sözcüklerin (örneğin kurum adlarının permütasyonları, ürün adları, sistem tanımlayıcıları, proje kod adları, departman veya rol adları vb.) bulunduğu belgelenmiş bir liste mevcut olduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.1.3", + "Ordinal": 3, + "Description": "Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, bunların tümünün belgelenmiş olduğu ve her yol için tutarlı şekilde uygulanması gereken güvenlik kontrolleri ile kimlik doğrulama gücünün tanımlandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.2", + "Ordinal": 2, + "Name": "Parola Güvenliği", + "Items": [ + { + "Shortcode": "V6.2.1", + "Ordinal": 1, + "Description": "Kullanıcı tarafından belirlenen parolaların en az 8 karakter uzunluğunda olması sağlanmalı, ancak 15 karakter ve üzeri uzunlukta parolalar olmaları şiddetle tavsiye edilir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.2", + "Ordinal": 2, + "Description": "Kullanıcıların parolalarını değiştirebilmeleri sağlanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.3", + "Ordinal": 3, + "Description": "Parola değiştirme işlevinin hem mevcut hem de yeni parolayı gerektirdiği doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.4", + "Ordinal": 4, + "Description": "Kayıt veya parola değişimi sırasında girilen parolaların, uygulamanın parola politikasına (örneğin minimum uzunluk) uyan ilk 3000 yaygın parolaya karşı kontrol edildiği doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.5", + "Ordinal": 5, + "Description": "Her tür karakterin kullanılmasına izin verildiği ve büyük/küçük harf, sayı veya özel karakter şartlarının zorunlu tutulmadığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.6", + "Ordinal": 6, + "Description": "Parola giriş alanlarının, girdiyi maskelemek için \"type=password\" kullandığı doğrulanmalıdır. Uygulamalar, kullanıcının tüm maskelenmiş parolayı ya da son girilen karakteri geçici olarak görüntülemesine izin verebilir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.7", + "Ordinal": 7, + "Description": "\"Yapıştır\" özelliğinin, tarayıcı parola yardımcılarının ve harici parola yöneticilerinin kullanımına izin verildiği doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.8", + "Ordinal": 8, + "Description": "Uygulamanın, kullanıcıdan aldığı parolayı herhangi bir şekilde değiştirmeden, örneğin kesmeden veya harf büyüklüğünü değiştirmeden, tam olarak doğruladığı teyit edilmelidir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.9", + "Ordinal": 9, + "Description": "En az 64 karakter uzunluğundaki parolalara izin verildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.10", + "Ordinal": 10, + "Description": "Kullanıcının parolasının, yalnızca ele geçirildiği tespit edildiğinde veya kullanıcı tarafından yenilendiğinde geçerliliğini yitirdiği doğrulanmalıdır. Uygulama, belirli aralıklarla parola yenilenmesini zorunlu kılmamalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.11", + "Ordinal": 11, + "Description": "Tahmin edilmesi kolay parolaların oluşturulmasını önlemek amacıyla, bağlama özgü kelimelerin yer aldığı belgelenmiş listenin parola doğrulamada kullanıldığı teyit edilmelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.12", + "Ordinal": 12, + "Description": "Kayıt veya parola değişikliği sırasında girilen parolaların, ele geçirilmiş parolalar listesine karşı kontrol edildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.3", + "Ordinal": 3, + "Name": "Genel Kimlik Doğrulama Güvenliği", + "Items": [ + { + "Shortcode": "V6.3.1", + "Ordinal": 1, + "Description": "Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırıları gibi saldırıları önlemeye yönelik kontrollerin, uygulamanın güvenlik dokümantasyonuna göre uygulandığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.2", + "Ordinal": 2, + "Description": "\"root\", \"admin\" veya \"sa\" gibi varsayılan kullanıcı hesaplarının uygulamada yer almadığı veya devre dışı bırakıldığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.3", + "Ordinal": 3, + "Description": "Uygulamaya erişim için ya çok faktörlü bir kimlik doğrulama mekanizması ya da tek faktörlü mekanizmaların kombinasyonu kullanılmalıdır. Seviye 3 için, bu faktörlerden biri, oltalama saldırılarına karşı direnç sağlayan ve kimlik doğrulama niyetini bir kullanıcı etkileşimi (örneğin FIDO donanım anahtarında bir düğmeye basma veya mobil telefonda bir onay) gerektirerek doğrulayan donanım tabanlı bir kimlik doğrulayıcı olmalıdır. Bu gereksinimdeki herhangi bir esneklik için, gerekçesi belgelenmiş ve riskleri azaltıcı kapsamlı kontroller içeren bir plan gereklidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.4", + "Ordinal": 4, + "Description": "Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, belgelendirilmemiş bir yol bulunmadığı ve tüm yollar için güvenlik kontrolleri ile kimlik doğrulama gücünün tutarlı şekilde uygulandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.5", + "Ordinal": 5, + "Description": "Başarılı veya başarısız şüpheli kimlik doğrulama girişimlerinin kullanıcıya bildirildiği doğrulanmalıdır. Bu, olağandışı bir konum veya istemciden gelen girişimler, yalnızca bir faktörle yapılan kısmen başarılı doğrulamalar, uzun süreli inaktiflik sonrası yapılan girişimler veya birçok başarısız denemeden sonraki başarılı girişimler gibi durumları içerebilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.6", + "Ordinal": 6, + "Description": "E-postanın, tek faktörlü ya da çok faktörlü kimlik doğrulama mekanizması olarak kullanılmadığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.7", + "Ordinal": 7, + "Description": "Kimlik doğrulama detaylarında yapılan güncellemeler sonrasında (örneğin kimlik bilgisi sıfırlama, kullanıcı adı veya e-posta adresi değişiklikleri), kullanıcıların bilgilendirildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.8", + "Ordinal": 8, + "Description": "Başarısız kimlik doğrulama girişimlerinden, geçerli kullanıcıların hata mesajları, HTTP yanıt kodları veya farklı yanıt süreleri gibi sonuçlara dayanarak tespit edilemediği doğrulanmalıdır. Bu koruma, kayıt ve \"parolamı unuttum\" işlevselliğinde de geçerli olmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.4", + "Ordinal": 4, + "Name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", + "Items": [ + { + "Shortcode": "V6.4.1", + "Ordinal": 1, + "Description": "Sistem tarafından oluşturulan ilk parolaların veya etkinleştirme kodlarının güvenli bir şekilde rastgele üretildiği, mevcut parola politikasına uygun olduğu, kısa bir süre içinde veya ilk kullanım sonrasında geçerliliğini yitirdiği doğrulanmalıdır. Bu başlangıç sırları uzun vadeli parola olarak kullanılmasına izin verilmemelidir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.2", + "Ordinal": 2, + "Description": "Parola ipuçlarının veya \"gizli sorular\" olarak bilinen, bilgiye dayalı kimlik doğrulama mekanizmalarının mevcut olmadığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.3", + "Ordinal": 3, + "Description": "Unutulmuş parolanın sıfırlanması için, etkin olan çok faktörlü kimlik doğrulama mekanizmalarını atlamayan güvenli bir sürecin uygulandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.4", + "Ordinal": 4, + "Description": "Çok faktörlü kimlik doğrulama faktörlerinden biri kaybolursa, kayıt sırasında uygulanan kimlik kanıtlama seviyesiyle aynı seviyede kimlik doğrulama yapıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.5", + "Ordinal": 5, + "Description": "Süresi dolacak kimlik doğrulama mekanizmalarının yenilenmesine ilişkin talimatların, süresi dolmadan önce tamamlanacak şekilde yeterli sürede gönderildiği ve gerekiyorsa otomatik hatırlatıcıların yapılandırıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.6", + "Ordinal": 6, + "Description": "Yönetici yetkisi olan kullanıcıların, kullanıcının parola sıfırlama sürecini başlatabildiği ancak kullanıcının yeni parolasını belirleyemediği veya değiştiremediği doğrulanmalıdır. Bu, yönetici yetkisi olan kullanıcıların, kullanıcı parolasını bilmesini engeller.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.5", + "Ordinal": 5, + "Name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "Items": [ + { + "Shortcode": "V6.5.1", + "Ordinal": 1, + "Description": "Arama sırları, bant dışı kimlik doğrulama istekleri veya kodları ve zamana dayalı tek kullanımlık parolaların (TOTP) yalnızca bir kez kullanılabildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.2", + "Ordinal": 2, + "Description": "Uygulamanın backend tarafında saklanırken, 112 bitten az entropiye sahip (örneğin 19 rastgele harf-rakam karakteri veya 34 rastgele rakam) arama sırlarının, 32-bit rastgele bir salt içeren onaylı bir parola saklama algoritmasıyla hash’lendiği doğrulanmalıdır. Gizli bilginin entropisi 112 bit veya daha fazlaysa standart bir hash fonksiyonu kullanılabilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.3", + "Ordinal": 3, + "Description": "Arama sırları, bant dışı kimlik doğrulama kodları ve zamana dayalı tek kullanımlık parola seed'lerinin, öngörülebilir değerlerden kaçınmak için Kriptografik Olarak Güvenli Sözde Rastgele Sayı Üreteci (CSPRNG) ile oluşturulduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.4", + "Ordinal": 4, + "Description": "Arama sırlarının ve bant dışı kimlik doğrulama kodlarının en az 20 bit entropiye (genellikle 4 rastgele harf-rakam karakteri veya 6 rastgele rakam) sahip olduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.5", + "Ordinal": 5, + "Description": "Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının ve zamana dayalı tek kullanımlık parolaların (TOTP) belirli bir ömre sahip olduğu doğrulanmalıdır. Bant dışı istekler en fazla 10 dakika, TOTP’ler ise en fazla 30 saniye geçerli olmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.6", + "Ordinal": 6, + "Description": "Herhangi bir kimlik doğrulama faktörünün (fiziksel cihazlar dahil) çalınması veya kaybı durumunda iptal edilebildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.7", + "Ordinal": 7, + "Description": "Biyometrik kimlik doğrulama mekanizmalarının yalnızca ikincil faktör olarak, “sahip olduğunuz bir şey” veya “bildiğiniz bir şey” ile birlikte kullanıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.8", + "Ordinal": 8, + "Description": "Zamana dayalı tek kullanımlık parolaların (TOTP) doğrulamasının, güvenilir bir hizmetten alınan zaman kaynağına dayanarak yapıldığı ve güvenilir olmayan veya istemci tarafından sağlanan zaman kaynağına dayanmadığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.6", + "Ordinal": 6, + "Name": "Bant Dışı Kimlik Doğrulama Mekanizmaları", + "Items": [ + { + "Shortcode": "V6.6.1", + "Ordinal": 1, + "Description": "Tek kullanımlık parolaların (OTP) telefon veya SMS ile Public Switched Telephone Network (PSTN) üzerinden iletildiği kimlik doğrulama mekanizmalarının, yalnızca telefon numarası önceden doğrulanmışsa, alternatif daha güçlü yöntemler (örneğin TOTP) de sunuluyorsa ve kullanıcıya güvenlik riskleri hakkında bilgi veriliyorsa sunulduğu doğrulanmalıdır. Seviye 3 uygulamalar için telefon ve SMS seçenekleri sunulmamalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.6.2", + "Ordinal": 2, + "Description": "Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının, oluşturuldukları özgün kimlik doğrulama isteğiyle bağlantılı olduğu ve daha önceki ya da sonraki bir istek için kullanılamadığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.6.3", + "Ordinal": 3, + "Description": "Kod tabanlı bant dışı kimlik doğrulama mekanizmalarının, oran sınırlaması ile kaba kuvvet saldırılarına karşı korunduğu doğrulanmalıdır. En az 64 bit entropiye sahip kodlar kullanılması da değerlendirilmelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.6.4", + "Ordinal": 4, + "Description": "Çok faktörlü kimlik doğrulama için push bildirimleri kullanılıyorsa, push bombing saldırılarına karşı oran sınırlamasının kullanıldığı doğrulanmalıdır. “Numara eşleştirme” de bu riski azaltabilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.7", + "Ordinal": 7, + "Name": "Kriptografik Kimlik Doğrulama Mekanizması", + "Items": [ + { + "Shortcode": "V6.7.1", + "Ordinal": 1, + "Description": "Kriptografik kimlik doğrulama beyanlarını doğrulamak için kullanılan sertifikaların, değiştirilmeye karşı korumalı şekilde saklandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.7.2", + "Ordinal": 2, + "Description": "Challenge nonce değerinin en az 64 bit uzunluğunda olduğu ve istatistiksel olarak benzersiz ya da cihazın ömrü boyunca benzersiz olduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.8", + "Ordinal": 8, + "Name": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", + "Items": [ + { + "Shortcode": "V6.8.1", + "Ordinal": 1, + "Description": "Uygulama birden fazla kimlik sağlayıcıyı (IdP) destekliyorsa, başka bir desteklenen kimlik sağlayıcı aracılığıyla (örneğin aynı kullanıcı tanımlayıcısını kullanarak) kullanıcının kimliğinin taklit edilemediği doğrulanmalıdır. Standart önlem, uygulamanın kullanıcıyı IdP kimliği (bir ad alanı işlevi görür) ve IdP içindeki kullanıcı kimliğinin birleşimiyle kaydetmesi ve tanımlamasıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.8.2", + "Ordinal": 2, + "Description": "Kimlik doğrulama beyanları üzerindeki dijital imzaların (örneğin JWT veya SAML beyanları) varlığı ve bütünlüğünün her zaman doğrulandığı ve imzasız veya geçersiz imzalı beyanların reddedildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.8.3", + "Ordinal": 3, + "Description": "SAML beyanlarının benzersiz biçimde işlendiği ve yalnızca geçerlilik süresi içinde bir kez kullanıldığı, tekrar oynatma (replay) saldırılarını önlemek amacıyla doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.8.4", + "Ordinal": 4, + "Description": "Uygulama ayrı bir Kimlik Sağlayıcı (IdP) kullanıyorsa ve belirli işlemler için belirli kimlik doğrulama gücü, yöntemleri veya zaman bilgisi bekliyorsa, uygulamanın bu bilgileri IdP tarafından döndürülen veriler üzerinden doğruladığı teyit edilmelidir. Örneğin OIDC kullanılıyorsa, bu durum ID Token üzerindeki 'acr', 'amr' ve 'auth_time' gibi claim’lerin (varsa) doğrulanması ile sağlanabilir. Eğer IdP bu bilgileri sağlamıyorsa, uygulamanın asgari kimlik doğrulama gücünün kullanıldığını varsayan (örneğin yalnızca kullanıcı adı ve parola ile tek faktörlü doğrulama) belgelenmiş bir yedek yaklaşımı olmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V7", + "Ordinal": 7, + "ShortName": "Session", + "Name": "Oturum Yönetimi", + "Items": [ + { + "Shortcode": "V7.1", + "Ordinal": 1, + "Name": "Oturum Yönetim Dokümantasyonu", + "Items": [ + { + "Shortcode": "V7.1.1", + "Ordinal": 1, + "Description": "Kullanıcının oturum inaktivite zaman aşımı süresi ve mutlak maksimum oturum süresinin belgelendiği, diğer kontrollerle birlikte uygun olduğu ve NIST SP 800-63B yeniden kimlik doğrulama gereksinimlerinden herhangi bir sapma varsa gerekçesinin belgede yer aldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.1.2", + "Ordinal": 2, + "Description": "Belgede bir hesap için kaç adet eşzamanlı (paralel) oturuma izin verildiği ile birlikte, maksimum aktif oturum sayısına ulaşıldığında uygulanacak davranış ve işlemlerin tanımlandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.1.3", + "Ordinal": 3, + "Description": "Birleşik kimlik yönetim ekosisteminin bir parçası olarak kullanıcı oturumu oluşturan ve yöneten tüm sistemlerin, oturum ömrü, sonlandırma ve yeniden kimlik doğrulama gerektiren diğer koşulların nasıl koordine edildiğini açıklayan kontrollerle birlikte belgede yer aldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.2", + "Ordinal": 2, + "Name": "Temel Oturum Yönetimi Güvenliği", + "Items": [ + { + "Shortcode": "V7.2.1", + "Ordinal": 1, + "Description": "Uygulamanın tüm oturum token'ı doğrulama işlemlerini güvenilir bir backend servisi aracılığıyla gerçekleştirdiği doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.2.2", + "Ordinal": 2, + "Description": "Uygulamanın, statik API gizli anahtarları veya sabit değerler yerine, oturum yönetimi için dinamik olarak oluşturulan kendi kendine yeterli veya referans token'ları kullandığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.2.3", + "Ordinal": 3, + "Description": "Uygulama kullanıcı oturumlarını temsil etmek için referans token'ları kullanıyorsa, bu token'ların benzersiz olduğu, kriptografik olarak güvenli bir sözde rastgele sayı üreteci (CSPRNG) kullanılarak üretildiği ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.2.4", + "Ordinal": 4, + "Description": "Uygulamanın, kullanıcı kimlik doğrulaması (yeniden kimlik doğrulama dahil) sırasında yeni bir oturum token'ı oluşturduğu ve mevcut oturum token'ını sonlandırdığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.3", + "Ordinal": 3, + "Name": "Oturum Zaman Aşımı", + "Items": [ + { + "Shortcode": "V7.3.1", + "Ordinal": 1, + "Description": "Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde bir hareketsizlik zaman aşımı bulunduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.3.2", + "Ordinal": 2, + "Description": "Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde mutlak bir maksimum oturum süresi bulunduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.4", + "Ordinal": 4, + "Name": "Oturum Sonlandırma", + "Items": [ + { + "Shortcode": "V7.4.1", + "Ordinal": 1, + "Description": "Oturum sonlandırma tetiklendiğinde (örneğin, çıkış yapıldığında veya süre dolduğunda), uygulamanın oturumun daha fazla kullanılmasına izin vermediği doğrulanmalıdır. Referans token'lar veya durum bilgili oturumlar için bu, oturum verilerinin uygulama arka ucunda geçersiz kılınması anlamına gelir. Kapsamlı token kullanan uygulamaların; sonlandırılmış token listesi tutmak, kullanıcıya özel tarih ve saatten önce oluşturulan token'ları reddetmek veya kullanıcıya özel imzalama anahtarını yenilemek gibi bir çözüm uygulaması gerekir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.4.2", + "Ordinal": 2, + "Description": "Bir kullanıcı hesabı devre dışı bırakıldığında veya silindiğinde (örneğin bir çalışanın şirketten ayrılması), uygulamanın tüm aktif oturumları sonlandırdığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.4.3", + "Ordinal": 3, + "Description": "Herhangi bir kimlik doğrulama faktörünün başarılı bir şekilde değiştirilmesi veya kaldırılmasından (şifre sıfırlama veya kurtarma yoluyla yapılan değişiklikler dahil ve varsa MFA ayarları güncellemeleri dahil) sonra, uygulamanın diğer tüm aktif oturumları sonlandırma seçeneği sunduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.4.4", + "Ordinal": 4, + "Description": "Kimlik doğrulama gerektiren tüm sayfalarda kolay erişilebilir ve görünür bir çıkış yap (logout) işlevi bulunduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.4.5", + "Ordinal": 5, + "Description": "Uygulama yöneticilerinin, bireysel bir kullanıcının veya tüm kullanıcıların aktif oturumlarını sonlandırabilme yetkisine sahip olduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.5", + "Ordinal": 5, + "Name": "Oturum Kötüye Kullanımına Karşı Savunmalar", + "Items": [ + { + "Shortcode": "V7.5.1", + "Ordinal": 1, + "Description": "E-posta adresi, telefon numarası, MFA yapılandırması veya hesap kurtarmada kullanılan diğer bilgiler gibi kimlik doğrulamayı etkileyebilecek hassas hesap özniteliklerinde değişiklik yapılmadan önce uygulamanın tam yeniden kimlik doğrulama gerektirdiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.5.2", + "Ordinal": 2, + "Description": "Kullanıcıların, (en az bir faktörle yeniden kimlik doğrulama yaptıktan sonra) mevcut tüm aktif oturumları görüntüleyebilmesi ve sonlandırabilmesinin mümkün olduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.5.3", + "Ordinal": 3, + "Description": "Uygulamanın, son derece hassas işlemler veya operasyonlar gerçekleştirilmeden önce en az bir faktörle ek kimlik doğrulaması veya ikincil bir doğrulama gerektirdiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.6", + "Ordinal": 6, + "Name": "Birleşik Yeniden Kimlik Doğrulama", + "Items": [ + { + "Shortcode": "V7.6.1", + "Ordinal": 1, + "Description": "Güvenen Taraf (RP) ile Kimlik Sağlayıcı (IdP) arasındaki oturum süresi ve oturum sonlandırma davranışlarının belgelenmiş olduğu ve, örneğin IdP kimlik doğrulama olayları arasında maksimum süreye ulaşıldığında yeniden kimlik doğrulamanın gerekli kılındığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.6.2", + "Ordinal": 2, + "Description": "Yeni bir oturum oluşturulmasının, kullanıcı onayı veya açık bir eylem gerektirdiği; kullanıcı etkileşimi olmaksızın yeni uygulama oturumlarının oluşturulmasının önlendiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V8", + "Ordinal": 8, + "ShortName": "Authorization", + "Name": "Yetkilendirme", + "Items": [ + { + "Shortcode": "V8.1", + "Ordinal": 1, + "Name": "Yetkilendirme Dokümantasyonu", + "Items": [ + { + "Shortcode": "V8.1.1", + "Ordinal": 1, + "Description": "Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak işlev düzeyinde ve veriye özel erişim kısıtlamaları için kuralları tanımladığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.1.2", + "Ordinal": 2, + "Description": "Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak alan (field) düzeyinde erişim kısıtlamaları (hem okuma hem yazma) için kuralları tanımladığı doğrulanmalıdır. Bu kuralların, ilgili veri nesnesinin durum veya statü gibi diğer özniteliklerine bağlı olabileceği unutulmamalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.1.3", + "Ordinal": 3, + "Description": "Uygulamanın dokümantasyonunun, kimlik doğrulama ve yetkilendirme ile ilgili güvenlik kararlarının alınmasında kullanılan çevresel ve bağlamsal öznitelikleri (günün saati, kullanıcı konumu, IP adresi veya cihaz gibi) tanımladığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.1.4", + "Ordinal": 4, + "Description": "Kimlik doğrulama ve yetkilendirme dokümantasyonunun; işlev düzeyinde, veriye özel ve alan düzeyinde yetkilendirmenin yanı sıra çevresel ve bağlamsal faktörlerin karar almada nasıl kullanıldığını tanımladığı doğrulanmalıdır. Bu, değerlendirilen öznitelikleri, risk eşiklerini ve alınan aksiyonları (ör. izin ver, doğrulama iste, reddet, step-up kimlik doğrulama) içermelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V8.2", + "Ordinal": 2, + "Name": "Genel Yetkilendirme Tasarımı", + "Items": [ + { + "Shortcode": "V8.2.1", + "Ordinal": 1, + "Description": "Uygulamanın, işlev düzeyindeki erişimin yalnızca açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.2.2", + "Ordinal": 2, + "Description": "Uygulamanın, veriye özel erişimin yalnızca belirli veri öğelerine açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, doğrudan nesne referansı güvenlik açıkları (IDOR) ve bozuk nesne düzeyinde yetkilendirme (BOLA) risklerini azaltır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.2.3", + "Ordinal": 3, + "Description": "Uygulamanın, alan (field) düzeyindeki erişimin yalnızca belirli alanlara açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, bozuk nesne özelliği düzeyinde yetkilendirme (BOPLA) risklerini azaltır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.2.4", + "Ordinal": 4, + "Description": "Tüketicinin çevresel ve bağlamsal özniteliklerine (ör. günün saati, konum, IP adresi veya cihaz) dayalı uyarlanabilir güvenlik kontrollerinin, uygulama dokümantasyonunda tanımlandığı şekilde, kimlik doğrulama ve yetkilendirme kararları için uygulandığı doğrulanmalıdır. Bu kontroller, tüketici yeni bir oturum başlatmaya çalışırken ve mevcut bir oturum sırasında uygulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V8.3", + "Ordinal": 3, + "Name": "İşlem Düzeyinde Yetkilendirme", + "Items": [ + { + "Shortcode": "V8.3.1", + "Ordinal": 1, + "Description": "Uygulamanın yetkilendirme kurallarını güvenilir bir servis katmanında uyguladığı ve istemci taraflı JavaScript gibi güvenilmeyen tüketiciler tarafından değiştirilebilecek kontrollerle yetinmediği doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.3.2", + "Ordinal": 2, + "Description": "Yetkilendirme kararlarının temelini oluşturan değerlerdeki değişikliklerin hemen uygulandığı doğrulanmalıdır. Değişikliklerin anında uygulanamadığı durumlarda (örneğin self-contained token içindeki verilere güveniliyorsa), tüketici artık yetkili olmadığı hâlde bir işlem gerçekleştirdiğinde uyarı verecek ve değişikliği geri alacak önlemler uygulanmalıdır. Bu alternatifin bilgi sızıntısını önlemeyeceği unutulmamalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.3.3", + "Ordinal": 3, + "Description": "Bir nesneye erişimin, herhangi bir aracı veya onun adına hareket eden bir servis yerine yalnızca erişimi başlatan öznenin (ör. tüketici) izinlerine dayandığı doğrulanmalıdır. Örneğin, bir tüketici kimlik doğrulama için bir self-contained token kullanarak bir web servis çağırırsa ve bu servis başka bir servisten veri talep ederse, ikinci servis izin kararlarını verirken birinci servisin makine-makine token'ı yerine tüketicinin token'ını kullanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V8.4", + "Ordinal": 4, + "Name": "Diğer Yetkilendirme Hususları", + "Items": [ + { + "Shortcode": "V8.4.1", + "Ordinal": 1, + "Description": "Multi-tenant uygulamaların, tüketici işlemlerinin izinli olmadıkları tenant'lar üzerinde asla etkili olmamasını sağlamak için tenant'lar arası kontroller kullandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.4.2", + "Ordinal": 2, + "Description": "Yönetici arayüzlerine erişimin, sürekli tüketici kimlik doğrulaması, cihaz güvenlik durumu değerlendirmesi ve bağlamsal risk analizi dahil olmak üzere çok katmanlı güvenlik içerdiği doğrulanmalıdır. Yetkilendirme için yalnızca ağ konumu veya güvenilir uç noktalar yeterli olmamalıdır; ancak bu tür faktörler yetkisiz erişim olasılığını azaltabilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V9", + "Ordinal": 9, + "ShortName": "Self", + "Name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", + "Items": [ + { + "Shortcode": "V9.1", + "Ordinal": 1, + "Name": "Token Kaynağı ve Bütünlüğü", + "Items": [ + { + "Shortcode": "V9.1.1", + "Ordinal": 1, + "Description": "Self-contained token'ların içerikleri kabul edilmeden önce, oynama (tampering) saldırılarına karşı dijital imza veya MAC ile doğrulama yapıldığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.1.2", + "Ordinal": 2, + "Description": "Belirli bir bağlam için yalnızca bir allowlist üzerinde bulunan algoritmaların self-contained token oluşturmak ve doğrulamak için kullanılabildiği doğrulanmalıdır. Bu allowlist, yalnızca simetrik ya da yalnızca asimetrik algoritmaları içermeli ve kesinlikle 'None' algoritmasını içermemelidir. Hem simetrik hem de asimetrik algoritmalar desteklenmek zorundaysa, anahtar karışıklığını (key confusion) önlemek için ek kontroller uygulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.1.3", + "Ordinal": 3, + "Description": "Self-contained token'ları doğrulamak için kullanılan anahtar malzemesinin, token issuer için önceden yapılandırılmış güvenilir kaynaklardan alındığı doğrulanmalıdır. Bu, saldırganların güvenilmeyen kaynak ve anahtarları belirtmesini engeller. JWT ve diğer JWS yapılarında 'jku', 'x5u' ve 'jwk' gibi header'lar güvenilir kaynaklardan oluşan bir allowlist'e göre doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V9.2", + "Ordinal": 2, + "Name": "Token İçeriği", + "Items": [ + { + "Shortcode": "V9.2.1", + "Ordinal": 1, + "Description": "Token verisinde bir geçerlilik zaman aralığı (validity time span) varsa, yalnızca doğrulama zamanı bu zaman aralığı içerisindeyse token ve içeriği kabul edilmelidir. Örneğin, JWT'ler için 'nbf' ve 'exp' claim'leri doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.2.2", + "Ordinal": 2, + "Description": "Token'ı alan hizmetin, token içeriğini kabul etmeden önce bu token'ın doğru türde olduğunu ve sunulma amacına uygun olduğunu doğruladığı teyit edilmelidir. Örneğin, yalnızca erişim token'ları yetkilendirme kararları için, yalnızca ID Token'lar kullanıcı kimlik doğrulamasını kanıtlamak için kullanılabilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.2.3", + "Ordinal": 3, + "Description": "Hizmetin yalnızca kendisiyle kullanılması amaçlanan (audience) token'ları kabul ettiği doğrulanmalıdır. JWT'lerde bu, 'aud' claim'inin hizmet içinde tanımlı bir allowlist ile doğrulanması yoluyla sağlanabilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.2.4", + "Ordinal": 4, + "Description": "Eğer bir token issuer, farklı audience'lara token oluşturmak için aynı private key'i kullanıyorsa, oluşturulan token'ların hedef audience'ları benzersiz şekilde tanımlayan bir audience kısıtlaması içerdiği doğrulanmalıdır. Bu, bir token'ın farklı bir audience ile yeniden kullanılmasını önler. Audience tanımlayıcısı dinamik olarak sağlanıyorsa, token issuer bu audience'ları doğrulamalı ve audience taklitlerinin (impersonation) önüne geçmelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V10", + "Ordinal": 10, + "ShortName": "OAuth", + "Name": "OAuth ve OIDC", + "Items": [ + { + "Shortcode": "V10.1", + "Ordinal": 1, + "Name": "Genel OAuth ve OIDC Güvenliği", + "Items": [ + { + "Shortcode": "V10.1.1", + "Ordinal": 1, + "Description": "Token'ların yalnızca kesinlikle ihtiyaç duyan bileşenlere gönderildiği doğrulanmalıdır. Örneğin, tarayıcı tabanlı JavaScript uygulamaları için bir backend-for-frontend modeli kullanıldığında, access ve refresh token'lara yalnızca backend'in erişebilmesi gerekir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.1.2", + "Ordinal": 2, + "Description": "Authorization server'dan gelen değerler (örneğin authorization code veya ID Token gibi) yalnızca aynı user agent oturumu ve işlemi tarafından başlatılmış bir yetkilendirme akışının sonucuysa kabul edildiği doğrulanmalıdır. Bu, client tarafından oluşturulan secret’ların 'proof key for code exchange' (PKCE) ‘code_verifier’, ‘state’ veya OIDC ‘nonce’ gibi tahmin edilemez, işleme özgü ve hem client’a hem de işlem başlatılan user agent oturumuna güvenli bir şekilde bağlı olmasını gerektirir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.2", + "Ordinal": 2, + "Name": "OAuth İstemcisi", + "Items": [ + { + "Shortcode": "V10.2.1", + "Ordinal": 1, + "Description": "Code flow kullanılıyorsa, OAuth client’ın token taleplerini tetikleyen CSRF saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Bu genellikle PKCE kullanılarak veya authorization isteğinde gönderilen ‘state’ parametresinin kontrolü ile sağlanır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.2.2", + "Ordinal": 2, + "Description": "OAuth istemcisi birden fazla AS ile etkileşime girebiliyorsa, mix-up saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Örneğin, authorization server’ın 'iss' parametresini döndürmesi zorunlu kılınabilir ve bu parametrenin hem authorization yanıtında hem de token yanıtında doğrulanması gerekir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.2.3", + "Ordinal": 3, + "Description": "OAuth istemcisinin authorization server’a yaptığı taleplerde yalnızca gerekli scope’ları (veya diğer yetkilendirme parametrelerini) talep ettiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.3", + "Ordinal": 3, + "Name": "OAuth Kaynak Sunucusu (RS)", + "Items": [ + { + "Shortcode": "V10.3.1", + "Ordinal": 1, + "Description": "RS'nin yalnızca bu servisle kullanılmak üzere tasarlanmış access token’ları kabul ettiği doğrulanmalıdır (audience kontrolü). Audience bilgisi yapılandırılmış token’larda (örneğin JWT içindeki ‘aud’ claim’i) yer alabilir veya token introspection endpoint aracılığıyla kontrol edilebilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.3.2", + "Ordinal": 2, + "Description": "RS'nin, access token’dan gelen claim’lere dayanarak yetki devri tanımına uygun şekilde yetkilendirme kararları uyguladığı doğrulanmalıdır. ‘sub’, ‘scope’ ve ‘authorization_details’ gibi claim’ler varsa, bu kararın parçası olmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.3.3", + "Ordinal": 3, + "Description": "Erişim kontrolü kararında, access token’dan (JWT veya ilgili token introspection yanıtı) benzersiz bir kullanıcının tanımlanması gerekiyorsa, RS'nin başka kullanıcılara devredilemeyecek claim’ler ile kullanıcıyı tanımladığı doğrulanmalıdır. Genellikle bu, ‘iss’ ve ‘sub’ claim’lerinin birlikte kullanılması anlamına gelir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.3.4", + "Ordinal": 4, + "Description": "RS'nin belirli bir kimlik doğrulama gücü, yöntemi veya güncelliği (recentness) gerektirmesi durumunda, sunulan access token’ın bu kısıtlamaları karşıladığını doğruladığı, örneğin, OIDC ‘acr’, ‘amr’ ve ‘auth_time’ claim’leri kullanılarak doğrulanmalıdır. ", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.3.5", + "Ordinal": 5, + "Description": "RS'nin, (yetkisiz taraflarca) çalınmış veya tekrar edilen access token’ların kullanımını önlemek için sender-constrained access token’lar kullandığı doğrulanmalıdır. Bu, OAuth 2 için Mutual TLS veya OAuth 2 Demonstration of Proof of Possession (DPoP) ile sağlanabilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.4", + "Ordinal": 4, + "Name": "OAuth Yetkilendirme Sunucusu (AS)", + "Items": [ + { + "Shortcode": "V10.4.1", + "Ordinal": 1, + "Description": "AS'nin, istemciye özel önceden kaydedilmiş URI’lerden oluşan bir allowlist kullanarak redirect URI’leri tam dize karşılaştırması ile doğruladığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.2", + "Ordinal": 2, + "Description": "AS'nin, \"authorization response\" içinde \"authorization code\" döndürdüğü durumlarda, bu kodun yalnızca bir kez kullanılabildiği doğrulanmalıdır. Daha önce access token vermek için kullanılmış bir authorization code ile yapılan ikinci geçerli token isteği reddedilmeli ve ilgili tüm token’lar iptal edilmelidir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.3", + "Ordinal": 3, + "Description": "Authorization code’un kısa ömürlü olduğu doğrulanmalıdır. L1 ve L2 uygulamalar için maksimum yaşam süresi 10 dakika, L3 uygulamalar için 1 dakikadır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.4", + "Ordinal": 4, + "Description": "Belirli bir istemci için AS'nin yalnızca o istemcinin ihtiyaç duyduğu grant türlerine izin verdiği doğrulanmalıdır. \"Token\" (Implicit flow) ve \"password\" (Resource Owner Password Credentials flow) grant türlerinin artık kullanılmaması gerekir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.5", + "Ordinal": 5, + "Description": "AS'nin, açık istemciler için refresh token replay saldırılarını azalttığı doğrulanmalıdır. Tercihen sender-constrained refresh token’lar (DPoP veya mutual TLS ile certificate-bound access token’lar) kullanılmalıdır. L1 ve L2 uygulamalar için refresh token rotation kullanılabilir. Rotation kullanılıyorsa, AS refresh token’ı kullanım sonrası geçersiz kılmalı ve geçersiz bir refresh token sunulması durumunda o yetkilendirme ile ilişkili tüm refresh token’ları iptal etmelidir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.6", + "Ordinal": 6, + "Description": "Code grant kullanılıyorsa, AS'nin authorization code interception saldırılarına karşı koruma sağladığı doğrulanmalıdır. Yetkilendirme isteğinde geçerli bir \"code_challenge\" değeri zorunlu olmalı ve \"code_challenge_method\" olarak \"plain\" kabul edilmemelidir. Token isteğinde ise \"code_verifier\" parametresi doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.7", + "Ordinal": 7, + "Description": "AS'nin, kimlik doğrulaması yapılmamış dinamik istemci kaydını desteklemesi durumunda, kötü niyetli istemci uygulamalarına karşı riskleri azalttığı doğrulanmalıdır. Kayıtlı URI’ler gibi client metadata’sı doğrulanmalı, kullanıcı onayı alınmalı ve güvenilmeyen bir client uygulamasıyla yapılan yetkilendirme isteği işlenmeden önce kullanıcı uyarılmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.8", + "Ordinal": 8, + "Description": "Refresh token’ların, sliding expiration kullanılsa bile mutlak bir sona erme süresine sahip olduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.9", + "Ordinal": 9, + "Description": "Yetkili bir kullanıcı tarafından AS kullanıcı arayüzü üzerinden refresh token’ların ve reference access token’ların iptal edilebildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.10", + "Ordinal": 10, + "Description": "Gizli istemcilerin token istekleri, pushed authorization request (PAR) ve token iptal istekleri gibi server’a yapılan backchannel isteklerinde kimliğinin kontrol edildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.11", + "Ordinal": 11, + "Description": "AS yapılandırmasının, OAuth istemcisine yalnızca gerekli scope’ları atadığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.12", + "Ordinal": 12, + "Description": "Belirli bir client için, authorization server’ın yalnızca client’ın ihtiyaç duyduğu 'response_mode' değerine izin verdiği doğrulanmalıdır. Örneğin, bu değer ya beklenenlerle karşılaştırılarak doğrulanmalı ya da PAR veya JAR kullanılmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.13", + "Ordinal": 13, + "Description": "\"Code\" grant türünün daima pushed authorization request (PAR) ile birlikte kullanıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.14", + "Ordinal": 14, + "Description": "AS'nin yalnızca sender-constrained (Proof-of-Possession) access token’lar ürettiği doğrulanmalıdır. Bu, mutual TLS ile certificate-bound access token ya da DPoP ile DPoP-bound access token olabilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.15", + "Ordinal": 15, + "Description": "Sunucu taraflı istemciler için (kullanıcı cihazında çalışmayan), AS'nin \"authorization_details\" parametresinin istemci backend'i tarafından sağlandığını ve kullanıcı tarafından değiştirilmediğini doğruladığı, örneğin pushed authorization request (PAR) or JWT-secured Authorization Request (JAR) zorunlu kılınarak doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.16", + "Ordinal": 16, + "Description": "Bir istemci gizli ise, AS'nin güçlü istemci kimlik doğrulama yöntemlerini zorunlu kıldığı doğrulanmalıdır. Bu yöntemler, public-key cryptography’ye dayalı ve replay saldırılarına karşı dayanıklı olmalı, örneğin mutual TLS (\"tls_client_auth\", \"self_signed_tls_client_auth\") veya private key JWT (\"private_key_jwt\") gibi.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.5", + "Ordinal": 5, + "Name": "OIDC İstemcisi", + "Items": [ + { + "Shortcode": "V10.5.1", + "Ordinal": 1, + "Description": "İstemcinin (relying party olarak) ID Token replay saldırılarını azalttığı doğrulanmalıdır. Örneğin, ID Token’daki 'nonce' claim’inin, OpenID Provider’a gönderilen kimlik doğrulama isteğindeki 'nonce' değeriyle eşleştiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.5.2", + "Ordinal": 2, + "Description": "İstemcinin kullanıcıyı ID Token claim’lerinden (genellikle, başka kullanıcılarla yeniden atanamayan 'sub' claim’i) benzersiz şekilde tanımladığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.5.3", + "Ordinal": 3, + "Description": "İstemcinin, kötü niyetli bir AS'nin başka bir AS'yi taklit etmesini AS metadata’sı üzerinden reddettiği doğrulanmalıdır. AS metadata’sındaki issuer URL’si, istemci tarafından beklenen önceden yapılandırılmış issuer URL’siyle tam olarak eşleşmiyorsa, metadata reddedilmelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.5.4", + "Ordinal": 4, + "Description": "İstemcinin, ID Token’ın kendisi için (audience) kullanılması amaçlandığını doğruladığı doğrulanmalıdır. Bu, token’daki 'aud' claim’inin istemcinin 'client_id' değeriyle eşit olup olmadığının kontrol edilmesiyle yapılır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.5.5", + "Ordinal": 5, + "Description": "OIDC back-channel logout kullanıldığında, relying party’nin \"forced logout\" ve \"logout\" akışında \"cross-JWT confusion\" gibi saldırılara karşı koruma sağladığı doğrulanmalıdır. Client, logout token’ın 'logout+jwt' türünde olduğunu, 'event' claim’inin doğru üyeye sahip olduğunu ve 'nonce' claim’i içermediğini doğrulamalıdır. Ayrıca token için kısa bir sona erme süresi (örneğin 2 dakika) önerilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.6", + "Ordinal": 6, + "Name": "OpenID Provider", + "Items": [ + { + "Shortcode": "V10.6.1", + "Ordinal": 1, + "Description": "OpenID Provider’ın yalnızca 'code', 'ciba', 'id_token' veya 'id_token code' response mode değerlerine izin verdiği doğrulanmalıdır. 'code' değeri, 'id_token code' (OIDC Hybrid flow) yerine tercih edilmelidir. 'token' (Implicit flow) kullanılmamalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.6.2", + "Ordinal": 2, + "Description": "OpenID Provider’ın forced logout yoluyla yapılan hizmet reddi saldırılarını önlediği doğrulanmalıdır. Bu, son kullanıcıdan açık onay alınarak veya varsa logout isteğinde (relying party tarafından başlatılan) bulunan parametrelerin, örneğin 'id_token_hint', doğrulanmasıyla yapılabilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.7", + "Ordinal": 7, + "Name": "Onay (Consent) Yönetimi", + "Items": [ + { + "Shortcode": "V10.7.1", + "Ordinal": 1, + "Description": "AS'nin her yetkilendirme isteği için kullanıcının onayını aldığı doğrulanmalıdır. İstemcinin kimliği garanti altına alınamıyorsa, AS daima kullanıcıdan açıkça onay istemelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.7.2", + "Ordinal": 2, + "Description": "AS'nin kullanıcıdan onay istediğinde, neye onay verildiğini açık ve yeterli şekilde gösterdiği doğrulanmalıdır. Uygun olduğunda bu bilgiler, istenen yetkilendirmelerin doğasını (genellikle scope, resource server, RAR gibi detaylara dayalı), yetkilendirilmiş uygulamanın kimliğini ve bu yetkilendirmelerin süresini içermelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.7.3", + "Ordinal": 3, + "Description": "Kullanıcının, AS üzerinden verdiği onayları görüntüleyebildiği, değiştirebildiği ve iptal edebildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V11", + "Ordinal": 11, + "ShortName": "Cryptography", + "Name": "Kriptografi", + "Items": [ + { + "Shortcode": "V11.1", + "Ordinal": 1, + "Name": "Kriptografik Envanter ve Dokümantasyon", + "Items": [ + { + "Shortcode": "V11.1.1", + "Ordinal": 1, + "Description": "Kriptografik anahtarların yönetimi için belgelenmiş bir politika ve NIST SP 800-57 gibi bir anahtar yönetim standardını izleyen bir kriptografik anahtar yaşam döngüsü tanımlandığı doğrulanmalıdır. Bu, anahtarların aşırı miktarda paylaşılmadığını (örneğin, paylaşılan sırlar için ikiden fazla tarafla veya özel anahtarlar için birden fazla tarafla) garanti altına almalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.1.2", + "Ordinal": 2, + "Description": "Tüm kriptografik anahtarlar, algoritmalar ve uygulama tarafından kullanılan sertifikaları içeren bir kriptografik envanterin oluşturulduğu, sürdürüldüğü ve düzenli olarak güncellendiği doğrulanmalıdır. Bu envanter ayrıca, sistemde anahtarların nerede kullanılabileceğini ve kullanılamayacağını, ve hangi veri türlerinin bu anahtarlarla korunup korunamayacağını da belgelemelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.1.3", + "Ordinal": 3, + "Description": "Sistem içerisinde şifreleme, özetleme ve imzalama işlemleri dahil olmak üzere kriptografi kullanımının tüm örneklerini tespit etmek için kriptografik keşif mekanizmalarının kullanıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.1.4", + "Ordinal": 4, + "Description": "Kriptografik bir envanterin sürdürüldüğü doğrulanmalıdır. Bu envanter, gelecekteki tehditlere karşı tepki verebilmek amacıyla post-kuantum kriptografiye geçiş yolunu belirten belgelenmiş bir plan içermelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.2", + "Ordinal": 2, + "Name": "Güvenli Kriptografi Uygulaması", + "Items": [ + { + "Shortcode": "V11.2.1", + "Ordinal": 1, + "Description": "Kriptografik işlemler için sektör tarafından doğrulanmış uygulamaların (kütüphaneler ve donanım hızlandırmalı uygulamalar dahil) kullanıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.2.2", + "Ordinal": 2, + "Description": "Uygulamanın, rastgele sayı üreticileri, kimliği doğrulanmış şifreleme, MAC veya özetleme algoritmaları, anahtar uzunlukları, turlar, şifreler ve modların herhangi bir zamanda yeniden yapılandırılabilir, yükseltilebilir veya değiştirilebilir olacağı şekilde kripto çevikliği (crypto agility) ile tasarlandığı doğrulanmalıdır. Aynı şekilde, anahtarların ve parolaların değiştirilebilmesi ve verilerin yeniden şifrelenebilmesi mümkün olmalıdır. Bu, onaylanmış PQC şemalarının yüksek güvenlikli uygulamaları yaygın olarak kullanılabilir hale geldiğinde sorunsuz geçişe olanak tanır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.2.3", + "Ordinal": 3, + "Description": "Tüm kriptografik ilkeliklerin, algoritma, anahtar boyutu ve yapılandırmaya göre minimum 128 bit güvenlik sağladığı doğrulanmalıdır. Örneğin, 256-bit ECC anahtarı yaklaşık 128 bit güvenlik sağlarken, RSA için aynı güvenliği elde etmek 3072-bit anahtar gerektirir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.2.4", + "Ordinal": 4, + "Description": "Tüm kriptografik işlemlerin sabit süreli (constant-time) olduğu, karşılaştırmalarda, hesaplamalarda veya geri dönüşlerde kısa devre (short-circuit) işlemleri yapılmadığı doğrulanmalıdır; bu, bilgi sızıntısını önlemek için gereklidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.2.5", + "Ordinal": 5, + "Description": "Tüm kriptografik modüllerin güvenli şekilde hata verdiği ve hataların, padding oracle saldırıları gibi zafiyetleri mümkün kılmayacak şekilde ele alındığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.3", + "Ordinal": 3, + "Name": "Şifreleme Algoritmaları", + "Items": [ + { + "Shortcode": "V11.3.1", + "Ordinal": 1, + "Description": "Güvensiz blok modlarının (örneğin, ECB) ve zayıf doldurma (padding) şemalarının (örneğin, PKCS#1 v1.5) kullanılmadığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.3.2", + "Ordinal": 2, + "Description": "Yalnızca AES ile GCM gibi onaylı şifreleme algoritmalarının ve modlarının kullanıldığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.3.3", + "Ordinal": 3, + "Description": "Şifrelenmiş verilerin yetkisiz değişikliklere karşı korunduğu doğrulanmalıdır. Tercihen bu koruma, onaylı bir kimliği doğrulanmış şifreleme yöntemi kullanılarak ya da onaylı bir şifreleme yöntemi ile onaylı bir MAC algoritmasının kombinasyonu ile sağlanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.3.4", + "Ordinal": 4, + "Description": "Sayılar, başlatma vektörleri (IV) ve diğer tek kullanımlık değerlerin, aynı şifreleme anahtarı ve veri öğesi çifti için birden fazla kez kullanılmadığı doğrulanmalıdır. Oluşturma yöntemi kullanılan algoritmaya uygun olmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.3.5", + "Ordinal": 5, + "Description": "Şifreleme algoritması ve MAC algoritması kombinasyonlarının \"encrypt-then-MAC\" modunda çalıştığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.4", + "Ordinal": 4, + "Name": "Hashing ve Hash Tabanlı Fonksiyonlar", + "Items": [ + { + "Shortcode": "V11.4.1", + "Ordinal": 1, + "Description": "Dijital imzalar, HMAC, KDF ve rastgele bit üretimi gibi genel kriptografik kullanım senaryolarında yalnızca onaylı hash fonksiyonlarının kullanıldığı doğrulanmalıdır. MD5 gibi yasaklı hash fonksiyonları hiçbir kriptografik amaçla kullanılmamalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.4.2", + "Ordinal": 2, + "Description": "Parolaların, onaylı, hesaplama açısından yoğun ve mevcut rehberliğe göre yapılandırılmış bir anahtar türetme fonksiyonu (diğer adıyla parola hash'leme fonksiyonu) kullanılarak saklandığı doğrulanmalıdır. Ayarlar, güvenlik ve performans dengesini sağlayarak kaba kuvvet saldırılarını zorlaştırmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.4.3", + "Ordinal": 3, + "Description": "Dijital imzalarda kullanılan hash fonksiyonlarının, veri bütünlüğü ve kimlik doğrulama amacıyla kullanıldığında çakışmaya karşı dayanıklı ve yeterli bit uzunluğuna sahip olduğu doğrulanmalıdır. Çakışma dayanıklılığı gerekiyorsa çıktı uzunluğu en az 256 bit olmalıdır. Sadece ikinci ön-görüntü (2nd pre-iamge) saldırılarına karşı dayanıklılık gerekiyorsa çıktı uzunluğu en az 128 bit olmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.4.4", + "Ordinal": 4, + "Description": "Parolalardan gizli anahtarlar türetilirken, onaylı anahtar türetme fonksiyonlarının anahtar uzatma (key stretching) parametreleriyle birlikte kullanıldığı doğrulanmalıdır. Bu parametreler, kaba kuvvet saldırılarını önleyecek şekilde güvenlik ve performans dengesine sahip olmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.5", + "Ordinal": 5, + "Name": "Rastgele Değerler", + "Items": [ + { + "Shortcode": "V11.5.1", + "Ordinal": 1, + "Description": "Tahmin edilemez olması amaçlanan tüm rastgele sayıların ve dizelerin, CSPRNG ile oluşturulduğu ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. UUID'lerin bu koşulu dikkate almadığını unutmayın.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.5.2", + "Ordinal": 2, + "Description": "Kullanılan rastgele sayı üretim mekanizmasının, yoğun talep altında dahi güvenli çalışacak şekilde tasarlandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.6", + "Ordinal": 6, + "Name": "Açık Anahtar (Public Key) Kriptografisi", + "Items": [ + { + "Shortcode": "V11.6.1", + "Ordinal": 1, + "Description": "Anahtar üretimi, tohumlama (seeding) ve dijital imza üretimi ve doğrulama için yalnızca onaylı kriptografik algoritmalar ve çalışma modlarının kullanıldığı doğrulanmalıdır. Anahtar üretim algoritmaları, bilinen saldırılara karşı savunmasız anahtarlar üretmemelidir. Örneğin, Fermat çarpanlama yöntemine karşı savunmasız RSA anahtarları oluşturulmamalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.6.2", + "Ordinal": 2, + "Description": "Anahtar değişimi için yalnızca onaylı kriptografik algoritmaların kullanıldığı doğrulanmalıdır (örneğin Diffie-Hellman). Kullanılan parametrelerin güvenli olması gerektiğine dikkat edilmelidir. Bu, anahtar kurulum sürecine yönelik saldırıları önleyecek ve araya girme (adversary-in-the-middle) ya da kriptografik kırılmaları engelleyecektir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.7", + "Ordinal": 7, + "Name": "Kullanım Halindeki Verilerin Kriptografisi", + "Items": [ + { + "Shortcode": "V11.7.1", + "Ordinal": 1, + "Description": "Hassas verilerin kullanım sırasında korunmasını sağlamak amacıyla, yetkisiz kullanıcıların veya süreçlerin bu verilere erişmesini engelleyen tam bellek şifrelemesinin kullanıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.7.2", + "Ordinal": 2, + "Description": "Veri asgariyetinin sağlandığı, yani işleme sırasında mümkün olan en az miktarda verinin ortaya çıktığı ve verilerin kullanımdan hemen sonra veya mümkün olan en kısa sürede şifrelendiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V12", + "Ordinal": 12, + "ShortName": "Secure", + "Name": "Güvenli İletişim", + "Items": [ + { + "Shortcode": "V12.1", + "Ordinal": 1, + "Name": "Genel TLS Güvenlik Rehberi", + "Items": [ + { + "Shortcode": "V12.1.1", + "Ordinal": 1, + "Description": "Yalnızca TLS protokolünün en güncel ve önerilen sürümlerinin (örneğin TLS 1.2 ve TLS 1.3) etkinleştirildiği ve en son sürümün varsayılan olarak tercih edildiği doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.1.2", + "Ordinal": 2, + "Description": "Yalnızca önerilen şifre takımlarının (cipher suite) etkinleştirildiği ve en güçlü şifre takımlarının tercih edildiği doğrulanmalıdır. Seviye 3 (L3) uygulamalar yalnızca ileri gizlilik (forward secrecy) sağlayan şifre takımlarını desteklemelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.1.3", + "Ordinal": 3, + "Description": "Uygulamanın, mTLS istemci sertifikalarını kimlik doğrulama veya yetkilendirme amacıyla kullanmadan önce bu sertifikaların güvendiği sertifikalar arasında olduğunu doğruladığı kontrol edilmelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.1.4", + "Ordinal": 4, + "Description": "Online Certificate Status Protocol (OCSP) Stapling gibi geçerli bir sertifika iptal kontrolü yönteminin etkinleştirildiği ve yapılandırıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.1.5", + "Ordinal": 5, + "Description": "TLS el sıkışma (handshake) sürecinde Server Name Indication (SNI) gibi hassas meta verilerin ifşa edilmesini önlemek için, uygulamanın TLS yapılandırmasında Encrypted Client Hello (ECH) özelliğinin etkinleştirildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V12.2", + "Ordinal": 2, + "Name": "Dışa Açık Hizmetlerle HTTPS İletişimi", + "Items": [ + { + "Shortcode": "V12.2.1", + "Ordinal": 1, + "Description": "İstemci ile dışa açık, HTTP tabanlı hizmetler arasındaki tüm bağlantılarda TLS kullanıldığı ve bu bağlantıların güvensiz ya da şifrelenmemiş iletişime geri dönmediği doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.2.2", + "Ordinal": 2, + "Description": "Dışa açık hizmetlerin herkese açık olarak güvenilen TLS sertifikaları kullandığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V12.3", + "Ordinal": 3, + "Name": "Genel Servisler Arası İletişim Güvenliği", + "Items": [ + { + "Shortcode": "V12.3.1", + "Ordinal": 1, + "Description": "Uygulamaya gelen ve uygulamadan çıkan tüm bağlantılarda izleme sistemleri, yönetim araçları, uzaktan erişim ve SSH, ara yazılımlar, veritabanları, ana sistemler (mainframe), iş ortağı sistemleri ya da dış API'ler dahil olmak üzere TLS gibi şifreli bir protokolün kullanıldığı ve güvensiz ya da şifrelenmemiş protokollere geri dönülmediği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.3.2", + "Ordinal": 2, + "Description": "TLS istemcilerinin bir TLS sunucusu ile iletişime geçmeden önce alınan sertifikaları doğruladığı kontrol edilmelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.3.3", + "Ordinal": 3, + "Description": "Uygulama içindeki HTTP tabanlı iç hizmetler arasında gerçekleşen tüm bağlantılarda TLS ya da uygun başka bir aktarım şifreleme mekanizmasının kullanıldığı ve güvensiz ya da şifrelenmemiş iletişime geri dönülmediği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.3.4", + "Ordinal": 4, + "Description": "İç hizmetler arasındaki TLS bağlantılarında güvenilir sertifikaların kullanıldığı doğrulanmalıdır. İç sistemlerde oluşturulmuş ya da kendinden imzalı (self-signed) sertifikalar kullanılıyorsa, bu sertifikalara güvenen hizmetlerin yalnızca belirli dahili sertifika otoritelerine (CA) ve belirli kendinden imzalı sertifikalara güvenecek şekilde yapılandırıldıkları doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.3.5", + "Ordinal": 5, + "Description": "Sistem içindeki hizmetlerin birbiriyle iletişim kurarken her bir uç noktanın kimliğini doğrulamak için güçlü kimlik doğrulama yöntemlerinin kullanıldığı doğrulanmalıdır. Bu yöntemler arasında, açık anahtar altyapısı (public-key infrastructure) kullanan ve tekrar oynatma saldırılarına karşı dayanıklı olan TLS istemci kimlik doğrulaması gibi yöntemler yer almalıdır. Mikroservis mimarilerinde, sertifika yönetimini basitleştirmek ve güvenliği artırmak amacıyla bir servis ağı (service mesh) kullanılması değerlendirilmelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V13", + "Ordinal": 13, + "ShortName": "Configuration", + "Name": "Konfigürasyon", + "Items": [ + { + "Shortcode": "V13.1", + "Ordinal": 1, + "Name": "Konfigürasyon Dokümantasyonu", + "Items": [ + { + "Shortcode": "V13.1.1", + "Ordinal": 1, + "Description": "Uygulamanın tüm iletişim ihtiyaçlarının dokümante edildiği doğrulanmalıdır. Buna, uygulamanın bağımlı olduğu dış hizmetler ve son kullanıcının uygulamanın bağlantı kurmasını sağlayabileceği dış konumlar da dahil olmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.1.2", + "Ordinal": 2, + "Description": "Uygulamanın kullandığı her bir hizmet için, dokümantasyonda eşzamanlı bağlantı sayısı (örn. bağlantı havuzu limitleri) ve bu sınır aşıldığında uygulamanın davranışı, geri dönüş veya kurtarma mekanizmaları da dahil olmak üzere hizmet reddi koşullarını önlemek için tanımlandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.1.3", + "Ordinal": 3, + "Description": "Uygulamanın, kullandığı her bir dış sistem veya hizmet (örn. veritabanları, dosya tanıtıcıları, iş parçacıkları, HTTP bağlantıları) için kaynak yönetimi stratejilerini tanımladığı doğrulanmalıdır. Bu stratejiler, kaynak serbest bırakma prosedürlerini, zaman aşımı ayarlarını, hata durumlarını ve tekrar deneme mantığı uygulanmışsa sınırları, gecikmeleri ve geri çekilme (back-off) algoritmalarını içermelidir. Senkron HTTP istek–yanıt işlemleri için kısa zaman aşımı süreleri zorunlu tutulmalı ve tekrar eden denemeler devre dışı bırakılmalı ya da sıkı şekilde sınırlandırılmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.1.4", + "Ordinal": 4, + "Description": "Uygulamanın, güvenlik açısından kritik olan gizli verileri tanımladığı ve kuruluşun tehdit modeli ve iş ihtiyaçlarına göre bu verilerin döndürülme (rotation) zamanlamasının belgelendiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V13.2", + "Ordinal": 2, + "Name": "Backend İletişim Konfigürasyonu", + "Items": [ + { + "Shortcode": "V13.2.1", + "Ordinal": 1, + "Description": "Uygulamanın, standart kullanıcı oturum mekanizmasını desteklemeyen backend bileşenleri (örneğin API'ler, ara katmanlar, veri katmanları) arasında gerçekleşen iletişimlerin kimlik doğrulamasıyla korunduğu doğrulanmalıdır. Kimlik doğrulama; bireysel hizmet hesapları, kısa ömürlü token'lar ya da sertifika tabanlı kimlik doğrulama ile yapılmalıdır ve parola, API anahtarı ya da ayrıcalıklı erişime sahip paylaşımlı hesaplar gibi sabit kimlik bilgileri kullanılmamalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.2", + "Ordinal": 2, + "Description": "Uygulamanın backend bileşenleri arasında (yerel hizmetler, işletim sistemi hizmetleri, API'ler, ara katmanlar ve veri katmanları dahil) gerçekleştirilen iletişimlerin, yalnızca gerekli en az ayrıcalığa sahip hesaplarla yapıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.3", + "Ordinal": 3, + "Description": "Bir hizmet kimlik doğrulaması için bir kimlik bilgisi kullanılması gerekiyorsa, bu kimlik bilgisinin varsayılan bir değer (örneğin root/root veya admin/admin) olmadığının doğrulanması gereklidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.4", + "Ordinal": 4, + "Description": "Uygulamanın iletişim kurmasına izin verilen dış kaynaklar ya da sistemlerin, bir allowlist (izinli liste) ile tanımlandığı doğrulanmalıdır. Bu liste, uygulama katmanında, web sunucusunda, güvenlik duvarında veya farklı katmanların birleşiminde uygulanabilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.5", + "Ordinal": 5, + "Description": "Web veya uygulama sunucusunun, dış sistemlere veri veya dosya gönderimi veya yüklemesi yaparken sadece belirli kaynaklara izin verecek şekilde allowlist ile yapılandırıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.6", + "Ordinal": 6, + "Description": "Uygulamanın farklı hizmetlere bağlantı kurduğu durumlarda, bu bağlantılar için belgelenmiş yapılandırmaları (örn. maksimum eşzamanlı bağlantı, bağlantı limiti aşıldığında davranış, zaman aşımı, tekrar deneme stratejileri) takip ettiğinin doğrulanması gereklidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V13.3", + "Ordinal": 3, + "Name": "Gizli Bilgi Yönetimi", + "Items": [ + { + "Shortcode": "V13.3.1", + "Ordinal": 1, + "Description": "Parolalar, anahtar materyalleri, veritabanı ve üçüncü parti sistemlerle entegrasyon bilgileri, zaman tabanlı token'lar için tohum (seed) bilgileri, dahili gizli veriler ve API anahtarları gibi backend sırlarının güvenli bir şekilde oluşturulması, saklanması, erişim denetiminin sağlanması ve imha edilmesi için bir gizli bilgi yönetim çözümünün (örneğin key vault) kullanıldığı doğrulanmalıdır. Bu gizli bilgiler uygulama kaynak koduna dahil edilmemeli ve yapı çıktılarında yer almamalıdır. Seviye 3 uygulamalar için donanım destekli bir çözüm (örneğin HSM) gereklidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.3.2", + "Ordinal": 2, + "Description": "Gizli bilgilere erişimin en az ayrıcalık prensibine uygun şekilde yapılandırıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.3.3", + "Ordinal": 3, + "Description": "Tüm kriptografik işlemlerin, anahtar materyallerinin güvenli bir şekilde yönetilmesi ve dışarıya sızmasının engellenmesi amacıyla, izole edilmiş bir güvenlik modülü (örneğin vault ya da donanım güvenlik modülü) aracılığıyla gerçekleştirildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.3.4", + "Ordinal": 4, + "Description": "Uygulamanın belgelerinde belirtildiği şekilde gizli bilgilerin süresinin dolacak şekilde yapılandırıldığı ve düzenli olarak döndürüldüğü doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V13.4", + "Ordinal": 4, + "Name": "İstenmeyen Bilgi Sızıntısı", + "Items": [ + { + "Shortcode": "V13.4.1", + "Ordinal": 1, + "Description": "Uygulamanın .git veya .svn klasörleri gibi kaynak kontrolüyle ilgili metadata içermeyecek şekilde deploy edildiğini ya da bu klasörlerin hem dış erişime hem de uygulama erişimine kapalı olduğu doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.2", + "Ordinal": 2, + "Description": "Tüm bileşenler için üretim ortamlarında hata ayıklama (debug) modlarının devre dışı bırakıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.3", + "Ordinal": 3, + "Description": "Web sunucularının, açık şekilde istenmediği sürece dizin listelemesi (directory listing) özelliğini istemcilere sunmadığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.4", + "Ordinal": 4, + "Description": "HTTP TRACE metodunun üretim ortamlarında desteklenmediği, böylece potansiyel bilgi sızıntılarının önlendiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.5", + "Ordinal": 5, + "Description": "Belgeler (örneğin dahili API belgeleri) ve izleme uç noktalarının (monitoring endpoints) yalnızca açıkça belirtildiği durumlarda erişilebilir olduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.6", + "Ordinal": 6, + "Description": "Uygulamanın arka uç bileşenlerinin ayrıntılı sürüm bilgilerini ifşa etmediği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.7", + "Ordinal": 7, + "Description": "Web katmanının yalnızca belirli dosya uzantılarına sahip dosyaları sunacak şekilde yapılandırıldığı, bu sayede istem dışı bilgi, yapılandırma ya da kaynak kod sızıntılarının önlendiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V14", + "Ordinal": 14, + "ShortName": "Data", + "Name": "Veri Koruma", + "Items": [ + { + "Shortcode": "V14.1", + "Ordinal": 1, + "Name": "Veri Koruma Dokümantasyonu", + "Items": [ + { + "Shortcode": "V14.1.1", + "Ordinal": 1, + "Description": "Uygulama tarafından oluşturulan ve işlenen tüm hassas verilerin tanımlanıp, koruma seviyelerine göre sınıflandırıldığından emin olun. Bu, yalnızca kodlanmış (örneğin Base64 stringleri ya da JWT içindeki düz metin yükler gibi) ve bu nedenle kolayca çözülebilir verileri de içermelidir. Koruma seviyeleri, uygulamanın uymakla yükümlü olduğu veri koruma ve gizlilik düzenlemeleri ile standartlarını dikkate almalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.1.2", + "Ordinal": 2, + "Description": "Tüm hassas veri koruma seviyeleri için belgelenmiş bir koruma gereksinimleri seti tanımlandığından emin olun. Bu gereksinimler genel şifreleme, bütünlük doğrulama, saklama süresi, verinin nasıl günlüğe kaydedileceği, günlüklerdeki hassas verilere erişim kontrolleri, veritabanı düzeyinde şifreleme, gizlilik ve gizliliği artırıcı teknolojiler ile diğer gizlilik gereksinimlerini kapsamalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V14.2", + "Ordinal": 2, + "Name": "Genel Veri Koruması", + "Items": [ + { + "Shortcode": "V14.2.1", + "Ordinal": 1, + "Description": "Hassas verilerin yalnızca HTTP message body veya header alanlarında sunucuya gönderildiği ve URL ile sorgu parametrelerinin, API anahtarı veya session token’ı gibi hassas bilgiler içermediği doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.2", + "Ordinal": 2, + "Description": "Hassas verilerin, yük dengeleyiciler ve uygulama önbellekleri gibi sunucu bileşenlerinde önbelleğe alınmasının engellendiği veya kullanım sonrası bu verilerin güvenli biçimde temizlendiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.3", + "Ordinal": 3, + "Description": "Uygulama kontrolü dışında veri toplanmasını engellemek için, tanımlanmış hassas verilerin, kullanıcı izleyicileri gibi güvensiz taraflara gönderilmediği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.4", + "Ordinal": 4, + "Description": "Hassas verilere yönelik şifreleme, bütünlük doğrulama, veri saklama, loglama yöntemi, loglardaki erişim kontrolleri, gizlilik teknolojileri gibi kontrollerin, söz konusu verinin belgelenmiş koruma seviyesinde tanımlandığı şekilde uygulandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.5", + "Ordinal": 5, + "Description": "Önbellekleme mekanizmalarının yalnızca belirli içerik türüne sahip yanıtları önbelleğe alacak şekilde yapılandırıldığı ve hassas, dinamik içeriklerin önbelleğe alınmadığı doğrulanmalıdır. Web sunucusu, mevcut olmayan bir dosya talebinde geçerli ama farklı bir dosya döndürmek yerine 404 veya 302 cevabı vermelidir. Bu, Web Cache Deception saldırılarını önlemeye yardımcı olur.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.6", + "Ordinal": 6, + "Description": "Uygulamanın yalnızca işlevsellik için gerekli olan asgari hassas veriyi döndürdüğü doğrulanmalıdır. Örneğin, kredi kartı numarasının yalnızca bazı rakamlarının döndürülmesi; tam numaranın döndürülmesi gerekiyorsa, kullanıcı arayüzünde gizlenmiş (maskelenmiş) şekilde sunulması gerekir, aksi kullanıcı özel olarak görüntülemek istemedikçe gösterilmemelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.7", + "Ordinal": 7, + "Description": "Hassas bilgilerin, veri saklama sınıflandırmasına tabi tutulduğu, geçerliliğini yitirmiş veya artık gerekli olmayan verilerin belirlenmiş bir zaman çizelgesiyle ya da gerektiğinde otomatik olarak silindiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.8", + "Ordinal": 8, + "Description": "Kullanıcı tarafından yüklenen dosyaların meta verilerinden hassas bilgilerin çıkarıldığı veya bu bilgilerin yalnızca kullanıcıdan açık onay alındığında saklandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V14.3", + "Ordinal": 3, + "Name": "İstemci Tarafı Veri Koruması", + "Items": [ + { + "Shortcode": "V14.3.1", + "Ordinal": 1, + "Description": "Kimliği doğrulanmış verilerin, istemci veya oturum sonlandığında istemci depolamasından (örneğin tarayıcı DOM’undan) temizlendiği doğrulanmalıdır. 'Clear-Site-Data' HTTP response header bu konuda yardımcı olabilir ancak istemci tarafı, sunucu bağlantısı mevcut olmadığında da temizlik işlemini yapabiliyor olmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.3.2", + "Ordinal": 2, + "Description": "Uygulamanın, tarayıcılarda hassas verilerin önbelleğe alınmasını önlemek amacıyla yeterli anti-önbellekleme HTTP response header (örneğin Cache-Control: no-store) ayarladığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.3.3", + "Ordinal": 3, + "Description": "Tarayıcıda depolanan verilerin (örneğin localStorage, sessionStorage, IndexedDB veya çerezler) hassas veri içermediği, yalnızca session token’larının istisna olarak kabul edildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V15", + "Ordinal": 15, + "ShortName": "Secure", + "Name": "Güvenli Kodlama ve Mimari", + "Items": [ + { + "Shortcode": "V15.1", + "Ordinal": 1, + "Name": "Güvenli Kodlama ve Mimari Dokümantasyonu", + "Items": [ + { + "Shortcode": "V15.1.1", + "Ordinal": 1, + "Description": "Güvenlik açığı içeren üçüncü taraf bileşen sürümleri ve genel olarak kütüphane güncellemeleri için, uygulama dokümantasyonunda risk bazlı düzeltme zamanlarının tanımlandığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.1.2", + "Ordinal": 2, + "Description": "Yazılım bileşen listesi (Software Bill of Materials - SBOM) gibi bir envanterin tutulduğu, kullanılan tüm üçüncü taraf kütüphanelerin önceden tanımlanmış, güvenilir ve düzenli olarak güncellenen depolardan alındığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.1.3", + "Ordinal": 3, + "Description": "Uygulama dokümantasyonunda zaman veya kaynak açısından yoğun işlevlerin tanımlandığı, bu işlevlerin aşırı kullanımı durumunda kullanılabilirlik kaybının nasıl önleneceği ve yanıt oluşturma süresinin istemci zaman aşımını aşmaması için hangi önlemlerin alındığı belirtilmelidir. Örnek savunmalar kuyruklama, eşzamansız işleme, kullanıcı başına ve uygulama genelinde paralel işlem sınırlarını içerebilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.1.4", + "Ordinal": 4, + "Description": "Uygulama dokümantasyonunda \"riskli bileşenler\" olarak değerlendirilen üçüncü taraf kütüphanelerin vurgulandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.1.5", + "Ordinal": 5, + "Description": "Uygulama dokümantasyonunda \"tehlikeli işlevsellik\" içeren uygulama bölümlerinin açıkça belirtildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V15.2", + "Ordinal": 2, + "Name": "Güvenlik Mimarisi ve Bağımlılıklar", + "Items": [ + { + "Shortcode": "V15.2.1", + "Ordinal": 1, + "Description": "Uygulamanın yalnızca, belgelenmiş güncelleme ve düzeltme sürelerini aşmamış bileşenleri içerdiği doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.2.2", + "Ordinal": 2, + "Description": "Uygulamanın, belgelenmiş güvenlik kararları ve stratejilere dayanarak, zaman veya kaynak açısından yoğun işlevlerin neden olabileceği kullanılabilirlik kaybına karşı savunmalar uyguladığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.2.3", + "Ordinal": 3, + "Description": "Üretim ortamının yalnızca uygulamanın çalışması için gerekli işlevleri içerdiği ve test kodları, örnek kod parçaları veya geliştirme işlevleri gibi gereksiz işlevsellikleri açığa çıkarmadığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.2.4", + "Ordinal": 4, + "Description": "Üçüncü taraf bileşenlerin ve bunların tüm transitif bağımlılıklarının beklenen depolardan (iç kaynaklı ya da harici) alındığı ve bağımlılık karışıklığı (dependency confusion) saldırılarına açık olmadığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.2.5", + "Ordinal": 5, + "Description": "Uygulamanın, “tehlikeli işlevsellik” içeren veya “riskli bileşenler” kullanan bölümlerine ek korumalar uyguladığı doğrulanmalıdır. Bu korumalar sandbox, kapsülleme, konteynerleştirme veya ağ düzeyinde izolasyon gibi teknikler aracılığıyla, bir uygulama bölümünün ele geçirilmesi durumunda saldırganın diğer bölümlere sıçramasını geciktirmeyi veya engellemeyi amaçlamalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V15.3", + "Ordinal": 3, + "Name": "Savunmacı Kodlama", + "Items": [ + { + "Shortcode": "V15.3.1", + "Ordinal": 1, + "Description": "Uygulamanın yalnızca gerekli alanların bir alt kümesini veri nesnesinden döndürdüğü doğrulanmalıdır. Örneğin, bazı alanlara kullanıcıların erişmemesi gerektiğinden tüm veri nesnesi döndürülmemelidir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.2", + "Ordinal": 2, + "Description": "Uygulama backend'i harici URL’lere çağrı yaptığında, yalnızca amaçlanan işlevsellik söz konusuysa yönlendirmeleri takip edecek şekilde yapılandırıldığının doğrulanması gerekir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.3", + "Ordinal": 3, + "Description": "Uygulamanın, kitlesel atama saldırılarına karşı, her bir controller ve eylem için izin verilen alanları sınırlandırarak savunmalar sağladığı doğrulanmalıdır. Örneğin, bir alan değeri, bu işlemde değiştirilmesi amaçlanmadıysa eklenememeli veya güncellenememelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.4", + "Ordinal": 4, + "Description": "Tüm proxy ve ara katman bileşenlerinin kullanıcının orijinal IP adresini, uç kullanıcı tarafından değiştirilemeyecek güvenilir veri alanları kullanarak doğru şekilde ilettiği ve uygulamanın ve web sunucusunun bu doğru değeri, loglama ve hız sınırlama gibi güvenlik kararları için kullandığı doğrulanmalıdır. Ayrıca, orijinal IP adresinin bile dinamik IP'ler, VPN'ler veya kurumsal güvenlik duvarları nedeniyle güvenilir olmayabileceği dikkate alınmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.5", + "Ordinal": 5, + "Description": "Uygulamanın değişkenlerin doğru türde olduğunu açıkça doğruladığı ve sıkı eşitlik ve karşılaştırma işlemleri kullandığı doğrulanmalıdır. Bu, değişken türüyle ilgili varsayımlardan kaynaklanan tür oynama (type juggling) veya tür karışıklığı (type confusion) güvenlik açıklarını önlemek içindir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.6", + "Ordinal": 6, + "Description": "JavaScript kodunun prototip zehirleme (prototype pollution) saldırılarını önleyecek şekilde yazıldığı, örneğin, nesne literal’leri yerine Set() veya Map() gibi yapılar kullanıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.7", + "Ordinal": 7, + "Description": "Uygulamanın, özellikle framework'ün istek parametrelerinin kaynağı (sorgu dizgisi, gövde parametreleri, çerezler veya başlık alanları) arasında ayrım yapmadığı durumlarda, HTTP parametre kirliliği (HTTP parameter pollution) saldırılarına karşı savunmalar uyguladığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V15.4", + "Ordinal": 4, + "Name": "Güvenli Eş Zamanlılık (Concurrency)", + "Items": [ + { + "Shortcode": "V15.4.1", + "Ordinal": 1, + "Description": "Çok iş parçacıklı kodda (örneğin cache'ler, dosyalar veya birden fazla iş parçacığı tarafından erişilen bellek içi nesneler gibi) paylaşılan nesnelere yalnızca thread-safe (iş parçacığı güvenli) türler ve kilitleme (lock) veya semaphore gibi senkronizasyon mekanizmaları kullanılarak erişildiği doğrulanmalıdır. Bu, yarış durumlarını ve veri bozulmasını önlemeye yöneliktir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.4.2", + "Ordinal": 2, + "Description": "Bir kaynağın durumu üzerindeki kontroller (örneğin varlığı ya da izinleri gibi) ile bu kontrole bağlı eylemlerin tek bir atomik işlem olarak gerçekleştirildiği doğrulanmalıdır. Bu, TOCTOU (time-of-check to time-of-use) yarış durumlarını önlemeye yöneliktir. Bir dosyanın varlığının kontrol edilip ardından açılması veya bir kullanıcının erişiminin doğrulanıp ardından yetki verilmesi gibi işlemler buna örnektir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.4.3", + "Ordinal": 3, + "Description": "Kilitlerin (locks) tutarlı biçimde kullanıldığı, iş parçacıklarının birbirini beklemesi ya da sonsuz döngüye girmesi (deadlock veya livelock) gibi durumların önlendiği doğrulanmalıdır. Ayrıca, kilitleme mantığı, kaynağı yöneten kod içinde kalmalı ve dış sınıflar veya dış kodlar tarafından istemeden veya kötü niyetli şekilde değiştirilememelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.4.4", + "Ordinal": 4, + "Description": "Kaynak tahsis politikalarının, iş parçacığı açlığını önleyecek şekilde, kaynaklara adil erişimi sağladığı doğrulanmalıdır. Örneğin, thread pool (iş parçacığı havuzu) kullanımı, düşük öncelikli iş parçacıklarının da makul sürelerde çalışabilmesi için uygulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V16", + "Ordinal": 16, + "ShortName": "Security", + "Name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "Items": [ + { + "Shortcode": "V16.1", + "Ordinal": 1, + "Name": "Güvenlik Loglaması Dokümantasyonu", + "Items": [ + { + "Shortcode": "V16.1.1", + "Ordinal": 1, + "Description": "Uygulamanın teknoloji yığını boyunca her katmanda hangi olayların loglandığını, log formatlarını, logların nereye yazıldığını, nasıl kullanıldığını, erişimin nasıl kontrol edildiğini ve logların ne kadar süre saklandığını belgeleyen bir envanterin mevcut olduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V16.2", + "Ordinal": 2, + "Name": "Genel Loglama", + "Items": [ + { + "Shortcode": "V16.2.1", + "Ordinal": 1, + "Description": "Her bir log girdisinin, olayın ne zaman, nerede, kim tarafından ve ne olduğuna dair detaylı bir zaman çizelgesi oluşturulmasına olanak tanıyacak gerekli meta verileri içerdiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.2.2", + "Ordinal": 2, + "Description": "Tüm loglama bileşenlerinin zaman kaynaklarının senkronize olduğu ve güvenlik olayı meta verisindeki zaman damgalarının UTC kullanarak ya da açık zaman dilimi ofsetiyle belirtildiği doğrulanmalıdır. UTC kullanımı, özellikle yaz saati uygulamaları nedeniyle oluşabilecek karışıklıkları önlemek için tavsiye edilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.2.3", + "Ordinal": 3, + "Description": "Uygulamanın yalnızca log envanterinde belgelenmiş dosya ve hizmetlere log yazdığı ya da ilettiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.2.4", + "Ordinal": 4, + "Description": "Logların kullanılan log işleyici (log processor) tarafından okunabildiği ve ilişkilendirilebildiği doğrulanmalıdır. Tercihen yaygın bir log formatı kullanılmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.2.5", + "Ordinal": 5, + "Description": "Hassas veriler loglanırken, uygulamanın veri koruma seviyesine uygun olarak loglama yaptığı doğrulanmalıdır. Örneğin kimlik bilgileri veya ödeme detayları gibi bazı verilerin loglanmasına izin verilmemelidir. Session token’ları gibi veriler ise yalnızca tamamen ya da kısmen maskelenmiş ya da hash’lenmiş olarak loglanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V16.3", + "Ordinal": 3, + "Name": "Güvenlik Olayları", + "Items": [ + { + "Shortcode": "V16.3.1", + "Ordinal": 1, + "Description": "Tüm kimlik doğrulama işlemlerinin (başarılı ve başarısız girişimler dahil) loglandığı doğrulanmalıdır. Kullanılan kimlik doğrulama türü veya faktörleri gibi ek meta veriler de toplanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.3.2", + "Ordinal": 2, + "Description": "Başarısız yetkilendirme girişimlerinin loglandığı doğrulanmalıdır. Seviye 3 uygulamalar için, tüm yetkilendirme kararlarının ve hassas verilere erişim olaylarının (verinin kendisi olmadan) loglandığı da doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.3.3", + "Ordinal": 3, + "Description": "Uygulamanın, belgelenmiş güvenlik olaylarını ve güvenlik kontrollerini aşma girişimlerini (girdi doğrulama, iş mantığı, otomasyon karşıtı kontroller vb.) logladığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.3.4", + "Ordinal": 4, + "Description": "Beklenmeyen hatalar ve güvenlik kontrolü başarısızlıkları (örneğin backend TLS hataları gibi) loglandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V16.4", + "Ordinal": 4, + "Name": "Log Koruması", + "Items": [ + { + "Shortcode": "V16.4.1", + "Ordinal": 1, + "Description": "Tüm loglama bileşenlerinin, log enjeksiyonunu (log injection) önlemek amacıyla verileri uygun biçimde encode ettiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.4.2", + "Ordinal": 2, + "Description": "Logların yetkisiz erişime karşı korunduğu ve değiştirilemez olduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.4.3", + "Ordinal": 3, + "Description": "Logların analiz, tespit, uyarı ve yükseltme amacıyla mantıksal olarak ayrı bir sisteme güvenli biçimde iletildiği doğrulanmalıdır. Böylece uygulama ihlal edilse bile logların tehlikeye girmesi önlenmiş olur.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V16.5", + "Ordinal": 5, + "Name": "Hata Yönetimi", + "Items": [ + { + "Shortcode": "V16.5.1", + "Ordinal": 1, + "Description": "Beklenmedik ya da güvenlikle ilgili bir hata oluştuğunda, tüketiciye genel bir mesaj döndürüldüğü ve yığın izleri (stack trace), sorgular, gizli anahtarlar, token’lar gibi hassas sistem içi verilerin açıklanmadığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.5.2", + "Ordinal": 2, + "Description": "Uygulamanın, dış kaynaklara erişim başarısız olduğunda bile güvenli şekilde çalışmaya devam ettiği doğrulanmalıdır. Örneğin, circuit breaker ya da graceful degradation gibi desenler kullanılmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.5.3", + "Ordinal": 3, + "Description": "Uygulamanın hata durumlarında güvenli ve düzenli şekilde başarısız olduğu doğrulanmalıdır. Bu, örneğin doğrulama hatalarına rağmen işlemlerin işlenmesine yol açabilecek fail-open durumlarını önlemelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.5.4", + "Ordinal": 4, + "Description": "Ele alınmamış tüm istisnaları yakalayacak şekilde tanımlanmış bir “son çare hata yöneticisi” bulunduğu doğrulanmalıdır. Bu, hem loglara gitmesi gereken hata detaylarının kaybolmaması hem de tüm uygulama sürecinin çökerek hizmet dışı kalmasının önlenmesi açısından önemlidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V17", + "Ordinal": 17, + "ShortName": "WebRTC", + "Name": "WebRTC", + "Items": [ + { + "Shortcode": "V17.1", + "Ordinal": 1, + "Name": "TURN Sunucusu", + "Items": [ + { + "Shortcode": "V17.1.1", + "Ordinal": 1, + "Description": "TURN hizmetinin yalnızca özel amaçlar için ayrılmamış IP adreslerine (ör. iç ağlar, yayın adresleri, loopback) erişime izin verdiği doğrulanmalıdır. Bu gereksinim hem IPv4 hem de IPv6 adresleri için geçerlidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.1.2", + "Ordinal": 2, + "Description": "TURN hizmetinin, meşru kullanıcıların sunucuda çok sayıda bağlantı noktası açmaya çalışması durumunda kaynak tüketimi saldırılarına karşı dayanıklı olduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V17.2", + "Ordinal": 2, + "Name": "Medya", + "Items": [ + { + "Shortcode": "V17.2.1", + "Ordinal": 1, + "Description": "DTLS sertifikası anahtarının, belgelenmiş kriptografik anahtar yönetim politikasına uygun şekilde yönetildiği ve korunduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.2", + "Ordinal": 2, + "Description": "Medya sunucusunun onaylı DTLS şifre takımlarını (cipher suites) ve Güvenli Gerçek Zamanlı Aktarım Protokolü (Secure Real-time Transport Protocol - SRTP) için anahtarlar oluşturmaya yönelik DTLS Uzantısı için güvenli bir koruma profilini kullanacak ve destekleyecek şekilde yapılandırıldığı (DTLS-SRTP) doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.3", + "Ordinal": 3, + "Description": "Real-time Transport Protocol (RTP) injection saldırılarının bir hizmet reddi durumuna veya medya akışlarına ses veya video medyası eklenmesine yol açmasını önlemek için medya sunucusunda Güvenli SRTP kimlik doğrulamasının kontrol edildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.4", + "Ordinal": 4, + "Description": "Verify that the media server is able to continue processing incoming media traffic when encountering malformed Secure Real-time Transport Protocol (SRTP) packets.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.5", + "Ordinal": 5, + "Description": "Medya sunucusunun, meşru kullanıcılardan gelen SRTP flood'ı sırasında gelen medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.6", + "Ordinal": 6, + "Description": "Medya sunucusunun DTLS içinde yer alan \"ClientHello\" yarış durumu güvenlik açığına karşı savunmasız olmadığı, medya sunucusunun güvenlik açığına sahip olduğunun açıkça bilinip bilinmediği kontrol edilerek veya yarış koşulu testi gerçekleştirilerek doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.7", + "Ordinal": 7, + "Description": "Medya sunucusuna bağlı ses veya video kayıt mekanizmalarının, meşru kullanıcı kaynaklı SRTP flood'ı sırasında medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.8", + "Ordinal": 8, + "Description": "DTLS sertifikasının, SDP (Session Description Protocol) fingerprint özelliği ile karşılaştırıldığı ve doğrulama başarısız olursa medya akışının sonlandırıldığı, medya akışının özgünlüğünü sağlamak için doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V17.3", + "Ordinal": 3, + "Name": "Sinyalizasyon", + "Items": [ + { + "Shortcode": "V17.3.1", + "Ordinal": 1, + "Description": "Sinyalizasyon sunucusunun, flood saldırısı altında bile meşru sinyalizasyon mesajlarını işlemeye devam edebildiği doğrulanmalıdır. Bu, sinyalizasyon düzeyinde oran sınırlaması uygulanarak sağlanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.3.2", + "Ordinal": 2, + "Description": "Sinyalizasyon sunucusunun, hizmet reddine yol açabilecek şekilde yapılandırılmış bozuk sinyalizasyon mesajlarıyla karşılaştığında bile meşru mesajları işlemeye devam edebildiği doğrulanmalıdır. Bu, girdi doğrulaması, integer overflow ve buffer overflow'a karşı savunma ve sağlam hata işleme teknikleri ile sağlanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + } + ] +} diff --git a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.xml b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.xml new file mode 100644 index 0000000000..cfd57f8eca --- /dev/null +++ b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.xml @@ -0,0 +1 @@ +Application Security Verification Standard ProjectASVSThe OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.V11EncodingKodlama (Encoding) ve TemizlemeV1.11Kodlama ve Temizleme MimarisiV1.1.11Girdinin yalnızca bir kez kanonik forma (canonical form) çözümlendiği veya kaçış işlemlerinin kaldırıldığı, bu işlemin yalnızca verinin bu biçimde beklenmesi durumunda yapıldığı ve bu işlemin girdi doğrulama veya temizleme işlemlerinden sonra değil, önce gerçekleştiği doğrulanmalıdır.FalseTrue✓True✓V1.1.22Uygulamanın, çıktıyı kullanılması gereken yorumlayıcıya verilmeden hemen önce veya yorumlayıcının kendisi tarafından çıktı kodlaması ya da kaçış işlemi yaptığı doğrulanmalıdır.FalseTrue✓True✓V1.22Enjeksiyon ÖnlemeV1.2.11HTTP yanıtı, HTML veya XML belgesi için yapılan çıktı kodlamasının; HTML elemanları, HTML öznitelikleri, HTML yorumları, CSS ya da HTTP başlık alanları gibi bağlamlara uygun olduğu doğrulanmalıdır. Böylece mesaj veya belge yapısının bozulması önlenir.True✓True✓True✓V1.2.22Dinamik olarak URL oluşturulurken, güvenilmeyen verinin bağlamına göre (örneğin, sorgu veya yol parametreleri için URL kodlaması ya da base64url kodlaması) kodlandığı doğrulanmalıdır. Yalnızca güvenli URL protokollerine izin verilmelidir (örneğin, javascript: veya data: yasaklanmalıdır).True✓True✓True✓V1.2.33JavaScript içeriği (JSON dahil) dinamik olarak oluşturulurken çıktı kodlama/kaçış kullanıldığı doğrulanmalıdır. Böylece mesaj veya belge yapısı değiştirilmemiş olur (JavaScript ve JSON enjeksiyonlarının önüne geçilir).True✓True✓True✓V1.2.44Veri sorguları veya veritabanı sorguları (SQL, HQL, NoSQL, Cypher vb.) için parametreli sorgular, ORM’ler, entity framework’ler kullanıldığı ya da SQL enjeksiyonu ve diğer veritabanı enjeksiyon saldırılarına karşı koruma sağlandığı doğrulanmalıdır. Bu durum, saklı yordam (stored procedure) yazarken de geçerlidir.True✓True✓True✓V1.2.55Uygulamanın işletim sistemi komut enjeksiyonlarına karşı korunduğu ve işletim sistemi çağrılarında parametreli OS sorguları veya bağlama özgü komut satırı çıktı kodlamasının kullanıldığı doğrulanmalıdır.True✓True✓True✓V1.2.66Uygulamanın LDAP enjeksiyon zafiyetlerine karşı korunduğu ya da LDAP enjeksiyonlarını önlemek için özel güvenlik kontrollerinin uygulandığı doğrulanmalıdır.FalseTrue✓True✓V1.2.77XPath enjeksiyon saldırılarına karşı, sorgu parametrelemesi veya önceden derlenmiş sorgular kullanılarak koruma sağlandığı doğrulanmalıdır.FalseTrue✓True✓V1.2.88LaTeX işlemcilerinin güvenli şekilde yapılandırıldığı (örneğin, --shell-escape bayrağının kullanılmadığı) ve yalnızca izin verilen komutlardan oluşan bir listeyle çalıştırıldığı doğrulanmalıdır.FalseTrue✓True✓V1.2.99Düzenli ifadelerde (regex) özel karakterlerin (genellikle ters eğik çizgi \ ile) kaçırılarak meta karakter olarak yorumlanmalarının önlendiği doğrulanmalıdır.FalseTrue✓True✓V1.2.1010Uygulamanın CSV ve formül enjeksiyonlarına karşı korunduğu doğrulanmalıdır. Uygulama, CSV içeriği dışa aktarırken RFC 4180 Bölüm 2.6 ve 2.7'de tanımlanan kaçış kurallarına uymalıdır. Ayrıca, CSV veya diğer tablo formatlarına (XLS, XLSX, ODF gibi) aktarım yapılırken, alanın ilk karakteri olarak çıkan özel karakterler ('=', '+', '-', '@', '\t' (sekme), '\0' (null karakter)) tek tırnak (') ile kaçırılmalıdır.FalseFalseTrue✓V1.33Temizleme (Sanitization)V1.3.11WYSIWYG editörlerinden veya benzer kaynaklardan gelen tüm güvenilmeyen HTML girdilerinin, bilinen ve güvenli bir HTML temizleme kütüphanesi ya da çerçeve özelliği ile temizlendiği doğrulanmalıdır.True✓True✓True✓V1.3.22Uygulamanın eval() veya Spring Expression Language (SpEL) gibi dinamik kod çalıştırma özelliklerini kullanmaktan kaçındığı doğrulanmalıdır. Alternatif yoksa, kullanıcı girdisi çalıştırılmadan önce mutlaka temizlenmelidir.True✓True✓True✓V1.3.33Potansiyel olarak tehlikeli bir bağlamda kullanılacak verilerin, bu bağlama uygun karakterlere izin vermek ve çok uzun girdileri kısaltmak gibi güvenlik önlemleriyle önceden temizlendiği doğrulanmalıdır.FalseTrue✓True✓V1.3.44Kullanıcı tarafından sağlanan SVG içeriğinin, yalnızca güvenli etiket ve özellikler (örneğin grafik çizme ile ilgili) içerdiğinden emin olmak için onaylandığı veya temizlendiği doğrulanmalıdır (ör. script veya foreignObject içermemelidir).FalseTrue✓True✓V1.3.55Markdown, CSS, XSL stil sayfaları, BBCode veya benzeri ifade şablon dillerinde kullanıcı girdisinin temizlendiği veya bu tür özelliklerin devre dışı bırakıldığı doğrulanmalıdır.FalseTrue✓True✓V1.3.66Uygulamanın, güvenilmeyen verileri başka servislere iletmeden önce izinli protokol, alan adı, yol ve port listelerine göre doğruladığı ve tehlikeli karakterleri temizlediği doğrulanarak SSRF (Sunucu Taraflı İstek Sahteciliği) saldırılarına karşı korunduğu doğrulanmalıdır.FalseTrue✓True✓V1.3.77Uygulamanın şablon enjeksiyon saldırılarına karşı, güvenilmeyen girdilere dayalı şablon oluşturmayı engellediği; eğer bu kaçınılmazsa, bu girdilerin mutlaka temizlendiği veya sıkı şekilde onaylandığı doğrulanmalıdır.FalseTrue✓True✓V1.3.88JNDI sorgularında kullanılmadan önce güvenilmeyen girdilerin temizlendiği ve JNDI'nin enjeksiyonlara karşı güvenli şekilde yapılandırıldığı doğrulanmalıdır.FalseTrue✓True✓V1.3.99Memcache’e gönderilmeden önce içeriğin temizlenerek enjeksiyon saldırılarına karşı korunduğu doğrulanmalıdır.FalseTrue✓True✓V1.3.1010Format dizgilerinin (format strings) beklenmeyen veya zararlı şekilde çözümlenmesini önlemek için işlenmeden önce temizlendiği doğrulanmalıdır.FalseTrue✓True✓V1.3.1111SMTP veya IMAP enjeksiyonlarını önlemek için, kullanıcı girdisinin posta sistemlerine iletilmeden önce temizlendiği doğrulanmalıdır.FalseTrue✓True✓V1.3.1212Regex girdilerinin üstel geri izlemeye (exponential backtracking) neden olan öğeler içermediği ve güvenilmeyen girdilerin ReDoS (Regex Denial of Service) gibi saldırılara karşı temizlendiği doğrulanmalıdır.FalseFalseTrue✓V1.44Bellek, Dizgi ve Yönetilmeyen KodV1.4.11Yığın, arabellek (buffer) veya yığın belleği taşmalarını önlemek ya da tespit etmek amacıyla, bellek güvenli dizgi işlemlerinin, daha güvenli bellek kopyalama ve işaretçi aritmetiğinin kullanıldığı doğrulanmalıdır.FalseTrue✓True✓V1.4.22Tamsayı taşmalarını önlemek için işaret (sign), aralık (range) ve giriş doğrulama tekniklerinin kullanıldığı doğrulanmalıdır.FalseTrue✓True✓V1.4.33Dinamik olarak ayrılan belleğin ve kaynakların serbest bırakıldığı ve boşaltılan belleklere ait referansların veya işaretçilerin kaldırıldığı veya null yapıldığı doğrulanmalıdır (dangling pointer ve use-after-free zafiyetlerine karşı).FalseTrue✓True✓V1.55Güvenli Ters Serileştirme (Safe Deserialization)V1.5.11XML ayrıştırıcılarının (parser) kısıtlayıcı şekilde yapılandırıldığı ve dış varlık çözümleme (external entity resolution) gibi güvensiz özelliklerin XXE (XML eXternal Entity) saldırılarına karşı devre dışı bırakıldığı doğrulanmalıdır .True✓True✓True✓V1.5.22Güvenilmeyen verilerin ters serileştirilmesinde, nesne türleri için izinli liste kullanımı veya istemci tanımlı nesne türlerinin kısıtlanması gibi güvenli giriş işleme önlemlerinin uygulandığı doğrulanmalıdır. Güvensiz olarak tanımlanmış ters serileştirme mekanizmaları, güvenilmeyen girdilerle kullanılmamalıdır.FalseTrue✓True✓V1.5.33Aynı veri türü için uygulamada kullanılan farklı parser'ların (ör. JSON, XML, URL parser'ları), veriyi tutarlı şekilde ayrıştırdığı ve aynı karakter kodlamasını kullandığı doğrulanmalıdır. Böylece JSON birlikte çalışabilirlik açıkları, URI veya dosya ayrıştırma farkları gibi sorunlar nedeniyle RFI veya SSRF saldırılarının istismar edilmesi önlenir.FalseFalseTrue✓V22ValidationDoğrulama ve İş MantığıV2.11Doğrulama ve İş Mantığı DokümantasyonuV2.1.11Uygulama dokümantasyonunda, veri öğelerinin beklenen yapıya göre nasıl doğrulanacağına ilişkin giriş doğrulama kurallarının tanımlandığı doğrulanmalıdır. Bu; kredi kartı numaraları, e-posta adresleri, telefon numaraları gibi yaygın veri biçimleri olabileceği gibi iç sistemlere özel biçimler de olabilir.True✓True✓True✓V2.1.22Uygulama dokümantasyonunda, birleştirilmiş veri öğelerinin mantıksal ve bağlamsal tutarlılığının nasıl doğrulanacağı tanımlanmalıdır (örneğin, mahalle ve posta kodunun eşleşip eşleşmediğinin kontrolü).FalseTrue✓True✓V2.1.33Hem kullanıcı bazında hem de uygulama genelinde geçerli olacak şekilde, iş mantığı sınırları ve doğrulama beklentilerinin belgelendiği doğrulanmalıdır.FalseTrue✓True✓V2.22Girdi DoğrulamaV2.2.11Girdilerin, işlevsel ya da iş gereksinimlerine uygunluğunun doğrulandığı teyit edilmelidir. Bu işlem; izinli değerler, desenler ve aralıklar listesine karşı pozitif doğrulama ile ya da girdinin beklenen yapıya ve mantıksal sınırlara uygunluğunun önceden tanımlanmış kurallara göre karşılaştırılması ile yapılmalıdır. Seviye 1 için bu, güvenlik veya iş kararlarında kullanılan girdilere odaklanabilir. Seviye 2 ve üstü için tüm girdilere uygulanmalıdır.True✓True✓True✓V2.2.22Uygulamanın, güvenilir bir servis katmanında girdi doğrulama zorunluluğu uygulayacak şekilde tasarlandığı doğrulanmalıdır. İstemci tarafında gerçekleştirilen doğrulama, kullanılabilirliği artırabilir ve teşvik edilmelidir. Ancak bu doğrulama,güvenlik kontrolü olarak kabul edilmemelidir.True✓True✓True✓V2.2.33Uygulamanın, ilişkili veri öğelerinin önceden tanımlanmış kurallara göre makul olup olmadığını kontrol ettiği doğrulanmalıdır.FalseTrue✓True✓V2.33İş Mantığı GüvenliğiV2.3.11Uygulamanın, aynı kullanıcı için iş mantığı akışlarını yalnızca beklenen adım sırasına göre ve adım atlamadan işlediği doğrulanmalıdır.True✓True✓True✓V2.3.22İş mantığı sınırlarının, uygulama dokümantasyonuna uygun şekilde uygulandığı doğrulanmalıdır.FalseTrue✓True✓V2.3.33İş mantığı seviyesinde işlemlerin (transaction) kullanıldığı ve bir iş mantığı işleminin ya bütünüyle başarıyla tamamlandığı ya da önceki geçerli duruma geri döndürüldüğü (rollback) doğrulanmalıdır.FalseTrue✓True✓V2.3.44İş mantığı düzeyinde kilitleme mekanizmalarının, sınırlı kaynakların (ör. sinema koltukları, teslimat zamanları) uygulamanın mantığı manipüle edilerek çift rezervasyona neden olmamasını sağladığı doğrulanmalıdır.FalseTrue✓True✓V2.3.55Yüksek değerli iş mantığı akışlarının, yetkisiz veya kazara gerçekleşebilecek işlemleri önlemek için çoklu kullanıcı onayı gerektirdiği doğrulanmalıdır. Bu işlemler büyük para transferleri, sözleşme onayları, gizli bilgilere erişim veya üretimde güvenlik kurallarının geçersiz kılınmaları gibi durumları içerebilir.FalseFalseTrue✓V2.44Otomasyon Karşıtı ÖnlemlerV2.4.11Uygulama işlevlerine yönelik aşırı miktardaki çağrılara karşı; veri sızdırma, anlamsız veri üretme, kota tüketme, hız sınırının aşılması, hizmet reddi (DoS) ya da maliyetli kaynakların aşırı kullanımı gibi risklere karşı otomasyon karşıtı kontrollerin bulunduğu doğrulanmalıdır.FalseTrue✓True✓V2.4.22İş mantığı akışlarının, aşırı hızlı işlem gönderimlerini önleyecek şekilde gerçekçi insan zamanlaması gerektirdiği doğrulanmalıdır.FalseFalseTrue✓V33WebWeb Ön Uç (Frontend) GüvenliğiV3.11Web Frontend Güvenlik DokümantasyonuV3.1.11Uygulama dokümantasyonunda, uygulamayı kullanan tarayıcıların desteklemesi gereken güvenlik özelliklerinin (ör. HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) ve diğer ilgili HTTP güvenlik mekanizmaları) tanımlandığı doğrulanmalıdır. Ayrıca bu özelliklerin mevcut olmadığı durumlarda uygulamanın nasıl davranması gerektiği (ör. kullanıcıyı uyarmak veya erişimi engellemek) de tanımlanmalıdır.FalseFalseTrue✓V3.22İçeriğin Yanlış YorumlanmasıV3.2.11Tarayıcıların HTTP yanıtlarında içerik veya işlevi yanlış bir bağlamda sunmalarını önlemek amacıyla güvenlik kontrollerinin uygulandığı doğrulanmalıdır (ör. API, kullanıcı tarafından yüklenen dosya veya başka bir kaynağın doğrudan çağrılması durumunda). Olası kontroller arasında; yalnızca HTTP istek başlıklarının (ör. Sec-Fetch-\*) doğru bağlamı gösterdiği durumlarda içeriğin sunulması, Content-Security-Policy başlığında "sandbox" yönergesinin kullanılması veya Content-Disposition başlığında "attachment" biçiminin kullanılması yer alabilir.True✓True✓True✓V3.2.22HTML yerine metin olarak görüntülenmesi amaçlanan içeriğin, HTML veya JavaScript gibi içeriklerin istenmeden çalıştırılmasını önleyecek şekilde "createTextNode" veya "textContent" gibi güvenli işleme fonksiyonlarıyla işlendiği doğrulanmalıdır.True✓True✓True✓V3.2.33Uygulamanın istemci tarafı JavaScript kullanırken açık değişken tanımlamaları yaparak, sıkı tür kontrolü uygulayarak, global değişkenleri document nesnesine kaydetmekten kaçınarak ve ad alanı izolasyonu sağlayarak DOM clobbering’den kaçındığı doğrulanmalıdır.FalseFalseTrue✓V3.33Çerez YapılandırmasıV3.3.11Çerezlerin 'Secure' niteliğine sahip olduğu ve eğer çerez adı '\__Host-' ön eki ile başlamıyorsa, '__Secure-' ön ekinin kullanıldığı doğrulanmalıdır.True✓True✓True✓V3.3.22Kullanıcı arayüzü kandırma saldırılarına ve tarayıcı tabanlı istek sahteciliği saldırılarına (CSRF) karşı koruma sağlamak amacıyla, her çerezin 'SameSite' niteliğinin kullanım amacına uygun şekilde ayarlandığı doğrulanmalıdır.FalseTrue✓True✓V3.3.33Çerez adı, diğer sunucularla paylaşılmak üzere açıkça tasarlanmadığı sürece '__Host-' ön eki ile tanımlanmalıdır.FalseTrue✓True✓V3.3.44Bir çerez değeri istemci tarafı betikleri tarafından erişilememesi gereken bir veri içeriyorsa (ör. oturum token'ı), çerezin 'HttpOnly' niteliğine sahip olduğu ve aynı değerin (ör. oturum token'ı) yalnızca 'Set-Cookie' başlığı ile istemciye iletildiği doğrulanmalıdır.FalseTrue✓True✓V3.3.55Uygulama bir çerez oluştururken, çerez adı ve değerinin toplam uzunluğunun 4096 baytı aşmadığı doğrulanmalıdır. Çok büyük çerezler tarayıcı tarafından saklanmaz ve isteklerle gönderilmez; bu da çereze bağlı çalışan uygulama işlevlerinin bozulmasına yol açabilir.FalseFalseTrue✓V3.44Tarayıcı Güvenlik Mekanizması Başlıkları (Header)V3.4.22Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header'ı, uygulama tarafından sabit bir değer olarak tanımlanmalı veya gelen Origin header değeri güvenilir origin’lerden oluşan bir izinli listeye karşı doğrulanmalıdır. ‘Access-Control-Allow-Origin: *’ kullanılması gerekiyorsa, yanıtın hassas bilgi içermediği doğrulanmalıdır.True✓True✓True✓V3.4.33HTTP yanıtlarında Content-Security-Policy header'ı bulunduğu ve bu header'ın yalnızca güvenilen içeriklerin veya kaynakların yüklenmesini ve çalıştırılmasını sağlayan yönergeler içerdiği doğrulanmalıdır. Minimum olarak "global policy", object-src 'none', base-uri 'none' yönergelerini içermeli ve izinli liste, nonce veya hash temelli bir yapı içermelidir. Seviye 3 uygulamalarında her yanıt için nonce veya hash içeren özel bir politika tanımlanmalıdır.FalseTrue✓True✓V3.4.44Tüm HTTP yanıtlarının 'X-Content-Type-Options: nosniff' header'ını içerdiği doğrulanmalıdır. Bu, tarayıcıya içerik türünü tahmin etmeyi bırakmasını ve yanıtın Content-Type header'ında belirtilen MIME türünün, beklenen kaynak türüyle eşleşmesini zorunlu kılar. Ayrıca bu, tarayıcıda CORB (Cross-Origin Read Blocking) özelliğini etkinleştirir.FalseTrue✓True✓V3.4.55Uygulamanın, 'Referer' başlığı yoluyla üçüncü taraflara teknik olarak hassas verilerin sızmasını önlemek için bir 'referrer policy' belirlediği doğrulanmalıdır. Bu, Referrer-Policy HTTP header'ıyla veya HTML öğe nitelikleriyle (element attributes) sağlanabilir. Sızabilecek hassas bilgiler, URL’deki yol ve sorgu parametreleri ile sınırlı uygulamalarda hostname bilgisini içerebilir.FalseTrue✓True✓V3.4.66Uygulamanın, Content-Security-Policy header'ı altında 'frame-ancestors' yönergesini her HTTP yanıtında tanımladığı ve bu sayede içeriklerin varsayılan olarak başka sayfalara gömülmesini engellediği doğrulanmalıdır. Gerekli durumlarda özel olarak izin verildiğinden emin olunmalıdır. 'X-Frame-Options' header'ı, tarayıcılar tarafından desteklenmesine rağmen, artık güncel değildir ve güvenlik amacıyla kullanılmamalıdır.FalseTrue✓True✓V3.4.88Bir belgenin işlenmesini ve sunulmasını başlatan tüm HTTP yanıtlarında (örneğin 'text/html' tipi yanıtlar), 'Cross-Origin-Opener-Policy' header'ı 'same-origin' veya 'same-origin-allow-popups' yönergeleriyle birlikte yer almalıdır. Bu, tabnabbing ve frame counting gibi, pencere nesnelerine paylaşımlı erişimi sömüren saldırılara karşı koruma sağlar.FalseFalseTrue✓V3.55Tarayıcı Menşei AyırımıV3.5.11Uygulama, hassas işlevselliğe yönelik izinsiz cross-origin istekleri önlemek için CORS preflight mekanizmasına güvenmiyorsa, bu tür isteklerin gerçekten uygulamadan geldiği doğrulanmalıdır. Bu, anti-forgery token kullanımı veya CORS tarafından güvenli kabul edilmeyen özel HTTP header'larının zorunlu kılınmasıyla yapılabilir. Bu, tarayıcı tabanlı istek sahteciliği (CSRF) saldırılarına karşı bir savunmadır.True✓True✓True✓V3.5.22Uygulama, hassas işlevlerin izinsiz cross-origin çağrılmasını önlemek için CORS preflight mekanizmasına güveniyorsa, bu işlevlerin bir CORS-preflight isteğini tetiklemeden çağrılamadığı doğrulanmalıdır. Bu, 'Origin' ve 'Content-Type' header'larının doğrulanmasını veya CORS-safelisted olmayan bir header'ın ve alanın kullanılmasını gerektirebilir.True✓True✓True✓V3.5.44Farklı uygulamaların farklı hostname'lerde barındırıldığı ve böylece Same-Origin Policy tarafından sağlanan kısıtlamalardan (örneğin çerez erişim sınırları, kaynaklar arası etkileşim kontrolleri) faydalanıldığı doğrulanmalıdır.FalseTrue✓True✓V3.5.66Uygulamanın herhangi bir yerinde JSONP işlevselliğinin etkin olmadığı doğrulanmalıdır. Bu, XSSI (Cross-Site Script Inclusion) saldırılarını önlemek içindir.FalseFalseTrue✓V3.5.77Yetkilendirme gerektiren verilerin, JavaScript dosyaları gibi betik kaynaklarının yanıtlarında yer almadığı, XSSI saldırılarını önlemek için doğrulanmalıdır.FalseFalseTrue✓V3.5.88Kimliği doğrulanmış kaynakların (örneğin görseller, videolar, betikler ve belgeler) yalnızca gerçekten amaçlandığında kullanıcı adına yüklenebildiği veya gömülebildiği doğrulanmalıdır. Bu, isteğin uygun olmayan bir çapraz kaynak çağrısından kaynaklanmadığından emin olmak için Sec-Fetch-* HTTP istek başlığı alanlarının sıkı bir şekilde doğrulanmasıyla veya tarayıcıya döndürülen içeriği engelleme talimatı vermek için kısıtlayıcı bir Cross-Origin-Resource-Policy HTTP yanıt başlığı alanı ayarlayarak gerçekleştirilebilir.FalseFalseTrue✓V3.66Harici Kaynak BütünlüğüV3.6.11JavaScript kütüphaneleri, CSS veya web fontları gibi istemci tarafı varlıkların yalnızca statik ve sürümlü olması, varlığın bütünlüğünü doğrulamak için Subresource Integrity (SRI) kullanılması durumunda harici olarak (örneğin, bir İçerik Dağıtım Ağı üzerinde) barındırıldığı doğrulanmalıdır. Bu mümkün değilse, her bir kaynak için bunu gerekçelendiren belgelenmiş bir güvenlik kararı bulunmalıdır.FalseFalseTrue✓V3.77Diğer Tarayıcı Güvenliği HususlarıV3.7.11Uygulamanın yalnızca hâlâ desteklenen ve güvenli kabul edilen istemci tarafı teknolojileri kullandığı doğrulanmalıdır. Bu gereksinimi karşılamayan teknolojilere örnek olarak NSAPI eklentileri, Flash, Shockwave, ActiveX, Silverlight, NACL veya istemci tarafı Java applet’leri verilebilir.FalseTrue✓True✓V3.7.22Uygulamanın, yalnızca hedef adres bir izinli listede yer alıyorsa kullanıcıyı otomatik olarak farklı bir ana makine adına veya uygulamanın kontrolünde olmayan bir etki alanına yönlendirdiği doğrulanmalıdır.FalseTrue✓True✓V3.7.33Uygulamanın, kullanıcı uygulamanın kontrolü dışındaki bir URL’ye yönlendirildiğinde, yönlendirme hakkında bir bildirim gösterdiği ve kullanıcının bu gezintiyi iptal edebilmesi için bir seçenek sunduğu doğrulanmalıdır.FalseFalseTrue✓V3.7.44Uygulamanın en üst düzey etki alanının (örneğin, site.tld) HTTP Strict Transport Security (HSTS) için genel preload listesine eklendiği doğrulanmalıdır. Bu, uygulamanın TLS kullanımının ana tarayıcılar tarafından doğrudan tanınmasını ve yalnızca Strict-Transport-Security yanıt header'ına bağlı kalınmamasını sağlar.FalseFalseTrue✓V3.7.55Uygulamaya erişen tarayıcının beklenen güvenlik özelliklerini desteklememesi durumunda, uygulamanın dokümantasyona uygun şekilde davrandığı (örneğin kullanıcıyı uyarma veya erişimi engelleme) doğrulanmalıdır.FalseFalseTrue✓V44APIAPI ve Web ServisiV4.11Genel Web Servisi GüvenliğiV4.1.11İleti gövdesi içeren her HTTP yanıtında, yanıtın gerçek içeriğiyle eşleşen bir Content-Type header alanı bulunduğu ve güvenli karakter kodlamasını (örneğin, UTF-8, ISO-8859-1) belirtmek üzere charset parametresi içerdiği doğrulanmalıdır. Bu işlem, IANA Medya Türleri'nden "text/", "/+xml" ve "/xml" gibi içerikler için geçerlidir.True✓True✓True✓V4.1.22Yalnızca kullanıcı arayüzüne yönelik uç noktaların (manuel olarak web tarayıcısı ile erişilmesi amaçlanan) otomatik olarak HTTP'den HTTPS'e yönlendirme yaptığı ve diğer hizmetlerin veya uç noktaların şeffaf yönlendirme gerçekleştirmediği doğrulanmalıdır. Bu, istemcinin farkında olmadan şifrelenmemiş HTTP istekleri göndermesi ve bu isteklerin otomatik olarak HTTPS'e yönlendirilmesi sonucunda hassas verilerin sızmasının fark edilmemesi riskini önlemek içindir.FalseTrue✓True✓V4.1.33Uygulama tarafından kullanılan ve yük dengeleyici, web proxy veya frontend için backend hizmeti gibi bir ara katman tarafından ayarlanan herhangi bir HTTP başlık alanının, son kullanıcı tarafından geçersiz kılınamayacağı doğrulanmalıdır. Örnek başlıklar arasında X-Real-IP, X-Forwarded-* veya X-User-ID yer alabilir.FalseTrue✓True✓V4.1.44Uygulama veya API tarafından açıkça desteklenen HTTP yöntemlerinin (preflight istekleri sırasında OPTIONS dahil) dışında hiçbir yöntemin kullanılmadığı ve kullanılmayan yöntemlerin engellendiği doğrulanmalıdır.FalseFalseTrue✓V4.1.55Çok hassas istekler veya birçok sistemden geçen işlemler için, taşıma katmanı güvenliğinin üzerine ek bir güvence sağlamak amacıyla, her iletiye özel dijital imzaların kullanıldığı doğrulanmalıdır.FalseFalseTrue✓V4.22HTTP İleti Yapısı DoğrulamaV4.2.11Tüm uygulama bileşenlerinin (yük dengeleyiciler, güvenlik duvarları ve uygulama sunucuları dahil) HTTP sürümüne uygun mekanizmaları kullanarak gelen HTTP iletilerinin sınırlarını belirlediği ve bu sayede HTTP istek kaçakçılığına karşı koruma sağlandığı doğrulanmalıdır. HTTP/1.x sürümünde Transfer-Encoding başlık alanı varsa, RFC 2616'ya göre Content-Length başlığı göz ardı edilmelidir. HTTP/2 veya HTTP/3 kullanıldığında, Content-Length başlığı varsa, alıcının bu değerin DATA çerçevelerinin uzunluğuyla tutarlı olduğunu doğrulaması gerekir.FalseTrue✓True✓V4.2.22HTTP iletileri üretilirken, Content-Length başlığının, HTTP protokolünün çerçeveleme yöntemine göre belirlenen içerik uzunluğu ile çelişmediği doğrulanmalıdır. Bu, istek kaçakçılığı saldırılarını önlemek için gereklidir.FalseFalseTrue✓V4.2.33Uygulamanın, yanıt bölme ve header enjeksiyonu saldırılarını önlemek amacıyla, bağlantıya özel başlık alanları (örneğin Transfer-Encoding) içeren HTTP/2 veya HTTP/3 iletilerini göndermediği ve kabul etmediği doğrulanmalıdır.FalseFalseTrue✓V4.2.44Uygulamanın yalnızca başlık alanları ve değerleri CR (\r), LF (\n) veya CRLF (\r\n) karakter dizileri içermeyen HTTP/2 ve HTTP/3 isteklerini kabul ettiği doğrulanmalıdır. Bu, başlık enjeksiyonu saldırılarını önlemek içindir.FalseFalseTrue✓V4.2.55Uygulama (backend veya frontend) istek oluşturuyor ve gönderiyorsa, URI'ler (örneğin API çağrıları için) veya HTTP istek başlıkları (örneğin Authorization veya Cookie) gibi bileşenlerin, alıcı sistemler tarafından kabul edilemeyecek kadar uzun olmamasını sağlamak amacıyla doğrulama, temizleme veya diğer mekanizmaları kullandığı doğrulanmalıdır. Bu tür çok uzun istekler (örneğin çok uzun bir Cookie başlığı) gönderildiğinde sunucunun sürekli hata durumu döndürmesiyle hizmet reddi oluşabilir.FalseFalseTrue✓V4.33GraphQLV4.3.11Maliyetli ve iç içe geçmiş sorgular sonucu oluşabilecek GraphQL veya veri katmanı ifadelerine yönelik Hizmet Reddi (DoS) saldırılarını önlemek için, sorgu izin listesi (allowlist), derinlik sınırlandırması, sorgu sayısı sınırlandırması veya sorgu maliyeti analizi kullanıldığı doğrulanmalıdır.FalseTrue✓True✓V4.3.22GraphQL introspection (iç yapı sorgulama) sorgularının, GraphQL API'nin üçüncü taraflar tarafından kullanılmasına yönelik olmadığı sürece, üretim ortamında devre dışı bırakıldığı doğrulanmalıdır.FalseTrue✓True✓V4.44WebSocketV4.4.11Tüm WebSocket bağlantılarında TLS üzerinden WebSocket (WSS) kullanıldığı doğrulanmalıdır.True✓True✓True✓V4.4.22WebSocket'in başlangıçtaki HTTP el sıkışması (handshake) sırasında, Origin başlık alanının uygulama için izin verilen origin listesiyle karşılaştırılarak kontrol edildiği doğrulanmalıdır.FalseTrue✓True✓V4.4.33Uygulamanın standart oturum yönetimi kullanılamıyorsa, bunun yerine ilgili Oturum Yönetimi güvenlik gereksinimlerine uygun özel token'ların kullanıldığı doğrulanmalıdır.FalseTrue✓True✓V4.4.44HTTPS oturumu WebSocket kanalına geçerken, özel WebSocket oturum yönetim token’larının önceki şekilde kimliği doğrulanmış HTTPS oturumu aracılığıyla elde edildiği veya doğrulandığı doğrulanmalıdır.FalseTrue✓True✓V55FileDosya İşlemeV5.11Dosya İşleme DokümantasyonuV5.1.11Dokümantasyonun, her yükleme özelliği için izin verilen dosya türlerini, beklenen dosya uzantılarını ve maksimum boyutu (açılmış hali dahil) tanımladığı doğrulanmalıdır. Ayrıca, dosyaların son kullanıcılar için nasıl güvenli hâle getirileceği (örneğin kötü amaçlı bir dosya tespit edildiğinde uygulamanın nasıl davranacağı) gibi bilgilerin de belgede yer aldığı doğrulanmalıdır.FalseTrue✓True✓V5.22Dosya Yükleme ve İçerikV5.2.11Uygulamanın, yalnızca performans kaybına veya hizmet reddine yol açmayacak boyuttaki dosyaları kabul ettiği doğrulanmalıdır.True✓True✓True✓V5.2.22Uygulama bir dosyayı, doğrudan veya bir arşiv (ör. zip dosyası) içinde kabul ettiğinde, dosya uzantısının beklenen uzantıyla eşleşip eşleşmediğini kontrol ettiği ve içeriğin uzantı tarafından temsil edilen türle uyumlu olduğunu doğruladığı kontrol edilmelidir. Bu; ilk 'magic byte' kontrolü, görüntü yeniden yazımı ve dosya içeriği doğrulama için özel kütüphanelerin kullanımı gibi yöntemleri içerir. Seviye 1 için bu, yalnızca iş veya güvenlik kararlarında kullanılan dosyalarla sınırlı olabilir. Seviye 2 ve üzeri için tüm dosyalar bu kontrole tabi olmalıdır.True✓True✓True✓V5.2.33Sıkıştırılmış dosyaların (ör. zip, gz, docx, odt) açılmadan önce, izin verilen maksimum açılmış boyuta ve maksimum dosya sayısına göre kontrol edildiği doğrulanmalıdır.FalseTrue✓True✓V5.2.44Her kullanıcı için dosya boyutu kotası ve maksimum dosya sayısının uygulandığı doğrulanmalıdır. Böylece tek bir kullanıcının çok sayıda veya aşırı büyük dosya yükleyerek depolama alanını doldurması engellenir.FalseFalseTrue✓V5.2.55Uygulamanın, içinde sembolik bağlantılar (symlink) bulunan sıkıştırılmış dosyaların yüklenmesine yalnızca bu durum özel olarak gerekli olduğunda izin verdiği doğrulanmalıdır. Bu durumda, sembolik bağlantı verilebilecek dosyaların bir izinli listesi uygulanmalıdır.FalseFalseTrue✓V5.2.66Uygulamanın, piksel boyutu izin verilen maksimum değeri aşan görüntü dosyalarının yüklenmesini reddettiği doğrulanmalıdır. Bu, pixel flood saldırılarını önlemek için gereklidir.FalseFalseTrue✓V5.33Dosya DepolamaV5.3.11Güvenilmeyen girdilerle yüklenen veya oluşturulan ve herkese açık klasörlerde depolanan dosyaların, bir HTTP isteğiyle doğrudan erişildiğinde sunucu taraflı program kodu olarak çalıştırılmadığı doğrulanmalıdır.True✓True✓True✓V5.3.22Uygulamanın, dosya işlemleri için dosya yollarını oluştururken kullanıcı tarafından gönderilen dosya adlarını değil, dahili olarak oluşturulan veya güvenilir verileri kullandığı; eğer kullanıcı tarafından gönderilen dosya adları veya meta veriler kullanılacaksa, sıkı doğrulama ve temizleme işlemlerinin uygulandığı doğrulanmalıdır. Bu, yol geçişi (path traversal), yerel veya uzak dosya dahil etme (LFI, RFI) ve sunucu tarafı istek sahteciliği (SSRF) saldırılarına karşı koruma sağlar.True✓True✓True✓V5.3.33Sunucu tarafında gerçekleşen dosya işlemlerinin (örneğin dosya açma/decompress işlemi), kullanıcı tarafından sağlanan yol bilgilerini yok saydığı ve zip slip gibi güvenlik açıklarını önlediği doğrulanmalıdır.FalseFalseTrue✓V5.44Dosya İndirmeV5.4.11Uygulamanın, kullanıcı tarafından gönderilen dosya adlarını (ör. JSON, JSONP veya URL parametresinde) doğruladığı veya göz ardı ettiği ve yanıtın Content-Disposition başlık alanında bir dosya adı belirttiği doğrulanmalıdır.FalseTrue✓True✓V5.4.22Sunulan dosya adlarının (örneğin HTTP yanıt header'larında veya e-posta eklerinde), belge yapısını korumak ve enjeksiyon saldırılarını önlemek için kodlandığı veya temizlendiği (ör. RFC 6266’ya uygun) doğrulanmalıdır.FalseTrue✓True✓V5.4.33Güvenilmeyen kaynaklardan elde edilen dosyaların, bilinen kötü amaçlı içeriklerin sunulmasını önlemek amacıyla antivirüs tarayıcılarıyla tarandığı doğrulanmalıdır.FalseTrue✓True✓V66AuthenticationKimlik DoğrulamaV6.11Kimlik Doğrulama DokümantasyonuV6.1.11Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırılarına karşı oran sınırlama (rate limiting), otomasyon karşıtı önlemler ve uyarlanabilir yanıt gibi kontrollerin nasıl kullanıldığını açıklayan bir uygulama dokümantasyonu bulunduğu doğrulanmalıdır. Dokümantasyon, bu kontrollerin nasıl yapılandırıldığını ve kötü niyetli hesap kilitlemenin nasıl önlendiğini açıkça ortaya koymalıdır.True✓True✓True✓V6.1.22Parolalarda kullanılmasını önlemek amacıyla, bağlama özgü sözcüklerin (örneğin kurum adlarının permütasyonları, ürün adları, sistem tanımlayıcıları, proje kod adları, departman veya rol adları vb.) bulunduğu belgelenmiş bir liste mevcut olduğu doğrulanmalıdır.FalseTrue✓True✓V6.1.33Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, bunların tümünün belgelenmiş olduğu ve her yol için tutarlı şekilde uygulanması gereken güvenlik kontrolleri ile kimlik doğrulama gücünün tanımlandığı doğrulanmalıdır.FalseTrue✓True✓V6.22Parola GüvenliğiV6.2.11Kullanıcı tarafından belirlenen parolaların en az 8 karakter uzunluğunda olması sağlanmalı, ancak 15 karakter ve üzeri uzunlukta parolalar olmaları şiddetle tavsiye edilir.True✓True✓True✓V6.2.22Kullanıcıların parolalarını değiştirebilmeleri sağlanmalıdır.True✓True✓True✓V6.2.33Parola değiştirme işlevinin hem mevcut hem de yeni parolayı gerektirdiği doğrulanmalıdır.True✓True✓True✓V6.2.44Kayıt veya parola değişimi sırasında girilen parolaların, uygulamanın parola politikasına (örneğin minimum uzunluk) uyan ilk 3000 yaygın parolaya karşı kontrol edildiği doğrulanmalıdır.True✓True✓True✓V6.2.55Her tür karakterin kullanılmasına izin verildiği ve büyük/küçük harf, sayı veya özel karakter şartlarının zorunlu tutulmadığı doğrulanmalıdır.True✓True✓True✓V6.2.66Parola giriş alanlarının, girdiyi maskelemek için "type=password" kullandığı doğrulanmalıdır. Uygulamalar, kullanıcının tüm maskelenmiş parolayı ya da son girilen karakteri geçici olarak görüntülemesine izin verebilir.True✓True✓True✓V6.2.77"Yapıştır" özelliğinin, tarayıcı parola yardımcılarının ve harici parola yöneticilerinin kullanımına izin verildiği doğrulanmalıdır.True✓True✓True✓V6.2.88Uygulamanın, kullanıcıdan aldığı parolayı herhangi bir şekilde değiştirmeden, örneğin kesmeden veya harf büyüklüğünü değiştirmeden, tam olarak doğruladığı teyit edilmelidir.True✓True✓True✓V6.2.99En az 64 karakter uzunluğundaki parolalara izin verildiği doğrulanmalıdır.FalseTrue✓True✓V6.2.1010Kullanıcının parolasının, yalnızca ele geçirildiği tespit edildiğinde veya kullanıcı tarafından yenilendiğinde geçerliliğini yitirdiği doğrulanmalıdır. Uygulama, belirli aralıklarla parola yenilenmesini zorunlu kılmamalıdır.FalseTrue✓True✓V6.2.1111Tahmin edilmesi kolay parolaların oluşturulmasını önlemek amacıyla, bağlama özgü kelimelerin yer aldığı belgelenmiş listenin parola doğrulamada kullanıldığı teyit edilmelidir.FalseTrue✓True✓V6.2.1212Kayıt veya parola değişikliği sırasında girilen parolaların, ele geçirilmiş parolalar listesine karşı kontrol edildiği doğrulanmalıdır.FalseTrue✓True✓V6.33Genel Kimlik Doğrulama GüvenliğiV6.3.11Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırıları gibi saldırıları önlemeye yönelik kontrollerin, uygulamanın güvenlik dokümantasyonuna göre uygulandığı doğrulanmalıdır.True✓True✓True✓V6.3.22"root", "admin" veya "sa" gibi varsayılan kullanıcı hesaplarının uygulamada yer almadığı veya devre dışı bırakıldığı doğrulanmalıdır.True✓True✓True✓V6.3.33Uygulamaya erişim için ya çok faktörlü bir kimlik doğrulama mekanizması ya da tek faktörlü mekanizmaların kombinasyonu kullanılmalıdır. Seviye 3 için, bu faktörlerden biri, oltalama saldırılarına karşı direnç sağlayan ve kimlik doğrulama niyetini bir kullanıcı etkileşimi (örneğin FIDO donanım anahtarında bir düğmeye basma veya mobil telefonda bir onay) gerektirerek doğrulayan donanım tabanlı bir kimlik doğrulayıcı olmalıdır. Bu gereksinimdeki herhangi bir esneklik için, gerekçesi belgelenmiş ve riskleri azaltıcı kapsamlı kontroller içeren bir plan gereklidir.FalseTrue✓True✓V6.3.44Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, belgelendirilmemiş bir yol bulunmadığı ve tüm yollar için güvenlik kontrolleri ile kimlik doğrulama gücünün tutarlı şekilde uygulandığı doğrulanmalıdır.FalseTrue✓True✓V6.3.55Başarılı veya başarısız şüpheli kimlik doğrulama girişimlerinin kullanıcıya bildirildiği doğrulanmalıdır. Bu, olağandışı bir konum veya istemciden gelen girişimler, yalnızca bir faktörle yapılan kısmen başarılı doğrulamalar, uzun süreli inaktiflik sonrası yapılan girişimler veya birçok başarısız denemeden sonraki başarılı girişimler gibi durumları içerebilir.FalseFalseTrue✓V6.3.66E-postanın, tek faktörlü ya da çok faktörlü kimlik doğrulama mekanizması olarak kullanılmadığı doğrulanmalıdır.FalseFalseTrue✓V6.3.77Kimlik doğrulama detaylarında yapılan güncellemeler sonrasında (örneğin kimlik bilgisi sıfırlama, kullanıcı adı veya e-posta adresi değişiklikleri), kullanıcıların bilgilendirildiği doğrulanmalıdır.FalseFalseTrue✓V6.3.88Başarısız kimlik doğrulama girişimlerinden, geçerli kullanıcıların hata mesajları, HTTP yanıt kodları veya farklı yanıt süreleri gibi sonuçlara dayanarak tespit edilemediği doğrulanmalıdır. Bu koruma, kayıt ve "parolamı unuttum" işlevselliğinde de geçerli olmalıdır.FalseFalseTrue✓V6.44Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve KurtarmaV6.4.11Sistem tarafından oluşturulan ilk parolaların veya etkinleştirme kodlarının güvenli bir şekilde rastgele üretildiği, mevcut parola politikasına uygun olduğu, kısa bir süre içinde veya ilk kullanım sonrasında geçerliliğini yitirdiği doğrulanmalıdır. Bu başlangıç sırları uzun vadeli parola olarak kullanılmasına izin verilmemelidir.True✓True✓True✓V6.4.22Parola ipuçlarının veya "gizli sorular" olarak bilinen, bilgiye dayalı kimlik doğrulama mekanizmalarının mevcut olmadığı doğrulanmalıdır.True✓True✓True✓V6.4.33Unutulmuş parolanın sıfırlanması için, etkin olan çok faktörlü kimlik doğrulama mekanizmalarını atlamayan güvenli bir sürecin uygulandığı doğrulanmalıdır.FalseTrue✓True✓V6.4.44Çok faktörlü kimlik doğrulama faktörlerinden biri kaybolursa, kayıt sırasında uygulanan kimlik kanıtlama seviyesiyle aynı seviyede kimlik doğrulama yapıldığı doğrulanmalıdır.FalseTrue✓True✓V6.4.55Süresi dolacak kimlik doğrulama mekanizmalarının yenilenmesine ilişkin talimatların, süresi dolmadan önce tamamlanacak şekilde yeterli sürede gönderildiği ve gerekiyorsa otomatik hatırlatıcıların yapılandırıldığı doğrulanmalıdır.FalseFalseTrue✓V6.4.66Yönetici yetkisi olan kullanıcıların, kullanıcının parola sıfırlama sürecini başlatabildiği ancak kullanıcının yeni parolasını belirleyemediği veya değiştiremediği doğrulanmalıdır. Bu, yönetici yetkisi olan kullanıcıların, kullanıcı parolasını bilmesini engeller.FalseFalseTrue✓V6.55Çok Faktörlü Kimlik Doğrulama İçin Genel GereksinimlerV6.5.11Arama sırları, bant dışı kimlik doğrulama istekleri veya kodları ve zamana dayalı tek kullanımlık parolaların (TOTP) yalnızca bir kez kullanılabildiği doğrulanmalıdır.FalseTrue✓True✓V6.5.22Uygulamanın backend tarafında saklanırken, 112 bitten az entropiye sahip (örneğin 19 rastgele harf-rakam karakteri veya 34 rastgele rakam) arama sırlarının, 32-bit rastgele bir salt içeren onaylı bir parola saklama algoritmasıyla hash’lendiği doğrulanmalıdır. Gizli bilginin entropisi 112 bit veya daha fazlaysa standart bir hash fonksiyonu kullanılabilir.FalseTrue✓True✓V6.5.33Arama sırları, bant dışı kimlik doğrulama kodları ve zamana dayalı tek kullanımlık parola seed'lerinin, öngörülebilir değerlerden kaçınmak için Kriptografik Olarak Güvenli Sözde Rastgele Sayı Üreteci (CSPRNG) ile oluşturulduğu doğrulanmalıdır.FalseTrue✓True✓V6.5.44Arama sırlarının ve bant dışı kimlik doğrulama kodlarının en az 20 bit entropiye (genellikle 4 rastgele harf-rakam karakteri veya 6 rastgele rakam) sahip olduğu doğrulanmalıdır.FalseTrue✓True✓V6.5.55Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının ve zamana dayalı tek kullanımlık parolaların (TOTP) belirli bir ömre sahip olduğu doğrulanmalıdır. Bant dışı istekler en fazla 10 dakika, TOTP’ler ise en fazla 30 saniye geçerli olmalıdır.FalseTrue✓True✓V6.5.66Herhangi bir kimlik doğrulama faktörünün (fiziksel cihazlar dahil) çalınması veya kaybı durumunda iptal edilebildiği doğrulanmalıdır.FalseFalseTrue✓V6.5.77Biyometrik kimlik doğrulama mekanizmalarının yalnızca ikincil faktör olarak, “sahip olduğunuz bir şey” veya “bildiğiniz bir şey” ile birlikte kullanıldığı doğrulanmalıdır.FalseFalseTrue✓V6.5.88Zamana dayalı tek kullanımlık parolaların (TOTP) doğrulamasının, güvenilir bir hizmetten alınan zaman kaynağına dayanarak yapıldığı ve güvenilir olmayan veya istemci tarafından sağlanan zaman kaynağına dayanmadığı doğrulanmalıdır.FalseFalseTrue✓V6.66Bant Dışı Kimlik Doğrulama MekanizmalarıV6.6.11Tek kullanımlık parolaların (OTP) telefon veya SMS ile Public Switched Telephone Network (PSTN) üzerinden iletildiği kimlik doğrulama mekanizmalarının, yalnızca telefon numarası önceden doğrulanmışsa, alternatif daha güçlü yöntemler (örneğin TOTP) de sunuluyorsa ve kullanıcıya güvenlik riskleri hakkında bilgi veriliyorsa sunulduğu doğrulanmalıdır. Seviye 3 uygulamalar için telefon ve SMS seçenekleri sunulmamalıdır.FalseTrue✓True✓V6.6.22Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının, oluşturuldukları özgün kimlik doğrulama isteğiyle bağlantılı olduğu ve daha önceki ya da sonraki bir istek için kullanılamadığı doğrulanmalıdır.FalseTrue✓True✓V6.6.33Kod tabanlı bant dışı kimlik doğrulama mekanizmalarının, oran sınırlaması ile kaba kuvvet saldırılarına karşı korunduğu doğrulanmalıdır. En az 64 bit entropiye sahip kodlar kullanılması da değerlendirilmelidir.FalseTrue✓True✓V6.6.44Çok faktörlü kimlik doğrulama için push bildirimleri kullanılıyorsa, push bombing saldırılarına karşı oran sınırlamasının kullanıldığı doğrulanmalıdır. “Numara eşleştirme” de bu riski azaltabilir.FalseFalseTrue✓V6.77Kriptografik Kimlik Doğrulama MekanizmasıV6.7.11Kriptografik kimlik doğrulama beyanlarını doğrulamak için kullanılan sertifikaların, değiştirilmeye karşı korumalı şekilde saklandığı doğrulanmalıdır.FalseFalseTrue✓V6.7.22Challenge nonce değerinin en az 64 bit uzunluğunda olduğu ve istatistiksel olarak benzersiz ya da cihazın ömrü boyunca benzersiz olduğu doğrulanmalıdır.FalseFalseTrue✓V6.88Kimlik Sağlayıcısı ile Kimlik DoğrulamaV6.8.11Uygulama birden fazla kimlik sağlayıcıyı (IdP) destekliyorsa, başka bir desteklenen kimlik sağlayıcı aracılığıyla (örneğin aynı kullanıcı tanımlayıcısını kullanarak) kullanıcının kimliğinin taklit edilemediği doğrulanmalıdır. Standart önlem, uygulamanın kullanıcıyı IdP kimliği (bir ad alanı işlevi görür) ve IdP içindeki kullanıcı kimliğinin birleşimiyle kaydetmesi ve tanımlamasıdır.FalseTrue✓True✓V6.8.22Kimlik doğrulama beyanları üzerindeki dijital imzaların (örneğin JWT veya SAML beyanları) varlığı ve bütünlüğünün her zaman doğrulandığı ve imzasız veya geçersiz imzalı beyanların reddedildiği doğrulanmalıdır.FalseTrue✓True✓V6.8.33SAML beyanlarının benzersiz biçimde işlendiği ve yalnızca geçerlilik süresi içinde bir kez kullanıldığı, tekrar oynatma (replay) saldırılarını önlemek amacıyla doğrulanmalıdır.FalseTrue✓True✓V6.8.44Uygulama ayrı bir Kimlik Sağlayıcı (IdP) kullanıyorsa ve belirli işlemler için belirli kimlik doğrulama gücü, yöntemleri veya zaman bilgisi bekliyorsa, uygulamanın bu bilgileri IdP tarafından döndürülen veriler üzerinden doğruladığı teyit edilmelidir. Örneğin OIDC kullanılıyorsa, bu durum ID Token üzerindeki 'acr', 'amr' ve 'auth_time' gibi claim’lerin (varsa) doğrulanması ile sağlanabilir. Eğer IdP bu bilgileri sağlamıyorsa, uygulamanın asgari kimlik doğrulama gücünün kullanıldığını varsayan (örneğin yalnızca kullanıcı adı ve parola ile tek faktörlü doğrulama) belgelenmiş bir yedek yaklaşımı olmalıdır.FalseTrue✓True✓V77SessionOturum YönetimiV7.11Oturum Yönetim DokümantasyonuV7.1.11Kullanıcının oturum inaktivite zaman aşımı süresi ve mutlak maksimum oturum süresinin belgelendiği, diğer kontrollerle birlikte uygun olduğu ve NIST SP 800-63B yeniden kimlik doğrulama gereksinimlerinden herhangi bir sapma varsa gerekçesinin belgede yer aldığı doğrulanmalıdır.FalseTrue✓True✓V7.1.22Belgede bir hesap için kaç adet eşzamanlı (paralel) oturuma izin verildiği ile birlikte, maksimum aktif oturum sayısına ulaşıldığında uygulanacak davranış ve işlemlerin tanımlandığı doğrulanmalıdır.FalseTrue✓True✓V7.1.33Birleşik kimlik yönetim ekosisteminin bir parçası olarak kullanıcı oturumu oluşturan ve yöneten tüm sistemlerin, oturum ömrü, sonlandırma ve yeniden kimlik doğrulama gerektiren diğer koşulların nasıl koordine edildiğini açıklayan kontrollerle birlikte belgede yer aldığı doğrulanmalıdır.FalseTrue✓True✓V7.22Temel Oturum Yönetimi GüvenliğiV7.2.11Uygulamanın tüm oturum token'ı doğrulama işlemlerini güvenilir bir backend servisi aracılığıyla gerçekleştirdiği doğrulanmalıdır.True✓True✓True✓V7.2.22Uygulamanın, statik API gizli anahtarları veya sabit değerler yerine, oturum yönetimi için dinamik olarak oluşturulan kendi kendine yeterli veya referans token'ları kullandığı doğrulanmalıdır.True✓True✓True✓V7.2.33Uygulama kullanıcı oturumlarını temsil etmek için referans token'ları kullanıyorsa, bu token'ların benzersiz olduğu, kriptografik olarak güvenli bir sözde rastgele sayı üreteci (CSPRNG) kullanılarak üretildiği ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır.True✓True✓True✓V7.2.44Uygulamanın, kullanıcı kimlik doğrulaması (yeniden kimlik doğrulama dahil) sırasında yeni bir oturum token'ı oluşturduğu ve mevcut oturum token'ını sonlandırdığı doğrulanmalıdır.True✓True✓True✓V7.33Oturum Zaman AşımıV7.3.11Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde bir hareketsizlik zaman aşımı bulunduğu doğrulanmalıdır.FalseTrue✓True✓V7.3.22Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde mutlak bir maksimum oturum süresi bulunduğu doğrulanmalıdır.FalseTrue✓True✓V7.44Oturum SonlandırmaV7.4.11Oturum sonlandırma tetiklendiğinde (örneğin, çıkış yapıldığında veya süre dolduğunda), uygulamanın oturumun daha fazla kullanılmasına izin vermediği doğrulanmalıdır. Referans token'lar veya durum bilgili oturumlar için bu, oturum verilerinin uygulama arka ucunda geçersiz kılınması anlamına gelir. Kapsamlı token kullanan uygulamaların; sonlandırılmış token listesi tutmak, kullanıcıya özel tarih ve saatten önce oluşturulan token'ları reddetmek veya kullanıcıya özel imzalama anahtarını yenilemek gibi bir çözüm uygulaması gerekir.True✓True✓True✓V7.4.22Bir kullanıcı hesabı devre dışı bırakıldığında veya silindiğinde (örneğin bir çalışanın şirketten ayrılması), uygulamanın tüm aktif oturumları sonlandırdığı doğrulanmalıdır.True✓True✓True✓V7.4.33Herhangi bir kimlik doğrulama faktörünün başarılı bir şekilde değiştirilmesi veya kaldırılmasından (şifre sıfırlama veya kurtarma yoluyla yapılan değişiklikler dahil ve varsa MFA ayarları güncellemeleri dahil) sonra, uygulamanın diğer tüm aktif oturumları sonlandırma seçeneği sunduğu doğrulanmalıdır.FalseTrue✓True✓V7.4.44Kimlik doğrulama gerektiren tüm sayfalarda kolay erişilebilir ve görünür bir çıkış yap (logout) işlevi bulunduğu doğrulanmalıdır.FalseTrue✓True✓V7.4.55Uygulama yöneticilerinin, bireysel bir kullanıcının veya tüm kullanıcıların aktif oturumlarını sonlandırabilme yetkisine sahip olduğu doğrulanmalıdır.FalseTrue✓True✓V7.55Oturum Kötüye Kullanımına Karşı SavunmalarV7.5.11E-posta adresi, telefon numarası, MFA yapılandırması veya hesap kurtarmada kullanılan diğer bilgiler gibi kimlik doğrulamayı etkileyebilecek hassas hesap özniteliklerinde değişiklik yapılmadan önce uygulamanın tam yeniden kimlik doğrulama gerektirdiği doğrulanmalıdır.FalseTrue✓True✓V7.5.22Kullanıcıların, (en az bir faktörle yeniden kimlik doğrulama yaptıktan sonra) mevcut tüm aktif oturumları görüntüleyebilmesi ve sonlandırabilmesinin mümkün olduğu doğrulanmalıdır.FalseTrue✓True✓V7.5.33Uygulamanın, son derece hassas işlemler veya operasyonlar gerçekleştirilmeden önce en az bir faktörle ek kimlik doğrulaması veya ikincil bir doğrulama gerektirdiği doğrulanmalıdır.FalseFalseTrue✓V7.66Birleşik Yeniden Kimlik DoğrulamaV7.6.11Güvenen Taraf (RP) ile Kimlik Sağlayıcı (IdP) arasındaki oturum süresi ve oturum sonlandırma davranışlarının belgelenmiş olduğu ve, örneğin IdP kimlik doğrulama olayları arasında maksimum süreye ulaşıldığında yeniden kimlik doğrulamanın gerekli kılındığı doğrulanmalıdır.FalseTrue✓True✓V7.6.22Yeni bir oturum oluşturulmasının, kullanıcı onayı veya açık bir eylem gerektirdiği; kullanıcı etkileşimi olmaksızın yeni uygulama oturumlarının oluşturulmasının önlendiği doğrulanmalıdır.FalseTrue✓True✓V88AuthorizationYetkilendirmeV8.11Yetkilendirme DokümantasyonuV8.1.11Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak işlev düzeyinde ve veriye özel erişim kısıtlamaları için kuralları tanımladığı doğrulanmalıdır.True✓True✓True✓V8.1.22Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak alan (field) düzeyinde erişim kısıtlamaları (hem okuma hem yazma) için kuralları tanımladığı doğrulanmalıdır. Bu kuralların, ilgili veri nesnesinin durum veya statü gibi diğer özniteliklerine bağlı olabileceği unutulmamalıdır.FalseTrue✓True✓V8.1.33Uygulamanın dokümantasyonunun, kimlik doğrulama ve yetkilendirme ile ilgili güvenlik kararlarının alınmasında kullanılan çevresel ve bağlamsal öznitelikleri (günün saati, kullanıcı konumu, IP adresi veya cihaz gibi) tanımladığı doğrulanmalıdır.FalseFalseTrue✓V8.1.44Kimlik doğrulama ve yetkilendirme dokümantasyonunun; işlev düzeyinde, veriye özel ve alan düzeyinde yetkilendirmenin yanı sıra çevresel ve bağlamsal faktörlerin karar almada nasıl kullanıldığını tanımladığı doğrulanmalıdır. Bu, değerlendirilen öznitelikleri, risk eşiklerini ve alınan aksiyonları (ör. izin ver, doğrulama iste, reddet, step-up kimlik doğrulama) içermelidir.FalseFalseTrue✓V8.22Genel Yetkilendirme TasarımıV8.2.11Uygulamanın, işlev düzeyindeki erişimin yalnızca açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır.True✓True✓True✓V8.2.22Uygulamanın, veriye özel erişimin yalnızca belirli veri öğelerine açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, doğrudan nesne referansı güvenlik açıkları (IDOR) ve bozuk nesne düzeyinde yetkilendirme (BOLA) risklerini azaltır.True✓True✓True✓V8.2.33Uygulamanın, alan (field) düzeyindeki erişimin yalnızca belirli alanlara açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, bozuk nesne özelliği düzeyinde yetkilendirme (BOPLA) risklerini azaltır.FalseTrue✓True✓V8.2.44Tüketicinin çevresel ve bağlamsal özniteliklerine (ör. günün saati, konum, IP adresi veya cihaz) dayalı uyarlanabilir güvenlik kontrollerinin, uygulama dokümantasyonunda tanımlandığı şekilde, kimlik doğrulama ve yetkilendirme kararları için uygulandığı doğrulanmalıdır. Bu kontroller, tüketici yeni bir oturum başlatmaya çalışırken ve mevcut bir oturum sırasında uygulanmalıdır.FalseFalseTrue✓V8.33İşlem Düzeyinde YetkilendirmeV8.3.11Uygulamanın yetkilendirme kurallarını güvenilir bir servis katmanında uyguladığı ve istemci taraflı JavaScript gibi güvenilmeyen tüketiciler tarafından değiştirilebilecek kontrollerle yetinmediği doğrulanmalıdır.True✓True✓True✓V8.3.22Yetkilendirme kararlarının temelini oluşturan değerlerdeki değişikliklerin hemen uygulandığı doğrulanmalıdır. Değişikliklerin anında uygulanamadığı durumlarda (örneğin self-contained token içindeki verilere güveniliyorsa), tüketici artık yetkili olmadığı hâlde bir işlem gerçekleştirdiğinde uyarı verecek ve değişikliği geri alacak önlemler uygulanmalıdır. Bu alternatifin bilgi sızıntısını önlemeyeceği unutulmamalıdır.FalseFalseTrue✓V8.3.33Bir nesneye erişimin, herhangi bir aracı veya onun adına hareket eden bir servis yerine yalnızca erişimi başlatan öznenin (ör. tüketici) izinlerine dayandığı doğrulanmalıdır. Örneğin, bir tüketici kimlik doğrulama için bir self-contained token kullanarak bir web servis çağırırsa ve bu servis başka bir servisten veri talep ederse, ikinci servis izin kararlarını verirken birinci servisin makine-makine token'ı yerine tüketicinin token'ını kullanmalıdır.FalseFalseTrue✓V8.44Diğer Yetkilendirme HususlarıV8.4.11Multi-tenant uygulamaların, tüketici işlemlerinin izinli olmadıkları tenant'lar üzerinde asla etkili olmamasını sağlamak için tenant'lar arası kontroller kullandığı doğrulanmalıdır.FalseTrue✓True✓V8.4.22Yönetici arayüzlerine erişimin, sürekli tüketici kimlik doğrulaması, cihaz güvenlik durumu değerlendirmesi ve bağlamsal risk analizi dahil olmak üzere çok katmanlı güvenlik içerdiği doğrulanmalıdır. Yetkilendirme için yalnızca ağ konumu veya güvenilir uç noktalar yeterli olmamalıdır; ancak bu tür faktörler yetkisiz erişim olasılığını azaltabilir.FalseFalseTrue✓V99SelfKendi İçinde Taşıyıcı Token (Self-contained Token)V9.11Token Kaynağı ve BütünlüğüV9.1.11Self-contained token'ların içerikleri kabul edilmeden önce, oynama (tampering) saldırılarına karşı dijital imza veya MAC ile doğrulama yapıldığı doğrulanmalıdır.True✓True✓True✓V9.1.22Belirli bir bağlam için yalnızca bir allowlist üzerinde bulunan algoritmaların self-contained token oluşturmak ve doğrulamak için kullanılabildiği doğrulanmalıdır. Bu allowlist, yalnızca simetrik ya da yalnızca asimetrik algoritmaları içermeli ve kesinlikle 'None' algoritmasını içermemelidir. Hem simetrik hem de asimetrik algoritmalar desteklenmek zorundaysa, anahtar karışıklığını (key confusion) önlemek için ek kontroller uygulanmalıdır.True✓True✓True✓V9.1.33Self-contained token'ları doğrulamak için kullanılan anahtar malzemesinin, token issuer için önceden yapılandırılmış güvenilir kaynaklardan alındığı doğrulanmalıdır. Bu, saldırganların güvenilmeyen kaynak ve anahtarları belirtmesini engeller. JWT ve diğer JWS yapılarında 'jku', 'x5u' ve 'jwk' gibi header'lar güvenilir kaynaklardan oluşan bir allowlist'e göre doğrulanmalıdır.True✓True✓True✓V9.22Token İçeriğiV9.2.11Token verisinde bir geçerlilik zaman aralığı (validity time span) varsa, yalnızca doğrulama zamanı bu zaman aralığı içerisindeyse token ve içeriği kabul edilmelidir. Örneğin, JWT'ler için 'nbf' ve 'exp' claim'leri doğrulanmalıdır.True✓True✓True✓V9.2.22Token'ı alan hizmetin, token içeriğini kabul etmeden önce bu token'ın doğru türde olduğunu ve sunulma amacına uygun olduğunu doğruladığı teyit edilmelidir. Örneğin, yalnızca erişim token'ları yetkilendirme kararları için, yalnızca ID Token'lar kullanıcı kimlik doğrulamasını kanıtlamak için kullanılabilir.FalseTrue✓True✓V9.2.33Hizmetin yalnızca kendisiyle kullanılması amaçlanan (audience) token'ları kabul ettiği doğrulanmalıdır. JWT'lerde bu, 'aud' claim'inin hizmet içinde tanımlı bir allowlist ile doğrulanması yoluyla sağlanabilir.FalseTrue✓True✓V9.2.44Eğer bir token issuer, farklı audience'lara token oluşturmak için aynı private key'i kullanıyorsa, oluşturulan token'ların hedef audience'ları benzersiz şekilde tanımlayan bir audience kısıtlaması içerdiği doğrulanmalıdır. Bu, bir token'ın farklı bir audience ile yeniden kullanılmasını önler. Audience tanımlayıcısı dinamik olarak sağlanıyorsa, token issuer bu audience'ları doğrulamalı ve audience taklitlerinin (impersonation) önüne geçmelidir.FalseTrue✓True✓V1010OAuthOAuth ve OIDCV10.11Genel OAuth ve OIDC GüvenliğiV10.1.11Token'ların yalnızca kesinlikle ihtiyaç duyan bileşenlere gönderildiği doğrulanmalıdır. Örneğin, tarayıcı tabanlı JavaScript uygulamaları için bir backend-for-frontend modeli kullanıldığında, access ve refresh token'lara yalnızca backend'in erişebilmesi gerekir.FalseTrue✓True✓V10.1.22Authorization server'dan gelen değerler (örneğin authorization code veya ID Token gibi) yalnızca aynı user agent oturumu ve işlemi tarafından başlatılmış bir yetkilendirme akışının sonucuysa kabul edildiği doğrulanmalıdır. Bu, client tarafından oluşturulan secret’ların 'proof key for code exchange' (PKCE) ‘code_verifier’, ‘state’ veya OIDC ‘nonce’ gibi tahmin edilemez, işleme özgü ve hem client’a hem de işlem başlatılan user agent oturumuna güvenli bir şekilde bağlı olmasını gerektirir.FalseTrue✓True✓V10.22OAuth İstemcisiV10.2.11Code flow kullanılıyorsa, OAuth client’ın token taleplerini tetikleyen CSRF saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Bu genellikle PKCE kullanılarak veya authorization isteğinde gönderilen ‘state’ parametresinin kontrolü ile sağlanır.FalseTrue✓True✓V10.2.22OAuth istemcisi birden fazla AS ile etkileşime girebiliyorsa, mix-up saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Örneğin, authorization server’ın 'iss' parametresini döndürmesi zorunlu kılınabilir ve bu parametrenin hem authorization yanıtında hem de token yanıtında doğrulanması gerekir.FalseTrue✓True✓V10.2.33OAuth istemcisinin authorization server’a yaptığı taleplerde yalnızca gerekli scope’ları (veya diğer yetkilendirme parametrelerini) talep ettiği doğrulanmalıdır.FalseFalseTrue✓V10.33OAuth Kaynak Sunucusu (RS)V10.3.11RS'nin yalnızca bu servisle kullanılmak üzere tasarlanmış access token’ları kabul ettiği doğrulanmalıdır (audience kontrolü). Audience bilgisi yapılandırılmış token’larda (örneğin JWT içindeki ‘aud’ claim’i) yer alabilir veya token introspection endpoint aracılığıyla kontrol edilebilir.FalseTrue✓True✓V10.3.22RS'nin, access token’dan gelen claim’lere dayanarak yetki devri tanımına uygun şekilde yetkilendirme kararları uyguladığı doğrulanmalıdır. ‘sub’, ‘scope’ ve ‘authorization_details’ gibi claim’ler varsa, bu kararın parçası olmalıdır.FalseTrue✓True✓V10.3.33Erişim kontrolü kararında, access token’dan (JWT veya ilgili token introspection yanıtı) benzersiz bir kullanıcının tanımlanması gerekiyorsa, RS'nin başka kullanıcılara devredilemeyecek claim’ler ile kullanıcıyı tanımladığı doğrulanmalıdır. Genellikle bu, ‘iss’ ve ‘sub’ claim’lerinin birlikte kullanılması anlamına gelir.FalseTrue✓True✓V10.3.44RS'nin belirli bir kimlik doğrulama gücü, yöntemi veya güncelliği (recentness) gerektirmesi durumunda, sunulan access token’ın bu kısıtlamaları karşıladığını doğruladığı, örneğin, OIDC ‘acr’, ‘amr’ ve ‘auth_time’ claim’leri kullanılarak doğrulanmalıdır. FalseTrue✓True✓V10.3.55RS'nin, (yetkisiz taraflarca) çalınmış veya tekrar edilen access token’ların kullanımını önlemek için sender-constrained access token’lar kullandığı doğrulanmalıdır. Bu, OAuth 2 için Mutual TLS veya OAuth 2 Demonstration of Proof of Possession (DPoP) ile sağlanabilir.FalseFalseTrue✓V10.44OAuth Yetkilendirme Sunucusu (AS)V10.4.11AS'nin, istemciye özel önceden kaydedilmiş URI’lerden oluşan bir allowlist kullanarak redirect URI’leri tam dize karşılaştırması ile doğruladığı doğrulanmalıdır.True✓True✓True✓V10.4.22AS'nin, "authorization response" içinde "authorization code" döndürdüğü durumlarda, bu kodun yalnızca bir kez kullanılabildiği doğrulanmalıdır. Daha önce access token vermek için kullanılmış bir authorization code ile yapılan ikinci geçerli token isteği reddedilmeli ve ilgili tüm token’lar iptal edilmelidir.True✓True✓True✓V10.4.33Authorization code’un kısa ömürlü olduğu doğrulanmalıdır. L1 ve L2 uygulamalar için maksimum yaşam süresi 10 dakika, L3 uygulamalar için 1 dakikadır.True✓True✓True✓V10.4.44Belirli bir istemci için AS'nin yalnızca o istemcinin ihtiyaç duyduğu grant türlerine izin verdiği doğrulanmalıdır. "Token" (Implicit flow) ve "password" (Resource Owner Password Credentials flow) grant türlerinin artık kullanılmaması gerekir.True✓True✓True✓V10.4.55AS'nin, açık istemciler için refresh token replay saldırılarını azalttığı doğrulanmalıdır. Tercihen sender-constrained refresh token’lar (DPoP veya mutual TLS ile certificate-bound access token’lar) kullanılmalıdır. L1 ve L2 uygulamalar için refresh token rotation kullanılabilir. Rotation kullanılıyorsa, AS refresh token’ı kullanım sonrası geçersiz kılmalı ve geçersiz bir refresh token sunulması durumunda o yetkilendirme ile ilişkili tüm refresh token’ları iptal etmelidir.True✓True✓True✓V10.4.66Code grant kullanılıyorsa, AS'nin authorization code interception saldırılarına karşı koruma sağladığı doğrulanmalıdır. Yetkilendirme isteğinde geçerli bir "code_challenge" değeri zorunlu olmalı ve "code_challenge_method" olarak "plain" kabul edilmemelidir. Token isteğinde ise "code_verifier" parametresi doğrulanmalıdır.FalseTrue✓True✓V10.4.77AS'nin, kimlik doğrulaması yapılmamış dinamik istemci kaydını desteklemesi durumunda, kötü niyetli istemci uygulamalarına karşı riskleri azalttığı doğrulanmalıdır. Kayıtlı URI’ler gibi client metadata’sı doğrulanmalı, kullanıcı onayı alınmalı ve güvenilmeyen bir client uygulamasıyla yapılan yetkilendirme isteği işlenmeden önce kullanıcı uyarılmalıdır.FalseTrue✓True✓V10.4.88Refresh token’ların, sliding expiration kullanılsa bile mutlak bir sona erme süresine sahip olduğu doğrulanmalıdır.FalseTrue✓True✓V10.4.99Yetkili bir kullanıcı tarafından AS kullanıcı arayüzü üzerinden refresh token’ların ve reference access token’ların iptal edilebildiği doğrulanmalıdır.FalseTrue✓True✓V10.4.1010Gizli istemcilerin token istekleri, pushed authorization request (PAR) ve token iptal istekleri gibi server’a yapılan backchannel isteklerinde kimliğinin kontrol edildiği doğrulanmalıdır.FalseTrue✓True✓V10.4.1111AS yapılandırmasının, OAuth istemcisine yalnızca gerekli scope’ları atadığı doğrulanmalıdır.FalseTrue✓True✓V10.4.1212Belirli bir client için, authorization server’ın yalnızca client’ın ihtiyaç duyduğu 'response_mode' değerine izin verdiği doğrulanmalıdır. Örneğin, bu değer ya beklenenlerle karşılaştırılarak doğrulanmalı ya da PAR veya JAR kullanılmalıdır.FalseFalseTrue✓V10.4.1313"Code" grant türünün daima pushed authorization request (PAR) ile birlikte kullanıldığı doğrulanmalıdır.FalseFalseTrue✓V10.4.1414AS'nin yalnızca sender-constrained (Proof-of-Possession) access token’lar ürettiği doğrulanmalıdır. Bu, mutual TLS ile certificate-bound access token ya da DPoP ile DPoP-bound access token olabilir.FalseFalseTrue✓V10.4.1515Sunucu taraflı istemciler için (kullanıcı cihazında çalışmayan), AS'nin "authorization_details" parametresinin istemci backend'i tarafından sağlandığını ve kullanıcı tarafından değiştirilmediğini doğruladığı, örneğin pushed authorization request (PAR) or JWT-secured Authorization Request (JAR) zorunlu kılınarak doğrulanmalıdır.FalseFalseTrue✓V10.4.1616Bir istemci gizli ise, AS'nin güçlü istemci kimlik doğrulama yöntemlerini zorunlu kıldığı doğrulanmalıdır. Bu yöntemler, public-key cryptography’ye dayalı ve replay saldırılarına karşı dayanıklı olmalı, örneğin mutual TLS ("tls_client_auth", "self_signed_tls_client_auth") veya private key JWT ("private_key_jwt") gibi.FalseFalseTrue✓V10.55OIDC İstemcisiV10.5.11İstemcinin (relying party olarak) ID Token replay saldırılarını azalttığı doğrulanmalıdır. Örneğin, ID Token’daki 'nonce' claim’inin, OpenID Provider’a gönderilen kimlik doğrulama isteğindeki 'nonce' değeriyle eşleştiği doğrulanmalıdır.FalseTrue✓True✓V10.5.22İstemcinin kullanıcıyı ID Token claim’lerinden (genellikle, başka kullanıcılarla yeniden atanamayan 'sub' claim’i) benzersiz şekilde tanımladığı doğrulanmalıdır.FalseTrue✓True✓V10.5.33İstemcinin, kötü niyetli bir AS'nin başka bir AS'yi taklit etmesini AS metadata’sı üzerinden reddettiği doğrulanmalıdır. AS metadata’sındaki issuer URL’si, istemci tarafından beklenen önceden yapılandırılmış issuer URL’siyle tam olarak eşleşmiyorsa, metadata reddedilmelidir.FalseTrue✓True✓V10.5.44İstemcinin, ID Token’ın kendisi için (audience) kullanılması amaçlandığını doğruladığı doğrulanmalıdır. Bu, token’daki 'aud' claim’inin istemcinin 'client_id' değeriyle eşit olup olmadığının kontrol edilmesiyle yapılır.FalseTrue✓True✓V10.5.55OIDC back-channel logout kullanıldığında, relying party’nin "forced logout" ve "logout" akışında "cross-JWT confusion" gibi saldırılara karşı koruma sağladığı doğrulanmalıdır. Client, logout token’ın 'logout+jwt' türünde olduğunu, 'event' claim’inin doğru üyeye sahip olduğunu ve 'nonce' claim’i içermediğini doğrulamalıdır. Ayrıca token için kısa bir sona erme süresi (örneğin 2 dakika) önerilir.FalseTrue✓True✓V10.66OpenID ProviderV10.6.11OpenID Provider’ın yalnızca 'code', 'ciba', 'id_token' veya 'id_token code' response mode değerlerine izin verdiği doğrulanmalıdır. 'code' değeri, 'id_token code' (OIDC Hybrid flow) yerine tercih edilmelidir. 'token' (Implicit flow) kullanılmamalıdır.FalseTrue✓True✓V10.6.22OpenID Provider’ın forced logout yoluyla yapılan hizmet reddi saldırılarını önlediği doğrulanmalıdır. Bu, son kullanıcıdan açık onay alınarak veya varsa logout isteğinde (relying party tarafından başlatılan) bulunan parametrelerin, örneğin 'id_token_hint', doğrulanmasıyla yapılabilir.FalseTrue✓True✓V10.77Onay (Consent) YönetimiV10.7.11AS'nin her yetkilendirme isteği için kullanıcının onayını aldığı doğrulanmalıdır. İstemcinin kimliği garanti altına alınamıyorsa, AS daima kullanıcıdan açıkça onay istemelidir.FalseTrue✓True✓V10.7.22AS'nin kullanıcıdan onay istediğinde, neye onay verildiğini açık ve yeterli şekilde gösterdiği doğrulanmalıdır. Uygun olduğunda bu bilgiler, istenen yetkilendirmelerin doğasını (genellikle scope, resource server, RAR gibi detaylara dayalı), yetkilendirilmiş uygulamanın kimliğini ve bu yetkilendirmelerin süresini içermelidir.FalseTrue✓True✓V10.7.33Kullanıcının, AS üzerinden verdiği onayları görüntüleyebildiği, değiştirebildiği ve iptal edebildiği doğrulanmalıdır.FalseTrue✓True✓V1111CryptographyKriptografiV11.11Kriptografik Envanter ve DokümantasyonV11.1.11Kriptografik anahtarların yönetimi için belgelenmiş bir politika ve NIST SP 800-57 gibi bir anahtar yönetim standardını izleyen bir kriptografik anahtar yaşam döngüsü tanımlandığı doğrulanmalıdır. Bu, anahtarların aşırı miktarda paylaşılmadığını (örneğin, paylaşılan sırlar için ikiden fazla tarafla veya özel anahtarlar için birden fazla tarafla) garanti altına almalıdır.FalseTrue✓True✓V11.1.22Tüm kriptografik anahtarlar, algoritmalar ve uygulama tarafından kullanılan sertifikaları içeren bir kriptografik envanterin oluşturulduğu, sürdürüldüğü ve düzenli olarak güncellendiği doğrulanmalıdır. Bu envanter ayrıca, sistemde anahtarların nerede kullanılabileceğini ve kullanılamayacağını, ve hangi veri türlerinin bu anahtarlarla korunup korunamayacağını da belgelemelidir.FalseTrue✓True✓V11.1.33Sistem içerisinde şifreleme, özetleme ve imzalama işlemleri dahil olmak üzere kriptografi kullanımının tüm örneklerini tespit etmek için kriptografik keşif mekanizmalarının kullanıldığı doğrulanmalıdır.FalseFalseTrue✓V11.1.44Kriptografik bir envanterin sürdürüldüğü doğrulanmalıdır. Bu envanter, gelecekteki tehditlere karşı tepki verebilmek amacıyla post-kuantum kriptografiye geçiş yolunu belirten belgelenmiş bir plan içermelidir.FalseFalseTrue✓V11.22Güvenli Kriptografi UygulamasıV11.2.11Kriptografik işlemler için sektör tarafından doğrulanmış uygulamaların (kütüphaneler ve donanım hızlandırmalı uygulamalar dahil) kullanıldığı doğrulanmalıdır.FalseTrue✓True✓V11.2.22Uygulamanın, rastgele sayı üreticileri, kimliği doğrulanmış şifreleme, MAC veya özetleme algoritmaları, anahtar uzunlukları, turlar, şifreler ve modların herhangi bir zamanda yeniden yapılandırılabilir, yükseltilebilir veya değiştirilebilir olacağı şekilde kripto çevikliği (crypto agility) ile tasarlandığı doğrulanmalıdır. Aynı şekilde, anahtarların ve parolaların değiştirilebilmesi ve verilerin yeniden şifrelenebilmesi mümkün olmalıdır. Bu, onaylanmış PQC şemalarının yüksek güvenlikli uygulamaları yaygın olarak kullanılabilir hale geldiğinde sorunsuz geçişe olanak tanır.FalseTrue✓True✓V11.2.33Tüm kriptografik ilkeliklerin, algoritma, anahtar boyutu ve yapılandırmaya göre minimum 128 bit güvenlik sağladığı doğrulanmalıdır. Örneğin, 256-bit ECC anahtarı yaklaşık 128 bit güvenlik sağlarken, RSA için aynı güvenliği elde etmek 3072-bit anahtar gerektirir.FalseTrue✓True✓V11.2.44Tüm kriptografik işlemlerin sabit süreli (constant-time) olduğu, karşılaştırmalarda, hesaplamalarda veya geri dönüşlerde kısa devre (short-circuit) işlemleri yapılmadığı doğrulanmalıdır; bu, bilgi sızıntısını önlemek için gereklidir.FalseFalseTrue✓V11.2.55Tüm kriptografik modüllerin güvenli şekilde hata verdiği ve hataların, padding oracle saldırıları gibi zafiyetleri mümkün kılmayacak şekilde ele alındığı doğrulanmalıdır.FalseFalseTrue✓V11.33Şifreleme AlgoritmalarıV11.3.11Güvensiz blok modlarının (örneğin, ECB) ve zayıf doldurma (padding) şemalarının (örneğin, PKCS#1 v1.5) kullanılmadığı doğrulanmalıdır.True✓True✓True✓V11.3.22Yalnızca AES ile GCM gibi onaylı şifreleme algoritmalarının ve modlarının kullanıldığı doğrulanmalıdır.True✓True✓True✓V11.3.33Şifrelenmiş verilerin yetkisiz değişikliklere karşı korunduğu doğrulanmalıdır. Tercihen bu koruma, onaylı bir kimliği doğrulanmış şifreleme yöntemi kullanılarak ya da onaylı bir şifreleme yöntemi ile onaylı bir MAC algoritmasının kombinasyonu ile sağlanmalıdır.FalseTrue✓True✓V11.3.44Sayılar, başlatma vektörleri (IV) ve diğer tek kullanımlık değerlerin, aynı şifreleme anahtarı ve veri öğesi çifti için birden fazla kez kullanılmadığı doğrulanmalıdır. Oluşturma yöntemi kullanılan algoritmaya uygun olmalıdır.FalseFalseTrue✓V11.3.55Şifreleme algoritması ve MAC algoritması kombinasyonlarının "encrypt-then-MAC" modunda çalıştığı doğrulanmalıdır.FalseFalseTrue✓V11.44Hashing ve Hash Tabanlı FonksiyonlarV11.4.11Dijital imzalar, HMAC, KDF ve rastgele bit üretimi gibi genel kriptografik kullanım senaryolarında yalnızca onaylı hash fonksiyonlarının kullanıldığı doğrulanmalıdır. MD5 gibi yasaklı hash fonksiyonları hiçbir kriptografik amaçla kullanılmamalıdır.True✓True✓True✓V11.4.22Parolaların, onaylı, hesaplama açısından yoğun ve mevcut rehberliğe göre yapılandırılmış bir anahtar türetme fonksiyonu (diğer adıyla parola hash'leme fonksiyonu) kullanılarak saklandığı doğrulanmalıdır. Ayarlar, güvenlik ve performans dengesini sağlayarak kaba kuvvet saldırılarını zorlaştırmalıdır.FalseTrue✓True✓V11.4.33Dijital imzalarda kullanılan hash fonksiyonlarının, veri bütünlüğü ve kimlik doğrulama amacıyla kullanıldığında çakışmaya karşı dayanıklı ve yeterli bit uzunluğuna sahip olduğu doğrulanmalıdır. Çakışma dayanıklılığı gerekiyorsa çıktı uzunluğu en az 256 bit olmalıdır. Sadece ikinci ön-görüntü (2nd pre-iamge) saldırılarına karşı dayanıklılık gerekiyorsa çıktı uzunluğu en az 128 bit olmalıdır.FalseTrue✓True✓V11.4.44Parolalardan gizli anahtarlar türetilirken, onaylı anahtar türetme fonksiyonlarının anahtar uzatma (key stretching) parametreleriyle birlikte kullanıldığı doğrulanmalıdır. Bu parametreler, kaba kuvvet saldırılarını önleyecek şekilde güvenlik ve performans dengesine sahip olmalıdır.FalseTrue✓True✓V11.55Rastgele DeğerlerV11.5.11Tahmin edilemez olması amaçlanan tüm rastgele sayıların ve dizelerin, CSPRNG ile oluşturulduğu ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. UUID'lerin bu koşulu dikkate almadığını unutmayın.FalseTrue✓True✓V11.5.22Kullanılan rastgele sayı üretim mekanizmasının, yoğun talep altında dahi güvenli çalışacak şekilde tasarlandığı doğrulanmalıdır.FalseFalseTrue✓V11.66Açık Anahtar (Public Key) KriptografisiV11.6.11Anahtar üretimi, tohumlama (seeding) ve dijital imza üretimi ve doğrulama için yalnızca onaylı kriptografik algoritmalar ve çalışma modlarının kullanıldığı doğrulanmalıdır. Anahtar üretim algoritmaları, bilinen saldırılara karşı savunmasız anahtarlar üretmemelidir. Örneğin, Fermat çarpanlama yöntemine karşı savunmasız RSA anahtarları oluşturulmamalıdır.FalseTrue✓True✓V11.6.22Anahtar değişimi için yalnızca onaylı kriptografik algoritmaların kullanıldığı doğrulanmalıdır (örneğin Diffie-Hellman). Kullanılan parametrelerin güvenli olması gerektiğine dikkat edilmelidir. Bu, anahtar kurulum sürecine yönelik saldırıları önleyecek ve araya girme (adversary-in-the-middle) ya da kriptografik kırılmaları engelleyecektir.FalseFalseTrue✓V11.77Kullanım Halindeki Verilerin KriptografisiV11.7.11Hassas verilerin kullanım sırasında korunmasını sağlamak amacıyla, yetkisiz kullanıcıların veya süreçlerin bu verilere erişmesini engelleyen tam bellek şifrelemesinin kullanıldığı doğrulanmalıdır.FalseFalseTrue✓V11.7.22Veri asgariyetinin sağlandığı, yani işleme sırasında mümkün olan en az miktarda verinin ortaya çıktığı ve verilerin kullanımdan hemen sonra veya mümkün olan en kısa sürede şifrelendiği doğrulanmalıdır.FalseFalseTrue✓V1212SecureGüvenli İletişimV12.11Genel TLS Güvenlik RehberiV12.1.11Yalnızca TLS protokolünün en güncel ve önerilen sürümlerinin (örneğin TLS 1.2 ve TLS 1.3) etkinleştirildiği ve en son sürümün varsayılan olarak tercih edildiği doğrulanmalıdır.True✓True✓True✓V12.1.22Yalnızca önerilen şifre takımlarının (cipher suite) etkinleştirildiği ve en güçlü şifre takımlarının tercih edildiği doğrulanmalıdır. Seviye 3 (L3) uygulamalar yalnızca ileri gizlilik (forward secrecy) sağlayan şifre takımlarını desteklemelidir.FalseTrue✓True✓V12.1.33Uygulamanın, mTLS istemci sertifikalarını kimlik doğrulama veya yetkilendirme amacıyla kullanmadan önce bu sertifikaların güvendiği sertifikalar arasında olduğunu doğruladığı kontrol edilmelidir.FalseTrue✓True✓V12.1.44Online Certificate Status Protocol (OCSP) Stapling gibi geçerli bir sertifika iptal kontrolü yönteminin etkinleştirildiği ve yapılandırıldığı doğrulanmalıdır.FalseFalseTrue✓V12.1.55TLS el sıkışma (handshake) sürecinde Server Name Indication (SNI) gibi hassas meta verilerin ifşa edilmesini önlemek için, uygulamanın TLS yapılandırmasında Encrypted Client Hello (ECH) özelliğinin etkinleştirildiği doğrulanmalıdır.FalseFalseTrue✓V12.22Dışa Açık Hizmetlerle HTTPS İletişimiV12.2.11İstemci ile dışa açık, HTTP tabanlı hizmetler arasındaki tüm bağlantılarda TLS kullanıldığı ve bu bağlantıların güvensiz ya da şifrelenmemiş iletişime geri dönmediği doğrulanmalıdır.True✓True✓True✓V12.2.22Dışa açık hizmetlerin herkese açık olarak güvenilen TLS sertifikaları kullandığı doğrulanmalıdır.True✓True✓True✓V12.33Genel Servisler Arası İletişim GüvenliğiV12.3.11Uygulamaya gelen ve uygulamadan çıkan tüm bağlantılarda izleme sistemleri, yönetim araçları, uzaktan erişim ve SSH, ara yazılımlar, veritabanları, ana sistemler (mainframe), iş ortağı sistemleri ya da dış API'ler dahil olmak üzere TLS gibi şifreli bir protokolün kullanıldığı ve güvensiz ya da şifrelenmemiş protokollere geri dönülmediği doğrulanmalıdır.FalseTrue✓True✓V12.3.22TLS istemcilerinin bir TLS sunucusu ile iletişime geçmeden önce alınan sertifikaları doğruladığı kontrol edilmelidir.FalseTrue✓True✓V12.3.33Uygulama içindeki HTTP tabanlı iç hizmetler arasında gerçekleşen tüm bağlantılarda TLS ya da uygun başka bir aktarım şifreleme mekanizmasının kullanıldığı ve güvensiz ya da şifrelenmemiş iletişime geri dönülmediği doğrulanmalıdır.FalseTrue✓True✓V12.3.44İç hizmetler arasındaki TLS bağlantılarında güvenilir sertifikaların kullanıldığı doğrulanmalıdır. İç sistemlerde oluşturulmuş ya da kendinden imzalı (self-signed) sertifikalar kullanılıyorsa, bu sertifikalara güvenen hizmetlerin yalnızca belirli dahili sertifika otoritelerine (CA) ve belirli kendinden imzalı sertifikalara güvenecek şekilde yapılandırıldıkları doğrulanmalıdır.FalseTrue✓True✓V12.3.55Sistem içindeki hizmetlerin birbiriyle iletişim kurarken her bir uç noktanın kimliğini doğrulamak için güçlü kimlik doğrulama yöntemlerinin kullanıldığı doğrulanmalıdır. Bu yöntemler arasında, açık anahtar altyapısı (public-key infrastructure) kullanan ve tekrar oynatma saldırılarına karşı dayanıklı olan TLS istemci kimlik doğrulaması gibi yöntemler yer almalıdır. Mikroservis mimarilerinde, sertifika yönetimini basitleştirmek ve güvenliği artırmak amacıyla bir servis ağı (service mesh) kullanılması değerlendirilmelidir.FalseFalseTrue✓V1313ConfigurationKonfigürasyonV13.11Konfigürasyon DokümantasyonuV13.1.11Uygulamanın tüm iletişim ihtiyaçlarının dokümante edildiği doğrulanmalıdır. Buna, uygulamanın bağımlı olduğu dış hizmetler ve son kullanıcının uygulamanın bağlantı kurmasını sağlayabileceği dış konumlar da dahil olmalıdır.FalseTrue✓True✓V13.1.22Uygulamanın kullandığı her bir hizmet için, dokümantasyonda eşzamanlı bağlantı sayısı (örn. bağlantı havuzu limitleri) ve bu sınır aşıldığında uygulamanın davranışı, geri dönüş veya kurtarma mekanizmaları da dahil olmak üzere hizmet reddi koşullarını önlemek için tanımlandığı doğrulanmalıdır.FalseFalseTrue✓V13.1.33Uygulamanın, kullandığı her bir dış sistem veya hizmet (örn. veritabanları, dosya tanıtıcıları, iş parçacıkları, HTTP bağlantıları) için kaynak yönetimi stratejilerini tanımladığı doğrulanmalıdır. Bu stratejiler, kaynak serbest bırakma prosedürlerini, zaman aşımı ayarlarını, hata durumlarını ve tekrar deneme mantığı uygulanmışsa sınırları, gecikmeleri ve geri çekilme (back-off) algoritmalarını içermelidir. Senkron HTTP istek–yanıt işlemleri için kısa zaman aşımı süreleri zorunlu tutulmalı ve tekrar eden denemeler devre dışı bırakılmalı ya da sıkı şekilde sınırlandırılmalıdır.FalseFalseTrue✓V13.1.44Uygulamanın, güvenlik açısından kritik olan gizli verileri tanımladığı ve kuruluşun tehdit modeli ve iş ihtiyaçlarına göre bu verilerin döndürülme (rotation) zamanlamasının belgelendiği doğrulanmalıdır.FalseFalseTrue✓V13.22Backend İletişim KonfigürasyonuV13.2.11Uygulamanın, standart kullanıcı oturum mekanizmasını desteklemeyen backend bileşenleri (örneğin API'ler, ara katmanlar, veri katmanları) arasında gerçekleşen iletişimlerin kimlik doğrulamasıyla korunduğu doğrulanmalıdır. Kimlik doğrulama; bireysel hizmet hesapları, kısa ömürlü token'lar ya da sertifika tabanlı kimlik doğrulama ile yapılmalıdır ve parola, API anahtarı ya da ayrıcalıklı erişime sahip paylaşımlı hesaplar gibi sabit kimlik bilgileri kullanılmamalıdır.FalseTrue✓True✓V13.2.22Uygulamanın backend bileşenleri arasında (yerel hizmetler, işletim sistemi hizmetleri, API'ler, ara katmanlar ve veri katmanları dahil) gerçekleştirilen iletişimlerin, yalnızca gerekli en az ayrıcalığa sahip hesaplarla yapıldığı doğrulanmalıdır.FalseTrue✓True✓V13.2.33Bir hizmet kimlik doğrulaması için bir kimlik bilgisi kullanılması gerekiyorsa, bu kimlik bilgisinin varsayılan bir değer (örneğin root/root veya admin/admin) olmadığının doğrulanması gereklidir.FalseTrue✓True✓V13.2.44Uygulamanın iletişim kurmasına izin verilen dış kaynaklar ya da sistemlerin, bir allowlist (izinli liste) ile tanımlandığı doğrulanmalıdır. Bu liste, uygulama katmanında, web sunucusunda, güvenlik duvarında veya farklı katmanların birleşiminde uygulanabilir.FalseTrue✓True✓V13.2.55Web veya uygulama sunucusunun, dış sistemlere veri veya dosya gönderimi veya yüklemesi yaparken sadece belirli kaynaklara izin verecek şekilde allowlist ile yapılandırıldığı doğrulanmalıdır.FalseTrue✓True✓V13.2.66Uygulamanın farklı hizmetlere bağlantı kurduğu durumlarda, bu bağlantılar için belgelenmiş yapılandırmaları (örn. maksimum eşzamanlı bağlantı, bağlantı limiti aşıldığında davranış, zaman aşımı, tekrar deneme stratejileri) takip ettiğinin doğrulanması gereklidir.FalseFalseTrue✓V13.33Gizli Bilgi YönetimiV13.3.11Parolalar, anahtar materyalleri, veritabanı ve üçüncü parti sistemlerle entegrasyon bilgileri, zaman tabanlı token'lar için tohum (seed) bilgileri, dahili gizli veriler ve API anahtarları gibi backend sırlarının güvenli bir şekilde oluşturulması, saklanması, erişim denetiminin sağlanması ve imha edilmesi için bir gizli bilgi yönetim çözümünün (örneğin key vault) kullanıldığı doğrulanmalıdır. Bu gizli bilgiler uygulama kaynak koduna dahil edilmemeli ve yapı çıktılarında yer almamalıdır. Seviye 3 uygulamalar için donanım destekli bir çözüm (örneğin HSM) gereklidir.FalseTrue✓True✓V13.3.22Gizli bilgilere erişimin en az ayrıcalık prensibine uygun şekilde yapılandırıldığı doğrulanmalıdır.FalseTrue✓True✓V13.3.33Tüm kriptografik işlemlerin, anahtar materyallerinin güvenli bir şekilde yönetilmesi ve dışarıya sızmasının engellenmesi amacıyla, izole edilmiş bir güvenlik modülü (örneğin vault ya da donanım güvenlik modülü) aracılığıyla gerçekleştirildiği doğrulanmalıdır.FalseFalseTrue✓V13.3.44Uygulamanın belgelerinde belirtildiği şekilde gizli bilgilerin süresinin dolacak şekilde yapılandırıldığı ve düzenli olarak döndürüldüğü doğrulanmalıdır.FalseFalseTrue✓V13.44İstenmeyen Bilgi SızıntısıV13.4.11Uygulamanın .git veya .svn klasörleri gibi kaynak kontrolüyle ilgili metadata içermeyecek şekilde deploy edildiğini ya da bu klasörlerin hem dış erişime hem de uygulama erişimine kapalı olduğu doğrulanmalıdır.True✓True✓True✓V13.4.22Tüm bileşenler için üretim ortamlarında hata ayıklama (debug) modlarının devre dışı bırakıldığı doğrulanmalıdır.FalseTrue✓True✓V13.4.33Web sunucularının, açık şekilde istenmediği sürece dizin listelemesi (directory listing) özelliğini istemcilere sunmadığı doğrulanmalıdır.FalseTrue✓True✓V13.4.44HTTP TRACE metodunun üretim ortamlarında desteklenmediği, böylece potansiyel bilgi sızıntılarının önlendiği doğrulanmalıdır.FalseTrue✓True✓V13.4.55Belgeler (örneğin dahili API belgeleri) ve izleme uç noktalarının (monitoring endpoints) yalnızca açıkça belirtildiği durumlarda erişilebilir olduğu doğrulanmalıdır.FalseTrue✓True✓V13.4.66Uygulamanın arka uç bileşenlerinin ayrıntılı sürüm bilgilerini ifşa etmediği doğrulanmalıdır.FalseFalseTrue✓V13.4.77Web katmanının yalnızca belirli dosya uzantılarına sahip dosyaları sunacak şekilde yapılandırıldığı, bu sayede istem dışı bilgi, yapılandırma ya da kaynak kod sızıntılarının önlendiği doğrulanmalıdır.FalseFalseTrue✓V1414DataVeri KorumaV14.11Veri Koruma DokümantasyonuV14.1.11Uygulama tarafından oluşturulan ve işlenen tüm hassas verilerin tanımlanıp, koruma seviyelerine göre sınıflandırıldığından emin olun. Bu, yalnızca kodlanmış (örneğin Base64 stringleri ya da JWT içindeki düz metin yükler gibi) ve bu nedenle kolayca çözülebilir verileri de içermelidir. Koruma seviyeleri, uygulamanın uymakla yükümlü olduğu veri koruma ve gizlilik düzenlemeleri ile standartlarını dikkate almalıdır.FalseTrue✓True✓V14.1.22Tüm hassas veri koruma seviyeleri için belgelenmiş bir koruma gereksinimleri seti tanımlandığından emin olun. Bu gereksinimler genel şifreleme, bütünlük doğrulama, saklama süresi, verinin nasıl günlüğe kaydedileceği, günlüklerdeki hassas verilere erişim kontrolleri, veritabanı düzeyinde şifreleme, gizlilik ve gizliliği artırıcı teknolojiler ile diğer gizlilik gereksinimlerini kapsamalıdır.FalseTrue✓True✓V14.22Genel Veri KorumasıV14.2.11Hassas verilerin yalnızca HTTP message body veya header alanlarında sunucuya gönderildiği ve URL ile sorgu parametrelerinin, API anahtarı veya session token’ı gibi hassas bilgiler içermediği doğrulanmalıdır.True✓True✓True✓V14.2.22Hassas verilerin, yük dengeleyiciler ve uygulama önbellekleri gibi sunucu bileşenlerinde önbelleğe alınmasının engellendiği veya kullanım sonrası bu verilerin güvenli biçimde temizlendiği doğrulanmalıdır.FalseTrue✓True✓V14.2.33Uygulama kontrolü dışında veri toplanmasını engellemek için, tanımlanmış hassas verilerin, kullanıcı izleyicileri gibi güvensiz taraflara gönderilmediği doğrulanmalıdır.FalseTrue✓True✓V14.2.44Hassas verilere yönelik şifreleme, bütünlük doğrulama, veri saklama, loglama yöntemi, loglardaki erişim kontrolleri, gizlilik teknolojileri gibi kontrollerin, söz konusu verinin belgelenmiş koruma seviyesinde tanımlandığı şekilde uygulandığı doğrulanmalıdır.FalseTrue✓True✓V14.2.55Önbellekleme mekanizmalarının yalnızca belirli içerik türüne sahip yanıtları önbelleğe alacak şekilde yapılandırıldığı ve hassas, dinamik içeriklerin önbelleğe alınmadığı doğrulanmalıdır. Web sunucusu, mevcut olmayan bir dosya talebinde geçerli ama farklı bir dosya döndürmek yerine 404 veya 302 cevabı vermelidir. Bu, Web Cache Deception saldırılarını önlemeye yardımcı olur.FalseFalseTrue✓V14.2.66Uygulamanın yalnızca işlevsellik için gerekli olan asgari hassas veriyi döndürdüğü doğrulanmalıdır. Örneğin, kredi kartı numarasının yalnızca bazı rakamlarının döndürülmesi; tam numaranın döndürülmesi gerekiyorsa, kullanıcı arayüzünde gizlenmiş (maskelenmiş) şekilde sunulması gerekir, aksi kullanıcı özel olarak görüntülemek istemedikçe gösterilmemelidir.FalseFalseTrue✓V14.2.77Hassas bilgilerin, veri saklama sınıflandırmasına tabi tutulduğu, geçerliliğini yitirmiş veya artık gerekli olmayan verilerin belirlenmiş bir zaman çizelgesiyle ya da gerektiğinde otomatik olarak silindiği doğrulanmalıdır.FalseFalseTrue✓V14.2.88Kullanıcı tarafından yüklenen dosyaların meta verilerinden hassas bilgilerin çıkarıldığı veya bu bilgilerin yalnızca kullanıcıdan açık onay alındığında saklandığı doğrulanmalıdır.FalseFalseTrue✓V14.33İstemci Tarafı Veri KorumasıV14.3.11Kimliği doğrulanmış verilerin, istemci veya oturum sonlandığında istemci depolamasından (örneğin tarayıcı DOM’undan) temizlendiği doğrulanmalıdır. 'Clear-Site-Data' HTTP response header bu konuda yardımcı olabilir ancak istemci tarafı, sunucu bağlantısı mevcut olmadığında da temizlik işlemini yapabiliyor olmalıdır.True✓True✓True✓V14.3.22Uygulamanın, tarayıcılarda hassas verilerin önbelleğe alınmasını önlemek amacıyla yeterli anti-önbellekleme HTTP response header (örneğin Cache-Control: no-store) ayarladığı doğrulanmalıdır.FalseTrue✓True✓V14.3.33Tarayıcıda depolanan verilerin (örneğin localStorage, sessionStorage, IndexedDB veya çerezler) hassas veri içermediği, yalnızca session token’larının istisna olarak kabul edildiği doğrulanmalıdır.FalseTrue✓True✓V1515SecureGüvenli Kodlama ve MimariV15.11Güvenli Kodlama ve Mimari DokümantasyonuV15.1.11Güvenlik açığı içeren üçüncü taraf bileşen sürümleri ve genel olarak kütüphane güncellemeleri için, uygulama dokümantasyonunda risk bazlı düzeltme zamanlarının tanımlandığı doğrulanmalıdır.True✓True✓True✓V15.1.22Yazılım bileşen listesi (Software Bill of Materials - SBOM) gibi bir envanterin tutulduğu, kullanılan tüm üçüncü taraf kütüphanelerin önceden tanımlanmış, güvenilir ve düzenli olarak güncellenen depolardan alındığı doğrulanmalıdır.FalseTrue✓True✓V15.1.33Uygulama dokümantasyonunda zaman veya kaynak açısından yoğun işlevlerin tanımlandığı, bu işlevlerin aşırı kullanımı durumunda kullanılabilirlik kaybının nasıl önleneceği ve yanıt oluşturma süresinin istemci zaman aşımını aşmaması için hangi önlemlerin alındığı belirtilmelidir. Örnek savunmalar kuyruklama, eşzamansız işleme, kullanıcı başına ve uygulama genelinde paralel işlem sınırlarını içerebilir.FalseTrue✓True✓V15.1.44Uygulama dokümantasyonunda "riskli bileşenler" olarak değerlendirilen üçüncü taraf kütüphanelerin vurgulandığı doğrulanmalıdır.FalseFalseTrue✓V15.1.55Uygulama dokümantasyonunda "tehlikeli işlevsellik" içeren uygulama bölümlerinin açıkça belirtildiği doğrulanmalıdır.FalseFalseTrue✓V15.22Güvenlik Mimarisi ve BağımlılıklarV15.2.11Uygulamanın yalnızca, belgelenmiş güncelleme ve düzeltme sürelerini aşmamış bileşenleri içerdiği doğrulanmalıdır.True✓True✓True✓V15.2.22Uygulamanın, belgelenmiş güvenlik kararları ve stratejilere dayanarak, zaman veya kaynak açısından yoğun işlevlerin neden olabileceği kullanılabilirlik kaybına karşı savunmalar uyguladığı doğrulanmalıdır.FalseTrue✓True✓V15.2.33Üretim ortamının yalnızca uygulamanın çalışması için gerekli işlevleri içerdiği ve test kodları, örnek kod parçaları veya geliştirme işlevleri gibi gereksiz işlevsellikleri açığa çıkarmadığı doğrulanmalıdır.FalseTrue✓True✓V15.2.44Üçüncü taraf bileşenlerin ve bunların tüm transitif bağımlılıklarının beklenen depolardan (iç kaynaklı ya da harici) alındığı ve bağımlılık karışıklığı (dependency confusion) saldırılarına açık olmadığı doğrulanmalıdır.FalseFalseTrue✓V15.2.55Uygulamanın, “tehlikeli işlevsellik” içeren veya “riskli bileşenler” kullanan bölümlerine ek korumalar uyguladığı doğrulanmalıdır. Bu korumalar sandbox, kapsülleme, konteynerleştirme veya ağ düzeyinde izolasyon gibi teknikler aracılığıyla, bir uygulama bölümünün ele geçirilmesi durumunda saldırganın diğer bölümlere sıçramasını geciktirmeyi veya engellemeyi amaçlamalıdır.FalseFalseTrue✓V15.33Savunmacı KodlamaV15.3.11Uygulamanın yalnızca gerekli alanların bir alt kümesini veri nesnesinden döndürdüğü doğrulanmalıdır. Örneğin, bazı alanlara kullanıcıların erişmemesi gerektiğinden tüm veri nesnesi döndürülmemelidir.True✓True✓True✓V15.3.22Uygulama backend'i harici URL’lere çağrı yaptığında, yalnızca amaçlanan işlevsellik söz konusuysa yönlendirmeleri takip edecek şekilde yapılandırıldığının doğrulanması gerekir.FalseTrue✓True✓V15.3.33Uygulamanın, kitlesel atama saldırılarına karşı, her bir controller ve eylem için izin verilen alanları sınırlandırarak savunmalar sağladığı doğrulanmalıdır. Örneğin, bir alan değeri, bu işlemde değiştirilmesi amaçlanmadıysa eklenememeli veya güncellenememelidir.FalseTrue✓True✓V15.3.44Tüm proxy ve ara katman bileşenlerinin kullanıcının orijinal IP adresini, uç kullanıcı tarafından değiştirilemeyecek güvenilir veri alanları kullanarak doğru şekilde ilettiği ve uygulamanın ve web sunucusunun bu doğru değeri, loglama ve hız sınırlama gibi güvenlik kararları için kullandığı doğrulanmalıdır. Ayrıca, orijinal IP adresinin bile dinamik IP'ler, VPN'ler veya kurumsal güvenlik duvarları nedeniyle güvenilir olmayabileceği dikkate alınmalıdır.FalseTrue✓True✓V15.3.55Uygulamanın değişkenlerin doğru türde olduğunu açıkça doğruladığı ve sıkı eşitlik ve karşılaştırma işlemleri kullandığı doğrulanmalıdır. Bu, değişken türüyle ilgili varsayımlardan kaynaklanan tür oynama (type juggling) veya tür karışıklığı (type confusion) güvenlik açıklarını önlemek içindir.FalseTrue✓True✓V15.3.66JavaScript kodunun prototip zehirleme (prototype pollution) saldırılarını önleyecek şekilde yazıldığı, örneğin, nesne literal’leri yerine Set() veya Map() gibi yapılar kullanıldığı doğrulanmalıdır.FalseTrue✓True✓V15.3.77Uygulamanın, özellikle framework'ün istek parametrelerinin kaynağı (sorgu dizgisi, gövde parametreleri, çerezler veya başlık alanları) arasında ayrım yapmadığı durumlarda, HTTP parametre kirliliği (HTTP parameter pollution) saldırılarına karşı savunmalar uyguladığı doğrulanmalıdır.FalseTrue✓True✓V15.44Güvenli Eş Zamanlılık (Concurrency)V15.4.11Çok iş parçacıklı kodda (örneğin cache'ler, dosyalar veya birden fazla iş parçacığı tarafından erişilen bellek içi nesneler gibi) paylaşılan nesnelere yalnızca thread-safe (iş parçacığı güvenli) türler ve kilitleme (lock) veya semaphore gibi senkronizasyon mekanizmaları kullanılarak erişildiği doğrulanmalıdır. Bu, yarış durumlarını ve veri bozulmasını önlemeye yöneliktir.FalseFalseTrue✓V15.4.22Bir kaynağın durumu üzerindeki kontroller (örneğin varlığı ya da izinleri gibi) ile bu kontrole bağlı eylemlerin tek bir atomik işlem olarak gerçekleştirildiği doğrulanmalıdır. Bu, TOCTOU (time-of-check to time-of-use) yarış durumlarını önlemeye yöneliktir. Bir dosyanın varlığının kontrol edilip ardından açılması veya bir kullanıcının erişiminin doğrulanıp ardından yetki verilmesi gibi işlemler buna örnektir.FalseFalseTrue✓V15.4.33Kilitlerin (locks) tutarlı biçimde kullanıldığı, iş parçacıklarının birbirini beklemesi ya da sonsuz döngüye girmesi (deadlock veya livelock) gibi durumların önlendiği doğrulanmalıdır. Ayrıca, kilitleme mantığı, kaynağı yöneten kod içinde kalmalı ve dış sınıflar veya dış kodlar tarafından istemeden veya kötü niyetli şekilde değiştirilememelidir.FalseFalseTrue✓V15.4.44Kaynak tahsis politikalarının, iş parçacığı açlığını önleyecek şekilde, kaynaklara adil erişimi sağladığı doğrulanmalıdır. Örneğin, thread pool (iş parçacığı havuzu) kullanımı, düşük öncelikli iş parçacıklarının da makul sürelerde çalışabilmesi için uygulanmalıdır.FalseFalseTrue✓V1616SecurityGüvenlik Günlüklemesi (Logging) ve Hata YönetimiV16.11Güvenlik Loglaması DokümantasyonuV16.1.11Uygulamanın teknoloji yığını boyunca her katmanda hangi olayların loglandığını, log formatlarını, logların nereye yazıldığını, nasıl kullanıldığını, erişimin nasıl kontrol edildiğini ve logların ne kadar süre saklandığını belgeleyen bir envanterin mevcut olduğu doğrulanmalıdır.FalseTrue✓True✓V16.22Genel LoglamaV16.2.11Her bir log girdisinin, olayın ne zaman, nerede, kim tarafından ve ne olduğuna dair detaylı bir zaman çizelgesi oluşturulmasına olanak tanıyacak gerekli meta verileri içerdiği doğrulanmalıdır.FalseTrue✓True✓V16.2.22Tüm loglama bileşenlerinin zaman kaynaklarının senkronize olduğu ve güvenlik olayı meta verisindeki zaman damgalarının UTC kullanarak ya da açık zaman dilimi ofsetiyle belirtildiği doğrulanmalıdır. UTC kullanımı, özellikle yaz saati uygulamaları nedeniyle oluşabilecek karışıklıkları önlemek için tavsiye edilir.FalseTrue✓True✓V16.2.33Uygulamanın yalnızca log envanterinde belgelenmiş dosya ve hizmetlere log yazdığı ya da ilettiği doğrulanmalıdır.FalseTrue✓True✓V16.2.44Logların kullanılan log işleyici (log processor) tarafından okunabildiği ve ilişkilendirilebildiği doğrulanmalıdır. Tercihen yaygın bir log formatı kullanılmalıdır.FalseTrue✓True✓V16.2.55Hassas veriler loglanırken, uygulamanın veri koruma seviyesine uygun olarak loglama yaptığı doğrulanmalıdır. Örneğin kimlik bilgileri veya ödeme detayları gibi bazı verilerin loglanmasına izin verilmemelidir. Session token’ları gibi veriler ise yalnızca tamamen ya da kısmen maskelenmiş ya da hash’lenmiş olarak loglanmalıdır.FalseTrue✓True✓V16.33Güvenlik OlaylarıV16.3.11Tüm kimlik doğrulama işlemlerinin (başarılı ve başarısız girişimler dahil) loglandığı doğrulanmalıdır. Kullanılan kimlik doğrulama türü veya faktörleri gibi ek meta veriler de toplanmalıdır.FalseTrue✓True✓V16.3.22Başarısız yetkilendirme girişimlerinin loglandığı doğrulanmalıdır. Seviye 3 uygulamalar için, tüm yetkilendirme kararlarının ve hassas verilere erişim olaylarının (verinin kendisi olmadan) loglandığı da doğrulanmalıdır.FalseTrue✓True✓V16.3.33Uygulamanın, belgelenmiş güvenlik olaylarını ve güvenlik kontrollerini aşma girişimlerini (girdi doğrulama, iş mantığı, otomasyon karşıtı kontroller vb.) logladığı doğrulanmalıdır.FalseTrue✓True✓V16.3.44Beklenmeyen hatalar ve güvenlik kontrolü başarısızlıkları (örneğin backend TLS hataları gibi) loglandığı doğrulanmalıdır.FalseTrue✓True✓V16.44Log KorumasıV16.4.11Tüm loglama bileşenlerinin, log enjeksiyonunu (log injection) önlemek amacıyla verileri uygun biçimde encode ettiği doğrulanmalıdır.FalseTrue✓True✓V16.4.22Logların yetkisiz erişime karşı korunduğu ve değiştirilemez olduğu doğrulanmalıdır.FalseTrue✓True✓V16.4.33Logların analiz, tespit, uyarı ve yükseltme amacıyla mantıksal olarak ayrı bir sisteme güvenli biçimde iletildiği doğrulanmalıdır. Böylece uygulama ihlal edilse bile logların tehlikeye girmesi önlenmiş olur.FalseTrue✓True✓V16.55Hata YönetimiV16.5.11Beklenmedik ya da güvenlikle ilgili bir hata oluştuğunda, tüketiciye genel bir mesaj döndürüldüğü ve yığın izleri (stack trace), sorgular, gizli anahtarlar, token’lar gibi hassas sistem içi verilerin açıklanmadığı doğrulanmalıdır.FalseTrue✓True✓V16.5.22Uygulamanın, dış kaynaklara erişim başarısız olduğunda bile güvenli şekilde çalışmaya devam ettiği doğrulanmalıdır. Örneğin, circuit breaker ya da graceful degradation gibi desenler kullanılmalıdır.FalseTrue✓True✓V16.5.33Uygulamanın hata durumlarında güvenli ve düzenli şekilde başarısız olduğu doğrulanmalıdır. Bu, örneğin doğrulama hatalarına rağmen işlemlerin işlenmesine yol açabilecek fail-open durumlarını önlemelidir.FalseTrue✓True✓V16.5.44Ele alınmamış tüm istisnaları yakalayacak şekilde tanımlanmış bir “son çare hata yöneticisi” bulunduğu doğrulanmalıdır. Bu, hem loglara gitmesi gereken hata detaylarının kaybolmaması hem de tüm uygulama sürecinin çökerek hizmet dışı kalmasının önlenmesi açısından önemlidir.FalseFalseTrue✓V1717WebRTCWebRTCV17.11TURN SunucusuV17.1.11TURN hizmetinin yalnızca özel amaçlar için ayrılmamış IP adreslerine (ör. iç ağlar, yayın adresleri, loopback) erişime izin verdiği doğrulanmalıdır. Bu gereksinim hem IPv4 hem de IPv6 adresleri için geçerlidir.FalseTrue✓True✓V17.1.22TURN hizmetinin, meşru kullanıcıların sunucuda çok sayıda bağlantı noktası açmaya çalışması durumunda kaynak tüketimi saldırılarına karşı dayanıklı olduğu doğrulanmalıdır.FalseFalseTrue✓V17.22MedyaV17.2.11DTLS sertifikası anahtarının, belgelenmiş kriptografik anahtar yönetim politikasına uygun şekilde yönetildiği ve korunduğu doğrulanmalıdır.FalseTrue✓True✓V17.2.22Medya sunucusunun onaylı DTLS şifre takımlarını (cipher suites) ve Güvenli Gerçek Zamanlı Aktarım Protokolü (Secure Real-time Transport Protocol - SRTP) için anahtarlar oluşturmaya yönelik DTLS Uzantısı için güvenli bir koruma profilini kullanacak ve destekleyecek şekilde yapılandırıldığı (DTLS-SRTP) doğrulanmalıdır.FalseTrue✓True✓V17.2.33Real-time Transport Protocol (RTP) injection saldırılarının bir hizmet reddi durumuna veya medya akışlarına ses veya video medyası eklenmesine yol açmasını önlemek için medya sunucusunda Güvenli SRTP kimlik doğrulamasının kontrol edildiği doğrulanmalıdır.FalseTrue✓True✓V17.2.44Verify that the media server is able to continue processing incoming media traffic when encountering malformed Secure Real-time Transport Protocol (SRTP) packets.FalseTrue✓True✓V17.2.55Medya sunucusunun, meşru kullanıcılardan gelen SRTP flood'ı sırasında gelen medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.FalseFalseTrue✓V17.2.66Medya sunucusunun DTLS içinde yer alan "ClientHello" yarış durumu güvenlik açığına karşı savunmasız olmadığı, medya sunucusunun güvenlik açığına sahip olduğunun açıkça bilinip bilinmediği kontrol edilerek veya yarış koşulu testi gerçekleştirilerek doğrulanmalıdır.FalseFalseTrue✓V17.2.77Medya sunucusuna bağlı ses veya video kayıt mekanizmalarının, meşru kullanıcı kaynaklı SRTP flood'ı sırasında medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.FalseFalseTrue✓V17.2.88DTLS sertifikasının, SDP (Session Description Protocol) fingerprint özelliği ile karşılaştırıldığı ve doğrulama başarısız olursa medya akışının sonlandırıldığı, medya akışının özgünlüğünü sağlamak için doğrulanmalıdır.FalseFalseTrue✓V17.33SinyalizasyonV17.3.11Sinyalizasyon sunucusunun, flood saldırısı altında bile meşru sinyalizasyon mesajlarını işlemeye devam edebildiği doğrulanmalıdır. Bu, sinyalizasyon düzeyinde oran sınırlaması uygulanarak sağlanmalıdır.FalseTrue✓True✓V17.3.22Sinyalizasyon sunucusunun, hizmet reddine yol açabilecek şekilde yapılandırılmış bozuk sinyalizasyon mesajlarıyla karşılaştığında bile meşru mesajları işlemeye devam edebildiği doğrulanmalıdır. Bu, girdi doğrulaması, integer overflow ve buffer overflow'a karşı savunma ve sağlam hata işleme teknikleri ile sağlanmalıdır.FalseTrue✓True✓ diff --git a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.xml b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.xml new file mode 100644 index 0000000000..2b8087fa93 --- /dev/null +++ b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.xml @@ -0,0 +1 @@ +Application Security Verification Standard ProjectASVSThe OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.V11EncodingKodlama (Encoding) ve TemizlemeV1.11Kodlama ve Temizleme MimarisiV1.1.11Girdinin yalnızca bir kez kanonik forma (canonical form) çözümlendiği veya kaçış işlemlerinin kaldırıldığı, bu işlemin yalnızca verinin bu biçimde beklenmesi durumunda yapıldığı ve bu işlemin girdi doğrulama veya temizleme işlemlerinden sonra değil, önce gerçekleştiği doğrulanmalıdır.2V1.1.22Uygulamanın, çıktıyı kullanılması gereken yorumlayıcıya verilmeden hemen önce veya yorumlayıcının kendisi tarafından çıktı kodlaması ya da kaçış işlemi yaptığı doğrulanmalıdır.2V1.22Enjeksiyon ÖnlemeV1.2.11HTTP yanıtı, HTML veya XML belgesi için yapılan çıktı kodlamasının; HTML elemanları, HTML öznitelikleri, HTML yorumları, CSS ya da HTTP başlık alanları gibi bağlamlara uygun olduğu doğrulanmalıdır. Böylece mesaj veya belge yapısının bozulması önlenir.1V1.2.22Dinamik olarak URL oluşturulurken, güvenilmeyen verinin bağlamına göre (örneğin, sorgu veya yol parametreleri için URL kodlaması ya da base64url kodlaması) kodlandığı doğrulanmalıdır. Yalnızca güvenli URL protokollerine izin verilmelidir (örneğin, javascript: veya data: yasaklanmalıdır).1V1.2.33JavaScript içeriği (JSON dahil) dinamik olarak oluşturulurken çıktı kodlama/kaçış kullanıldığı doğrulanmalıdır. Böylece mesaj veya belge yapısı değiştirilmemiş olur (JavaScript ve JSON enjeksiyonlarının önüne geçilir).1V1.2.44Veri sorguları veya veritabanı sorguları (SQL, HQL, NoSQL, Cypher vb.) için parametreli sorgular, ORM’ler, entity framework’ler kullanıldığı ya da SQL enjeksiyonu ve diğer veritabanı enjeksiyon saldırılarına karşı koruma sağlandığı doğrulanmalıdır. Bu durum, saklı yordam (stored procedure) yazarken de geçerlidir.1V1.2.55Uygulamanın işletim sistemi komut enjeksiyonlarına karşı korunduğu ve işletim sistemi çağrılarında parametreli OS sorguları veya bağlama özgü komut satırı çıktı kodlamasının kullanıldığı doğrulanmalıdır.1V1.2.66Uygulamanın LDAP enjeksiyon zafiyetlerine karşı korunduğu ya da LDAP enjeksiyonlarını önlemek için özel güvenlik kontrollerinin uygulandığı doğrulanmalıdır.2V1.2.77XPath enjeksiyon saldırılarına karşı, sorgu parametrelemesi veya önceden derlenmiş sorgular kullanılarak koruma sağlandığı doğrulanmalıdır.2V1.2.88LaTeX işlemcilerinin güvenli şekilde yapılandırıldığı (örneğin, --shell-escape bayrağının kullanılmadığı) ve yalnızca izin verilen komutlardan oluşan bir listeyle çalıştırıldığı doğrulanmalıdır.2V1.2.99Düzenli ifadelerde (regex) özel karakterlerin (genellikle ters eğik çizgi \ ile) kaçırılarak meta karakter olarak yorumlanmalarının önlendiği doğrulanmalıdır.2V1.2.1010Uygulamanın CSV ve formül enjeksiyonlarına karşı korunduğu doğrulanmalıdır. Uygulama, CSV içeriği dışa aktarırken RFC 4180 Bölüm 2.6 ve 2.7'de tanımlanan kaçış kurallarına uymalıdır. Ayrıca, CSV veya diğer tablo formatlarına (XLS, XLSX, ODF gibi) aktarım yapılırken, alanın ilk karakteri olarak çıkan özel karakterler ('=', '+', '-', '@', '\t' (sekme), '\0' (null karakter)) tek tırnak (') ile kaçırılmalıdır.3V1.33Temizleme (Sanitization)V1.3.11WYSIWYG editörlerinden veya benzer kaynaklardan gelen tüm güvenilmeyen HTML girdilerinin, bilinen ve güvenli bir HTML temizleme kütüphanesi ya da çerçeve özelliği ile temizlendiği doğrulanmalıdır.1V1.3.22Uygulamanın eval() veya Spring Expression Language (SpEL) gibi dinamik kod çalıştırma özelliklerini kullanmaktan kaçındığı doğrulanmalıdır. Alternatif yoksa, kullanıcı girdisi çalıştırılmadan önce mutlaka temizlenmelidir.1V1.3.33Potansiyel olarak tehlikeli bir bağlamda kullanılacak verilerin, bu bağlama uygun karakterlere izin vermek ve çok uzun girdileri kısaltmak gibi güvenlik önlemleriyle önceden temizlendiği doğrulanmalıdır.2V1.3.44Kullanıcı tarafından sağlanan SVG içeriğinin, yalnızca güvenli etiket ve özellikler (örneğin grafik çizme ile ilgili) içerdiğinden emin olmak için onaylandığı veya temizlendiği doğrulanmalıdır (ör. script veya foreignObject içermemelidir).2V1.3.55Markdown, CSS, XSL stil sayfaları, BBCode veya benzeri ifade şablon dillerinde kullanıcı girdisinin temizlendiği veya bu tür özelliklerin devre dışı bırakıldığı doğrulanmalıdır.2V1.3.66Uygulamanın, güvenilmeyen verileri başka servislere iletmeden önce izinli protokol, alan adı, yol ve port listelerine göre doğruladığı ve tehlikeli karakterleri temizlediği doğrulanarak SSRF (Sunucu Taraflı İstek Sahteciliği) saldırılarına karşı korunduğu doğrulanmalıdır.2V1.3.77Uygulamanın şablon enjeksiyon saldırılarına karşı, güvenilmeyen girdilere dayalı şablon oluşturmayı engellediği; eğer bu kaçınılmazsa, bu girdilerin mutlaka temizlendiği veya sıkı şekilde onaylandığı doğrulanmalıdır.2V1.3.88JNDI sorgularında kullanılmadan önce güvenilmeyen girdilerin temizlendiği ve JNDI'nin enjeksiyonlara karşı güvenli şekilde yapılandırıldığı doğrulanmalıdır.2V1.3.99Memcache’e gönderilmeden önce içeriğin temizlenerek enjeksiyon saldırılarına karşı korunduğu doğrulanmalıdır.2V1.3.1010Format dizgilerinin (format strings) beklenmeyen veya zararlı şekilde çözümlenmesini önlemek için işlenmeden önce temizlendiği doğrulanmalıdır.2V1.3.1111SMTP veya IMAP enjeksiyonlarını önlemek için, kullanıcı girdisinin posta sistemlerine iletilmeden önce temizlendiği doğrulanmalıdır.2V1.3.1212Regex girdilerinin üstel geri izlemeye (exponential backtracking) neden olan öğeler içermediği ve güvenilmeyen girdilerin ReDoS (Regex Denial of Service) gibi saldırılara karşı temizlendiği doğrulanmalıdır.3V1.44Bellek, Dizgi ve Yönetilmeyen KodV1.4.11Yığın, arabellek (buffer) veya yığın belleği taşmalarını önlemek ya da tespit etmek amacıyla, bellek güvenli dizgi işlemlerinin, daha güvenli bellek kopyalama ve işaretçi aritmetiğinin kullanıldığı doğrulanmalıdır.2V1.4.22Tamsayı taşmalarını önlemek için işaret (sign), aralık (range) ve giriş doğrulama tekniklerinin kullanıldığı doğrulanmalıdır.2V1.4.33Dinamik olarak ayrılan belleğin ve kaynakların serbest bırakıldığı ve boşaltılan belleklere ait referansların veya işaretçilerin kaldırıldığı veya null yapıldığı doğrulanmalıdır (dangling pointer ve use-after-free zafiyetlerine karşı).2V1.55Güvenli Ters Serileştirme (Safe Deserialization)V1.5.11XML ayrıştırıcılarının (parser) kısıtlayıcı şekilde yapılandırıldığı ve dış varlık çözümleme (external entity resolution) gibi güvensiz özelliklerin XXE (XML eXternal Entity) saldırılarına karşı devre dışı bırakıldığı doğrulanmalıdır .1V1.5.22Güvenilmeyen verilerin ters serileştirilmesinde, nesne türleri için izinli liste kullanımı veya istemci tanımlı nesne türlerinin kısıtlanması gibi güvenli giriş işleme önlemlerinin uygulandığı doğrulanmalıdır. Güvensiz olarak tanımlanmış ters serileştirme mekanizmaları, güvenilmeyen girdilerle kullanılmamalıdır.2V1.5.33Aynı veri türü için uygulamada kullanılan farklı parser'ların (ör. JSON, XML, URL parser'ları), veriyi tutarlı şekilde ayrıştırdığı ve aynı karakter kodlamasını kullandığı doğrulanmalıdır. Böylece JSON birlikte çalışabilirlik açıkları, URI veya dosya ayrıştırma farkları gibi sorunlar nedeniyle RFI veya SSRF saldırılarının istismar edilmesi önlenir.3V22ValidationDoğrulama ve İş MantığıV2.11Doğrulama ve İş Mantığı DokümantasyonuV2.1.11Uygulama dokümantasyonunda, veri öğelerinin beklenen yapıya göre nasıl doğrulanacağına ilişkin giriş doğrulama kurallarının tanımlandığı doğrulanmalıdır. Bu; kredi kartı numaraları, e-posta adresleri, telefon numaraları gibi yaygın veri biçimleri olabileceği gibi iç sistemlere özel biçimler de olabilir.1V2.1.22Uygulama dokümantasyonunda, birleştirilmiş veri öğelerinin mantıksal ve bağlamsal tutarlılığının nasıl doğrulanacağı tanımlanmalıdır (örneğin, mahalle ve posta kodunun eşleşip eşleşmediğinin kontrolü).2V2.1.33Hem kullanıcı bazında hem de uygulama genelinde geçerli olacak şekilde, iş mantığı sınırları ve doğrulama beklentilerinin belgelendiği doğrulanmalıdır.2V2.22Girdi DoğrulamaV2.2.11Girdilerin, işlevsel ya da iş gereksinimlerine uygunluğunun doğrulandığı teyit edilmelidir. Bu işlem; izinli değerler, desenler ve aralıklar listesine karşı pozitif doğrulama ile ya da girdinin beklenen yapıya ve mantıksal sınırlara uygunluğunun önceden tanımlanmış kurallara göre karşılaştırılması ile yapılmalıdır. Seviye 1 için bu, güvenlik veya iş kararlarında kullanılan girdilere odaklanabilir. Seviye 2 ve üstü için tüm girdilere uygulanmalıdır.1V2.2.22Uygulamanın, güvenilir bir servis katmanında girdi doğrulama zorunluluğu uygulayacak şekilde tasarlandığı doğrulanmalıdır. İstemci tarafında gerçekleştirilen doğrulama, kullanılabilirliği artırabilir ve teşvik edilmelidir. Ancak bu doğrulama,güvenlik kontrolü olarak kabul edilmemelidir.1V2.2.33Uygulamanın, ilişkili veri öğelerinin önceden tanımlanmış kurallara göre makul olup olmadığını kontrol ettiği doğrulanmalıdır.2V2.33İş Mantığı GüvenliğiV2.3.11Uygulamanın, aynı kullanıcı için iş mantığı akışlarını yalnızca beklenen adım sırasına göre ve adım atlamadan işlediği doğrulanmalıdır.1V2.3.22İş mantığı sınırlarının, uygulama dokümantasyonuna uygun şekilde uygulandığı doğrulanmalıdır.2V2.3.33İş mantığı seviyesinde işlemlerin (transaction) kullanıldığı ve bir iş mantığı işleminin ya bütünüyle başarıyla tamamlandığı ya da önceki geçerli duruma geri döndürüldüğü (rollback) doğrulanmalıdır.2V2.3.44İş mantığı düzeyinde kilitleme mekanizmalarının, sınırlı kaynakların (ör. sinema koltukları, teslimat zamanları) uygulamanın mantığı manipüle edilerek çift rezervasyona neden olmamasını sağladığı doğrulanmalıdır.2V2.3.55Yüksek değerli iş mantığı akışlarının, yetkisiz veya kazara gerçekleşebilecek işlemleri önlemek için çoklu kullanıcı onayı gerektirdiği doğrulanmalıdır. Bu işlemler büyük para transferleri, sözleşme onayları, gizli bilgilere erişim veya üretimde güvenlik kurallarının geçersiz kılınmaları gibi durumları içerebilir.3V2.44Otomasyon Karşıtı ÖnlemlerV2.4.11Uygulama işlevlerine yönelik aşırı miktardaki çağrılara karşı; veri sızdırma, anlamsız veri üretme, kota tüketme, hız sınırının aşılması, hizmet reddi (DoS) ya da maliyetli kaynakların aşırı kullanımı gibi risklere karşı otomasyon karşıtı kontrollerin bulunduğu doğrulanmalıdır.2V2.4.22İş mantığı akışlarının, aşırı hızlı işlem gönderimlerini önleyecek şekilde gerçekçi insan zamanlaması gerektirdiği doğrulanmalıdır.3V33WebWeb Ön Uç (Frontend) GüvenliğiV3.11Web Frontend Güvenlik DokümantasyonuV3.1.11Uygulama dokümantasyonunda, uygulamayı kullanan tarayıcıların desteklemesi gereken güvenlik özelliklerinin (ör. HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) ve diğer ilgili HTTP güvenlik mekanizmaları) tanımlandığı doğrulanmalıdır. Ayrıca bu özelliklerin mevcut olmadığı durumlarda uygulamanın nasıl davranması gerektiği (ör. kullanıcıyı uyarmak veya erişimi engellemek) de tanımlanmalıdır.3V3.22İçeriğin Yanlış YorumlanmasıV3.2.11Tarayıcıların HTTP yanıtlarında içerik veya işlevi yanlış bir bağlamda sunmalarını önlemek amacıyla güvenlik kontrollerinin uygulandığı doğrulanmalıdır (ör. API, kullanıcı tarafından yüklenen dosya veya başka bir kaynağın doğrudan çağrılması durumunda). Olası kontroller arasında; yalnızca HTTP istek başlıklarının (ör. Sec-Fetch-\*) doğru bağlamı gösterdiği durumlarda içeriğin sunulması, Content-Security-Policy başlığında "sandbox" yönergesinin kullanılması veya Content-Disposition başlığında "attachment" biçiminin kullanılması yer alabilir.1V3.2.22HTML yerine metin olarak görüntülenmesi amaçlanan içeriğin, HTML veya JavaScript gibi içeriklerin istenmeden çalıştırılmasını önleyecek şekilde "createTextNode" veya "textContent" gibi güvenli işleme fonksiyonlarıyla işlendiği doğrulanmalıdır.1V3.2.33Uygulamanın istemci tarafı JavaScript kullanırken açık değişken tanımlamaları yaparak, sıkı tür kontrolü uygulayarak, global değişkenleri document nesnesine kaydetmekten kaçınarak ve ad alanı izolasyonu sağlayarak DOM clobbering’den kaçındığı doğrulanmalıdır.3V3.33Çerez YapılandırmasıV3.3.11Çerezlerin 'Secure' niteliğine sahip olduğu ve eğer çerez adı '\__Host-' ön eki ile başlamıyorsa, '__Secure-' ön ekinin kullanıldığı doğrulanmalıdır.1V3.3.22Kullanıcı arayüzü kandırma saldırılarına ve tarayıcı tabanlı istek sahteciliği saldırılarına (CSRF) karşı koruma sağlamak amacıyla, her çerezin 'SameSite' niteliğinin kullanım amacına uygun şekilde ayarlandığı doğrulanmalıdır.2V3.3.33Çerez adı, diğer sunucularla paylaşılmak üzere açıkça tasarlanmadığı sürece '__Host-' ön eki ile tanımlanmalıdır.2V3.3.44Bir çerez değeri istemci tarafı betikleri tarafından erişilememesi gereken bir veri içeriyorsa (ör. oturum token'ı), çerezin 'HttpOnly' niteliğine sahip olduğu ve aynı değerin (ör. oturum token'ı) yalnızca 'Set-Cookie' başlığı ile istemciye iletildiği doğrulanmalıdır.2V3.3.55Uygulama bir çerez oluştururken, çerez adı ve değerinin toplam uzunluğunun 4096 baytı aşmadığı doğrulanmalıdır. Çok büyük çerezler tarayıcı tarafından saklanmaz ve isteklerle gönderilmez; bu da çereze bağlı çalışan uygulama işlevlerinin bozulmasına yol açabilir.3V3.44Tarayıcı Güvenlik Mekanizması Başlıkları (Header)V3.4.22Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header'ı, uygulama tarafından sabit bir değer olarak tanımlanmalı veya gelen Origin header değeri güvenilir origin’lerden oluşan bir izinli listeye karşı doğrulanmalıdır. ‘Access-Control-Allow-Origin: *’ kullanılması gerekiyorsa, yanıtın hassas bilgi içermediği doğrulanmalıdır.1V3.4.33HTTP yanıtlarında Content-Security-Policy header'ı bulunduğu ve bu header'ın yalnızca güvenilen içeriklerin veya kaynakların yüklenmesini ve çalıştırılmasını sağlayan yönergeler içerdiği doğrulanmalıdır. Minimum olarak "global policy", object-src 'none', base-uri 'none' yönergelerini içermeli ve izinli liste, nonce veya hash temelli bir yapı içermelidir. Seviye 3 uygulamalarında her yanıt için nonce veya hash içeren özel bir politika tanımlanmalıdır.2V3.4.44Tüm HTTP yanıtlarının 'X-Content-Type-Options: nosniff' header'ını içerdiği doğrulanmalıdır. Bu, tarayıcıya içerik türünü tahmin etmeyi bırakmasını ve yanıtın Content-Type header'ında belirtilen MIME türünün, beklenen kaynak türüyle eşleşmesini zorunlu kılar. Ayrıca bu, tarayıcıda CORB (Cross-Origin Read Blocking) özelliğini etkinleştirir.2V3.4.55Uygulamanın, 'Referer' başlığı yoluyla üçüncü taraflara teknik olarak hassas verilerin sızmasını önlemek için bir 'referrer policy' belirlediği doğrulanmalıdır. Bu, Referrer-Policy HTTP header'ıyla veya HTML öğe nitelikleriyle (element attributes) sağlanabilir. Sızabilecek hassas bilgiler, URL’deki yol ve sorgu parametreleri ile sınırlı uygulamalarda hostname bilgisini içerebilir.2V3.4.66Uygulamanın, Content-Security-Policy header'ı altında 'frame-ancestors' yönergesini her HTTP yanıtında tanımladığı ve bu sayede içeriklerin varsayılan olarak başka sayfalara gömülmesini engellediği doğrulanmalıdır. Gerekli durumlarda özel olarak izin verildiğinden emin olunmalıdır. 'X-Frame-Options' header'ı, tarayıcılar tarafından desteklenmesine rağmen, artık güncel değildir ve güvenlik amacıyla kullanılmamalıdır.2V3.4.88Bir belgenin işlenmesini ve sunulmasını başlatan tüm HTTP yanıtlarında (örneğin 'text/html' tipi yanıtlar), 'Cross-Origin-Opener-Policy' header'ı 'same-origin' veya 'same-origin-allow-popups' yönergeleriyle birlikte yer almalıdır. Bu, tabnabbing ve frame counting gibi, pencere nesnelerine paylaşımlı erişimi sömüren saldırılara karşı koruma sağlar.3V3.55Tarayıcı Menşei AyırımıV3.5.11Uygulama, hassas işlevselliğe yönelik izinsiz cross-origin istekleri önlemek için CORS preflight mekanizmasına güvenmiyorsa, bu tür isteklerin gerçekten uygulamadan geldiği doğrulanmalıdır. Bu, anti-forgery token kullanımı veya CORS tarafından güvenli kabul edilmeyen özel HTTP header'larının zorunlu kılınmasıyla yapılabilir. Bu, tarayıcı tabanlı istek sahteciliği (CSRF) saldırılarına karşı bir savunmadır.1V3.5.22Uygulama, hassas işlevlerin izinsiz cross-origin çağrılmasını önlemek için CORS preflight mekanizmasına güveniyorsa, bu işlevlerin bir CORS-preflight isteğini tetiklemeden çağrılamadığı doğrulanmalıdır. Bu, 'Origin' ve 'Content-Type' header'larının doğrulanmasını veya CORS-safelisted olmayan bir header'ın ve alanın kullanılmasını gerektirebilir.1V3.5.44Farklı uygulamaların farklı hostname'lerde barındırıldığı ve böylece Same-Origin Policy tarafından sağlanan kısıtlamalardan (örneğin çerez erişim sınırları, kaynaklar arası etkileşim kontrolleri) faydalanıldığı doğrulanmalıdır.2V3.5.66Uygulamanın herhangi bir yerinde JSONP işlevselliğinin etkin olmadığı doğrulanmalıdır. Bu, XSSI (Cross-Site Script Inclusion) saldırılarını önlemek içindir.3V3.5.77Yetkilendirme gerektiren verilerin, JavaScript dosyaları gibi betik kaynaklarının yanıtlarında yer almadığı, XSSI saldırılarını önlemek için doğrulanmalıdır.3V3.5.88Kimliği doğrulanmış kaynakların (örneğin görseller, videolar, betikler ve belgeler) yalnızca gerçekten amaçlandığında kullanıcı adına yüklenebildiği veya gömülebildiği doğrulanmalıdır. Bu, isteğin uygun olmayan bir çapraz kaynak çağrısından kaynaklanmadığından emin olmak için Sec-Fetch-* HTTP istek başlığı alanlarının sıkı bir şekilde doğrulanmasıyla veya tarayıcıya döndürülen içeriği engelleme talimatı vermek için kısıtlayıcı bir Cross-Origin-Resource-Policy HTTP yanıt başlığı alanı ayarlayarak gerçekleştirilebilir.3V3.66Harici Kaynak BütünlüğüV3.6.11JavaScript kütüphaneleri, CSS veya web fontları gibi istemci tarafı varlıkların yalnızca statik ve sürümlü olması, varlığın bütünlüğünü doğrulamak için Subresource Integrity (SRI) kullanılması durumunda harici olarak (örneğin, bir İçerik Dağıtım Ağı üzerinde) barındırıldığı doğrulanmalıdır. Bu mümkün değilse, her bir kaynak için bunu gerekçelendiren belgelenmiş bir güvenlik kararı bulunmalıdır.3V3.77Diğer Tarayıcı Güvenliği HususlarıV3.7.11Uygulamanın yalnızca hâlâ desteklenen ve güvenli kabul edilen istemci tarafı teknolojileri kullandığı doğrulanmalıdır. Bu gereksinimi karşılamayan teknolojilere örnek olarak NSAPI eklentileri, Flash, Shockwave, ActiveX, Silverlight, NACL veya istemci tarafı Java applet’leri verilebilir.2V3.7.22Uygulamanın, yalnızca hedef adres bir izinli listede yer alıyorsa kullanıcıyı otomatik olarak farklı bir ana makine adına veya uygulamanın kontrolünde olmayan bir etki alanına yönlendirdiği doğrulanmalıdır.2V3.7.33Uygulamanın, kullanıcı uygulamanın kontrolü dışındaki bir URL’ye yönlendirildiğinde, yönlendirme hakkında bir bildirim gösterdiği ve kullanıcının bu gezintiyi iptal edebilmesi için bir seçenek sunduğu doğrulanmalıdır.3V3.7.44Uygulamanın en üst düzey etki alanının (örneğin, site.tld) HTTP Strict Transport Security (HSTS) için genel preload listesine eklendiği doğrulanmalıdır. Bu, uygulamanın TLS kullanımının ana tarayıcılar tarafından doğrudan tanınmasını ve yalnızca Strict-Transport-Security yanıt header'ına bağlı kalınmamasını sağlar.3V3.7.55Uygulamaya erişen tarayıcının beklenen güvenlik özelliklerini desteklememesi durumunda, uygulamanın dokümantasyona uygun şekilde davrandığı (örneğin kullanıcıyı uyarma veya erişimi engelleme) doğrulanmalıdır.3V44APIAPI ve Web ServisiV4.11Genel Web Servisi GüvenliğiV4.1.11İleti gövdesi içeren her HTTP yanıtında, yanıtın gerçek içeriğiyle eşleşen bir Content-Type header alanı bulunduğu ve güvenli karakter kodlamasını (örneğin, UTF-8, ISO-8859-1) belirtmek üzere charset parametresi içerdiği doğrulanmalıdır. Bu işlem, IANA Medya Türleri'nden "text/", "/+xml" ve "/xml" gibi içerikler için geçerlidir.1V4.1.22Yalnızca kullanıcı arayüzüne yönelik uç noktaların (manuel olarak web tarayıcısı ile erişilmesi amaçlanan) otomatik olarak HTTP'den HTTPS'e yönlendirme yaptığı ve diğer hizmetlerin veya uç noktaların şeffaf yönlendirme gerçekleştirmediği doğrulanmalıdır. Bu, istemcinin farkında olmadan şifrelenmemiş HTTP istekleri göndermesi ve bu isteklerin otomatik olarak HTTPS'e yönlendirilmesi sonucunda hassas verilerin sızmasının fark edilmemesi riskini önlemek içindir.2V4.1.33Uygulama tarafından kullanılan ve yük dengeleyici, web proxy veya frontend için backend hizmeti gibi bir ara katman tarafından ayarlanan herhangi bir HTTP başlık alanının, son kullanıcı tarafından geçersiz kılınamayacağı doğrulanmalıdır. Örnek başlıklar arasında X-Real-IP, X-Forwarded-* veya X-User-ID yer alabilir.2V4.1.44Uygulama veya API tarafından açıkça desteklenen HTTP yöntemlerinin (preflight istekleri sırasında OPTIONS dahil) dışında hiçbir yöntemin kullanılmadığı ve kullanılmayan yöntemlerin engellendiği doğrulanmalıdır.3V4.1.55Çok hassas istekler veya birçok sistemden geçen işlemler için, taşıma katmanı güvenliğinin üzerine ek bir güvence sağlamak amacıyla, her iletiye özel dijital imzaların kullanıldığı doğrulanmalıdır.3V4.22HTTP İleti Yapısı DoğrulamaV4.2.11Tüm uygulama bileşenlerinin (yük dengeleyiciler, güvenlik duvarları ve uygulama sunucuları dahil) HTTP sürümüne uygun mekanizmaları kullanarak gelen HTTP iletilerinin sınırlarını belirlediği ve bu sayede HTTP istek kaçakçılığına karşı koruma sağlandığı doğrulanmalıdır. HTTP/1.x sürümünde Transfer-Encoding başlık alanı varsa, RFC 2616'ya göre Content-Length başlığı göz ardı edilmelidir. HTTP/2 veya HTTP/3 kullanıldığında, Content-Length başlığı varsa, alıcının bu değerin DATA çerçevelerinin uzunluğuyla tutarlı olduğunu doğrulaması gerekir.2V4.2.22HTTP iletileri üretilirken, Content-Length başlığının, HTTP protokolünün çerçeveleme yöntemine göre belirlenen içerik uzunluğu ile çelişmediği doğrulanmalıdır. Bu, istek kaçakçılığı saldırılarını önlemek için gereklidir.3V4.2.33Uygulamanın, yanıt bölme ve header enjeksiyonu saldırılarını önlemek amacıyla, bağlantıya özel başlık alanları (örneğin Transfer-Encoding) içeren HTTP/2 veya HTTP/3 iletilerini göndermediği ve kabul etmediği doğrulanmalıdır.3V4.2.44Uygulamanın yalnızca başlık alanları ve değerleri CR (\r), LF (\n) veya CRLF (\r\n) karakter dizileri içermeyen HTTP/2 ve HTTP/3 isteklerini kabul ettiği doğrulanmalıdır. Bu, başlık enjeksiyonu saldırılarını önlemek içindir.3V4.2.55Uygulama (backend veya frontend) istek oluşturuyor ve gönderiyorsa, URI'ler (örneğin API çağrıları için) veya HTTP istek başlıkları (örneğin Authorization veya Cookie) gibi bileşenlerin, alıcı sistemler tarafından kabul edilemeyecek kadar uzun olmamasını sağlamak amacıyla doğrulama, temizleme veya diğer mekanizmaları kullandığı doğrulanmalıdır. Bu tür çok uzun istekler (örneğin çok uzun bir Cookie başlığı) gönderildiğinde sunucunun sürekli hata durumu döndürmesiyle hizmet reddi oluşabilir.3V4.33GraphQLV4.3.11Maliyetli ve iç içe geçmiş sorgular sonucu oluşabilecek GraphQL veya veri katmanı ifadelerine yönelik Hizmet Reddi (DoS) saldırılarını önlemek için, sorgu izin listesi (allowlist), derinlik sınırlandırması, sorgu sayısı sınırlandırması veya sorgu maliyeti analizi kullanıldığı doğrulanmalıdır.2V4.3.22GraphQL introspection (iç yapı sorgulama) sorgularının, GraphQL API'nin üçüncü taraflar tarafından kullanılmasına yönelik olmadığı sürece, üretim ortamında devre dışı bırakıldığı doğrulanmalıdır.2V4.44WebSocketV4.4.11Tüm WebSocket bağlantılarında TLS üzerinden WebSocket (WSS) kullanıldığı doğrulanmalıdır.1V4.4.22WebSocket'in başlangıçtaki HTTP el sıkışması (handshake) sırasında, Origin başlık alanının uygulama için izin verilen origin listesiyle karşılaştırılarak kontrol edildiği doğrulanmalıdır.2V4.4.33Uygulamanın standart oturum yönetimi kullanılamıyorsa, bunun yerine ilgili Oturum Yönetimi güvenlik gereksinimlerine uygun özel token'ların kullanıldığı doğrulanmalıdır.2V4.4.44HTTPS oturumu WebSocket kanalına geçerken, özel WebSocket oturum yönetim token’larının önceki şekilde kimliği doğrulanmış HTTPS oturumu aracılığıyla elde edildiği veya doğrulandığı doğrulanmalıdır.2V55FileDosya İşlemeV5.11Dosya İşleme DokümantasyonuV5.1.11Dokümantasyonun, her yükleme özelliği için izin verilen dosya türlerini, beklenen dosya uzantılarını ve maksimum boyutu (açılmış hali dahil) tanımladığı doğrulanmalıdır. Ayrıca, dosyaların son kullanıcılar için nasıl güvenli hâle getirileceği (örneğin kötü amaçlı bir dosya tespit edildiğinde uygulamanın nasıl davranacağı) gibi bilgilerin de belgede yer aldığı doğrulanmalıdır.2V5.22Dosya Yükleme ve İçerikV5.2.11Uygulamanın, yalnızca performans kaybına veya hizmet reddine yol açmayacak boyuttaki dosyaları kabul ettiği doğrulanmalıdır.1V5.2.22Uygulama bir dosyayı, doğrudan veya bir arşiv (ör. zip dosyası) içinde kabul ettiğinde, dosya uzantısının beklenen uzantıyla eşleşip eşleşmediğini kontrol ettiği ve içeriğin uzantı tarafından temsil edilen türle uyumlu olduğunu doğruladığı kontrol edilmelidir. Bu; ilk 'magic byte' kontrolü, görüntü yeniden yazımı ve dosya içeriği doğrulama için özel kütüphanelerin kullanımı gibi yöntemleri içerir. Seviye 1 için bu, yalnızca iş veya güvenlik kararlarında kullanılan dosyalarla sınırlı olabilir. Seviye 2 ve üzeri için tüm dosyalar bu kontrole tabi olmalıdır.1V5.2.33Sıkıştırılmış dosyaların (ör. zip, gz, docx, odt) açılmadan önce, izin verilen maksimum açılmış boyuta ve maksimum dosya sayısına göre kontrol edildiği doğrulanmalıdır.2V5.2.44Her kullanıcı için dosya boyutu kotası ve maksimum dosya sayısının uygulandığı doğrulanmalıdır. Böylece tek bir kullanıcının çok sayıda veya aşırı büyük dosya yükleyerek depolama alanını doldurması engellenir.3V5.2.55Uygulamanın, içinde sembolik bağlantılar (symlink) bulunan sıkıştırılmış dosyaların yüklenmesine yalnızca bu durum özel olarak gerekli olduğunda izin verdiği doğrulanmalıdır. Bu durumda, sembolik bağlantı verilebilecek dosyaların bir izinli listesi uygulanmalıdır.3V5.2.66Uygulamanın, piksel boyutu izin verilen maksimum değeri aşan görüntü dosyalarının yüklenmesini reddettiği doğrulanmalıdır. Bu, pixel flood saldırılarını önlemek için gereklidir.3V5.33Dosya DepolamaV5.3.11Güvenilmeyen girdilerle yüklenen veya oluşturulan ve herkese açık klasörlerde depolanan dosyaların, bir HTTP isteğiyle doğrudan erişildiğinde sunucu taraflı program kodu olarak çalıştırılmadığı doğrulanmalıdır.1V5.3.22Uygulamanın, dosya işlemleri için dosya yollarını oluştururken kullanıcı tarafından gönderilen dosya adlarını değil, dahili olarak oluşturulan veya güvenilir verileri kullandığı; eğer kullanıcı tarafından gönderilen dosya adları veya meta veriler kullanılacaksa, sıkı doğrulama ve temizleme işlemlerinin uygulandığı doğrulanmalıdır. Bu, yol geçişi (path traversal), yerel veya uzak dosya dahil etme (LFI, RFI) ve sunucu tarafı istek sahteciliği (SSRF) saldırılarına karşı koruma sağlar.1V5.3.33Sunucu tarafında gerçekleşen dosya işlemlerinin (örneğin dosya açma/decompress işlemi), kullanıcı tarafından sağlanan yol bilgilerini yok saydığı ve zip slip gibi güvenlik açıklarını önlediği doğrulanmalıdır.3V5.44Dosya İndirmeV5.4.11Uygulamanın, kullanıcı tarafından gönderilen dosya adlarını (ör. JSON, JSONP veya URL parametresinde) doğruladığı veya göz ardı ettiği ve yanıtın Content-Disposition başlık alanında bir dosya adı belirttiği doğrulanmalıdır.2V5.4.22Sunulan dosya adlarının (örneğin HTTP yanıt header'larında veya e-posta eklerinde), belge yapısını korumak ve enjeksiyon saldırılarını önlemek için kodlandığı veya temizlendiği (ör. RFC 6266’ya uygun) doğrulanmalıdır.2V5.4.33Güvenilmeyen kaynaklardan elde edilen dosyaların, bilinen kötü amaçlı içeriklerin sunulmasını önlemek amacıyla antivirüs tarayıcılarıyla tarandığı doğrulanmalıdır.2V66AuthenticationKimlik DoğrulamaV6.11Kimlik Doğrulama DokümantasyonuV6.1.11Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırılarına karşı oran sınırlama (rate limiting), otomasyon karşıtı önlemler ve uyarlanabilir yanıt gibi kontrollerin nasıl kullanıldığını açıklayan bir uygulama dokümantasyonu bulunduğu doğrulanmalıdır. Dokümantasyon, bu kontrollerin nasıl yapılandırıldığını ve kötü niyetli hesap kilitlemenin nasıl önlendiğini açıkça ortaya koymalıdır.1V6.1.22Parolalarda kullanılmasını önlemek amacıyla, bağlama özgü sözcüklerin (örneğin kurum adlarının permütasyonları, ürün adları, sistem tanımlayıcıları, proje kod adları, departman veya rol adları vb.) bulunduğu belgelenmiş bir liste mevcut olduğu doğrulanmalıdır.2V6.1.33Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, bunların tümünün belgelenmiş olduğu ve her yol için tutarlı şekilde uygulanması gereken güvenlik kontrolleri ile kimlik doğrulama gücünün tanımlandığı doğrulanmalıdır.2V6.22Parola GüvenliğiV6.2.11Kullanıcı tarafından belirlenen parolaların en az 8 karakter uzunluğunda olması sağlanmalı, ancak 15 karakter ve üzeri uzunlukta parolalar olmaları şiddetle tavsiye edilir.1V6.2.22Kullanıcıların parolalarını değiştirebilmeleri sağlanmalıdır.1V6.2.33Parola değiştirme işlevinin hem mevcut hem de yeni parolayı gerektirdiği doğrulanmalıdır.1V6.2.44Kayıt veya parola değişimi sırasında girilen parolaların, uygulamanın parola politikasına (örneğin minimum uzunluk) uyan ilk 3000 yaygın parolaya karşı kontrol edildiği doğrulanmalıdır.1V6.2.55Her tür karakterin kullanılmasına izin verildiği ve büyük/küçük harf, sayı veya özel karakter şartlarının zorunlu tutulmadığı doğrulanmalıdır.1V6.2.66Parola giriş alanlarının, girdiyi maskelemek için "type=password" kullandığı doğrulanmalıdır. Uygulamalar, kullanıcının tüm maskelenmiş parolayı ya da son girilen karakteri geçici olarak görüntülemesine izin verebilir.1V6.2.77"Yapıştır" özelliğinin, tarayıcı parola yardımcılarının ve harici parola yöneticilerinin kullanımına izin verildiği doğrulanmalıdır.1V6.2.88Uygulamanın, kullanıcıdan aldığı parolayı herhangi bir şekilde değiştirmeden, örneğin kesmeden veya harf büyüklüğünü değiştirmeden, tam olarak doğruladığı teyit edilmelidir.1V6.2.99En az 64 karakter uzunluğundaki parolalara izin verildiği doğrulanmalıdır.2V6.2.1010Kullanıcının parolasının, yalnızca ele geçirildiği tespit edildiğinde veya kullanıcı tarafından yenilendiğinde geçerliliğini yitirdiği doğrulanmalıdır. Uygulama, belirli aralıklarla parola yenilenmesini zorunlu kılmamalıdır.2V6.2.1111Tahmin edilmesi kolay parolaların oluşturulmasını önlemek amacıyla, bağlama özgü kelimelerin yer aldığı belgelenmiş listenin parola doğrulamada kullanıldığı teyit edilmelidir.2V6.2.1212Kayıt veya parola değişikliği sırasında girilen parolaların, ele geçirilmiş parolalar listesine karşı kontrol edildiği doğrulanmalıdır.2V6.33Genel Kimlik Doğrulama GüvenliğiV6.3.11Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırıları gibi saldırıları önlemeye yönelik kontrollerin, uygulamanın güvenlik dokümantasyonuna göre uygulandığı doğrulanmalıdır.1V6.3.22"root", "admin" veya "sa" gibi varsayılan kullanıcı hesaplarının uygulamada yer almadığı veya devre dışı bırakıldığı doğrulanmalıdır.1V6.3.33Uygulamaya erişim için ya çok faktörlü bir kimlik doğrulama mekanizması ya da tek faktörlü mekanizmaların kombinasyonu kullanılmalıdır. Seviye 3 için, bu faktörlerden biri, oltalama saldırılarına karşı direnç sağlayan ve kimlik doğrulama niyetini bir kullanıcı etkileşimi (örneğin FIDO donanım anahtarında bir düğmeye basma veya mobil telefonda bir onay) gerektirerek doğrulayan donanım tabanlı bir kimlik doğrulayıcı olmalıdır. Bu gereksinimdeki herhangi bir esneklik için, gerekçesi belgelenmiş ve riskleri azaltıcı kapsamlı kontroller içeren bir plan gereklidir.2V6.3.44Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, belgelendirilmemiş bir yol bulunmadığı ve tüm yollar için güvenlik kontrolleri ile kimlik doğrulama gücünün tutarlı şekilde uygulandığı doğrulanmalıdır.2V6.3.55Başarılı veya başarısız şüpheli kimlik doğrulama girişimlerinin kullanıcıya bildirildiği doğrulanmalıdır. Bu, olağandışı bir konum veya istemciden gelen girişimler, yalnızca bir faktörle yapılan kısmen başarılı doğrulamalar, uzun süreli inaktiflik sonrası yapılan girişimler veya birçok başarısız denemeden sonraki başarılı girişimler gibi durumları içerebilir.3V6.3.66E-postanın, tek faktörlü ya da çok faktörlü kimlik doğrulama mekanizması olarak kullanılmadığı doğrulanmalıdır.3V6.3.77Kimlik doğrulama detaylarında yapılan güncellemeler sonrasında (örneğin kimlik bilgisi sıfırlama, kullanıcı adı veya e-posta adresi değişiklikleri), kullanıcıların bilgilendirildiği doğrulanmalıdır.3V6.3.88Başarısız kimlik doğrulama girişimlerinden, geçerli kullanıcıların hata mesajları, HTTP yanıt kodları veya farklı yanıt süreleri gibi sonuçlara dayanarak tespit edilemediği doğrulanmalıdır. Bu koruma, kayıt ve "parolamı unuttum" işlevselliğinde de geçerli olmalıdır.3V6.44Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve KurtarmaV6.4.11Sistem tarafından oluşturulan ilk parolaların veya etkinleştirme kodlarının güvenli bir şekilde rastgele üretildiği, mevcut parola politikasına uygun olduğu, kısa bir süre içinde veya ilk kullanım sonrasında geçerliliğini yitirdiği doğrulanmalıdır. Bu başlangıç sırları uzun vadeli parola olarak kullanılmasına izin verilmemelidir.1V6.4.22Parola ipuçlarının veya "gizli sorular" olarak bilinen, bilgiye dayalı kimlik doğrulama mekanizmalarının mevcut olmadığı doğrulanmalıdır.1V6.4.33Unutulmuş parolanın sıfırlanması için, etkin olan çok faktörlü kimlik doğrulama mekanizmalarını atlamayan güvenli bir sürecin uygulandığı doğrulanmalıdır.2V6.4.44Çok faktörlü kimlik doğrulama faktörlerinden biri kaybolursa, kayıt sırasında uygulanan kimlik kanıtlama seviyesiyle aynı seviyede kimlik doğrulama yapıldığı doğrulanmalıdır.2V6.4.55Süresi dolacak kimlik doğrulama mekanizmalarının yenilenmesine ilişkin talimatların, süresi dolmadan önce tamamlanacak şekilde yeterli sürede gönderildiği ve gerekiyorsa otomatik hatırlatıcıların yapılandırıldığı doğrulanmalıdır.3V6.4.66Yönetici yetkisi olan kullanıcıların, kullanıcının parola sıfırlama sürecini başlatabildiği ancak kullanıcının yeni parolasını belirleyemediği veya değiştiremediği doğrulanmalıdır. Bu, yönetici yetkisi olan kullanıcıların, kullanıcı parolasını bilmesini engeller.3V6.55Çok Faktörlü Kimlik Doğrulama İçin Genel GereksinimlerV6.5.11Arama sırları, bant dışı kimlik doğrulama istekleri veya kodları ve zamana dayalı tek kullanımlık parolaların (TOTP) yalnızca bir kez kullanılabildiği doğrulanmalıdır.2V6.5.22Uygulamanın backend tarafında saklanırken, 112 bitten az entropiye sahip (örneğin 19 rastgele harf-rakam karakteri veya 34 rastgele rakam) arama sırlarının, 32-bit rastgele bir salt içeren onaylı bir parola saklama algoritmasıyla hash’lendiği doğrulanmalıdır. Gizli bilginin entropisi 112 bit veya daha fazlaysa standart bir hash fonksiyonu kullanılabilir.2V6.5.33Arama sırları, bant dışı kimlik doğrulama kodları ve zamana dayalı tek kullanımlık parola seed'lerinin, öngörülebilir değerlerden kaçınmak için Kriptografik Olarak Güvenli Sözde Rastgele Sayı Üreteci (CSPRNG) ile oluşturulduğu doğrulanmalıdır.2V6.5.44Arama sırlarının ve bant dışı kimlik doğrulama kodlarının en az 20 bit entropiye (genellikle 4 rastgele harf-rakam karakteri veya 6 rastgele rakam) sahip olduğu doğrulanmalıdır.2V6.5.55Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının ve zamana dayalı tek kullanımlık parolaların (TOTP) belirli bir ömre sahip olduğu doğrulanmalıdır. Bant dışı istekler en fazla 10 dakika, TOTP’ler ise en fazla 30 saniye geçerli olmalıdır.2V6.5.66Herhangi bir kimlik doğrulama faktörünün (fiziksel cihazlar dahil) çalınması veya kaybı durumunda iptal edilebildiği doğrulanmalıdır.3V6.5.77Biyometrik kimlik doğrulama mekanizmalarının yalnızca ikincil faktör olarak, “sahip olduğunuz bir şey” veya “bildiğiniz bir şey” ile birlikte kullanıldığı doğrulanmalıdır.3V6.5.88Zamana dayalı tek kullanımlık parolaların (TOTP) doğrulamasının, güvenilir bir hizmetten alınan zaman kaynağına dayanarak yapıldığı ve güvenilir olmayan veya istemci tarafından sağlanan zaman kaynağına dayanmadığı doğrulanmalıdır.3V6.66Bant Dışı Kimlik Doğrulama MekanizmalarıV6.6.11Tek kullanımlık parolaların (OTP) telefon veya SMS ile Public Switched Telephone Network (PSTN) üzerinden iletildiği kimlik doğrulama mekanizmalarının, yalnızca telefon numarası önceden doğrulanmışsa, alternatif daha güçlü yöntemler (örneğin TOTP) de sunuluyorsa ve kullanıcıya güvenlik riskleri hakkında bilgi veriliyorsa sunulduğu doğrulanmalıdır. Seviye 3 uygulamalar için telefon ve SMS seçenekleri sunulmamalıdır.2V6.6.22Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının, oluşturuldukları özgün kimlik doğrulama isteğiyle bağlantılı olduğu ve daha önceki ya da sonraki bir istek için kullanılamadığı doğrulanmalıdır.2V6.6.33Kod tabanlı bant dışı kimlik doğrulama mekanizmalarının, oran sınırlaması ile kaba kuvvet saldırılarına karşı korunduğu doğrulanmalıdır. En az 64 bit entropiye sahip kodlar kullanılması da değerlendirilmelidir.2V6.6.44Çok faktörlü kimlik doğrulama için push bildirimleri kullanılıyorsa, push bombing saldırılarına karşı oran sınırlamasının kullanıldığı doğrulanmalıdır. “Numara eşleştirme” de bu riski azaltabilir.3V6.77Kriptografik Kimlik Doğrulama MekanizmasıV6.7.11Kriptografik kimlik doğrulama beyanlarını doğrulamak için kullanılan sertifikaların, değiştirilmeye karşı korumalı şekilde saklandığı doğrulanmalıdır.3V6.7.22Challenge nonce değerinin en az 64 bit uzunluğunda olduğu ve istatistiksel olarak benzersiz ya da cihazın ömrü boyunca benzersiz olduğu doğrulanmalıdır.3V6.88Kimlik Sağlayıcısı ile Kimlik DoğrulamaV6.8.11Uygulama birden fazla kimlik sağlayıcıyı (IdP) destekliyorsa, başka bir desteklenen kimlik sağlayıcı aracılığıyla (örneğin aynı kullanıcı tanımlayıcısını kullanarak) kullanıcının kimliğinin taklit edilemediği doğrulanmalıdır. Standart önlem, uygulamanın kullanıcıyı IdP kimliği (bir ad alanı işlevi görür) ve IdP içindeki kullanıcı kimliğinin birleşimiyle kaydetmesi ve tanımlamasıdır.2V6.8.22Kimlik doğrulama beyanları üzerindeki dijital imzaların (örneğin JWT veya SAML beyanları) varlığı ve bütünlüğünün her zaman doğrulandığı ve imzasız veya geçersiz imzalı beyanların reddedildiği doğrulanmalıdır.2V6.8.33SAML beyanlarının benzersiz biçimde işlendiği ve yalnızca geçerlilik süresi içinde bir kez kullanıldığı, tekrar oynatma (replay) saldırılarını önlemek amacıyla doğrulanmalıdır.2V6.8.44Uygulama ayrı bir Kimlik Sağlayıcı (IdP) kullanıyorsa ve belirli işlemler için belirli kimlik doğrulama gücü, yöntemleri veya zaman bilgisi bekliyorsa, uygulamanın bu bilgileri IdP tarafından döndürülen veriler üzerinden doğruladığı teyit edilmelidir. Örneğin OIDC kullanılıyorsa, bu durum ID Token üzerindeki 'acr', 'amr' ve 'auth_time' gibi claim’lerin (varsa) doğrulanması ile sağlanabilir. Eğer IdP bu bilgileri sağlamıyorsa, uygulamanın asgari kimlik doğrulama gücünün kullanıldığını varsayan (örneğin yalnızca kullanıcı adı ve parola ile tek faktörlü doğrulama) belgelenmiş bir yedek yaklaşımı olmalıdır.2V77SessionOturum YönetimiV7.11Oturum Yönetim DokümantasyonuV7.1.11Kullanıcının oturum inaktivite zaman aşımı süresi ve mutlak maksimum oturum süresinin belgelendiği, diğer kontrollerle birlikte uygun olduğu ve NIST SP 800-63B yeniden kimlik doğrulama gereksinimlerinden herhangi bir sapma varsa gerekçesinin belgede yer aldığı doğrulanmalıdır.2V7.1.22Belgede bir hesap için kaç adet eşzamanlı (paralel) oturuma izin verildiği ile birlikte, maksimum aktif oturum sayısına ulaşıldığında uygulanacak davranış ve işlemlerin tanımlandığı doğrulanmalıdır.2V7.1.33Birleşik kimlik yönetim ekosisteminin bir parçası olarak kullanıcı oturumu oluşturan ve yöneten tüm sistemlerin, oturum ömrü, sonlandırma ve yeniden kimlik doğrulama gerektiren diğer koşulların nasıl koordine edildiğini açıklayan kontrollerle birlikte belgede yer aldığı doğrulanmalıdır.2V7.22Temel Oturum Yönetimi GüvenliğiV7.2.11Uygulamanın tüm oturum token'ı doğrulama işlemlerini güvenilir bir backend servisi aracılığıyla gerçekleştirdiği doğrulanmalıdır.1V7.2.22Uygulamanın, statik API gizli anahtarları veya sabit değerler yerine, oturum yönetimi için dinamik olarak oluşturulan kendi kendine yeterli veya referans token'ları kullandığı doğrulanmalıdır.1V7.2.33Uygulama kullanıcı oturumlarını temsil etmek için referans token'ları kullanıyorsa, bu token'ların benzersiz olduğu, kriptografik olarak güvenli bir sözde rastgele sayı üreteci (CSPRNG) kullanılarak üretildiği ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır.1V7.2.44Uygulamanın, kullanıcı kimlik doğrulaması (yeniden kimlik doğrulama dahil) sırasında yeni bir oturum token'ı oluşturduğu ve mevcut oturum token'ını sonlandırdığı doğrulanmalıdır.1V7.33Oturum Zaman AşımıV7.3.11Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde bir hareketsizlik zaman aşımı bulunduğu doğrulanmalıdır.2V7.3.22Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde mutlak bir maksimum oturum süresi bulunduğu doğrulanmalıdır.2V7.44Oturum SonlandırmaV7.4.11Oturum sonlandırma tetiklendiğinde (örneğin, çıkış yapıldığında veya süre dolduğunda), uygulamanın oturumun daha fazla kullanılmasına izin vermediği doğrulanmalıdır. Referans token'lar veya durum bilgili oturumlar için bu, oturum verilerinin uygulama arka ucunda geçersiz kılınması anlamına gelir. Kapsamlı token kullanan uygulamaların; sonlandırılmış token listesi tutmak, kullanıcıya özel tarih ve saatten önce oluşturulan token'ları reddetmek veya kullanıcıya özel imzalama anahtarını yenilemek gibi bir çözüm uygulaması gerekir.1V7.4.22Bir kullanıcı hesabı devre dışı bırakıldığında veya silindiğinde (örneğin bir çalışanın şirketten ayrılması), uygulamanın tüm aktif oturumları sonlandırdığı doğrulanmalıdır.1V7.4.33Herhangi bir kimlik doğrulama faktörünün başarılı bir şekilde değiştirilmesi veya kaldırılmasından (şifre sıfırlama veya kurtarma yoluyla yapılan değişiklikler dahil ve varsa MFA ayarları güncellemeleri dahil) sonra, uygulamanın diğer tüm aktif oturumları sonlandırma seçeneği sunduğu doğrulanmalıdır.2V7.4.44Kimlik doğrulama gerektiren tüm sayfalarda kolay erişilebilir ve görünür bir çıkış yap (logout) işlevi bulunduğu doğrulanmalıdır.2V7.4.55Uygulama yöneticilerinin, bireysel bir kullanıcının veya tüm kullanıcıların aktif oturumlarını sonlandırabilme yetkisine sahip olduğu doğrulanmalıdır.2V7.55Oturum Kötüye Kullanımına Karşı SavunmalarV7.5.11E-posta adresi, telefon numarası, MFA yapılandırması veya hesap kurtarmada kullanılan diğer bilgiler gibi kimlik doğrulamayı etkileyebilecek hassas hesap özniteliklerinde değişiklik yapılmadan önce uygulamanın tam yeniden kimlik doğrulama gerektirdiği doğrulanmalıdır.2V7.5.22Kullanıcıların, (en az bir faktörle yeniden kimlik doğrulama yaptıktan sonra) mevcut tüm aktif oturumları görüntüleyebilmesi ve sonlandırabilmesinin mümkün olduğu doğrulanmalıdır.2V7.5.33Uygulamanın, son derece hassas işlemler veya operasyonlar gerçekleştirilmeden önce en az bir faktörle ek kimlik doğrulaması veya ikincil bir doğrulama gerektirdiği doğrulanmalıdır.3V7.66Birleşik Yeniden Kimlik DoğrulamaV7.6.11Güvenen Taraf (RP) ile Kimlik Sağlayıcı (IdP) arasındaki oturum süresi ve oturum sonlandırma davranışlarının belgelenmiş olduğu ve, örneğin IdP kimlik doğrulama olayları arasında maksimum süreye ulaşıldığında yeniden kimlik doğrulamanın gerekli kılındığı doğrulanmalıdır.2V7.6.22Yeni bir oturum oluşturulmasının, kullanıcı onayı veya açık bir eylem gerektirdiği; kullanıcı etkileşimi olmaksızın yeni uygulama oturumlarının oluşturulmasının önlendiği doğrulanmalıdır.2V88AuthorizationYetkilendirmeV8.11Yetkilendirme DokümantasyonuV8.1.11Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak işlev düzeyinde ve veriye özel erişim kısıtlamaları için kuralları tanımladığı doğrulanmalıdır.1V8.1.22Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak alan (field) düzeyinde erişim kısıtlamaları (hem okuma hem yazma) için kuralları tanımladığı doğrulanmalıdır. Bu kuralların, ilgili veri nesnesinin durum veya statü gibi diğer özniteliklerine bağlı olabileceği unutulmamalıdır.2V8.1.33Uygulamanın dokümantasyonunun, kimlik doğrulama ve yetkilendirme ile ilgili güvenlik kararlarının alınmasında kullanılan çevresel ve bağlamsal öznitelikleri (günün saati, kullanıcı konumu, IP adresi veya cihaz gibi) tanımladığı doğrulanmalıdır.3V8.1.44Kimlik doğrulama ve yetkilendirme dokümantasyonunun; işlev düzeyinde, veriye özel ve alan düzeyinde yetkilendirmenin yanı sıra çevresel ve bağlamsal faktörlerin karar almada nasıl kullanıldığını tanımladığı doğrulanmalıdır. Bu, değerlendirilen öznitelikleri, risk eşiklerini ve alınan aksiyonları (ör. izin ver, doğrulama iste, reddet, step-up kimlik doğrulama) içermelidir.3V8.22Genel Yetkilendirme TasarımıV8.2.11Uygulamanın, işlev düzeyindeki erişimin yalnızca açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır.1V8.2.22Uygulamanın, veriye özel erişimin yalnızca belirli veri öğelerine açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, doğrudan nesne referansı güvenlik açıkları (IDOR) ve bozuk nesne düzeyinde yetkilendirme (BOLA) risklerini azaltır.1V8.2.33Uygulamanın, alan (field) düzeyindeki erişimin yalnızca belirli alanlara açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, bozuk nesne özelliği düzeyinde yetkilendirme (BOPLA) risklerini azaltır.2V8.2.44Tüketicinin çevresel ve bağlamsal özniteliklerine (ör. günün saati, konum, IP adresi veya cihaz) dayalı uyarlanabilir güvenlik kontrollerinin, uygulama dokümantasyonunda tanımlandığı şekilde, kimlik doğrulama ve yetkilendirme kararları için uygulandığı doğrulanmalıdır. Bu kontroller, tüketici yeni bir oturum başlatmaya çalışırken ve mevcut bir oturum sırasında uygulanmalıdır.3V8.33İşlem Düzeyinde YetkilendirmeV8.3.11Uygulamanın yetkilendirme kurallarını güvenilir bir servis katmanında uyguladığı ve istemci taraflı JavaScript gibi güvenilmeyen tüketiciler tarafından değiştirilebilecek kontrollerle yetinmediği doğrulanmalıdır.1V8.3.22Yetkilendirme kararlarının temelini oluşturan değerlerdeki değişikliklerin hemen uygulandığı doğrulanmalıdır. Değişikliklerin anında uygulanamadığı durumlarda (örneğin self-contained token içindeki verilere güveniliyorsa), tüketici artık yetkili olmadığı hâlde bir işlem gerçekleştirdiğinde uyarı verecek ve değişikliği geri alacak önlemler uygulanmalıdır. Bu alternatifin bilgi sızıntısını önlemeyeceği unutulmamalıdır.3V8.3.33Bir nesneye erişimin, herhangi bir aracı veya onun adına hareket eden bir servis yerine yalnızca erişimi başlatan öznenin (ör. tüketici) izinlerine dayandığı doğrulanmalıdır. Örneğin, bir tüketici kimlik doğrulama için bir self-contained token kullanarak bir web servis çağırırsa ve bu servis başka bir servisten veri talep ederse, ikinci servis izin kararlarını verirken birinci servisin makine-makine token'ı yerine tüketicinin token'ını kullanmalıdır.3V8.44Diğer Yetkilendirme HususlarıV8.4.11Multi-tenant uygulamaların, tüketici işlemlerinin izinli olmadıkları tenant'lar üzerinde asla etkili olmamasını sağlamak için tenant'lar arası kontroller kullandığı doğrulanmalıdır.2V8.4.22Yönetici arayüzlerine erişimin, sürekli tüketici kimlik doğrulaması, cihaz güvenlik durumu değerlendirmesi ve bağlamsal risk analizi dahil olmak üzere çok katmanlı güvenlik içerdiği doğrulanmalıdır. Yetkilendirme için yalnızca ağ konumu veya güvenilir uç noktalar yeterli olmamalıdır; ancak bu tür faktörler yetkisiz erişim olasılığını azaltabilir.3V99SelfKendi İçinde Taşıyıcı Token (Self-contained Token)V9.11Token Kaynağı ve BütünlüğüV9.1.11Self-contained token'ların içerikleri kabul edilmeden önce, oynama (tampering) saldırılarına karşı dijital imza veya MAC ile doğrulama yapıldığı doğrulanmalıdır.1V9.1.22Belirli bir bağlam için yalnızca bir allowlist üzerinde bulunan algoritmaların self-contained token oluşturmak ve doğrulamak için kullanılabildiği doğrulanmalıdır. Bu allowlist, yalnızca simetrik ya da yalnızca asimetrik algoritmaları içermeli ve kesinlikle 'None' algoritmasını içermemelidir. Hem simetrik hem de asimetrik algoritmalar desteklenmek zorundaysa, anahtar karışıklığını (key confusion) önlemek için ek kontroller uygulanmalıdır.1V9.1.33Self-contained token'ları doğrulamak için kullanılan anahtar malzemesinin, token issuer için önceden yapılandırılmış güvenilir kaynaklardan alındığı doğrulanmalıdır. Bu, saldırganların güvenilmeyen kaynak ve anahtarları belirtmesini engeller. JWT ve diğer JWS yapılarında 'jku', 'x5u' ve 'jwk' gibi header'lar güvenilir kaynaklardan oluşan bir allowlist'e göre doğrulanmalıdır.1V9.22Token İçeriğiV9.2.11Token verisinde bir geçerlilik zaman aralığı (validity time span) varsa, yalnızca doğrulama zamanı bu zaman aralığı içerisindeyse token ve içeriği kabul edilmelidir. Örneğin, JWT'ler için 'nbf' ve 'exp' claim'leri doğrulanmalıdır.1V9.2.22Token'ı alan hizmetin, token içeriğini kabul etmeden önce bu token'ın doğru türde olduğunu ve sunulma amacına uygun olduğunu doğruladığı teyit edilmelidir. Örneğin, yalnızca erişim token'ları yetkilendirme kararları için, yalnızca ID Token'lar kullanıcı kimlik doğrulamasını kanıtlamak için kullanılabilir.2V9.2.33Hizmetin yalnızca kendisiyle kullanılması amaçlanan (audience) token'ları kabul ettiği doğrulanmalıdır. JWT'lerde bu, 'aud' claim'inin hizmet içinde tanımlı bir allowlist ile doğrulanması yoluyla sağlanabilir.2V9.2.44Eğer bir token issuer, farklı audience'lara token oluşturmak için aynı private key'i kullanıyorsa, oluşturulan token'ların hedef audience'ları benzersiz şekilde tanımlayan bir audience kısıtlaması içerdiği doğrulanmalıdır. Bu, bir token'ın farklı bir audience ile yeniden kullanılmasını önler. Audience tanımlayıcısı dinamik olarak sağlanıyorsa, token issuer bu audience'ları doğrulamalı ve audience taklitlerinin (impersonation) önüne geçmelidir.2V1010OAuthOAuth ve OIDCV10.11Genel OAuth ve OIDC GüvenliğiV10.1.11Token'ların yalnızca kesinlikle ihtiyaç duyan bileşenlere gönderildiği doğrulanmalıdır. Örneğin, tarayıcı tabanlı JavaScript uygulamaları için bir backend-for-frontend modeli kullanıldığında, access ve refresh token'lara yalnızca backend'in erişebilmesi gerekir.2V10.1.22Authorization server'dan gelen değerler (örneğin authorization code veya ID Token gibi) yalnızca aynı user agent oturumu ve işlemi tarafından başlatılmış bir yetkilendirme akışının sonucuysa kabul edildiği doğrulanmalıdır. Bu, client tarafından oluşturulan secret’ların 'proof key for code exchange' (PKCE) ‘code_verifier’, ‘state’ veya OIDC ‘nonce’ gibi tahmin edilemez, işleme özgü ve hem client’a hem de işlem başlatılan user agent oturumuna güvenli bir şekilde bağlı olmasını gerektirir.2V10.22OAuth İstemcisiV10.2.11Code flow kullanılıyorsa, OAuth client’ın token taleplerini tetikleyen CSRF saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Bu genellikle PKCE kullanılarak veya authorization isteğinde gönderilen ‘state’ parametresinin kontrolü ile sağlanır.2V10.2.22OAuth istemcisi birden fazla AS ile etkileşime girebiliyorsa, mix-up saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Örneğin, authorization server’ın 'iss' parametresini döndürmesi zorunlu kılınabilir ve bu parametrenin hem authorization yanıtında hem de token yanıtında doğrulanması gerekir.2V10.2.33OAuth istemcisinin authorization server’a yaptığı taleplerde yalnızca gerekli scope’ları (veya diğer yetkilendirme parametrelerini) talep ettiği doğrulanmalıdır.3V10.33OAuth Kaynak Sunucusu (RS)V10.3.11RS'nin yalnızca bu servisle kullanılmak üzere tasarlanmış access token’ları kabul ettiği doğrulanmalıdır (audience kontrolü). Audience bilgisi yapılandırılmış token’larda (örneğin JWT içindeki ‘aud’ claim’i) yer alabilir veya token introspection endpoint aracılığıyla kontrol edilebilir.2V10.3.22RS'nin, access token’dan gelen claim’lere dayanarak yetki devri tanımına uygun şekilde yetkilendirme kararları uyguladığı doğrulanmalıdır. ‘sub’, ‘scope’ ve ‘authorization_details’ gibi claim’ler varsa, bu kararın parçası olmalıdır.2V10.3.33Erişim kontrolü kararında, access token’dan (JWT veya ilgili token introspection yanıtı) benzersiz bir kullanıcının tanımlanması gerekiyorsa, RS'nin başka kullanıcılara devredilemeyecek claim’ler ile kullanıcıyı tanımladığı doğrulanmalıdır. Genellikle bu, ‘iss’ ve ‘sub’ claim’lerinin birlikte kullanılması anlamına gelir.2V10.3.44RS'nin belirli bir kimlik doğrulama gücü, yöntemi veya güncelliği (recentness) gerektirmesi durumunda, sunulan access token’ın bu kısıtlamaları karşıladığını doğruladığı, örneğin, OIDC ‘acr’, ‘amr’ ve ‘auth_time’ claim’leri kullanılarak doğrulanmalıdır. 2V10.3.55RS'nin, (yetkisiz taraflarca) çalınmış veya tekrar edilen access token’ların kullanımını önlemek için sender-constrained access token’lar kullandığı doğrulanmalıdır. Bu, OAuth 2 için Mutual TLS veya OAuth 2 Demonstration of Proof of Possession (DPoP) ile sağlanabilir.3V10.44OAuth Yetkilendirme Sunucusu (AS)V10.4.11AS'nin, istemciye özel önceden kaydedilmiş URI’lerden oluşan bir allowlist kullanarak redirect URI’leri tam dize karşılaştırması ile doğruladığı doğrulanmalıdır.1V10.4.22AS'nin, "authorization response" içinde "authorization code" döndürdüğü durumlarda, bu kodun yalnızca bir kez kullanılabildiği doğrulanmalıdır. Daha önce access token vermek için kullanılmış bir authorization code ile yapılan ikinci geçerli token isteği reddedilmeli ve ilgili tüm token’lar iptal edilmelidir.1V10.4.33Authorization code’un kısa ömürlü olduğu doğrulanmalıdır. L1 ve L2 uygulamalar için maksimum yaşam süresi 10 dakika, L3 uygulamalar için 1 dakikadır.1V10.4.44Belirli bir istemci için AS'nin yalnızca o istemcinin ihtiyaç duyduğu grant türlerine izin verdiği doğrulanmalıdır. "Token" (Implicit flow) ve "password" (Resource Owner Password Credentials flow) grant türlerinin artık kullanılmaması gerekir.1V10.4.55AS'nin, açık istemciler için refresh token replay saldırılarını azalttığı doğrulanmalıdır. Tercihen sender-constrained refresh token’lar (DPoP veya mutual TLS ile certificate-bound access token’lar) kullanılmalıdır. L1 ve L2 uygulamalar için refresh token rotation kullanılabilir. Rotation kullanılıyorsa, AS refresh token’ı kullanım sonrası geçersiz kılmalı ve geçersiz bir refresh token sunulması durumunda o yetkilendirme ile ilişkili tüm refresh token’ları iptal etmelidir.1V10.4.66Code grant kullanılıyorsa, AS'nin authorization code interception saldırılarına karşı koruma sağladığı doğrulanmalıdır. Yetkilendirme isteğinde geçerli bir "code_challenge" değeri zorunlu olmalı ve "code_challenge_method" olarak "plain" kabul edilmemelidir. Token isteğinde ise "code_verifier" parametresi doğrulanmalıdır.2V10.4.77AS'nin, kimlik doğrulaması yapılmamış dinamik istemci kaydını desteklemesi durumunda, kötü niyetli istemci uygulamalarına karşı riskleri azalttığı doğrulanmalıdır. Kayıtlı URI’ler gibi client metadata’sı doğrulanmalı, kullanıcı onayı alınmalı ve güvenilmeyen bir client uygulamasıyla yapılan yetkilendirme isteği işlenmeden önce kullanıcı uyarılmalıdır.2V10.4.88Refresh token’ların, sliding expiration kullanılsa bile mutlak bir sona erme süresine sahip olduğu doğrulanmalıdır.2V10.4.99Yetkili bir kullanıcı tarafından AS kullanıcı arayüzü üzerinden refresh token’ların ve reference access token’ların iptal edilebildiği doğrulanmalıdır.2V10.4.1010Gizli istemcilerin token istekleri, pushed authorization request (PAR) ve token iptal istekleri gibi server’a yapılan backchannel isteklerinde kimliğinin kontrol edildiği doğrulanmalıdır.2V10.4.1111AS yapılandırmasının, OAuth istemcisine yalnızca gerekli scope’ları atadığı doğrulanmalıdır.2V10.4.1212Belirli bir client için, authorization server’ın yalnızca client’ın ihtiyaç duyduğu 'response_mode' değerine izin verdiği doğrulanmalıdır. Örneğin, bu değer ya beklenenlerle karşılaştırılarak doğrulanmalı ya da PAR veya JAR kullanılmalıdır.3V10.4.1313"Code" grant türünün daima pushed authorization request (PAR) ile birlikte kullanıldığı doğrulanmalıdır.3V10.4.1414AS'nin yalnızca sender-constrained (Proof-of-Possession) access token’lar ürettiği doğrulanmalıdır. Bu, mutual TLS ile certificate-bound access token ya da DPoP ile DPoP-bound access token olabilir.3V10.4.1515Sunucu taraflı istemciler için (kullanıcı cihazında çalışmayan), AS'nin "authorization_details" parametresinin istemci backend'i tarafından sağlandığını ve kullanıcı tarafından değiştirilmediğini doğruladığı, örneğin pushed authorization request (PAR) or JWT-secured Authorization Request (JAR) zorunlu kılınarak doğrulanmalıdır.3V10.4.1616Bir istemci gizli ise, AS'nin güçlü istemci kimlik doğrulama yöntemlerini zorunlu kıldığı doğrulanmalıdır. Bu yöntemler, public-key cryptography’ye dayalı ve replay saldırılarına karşı dayanıklı olmalı, örneğin mutual TLS ("tls_client_auth", "self_signed_tls_client_auth") veya private key JWT ("private_key_jwt") gibi.3V10.55OIDC İstemcisiV10.5.11İstemcinin (relying party olarak) ID Token replay saldırılarını azalttığı doğrulanmalıdır. Örneğin, ID Token’daki 'nonce' claim’inin, OpenID Provider’a gönderilen kimlik doğrulama isteğindeki 'nonce' değeriyle eşleştiği doğrulanmalıdır.2V10.5.22İstemcinin kullanıcıyı ID Token claim’lerinden (genellikle, başka kullanıcılarla yeniden atanamayan 'sub' claim’i) benzersiz şekilde tanımladığı doğrulanmalıdır.2V10.5.33İstemcinin, kötü niyetli bir AS'nin başka bir AS'yi taklit etmesini AS metadata’sı üzerinden reddettiği doğrulanmalıdır. AS metadata’sındaki issuer URL’si, istemci tarafından beklenen önceden yapılandırılmış issuer URL’siyle tam olarak eşleşmiyorsa, metadata reddedilmelidir.2V10.5.44İstemcinin, ID Token’ın kendisi için (audience) kullanılması amaçlandığını doğruladığı doğrulanmalıdır. Bu, token’daki 'aud' claim’inin istemcinin 'client_id' değeriyle eşit olup olmadığının kontrol edilmesiyle yapılır.2V10.5.55OIDC back-channel logout kullanıldığında, relying party’nin "forced logout" ve "logout" akışında "cross-JWT confusion" gibi saldırılara karşı koruma sağladığı doğrulanmalıdır. Client, logout token’ın 'logout+jwt' türünde olduğunu, 'event' claim’inin doğru üyeye sahip olduğunu ve 'nonce' claim’i içermediğini doğrulamalıdır. Ayrıca token için kısa bir sona erme süresi (örneğin 2 dakika) önerilir.2V10.66OpenID ProviderV10.6.11OpenID Provider’ın yalnızca 'code', 'ciba', 'id_token' veya 'id_token code' response mode değerlerine izin verdiği doğrulanmalıdır. 'code' değeri, 'id_token code' (OIDC Hybrid flow) yerine tercih edilmelidir. 'token' (Implicit flow) kullanılmamalıdır.2V10.6.22OpenID Provider’ın forced logout yoluyla yapılan hizmet reddi saldırılarını önlediği doğrulanmalıdır. Bu, son kullanıcıdan açık onay alınarak veya varsa logout isteğinde (relying party tarafından başlatılan) bulunan parametrelerin, örneğin 'id_token_hint', doğrulanmasıyla yapılabilir.2V10.77Onay (Consent) YönetimiV10.7.11AS'nin her yetkilendirme isteği için kullanıcının onayını aldığı doğrulanmalıdır. İstemcinin kimliği garanti altına alınamıyorsa, AS daima kullanıcıdan açıkça onay istemelidir.2V10.7.22AS'nin kullanıcıdan onay istediğinde, neye onay verildiğini açık ve yeterli şekilde gösterdiği doğrulanmalıdır. Uygun olduğunda bu bilgiler, istenen yetkilendirmelerin doğasını (genellikle scope, resource server, RAR gibi detaylara dayalı), yetkilendirilmiş uygulamanın kimliğini ve bu yetkilendirmelerin süresini içermelidir.2V10.7.33Kullanıcının, AS üzerinden verdiği onayları görüntüleyebildiği, değiştirebildiği ve iptal edebildiği doğrulanmalıdır.2V1111CryptographyKriptografiV11.11Kriptografik Envanter ve DokümantasyonV11.1.11Kriptografik anahtarların yönetimi için belgelenmiş bir politika ve NIST SP 800-57 gibi bir anahtar yönetim standardını izleyen bir kriptografik anahtar yaşam döngüsü tanımlandığı doğrulanmalıdır. Bu, anahtarların aşırı miktarda paylaşılmadığını (örneğin, paylaşılan sırlar için ikiden fazla tarafla veya özel anahtarlar için birden fazla tarafla) garanti altına almalıdır.2V11.1.22Tüm kriptografik anahtarlar, algoritmalar ve uygulama tarafından kullanılan sertifikaları içeren bir kriptografik envanterin oluşturulduğu, sürdürüldüğü ve düzenli olarak güncellendiği doğrulanmalıdır. Bu envanter ayrıca, sistemde anahtarların nerede kullanılabileceğini ve kullanılamayacağını, ve hangi veri türlerinin bu anahtarlarla korunup korunamayacağını da belgelemelidir.2V11.1.33Sistem içerisinde şifreleme, özetleme ve imzalama işlemleri dahil olmak üzere kriptografi kullanımının tüm örneklerini tespit etmek için kriptografik keşif mekanizmalarının kullanıldığı doğrulanmalıdır.3V11.1.44Kriptografik bir envanterin sürdürüldüğü doğrulanmalıdır. Bu envanter, gelecekteki tehditlere karşı tepki verebilmek amacıyla post-kuantum kriptografiye geçiş yolunu belirten belgelenmiş bir plan içermelidir.3V11.22Güvenli Kriptografi UygulamasıV11.2.11Kriptografik işlemler için sektör tarafından doğrulanmış uygulamaların (kütüphaneler ve donanım hızlandırmalı uygulamalar dahil) kullanıldığı doğrulanmalıdır.2V11.2.22Uygulamanın, rastgele sayı üreticileri, kimliği doğrulanmış şifreleme, MAC veya özetleme algoritmaları, anahtar uzunlukları, turlar, şifreler ve modların herhangi bir zamanda yeniden yapılandırılabilir, yükseltilebilir veya değiştirilebilir olacağı şekilde kripto çevikliği (crypto agility) ile tasarlandığı doğrulanmalıdır. Aynı şekilde, anahtarların ve parolaların değiştirilebilmesi ve verilerin yeniden şifrelenebilmesi mümkün olmalıdır. Bu, onaylanmış PQC şemalarının yüksek güvenlikli uygulamaları yaygın olarak kullanılabilir hale geldiğinde sorunsuz geçişe olanak tanır.2V11.2.33Tüm kriptografik ilkeliklerin, algoritma, anahtar boyutu ve yapılandırmaya göre minimum 128 bit güvenlik sağladığı doğrulanmalıdır. Örneğin, 256-bit ECC anahtarı yaklaşık 128 bit güvenlik sağlarken, RSA için aynı güvenliği elde etmek 3072-bit anahtar gerektirir.2V11.2.44Tüm kriptografik işlemlerin sabit süreli (constant-time) olduğu, karşılaştırmalarda, hesaplamalarda veya geri dönüşlerde kısa devre (short-circuit) işlemleri yapılmadığı doğrulanmalıdır; bu, bilgi sızıntısını önlemek için gereklidir.3V11.2.55Tüm kriptografik modüllerin güvenli şekilde hata verdiği ve hataların, padding oracle saldırıları gibi zafiyetleri mümkün kılmayacak şekilde ele alındığı doğrulanmalıdır.3V11.33Şifreleme AlgoritmalarıV11.3.11Güvensiz blok modlarının (örneğin, ECB) ve zayıf doldurma (padding) şemalarının (örneğin, PKCS#1 v1.5) kullanılmadığı doğrulanmalıdır.1V11.3.22Yalnızca AES ile GCM gibi onaylı şifreleme algoritmalarının ve modlarının kullanıldığı doğrulanmalıdır.1V11.3.33Şifrelenmiş verilerin yetkisiz değişikliklere karşı korunduğu doğrulanmalıdır. Tercihen bu koruma, onaylı bir kimliği doğrulanmış şifreleme yöntemi kullanılarak ya da onaylı bir şifreleme yöntemi ile onaylı bir MAC algoritmasının kombinasyonu ile sağlanmalıdır.2V11.3.44Sayılar, başlatma vektörleri (IV) ve diğer tek kullanımlık değerlerin, aynı şifreleme anahtarı ve veri öğesi çifti için birden fazla kez kullanılmadığı doğrulanmalıdır. Oluşturma yöntemi kullanılan algoritmaya uygun olmalıdır.3V11.3.55Şifreleme algoritması ve MAC algoritması kombinasyonlarının "encrypt-then-MAC" modunda çalıştığı doğrulanmalıdır.3V11.44Hashing ve Hash Tabanlı FonksiyonlarV11.4.11Dijital imzalar, HMAC, KDF ve rastgele bit üretimi gibi genel kriptografik kullanım senaryolarında yalnızca onaylı hash fonksiyonlarının kullanıldığı doğrulanmalıdır. MD5 gibi yasaklı hash fonksiyonları hiçbir kriptografik amaçla kullanılmamalıdır.1V11.4.22Parolaların, onaylı, hesaplama açısından yoğun ve mevcut rehberliğe göre yapılandırılmış bir anahtar türetme fonksiyonu (diğer adıyla parola hash'leme fonksiyonu) kullanılarak saklandığı doğrulanmalıdır. Ayarlar, güvenlik ve performans dengesini sağlayarak kaba kuvvet saldırılarını zorlaştırmalıdır.2V11.4.33Dijital imzalarda kullanılan hash fonksiyonlarının, veri bütünlüğü ve kimlik doğrulama amacıyla kullanıldığında çakışmaya karşı dayanıklı ve yeterli bit uzunluğuna sahip olduğu doğrulanmalıdır. Çakışma dayanıklılığı gerekiyorsa çıktı uzunluğu en az 256 bit olmalıdır. Sadece ikinci ön-görüntü (2nd pre-iamge) saldırılarına karşı dayanıklılık gerekiyorsa çıktı uzunluğu en az 128 bit olmalıdır.2V11.4.44Parolalardan gizli anahtarlar türetilirken, onaylı anahtar türetme fonksiyonlarının anahtar uzatma (key stretching) parametreleriyle birlikte kullanıldığı doğrulanmalıdır. Bu parametreler, kaba kuvvet saldırılarını önleyecek şekilde güvenlik ve performans dengesine sahip olmalıdır.2V11.55Rastgele DeğerlerV11.5.11Tahmin edilemez olması amaçlanan tüm rastgele sayıların ve dizelerin, CSPRNG ile oluşturulduğu ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. UUID'lerin bu koşulu dikkate almadığını unutmayın.2V11.5.22Kullanılan rastgele sayı üretim mekanizmasının, yoğun talep altında dahi güvenli çalışacak şekilde tasarlandığı doğrulanmalıdır.3V11.66Açık Anahtar (Public Key) KriptografisiV11.6.11Anahtar üretimi, tohumlama (seeding) ve dijital imza üretimi ve doğrulama için yalnızca onaylı kriptografik algoritmalar ve çalışma modlarının kullanıldığı doğrulanmalıdır. Anahtar üretim algoritmaları, bilinen saldırılara karşı savunmasız anahtarlar üretmemelidir. Örneğin, Fermat çarpanlama yöntemine karşı savunmasız RSA anahtarları oluşturulmamalıdır.2V11.6.22Anahtar değişimi için yalnızca onaylı kriptografik algoritmaların kullanıldığı doğrulanmalıdır (örneğin Diffie-Hellman). Kullanılan parametrelerin güvenli olması gerektiğine dikkat edilmelidir. Bu, anahtar kurulum sürecine yönelik saldırıları önleyecek ve araya girme (adversary-in-the-middle) ya da kriptografik kırılmaları engelleyecektir.3V11.77Kullanım Halindeki Verilerin KriptografisiV11.7.11Hassas verilerin kullanım sırasında korunmasını sağlamak amacıyla, yetkisiz kullanıcıların veya süreçlerin bu verilere erişmesini engelleyen tam bellek şifrelemesinin kullanıldığı doğrulanmalıdır.3V11.7.22Veri asgariyetinin sağlandığı, yani işleme sırasında mümkün olan en az miktarda verinin ortaya çıktığı ve verilerin kullanımdan hemen sonra veya mümkün olan en kısa sürede şifrelendiği doğrulanmalıdır.3V1212SecureGüvenli İletişimV12.11Genel TLS Güvenlik RehberiV12.1.11Yalnızca TLS protokolünün en güncel ve önerilen sürümlerinin (örneğin TLS 1.2 ve TLS 1.3) etkinleştirildiği ve en son sürümün varsayılan olarak tercih edildiği doğrulanmalıdır.1V12.1.22Yalnızca önerilen şifre takımlarının (cipher suite) etkinleştirildiği ve en güçlü şifre takımlarının tercih edildiği doğrulanmalıdır. Seviye 3 (L3) uygulamalar yalnızca ileri gizlilik (forward secrecy) sağlayan şifre takımlarını desteklemelidir.2V12.1.33Uygulamanın, mTLS istemci sertifikalarını kimlik doğrulama veya yetkilendirme amacıyla kullanmadan önce bu sertifikaların güvendiği sertifikalar arasında olduğunu doğruladığı kontrol edilmelidir.2V12.1.44Online Certificate Status Protocol (OCSP) Stapling gibi geçerli bir sertifika iptal kontrolü yönteminin etkinleştirildiği ve yapılandırıldığı doğrulanmalıdır.3V12.1.55TLS el sıkışma (handshake) sürecinde Server Name Indication (SNI) gibi hassas meta verilerin ifşa edilmesini önlemek için, uygulamanın TLS yapılandırmasında Encrypted Client Hello (ECH) özelliğinin etkinleştirildiği doğrulanmalıdır.3V12.22Dışa Açık Hizmetlerle HTTPS İletişimiV12.2.11İstemci ile dışa açık, HTTP tabanlı hizmetler arasındaki tüm bağlantılarda TLS kullanıldığı ve bu bağlantıların güvensiz ya da şifrelenmemiş iletişime geri dönmediği doğrulanmalıdır.1V12.2.22Dışa açık hizmetlerin herkese açık olarak güvenilen TLS sertifikaları kullandığı doğrulanmalıdır.1V12.33Genel Servisler Arası İletişim GüvenliğiV12.3.11Uygulamaya gelen ve uygulamadan çıkan tüm bağlantılarda izleme sistemleri, yönetim araçları, uzaktan erişim ve SSH, ara yazılımlar, veritabanları, ana sistemler (mainframe), iş ortağı sistemleri ya da dış API'ler dahil olmak üzere TLS gibi şifreli bir protokolün kullanıldığı ve güvensiz ya da şifrelenmemiş protokollere geri dönülmediği doğrulanmalıdır.2V12.3.22TLS istemcilerinin bir TLS sunucusu ile iletişime geçmeden önce alınan sertifikaları doğruladığı kontrol edilmelidir.2V12.3.33Uygulama içindeki HTTP tabanlı iç hizmetler arasında gerçekleşen tüm bağlantılarda TLS ya da uygun başka bir aktarım şifreleme mekanizmasının kullanıldığı ve güvensiz ya da şifrelenmemiş iletişime geri dönülmediği doğrulanmalıdır.2V12.3.44İç hizmetler arasındaki TLS bağlantılarında güvenilir sertifikaların kullanıldığı doğrulanmalıdır. İç sistemlerde oluşturulmuş ya da kendinden imzalı (self-signed) sertifikalar kullanılıyorsa, bu sertifikalara güvenen hizmetlerin yalnızca belirli dahili sertifika otoritelerine (CA) ve belirli kendinden imzalı sertifikalara güvenecek şekilde yapılandırıldıkları doğrulanmalıdır.2V12.3.55Sistem içindeki hizmetlerin birbiriyle iletişim kurarken her bir uç noktanın kimliğini doğrulamak için güçlü kimlik doğrulama yöntemlerinin kullanıldığı doğrulanmalıdır. Bu yöntemler arasında, açık anahtar altyapısı (public-key infrastructure) kullanan ve tekrar oynatma saldırılarına karşı dayanıklı olan TLS istemci kimlik doğrulaması gibi yöntemler yer almalıdır. Mikroservis mimarilerinde, sertifika yönetimini basitleştirmek ve güvenliği artırmak amacıyla bir servis ağı (service mesh) kullanılması değerlendirilmelidir.3V1313ConfigurationKonfigürasyonV13.11Konfigürasyon DokümantasyonuV13.1.11Uygulamanın tüm iletişim ihtiyaçlarının dokümante edildiği doğrulanmalıdır. Buna, uygulamanın bağımlı olduğu dış hizmetler ve son kullanıcının uygulamanın bağlantı kurmasını sağlayabileceği dış konumlar da dahil olmalıdır.2V13.1.22Uygulamanın kullandığı her bir hizmet için, dokümantasyonda eşzamanlı bağlantı sayısı (örn. bağlantı havuzu limitleri) ve bu sınır aşıldığında uygulamanın davranışı, geri dönüş veya kurtarma mekanizmaları da dahil olmak üzere hizmet reddi koşullarını önlemek için tanımlandığı doğrulanmalıdır.3V13.1.33Uygulamanın, kullandığı her bir dış sistem veya hizmet (örn. veritabanları, dosya tanıtıcıları, iş parçacıkları, HTTP bağlantıları) için kaynak yönetimi stratejilerini tanımladığı doğrulanmalıdır. Bu stratejiler, kaynak serbest bırakma prosedürlerini, zaman aşımı ayarlarını, hata durumlarını ve tekrar deneme mantığı uygulanmışsa sınırları, gecikmeleri ve geri çekilme (back-off) algoritmalarını içermelidir. Senkron HTTP istek–yanıt işlemleri için kısa zaman aşımı süreleri zorunlu tutulmalı ve tekrar eden denemeler devre dışı bırakılmalı ya da sıkı şekilde sınırlandırılmalıdır.3V13.1.44Uygulamanın, güvenlik açısından kritik olan gizli verileri tanımladığı ve kuruluşun tehdit modeli ve iş ihtiyaçlarına göre bu verilerin döndürülme (rotation) zamanlamasının belgelendiği doğrulanmalıdır.3V13.22Backend İletişim KonfigürasyonuV13.2.11Uygulamanın, standart kullanıcı oturum mekanizmasını desteklemeyen backend bileşenleri (örneğin API'ler, ara katmanlar, veri katmanları) arasında gerçekleşen iletişimlerin kimlik doğrulamasıyla korunduğu doğrulanmalıdır. Kimlik doğrulama; bireysel hizmet hesapları, kısa ömürlü token'lar ya da sertifika tabanlı kimlik doğrulama ile yapılmalıdır ve parola, API anahtarı ya da ayrıcalıklı erişime sahip paylaşımlı hesaplar gibi sabit kimlik bilgileri kullanılmamalıdır.2V13.2.22Uygulamanın backend bileşenleri arasında (yerel hizmetler, işletim sistemi hizmetleri, API'ler, ara katmanlar ve veri katmanları dahil) gerçekleştirilen iletişimlerin, yalnızca gerekli en az ayrıcalığa sahip hesaplarla yapıldığı doğrulanmalıdır.2V13.2.33Bir hizmet kimlik doğrulaması için bir kimlik bilgisi kullanılması gerekiyorsa, bu kimlik bilgisinin varsayılan bir değer (örneğin root/root veya admin/admin) olmadığının doğrulanması gereklidir.2V13.2.44Uygulamanın iletişim kurmasına izin verilen dış kaynaklar ya da sistemlerin, bir allowlist (izinli liste) ile tanımlandığı doğrulanmalıdır. Bu liste, uygulama katmanında, web sunucusunda, güvenlik duvarında veya farklı katmanların birleşiminde uygulanabilir.2V13.2.55Web veya uygulama sunucusunun, dış sistemlere veri veya dosya gönderimi veya yüklemesi yaparken sadece belirli kaynaklara izin verecek şekilde allowlist ile yapılandırıldığı doğrulanmalıdır.2V13.2.66Uygulamanın farklı hizmetlere bağlantı kurduğu durumlarda, bu bağlantılar için belgelenmiş yapılandırmaları (örn. maksimum eşzamanlı bağlantı, bağlantı limiti aşıldığında davranış, zaman aşımı, tekrar deneme stratejileri) takip ettiğinin doğrulanması gereklidir.3V13.33Gizli Bilgi YönetimiV13.3.11Parolalar, anahtar materyalleri, veritabanı ve üçüncü parti sistemlerle entegrasyon bilgileri, zaman tabanlı token'lar için tohum (seed) bilgileri, dahili gizli veriler ve API anahtarları gibi backend sırlarının güvenli bir şekilde oluşturulması, saklanması, erişim denetiminin sağlanması ve imha edilmesi için bir gizli bilgi yönetim çözümünün (örneğin key vault) kullanıldığı doğrulanmalıdır. Bu gizli bilgiler uygulama kaynak koduna dahil edilmemeli ve yapı çıktılarında yer almamalıdır. Seviye 3 uygulamalar için donanım destekli bir çözüm (örneğin HSM) gereklidir.2V13.3.22Gizli bilgilere erişimin en az ayrıcalık prensibine uygun şekilde yapılandırıldığı doğrulanmalıdır.2V13.3.33Tüm kriptografik işlemlerin, anahtar materyallerinin güvenli bir şekilde yönetilmesi ve dışarıya sızmasının engellenmesi amacıyla, izole edilmiş bir güvenlik modülü (örneğin vault ya da donanım güvenlik modülü) aracılığıyla gerçekleştirildiği doğrulanmalıdır.3V13.3.44Uygulamanın belgelerinde belirtildiği şekilde gizli bilgilerin süresinin dolacak şekilde yapılandırıldığı ve düzenli olarak döndürüldüğü doğrulanmalıdır.3V13.44İstenmeyen Bilgi SızıntısıV13.4.11Uygulamanın .git veya .svn klasörleri gibi kaynak kontrolüyle ilgili metadata içermeyecek şekilde deploy edildiğini ya da bu klasörlerin hem dış erişime hem de uygulama erişimine kapalı olduğu doğrulanmalıdır.1V13.4.22Tüm bileşenler için üretim ortamlarında hata ayıklama (debug) modlarının devre dışı bırakıldığı doğrulanmalıdır.2V13.4.33Web sunucularının, açık şekilde istenmediği sürece dizin listelemesi (directory listing) özelliğini istemcilere sunmadığı doğrulanmalıdır.2V13.4.44HTTP TRACE metodunun üretim ortamlarında desteklenmediği, böylece potansiyel bilgi sızıntılarının önlendiği doğrulanmalıdır.2V13.4.55Belgeler (örneğin dahili API belgeleri) ve izleme uç noktalarının (monitoring endpoints) yalnızca açıkça belirtildiği durumlarda erişilebilir olduğu doğrulanmalıdır.2V13.4.66Uygulamanın arka uç bileşenlerinin ayrıntılı sürüm bilgilerini ifşa etmediği doğrulanmalıdır.3V13.4.77Web katmanının yalnızca belirli dosya uzantılarına sahip dosyaları sunacak şekilde yapılandırıldığı, bu sayede istem dışı bilgi, yapılandırma ya da kaynak kod sızıntılarının önlendiği doğrulanmalıdır.3V1414DataVeri KorumaV14.11Veri Koruma DokümantasyonuV14.1.11Uygulama tarafından oluşturulan ve işlenen tüm hassas verilerin tanımlanıp, koruma seviyelerine göre sınıflandırıldığından emin olun. Bu, yalnızca kodlanmış (örneğin Base64 stringleri ya da JWT içindeki düz metin yükler gibi) ve bu nedenle kolayca çözülebilir verileri de içermelidir. Koruma seviyeleri, uygulamanın uymakla yükümlü olduğu veri koruma ve gizlilik düzenlemeleri ile standartlarını dikkate almalıdır.2V14.1.22Tüm hassas veri koruma seviyeleri için belgelenmiş bir koruma gereksinimleri seti tanımlandığından emin olun. Bu gereksinimler genel şifreleme, bütünlük doğrulama, saklama süresi, verinin nasıl günlüğe kaydedileceği, günlüklerdeki hassas verilere erişim kontrolleri, veritabanı düzeyinde şifreleme, gizlilik ve gizliliği artırıcı teknolojiler ile diğer gizlilik gereksinimlerini kapsamalıdır.2V14.22Genel Veri KorumasıV14.2.11Hassas verilerin yalnızca HTTP message body veya header alanlarında sunucuya gönderildiği ve URL ile sorgu parametrelerinin, API anahtarı veya session token’ı gibi hassas bilgiler içermediği doğrulanmalıdır.1V14.2.22Hassas verilerin, yük dengeleyiciler ve uygulama önbellekleri gibi sunucu bileşenlerinde önbelleğe alınmasının engellendiği veya kullanım sonrası bu verilerin güvenli biçimde temizlendiği doğrulanmalıdır.2V14.2.33Uygulama kontrolü dışında veri toplanmasını engellemek için, tanımlanmış hassas verilerin, kullanıcı izleyicileri gibi güvensiz taraflara gönderilmediği doğrulanmalıdır.2V14.2.44Hassas verilere yönelik şifreleme, bütünlük doğrulama, veri saklama, loglama yöntemi, loglardaki erişim kontrolleri, gizlilik teknolojileri gibi kontrollerin, söz konusu verinin belgelenmiş koruma seviyesinde tanımlandığı şekilde uygulandığı doğrulanmalıdır.2V14.2.55Önbellekleme mekanizmalarının yalnızca belirli içerik türüne sahip yanıtları önbelleğe alacak şekilde yapılandırıldığı ve hassas, dinamik içeriklerin önbelleğe alınmadığı doğrulanmalıdır. Web sunucusu, mevcut olmayan bir dosya talebinde geçerli ama farklı bir dosya döndürmek yerine 404 veya 302 cevabı vermelidir. Bu, Web Cache Deception saldırılarını önlemeye yardımcı olur.3V14.2.66Uygulamanın yalnızca işlevsellik için gerekli olan asgari hassas veriyi döndürdüğü doğrulanmalıdır. Örneğin, kredi kartı numarasının yalnızca bazı rakamlarının döndürülmesi; tam numaranın döndürülmesi gerekiyorsa, kullanıcı arayüzünde gizlenmiş (maskelenmiş) şekilde sunulması gerekir, aksi kullanıcı özel olarak görüntülemek istemedikçe gösterilmemelidir.3V14.2.77Hassas bilgilerin, veri saklama sınıflandırmasına tabi tutulduğu, geçerliliğini yitirmiş veya artık gerekli olmayan verilerin belirlenmiş bir zaman çizelgesiyle ya da gerektiğinde otomatik olarak silindiği doğrulanmalıdır.3V14.2.88Kullanıcı tarafından yüklenen dosyaların meta verilerinden hassas bilgilerin çıkarıldığı veya bu bilgilerin yalnızca kullanıcıdan açık onay alındığında saklandığı doğrulanmalıdır.3V14.33İstemci Tarafı Veri KorumasıV14.3.11Kimliği doğrulanmış verilerin, istemci veya oturum sonlandığında istemci depolamasından (örneğin tarayıcı DOM’undan) temizlendiği doğrulanmalıdır. 'Clear-Site-Data' HTTP response header bu konuda yardımcı olabilir ancak istemci tarafı, sunucu bağlantısı mevcut olmadığında da temizlik işlemini yapabiliyor olmalıdır.1V14.3.22Uygulamanın, tarayıcılarda hassas verilerin önbelleğe alınmasını önlemek amacıyla yeterli anti-önbellekleme HTTP response header (örneğin Cache-Control: no-store) ayarladığı doğrulanmalıdır.2V14.3.33Tarayıcıda depolanan verilerin (örneğin localStorage, sessionStorage, IndexedDB veya çerezler) hassas veri içermediği, yalnızca session token’larının istisna olarak kabul edildiği doğrulanmalıdır.2V1515SecureGüvenli Kodlama ve MimariV15.11Güvenli Kodlama ve Mimari DokümantasyonuV15.1.11Güvenlik açığı içeren üçüncü taraf bileşen sürümleri ve genel olarak kütüphane güncellemeleri için, uygulama dokümantasyonunda risk bazlı düzeltme zamanlarının tanımlandığı doğrulanmalıdır.1V15.1.22Yazılım bileşen listesi (Software Bill of Materials - SBOM) gibi bir envanterin tutulduğu, kullanılan tüm üçüncü taraf kütüphanelerin önceden tanımlanmış, güvenilir ve düzenli olarak güncellenen depolardan alındığı doğrulanmalıdır.2V15.1.33Uygulama dokümantasyonunda zaman veya kaynak açısından yoğun işlevlerin tanımlandığı, bu işlevlerin aşırı kullanımı durumunda kullanılabilirlik kaybının nasıl önleneceği ve yanıt oluşturma süresinin istemci zaman aşımını aşmaması için hangi önlemlerin alındığı belirtilmelidir. Örnek savunmalar kuyruklama, eşzamansız işleme, kullanıcı başına ve uygulama genelinde paralel işlem sınırlarını içerebilir.2V15.1.44Uygulama dokümantasyonunda "riskli bileşenler" olarak değerlendirilen üçüncü taraf kütüphanelerin vurgulandığı doğrulanmalıdır.3V15.1.55Uygulama dokümantasyonunda "tehlikeli işlevsellik" içeren uygulama bölümlerinin açıkça belirtildiği doğrulanmalıdır.3V15.22Güvenlik Mimarisi ve BağımlılıklarV15.2.11Uygulamanın yalnızca, belgelenmiş güncelleme ve düzeltme sürelerini aşmamış bileşenleri içerdiği doğrulanmalıdır.1V15.2.22Uygulamanın, belgelenmiş güvenlik kararları ve stratejilere dayanarak, zaman veya kaynak açısından yoğun işlevlerin neden olabileceği kullanılabilirlik kaybına karşı savunmalar uyguladığı doğrulanmalıdır.2V15.2.33Üretim ortamının yalnızca uygulamanın çalışması için gerekli işlevleri içerdiği ve test kodları, örnek kod parçaları veya geliştirme işlevleri gibi gereksiz işlevsellikleri açığa çıkarmadığı doğrulanmalıdır.2V15.2.44Üçüncü taraf bileşenlerin ve bunların tüm transitif bağımlılıklarının beklenen depolardan (iç kaynaklı ya da harici) alındığı ve bağımlılık karışıklığı (dependency confusion) saldırılarına açık olmadığı doğrulanmalıdır.3V15.2.55Uygulamanın, “tehlikeli işlevsellik” içeren veya “riskli bileşenler” kullanan bölümlerine ek korumalar uyguladığı doğrulanmalıdır. Bu korumalar sandbox, kapsülleme, konteynerleştirme veya ağ düzeyinde izolasyon gibi teknikler aracılığıyla, bir uygulama bölümünün ele geçirilmesi durumunda saldırganın diğer bölümlere sıçramasını geciktirmeyi veya engellemeyi amaçlamalıdır.3V15.33Savunmacı KodlamaV15.3.11Uygulamanın yalnızca gerekli alanların bir alt kümesini veri nesnesinden döndürdüğü doğrulanmalıdır. Örneğin, bazı alanlara kullanıcıların erişmemesi gerektiğinden tüm veri nesnesi döndürülmemelidir.1V15.3.22Uygulama backend'i harici URL’lere çağrı yaptığında, yalnızca amaçlanan işlevsellik söz konusuysa yönlendirmeleri takip edecek şekilde yapılandırıldığının doğrulanması gerekir.2V15.3.33Uygulamanın, kitlesel atama saldırılarına karşı, her bir controller ve eylem için izin verilen alanları sınırlandırarak savunmalar sağladığı doğrulanmalıdır. Örneğin, bir alan değeri, bu işlemde değiştirilmesi amaçlanmadıysa eklenememeli veya güncellenememelidir.2V15.3.44Tüm proxy ve ara katman bileşenlerinin kullanıcının orijinal IP adresini, uç kullanıcı tarafından değiştirilemeyecek güvenilir veri alanları kullanarak doğru şekilde ilettiği ve uygulamanın ve web sunucusunun bu doğru değeri, loglama ve hız sınırlama gibi güvenlik kararları için kullandığı doğrulanmalıdır. Ayrıca, orijinal IP adresinin bile dinamik IP'ler, VPN'ler veya kurumsal güvenlik duvarları nedeniyle güvenilir olmayabileceği dikkate alınmalıdır.2V15.3.55Uygulamanın değişkenlerin doğru türde olduğunu açıkça doğruladığı ve sıkı eşitlik ve karşılaştırma işlemleri kullandığı doğrulanmalıdır. Bu, değişken türüyle ilgili varsayımlardan kaynaklanan tür oynama (type juggling) veya tür karışıklığı (type confusion) güvenlik açıklarını önlemek içindir.2V15.3.66JavaScript kodunun prototip zehirleme (prototype pollution) saldırılarını önleyecek şekilde yazıldığı, örneğin, nesne literal’leri yerine Set() veya Map() gibi yapılar kullanıldığı doğrulanmalıdır.2V15.3.77Uygulamanın, özellikle framework'ün istek parametrelerinin kaynağı (sorgu dizgisi, gövde parametreleri, çerezler veya başlık alanları) arasında ayrım yapmadığı durumlarda, HTTP parametre kirliliği (HTTP parameter pollution) saldırılarına karşı savunmalar uyguladığı doğrulanmalıdır.2V15.44Güvenli Eş Zamanlılık (Concurrency)V15.4.11Çok iş parçacıklı kodda (örneğin cache'ler, dosyalar veya birden fazla iş parçacığı tarafından erişilen bellek içi nesneler gibi) paylaşılan nesnelere yalnızca thread-safe (iş parçacığı güvenli) türler ve kilitleme (lock) veya semaphore gibi senkronizasyon mekanizmaları kullanılarak erişildiği doğrulanmalıdır. Bu, yarış durumlarını ve veri bozulmasını önlemeye yöneliktir.3V15.4.22Bir kaynağın durumu üzerindeki kontroller (örneğin varlığı ya da izinleri gibi) ile bu kontrole bağlı eylemlerin tek bir atomik işlem olarak gerçekleştirildiği doğrulanmalıdır. Bu, TOCTOU (time-of-check to time-of-use) yarış durumlarını önlemeye yöneliktir. Bir dosyanın varlığının kontrol edilip ardından açılması veya bir kullanıcının erişiminin doğrulanıp ardından yetki verilmesi gibi işlemler buna örnektir.3V15.4.33Kilitlerin (locks) tutarlı biçimde kullanıldığı, iş parçacıklarının birbirini beklemesi ya da sonsuz döngüye girmesi (deadlock veya livelock) gibi durumların önlendiği doğrulanmalıdır. Ayrıca, kilitleme mantığı, kaynağı yöneten kod içinde kalmalı ve dış sınıflar veya dış kodlar tarafından istemeden veya kötü niyetli şekilde değiştirilememelidir.3V15.4.44Kaynak tahsis politikalarının, iş parçacığı açlığını önleyecek şekilde, kaynaklara adil erişimi sağladığı doğrulanmalıdır. Örneğin, thread pool (iş parçacığı havuzu) kullanımı, düşük öncelikli iş parçacıklarının da makul sürelerde çalışabilmesi için uygulanmalıdır.3V1616SecurityGüvenlik Günlüklemesi (Logging) ve Hata YönetimiV16.11Güvenlik Loglaması DokümantasyonuV16.1.11Uygulamanın teknoloji yığını boyunca her katmanda hangi olayların loglandığını, log formatlarını, logların nereye yazıldığını, nasıl kullanıldığını, erişimin nasıl kontrol edildiğini ve logların ne kadar süre saklandığını belgeleyen bir envanterin mevcut olduğu doğrulanmalıdır.2V16.22Genel LoglamaV16.2.11Her bir log girdisinin, olayın ne zaman, nerede, kim tarafından ve ne olduğuna dair detaylı bir zaman çizelgesi oluşturulmasına olanak tanıyacak gerekli meta verileri içerdiği doğrulanmalıdır.2V16.2.22Tüm loglama bileşenlerinin zaman kaynaklarının senkronize olduğu ve güvenlik olayı meta verisindeki zaman damgalarının UTC kullanarak ya da açık zaman dilimi ofsetiyle belirtildiği doğrulanmalıdır. UTC kullanımı, özellikle yaz saati uygulamaları nedeniyle oluşabilecek karışıklıkları önlemek için tavsiye edilir.2V16.2.33Uygulamanın yalnızca log envanterinde belgelenmiş dosya ve hizmetlere log yazdığı ya da ilettiği doğrulanmalıdır.2V16.2.44Logların kullanılan log işleyici (log processor) tarafından okunabildiği ve ilişkilendirilebildiği doğrulanmalıdır. Tercihen yaygın bir log formatı kullanılmalıdır.2V16.2.55Hassas veriler loglanırken, uygulamanın veri koruma seviyesine uygun olarak loglama yaptığı doğrulanmalıdır. Örneğin kimlik bilgileri veya ödeme detayları gibi bazı verilerin loglanmasına izin verilmemelidir. Session token’ları gibi veriler ise yalnızca tamamen ya da kısmen maskelenmiş ya da hash’lenmiş olarak loglanmalıdır.2V16.33Güvenlik OlaylarıV16.3.11Tüm kimlik doğrulama işlemlerinin (başarılı ve başarısız girişimler dahil) loglandığı doğrulanmalıdır. Kullanılan kimlik doğrulama türü veya faktörleri gibi ek meta veriler de toplanmalıdır.2V16.3.22Başarısız yetkilendirme girişimlerinin loglandığı doğrulanmalıdır. Seviye 3 uygulamalar için, tüm yetkilendirme kararlarının ve hassas verilere erişim olaylarının (verinin kendisi olmadan) loglandığı da doğrulanmalıdır.2V16.3.33Uygulamanın, belgelenmiş güvenlik olaylarını ve güvenlik kontrollerini aşma girişimlerini (girdi doğrulama, iş mantığı, otomasyon karşıtı kontroller vb.) logladığı doğrulanmalıdır.2V16.3.44Beklenmeyen hatalar ve güvenlik kontrolü başarısızlıkları (örneğin backend TLS hataları gibi) loglandığı doğrulanmalıdır.2V16.44Log KorumasıV16.4.11Tüm loglama bileşenlerinin, log enjeksiyonunu (log injection) önlemek amacıyla verileri uygun biçimde encode ettiği doğrulanmalıdır.2V16.4.22Logların yetkisiz erişime karşı korunduğu ve değiştirilemez olduğu doğrulanmalıdır.2V16.4.33Logların analiz, tespit, uyarı ve yükseltme amacıyla mantıksal olarak ayrı bir sisteme güvenli biçimde iletildiği doğrulanmalıdır. Böylece uygulama ihlal edilse bile logların tehlikeye girmesi önlenmiş olur.2V16.55Hata YönetimiV16.5.11Beklenmedik ya da güvenlikle ilgili bir hata oluştuğunda, tüketiciye genel bir mesaj döndürüldüğü ve yığın izleri (stack trace), sorgular, gizli anahtarlar, token’lar gibi hassas sistem içi verilerin açıklanmadığı doğrulanmalıdır.2V16.5.22Uygulamanın, dış kaynaklara erişim başarısız olduğunda bile güvenli şekilde çalışmaya devam ettiği doğrulanmalıdır. Örneğin, circuit breaker ya da graceful degradation gibi desenler kullanılmalıdır.2V16.5.33Uygulamanın hata durumlarında güvenli ve düzenli şekilde başarısız olduğu doğrulanmalıdır. Bu, örneğin doğrulama hatalarına rağmen işlemlerin işlenmesine yol açabilecek fail-open durumlarını önlemelidir.2V16.5.44Ele alınmamış tüm istisnaları yakalayacak şekilde tanımlanmış bir “son çare hata yöneticisi” bulunduğu doğrulanmalıdır. Bu, hem loglara gitmesi gereken hata detaylarının kaybolmaması hem de tüm uygulama sürecinin çökerek hizmet dışı kalmasının önlenmesi açısından önemlidir.3V1717WebRTCWebRTCV17.11TURN SunucusuV17.1.11TURN hizmetinin yalnızca özel amaçlar için ayrılmamış IP adreslerine (ör. iç ağlar, yayın adresleri, loopback) erişime izin verdiği doğrulanmalıdır. Bu gereksinim hem IPv4 hem de IPv6 adresleri için geçerlidir.2V17.1.22TURN hizmetinin, meşru kullanıcıların sunucuda çok sayıda bağlantı noktası açmaya çalışması durumunda kaynak tüketimi saldırılarına karşı dayanıklı olduğu doğrulanmalıdır.3V17.22MedyaV17.2.11DTLS sertifikası anahtarının, belgelenmiş kriptografik anahtar yönetim politikasına uygun şekilde yönetildiği ve korunduğu doğrulanmalıdır.2V17.2.22Medya sunucusunun onaylı DTLS şifre takımlarını (cipher suites) ve Güvenli Gerçek Zamanlı Aktarım Protokolü (Secure Real-time Transport Protocol - SRTP) için anahtarlar oluşturmaya yönelik DTLS Uzantısı için güvenli bir koruma profilini kullanacak ve destekleyecek şekilde yapılandırıldığı (DTLS-SRTP) doğrulanmalıdır.2V17.2.33Real-time Transport Protocol (RTP) injection saldırılarının bir hizmet reddi durumuna veya medya akışlarına ses veya video medyası eklenmesine yol açmasını önlemek için medya sunucusunda Güvenli SRTP kimlik doğrulamasının kontrol edildiği doğrulanmalıdır.2V17.2.44Verify that the media server is able to continue processing incoming media traffic when encountering malformed Secure Real-time Transport Protocol (SRTP) packets.2V17.2.55Medya sunucusunun, meşru kullanıcılardan gelen SRTP flood'ı sırasında gelen medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.3V17.2.66Medya sunucusunun DTLS içinde yer alan "ClientHello" yarış durumu güvenlik açığına karşı savunmasız olmadığı, medya sunucusunun güvenlik açığına sahip olduğunun açıkça bilinip bilinmediği kontrol edilerek veya yarış koşulu testi gerçekleştirilerek doğrulanmalıdır.3V17.2.77Medya sunucusuna bağlı ses veya video kayıt mekanizmalarının, meşru kullanıcı kaynaklı SRTP flood'ı sırasında medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.3V17.2.88DTLS sertifikasının, SDP (Session Description Protocol) fingerprint özelliği ile karşılaştırıldığı ve doğrulama başarısız olursa medya akışının sonlandırıldığı, medya akışının özgünlüğünü sağlamak için doğrulanmalıdır.3V17.33SinyalizasyonV17.3.11Sinyalizasyon sunucusunun, flood saldırısı altında bile meşru sinyalizasyon mesajlarını işlemeye devam edebildiği doğrulanmalıdır. Bu, sinyalizasyon düzeyinde oran sınırlaması uygulanarak sağlanmalıdır.2V17.3.22Sinyalizasyon sunucusunun, hizmet reddine yol açabilecek şekilde yapılandırılmış bozuk sinyalizasyon mesajlarıyla karşılaştığında bile meşru mesajları işlemeye devam edebildiği doğrulanmalıdır. Bu, girdi doğrulaması, integer overflow ve buffer overflow'a karşı savunma ve sağlam hata işleme teknikleri ile sağlanmalıdır.2 diff --git a/5.0/docs_tr/tr b/5.0/docs_tr/tr new file mode 100644 index 0000000000..e69de29bb2 diff --git a/5.0/tools/translation_validation/req_check.py b/5.0/tools/translation_validation/req_check.py index f477b0fbee..763e2bdf08 100644 --- a/5.0/tools/translation_validation/req_check.py +++ b/5.0/tools/translation_validation/req_check.py @@ -1,6 +1,9 @@ # This script validates that requirements in a translated ASVS file maintains the same content and structural format as the original file. # It compares the positions of blank lines between the original and translated files to ensure consistency. +# +# Credit to Ata Seren (@ataseren) +# # Usage: # python reg_check.py --og --tr # Arguments: diff --git a/5.0/tools/translation_validation/structural_check.py b/5.0/tools/translation_validation/structural_check.py index 3c2c238207..79c78aa8ac 100644 --- a/5.0/tools/translation_validation/structural_check.py +++ b/5.0/tools/translation_validation/structural_check.py @@ -1,5 +1,8 @@ # This script validates that a translated ASVS file maintains the same structural format as the original file. # It compares the positions of blank lines between the original and translated files to ensure consistency. +# +# Credit to Ata Seren (@ataseren) +# # Usage: # python structural_check.py --og --tr # Arguments: diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 3502ae0d77..8bb601ccb9 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -105,7 +105,6 @@ If you are interested in creating a translation, here are some pointers for how * Please first of all search the repository to see if there is already a translation for your proposed language. We currently have completed or in-progress translations in the following languages (but please search anyway in case this list is superseded!): * In-progress - * Turkish, see [#3171](https://github.com/OWASP/ASVS/issues/3171) * Persian (Farsi), [#3172](https://github.com/OWASP/ASVS/issues/3172) * Ukrainian, see [#3174](https://github.com/OWASP/ASVS/issues/3174) * Portuguese, see [#3182](https://github.com/OWASP/ASVS/issues/3182) @@ -116,7 +115,7 @@ If you are interested in creating a translation, here are some pointers for how * Spanish, see [#3238](https://github.com/OWASP/ASVS/issues/3238) * Panjabi, see[#3252](https://github.com/OWASP/ASVS/issues/3252) * v5.0.0 - * None + * [Turkish](./5.0/tr/) * If the language you are interested in appears, it would be great if you could reach out to the translator to see if you can help them. * Often there is work to do in creating markdown files or updating the translation to keep it up to date with latest changes. * We would request that you base your translation on the 5.0/en folder in the v5.0.0 branch as this is now static at the 5.0.0 version. diff --git a/README.md b/README.md index 9a55b4fa5a..46233782b4 100644 --- a/README.md +++ b/README.md @@ -52,7 +52,11 @@ The OWASP Community effort with regards to translations is a best effort. Whilst If you think you can help with translations, or indeed ensuring the current list of translations below are correct, we'd love for you to join the community and make the ASVS amazing for all. For more information on translating the ASVS see the [translations section of CONTRIBUTING.md](CONTRIBUTING.md#translations). -There are currently no translations for version v5.0.0. Historic translations of the v4.x versions can be found in the [TRANSLATIONS.md file](4.0/TRANSLATIONS.md) in the 4.0 folder. +Currently available translations: + +* [OWASP Application Security Verification Standard 5.0.0 Turkish (PDF)](5.0/OWASP_Application_Security_Verification_Standard_5.0.0_tr.pdf) and [other formats](5.0/docs_tr). (Thanks to [Ata Seren](https://github.com/ataseren)) + +Historic translations of the v4.x versions can be found in the [TRANSLATIONS.md file](4.0/TRANSLATIONS.md) in the 4.0 folder. ## How To Reference ASVS Requirements From 1dfe9406c881cee130247defa172f234520cc938 Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Sun, 12 Oct 2025 19:47:27 +0300 Subject: [PATCH 59/93] Update local-custom.txt to add 'Seren' --- .github/workflows/config/local-custom.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/config/local-custom.txt b/.github/workflows/config/local-custom.txt index cf2fb5e948..046b28c21e 100644 --- a/.github/workflows/config/local-custom.txt +++ b/.github/workflows/config/local-custom.txt @@ -89,4 +89,5 @@ RSSA mlkem backdoors documentbuilder -creativecommons \ No newline at end of file +creativecommons +Seren From d2b76afc29e34bdbe393002403ef8d116f812b14 Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Mon, 13 Oct 2025 12:07:02 +0300 Subject: [PATCH 60/93] Fix latest output workflow (#3270) --- .github/workflows/publish-5.0-latest.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/publish-5.0-latest.yml b/.github/workflows/publish-5.0-latest.yml index 7730db3df2..1afc0a0fa8 100644 --- a/.github/workflows/publish-5.0-latest.yml +++ b/.github/workflows/publish-5.0-latest.yml @@ -40,6 +40,6 @@ jobs: This bleeding-edge version represents the most current state of the ASVS documentation and should be used for testing and preview purposes only. For production use, please refer to the stable releases (The latest stable release is [v5.0.0](https://github.com/OWASP/ASVS/releases/tag/v5.0.0_release)). **Note:** This version is undergoing constant changes and cannot be relied upon for stability, but is provided for convenience and early access to the latest improvements." \ - ./asvs-5.0-latest/* + ./asvs-5.0-latest/en/* env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} From 7b5f38f41ca39dd2ee0a3f90b007275046e05470 Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Wed, 15 Oct 2025 22:33:39 +0300 Subject: [PATCH 61/93] Add Russian translation (#3273) * Russian translation of ASVS 5.0 (#3255) * Frontispiece - Translation into Russian * Preface - Translation into Russian * Translation 0x03 * Translation 0x03 2/3 * translation 0x03 totally * 0x04 - Translation into Russian * Translation 0x05 * translation 0x05 * translation Appendix A * Translation Appendix B * Translation Appendix E * Translation Appendix D * Translation Appendix C * Translation Header 0x00 * Translation V1 * Translation V2 * Translation V3 * Translation V4 * Translation V5 * Translation V6 * Translation V7 * Translation V8 * Translation V9 * Translation V10 * Translation V11 * Translation V12 * Translation V13 * Translation V14 * Translation V15 * Translation V16 * Translation V17 * Minor text edits * Minor text edits * Delete 5.0/docs_ru directory * minor text edits * minor text edits * minor changes * 15.3.6 fix * fix 6.1.3 * Minor line ending bugs * Add contributor details * More spelling exclusions * Fixed Ru translation (#3274) * fix 7.4 * fix validation script * markdownlint fix * Add RU outputs * Fix 13.2.1 in the Russian translation (#3275) * fix 7.4 * fix validation script * markdownlint fix * fix 13.2.1 * Fix Cyrillic characters in the Ru translation (#3276) * fix 7.4 * fix validation script * markdownlint fix * fix 13.2.1 * replaced Cyrillic characters * minor symbol fix * Update README.md * More spelling exceptions * Update outputs --------- Co-authored-by: avnosenko --- .github/workflows/config/local-custom.txt | 15 + ...ecurity_Verification_Standard_5.0.0_ru.pdf | Bin 0 -> 574580 bytes ...ty_Verification_Standard_5.0.0_ru.cdx.json | 3057 +++++++ ...ecurity_Verification_Standard_5.0.0_ru.csv | 347 + ...curity_Verification_Standard_5.0.0_ru.docx | Bin 0 -> 243966 bytes ...y_Verification_Standard_5.0.0_ru.flat.json | 3109 +++++++ ...ication_Standard_5.0.0_ru.flat.legacy.json | 4489 ++++++++++ ...curity_Verification_Standard_5.0.0_ru.json | 2774 +++++++ ..._Verification_Standard_5.0.0_ru.legacy.csv | 347 + ...Verification_Standard_5.0.0_ru.legacy.json | 7259 +++++++++++++++++ ..._Verification_Standard_5.0.0_ru.legacy.xml | 1 + ...ecurity_Verification_Standard_5.0.0_ru.xml | 1 + 5.0/docs_ru/ru | 0 5.0/languages.txt | 2 +- 5.0/ru/0x00-Header.yaml | 15 + 5.0/ru/0x01-Frontispiece.md | 46 + 5.0/ru/0x02-Preface.md | 29 + 5.0/ru/0x03-What-is-the-ASVS.md | 195 + 5.0/ru/0x04-Assessment_and_Certification.md | 47 + 5.0/ru/0x05-For-Users-Of-4.0.md | 90 + 5.0/ru/0x10-V1-Encoding-and-Sanitization.md | 103 + .../0x11-V2-Validation-and-Business-Logic.md | 73 + 5.0/ru/0x12-V3-Web-Frontend-Security.md | 100 + 5.0/ru/0x13-V4-API-and-Web-Service.md | 64 + 5.0/ru/0x14-V5-File-Handling.md | 54 + 5.0/ru/0x15-V6-Authentication.md | 166 + 5.0/ru/0x16-V7-Session-Management.md | 91 + 5.0/ru/0x17-V8-Authorization.md | 56 + 5.0/ru/0x18-V9-Self-contained-Tokens.md | 36 + 5.0/ru/0x19-V10-OAuth-and-OIDC.md | 169 + 5.0/ru/0x20-V11-Cryptography.md | 107 + 5.0/ru/0x21-V12-Secure-Communication.md | 57 + 5.0/ru/0x22-V13-Configuration.md | 68 + 5.0/ru/0x23-V14-Data-Protection.md | 60 + ...0x24-V15-Secure-Coding-and-Architecture.md | 77 + ...V16-Security-Logging-and-Error-Handling.md | 84 + 5.0/ru/0x26-V17-WebRTC.md | 75 + 5.0/ru/0x90-Appendix-A_Glossary.md | 89 + 5.0/ru/0x91-Appendix-B_References.md | 43 + 5.0/ru/0x92-Appendix-C_Cryptography.md | 304 + 5.0/ru/0x93-Appendix-D_Recommendations.md | 49 + 5.0/ru/0x94-Appendix-E_Contributors.md | 71 + CONTRIBUTING.md | 2 +- README.md | 1 + 44 files changed, 23820 insertions(+), 2 deletions(-) create mode 100644 5.0/OWASP_Application_Security_Verification_Standard_5.0.0_ru.pdf create mode 100644 5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.cdx.json create mode 100644 5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.csv create mode 100644 5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.docx create mode 100644 5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.flat.json create mode 100644 5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.flat.legacy.json create mode 100644 5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.json create mode 100644 5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.csv create mode 100644 5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.json create mode 100644 5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.xml create mode 100644 5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.xml create mode 100644 5.0/docs_ru/ru create mode 100644 5.0/ru/0x00-Header.yaml create mode 100644 5.0/ru/0x01-Frontispiece.md create mode 100644 5.0/ru/0x02-Preface.md create mode 100644 5.0/ru/0x03-What-is-the-ASVS.md create mode 100644 5.0/ru/0x04-Assessment_and_Certification.md create mode 100644 5.0/ru/0x05-For-Users-Of-4.0.md create mode 100644 5.0/ru/0x10-V1-Encoding-and-Sanitization.md create mode 100644 5.0/ru/0x11-V2-Validation-and-Business-Logic.md create mode 100644 5.0/ru/0x12-V3-Web-Frontend-Security.md create mode 100644 5.0/ru/0x13-V4-API-and-Web-Service.md create mode 100644 5.0/ru/0x14-V5-File-Handling.md create mode 100644 5.0/ru/0x15-V6-Authentication.md create mode 100644 5.0/ru/0x16-V7-Session-Management.md create mode 100644 5.0/ru/0x17-V8-Authorization.md create mode 100644 5.0/ru/0x18-V9-Self-contained-Tokens.md create mode 100644 5.0/ru/0x19-V10-OAuth-and-OIDC.md create mode 100644 5.0/ru/0x20-V11-Cryptography.md create mode 100644 5.0/ru/0x21-V12-Secure-Communication.md create mode 100644 5.0/ru/0x22-V13-Configuration.md create mode 100644 5.0/ru/0x23-V14-Data-Protection.md create mode 100644 5.0/ru/0x24-V15-Secure-Coding-and-Architecture.md create mode 100644 5.0/ru/0x25-V16-Security-Logging-and-Error-Handling.md create mode 100644 5.0/ru/0x26-V17-WebRTC.md create mode 100644 5.0/ru/0x90-Appendix-A_Glossary.md create mode 100644 5.0/ru/0x91-Appendix-B_References.md create mode 100644 5.0/ru/0x92-Appendix-C_Cryptography.md create mode 100644 5.0/ru/0x93-Appendix-D_Recommendations.md create mode 100644 5.0/ru/0x94-Appendix-E_Contributors.md diff --git a/.github/workflows/config/local-custom.txt b/.github/workflows/config/local-custom.txt index 046b28c21e..0f7d4aa805 100644 --- a/.github/workflows/config/local-custom.txt +++ b/.github/workflows/config/local-custom.txt @@ -91,3 +91,18 @@ backdoors documentbuilder creativecommons Seren +Khalina +Daria +Shnayder +Smirnov +Vyacheslav +Mukovkin +Dmitry +Nadezhda +Fomin +Danil +Sluzhevsky +Zolotarev +Kirill +Nosenko +Aleksei \ No newline at end of file diff --git a/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_ru.pdf b/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_ru.pdf new file mode 100644 index 0000000000000000000000000000000000000000..b78345eae2eca95d0155699902875e38c32756fa GIT binary patch literal 574580 zcmZ5|bzD?m(6@nrpo9o0jkKh~(ku;%ERB?;LayG^;W`6~8E1KC^xLD%xKIZ{} zz+gOQ7bi1gTRe~PKWX7QlRdvAx`;)E0@>w_h;KS!(L6DFe}nm!B9;W!Jz}1i8yH$5 zL%AK+5rXGWU-oOQ1GsbZ)zO5H0Ew+^405kv5emZ$UH9XZv>YwpN6t2g9@)~DN;!Q zqLFq&&Yu4(giBi+{}mqsT0)JH@R4bNJjSX?VLG<(LbHZ+8$+WLifBBBkzbbOSZ%?u z=db|Mi=bld7v_&gK%j%NdOHsR%(Q2E<|p5NN;lP48{o0nW7fUVtC3yL(2ThxB9#4V z`0$y&gWg5q(`ib8A~Bn=)SP$ES#NzkW``L=$TY?8AVL$K)5lmxN!0O)n5O4#uvPs!1(xWqj+zMxg%k*1D9)mC#DsZD2;N(RouJjyn>6f>9Y47)wm>c8y8cH=PRE zTLQxyH-t^`2dEB7^2@$r^to||S^7xP2BVEc$j!2pvag6&hqkwXA+9RbLh|0JikI-uLJReCV1sZoL-m}vAf+Y^Q+`f!be46mH|mmC1Y?>D-Y zVqOZ%V`khSf|z2!xiN%w{TCZSC_^%aQD!i}luo%qh=~$oA`xWp-7k6I;sgH@X?C~` z20+XA%!1Fl(ZU*7#|qvy?h($Pe1 zxlQM-*AicJmnqOl{Z=u<=s(XWBD6#wtn50xgK;Mvzu=bW18rFVynx@c4}0EQ#yq9L zDBaQC&E~oC>{*K15XP=2S+!3+a2+LO-GRaTpg;SJr{4Kwdk5CLWv*xYwBoD#Pi^$L zF0cIYzxJb7?UVQEfO)tXmdJN7a~A>V#!}0n`X7@Mf5S?Skq=vAgu2|oeJqF@IDGSC zQHb$t<=t10BZ_}scIQO8jL3sH9|5=9%zQ|dg;n$f{MW00os-JGzASs+EqE7$sYJP{ zmZOFs6xIMQm|A*6?zsz!eXG-y{<`WdX5F|)QZUVnyhBEH{JF_kx;9ToxhV{uxG{s$ zFk4@((deT*jReEUa^HArOu!LQNrv$ig_!ftz3KlY&>KKYE`sqn9cvpz)SfI+C&a_} zL`pzM&D_dAcFLW^_9k#->16H797&q%whqC@3gIpx4+>J zC|Z1TH%{?ny;O3;c=wpTWHECChTtT^l_d58y2{69p4t4~qM5I4Xv^7w)+5iZ% zFe0)6I2o}F!0vPG@}44LdAD7@-5`sSfB=Qaacm+Zn?gg@rGc)IbO)D=# zPj3T4c{-zUO04>q-!Jp`sMB8h^DT5^$oa_0T4h{lzY1)M`-l84L(DZwFGU%#G%ZL6 zn()ETgI`?3Ei}o3MGrIXHNUt&iiro}ilS#gX=n~vqyt7Do+0$QFcY5rH240lhw+c~ zn+&30%O6it7_%`8amJ_*5F_53#>-$3FK@S9_Y{-md;1YFMjT58P)?nlwsw+K<<$e` z8(oek3U5Cc0<6yD=8B~HrY@t7mB)gsx{oO}Pk12x!sH!GW2*R!~y0Y`YC8? z>BM8wn4DFw!@G?i0gWhm(b9w@d4mae9)v1y8oG7~C?i@e5w|c2V-#B1wz;`Pm|jh= zq#0ukDE<8d#F?Lo@&%!V9={`|jN%UPv5l1~x`7?hk#KTR8-TPLn$ylY!Fw)qrJvp~ z=G@yV2@nVG%ZI5}xNU{TtFw^cTrb%646&R)ui8K_PP+gDrtmN#MbBE}-NI7dxLi*N zX?MxYr&rgui@&?we!d#$5AF0K8MD_@BIaM$;P!VWSWuBIuulsD z+Atc!HYGcG3GQ!J$jkGlKLbdDfJFfhPS8zT2>nk@}UWPMP7gs+TR4Xs_>u@E{t5o z@O~exgR#P}lUL?)>fcZM(dPr@D!^)8#lM}`WcECmA7Hsbk(#=3VH4re6=*JWmdpil>d z?7g@@H886R2ru}dz+a$l^Ff+^ZRX2HJrt<>r3`PxsI*f%G@cfw&2!>0!+1zR1MCRj zGga90b!an5`67;@1NSiS1xc0k5r?IBMd_xY)+q^r)Hf20vQO~i`DFXV{*i9CB;P&2 zlDW*+%kP8fVAv2~b)#9+qq?2}+t_8%$yLg**G_{q5n&i(aJO7d1BcOkZ_w~Bo`7r# z`-HuymtuMEZ0za2WMTBak-O+D^MtxzS;LRR3R8U6)Tay2e~&#xnhICkCg8XO?89m2 z22Aarb@^+}ab8FRh4BSt?)iKrt>}2wAe)yA6sWrrELrjlzyN9D!_+wu}SvxLAMAi=J0-Ve6=88p^vU%GkA_qt7kl!GpcygG_9ydMQ2|C z%})T|kRTH-a=-7`eD}d2%;QZw8KCJ0W{QxyUF@03#7OaF9AWV{oglVDLV*6HcZVFF z42Kq$C=}H)%W4Ca;Folcn+SX@L$kR4BAb+Lm^D_m8&E1>QRR1jxE1#Ix1~u2CN+W9 zzZ?KP)TE7bnA?c3VksF8hYdmltt<3_8bJ4wwv~^>^qZdgSN{6{XiN|Jp(e1_#>pAN zt8DEuwN}s=CfPm^?NNfBAsmh!>(47svX3Yi_2UmQDidJnApt+P&`T|;7lUV{0&mwc ze!2n0B0z)H{u$y+@*Ag)1j)}nH_(;a%p(J%AFfQS1;$&M0(DvPAeNJoZ?OX^I07|w6EXf_H1LM-FJi+7Os zk~FoQy|T{qUZduhEDyD%fKYi)y7uUy-o`C+fJyZ3#m%*G9rSGjK!1tU7qle6!icBA zC4SfgPraVvgkb}U%52h@IMl!TU99$fKPUJXVjZ6Z=!^m$5gUM4K4cD_q;X%J7u(wX z%GK4mmQTF4cBhwbE-b(wUhqiiQj7Cnf~T$( z1(Ha713JJ;tjWYc@u-B%&)Ol6#f8p%D=H}>Ff~>t!15(TEiilD9qiQbfD=a1F_#C( zo@3Bei@$JIjk_|qT;og9;{(0FuJx@9$s`>g&EFI^4wRI?Os7~}PGtb5uMRvdXTnm2 z*Ltuzq5RxVMPzeUA7Zu&T&nI=I<>&Jspfrzlb0j&uem_)c`&H|ezA;I=a$GPRFJ9} zsaujEQuer9_`W*!^B_Q+l$;YNeth#e&2s;5tuPs1x65%x_PR<703bReM(035R+Ye+ zy2|HCofmt`gkLSY6}C(89b+iAw9zrvxXj3W+)VBwhe1LMO5K)piWlYRpRN(VW9_aKe4|pflbV81{sv9wTUV} zcrCQ^K=c%|zXk_R@@y~ECd=q_o)l|3>#3l>eq4s;d|C0KsO#W^V_INidM)c8?T^R1 zE1YDkZ=N?y%{KGJmbIMBpZEzZb{_>m^?*r|^kl<~>85S5R}l9W(uw;C4RB&)WS8Nh zc#7QCAl-T`U=~*Jn*+DR0mME3jnXzv!M*q;?y+XS=E&e73sat+fD5%cb4* z^h*0i;=p~)$|-C9$kCa&Z_wrV_O$IoWZ|g%`bA@p1o?fs_I*cEW>} z*sEr9rdy#u8kCvY>wTWP6FQ^2uEGx5Uk_yw7EYhz-@EfQleu>VURcL@eptI_n*}>r z`_eumTzhwADx5Pb&(NueYUyMZIJZ%s?JY@KSe;j{A~`m#ALPq99NimuclJw-lU(;i zxfwZHW9frlX%$f&=pe?2R`}Qz!*T{T4znj^Kvre= z4|Rl`_7sbT^!1Qej0a*0cRp%^1f#nbZa4@n?#<+*`nzzc?Aodo>e zeLqsj1^dGp8BpDpe&WeD)+R$){h8c_6tlTH@I$)PNoJa!$F{$jPCQ&Z zGYBRp`N;W@5+CcgLcFT;SHNZ`O}IN1u$~&bY}lKlPy>6a;l4k0lo472NzPLo#jl{` zu}J4~K`6=xnn07?VIqkr7ykLegY{SQT({VW@Om67V``U=^d2MpP$>%FofFE z{IM41fe)UK1Oynd#kd%cc5^e}`+NL_IIop-Pn9As_2+ay`sv9=$Mzx;?sN zQ8ye|_=?yO$vPd^bKrf9aw*ybG}P#Qv|b_1=TtWRt1CtPw?2!i-CO?qbme0LPbvL# zI0(8tIYx!A);jrBA*CY115rKvZ`XohC*Q~?6cs?U<7P|qk_vY|2s+o37d_o1M{>R` z+%=Yr#ozW#nNq!B6|dF_TEMe5kGI4|kZzujH}&QK$n~=Df;nHB*Cib-YB-M%%?p3zz7f#4uG;C_mlb0%vW>|{|evW{4US{MM! zn+=xd*&pltb#%hmRiil$%Q1V zD_YF&Ts#B)sJcol@ZXvN;PJ( z`Ljg71^YlGUwU2+4XYIo}7WM3YjuSr!G{awQpN?jvWtxO> zLu$Fjqj&mv(FH*k(NKcZdUVnAEN(c=Yd}tU{at@Q)xN}S708+tpWB^BhRf!LL_aPk zixnn)-bngWsU7v5KFJzuXAJ>OkfuZEp8+#klzdC9nj+^@y_IO zW4b2=A~$f?@La8`ky85bJ?~QWJ&k}q>=P;h?@s6}Obuixeczf{01D=#I3T&9f|xUK zchqD&>URaofW7he_aJ8Whq~JDnyGNar!0v6t9DW8=?&B5TT7rpt6=mcE1u3CAo!M?6IlT^M^pLb!; zx|!;%XjzMib~^Fd%Iw}q#l(|MxiU8D{AIc_Jxc)uQOoC>{cf5WE14S3d@x#_r|Bxc z?u5j+A*hoYSZX%CdR+Wt1UOA@Z zPOp=;&*d)@m5JCsqYyHb=&|eR$jF$$CtP<1vEDDJiS%A8*pA11MoIK>cak=9}; z>F*_u!~E)|viPg=?`vPo|y6O$pC6oIOUho4nEppW@pDMtYa=s}Tr6-J^ zw$qo0DzL21Ny!GST1sHrUoG)F}myR4u=~AA1M@T_wv$kHX2Ryk^8W4 z^WfROBw;YL-XrmO2DiK##lc9*8?@ELpA~`aJ*G?41>arjcu#_wW<8;@vK7R{-M)>0 zyg|?3&y6AN(n;@Gf<>INVeR!>HMNaU>|JVOK)S zuI?18CW^K^pL^vv6#39Yv{>?73Ltau%qG$rd;s4DMoqRp488vbM1*<=Uh= z)q_lGE>6eeBaYL(`xH5m&PyORZiX(r^1ZCFo|s>E+-f=3lYMxP7De^T6<>2?N)gF% zSxaeqVH(jl#gZeIFD!QGbJ1kV)n16V1=c|QS=xM(BOr;`5=B`VZorgNKr_avd6Ok6piHMV`y9}jYwY=@I6q@!IZC-Bh-ko9c^t^sFdnSvVNE zJRrqga+c+^%Xihil=EXxY|udy>GMg!v;kWZ!jRtRIJG>Uhk$MG`5T0w>r1Z+?K=wk z>krt`*gMVF^O&Z_I+&-WFhjod^yqZ9}5cWH|Xx%Y0VCQP8RA0 z$E7sE%1StThB`ysy}5d2C?XhiATVh!&nls=75Pm43fjA8&6e{6$9arh8ieCKCH1Vf zlYC(|zB|&yu;arBmrqFU)+@(R-!HGcllCBMH2DqCbkB3Ut8RHbJ<)qd?(dIrB_YVx zGd7X)9BXjHRfEDp*@lmco>UV4?P4o4-gY!XSt&y!qzFsp^rr)z&jtiFq*Qh_#&@-s^RCv#<=X1!B>Ou9WZFD65ahnk6#K{>|3WUcSa3r zpe~H_M(5n`!!dVm{79(NRA8EpNDF$W+jQaL>rxFDHE`N|)JbAH3GUB6x8vMy6H`$v zJUQniHN;QWS7kP=dlB_M6D~9$*+aD~>%TMkQ$lnR~I{AHEW3A;d{v$gH`$Nm|=&lmQRIUcM}_xry#IBc+3 z*iMY$n7G}U4=ch}@gpCE1bvA9IbswD69Xr&I8#h3SEg&O>u>dJ9PHTXdAOhhy@L6* zidL&(EDzoveST#6O{~5-)mzER%YUnBz>2L<=)*?!*uBMz`0gKFWI6Rp_~mLxC(0Sh ze3Z1~_iQS}RH_Pv9)#DqXW)i2-XR|T!$dXUZ8lAM-@}h(`|?a6PuSIK`FZC_&Clgz zD>sN6h(;49aVp`bt*7F>3PF8)H|n*KCFatJ*FMM6E3nXPxKP+N&Z-5QsJNN)IF=V6Y%MgxjTeh z^VdZ2iA^I8jd{(JPl4x5*asQY$&2Ugyh5AoDcL0I8qSYKr@Y-B_p_i6gFz&GFo|to zFHq=F!hRP&E#fKTo%vf6`P^Z)y2qWU>%8+Px^GWk>9F$3FtzEVaAuLyU03R=$gj`M zcX4i(I<6dELlSg~4Z8gR!akOenhccT+O2eI9oL7ySmHB|@afosL1);Ylu8}J0d#JD zcoz+;ALMR8oZ;`w=dgq-FC}W1CrH6z7Aw#5Vjq=U{EIcJU;+RFkgR`9CzSIJfE=AbZFCKf4D|&@<8wp#EnXDjokUe zpLZWs5H&0EMaLO3OjZL-csa|SUwqUJ&OL?H1U4m}*$k?^!1#mRP^O+B}0u z-J6ea*Yi+UmK-ol6>&-Vpx$TwL09)aF2SeXN{IXwyWD&jlNhcA+M>X2Gcpug(J`gO z>S9}XpM1u750Zshna1$! zJpcZFqz>5}Pc!9Me8XAa@J5h?MMLK&PeR7p>`xz{htb6Dp0J}^AW;!_HrdyvSBtN@ zT@=1WyyJ&_jvGk2d$w_3Xxn%3CI8H(j#uiRW!YVjw`ZyC)TNhj!t3SWvz^pUChwU* zZm_U2+J0*)bZStp-`Sb)!-RJzlwh{ro1@uN+iJ+;y@I}GEdGwyVu%kRV@>v_kI=*W zHd~h?vOhMah$EhGUv}$LF2n0|8t!>UqATS3tF{d+$>eEZ%iIe8DLAa1^?@l;cpO)gv(V4ToQw)ee% z_6}Ay)y?$iOD^o<(ESgAwL)>JUB>3a++pJs;c?HJH;$zfM$Pf$6FxdR{+Ba}CkfjI zIw(8+D4p}#`JPrzkN5O17)4KBSn^&j2MQp--nTlIne&%#lume981H~oqx9AJj(+*n zQ=Z-ixx0VmaWp9u>akNm`&+IkzR1pBUe;oESdU{*Y(CkZkL~HT_n(Ldk1fO2WL;lB zK6(JznkDcNOp#eQAc_Vx{lQhN>fOu5ukO3&FKX`y@DV}ve$at^Vs#zA=FrQ8Uylgo;}sGd?Zv~uZ5>Xcfomf=1$B1| zlP_HcII?`T0)_V6GE?v>U-t zS9CJ_glJ6XsBcu*1CeOLH%Sq^ed2_|afi{zGbxaFUjq5^%}+;d`ISzDlO@k0<48!` zOHgsCBDSZZxy-w4h315#lN2H!w8dvcO&GIb12cNw0)_j5sVBSRo7fPtZe}dng)A9r zmQfP7cI%igNroocW_nNegQ3j+Q=y!_?YAQ1&pxJ*rj$rjc|)iMkUZM#r~{S)*m7yz zfit;af>ZB3wfUdDJC?B1nR?V}Uq$=^$Mnj)nP`IL_ZY3g`!#8ss9nCB?Zb3ge&i^{ z%X$RGYpS9q!q1$&KRF#f%f5q?e-%}(41MxVUlf9Rlf?S#%u#_#p>C;R%e@E6SmlbA zpA>wX2;l~_)SlkOs~}{ha+p2q%is1mGaJ&I~@N!9*}&3pNxx; z=T$CPYaIGcJLHE2gw^VZnkEEUHGyDXeXy}I(be|N3UyZ<`%_-~L)|dNd zscc?e`7v8cmPs6i$)~QA2$mc?C`BoU!c>Z?R7=LAz<8P$mhw^+g;ua%Ezd4F%l(?I zs~*9uOR=)*tSK6ZR*q|<{=j`vi^Qzc>n?YuEH|H4XTptDB+ZGWLFz4b@%Ew>neZ_? zNLG4JKCavwNk}`*3%QGrfND(p(GTbVdFnjaYp^14S?N{Dsn!CA^1?@mA*C0i)4-e3 z%oHD&ulG~nNUh{x4h`Oe4gRlTzx#e##;LL5Sybf;!+KPGz37rtUTJ~uGYF-O=XH!P zY}Ix+=sU}z&ezydRlDIW9J22^=#pBc<9nmwUT5rzBg>{5K(b%dLn;DIdW=24vvwSJ z?@~rN5XPz!G9u9|#jsGFRZ1Tfql?B!qkB^zEyBVJ)LRk@KjH8t?2Ch)Tj7#iT7&U4 z{PO0K6v-z*3Ld+r{M7a_H+Av)tQc!lQSm?-f&hzsP{fC5gYHL?+Nij{J3uSN2hKBh zfoSusk+>Ed6>E+>4{`fNis$VrrfG*HCCi%Kf^3W*b4!3oFsL!Nh1`g*tLRH4A*qXI zXZu-&^D+4kyclNw$xy(?@T<5$#ezY_+_32SNMm&3FdFH2tZLkq%Qo}m!=uI0h=y)8 zDW97mOw1x!GF}E6yt^CxcZ+3eiHsgpxl)HjI@Mbb-tJa(Q-2MqEMGodVRIN%SmFGA zi~qwTTm7pw?f1Or48iO6V5HU?e$!Ay+UH`!@JV`%os?Cqqj`PxuNmTEdYUFeCvJz= z8vZJ@s!H5LwmE2TLeyh#!?8Lfid@cPN5TXlzNojT*q zhbYDK`uh(Cb9%)EsKRB*d?3w(kMbIrzv9H5z0w6CWE?k7XAP~rpFPI!rTiGguPV^u zR+4YQ66TqyHA90CGkiCfj1BE?FSq)=+fxhV6rh+5XH*%{=1)uY=%4$@*(2GwJSfjpsw+?Wl4?mg-Ea6uB47*+wjg4%zi%R9!HSZXl4RLg|kXejjVUskn zhCz5!dRQ(LWfcPQBGCVk{L$|1Rx&j9sVejdmPty<8RG9P+5#aidzS zuFHs8!lZR{x6C=VmEdOFQgMeS@`Wh4KLo3>)8`#`14V46bNB}Fo=81|f zQq?$XKMaynD*NRQpbGqpVDPz&ev!G4CdhZc0ysq+DxB-WeoBP9PSPtb#8ht8wsGg6 zB}=T{K~CZfiAxo(f7%Y$k^Z#mrHZI3o1jymv0&1TXHD&(cDn-S^x-{s64y|7ds?-e zBJg?4Cetv`#!*(tT^)9+r7v)6iNS15`@48~v#!(p@Y_O^Zz%a%xz$KbChSektOWUr zS6Mff#(bPG*)u|y8EV#w(vS5}SZd2Yz0{NP#otH4q!mG@;rb~!Zn8H+ruviybR$!I zw)evjajNwE;dg{JNKg-Ll)&|6TRC6#P*LBeVGG@M>xEVoN(aVnCbUmBX!TYU_xUCT zQZwNlo>+EXD1cY>yB^TAbZGL9C<^E8t!Uf$8hscEfc6lS(YAFMgf0KsH^ur&q9L&8 zy#COE_R)E-1P}{#j$FUc-xT+_uoA28CvLpu+}!YR``8GDnI1N_$eyXm*usnzpZ!rA(d9UKrrr=`NM2$pDybM$Ug-(dx&V z5xxIzzF0NW_LRqt7ViE$ozUnvU!fag+*vR*8y4r!JH>993A;IMvR7#36w%gz4K-Z< z={0~`u&PQj{wv}FuRh)pN>pey`0V9R+`@2Z>HBK1_L2PhYtUN|g9dV<79_kX5;=Z+ zdxfBd8#j7K*!7Img?uT-1oZ@f@SY(k=fb>RT}bqJ zf-(F_%TswGhMQ!q<%W{t4i4$wM;BMmir^CsG9YC0)=eK?C8Rd?hoM*~-dmO0(-J5} zN0O_4Pc^SS-0MpfAc7js1V}auaFj-?(n?2iU@!CGlDE^EPLvPx ztX|0mRG{xJlTjKUu8y#;ayd0OxGQ`ec`ON1g%}n-2DtL!HLc%mA?Mnf$V{@03HzOC zeg^q+Tzc2oCplucmC`jc{(mwpPj7@m0J~&Bs)(Bh5^F{9ZezF@sq1a@?e5Zz&zde* zsnl-jmt$4;(b#_mB;AQ#P=!L>W(3%W;xb|R%m9AbFiFutftk#UYW^|Fdcujc|Rk2`Mrl7v^x6td})oBO0Qc>C$Nv7a25zt`Z4 zZVtUK_`4V*G@p5Q9K~Fx#zU}tZypz@6gVuFI z&O~fv$m;?DySvDY?V2>zZIvlWr^M#7i@$Kq@!MP@dt$DFm<_$9 zp{@!l2@>~e2q{?IBE~Uel0K(O1>gFgDGB4Og>{lE#WheU4Vivw62nelB=2|EuV9`R zzLkHG_Tk0gN7__81U}3;Yy4fY7XDdz%D@=N%2V^dZUhzs-U6b?##cCPB=++&UCYgo z_`76(eA`aHXL=E09Q}8qRaRo5mHwJ;&hU_4MLd$Ymie-g?#xMkd`S(EfPoPRCB(ia zT71HA{fRH5c-pKVchy0~@dy5lY=5N|=U&=OeJqM=fz6Kr21Nr8CPP-9qNiXWu!{ z?C@R51dQ((a*>P5PZp& zKu88CRA-0n1Sk}x0V=7f6w)`pa7=Z3?uCrnO7wU6AiB{xcQYT}6w6L47V|gI?g60* zFNKXb(jIv6Y?mG}N{&rFZhaGWX%4ygb?c_>_$4a2YQXlR*_!#$niY0@dSl3AzOpx0&{_?}S zn-6zo<6g=XyUq;2xA2PRi~3i~4S)1>^M8Mb>VMa7`009Hp~HE3Wml)bHJ4OYu2eQ1 z(jLqWDxNsXlK^XD{8az=rz&LHAhpn{0dK>j$Xu~P2j##1nzyJ!IL8|2?w31b@|&)- zxBgp%xiGmFs!Kby;!|Y)uwv}ByJpFyo*%2dE<_SkB4E9~EC=Mmf0hDU-ocaN0of4= zv&!Tvmj%m1d7r#8*a#^ZaF+Fd!UWh_g?W~bcG_;3IUgeR(-WLb2J;?*y(fBL^&&F= zCWcFcE;x<%4zsl&6UBGsaWd`W5DPCQT=`Qr@RM}ZdU8SWDv%9@ql~s=Bf#nL8|HLJ z1+ek1{cPCXBDn4A!SnBDVqxmTO+qO`m(e39s5N(v5j`1=8sh6x^w&35fW}JIbOZ^& zR|h9Vvg$&`1#g-riAN}PHB$ut4+hmx-J%`?>L1a{G59Uyg9ct}m!Njo-PBig9o38p z>)1>Hv@)O*^LZ5nU$sUS46K0^W@k;6*QALRyF84n9O>OgDM}HVQ5bhen>DDU_57ds z0Ccd$b5pu1<#QydocA9xG9YzU|1hYR zDr7=|CreX&ry^!LeXW#lW#M8kM|yM=ZNAGrX3yC~K)3J;YXkBGcF_2bb=NZ%o7xml zo-_w$pn(?eopI+O+`RiRtW-J$&4BoZKKDqqKb=|cO`d$#9sS1nY3$#yS7a=F zX$;Y|Y*GDITXXK~hhJ-Ne6>-+9j;e%GHaN0IXVd^w?svmP?*6BzS1k63gaHv} zRT6aETrpU*o9)M0?%{TR-lud+H!YQ06&B4$quXBnsPY|w$=keyb{wlRv3D0PU%7K!>@{1SgN z7gpWyyR8?`DL(~mMG|NU{Y8TaJ6I}{|N5QvUo;qO4;j_?qwmCh2|0YEVcRuJR~a~> zl5i%=b;dxNlvEjyG)hmk^J-$SvCxPplKYq19!>J`zAoXZ8}Fd?nve~w{m(QS27kzN zhY67!xk5q%x4dlFu=s7!fe+>XgROCTVX^RRCXL$oW0lHVRMk`mnc-Sc_POqFa!-41 z?qL((PS3}`dDSObi6*sI8@**Qr8?gJ$A%cpL*k6-QyXJGTpCqH9mp`n@P_Q_cZWbq zZ}Rvk*{|`FSKHY>6dy0~3EdS!{yH~m#+z>_bWr`BDuPH8>1OOm@ilM}I33$2o=r7m z=VDFL^87$pBn&mV+^cL!EWHp4_@B}l?aepVr=%TE1}%kEuk>{onz9e{UXglgwOAKr zICpMyh=|=i5R#?&eQsTMrnx=K_%AHZrx)tFze{5ni(%Ca4$tLr7V$5&q9PCjITTZ% zZ+3h7j+$8K?+dLu3c}|43;v4??^tF}$sD&bNoK38E4Ir`!Y|ryt*uh*DGS83wsWYoRwv@}mw0ZgFu!@gY{1L(qM8cfIiZo$K0W@4Envc&xBl2Id`E6t2 z!<6IyB52nqw#7NVMJ!qr@(|@x0$WH?!I^D+*4$%K+gBMWSQ9*VhJ`u<^Rbz z24oOC03@utbZ?v}zT>>xLpjumK9w+;uxJwK0SX!HYKf^_$CS|XEVoqfz0t(5_{r6O zHFC609{FIRmYH+-MrG4?TD=L2@dRW{Jp(c_UftW%_cygFP0Z-|moe9Le?-Jo3q$Iy zm(^jU`FD2y!^b!FhbJY#ud&9x5rr4T(m?U*>gVCBlnlMA;Vy;OW5=~C>wX8$(~Jw~ zYlX96YdsMsWDI*i4bbQ8dah;SCX-Sjn`?7cAsCK#BLCPeM9rn)eo}RO)C<#D;|{I{3BB7zS8E6T`?_=3TYX#?Xqa^P#q9DR2TG z&d!SQxbbGw{{ng@XGm!ECxC1g)Gzzx*oUbEsQ4MvY-+T7D1S=t*y*bi9-c-{e~p@h z7FWub@^5uEUzCjhx6|I7d^;1!hhpkYsZv1~-9edXa!QCD8?Z>On zz{Pc6L^;L}NAoFAj<$D!7sCE~m;Y19++xMrVZBD32gSxRc_GjO=5H~@is;wqK{TOc zZT5NdoUOkVe@#g6gBBaIFy-_J+TXiE5FDPl!rScHDjXJN{#vxt-F50OB;!vjH^;5{{_ zO>Iu*+1i!cNm!)EXW@K^x)<=L+F?fz%r|!iX*qZ{$8=B*U+Q0sWJ`N+UCG&c75uo< zq*MgxY5%-~0>4O_$bo_@?+Cs@Qf;F2^?o1|=y%J_GY`oA)t$SGG@ts*^l&YZ8u`l- zn(@G!Z&o`emX;OizLOUHsjH%L^E0Sj!_&~~f`e(mnYq}jJF9Dk_}p(3E9vHcf%;9} z$E8+8^E;y>r;E%TTh{EsW<+K!hFrG%s_w-OUDA1oe}SK@vZd;G_aet(#D86QlSx%K zfAKt|0!E**jDwnNz2bnY$lgKn0!!O%gYIx>(0-pldE>H(T-)HHZKb%ewnJyOEq1xP6-&G`RTc}^vI zh0^k0L9gl`{yOK{3+l4L=VIN|`M1q5XL=7$me#2XA{Es0LYiAEPVoyLS6IRFm-pv) zXBzRWX%Jw$@q(g__YFZ3)_;SbTYzLxOt>&^?_KcvlOd_IOH@hVttp3kp54}{>U%Af zIk8EC;@S;mRcTkLgtJHqOb`ISbI32Q?Pb+wNwvLYwSL<&i#ZGuDzwiW8N?81fNox2 zOPo70bMbfeTA0t6DVOvyPO%-&xY8w9PA|i|PHPQhtC*K70_RCtBwqj-v|Pc`o0Siv ztDj}t27Xn`RRgz{C*MTHyrH3dts`$={C~Z~-3^+HhUMEs@PZte*wwo3A-4Oth9dmr zO>6$E1%J;^-00XaXo`4@z@gyonE7Wbhkx}M%Psa@?Q*=sC8Z8bxR9*?Mn(3p+zLEu zwmp2DMBGP6Ua$L(yJwrSYtx)Y6GnuIMw@)*iU%py;KO^wC|L>#e9#LgIZ)aheeSmJ zuaS|O3+N4xyVlLe7CKw@6b&gGI((IoS16yC>DlU17?5~vb?y#;v@WD6rD3Nxbn{!| zSl=a9{os>b_0t|~n7a@vKH=vQp5_*ql;LAvOC-IK5W{heE^rpw=-p=@VU(e?>Kdnl zNcTt0{fxBg*=fF$k!pX^ySd`3bP5g=V;5L6ccqqA^7?%LZ`d>^-`IZEz}D_3HwP~u z%nX^1QiUiwBVHpm?avNg3Jxsn7g48{DY{&kc!{)>O8FCGumOs5zPSbPi~KF_R9nky zXHJQXQJ@q@`NT&?XQr(h4eb00to;U2`cPN!>_=V#!lQRnp! zEgi;zjV$1ojuXyuNA1k)8oc_*a}T4V!=WPt?#{WExV>su_HSS~r?9YnF<}_6Q zdbfAeZ~ZiX><`0Exo~HwB=9%=BC89#iC1r?EO+5f0{oC0Xr1nn(#)3Ty6j2r=|0=> z$^d0{OvoqP2ZAYDPzdqF+XeW@^IKz+k(@ea#Eo&JPUsl?!FCGF;_R|xylJE*v%NXtLtxzxx0T{v z6mRhNDLeF51>Do^3Oo~RJrhrpIi=g!&=J|M$@{J@Sa^GeLlb@B$VU`qRjSi5oeLvJ z9&F}cCVsHiErcsY{#U7wy`!}F zuVj%i#paM{cl$e}_^aWt<@(I!t=1!7=An&<%mUMZ3&bs(-G5oz;T+q!D>yO;=N(gQ z3W3?6QfV_`FJa54(>^P+XLA`n{Vd#utEvymIy1qyuj2_|tV`TI(zZpaLOu=at-g9L zpJYF+20HrnlKf>4-zYZ79cO(2JxR_6EA~vp(Jm~#$p2AOd4RzdS`bo_QN*?q1ri7`F1p%$NqPbD&ir; z`J(j$HS9;;X3a;bcR)cH9;=A>_pFwB^!d}7nNNK|OGLT{K1fI05c7^9)5;FF$yM;u zdsAHd4e8xFcrJAP-u6ELWPD=HfdA(p$Ez0jKyjk-yXl3`P*x7?E^ImUU40O=l-nv{ zN;GzSm;Cqtn6lIjJgXXXRC=T5i$)3>LZH#{`!*upq7 zyyCtBC``iRLMnO15ItDqP%R&Ulan`9bj6>n_y?5_Z~L+}y&Y`lt2CI8e5SU!GIdE+ z_rIZ|#JV@1(RlB;m5m1S(WT5T;bGN2o`(7)pS{??B7fq-+Vev{JNFr_$x_TQA}b}} zSz$&)Tnpk=W~C;lp_fPNa*_zMRyz$|5OT6=s$$}IL$1wYZ?~js!}TE>P`L}&{A@V( ze8d|esZh;WwJlV1AdE2Utp+bg{8#wc#PO7i(1rH~tAkT|!2jyi%)0la7?P^XbpDSa zPazvt@dhGl_&u@QG%2yg7c}SDZr<^~YMn9-^!iJ&MSWR>-91`2mqdg;B+^h%AV?Od zw=n>3yTuI0JiGMtmT3H6mQV@0kT{n&yi*2ZXSRIu9=JwXu*)}w3-MzU=PjRV9@y`{ zgy*gsh)^3wH)&J6gJ78EUF=S~z+h7J=f=fgP`CN~IM4w}%W*3soFU(%;YK9np96s=i&Spfp- zUrxXKxUzI5`cO_SzbqMAW~VFUqqB~S+CRRvsMDm@kd@iXv-1c%bGh+A6OtCuavh`D zu&9oKoC0*)3%v)>HPnm)FaOz@JgRf^L#vyDVOm+uS6wJL|EI4+(Y}gRTu2Rq7=JfpK)w!AY<$09u;yAJXN$6+jp}$AbbbejlDhvoA{bL*0HVtl{PaA=bDuh1XLi%U7T@)p1 zL9;_9YoQ3|Kohw%qCyV|wf1p#8^z6=U2lk0_8;%Rb-zhBx@J3IGU9H5UCnb=Dp)z&5 zE^U+~s0m5XxbC;z;u#~wZHMCV^7vtY=@GrT zEbMap91hXmKzg70lq`>YIoe zA8fp&d0J2=!R1)3B=_aa(mz3=YJTj{m>+%0U(45$-WxgAC_qmMn6;uOv2H$(>_M-p z^myy`9C(t~=XW4=h%ygW&$@j!EpdtoA$r`goyLEY;$U9F0?n84HSd+iaKAwRndOt@ zg6DgZdJUv=EP3P7eE#=3x9BpgcGF9(Kkwswxq*5YKr7)D&i?F_d{philTzN8yU3tD zxXb)rD1DXvsdU2FFAu(`RqAl{mqqXg@qbrvq{xYGp9?KpmCN8K>#YGqUp_K5gbIrX zOo<6x&^&|*{vbQxE73(eD1n3m_}%o$nLFZqF3sGYPIg&c-n4`-{c!!fb5yM0%3m(< zN^<9hi2n`X!O~`U`bA)dyGp22o(o~&&rzlVIEB+xlN}A@EKGaENk<#8LW9;(TxUkT zZCCoZ+yVY+x^jf2umhnEL?rn`Eo|@w1Eo;s@6#>+=3K3Mji#@+4*LHc6GhDMhEbX) z%v6YJBIjXYqjk4W_;kki`Q@-*Vo90&Hc9HLBx{SYm;BE_lDY>xEGG{m%HXtL0-wZn z$kW;;IXB%%FaB1+v(Sq1Liiba2f3deMVP|#B78$W?C$w8jtjvCJ)bRM zx0+y~^$nc#XcN@`yp=dMrT`n{R-u}GQ^g6>mtjBW$*CURdEH=9l+^j3A@7WeS(`x< zPd{P82A$k$WXrq4UQPY*C_qN07=C#TIDFx-D{X@IXKW)sZ2NNGbli!gi~+++ ztorenfxpn$$cbLdGcv?X_GalFXEVQDR*Jea$w%Wt&WBNt!14>}uK*te9I4($ltrms z+=12K8`PRovC3Ryeyk_cQY*kWE;M_mLvh8lD!px|VSwmAd+uc+@czE-3ab~}y3BQ) z3d4bI_v=r~^F#Mf6yc<}bCji%lj!b7NvOj=EyLy(zfoQsWjj0Ns&U-zn3+nGY6pL5 zF`gxhB~gifw@q@vM&2%r%7-uK+g-^nX8B&^T09*k%SKN${sVE!Z}0E~=lPnjU=58rZQ zuy{?1`^8Yj?=tqE&Zs}{D?&uHOoj~)*^7(i`5#6Gq)a6Hv`b;saXkV%3N9UZ|J!*B zwT~cikcCVMbY+TMT-nX_z~7g8uap-SNA@2_t`>>Ds3CY*o^tKFP>O(kaLP$Yw--hZ ze|D}M_XaU2-fBH@{uunQe%O+^4=>CK??#7B$UjD+?6DCU&vd?DL>2ly^&S?cd1H6< zpnWoC>Eyk)Uft6|%70@NxTp}@*jc`%ylP{>t_}bnIXH??12?avd7Bq4I)5>AT$KN( z=Td9gi9ufeFSi4*2ybeL$;lVbuv|$F;)QKzJ>b3fcP|bY8fiOQhVOL;TPv?BXARHS zW+@uqJT0t(2f2q7PCA@H**b;FI+W(HJo^j_{=?1HFxn6EC`*0zMP_UAYTsnIPsnZj zAc>UK3NBSG-J$Q*ed6*T@O#*x;PZIPA1Sx)4D?4V@%?&D%9I=jP-_r(!%fkf8Co4vzF<@J+{&MIZRbKSR@>pS@yTllBkD>?J{)~epCQ!f)>gP5 z;waVr(k>_oKL^<6C~4&GInsYH$jAGCgY)H$zKPReL65(04;RkQGHhU(s{juc0GpVA zYrH;*FRXneryu14$kgM7JXd%7@Jt?)ed|#tN#~8Hu$R=NASio1hGR^)8 zaJDOs?9h%DGr&hCckI+y{{gg3E$)1V1>0wtjEV90dOh6dl*ckUv7Z=d_Tug94#&ny z9<2q|5c|*S6Tn?Tlqyk82xm;bFeVr_)+M~4WrF)jlT6#dVGS%>pay$V703^^yOVi> zy1>~E@bNFuM){+O`n}N#v2~)7@Hk7-kXNmjOaqJ+>UgE%42TVF$otI>a~Hlq57rutTqdAZt%>ya&XG7X9-9+VIr1kZ#n+irF7?{~{W1^kEODy;a%hK}{CcLd-)AyvJ<{ptR^6Z8t{4APPe!n za|iPdVR_R%Ny)8xWzsWH#oFW6=qW&_zIvF5j5>So_z!@Jtk;LN^Se|aQ)Zcz$@(3; ziGc=ZLvK}Xee|1k?hIV=$Q+n^OSremWAxDwbL`cQzxX`DT3;%#0J zyDUxExXh$hPN=UTks|B;=@&DwccbAHSEPO=R|c2+pGi;j>*Ews?}TpXs!DaJ{fNw6 z4XM(e(}d3WzdG>er=h$OcPc0?cEV{&?G<(qM=bIL0vF$VdbeOaY$CWwp~xvU zOKO_-{e)z0ppP$`wSdM#J}+veH9tC$A>STc9I`eVj6*en30o+rVq*Dudy!w?!jqOB z`Qz2eAcl}#b%r13pmttCf`;+@1#u`*k?1RhJMPr zVMSj*wS#~AT;9O%eY4s}1oi8>jEa&l&;F2ib16{|a^Z_G!O7*$I6+`rtRXAw$z`yo z?vtAg$~Xwj%B;W^0ccskjY%Cy!}qp0?g65O;iBZk#2u+X)xfkU`-rzcO-Hu+J@1tk z|B@;;nV)i_Rf0^J8}CcxS&SINT&6OqZl&5qi-a6eY+;Txoau(PK-*gku}Rp*4!w6b z6dnr~7~3#1+E0itVJm=9KP+Ln@CIY-Mmm`^tUv zh>WJ#fe(r>J~s$ta$>^-f=~)g6LPcOMae+3^60~fqH&WJ%tLB2 zuU)@jlW|1)b)DE49hfy~jg+gx?m~6qa7Zyirs#^o(y~_;@?J~0-dQxOCHDn$0o-h{ z;N3BaO$+rD(EZ8jk2ucT-^LfVi)s@j8cZFkxg41$#MgaGDa+9?t!bv)s=^K>s2A8C zT55P%;Argx$yy-8Zi@})p+O#$z}?=ktof-(B3c;ELinPxEJ|r79Em)kaRb~bn$zRrI_T)~H8QznFgzt_n`A2!QeDMPMW&35w zVWFFFk+Y^pP+|L)#@jyuy(;7FJ3uk%J zw=BY{)&043A~E!bPLgASs0bqcr+T8DH+xZtf^Tv0c)q6Y>xbAxd5>-)4@%+u&Qu}> zzeqFu^5GbyswE8RwSts@{DZdIrvMIvR z3=MtdL1g?q&WFrgDB>e~{pzhT3|Rf-pg(#&vbQwM_Dr9DE)BKq_~aksUJ$J|t-gs( z@KZR!#$KBHmL=OK*~B6S2!bmx{&yg+VH1aiKxuLBfTz?A`lq9$mAS=939G8-xdmjm z91Oc2b1Wb}nHlo~_us?F3X3b)U8HYY3Fc6Q^HU4Wl!FfeyWc?RWqHofN?;~MtwRyQ zw%F%KS0NN}i7U)G7tVr5sXOSSAs6r=$Rsl9rD>fz&9^7~e)x|`>5^JJs6JbF){rUh zv_~CKvFYIAzP#1&NBf3*RJ*`^;X$*3)^Kl!TY8 z^&|Mt-tMa&ug6+Xl1ymA>JDdg=@g&vZHN>}bNofMt~(M-=$N|kLKFH<>`=nI`aP#% z^4>{ame}od+;VG-!}6cyGGf#Nu|1=|w;lN4@71JS3u3=8Rp1`Y^pMH>e6qYSx{oAA zCU>e7?6NhIKP;#m?BqV+adQn$t}*jr4o&x4m5+Fk#5r~ZN|2qcvnYlu%)w=fAW1h`sKKK z_u`cCD%0rI(`tPo3?x|>O1P?;;?X9y31F?AS^IU0V*ggFk7hl*b@7VrDTR<9^6gix zCC(a$)m|;Or60!`Il?x{uU4cgW}2>k(@zRLXiiW+RDtyEj#k|KAT*h|K&?`OurS#c zUnTeamTN8HC4&`NZv8VHvOP6y3|%BpVkr(< zrhU#Zco!_>Kl-yuAd^5%iBc0U-?<&CSX8DUmmL>h(N#TsYf=4kb$*Ueq{Osv~;=6lfM;R)?stJa)D%+5v!I1erE zBUVjlxWCX2|9i%rSiQ#H5UbKv;h$gV`+U1!X=>JYwEyxu-a}CLjE)Sg)-$?MuWo8x zF}Y3&J(Z#~c`bMeZkHTo7~XjAakg6Uou7dRtBn+<{f%KT4WjT2YB64@96~#A*P&1J zyi$d|R7}F*d@-Wk{)5qbV^fL9aj5Gt@cFr?iir{VB4e`~9tP1uTCm-z8}vI~>x!}w zO#3^-pv{`xGdZbLos}INB+R?2lu%$}&ZeqBe80*HU~B)k1_qN~iQIy8WsS6L$VKUp zf5k2J>L|sUdvd)(fz8Ff{wed3G4}TJ7V*;k8nPXvC$T3bY*Rl9;629sIIQIr-N{A?D1hkV&+nXI1_D5fgs-Fwd=Lzu)~l zP~7|2Lc14}$q-n)zK8|W{=sl|C^x7@K3h+lb4-n7Q{T#m&(&7@(Hl?JIcbjDutA-W zul_WH&y4R34YRDD{k~c2|J~}X`1agO&eFiHSwvjO$qyZ#Gt8~BOr|cqpX!bB(!dU7 zywq7P5Z7Si6ZzT&d)sS9X+(>KfN7wqre_gkJBzgtFS{G=CV-%}P}sS;>`5HF%r6_C zJ|)QJ>D&yu7tl8Q6DCtLGoE18RFDf7Kb~$Qx@BcIj39dbP+bwy$B>XYQ!cJ62X*O+uvO%fHK02{TWX=URqu8zT{?jWRemX`>9md zn0sfc&pgEi`D*W1NusJ2l#xrTL-<|C=DjtUz!__4>9_ZJir#*lGhd&e5sUd=n_>GV zn?^WPJ=;c1Z09O2JZ32mZg^~)QZ+hMC1uS+^;~~fx}Nc^=1bhL(EPiVGiTGs!AHfC z9ww?+z54O^B%CRmETUg|V}4{i=?<0P^!;h``l4Na-%8N)uIdvaj;?f?Y6x;la6{Kr zBu?EWKpE1oGulXGzZ&FNe=gm)b&%PSO0h}ug52}tA#UZY&2Zs1XbAiD!RiD|o0;;f zx~v{J)9xEJGFxKd{^yIwru_OYFPp6Dj0C%qV#to8FL)xlrQbh4^xzSpW_ZrK{lRVH z7bc?2JO1dN{Pua3y^(ZT`?>R1JiOgO705HDnvfl{w9F@B9y+kzE_-F)!Vc9z9t}37 zo7R5i?1o>Fv+u&&Igjx3q+Ujg=^v5nu03nG03tzTwWn2am-t_-K7t|U4|^QhmQrf~dQ0lY0iUoKu*)9-M}EQLRr9)^60JNqk6{faxC z_wm$ogmOXGFmSyfpSb<;V9#TL__v7Xhu+5(oLv-wFW)0+w01Sx%AV_ZeT{U}3gBif zuI_P2DlOiWIuaf7lG--!oa21t6T|$Kx2VdiIxk#Y8C*pIHP?*iGi}bd%hq}Q%KjGX zO<(m$5(D|?_p-JZfXivj$3WvyACUmy>h|qRc0r94&bTkFjQt6ag0h92oc3YqO{< zr33M+Iurkt`>Q)1{?Wr_y?G+>T3cG^V#Q;y^zv9v>|T8}>yx|Vw$GEv4Ua44O(I?H zmnm;okA7bKsuIiCE-+m5X3C?6t&1{pkf-X;&hOV>O^)|oGgkd^5PltGbc>M`QRW-J zCsCW~RDJnu=BB}`oS0PuAUcWADbvXdLgf5~^i{;4Wf_o_Zlqp6>0f$T;iS76#sQ zd#dXR1YgDWA@E|1^iO6~>v?lKu-q<>Az?kOg!0aOsez_od-S&OU>nO|+Mn6#UaenG z-|zJ~y_IX$%xRES!?=oPAIsD%3w&w6xoGirpN3t5|Myf-VT_#Ct7O*R=c~2@nM4ea6e`9Gv6f}8gG4@Sg4TI=UtUU3NLFlGsnw*=g(SWqB7Rf z3{&&$-+uSP$xQeV8!HSPYiiY%Z&f@DOHEh_Vum1*X6(jG zNR!f4kIdG*SrhRT(>lqIIn4U4q;V|FOk`qHnbEJk#SPH>Qc~#K(8Qx7Gkr(Luw0KNkMGtr@v-;-fG<)?_SX84CO?e#D&?% z`4~x1I&5dVE&GKHs9459pX#FhAy6`@c?OHiSjtPuI*5sOp8 z%LlhRwxI?mKkU`P!$=(>4$^pGRm${rfgGr|{k^EWYl z>5i$|9EEN6y_;Ql^%a*b7XIo!pM!r5x?`IXnvAw%%9}yvnD{l9#tPG|3-ojiF zlOMlXdz$6Fr11Cc9)(1X=|A$?A1AgPcS;cjKAe!>t@ujcyqJ8`<PI|R%wLLA~t<)S?eqrzi=fM|u-P##Lo%}L^g(Y@BnKtq>TS`CP|82O-*4p96i_p91xP45O*LZ56bnwDAa!hDn{Tt4T8B29_ zA|3MfHwGY&N-mK=d38CwiSqrg3q8wK23>uRAH!}ro;(x1+K-_bcB7;B8#O%JO(G}_ zZOhvbaXatb>@&B|OFqN*|C~){J58oEE!-&uzKTjuV>*)kqNeF3;^OO{2(I7dt*BXb z*OLu-B4k25gdeQ{QF?)b^7U82R9# z0Qc#SpqQmM0G1pg7cDVe#nQ?SkqN|f$6QL zn&KvXUz*b$$a5ub7T|rgZp%e2a339OCSyq69tc=VVY~to|Agb#L@P=u{uC116wkuj zwHm(g#rblA8-lhN;`6-Jc-d3iU9aJ!q=T= z&tm!!5aoXfCy#38U6#s5bTp3V~qQk@$Hv?B84NDT+8moKM#IXBZG40wLf*0egDvpPClG zYqiR`*IV}^xV*4AlE6TeX)73;y^@s>jO5L|m8*tm}p!kZ~WE-qodg1W~3 z0ey_3CJ+9TGlGk40t*6gEy+SY$r`kR`_5t{R0mp?1*TyG&^{~d zfoD;#VCRLt3)O{|5tN}}+gT_kR|dcwWXGS%i>J9sCIF6q#l!TINI?r=n7526GWqU0 znid$;+XH{~(+x_XydMg7(R7Rfp`;Ejod03_;r)aPV#Tu5BlP@D8IVRm_CaJggsW-; zs}?h~$CJO7%s&JUh-?OKG^bvVb~IO|H)1Tdk4Bbqpwvlx%RGY}$Ah6*T+OA5yiE)Z z`wmROVS%@BQ!mL=XWv@#!SO19AR<~{KZ(r~M-`cUd*s7PoKMLCDnPv`K+Qn@*$Yi` zO&m193d+E7aCyJ(E}gMxM8y!NGFQ=vS02Y_C^?!V!IQ@+g7;PGV@kqDZr;LfOZ!nb=&p&+0!Ua$dQLKuSXs|v= z#Kpiagu5dfr|$u#oKVvtDR0UZ5hW*z;G%k5;s z#zkDGP+`MN`f=V|P zdE?UnIL=w?4drw=4we<79el$3rlNa@&>P3d0=qEwU=_;U>7^m+0mB`%| z2XimW1Q%p-#loX^KyL->Ck))qf8EBTtHc#pUTnF2q;(iO32;t~bNu=pJDDtbW=*jT zk_?Ks42A*Vw#3j$FhmuoT`dVSq-H~nw&ic_gqk40O&2wyoeB;Tjg*1DLrhF!k)M22WS!jes2lLHl@@{=fOe1e-^ht{*fgaJ_O5{M)l+y|07~i| z{?zh|Xk{AAmLkX<3IyHw0UcK`1e_-*(&Nc8TmC3GORgRAAX|y- z-Oo?jgj4+~J^iqS%5*~+I|gYk7G3a0A`r!K zcEbLJXl=e4%I7T4?@4Yle!H#iS^Vk4QviSOXz7Y{J}h6z_?EU^m6ApkkU{603-DlK zgN$$M8(dpg`R2xBBOstf%EP23AnSwdDW@G)c#G18rjfP=1QLA_uZnUlRM_HWas{Wk z-)277wl%NL#P`$SCIQoJu$*i4YZ}F&mz-@|+xN<>y|u?A0d;lDvy11{IdPJz&|$HB z9AfjNN5T+VOUu39z(ZWj><7Xu0`tuPvdSm$S3 zRIWMGn8!4ywn8$@$L~kgfoK-lq3SBEIe>?`O;B{-f@G9!rZeo4D_>a-HIzU!ESMP| z%pHg2({!N?VYymu9}fUfQ(Kw>b_&bj$XX|j%7Z)WebAv5pc>R`wEwL5us|$WGn%{B z=G%6>J)Yb{Dd0gwl%a8EI5vHah=#RvO$*lMx$GY0g{V#&&O^YwP1BQ`>}6WTOb1~n z^lG}U!&M*bpUGyh0J_M_*WI%fvIp`qRb$b7?o|$^$7vCj{VAzzV8mLaM84< zd54h!w9g4%;1@3fSUjK6#9gj9&SK8qVujFN*#6(FPrqBN{WX6FZ_jA{RxPan^m?~3 zm^U48b=@^BykyUtEjK^A8qj(>%EX-i+*5Y>orRu-bM-$5_9m|Tjo-+qgGWQ+_)zO7 z&1a~*U3cc{oZE^OCsQ_;TP&ARiPZ|(1VU;eormF@@NxXJ9KV9oWv&IlnSj*E;t33U zM&*tIDjrxd3c!pdKcZylPILe+UB0PhW4wDapz+}NyjZit6r~anT?_k<`EB1cnu&ng zGdH-^obPv__7_Fp_Yua@cva=b@5V=y=iQqxvo$=cQ@?Wp$d(|{AM>h-RV}ES9WI9o z8Ekx0EKmb2A=yD!g+OB_LZprE=zf0h=M!0!)F2;MXkF-v(fD#j?lMBN^AVb^WHY-B z&P?lSJ=;-}*kJ;DF)*q@Z;X<xXW1kqm>_EF!JtE}hU0=x0!%5jF)Yy2lJn<~k)*L6 zofLm!=dC;jHbD9l>p^B7@x#U6>jY!<7iw2+qnIG~A$Z^EU9LZb1dVFiK*PmNZ{g{J zQ)KME9FUJA;@umhu__!Sdt{)UHfUUycIZm96?Dvt1zM`)sm2M=Z#69cL$EBbD%n%^>E~;3>6#5l+s|ok@`aBfT(Olw zSzbCR9FTYAxsWnqLvO3_=qvw<@!E4*5}XiFuoTs$>qye!gSRKT2VGfd7LrY8;4@6n z8DG!0T#iS$7ayr?Uc3qI!juDb1AD+8BlwxZR~aY6TZwPlo3#Q#rY1cl_JthBm0kxn zKYsX9IS}(a_az-*ZEKz&N*VjNvK~x_^>4i-Wwv8n_^Iy)`N(kkYUoxHU-3XR5GKo7oe``Ok z6@F&@mSxSPmxyBcMsS``(~o`^;@voFrVcTO4^@roKqXV`)Zses_QIXFi)BNZd`A-N zZdjn(PCu0nN^VaqGJ4{EX0mCGCIL~s{}Z$RGFy1RKLdr!ZKWnMsMJm{Ez9mV9f%4_ z7_&ayXt(eB2oF+{u`-Y!N%_f!5cI0>5@x;6^ZSxm9Go&}kgWl&mOlM(Blu3zs8iDD zT%ot%#*amWSh@S%HKl`aOi)3qQK~_QMqAVZtAfABtflTJe5bh^!L>R~I@T`9%k0H! z$QrRqk9+z1vLIQ8Ju&)&rsf&vWg+$-o2PGwb}O@RFhF%`>P<`^r#4#$Y(&1ae&)A! z=5`K1f@Fm=HvCdIGK-wY`{+#WPjJj|!@DdGVunNrK$fiWZK0hk-b7+hmsFiVLn|X5 z?l@5J{0j1Dz3bF@yl9kTtC4HJ@RkAP=VW$JLO}(Ga98BQTJ7X``CUt?w3EKU6bcoP zY@9m~XZmgt^udB_6yg?At(090?tCZkBS^Nmn6LIk=WEfhao3ckPRgN+4(>R$OdHUz zSwH;AF51j%XD)$wt2P}385~wRk19yKfw9=~CInfeDi&+z~!Ouq{(+Ht#e*Uo)nEsjy48dPd*Nu3+fgM zpEJC(mr7B|3<8lNjc}Cu(;7TLrnAyR*-FDYZK}~g#zRB>Au=YF1?IaLAU@y2I^D4O z^%+7CUG$6qr@U^J^MNA{h)~Jb?u)hZq@EhUgu<=NDM6)vh4yHmH67J69cwubC}@dK zj8Q0Pq}}iy2FSG(7<#erVLf`VD{ z28)3@u;VSj-}bPFu!Fiy=!i*xsVi*IZfp@3B)V54R!t^1f(4o;n$p=(YPG)!1qB0f zT*=IumKOk>fZl|i47eRE*y(8jf1W1S`)Y<8uRnP?bOUr*nK2dp>#1EsqY^1-iPmv8 zprqNJ{03-AqN1QHJH-POoMSgctK=g!7z+XgDWzxQ==h`@8pE(a!6p{=`{Z;tF+e`_ z+L>L&E>K$xQ2SF4VeK%+EnRQaALz`$J)J*qCaPZF1%cYL!w+2QT?s)o_{erQg;SY^ zV+WvDrejwh&Ia7sbwsgWHj{Cw@?^m{6Lte+I`w&Vdb~Ib4^*R~(*BxZ_s2s}a7W3Y zINd_L^X@i~agR#T>nWpF*I-blV5}JMiY@QqM@B2s<}*d@1SDv48n+f*`8xISEd911 zs9ROu!;o=REN@3z`8z&{udY?Pl4y&v$eT190|V5r&;rfGao6PRiv=!i2cIun>%;&% z0zcI{1~bR!+h+Qp9M%{h%PPd9a<$6hQW;Px~|5kk1wr zN~9z}-G%$sUL>3Ci(FC>1D1{;5TQJI;|sx1f-Ekl$I%}!K}$?9 z7$Cal)@k-3_gt}|$q` z)TD)$V|3>|)`uWaC%HtfD_c8NKX)r_zeg|&KL-mjOJ*5qu%wT;kCUqtKm_dL9V&eP|@ZZ7=P;nv;6V$-W8vb&>tp81%g@8d>*R!z3k~hz`Pk}z*!Vv}d%%2Mt#}_> zdANAFTUY_$EdLqrz|8QA}GYquOuiZ%*UrBDyl4^B*rfwCkFY~R?XSN)6Chz z3Plvv*6x4W3jTk#6<2V#GV^qChq<^o{xcOdM@KKfyiwI)1#Mw4C)CWs&e_w&!FFDGY@Yowa)R+e@aC_CVXNK5l7+c|n#x$`PJnt57X zWBljS1o$8jf&cMpKC?d;9Gq!CHezckFUdM~Thx8Kb89U9_O#%rRySS5xB405c;mK7 z`Jk0ITm7((HkqBBE@^3LZxA%#Y|pEL=zMF~r32W-0}5Y!2RkU5iie)}P+e^Xcq0VL zSVAtQhAMT^lmqEEadb_$KI?k7SI?fG6Q==c#|PM5QVSu({cpPO-i95gfo!?92*8NuCdCxk$6(Q={M@y#o9z80kNr$ zn5jPY*tv~o_m{9Z01`2g<)xsMi+U#pwkQ&?=$A<{v;)9uzXtl9-cUiRg_~!m7?exON-h_p5!|*!B^xpDu&HNTsQxk(92bYmK>V%M6}48_WZS+4OREz=6FHD{$Z zq9*T6IQ}T$A4oJ-_P0+%@0eZxQ2v#vCJ`(9#iyYcUm$XE*PT?sE@z`!=dpBo3jWKm zE+7-tj95)TWx`*~8h{Ac@5E~SHvZM%tBpiG@+KrRP+qy_xLbk5bNO{PW?vfFU+S(O zW7xs$zr{4|oNC+AQh}OEVx+qK${$`}u9K(OG6GxZO> z=-i6`tDI?HBJl-Z4t`=w?lE8w2?ayr*_x<#;|3*L-!*YQK|FDKpwSY3^4~_Qta2q> zGh%!r=4{te1<&{piEl>^zxbxhjSr;o2FgRFkVp8BIZfBeAF`k;x>+UrvRhd-WZ^{v z3JYjq@&+2pXs#8uEzTogMu9v=~@70|k6f!>xpGhJ^2v{94`)x(YDa zY;()C?y#6QfB6ykP4?_FaSo=g3>v`H(|%;;fghGW_Os|~xxqIf>yFIQIHFZAQx(xL zRM}YBDV9ngy(wj2nT;yn_sE{TVQ0*bLB{tBn{U*q`jrBQHb8l`UL7A#RN3v`quNNz zY#=m|VOe@@6D6$c_t`WpTc|@61Tp>&<-Nq*`pB9Db$7X>n@PYXD^Ol1=I#fJCScyl z^$k-4j_-i7p*GT@@>7IEEay}B$u*S6>s*g)AD6q#Qi6nn*ZnsQKs`uLdjlG#>!rJH z$fGuLLeyfcyDUx$6f`a$)sUgCLeEdQYXjN?+UTk!E)vg6rqnNTG&ZZ|tH90^P|DRt z61xdBjv`tdnXlPbQXR43aHmbKA=satxb~&dNx8%7AB5>fX{=i_u9<+b$>k(#I)Rsk z2K?$7(5P$`LZn&bW{DMT^|9__&|Ld48lb6?BSlvCZ3m3WYi8F~L!|F$8R*LkR1oQ- z4yn*i_Vj+Q#SOd~6M!1I&etK12DqHkX_gs$q2WL=-> ze=AO6Yc}|}Ip!6$-ym`@& zkn$zhPrLsBT?H6lppQ8s)e>g5c%4hTI&II~bg)PxuneHY9 zPdRV`3Y3TPA=0c|FxtnQH6aF_=ql5@BnQ87bL^8OUla{IzU~3Q42YChVJY2s75@fB zdInY?Yksj`*h5pd`p#=@lN|6zrfnv2zX%^fB?boyo$3eB$iT9WMubVBspr^7X(W6AH^E&fBE1Jq1xM z;Db9gFCe7&s6AH@s3I3z>Xw$~olR{s#7WhipVH`B%~YBLVl1k;Ph;IA(QLr^4p4+& z=N@yM&8Ysu)K{-8x&{j?X@17OH>0|ONvDU2A98W+sZfxtRnzi@*ha?GLLtVeJzEe+ zcc1Lo8H>DJtsmr20lC(_y=Lg*OIsVrC}E9jWsT8v9vX7VfaHKMjC8C2eK7e}gmR4r zTD9HoZnl6ZL2`wCy^g%qt*^muPs8I zF@QjZk3$zD2UZOPXmiJA&3$X1Ut{DZIiTnz(nxf!C-ZggH0?VjXMrE z26bui<2r!D9iR-Uj%<;L-RBs@XswW>c^7wW6)GeL(P0E%@M?qOw&L0PJFjbTNDd5p zZ{vTe3I;nQD%Z53sRd(o+`92zp7|blBHB``?jyRAPYln`H$R+>RY!Ijsm3yWJy)iu zVs-H4^^joP?WVEny5=hQ^7PN2ky}NPqztdsZ|HiJUr&f(Mc5rwa$gieD7q0=yVs!o ztm{^h#0(^gH$tn7Q+Xx8XaV*Uaw)-*%^H_jtok2?LITmFE0|h!q=|%fp2HghID)vg zF{*H^K++fQ0x>wiGjMBzdJeRz6Ed-~@2)(QT|R`e%rh&ZZQIn7 zJuxV=%9*IiyT+K}rCV0k&(AQU5On(y6a2A_pP<$?-W9ccRJp?rWch6DrY>p z9>&TXa?j&bm+symF(v4YLmQ4P2FU>jE@l-8{SBYk@IbV04W?sVSC6{EqxK3kq^lHb zdW?2OrnV#pN?4#YEG5vSvOgzU>QAa81`3K;rr}19BGG=co0D}tzGe5hvMAOs*X*~j z*@tKbsS>d+Zah05?hgaqPe->*NWr>b_@wki+9>J|5@f&mRT_Ny-MYp zeRMT(0@eki^D-l@7pS7?$OMhAm`!fYWSI_B?(8pry*67;$h{iuILij(bk723z(5&K z%8ePmV(+<8gE1F_mS72(N#iq~KX3Z^tcNx?X;&tQ;p*aI+iP#KhH)ky-6&F);PhuN zxh!SL?~@-_c91to)z{rPvM_ zU-n=kAWk5@sFBv_RGce7lV0!lAF%<}8a0|K?AKP6n?_A~@M-r;%BRrP82j$1rh?|t8wec&Qly3=9hHuB2)#;IkglL$LrUl^^d?0> zK#D{`5euN8bPQ5OgaA^Mj+7uxl#b%>=7#S(zjNMu=e(Q0?%v(m+1c6I*(n<-4XVz^ z^pmn)htPt>rd(o1Zz`iqYkTl2eCUp^@dizX&8e3JZHm& zzlJ1!LUHf2Y+c`|2eFL;M@tN40e!6Sk1QZS96tMz!|WPqQP*TEgP4=k>vA^uPxV2( zhzgvFd6>G#W2n#BFnpAKjN|h`5rW^;Ww5ReIG)c?*O(SxBKa_;Ai({#U(m2?X2sWy zK;4c9Ec=(s^cd>d!sr8h(#aoqI%i@7)v_>t2cP^s4$}{OOFtPiaT^{G29W7WdkW?{jtPRaUY~WzW63Vy-4^0h5@)wZ?fJhlVNn=0vi*?r$Y*VGW8cQM*>wO`u z;vN850LZwDrq&^UFn9104$MomSk`*!nZF09w2`yM5{0S2eXyCx!8U` zbH^|Qrig@xJ=YoHto43BOfTkYJ(}w!^=a~O4gvUW3ZI2u>#ml zahGt>E@J0BdpXh;Fb)XXD1%>jL2L&s8v>3U(%_dB&h;qMQq)ILl`kf?dP{XD*7 z33!x!;ETC}Zp<7ak?wMEvMP{%KehSJU-{XPz?N@NF>XFugg}dj%@Me7g~qD(kv3@g z63S-AO=W52g~fnpX~*Q6V3yGebm8W(>9MJslJeilsyx!8#W(&`AgPp3!L5({BOKUT zSP6mfcVv^)GLJNH2t#_uB{gNYPt!*pch9{jv`FDv6wq$@j6R zQB>bNPtw15>^zCght?(Fd8d*l|3tBl*mUHdGX(?JBt|cW^!Y6H{9Sn0Ki#)(ns#qB zmL8aKU9_RhAzW}|2t63WTYqZ+EYBUHH>x(PFb<~ZT^SO-l26Z62DGwSrF#|;nj(yHUhi7v(>kfBx!`ghvXfZU>HDE&7b<+HGaAHa8$7?ibl@} z@3&!oj)Pw*Zf0V-V?vKCVak$gsFfS=miCh-_j`Z7f z?mzmDEof{#@9j4~%Ui~Nm*soAl8hNWGnagwa&*$h0p0KD?%rv+hjU)NtzSeUGa3i| z0QSe#+lg(;fKuM9O?*=N1H>5@&85Omhuuz@7$h0>>04nDd#(}#t5_)twZ@r z_W_lBi4x>%xQmR+XEPDWVQ;&I9~@Om{|gB$H%?|)q0f7*vBq9s-ZE{7)+lGLQpnq^;&gNQ= z+Z%Ensl$67wOm`jUM@0C9FDJC72lyBSjAHithZV5D_;=ishnLAfcLq!a(e5BIp5pE zsHz(|X+kbv^v<(La}TMb%qw1x_?jPeHi3^Wj9ou&7HTOL^+QDH9%&ewr#ktAF zvoHk&1QyR6O1`gOr}7l{8GOmyT-o05E4s4pAc%LpyKjFMP$~fDUp##uL9gCAjAeIA zjgRVfl(S4qyBWGAK0sNpNeS#2-<3zh<2fzdqXYLtT}1ZPZ?Y8YAl}#^6Oc^ogEJqf zfLr(KcyQTWLFCt_J`ZEbZBCT+hG(KLC8n)NZV5{M1aN)S6?CS-^lEE>$X7Z>L z4-m!-hHlKjAwNed7bm@*Yc|c%;ICbyujaHH*mpDc-nBag0uLgUgW8o)pfWeU&31#9gG7&I74p(R4qgaaFxou z6^$3mxMjY}i{^j!Lb!>1;hvVpj~W`UR+lh0CXEZ(>nT^~RZr_YnZ40Y=2}MXHvE=@ z;{|GrMpDbg+zfDHH9aM$wo=e7`0CcLS3;9C^x^Q%v%oneY0tO39IsJ-XpUs(64F3{ z&oE(J$K9Th*#{r-zp|FOxh1^3W8etH4A5a-G0;1$QFfk{-h$i4An31W16ItM7Ke(6 zclS#hTeL?pGV~ZQM9%drrM{GfcXTc|J_e1OEeH!&s?QU__>hdP&DoNfC#9RO=&Cgv zkA7$}9NlOXsv~q5g1VEaopgMZv7aM@3X{_?lX`@9zkc9>&m{RUpUA@L$LJUa$8|E0 zp`tFod<5`!du=oS`Atz;gZM`G(C@SkBGWgpF};D<8J>SD-@mto6fLjP)lZu9*@~tGMyy(!&qnNdG`K&0DDdwkTd+z3?0OvnA5Z z_X##gr__HH3Cayuw(>?f`p7Fbc{I5H^;E2ZGPJi9{5|1Yj3{vVyv^?FpgA^rDBl40 zlnP3e{GMKJTh^OV63Kg>hi0Z+yyQfVyvcf8$C^E$|Fw#zm#4R|$26E_dOLR?;a;?O z1An_%I`8l*p>a@r`&aSK&zRx8pj&)qS{iMcJd@q6Mx!)Yp8`yjr6)j(1y%J4?$5hr zPAL!et~I=n?p37== zt$FyUpw}oFCgxJwN#4KU=9#m2@qN+;b8lFJM{ZBp^$qJGkdZR1TeHE0gtepzpU#i7 zE^}yu9v&x7m2qyhp#`e5sMz3uR5dO zA=%@1q_3XIOo=?o;G$^#oP77{YnWERUuBDbM{Fpc!b5TlsOC%IRq}0P=!!`oj;Xxi* zlzI2Fs66ji9W6PFT32QDXo=ecWng@-k*;kpG>?hBUw31k@b>$U?~IC7FV4MLeC3nu zo2vWf1=*SN40TR)AXk`OmDh;O2LZ_S^8byGha$H03b zTQB%-eH5+#?LqJ6t)e0Bw%)zg%o)&B56Cb0uu%$);n^i}unwyinR3#n z6qtK3IkAM@#yd{?dsowrR{ND>2^6_;Lwx>wuDtUtj~UMUu^Vp9NuC9P0aS9isjfYZ zwB)x4+Y|dCg{29u=cPeqt*%`d5M9jd<6nD_3`Vi^ zdP|h7ejLi~3JYYTJcp(U@sB>;9C_cn`FYu?pD!#Aa(vfL_4`wamPL6<)?xE+Y~6t0 zWCeOf7W)VwJ1>&q-*POfO81ay%<)KNVMQG#jn}%~_>C|ye!RJBCjP6}?=&jk^0KjZ z==$JbbLC_U3^P;kR^MBq4eXJscXQ1vTzy@yR!bgKJDU#DbAo%oe?T2ud~6M*QH7^s zyBb{vmf1m7XK1oFU{Rj3H&BkOcT-Y`@XkG6;8Nts&L4;0(UT(-Y<&r!K3vfObT>SA zX>L5UT3#aioH)E;p^K0%^z<;Pz2!Ix!&EWRB7oP^Ap4$l2p{Yz50KlxEqQh|Hu;PPj zCfkwkn-^M@hK^lKPm_li2s1Ts*C%8^fh@R7xH`PoiC*WSw4F~IW>jtvLyCQ>&HSxU z(k7r!2J#ITtW4IrjfTe!$n(zMC}Mja5*b>wvoJL8r<`ZN_=vH1T4-UGA6EDs2I@`Z z0RM|SE-eoqDi33AH4{x-49^&pH-w-K>;I9JI=&1`;snFEmP{3CrI~T^>8R+bXz#Rg z`uuVb?=>L@FjlsZi6RC@=$_=w^Yd^i#yTiGJoUis8u`^9zUVWPeMYW!SHOca##*tH zT)JRr6;ux!=As0^;ot2uPhQMNmg%c%E&lnmSJ~Rlbd5L$D;wdG|^mpkG zf5LjdKCr!&3Z&MXKn53d8D+D=J^C}OrDjg*4R7-)WhruKPvD3qX{9@EHh@n5)_n!S zgLOph21nehDzh#X|Dlrr_1tg!UMC?yzR_}qdR#%$ z$~Il&|f)>l~p5<&pLSMXmIv)2HP7X z19S*?71iR47HuGBb+lB_4!a(0>M~F4!Vq_!H}7`Od$sK{zdzq%rgC!+Afy4{5=D~F zFg9IRMg`Y-!A20sShNQZkA)R5EG5lB5a=LWIcc6cb5O6|zehZVj&&=Z#dLxqap-0B zV}9VK2n5DrWDxE|aRCMT!%kM@9D8i+K3GpAh;ouu89trgbcE{FDB4Cp+;(odg2p&} zD$&QPGX8?>CU#=l4;#g_0+#}*ebJce3zmW;?94Y=cW(*lWAr{MCPO6{e<1=*QX1wu zyD*)rtaBW6&PBPg2otI&<8lRHC&K=1{;m_dkXn0nNp~@hNRp2I5e2~Fs~RGf47J>>@F$pB0>XboIl zG{P4(Ef8>Gr@>4U@IgsQ<-1A@ieuHMC!>l+=b%FRIj!h*uR9u$_yH*Av`7XCc{x3X z2GxyRkeJYelAo-0GWRLYKlU#IGltP=pd%PX=bQ$aDwvAlMeoJ+srY53+#&j4Q~wtI zb4fE6-<`-+jU|9`^$Y7y@25O@Qgq?xvMWiJIbd^50p>AJ;3pf&@25R z%s({@;Ab(-Cw97AOLGA zWsx3h$&k-X$G?oHM0NxRk6=bWWY~lwKk3J1Cv73RPCWUt_o6X6!txZ zSO@bLnI$XXX58(Lz{!K1g%^U5ff!{s%7RWeyego4pmyw=0G2^h3q|)p^^Q0M0x(_B zW3lJ~&(vcI2BJT@{Lh!2s9|IXI#Px{UwHCLD=?v%eVd>Y$U|z-Ys#Q<;h7uni!$`Z z^3E^RIOge=uwl|jWSq*i0&R1xzLa!rknDgU-5FGd%YD~jhU`DdaY z(d$zorqSd4%~+B(5SV%1EP|Cu57-$0HSxyF)cM_yrGHm~xI>9OpV?gdWXt9Q=n86; zrMo>Axq0jBx5BR)f6_Fy1j)Tf4nUz9bpm>EV4cC1SKXndJQ-Q3-TAZ-Pm5LIlX(?P64~FW&%C$UfZVXkP>zIevlx*G8 zB5nw{dsOx0Og%@pa=HHQzW&sA{hPcKeXwzu#zha#W~dnobp!u#@l1|M;d5Gk55mG$ z^ED3QV5+R+5hx*MbfyXCGdg6JKVe?oQ;qlmy#>lwczPKHCR&KldzFB4!UySxJuK&A zxC4I0d=%HA;-{ujv2LVayAuEALx(^^Qfl~(!rw39)As^zLVfb*+kl$^{#Kwu+e+rB zG0UA3#Y^j#1c~lpSNoQm2o(GVe)jd@y{R3Pt$SVJURb>3IYFo;#`)+x-XIbov2|+g zrcQu{gG<3B;)mO@A(r`|Nwxv>Mxw&zek-dwLC!2w!)87p+z1~?bIk5<#&;}shjj=)A_=X(U~wTmL^iE!m+byN0V9CnC~#p7zDa>QlEdl6 znoAckx1SNaD-{9(q^Qv}gtN*%kYfpt4E?;7!Y8}ow%YvHHY@wPGqF;gHznp<6BRP? z>SC?Mw0O1IjQsiCSz`Z>X}E1dW4M9TwKWuqC;4vR6Yz@MW}W`%rD);h+r%VK0JDxb z5q|{@eESKW=V>?h*M)q|vPz~UUZ!(CG5Jgc^5K_mAn*+gauP`Fuk5i&=lvO&oxAii zcwrR^MUnn^;T_nX3#{-rsegl8-N5Bn#4e@q@-JT^cpgyD*?<=HTI&y3_a)o$`98P) zq1v$>7i%k`ysr9&VhqhHA-724LSwl%_h~;n^EvNG*;~c8%-vznA@YIgdfslzAWRIT z(UyS5G(lcXaw@M(^Uv>T)qtG4g+`LwPQ=tGrY_V~g2(7+SAQi7Y)m^Ef#%nU9Md>0 z@h+zJNA-J%$6tDL{WBSY*=a>1YD6^n%%(}kbuR82`oEd-NDSMKhXXb0LiE_jP!~=W zuy4T0QC~pTAE>a3LDUFp@a4*)PnrB~4g$Y;*H31eA~7$72q?M_qq7GutX|iVzIc~fAX8vC6=f;*iMUo`~ov^2?hJ* z*iYgcC+>*&GS$31P>iEQjI*OaBAaW*hOv)t=c)AKyZnv_jZ_*@3p=E z!Xfb(8vaf!K@gpZ1vZvGTuY8Z`BJ0GTT!DTwVxHkKd%irq? z`rl@kNHI+}l;+EQw}KtlZoXE@NP;7S()J3k^=K?R84-B}rJg(>8aQ%D<_|h;(K9r2 zev*??Ixc(syTXws>O`N));MAplFS}&X3^pP{XYC-I z@lnw(T}JVMD8M+~O-^SnenZws|68|tNSw169l5D$$Joj9%5Nf`{z;X%GJTjMX* z1wWfS`)cyWHii!J@dYJ|6|v0|P{QDF`Q}V%!DH688IehVhr-57m$cE?y1xX6a>>|J z@CQiY($4E;K4^YN&HwDPlVKF%*;K z@XXjlfYF~S`Id?*jS7E#>5kF~$S+wnDPzq3%rAinIp$SK<9bc@Q_Es7dOx$Po{zG$ ztDcB_Rr~csN%@8BgoZZk&^ZK+O0P+nnMs0Y*vFd#kW*HUB?fld@!FG6Len6o*G%}Pg1-9%20MY8&M=?kWe)w$3>$8 zg!2q;9x69L42EfGvQlU0AmFsYR*7U=)bp*m45Ziy*E7b$RKmImp4PI9A0)LBE+zI0 ziWR`imaR$Hlw_5sYbPRnMBK*uMYIyc!Os~m&0B@4_)!yUoMQT3_2J zbhfzMm4qDRu4v<7L5q0AiKmz6(?zus=G&LF5+iaIN&aI@aQBx+rpG$dG#p{#Iar-* zbHDjxTTbVHA`q2ZS2Nk|b0BrjGNTPmfRA`Dwvy92#MR(>&bizmCDqeUfFsfAw|XC`)r5@xyfLmT}}zPi(X1tCPp zNHA2O_8){k$(AW+m9>zY+-#Q3}yn|*Wkln`|^5&ELu#dpwqqwjN}m@2R~)C zFBO0P%ueAgax>VG$br-=LFPJ_RWhzAfcrDC8Bk@ECI;FbZxw2_oxNn+OfcanBHQB6 zz6yN>j{y$U3@klc{Im)L>2v?>3{&D`GI;+{Tk<720+~M;gG(u*!3aho5CM7*3zYxL zK^uy%eA!_Q#GD6x(8OoA{71ZdOZdKuXIP87GPr-1SYdcuYc}_ne*PXN$|1nDJ}P-Y zy&JjSn+B&F0K-l>GWR9`JhU)z-fCZv`tsw2+pK{c>09#DdSk>U!0GnNpE;Xt>;KYk zn9Ct^D%Eb_VI!bVo%rqL4j8B{t^m*WzoN0-fuvEP*N26`Nz}rm#uD&F%0a^#TJJj} zN2sz-X{3Wb24XV{-FYS_GChRsugTwc(m?b4Px$8kz%HNWTj+pOb}y96aDH4c`n7JnqUkmOvE09GJZ()lFsi63l{Fw}g)4 zapN-FuR?+ujiEXw5Kv11dR&rJm_;K76JN}^A1YP=tPsKJ1)ma>}cPA6#87vv@XQm z5P#OWR7hjPgfw12Iyu^<#WDurZAL1<->ZE@j$}`5ri{a|Vgtdz6$mJYcB<3_XhZXE zUqUAJGuZ0Shf5Ma?2GA8g`8!T8sW!~Z<0=5IHn(0C&2K5*Ut!RddIymxvU*{oBJf7 z+LxLWi5EK%)zM!}S2vhqzh0zNAmCQpmoO$;VDaJ?b#}BRJqqWf!=R%32xz7|28;4O z`yLJIj=KPZzNp5=F~0#!Un@1=b8A-Xf^OMzt?$1vF7JN+Wh8chWlldx_-KofOu_78 zbt1{ScWjDvxE|_2?2%zQeWxGXRhN&k0mzbn&L`z6@lh<60?ji2=~KS>;nxTw29+%# zjXPjq3=u5AWL$G)LyhL3R?6kVAbFrrVt@Do84m+AC|~N(z%9LLl+++T$EKJY3Z}p% z+VG=#f|0>DLX%au1bl88g&{75AO5-^2!W%&oGsN3VggDz=p6vB?h*p!HyR5xKQP^_ zzYO6E&|fC(O0AklGNfx$$XXI_%m5#JC%$}NT!DbkH=aB9pZ43ONxl80#`yQ)`}uE+ z4Ryk%^jr2Opd$zXI*dgVF2o?*OAeY+KxgBPU@nuNJDk&hpiap0|BO6=BfnYdPoR33 zMvt4kvmUOFg(JIl804W&+l3mhvP$Ix-z@YU9Y+2O*>h2oCM3EtLMTXBLYzkHru8w7 zxB$@kFe{waAHGZ6_rZA)29pCs;jfIhm3zfotv#A{Xo$u9{4^@kRTG>0-qX!LuM&^e zN262Ci#@k_E(6WyYBJ#6`OHCa(KSzjO*2;RQI7P*kF#jS6`wxyf3GDkIi3II<^uu& zcjaDT>%y)r5-$R7Y^Hd+uo1SP=V4*%laRF%z-&vhpfx|zkke?1%KQgQdKVtDJl!x2 zovc;IO`KbcB193KPy`hcBq1Vu_5~@%8w?P>Oe;X}Zka&f)HH4pF$coHKfes6r0v*B z>aTtuIy*_S3-Bw*5u_h7`JCBQ_U;QMo__$K*H2Jux2+JxH2pq&doutk19D_y5HXyB zyiXhgDtxhwcfgcU@QJ-}PHQ*G79jvfb`Xw7v+_WT>ce%8;?P~PbHCzArVZr}oJQV6pi-*a3*DNb3#G3eSI zUShaO&0HWp>N^nI<)?Y%omTm`;f%7Oc|VLSB0r_72ifDv2)rc^j`ho$&^d+zw5P1+L}U>)2;WDx2868NO~ zBl41NFqak66u9+}7@M@U*&%=lH~s1*q-v}DQ=|VS3`qkNaRRH`z|Fm6Rq11ZJGU{|oQMl5fa{wA{1coX{q3s+>|h8}@`8-vw;RROw?Z9*Pp|$qNlp zl^^?H7?GwS@{5JUNM*cM2`5^yK{{u^50l!Ip0|Rk_l$k`GQ7$ch99T+ZqCx zaVk+{mrIe-5kUC;42I=)@u89gM;d5cvX`801wRY&(L~DZDtWyje)e9xU)vi$zgMVM=rw0xbC+4yeP=~VmVi1{ia-X}f$OY*YjH;~RlZyd zB5<1%m0Lvam2)iv{=%pb{RMEnO@>|jewTb1%u@o>dVsoA(WB)Zt2ATpn!lfXYG641 z4M}>tlIzjyPgBZN=&{`DRI3B+tiO3L_-OaPO{csWgBm46pF2DQOg80U8x=8J?n^*b zjE5r9>~;0s3mg2W*{C=H2cSJpqx6-X<5ehg3q&!a9>!<@}eIt31HO{O_4q6>2f&gfG(z8Dum1^o?q`vJp7~mpqs(0~`6>`6$JR zxu|__$$O?wrE}LwXyu${Z-cMHjQ#uATtnzqo=sJt9+kQrQs@B*a<}^K7 zx>Ga3?DPZ}6Y)L(0>-njjpmp=a3SM*4kM`qCdEJbj!cAI`jzugb3_8X<{_?{vdV6k z6a6>ePk|DDbqVNV4%}AD%VhSTRm@cKJi0-}fNReC6iQoohA{x68RkQcrEgWvIMC?P z!kP*sKX=-`bq;uV)G8@kQgkBE#_43^aG6auEhbc^@vOqTAYpizYz$%<6k>`tUNwo1 zf z`ZfVWY+a0A*IAbaS2>XH5;k?1m7@OD$3d$>Xu_u=md$rcXWt zBtPb(kMeRo&INL-S3Tt1Dh{AdeN!+)PK=hVb#UbKuv}UGreJbj<*G_joaXh9O*YaO zAFEi3=F4GB-pr1BHK>1ZzEeU4CQ9h&zVXBEpA}PUslT9>V>kRQfT^n2L+V+4L81x_ zV{y2O`xF5(u-b+Qp~Fif^-(ReAGmZ78TVGGP}~o~!_@fPzeHP^5&A)#5c3@02vMvN z{?z=58`CYx{hx}jP{Af-=1#I_*Oau+K6zY-4+iA*E&6ffV5*%{{9SDZB870mV!-J@ zszd5zI4V?En0&&G@^9unrHi203UE+#Qu_7GovQWqTn4SBC1}j2SD^O>9VBU|h}3;O z2TW{5a|N^mla#1p_%NNWoQRgxh|k?ea`%ag@gVw#|3sn%M-NRL4D0aN3s&(!E5RQW z4}2Q4Y1P1wkpV#~BQeozIObteGDRJ~*89&KA(s=vEbKus>=iR>Qz0?(T$DIMF-o9_ znkX&O6n=i6GgFubPa69D9vjbDlHOYf5t-uQW4 zjEe!haCss6g{<-n39KG2dY~L7JjQB71%e5cYG0Lc=cmltnq?$dsB&hOob<}YfGsN< z5nMOiN%T}51rY||oj^ZIQ7&>en7PP@?a5=ndom>&4$9J_L`&s&Sw-aN@e7mj^%p3c zKlnWTQGd}=f);qi=1+~@xf*1fslqbU1Vgtf1G+690scKv3rqYjHD_{~6rMcBKY=;s zJ^BMoxl{h78CPS>Q>F53ENv2(UwwKKF-7^(TYKsyaEgb+j-RLXW zmfJ|72Gm+oc6^0CB{QrP$=)<3B7Uo6Y%a>HvmZOUVtp>ijJ}8*qk1FA!u3XPNZF5I z8zNq#AH}4xjB- zPq`Qy1?DqrfvUyuOZa4ZenvL9?eepe3pI1wHmFrF(H0tfnwW!t7Kon<#Dw-@-{Uw! zRK~l)D8RkWA_qzJNgjbS1A7~bmCcpRWOpORCx_<4RIy&<-1H}!^=-+gKIm_zK)7~ z>T6{N)M>Z%A%ujr$^^eEpGfvTtfU8+e&$T+6lRvOz4Uousw^%F+$taY3R@H*2y4!J z(W^_fD&yWX4J|B9o>tk@lx1gd@2y&0oGvLm z<3a0umixuHJ-5I6mrQ#yoL>HIB>$Ub;xN*LRjKUWo2XC+NxE9LtFcR0Jw9{$v{(0Q zD??fupw@KxG1L05br~GqcNdx zbTEfEr}}>40Sst-HOa%z4{9sGgon20c=4rDyLjGKS7if-j*C~L4lKd(xCY9d1Mpps zIkysNfNe0ZEk9YxT)EKTD5ke;(_U%{m!H3lts7m%_N+d8tNlt*?7+#s-Qy-BR9v-c| zh`}I9j>Kr`7>&EsFrY^o1Dy}?Lok{KgF(O|rnU=eCDuuQU>FTvClx{wG)_7szj9+n zGd_ix{b7Y%8~}>x8lFln9)bBQsj#sR>BeXgEk1KnG6;CP*}!F*2AC9vh0j-%{TLaW ztCZoi;NZu;L%r}939_KwoBi zUiX34?%6<~ij?t#dmYvheqxinDvq(f?FuEyHloBXrnO7W4LshYgiJQTt2`|i18Uf< z%k)UqQQ4^};?V?{(S8YU{u6WSIGY1N*asiaADmfhi-a7m3vYZ)!OL z6_W{odreO=t9e_u!zXoa1AM+qsHrXJG>1JaN9bZQ16&hSk^{G)W_6;T(NnVn@0gH5 zy&Niaolv2xj2r>H^rvYO;scbQ4@gM@(20M2y1s!_;R#-jpp6Eq_@KGL$+pZzs6C?i ziIG8bbR3hyT+bY@zDkMt+Vlwm0~GgS6ZjhdUg`KWbwc>mM`)O?DR7#QEQ2W!*s4Z_ zFa%vGhjR-Bl35*OKB(Yi_dP5(k{mO8JTzRKyd0rr0RaS%j+%Krwi9h9t^4Mg?b zedOjrDhUqjP?xu)@;;xKroJG4%xtS!vRZex?HoadtblUm06W1I`i6w>D34Bj@crG_ zBr?&t_?V+sVVH1t!HqEp+|RUjnua^|Ce_Or!*< z6)^VMc4CO-F*#o+UWT-+0YMuRe5i&g2wq;4WS_$b(Dq?NOA%Y{^v!2CETN`2v6eaK z*gg0j)8mzYw}Tv@b%QawAwrx#OrOjBtn67)-85O>TWDE6do-D5(cO45!kdpOH{5d!aLx`9XBZiJ+R>ODtJ2%>j(iyVO$ z56%es8dNajxKde1H=w70PnJQee;ol$BH)w0kK9^^pTj3JIVt`Zi{^P4u?eR4FEW1fmx6`f6V_KbZIWA0M)9mVqBM?)ejoh z4$RehH1DmWfq5kQ1k}uE;`!ns5f z%=qORy_1xaImrr&vSZ#FSDVlj-HZAbOK5n8JP85SFe0j^{|fi0Q2%O3*+~`;;eSss z9`x^1xQO*~95nSU^N(GCMq;QNeH7dEm%UWWV)zSFvxj!&WoTKVRG7DxVhQZ-+JO0C z>BZ}Eq+x(pNQ4^3V}+)DM+HPrkgWU}#8lq&qspX2tPn^uPe!OJR*vT2A{pkUhBdwS z02>nCC<-B0ZiIK?r>rx&0`K6^nI5H4&^Z)=K2R9qT?FatjJ)6-)C1cnRZ^)sSY3p< z&Im&+_16p)hUzjH;dhznC*}n^QEe?t{7@O_aNH^aqj$Truy-xp2*O=oo8{b7ptvfm z5Y0gZb988_u|@oy`W4@E22cxo@am1YWm7So#E8jhp4iZ1+pRm89h~xPMn;*%;$_+O zn>)Ht&N%{M+ z!diT$g;jBmw7-7*JR7Lq6G5u#0A3pqOY4xg5!-Ylfnc9iM3O0eLImr?ljkyRw5+&w zwj3`tDu%9t##r#-*DBV-Ro&~R&6GHoRB__#Bvd*BUgK~-@3QJwHg_9A-Cf@FaMBVt zi`d`%o=_rv-*r)VjfCDwnoqk&-+KNfEycbETE%AbKbfzebkFwTm?YF62Z({E zE*D+1-xAjuu%b7+p-!suIJflL87njIz_LP8cCP$8-gbJiQo`@PY6X#lE>vl#=F7{J z;o_F<2yH2p=xfr}gX6k}XXNkxYLG+jS#M8TFs4^2{{mN%!vBQGRF&LOqCSpA8#9ZJ zpr38``X%k^R*9Efh5S3fPYD+v%}n$XQkEBWbJ(6Fan8sQ447@2+A!kY)pAPI0VIwZ zJ0Be(?bA_EdKFjB?Mb~O2q6`eRauw7za3n>N>yV~LjoF<1y`q~!82*|% zeA2ZsGO_(iIxn`@`NzVc)~;Yzv)!@!C+MOyk~ARuIv^zjW^Agtv2t=}JC5eOTcd<( zE`p`miJtu8CkV-&ccG%HIJml`&w$z|@fxql6k2Ec+5eu(A#E1`Tc2IF)R7km&RuysEh zVX=;CDJ5Q}PYl>#-Z~X~A%W>q6!_ouq#|%xtH5my?m0!BETte7F)(l4h_$22bbGXf zT_d&wP&b&jqT%)lS=S#8WBW-(`pjGTLJlXoYw^x_C@Kr!XQv6d8ePHf?nDsv6o+bM zM8lhv9@&cdO4Xd$A}R2RrqRyDTc^1=Iqa$Ip(O{j3u$d=bDYdjqi-f#gODc%>?xk& zpffoae}p-LKmjKV@u4R&DMTf7%u(i05r*6dubTPb3BR%q3m$%aiHn_S^i=krGbhBk zE;e6)^nc)`fYyddVNRL_!|6#VY6bwFW?}7k zhnEcONRkoUTZ+!lM>?`l*`KjH12wd`3om*#AAM_7K&s|c6-i0O^3teO-sAe!!W#A1 zs?4aIG^QmXLX+v6Zp)p8dlEUi3y@PD;4z8rGqWqTlmt|S zmc&4%K(G-$IOQev%ooPDBuu*3Q*>|z8Z3f*{#5z3T2L)4AV;_>fFeVaJV*Shas+xe z4y5PU7W5foEJUCeF`&wqCmmq0ye>W-$^VXyG-+5Y-o96cT;G7jeRxq4crC^2hfiOT zSnzhsT%V)H4@CC$s}LMi@HPCU))|qEhM40v;2u!qUuuDBsCeQ-YI7QFV+FPmx^f0&8QY7+-oo{*~^Ge7Pm7z!$riMX{v(!&8M@V=}}9%Rr2AE`+|1~w~? z2U)jH5^+Eycv%)0ubq!Mo+o+%tukt5l^Ul#QvDJ`ytrN(;?+r#0*kX_M$@Y3-F%D| zYr;X40^+l<)(`HX#oiT?-oeFSUCe`|J#!g?fT0i~pl65HGXlSo79+TR%8-J~8CUKd zzl(xbR0%FK1(S3cfJZypEKq+?pj#Hw2LPo)@cJ=#A!M3U2ni){>CTGk4_^MNO(I+( zXqi^zFiI#tO%iCt&@Q!8#tBg?B!=KuqEWd8z6YKp5gtX$j1Ec_L%x$DorW-u;KgY} z9{ONJPl_IC3>je9;FK>fr}5Bh5|;y3pchP9{!^ugSV`4#4NYJBuypeoe+U3x)qIh zNn&jP)C&bp#w?#XP1k zNj zA8_Uo57R2GS4xNu&w;D*EByLDKJR>Z1GUg|i3jaTUA$d!avb-vkLonax!PIs#~xAhWQ)XiUa>g!ve?DT z-#|cxwNT9dtWwA&2dy-Q;pX&_CDqi+W*0MMN?BSjWyqy>PB z(nW(KbvCL--N9^4QZxdQ?EG+T`aY^ zTU0&I{-!jKZHfH3tahjq`j_+FYtcW1_4_+p;)NPrFc=-E(OtsTG!0>C%CBgVGmhj z`WVzjL$0Kik6M|0ydJx@x=Ze}d-SJD#mwhlvrez)z~6#SBLVvN@BJN(h2-hp|67mP zXsO7JPqgUx_dfiR(!Tjj3_4bzqo!vc(}n8v{Fle!cXyfQ969$^PP`v$|NGZ})u%#x z?6~y{$yP!ja0SJ*J!0*-ukn_W*_{1X@53a5SynA zM0h!i-ltBJ7rtr|c#$u(rs&z@_uPr6>`t{ko*}a;e3PF&+HYx;COZ@!qJNrNGBU#6 z@^J<5ovyu_;dLKVoXE%Lw~H}_w&j7UmpeRbm?#6tV1n|e7GFu<>80SO4D6%L5lhV0 zD@zx%ANpKyXXT4$6}r6q`FMHoWC%AwBK{SH)HPh;(8n!f$_VMPn4e^S70%lpFwws) z#JN`r7fihv@VC@s&2;t4eYIzEu>Q*A)fHFDmZH-F8Dw38WA?e8E^*Djv~RR_e(Sc8 zuNkyN`&F7s${oHKv}{T%xiW*iczc>N?AqhxzGjgdF;XV-diF_#UgM2kgy@*5uQMY+ zq3O0UkLYXl-(;$*XnlS5IrHk^>Q`nrrpszAR64XPy`8SK(WQZx?^}50M2%!WS&xm# zP%Pp2LV3w#Ek!0&pjVlNNA$O}FB^Iv{i#x&>MGxdq&{@v#Z#Gm)_rbi?)*CsZo96x zWS_NfuHI@obH7M6aqWyubSbvJ=}o~8PG!mpySpDg+s$ja;b%_uoLdTaBnwrX&lfJP zdcISXRJ-Pv9pnFbjPkr$9A&MX#IFJU$4;x<+3y&h<1Q2g`ab)Kfi$4uy+9zhW*?I-UE+O&%g&pa1z|*o&9epYL@x zg{-HaG%)dGWn9K{D0U6zjTjbWj|8k=P@mAk%`bb&-;!Z={m?WF=HjV~sNg7=O)q{P zf6{59Pu5crXm@^G7|}&`0{p+4!>~c{zLJ36--Crr63 z{oF?DZA7^QCH}G=R~0io=kxKZ{By2gvD-G{wFG4q=jpf;0}|%xKc}-WPjszwN_zf2 zxtStfUDwL@~s~TGQtfT`k{+EiFZ6S?Vd)_J~D^TLp=) zI+gZ5HAfx9d~DAS+~#GYPvjiaBj2H4t<93RK$yze>Iw?(pR#>$hUV#g^N*4(LOwJx zX7A#p3O*noTNT#|oybb0wO6?I@A=yOAPLIWOhi+eNe@mMiCnb;AYyyqwP%;BOgL8gD)N}cg-{yl+R&~luS-%LGO}@`? z#lJ5xW?uhrsdLitV1~xfQt9M5#y3GZ{i!zO8hT~QVRqyiRssqJ3g(xC65LPyUimt1 z_)$A-9BIBC`;CX^4!dH0d{-}bLrQ_i2{pZ3FJaL-AMM{f`C;FLe!qAgXXCZ+|38$y z1#sm+k}YaxyUonZ_BAszGcz+YcAJ^mZDwZ1HZwCbw3*rdp85aBo88%cZ{LkjgrvG5 zsVXZ&M|raH1jjz9kfHT_%2#bf7h*7mxfsITTqsEx!G%<{l?}|v_&_14Dt|t-G_Ugb z=Twmj+>A+qyiDkzceiJJ9slu(jmz{x3c#5v@_bJas3>I?>-8#qyY?k*O_sF_36TI} zd)6Hfo%~Ble=%?zEc$Ll?0ze*_p`!Q#H3+@hi5nrFH(jkRF&DzR2xu+l$if_Z26&l zteA!QPw%k$IFgmM1;5`0SmI&p3rd|wIyiwN+7F8oIF^DQ-6FMpsrQ%Zeu<;YDh$H@ zr_F#e<98;2?=W6J+Nu%HC-10~wtY4p)(}!u->(swkl_SoB)7BOto9NdC0kNrwZTs9ueNrvfU8%&jQ(d>QwdO324D!6&G;ERw^&Lmp1H z{}JS21^h?Iqaz(#*^abztbPqSeJ5ZCwT5^14fp>x|=j;8esE_Vn+o5dE8>?VIQ6zwfE`n>k;_+&dG_KQ>#+ zyn!c4TkxPD#9X%RzPt`^olenqJehQ2%9nSMy>>kCbvw!W9t!(NJ|g3Y-zj*`y>q?* z2&YUu{5ychTs>oL6g&Ofi#(Pec!HK^H!~h|PA%o?j&NbI=C_?f!O4U!>d z9!rkrj+De-ER)`3cupDnNmGduceo5M=b3=_w{?ClvUndgVn^mfmmi-^N>wqa^d$Jg zT>3=KA7?EcKGetCT;yHzn_tv9wENF*%W_!#jfpQ${vG~qJ?A@YjMcWG!bV#iOeV|H zdQ?Bnv&(j%m(M1~uXq@yz>j}=^h!F{#>?%x6VZz(ncyobnZHJ*&lTsBDz__G7$c|= zE3QfQ+WysV3?c9$`?R>y{b?twRm94yMrYyOMr889J2Iq4c%P3tMo6rr$C4`pD8n#i zRqs!(I0K&snYN6lI)4H0{Go1GckN)$*i~EeqPYo+a=Cg9mhHI#uVUFVoF3m@L`#`Wpu|sHZA14| z$veqzCgJ6czUD)^5NrMsxeXSFBHgjPS4_#VbxA6yGVahN*D^jc!g=f&DmE%@f!bL; z(OZ(0A8qeRv=${C%7wTD&hLi?E2^wm|J_m_qe2+XRl0ip&Y0PhK66W1T}bhy7L`4r zZI0N`lXrv17j$TBiUK@)j1Y7$;~(%pa~d-1;TlWP?^NXe&!Kj*mO-&Q(!7d1k>wPZ zBr-HdV6-6*M3tYEwc)YAiqhBplnDV;pwh>sC!~S`fXNsGKO?tAHITnRPN*5)bF?8& zFeL;Lc_H^m!Y%BrC_j&Kk@((F%!D!t()odIsKz*7KvruoXAH0p&b38y@?R0uJ7(3E zn#o)Ck!OUjbuwx6#zFnWm~H56IS{z94OpG4ThBkW&|Gx|aOht*MGb#?R$z2xTklyv zU(zY>Tj98SlkbQoZD<;7HwPFE%sRkgFoZwoB6YqYYv&Km8Ua$2m;K|;?b2#7WJSMV zFVpsldo8K`N-S*q1L7ehjbcYvMeK71>2ow-2Fq+Ae5Fd1&ZnT|n-z24pJwBqv+xI?Sk>G~kHBBq=Wd>uR8Vp}X|VY?qZJ#W8` zhIRp1R8p3=p27RTVJs*Si0KFdBD=hbLROz@oEY&&Eo8zdSetGPdjPrweARy0{t0!B zvOe03fy_EL0*Jmm{)t7SEqykeSs5n=7O84!Z3sC#6E=!uO?yk?a{rqby&#c2|BlvU zaOstvG8?r&E`7&88(AC0GV2{B4~t42ysr5$ueD%X(*90YwIckiAX-y&&~Kje8+7SZWqt)`;6+)=fXu+(j#pjV;EIYTnrZAwms zRb(Bug4%w2k6)?8J*^r6wlF<$y%Cu!3q0|R?8rqY19omuJmqeb=(KT`%&?JjD25HumZ@K*pkGTVzcL!A#K7t~@30bJWk0Cl!V#gJVSxQ2! z6_wWrRjEDrn-M7wndQGu5nRbx=YwbL=uK->G-}Qgs0=u}=7!PC{8IvU_uvqq`O8RZ zfl(7d)Exfz-~JjF9mW_@^_H6j(!5BtXO8_nUeLHm_Z;g(XKxC+hGz8*-z3SYD3m*{ z$mE6=DzzXJ6HfwIMd1bYF%)nukk{5EEQ zOGf{*@h=j?uZx$ZWV4BqUTgsHj?Kuo>h50 z8QE22K$CwGYnRN8? z4Ar-cYNO7{JfxPK$Iyq<5&w^nAGzg3Gp1|hQC+b#HR<3j!4>V%6Z-gzxHB0vl4lYR zP8iEq$hJkbkb=%$vd z9ntl?Z@TEB@hLOrQA@3d zOS>fN!KXV-F1sAKrn4(JQX4shY&imr}h>KiB8WkSmn8o|w?3Pb+1M%3d{#_N=M zy$;4&VUTLi+YSmZd5^J{oNpf?9DMboV`M;B1^rZ2J z-J+|voU;{!ay#A%_lyfs5$rbd^O_b4`Y-ha3UA!Ia1H2B64|ZdD3WjQAQnUq{jOUe za$6*FYjZJ>n6h3O#LqHJ#NG6mzUNa%+sIWTSW&S?#L3(NKh6lAf#ThJ>DPKO)~e$p za&z0Du``S7+}nLtZ^ShxoCx(8oa~U7{AlaiOVNx?-E_XE0$s^G)2jqKk{EJWJ$$8! zVnA<#gM1|#^0I!@jvBvX@PFmspPIM%cTfmmX8#|dLS`nme~n3A{2q^~<$8cZl+1`a563pm~d#H|-f=cK!5XbF{aY#Gz?#G7l zuLN`g){xFJb{RNsxNZD(F8n>MK0h+8Fv()LmUv_*L6t=m<{9PEjwa_1{bN;JbZM~8 zDP#vJwGV%2j#HkC`9|EP_oON`B{d@Sj3@k)z) z!>Mbl43zx?kZ(z@f^(G!rhiE<;75+VxmBo)9VFk4{G%7#9$J2VuUv2(Q9o7}t-K-6 z)9idcx0T2B{&mV9jY`NzBG4-7RBn0+kfvKsawV}5-gu%-`gpKZmcRS-77l7Cf8jnG zMTF`3vMO8>(Tw-|T77SMX%=3OQZU6XMRuGTqEYf=|0MYBff&OVu2j1 z?LY|~P7TgkEjr%NeyOTtLbLI6@QW6l*o_v{a=s|lMJ^bd{Fi=YkhUakvIZq#)T1EP zW3l-ARy|Ex^*UuT@ml5jN%B@CL8{!0gcQd)%}i8723OXJyWoo^MJ@p!PV6-ZnGuu1 zVbM*3hovFjeX%v6tUBT7 zAU2q&x3i02*QkxP%_aE}yFXxm>t`V>6%N&5);5n+lJyFyjf?iWjC5aVAM4lqn&0~I zr8%r5XDyj~gDD3VOoBoc;kRx4JO$P8xC9Qs`6p(z>{U8$nEEr9GNot zz9{(?X!KW7^WNT#3`3PR#FI&6z{nOLovta&Z;(A>&sLaxuzc-ze%9mS9k!Ba+;39xsM z@DIf?YhP)HJrcBzV$8>kvt`R@Lt%9fRv=BvU~TjB3o;^(fJ@}GA$ z$;~&6YLbBN`hUB3^ls-z{pkh`6!^uzs((asv7-)|Sv-bK4Y}!bhdB)o^EjlBH?_PL zM7_TbhOD6qK@Fnq-XOckJ|e_UdHxPDYr<4;Ms+l+VR*nM1V5Xc<^5`4z`o6S40R{W zdVk(<{IT=Fqon2$xZ=ls0T*8#)%b$5b8Ta;gyBWiZ!!$JTLFB4Y#fZiDlQ+H+pRZ* z+%XjGP}!>6bb4I;1SBe90ZFwdgIM4aosV1N>RWH1?8cA?Scf_}R@h*&z%g%F;+r@Q z@XSPxOXBjVj^OztSo?;_$b!(Na;*8+1zI}ju%g-T;b!EQ1wXR%PUzLKxB|%E@*Cz* zORA=s_+bkgQ{j_o%By{QN_nh%$2om>;c#@?prnf9tdDhZ&$alrBBfuynm?RDbgcTK zD`!$bTas3n!0IiC?a1Ya!uUXy2ZSW}<4;1<=izU0>o%&geG{HEhcq;7#XaYLQxfU* zVu-nO`R>*n!5Tk6j2+;0GeR1JidEeQcO1Y<8*A|^By_>>)!>SZv%cfY)EYbZbvw;8 z#PSSqXwowG*<;5-qVt@7_yNi_?jspOKa2#?9A9-e_HJiO;6GN-aZbxWsclJyICm$K zLBSr$Ilt>m@^MppArwUJbRQIGfe6L_b?RUrWp*mfI!@Y<{T){ta|_m8z|uT4-_Iz_0t6;j}*|i zz^I*&HI#w@4Nkf4#*DKwTxv_w$C|e5dMGEd#jO*#xXXDO@{x-{b8e4K4*U8H?K>j+2s~{1r*`{3+Wdhoj13iXbXh$pP9g+p8{WXit7n4EW6aSCoP0y zrv^Jx=bHcg!je=tl2+iAFHmdOema=hhSF`Dj;%8sLz@aG?kSpxZgz|Bm zfL=i@KSN05^VjW9o|K~dAQ z(&eL(YyNef&lIBYh^%RIB4^I>Iqs_jT(+Ey9)Ptr1>|yA|9?4iDCKkKpwL61;EX;UPz>MrW)!0Sj4G; zDZctkZ=Fip7&7$m(Chh;7#5s{bOT{QI~!Yf>5avXp$`e!a>v3SQO_EZL{E9&0=n<1 zs_+mJz8_~gVRG~(F0Uig4w>nEL_(OA3)<72CU`-y#QLj5tjH|rWw2L_(daJf-~ofS zy2tCqz(Yr;+2@%lr`-R|sq5>p#vjPTA29k~fGhTYNaFn;`QC4m@jr#!Mq~Eb5W9|P z?m;IV^nv9|mL-;r#NWfAt{;U!DmpImPLVzg<1 zJLI;r&rxG*gO|TMy}XT0_0v}j$eHALA-zrcNUJ!hNu7hYD4dRN(k3>*RP!KQ zHXZNuYGR%;s@FCc6CzNLNZO(gZ8!*6@ED_L1v2aA*lQimK^jY01U{21dU5^fEW_G#xn;S{zfm5ytN3HT0GO>PG zAxQSzF{~2}@@s`2@zNzw7{@VCm_`}8TvQ9r;$@&g=G<3B-Zqmg7}aFDB$$N0 z8fO&5D%oCShWpJu;FBdX#J^y*Aj8n}((5JU>&I{FAy{x5R3TW`GK>|WKlXa%o-yU3 z6jv+48+cEH|3s39St}z%pun4#7W6ZI@Na4V0FZ71)ye*#yYKU1Pzo5=^_XFpLZTQf ztVjYf?#H!&DT7bW;&cW*#&9-UY5_q2U-sq@z;ki%J00rrZj<8mswvU)L{scm4@Zc3 zB!93*2?kvET0DN8p74m9>w}ptCF?b)TdtPStLV?9j@sheopI!5dP+xZec;KILH-_l zPzHy!_N}%lkZ~YprI~EQo%GE7U|N=OMgFEs8qe3KhDVp3kaLuZq%UrsV9;@hg54lNu>rfz706>cG;!e*;cJxQZ z0{+8G{?$8^<*0hg)*G?hFD1PfrQN^CxC`^=&!&iQS*}KSMNlK|&sxlgdf&A`wS!oW&>j7Cc5F8CVYF2aftE2SarS6_a(FIr-r4MN&%EoF!DnE`v?iJt1Es z2b%briZMqD>h6k4VMX4vhj8&z8$<)5ym)}ihQU^iPGHkpJVE;71dFOM%BNSeq;cc% zp}XupUt6!SZOgr^O^2h`1Akff%dkKsOJl-~D}6~M8rA||TDAa*#BV0EV zI{RCmbAxqBgMb)Se=wdw<^DzRBmaBa+t=`tuF>h&*4)+EKaDDbQlWclZpEQ;k4;s; z_gRz_7`bbxr~9vFf!1i>8HLV*x7J0HLVAb+h%@JZus5D zY`?fY?kla$A1rLwoi;?%U6MSY#JNA(VAgs=2x?XRP&zvkxu9K|&LfT_`>sO5T2>5` zZpR(A@Cq`FMHX7@HSi1;Nl94M&8VOOk-C6B7s4b)6&a>@YPqCbPq`^=O`)le=4H%} zk9LAEWp5y4l5qHO>(Sax8 z=xDc;R_>JR`XE9lj+;0mBhT2B#)HMq1~3Lo6i{k6K0OFakczfLI?Ug7?es6Fp2896 z4#jt-!4Z4l)2VN9zdeiVoEyZP&Hfc&oPiXe%-3Kr@UEW&Ee3&ShoL&YEMM0`addPQ zX`#|LWZ~?ngSPX>)~#5o%vwLzpK^Ag>o|AH{MrPt#2V3YJgAY|mjM{aQDcX^L!_BB zKh?J$`tujH{0hOY)^{R{rqYz;S~~L8%0oKY*@C$xOI?{CdDHEjpOCn z@%3FnrawIYfm@3txSWU9z8(cS(db%lm{CMmJvRxGVLt)UJ(TL3nc@pq&KT8+pf@8J zzSSsDCaqmAF0#r>V4iM=2_M3YQ|`f2g_Uh|c9*El&yGPoYvA0{=scsWkf;wp5vydo zBdr+C>^g6i9rtf1wYf|H6lmd0R>m&HZx)9 zV6JB*?Q8vvi=zGZTSPv$2zXc;8Gz!O4A??{IU@GlzT|9xf~6BGM?NNu~&8I3t;Me2I{MmnO-`ac5@ zAci1(a9Zs`ew0mOOdHC5en2a22uU}q=q{!!)1iV1y65HijbBKI9lYA9l!=P{diuGSNw=H8I7XsjgH3_f5EVljtP}XGB;-QCV_5^j^TgzW znLwNOo=Inujge{Rv)>^r(%fh1C&s#k0uggph_g}G@Q16H_qr6+i8u41Q-j69!6}Dv zwIYSH#83xGF|49RUv2_z;DLiR8$Z@RB+ej!=N z6|mLBR-VPnTdx8M3>=FoxMo`A5)Tp3@?eP(^ULUiUN4)nLClH)eg)BIl-&q4>0$zm z0Co(hF2Gzpwpq1)z5Lk>Ty#Q^ce3hV_UCV>eoHt&eZDO|`*AmE@VoBHx>1&2|w zTmWY?;TbXB7DQEQ!zZEJDlF}NS?;fnwkyePVxpXqY)eyeU4?;wdoM>kZ(8H zxSUnorPD`8Pax#2xQ_A5!)`4yxrsORQLz}#P>mM-GsX|%LKkvqtk@ZDI9Y0gg7&!& z+3>|^M&H+w6PT1V1&Gw`TUqWW(Sf(Xn9K5JKGB&JB`$7|C@xztJGHL-G-QF-2u2iB zRGh|C-v}4T%4(qEZo7;AaWIWWk{J@hwO~mAa|%9&sse0n{EB^7nwkc70rPr`-8zt; z_Zb-c{Tg>0EG20zI9f#G|2U*o{Bkhlp(zKi-)Y^MN_# zOnX>T7&z7OTqn>T^XvDF3&IPkI{PukXk$EqbI`^dZ}#|nT1AAB?4_JktU=IS5hVfi z7RrpEE*~u3_)f}NpqwEmJ;cKniO0+4OAi`Id1tk$7U9^P(BgSVjT8#TgfCrK%>hCd z5HhkLPy!bMsX6q#(+>%h{Bg*M;B|?QsdPW&;434jnwjl{xN1H1yg$B_3bnvW-())7 z?@&V#=(s;c&q6Cz{K@A3L|J&0$t#<_lyu6c?!5W`%wLAz|JdJSa`@4Go2srrz(TK6?Ha?Hf>;2Auk9Bz~Wt6l2%$3Ph^EZdBRO>GU+bSu>f|=Mue{5;aR80Fxp6!#%cU)xK-Gsg zew3-Lzdhj3Mj*x`6JltH;QBNUYt|#>N;wdd99LGhTqD(g-g@LEi&!6=@v|e$0YXJy z;|3}!CC|v@6^PEX*J%@p1tI80%g4*w;!3*1^BFnb2IK~|CZ z>QxbnrgHJ1LE`UdmLU`H^;>a+}^+is1BbWN6>Zf)DRN^!Bi55Sh=Z$DnbR$u7_l7)_QW=0|O~i3jMktEG=pg z9^!^V$#D2e;P^W`_(l*!Qy3IQbpKc@CPFLC@pEX%1V)PIAG^i9Duh1g>od z_TZQk#3W5s!nX^HFw2C}-7@R+g@j5if1a8fG8Q7~@6|6NyiCxjuf*Wg+h9|z+on>v_? z2)>L`_`(A_@Uf;_u>-QHK6b8Y?b5%e(k7O6%TB)T&+j2!KH_-{`p#FaXzi{Ru36BU zj)Ga8unz>-5U_MdSDp%B9WbM&)qd4gB}vOivo_e!h8O$o&vu16ZP#@SnCv+_A~bLx z_!1?&#-gB`*pZ{}N#%1`af4R571g+V!cNUzzC?S#-h-*(Q#D~vQpx7Hl+)q^z@>z) z=y6E5xAi}8^89>Y@CQPKWkvXRqy%98Um+nCPX|*5c_S-j7h487LMBGW??nMl&Mt%i z4raFh&H4ZqCT7NeCF2%#XRAqDqJ5{;7mVwFv?Ei6BO_vlp>S9m`~s^B1Y>+hqzEL` zJfG-G2kP+8ab9U@AKtw;o@HZn*V5J19ZW!=x{Xs}=lnZ+zOrv|hB%n%d(tTU7x0&( z5U=5k$Y}-H$Ik{g-mj7CjObZu{VvXvMfJCh_*qE9@~m0ECr;|6+jY5hw6J689_e86 z+JLV^`5wp@&#DrU$2XDjNba#)=MuWqYI|IdM>6JN4(;``RKfm4llX~+LU zBjnehL^XJx<9HLhJQrIIig07Fe)jO?&wgV1>zR{!UUqrD$G%*_pe~{byIw(SFmUXE z%YMl!YJLh4i0t&@=ouZem>y+?@cJY`oCmxpt<4hXA@ z8cao=jbOKziEMW9xhQIay(tOc-Nmgdw(;5(UXm0tmV(ubwp@xP7JhH7N-kvay(F<; z08*i>aH7ri zwSD7!UrL!ozpU%vXT7Y0%t?^%i6(*Jweh~mR$vnd>w=w-c*qWJY*b6aD6V$nE1C^} z_s3qTK)s){cBfSs(5}3JTCFeJV2b+rsIe@ftzw-g_ z64-ehy@Z?+!yCOyv&(#zDQC{XG)?yrrJDU|2k@@>(B1#Qm|7bfIxTkh{4%Z2=l%4^ ztIsHCu=TzvOS#A6I{5hll?y*#G{_UBBD=Wl{bM*z@!8^1>hW z18eFHZ_Ag}ERU?EJwgevPMOFYDgnGfkG!9=y+MZME-51&Y&E?(mLI;Lm?F&0e))GnsDP^(m;qWK z9%vO%)rtXmQI1*It;{*%IU5xws z3zOUf^O}7On^zngdak!o?ny;GuO~pDy_b0+z8KPy%S`a8W|kt^vEET_BHj$b(%>x< z5U?<@*f8SIBHP(ia&;VJMy7#jc*Dm=~z>IU)ew{-4=?vD_4 zc+5QWO>Dj*i(Un}7O;0}89UQ=7B54vLN)+H6RstQA1BASvEK=YHw;2H-Do^HkOnxS z;kmaID22VmlteVt4n$I18%GgRKW>U~uy}1>eK^Wc9;_5E5uSsJxR3#ACnO*s2$;9n z5n>ewd&^no8VXTNLN~-2W01s8TR<%a8Xx%2+%KeKBg|$cj$b5c#sTI6wUmr|zrotW zqQnSHr?W_8MI1n7MofFL6Gf4MqnzNj;mlfhlUYi7fwoE+pM6P)O0$V9j5kh3f}gZc z&51OuxQ8L8f9`~oniL45KAI(N>%r|h+0=rAwa7*FHVO9b*>LmhS#q+i;6s`H+!J2p zV3C9BqfZz^7lU8@{$%d24W}Xy`Czk8^swiQX%meu2ZBL`@n|z8m&iO^F@#O*1Cdd? zE45>0XvF%{Ip(BPbZ~30b4p|R>YJEPz^4eMP&F?#Q%v*Qr;{KkUk|sT1{+E%s)B90 zEbfgPPOVcjU{@y|bi*YW@kjuECk9idbuyh$vJl9yFWu+nG{;jl?OM^fw+H0;ScGLP zX|_*Cc;wI_tl(-!?5pZ%u&cKO@Vx2I1M3?Wi1vu(Ndje7GYqy zvVpN{*t4)7kO=~-haxeGcRsd)hG*#R=c0Dv4im3OqHc{>2jI;OA4%7_2$A7z@U1ZP z!(*(Agzla#okWy3NE1)sFbu%MGl~;X;8;eqBbNI8Esu@E95gS`(ZF3`yq1#!oC&oH zlLmJ)6FYiC^iwf}ttpM@3l4J zPq6r$HMgg>^`G*I@uN{?^$0s^N4r_<8dFa8iG|hS8&yCQ2Wp65^)sO?Eo5Yb83S-& z=}Ky90+rF~w;Q}vptB;xsWQ19(2`gc!ksY3Pq&>%kl_u>;o8U4dZYoflcG$6qDI+sd&M>tW~6G+j6%~ zvoPd41hksU-+cp(UNI~tO2bFa&Jh0Nm|06Cys!2Ynof$kh}pedtsRI72L=Nz#d=XpcolI=ZfF(5okmJg=ro3v6kG zQjsQXt90^ADzn;kGSy23C~hprF>=u88&5m>x=rDxV}4)LTzFbJ<6pELQe8m9?(^&~ zHXaM70IhQ$Lu0jS+&WF&5lI&Y>O;#5j2`!oLr;g&#>;w}a<7~57-KYKZENx(t+If1 zy%maU%ylp*=ZB&qTd1#m{DnYx%u%6uzg%MGD&#NVx@xpWU!-#7E8ufAY$*NbLAi1&w=70t)^SU z&GEyCJ~XO#EZj-61TgIKnPB`c><93nT25x;Um7BIhhAMr_<`0a?IqSj0i~^4RaKMy z6wG>>6y8lF6o7rPV&%4dkb(L^ow3g5gIl6;A2HW0=qB2FWuvhRQtqa9!?u)*cZH-h zM{C*L?X8GyUs-x8%1K5iz+v-fV9h#+={9e{pRNmj;xT2T%gaKZE;Br5YwSZRfV;a= zcD>%|GVTA@u(_PZ9DAFjm!pu)ZtO|7`w~a|JX-mFAI&5oK|{m8i)rS-imdEzzIkj( z%TV*?GlHzS)9}~X!Qg(ae)=j5S<>KVaAt6bluRH{+YD?K@?V|E2DT1R$U;pw2k!;SgrYW0!K~L-S`*D9ZKV9HF zv9RiEZctDRCH)D{{1&ZyrMIEDfoae;50MRrW`71Xbrsq66@nOpIIPA}c9v;%4RC$2 zv(S6nUI+4E#-)h#!9MSPEmjZaCZ(R}u8g{-H`~T`jEu(ra1K{vSE`ot`9&V9;;R}g9CC??_PWjnJMoDF{E#f` zDyAqMnf9#3tUc*eaXr_Pfx`8!c9dE}T^TjUl7Zjrnj52+H_=QD5!|dt8<&Gw^npca z?pDd>Q4}Z+4bwbB%Em_*Z0F9f?^oBhEAz-!qNBe$s?*wahVblzVkl^l9>TL@xO?kcgX={F0B9 zTa_;Qe4%yvAnRO&bn&)SF1oCPdvWw5s14o^eX$JS>aLXaceG5TT)F8Ju~bggQ_8h( zahLwiQl(_bW&KIawS3B4g#rX)8=58huZpgGYI8sE9-peE&Oe$*U5O!zn)SP@KZqiD zsxCWct5cWU_y(X{kq@|%ArR_NTXZgeqghL(PMGT)XSq-Aaj_n)f4gH-JS6G{$z>1XLxs-EUYJ1|VwXJ~~}ptL>S#`GNmhP#$+VO2z4vFh*5eU77nJ{@bb zVuzt+n9Ahr#s+!A^6)};TmK$ziRsX~U!GERciHY`XSbgv%JN#ab$rbk%oS&2H@L;> z^3s?^f9_Uie}PEqv;qHnpo59^f0kMNZ^Fm0VIPQvv3*&dUP-$a&B3$l5KaKm&aDy2cYNcDr z2BQx@MSaif5?tcX>Q!CZfji7GbT_ik5vt6^y%5@y^J!5Cbb|%lC!3)BP1lQB6_uQ` z^v(`D4-0MT=h*$F%IRSh;i$;?ipYk`yZ%}hvyx3hJN@#{$~?(^NhDm(2J9yk*P@VP?NdvEfsbXQVi}q%nTor z#{Ks3McTpt`^Kf4bBKC2Nm{s{rQij}v_T);ewD})qCMBzh!mv&&NLGuQOz_X>)A5b zfvm6k@%->8`mYMJC*L1kID z$^q&jLD0P!z#;HkC+fXeyZ&uJxOvd(xKEd=EYDh)UNVCgGU^?L@w&BJmh0>^pv4U+=m4wjZO%ezGUiZl5X#{5mu&Qfgb7v~ zJDVe&EytGvdR52kz3Ygv%mrah+k!e0sBwXZDtr@czfQuzf@(m4D@VU7QpOb^;<1b$ zOt7>Jg6C?PrTUBX&Y`zv1&j~ub`&}a+>ba6=MLHe$f%{wwXB^yt-Tl&bT65feFrVeBrU1V4-W# zr`#*nNKxzyg?t55a0Tp;1%Tt>iyWd)HBma>@u*TUZFyhI0v)hkN8@Z3BvWvt~VQtRiYJ(6>swwwnAbOC;jD$ zn~Y9-=bx0(upcZ>@W=4h2Bj44x$g@5fg<__18%(|Tt<{M^I9~z`Kn@Fh;pXKPmS0{ zd1Tt|10hw++=Q@3>1okN%u`|9xq%{0kX)lg$SO#wB&?-0RIpyA*&nhIbQ(rfO8iyg z6Di1KWOiS6s#|08&7g3nH9L{^?6LuOGjpOaVcOF`it+GTVc>5O%1-H2hz%;V{4{e^ zlh&hM0YCYBK++4eynxZk)$9z64jXQI)JZRUVX-fXdZDBX>)2(KGFnq?l*EE$PyYPv zGI3Z@P1%9CVE$#5=|9*;vM?F?;7PlSa6kx*c3`7#ge-+j0;BD#2Rec|a!fTEWk;BS z6wUk8D!iK1!HHntE)CYy`S)1TH(8F7n1MgsxxFv+zd#}knOo^ zod86&tlVrhm35@47uL>ZNFs}fH80NcaL_zL8lfR>Ksajxe}+Cuc(B^S7I7E&0qtv0rPcOeGB{sjCZ63Z zo*29Zn5poFSh6c=3r)z8WJ=iZS8`GeLeSym0+t&HWVWLR8nLW|^dE=o+{0EU;pIq8 zd+3U1?h1Q$8}QSaB3e~>aE)|lHCPrzza7P!8A%9qb?ngb&1N@fA*-fD_os7onbNDg zg4`RLpvXzf*Dcl>A5xLbCvH@XgO#G4BkH#AxQD#DqifY)S&H!1f3tjh54MYr)FK9zLIU$E z*kCk~os2hH0MgX)oDTs4(4~{$%;P&`5f$L?8p1818k;B%2b5ooedvzKz0hiK!Bop1 zK9C&zY_$#&5#``4>M8(SYY#2uS!_D4i&xq|G%b{M>|x{OY>ax5mdmwd92)L#OGe z+gnmBmwJNG{5wzqljIZi`!Ts_@3}@G^{QW_&wJF{%2rUW~Zy!+&GZlcmSE>Bf#3_&MyLi-p{sSS$|9d58Lcl+E zTy5>X_r7nW;ACoIY3yR}M99R)_uo@WFznyW|EuEE#T4*&wM{sX+$V+$=MzHUHnF2tdV9$RwQ2#=HN!q!5_l)7Yo5rRNF0O_)|1uWZ48n#sO5#G_Jyo}`bTL)1 zx3qK7rsrg3WMLx&5CZ5KIXD^FbQ#1AZEX#;ndq5dzBj_}O_xE|(8bBpLz|ujz{Jc+ zNY4adVq+nsX9RFEGZWG?v$C^t5Yn>)SOM&W^Z)?ociIv?fP<0c`y?a#Ka!aKaSv8z zT|Pct24z`8XKNUye;QYb;h$XH|J<(sg@OL}7W_8xKj(roA@hG@LBMzF)PHY6LI4vB zJNtjIqA#?A_Od5E@c+ZuIW}h!M_D|!oryWIF|ln=Y-3{EnArBjPM+AdZRd$?Z1&ae zR&8xRv;lNV@J~KJdokaHQOE_)uXvu~P$;AUbP3XC zdwA*jdGH%fpLbu|Paj{JJyONW;NTzfB~GrcNZn4qvi>Sm3tYh4p~MbX(9kwCG$4wT z-JMp{Jl;RjL106G1^gzJqD*W#MrZwq(7$mnC~WA@6+Zxgc!DLY4rar*djUWPcL#@459kXuV=4g2SWy{ALYX) zcW>MS19s--lv$)~6A#SnaYJ|EU*L-SOjt~T^^ww1m~dhUF?|^h^SZ&#kz%w67!6<+ zz_V(dV3A%FsK^G9>#{lb0MOk)xpfAk`>%BZ67D9Hh|`$;q{W$OjOwB(tc zyyK0<67voH^o}`5-d{f=f`xa}%hJ1Y^fD(2;X(>_CFxMdB{vP^#CwQQ28`uxuD*lZJjuBmz(kR#7C-5k%ZaE(QtEqlRmy3 zAwmVIQd0c+StbL!NF#Hn&`{7lXBh~Ywtjq0 zCely8tR2`(OkwnX_G;KaFA*kTD3Uv^t*m7<#Y~$tMwiVIFIja`Odn2uwBH4qg%}L- zV|sE55g7?QefRm13r|m!cP96Yol(zWg}^Q~Q#?qyY=pz4-&A^h>=y3UKNqbGq7F>9 zO#nprg!f0&G*_j%^?H-KGblj-H!JGXq^b!`Fe$1pXlvdf4j?21as&C@o;y1{xJTH) z&d%-&96C}a(&^5TUGv8?*4bfM`yWAGLMM4HEp07{P>CUlA@Bf@IB;aO%mq!YDqdEV z9=#SKb+Ls2&kcsuNxP>OK5RyvbKnU>1r_VzZ>uwF`c^D&;)i@WPHd+qLy5Og02u5A zhnKn6agmGT7ANvuKt}}It|Lhq4ijw@^YbW)7P*uRbBq78B0u9>hi}*>F!Sm7 z-~dMsY6nj2vuf(>`bIAn8U^O&KhJ$Wt`JJ8;6DjLlx@|GQ`m_t#$c;VI)f&4 zmCcnLuAMsX@p=H9&7WOO*Zc)N2>Tw~HZ?uYnkl=Eheu08yFimHOA~aB1ruCLhk_Pp z>h0Z8Q-kbjZ)9ZT>Wbx~r>8fxzUzuZlC9_VUMKP62OhaH^#ZKDSJXQ=7e?r@z}Nn; z0bk8}6!!R-bVWr)_v>N}0k<<19}UhM0KhRqcYpwmjK5%NZu|@sAlb*k!+YCB_O-u! z_ps3JAjN>~zF%a-OvNHo8n7h_e5{<bdt0mtg9;rA9X?>u)br*4aeeIfc^rmJ z6k6kL!U*znGL?bvX~T)Hvy;D8j~Jwx|7JUfiiW!W;HXx#n*=DGxCOAbm8`^=lRdhm z%LKz)H#^qz+%=_Y|IH>INnG^Y3(9lwo9-u}-+TNpA?uImB>u9s0;D4K3d4HQ`l7Nj z*qvTw*=LRJ_rZ4Tt@f=su+!dbcT+RRqeE=HN3V}2#3r#pG3v{sd74x~E#4Ls@2gFC z!V+l3SnNX<>LIhIOTL!5(imp<{fBM7x5QlHnc3{_m&|UDy#d&JBw^5hf~ghdi!A7Rb-X|GFV+fOc!y(+sXxgQ(HJGjt~R~qH2{D6`L(A@KC{^o$+XftzO5UEYuvT;yn`XAP_5)GlA)Pf1zX<>^lFV}bdH>5m zs!Y}Ck4Zi!J4lTvnUej|^9V!-$`w5g-Nx*Ks-Ai%T|~dSsv-W#-c4QI_~hi>-5nce zl2mak7gvaw7<*Hb1#1;+#Qp2VIv`*Bs{3hcqVbn`$0XL9-jhmli zYkoG!J39%ZbwHLo`x3vsQ3A}((nGDK5@=5=f^c=<3VJF}^TM6#6d*;^M(`dcL#nJ7s;GxL8!UDCy9@5C+?ASvqjBfemUO>n#=!!L{% z$&4*?Qo-*g3K|LDpW1>MDq`2`s`IJgIQMJ%>$L`$j{6MF3zCZt7q%NtKtLeUF9H{W zU!A9JeF8#)3O<|5dNPw#_sL%z%9;i;>%^IgU)A+^BN50vD1!aYA-_ag@^&vU`tATP-Yv7JzQLL=(^ zRSm>zvnZW`$kIY}+44$Wu(?hSv$M35N=U56SC z4iurdxESMW&J|)+?r-e$#6%;Y(SL!DVHvEYd_wrqM=-lG1AQSbcX;-LWy zhGW*uw08t76g0Bu*ZlnaH8KntZ%J()3R`q=ysVvMF$xlonH<(QrRFMi- zwmC_4Dpr}WbYDZBRD6ae9To!3rzQQ;7%M9tz?PPZ&fa6g6`H}^-XVVXZqTOFy*Rvw z>{4sBi|Q;~QE@80jN+0W~Kh535BGk!c9AF@taOZhhXk2iQqV8Yee8F*<7LhNrxx{$#T z<@Eb~tL%qXgoE7;I#qKNa0Cg7lYXV8N3d=XnpbG3bslbqsxSO&q&=K9-V0Le&JF+| z2BV&r-vkT(4xTh$GP5|^d_V(RI?hFhp=AB=7KCZR3iAY3Cq=#il-JhQb_Z3I>=yeV zLjSoBJI|Yh`lMkeW5!%WL`1S)@bya9`)gq|F_zCE@SpJE;UQF^5VN@Bt-kL`)UjT+F<(^Kzl) z9*?BcrOgIr)IZi9_v99`9kx5o?pj`!QWJ+!7F zM;zvQSuE8`Zc-i4bog7n6B6&1`Q2YHN11V;w5+zG@gSZomISU2mZ(?e%jfn02r&!V zUMmzi5bt+PzTxMKjixiK&QO2<7LnmpvUp5e$mnRHIO*kaj0Dd5MVPkmAFj|W)JbD_ za=Ujw`tAn&1xru4YW z!ruv=h^|;n+9sRDA%4umIVw{EsV;dyJ%(h_(fk!W*U1~vR2JJm`=DvX!k215C4k_?A+;IiE zxZ`vf#W|ar-X+t9W44UkFE}S$*bYHqf!C|#!JasIV}Kz6{<(y#zYcd+g^L)VfbE$K z>{wbfnW)s2r)=3 zZnezOC5CoBsFNy=>%4}4OMx*w2dj0%5Y5)avb-Et3`DZ}0WwbNl_Q`}0bY67L6K_7)(^z=<1e zpXAE{3YDVwr>o0rn?Wumg%M>#+cKTbVc+otWslXzCjAnyFIOVG1Yfp@k?l3iMdzxX z07kAk+H!=xl3W5NW@eVLNwquIH6uo7fyuiQr63TkRHBBG=1E@zs(Vt8sTEJg?p_Bo zP-q~=*-G*Q(r{M6 zQDpNgcQ!g?@=pzT{uy-1+W1SbH0C)RLtLH@8N{YN(pif*m|3w?QfE-`cER9GhSMFb zvWOsYV8Q`?Mj;8;Z+mJ2bPMS81D(ko2O;HqXP0I`W5DJvel3AXQg7byRaEaFYz5{J z*u(q#V6KLmnya(x!_yPEi-BpfG%RJ{ZCDw;e97izkA-gMoDFmO*!UPw6n571hn${} zkhPZ=zFhdve@bRe)|xh6U$S~x=}D3Axe z%g58+{(2x$;c~m1@%vAx+8i*7SB{rDmWg11p9pe`cyE)qCwJ2FCKOPiJZ44Mv2u4$ zgX(!58#ay=*jiXH0sQ_P-u@tPA=6QgxaZmaK+@{6U4LwZ>OTB|hu6S^--DK}L+PKl zZ=cBd*p^2IF*E~$Q2rAQv_8Q_t!_n{BPrdo{`a+F$uRgYAqYzJn;PFkT3joajH7E( z6QT}?NlLDOUiZD5VM`Z(`O7#Lu6&f_pdRB0(Fs?krcs7KCD<_1YqVO~wp-9boRwlU zwxVnFm+Osl8!CM96~i63%Z(x6gESIY65(xL4@WC2I681_Y8slY zCTq@tO6B5&pJ?B0Gy@~!u!K-!y`vhSK*^mqUNM-C=r*7YrbvVwkR`jh4?uN2gn;hT z{4FRf!HpdAZ=hshAJ^qGf=|+!GW4kR@S0Hjp`M;&T%+9kYVhez#8}q z5)$wkV7*+e+v%CS$891fC+A|Ug1#nNJaG-92|zQ_g@8yZn;>Vk%WNcyYW1)R<&Djr zjIODYZD8{z^W6FL2i>6Fxx<8`fC)T0tEB$6AK{*R{`Jg$f*vjniKr7$fcm#!9(c_| zC@R3KD?wreDMie(yC?)^n}|t+SNbr&NU!M1gijdE46+vREK4~brfPEaPfz&nrK^j7 z0HKlGq(G~Jgcf60c9dOk+U`!JJQ*%I@Y#n2)`x?K2Yy^~MVY(^e`UjnBeAUI#RI3R zv(twkMG$__$k0t=8YGhgjf*kS^z4CMP0cDgr8=H$d{07x+9^N!8gIjC9%1&V6()1? zJ9ReZK4ynvYuzaE-n%!yR6|3fCS0-6mVn>uB&WH#84WGXL8W-tVE&Q-L%MAB z_M?y!`bm)A`|uYZ8(XkL@|ejBEu>h;%w`pR)${v!Dnsut7Z;bf zQhn<_UkP#jT&7tAag9d35k}u2QHRKW-n0T<50i;%sT>j ztx&Sfi)aBszE7R9f#0cAqe_idH}Fq3fr%5lT*ZWsBz4$69XWTnM2N_w1Pe6@sPfZ5 zq5}pYk27wNQIcI#3R9SSSS#A~FCAaRpn`1?CAjC+i! z{xy6EZt6T2KYvW#YLm6OgM&j1g+!nF^hjTUBzbMEpy$YC52ef+4!`eucr1B>0h?$V zS5CO@>&{%C5fh7{&&8sK5Zq6B-T+akphf_Ww06SO&*hYbxfI~ph0oKb+cx(b2dxdO zES6LMqpekP#>8;tcJA;fij=5lqVE^@TfP=$m3sTU!_fq;zl59|qBsE&{Mc6WAAKc5 zlFuG>CD%KUXsI|B*=DC>`8d>GWRB9Kqa#mGPv4ty{XJ}ZD$AZ2D0k$3dlL8Na)x^4 zB5){sI|I5tNHes`r8m)Y4)XdVD#GDwkvJqoG{nogf8;QWu-}fr zXOurFdr{|E8!j%Ya7Y3K!!gdqBmRzyU80+>CZ02BXAfzQ^Y~AH27rcxv~R|w7zMLw zA)@F}q1Dst$6ix2giREkOhSF16NfrlI)OkaD5xZyPrCYi9V!gs3NWbtwGqc%(nepA zV?huONJz*=D24iskdV6B*?>=95VXAbbGD^KBCvS>2@spDRnQ6gzvI|9A!sCoi798- z;2?tP0Qs>5BE1Ex2I9f|X+AsTtj?xR-RJq-%e78C-=LVz&(|{)Bc}A_v(NEqfoL0~ zrL17)e!)}Ck}*$DFD)(Y%*+}PLw_v~4-YMlkV5U(9jo9DmR|;ZP3rV0 z0aYAHy>*s9CCIU?>g!!EHo?On*%%n;J3k&hqAB6+KL++==T{|I@JLh1@=*Jn31u^j zLpTaB9i-z&2r?M;KNo3h4E%3+w$xO0RKIh6d(9yb0{whcsG;Jixs%H+6%xlUGSV{~ zS~pANv*GIFTFs{k1GjkzCt8e;r+8d~*Puz9Kh~O-{hoMC`dC?6Ed)KpJUmRlLx~F8 zEYY7xH&020a}-GvW+303j~&R-2y)W|m+Y8ufVM9$FA_2MxP*lK9=GH;pj;Pt-*@2g zBZQ(b-8nQ329wQ7OhoPprV{Cc*&8nH@VVs8HKFYe7K9Cxw2S^*T~xVX!l43_Pm0~h z&CP*je3p6QZ6}X(;@^L08>d6!*2RgeRH&go~OY!6dR?ctbZa$ef&t>0<) z{h|f8FYFKOh&+J9qr*Uk{n>#dJ2m4asV9ir{;UmrXFRRVfB>AQu;VbadE9c?&Y@19Pw#)1<& zXGuDcp#1F(IzRLK57TM<4`+Z|A05v5YAe^Zq^_-;uC9-iChk3T>=ag=3aLpO4L(%E z_dGqQFhDQQomZw3T1OUd%8`tjK6ykSCnt6;_Gd_8BVtbHD$>S@fU6B;~9NXMp!)n z1%>bxl9Vw)bItKMYxV(0jJwrxq+e`e_pR}B^~4(4-rPiVh4_@w0D@En5OjY&bO$=* zi`oKOnO2QN;CR@ZT#V|d=uHKGgG^8RTsjTM5<&Cte_F7SV!-TT%~*IAGV?(y96c5& z&D^yt!kq-pqu|yo<4(XReo|gSK_>`ljGS3uu5oQ!}|92OtptB|HV|K^e1zk!I|B|$E%nHF=62ounly%@njX~HtUDLIF}X| ztKy;N9t4_A`wy>mF zBX)ld?tqFs{@}g@c01#iN$R@y+f{ z^%TQE(Ks+rgjmZ$OTr`F%$23}Z#ZU97oh8VPIgV!&b;De!vZ)rvg;P7jUNaSq%mDMZ(|MXxYm|<(gkf+rNAw@SSStw=Z1p%C&+c?F9R9Y+8 znOOPLzf-DshvriMH04u?!A)lp9TNQ0y?lXK&xH-6RYnYLfs63k(dS*PMUfJ2s*D>N z)bQ`XJy$oF4sZY;;@B!%*9HZ05lR|hq7vuiF@U!%)X>$3xX2-Q^nO0VauC~t2%bf8mGP>wn9ylFI|ikG3f8+4i%?XMS{EiFNsk@etXBE z7{|30p}I_S0Yuf{pvT*Q1P3BZ5GQ_qae}fI4?iQ^2vFV91pU+ZS0u4Jo0X}Mk|7;h zyZf#W_vYH{>dWFce@Hj?Rn*pwVsmMDlu|_Y_j|t%6Y#zn#9p=a8!3nIOeCoxM)qXN zSy?NLTG6u?6;{#{svfl=O`4j5o1F&*Li`GiGZnA540#V3U%g)`Mj1bbPm=zu?raC5 znXVx{9x#RKIcv{&#%yU}qryPKkd=x4IF#VB*+Y>T;3`81K?|(jIq4r}$ns0IV;~^J z{Sf%NSMYnJYK_|{VFyBefYTg*&$T>(#i?2HKeMkw)dd{yVG4}+J&c6a#8w+zxs+Je&h%y$JWz6zB6V`=Ge z)fW!XN{6xBA886n7upL*2IFWGZzg@WO$UUysRgmUYtIQn5!R+=$6lD_q5?XMo_do4!)`BotV!vZR(D`pMv!TW$ZVavt~%Mk1p8 zg{XuTV+I9{Y(QvGK-1IVilrkKn!D;i1G_J@@Dzi=dPYV@8m2!@?CtHhw>rhd2F((s zNRuP^PfHm(X0Pt#+0-6z-XqJUP2QUjU7UBPi(GyHiAw2zMEq0E z_3j?@=^V))JpYGvl!8)XC>?pokm}+sT&TAEr$#~$Pj09!v~9%E#M>GFIpCh)NmgDy zA(@Cl!^Kq1!GW1N?eyW?0oa#Z{93t_7slF48+6Xj$-~3O8*FWFA6}h-3K#OND&f~| zuBt9-Trgl6C{Su1=QC|WLPnhLJH%2#@Ot#!1Ncj*{Jrl=ZsMZhsp}~`jF*UDSvWZv znK;Mywl*EF7tUWktFW#(ZDu#YtH*>p-0RyrUziwZS>!hCyigj-6mLI3F^3YEEBRMn z;WirCa?gNClTd1U5@plM8gzNNx?>SvM)g=Au{2~{RN96gQGIBqwNjklo>SjECB|~; z?8!<1C@!Wr5d{$k=xw(+wSQ|Xd_k3zb<`KO*SF_4*OwR1o?d|E1+*G9d&my}{HRqM zfZ$2OJ~J*alhwy{PnwcUT1bCN?tqLPR%-i-GWWa;G(Ce z=lq#fcbn=$q%?*Qw^<1w<&9emz!JD`3ug|mYw~GdW7vRJM zLg<~>_8Xz{hbZsoli$~qipuyeQ7nFEAQLP3X@i_)3+P8DsKjUDn2t;Lsj*+vXT{BM%+o@+OFjI zZus~v4iPT2(=4Q%wgj`Kl}4Fr-eAsFm)o{SNn_)8@!8x~ewx2O?DxJ;v~CLsd3njm z&`O*QpIz(r^ZV|1-+i1-Ogud^QjR(E0@Y(^>wnW3<;T&Xo}SXsGS+-wRTV)E%FG)2 z8mXzN<_6PmQ2a7C+&q~rKqum-J<`T6COLh#8tLzhyOH2`;R3oqywFM#m1n z0zyEZc~E8iR0MA+hmIX^0l~7ovOUXq2rduo#Mu3(Mj)?;YT15{v&MjQuI^<4 zPM)xle#Th~a-k_m60|sp6yi}(Aa`d>)^Td_A|9eJiBL?k;DJ5b=)lIr2G5^dBHSP8 z+3B5sND_L@*mUGW12^rc%$s@o#<#hhhK`?v%(8i3pm>kqbH8|1O?-tw8hhI73WP+`FCKp(y2oxjh5 zUHj7J=BwB~u_g5}Ag%}_-&X>~w6dO(o|2}TvfjjH896+osBk>RvJn$*l#Fyighill z@#3itbo+7u?EyS4zlgk}nY*(O_NLK+gI6e27?kJRo9Ans`0OS?dy>(*#=su+;_KX; zUqwmXj^xaQVq~_>(=#t)my}4S%^NsZyy^8gv&ry1Y}rU>HD}Q8>Ja+*Zx=gST;Jz# zk^1c5TQlZ*vE_3;lYb~VaP_3?{Cn^vpW=DpgZr$`}7&bquyQ%*naX`w(O!9XBamR$x(!*?BQ&lrLIysw(sFf4y3r+E+YbHCC zfm{0hO=)(6+mM*vi?WH!6W6bvXWJ4KVI4osvvzShCM|Tfhby8e48$wsaJ!5dvCOMn zAQSRFKdv?)g^^h_yEVX129Q1%S5+Ze{>--9Fkl(1J?_IiI1H%CmOtjX>JZ^LTUt1` zu;RWsNCZKKA%-z$q0XO|8Zav5eFy7ij(aT%W{7M@1{m>UF`>;S$%cv;^fN(W5`epm zUkix+Q)(JreX_VgMqSKq5sYsOn563SklA! zLxabxtBm9pt}Xe7Rwxj9e2uAecj z68rTlAWFig^SG$x9Vnpp=h~lRDLZ(H{DO`rI52u`iGT51liGIe{c6)`9y9ePehz#yAZ-CE&Ov-nwxHT{Yk3zf=Xtut*_(QY#GqhRQ+J?kq zVUKvLf9>QgT7@+9x#brMIZ4+yskm>Cq_rMj6%@L>HY$^_!jF&doW~*&Be{`bhD?g0 zBAN4}{Q4H!_3n~H4a$}f@DegYKyQ`__HSM|v(~?V7xiFhM_-Z%Le5S+FUiC!ls% z&&Bj?@0W_yx`9jcYLT3@ySYf}mN%+7SR#WXwC^FsYjWc0!e-imV|@ZEH)WgxJzk|V z_l`$64s#i?4E3XH?7E8Kr;y^Z885FM9_pF+FpkOW#-q;37=JRb!-i&DU1t3H9G6Fg z*%8n6ZH>@z)`9+b5rZ$aBI^#RUw^tAX{z9*Kx{wq@Ezu*OtXq4~-O}DYAnIb7MnpuV zp<`T_?7CTv?H;^zgix`in{4}BJG-Y3)>=!Of?Qz^>sLpKa9F2ygd${xno^Xxq&x$1 zT{Z%TH)v;_MA3{+#Iq|8F#GFL_EIfXK~JWj5Plhu6iJu!Jw$ULfr*oZvH|t}${@n- z`fwvT+sR-={6i$PR|sA+M#Ap)>?9L5CUa9eQkv@tLzXC=a!m!q!Xklo>_XK)g?`8V zs_Gtg4!$tTRvXQKBca-FX!*i)iu6Ewy#H)Jj{rl#sf-Gr$aJ5DT5@TmBEXvCIW2%< zJH}$=sHmbPYzs7IJ;8#N!DsX)pa}Finb9bsU3F&-`rR1pOErx`cB$spQv#`wo!rig zQU&AGDX??FW(?20+OGE|KVN2snQKYGrAox>!Db4+&yl?JB9DPZqTcUzvr=4Xyl&H1 zo~y0{<0Y~u=&cZ_jsu(o+Yvo z>`DAi)B?ZZ#&{65-vUdK3_{ui^e(tUMJ9&wy(?h(^9F1^b zxg9f7zvvgTD<=p=O^1vqVvGmH88@q9SDb7wh98PD&FPG zJo2K;A^Ixtev2EL`*{&gY@IsYG%k*d^2Z`NNAUNW0nLxb!a)+&*rbm&6yI71Ox-RU z6ijZ1r(DfLhwHQScqQa;35R>Pz18G3432#I=*dNp z+X>}=Rt=FA2(o)p&Pzx7+>{4QY55Z7DXTwtVbNt$Q28=skJ-SkLZ;c0`YJ(9L>!}x z$pce16C8$USpPsMDC)mxPD;sv{(Yg8UZ=K6&i3r2XJeBx)Y1|dal6QqLsFKkOe&$W zZJ0>Wlz5FR-@g0+=b(+o1cgmgS?wT%Lc}kQEl#7G$^wF>KN%#Wjs#%gz-8t#OGE6$ zA5a12&GK<`K6<(9@8%On5}*C+33&Dmyc_ME$UN}vD1yy!=OAG{)5eqna}-dH1r47u(D-gQBxbAy($QFiYXW*8JX1 zp0j9YaD>hGMYH&OG?VpbZ=q|jL?p^k=(@4h_X65lhCjZ`A^T0ExdE|F1EpXvq%i_1 zwg~2m6h7GQ27)YD2xB8bm{g~k-)klU@1@VQ#({HX*243K>*84H@pf2`Vdye*NrpnB zE51?V=knUhzr3_a4sSeM`?Oa)-0+q0KM@(97J(?Br&r!nbJOc@-WNA`%sWOK{E{;W z2?uWaaF=Uga2Gp6O`E>OUGQUG68d_zp8M;zf)i;7xEJppJrnA)c4T4Gj4SDePq~Lg z(BllhU%Vx$;NE!aqET+t77(EBkP^?%SSp8oyA&3n7L94?xXV}Yhk#afTMV_=QM1S9q5R=s z7D`u#-x5;-;9d9WlZDSS_4Y+JjOW}i1l`GRtL*=>(?aKuIixks4lmo$Y(&tRBbCp) z>;U;s<~Us2g;=1vOL1Ohc_N8_wCm(|&)^v_-%#RBQG+Zs1KS=Tof?rHy)LLGj zOz;v847?C!6?=oj)JCKr$yX&1ZT3MaF8;MAu}0e+jaATCYi?<9)Sm87{)=dWV?DfS zGvozCJJ(1n^^!io`Ji2~rH7o;Cr{Z@9BhW5=uaw=Ex(C(m!WCpw)hjW&6TZW_FLH{ zQxd^N_iS4SuBA?A%o_Dd4&OGbcCB^;vsP{Pu(S-~Chb(`O?q7>v@!Sp2I_Plqk&IJ zlr%%UOa{IJ@w`jVpQu+l=e_wzx(|^$M_L^1i)wKeJ6ka~fvpMd^7a|3S7)D^Bcz>wV2AE2 z$fkxf|Anj$Qwbvsx?4y70{6#@`uo3>0i4YLwQBo+_{_6${11oJDy_+w0|4rG8E_9q zf0s+jG(+NVOU(Jx3Et77j6#1e=xJ{mS+kM`i^64k!mf5lnm&H;wI;S0_Y?m+-P-WSg_}2TW* zfgyNS0n6{p?Roin-MZpT=xnz2oT%?Ky_LDRjOD68!w%6SjknTKrt%3n`RZzwmpbZb zi8_{D;Krb~!zgt4mxsqeUFw25Uy z0$d|J|MJ?u0^V;7HwV_3&7wC8aMfA@w;sM8K`piLpM`jcRHG+idyto1Lk{|Ujp2YL^cIVfiwMj0Xi z=jYN3w$qU2%6NV?v1p@$4O5D-!W}fF|4~t`13lwZzC?U9chsgxeE_}XH>;{(2rsZ6 z^UUj0RZDXbOoyS(_siGo)Tqx}<4Me>IRmg%H22xe-)LmBzTk7KbN}RTMH<2uO8btb z2s(8zq>fi79h*kow@qiNWhl5-gV?GU+B(=gg^%~vz1BLax#*g4FEu{kXT;;ozKf%n zKk5re$7Th}OL^}*(pTipa~&Dl%bVw0I^z@N&XHZxoRUznt5MK~f>YR!9b8k=SbG@6nU^nF&!1u) z7S-=o&xj6ycZw!llU_&K_Yz*~3WXV31m43``?r^gLlM|eeC5gUz1jBVYFe;S=@ieT z1XGTa)q~cQj!+3-{9&G9gN~S8KL-VfPFr{jliA83S4lePGKFj*x`k=98Vb(#JUB+S zTgq;k8a%Q_28s0p7MDq+gyE*CRn=zi60+#=jxx$`rFYh3FhZzg;jdw02fvY<|J~mC zXrNfaM}T~S$=Zr174*L=(o_y=c!e7*YB9NYU$3R zu^}E~W51rE7RzTg27nL=1EANNh+&AY8xI>DbbdIgA4Q5P7P_e*qD{~smhG}9JpA70 zPsSg9kxNCa^^(U*;E;cJW*{MPx4EFwhb|B5tsoRvxtf8{@xr8seTu;K24!7=&aRYUhUt8@tR-S44v*4 zUKzi`0}6!64N?6>vwljOuG_pyBNTcjV`KGAc1T7^yA+3)gI>7C=*_4f>==_Bo6Dy& z0QG(_%IryhyfK*=EY%@2&N%cn>J)ni@Zyn$r~8Z%Yr=2 zZX=gR{u$43Vh9X%<`6Sctb-gw7=3hp6_BS)Se&Njc>-F3Z^D)Xm4u)qj)MymI#`x` zvaJbrCJ^Cjnv@<^@LTFpH`i8S0m0}Yb5x?geCrnMCllWHQVEO0Wfk=6yWIEFB7EVGTq6V)pOomZ&Rr zqs_bOj)|NzlKW^jNl{MnHp2<(xSq27YRUT${N(X+56VQuSBdE{p^fFT339{`bUS%9 zUK_sjvk=86^0n@S;1TB;yyUej9Fz4rJqd9=&{wuatP~R|#>^`n*LZVZ(RZIq_nrkC zv2=0Hh-pApvgFGqYw#?1yFMY8ZWNri&_l=l1ffn(7ML%Lc?|P+*ZqPdj={70hG%T0 zg>THnNW3RL6-__R0BSy)3`zH0euF@5a}mb27RLbJRJp>l&{X(Usp!H`jq)lp*SYo+ zg6lyhtV1Wt~^Ba3ZccsWLO)wbZXFPgq>!;u{$GEh&=9&Fzy z$==dGAT}wUl~hIn#bca5TXP|e_H37KrXO9H>{{3-vvhk;Gige~ui?SqP(PD`KYVr1 zhdj;lMnuMnjr6gsR3HY|_z%Y3sYeuO3)XGhwr$(CZLGF!+qP}nwr$&X_v*7w?#tQ9 zzR7-@e_$pxYJ8(A!64VV&48Om9>z`{Zk9epYQ&#nxprb(OX!*DAN1r)Ea=w#es17R zu{Xr`e!3s?@BPP#Q!o1#*Qx4MnMY#ha#jAFVr$_o!n0RrxFhVXOm^$wNkbRDTap_hxzOv`nS+nkMy9)%FPxnVD10}1{VKMSKIIFhKpoEB{y+V$<|+sI(6@C zAOcg$?{;`tw=d67I3>bsz1t-P6iMoudKtN<)k4?79=bhZr+2s&?u zGkw*zD7Y|5n`4ss#3-Z$VE>T?@45J2~ctYBzgkmxC(8se>z>@fUT97KxRd=qo)Gt@+7_uI>GO<=3A!E&Xp2 zkL7=nc+3oJ|B+eJqdgTn)Cs%uM*RpZ`O-{6a9=2(o!=ETTYEm}df0WLyRGWiha{?) zOk+=huKvX)6fg z@v-?Yyv0tdJxYb0vtnxP2;Z$B&4i6f?@jW&EW@TVr3vNX^Z8z?`B!krMGz0 z5bph;<78{uH>&T9W(N0D?&2k|u5FPQmPC3F!H;d18fSGH%)DO?KJzK#_L-MG%+~6* z^=g?`k9Hoen8G_d(}R_qv(8~|P4~ow54}4yG}O=c=f=o+o3HHX^l)}VGnD%V>)-W& z*|*I{r_}k^S)DRp%GF(37Tm7hUs-QQcEmitu5^n|&ANvV{j@%PUym6VkAz24nPm9U z7m00Jkh}l;a-c)!d+bw5E8qYps;P&PH0Q|D{*M9 zd@PF{;tHaqToM;}Rqgw#$*ji0_ONP`uUTw%&jd+2DQx}%UjgxtB1G=3 zO7QJ6Rej#|=6myGyw*s_jE7HiyZ|R{3xMWzIk8z7+f-bVH;M?3O|!)Cq7NpdBI-A+ zYhi%fi1M^0*$w}0&Lc>Os35zA@$yE45sA$7VeMDAHc7CV8h6%9f^H;GjrsdJkai|% z5jiwt(c<}7+V)$8jm_D|Y$(He@@4_qtSk=(M`LYN64b@#sJxZ4+3-K!{cs)pX1M%O z)cUO5mjQ{=mBaP0ay&KcS7isLLn z<4u<$+rVbBty|NcShJIDVfljnH;k~O`4@*cwyyPyTyZ+bWz=%<65a3-ohyfWH zdmM`0Gub8T@ZQ^3-*G7Mz!st+K650JA%00GOf!T_)Pq zAYgm=byrzVe>oSa4b_^1k6V}_7hcB+&}`CODO{$o;t&+0M;^s|YYxab=&;C=VRuYt zpoy@ocEzq`s13ON-3C3Im6XQDqaGr1Z zv&6eZzb{G%&(0f>;&eHSGxD|&=>$nI6e>T`M}{Ld3-`Rt8H1ccC}Q@dFQIbf6qPke z1+sL6dzKgIK}sv{*je5nTB6{Oqc6=TseTxEX>m5V_zBMBa_29BIVk%tp<%p~{5=Uc zB6q9!&{2D@(A!|zA7Nl%P^b(9!=jfd0Y&3|e$t!+EW07$Y@1k$FV+Xr4Wk4A$3IDF zzZ!>zi}&onxIMEyX;3}0eqC||sI+l50_`c)w|FJ)4^_x3R~YSYSBx6VsaHXKt>O-+ zx-&BU3MC)==>&+Zz__GD!a0_#X3db`Re8e{qq1|-NQ}O413EU4Dnp+!D!KN`ppu56 z~C;LeZD>#CfLa4b(@ zO#)8cKe7a2#BCpxI4i8u!H9TaC&`HKw~0~K69+j;81`UsC}QUv&cWhKjNAd`S_ae| z{cIEHp&6tx3fIl&1e0`Qsgvk?(T!P2#U2Q%*+1)LE8D2gOhT<5LNQPVgJ)gg&fcke z!x>6I{gYTNY7rN~7PtoS71OY|vLi;IM*(V@j0iTf9WwnDZ~g^x%B)-0!_*ZL9Kv++ z-P|dW%<412L?4tEx40ZaTM6QJ_VMKv$zU@MJi`p+v9um^m=-o}ngX#2<8qFwK52FE9u)sy9l=Ubi>}IJaT~m-u1{ z@6nDCgaSA5*vijt^rK1Vp3;S*CZ5WLoVI}dk`#hpsvUUad55uJWt-39YXOcWoNW>E zgeU|`YXC_7G#9p_q#i(I?x;0*NEOLUYf9$DO6ldipl#2>zFJ$s=d2$cz&;wuP8qoE^vO^}vln$|LBo~| zxBwSbceAZ+QK1)jrNEWG`e2b{7$F+`jtf{Ouq-(D z^wy|QJL)pmtPLdPZ#jKnX0|KqHS@k4oGc4sx~PxIBUgmmABJ$2MdMzn zpT0a7m;vdaZ1RvmEoQ^RJGzTFb4it#TM8F}p{5;NsDm1)70ckJ4>{`xH=5Q_4@VP) z@3KC*H3k@*wJFEPyBo~#bMB_b_fyE!_5sV85Gq7EP-(di)&25T&&sN%77o&K)Sx|C zsm=Z~B{#)H!?~6=`DRl-IIL-M(s9sBHPqxpIR;}ldj(Eb?sxvgttr7v+SX9m8@2j;UD@2Lsm*%x!Ia3>`0vIr4SuVp$kD|;# z3{^wSD6BCaG?08%r-6A1QM!>PI$j*SllgSsKq>F$IbhGpibgJ<-6TGJ0N7Nhx+a4w z7RC4|yh}8th2sEA>~W;b8HU(IFy85@YEP{wEVYowsZ7w({qeTcE9hU6{#J<7jRn@* zVNYPxP8I|(CUcOn2ftfqSM!;aBz+%KW_c5CnaOmOMi-9W3%Se&<2o4o)1a7>Ve8x4 zUN;qq8O`%mGy{8HOoQ+FL3jWoZJ`lZI#Q$*+D0P{NMLY98Q*Q!^QN`SFBoBFJIFc-|Np zAegbm!9|0bLlji%8ee;Il`VthOSs0b>IJYSKiHi&2V7Aj}9q9g?XC zW4|gNeLrbS6ip95ekmD}yTy-bRZEYjF~iAMp6~Q|NBkVRIY{h;AHN(6RcpVeDz$yz z2mdykg6;opc=+E!r#U$O!yhiunuvXB|Ns2qngcmR25*RXOoBGazyB)N(JkmQhK>{e z`NPnf$&_0+g2J?#L{Xw@E9%gkKa3ZWC;Ysk%p>uqq_S;$Pf_}hFIz)Db^N7yzOPAY zPD+yU{H+(#UmKMi7R*-$rTA}tImtabvvOx&Xvw-e8)@P`t5kdcM)r)y?vBOdZ%51)cH_FFv&i`%Tnlcy%a#@lOu@Jr`9&&|jDGl)6HVDGX9JZjN9%VNX)e&4^2t@V1%pAHu%KbqvqIxSO_ zeKen3hQ3sV_xgS~l9Bg*(@nF`_T-;T-gA7PtTxR6ej)S zQ(QkHO%A4t;!e#4V^LqH=rgRoGDhiqF)e8#e-urA?k;V3R_sB4Is2}5N>JQ3%zCiTNpK(4fdD;kRjt-XmLc{OSF z(5e(B6JPRZ6Z8f2puI_Y-%ZMetqe|{Tu1`hO`V^5us{o>YzjS9&*~7~;)&6kXM^jB z?{SVRRU*Cn*67nlsdThOE5J45ar`w%n(oi&wPjrUd{-IRu_gaVb6{VgQn?s?VA;+( zRS;L4BE~1?)2;%SCeObvS4gQ*fAB&C!DYk~x$5YuidzoN{X+}6zS# zS8|qSsFw=f3{dK0W9(LZ@v`r0TIB|@7?<2((+4p&H6)}G>PA(XsW?hC{eyx5O2q`2 zvrFm=M0PeOlZZa$ki7}5J%5IMucTHD>i1d#aMMRd`=r4U*rQexHM~OT?xk=fQK;02 z3{vhMg5K#i$}p0T<2t(J^2E zhyCesRm0%Mm6NZW{z|EKoIBl~{RkY5!|wO*0GtlUUwgw6|4}r%sp@idDHs2ZM?W8c zVPE|cm`WzW9$5|FPA6>qspMN;zl%_Ww7mjxGUe*b^7BWOBy-721Sd++MY@cJjokH zi!IUuji>|XfeoHKYP!nn4Vp?2LO_=gfbiF}Ndc{2O zz(h0n&r~V$G4$4kTk;sU_e;gqt?`~KaQp3^tIs#mlN2JA{{FA@|KoQi&zMWwLokJySs8K+V>5HrQ>MRVk1wMDUtgzzUK(kF2_Hve`ol5`w6s8 z849`rB<|bMk^cv$jK#|gKq$tkDaJ6fiNL<~)V5qV%xvmfR;+2Yc1mpc&%=&=YiwZ8 zi6>Zym{JSreGrJf z>)stA=SbqR!;DQhO=|@8EB#?N&^VIJH6h0qG*}Ex73$;NwNpAkOrlt(Mf6-aW$Ya& zQI`0yOFD^n1hw~+WaZ!>>?8no8C(`-IMXnKp|@#4J(rdG!z&jR8;Y6c1U0NyQkiQc zMhc>W;~UlE{MBEuBh0U>mH3?^XbWQm3spJjMPbFcax+X&6B6_iYO#-2Av3q^IX0jC z5DQ@+BetsIpz`D&6ibWxjH8kx4`foB45H6pUsW6Hru^r%PWM`pThRJS2i zPfrjtQAUdh&5+=1BgDDUa(RsY_#AcLBNj@NybFfsioIed?`2|uKPn{%p1vPi8$h1k z3X9g8tdo>u5UFZU6LhPAmxgDtKeu%LlzPTJd7D0nqCssc-MU5y(IxTYG}C+l-w@Q$ ze4thy317;3Sa{$=bSiPR#p&m(Qg((NjW))$rZ=(ATgApkHKBhRKVJXC^|kmumeze~cI0aITlZ=?n4K(4oNKSX-Mf5u@}(6B^2XSwV> zhzkovG>+LRh55<6^Low19(L8qGFNh&$8?R9HOwZP+V&z@*X;9Wa|Whjsxq^ z9QbgG^X*|2*cGh$$BC0hu-XYc{&u@fdZq?JF6BdJ1g>(gK^VcF{h?b^)*=$3LAT`m4 zFT6Tx&55*z(^+g7PMCPE0qED5)-(9`=M`+ILt#<@vTwMhpxF~+&*MuRr|ke@%!Wap zB{wC!QNuDuzEhvv6R|`WaX^tlZYKlM=kn;HUiohg+vBw6P<)H=g>sq-1O*dm`dI;W zhq~>e)|xv-DfJB25TG_QDmw+pdiK8f3^`mb8lXxVsoTln4_}J*Acb0zVv`7+_0J#R z@q^t#Gi(6_xu?@Z>g2-$yh9;M9#anhx#xqL;nvns-dh~oIVxH&i%6M5%$<(Yyq)Tm zeH^KrQQ&O#vo`riAac>v=CSzx>S&Hp0F`Jmt)Fxm5$Y-Sxog}`YE{cHJm#D4czW5a zn*x_KQKiR94g@t(=}JjaV}hbX&Xr06rVG*4^|d{L2JqTom%4^3tjc!eFG55){SL<1 z?)L>g)~O6JS&ahRQvoTXn)L%J$*`Dg=jV}#9Xz)w^=i9dpG8_8ykOIlpOz@=51>mG~x)E1cmM<|6u% z#9s1q0_nS%{WH@t&4UE&p2)tdydTNswr_n3WMLS*GE(kM1Qit5h z{BgXBbS3JnD!M^ro@MdUJU8Usr%n90&PHy<^y5*4u3{&ak08akZcc@uPM6`lF-+Z5 z%2SOdf@^)W)=%n9&lgV`&~w^*B}FOyL1MU>zig@wY$bR}Q&NsDe4B5ETx7ZR#Y@t# zDwOBkrcS4$v0&95x`yNmz=SGY;I|X?mMXo^0c5p<+6pp8Z|9xE4Kv{*c$6O&wuORx zKVLf8h^QeHiiN0lC;>~gp_R1VNC?B*`L3xJXrp+f@?jA=br1zN`N$>zx+l1q6?6`{ zHa^keJO$nGjW|)+SJpq*qTJcFtsG;xRS|M&J}Jb?@|t`uuAFPQdb9Q7ML-)xIc*Rs z3nM>olf_8s1>G!l4iHt&3>^U|pn5ox*jIoz`d7HLBR?JQe;U8cdGLpwmm>AdMHTT{ z_;jQ_-FrF4o$d4$DmuxL4JW*PUXE0_b^d;){Q^gyPhbBR8P37*zj*je?CgyHL2GJB z#|^c^_P(jV!w*-r(Gc7h^xFpPqUC5W2xqVNIKz8g?&(XC{EMG{N*^EyA4{N!oQq2i z-?t$c$rw%$R%g>L!EJc}ULkg|eE;(P zrh2|*!^Y%mCwIOw&Bi;a8TsBL_mLtsmnA8D8nsCElL!{ZxetGZi?{Ud^vc|Jk zvc~T1Q+5#%U)(|HYwfKju{urmDg`2ld*qd;jko>ig^}FK9v0TTlF;@c5c$s70d2p32VZd;7pE!Q-}0zs$4njz3H> zYy$3=-t)02{P&j;<4la(;``Tcs4sMnf8OGHx4Rb%^Mym+_07V<$4$>xcTFWcvyQ_D!=E8ZC;^%G;U&}tq8 zaXn9JnvqWmYEH~GV~;*Fti{^mQ7bnpq_gRk1nsWez~}xtsMumozkodEg8&V?mYDiX zw8YHG%Be@+K)E}|8C0{^YPik+>=H5r1DWA)91w{UaY{r`40K)JjuCm5*{)c8{ zx@8>1N=gjE$xbMi9+jJ#*c#TGLCBgLi5d)MlNHze5oI z6otnXVz_!xHnf_XjSts%F&G$);bh*7#9#oqqt{eoj929snX^m5TrxDop%jY6e{j__ z{vWm$oGt20Q2c?GO)UCHwZ_p?IMSFTX)s0e=i=8EM)%m)D>_kirOnc8lFK|a|MI?k zcv9zbtSn#~*GHU|G+<6vO=9|WtQ9OOHk%x@XeeTL9qow)ZK?&dZ8sPS$48$`QM^<( zmcf1^5M7je-|aDutu#4Z_;icG)$GMOO1jqH!fBPsVT&H`@yo0G1-$;WJVj<4fIFieUmm zPvdw)D>Y*4pjE;T6P=m^RIp7ouPwvOR^ZDtFcK@U?PGUMDwz07EeBtO@fYb>u@D8Z z`DZpwaB|at^CBkPBf4Im`*Ko381df~7>-bQXoNw#(QE+y6serm{++upm~z9k$hv5n zYpAtRS*Ax)OQW?4J#{}nyPktuQhfv9_W#jy;YziW&FZt4u9hgxxyiEf>5C-G8xn67 zAL+iU56qQHqZFplz1;2&QNLOJvR&nlFzhv`z%B1Pax|=O-z*SHw4w2jq3@Pu)wX;v z=N42H>!Bei;+yPa0rcABL7dz?q%)Cb+eT5!G!;Dg`Nt(ct&WwY*$A2^UYDVdMKvo9bz*NdJTruA+8F3WX6AQ|*) z=B2t{*4LGgJzdtLXlc1IxgZpzZc@_7&?e_nD?x^9O+jsMEK8bl_5*cMO$IB8i6$W+ zN3n~h%gg9{@Qe>u@W$5CrDryH#K!}jUT5!uEwo7Q2N$-ATwVsc zxxTdyLzXjD42Ao^LXZV?xvU4R5b-d=9qTh`;$-uL^nwcGq?Cr&q^FMj9#w-iYTYOn zy@{3;ll4c+b`ghc2QjT710f_qgeBLiaQ+MZO?ms1W0dajXa-I|rNJecGaa^bgavKx zMK6S6eJ6#!8olvw=-_^O9#u`kidQh*0F#=<(mqIEJg61lhlgF8w$Mox&c+M3B8Wv>D^K_1bf)!M>THB~T+bO?$Yz#I{`hck?c<-TULB`^KhS>KU6D8R= zc!qlCHYCT#xQG6?0&*Gl}_x&2QPV2^dkxx=2>2|6p8ejta0@P z&H&Oj;(dr!pzdvjdR|!zVzUBjxbhZofFtglbN!^_yb@WO9y;wqPv)YjL5$glNY<;9 zRh(X&Coo6f1uV{KZHZM)9_mDdDZ>dBs5G(Z7-)=jqRYg1f#moOYXnciMfZ)`HCXHC zkcp=1u$|#`0(I;!-?J!Pr!-ZHrFve4C0v&EGGl{rv!jinAIla#RV$WdZHs~(S_!5h z13x%)*ZLFQ>Q$y^81qyO+RR;}@A{GpSM=aQM>u?wqB;+{saMNLwsFqYOM_k-5OqHFnTsitO*C()B3u)#2L@x z)1roNr{kDLr5U>yMtBh;3Ct{g9VE+Nk-$1VtRJ5f1_k{g2 z{@Y+5c7kwpTPf0~3}xMa%?T-$NViV zdf&xAfA3CT?)c&QzE9z_atb3q?~QqJTDWDYaGE(S?BMusfBC8|JbN^9^wjH0!+P4k z|B=N~b#WcuCXZh$r-W%m88W_!;A7Ik;BneMSz~*Pzej~P9n&u#SJd7u!f6Ys|GTF03!van#*n zfU?tKmvMKE=PxS;|?YR+MA|1dApF(&#T-R!OVf%-w=Ls@v1EvhQV>zf>9?2#AzVDW~mK z*DtX&fi6olbo8IBD(9BkG^tQ-rq^S*vdTeY&Hb3@fW#+3X)KJg_w_Oc2v&!A0B&?V z8k12&>h%<7zaWb-(f+L+Qf?=RG2<}P;nfj4L~7ZM5Y*)`mSMD3AR}8l4%lAA zMj*RV)W#x6dLF$|#l(??3G%~n@BLCexs0Z;=;VmO6<} z3p@z>n#agba`G&`T{_;~cWsPXr1#35p-OBRo20^o%>QQRZuXQVt^p#~t$aF^ror;N z<)+}o@<;xw-hoEhh0MV zhKF;%5KZG;@BDQ(L|>=dW<))cO4G46;+KtmWG&3*R@I%3&w>r&8pJ!5nGM)dao_|X3g$*D2AwZ2)T%qUJU(KLv;9Ik{a)?A)|oWh1}56-hdd` z>GM6@(?)=#S2PdKL=`?kY;e-JB?WirL>3U&v4AAa?Bpg1Jm$Esm7Wqln5kgU?tHrV z#)nv6!~kZ+JhM_0ubrDAARuu=Sm+3WagC`6%G5*K@-lJ4_otXTTGO~hQ9g*%wf~EG zjWfLdgD+P5PkVbmkqzl0F|+bV7gr*fBqReVtM1ZeJOd#x#5GewtP?$g zIYCAy#erfekOdckSUFjDo4TbnVPzI*>KSx$^RR=$6M?Qkb_>6EQh6LE)1mRBQP61_ ze{Or)KPkSq9Tq18tH@jR6!oyZ9}(52vs+lg_=qeB6}5n~OjHl;n81_s>;4%4EAllL zcy^d-71;ox9^hQbqY3>K3_KVsb;baSdidF)EtuJraqZApPm)5PLg{qT!B&0qA7azcgi^u|gw zm}(4acbi=p#dJHjsEtL;AUbY3PG(ruvgW;jpan);rUQ4)K5X(yyElPaK*}!P0od4& zV?iP{tT{YDYotBbr*qx~l$y&(dY$8nE5J0=@T?&(Sf{|J-#4uF?HeO^P)Tv6l@Eb~ zG|>{g5_t)EQ9xJ+7p7dS3+#iM#~MK(&+ZXxrzCkJ_qi3-NeL?gMbzPFYPfscp@FGt z#YP!VigZ`V@_P*35^=u5B#5JYKazA#hZUVQwgvzJ2}g1kJw2?(GbWH|biE!46PIV*kbueKeIwSRU4gi;lQQxZn`fNeBmG!E>0Vc9gDL6Ld9%UvVS zN_qddJSlbb6^ByuXsUkluA{;kXdb9xWY`1s3eT-J`ipD33@mji5`bU=R>4wdt~@MT zDJ&DVm1zWTrUE=>l^kuAL`qum=HBUn`1j!~mT6 zcq4i!;GCPr85Y|PLbk|cxY133-0X6~tCa>U>;)x#p@39j@!LHcfbdKxoAXaA@2hMa z3{)M4illvrqhC*&e(FOn)2>VTh&(HEmEAkbmS|!&Lg;oTCo?&~s zoCcrx2CUECnUJw_C}9q!_P9mj{gROiz5la4KHr$pNN=>=G5$0HPhYYS*;8dbnm2Vv zc9x2e56wH?9{6Xwi(<`9w8{EmdAN=c8+GMkRAM6-l}h?K-G%U4%O)C&wX(t@ODl?g za@AyzOriqi4o<1Q)JRI!#C8YcU$+RWhgZ9qNw8?(F|KJT7yfA|7xU3+J1g^wtKYGR zMVYp6ozq$WGDGL6Z+30r6wY|qiA%n3f(`16&Qn#hNt$Ak5A=dU?`hQxSzitD^vOHTJqp6nOe->^x)o%K&aK!)k3ru!IWW+!63DUkP@Y2`c5CH%7s z2A}q>5HcH83j~g~(*UB7T4c`xh-RvBl-;}qu*4N?()08ts(&$f-cPOCTaY_3Xx;&J zo2j_HmGG~i!#wJr2Zq|fuIh%mpgzn4JmsQ;xEy3imz1+!(4ZES5kyja{yo)L4v0eCXEpJ0l35j=#NXzm8k-E*~0S#u5kJREs3@aXJ zy;5vYNz_qQ8}NE3)3&*ocI+tJ25n}lZF(0q!En$OZaXbka(rAVE#h_4*j3FFGFjQs zv{Vo?Jq|#e^JziR!mr929nEtjsiV;I>s>N2Ht_JJ(C zF8HK3lRpF{%$-fFrKLo-TQ|{xY~=VtZ!8hKI86YgpIhLE;xWAOQtj`IKKv0Jkh{4! z#%1*HgGe&pq)Vw$iX!59maEMO8p78pMO& zK1vA~FT5*DRc3Q|Zpz?0e{RX{@?cR$EqF)hZv&Cskoa*!W&g+ zzl2MwoX&6ezemdFUq7aQKDV>yt2#EmRdO8UkK+Z_Ffje(G-=^}} zB=m$A-j`jSuIT*HI0DPd3UsM;`;N|m`Tc%qi&~KM(IY=8JiV43m0!e?q`I^E)ZTw0 zl-}$6=4e*_`95-7VO*c`8<+b_wRpEjKiW|Ri{N}uaUoIN->iU-f+;+jqdg!EX zZ(TS(kF~n67Fh-ErQB%;5g!OJHIGg@XtrfA9|NxesO+LFqRv7g>}I2@D8lB*+%z0~y?U-)KbM+XB@r}i zD_+qGIE8g}&62e_hnA&0fa_7&TFBKK`ANnq)#u$tCQw{{bpTC�TL8>SmQsUQwTga?6U+Ij)k7Q-e>t5-h5FCMQO5pU1%LE;qcg zs%3_oZw*97J+CpLE)2{$9Z`Q|wHIl3!W0NV)e0e)17m%tM;%(j!;nq=?QIXcphk9e zB!s@Hq)E%{wY;MUf?`t$=d)8fA|I#aleo(7O(AVkORgl-#KXfoAN}6$OgnE?ALOt_ zRHYujaAxl6w;gR@_-98lfE$ixcraI>i9&oUh?6mdz{`~l{6Z{wHps4lbUfafTh*h# z*GlmSK*RK3E4^=09ye3{*2GHQzE|%x7IG>V*-h9a&8Dq>l|_W$dnpw6K4`P4lE_r+ zKnsgJmLT~Z}r9V*I>7^L;YzD}e|F?tO$1{rVjYYA-OCK`yn`?Bb8gSFEVI5OsK z-Z}}YN>JShT=5y6sJ2jlXjM{?C|Y^2&v+WGKLtB_c;YF0*KQ7;m;$1v2KP{$7fPD~D3a z(xU zkeGIBPB9AIj=YTxRzK41B#CvGT%zez(y19PvDH-9JTb<*Z62k{)xk0iw>@kJhmwC9 z9(u1F8QAMNm5t56zkarfZUx0-J=lyD-F8+2exa~OPp@m$v4+eckcvviYL2R3PycxO zQBN~a^B1S7v6VuG#KG_@23h_M){wV^6;qFqt+UNm_z~RvJCMpxlv3D0=69$Mcds4! z0j)`BBhfWB1UFL&{%a#r%5^eailEjA{)709#liu2$G z-S1eCQ=4y!9wTuvUG5XIEUQXH)=549+y4$fm;we)ijYilp5?qQG`NE-Joh~+so*0w zF<$yj?|MXa6U{3F>yzY+URH0jP5rNu3L&A22PtzjRy-Om>TJ|~L0;vrP93#L) zOF4^^jjOJzCp|)81k(~8#n&>GvJ9__Om{uJL=05#wit^A3}!Z=Q-~DCro&@%^;(>Q z@?4Rr3R@Uxnl<};-GfnnlfImVN(GX~sXRKVEM!UyY0=$aL_N{Y^12eEU$Y!r-!_4D zSP@@1V{ty67*I!QLwOcS=jTMtV{uzo3$#PW6^QRot$mzzpo!jNDJj0Vr5?mNJe#x1 z9yek@tcuM9*x)Bv=>ykguZA31Af+D_ryZ&zR-NnxmXc6Nv5|-~g*&?GOR5Y;EsQN$ zW;(bh`*jU6(+d-0NU?l|HX=&Ml4jhXi zA?h5prlbq3aC@S9q$s(7@k%kCd3n$;>U?Q{kp?J?jX5>GqKqlgnwYbuk&ZmXIu z_PV(%nJnZn$wsL@#)|{%k(CQE#SiXK+FD1}HZ63ZXD>5tj*$Vz=}|aWj1|#I#f=y7XX1sc zq32!!0AeN>h{e^55&tC_nzcqA?=j>wrUF%jzN9Svm5c;l_E-6#Jo*ds)p(-0w^knSTx0RjgQbt~InApbt6DyALZ zcH4Ea34hqy$*BF~{0pDW7@VYBJhutwDAl-q6wTZiDBE+;)Q^C#`ssX`+%yG!?%*TF zsCuBIog0Jh>!@&!?fQ@F%J?{r6wE^v|LDUCf`vT|yPXQIo%t-0cD=47MV5k9dLhyg zk%6|NTDqP%sVU^{y#tO0bWA}W^`nVL1B--+IpINV_(~>wpYO<~k!HVBCIdc^Qxo-x z?v(nyoSH+M{|kc4uX{lCbtqrqkaO;zg{!`^CGqxw?KIBi$lAf(nXkmYpKSJ-0H47j zGc_&nY5zM@8#rG9cUnZ;b2(&M!|bx#(|7+)w_?ha-M*@6b8+=cV^H10mDdPgcfyJR zIZ6?I(u-~T%a6*}jigTa;ir}_{`6bN;QRNr>=#JQOjYB*iDl0JNi1{xXChjUc1P@R zJL1d_>Sw^ki7cWy1;ak;zV*Qb47ie;6|!A@g5MrVl?IKH3O+JMkQn}c^%o^pb6a4P2Bs?-qF?D(3gH+nZ9pJ5=t6DV0Q1@h4f|=ns4GIQBG#>-ESvU zPi<7fgO8gK|FqGPc!vby9=_9G$&$G)N#Rub5>?NCkPYd6&=@RV=|kJQC(WYHlTMni z-ou%8MlM>SiETJNHb1q_Dh=6^f6{I98L`izI!11p4TH^^g_d_)#;Z)^U|sEox>Mpo zG%NyOtxHycjl2>p$&2I$X$W>0(>A!xX4uNwTlEg- z&5#vS2>GCK$~LBsRdQ5^CqA;EofsrxY-g+Z7mC={Q<2T*mBCZnuqR9Z7{>U4o39Vr ziJjMO*5!37GYY}U@W@p%9C95H%qu@t5UMo8w#g2-NLlLhjVZe<$YiyQHD87 zVbeAw>EweiNom#oZr#)<$UB@y7!mY@ZW0UyVFSM`!7H8kLvCR+w70IXQ`B}Y_e#iw9dkti}gqX4cU6Nb0w7^ zPVv4Z7Ttk=;%K5i869w#Eem{%1Z$Td!=zvwwE;*OfSAfgr?vC>rJll`_f|f;{n` zh7@5P04Lr*`$N*N%!RGRollbvE`*B#(kWNyG-ErlN&ue$9Yj~3}PBWPSf zTUplc_p_Bvm%zV;m>{Bjyl&Q*2}hJ!GE>NHRqa!OII^y*ni%G?NBGd-b9uKIv2>#Q z5_P=OFaz$W9WZ-qusEyICCtRgng2NUmR5cUz%JfxXzY7m?S?-7l(Qd+B1JHVy5{7e zx5*Br(n~Eomm8f+RE+K7nti5qIL;}t(HTLkHI8q;Un=v*IG^3Krfz%Z3Y6UBd~WNT zlW#fK$m&rTqy(5!b`vw}TREEnt8Vm86d8;#LHI!7b$pL=YE>kmyg-xkKTJe#)nlFv zk=_mlos-5x3$-t0vlBJ2#2DVX6cxf|=2)+y~799rD;!U~h zIoQ$EO^bD4D6;B6rrKB?O`^S}j>)o7rT2nt)|Cf{mT-!FcynR!CW6rzUp0u%d|y>F zP!$X|G!L@Cz$|SQ$qpGdv1Mkg!L^a}HhAT1PPD3|E}B#Vg{(G?vo)dP%yUX|zoU9B7Kml#BuPUDrzF-U8~9mPj%NRuQd%pqX#0>h`52HJ8f zP&g|T&#KA~eJqcPTnW~T4T*1Q>trAwc#EZT_fWVA%PJ6 zI5Bx(tnz6m^xU;l1{lCjGKZ`biKel{nc%Sl5#6Zx)_{gBjC^lZ&?cF9DgXgAIpf&wtDbw!m?FX9J}n3zEjv{d@VAnq)mdI(9y4>+ z*rXn=qo`UR;KGhi;cB>_n_oU*66nWuKR_M@f zz>z&lKsLSi@|HguEj7<|zMu&xAkM`?LA@o%#}6FefOwfYPq_e9Ao9w|uwGK{Vf@7k z-x;hn@PATi)hrZtmeQ^`%`rXWt?1|%iah`@sC%8u7aknp6-Y0Z&5HwaATT&@5VcD< z<0YfrYCAF6UX(p<1{MBzOiskqcj32VAqRgw_%D7pP$}Iz2O?aKWG`w~pR-^N>d(Y{ z4Bjn)@!UEAnSq|(p}d%0_VJ-j*2Xx379o_ZvBQ*oF$v!90Ubm5znPIF^H|WVq012; zTB{BTiM*l^@DCkZg1G|Fq4nX7&(W!xWPJemc)HZ_c5vo0sT3kU85GjgEc4UPn4=Gs zm-&*fu&0K_y4Bw}hPSI)V#qnW>~wW(b$HU{Ex0q$?;;)zuOQ1n(@e3Sfz_o1?2b0x za5zD8w!bsjipi<;Ewj`r4o7$-KDi?=obSZSPDvLDxX2l<+-nbZL0`r7>>ZNYQ5|BSx$6M#rgN_PsOd8 zEQIbWjmVS-xEfX3Lf^cUMgTPwC?_+i1A|@@_+OUl8P%c@XV`b6uBZP)s zXYt~)40B`ZNX76(2&3^^9V5uCSg){+7qL!ToU|f8di=q1A0w}OCxxF+TE02=xDpHL ziYXpY1|N6ymMrYiS5)z3Z-anyP!%9{v52teE8igHRl4Vm<=CHDrxiQN9SUtAmE`({ zK6LB`J5>(3wTnfFo zPFwuPfNdHeaew-*aN~5VqXWmE9Oxc!6__z#7E{jBe6cTRks=6qoS6LJ_Dl%Ar+jQS z)2y1BP_7oD2UzwV31X$(+49`#=*5@;1X_<&NiPS&0Y3wq*w3IS$2c>>Z1pk#e)|I6XphR zqV9k|z;Zqr>QS%W*=z&%1~x8k-8XBY>EwWiBVJt8Z8Z=wM-GF+3LdJYT{(+!4Ue+# zYAzvDqml-`ReevVazEqxkdD}w^|Lq@(pK)7aiA=cY-q9B=NLRbSAH|p42ntq+ktvq zcnDCWyy^Km3b1Yxnf+g+I2ZGOB*i&c{zs^%SbO5nMJv*eZ~X{bwU>-Y|ZHpru9{jcVrcB34MWc3e2>ovm{CctT3?gRD7RI@C)~W4sC&WcY{l z{q5uZ?`!07!ofY!7@m0aY=p^AlE-F`;;;GH;^V>HP3G*&hqb9MzWiyamYsJ>1?t_K z?k-KrHbN4hl0drRQN|i~Sx|u2!&mO=<@H;)xJ}3)t-E_+#pgN)Jh9Co;+wsj279>@ z+%!)kNlI+#biB$MqaN7u^&>3DwVasuK_$W5avvMX7u8AU`uZdYen|ofY$E zxe3oiyde;&bP&P3rU~%_GBibdtMJIbdA+jluV(H8>L>JKVNL58(fH zcwc$^u&J6Tax*E&V62kZJ4QrD-G2QjKj5CSKj=X>f4KX`-$`Laz*<7tpRauGdR$R| zGJ3icX0LFx@bQKu5&i5u@HhXUhK~9U|Mns~0;YwH=Mm#kTLT=>Hj!vHm^z!f@QSio zNfeCOA$uD}$vD^$;;oCNOhcwnkd%(I>pv4`^n{Zgn|a=IJIAa7L|;=8Am2CzGl;Dx zr^drN>db8N z)}mu@;G#qZ!^*&!8Fj+6HZ3tf?0gi^+2+k7w}O5(YUt!%cG{OIH~%tqB>?>sz0t(R z^H=mPW^t}oj1qe;kl6IQ${|X~E%o9%(f&PZ?q%(Ca?l`>=1$ z->HS}4Y#^4m7{K1Q%{dV3xgqUdB{X`6J&LpTgs7ezE$r26-6cqgr4|Z$pK7>OMAG zc)i&OA-*etngr1P6ehghMQYk>1zDG7>kJv|Ve@=foPvIzO$}CwXC04WiNL?NfK7sA zBb?9%Sh%J=&%vR=;lXAeE18&FB7cooHn#8O9KhoES)|jia$u|U#nwaeW)RecGTws{ z;(GYZh#19?UeWQAF3bL~*CNUQinh$dn;F8OCNY1Lyh&Sq7)Nosp}q1&2*^V0kQJXl zkt#mDvb-XZZgh^KLyA}7Rc(S=J1GwVNCZ+g!2^tn-~CeM$`OVvYt97E4Vl-l-WKI*vcevMQ~@E39ERr#Hx+qqD894zC`~7_F7<@e>2~9{Vpgd%U9RY6ztXl}O`Ga>K-LY{MgIqF?>^RjAV)ovv ztRN(lgQPuy{24=NEDZS@$P)Yy!v%- zI=9jv*8Gm8MWy|RF43(LSY?lIxLa0#xGC71!MHFedO}#*}XJ9(k4hAty_mm#PeU|yN z36yoNAz|)OR?yPlMY~D2zdmK1#bVr9IxF1AwX`=r$SW8OJw*vFuHom~7v+bZ4lB?g zmZiQbV$*&-W`19dwIh`_xoq2@U%KK=MYKcX*;7t=bca4=W2+(On&8BASvy7G%BXJFQDGq4=NKVo=2GEuH?3 zPOKZBd{9nW^H36G#JRtV#d4@vm+Ir$=*4hxAM=J9vI8qisZY<^O?Ps}!Jjc|K>Ev5 zi)yfxILM>b-bdS2J!*wj+NkFLKH>l;6m=MA4|DaJCgEf*;vc3Jk;xcGl4<~iG|b{E z*OyuN0XO`epuclQbZ9cAm{q+mw7;4DF!H7}*b|&6MPQPdhArKIE2jnzd1*X0(uS6_34mKm)rJdp#dQ@C=j& z>7yF!BMrcARb%BG)i#8zJ22A80$+!}=#8`HR^h*7(K>EVmxE4mAt5)ksI6!toYJS7$5>w|=?-8~ zR}2Yd`e7Ov7u=G#T*>xq%J8yZAzFgxebF@+3YlHP8Y6-s`E@Dlf`5^~de;ppRyDPi z1TkJetsCn7q^nCAbqWbxsgdYR>J~8QL}iv23K9am_CLN6--T-!qbKf=(HnGi%V*{O zSC)Nhf{N{blf7*JiR@)z;^6%MX4(H6w(<$G?3nhmKm98mDt?3Tn{Ko(wOE%qoa^W* zyfTzlIWg^;08XS?RC%a;U&AK%AMaU`big|+U;%TVacJRFqWv!J@$KgL{e|GigMOf> z3M(t%|I$>jxPqt{PGS#%KmIS>8(rVBv2^CD7g8VH@&2i1&?LQL7OX=aV4#QZ%!gxh zpTx_lPr|2Z{s|bFIcv~u>ge5!ci1_7o?Lhk2Am8(-ko*in{6!t!?B(zZMPjdJO>XL zt>cweu`9@EAT)wfh53gacc~}F_~_oXV{e`~7uwibzRtu27_*)&?#zR)==4VsLZ<~xj@-Qt+>dk=jv3DkI=61LQI)IW@YRhLb9YaQep9=FR>`@EpV=1Vvqpn?-;3g zZp^mbI?6ojcFXrE|Dw6t# zR!s?-p!=@A&&;rS!UWY3SG;RbNqF$8Q4voR7HDv*qbC=ju0BiQhkEHhtD}$US9V@Eu zM(eJ44W6)x8PBi`O6&S|`rMx6j2jhMd|mwj1rL0aWkZ# zm8!=LB8CfB)R9khWe_&pg}ev0+DY!om|Y=-j6URGG|(C|R0Pk=%|ie;upe9_a`^EApl`pwyDe=s}38kr4&NzYJaZrW+mcnD zVsuU2Gp>ZIg_BhNI2&1A1?I__g_|NWa{F8>xrh4~Fw&H`?bO=z?Q7#=8vMBApO7{jT+iwSP=9Lahe6-#*c5fohW(0jP@|sN9L+ z`&$JeXNUf2*`6-E;5XUQ7I*Ioe-=$P8>}>j|0QT$+TjY-n1y?@4;K=+^oBa|I`x!_GE61uJ86B~_(4$P4c*WR7N@-wwn5rL_-c)ivLc=Z6++!|dhocIA9C^@ z^@8HSsbE@{8HHg$3vSwRI6&o(YR^${Iqb17O}hgRrY3*04ZWV1V&a#0F!II`!|t@! zy*_@t;!Wi>1%UR54BdR7>CL=2v-8Kyknj+!3Wb$+4@c$;f|3A{b9d^t!6fpv4YB1b zJCk-y1o{`MR4gK9T{9Jq-`i&Qs8SQblRwHf>zX3Xk45%#IG}JW4V5182kW{%LF0in zG2?YV@MPck(#lUmk_-ppZZ-~?Tx==~n2?{aKyHgU(R{9Q0Beo3I5t76j?_l~C7T!4 zRFxNZnPLT@#w#t@vTfIb|5nv}vl-`VgZ9jxUra06@jBPOI>u^z#hb|>r}H!1F#MT1w!%eUe@ z$V+DPnJJls!d-QZ>3~~x+jF6H(Bo-6-z;JSwN~lgclxj^9CfZ7{;k0dkv!sovVRPx zOLC3j2Nm7CZ>p*>seG8R2U7LbpUKs;b69NVPrlqr_3;OZZQqh>WP);i9#Tod_Vtf= z@0wMns#gQ~(jh34Zpp2bdz%_hD_J=+>RW{cQtG5wb(22i_#0)uGF31qhJm-yEsk;+ zqU4gNlC?AGk;lTyb46y-KIMbLj=P~)8e0yj>jZp{Pbwq&zg}^~Eq@I|83Wb_J+kLs z$<>waZxa*J#AgKaMlJ&`OcZa`<826;sJ$^InEZ2zj_wdFJB~A5#o(o$c+s_uB^8>)`o#si)J9J zTD*w5^tt_gm&Lcw>E{~!;YhsN1LL(JRhTy&Rj#Z$w3To6e0mv|j@~pNC%Kqoeo2N= zZC0%%;ihSN6{L!c++H783@c}6XjWkk!gDW`O2Rx^vC5tV_9(Smmw zgi7;Z4J#sNBheU>sljIiCte?fLG5s2$jWN6TSQy06$x`pG)4 zIEgZ5=|MW^`mUAtyIYfbH=w>Oi`#Cm%EIInBR{b=XjPRwXiG-UmAmZ>GFKateazCQ z%o8?T%6f)bxt6>|JKlc>DDT=0Eub3!q(+)#%e6E-#yEgB)o2N0Lj@BmskA{nZBpy@3ib{^}j1qN-C6P0jLh49znW9r(kr|_YFgXCGzQrKm`JZF5;mOR?>=$Uw*`d~_DY&d@{O!OfibiPq#Rurg)|nh^y73x%P+O7SZ#AJ zamTLP!_(Vm*m6pr^_cR3i%ZC9+}ZWGQ_hnFX2{5UgQkQIAY0tB?PDxs9FyKBU0drM zIM-V@Ssj&&&DFLaup{8Vl1Fd;wMqzf4r+u$c4`&W&Au!$-hJpb1R!Zf^VK*Eh7&w# zC}#qbj@lPQinPMcn{dQe=zw52WmXdMi*gdf#o*{)Yct8VxMB5Hvji@*3v!?!ntkh9 zD6p_$$r5fg3LitY8#n``80^-i1j-&6=h=MF;k~n%ms{r(fvAPOLX8c1-2x-OdXnDF zEIujuJxlLv+4kEX(OMP0_+Vw#(o%eHRcP>V77-R2HPvG)zzsBF&vTj{(yUAd!U09cR-k}K@bM1* zTad=dUE1yinFP=Xu;qZTr9)Ww8VCBoVofy=HCljE8;DTVejIXm?6<&}9TY3K|)Wv;F zHF>&edeOxO2dN+CY!wFx{F-bUz|a_joyWNA@4{_@()$CrIkjkAP2Vi#8_To>=lSy| z^8&HPCC3(n!&!e<%2f?BzwoP>N9)4LyaiQ?;f>ca;aTXaHRZK`U)`NS|7G4(ZNutB zhN$Mr=Ja^s&nX_3ht}UOdl7=CV)w1*Eze>sfkM4Y-NAjzbZc#=yla@T8Wv!ei!ob$ z_scl@K2WIBeMs#)nbcn#i>ha_i77^R3=pwUjttcER1xeY&Q$vDKYl7{Zi*x85D~na zj>j{M(@g8@zSwp_71&riXBb(l31GFnl{Dp1%S3WDGaseqtvkV<(g#Z4e8+Kt znBiMa4BcmO;$iZyzRITjJ>kx|lh2)i`bO5@ho7c6Pqsuw_?T6>js?eq{rge#Hy{O! zjgs!0r($#c8=~sp|IL>dC~DjN{|^=x#{URQ!@|nW@&7(prgX-t|J$ek1U2VG=ncgH zP6V%)xpx;rPo*yf7DS~o3chh;5y(t@%X2Dn^F^m%&elMV_lpOu+0S_p#ew}sr!3i*T9|W(69r#RZw3l4N ze!t$GB(Y`q_L=S@A8m>i*N8W{E4yVsoP@1N^=%6L<2+R9`sa*HF6Qy>aiD_8{QdPX z=FOnX`uNf#AHef<#I&Ne*WRQhi@EZ!Cn}AE;1H7N?)=tZs$TSo{d~;8-K)0VF{z;? zuB%ErBkW&dD4UPyBgIm?)UOe0BH^kgL~?3N%Y zczm_TboC+^okv0DnR+<&3dfA`b8=<1*>e}R3MPdr)V{%CmC^(Z$6}uVyty?^qs}Un zB|oof4e>Hdg_FbIa;A8T&OZDKR0*9o6o3j_R-k|MC?_JNc7+%oLZ`{w@kdB-y6g$< zQtQIj2m}UpnkKG3&A$?fm0xy2(iY6Xd>4lb(t2MpQT{qPCj4q%E08~e3b=M7MW!}T z$rci)WM(wFhm;ssURa(|nBSn(K!E2iRYjC8j-5t=*t$^mRma{-DAS&0rF=Ty+x-#; z$@fiVzHkQ^rg`I82hFg%f#HZ-(D`tu`MtP?g@8)jT`NL5-Z)D4Yh~~DGDo4RZt3i7 zod#-qws@mbCDf}nD)4;=xjsM}_dW=kHXS9mCv^m&YKgyM`4tBGipmM#WGH5H1lN{3 zq;8}rrviBqsc=+*G_?EqoQsl8M%lby=OUlrL8>f6UoAjjE>C^3M_3Ux-3VUR<>LjX zPl-P4h}T`>`7*i7P3@~kM}lCSk76CS!kdpSgTG+opIbWR>Eji<$8#V#_#}JBv>-AN z$e^r`T`EC*;We7vPmqd-rh0I>1bg(4gKd>0;wXOa-9X0`v; ztSJuBH4K`dx%~#H6=y$7)bjE^)K5@^0%$<<)KHn*z5!s8;-j#c1e!qn4;$#cM`CUc zz}A>(6Y{OLC$FV*FdBai- z4mbpWIPORF@a{mNE()7q#_50LtNw@pQn#21a(FPVs84peL?(IGnc&}G@GH*tcJjG? zpcMlTHrC2wT8vPk8h~}22fL|5EVNMRQfiKDMk(e3s zX^%twYN%}r^K~>OzkpboIh(z~IIi&;htB^1jJ+3P+}LcEsF`ggvy;SST%lw)LZc9L9@fzYNoQF+Co{jMn^zyx9{s0lh=Daoel~=%2$QB=!ONMcoqox zdu?AEfJ*O1iFQzetlUP&kh@mzJmsfr1SfYoQix9*g8ldwS!HXR1_iRVSK5I$-Ei|6 zsG>U%ef?j%Nzk8~-A<~B3fk*p?a<;@bemJubp@7{<=h~moTO;VZknx-yQ)C0enYrq z*&h-3f>s}lD)>a+gyn6Lt>@1T zf`G{VqNj2@K}4qV?Gpmli=(%9Nd@yotPF(oKqC1G_L+<>}VAf8bY>J?>>)m+FEGFC-81i&(ImDmA~jDN2L$GZbMhIadX zQ1<9J0@qWbFeBSr=b^E7#@nR}122n_Gbn%u96yp+c*C>q7PBnfa-9Bh7 zi2FQ@6QDU>?`B}sxx)T=$%=b?s6z}d#q=&udd2TJU{onb41mS4+(=3UqN){QhZ-?) zp~z8XYWUr8DShpyCqBW<67)$Ub<=ZH3J2LjBIsamyBp3$v?RX zANb7mFpDD)d_2>&t0;Bc#*y`xp;f4s5s8Y6CM&YhRh{7)Ilhz2XDgFODGhM~(56ti z7Q-M)OES0^x-;!+lhQ*RD+u1uV4Y9WrFG6*(}YlsS6$eV5yp7^OQq15mKn2|i)a?? z27Rkl2)=vfTt7x**^?itL$JN*rLX+^e#<$gumCCso>_p`B`oMi377Z1c*kTuEBe5x zo3F}9I5N&}_-qPItIY@-&w}@5zPpX#9wj#zIWJY>E0QN%$szjq^`=+X_j!$hhr^Kw zSvH6kdC ztMN5Ld&lQ_ml=E4XuH&icdFx7%pJ%jRljg+RypWcUL)5%{Zx}>;HP)J@QbvXtI&J` zjQM0~g6|ex(O?f}g~q%#4X+x+ z{`%Q=+hX%$Y5lk}o;9qc3Mr%uzeM5KofukU0VD2?zB<$-efQ{yakXXoIxb4kvRI^% zX}&J7QO&R2Jh~ZCBO!mgolQbGtTku;?X~xN2i;V24>mXtyw2O8j>p;TN{Fen#+B1{ zhQPJKEx2C6xOWh_Ub?DRYgl*dOPQOk_}P(ePe;T)F8;HUrUef=kmb5U)*ly+rKPxg zNe9l*IbQ#ssC(`~gROqr+GAv1t)G&h|JZ}KdPZzNa60FfKuZw^nC@Xt!IrQZBw$77 z)`P-O2W3~AzVIHUYZ;t!zpSn$Tc&OY(#!dI@*JH2gFh_FoWqURFOb`b2B&fbetpQt zdntUelj}VL*n&0Io#vAjWYrJPAtbQlYeWfw>7&_-GO@CK(%%9s+Pvx)i)uZS8j(z& z5SrOgw+RYKq9pby>SFyB*k~Ce3M?{zG zekIuwaY>7noM(0$yZ^DJ0ju2dhM=8yowSgjon^NJ<%<#3nom*&)4yMyqt~d5qkZlX z6tgHo2+EQ{kfDc!sdWJ+F1oeI-s(R5RUBiZr?^$7&Z(3=duV|LpNB5N4Fi!(tq-D( zW@WAyR32q*pEIuQM;plX@b!dkitYUDlp;*{G{la3gcqqwYjNCpj(H!`R`b+TN!2o# z_rrKngpYg+($^E0D;U1;@D*}CbehM(zFfO`P^avwn(;&~rpvvVq;UJ*c3uP}IOcHd zxwzV2SXs8Ic#v^=@OGfMpYb>9MEF?E%^KI)sj zjnDh@;n4eQ;^rS{<@GGj|8~*+M>r*BE|&i>3txrP_UE#d=|$raK{oRRn3bE+5XZ6k z)-)`HpOj+TkmS2tN*ztBsI2?gh*0up3)XlG;^cNj2w(I)38Dsmd&ndreBhw|GQgvTD;`r{I~w(+OdRJD)CmD zqW<5{P5|%WXK~}W!Tql1pI4){J`?-^nHA^MW7XsK&-dUO2Ub4NL{^THi4u!Y!>Kh? zT*vvY>b64)zu-Nyb+nQyZUq?+9Y=;T%FnZQH#P~Z=hl8dwc44Z;Fs0C+nbvJ+!*=8 z2W}(`DvKHB9O@IPws=#V`@h$8fY?enh!O#2EH&F;vkhZLnIO)Er&IEHOhJ63<&|>}mld2I;d- zBeMf(kZYG0mBdN;m%4%p z8EE|2-yQ(Dx=0_~x7uWGPI3TdFeemBwJuCze`r;pKxeS}P@$+2^4W|=tw7QJQXXoY zgt$n~SZdp+B^Kr3Tqys2nA(@_Kf=0$a`;8O*h!O!7#z8r1 z(4=+;&wC!rmJ=_{#o!^(AzL_O8H_pvi{cmtgR5W|Fj*t{g38xma*XVqA68mP@!N&@ zv;}WbTS5Zjcx_1qp}=xnS*d|o9B5~|rL2TABokjW24U_rxmdLqP(eiFB>`CRp_C-} zyddk@;p8&;m-(1Wuf42Ils6j8M(?Ue!)=`*4wD& z2#d|X&lZd$*ZeNX$Pm(a51otN19|F2+$SBF{It|nVwq&`rGPVCFByPX7yo$u+uXO$ zMTS&ULW+3~#v&)fU2I%ebM=t;x6Qc&Dhdx76)w#Cufh$FQTnS_a3YXtzJq&b#${jZ z*}2*%wcN5j(dDToqbqqD#6>WoXAo4FKU*KAi;bbe9?cq^ijlk1EURi6bI{A^YFszD z$?`9c#;P$n?l-8LS*wclVq$$L_%bFH0kF-#L_(D`%tAU~jAPtv;E$kR%E`neFk)2| z)4dvICmF6I5pw~orn6~GLtE3wmSt`Cki#e(q)tmKEWhsIi9>B(Mf(Z@8HYoKx@oDi z;hZKpGT+fp<&dRa;cs&tu}2j_xU>tj1~rN5$z2Hq#vQ7jUKOS%)fx}%4xe&WuW9Hs@p)Z&9=S+u`QKS=`(z;fD?Vak; z%Z#DW$TGMT6YqviSv6m0&M$0G5=XDfCF4uoSEA-eMTh=`MYETybd;Tn`=FZD{n+y( z<`YJ7W-t0v_x~zojWgKDWFoq%0ht3desh=fbB3s%EdP~{-a24_i*=k+Qfzj@(yr_( zD*(`|mn2x*Z|n|8lP^3cGi1g~Qc!*Lqb3KX^H#ZK>ws;l2#V83=PcQo$=f;Ebq)T{&DR!ikDk-(Q~6x3^{D$XnEO&PhmW>>0;IgK;xBvr&+ z39LG3O$-8BffRzI(K-Dy7alZU`$=kHkzUGen8tJIXvAv!{ZhP_D#5*ROy?Duvdr)_ z$X&JNl2t15K^EEJQfLzQu?4zvVyrFxXup4%E*cSg^o<|jC298idjX#LZM#LHlP!ZDLgc0gL0^b_Xws-#C z@V4U;K*?&VEP5BF7Jekm#QaM$hs~_Yc6vZWNV9Ao2)+vQvmD2(pzb5L`pbW<*89z< zbiu*pm$#Kx8Fq8k^4cX)eq;JZicMnvuJ5(pWpk28cIe6OS?oBaUaGQ9@wHH$cj!w7 z^~aJXLkPg5zs>S;8G-lHlHGMFk2kzz>s(uFmX^(YWxqyp`wec6KTHt-3UhVO(E!H$ZtI+1ycfi{h*(|NZB~W`I!BZ7kMuAN zZS91k^&5D>OISq887V>vXeAgtd@}|eijL3+o*A{emKOenOFkfloWe^Io*NBq6$Twc zouwjjyBS%sp?v`8^&Ud%6X;)qunF{L?er+5srFZp=+u+hI&*8>*qA8|4+nlj2zrOF zsar^kZ8lBDR;T7VJMxEOU8D@yZCLu`M~9|KOs1h+gSX1w(y76-HLXj8!?4fzS4Gc@La0#2zRXuFJx51a{?E_ z^W$$BH^jE4CM$1@qr2mtimC6oB;dv_(ZXC#y2<$tN=z8ojs!*qF4gyB5~wQWJx#a$ zshHS>tFEkVZa>!TtCPnba?qMK7iJ(ZeD^3Ba((on9se5DS~`?NuNK9X#3mGY$Xqia zbx4;qpQL*(N?L?XCt2Z16&Rk!NP#6*=qx``%-?@lc{Zp@D;{x*L2*zfg8h`a74L+$ z=gK3WUa^0@5#_w!7Kmv%&LdXtH@$~jqiSf^^SB}nxr6{kKUPD;SvqQ76rq+EmU$%7m2n_GHNxQDATw+HjxPeFN6jQ+^8Bg^s z&Cc%TD~r_Q>CHz?>yic85uyD9xXBxhNp(RAT;k~%<6X5coSY=BB_hyL?@wFfeDro; zgYHkJvR08rD=jTX+ro@zDn?MP0`~V+Xh2#yxnM2|-mJiUht%7m$$ob^mg=ZKW*R0P zf?0dax@_d+j6d0X0kZH>&~9+VjN@UlM#Ld%9CX8g#HI=D8*!wl{IlYyF>soB^ReayAqFLx}vk|Y-wJvb$IvSA@)mZGmoNT!X~ZAT0L^}SKA z2YOwHBZ>5ERQMH(mQu_!|J3uBfDZyzC@3e?#BUTiKelfHz}>%%+-NIvC ztS6-(GNv<7ySpD5(wBW}NIRsbIyM?l8@V|eVmNw#x&F68ke2HYk6{yLTi^Am$w0sk zTPTHb0gkhEH1g9UWZAyqaG3CmHP`*5Tg-hnmuq7{>2!X2Ik!pL2*=U;QpP#aDM6S3 z4Oo7TbEf0CsF~$hUh(k$+P!uoobYpL6Mnn0)C_nK1abR9Y(vU7;vNaXtxj>==t#@?o5mfuwh&xUG~f$nw+YXtZ!u6@I7rs<(u^t$z-1r!0g!%W0QgR%$bt5ROrykC0^3u&lBt{d86yn z%IaHPj35A(SU-P<{Rr&M7;0+9lR0x$8AVblw}ZLbm66kdCrNa}o;B@+1Q(w+#0l?f z2pWdK2`h%#lv}MzxCpvTgj^xxsIBu5s-+1XommQMacupm#pu@2%5m8PW{(Cw=zI&7 zFH}~{ht9RX+XGeBPDq57c9m?+(0KBHHe;UrjB@B``nsFo?7(bpg&Sz+7kXpDJ2aP1 zN*D2RC|368UUkr=1^O=4R{it>x`26dY2xA=YD;Y%cw~s7EzB&|^?w`kFX^9&BqVdN zs#i|8wpmkI*|&*9bj5aP(2=Ls*j+-A1Oe<{hDixhGYwYSnI0Jps<(Gscnc=-J!=<`Dg{hQul~12~5GO z#Am^eW=IMaxG4UC2?3I2vu~WT-N)Bbf^vpg#r9Xcatg;6Tyk8U^vDl*9a&221_q?D z6+gG~&V^EA%`lUOWSl`qbX}mtIfWr^)Bt~oNB~-&TE4NFW}SIw;;GEx?gI8|;^=m( z)A2&0wQo0w8+Fy{jjO+we%TxfGH~bN%TaCQb+)9Qx<7pP7^X&|76HohS7*zqslkS9 zH0LhcX1_RcYb*}rzjdSFY$0cM!{ibV>{E*%Vgy~ghg82nW5(eMct6Yo2Iv{L3vyk2 zp0e>D*6!;F1y)$;Ab#h+>Kf6pVF^;Z9a)tiyKj+;Gw&b7%Jwo70Tb9)HXE1lV1o*$ z6`U`3AA?CGPYHdC`_=C10 z2)}1CNn&LEDfaqHGgq|5`nh2tPp4p$cxc)c#O;7RdXN#fys-wP&-{Z8DQ}G*Eyz3= zTUbWL&n0e)b51j<(XeQ8_qO-Oa}tGc|41$@N18sORE7oB6gR7jShzSW+?&(g%}k!a zoB#+mlVcg-=S@}!(F_BDnbNm~z2G#-H%JUyCPIsQ{4`9|*grZ{UL?rUTg!r^nRRkZ z=~^E|&I5vGx7*cx$1PTC+D&R*b9)Ta<^l)x_6Z_E64};~zir%s;lEErT#K53 zzc{vIK#R%>xq3tj=-kGgQ%_Nw%({eP7>wRVcNSDu;cu%NI8!Ee9@fn&sNA%;ozinoqZik!DVM~!p-AMwVl$=*qs**mO=OazjWGP3 zSp4clLFW59?$%VZ$%DwOl~;f{xwk)w3Gs8m`MF6TQk5iGR60*=^Kcv0$E z;PPZ8d##Zom=Qt9TP%Y=bcXaKM!@>8dTQ?ZuEIIa*&DplB8kvDRDTV&^^*Av`=UNIRdtyVa=IC%dk@ zkttdX12x<(GCO~LJXr4jIxmxzE5yjY@JMCFh^_wue= z*BCe6)Q6Ybj6s|@>8f|DfmG>@k6h$KTB#>&4?mHPB`s;0&$@~^=Sb#yw8fFCAX;Wk;^2tzI}bk1d2o-H=DPNIPkS z%bENrIz_YbaTjz2&KM)pGGs77Z9fsrh;BSs`@Qx=`3ZKdd5ZQn;M3O*Ut4*_CTrGE zp+Kl7Y3wO~7GHutH@-z(zv#SHKB+w=$S#Y@Ba|#R9CnT=CI+{NGSoU0^09=qRjD3^ zTqldE?Sh!h94jekQ4j~D)YXe%G7_2loqkOuHA-~17j9r}UoaV{+v8uO2%+-e4#QrB z@=+sGsrdjrQa|hOoe&ix9M!@2Vq~t^J+nu$OQ&7f-C<)ZlFqR@M<7yaUFn3l)$YHN zRTd9)bXoi7NfERj_M`alPk%hr>txnwPQW?D)iK>$t#o886!SV6;%ZP9L)F4yZFj?CnBl}bQ&n=c29eil63udJ`j9Wd z5dtUm^?w-q$L7!iE(;fpZQHhO+xCua+vbjK+qUgw$F}X{tl&1)T_s)HU^$}UMuOU9^vPN)S^}M`M@N;STAP!AK|iuswu^5V1f};Z<6#) zj7{7kgkWeSu0ao>`dj#&^$yDNr_T~Nf_kL0r#KBjs$1M+P#bO&derxLy){F zTxrZUPIZ~_9j4QTya4L+zVw4Cf{H9Zep*o0d*98zemvR#PSIzzKXw0&F7mxxOl?A^{UrJQ!LWX{{hUxeUbSFg)^;Ml|3S;N zJt7kA;yeD7D*o6iBAiV9?FS==g_G{{<6&!)J!pOP`fqfR-p=il*y5tl-{a8N#yh>e z22;j#uqx z@ly)E+CqCpN7sZsts*swi)X>b&7x@7nw%dB?^{&(Y_IG{dsH^- zf6~$~kCWi*u_C%cX#wVh!v&%pGf^_p(E0m8<3b2blzdcTd?JU#+GI?mGFh2N=_b^3 zG~QU|0{)^cIq67|_SLm*oQLJ(GyBd6$2rab$S>Wc0|ca4HYV~fWdi6oqQxcWxr%Dd zI@MXQCeS=MSFlA7vJZ|i0oEZ3>eX0i!H8ZI#9}HYmVdLu%h=o$+45qB6^%Pv95`95 zcXvdOjOITxP#*1VA!@Dz|{shhiXV&~9yZSFzXez~6 z@m*{88Bq)&3dTR$QX*m^ykUQjq}F00qawq(o-k;e&VZIBo8}?+F|I=lNZdZCbT?eC zpMW>0Hmj%$138EZT%Yp9J*b0052|tfHEN7Zcyq!UQM2XMbn(u{*u1;=WO&qXYq58~ zvXdrgt6;%zVON%ZLiZ1djLv=hDIhb9tjen2&I5u5#M{I-Uf-5DPRw8gO9C;cAH9#g zXU)5qgn+n^Zu+?jYW||gP6l?3^L}%N1^?Tu+&E}DX?2=)0SOEfKlMB&!w6A9Vhb88 z90!_~DTI!MJ#rg`T}2jOU%LJ61_c1bu5;M{PN#3D%e;)S5Hx`yAqrjAqQMNp&Q{Vm zs_-2sq7HK{@QZAlM2~pD@#MteSF4MIXbt3FA#>C?ZN{_7$YFC3%&DeF^^#|7X*i3u zDe{qr^z^xzDR5vITk6Rc9X)dZ(b`Qd1H+Za985TX`ef5p84N0=Ivvs5Ib~w0raSUE z5+au2hWv48lQxiY$P60);TDrTfm@0(!zj5-iictT`V zr9gm0f1dZEbkbGPSOYPIn&wr&GdZ78wZ_7IDva7&Nw;(y(M+~cnr#}*Cq+s#Mk)mk z;v85#&D|l*n(-{cEgDzNanh516EtdSzKc&=-f(C0u#B}=%A5f1u+QgXCkarL1lF*9 zk#ptcV!sL|nO@*Bm7e5s{6Nd?P$0it6yoa9z!3D9CMUgSw-2LZsUYaE7L?&+0)v$X zT3O}h=%i(kKDxIHW&!BzAi*W4XDYvc^Cy@o8FA;A|Gbm5=M-NyUlFL{U7LpQc$9OnlPQfVPe+szw zjN20f)L{7Zi-NQNN>f@yD5N;>SB6>n3!l?QwYFgVA!A-m{A<9l1Nju*ThstsLp3Q& zkz0@X{na-N+DDyaes+h3xs9$|o~qsgePJ9E;AA?|^YZ)A$Kjkxo-DhJx16+u0LvvW zZf5ONjjjmjZnHk!GM4A7ycA~1dpRifH)Por3;hz8CZI>PJWB5CRdN%UWSI@0TfxTQ zm5qqZf-O)%ovw3LQWQh)M!ZYMRc@!IQq1D1J6o$L58P$b&;p0f<*IuGJMMf(+aT*D zP{9b7c#i}eQhOo>y)C;4wGk$_?P+2E65*Y{D>O%8FEc^CRtj==*W-^4mP!^B*sD15 zI#SB05c)9uLw;>*2#n}+@PwKYaWwX4KkN(h5u@r zw_ucRTnXH)I84BnP8ahsE`rUzJh9$7a7H}DAS7BPCWZHJ8Eb>N_;56|e=g8{eO{Ap zX+&x2mO{WA0GiK9Wx!7Ks7Kj9P_2j^a+#Z`K*q_F^OBX%1k>x9*@^@5RMX1l&{emV zP^^HJ;mfkU5al^Y5Z0;i$Q?}sS%m*0(c1JbTo};I@WQ{CJCclk7H0RI#1Yzc+2IV_ zkFskT6U5MEQa*ZxlZbUO!HgwDI3<{s8ZjD?4?3fZIvT+Nk7rddo1QH<*VMf_yU3G+ z-?k(x2*NlZw)I-@_Hoe}VE13D+pG_&Z*CD!*lD(bPXr4<=Smleq9wDf>z&83*bVGL zp%&@B(G|{-3UBcpv0RF*35lSWqiEU2r))9gE5=y$>IAa3kOd<$fx}^s*&BYW9(ghM zRk(Y_%1+2dKaI}xb!AyKyj94yy4aDoI-&xypw*(@E;)OpLFZIuZdXRkvMdGYPxibE-ReocA3TMX<1Y+ z!d;D?Pf{2POgE@q1IR-Gyl#U4Xu41dZ;>fsR$;)065RWpeCCKKM4`Lx8bkEJ6Chm6 z5#8lL*@8(hhao^U4ezgMml+Rz(6un*Mr3c+o zNw+G6)LPjG42C5je76HxZOuIv=R<~BTJZ!*D-eIDtryW7e8=egnyhrc5Jx$^Vx)KZ z4E}zT6;%u$uotIX)LlxU4cnnqnH^c7?P)Fxg4p~1_n7B?$^*0@=E&6@dTcBDnas1_ zBXxQVNX+i&@|WXiTxo9?5<21A%i_`UEAsjG`=tIi$i0dU&i^u~GX9^yKFo|P%>UoO zK(lsd&2Pf_`T@l^;NU2m$e;`&9yZ=KVG)$lJE3J9P5bCc*wJ*1P;{-~ho6Ii!${9frk9R$J{e_(7Tk`Um zh4RIh1AX-T+SRo&cirr{sC1i-9yWV@ZYCmX{BmZv zWS$>)h{*lW?mqCz4>s52uzG(^9%mQrW{c?(mtrC;2a536-QfNNPGi@GwCg@}W_IQt zCDoj1A{-MIxC{0Dyh>wX-r&Z>?%>~9I*7gJT%+>%rG3Y|u-;8(G$OQ-vTaae&*%%tXp$O#>#=Z2uk}B;#N-Mz-Y*)Rr;|hE2glEA>?;YqcZs}z zv$l7&2{hxFr&C*jp{C9*F_Y)-nASyvxVbCq)FmBXJYAmONIhWtaGdWuOb-g+J+Cxteu)V(m* zHCHsg6qVAhS60?%$#t2y?_VXrV6jS1IDX;_3Eq8?x*!tQp-jwZkyRR=9SRzK=^lpM zfcm}?B2lu_T`NBBzN1O74(P_KlSt(8+KZpL!IXA=LZFD;v^|na$05oL{Ww!1bv{A5 zj3A9gt?DB${0Vp_(Nw?zu^Q`kKcI8hT(h8XZ8R8jB(r%dD(!VhRXbHf`--H?if<&` z-YPSVj-clFu|k5ltpf?ylvZ)9$P;cHv8ADs7DQV_GW4Q(d=kn%h^5lh3=9tj&o9Sq z@Qn=#BGa~Qw%Un;*E~6vre4DBmVcz<*#e}!MZ!>yE}r;4)0qP65OcPsotDS;(4cn0 z4(iLs2~b3>6PWawY;K|Pnb9GG*Sc5nVp^XrGw2aU2L2u-#*7=6Adt^hsCf=O>FFMP zR*rI#UFMDk$@l@F{^xif>Z7i43*7P>xn$|eKA=sgucXrgL9=wisYl)!#EVkmB%htr zG%;=ZzM=4wXA4lCH0TnS>NV6gHG%oBS(?|pw2+usEO~@PfA9vIA)siI-FA^Flu`eR z|9$|8v(KY#;I;xHr>C^zSj3GRTBc44@WG^gN)3(v>OI;^{bda+QUI5sBPuzS5x-1r z|BZQ&WS6B7s3>|$OTQFsp)`tGU^jWkDhJ>Vj8r1Uu@TVfH}^uf8`Pq$SCaHT)(e)I z`N@=uo68o;H!k~f!E!4ZNsLVmFS@k-Yzw49r5CY8zLt$#wrl+3T)9cVa?o&6(fbg! z6Lf$WPNd%x4=E$kYA~M}%PO1R!9LrC_3n!Hsy72a_v1rW7H$!{Huk^Ol4FPj7{H^_ zB~1(Y->78d*Ihn?sSIGY2S$h_n!9zK9o7_EM8I&z6a=JS7Umu{&TRC3pqF^s(D^Ux zu++Zg?lIngwD53^QXV4PlLBYSUw(0Ig>jyK6{hJLz7Xl{O5|wL+#%Mp#Y^I!SmiLn z_ip!Uka#^K;1|w0J7~- zvGq1GiBFy7=d20?;;cq=JY4l@#YfpVZ-R|=gMebC%{0)opZm~p`2#X$wN*0%C^@Mj z?tbiOX4 z9s)z(R;SQ^rLPGPWtDKA^7E`Woc(8a+5-w1h#n=wHxPq6*B|!Y-$iDNRk9_5+@A>l zO20VM(pP3am^c=eS=Tyu@M@`nv??1RTTJSE&NbER2YCDE(-=REfh`s8(w2Y!Jt}T0 zqWWtBb@KN^efLh}93ZiD*!@^TCjWFcvQHK26UKPA#-$VWR+>(DwP+qQpvdx>3k7dd zx3UoURa}9A9CZ!n8X93)G2=NQ>khm*tFxAP;5X$a-07kX!eo_V*=`-ig2c_hS;zS- ziHxSLY$~}WP9BYOgtqoaNi6N5ElHB(;||CV%{XYGS#H47lInngPq48VsCs{MM5PWptKDfuu>{UIkmjp`Sv=2 z1yF?L%;&vJz#8^SAB(_myMioDrVAo;)8+)_OdTap&QBuqrDNC13z~3&N0G|I%6!r) z!C?RyJ}@A`2^O^jSrA{&2`rToz{@=`$Cq^6(lGz}XvXi;cjXW4)(c7k-mhmUE=GEV zl&_^|{Y?US2L`t()bFzbgSx_)-<{%v0Z>ImHZba+(gLZjyfx7X#^*$ww~LQ<35EeA zk3K^H!^66{QUn9D`+}ziBs?yf*yZk)5PH|%G>!7MllbQu50^>R9}2BIYRZ4p$^Ka6q`fSOuK8onWqQT z&Ise$U?rBcj+|dd{fwDByywnEWw}-{RTUBd$4f&SFbFPPaqIB!rNpSNkQL1t!gl}D zd_dDFiPCpWDMTYhs>1RC>$o(hgv1zK;+!v)A~g-Hl5ve!!_YX?!wCL|U~l4R8ZMIz z38Q<}x9@E^Z+|If7}n1^g%&_jv47kVvq_hxnh=4fR+?P2o}V)v?46(k-*5`xI+Koq z)!$H?y|@X4jJ6%ev8a7taRsp&ok7Ke5quq=%S{jkJ6SH>5g1TDxPNpixUJdl<)A0B z`#`i(dnt6x23dDFifw4i7s^`6y1Jw$NDoA@Fra65j$C0u3!F7OKA4ovlTdwhO<;3- z#d@+Q;*cVOdTo{A7%}E#3$K&$ip+Gnf=FLWRyX8NGmmnaocse`O3x(iiEle>@z|SQ zhvl@iRvQm5Ge5tSwL^$?7b}GjsRxQ_-?Yd|q zoqZ7hG5j%9`cx=fuPlj7$Q_aL*HaMetOyxQL-LGgqpO z1NheBv|KKuPTt}ZHf~F=%cJy)^aOEh{ywL13IY}vVeAcnd85zUobq>i!s zj0~9FFi3Ob&{(*7C!VIR8zYy8`w8;O7*_SRjEotKcHBTt{fWDBNGSQM4oa=bRyX`-H(Y{ic{B{^Wnl&g z7;u^VKF{qA@V&vv$&VwZ^m2a!QIvI%(*sLq^1QJ`VKVyp_h~4p3`o}Jejt(zTXn;= z^;I$sLEF!K4GQGrJ4`qqrQtWH1O6QiumfewyZ5h$*`g>hcT(yjitxJ<|`uRuy zkHM^-Z-gULSNFgQdv}A1{l*Qc`&Xfi(bbxV)BC+v4mt53%~#mH65F1ynB7$MeHxOV zbOVpa&(uKYuPgc=V1a8~lK*WR`M>d&7?}S@e7RbCvgV-$ar@=BJ6O%V6aqsF#T>{v z_4zWAjz;^uM6)Qf$9H@WhO>y`<5eCpOC!Z2{o{!EXYvN!1M!aE9<6U#L?Q zp1T24tKzvWi`Af$tag^l!a)P*_Yd!lF~)DG*Cyc@%t_bNXLJ=l;}`kQ!al^0or_9m zg$B&BTV%H8BrX4*5;oYxD!<{9fyPfe2UkS#d7k0JO3wMvb~3AL!q>{}8yXtw=lk_! z=!}xPs@O)s**RuUtwfzP@qzY(_vVz$@ItTudpMunp-+Ts?EY*$9hWEa{kbyC%Dk+) z`{-~J!x?r-{N;4;uxkzZE4CX|(>(WJbIBwHmkHBWN)c5Imf~3ynbu1ax&}P^0L6K)|m0kNVa^NcN=|7 zL7|tZU4tl?DO@4eb*irsd9a>;Ec{MnIwDJ{R5Zx4VoUiXmh0k26DL!lVatp}B#K!W z2gqq_+GHmjV(yNZ<+f?#)T(tV65(uzf{Cw0xNj%-qEbe3b&8Db(DM!Z88rw>6);_$~3DS+1YP3gEd63meCp84=<8O^Ih0TZ=ppb zA7RtjRyL*@WK&2zeH3YIg(c5FGi7A@`eWQhKh6`C4v~kHGgTeQnh?lkQ8btqhkdl; zqiH%xSe;l3W^o;bcuI)HLvjKhp3aF7+7wF!4DJ~D0m0-3^*)c%D1PkFVsbAEHBnUH z^%qoRB0_!Ngs#$L1IRCbt)m1I(m6h@5F0t}m%O%cX^zNil;&Ch0)_?F3550Bp~|Qm z6?zR)&0|Cb+oxu54Sj!b{4o@9=w?yQ6rke>UZS z3IuOIPiomvE~=Pc1=(Ibqe01(s#NsyRw&5lMx-<@VNAKbGR&?y+YNb9bsI55Ro&fu z2eZ=^WwyXoHFh6NB(-@@@@g+9>9By+V^rGLP5Pd#c>+osDqaD4lC>SBAc6`(EgKNO ztvcAJ%siZYl&}a#LttWK;FktW&<)&NFhrFkLfEy`_f+U&rE0QVP=nFmD9eb)mLgBv*(L82!_(oQ8Zz95co}? zXqe2PvdPBa6x6^*dUCbdP@&2i5-ZZ*Z#y&~)hmD!e5fU*6%}|5WPu!s--kP0R8c-; ztL0st{<7AgO@f;~zO0~G88NKxWOV_cvzq@Dv)K{ho{gih&k9Hw!~E+Nruq}&b?wsL z7=9hkeN9#y7-0v*_FR>lTDQdX@ca~fxqd#e{U-gsxsDOLw3dQ|;VgmOV3#6uL@IZn zc@korQkjVgFB!7#aOF9bwtVJLT)5L>5kx-7BKa-AuP7RtX$XI6>O+#>^sQ}%9II`u zjOm~HYT)i%VIU$d*LWP!PUNE(tZlQd#F0`^>1Q%+$npM9DcC`L-b^r;JNYpw{ewda z2{K5HsF7J1Kjir)9mfWIdWzMjcqnJ}OD$s6m74jm>(IYV1S1|THdx&_ue@|7vA>T5 zzF6amp0Xs-v+}RwtLx)|q@su;W6T6Nt2WMG(2jZJxbmYlrkvFt$eBv&`q;-T4?IxORehdnKO{bs>{s{Ri+$SA4}FXwocyDP)E$M|CW z@hIauCqIbghFWb>xgDO}Txz}TzH#h6C}7Z;(hFeU4&;n6#bK>6Lgi_cv@>(eq{5xe z<)|8&+(9^f^R6)BQEVz7TI`C~KQNVO^L`=GCSp2DV_EOJ+)%yZ!Q>V`4?n$MOzv;F zk=N(r7i+Dj*F5t5Rw6h$Q|neN1!2Yj7u}%NCIEfEr+Xtj$t)lN?Noscm`}2J_JF3a zw~i?{4taCRD!73TR=x|jI`(=Za--w9x`O14tiMB2WgK@{e4|kp4Qg^T8WjP@i8*FA zkK8pVtX5@313*|?P2%KjxK?)1M1OnQ<>TpBjQfYw|2eFO)g6?<$erg`TGqqpbOufp z4^K3`w1+R(T4|H+gFLBm+4zid2_?-+9)xt{J$5lk=~#Hy?>%(=<_r?q#8K05xJ|vN zDdfs<{Si|FeS0&hF?#uzm5F%ZlPgK0b6si9t7Qh9%@@mbUD?q@I;EWO+0{i5c(1xp z(=%t{qYELk?`&U}vCjQ(Ks1i)o=gG~smN zTgtU*Y;JDzb=?$hVv*QzN5=Ql(OO#qab9K+WTitam>CYCJ8a9K5XDjAz+0m8n~yB@ zqP8I{56cu0iheMzLs83FuhpVRlM;)w!k&e$09Uf1j)R{>U(InB zO~cn*<=&7`raT*m8wz0-%A1<6g>M?&Be8LzvNWo#_{OKDy9XStp<@oB;Qo~8)td4a zF|Hm&iXI0@E*Ax5`b06O?8|MCW=_7L{~?DpD2G;iKQr@#Ok{OlKg-kdtHOIx#!EDIj7g8G|pT5PwTTKQ^*KNk~~TrP($_d>(`dWEl(whC(hX8@g#KZj=*bhyL)=%@{ff$d;G1$k# zZA)#ky^SnYkqs^|&q<)r9bf4EF^-ALK>BCg+h8H3vD$|QCxE!OXlHVbh(A;3qJHa* zQOK<=A$MnKwgj?_BfHk(S&kR2Qf~nzYn~78i@;1ND+B9=d1cV-)1Hb0WlHe}K9a zt6#9hn*6O5JsTBf_bdW!SFV4qx@5QdX;CtE2FDw@R0a@_y>*N7WxQmtsX$puZ2@5NugA-+j0R@l9$men1c zls+pjf)?U>&35|N3RhAeuOXfeTLpT^_J;l-HVOp|M*uYZt&ivWk?pvep02h`@6baW zI$+dJ&tybzNH7o_*c#M5DPoy-P@W6JCtFy;Y2V?>exTa7krI=VsNp?-HZPG(TA&VF z?|k>IncD+&^sMaI?yv_Dj7`vjs41YAK_4X1aM#i;TpgqkK{O2r_cKo2D6%Y^a^D`2 zl~hf?TwSqdewZV?E``w3s=}S@poXqMZIxE_<3uaJ zWHi&kKD;H8KMGoHo@>zT>bjN7L9rf7qj?9fdb{jD)gapp^5|luoh@3imlM3pg5ZgE z|GW#sLd@a3cUFg|TjSnCy$7E1f7Zl2p5FCs=T2(<-tmzeLlgeD z9f9Nj!enLQWcnZ0n*Vs}2ip+4|5Kq`z1IT}3J1sp=!jkPUyk}|Ql~U!Uw+XB2{d$% zv%L9uS|`eemY2w`PmeuxFuza3;bE*^4!`yvK>BaEpI-RcUSECRH&uNOZJvkEdmo*i zHa(I?bUHNKp`(wxTI$5sjS3DP_`$;(HC(>?WM=nkx*nvxhkT*LCus>pU&xrR^SiLG z9KO(Jx7Qu@nwt7r$XdJC_ngkK0Qc*QJ^ewmfWZn?(ckXe!m0K!`TLBFQCsbE*ReU+ z9IgpGQN-6}mIo;+N3DZ|oG^)tO}p2}7?_{$?@>|7e|*$`oE%ObC%&35wGxtcTwi-j zPezP(dVO-wDfxf8XcoAA-t6WRbuqku4ho_*n-YIZ!BYM7d_M#>2$uG{h4cSFb5MH$ z$cKLHMr>cK=c}&ywQ_CNSv~Nr1x|_;aN7)`F?@3jq@aM3d9B5XaY{NdsFYS$VXD(8 zomi-1lF&*88C-5kC>PF4xfm5k-&AQ?){hzZQE5WhfyNwr$)qHG5m}Gp`Kid{p=fum zjv}&^w%(IbuDcY_6D_+N6<9~oX0 z9=o^H=^}l$xewieUZ}5K3wsgFEwr9mhkp!bK^9K4$O)1INv+4)UooRQZ9OC79$8vO zmEdx-cUv|cq)x&wOk5I7&b}aq_l9<~f!ltq$YqXFUd@M}n*tNtO zk0>a{O^J`f(JFA_0K%NsO!Xv|E*eZhJ*J(MLAS5KH3S-Nkik5@^bS1hS(L8iaUCR~ zd>Hy{*9k^@DX!!r+PONS&`!lp>hf?MMtKB{5LZqhLY&17lv#(EK}PeK_!#-#=GbNo zd&)Yx9(ERWOgQwk+c%uz}#4hW!rJArjUc&wRd z>V^9sV ztASz-LR|1M(iKtCWzq+eAa`Z8sOS*61?^+^?L5Ypvy)c0fZRHzfW}HZCqEDZBav5G zjF&tXu#NF_!bZ{#hmy_F8x89Vsu+YFRbtTvB}TagLM%LL)i6d2J?KvQy_m&T{&k;+ zEV^SSCjiA{-wxY6=hw~isU;KO;IO>s@P?`Aq;pE~4#O-G--7YF zUZ!n&*HSQFbYKHkU8o%!7qBhJ@~{yW+`6pLP}tMU730q2(@m;41#}zt ze$QpE0UgE0lqmUojw=;n=w)@N#W=d}KVxh<`jSMB*=GC=O@ip5+Eg#Zz4?!zzldU# z%yS%`3;>+vh(SNNw6O+o1n-m?!^v(|$BY6hm-7oKj~&cnM}w*Y;|}X-gvrS1#B(9U zIuvlvzfvMNf$G@jcVA|ga71$hKBjK|jL6!51CFZ&q|RFTw59{Zhs6S z5(r6U_%eR+$P|Bq!>D9rNf%z|crVNLz?Wb<20R;|?YQ5KU?iw#LBT=R%>Xpe(Bugo zwr?xg9-Sgpa|%s_k`W?v`%@0BC6_WTd?#2ZoU5iYnq*9*h&6?oWn;0+4={s4GHfkI zvmA#6(x-W>(%?oE29S|Z33(u_mFrM~fwh!jTLZW+2;J z!j~9G7uiVXt)pP4GF>LRM*jN2)>vbkQluoA&b1-h_}r`7)M(x)UrNRs1|caUUP@~Z zWxtlQv#tV6sOKzD3;pVjC8XIcOts~?a*)nAB&!w$yr5t+#SkN255_^-xCeojbH3>3 zc}q7BPL~R%RARc!k5++mdF>JR2x=Q8_mGUvDZ{d<9N?XhxXaDD(G~xYr_sd0Mf9uy z+ReuO$)8fe{N{ZtC_I@8uVZ2CJv`w&p&2PBEgFQikq9#-hu$!=(y11w+U14YAqtm{ zG=!ZGtM0ur?*u1%_b?3Iu8l9BsQx_JnG)lRW*?8Fs6dM3YElOt?B*lo~C9=us z)J!~EcQeET<*$KpIQeD&im9D>s9#PwnQRj3MjZ)MX(1Q8cs=uA%`Z8sWnYLBo0QEw zX$#+LCO4QxsMa`*3@WbB92TJFY*SpQS;R{Ks5?lw`+tVtuM@5j9)d+c@rq0g znM&EWfb$kiG?imdS93XHrJTxH-T}5M;;EIW9AzlZ zMo*m7Cw#b=HJGUulMgEk)`G}P{$-U}amQvBlP-n6;phPVu^_wAiM{!3W;z_m?(nv_ zMvD^P`)upI22VMUvEUZU(?OM)F~9|4LwW|{3!IMvpsW(U*;^@X5ejW#e_gFVh37^f z|2|Upx-)nn;u30`C6wvWA;81gVA($n(Nv@-*i>g854FISg{7A)InaYlq#~&gMA65h z3iQ)DnOzYOn&4!FJXj;EFM35|H^o?cBx)AqLmxkg2gYf(4X+7?_{T0GjYDzynyMQ0 zP($8{TXhSf3X)W%I@9xdcBv84C&)9+aE4>)uTEtGNBsJEs!_^JF5ZWvr^4{CS*FVA zL`=d>P9+)#&Bc_&N(>GexnTEA$6l!b(G~0xl~A7yJOJtv zNN@%4-}rPALQb)SiC&~I1woEw0B<`vD!kr3WOv;&iM#USw)x-W@8&$^YuzQMxW#k% zM%`|bFf!0RLc)+)*fy-$83{cpRjjQ|XirCNxkf8K04C;=t&w1;F^T21g~c!e{+vJ$ zz0e%u?Fgh!!`3waPVW5v1K4&UbZB$;kKMwsRNOsGxfGV}f>q1FTQx`d635T7%4-BK z|K|93BYiSk#t5bwaSE4#5ov4Z)4IcwiN|wH!#c+aKcHx{@L>ipPW>N%1{PjSH>)xQ zK+~v(Aeeb2%+xywdK&(oTtj3~0JZbff5Fn~^%2D1KPbl~lL(vCP^dzCaWI#lsRU7Ws z2m4J?8(=VX8+)fcaD#V6gLP3o5ruNMoqsn~s!_S?&tZIDdvwliamP!pUV`wae8-8Z z#p&Ye>9P*Y;|D73YmJcB#Sdj0ToNU|&3Miz)dZCI4<2ONH%RIbj z9jEs7aw{)yu6Cv! zTxuNWYfs*vvC1_l3d=qLTJyG_12N^^T;92cBUyokD@8{GXz?djFn*U{NXZk-HjX3^CgV^tB|CeI}``aLP4n9%X zN|UD$1&|J~2J7f1h^9*C#g;x?b^nnd5m{i|S=ni4uUNOS5=2%$C@l3Wu!!obe3#PC z>ljKbX3sH(Ey*T!X~Q*X-&Uo3$eu_a!WHFCz3Spmx$9q(3X2uI#7S69?eDdX_It z@ijim-*4V_<{EBp1iw+(yDY2rMs{nst(<>0jm6qMp7FRMjE`og$IVK{pChofnf*69 z_|CG~zoYwITvVf`&%Ei;-{Vi+Qf#Xj(&aeTAG9t$*8fCdmARKMa#P1k*7Uz8T_Y1G z{C*r92xWX*9$$W=uw9?epp_evv)6w`GnFzFox5oZRX%*RxhfK79_V`uonbRveuv=~&>=@Gg=7%WFqw3C>i* z#$QG5ZF5crK0=HY?Q>CmdPB`^yD)kU9r!!h(d=kY8?&6~`~mqjQQWBZq&z@NILgOn-1;-d6yZvqj~j&GiBoozkK{YTEji@;n6SR^y>jq!YoC zS+A4GLL@7xEcTuuU8GLa=dp&j<^oRt^o>^#qEj+Z8j!j9%s)V7=6iy{kF;s${99ki z8`8E+*f(IUvl_6^;EqGX($*3HkClg04=Jb8Czenkow_y!C8?E#7k^gJ+R_aO>C%%y zqnwTHGrV6~A!RvS_6)I!p|xQKql`;axlHDrJNEiox6FO4S{II*GI?tO6jbG)ptIT< zAcOMTO^*0j6);=lmKHxlelxNN2fD#zIKu*$%cxSQVG2#o8A`4~cPnh>O0vqK22DV2?b*R>zA z0PqXaf~b;{-5z&^&>a#u<}}2p2EnKj2w!;MC4v-C%F};TE0=iO6?F#m2qn)^)D+%B z{|6WW^%n^s2AwgXz}&6%J4t)WR?5?Nmfo5;<4jW(Xa)9E4B%pT;&deE=8%Y1B-7z| zSjsYcfe@UJImQ4@Qg;0!=vC}>b}=w(K@DhOzsffyXy-vm18@Sj$u006WkW%2n^G3T5Str61MRk_#I|+W}Za-~FvWg^L zmBk?d)nBJO!h2?pfpc;&I1V7K0|NsBS$OP-$-)Xl=LDGN`h;fH$l8_j2JYdrd6PcA zBn{J^3WVcK<{IyF;;S5>h%!IwVWIR1%An}$?uBl9H&vuSP1ou?~g(baMG+%bu7d>|<;`V30no>oP zjR3o=r(J)b8bvcf?0K0QRrh#WhfW5mK?$y;$DGb1pV`DqVk^N*<{t-j8>Jhojm!odZ}mcT?Th`xShDf2*zQ9ushI7uzsa zcKr%Rw(6;N*M2dNqQQlvqUpyo)CntS#m6dI5SqaTN1f3Fy<9p3MMyf| z0Jh}{EaFSb36;EJJo$w-iW^1HZW+DInbs{VR8la`-P2^@Y_PB@{Z~Z6!MJX&GL%{& zw@jkC0rrnTyOs+CA#Z(U1GAjjaXeVZb7&0zx@AF(3*%E1f*b8@p&ot>=MRunQ#e(4 z9clIg_uRHePcd8Nmv+0hY9|#LUKS0#>i5EBt|YbaNhJ#$PpOl0w}cqHiVc-i4UXO) z8p(}ho65{vU>D=Y9w->$6$l+S-i~J1E>KmTpCa=->5-ewtV2E@JtEHqkpo@tO<}xw zUg_d89p)GPdqa1=`{l!n%1txHDB7*R#LN3P#e0>T=ibvXsVf9dGxx6bM{e{g6SQmG zIf$Y2b7b33(Kcsxp86#d(z59Hn%fI$qAb?o%=AvaY(^hM{STz?Bw2lB@3f|`Y<~18 zHFiNkU9`D%U=QbGSjIWL$|&~J=p9L#ORUV50UnEuJozN4r6wT;{E061Vp(seN(j zX}Dlr>)Hsq%*+OaZgf5)+6M<}0a5=LSnkllEsSP?9GBDf+S?^hO9IO_wK? zu!R_ZEYw0x(iqjeFp2z@q1hB(2Ke_SS9Xvq$lKU#(OG4i*rttE8~HI!Rp}GJZlf04 zt4P^g)N`}g+f$tsIhsO?^E)UbS<%ZaD8qQh9}76hTChw9C3VBb?_9)U-8hHk8`tt( z&OJMWQ1nNY77E8fqv$>^9)85QX~FR`if4{j-eE(EiVhR1-4>0*Aq!Q?v=-Z>h4R8J z=uc(z^!Rj^cl=zHYEB!C+aFsfkd5t2mN52OxvOJcyGkAk(yvmAz;s8(1m6Zcek8VY zq)!AM$n)#PKk!P)j($mTZaj`T0othm>8*J8{Ie3^=mbTK#QpK8NV z3y7p!pnPLEWoKKj(&p&ZQv-BVb2`c%g;6D3JImz5_QEVbd?8&3V<8yr4P1Kvr;XXc zeC{=gW>4dDc?RB8HNU)4G?W^;M2L_#U#9tRS`G1P&bnuk*HkDj%jb)<9ci!Cl?p5Lq zet$n|#A)*qx8(iR>$KNxp`8ANF=AJ?(-X)ATtk94k#SVDI>_$71H>9^Q4p8km-^%F0GDiO$8A3GN5cIND4o@BaPG zPjA?RFVwtl&HOoKtpt|~$PcDy%;43};y5c7tI00<&rLAC&!@ip`BQ7}C;YckocsT_ zxcr|OKFka(|AXOEtvw$5|LcJJFTDZ&zx0N~UQkYr7M9ehKXM*l@y+p~w6-7Oa|k5T z#tBtVl|&!^wY9u0rkc|+9#S4n9>m@6-yFUBxcywjP15(iN2w{RY3ln{rP5!KSMG~u zN`gDR-F>dAu6=wRJGa*gt_^Q_`z*0nPxwgQPAr`)FO#*>8_E9v0Y3OvAL8vPnXc-m z*yk7A-M;oOQW8!(I&}Iuun8{g;7)mRvuwvoxtFM!!mXH{)h({nZtzZF z8|ScO@{XU54n*RA8sJXuXD97yi)$*EvZ*bJiuB0XkFxCV={%3{?n;zBd_i^v-*jtK z=+x$sC9R!FhtLU)`Q=h zd#G2HYQ>^@G(?-uzdV=`JqNs#H7AFSOwZ45n#(&yv1$^r zj&uOtTQySexBg~5*hs2YwpK1=aNDVY;68Qu2QI5xETl_}N*k;ya<|4J z_N25EyoG30N5;4oNrY-8(aDl^5^XSG=EA1|Y?C1gk6lo9IFrN4PH;IJln(TOhl-k_ zgc^ov+QaCIXSe&-48thdc+g*rPkC->_8=e|6fI>la?FczRBo0m@M6wb(!*;^Ry-C+ zl@>YR*wi{|lsumT8AgT;4s58pZ+KQeHlJIFu{Nh$sFSkYx*}HSE$`$h1x=u@YHnz# zIO{&qKD1gY--+c`x-V0#R(q&SR)(rh52;!v1Bw!dSN~$0Mlx4rQNYhtfD%$ zfoS!mYr%MKRSi^lHDGAceW~E10W#h;tvQNfGE1Z5ZC9+*eukdRonnWm3KUjH(*rw70+shk!Y}!T*u_12OrK(oT~7{!jy1eb zZXnC}0%CNWJ8y?ky36OIfN|~MB#?U|aR4KVfGiSZA-Z9THu45=} zOYb!>f!Bs(MD$8$w1$YC1N@YvJ6n71&)M|B(s%f?B10R+8YR83Xp}a~)}zg_^pA_< z+z2TLyZUE#G+d;SLtF#P&ebH5?lROAjA`tbtB&Rn%q?^lx#T~qt46)k(P^j{jQ;|< z_mutN0;q~vi2M;#Ah*GBSr|6qdmVYPkZQrMc7_U=z)P4eY(-X?I;!q?N3lU>DP(qZLJ{k8l>~^fRN7d zhdMU{{E9aX>osNBj(T!T23rpxqoKdoP;LiPWyusR1ftIq_=W9ve3HDm_Rv^c(z-Fa zMO_=5Gj5r3U;)Q=(q8pDB=)%jC!7ckgs7#-^x2JmW)o{lKT)eNPgr7C#~VTg!Xyl~ z%p#wI9G2DkvikR|(+&{$J<3RE^HBq8r^_10VR^{DRMqk+IEqcHt^shQ9Q`lj(q-Oc zsCua4cPm(a#qj_za;13{FyU>s&-);@iu@2txU9CQ6PD=s6W4|61m77(erIq&U4C=Y z_kUXI%2`G8KG}QCv#KeXvbjaG$XBBI3IEXqu}UI0nrf}!s3)bgUvaW zna#STfSj}GY_>NylB~3TtlK7yppK!P#Uc66{3S3hDiRl zy%|%EvzBRdj6<>wP`U9{R&llXX5L6MU$5ua`m1;5{IuQ2CLE9Af=`%RN1aoaW+rQG zAgK=_=N2|0>0!3@^alkgCkZIsy5&$4c)`dQroq(W_jgxpR^c*(fNdUHqRLn8fu;CDOdn&LFewU@TZ|YN_qO z<|#3XvQif)3g+ua3b-@e-7(ARjCa3+-Z@}bjqOcCO&B&QhSvi9JI-sVwOJ}-{y-wV zN$|JQ-hF`Qd24@5G!@ebs&u%maNAc*=H zwOef`HU;j?SwJ*i!(jz-XsF?Nj_Jll{cb1aJ2XV2g825><(ofo7HGk;1Qn~5AZI-4 z7Se%alKOOI2Bhnh1V=kPyk&{Ys4Pe&kPP3dN^CM*Uj(7f=tvAUEp_n>wtu^I0udE{ z-Li15|1)R~584uK5Rj%#wSCsNw=W&>Z#|&edP`$V-fbPf*Pq7o$mv81%S^NLIh1Fm zizewV#oM<>Gd0jnA?j>+|dkwN~ldRv*5_>pX#5&t=Z3pRlGtn8uNB6 z`^%5O@2x@3IGf_w^j6xfI%uhJqpNQ|uVg=W^%eCKA|oq|6N}anESjL~G3_wdBLTU&D-D9+uQz>EXD1KbIf{z;eZVC#@eIw zqgo6N;Sny#{s@Y_bgLVpOR${4PY50~YJJXFWR=yXx?T6lJ#a|$7`4_H z%@C&j?1p6(fn$t_(yBl-W9y}hTwRqWufN~T_?cb}$DcO$pBd=K$wt`Hy0$K-K>XNq*qYyi|`vKv4 zEB{;QCN4EX00CSVr=;$-%2@O?pv~|s6!k_wGyuBxCr!h9e}{AE@EmQQ8&ULmiwlp4 zu%7&!iyy?gi7UyuIM9)jW=yM_R6om`b)^y2<7P40PGmWJQVGGwsCPCW>sBwXGAHYZ zsZYq`D=eS)qVxl-n!HY>$Z4+gWHWSrCe!C&8Xte%D63(qY3sL2@JLss3bSPja3^Px?NSpikL7aEeZOT6x?r zd3-y%{alEd!2j8&Ro5yAf4?{A@icYGQfxJKSlZU~=KQf!SU9k2VdrwGDW2Na`Yyjw zFFFCFsF3;WSmD|K&?k)fj0GHU?c+D2b|2qayj!|h*%(#N)Zo9m7oDZW7Pm2YX}(*> zR(5Ul|CV;YPuKVcZ0WkDHTO1pjW5hEpl(A`f%&`}Z;92zcx>*qVXvM%_nKI`zMjPN zXkR7{q8F2BCT4bAxEho(l)Tp!%|OivrL_5c+m-)u|8{PZwsTJTsm<O(E3=4XWWWu_Fr7(v%mCc&`4f+&=yaoET9Ds2KB5h!4i$w`Pi#{P z88*mC@~dyyabYcAnA)Hlb&xa8+ZbBVT?+0Gqto6~sgLe%EDN?P@qVNwmuJg1e;eW@ zShqAX+&JBVCMQ+lOa@_8UG5%5ccWb62L*s$Hm}yxF*Q_`7P9*=)8>zlA9vEvVFJ2% z?92h2__3&;!i8hPZfBPJgZOEzXSI=YGhg3&5!HATTMebD&)f|u##Vlp*R(QI@(i^{ zpn))+C285-UH5LrV96ih-f{07#p&E0ZsOU@@+K6){Tj@p0B(KTKGa)G!Ov28%roY& z&@n^IGx~$UPHV4(Pf7ry__`4uing^jmfM|Js-XJgAc$zNLAQvG#vwO$Q{3+q8AS30 z?YUz@Ao#XIh^=XAn-V}|hB>{O$(o?lBq0|!L9`I!L<9tJ!a!D@?89ij1J?}m`)UR~ z*Pp2+&ro{q*S86uzMz;l6(ixBsD zZ|^D2$+d%fi=IG)8Fi3Wezhh-%Djyzw_w;nZ|E}CwjXIRTJ!5=U}1!t|4kmw`K9y-iwIvSJxrby?J%Y7IXBqgbgh3_Yzf>k`=t*DjV8kZIm3)IkAmIi3P`8%O0TjAmeX`8%v z7`(${;8$ds^baKNgP3y>sfi{hoauHX@I~Z7sHxZiYfynqe&D0c)<;(ru>-mT?R8@$ zG8$o5Vc*ogh|^>bfy`TB)P&}%BS0OA{`~UNVYQ_-d**hA7B|zZuN8p+(Wz~oR^3=v z3>T}cLRNf%>KYD4*-8;X5|Ff5W46oqHI<%!k?!~^IowL3c|5^^m-N$q=yql{9{TBS z$4QX3cP}Xezkn;P-XA+-CzWfkuh8IPk=SYx9za&_%r^jgo9Fq1KxX9B;ZAu+r4Q-vwgGUMIh}eE&ac`^*709 zp(2v3d>Fe|Qc0A6K_x8pz4hRs_zNf>=5xp?J7Ewja&vPi+Z9E{O$mlb zP^Ldl{kYYT6H;yG8Nx79+~LhWS`f~F$a~ViI|^q)o5|i9U^4xZNgl29Z`7{$r*1@#K&-i1c#Ra1(A)+`a~wl+ z-Qrm;^N~Ym?D6}?x{v(?fQsGP)6%o&;%b^lV#zS#1XkY^mFh%{%kY(z$!S<$0WaB1 z^@P3+t*RP|B`wc5)&;Vk6OW@+%X-qk1-@%ziE-S)Z)$6>uW-7<=;{pZq<66BFeRz? z1Cw|w-q1NfAR#jxd)>l}mHFQVHc(!|tWehP1db;S9+6Wa*nWsm`0hmzMc96-^CWur z98@)C0+egfa%WuJim%AdTrVO{grljH;E#|2=wOa(%lA ze=4y^J)YG)9c#BpWwz8JeLW$QA>bmB#z++bxs3LG2U?jmB3*5>B4`t1p!UnHiCBid3ec17GHJ9kjp{ESU{xj4w(6!9hNwB-fd3T zfFAhb8XDj2#PBu5oiTt-vcOWV85R3izaPd2+jlbo?ISmv0_0KJut!-v#{l-vIgF~> z&4(KS9%_$l)+Az#OXYcnI}shm5A4T)TKV#x<2oumU54#thh3OkuA;h>u)E5he|TdN zmj~~@ppd=jN_$gHPvb2o zOAfanJ9=?(F>bC9v3f7VpyeGdqnRl}HSrzQPdynTGdIq+dx^Vt6IX?OvmoB9aK3M^ zO-C=S<;T+fSb#;HL-tO5KGXcVo$A-6nGF}W8o3avoLgN+mEWV(iH0y%>Z0(?j>8@y zq9fgOlGt*$)lgPs9e!h<>M9y&< zoXp9+3?FC>lWL4Sd?bo2_IP=FMEhLygl8sOR7_z~FA~xTbq(f)if%`7QDN}4M)VhVWHxBmXAMhD|M+5L=uCT^T8i~q~4a9s+%+QhKPsWIDB|pa6 zgX+fqN%?zAN5*`0Rn=gCB?Zxy3X9-*Ta!X@Ft-P`$^N6(qB$LHvtV+>NGUnO!$lfn zS|9C!YK>4)JDo}Hv<^WVm4RA|XsF^0~L<>-&_|3S?57k2Nb!7tLV-$X61AJ6*8=qPmg>k9R}^;bh7 zh}9JNiF1uZieVSoY9k}GCU@N0lr>vm@%6Lpf^t?W9>d@S zlI(9#6O&0?|$HBJ*&O}=PqzqipSz9&@MfaWp z9Frhh=-ohut||~G_C+_)UOUT;T*+@NH^N1yj{q&8-!~Q1tcgWLH({ymv64lc3ZjQ; z#*aF!s?109QbD4L$wgLJ*>PT}vM#A5$b>^+4W1`o<)bd3U`l*NPg=7R9Tga{!^sNT z8?;oqVao0HgU{O2$f;%!LSFAT(r0SFW=oX^^#mzQNZJoR#*)v_=O@IONN}Q1y{UA~ zF`{G!B?;il{>qPlKXt~9s$Y10+)EOLG8~mM&X0kAZ6~W-Z>% zqY_K5sbtcX(Bpc5^~^`dj=KqXPdJO7QAUH>VKBQmb&jF(l}oD0Z`4P;_Rral=i*ag zv(P#+kG`5s!^Y<2qb1zqob1zNOsJR1^MqK(rh2inY^@o9uB`b3HGn{ei92{8e{cca z*HX0N3eQ_|^zv{jCMM9*rd#^5L>Hp2OcNMMp6e~H6j*eRWEBu;YhLT{;EZLCPfuhU zpq7JmZ0zGWwYr!+nZ;j&WoU@}?em*ZaRJi5qFvz^=#-@&^fhMaa#^D#0XOwd-=1Rv zV#*?clG+01=th1wWEF#Rp6D2qx)ltF+%at`rfqDTbZ9#7J7ixzyi*3}fh-9X6fBXP zl{&#i62M5QPgHDzDd-a@4{9Dv$YKf%S!c0=7nDqG+5h3^@EL*Jj)*!68A|)AVoL?Y zI=5~}!SG~8FLfd;LZ=)VblG+UE5Fua4=4)4&n4uUHcwVfK1F1>j*|f`6d#sjU-$=U zpBuLe9E7`~MzjV@g+?BqhA%_eAq zpr-50=2uT3jvFpFnc?mqJDN)fV6d~tQ6mjBfKva|$*lpOz_SsK0h1qRsnFHQ)uXpX z8pTV(%witUd8n;4OBZxDA~1o)jK)-e5e4$h#?ev^Yw~>{ISBA-Tu-t@*VwMAXdUE+V zfZN|4aTzQpNKpL25x46mS!J6ed=a(Bl9(&&RfP4;<_JyZ-+TbPJib;aGQ2X;>HeqG zV3>f1nX!UzuvRU_n4Pgj{xbLj-FvD;Ej-ox@?@HjhP znE3oV=+Sq8%_0qOO1as`i1O|`;DFEGw%(6x(`|^>%FGbP*6o1$A#g9NI8ruS%ntJ0 zK~wZB7pY^Wl^UEEfZRympks|Oj_Qtuuin29_*$Fl%US*b=$%pS{xi)b;8ogRqLg{f z%rrx_))ZyL^T{=k5ALonJdAz;0clFm!yll{UF3wR{twGu*2$Z6OlCagLzY) zHP1z(RZ>WBUCeqj-b*9Tn{fyyJ-5f!IfEMXX6v1S7jJT0YK=%7YKge!*lC~PA7}5j zIipCNAPUz=Txr!$?|t&0%(C&StzgZq#m9P1i@R4IN~Bz9JnT<^A?s3@5#J1pb~B@0 z4~pu^)4ijRI#90h z+Pi&_t4$>_Q+rs?pl5x!qabA!k(03hScwbC<|tCKkJ|0}?W!i>t8iK-;T(Z2sz#=p z&mWzJTC1ef26|-1shK7LBXer;=RnlomQ!0o#Z85q8iM!zSxibC?u8EM2Z>B-m7@O0>gmnsbAvf10gsoA? zs-H|2dKz|`(?s9n#h5>|7qgoNLDh`PnW!ho!bT1S6xh3weHSSOhDocGmi`CXPvPU# z7nW;R8V2}AW5AUjWXU%qRIU)%VW~^|f(Ut67m*Kw&XESdo7G_7MQ{c&8grN=EY zkQUx3_qwDb)fgd7kbT6(YUZBW{gd+XUW*%Q%Oo16l}Po9C$nwOohmn5P^!+JDht8q zp+#aBWmTo;GmeAl4+cS&PN9mCu`^|9*?0Yw-DZ{4oqV~1`A;+l>~^2HHg2DgpmK0d*&|_BlG_>VQ&3D_sk=3$ez}}+pQb{Y^+v%16BL2&_DMKNk*r42#$6z z3hBhNSv(le<3#e%hGzGh@hIcx-%!5+9)?JJj4Fc!Y-^r@fScX-m-FwJnY|33R6g6| zR^)+`zn%~SDEQ!nX|?vRoj(tQOGoz0z}FE+=F27rJmC$ywmBuYqVF>i&o!Amh4J6$ zKlL0PuLGU~G2dUs9xL`_b%n6K3T{zoeZaP$j2@Eo3V79n-u zr>a*i<+?F9rBXdo!y|R9n5**@hM8$ybx5imx(7Qdj&EybZosQ}Jqv*MgvZhvY)h#B z`K0X9_S*NpDET*RcvzkiuX|u5+s0sejJTpA2VQc(t!Nk%!gqccKbbyjuY=Y+zh1ST zo>X>PbcapX-$G<9k%-T@xyry*GvbUEAg+=O3({oK9w|IB)P&_~`8f+pmq z!{><@^9CySi-SN&{jEB@z2Ky-64g3NLvpkUf&YD<0aC4_d9AsL&QxIAlfsOjlW}Z` zW0i&_u68qBCEwDVYoav+>zJ@f-##JOnE7bfncbS|_S{4Do&)cH{*}A8+4l&mi~0zMzk5Flp);D^&-9hc zxY^a^fHRDWLz6W=YX;Oai=VT{-()WvXY{YIxd$wZ(wB`V)ygR@I78}hWpjr4_v?hA zKciq2e>=ZcYG)r(V!$L4`#{}cN>l4qip=-cfX(vETuz_@0U#eLD|Cfdyl|_VaOZZq z=rW6Hi}he8!A{FZ&-^pZB|R&LyPJ5B@mJiA0x9z<`^cR3oJ{do6`SIgP=&N{9Ze3( zn-wyH6jK*5Zb_(=(@e`B@ipNvxRBvpJj=l6`1=-;b`2!05HOMjeE^MF>=pcGT)Qh~vK^T$Ep=TOe4W>Pkv~Yk{n5z+MS+dT2dQ^&Y zm{ezpZ@oVR$f!xbM;vS(GZ>Z%qVzDDyb|L{q@wR70a*G4>vhL~i< zE~&jTP}uf7`dRK274wXN;l}5R89>^nFJ@H9~Rm0bb1l-Y3w$;!IPAL zQzNb3^CA`b-8G)B%D7-zB~3DV@O)MY0%g5^S&t*gB|pe@bv#aLxFE+ShZ<_yotp4*=^N~chrEZm{;F{=oA zPq`|{$TzB?=g1P~x&RD4N;pf`Xel6+6~;g263sN%RN?p1)~N{W$H5`L*o%U#9#>~z z4PL%v9gcb|%tNKa0VsN`4WZIa&I2N0b-z&gBcB31=F7RtOhchhAXrBO|1f3f^51T* z=oO7~J*vohI>Op-XE*##rkHtgcA=p5saQ)M1y)ySwJj znaFcoTXl)xbf=}*H<0R*;hA&zwG_a(L-ob(dG51R(iKnE`l%KudE&1xo^|e2vR)$b zO97`2akQ|IwF|{g;aFSIm9=L4&Hxvk#T+umQ9~?Q_$K|J-R)&7!Z~R;|eaH`XhDlom>qw0EPlt#SoY zY;nkJVBql;x0&j)iB3rU#=1 z1E90d=~7tkZW+^PvctZlyM|WetddHglOnXH=AAS2Sf;POTru=;4;-y1QEA|!VFUTD zf}q|Od!C=vmU=#2{B~*E?lVC1z-YGLO!AUH5y~f&pCYX`)~d8>hDoO>Us6kb+&3ER z!u7E)PF#qmQodi6P$JJ|AupU?oJc${q!s-0R|tro;hHHRH;;lMcE#~?2Bo9DzulQ) z08i|!q6A%5Tk}(a)UF)or3uoxo_Ir%=`mpI8unqkp|HH#pCk6Bm=Cf;TPgrc)$0#* zyw5J!+6`RvH$iCX=T;`o$mFlKTGny<@^agj(H{g5#NdN+NAsR2lYd@_I-fT7yb2h_qbJL(ejPnB@-bILw|;&T2mSJw&oAK12Zi8eH4U{5Fh z(u|$zH$g7^E2rL9GBR?l7vGKc&3;m{JljSu@o38YsH#i88X385|T0cGAa-5bb zQ>t^0VRjVX5mEkjww0O24*1a9nHtfd)J%H`@Hq8C4t&H%-IN%{652@QoEWBs-}o`X zg>pUS+;8Sm77wgwxVrMHu1B;bPxm_8rhjC=iglI8a5YmAkIrjPpXNZ@#XgA97c<8L zABjw!w!l;#%p7x1cA0Ac9Uuur&weg9k-w4nL)TBLKLm2&>rhTSvVM;$V+~YomUbR6 zU%V(Qty9YqBF}1@NXYKRt6^#Q*PgXrj;X+auQ_mVe=Jb%NAoG8@+8+L5H_u#vT09F z{4a4aa}4|E3DY`;vB)k~0g~nX8_;&9UWjAM_eFFJqCAEw%9ljoqv?SSXZi=c&j(%q zffV?EBDw$05W>Rv_kWVylEzf^Wi#ymXAwLIe{b^jLkFD)+A8Ym$d9;-+>&Y#1-O09 z$CJy|bDB)2MUV;YzD8Qfp@?~XBHr9i00s2^=-S%bF2^L`U-KLU;NQK!?0u)$4CMTn zgCP{4;|1Gn*#2Uq+yjdxR%P?__JhMlTg9A8l3f8L*4_^42F6v#J8*cbzP zjLVFq_nP;eVqQS|SMj^E&cptZT)}+;ruT%qeL?RI5B&Q2oFwJf_sng~UI}s1-0{T? zk1~(Xmf3)5R(0gCMh^BLsHEh9hdJPAc83>0v^wQ7or)Ry?10ub| z(sXEFysnpkq*f#h+ZgxRftrijCZwmO;lxsR4o#SF8~;|%RxS|EW>cXLF9xHrnug+` z(@dI7A;JrjN~Q5-w5CdnWm(2X$OYrH)MzmYgZujNL1T7l3(N=E2&7^jHjYX1r*ZNNE5d0+JW zE6Fg7k9GI!Xhs-tF9qtIl)}Lg+c(i${Wh)bo&o@(*(o_N>X)5Myo8@eF^Yh!#QEBu z;;e})m%nTyxj?8X3Xh?b0H%^2ns^O^0` zCoo}4q)KD!8Rg`z12~#J>3XHcSdZtxxx6Ahxxu*1gTK%u1UBL3U6Nn_#2HFE@%E%C z#rn~vR}(_9cSvp3Z{zOJ!6%_SI{kQMBVupB-0M-&{THhRQ>Sx#fL4r@75-8HJ!P0E zdT9kR!j?~gP8dk}7z~(@e_J&V+F+1s2!DZy{CWTw&T|cktpW%duLfmRF+&XuMw;L% zN}3&0wqb9BU#suy9vm>RBQM&oXuYX!m9r|OJF5}epjJpiE^V+Ha%sXj0#dl7y)BsD zX0G*pA<%0Z1>nXP5{{+Xu5D?8ImUY$=fY7XJUf32o-3J&HJT4~&+#m!hvb!Ck1~03 z&7=L18!H+)Ajw%Vy4%$1$v{Ex_6~|nW!{K(88qy|eReM7*X7BaM{{b)t|G?2yGwe; zIh5wA0ID*f!BrZ|+C|StYY1e?yRoE*%6}~#^+Z=HEha)NJM8K+D4Qp`s0>Dw9Y9uE z!nsR5-KK<6w!AXG)`l0z1>tpq6ywGYmf3wpuT&eR!)2?J6K||Kd+_out<)=mb%b_(1c2{$e!CpEkxs(ao=eK(D>_ zK}tiC7QsZHTfH+D>z%;CHY zF@)Gv|BIZ;e~fB<3CVKHVf$Mn2Aeq_*c*Or6c00oFaC#n^OTqcsKk+d~k&h7PmY4(4C;=kbrEL@ew=cX@^u#hNW1%e(u=&uWEzp7 zZ9h3xq}DArp`p8>ILBu31Z<7cX~zH+2%~$S=wY4yxBZE z-!S_@6CY16B>*jM?3Nh06nc)$li4lA*;x-c32-M6E}3L+Bc4L2RQLor?6$@HN}z!W zQInZ0`Yang5N5?}R}xs0vo1^uy1wjp{z5UWov2i0YN=3?aI)7;5wY$`S7N>x5eu@^ z29h-F=a~m`zn~YW3z%YZ<}oHyIzBYZk68dyt_J>T>WX8;PUWU=IClvjFEm6XBVJf6 zQrUuH7|u>2$oZQ&apEuoS|6rO} zQ3wZtWN3!4{$;1>%3Z@;R_RIX3+tVOiy6W?X?%xIB!M3_;ru(ZY|Xe>IJ*$!gK333 zlfb6Pj1nZ)kzGanncbP|DTcS)ffNeZ)}BJ7jGXJqqEtAspx|S=stP4DTahC?^Q`}_ z9>=0~2wh4{3wbP_Xs}F|IRI?hI(-e_iI8UqgiXt8rb%fC=t)qLIyEdEp#-qjXt@ay0~)j(z0aWizuL~o!Ej8=LzmJor4Rynv6{DklBpD8|5 zOJ0w@n2jy0AV$hS)J$6LCR<~RFJakX=J<$%H;1uA^v;VX!PskS#&K>1;GU7{BU|NT zDz5odwg(C)MZY-!;9@K4d|gr=)*o*;2gLGj490f^hu)o-S1r#>53O6aTEo3rg3g%o zdfftRyWi_0=hx|j!2kGYg$_%P8Y;CHitOaU&zZBCllE+eu(rwV`4)#57vQD4U?GMz z(XkNOZ+DwyNSDzZp93*HQQxmE<%xLMTK-PQ`x}!`lhgjoyzXw4t2kEw-(25$_^MvP zdDU&@d0a&(byl{8!1XgtFUq*-cmwifm(U+Bmc5t9P9EPT+l%6~NyN^Va^A}Lgx{Xp z_tp7jE59RGomM#f-XseQR{Ufk3@#edrTs3x)nC~0Q+kSv`M2kKU8(I}7^^JHEC%E% zXZG_&J`kOXxz7voabA<*e%k+#95Iyi$^TJnHi;vsC|cs!z48|9&!u}I2E4w?Mfijy zG88yLm`L}rp3QHlKDp(5PXNJ04}~J_T?gQ0eSY{Je=p>GLx1m|;{ONaWn%cRqHjD49{oSN#^>*%Q!8lGMSb5fpf#!a4uS|up87FrW5C#bAL zL_B#o=V9LBKurKf>(8HHIk*BROZ$P(2%p=8p6{lPpIh$FH#%d4Ot$O6+iqBNz0~~! z0up3pxSI){?bi0KYW3F-<2LoDrNEed%GRD51y7QJ6R8lDYVL0DS-i*0gF)gc5vs>VDSx9#$ewj;tqiC#NI_(~kMXSTt z3F$QmR5z=c{51H_wI1f-S96ZKI_~N}#|YB`Zm2hu1;Yd0qQgF_ktNZD@%a?#zLO*#GNePLnYTpKcv+V8 zKw7DRf${##b^l8KL{cXrIA|5c4++b&d5~E^?%5{(g0`alVX_@&8%|5U>39i5-<@ir z7%I%sNtuERNiAf89J@Al-03QKQU@+ZH1B`hqqCbmmU6B2g~wdC?!J6DOOYrUVk}8h z;e58K7V9Pu3lYA0VWIVJ=x%nlbo2L(m2a?lWA92yrl04D-I@ZBog@^?X;>6@EWt2Z zt&6hakI1MEzVL33XkTGW3i=o*asfu=={ zgHR*N`(v7=6K5Uw^SN+yO(a$9yB--@4b4c@EXUQ}BmhcK4N1v$Ne7UV)qvOs>Zc=x zBXOu2xPK|%ZDtkKk=%kY@Fta*?%5l+{WP0uVG25olx0611z;63})=#NxtH zNO}0wWtm85{?t2(Nsw;*Xfj+90tf6x6%u=>H;+>rPo32bfOIIX;kloh3>;hg>tM0x z+_%%lXZ@XA_?t`P1gDuqEBWLU{yBGvY?W?dxQtN1w>Yg_;FOho6FOo|8*(^c9445Q zzg?cI<;Dw{>r-}?yto7Rx!B|O zddBvJ>eAkyOtN=Dp-v^h-P6#LG};bIlf5A^;#C<<5V|vNMc|RGM=XlW#;lJla)4H} z@n*V9Q$`{)-jNke2PGB-I;d-K_en_DDf(kv1V3 zIW|%R<6iq@KGO9MJ$H4oy!m5cF;>$9%%!pQf^0g5f+lDA2+4KlFQ4b%8I3C$*)a&K z#-4xhA$n=f)3p|)PG{@UpZttDW*KN46%PtKd)$4u&UTb=I*416-x@+ajr-Ft5B{g{} zj(==8%Hgr>wd6m!d#^JN?>iod;9tE+sAyN(uT{+CED`DJEo;W49${_PlF)8dLyiQRK!V3xPyAWxlyeQRs`EZDb5bjPO zvZ9ZVc8-3_^*Eb<)TU~KRj2e)_@P{~l|m?A1>c;t1ttg(HC-S-%Vx=PJbY39CL!h7 z0O@;QoYj=Q+%)3J=*hbh_;H1+(V^?&hSaskCke4c!7=CkOowmaA--tbk$>R!`5HI>_(4Jj=c8|LZx5iy zFaEH(-9>->v~c?R_e~EvlO(LroS|n1Y0~}lLt7;OxJ?>A#wW9_U7Jq5*Qri(>Ro@o zsucomWvxWypAeP3+n!B~^nmW}$QJTn>^#$Q_r>9P95H*cxI8?f;^|2@WgwE@2z$$5 zOIN4iH75pU`B-W&eJ7pua8b5K!=j;R38s=@D3dSxY2IOnipn-)H?|^l>^7~^87%#8 z_2koO9%}Ifg&dvPgqA3?V!6Co_H@3Zc2#1FJd3@HvC$e~W#!jJnxd|fNyWH<1Csq^$}<-c2H zdNI^lOF3akM8J47mAqACCEsXNm+>aj*EU@AY?+RKt_?b zLu<#!PkrInKKEaDdi=f#D3ZXoz`&xus$6Q2ti)smsi3B>2HD91-gH3tQGaJ}e(o^e zm`tYE$h3#~z9hThR2xAFmIFL@!s&7#GpGo1$sWgD#Z0(Pcsn7T_=l8K2J$9nqH6PW z=jQpV?6AW<;pz6rZfCkK&m_zch91&oduq;0fpkhJPcPhHIi?`sG6`MZJe z=0ib?c{~Dya+Q%HPxwc?S#$Q5dqpe*&V!rTdXAkrXW-WD;|9?9)-aP8k?Y?|W$&vw z#HTu;rtq5#q{9!cOJSj{qtF@S{qZy!5hcZLy)VBZTPJ@El;uX*0;E!C05XRz)Zme3${t=EA25^IoR{391JBgFNE3mu=o@qc+|3ey^A&Vh3tkmbfY8*0dZ*J>)TfJq%)s z91=xA7$@dM{bm}c>d*8Z<}jFeOb_qH*!|#w9YAf3;3~O!bLql@=7uP`(=J0jn8!N} zrQ&VGnQB;uEKUrD97PZ-R>HG7sfCmnBGG3*{#~V-S;#C2F4^8{yGcF~)zycptOSyp z;T+4o*_(Y6i_guZ>Gzulq!V>%Sa0~jhF0_bBXEdeH23CX31Ksa(q| zq{td!GtSq{AlrnNIoKm9^!NL{W!_+=$j^?9MZUY7PWGBhxUO(RFYVdTkG>kBVe|YO zd2u_81%+qc{UtnfUiMVpR*3{j1jp$dB7y`FX2?Ns5$t@78lodF$+sGT4J^+;kCPuK z0cuYn2pgjWDnJQ2Moj~PJ?MUoB6e7mM7Pa1K9jvzZVlIFfECWG74lLv5bX#j{#y%S4UT;m zZ%tyTfmKzi1dJ2J_vKv;PqAF{PDsF>@UuDT(TaUKoEB|%_zqSLoagcXF!oMCwgp_e zW!gSz+j-KqZQHhO+qP}nCvDrdoq4mmZg+G={15fGBKFH#4?Dh?b9{4@U1+}O@1pc# zXcOouPsRe9l0@b$XPj3zL`5f@>PzNR->?`*Z6!a0z-xr9SHkBsG3XZA!>&5$27lH@ zLUvjP!oHxJE$2VCj9cx5VQ4a5<{3`PSXmoFp_o~p81eFFapnX0XUo)*C_pB7pMsSd zrm3Z@v=2?(ZkO0Fu*Pk`HOX*DnFy4$IB`$$4|>W2jAzt~FoET*z~BcMF=?tZ&|B3} zP9&OrmJ#-l&s@|@P>G+Ui1^i2VnG%g(v{NULZn%)VNGC3P~9AZYV^lyIC0Xwp6)Iu zE(5NQ{S0=K9i%tqXL9ghDiq8twnigOPH613_=D!dFSZ({PXrK8Gl*4%AT36xA}y*~ zYzQ|gZ1@mvm{@lvUU61xZ4~>l*4NM)SzjZ2w|CUZw^~aHrafSS;&Fyg@&)tq^SxV- z@Nl^{m!Tmatxc~-AxE(4VV!U3Zp5I!*QCf7p0@qWUM=1cfL&c9Hw8i%Jt#V#AZwV! zU&S;WUMa$O`kTF!4PJ}Thl{yXCE!4{qy=5tAXE}@PHx4VXP&+69$IS_vHwNvho@+& zCQ~^y!@GF^O(0}3Y(|4s5Q2zKd_B(*>X+Y4WP>R*mNn>m&E|%@N)L#08n|`^8aVa= z5i-&D8FCql{nax1aOf!42LXX3gyGt1G-nX^*cjeCLYsZS482SUbVt940&sw%cyssC zZq9P^!i2m_!Mi!vsK)pbu$1o^1)}rydO%F`C-0zWiv%|q+?DkcuovA;*v|O3abIXDYnzs_u|D@5wHZ z7|PH6ASK|&-hJ2ZvN^OqV~mQKk5m|%B*`IK-&#!TEK+L2k;hcAbEm&DOrH4C!Rj~5 zBOkPrF-&xFz}T01sL7Vh<@T&S+24k9x(M`^by|BaaWwZfJhnW~qUtO*$c5asUIqK% z`A)L$wI*ES*>?u_ez;?*STNL-J36}I@nE~8@($^ppqZbee+>LqwP@2N&Ld&K2js>^ zhXTYYSpIxtNN~=;*iMcgFU%&Ir-dK2G(>--&(&Usgn!xKkX_l37_y@|}ppA#~ z=WK=d3r&GSDegZ6KIZ@3td50_@qf(fusUll+UjRiPr<8hr4i}0K*UhRTF1@;kQ1nj z$51CZ%4)X9ZM1@JB%coz zpK&A7Vtc)>{nvZ9gA600ygnh8?sm@bj?uo{`xoreFMe(r7rXPf)Cg4`Wq!Z)@MC7Q zAL1K(w=|Yv^UBAC-5TI)Kooyo>E@aua#73`H(lW(M~u5`O6>2qrxh7-z1-wJt-~xI zJJ%VliL`rrf6JJc@X+6OI7gCV$ItrHJZ#5@Y)ax4#^-mj;=f0axYv)Jt)0%?nc`{A zY0qLl-mpc$_U(28!kIQ>4a|}$kQc3Ia zP#T_!T4+}? zx@JQ%*p!^GflJnuc> z!l5I^hdih)2^kB@uA{tG=vA+BY-i^D&#DtgZ?Vp1Re!2wI-x_0D{nY5EG{O0b&lJ zO>W!)JOJXE8|tf>Kgzn0CjQvl5jYOJJ+>c>FcDBIVOYP%-EF=!ytUg`BQnO=DAVzS zHo6&BLmmuGUGI%tFR~GyTAk?(AfC1dkR$PkK^Wdi*s#KH7#YuPCvS>0zB=GQ#C8Sp z_f>yHl?@aj>l2HYrocp#PnLHtNhIC{l1cX)wNYE11E~d>M&b%-x7uKDayY7-@gKAU z!Ti{$O6_JR9iWUi^JlUsnkk@%lm{D`;x;^>&?exG@0)*)R1ZCR6R8&qw;0L?Pg>lw&?4;OOyPsEB zi12xvdSQTxK~eX&&I~#Px&Imj@FCt%5Gh;N48asz*kk}Y|R4NBzj*_U%OP&lTcHB(^}yC@<4GL6TY4KxcV>>Xu?LVN}|pcZNl->L2U$R77#8 zP?_KhysTuZhW*l~P%O2cv8D-;B;jV=q9>(&bh-n%7XQcF|&;%v*Y>o?;W+$wpS zd~MZP+vh{MQ7Hb4zPP6!Ul#|7((EKH<~cYBxdcCNj8>K9kL6r^%RhJk*qbt9B#`y8R}D6I;ZiL30Yhjw`!Y#;wc6PvSqlmn&FcDRFlX( z)AKT4(ekIv@OJl^P`SiWAH}ZK)jgh8=meXKO+MMDZ-Ef%u(rzGCLKq~Iwamh5sv5!V|UI{ za;F96NnsaxY7}H6^YNN z+m6P@;2SOeI-V(02*gu+dl9dlrOlT+j{{A<|uu!2|0@vspEo`n3CT@gaIE(LTzqZjq)p zUcX^5=*QZQCvPp|x)$aD6=!P5M00&};c#d_Hl{v>IKao5215UbZ+(KSrK~X0+T*bc zRtb(_0YyI~%@kaQeN9*0dG61xn7cLS2;P}gBrvU_u5@`m4noVhXD#02tS72DPBjsb zIkv#eyfZ7{IMa6JTBa>Z;h^#i^JsA4gk|ii70z+0*MwoYIPmYJcF1KiACGcFH~dj@ zLwB)k{`;{cX~)XWx{#Z5d8&9H_l&!%v6DlUz`o*L*%(M#Twte^DOE}*@Ak7#LVV4e z#jn2p@1|fdUW$>y(1+6YgJ;#}+n-1;O_Y!MU6VH*^|}i^cp^CYv}gp$Z~43Pyahpt zSnKihF7zkW19x@77=Esex`m1tP4|m2+(r0v&Kx5zlA7yO)Uuys>9tVO&i9SQH#UQw z>v-mvBb0?oo`p0ndUzUFp^`AIoP)-Z9hm4K8z8jJjN_L`5mf z3#m2>)00{I8!oy6;Vo;X4TbM;&BoCqv-4KQ<~vrVhQ@&C#M!irN3$>8^&wwYOP49k zhUYlkT^81ByPJje6WP)>TQQhT9{9h~KS=84RGC=k2~E>(8Pq*O^Pbz%POcrCaRMgq zbWGnNSGk1b>Izk(HVL>KeN(TQ6-es0_Mgm*Ml;}Ls!;%c63q;}vUO!a-q;K?(s?|B zRhaPb5rXMR!(tw==lxa!doM!63t5Q%tq!7ch_KkL7F**08;lzQQ%Q z*Mv`F0N_X^5ysilTllln&l~&?s8VqF;D1P*EdRU2$;kdc5@+%6U84VXFMI-D&1s^_ z-4gPd_+65=|89rxEq~PuMu|J{!U{-74$i78y8|nK)r-U;4)afOztJD_c5`tHFbu>F zl0u$b(O*Gpc5ttKzvw?78~<-X+8zdPJyvCyKT{r@@pJXtS@GE?H#_75F==b-@}V%N zIpBk5FK%ombVBhM-cZ^nk*t*cF4DVrgv&SBGPk*t;I|&_imL|vDE^}=6THXbD_;zNt+Ol}G=z#xaFfQjK`=&f`Z-@7rhYk8T z5;bZf<)Klg)uNfQyywQQ+DVsb{`+cV!JG1hH)O744F0F`x-uaQJ72p^UFcb z?5)^dcHlf6f+1K-nG?=E)#ns@6fJm25j+M-RIXKc<(gz)l_dG&!C99znLr<|(8r<= z+qS&_BM6`GRA5Q8wL7W@_Tk*tFaE-wk2cB3-rlbQNu}so9OBxI<`GN6F{;xzX?6E8 z>foX>9vQDbSsiY3F&D${+!G~>_ zo62^+o-_|9s_2;maxb{EZk@bqc*p%z4rN_T4U%|!BZ|jx$f9UA#gMfrG?#J4krp5K zxdLeGhKI{*Navy{X|cczJr=rO#Aey4o~aEg-Lx+rh&fu+WTd9MH##AFuXKqviJI%x zR~0XFV$ma3?-TLx&;I~(O-O2J{s3Zin3LwpYjCPeq>6Z&)6MgKc0@fTuuf>$L!)q}M1_Pa-))2x-q?gBi9bXvV`sbnt|-m_htJYOhetgl$ILvd zlfY9VYdTswX*Y1=F>(W z49wF+!`x}8B~RY5dZM74f_i}2ys?9KY^l$M(2KvZ*xMR%gfwUPp_S1UCgA1(KRJ^j z!1@O?@b|KaKZR>sEwefCp^pLkXw;zw@$XD8%K5YLX>+rn4rg+r3FtIX5xedT9?uad z0TW^eRKx+fAC3U{9$Bv31F^&=?-zC`lZUC?QIbfq6#Ht%)NPhbi}|CUVfYV|a` zAHZ5UAw70)EKY-Ju)5Ix`;T_o0g3Kl6$eVjtu`omvo-kYee_2Vc))2-<4kv7vDbN| zwe}x{in>+Jif0Rj{1Ih|Xvb0!$t@CU0(+5?cNuYD8}GTS`QD&0)Yy*=)4W1s-AHVuVxU9RpQJW!oJ}-I|g3 z**^*QMakK*5qc_mgrJ1bt*II9!U!>)2@(+`6`>W0mMq=DHHoL_1!b3-YKpy=sxr|4 zvNx~EMNKc|uZg1}a>L+H#WY9H_Z0dhmBxtz42eF$cQs3mezw|Dim}LN`>%!UG$m)G zKrfeFZ1i~VnEK@IPy7u9mRRKMP4;Q4SO)o|u!GWR#SALlO!G&9Ow>Yh73M$TA7P|7 zq(=IRUL(2%fSVp8+93JTFVlD#?!3-n>&wTxoQD`*33X5CG{_Ayw?m)vuAQ;Pj)*bk z0%Cx;>&v@MO2zjLwmq{LoUBA?9vO+Jgb?ap;^0TCn|a3tIMa(gP)-B4j%{+S9u_u1(}c{O{*IhjHUeubh(N%GNHJL_CIB~Z3JZ(sngn|~ zI!@*V5z_8=K(=D2@o{aHL={}G-OtRDt@G^)>w}OAu@bwrtz`ys$~A#W6Vd4zCt=bY zByBQgHKIv+x}6$meM(rIQAYD5Xv~fdm1_oAp@lo*;?sR& zqPeY7S2lVkQ+qrT+8v+bR_GSQ#j56nwioFqxv@GY; zB(X^=iXX})EbCW@wd@Qy&<0g5ZR2*3Y2{mel#EJdaI(Csln;vCs9+vV6)0rbF4|Sh z!u{xrRcP3O0^x+s4SL6ocB(`dGSW}|=Hf`}nZqaK$M%(V+j77&+`x+m%C49J3$ z+N@*~$DM!rNjTRRpA?hep*IDuDyeUg+s@)Laod^eW$estlJtmxUcxm{W1~}EtC$x| zB1uPbttRk8S2pmsSLd>M0+Tj{^+{PRQnbDHa2}V0a`Oc&)7fJ~q!yYz=RTY3Jg5v) zEGil@4^^{L`VbTCLb&QfYVhPp(@Kw2S7;j=*cGqtzBH0Re;(~TFy>?lg62b7q%Rb+$Pr!KP(Jc7y~N$a=*G28w+aK(idaX)IU1rB+P-9Gn0tQ$nv zyEaQ&-;b93AFU)2gcSEg#Tq`E zuLA?TJ!~PA*?@S=U)>{|AcRqL6$%uLqhS9i3X%z_b0~#`#*bVJZa^3 zsHG5D!$bW<7l7(6_5y!h0btl zSdrG~4{FRam23HS>$%0kU*%7v16#rM-Ipb40IZnWMhSlN}O^bs? z3`m~z4fmH#JA|4=5WAeB#;4K<#H}AIy=DTA9Z|0g_h0#q`WSXj^8LHEwdJNZoeS4#d)A+Amcr!jd1b2sMcS2Z3)VUr-r=yeYP&r zo&Dd_o;*dX#2+xp#bJ5B%{)iWINf&AwEZ6j2lb9^2D1Kx0%F}YSi$h zhywiV>f@c^+hxX*KjpK$ujWhpBUO(fIK&2FW6D)8OxG`lp4=Z*nUT4}Vc4HimFsK0 z=;{|cA9%=^OGn{79{PdkJiD!j7&;@Yhto+V9^OQ2Xw z5#|w>Rox5iDpQqEAEI@{opTupfSVMSa;AmPza@^FEKxHA(pL$*jU{uC;KO2@JS>vn zeIw%k4n@T5faEhP?FJ!i+78aH?usHIL!_dyo`Te!s?-Rl>bX_Rv(H(kqaC>09cECB z(kwA zqKy%$nw?OHJIkS8A*CJyNE|B-RE)2s<)jc~$W<8_-T~1VQx#KzkDYvzz~5zik^-QJ zu*p07rHm+pr=^!YX(s5S(R$VN^oTa7i^!kkqDEgTX0WH*L_9qxbd`UM2XFJ^) z0&G1jc2XlV)*5jt3NGY{NIQ=|J848->@ykpF-0C0Xh-1P4H0k*oCOB}sO*~Fus!bv zcMV|Un+`GKJQU1q(IP=jp;OwpBePo1zld2`VI`8u1LAOzC9mI{b_7aXr;DH1Eg2=qNm@u; z+L_Hf=VkI#Joz>K=2>UssQgzw4sxv|3we9-s>T86!mQ`y7*Z>xO=*%Z!U-|dYtvb` z5SLM(ah^l_q;sd=fvhl^W+ZE~6+#i^5M>c)`Mc+B+W3r;^bq1;j02uZrGi>mk$c9K zq?U5!JKgl;bp)4NUsNA6NYL7L=yDY-NILy|SPj=LJDryXS}=$@U(`_PB66!7Ll>d0 zqG|^c3=J5fV<|x&HtKkSxK*CLfQcf6x0RxkMZVqVXd3)lAlwU$)=bnlLw0^u&R60U zw{NR&>xnlB{){ocvJ4TDV?n22fJ4dc~tjMV0Sas~t9A#p%IB+DWb{MmAKW|wT4nRE_1<}~Cd zG)ShmqqsTy1l!?UBBB0qyM5*t%K?bV>-@v4wT$Kt^rMuVQxzzZ@Y91A zRxDT za|H%PtLPs96`l?4(d>eB{+EL;)yEP;#pT8HX)=YuWQRcdlVSk2r~Wmv5gs zB_m(KIgx{Jk?Y58J}Rzb7o=WDJKH;>3j9Gjz-uLX2kY%f#1f}trOCA0zQuPVyatzpRr?HBBrrQA!8M2$1e31t{+n0cGS0pkZJ1PhE z>c;hbF|=#89Z8H;TRd*o%8vQ_k<7#}PhG<<7tnFU;GC1_Hdu=;4%G}Q9E{fz&9#co z6!SeEh+g@YeTAkK3jJ&?Vc-5hi1W>;G#dNfcAoZ9f24FPeLPj$|EvNU(c!iVfK_tu zLCq4eNrz~ZPJ|A0kd_u{+F7qm}>Ui)7#dO?g{t;_LpdRGi2+p^5zNT zAi=)7Kre;L3~(%d(`32yw!gpo9KeFBnbOP2i_hR9%5sG9oT5B?RyIwv+A542Dx8Tq z=!6e*k=EXLO+fvZa&&;b?w>v)F`NFs%B58!O}~Fp+m1YOBzttzE0=xSX}wA-L*m;B zsTM?`{>YhG1{V?~AD@Sa+?&1?QQLTRg{9&p*OX@2y*tv0RIV27=;o?>_B-~zT{oj| z=g}A*lw9F5n_V`5;;MG1krrxl2+J|OKBFJx7=^=xQFX_a8*-=5VgGi-VG^X7cxHo` zvq|?O+fYC2kR9R=w6(?*rD-6ftXc$ixx%O~H5z7w_O1!|A~$+@b*4*1HPsbv4YzntmGN^3N@pj zIBf^q*ZM_(X1i9CT~Vk4S+N@l#mr5?VGQFU$zv@zK`SN})=#C-P7=oo#oE6N2Vjj^ zpV{YaDyEiVw3NKbs^S=o`emKuiY;foohc4Dr5ibd96ru;CoNaj_s46Dsg{moY~2*QoWsi#Qbx+0rKTjbk^W@DhZ^?YLVwMqp??E}hijNMnv-5(~A7X>PA%q-12K z+?iiaKO|kR^jbgbTR->oUvJ=ykkec*2JfpSiF8u-tdL_t$qOU*v5cxK7s8QtJJhO` zJ!!Axe*;24I7(F+cx*X*{x8mH=zDiN=rI#}_u<*L{NFg|imIFUf8(4_dklN(0Nf<%TtP;@J-;|AljIC|RLilaA#G#ov~a98gj_6@K)-F*Ol9NYS8(jaJ2#1-__id-(gYH4ieoz4=Tteo}&cfqBpOw;JhUu z2*=@Q7VW+hPmVdAU0vcLmz>gM*$<&IOII6GezDS{UVlbI5358iAON1Vvk(0@pe~>^ zo_%K^05q~%@geVp*oXFg*@{i0YMKQU_FR-Sa+&mRe32hIBb(dOUoH+dcY(!!VuE4*5IWPe8P??7{hxq^%@%_tSY<$C_ z4pdq^v6Pebm z?5`_XXzDJZMhckVHg02Bb!G_AYR`Vsa!#TJ=K=sKwaw{M{-)&_VCn|810ewQk8mD6 za0JP~r5Z|!1{kcup^PmA5y)*YCK2k;Cd$V+kj79_i;H{^1MHMtnVv(K(r%4d%o^J4 zCIL{J3qf|7WQrJREjT|XWc;GDRJ`*z9*^+BunxhKHF>KO`KogQP85()DjkC;rEDZ(2 zEy2&0zBgyXxP|o$6-$DE7Kt?oe4tg0iE9!2^QCAcX+`}Spz(4WklTELU0lbsq#Hk~ zLlDYqAl;`Os3p*P=5PCTo`Kq1s`KnzJN}WKc+DA+$)@b|-j;^XRS#F~t>jQm8$e#O zPhh{wJ4(9Q3!ozY5`ASMBezg7q zWBAJ~+Hk8#nafB!<)S?_U!|cs^v+gT|5-yFx&z~i^fIozEU*Z+tWP+2!k(Ws1z;R= zp?bF8`;D^s_y>TpRV4C%u~&XyZR+EUr$A}(l?Ui>Bxxh#oj!>OS>4)2UMzp-UoDw% zdyfJFGx7s9r1`MojvDx=F@KBal$&B;T-Sk{EHe~Zj+|R_Ch(GD!=d(;f#{wkvyBvH z$-s-<(q&su1H5-kSHMEmWi-CF1q;lxEX-QS=L+n>) zVUS_)vJ?4?K*4A)FZ`>Lup8Q&C31a|Y2a!UYL*?fDr6lv4jrT`y#bpblryo21{}?m zxih3PO6rgBsUW&P2x$s(jT!OA4U3Y2NTQ2(R20@~51}6cnOas=u&5{EzE>7wIsf(X zNO9R-lyoz17G=w9qdw%3PppZh_)mnADkEk=UVVaZ6S36Z7>|5NfZWB^Ii7U49B-~v zi5vl&j->W3FbJuR3|iNH`LT)W{xwoSYQ>$l0%@lit?+CUE=L}u^FNXfU_}h@Iwj+o zLIkCh#cV=zg`a63jbiL0?!*Dv-!necBz~-CWvER^)#R#B8q18dj~7qWN9>uy`rMWu z65N$xD(C9(Mp!A0VOBQ_X-&YGiN{!GQs=4`l5V+>?LsMhgwt47A9+wKbm-IqP2^C+ zx+Nj|om<&Q2u7oEoE08KPsHY?jx&IcKRb-lQkE%~GJn*?tTcBbm9a<45<*x>C`N>$ z3oWfIi&X9gB#1H*eOftzDy%heh+&982i#Ss!WB^}H&tcLKm~6im0<71mpj!ZdPJYy zZl1BY2h0P71=K;-pSM$up1ZoEQ)Cj?lnO<~bt2VwoAIQ4(1sTQgjEw`fPI)zC;*_# zM<-r27~*k1d3!Zc7Eo9@yUZ1JqT%(3%Y`=AV0YZTHjk0NO@O91?DpE^_ZnL5a%su- z20MbiA}=l~U5R z8?d}j+5CqHgo~v~gVN`g#yjiZmndxK=Z2m&ymVUo}85 z@mY-;i%GR-{=h)xSQGU|KOc1gXkpC8TGmFiP!dnhely?22Fd3n_6)eb~Y zLN{#bZlSS%*0O!yvA^G0x$Rgyj^A$E;m~SC$1eMZN2AesZhqeN?me=RLmw>Cv=)n6 zW4-oarX!&R4L-Umt`g1&i&lNs{yrzl@=~|H+IN0~jWF0hAzm|Y+%m)N++S@7aqV2} z&EBdPnJ*Ouz?_wMx*s=qC*a-P+ihUmY96^@WjV)jhY`-J3g%GNkJ?9Da@7*nIJTEG zk}-UKJlq5(ZkoW>i>7)qc-s2kpHD0s6V zH&v{)435de2Lq!ooaH$)l14y)3yiXs!_UNtI}L#R%Z(PK#Ts1KK^mi!Db!)``!OCc zh5D94OC)YpP~w`D(mF>Ovr3bm7IpvTyL$0BfcZx zl~Rd+9XgXpLX3eMrK>N6yFLI~vzy7cW%lQ=WIuvUErA3kv;na|d2lK>B85kKAo##| z_$Tf)A-pO2+$iPP2-1??$Q2h<4HPUImKA1*&5J~9N#cW!l*n8>b7yaDpjleX)o^i|Qm{OvuvXqPrQl z0756}U~^#}WF;a9(X1BK;&S^MbLH!#CW7I4J?kZvmEG=Ce9L}2Qg9`3EBK+D$aQ_s z4Zw}~Zc^Z!kgkhxgR~(9%?$IqS}#l}RDG(Y`{Kf5dZTtc-#Q?J7d4FBQnDR=?;&p} zKZzCBwfYfqg^4`@5ec(mSFf>0fGu4}}1S)?uL# zA+%31|B5HDgK zE;ou#rFCXjxOi(N6CiqQlrNa^nh~PE7)Iw;D*B!BZ{0xFBZ4#sKAQ=4dhT}iW5BSw z2@=kMIi1xQYI{1XS4|=4K#wQRpF@&B+nH+xa$J$r{C4y~3))^r!XJYr^7SW0Vx=-( z=uFCKAkG*JkENm{A|8^|`4s2`ut`9_amKTZCz9Uc?X;(*f;>&1)wP~&FVWH)wKSdj zq(D8nDWbMj%`;0BO%!*|KsF4KlZd8$;_si=@+#Q0(JcbKC!4n32QV#7!*Sc{1Jy)y~nq3_ozo<5G31vX&F z9#kz-4oPwbcLw|ePaTEVKK6oYn0TOID{xX^6wokiIyT2;)45J4PL9?ISLJ-)i z$B(}oht3RP7qMut5YhLs$Tcvei^Bp{@Fhj*4t;rxMxN@MvBfmI$z~` z2$IeAjM|h4FIw8NQ&LnRHBmxAmSb+@uEWSlC`uK0&Gf$xd9~vLB1kOHN-cwr=}j#t znVX30Dv24m$}?i0Fm<&}Y05L%^!~x`(DA%z9H2md-5-Ni$JNyqlo(vVW~~0;Fk4LT zmy2-c4mrlJ%SAm|k@@xp6To7zJGQ0fhQ4K zFoJ-*jWCyLn!w=(HrH)wHrE6}=DdTHkY!8UZ2`SoAXVnQag??1s3|_N8PoMLDz5vY zmZQ87flMadev}dwt&`!$xpp|NCeeCNY$3M0C|A&ouzVpCwZsJyD7a{Y_*!mu`8Dt2A^N=U$2tL4Njd%Vxr#1Ej^*383yN<{y= zyNnF%tp76+P1GE+z-`T_zJf~>wo>Qq3j3vlnXHU$fvPLDUs@#ydocF$A`6QrUENpz zsyF!uty8POg%v^%?{L1+7xDLUF#~V|Vhy4OKRKDa{4Z9vzCvU7a(`R`69~u4LSmiU z$jPE$0_O$XxxKi2dL$e>rB(X9pXRAu9M0sWB?i1P>cvY>mP-CE2xDb$7fstoJQ}1w z7@qSEHcO4`*jLF;v0CIz+%m;e8WL&25&mAwZvW=KSTi z2YbD&Q*T~5N_LF&>w}^MKLv|deS2R8iuKWZo91z(k~kIlT@8*T zcd`BS>I_rL!f9jACEPhktS7AJUEm*;XS&nY_K|^qsXLO{C;S{MOe^;V*tO?6{(l1% zZOMDF%nhvc$qm^imkE`ikk7~pB8}w77y5f`>jCt~q6nHtabwu_Kjt9?e}(VwAYy01 zCwa%K4g`{s-Gaj@4LMVLkb}t*3kkE1=k&*IL;qx;2xgOX#sUHIoYr0&5N6M*aj%;< z@ZlZXbe9A$eNFV~P$jd~#9{?1Za8rnsM2@+vuus<@e$D}0r(=tMU5jqrIM$YVjq;2 zTyt~!o4kz3m2W^3Q;4_*l69WlEQ6o#aAHr0bX87ugSy9t<)7Tx$_xV=tl$M-<5oP? z1$CfGM_iePL?y&Gr2C-O1$q;xLN)ywt+oltJ=XsM{uvLx{$=;DnS3nAk`Mu9RC1-n z;l-V}Vfi^21r)IOWtRnQoO}C0>lm@xcAd6yO1jbOgBgDrhnIok-IH0=tSZkk5P#*WoJ%!(oA6nsuonQ*jr3EHeQ9R6V=KF9n{N&||z z{$#iM2c&1o^IWb_S_=BD$H!=%PhP8tYsEshl zO1|_70zBudYf%VS5WjvebdU_XPR>>bSS_dxd{Ej)niZo`>}mxHS7DtC<&%ff;&SEY z{AJH5is?}j?15`6f<%=?`+K&p9%fk&;;Io)X$t5>ZC?_R2}8T^hO&;>$DdV^Ut*10 z+167b)Len2A=$8lmZfGcLJf1T6{FyZ(f%=6Y~ZzK)~qu+@%OIIY4e{F6YJ2ywr7j6 zC8A!o`E_*br~+?;1z2%rBxS?ZA#-IY8kaVj+Z8FaC2=-(cE2G2-8yvbKe+j#2iLX_ zC~H0Hqq9X|AbjGf@)RWyX^e^{>NNWqgy%X?RwT^nl7cYaf$>td^xc!%zOg@M3~-AD zg5pw%Kw27nlsSPV%l3(vd;NOBH158*J895_vRXXclHAFhp#}B_N{+(9tN+foHqT%q zhy_7&VqheVQ8uA?n_B!p-&!jc-lWBQHXa3pJ&AGk+ELOD5^RxfO5ZEIP~g~svWIQQ z!myz&Q0lCpVL2RIhXk#}K^l#_5|o#ctsyNSn|U`rv7vNnr8w7TY{P*S2G}RW^OOi7 z47m^dEfi%zue?_y>HA<*!16`!^`w`w!e1K_)blM`@hMerN@VB?QRW#bt^S?Y2Sd)} z$@g@)0&?E8*z6I2O|mTH>bUj7{~d(QQ-fWo=8 z9WP=LL`{xlczx*{TvurN)gWI^l%7H2y`cV?0Dd$zllw?c98=(I)K8wn2ItT-FHfEGA0Y6K@SKfM&}HnYbOMwerO+(YWa6MlNJ$Q- zn}tP=Mmzs1tkz9WOMJMpQ$-?x9ENgBk(5ctlB8$u3;L0$oCG?HM9^L`qFqMinbWe$ zznkS7%%{Ur7OiW@%VdE1j*U|$1Uk*LxETXWfw(Fc6q7E#v57I$VhFg_;SpA%)lhXX z#T0z$=94i;540BA;0xyX6|LG+INLSJy@!UI`rt~du|GK+>eA#jWTy{eWv?8v;JwOF!HDR4J2yq z_H9tUoEz*9F&%qBwaxQV`=|7q98m6V=&o*FtPq{$ES7-~8r?aQ>q%#s+67-eBu83);T;YIOgO$uyabY3L0hYKLMcH4 z@*t8-K~qW~^9b|{$jR_3(G_K%;nUb+2U0l+SkA{%R$PWUVGL{ZEoLXc+sB-zh_(EP z(+>>usq%tZdI5+ozSIr}ie=`dL1GPodG!QB4O%^1%6=X)yVI95 z_$`bRlrLj4RL>ny5XOclx-{ZLImMfzV5Ece+5*VexUFzJIQwLyj8PKtlG?c*K@l^h zl|eL5n5^&f%-j~IXdQ?9#=aZ{;=DhGlowgI1Yd8V@&=b-ew}MFtv?$%lCuhY)BpO* zn6iI@W!wKBLkZy2M#+E3Pi+6Y8V3`@|B&1*X>i64vLIdGsGh>B?PU_`l|jTo$NhEP zz^PH&P{=3}%lP~v3S~TuE9l9x(OYu2^17yCK25h$ym909A+fL^kZ>IGT7TC$U_52v z2bSeT0j#UUN33f%-u0p;6aqB|u%ZMym3tooL-l2y&@b(gsKK*+6`bKQi6y)-%%8T-(j(XGuuo1|bTg|n-^ z7bm)h-IDYDH9c9X))Y8!i# z#zyeEn<9{bMl5)=4ti(f@d?MHAlB<;YyCfryYN+ox>Xwr$&| zY}>YOy*(2#w`2N4|A`$d_LI5t6675>0z%g6UQ*~e-V3S^A^0|0nc@8YVIXOM0CeI3 zL~8Q9h>QfHeSt=!J#TGUZ8e}stf+W6EeDWmZmWJ=gTWyVfvTRb0S*k}&etq>x^dy7 zkkRCTa^|v6dF!noH>#CQNM%jvpyCge(o6BY3w6wMyrgYe!Y2q`YfrPh|NZS4t=2#Q z1D6E1nzFqzlOhK{rH*S{A}J{7G)dy%$1$5~efsRv1iN87}X4!YHRITNSnaAZXD}hsb>>Ipd#h+JZ%{Ou?&eGV z(3*2hd8}b#z2(#v<%oj@2U85Rj{GE@)`gZ8;zJcLuaMzD2y_q}BoPa8aeND*5K4C+ zw7$}KHL&|h!0-k9a@&pM3cRs_9w8b%@^>*^$2^HM;~~(*ieT7jV)CCDysWH2`i7zJfPa# zUnxzJi-65Itite5Yli~q9&`Do@FTOj<8mbMBQu1@Q#z)JMsd85jHc<$Ql0(xlil3r zgKJl^1}P~=G4zviEya|Q&b*yY5-*D2(LLoO8sM*rhnNbLKH5>$9oAmafYA$F>kt4Xb1j+=5P zxwP`O`IYjD7b*DM0@@7T>kDm2T?Fb;uH$P{7~lz1pY-jhAVfq`pk%@gXX@7$1p%3g z>fk1RJL(N6{GsgnN*IV`;&6QI)bxP;PGc~X$X`9oNAjTOwoK5eI=328r|19(JIbTr zrYi$7wR2HbO5+?75FZ1S8K%IKs;Px^!y~kEiS znaYt!{MErXWWyq^wBI5gH|5T*iTT72C?M&uSp~kr8yN^LxcxZUwwkmL-Ygd;1tE=T@slHUu zD{ztAnyBTj*sx(M(U_>dWM09;+p-qjJf21@3^Oa&P4t%BOI43!8aPzbl(9Ov{!^B* zi&3O2Xgio0N-3x#8_bf(=}t&`D#bD~WsVeuTx40aDSo@Mk}OVr0veAR$;au#&?)@H z+|ue^=MGKt4xh*G6Maf6vlHS3cUt1@d(WNW$4Oj0Y#t9%Q$p;+5-m4fysMht?*qRI zKC8z63E=*BJr7pa|Na4{_5Ym&P21@I?hOJY0y<_E*$Kd<&>SUjOljZ06Gm#q7g)P= zn#Jvg`mQlbpjv%c8p!p^S{HodXTs!0xej$$ybbfcj_dtK!~9;;zCY1f7$k9Atbe0n z&`QGcOboJV#|xte_-a(wFPX;QJr-1|9!h(}oebwUmBC`%-rL3)j-B@XgY*VBZsKR=eMspc=R5g>S0IiGkOz##}*nMiTpwtj}$lBgX9j;g9ht3r8Y#; z4{o5p1jp^OH0=dS#&P|-N)kQlQ}g2N1`GT1`FcSTY?h0d(;n`0KC;S= zGy7EQh{HsbwAMcL4*RWJms*TO#X}#ma$p~>(Qo$j1Ux!PJ4Gh(;;uUsUe>2QKnA#z zMa0ti(I&XE9j1tp_hc%oBqr3f6I^0POL!~4Hl5?UsCZg}%3|zJiK;*Y&ZM-zR#Z$I+CEGCsIiz9JCOC2Q&8P}iufX& z(Mk4OXPLY#=4$hh)}$*y^kOOm&)FS?K=ZyAmWt3+K2NnhZ`}pTcx>TI%t+5 zb7jp~px%~eE;SD@EDtr){1)Muy=d(DB@rD{}iR!QSAJE4UZsV6|K z)m5ZSI8|i~1Vvn?$2>lFF}YRiM}F@2MRUhrueM>E%>^&elX~&O8V0K9nYuw(01fo{ zb|E*fB+X6xc7CH@f12!?5dzv3Sz)RW3#-(JT%)``K%P4dx~Hr%Gmt;SQ$|=h{l$49 zc8jjkPc`zK8GdcK)M5+5^FPRf#g9jObxdo!#84EP1X1j&)-KLo`UDKeXmHUC0KY{> zaD#hlhw6al>;7OJ@s@i%dkSYiaeTF4F~Ad(4b9c&D&XJ?KzNpYO_!M5J3(F#*)tQ` za1&I~YR5Uk(Mh)9h?Ul(jDVZKVX5`vzf75uWR_(iowZTi95Jn0+h?cqK}BN~SViw^ zk6e-JXwBPfbf4d45NdZ*{oa>}=hUzn$Frjb+zeAPX9nV0BLzlE#fT=%XwZP-4 zx$vniM{Zoko+f}$i7f|JPUGI>GhAQv8h6i#Vws|?*hTl#lip)8CV94DF*I?e1z&3R zLG=-m5Er0+W^YEyhxJnRmx{IipKm>!8wEY!-*g#e1yk<;i}Lx#UaxPa6HLk{$>NuG z#}>A@KB7;N10UA!drLOH`_tjh(l=itDsM1}zQf>9fp5)ugkI z5`+BVUAExxNFbYVWbX#MT8I2P{nzMzJ0GjtHWRP-DW;*~nnZgieuRy39s8_XW^|oG z-O+dQ3-3~Vi<&aOh^f}vhI2zmeMZ5ylD))=mFn=JCArWV#0TO#J@cEAZf-z`K<&SD z$T5o5+l6BA%=TIqnRP_U&OYly%218z_vnFbUZ)*k(-f0A05^~~_P9js0zm7@u zPF?x3o-XGakKtJ+z8c@(-oZA|!e(X7GJ9F1lry5kI?-s*VjyVd$lH&Fg|kom{>@S9 zEYe>@o^AUEq=u3buV2&7<+{{l*viDuU`zKCyGiB))SE&mo!+=aGFs5&Jknj-X&QHK zB9$fNLBphkkRd?(*+F&|b7G3qJb4qW(|kzF4l()H^MJ@{c)ND2=a6}LGi=3=ShHxM_-GH#wHTHwP9G4LWbT^6>L zv+bGa(=ZxvI{tQ(bwT$bUlNr%<~x#J<-6D#d;oPwqj(aF`Pzn#sN*(TAIB@r6-M^;pqZ!6>N; z&n8eE)Jj0EosLLX3X5}jSOHgB_ovb$W#2OR@{f~3aF&e4;`i_7Bm9tD`1bN(Bg9xB z*Y}&L%@EGZBserlh&38&;1ow`qU=y=JvmvEt0p@zrFS=EzL@BW`)*ihj{7SH%Lg7i za4G0w0579>o*!R-!J!UfwH93TjP`K4U|prSw{#rziDZi`_IWzGPABIHV^L8LB7{(v zRE~!OCl3b?h#p5wIO!5%VnAlu{*0~eg=>YPkEY(ZsdNC+Z!#Fjy!|K zg{I5o+}TGuC$b+e(y#Jv~1l$qx9oDN;>Am(w<(Y|PvfX~E}?SGsVCYAZ-;Vn>SYIU2bHO2?J zKJn`dt)j7Ch&_}xiUrzB7j&s%>oY-5yBVy_zps!r>=bHFEAk2Q|AZ#;Z5GFOa`rzHu2c`g~IE%Rfh@LJ zoAy7$es_s}Usg_E4=1;Sv7Wou&Qo`LPPla1u?cJbk@46J-n`#;{fAGS)YrBD@f9}0 z*}YAr_tGJIlMZ~S1Zy2f#u0rY*}67H^3k|?V_)}vtS~w~0UF7?zGLEmUaqW9{dO`5q%}kHdH2hHTldQVss`TdH$aj|jt;dD50hjq=jI>wwxkag0_| ztKQ4a^}|hi+;5zRW|Nei-SjaoKT5v8*w=IG+GdaXnmnn=nSWX_NV1(D^lQku9Q!=c z12dT_Bgf?X@p}EZeQ-^gJN(7g3f^zD%@sKlp(-yBS z$O~@o@0uRxVC9d&^RtxuZ#`MTed)FG)-fdz(U;tNcO+&)dhqwvXd!Y*HiN45V$yC( z-5GND`Rri)zOBU`yl|oQ;_YP}7PXSm_#H;Zt@#~BX4IXn(9K+taU49QL!NV-PlWR{ z^fp-gu|4$z`-JT^o_h0Y0tew+?!BX*VJ85Qim?v6A6#W21Z-;yvt{phv`?DY&WeLj zm}-)b+w`3-N!vY6sW-3Rz-|;ktAd^|*q)i9XcFS6CjfMKqDQaF318~P_&RkvcdNR! zqNgGooQ3~UbnjGVdQlI5aZnG+MMUcl8vfAF%FtOB6AZC5|EF2S6Z#yJ%bB~ zRxUsLI&URPj4L29uvhLbbniisYAeiJW~r7DjrWYdyR-a)8W6K-xAF*>TeDH?g$|3=(ejuVId!;c|G?s6l(z%<4zj(CJqR*cFZvwO9`i z&?7yni=p`wKiw2GS>UtnPB!~{C)GMcNJZLy9?HP4a`3Z?Xm9J`5sPimc!;&AwnV;K z(E=p~Jcc}Q*JC5Yb`6P;q$5fU?P133oF;Oo=`948^egqBJ?-uXp0gUfPiqqa2ZhL` zPY52>HStd>rZ+%4iaYEt;8A~#mc&qj@RCJxU2}&Z8zkvss5q^`I@EZ`H4bl$NC=M+ zy`*6aD~k^=)=r(%{S@fWxe3_3sqLzFwM1;pR|Vmrz5Jx{g13blgj{RJY6%B0(dR@ z^rkKAVyaxc7$6i8y^7a#M==U!!npLs9-8XO3bHWJn-WN3A9#`1RL#&4Jvlq%30@yl zB4Rfvqu!qy+*>|)3_D=$aS8q$19-kqbMTV|@I4^dihcwD=Ru?CFj8BFP; zIvgKwu6kqQ!iS8~2c#_|EdxO^=6(zkKq-h)0#|IMg9uDo5*2!l7vX7|s;Qqou}NX* z(R2uKY~rC}LsA~j8!?bhU-DK&%d8^m@#z2L2ZJ|7&*t8edL+71$^tmWlq|7|9Sn91 zJUbIhw$$bPC!)0z7oR)l$%C-6^+msP$(0en+cQx`C*JnYNu;hwH5!o!U@^`Ti~HvO zoOZ+#;lelbZ)<0W#)oyf>)ZnLMs++R?RXLQoFgS7mJN>BhEz!VUY2Ou6q5uA2$Lr` zW>2#q71=-<*EHHdu9KOf8hi z21T>XHBHNo)M0;f*1d2#6^gC{HR>!`bGV)LhFrB#RR^4=D@q$iSm=)*QweTPmie3yQlYeGRIF+{Pzv^9b(OsD zTvpX_TlxySJrbr7y+muRfMxMw%aU%ll}N@`;=}f#3zEIis%7`$r)<#w z5H$LSbU3=xMUgtbSGz>IOvnKn(KNY{KL|mGN%+RRN$ufhrC5t}nR1Sh&O@SAg5(<} zO+wRrn>(2H@Ykn8CYnMr9X9}p%BjP@s2AwFrh#N_9kfT3`A=i8L0xmuJh~Xm*yj4lB@Jb4k2wdAyMwu48Pt zEL77D+X{)RrE>ISNt{5iusoeaSYDGwW~$dK0q50;pIsDEDgT2oU~)Cp);q^@!Z|nh zXkTP<=E|Ft37?2J7hO-iKde}8FV}9?X4tVu5#3;w!NMBkE^k)wN%Ku@W|@?o zA@t+2z2(WrG6s`=x5Plz6+-aC>^B|SJ1ASG?`-W+PkuF=rK%5XFY+3jcbZ1XIM4O~cnB z4Uf(-5<65^SDf)6?UJC~L%6PwmEQ!wDtu;3xg)n9dl7j}dqFW;y_48<-6pA+r_~%w zQK4ZY?sf_2i-Q#pxvI_LFR@ra=66enm7#X|wP%KXafg)2FZQ%CieKAn|Q{YhH)Vd;NXrc&|RAG~Ds*`)GdU3R7d^RuDL(5Gfuskl0d0&brP= z>di#UE>H<^nMl2T3XO&A@KJLq0B(v($SwoYdd*y(aS0nLiSL36L=ft5VN)>oz zA@uzw5yFrR*2`s-zA%FEXRV! zhE@Ea-G7{tW@|$gSw*q6dW9ORNo7rKUAD}*Vb|tP&>9NR>LgFm3nf3{ttqq5<$xHd z^yBo;dTR`{b&6J*D;$iwc!gz|In*m^%p&;eLj8D2&I!$9M{jYKSLdJ%F`DmNe700#h zOBdcUDhqwMQH{y8%el;XfKGu_r_1hQY|Dd2SH+p*F!Jcp>ZGTgR<`{R?ILV%1}-Ud z%-Wm>;C~qIsSK@3N}`j|CS)cYX5E5GQ9k%vqg`60HWbwR-xIoych=sS~VT_ zVO^1bdd4e=G>VGOa?)G-4fEnPi6UL}4j(T_$m72c50?&gvV^iy^yVXT=bv)7zUXfj za(_(8DUT@%vbI~#WY#sH`6O7RN=sfwd+7vsY}JSte4GSpk1ZbxyCmbUt^TS}@!65V zxA#z1-=}i3>k|8@qkB&sq&iotS`pqvjH7Wf>ag}y1zFaH-Q`cjbD3u0 zJA;M`wQ$R7Ipe0?qTPinqj*2-aA6U{wAj4up)7Lhp5t+4|NQv6Nt_G!(Ir1dI=NIC zkvh^GR^DEArgiU?O8Z!OQQ}Dcs9mTss$2M}$oiz2ztJN**t8BT+4;%-=J@IgW$g6) zIw-w9vBUh&^&96kbI~a-$DiKr9rW4q@OXE@yV}$a_+F3_)c71?hbojCGBholRM91B zoM8V@-*gYdFSU|-zhd3rkU>zng_qD<*4WJ%n*-a3ee3b~@AYbWtR#@*LZ*x`Sh)Da z2H7F8j+=lRa2PBNlS4`hqN;P6GwmNVR3aNP#W5A-qwd0cPI*<+Fzf)q0|cTH4c0Za zfE2uW(qNE4fUpH~tDl zkR#I*qWdyFzBD#kV&5vCCQ677$5x}b{Nzy};o@NbIl4Qua*5Cyij zC4hizqOydSDN;SfV&JEb(piEwXOfJISUJhkd`UBKh4)NhhAQvgvUu-3K(#s-<#6#-OUPFgj&g9ja~o=nq_!_b1Lr1`*fw zXH;-)#6t7nU3@iErum&!tA8bc;L?m|0OE$w@@0@EmoEF5(}~6=m@NsN6qgR*qd<`k z6Vk&95cnkqF~&CI7ipkj4UGuP|1#$SOTegyna3V5Phj-`9zYpgyRQ^{&RkqymNI2b z@HXs=M~zd-+E!W$u2!-{b~9>cjPNGNSi}=<>pYo=ac&w6ev+^$zlx&$^q~OQv{uv* z&THBNyVlz;fPZaAAfkY;Amo8+)hIslowa`dLqzlCq4G;3W2Hk~xs=j3>;xx~?H3-V?Ci5n!!qQ5#)-W`t{F z8X3ij4oRE>;u~C20(-|PO!bBif|mr;-Q-@h=0npUnCT!I)%A1QOP%#0^`(w`iY`)m zi=~RCPIkhDh++?!^o@(=0KuRbsYxzS8D$)UfO% zuo}^a%k1_l+&lo(!PMRhojW$qJUuG zwlZqv2b%#vrB@OV>m?FCXGX|BQesf#TRgdP=9eX@mn~Xqt2X0!Fd0=pjyz4Z5wj6Z zXt7Nxqv=Oy*8I}?h^%N|#fDVVe1ND6z39xb9u;Ig`w}{Uks%oOzR<5~L7PiXyV(sO>gzqNGF-Ai|cCnzCATM+QqRul! z`x}f5*cc)@E1;q#4zaoF)mqn46ArKfreUE$j2SXWx%4NFbuj7qMbk%3F8_~YZNzb9 z_dRRnI4d0Yr>TvXI`%d^A*x?x;Cok+`kC2>Z*Ej-jiwLNG@dg#cFts@Z$4bZfrWrQ zVN8T-_Sp7S5n=l)ErPXPYS9T!_PThs7@o2P^VVVwjN>qK90rVKhc-6@k>|OM{-yul zhA{<>p1B!u2_Prl7N-}7ohe)$4Hb(jGOe?bujblsPiy8sBCa5k@&$HfnMkozT-V!D zEK0|)(Ga@!OR6&1DDLplDWDF(*1B!&$7GQ0*>BJFrsV-8ka`xP#J|c^pJ>OIMC;jA z^5S$3x@kC`mbE3-_3?!e=`SjQY}roQKbFq#>qq(fzA9+coMpGpKu40r;so}4J$m^q zP_E^2*w8UtFG}_-LQ0@|fC5^C8d>?!r<<19^8xbA~C}- zon12x%Yv;>hC#SdcdMCp&qY!L*5$<{d+mtnSzT}?^V(Gh5+ZGn-)zqU{I0rKfNl~H zwYb{7bB~s;slcR!1ushgY$S{teLxuyj1o+4xJ4nG#gb@u*3;z)Zo{+kUKs8x$nPoJ zW`bm5rm4B0OLjc+LWAu_9*GQ8OLK9=uhJSB%Yc#n1E0G$cQcG6;oiyE4A9oI=S~ z)X$vlk94pWkn1|??38ihT|xZl_z5$*Z4)S2Rt^sGdmRx5mH6@ZoFCSWdEud5D!rRd ziF->6vFG5UyuD7kcyad1uL*A)^f@jR5eX~(LUV!id4SWhx+C|JbsH5c0Q9jS16dKcbVS!XF>ZrNZhRHD00 zM#DGGox`{3;C<4VoQjvK3C()N$h!Uje!n99UPv8P`(?)^LNzG)IFild6P7;wB z7oOL3yXqv=T{ojr-Ftbk)@q5(hAz9U+6W7$L&u&vzigkEVaC4Vbbbt0uu3o8PnYEW~lFV7K1Bx>0)28eF+ zOL4iE=(WgVQ7k07&m`8o96Gr=Aj+WO=jDZ7alc?7NFg16PfP06OVdcF$B zVl$J68uqwb!n5Y?wgE;NkHSu@8t&e;Q>CJwe-#Fo~$hp$l{#|L^X$8#mTUYxm&{v+&Z-@By<$x?C+S$D!C zoqtO;igg&P3#99HUMxq^vRoE}?0u;M~Bp4m{r zA4+TKybaE>J_a(uAv7Vk zkKSe2jhqdB21uFP!yNce%+*1gnj%?F8DmScaZ3=MYSr(oZ*s;oj!6hUQzxI?8>Q$= zi1M@PLp){g#@w5=N6{3Hv-MN_U8CAP@=<)f)1#+a7f()h5+8uc)ulI8b61MfpCfr! z-l%TyRzCfoKQZt`ESOVY0dGNp%%pM z6Y57`TBlS9W@m^vjIrsN-!Iz5tpxh#{+`1ZA+$*2_=1!(OpFo!LfhuHrTcT0_^lh< zo3xLEErO2zRo|wq2ey}8F}JUV_Mfl9kGWo@aA%gLMimhxoLNa3IZgR6oGF zu7tSIHtpIlg!}n=RVyt*-XX}gS8(*)f6ggNF`YOW)|s{Uvp4^Ujn&~9{Tyhz4u>eELkVnJ) zCPk-8>rR(aWF=Y->!Kz2+51~GPKkO!j9U3yFIxKdSG#BO)lg3EGPFHc%krqks%zle4-P)BFc6j;Z1EP# z3K&q*^Yyp2t1E3G_AI!CqJTN8V#ruhoN8EAmUaMRb*7Rq&05*GE?7MNErvZaNCZdwVo#+n>ZX(uDrYgltX$p`BF_pT(2&zvjmC!p=D0wT z2@5%Tu9z3-wHmla>V!pCRg$5RMSRf>Vvv@>@eu4*JHNa#B%hW^(%U>DVISdL;q{w9 zv^}Y1Vwd4gNc~E3ILJYQ0k5;zDp5}pd)6wF2fUWU{%BFX^v)zEA}Z<)sF;Fmec#iV z0l_b-erY--!bBhtA=w%=;-XnY$?|>7K(D}#xTud^f*3o@;$wqc00ML%?CF*=IWOB6jZZ7Pt z35eLKJY|lyJK|B8jk|$tJIg-y=r1!G;F++zRTr!~pKvt?`rKeGZm+VI-jY^u9v!g` zBAfglB`_?)DUQkIN7P2CJg6+w0MdKy+ZSbEPTR4cogqx2$O%R3R5#k_r8iE`8lW>Wg95hELbqB^i{3_4i zJSm4Ka23e<5;Q}0mJ*0hxV$|ICoVs&DIX!w-QN9~fTPBak$ zEwm=6TlgtRgj7O!^y&uk&G`szdpRfz+oiNYp=he+5P-M=sEE3BMq3J`4(r-QQz2{n zcQ)G|g81|a|4fk@XSuR%K;}=SCksi8g!Ci$Nz{J4_whV~f_6X&&^vELxr^R3EQFv6 zHf;kb2!BqNiVIn;8d(exAVg3`@3mb6((&CkJTzo1io)lDECRIR2hs}W-D~5~qD(w- z9?}9OCraS>J*v9M!IkFhbMqs?qDJ)n{;ZdK;4%bK&6SO{XB1Qh=cW|Il|k&nuvd@? zMAa%(b)|bKWE;OiR;3RK8#13Hr!R(u=_SsuMwRHPu6#0G6%Bm0d;g zk^nCq)agMoc-pQ+G9H6F{vALuC7^YU0oQ#MmF3leQND)8bXlhZtdqdCoJ zZJ@Q`Ge49FVh+zc*VFKuaA#c|W{FN^KPH+=Ey!$HoO*ApWwM`=BW#+5Y>Ht#;;D9T z$5dN5^&0P`Ow^6cS-+)N%Lp%3$V}ThJItJ8oTShvUoNsgGOAoQT}CgjK)dojR~Xnu zrsGh$7aE2#MS^w)ma|;A3@`SuG$bmb1XZo*BE(M*(W$Ih1*3b(cqe%`2${5`S_O!>D&z729>50Mz6Unc!Zc*5skU zGr?~Fh#*$3T1fU+aSAGzRUqQpYfRswpzVw~12|E$l%8g=VJLk)QU|a{lUyk}_~+?O z!~AP!U}(GCV4yFvH{+0n$@6LkSKObShURVV@2Q@-psHhfh5$8LqPV^rjIMzFs5C61 z0@`*W|9Rw6F9kQ^bqcw93r7KjRH7N02~TCki1V8G&D?YN-{NLwqM$|y;SVJ*Xmm|k zff71?e55Czvv=m+XEF(9!-eu&Y=DDgx>2Fn(oD6JDBK}ZdQOiX>gnwhk8tdnkBW;& zUD2woK!z`O;E(XArRwbwJDA4D;Ye3Yh@UR@JQ;7P|J#ZXR9>o_&W{ZIV$?*cf}bE+ zp@v#-e(3S%9O|3~eO4e(@_LhY_&zHT!m(W$S|2mu?J`{w77Go8r3SRygEwXe0vn^n zUBrHk3F{eR#!FuVzPaEK_dRYhJlMrwv&koY6Jn;toYq59;6wa@ljXD=nCwB6-!V}_ z%!rfK5iJofrCQ|Xg4jMCchLs}cMLrIDkEZWDhHpIbDNFb0qgf1IYYdEG(SP{aQQj2 z`vKQCbgKEEc#ZXc#cK>K|BcuFZ$seKe++@{hy<7fof4kt#tObBi5gSZ_aFHbk_E<{ zb}B{)1Z}s?QYjP(`v-B?dn*EPK;Ps2mHnN6WDV5){Qdtk0C@IYI=dI^S09LCgdhNy zJ9OrmTStA3y#>L@PV$ez#4|2SVwa;Wv15tws`_LcF#$=X<_e?A!W-_Je@}C3d zChdJp)$b=}h7XGw$GCgZM}9)qN8)w<-hbWFqrjd#V1G-{YZ@V9bDDd~yl!pF&Uz#@ zzqkJ@j-!v-!LmW)(4Qoy`@+9Fy)Yx~bFvw}|IaBsed2WDsWms_*GjkU*tBfFkFOY; z_!#AlXTipv8IMg4f6$Ph9qLyYbiI^u(Z6Nk-91HmyqROF2(Xe-8T)`4wYrIZd? z*d$$NJ!ou&tfYW8FG?7^DZ;Q#ididUG%af|pJzr*T9{OxU`D1^#IV4w!;8`t-_{~V=_F(V->&e<7E365iF+q&}B&X-dG zGZD9MF@q2QleNE1s#0b7(TS0 z#<~AWWAa&j*PQ@Y=7Q)Sy1Z}kR!l#q8RFDrI{I{A{*^3kVsh7hv8t|gh8R(=cNl-Z z>2P3})-7fRAyUM>1??&*RT+AU?V*lB8#X!rW-?LmRCEqTZi#{ZK@pc+akIY|?WFDL zMXwX-R+-HD$W(X?A{$#Qw`s%OnfgQpa1PD%rjtbpEAMT}PGzwxs6fA=YzUjY^NA zA9N10wsk&~#gV4^!sQrhSDgp)0ov@&FJxR9|jR4O}!H65Lv8F0n+5$8sZJso3i+VYGx$lpb>*FWh# zR@n8`rS+&OU|>;SG@zC|AW~ zZbI;pX3OfL`PiKELFaJzaBI&IZ`_?2ASt0!F88A&B5Y07*N+}*^%ApZG4`BAStO2; zeZw36*-K#CWN1QR295F|S`!2|CuqZvJySH?9>9H-j&!X$g>~QBO;}krv5{=4XHVO z2AKE8-N`k2QmU?k`!^&Bi{U);5kY3eF|Z0?G|-5-$GOA%G(ZdTe@Cujxq zvuF9k0->bi#rL$55p4v!U$^&op1or8L0Yt`b^^- zF|Vy;e#>ySWPbC_3%1RP8+BZ3tn`$#mmQOuYS|z@a|=<~GIh-x`uNp!oJlP)R8n?h zOjdnWC>?3=U0qI3JqS@Q()={lGsC^}$&bq1t+_qDbN{{E91g{iT;NglnEkcQP-YBl zXS#Uy?>?4`%%x~H!#b=fT?Eb~k1wGlr=)^uYi0Ub5U>~~i~Fo>dledZt+DeGewGyb zE%n@JP!v@85Vwp1G;`}qd}P~M%YZ3AW$L!(F?(od!nWd=YIf$ir#WxwKe5GSG9DBO z1=|AjbtTvluo;c+K0&Jb_S*kZ1$No+4l2lRy|6`|Dtk29>OP)d8~)a-h%=)J$!FIs zQRbze<&I39P^aV4Mvxh%sc!<~R*i6@>S0q-&1|De-FL9bYONBUCBah9$gTV|p;qy2 zJ%gIF@FWpzs~@I;y4fx}qD}kDn6q?GwHm33C#F|%w2{8}I+O!1*C7+{7x)!$*2-<^ z7S9Qoe`%@vi6OH86ty#oYMoE2>%CD#zgS)q728ij9?fUN^qA&~Y>Py-@aW{Tk1dX)$EAqiVE_FS1xgzd zJDQ&D%thva-f?Y3xMeiCinbbkxO4d3bSa2O4SjEwU15iYulw7t|D?I_K|a-sc69vk z<~`D!=<{mF-1~L4KVF7nR*227d~VC{d(aOMPsAnu|4%KNIq|CiVJ z=$Bf||1WBR=gOQiG)?@SkW)Y+-B`Ll9~mAFuGO*Sp-A97%;)~(9TVu|<8WtjM<1bt zdD+<=rnmnxbNZS5xIO7z6Nq34BM5zQX%pwN+ygHcJzKo}eqG7@w{r1|Eo$VChW{_N zq(bVIzjkG;8u$ESi=N@ZAMp1W#Q5gCI(?Z{00o%2w6J*c`^-ii{oSaLjM{ z*bk@MFWgBx2?sR|j2Qwx52aL})G=+7qTk?KJ*0WX+?=%pXrXh@P{1cqdNOrIWei-K zE&F;!Oy}NXE()XDO{Jm8_(8g9WOc+pS%w-*oy<;fod&tlp(P<&70D6Nxj8eNcQSgRNk(I3q^lUz1o>8UW69vd9} z7o=4oibe{kw!6o&{RSIn0Vb9(6| z%T#mikuumfB8O-Zhapr@fEyVa<9X*CTP?>1bG$6Q@!$#=_YD)?@h-gQD6U*GRGzrC zZB;cCj7F&Dz-mV<_lOI5GI$8a4JM$WeAXgB4{@ON@75CO@JMW*MTm`C{4|BdS-BkB z0@Jh@IA#JT%MFFlE!*}VVt8Dh;5RW)kR>3;VVE-ztgOk6@6ibp4xrMrJ3W@ zE1H%hZl*<4gVbb$;6WR-))i_7$#jSLd@#xbvD(8o43kTYJOgw-^rT|=<`L;a*FTss zH8BA;*PF5^q81vy_lY6`k=Q$E8X14YJXj1R1fWxPxYo5cH4T$4Wap#=*{GPo-tIa@YZx)(h4_Nui%iiA(*uQ0=RM8*Dd)v;k9+ZgxfIEK&z{7j-Y^~be!TRFbD z9~Ca1t6$4(8>jRBkaCICQQmZXjdk;&YjQi~cxHD!!}9`%_VnIo;(WKYLXr}ND&mv-| z9@?k%x4VXdnMSU--}m}WD*+=z=jb`v?LxL?Ap}W#j^n_aEd*)_WFkF~7Zd_PXHppp zWXCq@R_IH8N+zU+WqA9|y&$T)eEoLjL36C~km%r1+Muf(1qz~^UBzsgG57*nm?)g2 z(gH=q(%h8ub9-czW>nvOO`}U&Iqn?adHuH4C6;_p*m0yC?&&4X#UZe(MbE4pvtkL2 zy@djhOI=Cd?poZO5l-4?u2k$4d=)}tcf3K_)Z}fuVk+W@;n`2?JH6}St<$dii{p;){c>5E>Wq5Q>v9Q>+U;Yp$@yX&!?6rWpd0@} z5-z?DV)S!&wO1OA1(P&%?j?vzWLA=bI3#0)A?e_|{z@0GW3$$rX&fhD&r{YSJ*vDG zXisjQ>8~IF>daL3k2x?dP+RWu{2#{7sX4TE?b5MruB_O0vSQn|ZQHhO+qPD0+qRu_ z-u-n~_wL#U`yb4j2TzR}xb7en^0Y)=%X!E~ii23w%Dr^R*E7io1)I1gH*F7RtfHG5)0pQ!6(x&GyIkN$*zLZy}TsPS{cLeGlTkOz;Bu!6AD&=Bwwwnc4rb7fa9dAV- zNu$-0wBb$Og}7TUx&?xD_lx{b)=1Q^-|#n60CM81DwX{nNAWUM;)_*9*a9b&Wku!| z+l$#tGlK!kGxhnX>|K#QS*j65DwNI1qS>Rdb;D*&?7M%>7-&nYPTkhhB>HHR%!5?1 zwr_}|MdyB*`v&Oql6qC2;hn_d`3PB6;%0$sdEf?!ersH04p{M=b-9ARCLU}* zCaZwwJUKt>d_VYvAHG@sKT0mf%QeAyp&wp8YOZW||EtC&&!%NnlbfCj00QaO|_M@wxfp(%@vdp8xgtaaFFztNlPm>ziHpZW>dVgAtt z)qux89KJ0Uwk1z(!?XAE;Y04E`<(x=pccLUv7mhZWkF&2e7n3H-@HGX7Bpsmeh=G_ zvijtDjqsh#o{uWL`x-^!OS+};yX!gm!a~=o;-hTD*>?AtgPM*}J=-7huPHZd?AZ28 zYo{(wj_r3X_OA~AI{iZKLU}zfg;C{5nwBn@XBaox03-Yxr}xB!tXV^uWU*=j%4w(! z8{$7;qBduPKe72xulYW;4&s2VmIYopIAA9dK~8eK=cO;Ed$U&lY@Sm@kI|%m)B+7W zR`e_(G7F=Tdl`IGVW;ef-v)WYgbUMst$Nj0H-LC1X-3v~DdCpSX;UeGb+$Oi`OG2fH1P;TRQ*dh@x5PT>l-9mAXltAxdgtha zhE{jMsf8Yy(6nRjnjq#H5y9x@nKSJ71NGA%S0xCcCV`)jvXL&Oy1)Uyw~`PWsB(rS z6?R}L*wE{UXd*5v@S`d$peVR*u71K+Cp31e3xK}*9Z4vJr4;J5gkT*Hn3lUY58%Se zcI8^4k_E}&oY_lo#kP|UuE6FuXA3{ba&3l@)L1tSmOc8e9SjStjTu|~s-3Ykt)A!> zHX1zl`$jF~7tMaK){{tG? z+h5>=B|FcT&aK)cOl<4(>J5PcW25!ww1HZSA011-h!dH87d8eni&@i|=xuK+6~pu4 z1gb^exkC%j;En>bV44*G({%K(I0HJ4Wi`y$-G?jy^)`V_LYVz-S$4e|{EZ|-djS>D zA1-SNR0;Q{Q2WghN;m}%IFvx_Y9Xes>tV9Sf|kc1nehj8K1g>u?Q6TSDh;$-{&wL> z{v4}*O3>9%Zn}sUU%tbJ+`^K;$B@}@OD5&xj=2f4Z;RTxv9OaJm+(m^F~`&?kv4cG z2;4Dn^>4G9O;zq93;0^g&N>AO7to~KjZO!8|D6SoihQcfE z7CPd-@HfG{dutE$b5?ni%?*Q3!WR|UJzt(;G+)4-3}QueU80Z&bgk{)PmIxz=81T z4lmM7Zk+1$IPoqUzRk0}b%nPU3ow$~vf#KoON^lbw)MtI)u~~? zCVBM+0yKCW1_#K{2ri3dFFU&c(-XFTPL`}HKQA${l{0*+XeRt^ia?#*24!-9>tXb6 z9mqV;h{mZrp(Z%&cq!4YG|DlmyI=Vp&OJ4CxT|^^%cwZrq@ckZ5ShZ}4g{hgWE1Hd zkwI=|xc{&l;bU@y6l`2Npzcui z)e~Gj&XM=$xatk6A8dZIBfQ#qEO-O;Dgfm2X5-{6hZbeo4)?{FpbLI;qzno`%m#xz zAa_$G0DMiY)!$|<4dj=tcJYQ(m~dnbAc+WJ&+HAhCT%s0dI3mc6oo|WUD72>A5pzh z*vWdOrOZYC!}qD%6os=hIVq8pWrLg2l<_}8vPW~{l=5x+%xrJznC z(F9#C;-?2;k}oRw2K#xManoZGOg^>1EGOMM(zQXra~~2vaz<&6Mi}EiD1dj5AjVXM zE}JGQ6UAO6!RZDIaK;h?6%~q|dM4Zo7)8VYMO%MZr18PnhFsLFjL>3tv2E7{7 z7n2T=f0^GQ7rx`m8NAsw0$j9pG#I*%vL>}IKzpIK(`?zbg6~wGalohfWU&hV;=-gE z*JA=VL8b*&Kvk7hbWVz{QL7{*es8^6n}$qKST9mN^2k=j8&kJJejkjBID_kRG~OY;e(riK?!OBhJn2IpxKZK`Nx)pdOO z<4AhGRt)vZdVTaZNsSd9pjKzIUbPMnxvw78db`PN!kd+j0ZuJOnc)>`>^XukF(9}F zeR#MV;=VUhl?ufKU~Do#VUK8#+O;qq&F%9SE=6VNlM+Sb=#xTOEf?w48|2!jU&Sw= zGY5*W!z%Qi*j$@}AwS%=9|Dz$=o?h!-o++5D-nwR24M}Yc5KtPwOL0~X>S9~8$}E* z5%L^u>C2aQG-rEcRB)F=C7k6nWYpcMTtH80xj7zFbWXB|*XW$UaMdM*+q&Hy9O55l zB;Y`5`xhq(eQIPk1oH6@Ns`he$SDtgxdY6+6zjxWB7v^t@I8*4&RXhy2yN1>Def`e zPRwZCJA$AJ8kZ1(Y>Kah2Hy`&t7)o76O?w8nQf8}nDh7<@v#@MZK?6%htu4_wjh`= zrEoCvLSY4j!vbAR04++Dhv883ZH2WGVm5XviCQ&-P=)$1AOKtUe6E$gTnQ zRv~WFO@Ly7qxp;K*DcM%qdPs)RtB;=GdecUp%9d7jRJ-Itp{V>*x`@1{YIh;k?7^A zZ27=E-`-K9{Smj#G-x_?FT#@sBJpcru2i0s7fYIw@qpOWMib25r_Y*P%oz?1Qp3hK z&0g>W{en*HpPKWj5*9hKHHQC&FudR(*ieC&4|l&}36VjI(z( za)Zsyv}W<-GSMk7QG9*@|Fg<;WPdNWen0#tV6{N7-~U&@xrw;RkteTBfCMDGbxQue4Ir1pDr9d z>MW5}W?^gv*_+^JqC4W6tU z$OYC{+BZu-MnciZQu$9LwAc$VOePJ*=f80zeF>yZXQj%h6@Cl~c>J1>)GQ0i@vcKj z_)(K)ZWSy1;SqCfIW4}>AYO+IaR;ab(*mLjgK0EIvraNS{C@Zq#4QR0U582otg2!1 zs?`PDL2LC~l@5=_lgg>NtR0nssH}CY#(2T8ILm*`BJ>9J>PA%yl01GodXe#k%lNx%PWelJU1Ubn{y7j%rG!Gbl-eFqsUiDO)?^rwPQ#{oR)NxX>P=D#A*Ad}3tTliKp&|a$gX(P z;L(;q*UMRkVY=G0sx(OMm;X8-5WJI&xkMIa!2mDR044mB4hfO`V}IZRB_eWt&+`m!UM|+DY1cqcr~;gb9WAWV7FyL&5eCQf*`46 zf+U6N9C>I!Vt1(%l!;^()nSe}?+uHD7-EI?k=9J;1sJX@tQV#lsv2vh%ett8&};L! zBh0NgGEgt$)AsJRo7^AbfAzkvlo_KbY{$NGE+Vaz4l) z3@aD)pH~F^>F2sEATGq_O={18*b#+rW|7RWT!)V^$n0O7YR%dVc<8XA66l;NvB^_(kXxtr)v~d;?u~aLtlB4;Sjlha% zlHHI^T7E@ns=0`vT|hM%s~sq7;mi5a6mw2B%`s>cvbDN)qbDh0m($NvW75Y^n?Bb^ zG7SN^pc{k}f={3th17TjOzsPVmdlzey2mKmiAzItUv5d+6T^(aj`+cQ`@|(L<>BWS z>5Y5axuygA6&*@Q_#;K`q?Ek=g2b=J89y$v(_S*gT%T3JBE%73)Q_T}lXg#LSh4$# zM_|7r3V9RrjcyyQQq@TyKRIMO06fcZJfr`9^%b_gz#1pPOOL01i028an&o{2Dby%8hx+H955Qn zA^yzpgKwiOP5=HY;N@f~U$K_AZqc7U%2&Yns5{{2z;hA^tle&AK3_R+xXFjDFi`lQ z6?{?M(A{*$GlddJW@9g=`{hk1t5uk%5*CcMUjjQp(k57B@zfSfD>M7QGAUTgv&;j6 zE@7?FE3K&-Y1dsn%o{@{E*~AzOQ%!q{%pcCP212V?A0|E6A7gG^BkF2W3H_J(IUWP z_!DpQ8cf|FOZZc{Qy?oB7)bAQR&nuHf;@Ds!MA6$rYNRIXGw@Bf*=l1IOR5SPL{s= zFvRmP{pJ7!{S{Yg6DI1e=7dD4SQeVZgXC9QLV&PRx9u2DHF5ZmSCE78L{TQLuWGtk zc+em1x_vv<7~kDeJ|Uq+s^?BCKUwxtt*u9)Zb_|iF_2!Le_}P68V&rlO0h%Z;#2ey4V7tL59(`)FPjFn%x$(`D-=k ztngQRw{+&JP9qWK*{%C{R#4!J!i!;Q{|)jDCbb0(2_|QUH2R|6Jgx4s37zbuXIDz# zcj2Y;HZ!-x2+tuIt(pR14JE#5$8hG=U!8`bK{Tp}m0~WA_&zW1+^n)?tq#Y>F_G^4 zdT@+p@+)MZ3AdDdV~;v~yjhO4*`bIJY&+nBo3Kkna%9;jA&v`A`XH$TOof#g2a_?q zmWi+SJ)=MtC^|5GI&{XPm2WYe+Ao_L2FHO5S|h^l6!ordDf;iG=_|01`$Cp`-+IX; zw|Uq~uP?IBo+FY{_M=@=6 z8bemmMiUzzrut9slh>hh$r4os&w$715~}L`f@Y(X~T~m=!H^rhd9H^ZOm2Zfkls`}pL4 zfmskgwwamU1^g~vXSG@FnH4|d0=Sdc+mJ_6c#4Qi&ONgBdzmWEO@{qw8&rWtO=$HS z0j2=ncQda3uFbmjYSip20eP#rD8FAtqt|SAA`zOVlw6mc9K1bVectDML96g#-Tfy) z_}>8+S?L)6Z7=+jTA#NfZvL~4SgL(N0ThS;NCT|TD0JaNOQ!zcWjlN|p?Xm<>yCE< z-Wgkofwkw+6bf z+2@sQQK9>bJ913M_(f(m0bA(hYdyCLce3#0y(gpxzURsV)9Ur(GUezTug(S|YPRzp zy3`J6xP4k?4e-g>aCkK6Nj!Q=k_?*MNWJ*(w1og)WDH+VBFa@?%A&K1;3c0aEg zJE5NQHksmwtMaJ5VEm-k8Uv+GN9V<);O9?K?<2XtIW;9!4?x(&R0Dm7gWIE*K}naw zB;OHXG*p}Q>YKvC$Y|#Vg`iY_`gWjE%OnP$(L(5DcuqgOQ{)rnGCgN6e9zP*$S>?S z2-aQT2FPb5!$khuB~G_-Lmc)Q_ytwyW|53|6iA6QKWM5OtyX+NNONZVnAfJ zNqGj0W@UWBFX0)qW~UO`=JsYJP79#S9Q{b#tsJToXDm)mQWyplH-tuko6>*l;UkGV!~FLiCoF8WWI_1d zOwc@R!NqG+fBwD9^Vb%9AcgoLg|F7c>i^Zb-fbAV-c^V?LhBBaF6`6kFAv<1#X|Cd zR+R!Ak3ss#Etw7K4eD>TVs3SXp8Q79e+wa>(Ikpw7(9-EF};3dQpN1YBszaEelfsp zPU(jh<>9EA-h=iuvQ`f~T;*VfX?k1TSbH%Ns9fIM@HWJGM=|a}-tnKWEwm$sc=$7G zB<)5QVs_*v%16Ea+`s7|(X4|FMS>j_vq`l(woj@5MSl^G&1@|kRzkg7@)!8sUen5v zPz`Kzl&GtUWA-??w@Ly@@hKhwDBlrj zzNbR2EDG5#45q|B*?F)y6SP#Ml!rCyQF(RqFo#{XJ~>*?t`@Uh5;!ST$|IVLc1Av~ zCoG!LPwc>cpO@(oJC1LZNue0=a$;O~%lJg12Os7Kb?9ypus5^mj+87;y7NQt^ zA_K?@<$nqb%mryMxOt1us`kI8*jFQ4$p?%hZ71U zbDa4SiVn$%RoZsbb5dUhmsfzg%PtTZOzD)wl$BCZfR|YirD&wHv2_Ed6`QE4DsgO| z_qb*D6v3(WtnMYYk51CG>b&_|3p$*$*n`n7xW@Yx8kmP^k6IBKNnAFinnQaDYe7D> zEO6y_)EV-uD*e+e(cSDKHO!+M$inCeyKB?Lprm>G=`qOu&P&`{Q`F@%NR_fd(Xd%I zqOeuu6G$TEIs5v76V>+GVhnUUBPxFK6BfzUKgl+J!Z3y{uASCxF|FgDJQ|-13nEH} zJ;+{eT$7J}?5VI4MbF#Vd*7Dbx3qrJC{mCL(*uT#eVi;(`;Nx&kA3%W0UQeCB6X{A zaGm83szCg{?3YpnLF8o_6rQO;=H*DG0a0=SnGs$dc7e$K(@a&8balr%M0G zWxt-74$72-+KH%SZlN&Cr{L0x2KS!-5%qGL`ADT?#Zr7?Hr%8Oe9FB2+8L_OncS!t z4IVTTFpo&v(Qi#t!~V(&ogdkth|mSo(DvKhpqJX_t?`xsg{q)lkLm1-NVoEP9M`O} z-z$-J&d4ydOj+mDn|(V)k3@f}#lOe$G-)fZHQww9?I9iKhS9uiWozN(+S%sKudNiUuu_83J|$%gK#M8z)! zK*`!h7LBBMB6c{-7~Io>1=|!8_B4`BA4@E8*86Q0miypjZeF=LqEuXINZ?oBG82|s zbB9_Ln-0lrnjLj*1{Ax4UmKqexkC3rlaZ5;n3bY4HdAJii3f1)LMW<&EDkYydl80r z|HqwF7hF;qF zh|yg@0{QaR>131j}-@bpx}1}17>%;3zH{+b2?MM@!J@#y)+&3qN-579@te zzvV|MOn#X)Jo=eLjFq8yvy{`esTPo$bn!Z7pk*WLK%%%ps+1&@{Tk?RzG@lAOjtp@ zEG6pUsR7mWn4GO36_JqzB*^*ErscJ!ioFFm@(K1JapMP~=4J(OqSRIo7KLcd*U#(9 z>&FPpUU^{l!~8$c%=pNMpS#JT*7C}nxM_HuQh|AT81z}_y6;IoRRH_e^hPaglwG#k zQ!g^23)0bOk7jq99(Oa4Cx&Jdn0qa?tU@>z^>OM3_6_@7eV3I7q#VDPd-roji)9sx zi0IzIn!J1!(lnC2tViH1{kyVH+OnT|Z!$L1H=^U(9vh`rkE&jcI_#>T7>)~xU?0wH@`4mhs5Z?nD$4Fy&dgSJ3GGKO1^;x z&JFbbgQ{g<_^-N{46F?Qu4=_%E|?Iy?b z@7BbA#w@^)T!-wJuH?&ii+gEbnS+D7IjNbMnXnTfX0N~;-66*<8BZC{r{~ubL~PK1 zLQlOir2FZHHi?Lkm8Gwjb+%gDHK){hJJhO`y;yFQGC@O}A6JO?-;4KS@5LxEdj|V< zaZU!>3zylv{YsAZ_4z54!! zLT5C#=k;d+_QR*?u(F-We-6MH;CO%2n^~mYhI@Z=fByM&?SN`Hd_8@?I@YnX>WiGc z+#}6PMXy%lety8-D33GR>hmN{W8}W&7Y`d&1nl{_s)Ync&naGbqDmMLOX4xvYW32Q zX@#aT8%=~Z>85uM4sK$5akZgNSLNhkeTIoK?vJ|p-TJl?=8;*bizMi97jH&OLb>}} zUmlJK%CK^tg@MV@ncQw;6yRBxC0lzUGvZu%eY`3A#cqtrWNMXPRllxVM2*zkitlfG z3CuyfRIKC>E7BALgPgEt`3Jqa$vu4VUq43Hk4X_Xdh>~ zAc<&BK!wsEuLELhCp5dvMp4wr0Pq*II+EC{JT%aHb)X6$XFY%{L1_F8zMGRc{Q*J} z6nj{6RSs|NnTW!IR`!!BqdAa0FXDV(+qWz|4g?50Jzdn5k$qvz^k&piMEpl2%$0B} z&hr)RmJ}u_^CKm)@?u;E`9IZWYqbD7YuJF~pQg0x9>r7_K@}N<5o%`kJ#xDJOc?i- zG~--a-A*)KCaB0|Eks81CJfOBef82tMT2&38dCx&l&#Xzcc}iFdleMI&;j)Jb%H(P zMjHkJ&Qj2YGM9r|U7E*d;93@hUG4fEXsA(wn!90w;^qQRcd$G*O}LX17wMXN9{SeW z;g)!K>#j)af{@Ls?^t6D#cZ`Oz~|vd+2E!~8=3`au;3QfNSH5{rs*A-7M_IUi6azp zH>Skr!rY0zrU272foyc`D_u~2Vu&O+*TOHBq34vTvLE?3er>Uz`EnEfGTtk+{^bq1 zaJc(Vn8TupM#HWljatJiaZkjvM6i=U)`&xis#@DoiykOuj%$zV{K^&;`HDkiw`vXS zxCC9Ki-3`1MCH>bx=mY_AsyVY+iDf+B1CrMnNffSUpKiDHLs!>$g?xbo|k5nPQ>y` zHzQh+3{gI&Kb1519eiPOMIzKZJ%U`xLW>j=c!J+#BKc44l-}>6Q^HuYPfU&-#$VfDY&zOH-&%4$3~X!9ONArwpf-ep z3#DYcjRgyaQzVYQDC{(+ID8D9bJ)VW=H{FDUlT2LvDJq=))(9qicG< z%gbEx2XOaTeBq8aq&J={{Y3d&!MuKmhc1`Pxd@MgMEdMQAJ3I00^0;Z`@vF> z&B&_Kx?Si#5C}7k$9nohjPu(ANm7{tjoH;#tpT|#z((ib#4@XC_C-0_p5rurYynFT z>p7d5jnwq}a{zY7{`Ca0+UDN^K8=a`+p8ip4_C4Za@Yh{2keUbo7;#AoUC*XT2~Xc z{%Tyccr1Bd$E_}Tq+BWci@nE;maNHr&$A|2dg7L(Mu&y>Y$lOH^{Z*|Ptm3G7Wo35iE?7rt; zA~`(HUrJfc`qDz+o33hBz3UZwzj0X4fchju7pae@;@I7TW9`9Ix=R}xZ#=}3Y)_^M zQ!ub^PgGJ+REpRs+q_+M2D9IN2-;`1==GR|(4C8@e+xP^Zr1Oh@j@U00JesK@L6|{ zh%)^N_6C+y`4ptm2eG_ze8OWl^lI*$IbK(9!=XqpX^Rd@RD@a>D~=a!RY1(+%RjP~ zs+Ypc;5Qy4Glz^HBMYP9+<282YpiBUBsTkdZZw*jWPa`Nw_$GXPE(=8xjD<2-JbG70P4Egm*&Vx#K%gFitmi>f>3sexEH{Zfw8g z1Fww&ZR-_jIsg{|?Xn_NKc7%EH%r;N)a&kUj|dsot1e{sYBP0L6HNOr6jmt8SffXE z!^W;B^BuZ_)nTc9e4~YGU{~u4n5xMeD?X-vBvl~WaEP)9(uHnAfXPz$YllE}5IO&K zp#q;(I&qe6=k|A&yFq+ditHe=g@Ld6|<^jg1W$~$RyXDef88@1^T*EQY+ z)8W~4yrlNYaeM~5a8nwTa&(M%rPW+LVhuT_?p3m61Kbn|VEen9zK9)m4>U0lxI2=% zfad1542iVofudy>F765y;+YJ5@zsqx(-)L3Su~7xJ6*?ZJ_bCN|6Go1F*xr01-E&) zBkuo&FFLg^}dHFC=%Am%r>a!I1_3K z3TsLni9gc>jX!(ayzHBg^WMaaiJP3tk~q7U&+*(UBV+l~=YRY^o@)<17CfK#vbWca zYYjRBrppfkl#D^q_F>LP@E`wgm5JYjc-6F+4PAbWPV%t7;g5iUymY!{O`N5HAUF+6 zHq(Cc#I=1>X|*M;9CiBrpDG=g%)Z(RJBz-?CC80ZX~wziNeJ2Uo-ZC)M`yoXTjVBor@eXF}IP8FV@3zWhvTqt; zYM1;duu9=%0qwrjWSNWYIB@U-u4XtJb>*_FySwmlc;LbQfc`E0ThY}%qbA*F zMoz~uQmP-db7OM#g*&H_eW`mdi|HVGl4*)FJ&r18L=o%YcHhxu1Nsxb&vy>khA7P_ z*EY?_m$^7DLqGy#0HM_VusLd`@GlcT4#k)rYQ<6%BH3E; zpfr~F?LMPJbTo+K%f3O6s^@)`y~YJg`DzezwkY{Oh$T&Wa3^L`1lH$j`3riX!Hh;0 z;i=Y-Vx|aCf=`}M@yI`2^FZKVNJe}52f~}Jb&Q!JqM$e@{Od{Qm=k(n25J*dff~>+ zTOh}n{3|%r2-(aI#r{5!z;dYS>cGHE2jI z$IO>TB+~s{REJ`!LIw}j3S%j4P760_LN^;)josBrHW3wZN94}_V9-|syYu&5DcCSl z=yO6?49^U+NyXu#fRJ3(jb5$G`xxPxS5;!;w)0dGdG;+i2Ft>&15IAduSJYYbb!?m z-Js_Wj2W|j`&~wYc^^EY6>4-gl`Uq|B@9GhahQIBnkF-;enjDm38VXrDKO+4E7 zFh{2&9v^TU>*gOelZnS$Eiz7sWyzmlTJA7#1IM>&D6f%8CEUlZj1@nH6j%HJzCW7I zk3y?30BPn7@c<30x3#4u#$uW~=}3s=GKUM3T?l^_w%{k6Y|^K>7M5n0uN&PWP4Z!X z=QsNKZS*nc7i6aZ%eCn)FjW(&9}GS5x|+l6$@1*c0 z-t2PpVWXF-L`uAMaL^?FK+nNG*5zPW9{)D{3p2A#Zx)l@6k41g z@>SKiSM*oDDCXO}=t9z%s?dtI6O*R{K6&CFdAF>|3s*-a@5=$Qu|^pr35GS=)WSBp zRbRtVpfypkct0CPN5_i685s{$q=&V`gou_K02r)P7Efx&nwT3ssi<>Wb`luAMZAL+ zlW}a*MV%vA8MNprG*AMkAt1b6VeNP%oijnLvk@et z=5EwK`CqY7E&h9W>_R1GM7#c36pqz8`!nzofo@J$_yZ&fZIn>i6&$QWlkv_*s8Z_vQ;rn-~j;7u3-r%ka?BCNH80r7clogX)DIN+3g9*8<_?ZNYCdn?aR% z{!EjJ9(b|L^c3-^1J|a`I`N2t6&L`Eu8@zTkqsyMIN>~c5rC<&Ezilz=Gx>eE1)F( zjkgFl0a!ix;iJy!Y8^7P5>Q^UJaw*`0WSKaaWHv@|1QS;}9vZS>zXciAp2~%e?GTTI$J33$+(jkJS(j?*e&&2K(G5g4%x; zetJYl@W_aidFGM)XC4!LL77eTR~jO6`{5Hci$RqhS|(Q==6Nde+nqiA{cw(3-**K@F-?0Xj9-`nOQcbbUHnsDU)djipUd~A>LSlwnWd&M_ zHD?xv$O6D(n}uc4z~q79lPnPIOB$FEV7ksNPa;mr2h!{SojTHQg8jsk_ znr;NF48B>>gzBcZ?wC;t(WnA*L2{IQ69{6{0`A~x!K2U=97IN# z8{yjEex&g`e7(YdgTCp5+W#jF`QJ@t7+Bf<-D>*@kXexa6(AqoNFma7V*Ezdbxu3g ziVZT7Sd~N@CF$W2Qobc0yR>$R)nr;|B;t-xDv?HI{$vRY8~B&o_GtMuf2rbn1FYF| zG3L`P_5G5P24a%!LEmLHFNRUvnh|K&KX!WgHJ?^-{+JJ%m~m*nh>q+X9Xu&{{GIW|`Pq6M zwCeeJ9CGyZJkz54_oV$kLDmwj`s|0?1in%cXVehzB+g)BoEVhIK%?;bLL)IUdlXwc z5N(KC@ziUuuf}Li`MO2JVx_VKxAEh+p`CL=o77$yZ~o)Bby>SJsJ7Tli1dT4o*L@L zHS~)0f7#n@+tvuQ<^JY~Gn)=9LreaFPFqzACZd`36SS$iDQ|%$EejiY2^BOfD3Heg z)iOA@{;b(#B)s8Dao94X#*qm+`>+0P#A`jAg?&Ch#V*6$Gr%p*ZoyR0*0`#1lutu4>8 zrb^rCUHO~!$E)2HD*;FaAn?GW+Le6wS*9#bmEu-}YFCC)>gCX>6m{#~)5KfsLKa!2!O=ZMXy?v{xd9c!zylM0I)iEwf zA+o+Qsv=hOqEIe&cT_3n{J#kENYh|aFa8e{N zuHdpr{Z;@tRQ87FJu}UvTb~HvfzsmYgh!M}K9&#iDK*sa7JgK*^xAD)d<0pT)J|M?B#eyN9! zpoWR)YA^n>PRxGuuc0pbbaEGNhFw42SJA7VNm_aZM}5c&2pWZ3(_nTcZuEA(19-Bx z=)E&nQ~foC(=L~PF_xb=eW8eF6Ub9{6*`~+E-mwwc7ovS{)k>RV~ohhRpB0T&tC-N z-$Ur4FEmjPO8jOg&S;@W7(XDK)uaZ?eU71=5wGFc!Eb$Yd~bMC_4#YVtTe zbp$$jwE7O{I&6=#E=zGGqqp5X_p)GfE1waHa861BDJfzWE%mb~vHpch<=Xhj5wW)- zCuQdJGnRV{AqRUX%@FfvLXwg}Sn<$cLv_xryt#pOGU93k<=&VS7yF{6>UxW*-Af$t zkfxU=Z%Rea{r!k6!`7MGq!}iT#cIvsJ8t6vUf|aHD)9GQ&PhJMWJX{&9~LrM2gM0O z@U|`_l)^GE7BbVLr(@1NZUd{c2bVEz9$bNzKz5C31Mbv!bd5c~eBDIzRV$!08UqE| zZna~C1;-=;d1k+)q>hnirbM!~ixD|ZRNu(_TpWi-&9~4srcT`5Judjq@{+RNF1g>~ zDZzWlzp`HY7->W6Bwr;;|3WcrA~Q1#)g&2(AROTM%s#G8%e!ppEbn2^T{eV5)BT$Y1(}D zvPZMqs@Hm6CJH{WC&Um$$%T{STNH}LWKWb}6Y`-iw4}(eqAksN#`4K@|IV=P^DxV4 zI9+0d@4h$Nv&=LZTa9J|mvH6E$SzI}y$@)E4Rc^@>Dgo@wt(tsK`NgnY+pHu{6*r) z&CfsF<*jFJG~B}(tW&ZT1CQJjIPx?*m|*?e=#*WDtS~5o(DD8?+=g*kzY4QQ^2>RsW64?0}a%y>V2}+{vYT zw!?DOdir;*_}s#SP*l&!fsk7#vnw{pKwBTJ!$JB9dz1R`d3#CUQBVix1WUl8X&uiv2TucQ%eAYES$uejd?EKce)P0ZM&*}W5j#{U^PL|{X@39`Z3%zji!I*7aeIo zkQjNSLlKwl?A%@Fq_KFiaE?DjT%X*hVtqN;`Dywi4rBB8tfnuR)jIIcJzg1KZ!SD$ z%qB^X4^|o0Ytza@Vi{`Sj9wm}?^3J7`&UdGEx8wGSKXcqE>%0-B$f<^_eW!d&lz>a zAM(GZo+o%JW!_Y?efpcWnmh)&^O$&AU)4HN{2VVccJFRhZ+^0GS+J`IbBF4~1h0bO zx^@0d7LE44&4LTE@ZB1{)MfEFvncFMR)KR(JkRL>nD5u8m{B!ZoyJ_vrJsS*$5P`G z(P9j0HR&dLl$Xz&bDPZL*E`dC=EsA`dI=llPucE(Kh>-L?a*-3jg1?Og-ntaK0-1*Fz{39 zt*K9I_OmYkXL`~0$AT73*(%kF8WMF;=&fF~NM$k71%DsbwDM85S2m*`FMX(eiLhxO z?bywnsc zO?22fVs_$2God}(x}L2ApkpFI)LwaVnTK|DKqV4*{wujd(3MMt@Myg^Zl^2(x58RlZa8Q`gxi}+gyd&a*S(eWH^Jce^nDV&Oy@v&hIEBwQ-5youRShsPv1vhAgH3nVb7~gV zP}>fsW||b-AI#wZW|&oA79;RD%nbMl&Uz8*pH7~v`a=5)6|uW=f&zzDk=pELj6o2YasOb}~YG5<6=|$O(AbVPp4%?OpArwO4Y*u8d_u#ee?iPB(xFunS!@Az7 z!v)leN>Z~vy4jjxRlrK$j7#Ga599QegnHT;&nh_$e`IB(Z&k&er^#m+seMWAyW|H!1Q(>GW*Id(jfvBrp_bjLfA;od81{` zVX{D$l54=yQPRK{fkLnB|}Q7E-pFh$o{ zOp=~S7J!$O?{89N`z|h?D+rA^ft5!^_01}Z=O3`JV4-1pEug8vAxW=9Z4f)wp9NJ3 zUjF=vewjoayup))rMDDsw0C^cACu^_G*0m5+S4j$S+KsLNk=a5q*T#2s}Z8@x7Moc zPLa#yGo{5jjRjNt-3tHa#Mm3)ot30P>x?;WohD8mH=^mR1-9(`1=~%<>5<#8aIKS8 zceiVxRAXH$?cV#+?ZR7L(M)o7pBU;j?d5CKROqj8^SLC1WT6(zcNH8+!3Fn&`0*06%k93&xq$-S)V!x1 z&4@}-c#k%gIFk>8PLvD#LK6>{hwQC~cekE=3%atOd){Nc=^|4MuswgvY91Oxx?AA^lLLAgcqdX{+Li4MM3(cW73Wd zZ406)`tp*Xlfo;zXZTu(bw5zQq!N=3tO%2ua(BK+LI9`iW$K=? z6nHc8M8t&_^yMO=tL67P+=m(_P1$?EUs!FKoYEdGA-m*HyadVU5~$0z>og$ZSLU*H zC;ZspR3{fSkCL8)7?Hh*K%SYqSK)E`4KNCGu0mcGmusy#nD2J*Rc~4oW*QzWKU)?) z^dXAEVE0%q*_2*=GT~(flO#Cn(@?~7b|Fw88e_gLup}Y7fbEj{$T3^YO8C`>%I}3_ zZ4r&@(i+4#87B6Sh&buxj=qKSXGifyH}tfQUX-5>-KmgG%7Pc9^6^QW%s0f$C`bDEz zMhY4Qa>jpPv<+eDT+zu#3j{#nOV|@GJzA~Ci~a_5DxAqWS0|7NmR+T!BnBOL@bLwF zY4Uk=!N{o`BtVuS`s!3>5%!wfP6j!+*5DM_w~28z=qYpoUN4DWp(sb#ek zpODKxgu_b;imnX&aSO7H#RyiH(m$?G5scwc;|6C`{6r**LX~Z%2M!LgWqN^^! zzoCC{I;RbZy(ksuKcq$U9P;*TqqIO>W)f28$cCE?*xYUgQiMVh0kyyVPC?ko;xu6L z9dZY}Xg}@cI@!%m0}t%|GI&NKcbvcvSb5W+<${XR_7qJp6A_nkrZ>95>VJ)dzSeoQ zLn1n?)zlu9nxh-tj;asJ?rCIPosSeL-xDWkoqNfixKEpt#HByMsW=PZD4vv`rOJC^ zKG8VBg_;QQJ^A*Pq^(|Bfqr+t&x|}>dYUeg_>}9=6AnJ6NuqM!tCYRmn54Vfr|;fN z0`DDAYy349-{jh(BR|J8Bb z=ef;X@mTO=uS5%eDqKE}c5KJvIR#$l=AO1Sf=m3pcjkw7kmtHC-9EPv4OAeU_uuvMe-6|w|J6bx&gl@1XFR?iY>Hc@yDS1l3j?Ex z#VUz<=}{5s_U?m(9QHGGbaYf@-k7)YUyF*j4nH5GkBhTrNZB4Y!;kgy_Ww7^hadOT zu4tN$RZJ8a{vQIMZewvo2{Dp-_PJ5wAH^kC`J>gj*a){sdL042# z&TDJYC(SZ%6Zf{KV80jtC%XygnGqLdf4fU&OUv9i(EG#x<@Nrgbzy`QXbJl+SPVDBczY_sgC2|B>|ngFB#498 zQg{s{Pr%$wRfBF213k;E1N7Z9s5@{>6!mDd=MnG`bQu;p{cz{HZ0Pz;9h-5O-KM5X zJgx21K`#k2ojF-#zTGa>i#g3PI$b_YHZD#Zo;68@vqVxRt702>zd0FR7WRrJUYw!H zS#dDrVjh?J&`vh!|Cy0L{>pNA2YUlYhlk2SssAn4ENvtq!9dkC)zmlkIZ()sT?TAhL_mlL)DLx?%gjw|8e|xeH{ocq(6P0XKIJhOIjnLE*?xeOz z*~#N~$#MLtZ6^%HC({|R{T{-W_b|DuiDhj&HfGNMf+Jc5F>|-LgK}E6({eQnGOG_O z=?IwYMIV0Je1DjHk7c3A0z3$825ERSAiV<4#z_~YW>5PtCA^jg1o95b0uZAxevwe*oz!*#SzqHn^1-%J2Ra~KuRk0t{v zq6!-rjJvvZ01m`p{0=e8vlB{3t8J&z5go~1i*88kvN?+&PvKVk4$0KpCphZx*$IK5 zbPO72+qpYH+voxr^1-r?0TP!|Zfuf~96jgw1rDZ*FPO{hd6b4t8iqe@jyk(IY> zPNZU`8LwO$I``ps&`P7J2)~0ExO0Zp!=R!nXgLIq2;#*Lwzoy5XjAGh8_28B7c3bb zOy1kUCIt(}Vwdg%OYVz0o#(MOJ~9y=*`jze5J*5lQZwWQy#`%^BaFRJ+CKn zX8%@1QanJ7xXx)8jpQ>+jJv{=L}Cl6U*A=)8mcuZ zG$oWo@V^?}DvoY*icpc38;&p|u@qAEFSd(0Sh^IwT(`a!Sn>#2Q?pKNK!ma`8Au*# z_?F^v2aahODM!$*Bui+l60>v&0F&j8 zxfKvS^hjf>T_Iv9u_M$RkQ}OA9E9_Hp<%^^n{}P>;_>UlEi=iH zsw-k0on~F+wP#>dB%d{wy9y(bo z>M~b)9mg6;nNBeHNN7`GaykYr?qxDRT4APte1L3MO4XF`l|PvJP6_5oN=3eh-Uxkj z7v5|gVV3XuN?W`PGUvJ&@rcP*;per*nZKwb1gwpNfAT?A-`t5UetLFfDcU=~e7eg- zAsvt^X2?*CJQ#giz8^#F%h%NTB(vwpa1}S=BRwf*SU@9xnH|KW-AK#KEtJmoj{_E= zZ{8tqaBsMU`qG^wt5CNc=IlHd2k(ZP?zgwifk~;Scp`Yk_3zWX5pPSt0{GUjETye# zmNcV))js6G!e^XOm0oFt7ot;@6(%jHsctpV)R!}D&>vAbv24v|&R{c}dwsIX(es$D zN^a7~(U0kDMc37?W_cKi-e{?5vOQhW)LmI>hvi*clWZ>7#M-1i?~Z9sp7Ztz=V^yw z;|M=A+JwGVw+)ceHrj~(%U6}2KR7HRAh)rCbGpjzIMJ*qFt`tR+?;VV7Rh4fhsb0ehso0wY zy(Z~>dXE0&Ru>AS%KPL=tfI$GW%DS+d_HfO8!qa&ZmTx+?YfZ9=M+*E@N605H*c{S&?{0l8}*jn5LM! zMi&09N<+Ag>qUS$G|D=qY#WDx>aNuCBi(zVi04?S-DZNf1{82OEJSnO@ec$4sy~w_ zMNGWAQo$_bLaQW_Cy=y+Phg>BAw1FkI9wpB57E{6qT42oZI(zNk|^PvYn5 z0XYV+)%m(K2HFmvt4HzROSR?T1)l%t5Fej*!q1vKAB%ufj(~e4zw#vc9!T=oc!hJK zwc|vkdL~=%;ZA+r4e2;jlvz%xYoAObhRYYu6=0LZ`EIys7&u(qjU$J#nRk!csLupK z0z$?fr@r0MnFSCnQlQP_e_Fj~4vMCz$n+U^T0qBJr-*i;zv!X{3

J?U8`;kqQgn zkX2uf<&$QV{$vEOg=&_TvX_Enx#&?bocfkg;>dURa*kupNmY`+EkCWlc>g@v`vFGu zb%*{>iuixWvSViW?|f(N$%d;YxSR*nw*WR@?wXAhKve-$<~A?aC_#QCG6sLh-Zf91XUh7E)Zp-PcB!HH~OL^?d|i#{Y%v0r}ykO<&q#>)nCc_ zI@%9=%jTC8&XG8(=fffMPGzXh{gVs`raQrW`jqr8(K>2a z%3`BtFTBj#Jd9tek5hEmZ7=Na$z2R|*AMrb{j)76WZmiWk@xL= zl1Y^8ZwSwH&lIRy)nK?ZSTy=W6#Hh){Xo}oltYVz>Ury&4wEo1%C))8b zHEZl=4dwBH9ussBbQs^uSt9<~ipk6V1;6YrIGEr-E&T%Qy(_+U_8P>nTBu=}XZ3^6=6b=Gz^}S++ zSecE7dd9BC;}Rz5JctJwY=5)2FRqUL4vEX09rwUIEk>`I4NsP6vg3g9zPxGB!_H+D zf3k=AHUovP(t`X9l>-fMys}bZv|jx)@{c%xEVBQ^$)VMRVZ13|<5n@YgFX54OW?D!nJ#Se z9KK9!?<^0#evbun8KV&2EEDGSiCr>*g z7k_wkr=C_28%`&-3!K_&bG@_C!{%hNz2dG=gM$=z*u-N8AK@muHnPHQb{%wmKzooN z_F_0>8!Am3a6-KC|g$bsg_#TUH{e>`F@wrk{> zKO0<%vJy++F~}8^Pmh{TrCbT-sVofp+YcbxY=i*&n}-<+a<4XKQhyd7+F0d>MM`eB z$duTm)=F*>8?i$;IN2CQ(PSdTQj#^N%F`N%`A`LD5501=Q04-2Vowb`FBcAZN+-6r zibYlcM5v=wXG-Fe4q#<9P|<61GOr_$NUWetL9wr!t#ibW>W%x4I)jB(2NEo$l5B2U zQq{xB^0Dux!un|+WT3iU+{tA8KueDKb2;qWa48Yb$=~*aUXw6IYZx5c?L1y}a|aN= z`STXc9pO$naj76jju~;%IJ_VhzhrK#{#lB_SQ4s~NCM=E(89O)RNOUWvwLHUG6f6U z)=xQ-u<(ka6=`W5i0e5dX`5j> zqyZ7iC#9)9LWWhLp$@KUM1$jhFbBLK3|yKntxS}%ua>pcAKRVaf&x;(^DLarbo8J3 zoGUc?uJ9IN-mR^$Rty*~Q+0*T6g>a6_ zht)Mp-N+5i*8YmDq5JnEW|#y$Us9;LBWDB7K8oW*xZ&z?AFuMVX)}_G3a2g z?u?h5+$8GhcrFcMm>3q9e=nsij0wZ};7iC5)@6LV zPjoJTF+E&S!I%mAJ4k|$*7(xL(JWTH| z@Og2vkD{T8lzJZ1CHQ@x&`(1^p8f|N#rnV6y7r05uWB8|mbWSOm>pz+9Y ztWh&|+uqmEyw8Wc#Si-3zx+S4@_iYHaDVMb9|5LGT9F~Z#AJ5$emoEF-*ix3Ukux} zmJ0{PHT*wb_(sVP`S7X!XyOS)-btTbp@s2ZX}@E<+kda4E7&_$K~Brt?A+fmARg7v z@Nf8`aa3!m6a#{HPh@(%lI$wIaM;KW!eNHKwZ=AyD}ng3PIn|GW=7e)%XZG|o!R>KtY3^>w4xpi1qxf0#?(q8_aE`gSHO`~Gk-o}2N0)sBrb-Sqx2 zQ5vV`{t|(2A7{@`y~+nc`jYQ|oyD673UVsm=9)7HYO6Dw97+fKjU z&xc2^gIs*8#&5`8zWT67d+gydwcVZwmV=V}@F$8qnApvQHraiQq>*7ZWD(>vP5q4Q zHA}c^=(ScBNgRVkqby;jBn0Ij)J;9!!&=yb0@OnsP2%ki9+UX0gLoDSE9B9YVm_*J zeHO$pPydRe-jCb|Y^qr-KSy>hR~!!kmcaa$S|b%pwlK8!p5a$G)3@LJPw?hOcJy>ZA#Rl9+cyO*mD3W3 zMJh&2rk~_cJv;HtFO4XOjv1gZ{)pQ2k8N?YQoxUFGY$)4T_#%OxAgLsGj+vyiU^7_ z^$fRaBwxgu3=ZtBt{V>Hpp70e5buq{V@Nrclk+b)4nI(Ob`-dZhFhIyg2*#mI!udW z5!#`92DTe4c@*5%xrL~p2D;n7Nm9)NEUW$4q`S0KUMXe@-2*BCd8j4S^+OupA)Yah z{q-N$!J~Bh+^0qfJWcpfP`3mJO-|%STRZT$R^;`%W1C!K_k4Go>xAnzPOn*H#!*O< zSH4tr`5lPo${u@Z|G3W#?}*{aIf2qGq8py3#Mc>7LLH?Pwjv0xeOUsuNa>588bb*>< zxxri0X!@fUlnNnKRFhSh3aN~Pnu&PR9SCB7!gOsCH!TW zI=F#%XL&SEKqH7(E`FMMD$!xFwX6fN{!iI0k*s7CGHUPAfyl5G!ofS-4~7Z$PNT%hkF=ETr0!0cR9xWzu2wT&7L7z) z9`m^#so7>9!$LH$Vr*=!f*)r~bQ zW0oC79d8RCQH~2BfPAhy?kOGF$b%5-^sFVsj0RL+F-D49Sm)ZzC|r{#R@)77@y@Y+ zqtN6MH=sCiCp}SC_ra|4`~aie`aiAXqR&U_i7c|%*JrjOu!7|R7G2N9??qT@iaf>I z0J4Bf3J~fXT-hMwtF7Yw(f+L+Swi(thXH{N zjJH4x($JvhiL*z#>e;V)HiO$w0qMTM?rY8fI#6mM5zIfY+XGZeZH82@(~{7-uG=SK zXMpEpY(Px=Mq(-$dtuYr5Lxl|EEq#W^RfdH7zSHHE!r5BQRcddg~P36HS{^nntq{^ zn8VqKrORb)I>KIQ$>VhglRzuUyF7LrBmy2Op|NJOPx(1IT?*izNb!An=p#T}dyZqT zTR*-gb0A(r@raZ)pl$l}{J;M-EGvf%Z0DL>nZ6el>2A#-HF(LgWhMEHUO!L zg+Lp+!*2JmBWR%Z(diB{LD-pp(N}~6T`c-6c4>cTE|Nr>``h4SH^jrw26W>*sye*XCw@26to!EABYwd(msn_%l}Qfsn%h@by$AIsWVTC)R(&6;74NRJb6)9(Wx3q<_+CoVS!pZVaHzMKfNP3mt(A~-f|C)&GIw)_A$~nA?!|^ z-JCZ84bhYxediS*DQ)(7-+R3{&%DeU)?%>W@g_Bx;XtKb-o})CTOjLbR$X39%2&y~ z!3928rG{&($JK5kd?*(Q^p9q5$p9hz6ap7pRZ_jU7!VL5==F$$6lTK&D)YovB-0$B z-H4`B#u8Mk1TQ+B;y7e6{?B9Y!u;&KJvhSYfCb%L%rEXV41z7} z)7YTR6d<3Yxi_ZP7WC2k_50P8cS@A1?(qP1eKv{36%|kYR10LkA^siDppSQ;a*0QT zJ+1zT6qcvlC!Fo<9Flm{2<-{+>Vd#N5v~(wDF$@A9fNxv~VM_xg-ORCn#1OlbI&Dz z*Z%ft-)6&5Qg>X(x;vF#Hp(^C=5%=(_bnV4!k}k{a~ffDNpY z{mFE=YD9Tewh-YYn7S!3wk59yr?CJK$N{a$- zF9TLh2?UVt&Df#EQl_|%APG%@tY}5C+p8{8act{2DCT#!Bw9wraz;g6&evs0_bqu_ z$h7cWR_f<=@blo{8Do+@XUtf>T?=nmgQ%!*<5wRm`rEpMxP^+LiuzFaN@s;x#9J%3 ze#0HCQTK%TiLA|BnpCTn493ck45Jcz&$#h7V`P^!MjM(PcS>K}M)nwQ(W98nK=N$I zWfcpolV7*v&A=tm;ZQnWvd0F69(tnHaXrMw$(|T6&dhoV4$r%~a62l;-XCma82e*j zk}*#vmWmIS#o1t!-~b6nPb8h~3zMb(9VV8VrwZ%jRZRKkrNTWi&yFrSnIxRAKXUhj z%jF(@8Zx}#PEW>b)My@EH;khr*iX+CMJd_HjdUajL1#E65N+`R_KGiJY5Ub0djH?l zrM3ObzrNC>5|M-%gqD37XUeAT5Lc*}5(BK06$txpBvXS~EoNh%M+?$A&0{AkiifJM zyqiyO8hC1sLxG>r5|-^BOljYr&(a^@bK5k}|KSzD_P@&)u(1EPe8I8SWX;k4$rs4} z<_p^9hy;uXxVhcXP3A9ByXw)O$$Ik+lvPnm?51@vAOZtIJ8TlERvuIm25*BfI6jes zl7bp@V|?8|!EpHp9wuwPE>G_Ucc%$B9=4+PopJ5{6EGn7-3o%soAvW?aOsu*-3rpG zLF3K1qay1s&>dML9sH;mj6eUce1Y%%Ti9`e-ry@Z&m_sCc(%3h3$Gjh#A97Ng)=V? z*p8{5nmpG+JUQU*0;&-ZyE1tHqf%}y4_l2 zNcEr|`*D0~VfH;F15F~p+9T)!P_7Ej2{&w#@gMlChq0bil!s9cJiB&a?(0!3zK+s# z`lllpwX#Gc+aZv7GR4`cn3`TSD?vQ4f>vBbX-SY_6uhn>Msi3*id;N2JW%;GJ^pUf z)G|U6^;Yeu#(I5)c+}#AyIOzQA(6ZHSNke2N_$?%h`pubVj__=Zr$180w9E4sDJ&Qcy|G22Hkz@NW?u&x8)@S2WQMT-!eyd`NQI6J*6t7Ib~S) zBQ;~zj9GKQ_`s2A#)`u$1z-P=XwK7~(VP|5gv6`ug1pfFHPwNF6+313pulxX@}Doq zQm6-pgzyvZ{DPQEwfJ8eZ<-pqxPy+Vr1P*}KUlD!7OE}(=PsJz29Q=J-tM-lyu)z# zV#G2`*PhHID)F~_l`jotcmfK#NDD&z(iH3Nuzg3x4zJy0aRlwHI1oFZQ z!H%$+U<-Mp10rqi*$>9iEjEi}dYM(_salH8^_4{COei>EO$c1jH-na7-DWrhWN!={ z{wr~OPI47MUCgEbc3?nmNwZemnKb?gi`-LU2LT*@b0# z3UPWmFhr}OqR~-s_7a#y9&R%_9CoXdk%1xs+TgHm%a0>ZIQXk?!h-HFw$!h~U3oYk z!NlyaT+TQ!Iv)4)oV+L4`_-_(QMm=5A+;e7%BQ(T$;wbhM;dzlsmmQ`-MD0<5lm)( ziYzt6L-FrG%F1L+$7{wIs9m~CJ{_%(edz1W2^ap^mUlmIDraT1HL5=my0fdC;ARVh2c`_l9>QAQh5yUGQU4$F+8?cv*%oyNPrq?t-2; zfW^S1R0i#P&TTTs9B1;?K-G2l|ICAYQ~Q$_>~=N`$jCc*DWL^CY?g7a%4nVT+E^^D z0#L3K^=oKP6h;Oi3wwKA_QEhO;C^jESo2*(Eqek_S#AGGDQX)D=!j((02?S&cAv9l zbt+Jbnc#L(N6T53)_Y5JnvAun6Qnxn1lAu8v~Ub#^_wo=o6PXf7UxwA_#k@)I_u*Q z9i(MLhE!PsM)wZ^K)&f4&PFtFqqW^ajYuMAtnaP9meI0{r+#)YU>*`Z87gg|!7kir zS2ad_6nBiYWd1JA;$Tr$WBWAOp7J9$YTE@dHVbVTt-rcvxjwR3P_U$PH^5baHmXp7 z5hV>WlhJFxY&MQf6zww_jTe2Dc$!_}w)D89JOFTZC@j123Ucq1k}Yomtf##+wq+Z>S+)Qmz$0q37fmbd;)QA;KhguQ(LU0{Cl(xW_6@lsbLUXbyI8}#>-1&^?--O6t> z1efsvhnUK_u1;UU{ytc=qjhsTjiN<*aMA1C%q9O)8g}z!UWkfYGb1$v+%d4z= zTS8{ZD0uvH^y~$=M3=SLB#!r>C)2NJk4dp@Zys{vg~(MIRa2f$PL|L|6=i;q5_Ru( zuiGgY?dftCXmeiY(s!{5_x3?7b(bn^fQ`66uXEfItsJK^Q z+mg%@WN%+eNTiAl-S{tCU=%>3A8VcpDD7<$Z*sk|43eMlWVK|sf$4*PK2Y&LqgQ*` zUwVDz_&-g^$g%dBj-v)Kb+tx6kqZVfws$uuqyV4_ZL$wai7o`T2#BPEIG6kc40jpos{5@NVkmJv}W2@ zm;Pv!olYWkwK@+Hjn?^*eYh+=hOLwX|04?K&D{oJwww51QMK7lvsvfy#R*|$MUsx& zhQv-?ZWaO&DvGK-q##VN><&9XZ0d=0EgI`ocM0;95g$bJ zJ=qFu@u>|OFkH}GRb`mdtjPThL~3gAOM2Ac0)cEx8Xox)RSKbNn~7YCU@IK@+m+fY zPHH+XBTQYzZ}%`K#twQLAQ|r~e7GRyu!<%G=_U_u)*(Pcs1D*K2N3NM=6}JwIUl{S z!)(yQ3Z;FLxG9Ova3lFK>AM0~x5qUQ8GIjOeKiwFh{-URp|2e(SUNZbLMn@AzC;B5 zO&Q*|aaup+MQe?LB=X$ z-5a@4qIZ3+3x8I-z6t^1Xkcse0G@p$AtC7`g6_Qqb;mA};`_m6tHp95Bfp;MC>8rfU*( z18Fm45)EDZ$S39^d*UWp9vh}2x?CM?Pe)R`J-Dn{^^G6)RU1|!SVpa)glkIrkt%B! z^+p@hBip73^L~F9vA|_2k*3B9&{RQ6SNC zYFnn(&FlE!_5dwDGJiC^y)JQI=#v@)%|vGPz#4^Sx$;Z8F5`3O&%n#7zI8m!#+KVW z-HLKIOl2+sj50zH8y`s1=J35A;VjwKJ+mmyu0E#}V3CeDMF;sG!4LOWAp(>WC?YtG5W?R;@Pj}z!)xq3Trnbcuu_xmyn zEkmA51R5?~)4AFUFPPV4VWJMB3ryj~@y!-+X+IN-99Yq_ZK)S$Th9@@zYf??HzLoD zx^D@uLbTRfB+3F&7pV1UspFn6;~~`z12vSgfNQz(npy@VvPu&7N|x0varNEv&>?i-0w8_N+&Q*vz?}X6H6y+z0vg3#$RO^oII<0y5djvkD9(Gxt7%- z>7-980&Z_ijEtS1X5%ZG#nQ^uTcjGd!c?eqeOMvJXs3^L6Ka(SXO4tdj=Bt$atmNM zSDlTveHG!~{%h9KuUL0VCBOr_qR5{tz)l0X1he8ZdnYNbqW5&U$jkGBL~Agzv`As1 zoGAdhviT4TA=}?xP@4RrL?}rlaqK{w=&P^n9(aWNgcG#cYiQQoL&wb|hdb3eHsf{S zfD0vK4A-E)vt8X;pCE(p>ng?(>nz+2rPQtfM2SM9=ON`Tt`8U7_^$mp>{W>2Xs=uj z6YhD`9ro(x3)!lp3SB=p@<~%U1&g^)<_T}9)eC64y{lv%C(TDmuQH{Qj4I{RAJ}Nj zS9gH#d#{Xurb}w&JklkxJSDpA)|jQKu`CA=5k>V@=ir}EBT}JK4xOFB9z+83*E30`nEv^3I5QoIA#mel=P9OHQp{+}iZ&=sO%pM3qu2E;$%cToV5QtC zd!UpLD|tOxo{6PpU#OYAv$}b1Eq8?YcQO7@lb6Q)nWKp}ixd8hwOr z`V@%Jom&DE8cP@ONfGp>?B44#s%^@G9<_FD-J6@}6csYhHhdvYara54URD7*|AVne zMGao!x-+<}m}gfmoWj~&D13p39;uM;(a4js%TeB#o~(lQxuxSxgXoe9yDrNBc1`s1 zQrg=$h?~=XW7&=qkru~_B3}4?<<#+&-otu4cMVhKg>+sr0BwQqA9Etbiu@SWMQ&cx zJTNn`E8oKO8c!(K`3N&mzcBAl8Ga5gxbX;3G#AJsOdnnIo+xKx$myTcU+%S2`8>1E zwV1JcW^PYV>BbAjn#jfFtn#AG zy0K#6$gvTU%$vj#X$F!sI;QK?!Ogn_Xma1%@}h#@=H=h82XvYeaWt$u&SmM>RIOE# zbo`y});y=I8ikckLhiT0Ocx5&Ydo!MymL0(=DF{)prsmnZm_cU&6MRI4bq!j#+&?= zlOE@7!p}ET@NeE2L(LQ%xChyfvOC7=t+&LgvGx39@z=R!l(@nk z>2fn30nkK`p#q8hsAtxP+}mm3L7)guu7d`{qwpOZ`(NA-wWC3nA;x{$57yP7Gk5Qw zPnVbAo^yJThtt|lubTd__G5sv$Kj0YR_@|(MNJCWs5j&FC?0q)X3go_JD+FX$t8HM zHRgJDD+8Q#5<-131n@AxW`r>pVUdIsOS20!xsW}6MSvwxdx1DO)) z=g)LkW>WTQ+wsTW`(I|!j__}Iqvy+(0c-7)l>wd8yq2j8aW!1YLwjHA-Y2#EHf~q$ zSmmY{wg@f>_gmWO7h(Bp*G4-R<*L6@j#{e?Tnb{s2mh+kJEDmIn@`&IE%6gY>sPA;N4#kiU@ zVh~2Zqf_{X>(d?oKf!YQ^{??2Mz+nje9;U2A`UvKIA~$Jj1@}~PIh3(n4niYMSMM+ z_Uzo;T8Y#(9a;qMOR$3cH4Xk48@7P}DQS9~nMv~5$OW~+0MW==OQIT@()xK1% zl(wa+R{kZp(FA%@4$~CK`v>K=s#*3Qf@4_?GTf;Y zu~u_74X#$?5Jjz%W<66}-8L$EVC5e=z26IR*Vag42LdKqQ9WXVnC>WypfmU^Fz1EC z-&9rz4x%=$t`*|T@h#HW)cj7=#Nz^6vSSpJqgTF&vPi;duC$b4RX!&@0%{@3 z%kH)~l5``#`8)3;BjhG3HcB1(HHdlTOG&lWxUAx&l>q&5o=V|LqyfWz*Gi@_?IknE zv6X2gB2T~e?p7Y{(Nv1$sQ}8zuaHSV7mIRX44i>M@(@o{Td~`vTjUu#c>YAIt1mUx zAC@r0)FX|z>qYM{PpkNkc1Y#n3)n;oS^G^7xs`=%ntVe^q5fsN4~JDO!o!~=t(g_? zQ>^ho5I5yQkYFn>!l))D?()Ox;U{Phq&@uz9A4|eiKpg_)m4|A4<@5_t(K8p9K}Fc zd~UADC;rc)Fo1mJ5De_%uzXUL2)K)ySfVi&EmcM5$XBXLXERKx(EE&w2|d(DVnuXL zz_@^$9eSP&95wYZlwvHmgc3MI6($&D1GC7cvkU%k1PC{3Xa&J`pe{moxCI{gF4Fj; z;Xi0kt+fQVLRtYk@D|*`JFvDt;Acp{v zTwn?SMT^{DMZBh5Ub?koZCxt z49AbPU4r{}DKoqZI=6+}`0MumftFgs<=hY|*(Ej}{P01LD$hSf0mQ=O z7SuucnVfyiZYArhm_IhCHS%Xi%p5Fgo_Wv>m;|$0ua*#3r9PUMlr_FvefvoKQILYxexJ!WSpnyif$R=YG(1q+Vx1SZy#5-h^v3AKId>)}ba| z|58F{%h%MWRr&?sRQ=`zc|a|_a%{&kxQXr(0TvaIGp$}VJk5U- zBs8v?(VJBpq)S2nl2mGz$P?>z|6uj*GHF|z{h}I5*w2~*HpO9r(laqo>(e)!2xJA> zMmDE7@_}kdYqZJ$;x+|a>;}*No)eFI)?nkP@cw^{y<>ME0Gn-DNh-E&+qP}nwr$(C zZQEAGwry+jt{&W8(;xa@oCjxbwJ-N=##S^|qXJ4iWhODrTSt!i~oJXG>Gu3snnbI=gv+{fd z2eZf^;U`(jWM=;h16xLf+Rv4$Jm{CAWW~Xt5>jjpf9uX2VB?(Ac3 zJhl*@U>Cz0^bp08BbUKTjdeCLFP2n@z2Lvy4V@&q2k2`(WJtAPg4>+fypo$ZbOB7g zWVpL%DPM8STt@?QlSsm?Jq?G~e>o7kR_aJwuh=1j)xORpK>kFzx{YE`+Wmo>+UTO*ASoYu!hYmMhu zB7hCfNrh4V<1ZT>jvj3cE}nndcLqA&iMt4xuARLJGe<=YNvwBQ)6B-@uu2!Q0@~FE z>|88=v6$!Ym6Fo|DMwEJ61GNT3g#y@t87xvmv{p2dw0}+{ z+~*nYNW&;oYeZq?a>SFjk8+?!VV>x5bgME}O~uPImZ?_+Q++6C%PseS15gNbQX(nk zBQX_X!LB5W)UfM5YE)Y=e7mIJOrtr`LrE=Z_2f3RO4>1|KScTyicORer>kKc8tI7R zmv%I&aZK~V`OHjb?x&^tL{qvIUk~eQRN>o`n|S`GoD(!j1_Nh`=dFXR_Jwzs0+X&h zZr9L+qGjq7lk?u-j*x}1$ma6TX*Ed7W=fP_Fwn8kb2+5+0LzWg0-J;Kaw0v|@Y8$r zY%OkSWv8^@&QFoQ{4fkw^J{4I?F?-<4AbPV4wO-=>py<@R^A5kuAFba%Y9^`zX?Ag zQ99Y5QdONl_o+VsVKque|3kQD`(JIy8R^(q{!g6iv}Wh85&(Ys3;EqY{>|r4APm$h zB%9`kNl2iIq{BY63*t}DTNyzlQt??%I&)NH&v}YagW9a(aK_n6xGdG@K_YS@vyY39 z$0vf#Clb#Oht|)d;roH^F@tI%gp1HuQ0mw8VBl4J@5l@8UgK7qhpeG=mv`s}EEW#wKHG9= zEX)qDRHY5Y+@HYZhGUf8@t02zjFvH ztGyU)YYry6Jnc3b*CD z_O0fm&0hPTK>)`wg#-6zsGH>iYv4ZA;l&PUB9-aB2Bp6d47~K=k;o&*P7rKeW@T(6 zK`L%=HShLFjUQ|eFi~o`cIC*Pty%?HmR6zk`a?tz?NxxTc_A87)eoJzx1CA1o%1F6 z%3BU18S;57;li~}L;%8GScM}1VHi(9E)g0(Noj;NtyZjxH%YR9cAiyN1Ll5X=lz_^}L zypUP)hYU9aZ0$}C(W5Gi^$EeC*>du>m4BYkzlVJq&|5dq2{MlE3X;##l-eWQ_7T~T ztDM3B_j`Ei8*`h{%JtTlU)yw!?p_` zoylWVpkhPMf18trm=0qZ0?XsWM1r%hXCAN=bn%S(=@|KGvm+v47dI~e*a}1?lhC)} zf=gCMCI^pPd5y>NqeRLrN$Xa1(yaDqJqFmH74Y2 zTGNJ%b|YIAk%vZ50{S?}d2L3TG%3U@GOn&X^tq%Umso(FpO~moLjYox#>5D9CpzUYQ>TAgaP(Lh< zs)jF6?qM3?(^(reDb=)1f(Bj+N%I!T$pAcV+u1efTeRPSy0i9Z4=e9OF8IqxUPtl|(6kMDTDMqz6NrFq zv_LcAth_4!m)3YXCy)befjiGNTv#>|JAgh(0#SODjmx9}B11?x1_8^0ztO~Mw;(=q zH-=3pCJ*F>ZRq}GB3wc_Hze?%bK`n)gogV;lJ~sE*)`yByf}3@K2lDqCKiE3VoQhT z?66mvFM0*jLDm5G2!Ja=GrvL@8vOo&Te_mSib-stnLd#DDt7nyERwJdKt0K`Ya9`h zwh=Lm8uJ#xg;xX2p?1~55G=Tz>h+f&`o_(BE3 z?~ip!EL2JmVH;?K{!FXo>F5e*?we6J_CcYylQ~--ST5UE+^hFf!9|**n%dGv&mpWo zrEedZ=E-O{!I0pINdA!;(jr0Kx8aVgnSHH0E#^1v=a`|CCTG%Fqrm$9#>H8jBx7#f zway!}h^PvtmeR%4j2hbiL4BmJh1gTu^Yf?)VwzIP#g)@*!5FY@dX;kkxs=;{PpC&=K>Y&!g z;;zEWX%3)BNNF7+i0a>Jt}C`_WN1$jeu;{ip@e@44SJ}i3^W~bt1;TQEz(uwyt;W%{hC*-uhyPmk` zsW@Z$E*w9;pJo{~P2Cud)4dBAt|i^~>lT_!&N-DCw|7Tv#3h!tlIWw$EEyn%xE`JA z;wnO;{%5Qx9q)D%1!lg&{fpNVioc){Mw(4|j#PFsc!Tq{zgcLOu9$_n1Pj^t6$PhLj6Pom_%(mbVq7YPsgoBr+#lgxdBd9G? zuLaUDfW(by{}&QhbaRWdC@sfmLTp7`7{n+&F0;?G7I$t8g^4MS!#$#Dt1mIO@H`!M zcb;`xG)vRh4*Sw?i&}uN9D$nwDdNj3h~6x9xBqG*%~W`)j43fECpgDoK{u|^ zqBg0-g6Set;iA9bXdN7pZCK(?F0>e6B3}lIXw1-oSV`z?I9 zEqyOO9vjX>-G$*VPV4ayUu+}JUaY0(OE1%C2B1)%Oko>}tA3wu?E zA3FJ-!Lx}Y?f`QQT1V|Vm7PP}X9Of?P>bX&aqkj(_E@*yu>Yqgy`E|of%3>8{lmlF z4f(X&@$Q9VPD*qA&MxQ*IQ_8W&ln}b|&aJC^6)UWq2tn}6% zx{qQQdEDNI4b30zNeh9y-o|dKphSyGYihEOQSMl)Krd)G)2;nIEqC_4=2GCAsOYdZ z5U%e@)-J3EzY8o^(LWf%Tt~bw+L5M0OR3wx)hR!UjHEdL)of@E4|D=x&pX&OQdL$x z$P9VT&$_6_^@PU`MOyoP<_D2(t*nWb%4Ogrr-(7qHf>fwyaYMnd*N>Nb1FL^v9z0w zyh>8EpA!g`*>BD)#!MyKL!v`lRI2jQ_+yXF2{X(ViI;Zi^u(-ttND9btV>DwtaUDx zV%lIu&R(aV7!1K%Prljc+3NitnP%r&anEbeO)o@wN5=8(PB$U~FIEe>de3NE=Mu^$ zEpPNJ+>y@znXT66bvbPXHvYl_Wqj;)($#x#V&^IKqdlzL0m+?!;PSY3V~YXOKqaWn zH*fNnm7I=hO*#hSV4b<1dLOBaN3eem{q)?Sxs^P9H7+LAr@n&Ha=o-{UQ1ADajJJ&#O2}((`B(on9r&{lF*PpUU>8itbHg~;vwz|*zOTG0` zeIHrMjLo<)D@#}@-!7HdOAhW}Gv3c)d?{Z{fHTo;qawr@^ctP01UURX!FuEWQkV39rUiVYozFazfp1fbrOgY8qLEsN>eV|~? zMX5jWmdLU(wsU_x5IxjQ2oJvO1a3@P&g5qlhCXRAbYkYUYO#jyal_gyj0k#(xp=XIJwUPU*9kNr@vn}g%0wLE-8D_O(F>s#<43PFUrR~ zzMj3!itRu2Q5;e(ue599u>{{=A9`7sS4DR>KTtndK3_r2g>r^qh!EMy3dbDAlmnm8 z)4i)OmpIbJfyX23`s?b$fX!$!I)r11Bb!xdytNnX9yG@X2M1Wlf^QA>8H#cz*kZ|Ky8So|3ipas8Tyb-eW%};R74W#t z>#X48Tqq~{Whp*Y0wKc?-L2}lDFT8v%?CTK9PXALW~oP%XL7g zWBQEt=42|SE65Z_Wmve=WzFho)W1+00RKi`g85CLrUXzd9(USV$nM;}K@YLD5t&;Q z!pfkP0c-VHR(2^vUVTQM?i)=@8m_^Rw=?oleLpth4wywlm?ty1B+Vx=D{~{an5Q(D zH%-iSWMWA-I=hn6-G7d{z{eYnAi^b&O;6j4Lq%cO2?362w5)}*9%GdR*9Fo-S0~8N z!y1%`QQ=V}s1^*Z_=&Hs1C|&h(wy#{faXV+D_OP=PlqlQGJ@sQ+~zpD?B#URrvht< zH=yIAUnw@tdoBERA8Q<648Jl~9>c&Uf3IkG!2H{_MW5UBqzx?m9wqYNmNl<)TS(Rr z*U9)bFAx<^Kk^#qqXhDnns6vpDP<8ubqD^Ue6aHY8i>KHLEg!~QAXmyGP#crOj+tO zP^6B}01a;dFEF4cuP{(5)|cVI8==6ntR zZpGV3&ac9OFS#HfnZ)eD~m}MuRGklMOQ6bbf zd7Ky{{uV4)*trlJzd#Tbg@9ps?kAO^h_ea`CF$fu#Xa}6wd1Qr()WFh0q5e^cmnZ2 zCMki4i>(s+0>dp)iK%k9`E$RXOtdC?C^(Jzf~aD^gdPbT%4eUH*T3O5H<5e6uu_7Q(LoD&;;7vC2%yqDo1I8G*Tojw1WH$pVDA@xurmWB&{>k|}R) zpD_Zs1eGBcEx2NUtJ2nu?~w=BNj*@Pc%zoatRjeG)#5Ew z!bXfa#5qKzp=S^@EXOyI8@&s7=s!_ZMW)8&;0b2c+S_m2`_pY8)xL5KpE!rlQhZ_O z=HB7_LR6v#tLV8}kaf7F(aj|3Nro_8!Yfx$_DmM;5bCq1&Y3SjZd76q$gntm+wW@S zrPi7?o?U<~f77CGBxAWmUXxBQVzRFa=%OW%_(po2b$@>H6lw{tUX+ToNXA|;V?;fn z@3s0tHSnvA0eHN5!zEmrNovK+Wz^5uYPtM^YSU|=u+}TM0=qPD$Nl)mS;RI~pK2kk zD{7jnvO~OZgZF@gWca7SFqNSpY>3W-3qR`s7u3wPR03`2%*6kRmUA4PU>QPI6p6jl zfBnPbRyT^fjNk&x@?VfSrS9|&3h>Jod-6UTyWliV*4eni05M^6P)qY+qx|YIk6~ zf`CkD7O)DcZhmVy(n&W~B^u}P8{E2}XBAUYF~h8Ve4TP8CO(gqGiyi=8GvQ@I^IuC z>ZG?OQZ{`HW)RC$VSP#y7oJgW2ow_zuE+}jkK4^oo)(``w}pz9s+Xa5Lh$T^iuw3V{c9X zd4Q8Sd?w@+3drGyVK+=@53)~o;i%*zd}pPB9|>P1PrkxPi7v>j@+M~qxdd0EMvX-! z8NEYb1S#xPv1#i{^r-204QhV*Blij=I_2CF3~5mmhvlk_?`$ovq=S*>BApYj5I~(Q zUQQY#f>*`MwAX-V%K}|b>zfa_{ImpPr#@*~>q<&Dlh{3}tFjqDjStAk45>hKNpqo2 zH>ce5PP?V!seUB&==(6PoRmikIxr>KkiFi^%)+AKa`z8Qf^oCld5ysUn^UP8f5wGu zKOLyEDyXN7@+xPRCHi`^MiM1h&!JM_Jj z7w^Vop>@j!W|Fosbcts#Yfk?f(g}x@wkpYcK9Z)#QquxoUI{EpDcLZ5Q=cMqQM5sUFBIavlJ+4`sS|2uQD0zfO;f zbrg^xK`6EDn{DQEz8kK+UQL9N-6As~xdum$aWm0PNsNp6cr?F-Zgbc4c3zxId^dA3 zyL0_~O;=2)QD9d4WTj1NRn4wXC9whP3vwm5Q*{J_RQ zn5_g4XCZXV7H~uecP+T44B0%X+#UaEY)5z6Qe94+xO47?PC1%rPi2eJ_1ymbWx`dY zz`eDa1*)@rTW_c3^XE%lSDnK9b(}X1Qxnr@nbC;{b}=M-K}&WSk(4hvblMGASDvKrTZt$EmQIMH zrKcJJ-=8PiA0TZ0>eTSTt;z|2JVe_jE)HU7UVK>k|^7!(p(9jaZ+vr!0;v*h{^<|WCuH|jWndeJI(2lv5n za7_s@&$;_K{_m5#!TznRl#I-b2g}FVHzn6Ac#W>iORtxd?|0^ZIo-Um7BcCi>{-Fb zgOV3UpKD!fmYwGSuS1V4RwBWDBZTeRZvNwR+X;mcOkpiIazh097(R&n%K3&mxUsv6 z{C8tt10AdCS17Y~xvl+68do9ZDuc+jMo;ZjBieN8ftBOd>{ z!16&M;jn)v_995a^Md>z?D7t-Z*CLd9Xs%V@OZlL>kC1%K)IT0+x3|bqW!flFU~pn zj&Ek#ePjB!=Hnq+=+1vh-GY067{46f-?|_gkKRXRr)PHt*8|WC&-QHv>ebmAynN{tjVO+X)#jb^6AQ4}V|O78EpJixB7p&6%1ipFa#^@CE z*h~F3oEI_y?xqRqX>AfBulzb?UYskbbV;QhkF%itQJShW=lK}dz~|IW z3J$7>5u1jFXChy=5?c(v05cHPcJLsk^kvV9tQmp6GWFo;Uv($q9cmuj$ron)oBo1sV@gAbJl4^NSY&h$Z-ovO%6aDrGXPg9*)Z zuS$IeG-o0Z7D8& zl`}>vQ3#7_y+5}hq@RQClmc|9`l+5U5vVhdA#p$APSa_iVzP=$Rgh(5>=i;?e2-(Q z)2OXBU3m_J_;7vxJ%+H4=pQMs=BfeaKHYU6JJwx~=#fVySLtVamC#+X_ASytvSFuUlH4AU81?)4i`=N89m_P&51W|#cm2e$qhJ6s@S z4+3EEFTa-=#Nro|w<4IwGBw!8!d2^8R2+M#F)O9M`rC`d9lqyk-x_1o7khv3=2t2D zn;ru5*ona!j$Z|C=bea)cz{@H%5+&(glAUWIy7}9Uc^fr^`hY%b;{VDbT1C0L0Ko>K;3!TgJs3#yEX2^jzy44pAeP@KR;h6=4(N=yPtB9Dj*g8< zdoE|yW@u{gtq6%ZiD-Jpb=Gn(V!Aw6E7n+S?Z@bi#%GZ6R!798xHM zFK=Adl(e}VAzXNIMp%a2XF`Py@a_^$+NI3VqBduj`Y5)9(OP_mz)O*D6SP@2v;I{; z@X65E;Q+@0qd8wJ7KT|NBY+?wJ#vK1tX{Y&?t`n|4oiY$w3Q@%de?o_X*-Ai+z6gM zA}E1qJ>$@=cWQ%uRRI5K&AkD3nK6!)xk)jnmI^Ap9|{2{rE!jtM)ITf4bM439n zD@ASZ-te^jj+d!kLQr(>G+E{#knP3X{BTS_Ix+=h`=hLM9W{Sw!kUJiFaoOjOU7cm zwp2PW>xVx-fI76MAgOv06LnI+vcCf97`f^=11jS1Jb1AhKx4h#rG1bt=%}ZUS3=M| zZ44$eI~xDKWr!BQuf*Ze07- z*R66|>|E$rXb`9Cv+RO}*`@J$aL5%}zDbCnF3HqpG6{TeTBHs2=dxfZRHvg-xV(F_ z6O-AucOK3{f}lrCm;;vHxsn;&7IL=5&{KZsAZbq}g7++xd|oW_9!lOY2`@WotT-H3 zyiH3oER|f}Z_<#?DbZ9!GS<8So*iXEI%fZ93M$AED-d01O4zHgH_rRCZY4`6;+oh+ zwZDY8$b7T~Ek-v6v6Votn7t!YA9gNg_`oUn<#XYQMGoKNigSv$JLzlp%>meyB-p!u$S z6rE6vAlJ(Xept)GP%9Ni4ze3i0yX~%__jLtUuN9pdqy_Pjd*>9Y{`78hXOm^qzoU7 zq6Aci1g}RHpCr&!^Ul)U-0P4471%J*!05}`!UMVOI!1|OrDSLN1*hH&$R4IaL=S*u zYc;RR-D}%q=5yVqm3)B@d;F94CT}j-``xk&BRg*$XiG^Cn(r*N#bwg) zu0~H}@I6;fSbM08I>p8ckhLmS^M*AYYn2oHO7~Offoin&~bP2Z%SVbEJH-;cFs~w(_8Zs@?CN*xo<9n)e7dWD^-jon|G+bJX@}tS>?eHS;yV}PH!s(UWzR$r86?GtpBkoV zzPGh1k`jR}s(?Fkt!i5YxxexgCJb7hCJ-3vu~F7#&om~JMX@W#ELF%~_@$)>GmZym zT*R3}A4bXnci~xcFct@86$M}@Ms+6=X=p+N5}|$6z>=LyhEM9th;`$gT_hfC1m0+j z&|UETl>uk5^vH4L4&U=S|Cr`4fu@gFQFxmRY~0!UI^q3--5VgL`Ts{oW;*)+Rb*sg z{BL05W{lRD%Q5;D)mzYzmF+)6e*v99$vDr90|Mxa5VY+i9zQCsD=b7~Hn{csi9@Xv zx1S$Bh)4l^9qujeX=d!7 zd^&k#MYPFE`e-r3!adQ5WTz|WQ#}7*G9ULKZl2sz)PIL{Hs~=p%JdDg;*nx9?x^kI zoxj4GlY^4L#X4ZTr#{zkY{dY@bf)vHwUDS|=a%C#Y@R8zuxrD3iH;=9tKC{_!!Lrx z+GPuIr$y@&iw*VjdABldhL^j-r&W-}J=um-fh=}p9DEV-QaR=LbAN!J`}%9NyFj~q z+!-L{g?#> zveG|@0kB~N$b0_FWET+d59ajJz|mf--v{tD#P!SLRHMyx)uw>%9{Zsy+j)*k!r2>g zF`5B8CQ!qUfYsn-lTcW+CU}V(k9)w4%Oq!365QFeiwaAB9{jpy!1latydH+WdzEzQ zA5Tp6;DQNRDi1x)co_rA-SrvL6YuwZ&ov@{2W2iy`yc>g9CCpar%7G=C!!}N3DjgU z%~IpYCR_Iac!=bN+}rewe>3Lrqjl_Fne^KcKBm=c^Q`@v$FwU2U*S@9O1;K-)x8Uz zDz>U)32r2Q^foFi2!emoebR#(%0>e91PDV-s_~)0q^54SUd=IY7kd0j5pUd7 z2%D*FxA^!oy^5$%!-qocT;G?zX=Xt{yZR93iqC1aBhr~TxzWGB7RQm%h>$*!(Iu); zi>F%Uh@XB1&A?SyH)fiZh-phoSr(OiX8iY5;N~Goir=^&1rokLK)p_oAe{kH)ddbA zX|^cdRZhUz%Oxn80X8kMwjkcz;5DWr30O#3&X-5H1uO>CYep62q{^TvvZ`&B&}3fV zi5tE|zqe`;O)XaQ@=89S+t^00`EQO{6HAEE=fvL{kSLKqu21u$1XhHq0fWr~a_I7g zel%3$4NA{=OM6>Ju(IpSia#6~`^T+(;`b!|=(Mx@iJw{RwUzL;XqOWSYd&~xxt?HO zF`;5vZ)c{w!)qA9IL<5_&k<$U5g;z#v{NeXFdJbcvkH%NG1P=&6W_3#5muYjxdsrJ3B?%Y(>h0;%3_wElx zVFr<(lcOI`ptW!{m<(2e6_ZZY5?W>2;8Aw=1K~Br>x{;;iH@x6<2grr&Zrun=#>#G z_G;L-Ip45BqZux8ys(`w)IosIB_sfmKp|RJ9`wANYI4)Gzx{hT&dAi=D(w;=G3<}$ zEcK8@A25d*q&k&4TRfVQn&!;vdBWx7m!nXuts`JEQKk`u zFZHbd$s|dVnKTWO6+zW&xy%7r0zjCgcJS_?BHloq`=_jkBRh&pHHi%&#UgF(aR}m# zDn+Z0RQySeUfdwC#H(E1qh#2a@gi%I`B+|R$Y{3LC{cz76zZ130{djzI1i|a!T0_v z8X_0k-^G_!nF)aym=|#nz^bo5C?7?7{SSQ)=kZ;@0ZIGH8WL)i0g?W5rTT-k)X-J` zD?f?FxeRsfj355I^3BY0SMt6cg-~ZNY*gGqeNQb)?D554vl;#}ekMgMWf1bn^oV)$ zsw#>4D2^Y*`$jn0KKC_(2>?hpV|^$at!_6!xTl3jC8mo{Tr~5w5_Ugfys$p)Z(PUq zlF}KQpa^6dC}dA?RwNud62d+p2rRXjj8HVaq)#G`07FFPSY>_&zLsBX7lqq47%o1Z zy)qth!U80#-Z7f_HX4a#<}Gy*)4D~{AmFcTbpH?@zJ4PUU33p%E0i25cv=a zXvS=nPy$9G*xmXKgVeV%B7HX zp7fyIZk8U}IL*X80o<5WnjEpzb!0NotUlfCa{tIU}lQ>XXcB1*R(aRbq2{dNK84ZFm%#s1r+}IRbueKhnEsu;5o!Tplf# z>Xa|;Y@|@hesw`DF}~(G>73+hK|M5ha*1B01rwdSQY_+?>6GAIDpVj|Q+8LB|Jo8< zGG*pqHQm3w5rA-bne`cw*Tnck#-CpkR9P>Axo8!OxU0R^M9zyN78qrMqR@>GZ4(Fb z)y_18En*+~Z$_Pmk3x8bcGYXMjS=rh;=N{ttg3Th%l_q`_TIRB=QRXfamhBd+{Wzy zHJ8(D`Oh^25&L1lHC4^)w8(U= z@wOlYOD6!{Q@Qf1in0)rPy*+jLY8OLm%0=YIo5J&Y%J5DXz?>Z#6F?-y{4cm%N+L7 ze*To)Wf~crcX?3xB6s;%k&i_`1V8GIYbZf7vx-VasLHDcBt$@IUVaZ;bCyV zgN5hO!uj(99k2m%L&Zk!aXg+F7JC?;WJl)uNP>Mv6@7M!R^mn>UG3;Db7AGRe?$Vq zK)M_6&ducWs89mXEtwv2u~2r!aJ%-Tq`)amr$4g=fr)&!r1+QVPou?Ww%OPQCO9TG z(Q~#z<&|}7-PH+cLgdF4Hd_s}PYg&WdOW8_Z_D7y$V1TWuEe~P@o1Zc77N`z)E6wk zy#^3d-$oi-EmqErs3*{NolZk|s?v+=i%NBP35K4*ANut}CyGE)F*SuRT^wl=5zpCM zT%-`}>SCsq6YRlL(zGc$5}>$*)$EsS%?9csYgOIWH)Miq*n{XmADWtS>Up`<+vg_e-nW>cML;z?}>f}Ti6D_Hh0WdcJ@ zV`0VI!uAZ4Zc}1Dq&W&mDdO~xn;VA+@Nd_1wee$09$b&q2la6t{|0C{Ss!Fxt0hk{ z*N~a%G862o)ozXi>?pbnZr9D(Y&V_kI+ytu@YYt&ax+|b4pcdHKA5hazzqzqF1Zd* zbSBwv^F^stZW?mG{Ff6|0q-}Sr7Yc__SGo2e7_cc{s7ZXJpWIL^nZnTW?*9cZ*aGz z|HzhEV76veUqL12G*RSk3HT87T++|B^iYgbxii}%jS_cYpGd6RJ1RO8@!HBREK+fh zgmG{bFnrL5`u1|svaqtAtR4sNp>;n0=Kf&k?DRtKe3|{1E5mlf4*vgfWw>?zoJ=fT zv6utQPCGQ8j|bHnAYkQOpy`g^dN1UUJH<=<@@5Tr-#!OBifZ$}0CSxY-Z4JbZ{JgN zX^TD4#FBb&ctCn4xvG9m8ThUpE9@(`(%Om-tJX4GEXW=G3qos!WDGy%<6RJuS<7w3 zCnO6TE1EtY1cSai-|S|<=Z+9bnarjnd$r1z$_nf}og9!&EzkD)5cqy$jG#=RMT7Q&4U6pkyFG%=-Zc|RiH3Qn z9M3{eq$x_WPoEgwsR+^9&Z@esBU~E!hx5AlAG}-9j&Z|(U>`-+b6Kj*J&krClOz|* z0p`_r9S@n=2I;K$v5<_$vBz<~5+M(99^0HWp1IrtG z27KOyVw0$i`};lq$Xk<*)Nk%{Or|qyBoz9M=Ys+u#2>VdNRWG#rcKByjE&h6=2D05OHvpR)jfU&N* zvzk#hDi!GQYiY#Cv4XEag^&OUzLUcazybwb?dN$wX1u67^Y;LH{==SB*K?@Zjz8L# zQZ~=VsJ569h;rX&u8bBPCW__vRD2dkoTBDww>Fw&ptD6VUoo}Dj~?_=k5sOp7qs3O zT|%yYVpdF|EbkNlXJw{5CqGZ8v{l@--qO)P;nNhJKF1$s+7oI}svF-OD0XGCJ@d1-9 zHYvP^mTNYYi8#4a!aUB$AAaA!FkTA<{tvKC3Pm*4)IZ;;1ks%YDxz37WOa5QYHdDy zR*xWr_p?T`FvJ&Z0@JPK=`nq~UM$g;t{~q1dTPEz>rs%u z)o`CpWFB+j7LdN&(Mg#F>%}1sdU0x?ki~z=7b{B0khpS<;hCIQH3=JfS}6Wj6oZnL zwjnOp4?K@;05`r~nYK^W*?5Jfn|j2z`(l z5;u60|5@L+2+GSw*N&A{2E^nhh>!G~&4M?!Uj%cUH;)wM#V7`X$``F~9^Dq5D?Qvy z=NK#Lov+cyEdY)VITc}N3qkxF8;Xrq)CMlH+!pyp z=ps6eI?Wg;VZ-=tx<^N8bdZF#mCUq!%VyHQ(lv3h zODm0(dO=kq zlIoX&c9H}Xfl{_eEMy}pF%gw0N|@bdSuiH&AmZg8qYyoP(Hhe*B}TM=fOWi`k1yPI z)G+HSjlr|jO<~5%s}^(ROMt!9484u|j8A|-o5JWgIufqZKtVSL%+47%x9Ts$Qx60W z!shVG*#|e95$@SYNd4lE5QUH6nhXu2VPAx zm@;!QZU2!MAm!;o+NaEFXCj1V7xE;ktJu1wh;62wQ;(ivF^McTYw)`nRcwK^czaQ- zf-aAiCN7SV;IEIRlw?*viU=z1-uHm>1{FSQfKLW>Rhop`((w+I4Dh2DBk!+>dk6UH zxF^sC=W&ksD_D|?(G1+ZR7zspSr3c~Q_~ZKo(nCZ2I!?V4Q&FAd=6?3k`|{Cua3xy zE>oJ)?1qYZ4oz_e`E}WlHv?7nDPC(8;wi<zGJC*F})oIym&otN-><*<8>2eWh^4V`s-LORPLu|^8+$CGy{w@}K zTmgb*|9*kGI|Af9q)fq@$lR7rO-)yhuhAt*M~6oD(Ieb6iCetNB#bG7ezhkZ|FPvk zo^))|*<-lzDic#CB=>#rHGQ|!AY1|65_{YdmwCRIb|>;a&Tu(ZX@lR8IzaZ+M9xT- z$8-4IEw=)Ss4D3$`$KPB(igqyc6QM2_yp%ZLbG1C1_G_-mSAq^=L=+y?+#t* zgwO5|P3Px44A~pcD)_WgNH+P3cZ-B?PYKqE2|>4+~#h- zaHZOIM~KynHRJo0=JVQ_!l3Wai zBal+;xYb;a6F$gm=oW5>g~x1ry)Q5^3G=b76hEHWhMz7#o3!{c+GmvN%xK+jREU_t zykUyS&fZ)4(SLk4c^whIRrfQOu}QDai1Ks46`x$|EA`ze>0Tk1wn zf2cJ2>M^-w1a?1$1MKCnd${>M=_oA_OH}`ja7>OwG6t9HL zW6WWzL*ju27S^T=G{uVTUvLG3v_OH~W&fI42cO}!JX-=n*Zi$MZVqj5iQEH$c7(LC zDdp=!e);1i9_mt_{aOGKbq`td)O=s*z^O$L-PzH*pv`dx-+d~uZ$#9k1oO+7$T}wo zHCRC$*C`rhzZ9nzFEAB0b*M8P7J-xl3wAf-cTiy6+#k$vCpREL2DYzYH+I~Ps~Yh4 zGbBN6F9HC$^2vNX)r#B{vu+?g!CMZ3(;tAE4!yX!eb`WK^G!mn_SU(I3q9Ztjh9pX zR3{shP3b>KD6g8qB(io@FzrotvEvci`_(+Y&~T%q*X3x7%taai4#NQC(n%5alTBUp z)-`q^VTUkGWm6-I$eRxqdu?>iffpOtwZdb==NR80igf?NI?|O_8F>I!B-=t|t*Om% zQ58u69_{5x@QEma0iYF^8in^TB|7k_`f4en`Vok*D3K3B)y@$}-C*>$J0)k9Hn5|NE*z(W?-m4T&)tShUL z&YEE?W>`E;-5nYB8`d3ta|D+^yl%-N^HReVEgMek4Rrk*LSmXvj!u{c{ah>BB$EmG9cekoE1>Y1-`)6jTy4a)V^!DAus9sk3 zW}>I?JkLbh_FH_w_5CZwL4V`jyYkhqrhktRtVY;Ao|Sj}^_l&Vfh}VpWBz!KNEj3ZCO*s}kH-#h@^Ikh^bIFlw39C<` zziK5_JIj_MfVI_x`u!?|5Lqc=f|TI8a;KPLtK|kF%x;tTj&Awiobb&k+g@i^<&7xc zf$EoYasD(gr67@CXe$W3|#$nw;PrnY9%lX6wo z3&QKYN@^|*Ww>KXnr)g~eVQ8$ZF5a7>W-PWPXYQauk}9Otjr1UIr%3&fP`RIPwfUm6I3KQi`|sSS zLP*!gF@h>BxB3LhOY3Hteui@hwX=swPOBlcjK>wYE6dXqdSiH{tyme3W&62Y-CaCS zSWp%ZmYV1Z#pA_TJf7v6BmTpTomw|_!&IN@;|rtI*TUNx}@J zqR4DJLe3h*6xuR9CbGs|*e7cCVcuO);<%A29nWuK%gKShl-i|2mQHn5kzNr>L%azj zc1G)c+HzM_Sz+rQ?>54&quR~6a2&7WQoZWLxAmy1z_>Sqe471cBj;*YKGuJ+J2}5U zery6_qjLEFWprcw-z|liI641cj&NB^I_`+&ch4jB1H{J5XS^6ELBG_Ne>)+3j>`ZT z{A5V4{Ce#Jv81_|w;7^EitEUIk&c`1vub=d#; zs$HUc`OWDnt%OIcRh?R)3 zpw1l-F)<6G+@H07+aMq7`0_q0s6832{sQFdb_S- zck%EP24kwZz&%y*j84phb*h77c?fHEgV|n__y5LI2M$9 zM!cgk`1+-(Dh0Xv|7jw4AzTRs>$~3Rshuo>YzUJ>C_$nPHkf8)BTpD2Ae!=@wd1)L zl^CSKFiDJn8I8$ouSZT+ze@m0uDu?32K~n}`T$-c?FVsDK3pwkskeY$opEwx_&l|! zj;_zk!^PfG!N|jKMJ#UxZ60TEGwNc5X%&s*fY>6@49x8sb%-E<@*IhT8-sK zqCH?T-q6^ubu$jnf>k?PmtWc&O23+O zw0z7g-32fEcelQLpG@BY^ZBI4oS~0WU{sXG5EYR3dL#I}d01}#wt0EC_uXT?>}QfS0e!2Ewz{H7 zq(R@g%+&IGEq9k39l~gdC=ExCjF!c8c?{fC=&tw1g+llA<4#>>NVW6^gAmEbks;Q= zyq4kpTT1;NA0GEZ$?q^^oQwDHHKt%i^@sT?SmT6`9)uJuRWWUJi!^yo3Mjkb_t-7v z<)AA)tGo7xKN7bkic^q_w76A#{(IC=g6VKWcZ84#Li{s#CCD`CxWnk}T{}C%_mV6J zFXRolP9JhDaU`$uqTAeN-C!E4ZC2iSXaJnI7VB_=1~{5GxiHAm`teR0-@I&#PYqSS zlB+YDR>{rKa_Z?j6eB=HAsYk|1&zNaOzju*C+f?7xp!4LiI9}iLe#Id&g`l{YvJ!l-Pfmi~xqV zETn48SqjjH+xdXNm9hYGMxneaAIBGdZRG0}&LJ)I-!&9p$)u+JG<48bm!HH+@s$J@ zMe^BB-Xes?3r!sE2hUhv32Y}{8YGWC-h>Vw=tA9>W%_fDX|J%zmBMXw>RKUC*?Oy! zdxMiPtza)=nC4seHbr6;b7TlI-Dft_WmfFLT+rHq7A^bt!N zBN~@j%;*F%4%_ZCIf=wfg78ENkEA-TnXFNaMay!`LYcpW18Ia;N*xwsZr(d&b7-U8 zLgS0tX}s+^#IksDcZ`kTm&}zZsQJCkiSxN4WJN9D*dJu9=b?fuje2lUDFH#}XWTWx z5MYlbpW~p11}Y@z2%(@c`YyaYLU`<{giDG&hTV`aLX)P)x8${g{G|tjEAlVx3x~5% zSPr68K(?=_e*Z2JhymMUtJLOF^A&(z0)7I&$&(GhqR)WQ7NX`S0+CAO%>uF&eOC~& z_HyrT8rqw2)sR$vQatyZbBP1w?i6oBJJ)ayOV}b?I}T5vX0%xyuOBRT=TjRd+oX!S z^N6$iyGds=9pRhtZsyfo6YYuF0&1m1)rc z!PC&5($=OxwHbWZkG-;x3hOlRy5bZ-DD>U2x2f!J7UR^S>X)%w_}PQX}};wqcv!O!o&Q=3Tv} zMU~vW@>|LLzK;kyEhQ&_82 zzF9c;ZL}QoSr99uw{*xR_SHyx$Q+@6sb*et&b?Fygmj?i=0XC^#=LO&tctA6ussSS z*||=$c4s(a=9cMBHcb~>u60a#n~5&U@77q8Op1=wG-c5_)uLM&j}G$pesO68UBG~+ zNM|}T4>>Pu9iz}u^GRFQ#h-q?UheZbzF#tAa=A#r(2?XV|@9?Wj8Dw9FZ0r+)UA!2eTL zaQ#zOP!CZrlY3R(HFwM8y;Ez2YpPwXq*_A{im!MjX9rW%tTrLb3*j_6$%Q}!L^Gjf~rK>NFwaVR$lOf>Y*gr`9A6G)s@C~x1yoS!bMa?_fm+ANmTmmBiNIiHSnZQBBcI@|H@zp^}H>J&e zdm+y1Cf+B$_%Sjli8%+|C^kg-4E`G0t;;61+`Rd{eze1Bp%)^~@E6^+a4DUQJZons z!T}wE#JdZV?Xr<8rN$ zG(@km&kPFnS41LT*isRyZ~HPmo4h1s09(XuTPN2u>9R(H3mBbvC67|wu{9p*y&;Z* z6%p18SjzzP1!xL{Q3=nVlGikmAazCSm6AZxYY8%V)80j*5?N3(D`U(SRn1)I*P9&+ z8DyFlgny-3um5&FPP`<03S@Uag-Vq(r*n?Ec{g>X(q!en@(L_=UyBMNFoQCLPQSuO ziy9J|k&~G%LVr7YUV<1&rn~k5zz!dhwSwZLF@g|)Z&7#CtY3W_>l$Xr|CSbEeu{9I zd}>MPEACppc1X2HX7%D7W?`;QUp8(W85QSV zoU|o$<#HJN|MvZLX_C#imYMIz%;E#pYA9ZYbMekh&i}MlJ{xGjvdf)A;MU zXK0;bz@|XUnUegUWRy*}YM4_h4ZY=`u>q+FEeN5;1tPfc%*No0ke*?Pr4pj{@Z&9I zl$y@ZK3e&`%z5=qP(OCy*}|scf+S|;UcIWG3o){K?8V`4tM+}Fm$r?WHyWI3!%TSMPJ2SZGF zYTZNzS17o{?5n6ZT5Hw8OTy^Y$E)0ErZEFZvVRN|w`H8$aYE}#AB)XP^azEc;nX*Q zz&U+hUudM#Q1wJDiJB(v!Jw_shm7f*HCSolt9>#8s(TOvZO~kDK4f$&d({~<9ebRy9yt({D>4vD*}qXjr*_#&YiG&&$iS2vnT>;k%cw=QxFqt)j7ikX zyV7qTX}jU``nUO)AbLv69wz){SCB<6^D6_XWbHI@ypimo=a(t?peF{dC4{XTyGE@6 zm+y-#f*pvnRi1e9loKNiw$pa}yqkKD#jEdhEa zwXY$Yj^mgNJtLLSU29yA?o-jSSgx=0YF3&bU&6ybfcxbsD;+Vta=W?vMVu$4%eVQ( z`%Kq}hQJ^ZFNAY$iYUe0IDx7j7Z&Yd_7KG*pgO?PWLmimj)e*yC6z7yh`dZ**sK zKueR=ae(~JGA}QRjhoC@1epy+#Xmm7B|5xHl~Fu2|Gb92LLrEGWXagjTMS{bb^r#K zBN$V7dUUO=cHmx0GckMwSfC(>CYO19XGQ$>?cdC3GLB2-`5^i?UU#E3o&QexKhPNr z8e9KcR>b+gn{=4|BP+W8!L^QB;I~hIx|xo{y|e@dqhPi`$LJ()18F8y-Pp#7*0*+h zlSL$x@t-qu`$-_NmRn4v(I_8q5}g3%5IKGPXW3WT&!2mpllW_QykCBsINy&uzVA8b z0#AA#XFF*(prz^qt_0qH8@zkJ9>|tnd93;ljY2Y?Ee0r~3GO%$>Lo)TMZ?5Ll2n+s zpb*~Y7h_%%5&cbWRR2wXu}?5CS7b;)^3pjF3g9F7TQB$iJ5ER z#ZN~O<+IJ=OF&8QV7iN00w`&cbgS?q+tMv`Bg2!Y(mvcM=#AbzlJKVOStBR;S^?6Q z-j+O;%#pX5x$BOKrhlEx$h=o{2cSfXDJ*B?hpQ?TZx0?@13-1;b6r z&dMb$p@+t=r7suM6(eth0S??11X`ogQB9~}E6hZ8m*w+ssiykJrm*AnEkgA7gE1wv z0GS2LV*iXM7InvGHDH^d11Ovc%W{*}X=xY7$_{_TsKCWoa6+(N0_ zk)+ucBX`!Zk8p(c^eZ&PgSJ3h#6S6xF~bHyuj1Z-shGUwgr8He(9rxtd#GDm*x%{0 z&36G(6Kc}e*q5xwIV1urKS7tNbnu}!RL`RDZM+8(88W!I(;ZsocLLE$Oag@*l2^os z7w{1wLPI0cIV2Zs6VKUAUAs13Aw+zSyB_}i;KRgLlfb=Aj#isM&A*0Zas^hpux7s7Ml!g(x&S(OrAcJT){H)PEuj>H>!HPc1GHk zRSPVb=t`H-FP-0pGoN?0zs+^L`y|&;jL`2WSNds#Xgey1Q`c)L?m3Qj6gKIg+SQCh zQtD8p51S~X16s$-Q{5`WA#+{-QMZzlTCl+tkAR90 zQRM8+37ImSLtvQ1ztXQ2Ayr z&X?~SdBmdo$m7t5Gn18?j!%JPS5>qSh3BJ8HYNKGwuV6`08x<2;h|^8Pf6-UOv#P9 z_miR-UImMbFyB$cwMZbKM-M9CzB!?JbsQi%?*P@6Idso;-);TQgF~#zmBBL!_8%zs1N-7DY^+29h+B1rE0OGl@tqZVh3ap`Gj!=-v^X zWo1u$x~wFOFkr>d=zxHFZXx*aI7fG@l*V32*LGNG(B+<&8RVJP{K&I1As9^) zH2v|K=rf#3hJ%zXu*S9qRAlBaYuyL2A!eWAxR5M!+!HcKx7~&l0?7zX00S~Vv{LJW;y|f{y={HDT5+1KJSR^ndQx$$bQIHmol2C|?rReHE*X;H%9_1j@&}ae zmK3edj%u4Ifwu|Lu_PXf@;ArbmiRPO#9vaymv8kG4vh@Cf6_SEkP zJr^9qYwx-8KnMXO?LJaZ1QN!i)2Sm;jUwE>` z#A=~uW_VG+5m_w#2ncwHVsHkwTzCr|YIB~eN>vQLEwOne0j^$Wyx?-?>)67YnPjC(1F7U{;gOl248S9<_LJ{{ibw6hcIN(sV{qh;5?+ML842zR@)S zrLZ#GJTq;Y2mQodd<$1}6caDWOwnOrqWDXoJF*;*iBcy6mMS%A+GtfbWC$mg)>4wJ z-r7;4G=_h&Tw`|#o*l()R4u=8F{AA5TGg4c**o<@iBF5WCu72iMs9Ry9!dVqSnc6G zX!QNg_D^vQBL1M}GlYJ|n)U>wggW>$53~1i6IwB6QvrTczCZ+}K=XV+8S39>n$V{@ za~f=3ot8V5 z4}8Ni^u7Nw`!F&6uVx<>#{aCe(Hf6^Y(wlhrF;UOcF_MN9QG>-$SJGXUJyQ&<~Wga zO6TNRc`FLVbn=rO7!l z->S0FNaDCze1P*HN}}=%404&r^T+#HY*fHI4W^E}>@b=6ac@J0Vw)Y?*1^|1-6!=U z1o{^LJ$>hT3B)E=?;Ak<#fCYlbx!Sl6X4=KJ?$$_)9QMsc$ZUVcT6*gqf{i0>HN4m zMB9UxNn5{8=fm7q$pBzL&Gox5(+McUG2J?JJyo2!&aJJ@80_WyW|IWEU!dug?6UxHN$b`7v%NSr=AI{Eu!aJ}K%T@>c3q&rmSpqxd38&QYP-8J!I3O{7N2O#7 zUFjPhQA4Us@LSb9J*HYgOcPboT6z<505)QGk`^mY*0^yoCup_a3L6AIKNk*&PaT$Q z5LNoOcBu7!iA26qA;UF*f<&|F(7+m{k{qI+ZQs7v!s>hrTR=Qm3mZ?;2_F#tXrm zjSER*QW`re6trBs^j#$j!qc(##=ED+(!<(1KhJwI`aqOyw6RVojv?P+^e+*>w)9)Re@&_8w)=YD@T4 z{*3YMUH;J}My(YrYyqRCIA*a8w_bKhLrFZ$xKU}?BszlG%}ddxY$_HbO#i6`iE`ia z^o!v)NKzXrj5BHx)l&P)9u|;i35IaU8+>6L8Qi=e`C9~A&j?Up5bv)u5fA72bgl5T zHjAQ$B-8$1ym$b#6^UgH?Z5joX7Z^eNv;-og$GsQmsg5{ZM0SUy6F=XQ-euh^PCOn>9GYdSd8BL}b4QLn{oZ{R zM9faX%-oz!3^;S>*r z67)7Lg9~^UI@WSSMrQUqUoex_FRDF|(l(wwkjutCfNMlA{tkwZNIW$_eu5r*^Q9$9 zQvUY1;#TpE`>VzvO15rtW%2xx1!4tlXo0PfE~YD!t$wPAk6TDdoWBn)U8yd+dGr;l zARXE)^IQ`=TCoTN=ip~Ca?PV*CTzJwIXzL(^xNul>%g#bE@*}kYX1JHUxG`sT-n9L zy|@Lh)?(skiSL3>{H4Y`S6apDa1grrQodKR%J%L}(BU4;`n69mH;P7%2t!T7BmL%w z^J;L_b#|QoXycjl`;JK1GBGFjN~|#RRDW;G)r4w8K3MV)rF5|?@yTRYmHNPQNp`Ai zDw0n>kWP2Z5ms{rYiJw=aglZziBp$=JK;I7QeQ~Uj&N3$qn@s{wzLPuNnZl&`_@T+ ze}31A#;a!;4DOfQ$_K(HfPIhxKO4~w)un`%aYQaNh{i@K&;sKNV7ozoyd21Vkba4L z$*YU6dU5HTgkn~Fxm1{Y+}Pe6(MbkA;L6=0lk;)J30AHG z(BRn}HXqXq>@mX2&>PILbjOYHV6|!trmU zEeX+VL|!zqt4l{@4<1A;F_`U1=Dn@2GSqSF4>a>S={)+_HHSm(j$doxiYPQ^Q~|e! zW%6u|+kDg6^2-05RcbOlxe+3qD^nm(UyCz!T>+1YGPv%O>CH==DtDO4#y!LL^h-as z+q-Ii_u?_#`6~TezK*8s4mD&4ptc$r(Qtef3Vk(qp>C7enLuiS+tgeAP++a+l_|Y_ z1%-)?G1pquH_hKUrk8`Nd{avJ<}V&TW}1Vz{)sdz zl{ogEBgaU;+@8E^JICF$i$c!p1I{)qWeUYCC2p&P9a^WsZT}IdjHA&e)c1FL9FF|^ z6-?~YmhLw>kjS7d0_!^7Y*hW34cLfHpEm^RqTbh(aL>j{zUzr+qJ(keBbSNREF|R7 zpGhxX4pwqS`=KPp(+{ScdY){o27@ayHd-HGqSz5n;~IopVVWSqd>l2ZXHv>WEb~wT zlrzfPE~8YSZ1r2#UTChlWi!A@0ilhB3Qa`vb)5Ow!uogQO^nNeyG~npsiG`AM|z)aFQ-gH=XJ#yIWseaUkY#bC`-jr+s=;E*<;OrV+nQHAtZKAmFK16 zj&6Sq8lMa)ZVBAx*o_t4IS=U{{jRU8@mV}hMySH8+8`3rhhk`du9f1qSK!jh?9F%C zpMELce4Unlr1h>ZvlQ_L-%}yZQC>N_btpL+GJUjJ@oGE7U=J(!6o8hc1)mNhMlu`9 z*Q0Scjq*w#C-!5!qJ6tg`ZQ8Ou>9w?%gc7xN&W2)}h#0Yx&-6vlJ?;`5g)?&N&!*-4NE1t3znRXK^#y`#Ljn|KMR9rEdLu z=(w@^CP1DU=c7#)48gI^U$3*o)2V^@+C3Ksa53?BI7D!HwdGI=z;)Yo0^)7D8H4+8 z3~A}{Ua&{wwA_2nlV&?YZTAm2URA%?48);_FMY-Q(GX2Vng z2`=e4t;^J1TB^cyctV{$$ez`9jylRwRuRUfUVHEBbogV=JmQa^ozrJ`&zwtaFJ7-S z9V(F)AQ6R#(Hfeui%u`$J)MX1X9$Co1=T=6|PnCclW&L7PcH~ zr0ejXyr?G^#Tu$(95g-Dnrbv*4+NtAK|f~XKJm(rnp*3*oi)MUpgD@GpnSUE>P#!n zu;9J=mCKwy3If*l@ABgQ$cTZwcY&WEon8?gc01J=QQ^zCwfN|h)_$HJmSj(S0xVY; z*Usap{zH4wyVzT*Khrr?tM~oU{{BjPO>1rqxBEf%j8kmBna0lR--y-D>7h}#d}TY< zr65I^!F8Z<98bRgyD>?mGL{i@sEZ?AlVfDp)=^YPmAgSB`gcl={%<~zb=+;SnGp;* z_HIlJZgKL?@3!|BB*U%bY}D`*w85+CBa}Hp@+xzP{9fKN<0JE{DW!nDZI{NrE&}Fz zCsv^wh%M0`{(oY3@8Ot?-nYD9E-%AUO;RZJ6a|jSMJ_8_9Fkx92mN_MpW$3wPOmG&U~rqj{Z`LDB&3kh<$eiWE1a|*JAtyslusd()H&l!(YP3^jkf(9!zFue-CjLwU72I^&U4Xk zgSDRqtCUnqLqN3N;UVlK9aG0o6^$u^CGeH{Jk zO~<#ZqE7XoX0OQ}o((FJ@r;mbUq&{j-3%$e7FmsG1nFr_c=R65D5CloDS!k}Q|CKfvueIy}UrXI;fJdS8rx4+Ap=d{#C>bc2 zNth5;F+y|zq~su9w_>2!KQ1E&$%mZZ2z!_&RSTU%=~h|`M$@6p%gk{H)sX6p;)KB0 zK*SGY<-f%JU6B}t1y3+7QSg?E1eefC?QL#Z&~{JB(-YwC#W5z-dnV`ci%YB7nuJJ7 ziX&u6UYOz*U9&gf;-g=0__@OFk6X>Qz5a2%%;2yd#VQ=4PjvsqO4btlWsfs-jmnc5 zb_zG3E#VHAR@gZ;JC0tB(5DNTd2V^)MKiIzXp!-%I(vjHUd&tE+QLBu2(~3OsP3Bw zrQ@~7<{}m%0cyoDB`|M%!dBRsc5kC4{?*1jZ2N=ek|H%Tv84TGC1<5|aBUBgh)Uue zE9SxzrR|%uaUyb3bvVzCtYec^Elx^EmUEL5PdAWA0az{QSlu0~#aST54Od{?w+y|*_%RL9!!*opKBs|UZ3I0Kdd_<^e6D5ir6lgn+m4(lonDsf5?unj zkw%%@5n5WCY5t4Tf^9w?qu*QtTJ3N~)kgk0DTR(tbIW9%wFLN*se1?9!^Ls5plH0J zur?0QvG0{P`8qy1&!-K#OT?k=!!7m=;V{1F*mv5Qp9>$krW|$?Nb!!154L+*z@z6@ zn?L6d8%A`ojMK-Rz*33V9{SjlySY>7xEyaO8C7*R zqSaq-$zKbQ+JnC;)QnL#(lu{JPkXN5Q06r2@XqH3IarrvKYLqs8C~xDsMwN74OVvw z#s^C>-g2?c&L*5;Xsj`!nzh!Ft!g-#+0%Uu{m~(SI%&!*iczExq?kI6ehtos6caj; zhFcnM4ICt*RS>vAU!Z4DI7bjr5>By7Y4tAh1czqKB>lRjtmus!mH?O}4=eGo=4R3iy+E4TL zT^Kz07>8e=%QO1~H7CX>FDii`vyrn1DVPB>Ld4&7?uacw2y1n1gZv4BeA@&_w8C@)-Ky!n&}|E^0|9?H*x)y2NIVXE-F`%_4ZE?5dS3+WN-iHL4I zaA$5*8*)v!9_K0UBs_tZlLMaoL%{(=zi~ zFmUuJk~CT-gtWz&>Lqu%$@_Vioo6rhx`|yUB=~T7b7<0Ao@ri7d;+MlbAwRZ`+Yii zzBdk*UWF5!_=X<2-L1Z()Ka^=%lVEpNw+Di0LSOAd9S4ccR}zbGS!Ap7aqxZ+_t)6 z>}IdY4TqQpOHVRp@ioJ-DAp@7GFOWxR8VP4uC=5`j* zN_*!KrvyBeGH1g){XZF&)j2uri__Me5X$_((y}|s->)A9d(+g6!n}R*4--}Bc`)z* z{jUdp|F2pBnOK?s;{xV*XLHwc6o`B6>=n)y3DB{7#=*HJkbv0U+ zWE&;eJU`*b2|0@?wE0d^etf_#773Z(uV!QWae}ZoUlE4MgBG}1TMpm2;C_LZyPfa5 z{Gs??hCe2aLpfOd|7+6VgBM~lJifbsIZdhBv|Rzd$vU=LZoH2(Lc_VaLMh(^Ew;o-j(g!;bl?WAEXP3iti?;yDLB#7^~_PHJXq zK(}#;spOz#z%>pa8r;tBhjT%>{f&|Cl!W;;;e~}6*82y)sd-8U`ul74Zu4%^57q4P z`BHv4@6TH^7_->oFuhQ{WVFdEi_#whd$Ckm;wkmS7_*vP0sh=)`5kzM@sOl$DqT*UYjG{h8aACTFj0q zl64UUx-<_~ja)%vskR;vpdJUBS0pRkEhao<9U7i!Jf)p~w7F|Knx9|p);mNXeF`?m zn>N{O$T)flK&vl===eC+W|k&7>AC7_|VCuU?_%IA!76PIeL`PA^(jRWPl>`EMzUFR^a zDZ45Fu8I$p&3Ct>a9cZXuOO0(DiLqnayKBiA{2ZKa((g!%*?7SnnY=K=%NS3c2eW$ z7H`!T#&^uG)F|10B;aLIgmU^Rj(tL4xRe`{y9EwZLtaYbLseZHH_#WEbcw)8CKHjh zSpDLB2rv`oVGFza{+)Q^z*!aB|Kni%mJkuDvfbukWh z_Z*c{<*cp<7-Wq({dUdu-@T|SA`NWRQ}K9o+hhzWePRveqkXt*PyVgdrqO?BBt@sG zG_b%1lCE3cNU~IrU`mNfyf`+XWc1*cM}2zHaX{G=%$RqKmvy zS0tQjF?p}ZH|BL5A+95JXg?_jE*t+&BPx;%M|gvS`$Z>pM|>|c*IPJWF%ohC3o{R1 zASvaRW@ICI?`T|$fs|U#lC~_= zN8!3des+eL+$YsEX#2(j6hS!^%+!QWX^m(~;*R6sbta9pD5d)7kxnLUP>r#Bu~Bu~ zz0G0=2~L8+45p=hoDo!x@67s&Q{e7qdPiwzM;RXyh=FM=<)xy^GyKA-&SHzObXYS& zHVo&D$UAj3Bu8i#sJVFuWxtbaR-0(jr5AM%5e1$N9OtJ|mKPZJf>GevUpv7`29`gf zP*#N{*8^qaJY1P<3d}&eQXME=n!=;sB;{X&g~sJywW(gYBBEWXorkzet3!Rz)9iGe zKF}>i2U=HNI+(09p)@BIeX$*_+df=z!KUQ?2fG!2RUfQR`R^l@7OC6j77HNCA8Y!b z^(gp`MG!HJ+uj zM6z=5nfMlJ+g-cLg`S<-`pm_^GEgPvvn9Ejl*Okm*G|u+(oMV3*5-GlhrZBV&%FdL zKUSJTjO%S%tP(N}rMb^YmZe=NXceGoKV@Slm)+Y!F$jb;?IWWjv6`(lup0u6eSt); zV1LiBG&G1+xLm=gN#IqGT(B=U5LSoy#-6xFj5-eJj2%74)Zk9b)}Gi_68cOKOQ$xDXEsSkHPdy5)o}>mOf!^W%_F@y;PtiY73~2U z6b&JLt81X*2d&iW-2o@`QhWh(m~ylk>u34WwD6?dqA>8eG!YY={@`+M6kFWwlJDSg zTTp?XL?w_)l55~;lTS=;UHg*r6LZH2R>};Ol*@!tm%?9`(nBl0`R2pw)vI(H_e&L9 zN{hF^Ks^%053*WcCX(PRR4*i%l|tP2$Cbd6l#m~y$utrRyvIQV4ms9O+b7l2+LVmQafsVP{mI!;M*9^CAuR4yqA9I;*W9k_L~aD9(FY~vfe8v zfmAuHdYKn#Oe#WbsA(rPz>{h+km#S<{Ua`WQb~wa9BR8anZRTj$8P(k>tl0*&QJe! z#p3cnk{rMUbdhnRSPlc?`RAMiMR)IyGtmS_xmJEx0a9OqJqNOBh>?<99v>>}g#%ro zB}3h=BMnu;zw;o)z9us4Dm9;6N@L>8~uZqj7M(S z;#@Cp0r@$6II)MNQoFuzLKDde+xTLh*3}F2xXcvE-`8SfMDxCs#IvbPN?lZ@2iTs2 z>@~X0T*mS)C6qOROzcsWg6~$tGgaGH#gZLBOgR^BUPaTqZI$j9M_R3lP*m+9x%l3-W51T%K;rRQX^QJ%P^A_{IPsm6` zlNDw2E?pGmFfhqVLLR){d_FFPGdHiTP`A|Srx*2fy;Rgm_rJ31CCg5iOX*gl*tohS za}HS-qD~X>mA}DiPgU0ua4wY}V=~j2cw~zw)*#b@%w-ohszk9Y=89@xW#mtY-A4@p zJT|PB7+bgtvBef|=bf%_y$-SfP~*-g#hx>bI^3qL<; zXX^dz<0SoL#71bFw}l1zzpBLaC%+D3(E6t{(6y|$N+VusohafR!q+81*lq)h4ZO_Ss!(XuMs^hyw?DJwGr=YMc=Hk=k9A9e9bPVPU!_y zNK}4BI$woYEWG7Mc6N1oW@bmv{pGE12G>geYdG4r6dB07R72&ONOdcd-b=UIHoP92 zql(xdEg?jDeOoSfK!d%}fu;G`&#XiLf)h!GX5LUc+ywpCCfV+2>92TtK@zm2i72rg z(!!C66FsGK+>ln6i{Ja3CFmH)nNA!ZGV~g31sos^ouDGabhHd->q&o}3n8BuI zWMCm8Dl@k=p^qRpO@^)*?ca9iodA2b$tUc-T{@9KPb`#M5E9==VCP!_;IAi|+GVORu!(-it<^)*-YMuXc0yt2_cX=S8ukVa8<~QtMh${W&uE#y79Z4v z(f88j8gu2Zeyhe(x@lHGm``4JH@Gdms=M%fN^TdO!|3$FcyC0m4~2TOh37AOt~JUH z8HmZ$zKX={uFMR0XvCE6LfmzJ7$+t$N(}wT>9iP9ZDrX~)OASP=zt)a7ptNE7L9I5{OEWWpFp68QU>RG_@E!QIFB%>C4T`dB}qy-i8|*T3AV zqzo^0v5+(FJPEZqt9Ym7SJb-Gx;szWJ9_T`&p|h-g8m5y&yzuf+X@m|ApMj}^8ubQ zzu{#vy)7yI<7QEu)I!=ttVs(wk~Z;4n1}&I`QyHN4E>=cwRBFW$7y?92dhf@?!+nv ze-&Z2a#tiD`5`;>^aA!(fW7hv{r_R?oqszE_-^gmowidOQ+H~6YTLGL+uz!@ZQHhO z+iu_9CwWiKojgB0|H4jovOasSYh6xwIo5zQd=)9g+VY-|-+O$Vt@RKkjIg(*FMnab z=x60WKrSa2KWXr+uHwRSiM%*`EBJZH%}{!Ehu%Qqb>8xL8vc+K9mq*twvhH($Y2}d zaa2?Hg)6lkz)E80ivtiVSs7an^kjbz*w>#?TkmjWcLI(4WPeKCTR5f}9q zH!l)Ex2R9B83n*fU5(nAF0(Op5zBl*fOicK$OO@miMV7n&HDddf}}mf*oK_{^6%mu z3W(eXEe=nl(^@qgn|NZFX%+tNZ1Ip0BdYqk{nHM4<*8xV*nob&6LL_Vm)rjfPIK9r zA#p0#5*@;SsiZnpFEEX|rcZSjjv`S#xf;^nGw-=y6bKKDb;OvjlQ;=wH-y9kBBQ2P zuP^;^V-M=D#AstjU@akfndwS?mz&yLSv(mkD;tkD%4D^IZfVTcypoQ2P!uWlNB~l~ z-ASAZ}wp$n>~8T2iTz&|*Do&Q{(oj4k^cd;!-5w(T+3Up&cr#dLU-eDo%t0S{T;!37#{ zkd;141W~)yv zPO^$QGMJmkiI(zVB&!Yaz2spjl2+>gmF>B8EJB2z@eDhu?3ZS!kZpmSN^=`Q$-->H z8QxGK5C>yt)>6#O)bA~Ynv1>)$JdK!pQ@XsRUO&FhI6g#{o8#p#2BGa=|z4U9Sf<| z#rh(u^qQ6BvfwLuVVmw}jbBNY$6`bBHYy|>F2aq-ku)D{NIA1NH$$_}w2iKM=E-E- zqna?{)?DpR8t$=j{+T%(X+29F;ZIaORC7 z?P)I1Va&j%p&1sRVzw9fU)8?`^$b)jE7}I7a~A#FZ#d{A3ma!h7Z8e6BdOwdE;g3O zN_!ip)8nSt*AGKuG2Ic64=cKfrPwwl4D!G=DEe1#)+I2lYy{p!B6-i~T>E=i9|2_U z!`nPusvi#oyOIB3&@c`p{X{44^f_<0Aecj<_& zl`mDWw7sn2ldW)Ao#Q_ry#qNWCV!)3I?$746zF@t>=f?U|C2r8!nUWg`Bp;o)8G>` zq1+Y^8AnH52j!qsLG})8Z35~yDH^zCD-v>ukxtklOPVfS6HyhFt!vFVmuFeG*Jk?9 zyZ#V@N1#U6iRT{7utbl40n=}Oh`6Y5YWRA@(mdV$W^25o!Gkjii(}5*RVnf-aM%ue zIeRqYO@S|T(aYD8?cWj8`kR-5xIBvx;Ig?aIj1lN;8UfZ{;NwB_lo!X^t);>+T?%A zm;bB(?TqyF|CKKXHCm$>Tal(dQQUza?~IW#$mw>NcPw{#8F5ZdocG{a?#|OI0{%Yb zCNXvE!GW2na{-(@o#cvnrQZtfvU!9Y0EF-c9GgDV2w!PB-|C&;ufwOwI-g?Ygrx;C zyhrnD@4aQNbH+2h8Qxr9w}lsv?sgpA(|oI=TAr^ZwCab?W`QC_o>^L$_UzaeW2{ED zZNzW-ZTrIvUs*cyLhZCE*kk)t++Ft%bumY+6y2U*mZoYhcK<-7+!wfiPDSrs+Z5-1 zvwG_JyLQMmKNNxQU~3&Ju_4B(7anY`W5>ehh1r{Fd>>Bs^i^~#wg6EV-u z6LefWyUkMGlkwZ__nvvB1ElhKKa0mGeo=mZzmEpdz0A&ifAf5PKCENUO$owNL<%xx zjOJRV@)4}}eL>n{9$MW9YM)yxyTwhHG_t9 z@1oWo1KVR#Gz;EgidiGW4KW|xr5>msB#)+zRd%FdUNyXV%W^yzx?-=f4tP!Vh0kLyhR%Tjowzqd7jF!&?JxG8#^l~G99y{cF6 z!u4#3Za;fqjDWoE%iH?}pCwWBr z30>vRh$j!Ip$x#zy?n2hZ8sJWjO4y?vE)aCHf0V5C0v`mtDC|EIM1Ug zg1S>OQHN6|A;;J!%`qD$5d5O8V4=j7b1j6bnXE3W%)zlr6kR}Kc)5k?X4OynucnVF z`8if7DPyxS7JDY~Kp__YFyJHSup(>`Pk6|6%OYiLj)de98LhFf`}pM_ODh7+@D;X_j(U(hRa538F!U z`n@2mts`im-uMXkOhLvTawy6u1xV8OfF3CS852_1@ieTj~UtJxj9Czp zlmz(!pKzD?RLg^d1H{T~{^U+8I49{4?XEEypOJoi8HcMg;%6atiS01d-B8QMG^4oc zb-SwJkSJel*uD%rAk;$^)HEYtfut+1A3^@D)&8n0GffJS&kJ2dh@r@WFF@)|8Y@(0 zG;rA9)JgaFgd6aW;z1V@4FpR1bkiG1^7OD=a$|6`a$>5*PL#dChqv+E81Km013EYm zs(de&mOKEYx3~#I-{Hec=&NUn*ePP#%&0Kc0$~8vh}o2iS29iEw?a#qRjR$1jz?~a z0;beffEtG;^6iL_T%H-`IkB#(Ym!+=WO9^14fWHD@*mVmnpM!RuJ%kiY~v4JpaB$6Uo5rK_&U~e@^v`V|C9G2zALV8jnnN zI`yO}6$wptq?UF=aJ|juj}bE&_Z4}l%`@ivOLr7K>(ZL*mdyXcPnE~V|H1b68P(@P zX4xW!lLG20yc(GXzcN9X*ACUJV5V859uq<&8-?wJn7cr0rz8Lb(VL=?#W{;e0FY}?2e7vRpJ9tt{m{S5-xX+nYOJ(dt#%iWSbR0KXmgdw{E4%vzDO6cXQogah zc4hXMugfkS((+GVaPxZ$)*}C>w}#qoJ(v)moM;Nrg{O+JCNZZW0wm?Ghu&%=$L=XK z4dwm1ez82~M;m$Zo4ztmVhOJ*ZT6UBY&G`J^oe408-V01u>0j7@=@t0uH#gu#Jd5N z!Jn*wC1$={kM_*;_WUp6o_9WRfLush5O2y0IV*t;`S6@69@E35MUB()7@?2n>^LKm zg`HvEMkr;{2FXsC+-bW#%O>1eeK^ndpxxHX)T6zHl2bl3+@Prpf$N{*f^BXg^X%Pn zEci!Q$C)%fF_gcAUrB6e$125&Vwlmq(_#dds6%X#2GzIo3;BB?fuQG9F-$tAdobOd z%J04@(qE)UV8buH7~PBW%+8B&RqXF&+2!*RpPKhRSI0>$!{;x+lrD_GXLRC6Yhb;_ z`3D8QhEMSZKqr4AV?B_lj>!H5Z7j_~@f(hKx;XsK6mzRQe>ZoEzfjk17ZseHK0~)K zA{es(Yz`71I9~_mcyt<)o)x2@-LEO4GMmqgUJpv*2Q?K|V*grej@~mU(6*VvCALrVn#QZcW&2zxOkTXrkVt;pGGo_dp@>PD{hoz)*a1$viH}&Xk zQ28iwuO|+;Oll@#MIY|j+U62k`Sj&6Pjm?Q|_)>7-=AS#9A#&C7=%U+d3MtRou?P`Os|j2WSomdW z1_hu=QMR3~2)i&4sb3u`tn9E>R;w#TSr{Q5qSr9DCgFR}4$d$et(^OKsSf9W=1qIx zy=b$ScPL4#DM|Qf6ej=u=XAi9uTQg7o6g4^X)!?*9X!7T9b)mUa{TpW9#&`8_|*i) zgHrexQy{$>4ykiCDNKy!l9*?HJS?Y{%$5^p6**4lam>eiCAOroSvcvbpbJRa< zcZi<`_l?uZhG`5`FLEIxGo7wd{bmxP+n`#6Byxo+>%q3%V{%2v`3?e#-HmTbp4A-~p2Mv0=UIKi)yoo01n5CN9mQYgRT=RHjF>4YrB*)@swct} zvr*wZdN_Bq`wW{)OXY_@GRnC4XNIPAW*u1tj~#1#nmo<|Tl;qGZ4BaHk1`bFv_;8Fy3M=g2S)8f31U~~8O(Kc z2wLa#Z~-EN9^V6CpOwRHv{-hFx>{6&c}FlUj$vu^Hqd}~puaTmh?av?(Wv}wU}-4# z5$5lOh|1-WQjCncIx!)bWuWGAZtn=?yS0v)m!)45(s13h7V(X;4zGk`5ewcaGNDCV zE+kEx9RoODP+rxfq92TVEy~xM9&ZmnOy~8|iG+b{=W-qvWto)_7 zd4_3s)IH9+y0tmXcoqn~a*R?&$e&kqXE)FKf{}r0W%KTr|heoXSs`HlGX_XVmiW?~;I!!Q9G|}eKOMjF)>f%wf zb}4V({#`isf&+thOMh6MGtmRvEn53Gr@454A9sK;fN)YG&APiMJbUN4dh?|ie;)sP zkF4^jATG3s`gp7n zP^!)PvN`6u*zz>Zn>7|TtW&&NG$`|3Y7eOQ@AgU6gsRv1`}ui&dObglFNz(Lrl1aW z>InX~-Z5h?h+f4WQ`q( z&pl@KnTcsA;)b^C(hjaDQ-r1bK08w2ACMF`4GB)ing~}4s4+omCn15-WEy7Mz8!xe8LlDK?L3w$b@+oGRez?cbX4(GuNPwZE zvF!y#{oAvT$}#mz^7dQ6C2M;&-qdj*StNgZ7hWj^G z@Z2i+fCTe}KDEj&FzC7w!Hx!gAYe9U7v4Jtp6&u<-cM<3<`8=Re6l7;g?96%e1=l4 zhgGHF=0S+70wUX$^}zvi07DK?vuK%YbYsjua?(!_|4dXsr~AHlkY-^sMFBIwuOZ7v z9pu8kS2HaFy-Ys9X{&5!P*$PKQzns3>8NUo7B#^b`~Ve;l|gG>B%W!^pxU?W1fz5q zd0Y7#_U7l~Z24cq6yaE!7IB1%0!xxP!f-S5GG(B z{MI5|vH(7(ovS?ARH0t@AfoL?rze&8rd_#NIIFM7?*xM`NIp*9m%6 zCT?nx9A@a%WTUjCRKm18s<8xo*5DN35e==ojXn8#kW7D<8J88x-oARL%g8UE~CmXA@WcX zzr^9w6|wCc&{ip{M^2g)UVP9ESCWt+6>`>pHPgvUxYkJ^r|^ui2^gLe3y$e%YFrOR{pSb5rU0lyBkN~c4RgGYx3FzEX=}}(`i2MS7j~p@)EvJWBfIX%^64uC4 zo^4OwlFCecr21TKM$0;kA{Jr4B2a z)IyIZnFaL)8iO$(*jW$rRf>NyH`xE8>`dq6xU($6-Wy)Xz zJ~6su+V3k1m$u!DK*L*K)X5mhtJv?j$>b{j$Qab-HN;CpXjR&6qW9glu}9SCW?v#g z3dOqDZ1Sthy_xupFQqSr0dGO*$zEvIgLsu0o!y+7Y`v?N+nd~X()2o4!e(&kLm$GNp4#u z4TA_y3Q9CpvCFo&TsdKsyn77H{i3-7)Z$vL)9= zkaZdjRakEFyXf)b>2=>+lKKranWM3>dn64?WEQ@GhLPh6W-?)gvk@H>P29E`I*Ex4 z{#~?sve*>ME|G>^p&ig|!L?S8j|Wx9!4=`OA4=fcOw_(cb%Jo=CjYChVyL6&o;xjV zetq=-F&&UKppa=mSkO_*x#(h^TDf0?k=TrASfRqBdC!<)3Bsibmfp=z+-gO)wc8Am zN687$2+ST%0_rGKLlbuO2~uKJP~O0;9$~aSs+{OxPs1Fu^h9TPh5B$OBeq|l`SkCy zQ>L4kN92**M~ve8Gy=@H>iMB-H({aqESRhIwO0lY`q&ab?SPl4sBidSO!+#$b*#@W z;yKe76L0XFY8g6@i&55Fi)n$scpHRUdbzD0RC&dLK9ol;vtA(1Yfub8Hru~2Nfk9} zQ4SN$Prt=J6Hb4&janc8me+oHEEOA}W(jL2)^Ck-SHI_TCD$T-@wiJ*(gy>yb{pPdI;9V2CT81#xnmHrZyRWOP9*6_ zE+RtPP%rfZ+_ZtO`n9(Y5Z`%Pp`Z8`H-7mdD8P`MH{S*a5~RrtaSRgz;}*Qi;3S)o zK=$SmL(F|R;$1t74L!4$oOCTa79KKrf)l_)Ul4KA>wxr>)8w`%zs%-d^)inly#IN> zAK$$)$t^6E3nPYvgGdu^mbO{B$ANJ@+X%|7ZPVu@$43O%2=p^(aXr&hm5}yVQCf-= zI##Jm#GcO>VInIQR-x~Ydoc;Fg8*DHlEv&7(mVD)|DI*fg&KNs(g8fUgIzeecxsMK zmf;cBmT1!~ZCs&vjH`hilR5C8_9NLaXdwneyf$CGx69p6B@EeTPE+0UOc+vpc9tX4 z(bLNeTZfX6!8yQJy=_z-X_tP)fjTdO1?-fm-mz1v;GDher zu4nx>)#7+MNjp~P(ZIy{;e8vEs;cF1G+QldmGG{V8zoJ!kaLD%4F*pgCk%UbF_Qjx zx)mKR9@VQ;3k;u-X?vtMoZ~gycR=&Co4cy$LF<29dJ>w-I*tXvWZYw%$v0A&^EYgl zNkx^Ek^$vm4I=WyU;i0rB4NL@lUi0P@}g1ccnc2h_W5v|gIPI7p+jdkq3O$pU4|+A zS@S;5s`|lBzg}voiakG_^v9-+-&A7b4RE}_8O$tFQ&GRZjvtm!k1r`FlBRXM&Aq?S zmVR7%Qs}(UgT}ifcdyd#{*_p2ESxFT#16*N9WnAlR+RYJsK3}zelc*07Mx(j`pLwb zOtz4Gbm~~5smw+Z|5SkW&dIP%YA%hp)#)mkH(9qZFVIt`5_H2pCpmp2N(v8U-3OZKjtbrWN5x>LjFxmK41`Ic>9&cco^P zEK4%!vL~;8B;8M*PGv`BV280ehH0f^{T@Db(W0G$LA}!oP?b8PRArh#NWXSA?wh!P zkH7Ilf1Z~HTHER_z0WNp&f_XjnhkzaVZ|wHKOkO<#40v9*g>-R5fj%)^r5>2O@s0f z;2F)`zew&gMsGlc4{#E39R`VzmnOQBP3d8<8s&wpA;kZY(_9lp`TIK=o#?`<5|7yq zO9fsX8K+2aIcX5f$^8AS&#Q&;py@2*06^6~KB`hVu_iaF4p2r>@d=-YqYcz%s@@e* zex$YVZ02!-AiQs5vXx7>m?#{oi?k?*DDlKS*bA|5`r#(TwO`ox8{iv3;sNUhOLG#Z z3Fa;6X1X69FdQ}|phPi=zFn_-QIJ9hE z{#|I$VulslO9dv*`VKL_5P@D^%~&Ed0RbAH5m3lax9f?wGK-KrJUD0tyT=&cj;0dp zgRo_Ts!OK?U6Y?IVJwA-Y}l$b3>3rQgn56;ph-jFpCHPht}K4k=o-}VQzri)LJec% z88d1?@Qt+gw)(>p@-JcB^bdgXihETQ@#)waRr1yM3MtM-K&PM2A1XSOKbr=7LQ3ZM}MYUbD{Y1V1c(!#75UD-1QAunas=4Ky>O*T8{vkm;^Bka)~#JK`sFX9_UXf{iF&Yv8+)>8GH^3f9`Q!A9fdCJ8Vj$xlpS`e%aqa`;O?KZ^+8JXb(<5>D zE!7u0!L6j2VBJYYfJ9*%?HaVyvbKP51Qikvv?F5p`Cw&~cX97H1YI+r5k71Ng>bbF zo{!5&OBQTtfc=<@I<6F>3roK+pDGgVMsaUY#VAizxI?XJrJ!UPMq(a zSBju0a)-ikS#N)CV#Iw!-8LvnX5MSg6_4X^ZVv0s!Ui;; z!XP8cT&G$7H+slCF6>KA^VG##@(7yHf}`3$IhIH$HJ0@nnlpRkK^~E$H8ge-{A6Ez z{JKW=^*-JXYAR?gvx?jxWZ=^8c)mHu5HvfV&=osHdxB7p%8tD^~ z3oFY&XM2VFbxjQKi#7iU6N3D$Bdeq;% zYbGAd-*csjskvZy2!GS%O>CW?Y=M| zP4tsXx5~-E3^qddKAPR#nA;#{;|G>S@xW|7e$*_Q156sE8EM`cMUS!}a@YhL2pSO* z*33(p_{A~~M;Vm|B--aD56t|_N$mNYZ(WV?t;;za<{u4oBDQc{aVk`IhoSuYB-SZB zUu13GdjJb^HFNbpErjwC7h28#JX+Y*1{Hr*r4sm;{xK29g+@C@b$Qyg+(w zm}3x%XIR?$MZ(|6T%p*s!sM5<@ph_jx{1EpVwOPGX;G~e@x?{o(^aP0Uvd|09UHZp zPMtwVTA^cqa(%v=kmNQo_t9dJ&zZOqYJg#4)1VZ(cY|#f)1%|XE#{Q`#Dw6-NIYf# zyV(M2E6+I>H=V-r`*V$HMCMWL)Wu4DpmDLbqLQx}5r!|lG6lQRV!rTuK$DROZHnRQ z%^JpSI#<|hzTAsBPHfWn(1ILPje{aeguyDsWnDI1=BhzY4ZAlX@N@4@X7A4D{bX9Y z=Yz88Vq;AjJTVKRB28dC*GT`09saI@Z%JSsEg0{;e6qW2q$CkLTjth7tE$uuRX=^` z(>k_MF?pLKrS24=Z7r3G=;Te*3fEG%Fk0H_;VSpY-~xnRg_kjXUaK&`pZt@`uP>0MlkV+u`mMVybsb&XvPrVKlmd?7widGo3HRk;@M z`>ooW4-VTS&XuT^PoyU8!obIqx0cJ|LS~pki;q;R)}*v1?J_6W#_jN4+ZY|)RKnN3 zO%=3}-&X?9wGR2jJgBUP;{<)do;XFNCpUgpOe8kk9OcPu#0jQ%nof7NJko+J^{CFW0 zVR&$X=Q)NL@AvLDRGNyd46G;-KxVyWX7Y^%0C=XgJOdU|g0;gsQ)T#r6(Uf^jz{D*m2 zj`6$Uc|R&3cP1PV`kUQae2wGQfx$rk1lvq^YqfT43WK|5!6(OKIlVyrvE`DX(f+-A zU(pwHOH=^W9oXyr@EUR&%M*Nyz*U5_z&ypgdq=I~op7p0NbbOmhs7J-QGunDKq%wB z6=7y7Zt^!%eRY#3(GG>Ls;-@IF8W%&49&xRzC^HR>U zuRnT#`ciLHCJ9;(9R8Dejd=X^V6`lL`0?IT;Nt$G(im@q)BVjtZjj>4;PZWav%I@( zP~H#JlfeH?pe(YR@=OCg-D^(`kC$fQFkCMX@469H7ghcqSspS}Pn~UNgCmtx6-)(z zkle*PL2mgX6^!YI`-_V_-J!P?t{4-cRe7i@Ub{g*!^EzzJ0D1#l-1XK_o8HWjOQyU zqfvD$M2$!S_+(6u4qGJX+GtYb^8gE>f)#4YEI;|cZ#G2nu9t1p#3W@OZ0S-p6*wD z8frkMC#d_LBu;KUbl4b+lNb7hJoxH5t9Ors=PG%M*o)ieM%g`N+bM*AL^>#ebI=de zLi%Z{mcfN3cu+Dvi?JycZ_x^op!TRRX9NAagFcasdVJh!JTVTUtiH4krxW~kRz9T8 zy{S-~wh*Rp#Gd&6CJ}ZoFETDnHjjdo9uo{+B|3nlJ4VQ#yk!`NXHiPXk$OvUbMVOf zC$(R=aUHufRP_s}sCY*#hFd5_uudbHjubr*8HiVPdgvx4Q%pvKTnZ?7Q9pU0g+m`( zuK3zU^h4?ikcsmOO@nTk`dtImyrn33(A<2q+L@{O2XCY(Cs+A@e4nCECI!(WS9XiZ(A! zc7M><4e0>F@z)(!5_yB^b|sK5gsHJXienD`L|2sv%zM|>ERuXHSYf{m>%4BSi~c%D zhcJxUa`jmv@OztfrkLsFB{sguvZOtBvBGS17-*-=`-!tcdI49Exf|ldyq@ar7Yc%~ zCr#u(b#9}L8!4S~ca3*NK1r!Qiv+Z%*be!{AeRMfhDEOH4LYT^Hn7{F!E=V3U3@~! zx#x}c!9O&&s_%~=nsO@%Di;zP1|s+y48@1xHIlmh4oGRxxf1IRGVlhg+lor|y$3S7 z`p9B(Q3q_laVVIFKXoST%vQn8MDz>*2{==WudmwroixW-f!MToDva07s14G{40@(h zPE5qdWueJKe5?$t@~Iio=KR(FKp-K+%y3A#NA_dT8uk{M9Qkx@(c}kkeIIEV9I%jv zIpojMxa1ifwQLm-PD#;C&*MW5#fF*b5dhYztZ#CB6WA2kjvp-qXz-qTe4elZ^a|14 zA9J3ce{NuV8k7@sdzK~`22po0&I*%^SNf>>GvKLqxJo6j1ck&M=Z5jAop(gJzBDWWcE+{`Pwrbs$E|+SJ}v8~<-=d{mQ;A_xuVyvSg z#Cufmm}Xv|g7z;0sf}N9LajHJ)2)#gCFh=#W(s!DMGvJ$C7v+SWL@kLR+RhaFlb67 zt4!ze@;ww(S9%S(|^^NgB01h(eQ8uIVA zpkYa(>gQuHAaRsnCFUZ6B-OlZE?DpN^b^f!s;tYOnh6zoWwGT3f_L1aVaYmnBR+7b zFY7Efhn-8W`ldRn-8-9OZk*J_)Cx^v#ES8xYj*6s0}Mv6NRt19&XSxd;_Rp*pKc1&{XqwB-C|q|i-?xRV801J%kU14 zB0Cf)n6~LPRYUyL$3DO?FT@du&%PKN6eOq-&zRYM*uW{{UJjdvn>U)lv{I%!0c#f9 z62mMCs~nd=ce;qMpMrFw{0YT_1O?;z6dvMP?TR9}R+XQcFM}lmK;3*wYIKb*DN|ug zW!&q0dpfCbh-HWfS?b;*?+w}?Wj;x*pmu8Vs+>kh&b-jJD~axMyM%^%P#ue|ALa0#$q0jxE> zbgG3}G*^Oa4-S3yTWe4-B`k?FI(=nXw}(EPHE)hQCz5c%UvmGxXbh;%^!xQyA%5Ml z5nBdVs`eua8_Qh|CXPS(e3Qb;;#YoO%-2|EfdhL^sBtKN7GRlV`Se;;P$9x@(lj}& zusOy%u6A-;$O*rUA8Xp@1?F#~)Zzx-eu&$(n_h*S>qLhhxsQon^ZTJb7Gyqnf%K>A zNSaQU+i}2!fis5ir6xLzBXSyyEjS2wIOf{1-;d0EM8 zM92dD&*QeMX?FU8e4<*^wQFn1a4=If5gPi0m;OG=9SWE0J7Me!Nz`=05WMPMzU;aS zEr+9kDcj~coR?#{btg>qe%~_P-!rLNkoAOwxx@*^>Mt^I@4;fQD#89lTXO3V*gko{ z)k6{kY<3Q+f-nLpS39c)&+dcHFnMKa?TWPq^hD`h*{RmjoMh7aSMAUsQAW>HaF?ts z4es}-F#Gpgu@7hl5fA78kY}0ycc>rJe-|VE<8~w_``z`fa)3`hkuGSy*c)eMX0vs< zJ{IC`_@sk5IT&Gkn)wWK)jos=AY#stsgaiiE#3Q znYHbFiEust%-bp^hGe8T|IU$_fGiv=W|rHLwRQdN6@O&Ut^s~|R;YHdTBzcr{Cmx4 zN{gejngyOcyJ7b9M@_^f^3iWkRc-bGpLJMqq46I#5qP@|6E}5%sdeCRZ~KtZ<*G53 z?Odm~gP6@xCEWCUmC>5{9FwV55qEsvZSi%N1>2}mw1t_9)>EryO(ZUSch|Q?9mEPc z+|L)`<0;B6r79)yMI*ms<+buL2Om!#ax(MpjKHw^^e>e|l)%7kAIT+;UE_dmpX@Kj z&pI8Um$#4iRMxiWIE5k ztVANP?GmbpCXoXtkY+q$E04Q>9EPE$bd2$gVq+v?VvQr_e#`oPJQ_GoZFo{JEeVO1 zxQ6Fx#_%PmsH{*}EkTTZ3^*@!j$hc6yPZHH+Rc90d8y;$k0&)p@Ja`2AF=!rx~-5= zB8F;2*s>LSW?v5*HKe>$Tu5TEXGyKe`0)5krIl=|Evh#x$`eF@FltMQe>?*HU{;3; z84fK}2{C0W)60?BW0ZoEjTii99$&B*=<8HXxea9#2}4D(HxeP9&8h?nR&W7J%GGzQ$fmf4CxGu7BOxx|Wo59+&*0{7lpH4p!o z55h;q;#E76SZeW50ARa0unX4G*Qj>B;k8x)!DIDe>Xd$q0O~TS`!8l`Ow~;XSYq!C zejr!nPMiYA5-LV6bXTIYN%g-Xx!Q-@NkcQk_q0I|Vu=QY#%SBIJ-ia3T$`hn4+r|M<>fG0B70C1#n%8fZj`T3)6|(kM z`(<;?Q5y_$=JFI!sehv9Whhlo1j`Cw<}eYW6@v(y7t?|RKm-g&D+9E@Q*QXymGd4p>@1qhci<} zpx7mW>uz_!wDw2OoRyS z`UPfCN&k#@B?nrHg98EVF!osQ9d_f?=}f7vvVKnOS%rSgZEbZu^fGmI#9^X(PIyYr z2mhX}B{<1?pwhSP|8y4yxiE+DMHB#$=28%B;l{?$Dg22b>uxyeZZCjUL*U0terGVJ z0pD}zCeb5vF5ER!eFVY|zkH6{k*C;x+UssfmU@yTy2T){B8o{A(fym)g}QA_)T1?Y zDdN6*h}uOf$Q8kIz!J(L(+_9rjoz84s%6A$?LmbXbOw!pi1F-OLRg;!p~-Hk1VldP zoSGEZDWn{4T5DHEe86SP{vtZVKiO{6VvhY((-7~&tGRJP;K-D|SST(YY}Z=QBc{d2 zTvcRPO>Kbt7b_v9a{KR^5D5Nb7Zz91vzD`rmP`_}ZZb&51#fkg9x;&pg6H|dBXlA> zvSt#hGK(jQ-0CqEwy;F#_z|BOD3`L_#VR6T`4 zW_E@hsGd$dq7MJ7Wq0zV{Kloq1>S-7-**icQJK_j(g#sBZ#!@1@oDL5HpZ=Fhcx<5 zYBSvlm-RA7z?=G>@(gc`sbn(Gp8%zc<{?~+ayLuJ{XQJHvhh}KxQ4egknJJTzDm?T zpKR>-A)Mk%t|qFQSd_iw=OixlFj?3#j}A!c67UkgqYwnkg$?}0dMEwmCZ*S=mooXI z%2tJEI>`Nvi@~GKovll5-&c(H>o}RojWUuQG(p%W?6Qa0#_XC2A_#R5R+cFAnEp}H z`1r1jlN&oC28kX~@*;?j&+rl6ryE@G7q(ca@Ha(^kEFj~j}txTEyi^5mdqRwjmx_; zkVaK@COWyPrOT%j4t46(8<2uQ?WrT#SE4#oiqt8FmBf0%^vKMqlW-hg5O1Pfcc_YQ zsWt&T`Gcm0=yCigj?21$N``Aj%wf_Kumt*|TD+*yyJG+C8s2S;XGj<^_v?=h>y9g{ z^dJ~mMYrD<^$}*1u>ST%`x@zfyO1W}s&H~D z<4W3b|EyFh80%*l&vh?tQW*mY1XmR%1s&BrQX@n|KoHKhyfJGg32IB>pPwU0WrHbb zrH93gma@4)LRVjNPeN{LOL5~Evhk>jbK@MC#JqB4x~~AGX4;EHS$dH?65NqLvgO#M zxH~?0<#m5>kts$qwz;oD{9H8;EW7VeNrST$e?hnTRGA&QgiP#7GIgDXr=)3qtp?^| zdW|BrqGDOtg_acsJcN}yl^dYiM^Q?*%QK`t7M-wo?3z3d^r}!#AkhagmUN-?IAhN9#0 z!Ga{`+6Gy)bInTTg_*9tyM~|c_Cn!->!rNPF?{`mDLd64%J^tNoGdJW$Uweg#n>^hviz5bX;9-wM!@pBYg*w1 zJZ-lN2p%6I1#E;mwF~}eM`(;lRAFVlY3<&`B=@#*DllXvX8U@pUgf`05!q zfsZaV_*aI~(}+y?)2`_j1z{T<)0(~0uJTtCXYW2R z^Ws71zp5Scj`m)!$eSj3P! z4a5+8tl^xDL50(H{J`lOEk)U2ITK&zWoRuWy?x1iHV`S^(_ye~au5-TzsbbAd*9lc z;18a|W{*5t#uynU1tobITO~?nr>=ZFt1l+y3ml6?_=b%lNpxga@tDe=a2(EC&*(4S zoOZleu)k0*`uez!9c4OvN}u#pzP0)q5qZbSu$k3CL`V+yaSZNZ(p9Y06*?$e*+oT_ zGRTbnnvYG><9=>es`uU*K$%7~8l&Pwq%@}DE%!ozLoFs3l_XOl&A^XYVN4)o zR-i=9@{>-dQuvIe_Xb~M)~v(@|BAK%T-l#i5g^`I$M3pQRXefbXn-!h)AL*ZTLYut ze;tcu=t`^stE8wHg|i1*T(lzQ7nwPH#YQS3=gm}!G@^pD3AXLWu10bk(uEx<<->%v z_gp7QxZroS41Co-2$ogWSr7lC5t_9jFaWuUv)%A32UJ(->-;P%am>=sg+b5ST4muoYemD$`oS8$`!u`0L@6Ubps z;!yniP81PRX9`>B^d0jCYZv59%K$281MSvqhKNnjOO+KxtR7m}sa8O{@a?7ZL35OB zMFNM?mpaT`Um^ID2cdBr;5i0Uh!hgTLE8&Zzu0HXHs;+bcsHc&FTwoq`a`NZ^r%DS z0@<|=XAllc23VUv5L<`IHDVcTpZUD4NZj^^-gqS~j&0^7T}e^kY~gdEHH420l3om5 zM6Kw@ZE@7zJIG3G4B4bzr4rj0257^IQoB}g;qXmC8%0P%Tkjlz>IPws1A%NZsE73RszDu|1j~1#Sp!p`s;JU*y_Xkpn^+ElD1wHlYrJSQc=e|{(p>} zLzG})l%&(Fv{7l>wr$(CZQHhO+qP}n##HyrqGzTTy?g6_@lKq$5noI;;|+utqQbt? z>4&AbG(_3W;`<*>&(19_^ulDzUs|2-D##S=ePXq30aMIMQW}ns>zwbIyi0(;#`q1Q z+7RxUGHg0s9?s0HGP|;81X}9=L37^a;XDXLI)LJVPESiB3sT$*>jsK**zBcn*>;%N zh{`%@Ps23}PEH#`{<;6!@}Vv<3|u+w$Xuytu4kI16449Z^UA0OW{wJKWwHj_(%~D1 zg}=qGUclnQwa;tXcr{XNHwk}qkM+H=(CLafXoAWfZ3qN&cV5JXmlI}X-U1cseG6x8UmrV!gY^*#(SVuX~PZp)93 zrS_+Ce!1k41f6k7JqbZ2nbCTp|IWh2^qFs8wMvgPMWmkcGy@FmBASXRmb9aXEM`hM zx?}kdr6t1{llwm9Xt7<4-3dv5xWS8K1;n|6@*m|O#2zp9I%uH}@Svtw1G#PmA)|W- z1bfjQeVF;NSCsAhLvm zA?T@}lsa=%9ySZvm?>!rCn zu*6`CY_M1=GFZhQga0Nyw^7!6VA&CwU*G>RB|l-TXKS-kzRr2=;j_~A^V>DumiSlu zN(FiSVGtkrmFpTDZOX1tR^5OU7=@Ep9$6pRk(J-+Q7Dm>(FwA4_~oe)mI|90GT2OT z0MD*bGBSjxn4V*z4!0-NMsEAhV;m-~ryX^tOfZ|!sUKlH_LAlk?a28CLR64bWuGt_ zF`-Z|YqCn5TahaO)TEW#D~~3m$Lz{Kxz<)Oas{F_*gyV?>8n7!sLfe1bUByY>`j4u z{y}#v2L-TnweJz|Zx{py-MGFrwpGGPf+Lf|{=o;$=uHQTc1ih{kKF>Z)%ETXetm{k z&YTotXL=N>DJ(9}jxU^78T)(rQEa+U4N56m^lu{ONtF4%cylM_m1SvKC=doTgsuX% z8ho}%3d>XC_cM}N1sg20>4z4h{u>No*2_ZXRjP{V$OXaPPeL^F8`^aHtLN%%VTvdA zC#9IWDEH7)7UyA2ps@z#A6k^-wX;LAwZ68nmiDTuhxNNR`_C=jz^hO6l3CC~9D&uF zu;AA@*`p$LuREl>f)jTY#~>+dqRDp{aAQ$wTGFTbflzjM^UM2`Ax_c2@jM(0IQg2X zkTusS6M>%KPOcY%aVR~e%{S*P>md34#!#>LR4I$k_4;4m_t9U#^$*jF7QQ%@3INZ}*Y;vg=1BU5HW?p?V=5cVvb{QXJNet=V#J?7cDB<;P ztuYs$@!WdwTy)R9Oy8+5+|S+p;ZO&@%7mdyWjjSh;f4AafW7D%aGbu49H{qwcTtu3 z`f)}i0b~7c9WzHo{P|C`8QP!!(*+w<52Bsj^||=@lFiWkcgE#>7so(Y+LD^3{st0d zeju2l+cBf>jC0R#9qUW`Cc-vwNf4W_7XhP(gH;jRy?gC&`;P!D6)L5%{$*k` z^qNbnZDmk%%QkEC6*^^s>h>?&XAijI4*a>n|9lx~BpvaPuNgP>Rz077#etqL4 zK+^E}k)J0Wrfcm?Yn4zdOp@5izlfsqX|1AJahj@QjamXrbE!u!`$Ce=Etu9rd}s=bWk(a3qNI+s*xyNd8W<|AtrZxVF^XvON{f&`jG z6bcP^$tMxf!zDbzi8e)ystUtvkTi-i{o&$nB>P1P{vU)t1s<#0;c z8%hKe2-O`3QHBhL3_1}oCu=P#6@3gYm>8sgt-NRrfw0RG09Inj;UzZIiCF)Szla1NHl@X~(D8$Td6ZEhyGCI{}sLcKd(f6%62&7J@aUIpS7e@#?J)6p~N44j#gYN4=HiR2#+st6#d%c}(6m~KMlkdgkgVQ4kf7y;6izm9}<0KJa1GI0HA5Xh^;Dc0+XR%2& zBqn5mi)sVsczOVyrGr0g4b|ZnVAkdP$5#BJFb?1R*zADi-(MXsxfxySPtl}`J=lli@;AM60m?;^ zDV>M2jT!^PoEg?muR0f`#fQcUDris@m;O4`DKvXB6P5Q|B%$eE z8e)KwpW^+}-CEwAf3oMe6OVf0_g*p@DCmpmkt>CQ9My4!mqo^l3oMGTK%CNS$x>Q8 z->(a)q_eV+(}qR*L=vU+gBjP?8p6mJdh$IHMIWE%_K|*np47v2Ytc&zuEYmgcj@wB z1pQXy!$KOb&G0X)C|0@8_o47aoeLh8LOqlMb?q+CpOT#4-Ku1Z>>L9S)kF~i#X_dnw9iMQTJFr6-6E6h^wo55GMUxu&PMl}pvW3)bRUQrXv{64a%4vT zqd9ex5M;i$RHsv3?!?7Xj)yd#DY!B!sVbxeVR!`KKWLTN{=;B+Bi%t+9+OrJUa{{aDt7wTz{d~4A%v# zHT73UZJ0orhixEkmwR5QR6sIQz>cLS*L@^kxSkKD3-ZPy@wdOa1l#8rTuV8#QJfG_ zJ@R8MS~u4+?6n$2Fi4cW-f`pqb%Z-VgC0a!qBrk@_tLx>m*NJ@g7+(O0Vp+atPoiT z449aVZKhc!jPjP{ktLVG{yQ&nt%oF{nC*;JzC*>wam%ni6w$;t1Jp!AmTxKSaR^IXg-$Oc zqkk<&!_octpt{I#%31SLmWzmS+P9{%7jatPwJQ!HV#JD!RNw94M zSG8GB793b(1KJB)5y0Bj66ZU(u6da=CZ05R0gb1mfx2qZumCA$fe+vY1>8dph|J2! zJts1w4E42`>;UQp(&1B!s+u^fI2`-iQ%mJ`JmBNPurKE*0KNNn3#F52qy2%2s_vG# zGm$o10;QWUfoXlL`d;^S_Gg49e-`%>ajbKGwZDMh+0~`(e0WjttFAj+?Fm7{ zJZSj$l_@=qf1&FrTb-%TfCBkA62bi{{HJw6>K_&XpLF-)tkqj&1^%_rr|u`+$pzgL zBR9&$nU4ij@=eQS6i#KX&Rz*6Xiw_gwPcuuq?4;zntRWcu-)M*tpb{3Zt-Jy4ou?X z2~aG`fThAu)7)P5_LNBb(yRHm2iWZtEUmfst9&GIT@EJ?_Lr2(L~b^<-0eVIspG6W z#-aOlGK4mR0vZzT&-0koQ`ttaYn5x5j|Hbw#P6H$$J`(A0~lw4|4y6!&nN}#|8GHS zeCF`~49J>{9S|VUdHn}?ca!LsdaOS(N%Dlwas0Bh4OzYDthtjO64PS6NvuAi*-JP6 z_vx~TB>Z=YX^@GN7L`}qw?8EJ?ql`lr?mDw*0(+}VL-CBq}G~)jIt?<6jXpct;gn< zO~RWeH)`PXq)2CaJS6s_h-hb(n1%nXEB$Wl8~}5Gc3;h61@3m*=h}vdP~KQ+N3U7FXm(ISZ8@=K^@iBxYwR2 z$}rfR_wXk;a-VkEp4`pW_R5G9ewaj0OlLHb9>@O2gzQDvfwS~$WQ6zcm$Pg3+0P|W zlkU}1Zi7r?+}n5RI2-9z!Q-p1tZ%N*PAq{|`_GHw<8v!r3*rhU&l|saeOWq;EcG?? zi^o@Fg{u`N%>4`(@HCKm2*e#DqFjZHEOpE!?xCV zTw_1Alq^v>OoBx7gh79*Q9q4_)qRxS=rBxTj9JkFQbRM%mFk#G(Lu-An#+D~s_IdG zs*fAX`PKLMwqxe_Yr1>#<#xQ5ZR7%K>&!erg-8R)S%avT((NduMQYoUjNh~R{AO0? zDgHxOL#t!@!I!<(mlTxhrUwu<_Uc~IT{YqfTY!@4SJYxKXzf$xM$4Au1fveiC}p`7 zlM&?U5}KA*Cx{n>S7TRP;Jym#z@syrLh`UI35zTaHMUnB-JF^AN_=?#bj%feP~-5p z-A&oOo?&ahp9Lyrq7=p~_utrY#0EadVe^R!ql9SD7b;>JSmv=6x|!(bAa?9N3$NOX z6^`?oH4_M=>S!fky+|7o9lm^WnOGqWhabGkkrH-Evc~+GTuoPR*tB=zOxHr}5kb-G z9EW_|n!t$Ne0l#%paHMlWG2l43c(qli0NXAbuV}UbiX=kKZpbnUdA`Jk&P^;E`Vdw z#;|{#lbA_MY51M;lixIwkC8Mg*gO!u7;Zl$foTf|KXP&D$U$3=59{ofRD~cQS`%BG zbYyXT8s|J_MlDh9m3ppyayEYT(pcxE# z+)2u_&F{M5fIB&bi4>+zkQv?ts!d5;|J6yhB{3Tab}?EQuP9aZ@zf);gL&|Vp)|+2 z`~F6s{w2Z&+7^(#l3WnkJs|4_!KD$G*cR7K8WP7c$WpvBwS-U zZALXP2}=LyMA9oqPX545hm1uOAg<(a(+=(!y{-f?1I%JTB+g(5NA!XH=@j>vMf!cH zgFIrx51WSv&$Eu;xb+S6Kek3G+nKndRsyWVn?0HJePP0%84XiZCUUi=REEL1ujI*O zDw#gf$^yV7V_aX~U!L*5k=WIkio{*SRL|q{EjnBt*P22{kON*=6tsdhB?_Hz*Kl=+)Cm`fi!(D{Y;O zr1AalCpC?zB~u{ISV*jXxCchkgm zCj~6v`7JaRxPlInbltD+EM(KNTsj@2W(Kc9y&I~Amm34mg9Kd+qwumC4$4N0-B;LG z(i5yU_Y|ham9`tF#`O4^bKgk4-IByWqQ1RsKkBsku;4JvF1EuQnS$>mrdV)7?XFX& z7LkF_()MIzzPjIT)X$^4uI^s}G`@Au3_yw#F1QeS-E2f3M3pk`ToTrHC|@$KUQyNx z@Kp3vKjI#eLdj5wiGnXe;RS!vR(J(w-=PKEaTW0s6ot;XFNw>{pNv`=BC@Oj5U3&8 zZ~_$-G~$<{ux4JTCLd^hJ!|ha{HN()2xRBPrZN~s+MCcBv`?wnsF`^2= zMY%I!v#TqwnFaxAOT3q(B%S%-$!Pc#=rHhJ^sFxg-&Er}8k2cy%sgI(bwDQZ>{ya@RiN z+#jI@;?F?0=0gmzxpkME4RTt3`QnW$UQIUfN>an-zq5;*yn(x_G9-@W@}94!Ea_g5 z`~|gI`?~y_$#RuK#HO%0s*O7eA2W$yprM!&#p6?mU8RP^%4iL&biRoeZP}-hEUINK zSym+fSeYiFo3*$XOlEq?)#$2%*bIhFoeU~4ZTwx5a^IEh!cD}*QXheEx$ro*)(ktO z+r4=s%x2~zgo|5Wo>1bY*`x{XSck-VbG2>@zs0dUcj<}=MNG@*nCCEoz8YkOCyDc9 z*>2u=b&FxudRVxiy=8?RnO%g!3k6=OKXkqu>)OX#6S^QBFPfo_$h%V1x!Ksqg~`_s za=-}RZQuR1n*}DWQ&{5wc_{bi@S`C$c%abq;)Xc0WaVES6%E&ZP65_q`EU~v#?FFl zoo1#~4B9U*^}~2%$9uQz!P_<>hLIh3Y})3KIB@~jio+lC%s~E{(`|t)GyE)dKDIyM zlNo@xX`Fe7_amA^D*3nEfOo2!Hf%(zVMQbuI{h&s0y46C5Y@vw<^q2hv@bPfIUdNu ztil`U8j1)O4<)=48oM3}ExeuR>qJkQ=lX1PH7KAlKt}Kb7^x1Ogei1hs>OJfEE-AN z^N8AhzL=0}xtooG?g1Hs8i<%x((Se`M{ORt)LgUtxG{7K(JYYp00yc(w8)@rJF4$f zw)1sow5@4Eq-!erRYXG|t*!Yx_^t6-d_p$_7}=W6dXlIH1(%5fjbl&zGb(ATvL^({QEE|KcP5qKEC;nR=HlZ>mA*yS3tjzV46yM~kq z*d3F{XJ15W-A?#rdR+41yXH45x#0{~45i2uSJ;#xY8s!~LnL1u<}oE0UIa%laDse5 zFgKaR;I)tc+>&TjHp@ZZ1xZTN;(Rsgr-D5F?vC?b7O5!_x?7ybjgUHPo8EVqCBeZ( zt*t}T*(j|Bd+8m$P&;d9?399wWW0apb=*kym6W7&=8@#OTwV=>82lHO;Q9TXg6w_xVUx`qZ!!=#*r%4=mO@C!stocG7=0n0u!6oLS{`+_7 zK76@N9lg1Wbi?7{dmq*SqJr}7iBuuuA2KydOU6$w`*Ofy#1f3^e7_h$*qy>$EO#6^ z&?bJ&P-}2+$NCcn@wu@22I?*8Dxx`XdfNnvSeh)ijc$R(%(u=EE8)Drr!=qc!nuRn z+{=~G3;t?vf9I|s_g>vzI1PEupT~=1n+0D`WMN}d% zzY4`h#Ei{yDly~-=Omy(TZ(t<$2Jp|u>i=Z13OxAF}v69;vc_wzqb=?73aUx>1_Wa znivz~|COy+)|ieNY(ePx&mlGTFBHJRPylPcorJ6Ev;LG~odiLL^GjDT*z$a#O^sVr z{`$Fv5@8Fr-rXs)H*Y`w1KdA4Fgu|1A^IOMq&`FchScsuWA|%)TY<$8jQsWuF=X_D zQ+xo3`^xtZe`Xt(RxgJEVj>egSkSO|2SABp9@9#czPi%fCXb7nB6^212Z`t49+P-S zK1sVypwk>RE)SlPOG+EKY(R{y`z8-eg*P)I#hL!`#Jo?idCwhtxT!mjjU!_w?V7@0 zgdz(5Y4n;CqEkj1cP%BJQ?FurCZ?~;L)^gmF`nA^_91ppf4iE0?BW6E5zC1~n1zjA zZ>}Uo3}4(J*uuX*ipNL6L$|#!BkcO3(!0KYeK34BZV9xyeSYfSKSZ~%f|^5YeSoM% z?yNo;7J2k)MP#CIRxOFU{xZ@gDV(Qq6zx)kazTcs{Uug#jvB{18ZJawp#PCUQyo%n zCX5^wQ(yl$*aM2)&f4^&8@Y2_lsetYr^nsuJGe%LV;3Mnta+un{0wMNaqpT5Z-d#S z(#SUIN{=8&9EgsRJuYI&Q5vAC1lw%@>ny7GY&KC5;%L`!$eV_#PW1Dv#L}_<^L87N zO06;y9Xy{#HF;cGv@4eLY84oMbwPSDeTI;5Ji=*Hi6-uqK!!z{1T&QG6k^udl40h; z&yzu#UbJb3$mpnc;s(pL$ehC$ApY6cVAa;c;E|zg~k5wAZ zLsmnVZ8jK@y!X6TGf(l5E4=B#vU4W%eC((X5y@#hyBR{ZyXdj}&;tUx0Kc3ZU-M@w z-ckp#l+85py&m_oVj>*}MK}ei%0vAmOwMNNZ>P30!$h!rMj$qQRi0&*?aS^OMd}%Wr&TgVC$*CllLrGxQXRv(dU*lFcyK>* zEGk-#9v7)&e<$rmj;Bc?*-e@>VSjWh7Y%^Jj}HX8r&3rC?iZO;wAF=;C!heN=_U7h z7JT%NPkn-n5_W)tILWa6AvfE_K&BY#&JO;d`yYRO;=yhr;6wEe@F}t+*1$#q3sr+% zFD8iBxzK()ww60W*=InRh*3JesAa=FyBCn1JtAQvNF9yqyM~1htQd4Oyu76-Q7g1j z$Y{%fy?~mnExMr{E}v939eX9VokP>4&ZK)Aqn230j6>_LHYU=?iSgvl`$yPwZjrq< z<^-$p$SrK(3YlzGNgvplMprvK8{n&mhNz;qOh2LS_x9cXZYXlTG-}S>$dqBMlv1f~ z>s{xucf9wY#!9?WdRYgvrlwI0Syo&x@%p526H7wx@n^>KO$;1j0Tus;-1yIyOc}SG)QxZt>@J8 z!1B@uyrj=xN$zAg0`%3atP&P}SrG8)-=<#|2JYjcIE=#Kpe+l1;y*I`>UMq6{eOI? z1|7(%l>zCY5|+j-nU9-apN~e*85P`aRUQ~>rx`ym)3Hdqn6W;37`=aT;u<#=7UKpR z^AtuURw_1=o>q!%Hk&?@U$;1zYc4rU#}58*LEY`9*+&oS-izztw$%iOupD|O52m>i zYj|&nmtqZi5xo}{*{7B$Y|{%@J9Kr-ue2+yHPc*FCOzJpy>qvBnp>TQ zY4i@h^Ehg|6A1Dd5+2dt>J~34*__kpY~iVN$#ax*OuK&~=UhkN=+bAiZ21g4QV@## zRav#{x`T@G)G-vk`<#=T$h1bMM-3V&^OD%)jVAQf@lM(=DFlrdgq&mj7`=@UiS_aZ zKK-aa7e8KQ$u4N(Nrd~`+oTI3#nCmQ3f1)o(p28MpRo!~bL+6UvOks@&X8x(0}r-G z*_()5Zo;xMG&oZp@a=h;d$A{;l68|o;86Y)Y7jbraYlu{v4BA4JP|&^$2N^ z1akdleD3;D@T{isn7-B=dZq~RLV>Y;#ot98&0k-P@5F^cp@kvwd zb^0nYvb1gd!?}dnF*dWDHZYQ~E=9eRFuJ}BTa&*#=a2c!8lcCp<}KE-cc_zJA}z($ zch2}J=ALzL5l2l+3bXAq@HBB&x~u)H1mp5C(dm=>WEH%4C?0YU{+pWX8FIz0SXFg{ z!4P&fq9uqT?BmB^cr!*eM4>NOSV}F?N^n<#8gG7WrW)(hH?7?&r<<4$1@H#4O5)78 z%c}(=r_e4Y?fmKzDErZ#`Sw%MgxDw5?I}FQ2jhlYrPCoyO7W&iFyZtUY>{T=x+ezj zO~!BfTr)sXZISqJ9GNtSl_;_F2KonDhoMUJKyZniS_#kg-^R39apkWnT*piWRv@R?*`a7yOx*TTW!dsw+pom0~L35nUhz zf;|$!b1)iF(1;OjkM{UQ6l z>i@r*V_^6%Nm(U#J7Zc|0}DkbYg!pR20A)g5pxGeCp`Lpp6kC)D<@+IS`jOKCu1RF zLt7(bS}9{2QztV#W_mh?|JwJz*0#3YRB8C}@dfqwTK5FR$$3qU6!vG5Zc#6)#v*lv zMuzrJG0%)9svx)~`n-H~kNKK0y516r*m@BpkRX9GJ(=QSbYwFvYo;~Iccw}@Hl=VH zDvb|TW@D+ai^=V{8$Vn`p1)f}CBIulksuER)+M`kgNHI!7y=A&QrX8tnGjVp+u{?R z239URvTt7wRzW<}{HmaaqoVDbMKxsK64A^$1%?AMQ+%5>csk-IrlCuCb!edL%6F-t zBe~;48zG;hhdTTVXQeMN;LTSo9s=G|$8d*-it2R7!-iLmH>06*tf z!XiL}*;+5IffyVZ=2$?TH5ASfGC=;PHjxVZeWk6QaU_$Q#U z3mhD87!;z9ObZ3&r^rq@fej<^K;cPG6-6gx%5|UJR-|*_5vovdpL(>PD!@4k*oK~N zq@U@%&z_E)=dL6T2p4Il-<`*vj}C*V7?d3xs*i65uu7ny0Rr#|GmMo;8e@|{0@4F- zIV~8brBIoR6nUOs1MDE$Um=u4SSG8#w}{PC2aQ~EkP}-DlLvL2zgbES)Cq*tFhrp) zi(8Y7oEU7NOu}NTZ%>Mtx|EymzG$|Wf1fCfTxy9;LXHl}U3h>Bovu1*Xq|+dqIT34 zl8}-jO&nbq!y$zZ$|`^Zs9Ra*K1@{zVpAYQA`l%L1KWITOMp%ykw6F3vhNM`RYi{S zEb0ISkf5#(4OE++ZD8BUfr&-V7_u3|f;9u%#rpmHncL8R4oT3`NU-a1r zDB0vu@1)5kLEfa)G)HJyOsRjijmpGC8{BvhtJ-5N+V+J*8r^H!L}EL=vhiElHT<<{$`jHXJD(Nzobo zBn^+ecw%HRf#~Qi7I~jKoN8odpkJnvWKkhrTKAxPrJ!$3vw{_cdnkZBk}`Fm+7oW- zdKpi_G<-Gisjk2zfL$T%aY{rsr-V03d?Zn&Kpj9iI+8uCk3{`>wRHN3F>Ri#9Z) zQ>I$6yjkP2lsLe5U^667CizT}3y6p`t}IcyA*DU8f(n?f%zcz`q-O>m!yRmUcvkS| zA@5Qo1UZECeEgWPTP`vOA@$Sz>zVtAIEc6|0+AmPx0H9*twE#;z+5(lBjDer(ijfe zr;}`KZs`>vGCF#mhb|#2aHu%ozhN6OV}H*gu(Jj5!q_=-_VgH+;Qm4w3X#G*4SEA> zCrDuj-_??%T}T#bvvVv!D1`4nLB8D(bORTEuJ)?b?$Bml+#AfpEdQMM_u0~J3};?k z+BmOO`J~uQJ>)L0ezH0DdT4(a%ISJ5duwvn=4gFg+y5-?cBpDUPwRdx2KJ=GTDQL8 z0t$WFW_=;<`ofBcq5Hq;nEl(L)&lwPF9T`1$kp|J*3B##jy1Da7^|Xs8xnH26^<~+ zY8pbI9trC+Pmurs+v6ZSYIIlFQxPdD!!t{~Qv#B~C^82e+JL844LXw)$U@7>mq-{u zaJkFY4^348*l5L1ir*Ok2{tM^ND3>WCc&@X2BRkIcBX;o@C`~MkO1;S#qY45V_4AS zE6uwN!Z2;>R|3p#<%_^Pr~V40qwo~nXTH~l+PgY2Yv-RyekmbC&c{6=)OK+dSTr^> zi;L1E7~LTO_t7~T0yd%_QB>XYQE^^xGpeVgN^d`ca1(MK#L()o^7m}hWTadL-wo6g7 z1|r1)FsK>O&zGlmY6k40%G>x`0?>(k%1zCt)`8R z_zj@tp#21*D>8QI%#ctgG^D30%|Bm$)trC68azs%CV`_GS}#gIr|%q_U#A-{lpk%% za%L|NPsTqEFP}#rXQ$>bQ)l0AX-Nm`u6|o9N-9fmHX2PfrcbvE(6%qyGMX1n=2^X+ z?|QB-q3AW7GcBQ&_Y$0&*oB3xLiub)#g-xRi}oF=5#9B7h03T?^|%)ToL2uR&xY|k zc#jQNM!J8VhX(4>@z8kioF1gU|4yBH+kCE%Y?&YYU_Zukkf71Q5C0-0|H#68Jk;2R zdp;S=zXY<~%v6vWpG%w9V23?~QGanXA1*o?A~+tAa*GpH^G-Z4_tsnP{8$s7T-RAN zJa%0#0WZL#lK6dO9fAK1ig@wg9Ccp(#v1LyzG!Ut%9pndI5b6?FfppPl<)~)tLHV( z$hTFYmg@Q^cP6XuSAUec-%jp#j@}PaovnD+HJMGP32=G#)f2sQNMu6ZuNGwD2#~;$ zuX*kH{o(2!8a;!4Ojy@E8ZJJ38g^l)jeI*SQUyENeuz$(kSJ7Y?4(nS;Su)qTm#!} zeco&wfr*<$~v9!LQwj;+ET?HF8mKw(u>6p5Hk#`ah zsdD*Mkko((;(ft-`L(u^nrea`U#>SD+Aqv9jyF&8gnqm`0+c55&&y|z@6A2el)mL~ zr!po|e$8M>VpAoF0-aOVe%{{`RWBbYizi4MQ6H#0wcPF>t@**Ae@%fRs~SEOO+ugL;3_>nO4P$!Fk%|$;5yBPEz4Cz6)Ow8oO;3(FE)h; zpAf33BxKYs`vi{^yZ!=ph4|K(UiV&j>if5fh^@GCkgA0o<`2Ai4^Ck>eT%npUF;YW zv!^+aF4J-gZPNf)Y&WPcgI`Czc)DZhScJJg%~2r0e#1 zFW9P7O>261FYs!%Kn?xEc=PD0ICaG7Ekpa)s(4nz!HFiyE7I%FV3Z*X^3zcyKU5LC z+r?SuPNH`mNz7LF#$_b|ZnALakotiOvuooyKd`0E<@q`3EX4&2MhAf6;AJ*$wu;lL zkbzTzkVw(ZeYq~+Px~z3v?*;BqC4QhJ8BGho_-hah?NPV9q{z#aC-DGgPq(DvRwCO zcT&fDM(O;;O5(kvdoajSs6hx@B)z>{w4dx$KOoi4a8s(lD`x zp<{T)O4w`RW`1!g11)#Al@E8YY7W;R`}9R(3Zs$&pO%d>6v3@eoQ_cUIr2#nt_Rt7 zRVAElO|-5YO5T~fI1Abq#fs%;9cQJ1tjTsipv=e6Fb}x&sSZtYkn0g*3f`d#{X4$L z%>Bj}EYEI7=}VVa$L|Fc!|ejPB*4Tb7cpgMJFkotm$2wf7uUOUOU;|v#d3iFnfF5V zjH+-=vKOB(QY$pPU>jgU#FoF9fpNAENevpAqz+TiqjbhV}u{;jRn~U1&>xU2A}E-<5r;UiHxHJjCk~Bu`Pla zcmdG_Z1^7Q4dl#Vx6K~&)M@=r8QV7)LBgY}7!pxr`&}H`3&8%TF}-H~T~q zyO?VVDT8LOiT;Wmx8?J1vR;A|cB2|dH6+WzNzXYOM9*9@w?lxA&5rx4``G0|-AUkL z5l>^{MW?$E?6kD9V^lf>9i64hb8*j>n(TpB2}z-Tu$KuI*!mA6pEd+yRxftbu!tEG z+|B(nMHEh<8=q;rT0?zcGbR(5*ZCVTFSY6kjl*o4ZJKqd#1s8LNtd-*moD7GRnN?Yz z&_rd{KaH2h#O|MQ;i_3|)CM>D4T4!oIP0qom!S>nRdGc#=|R{{@9odc5^H2n&N7Ia zKwBqA_$XN4DSkr?OUEsW*+NN45vW%phE*v2w_)A*R=LZIA&c(9Yyn7vC$gtOx&Xs8 z2s}`s$p|s?InR0a-IhqOkAOU>?X~+>~*Zp@kmnJFdvo0(Jpr1lbLP^bJ+~H3Uj;q4Ct)t0IrRAn#UU zrIPI9^IT%7q%>(mk{OpYSzEw!?bx6;$)Y(eZOrcuL?dnI{7gtq1M!r;My34|DYNqm z@z;cPFzg3x#@uX)9rr2)@q6Z8e`2v`Tx7xJ(L}9zQQj-UFUGpg0KSHgE|kfzm5xI^ z2=F673MHS1VyEcIwOP+Ten|Y;KmEbVc@!KrzMBI9Em%7rp+8(tl6_6EV*^~$F>Idq zN_bWFPQ0Y+y{*^?1q1lCL@NhpYQucJ*E;kZ^0F~Qy^-r2Rl40Qq;>mZTA8S-&BTlr zx*jDru%7)?MWUW}s=E82r6W9Sxv=o1jj1(x`7!_RCuW*+C1^_8_^zYWGOje-Yz?*X z(KK%Ry;j7f4ku)O@v9ZQfeW-jb;CeC;#-y)={X>$B7@2)TL%j;0^7>^QP_4+zR>$kAU1W&q7#O#jay<>y@9X|~dXKMSF zlvqO`ae>5lunNeztjH6&4WnMS81fZ=R%_uK_}7>6#=||#>0Ldy00lmbu_58mh}N%B zVt5@TsGX`9FhYh6>h zGtD$L=QZqQF;Yq%v+K%ZXD7n|b(4}wm!7O+&@u;m4qh{r<1P_5;YTa9lWw>$)$H4ghp-SiS%C$5m-`?Z#azx(lc+jlH1Vfn+-BkG>{DIsy?BZp zSe@h7I<-Ci0}o(w6x)VqU&1n~j3WS&>JmETCfT~{WuRh`W<{VdN_ zlvh(XA)n_->-K70gOU&kZ9y`vmGgp_hF#ZnFNROSq=jj-Ul^d4O<0f^O zOY074cHX}=>0yF-#SVtPJ`KKIr<53N?Q9|1dM6tEW)qoAG-k~!M+AA9O*Y!rEgKV8 zaK}2eeBNCig>N2#T}p8d|GYNu*v|bMU%jT{+j*R+`)mj=+r+Rfh;f+yU;Ia3ctw{| z;ZMCq(N1B0f-B1UY#aGkyl0KZD^2afsu=gcM;C$cPI2Le_jy=__7vu83Gnj0+HToB zlU=frc7E$h+okQKj-nB2IUrWtyWu$XG9GgyPu(5a4@=vZHoRp)=0{3|q`gl8`d5OI zHeed=C{JsC=63@DvBYe|Zpko#g;Ww|ao!Y)Kf4Vf8pf6r)&o;$Xch_{R!S1JuL6Cd z57MbQ+-9slM~^lN&u%~3Kot+tRq`jTb9Jt(C#y0yB+nn0zcgaUVBnoQk|V4k9Y(En zhu1a=*K5@rvdcmnlegiuu2E>yY(Fr!W1MXNzoW>^_CJJ#vM~Ku({Nc+I`*jyq32Zf z4X#P>UY`&19p1cA!6tKxdZPcj#c>?Rh4%duu)=S^WwwpGu`*ic-5E}r|9*)Sbo+aO zpLBrttm^7&&-1kN{dDfm(Cw$&^Y^&>^HEnCyx?^}@U_Q1mkZaCFTVc9tQ)N3u!KDyPhS z=Expztciz<#4ClV3di}tKMcoshS*2Jc8xoJJKjn;o~ldwfV-aHd^SH_)jq{OnzBbV z{8Ed=<1-}GxBItxk)qF386Y)|k?^fGKw}@dgqVx5=QhsF*Ugur^y{biGTF7{(>6Zw zTKMhrR0dAaHmjibck#RM^BlCi5+~~h$g=wtRz1{t$Dz3t`0SgmDF`SDet={wXindq zfs2A`zp@h_00bT1=!_gRT*?nUIhG0V1kW8IG~V)RnBTJsp-qZVj;PAkt>lhtpis~= z4b@B5xz}o>49D#3*m%}7+>3flA3QGgpJH4aqx5uzChz?VGTOWVc;}OVC3Kz zM;;J5iZxhrNZ3u}mrsLy;k04T{?44}!zC{s)D#j7grCNo?TY--t(4e2z`Ng$KOyT* zEn%OV8*{S_ua)3i6o{rUx`5(9J%LkVZBWBgT(cyn&=Tfu7`9lRu&fTAwg@_&v^eqv z*_yA;5H70-%C45Z{?;5{ZC%rn2ErfdCOA(Hei3umc;1iCWI6N9ALv9%&t!PzJ#!A+ zN%?+Dm$lDyDTJ@wj!10`TWQ&A*Ua(+CRoe#OUZD+p)Oghm>7^6#&bymHEE@;hY0`l zvu_0y(tf}YlAkHwj6#rG>}kSw27M2A0K5vQ<> z?zpp(kl8>%bxXemLVBH9^$UtX(fMa`H0O-?JUc{YeFsp>KSuE;pAjVU2VY32=p227XlB9%ZFjXkA;*4{}UB%oe1Z#1I+1fh4Yk%8UQzJV3`` zThEEM=BVP|qkF+U;66xVzzWyZ5&fnpYUh-AP5aszW*y>D9c$^t1nLRb7WD>@lyZeQ zuCpiXa?j6_>o3_lX~Z?=lboiPIro?HJFiw6MXuYHrY8n7=hQejYGBjY#MW9_V@(*^ zSH1ldxKt(t;|W~EmaQm^?VMA}6y$Ra(JzA!slM{38Oy1Rx)NR{YD18$nI`^xpalmu z{KH!5ct82G(KV&XdlZ#q)AiUtpj*pC0(-$7Ow=^xbD@G4Q#SYEA+Kh3Tn{GE+(N&r zbRX$@x;e)DkxUlOyzy70bVO&;KE*KJPBN z&U}c~YJ_#EY7xHH>eDILvmMp6kR4~LHD%lwmdDq@iAsbl2vCQ|W zF?LG@3vvj+yTBj(QNoKcsK6_fSutX@i49_}5`Dh_jJO=Q=;f2AwbL*SJo6;4wL-+2 zfLlv7U907m7^khgJv`pd49H)-nYgLWkIJwacLo?{ilSIFe)Y1rZ06=W?_WFl?frF| zd!wZO!y(tLJj0Sw40e`pM5ThxJVcrn2$y9BEifx`_DR^~>?Q!vobRoYKRtY#fN}{h z^?X&oE9mR8l=$wiV|l9Sp|B4h<=ViT6HE&>+6|J2H6 za01L)SbUSs_^uThGo)dOYdZmg5DEh1&EMi~ybzxyO;73`?S+HNSuF&1KL*$7pj)_3 zRrBv0n$5xKLBxe`MCyhWik8!kEfGS`SY4K5rx!Cr&od4g{2DleZheuSDh{4aLY>de zMwFWdM~vo^qw!5M)1X(KBSWyRhoL69Ywl9PAxa2E$QB+NBi};+VSiSPKfGVscHgCR z7*1k@*B5zBPiEi2kA>Y~du8ToIskSbbl9KLLg_BeYimPedgaSs8#rk|GsBxGye?!j2u6h=8Ys9z@+6}NnyZ1T zt7&bqO-0%ipIqFPLd0HlpEz42tZ0eN`EHP%O&#sMAre8$&Cnb`Sf38*Go?y1l-PGT<_nAw7!jk@w%aC8Y9G60$W6Xv1CzKDYJmnD%t^c*g*Lply za!bV#d)9?yB!aA`4ZY;i)vMy%^N27ceETOk0jGpQaT5PPp%TSm1KQ&OSBtJ zO7n+GswtBaZfM^1`e{V_yrx9D{y5fAey4x-asu;eUb=v9PBVfApY}W*moI(E`$24;&ssUe<3n)~)u!80?~AHgf-l72G;V z$+T~gSeGjA(|mRu=GjWXbxGmjYH+dgmpmH7gjXu_WGY8-gY+gu&?a1!uYZx-_E63; zyOY^7iORkRU2x+6I$cOAvYWJ~y(?3sYW8K5q#q5w*1ac^zB8J`t@`E=j;d( znW5)@iL0DU|J6Dp2Rq0AJFfollA{jTkUQUL9zdz=i+`cs{q9-uv3^>x+!2KT{NNlB9PqZgF}tCUP{K^&-wV&)zt7%0=I0A0 z@UHVm)khSB&tA8Qbz0~{P>h@_-M#<1M#!~pE|0ynw->5DGMmr7qZa+pD*lix>}HQo z(_)Y;e~|k5K7qZ}FkYA&b@uAD3tvY(0dAiC%P@{|pb}>|d;0s^(7~*#@rFIJ&rHW@ zUvmUAJkII4>qSbZpM_0Osl=;(l!Qmkrbk`_5fs6N8t}`{dq}629tuI|chE z>i$2o8nMb-OE0uHoZ}nM+1bTTdDHyC3c;iBKcJ|){E+Q$%n1AZOct;2>znG`W%dfZ zKy2X@@srcCK~)FDM3chrpL>-LDRO2F&RmpG)l5o0&9jr9lDaffP4PK_RT7>rqZD`1 z#jX8cifso}?Aa8csXZsqaLk4bfxvK;l~p(g&ji0e+IAhxj!D(AXGc0`=Ek9w0rs&A zIt;JPb0~<9eU*T ztdA3Y&FFSHd>+fZh(@|sXYLn{3vjr$g+Z7w04*G0MhIK-H(nsqGKP>ty6L6vr{mzW z@4*N*GaCLKEHmb!xoRf|`<8RGkZDk-xq_edKYVZJ4g7*+y=;jZ;mGF*`0wrcRO`N&`KVFMirr8hAqy+Al!e70W z0X9g%9Uw!s3`@h21;7}+VoP*x4>Qh&AraBSwB@~CS!llEK`m}ZeIafEZe%EJn6Z@U zAO{sBGt_C|B0N5O@igWE5&dKf=I?N1qo>=}-tF-2q72=mkR~aQBXpjJG02d+um`>WuxrLmOuk;lQDHA*HI=taj)U$PgEv z{K`KXp%^9QXr~{7A|YC8C~oB4BSdSk$1jZ<6Nv1f69xzUf2p;5S!`HF+dq0un8-dvPl3BDPh?PZ0gE(AK^)v zOA^A3M&J1Fo7*@Zc-&$2I)@j1Q_P<iJ1>%Ks zc=9ND>CW@Wv7E!2oGC_~^KkJQpnngu^0xT}hHV;`BrE|Gwcn~&tNt)t1Oe9!D@VO6W- zHaw+As@OwD4aGHEmj3arJhfm@xdF&PxJ0~xjIPxC4yV61hvC}(i7#m>SS&6Xv4)qy zdQ5mej6%UtBuar=o2BCL$jyyMjPBzcVT_D(H=vF<@dXS2=5Vj!lqz9kXr%^XWB@0#YOgw!n<<}TRJlIb$U2Be02!?8`+iXw$2%cWVIHq< z2%1B-Tfu(RaoGhaO(q3Q>cDD?SQ(N~Ihuj*8?Z)2I@&?$A+p`4+-m*ALO0+{M`BAL z1}{LC8@8NK1AJ&%B^K}sj_FcO>Sa?UZxgVXIr=UKu&B4?UGa3EQ-wmdVvd z-UbJM4arxX3di<<#bdO(yka-(#0@M%q5ZtUz2|y4KjH)dI+kPzgY+=vs==Mj0rlu0 zqlNB<-LlC+c9-!omsLLzLSOaG7EI4ExB@p=wF3lwI+C$?c?F(~wg(5NJ?BzYgQqHX z|8NiW*%t*jf=}<6rvL4--b^ayj(v~g=`a&Hr|*u&O^=OKExz)UY&BjPMMk|0tIM3 zk)3nO&oXc$A_XbZ83rxOJCwpe9Aj%=g0bu$m!t|fyemXkIUlt@AxS*GJ(8Zdy4oEH`o2(6wxfc1 z{1kMvO#tBAy_?0Z#5Xst?q?0iu8uh7e4Q*r!<)SBZl8?ZuTM`dch5cIaB7&pe5Qxr z8Y#=x({LQBxWgEG>mCh_79;uLlg#&Jlmp>AjPNJ9i{L+R!jeseOSv)S+gzZ}DPAKe zryo{9)oW|H7eF_ux1rf(>?y9yovJtko5ISneIMVxC%Yzv$K|J8*w|8=DU|k>wj?>g zb4SugeJpcXbp92#hs7$amp~;GtF*x(vUYa4!uhU{@&*Wyh+P8`5fUu%p;uBiTV^%q zp)f5)64A9+tzojUKt({;GyG5^44%me?+L|!Ii2o5_7$FzWM7In*N#C4tei%UqhsxM zsX9J9c!lox_!j#dRv2$>Zk*hy)A=rLs%{$HTsl#5Z)?)=)|rw18FdS+CA2}WfZd&9 z;Owv^9urW!4Oo%_ZR)+(j$mmnuy` zFc{Kva*nDG{n<~|LXQ)rYG=J~q~yKn2;`QB->)M7vyAT|Q&dU7oVIEkD8oYjXQ`%q zr|%Gl=;VS6vZ^b|Rf@N;GV~vC9e(MlEPE^n@oA}XmM2}eU2c#U zV?S?$0`GvAGNVN+Qoj>AeG#bAdPOTIsctPY*K-*gxr(9P1vAzPN68sm z@Q35_2gnOx_vkW-L6W`V0nQECbTomQb3iVFpfk>T21S2(=NZh*(@Ek}m(u*tG0EaB z*PIXu=fo9#!sT_7jzXu!AT?$+(Pv5qftZ1flBKU9>M6VHB+y5Vyu3+c^QcyaA@TRGvvp8XM8Nvb3Ayri z(0#im9(i@ECtjr|8#S^g6D-P%I_M1FNgf|h9+5X=SUP->u}3wB@K-SN96i~$Ev460 z7gkSKU%$9jZQcu%Jw=|{ovQEGJQ;<E`Jzk=enM<2{un2Se;&lU5KJadcPTI z_lpLxTG?!~{ABQbUN)wW=Sv-bRte8u(!;!?4VgjJIc$ltEAuv^7P+#A&*Ak$zQy-z z|KGL_{of|pele%l+YslSHu=5X-gsZU9}c*pE^Yt0E4q*7X+oY-=X(if(o^<@)7fr7 z!JQllXDs*<3*Ql&30!KUogcWvF{Ru&%Bj1Liixb{4ViIm5OOQpemy#OigoO1QlpZn z+*WH5AGcciKPZ03{q%Up;UUjCAbM73)7X3vqD4<%^VJnkx;{sk=Y8&G)e5(OUFZZtr`9!HM-u9Vqr)k z$8(5Qp=bL79@&&E443Zw-{7+@?2nHQV@*_f`N&3my(}VQ!=5!(AkCrixk<}G%PzK$ zMQP@~DOVOvP_)>k>LS*;D#efMA;*si%Tlbq6Ae)qWQ0kih0~{$_>t?Wr9w{Ys)r_a59*uGizrBHv!k;= zHEWe`$7sFP@J^9wOXY-juCyQDoM2;eWefX2ZOu`_57qH zdZ(g8;|!AD8sGJ=FBBbxN@v_TMHtls(UXxMBXG$O(_T@vYp$zr`#cqdD>L&=CcJ!0 z4FZ)HD(7J-daW#BN7VT=4e+ezhsbHQ zxvEyPoWo}Lw@>g1Cvr^^e^UDif3~fm#*m9kUskeb#*K?9E!+s;7SNW`)l(D0;KMb^ zo)@Kt@0Ah33h+a1r)eoq`aN|55huFj<3bC~CT0_pLcO$q0_&^$QMu;3B;pf!Gt}^m z2KZ{N<8ARJCo1>exr(3TLM7S_$XvHG4hVf|z2^gK3p)`vp(dZT@asynl7R{>H!)(C z1W418NPZNjKFVu<_E>2r-v-PqDYjJO8jU+S4(NDEEOB{A28oC5i%O$y1}pG-DaDL3 zcr${+<>uNOCX{OM%{%&_3^p7=1l*BOqIQ=bTgf6smBBi}YGI955K+p*nc0-~%(3!9 zt8w4e%r2Ag<2U9MqY_9GNA~!!KCuZaE)cumVYzZ~BQ}FAGjD|t7J*DwCri3`D zPQT&0lJM@=T(?Ly)ZShefUj6)#eHjomV%-v9#3@1E}p@DwQ|kc8^JIw zMnJq(L2Nd1mg%-s^ z@6U86%G?VZHjlzS54v;YLmzqCWLd`JqU&eN03~aQ7Bn6SKb;F>DoQkEqOu^@{_dSp z+i~Jxf%3T$P|DS*q&ru-0~vEFvfi}(WpjN{cXEX=)jdwKJF2JPc*3BbfPe!u5WSt%C0E*VFoD|^y|^X5fTg$@j)g;TTA5_GIyD@} zHaG6xm+5bapq&t!7T(S6dg8yOGNG1vv9z;+lG~MQrX;t69Hr^xfg~kU3*F@}8+YvEZnyb8;O_obdm z$02{ORbxr?jH-d=-en`1Tq_d{VG27a(gT>nm9N z{&MoP*<6%i#Q^L>0nKCs!0ULYXVjL?=({JYwU!!Ke_uHMR@8{swvl|=e+(}IGT3_F zHrs1JoWVBZ_j?2Rb0D0Y%Y3&yZ&Q~}OR&qGg3x>y)z3tEKjG14TyDbT9m*k#__HC{`zHMIz&yw=mAHL6PqMHRhF zkkX??_vQmjpS^}Z?2S&dX5a=kpH)A11}O<*Zqjyiohhb9vcC@SJ=2zF_InvqHnQ_YQJ->OpYzqoDsU4)sR+@=0AbBX0N^M5O z$-njXl$EYEth7nVGP5i8RN3E6u)6(yA2qi>GGTu(M?|g`za=BkiWd#0gSfq@UyvJ6 zL-p+vDyr%EFfXq7KQF&K;0QGTx1jUi9Zxg=PlM+F2|6uso5wUCpoJ%NFeVGc0!#u< z@elMPd0K|X@#+&6N6*2?k2wadYk%K zogulIujclzOV77+{s~f!`;G8Z&vg2}--DZ^q$q!7ucN;^Y#rMHjXvi_ts0Mu0oi-h z99qkqTXDP3Mg26(;mS-rPz>+oatKS@U$EEPxs|H9+j=@UR@-xz?pOE_$gS1EMmx>Y z{b%J-_TriNhw0`ogCl@yW_ug^$_8)qY}+ahV=Y5))#(F{Rm~2Mlek~+ zU(*sah}lYn8>F1}XkV4$l@rPve@&b_=!u^`-`{un4$rGml)TvHuMM+t_ivsV;+v9E z)eF17`G3IluKdvTg`eleN7LJVD}Gq{r#l$AE3~*+eA}k{HL4`zMv$M022&H1FjR(G zMR&LAu`yEV@d0>FKO*{7(CEzni0JP+bu724^6*;d((Z|u5YVS|S0~#Vbv4Y}t{jYO zthQ4SV0CvKLBlh^WfeE@SMYJJ*tPc$xN867p*Q&P&}X1pk=u>Yu>LF5s^~De@x!*r zA2J%BDGAYRQt2k3ULln$!q|2kg?DHwTaEzTx~i0l1D~|@&}I-iZe!&@6We_Of*e+94eJJnY5wg9k{ex@-9b!5FtP9h8yQ)#Ws|4{$fgUtVN=|Vzfh^8uqSH}Yfnuxe2g^JU|e3*?q0Gcm__l595`xLJ$+P934l9TNwg{G z%EQHE=-TY1@@92}ZUfNR+Grd!!|Vnrg99ye@dB`I6q|Q8qhn&O`b|~-_^CCQmhoH) z61s*&gkjs=_Nwf5!G)d}A#rIjvY+*e4#uKOodP)?NE}gmo9!n;DQ9a|WYz!?kYSK3 zqoslPT@$^OZj_u$gB15<8a%m-?6@W?N~OqE z^zcC|y{es>eKf(TSsbj8?#0$k4hw?Bncx2EY0hE*1N!NN&^hmj%?wU?oP6Q^QcV(C0v>bDq77KGuP8@CfoY}*m`^@6}LHVnMe&3_oq zMGZ(SoGV#jfq^wPRwUSh<=ETIBtihlt1f9Htf3>h)0y2iY@-^bPV&@cn(bm{kH|FC z`YuTw+fNcX-YCeU&E#L@_(p;ja= zW(lT*+@Xv8wK7Wo0eKAKUGN<54m2yLhTqob8PaMPI4x^k?D}h`_@Dd4H6l-_)tiwX z))j|LW5Z#P-EjfNH(?LTjST(rZ}eo{oI40OSh0YH_zjRZik~scuHtYp-)E^y8`>6g z_C_3}V2H80z??JLoOvt)i6S!0p=A+PFI%pM9uRit86Ux%2nh42NNySY5+~R*Zqfl< z7i-l&pGz|9RymFe$kvJ^85Sr|zM4dUbT05z#`v##PpX0$Gb0E;e^f=a>5iFWVQ5yG zqD0pqr#%`X(JXCvs;miXOvNAm)4U(`_ThF99ZoF+vPaMuINdnXpuAkRQUsDwoL|p; z--u0Y>S%g~OkrtA6S8P*CHdT5fK;YyFd?hINIldh1{504m$+mAu4?AoTAT9luXol% zfVz`;?(}9C+pH{XR*90?Lqo!(B=Y52k*AcHv1wh{`vG04XJ9*01~aTu()P_{nl+xJ zLAMi~-REkDKO0*RIS<(l4u3!TyrBa%t9nfL>Yg zEIsogd{lEi+U=(T5FYi87AxzmgSp2V;gqB_G3u1D+;o!G18s^Dy76G(zL>g&lkYif z#8Cg12~Jq5;GjT@TWYo7*&96S4SY%m&(2v6Fr5dO;m+;kAGf{R%9|$;Yr5U$0b_*C z>}C!=NPET_pyK-en=ffrgv*HoyKw|cW9&&CYT^PfC|8@IK`Zdm0wTqMWljiZ#zH~| zd=gCA3xauA-?A|7uD@Rs#oA-WGLXn%wrpdM!zo0NRl{@89CTw8xI-kOfLasOaIg61 zD&IeNsclt$l9qfnmL^+LPi8D?U6xZd2bvTJ*O)mzY3cmir+E8dFjBcva?M;NZh?fF zoXo84(lL>G=zQL3gz2lyB*C1|bN~V!q7hfOR6_pL?HEG#`*&Ht4ien#Df?$4Z>(Dq zD>p5_ykm$oNmagPRXKLFA)cOXgmUX_%F{49lIWg|tEk%rgQ_s=up+0J(d<$vcEE@Z zLjWMKf=XmUrY>i4Fv8D412J(N$#d*pWqO$_hRTM?K=Z>(rL+rzp3+B&C7l$XtV|)0 z)RlhFD>mG4TvF?z;h!P>lIGWa#Xnqae*aJcPrsY-Be$xF%ac>z^6TmNf;GF!mn(-i zAFxOZgAm|hg)w^N6NEE7FdSa}v$KC0(~a7=Q;C;mLk8#zycv9paPV>JkSA9Oy7g0w z$MPE_jJ>-=`{D5!wt~}G$(oRVBHPcWy zjkA${-fgGS^MNZ*wOHQ1IQ+f0)swGs{Av7OgX|iO3Zk1IDe2))l`4RInR0(quZ{29 z!i!5MN9-wkc_%y7Z2CtP8V)(nF2lLUi@BeOR!hz+!7yxI068C$eENwLby~Km`o&hT z&fdm*cWg>Hxh=-QqlJUL1OOEI^0g&%7CRVr-#mV-`eaYCc|sUxn@$&CzA-D`Ye+Cv z*$&-X*ksN}PSxh^X7hioall-h)BXpPUd`o&R)r?{Xz8avaG!JE?EPg+Nx}EM*1-1E z^(q&uv`qc-o;(yd^R_j&{cZKN_0fS>2zU6hF1MK7U0CaQ-Wl(&(_rbo8M^x_%iH@m zQfS@zrjyn3*!>`ok(^gk%@-#|#-31%)N@(c)YQ?bp4}TGJBdl%tlR7+5KX zzSUP(?#R8#b$rlvIu%xH3ETF@AKlfJdfbA!iH!(ngGlc~)!QTKFdzKazwd*M^*$}X zmPwj$5|jvkW!YS-t84SNW!fg|wS)GZ$5plwfPsD%Gkb;Pn%DyXl4wukiGjx<#*$_@ zn25WRP?VG_Q`_-D$E+KyHADzsjn+%ZnyR{kui$-635U2<^E?!S*G5L!njO05OhQP} ziqBNpYX$iN*VQR_#Gt@xcH^y`*WXq=f8X^>S}v~An-QOqHM}Cq)N^}K`fWD&<7p3w z*kR-5;Xx2GO8huU=Ny-pS0%q`kBA+jCohN4pYGi2*+ab3aLtOMj1vs*bkt5z`oe-C zJNF~}wHWw%Ve=qcQnU3BVX#$lsMxTrT>5wsAH359g5F#^kdto7cSC_V>I|6}jd5c> zEX&-K_xqYKJ^BvDAxU6BDuE(f{&ogw+7{1TK2|k1;PyUPQpP5w{BpigO7@d3*h*`C zy~V|0xiNG07_aT#@`4T6c&wp9KmNY05u)!8{w7a|tbZPG*(gtr4B7AA<2{I9D2dsG zX3m`l$>`U7o6$l7UZJ|>#*~yEzFD)<386L{H?Uw-{&tJM3#5(%#fB(!b^Vq^*^N)9 zur$$aCa_tTc1+E-T) zUD4PzLvSmS*s7-=FiGW`407dbdO)@sk@O49*4fF~D8#E2ALNtP8ON=FO&Hv8lt24f zIYNt7^v(5^Q_~+lbKI?9YUb;sc$8b{9)JB+rdE%+Ma&}9lSen;7PshsrTx{ifQ^C= zj{TX*5;D5aasuqxZYnRj{pUUhix+@DRa?5ooKndIVY+YZGZvgN`pjZSKxC=afI)t~ zVgQpqrot#`hXAg3$08OQ1JB2)kWVWGKzL@_4V<7H9oUi9>BXTE zC}!`1xmVMNI?DX37UW73o;JNC+ayY|-_GWP6nX}=y;dz{Smuzg6j~Tv2kpvOYn@0e zBjGZ%?(+w82R3gGDdm`J22GxeeIo(q+9pUJEF7Co3zP$MuCe#MA5J7!+3kHwRlmdO zbYb3H*Kl8;dfPSbV<1^h_k?k0lSu~4Eg-}$DW_d?`8(>o4#V7sq|JC*uiB{=1Buq} z7nlJC85v%Z@)(L0qOM#ypQaP4pzDOBCs8!`&&!z3IQ1De<$-QM%O(Zp%uCV9`F#6LwPpzaYh>N42=!pbjF z%-OeFP2N6VHCELH39Im#=gtTavE6mXG!g9>5)ej+2Z%64NY2$z%|R)Nq%FmG7pijx zZ6e91|FW7GTBn(ej!+4mi(Y}l0WxBmSixRkI#W+)iiE6o9o#MR1E3#U%?L9uL@On^crVP}gQR_BZj zC*?DBhB*D#Q)s=&W;8gpA1SO4+j=bNUgv`HOra~ozbkDoME1;$F;0s6M@Ph6g=rTi zROD!zsqjK^P>$$WpR$^+3 ziGfD2!y_f_E5WOFe1NRUc`9<}&ghP{U!JtKoHBe8F&x?=_mqcbTuV#2WoPe#U5h47 zGWtqCZZ1ED1)+-^7I}uaDbkPV1tgCizyB?F*jv^tIstb*`gXM$KWLVA7ap-odBSVGAn;dqn=Ns%Qv3~Kn zHyqq_N5R~Fb=+6g2$zCwi(J^um4*YMYXcUPY98ozdP6f!_%03Aho#$juX34ys-01A zjnf*t@Qu`m_4{a`J-}!-UtHPn&cTHh7TC!KX z2x97H?(W3F<2W+l)FZ+*i_U9e*ZWKRqgo=j$%(#Y4DnwU*|tjk?S5|R`KVsmU^j2Y zmD;jgt=8X6=Y2=UEZ%N4_D-Qz=2m-RilH4674h=c8FofJjBk&=8Xhbc;4_K&Qfio( zzUu3%;a8^2Qa6ImUWzpJ%$t)E?p8j{w}$6hJpEVpu$VY|K3K`U+m@^nE`J=H*CU#4 z$36jg!hctc9*G*~)o4^MY)iV?^D2o?{XMdtx(OiF3!XEh%~CcB`1fc62h-xAh&d7- za$YGjOxJN^Htpf-)5JDO{G?bTY}0lEl7Q=*z8h{H#z%)8Z*!D=l?wrJUp@d&p@!pz~_Se6c8i2`u_|Bg+mKOR?E)LuEK$O1FOp|c`3u9`$-VG z;oRhJyuOdq z>zdaWO7~5y`Jg!B=KI?^sKGg5v->&X1LX{+7>il(wC|&P32D3t=8hv z)(;I(9Bww!0@eIv3!|fW^t0vv%%_1wCXZ0uAuv~s&=ITV^eQf8B zYl!96%@ceatgpwf=3aIAZ3Ds90#5J6+e(v4@iJ>1Et)Ni%=fQ{FPrR_ul3(+9Phi) zb#n71JJ&jp7=0(kQr_RjFT*$Et_h3@=hyt~-d|ZmOZm^T@Lsb{8IPnv#}t=f#>~+B zJc8clL!;9rF#6KkMUk(7*%^^^;W1fmMGNT*!GWoI92LYjK(%jkxf-NZxKdfkqkmv@ z&4tmXZ1faotCgFb`~{}J)z@@B0l^U`y;w9v(-HEqt)1}i8hBn8Zitk(XUmo7w}?nh zKVAHRo16~y{k_M_sAW$`97UJzOUK!2nBxTw8DB$TvUcM>*7Qq|i#qc_|IB|Bq{gX( z`1ka$4N{WUWiH!(TNriCxBb5+d(fS3l5x@RFqxY&Mr7HrL=IwbT|AyHmtvoJ_#r|i zI9PespY>eGa%^oR1Yw6LgNg^{v`~sVV3o|bu)&Sc#r8?4pbNY1@?`T5-aj$3q!-Ud z-PaC10b=7S_vz@mCdk}Pa-&`K!c07wd?LV$Jdy!VGz#o&RguqpC&p1qHUIWqI+lgKzB zn2vw`7z1fMZSKfp=%S!3@vcDRk_FKOm_}W3uX2KWFtbH!Vz(SnnJz{eng;vVSi}1{ zDcFxZ2I(4*a$BQFC$+-X4cKA6oN=gF9*=&@4zn=Hw2==C12zY=LVRS{kXSrYe<*}D zHNfrRg8aL)7;5tQJFO*CV=%zAv%nRS9CM}JU`~5C<~e47eij9^9p2Xaz}g=wn{v6#w{qiYWVC zr}nFkd^zYwSYB92U;r5Yg)Z`_jjU-}`05kMXOY94mQ#&uMSl>k$%u1hyj#2FACi(lQ}{NTq^4J2_gf79FUC&z~F@xhn77wv^L#> zyomo~tkM!S(X>wCyIKX7beg1zThNTU``f`agb{-%#>3>4$~WG`yti`;xtI2%UE{)2 z1v+*xqgKjQvbP6UEQqnOCl+oeppO~fbjy>O{ZIP0`h01`4K#KT{Kvyb@K+nJk$sXG zlgZDQYee7(0Y)^cqe_HSMG8cKzH4w4gR#Ws4A}Ye4AMu*RkX-XQkjtK8+b3d)3Q`{ zxqwvFf0Zd=L$WL*Bx-@o3SV6>REL(8t^o_g;YIZ(>Ux;fP9V1*I7K#-bJILgLg0I} z_I-_DAXkNh(sFvP!u@e2DT;lR$39Re#pO$M(~?w*vz^DW#c%sdEh_*sCB|WwLl5h5 zz!Q)g-ACA924_81`iSsNyZtFYk_+ zEr6U@N2cPSZ*XnJSmtE#JUs*txlQDhhDhMSfGHuZ2W7Y)Ffg^MU#xXC8#0KM9em1% zSum;$T#WNPZFmyA(*QC+Pl;yI=_hJRGyysZ-hpW1Au__MCH3P^n=R^T%{U+(;nL+< zjHAd7t4T z;p>&0*Ih+Zfm#tMs#6wuglTCkNHT>%0lG1RNZY@_Pe}uB!J55&yJ`}R<%y5B&9?+J z!gBOIB5==}oW@Tcm8r)AMO(YE2Bgd;>u-{Hnecqug2aiG^g*umNf&CAd`9vIuydu7 zJaz;nAqQ5|R(QcFwO;26FVuFeLcvo8y)GfSavPrp%5GN$R447*59!FMwY83xE4`r+ z@t`3yRKF&LLEzmSq;Kpd_VxXQ<-c|^e1g1@dz-&+IemLxaIZ93hH?+Js zO41g?oLf+3<0j&3WmP#!`C4Ku0XUjy&Lzl|Kj)!`f8zt$5b7Xw4>JIU65kT%wq0rgxr(n@5{Qn`3$ zW=H+nXGAj^9JoKG*ry7qi2Bab>#ldSqpo9PPMs@ z33Z0G@D4_RIhY7_olHSytQpfhQ5WsfJQXs|KLf+H`9OA?*4? zN?FIs&aRS%)fa|-x1x^%pP-wQNyNtSdkM`tViRv=h3X)tu)WX%Jw{*w_li>rGD?i z(q`d1c_X_>X!M4{l67i&B;F!1uKQJ4dytW3;FArEsh8~{)tI^y&d)S*DPVPfjCS06 z!N%jz$1m<*yu3FLK6YL3dG~szMqmqKs;l1QLvGs=Ty=k(cGG~WWBxB;nDM{UQ!=ys zf7Sp;tIpYwH=k8cASaHbk$yM)ih-YLcetWI38a(iJf)43@!}uM9mx|J?eby=_JiaF zNEy_s^_Ti$d*KcA>}F$T;AT8pJoJCS@Vo$5eP3Q}d%}KyBx8XYXSp+aRP>8t7Pa66 z81#+p?%&=gmakjRfn1dzn$5;Td51~Zv@qy$X|-fEIhL9#ir%Z^E+0=*Rg1+ z-fKnxQFU2&t$EKx)9i7&ZO{IGZ~iY{6YxEI=zw%GWAfc-Ei!tW(ml<4837T}% z^|zswTJxZ|F!zK4zeW;Y>TKYjx>e|kF>P8$w_Pv4&hyx*tVqQz6@Rc&FQYqDYJLgu zpMFo|eUXMarKD2`Tx>dC+W|f8dqOUjJqfCZUdiYtOJU4ERT-KN< z7YZo>LcGnf!J(TtbZ+y*x}kw44A`WP+$A=|!;(WiV6l=Xr|%(=;`kR8b|6S4jh$_% zfyk(D#7*T3*x;b0Lrk76wBjC_Xt5aii*zhM_DrcdX?Vm$DUAlQudJ*{z?E>XBzr{t zDlJMLb!B_eO1t;P42BU#dCXbs)v{y8bi5j};Xnj4eDY8dTSeKuqLC0Te#;<3Y7~>= zMol3XTJ}szv1CxMMQ?NK0QDON>MS0gUI3y75iTGk8Mw8|b&-&uuT&OT?qw;dTk`Z& zLKg1KW#G=m+d{v-LbnbEkGU2T^^_h(qW`&6d|cmW{xok-_ZsK;ad>K-b)FgvERg*p zR|5k{BGz$M8Z;h>jA^bjr^vP1FK%-cQ?dD+Ppa_^v;Fx2w8B0&P`U`*(N50@gK7y)|rJq)gsXc9#9WK^4$^ZqFr26WW`T#E&qN$f~0 z*x6M39!|Q9EwUKZelaD~DfnYn4ZR6_%MiDE(1L|>R}t14BgG&^9js-Fb2|&ArFS}` zDM?BkQEBMGv>iF=46RYluRT(g&o+ai@a)-r=>`(H{t&+Cm{l>&llP{SFP`wZ4Tt&? z`Zu~pz7HiO>TlY@KJidHR%_Q0olQ zYK<}s4cXwDSeW%)YHHjr1Jtk6deL;sfc@ zO!+XAzSs`MoH!NwY)9E=5&T$>*w>AmTGfuA9TF;aox($71vmYaDGw0B+izx42HP-k zOUzbjMu>c8&FOkK@VS|$yl!h+9h6z*VpT0R8zemp!`I2vx=i7$PO= zz1A2w{%`nR;}2h6pszPE2=LEbeY-mKRm#WiIUvs563#Nu;>ST9B77EE zXhuMbfBI}Zvtyf+s)M(jo}##`Fbc(7N`9{rYIs`Q!TKOnN?&&AF(>R5{>9Gsr|q}A z#P=x`aTu{S$}lt~j+;brueQC7Ff!1VQAPgR+v{Wt*n9wZI!3G|6J=>S-!-hzBck;? zQf_wqKq2tURo8y6fx*p9O<_61kyEjrH4~T}zUrY`m{DDZ%04<~ANlNStq06loo%!J z<8U#D5O=gZe-`g*ObxS2R$#$Z9X2%=dm z?V~z7Pv}uWDaRtz-DY*q**LY@rkmCCpqM32mo4COLmOZ^8wFdWq0ipH&;%(6mp>iG zwa=3fQwR}O%w~;_UI*E^L+TZoGM$E4zWFF{eT7fQkXpGvkrwacf*BC+jieKk{&2WTf zi2nebGfgAho?6^jSM}FFJztyOS~(WvnrqTSU}l>eUICUUJ(F?Ii13o*{u7Ls zI8}vRQ7W-@B~X-L-IWp5j0flCkf&}$-`YEFT7Oo$pdDCy{76;?@Z9G-6ukcg7rzQ> zfbzX4v9>b1%#{kbe9U;Fy25By!Eqr*s-h#AYIpt218J5dA&HNck_+(hKJ#`d3 z`j7)-C&+j3#nWHBYb20zxOo4d4`uW|{f}$@Jp~d>2(h&HfgFjS3F2nU?^+&70(sg~ z%TFH=(_6;*nO77Td_#~v6o&a2;-=cx4sdPwSIGDHri$|Ul^4lC0;JVB=;oKuKQ7rV zDfxndM7Ax;5!Xf(X@vKg?BnGx1Nj@vbgU}f z6|v{_)2!U9NsJR*h!sj8I}p>A*Ic-Q)}xo*cO4v~SZWxeJRS}=mB&Y4`}|)(WXHyz z|6A1h@8*td%>RSZ)2K0Cb>D>aQ*u9m7;$uj`Rt1Nk_tGRegkF$=`>ea!aveGyn>ng z(@Ebm_6s;>Vrg%gGS1nBWxM5mn|}CHrBMYH9I?=K?}lgJzBxL7zc-%-XMccckY(z= zHOW%kjGb}#Dj-fgTz*~GH~mOlfVY-&F8cuPtl|5209HRTDuwD0$i$9Dw4ZzJ?6Xb za3$B#+gW3!8{XLoGWFSCC3azw``6p#7=Cy4iQC_qU#y>Z;H8@2_31GziE|SL{cRSd zYtNwaQ~|a5OR+13k1FOq<50`hKXA4kw_$K|Z5})Ps`KIbU#_w=`};Ttk9dvR+;_PA z{ur$X>>>=Pf}0t?Bu_elwVfz_gL4Ree`oU(bbQb&_ksNt^gZs>m;fzb!?Dh(8&mE$Uvq)tf#R!m^g}S)DRz`=oUe(-0#cQT+ z6yeCm@xq2h%VcEy$-*8%-XE;9WZyRk9^70hu{QWP4ZN&2KNYa|IH{=d4GNyh+)MpL zU>mb`ZCX+jqqr7SRyWf@uQ7WKh%S9o+-@Jdcyn;C9GtXWx2kiucWel0BelIE5oOU) zzu%!9P8Mf5IqL~D=OMK9>I`*0v`(c`U%@8Bn$a3Wd=uCm?9V5Qgmuw!Jz>QOM_7;+ zX=kAqY!(szG}m{UdqAgF*?3!eoIs8&fC+@)rXCK9TcA4$d67wNsv~NycYG^^|GyY} zr|wXovWlspd)2PDs-BaPI1EwRKTexc zFHg%Ntba1nAxdGZBa&bZ(Ykg19+*6v!bEG~nrpfj7vEVO-j}(B_QNg)VjzoQ8Ae+Y zwfvTgRyOJ?PXFyRNbdS4iXf*KDLj~Gh`q_gM~?l%Z0vqdlTix8A&7?ueMR}2c5|g6 z3Y^wRr-|tKQS_s{FG`Hm+`9{N3+j)t`a2QVI&z+YG3Jh?*)n^XXzMh*%C91px)~js zu^dGb44EOlfB4>U`L>5TP~Fj3L*9vT4Q!f|t54<*liuzJP^J8Nc3EwXwcW#oQs~=mOhg5bmSQ_e&gLQjVt)u<17gkc{i6v z4T1Dy-UPT$qzNC2%3AH8yTH+gGh<(FAZqF+hfqV#P*dHWYEe=iM`XU&Tl>SWbWy0< zj@K+uDQ@FZc2nNWTU#F@;eOfEikBySIpBTrLYQyPTc5lQMyc&ifGut3^K}nyfiGBv zt4J?LgBbSso5zxab~N|_T*`XS(vy11H)%-{H)gIYbGlNCcff(V!FNKnC0l?nX(T(B zK#D8AehTZ?2jBQ<-rZIn$U>xf7*%zEP|dsXd;#v#-SM3|e8IMeR4s19OYXY(B3&XQ zmhj)SwS9e*GBsG_3QM3O6)+|nWCzI%-C@g6y-r$8ompN^JP+!jRMJqqPxDm|&Nh{Q z3_y-{v>p@acu21WKN$l`sM)XMV1;v*5lIHWHY4VeAU{n4pdz>;N!8|-3!CyAm*sV_ zBs`L0Kg{&lqr2JXkHo5UrmCA%UdJbB)0X|(k!bfZcS~5BSE|B+pxxUOq3eK6E!FG= z*i?aI_|6A6YgJ0mzcN|AVjXp+^|IALt>>Eo`TJv^uu3($GV0DAHX)>E`kq%3n}lx zYJwB4vK2$MD)o=gTlDn|Nwqlq1Fdq;cn3Xmo9imu&_mMfw8wU1#8~3MUPtPKKtwI6?aHvbAcT}2Xlk$_qA6y=(QV^sA_`Vk76uyfy)JvT=Um_6g*NC-ewmtm~u zBrvUv2%*q~XbllzrE*Y|%qTh!3>`u8HQ3haHOF#$N18)63qoX)T{6qRK99nEv}lJ__L2VlU@j*pl({#Al!R2#*K-rV7) z;uGIggc<}6se*}eZob_KTGdyBf-*9jjYapOIMLb?8#h& zEsXXG4hAQ0&OB|iOru$ouM^XfEqIX2Ai!#G8+Rl%DLDiNH~1ZlWxt~?I_0!?0cM4z zN=%q1sDVxX@Z42A@N&!1;)Mro@EMRttC`nIHB#QK^0oC$=j!h2nvAl4NR1*+mjpuWpZ3fJPLnOB~Sj~D}IjdD{5g)lnqioTpo9?tE- zWe(@m*n+ymQ$sd?z?t^7KD3oME1@)*BBjBUR9R+yY%33YG_QbqDzN^3e(>Zi1RVEV z!J8i?LFDwGoi<-oJ5Y%BK1N%_et;OGBp0KO+JlA2JT1I_$rW$ z65km2oU{8{YogMA`}de9Fg1XX{BGeWDN+nD;EU<|kzm4sArB@tib4zefDA(mN@}ap zyVk>3;ykgyY`h?zITM6lT?JT9a*{~##y;(RWZK;l?3=?~suGp2IFjX3JBlTo<7&{k z5f^%2Zq|5JY|BbFW_{)ZEnQ&@)c#(mVa-K=L)C z9D0CjOgFI*)-W)izt7cRA6MUD_N-wAY8LIE%oCbf&??V`YtN3|f{jDf{&xDz{B~A| zo28jUjRId|z@4djdjG{3DrmD+W3>&~7csldwQ5w-0;a_Y7x>d@@X{2}#28siW-NJn z<)VFb8ii+gXyQi}_2YY4#1J@4e-9dKn3Z8&K|3UZ0_(M1$X=_+ee0IXdCBtUs0#|A zOR4d6NC$%wFL47eawAubTcikJXlEqw{`{$Y$l>S6_6K-~g*NoR3DWyXI%(kU-Uz!$GV|(r<6HNa}iViLbOazm?Y6WKBYf zdfd`;WR`*2Kx~lD#6Yz`SA(p6yAM#CPmqxwmlHnkKfa%lI7R4z5Du@KA(4%Rs6KHP zNwToHFTP$7-d)q8{qDa*JSNR|iqnd{?%B5~5i6PDGRKkgl)T~51K9V0PbsuUA6VEI z)KlQk&Ueo&JHJb>>~TfifPbJ@DB&zk0v$)QuaB}VJLmDrIb5_9TVzIT?3&qKvm(a% zbRKl4O0$+*iyunnIae%sLrwnte12Z&Gl$Js!rP=|W&eF8SEOP}UO|b`;-o|T_}Ee9Svo02?Mu@7}~|GZWC+8Y+_cs7z{d`HQZxk9OBT?vR?NQxlc>& zWQW@k%)cebq;hX!digxiI!HLO?8Kr}kDJajudl2KQU>Qj+3-&)35nU4G#(5xr zV9kNLBUGyAIQp9K6PEN4fanf|wYVeLZoQJ;zq;28$f>g6)%mC(RN^T1W5kEzcJf#n z^U5fS{_@E2LV%6@7qjha@Ihe#q!BCSb+(u#u6Y$UIv2^Gl7 zXER@kC~B`|_}Js@Tq3%JMwbaJAgXz9Tx`}hS}XEVWjG|-#a+yaq4NIhE~vYOH`8;o z2?&?hyQKZXJ_X7w?_bEFVU-#bNL$z)I-~dFuxcW)ct+}@tXo-azEYB+Lp+TuR>GO1 zkJb8B{0DH5{q#v*0lp);Hkt}_=!JZIE3^gs3n}#y;Q>pS$8cw>t`*RZN?9G_Hko%} z>x8V3k23pH@qmQoPz)axd82fxp!CjbVhlH#HIK@o5$e-4tUMJKKoD~|$I$SY#&V#{ z;2qvSCl_HFAZ=4jv!W*@ayH|R6k=Az)=1^NhTM^7l-aJCQBol_nS7kLhk;&|J1@{x zc%)=5`Z2B@K{QJ-k(u=(OKj8v)SRG|92W1TP!%o_x+fA~*gjG?9p6>8Zm;vBb2kHII5`wa66t>m1)M0*GMg zxN2Ym6Vk352xaWqgNYVFw)3r{EbSqc9GXelal01&7ZZQH+7#(}3NK3H z|Ax+Hq2o5K38`jR|AuF-=8H78A~L1`Xxc@-s|mFltHghIsQ+~8m;BZIXG1DUih|FA ziDzGXL+#jf@U*LPK?-@1J3|lYhF^F)!^Vd%VcomjuujPhr|ACFkR3Ed%a(#5pXzB5 z-6N*~o*r2gQS(xofGhOgC{Rvxyed=Zx_i1PBdQN&ntckD$r8&QicojbK^c6yT>}?X zn6$T;wy=g_Ak>=OSP^tC^a!IU&ab2^4!0_$&qJmd1L@r!Xh@l`l?s3?!b*N`^qnEb%cwFa|>$JyB)@gWN8FpKKkizqw}}G^Rtlh-vOI1;3sP+^|E?vs>4O63n`r4JN&v*zLMgz|@U zQ29xue>XAV`o-LMLRc$3n7OW;aATHe+Ah=qfQ>{-)E{mm zl}c8KF`XoRlbg9Zx9XANeBnIB74uzdL^RcT(tnOLo?W>T2~0$~d4$(-__xxERg&XC zd`wLlTmN=DsnqRobKkW8))$LzD`Fk0ZaQ)7r+hl7J(ihmAdkb#6&f}Yi`>CN)EVeB zA#awz{5#uY(UJ<-NBu=bZ{n1+hZPXEf#nRP%&ZJx+Sp5d^(kk$nAOWZ@d_7ga-1=Z zY(v&Mb(YPUtKDEbp@ApndvQGx5>J+|Oz?}BtA#FZRDJ}1L@QqTLv)ywCfVTJ4DDAP z;vY2cBfn064D|*Fs*r@m>#ASv`ZZ|nbAUNT6%kN?#Uf`AIqVBHSUJL+AD8UKy`}BS z-(JSd6sAl9&H8A~cX^(9M~c(lw#|6g*mbXb+jkzxR_AryV~`PWi%Prn*EH743! zv2@sSt~)htiqUkiaR(Sf=nu~7dD=3;&;+3T=6 z`i9kK-j1R@JyweFx)`z*mj)QGoch@jBUUBfy-c9XwsB_Iqaq$!2TnpX_*;(@=8wv{8O*D$5x|ADaJ`A=&V&0&?gMZUX>{a>VxK`H4A z3lauKBwmU*eo@bj+TQ+1%6neH^6?q;)l^U~^7GO;q`jyQ8O*;D7o3KBdtu&gYL z0{f0fW;%yBSJ9&Bq!r=&ArYtpzq=onbo#fjLo!9Ol(2c*UT8#kLArE;c7eLv%+%-* z|ADJUnuf8$3dYznBUS3yij#Qvx%ve2g)lg@z+)M2nurHeJf{`TJul+v0fnlAeZSK96fZ>E-3)qq;r%(p)9_}k)DZcgS0IzcQ zHFWsX1?zxbu7SXPbRG!P+a8`$XO>Dy)mRDp{iQ9)pMdJ7!iP9%PnwajSyRl&aIs&2wj4Aqt|4<( zt`ON4=NoX~_5U0BwC&peFJm{XjQ^wcO3(KHSGrSLV=>Gvu-zvV=b)m?HHh?OLVkn% zHZI4ghqF47bkBX=hfjsU31!8Vsph@IvEP*)l8Oq*V>d*_={~uu!drZ-7`zzPV^*b4 zY_11lFK@*i-(QyRd$|^dN$M7BkIvF~(g*@mgX{(wa(WxSyydOhsAHQ?v&xqa3g1*( z=*}zNe_C39e8hK*-*y8&$hzxvsJT~HUYA<*woLWXK4H9@dc6HNEYGjO4a;kt@s7G3 z(N$>~M**^%Kc}~Rk#g(YPhFz7{_J(MRYKK+E3khqE_s5Ya!lWatptv^U!%3IONRXT zd|4*+m(M_yYR_hArhQFnP9)S%T=QCX>S~;R#MWkBB-QlD39o9%{7hUJLpb;NW)>|A zPXYP-aQ-&H&%&2n1Q9Gv;XQHS?T=cM7GgxaynWv-$Xb)W1FlHlTpkmHoT{FiBR+%jQ7(70kxQ&3D263r<=!?Q1E0?up zLOMzw2t)CH)yaufDr&vuB>rkj6A|Q4@d;Wj7|2Yfxe36P>d6oLH)4|EQ$pRvM(*TV zO^5Puh5D44YB{KC{Us*Nvqn`)bxw!6gN!U>_vlDQ*0Wdi@iR6!&!VxWjavh{Xh2uxB5@Cx(_O9kZ#y9rjlTGjV=ShZ`8@qR6-Tgw>oJmC%_G4c5rc%E@x^yz>&^$da&s#D$gM+LJ zCZmL;Le}0!a$W^3E=8@F^PL*nt^{;9)u?_Msp^?oc*ch2PbBRwDX6&RndJ^ea z>p!VbYOggYjpx{eBrz^cva5c1(E+Ow7Kx?kJ4!eGbDaB&`;ZkOFpEK-G;n^SajhaD zA?L!+uPa5OK9Z=ONWtY8jr*R~5UEu^uD3iOqS}q#tByT>@|vr+WH_7p!I=*8 zX;so~yX+AnO;V_+hTq$lb%-jT>n@N$ zGZDs)ipJz4IrWgDE-QL+g+%ncn5^okwpuoD$xnv*Oa8k3I& z{o;7n`_tY!bIGR*OdI!6CuP*!FGbA!H1m8bc(ZS9|28yP0k=#_S~JTG4&SE#*X3+q z$bTZ1t!CfUZFussu`Ib_AuL&p10nWezL*n+^@Dw7L3qNi4cGpI7!eQe@rrd7(o6E0 z7Gub`n9e9)36HHMMY86BXXLyYwQxYK$>8}lJ+#7a)`ljT^KTIf4V%^;Nc%piN4sk=FxAV>b8^dnj$S2Mw`c1&|>&*5CeEf=m>A(1^jQ^XzO8=kBL)DsX zzdPsf|F6GV;;saO2?etX&93FiI3Q4|wfX<~tBF;F8bymElbFEKw7AaQoQn%B64Kn? z;bUWC8Z#z*Iz7YSx%+p2UB8d4-{07nAg8%s3_YM1Bz{wsng5rnJiB^cNw1vvJ4cuk zcx153#I5s( z)7&yW9cBB6>5Id=y9X0#*!kz@)#>(@YdthA$WV4FW?jrU(47xBQ=8o;DS8Au`Iu;6 zUF0JS`=T-;G%EDOqie`$x_)tm16P4vVaS8!&LjAR?MoUpn6$4kW?9CZk*PrvKxW0<8i#_uRh_5f|omVWjN`BF*cM3G*0F%R7Wn0it>CZ5lEoYV`Ut)(ED` zi`Jv09S&xtM=(2r`q2^TbVY`fc>O+tXxheQgfU+rE29HtS-s9(-!X!5U1%F2Nd8&+ z^z@v2=C~GER?2f6B38=;F=q|ZXgUi-;dTJEg7f0ji5Ay*RD0;Z6cp*osHyjsn-e5l z2SCZ1tBwyGR5Evjq9DNPC?!wh0jbGL91n_PQTqVf`i6kw7K~Z&J6Jgwv&}m?E|nJW zwj~^Y;HXAfgF1m7LWZ^SnW5<({xFw=`4SKgp^|Ar-@;OY)xy& zBtZ{L5q$f%k!?L@I4(W<8|$hx?=>R|HzV#Oe{X6*r%NsYk6SmRMzo(}cCkFZOJ^2; zfm@C~t86Jj_AB^@?FV)LA+xAiDN#sI?^5JVU^fshv=dSSg6_esC}b*|TcIv{nGJQN zJ&AbnFmwZpDk7}B(lHkz0~E5DSKU;NUTV23_bj>;#*g5OW(n-}YS^L_)yn6L?N&hA zR5+-B?aPsQq3H34oy(NMRNk5otVvqD0oe1g?1uuZnAN~1`Ivoc-XA4biFt`BlBNM= z*7+1vX-2xphoFR*V&lf0^@w7JZvk#hNK)QEtpl$tgSp{7^?@#mtrh$+2-p{t+7Wo#xA za^1sIOp)07Pz;~XqDh8XA`MJC6lg#@pGiX-LqR}((UqB+aE*aTpZx>vhq)+lko zRLI)J)tHAREMNjdO{PBpMTx6|S27Owj#&qmJP7*yfi{TMf-h-{$3;`id|E5McLCHm z7YWPF2BMdvUW*dAOX#~O_xE2RCP!c65oOjYzr{EcO2ybyap=K3q}pONUpE*!wfhB; zDl*uL5}q!xi)jpLazP0KSizZ zFb6Me2Ig<6`UY2p4izisB0r-d-1|UG2vTC!L!0s9Ltg;Om8rK(bMjipvqs<=IDT)Y>~s?(v>J4 zH#=m-<4~Ko*!9+8DlG@a@ zZ(+RJ_JVt}ScTD2#Nntzy>w|J5i+HBlr1vtxg2de{1)Tv#r*g;t)<{2cjdPws3WUL z&yjgn)MQE-F*H6JnPxH(q_ps24OJ-bjg~-UPpYtQGAt#GnySSuIM1v-&}RS5>7BuJ zVnqaJT#YxkLZPE|9EE!tiAgCzT@7yD7o!_QfRwGTQ_&!`9z(tDzqa9dF@xIf8OsB< zD*y6khjk3Er#k8JY-gW!p(~NybdwkaKwf#DH$jrh=~u=iD%^k3jRImdexM3(4if9E ztS1wv@_hDZZb#wKH*G#|Sj!0;SmqQ)ECsCDL$l5meI2n&r(Pf;6wi!ajda0L(muB= zDp}g(P7rmTm^f~;X{>uWs8|nF^|o=iG8xrDP*bFuXQy2{R?{t^@nEzyACo&N`HE#; zq{YD5BCq{9(V~jE>&~@n3>-{C(%B53M|KBdoEcmIFy_f+1=^jCQ|fni35)weJyqh4 zlhbmbb0ajC28k&I^LKZN5e!)STcC;p+NlF$41`SJ+ZP5XG@>d_=pDKmbk$V#B{E_< zQTI}7AtJmb%V+gX44^PMamWIXRVr6B(Hl6O|HQs}Ve?ggYM7){oD|C^MNP)Z+5s(^ z%0orKXr+CkRcmdjnG~T`D-*TMD@>gxz8lRou9G(&o~wlv4^+rNfLVe{b6tUR{DFa3 zx!b)#NJ_{`6Y)b`v{4Rma60}z1#GjF+qF&N)h6F`rxBw&h(}~(o%~u8&S*hdkm%!J zr~R<|Ko@uWEd>9QJdE++6bnevO^gnf{q+G3MqI_uBf(hvWggF>soSD9RNeF=OK)gu_wY+w0K;Uv`goiA&CF3^tGdj4-$3i;H#jUAnY%25_?tE^&zlBt z4&TosUSOd?`G3(JObq|iv@;9Ge*_J$e)%eo&A&Ln-=HDUFJA@b9ln=gH}k3ul%sJ` zk@l{y`}Ij_Gh#?&i-*S%68>|RE;@q})$+}Ppp=i4m*I7UjEdB9v$NIw14s80WTmI$ zV~4KnDt+GGSfmpA4t`a*+|%bvlJs3dlSZ|4{NOBXTlMK67QUhqZKV+Z!)4OtuH z%bSGf;EtsDs`shyYJV2$9U1HM3AW<1ch2Kw`FUaK(RDP#Ly*(sY-jF<8eY|2)+_XW z8sd2UEzv!)x7Wbp<0AfpvFW_a^N(;owh^pqf4!BKPMKDtkbDmxb=padp0GWEbYY~s*WGp@H!Mjd1;Z0kE4ANZNsf{p z5gT|$=S3snw7%XIn3#llwM34c3tog-C`9F}<57Es{8hV9^-`6bb1r3z);BeEd-BcO z?uK#fgye;mpUQ-X4wIJ_?Uj5TMB~shDCK)OGZQ(doB`Qpwkr_ufsVa6S;5iqQ4`5)G%0TC3gi3 zkO(tru9K^>_=bcX1!>UyWYxsJbCWR@t}$dsi5opUc_6x@9|)!(->e^aE4%p2AezD} z;rJ*))?$cg)lTf*KiZ=sH{kFw`teex(Hg=xshi+aM0*3Xgq7vWK$`0@WMS=7&G_lN zGDizTZ~@j8Oods!*l}*>`HazWh5c(upGbwz;vY0OK@*N&GRG5aDxvySD*wj1Y!h7A-QqKn3pNB zmWG;``hcTxrpk*tyTm|rny&+ExE%;Iv{PDx2wtF=DfIQi%> z7$o@VeMV*tZ$gt#{sow9lD7$TO9LyV?2|{K!j&{j&XOM?Kq4TC@Qx2(??Xq6!Zt5b znCw1_0w3rwc_CBS)}m+#PDMHuk1L`^P<@9JN}a8()j&l}Hi8z;d!+zbw2NlaE)TS_>HpTF9D%KTtM4-i6`q(MYNGKgieC-lt z#$bfzQyW7@_4f{3{K@F9uO?m)QD~t!oQnNwe%EwEVgs~8AkA+ipuR{#bIIK&0Zj&= z@*6?|Bvu{Qp5UvrlHwIFoHt>|9~h(DRfr|Y0+bH`FwwZK#5$&EQ{WxW?TpMpY~qhd z0DUdgB6Tq5C&_U)>X5X>*541Tl(f?bo{Ey<$_P6G z6~p*nzqQuEwA$LjyL?QaJ9HY{G+Gg{sBY+RPo+BkRvU&Au6#7tA&3uQauBw zk~C<_dSeV-_gqay+VP1y(7m=pwxzk*Ov>RQoEx?9frgK7+jOjdES)VHx?-xHMY{*TwmuG=K^yuXHNZV8uB{`>8fE?;@aHq$WTX)yY*atclg{;4kT zMN_XTJxia$r13(*_F;H5j554WamKmgtaSk`zLUGpVe(@F;Zk(ga2c0X;UZ2Cmz)8v zwWZUNhlY=mU1d^G&0o5x)j=s|e-jszUet2v`${r7hSN>XH$Be&yyA>0!-~J9YCCpe zed-+0@B+Mp07=>3gBV~mrlTBUu;n~#CEX5T1P!5~=+kdlxdwTk-j+KTfBExemFqb- zBU(zCIuY9yU$})wrR@ON~9$BxfGESU5)7jf>hV-`b^~DwG;_ zHYIt^C5K6Vtv5=#EazKw+=zUsEF4A=-zx?4+xCb`;dEP2!+% zrzvi7D99fR3wySXXgt3ecBJQOMoiH}z~>vW4QFMHLiE_nJ4O|)@1R>(r{c`2=U#%^ zjhgqiFU;q}oda*%qf)edjGQ^Nxl;klvK}#Y%)Cm#1*>druyd>p<$F&hMiexV|-ap^tMZLeU*?3 z2Ngz2UYt1@L_k=O4uZ^iyLP@k3irKoNCF=!%GD36K1nh$f*%YAXs&D3&O#^2Xj^^v z!8_K9!6#UB-|y7eQ_{y;=+!zK4d?GYB9|ZVy4ltGmMLB*i8>G21Cz81W7B(A~vsx*D(|UqmgMz zl!@MVO>n=@w_>z+ z0@!$8?R0$h(q*@Rajk&a-Z={xQp8UED@vUtyqu)nfryxZPKMo4!oTqk-s3iUOlUgv z*?rUg-nN(pwzjN~_`bHC^?(-}L)8JK{C1U+Ha;N+7Nsg0u2?cI9 zPJ^9iaSg;F5ISQr{HeIC;n8g~lm91m5K7HJ4AYR^6Wh6naN5d%p|pi2NOCA_7r-I> zlQ%^76mB{;_qIJ+gH%^twW_5BvWg&kgj zEwww9s3BnVXV+o>!Jw!s1@|;bh0z4zUB*>%MOR>p*n)mlOUBUFRI+aEsrPd%S_)E4 z=jg@e3MthN%Cby-#m;fZxfWXC{3Qz*L5fpSEesQ;dQD+UP{V$f3ZM0Hqn?5bqOZi5 z7Mf9`_5O-sFp4}O6FRKTUY$teu?j)A)?A#aytG+n0>U*-*ceZE=k(|~mh5dUa)6hkDJe z34>uKk~*Jz^}stMxB!y+MDs1+=ya}CJ<)>txuGcd(YI2-(nvTi>B#79isikNov-RQ zqZmO|jAaPu;|*-!l0;-br_Df3S|TV69dtfYqbo+?ZpsE@oSbe!kIW8Cp7byBp(<^l z2Av@9R+3bfG>tO1_kt|1Iu@*{07&%dps0#WN2M%hZ05YTy4MhR?)RJLC2lwmaGGR7 zpVp0rUsL!AZr3WIti{{`sXNhMW%j&6m_i?>^a5|mp9-HQr?k90G`=QplY&j_ zVo}Sq({tB+f$DzD$0Zc>wWJ;)0j@r9*~iYGl(xVxQBeYA%1=bG78zJG#}G)|;Yki6 z{1gsXCv67+Y{CO>xC zhFp0+_T)D&xiySB86u1Hazv?}*$Rybbn3HoYw_MxDJ??C3diRALwrT%dv)TGF(Nf^ zRIpyuaEbhAK0NlugQEXz>Pa!cgQ4&IO%&&keZbsBuTVdeTv_No5>44^Nl}-{?1nS4 zN6;26!?q6Pd68*bO7lK0Y+kvtO{zZLl%swa_(i271;=&tqF`euC zj(6_5lK9_b58MAFd)VmzL-s6b$;AE^dAol%Q{dE(T7>oUh5VTLZOva)ANAK1>81$U z9&b|dm=0k?+^@D|{C0zN*XqUpoIIpsT;E>cgCl&887K}Me*TW{JxjUWDz$z)w*K7m zem>c{#2G&JPwaW)(ay(cN(U+zI$5~&{9MSKUN|!_Zn}~^nxJCwjf+Is?HoUf56yIh z*HWVut9+7lU!uYBS+#sJbo)ZDG>bo^47b0&LdDv$bITIjSHY#i=AuYjq9&U83B1%F zqw<}#e0pFu9~*SU4D@f2t|L)Eb#pe?ln|frT)%Z!cFtTuxz3oqzI^O}7Xp8f;-o=m zHAFtz23rOzx^MM6PrRs<)bVxajziw`{3(2H!1-1?WR52E`uR&g9qqDw`_(hR7n=L~ zNvhHQc@6jeqM4=aX8=(zSE3O%x0oXQZ&z8Fa0GflfwU@ z=aT#-ip2ZR1pbZ;ioJSjVMkP&iJ?X!6#RP%jE*(fu-Xxg8Aflnb(^Pmd6cdHS-89! zXdM2Hj)TqxbwGJ72PzqmImFpuMrVfZG#l7zoTvW<6rpB1&JF+#AK4Wgb0hBCs_LbL{mE5Cc-_Ur=Mpa24bY~Rix`w^@ zmIqeogI=P7kh~l#`KecbzqRB%njLs13su8MjMv7v1@{*;CBkkKRAqborcU3>)_1UR zsN4p=l{nh4N-CHJ>|7Q^K;T|4>1_|K^K@EA>4*qXJ}*scbR+SIahxX^#vFDYT@@jM z7Cny;?B2cadYUxyDA2B-H?&dtS&vO^@

ayFA`-maTc3sq)f|EHJYzI9O7pOHzrnmrm0E1Vv%gFs3Cr2`)Vk~d zYElfBf|Lr1M9TrH5;V9;q-V&%&OfJ%8|}jg#$_vyA#gNh|CJ~iNA2X^W626aLS&X- zGuQHYQ$KJGhd3RS#(293UJc%4DNy=8gN39uJW^IJ%#?jNx$9k$IOUec?BAo=ni?|b z1TCjUSb5k4UOH1!6fS{(Z@$l(o+^3xl3m>~kt7!vl1NG77$)kADXJkUEAP=P@b{~#HHm<-YH zcV8C^f*IZlSpcTuHk}jWhg;j6=&Mv;kS)Tmsf?TWvU6y~f z$r3rJgnJJY1*Z%~MCArKE4%Y>D8HId(_oJE((-!&A>Gy(ew5Q%%d1ip-sZhVoTMWa zqgu9~sA5c=UB_Z%-ygsPm788x!t+c}^7M1Ah#0*6Wv1zhAuCvSce2ej!ZKpek`M`u z899^*vBMlYv=G4jWxK6`zluXN`k${DV!>44wpsa2(pO()MR-p1%p8tF?sFDWkiy`B zvrMY|CT!#S5prn!i_|0kqQz8OeT#vB77YLo0o}LW!HI6Pthe$Zkrq;V~m+c z1QDyVb={ST$~Q_8pOjrKc5#4{k@>pT85ebkws2@K5SFsJQQ28eVZ++)dtBfQkFYr9FiqjzSblqVwa9Een0yR@kY8>^9hafe ztY0HMPnoxEHfCfd$#6k8)qIANOT+-di*b$(13qsa5Qk{#9%SzYi;-}-9jGsawvpYU zH0J^d*kowOJ};P;4LbvzqpbMq6!~xsGplbZs|jZ>cO!9iW-sTS89I&1N)|Ng)>gYI z&(0KcoH%iE*_|3F=G8>gU5vONZ6Nr}1o0(>F*nXdP8sGMy>ckQ1kCJbOB|^uvmuue zR70Tdc=-MBf2$e;2TLE$=F8275a+=7Rm?R2ftOlmD1m8RS)PU;KA6jirY106R0Qc= zQcX>5Ps6U4GKfb?>2g#mo>eWgjh8jx3RqwC#%-!pC$=}6X-0@D_Is|LN>HYm+-cQ$ z1-;OF!)Ek~%2R&@7#^jI!w&I?hD0Q%4lyifXD*V8IOy8RbX_>> zzKjL94@Ik(_19Tqa{WjgEXu^-rFpfj(7%h?khRrz^yXkNKieBYA<)4-us9>3KolVi z$xD{Sp^LS);5gd@FIAu%`hOUEr{+)qZ3#2nv2ELSvSZt}ZDYr_ZQHhO+qOA5Q!`cf zR-K3YFM4&a?(e#)kwlvJid_9XJH>8O;elLxV~s^eZ>ZiL%{~3f?;I91rc%Ou?DA9# z=?FrYf!)gm}&>_fOsU)=_{Dyrk>`>qE0ML7D_)o!&rlm*@ zpkPRJ5J5;OrX3-gN;WY~Qdc|ogbz8XI()t!&ZNS3(U-qq#LcCZGM_9h^!FUC{=!@-4eVw6y@})xekhS5J30|HxbkcY&e{UlQO9126R=lb0`M zvVKf+i>OB4?p7pbjharBwyW&)+5NpSSp%422zzsANK|Fa}9^q<(c^*<$vPoOF@T|WUFAgMp2*74n-9E%1g z@f?#{$4`Rdg+lIS<-aBaOpA6sYB(XEO}0A|5l)^O0vg0GGF-cVBnbY zkip8?GnTc$u@~{Cg6H^yrS+h`rigLj_yC$=%gilXXlCU<(bq6+ezk^*X*b(d#c@LB zSiUt;Yl+jG%Ka<5W_85oUKijlFl8LJ4is)8sy{O6-2O9ArlVJ?M}+Rg3w-JwtpQ%d2| zicoTGt*+mub0n}CVg=J6!?3j>9woPny9;wUzn3XWH%{2KOw!XOPR10ElAA+?SP@uP zQ0mK(PI@k8Lp*csF44GfC(^8Y;N?Ck#t`1jNjunQH zKS5tE{MK?!F}-*|jh0{+rfZZO9bkp4jK4yd5Z=5uFrW)OfB9 znwoz-zr)!p!;9vEV&;<;Y8d9wOjfvvbF?Tpx2FbFwlrz=+%d%+5Aq;Kdm5Wvgnp@M zl{nSr`b^Gh7>Lup%U~HD_b-hLR51q&g1tOeWxQ~yf>J zRGxGiur|4_Kz>}fl8}qZ2`e%`ZuJB;YfCY?<);O(`vYbulGnKxNW>XS{nXWJVvdNQ zb>yb{h{N<6XB(Ue0HhF%rmu%&HJqt(Zq>%cPc%-7v2vjf@8Tlepm5hf-!_DA6D#|W zIAwVYA(n;pQvYhh%t@-!+Tklx-Gnk%NW01!n!9x2V4WqVU*TpXE=tlQ15v;qW%q7K z(>0D~6>glOIuiuVC6=a#sQLtnyQ|=~`IOS9s^=>``O;bLTdf;;4+g}Okc#MS)3^xfX@lBh zcEO&|ZE?{EDvKuX?7OBP{udDnS{QGTi_Ef$$X1N|i66ZEa8t>%tw~qDuNGuL}oww#_7$8PX;?pU;qf zwN>~=;&>R;6+{Nv?cxTaQ(KuVJ?y3WtdA_&`Yqm=X&5p?1NkIDY`oiM%}K03FeG`( zYp5Q<-DnMWw#9Po&%4iG5aYBV?#)F@%LNC~?&*wbB+x{{!( z#%68A>VeV|2*rky(7b~=T$=IX4x<}_ z**kEO_*d7N6>o7Iiro1+Z&ZTMR$!~&VCDp<)Q$i|vH6t1m9t*N8&F^=(tEi@wQ4SU z;?l$Dc;K6oGSt`wH=Q_>v9}GZ*}EXtpA%*RtUjQw6BQKq*4Dj;z3cbuf|l!ae8}aC zg$|@Vq&imq=se&x^tv{JiO+xbJwisG|E!=meS7Gxh(%kf+N%7)52a^fVMYg9TUGL@ zU7lE8nevw@b+aJQU*A0tEpii+LNRpoVd5^VRhzG0awfPaH+jm$_@l*7kH?y#N1gTJ z;K>U=P3GQ%3Gv*e1Xc)S`zHbJc3{~o|Cr3l8^<9c`So~vdzF#ck`@4ud*JMRGg;lx z)2Cq3Q9_nyrKL#KU$RAybRYXxgeD1j7lK|^pHoP89Nk&o9lI)&d26+^NVniFSzQNJ zQBrd<=?b~rqDb&OR&?1k!8A@R#SG>&KNv|Fp6C?z1p@=R{zuKwoz7wn5%Gr094uo8=^&6V^( z(k`Rj5dx&B&c$ezgf9R?=DeSmmNbGJ1$3%R_ItDDDk*bWZMSZ zZbXB|pqQ9%Sd-mzU%Y)E;n60#6S=8pc&$lj8pMQ6`h%|2u>odf^l= znD9GBi-oKW<&;IwVX<~dx%bPR*~jys>0uE-k4syGnhL1~~?;$BDE z{T5mi_1u0vCDZeoiQdGTtI{CH@1o|Q$n$6M-{vzST_KvJrV@jIuEOzR48R+4$O$BE zz`1&LGRef0umBL<(+Zs;x3k&XkkF>3M5;4tSZ+49dNkkMSe*<4?*&lOHh1x6H5d1l zLU2Xvr;$v-#523t27jc75_=KBX(R?xeBO9GAtWj|GDI zf+sAk`3!<)Plj z$dp+V7<~JQ{RZmw63iKaNRFnw+bZAAEajW_(XPIBg=FutLQL6!Gz1m>$AzVaY0+bF zq7Q9}8A&N*>lK-ay8)E+ZWLc#=aF%*CiaQ~S}~3Y-D#6dj8RFIVS@-AGm5S?p;LPhs_@j$dZA@4xAI}X7jjWNv>@W2WdvwR^>0mi;qztPHNp~x4#J& znEsd`$1q*yHG%OyRX5VzE#@mt2d75oxadi&7DUFe)E__&WX4QNEcS*n!?t%9vF(P7 zlX=ztvGg4?D-AItcpf$-(HnFVc3sbXprmMqF|%te!Z=OL8}%WyX+krjY8+e?a@x_+_4S+xS67FE6;$9 z`5aFB(J6VA2t1JvB5jF?CHy2|c3}haRZDq9U#I(S*lukf?k4T*9=HJQ2>HkU?EGEu z)!?VUBrS}QyFfJ47EII}Fo@x1MgNQO<}l09&UZ!)wJd(`?^BbT112Ul2DBPwx0>|dfpy!WCZ78sW~P>QWeK$aZlmS5$rar;#n= z2FfRo{$GpU0Y94#3NXnS0|#_3qGrV6ci5WuzSFCIU0) zI`ZZh8PWyVn{;Ak&Cpx&`kj}I==RWQpw}Y!9#*K}*(BgVnz6BD;szq0u=*Ix%uSR1 zKP)z1w+T3#rAc;xsIP@0WX$=gZs2B0|3;WC^cm-?NCj`|@Q5!XeCSnOTuBm75n=N) z{+T30uEp@@`Z>=F;#h^x^Pn^5V(rDjWyVNISNn^aikJ{!zIRPGGJhYWvO2mw$Bn-+ zB;BPBbq$mXGqQN{Te)R_hJ5U}{?L4qsjEzF^Q5f#@}+u^V;jilwdhhA=1l=zEickO z!Wd4wTH);k%WJ1Q&(ULHc>6e|tjB<8y*9~UAEZQ*DoFXMghA~1_}L8QjhXbmMbL7 z$+;S^s;?;X7X>~~#p{^}gq&qMB#dgmk|_~M${|D0QDWndk4q6z5`@SG=R4Ej8%Eri zfg%D}9U_e;+*)@DGOmE0!Vv>K#_ZBLu%FV>i()LmTVY|>ZsX4)3hrcX^=p?!{(bz6 zFc_qnc(-CRrG8#VH9(#}ZUjE`MP3j|O6w{yM*%D0ypDC|^aIZ_qS0FE1`?CWB!~wp zs&>k**Hdw~GWl&8>rHd($_w$xsw)yYY-(p{2O1S=3&GLplee`XC}3=RSfI9bAQZ#O z5hvqht}*I1)qYSSADjr9LVs7vl!SHzBf5LBb8$4!==+o3fTjgL(m}!4~^R=MU>ppQ9QD zR1H#;jEd4=_!`buYt4ZsTLArF*ah{dl3rZP2Mb?smEVB=i&_amj^8mje0v9r zt7peJgPltygkP^EY0`D5V*BP&uU@r;(YaktgFz<0vF}JQvV|f)e#J3`lZ!NCKst?> z)IQ{u&YsFa_k6aUE>_x_w?rWTK2*C)!W?%kTZ-?zY_Z;w-U&xmV{DF2?{3f}&T{BI z^RW~^-IAIDn2I{*^NF*63l98ont?A_xvCopth9*q1<$HRpn&Dn2Q@%2hXEk`XgrNl zc15_>cacRYT{1;`9VsP~Wi%r=d~wKB9MU%P3}#zdeWj|M%3p@5-K}XuF7DmB~ zeJL6CRSoQ7qN{63F+N*M{YAS4%t+cC-4+tN1x%gqe9=4Ikqug(;0E&p!W0~sCx3`O zH3am{?)kh6oL4of+RKyoix&73a|Mdye^fSH9G)A@H`(qh7mBywwfuW?0W+HO#^z8qGuU3lzH)!lthuG_uid{NPdZEP%zlYF55Y#A!D-VOs8se zl2EwY{a9?SsiuipsLCE%?F~4vs0trDXM=B}hBKtIvmR7ND=PO3Tl=TAT}ej;WyOd} z)+9QKGWl#I7{BTJwV+^PYy5rp4$*c2+VEgH?5YWZ9+PHAc=eXHIHOTN;2FjwtM_nt zNiOMuPIU?kiCf`H-@g%}Jo6{f6rnR+)d zW0AD1_!Ze}l-vQaHUay1w92jQEmo1J=?k<~kl|!{6~z@s!L1kMh;RSO@-}}dDv@a* zg|9H~Qx)V7-S`kr%V)jCR*A)^?Ez5Rw<9F{Ewl&aKl1V@WE>CZ^Uxu=W`qS2oh(hf zl&Fq%1{7_I()9qj?!2;Rwcd?@bW=2t)2J95O1z3oklP;gb^`j275g`#Do3^3h2@@N_a>qE@TyN4kJlM-e%+uX$ij?IkwjYgpTUP5v zcDvD7L5Tt9ck6Hmi8*-Lq;Xx^lsDR(n%ed5+&l4yhc3={d!_rLnh#I~GC zC=M|W6@5&>0Zu*8hL8$~z5;>}0Q(TopvCL=Bhh>f)_ruU*|w(!akszlR`M8D(q_ zPgK3Zt$KXlMs~>IUU>eSiv7R60x+?#{7=tx=|3z%X85fKl(&DZK3vHnU4MayU3xF! zBYcRhTA@~NKVIdVD-g-Dt}(O&Mbex~3_G-{Ii1Td_iFf|xj)1D#`@G}MEEwl1Ht%$ zFJhLyI$riR@FwxuA2uWQym4jv>4&!PiIG%bZ(eqOMXA=bM&O54Tl(YLV9Y+XTdS<0 z2l2s)`iSZ@S((v){s3lheNt`S4849(tIwz(H7zU;4xqTZlaA|%fi5Dh(R!*u15XBcN3+k3Z=FnoM}%x5V} zXUcMacV#%BepH%NNKjHJv|7A+!WW-EUZ$KWUwZ!hho9nm&dD)6@In{RoSY`#_re#V z81p-~*CZAi%n4Q@+m6!W;H|1!r?RX?A8%N$|l)zdWNiMo-KR1$|>H;o|bReCVXx)>D%c!*rK28e(~6KZ#@rN&a@)p-i&*I0uKIQ>2XaXQ{KYDPK7j`8y6M|qU zs?O=&jd^Mc<`W3BzZoewp&L9_q`1~K;E0>nL8SSakL?04ZT9gb$422q__F7I9Oz1N zTP_}mBp_8(oV2~g#Iw)h?x&mY1w z$YALjKii`5c`TD8_aw@RzZOw;o^G7JfmCRBI!EI|-LfPTE7}v%!ON3EHUdsxnNuQ; z4I>FXq{1(Y^R8uD5X`BtsErLI2s@;=rZHXA9~SdM1%YMZe&+f*FxW)^FOygvs*}Qo zr=rxvl(N*TB+USVU9G8*x^QBaQY6TOeK^Rdto5;mqxczR3fnos9VKnywQe2^fL8qg z{SOa^{MCQc;B6XXX-M&Xc2IJLy@Xh$VNliE$wqqzCJRR7EXD(f74fLD4Q_psaL_=! zl5ptYJ>Kzoy6PRc%|avVb@p%QOVC-1<9WAAO`~NS(q(>oxZ$_K~Hg0 zu4k*wdlF}Xp~GOx%P3X?9NIEalS)L7jJGKOrvlSRp z%-9a!?XTfp2|1T5+B6X@FE?6+Otxe*co`U%bj--3Y$-#hVns)AK=5a+E^R{V>|P@2 zfn(3%W@_dGA%(eAiqh-G?3}Bl@S2>SkOSG6_$+B$aNmD2lFVh zYNT9o9ht-ko^+M5 z@OroY`h08&CkFd=qoPW(CoX^j&p?g_kkaC;iwpO6Ou>U1x) zJy%B841?v2F@s2gH+mUAWEno*3ht_jhu1geqF%}M-i<)!kJ6_jhSPJGl1v_D^nKxkq&mEX(C z9yrgu-!X(+v@oYPoLZY0~Q7-dUv2Q9z=Y9Y5c>E z6D}n9re1h0Z4dB~IRa zxOf1SWE2>38Yq&#^n|<{aqL18h?y(bq&1(wIbS^oxTGZ&oC%mF2WUDF1JTs(>LNI| zx6b_I192d~o7r(>_>aTURe8Psy-cMVRg^dxOazDXZ59&0Lz6JDgr^~GCv69?glL)c z0=*DiUb@Wj_)k4~4{WKbL;%!K4({@T+{tqS8(*(I8ZtJ@)U0{dk-T5sRXRSW$Dn?T z>N!Lmm-3VmQU}L)UxM-qtLvzcKdB{+o&fsf&!St6SJF zP6a2X36j+UP+MEN2(`51Deo>JA=CcfOw@|#SHZ!=$IQ+r6kJr0*nd%8EKL8WCrl>R z|3z`$`c12uSrEG)kl%o^*gK1hRB%KvV_N~e1+mK=_JF`zCog2#v9}#6iZsP?b>BMH zlVC#(-wf=XeO+cDKEbjQvKqSayx6|~A?+MIY?yq`h`wC876Z?D?&W=`wX@N8Ayxyg z1te{aJWh1Tty~BLM@OJoETbXu_Je{%Km1i>^wM#1JGv)Lg5C*C`5JmadqC$4ei8LL zhB|fCupD?yDj8|yhWBq=J}|s(Fsgsg4+GO-KH@pK74I5ZF<+yh)l^aoE+E(rLmB&p z*6AuYV9&G;+Q;2xJ|v0m+}>V{z-6hB^Onf9Qgb*0{$v*=a|B&P&Y+KA&949WV4qV& z`MPx72b_JUJRN%c^Zl7KxAbHp|NeNnKDi#DN!mU>DY?nu`+;oCV-r~!-1++i+#2qc zZqBxv9(M&6a*=eIg^^EPnCK*Rbk;#lFfy*M4;E#FRpGRIu+RU}uX2w=$67|E`CC6h zC5(8Q?(^h!akPQyT5jiMo2dlZ@PwNB5%T5{_v{ouB`H6K`TMf{F)hIj;dEMn>-4g+ zNn;uIKFkou5)g@wyaRCeYL_+Z5$IZGS*qDFf-A`C5%)H(pf7LdJaTo@DJ7g%`{K9D?NL1H{ZSSL>PMUFWaZ~`YVmz+*kt^H z_uVOeZNZl?&{Y$>u}xQn6|g6P7Wc~8>ocJcqPYRFoBBmcOMI!-fI#t4S`c>q3A_Q)%oqfJ*xgAng zO0Vd+0}(5YUobR=$o3Z-Nns;u*rQeF;RhZ!(gwj?X1q1`ExqFSgt^g9+!+BVZCmh$ z5w`WYx5u$j(LFflUtD@z-@s)m*s1*e>Nv$K!sn$r%Ths(L+0=Zv z9h9(CwPb5*&jaHy#oB0MiQ3Qh`RJQCOt)!yKKri*rlZf_=A~2c6 z$d|iP*Tfrt%b*BMz53Z1$iZ_}>y8Vq_EUJlg-4GZlUUE(-$BI0O5WwJmGR?>aVsr~ zQq+Pse09_#;xC3~cMa3u{rgp*R)B3rgJ{6lEJ^TctWew{fqm$(G~F_J71v3>70f+{ zcWtaU=wFM}bD|TfH6T!ml(kzIkBV#n?m7?GgcGH;iJ@?#pbdo3FQUm7x*;_wOKHF& zlH@7r*c}r}ge{^_SOTIV;c9&=k>*Gtm&!D`VGmNl8MyG#!3{)0IeN?(EydlDVJ;{o zZ&bVzv8vPmeB5_5Ayg1{MS32+whOvvOIQQr z!CpyWN|!nljVMnA9aWBJu&9+`5NC&zFy2?-47G5~%T#&dq2fAj%`{pm=p7|b9oVxx zSuMx?beboe<{Uyi>})i-QzUGiiT?7$ia{C_nrhdrmS$^R|2l2pa`+vVOS@k_b4lxL z>3g8HX>a7$M6&wg(L_EdSOCv2~|d93#$a zLyaY;v`cpd{-Om|zn zip3-@yF7kYZeNO6=9$WRea_%Bnik4&%_GuGD~lSnZnmp%5@|YI@aQSl-z8HA^ZXQc zsm5528)*-_5Xc~{;05|dLlZh!unfxjm>v@LE|7$T32TM+C58~GykH&GJSqAmoY(yz z!3v{l;@~DOaRLYmWmb4*-79t9oY^%%56+4{GM-oltIRi4(ZZQ*GXkFFNxd?cZ5+nN zF`j=d!6~o|%3wMt-n1~%M~|m_yP)ca3vH1Cp8Cbc_4&mGRfORPTvz(e`Ol&ER)#L8+I=E}yljR@JW}_c-L7Q^6xOb?1oh}LS1#SIO z+&_^js34$-4ij#IxzOM6)(RpN9N zMb0kc6Gyr?(dqGXczi`mNq7#)6)jV&sg6l;A);*N(z>%%=;l1i3g8Gj;-hE(C-jba zye*g+ft`M4f$D$=k$}2_RZo(@dlSwf8aXU2ae7GApn$EUlh3fsdD5be1VP#(XQhpZ z#7h~-Dj}JQ2DD@2w=LrScp|Jp7dwJIEWXLitIlcp%xcD)pWEeUODh4q&ui)gYREu zVoXWtBAFM8y^()kBP_XpY{m1zh5X=WWbRSr(194x`Le z^f}YIa+b&h_x!v*46Rjmn>9FyJAM~0G+9(hl;245nsCcvn*BT;EXsI&e=)8yzfbg3 zWbNnPf7zm;_3w&GzWj84KHXoSRoZ~@v`eB|iMa*Qbwop08DBPgg7gnAe(-GUQRphTEXflV>)R zr&b77CmSj1&KJzUmJMKeBnG+$@4iK}-?Y21@VQzAuLbxlv! zU{a+Mi2MZC5$7o&C%2wQ(e*=){kRT8vH@SngvfBlJ18h4*2SgEcbos6Swg=N32qis zJ7#JuBtPaMoWB4%ujjh-Lwiv=KI2?GryfKWVF5) z9930fPa6?4$pV)ScZ$3CahKp2*hGVgwjNR4baD=#|Ec7mj3Uhjo?4mNAXS5dd zUixuTl97PvM4NN?vYo|JL@ zmYS4d&8yY@44-HN`$m7H(c=WvTY$6uh@`lZi`^nrl>b zR6bhnCQMJAN@?iqBBDqu%B_fs3FZam8;BS>BZ#+<8H%W189+fGmw7=o&k~}^N{$Y{ zy#umMDyXC!L`;Mt%!*L1wS>h(t6;#L&|b4(} z!FkY$Q!msK=6F!0dwsm4oc!M@62XhSmf|F3%yD9|CQ2E7{bb=?KXO)X7e>Z-FO`~A zpG*Ns!!8GuO|gZKol)76#8KyFN-1W+aj;FCk*9SHBud&V!!2TCeoMUySt395RSs&k zPH;t;mWL>Q9roE!OQ^OR(Rg~9s-a^#*hQ{%F+DmimE~+|pPE2Ct8@#TsbsTqIu2|A zQucAt-z|I&1t==G&=p0#@?a!psuC85vLv!T=-8Q<;&9f!i#9lj?MYDMaD zi3#EivW_J*X+Zf_?NX|#fB!yxfoQ4}z=r26cdx ztUQE!*%kJPOIl#McLWKu?ez4vo{Q*@fgl+_N^@|)I(9(tG_`Va35fuhf z!||R{SI5%_xO?2FS=qak;!RrwS^S?wEj78ar(I{T?>ta-fqM< zxNbmgeAdO%;wvw?KW={f>MmsZO^;MlM_J0OvD?3ta#m?qwk9ul)={GDYa%&rbjl>6 z#9YGB4k@vUg%#N=lc-OF)@f;SgjSLW^^@i~xBw45F?Fam+B~f_Bq@%Yd8Ab($iRN~ zYVVlasNA>nXG54nrlsUe53%Bn!b;P{!#Z=`mtCU8c}TBd2nPs>!Gu?j&N}8bm3-Lx zF0>2`Qp2|=ll~jdPr&BTZKZj4V%j8;DjL`W za}F>^ABwWG@cmha=ed+ZBODwKS!yH5fO629WX102zM$zM2boOq-t&@er}@uP z^>ZcwVzTASselY%5kl0d((V}C0wpTu7Mi7(a1KtesGI(GJ9VB!d~4H)?BoA8!V#c)JHsgRF?5&SoDFhIlx129CiRKsI5OZ zJ7Dn9ZEIr_SZe80f}6MdHZKWA{?$tA;79Xa{B>DEp4cjpsYBmRHQAIM#4gd`iw|AC zi630g@2YSM@0Oe|vUokeUqqW}Io|Cz&nT+jChvcXqA;R;?yrhw{L9WS;7l;<%zZr& zI5PpA-=YwZfejo6)V^<>a~A15W67dwmaK;!xX=hVKKfb8IaHzTRB&-Le!nytTn0Kt zU{Dku1eSNFnP$CyIg6wE?$LO_^rWtTY(YYOze=#5hp|mLRfkpG>MDvUopUg)-a13B zO!1x;ojrofxe}5%E2{^X2z8T)GcDJWRfB0(&fgB0Q8idDbaJ#74!Zq~2KTm=J4lB+ zIY);(+?O$G2(oMLutHYfB(8vZBIMab3*p;s2~k3oDD>bTZk#Dz19e(a*kb@h#VhgG z(_5;qJbMJ3Jj!!7z@+V-0sM#4;k5G=S6Ol3Nimja}7LvNR zQr<_T8j%Qq{(w3>SWnQKDs^Q1$2gk|VzqIE{M$u0Hs(yO7gX{**aF=b-oGHLVqSHDT<_42pEWd@FM^>*sw+oe3Nngg^lx65 zKDtdm2{F(fi@A-T6*2Fp4}71y4>i88a0U}v^8Zbkv;Lp_Q5N?9RZ`#jMV|csBaj1j zzax-N^tW6pmi;-4h^Wy%vot(R5G=k48IW(P) z4b~VSa&xCJu#CNWFV#&vk|ssk8kq9AyVY$ztgQav@=g#xdSY4{KER~k7`tVPCD!qJ zNxjnQYw(;20YiK2rb~VnZ#%v)TTKtBpo9dKh&Pfc5PvpKwTH)NzO){nP(JXcU~zj3 z4)F1PbDE*7o+#>_4r~m zHcduC`uuple%wAF&BF>Y+=$|@&n#qM0I#J-OlA*K;%a!uIUX7xTF3W!su1PH)Z#UN1~N%(jOk^l)QpZoONG^c;4lQce?5x|Dl>`HAiSm{N!=K5s4_ET zC>)`O%IEu0_V%XP2=<##FXC@U>dUYjAQly|gjX@Bv9{B1o14I-`X@3XF9s9XWa z0pJtr%0Yv$dEs(f4Ab-lei&i3X(nnc&O~6D>TgVSiw-3g%gJeQ((7%9AOA3W?xZfe zCHRj4km*PDV&8yK4af|_e}OQn!jHcvleh?cYDbG2jmjzudgt$MB}JB(K1trp z+1OqMXhgH#E(kJ~@~QNfFmu-(KuZ;SQ&2U3zk`4Z7McdDvz)yiO3j=$Dwl*!2TuTL zJQRz-kRno5`_h0FU;B{T#Jt)G7~)eH<)Mpzj7O))TA)ym%dM^1F~CUoc$*mHF@jv1 zrMh0v)in%|%SwC3D1DNW$&o>LWK@J?ZL$8q*JeWxcvG@*Q2QyP!k%DEIf}!sXcW|k zEPAU1Mk3`e8X-h#;Y#cuR4Gi2BRRnpEBTK7f!+$lp#Il*&8g>P*A=%FvR;+n%vpC% zC-LoLxHk35#E_*TIX8dRK1j7{EGSPG4 zg1{LJJTB^*DCLtVHN*>PN|>U1IcGSP2C6L?)@k3-_a&+|O4K5F!^=&>g|0vxEtqpi zYa)*ctz@?SsewZb(5erKrM&E8m>k~3hy>BKML<0F8KWKUfUzST?I_0Svc;hi0+(5$ zqnVEE%V?stn;V6O?X%ese#JC+LQq$Af(@r)@6@gUjJ6)+p(aJXwS*KlTdS~}*e}&6 zI26yrtGZG5FAPwEc5rk5`oEj*>eeVk#zex9=Kz>c!Sm^A5W@V@FM?ac-X$g*rlIA% zyu0?wX#0|2RWvn{0Do?SB{fB({C5hTE#d}EODXD4u6WZhA6q1Oypn|sRnOu_LE{%$Xx&XmV!2E{!N7}xrIybwSW7N4L^Gd8RbvqI04Tfue(i)GFUULFK`#vZPMJ3)m8ndgsM5Rmp z62!cyJm6zv*6aCoYYit5NYmAx=4j@1sue3 zm?iz+XibW^K1|$^L|%93;am`lB^z+*bVkkNm54X$Ih!R=GWU*GVp|Guo&t~>L6v1f zG2-R(P(va45&0nem*ltCy>;;|q=glW_x%l639rrQ-;xQlWyXm**io-XX|J@&!nDOzcyamgltnDzCqX62AO+fF3 z;OWs8?E9A{M!=`YmGN{g6pSUMVkC!6xN~r@Y;{**HwC9KmXq4#=bH>6O>q+t%%OLM z{Hl>y1}dq>D1+tH3-@N&w@R1$$-_Y^cNc=1!!@$UtKu~n@1K(7tR&m}6}XjKHwpdM zc_W@26zCjhqQTj#YmR~8Lsx~g(SY~6iNR1KQT2O{2gB2Q7!#$uI(&8fVAp*gLb`T6 z_B?$3Oh&P^pV5nscLY*{kX#gp`!rx;2v)%~I)EqfU2H;C(2O2N!ypS}MW z;E(Ubm|>#?O~63Z+`_x|wx%i*xRi!LNX3L{~=le{dJW#H{B-og&h`Xg(!cy_BG@%CFwMA2_X!}!fvtkP0 zh8t;iC!d=b#5*3cTQr%O86qrSj#>f|=7yYGmX+zh8x~IDI2ddDZ~wfd=X!?WG z#f{H!%GHcr-X9|T+Z0naJ@>Ke0uLTvj@Hu{5ouSilMTe_aFA#5GeAL~H+D(R1vGgE z3<_>6quiZWPh|kI7aXHE`yAhMA<=b>QYy};q3v&($^bSIJ?GwVvYL{x3w6$| zr~gUw@*|~!7-lN75shrC2#s`rO@XWsh+a1vOyo=M#3_kp0PQlg zX$uq3sK$~?2XSs(EOrvn{98h78kp>kgt}%D?0k_8(a@iD^NE1; zr#emj%TxVuR9UM=LjCzM8?}PZi4=+o#>C^f1v}KGdy=^=;^-pOu>A1`A%v?24GTQf z1VGGtPy~jKVC>j^`m8nDna~vG0}K-~B2b(9x?d+p;O0oI#7dt4!|e>-7~>0as>6;* z2|eZeTI;F^6fZ{I-ggToAtT+n z^@z#zyM66dEbv1+NcA}5x4(m^S4!R|OG+ck4DaB`C_>@}K@r zm!Hj2W&ZE$qx$e>e^zJ7ieUo@%Z9PpaSi7)Yyt+4zYqUtG-(g!hBIWe``7J%zM#J zLJ5WTXO)>5(1BllfN*#W0aokcYIz(+;f^!wn${3kygIU>a21}E*W&`|gNm1u#Gd;= zf=FEfQ|2e0r!C$vgN=Vof5x%NP$@ND!;GNy>aUL}9Ax$Fx4`c7tB?z=G zTUKUP+O}<5m9}l$wr$(CZQHhOTb=uKzuepV;rxj;=K4lNOv0rKi2f4pAh37&M=)mf zGx66_v&_Ff-0q1uTaHlIWa1G(;tz5VxaD;&UO|5`9shwWcmXmlec6VfCU*y16=^xk9>#J$oeyGVJ0_Qc#s%QY2quEnOgB0Y(1u77pgc?+=_cUb z!ldHH$Rrf1fpMm2v;8Furic^h1XK)@WTVA7%;pkMLSH5qOAz z#Lc$Sf`5bF1$}$k=x$uM3~gplLlUEK>UKdU zq4;L#Okg$<82lF+Y7XFfKxwTJ+OB1}wKzy*&r-isu|P_Fe1ku=S1NLVcIpW;?aH2B zX%SpN^j#1zYL7StUmEYy7 z)zi(YXQ6-S>VV```>|IfVt;aMeaF2H%wsxN1r)0X&p2cM0gb2R1bj5IDcOVE5Z0&f z(>x3*uqc_iRM16!FV)k(osvb};2F%*k8;YrYhVLU@QYCvcbEpLiA~@^-LQ{qJE@C^ zKtA*M6`vwhh>~c`CD4sPRS|iq!V9M(+#~ei7v3f101$3>YN&P|((VZ{Rr4`AF@&fefUjJs4Iyba(U& zxg^CG#HU@`$K?38t-MtmE{wi90ylnQ_e1U*b$bx&q}(FBegA}ep&|!@GgogQr>QaL z)h)pL&K>XIZCo?V)vOS_2L;KOS=h2q7tnA(jzdo2r~ROeyHiPP)7{&McfB~suT_zq z247-_ceySR3X|nOkWHAB(~`|_D91ANZKaBM}IN{L7bM>pq5ELDagi1>G@Ld zTsTRoxj=bI)j1+duZR--b~)Ry?;)VAJEtAfE=D)tl4w&ac?@pSZyFneR7MNvk&(2m z8M>R$B17x>#mbj*)ARc}vUvFaY3Q9?EFnRQ7--0|U5Y;1w-wr{dCZNAU zo2+>kD`G~;gw5BQEqCJSiAmS|3ttE_^@#UE5F`U{E5r7IvuUFUd9Ax-wh2#ZKj)TH zy$rdJ7SGGi%bpW8p?Hj-$e$Qu=RlsT=l1Cp?1QNeJiQds>d#HLy#k@NUFEd1g4A=8 zj^t54;*R^fUz&d?NfLhJhF9B(?W&g>kzdMic&cc;%+^T@dFqAE_B=r`vQpT)tNZ{W6wbhb)tG z6tPN zV-d(so$^n_SJ!UEhStAukkH+=dQXRR63$doEBW}M7yh9!m$#H}Z`` zE>QB|EHjqZAY5t}X=@?Q()v*}ihoAIo&ETfb8PM-q6Zf%*V0+*k&I-5QkTqo`(nS1 z`foD4(OKLUm%7ajv)*`w=6h;wViK>L3^j(9&0$`=syP`Zs%3ND-LlT6Z-}zvf++zg z-af$~k7V0A`XDavX5QXu2mfHaLjKhOnh<~GhfNz;vLz;1T{2&4NZC=Hic0_yV@^~n za$$L3TQ;!&?a}+Tbz{jN8R$6}m`6d@q}@EeP1y}aUPII&%;x} z=m^_$gs}!jKyCba@3&m3KIWu-u%u!$W_me4lOoRfeL{@+a-f-?)wlb%pw$(=i`*`* z`IjL0H2Numc!~lMw8L_zh26lWU@D~{$2;SWJJ^6{`T>Y z;}Ai6W@GP~&cw}8>!LV2h*Sd;wD6BXJOLwNtVq&!^*aS|Cudr7=%!Mi9-Y!2!>bMcK zAj+D!I!(=7VJjWK`@ixK3osXSYQ%DMt%?NJO+O3B86&&vlk45VW#0ol|6z*wHRtTm z`$;&==ANjp=Yl5mM_hkp5zZD87j?FJX$4fpU?YAJrlJ7PL~xW&gD}mc9(1QBUT<%t zi5JSZQ-bzwb+_9A9pJNQ46~VofYmmBaWGk{#|$kaWC(f{5?Ad_mT~+4bz8L`PUi%J zMm|7rUwE4<)f~ObydY1cK$6emrXPVfA3Q783+fBxra1x0FcWtN?22ncMnqw06##b( z(3wLNZ3ZrUX1OT^#SYfwvL#4DPdQ{L*)g-8>aM&PwuR?NnYt*R$@}(LWuOKC&f4u- zK`F$#bM@?(D&Tk>+L3V@cT69G{@EaUGe!Q6NPjg^v)DMglc}*z&@C`2Zlz1X&H4mT zcKCXO{Q(kA7lZgOFwe^Hzk+#ICi?#y<}X=beqsI-sA_HlW%gFzSIqa4VWEQ$<%q(A zB|+$y=0#w|35?dB#A*B?bvm??CF2(H-H2fSb1VMNK@(<=T&^2~UeWoC!u`DK*?P;- z8Q|?^4cMKuBMq*xdW8!n=Yip8&^x+y`nVxgNtvh&;XC z5jln}GkhiHx-LWW@5+foz&ohR&~A$A0zn`lQ*F@~gKDqZxW^9%BV>Q+ntPFpoM z@}b4P`FZ|wG@7^{EXnkBEqIDEf}N#ABz;7az$X&^V`p%OeHm_)!~hk3T*sf*;DCU@ zhyw}%w{U_-RYZls5eob6Fv8SwA#lHQfVH@s@P$lbC#i4N6|bIMPQ-s#hUhtR>=xk- zK&^h!Mx!sQvvFSwD;Z?vAGs@fs-brQ_s+=u3!TSov&FT_HNm17mEhXgI z;Bb3v=-$U0XOtX1lTt~!GdZ~qiCio*jBY$}cY`~c(*v9cKZzEl_v@;$tS1Ca_YC2m z!qKP75Z>9gW3l^#MxHQ1f$Br4n&uQ^q8`oi*I)lYjL{l?UfU#t^miBP?`)p{E*9Iv z0Lg)Kv{}hr>z*`F-J}}dcT86c>j5WEq3(RZV+b1Z!8)|^dt7Lrhz056?FNTsl`uAd z6>a*RKNvkj$=}!EBNRX}y852&UC)XGZ%v-5HMVsM?fFKYgcwy#4Hk^8(UYr$0Q;f5 z@B&>*#6CKIEWraKnp?shh&g8OrN=`iKz!H0Kq4u&5IIf(wIpgFz(;HS#RNeXQ9qV! zBcAkIy~2De4Ba+7O`BG9N*W;3PS- zaWSFh;dzv`}W|R*2ADs@ltRRJst|pr{Z&CdKLRXj>HQo2;Kak*csE zmYYPLoc)oDQNa^sc8eD+<*NZpaMs9%4qD5g9SlHM3+SxiW`*g9xg`Z&Nab{cU`970 zX>Zvex_ywj3|hC;84Kh8P_RhMJ*Y=iPVVMHf{EK%5ECr$#rSTQ8 z8$2_YhQwnRKN(6sGx>xpN#2$p9}R9~Urp9(s6IB5AXFA4qp^i9X?a5wq1K&Al?}c+ zg%alLLxM#NCTk<1&n2@-+2qAl74D;!H#)1vv zK85r9);VP!mxlX__RDFOHf1{jUY-K&Fmy8*_m&u1Hs-3=zP~ZLQGJxp{H%|_4jbBe zV%4Ea*;=*UB>vgVInr_9~$n4Aaofo zrGTZcy`-g-IT|S(lx*`6=43KQ2z_NrOYtlzu{eo}0D1RSufM$Vo%p|mCjERwWvr)o zH6gG%`ipB5O(a$00E}g$z$|Br}O*!%AOfokgRvLtP2ye?S8i{;~=~=d) zBIk)pMNul4^#pg$+_46Pi$F0U!*FdER?F%>=5{k`^oAaC3s82*S(* zPrG;GXub~7Q8~0x7f37Jk`0P+7Mq+3__(4xSl%^#?kQBy@usQl3JuY7A)-h)9)fZ( z5JMmAJ+48J^6zZ&Z<$GFGSy5-oQAsF25{$#B^!2n{7t5_G{Et`FK8XNa3S+bw+?}# z5kbVwg4NygFetQ4&w01rrvH4`)w;=~n{xf`TdE=i@fcTly=W6W1FX9C8E}_f1f$@B zIYNmIcN?r#NjAH)FAqyfYpDk&E>&RpuSIURcEt)g^YOu_ogGG<1iC|W1zaX#im#e7 zGH$^9wb$Eal+MaMoP-i_xSC$23BdLQ$$kRv*EQ>~f}9hJG8U-3OsEwro0Jr(-RU~G z{RnmYA=$OEo6ZsI2w!l|4<3~8)d;5>K{WZFo4@s7IP6wMQ!wo7js`a=WL zWC>~m#QyCOt@u~0)k6`Mce#y-LEQ~RH@h3~;t|GqwW1kNPFo0jUdbANd(Cz)yBe3Q0FIO0e?EFRUfvk86j^_PcZ5~>3~g8ch6j9%Bu3s zuVSW+RsW6WnP-iz95se|`m`X=wyxK$Z}+PwWG0wu76<_;?j8nN)t90XI{9SiVc*Vn zjwO}TzTo$u{1}xYs*enP(uR~VT)$OMqHamCai&cjnBDumW4xQyP^_t_Xw)rBdzeY* z(0Kc_1z#fOl5`A)~k_J)y@bJ74=zFVYJt|i2lHHiWDI}Z*=r1eKT zZrCPCw)X_oKij)abSon9-rh^ne<^8<|154qIGLc5(!>bWvO8+B&@20Anu^y#hpC%R zZM%)9V!^7S*dxTgHy7R5;2vbD8TJ}_=HtduA^z;qg25{yo(S!n?1PxRiGZaQu06^e zlsSJIj{!W1u`mGd+)TKNKkn&#GE=ds;P_{(Z`DE@X&%&!<)rpC(Myb`Xl<_>U%DcY zL=;7U1xkABwl*$2TKJI#cE@RBBk?Jv`rpPJ={F9j_GXpo(4a6+R$quasmjcLSGz{s z=*!DS)oL}~0hOtUxCFl}PuJ{3+YDKt*kC{pn3K5}hhQe5UD*<9EP)jILl}xaE1OG- z7Qc#_zn1K^Lnxt>6@4$cc^WQevgT?%ahW z#<`6ULc+SWf-(Dy!m4C2eeHo>%W4JsrM7;%Kz1CJ38w8bqf95bL*)gH#kRBi+sGH2 z`T=yCAjjs3SD^hzEgr_L3RVZV0KsxTbvJBBa%=sj=y^xTD>9xjM(Z#Fxb-PjmDlS9 zv|}H>{J*j9|E|H$%Es`2vG4R{Dg5?-R!^l`H$iqJnb&x*?Yy!~OJ`o4VLgqMF+VtN3-`&%W51sDd-`!Ivf5wq4 zwC?6T0w@JftpAw0_b%>cC{DHe%NesPvn%h%oGi3u9k`-}-7qvjGYBC|tk|Z#(lJ~o=Q)ea-Z<@3bsNQ= ztgRXUJn)3}Wi+NL$j0oVG&*eJo zI%fzTzs@dXrO&=MdJ{7yZ$*+9M%g~Uo&JY=KfiMJa0h5lPCxV ztz?QEZLzd!W*3@!*5`qOdcJO1g@ycg5yO?;2e(enI?-J#PffsxU^z%1t=2P@)dJ7PcTCf z`!--GBP3H8=|Ys3lg>lZy5u(pK^=ZsF~5>NcDweq%a-?i7Uui`^t1;g`c=Euw5 z^EuefEanJvq_5?>poqC3>Ku&RnYE*|SoMQ7VG2@K>hx_ogjoeNo=~1!{n=~Q$wI2 zxw{C)|IMN#($076-q4$;gr*M}5j9tsS?>!fgD%JE(}DqllVWpO)d>`@xh!tNKIfuf zfWQ*)D|hw06UGG*2QUI^?TQPc6E}Abz>L9Lv?yVYK5xN7B%1d zhfgIIgl6YSi(ul9eokg^I4NTN7c@2Ak$VV{Yoj_PiE(cd`=&cegoNw{4$vi0Sf_Je zC9z}-cYt*~v!1ddf&rlKP9Mr(*G&=dqQsecP#{8#$BN+Hx~qiG-C#F9iVlK+D41Ev zx)#kMmulQvvVbKx1L#pPPl9fHvu}}SjRlU7{Yubc{+%7MxP}w)e&SM;q1FmJ>}bXg zrRs_FUvLDdqjO$E#uwdih=N?@^hgJrYcO4ytqLdUP2&YEqwwBeur>8bIhr}t_5Ghl z<*P)@^|4HYpbC>CA#jYZFf4hpklNAxVJ9ig-JMi@r`i2#JjEixA?}!`bR1^DfyiN| z=BV?4bL{&fs-RS`G7>Y!u>(+elF~`b?(c7hrw5muaxmk_;x>p%F-Bt3_V|qRNTZl; z>I`At{z6}BmUGN2|OH>r)_b;+=)3HQ+Vd zzwmPq#~ROI_BynoU|eZ%1UK(f=|Ghh=J=h9T=ulu?0uR2vI50qR@*}1{Q8e5O#H+f z(%^8y@1juzzP^Q|z*iwOBGn+5TpR&Gl{NZA;Dj-WI?t}~ULuc$Z4V}sibcl*0TVR+ z+GJKW#*~EQyS9^l6M$l#tjN3Npz0DFb0PiMW-6x0ZkUNH`1c>4*hJZTcqMo2)f^~= zJj$vZp^|&FBc8pHTz<4kkPe`g`$W`s%n_oO<^DNE@Ye;0t@9Vn@$eS}Ll7Ah!ut0g zkQlwTYaFV*d1lliCtrF-FA6<6L`BwuM}}Cg>Hb$I3)U+gI;=h=|3KW&okd$gG>; zIJ&QqYPzR!^aV}7o`LC9+a~_PN+(sU;%yDc^Nx=q;_8++62IBnxXJ|8lIz@BuH7=`( zF*Af*8x<-|8^9OK!_Eq$bHKbr!=60h1B&Yz*{dS{IK~Zf=?V`hETm=^ zcYMparj)El!7FXG6avw$t^`cihx>>HKf$Syb+o8usMpfl=o1a--H(WCg`})wQXrQ4 zh>lB!$WCOi8ueMTi}`tu91nYjWstG7E`Qa?81BJPK+pHT+vj6? z?F!}vtPq9jMU!+bFnL$Y#(cR7|LW>9SF5l>kw~O z21Xltdx(Be?+pmVJK%yhUY+8{x&N(rJl=* zXkr~KCCEf*BYn&e&2+9HyRDe?%WvVK9zDg1gF2vNs@6mn>C17eEj=KT&DwPbX}@jz z42Ki#`|Itc&lE3b<)3DLW|rY+sbWR!_y@#_|BKpjlg~%zp+egadn5-4=V#6RSPY=| z4?Wtil8x!>`{s6L?}gS@D~2Hz;2)*|6j=LaGPmN0lYI1Cn|EHU{yf3f01@I=pzQ5{ zAqE6_7$83ye&g67JVGHrDs^JW1&oShgl$l5!WgB2R@q)v-dZ+W^o8LYvGTf`-yC%S z-XhS-QC*`mH7B5>S$(=)zUG6VTgs~@D?M=MN+Etc20g_^51)MZtyX-$MUF7U*f*7TWFP{lYcMB*TMH#Pr13$UGwvWKB z6(4m#vTB{A+Z0d`u=n~SxS3PaA#SGnPRuKbtPta@wgPTFW1uM)wRGnwnwo5U9QU zt5z*w-bN?xyaCnOZSB@;@>z~gO%_A`+LqXXQ%c8ckosv{j!sE=ZFA5-fI?tthNBW_ zcG7^JD%B<;NJMNqoF;O0>uS8*H|4kJtGv9%zxwC*^GI=Q$CRmzfliNi^I7y_QKC z$}I_dTE#&T%J0>bZ=hq{2Bk&%Ma$ix9jws|Pu%7(SP*NMdz&E9({TKWha}RC5y?~jqQ*HwT~YqDeQu^#TxOW_p~DYFn{t}BI(N>WV|Y%TD8|k(MaV&loz<0pI8`D^ zi-!u{ROZlb&SI8g8gyUBevBN>==8nKB&#||;LJvz-DKaFte<(R7U)?3vXWMv?|4JNzWbX*_G?`uh)U}$WY zlBpPGnmiC}4n&fj{hC~oMzduuujwK|ww;(#Q0uWw+F&Kgp0Ctp8{2#|Yp2WRW6Jk6rY^P;pZ5L3XdLqT?`AFN^cT#)=bp$S3>TAI# z$(nLhG{}e>7A|KCo(8@yR>NX&yn&A~kP?3HMm-jmX_siC8^AFSdQdw5QI+>>G4B)6 zHt<_Pj*X6MgrwLva=Uo&=9l9V_$YG(Qz<+f3x7&?i#Qx623#PQ8OOb}JJUv?UNYIK z%`i?BR7znoF8FSsc(nT2u7sxKoZ0*WmbnOVnl;Q+2hJnaR%h#NYlg&AVuc&;IBUJy zTz$ZOoY4hDsS0?37hsL|iOTb)6G09<2=@(^XUgoW_Goxy=9I8jHn^qFlQ(fd3NKayhbRW!atvewZqbEo${6DQj zbb?9!A|cwDheZeYa{H-SDW8FVT*VC`5T+TcF{DvOkGFZ)3wStq4ij1~yEF>L>l&J} z2n{+a2uEN+BD%z05gg2VF2iUNY3;uj7^SJ^u?-uON-DaFeW=|PNCpukQ?7e$%-X0G(c$xhMSwqu z6!Xp$Y%1}}P-Zgq$~C@*`R7Pc zXA#gYTrbHe9@`{g$TnN0yhvO@&9Rw+F>{g05kB`Su&1iZT5_WPPrAtPMGmrJKE=F# zFr0Roi*ZmDJF5=ugRV)?!XCb5QG#13+(0AeWCgvQnd1C1 z-D?^+^RhV`4%@iZ1<~~Q$6$?zHajECp89;GwoeX1B399jW~szne#0>oq3nK;wL0U= zuvhkgU#ZJI3ZX%dHkW}_Es|Im?b>7$i*p{0!%BpbJMCA58gfCs3VPrx_sg|6`+Qv-13BLm<#*HEUWy$Vw7=nHox7vXz(1CF3o4s_aDr_+-i&V+wfUpCx%8O%2G(Dwq=wCw(yn%EhB+2-WsFkjaJSCW+d>}_Ir%1M^8Wi)Ff8n*U0y9X-EXZnT6!;vD0S7oh$ zwk(Hs=e9EOacL&}IISpN=Y#I-OAs!;SI$DKohWuZ-4HUD17~o>!UG_-zmlOM76WK@<76qM4F~DzT)25G)V;?J&s_g!AKIOE*>1(yZ6Y z?h61C0~8_ILIh3^%s`dYhjfMxh@@7AFSSQ<4vn=DjGa<_ii&hv`kU@oKIGuF?I^az zEoZ}GyC9d$_*+$G>Q;N3`E|YXmk@Mxob67jh2)?OToAWee9tNP0eU6ix~4YbYB7IR zI;AUf%Ly3g3+Ga3L;c>xOOziz)0WC_Ri9i_^5*SC@4E-?#DOjlu$>!yt$kYH~*NRJWvQR?4-LW|=3EE*25B9sc);?;uka#87_SgjO~LIq#ffnyGvV>l?RCD0NuFuCHL&KL`?o9X|Vjka0i zHnRGw>~JWAZXm@Mye{vy>BRDgxu1}+4JMojjKW#9@Mq=Mh(>z^x@w%HB5{uuULIi> zMN%c47s_Z{5|-ekw(9)Ea@bTXxVV`Gv{mNS>a4g{#uw>bMozifvHo_v-Mdh}3|8&| zotRt>=+LLEG)FdVLrItn6H%+Wb8YGekYlXXi(&Tob>w!od1#G@~ zg9&F42Esp4Y@RWdx|*I`ExZv`E!DK?K^jmm?bAfbL@M%yBozPHK>g^Tfw|g0HNoKS zyOq9>S=2!zfptQ1Sfh%C54Go}L{-z1bW@+!?*LsWTm`efvCboc`8lbVq=@$kBKUXu zr1A#hnifz$rp&F%DF?z#l&9nV-i`^*aG5e}p`@z$IFXdjnGD0Aegu%iil^)I*V#-+ z-uB`Exq9}rwttV+9r9^7^}yz(Fu%$mIrJwnI!^#>a&6-#;fJ+2@?)b(&ebc!5@S~G zx(_6^X6T|`td}JE;su_W((S(vMD9;+@Ll!`mLW)GSb6Mns?ig9lSG(;)=Q*~Gc83k z(J+Za=m-Nt>qSv}sKj!Cy_1piF@=y8!lOu;83N=-M=Uifh7W`B^EER+PEDkXe|w_b z%X?)fB2v$690OxNbwAH~SVttUWS-w{hzYmj*}qHtnyr>z*?Iw4g`<%DmgsM4Tf zf!Imn5W6oWGI2txr-?Kp9}Uu;a6Lk|}T4+L28@P9bL z(k`6@?}~A?{(ys|U^ zU+h#6I0@yAm6priI!;QzCB-4Jy^w>^%M{ZM{Y77c<$KJCxAbQ=9z^RV8xfFz&$X!;xW_Lf1IQ08&xYC zV*>jJh#$TEhueS{Qhz7$$soK5rPDPt$qV!JdBBZuv{N!y2uiLjpmyEtze?Q#%!q`evPuZ0h3~1i>#WICX>Rkw;0eF%7r{I-G7Lf*y?g3*96iu;nvdj@$ zspLt;TkXlw$V9=7nQhPH2inG753lVB){xFtx8L*)>r72RlxjFNIITzvDKf*H3g&C0 z?Ep9-*{7<9^%Mg}he3o7=qS}-!tECm9SYZ<&565fDUD@uC)`DxI4a@d4^1+nwJ3^b zHn09{@1v!ncS6)r3ycaWWy0fbWa1Sa$H&xsS#iJDzN0$s5H>kYXa3t0j)fKhK2^S* zTw$O+mV#~t7p=V+oA(BT13ud%YsK_*rpPSz`v@S)Co&V4F1Vxm6VF5~a^NsHA*K#D zCjB0XYN<0eU+>B;!5LSRQ3U_io#5?h9^pD-1IyTUYET4oHJbfi;3s3=?m7av+03#f zYxL7f5FvqNLEebOAjIt4s?#Kb9k8~pOgY3ukzzH|%3VuYHLvj3xTJihMBxM;PE4S0 zVXhNg@#jkOdV-z*8Fv((rbA{L9^=P5j_BXZh;D5yFPqpZIu~)l7I(G1bK%y3Ikpd{ zeRws1Q+UQyatFcpV|r@Oy zoOrevn2Elkyrv0$`dVC@!tS1q9==-lB>(i^%Xv70-JIxP&B-t_=rMAz;xn?N^2M!q zXr`4K@L04hr_mteKQYIGee``lwM{>~&Zd+{oU3>)9{GN-B}|E+vdC@@wa2@y>EC0y4!OkrcdGBl>`fs|;$G$MJM1tH^=Uf>n^MCsM3x^(@HjV} zsU)}Y7yy?S*u(8)n+#tQ)s(I!!g>rAh!p@tORE|EGUb>xjlMqnfUhn~NuynE z9tsi~cC?LoD45yppEpD`UR=;xBqa`Ng3JzR+1+IAw8zF>1Kh!Us3oaoeAs=q1{zfB z5Ib=3_Ab1RV88SUviLjJ$dH)>`3Us3D-FTXriec1~A zKl$Y&(_~;Ib9g*6ybkGWn$dg^&Wy)=kA$5VkZ^*dyx@;{Fq}`#qk5w71NVb8bkXHHd~FtQWxA@iRLTF@x^Q?eoH=^px>OFP=75fH$uOHKBzrwyZBLKad~Qwr z$RFo9q1*&2*vrxJ!H$f+eBfX}Wiz2=$c(cPE$f`VYft%*ItYN+~`BmLgYNjifvfk#SN$YgGe&m z@CpLMAjrWYBb$Z;T2XE)`0cFm?ULw2;B0oNI7cn$)FM_k4uC182%disiC!ygD*ln* z5Amj2KPzDh5*YY~P$A@g4qg(kjp_|(gV{0uTKuHz+6=exY7*#= zY^nDrG61`{ZlZr#s^i{MctpyG-u7isP|yI8N=_}oj3S|JIK5C(8l42Hojk3(?U`|n zk$(G60?2hGno;#sVjCbroV6m0qD85O#Nc-9gcRo^ivg}#)#ID}JYTk78A8`?aPZnO z_(H3o$$UaW&OEJ(t=>bDs(@&N&t*&cG#mmjUDKUt2!TR=-yEwUBjZ|eB-|3#J9!HD zQVs`F^9OJWon(h->_5O3!$d3M?n+r{4EEfA*hQQ!%93wVo#~drQ-BdrQa|ZBP=_s+ zu&9vo1MOC5}7O5 zmK)!br%)NxM|+Vq<)2Qo{BNXaFk!+dHRy{&^(pMr$9K&Y8A17K{R!YJK^FEk-cOJG zIal%!7gnbkF%c9}B$ZlhGeu~e8Z7}A3;~<9H2*X~H;cXk#rDhHC_-`GFrBH%bJ|6v zM67t8Mm($vRw{NG5DQ|IyE4ifw8E%VKv9vNnOO|klnio+Gh+VteVE*QA5;r%6Q;!PS6OneA{>o_ap zOoAN@=MfRC?i#%gOwt_V)JL#Xt+M@5$5CEz1e-rV1i^Z{=)g&!GR8>JM6@pv8U}A% zOm2OsE0=F10|hiT=m80rKU_XPbT#(!_KNfm>}6~vboRCs*TmcXXocwB z86ia`X1ZyzMAPR?Ql7u2#{f1_Z3ukIRma zLf}iGtMNq9#J#G(5_4#RcxUhO#pNuE{xj9Yj2Dd5`A)qVdYMkZx*pvv3enqqN8C2S z@GwT>xBf<^B&Xoj3xh4&E2=I>K13%OJ*sQv#O*Y#+|XgKv4PAa)5JT{YJSr)H7ybF zRA#(s{!d1`4LFBOTGD@kLUZ{a%AlKD4x0hj&QX-1a$F5}&t4&ZSZoQL-4^Q;0gvO_ zmfD;S;4&H|u@?}sA(#hi*mcH6GjR>7_CP6l$T)p7OW4oSOVVtR@m+uuu${Y;i?EYj zXZe`0zXs*X(SV#xv*%yuDBs!(n4F=!uf`yAFT1+y>=!BCjZ(jRuU5cU%~_0H{0BF1 zFJe@J809PdTB@OYP%5*jKM`pM&s9Hg$Rs>Tcy<->`Jlgd>b&b#^x%HL^nA2k;k zUQ0hv_v48Eeh?EgGD(p&=5lM9K_}d~Q#KhzL+cphH7LIO5_M6=qx4ToV>=xAYHH}2 z@wF9iyx{DvAUsObd{FyM?UPqzTO5H>rJAzfJ^)Y&oW)lIjJU)Psl(;}uGq#lVntVMvsKm=_37l(k1j>!kv2j9N zwN7{~{1C>nmf05<%lLIVdn4VC=F#r--6gfl*l`ixhy+L3B>V9SZfo4y5$3H@-^%UW zS^L?b9x?WsaanW`PpZk&?WMB3!sKaNBGTZZF++Z#1P#w#q^?9$Sxz7 zcPYRtTS8#Xj-yDNTMTUxf?7|takZOI+&eeA0Yn$4qtA^;S#|FLyex=Iut-DpvT#U> zK-Z-!(}t!%s6vP0-p4_>*b%Ah-T9ojJ~U@stT~CAhDRj{NM>|rfhx*;nBnvS^--Gj z$~~Qsc<(Un{*2}D3bh8~E6Mu{i*t(BXCz<0KX9h?@zCdBSg$MWSM5Bj;SLq4e4;G? ztWmv3J)r2Hy(sgVey-`3#Ih90tmy|ymY_bd4erm`OYq#xY>=qxHk6JmGPjVU4H8T7 zcipg1hL$av9yJ2c?^N|*@S=X4 zZdOCt#SBmNZ|3jqEPTP=d=r#7xF>Iq=2*WKu5XsO7O^5n!rjf^HQaav!L++qh8dz; zQmfssJr+}4hfilJ=hK@|b?k2j5EwO# z=66QaJ?m+(3dWoS{&WNlsBl;I=JlBbMO!_IF#x;2@46&DkeeZSr|Wmojv4NL7`4nS z{a`#X3A`Gi@dGQp!u$p*DX^rHZAhXc>v7$^#;tnwh9 zl{d*KPZadV1skK`02$OCq0t6%@rcV-|M>DgL(RZ9^h`~O8`E&XUs<)PD?O`twsk5T z-tMxERdM+~8AH9ONduhuZiJxAQ2Wv*h;@lZb*<`}Dk*sd!wEi9L{Ma$D7L!_X2eEt zyc0gL*f8jQYq856<8b{MTm}yu!V)|m-;?mJ#Ns`*Wy3bR_@mRc4%DPQ-b)wR1ME&= zH2|psso=D;vdc>OU0`N{V_8DMf%RDoN9D`Du9(ZY0+gT@5IwU{uZCR1G2bi2_zM&X zQ;ieKMbyCv8Mug6#Y9^q3q9L%#Tf>(TwEz~(M|i?0ntEc`dnIjBDH+h-Ru1#^hrm! z@&|DLFbU0oMFO$y-IO!#;)eHUujfrzLg>G+FFXDJihUW_{*P$J(ys?&kO}eEgW=`} zvyClLz=H>X!1{Xf93enUkIL2?v{It4vSws*mYu!l`)eTU_%)DCsAvT9g0h3XCIqMi zxaei}+kX7UGXgJK{y+cNCEgI4VC;Ygmh^nI`YT_#90zmf&d(3YfJ!u1?DcSeI2 z&v*lpZB7YOVe-rzRZOOgc*Rl5(Vi{L>wxD3Zpw*`?Uaex_Pk~bl#cDI@Ip!u(G;|; z+H0k)ngdH1NTwsL$Mgj0S2C{5LbaRv;sjIchM)(5(4NZ5Wd-}#TO|EX!T3ogtt%`v zbWisW6B_j814e2@W`ha(HpB`<(LKX})5J@Kq(hI-P7>nQ50)@C3FoKQ;h_k?&JS9o zLqQgk_m9`>|HIfj1!)qt+qQ)++qT(dTV1wo+x*J5ZFSkUZQHh8ed^y4Ct|O2*2RC7 zcX^W;ku#rnK4a|MK6ob2C10cxWY+l7SxwAo4q)(0@XF3N99a}?=~s!_X7Nm}SU$Rr zcgjl^8=c1iXmIZ-agCpe;|q+W!HMK@CMj_bZmurHwMDt>)uRxDs}SJ%`s*^Ca5%Az zUfUdsj4m;=tiMZ_KKdF*B*ql{&1DU+yRfnXoJRZ3=lYg?r-U!xu&^6`_0z@~_v8K0&+M=#BT8BQqrws!mNU9aK+ae2mOslA?MV|$&C^cbc#q1 zX(OI=8lKvWZD1t~bt5XhrcINj)kzCQVN6C*&rce4X){-$|D-68yb9|-HV#~3ot60K zmzUThPw7LB6-u}`f)uC6lfkso2B72x{X}O%oIQmleFQTSx(frRCHIF@PB_NoD z4*t{}KCqczVtzss9g9dHkPnY5(A2&(wsQucXy&a=3fU842KnZf)l|j+T2-UF3kxlR|BD7+Z>}@AdMK&ua=0SBm=e?KqT<^{;mx@QSFHtfN=6d$_28_ zaPwOjNE3MWykgz_IgJ0uooBc3kM*%jAI))sdN4;N%&bt`6Ei={IzRNW68uy=jzx#f zQDiqFMa1c;HRZq)n=T|c-`=}21i4GX(R!oAa3ijc%OOM4<}qr+5uuL>QkVs4oP|;p zUx5ij_3K)dzPDLI&fRsIrYbvXEtS%Q4AXd+i%xNg;=%o;Tk_9oQ48I7AC`n_QYaC| zGn;Hc3YaK}g$#j-NdY=4=NXHqi+1)z8_aJtDiai8R8?j+Zv4@B%^~^3S-eXz-aWxF zQ<2`*4RB?NO=J@nTq_YR$B}|qi!~bhM~)O$mf^|?Ud3p(uI#P&7f-sS;8K3PeZ+ag zxCfS5#kd8JfVVXfyX-w`#%Lu-o~6S4D^e~6GKjXrK&4%>#6+fDCRTKrpvQhoh!que zh}3QYZ$!VnVbI0^l{BqoB&Xt=_exyv9^gwIk}t6aTkL8t>WH+9Y||o&j`Kc%%1IGV zocX9|Ft=pthExOyvY+`$gdh={ELI6qUJAvcZH_#j*<rF~)}`S0S8ZJUCz3K;bVt>W~S6v7-6TA&_~TXb3e2z|{r1xa{)j(h89 z_w@q#UY){8)tYaH_q8H2m$`35DlbW(b*)o8 zk4lo4?^Mnrd$r_~1RS)H?5=tP4V76_Z1%QOk~U6-+)>fq+}D`L+tlH4?T&>Ald2z+ zW9Z{s3~C?EhPumw1V`ad`vaz2}3F_S4)H8`UEJYr3$&orPFl0ln4j+ z5PX+YG~wb8IxHU8XCIeUdKv!RG@2_XWSPX^UvOA!pi((naH#l}^mwQ(4E&)GDG5 zi0o|+m_%fQM@Rpo8z^lYmJN%RyL7ZJb<01;(RDl*URNnXUbqfv#&)}7%@5Te@kqPW zody_|X98Ob_h%jG96#fHhK0vLCP66gTku>RO|GT}b6_yD)V63BOv*E^(RC^wF|OMe z(g+fosg1*Wn|bo^Ibu8gza^d>6brur|G6*QysG7CERPU$T^hYPb3?G6(tfAx*)zAunU-11^doze z$x*@ARIHIXPF}%i2TzKEVG$34PSjvY1=wW|9&5(ga^rEnY{u@GTv&O$ z;KmMwCx132gnB${Yh7Q2P?*40{i%r_T*u?4f9i?@Lagjw=d@7p1w8KW4NIz$%DLWa z#w6}-y&m}tSDdG6_cXZQOGXLZub@xNPG?4LeVy2S1AG3$9{k^8(|42<9*M z&x?Y~D_0lnYcF|MC$(JP^9oh_9dvKw`XDv!z5a(Bu2*I(*QED!j5j@obrMm(<;)nh0+ARLWXb`9zhQVGz_}HNfnpxrbhcQyAy!>gX z-%Q=L#kSP!Bukr}ms7*-ydMJ79rM~CK9XMOd;`?lItg&Ow(R`7AI|at(M9sq)Z`C& zs8&#pdof>)@|lbZLN^8i{Au0i>|-?@=l#w8v1~FTQV^zB^)JK`qWYc{{gT=NcB|-T z>_(gq-ug93dDIkCObDlk&vJXo#!GAS*`4be_?#0HGhXUiowR7VBF?meB2pzZqA`>4 zQR3kWyY)DUC}nc95#Ta%;(=j-=C6j!0Aif$91PRntT03!6kOVHTX$@{%fPTUEDuggCc(e-4@YUa(77zEjlK+|e2e zpEQMxaswxHrPa~dra+TK%o0TM?O=u0myq3S3;{@)`n1@7e1G2PY=O>68TUx@W0e<8 zxEzy(5$bt=iX;@0;1ImoUcN?zIP}6{wwDSIrWAROYDO?ZWfN(xr!b*x9sNIM9UwSag7#my{eE*biJgbqNNHH6 z98U|fsl>VbQ1y!)^fbu&IPm%H0O)20Ry2k<)53+u(>2nWCr95F`&>fw8dDt4QK48} zgOp(-e*!jpB;9INs4B^tz_6uZf#sjCc}a_L*?-ohjRiojRSMz*u_zx9c}yhT>b9F==|h`>`jtze?KxW?BFa|(*EVk1f`fy4yUcz>o}iTGfs zmJU5QYLM*NY>uE-a>l1}@`i8C=_7y#ie>xvkvo7}(YLPXGaTSmDIdpQrw_-fl%>aE zz6Ta7om}v&>J?R4ICJ&iX*+4gCk*8jFflivB9anXy?!H`NTsQ$KSk=F*!`uB5JFB9 zaEIp5)AOLraNqF`FqgA>7&YaDh+ET4BTlO8Hz9qcDTuH{Vn9GO^JTFEYoHbNWr7{3 zlSg{Z-y|s^xCeH~6Fo807?M(`JNwE6J(J(6);Tu%YQF{+1^t!Ob&z(}PCkpzSH--g3K=2qhW8V6RE=JP6?t(~O1pij-Ml>lZ%SP7S?w$eL2^(mdR_X{>yncig zPY<16-g7EM1i;~S`PyTXj(Jk+J;D%htJCp!e_PZ_!&K^B!i1`*z#6v;I(f?;lG#Dp zoz8L;G}9+?IIS+>_Z+P8CyAZZvZ@HtY2p+e99+&*QmI1t~X0X15W# z#9Oltej~21P;UFj%G39?BOcHE8Mp4L0$>PEVVxT*^yZH4pVuD^E=BNmR@ZiAzkQYX zpaMbwApnEw^rQ(c;;!z4fE(#xfL~Lh(Wz1D(lYG#wsr%U9?(wzd)w8vX6Au z_CQp(-Lh~VqJdUar|c2&z`fa>dXT|Uyv7|U37(pbp@&d7IgpioM%%!CC0>fZK^lHH zf{)iCs<|>V;*Ql!@a@jyz;B1dqj>_J>IX%3 zx8-3ne{4PIr0XQ8s$5E+doAYvQ7bcb?;f9Yj2BM8UCq=rEqZ#ux5)2sL{JEY_jWiX za=E*$tlQXDVOZ`Dt}B6syjzvO+UGZm>*m7A_kfT@8K;_MIlk1vQ$JKiizWGczmb1R zIXF$U&Tn#UDbNo%7!drT&&b~xv>DF#8YJQ8{QI!gM;g)b!Y9w78|$VE=o9q3kbQdX zYw0{WyuE9ESLDJO4m8TEJk*oc9x(ymG|^Sy#Sl^ROQfTB(fUt1l8pzD10fo#0GNQBixSWIx~ zIFD2p#aHEHqNYoH=shJ?&+34uhQ7aj3!k5U=je~B?+@$T+qOdW_7h_Tde@)ID)8XD7mU7?}s)0=WNi&wa|JlyzQj<=(#`POTPf%h? zjsJg6WoP)W#(T^R%>QG&ccnEoeer|lno)WMD>&CfM|5ZGZ4_|3^6u!P-5ufYIY_7L`IBa}qzp0T2xK4)8Pn7~3w^PD4NJ_J$GmUQL|7PgZWX zUQ7|QJg$dso8U1F()Mi;6QF29YesylwYO{&(f2wvtI>JW-Kog?27df%DN!pGF*VW{ zWyapfde4a?5EHyQ!!I{`>g4$~v&+L9?43R{Q-y@_8}IgM_H+uBIV_LBIK1QRsqV$q zXD;S!rKS}TQ~hfKJNY!ozU#*w5w4ukKiDmm5(j#Ao{tiQe_!tov($fQ%JQ@qv(kfl z(5sSjA~uj?ytrmS*1s<<>~rqlUi_)}GxmHaoZuCNZ5%{~9FA^jS z1|%47Mi$*p*Nv_^nr&!*Jv3WY+B)Q@8RD=_`OM~1Hun$I$zoi%XK*W&kn!!U&Lh#O zRWL4E;wy&{zw6!yF6BEb9XE>W;j*-<<7^{ZokN^tI1%+bj0g)$)sZKAzjWd7Fl)a5 z1+{={7(Vn!MF{`Rnt`1j-@FQ5$6~l@PQKK}qp&(Y)L$Cu)ZL&Qi_UpGr=mfxXNk}H zLFjtrFqt($NezpEZx0B(8AQ@9T9A$+#>_IAe_ed3gq@x$+Qt1G$v7Q@(QdQKNWZi+ z!V|gcH%G$0>0oie#oIaYSSf3xng7#@G>lPnh>#DSkh`~gGxp>qJhpXcm{p+jE4j!& z48lAPhLs9w1{~t=K-39-bYdxZn{gi}&#q52-XW`Wa~=36wfik5=ycVp8y3RvI|~O9 zEOgVL79|CKyI#_D@!+jd1wMHdtMeiOv!FGLM~3W$7}O2Q9PuQgQxVjyJ`us}N364hMbI}e~NX;>Sx0-q3QJ4_5F;h}eY z<=Nr9{pi@mzLK!yO}dOgPNW$(;>O*OvpeY^S5~13E}9tmT#7p~Fmo&A>#kAT`Cq4m zOpsd$V+_6Qpvp%Q7d|^|0+!(HQA&H&PwBMzcE$K%R<4SVw6OSd0|7F?Opy5o=vp82 zM5ijGz~M+aTgyjP4W+ov&X7a6VBw~i6Ne~KCw6XW^8hb;+*Enl_x%xXBrt2f8|W0} zY-3#@kU=D5+QE3HTW8dQ(`xxrL>zAjFnc7aqLzGQ*K-UCaB62T|7&C+1)8|ULP^J)pt z&O%`hNuxX{(dpRR;`gXpTje!|h7XJ~0yrnqFT|p}<22CMZcEg`3j2e)C0o zz=I!Y8|K@DR2b6`;op`Npa_yVJX+Sd98JvVei=u9&x!ik)?c$1sdrA*;Hs_j00vJ4 zhy){lV9|YN;2^7n-y&@lSDB4adrk3emO>G;f`fq_Z;wqBB5QtEAALOTt=0hYO6 z>Jj|JwY*`(^vydig-(X7nwn+CVyxFHE@obLH6TWPc19vCQ+pO-?g)w+#8;CDKn zCQF`lxhw)!*0nyZTHp`F8QkPKOJL4%ny=Fk&VJyf+{^=Y?ho63!Gvk9qTte}a+Q1d8Jj|d~io~0yl@W|eF@5>R z4u79)Plh1X^Sa()LN)93gt^V+oG!GW@xD~V!1JPkn{@0`u4gdvRalIeK&$7!T72r0 z+L_Z55khKd=GyVX=%G_6ErYVd8p^b2=pm?V$6l;2t;vqG-A(JSNGT&!yNw3Wn9slO zqhCt@h|{|Q8j3GaqWV2npU`|)dD3TGI*t$Wd5S>kcRPqWQ>8@KgIHYaM{K^nRqb9~ zBA4C~)bwautng^AgVxY|H!upVcX8o+yxy>>gG}k930erTO`t6+v}rF6yuMTyE$pC4 zZ@$dJq=4eHM>GLyULMzQeion35rY$Zblu+^)jr3f2%O**l+9X6 z=Cjj6pW|T$O+snbD00CLy_4aupNJoC-7k=z^85Tq068n?lf z5dP({MA9T6>C8xsfcXp3Y98&*RS`c|9F7&3-o&F^u@5LQWR{i;!HpLEl(w0rb;P22 zr%)xBP(xq_*nCCeVbH*OoSzWLLVH4pZp+p;ASENLcVpcwQy=dhsz+FvS&MYy`6HQI z`yfgIAs}V`Te6~QY2f;_#7OJz0+zBVHcJ#sS2~lw_uBWja t5vp}3{qN94GMFuTFAwB6n<|XtiZ=LHL8W@@xL{H7aeGR`%f_zPz-5d|fhrB*PcgW1xxmRl=Q1;t zYcyC+$wo(@H$|i1(J6Jpdwct~n9gcw@{-tk*Z7ywwo><8+3_8W^#i9N3SXwZZ`W=h zT~Nu>RU4I@^B`zgAfK=^V59u@TiacDm;}e^G-YcAZ=SI>U&M*EM3c84^6I8~VK4q! z&4uUFAWkX9!kAxGJY2PIh(0P%KS!+KjVfpg5T@vyd1feqUdL`JWRWVZL1%kNLG12H za~|!oSUVR}S5E9WfmJX?z2o-6#$S5xrdlDdI755SSfoU7Z$MqBZ}UolK=G~-DC)pX z2VeZtV^Q;)H2?swB6-mi!Z4Gp`g~eY<2;8qdTyv|(2KmD(5a@WZd>@gY-=OIno15M ze;eY)N$q_#370Tn;roIc?-k$ucnt*1-2QqG2r>{c=)q{Haf5Zt}so+oBdeQpx2?uy-qS0=@_)?k< zgDgliTevHSvPyBRr>~yKiM$~y&!PJi8PlQyP$e4#QR24yR~785)=bVGuWehk{}IzG zP4vmgbZ+G=SSNca;FFX&j;rw`65r~N3GpehvH9kxX_N|;;G`Q zEon_u{|vMLPycmg?gRKg{Z}l)4hc^T<2_G~9~p<~Pycl=RC>(SWsAE@eAa$rg-iie zB0e;U=Zou1BH7n7!Zd5Z#*)0{HbQ^OKzv+rvWRcIi+F3>!VeQaAj7pUo=%2 znBL9%?V#YQQ7xPLft}>jUQrYKUar!{kJ8EXwPn9-USF@;E#IQl4mzdUb>1HWom3_LWUBSCy|1tA?UMb6Y z|8vQ(kp;ZVEhuHFynUpO1v7jYpWXP%`Q`!uRW7_1yxeM+!scBJ>?c`q9>qU0-K2|Z z@7825TIwHM0=+2%q}$8*R*GZrz4ZidN=0W!rlT+Ai@iyA`RMqTDxlr!Jh2Y05kU>* z_ba}+7@+%{3%+qp;%w8CzcVwrz+?53(5LQfUeuCK>^bBVv0p=&M0(C$LlUMG(etLthNM+aUd3$c@$)wFi3VsBs| zun*^o{&?3{`#^CRZxf@qnM_ zubiOyZj=}q`hb_wC>7als$f`-TV|PBsBuvcy13k$QmNemB`2`1YVOd$Jh6^LLMGFs zPB8fQhn8jURu%5$)Ur6w36jy1=SARY#L>*5HuUOUXjPa)4{|ZMlaTv^8e8)&+B6ZG zk5x5Or3D{3eL*t%27IM06_;_nWY}i>#)DpS7W_C$wqR#HP&}jD*97Wd*AoAmRE!`{ zzJu4j>R=!Uky`BQyJL!AI=`Ggkb~HXs~D18$HuQ*Btsuuq;=wxmoHZF0A#z%0u!qb zW{{?(5j&zJ?7Pqj?ZvEXL+bgvu&gZ7+e%%$u%d!(Um$(y%^3gPX|5wpndE`AEc`b5 zu4~h-pZnt&r`3#b?f2oSjuE-dv5}UOfp;vR^2vT|7pP_GEX;k5$Em=ApH0aYkO~s} z(}V@bs>Z9JrPI%S5BjnbvKI79-u@?u+E%CoAz&i4`QsfCDG_k);8^icKfHmtjdcGP zFz2vZ8DPludPoIZ)-o`ArX5dl@(ozz`p5V=UD!~FQk5~W zC`n9|)rU%x%X^fcX5K(MW9iT*9#uF%sOB=NYhdbJcI7=b%X|(Xh@n5pF~t_px*QOYVk!qWTj^9<*O#(##xcixipE>LCxknoHJIi{<-Jy zAhgDFWu@@9FoCcd=fz9MMu<2hW4N9CDeq!4qyJ=z_sNI7A7CjUYly{5EtFqo!;^G+ zFZR^r=jeCVLG7!*n^-KvEb-tMu8Dyt!$&J?W(g?>u*>9ZGw9^=Pe$5!DSI@~eym{{ zeaZ6unGL@Ev-U199#|M&ks!1MXD=fE{X(n@pH^)I{sUlFJEV-BD@ckfF5Odoh9rF6 z-&zHXq=gk(K#{3|W4YxNDNM{`1Rj|}*`W?%cDG9qLk~w$q=k)2JP+fCcv?X~QGObN z>CQd*Maam6BR>6(Q{CI~>6qvCX>niv!*s^`F`hTb1%nl7k#^R4D_#I;b8}gl)J&zL zzHvpi_?Z72DwSO!zmEb65Y!jwGTa~^i5_XZBZ3|J6a&ynrSVt z5)2^yguPk$>IYiL*r8vz&80gKE¥2~ZPm@3fg=K&8ycnQyKG`xY@Zhsb-X{5416 zIJ({~)V5K#UQ5pWn0}d4dg%IL*l#_cPWX{?VGejxZ-M}>eK}@{#joTUXk}cx$IKDn zg%3JqGdx54MSh%HMzy$tA=QC*GlRi|r@_h&MJsMcPyB?#=r|zwOH#3hh%)ryh?EX) z^#tgijpWk-o4d?MB8;P#l~AkYLAwR57cCyYL*1<93dju!C#`d9S3UH#k+dvFE~~!% zL4QIqx0k?1xu?jv0J2){fINLZJ}c6ybEm@)im6V<-0e_A@K(g#=5){!+2&o`p>vV9F{0zNYCbPM4O$ z7!Kb%!qmdsog9|rey!!Gj(6aL0zv5Lj`#8&^c!<}9_l@|ibqzxAO}BFxa0d->E*=k zDJc8rWd1&ED-_0)jXqq-^-9He*4CGhZjwqBT4IVTzCVhwH*)IMh?^P{VY&_%eKg<6 zu>pENZ|@8HS;dztq+~n$L)&y)j<>kK=%z%rCWJY}3BLV<;57EPK@x&e(2sxBzA8OC zd;DMdC;EL>QzpPm_JVR@6Yrj;^Q}Kj&7nDC`fotJoqUCmu-}JK=Ih5LCu{0stwU&n zYt8C~@^wFM7tSipy8$F^{#|YS4KQ~AXdcTOIZX(hEdsaRmTDmfD#r7f-{?&{ubXD8 z-GPGcg5E&ksj2R+f~(H&yHo$)#`Y1@AHT8^YIO)2XvI^fFZA@snp0#MF$~`2^ zpADWvZ3G|KA%DwR5ZKkhlFeWU`2MX7;Kyvf)++3H4cIS2|MWfXmZEtv<;?fky2);f zqklEWV0ArS%S}9u!LRZW{f^v8fZaG?soZo&v2>x>zLnDE9@evj1A@FW za@!ol|B3&%ibkQGBarS7MHM`$tG;+vu6-b%fj=vv=-%es9o7>!-M?EJ2$`#qgBzOX z&>7Idcz0Rb>Bk7`7M^OAmUZ!~QJx|4%m-`doPgY9IG;-QJBc~L)jMcNACZca!^W^5 zK4tq`{NcA%QLOo*c3ScqNRQ{24Dyce_kb_(oiP%@|Mp|@-@%nxI5_|Bmd(|VgqpMk zsq2I09)fykH{%z!3xht)tc>dpEJ1lalS>`^{7{b_6DDckWN}4@i3K39=*O8*(Q+VFPhMm zksjTk_N{8{ey=7Wx_8U{Kdk|fHzxh$So}3yu5G$S33sWhYkIt2wUcK?m;9k-Z2^G3 zIySbQzaG;A2O@DJ@3(2U8uN|sXNZtQ<%&q<~Q@wxZ?&S`|ZfJ;U<@kE}@!xb`S$N_*^Wp`H}+lqDc zE5uy0v@vTAPbZVyiHZkpsAGH3;5m`u8M!5kPB9bxqp(kFs^=#19=3+?E=|l`J zaBv6)nlpW@Fq@XWcNXUvT_4di{y98%BdxTGW11k!?CQTFrWu;7Lcu2D5m8RoOw>N( zK1CaV&r1^y{(6>)Yes1KGmB5QTSqR_|DxIQ#p9tFHN7UOW7x$ZiIN(F{)43JWo^&bl^u zy-S~9UbvWxN^5=Jn;}l6)!s=`Q7iF)8)9lW#@-sa#Gc*Y;vdjX>zr9&?~CFD{$9~Z z{K$nvdBPBMv-U$TOd*xYOH~bTy?XBi`9W1muI`F0(JMLtBbMIYKs!2q6L@$tDtd(} zGWY3rJd<%XzMC4MilN50KkegbMrT_ElGyXJc(5Q9#aDsfps3l@@(CcA)5kc0VT?@y zlS_*E0bdkE6xn!$vS?HTjKy5g;Y0P}r1FV&T40JO(eYF5k6c&P8pEaI?3Hi@FB$qSyG>8_74=aZ%(05sBo-2GfGG;qob;k>Y^?T*}`8z3h}KH zFN~0v6UN8+*YnhyWZkDo6ELYBvNzj}6E;V&2C>o*LmCEb28=&$MHytv z%(Cvl4lD6(a^z4R)~C1xuCXk#sB5W^~=!_6BGrw?h{8N1Uv}ei2@K z>E*7u?XP>skmQ#St9kP|C6~ByM3o*R>H)^ylm0u4=X*YIpTf3D4T<9o?%(gy$WF?E zAHwq~u;Txs$%uA zihps3CmmBb!tk=btxr+NT*Yt%!@Px>_lM0{WKEZ)2mjzYk8M#9?EBBoI)#}oKynCh}UaeguAY^jeg*Qo1dIUOFw(3 zgWGGwjq3L>7;zR!%sWK5$%IN2MU|I9{7cthF{ddUuXQ4W8wRtMLCxno=t6sAgwJt+ z$vs1>xvxKkf}tgu|B|fa{r;rX#$IL8<-QM9e_=XETfJo0$sCrC%wzQ#^*pNN@K*G}Z@u#KX@*9^$Rjo}+`A2gpBN-DEp=eE! z$x2g>`AK88td#ZhN0_ElyHT&{A+O}&=p?dA^xIG zA0H@XmxLL}`h=q63e?~|gqR^3g?jDG1`Q}<&m#AIa=L7>r?%0a@cPaO4B?Z)e~0c7 z;+^!t%0eyu4$^VRnzonkBh*4OvJAEkm)@A3#eVx0uibPX&!5nJH2n=szyo7Dap}@j zw3Y>5_31K=^$}9NuETy03^DAD$ncx_`l>orvH)~%=G`wf7AbO z%er{38wiX5#29?kCZQXQQ@L%t%^03JwG;3|6QkT{`a~-Ng$)SVpx1&KIwBE0&jn;J zlJ4bZ1mpzB5tmrJf$4t!TH$wn;Rj>_Ugu;aBS;f7x~mo>I1P-`lF-L5&Ni;>%q-|r z*Qi@-bTc}#bpXl@3HCiB_mU?kOUL975;)mChr<@KuY28#Bbz^^Z9W<=dLJKvPu~iR z%M2*hdFHO;ZKZ=c_l6LtYkL#t&D&U()x-RiW=9pdTVMxGBZeZ&_v1ikNTT*i>+(nW z1=kHmXQ_WkkMGBWFbhQ-#_K6UoM6Zp$E z$+gS(E(e)#MxytYuRT%SJ{rdy7Gx}8$3;nKRK;Uf>fsr^Vu|$&b}trNjx2B?P(_@C zgTNmJXBg4Z&y!<&FcxVA?SHAY^&33i2A`_rmqPiw6X(W$<+zB1^5 z0Vs3E9}TwHdx7&R@rTNYci-5HX6i4Wf-17HY;MSb07>_tv{VL?sE1Pm!qAX=3<#5F2Pkecr6pE|B-(9oyPjJgr1}wd9SX(>~@GQLy z>4D~QOu3)Fo8RB9U;Lu`jOSaOi`@3S#q>A+!$+8Ws79k*2Bc$6`CtIM$@d_MqWBV9 z2xTRdnG@PsQU4>zDl|riaDP{p5T1(&o@&Ud`TTihu=Hdi?;fU9w^1TZxfkEj3tBqu z%pIezc_K90aT7?Xz!n&gizgFoanghgoK#7Ne06p_S! zj{&87Yl$3n#R04XxzJHbCMoJCo=ARx@(evXn&0Kc`PXy|EL2ccgoHG0NX%lEcE$wH z78r1M>f-Sy1gA?5rlmo#(3FVF!-Eg*6xmVo;0J$j^hsKQK({E#ia?;RM4;)8~KwawsXUZrRIS(tQbUayYJS?ej&RN`f{|XnB1z zn8947hYAnTbsB@)6Kd)QNB6tO-s`5W;0f|UaYgZtwWx};$gx$@Df3!nBS{Z&Dj)Vw zx6DgWGiTOUm1DvfPV-8qmuFN3P#wYLeyB~b={f>QYT!9#mb1VFU$3``Gr-LmG-ulW zT~By%=4GPq6Zk^@p(p%}OmE!Zdq8g=P8&@?gfBYInq{+X)$6NC=xwRZ3_6@oIcx5Q zo2zh|TY;qIHXEGpFUyDyT8o}lh;?7=ufz38k0`U*vC=n3bNM4%&xW?tibuUkjAQ;| zi4lt&@V?lTPAYkI-2NmQXu9jCgphhxb-xPRgP9r%d}B&8!@Pd)z)q{x*W-(KlwBNe z%x=8WTnPLOJ>X8v5FpCwDNTbKszA}NUAu-nK$2xUapH9qVb#TMVVqL)9eUppYeWUw zoT3OD_5y)ou+iUDlESy5cUim;n)9>Vs1Rxuu~#h56Az!iP%G2oX1`$cVo4<=TdFO* zJ&XW$*xnjs9$F}F$tZKO2=CP@=!3EKJ=HNMitR`I>IWq3enXUf<|8WKM(#9QY;>B|Kwh$imv;+=ds%_~`{$=-zY0b8`Fvp+1*S(+{x z%X4Nb?7(NzHtTBHlrg0r()#R(dwQlKWsf6DFYJRu_qlht7Ed?dX_cJBLgg^}M@P8a z_0nuzRwC0lOAqOG-FyWw4}h~@1ej>D#IIl1h2vi8*56aTeK25_cAInP!l2DlgbaA` z^)^>jVW=Lxtdh5A?d+Fm-b+uEA7>n;@;RaC8G0U|h`&m2p}0L}+*U2% zSKpGqEKK^mKxSpqRi>C#Seo$e(fV5rnC9+ny4ya-ed?PCJWYLzkEZohxV?a)>{j`; z2;3|XxB|RUZ3JVj6`+s$Z+#^cZS=mE8>Gd4p$x>KJJO$&A)BOkHbzdQ7iXAg!t&^u zUHyD-L3&)iT&Jqp$)c|Pp{C8O;+SINk9Ys_Mm165%AH)IJx{dJSogeYgfdSz9rKAY zU$VY*#Xf9bR)DI-vXV$3Rr*w8oyjx1&k)192m`fEmbA+*Ec{C$Hct1c8;tN6MiXww zk3{%=Wn_!#u5+SmtTTMXrTB-WL6P=}cNh*r)DSIuR#z#R1H#y6;yi>$Z>#!4CR{Bw z5s+}Q(`fuO`FfW<+QHDG)L=XnNGD=HuKsHuH z4Al4O#1f@-pOK)8?lsz(JeHP;z1l3KquKD1SPyV&Av81w5FdfQEK(=?iA#~5YVi;+ zfTUl+ZYjtw$e9FT&!cIw=Sx;V77SmPg-eQOaxtDEF-Gqu?9^7f2PYh*-uLItPsKyi z6(d#9?`PJWVNC3iVdoiV{aq%Ws4HY5+7&O9d#XfG?Potq-J9K)r~s;ySS1g3@3zp& zHeFK0*>q$fMDYfww&7ZtB2O6I_Zii7_2JmtQW!>ZFCMmueO~VpNMK ztK4}qfRocTMuax%a%$kxwFL&#F!ZrogcU=ynAy}YAFdw^!np#606h` zUQVXk?nAcO&847UHk>g{cO|EEc7Xjp9Cy1L72S2;&OJ3k7n(a!f2pm?f7YYNGGd@x ziihB3$^~uRP6_lLJMDSNS$YV%oKL=7V1R8E(oVo~ZXY+T9-y`6koN~Ia5(WB0`hAR zDX?J=7MuT`Ft&2fg$260d@)O|j}nQFA0ftLZ7S}g2bTkk&cEj~7Gk{u!k53c?cZmp zFX+f#h0y<&+y5&JFf$wH|16YfkHye*#Bcpa_>nZ_0R-K~ppSE!J?FM^D^#4%{)Mjl z_9DYXJW7~|&2-^8=Pnl~xjz|(LJ`tg>YH^aQS|R{tRm6P0qV~Ai^S({fw;h4D?WjF-&@Y<-_dolcmrGIjB1&AK(Le=1Zf7QJ{;>Xm)I z88{|B{kVUAvb#g{>%bQ@fzyYT=a!m9x1?TbPxtPM+IbE{!XkS~s!T2#yp^ibvR}5X z%e2>bQBR)7*)!Z0K9`%+O><=zt>|8Eb*9<_*#JJl?YDgG%m>(xQAEfpHom-(%FJw}Q9{W>tt(y*F;fBmaU`h0H1YOO`V zoF=EX4rAzFJUZa0seFp;%1x4RuDPKImi!v+*2%{`Gg?r$U4EM({mIy)yKvDenae}% zje6YCAay|4tTrnW!36Zw-JeNG3L9;xwp))txoBc`27Gh~gQhKXI(thswf_rE91L=~ zO55Y?c`O=hJfeV}h?p4WUl;Dj_oz*;JZcu)`W1Q*c1I`d~i;^orB}gTs+!h-Y;{|P&<~I;ZhZVZe zQI(dOcau2VR)KY~5|Wbe97{)tr#FoLg7@Ri4E09M&4IBsO2}kdU0%zQJEJwu6DvS= z0%EgPCeP(oE4DuR5KLiyC<2AMLZ@~)1jkOKtTp`krb)x0-;>Q}%oBR&)iqEtw?{lM zG#&VQo@)j;Fm?n7{D8KTnr5^A+h)+_iZa^pm6`I_5I|392xtT}t-*lP6!xAw zM7Ie7lk?oiDD;Y<5J%Rj*hKw{i0d23DMqTAw0lIGhPp*!v}%H;I=Ts72mnHntOoN$ zjQ&Cu7=zJA5QmbJsE6PGoE%D83*}}Y{v@;?8!^a6U3zoee?WS`-}hh;mVB6eaS?p6 z5pH9$^&r*TxC|J4L0M%s^m!)Or8FsPhH6IV)CxkOl|1wdo?M&lJ6CoR@p~l(A7m|y z0rV@qfDT;TsyU{1F&+SoUOUkm+q5%(!gi6tWMonZ%7J3hLb1quOX<6Z6-lQcdczkI z?8(8Vao9ebPUA_|xD31`-qRtMA|#t4L`S(?Qa~C2f+vZ3snieSdv~ZIst&Mc3N=1q zUZsHb)ql^sDgGqBBSgUo$v-vfz%Oae_3q|4cbf|nUDm_BZas6)u8UufvO~QJF5h?U ziLBo4Wvm_^f~;6CsJ0k~{jW%Grim$CwnpIMv~K<>jB>f|_Nt4uThu1p^R~}5t7LxT z+cyQa6P7`^Us#8v5Lt_qu6r099XIG2H)x^`D|%wR=n&iPlhe>E@*ak`-P|dwzK9ZE z93_A~zB)0#j*6&K#(vqjSE>kPI#KcP!-bal<$y;r1g=-|GO6WJ+&THxJ1{D&mohW9 zvO*?_K^+y&73Ewl$IZP5Y3;=@I@S?yT&i~wVU{Suh+08fYB^!rWvQ>jRS>-&I|K3M zR+8tbO(xhLj>&_G>Atcktzt)7wq>6h7&D!gyTwkJEC-TwQz5ImhL6)MNmWWQTmZHO zb8oivbT((>j`d3|qmv`9-3*~NbM+;4iv3~VqE#3nh%4gvL)J4n=%mZr{uyOPD!q^6= z7qK5Qx^jVFy$$!z*|ed}$$=|Mo194SGsWw|u$6V&=QDi^j+IAqxPUX%7d4jv%#n4^iA6m}U^&*hU74TC<$Spp(-oYLPk{FlkXm~NTI3)?Dp7DpIX zYaP(BlAnFl#rCf-?dCXI+Z*aDCG0ekaD~2|D%BV%278Sz;higlzKMB;?|96-{1t0Z ztw|DJB>o$Edj>!4A8igoR*GuBgar)mWZ>jzACVsc_FsCM9)(3i=$&_9 znGv7`a+mij9`L{&gyUbz#)y2F)HqWuqj(4O!Am5)MIk#5H#N(GEX$JyIydL9b4qO| zD5X(^quL(nB#OM|0H}5`9E<(gwii0f4bVxBig(2e8YFjX@O<8A1Q}ZOD6b|%Y;8Z_ zUQe;(e9eGy{OMt=n}f%?XZMcdmEmYL;nu|+Ub3T+Xh0sdR;8qH4T0A8r_L+yoIm}m`S?NPmybGvTW5&@{3z^cwL;|y$NhF|k=cR#SC#ch z{+-ITNzZ8e@CDJW=L#~?)9R$~kpbRYFG`FrnJHy+aa(EX58fCvdW&@KD0`$8x^XACcA)) zJ9uf}psFLU1S&VpECA@MX@f!x6m~B70}RULu_qS9)-klPnm#=!49$y3q2RheNS{U{ zFBgTWD!{ixG;WVes&8GCPnx%VWMc3E?DGDfFv%(@cpP>zC!$vpTyvrfaA}`6`ctGl zgN29lVF*i}kxCKRhcS!lopAIU!x2QkzN-zQ-4N|}MY%i3EtsiDVx4J+l*gcMB~}o9 z*eF=sWl{W|2|zh=A#&Jee@P&hu-CdDKO3ZL7m_@|QO!%y@h}oQt>vXgIv%e;&(Y5g z@LgnE-GeV?d{se6o&0S4WO0%6piE+~Xh7wqYp~Y42#^p_W8>ox>&z%zs3tN()Lh&H zb%u0+1zN((H4;cOrAzW%R5au1{?uAknTf^6a7)#(Ot2G&K|lmrmMN8hiW-oe@Xzmo z(2>pDk=QPq0P}Cqs0mkMDCI4`BrG7 zHZjLaHZ7*ZrN&mD4HK*v!fak3$!@X$B%THJe9)%RmPV0>XlUN8aDd{fEKk*5_ezoj z;12T-a-o#z7&;_2A@Yl<&U7Wpqc!;t>m*V#6%NLlL3arGRL-dW{F+s7Zj3(T z46?cROihC8H-E$UH|@6lz%4TfSIwZ_JPKyVNw6d0o?`ppM=fb`?NHfH5)vPSl?$wm z9Joe4EsO3}={YK)hBz@%7v@u4mapB4_oSTjz%H706D>Eb;^_~KE?&0Sr()W6b~GqS;d7`tCisHTHhL_^huWxELFT?!#%bE zJ}~ob$0{d+>0%>)$TVzo;x4>Iq1NOMN@3@~o}!yV1XB&oFyL;@ zwM0;>aAMsu$bBDUJgx6G)#}O7Wld|C;Ut3NC!uv;?8mQrpc5@_BI{dxu!{d+qq?B^ zuf4xVdgBL`P5&*l{;!liOzi*vv#CdWD)y=KKif5rKn^ZxpdcD3=FrY+&wHpk$A)f8 zP3%>@z9hQDld6mort&aAWUaS_yoq=h9N)h4;3>b)1eroG7MV*2uUfqiYu_Jlx1VKt zVgEW1c+HuKlArfhJlHLH)sf&fq&U+DYd?8pCUj{{OCOzJCg^UjCsn*wDRomYZPFjT zor=fa%&W;{CH9=*lOLiU}qiL=b4=h-&bpUaI>c;QLJ>d zHQ9Vu&XrZFVwH4Kf4A>FSLEO3`fzWN_5ApxS!e#<@BOpXDt^4#fuj!|n@RQkI=zn_ z+|gaPt|~zt#E&tTFfXMWNXDkxo}iXpfT=fqUwJn-jgYL_4Cw#ZHvrwJ6`R%C{Pipe zk!c5>5`0s!KxJiod>phj=2)aQP}$56a>Z+HVy*YAZdW{T=N%-kQ}ImYl5LT8kZIX% ziJ%Neuz8VuTDfv${is-sQapvLp}cy0v#Kbb&g4t`X1G_sQhWxBNhbVL%j&0X5$G9` z2qpFT$aGS-Jr6Tj@E995@gAI&9K}Detw@_7wfCfQ5YFHK2w=|*l~okRjLR_l#c|^0 z!K$s0l91x6wys`cijk$e)Qu^W1xgLgGsNQ5%6k;C7V@d0*j{kd-VY^=kWL4ho;5m;ucQl901FU^AInY}$~i0@-G8pP7>i#ViN9G2GkID=*_xeg~Kkj|(nfZi6~J=KdMON>&@vj`+)L6dv|_!@g^Vy@(%Gx7z1 zt_F=N+KN~%F|{g(wwTQnM^hSvNQYL_l8#haOb53Ao9nZlEn-~wsBVdas6}uCjZKF; z0+G3(4ntc5q=8Y)B=Dy6z&XT~@O+GAs4eThr~v{}w`0M|wTl~)*Y661X9&N|Vqj(? z8aLhcg=z~9zO}?cSx~1=eaYYvMG6`qC@1(r30Q3dU zVUj~~ZH^4M*@5U*@T5_+srB==l+j0LV}|MtUF$inMvC*_I=$Qd!%RTQo_x-ze0UX{ z>6Ih@+K-Qw-jcQEg`~Gr;E~l8Z?PtgtKNc*`d6kI(VM>FjrNXszYV6BgW`sUeK|2A zid9r=VOsFCDC;3=?k~f!>;d-(Wv)4BQHu`H6dQ_jg&d1N>iP$0F{LH#_rug#CTNvB zS(GfRP#W4b-eZrBV@%l-{4t!&{f-d_3zJxAeCzf5K)AxKa746Os8K!xhs=P!7-6Ad znPkXA(4pY7(J=9hepMCG{2@IGi99p&FtK5x5o|6nA_k;j=gK((bU&R`n$HTTV)E)I zDkaRwM0P?--&*4M;eoEXGhF~Atk@*1@SNStfLWy)?dVNPhWgFt9MZBOF|E|Es%N9+ zbp*14w0}&g(h<%Nm`B#IjUG)FEzbIfkikY8A1s>hI+cJ!;N|Nc0qF?es>*8+YwExf zzHpXfEgMOF0yi5?(eMR1102B=X0gWM;->L?7q4mW-(vgXG&}UIZ-sosR z+eITQV5gCI{G+BQ(6SHgF!!=o&syJ9En&1T)DljLY>xvh!Blyjy-Udh?{65K_;l9s z$<}ns-9l=8Y1Ot)0Ybg7XCoB1uBl1Q9{al z!IpD6bp{I!ac!Y8#@7;8?TJr@85j@2R`plRO|0AE`k~U{Mx5o_bp}$|0Num1Qv+}_ zS2XxMHe3Dbyb2GA##K9XWjsWFV-}Hw!Ledt!4j(L7K1CJoRjaQyK43){ihca%;D-< z^#xCuh^aOV-__l5u^IAso3I2=lUZLyd$zF#+08^vVz0h{y;N^kSfj2?f18Y)%E~vS zaoF^4Gz%hGNeN4X5XUdd$$ELe$=WVF5jUMCVVnas8+Qo0HAI!S5nJB@2J^OnY?2Xh zfdg|rX;02C6g)wCv8mj;hn3v6rQR78nX1EPuQj&{Z&o4b_3R#=cQkBK-Z)uhprE z5=E8Q4v=u6A%1sOA{!SB()-gNe?|;Jh>=fs%LgKiu}RC~O*fR|iIAbtuZtR> zVD#UoDJwJ4ARL3m=RdM053sT`U_n9Qg|IpSts=}(9Zry}r?lXzp`v-4*CR0TS1%E2 z?VA!#V;^J*tN}hyQg6Kil;#ql%i!M1EDQ(TgcQjoh5^8u&2bQTSMwwEQCeZko217I z;A_)sS}lS@8zlPK`nGliMN&zzPh{idR+J%LLF3}zRii#itN7qFd8o4(<6&t%n&j1J zg-sdLIsp$Mk`DyorwONHJmIC1yD2^tUx>}bQq*6-unV0wWKJdHV*c{zISb&6;ADB8 z?prtRhhv&dCC^X^*jYbg4x?#i5c=jxlRLLCj1!-fkl|W0dKW}<#{)*IDsw*a01g5};rGMo7FgX;bCl~wzu^UOVh41&-vxflUXHl8iwN-t%m1eoY zyx3QQ2eoump_X*Q5wdBFDM4cT2hrjzcl|*{iePkCaKgL6Pg65Z&vqx+D&PReKNWXG z5C_|`x@q>hnA53%PNQv81=F}1W&{~nhIho4>AIRx3C)_}gI7&3&0`weoI&+m%7b~8 zc!tl_9bE>)g-(f%vWyhqdoI*1o0N70hl|}IY57+$A_pr3s7*YsxZArQXgA?!h18H) zlv=N3qR4Q19%$A;gSFYM-`|B){u>nX{Y7azu%_9D!bNK-jt<$CYQewlyH-Qkg9^%^F}yUJ*1rv4khW zZXq~B!|*vD{Mk7rr1TEmLZK zE94g^jnZT>R8cA+2+bfqmU}UW>~ncYV}DS|=^QqaC9`$ks7C^UxRNU0J|xyR_FT$z zoRHJ?L9)KHL{kDS6{c7nEEKew%p=<1Ju$RV!js@r!Aqwo4jDN~`drAy%IjgydZi5J zpj{4uzoAuQmUo{*-u(BCJzMR0PK7DD>$!=?s`nyI({vdG#=gQ%Q0IdH7o<+~NGO^> zUVVyfjqE`uerQx+EgZ`lkG8o$nbX|(V-Oy2ipE)kuVYBI@^Yk*OcQ40B~86%Wx%qb?$r1|-;*9zKV_x}zwBApHau+w;4YV%TvkLyeVA8Zf^Xw$uZgK1 zE&O?gA$dt1(@epQO9Y2V3ve%?0rYuIGDXdn^fqIjInwpULC+s&>xAvGGJ z$gCfJCgmu*chY{268aExm7L&>j!X$Hc|Qd7%TI-Z^i;8jyX8K+Wd!ZLJHCU2%z|~G zHhSU68XcpBOtv({9oa&{M@A2!7-S{OvEenB-Al$m7ms1t1_3@vuiwusw|FZ<4C67w zk8*I>rcp_3UA=>=nwIr#N|8Znw+R|}1?xG;(>PZj7E4mlb6d+OO(_V^n+|&usYU)OnnLyBZ0d0$j&4Xzn|&Eyo6hnF=>#;F$1nq* zr%y?f=N^;co?xMV<3H91$?48Ausb|BZ_*uApJNWlsFS^m%uaMG$@?PT(%ODwl>lQ# z$&wR^(T`Yv+bUE_iW8DVyOOm4X8@uYhu~gCGj1ZPobPC8n-{7}I};_*ZwUDIkqZQm z`0)Cj5Pe#K4UGua5xL8p)-;qCdX8-pn59!CDb6-|GVRZ7J+7++Y@n^8wGfT5s|55{ zySI=tTUnAa0#6D1{h#u*ToEK4@JrsvI{{*a)kS+Td!jZ6`7egKWttiP0FUg9d1R#; z#NQwU!Wo=lZ)mq#mhGLMQ`TLU#i>QKE~vWCE#ilw>5(WP#q2b0pgt%+~oXc<>1-99mlmIXUga^$rzx}@Ta49IWRMhp_< z`RD+;ziT79nb~UpzLD~U^Gnz2plNAr2TjQ1KYbJIqDgORQ@_ayb}_#iqpzQDeBbbo zds2@7B|9_yuRu*^de;B%;rpNLeASNle+>ev@1+nJx*+KwI zdH#*$(N#FKgMAz5>@&9L9a{BBI!*ZKe13-N(Uo}p5l`(U=(X-vWv}kYb8T*b?Q0rGC#eq!}H_A#7UdGYHx3M ze5D);QH?RBw6pT2x%W-$xTE8Pd#mXF_04onzq#mZmh(k=c(Nlq+BPV^3rm*Qrxu{Q~A28z`(5{p>awEP&Nu`VQdO4ah|TB=><&5 ze-i`i{dlZ9+71`8B0M&{Om*o&@JwuE&x%St>BYCU} zTCX+Ds5$n|DhP%ktzQcCtyj5Sq;0XV+0Uzt>{1?gI5)w$W|mM7lD4tzaP1Jppz_(R zPvi|6$3T5Z%%BiMmV1sb^t&o5MApZ|bH-jh`9c~TTI*z&bYBtwvytOH?3CL1AcB+% zT3=mwB0r!j*8pV3=Fk{Ke*hUhVjt4s>(dkZW{6P7G$(e4Lg_9)@$1$LY!27&3E>b( z)DqThXjrmAA|8fBb>YeTux?cfb;l+}-N9$a&NX_k^2+fTjPdwpN?^g{qtRvzgHJn+ z@w#Pl!If&J3!+vbK;ty|ljn%g@ogdLVL`1QRW3G(WH12bK3Eq6v&Vy^#SQ^cYYZ}{ zqiel4;}lSbZr`-+>Kg=Bu<}H7hP*>JAK^+hou-geT!O&e~KLu47wKxQGvR+$xEOpUL zTkt*cFm={;(4{OOo@Ih+0V_xaDo}kMtl4H`C7k%?Ms^Ue96|vuVX+NDl-Mx)U0e#p zI2*-jZ6Qhrmg*ct(?6oagJbnWhGB=|99Z%R5wp+BQH)=>X}P|I5Dq^(AZAuz3ud+4 zT!2~drDX!sZ2{B_P>0y|#nW3*B*D%7` zM5<9MOYKNrD19CVRCny&cmhc?+r`$y31(ih9$Ixg$wy_ofU;hAx!TgCs|{SUV*#U$ z0~yZeDJ75zD7?LU(RJBh_YSl1{7~`xPkYDMgjRFs2oa=9*(A>$3B5`hYU>@2y$YkW zVmo|)%f&_j6#_YqTT1v2FrkRiH}g|*&JUPBBNhhekotmcn&6xTe7-?$wjU^;&d6LD zwhbO7f=XKqq#OXd7rp%Ra{QB?64XeU*scPjXbhJ=)+#(; zV!jthytQ&unu+s)hMnP4VPz29sfTaC-~d5oL$26mw&rffl6???x#o+v-3R(6=Nfk9T_{HES6Z}=` zkJwEa8CKV#5bKD}i%nj?XYO)fmBD?YYl^)M_p;VI@``U{)&t;QW*+3f=1TX&$eP9F z>aJVFq#yut%U}%+TBUdrt$tv{G4f(!#E_=&Tz@Z-VMej^qsgvv&CQw0K|fweSeY5I zv^P`^l40LqX$<3IZ(9gC$d4h7*Tbatp795rl^}7AVTz4DDE`}8|knN@{T}3f2S4b@LPjuf}4RX;4 zV%D@?GHnf&wwbMsEy_1^EOQRoBmcA#v8gBMnuvr2+;vS>G|iQv>(ga|TE$DWV-wmn z5PEWqAhIe04zz5JNf=@gZwP{XcasxQo1DkD!L`do;z59gXQs~p$uAF4p|I9&ct6`@ zM6>FFmb$hW;ND+L(_ZAJJ;Ei$Th1WfX_1SQ28kh|okD^6`I4TO@yEbR0*?Mp^{fYbbID&qJuXj4|ySR zg>e}nrF2=Zv z$BJ-vv0xO)RUTOcLlbE`S|(S6g-x|*71$O#iKL#JTLAb+1Ykp`MIR{RfZV{Q9DnFr z^rxm`GzT(dd}G6KC;ol1T0NT75lv}*d|fvTRCsFg-k2+km~IMOWG zwN^#SzjIwHtpi*~3OU6i1cc?VE^il%{Gj3ul{@?2sqhGaT%p%JRMxltP%Pq(=7Lc~ zY`SQSZP9N7{JF{D76eD*MV3@ZN%0b@Ly!D=G4Hu)CGGgOYwt5TsfM-^ZG<_nMEuYb z`c7(htbU;b&d7_vz+iSV4n9D42pOkQy+wxjphooE3`5FZ7lo2|%`7RSKuH!90w_9W zYf0HHc8=Xv;*rP~Z|BgN1XUwSDd%G0)jz=M^^<8pF(H`bONg~dnwp>U;CeTU4}J*| zg~dLwm;W^I-SI(-Bzuw(?6ubqg5H0A0o6o5t?|i!L)x_aT}Cb<(0FW+1urpLB-ft2 z(57^UOw={k>s8%X-(D$QK=|~;Ans4kh~Wd`1YgIPA=_MVmt%MgnY>s;=35keRv;|L zMZM9icrN3grFsQ91)sOxUMtTP@MeMq!t+XNJM7aAk=FBTbT612UPw^V_)|HLD%*(w zlfO8s*~NVCPbLByw2JYFWP3oS8a zxjZp$yq&WX8w&C;c9m|vfF_P5AaM{=t(NRZ*OzQ^Env1s7)PAO!Wop6^K{2q7PdP$GwcYLcZg^X&5u4h^Ie%rtm9>h|KyuCs$u=sWB)uwTG!u+v@N z9YQ*~VUs6e8EDV_-Kw75ZLuG*-|}GvvFP9SC(^7li^KWmG;&+L4yQLP-@?2WGiX=E0|bJp{5xa-c-)J`VCcK@_? z^PgZ(?Dta2&V0u3_5Kqu?*d_ImmW44wOlVCsOypCap38~T&-B_CnH-b>x>XKg?0I9 zc*%bTIJPUF5X_dFDETBErU0XL?Eth!pQ*%3I`zJCy=csmv+AKLoY|YKqj=^vWoI*= zWS=K2o|(I#{%;y~L5y)0N%74qita1}^}FoZHZq@?VFWhaAI)R=Pwjo0r|)U|y|g8R z#NC*xPXH4DMMN@KD5aX~cmX4K=&*Wn2CEkJV!@JZWf~}vndmnGEsl5!A3diLB zYBbJ}AA)mkj!Ev6YGLf-$fK%1O%#Fm)&xXle>@8#e5V-jw_(t>#Fc=nc8z7nK`r7QTA%B@i@J~J9X-0xReYjnOCwf z6t3i?n`BnAvL|}ZI*K3o0`GesHgYi~c?E~oYUWM}sP=*oDALc!&Ng|o@DeO`5Sy%^ z9WyG|uw0R(Y;JvYYWBgZ_kLv-aN-PybgsFE8xu$vM}$czzYVd>4};jpZt#b`HzWZI zhEwSpTZ9p*gB)deTSkP#4s;eFV70#;;C2kMZyXF4Z|}WE7j=gQa7lMAkOqc#wB2gH zZTBW5C~`*NxUJN<1HH?Dqg!}}?}vLn*DTxW3>28MW_2gbS&Fdff8PZE{z4bxIsWDe z9vTm$jO6?@A$(eX{|bJ->HR)~zuo6u{8C4W>&Q!4^O&^Fo=e2juJ>SM>nBt9rICsJ?DBC2{o_ru^Tgly z9CKl^WF|6{*#!8fe5q#EV=nI*GE1oK-w*t9o2ExAA4go_dBx?)QkJpSVdPEa;9sND zGY$v#_xqtOXu;yETQ*CI%WRG@_p(++^5i5}SIzr3asF+N4>woIAqR@iY1ne$w717e+lEz9krXA!pOakh7& z(`-~d77_+L=1eoz9O;Q-Z|E`>f@sLZipR7#x>`1_6*B08`q&!#)wu)MGp-LOMucX< zW9zS7x8&>4>eO8n|4HrRsdiZXv}W~rKF14xu{g%kv)HKYk0ypJVrx9NdBWS)#8{#v zUB^W&U0(Nun5&l$>#OTzm!UP)G&sxt07@!52kRSj`snL=T@bbsldUiGX$^fe`2sh! zKpznj!N|dwGrC|I6c&Eu{AGB3sDpXpS5J^(w=XeFqu!QvbS1sl;vrcsLiM8m6n`y^ zu_cT>f_G>b6WJf(;LsaeU~9>`^e=<3V3~@HLM^(a_ zTPpMX@%HHZ%>0*qG!Sg^uwbLvc~9}Q$RWY3hshniuh zn@;kTsbj1jDM1I-RA|I^6du9kz=pz{)y2y~sTUzyIkkRLK zv6e%v7P~~ov9Qg1qf3x~*~@&v?QO)}4pXihlxox9 zznBGBS!fN`MWPBlcwmQIWzLZC7j0pf^)5m#yP?(>MlM_tW3Fj!yV*f0_~`DzG@p;8 zPq7*YSv(Q>B?HNwu<{5 zqC)ebdjgszs*u~XYFz_PA1!Q-a|RZL{aBouqVg^xPl7xhvm~{4plbGVBlVsBNdfRag&uJ zAq!YJ?=dbkxzQ;Cj44N=U_MSU83LBv=V5f(WkeAU-VaP-EgTfcQHbAz2Jw!^?OdYk zmbyp=7Uklu6iwp0fQX@Y5xsqI2kh9#BAF2FITYD?A@XV0BIMO_qgb@NXL;m0Ma_iLc+8q`<9iY14 zZ`+FGL2T0SM$(uVew8}U+_;bX-x6e#yoO5RPZ?7t=zk>oLV2`H(la6kBi{!?QdnJT zx-O*Bb1OP4SHlkg@yx}ujpKh~xp-6jwgcC|KoD;)X?Z#E8mBZh3kNMww<<3wx&#vN zbXeVNR3$;Dn^3=)yBvKXB}{JDu65)}Hz>5X#w4F`GpqYT_^90V$K(9TI%3+F^&<<# zEq#|N0KI$itoo*k=p&OYG#IR5{E>7z5sKK^&{w~5WZO3Lbf{~?aIlAmQrnEwqZHG} z*4()~v5-I}L@fR!-cANnH%@IE1q;&>vn;Bm44N|q zz~-lDJ^lgnmyDLLc|07|Yilq(FP#a z70mooR04xMI#7oIy+#Hmf`RaMmJc~CY28NbGmkppN~n(pm4g!b;CtZzrvWOE;Eh6+ zA}o>9c&gz2#~mJ%_-@QS7dXzQEnK;jWpx53@xdBj{{3G zx61~H81wvi+|3jhR1Z&IEfBzLI~TwS6zu-zE@YRHg&Wf_+pTe_zMxw5T7m4BN|Wue zwQ|FEHkaEWaXCR8oZMFB;k7{1&_iXWyS?R+ayq}XOc)zKb-lQjQ`6R`WH?DE(=`)U znWc9xl^+@Xg3sZnD;GaVI@dW(bRsl~kZQ0e2ToP-uP|r2>38e5yM2_hE8%S8T+2&^ zV~D}FN98uPYOC_c?-^Kcnp{~%uT|4iD~+x60)M@xG~3S%N|!{nm30sWN7goN<$x

4%3@t>>h${UN4=#6wB5D7QTG)-BQTxo6(r3*0ix+= zAdUI3D;c*860$LnD^_25&4YTP(TG{M49-!}>Vt`S{v|9;*{c!_d*S_eJd44L0XqPe zWD6q`VAT z0h%+iMXzL9epX~W&Jr_k8A!b&UEi%U!>2H6tn`jLzk+HY;6W?TW<(_-Zl?+fcJRJQ zP7C)L!|ULnd?1x_v=*&E(^V<^T2NTXUIALq-ye1JK zl@&94%2$JHkAHY1QP5zBNHI#<$LKEhPDViAvb~Z|uY3pnFBQEsjPU8Q%9} zA%-bM0)h#%(Cl1KsH_DVh06$ons{SHw)3)zuzu6Tk@F#1Z7Ki-z@g@KlzIaRDXgut z!I>x^_iK9gB(SG1v2KaTw49-OJs%lL*@PKKO_TGaLBk}) zep>EI|D+l^hdO!ai2hr&!Q5f!p&s~4tm|hqu&U*~1cf+m`3L%<*`hyP^-HAW&$mhG zB5O}N*U25U5gdaPlPR#rn*R1dMM^{qw2Q7O`Qvrp#3%ORylYF(sRbM_u4&DuTd*VA z%%4bdE?rFbj))H{f2^stx87^4bchL_SkKnzIc#xcP=^yMd=tfX>_TK8z2c~4(Jr;9 zOcKhfTMkJO$eoQKg>!7_VaeRmUXwHV=wU57e@YK<4Ollqe~H28U%b`Q2_)Whm90ka zI3U_nbY0W@bG&2#ebC7IXZI)7hdQ!G6fgSAK116Xow# z5|gmX(Tld3*y1nvmHDd~FEj*6(7g@08|DeKT9Q4eyRa08;8qzrs^OlX^o)>r0 zZMfs8Aa#;hN-X>Y*^gqGjY$$NJE9yCV)1iBk<=?~F3;TK{k9`T`$C?SPs{q1303(# z(t|TfITE&?+RRJbQ6!n;wRt#7Iu4XqP#gqwn_nEUz>Qg=$^M0U@Di<|=pYIMOUZuoX$5RjGn|W26lo(6VZTGc(}H}CTvJi%*xd0n2$DoE2sgY)xtwbg zY>3d9bY(Iz1zOteAtgFf6@p#_e#2GFu_?&sG#>M-x!#eogY*yzEuN`OJP<~cD-HN$ z$?ME`nB0CwuV*T?bH7bN1cT%`@pbc*qbOIGB1>^KMzXME*l?Y}V1VKZ(k~7x^+}bQ zNJ*w(VNEq8=B-A2-Ih4uc&#zQV%Sx>!pWUNzWh-@vt>v|zwctv;iHn(62`Noj^2Ia zHYiLgDyP#kE203Bc?wYD83c21&DF-xrCpM(_r=GIUZs!X(H&5c>o^2^F%sM zvjX%#?ckMOoHRxIcvV%H-EWt>)jJ&&xLHomYOvc)n;d|_ITCZDTXF>{c^i0-r=x8f z!M8OV&T6A}IR;>Uk6zhs*rB;dQ-y}x)RFB_Jd7{h+HGC-d{B(3C;qDcJvQV_y>H!% zD<#G<4m%&QX`>+=uS>zS`|Q$Vo>p@+sqN!f*$I`#>D+Ri?CS+*fxV)9I~|cLv~Q0L z=L>xjW%=6Rc3a!i>VEZ-jnVtwOQ4~~ph6=#IyiSRv{pjGAbIQhQ6t^*({Oy2q?QQX z@S~~VoB4H^c>gJM;RwGSXI<-dxw zJ?s4x40z89ajrh$Z!bwgGI>g6o5!eE%x&$eq@p%lh1cf~u^iz~5?P(>?g+{7(o5U( z{@umP)$I=*pX|Q@SssZ7VZ@V*G1t#T*M-5nV$EWuGQ2iFA7~%mI?>X%8AuOF=YVYY=dP`Tml21CHo!{@#adpc)@Wd5%(sWt8 zRM@N4rPY93JD1sS-x7X8|J+7EJFGcfC2m@)x~YZtRad7g-V^m>u)A!aU)^~RJg!#n zZ*hLv(Xz)+oQUWY|0zdPtz1f;eEdto?tSBnZ*_cdAHsKid1yF6JU?xZ6Lf?=zcJ%-z!Unz zA+}w-a-$S-D6eqV;H6NoklqF7u;}8$trqk$${k&j0vcN;n1~S%|4Ph+b(afHLF1<@ z?xO%?$2>JE9CHz1XGgaffNkAy>QRn6t~|AzjYdc1W0BXiC=yp*o*+#K`vLZekb|VF zq!i6y`X(y)8MFT&bkQXyBL3llDaG~tH>P{DCzqgB3$jhMYjCuZkzl|^gdSVxA4XG@ z& z2AajRcRSsNGFn7eW#Wdg znb1IxEE+{HPGW47u?VbX0VwbCq${iJ>}cq zJY8dYi-=7+0ZB%SHH$HJC+x0V3peW>3EYs>s>!=|`3vrDsw=j=dXkJbQbq|T9^=L1 zmZ28rMZ=Y6;w6%aK$Q&g!MfION7^8%JU%M#J5__pP|>}$%n^ylMeSYo)ByUuA8 z2~>@{Gf&JMUKLdFrIhuEEXf_K-x^W2js~K!I%n9uZS->yUDlug=q8`#6HyM@NYwEI zIfn+(5$Tv?C=v~MVK^5hrp%BLO1&VgTW?mSuq@i;Ng?kH6diNSIO})eihx>4-oQrT z)|hkH7;d5h!?9kF$n7MP&Ak&q*z{e?XX16cTTUPYv659PIE-@2MyVHE&1m+e;HunX*@u!!z9N5Pa77P7)G$p36EE z`E=b^rR(T2qqEfT?<(wNmusJ9OFQ{Ld3X748RrILink~-Vu*_=FM+k~sHotJL*Ct& zZmmfT|A(=2h!Q1Gwrtt9ZQHhO+qQ4nwr%^Cam%)C+wOYZlkQ$`@TWP?TyZi^>}@QR zVi9W2qRpe_cbidFfbXp`?q3Ah>xLzz5@JAfY7R7R-wZBvOkGIsIM=7z$|KBc@tn3T&S)Pr8T{{nO{;#+&ul<&K6F z?YCY{$rorFV`AqqQM3G+)Zt&UY4%kd%w|F{vx-*AS*O3IH2!hE8s}%l9-|rP78a_! ziYmj2lL72}kal{dY@L){X=TfB8|S+jH=pQcITb}1)|_MjgqOH}Qfq>FE@r4_ODQ2* zqc+b`C_;0%>nz^r38{`zquktcS&bo$c}P@}BckLo4h9400@WXh4SG)_U}9B*DHcFA z%}mkMQTzG2e}7(U`UWZy7Ch7;ONpoNVpw$H> zzz(WcVZe2X(Rs5HUaO}GrpV&Ggr1?7Z#Vzp-9ZTaZ`!XA+hYdZbpUhI_O@bzzLgTh zGj)kEH>b7U<08{}rN4W%K)YNDx&`&z&ox9;P^R=Rl_kiQB`V!0?YR$RjzzvjOS+Dz z3i_ZLfN&_WE~%6Gd^O zQv21Dw0Kh2Gd(hIzw2+a*t+qi5dV;|N0W%Q%n%FHeGTH&p-M{E31&+KPap#$x05!9 zt7nNYS4{Vi%4dv4TTLave=$coI1{QrJd6QwOkTck+!w_46AswI3_hIH8cr-W*Yue3 z*%PXNneKIc8SmVxA~Qm@>a2@%zKdCRNO&(*sD#lL`s|LqPcRZ#WEt#nv;EZmsIMy@ zZPE~(otobI#vrx0jc;zd>x6l$JQ@J`wEbnt-muWQOEbA%$JC0EchXm9<3ukuLzxf1 zTx2iR1X*7II#cjWr}2V=mpcmqE6tT?7q907W~vG<27_J8raMavAX*Ie@GtJ{&+Jk7 zVQiA(hH_K5Idj-kC+FL5DlL<}xt!eZG? zy1;YTawa;QZ7*3Ou#bkh-yniD3>MV;qj>aB84TurCOYQ)9@q`TA*}M>0ZBaOL*0!c zS)F2d{MFpr6XuPg8la6LT#OwUN+?gzgCsy7eyp93bLpf&gknGv0fP=;e4d^KcR)>O ziy9I*&{1$3Hv+C4Z zu)b-Orr)H^59QjIEVF;WB$ZpFsQV4|>atN;JX1Z@b!nkUC<*()Q6+}PR!IHc_yZ8- zoWM;1h|NmKPhjUFP}cP?y*o(XQ9AzwO1ba~{>7M-qymBMC#Bb#0X(J<)Rs`dL3Ivp z!Y851cG7#Ojhdcih6oC!=qSTB+b=Q`5$yQuv#3>zPI!CR0@o-F;{!VS^+I`yixrzr z$ntGDgf?)<>^cupU2>=fx3QYT8epUNfFJ10x04BR0 z%|iIO+IckCNDMW<+KPZ!8qIc%eK4yKpVYH9?P_OW>Bcf%*Y0PUxuvShvcMHJteut zj|pem0Bd@TlhD{?HNN;VV9IEu%#LZr3IiUwhQG|OUX+M-AHz32Rlw*CV#CBWV1kTcn$iB+K_frhgOi&?=#iwf*1 z%TE{`V2TK)3>_Um1q@ZvMvJC0&-4c%$p4Ornyh!aK^2=cr@W2+frsunfy*~FPn18; z16u>KI7qi^OBIMSl>GKcAA8rk3P7kD|kbyM9_^u?iqzU40yF? z7vtLqG>HW_G3I_Ul$F}|OxYuNDp%^}rzb38BM-*yG7v<`Z2Z_p@I5>l`%!sFDw09( z_JV%{5S9qAz&2gRsTy#|pn}+QXq-Wg1lTb$dBFvwTp#Bg4f;Q`eUh_!laY!wBzG$2`TpyTxGp~R<%z!8^N6xCOJ{&>!jr=EfV z35}XN=kiRNy>XCx-=#+|=I4&qn5bL+QN((FYv}zaqeU*bbO#N=c+t$m%*VHUU^@BM zdeJqj&;rQYG;*)vB?Cqfe~)O4`8Ib0A^{qDwUndUUrCv^&$h248@LYm9-UFzmBsl* z<`AX(L}Gw334Z4%P&XREon zfie~L-UaV2UH-cT7<${9ijn21R(L(#rx%~sn~Rnk6s?k{g6hbnw;nF9uY`Lvpum%< zMfq|n#=b%D&G0?4pb>O$PeJ;vOjxwRO#gF|a&Eyq+@GvAKtW3#4m&S@v>f*xZkQ-u zw^Uk=2Rym?&TX@d7soovuO_S%mHNRm@xg0^aPP=v=(Ly?B5WyV2o+j_j?slF7<6cf zp5~z}Lzn{Ilx8}FYy9zYW3An4)9UTYD$cpxBUFrvI@dl5URPDfKk7^1>#>?)pE6jP ztK*Kw%GAmmW=`EH@+&<&Qv=e$kB2ooqLAxUmRi99sZtoQ0~XXY{p4Myizlo4!-%%RFh*3{K$=-@xjku);QfAY3Z4nFAr{4&D@<4yic`eyl`X|XvOnE&tey`JNWDo46dL)v zh;|W_LodE9WoaL(xql}#Ck#U(r9WZmhadPhy~go-m=enK<3CH1`t#0`xqz|HFtqUX zo4)JLo^JjFC(HhRMgKEz6;5@&5O?IV>{oBaW66AKAjgmQ(?#LkJuO%ELQ3)B(lmqr zRITduNA7m?a3*R(^th>k>`xN(2&GacFM52N%)11Q5^lj()3&Ki-R6zP4K+I5nSHcAig%2K?x6=edFz_@wi*6U zSDl+PE7iW)($Vthv-+TdGCIP`d~!WbjU`7KG|(W zl?`=vlD$z6w;}U`H6n^SY10DcwHPFwq`>n-&Q^-sL(Q-4@u%;a`beqB600999x^dV zJAobz-h;O7t>26CN*;mE3P@yH5&1Kt7|-M}!bz&6D*ImpMmrLoyeR!tp|mKB%-3WR z?*#(}zNA(G3N8)@W-6ROv6|iIAH>f^Qi(P_G_A!u6!06FNo%fQ!Hqs?E4+@sw|)$g zCU1idc?=icyqw0o-(BfRS*_53))NOWC9_%9Q6+T?Hca6n%N9sY;(5Dt)r7WhX>?yt4O3am!lSq!8Wb7P8E1jrrb93yc;m8ERUFgAGs0646 zldPUjs|0ef07^7RPzUJS*-sR~t1e=Vw_?>IToR+Cs>t55R9_k$21~&0b1(;|y#Sn= zhyrrh8m-X~CkRI0E>ow;dOiLM0L4T;fpy;I21)}K*q0G4$U!***c4IQ;r6tCRf=&D z%s(V+9%zG{d^PK@g4oJ&RcCO&R=(;H)rgq*U%k0yKhd3kVEEC57mgNckom9nFoT{k?Hc2D>D~|ao z+6Vc(rco9jvvpyKgMaaTU*5qyI&gh?EdC@X)}MqXvz6emx=L=(+b%1u4$8y1eWl8P zK_?v2GJB;x0ly0xSDrBMwtwyM)aPj*!{;R#PdN10d;a$4$t*wS8(K1pB#zc?k44bZ zt`5{Bw1tq&p{6TEULpO(Rn0Gf*}#=M!Khi#9PL7rmO%;=J$%vP&*a<*MqL|bVnx^y;2wWR!P1$a=S>nXsteE>vlG5e!)cFEYvpvw_rV(qXQBH!HhZ2Stk~M0O{$+j zaHW+?LKKq+xbkK}izXS`@32pzsyzkJE9Fa+f|^8ECK(O;g!tt#d|I9MXAr=&<7>q+ zXo!RyzwVOaB7m(FHvXNv2NQY^KmI@(D%c~1rbM*Xwe#Gz+RL=`9T-YLp|WonZ*Z;F zkMuAd%#Fl}?KtlZ4pTXdvmcA$M;bKN%+IN2q4erDoK#v;7Nh$T@F4AB8=7KSeMupf zE`6$8#eD&VUeG=*G}NN249lJqp)RduXkbETqusNetqM;JD{6L_Bil^DEqnlj;7su_ z-B~Ob)M8~k!(22gT+QlR#l(b?1~G+7+bbRJM)s8Pd%d?taGmAt8OJ=yC{&$)gH|k!{#Rfi|mS*X!-=oYGdVA zPRPWTQ&hSR6ekR3Z-?WWW$F`SWYtKgEK&`>S@+)EPyLi1s42%lkmg&B(c6UH&)q&W zNi54RRE9Knut(6A7+y~dQ?xKd2RRx- zKI=Lw2Qp{&4%{dVItKRj{){RRNaDy}T1f%tAV30O?mqk@CQ)1Jm3(mZqM&&Gu>GK; zs@|}qkR|c@IK}>kMz#ypivD}xM$zf|A3GFyoRb1{g~E`$vm}Z};uo1&Wb?D&2Aqx5 zJC$s6novH~U$`2!O#r!O{fml09OtAJ3XY?0dto7V|9_5AqbvzU##%ms%+7p~M~`c{ zTOG*!j*`YyaLABSTeGG&LYD3E5C#0_2nkKm6{I_mtlc&4Alfy}N2_lNL8n-S-Txj0 z1^psN?R_=9_28dP+u*;{-R6bE_plR*tj+c-qHUQ%Z1!;0$n13#S6qUvkrLpTFfG!= zMYut%-L@29#Z;J|QU*FATt!9-2@}p*u|48~oZitvx5uU!ak=X7P!$~OHH|D+dm1>R z5Z51ce#Pf9Gh z`o~raPFfO2E$+W?c;s5h6Bcl>*ri3 z3i4=S-Yp$a_qLfeE5kZ~2CKhJFZPOqm_R>>)_MKp6RW^5u3j79;~bP=x8=M0?)@G+ zU9#Lnj#WMTg(z=vRXmOskIi=D8)1w8(ZjSRMn*1_L>Moe?nFKI@~SQ=@t4OPmSW}gG)Se{$w3iW@6#roS>LFd z)$R|ERS5K~r8qYp8bAOUVFt8~cVeg^z1hIfGr)YjO2Q0;aI+A0U_9q4`0~2Lc6N1~5PBqK+#zOuXB=so-Gk!hZ7gcVWAiad3Oow+E z4MZK{TfdCQ6{MtYOr@e-y$7`tpIILdJxvWM$iiN+Y73Bk-t4qQY+fsXJER@;6$IA0 zxdSyvMrX*o3nAm1Godb%O&XrDO;Va50swuGFvhgNYChH|U(e<7dR6PGX^goO*18h> zS?~ogMtXzlE{~)x*Beq@Wxi#32C@&Us6%}UR_+or7dOm|0A03iOfKKV(%&RHi&pf= z(`G0&z`_4lK`9aLV^hc;wz?0?%$Xt<;O7yZgFX2e16*7IiBxjhW=8TiiRANg)1ppL zkuaM#R5#TMH#xAbkfXcFYTuxl+Wcv4{IuuIe85A~^EE2XIVm;{w+?LtrgG4$ab%=} zi5&!2Gznt@Xm{RFOxd2TABJ!JI1)X$vy`)3OMe85=7KmbCv?s?lxMBiNZ5uq@cNeQ zh)j@{m7uhOd~$Q%hD)Ok{OT+AY?dL!rKKQxF=YMD0&_Md>_NkBNV3Fi4exCo3i0ZY`Sjo!#)*DpUt;18D1i^lJ}bI4?NT>e9DY2p zdSt2&!bCi}Ud$VDCj2t6@>L3S<*DKh-JLTskCWbxXY|>>N5lz!B(K<#V37^y;JRMR z(-{4{Bdoh<_SwNBlaHH#$o5d-ny&{5B^v+pQI<$tnK{W6+T|m_t~b%|gT@m3MB$9X zZpyx}Y~ot#wiqN`TSJ7>RYaO7ts;)OL zMi11w?bY)&Kx|KWy0b!h3f!i;i05h1=@Gzg=N7FkDgFY5i03ch+Y%Myt zcvHWTA7p^t2Xo6rznuV}rql%D!aBe#)rm{M;7J~?Y>5@&U2yG%<2B)Y%3y=@m_*+| zylsijI>r^R$4{!@llN&xT-lQma5ypJ2OJa|_YQ$*orjf&@DJLkVx-vh1_k=KGAit|iq&N-p56NjAmZYzjVx~aB8 z>^TyN{f@F}Y$JLe_fOA}MjzHFr5T%iKBv6=)JrsQ=ji-kO`zx}s!a0-XFOWGGO>`u zPXTpVy6o*=xET)?i}5DHpUEo`{D0=1XJ!3=cHlMI?bFnq zu>U)S%Qw^e?-2XA@S`9EJ8xutb!@_1X4wLGpOy z#Kxq{PX1{1TLw@0ErYwlI!GVg{I0;K#sAL={6vDkn*B3#V`tu+SK2wShi<25_DcKg z7Z6@zFN2@eLyfhZ4LcdYwROR~@+q5F&*{=>^jG%8?##;YngLbxr{lUkQyz1rZO>J? zZTd-QWp!$AhyUA=fy*{;#nRdGs>*;8}jBy^=J_?OCXcbh%_6gTjT2M_yM za{k4G|NQtd{09&I{?i-w2hY#@pt(e+&^e5yjC5GQd3!MFsP$lq`|q9}r(tk8_Nn8T ztF?DPg}FplWY#LL;`ZMM#ep0e&wbsoqNKLgq@WL3i+4{JLDB+5C1^q)y(EOv?8T+x zxbd>!6_)nB=I4(}bj-;;i^0O`5!;jv+jaWs=^%HM`P>$HbyswuGTUipRqJ;f^Vdu= z>V;6rqTSwVc_Hgnj88}2lWR{~E9pEJwev*2hNplZ6+QQLHycNOX%C8KnLLG!HDn%c zdNUMqY_vQC@nq6E&*zG?ptwyb`aj`OtW?KxR5Ws-^Ws}eHiz-STWU2_BRZrm-j0XG zWn^O&a#gJkD{P{1EO3!3Rt6A#tu=%|-Wn{{w=@B1U z;|d@WynM4zz;zn7P+TyH3~&)tMx}zBvqvibtNMGD>0*{({l#3x!NPT!!<+Ub8zksi zh3a78?}Xgde4uGKnq^=QDQjo8o5dm7@DV2!z*3D0eK08p zivh<5%@sRsr8@p0@Zj)VfxbPpv-n{Mrjdh1S%)8e+M8i8mzq*ZBiox@`4-N-S_R_Vo9dgcOupL5#A1d*KVlO6T=TSaa>FCr z*GQxz626G@a87fXtM!7IUBO3*X4J{7(`}lB@w^|zjwy9;teUKr^UhK%hJE5|-pKX+ z{puLui?TfcQQ;vV_xBxVCkt8VKo`O4_5c_f-T&jKiPDjoq4QLA5naY(+H0cj{7g`!00 zQ{hw@&XLq3y=%0ri;7cN?VbbKC}|)cJ@{_4RMT|gdR!L)t7w}3KulE9v6?8|klx9) z+Bd$l9Xus{Wen47oLAWKVU+aAt)ahrFL9Yo<~$ypv`;fTH3>r891N3|IJ&L@Gf{cT zn#7h6lkS1(c@bcmIT|V2xIBY?9^$*;i8X3+@vBc_O`PB`ks0lgonX+r2ULiT8wEcQ z;dyLZ2hMITu2yX5o^zJ@_>~y#f@TCCros_`sArdP`AHf8Vk8sK(06vkpm1ql>+)Qg zfif-!0NjgD)h~`~e26^G8NqnRQ$8GYqiOWjn2;2T$zZaIfz`O<{SECph!K6w<9k}s zX!D=1>39+bttD{pY+>z5zUT=6Vl15p;C__?zW}HYG|EM@-9c19j1IPaK82QoOiA;H z0E~4Ul1W7BnELUz zMRbtBlV100;$#x3;&G(u$P3#QM1a!^wYuI^G0eGl&n!KWHHEJ=BgWK}iTS2Z!NtC# zQN6Xz`E74tkc{z=ol=6rm8Y|@!If~IwRP&JDwfm9&*6+XhH0Y9`z@^4U9Ql(GXrY; zHXxL7+Ai!!1lHVX&>OyVQQ~M?an0;H%c|HG6hKFdDHs{kpk8fLP&TG7Eno{X17L`qR!RD zB-lZLU2!k0!~K1B!+=`zT-r0r1S^Qm$k+g2Tmh^EOwnhzu7Tp{;GR;HQF{xDyTxa1brZpQdBgD zd`)YcYjM?X!fDN^-DPp?;!Q1eYjZV~rEW;UR=$dYRpb}l&umy?-kmtw>@jccdz^Db zyBphQKahjt5BU(yjt`6cAwC;8rCs}il~Kjb@EdLbY3_eudgR2R;rF-F&?L=K{rvK1 z&nlnHBy_DPGv5>I$C0CqFSS)k^IFg}sv=OW-QTB+ID94-HQYI5Jw5n1wQ;5AN($bJ zrldZ?5v%R+8Hq43!7J9$-o26&Ms^pOj@7`@rvgh3fxfLYY(he0uRHhROEBAmPw|Ja z^|fjX%g-;aFy6N4qQv5&;eCqPPsAee(hL6-`b3xyzRJ3kUSzaV&}uRVI`e74k2`S+ z*A|B|UBH*v(iI=BC&$XMK_F6a&j*yLQ3sZgKx+JaWl7r$F54F$zr~cb)Q;?;%erzY=oG z;QvDd)G=d4{ZQU2B5p?^TXRe>i6k7{x0rH8QNMZR^r?~lD`YL*7u5+f@uJhzz`bAurUAA!q!ezGD#_BcCOUTdPj1jzKug?9 z?WLzy_oy)NkafcKbxrDv`e@TWzF~&!?BN!>Vs>p=JmNV2u4%-l*95C49^izRMobQN zV1LqPR63|qu!c!<9*C0DkidyNq9ra>*K@40h{c(8!8WuVo9qgx9AQv8iKt^gnHwQ7yCmn1o(bA3z6K zyHmyknZfBY-^@u?c&kt~s-TP&vE}0Y&9Qe=Ea9U5N$!n7r_o2F$u`w4y9abLkw}9% zoWzCTEjI|~RVF4x znbHV5T}|^(lU&I=0i%=Lh=$TVfC{4$mg7di6vzmgT8)omb;%|8lM$jI>@*L{&iKle zqAq7Z*-$bkbDfr2^wZ-rg?`a_T6_F7S`%I%-K%VhUdpd8800NJdO+z|?HO{cg2tJ& zZ_>FeaeaHi>Mho6sw_OqBvWgkFn_@h-IaQ`#(Ghcl+={>eWn&KqdxH9EPG5#lN4){ z1WeVg*Yh>*Q+l(UW6Quv=Vs5)PqYYMk4e0F-;#uW?;R=&MrM|xg|GEnBicfTH)~Cjmd-{v<%|3M9$gHP zC7$KS$jKu)W*hl2w4;{#?XkL?>Z0Bv?yjN`gU?fKrVSiWpK|!6~?0{c%I~9%n`7wVref87N6hiO# z`T4vWj{9Tgv+FMg${dP@UmP0gh{9@nYcK6#m?MEyY!*R^ z=HZ#nj zZ!OD57a?hK7(u!45$Ijh_6ma$*$%PZBeoGoCI@!7#%_1x{P^}Uawgwo@^_V{W6{Rr z^9XG4#Udy|8###e*_Oi#k(KO05{7%xEJZn~5zdDu5#i_f9oBY9bFL=6QOCpW#y)8> zw`#S>{^ksX5}5p`X61=?h?ZC!^v>hD>4*I0yCKhqsA=o=ByAWTmx*+Ia5wNna!Ob5 z=Q3SYws=`XQBGs(KaSKU(DWHpWEW_f3}%>+OGeov*Rh#;B3@NVr3mw>urkmqv~s45 z6GUStqW1vKWB(w*Oby5BJ+|wk1ooxqRvpfyHBa55sAgLeCj#dX>k~FdD-v}z1vpnX zt*o>;U87Q78%s2o&Oq)V_oQ&OU&iTbPeP}c9ZaiBQ2RTEVqy}r4{v~D%LP98^2#JO zi4I$42?s&UrB7+-L**vEL{25d4kDQ|QT2nfFbkTg!#+ zd6P|^2_&l3Rjh60e?Xm#gcr3*G=-}*Bi{BH$)igW=+HbML9hyeCR^}xcUci!Hsyl^ zd?Lhw`1lLU2eTD*qGFdmxHh_vmuQ%o2W^s41fj$nSDnZ)-IHxzO=ZuylHISE=*s)i6&IX(gEOzUs47gJJSTH$ z>W-Xcqo|9I!80tZE5afM#fRjsRNk=Ux+?|NH~YndYh3Y;V>Vp7pVeZ#HeQ`%^Qv5D zmfnM;bhR|cu6$@9SEeP~$SR_JIIjw!i) z=~|5484tRJI=AA?$>;s%_EvP4&0yLlbllTDXaD8c;yxSX9K7~O>n*c2D(svEJt(g= z+iGgK?7~bX5!-niUPUk)?;xM_AaxM_!ZH`4Eg~))E?WB4#$e}pLB~cpnbS~QFp#y9 zjGwf?A5?^o^=<36V(vW-N@G&Dus_~jS6O}DlMO#dWnHO`_AF^51Zakt+er3vTTOva z&Cy0$oKKeZVxy{*>0u+s@p!g(#q|9x49jL1hAS*WgZlFc(o3iMSQ$EpDrn3!9kLS8 zHi2EB=~_bCpkz2^=s#)>vj($KIu17?yPB>$3g4~QX@)f-~El-e^sL^On0T!64?Fr^wSLW-vZWJJg$k^qQJ@__( zxs=(Yf|5B--4^&z(!2K9!8|`0Pz#~I{_{x=#HCd%iU?| z+?#21Gk3q=?#bLbQX=Rcv^mpAlloo+thifz^VO3Zz+!cF6;%Eh5io--@y zBfg%PX7$`jp!ZGE^Lp-v(bSQp*TTR2kqO)!oR|G<7MX#6u~P?TD-}9oUT@;E%$)tZ z8a~xr+-e+b2*#n-Pv>pFbT9U&HIE}(?tKt`85Z|t;U;>juR)nd-XSACAn57HLHj_S zia@M}LC5kDbbo*ic#K-QCD^9=ivLSz?LxGT8=gw!1=2$w9BP4Zl%XTY*P`%+m?Jh{ ztR8>JapLRzG#VQZA*H@&2qOH|tz?BfW~_Sb`fU2k_1GkWVP?hN@NxwI2?24=@O#4OgEGxc(&Fo!J%)c<94U}q*^Ah0*Gg5u$!7qhf+F?FIB zvoUlr6)`ooH!-D`F|{*yu^{**Py9bWnYXYfYA@Pscj`vranu(VfC6ctnt@%|uhvj? zR~xou%^9~IU#Jt3ML6Z;5}l*af}r&`8YL8clEyi|yaJP?es)nFDPK9Fe^r#Eu%F4b ze>OLNZav?>@-`tC5mbX0PTbxB*fCJ$^1*N4AAbdd)srl`G{qmsDVkS9N8)Y%QZKH9 zggJTaS!FtW&2zsq8xDN}f3>>TwnQ|>TEg3CEd&V1AbGCk;!&$I6s()Yp zd%i*jT)MO}p1z@4g!x(SUS&1lanE{S1sO4)f2X81(XuWykxD6RtlS}%3GI2AxlKG! z+|IT8^4xQe`s!=A+VL@v^Ji?H2)+vJN+@CEJ(Gu|UMVB7ncLxPeB(Lgr}a9k_7i6< z79~0@pUE6`9l&vrS)B@;itba%H2gH4wipDWi;>$QV}xm$0ZwaZORWdV$*g0pjR{Ik z8dQ7mb?^q_rAtAlvDwAEz@`pT6o?wYs5cV|xMUw==#lYiSgm07vd96UcC8_w!+@Ho zupmU=+gf;;m}5V#`V}qZwSa{n1bNo+Z&+Qi;ku|!-caO4(H2`0rJ07T6XnKxE=drc zkOR$_W;dB6(_#i4|4Y zn#{2dCePNIq7p%Iq5##Xdh!k%;uaXbmOY-5ccnA+4X^Ny0?@*iS+)kHiea)Mx8^$i za`p+=XyL-kAGOZ64U$_mGSrCMuF51x6Uxc}^d5BE(Tr4A9E01TmD3sSad(gHT7h;! zab*~2J?3h-jwYJh+H#fkh2+IBk{bG5J6Ph7Y7oOb1)+acK&7rkT8JGDqWndkbVj(!Gy73fBq-9A zw#qwlJn}wUNw8i6hhtlYH;!%oF#w@BFVkl>1z#)Ufydd3%6QDHK@^s5`iq(g%ZFIe zN>SLFm!t4;+HB7@3D4ZA(gw?FMmDTh*soC%-&`fLKX&CXrQ+L{Ek_G$Ind9lH2Mzi z6RW&1q=lv6LA}FQedYU5ZTFRR@gbG&v{{4W%{8Pqc+N$WHUqgbMve;$ zU>=0hnit0}G6b_#&ed{s1s>I9JD$iMB{2SRM#rBK8j)^DAIhg*ZdgNQ66B@Q`ZSn? z{nE54?gqo;6w%DOa%&y3md6(}DXbz6-wG$YVXPi{&!yR$Q}$SUwvny85q{ac`sl)E9jSyl z;=wouxk{}WmxDV{@)dS}O_zC0(Md6EdLmnGhX`x}QEVhqjspTIY$BEFoiqB8vk#vm zOXI-bH+Vq`#3rk~lBCs&Kb@al&6FgV*Qcvy)1ef$C+{jRe?P_J|;$ahO=Z@3b%|9vk{kmgyL z3|ANIK+<~H>`zk@|BbdZL}Z?tC{Vgi11Rsd&`K#ju_^GiH|_qt3K@*KUSFLC_40q1 z(jJ}cgNQdQf6E)exv`8ZW0^M|&L7-%xyUb~u)|!Pp??Ru8qL23&Cmc~s?u9zPyq@Z zChsO@(T_^r?cOS&DG1LV@&O6g=1D}&aoco4USW8;9Vq13lLx)`$hXH{y(3ZkC!mq_Y#Dg)Kr zDp01&jJP)cJEMrbDjbmVK~~itR)~Fly?PKLx!VJ1JhXYo)JipgJ}Hn<17W!pt%elc?+PlS?TY^ z1E@B*l41HNl77z-Z?y5sH~8)BqZtr$zf|Ldj6N7103j1%=KD8FL)h!N_P_!qGdz=gU#rfdBwURJ6%R4R8#P z%(Rs6-PBir^AfJA8`9%A0@qAqvf(0RDNJg-X4g{BWcrJx$KP5R2-UO@pQ8v**OdY& zoDNdBxC7c&@8!D92vY@J4w#yMoS;o^7y`1lQIbLw+@* z_Axc>9CUW0U`FbNkVg4E`j?JarH66nr)P5HBALL2Tkf2nyv;M2p8iDIRif9Ev8M=TRL+iF9LPrTuK6y z&mL1SXWB@u^&F%-QYfo6#QBZ_aU*r-1|ABmiyibs%QNsWMA6MAr@Qa^)ERp)CB=<& zO*e<^C$0ye(V3*p7ryeB9h?2y{|0q?;DX`GbaV<@f7c{ubeHQi8RKMmJ*}6n3C12I z1Z}pf4+iGiPzw>Gi_ePVuBt^8t5(3^~U(8VbaS+E#oa&(Na|(zW$-|Ag{i6L|Z+ zgo)OfNP4=7+HbT2u2k1dibSE}E#ZAle@=n1<`i9=tf4Mk_jeD_L9SiSL6XzX=)h&} z<%n}zXq|T|_5gm6{{ZdU$%J(gT92&eXnH1rak6Ol-eqW6oH%WHV&@f3sr%)f`8FIS z+tr@9Iv*mp#>j8nOJe_?Q4*ba=pmSU-P7EH=j`xu{C(iNGf0jRRS=I6_4nO~$v&Xd zHF>>Z-M}07I*(Vqt6$p76kN$&ft1_hu@$4G1L12A7E-&@Ly(jj{n)r{{Q*oYp}** zFWati>u%wjiLKCQ%Z2?-{5Q$YwBv=_ZB7z7Cw1;W3Mj085dk@=Y&%5!5!!54D$5 zQQuB4?E3ng$58JN_owsg6L@osNDQF|8JCQt+C!Esv&Fq4HJj~ljKsHE z+A1J_NEJh^m@tWW6Z+HX0_*e0+CCVFp!o(_>*Cm<=kf-!Cz;nU4m31dIrH41{% zOr)t@)Tp=2bH8rJA9BByrSV@+c((e~Nk>>_lZ73Ji!Ijo64#aN$AS}G3(F5IjcfeG zJRPJ&qoK65*~!4uYW=wowXUXitRDaOETkh^WNx8htlun#=glUF9{)%bEHgvY!<;c? zVfjcB?3o_q$Ty;c7DZug7yU!H(3X@{9W2g&KpK*YI4q+qbdqDT39D=xLZ8G%&9j(q zSyL`W7peU=tE3@QqhEm|4sf$$9jzhE`0sqCBbqBM63U1e)jJc0RWL+`aHui3K(`=^ zhdS)4YuNXC*`;Rb8|l)1RiDN6WPh^k&*(JdM0IH4lZvS<8jvRSmXSbmSxL0>pm61Y zy2#0sQ(Dzk6BTRVibNGs5g-}b^2!P_;IP4!S!uXc3bSUI!kuU2B2)w!ecsrP2-Myy zcHJapv5wBrO*yv*Ir@+%43(xuCiBBfb~k!4h+h~gy{378R6|*asKk?krB*;IOB;}0 zM*z#snQFpx$jHzg)1QPxMvi?#R}okmfENhPU6SNTh{%u0rqh3@-iRD~mgd%o6jl7b1e_xz^KQLrHP8@6tpCUo_MmOth}_ zKsoLqD#-3owk;N>?^n z5^o=VaeBnjWWO~DU_T%KIQJ0XRESGL+Mi)U0b#_x=*U0>a}gK%q}gtlz+EN~{N98j zGA5unZ${44v6!1&Orv0-BH4f9GYIA?pNPbU4*J^eTNXwj>RLxv4HJqTwMEGuY#ZR) zy(x>aD}@TFM2^|BWii2F-a`Oj6KnXi3D$CXAF3gWpPO4c!}jks?DiU>VjHGeCC5b4 zrer9dj3Se{v43%WE7ySp*Y?T4ZkVMVYgw_-;w;%j>bg+r40A-2oMLRK!4VaL6{V@f zM(3b1gm*KEzMJHQ*Fs#O;NufyGcTy>+Hwciq4cQKL&y>)7)A4wHJxP5_{im?FiIA& z_s_i+Oa;P$n6twybQDbc+5Z^kYO{$zRhfP z*lYiqUnb+vMkCiW6h=*;VuWOqIB%{~d_Er9mMtu_$M%JWcWlzwT3vM2)m(HkezCS{ z`Y3H&3@uS58Ec_)sVp5QyGPMn@!8|5V6z`N@uqIIjK<^>a={y} zV{1{I8qEKcyKAF|oYabj#0yQQGqCrkA@_!zfc2vp@|1^Kv(-$1LK$Og?yG-Dlv?nV z_Kpd%t}M2+euM}o1Wu2#KelAc(W-9FYRgTx!hei`4cB08P3Cj?TJlS=GEWtKXZ(2j zC%{11vP__G!ii|)t0^dY0=r4)gV7T+GS0mQq1&ntl&eZe?O)nXb&4s?`${P;u^86` znXdapO<{H4%xeUx$(<$K*H}|W!u*9kBzB75jnaKpubi(kI-mRUO6^7My+PC(Qj@!i zSR}1z+^_B?(~HzwiD6>N4cI)h+ONuRx9o$hhgP7G zc23dwuPzF7rm`njq(@wqoYrHu-J4>B;j1~7=v<<+HRvu;lW2pN^9scZvS(sYLg8wn zfsdj82ubR#NTZkaviM4aOKP~y+J`DjmzaHwDbE1-j2dZ_-Su~1u%KAm-o~}EuS*R< zz>+1Y*rCl1sMn5--wqfjXK|C&MzGH*MmfN~$E_#^o97Sq^QWyTEs-`obSapNA#=;v zV?t?btfPATT5IPEt`vwY&v@&EU8k0q0vR`Sr1MKC9cTb@5 zW>MDAuuv)qXRPEJgLaB-h& z!Wo^U9zNNDq|7z)@}MFKg^Gsk>Crsar5{@Bn5g$OafN@C@yJ&W{jCJ@;oEc-`$QmvRs9zcnQ{HeHw=x_1sDn4*_j zdc||N_UIAz6{IXp+@?>POD}dGe}YjCGb15Lz=hZHtb|EU3X~S_s*?7+rmcuYA=3l6 zK#NxEDTi4|`Sq_`PDgyE%C!dwc$Vl>G(1q~neIKg2A6{l8g2GqMAi{-<|6 zqA^*!#RjweO8o__D$)b0Jypn$o!`~$rslk#(a>dqHeTANr3DT%d}oliZ1|ZZ|TYV z`%vP-1c2G^>ZDkAVtkGwOVFSr)LC-o&HOZBp{hBL>Cs&y{SdwX8Gp4w)U*{*M~xUrz3((AO<-j>Z+ zZFlIR)IIGyVsmwRdwgFVH+RlkJ=?khcm=*G_o$jdO-7D|Y%&-3^6~9%mo50_1ji1@ z{$28U5IlHJ8|NUmo_qheJ%2raoR74Be!Et3dylaWs$XdyHJc;yx0_1i`u-(`Q9;o! z+oU?UDeoOnyHPAWR(dQ-UCp+vbf3NV8&#YQfHqtFTLfdOt0hI|oL?9XNUVkJW(Jf@sE?tj8P! zd=cllZ<&>`EQ@H30QqnbYgA5=BBy4CH8@Bn&^;Dws-i;&n6aRkLdkmby@PFSpD(Bw+C{imbxhCcijLGI~@JVN)&Zc1J>aMy!qmoFKt?YB_J-;U-OE4~=HnBLz9J zHJUjQOtMQ#HbeN0&7&J_w4jP}qwnH0|0e{Gu1~C@dZW-rrydP*4*s@uVDTSFtB7NlS zsZBx__kjm$qS5iB@d?vaneaDpQCXGjINUm_{AbK$0%z;{Az-NB%*ml8kw;YQjxKq6 zvtk^L26s&qw@i>_>)}~~geKhi<~F`BEi?;`AR-Ng!S*FvQ{d7|P#?0kZ5dg{$a1uB z#*mw+ZFP=%WqIE%0A;Cs6o zPv4*g{KC_MTK?nc3}GmmdyLhB246yVFS*RB8qI70L(w-9aOezR($emo}UTwyZr zJkYm}dx5me%cHJD2L#}J+}dF|GKgE~7*ar*)Sqni19gD5Brhcv)tKS%+KW+gdynI~ zBxzQO5ik9Hjfejz>xk10Mo!1o(jacwRSQh0PL3z7=IRxZ@Ov#S)`f)1V+oS~;04LY z=I^3kirZ*ZfFaHO=RZmzi_R7QZu>!c)hw6JbXqH`Grkc^O5$*bj@#P)g_5^`tQM$Y z1g$PCyapV^M5|CU7CB^fZ(~9;=n-RfYexWRE>Kk#72XneD{KYE6CQ{XfR9ztIj&1C zQ)Vg4E{}zl*R;rXoNy$2N!B_uCT&)ytG^hRs@hEzVz9EHnCNov`nLtvGiG)>U{!p3 zy;w>3h?i5ZEp_Snd>-e|Y&$}RDE;`GErJJT>S-M}AHZ)&9*7)6VsBO;w9!tyhYbAi zA}gN&V6?2PdW6p?YF2992JWHm6#kVg6egEG5fYiuZssez`nB{O=z7Vsd~8%s+6zZFJqOL5K$}0y3IbnIO{UL1$n#W zX5b-~@;Mptdbxsl{~@PG;7)mMM49q!zixwG>coB2*Ev3Z8Ed1+evFo(7{-3R;*)f* z&c4jJx-@=agZLMCkXn$N zLNJGR-(Ej?x9{e5-zP@z_W&G$NHSt*oC!w&s^$k!@~^VcxJ`Pqim`jcU$;?7o^0q+ zarQtFuYh7gk=dvM%Cw|~$lkdl_lPfp-V?D*zY(ime?VDFY^WGsZ|boy#KcB;+KAbR z@$?7@p8I^w4PY^e_w?LiJvogwGj)HPYzLV-QctI?&Q@c_O#8t{;XV8D&+FR#-Q`$Z z&^$!mDg+&|89l-*YRd#=G_&ricOF5__s?NL_QZFbz`wGHJGGP~bfn!rm{EX1(8=p= zSYFty7uDeMWtrUeWu7p0a7!tv?{C`QZ=v3p=j>}$36a0A>=z{6v7yi)mWfDzXT@UI z)Nd#kA0#h?uA8Znn+|lE;LRrl{>A|DlLeQ z_e(;;^4EgJx8S0(D7 zDJpiR-=3uAis))keEqhC2VhFbK(41^JPk-~)(58IKucBYVD*d#Q`?Kcd*2ob}?9HTh+ z8G)kJi5QiLFF#e@>93iPj+UKG#cH+6%cPnV;jE?F%}nh{Bi$AhgdzJ#sG1x(aut5C z+F{{TAj4c8+~~F|NhG1R;U%X~8i7cKikx<73on|!e!WDbsI(ds=Z^O z4)bROZU^yKdj%YxstYFInjhRPXRA3#X}bP!JRZ$GM^L}kCS#1PLKqvdNmhz+Nz&Ge zVaMSNO?RPg-L}{>WX4?){=yxl04K9+X6JXDf)qbxnGS>dkLGy|i8sN18HRk^foQKb;z&2mec z=0VU&Y#zcmIQW$wreCZj@@65g0G7&0}X&8myGJMX2(qs#wJEF;Zq_e6?ndV=*R zt;x7Q6_Kl=>%r{S(OLJ*NuZ{?%K2+tON%J2Du6W35ykK?A`^E{TSv zv>#9*I`O5CYQ2p}mVV0kFDUiZQsLX6hpU@piT0QtjBH&Nglm3?UrS;yqAZj>wh&@9Q0O`Mrp_@iB?OnRq*QYU*Z~S zV^d$vP_J{SUrB2viaimHP8hHNcY|r&Fx?2<3@}xb+EipC;vKRKhZw&sDqr}Lzb@m% z=%=+@2)FFuEG;DUm5Hxjntu%?@&@V^%g;FZJ#_~|3>_{GF&?jQmGnzn0KQt zU{4uD*Q*mAFzC13opRIAM@|?7mbm2YDhB;>oTCe&m6qXs;>^=;o=X?si=(NJH}R98*+xZIus*~mJP*?nKg5rs zOt-50TO7t&wT^Uyvv%YoDS^j3Do7GQrerg$ywdK3Eqzg}sw9VX(3!-J&;#~P>P~2} zIXrVK5x+fp4T0}vxau_xmX%>=6wu>Z(!G-9SvX63bs0lQhboLQJqATJ{vq!5*MHEj zjE45SzzmD*)v@r|5vuMB?iwxCzu>112@0h{k{md`VV$Ze?_eAB<3dNx#?CGJNGaV*6AiN`qDb{2Xnf=ROU{b zRk3)A{tY8JrkJeC_e!;s!(kDi87Q5Jq9W2?UL#qahUX7s8N~pi!&${B>w%~Yo#&ao zVoe2jMBh*!Vfp)7(d;VbMW`(>(@c6rzAU`QQVt88RSG`MHQ?Y2TPt4w)x``%R#)gP zfDwrNC^ES@F3CM2*+o8(^2S9z7$B|_w2s}%|NDUNR}6)EVE=&i9Yx8vfX2sl;~DeW zC&uAH3Yw|A2}Umj|3hWq^!ICecffpQ{{PYyZ2y(6U}5@Sr@;Q>HC?vf=hn@^r|&Cn z`G@{%@C0(qI@%7zG5*)XfFOo%t-^EQcraqZkMMNU`z>w6Pq1`-?Q z@6YYi?D^`aPH@#KpD(8GPr{4ppe99@)z(#UG{i*OwM{wkA^6KkxGRIEySCa91+rDj zIT0r^tWE*@4t+)`^&$>w`5jwN!@+R`vKHAqSt434i{L;WF<9NZ(j|dw#F402fuZ>o z7ATJtD-@B>l$mO6tK%gk52&IO0XYTGFCKu$k%^<`(pf%JbGY@Olx5s%bRSD((%@+b z1yRfTkirDq&)L#lUi}&z5*>L>u7zM{ppCdswU2P5zb;*Zj*ye z$(m#aeejx-0-r7c^@?EBU!5s4QhPiFBOkCkd90Q2+9yupZP2>xkZPp+Wb@f#!%(&C zc>kVKH_XqAdx=@jscn36y0IX<^O^OL(XNXk5V%YOr$aCE;d`%8c{u zjW3<}?Fnh7?5SXi?RJ=E#x@hHr+Sr!pVD@v#*+;#WjY~ZG$td@v`*6rjD={f38QU(BX`4 zBN?i@RCAZ>M0Y*OnYE4kqz`n|m1+k695YZWjDH;%yMQURGsOXHr&Wq*R(c_zhC^^m zdU^))%=fmMs|PkpPJUZsH=`JwQ(bU>Y(i_teN)0%!TI#4&x=nXvEvCOXN{&dlz;ZhNs+XO9rFvxS5x-f3-7sUJ-cOdW&*u{%w z);(l)4G=~Z67c_w%(k=J{>W?vjp^C4;Pq9*uf~X91|iRE9k+RTJO%d*B9@m#lynUdvad7;upug4R?Cck`|IkRIYj zfb5AeU}|ToAk|z_;r>z|K zy;Qs>{oX3g0)Fr)V0IHKzy56M#2Q*&_}1R|M+oc5Ou;54O}MnVQ;UFsanR=6zaNaJ zFSGr7qgo8K{QQ(g{)lSIl3j#d6Xb4#Tyz`P5)i+MCuo>j#N1z%JH+kAKo^DGP16+x zU)qQH$UZL*J>=lp9v}CJBY0`MAq})L8k^N(?P|(w2|r#~1b=sWUGewuq6SG?=hu!2 zCbUC_^B;u=m=T-3ma5FkJ*~wm<|+E>mw?(1G_-% z>n0@=GAXVUnqNTgLg*D*|Blw_SZy`7x@QZ~H5kaaTM3Z`+~ ztyEK9pSb0m=^q`}D1A}fsb3Edq39($HJ8wO*Jit6uUFNMY=_8X|9CZ zU*ycpA!%ltnCtaKi{nHOj``r{=B(Zlo~2M9z)M`}l~Q_L4;7~CADU~5fa!C=pJT8N zQ`wERE#x%A7rLPyok1|B$Q4Cv0awkxEPVHxXlWWYlJC8(?P%%ll3A7BPLU5S!a=M( zrRRiN+g6%sUM}t0l?Al1z3B`+A3Lq;m&`#S^Vuas^uIH97;zHOv}x_&gYtUNGG<-N z0k0N-g9ozzr%}`|$?G5FU}9_Rv*m~D_gLB7q$4BJ zO&9WqDIFWnL==jBU&xna$?0}6VH$ji%10vDm{c)*8!Z0f8*J^SNaif}YRM{e&yKsN zruf4aL|TZM$Yf^JIKy1A)%s&m>{94ckzzfWp(F%jX4}@vy_#XD!0) zrr_(^z}>8!UrsdGg9q#|>BM?ebY6%hsA9*~-o{<;1ovy1o!k5H>u#CGn10z`6yA4@ z{@Y!$!!7He(%rwgKfK=`zgM4Wf--(J14jMxCw;IBIA@X^V`rX`pONS^m63iIW4avl zO_SW5cR&*hA1~LSHc_E3{9Y8n%cLW~v6rn4b^GHjP4jvl^EqV{ERT-+z^zGG*A@jM zgNG-v_Au5A(H|mh)NV_%8`+vz6)1(WWGw3gl$`m`bY*P z$7-IK6Rj&B0bKRQ;1Ew0Peq{&J;iF|XV}zVyS7+?tcQ`s+R%!r5JE z#O_RrxT>i6{>8^#AwxZP9c++IANy^~ZMVE(fo=C#jhWZi6dA)h= zNJL61WD2`2LqpJDhb$Nt#cR#|jou#`NelxwIb8)XYgZx%nW67ff!}vFL`0bvR7eTu z(awCw8AOWL9LXN()3uM$g@Ssh4hCEKVNd1U9xv1+7E2gzbO}Swuot)HZ#0z2oWjH%4GwB#uEzbJM{oT z`j#-~D?yfyvXIa4_aCR6l zN#H*trj04Z$9OC!9ilS8Z!z(P!D}bOe~sYGdZY zPntQ-=%owC+f(=$Khz9*e4vG529A)GBltgG>+L@0Fk*WxsH8M%jA1>YHcVZ#EXCu?Uq95?K>Qlp6pkg z>zPV)c>+|t{5ZgUI>Eon1+;9+j9fIw-4#d=Y_?*wE}M)!7M&Jyx5B%0IenEPsdall zHLXDo^e8&GIyHfIIl{kLl1KH*{B}$>p`Odk&sA#`nFg!L#;US=tc$GzEkZUDU&hcx zraLWCuW=ej(A-MU%udBhilV^^MmcLbL9d{FmvVv>BUn>h#zZM7kkAPHR38)~U5$oV z?!uC$aaui7kSS=^!5^^E-!u3UUsC2_vBxpvRhqFnf+_fKZCIEtLoG?M)b7zH(7sUz*E= zrr*?L@zk_#*71>Vlo}Mp5-E)U$k#TNcH1EXT6Jp*aIF?M;u8}JPuG6py zPR|*tpfdINpqq&y&tz?6!%%Q~!QIG@7-ZEuIFYY55QAmU?I~6MmMzx_K%Q2h7Ms4s zN=59VvhAGYQhbY-QVZrugSng!1>jkYB^}m{%^cW%2#% z{i=3qDSmsMUD)5F2$O6G%cr24cR(z4VbIeFH2;D^MAOvYN7dKeA{|?eqTdX@0dbiF z+W7}5#&S;bnllP%6@+0MRY+S3+(8QCU;ZJ(&CllK;Z7Svo}G#--=TF~x$)2I&A|nM z;)2F6g~z28k13XHUqhTCMIWr7fU|!KH#2!p{gW~A?#Q|%TfblN)_CeB_y&#*&Nu0x zryNJ1UJ!H?#HLUwrT$?RYiRy8AJ}#^?dW>B%^Nzp{APM(`JfVnyR{!B9oL^<2`$qB zOG`YBvaIo=jjk*>P4+f_;-!FW6kda%>s>cOw(N!QOpmMx)VSaIcJYt4^G?jkfiHy2^j_Ai#_ zSf+oVnq_aQR@?Wz@cl*HviE0QbBKq7>I`yD{%)@Wb}aOx@^%=&_dURxot*;peLfp? zO5oP59C1~`+!WK`N={3n=q00dxxfD&U5hLY%Lv@5^hrZ%mTx2{j($pEBPQ<2+RQSY z@3sBcUaayLl;NnON36^`$^1+XN;f&!Q&)7PH}V zCidJ!1OyuYN9@Vdf2qE~b9YM})AZD+iuCIO(pDdFdnn}eY0<^@vo=bZYFABe( zXIB|+V9t822$PC`sMr;OY|9oYo#8;>@vCM1xAwoP^dq{&C9B5wji|(1>TS6X z#fOpxc996>lAT&Pmqza0s)OdB;t_jg{;^d~7}9Yvlyk#+qlj3~PKIswo&p&5-d*`r z70Fn!^x3pr_-hA&TvqHI?4{EonJoN4A7$c9&J!+~r>z=(!0h3RaG|774|bHTl6#8V za>IEA_foQz8EY$Z_RD!I&SC6QVFe$}0HHiw$%G?knk1{tCW&k-EuQjNwXJ_6fXTM5 z<~DC zQ3`zBFpcr&E7kGxA)m(nXPw^%{ds$?Mq$}c0Q@UzzZWi zp&__Y%<1Q@Tg|9BIbyd<+|1K{z7mNBh^0gfHh(!`8BEQ7vjYIpuFi3s|_Llel zfmLvi>^N_Mv-s%O@c2WoeCt5P;Y@>f4RGN90jvD~fmL@7Ki3q`EHPm9Iyp;Gm^K%K z5J;P(bMcbj%f*z30v0K~5=n;`?@=Z*+bn*gW|#vw7Bx~s$ndi!9z-A}Hp63vdW;&( zSO)>y?X4*0lGs)f7KxY@Zjo$KIo?ZB-Me+GMtep<%mxzIf51 z_Z~5WCgbaf2Mv-nj!=t%v)P--a~t@4wigx6ez1aL`eA;Rx!v(^@0K4S;>jxi#L}I~hR7w#%5YO2x zj7I2H+*Odd>CuQlU0sKKb%(D|!;Ot?*eJ8zdDY?12Z6>%#j^nYO{Q9R94ipTc2UYm zb&XS!%=XF$+Lkyji$97R^Z(KXRl)}mWl8U6(bU^jf#I95ZIGHstk=Pf39Q+18L@I& z$~7v~p)-}Z#N3n?(;L9_Q9!6#g91{q0;vH~u%t+{F#wy8>7>fH825Lo-D41=^;Tg*c)G4E43*IC8zWenR%ANz|mtFYia_i?;FHbEyw(QUU6N4RfCuBG3V{I~_UcsLJ$RJiLNA7He^L zm8^%PpCwEVkVY<1owYYNtgSgQh_lmzFX*arzxYJf&*2pyLpp-XR8m>#yH2$Opf zBO$kw%7k=7tOAbBZdPA)15c8|B}oSSQ}ih*;vcvL6-m;u=SMBw?m?tahn+g@p+BPb zI_2Cz##(`^FS}bS_&)uwx4L|b_PDn{2A5CM=(FPd%DC|VdH;P+@cwS?0}yrFpDyNJ z&$}HD0wM^$Fw6f5Gie-(yJ9;BDH6UB?a_gtWPZj-*Ze-ffUqO(4g~hPc%k~n%BJ02=!8u@H4g~ z5mHazUrXzvma@jEt#OZYWx_t-Vcou&7Uk-1=estysuky?129a2nIoH_@-7FjmhI(K zcc4#~ts0ry*v-i|tozA56}wTVB{hLwU>U{;0;5APlj_XU$0E0Hn05B!gP1Bxxy9Za zwpNZBlV}pPJKc)a7-qq}a38XQfbaxA9Lp;ub5uNjtL}Tro2BZBeyF0VCEU~z=z!hG zfj%FTqT)aQIzSahjPde+`n~-f$m2xPfYlg}362i6TnmC`5g-}BuQ<#GC5`TY#{~FA zB5C!5Wh=iKQlIcET_^@^1WAN-o@~{_@=nFuI@9;0BxJUq5xg4klZw^(2D0hm(|<>Q z^cA~rWh8u6%P6b^@)&$vg&=aa?1V3G2A1M6SqZ&5QjLGy`LF-G_V3t5nYz#TBr0lS zmX~tSG}H^$RwtnJm4@mZ_RvYK%m!uW^6&m5epe?npzrV^+VwZ47tbHYw}Yd=KI*x$ zCj9I|kFkGAu5EZn-NpsMk7a#h^2Set*UyMt+-xV)T=pcBtjEi`-BF1E)9pUR)B>&y zH~wh|Bf+iwaY@Q%gLw?TIB*tpC)I^1GmD@xwphHd6MuNPJXLGCwcN#~I-IS6n&tMS z;~a`KYo0+kku9b>N;mPMtZFn=4@wQh8;AovcdeYZRQ7Uk!fD9lG8SesNems}?NB5lirL6SBJaXC*kIygz)}o3E~|JM zZUd{}|7kwn^jsFlEN zdWB4zWKptimY98iysuR))N(MQJ3xUi3UZT}w)r zGjm86xDASHPtye}P#n;4F>NU=Nx>1~SL2tpk=@Exxi_h$o)UIdo0WAJwx9#wD2=|6 zp0ot|NBh-daJw}1GkNsGSqz+QS`~*K)Xry>Gja+?IbF^+@=kwVe`TX>8d3ADZcNUU z%GN++w#3t}q&(By$cUI(w1}S6n>KNoXSXeN5y7VbGQJeen=^F=EYi&L-g|3XGCMCu zS)0Ip%vJntX$Wy8HFF6&Sl8YBxEwSxyXoZU!cxwC!`v{sm~8i-*7X9lyN-GPQie1r zQiKl;SRoAj!WQx=Q}#+s>pSLfPYL|H*|Boc2@f&640x$qi*#p0f+KX=nL*wkc4(^Jz9<9l4+Fa7XG$qL# ztTk4P#gUNX_WlPZ3mT{z=pq<5HkpIndk%$G zj!+`5B1i)#R5ohP@qu6vO_rmC+vwnE*j%YRh^fdhxrGP{(~@&{Zmk-!}P z(e;YQgwtK`EpZXsKgeChj+qRf2Z3hzT((K>gIu2~7cRCXYQAR0Q^ZA=C#a3l2j>a2 zt?lzvPP;2w#JWg2Ly#uGMGcstsau>6SgaHz8kWB3f|g>xTdDOiL>u=)jS59eT@oEl z-{cK!l1h73GClS+8Ckqs`eNczDX42xlVh%%_K>Vrj7Z0ktcz88dY3xM7=&KJtZ$a^ zQ_DsCC$1{pEd*5>+dix0i|ORSvoLrlIUBlR(?&t4Ll(fAaQq#nN*I_D%xtVjh%>U? zu?Kz?iuZu>TT1f-eZF-=H!Fg1qj4`4kGb3Z;r@CG4$DyvU-iwp9v;vLjHOOrIAo*+ zp1J%s|L0j#@Aq7XD?anb1f7YI)*c3oeOtas@TSmIO}i;PhP! zq+d!FE#JAz`F5F@!`3OwqX8+M*5+V*6UPP)%1DK>M0U?S^q*fQO$ zhbB>!O=VNSk*?Q&*|U3?n?PSuy4T~#!7NYsX4 zSFg-iSv+kYTza}6hNzbK;a+5Rs}@SavQ#P8(y@`UTsf*4x^*R1PY5Aa?I4oEyHd`x zsDPVkZ5|vs4mh=Z>@j-$ZL|sxsH6j}1+S#V^b55+s?ptXRne-Vx;J6%ppy!GY@y8x zGXK^-s4J*|4Bm{@^R>3^8`VLCu#)Ma9b`T@tc+2xwP+JB2^ITmb$jm}>< z$(Zg=wJd1Y*kHk;Z+roEq$=lmAPd8xz7Nq zYHKoC^$ZorNr>2I%$d9sA1wsD?ELYAz zcBLf^P*dB}@61S1wKJZdb5h4xu9Ws0a6-kZ3!mzZy9?PxuCXZY!&dF1->G^NWqq&f zzNwdB0YBI;s>3saPNtY!mnmDB#zv>HYTL?PL`?&cC|g5iX?usUII2dqks*0(#58iq zJ#tI6OdiZ)DC{q{RdqqRncLrU5bp9h9IyGH^Py~zMPH*6ZSwfc)Y`HW6@9%}(yk+a zUoswK3w{c|_7Oe&x5df(mqFL)Dp8n%qWHF60oL3gsQd8VCA9+a<>`B#w)3hBmIAcf|+Z zByRd%u-*q+f)3p5O9a;z>`tdI3Gnxu<=gyeu@`yXM!joEy{#6K$72e26~2!*S+tY7 z+qO5S+GhVIwU>$$-{Bc z^Jg;85ZC(%b*XQ3Ba`<>K$Z6&q{Sx;{MP?}jBK|5>QkSc1@J#7_O&Wc+$ICe_9yid z_*CRl8Yl=JR5Q497n|1nfJ8A}&%W*XEekn#ZLiL zabVn>n2Yy81h{Qq?T4J#^L><3IpIaPWu8hHTr?aM$+9a)t+%U zu;q=CUa9!#dgS$KT58{U^|& zahnV$;L+{u7EH?6h|PuM4*7uoL&52*b2cL|N#f#*`5zpA^-hb`!L zPM@{`dRY?l8pL;z77iyCSyqe{>DE{#L%uuLrYJ0Igb7upB{g=LhKSpg9#PuQH+SA@4kik=WZ7jR z@syT}5vbWEJFjIP3pP;CBgqQI-G@*}!4{1d(|i|M+RQDOHFbBiCs;92*cRVYA1Uyt zhSlIGi={Es9H>fjV7&n;i9-B`cB)+HVzna{Mt8l9s-vE| zB-13$_WcbPCM20ms-?ybfw7K)A7+M^jk$ZH1)ekPH|MeJfi4oh{Y~xaJ^C^`^qAIm zbGmB{t|*LI;FZ-0tzJ-a%MWQ^>4p9CLGpa<%IZHmF2R#oC4;{Yg_LKMPnW_gM+V!W zo2+^+gN0Lv2?@w^n3$C~c8X>99R(ZOwd->eCHB!J?wHE%5&Tlt zs1o02GweDwgJ*eNZPNjyoVLlHVOYQF{U>ke5Kk zfMB+0tbb7n(xR;OO5%)b`TF67q^3Ir%n--S33HC^Gi@=#FO@)R?-M(nsrDI#u& z1drqca~&noYfCDJX33aTR}6XI9HLLcx}8u8T4AOKu|`j-?fNSStb&g)i^`LkNaD>@ zF*0cNaZ-VT%TEP5$nrKXX6Cg0n?e+xBNSIiBVH8D69u$Y6B!GF=kD1|L8WOFcKs7d z3(RCtHGAABRw0oNF`(O2iloc5No8b%WD0~1I@liRSS8XZ)JdW7hih11Zq~qcM-AiG z%Xd4C&6KSMP7oGf=`Fm8@}$w5RT5junoP09z>JvVGxCba)0RkQ9bC=_ioRdhx6YF4MD%Ip;X8m_a}X$wkQbVImOG8 z=jy3~u$HNY5E*}&>K5lbQr^F>2CfFM;6$tv zl0?VHYmzLJiTLjyMfAO(9LZ4p&!wb7_l@a1LSUc_5s%>vN6;yX;_N`(IWt?av$hpY ze8H&oYznlp_8V5Pg`rUiRUZ55GSCY;UbNnc@(A~WQymD)fnF*A7ZLN2 z%Sb1rEF_U0H)9jrL>8SO%FG)JKm$u4N2duerJ`|>r72`?jD=E@9@4vZw3Phfskq}xKpPUx3GqEYm6HS=<+@645JH^v>Nr*0S-<256d z2ZsTVI-HtT)ywI5!%SmlkzNrs=AgLaMt(m-AV*ZBpDn1511@(uUUXefEx6fVpaMXn z5v6&5SkS5f-3j3rfWj8hQF64VTN<9#nGIfCTy>;;kKd1-R^Hyhe~EQ_3wUWt)xGTd zLkr)hqpq9m9=6fAx>1g1yS$_-IJk(H!@{iv|6JhhKFStGfZ6(^8V9(tqM=oo&+g4=c@ZES3iMOujJ`43uNlxphy|({kvKM86t2^50e+;CBJF ztjrqYPMwGQ(8oy8+HeM45`|*R)6>W0$4S{A;EIGOuK#*J&Q)2r$^%6NPgQhLQtlUEjK@dX z6a@?{$41Gvg~U6)q8*Z<^E!yfB&@V$$V8#kSm}CqG=D@%4%%BCjF5J&s&UmpmAah?D+@&k zW30e{dz(^dhb^mAy8?fWH+-g|ETAlO^hmz$Gf6CNoOiA(4{#@R08+Q??OCt~wM2F= zZqe~)hwJca9(Zf;-fU&0TtmDF*?xFJ&`tq(pyTvFDngH?@&@JrwXqh+*z^4gA!Dj~ zD1roK^!bSM?C0`HSyM)$@_;C@%26r30}3Jr=ZfgVV}SJ~;v7A4u}G)vdUHk8w?py+ zQL#WObn4f00LE^SJm{3ddpJp8)H;?tpp-)Isq%mVUW1K!6Xg4p$Z$|h(dx_=xKG@RVAzTE;F9}&=LR;T60P*P4uM6$ zl*#_kQ`{@6AbIQ+R817>8Cmib13ng44XObK6m9k}^{Q`2;hj=^!y6R4U~ z83L@6nd12R-)Dgz0U{S^>44hR13?%3J|O5J@PIz$Iqx(YiPH)6olTskgRE1^YQUx; zq8RPb(n-vHf{wv@&7gpHm-9g)^wCow!~kFp68H@QnaK)|s{`X#mbLf95m0CxfW_w% zv{U&p)vFO@1>Gy?PF8`7#*pM@4Ler2n%PkcUqmGe%AX+d`MakS+?OG1G`AqEb`?QC_S}JP^66hR#Yls}9rLXTM)Yc4S9r$I=j8JKYg zcNfUQ^D;xcCL5RmfKsNdnf(E%V7UgrRK_pe7RtVqf{lp(4S;+X5f`>0J`>VE z7Bj$M&{NkD@^S|!3W+0~(nmiD-h@QPs1XH&80-^glV&@EsUqqL{GRW(fDnm5o#%Ev zK8#GXAv(tgqJ7b~9Fax~OESVOnr;KhUAL--^oja<&W9VD$BI)%MzEqSN|6C!)*lt~ zMTZ;L&-oXgIiwU|&~_fH&P-bZNXPsxN*)Otv7cNd z9*tmS-0$rzNh3<*;iZ>$cZ>Ssp~!qApR1b(>vgqK{jue<<+{ZAMHLc<`bWpdGoq&S zICnBv^di%Cf;X9V67ACTx2(zAebl?F1vgmmqpdDenUC3F@z8QJRE0Yuys4eE=%Szl zr~25ynadYHzH3mGdog~uY9<6kGXs`iCRUAH#CX~afa?2mlKI1iUba}nfd{oiyK&*s zMm5v%ucfy0pz7k%T%H>B3l$S=4}7N64ug`kPjNJOIGRQ&{|WVM0t!=H#Dm`(z#ks_ zAV%L7&6zPXq6BxsM_%@QIoe=>1=eq{xe}T=C7_K9blroNXt)3-paj{9cuV#J?5#^< zDxxPx%e8U8M$PH^%}NK&gDUb-U2%FBzC$_y6N^JQ&Ql*eEKeowXO0D!R;kbLsPq9G zJ;+KgZdIF;y*jivrMCAY-%GIKjcNL z#2q$X)}6_SEXdGp$}5?y^n?_YuuqBu^ODGgOghp_#gs$pitwc!Phe-IwDa_o)cFK2 z9<%m#nava2hR-^Tyj*Xh`N-$UTrH;dshJ%ijU4u3DGyQKjFMIT8nsRNl1z_KcJ$hD zIn2GhxPBFOZAIURtkKZg;WoZUuA{lz%!Ag8oo__=W`lSDTxuK#FMlBCk%vSNYO)9l zq)zUlQ{fh^x$X=%Gx_>Uvytgw?+pgYqxnRvRWgvIZp15$BNLVfTi)kMcXX}_nLO14 zsJ&>SD|4BjF`e%#!G<3UJzQ`RB9N@@t=I;?mzOQ})R6UO-8Qf|If@%d`hE{|RCW=Q#CcHK+ISZn33V166H z2V&$tQ?*oc4-=R$7&m+_N_GUW{L*H<(4yq< z_F}lJyR#xw|I=_8pnps2>xi5lYYYhM&z1=7-YEJQkmYths=a2gmvX~5CWW2pgMD+0 z95Z?;TH-$o%?C3P<*hM!KTDCQYzXmd4jTF0B}cc(ZNh$S*5O=PjGQycIPk6W*d2szsu4(7`jN@vI7z)>A!eVoU2FqaYt%m50-HGvATL`%B`_wiaN3(!GzQ@D`R#=Yix8 zh1jW+>~yo%)`Du2KN{Z!9W<(cbX8Wr=9C}Rm#tQSR!tZ*r!Kz_Wm7o}cr54a9n`5q zIw+G2kP}m*Ma*ZR?W}eO0?ABZv9~L${o^xSL+ z2TQ{FBuK4Zs@wWs{9#JQQ-=+V<8-cTu6_UyZOWql3uOwsl3yM=9k4tNngWpoQyufs zYW?!hn=SZn8@|DQRA$#IMG~|q;p|USLIUlH^D;_lV?Ip}@IOs8x4VSp^wuy~2(cmL zmpUfXM~jDl4VVorQ+2v8!BEH6+@QWvm7T}C!@koeOeIhhWP5V57oe*(Y#3lLa$7V* z1|B`ZDaJuDovQqHXd|6OUE;cWU7s4j^>`SM?ZZy}qtv?`KHD>=tLjf(H+_GnP0f>) zt>(~)V<;G24VPaI6MJ&Cnbu!_rqc5Kt)AoRbHgCNFH7Ehs&mG-jdoa`pSHoJaexOo zPL-|(7uJh;(IZl)4?NI+Ku-pp*3BQMcp^L%`(kxfwVjpWnaWp=e((n&b@X@ExpUkO zYqiFBL?0q!#jZYT2=kSvon}gTy?r0HV|Q(@^9INa?Isl6WBn!jJ+b?R9)k8qQ;EC!iB*gfzWP%PavUuPvwHuMpHQS|4!H{to zQbh}LSW?Vk{xgI2`1h$U3fbDTl{bs~o`+nhz#4rZ`)P2Pe-9GAlEM02uxWXAwDYbe znUjny`BS$;8r?nRS*X1V3^x7^Pd|5+cV1YrloD0V%$}d{qYCi341z>)XDi1gZRxGU zW&aj2bx(HCrPWV@ANMg1jhWRl)2E?$5E?sSkI=jbESthM@DLhNwo;$Hc2KpM%iBAd zvX8x&4dnZ~sau0<|Ad?e(wW1ErSiiQ9y0O|P!Lv0Sz>Nh4egj!apofDCFEZ>%nj#$ znr3ZI05RciL~|P15j7nQY2sURn0;gO!%A3B`XDsWV;Gegx4rN0*>&t)qh{U7i8XFm z_9tl>X3g>A5to4>V_by@^g9e-H2XpsZzb}Llx?HN(Q&%Z^=%ky#QLw3C$p2qeUry= zBw#~gR|yH`F*m}(Lm90BG1$4M8(0TVlP~G4HN_%4R9U3dPg?vrKb!2qLWLh}l>J7% z-7y8U5VbL==$ZhM90Xb#!Ry!g7a!fR7@ZK!-K&lp0f(cd15a|Ii8st3y-UyZ0YiGX zTX^F;>R6WfApdPWMhb}ksy)R5HLK*t=Bv?e2;E~<{4z@91|(@OnGH@y_At| zR|nGV)JF3Kj)7x>N7M2M?vJ$!)v-r{wJEqdgZIj*F>Hm}*4KodvkRlX*M`ndd{0LX zy}TT#gkTs=$F;i8SIeb334(j+W};MPzr7;aEO^%`ULUsds{V8pV(!&)nNYJXWXJ|yle3qDl# z6~4dr$qg5PGAI6dyWYC{-U>$|qh{1B8TMe8k3cF01%1fmU#-V^QCwxkPQ5^YdKHado!K~zfK|^oWP&HTxjT6JvV2ww^j}; zSe%{>cZ0#Lnxryel@kBvw8B|kE#zxRnOMqPg;u1iY&ZD=5h6S7ENPee`vbdEdHR~` z;RV@m$ke3beqEx`j_zjX#MnyZ|F%S>vYj!L{{|O-;>NR~WKr>s z#L5Z(61#~X6gY|?i*<;Nfhbg^VAZPDOjDAi_cbpJ%^TAh@j}~sI9bdXy=%GJ9PPuHjU|pnmdU45=lV| zFk=}7cqAJ1TG2r{-7ELVyiU}M#@LvXXmmm}N^kh!MeX3yQSXqW0aJF7g;%L4>zl*( zT*z6LO+c)A+^0h4x?XnM^O0n)2HbUkuQQU_Z@C?{h6bxpZx{2Ur@E=guDq1>hiZS- zkz+n0iEbn=<5Jg$Cb`kbBngV5*U=e0t)~W4{$<#LP6}oWiMGCpo|ndp_q`-k<)|*QvWMfz(4k zso)MJtJ1(I2mHZFAV-b*=#j0HD_vsIUflwhoj1?V-K3i6V(;n#F8$rQ8|6Ft^L^dw zo25EE%nWe>f4$C2@`5h~xnUg4*=9@!oZFVWN=w zQ)W})`IJ(!FN-ng38EKP*N`4+S?WCoX3E}ovPpwJrIEqy+Lr(c=4EKRW2=S4=FD)q`3U7k4E7vIeYlSD{Wdhk3`~ z&Y{*H2d?x!vq<4iQR07><75p#OG7KTjlAmZ4vp2?J^fphwxFk+ZKzjbIUR0j?$BD2 zelapHniQ#lgkcEILd#6R!GNGVK4=tzl&QL(1%FSsB#rdaJjZj3HnVNRx0pt?o0Ft-;HD87spFzTnXU$O^y<`A zO#&N&0qq@BX=U5G=}jm(AW5NYVJI@<9l@C8^HJV)3fK6ZC+aop;}Je}{|aCWk#pP{ zCWE|Gs$d4{1Il$PoLA_ZI$e!9?OPE9HUCXNzrA(M7(e6EUx4vc^^A*0tB9?rO1ITM z(=VxBg*+NK>}Vt3lBA-1tBN(k@-z;s4M=O`L;A!C2)Evzd#|cK_E0n_Nm%$j?4+}} zq=#Q(bWJ^Ly~Kro)WZmTjE$@FL%vJVs0K`{pCp-^zmyvEq}3vyF|8hJ-zS?yPj8QE z_h8E)5WNhp*f9w18Iq>nD(^d%J+wfbrmM;19^6{FSXRYEg&rTUROQ%IBU+qdjNySg zE9lUcTnOF`;HOm4%PvydW65x{`8grDRl@sCFd~ara5Ya*LyHQb8qq%9I+#LOU3O_s-#fl5of7{_@U0@5*MXO;=XM0LAkPy(Xy+2QV}Cp z;p(Hi?T2{sTtbo0#L7eTK3a{@rpj8HrGJf0{Cje0$3J~6Uv^RgT!gLSftZX#WrZvR zzS2l*bHwWI)>s;3Frj5h(OA`CRa8`Y9k173vdU^#PZy3=?Um^gX|O-b*53U<-a`qWL+z5KN+lenI|ze$)~#=5%ftCHQw z)RwJ+y*}={wMVD??FFwd(K#6z-o6$8ad6v*ycZO=yg0UJZv99)(uJet{@7bRvOHhA z-BEfU-pj};G`$&DWk`N^>xUH~S|QMtr~PB9AB9KTMbiiGjCC>nVf4>!ykEiw;u7}R z;)bBu^lI~n%|GS6+|aO{26f}t&@xa<9zLW<<3D9;eL}`?x znu)q8CeyqbVdny2=G8R7G9d0e2P(~$>>5$Q-vDqGTuCpDtHF|@Ox@2Jq0yoN#?-Q0 z%Dia@XqG6YF@l|EWOh@XeaC->Caa;c}T~`?_00#MaAYr z#YJcbz#PJNlJ1OJWn1TtjOVdHK^ZMlZLoY z$oc&d&mrtNeBz==W9`^^oyiL6xq0?uYf0(X(dU`4-Ls9|8aQm zKIr-KC0hba-t{!s9eM*GVs_3U2UK;jGuzuO?#%@U;RLI40SW%cRv$oowOp0}S0NLuul1=q`hYNU^ub*T3}cj=$)MD98nv% zC3elEwF6l{LO#ZBx-ZL-ox^`;5<9;SvB;Hq>YTEy{-i0T*ia=!frAJJYMhH#FpnMo zl)ZltKD21A-arx9bM!d?d)Ez@|L?)VBb9oviW~IwPmwpZl;LlRO?ccMfUjZ5bq!k1 zTeLC={HjMB*?YGgyC`6H7!pnuI7MAp= zSwBi-;aQ4WXfi@L^)P_Q?FH#<^T|3f;1yMYU4KgwB z;ftMHFZ;s1&YHPOC{4VUtBf1GVEJe?a|f(&1xpPZS|sxWPGTYzc|Aqx2$F<0bJ$BK zo)P~toq)0yn@Pf&(2nz%Y!x$DN(IN-*s*8{yHt!T*- z;+$3E0Zn17NsY|7S+i3q8U!oh!cB)Xqc5GR2n9H;Y#`>e_ZuXoAmFA6wJw`XC9<7&N zR9R)W$&L(*^ijy6d-x-ge~4S*n-=!LD6Vxl4`SGa4OFL#_fOoSy?&Bsr>(nE|4OgL z+eS@jD!eq7vFwpky%+NQcVp;Ez)asNJRV{`yiBIgOxT=6w!Vd3%xCr-;UW*VR` zrIglWKvmRgB~93*iDnN8k7<(9>AL)FGEti_qKPUGstny~$_(DM+Qc^1>Z^w=iigCs zz7&g;TUqCx^D9wm!u?eY+~B2UH#R zJSO%Wsm80`YZ`q?#V3e(Wq+bCk8<2DlnOUxexet(7k&LCuZoJN(kFFS;A;y%0TxZV zkrGvBX?c3PVKKsiZcJE>;8UBv8Brx4Sk{0Hf$}PY{q0hKqK=a!ccMMffU?Hd)$N0^ zRXl7A-qhfyvSYXWSCCB^2CIc)L4Ul2tf-dw}lDzn09tfRKcVvL?>G(a(GdFOlh?DGV)lqNd{kIfEg*0?Z(r91_Aw zm6@{Dbv~eM-bygjn%w55wxDhmZ;CXaxjbZw8tx#Uep0erN~3yU7ra%`p!PevoVCMJ zl$%|&Q*~}o&iL}QEEuy?r;8Vt6I(L&LX+S9bNFcd`|FALagJ}bnMjn4cMP0(#4{Ex z?tn(b1P22z6Ia=mf@LRJx!jFcT{|aB7!0IQm|e2OueLPesP9qz@bGdISg0Ka*FSmP z9>(JHtfS5A`@&kf>`ecE{{gep{jU^B^z8Ki4Tn3eJ|45hg3x{X8}FK~i{PZ2!{;;j z+e+jJ?I344PRu@(`sov4WFOzLx$=ZwuRpg?*S_>%v3xfR5Lo0($A+B+I}ob>ok_wo z_xgD9Hh6jWC2R7Z4F;P*&?vbDSU(^txZ25ES_SFFGXI>+WQ*m(@LIZnqSK2-JBDB zcM8QSCC&x(5Idp@KOtSN-^V;z6urr zS`V^f>0gaab;>&olvchn6`~cp;~cj{(74oj;Bu6!hCp@sDP4?BJdc46-~$>3<@-ab zKc@rm?%yQ@!0n|KdYvT$+l~TXr8pMj2f|&@Gj9*ZHcmXjzksNc2MG%2KOzAvigK{~ zzOOLnB{?>E{?)J0K+@q9j>fv5i-x4J-)zAElq68dO-(e=Datk`W+U~r#0EGh7sZGV zo!~vF+-RFdm^d}P;^^c_D@G7!RM&~F@)nL$By;){ue2Hu1vwMn=Qc4+sGSdY5Ho}l zKv=K(7PZFD>CeK{-q@Ut!ii2ShgUBiDz;@NG)G0qXJm5H{)$B(9z>?4{={aB&DRj9 z!=M{9UlC{S6T*AUeZRW)m>~r@Q%GUve=&xOA+QihvW?{co9dMHt^&&#%7OWco;2(Q z5NOBm3;MCX?KR^EH{`<({SGqo;@Sg#rfRj&0sQ2>Mw#YG_-T2@FYLe7f#eZ}C24=_ zb>`1!CHVu($8~Yd4Ok*p0Fu^NP=?x&IP_zI|20iYZ6tf88bdGq1asY(VB6Aqc%sd3 zqMy0RV;(3AmN`HQp1BA?*?*GPd~C(wsVS-_rSlRjl-{9RK~&)fAjD3aT-OcF2QL7W zTCzc2Ub_gPBy`~}(YByk0b^2hDqvXR8s`yjctlzg!D*G#En{y?!DNnRE?n}Z#2yFq zEI@ghJ{wt?YMA}6d?1vh`q%(pYcz5`UIbE0O^<@*flBqS*5s>F=}|*{rKVU>=tC1S zM^B|;`%Kf9PK|`- zmB#T(VG31F;LLy_sbRP0%8k2`%i$S9Z^m!Ryrz;A;S03G# z_6T=DNskrLA6DjT3nPZ?=`5?y2YIUEJj9Oa=ZxK|d!?1D-TCl|wo(NWG4D7tbxpME zu!lKiW#%c381O!A+Xn=7=k0c-_U*U2RF!9Enk6NlGs<1;O%@UcN&h-!5M{G%7R)Iq z=R-HvCB!VLW!B&A%7S9XMbs}WJsVy8cz4A+9VPBB%L`L!r{<1rw9ij!a1)BDeu^Ugp=|B|EG-g+yr<=tEkTGckUcU>1{-4$^prqqvfPmxd{pijn# zr3z!!B`893Ecz*Mf?)RDCz9v|I9v&RZBofaZ{|lwOu1xzaW?Y=_WorVDr7p&&BS8P zl%I%_%uB^M9%a}d|CtmqR2(J5gbwMhN7koA2D6BU&JFzgg2+O%bj$JXxi%(wC;6OO z^>3h3&erE(GXx1PKT?Xb)On0atW~0A>R*jON0QYI{>rjAbut4jGcS3#S%t-&e}knD zEDi>>W z?ZZCxxK1@Sd`IZv^x({E3(pBn-O#Rlo>OX+7vu2)S{V!99tCo z)Qg*c<70DEJ8R5ppaxjEyP2Qc{tM zsFiYeHCKW#E^_`uI!IV#`2ph%mDp*6BDs}Yx=Dw^q*N@Eemdycv|;P?;rELL8d25z zgL1dpLx6|zME6l?K?(HZIZjh}FSod&J|{^)v>^H$!Z>4p8Rj1O$aK}6T4C?C4#9PL zO)|)Q+br8O#sMiAt5Yfl^9?~5fkJu@yD%3j4%GGK07^pNQS%(h+2af^sCg-8LT{hg zSr6i_R!%RMc6o|6!1g~PA+A6(U`Jd1T3YQGHH4|$hc;bkgG^VxlsCnL`U_rcZ{#1-l`5*3RKei0SQY8yE0#KTAK?#XxrKF&}dnglXgUX;CT zJGZFhNjKgt`%dI9!}m2fGh&g;kRz}o@CuIl<5v#~xQyD1+-fNiCSkpRZa^|2i)1n5 zC{BR;&enVe3B&neAGeW5bnXj0bOmjode@Gw+-@)|%Qk%2H@0#*WKy%!U;_Vcz^;Rx zRd?x#DYeqcI+DZ942%grtIWCNpl-A2DH-+7o*~@Y^P8qhhVDj2uq{k9oEDdfeK@F{3~DV~(Eu^>D*_GFQ$R=pwh=kffOzsb zgrlmM>o;^QD5=a|y{7H^12BMDz6*!PkP?!Mij1*QEyUYQt;6}#0EUhq20-vdH9_

dre)*N}IyKUW zhmIff-!CwUY1ttZVkjK5!FAMY)E^9iC+AS1*&9#>?d+n{bg`=vy3Ez*RI;q;3X^xi^7dnPlsP99^Hn(1Myn-gWFG(u|Oz)p5(7mGQ#>d~z&0cd^t~ z8LN=>BynR-gJA2WMV$FrwXQ^|u(i`VKMZ4L%f+b$XPJ`D$9O6UQP*0O=L-x(SScQs zD*8tka58=t-!8|k#3P?Q^B|x#^vwGy^rt~KTzN-qJQiGVEiq=N{BKgSDZ5wlR52a) z*%YFe92S)xq@68L4dCM^{47dNljTVuYz>r0^gu(W&l)GlEQ3^Ss$m|5W=qcB+AO8h z)moUTVTLmP{Vimtf;2}9(2xhM{spB1UV>MyL`bJIw%})>`G5ooXLh5vY;XnR_a|WA zH{@R!?28(n1pu7B7@qM3wKKAn5;2D!B#BD1LLc98Fjp2i)CP`ST!GaqpQ47nI7z$P zD5~lxI}MYJ4qlRFDCOLOAxb*o8+PTRgW?n0Q1#-GwWvKK{%v6Kq}MWkBtyVb#(ybs zq}x$))_I;s*C6KV0wCCk)cHzn1$ZftvlZUIRMJpdkJhW47$jSIA^1Jf+n1NFMbQzV z#Y7zR!DUv{XK!4&;P`w}dG!YHsG6{O(on`7$?ZY&^q~C5gUnsY-EFY}owLjanQZR> zUZkj=5Mf`A|FaL?EN)h;uOkpHyaT-;aTNNOd!=+GHSYfKx8Ya$z`%zaN!gu?UA+pV zc||bAM)rUicaEcb5pmoR$>s|qMfGZvrO}V4u%Dvx$5I%d=^G>tJL1og51i9l7S>A@ zholWxc`6@8z%8gb@#~=8#)5=BGI7c)#$WcTm^%|zv6aI4oaGT@nKGJIEW#8|R*~o} z_ydSD);~osa`Abl37Yf+-fB7D>w&*y0HXaJOD8^HVLxc_%Ql{e_ZPHoRRuA%Z;(P6 z?r#*4cAu|fUn~gZ@c&^ZGybo7h79y{O#f$ix?7_==8y&9<`LNgkP-X)51kUo7*5*(7NSh10q#Zf|&!`<23K}O)eZq_{ylx~O<4Ni01Q-S&ik8&gH3-cyT<4URf2 z<{BZcnQpRGWIq4Vm>PFTv7dMmH)bFGvuijwh=Y`)WBhdi46VnNf%b5`C>~F?UhSGqHeTfq3dg2J2^n0&LtI7fqP!edTI}A-BHJzL^ z2}y}BdyTp_qV$3XK_=57%mvhsQlA(lqy+f&uYJlctp;KUT?RqU;mF}jloP}O0dBbN zj@oR1WeM*JGeCmi~oN(jG+7pzs<{B4lB~(E|=J;DWB-Jt|3w{ShzBZM7pB6(G zn--aJf?bS3WD*-T-=9Zxf^;`vwtxN=G#jyV@80J*_42s1dTxq~2^AlCnQZ!C4juYp zPm*F1%e9$f#9>4a_(nkQ`+3kA)~`bR>slw)x*HBy z%5zg7^yXW)P7f?%_#tybbUHG#Wgtu|txO76pUq8I-#DLw^ zQ8S^?;07kqC&GFRM_pxc=~tOw2^tWq5&SH$i4%_uPChD@z{i%)$JgU(iGSt|Q3(D^ zyp2}{Yn`r8Sum!VNkK02Pk1_>GG1efswn8PzKa7pRn~aXB0RYfhINbZ7*7+8fkyxD zrb<8F>WOkV6=l;p1LS;sq%Z|y%T*dgJh76vIHE(bfB90vq1Ne%w%SSf7XcBI$V&2r zRn8^2P0m8#j82-ir*SDH({RUA&YQ=!%{pt~R1DPRdFHLvqAT;>Jf_>3zX(d~53Cbd*Z8Pl;VM1v7`?t;pET#C81zuY&L( zlt;4kghi$r^0#cEPZAO23qe*$?04HwQp~O%l6RD>sw@eBwbeRn7&C3#T}dvEwn4@s zxFp*!WUVceUdfI}S3ZBh2hv^g)juuyTi(gRDpv^5ypC}&J*Vh{wNBR+>}u=-P@()d zRZGzXV?8F*MT!bqpHkwPPc?-s>>MBiNAvNe?KyCKr>w~W>8YiRXo}5(S9J2$c{bZ| znU<^Hk5W;j96RpAVR_ddROXn3_OrBsbVL5Jb}y-w>BT1{4oE8B5lR(!ZuLxUo&T*1 zCXWbbJ@^g83}Ol!0kK>)0A$fzVC*enN5pJH ztC2opmS%bv%Qg`FGq=T~4Tv;9Y~m1YqrV?S#or(mKrfoU0h$8~%zgzZ_Yua^4KQa& z6qb3v*bfD^oY7!#L}pcyczw9 zsn`?KmUXT89y8@kZAGY?lM2I1AGpRhbA+6T7&f{#sF+}7r*0|Y8CTQ7%%-szrQ^p? ztpeZ%Mv`(y7g{nny<2}=Eqp~MGGnqi-XxOn4tF#irP(|`Nuf=%1rbwRBfx;^9Q{6_ zwu%_euCD)4m9zKkZHKU<#_fCMaS1~Set^sqeyLRnJ$UwDLKCC>I z(mOwIU5;>YqT-PvBIm~YWQslKgT@c3YV4k!mkZM&J;!`+C8>|2zfoVF2hk6p-T*|H z^adA3HmZvbWI*#(5&{ah)XYy%=zz>edbQ_kptAI*Bbj%x~Ijqu_dF;0)md3)pY_7 z!)&RSHtklWxv`EY>)FCX$@X1Hr%;TZkq}r-c6m8XOLytTJN2b5g{}5k)~7lbef^CcUmDU zkDHx{he2cz3@0+5I`O60*?lWA7~$wyb;+@cx0tCNB#Q)FGe*dYi;I?vnkU}YjCRos zM2Fo>ugvIu=v|Oa{*Azy2GT8b-D?@SVT*1^?=B9qFtr{RCtuz2!mC@;alMbP!48$x z0wK>@KG`YyYAR`2Yb17kH?Q|olFuch@v>D4=6;@7Isg0{^!>+z-Sj`KAI$%|^@D|h z<^NniiZ#Y#2HOz--$#9uHboE^93Ud#BNp-90BkGC|IbCEOl8wR)wyg|My#k6(cGm` zw*SHpi}byO@Py!nY>189%RfkK_jP*yom#s;>+2YpKrm4jQtRACMj8bZxFF!p?KS<= zA>r65tTtZ9EN{JH_l=s{g`d#mokC6JtiI!1VL9-BCi!er+%P zqFm}t!`d?%6XNUp|MQX6a;tl+G<=TY>bJ-^oL)19Q)^TPx2N0jxm zc8nYXvey@@>SZ80#P`Sb^%qU_NHvgp`MbgJ{`9pc+s(8j>Lwu;LUDDoHW%yeHDhWs zZ8e+P2qBL_ss1&gXxC?wFi0MPfmC$M*On42*4kT041cvMk7O+>2wrAIJ*D2bFWD{Spc+9ZY5y6rMqhB#9ydJnk;YTK#b7S9i~ zSf8QBYL7Tme#tf2Wm&-dt&4+Aw+Vq-My0!t#X%TR4Zf#yeUSmdnC1^v>lFcgcPHgu zI(=a+X%dehK;5gyw1&CXc}AZsXV0IMl~rYSLU ziEHv6|s?uTc-w`kkg>LCOi+KE33@6ADhz1cNmMJ40|QHMRKohj zL-j4}n404u(txM>@A7Y82s!uq*AazH^H9BoJ)wGP;2z)ifGz`9tLVYaXQGN51l}je z9UpA3v4vg1h`7*T3~D`)lsjgTT0?S@MDJXI)gb_;+4!-!Ms^Q0zl(@AzVw)Y7A7pm zQsXG?cXEwmqK|3xX5yf7T7-~xFi4Fw&}V89Q4^a3xvBGYIOwUT(PXQb_rc?6t^eVg z_jKrvDrpfxXy}*HU0DN+9YWvoN{gD9)5&%>L7(&-EsKg%87v~~D_dDFTM6g8WFZd% zmh4S3BqD>Q5FFfYnDqHOfuGcG{L39oU0+Ns3kXWoKW28G(4fz-7tG06mHiSm&G2}# zi`7socGTK)wtgRST*SttT4sCXUhRe~h_MD~1$V<=a`kEhi?iQ#*(c?)HwZ|{2mte~%}XDN2`L+iPU-lv_^rqOzzVsV!-Iua-RTM>Or2+uX+S zFVi5ZbU1fU^~%@Oopt+b%vIJ>>nXkP;ng}}fo|H`x&5*|%x9ij%2fiG{Q}#K;6?^< z%1gXjVB0KvG!Z0?cFDvhu>g=2^MbT18T*9pD#1B2eVOj0g_*qLFSr#?CGO0M?a8>@ za~6AaSa7!ipLP6)gNh|Fnii1P$@z^oxb32cE&wnGLXVYHi9+!!{=1CC`@LEU_NL!@y7U*#PsLc(JM* zP82B+At66@*?745m;mbOZbdHSL+RJ{4KiX3M!&T#`NcA@7-rvXWHDnJ{sqK*=3K#T zWTrpjw>ENu8j!y0Mi;mDGg-@u6MytzX|4(x=;W~`pZ)k&synR;JmpKDQbK8EC_Gd6$J3Fl+S4>&Iizy=aU7OTMdiZ zVX~FckdiR@nT;8j^pJiRmI&H&bV|+ehErSM`oaYdmK{?hk;oZ#Pev5I5sC}uP5p?}W5)^DeMK)s^L;

4GjLu=Pm#l>yJc}VCy_YgQ|00%#QolR=N6BOm~ zyto7Jj2_2MIh;MTEmNBQp)JSz=U1a-rT7rmB*|FCso~-+h@+E61Pb5dW1iL0 zqBQ5|73@UmB7$V|7`?jI_LLBzu5K4g8uC`u`EqhA z`gM|u6zCu>6eWpuD*8|kM%U6;K!s`XEd8N_HEW|qYS08&c4>Xe$s|>$ro$4BCPVG{ zNIkjC0HBa#B$;$KaVSCb28PYYc42C$1&?O26(Oq{ghpe>NtK1398Gb&YNsU$24)Fp z^IW5evkd2M!z)9|4zL4H{Njl%@m0B#xn1F9o4rEzcP^r=*(eJ;<)vN4V@JgWix`cM zK_T@RzCj~H0mKiQ2?l&Rq!@(9QE6DDU@EP?EU2Pn*+;(c=qiypa)*k!62{p+2C8Hy z9`NXYq66ZNXS?)Hbq2BVK87%kAt& zZbmy!`H~I{3{3$wrgubhR?Q5-N-FOv87$6lQ2^8vN9ZA_r3w+w4wt+Puda!LO{N)z zZ^r;~frtQw+=gT4ghB=kg{MK$?A!BsO>np8ihyy#CVeN3VM77IPeSPm7@mW62ouo zc-5g=25tJqf1`_m0xV97x|k9Gv$M->{di+sJ9l*zeAp8C1G}A2ZX!P zTJk`Qw|M^_#?GlpvjEDnY1>w%ZQHg{Y1_7)m9}l$S;;SL+qN;)5fd@pGd&aY1Mbtk z4|kul&sq(%)bq!iG8GE9{h+*M2!~z`yq+}Hw$rp*AFRIqHAbE@JBzl_|8BT`-dRKe`ep#75WPpX7oRK`aH3D`&=3_320Yr;t*s zRs%9vyue4#OVNiQ@f>i2>4|)o*X`kYM=$H#Ufnm0=^vk`kGSLi=J@uob14=@6+y%x z@C-<6PQv&mSt8Bp{A~ZZ&^f(uWn%Wbkw2ZH{pZ#Zi+b&udP|X>>5>vjW%%dTA%jPd z=_hPOCs=r8^J^8$y!j8ej)qT9>X{|6)^XTt!=2V%qZv~MM7B#AU)y7GpP@&tTd-x9 z{K9_QRI|A<+V@$eFB`?bJU#SMyPLg%-X|h5)aUbsjC-EYsgBX~=R!crtNQtl=X znG+0gO5Tsy@wMR>l3dZiY=DZdq_be8|m)PqA-7PEEr6GjWkN7YZbArXr)KxxkB%xi;@&l>v0%(qd~MTlt?;uJM*QM6 z8i_iWMw*A7zIX<#q_6K^SRrWCe%xRw-LqK2QOkc=GEYWlDKGYD?`LQ57?a-nwKU#@ zvm}Kw&)${gN*q?xyo|nv6=9~w7cyiYIB}Dfpo+S@2w71kWHUs)Oe>CEHb^zkFFtne z$68K@qAA*fg1KBE`%*}PZ!Oh&>Ve0k7&Q@42w?yh`=cV(!aTKqZvN4!4@lGnf^4D+QY*5osrw9|c~Gty1fGJ9f&$o%o@816lxoFvo> zoqM#}KgWP<-f22dmB1{{Rfkx>7TKR{{Lii!w^=pfPx+<5q;CYs|e6%MK_SEYRkTEvLBj?oV(` zK-h3hvvEse6sEPUL1p;)_{e_qYG(Ef8U6xI0&DfuSL42G26_KJjgx?P;IATzN@7)q z9YvLdEf!-ptOd$x6As0(28k0%`MI3oH1>9~C{~dtTw531@-d#bvEwYHS0(yHQt#s) z9NfjEY`GXOl6QJyAr~k8JcSqnM$VNf6X2v|+B@0E zY4fOLlTdiu+={>MgcBCdiyF*_7nZ3|Jb|x@!Lq1#EFVb)k^(QM36qJbT3%Dz)`OuG zxS-J>W&b4MVb3KG`ywo2RcBa}#DIu3xNfFoP0@emarK?pCyA8^$J~3@ub9|(zR9-D7lBM zJN=bBM=Qbl$28OU!$i%+*aQZLOCI{?Q@+eTJEsWCMwyRt$RRPZ`k2$y?#V%|0?u7v zw<-YrfvKqyx35K(dpf(Y2tqDmbmmv+{oAht7~v9yh&*eYwA`O~qWX1vDb@qjVnJSn zrwFW$GDFNPTL4TLyqks}c)Woq6F0~@YrpffQgUrv6hx}WNP_E=duTfS5x9#1WgR_w zmg?ph3rRbHCR?~_sX7~uz9Yq;6$%wrAtdiehYlnHEC!-8(ym8dOYa4t=h@72%D-RY zINjxcgbkW8ZX!e(pnf&5NUj<?mW!Tnv@VGY!ALnQeHc^WB>H1`BM z4PbE3G!)wIr#-nFI3N=(jn+`SFV6io8`>0LiX7D68hQze&F-UT-CkR} zAyaDp!AUk({OhHzpalufT%49MKO7Kq8wil|E5zS17~W(0XXCf4>jX-vrWyFiZpqam zRuD%Ss6aMap22&gX!Ny!G|N77vXM1dKZ_19#8587es? z+%xC2&VW9rUKXqBsPbhC>AQB2-#i?lE*cj?Z!3#!$jr1jd|3%Nk=$ggu{tr*eQTSb zm`=kxYHM|%t7E^E@V9||jOJM$(IPz+BB(c`XSk)%f6pWk^&F56@9ou4eNT6XiUP`kHwd>G1FVkxARO>PDkBm_dHTC%DUx3k8fp> z;4Q}WL-$vTVQw*DQdOm~=ytIn9R}7A^ve_vGe=p=kT)_z9*R77E8CK-%^>xX*;Jjh zCRe+H`tF@T&T910Agu1rIzN4CkJiwbydm6#@qSl#Wd*$H0s!K@q5x15H zj+oD>uY)(h@txk3{gi)?-lTuMWoT^DUQl1dQzmEmtQBDkC_LEk-&#z`;$L6hN}Me1 zCO7p;oxu@ebGTOob4ImbAfZJ)4jCDo%~m!2wpKW;FAed#Ew^9_5m)v>cp2=TV{Dl} ziB?`^bgiz!YS{A{GEd6PTC8~)XjPqK5h1l0B= zQg$$H?;%)qR<0h@A@Wx8EPS;OO4q^=b@JvnFtzjMaqo+#YD$$W%S_+pRn$TBA6SDv z(CW2XR#4>?0DPCu!q$J;`Th!%cTtn|SQn`g3^s;+!etx63+TQrWm!zoB`~BQkw6(K zGD*axh``}_s0b+vAx^Nujf)IwDL=kxg=TDZ^q1%}VDE)k3_UULbn-?j7NO1poFmvk zgc!>N_t$-c3Hd3N)pO@eSpok_xdDU=6YoIQ++Gv%L<3%L+=JR>#wes=AD)1&#Sd!ZQU^!lb_;N z;DBFNmJISWwl$yW_bNL}I>UN1&~Q`}$Cvrz(5fqFh&~6CiD(c>QJ93P`;HB1F!K}~ zw4L)eEb$NOz@r_WjeAMd_AD&u4py*UZiH-fM89&caB=v`hxX?--=}SpNHh!WVf%vpmXv} z8Ny@L61R0cRBz1El6dg?-Z6mTMySZzM|Nfc2`#JORBqJw&^Is~^ zIQXeq@c+3l`vLy&Igu*HhxnyO%eCE;h;{QH ze@d2oEd3L7{tFRaNf6;O0hsY6o27R$pM3Q5*(}vE@pZQzLbv}Meyd3S?AtWy%et~7 zzya5;QxcsEC(OLTTQIAYsG8mDG2Y^01ATEdRa6tE@zx!+m6s2Wq1FbRpC2ED6h#Mj zp7@BE^3%UfI9F7v(kCu{eWyD0jKh7j-RN=eJ;g5+57{XERJq(IMg08uF;C06E#Ln5 zEBx?&Jwq%#k(xV4mCF%Ng1dIm^Qr4_QkCuEK`!p8M=Dz6dXn~QWxD0wVIyP%`qlof zToIQj9frw*#y3|FF;B5DY~fgM!fNd=LFtSo`&)lPcY^Gd3(dbk4!(SXi7G1 z9FQy@Gi1Xv%b5Y4bC|TzviuDiPW!hb_5zb<*+qhox-RF-RcAlaf`K>LuqLi z<9rlm`@JpY4VuKlyoHqHnpw{URdxjlUGkocQ|s5*pbt-MVXj$oX~`k03>BVBt^Vx< zsw+6E9TBhx3VoEJVLQ`$YLu4BnC=h%eXctYU%}LXAGuE1vsPX!O_NP7RZ-juUTWRA zR;Tj>A^Cw`toH=lYZjeZ0E&wM=#rdEYpT$;N(X^tw5L9tsV0Q8b#rwt;LY$)VV2yv}Le0Sf)DTnk8DQ)m1) z9Y8X#R6hPv+fLmA;%*VADk3ZLb_jPP1r^bi)K@)~73C}0m^wYF=)mu5ty)-E)tMVW zlY_dA8>^Uf{e&SQ@Qf2+Y7)1F9oK75T20@0g^4CGfl)K3KD8DRqh&;ikl0Z@HqKfzD{83CSB#g-kQNiR@CX3r z;&9YtQKeewYp!NsKm^%T;>lKu$Z9`3RkJb&R>t5QyqYajvLL`&hF1Y--|a-+ztz_M zO;F5wJluz?QAu7-`CY+D5RG|+z1$((kPW3Kq;vq3PBmR%BBI{HtAeGs^ma}GG@r&$ zew?>{WR*`5y&e*2YxlRbtOOp>0H&y=dXVhlc>{%Tz{M8#)v$Cuv-#IN$TS z$z<%_c5~M6LOW>M4q~B(WK;YVPVm+xNR6%D^a2Rg^3r^WF~wHnbz_dL@kPHAD+G8t zi7{Pf&08d)^J5K9+UqU;PvUQi0Io2j@cr$~@bB zmj6c3qPlTOW{hKr-J`N%wIi%!?=Zj0DHfV8DaHp^>M`0{FM?d;;jprLH1#@frK%C^ zezKDvmKq9aX2#QF&xmY&z6?UYioEaF+Wsr1~lh?|kLbb;esBiCWD=)(` z1V~4f$Zlo|;AGvb*|>Nai|0!jjAcvy+;&o?hb<-!=H4#H#k$+1E1BKzCuwE~^&ahK z751rwO02V}OysLe5sTqyx6)&iK`((EkG2(K(9bT}P7GlloTC8o{tf`c| zcTRv3D?&yhY8+eG-^s@g*Xl9}55>lqFszWHa)vf>sw?b*T-6t9i{El~bt*;&okP1J+;L`Lc(oq_vE+Pn;ZO3ER}UP{G3 zKZT9{&jFfRaa6SLBD&SK9-R^0^ktgzt3pJX$Fc@-SV~W;wv}8vjXVDW-GSg1U$C*= z7%6`srj=Q@9KAot_k4R2-3gM9;f|hBB4KIVne+&89W8DFy4d$Dg)}9lmK-xP+c;TW z8f4gMb)O&4?Ic;~&yNB1o0RO6sd@ONh^;Y^CqIS~%BQrI^|++ta>kbVl!@s^f{QVe zhlswS6Z#{f^ z-*`LV5EPb|$Bv-DB{O9O2$nH@IWfF%iSN=r+xSf15^8x>Eik@HlJM7EIdBPDy_EJ}RlPE+jSCBo zKoY5>_~a3_Wmp4+r8liCTfWSL<4Q*XOlXj&_^wyWH|t*pISh;1(u6I`+A0n$m!Ua7 z9pHsz1r2_h>i0Q1v|7JDCC2MDzRWLTI)4UWWlPfKq;RO`Jo z!dR}B?y9Zh9?FGH9|2d;OC)9T1jgHEmk?NTJ@`_3cV=F0TguL8-8k=o!#XKZoGon4 zsW3ltP(55q-fZky0*E*mf%VtN&P7H?F09IIp?Z^rs$9Ts*6>vkvyRRPMD=BUT_*W| z1TL95<-HcvlR`HnIXSm$X(9%?R?>6ZDOvtWF1u)(DWY;&Qs0Wxiu`tM*&Qx_B}EjO z{gO<2D<4Q-yMuTPtY-Iy@&x}dyEi?dNe?IUL>N{X@_H87vsic1rZ`Z7;s2aO)pHC| zK$i~olbhC=t`W6$Q_ZV3rh%4-l@%!`ew8sCBg>$6ioHeD%Y{S_!?mSC@AV*YoTWaEAh&7?-X%e7n_Icm$N!}Y|P z0)k%UXUu9*YEy`4$sd2Na~?RILJ0V!HmjW1_q^*y{Ja}wDDz8mDx@?m#=*Yp2Mj6L zTP14;mg5=SJk?uHDY-hue7x5}Rj$HB*P;C2$vh~@*j(NzxZ7%LV(X}W-2bX8r&2RD zHA}(g?70!j=zwu*12N1Z`l^-3YTJ*k~K2;&v0@Au77UYfqYQHv7QaSshZuHVM<8+a`UvYN;D<(CYEydHnDxo|lv zy$xVx2AI)a_J;`4FNL?elLic)6Z2I_%$5_#a6;$+5v5K-Q@A_aPV@FF)qdYv7n$Df z6`+2Dg251)HY$_cg$_S{knp8gE`&$*Ex+>2%qq?j3j6#p+l=T(!#e0%|H?;QH$4U1 zBrQ8x<9mD5QBlsmiRKk^n}nt@>*!{<5Xx1Cer&4dh}TdmbMGbL2SfpD{Q`t7H%KEO zIvX-`Zv8-gE-cJ$9m)ZdQ%wQmyA{-J{5lCXaTQ$dm??p_P2Hld$>V*(O$Y0LxrqU4 z+x7Ev2S{T0A==snNz^*CIf)XKG9$J1HHFuRK0g2M*Vv4U{`>M$)t_H*&GAV)Z~uZz z-y45k(qABV+map5WalWi*tqMxY{9usP`%dm;h({l6!)Z-G;8i@f zWKkcgF9{odWBSU5HSz>%sBniaeafoDMG2#(<=OpgM?fYNoAp>+;m97REX+&XfX0|+ z9cWJVKq?khUOr|QQD2R>GQn8zplq10V6a{l#>)7Y%XF~83_-uc?S z;&-nuipu&F2TO@V5%momU9C;}l=N~)DnuT%6iRmT>=&a4ovR!V<35pCgWcT1LUWBI za(745xRG4xs&BJFJ-v^&0t>T=6*poDgiWf|6nYUI5=cg0MOOfX)pPr#x6ehZo4pY1XBPxeg(OSh)g%%fZ(x=O=tOcIoy^BZfc&`kPZE#i%*o@ zfFlhYE(1CCCMC;J)SrC6&tC~z2HI7rQ+`nB!bvtzwr^Iu%~<349|AB~eKAJ-V2pv) zoUd@DDT9aN%%OeK(JnZyS`0cYkJxhJCEXLv|42s&=p0d*jRi<@voRrp)a%o@q3XHi z!IGZ`2rWD}g4-7b}unkXzTXo87ZV^!-$mMJF%^uWQ}cj02b>x6dSS zRL3DxYtkEbOg2$eRIa~1wIyq?+q~^jm?7>d1rzSc2ByF>9P=WpAE}|^2Dkmakc&sA z?4RtA@ud3aN=kFg3)6V;VC+o?BS7l~(B748eOxApY!9U6k^;Hb9WN5RCHW7FX|U~B zmn|u%!Ohn{c&)dJ!^#G8b+RO!6^HUYzn7V^eX5AbX|-g3A12H}tRA%V91b)aO#eC^ zTgaf@;4%9m_9*Lk%}y%4OhGwu<_M$0xexZ+H9N^}&y-Jr%9MJoVbeVZ%iQ$*Cb)i| zRJZ(b0Wp%#qtIme)GI;b^LT>!- zh}KE(r$n65B4WpQxN_VpJqT7zH=khBERN$JX@G*P{M1;Mz~-L4f-ZERLv{FxxyQ3cA3T(nMUQ40G!^E!g{mc` zhFroKb7v;p#v8AM)Ic>$MnI+6sL3+Xxp>U{bSlPHbn;O7jdHnGd$jS|z*UpKV}ui> zyt7?hr5!&E4jJZP*55SnU(sjFcDBa*<&;h;rFXg`QoSX}XiPDm^p=_6E$!>Ti`Sfw z?|b}Ns~$AaXp5&Ar{`(1J36c&eVCXt{DqV|(b87^8L`@>A)f@iun!r-O^kVdK}^Uq z68G_8BPWyTZTuujee4T?rrS&}@&#P_bwaW&?07Q;b{C%DW7nH_D!9umNUHdd73& z2=m_y%+Lf|TD)QQUWiWbS($9g_ApzdVcJ71NLFotnhNn89^qymyV14eu&{Z%`HHMU z?^*~|&rxMw#;Yx0vlCJ!%kgd`x))#8DF&*;(1VFy`jkzV<<|@CMI!O#To_IFGo4B; z_b-~tJwcNBp|`J1hT$U18%;zq{6prk(h#l@-zY^(!Sendq4HTg(st#;?)Ck0UDsS? z%z!PmCpwPE$NkZn(gn+HhEvH&SlCr*LgmYwU$N7xU=XNGa1ZqHnPMIHY)vO|xVou)m&p9>RPa||ekB8<}YUJP9_uRL^@;UXB>BfNN3-y{oiv)U1~9P>Nb zSezk7v1-fPVwa@1HS#dnjESUR$x`|vq9-+Qfle24zm#Vah{7N-C=%K_T#OG&h1G8N z(iHPBpuW^ijJIE8{u!MSo_Yja>&k<^6rZ zA$S#i7xEov#2m7wIo1<5;Y2XoHV|EhCXcnA@arJV7jPJ=v5S7VMsc6WCa6pJRr|{9vvQIxq6#Sh( zD!_fI<|k{bWnl|6f|B7qr5A&2f zmx52qp{#>@JvX8BnM?gL{=OkerSw8rMU9qN9wiG;I_?67!GzEfz0VfZe<~V zIB2~lH1LwrTPGVi(p z#kE?BQ${sq^7RFqS8tV)6zcPWO8qpAH3V-{>Babw95$eDwA%*DC)Wep7CZTYb#Bcn zkN^04&nci_4A|yKu+zRg;}?(f1C?%BmI9ZbgWT_fk*GCRp>&m&+hF;n1hL!o&a&{| zjCrkI{@?6v?zEM#y<+94i%Em~7j_jmSPSn>%i=!vLxg-TM%!lK&XOzmtHfJIIukWl z$f66>7$@K2Jo54Ek(E@Hb&h*gW~{?QO39o;&qo4(G;qd&<8BS-&~hf!?vPmR_FQD+ zM6Q3VK89eXktUvRbni80e%!o$zMd3*AY+Lrf&RPj^q*xp|Bosg$N#p0(gnoPbo@t^ z?Gse}A7+8I8!7>ts7vaaer#}y-aJW5mi_HZ(O&7PUdPo@sco}0I+-$x*JmtEfZk#6 z6_H+DxB71K4X|?aI#TEH_Jz}6i>od4pt9^82O zeAe*fMGCsF9+f$;{xe>g6=ghz$VWXx)}2Urc5&A*^SG)KHhNoouzH{<`n`bE+eqk? zdBC!jM>6HyaneO${JIj~re$TI`^I`!4;W5Ha)pGD%goRYigW>+9C=768X%A5kotx{Bvq5k zJ0|H}s-B!Lq-5gvs&7ewsrK?w* zVlZ~81E8A;H3*9%eCdq)}@i{5pc9Z~L zV_CFlXOcd4Q(M(5%G{}klZ#^?mlPylEQ^OjE>!~ZpVn~vT77eEwgQp&`jbHi4V9yW zEzE+Ra+8eM%)fLy6jUlPN|JQH7`1-nd$ZFEZ>*Z3I6)W7=bZ4wmiK)mUaA&$K0<1S zYxe!3CZvzBU;NZpmx@sh87$LMEej<}Xs>|_&;%Mmz?T9<8H-@WmXu^*QPA(V!LZb$ zIZgE^Uzk+Ov*MgWKBm-2_p5ZMQWa5dUaskzv%z~xv*+WkEej%8e+!vNoQK}-7=a0m zgR`{)4r7jk1t}|4%_qH=+*4Qv!@Hwqd;|iJ z2f0eS3CcA*Fa_(ecDD}5Re#fa{1pQ?u0%5#%Hh=+V4NqT$($TIl9J59DieZ8fsJ85 z$w(W*OK`%_kH#mS6o#o6N--c%4H)70BbeGHl>oiPo^FB!l^|28MMrziqX=I?`6NLcI+6gbkI;Ou?R)&e ztcf7(H1RPbUHJZE*sOQh8Smh_ee*KSo8mKkw|pGsd9k8vOqw$Byz(h$GVY2 zXBL_k49E=L`i~U+_em3jDm}9N2(1WEwVuu5JSen(V~v{rDoJc} zJkm;Y``uznL3@nsjexCH1S5VIHQ;bmX7of!LW53RBB>kuz1bb7m6%>lNnuw4oBS<} z!Dr}zQ|X9j$rMEcP0%+Iy#K$Bd(NK8i${oS;(@oQA)lMYe!LJ={_gv*!+|}X# zFs2vy;)Q>CUE_O?36p+iBGv)%ZuzUz<62NVFs2Z*z zQqf_(979h zljbGWI7iwaN!&H|)PaOYRLC5c)YodEaS>1f#M@27PPoYKj&>IlT2F_*zHT_|lFi1y z7ZS0TEECnB!DS`Zl@WAAlG{L|hrT0P7Ze3sTOZ`T<%h`g&@|6OfQFszYMdL8 z%VG*VngWZVDgZSX%FsMKyxTi6YTJ|EN&QW^sBVX?@~s0Hu)mB7;fjvkt_MC@p0Iad z*#iCyQ#vr0eJZLEvmKWgY<4I8l10Qb_F@gA_G$&4W|J$4d&3v>jh#mUO>3eG(6Z$4 z7FFw0T~wnAOuKELnPm4-E6m23P0ieKF-o)xmK%E}c*)^rwyIbZkT}9^PuC4GD;p;P zDvmTG6u`K~T*uujlLlooE4Z)i2;gVv&+57ebKSKS8LHg;bEgJ9l&yuXl;}M*<=UM6 zNRl$@K`EZ!KQ|65%y1zQI7+;g1Ry9*X;2H%4+F(eDpmn)6wydzuXVeMdF=T>~y-%L({$q zH^XK9O7v>v_rL>aM)6hIB0oWxVqk!)m6xD`I$F1&bVPnqob%iM+zn7&iF+r~qfpU< z86xc)vggRKEfUUAwr1$s6Gh#}0=A+`RKR*_l^IX|73Iu#w9H3ML^zC8Q*cBl zctqDkqmFL18^`R_=}L^qHbkc*QzZaek65VHDc;SGvSrd9z0!fqlb9Zgg)`O1>8vhR z1j@SnA|A?$lPJAd4`k{8^M>htXDH53&I44?MM(iPJal-YSYsf*q7pR6(|is;&hp#U zVtZC4d?&={cj|=U3dr`fcLk;`2iAiJmm)W;su^ZANQ&XWyOs5dGtLC}UWlbk!3h|B z*v)ICpO(McWSAG{5qoR50Q(H6o=onpYhqY}Kvr=Ex^1Xputgg}YcT=*smh@*-5)oM z)=4QQMTbF6mC#yriVb0#HKCv)7U#h*a>yrV)~>-4tvii&(P4&7^I zOVb2BIUoV&G~~LL$yii8rn0+i{;+kML}Xd%r8|hhuJ}9l4m$9-0MWRVcOVkiaqa`xXm{}`6~fSk3WLLIEQ>V601fv2atS#ErM?}>?b zL?;|qsJ@dnX7qmFQ@DLSj&veQ`!+tb7B2~~(Gr?YTcZxUtc2<2Ide9?&Hp_{Vk$c+{!N+sQ7lPnxh+jfDa;{Xr$JKretueKW z9xPXxp^le0o5&O;unQH{Hqv63y;5+ATS}jKNbFngpo^(EwPAm8I*(L)eOL;ND5*;@ z9f=F$A1?O7-lWlk=-n&r)xi+Gx9&a4Z%z_>@~LK%pKrPL&Hvj2vnF-!JZD^$I%VJS zz;eWf=_VXSHjzP4(8QcJQ8)4!*TcD;J9GB0>@Q2acyr1u#p}l8Hc?^lMFjwZpba{? zmRsmtum)R5dl{7xFBC7*m=!A5A^5*)m0)FdITM*W6{DBHy*FTjuYY@3Mv1_h<%UrV zy?5mVqo%e(KbA=a2_nY7IQh^G&&#y$u*{6ioc}KYEGP4S*%of; z>BS$gr~2;b7mRK}F6?u3V1b>ICdrv4$^J@N^TmP#SvOm&OeCu#)o^{P+i|u8l+dfq z7zEgMHUe{tZ6tblc=mZpag{|iI!vQ&VtuxRCgb_*74Z5#hcdlhI>z>!Gr+|APgez{ zi5CUph8Bm>x9_)4ZUk9N?7Rl)$iZtkFaQSAOo=@z=8!^>QgOPGq!$z_k;G>?FyJ@$ zWK^Kc&nPs;l&M&Kh`~8RB{-Bp3QxKd)`3vdLjU0>=0aV9dYM8WvEoiz6?GT%u##j2 z-h`=eA}L`_S+7yL73CF03^o_L5<-t5+F;czGHT~Smsw$Eg*F!JL!VLl9m@7fL_rTh z-Uoxj#HFmp1}%7FYFS3+I64^-iXZ0DTK|UrULS-(>Nf^b*S2~cwCdDL32k{y+7ESo zOagh5!Kp}0Pkcm`q>WU}|HG1>r@`v{x=tgLJS>?~)-X5hLJ@Ys_KmGLXdS>J3NM@D z?!pwC3Uvlg5cP8^EbD#__jg1xvR1sXqykc8(g0i!lAJPU$ku>74)zS;7W5>y7nIPU zLfPMf${`BUZW`XO{xq0pvZ3uXc;TT(j4)^++4xi!igzH`wq21GL#Dfojt|@yiY9QY z5OEK0E1KT~hxgWD+)^F?Js~mddNzDJZ7*v}W!3))YD$(dBlW${K+c!9pWlU7(H z0u@AV_xFVWdm+EClvvNjKWuC(8%FcueBcSbc_*;vVMKr1{k| zt}zWTH%SqKY-5eGBp_Qr1iNSKt4#F8Zx2)B#mJkNTZ`-#gc={f#Z_~FO z@SpRlqZa^S>P}2w56{;l0P*og-+jp8^vAcu$H&KH>&gq6V`Wn5&Wd2Nwdu z^f`*C=3nxpb({ho;`RV%hy>XM; zH-b2HAMU$4VlVIC%m4MZ2aD*w9V4-aLl(erB=?i&jQUn|r4heu_mPY+q4>L71xiPH6T71q5zMyT_(<_Ii zh!}9}A#nX6Cd9H#57J?~51bP`zsfoS1r93ZJopPKZWZ>rUvobox%CIJR(#8U3^F1m z9piZr630J9#XbeGnO@7Od&URoCXX1xqsoU-+5IqBq2hywopGIZs4` zvb=7}k)}FB8OtdQZez9$w7k+0z=LJuKTpFvJc0wULDoYu{Djup3K;57%kc};z!|7^ z!|cY13U&IEx1U3UF@cn9uRQvRpNFsQyx-(3D&SC)>_BUJ8)H=I5~>_Q^VI?u;2xa; zB-kKX-h*6@lPeXiH7lmgDg9 zmEYS_{LS}6yc5%32g{f6_Ukk~58Z1KfxmVgl|#PCm-QVvLv4xJGVOE+?51XYK1P

+@zJxsL!+Y%GtEGAj?nAxgTq+X)F4e!mmiULX=E<-R&oZOHQzCLPx04u)lGTo& z%o+uL{<=#`+;D0ekN;-O?Qbbt-R8R)p)OSlQhup}j(Eb>9z~z$2d_+aL+_TJ5B$DM zdE%}f1WT5*SsH5;o?ezc<19iK{@cv9eeL3Bs|$hfbg$k$yv4G@wRz6=v&k`%5-Rsp^E2WdsCAF-yD@&9<&L?( zL}=-AwbeqhT*t0<=vtD^qk{QE* zal${;2TALw2I_TUz~Vi%>&|3t&dC$RvYnGXg{C5=+c=WIi19EW;>l4gGj*IN=g!Uu z1MWV|C$}8cDH_7m(jCMJ(70HXa$?#1-KK6IBDoz|aRg0^0#U0=Tr` z$Eo*{Q1qr$^pRFk^r3DmFf;6W?f4ik@oHGt8>8R7+Hh==4cnLdM*2IWUnqm$*|saQ z0uC+X(#k2joKS{)0b_V7t@Z-yuJ|b5tF+%vphD;SwjY5QqnaJOGwAPeUo3W!ih)t< zq$Hj~BT}Sss914t^Tjs@@2hGFZ>5FzeHP#r;ZHX@sAU&7!)Bf(fxZP{Z zTbHY@GW*!zc-*k(cswYJaVc#+N>$RTWennyQ3l4mjs`rkxSbY*gBkkU^dkV=!-vw1 z-mZov&He{t?--m}6tDRv=_DQ7?%1|%JL%Zw8{4+gN#5ADZQC|Gc6xH^&aJuU&Y4s5 zWq;USt7@-W&)War^YkJ&Xx;J2jFE-{Gd}kxU~>EU0ay4SbZ@mgGn}hL<%+7lQe-ZT z*C%|OTw#GV%eosaEh6&_ink+Q#CCOS>T=-ktQ)31WhZ$vQN21*3;U+2V!Kku&3@|- zj^SGn=~N5tg=T`i8Q;3aTjO+;$!=~7`G&R}M;P9Io|k9{(K zRGa7L&uW}<-xG>T@{E8pyt<;H#`(jMC!}zjJ-cb^6Ku7^tGS&`7EeT7p38N+eBKYL zvr@*oarXj;!h-<>4S#dhOwbVLIlsT^9HG zqA`nkLrL&N@OUnG{WWF^;O%R>)1L=a#U`oOi^C>4*a4=+28s3X4R9W zv*K~Ks091bTjGFmk*nj8r^TFQsJFCZ6=~6BOIWN0Wek*ZxfE=*b={_(m?=iKoZ0e5 zFHLHNJ)uY%%bqgU@YI;;pH~!YaCJTcV`d)1RXrdoWQ#rVuK`<~_7!G|M$;xGW26)@ zAZEFfVN=w>$7E5^)UUx`e|J5`FPvge*+{~M=&y5^JD%2D3elX`>DP3FL z0oUo@bT@dXK3K+(gXevp8upU=`|qbu9o?4NYuc^6vg_6)*-e2H!DI5xdrH9>#Hi~` z>w`CV2aUy+sMz-b+C$unbQs3<|0UV1TuVZr8a5ePlD0-&)}<+)%6#HE#URynAq)y# zdOh|6)N@>1?^ETs({@43nYm8E+GOlS_0Eu8Ppi*n@2|}JtX)N8X50Lx2Q3_Ock!m? z2sYD-ec+!m9VeT!UhpzDmBxfDuXx6ijV@bET~79zU>cGwe^?ZQ8o`!pCWHmSNSFxL z6xoEF@4JVx$Q3z*P%?{Oyko$%K!uf`uV>s94VkJGJHui9(b}iXA1@Qo<~>6St-dnP zXEaI@FEP<~b%0VWhiBDsLwuW>`UqDbnMPF|O2gejx*nhhjJV>y{hi-lU~dPo1|BBg z$fqRmmiU3!tKn96aLxQlP{NpjGYEh)yj$mj42MYr7V2S4jQs3jAaK< zy`;0_1DPS7j?)fG60~tId@VXYX({W&C+D}F<;wu;i}qM){3V|oH#h66lgWqS(H~gc zE>t}Avqb0HEhE0aUMEo-Nu`sUAnmab0Wf{7Zd_f9H|)i4%()b0&ZSw(m=V<%XBMLvA z4rTkVg%=22!!kngBE%!a>POZho>WfxN5_7#6o?T}iCdEbnvGl|eNfxmuXdJPY}o5^ z?Uym5V--=q8cB#=E3glmO0HL*x8+?y<1-yd==bEm^j&p)ES`YcA0G$V3x}37oMh-J zD5P6YM5c?zQs%8I?^Qj^kTj`jTo4AG*}@AGAYH#v&AYnZF1%**sIF9&Olx` zV4QAtD&`B?U9U2e(3!RNZ?L(<-?>bPUJdjUOC#pw1xX{7J-y0!>p|4XP6y}ZR|w5z zTazy~*)sJx!#ala?_pC`bCoMB{AOzWK4>Y^7Q^pK3kUT(-w$_ zNwh5><2+mkG}36BMMo3%S+)Q#_8XV|VREHX<}7*c+C&vVO){K^@Qy*u_UQS8J-ALI z>SP(`$)ECMVWX^7}(eQ`l?Bzz`BBygMlm)t!%)5N4I>!&H;X**l#7@75X@Se7{ z{Ff_ZtrEJ=A5uoo0tvHIST%Tq5SFDuT`E3a)I?={uX4R&Mb=@3@)9!vL9&H5#MpmW zvQdtcx%wQZ*x7KWcp*RW(&(02KF;Tzn0<-yq-LX@lzmvl{}3G=O^DA5A+T_{K>iUJh$Hr^&~npFEVwU6MsPRMr$A8eDG-V0kfl4f9i1!JDu~7OD3V_ z#(>KcDQ~*&CXGz8icI}y zaO>G4_?H!r^ozQy!H**zkJk|v^C;vAxmH=%zg+8frYhVNdR5E++%x!p{t?OFHu$_& z*z1Po@cX!*K!2};Ny$Yp?h!_(#yg0svlgQojJA~k2+x6b@d~sPR@DA$)}0%csU3}W z9+B2sKO!pKWN|CH)ZJA5^mLzQpkhcz*%#)5=PTQbH7n8KfwSdSI6>7{aPld8DO`b7 zc5%E8oN+nb4dll;d5GSlf9$ve%<8y07_Kb8TX}XC$#0)%_Een8>2IFY>|EJ(Smk%P zoCz{|{7O%a)bb0t+w!@L8+cl^p|CDxuy)(?ogdj`tLLzW>U*x+o{3w)j#7faqoYjv z7%C+Nx5aGPI7jWdF@>)=8Z>>~dmN$Q)NEh8yLai7FG1hAT%}A|V2^Wre5KYK9Y(iu zzo^Yk{nR<9nW?4BV_QD@*=(z^Rr_c0Z_akEQ`sI}*`0tN^o{Knz51hTH;Lh3(b=L1 z7sOM~{oi1p|9zR9iHZIHDovJ!os025fipT2)g*k#-;)H70Ial|)Yy7KFjCjvOQfj7 z!YufIVC^|ApIl3?;qTG3WnSaqcG+dGs!?{b#ahWFTOwvEQ zeQA<-Tc;ja`CCqMm4KG;k9DgvF)@3&wfKU1o;%H}`|aCV_v>XsOv)rTWps0r%jd^G zwYKlTy!XJG8-S1C$2Fnf<+V!N*GYe&+uL1FyF#kt$9qc@bEqZ7{m#GckI%c66{YmD znx4fMNfQqByR zAMKnVBab-bjS32Vo}BbfkPh(LEV0?%*c|lzdsTuTe8>nhPVlhfQFX7|&$XjJAjbuZ zgM6JdS6*UT6`g@Jdz;(fNYxl`-Ube--%$LFn{5fd&9>1`aG>k+|#c(9LDWvPX}~=o&Kt4Lt565M5+&2ZB>5Nl%slI^7my% z%IM(U+(%azeMdS&bJV!NzdvtN_CT{Ruc9(Ijq)BSCEIh0p=1TrzVWbu>sI-^a<>8b zJ7i97WNY(R&8Dt{gZbndi}s@Nc-m+*3-tk+Bg{!!L8z%{Km%+kc`!YZq+6qxwc1AQ zr<8dCeCLS+tVPXbzZKP?6|b0>}(|WDVpN0S3})Uw#ykddJe9 zJq(q~jA62;;#tWwWxNO5Gj>sM!!xmOR1Khd^@?ND1pu2UbtZcL-&duku%CAnaOx;0 z5+s{64p=DbvqIZN{8)ofhXI=^D?cv4iIiqsGFD6-X+w!=r4FC_s-sAYrJ}dJPJIER zG(u&!e_W`=Yatt1 zg)k=h(GqqP(xQm4`9Xie@P0_7YRsB=$=qVo@f;7ZR2(7%DMA#f@&&=bB=c@Kd~Bd4 zHJ}-5wiQJt4hja!}@u%L`}Tdgdj-sFAft$jMI` zVb%(P8WME*4`*@qLT&v_)_wi~Ng;|1Ril1j?j9!|jD0=8L5muxS*{c(+dT4oN@6Mu z@=8#H^wt~Bd}_`WYUOSw$H8rB&pUe-o2=>8bMjG8i+g!E+LF-5@j(8>west%T0!~!{dAM;y* zVk1vd?C9^5l=n&p>xOPrvQ6HFIhtRD_xUwrubB1{&}i!2W)Gyzgy5J|o`dA)fV|GL z4~FLGy#4_IIM*4e48N)JhAV#_lt`fH z{=~Kk4*eC>HMUt%pIrvR%ItObA*5@%Fq6JFOLoFDI60zB?8pJe5@TYpITO>vQ@%vW zIFM&3)UufSxqb9y{dwjj{*l z4M!!5w@b$BHM~jMg5N1^#sH-a?F{ehC37>wVcNbb)h%RNok?gZ`2!kdFrA96jK|Fe zaE%#02Tc^ob1A;Ip<5ryKl!Z-qm7wSdX>1s(<>6>WnVt3S@6izmy!=`c@gPIA_X9H z;enmmD6*y8N+br8mWMpd_Y57`$rZX*o&ddtCL^%&XKzwEKN%B^oldj-#HO2w_3SMo zS44!8tWHJ-QtP2phjN-R(W+pT5k?`pwBhP^WQ_8JRo9eEVnFAzoO+MM#MkId#M*OiBr=Rvsd$ z?*OIF+cDs|u6;?D*7U9BgmiwF{n83H0h`vDFSKgE_y%RQQ>IPy4M~0pTaU1}q~T-3 zs|rILpqZnhH+nh+bk=A{)7Rv#4&gK15} zHg*~|isy0~Mwh8Ew*1)ZY9Cl14rBl7PC81BnS7a~c{VX2xq@w_dT)t;6I)+N7SkMf z{PD~~`!x544Omf|l_tgw$hL$iN+p+KweTKO*;cR&dfz|p(jVR8(Kxtygv=LyrWd7y z?>i^6*>m>6Men7KsVmB7OAi{`z0jm6>aTJh$TR>_lJfGZ}JsfzX|=nG4P zx%WS%k#ex1O3%4hrZXk(L93J%Lb4-x7CVK-YOE(F!b}DuJbPLyY*TIMd93S;Nxm?HJYNYsH^R6Yq>4Lg%LfYCa%k#-VIZs+?;} zrEkscdAw|A2Z;@pV?WoLbnpa!j1}Gv0LmBxoKq!vxWW^4g*1?p7uV~!C?xit7P3Vw zVh%yypQDOO4BVw=smecptKkj-djHhG3a!L1UKI01Ad0M?23f_cVCD3}MzDbqH^piX zT_zznFQ*_%zo)jrug@4@#2jm8b2S0ys&IJNi;huT)`|8@B)KaJ2^Y)-GkFQvY~Hw6 zObSDc^pLwxnNL#{yKRPt#lz%R!$;3Sl*)V)igYFZ(49{DoF!^Z#Phq-8t=PF!Ng|lW zkh{lCE_|m#6V$m3FHp>+b2ntD2m!8{N5H3#CO2c_rBpEoZ)sDetz<;J@pzt5yfv&g6|<^p=uk5Ep-4>=6u8&Z`C z=%LHSh6+wl8gB2BD-m4C^nb|gnRZ;onBsW8_c1G`AU}1Q%rR%tywh287k4~)T>No% zqiM-(2s4RA0L2wxI{QV9(;^1cvSiR*nI)|9o|rs@F$OP`@hy^fiKh^h<-{hH#G>?; z0*7PZ9K8owo0reMyluzn$F5|Oat*>szFZv5g5Q#fwDbA= z8{=tRT(n~})rGxKg!^f$kbxHK!2{>H{7-?oE+g75;P=SMwQi&%XBs=6!7L%^Ys~H> z_QJ`yi(fJe#Kc8sHI4~5R98YgAvvfgnybZ_|D#Wu+lx=cUt^H1;HJa4#ZjgeBE2~J z)~ZlnXfkkO`b(vzT7~)~w_@9fX)1zAT%_naBMTH#LZaT-OWZ_S^C5TB4`DnpbB17QvB*IYYd2P0(+oK zcgKf^K9A?i>FRA&~mVXT*wv@kxLZ3}X)&F)Mc&{G(Itl3zZlmf|b zLePlp1#QCmz-h+mYm0EbNWzlcY;y>YzWqVJcQ+LAo2|CdsTo9cnjC8O*M!OJ^?jAg z+noFpC7I=s<<6`dPxMjr`}Usj2do$(vTx%+embX`g7Y%WJ?G)YjfyVax-0nW14rR_ z)gS#boNB+%t$(2W%}ZbZg<@r9X8&K6UH=WO#KQdlQ>$lZIVZbG~ z$G6o3&gFI?<{vpN+@18C z!8#nbg-yi0Izdd4wqPQ`MYn#qe_ljQynhyh02(;;j zpzUS-HTJuIjXKNF3*8a8W!e(-8M2mpdC3v*O`Z7hi*m)&+rpcUS<6KwAv`ddvYDnSeIC#5H8&22gE7j`k;+7q} z(}uH&{fAh^7mI&!H;cR@S6tSK#7+OZ#WISAImsMn4HFedRf^@;^D)fEFa%3Teb?_u z6AFE`5Xh*&LkpJYFnCnXc0gIkLAzbB?AXAgnrtdrRs?pBSK|pC|9s4hEVq-mNm>|eymu72v|m4oYw;CVz2t|5fBDTI0cI)?8ySbC zi~sUi&Q;9)ESd10EUPpWTxSrk$}bD??|-G~nlVFir9FZg@YnunErCs*Yl|KGi|KVh zw7aa}R@iaZBxBAP19AJApC$uimM#_Vw-5Tg1P=LpD-K$5U6mK6J~3g0oioc^)5Fx= zU0a6`pjP6x=*34eac(8(bK;>x&KF`N#DfvCFZr$nPUb%(Zh_~2$o#EH1f5Bzv3MI( z6Eb;an*=RAF33{vtv_IIGvG?d%#@|-v`U$5B&}w+?#of#CD)uu%(pWXEJtTby3t;K!WVs{+VzXWkRac5XQSLRYAyaHz!BBQnaDM#OTQ_A$ z|Bi(0?h%w6!2Sf}?8I)Y+4T3YngBO|e=>fex6DF~$+sUU9}-pR6X$6v)_ zcSj1ZQk7CeF`C6dqUZ3a;DrK&sfJswyB0$6xQB`fpCS3ZNT__ivXl~i_i7zGou$i-Ia2Lm|SmL-`FVH*;)f9JjpX5LoZs4@| zK!P?=Q#~u#J+LsbbS7JF&$>O*ut<-0v~jh~{i~ChjSW_JN&xlX-P+GAM4i#XDRZW6 zf3GTNHnX^~RAo$mSm${wB!=vYt+t2~h$D8(Wm_lOYLRfrc&mbXAXF~8u_JLCgNYF% zPpu;Yu@vwf%95VE|Jy{i)mU{{M$yhh=Lwk^atYP6qph)wwfB9~iTY36bqI>5IYSK@ z&jT6eNjGWQrAli2dq8JRuOSyDySnOCB(jD>kBA(w>v=HJP$xymGF)+v!clQiThK9y z-}(HcQ3X||pN17$-FFo@JS00C;VhePlg1C0(W!vD6+jgpTd9Jdpli_3>f1o?w;5cm zyMu0Pnxjexnnvmhm)STGp{g~it>cIc2LyVB5&`q#D0Ozxop<~t!8J~|i^oC99*J)) z6kvaN)WM`(jcOQVa|pZAprsIfsJ2@>^?sT`m!wb=V5BE1&l*qv)go{v91C{qS}n3l z4d|H0FGq}5!=4t5u;sxG#1@7yGQu+p#t06Y^_(0-2a2=0aFg4C5SRZQzWXjKMmxB zK|mG-w3_WvK1mR_Lv5)ny5DqKX!QdMr@_LNB9u>UIEGJ@anLrUjz0(cJ^6`Q0yqV^ z8xk{aq)P5i5#C#6oc@I_G<1b2wIOSsu|JphS~(5|%k1(yyF+>V;-5l61;ZNXq>LFs zjFkDQFFNW+dNz@=F#QRqU6v?R_NF;8%IViOAsdX9kXN&-spDSn3uf zbH9oWy~^*1F;xa}On#OF#$I~;BX5alR9c9yZRN*{RF@=cV!IUlY046`C~HMdbAr4z z6Tp;lM*Pbu^1>Ic0_kKkOYMq?;o)UB=y@ipfs3q5P9E;yT6_J}*(1`d#yzYAdTJ6E zYVfh%^nAz!%*Mci^xhQLZc9o!gy}Rp{9bhsU1^gXF=?L?Kxd551PxnY_qJv03BB+Q8N?urwUH4mia=2;%vC!G0U1;HkwLl z8>Q13=UO&>9kNGf(io%QJv#>d0mxKnkmy!idLdWhxkbE#y}12zxnbST%28Rp6((_s z6{PxhHVWuLamNd*Hg57-;IejxDM=m>LaaLL2vfV{?J8Znc^}2a$pLr7mLDWN@lGU* znB|ZK!)s-*%H{>0FpG~ImqfB*S8J8MG!3Ge%@etu8p??ibE@til_2ZrC0MvNiPH@a zGw;dINMUy0=Qf%Gkcr>$P5NmI0|c$SS;pnck;k#5$$H}48DEQ1EWE$cU0;hVAaR@+ zT|7GEX2a~vBp6~416|92R!|^xLDEMmdQD1Y8Fj%74if<=?ODlIgICFd1*P)O)}hNk zOnd^EB_bsajW0v+) zd0XIBHRArP9KeoZxL-PizA2wAe^z&~Hsul?F4ZUZ(V+Ce;$oHdbM_Q66)Re?#{RP< z4!y}p!-2*NgOV(EOU;9Tl8n&K_?X~hxkN<`I$e0Egg`~+hKG?1cJ`O`+z>lm@@0zM zJX^};WZoX@52A~hbND&WtbSc_nC1qhARJ4v@t%z^!4eGFp*#(WL;4A_n8eQ!7B0y8rjZx5@VveN1&OIvbOujYeQn5j7UX>~mWn=o4(KEA z--L#|gU`Lq4YD+K(FV%5R4&;i-EY*5eVsd7Do_c9m!-<+qZvqwVb9fLn)zm156Nw? zxn@5if|B>;H;4MjoaGqp^AuF|h2tIjy2L@OsJ40M;tShkE6wtHN)9q&hhIeHVmzOM zi&3T3f$RSyx1SLBJc^dN%4&i7^DS!^wA7nfUIhxWX!FOAa%{2Six}3E1UbLYJlQl( zH=N01^{ylmT`G1}%UficWNx->_tRm4`&EGwERDnAROMrLt00X63BV>nO0u(PMfQ8G zbTSRpkBYD31Z28to%B+BOqm9mr9hP&oj1lmr@TqUC9ciQgy^K85%Td1<9RDSdFQ1f zbGGK@ch{%nlsB$fvm9p^JQOw@4)ug0(Skhs$T4Jlkp}HlR67y1EQA4S`42k*5pk-disdBgq$QsDAsi`}L5qB(bnT+m zM^LjQ5!mQc&`@&rVMVcqwf0jzEJ?B}<^@H%k2>{L>_vD& zYdF&uda!P{I2On{{0vF={uPFf9a?HBN@ZQ%>LhzF&td~DPD6*SJ(dVf08jKAQS(SjA8k+ zP1+IUdP7?q!#iraM%E!sEva_h?Dx4nfTBh_=7d5ksPLm%D_K-8=e^Il=(p7{OaeN# zamaXjqQ$8!V`%7D;j+c5th3*!>F}(_;&}G1#cV{#5R*7zn}bC}H1tWFbaccoEL~HW z9SOoJ6pM^#%n$)9mTA^P1NsB7G$uWh4^BRF>=nEPryNIP@7&Q=)NTc{{Mz(1d1Re8 zYfI?Wu!9|2TZ{ zW^s`PfC^p8?#(!7H0bp}va7n^!hcey=VGIx^&{FzP78bD{}>g1-!uFf;;8vUkTUzO zYxy^s8QV6<2b!49T6a0iO5qBm-!=(;gedZR=fBEdXO> zyPJrhWxLn^hroJhf&M-v0IY8*MBk*ap&a&Fb7QElNLZczTaL zud_5XZ9!FTQuKibh$(V5qTSh+MorwRkj!ZYkf$Pp;>F+|X9ns^Eh&o(kv?fIKd?{Y zY;OkmYMs5gJXiqGI|;#Z+B?Z?0W5WMS{N||^V zsRGS9BKQRH6b{~O14>s#R1(cq(jiGJ?n*Hv`a-3vEI?qKI@l%mp}i!2v6DA20riWv44O1#09yQ=T)Y-U2aNJg_-ZT6H3dv@V!ySox6Hzoo-FJWg2P!d|m~x z->*9+a_I$hzK~+OcnIEJKm~RxpWk)=-K3?tJ^K2zPHS8}-CZl%vmY7$*4^}$!St(C zf1ha|h2Ubcq>vhHmFYiy6U+3qKh$ke{%ROpp)#P!M;R^JCvVoG)sg>#YOQh z#h{~Kg`m5&xuqIcU~!1f^|GwQ3Uon8lBHi)^XmAg?7F13#j3_3O(B*LaYeGn9$5sa9$QVJ<<+hptqY+R+ho}~0-)+6USTbY~L zjZ~Lcp!kcK0xUtk_Ts$wdf5~;q@Gw}TpB>R(rAc6NLt}6+3P%I%RSZ{R=v6S&d$t~ zU`@Ot#JnHXHY69gnCNmOIUhL2nJK(D#Fe@H**L&d=Qf?(u zIpB5^Csnm*L*7T5N*~2X_8y~yfI(tSkjWGGqY{#&Sgtv8e$;QtUB240>$*8vW*?=X zTvzT-)ak5mE3==N8ra-~^idv9X)!xQn-i)DGV3Yo0<2l>xvT|3PdkiM5G?|CDfvpf8+?-rqn@ljf*;o-)Q<6uX zj7bSK9O2&+pcD64ZTFU#Ocj!ywMK+DxbG0LxPR6DR%Y||xVKkJ$Fny%wmnJ%Yb=hO zpnz?>5Ve|y$ObhEKt-25`D&98^81xeq@MyEarlh>deUs?OMT+T9q2I1pOSPI!o!Lv z_g>V-`Jm?JxY4xHb_JaSJ1$9v><|_vlB^R!YmJ-43?7tU+D9?)MKdP3L z^r-oI8t9IloQ$8wB0NewEOtLn)}hZA=MbgjP%|-aw3HeaUqc%+S&&(-sc>oYJar4R zYxz!^A*Zq(8DJ2y!9--1w5UdTJGm-9N63=%s`J#wufC{h=uD;wdXH~4=C`Ti)u8=# zrK{rl=z>|t0kP3S0_ZR6q}230J&zsbJh}7~-wCuxG=k2zbDHDt>UmMET6SqPS9%Kz z3(HQ@Zt^RR=&&JDj3ztmTsdmD-gy0^BafRZ(s?8)bIUrV>?b_#rN3oY@%B|0tE}v# z{BO~`R~Do7_8BtI$9+3hp!pl!_S3zZ!1jW@+Y>KBrtb32ZGL%n#Mw+Q-pczMSMHqu zT{@$DU#JlHr2CG>X9>*|qZPZ6;J$l~%~cRQ{5KiUqWgT*tt%lElTUjd2{~q>ba?%O z#aCsb>$2i{WZXuTYwpSpW9}&O0dGJ;uJ?$!vZ!P@nbGB#R-hxYx|wDs8Ntf-3;JyQ zs@>hjN% z3BQk*=LvQ(B)jQV)I@KCY10;N-u? z9t#*VEH%v0N2TS5r9Fm}VoO}8^hX4rrhceLyY2>~;;klqe6X?zE9bLn=MUh5R+|kD z1v-(7nzQtObgJF5-bhM>5cNwiit!@=m7CMh&69a(KuJlZowTW~_v-RYg(X)Fm)!AB zLmuObb)>46;hhX&2w*cihw?|1V?WoO!ld>?-6eRbu$xKRml6C(rjBQh9mj%WdQEevgpB0tcm7Dp^laXzW z;-mmYf9!|K0Rkq2)5ueQzWq)J)4-QyElDzjS6ApHs#pzj51A zahC3A%a0#c7}}&XJ^C)z*<7p$duxt;Qrujs^F))?JP!KpG}d0vXA_*WI`|Ho#^?{$!z3CaubA;yw=OJ24?jhn;+aeZ9@94OD-M_ngUgn zx&3-6cpdL39BdcIb=McoT9vuS>>8qLi7Oj=8sGK6+tX4g-V;u=Kz6w2poJC6_Y;FG z3XG+VSWr7b_?hZH(xieXQ{5Y%p^4(oYs{!pM;0V|X-Rs$wz7O2%vu&U3^106KQuo0 zf9bl#1s}Xr)a90F(-cu7SPJ(KmwKORxP>Z*LAiXpPR$rWZ)k!O}ZgoT9F6X64H0K znl7fQULsjZp$0(r%+Uk}1GyL+Q+FES%ZW~LKYuteJ@HOZlh5wz0)}rR$4_8oDhgHS z9Fd3GRkv{4gYAY!g`Aq}y~FUIiCY(6<-%bZ_fZMk{z><)Hi1im^LGzcTz^!QxMzUp zAr5ns%SV?3GiAXfWjcU*qysY%w%Nn8TeFFS;>mV5%ZxTISDLu&4lQQXS^bWV-0;|`{Dpd) zH)PV*ky-$Qa%s53R#~RGc<_2wBBZ<&Kg=+s-NO9S3ndZOb;+)xnBIJ634Up$vNvh( zVQ2*HmC&N{?aOeLJME$%X7o0)@{suYTutUGJa4bLgCHs{en&jPU{aL$B`-^(M$cluEo*Pf(LFY>TEWZKA9G03`nAlnMzh* z>PSR>1gj$VxJU8c)_o@MzS2AgF_PAdk6RBFBPKe?7@r9RZ(s`k(;)>J$6tm%5E!Pk zWuj_OPD~0?7U>V7ObrGmSeE9{T6Ke6)x9MK!NCff?~eILR;jNE8s4; z9ITf#r_txTEPFtBFGz$&Lt_X3RNdjwd_{|?+UL5-p;ZTqf$vT9jgbv!<6dgrUIF`y zEH2)<12qBsy2C9BSL5DvDwJ)j#xf@{r5U8$Na?dp30vh{t;P=PzRzTp5@4Z;4*44a-{^srX@MQTz}i>`LP7zLJ2=dU3lOf$-%6`flwqO%XmpOpY$Bl+lmHh& zec<5Hkcn51V7Y&YaCVx?Vppw1qNzSlAEPpqVE{!jBLvQ%-&hs|I*uq{`jwd2xHVl2 z7992$F)tELaQI)rQY7O39|^+YV!XqGOi`#%sKTO#U`oQ_7Ftj!!h;iFPevZPptV}T ze?f(ZFTjkLwK3Iy6_~!B5)Iv)lRKIB1<8lN#mtgmHu0`ce9wCrCZG^+#+myEyy|rZ zjRA)lgkBu#$OPL_YSBMyHJFHc_2|Hu+iSCpZum6CJf9HoScDj48)14p_(jlaYFp>l##+qJquSQW1P?;^%Aowa~3osvPe`Lk0m`WPd81wr3O#UOS zU77F)zg$A|g1(f4gQ|@yBRr0c$OU^cLq&&pGYtq78KA#@ z7>6f0E7L6vAvhD^TEI}8G$|lLsC_ZW9P;`m3G5ugcYFsNzr;lTuTqh3qi$KWzq+f-x{78* zLG_x01K^iath)=y?Tq~c4ggX2S+d2t@Gxl59a&&8iEKR-V!VIRppjRr@1+EK-jf60y;F^{P8Xf{1PE8H`lo%MXDGhjO zT{1O}dUcCWlRTv24>(nL9exO&QxT6o7v>NL;we~tWkSmaW6?@OzH^}*9rytqY)&;= zQq#g{RKuBpzk-UoC0PrUriY{NI~$zS7gflJ4w8Pn^5O<~UR5~Xu^1m+7jY##NUdo+sRvpj(u7Q2T;#6$bNF+J<3>-dYnIx_mbifLwikaR1rFJ2C%Ri_95O*MLI6S z90Cp<1*j2mBA|STvQqTDRgvsHS7QnRm(@d8k?kE<>-!fhLMLa3_QC9uDx;}%uFb@H}fUgq44~7K|4;UNb@%Uuo3HYiYbuybgALu?YD(|ufueC zN_J(ntjeuNg)!bV5OF7G%K#_&7Dln?BX8JW2V9fk#PZsABI_DOalb`m-k41r4@*wL zGkhHHbMB>fwNvVg^=cHRCGv*SN%shyHV#}>#7S_lTQ%4Ec^>^YOMTD}| zL*+qRn`GLdaptGkp`CQQlJxIufdC6HBBARwMP$UIh%iBZsDX-W&#x?EX=RHHmge;# zKOJw{$@UUW>`y`~M?MsVnpZra_m@KL!hATV%%#q*yrdR`Q3VP`8d*^W3K3WS1`irc znH}f2g?j4;pelejnlze3!{7wcyn)B?j`=sv(?#9PS+(Fn&m=}CK0!lf(5R!rImKe3 zqdEm7MHvuz8mlsn%DscPGxt?!){82MXnUh(tS2hPBFm>LiRLsGGF&tm2~!CcK;aaL zNg}hJgI`9KDp7zEqrH|n&Z~E+2_G&-*rn{XQ2+Rj`%8^B8?6u$w;r^J?l_N`0=SzR5xba@3BqQCDn60GR3cL1 z0PthU$%~{h zS03X?5G2~z_QT7pc;$Cz&=bc>Aaik}LJ&!lBfTzEbu=>gJ5Mrt0480dnX6iH8?{Ni z2X$--L53p|d7>A>M2{REZOCz`yl>;V` zO)bkP1w2X$6Ajb}&*=qv7DLiW3wW~l<=Fzr%j5|m>)`(jVbJSk!y#5sGLTa6WFTO9 zL?S&5(NR2+z>3U>$rKk#T#`wn=K^_;AOmE4ggqBi^lls|e>dSyQQnDy^uU3b>Ju># z%Mh{eH$?50Aymn*&>OH-sU%FQa?{hP7L;D955cRDSCr9rqHf%sE+bP3sX&Ana}lE3 z6h3#qybxzUEa(VF*2jveWERK{TUH9{QFz9NV||2@cc`L27L=BC=n_{VMJaMLp9mVb z6&X5L0fL+k7^JIERG8^17f1sTF`!C`3nOH}bRa3HD^#&eM~H7M);Lr*LVWJr`Fh^z z`MTb~ARqztq`}4);o-ve-yALlG3xR2#M4cbJZRP1~Q{P=D)a6_}ob>DgA{PxA@?aD^ zXb0DV9^%N{J(qqa2@k1JIoj*<@tc%61Yg1DK=35`7b_vLMmPjHUdtVk{z>!_RyJnL z_ib-*@s|nrS&HZF&V2M{ULh6ecz%CR@=gFlm(sN|uxmUrgU90hIDav*a zl$8l*6Xb}TuJdGLumSz0*s(->pC@t09M3^GD(a%lMMJ94Y_nMsgy>>|y-rX5 zR~%x*6dLkO%P06kC7xtoNj-p!W-n;L*jx)(a?pg7u3cXi0GJI6xWfvN1au!u9`{m@ zEeMkw6`GvL95s?0xYGd9*i5?y@ra-?~b1uc^o(*-RuoYtH`!eWAjI2=r5vrU%1 zQBxdgr3x(}Y2K1Rg1-2k3P_MeBcSRrj*>@Zd0VMAkQ$bYypx^`K$9lVA_SBfc+LaX z3>RRUHV@N}71|6eZyG2gU!u{^1Yo@ea60gAn1y%n)x=Ob_^&WjlvSN$;jXlLvSa@YfLt=H`}ub>{;9&m zQFT8?xb0r$O>YuWJ~5|x%sO{7&JwNkOT z>y%w;RT;z%)%gq8tpKAf9#{(Odx^B(gDBkeO@o1n|5DLo7}pO2ttsV8al7j!N!OV6 zlSg_N_ZKbD5Ee=P6&6qK5j7I`yA&$GoLhmaLbS339pN#qZw8_wU2P5s2j7#gW?8X zBBi&C@|Sc<5`&swcT$Tui-xUk^|C5u$>aeHY^r(f9RQ_y?H<37j`#Y!3sjB{Nb=V- zbrO;<1`Kxl|8cqX1xT?X1c0Fb#qa}8^@7yjE>%yxFbSU2gZTbyB?D0M*GdAQ;O_)U zm~pIrHqIY@UMYr~+CHAhYOn}O6FY?T1^4hlyGoVrFQsM9K;SmBdS`&L|K4C2mEY;F zu5Ov9dY+=3M{g_X+6P>VjQH5N$f`QPFI^xRxIu1m^8)>j@|EXJT1%1MO^X{M2e`SR zcGT12Ab)NN9U5|Fbpci!y=ok&)Ajx6<7v+0PEaA;xC%RH^=MkE3%;3$Q=-!7u}Nb? z8qwvV1%b7sBLM@93B1RSFpqa5>c4COS*^p7^lL4`mQR)O0<89S=h_!dH3>0 zD(|6=-3*r*4#SR=u%yt?ynYPbFr%gNcyvB*RIUb!&z}otMf6c+U#qkQvPzg zC-raldKD^u;_XKV4Ky_@+j%ARwBQD)x3&(_YK69_Ng5lXffZgY@Fmb81s zt^msUUbF7>U9$qq zMavM?%c(Svjwgw7Efv8e16cW2W8XR-bk!zytk;q=A?xVo4UuQzj=btmXH7T$MZTNh zG9k{A?kda|MDTZTYCJLURSl4f<$O8Vt(!e}&0%?OAEvNC>-Ti3h7j0mj*ZdF3T9=5 zWKKk*QW7^RI2(!F_uuR<=E{Cd_kowFX3mcwe*tHCrF-Q+OG(@+9@dAqv^y`geHK4Z zRnMtB&D$bd4Gn2Cgn}9x&hl!is(+S}lb1Wo$e=xWl?VWbk9TV}%Q@Pp#4O;hC!E){ zHyf9$v(8Fz#wl(J6bVXuA|=f;0y7meT+mw$oVhmW+;ms7-f05}S$@0n#H}6l7JWRN z<*)7?=)Ns}&DVOVq;uYaL!*l95`;-4FOZX6BNJz-vcL)b$->&QloEitbR<$wcDnqI zFii;>?ov;dW^;Ipk&M$&HjM%(+swM+5s@t{!QYcQh%~YMG>SmK1j1@Yl76N99s;JE zLj`vw&i{4&G~GG#pyA1OQS*nj`iZi3tNNZCr;3+@gI)=QbQG+49T0c3a*O7HT=QT* z9ZKPMyTQZFWYfjiZ!(mQ^;}tsvKV9SQWvrq;Vpw)TBo=|mao@ryQeJwr+sSj)}w22}zvPUxI*=6raNIw>q&Y90uBu zg|eE29500@sjz{wAw;{h$`X5?2%5UmriJ@*yK6y$6mvKeQsmp63o8oRx5{#h%Kb|d zy0D$n^fg@Z$X>hG-i2@fiQ1o`jx0_1SFk_cH2 z(T{m_uKu=QZaK2ffn<{mLXAj430Z*4G+e+H8$6q9J-fS!S5p)46Ns#;KD$enQ5TWN zOO_dJmR{EKch3ohPihX;y$P0I$y%L%uj{LY-!A)%crq#jJ8;uv+ebWTS31i!9OGwa zL{=Q@IqNRkPm?U8EZR7ZurAuyuJ>kGWr`BJr#wcO$<&{s>?@jsu8GV%Avoo>y=#vG(E*zaEm50*}ptNR|75xUEPM=4C<#) z!^PS%Gg|hnjfT%2jW_8R=ZVwe=pRHJ9@M69Zs~ru>H(r%oHI4#M)rZ%LpnjvJ^4>5DXZMQNm| z0*^K~be=5yZn!W0-ND1hkIx%vmW7&1TBHFe?mvmkMM{g`(tHf=tXHVYun#@pr=7{WjIx!VUU716Emy_;`cloUkHn8K_<&Ze zJ%2|gI}Et0AO_l#9HihsmB6sEJ?_gtQ9s-OVAQF7J@n520*r0-K?0m@^KoGvMO;RO z7;Ls@wpxolJ!z><_{5znesu-DdPTHH5C8G7B5s#?S`l_B(A8MV@!;k#Gaeg3lBlIsE4h;lC7A z*BZCCZ-*<`WrM`K3yO;}z#D`C5z;S;j{%PDuLlF~X7(Z0{tkX@vh&PI5QHmuhm*Y| za`mGqgO@<|vgVf?+%`(uk9~)ed1WL8ekqV8xM`TU8~r~XHjR=BP;riuR&R@g+xo?V zu9wDv*v{z@bqNGU--2atw9%%)-&I{)(SYzlH?`6O3vB;|C_rQ1d{N(?iACtFq<9v+ z*>gNOake}R^kmHH_cY^22ENH3w*%AVZ`60R69r@E_5(J(1%S(n2eaFaa)O)bV4CR1 zjLUhR0f&S&x7GJ&TG$q>n~$5Jp{5ErvhzW~PkTlS=nH9Ttpn)qYDJJ{J-qdsok%$c zcC{_N{#o+8Z~vJDTkYoqbvpw5<7T)U3%Wgaa=Jv@gWHwg@Vut%W~dj7x{a|$L<=Lt zF6Y7f=F&S#)R-|^h{_TiO+IW4)7_xpVdku`xJcA z`<#N(Jlgm9@*b4#lkx1mDB*4A6iSFyeD~Zua9jwzzJ=vBzs0By}fdemZ~Jxv|{_#D&8?&V64P1&?t7BGhG~5Sg6zF!lt!2Cuk(_I`wC% zYV*|qBs)jcBpxHYx=-AOPRIYO>LK2=GQ2aJnT7RmC>!{u>{Qx2|JifipF|5C90+S{ zL$SO#Z<5>+V29WOwe8k29JT;ERO!f%i<;zW&_y98B+)ru*2M^z6sY$CE%#k_H>Z9Q zbF!RVzJ#^FUF;7S7-Y)bZzI4>pj|IUJqT5WbR+G(P7gDkK!q}oI%k7P$?adZs<<3=g9*CHm?D!64*xmxUd;ENx&8@e?K>K#6n^e3bmUmNma@YPE z)F|kXmi+XQl3YAr_lVL4)C0ao|ATm=itMsBFaF0QHdSE#^L3PAM;ATEo2hzYYO)&AlFSwhc`4y! zhks59!tk&+*umf zRy_As;U#l?pDkADlnkP%H5$;P^oOjPEqOdnqo=5JoBsY3njPwlr^jA)oG@{lwH!a^ z)Y=hhAbcO)iKjRFyXRbGEJmRZV4~?W>0y zY99zU@cTeqy;ad3>)NxWZ*%AV^7?6~1Zb;U+zog2hq=pdtw!G@yJdsC*{6-z?3Eo$eb;p@&3q>k8>FZBP4BZCX5!3G zZ(iabbvfjrQiiKElxOoU?c>-3%lTL4nr4F8!s0T5HlDm8jf5Sl`r~x%hJU!>G4LtO zotrkLXVUS$R>O4NsGwiBYv#9TJ@ozEHWypnrrZbawOm-^f0sDgO<%m(ynPVsF(kD7CFuFT6lL&vj&%(px~aV;DsTtF>bm%P;}BWB%&g+f>Q{>7EU-- zw@iJMuKJiCc5Qtzf=*_Bi6thMleHtZyw!)v|0zIM2@p6QFv-VuK7^;d{8Z;a;4WZ|j_Q(;yJO zUv6y^K`-wKvyC38h`vwP>AMCIdFXm^e@+jbuF+ZetvZeJ#TKx_^K2 z5q3(~rgUTK-L9ji@ckq<=0qKL2EP?;u+NR&aqYZ$1!C?!nQ&iQ#pBThyyP#}Sg&1f zdhdVi%{#tue_ikM!9AK1B+$Lc@x4@h+iqFiVZR)BO^Q0 z{|kA7?f*ocV5Mhe`Hxy^S3Hvro9qcMZxNiD;0^vmTm}X{dTh^irP*hvLgf`ps!bcu znhmDMH)P1fVPqOrsU+_t}v6fI#YNb+CTP*fVW;30rpK)G1kOcB3T8x4Ku4 zU?9lY1WAPnn-Hd-Or7ysnAG~&#as7EQ)6|tcQ|F+gIDAGyV;5-krYWl-c1s?M!A zP#S;+!q$gv*-awKQ|~K9vg;w)22{{niGfS)m3W(Q<^HYh+ z6@$n6B_(vshlIqb3owYFLXZ|SJBwz`D=s2n>GAczsi5+w9e@0VA=k8Q^jMC#gv7l7%5iiyba3d2WZ36C$FNqU$r zD}yxL6I&$bVh8cBiPuv1&%n%^M-ebdvK9S8>a3?_X)K~6H&iATlz=aKY8Wg74`m*J zdQ8&Pi{Ew5p&299#~>Twln_C}j!EznLBT-r!I`!z;sLk=3Qn0@%7`eV!RhQHq?Z*D z5~+;}Q9%6YFHMQCiIb*=x}7f5HG(~ zKfQV&j~#riVNnYI7w6t^*f}RL3~%vF7SS0|i@K<4V7{awqJ4j9Rz%Dt=~JYpq+q4D z!kbA(#LOgcj7k3na6u7Clb?93h?Jm|aI=xjJnk!@Ih!UrrKW|baI-Lm7iHOLFhF~x z$U!E-A9<%S2YX#&0sti1$|ze=k!dfc00C$b4}myyM%YaR_6!&b^9=qE{uI?YB_T9W z@vmz8qLLx%B_E)zcS8M33}+Lb5#pv5f)R0?iru7Dn~GiT5r}gB7{pLB2(jm=#OQ&7 z(X|C7Sqvsc^GA6j7I}es_S>{`Ac_v+3=Vt|(;{{_@p+Q?*?8asquV<2Fd<=Hu^ON* z8Uas%+k_%c3hwgq0Jf|wJI951HAj#bAiBh!GVua0_-zt<_!zJS03_Jbam)g$Ji<2u zd2M}U@b><@541A%CIVG%tcqN1gkG}1)fK7bP z!!#V;VM2GZ7_UJ>#XzbeKVhjou|lYa%GGX73PfuUqXf$$m)DxSvh~atcyCBA}1* zmPkJwhY2xh0%ZvuVg5~!F(FxOmZy`>9fdQW_m`f2Sr&$!mt-fRQpL*bzk%cf5fM54 z?}bvt22+p+y5G;Oy(p5sxu@AtH|>p)gU(b#RB#i}>_74qKf19WrMdo9%nO;M@PsH+ z>bH(PXjGa7HjX?TMjm8K+VgYAEY3=;E%6(Okz308H&2aCvZ4Hm`5mQ&m7QWrap}E| zc7jOd(tN82E+>Xl59`|*w7krmBX25xaQxgx=bTH7h;wDDUhnO>7M^D0ey$0RTZ`E_lp;#8J3szY+W1 z!8bwjWr^KeEQR)>|(|E8;pHu47 zZYA-aAdU|PC0K~bh;T>BQSRQ<^_Tv~CQmmXzGDuYE-pOEDSLNMAeg1Us!~k&k+dts zVC!Hid}t{dohD>Csa*W&h*0YMQsoSPo|K`c}B7`hfKC`;Q&P&|4O~wV1-1sPA?0+2aO5pI+}jTeX*Qb z;g~(Ia9*R4eXuV6kxH%m*im#~Hf7c$Jkw_->+*8~@Fk)y;KmY>p!}OqiWylnn7p~m z4^9M3l2epY9`c@<`5z_X*a%{zX==>KfS^=?e^DiH(PNIfatDo&hn+Z7TzGdTOo;>V z(Rs|ot#+5S=_q6TsS;oKQyX3X2woK8=;l~>oN4I8@6KYlKQ=B$4 z58t*US~wOXwY9izWf1*S(H4ANXS}?;Jgy(3x_G&*cpal(dk0LS)?2l@^{;z(hIW|` z$a^s-_b=Xlf)!&~fc7NvtXh8ODJyxQz8lbegC1noEyaV=G*A#VYD+>H`ZA4uEA1|q z>|Darv2WW5Fs)E}0T^o)75pl16%_#$12544vGX=z8WfFsVe;(|!M7kom|2OVVyhP% zWZ`xesL|us1Dxec%1)ih#Q zs;vdPi!ca4)EcmM4QALxe-woE= zZiOSzw{^JDDI~jb)K~=p1qCJyEu4+27*(fDTcMF>jMNz67Z$gLS%?4Vk`0lYjo(w$ z@)+WF6@Apkq42)YEz+x0i97ZF`4(B0*11wm8jQb;5*NS~xFb10F)6R+4s9E&6I#ux zKOZ9SlGMkK90Pv(80J{Shk|#n3GKk|B_=MF{_0y@x?0vk@u;fDXrsBPZWEt*b(u?BOw%6X90e4#S|YsvSfPD0rw|b^R$ki6Oz1Pc zY~~=oFitX(A+`Af^8D}3=Se`KNZPbKMyj^$k@}XtB^eqPdB%7!# zWr%!b2!yAsCocQCvI_WRfGpG%O zG{zyEVl*9~|4kI<(4}q1Nzo7g2LnlsaAj&pwVsR;Ht_;>7J)=4hIy5rDMd6cbbFMv z%zSx!-ZhQ5s&Q+jjG?V1w(Wd+(<})MVYtp&F1yYyw^=nct(s%l6XU?niw&xmxhi+* z@M8Y)^yW=^LkG#ExDdT*0&GUK$jfu>`s%`6Ban8-jYFZtFPrhGoe{VakR%sZa|jsL z{s2%*&CDxNGXg2V4oWaU0ii#DOqJ0w2=<^bp_q`ATgna(6E0y5IVh&*ReDaoJJc(T zR|5}TP(`{IN5yGd3`&x*>;!C2%@f@W=jwY{KaIFGvFFE4BSc!~`|kDn+D0}2&c^u` z=fD7obx|pUJ&#I=8>>A>iOHQKQBwS6{Q0Sb>pTlBfeG%Z%O?v>#5d%i zT~FqX1d&z48og=@e#UgD>5q4){Do6%`fC{r?LFfwPf^393x9&dKGu5m3xDP6wrnU# zHeN60e&Owygp6=1Jf+1T@1uvyK1_6J$(;{O$wwv6`g>|x??nlW!Ocm8S~^L62pM)fP>1u$ z-vkM}h8smAhBU)_DvjIr9o-T;yYDZ-tJJx4`vyeW>M%PCk+!?BW+UqtSh3Q?6Wn6y zl?u8{Ltfw8%6WQ^7$8NLGinzt<1ORzOquXH*v1^3(ts(?-%72apDSQ&zQMu@f78P zkKrnIKJkCt8CM9LGo+_Iz=8H%Ev9G(8Ll9W%_+UMR@(JARSw%k_k$uOo8=S#wXxw zY`lryjV@;D#&OhD6fmP+p_Rpy*4yFUClC>tudAa?Jj)z) zsePkOu^`h_7W<5GW41^lo;~b@S%c)2U*;lom6h)&MNmhPt+3>r99vJuGa%4)N?cF) zzz{@xaMc8$(&7!BwWIraVJD^^R_X9!FENh_N@}Xx2&?qdu5&{_=w`V*&|sc55dnTe@LIaz{r5zxSqVf_Cvy6p2d6rdcj8o+E?0=di_8jX@=nMO+*l6eOw}?IwO+NJ%<(XiOT@#d zA=?D&O?I(MWgMVHH;i&N4;_Wwp!%ets7N!r&+Vj_lQrP+V2n+CISS0E_3LwOx+63= zh=v)U3I5|E_3Gs1=Z8Qc54uB`Tr8JjV?%vaQtB_f5-lbzzpJQnhs%T5_Qz+x#yK@OW~0AFsKbfN^WzVuz+rH&2jhlrjM)JsBRs1B@drriQ(ke z5;fb>{i9t%#X~q`Js7Pk9aXQs;c-i)Zq5s!E%p;Dsd} z*K`@H5dTWvYIOH+N_yaO>o}5GHFOUd2h!FzNTklLug0|>H`lSJSD*#v z=#AzV7Fy6{GVzdQAD%`F`9tz(4F=Aemma6e(9eR|0H#n>iHdv6uljsKNT?c-;4<;r zI1&7542BEjSY+JeYktixH;ItHoK9T8KMj>IEvci)tNGsSYUipzbD!t) z_Fa*OU6vaBo+OjGMzUIVIJVs2zU%s5glC#LVsNWG*L(OrrgVJQ zX?S?NKZOFTfLow*(=;|jo*Y91(VV^(ruo_8SUn~g?__(FjjS~Qr}R5)`k?q;zhpjJ z&UX`9Ui0Ll&VQHZ<~ROR@j}F_nmQT5WZk-NBWr}wqpu5E?pM1gVWCyE%LtVKcasm0 z`Q~7j1i3|X#oB{lQLQdhaExI^*Y{hj8m3KS`ytZ~qn8A;k2dZ1Mb9c~!Zng`MeVRi z_<#TH+Pf~~RQ&;#(>~R$9`D9p88(>4NDYg+p1!U6QmGI@C~enoOFy%Y03Xl0f*L!*8_7xO<2fWQ?YQdj^{%AlpV4n;Qd|HZJ9#!O;$$ z*F`NvtSiB*8@Dc!*zcww^muN5FS2`{KXN>Ky3WK_qL%y1L)+7IRn7`!8C zH>wc|>j;Bx@@MZJkHztA_F`PLo59>@40$_Mui?|X0Wk71!x?N*4?7FFll>(gMU?)QBo z?rD4%o0DfL)D2D2Rlfi{XBQqHNJb0zJQLH8j{SCL@N>Yr+-)>EbkPmwBZg-1^B}?T zVRuoY1?m3D#2w8=bovb*Mo;Qqcl?p3jqvQS*N@-rczJi#X(^`M?yAa9$VJZh+qXip z=WhK^f{*6Kw#?PCoiJyx?xfDhorVbCi3jG9;hOjCZeq6*^k-s0=$cM>#5cy7z~xTL z*8yJT@f~uXC)!3P65o|oFFkj-7>b;=#q+6-@S}1$ZooBF&h~}mXPig46NZ{Zt!(CB z4F&M(s7&A4WT_^#J1p+SjWO-N65vW_o@5o@^PJKPz#%G|!+iA|e~ohVOM6yjpA7_e z9R5PGNhKAk%F<{IXqS!6DsZ%Eo59CX#+I#_x(nuXbUT=FqrIz%K5tTEsx3aS_xv7i z6_1q8_cE5-mnS6-iHRPS-ywIUdi3}XUZ^iRTvkYyBzG{(d&sT5k z^~5B#tq|)=S-+M)lwmg;qmgS3%=~3-*sR0<7EqRQ%Ew7cM)``; zVA|uEHSq}DEmiJ8b4-GlB)O?m*?pzmh)gTR7#j*W4G!1QnXxYuDUmj5InR`D`Z+`_nd> zKmc+ff|BbYd9_eR8(0hJD}tA$cy9JdIT&Ma#%PXlV?DM6U8uQw*~{Q#oz-=Nxb(`-VrsP3$UWR-m$4th<^7#X3JbbbL zU!Vdk^lblkRDgklmFfS$Bw=J=WB-q+K(e|-3o!-U<_pCq2(wv`?mUf+)_DS;Cb(N5)^Cf!Duq^0%FPVtktSYI-MTuZ)KXm@#}K zJg-Oiu?p~KYnzq)>zh%*&=U4$qsQBqb!fX&>{IUqDNl90Y!`caahex8r4U|)6Z&^^SIr@3N)ND_{hB3F~Q@K6ze5B z0`i>l6v~bcx3`=eb+bu0$(2>QKz10j5Ma_2Nmy=EZt3oUTfCJ=X_J~E;x zrs9Rxg#-20>tL+r9ABe;Do5_noYG*uB&Zfqcp}l`fbJnvD23#P z7FbG)X_>$UL%|gcm&^$B{k&ox1GDNPg+6wrAjnOGKO`n03oS-~5J$!RK^0mgUxL|O zz$AfG#!z*N9#-6G3$NqqUqif^tWk%HV943);ISo!c`G)|YR{$d!W1p1klchQaPxOtHT=Y#o+NGM z`38dO@Ru|KLxdN~n0mD4Sp$!-s0R^h^fD2kn4L$^-;b(j(SMziUw_0LYtjS`&rJMiE3|9+=ckQ-@*u5jWN@^zoKjqZq>g6xj`X z7&>Eb1tEcpu`2+C{-r;nifOV+M9(0Nl-OmNHj*nJ_5J>>a_HMPBA6)xwe-I8^Yebu`}5AEe-e3JR9FRtvQ`y(?7JB#W zl*7Y~ZSV;HfuXxKVz5nxC)Qk0YJCJBLtPDhoK_u~{KR-V{{;WQT0AK3&9FK8IsT^c z<|_E$kI9#EE*~~@zH)MEMXEj5d-#Y`nT%n#-0If?pW63F$=#*l-=GvL_+|f* zoZ8!swGkcV+U%1Jw&$DAo3pFgXk$7)n1#t*JAxl4n^;{H*+KLJT9f@HW75>k8>0>k z^p<)1Qpny=+QBK^4<2ndGB;G+!xQEC3n-rD)`cfy^2O@%9(Zqs)^v0=Fuq!xZe3>Y z=8p%Oj|I%>r-nLd%oI1>3)DZ5oyCvR1r#e3Z-xf54g)0qIYiDrP`YgJRR_g#BZ z9;@w}$=9z@=Qz>q+A_)=+hISxRsT7;S9Q42@E_oq8gAUP<@s(`*4i?)+f*MMlsDMk z4NqN2S+2iZv=lpQaXS~-(ysk$t*@B4PwJR7eR~V^vNSZO@%DurUMhMaYR~JK`TPwY zmwVbwUwG-NPNb|Zv(c6QZnF7=I-A~w9v%#JKTO6MS9G{h`g=`+zuh3eeJ7Dxo^zGDaT+4%mKZVvnZ2RDcLKM`h=)ul3+$`Lm|P@I9l?m@K%E9*}l zV2>YWUR*&I%HsGRKO?VeXz_F7F(puwy^bo~#)>_X*Dp|Gek?n0)w`N2#ZMv~lKWyG zoYi{br9eD~H%MltRp`vKKOPnPP5QB&t|5Eg6w(cvePHR?bN(M|Vp+w0teXh{~78_4U%2o%1MqKX@lhhz(#_cpA0 ztyQL^836!MGcQ%O7=(-_0Ntm7??$j4gZ3KW6*3VnpH2&s=jKR64kJq0%Km#FUa@u}{Q}3fhAxOF{+gF?SXXuF(br;t?6M_nc+hyrW#PEnGJrklsCf!7W z$nM|?EQ5sxa~y^eTDYCb3RfenM%1#C!iB7hDvbxgpa|l20Fep|KL^N$q1B-f;)a4ES&VC%*vUs`qM&nfg(&c_(&3hYenKyr@2qRt|3+7|-1q!PBu=_RC< zR3a z_$Pe{I2r!1ch+tvtL(0JRE;>_KnPq9c6X46h6O*Drm=B1CRX|~X92cVZZ;3>I#zxb zpt0rU2&Roj=}B~p6PiSct+x}FxV?=)IVv|#1oAZ7C^=vM;wiJ;hy-w7${t17j9x3Q zupcNHG644PG#x)Ltlr7(FNr4gP&qM>)_^EDp|Eqfkm3JC%jA+FpyNgDp33lMSb*eO zW%(_@`b{74G77QRk%F>s+i1N&3eF_f*bIDD)vGE_drK z`sc#^A|Y<1_ML_K?NFC*6#etg@}1?xsWVnQJBH{X_gYNOU2!Moq}eNH6d-BJ=3(8` z?e>KCTN6ZxBuS+?Yu%d1Gv%k zJ3WUFpB{B%aQB*3^>@xoI<}Svx#(%uV%tRTmN8o;FSd7~gpZb5zJ2J|X74lG%fCnH zR#desODZYOeLF4RSD(6;x|36xlN}mUcQhv}5%o`tywl@w`(MG?ntYaIeeMgbYa0s# zgxsS+-E2Fq^}3I#?REwXGdmgQ@O_oJ{{8A1hkD#0dqs4+4<%mAJ#@jLLnG7X@4)nr zS!+GatW5*T-jnIECEEO7bYD_i-HxKo#nqX&v$}gPKF3+pT_xosd!HX&>8=llGG{%H z#&M5HInB0~^Pc$YWxW*E&DjS-;mG3Vnmx6Fhl<^+TWoWu;0Jcb*&aYQ%DHpFpK1yZ zjZ5InV-of0U>rdPSRf>5Z?rni#m`W&x&G~%v5{}{9-s{oKCL}L#i`Fev==HJPPbpM zo;*9iZhU;xz-^7$Pag@`w+cNMq7yr@+s`@s(ANyIGG4wdwntR`JPoHVI2-4-Qd^V1 zaKpt=%PT?Wa%syLJX~%T;N#ef`?kqr_&ci9T^>vNr-Q;_{^|`fu zjND%{ZLIT?k|*}n+?L?gJ}OPPF69kwCY3jp4|>O~FDc(sKHKN3^PSZ9vIL8bnTy%? zr=^?sYAXBnA)brPUHn+~Ti#y7WnfQ~$5!)8%@N#a?&Vk-R}I?-?~`gi-mBF!u7wG_ z;#G-Wx)anVXI)b@FR`4H9Q6-m_O(N ziHivz3-3NPlNZ%HFozcxbvpMBn`_ZZPI&l9GgQA5nb?jwcnJLtn~i;40G*fAvg}XJ zf4wzaH6J1^S0C*<$MqV%ugZ<_wu{a#G_z&K?{ICKCVcaaUMAEz_dFWUPgG{kMPUUa%;g?>!zXpJp!vF}fe+i^1nKSpzIgSFQ0xC)cMt2y{Gm2&wSYF4=+q?jm`)3?dpc1@3ZIdYS3>NJXJTKiu3@)Z%clKwCK7>@rB zehmA6Qov5ukZPeOgUj+nZ3n{odbJuP>h$gc#+&u{`6KX#s+^F1#AcVCiBC`@FMdnx z!F5m2d^m{mv+9AuS0usf!NHu$F1$g2_S#SQ8Jas&ECQ!;f<+w_z>>DQaw~>rR;U@K zNxrh|qmCVMWQUn?u@^Ip`*xc`LHplGd&d}2qF`NgY}>Z2J+^Jzwr$(CXZF~(?LD?_ zyg4T?x#zr`dvlYQu5?%T>Z~7YRXWvQeN`nE?g$OzZGJ7bRG<-;XduuG^HCqO=TspX z;<+?6%!Q57V)VA!`QVEIHT!Nw6k9-c(zx7qTWmqfoaZZs)u{%nS)j`R$;-95lv1ovYb> zBrkF?QtKdmr@V50B;O*$42F4TpIo#Y=J}U)2=h%7IcyUQJ2MO)G`35LtAfd6$CAAl zB*!TDNf2Nc14vUx8wNs-A;?N`6M5!Uw<88&=zb82+_F^t}9h7zdm?J zw_XGQh#Wmogg6ugQTos{v@E)Op>m)cEf@$4fwid;s(*#!{$6g(5_c^ajSTKlpzy97 zb9-5I4xxU-ARb|CBc`)IXXDJU>Zu;E4G1*VW^L5&V9x&Uku2XJ3vwS&LjdAG+qEqO zunDG{WTd4)Vh5f6awqsTn6i2BwJn+vPLAL9OEj$LrLci!*FzSAwsl+9uWX5pM8?k( zGc)u4OxZ>U>aos^3Hg|m#>7IfXNGks(>U`on6dt1V2=6%M*O&U{-pspqvbG=_h1=g zd%_o7B)2v2@`Eocf4-t0Jbm}t4N!#5j=~i}z~X11XF-e5i4(%XNF9m?#t5KlfoBP{;i59~IEsWWNi1P-;J;bv{d&dVFDv#P8K}-t)?SOfpsN+w75UUR| zjn@dRh|5c-VMLVo+xff#e00D;+IOcB?qLYPyyuhFgCqlL8OoEq#E9be2`StHAMR>J z`~|0>u(&kTVpi{4zWghjo`>9cfbZe(bk@UI`o5KW za!#UGu(#{Pp)2WoLrMCrWeWVnDo%vAE9cN^9;A9_13n6g>D<+Cx+OcV+;2 z;p)Br9Mbz^1wZcH?T0{O^&tRA_90cN+3TlVQga|J@89ZX+QG|}y9v*CDSmr%Umnf3 z)2Nt_IEA>~*U97GEk%#X&O@`0*2kv$V8J^fzwOdr&aya;;|mkduE!`6i?rwN z-5veo$GEjdzjsl5&eR9Lz6;Pep!ag6A7-DvEbOl_qMv{`=+FFmzVnwDUA`l!KZDq? zqMmko?9N5-k{bBO{o7Blevcq#FTyf*4lUPa&PSmCIz2(#-v_%0Jf39en%6?<;s>K= zbh&w_s=mjrI^UJ-H%fbwhyS48m&0;RZ??gju!?lH$^qn3!M`hf+%I+=l5$GVzAJny zEn4h=;Z;z#opW+pg?iyXi`8Xn`X%1PebeL3?umTf2l)apq54$9x=4KE`nH9Zs+wNa zp}%T)Wlj5y)z)ilegX9`f2X=Uz~8cuOKpf;O($s^61UzKJN+QVHNOpUR+{NuecSy_qOct!&EHa&Bz(X&+2?rYuBipynV?WCu@wmJ#o-E;WJb-PJz ze%P9e@tT~VYw&g`E!-J(W&)XmqDI)~5c zEO2^u)xe^^ipy)lcgrib`#ImvOzA)=^Z6O0{_tKJq4r)&j3;L{$ zU2PrNAZqq{YGWg#PHR5X(}>eDoA8a88SlPoXwlyG@;-Qe+I|g~v1@*-Wc*lhkJMXw z=JZqf=*Mexwc8pUX=@GJ0K3+qgHxn$Fk+kO^n-0CFa2p9nRTac`PeYu)unv-0AI6u zM)M}%+M!nH{OY+=6S7;vr-Q?9c4(EG$o#Uo(UI38>%5n_Ipj+^+E?Dd`)PSp?d$^V zZRTZJ=`+iD|8Qj#@O|TXt2pS$+anx4t^^&u{ zh$g>qsIh+H?ErLKarJZH65-oK|7cnHEyNM@wU69QTA}olwt(kl(K>qRI5s=t&DR_B zd0Fs^5-&x+*kgCM-hf_n<;eJN?CNlbzK-g1G~MY=%pqqMs`F<(W3&4Qx%rVC;>kTAHRgWr$0pR_OA|&!q%$T=#^!Cm%FW;A*rA8%IDVV=r1=FJK>>*gA?ygKQfehhGltAEn(XzdSp-a|`o_{)(<=jAG|^7U_0?)!x%R+Jt6_S?Zm zJ877|<_G-S5Aex9`~MNPVPyFK@9r@D_l6(8?oJe5C*p6Nvqz?JLDiH>NhA!RT|rku z61RlIL=ilrHht@GA3{F96Z4V9cV3s5G>zyQ3zu%WZqMT7h9jA%cU9*_nvM_~%lTG3 zZ@et?&0>{J5+>hF+l3T07p0?4Oc)&cs>xEDE}UI9T{^A1{?(R+vBF_fB=0g?(-=8> zbA5wp_Aqbl=4qR*XrU4;#nv(J_7hskvd10~RH){f;|2-PK}{SrQajfC?7gE6?7H_A zsA-yp=KOnx78i;-*wBSBDAW#i-Srg#N?0(-mAjS$5CL~7d&^|OFo?$i+Oc7-e?V6u zbu8uNR3WXqg~!FiHL6sm`g-^IeIktV${cb~g@jAWG(w>ea>n{i@dERL%iQo#w-17g zd&+khC~ddA6t^_aziv-C>Qops^bW91iTz|sHB}xg@Si-!aH`^A8>bCMBH+pX5Qunz z0KGr7?3NqY2MRfRcuWZG(vz^77PUb@c&XeJyXv2lW(-p1?FrIhNBnW;^*Bt*LB{gp zQl(O3?c4_`1q6lAl?GgM14<0H+Yw;~Kx5hwbcJh>+WYd|^U46Kz)(D$l-?XL zOyR~``$v*RLE{QF_aKcB3>0tzGGL&utk?;A6-@8pSKc zHykMf1stHw19kq;GGk-Jl#k5LbV$j7GEvTD%?TQhQR5&Vx#*YnqZ)7 z`aIM$L7-UbbAI-*oQRwLzz<9mT(bSjLP%M0RM3~2+^b5b=)l$Csfc|G`uQp&HAI!F zn60su<|*MNMm3DKIjGH?B>__q&RhE$W`=J3OC5g~2s>+vMu=(*g(wZY6P$Bp@{p&P zqqKrb>1c?%>zUBeKu=G0`;x3{GbE;7PH|rAc2S}cca&CiiD{*n+W0jMl(9iP43sqh zviHzBW@13q<==Cfy^?v|a5;9z*KPE(ys(-2IE}~r!S;p#VIJoT)s4F0COx!la4 z73FP{1Ol|Eg3ab4ePk8%*l(J)D2mW6Llpf7By0Mpm}t#9giVp8PAJuV;+qpJJjC`v z0%FZT%M3X0VUIvhg%4XXzK~G?$VHn0VG5>1OEpo@M8hBz^atc}*DHS>uj&21u&t%d z!Bo8jF~2@1%jEoimgNAK?QReUKp5#?L~d@VzlD6ewwSYQZxVVSU2gvT_|oHJ$=s`b z4YBsyls!_=LiYQ%*NHcHeWwCM-8{C_J<=|#eQ7-WzAs!cQmeQ15avxXUEy1v02$8x zgzsrR;V800_VZ?_CtPfM^0+}fUiH0lb0)Qj;yKeBUdH{#zO(a^`Ki*2^zvwLmz?vd z+l|Hb4_*H|wtI!d6%UWZ;Jjn!qx%i$?GN`6uQ!DmC0&Y3`C<(d3MM99-UT zYlpB}*{Pb=yj{g8T`%qL<#ImB>)k&81~tc;-R;xBck@bb?rc6OC(6xV?!~LScT_#~ z{DQ}8HRlBp*MpXh&=a7R^4$hdPyPPir+Q%>?Rv-u1BUEy)$4xGR^rV#snn~b^k*mi z?cdDv+)o=y-CaBM@i17^!rr^QxXZI#;h8IVTFQ?QUtguIe#>duJEt!Oez{@rm^a1V zWj~s0^o*-)Y@# zRW#F((=Mw!8zsIb^Kt|`=N_IrY<6z#&w0<_k9VS;Y^&XzoqXYX8ktHnN>8!iX9hjN ze5Kp2NxWg#%_Uu@%3rJZVe2%@zA8BdzMEM_G}jU1Jm>IRy|?U--wU&5#24Z}561`? zIqxD){gIp|c0A>9=5(G8b{^+nR<4FQ5*}`G!-_eUOzmyG4str8_)Zy_JCgXQjS|^v zV$}*2*NtIoCQs2DaiL)xb#QAwiWMiHJQpnQBTSxZ%4I}qk8CPwMeESZ^Ru0e5*d5F zQ>F!da-3;)r`wCCou_flv=TgFe9w6qy|uqI7fXZ5$G~e2m7mPIMZbByxi2^GZROdU zvlq|xIw>ofBx2WZ<=Ih7Sy3;uR&Nxqhrx;W%RkP!70%9H3>q|63If+xEidnVU5*ho zDt^@`PS&a8V9P`)xLI#puI$%-I#JI{@XQYo?UULU>eNj*o;RdiCY9doPMe57B~EQm#aDCPA6q`$YPh$4!PlB; z?P}+E|6I<5Dl$hVT&$SKl??0tJm@&m8f{*!ywuav$B6mU)tr2K@YV2KtWk3LIH|t{ z8EsrVJJv*Qot|iAfxS=Q{ZoGr6<2K6q_TN0Zmb;bX|Ri7T`6gkIj(zzdRznLU}%wU ze>1(Qcz=}9KdRf+yQJ!16nW9F>=an-UsyMN#A~}Tr99A6q3czr6>1*;obHF4i`pPR zd5LVncl{o|a;53C_z-JmuakPI`F<0)($&e~CcpNG&oU}2+wGde2$Lt{iaBz@$h;}u!<8^z+B zv}=DiW!J%nu~oOEi&RR;qNiK!KKlA_jl2b+xhyQjMLlxy1l6D{d~As?CtsbJbJK8 z`Z*p9bMyNg^~>e;JHVI91%3}J`-$E86uJEYh`tFr`Jb>P#{UcI4-+E`x@xW&n_iSQ1Qzse#41mot)-{(f4@%?vrt z>;LA1{m_2<<_PB|$&poi_5{d{Uwi@Bm;MQn2_tt?wmu z^N7TZxwp}F2%_W5&Zjx}a1Ucla=JyX@0#07EEM1zDK$WjhJ=x&EemFY1nnX+kb!$U z%9mL?zb)r9FhdAHl;L>4vF198B7N*81XXUqz$l1|9ux%*mdB^_IvJK{M63hDFsN6g0DYR4BjqLECP$0bJ-fRAK4qU8ekO*S*sM?j8)?len4)`9j1 zAWCxvH?E*u0}>FJf<6WZqM>esy;x?+a6%Vx0^q>|LboCS=9cF?93hB0y{^7SqZbdn zz!Z60Au##t1y%3$VTuCZ?;~J}289t9@bfs!V@hNiH0eWMAy2eXzb6YYdbZU0K9T%XZNnkO&}*K{J*@ACOeHLVacc|HzpW zS`MUyQqF%~MHCH;0Tyg6LOs9S!ka|fKMc_hZp=yEjT;(lz`rNWYL9WG@DWt`!H{AX z;XA#2qWO1f;MmYM&6pOVU3><{aD@ASl81;O0$GGNn%@(Nmk7)dFhC02s?u$`lY`W6yR_Q)v^gY^$c|chk_pN z9_nwpwnC85!vn!U7E}-g(Sh;@%^b!o;ZlEd=1~t7M2qxh3I(+J#eh+eD}4c!4Er>b z8yRFB#~S?K(**ah*AS8-Az}2%q*X=U=fq8{CN(f<(VxMLk?S$~`@>E`LT>G=(9pnG z`dr%qXzB&8{Dm0$si=d|t&uPyiJtpF^MMlC{51eg(GCUtt95Oo+-(F!!R92blo9QB zF<{~+5HR6v62iiteGLG(M>50jBflY=3JKt0{_Y|o=+=|^XVAj~yW8B616oHkGp0i8 zvmj7_AmQ2OP&xx>0lA^h32@SgLk>W1HR~3ngZqzr#sJ~=rTR0WMgZ|@-awZz>(-Ym ziRvXocM;UO-k|`_wGgC3V1}o_4wv~;^cn2^$1I|?eE=;WhuEO-vV8@^jfmC}F{dtj zbNNY9M+N|P(e2vMz@s>5?Of}{fV3RJ^NCMKkoGo$S@6G>5Gj)0m%66hgzW+q9yAcF z2^reL4Rg3|8fOTy4FebD1^U`oLAC2=5Uxbg%lGwo7037UUA8IrviTM3D$KcC<8=F% z{S|&^uecHaR^s*!N*n33m%ex1ljl=!rtJNvOZ!H!eRQ4L+mOfY=le=ef9vP%8Nc`Q zF3s-e`K9;k=yUVx{$sZH^9}!p^Ly~+X6O6%?&4~;mwrB)>+7YJ@6+=`@AG(~^{3-& z=SGSJWT(gPrxOko2X9w{zenZvwzq093u+<5e{-&Vd58DhMG`=T8d7yuU&crs8q$T- zO}nSlD`Zj?Z4Gqf9?^gaNjjiE`Nd$Nb>g1703WCGVZ=AsEJQ_3Q>Q8%MIk}o87Vqq z0HVhVUsUYWu-zPQa73i}_TNpoCC|vmKaBx$@mH8~Yn+5OF3AL0op$Zm4~5NmG_lW@ zJio827a7{`hlAD_qht>H@{iZk( zc%394z3Ewx(WPR^3i-I3qmH9Ys5{Hrg$X^CT&JL)#BGd5aG#@sy<{h#Bg2$Yr+I^7 z{UE!yx~i!Ts;gYePujKc1$i0V(l!X$vvpf{*6 z%+E|Fr*W0d=+~%F%u8_Y-L2MmWDW(o-JjjuM$HI~OzjsYkdWDl;`yW3J8VJ)hXri09L=fPneWZ{eGXt+g5UODP z)Q}*@MAk?^C?aIYu1d>1l$KQ89h$wIA5;QaXpAblK>5V%2Qk45G`Mvn?>>@CdCGQX z<(^t-WppTZ=U4bkot!W;r8FPZV#mHmojPR|PVq{LZd^m$X^W%&C>QHPE3Ra{pzSYE z#ihtAz+}B{y{`jLKY^fR1q~9( zt)aw%%KxBqx{+p(|CX4Nrs$}QC>kj{7h&a{k-@~juFlCDZ6VE8ZInW$BB8+{txP}b zz6y@G^4%eA_8dIf!B+*d^}~5MqMNC*031ld;fN(*Iq~hJ4LzBe6hgwpuLN=a} zP0hwnT}L|{ET|MeF}0nv#0*BOT$0~`AHpHEm$;|O>Y@@VCgz;Wh8pl1!Uu3p^XHVR zImsr0PUy;!e1XlWeQXQ-VD$VQE{8Yl;)P?X`a6l}upNDT?7*6q^;V!X1i19fJJEzC z>O2@x3od+;p_*&^Vk-T}nl8;!q%IKp!;3VhlGf9caFo1hBp4+_rNy-k(~x1>jJkzA zBy$+SW6)^2X(pM6`Y<%zWmeGUCMY^?jn-$Q?9s%8G5}eW-Ij7oBXTepRngHT6K2k2 z=;!GKpuYiJFPUdXn2#Ugk8Ze}<;KywI|$D|EeXWR&1rI${>EV9LFCt9he^U{qLeOq zWQwt`4>`g-xT_}~$6GQoC=!7RIUHXP1IY%@EOaq)MBVLi#^ly8ZJ5uXNd#FO-DjuR zaf}|D>@?vsnOKY3Y7{`~H!udx!j8G-IAWw4tgk-wUD8gn<)m?fwTa<78pHmv+sPtE z@_^(gjMyrcKqVI7F|Pl^mgdt0g#6jsnCarb&zR86eAAae6i=uhV_OGgbE zH&%U|XTp#hTQ3;S~M#kcps5Bn7$l&4iu#Mz|zlE?Kvf z!PPGuy$2~oGKrFCxEc#A873y71!fYVOv!><5`G-e+2#gkR=J^++C*1U1I486PW9$V z;+8Rib$GjpN5sh&DF>tG22WQVaTkKloHo}o^;G4FdKcRkYoUkd!e%xL_^VO}>pR+a zNTMZ)DWNN32epd{;RU}$Co8@0eS!oh4w804`f;WFRE{f2xOlStg(WY981Q!gl+Up2#!;O+X#&Dw)vCg#1^!7=xT=?$@+Pq+CDvuKb(|;8EM{2|i$NsIgrh<&`N0Hc02l%da{@I|D;>~)>6k)0{W_j(qk9b8aE{tNf14lYsessI{&r6x7U;C z36+hl`=c-q=lJL$MC8`cpFw21s)WR-9!qoqX*kF4L%%YuV_QhN%d{DzLe^POf_uZ- z9Bv^sq(!pEKzG#b;xY6RsPvDj*m@Q09s%LhrM)XML>MST%ZSHC%i=XCHc8$A()igU zwP9w;&@=%BX8jaU+$A|ebe0SLH8I(^EmfpX%ZrWbkBLKEqQE3g+qfOHZK1h)toyAc z%Lm$QTe}DwZnbYc7-t43rw7X6EvNeT0znxy?G(+}xMKW42SHhc`?dE2w)#*5u5;2y z!HnCoM}`yztY*F6EMtQl*z&dhQ(Gz>C4;j`f0H+gK;}j)?1s~86X@G+c5#>f2&b08+m2z-&sbOnfMb~ zo`LRVpJfv#E}KOqD&{7`1dYGaHR{9P_LU>YVr$9g&@~wJt5rdD`QjOlKid@>wgTNJ zRcrA5A4`?aY+e*><99H790BznFblXbSjVQ=abEnm37!0@r*`0=&Rl;W`}+{2ks($P z`rQXoF7j(l&;=0J2mmKp3FQE^%A`e;D#tozzSo*|P4bgKSe!yNyT|u2ONs^J%!^## zu@h7kW~-J=BP=%kOZk`gEm%$N)a!%)-S*7vW9k;EgX;+-kQMJuk5{NF>$_6nfQR&e zBOyP_S0N2@A%I?yA+YA9Q*Vv;WMF6bm>~v`5b9$B`2qoUA{&tF?lQGMxKqpcnK-_= z%0671@f4&ZuNnl()83)rDXmqvu_f&vf<3lN1z`&Y_f%i9tzrMuI)>i{iF=!VL0%Le zG6oEcMIL(O<3GoH8IOrrw$b_o1aU&@SMMuW1nCEg7?M!TD&@`c{42Q=^mww7cliZ^ z088s;>k$axpp~U}fpl&B6mvc9qSc$&oLg`M|F%jTZQiGmZ@dIzfJ9mCi6oyW;a*WB zTI0H2w`7fo9J7w9q39roz>-9Cs9CDRgjra|QV6WC0adhvnt(Mfk9YrI!VBkSOSQ3A z3d+HX#9G~^SS3KQG3`FBhK7fw>yDvbHmF|=LEGbT&r|-6l^kk23E}B;d?&nh8#owh zi;R!<50fu|8&+<)h{%sDt|P1%r{f-I2#=G_*Z`=V4YF+IxB=CSg;ulG{u+?RF$kUb z8KALzbO_S_qgkqhB0gA$aaLhng1>QWuoyC*2fQQ1(z#T6a}Nd45;20*3+6rER#~Vg z>~^nu3=Gl&%_f~Yz*$Srx$8E^Wm?jhM}Y?;CX8+wezkjej+rQYBuE79*@hB>oaza& zM&;jwlfF8s4F>kgbmanwGjq{0q-N@GC13n8CxU0GMaHhCdbplIq7tKpk3~j!!!K)v z?!DnK*c?f-Nt`Yhe-)a2R^| zOGJ~I%}_{TomSL+(Zq#Zb@5;L@96L?2j@^Ep2u)%9R5R%*M_w_35=(3M+u0jDYE*_ zM5)UZ^*}nY19~)!N764`%hi3=5n#T@a*Oci8fYii3K+-4q9Hm+f3WZNBIck;~|E!J7<$X?nw+e zAJWE9ch>1Yljus6a0A$PlR&r|s{~|#@O9O@ZdOY#q9|6HgPNw7p!d-YThFjJZNa}+ zsOAa&<`bSu1Z&MP6j)J@ZW)#JG#3?kXdBy|g|MPu>-o@zisOvy|2?)N?4ri_E6K#5 z#ODb>VzzHQfbvUJC1G&L!u;0mMvG@1SE4gb? z%0HSm6x!#qW*tQR-Nd257zDBigXh-e>X=?iM7kl`X_Q@%#)ul^gp>Ej^Rh%%dUdkuWl`S|Gx;r5 z&KL3e&^BVQFL;@xT?MdUv?>mF1&AwTur}u&9+KKg!Q9M{^SzT3nxwE?LI-8d2IidW zlhIj$s*@U<+qkqN_iJ>abxqki^OzTE=&_!)JeSYk))^DJ6`6i%<*p^Bj0_b9NgwIt zi0Bh6ZdGrnl!32YLrK9LQZOW}5p6jXbjioVYArf94nk8YW(;nrB8Mr~n<=d>;*9`= z-BsaR_iUd3@|Bu+3eThl>Lq}xa3UUS#!{fd4DjM=7SvXfH){c6o;sn=#;!l=ZhD`# zHkUgNe;%VSL=sDQ5?LdRW69qnfO<4rUnZ^xhG0puL`%on_Nf^=6x(7kXe#0dNEmZZ zITzUn@OxNfr}Cm8upk9eNyHtH1YY)$ru&brTOw3#rVm$N2DH^9U+<2by)u?6+`Fmw zF2aX^@*i7<{NWe!nY-Lmz!S$6=rgko4u~(*hg}U(Hz{R82D!mx^fJXyBcIi0d*b7e zAaAyX`P`3|-Ww*EcUY*OJ?eEV^bC{8R%YpqnIp>AB?vqXPl5bM;dB~&ru$q<0&$UO z4C1dykW%T_>I{@yXB}cT`91_oU^55^2LrP%$r3Um2*tEH(F#Zarvf7`$pNp~lkqbu zH(N$JSFn7=`Nc>9r?bB|J=fMLs5W72EJp)RmdhrmRqAzK?z81UjqHw=kBKzMNE@Z0 zZZg;{3$~{rdYa5~ub_ZEu+zPh<#)4m)0!#uOV}qr8eOy8Qj8Fbo4^&51i9|wBxQii zTe`F8Sv~XH4Os;%LmZJDb;k9>v`xp(Bo56ptYyHTBVUx=>^DW~VR#zt{f|J-P$f`qC)i>$B_RND7Jzy&^boE#mw zS$K`>So2_?dF^laSiw~w*ait$*oZLS>4tfJp<6)cp6jTKJ5;{|kk=E}9$IQqt46W3Yqh|?sJ zUnZ1Iz*qrbG~aG)<7)<8xG(F%lb~PDJGO05m1{1v>9D7Ce* zg?#v38v-T&4>2Hi#{UaGF%ttL`~M*Z#KOeJ_+Mi{%UU{hIPDHTFLkG4&)5DwtG=fz<@#WLdAd5HvBJtpWKvL<7Sf&fDQeMJdbXXuu~BJm$r2;7xN%jE zi>uxh4TfN|M%(dFBr+w^EY=t$B^$ zeX+n{C93L|seh~^sN$b4(#0krv35;kGsnuF3JKk{(DhIS1)3u+CaT7QGR>BCxKhp5 z;rs@qfc0IeX;H>Xt{MTh_b|yIMH@so?Q2R5h2|j|IP0uicGazgmedo<);_3S9UQK8Q+c7L_}l`43AO2 zei;<%(1X6JH|c9|nXw*4Mzy`v6Q-QY37~2fwwc-IH)ONb$5EuwG9tspxgrlGd{uck zITD2HW9jj<57zrMsU4L?`>;G}8MSV+%|lbNPu;3ny7V*U@#CS!FH7p@;WowS5v@p* zsX|g%O-isSJxI| z6g5sqF=CZ2%S0cCq6#(5oz1!uH)@4FcUl(9kg-j$H5ie_yf<$1tXHGaf{#mdiv}fA zD6?Og=eRXm=EE&_nkz__4*dPbk=|}ppk1f=7=*v^{XEh|-#nWo3P=_d!j z-RD$$H(XMw$cIF`gQgX-_Q45?}K`!_xs>%c1Lrvz^~iyC#zo+ zRgYHV>$k=YqS2a8FLBSTxBC#|Yrhn4@3C6fiCU(YAtFq{zvgY8!7T8v?=D+HzC87| ztdprOzmKz%G&`^CpW8E&xQ9-^xA&;bZ@Il)5FO6`(L-~YyiQ}=Il?hK$ailDjskli zsIvBdkyHmSX4-Zq78HV+?Xc3cAimWFmVQoybtgU>(EH0kPuEll)3Z^l-&1k&r&1YX6u@cZ1g`hin+%i@!; zrc|JQ0?e?l77|67*BQJTvQ^_v;&)f-w-qb}GCE(sH*Z_x9HdI?7Niw~I|O9fg@qV8 z?jK@2+{~2KHH1*M(~bG6Na!TEfzb!k6N;m>Yk$UToxv~dBd?JZ>Vs1_$hgdbPN)Vx z<6{rCSE85D@4qhG|u0FkrO(VC_d5x_z4?BKptE(0V3aEhNwa7OmW;affJh<1{ zFofXlmv)pZ89e$PPQT^xcj7(G6|TK89YF#PctU%%8tZfxmqU7HT_;Ih4fxBu-j#aS zpvf!K#q2>^uK75u<+47V4>!7M^Bv%sCyqMkaprJ8?UgqHYCdB2F=oC?Qs42Dc~uR% zMR&AP-BPtm4C4ZGe0VCi^wLUXM|DB&8@Q*L{(}6!JSFsFDT!M{@Fptuf+3Fp)|%9nOe=+{_~>m0iVqn?v6aT>yIVbuf@g5RXtx{ zch7ZzmxG_L*`)1*-rVOQr#yrn??qsGd`*8|s=lxm^2X-rxR~?H-ey^EE9m8#8u`|h zJe!*49Zk93W?fS&*qs%w?wThAtt^99Hf)>e?ix~OE0}FfSXSj;4SqVYrB(TXXxiK2c+}L_`ae(T!)U>4fe2a%hR}l66n_hfLldzi zEh#GgKZ-3yd%752brLO$5+DDg@(z zwg-q1n~EDmr|0&zeAXb3}odEh`Cc|hI&IL@5Z^12wj0+#WrpY@x;t9aC}`YqvA zz3MlDmUG{&A-MlT`Cnt$RbeFVm#(xV{p_3^WQ2ZvQ4kN5tY5X<_db?4PF{IiAD7!@ zFT8(+#JPiqgv7m1X@TqsNbm&r8T-AaZt;}5!esEgpLZL<^LSozf!+U8dA;m6gXi_S zT@RZ5&#|=aApp6V;F(G7(}{Q@%n;f4=K*kd#}9W=QT)k!nSF85f}1+voz9L@6?}5F zlfi}poLX5Pk%|+tC*!`|I3vCD#U{oSgMr%!GK2=W{+CZK;SyAl7iiQ)l&2wo3)&`4 zF0A+&!c1K{flHh(I($zeG7s|sZ%hAZFzJE#MJ{3QDEM?~?<{UxSPG@}WCgYd5*Qm@ zjX-myc}QXHuy`*6h(?CT6qGg9Yc!XPgysvK^T4!@{r)-Z)xaz@iyl{64)%aum+*Q` zlCxcO)9>BSA%BmQ)OmjijIkP_WcF8tIUkTTaxm$tCe}1?U~?p}$P0vfH2gV4(ESL& z#dg{S^SR|sEedGqPvaa>&sPvB15fjzJ1xV972nO+>Tp*7jPNL1VFRo{IH zm64%u{XyLU;DO8$_A3}2{-twZCBe-?$Hh0mjYsA5xj=Q4t#QQc$p|8TbnU1SQzS$c zD0LnJWYnnw=~%p`n7PbCqJdEgRt4})6^hj5== zO>_l|uG1tjpy-A{*xdsPs($WM;dTMAE7^Vi3Vqbz_&v*%+sfkFU22tKyKImS z`$#Re(Q3@UbtN=cho{oZkrSHrnk(PpAWKkdqEN?e*TyVIwng(f5W{brYp}pnPS4wb zzY61rWMI;qnP298-$M}&2*h}cGq++Z344l&LoWp~(E=j;F&ZuLy+<-oE zWhTNb2hiwS*^HfY%aF3czYbSSadKwOl!%$@glZ)nvjhM`I=1YD1>A87v$+PpqP>+A-ZX-(v5FgoS3q zJ%x(hWy>Bg>=@7uc4R-u;Ovvao#t`mjS!ALWo-=+Ua<#|n>%C30b>5ijV|;5e+4po za-A5P&SSleiMN5$Lq@qSG5LLyjN!$1lnZrvOHH=D%Id7J!;ZiY!L6klmEDS?0sHxF z2zK%pwUw409_KndpAr0JDYZYoIL_d+gik5~f12}e01KA^67|A}vIA;fD#UI>;!#fa zuvU*ntHmEK4Y9B$h#?=C@1JQZl**;c5lsFzC~sXn?@i{J-fLo=vQP$S-b}PL>%i*WHhBbDR7CEi^zLE*oCziT3*P7dfEtUD0 zlr9R-@8x#KmhC=jg2UW7q*YFxMdulrL#Xj(*gXax3FVCr{a8Y0p=F z0%mk&c8z0?HmS&S+{ZoDN4apb^B^(}Lqci6t%o4{WTzLPUIu~xwE9!i^TUwM^Yufh z-4|8r=TINr1HaX81G9dEdotOFjp#kb@5h4AMNLP0A$6Ct%Z~44gS5sP-f(WXI$fy5 zCIi)HUI^=PK&oU&$`f3|zESY%9OCPnL#Hz>4TV`@PVP+zIrz*&W|)z5wL%m9yj`tV zGpQa4=9tM_<|i97^C}R;SaIR5#2v#TGZc!ajE+AqpzXbW5QA9{=G4S@6%P;LrSl$` zIeh;(Bb8SO)uiU|(IOBFan6uhdjUMl{}BEUNC*eVe?dY-Ev%hQ9O*@^4V+DcO^ob} zP3WafY|Wg_30N5ZTLT;$B^|3E1{9wcwL=FZlq8Ji5Te)l*nyVV^#R=)-9H7Q5zhrb zzMgd#D-He=oSY}eB<&k_Wb3DuX3w1#_b8sKsvQh-tY%5TfBOC|q{dg5-}?%_&RkSC zU%s+h?KEJecl$u{C7qO^*jSYQF+*c5Gi=$Z2^oc=km%}c>N^Z(m+(CEENAbqUURfy zH1&gN?%dX16H;dZcgJb3q3lzBAH#cgh?MrU-9%o>_Zq1o=yMEQIFbR>$vV><+=JYBf_(NA9Rb}4}g&=c+fSmapd8U&myQo2&8AnKp?yhVr z?&K&NPA9dk9oM!~cA+o7s-f_2Gv7!qy4&04=+k;?PGjwMt5l1BEw-&^MYzPCE_(~&_82;jG!atTIhC9gKE1cA#Fo@>_&P4Mv}^RP=8 zg?R7JRm>$}uoR#BpVOmlB04LYGE-lFgAN(~s-BGua7?KJbqbU<9e`IWIC?_uG@y?- zM9~|_7J?u9s&bx`xy3TlJ!06-&P}@+w601Wkyi(#p8v8gY1}*L-i)&I>s>xW$TNpzbS z)6}FUaOP+E?R>=>wyJ(Zbta3A`%=CT@r|io2`UC~4VBLk9~Gx7C-RDmE#Rrh(-mqb z#Ct1aCRD08gs0%uAcXx<ejID1RW!49*`9IYrhpNR* z>#v~j`enJM^!$(O&iKF5_x|_m&dSd6U-3g9<;mD0eweNYRG;j5OO&mD{6r!N?$^il z@U$6|+Yru7;>i5LIQK8mwcFerG)MwREt4jl2O?cEEiyde!*xBhPR!v#|CGBqThn@2 z4DDiF4&qT%bl}kL>^!Kr%n<$PJMf3c!-rdSIzHY{q-G4-&n|*|KWt*tW()nic1#YV zCU6kyJ6%P^qgo|=dEk$mY~X6t>u?FtjMRPb-mBapt6c4L$v0QPb}vWS*9{d-lGXN18YtYNm4vR+HXitNajDSGSg5r z=1*g;a(d#h&V{?bf0-iujL|JmIj7v6%&U$x1?mTtu{#2CW@Pr*#cVkYO0gv% zQ?0VsQZa_ru8eAd@%C(Pu9Dt5fbrP%x3R}E?W2z8{iccKCh%^Mswp;4yzGj>re)KR zn%;-+8bjBwtGiT0iT${Ru(Ktr@bwG&G)hhOe>6g-{~IG@VrTxZMyQjpV>w8GGIHY+ z>9o!$`EC9GF!l~Gq6F=>=-9Sxd-mA2ZQHhO&mP;hXOC^$w*BVM%S+D5JNM+Kx|8Bp zm9DPp>PoG(plO5q#8t&xO^qz@`%Wc}&6T6uPd8@FPlw>fs|FWQdEXS5&8a< z2G0GD&-K6P$^D-PH#5_JBOB3CoUr|!RDTCIZ%GA_dKi+5pm;C{YB_yMQP_5PcaeC% zdg$-iX0=LesW+~|G##Fx^Hr^aUV@qQW6!2=(03^;>hIyg46u$16ZPoJupVR}^o(qo z&&lmpes8u+cpEx-P`h*1ORN@NSlsho!aeeCogy?uvMSxqVP)doGt|lX0NfB$ zyZ&LzZO&~iomqG$p`2%uM;-NVfT@R32AM}ag{;R3rU`uvR0q@~1{+rzWPyMRH5LGC zf=Ff-<$*51vk1wiC#az3R|ZFw$g>75NW&-aBIDO|xJ`=)yqiIy?=UR(Jym=2cG=mEDxXM!3#X=!ZGS;-z)^7bR*3+og`wW&X-? zYbc@YF9!@7vyG)ZmMCAGb&{8(1n5$KS}icb;;8A_PhHoRI~+r^NE@Le@lWaGZw~$! zchyegx^{Q2D7myV#<+(sC;5&L-{XKc)#o>$jqnHG|M)`u7jW1Ad2}-Vw@I(^hwrfu z9H7s?vHO2C`Cm8`|KH^>BLOozGspkN4b8~H!TR6oxblH?#}WJGbaRuNF~9!EQHaxY z632>(ofB`Ep0n9%I1)Ngx+mRnwO(_CBM-&#cMvzsKmY<^!?pz`{)>Q&WT>vc*KP0J z2V|!Qv1e+qv%iJziY_jCQ+s|rC!Q*#zvmVA;xSzP-FaSH@l(@V;fWNCD9GsyR$u1n z+*R=`{WIu5;Q>}NmQ8LJ>@r=^N)Y^IuX4k|>0>UIa%~%&P8b~heiqbv4cT+QbVF>M z!(ZlMesf)}v)B8z%#MKN4Ya;;6B1ZpcfoS|3B;Xt&BNj(`JpmGBRGr0!H&z_;8gKF zFee)9Y7IyP1}BrvS&_ri?;ger0`YIJT&Ob!-v@ox@pJ+rB3mr(iuZlXE!P(%KkSh| z4ys-n^8rQ?kjD%&4**uutqXQ(pNV40LOs<8Gt>)`5qg#|>QGM1?Suj;zOJtCo9Kn* zSKh_G*8kQ^0=H*ao1ies_Xj4|t?xzEnc4`<^AnoBFl>)2$~42tm?RiYl{t>4D_T#( z-6KC{f4(CmEyL`Nl>(czc~Z^%i((yor`eo#W5OHmcMW93E;xngY~ujK1Ql&WM%=Fs z<%=?NyrH~D{N@VU6n}?enQk|Cr#XxFD(Ln2DMUty&&8&ofcz4_5xwHB4?a&yI9I99^`tB;`S<-Pcv?;khbarX|Tw; zrjappSH;j?$}}-J6pv9c+2CNXVzPYApRJ>zmBzra#xb+n$$2tht(JPG=_WaPE&|X| z;%d@fuat%n8erRyzx9nk*=_8+E87c@x9Tw#Y9mi>I=4D_JxNM#dg`yuJ)vrhtAlLZ zRn=H2C3*|l8GN}^PlLYZOc@HR!^7p(;5{Qu@w@Y3#V!ZXaB~?PkBc2tz@l%44Y`;; z2JwKzCXW(C^d>Q?n)GfN=;2~52w;(wjnuGSA0a`3D4w0l{{&Kz`zT||go!UsU3s&f zA!0?|U>;8pw!6lj4vR$b=a0)!v@23HHB}RF(i&^Z*nXt6=rIBDC6Mpnw6uvTD!M-q z9XBXk5J|Ak!#Qp?P&vuvJIVdnj`f`J%yd-+H%N-k zKaD+_XjZ*ysG#6wY3bOvl4Vn}L1_wNa2=bxTbAQq7kxIhl%B!PdD2b@v{6&JKWvW@{si6#;c^)k&nuI$XL3s5%43Tm$Cgc6#GIt)KXJgly=QWd=2mVwL8cHhwX8-`R^2^dW%m0!x&L@Cy zGs@*b;`?PWIIPYxQKn^~G@!$)nXF>qYyPI6xVo50HimBPmycJ`^0t{8+G|rihU9IE zPF&r27+-1fG1@h|n%pUyEh`FW!%0^VJ4RglZ{B}qtt{W$}E|HyMLZ?Mh#=Mij8G+Id=wN7UcUEYG@z!I09QJQ$E_${7(&N-w`M-Hgdd*nm2B23-+GO zP0l-q)XmO2huBTeTUX@z`;}YnI^eY{b2I491GXJ~OXNY*%7e9v zNNdzrBiJ^tz3Dykgzd!E7l2G*kos>{<1|2*+FX|(VY(LXK@ zgd&u30(MBUGfzf=8#Ut4lw#9z^B(P;GS*qO191PWct(LS)H8hTQ_F|Pt%bPvEXya^ zz6q5XF0=i6pp=8N3}*suozue1^&q(bY^Lw=Q$wA z4xrfR#&I@w)I@HXAr}xdWrgtmO)G$eEbpbEccoetbWI#ge$0%R$jU?VPHPVz|9eJ~ zpb9OZRYW_uJw~(Bys1Mj(UfFLT4UvymafuY1hu5Sk_^8qfpnJIngKLV@Ez5iXM`wv zO3Iwt5)}*dRm~7iF{F$a2tgqP3Rc=tqjs8rfJi1>cdHg#6lD}Z*hJBQkf)5AU_#j9 zpRW0!qCs2zOA0-jCmdztfrw;EB4IYy5fMBKgv^<*ONRoX(?HeWjgj*X?Sw87L9NkQ zMVpZB?FC4x6WKu~5!jezA~IwVjt@yRv|UwcWjG1$R56<aCR94u&JCcZo~R!pBjyv#S5^Ehyzqb{s&~0-yWil(HGOu0G%HhzyQi* zKdoN51(KlLnz?@fWL@xuo}GDwnByU$dG!u5#_)%n}tD52=v=yi}T`|D+nFQEjR&%?79rR=*J5pS~830cLjs@UIX8 z6P5}Ns{sx5rb1j(Fx8$33v~&0EEH^Rh)uX&glAaY>Bf&pb2uf%;piXnP^-;OY*;HJ zx-L(fhxKl?kn!+S>TfcqOl3;83uf4N~srpAM*ee+;SFqI%2h|)tn{`T3iUbJGJ$> zF$+>eB=^kv?`bLVpNzL^vY?s1GoD^A-|siKk#F8ma7|51IPwd)qid7tZqA1qH$c<@ z23_cAGXY)YK-J=lsJh4iL`;x_vJ%9Jf-8p4NrwGDUD;}<^oT&bwHvk}uE+73`-RJA z&Z{2HLEG*LGRw=Q=R^e%tdG2(LDxZN?ixZ`FZDfFJWs66F5L&MElsh^CqUg-tOI1z zvn$KY3b8xNbfUqVgTf*h#_8(r84?U}1o)QXD`)&_csv74x-h}8h@i3o(ze)S#a_oS&c)@8xNY81 zUB#VNU^}ZsdoJh*t9jOuvYWO8ltp0!!5^ukvUf|{bQQ4m&RjUGm!C&E)O(67jb%zj zloy4Z+~rRSU9j`E)!W4}Tw2iJXKpsE;mzTHrX^~jJ)Jz_Y}H?ssd_ysUvK0G|6^~= z8BaDx09Hx=Ys#>fp~gt#71*ttDj|jxin7PW{W1WJ?mL?G@pYq@-G98<+(k1dHCwuW z!OVX9w8ydU*);WUBwfWk>kTd6C}(FW`&oz&!YmxD#2+VmS-(h?5O=wrAld`ZMN2ZA zn;%DCdQX@L2EDOD8)afF<>ZQBHeW2EscfM_pcDe$U>s*HgCqeM;Yr-CSwk5No|MW$ zs(~#*g)8)=ZHDiA$nX8{OJKx_Z;(s7nqz65%?df%73d?ZCk>cp`J2FFmT~=jB~&>L z+VpNocHq*Kz*M_h?H1v}lY_ZdG}0MVTnzY>P_jY95~CT(eR3ZdE^47+E6yr}i)<;i zhTe`oFerkPIl_`9Vu4ex?jjWt+W6umT#1*Fwa$1NpHJ>=0l-nM1M46haz>?%?rjg5%)R`#=a zirC)H$YHINE7t1BaGIkn6ymDriCejrNmcR%Pk#aIURBFQY=&?z*Dt(&v5;dM8pM;zHkZbx^6=iu{IOBNL6BIaskH!vVea>4CwR0ivY9jX3iqdp z{gd6|O--0zn`Z2VK43U%o?XBsJ#Qn*1qOx?lw%|U2#GqkV>~rZzCH~E6G^dB<4cye zSqPTmBGKQLlWW=P?r%g@oH3pDmA^1xN!wn~_pqpzc$29yGDWnK4ReA+ z+vCx%^JxAIPI^6HamMoC z1VJ|wD~z+9zHcHjGdN0E)Ush06>uyzJ5G`l zklmJYgKYDPRXeM^EpsHoS+QgMXL|?jxny7a4y88PY-slF6f?NHVY0^>>6DRkr6g?9 znpK9tzM)F>Od}zr?g={pw@!{2K%}rYrD03Sl#>(E@TMaCP_#lo0$K5lN0YPQf1;L1 zrh4$mlO#H`;G(_p#OfPY%T~%fP#cUoMd1Pquu=)(o*LGaXb3A&H<8bw?B5TZwDUTP zObRMYK7@;Wg}Ns37Q%v29xjIn?eeZt^PgHzHOVg^Q4iA^3x+}2BTb?$KmSkVqv|w^LC8zcx~dr#3Fe zv3NdlFdACZ9K@)3p>=6ChNmTxCv2$Mo2G+ zF6WD+aUH3snn19c*2L>>)Xi4|)3Y$2NK8Pck!}pMkep z>S`$Itnb0hX&U=-F^{Q7V@l>Vc_u#)gO zQ8q9X2-0N=iiotrU(|~Rl{E2R>nzTPb1a{15Hxe{96mL{30!m(SEFi~v;?i1+O4wb zB-w$X%2x<<>NWZxraO|+wzMoN8!c|lG0k!UoZHk`(8Z-f=*DdvH5F26o5WvYT?VH! zLatH{nQI#p(wZ!iDxCk!ug97}-)sNPViUwD#G7rZuAezZ-rQ~|u_<>y9dq#75*Er^ z)l_6_F{${74d7?N@~^C7!-Xa1A?&Vw(%K$&mx^W{jPz+XonF_OW5Qa%-|gBP{#L9W zvuI>2_hbY_K-H5al`e642V=spLDG;2uDnRArzvb)#8X$3+=OgG^&D2BAzhw} z6K@~y>u*%9@6DX*@!IBG?}z5~(9Bc3i|fcgyE@ci_WS^HSd3Jv`&CzAR}>6kRV{MD zjl@D11IA!4(jEU)5t7c(VsdgZ6Vgty{;LV0DJL}A(&Os)I@<*VrTg=jP1R`lip5Bn zRe-@@g!RN_D-HEKNLw%vMv}J{B}rRzL2j-pg-Z2I#E*I14lzkfRQ4G)(|Kb*mSDjG zRGN}SMPmpAkNC-CkQ&m^!s#6@{YZ-IY6+KBL10#+Abrt2%llF&Jt=fG)j>&16swBq zsR{O>?Eqgc&7|dqbdkYj)N>nWS#pVoOC&DxnH8@-Nmn{#9rF_sa_nhr&YoqwDw-xI zi|+yl*R`Jhv!DH*fW|Lzx0i(H=Yg%QunlVDUs7?C;w+P<>F8RXIZm#uYYd`xuqjYA zX4$;{(7@BwridY`!xsS}gMbi5uA)Q4I=a*$Ayc1omDV6djc3)=5^!aCsr%^SKN(G1 z24bTZE#SBU7*WzHSPXtE1&8Kc(ZV`#8-{3N#u%q@w(A=W-MZ#?6{3V;l@zTbH4ONH z*1NPLE4h|09-{dFilaDiPBHlaKGo*{IT}MEkTsn1tW6>Ie*mVe4VtTykD0YP+Tz=j z)tY%dqWl=&lBh}8TZpJ{2|MczTjsr~&vw{R9A2A!g9a|`nh&h7t*n$Q7HG6o|9VBd zCIjE6y#Q4sCfaon;M(i;qT73}>H68F!K3XGuSzVcy4xO>Bd2V#H zNWMW2<`GZ+O@J<5sOCPTa~0jKV_ z6bPMoC)wpPS)-tX0csUF?0hr?G+GySg3oC`e##EX`n51T=7-ppTwG&v)o-b1{LAmi)jP8s=VddABs?<;{8~{Jkl) z?JJIu-MArPUSWvt_6kE7B~pDyQA!w6$~6y%@5}a*EyL65?1p!?#IL{&|t2=nN z1gte4J5-5;2+|(q{S4MrC+jj%+pQC{ zbWU{^uqN9gV|7-pFOS`%xv3g9q*?^2%zs=9hRwoMB@|4mg1rFnBS^A=q_nCJ!Qtnb zxpF4EWdo5J3EH@AJ-5#ujd?u`jJts7O}IXv<+Z^~Z>>Pu631rJ(%kK7GXXt=ko_cfm%q&4n)nihe0!U0X7mKwpzmk@_m#t# zbr_>2KfK#YS(_I}n!DGv&}za5YI|AChraLfT=#l_b1u3Q6?|2VNS(7|pY)`Th#VJz zeUgvs5(-F95lRhYl*{;X^^ozR)JCi2RKt~)f;4GLxz^gH2Dj}{4{K|2=)ghz6MM7m zrA3uYs>nu2Kts@(maOVv1s50m*#YcdDWHh^hS7X`3yam0bsQ;c9W5UH0~n*J?7x+0 zFLP{xQ){C=l^%D}B!nW7R9KYyiY;w4RObK^g2IX%e=QJ}E^j@EXNvjmS3Q!TY$w}u zS-T0}0Ioe;j!$GtFYrfw$oQrS>+sPzDKW#Ap^`xG=I1QbpxHxF4sAxjZIp3RWsAnn zFyxDlF=H$D`>Z1$nioxu-WW1Q;?a5zDZ(_PL=S4)5^P{*V4qRqRx~2}5vp4Ji=Qsy z_}C`13M)>OU+U=YS~kH=nkRTa9nKqvKOa2bwS{w!9`M}RPA`ORGv*~<=i>1%R>+s7%h<=PFLOF8(a-xeQ@qtyQ$50cLw*Vs*VikMz z?0^fYU!uL1&b?A8k5_P<#qTim#aFAl>wbPZd_t{e};%y0|I@{i%&r=pwl z0v)6X{J3(W8#YW5mP168GEmN>ujj-H^sUQN53 zzltvi!Bz*PpZ%MlNn34o@a?I@gAr1mChi+v#q-?8l}+QX5%La(A#qS_ew+e~sU@<| z_=Mwo4RFGDm)`@VYnLNm4aBx4<)H*~E`_A(>CmhOc7w2ezC_EXM=N z#u<8uO4Tcc9}?@@LbV}Y$N!P%+g#2)hrBt*>2))n@_DbwjOppy?b!I}tYAv0=y#jM z>75nx5!-+E8^@=A~WM&xcz%sPpP4>>QtdF_JX;*S+TjCw&_q%1h)G##{#43$Ya z9-l`_8P+jqZyej%a2D_N|)Q z^0{l5Xl7Xb7~0%Qn$aO~CA*;w%7$EIcPF@De|;&V$;I{%wFM;K7QF)G`XF;LSvW4uS>IGH_eHjXZ=%nm?-z?i^o^fbs56a8 z$QlJ@49p4*(Pbu=q>V!6joY$h!y2VQ8>laK08;%XAtk~F@D`|&hxrIuzfzIuZ({%5 zg1NdngJ%W98gE%#w9`VRlOo}Az0fJv!fnZGwR9sgXs~_o476b#ss@u?QP46OmoHfJZjmk8}yJN+Oj!-pRa?i__C zFiz^$WCHf&)eJi=A2x)g87i_&F(!3Jv?Z*x@74^-S{+kjRxm}D2j`gsRk`&Rix`=@ zSbFxCw4(YKc2cqg7UNqj>jrNsR3FeDkcF9R`)9t6t#H%_$DEGvhUTq$rMFR;_Ub_* zR6bC$3#~OoddWB{tVRV@D4te8Q!HsEm6Lb9qPdJC$z)0FM%6-H_F{q6S{>AnL$&(f z3h$*IM3v>M{j_(Qo%N(16G_(z&p-Q7KDOh|%09YUFTZL{PrvF&9Rty{Z9S=g<>PHG z_7`36tNWv@w>7h)SCMBlLf;hXXHgfCogMku@ycQ&XUvgAd--ARiQGma7p^+Lp8P- zrUaW6E!C88=|swUVsVa@lT%bfD)W>W6)oX~C`ik7fv1L`VyU2KQil@DCi<7@@H9h< zY$UNV?Xk@&pRG4H+UhwmS{>obvMBWqGRH%u8#<(2npZ6#u%Zr*R#lMjS>9wse^NTZ zo>V=XEaq!_>MzA|HE~t%_J9x^{paB_!X2+neEy ztHm2i@<8(g(K&Nyu`O z_W4;q-zc}@v?zbJ=wY8YAM_Z^yOwn|H@k{$Yq$-bv5t8s9p+qk;JFbZ8ZO-&P1n?X zrF}%kd@A+at~c&xt6z3Jb@u@1m=zDlmico{S>B2OE9;47;y3xSJC>5(Xh4m8k?y={ z*Qe7@3)WWGdfVqKQd#=wwO>hI#8Cf z(069>|9f)VJk;+;)ypz7>;9A|4eXJtP(r}hD^rmS_7g=RDUTfD1E zNa^PCv7XYBR}r(1`VD+F`ctr1S0Gh zZl577RuQzLrGZ~zw=q;k=k^1sv?B*`T7rtwc+G60R3%bkbP1_K>2)#PxyO#|d3qXY z&wc`NdP_@IDZND!8bMQuqV7?QZyON}4H24zvNiWG4|`kNQO}R}XP)Y6FE|Qv*~X7n zo}gME#|PUp63P7ul8beS3}GYAVxq7)AK&fy<~H@h3Moak0L!b z8C$tZent=CdVjv+_`Va2_H3}(Z7C_&8XOMT?mNSE^?a+MR9t-}QXWcwKCHBDxOpH%W$$&AwhxjWEY|O z{cV5b2^Y<8tRT{ve=%4Jwh91k2!g(|idt}i(7c?keL?H*p={COWD|M;jk?QoZw z)w-F$^)+ViVRrkO6ASm&A=pXtZ!vVHuyNHS5Mgk-CxoM3Ko4%_S=-nUE5*1CF9sr` z|I-kzRKMwrSD(k3)M9Yxkiak4+Iy7iN236U+6_C;@3O7^ZFHz##5{{zX<-@tF%Te2 zz5OBAAzx(RWHjRIqvKx5uC4WpENV(Uh~+YsIl}Jra$7>wNCV{ik^W*21zV^zFd6Tt zkEA9ePd>a#B`hN9?NlTjpGy8G^PSDGzh)SoRda3>ntr%7&Se1Ae)-hPsdxfkTR)Z5 zWQ8r1Us0idv6u6WtaGImIB*QsyGqiK^WC=&EVJS8N1myzqNJyV`{gON6)(f5sJFrW z-#N4$4#MD7Cs*r=#DfCP_a}_A5&s!EtFr_tIb8*r;6R;_|?y^Qs?#RBCFR%kd{S`%=413fDa#3qb8M( z){*=GOVk5BZ=$&R?Xi&tOrg4tMm7c$b^`tf^tPnBH)_Rf;p!1RpGX0VsG-Y8P091P zy~|eWam;4EHT6D+Bqi`B>S zZg~5)UPnbTAXk~5-Uds1MT|N`kFu65EK#W(2q_l@9qrEQ5=X}6AFszlt`C9M>faNa zdWCU-@VXFB_qE|guPv|4L~8vgkM<;xm|{%jaw10M$~2jR_cv|pd0Qj#sO|HvrzN@1 zpep3E;uh?{lkEf$qEeEBfjyytF*1j4xQ0GHMJ=`yCt{bldy(oSjI;I6C{+>^Hm`aa zW#<5IUo^*KxTsUa-k@$~N~n=~J-KfXhxLd}^wq5XaK9T)z)8;m66gbulD)_*-Qel|`l@*m(l0Pp6%8XTk zy@5h)U|rriQj z>~!Y{H76Thp6jhFi_2`4}W z)i#?zJle6Buh-weJK2%5yyjX2qx_?S8#1)L0+!F{Aifs%OO&2^3x3Z_T#kCPIEFvu zYb>Q^XGq=R?>AZ&cmeNi#|T&DyM><6PLMGMT<7|l=)NP?A_LO&lKh`orjmQ}11{v; ze6gVpq#Uj4ufMG5I*#o7A)@9tZY*ICXK2zJ2-v%&8kg9uzGoW~!7EY^Dx{M7FR zB7q0fliZ6bZo-SvxYi`QD_7{*hzh|}S0Kfi{+LJJ7pb}Kq}Wwz_)=uL*Rwr=rv$5Q zvJBWv0lX2*{aAtW!E5jUJwEp=h{-V}(T9GJ8GUz~`i8N2j;Vt$HvB~fm$2VvA5>>qU>^pcN?Li57|#~Vd-#+$a5zEPo#IS*`3c9M9<_>8k@Pl zD`AXD&uHsX^BL%4rwyYu?E~nAIYnuy+Ee}sRwcIfn6IElZ6}}6($yk|u0#Eii?;S^ zu}9$pRHyv9j;_*e;HB;x8m!u2-X5-J2D_TQ_rE*8gxZxq23aiEtiI!~luCck92VT9 zcNp3GTNk+Xb*;9Iw+*)Kcul7@yHb%RG$%MFN|S3<9?*X>tHY|*s_EA?t+!g}H;kSo zJ_J5ia2Q9T54K{-ar7L$r|xh^{5TUH@J={R*mX43vM-`9ELNzmHD7$L{T>#-mi**A zd5=7XI;Xtm%wD#RKZ^KH`5w?ec=vuXe@Kt8F+8?*zWnB2rUKvz-s!^5As-3m3w6pM z7~?f|g092vYq6ffKTGEkJ%Q~=`7#ejz4{N;aFL<`;l>$)#ucJq8Ubz+4B)Cma!A!f zJm=z!)5Sg z2U~?@vKA!0{4idP)?EE91e(&wf!R_3Q95e`>@FO7RTlg=!2o>TX0KIQ! zv<^GPX(zz|Ub9ls_()`nD#R3@N`dn0RUt}pzaHYyQ}(F=#^~^9W|Sd_<+G4!vOxCR z0rOa%@&_4HH6OBBG}MEnjNC*$22Yjx%RFB7AbF4Ia2evaea)Gom~3@{roAxO3fb3H zAVJ$x9W&z$V6Rq8lLWojBABKLDlc4^$Fu3W^aE7Nl{-WO+?-{8e_<*WnsxhE@;rsw zVbJq6gQWRRzwib;FqiXn3xEASX$ofx{=?B~Cad9|GNzbp`FR#WFaw#JEW`t7%9ft$ zq1FBmO)wh(-#IWF2^)_$OqcwojS8XJ0N^I8A)m*=Fr5iY+yn!7ET*dF4+WYJBACzl zc^U~R_$le6T2KDg)v0+fMkw{l6AVFtsjy6wM6D*Gp&U&^j8BLzZV865nxp(XUkW#5^FuS>+0=iXY5>e>%11LGs%+;c5h~CER|@l2 zVN-$px0P4v$p*KSBSB0syhpFeFdK6QBhbIiR6X&B;hJMSLBn*-_dHoKUX9tLlMUrD z51ODK&^30$O)`kDzTm}tE^NDi1hOjI>gXXH&~L3tGsd`Fc999~x83r@1nYDGH~9_w zsQ)K?lVnh*6&DEadSQ|9>ziTxO@I1T(An}dVuEqKPal?v(0+@d^3H}YDy&_Gd-u)&sM50Z26!R; zYUevnR(}ftpDH{{^t}W1fjkf`@{Q<%opMn4B>G@!+KK|5ssi|e&Q=0+LB0M-wj(8O zxG^|UApQITx;impc*c2jK^*o3vjlm*lK0Gb9Qek?{kmE0HRJo0ffBp+A=ug2nNO7y zpfB3uzLognlX*|1@Iv}bE&re_Fm^O_m*=c|o}>{J4FAu4Qnu~6-vzBkN&NNH-M0$* z5_~mGzo^%MPxL)Fhpze$Rl-XO_Odr5$*Twzk78*uuTcJs!s|Vfhd3v|c>WA|es1aR znZ)eaha z6pEj32rnJonUM&jQ?otkUPVwPV2x;-YX1_P8o742eRXIhJ{{BfGOAcR%%)$6xJd+T z4R--99lo~6ec6<~iS6nG_fsnN%W?387QspF1P>1+XLhOQH^}J6LKFG?3#$1KPI5PP z)lCw?Uo+??jZ-1~Frl z{GL#7YHN#WO z7#csa!%xWvw~3G$LRxqo(ttVsVz4X2&nmAbbn!Q!@>fM?9Vwc}o=;??EM(m?@-FOD zTXKU}5`C5G(KTAqhaGnhBbpH4ILG9DUCe^?o?Px?FTz|X@%sXdIq_YqIr>3zDW1fpo!Fo&f0fs(a3V}mJ}huO;^l3DVm4XQ2E;s?Reru|!aC&@DOyL61P?m|O9;3#uT~m-38O*!SjF==rFBy3P4H)j z2<5}fZlEHr*mu~hXDhjmkO{j2~i8J;uvCAt`Fpr`SmpPiwkp8~u#L%OME2V8A(wW*ju*UDOI zi%>7}mCNKZ~yRlr?cJ)_Z~4NSe)#1GmyNz3Atf z`Ee|da_^O(RjRLWj^%tLTyy}1%8stTQUL{EVxHErYFG4zorot3T?QIZ^A--*~x zP9!-VT$IHVtMk7QBiQ=GEy@zgMjuE;ZcsN|k2ki%(}r|wHtW)C`+T~)XCdJ4uZrF; zC!{W#O(d*~Q`eQ?KdTQ!+kMOI6iD2Cq)%x4S74TvWk`uEs-hos=?SsABZkLDSwXS% zBE7O@f11o;yV(@2Y(wo1n7l0CqoUhRBdA~63_p*x2|`Gou0%9F0~%~kZ4kVp#NEV~ zrMVtgp?qA&b=Mnc0*mh1lEA7|`^cIQDzs93p>E%>2SY_keVwrRxoY99C~q8yxcWe$ z%C|~u7y2C6R-q4-{%BD(B$~-+n68YB_oCVCP~iQTc<0ToU{Tsm<<4x|)zj!h zD0p@k_3@|~`2nMsHfbn#nE-a(!x^ufYoVjHa3QRv=1d}=NLg0u(u~#aFxJA=ob49a zJBh4@?kKX!amnMG_n6I>uQvqyfb*@0YIv5)$tgS0l&(@ z@PEZd@&ALw2LD20&!ejb|3{PmgxB!!{uwd(;u;;vUOu*J4-8SujFyBMO(Jwttq_Fuk8zV?O%q5{dE!% zHrY_XY%wotL@oVgco!dnVN>Y*ifXGib- z(a_0{@MPYCtg1U?H=M5%9laUS@hD^y7#wV=SXJM*4?84OzL+=Kk=Xgl)e=9623e5QkP0(Oe z62;V5HsuKC&CHfsO?8PBcMP{U>-lz#E-UUa(x%_Op<=)Obe3z?3*~;USvA3%B^Qhn zYa`8B%X=6;V|}b$Hm|`x7&WdW+tpQ`ZVZW~;D_JoG{Kt12cCZ<+cm~9hn~Q%`aJGD zFtwqK);meWr|e{=JY*$Qbu?CH$ML8)B2=ahszCK^NR|6%MaV=9Td zEot1Lfd(3H+}+(B8h2~l-L-LdE)I?R#ogWA-QnWy`uLK`%p~t+GD)56O6^@MIe$(n zwf9=f+qX*!E|FOLj+iL|G4xaplkt8h|Go%~@hzllQw8GXh^%2+ZYN9=btW{lkE)On zO+*$r6mN2o;m`Yy~wX(e#(pCuvxQN1%|a33qj-CAYvl)u2Fa- zK@qIKR=3KjtQ+a%L0Yz?DB9DV;zm2Ofu$-8{bKc*q&2DOs*yuisTw)7U3B0w2maE8 z|2OAgL7PU$`7Z@?sz@B1g&dhi=eqb<4#!a%2nYPlRQZ#`bpIztPiOwdkbKM-tq`BS zaM4~EyEM)C?}^ZRRb(#4$oBId6I6D|AHqNB+*m7UihAEPg2xu>qXH31} zo^zPfx&CTtL2@y}g6q!Mf95QLzJHVbS;=wUyKxo7pYDhUcj_INaauPIa$_;#WH(&3 ze8-MDntNe2F2u0`Tuo;`UHxU?N)5w>^AqL}5pjrmZq_fLzAqv%Fcm$aPcRH#2`~E2 z9!D?EX+bR!lWq+eks7n=$wHFjWaDIzEH2?Z*@K8g!8u~DV%|n>&qNYRTw@RPqjzA2 zh(xCv+wDEc5r!=K8Y#6P840A$l;bBrRels2sZWLl#z$!p*Q%%5R`$`}Ok_0LE6EFD zJ5%vQ&SMumA^PQEN@e0oQb~{F$%&s%w1Y{yY>Y>r?IVJr{$h!3f}R;gzjpLj%(jm} zCX5oSJ&r&;o$G5o4p=*xcoV$bbeG1BCSOcjF&b>~tRtFkquAszc6oU_VnBTl_QyDo zcol*>!@yOb#t9g+^Jq>R57a0DKwM+E5uPFaCh0}ZP(S5hq>J`hb*_7L|EpXnjddo5Cdjs~G` zZb?{tBs?V^vJ(o1VHBBi@Fe%`o=Ycu^B4r~hRb~sN1WlCCZyl3nFCSbjhPft;dL=X zTs$5jP`w}3u>wfTL;p?<2>sN0`9CTGeBLyX zUZ3iqAFe^3Ux|jV0$gyHI2G zIg%C2t6pCbc*3SmD*RoQ7`{Q4$#sp4S|&Hzn7m;iBE9{TG;0R9XWexB&vn}L<$LBD z>y(Ay$3zfU4TA(v^x{1E;bCKAHzA{e$9s)N0`UIuP%yBmW7FD)LW%SNcDRX1biZ^S z_l`ghZF?1eZjMhJ#ZnRvm#~c9wLoof{ma1<*D_`3E zR@~!sYRKHtvum~*ZJ(~i5$YiacOI@k>zr}XR-n2fjrK>+VkyTQ*Dz#;&w7SqxHKH1X}BJOanP_!QU-rVZ`#HRYg%$ zL|n8}`vaFO~QS;xg!V*6c#f&Z-b4j*Z;fl3NvHZYJf3f@>6VRr)IH^J7!iJ;)tAQ;rBgB?> z$Y4IA0Makm?_MBk4IgbDw4SpmI56sUCK})2E^t&Xtv{}BcGTKA- zYwktc92L4@EI;9sl|b-ywUmcZ*ZRiAXQX2+i-}AG*KR0VtCc+)NSgMX9_t?JtrlTF zhUJ=Ga3>af{qFUEA^M8}>~)}<(Vm=_mD^v6`WA$00sHt8Tm!Jb4%HO)@!{D*U^6WJ z7M@@ajyT8<4qwX&2iX=*N0=@OY`{NNFua@0^d29q_Qm$VIV%6rf!iP1@oW7jI;AoF z{X?G^NSZRz^ZhG+m#@P&NSd=}9JJu%9JS!Y#_|;NkAdsp+!n0XrjLtIy1wd#U9GG3*2uP-*6s@v3*!fp)m`ZxK{fap^~snv zMo<5G-PWB@BK;&i&d$+o9%Ezu&Zp0trg**YfobFq8%@om++aS7JK9TPWX99U3Np}j zRMW!0GK!W5rBsg@VW-ZB<%~klhcnlfZHfEz4{4~V$A{W^yGSz1(XDUX*MnU{wRz7% zaI7sYHdRcpD_J?O0K?14(YV}Ab{Xr>x%-=0ZLZOB=RD5#pGh}in;V$xfO3-yc()Cu zp$l`X)!CmO7-q*I`_^!Zw2M^ zvYX*?4_mzk2S_(7z>RgI3&&HIAx5_6W|A4wBjfi)|?D7JH+)TV6 z3!4^>HQTw=*(EDe#C{Pm4PR+A#dfchEDIbm)eK?hY}Y+6HuSy1+dcbxn}p%PSym{H zeTTi{Ck^Bl8J{R`Kp}v@%~#J98c>ZU(O5jGt+>!$YI0jtMxEb#QDSQ$bhS>OzgoRk zo}tCg0iwJRo=V|?CiEcgsw{FfOVeYTO~wx6o_BfIBQZuquCg0lB_LQo)mk$=dIoN$ zhijYpE~_>2msNEzKtQ#Id`^qrUrjY_6T%#0zy*({%F&ob$Q_Hwvf<7Ro-3%x2|Jb8 z)lo^oC@0;HULaC9(?59Xw8-;`NKEpi_Q3%)gEuZwtc z(+j&)KLi{mVkotbokkyP=$AsvR639N;b|nLx_gr5v2nbxO-xKVbCl`F8o2me=#P}} z>setBDS_X0!>LtqGs-knW=KXC1>ID2B_woJ-MUB9dRB;D37-nU_&xZN%9(KiDOBkb z0~m4uDP?Fgg#?O+^ESM&lCUceNOjdqg}Jmn3VuZCWKp#B4&FaKJWg$J;=J+j8^J+2 z7$>&)tyn6RPF!`7r|p$Q`nqaFXX0Y24NJNPzz29mIOuqmkB?RniADljV3-Q!*D$7C zG;pJFa_brYK*`EtVu+v9y|J#{c#Dwb^~v8q9^R*Me#}S+X*kPlr&wtfZ#5}g0mF={ zOsO}H)~B6PtM%rlAEIwAD}E^}C2=Q5NzGEEarv;W{}eUcRzj(mr7-7IgQvEDNv*xp zAW#phd2~ob`bU==ND#QmUvPTvyXCet&S#bucoJ})qbZXcCm`T0| zvr(-#`N#*tWk5T;^0)%p>*@EWnn+4D2xDdT=s&zFYK4**7(5g^tS1fiI@~>r%dzyU zHU1&H*moCMa*0o}z(BJ`2O^xEG+82BQycp_@f8C8kZdU`7KHr|0NbXCKXZL??+w1bqOGIXYG)KM%x=d?eAGtym}3Fa87- zIAEQS8{sZrwCm)7t5FF4DL zvHX6xw>duXykD?8>|fPtd^VLf&91Bj0zur6Ide-%7NbGP_qke-dIezA0*R4{AVF8m zzkBavKf&o0TY1Y(q*$J@x4B3hM~6L0N^X64Z5z)8bT>n4C&H6sNHpm_l4oB&B;C#a2vH$Cv?l3Q}r*aJxtyUC^^f?GpD5GkcqaC?2xVb{Rm7T!60ZZC|?*MGoxP?h-fYP$EFt z_;Ypw{I@BS$|vQ!HWKlEAKj1m*JgN=Q-=4vUU_ot>P!&S5_BzfPU&w&Xiy7Ni?1F@X=X zE*~oDPkfL2C%@>=E=56p8mzk?bABD5yf%BA;-O<|p0UpIxSQ0QrE<_oi)Ur_{|a6H zpaqjjzh^eiPos;>o#NH93ms?VG8kKX{%c&n&eG0OK*a6GpE<`Du|PvArZA z_)X_8vgOQYRwnJPpGo3T--9=A+99L`SA0KWvyNe~WvQ;=kEfD;oX#PF_+{~pyC$@? zFs`#t6>eKifS7Rp%AK+1sR#bPk`rv6}++^qOzIZZ9Cbm(BWqYe^=L*m znC{p`?eHth`Lm6-mzes-R7ywowd0hOK3DiM3$3qd^S7jq z^tVeEJRY%4&#feEk5eBR!+qc*2#v%p5}r(a6H`?xs-2FThUup9$Ra$xX~4pB-^M}3 zaNp)S>pwMf+(dRVIA4Xy1s=q9GQPA-H;d{tOx~v%{{edq>L1qrNA>mW5#sCR&VT;_ zn@Gg=(AFaPLabN)!Z~*R$`s~*fyvCZ{<4$Vio@=tlY52t&^}ZoRIMt}SL%}EzM#4< zKZ!h{Y1Z52OKRUadP0);y<*_Sw)9*7{ia4LC9*!#7u)|)qJF&Z~g)1_hsiH!~{O!*5b!YPS z#;}{mWc?~bfW9cho$$JCjAda%KNWo>-iOIjca>Dfb8z{D7mmvd%X-G&4A|4)R`VqJ zneRAz+|x|lfldjl<`9!>11n&cg%&vGkmlel*6|9j=@p9XV?*gkQG%FSF~aV?Msut^GQ^t5}oA2$_UI z7YUNOv+W+I>KRGzyAGS)E{Jp2QQ)ABWBQxc6t2q`;ft@IjCno*8vEG_;cQfo zcxxoN>1K%$?PoZt~5=*zupuEF|}OiAU~v} zpR;1va(m4gdD6MI2Ax6pr1Q>(8wBs4-}<>^La<_srcOJd-qb^9+1G`ytNffcD3IP$RiMNUS( z9U4EGep&C-WDyd=aMK)SW0c$D`M3=?jMpv9j%d}G*%Fr_btz0DPCVPo95&jSU; znCE_Z+>V4*#RR`RWL4To@Aydgc=d;76|*rK(yUy?MIY}bI_*gEq2p>IO`^k^9SHyZ z$mS+~BB#rKdxvzgtI+1YJT%koEY(aT=BW5-7xwe}{!CKXLwHL&Uoh`a^fpl?)5V)j zO$~tj*a8#v=_b70ZOIoQDmIdrm;T20otc~VtNCho%bXw6jzF)*N^w~4wRCwiHjIts zbrTdekaVU^Z8pI1Wb%}yS09q>sP%A;uj4+ct-2SK>Y_7`Uk)xl@R3oueyfoy}d%6r?!wD^tS z*A?h3U2ws_PTk6vV#~rLPO0h#Jn}@GW~`Y)d;C)1ocNVh&>M2;HSwo~@13L1EGBRX zUU2H(8q)`;!!O=w=`&sV(+GbSLC)fw=ok1XIWVP)QNfWxG}vV#KuN>h>4!GW!lH%8 zlEohn*Zl1vzE$Y(Ur`!b<0~ermnNVP&|#(V7;nlLjbnJggK0|`Jj!Q?7_Zl1yNi+j zjgAG{Ge)0J;$qc#x4YMB;L?)w1XL?XG*(+P(Rk39@dMT-6*?ezk<8b*fGHeYognWfK zrn=f$5WqThAPcL4pL5u159FEk#++VLFF^txzW~oAoWBmdn)7cLJk!D=@sGKu#MSd0 z!3b}4_D!;{(iiEoW=l(>TS?|sDzRG`Y}NL_2Kd$Ju2ygDcVdnI>vFg2gbgcsWcD#) z%r-njhfCD_yx%vDz}rzcEIz&n5A-seND^wuE4E*K{%$ks(ciMwIk$O;$hm0o(`tX3 z;v9w2ZFS4e?;m?k@VSt7G;zpHuWs58^*fqE^@z&ms(t;DmV}?9u>MBm(2-1%xu^2{ zPsE?v{4?|158K(zKRp>I*YamnknHqb6BdMKf*4dM+VmVZWn>ZfIBPlh;!r=wWY(+Kk_hZ=2^=|66Rj3*9i)eV31Q10ufs zxFi@R82+^X^nIC*PkXW&j(_~Tjy+PJS<(yqh2>kno!i(=$sK{l-Tr& zbgxE*d52@n$I!1VWQK>7I8Dg5&O?0YG)Sn5hkCcgyi>}I5u7?`aqL+8TdYzy>4^C* zPT(ZK7@QzpXeja)vhVkTzyiR}D}-xYHiIx5Y2+9vQArCIY}~X#jq-~L{tudm3ijYJ zWGm@kMGVwC^LuE_@7WTR^EGn%vp@R6YLDRgz$gHcq z5G^3LdX$M6ir*QdpAG>o`Rn)<-- z?HqnoL@`~gmoL?xfZT(u!B4QnZV790l{;iQR>8pXbNl4f?8eRj2bYK5_HA|`ML(mh z8t!X;aLIPV(dM`0s{NnPScMSS3Y@D=(IOId+vDLv&%^>yD`8+GPQPnq z__eq{p&ar&nil37?o`*d5E!G=4wD0@heOcicn85CAp8qtV0LGY1x4G;x_FsAH*{QE z5lNGV8?Av|24-@IxgMlt5P+2m9Vhd?5D_cH!FL{O;A>H3yU=M=MR*cqVDGRftF?op zGd^@{wJ+wE_sCE~KqI&_*5cGqya#yCmgvVLy7PwwEU*X36FhB6&3cx^=W^~o1PrQ#F?b)S8*ZNEZbL{-3|7CFaQsy!`p1oOiQ>7cVi%@lB*{TJTd+OPKCGdVX2ivC4+5aU5= zr^bcE@XElbNf!O`+h^jwo_l-0K^^3)zQTI3{ae`M2_ra90BPi@Q7suw;BMBRxYhZ* z5&uz@ClyuuHoV}>tPjo`Kf{)%pyz+l;|e{M0l{d;itXj!7GMfY&swzj;Y^eqd<(z2 zr`Fw)CC+keV|3kLW^;VEs2a|RhpwyG!M_TSbXLVd1n7ftCAA{F-1H*?vpdH|4Qh;4{jFAfs5}rb$O_Gc^R3+uN)FnZE@A}JP(5Ix`5SHjI6OFE z31OA_=7O4m5a=h+*-Y&xqqLk{HlV;aDO+|#yegaK%IKjxwH_!zbW^5+VYP?FpELFA zgRbX#hce|b$K@;v0c=o$iHsvcVM_3~)dwo`#X29al43sfrQ!?XjJZ^Ge-@%Do&4Q- zG*4S|_AKKWgXp zYhRpAW(#V6yA;EasO>!$n_HF9oH$E=wl)5ksyV~VQg@;NTro!t7Kqa%x)P^MjdZ8-)ev)qm@Yi^UWc(i(rKA90FxNZw@ zHa;K9&XSWKY+UY8zlix5CsDCcXf$!3gGINNWxuuCpq8Q4#MQbemN;tp>+gk=2JDj< zC8|jHGaDFikeDnPKLL___tDyedb;;xSA+%yl2V)D*(svJwIu2@JX9B&n~yu1B%vg{ zke^WSeQ^-)e)>2crq4~bbX``krR0+zH?&GN%@4d$KM5qf_eDHmTrr5?o~7?D zjjiFX?s;RX+({vnt*s%54JBB4k(i^;TMYIAHES0?q3BxA(l^x?eI9w--ACqrk6d*> z!(2awqCkY2NCv+#vM(#W7-L?VuwqF?n+cb>r0BK00BZd9AzdlPCMXmzLI5B;X}hw1 z;mFCt8B=)_R>mT{HPwAI59}1=mTqaQ8O`UuWNs!;Zolt_IXi`GZd=D(j*k~S*KZND z?V%r0$braak}9Y~hJ&qR-F}?ujtFAJMgZm5as}&?i_^uj{X#<<3y+T(_@>$2CS2kW$uwD|LpbQux<*kI8ns9u zK7ds~{b!lQiS}dC9C6~2O-Lk!ZHK7OZQaz^2l^oBD&?yVzTACt-UjwP3zu*P=J^o3hDBrj4D|~_xBND;&9J9Y zp1{t##?9=k`v(P0%2~X8Y_* z;;lx)irvO&Nz@g!A-VPv{aa^?YvKo9ZpddPPG;V|k(G+w85tHh$Qs~++eJu zHBDw3A>}JqKcSi}hJU7z=Hj=niup8DHZNo`KcBoy5;1d#os#b^D7$258tp?v`EB2) zHDJQbuH5IUKEr6Qf1Hir^YP$RbYj8HNa!VaXnI9jc*C0~ZKvXV6aAhdNBcbrSZNhL zsU%UP<8C&rfxqHy>#EGog|~Nm^C=#CFS>TdJ;eCpU&r<(4qA50=H>QqW?h0^s=P*u zu8iEotvIx*Xl?Wn@9QL$Cxyb#NE@DML*W4UX832Z+2a)z2j@H2=y|m5Z|R^+wP zsUR#n06XJEw_CcKA&BPOdDW(Aw!ig#Z0o~bVKYJok$rn$%7Z9wFbxr>Rw|aRPuNcT z7F&9Mm%DivGZSsqC!5#@Lb5qK2Xc$G=uvMi>!(FX9?J3$g8m!9dEw!x$K zawx+o5?S)C`^O2KS>2J$@2Wlx>8@KpNl|uMngYGXtF98Hm}e8Jz3APd`?$&(;<8An z-m#YnL3wwQ(Ejm6IT{mxG>?w^uWh&Pr3t#ZHgI4y{=m2!U6_Z}q`04uV(AM)7kjm< zm1A9EbX)`*ZXV+UJhKAzz`a2bK;H}0Y2JV`7by<2WNQqN+`)CLvIN$87LX6D7FNa|7A&;* zDOSPKIYUgNak0};1XS6T1uWPc!3Av~eE^#8VT>Y2<>JhxFn;x{_M&`)A&UWzU^dOu z9=OE^6mhVz+e#O6u(8=lgS51rT9PrjoNl(Kso2kd`!tYBz0@hji|H^M|j`yJbD{HFdR%S$SI5mkVSx7>9uN)O`S+5OsJx+F~d6Q z=OZ0_#m2zS&TT=-<3c-T&f6-jsPf|CL%3*aZp7x{8Ys;RD^@XIQ$-|Q+M!_KGkYa= z1|#UuItXth7Ql6VbA~Eo-RmtvT+Pa=UPfAVOZ>V8r8b~TpbZF7(Zx4S+(PLmX3q%8 zs}7!xF7%m)(){!43QxkV0g9sgrl2CrC~$rrixpCa*|JU86lL^J3@VQ*>a|6~gqBOF z4*3E{l3UB*n>2$aj0cLYv>}0^95@9|lYq+N$sSAkY+PqZX_y*gbkF9ALSo`Sg%-Xa zGYac7s)PgpE7mn}nf@=EK*7RA_I@8Ep)A)*{d1@0b)3=$zLP1aZ=q=2x#4=TpmzUM z+TA-MJqVOy`hJaAvRZTVbsd`aBf~bS^J#36o0IxMGcOX_4L1ko&#48fZ=eBi3MSA;>qc&dMLxtCjJv0X>UqdTR@4dbfoM+c?kNFI|)!@FUq( z2MJt|=wRv3`ZVpk*JZFj|7ktZc;fPf?%fGj$RYj{4>WvaZc6%;IoYVGlNWb`0>61f zeQAUw^ou${n3}!pt)tnydonyikmqr7v+T0FgzEGw@n~_|dzjpE&Suucw(9rV6zAd6%A?bk zS~+|u#rIX{Y_;;pJl?CL_VQg8UN^;c$-y1L0)Eg9f^y~3*Mgb z!wn3N-SsgHoYQrPhL(Nby*~jpU-^q>Z1!7{_vj|^8K&bo%WN~^e6AOgPj*9GKv3%1 zQmrN<8mochCm%un$lf#m8M*mfpM2uX0dsn0FiDZijxV=xmYCn)gRwng20Tzt&{&e# z56qTc$|Wvl)f9eE8NhTv(3m%GIXj6xClaElJA_5Tlii9Vi;&&F5Ri zfjJq2@?7`vnq6^CU)ps_rcR`*bkW_(eU`TwWe?l&_+$HyxJ?$3A1nrOA~k44gQ`KA zk_BRLvsNnEFbx!~Y?S8VY4f5EoY1}h8LsyW3wMILPJw@onSCqa{J0_;z~R!e{sH;# z!eZ2Aa1|$2D?Nq_k6O;>y=-y5M2{;Sie+Lz8sRcWU|QXOGoS!UN*!%rfivfRV1Y8h z4>x!=gZ<#2hqQ+o+Pjr+^~a=}0{ToJ>hvwP&-cc7=tpVC^}N4>g-+q{tg!l>n^cdu zvS`7xOP$#dXJxP4y_H_i+riWEg-ytJ5lPx1v$Wnp^h0Z5#i84T_LvK z%EBoqgR$%KyLZ&xr;6PORiUaiyT`0jHhjZTJr0^du0o7`yQ&k$qSy+Q&zX9hLw zo;eb1fHn3a-HY9$_29-4E?)v@{^1?LcUjv55FLgQb!<_yVtlebP?m;etC*$v7wXN#BdsU{m1({#;P+F#Ovum_sW`w zjjI=<*qQ3b#+kqCq0$1`54M- z-q0jMA}`4Z+8cM?1~vLFdX?z(P{^--Z50saymR`2(MkS7!u874RzP5YsloEab#y)p zE^K`gK8D#0Q7Gv-1)@Nob`(A+J^enPH_tpuz6pPb3BS1sk9i1pOet&wc8nPwTiTsA z8t6e`@w&ew8(6_vi@wJn;b^|@0>Q)86pqogK5y`co(Q~jX+OOJhm64XUWwSdr$6e0 zYx$7#XB69&D=My6k#@2G2l)3hhM&rJFp<0_u)jT~Ke_wsE&~Z&cXe>XBa&snBX5Vg ziGV^P zgyY{{b0fn|v45{31Xc51f^#bk6&Nwe8MGjV z_t#+AhCorb{j@HNrb3EKdYGEFGN#>CD(@{LLEzkj;!V`Gs2ie9DVMBW3q^-v|16yF zjMpfyuC&q9nd$NNjon0eGWl&lXCYR9PSwBjue0~Af{bK2)X1@T5cMdK@*VWAdDr<` zsd{qoQtSy_zz^!_Ase>yUoH9Ifho<^BbWC2W&w5!Eza*!0L5+w-QC{FZw;<7(9Q@b zf^=Ho)Cq@4$g(g7^K1S(^mwnbtY(TfKeh?~D1-m|3;*rAng zCtp9}@(MgM;}n!f_0TECfegUPEltONvdU(1aaLW$R zlzYIjDp@?ie(?yGKC`Al8A=e6A+DNBD=0*>Q(aJ~@R*dCD`{s~Uf$5l!iEJTuju?V zdzO_aK%{PMRJG_8_s}3BVv-Mww2+E2dP>3u<$p4#*BOPcWaf_$4l zVEb={%N}5HjXFXJ$RC$FVy7JFpCDVZ*)RsZ;&iGgruOiT`5iZ}FbBKrcKA*>=Jmo} zTU^l8c45wQbJHrT?~Tb&5oyt~Xkl%SJ@-NITA}GZ!j` zJv_VhK5up$Of@er@b{W2hf@RHg8cJiqP-=yt9Mq%S$EqXcXh`Rx^mCTvi_$}mM{KL zh@>Qys$oh*Gq zcp$mmxGsc>8qSjc>6W z>Kl2tCF^Q(2_MNc7IT!Djf}zv^6jRkQS(Wv2lFq^Ih|90YKtGp+K|DcQT$zc>Uy{_ zjU~}hOUkEXDW%RKo@VokdGV5C=bjX<*Gc$}!^L5KP6{r~d8RFF0;8*hy0JqY7DK@a zM-@Afo?Z+%1e;4sO?K`t)2j`kMa6bHZ4ZO~cN(<(lbng{tvZ%$OdI$Xr6OcVw+TfT zV?{;u$7k)vmM66r+rzm)?J7coPT$i-5t1cxa^|!KsZ!4}5%$?F0aDaPU|j;&x$bhe zQ@}YuapP}IvY?qFJvCx?qzh{7RnY#qfDF1e8AdEqNI)pLjHjm#VK6b>O9@Y2eR(Fn zgK?=rP|TrV3DrEW%Au1e8yj)?*an6zPn+9Sgm&bF+)tSwloY{K4>&3~J zjQXTR(cObUGIbhKSEQ$Rd~5Q_1c^hUBEWA3t8A6E_OShM5dZZRW{Loj`^@vad!ks* z=Nti;udlV$S-K)+2`zZbpTqF2bh{ylb8m+!+c@(q?pw7c*a}~ig!9m^^W4M=D|XAJ zaqYZhk?Pnf3-u|@{6!Hp(&Y?++e-hAz%Bo-o(>4N4Hv8oyRK2IysmHTwcnqxbJC}g z4QVnIvvq&xdV=}JEVIEr?i$?MFF(BO#V+xExKAOlP4TJUf@gsEqxiutk6~o&Av6{- zEt7fmMUZmzXQJIVBogm_LV_zIac^aRQfnDW)Er$ZJ-)Lx-0&BmLwfT=zf=3g-~&he z7GjEa2LElQP`B5;|E+}dm9$scp1mHP0LS%I18jY3I<%|Jr`VUN)LX zKhnG7seS10N6PzaewH3$Mg02E@w%veQJhVDRUU`f5!M-El^^fRRBC9}3JaD*i??`5XZb&^RqgcvIL@M+TdU6~rd7v0bLGS8YkeCzhZc;#5l0VVz9cbuue@|>` zMjimxQXS=`Z}q{lRT8>5bEJ4(2r)#?zHAX0$Kbm9^(Zx!a(oidf5;uso1Yz3mbhKV z2{?l;?v5K+?Z$Gd8U}S$t_B8$n-_8Hcj>ZI5^mK3@(ps+I@9OxA=Ol5gfX@Q_>jNx zp;Ud1;?@TBu1!Z;Nh&520jIoZ*@VfN;%IA*@=WI?=TeeYXczy1W7=&vO=+iP_&yK3 zd7J!$m@LPcvRi&VBBp19#QFuYUO9ZEem2T#^R9!(h2M-6Of;$U5@s z)lZ6@c!Rl3ir1A&C?4RyOG+zhANK&9?PRCFJUxiNtQwA$Bch{P8z%|aN}}MiHbJ#% zbO498T-pofS#(Jr|F|A>hB+=nRm{4HgC(m2asZR%)M9BWmsqa?K+=Z-=j@BioQ6wp zjwIf-R|ot2YhdwX4^I^)8ve*#Sa8toWpoxejK&s4Z-1sQCH$%3rsf z{HjfinbTU~N1cg~y0$g7dlNTGZLf_@L6zal(}&`X>&aG~K!x@_!{|Q~_J$4OHLd)7 z1lnbnKArJ z-?JLj(6L^aJCp8=GbU#W5AOyrB&|x!qhcvBZoS5K)3qHS;t~FJ(1x|c>ppqujBV7i zRl1CFX8&arH233T740@Zp-P^oQ~~AmqzcVGQmLPTSj1Lwr-(k}8vLn{jmg8$ ztojtG`j0mgveRfR_CtE>GH`CvTyR^&9=VP%ZGoQX-;*t^N}NmIbqWz;zg>h@Um93_ z{RqG!z}Bv0M+I&1QlSAmUEJ@xt6=ozl9nLXOoU-mcs&7PA9!t}e2?9U*u^A-DNRAO zu34)&F{#twn&{O5n?A80AakNc@*g-p%0{*V(9E9n|ApeKqn--~x7p4QX>dT|h_3=#fdF+_=+Pe+# z{!}r2Ow_SSYRuwGu12hkr}byft)9!taJz4>-Mu*x+Vv~foHuuXTN0x3l=vubhN?#v&qk1tT%gh6aG~V1y}vq{8F!g2NBQoBr38# z)go%D*RWb0|59Zi+){8a|LbY zn3xWr>-FOCTEnYHlK2~Cwnd!N-d5srv$L~9!Y3N_w8d5CakCZB>EL!gNW<-A%XvSK z>j_(lv0O?OCkLyJt@1;dGBc47$inHh8$cH%Ld{--3!E1Ve9vlgBi=~pGzJH_n&@0a zYeAGagxOx6o+3)okIawFCoYK0jrmMp)aSLIQU8+(D}tGtVmD*S4}SDNVqB(U|7W!Q zru!liXJlPtn5L_2I?VGn@EN1LP_*XWI%>l-fJj`rYo%2qxHXA->%+JJ>kO!O9U-vf$Q>*mIM}qNx3cNI$$(8Wx95Q&LKm7hX#PpQWhOjsW!U2W5dh4L9(_dHqBcwg9|TZ>QD@31HFDIF7$> zi{v@V8j>y@xOky-RG1?QUqzR#xW@fNoanb{gc##-?FD)1K7Ew-m?7$2WnEG$OQ)RJgo`HR%IRpK=3MZ@gkg+nkiCbTrRVO7$Qv>S_?8y%o(}xu>#{ zph>)h@&z=1^|1)oqHKd!cA%!J+E~GjBdfyn4$AX4Uh-G>V zMZj@Hm;heF_&?1uE161WDJMlgdWEphK_Q6%ov$zc#Zsy6OR98)W>}#_(c;eWvbV7f z?W!~C`ZoSSF;h_z4HFgO%gU-FKrnyByPnAhhotGY_Za6p?%%bSpF}Y0zD1NMhFgmm zn9IRKeW&Z2ilo&zGFdN5x`hKur8EmXGSO<^I!=O^HkUMtT~jA4n`G6Lh!a~DOzT8+ zmo$b|H;d_rhE`2lM&ZvQ?;a={4wL{+e6!2~feJF;?lFUQvmw<+9Mwn)!9BV$fodz< z09&zYTBgey$fc*|R(Iq-!FIi;Ls}F_j?!2aNiw@LztXVgvG>Zg++!F2jw5)g!)7YW zIIJsPa*x2Uiwru}2*EhiFH)+SKam_!BP%*Ck1v%s%%rX#FCI((Se5pB3b>dBXTU0d ztU1PRZRB1v)EgJ@1#9Mv{qpe1i8H=RNzFmoSzP3)e4WLo9anFCZW_9vw1Cb%SMs=R z$_+P^jL6U*zZ6dCa+W;M9kuZSlfT1W4T+w<7KOH9{e*`>L$0F7nkw&yWXPXss?0NV zER=00v7HJ_sf#5WQh?QB1MYF47$*QbTAZ_xnj>JgwDbJ?NXL^op^OiqE| z*TLu9R_@ejx@F{Q!s_G#^ZQu;^6jMQl`%%k9~$_v$P#Y#g1Qu%&jKttOxBjy4;td8 z=-zfl3@x{U;)JW*loH#L`$VfYC@Jb)E6SUSi~u)IIY-?8SvUb_FZQHhO+qP}nwr$(CZTIfz=s4$g{C(oyr!}9(jQNr) zB6EBrvE=TSk44zDH7z5`;4>zE&9Mb49=^4uaVod+%`XHFbt(t)&2P@)a$QII$kE%6 zG7)5jyoSYz8ysh^cH`xfmSjSe^k61R7>FBSS*_&q9D@khj%eW`PFbwesE@3?1QfFx zp)${P_Oy-KXOJCQjx$C~h^=rl^gtxEY|X?s;XE=NKZJ8$$=n5LUFO-K@t()Ye7(A5 z9c)NOzixE-;asAU5zHdGUQ**QI1Txl0OWZabG9Z_X*Ow%Ga})4iyEb;O`@a z99YosJ!YVQaGoje-;89iDr0fnVumllhjDzj!(d*GuaOZO$4YAT7U|Jc<8WzV z*iLyWzjz=lsTK*HNkiUB$6wRJ7Tr!3vWade2XEz49$50nM(x5eQLQ{9{{3@z7vsiN zSjn?5zA6ctN?-~~8$$Nyrl!D*Bz*hdpl*wBlZZzOGi~lEu&QPB>&VlvP3Q3(Ge2MX zZV2xL(_E(*pdq`&v4KE#>zR-~a7D?t3gmf0;9;x``phA(8Bh2ce@}Vpe3?(@KV#0rMQT2C3i6Xxo|@)aJZck@Ww6ATPRIsS1&4C|7JPkr{4C6_JYwBuYrC>G}IJmy`s_7 zldUQ<{lo0`Y@;nsFwe`6YwSgqns}5O%gfDo)ZgyN61d8L(|YQ?J0iYC!uN>P-Egr% z+2giU9HC9SlV(997<2`*%IYy~z8^Uyed-5{6ebZ7LPbv#ojR1|C0z$Atfj%7rN4G~VF9jV1VUC4$cv%gMe0uvYtafIoQ^=tE_;_JI zW%qw@&IU&%_r>J-JpvXMWCxoy$%t=xB*b;4#LpPX5wY`{&cKoL9g`q@Z$%iDfRFWa z^SAiQQ*lCn7$!oTpmqzmi>wc{!BO5!tnyKD z&lM&_RR46Nv2Ojo@BW_gRyq1EI?5itqWSXry4`&FhNk~&{r)aKFTb914ZmFTLYGE& zEx+F`sv3mK0?az=?Rx6x27muqdsVdANpAB&%UTC~5#!~ruWkGVe)*JDBE8bLVI8;$ zYT^bj`jvVd0-&DETxTLav@+8{SeHpbZSo784zu&E_%>Dho{XMkiwbu@$4s z*9m+*@HB&A9?4eqo;jZV<@wd5x3#lrM|Tj+(iPAV_C=k+?>)jUGTV?{cW3D$38=)| z-*_!U$kIH>LOf04g2(b~>q0tB4kaW1cASWCl)wr2!Ic;338`{uboAnVk{;xd40faK zx4+#*trhdR%0trtu%GG${DCg+r)T>HEEf8Oe!mT#3w?#VVwVv9#fdQ;hPRjN{)cXQ?LG@FWIa^dfP#B%m5T{+1vCh9K z&=Hhj3VSK=H0RM4k)3Cq<1PH1XnY)TQ@!_@raiRX_f7vL`(^f*pQBi#X_LBZn4`u* z#)0Gc*XwHuvqAk&aPw}dXiCc6y01TSDp*iv?PKh-RFO8BaLn4KpU z_x{kX?JS!y%SfZO&^K(`ZCzt#fHC!wZTz+TDWYCh$(dUL(4@6`-IG>@+58!%uARK3 zgJh*cD%c08o%3f>NbNw}!?2>)yF_LX}>%hA&@3z4W#zi~ug7Hej zFLqrFyoB}sDwsm7a`da9$7jMuzypKYScKXN&kSwarv1m8RqnH$rJ$-Tz;ZF^kF$d{ z&T{xj8%ysQ4j^-g&Hjb}McB_ov+xrC#&q*A-02tPDoy^@leddk5xG*+J~w<8!Ph zmjSdRakf!U>aFAx(su|SlpB*;uS5q0`U-@GW#A@)E%m4fK}ykS1yV)ECC~@j(kaDG zz0JRJg>~67Esz!-_c@Rj+)XV5%weMY;fv+ccE4Orp!*jxYp!yo{kK$4O#|7RdliWn z!SF2x;4*~Fz}=+-+Lz@pGKf*CPJdnh#>2Dt&#(ika-E2@b%5mT0-hrKITI%rG59$% zE{i?$SH8U$mm=~VKa{SUe(aT_SR`$=BHj$4aim6b!FqRsCvW;8kls}VTqWCCQ${%< za7Esx1syA6_eh10Rci*o^>BHdzd6_CgTpGmuXvjU!} zgI3Fd<+sepsyDO=+#%y?4~!b(3EaGd0Nn&1l0LeLAV8}Ij{|OHI+bZHR7j^?iXfr31(gIVkFCUt^*Q#o znG(I#Z3SFaPHC(YSJ?>Ocx;zS09fps3^_mRbmV}%7Ty$~zpv91i094BL!gKT-M>JPw^wendoGS@yWqnHnTfL*} zDuh_`f$c&%iC=r5mOeA9v{6*`lnBEOi3;qVE7Uw}lyyG`)}{K2$utu8s6#%O#$|Yt z49OFY>k`4Ov)Au32scFAj_8-JOZxAm0Ox1A=(vBc<=z(_`hHuF-SL}bq3QecT#e32 zW+u-vBkniS%lLEdN&NeQEShChE*H&T(vK|&{rg{l$-hx;|B-iL|1aJ}(b>Ss-OiX+ zP+UmF*2YQc-8uzp$@V+lDtyo-& zNsD8yW)b$ueb6tt(SD`66ky;yJ|r^W+drgcpn`fCVMGmK-a_Q^f?D`J#6E-&4C!9} zTmm^HwTauD5kY?za|jZpnqTbsnAX>fRcZ zbQ&3|N}V>LHaL71CN^FpNo2E+c!bJ#XvCCsRWpXJrO}J~H}0C7FhZ#v)437A zl|JLOzf3Ex+EVgrKIr(-x?cC{cdBFKnaFHV(pmVP{kvdk&swV&4kIb^Nu=94#2G-8 zYluh=h?sEmiR>*F!y4#TY3T3z{sy#0s`oFf8G{HA$PK>h&kn#SKXDnL%^mp}fNMYa z8_1V5fC2Ntp2*iKsMA~C3j^6Y>?+0FMBcMcT3MeWw8Xt&_a9y(xeDA7$~!1fYjBEZ z!a$Y}{eVBe26K!)V|#*vjAn}p#?dkSncsHVe_H9ureW1VdM5IyCB2!4p*K2~#2iET z&-s&S8OHWP$04nZ7?-2Vy5%>HOS+sRM;Y6>l9BzMuSBa6`fBI#6o*qrB3xGaW9PvSlp% zaF$qBS^3wt=8*D!^|NJ`E|Ok2%R`@vUiL}hWIAZMRT`sh7F)id@qegDxJR@Hw~TQ^ zEl?Uq&T*=F6^%@tQS0tO(a?!}8GdpwXT`Ti=RaY7;eYvJEi^G_1mB2x zymDGV-7iW$o3?Sifc0}P1^Vp$F!OQEzTvx$SYne7@2TD4Xx-g6GeaRLC)o&lErM@`26EltM% zu37mjOYQ~$(8VHv`yVBl{!8-zr4Z>E8R%L5hic674^sT^S6p*I*l8Z8|NatPJ`rC& z;E!`qjkg$$uRI&AcX;i}P;J%=3K($qAZ&)mW(5%eLvDx6B`9d9P1MVgH5G$lZ-8L5 zU_%zeC_)~awQ7=0A-QZWD2)9DeCXQ!?IqP@$uF9^nY#Jw;q!5O+q07hF9JS3M^7YB z#(Ml5-Q_qLP3K6xwMlCFS7wX;_YP+6mrwxoap`UB@2I6@D!$QFNc$X;6xnX_H{6Ic z9ZhD2Hiz9U`Z@2Q8>An~%oPsi`&JC?AF5CKprPYNLa-M)mM0DYWZmHJllJ)a`*2>R z*#0+C@Nr!s0+N2NfCe}No=n@LiFWyUM9*V9cu-0Zaf1W=HNPVzHP8c^mbT|FMyClt7-s*TzeOKScV^Tdm0 znO?D;d(%YOWk=Hv%ABe*mF;Hwq-iUzUuAQ=ytadft2y>4e?x+P;yrDDrZUj8R&yth zURvOwNGpW!6qjp$DA`sai43g~P%#02JvunMgFIwIM@d)DN*F`If}G7zOfV9zl9&)~ z!jO_c&308zbWl;vm=T2V5;htLTHyj`#{)h0$W0C1$UonyA}%j)cFf=8-2k+ ze(U0uIbxbz6;~ho*%ZqVipYqcdkN)lWJE;KOXLSb*2}0qmg8@hJ#N%>fNRJ@mVq|2 z;8Q6RXEaUF(UA}T)y6i1)zpuWo3z89Y&$e@oXA`*pXKnidEk-$9YsV%)~6t&c|vi? zs|U0@Av<9J)TWC(5ViaT<8O^K_^G}r3LL1DBJyc&v{@rjf^|kT-YRkN*+XFhv28&Wc0EM>pKrvbJy>mqtOb-#U|C|976EcU3-c3b0s-)*_W zehzmspsu`BOg`Fw4fG%Z^KK)u5D<8dZ2m};ro!cbkiW7!4duTv?-}-~ZJTOxDsUY^ zFg7O6?`XCo%z#lqj2AGh)6-iVWvjamS|rif+w?A6G%oF6+UxmoO%`jK<_rZ)zQ3Sf z?)q^dx&5miIEzeg;U_nJ&)8@@*jt9wQ;uk@cDy#GX)ao;0r!qUw|P_^?prwBTqHn6 z^@H+zx*Zd}RA@;euqvV`1YFo|&}Vas?7n_~bpm0sfwf6pGf*i(bWsZT7@bc=dw5oG!6l1f3k#_n+62ss~ zmQSl>)y_A5Zb)9xva<)O9K8bUIl#TYH!GCG(G=kluvKIDem_grx^sy;p`0>aZG2CcU`lJbkGpJr%fRvK9r39m65PDAP-=tizgSawghzQTul7a9c~e0fp| za3Vm3{2h_u0|TqrAb0R6UT{spqo6K09msa!>gda`rf`SQW6 zjlpfEpK|TMoxTXvD@y=tXZiAu7{=k0QX-6{S^f$^q<<^5Jq-fC4l#~#N3$~r&Qx5l zi!hM$Py12}?u{(|XLr4Z+TsK{Xi=>XkIQ!a$$aB&-^qf*8;=(g*n++ZbQAnKMY+Re z4rf(YfgKcOK@>EoSVSf0Hyw_@Ygrqx!>e=0$H?5p0*9s@`jQXCzjz&n4oTZ+K7X6r zyO*|E-Am47;m17hU|4oFc709uE~o5VsISI7Q&F%^c=Tmg7WK(0*((Rnay88Zf0j}=i+P?XSOpSq7I%<1bW|hOJT~& zm3`O!p>%|uw#4`MYa`9J- zcvF)g0x||o293^UYC;%IeL#=ZU|wGL-1nv#SBc&+1P`XH(E4XLn)+v3XrQ);Tvom< zf3U%POX_Gl3Yk1|XzALjmRF5>wa%d;?{d+tsV(TzD0H^I#L&ol>(5Dth?9kQBg&jX zzAQ|Wu7GFEE>P;nvd;m$=>ZH$S3X3=@i=q4GHZa=5|Pn5v75r-&0v$+$MCPk{iD?g zXQ+gMFouP0FDy6*r=t9p&RZ&jb)#mXw_zs<+1kwFB42u%({|n1-%Z%)40c&eSH&r} z+ui2ugcAzb1O0XX$YlC>*FR3K){MdXR2h>S+ocwX3Hr0oI92?k_wxRkjxRn}yEk$- z9mY%P0Xl`QoFkfpYC|_ zG#ReAol%>!BCLcW4~NY$8v7==U@g}70j$E%g#s+{NcO;;_F1@@0fRBbqO&}BkA zoy^8`i=5$k3dwCAi7y_yn0vpjWa_Tb(;M}XNOMz%-2$+f1T@Oe%A7zr2q8j1Xto9- zW|27J?#W+rYG;43&h}o-LpjaL;(y5tR}2m72i~0`A5RTh>f-#=uNl>3vw13I$2g)j zgBH##LlYMkP3jR;mWIqOt8L!(Ir;ag(GOVx4x2D6kzAiR@j^+MBn^gfC}!3sI(}ZD z$vrqnuq{{64IbqzN3x?Tm5LQD5=9jK<qn~T}df#H!xw6jX8yUJ5uB#1e zl~kBy!>*HB$`h8dBo?QNn6D$31aCcGSU1RndvkZ77pk@gt9(2w%+0AXwEKst%HWOX zeimmsQLHz&kTAeQ?|_AxRDj!P1IFIYD;orr_M$pYJ*~dv8ar}0WzZjWhK3H4#KNG0 zL?Z7%T2kD1rFd&{sF=kl+$tjyAE&9`vk?0S=n)?8wjxgv0_cMO_9xw2>*Obsn`qqb3)kzZUu zVVva+9y#7V&>uOK_%A`{H0DGwQcOc@+xl*b+M{qROsJh{5uu!A3#V?HVA?4%k=AUe z9nO!U(#Dm=?`q7qu9Z1Duw<9VGeECR8khC$GA13-!o^O_p_#djZCg(Tn;~b_-6usv zB4-7*C`79Dm@%|J^aIyAH0)S0E~;fJ#+4Nd3iS3Pwa1~Uh7cP($daU*H@68jENk}Z z+QOC%8r8gKvZI`V<~%Z=G1J`gm@%04^n&akyVR8n4S0yhxeDH@RQ>r6p66wD+GWuE`&r zq6_6*E1UpEx^@8pWlmJ%I;YI9z8XRC{R-gKK>+>Dr0}EC&uEnht~xhP9@njynRl)l zeikkuSBP9$C~AL^f~SNks#+>2GMgjz)P5csFuFn5Bp^bG7@?5a)WQvsGb3o{m(kB0 zEC(94gzC9zMU#T@kLc!0l?$u{;~RZRhi@Lg$IY!-Fd~WABN{3dSxd|JbSiEusU0wc zW}rFT*kS#$q%DuDG^8n66j}wnHMJrSXOALp&%7KT@0`OKA6>BiYE2vaLYy^}R zp{OW>-lU)i^`6O}?wtNN+-gW-hz-g%c8FG>BVlOdK3h22B|t+g&J~~ca>W0j75d;H z$lk6YqCa*GXd60vsv#vGOoDhhw=hlj%ZjZP_T!9If>O66$QC-70tabp^Tc0iTia+^ zL()C7S5_I&HP&&kRed!e=$YH>W`#%FZnt!DTAh(Uz~u;|uLf9^YD0KffK)|K52t-x zDI%3)GckxQ9~wu>&FiqFlkxLE&9qW(&R6YT-|1n<8g(oMXB9$GzR-AeFx@AMW8roa#x7Hj*hcXlKuy+-F;mSjE zp>FcleMX{P>H@pMMM2U)L)#LrTy z7j+&=xKpnA5thayWmvOUz0=8=`Zc0-aIf;6|IzDKN zdvkktxw-mhI5Iw1z?62ltUm8_=xnOxeBd2NKL$*(qO~ujaz~-eJ1e3=_^KwV@DtoE$s4|O3G$)2kbZE?VN3H%9B4``!wA%`_>5b*#8n`#Zy36 zwOpj=c@~3B|D(zuiVHfs;k1xn^d(C+kT zGx!GYq&Y1;vt_vc_&7L<>Q)J-r`jIQWOo&OW}Jhj&)V4u)s~;bw#2^siH1eI!S)ey zRlaAh{b4|zrl^bV#N_<|1Npf$-agGOZPq{@JD{3NfoWRqV?=fLghv=VROHD-Z+JH) zFwFqF%UT5a$v}vn)PH8a-B?ar!(ERz!*L1D(AfO9HAHFOr9L}E0MwFFTbO0V0Jd%B zx2bl0ReOOBbLWgkHidIz$~bl8bHwIRNL|x?zyc|UQ|itt+P?j6aJY2>6#LGO=84p+>{s_~f6!_DwOjARU*dE=5b#wWP><<~T)HK-^HayKuZWZi%>}{U^ zP@B`fuN zd@~E(Z?RE8y}&>C#Jg?CdP#+*^-!wux_{K|9vrAVTpmsIf2yb6bMGG?j<4U~9@)}Y z4S7=xkAYoZT;_*9Ss&}+@#*`5XIr{H8pVh_vY&K6CaYr~uTOFIeI~i7XW<#cz6wUb zd3g;UA_?EO<#B?ZcgG#cilShLHVw^y4Eb?RWQa^<@Sqq&tEOP{rTe#mU$g0WVyWIJ z+GMG6^?PP#BV+RaoCq7~$qat{O(VQs&0`ku1UFCf6&5*x5+m{WJDzqKmy|9lQG&Fx zT$Y3`tN}XcfxG2kG{hPIcjY0?ylD8@?lZM_3R++@tf>G|Y+9-xJE+^Rt`_;__fPpf z;#d$VzzK`mq$UsP0!^;rM0~(JzY8m%HcFo%pjYr1j5V^Nh{G;vt}IWk7tg!b!~5=& zK8jd2>C>&|wXR()L~{T3UsvX>WV_2fno|1RAOXA1eU=~HJdyi)RV27;q;294SbHHaF|XD)_xnxt zl`0tZ&;}nO@}wtm9%^=Kcg>5$9kTCYDT2#5?1XJ9PgR_h+c;n4AJ1U%dSUzI1O8#! zWHI&Xt$eN;FR^!*7OGC(&kflc*_vP0Ron4oL=9KzW36mQ?U`uy)|0JlN8g!1_EJZj zU)(kypw&xM@9ykKo|Rg`3g8j~y?}dzj@yOKq2`lpkv7E%jX>*8u>ZHMn z<05^aIg9^_eXI}D;id!!^N4Uaa32`ht7Z9h{=Gr5XO6&YTqCV1aa=wqYvacXK}S)U zI>4|8yLwz)CK}qh+jZuEXv78x%n71zztmS1!a@QYqF(+Rh1zR%a=xsHWf?;(&(wbiiW|83fL7zeM zvVbG672?D*Kh@pgSqtDzGWXE+b)fCt_JF=N3$5revQEH^wYHxN#8EQomwj&@df{oV z6Jy21e^A>l=l#Z_q6}es{kjt z+Axm9K2@^u28#-JXlt1I1l0WX#Rt*T%Y38b5-zF!P2S$}kcNAP+pcy8c(n&l$~4oT z8IXzSdFKqPm5Hz`623p$P;8@ZU!XjtFjrPfQKb14os-P=;JjVt2gQU*+2Wa z-~w^XlW*UR*lQb8r@xt-){T8@_hTpQ0~Q$gcva!*Ls|#s2k`zNC;{iOsvAf};7RRZ z;{{6j6+_1{GBT99@;SU21QqgZUFIu)YP0LF^DQk8*wXl^TD9q~w$YB!7{|FEoVE=xbk#6ol z8XNHe_xGCpsGT4}g$)lO48*I6bcs=s>JY5J%?xoE0M*C4rQ6}Nz-NY22XXH6TM=?W z&>C>wW7G$(iC+4Vv7~t0D-jV)=2Nc4Cml_L~BZvYgB?u=Y$dE&{7b*a`1^Q`D zP&0oDA&!^&ip3M3wGdT)wEv80mGoT-;;`qDrX{z$YgKoycMm{eI&aj0BWFvCF>CoYu*d$OL25Hq~ipuG==iwDPo6IjEX7HQiiat8T4q`kdz({=rSkGAPGA zd5bI!Z|x`1RQYYp@g&i)gKpssxJJ=(Np0gOC1^%NHmOvHi8ghR9{7Q_<_E@3o|<4l z<8qWDU8-2?vLd18Ji7h50Sp0+Z~LE1V=L^w|F8 z(@~gyeWLm$US)6?fB>(YjdU<-vY_KXy36&ej?1MwbjKOW#{G7F-OJ=RQn$<3Jv`jc zQLq0Cb1LH0{rR?m+3G2+bo=>qm{BG#riLwkFLesqehCBP2aB)6p99LC2}{+ zc#%QLN(sjUf0CUg&PC&yk}3q1=hyjZ<2Z1JSxRAl{)na{b(xvIFYIEiWo#(xsR}E} zHE3E=Uc)&E+iFA9kiKOI;mW@i@E1zff7!I~6@7>GE?s zMIHivwy;xuN)s%B+e`kk)=(EaC&o7aLo7{-V9L{aq(O^#TvY)VQ`Mk?X_MIQ;MBxy zeSharGb*(QQz?2S{2XuJ``SR#SZ5c!3C^J99KJy#?M!%{n7f3ui|yl9lf%kQ+gP3s z=fjof$4;*}cy}hgU|daeR#Z(1&0OQ1hH5a4a3OsuRn~`@^;Qgl*0Tw?+eV#p@eg@B zB`F<$hX&C*p6euN-v$8Qxkw1~O5Z}GcMUAteN#B#`enut(r;}^1{)X#(6`7WjFh=y zgolxh%TCw$29Z6Es;6--b+&&J3^dn`K@_#LR5pmtm6nIi2^a%bye=S9^j^2U>*%Q4 z1Yk>_1AKs*9-&P5Q{V|Pf=uHuhEvgL zu&KqZeFJ3d+0FAYmWX+^F!>BKLDEKU)*el{U`@I_8!C&#?H+WZA17nyWG}26JbOn>DOwD1~I?rl=(DPDw<>tRN}pbq)9|yMOfGffYhGZxvG(GL{3K zS7=05Kvfk;YBW%seWX;#fZ7hD9Ay9ec)EgRbqAGU4&UbRe7|s#!d~(7=~2D7vNxH< zPnIvj9CLF^m(^5fVV8*VkJTImW?|JtR5DU7O2Yp@8x1&E+wg;CXT?=W?0Gh#vGwPo z|H79T7aNg?DMgn%9|waRGlPrl)zx(sbyUeeut`Aiu=-`aYWbwDg+Ue_HCZdtu?$CB zufb0C-;P&~*CWW?U6dw^bVU3bcGfHbQ#}6Qx0dwtpyAe*f6DD=R|K#EO zuDM!#tMtwV0R!(8{DQL@YW$L)8-S=A5<&P<9>Uffy}EwT>Qu;EiL&vSWvPuu6{ci} z(6`KaNa}G6>ab@<+*vay&rBS5TOk9rj#uckxH2>d{IOk>*&#tJfRKR-N{?>yg_I1Z zrzRz`WqVIO7)fei!cigZ!+wjcYghtLNeQYrirV^urXC=CtD_^_1gG@T6GjP`t&>WV zS4`8DS!GsfPIKu}fpzxybOnQj@!eJAN0v)gHCWE5F=~FIL9{}vU=$dA$)m3(EoOH#5Q# zU7EgcH-r>Q2CFs9El6TeZmwdRq-ZRnsEnwoA+IDigp|DD7hfi>45&w2U<)rP#R?U%;|Fe^fI!m&! ze`vE*@2h_oM@D4x$5A)xFgQ2RpPJy}>#T3xKP7_*HmJEENL+8n+hEQYogsWOG!Tw; z3{3N8(0+!8F*zi{3&GQ&eSlSgIe7jlh5U<|;mQ7Tl^pmO353Wk<{0vL+4=q2NmW^& zcQCmrJm=p|0#SGR*H5BiXl|?PeNy87Ip2M<<#*pYB~&ol?SSA`J?Abz)0|s2&Fyhe zH8L*Kg7W&n_;_YKgcsyd6|=K2LizIdD9~9Xnz!wpXp@p%BE)-v{Mz`-zjZV_2@v0JHGms$>w_wH7q<+Z=ii+UTYv3)r0$r0GyS}fKN z9iMlTn5;IwcH4vFNYqx(dYH6+SU*0u;cmA>%ZVdhnQ{Lx>p-K**An6*b>h>}V{)R2 zkgSan|Ae1Kv#E7)qnK-9lL@yA{8gmx$2W52tjM?hl25gux{KH&l(1=dCIl{bVOW*H zSKJ2!r&;_~;xqKI?_@8h32WHgm1GY!lPOq|vuqZ>B|dgLjKdaF>fe|2Z=Z1Z{IHK2 z##)gVBa^c?!6lFcK%i0v4>LHgM`pRN3`s3+E!MGKw$VwUiJyyP$=mJr26y6yVCgTL zE!RlP#t4K;xSa2E{xqVB*b7?eK4&U(=7M;SLdepg>CI> zCr^7t^jyOqgE~LmH!L8=zdNbAe1o1^poZqgE?y-i43%uD{>*A}k*e-uC?JNQi!x$~ zIq8M*MkzzB&I9;%ehxeOdZd0pdZvK5FyWsBn}fy^VPShUX*oYFH#SV}e6CW@l2Eqy z_E(HIin=%04qC{h<8r1>dY>{FnmnVG4qTs=!*ti*jNa57prM};Q|Rv7ZL;?cH{|y+ zyUmuY?pqzddnx;eown9atPqcMhnqR5P&Xj}f{FSw+!vNL_xWw1wW$lrRz^G%Q&2Jr zb*41kqbbHsc}p_MGMeVX-w&%jBHw;Tjj5t_%mX#Qyxnjw@at>C6dq_7xzqMl9DE1; zA}k?=V;?a`hfki>zSpPMLAgUcKAc%|lyEPA;?X>8-y1%TWdX&Yb#!&FWTZ6dnfNvm z-0dd2Ekd%mPFh0VY&ou_>4N*a_i>L%_6m%|qnc=vGa$O!-oT9VR{Y*xnA=-Qu2uy$ zO}?KYq5D;UXn|Lt$o-MlruWZriRH^=cS26*A)u$Ap?(zVx9a1=kEb?)&escJ2t_ni zQ#KiMoqtKXF*6g9(!)J~Tvgxa*9MHgFRD$qc*BkPkf@6+I2(Awb;;K~&zhehcMA+d z<@@RhNgpw*E*>8-2h0t*hxEYY87i+VXv)vYMdL}I##hbjKK3H#$1NU#xS7tV*?j8| zf1`#w?hKlWCD4?ciZ7(aJ!M~4bC-lhkP3>x>h^p1?GsT_K}b)AgHDWikFLQt%)8cgH(Y^w z+5=T4h8~X+M;s{Cse66)DZkP%y`{#u?#6Gedm%>FMPK@~*0ES8))e;? zl5`TZ!a2L{noOR*(gwW=TO7?>kZ_5lqb8U(KZb=wC!n#0%)}`TyP~$<-0d8nJGmJi zucP&lQBs>HG?6foD_cmvJ=nVRQKfm__6sUz%^ugYLrMrH`A-}ZfDT@1a0lZV~K{O4FSgjl2MinOkO{%EcY5vDXg4VoR8|q=Q7}+^_%lcVoVfgvmZLPJ z)^zubf9@fd12;8M61sj62nZS5JB$NPC(jV`Ec_I_#VuQY%rNwq;OO#@&9XZWSqImD zmAXyKrr#}SXmL8|7Ox&)clb{mk zSdT>y#ga5tDB{zO-tDX^qQ|F;8@4SrAgfz;!q@zZPJcdm|9ZGOd{^6y`P7^-GlxKm z;O6aZb7s){8>_xNN9Lr2+OZ_LL=R5P1H|~^k!Jny@iM|hF?GHFEf;cj5*ni2*WLT= z?w`;J0?-uuPu$$GHnH+fzN7oDgc%bet&n->}mMi{S^)I6p9lN~FV6 z?z-m?7#uyA*+GFpSJx2RZa-9f%|oE~bu8<~J6T|UHcZ?)-6q+}Bc1Xfm}KE(qK1|y z`86q1Ym>8T7{-rF3CO70gOUOS%uJo_`GSRjk$?!-owB<0apu|g&^KQ|XkicZ$F zGXMP4bpMRY4vtQE|4hv6|AU8_iT!`Qyjs)R5vd*iCr6haH@{}A;(3QWf`Sd#^~g^W zTT5))gcr>dUk07lICJU#_OYqN)0La^FbZ4jg~*br`ex;^NrMqXH}Fy`wfj;)NS>o$ z;r*h$FalKTnZ6KOJI@cQ-!=arB(4*!n`wxKT?EKATyA8}c$FqELEY%M2Dm+;^Fq8P zsb(bt^d_x<=_p1$M3~h9!do$bV2;RCsmsx!x*(+(A{hY05nqYzP{Rp(nCgR{RDx&U zK!~`dWKKQ=p`FhorVcVi{+>ZEC~QC)3|gsi3G1j4O?!TDoGp0&Lo?7rxd?V;C<)WebT=9Hu6EydQb0 zY{`YxW~?nA!Nb_*K@e4##iBS8h8$SGxg84;w>@8sE_FDwjWeFD0cDjKHVpEQLf(o{ zSwE_Qam3OQP;tDl4}`Wv+rKz>)AV}CF`|3(U}kZ?@RB9skRRj{5}OwkSU=SEFiytd z6&SOZ9+#+akZ_?!f-FB<;C*%$PpH1kj6e#&kp*0*iDKJ_07*ImapLgFAX8{ZwUT*u zK(IJXtSbXREvjmAC*tStdFnv@BR!vIVJ`q^RewNsE#p->kQ;iyY9g_dtYGalE}D9F z(C?vhJ}qEskY$iDV-!rhQHbcE66*{#A=W*I#4`|cXzlO-znoy{oqjz4j8@Mtd}Uw^ zT7RK4n9?w!a>y2YTRi>Pxh{T$IKUlZzWgb=pdy8G7!ViHddVNyFNp3u9cZm%iXZ^% z0VW7|YX#yWp%ih0H;A+TuD7jFsCuBl;-qp@JYsqrB%$d2qGGl+=iUh~OZ28Fg_@tI zxBG+D=jD^hD*bFW13QwZYS?77jK-5meY?S#*8H2@mOi$h{oVjx~zzX%!p0DlD+G1 zwB^|NSEc0^rKT#4irU7EgykeI3yB<-;=fYkU?q2C6%OgN46{YsFt$ZSD8={fv^Em{ zIqIK~cR^uvnnL%l_4t=o$Q#pU@|_YmndJ=OXE`^Y6v_Qk&-H~c3dktQBcSE_FL=wa zU=W3NW&fVf#5lHPXB>XP0^$?>3dw*`30=HdzC*!LuDTIHwI3p8x*yR3XvH}O>~eY3 zff<@#ykZZ3Wg4lM5x(7adshJ;y8XAaDzPs@f8}h*7}|u(+8Dh;EtIa(kdAU@_W!Ew zE2HA*+ATv!a7mD0javxrjfarX>EICD-KBxXCAf9d2@tH21QOf{?he6%yL)2+(zsmS z@4NHe`_7%Yvu4(sKWFVat5(Tbb)Nm~U8kNR*PU-F+LV4APdlAF7lSlVWF{t$BxOSR zJ>8%a>D4N)F{SZL3iC;zVB&5{oK4C~1oszNj#Svqgf!WhXg#l>Y$x%>wCtfjmR2y-2@n4Bk#^9J4U>2fH8uGP~7g&ohSvl$K4&4DMN+CuV2?E5xz?RJ_Y7f z{!WO%>s(*~krrNSu#hR4#^jW-a%9FIi*Y;>j(L#^dN#-$v-#=GNpD<_2Q%x{%)6}> zCze6QAZIWBf=dXmyQMH|A&0I~pItPY?mc>As4*^V$;HZJDZr{6a$S{R`Yw%&wOd#- zCr{wb=MkarHcVOtFEl`(^G`nK%UM>;z0lC4GOSn7w7g&XTR>1KQ1qqzjY`s4R=@8` zIa!rUdNCKV#<*h52PVZ2OocwFVo7tPy?tc`<9yxDvW=RJZN;aYf!bHs7~iJ^Y^bUf z^{lvK5;Ya*AV&LBOZ;0KvRuVCaZQJk_{04L{T>sR4X6F5Z6=ntCf-1uRM1kRjD~;r zR7ShgO+J;}1ng_96#-P-yf@^n2C+c6L3O~9I7e#GoM0FVs{UsrSejTaKfXwX`j4z! zE<#;gX<1@UWV^Y!av{ViHlq7=s-vQ0^16>_i?+at2WN!SxHzk9Zpu6BnJ`w0R9nwP zbDQW9Te?XOa*1pN8?IdZm__VIY;f_Y^YD5F+~i%SGV`9xN5x9)KDm}>^%2I|GtItU z-^OJygv zsEYSc-GX|qiGrW+g-Z$`^;z!?)e1_UYicL_G`E#YUqsS9AMW_^buT!L2c(&lUC=Q2 z^RJ<&hUzej+OJ!QR!>&MxP3MkHLzDmt?^rUpjI6vg6?QaEOqGDuGZw7D=|59!4tO@ zZnn{_de6Qi|IwCldk8dB1kk;$;6OU$2hdC8OPNB zX?y)AGs4{>({$mY%5dnZ`ARV6pa>fv6hDK4=jURGi-*-I4?$(g^CC{X-RSoEtg?SX zIrqsPb-;u$b+k^0xV?_`e;gt<1{NYqcu@D1HGS+62(v2@(@6@p9HX8!wYU9{PSSO2ql z=I4Bk?l%6vY7TocDnFfBir_TSOWPJg7js-?NNu-{g{Ym?d|Lc1%aar*j6${NY;O^w zXm1qUYhK!<3R80C#l~bMLnP>h+|tF%A0+)o>&|FnZlhwA;n+;aTb=0DsIknauk63c zXlq?88J8eRMUxORMKXRbv%G`H)sF`v1-=%&1%1j+gtgSQOx}9FmABLh#k#XAw7kcgNoTM}J<|b6*j*o>cB?Vonzh?)V(dOOwH-oV*`kyF-zIwM2_a{jEi& zSz3C@F9F)ctMSQvFJHlxi=xoIJuAh}VGC>Hy@JaRrj~(7qbNJyEjH_nd&#jn|5MSm z9axiT5U*~8@y$T1nTNFf{x4N-#?i@7HaaWPUa^TiZN}SvHpjnpOCYF~AG$%Ypv}*{ z5o({1J+B!W9bo#|Cgn9dG5X{8Jlc|)$K@m+jlfJ54(!M`mFnNWMsldHSXO@jle@lQ zk}}QgwCxB^Z=6-w2T0c(V%9DsACshORlNL@V+r|KsK7v0gG8=-c}f^8+;tXaF^+}? z;PCS}-H?=bMok`@m87s1Fz9}o5Gpp+24lyAhi9dqe zj2uAm<@u8q0-Sf}#aeOiyuu%A`Y*?%u9^U98)0eRNfN<10_Frc<=OL?fdC$)%2Vtra}q7Pn^9B${E#1WO58NfE^}QKhw+*dG+6pGNLW z1drEt#4A!;8uX(w` zG9-Mx89Z+oY&fTL%dALS%@sL2ey;gjzqSadDiQo5B5AhK{J^4lBP@TQ$wYqBAXf2b z5N(RHw>}T(8;eINaMJRs_GNQ(P}^}RJE+BMs2?lxx$NViC`u6RG?uU=eyAMBLv2hKpDq?(pAWPJgOE!mO_TG>G^rJ5y3qzskl_G@b!D^_|%SSf9 zByeuT+QGIn(ukMi95}(pk1+#&KGWf`Ns?XfeHMrL{Gp|S-4;$TpFGR~qpwOE-*po- zloW-jHO}@h zol{FdU9|@7rNJ(&>da8Nx8fIl`#lnqckRC>4w|OCwP9he$BTmJC$-7kUz?l6<$+;*x3S0P62+9 zKdAGQcBeT7q;o-qmk*RFYdvN6Rq6%;)V9?{V}m{;Lh4ztW(MkI`d=rV`dnrr4u_OW z?^p*MM>D`LZr(oJVa6y)8U$i0#ZdHG4Jl_B`AHgkIvrhKpEHwWz;=m7TbNY*VO-m0 zZdCz$>zSU1w27M6ysHt4gI(-ps^K3U>_+QWJFE6oE(xs~RxV~P^rWj-SLk-SS>DB5 zEmfX%boFhLRhB`wvNOlEb9*T5n6Cu=MQ=P#=DMhSN-ZfmYv58uUotaf{7*K~gybKh zc(;0zm?>ACBfj>&;rmwls)ak;E+zcQk#uNTg5>eBZJK1$%KIM11on}5C)r`{4B-bm z_{;teb{dvb9@JaH#3)}xP?~uX6Exkd>?2x`&yuf*AtbLa3odCMGb!#j+>SNeVZLTO z40`?z^5pB75um`A;dli1{3C>k(TNv!5T3RDkqra zxV*8c_forGGW%C2uT;=`&0ckZ_8sGrDly(KNSO`814UKc3YiJn_7z4A-#Wi#^2DB= z7x|ejRXY&$u?Dm#%C~+<2Q#|9**N44sE^thNq9?~=$HML%s&JnZGVyT$tIa(0p|_t zVFXj6Dhs_5_QmuxBTb91GMT=z5IKTvp&>*Sh$ByS_@SWh>1LY^3-7ASnd+Yt#IVuL z>6It1anr1UL$80wbN9#&X&-v50IPHv<7&mSpV5#1aR6I6@mOH_LL~Py7zzBvc4owrV>hA5wPg24bjWbKw6k3_3CX z|5WSc9|oO{x}_B___e;IB~VaMP*lv!N=!sh3@9pUVIe9eY9$~jD8wfqY{e%c{eRxW zkXPN=*&XjM4^W*K>}2K4An*^UVe4bbARs2d$E&T+&mhPkVEEtoe`cj4NdcGGiGEI-Y{1Olv0>SBCR)uu|0pT6|bRd(5v7Kr_>YimCK*Sp4 zA)6VAawj+$#sQ?tU4EYyJ_cWN)}JfRXw$N9`EEu%)Ts-k*;+PG?C}QDQ!KwS2#tZ@ zS}m&^gr_8j^+O(8t-Uh{6RV|m<0n2Tzqb_i3?g+ z{aQ>9`Vt&WqT1I)^H`GguU=o z)~F=y0ZWHf`u?%SlShGcyvuJILz9m1jJoW-Xzh=%7CZI5XbzVRi#mM0=;@c`{6Y~& zxYAwLI*8$;$IYGE=hREf`hF3IN0L}%k8(@sI%ZHcN)moAODE5?ba#z#1RNt4F=ABqv&HW_aK{PiL;30 zzfzw4CJKh}gXrg8GdmXXZ{01j`GZ$sb)T){pU0VYOZHWOW#XPXbYT?nZOYNi!E=x% z1EMWu;J`Sw?rStTl7NBAaX==cs_$i7dADDtMZ7G_8tmexMubXHpbaP&U>?uN0v_k@ zo+%mHl!G&pe247$q#`mD1ac67SwutFgsS>n;%vK9ggV%cSjOOP@*pIP0W3W9 z7+(600W3IF#4ADt7C`!t#dh-pCxIus`*CYJt~_Y3v=32v#mLCnEQ_^yYD;5eyZsov zavfVFMX}-+urPMc0{Dm%HMg7L>oelo&(2cPywIkPlhB7DWy)^$87u zh#duxEd9VGu9`kT9C`NzdP*ckAnSfJ7b^$f&{9=(pFmty_eN|Pn61wT#bpr7$w#A2tsQe$(O+tI0q>sR zA7B$>LBcq*AcflT4qqp=)=j0KQELA&ZCIyHoR@8SHbpg6c2?bxaiF|Lz2tShJ6nPSWAv>o^z2n;48^b->3Gd2q!_k;%YZrOQmp1n&}eo&97Q_nh*J@0HIH$(zfEf znsqfQYA6-|_bKi7 z>Z+CY`>{~yev`R^IGA0hj=Eb2^c!QF0uO0StrD(XA{FPFz-Pe_|0J_`eHQI}XPT+f zskv*S3*oiPC7H@T!#J98s2BYqmFL?m!%d9-d7*=9_-^1^*SXq`0*B+sbsn_2pV|D) zv$+F}`dess_slv~pZ^-2!~z?d1p)It=5;(yTgOG?``OOB(SSC!-FNei*J%7=4u4Ap zv?9)NWy~=HWbY=z##*4=`h!O3DXjGES2Yl4Kbr=+#hW?^1#e|kQs*5mXMkxuL!5TE z{~sFUqxi<}MEnPCG!BcQ*XfX{+jOPWIKMAW;e+t26`2_){CdK1?()x&mQ?G8;++8g zgYZKKlApRd`r}x0W)cq0^D>u{JoyqDxsW@qE;d^5_1uB4GwFh_5A4b~%V9KyrMEVa z#wnhMg>l>v-g7;;fNbcM@G{|jx ze2s1U+8s}B*HG?$bMPe=9wbOg4)zXBin^g8$+${}d=$ z#S@4wMs}OK5=EU(8>B_-{5uOMxbXiw3s^RWSkHOt4mH5CjDlurNwiIgHdpNidL-B2 zG8R)Btv=nVrEOKUL{n>6^N~oHsBN(SzLinop%cDSmt!qv&6+Y-`zx+)LmjimeC~a5 z&q`(gD_N$LvLhpmJ7j zHrxdED}I*_VlT%UUgeO4TmNRt=s5AhC|zZ3glWS(HDdis?Hi{EP`f%YqQBV|+vmKn z56x&7JFd=Kz3_Qwgk>xSZO0M6%a0O8=+soUhjIdbL5$ioadx>3QELzo2Yc-atW5_H4FM9YjmYE(vrL~& zNI{=LgO6@^*pUbpW79?%XDib5r&{WW`-uFkXXUR*oE%CDAz?GeQ|{&flK(TdCOAMn+dZq3F$Q-c)Le5FaNL=)HW2IL*DUJSHNB*%CsBOZ5O^$RsD zO_nYFSpOH<*HYCiYt4txL9h=x{|b8ZVXU<@XUj%hUH&@Z8@2SDWhBHV?RHe(Bjp0+}&zzT)8pCRih!(rV8zat+Fr+&{=aiYt8h%!d zEn+q;Z9dJi{w@E7<2zN(sc3%VUxMCx>Y0SXmZ-dp108=w@wjJWH&KSRQ3flOafozm zPCwK)<8*+3o&HB8K+u*kd$bQtKW;D+-HSD)jFsYh=xfFc>s*}1zA_^_?XcNHV7f36 zwYLEunY%piHUkiKcmbS(>$Rqv3Z9mJ5XS(mJ_o?fT>!CNM?efxeq8od7R7F|G?<3V z3+0X-Af^UCq4g?P8r;o=CudDE4T0~%$kX0c`$*7*gQr7rpnaqEVI_pMq#a-YuS<@& z$h)b=npzb%K+w1_|3xd0Yf`^#e>&Cwjj&}5Bmts=1If?R7-fDe9ebdH?ypJpz8D3{ z3lMcV>7kD3z%3Gt@sU_~#l>VCJCnE1onr*A)A=yVa~DZ{+!JJ6b2nDfYEtjHlc>7X z!>)ti-8tx%VsSpgL?tyR3DdZjZ|00&awn*tbztN%2hyXT0HVwDZZyI-SUMn&>?eU` znJl#TS>X7QhHTTLBvUpNPX0Heu)3nk$57#g`vRWWeTZe;B1W0l{#d-rmW}c?sh3!b zRyWkyL>dzJPrMvl0rdMhn0+r;JOiOd+@l73hUS!3mcqRsD^!hlusET0R<&NwD7c7m zCd}7`{(=LAC;0*Uh;LzR{Bqzj^a4;wJu$2rVZ!MULLD@`Di+5xO)FfIk$VtwqjN%S z2WO|q+gf27cnQa($amu-M(f>_@UB=kzG{v_mu5>V1$@@qtqT`bZ6RYlJK~ULZ&AL% zS}Iq*lL+@S2VLnk$_kK0tl=CZ$IV?N*|NIV^~d{wDZMxZ9_v+~Ws@u{7~>`Ck95a{|@KK-h>U-&FBvFbw7dFoQ|F=!m&T`C4+G*`9$ z-ZM^pMgn2#-#yEN*kV7+l5ZrbS2?1x+na@NsV!Z(p*Xz=OS7BPDH^BL_M*kFTD~1b zHSv+4_Zwe1nhWH78A^7(&yWZt!^A5azb{75l~bOL`h$x3f8$POcdwtF2fbD(XnuS9 zNot<(K6;>{H%Osmr(2rZc~GNU#imD(;x*DbG$ zQnH?1PpkXsHH{yFkSqHnl5~L*X1pUl66W;h7rYG!V?R@8U$!xb=G?|oEA5;}29=!s z+#*HAr*#y%%a!5waTj$&tSfnc#tz|ogdB5}r;XlM+xn?fKbQ}Vr9ps`6>A<>v!uj2 z%_}cP*W;X-QE81jDjC9!f=>O~f;5g*EGPpNoAmN_=TtKCv`b{^G81H~*w z1vQlsFC0+HX9*5H0KB48Zo>I%zU3BH6?Z>ugn4eGraX!1R}}o@YS>Zn1eU`D-N56w zs7HX9HU20kXB5+X$W>Wd$xz0Xt{Y&ji~>2jAEU-HSk4+Acb4rGGj>0x$KW{`Av-`~ zieLM~60s~|F!r+Wg9m`fklx{CF{AI<_IzkQ#nutvr-LVU>DU?&Om70TGFO{xQI-Um zIXJe=IxVm1DX2KRiBrB}{aJm-+ff&3o{kCk2#wM%YRQ+Syxi}6?|961+CK$ zrv=si*bAS=yUw32#qZ+%7To2}8)1t-umQ+r+{?Ex1CZK_p)Neh*V<>avoh?z0htAu zhK4Eb-3OFG;)!e~Ol+Tak$P{MKKe1CnFd-d^Z306_LkvFB+_zps7ZGO*B!#kYj@(R{N``B1EB8>b)aa^6NCyJFUqGGr z5SN6pS%t=9Bmne#z(^)dNK6MP4ylB+5R%b4nw z>Krmi0lc}2F%Bur-UeoLd!7fCoc;zmm<+F*NH1`q(6zWwsT^iq=4-rTQk{_8Ug(*B z;s&(otHhF)I}|#CAyFwB8&{eo9hLMOBa=JMiKv8a1PF-1U9TITC7#jwfZX0xJ8bRG zlZf$kha$cdZi9hTRT20uge9y~7tI@^JqUz-!G!4vW9L% zISo&tgdd|TAv_mWb_<8}FBkmjvm3(nmd<4*qb@y!N;2LUn%d2Kz4oMWVqc16KO(3* z5ODXT4|Y`3W|PQ=zTwA$LZ?!k7^|vZWha&d3ki^!@`H`%gD>|FvnIzFxyM?!rrzqj zS|GUB>e9JGAL^H8f@e$8^E~H6F6k8dR8DZmT!`v2`Ud1Cd=g!gov6@|YnX9wzwVq^ zW2E*DO3zHjPKuVFfVmefWF@KG3I?W>G#}k(XHc%4MuRsu1jc2V4Oz`M_iniVcDKoR zmAi0NNf7i+fw7HfJ@r1bsU&C7TrXCur6Wk9WuPcdgD}R6TJW?f%IlKwBF_9Z@%eMLUS=_!@tXdzV9^~@&%gs%o2fgRCaPxy7;9jC zhnweCKQtn~mC=J=q`Q?57*9`Fw5N4y<<475A94!Qfi;vTl$2zm*H@?~R~_rc?@(!Z z>@?Ie=!VH-m2x`cFWpQFg^L@{C!DRRb4H54Pu4+shUENPL{*s=@A<&cbEoL?!|Rq( zf$@oRM-*OBCuZKs6fMe5GT5ge=kSaNbpU3r%NVmuKl_bQw|GN^((SSL1D!FV*#mfq z?EEPZ(=yI#Q#G@K4cpT4>B5Oe`KxN$kLyoH4ONWCr4oiX>id0%1h94G@a!b-zX=RF zn;>t9{jT5+70q3Oa-(cf{;mshJ7RGe()(`~7@M;e5#)KkD^uf|I&jd;qFsGGv#){x zb;Pl)aNKsZnb=$wd!ofQa4mwA9omepT8O|a736A?}hnqSHFbc zY3Ai_g!KL+-4dLMex5kMg8Rl$6g3lB5?KAI<}1%DxCyW7*^W=WSA^%DQbxqS>ac}- z&1eWKbfK_tOl_P~M@6iJX@u@qyxcxm>cSgbLt3iTe#Mn75!~f2k$oFI^0FjbdDsh@ zRLpPe2{_bMU;31x@3Ey>PonUKRs0?LwH_$=z_Xn%O%k8?W0C9)9Yxt@V&l8)=x!9w zc*8DAJJ56_W2$mVxafqiF5|&A@G$ICoZ#uy#*nM&r&RJ7yK#0(y6^=t%ak@FeG82`#BQY)7JYWuVeZ;ynQ(k>aLOrj7B@ zI{A#QF$3SA&ybmtAGotO zN+x8*e$>Bp)LPvxPMyy1??!>Y8?HE11e;d`PYy3`s7c*#u&X_?@E0h9jR@LJ_QHzG za7DVTrUCjU3gZnm-Kq{Dj^(r-T}0DQB}}dNf}c(kHkea}n-lLv-SClQmx-RXHB%x+ zfH+rce-RzzIZ+!WAhw(`qT@dOZG8lY%61WoZ7WZP{mWPcl4`gJD7WPU33Jy76uX4d z5ciBQ)K-@qdvZ_5tzoq|6l){{tp@+IpD1cZw`q=1@;`)Q5Yk1^sjaw{ux5>CJ}OKn zv`Z)G?-B!H%1YPzLh@c8QWLK|m5k0k0%o+v-xI)Zl8m-WFQVbK$BmIy|B@I){~C5e4bu1HYN+#G~o3Bl{rQ#$EeOQ7t!!QsN0)1%%O+P@9#)+u4AWgQv@7QikNki;3F?liA znz{GrN-`RZH#&<};DfSe826HH9Dxy5Dl;F(pVODleLNlwrdtOgqEZuv@dD93Fc!oD zG!Kb&U}z+@UUQ^ZKWC1MFFps>?{@E)um-_k2Xl>hG>_EbDTs zVa%P&l;B9itQchn8$D#LMyq?4?^$a}KUY?_puBQmCg%KJj zfwcdieD==fC}iqAQ*xN{Sq7J%cqM(5g8C=ky1>ZoYzD|rk_6cy5C+YH*+>4k2+f2DA7f@(x_W$HnM)p>ObQS6kP96*c4 zVjJsGN!L>>fJ^Y_|8@Q_l)_B`Zm$i{zaBuoTCF5d3O5C4A%W8XTG)h50W?U(nSYi2 zUgFGr4?^ku3Rrxv7b%MCRakKm9eo2(O9KQH00IaI0Kk1uTeo+l@8+Noe~dmdUru;%oQpS5O9KQH00IaI0Kk1uTcxTp zud(|90H9J201*HH0C#V4WG`fIV|8t1ZgehqZEWnldv9Dvb}#x>_EnHT#O;>&erV$4 zdgRAwAdeMGu@xY|MU!k=98;vyq%7{Td)KaAwQ8;3`mNvk+rR(l=0f&iy|FyMwD`)I zp>u<0vijo8((L@=`>&k&$7^p?C(r!--~H{K3$sfzw{O-LS2Fea#pMfkUO97PW#!g| z^XHdmZq#qqmd`ESsxPYF%`G)<)>hO%8}FaLv(%Wq)mWOTFE6Xh-CQ_7JUBRh{$_1{ z@eEz&W;d5vnwy)SslP@8;ESx>;EOb#_acq@LTyDo_wtSTTg!a4rB}|}ZY*A)OI2^q z&oq{nm*!TgGfOuw;8o~9{EZLGzVYGB1^(Qfp}{V$ttXAYQS0W(W*fCTiRryHKl2<{ zP~Td)-7t@L=hkyv!+rIy;V;kVg*3f1dsqMW7W{Fg0spzWa(AJg-MR2#ZQ+$O*XCCi z)ZNej-QS)!pMXDL@m*NHRhy~5a^_Z}zFcp7SU>Z3#qT<6MYA|4wu@%xUS~~zZ3Vu3 z>Sr~?H<>KH`Nn7 zQ%`WHCTmqaL%Xx8-qdkTS#hY}PO+zM_*C6EoU-%0=#ne%>h0;3UKih&dR3^$%R3v# z^k8G>2G0%l_$05@R(g7h->5})TnlV?aCj^_{N>pd`VWp!oiSHxjg_~je=h#@W^G}i z-neUwLv30;<3=z-COE{)AjeY9aj%A-&nc(%9)kM?K(Z`{NnOT<68Zr z)BxVTnEmro_Ba1>duioIL)8)dOZLwn z_UV^IZ)m8O)&3vheWGtEHsE0~;G$gxlO_(IqSft)hkF_Ew^?|j9!86%W)LsB0Cw z{Pjwv?$<1y!JnJ@vTE#lj&k)IzH1JvZ>#f}`OPXksh-8A8f&gU)p-c_PCi=tPMP}8 z0bJr4AFMR^$QI7xwfgx7Cj~a0c7-j5Knb`p!l;hWL~6 z=j{OCMYiz<-UD_Xb{<6E+qu#$`ugIm*r4Z=yLU|N-llp9_~KUez>8KD?%UKOt`>O} z-o?jo|7Uvq$Fj43=?@~agMbP12GO@&FC3c;T#$<17|Kn^k_UQv7#C}|bfi_EePjN8 zh%Lf#Pz0g=dP^Np3-gP0_^Udlbl5rbk%~@-2B$_R)a=fv195b4cw}T8Uy1tE++2NT z<#qh*^ebo78d!io8}R1}{D~jcUO^+9tuN20--WLj9Kcu3oXKFhsGH$pxxzt_x=8H; zOy>NI_^WcbYT50^{P&2r{_bzp-*n7|e_8xc-BZtx{>RMEKD2{AcYgk6?fv@l`2`g) zE-u&4-O?TkjCUk9UcLZcuBLBsd1>Z@i??HIr|7+@m+q=HN9|3SIv3* z{ab2}yjfqmnd!f%;i@sg^=ltqUgpv9XY|h(m-NW+HVcc{omb9GjVa6G|4PrOwoCAj zmD>CQ{o}m;7Cq+jEi;+$=FdATO8#4K7`rphiw)E5CcLCq4ei8UEW!7)KtEOizxFkI zxZ}m8TX!4t@84L-zWe`_wHchOYLk;)yHU^He(%+*SF$&jZZFOPb`w7pUg&6wKY@W> z(??=korC63RgRE4Ll2ds@R|Mro~7I0BZ|7AeCmdJzaOZrGf(?w^o+SmgU0HfIs6^t zhhORbWvc(~WEUHCHI*OMRm5`h=F;MF_Ug(?V}AO!p5E$J+?~xs&f9-65)0S($F;fd=6?~d4^oHD5k?Skb z<;jI;0EbB z-ljpT-@T`Pz5<~soD%9^cg)$Ze}7rck`7|ETlCHn{_f6&g_`^q{PN<`!tI-j;`h!E z7MFhVtU=jg=$k@4VTP5nD7~W{W1I zEux6=6J>Zesw&vl#_3SUfX8EhFql=jiFluwP1!dDu)Zkv9tuJQ(RBNdJ zl+0Q;hvG!pp*ShC2?+2iFB!1es)`r%fu)hu1H^WZC%53E-lw;Guh?(ow8%^2RGnqUuG9;jm7%i6E%5P)#`05WpCDQ&wNiS zG+Abari2yR2Iu$*MJpz|V-lVjilV35wkW3fzM*`Y+NQijM)Fq9s_rSFj!#niDz zgfhy@H6fRVNvvSRkb|>1%^c7m01nm99|sw)JbS$#K-sTg7-}}Z>^#Kmt2b^BrKxC$ zs;xe*KJzJJRT-dOFlxZB02<{ao<-dBA+rylss3WdsdqIqtqOvtPhkSriyfRy_0wlM z(F%9T37N}bQS4|8DVtwjzFkM$?9KU=pWL2y(v}+UJFv+|HKI-R&27MIbDd>utDq21 zzC9d$XQT6=Kj7qsem)qLNV5ew{^s%K+Tn9K1mo(RVO|?B$V0gLwsHq(wscz3j8t9j z)vNDbg@w?BwDSQxOJ|jrx5oK)D&|$It9%Mjvw8;_&d>Cs(U-1dm}zcjI>)aDiuYLK zud7cFO_@)h%Ze{BTdgh!H>7o{u~h(EVWI8eM$>@p9^_HY%gt~i*44juDJLGA$O;W< z6<5ij&d$;Vs=KYjOsS!&zdhoWw8b+*Yfg_0O#$Ta)kN+Qz)Nessf|Qd{7JuT^~8@d zyuH42OW*BxFg|TF_SIE^o`wIyIoPCk0r~dgEB#J8_thGK5Bx#DXf;V2#XeZ4eR%G# zI=@iY*fJl18NY`gpgkS8SUCDNyaqGPz)awG(aNg0o13saHpwFB_rIzpcVE4@$NIzU zVA_qJ(`PylG!Fw=A6sBTR`thV9qFI!!mHfIO$?W6=?fuFe-Nxsb+HyL4E>JvGq!1U z#a^D>g8H8U#NRa(KjodV_E#fiq=b=Cas1NOqtgL$1>JLsdSXF6j@_wmhv!$2Gr5N} zAF}+GV*@X`ue_tPdIJx*R&Ff8yNtfXA@LHooIKOy5Ab!3`~&1(Gc&NHx__aL1J z-|vg-0x-oM7+gI@$mlgg?*P)p{s|5Tk+$5B<>Yll`9NGt=ubvGv+V4L>XPS12JouG zL(+@ba>+`WS^!(T4A8HM+)S^#OuG_rA$?r2cdkwv?Fj={uE{506N!OvK*KwD=DbF= z5<8#3sjWVaN2xi34tdhlx9POn<`u=Slw4H()fd>`YMW!n&#e6R^RCL&WniywSjSby3E?V<^33(X%p?|sqtL)!5+8F zh6nZ#?%@1F46tb_C-T;pH7cuLt4urE;>od0-^DB4thaS@*qK_5j)n;ek ztvBZ9#8rGh_^jI5i?g-H?0^cae(yUkc2VXQZMqMk+rGBN^3YPdtO`yEeo!A(ZANiC z+ow0A#0GGxfjRY=T@45Ht5vf1973i@>_m9722~x|&zOZy4uLTZ=oy)NA(ed>o^OpY zH|=0OfNA)IHk#gG@R?5ylU&UjoFB-ukNSV?K&Wkr4g|#Pc>deRYZH%tAKg1R=YjEs zU!)LLNB0qu7_Nn*Pv(AX?8h)HbZwr(Dh$Hlz-4vjw7gp3LT0=Jh>hq>k4(K@y}L)< z{84Bzdl}6+W0^2M0oo?MnGC!YWw605gcw2_2K3#Y0-D(bADwryf8QL@jW$@LO~xAV zN>ut_mfpIJpsKJx^T^YZm#U`;ibG&~e2g(tMearuda1PsM(>`oTupLR%~yaCseZ5z zcFS5Mu+mI@%uN_>7w|LK=$gp5p2Acx8efG16jqf==WUlLRu3fIN#fe z*m^SzHrse|YCjkVuAhl`0}VEQ6n>=lsoEcZ;4=y8u7>P7!*dWrsTSgud-S*x5x^7q z7qBD`F+B9|6!QUcKYXDLr+3dL+_??j;*OmK9HCgA4};+kNAL+k2ymO?1NgvQwduSdM$;cF`i1ijVl{EX&m=6sbL+}{9=#U69 zDor#rB_Za?*nGdGAR6L9ZG0%N0@`f9E|~(|kan4!p5TU19{{!E#=%poFeFSoUuZ>owqZg=w zg?|JF*m&FBgXwr2t=cbz8-Z6O`-7P(onnjvc_{w&_S@OC~&I;q}7s`E9n? zB;uT!SM&`23K*X_@N9gp2h282Y>6kPpavrPH8NCx!q+60l`!NY_t(-z(46y(X2^eco2~35&u?4ZESn+!|g#5 zK+qrr;-I-2IuruT7B-r@g)6uM+F&X;cX`0;HkQQB#d5Y8&sJ<2okSTOtLjTn%nB#u z<_jIWu98)5E0fT(+3vo=UZ0++JojkHsXH!Gr1+FovJT2itJao3Tt1dO_x}MqVebS- z$KUslCH6yPv18fLcm#1&p0l?MWF;DEae@;AE#m9psfH1&_I)*Q!1wehAp}gcAR#O^ zXpn!^d%`<-O>l+#B`3JY!~qqA4sWb))~}1PM6DGr$Y}CKnSmFXe)%#q$C_;5Bw=7pm8N07RUQ$AyAYg1By7+t z4zL6O=-c5fvHJkE+lo0FO?e@pC?H(wd{adr#sR4SAo~O+YE$5IWQO-J=87YYj+chM zJ$Ol$ITxfU%Thg3W(f%p5bwZ{O+aXA5l_@_)(Ou$Vik!P1Cp(|3#fIQWT2xs7^?AR zn@+UixUPxQJH+k#WB0#7o3}2#U78GXgPt(+4*Xj*$AkiW_s1g)_jh~dsD7qbmYzd^ z8JQ&kI|*5zbpGsX(;j;fXaStX5FD#$47S)G#? zu>tCVtK&7hcvPVSZb?71Vux2sAO7&HCvd!IlrQevX804 zs|J3hIZL3X0x~q}@xW0#56|lSh{IsvI*O6x1S5TdXE_mfFwB^(lrmEQB`E zxi!G>c}1AQAc+@qHY)VlHiBvJ{-L;u!r#~meiT_hxvA!nlggKQCKF>Vvd*~)W}d-j zc$ft_u$BW3WSE~3G*pPZJNL{6#r&LJ`mg=$Dq4hxXs_HSTx0jC@Wik5hqkSsVRPUR zb6_L^@>ut&WU6oO>o4J<_u!1m@tMepTBAq7SzJG27E>mPX;`rPJxkgQwogWB0Ky(} z9ZvxS!dng?p>T(ZZ(%_aE*q?G`qXSVc}!=Jjcg)8OuF6dzOTk`zZR5u;niELQ)b9R zAj$d*2GYoa+Zfxh_-PgI;|eCHXP4;wkTUbuAuRD{1OQSJez)M7Ldkb7MbZ2bQ)Q-I z%#iphuzpN{19BesO~!?1l6M{XFRt#ab(18wFSp##^4ax0C6eAP;Veav@-p4F5uw`_ zKi4{+AB!8GKur1u7kyo52JSYjrN~JsVFOckjBXrK{(*7EYjKNei3~TjnQ#(Rbd?p~ z!eTJhoh49>GXzuQ%ob-igA3>41hJSVoewd8H5FktqvXFMht>prL8!$v5Xa}>UQphs z1-oU#92E59HiQUzIUlf-&2&#<=9M{b=9a7KVA=rkNFJ2HSRkP*bwdqt;(#VJ!~8<}tzF%d}gSnN#{eC;0t=12o$qC_zzFvxo*Al*k;wk6Zjmdx+& zNH!Mae83XP;9m!{@tPcQYP?Kvi#v}lXgK45>h2t>MOz~pxWd#&BERi=g_KDZjR>hC ze-R$b+VJr9{=!M!5JsP~gfxW06AH3kxXEzE9;Z`d#V-Dv0o4QwMePcsqy#aY;%2EW zN_&WiYcqwBgaPIXc3~+3a%6(WbkbSQOkpbR!nv`Sjd}uoc0VTL-sGt{3}hOb z!~x<`80)#mcxgabp|o=w6Ng-*V&MN4g`Z^GRg8+oD+Sekp<|kvi1ir_Eg(zw>mW2} zjWgq0_H0skS~N@!z$QbqDbyr=ryuEy`rQNN0vqa zyN0Wl+9KxVGQoY^(;5M5S>^$84~WkK;8Up~?LnSwFAP0S%wcx%M!mL@UA-&?J(>X z%1ihImQ8^DkrT+2-s{Gwnp!G&ey+k}nw!j%fqgOg-*7MDS&KM;KBf-K@T`b)RHmRd zA{5kO>-Sh3q=@_4KUN#5wY2rdjtoR?Mt4b?cO-c?0)w#Iu=PUKgb2y4aWAwcdvn5iez-Tkg>W^?9-@|bv8DBTBosFJsPkHx!`Wm1bAP_ z!a}HTA9pQD`4IRRA6Z^u84$|Guy@zyxkLVnUx~{n-~o3>`V>vmHaT3#e_=*2DLjdq zM^;urDp=FD$1*Hr8+C1XV7obh#n}d5Hc|hEiTW!hbGltn^&ompI+XzB!7(>l!$py$ z(vP-COYa3ZHSpS31^^fgxDD5PJT@! zL3wx*5?wImg^vtd+WiE1!kngT5|^+zFeoxlgGZkf1vISRgCH2M*j|6pklRd z&mv!G%;6x44u#k2Gt+Y;!{bA>iLtqn>B-^A;n~57+W6?;+{AEgc5r-dbh17?ICd=O z(^o~hh?|f!f3KDJDt$ZJzC11w9!xxM5{=H&d%|Ps5cBk50>x`L2xQr^oOdotV%g+* zIdkJ4dWA$-EQl)<4X)MPaFmQF>~S-Qxxh|{G6F~${5G~*yP{kCaH+_zVIceLcEgcW zgoK3X@lFTfQ$y&CK7Jl0Bv|i>z|nYuAR70slK-!#y=nRh8utdsbInQwtTfsTz~_r3 zKJA)ny1zsQ9@<-Y(|G?w$~!#LF~zzj_7hU&@!R_IE};@6l;^^@6UcmAYJ*#t61h?J zl(xp|IdOm*KE$2e!i2-NuyYAQn4V3Yk-2Yod*|VIdlhrm9m2``5Qe=g%EfJj1L-oV z4|JUzcnQqcKpDPBWTH=LqafgOkb7m$A`e=afbg6Y)lH7>Mqyfm>ec=Pi=h#r!;}bR z>BY$r2Xvw@_H-~e)RT9BfaJj;NgOb~0tn%Yf9rkUxjI}Z0HzV57O6QYAs8SNr;Y{65{t!t(9tgiCWV92J(uxEL(>w zYIAwkFyDVa6APs6yS@T~41k3aqr|$foG=!6(?sa~{F%&57>V^Qo+PUa z-7-Z`YEhrHe4<0j;kr44HD;C>J4+r8mRG2SG*BVCWl0O-x88VVexRM9zHw5P7{Z_s zRndzeUQ`eQ`C%%hOjIfEkH?QKECHg~lHzV1V9kO2I8*&v5*q zTEJG}2R_OH0i2)MAx0NVP=eizSjV(iD*KS@n%iax_Q;4rj>-NggTFsp>UXiU%{C;f z!s|j8fmeYFmayJ-5Dc>(3+*s5<$97_3bwtNj>M3)-&w8t zEVjfB4NnIBdv}b8wxOr;kmMVvfGtNp^|nQ`+>DmV>+TsHhTNGSy;;^N8)S$x;(}~0 z4Pzpt24bXXYlj5WSEQXBH;&sYMRQfon!w8y75bp|i&!vN$WR6X zU|}~sB|PsI4Vx7$)|l}F0?6Pz0@Ig-SePb?n=Y`(2OLc#ol%HNC~@v-y+xC5G1stQ z^|Fv-kZ>gWNf+q-;{6muge->E1bul};#OkcJE0s|zzilo*)_JPMdTMtgafvSb5ANuLFEpbG~W)jN$4{5 z!W}{iZLPRq2g;d%tdm@wc-XNeH5HU*IVE!;j!YVEPYM*N(HRsns`gYg^$ zRzB1(5;@51xraafp%OW9nq%Pqd5)aJN@^xrdDzL{F{yI(Hh=4$C_Oa%h?Jz32Le>` z2apR|3$ql0vmIqZB&@lg+Ml@~-QaDI>xFyGWDUUx?||NriUa-&PxRU3AQB^<#Q&H zm-GJNz~lg;I}w)cBFe#z2%fk(9p~vt+604!zhlEMR{@#TI-Oupduz}Xw#Yr5c&c1> z=x#PExE5e-MmgHN8y=%+gcL*0Vw0`Uo-a$$^4R-_tiMaxlnpW3Mp~C|e|e~qT^`n# zyFAh#i45T}xw;@p%aPt+-6qGntKf0?o4G`i3d>FR9fwp$m#4h4K4pf2sWbN*0+_o0 z81YiFOm~7x#=c;9vJ%ATv6s|>M2)JIU=Ycm*hecF`Rf~2wycR1s>0Bct=F5}%FaaV zoe`x06*B!7U`8F5nFulUeMkCG%YInE7ERD9dE8h**z_?dfxhJ)|5;egh*b+#P!DQ{ zva6V(H5ARNd%>g&aV)IEZ|ykzt&ti>-~5QKJR9FW*_DG;ZC_Z93u|9mJ1_EM_J!nr z(j{i?LaEJys~mAinuf#(PT0<)NO!k{;(DXUSr8U0sz8_}-SY5^B3>=`$gi;9aL;w@ zx#sl}J@jiT(@q;ouS>BwH+8yi6Umre-;aSYMcDd9vzXtEnt$e{FM$OiLAxbOjFiDvBD?!hc-*5$=)?`tH z4IL>P%o{gVb?EoPgH?_vF_qPA(xN=D0zl|}U=dDwB}gQw^9!t(KsQsrlurqqcDc=D zV`ToKKb5fe{FoeP>@(LzV%T663Jn>?-Z4)}x-kGXk|~C`P#X$nhh`qmVMMl&_0W5dIvH}K8!or6VI;t?MV5w|@}_!<5c7cZoKo_(aP`HJC=HGvl}a61 zD$i^^H%IFtHHiSsLAMUccI_F`9wrHGRfr>Ook+PSeAP(QYz`u)4~1KfV{-o7D5zCL ze2JEG*8X5L!2^~;eoA4uboF>$P?|W9YjOCJu_)gG+T*QPBk)>T$Dz@Y2)qWTUUleL z++eSRTi;w<*|H`Uk;{@r(A?sK*hZzrQNkMKUC(;yR8(;bRyt|14~Zp_dtiDuBVMex zFq=sHQ3o{?cR_^X8)hK4L&t}>EJl@%60+!1sYN_I_}B5NAZfP$LUSbhN;}&hmBOu9 zmZ`)yyTp2C@s=~9&fIkpPkA}Pe-X&Hwb1Wqce`W%+ebzNiU$ifXa9^^0VRE zX8%9>Obp=I;%{}4@BXNq@-OIx!)o0ib(-dPdjnE0*4vkOs^(k)2#7%H%(Dat(?1tS zXUn&xc55Un*mdI8@2cgvkE2QVakvle<8a^H$1lQQk^8jyc~Y;uo(@ZH62-)nSeE6H z&y8_2jHLwIu(|Nr%fkaldT?W99-NGA6LDwgyT+T!C#%B1P17Am0bZLZ8;;tZ#C?bs zHM>^)@(^VE^b{N=O(!~mh)l;x^$^9Ws?SHOY?_(Mkk%328hVZ7uNBPVlvk4Z8(S-m z--|GPof7PxJx1#SxJX2m{J5v^Q2U}UqT|r6aR_&WOY1<0;&~B8hKD$*y|{7r=TrppUtQxdl=_z|DjsqnGX=c?6I!$R}J41^xf$NXl4B=yT5=CJ6)h zgJETUZIV+Gn>2t?8}P_OMaHX+1dJBeQ~*7onNfZ)^Dxc z7?7qUHygeXrBv`VMtO&gX)7tc(ODIbxJ9n5t*`6BM3jlSk4iCjtWAT3Qk7mu)%9ko z)@#ucr^jMRzP3XNcx8@mku#JZB3B-!rri>sBGv`+kdR)(2W`{Q_|yQu9U)PYVIhl2 z&E<}aN~zXP0`5-=wtOjMMmm;@ER``jp?rp{ZH)8c1X~EVT+z@9NbC6iK?wi*Dx^Nc_M$2mSZrka9Pqk0QYp9TnsiHrYA2ikRit zakTUN`ac5V^>X}IB%D}rmLRzuNCj1bB3-V^aJ4j$wsapsgN~=VVX#S0(80;`ur4zM zOq}T3$55lGzX!BO455fZN3I6KxCd0V01XT5kny=U5bS2ie6QeYL#Vkk6#?EpBzU}n zb;bLByf{)3fs%eC(<=7>_TLWpP&hO|#zgT+%$#(4LiytV;#Xy=?_(qW;Z?OOkzZ<+ z^BPsZ2I*M%;a^*SrOOuW-80%ek$c&kxM=o7dGA&0-n~^{`Rzu&l#suin&8=r3F}Z< zy9zcJU&5w23Zz*d85>McGJRm(@kk4!C^9r*1Y1B%1hc)sSKwyW%?dRJjW-ArCyFsA z@^1a%o0#;R(|pxywhN}r%F|d00vaePl0-mAYls+T^?Cx6p$(%FK>_7E`}Zw?C|^!n zC%>shuGX4dBu9uyME#@iw2PwucCOwXshCE4biB2g>;>KH!>YYDa87(-h9LPsi_2;` zyn5x5)DlzU);uUcEA3+?3(ev2e%0YdV6IXh3q_<9lHY#y_R0-@$M4mr-??^?v>wXd ztt)yYh-A@XEA;L_{+L{9QEb)qSyQHzJv!xESaPO7=e3HYd7}NOJ0G95mAB3O+x9KW z`BL0BH#*XmkOF7f16&`@pvteC_3+t0-}_AupMIFbQ zx{`r(RtsyOv6Vzq2v|T+P>8Oytl8BJ>KZbFP_3ZPj;ZS8*>4#NDPXNnO)hcY`<%F# zBw$)6wS~(0s{%*Knd@RN3Y?5B!y#^A88LnM5PV=|z0vBgq2W{pp^H-4#oIUWFY^l@ zF7OKFszCM2OSAmLp}|4pc$sgxEBoToP4!-SI_-XAXODy_?d)Y|Vf|!{`a-?7Tpz$$ zcue?N6PaqQSnLU=^EVNb<-A!Ao_(1w7LW6Ysen&=ExZpff7xOE$(SBDPzApdyhpOV z_aybDgyAnrx+D?f&_oJCG2sxR04KFAnf=jJsw`5=OlGo!f-R%x2G5P)J{ePg9UM3f zOUmq>*pkx5$XilTAXJ=qDDxpw8~6sOIDH+WS@9b#$3c&{Noot8%kD27^p7x7|3bcF zPPH7Hw4I{hkmxBWi1KDL`wo+ zUZYwhlwEq180aYi__xB7_(+bSzd{4Q)eH?;W5X8SWp$QRjJJF1+hp^8fl z+d~g-8(q2FNpPU@02Vme<1#HF^P)@ZC_~f~)Bpi94L z%-3sj{HCEG`=%)s(kjq36G zOBxkN)^k?EravLCVCdXmo%^ffvJhteY?0TNnDb-HYW=#GLH;uAug84QZR3Cumks?V zViP)!Nl)YZUoUM-Uu=sw82fKqoG@Y?911Lh*>TN|$#nK$Ykm}KLvjji&2XP>jY}^& z8TRI}iJ#VhlW0T~xf8&@f*}G~l4G+fJvw?sA~_io_|jni#TxAXL@q9O1RcQxQv>2~ z)lxB}bYlYIT*MWuoRCS@CU~rev3Q`#J}Ha)nK-FF5}?mP7#Nq;DM2F_mS#Ta6^{G^ zRBcd;FLl??ODbwnvVp3_;78PpzKEzDBA^dXsFCE~!Ru#@C^bi<4+5nPf)QZl8U5;# z2sp?Z4ownn5z0jtwSPuSOapNb0o}vVSSDz2RVs2a=|W0dx~9`Ea@Zi$G(bGIc@8R< z+U-3l^ZfYEuTzjsv}>()wnU0vWTZOW`NUn%dK$&QN&3RpFI(*{o9J;Xc#Mcjq+b`H zkSHbJ!ZKcdTU_QSKO4_YVl!+DO`R0fXjbFI2^z^Y?!I7vhxAbDs!* zjeA$3V#cn^oXlA`>YI~^y?qD=O10N>swaQea#mz&4Y2;PYRQrRGMf1B9!;=1py`uz zGNv@w~0msUOfgUu3 zCdcERB~ok=xe!~F)c7BLd^$-gnx#Mm;cMM+uHW-fHon@oh31$EYT+g?sidtg}* zfMumlK2tt_UzRhqH{MNk7(!N^6lvqiHJQ8Cq|l33->qanz54dg;3Wv5$B@e<;-xlk z2OBXV1A=8Y_HCtK$I3(t4n_&R()1z}T?U)ox4RlE>uEJMENjgSs|ZYWHAbQ0M(O?1lkmsYd&Z$5o4D>t9R2_Gh-0ot;~1d@xXP^SdpNXvJxpC}VLe#pcV2$ZDTu z-(evh-SXTtdTa+Rw4Q@l%3_LAfHjZwq%cKCDQ=@KFnY;tjB*>lAGPtn2d%Lin->ur zinW9*C+J(14Xwd3L^O`3koar~-R8oy|LnQXo9y5-%=T)eiwb!ona>rW9qc_CCn%?6 z5hDknuR1S&Ri-F9=GI|jeHe)56?rvg)sL^=BvJDfUGYLg_xj}2)NH*rJ~UIC zo}QVQovPPIhHHbhiNU$r$mr0_+~`bgYIbVkSUf@2uYp4zqZ!IF#(2)rZPWs1LJLh<+d;Ank%W^8PFczk$xs9qnO9G;k~O$<$q&P~n^&drRC4o*#v zj~$N^FxOy|7YrVKumo!vOXwV=OzWPUSnrFBl8^}Xnvy-ifS)j_vTCEQC&S`aEdL+r z6_1W!+}}Hdz#ZD=aDT24nQXF~2D)F|3yoz@GKjXf0qDeK0Q;#-s+4d67YoZn1kPCG zXpbee;s3M1-U|N9>VQ}l$|+-CGkz&;*u<&wSw95yU!18fBXQ9%a^?!u!fBwLTKr-4 zYETi6^bD?p$2wDZ{)k^{IssvWN(Uy$sY9HH1IRM!j_p2dC#)6g-;9mZAvVU<)MCeh zeCX$LEL@Bp&nl*JNiYfr_`(XHE41k%_2W#si7Wz&$TvIpdOlS_9{c0_CmS z6gqBrYX^y~>6L@+a(QZ-6b_{(leO}F-GT#CbWDgnQEHEOHS`rS2n`hX<;ZIinz_u z=tpo1-5LjwSEJk{HH=nFQ zG}Yv`G(TulLc;)_sK2I2(vy2HZ^G8Ot;~wH>Y|D3mOl1`j+~CXdc$T|Y>MPQ3T~qw zmqDj${dIWuJ*LD!+J~@otCsx$sw><=knM;N}$5+rC?yB5&<2z z=)nQwdWs2uLm$!W@Vh_q6h}Sr`26PI?V;W&ahL7U(az-Mz|!D(@QHQl9+2a7p#2H3 zckCGD6rO-7gGj_NltjYsX(gaHm2u-q!!YBalUTZqzKT&maL!jZv_g4W*lC+VMf#ItCC8P}s?p zw?z2E>e8Qm`@L7MUdgU4-O7drA;;W_N#{Gehc`q-x=frJ+{KxjqpwR8$#CGru}2XH zx?zy|wq2+xqTXY68VmI8r`$4&%A#)-gTlKt&!r6=M2CaxBV!X&!}YO|(fZ8H%-s0Y z-1Ok^)Wqn_WNormAFPiJkIqg^503p%At25Hh5DFp1lmJnDL;qB>Z>uAW=-$2J!89$ zKxdD44ouYatY{L;PxfxsjscCMMGcdqrtshS+i1*i>#+1K2{oa2D42u^{R~;3=RZg* z`WU1$=8(GDI&=M?z;+O8{xmYcS= zDWJt^DfVP5&;y+JeNLH06$ZLC3ce`6_*I#7=eU&aj3hmQ7J?E~QhB=<|E(vo$m4Jb z1VWo`U}6Y;ON0NG_YQ*fPhgom!$Xk!gVUKn2MuU@BHs>m+c3qef4E&pVOLsMP1uki z;A$?3(K(>fu!L+336X`R|4J02MXWju>D%H6WRSUWu8{Ha~q288_xi?OD{N7#DjmC$iqcu1?H8L?XH8wLiQ6Czu537F; zj*RMT@yO8J%<$Co(A?O>{V2mUC z%guxF3pT(fjFx)zOXTFP8LkTC6R!@Sme|H`M`rl&GX{%$T2`ctY<^Fpr481;h%?4{^AJej7TOwGF zk-aIxYx86jO=~9)xP!%ZVfySA)T#vxEWb{#a3>)`>;$HW4sh0%v(0999Vu$0=UP^y zV2J4tP>$Ao_aH+d;D`kvU$4YA9{XwLB@EfhQ}<2^)Y*OK@y3E+8%#W*GYZlSh@PjK zPISV`0@rC}UU;~g)=ZAuTPolYB`oeETq9kdLp~qcvB{J1ZiW_Mhi-<6m418-XwlKo z8A|!4>zi}yaV`y(Mpj4c^iI&X7Q?R?FM|qtbjbTK^WgftWCaFsSgCw)BGFsIg0@oN z;NeR5iBAog^s|ljwk%=5sCRTvPaYp}93fH%scOL7otxvq#lPh{W;XaXckJ6r`#o5p zZL$s`Vu1;PE;9z9_LinE9dCvf zo4NElHdUK&qG_gmn0kWDqHgcAfzH4lMli&Mb1_Li{)r>CjWCRl9!jt;>~JHpYH(CJ)d^7!Y?SG6B>TXy4E4Pv z(2)b1DAr|T-PF2@1l%go0V%DnU*hsgZKb|YUtZSjBL_sWM+$-30Lvx;GqOiwwRNAa z8!xK^8XuKrN3OAIYK=&3&kE-vcG+Y>f;c>ss1yUBgv1)}#0msOe<^z=W~Mq5wgP>q<9F}44?xtevD_vM zC@Fl>*?SokxdxFI`fjR4yl)ddLml+?)A!)lL9n>fySvQmeb^C#5*FUhu`W7Fip-dk zvRlG`GA46N+DEM4mwW*=Q-3Nk8AiCnb?)29_yHUo0>WoDQgl*pcxgi^a|Q#GMhU!< z@AxLZt$Q}Z?0PM9n&~&5>?=VD3csf@E&;*(#@}#aMH_` zxqyS`6&V2#?KLUr}T@@J{@ch;vNiN{O5h zgue?*+;--JT0FdM3EQ=#s+IAU@;; zxmKL%c9)|9TC;0cv#fGzTr$JNQ&v-p_gEaw-*mBS`sQYS#ifd|3fAryT2L|-%|;7p z5HEp>HQqYxi|jn}ru5)Y-Kp5e?UJ0pBiG;A5={p@zqQHPF+P~r>ymp0hTB^3;G%p7 zPQWuOLM?bC^faRzejvgmO}dG3YIT=y$5n7@mbGiF_*-?KXw({Kt?(hP7t<4@L~#z( z5AF3m_TX4TK0EtNm?tGlJOh(l=%(oi5$>LKP=o5sCX%ycVqm*$;m3`smEO>FV=cas zjhqV$!bu~*B?7dgrQAtK9FzD$I$EaV1z&@Ig=+xU9Ozg;37o(u4&;3>qyccpQvtvU zFXR2g<_PI7VsQl^k|kK@!G5KTSQB8QUGmyKMasSS*g+fQmaOz9Zh zX(&`pHH_Vq_YkixkVK|XB+4+dDrC{rO+0?KWdkYI*EmYE22sDm3rN)8Ks3|`XY8ZKdq3My?sj11C;lc6giILH%+SJ(8WYRmO}$+UfYA#ZbP65pH*3-z-ThBKQtUd5~h01y@f<4~=bJ@H?+i zt|y(7v#-5+^%|7jsQ(T`YO>tAIPok9Ro$AuRbQB2tjoHqykZi^!sY10Sp4b~DWm%cJZd?j{rCu4mdL+*kjY zdp|*lyd%6*1mHGt1L*@gso;XIm1*TZQq8^;mL#-58KmXB6`N?u;|UnXz^p^$ysdPh zc^}R{Rwc0F_r@)9C!I?X!PB}2;4VeY&RRs8o+!g;a$^sw@3ysH%<%UsX46SFskaL{ za2?j%jdbFG7lI*svY8RS#T4G5_X>Px2UnpuBRN|~C7NzAOS&(`0Zl0T`;1!K5NpTE z06S3>O+T~KbCa?VwTY|lQcj1xL~4S$w?h{vI9LIfG0CJ?CVb@v`Rs7L-o6)*^<(}1 zpAHufL7AZmRBS4SO8T}6S9LA1#BjEe?|L9X`-J<4`PJ3V7gTz|B5HhkB)>LRi?40g4Eo5qrT9t;6h&B= zq6_*gmkvlX8C^tFP}CcJWErfQ?C5GBhT)l+&6K@#g|y&IX?kocjIb$mCK zZo+^PO$*EO^vt!eL_5h_ad} zih8V3+VeuYeG9g}0rz7cx3O(KFONBf3^9E;l%2giG!Qhe8$CB@q)*$Zx(xWXv+A5f zi1MK_k)D{U-eUUfEQK81L&2HD#R$OQfeQM7D4!k3wD>#2YF@Q7t4rggh=WS!1EHN| z4);*&5UrLbfjh-FY~?B*2iasvTS+!DSH`TFbg`7GGE{v>R;(!pH1;zexFL& zCEtAz9r9#GHAKjx4eG!02m-FX;g~GtKIue&vjofK8G1;JJ@Dt^h$@l9iO}z;*V%hV z&%1~sQ93JG3FFocQGJ(j$(nX@ykaL#Y~6F@FoXPv1}A+5Q8?={PqvLHfr(i{q@WzH z+H%56I&V5_Oc+{4pSC}z@i)&=9mnsA8&;=IjiVFNmCR%DPzelH#L43Nv`lEs7|P|M z%&QLhHeu6mGpa0X#sF$r;kR3Ek|p*c$#Szw4)^SY<$@O%dpUz@_ad$R5Q}cCD0Vs( zNTpnR#CAfmbVdMyL!~})J(j;C&hQz1Mz*w~m0k?U+CL(vU~zyl$F*zs%NM5+zw(6< z#IMrj(c@+1(USsP7nzL~J8)X?hG4iY3!Km|K)vx0U3Y`%aJi_P4aymOpe9@uQHHq%162-F z=TmVi6a1n}LX^KuIs|HY8t;3raHLtYp~0#6l${-!{ObY7sgdDV_x19|?WRb&`RlDp+8Z4B_MdD_EYK-XTz_g`j2G zkTnX)3q#2IMQ|!hEndSB*;df-)>}q@&c?d<3_zc3mR0DuRhYD{_|1EHF~L=dEnVT? zpg0l%V(BJ|`Z85aMDhcWcob00+Tg25*03R1`+%dw7yDrozOwu=5D;_OW3nw!llG5i zQ4@kwcJ&ASz|poI76B0n-lLx!Ev$05^*Cc^6-7S;BvWpOmVSISlB&3KXxZ@FXv6Yx z)XSD7?=dfVRUEuIQfHQ9wGs6@kqW$W^xs&K{4zTMS*z=p+p+x)HgLbhr-F-C-1ZAj zsD!aki#lPT^trw}k=2PahgK$x7RU{ET~)@+2+|kf&%Re&20^<}+6g_g4O{*cbd40n zH{@vGmD1=t3MIxgDf*LMh^Iqfyb^^^mmP`nRslwG7o`e@2%CURHpy!QoBC-%CC82q zh~T5ddQ9VNfW360*NgcbbF zNYi%7bhP3Mer$@n4aq1^0J`SnoGH$YIKo|@UuB9q6C<*t$lS!_#L%qS%MKN6phsqqR4$_3>$)qHQI+Jq956kY+;qd>9f$jufg9O&;r= z3lJ~QxnC&C0{E1AS|2Cs&l z8UYqQ#nZ3ja9E2a6nNv*nv@v!Obf;0`JFuzi;G_hB1z1DMW@;=%I}Lg2AU)v84+5q z%%F?Raw3f$%aj+k7h~`WoR`}nqB~P%+n{hK=xutw05y`jF5$deOftUaN{azmFP+^O zL)Tzzwc@)tQvS?%xOUFLVjSetFeSyUbP5hmAe{u9v)L; z>d2@f2^S*$8(h?ks?S^~!@Q`jB+m?RF4`zxUu<`TSg(IJC@%Byp z%lyKJ3;d9bj;UW>n&lr34GtQTn)#MHITx31s>kldPQ3lf3 z;vvC88Vo0r1&LCmI=YzVDzk>=7A;WLsIxHx?+0E~MYxZtyLwU5cqkq4nj$twhP)(~JS&+DKi4fbPJh!p#7c zlVz+NXtub=hhd1C6ROw}*-^|;HVwq<@K|8^`p{M-LI^iHBveQZ7Fo6eKIBqaF7+ zV28nUHe(9prX3fkomfxxkkrNRS;JJx(7TLkp9euz?&yb<^@eoMYox!gVu}^B5{1>S zW#)}ZWWp-#Ff|OUK(Fr5_mEDEV3r=INLvm7xG)Rsb|;8>Qn6ZwN8)VB-N$X?VS`0g z&^yAZwZKYv?ze^&@S*D;i4ppxu+%&v0copHw$SCuumiI!X?Rr9+)Yma&D{$=J;z@7 zCN6$SEPPnj=7fPG57*M!tM!Gs>deyON^O3zKAT-z`k=nJJb?RN#8qCQ8-pUd5dlS( z0Tu#^q8=bQ5@*-a8$u2ZotEiiVLya%+eCjA<$ii!{{rnv!S%|L)}|M5ZURv&TfzYu zcKm%H{Rt|D5tSYKM=WdPhG|=wnsma!&)iDU!jC}#;A*pFWD33v>f=Zn}xQ_88>#Kwl$4&pv87!)wM#G1kv)S4nT!!qGuT+)GVR#PkJ)yB+?`IY+2iuyUNqHj!?+8cnq$*!m)tkY{{{+1&RZu79wLPUhj zOfX%M={k+-K^S%Dr?-ClBavXD+3fX!m1P@{Xx{w9MGHY7s6wDcVil3cP zb|BX6Ho5&g$voU#sSE8T4|HpisA?%P~34?lfs zu`U8WQO+UOFN63-n;NAQC0p(Yg)(nHT+J`^`q$bESWSY5XES?uNS7Y|GPb#m3K^B@ zxHxw?3NA44@Ami=Hr>{-O|@u#MM-OSzlbq zURT~wy-{14S3f^{@txNPJUc)Xc#yBfPOG2bl2^0yxyb?|{D&=ESLLzd4P=WuS(!5u z*asy`qAw-w-K>U-@4c>v{j*D2amk~~mo-bOI5rO?&D>f}U~6Gj&`yK+_@6#d%SW6ezq34udSP+H`rRWg(9z;~Xi=9fS!h9&I)$`6ax zgfvnbyr2eS(P;+l0pqawt~1sWKTWb%GOjYPWxr|553rr(enX(Ar=2`Kkn_>mG*_jD zDSU!3a)?2^%;#;mTpxOcPJfS{{m8OD;uE58=k>v{skzb7>4}-K+F)&BXrw+hTN@sn z8y+8k8)^jwvH-Uxu;(apK2K~A4mbNgK69n(M^j*o4apb?#VS0a&F2WU9&-{ zT$}IDvBDptPTl1A;(Nufva>U_mHPWjjl0#Q#f7`tRa+iF_yintvBS2Kg-lV1n_`!s z@KN6)kewis7}xV3AT`${(UQ?oNOAk9;%2OJk|D5MfJYf)i!K|GTOhbGS?qD)$-t?N zRDE@8Yy2X6`>V;ada6m;zKUXd2$!gsl?_5Qa*nH!S7jr?V=A?JoE}x2fG7H%z^M9H zL*W-DwLQ4jX}rkIjk3!_+1c;@So{Xg)f`o07(V)LPi>#e!|;LMc~KdEK%Z8ZN8lrm z;p*G4oRLYw*N|H2O;DrR=d-OKjz6nDVgIa{phiU^i*Ea_oE243)D;U`eS(bzLqV~` z)tQa#Nuf4Nk=s5`l70X+G5zrEe4m51KM^brLh6_+=$dp#BGQMJ@o%6s2bn{5BI-P$ zvf_PRHPe?yJn?c7=nN2VkW~shZuxs9*31GJ0>}t9H;|lPQ`~RGi{!?yxVIS#Zo{%x zqWE3ApP#^|sF4?M2yMYF%~iYb4qan zz54dg^wz!p)@9quhqhOT`!HZ)6TnTZC$SZ{^1yq7UVI0Nm4qB4Ql((Q*wS_9jDchp zDiCQ<$RAk@iw5fesf%Dbkp$_yvF`DdNm&HD>S7vItbK=l)T~;bUtjPPd2hin?Ay8W ztymOI4D}&4HWJL}d+6;V`pOkYie1M8GSeqS-ASEH|8r<~aDd%4(zk1x)R56vitI^=w*kVnI=WX`<( z9>%0L32iAQIc;x2m10kco1l`xCjFDnXUK1|$)DEuQnyQpwIXYZt(0uQ;-L@5Y6c>t zEG`??R)D2>f*1sk71CZW-#+m zh?gGXr~^@0|I{&<_RMXrwUx0+E2t=smdGlVD+9tUcym&$Ftv{Q5vzPl9$V8{w1L48 zaV1vfcZ7gOwBwnf;ufJ`EKVvWTw9_}zkmu5pk{(nH?a-5d*&vkZA_J;mIFZ?n~aLJ z_Oa$#@wRM1K^p5>1uDV%dv>9bHzyhwNG=Jn+PmrFR0zQU>hOU}#rC^sL#z2OtdC(^ z93KE5SmbuGAZXVcka@h4Qd5dpNFyN-M<8r9LbxNp+F%@O&alAYYhg5nns5gUHl}(9 zVe2Nu5Iv&+lk}M!Y&+5{xzjg=z} z4yC~};<2Dw-B?rpgNaCq<#Z9!<3) z^gXKLkZxAxgB^=I^$l+}gII~%JM-E%hbrB9&lSUvh$Fs07w_>zkWI~ue8iT0#1MmH z#02&_Y;C*!5 zaYLk^p#$@bQsgpe{xL`CoRo~6t1yBG$e7S~KLQ4zhV2L@?HPVVQ|*CnEpxiYe$ub8 z7r!dwfesCd%-M%S)qslKq+0uEv$5_q`+AYCepiJCU;D!_42$S6x(8=P;}vRV1**DL zKa4$=9N@p(8wPQ6|I&M$%5h7!jwt!^UD-|<&4x}OKe?Zmm|!Z1ik>Ncd8nu`3$91{ zh8?eLzyzBV0@!2hY(hBo^A0uc8*qvrAgp16LHrqg{n5g7i?ZVXh3T!%jl{f$fgoDr zU!9c4N!&>g9YjJBl}t$Kw}a|zZZ;*sZ8uQ3D1$)CEbuqTSnVR0BhmldbZaqvmE3`l zFmQh)(7v**#t0se-b;GHxuF)uzdACACigHN5+Po!D(fI3$OP}|)hm}O&WkjtIEJ?X zLv`-i*vYL9H^Ak*A~=L+wY1J>#V{_9>4MBhAbb6wY5C@8Pmr{B5%MzirAJ8(NW}ayYI5w zAL!`I!YSy&=}Q)LS<)?fzL7#`!@?q%YzK|)d3}TcYZ5e2ocxX7t!*beJ6oTtFD}>r zeD90-MfJyQ{npBj0T1YFTThNflv<<_*fy_HT71*o#c0w%^@D(AQC=Tb}ato^X=ZmdRK%AvIpt;QVi5 zl`0c#qRi8D4kRLN4UUv)ZszE{XuCo^yCv`{8Xpw96;?Nr`8LBPvv|MlWF->w&2XNY z&Uw31Q%2D&Q^> z8xJcDZ1lb_LVN3zIAR)hUuJwid%$n8mG}J((>)J-qqt{5%qAvNwNxa*(`E{;!*DwL z$+fpG54ckpuGBToQTQ50Q1}Q>zr#mF#9PuIj$7iD=>_@^QOu_o9J_O^Hod^rUFvu5 zsh_Xhy`?Nn?e@x&w#s*`9)kM)Wo5n959hSCdS^-f4!BPXHToA6nZhqGE-l=?xkx|J zzjuDHxb%}B*A{2Zzup!9LJ5Y!;XyWna_nz5=4bU^-&g-tSH$rRtJ8so*xS#~JJ(#n zn>5VL^a)aL@Q_v-x9jFx{Gl2A^Gf5W(@1JV+_~`c8UFc9eQ~AU=)vCqRpd3FwoEth>Z~hN(cy1Fc zzbfs&h&%$YVjH;yXu%{%Vf58ouKjg^3^-H{DBPeZ4NFeQE-Od>EDDQ+&7W;nCMafT z4fv@g0F)2toCl_BD{gwD=d61*0=W%&+A80ZcW)mtaXv+6a?9d+_E5s!xNfUnatuYL zowJpAMGViiANwhKMNvF09ZpuV@F0|Jf@RR}B>XA3Y`NKb>a1B7!N*e}KcuA@KIO)x zWc(-0xP$;+Y=tGzAsV3U8qyAyH>luy}hTiyk#fy66EVW40|FJ~EmBYbi@Ol^QQiMtrPCt6S}2Hd!Vf zWWj@BzQsFN0QLe;{lM*{5hnVWn0sX~8@N5Cw}fZJtieCTiooc!9AN~GNl0O$f9@_&6@{Wk6?AQ_SJUHYGx+t#UI z&wfJJhi<_95|@OIy&UNih0`1)5E0*kr_!Dp(LFX%B+~u@RhVqkAL_|LzrJ|&s(0og zwXwi*$vu&MxOOE(fD8jAENyTz72NUfDHC5p9ovqlZe>Ifs63Dk@6`J{X+dVmK06h5 z;*b>gu4+yt`1>fHUPOt00a_ZxoR1*JnNnddWb7jI z$L@J-z_yqs@`dTza(#UCc4L8U$G_aJH}3M6Zq;-<0G}-;uX+fEB-gzH(sSSOI=uyb zTVqbM-~C8^De`o&sbT6G=|*QiuYFiso@vbATDidEo~^CaE)2Xh1~1kajQm9#gG6-w zQ?u+qVX zH;6{PTHfu$bLHwkC{Oq&`j4M2!QU_5y>+AB2sb#Bv3liLzx~czmF#tt&V8d%yIH@p z)c9c8VZ=QQs!c7sm7630!&MD1*l561GIi_NLXg@ZI9g4#2NK;Ts|hnB0`c5X zp9(G+rN{cXKvk}LFSq!M-Qr`XW{XGjr_Pck1Ui%z+TgGhh!r}=@jF2`0OLW8voP_3 z?G{WYl!BDOj5H{mPcLGtg4w{)(AJDy)%WCy5|TLdt-x5*d2I6>!d`Bs=if}@ ze}S9n@@ubN2@ZgY@hweU=4mIe$YiYVE1rX8Z7msRGjcl#e)LIOz^9u{Gkk91FK_{~ zZ$ijOn!|GaN^Rvv=<7r@oML9)D9#H5?*SaRjJFUJ?T7-ijN?V^4Hd4eJH=(*RbMXr z7rXE$Pu0Q)e;A6OA@iGEu3f8NXH7hVHAD?;6z4jKNQ+v`{XVK0X5ans&-eaq`9^(V z;m`NJs4vgdZq-Q*IsIJ^uVVp^RdV~=+W&D}Gwv9Ww)yz9!9IPtBVO!|m^xKE!aoXp zDmLkR#M{t|&5rPcJZb{Z1taef+n*8(S2L+r6Na#FE9*biBgn(BxpnZ>^}JG<{?# zUzb}=;5}BU=y8o3;)DRbdP4PBUn9xb70^pu2o=693LUMt^&c)rM0<;f*0pXY zP?(0-@=ndDFjP+5fTruhaO(rTR5q0rK<167PAR_YfA+gSzWvT?ufLQ1_@AK55{_Ny znCVyyYb0XN+<6Es4f$sAV9}q|BUIPC!jUa*Ny$szmRy*oiJ-i>37c&{`PL$N*Y1^Z zC(BC4rks+okryDE*kgUz2r9LAFOYaF3b+svST*_`q3(qLgvh6)&?hC-=P!sNt_l;W z>WZn0ClTvtUa)ExR9%JCJlV3)hq z;6^t+r2FlQ+)-JH7R%w_-CzP*1k%J_jO}HuF`89UkhjvovZP1fbi0FcC-2O`JmPr!)@T=vV==oD2J<_o@E5h zI#Tr6d;fIx(tH2(rZM#>{Lj73KQT^s$0@OmoIkSbVwiTxK{O9TR=Q*;>Wn`RN_>r9 zB#Ui#VluO)AdL4;XU*XP=(#v)A@AwtSdE;vIw3#*!L;@#?8&Cx)Vdnb*?};5fFVX$ zZ;<;UtveCfVp}aB;&v<-((dimTMZS@Wv_pvA8}bXYQJ1teE)Xs{d#ux>aEu=>%0zo zk;MT%LBhwWSh8i_ZGUan z2}H=vf?HW(Tcj@Hm7O3ktd!Hb(yLZ)51I0Jl_N~R0*aby6Kz`q0-T*>#1Y%m0SPDf z`w_v+g;l_zzC>_ihPd7_pZ-I(Mq$A=Ms| z?o4k(>eAWbc0*uBOn*&H;u+{=CkAc@^=yif{@h1GiWG=Ssn42*RdY*?`uzKgZ%=D( z$IG4gVt3*xufK7&57F#+YoP|G=u1$(o0H92Td4NntjkEDJl!>5=>;uA^hvh?jV7H& zXEJ>yb5>Bt08TB6RlHSed@#FoXVDR}xPJ9=CHwJ@FD}j2%R<{Y%=>cxJpcarODwr@ zDi$D{KuLmKlc#bshBj473>Ab}zM2dlUlGpLM#diwTK%1I>y{s_Fu7vT4e& zQJ6Ka+>FR2pS&~=FVsAouA;4o@7yF|*{5hIB9aV|1JERmd)-LgAAnmP!%J;`Ex(fe ztaekQ!?nfP?6vuZGDS;`yV)iEV&~LkWM_Z+v)4c%gP&XfJ19$w6{U4k_SJPAr@rgU z@~~sxd#AfREWNK%`$exvu1(>_5=K&{>+-E8hnifE)kfzy&_sW^Twie7{nV6YNqr8d zNT`gQ$Fd3m4>oQn(GBz(S5hBGMp0-DBSaY$462l8<;%LY;+ zH*?JyqMW0GG=!Km?IJG-6u=#m5&T4ejlTX5c`QLk*sE`8;ac2Am)?qKr@UO-FL-UA z8b(MbC@W_PMi;P7q-FvwW@70!OmOj{-_OeJ=(_V zxj=*7-28XyuPqsT{hiy3wL7)D>WA;wKRRhUsFy0DNU_FLNwLP%pi`_dTGc_51~&BR zUX{K=RsX++V%BX#RP08h-+2{DKgU$iF{- zoTbmP-Fu{A?k5+q}?NLl3DgVe_}#-GjR3h{k+z z&RM9=;v8qJ%0fvonHw*CYkld^(lz-XDI=m=_%_gIWZRN;(_OI*5(8UC+=g|nNr4Go z2e*j!d#w1~T&xSQP7p796an*2^8xNtN=9fx(JZ&1sKn;%-Lg0;(ZOVjEx>q`(QDjw zuNiN>73BlE-K_H9iBVGIo@fwF^=tQZ*2gU*-2}Mj9%MvXHqwada=TKCAYHD-gCV{U zo?9i8Mz8b8u`f;+$tE(5KrM6+wjPkFR$)V!;Ku#-%ZiJhe}4YX%ZiKd=_J0axad=S zFnWqAE<`6g$B4>e%~IbP4t0=PX8w2TB(i5l#Xps($pf6Pc|u)lok*$=kw~jg1cZf% zok|QJeXbQ$T#L=&O$E8|dW?FGw98ueEyK5hqFLLiECjrg6=-v7WHn zpf?Wm@mNK0a}|K2O*jg+(Yr^+)~fyl@Y75O^uWsIf_dUyhD8kJ0Jx}}g9yH=6Tz9^ z29h(aZ1MKOLf3gYqkJPGC5VqVV6Q(&9~$d`18kw#0-dTmNra$VAi(J{ADgjLseN6B zf=zMA5kk4HL_gpjG`fT--JoN~{aQWPzh^+C(^ePszvt@ILol*#*aSYog z*dfNs^yVf1lO|zL6dA|&ZnArXE<@7lK~2V&+-AGBGcyz2jY@MyS4Va(eLE~i*5Vtb z9hVM?F0koVNpB)d(jPPqz^GMIx`LpkhtP4E8qgasSC)8{_Lb!kHBYkaL8B=CCJ>Ve zv^4Bv(U&=;cM}wHV`oi}cS(X(c|>d~EU`>UV>vi|NJF5_7WUBEs@OF zDFVk*6k0-!nmV0BSk(2mE>}@65l0+jJobPUB9l@&|+ph6#k(jez>1|(@`Nzr~{Eh3~9pO+132Oj0 zxH>L$u*>~kt}}9qWFls?8&}u9>Gn&8=ZiKurv{Sr1978m%x87D=L<)vCGZ1skvZEI zxP|G@K=PylJuhv~>bVZO)o?|hofX|Se4ye7{v z0dIZ`{iCNGR|{j1l6DQHT*{Dzj?j#8Fa;xf8o^4S*6tZNUi&ZxO%-PDF>5aQ;LoduPevmcb^))WdP7R;&PqK#lqWC*!x;oe1e(%+* zSD*o@Z7h^sY1BVdt5*N@;*EN3CA)f~USIKN#EkAl&Ckej%+JNf((-b4b$+FuU7cyn z-&)Znnx}b|Mvr5bUVHnk?8mj``s`oce2pE)d}*xU^^aVv;51Lt_;F0qd-dt;YJKK* zL(k5&`Z6q~H*e3+)-Pli7v|MmRj;al@UKqCOidieOhNhh>x(l>v$)%qv^hT=^D+5i z=R+ByD{8^a-OZ}JMway&0o~-QwZ-|B`TtRaJ$8A1x>0M~Jsq<&^uEmh#9}lzD%*ws5dQS&;0yNl(v2Zf?w-{Vp(qT)l4Jrk_rgz1{~f2tIPs#Ejk?yc9QOL3^R)%uNqsu4 zUf{G0z1V4abx}(?FDx~1K9=UPXkebbdwXG#|25z9&iSDx>qUnhjoRY->d;=U%`5x! zYWB1Go$U2SP0yN+$#Ev<;jI71cP?kjIH)hGxy-IL>Wh57DRXfX#8Oy4yPL@jBW4JS z&!>JjS{6gPUMWbmnQb%36gQ2Ha+{B8?OYWRFSI3V2{S<~lj?p1bituGZ@Voi#Oz!TgO+p#y~RHPs`75Ykl<37gdI&y35hH> zX%RJ3qYJus0zoF8I;L{U&n+nh3wz?695>l(De-W_4diZD93Gq7?va#g9N|;Edp!UC zk|o^p&(FVP3BP0sp9*r3IxS8SOSrULBvNJ+=frvT+bN2`^2xNs)dBnBUUc{_N9p=P?epldoXd(obxb!~zp*(wJ47ZS>hnS83*$9QF%)#{<+%_xY6o|hi~o0N zF7l3Po45Voj9Zax6x+OCZMqK{ zNleHb(Ybh*$kb;X6B-fE3Yok14Py9H=f0Lf!h&^JEU5b{5k_#5-0V&?zAy6-BLy=I zv?aX8-cka153%XNF^f9C2}=;A$}6|@_uxH>0y&{x6Pbi$Wst}Sktd2rFFbMES0~7f zCHWkhx3m})#FO%YJbR76z8dYf0OmHiJ7aq22PkP}z3C0S2d535K|OiP{vraI@Bq^7 zoFV^p4;Ird&bw`u8W8xo3IXp--6SRFgOm)5Sle-T{!m;iS^MaJd`q^s+PA8hEGE1r zdhL6Z^TA3VX#`+(BPmlNBcL~XzuYzB zm|(#g7voKalMf!+$M6dGpa`^?iL_t*ZFny_hk2u_q+LBr*ku~w2f`-wls}=A-!4gd z9L75dVgeA$t@Tz|&$y73yZzIfyjbXFPudP0aj(a2wkdHu+KHKSe zS;goCdHLr-}$H>wi`5RQC`2ZHey(=(l&+`_FmMhejkD0 zCUMtU;xrBOg6!wf+5R?VSiBS@I1hnFQOi1NAg>w+jC11xwrFBJRDhj9hvwjDPhK91 zMw*du5p-i$1vj`&<7^VHl%ArL(2Lh7EGN>M5n>hS0e)Dn&5l%6+Yv$|;-^V@=0MOB zQQgiXJ2Ar<>1PA7L-2@L#7PZMBp71uY2V$!PH(~!r;K#E84kmzh~W^ewPAfTmP~76 zhGx}nj&;78)DelHEJyQ}M0rkDcoJTW)UiwrI3;Rh7--6+Nj0M)H;z(TQ*yAWjmSE3 z_brH6l2FOL)8i1#;b)AWQg<{mMXk;k@gM}TDh-`C(aJi)OD2@ zw)ZT7gHH~YiKD*J5u{b)%#_U~dX&uw^kzgT_vY~mVvQb6Xvkd&Fak>FQknf=QQ~OT} zBtZ*pir@wyE6y)oEL(0_V&qEiPWS1=oxYqtRjyP)Bq4z$2v+F{fLHL7>@~+_&N1hj zYXP7D8q0;MR4hTbtTorXjPZ?ce4mMIVw@mGs9Vpkk5IP}>Xw$MZaPH(SU{)0s9W5I zOnX?>GDPgM;kMO{bZs01mRJck$kd2!oM&!>)gP~psHemnIyAO4oX!ENhNTw$u3-zH z(w)~#rwF0wu@%g^Y!h11`KGn1Bu)5}tbUr!!g8Z6hH>MABG zeu(|vNu(w21R_%kwxYt702q#u6lOxMR|HW;_#${Pja|{*N?ksx!X5^bO=jUkA_IJ_Fre@J{V@8W~ zf@oS(+LDY9F|LJW6kflyo?;S~Z-`x93&tKk+N>0^kHU)_$K(eOMM|r>Hts#gesqh4 z;7Cu|i;9$tP7HOzvaL{5&hGLy(HkPWI*`700iZp>WQe+{z2gY`kbwYjA+O*Z0#>cm zWNBPw0$A&ZB<&@9F-#q*Dol!wO{WTQ;dkNGHgx+q)miO|MEu3re$bd|7ggFYZL9-M z*wj_Cp#$CD&B$VsG`!+K_eBeIpULw1r2gP4r47=dIQ;FP_4|&$Jp{12zkf`vemF5< z8-Q~fBGGTuBt*KV|DIZCm=}w(C-(3q*xF=_8x8YybYc7}xD~8`GmQrV>;HI4l`mjqOYbeR>L!h&Ij~r@3N^;$IQ`INzf+T**{})ARa79-dM|9 z+m9;Bsi&}xh9rYG$m-{K_1T=I^LV}gs9e~}m&?KJ;wOc*;T^5Sb<`P#@aqvU_+1Zo za}bKuvh0$;s#>F=F~*~^V)`){JF|u^`MLw=z1|ry5aY|GF#moCo>uoCl=8VsIj9t2 znk;Q^Zx+^IAUGghhit86PO>Mg?S7+}y^@ z#9DrJacyyaa&2y5J~zF#o?FjNE-ubZtWD1kVlMt_I?-8z@cWqJQIBi!imMY%1UZc@ z3ZhvOMXD#<9Et;h*Npm86k5`KY~ozLR9lg&X_TW^P*_M$~zQb4T`noib+4Q>YB-ljN*#Ibh7XhBKbtz=N?ZlzKx ztW|>hrQB9|yBHqiI`JR-`O5v3@l0@|7*3Zh@eg;4VaoTpvNgUt9#{%_v4)INW6r~? z^B+~}`o@(~NBk2rkd`BSAU*X^T|wexK7mR{mOs*5A-^7oEU#EPj-PG~m~y1O+ zlk@ZW`RU1tiP^cejm6yh)YSCiWNtpUIzPLSpPHDOS)Z8C4afm)T4|2|DSTQyAJ1D= zLj6(dpvoR{dsu`c`jif3jg~Mhj4O*!|4gK~9boLaL@>UbPWn6|=*D#*`oB$&P*g9u zgX(Iu=M-!-h*lQ8a`mr=x;gz^x4<6>jRn4?Q7k)(Wk<2>Pd1iKk@i|#OPi)C#z&%Y z3_yy~JX>V9oBK%wVqlFh70+c&Y#6@fiQe`-T|K^S-xn1L-l5WMrdN)HZ}2(lcX(qY zXk1_g`iSN;=%fjzi1{^y&a9p#x-^BgsfZUs*OqAcAP)~}i6uh0$HBu?j9#?&-XoaL z)7xuonM~H8eyS#8(O60TDm@P|eBo=J0S@E-?5%ud?Lqc$#@V2PXgkK47tzqjQdo`oZ??M{gFw zbg5iWwVwBaT&0p*d+;!Peb|ENH1{J^NYXS0Mpm^NGTP`r;I$%nW33V)INEVr^&Dr}F| zcc0gHYTB{=pb&TXAFr5!pt~5+sKK=P~-?nhL(;ZkPKCKXNx^k_05xBZ~F<|xc*tk1dsdrBG;n%zyCnN zL(K#F1&)k^5`hXR_*L?}DDfUKq}BXx8n9to!|w`oC9)!?CL|X^iLRZaZXP_@6Sdi8 zIs8@6HH)rH1H!tdLC(+q`9S_WnL-UiomI^%z1+jo$X|m$^<-J(@MGO(O>HFmN_3YR z3N#!I)1SStU~wT;;0((7oRGO%YbZ^}#yG;p4!HK*{SN84iq|diR0Fx;txMg9bF2|R z<1SU*ETBeU7n3=V?TK!O;1^c4F!}fc+_WeFh2H?@=RhJsXNxMxKG3tUSaay~=0DFz z0A0_oj{v$6K$n)FF-0qW!>)nP#SsEIrEx#Q_Ujy1*cT?Ae&T*k1)SLx1? z(xk~2@kX@fbQl|~gmLIfp_0cW`!$64CrQf!85@ZTZ7#%u(1kV^6>x&xm{>QJ^J6V( zAtEH{;agQ94|+(zKSr;!90QrS!gffgeODJ4?dq{ZwC9Yx4} zaO>EeMnlCI5U^Jo-d|Fo)@wM+PTC}ZjV>nk1&rNTxp!;mcmrwfoSaURLLDtzsuaB7 zQhe;;6g_@Kp#tU^SiPD&B*s3}S@6b52&X0MS(yTUyl(?2JZkoms#B>0kd}9h2jOUL zUw&?L^)>`mrICS2@nsBl`w@pg(LC;cUoTs4t!3OOgd6$u$)Of z%i*_;XZRQR+N2|bu}A7E>il`7vVCW3^K*zhtDN%t&UV{qi13ADAn#c2CFY*@?Nu&2 zAP|J~R^e16T*=;mTN}RMGVLoeJqmGzp+gV?TY6p3cP|))u@Cms1EN&N2#)(N>)!gV zwY>4fk)}X16N__bN*_i>*MinxKmy$j3r&XcEC~eIYxpi>0@)Yw8KKL8_KTRjL2946B*8Rc2=++F6vMX2 z-w~moV(`t6&`$~~>U@4;W->QDpUdUe=jInCb8C|uGYhM;xw*Od#p#KS#fi1`jmd$u z@BM08DYX5Qv;Wqk?&{U4%+{ zx|J#Xv+h|EJ1wJ%+5=T=gaS*D+*;Eh)|s(l@^mk2aKYKYrDlVT-c=RsE%x6 z`@J611NbMb#~Y<$xg0LRJEg)Wg{|OTzFd4%TFVD34{{}?Cp32B&b^iKFuPw`Tg$^c z6$h|X+zkJ;w7FS)tUvqqjFUEqxCmXeC1`P_I2Z+G9LMr4al8d!AV}hLY!%JERb?E9 zmzhD>vT3oV948EqSGZtiAj)1R?$=jvb!Y+;w7$bAE=DRifm{~;au;L#Uhp^JFo(Ap z@3+Hyq_(aV)C=Vm_TY4$O{GTCV7= zSmScH`h0OQ25>>#q)=DqWU@TBX(xH3T_e4omQeu5u4?#QtYf=s9EH*@YMI`vitB3> zq~@UYFWC9q0FX>c)a=8q*c&UrC3_-;R7M}|{fyh;@-@CK@=Su_>fh(rD%o;rE!@Di zid%U&2ZGgHIiC$5x_&W2I&+@6{tdnNYO~KbZKIJxyKhz1gWwcE4?6E*U@n`y^4jd7 zghs3INRQD13?Ai^_H%^^UJF>lF?tN01h=PS2Hb8|7jAgSf z{IQ33htFy)-_y7M^MJ0Kp2>q;`2h=Kk*uoeY0w25CMg_QN1(q6cvObC{K1u;!XT!M z?|6Q_{r=Y!jD=&Va@Nnc6?f{+HV7%c7i<;FTZN5{w`ZgP)-=^`2h8+zTl#2Va+_w? z2&GBkIedKL7()!vVK&S#wPw`zBtk|wCw*v~18*Ns+I9KgJ5=>jC1Hapzi z4?BMdCy?rzy1rH}i#cL3uUmpg?wKetCq@K?4iC9VCYM_e-rp>)eadOv`y&oepSQ!5 zRb`#FD1T8zR2D_pLWCg*im{S$Y!;H+q0Ti8;co!UAyuEEss|D)60^~W%Yof(1#1^M z7du$3L{eUNYz1Fa_1o|7T^&{MYRmWqt{TzGZ`9Of&AYmvig9*o(!Z9ObZRBrIG)jKR9m&Kmd*zG|TfBKMkk0&TfZ)&W>Gtgq2d*593ME;TzD zsebzVJfmP>G-cfnHcGjNDvryAxlXxKES0+qVi?BI3pOSLi7fVh_>b1engZT)Op8jZ zq(c9tx`nS=+Et|{=LT@aE8O zuQuAHF2767r)QVy1{d{iDW=|tQ;ccS=mWa14&(^C1@b6j(V?7T)bZ({{bbmtV`skB za8JjD^h`%T8Uh71H94TlW5MZkWZ<5v-gM;a^!Eup*=UQ=B51_)0fVr}^#_%Qo8uAG zxkGtDWxQF;ce8i4^IQ2+mRHekE1^-D*{^F4s!To!{(=>(3Y*epwgX>3tQ{O$66XisK?&V zt#0L3S5@*K-UFPU;lA@|OZmX0ZzE9ui6?Hdb(EjDY1vF%o6R~A0aTo`HXRY8ldP}E zJ0MQyY|wfcy{y1@S>D>SX9SZj^70hU?<8`@5i>(CK=46reLs zlaZzFr*pYyQGfzFdzYe4;ddE3N!bW3JGWGQ*mNVp9?cFiLeGd&YlwTS zVSp7Q2Z8V0-4Jv0|MJoEzr=H%2PPm zA}hFP+eA|iw-42JIhZog z(9wWqT%!_%ikIC=Wn1^mi<8fa8k>v^S?4fC(8dBh-h>$sU9S3=YOn<`ap&$KB0r`Z z_RuCNzWrVVe|k>HuL}SF?HO|Ev*p}IezQJaPYTbrz?&%zjQwNR@CrF+00bbFeR4@8iDDEgjbY(28(WEDDE{hMdrThws^k zw2=8gaf9v`Ag25iS=8d0YwxC3k>6Ev+V0;nX=v+C)~RVn+fjzQvKi3{Tn~$<#h9d+aKKjKzJco-_!E4P}p|`B0>vXRSO-O zcK4W`=WJ{J+~ z#xrsqU3L?kSGDSS4;$A?eoawdl&MSj-@mcovaU-VoK{77wo!jC2qU zKiJS=(z%tk>bi(SYj8Le*wkQ5QymV6Xnqq4cd$kK?73>(N(VL4Xc<~HBU;R2^(DBm zs4+j0Js!-WwpTxvh`NRS-Ht-9vW|LeM&qk07<$Ak#(_!qVNh zt)ZdlEc;|1;Bepm#mb$J?rN7aso4YZew~6a;K4?qp1N~9 zw$PyHweEZrcxIySSrmrk5Y@UQln{0WTz|c?vOIK9WV$J_vngU|TSkDQW}umvVOm3k zE}<=z@y&Ut!#Kp(NH>Ku|4gQ8V0AX32tRK)DP3FbX`1P1-K1~bq=!o01;>u)^|54yjrtUm{zKKqM?^I3SYIw~GOhe66jiK$7ZQ8qy2POO?%XWMA6Zqlu|Lf^%(ISf}8ox!e{x?=fOw$%Hv|`)A4a> z=p+Utpq_ZEEr1%CjIt~7_jV~AwxwVs^Tv0`N2`54)=xqcL>E7RG_*(tKDKgiSyAl% zk?-6T2wlyEOpLIDd+B~(Ar!NZ0y)S?3L(NGhu$!9us4yOXcc>+IoaV3jA(s1aur8IL04pKxS6pQ6aPYxcDjw6^!0 zJ#+X+T6Fu5Zrilewh!N%!uSThV4N#l<&IHRuB=KC> zNk%B+$B-Wtra?y|xFJfGGJ+!+Z@cmtK#q05VLn<}y1SeSZiRd6gG{jUpt$zw zV7gkQ?xAylNq4<}K1F?78P=(kkfAC%(TfT4 zVa)1b)RsS^jibLCM{20l{*#m{)!2Nd2zTsZXgU;{0UyIUm}7!$>(+1Kz>xjo<}y3uDxbtu7`)FS~?8)3*qd z%L6k><$-Bo)U7~lCBCPgYIY!Y+^xTuU$`>l{ttRq#k3{+ZT!@lYg`j8Gw*f0;;lyy z@ehT~&o(vqO9L7Hoj&+{TcIFZp9Up(fTiX2$*I}@;qH|s z`$_SK{zq3k=Sseky@4%2zxmD2i{(l-2>)@T@Y`TLU&$3V%kDtviyE$Bnd|Sc-1&HE zqSq z(nhiLFdf4)Ju!&6bo0)K!Hv!0>S`YBhA%yTJYmALD+?|EEs?J}BNzss&17@ig=`o< zFxy914s{z*O!jcP|7s>!y1NXdn{OjO=smFgVUXb55+y|u)9YCmEXqy~Brf_V^OF&L z>dFG8zqI!iPll^IE%rqQ@K@xz4F);5IY;`fBUga*JI!ajLHq%`M&FZB%HTvJt&;42kQ|VA|~17o?i{GQqDu)P<;@sqy~1+v6aWK^3tR zG?1-A_jD(sNV32PfSQbVoREfFg!cu!`&e$2U1M~NG2~Ok6312OAa`$iqrg}p?vfxb zo$+&MU~AZg=H3IE8Bv-Xs}FfB)iUx4Msx-a#SBv)NHAtN%QMG89yahk%~EA* z5vPXb<)oV}VJ1N$*=VgS5>AiJhTyoz$#LPDkN3r~U6p-#Y35RtGo?X^s*dN>oxPG_ z+x39S|J;Rh>hu_h*h}>D$Bz=RKGk<(KRv5pQoi&C?ni%ahaL(U$hDs(igPCm+O*O5 zXkUnkoWi0%hGL+}+SP9N6xz?4l(NJ2=dgtE3X~+tQ|LN#wHLg?p(vOLFXO~IGFR>N z`CpLu=w+U%&0>N_YQYqN6Einxdkr+d>J{8FJ+P`tUTYcYCti)!L5_Nb0W^W05L@H-a#n%6ZuBb@>_wu>T?DE}A_{Uqt(&Jod zJ-?p)8}-*;hL1SAd~>vZ`@4QqLsE1}+^XeJ22UO(YZo{^fW_AA(2o+g)Jb>|Sdj|e zA9Ioptv-#BnBpEl--oT!6VCH-&DM+AZ)_!PTq{u-n)Bgn4oNfdPA!J?5bwC76=u{c zwLB6-rHFr#u+dRR*BeOKzogbFe5YWdtGbxT4x+_1lpcj&ZFro4bgk%16U-W!<6{E1 zC>oUKVg$K>>x<8$%%7XJY8z8oSAnd3kj1K< zf=X0gqxR73gGyyP8+{}Ls%}iF;<$5FLG-F{=Z{|1mDM-cfm0SY$i+KcKB{@~0BPh> zpBp75s;*y_rfEC33AtS~YO2TG{ACm+(Zs#Vj#WYV;iFGJ*$kgsCVZ*9UEC_?gYx!f zp;Cd@(9kLXgB6EOr8{~CWzz}c@c9pKO=D40Cht;I1K(-A}^ixa}kKu81Ru^+~ zS5e^oE0mKwZK2Ar7@tZ@`rbw~c3T%#8ss@+HHz+VYe(dD9R8!0$Of zSq+KcBr@D--wzl|qPAAK$EvcHe4#S4y2eqptLN88)vi&sD=iW4REnxyhYGL=NcHdn zkq36S@VBKoHKABAg#u3-PC=b!07#mk){Oh9R`2ruZ0ls)wLL-vTnL(ei9XnNbRBmd zbffZYIa^mVNrWu6B{Sk)@XOr>3ji2Lq5~j~seigYdF{6m16YvKvde>>N+a}?ZRAVY z54P5d>kwWf)FW@_w?3&nFmV)g6e{k27Y*zS>NLPy*_*@)nXrdcpP_ayJ#C>3%0QKR9Gk$mY$Z`%78KuxhOnfb+bB zl@VZe`5iMgrA3Yndx$^BJ(Dv&tKc3m!Xa4)T^z!6uj)TEds-Tl(ywqz&$mQvP{A^1_M=79-$j#} znu~wYbg?8HW`fOf0d*cU+p4OPzX+vTF}nUt;jJT>E&Ue`gwz+GHdSf`=T-q(jx-iW zDn<%!+zZC6$B{f(Mtk>ibfy?(N%^*ma%gI%=gsSPC>u#ds#PT}vzx(F#n?xRa>DtW5G;g2<^~jAH3gCH zavPQpxo>%WfyX4YAKpBgb$VDh;~7~V_=+$KJ8QmR7uIkJYE0a5WRXm}a9*WvJ4`O` z%_f%j=B)DGbQWq_|7&wVg}P~OBD|`S8~t2hSqIgbz@e((FKMy0YFuSja#IS9+tKA< ziV&cF&LsIa#44;KCDrs=qQ9G5!a&r*D&I?_vO8^et~M$x>DTR-xYgmLJ`86t%NC+f zu2qwH)qc)(7zi~$>di7q&%%ZHTR>DpCq|xLs4gToEc=f0 zSXGVmP3PovVJ$2c6+zXQI0su5l1=VPa;R0Nl}i-z3{LHJ~6?D=QM>qG$y4qF@tr$DXsUh zk5^X4hb>4uK&cALGA z)yX0Wyn#Ps7YP(#+n|1 zLLVQy729F%Pu82ZK&LQaGYl%zfkQGNSS*2pYO*Y)FV5FO6`pcPSIUf|Wz*kflNz2> z7c;U;ZBG$$)HSlDj}>M}0d-0^D7MI`oVgV`lf(65T6YP!hN5Uhi4<@MDKw+t3Xpfn zitBvgoPIUdZZT-VisBsTJ4xTFNQTnplc2O2p~!3*Qw&Ccd1Oq1FHTNO>T!E_5%hrw z>fifd<-W0BxFX^F%MD865SeF2R56CX;_5aNg^EM17X= zCw|PeV(F8F$I;t$Cyrvh&jT{kXW{;(?c(NU@zP__8R-3y*7nTgAl7zx)|sV!KVJqm z{m&j1*7NV_RX{Hf-)i>`)6`WD6aQ6*4c*xFc#h{8SJPYmTcRe$tknCS&B`K282@Ck zArv}D!$7Uu)4V5Bh}j_AUG-@-*RVZT-g+%WW=@T8$i% z>E!$glU3kezHU`xjUGJpF<+XTvF_e3c8LzC=a5!BF{2hMp6*+ziS*VPNpGE1%KTpU zK&8_k4u@RHwac&Mo=V)aN}B%<{)@txNnTW!EB(r}Ya-gv(P@B+v-bVDt_)Ep!zU!m zd@9xFN@Bm$}k}2l=O7uxAzF(A$i+6@8F;jrUC^RZv*LzQzsIVpVPMA?2P~+j%%RnIERPv(7!V# zWod9k6lmgIiY-Hdraq5&lz?eO2Ly6vBC4bMx`m`Jk*U0rx+mVwHaZ5qZMzWHDSd2X z%dC65!fQK+LeIYbM4jn9$8bqZl!9g~9jgpo3H%+w-I+w50c2g`YMeBu?o;IOoeYDCH2+g9!X|RcOe?mE7oBBkUp;8|TH5nAbFbm6 zaW^m^Jl4^ip|8s?=PpW*gd-fH;n%Z0cT7GM&lIgC*m8NRq`i^)lr~23RHipfohtx{<@SMv1COMNYMdTwEb4Ve6~z0 z;T7aja)Fo(mAK*YtD@E+A_@@=5o6Sc};dTe%_Bf#itH0=@j z!yynd_V7DYsQv_I735#sS)dXIOacDq^4;--b!3qYWuu-9*HJ$ob@%>@vk3GEm zVeXT{TCnQYH4F_9n&}Mr`JR!^)si)+8l1jY5rI60|#&^1Q>Y%K4jTTCquw1fTG)AinTV25KWc3D4lI(%_Z zn#r=WsS*{8K(t4O+3EnDxYJ6NpEK^JavD$xTQ2?!0VSUc22(0Sra5xn1~eelytEEEd-XmTabPNvi+E*9nuG zKo+bz;dEAq12iYCI^lrofzv_jzwBSNVjj=^52o&SS%#S?iYM_54J@JcQ4X98L<>Pj zYK$3g>6;i4ocXi?!7q!Kk#?^Xu0i zk4k%^(q1|uv^2>#$^?h@Jhd@vvVw7|aY^s+t~cI&lXv4oD$`Z%LZI5;h2Iuj(g6w3 z?IR|Q2s0Avv667AJKE}Ok1mcH(T>hsFQHJ)Bz*-u97~p!JRV4z8w#43dBr&{j#I!WP&Ud()j5-F>be;)1E0MHdZ1Fu~F5PTQ5oLSonzgI|ei zU{#l4#mGTI87cYOQLD58umWE>x};a_h{@9ffZ#+Fvk-_xl><$~{I8NOo^~gI-kHDZ zeGHwW0ecLGcso~l5L8OJ&+?^mZd2KWEN6myx0cnHtgPI-HCovHUDzor`b52f-8M8* z`7wt`%}ep6Z6aDxsf{}(h(ZE_Hjz5nDjv&2HI8B2fKIk1f+eqjv#blg`#?!NY#9|} zwLi7VL3$`qjo%fvgYsr!djx58327`OLK=$}q%o6)O}WZ!*Q)KNQ`azQp7(#x}2tnLA0;S?x|>EfVA(<_eqR8G_5)%tf>7ze4#6 z{V(3+h`inBrsn2s`%D$D7*-CFbRhdz>qQ9~q&zKUAF6G*B(}>m9=QWg?EZ+j0 zjY^{har?pRScP8T%%9SPwbn!x^)|o@ZU@vYnkrq7SYi@L(B7e@Lzw;HvfE>xH@id< zo730uTk|sW(>KqPli$UpeqofXYy`z(-$ie|S8;TQaJ zd$X8ZzbZ+`J`PErweUXpZSLWA`03(C@Tjb`+?atFY!pjDuC!XHlyardgAFxkrEp=S zWSIJ_h4;a4w>NWJ=oehv@Bxnf_!Td(+K(^(Vdq~5_0=Cj*VFrPT~GbF`ah*^#5YRC zhr!2%PYc`m^+K+TMdLZ(W)ox)XA@-+7scWC*<3a%8?7y@4!S)JdlE&Q3tGRA|4Hw0 z<3Gf^mPDK#$f-UQl86Z->G4JT5=FngEf_>^!{qD&$Q64O)xJjgK&^Gx64v0{Gp#8X zb`v%J5)8`;yJ)i8S)`Zq&=In+`Z^WneIQ)fTxMN{?@Ij=))KTZ$0=VnX2mt%<$6$c zA&8FPPgUf-O$Z#lgNT3+npL0l$s)~jkj>Ba_Z)Ne4TF!CmBRJiU}0h+I~PgZ2BM=J zk%d7s(zZ0+Lva`>7*jQ`Ys}-68b)h|Z6Kk&h#y81C0EEloLEQ!ev$H1GtC*A#)`hG z`}7q!yKB}jNHjv#x&Hsw@9ENa6h#42L)OPKZh|^*DEmOU$gq zDe+%y64)S8R-D&HRDjfW<3mSud_1;`pFPXo560ep-}*NIN6}5^Shskg&ZgSjzM$QK z(wJl44j7Iz^zHtK$KfRY&_iBM_=sL}(~O>5@Xy$H(0F^M@U1GKM7UVOJH!KsKvE^MP8E7sg4YXMDJd|1Xa9*R51G8jr(u|0^AnYgc|{nRlLIMpW` z9aRQAdB)$3cj6N>BYa81Cm?UT9}fIW6=-|OQa*3Gv4FjAD~2^r{mD$h0_}1kkJ0gu&UNVSsTzg#&RP zZeye`)%P7JJwzVFwPS2KlpcpAu0bfY&T!9FGGJw220K7L5N{f__Se#0*xj>4Ec^od z?0D@F^6)Ljw9vE%)L|9jDgFUPxJDpZs&7)#*+i$FD!h(s>m(i{!!J2TV2y6W2LWM@ z)#gp4{1Qn40!O?0dTl^WieI{ys%c$q zOAC(isKAwoAq@}e^sUnCNqnf;L?49NMGIe=%EoEjXYHVCKw#2T(0b|reJAL|BK3i%P(MH!rDqI^c>~fqoq-NNIQ(4-#m}MrU$^bUB87P3 zRMbq5p@4BjZ)!hBCcWY1p5uF?VzqUw7&E&aXTyQ+)(_~ohwuZgupSONZn|0ZeyOM9JYr zaC_2U2Y^&jkBm69^Z|Mfg<4T3BIvdKEWF4+Q9mP9jCSoh$L*<%SFA6glb*}3&XmI> zGWo+^-v-vR z^Zg}by#4P0yvU-t>ZN%X-plT@H98U=T6X2W3diE5?_*RD==t?gL10u6NJ|EvDjysB zbZ$rFa^%r!RhFxi$p<wf zyqr`XQx+qTuZw7q`V+*X4_gJ2V;(#`F)v-S%>Qcj`@2?`!2pF|(a ze9ODp7?>#B|> zet#$ad|D=cd&i!Pzz!hl9@6&4!U zFQ04vU5Bq3P1OEQ)P=N6)NaCk+p+49NLm4OLL7rIwo@%@K)nwFmDZWHPbP`OLEoVc zt6sIyk`?_)kT*&+6qX3J5}rU7%W2jliB6XGMiafy6MZo)6J637F$#&e&UrRsmp)TB z`C}8~d<&bNn;H7pH{Ha=scVxHX_;~M*2+H4FFDy1o$69#N;OTBcG{`#MScbS@-=Lj z#ySUX)hPWhxy>B0I-fH;Xoqb$45YvF5iQT%G}O*MF(HLL*+4s#J$sSR(YomKx=2qw zFt&d@fnMvi#q5!}??nkMmO7HvV0kg1qPg>$+KxQ+YpvsJ<2`z_McvQNAcz5W@;>nP zk6CTNpru0`rl)?==r zaRVZUPb)6)E9y9p?bY}4*E@68h*Boaw-{D@p&5FrnQOhHO zE{?Ras8nVco0Uw?*;nr^*|xmpXNVjv!d{d;h`9o_o+wdt-b%Zad%D)Jjun;@O$&i zHxmbox4*XAMA%7$bG}(4DcgbbI=5^*Qrgm4m3;>WsdbZYt88eHFat zzv{9cWm&8tZP~4Jc`OXF;KWl;Ae_H&4mRo3i)f6P5UM&kmq!qc@Cd9zog@bqV?wS_$iOdEg^d5_Au z4ZeO5Ib_RBu^BpTOl_~^66_nG^-rV;>ki+Yn?BcPh36J)wF{qjm5R9!W+1|bJ@o|z zW8Dl-pVgjorL_lz&+_ZRT5W(BxkU1Z$RdM3zCa`*+ zCvzGaEiyr2Yi;w93d-N>_ge0==JwnF4rYAJ@$T=n-#0itfE)DqK>v6*I5U6-Cl8sr zhuPZqMLIXz_j~lpjf`5KMy*ey)~8YHlV^V)R@AmF1%QQ62oxVke#|cbrd@=CwNidP z9K%9xGbmRcZEPq@kuk_Ac2TnofsdZW!IV#Ouv&Ul$!9l;rL}zcrAbm@nv^8=usHik~6$*6f+rC~T6t&M#@WP{U z@(%J8`b!a1dqt`lU$UU4S7-$^=MbrPL3u(u&;8OB26wCxtq*xo4s1`<6>x%}&H%C} zC#0a^u?qo(9grna_3sXTB+&|_RNllRFyg;Lf+|8rvV)v5sM_Fr!?8FZS&W)P*cP_c2eCW;6 zlPq70l!Qo_uY=Slv}ze?c;ds?Na?QG;!cn^7|&Yje74|lG+eiI`RY#9Y&7%xJM+`i zTNo=Jfd8!R6IEgh8a$3^8e6$L!SG%fh z+do{7GoB8=SH$J&j>gG;2@9*wur7V7rlv>n-A*d)dlhNU0E<9$zrt8Zm=JW5S$2F5 z!d3DL`pTh)%InSt&na4aL)Ion=K&H2b*Z}`>{DZ46T>aB@*+}c zK&WDilZKq{P3YM9t4X@Zpb8pvG$+;8kFc{GVK3PJLb+$4O-cKJd0RfZdADA!!U(ZcV=jNxTC-ZabtCQ<9a~qTMvs04` zxyb=BzGs5g|8Ci4oG03hGx-UEF1CvR4g&@JKg~sTbWoIj8qq{XDuN@Nh%zn>6<47$ zxPrz`skSgyE^btUO7YYDRv9f!UEtIGz=K?A{c*08=MTY%E0~smOGxZ2VR66bb41b| z-s&@FO}1X`9caxyCjT(f=6cdowm%)tKkJ72K%g6b zf#t-(hf}!EV=~wOF#*0(w6rx6ogOi-M$D^$X9FYV)fMG|GwESoK{@;@qe|z>Of#53 zelGzs5j;hprka_#(FDP9<^Y(C+V9lTfFu$x1D}m4GO5i`6XK{+nEcBQk!8)d+wPF!b+px{< zbdw`yQbY?nl;I43UWh9r{~b%86dm|@h#%fs3Pj5@TI52owXd7MWqUsrhln;nSk+ho z`1F;}gY8nWsQC2b)Y(Y7hOhC;bW6M_F6f#U$1?QQ2yS_>^3hc9?^I6@4~UHRNH|>f zMX;%{DVe-*Bk!*hpxQ*(TkY!_9F`omHwae)K&)o;u178bWdV>lUxmb?5ee)G2o~}i zrtI?uS++#G(-c5QQ9&<6qy<$C?hV7l}2JtmB@qo#Aj6>8S^A_0}Yi<1E5@k-~~H*tZ;w~grapz}6 z6?b)NZEj<6YJPq)pPR_d&acm`O-!tBOm3{rPt46v&a5p?FD&NP2UNwK?Mk=nvT?W< ztsg|;7N)XO?XsQTAm#+jeuH2z;@tW`fW(%s>ji~Os(-> zES86R`om2`+ITi&@E@1g`NheJ$r-+0{i*mR+}&NNdd;Kl ztPSQ3`$f0D6=9E7aYJe*&NQ|Vw_xS5`*-f&9Uu0ayYr}$EpB90!AlvlLx_gKT$A91 z+PEj-zpCxRJ7G{B-il(?4q`#{dSg6in4TP}u#YM7^pJB%{4bz&V805GtF(IG{U!E= zhZQ(>zm(f5hXYnnG=|@Ul9% zRa2H)&T4dwZZhsZ%83f=PS~$V`K9Q90sd1$qbH1Zq%Y;}GOyrFl!WynV_CC=xA4oA z_e~>aH4}Vv>xO<>G1tW{=VH~xw1J*dP4bjv(siyPWCo9AL7Pn@)nDGgqX6l=tB6M~ zc}~PA-{!o^tDtcZ>a(t5df)J50COf5E!hcT?o+znaJnN3w}qFiVVH>5@CWQ7QH1GhUvG2LtaEt}mqQ&t zk1!mflTp;QOKLxKQ-%|LkC9zaxig)WEO7^yeL3cTFm_|*?!AwGHqJw%0CN;aP-FL6 z(i>`qyv$t;z9PYBP4#t6rG}O1T~o$KJT@New5s5^1vKA2P^Kng4~a3Khfl@>=|@jo zP#Ote`T`{ouuR_l89wJ-ZuIG)-;Xv;ZxT)SP{kk6{bPfs;b_o;A?V%7NT0T8SA7||2#dx0iDtS zIUddU{?7RHFe=Z;pX|gg{U$S{ERhZ15~xU|v&6-?B{`^T{y<}7U*1UD0Gv`vn!-4r z!lkJLV%X+wx|zVUDUvfwQdjYHFC_;rwpO1B{Vn*4I!q5KWM|HhvvMHwJw)=#SC}jl zz7Zx8ib$bCa+^q@f)zp1ZPnhM@l^MJz{|WCErq@=h17_kIpGC2Oo98eVPRYl`l18v zI~Q|N9a!w^lZVVl9|x4GBYs-|yZ ztN+BZ(G}nPy8JhrjlL+@=u^4;Vs2t8zc4YC%gs-%O;1kGu1@DC)~BXsCRe9(Q#1Lg z#r({G*ywXX>sx;u+}rl*8Lp&@y*%&y&qi?AhYWSH8TRti)P8KXU7qQ+P7zZ09+fNr z=qY1(lK)ePb~I*c_+ln@Vf8u>NWlhg*KqW#f>R8LuVF6nrwC!~f*jo&c5|76v9=$T zA7tZXthHyVI+qQ3&v!%N@BTaFMopi1t)Z$K--13+Rj-0!_9x(%xlbWJozx8r9Tt$0 zO+`2cWK*BR=%3Qyp7Z=x4AHM>s||j2XZdbM2x(|b2tF3VNAdfF1tF%_-Ie64^=U=4L27%FppCVNC@m@g4m)6<!UEF3VR+PnkoV=_tuhvc$2wH)_gOp$nKY9dD{!K<_H+n*$pIjt`2Mr>A z!^-l9S=cXjs4#P(fiOo1m>*3#dP$LHZXe_N-C05g6Jpu{9s>%VFv9ra#WgaO=t@$@_=X@xMS4hIzqm3)|AluU2q3<=#AfoNL$lrqwKsi;~nh zliJ*%*SQ{k{+y0$QPIWS8;^T+{Ax7Nb&6=azG^3q^V1X$#qDYDISb)UxQV<}xhRT? z?$T9NSy+^f-@RdZzfaVEH+>0ML&L^FD1X=B3GRtR2)9j4Evm@crl+B6&}T^x;n0#w zQA4W!azxWhI=ZWW==ZMFXG&wd;8uJf_YMc1SUk8)E&va&N{YQ`34*%Q*Bo98=~>7; z!E(o}X_|6)-2hgy2U-}QJMNeeQ@W9>|6WBC25wqMKm#Skrm1QKN3_nL z0IhQ_J+#hVQEq8-=nIpuArCEX=BhciFU2l z6{!qf2W{QL^KRLQ(HuIw+p?|j1kW55cpe+jMue+cWkV}}>+chtix`YTiyu{_&QZk1 z2&uiIyRG>U8V3aMkQX@}i#?HENdF7b-pg@XUAusG5g<+{FrC~EA_*{p`Yl7%iXvE}zs;UX#FL=dg!8 z*fc5Ev<`)_F8!Jp6x8CXi2X>Z99>>GW|fIxY_;^Lk`FeDrM3LHRS}S4JjTE>0-X|c z%mDEod8zU`RTmqKm2%;4Y!)6CDoT=3*92aBniV_VFi=9ziKPX}? zCrPp!gB4>Ud8@w1p)su9EzrIR9_A`*4`BTc*)n?98vSBYjecQL)ad8u zXVxbtX6NT}Gt;v(>l5?qx!mGnesMDV>q0I+Ik7l9zp*|wpc?&r(E6846>5f|Uf=gC zx6Qv^0JIp%s7R<}r@bdi7s4R|KVA=RE#JJ8>0+C3F=Kz4_Khj#)fC4Ok6it0Qcx0? zA+UE~nI>1_;;QV>wt|P~MVOtwp!~FH7{hQTW7+YkS?EbZ-U-!W!V!?XELjqcL@i5N zO71;^4|D^Hlr*+g+=AExBAiR!e=AOL2|l9sSoj77{_5=+;`^Sy4GOK#s8NUS&xpkM zf;4affu`jO|z9m%qR4olhKK;TMBjq(xTVZ?vAn%OZ( zT`I`lTIWC$+V6A0a$ztUPV;><8yrc;jB1Sk_o&7=sxb~1N;03G8Y5AHWDtTxFDC|R zv00wxRPfUZ|BDV<9fLavd0dfC_Hs|A$5PC~BH5O%b`!<$}DFH6d&djdOFD%Tg&rhwcuT8CQOwP}( zFXrcF7bfQxXJ$9nW>!}>rq>1pE-rNF4(Ozd!e@Y58ONFhOi8-Cjh_T#%j;c;>GunK z{LZ~N1OXE-PD1h;BgZDYSi+#n&%Qutf+2ihTM#kX`+LAe{tw3@Ev^U1+fjY47ZuZE z+Kyue5{{!kZ|v73UkE>pDS9{(K3uhhjFoq`9h{&A)g-A@3B>4}Z zS>03WfNx`yJDL6vXzEowH}OjYZnaV0&D~-eH`~J-K7-@=lzbJ)z8Yr87sOzD z3X~f_V)m=Nk!M(m|dAiQrTc2rvSu8CgVwAPq}%T9Fc4nR{z zMhqXZ#Zxl!wx&LpJ&-g=TbVyk8_Si$fl$sU<#FH~vNg+z-9-Zfq^8m{-A>`Nx)Mi> z!E*`1KF82f{VqqKHM2z9Onp=fbA+UgkhBq!_ESaD7Se;H87pDha$);C#qG=v)^*^6 zz1wa$WpCRQa#eHv?FTTwTW-^#xJPBPRbHUCU9Up`>`n z6KMF~2n-|qMN08Nnn?ZPut6BujByp6dZ5B4-p~nFTAQD>2T)RgNbK zg#Et2t9<~ph(xirXsUh~{Nm&Ly2WPc!`tHqz&q9upDQAyrF|l{Rkp|3IWaMeZlUd* z<-ZSP&74B0d2W7mv~v2pa#BNtSJN^ZJ5{Kt^9l=6EonH`PVgKEPyj(tz8K!Aw}?6q zS-vB?*|BV7__&Z7@6rOQgQ#ImT=`fjzrC6JJjhilxwTKrLr0uV`}9r^|6Ge*MBDOQ z*nlNIBsO+p1Ys16qQJb<1Tc>QY{NopYB0NIvTKz-e?gQX1io!Zf_P>a-(haQFSCh^ z=q)iMw60l zabes5@aeg1hqX!<2){gMbWIMRci@d6QImy?_n6zPq=Xy#VcPb*Fk2Nge(uZyn#Tcr zR*m9U6u7g`ebg`XYy4CKu%-pb4TSD7qd=;%0xvtT%6$lsZmf>Q{vJPTj%a&nUs(<0iYKec)P4F=; zwkKHp_yVx*hA4it8rMV_tIy`{vwROdS&4hOo_#h#v<1F`Y;d#iNuiS4G}XSJJu0l{ z!!OL2-7yg?%3&IzKHDfd5@_KNDf4kPIBV!Wu5{jS7dG;1pRa{K@?mZ(_euU?`0pth zuGxW3s9Q^amy&Vlv$o-#kC(zx_&C2BtmM}omDEbQpD(N4LR?Yr>A!9iOU{%^$%yq? zy$?t1ZmwK@Tr8~zE0tn+0OW%k5AwN6u<{_EPs@txGp`-T#j;vOY8U<`{7J93zk8%sSaGYIzQJ1Tb4$mK<&`DacXEm<>Fh9l{2i}+WFE2le3Y;7=);dwq6HznQP(3Y+C{)&=1q2i?5E(&lDCO~o!o#FOSM zx@nI5x9NlwXli24q(Gm|D@}n&n;Q6W0S6cuR;_xs$l7g;Qr*5rGNh#X;P0qVU|}Fql{qB8$hZIi_}G3 zh;N5lNH)pNt1zEjKlQgaBcUtm1#t|F#99|vmsS{VVjUX@q$qfXHCfUMXB0e&sQmo? z{ku?BRv#7DL8T?nxL6uYvAQrGCahMPLYk|7EJQ~%T-OGexB_s40`!R7A%b*@&7`CV zRdxIoYbvvkFv2{m(8 zTLfF*&Vj7c*VHaVhBo+7WkC6qF=iOKCXCK^(Px@*2@-WG?R@S29L`VCx9n+x74rb# zP$Yojmo<35Q03SQK=G=&M%nOE(prr^12l7&Iz5x&FFBc=77k;03a`C}@k`>C8)51g zo;Yy}35P!bL2=rVL7171A?xN9_P2J{ZoAl~qIR}Jxivx%|V!nhZ$ zLpi(wGa0EPP=91GI(#Hbnu7rRbD(mA3SE2eTB~+V@5?AGY2)hg62=Jy8EY@p+srA_ zG<&7czRQ719CsnLE*GNEwm6YO527=kg!jTN*B4p8L;v{VK!LtX0-?#bl_9?wDAB+^ z*&q(>4xCFa@9CvJc8x&*xm@mpBIBXW!B3Km>2c0nhIajDG8opOqZZ8SP?hA>!4DVo3b3_Z3*ElNCp{wfYh#jim zM?PD#1Xkll#+TV9+LbL@neDa7Y@`xQl+LWWDNp9xesSr{x2JB#@Y+;Qg7?~V1v+wV z-DSpuI0FBKoQ4{*mncpPgMli9-%V`vp(ZAf#3di5BcUz}jJ_CW5EXuhD~JT5sHqr8 z9ptp4_Ax_QVDpu4jJHo6`vP^V1qN>kJOESk}n z^dLsNsvZy@$GJjq#QG~97Pdf`@cw}K7TTDpS<_0%y3hVkeFsup=HbnNugcWS>Aj<_ zJ5ng}HMn!=3#p_>W|D)<6NpR{KESF|H8W8>utB+!tK>HxZI0_a6(I)vhs}JstorTc z47FAFbR(LOzEj~2Bq|7B#m?WTHYa8<4ag#Q$%b~v&N-tgDRzDV*EarH$E*ii*3-9O zG0!&#V+=$DskDP6;H0!SobW>N+pEFY%F3N_>Cr@aN{krUsPU@j*RMYwHD0|V-E!1; zbtOdGFqleD;}t+MC#?o~zj@ITM8;Kc1$*`x$fXhh+5qf#*QOI%ewP8@ly6`^v=NjJ zM+!hW3F3VM3UjL)j8n2-iTb0Fj-{CGH6U?P9@0ig=%iKm3rFJLaqx!;v;c?95Z7L-dv@*`}GjZn@^2Ar!8DZ?s_g zyI@k&422nkGpjOE$;0TmSotT^mEGc*tUt%d#}KO2fNB54D`C_kUUO{6NwmmIIYh@} zQKc>oTGx=OL@-uLS5D#Z+@Yk!@T#%E0kA|;k>e!ebb7>yqSq~JF;FztZ7~c@^m-Vk zZ!KScoX`ZY$OI2RPB?Gjgi~46WubX@ko9N0?QgR3VGRfvoKkgqaWOIJHzxG@Vy+Ac z>`@=u16yG*8M!GIf`3DeKeT(a9Ai8S1#LA=pO{6X80Gstzdp+MNBMqQLZzwn7@}6nfZB`Gm)qifNdh6u0}vWp&uT@|S$= zvTeq^S9el2k%tg{r?4ebzic^LO4ASuogu~4(!d$w9J%PeB_}MMnwIV^L#!seJ6f)# z(r7L8cP*qQd+jh;wJem8@Q5%Mv7~F|yDV?rL4~-3@VqZD2H3?c7#76^T^u#X4-vDm zOswEEK^rKgayWKld>W9;#0MH?^}5md})LM|*YzeVnS zr!8TmO)7>I#Mf;GC5tm%^9)NbEd(7!PHb`$v33&ZO(V>t=hsJ=$p|w^OQwo;QJ5b*mKaMCny< zkzFfpRdR)`{JMXK5;V^GqQw9K&Oi0Q6s&ZGxvp{geOV(KKzI1N$*63sGJ7mKNKGS{nWh5K&0 zaZc0xSZh!C_~}1dj4bhiFwtCq`1o_eK>Kr*Ez%7e5vgiXT%G6IStKHf!8ITh*+J z<+6zaq9?L2QX5!lWEM&zd|lYjo_t-7u<4Z*PC$D|F+?rL?1&L|oCUU3zhnBKTnDhV zn`(yI)?K2Yv9jw(trd_b9SSvj=<1dt>{X!K-(hwE!iErC@x!IQYM+WhLKVgU(LnXB zYqLRJkHJ!c`u<~s{p(cNk#|C8G0ejOIMF^^rhA+OkG-;P@x|V^XCu6Mgg1}y=ASCw zJewxG*^{u^bQbnGq&jM^_1+6A=^saubwqx@3V-F$SJ5LjFkIg&O+fa@dpONgBGNnr zkobVb<*P{)oEN^FKmRaS*vtgf9L68sTGCPIvA}s-;5X}G zFV)GCuFV#O)fD;;4)>Bw5$Nj8Yrcu{a3E&lC1PssAfKZVvL4r~O5?-tIS5EPQ3~}a z=}`%zwfDz+&gMqby1&ypO{lFt2t?<$I0~@)uWfa!qQb>%-ani4Embl+?)v!ZVFirg zq(6m_{scpRmTs#VH(5+UB&b{+7n^>9yQtIbK5Q!@VMcWULIBK=073|Z*$`<%KqWf<|pdVYPBuaENev_w&J>B-mIv35W#VVl%bfT9Jjm9tiG z?=Eilcav3ZTORFCVoXac`b8wrQs0o6Z%ci0Bdd7?pWO2{?m*$u6&S@AwVwzoqRAV@ z8l|F~o1TE5l+@pFFRj$%-4T5~yVu=LD&WmvW`)I>j@3wzP0^)GPmg9h&KQtVTTZ6K!aeh8G~ zyqVMP&AWK14Y9*v8PiQqU9ZIOsU!8oJ0Bx-9jkWo%sk`+3dCf0K9MeI&A~j}g|0{i zOasxSYhSS+dno@R*OIH_M737dZ1S&C)my&T(vEbyikE{6Ekku(r+*tP@?eQ*u@te; zlZVcCz$6KYO-)E4v4xJlivGzm5RiMJqmiQjVy+(>mM7GIQH{KJ`>7e5eRG~kCD30|Q;o8sBYhq+ zY{6cLnrMi9223;TE`g-vRPYcoET8}znAd+d&M6jq_F;F^4cc|P_=osS!_e^bGOdFD z(H&-(5R6--fzo!2B1uhQBzZqV@P8DrX@uZk3Cy^VCX2hv9dll*Ehh*i$z<3b zziRnuWkg07yyh?}1qJ6*rc~5D@3C2I=g7_T z!&&Y}S_%}GD8kPeXRC(L=Vg{KZVL0k!mQzq={t+m{hj=JA z>*#D0>W#2eKtCfBEZ@yb&Sb&iUU=zg`R;I5US={SF538&;KG>Qu4CQj$jihLB!vz;g#{_V z8krl;si#HW}m=j6e8B7V=KN(?>T%Iutt*nz;9;&TW;rZb!NVs_h6a)Y{IhcWrt}D&M zYeUy)@~-^jBn8;1iA4*moyx*=dqRcqQ;2VNR6F!lg0xdX>-WB^__5L1e={Uvxkzdd z0OQM!$gm1EUH4b&+KNGM6O+-5lX%u;gzl^M5jQ7NylatmGQ3ZO5r%NMW2zOfZq2!zUUh?r@+w924r+jgW}hrQ)ag zE&kYTwVZ>cN0kS~QsH+wwZw-mnMnJZOb;;F*EK0{_>Dq-bKQS*{21%eAPLPed<+K{UjFOSu{w&J43-5yjg-`NgnP3F69~EfHhA&k#y2o@1}`;d{Ra3g;l;JqZO-^@-;ob zIF-0z+nnANE=<%+oSd-W!s(dqfvg(&tUSW9Ek~+iK+xfIOpAf`1Ld_|k&;0o^14T^<(N zRlpWUWw`Q^cxxan2du>Gw#fMb+O=XViAI3p2v8gWia!BBF-<15-89HVWom>inekxL zhepHhv!a)*O&&V}1SLuZQ%Hz%kQAhpd$a>dVa@7xbK8GJHaj={#mZfux3=M~D>_iNV5*a=i2Gq$plZ&wG&Q#p9qgxP7GW=dZd8gVqM1agNTDk7M~&kdrdo+^{QW5(}L z#~&xoPw^HEMg^V?9k*nCQ?X((<`LU(#-H+CR#!+KZQhcmQ%m30mWV)2CJJUwPFe`m zOqSLZ5Sg-o_+HTBes;C2wV4169Gc9jvM%Mvrmp>=U-fw#v@n{(Ld2zodwupi%{J_R3xs( z3vC1@_5At>Od5enX$fi5WQrVa!il@1x8kNU&X`ovp(rC~-Q(+&oa4q?_=WvvVE%-?{Hy}-3yl!5X7?wcWOEfH@ zi~^9PuNA9>1A|k|tEnUBQlqLYnHr6i94|68ZDA3?R6b+{SfN9OUTjG& zG;j4$2dImd3I44&QOW|LPr`2v5=21*GU+GcM|B)bD#BZ&BS?|0K0{0NUjWvWn?qfeotmI|l-FH@roSeF9T}_J*=MGCBr8N6FNCOccwFctd zRW#LVydL*&uEM6Zj;ACJv6%H>U$v}3e%jBvUEMtiYA$NFi~QX{{;qco`FEzdZnZTR z2C`KRg|_Cm0YNlJ#5&E-uzXF{%Em2bELXfU>NuU!t zxntOz*L+j|M1rkGnG=6cT^z<*x_#Lghqd=S!=G`-ieYv;0;=NxSx7dFgERCe?mfSN zl*;z1fdI~?dUDnSr|KD8o|%{0`I)+>t!{{`Fs)UUg*r&!snM>HeXSW+sBfGb#<<~w zqJso&WSR_w@qJx z!rm<9q@{K6lu$vne&cS=(DjaiCx?6slS0>YuRd-a>JQ5|Z-iI%(l@!)Nm&mQfwRZvH2d`;CGl2YBSL>SGf^ZCfIcEF=q#;{uQ(Om2Vm+oHc1h(ts4?#V z#x2sFU2;m+d;u>)V!_Q{n@(y6cma({BgsjwgmJ6W7l|b6dC$v8M9HnzX+!x6F84Gm zA8uA1=&*}r{ZnBe)saOdy!uD`vLbViH&^dvU1bDttQijt*T@<}bpQ8P?$gD49^qdX~rVlf(5l1unHv5$(TmZz)f?`Y5@`vObRrlK(_U-bO?sC+Rh zU!()MT}+kYXBT0ZiCb*eUNts=+0_Sf`|B`bc@e<&_XT~Cw(35n30db%=fkBNy4nG$ zP5^AfhS-1EFpS^oI;mq=b$|9C)wWfleeeuZ5xcU+7!NVbAj|-Yc+3 zRI)6hQw^Wrh$s`dUmK3%7<}KE0TVD@Kf~nH714mDiAD-LSYJ`!n~8ZpWMAG-j8lLG z83ZPQNV_LwgQ&A!c{Jx9f{%(@c|kI6MWy5JBwR=S4 z=|AmVOjAt($pPQG>-oCC&ROI@!mJO>gNNjI?9=?`!CG-^<577SySmf9XQqddtGBm| z2kT-LK{4lqIe0ffQAWZzHFi~b<0(iYYm8>~A*5{fma8HTU9i+23fv64g*8+(oJe4) z`(PT7DP$c(UQCc!kPou=B?r-u?HVKI-Ya|G9^EXNKYq ze>*$4JM87Ehvk7k{&YBoBO+5^WeKE>%$18X%nw97md0e^`r{HkyDhYk z2pytt(i4Ij6mv2o>l(7i*%a{Y1%(zc?p=ig=YSkL4;0H1_*GaxA*3Us0%LB^naGyi zHv-saI;UwM)yDE?G;m1LFYM5m>q=?esKlBw9oBN77Q$70P-@x z`dz2|7rP)uX?hgA=O=BI>ZtIi7)n|y$f^$=CTnlVqSFY7@A>r+5I+Lq(~^j%PUY54 zKUr6TNDm&SzdVgi(bf~yMNiy44}bU&|89e7qCd6UP~)7A$M8p9wobh*ug50yJqKa8 zxY&m@4TmD{*;?Hgj=X0$(!l(0w+A*H=}XLpdm|jODo%pVqzH#I{zO4i3o{Wnanp5= zQE?FKVM~gWj{nIEkv-_fdvtsS9Ph-p!Mb$CggviIbx6OmoN!iSO%nNiK!OoF`qJ83 zzFbC59(KX=HK;rA(n^zcDPub9gCBPOVE^*+P5jkiTgPec30q8)=&~*4U@c=*iE-qT zb&WO?3oLL!vLn2p7>m!bG8)Ac#&VC=3!o@&0r0FdWYmSi_p`k;SsKacL}k~ub4v_Q z`|bDP557I?07PbdQm*IpMoekVZ48~vMA}zXT2z>2EN5ORh zE#@9o9;oh%Vqtx4Al;yo6L!%e@gD6RV5ZyF&&7dk3B%C(2}3uf%p3fjLM$S>Z;m(7 zJBTAcjyb8eNq7a(hLtNrvQ6p~*r0gW(v2Nenxi||@Q0_=QOnigj1z(P0RU0bD9sU} zxl1w-zV0PQ1X#4kah2E-;aIx63}&suuw6!G(C;@+6+$gfn53bnBTot)Rc-Z*h~PNP z5e8{JuEf^gdg5OouBl>*rS4G0&r~^vr*sAoP2H3d6C*YQlk|>-5V7k&;j2%=t2%_4 zaT?s&&TlQ>3~m&+wv@@vnA#P_xt0l?jRao76_Nn$E12=B?0tYev~)T~BgABU<{DN` zeT-I4#@P$qa>x^YBhH#=MI2U9X(e)U3yE9LV5w<^p(!rML(-TXTUog?PR)-OZItUi z)5}1ZhM?PC(E1Me7FsGMOq#J)eBhB0MSd+@`w2mM__7}RL-h-B{bUYHLVY%QHTLE?}BPZP~hMvQ3)eeU7fCE)`vMJR`D}+PT{BecL8H zGo`LvB?>@IGs6;hP;0NG#Ma$UJrdNAUa6segPAT&dDxCYkSC7Q5q?g)6#yTduxy@j0 zGfWpNc+ShWWe`|nxl9rx2>;T4(#Aee>LEJBWqQJ01M2h#xrMI;FU3-1@H}n2irEFt%|5!ZEtudr3|!Pn zZ#EG9)t8(BSG^xw`=efYdL{>B_wwc9qtaSFSWzD_+)-*M`mo%dF7AK*T)9&(Ymj}V1YD_n?srSlZ`f~6HZJq-VIEFdWV zX$qT^rs}jjJ!4D&7HOI;(~{(2>j=)y)H&(m-xJp*I_qQ~}^&eIeN`_AJn zSl4&-E)UK!=3MYURaN7V>7$vl(MS)x0$?EVWH8mi6JHPq=elK1tp1`7;c(y~b?}Ss zd-osQs^jxrJNyF#r%p-`(qT;n9N{eNH3fJVEe%Wof80D^rtcH;UVig)rOp=)O6Bu# z8s3ct7m1ik#^YnaX+lECfHV<58A8ke%=)vsbfTh7OuyBB^eti(J1kMweqyqgBRZ%k8_0?V%eEpw)vSUEB7GrHl#p+I0CG_>Tz%)kt{<>(nm zqN*#uTESkeFDZ4_qII?t5<36*mae*iFoC)XbkT#lMp|`vnUW0%GYCNT0`4J-)5Gu( zle~`l*ghRYq0}MDjNU#X>^T?x)m%;zns;p>FQ%0wq-Jftt0RkRU%%I&)htk>*>lCK)DN80!nFVqfp4ZR9|HaU2k#~!Sa}6bcL;wXl zm4MUrF{`hDy6f#;(B7)ozWV%BpCzLoR4Uu$_pV=us`9n1eC7Jo^(!gAzf&84cVzmk z6Rk%k4EhS|Ff{A=&+?l^#qYUZ-p;R;FF#V=qK^^=mZvmnN!nti#wAjgW^iM!do~c% zt(0PeOzQI1r!$d#V>i;3j@Tk9^YXii9t#%VHAt(i@|MuXtl^q%ToY#xt0KPrUb1@L zo?S`()!?$+J=C(*Pa&jfu%|g=?y~JU&fm>qoe8?2TaTod?LKXvL1?K4 z@VD5)bXRLohXL`MKkM$wKwQ0)l{qo!#l%F~7K2;`Q1D^v_e3-njS3(R|2EJW9u=Kp z;${78bsT2p?h%f`m7e@jZB(fAhns;#=xh)Ty(NhF>Q?#;^33)fHIRKQUT$-ALPRPN zPE8G30q(7kfV($i*96R_CN__i@*DXQuvD>18|^;=Eg!=k4Ra0nG5|$s>J!P=7F!gCdJTj;;M3vs?=yDP|5K!G3Mdv(3WF2ptE)d`G{a+faaV>ZaU1(Nf<{7s z@r*5@YylBp;3pK`)v1p0K$`?KG9G%-8Hs%9$~SQ+;}{MNy&YUQ74(KTz*SKpL1b0b zK(U`*H4#HXtVrG2Yhr$Bw+jOO>)aTC)pQ}Pn0Ozk^Dd$2Lt+MMv##(vZcjS0YgAZ- zfU!zY5S-0j>#LkVT4{e&p~ zBxIK$`I51dvbtv0L5v3!3E%dl0?Md@p%xb60fdznPrVxnzl?-m2HDp)5`MXoj!w1N zrbqe3rP*lVGJm3rNJ>D!0w!~s&EvQnHMnr)=(RYqst%0>C_vHr6hUTjj5tt-c|s`9 zYHlrzK-aSy#Zq>o6lOEwUv%UJf(qe@@rHS|O71lGS#D*mRM@U~N*W4(Bbrk9GbPFb z>~XV{AT{Sk+S8u9;s_9*(3PgI$#BS*UuyJ5>|i~rQ{bqB91tX!#NIt}3EEX35Sg=R zd~3z^JO?P8!Hqlfl^bw)Q5(V?ErLVD9N%a^YRK<9Uo1+M!*Z&|BzfY^q!M*P`hmLk z9M9PMhLV^gOvsOT!=hrj#i6jin@zpmP(>6QtFVKVf>W31M>%ZG;sPsGiMHu+p`MoQ zQn9!ZC?#~-n&2Vif4lY|xAjRr7`yxb-1q<}Deq8bNqTQ@YD?GD~O5Jvq#+0l2t^y)K32lnd20?4oS0ZU!_Slx%wcXRTE2{0P zikXRtaC8I&5f*p=6rm>oUZJ04a{Y(3{&h-#5Exm58>-S{>x*DK zfrFn=HyC0W!55dNooV*>!azH*0@DBidk3V`>$CgA6`{g=}fw6>IYP%7TSh#6j$F6yex)IOHZ|cR6_o0BS&$zhwn2&1`HiL1;{R4lDA^#?5PR z^f8D+Bjuzay%<0^NI)|BPF{~k)E!A1ULVVlDabZy5(!ApfJ(EPataL40V7XCuQX3l zI>l)9$JPwj-mD9v>_}K@M1Qm3Lc&O@lS;*UESFN%mNh;gqSeS)h(YYdv0A)V=pZte ztTjZ|8zk20(tHv$glTh<7xPE{W1QR5YUH#UIju(i9IBCd;-S_>hFJI5)n5)3GPZZB z4+;TO2klg4^ZQ>Y6>_YlT;KTMUFy5P(9zHr2#@2@oG#3GT40u@m;zK1-^wHQzlngg zIp}ikJ^eFN1W+_ep$b4DdLao-BcO!^>3SpRYF@Hwr{;X3H8|8~)~o_#OyZ5kN>f3Q zz+|UL6K;O;Q;lWw6S5s5lZg#h8r&$(k{}zIQTFLF%+?2kg|}jQXGd7jcy476Y{w2! z>PJtQAHqMblu3Wp1(&YC?D7k&)J zT^P}uGtXL0gsrOV?M*~=%U6Yk*WTh1xWT^Sh);~tL(PfWqx4hbHe%zJ8%pd*JY>%v z_dIg!P=}VN6{*m8h z*}TUP3?6FUksE_>Fj~}N5Pe%;-3@HHeQvU^D82HCLGvr)pzHv8day-u?p;#8#N^Tl z(UAx;KY{{UNSPNn>c6_#-(@eWP3zMoC;sM0-R*ikIR(3Yk-RKO+WckKvUt z%eT4fAT~$+z!N`->QF{Zx35AOqE+s>YLqed12Om3_jylF!i1;89;N`fco?BEBbQ4f zJWqV?pr+xg>3@|zYr|ozndRTsqw4A@J$s;v#Kr;Q)3Pjs{KBx5?05|7-w4QXZsci{ zT{|yCI!$0tu^$=eySgHay5CLaSu}Wow;w*}I10Ns!|0u4Yp3(pVuYKcgoCXQXMbmD z;k@Slo)+6L{Q0!lJ}tKACLvtRPqBS~fAqnK9uk;iIay$E3bJvcYh(K}O6J*GO2n?F z%WsJkSNadEj`3qCZ+yns9jc?rZ&Zn7h&Zol35ql@VuiHzNDq`)Kt-rRdkYgB25)M~ zf{CbprK>j?)vuB{_i#!q5XK(-Z*sRZl z;EGjIbTTaLWJvg0z5Cy9mFuO-&iEQI1u>6g(n@05a2t5S9#DeVcC5kFjf~ihT0)Ps~J7{z-tz9-C~uTd$<@9UL&qqf?6rp7(c zEzqi@$CPv^WyoV5euEyfz;U;ACIe$)UP1l+{rY}sC%N_BhTT?P(2ZsK=iB9b)!n^% z4TlD*+sRG9;j90s?(L;FsXm^0`)2j##0h}EDUNJ43rDs%XXD70Y#dp*^f_KM*^-SW zi&S4P7gNRxRUx>;(1W!O1iYE~Xa(7bQY?EU=o(b?XkNz5=(j@%Mp$Ep7H$XUZ*(j? z5w2g6pZ&J~YWvlw7g^z5{x) zjh^8Ye}kJ3lDe;rmek#XXtt8TaLHK6?mfcqk;?+Ck9M6D4ffjVoEIAnPjDZ!Ayc5z z6sR->D*YUQN=rEfD#hCGUNtQF@PiwsgTT3hEnSr+Hd~cid9$v58G9NGGkMD6Rw_ez zK@%$|enJ0~{0c4t=p4bWZQ^4%_kthtw{VZtMY3lRoZxAuw6jxvuv6Kq&jy%gk)@GX zDnOnBpOgcHR-(x*PA4s)$=HVZI7hjGzl1B^!;WmKBNbu|w5AbbGt~uZy)h;EaYUsy zRDy8k(Xcz(p%bM~k2NP|;-G&$Pp4?xp{CRu8EgUwaIImLnp{)f!EYh$8W` zti@B2tL|;cwNMkW&}CHkI(I0urG6@gHly!MLfWHZQr3+Y2F2i3fDL*s5kh||wZDYb z`4S?f@U7w;5hn`P()H1V-h{tv`hr>>p6V>8yFuBFG@5`LKYf%R#p+?>7T$RkY17#&dM zrz^6vQ%)D_6*kA)Wxex>Shf2*X-F})RSKVC zYic0u{F9IiWH|riQNCS{u*IbL`<#RRmaeSk#@}D4=nhag0`jO*984tC3m$D>vPQ9%vvhp_^q z)eQ>_(+_USwW!P2vnjgTCXPRVL=tH2dTkc64o^}Uko^(;*N>3mWDj5o`WYtAd8R9| zCvF!bwo9Om(xDe1wCRKOtf}c4vFTaMi|Glcws>Nmpp4iv*zyWic*r^G0k(-1QPQhk9T$Pof`rtKV#-CUkG zB{Za}NW0}7pQKY?H!B@2B=`6C?v}Tl5>~DJ|Lm9d>U+t|&1)abCZTU(>J~B~)AKXt z^OGCkp*TO!f#{1HB12kw$#{l&oKM27m^??uw>{mfqu#6e0ry=9;xI%lA^?N%unwL+ z@kEsL(*L+$-Q6qy{$6$K(v)Xj1H+NcSUg;{gc(ho61CyJZUaCQib<-V0y3!Bn)Ms2 z;(N1vsdlCC6@UM`TgAQd=6)^xb-OY30ss2nr@uaFrfKjT<)oXY+`ti0aT8)p?rlzl zo!A_wdAJzir8@asJ&8)6HNj4xfSity}f4!fCW@&mz%RE4};>d%W|WzrW%Av~&j zys$&}18Q}2jcj>4yI8GSf*k}1zR+!vGa4`qCIVmc1|_zL^cM{}Gmb{@olgVz$v2Ss z!79q~FjC2he%>I(_hd-WgUhg&r3Rq3u4c7xx%4i;MKU9px&`|M6oOCT{$9d2L*@cs z)ke6pYSpWJUyUT;v>i4?yY#$Z|H1kLuz*@N26WkAx>66j-b9X7ul1{>Z_!2zQU^8H%n<5Im0a?py9cYH6EuJrr#O27Z72leqi zTK=4e`kyF!)*=&tgxRy^ZT76?qO>~2YGrHl?*={TYqDf5C%r!jTkY{@Ugc{>FZ}v! zSl@%;Vra){|A_RvEa9|TdFNsJT*>`(y%dq0vW&Wafp)(M(;N}~W!CO9YRF^{)!+pf z=>sj*en{me6`>RKBuLc-+FZ8eKzWa0~|}}YCvOyLkAc;!bHj@tD;sH=<2nC z?`=v(jxo{cb)z+;iHOX1tGk<%(ycLX1i5=5hB@XY`2>#)jdu|XHe0Wu zoj>=K+*<>(buTbcQ6*BI&e)|bxOQ#g5{;ZAUzT&kYGq*y>hMx4 z>4Rhjl?rCHDZsH3M`>mv4*gh#)oc*ViO}+KxxFM4pRkTb$%jxf;rH<*nUNgnkgZ`Q zEC_eHP-4@bT8~j%kNjX$Z0ph2JZ(fGX;DA`b~ycMx?L5D>T`B+wCjdMg;LX9PMxXh zH*(m?<8U%u`CJSwghuCvx~nU8{b(S2UEo3mGwS%^2k&98>sZ*+nabYYe(I?q7V!Qa ztM9E~K&7cIQ7xda<%D&w)dU)$OBXx<998bc9L2=3<>lT4CaP&S`Qm$6gehnV93(M+y~}?HEltMI0aO=^TMLR(t4>! zeD4x806p^_lj>rV=748|0aK3!f}{Q+RmeW;0jJnG&fu$o8tjq?U?G5x;UCag-KPaLjzKER!r>t340?V-@4ACI zaKh|R?jldb@{YG;nV#ss$u@F}q=D6H9ZR0UBdq|_MIkbk1xX_1b{2Pnqqgj`mn>LZ z$2qJ=sQ-z>Cgw9?6ALzMVx{PpZ;I9X<=x8GxZo2jND*&clIqQYC%-HhMW71)r566O z02D~);Q=Uylo&I}iZ;$vj{{dRw2IrLfi4C{Qb1;k=er?#b%a$x`gKK_92}NN46ytd z-=kXCLW2AjSXqi8Ar!C>U-Y#Nc>6SKD4AJkEKwU9e9HcpQxwI8Kfn55ilUgJC~}gk zuH*CMXR($D-6D_g&>D?dIFi5=p@Cu&`i$r+wz z3V(ObEvXR?M51^gv!vWwU6R~^+R(>7B8`03 zMF!1j=1hP#+!}!b1l!&4fR|MT3?JGln;bK}HZ^J5HX$?kU>h?XWd55#&Up4QzrR}< zW9dJCW=j1}ya>FISp;6Ri@>Wz;?)*{y}ee^W$5mmkEd%1tM_uvU$PN+M?VKP5hG^`zUZ6drW`pM~RBwz?$HSGXw$Ib^+i*>HQt0S?~d+ zvsQ4dCL)e$&LLgkxCY_}mCd_h2Clti=7Vb=%&NpVGQ6Y~-TqdYVCz{ZOE4Yvi!#7U zU&B?xt2DJyBeqfb8I=kfpReq6jEon`OFlAQuwb#@p+9c>!Y!`J^I5jL47RmRSh~Xt zR`qRoi&bU(FRRtx)nU2b)2T8J(!x-U~Kk z@0mf)onLut;2rPo-^2f??0meVvt(Mx^oKXL_`~_Rg;jnA{a5k*W1jSGn)lasD!U&g zHF$xw8(RyDOMmBDo|^rp_>cZ>C_7YDBlTBy%XRmG^~ERa@s~&Y_`mtxwT+wf;uo&W zDVpGVb+fvYT)$f`)sv08vZi(JXeo-#f z$~8jPez;e1WVI)E+15tCY-{uDV##jZttlJzes!z7la$gRU_&wbR_YIv>($-8%2pZK z&-Ze&Uh5-Yuho^sl}yq4+Yf0uZ|>jTscaJUUrrWmX>Rljw!A(sHrU$_(^ye2OPZM8 zsc1@lc9c0;tND?y)!NF!np~^$$Cb^pW5#}2EA5Uouo~eCEsTDJR_9jJO|w_suca$< zV|S~vS*llSdvFl-%H?Ev7Dv83>vJn>$=`4M=GV#Z%C~uP_lSLYFN~0EOAw7Aq*lI)lS}nN&lq|`Ot<(MRj+ zt8;T{_Oe$`uJ6}sDuB9KOK(O+3ASP9ustU$HR3pZt5({si`7tT^NU*bLHgt3FG_pL zxZhWR-#q0q%OeiWagAicJU^nE!iejx4np7!O0fvdO%vJO@@9Q3HQDviz3vfb7tX_9 zuhz=R{CFef5iZ7v6Nz`P-MnF$Ne+*PSdKu4WZCVI$e%4`bx&5-B}{d`7#54^KOMH0 zGJhdd>U`4sQ}}wpQxWd}ESo2Q+VL@roV1H1=YxcL=|L{e&kg$&7wQQ8o4IDHDkU+E(A_hNCzw*ox6lR`Q8ctC7 zfM;O2)wlWbMq1{n3sVyI?CqGrp zD5Ew1i*v7K@iKSTAK>|p@qzIEJFw#wITe9O!bamU0PaxXNitq}EpS%iGH7qZ#?=kI zBHUc?4qgJZ8P!{{ZQzM;JQXl$G5iE6c;J9E^sHBeQFgM{`Y*~`DIbt-#7EHG1zYkN ztl()>3s0{gI8LBJy)dLX$9Bzt)5CV!#7 zOZTu^-bXMss2xK)uy2R3KD1HkJvCq{o|3tUhaF&{5uSCJ{yN`=05+##%a35pI&7zq z*7`FrC};flE|ySF|CN~Yj^PBrE04s$X@K}0(Op_>kM5}_ z5>O*R`dn=Z!Dr?KOb0j~CI;kQ{Sc6LAg`+w&YD5n)FU0x&?-=v)yBCsS_AFJoBCxU zP}tIOy9~m!zlFvINdVg)mcu(UN~=S}LpqlXNtFie9GD%JZfKAJLoX6AB5IrakpS`T zcM-Fy=_sC>VDvDSY8W{^0#6YyCTwU;_eh&IOr{*JAS`F%FIP)Y$A zo6E~v<@uHEg|+p$`R&ry!rI!({Bn79d39l{JdQm4xAXH?=9AtZ(?@J_J}I%X2oiUV zjy1v^_f?k&_Vla{*Bj3;-{KKeTEC9Vk0IL`#D)c!d6&qv?#Oa&bd z9QUwlv&cyT#IT?H-%1Vx4j_EplRgrhn56*rf=|JAE3mj8*aFouZ`1=<`UK`Z(t{3v zm9EQyFEL|HX+&hsVEW{1IKwYdZOVHiW^@SP%qn9w`Uc z=5W0WM(`Qe5ELN=V{eM+IGSd;`#8t-d3>CcJ9$uL3> zTvwON{?sm;u>=+th)}P?&N4gcs%+2av zz4%}DOS|>`d&%|M!~69rc;bhJN_tbO%p4|VLqMi#G)n#YU4}iRN9Z%V+FV=_eRF&S07BdH=O&Ka&L_JPG56& zHcel1#Jz#lk$5iMAlwYuH5G`Dtfzqm6}>AdkF-j?I1@{S-T`?i(tq047HV4I`=wiH z!N?lBxpQ`NzrL|?E7`c2tj*08mshVO19aNptJ+v) zRHrrI)?RuQ&+LoK2M06wg@y^aJbjw9MB1^b85^+~%MV#eZ0_B~?GSR$ZO>-_^|TL- z>WQ0{wp8LV=bqKr23^NJUP-}bJwluX7)Y%KZI$Y|Hl03jOBW}kQWL~{`uDrUOb(p* zY5{|Ip`Y>qW$eFv9H9KDBI}yH_M#aMdBhQd28yaygr&0CncAryQI$V%2w0^pY zFjP&&1s*muuqPbMe`l_P?~gEYNihKsR*S8e4y7qX9~i+Pgp%TS*|B$^=AdF2MmY_a z`#80B!pvmiqC}PdJW`fdS_!Hx{-^-epF(nD<2P4tymNilg~V}x#{$KvFAa30VZk2( z2B2ea4_Vvs7hYDEfRq-U#-PPH(G4XiA(0+5>{ht14y*>uz;SgY9N` zm~b#Lg`fOfxvzXZ{@aYC7#!Tj)iSCHcz_{!nb;cQ&nw7oTfYrr8H{uq&GY@^dmO(`RO$b z-%Si;)PZnDmkiG#ZoxtQ^JIQuO_i;nm_jq&&`2fZuaj{41q%jYB6tDDJ2}+J8m9ud zzJq&MSYDx9q1w+o*RSiZ%TkXqUjh~*eWZjQDFe$53yQicv@pk-;+w$#VjS_1EFFRo zHIP3eF;*T>;VrpDrE+sU9na51o(Fv7;@s*2-FFxmK0WwvaPV`~BN_VOyL~#S6%k5a z(g3``P2Q!@4IL&?d{E&Z;vm?`S@XWHe%QNPt<{U0mD=WhrLIOkyiBU;>o`B{e_BA# ziDBNE{W(Sil=U=}cl?CNIp`~OYm}!z_D{bzS^LNOy zn|`aAO}{m}>9<()5nRPkJ~Xb*-eS`G7Y{-fx`9h;-}$%mMkzfH>*>~4E4lWL5}`=0 z-z}y8Z($B~Qw2={o>=`C3bpEyN%e-EyS2MT(}u^zKc6-{rVWqW#5jvNYIp#&HQLhe z05Za50BeaFB}^uOBKG5K6U@E!cdq|pmhj060QHQSP(JO^IT$`Vt+g#sVS-V|YSW+rmw>QUCwp>bj|I>%#5P_}i|Fi@3 zzc7;L(h8hmy##A|2X3(FK8Tpqll{3SMogU^DxMSmWhgihQx$ayt%RT?pDI&KE~+SQnLHKtvSpF>w; zDL-9}jOwqLzepX$*MSHtnwk?Uxr?*aa9p8#&;wS54Ap~}j|Dy#d)C7WypGVH>A*`p zGzMO2C>4mLo@7Ji)0pGm2)5C}Qe{LWibuCw0Ue*nN)~jl=KZ&qXLaF%5&eVYsNyR$ zX$e=(tM5xWYWJ8(&SU@t_#aG}9w|1TIKV<@bXoE~lg7`5Qk=e^9kS@*2t5MH)vF)m zmm)uTkQv1aWnZ1C;qwFjw1Fja`mZ)ZvS_lbtL@&oW^joUx;Jnxh^N=-ufkzBDoh|4 zTVL!12huG5x)3bx5Gm+1sX9u2skd_!K}DmO3p4D}igtOo@N47WbeSpyakB)Y=>ZX( z>F){^CHO6BZe!27D|vp&CkTMHE?y1=@t!nWmh*nZQhqv#5uX{Z8Q`?2h9=tuuYqhy zW@L$_M7|2N`6N$Nn`j|un~I49(I6-UbQcq(x$Y7>^b1|%PY4$ZusZK-VO&F_4E>|& zsTlF8$W50nKw9E=%b++P4C`SQReI7V1KjgKnHATyc1fNmy=!#O9;0mP^FJy-O!n%v za((kIfR-4-op~$jxCjT|e+r!W*3}sv<#EEMPawQ#&lbT%0u*)5z}LNyHys^r8th-m zPBX z#KATuvu(4&m8NjpX5NOJFBkoGc+rxI8zbC&IqCh?>&3elpOj9Ftm{MX(eG8Hf2@+} zCc3qZY&)3|5*C%s(#}q5CX{k`Ik~x4-ruSgYo*<->b>OG`}b~_YsoLmyX9J`Ua9V; zf4OnEzeENy_}zF zIn6m{1LVjP_L0`Y*D{T06=()^-$)kXv8?g2UL@<#Yol8f`6YbArzj?j>S|(^-*r|> z*TFz(^@4o(;f=Rx{_%*Y@6Nz(H{o%gauTa`Q&H0ZJ+OiWJjq{hIpK#XKP761$2*kt zWe15Uu_l!QZ1zmjU)K7{wnC&T{;1!74xrQ*=|@2s-=A_bz9B$OD58td(fL0%garXC*7`fxF1cJGM-l-dq#l*D zV6ua8T>`MyjP$Tks6tOkAS&w_wPzYu3PRbEgXw#_vb|j?7k^dW*|}Frlgzh&1&H={ zc6KWF>y^#q`hI%f-fz8gJ^ekqvy#PMYj%;97dDKTqBe9sL4xX#1tzay#~IdeNT`zD zUkqeUNy~=Vs;Rtm4kbce^6o!BPkHG(+LNSF<8~QZblIoyUlRkI)Y}4#?nw?Iw)1Pm4x{{ylbT};6YpMUbL%$aw z_2mldfR0Yq{FqyG#Qua+2GgiEjjoJ?mQ`==g*vTi{tG8|VLk zJD=&YjSOZa+#Z$>T(A+mo(&7Be|`(+JN@ILnveo4h7tzp%u=j)fN{Gz zCQXb!Wy|~2#cJt6iVV1>cWPm@$Zwtt8ehua0E9*WJD8>sxU3F0hPw)nqU0#J;oRtT zxG?86;Qiucppnyx^r>I{08e~IuAT*wdaR$S40=n^7E+cvP^5)5*}EvtGHFKRO{*~r znbnv@F)mo%Dz9yAZ7-D9msU#4<+-)h+Y9Bb+ncKk+uQ4_a|>$=>)VTK^W!SItR}tx z?aqT*v<+&$^++1;ab%-?x8FH5$Oa5#<%gC>;OJGt&=sN~a z7}gEUU%({)c0Qu$9lMF37rKh zpO3yx?DyDqh}8zaq@Q|C98LqZU)>WJ*XSHM$%01>lSK)QTQZD!(6r~1{|5dT8_u;s z3&!H1iLi#+i8L^(nM%eneXVHHoYWa@kg{R~9tGU%XRikveKR;NYzr+VSm0?0C;(te z|3y!eI<~2{_OeHuiHJ9WxBsalN>fO#ZTxma7SDth4wmgiOXRuwCKQ>%k?TWPy^d*o z;y}Nb(5VlHnAAN9vMDx$Onnz+=?lNGKsdLWIZ?YRCTjn2Zf<#LX>RNG>eANA*6p?O z*3$CQ>eA-&YPr0=U0T>$UR_%&&##Un)JdbbEAvV3JACyl&Eb&5YVy{58m9X1f#7x{jkXtHzyS^UefP&(_YW%fDq5

o0$idovqDMZEKcS zIc%ok&(0~^1T=Th)Dv{dRUGLFYPe0} zdj&(O-j|kxRSOaT?lhD8wd&UXrkeRKBzyJJozxr@lCAQ`<(=yNd*$7FA*q-5>I&?K zh0|6H(*jI%>DK#v@U9P#Zk+f`G(feWJO>_LpuF|h4oEAye7>P5OfyP7Pc}Rd?pS>% z1CZwd56NK5M7-q8j|$f6o94a?#gYfi!oS1uitSBItcZP9nJi8F2M%-E$iMLCSEr5q zX(K-$9mq7q%26ZVKO!mB&LW^S91#<-Fe&ex(!`?L(W1;IF*WY=C3Ry6!a*u z2~=!vi&R3Dxu6!*KwnB1!U-#Z8do`)9x7L)qu9Lc2M1ETG z-hqhkby3ObP;*?dZp~~~?%z$l(cXR~4ZmgsVq99fSv1fwhh>ET$W4ggpn-~1s48pN zdEkT49UNUr-dhaBY1~rPlNDGK(Nl~Pk}0NW4l$rM&nF95froX_)KP(JsgW?VU9CNU zaNnZ7(POO?C_aTqlveL8$nc@q)j$!5z#k?v@8UPB#%Qg)`LK|@yD2s%%pHVl#QycHl4z#{;~TtIAqf?0^q7F`joXK z=$$@?`+7taiCi)O*&~(XBaER77Jx&t1;iQFLf7rN#AylkFI4uK-qYt4 zYQytu(QuQS^bJ>@E|B7mWRZrJTY!5k=epv0dvY}=&A8`!5=R;L+|a0o2_s)}v2&J;& zi#)71Jrkon6Zs)gwE`X*M0L5q8$LatZYl9eIYpL+!`_S3;x>UUHGD2~{NG@ocbfcW zcc-#jPOg`0^~!c-vs5o98}(9se=oUNtJbTV)tzMKH`h0A&Z>{^r@wn=(spdFQL}2t z=11JGX>U+u+x!%hz+lwtZgGb{{~eU-D{m#&cPi=9CW^hJs<=yjWuz!VNO8V^3&pi- z`T^j&A!BJcB-tMA%7$8xTJr1Cy>fD6cT1fO;P~A5^$k=YwUN3uy1aoUN)_du5}5Kw znw^}u9QO@Tv#Xg*Ppg9I=^wWiSJ##{=T{b2))v-pua!!RORGyOE1Tuj`PJ2O`S#Z4 z_U6Lc^0+#13(2o;-MYCEg-$`kUtlSSgGhi`pqYGW9k@*20Uy8v6-oKx6AbQ8ooDc# zz)ux3`pJR7tzZF_Alg5pE=wd6K%i0+kK_<+-jcQob0aG%%tR1OYy21fd|Kn5*7$Q1 zFD>M##!nH9?mGuC3)$Gtw(pP7;(Jah-us5=jLTSffe4JC2e^OP}Fr_px3Mfn%2 z_?!oN50giykn^(sLaxgCX8*RVSOj2>KK;rt{y!4}kiX5A9bad1cdT069V=VQ>)Q(p z>#Ix4%iHryE1S3Hw-&ZbrG@p<-1hqBV!6CDSK1m^e7(pBw?La z%L2_VTOtqnU=5jNOUK)Ak^f{~(L(fLvk9 zf;kQNrvd-ZI^bW-Z@{1a$EO66Cd5C+>CUI&ydYRmjRIU_@%V`skNZ4}hz)YQmOTW7 zKvtXv#|~CUHM9#6pmPA^3FC4{P%%2wbb2Qa-$y&y*!Y!}HN!yRsIR3xl{fjm_gw+i zNMAT(bOrRwimd+=aD^u%VDYlY8qnVWaOspoQR@LchkWhk4RC?lzdIzE>0{BTJjhC% zO1LWg>Cxo$$Z6(2bs#xX)60V`i4S&^i&F(UzRCkAr z%6aGsh$;U1HIR1+eskus1iv&YV>z`7Z(tR21KF|b?S*JrlLrTF*X>e4Br}!WdaYDc z*R5=plg;YAd;7bDi~$UK$ZQy1UYrJuVkJpk-p9AKB|_Uw@>--Ppre-NM`8%r{SG`d zpkCh-bCm;@1m_2}4wVb#cgG*mv-E&j2vkZw5MR-z47s5b zcg@J+XcReMc4mcfsWl3oz&QPBKwO+Lu#IG z0e)$KNhWhZH9iN;+xT92@2;L3J))FbfXo85jHs!lnE`y#FZEn+T*Q6SZ1bCY>MDqCepa5t;F+m$=}q(Fa1kxu4hkw#3MC>N<-t?s1%C%IGJ zE!PyL{iEILgLHMO)h&O~_A=Hh`>c(8yA_y&>?pj7fa(}()&~Rdci#seuCi%85hRl zE+>MJ(IJWI3A)R`>JA#WwMNo|%B7TXWKdx@linX8xJJ%I71;-=ud~+Ub*OwI)RZCi zB{u-J36}auhGGc;dxIRLz~)evvy?T*G#IpsrKVd%qBEz3ct{+U9@yMuOu85Z;~`(e zyMGB&C3w?)hy6T#OE3)B^NOu+>z?b?P=a{TdzsVvtN_;WTIq^C38v)tHM~rwEzdQ3e@hsD60EM8yNm2 z>!wg9Pl$y-3K;`g?e0=(;eb`P)T43TjRi}Cuf-u*z(RDGTPPEy4r=H}Ekc)Ns_Ekq0r@Y>2P*3}Z^92UWvGXGoIa{WUh; zyTYx}L2A-72;v&gYQ40=OOqojqo8wSaWk;q&ZJ2CpCI|%^4e^=H3#v2*X_5-IQEQ) zT%o}d0Qm8qP*;iyJR<{I8%YTD>(n=ZLIUb54uEBxSj^~oXWp)E%ubrE$u&>NVy@Vp zvP?qo?09y(;C0VJu< z;N2XD7Z|$zUh$9yzD^+bJ?azNP|r~>#46G=c!H*r&Zqxu5nv2Cnm3LVhx*Orc4_mYVs(340~Ek{ zb^4zoB80Aw=++ms36Qz4nKAu_n*w9gE}{HS8Du8b5_W?B#7s)4OA4_|;rEJQm^|V$ z@c%+GyGJyPJyM9!T$PGEt&N7>U*(}(2^Bj|;i<*V^XgMEmyTpt7DJuQH}xtb_A0pn zxQ@!Jm_izs;pnIv=23{A8hDP-I-h0WcY@dUR9XYG7KzY1IYq@}vI6?4251v;o%Kv9 zcPV@K9M1BK1Z>1}9XuK$LSMN(dB|7(tmhWeV%kw>kG)$$C#=aWM`y>A#kg{Enqch@dSDV@|+L4 z+xCv8fu4$uY*sX4_rNaS1O|*wBVq=HzID1V=@R{cl2U#pAWo&4OF?;SJ2GsWP}A!b z#f<7e9th}0eGLirx!_3-^e+uhbl^_Wco#&E(`3D##YHGEqL;&V;mM`o0njV;x^E@D z|CjIpjpWr27t#lPb%u|q*~hVqn1vqjr=6Y*rC&MiN?rK#X;*66mC8->kS8j(uqNt| zP#6(jMI5Y0`h&qqHje@Hi;ieNbTEq0Mm3=5&@n7Qwsr(h*?0j&V5~LPa_U>G>d4rC z!jGV5WiecfPq3ik!M|iotk}@J3_A7>xN0B`b%b!-sSuPSnQXA$)^@Ro@URf!7eq*9L{k}~Tu_s4=fVl#@A_cXj ziajG|!8hL3qLS_+2+k*<569Y|aO53E_nG){I=nx6E191r;h3#tpy354(NWGkb2-KI zvBy@^Gj+b-*uWN0qKdL00Yx1+KW7~?I`z_2Bf1tUEDcjgJqMd+H9ey!3GdKOUOguF zr!qh7G;WOah7lWS+U~IxpT8gEj6#hry+OsCJx#a4*~s`#TO3xLwm{s1G>TqBtyZnp zud4sUR-&|Zud;g;{_n)~n{$6a^3xfJvZ6hM*!D~8_r9b`;%PEd+S#c-*s1K*jm(4( zRcYI}Dk{)h-Kdba!U1f{AB4LEPt1rziw1==N?#^64t1K%5R1z==QJd#?fD#vqc5=A zVOLJs)L1peQ`5Chz5Oh!n)MH(Yb+6LTyhL`c4_j%c2uOTr-a<{Uh20f=^oMF=ZrdgQq z-k>Sb82r^kQ~5dS#qg?FvQbX%tfwXGBWTq^99pg8>$cp$W^PHIfA-ka2bX7nAf5`XiqH4Fvmb<7o2_cRQBaFF|VX zNSWdGM&!&wZ`SYIHpE%B1&%%T(nFsfIGD}?PjjeCt=iv!xUfjrTJf36prA2%Tl38T z$CLxzuYTzLDfE}BSBv#z<9ko+iBDxzpt#MjyDqK-RjeDhI*KLruOKa3rMIO_$OOq_Q4w9hK$9N`UuP_bA%p_>KUg<}@Iu1BmC zC5k)({}iQ`vmL2V*)N_7GCGBrwyFANJ}N&<|ZLwqTeXKt_is= zPPP*lY6Fx6+Q^GSPK#&N36*E2F)U=BWK+}ty1u6&BW?hot9#}0R#7%pWMFSvy6{%i zEqG{l&Cc34lVmOIe_9B$f`c6l(bU>7Vs(3Vch+8V^&6ISKxihT&k~x3IGS4cYPTN8 zc(1v8{RrO7Cy*Lo@7EBe*qoSllyf4=UFmPUw-^ETMLYG1uZ5DH{voAC_HGYtU-!=# ztk8vS|5=c&hXB_zzuI_zTJ0aT`Oi<2+ENTT^{6r2${H|_cHy62=tQ0LZTZY)!t8P1 zqL4HIB!=(hYHXy{%T0~*PB{%)ll!&G$CaJ(o$_=$k9s@jr@Kph3Blyi%%tG-Ap&eo zulM!v3)p=*bLwXVy*4H|W9B8$g7V^#hD#kxp2~9mY9y~lzuajokAWM7FF>jkbQ#|e+Y`YcCy!7AbE@w{8k?*Q`8sn_|L(;mVq0KF z--6VDne{ZDq{EU2F2of|J&?jHn@i-SxMI=aGVD;$#4m>=9PPPR;3MMI6@6Jl97ziD#5Ddq#TcsJe_Ih-1=3gmE;w&inP9A3&(ak%GV-gPe#LVTDX_)-r6 z_be$m8*r0Ho*VdK4)A`E;v}c&p~7%xUQOfeA0U^})64 z@5E=;W%rHj?=cDyLNJ5L*jM$v zcJl_32A@M%(bnaV4q8&I_k9iMAax4bG?}mAATmInn%#-n#yOk8aM`swT8{)nQMR~b zimCG3K}IXjEUFK?B5CYD%?O_@{M)4M!<=_Hm#(blW*_QE^$f9sVKwzIW4NQME(wwe z$|pPSk~t4IIWUwx;tBzR2Zto4&1n9?=@^)t6=DMnCz{cgzce~K=1$%(?UwG8;Xmom+=UxXa#ZcjtFfQ0X6)+4Ig2)SsVK-K-wY{m zG40W%L@9Ujg@=a$giorF=pG{-kS||ZZu&ULic|G-?O-Y9r7zT`qDE0yz zBiOJZ;#BB^KXs=Tv3hbw6%Rw}K?lB7aHJ6JpA)daxEEHTvWFT2?R{(WNDlF?inr27 zKIQ1AZ&(B%0E9z<`34tjp5wN=jCc00{Vx>BIU*Z6lFa?Y8i|aLio)P(rba7R)&t~i z;J6OkT4!<^wSb@Utcf+Vkp`%b0H%N;rw$J@OoWYG`kTM=g32d-OX{RRiJjslL;$WL z(N162F;QNt+apMOUvi`9A(fEj3G8b%*NTMqa%?_*#8+pYrL%b#qzuwH*n2nU8hUXw5+*EW8;QDC@EgLp4=Q#Oj3>IW4+t;(h~<@?_u zJLuq<5{8ooin;_EuzvYcYscXSzcklHNbn=f4g@UuX zQjg`;+3<3}uE4t;eXLs%Ri+$px`$-M)w)D%=2E6OFjNc0js4WXOdA9b;R@u|?0v{) zM6Drnwwav`95_f4>(jeRUT{DY_IbSQNoF*lQCezgrQ@_cigRta?js3Qdr9?DBHF>K zLK~l454stcMCQE|5|D0e1q|zR``MoAP(V`bp#c>x7W#K$r7y!F{#A}X@iKan3&_fV zu>rCX0rZac>>(I8daVua)36F0y^=#YOMwVbsv&mK>}fU>C&ck&wq(8MDe@a1f~Sh< zPg@>@bc@nGLjXq_2XRM%pSYY5!k0ct0*v+pqFEnZ9MGAzn5agf$GKPW2%~d>uJu1TWVijj:nhe%788dP1g_bCcF3U;;i(9; zY{Gpke#p}e>Jo4%u>hes=bSdK4x8lWJ?;rwYs?>p+Rh}j)z21<;7xFVgR1>Q`;F-t zEM(pKgyShg0oLMOLvdM`Xt^Dy5uoKuU*IG2M^iZKg+IUgUUVar z$0HdwTpf@&F}tvp<22YCn4brFo^nv+Ib-eh_DmD)5y9c?tVIy;gb6pk?g5!}gNAP#hr1j%+jiFfj8EB)+ z+|J(h7fAx*baB=R7{G4{cIP|4!0(dC0D6hxLZNCt1*o$bM>C}NrKJ|Ib_fHApFst# z%V9VlOCDrK{He#igy|O1d;&KI)sd_VdPQ)%5%eTPP#sN8ye31FFWLY-=Agcr&q^Iu zb2hfwq?IPO>gp=liJV$9bf`laI=g&t@uvpWJITZjQ)|hc(aQ!QtY;M$*XQiw;zE&l zstBl8)rW7e zrUP~Hj;V3Mgg27;>&QyeuQ3-x?_#JR+a7fEuoNCws8fItHwZPgf=`)#2xO@P`n7KL z5KP$%cz`xB6r17W$e`~a=N5K`s$lZc;v!8~d0Ky%)*q(zho5czA#eJQ!xkRwvc4wR zKo%Y|X=Q^_6%>`gH!$E*w3Jnh#t0eY=M?%ix&8d%2k!||_AWMLov-jXA}wFqU{b62 zlg9AeJZQ@j#;S)R2`h#41ZzKbHKM1lxiu#(TFmwA?NY9k0fS=(A%qOg8JzaNCRDbJ zaW0lQOD(fZb{0(I1WtpxgwG(BQt9&n-wJ@)PO((x$RM@#T?ctmrH1-*B(UQwU4xxC zs?@Y}p!o?8btaY#&ik3C%_f81NjqveuSVrb?(YR}F31&n;o*l1*4hPmkz`2}zORKF zH@(1*x>wmZJk6?76JmXIXq!2;Ii(S}Mh1d)_CiA%Kf<5szApPFVmWpV2R^RHgOLM1 ziQFHw{7fwCO!p$y+<=4~a)62o%|ujChbo$8)kU4Mqo{LAvRS{<*?!$h=bP|aYW5iK zuc4XtMXxou?vYv8nA(IlunGB@3Jz6bn@FU`G zso#Ch#kVfYqXj5Dj(PS>ayj=c8gxQHwJw@enoG2)7HUeiVxkdsAmCJL>=$?OHE_P2 z5G$cg$F7g4LX&Hvz@wn%r%8}o2<}%10-bzNrInX7S(?+m@x{3X#CHiw3btkxWi(84 zg$OA8n*_xKxJOIn6xXo2|?JedEj*BXF=4y5FoR7*3@YZtG&G++x)Y|blz{S^>zkEGQl zH1eO2X>yeb{R|^4Xtz*%rhz2-yr_g|Ifa1^&9ABt{~2Wv<_j#IT!wNRcy54%)%q?U z)f^beGg3RKj?*CAt%X2pMv^Agy2t8=7T!r8?UNqRg#*6mB^MSWfA8Q=#U`<9k!^)i zHWM#qzHw@mMr@VxL-3FlA~bNU&8<5>wTBnmf$CuzV5PHGeSye$g{ z*MTvvKrMtTa{Z?S!Tw5988bNCG^L6Cr~in6@w)YdrS>zvaqbak0LQ0?XT*nR?dN@X z#6Hzts2yd16{INzN5Q+Ng-*kMfhbcn`&8V0SbS8FNIb{$3{wtfLK9F9*6E!*faMz! zo~(1HKa4e+x3NZx4mpH)bxMJvQM9V9t)k83I4-2oqQe|vg?gk)BJRrJmkg|5);+#H z&gc&bPa9iMqfjn;AO`WAYM2N2F{SZFxR<3zfGrxqi!Bm6iT(6plF}W;Rx-RU!W2t0 z#nMc%G(QI{O`i018))xhgEYbRVi#sVzL0nt2vvkF6cs~XEH0=Ks=ndv-@Knt6;XBS zA<-{bJ#@rBs#Mst8~S?c6!H22gDkKvsvhxg7HCJQry$Bl*AmmeyuMQ|)ruRHdb#*^ zsa`@NiXRQJqKfn%1O1P7Sgc>-t^39@%g2U8ti;XSaucdDDEG%2X2X;rz9?3MTSD%D;6 z?;E>Y<^NjVdixjb^)}NKprST^uoXC{5g2B$ERZa!6dE(+Wd`hoN)J2zh9X8S?ba*B&D7VazrTyQ?{=lUv$f~0VSp8N5>|9^v@7~{ zb#q^F!xDAu?dpC#v_^Z$?T5+x)qk$+?38k`Q1c6`<6z;1-B#9n?S8HLPvy;eE>>h= zeQ6vkaUNTT^ol z@9fvA_si+3eYmUk(J#xp<#ZVnD6NS7^+Ea0{tlY)nP0wr^Ml!>`f>UNmGXm}EZf>x zm(5+Sjs5#-b@r;YbmQGnk?(G~t~cg8yLT$P<#J7Vz+ac^5303~a-rDR-R{GX5hJg%>HDxKqdf`8B5s$<-ki$k+GH#gct^Siq$0l8mF|41F0 z0Bm)Lb@4N1$ceAUezxHJ%*v)!(ro(d%SDekxzT@G#HO+738?yeQArvoXyB)mnx3i} zxcZ%8v+#?FG%PDh3h&mE(5(SdJ9ulsbU0jPSR7i$VQJV0&Yz6Kp9#JmqZR??Z-jOt zHuWhtuk@%VD;OBQd@Nr$thW)qZatRDSXA|WUVlyUCljQM@Muu!d%-^~*!LBf4D2Bz zI|9oAOrH(J4Pp_3y|~lxn2`p-i7kxHCdMPd#K7fgHQ-7cE_1EYf!ztg^n!dW(XA1G zr4EhXU8KzP_QXe~FyP-@UD#s)~+1)E3lX-v^1x@4|HKo21A$ZoWK z0gkn;gf{fML1M8?f8GB|X{VsSef2}1X z(Ebzkr~+TZgEO9aYTy_kYx9c7H?EaX&2A(>lYcZy4Hf{H1JVQ7NnhQQAh()o?piPW z#2SY}u(n0p-zB~wsTkS7?bsqrPTM}@79|7BP6P*xUV_0o0G!Wr<07rK3Bbekf*b?V ziD>!!uMbarwgS^%d^U~+5fX6d8ASq$AlTT#6o!q)rE#kCdiY-YPk?&(DGXLx)OJma z?8RDM(5f|F0Hh;e6#W1i&TVvXaBlQQK{OO%y!0%J9~OhrY_Zl;2L}9U1Q?ae(Oq1^ z8B0%7@RT`o_eA4i%*1(mrhsOU)TJfQrAW?r9^u9Fx_89>f zK#tarj`W=mG4=Sp$*JfbwH&U7Us$gd<`x~=a52DaM!}oL+hG1?MCt^++1K#GUdCXP z@J%o1RO>PF&mcoR6VORRPh&ea1FU?MK6pz@-=y!^JH|h4+#tc0u#{lo9)XFlMZ9_q zq;fJeo?d8>%{u!mURP>i;PmI#O~n$9t0f~x=r)^vv8!k=G#Fr6Wo&Jg4R z_PCrcJ&cEc`~d99Q^lKL)9Zz z26lskz(sM0GQqG~*QD^;#!dL~6PrG5|nHh9h6sgNMz^%0_@m$hhIbJl$8%o z8tgLH2>#_~b@wl}EVqgrB?oOao-P#X!kH6&4_GQB|%` zep#?(N0FZjQn&^cAuWZ*Cj9QXwXcb{I{g=Pg^t46Mc?C*T!@?1RWdEs z8R5cuiRL2xVuzhjma2O%V0!2^6tgM&gDf_%c+_gA+hnP7CPf2^5_LEDhE9l3@i|nv zG<4mgIFHeuzsix`UyKW98WZ+<9yuO<`nE)7r;@G(qgl16=uD3& zQAeHW*(s{Zk8opHJ}3h6o3_ZNEwX8g?B~!T%adeXkVVH6Pqkp%hd~fx6eH3BUwQ;F z${9x?Sx8mZR@EK1a1*Odme`F!CM{^sc|$2r`fy=v@L;(dt0vhcBDD(y3IiZlUU?h} zk>@6&uu8B3-(=Oh3!!fE5NC-?=Nk7d6dS{XLnOjVut$1;qMe^6 z8is_ueZVN=$%)9ZTZHUVK20dN06f9bf6BlSq?x-xT(=AsgFCts&4d}c2fs$^paJnh znuvRMFKn%(qc|*TW~+R^yt`H2-F%pAR(H4e_kek+UN3EaG&^DEE9Z@gJSnOL(;N{N zvUqNUEH0~uP5uZZ2uHVVOQ-RSj;oF!H6maV5UD|WcC>J4sd|! z7%Z#Mw~FmwBT&~?56ge>RFOI70MYQKU9{!QF4~Gk1)?N3{NdkLF?-g$*BV!2ZP6zH z>2ipiaXXXHM0-SvO(2d0yR2!)Fp6yA%Lo$N8?IHQ^W>lQ@7&o*SFxa|2J2P$?0$7; zXCDZeAobN7y;WfOJ3L(4*oi_wMr$D4mP0ih^*o2V$Iu)|L_mcApAqC-Y2zs6x>J~x z`**O=7ThB+0;Om^P7z|p&W`dXEwhJET>af>SFjjxjCazotwPJLcyQ;3T+7Hfx%0kg?!6qa7GrfS!B2Q>>gE3s;^}kJI6bw^?3rT`j$yHl}aXY;6%m z5lnT6jK_v^UAuWhAuEM_JRn$kBTUd@2{?2U;3h!cZ{hzDBP#`D&z!rBRQ1Dpl2)bE z1ji`rh}jyEeuJ##F~)RA715$RS3~B*!jo;#2*>ghti#N`(%xQ@{{PCIUB$IK3zZ*w zq;%C7Q`^?{PAxfUa~DBLhy%!;(be=`pDXuE+e%1x%7uV{3BSmm6yq!^^pjtU?qsAa`b8V(gqM`_&sFCo^b812Kf>pksyPrKef zhpu;?#HE7XaXAx0VHaaX&`CQ4IdAsmNsZ}(Fcl-&EBX+EWRDx*U2FmB1{&4Gl&3kTL;+O= zpX-yTl3zS8aEQEAO8pwr#GWVmbUo*<2+Yw*GU1k~?Q7L%bcW$UIV%ZKzuJF9Ep!;& zBezPW9ij3>tWRR((D39OL+QiG#YH7wr=5&m?@%hvH4?t*k)*+ag|Il#d*i0? zw;5FkuT}Uoz)}z^n?w#!pta}MgYc-dNSpCIa*N7JrB`W0!uvK7PCP401=8T)n0D

.` где каждый элемент является числом, например: `1.11.3`. + +* Значение `` соответствует главе, в которой находится это требование, например: все требования `1.#.#` находятся в главе 'Архитектура кодировки и нейтрализации'. +* Значение `
` соответствует разделу в этой главе, где находится это требование; например, все требования `1.2.#` находятся в разделе 'Предотвращение инъекций' главы 'Архитектура кодировки и нейтрализации'. +* Значение `` указывает на конкретное требование в главе и разделе, например, `1.2.5`, которым в версии 5.0.0 этого стандарта является: + +> Убедитесь, что приложение защищено от внедрения команд ОС и что вызовы операционной системы используют параметризованные запросы к ОС или используют контекстное кодирование вывода командной строки. + +Идентификаторы требований могут меняться от версии к версии, поэтому желательно, чтобы другие документы, отчеты или инструменты использовали формат: `v-.
.`, где: 'version' это метка версии ASVS. Например: `v5.0.0-1.2.5` будет означать 5-е требование в разделе 'Предотвращение инъекций' главы 'Архитектура кодировки и обработки' в версии 5.0.0. (Резюмируя, `v-`.) + +Примечание. Буква `v`, предшествующая версии, должна быть в нижнем регистре. + +Считается, что если идентификаторы указаны без элемента `v`, то они относятся к последней версии стандарта. По мере развития и изменения стандарта это станет проблематичным, поэтому авторы и разработчики должны включать элемент версии. + +Списки требований ASVS доступны в форматах CSV, JSON и других, которые могут оказаться полезными для справки или использования в программах. + +### Создание ответвлений ASVS + +Организации могут извлечь пользу из применения ASVS, выбрав один из трёх уровней или создав предметно-ориентированное ответвление (fork), которое адаптирует требования в соответствии с уровнем риска каждого приложения. Такой подход настоятельно рекомендуется при условии сохранения прослеживаемости (traceability), чтобы соответствие требованию, например, 4.1.1, означало одно и то же во всех версиях. + +В идеале каждой организации следует создать собственную адаптированную версию ASVS, исключая нерелевантные разделы (например, GraphQL, WebSockets, SOAP, если они не используются). Создание ответвления следует начинать с использования ASVS Уровня 1 в качестве базового, с последующим переходом на Уровни 2 или 3 в зависимости от рисков, присущих приложению. + +## Сценарии применения ASVS + +ASVS может быть использован для оценки безопасности приложения, и этот вопрос более глубоко исследуется в следующей главе. Тем не менее, был выявлен ряд других потенциальных вариантов использования ASVS (или его модифицированной версии). + +### Как подробное руководство по архитектуре безопасности + +Одним из наиболее распространенных вариантов использования Стандарта верификации требований к безопасности приложений является его применение в качестве ресурса для архитекторов безопасности. В настоящее время существует ограниченное количество материалов о том, как построить безопасную архитектуру современного приложения. ASVS может быть использован для восполнения этих пробелов, позволяя архитекторам безопасности выбирать более эффективные меры для решения распространенных проблем, таких как шаблоны защиты и стратегии валидации входных данных. Требования, связанные с архитектурой и документацией, будут особенно полезны для этой цели. + +### Как специализированное руководство по безопасной разработке + +ASVS может быть использован как основа для подготовки руководства по безопасной разработке в процессе разработки приложения, помогая разработчикам не упускать из виду аспекты безопасности при создании программного обеспечения. Хотя ASVS может служить основой, организациям следует подготовить свои собственные конкретные руководства, которые являются четкими и унифицированными, и в идеале их следует составлять на основе рекомендаций инженеров или архитекторов безопасности. В развитие этого подхода организациям настоятельно рекомендуется, по возможности, подготовить одобренные механизмы безопасности и библиотеки, на которые можно ссылаться в руководствах и которые разработчики могут использовать. + +### Как руководство по автоматизированному модульному и интеграционному тестированию + +ASVS создавался таким, чтобы его можно было легко протестировать. Некоторые проверки носят технический характер, в то время как другие требования могут потребовать анализа документации или архитектуры. Благодаря модульным и интеграционным тестам, которые проверяют характерные случаи фаззинга и недокументированного использования, связанных с требованиями, поддающимися технической верификации, можно упростить проверку корректности работы этих контролей при каждой сборке. Например, для набора тестов для контроллера входа в систему можно разработать дополнительные тесты, проверяющие атрибут username на совпадение с наиболее распространенными именами пользователей по умолчанию, перебор учетных записей, LDAP- и SQL-инъекции, а также XSS. Аналогично, проверка атрибута password должна включать перебор самых распространенных паролей, оценку длины пароля, вставку нулевого байта, удаление этого атрибута, XSS и многое другое. + +### Как курс по безопасной разработке + +ASVS также можно использовать для определения характеристик защищенного программного обеспечения. Многие «курсы безопасной разработки» — это просто курсы по этичному хакингу с легким намеком на советы по безопасной разработке. Не факт, что это как-то поможет разработчикам писать более безопасный код. Вместо этого курсы по безопасной разработке должны делать упор на упреждающие меры из ASVS, а не на список того, чего делать не стоит (OWASP Top 10). Структура ASVS также предоставляет логичную основу для последовательного изучения различных тем, связанных с защитой приложения. + +### Как руководство по приобретению безопасного программного обеспечения + +ASVS — это отличное руководство по приобретению безопасного программного обеспечения или заказных услуг по его разработке. Заказчику достаточно указать требование, что программное обеспечение, которое он хочет приобрести, должно быть разработано на уровне ASVS LX, и потребовать, чтобы Исполнитель доказал, что оно ему соответствует. + +## Применение ASVS на практике + +Разные угрозы имеют разную мотивацию. В отдельных отраслях имеются уникальные информационные и технологические ресурсы или отраслевые регуляторные требования. + +Организациям настоятельно рекомендуется внимательно изучить риски, присущие характеру их бизнеса, и на их основе, и с учетом бизнес-требований определить соответствующий уровень ASVS. diff --git a/5.0/ru/0x04-Assessment_and_Certification.md b/5.0/ru/0x04-Assessment_and_Certification.md new file mode 100644 index 0000000000..1edc5c19f8 --- /dev/null +++ b/5.0/ru/0x04-Assessment_and_Certification.md @@ -0,0 +1,47 @@ +# Оценка и сертификация + +## Позиция OWASP в отношении сертификатов и знаков доверия ASVS + +OWASP, будучи независимой от поставщиков некоммерческой организацией, не сертифицирует разработчиков, аудиторов или программное обеспечение. Любые заверения, знаки доверия или сертификаты, претендующие на соответствие ASVS, официально не поддерживаются OWASP, поэтому организации должны проявлять осторожность в заявлении третьих сторон о сертификации по ASVS. + +Организации могут предлагать услуги по предоставлению гарантий соответствия при условии, что они не претендуют на официальную сертификацию OWASP. + +## Как проверять соответствие ASVS + +Стандарт намеренно не предписывает конкретные методы проверки соответствия на уровне руководства по тестированию. Тем не менее, важно выделить некоторые ключевые моменты. + +### Отчет о проверке + +Традиционные отчёты о тестировании на проникновение фиксируют только неудачные проверки. Однако отчёт о проверке соответствия ASVS должен включать в себя область исследования, сводку всех проверяемых требований, а также требования, по которым были отмечены исключения, и руководство по устранению выявленных проблем. Некоторые требования могут быть неприменимы (например, управление сессиями в stateless API), и это должно быть явно указано в отчёте. + +### Область исследования + +Организация, разрабатывающая приложение, как правило, реализует не все требования, поскольку некоторые из них могут быть нерелевантными или менее значимыми исходя из функциональности приложения. Аудитор должен чётко определить область проверки, включая то, какого уровня соответствия пытается достичь организация и какие требования были включены в оценку. Это должно быть представлено с точки зрения того, что было включено, а не того, что было исключено. Кроме того, аудитор должен предоставить заключение с обоснованием причин исключения требований, которые не были реализованы. + +Это должно позволить заказчику отчёта о проверке понять контекст проведённого исследования и принять взвешенное решение о том, какой уровень доверия может быть предоставлен приложению. + +Сертифицирующие организации могут выбирать свои методы тестирования, но должны раскрывать их в отчёте и в идеале эти методы должны быть воспроизводимыми. Для проверки различных аспектов (таких как валидация входных данных) в зависимости от приложения и конкретных требований могут использоваться разные методы, например, ручное тестирование на проникновение или анализ исходного кода. + +### Методы тестирования + +Для верификации конкретных требований ASVS может потребоваться применение ряда различных методик. Помимо тестирования на проникновение (с использованием действительных учётных данных для обеспечения полного охвата приложения), проверка соответствия требованиям ASVS может потребовать доступа к документации, исходному коду, конфигурациям, а также к лицам, причастным к процессу разработки. Это особенно актуально для верификации требований Уровней 2 и 3. Стандартной практикой является предоставление убедительных доказательств обнаруженных недостатков с подробным документированием, которое может включать записи тестировщика, скриншоты, скрипты и журналы тестирования. Простого запуска автоматизированного инструмента недостаточно для сертификации, поскольку каждое требование должно быть тщательно протестировано. + +Использование средств автоматизации для верификации требований ASVS — это тема, которая неизменно вызывает значительный интерес. В связи с этим важно прояснить некоторые моменты, связанные с автоматизированным тестированием и тестированием по методу «чёрного ящика». + +#### Роль инструментов автоматизированного тестирования безопасности + +Когда автоматизированные инструменты динамического и статического анализа безопасности приложений (DAST и SAST) корректно интегрированы в pipeline сборки, они могут выявлять некоторые проблемы безопасности, которые не должны существовать в принципе. Однако без тщательной конфигурации и настройки они не обеспечат необходимый охват, а большое количество ложных срабатываний помешает выявлению и устранению реальных проблем безопасности. + +Хотя это может обеспечить покрытие некоторых более базовых и простых технических требований, относящихся к кодированию или нейтрализации выходных данных, крайне важно отметить, что эти инструменты неспособны в полной мере проверить многие из более сложных требований ASVS или тех, что связаны с бизнес-логикой и контролем доступа. + +Что касается менее тривиальных требований, вероятно, что автоматизацию всё же можно задействовать, однако для этого потребуется написание специфичных для приложения проверок. Они могут быть аналогичны модульным и интеграционным тестам, которые организация, возможно, уже использует. Следовательно, может оказаться возможным использовать существующую инфраструктуру автоматизации тестирования для создания этих специализированных тестов под требования ASVS. Хотя для этого потребуются краткосрочные инвестиции, долгосрочные преимущества, связанные с возможностью постоянной верификации этих требований ASVS, будут значительными. + +Подводя итог, автоматизированное тестирование != запуску стандартного инструмента «из коробки». + +#### Роль тестирования на проникновение + +Несмотря на то, что Уровень 1 (L1) в версии 4.0 был оптимизирован для проведения тестирования по методу «чёрного ящика» (без доступа к документации и исходному коду), даже в то время стандарт четко давал понять, что это не является эффективной деятельностью, гарантирующей соответствие, и такой подход не следует активно применять. + +Тестирование без доступа к необходимой дополнительной информации является неэффективным и малорезультативным, поскольку при этом упускается возможность проверки исходного кода, выявления угроз и отсутствующих мер защиты, а также выполнения гораздо более тщательного тестирования в более короткие сроки. + +Настоятельно рекомендуется проводить тестирование на проникновение, основанное на изучении документации и исходного кода (гибридный подход), в ходе которого тестировщики имеют полный доступ к разработчикам приложения и его документации, в отличие от традиционного тестирования на проникновение. Этот подход будет необходимым для верификации многих требований ASVS. diff --git a/5.0/ru/0x05-For-Users-Of-4.0.md b/5.0/ru/0x05-For-Users-Of-4.0.md new file mode 100644 index 0000000000..bd02aecb2d --- /dev/null +++ b/5.0/ru/0x05-For-Users-Of-4.0.md @@ -0,0 +1,90 @@ +# Изменения по сравнению с v4.x + +## Введение + +Пользователям, знакомым со стандартом версии 4.x, может быть полезно ознакомиться с ключевыми изменениями, внесёнными в версию 5.0, включая обновления в содержании, области применения и основополагающей философии. + +Из 286 требований версии 4.0.3 только 11 остались без изменений, в то время как 15 претерпели незначительные грамматические правки, не повлиявшие на их смысл. В общей сложности 109 требований (38%) более не являются отдельными требованиями в версии 5.0 – 50 были просто удалены, 28 удалены как дубликаты и 31 объединено с другими требованиями. Остальные требования были так или иначе пересмотрены. Даже требования, не претерпевшие существенных изменений, имеют новые идентификаторы из-за переупорядочивания или реструктуризации. + +Для облегчения перехода на версию 5.0 предоставляются документы сопоставления, которые помогают пользователям отследить, как требования из версии 4.x соотносятся с требованиями в версии 5.0. Эти сопоставления не привязаны к версиям выпусков и могут при необходимости обновляться или уточняться. + +## Философия требований + +### Целевая область применения + +Версия 4.x включала требования, которые не соответствовали целевой области применения стандарта - они были удалены. Требования, которые не удовлетворяли критериям области применения для версии 5.0 или не поддавались верификации, также были исключены. + +### Акцент на целях безопасности, а не на механизмах + +В версии 4.x многие требования были сфокусированы на конкретных механизмах, а не на лежащих в их основе целях безопасности. В версии 5.0 требования сконцентрированы на целях безопасности, ссылаясь на конкретные механизмы только в тех случаях, когда они являются единственным практическим решением, или предоставляя их в качестве примеров или дополнительного руководства. + +Такой подход допускает разные методы достижения цели, избегая излишних предписаний, которые могли бы ограничить гибкость компаний. + +Кроме того, требования, касающиеся одной и той же проблемы безопасности, были объединены там, где это было необходимо. + +### Документированные решения по безопасности + +Хотя концепция документированных решений по безопасности может показаться новой в версии 5.0, она является развитием более ранних требований, связанных с применением политик и моделированием угроз в версии 4.0. Ранее некоторые требования неявно предполагали проведение анализа для обоснования реализации средств контроля безопасности, такого как определение разрешенных сетевых подключений. + +Чтобы обеспечить доступность необходимой информации для реализации и проверки, эти ожидания теперь явно определены как требования к документации, делая их понятными, практичными и проверяемыми. + +## Структурные изменения и новые главы + +Несколько глав в версии 5.0 представляют полностью новый контент: + +* OAuth и OIDC – Учитывая широкое распространение этих протоколов для делегирования доступа и единого входа, были добавлены специальные требования для решения разнообразных сценариев, с которыми могут столкнуться разработчики. Эта область может в конечном итоге развиться в самостоятельный стандарт, аналогично тому, как это произошло с требованиями для мобильных устройств и IoT в предыдущих версиях. +* WebRTC – Поскольку эта технология набирает популярность, ее уникальные проблемы и аспекты безопасности теперь рассматриваются в отдельном разделе. + +Также были приложены усилия, чтобы обеспечить организацию глав и разделов вокруг логичных наборов связанных требований. + +Эта реструктуризация привела к созданию дополнительных глав: + +* Автономные токены (Self-contained Tokens) – Ранее относящиеся к управлению сессиями, автономные токены теперь признаны самостоятельным механизмом и базовым элементом для взаимодействия без сохранения состояния (такого как в OAuth и OIDC). Ввиду их уникальных аспектов безопасности, они рассматриваются в отдельной главе с некоторыми новыми требованиями, введенными в версии 5.x. +* Безопасность веб-интерфейсов (Web Frontend Security) – В связи с растущей сложностью браузерных приложений и распространением API-ориентированных архитектур, требования к безопасности фронтенда были выделены в отдельную главу. +* Безопасная разработка и архитектура (Secure Coding and Architecture) – Новые требования, касающиеся общих практик безопасности, которые не вписывались в существующие главы, были сгруппированы здесь. + +Другие организационные изменения в версии 5.0 были внесены для уточнения целей. Например, требования к валидации входных данных были помещены рядом с бизнес-логикой, а не с кодировкой и обработкой, отражая их роль в обеспечении соблюдения бизнес-правил. + +Бывшая глава V1 «Архитектура, проектирование и моделирование угроз» была удалена. Ее начальный раздел содержал требования, которые выходили за рамки области проверки, в то время как последующие разделы были перераспределены в соответствующие главы, с удалением дубликатов и уточнениями по мере необходимости. + +## Удаление прямых соответствий с другими стандартами + +Прямые соответствия другим стандартам были удалены из основного тела стандарта. Цель состоит в подготовке соответствия с проектом OWASP Common Requirement Enumeration (CRE), который, в свою очередь, свяжет ASVS с рядом проектов OWASP и внешними стандартами. + +Прямые соответствия CWE и NIST более не поддерживаются, как поясняется ниже. + +### Снижение связи с NIST Digital Identity Guidelines + +Рекомендации NIST [Digital Identity Guidelines (SP 800-63)](https://pages.nist.gov/800-63-3/) долгое время служили ориентиром для средств контроля аутентификации и авторизации. В версии 4.x определенные главы были тесно связаны со структурой и терминологией NIST. + +Хотя эти рекомендации остаются важным ориентиром, строгое соответствие создавало проблемы, включая менее распространенную терминологию, дублирование схожих требований и неполные соответствия. Версия 5.0 отходит от этого подхода для повышения ясности и релевантности. + +### Отступление от Common Weakness Enumeration (CWE) + +[Common Weakness Enumeration (CWE)](https://cwe.mitre.org/) предоставляет полезную систематику уязвимостей программного обеспечения. Однако такие проблемы, как широкие классы CWЕ (category-only CWEs), трудности в сопоставлении требований с отдельным CWE, а также наличие неточных соответствий в версии 4.x, привели к решению отказаться от прямых сопоставлений с CWE в версии 5.0. + +## Переосмысление определений уровней + +Версия 4.x описывала уровни как L1 («Минимальный»), L2 («Стандартный») и L3 («Продвинутый»), с подразумеванием, что все приложения, обрабатывающие конфиденциальные данные, должны соответствовать как минимум L2. + +Версия 5.0 решает несколько проблем этого подхода, которые описаны в следующих параграфах. + +С практической точки зрения, в то время как версия 4.x использовала галочки для обозначения уровней, версия 5.x использует простое число во всех форматах стандарта, включая markdown, PDF, DOCX, CSV, JSON и XML. Для обратной совместимости также генерируются устаревшие версии выводов CSV, JSON и XML, которые все еще используют галочки. + +### Снижение порога входа + +Обратная связь показала, что большое количество требований Уровня 1 (~120) в сочетании с его обозначением как «минимального» уровня, которого недостаточно для большинства приложений, препятствовало внедрению. Цель версии 5.0 — уменьшить этот барьер за счет определения требований Уровня 1 как первого эшелона защиты, благодаря чему они становятся более четкими и их количество сокращается. Чтобы продемонстрировать это численно, в v4.0.3 было 128 требований L1 из общего числа в 278 требований, что составляет 46%. В 5.0.0 насчитывается 70 требований L1 из общего числа в 345 требований, что составляет 20%. + +### Иллюзия проверяемости + +Ключевым фактором при выборе средств контроля для Уровня 1 в версии 4.x была их пригодность для оценки с помощью внешнего тестирования на проникновение по методу «черного ящика». Однако этот подход не был полностью согласован с целью Уровня 1 как минимального набора средств обеспечения безопасности. Некоторые пользователи утверждали, что Уровня 1 недостаточно для защиты приложений, в то время как другие считали его слишком сложным для тестирования. + +Опора на проверяемость как на критерий является относительной и, в ряде случаев, вводящей в заблуждение. Тот факт, что требование является проверяемым, не гарантирует, что его можно проверить автоматизированным или простым способом. Более того, наиболее легко проверяемые требования не всегда являются теми, которые оказывают наибольшее влияние на безопасность или которые проще всего реализовать. + +Таким образом, в версии 5.0 решения об уровнях принимались в первую очередь с целью снижения рисков, а также с учетом необходимых усилий по реализации. + +### Не только оценка рисков + +Использование предписывающих уровней, основанных на оценке риска, которые устанавливают определенный уровень для определенных приложений, оказалось слишком жестким. На практике расстановка приоритетов и внедрение средств безопасности зависят от множества факторов, включая как снижение рисков, так и усилия, необходимые для реализации. + +Следовательно, организациям следует стремиться к достижению того уровня, который они считают необходимым, исходя из своей зрелости и ценностей, которые они хотят демонстрировать своим клиентам. diff --git a/5.0/ru/0x10-V1-Encoding-and-Sanitization.md b/5.0/ru/0x10-V1-Encoding-and-Sanitization.md new file mode 100644 index 0000000000..83d23a0ab8 --- /dev/null +++ b/5.0/ru/0x10-V1-Encoding-and-Sanitization.md @@ -0,0 +1,103 @@ +# V1 Кодировка и нейтрализация + +## Задачи контроля + +В этой главе рассматриваются наиболее распространенные уязвимости безопасности веб-приложений, связанные с небезопасной обработкой недоверенных (пользовательских) данных. Такие уязвимости могут привести к различным техническим уязвимостям, где такие данные интерпретируются в соответствии с правилами синтаксиса соответствующего интерпретатора. + +Для современных веб-приложений всегда лучше использовать более архитектурно безопасные API, такие как параметризованные запросы, автоматическое экранирование или шаблонные фреймворки. В ином случае, самостоятельное тщательное выполнение кодирования выходных данных, экранирование или нейтрализация становятся критически важными для безопасности приложения. + +Валидация входных данных служит механизмом многослойной/глубокоэшелонированной (defense‑in‑depth) защиты от неожидаемого или опасного контента. Однако, поскольку ее основная цель заключается в обеспечении соответствия входящих данных функциональным и бизнес-ожиданиям, требования, связанные с этим, можно найти в главе «Валидация и бизнес-логика». + +## V1.1 Архитектура кодировки и нейтрализации + +В разделах ниже приведены требования для синтаксиса или интерпретатора, предназначенные для безопасной обработки небезопасного содержимого и предотвращения уязвимостей безопасности. Требования в этом разделе охватывают порядок, в котором должна происходить эта обработка, и где она должна происходить. Они также направлены на то, чтобы гарантировать, что при каждом сохранении данных они остаются в своем исходном состоянии и не хранятся в закодированной или экранированной форме (например, кодировка HTML), чтобы предотвратить проблемы с двойным кодированием. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **1.1.1** | Убедитесь, что входные данные декодируются или деэкранируются в каноническую форму (в стандартное представление) только один раз. Декодирование происходит только тогда, когда ожидаются закодированные данные в этой форме, и что это делается перед дальнейшей обработкой входных данных, например, это не выполняется после проверки или нейтрализации. | 2 | +| **1.1.2** | Убедитесь, что приложение выполняет кодирование и экранирование выходных данных либо в качестве последнего шага перед использованием интерпретатором, для которого оно предназначено, либо самим интерпретатором. | 2 | + +## V1.2 Предотвращение инъекций + +Кодирование или экранирование выходных данных, выполняемое близко или смежно с потенциально опасным контекстом, критично для безопасности любого приложения. Обычно кодирование и экранирование выходных данных не сохраняется, а вместо этого используется для обеспечения безопасности выходных данных для немедленного использования в соответствующем интерпретаторе. Попытка выполнить это на более ранних этапах может привести к искажению содержимого или неэффективно отобразить кодирование или экранирование. + +Во многих случаях библиотеки программного обеспечения включают более или полностью безопасные функции, которые выполняют это автоматически, хотя необходимо убедиться, что они корректны для текущего контекста. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **1.2.1** | Убедитесь, что выходная кодировка для ответа HTTP, документа HTML или документа XML соответствует требуемому контексту, например, кодировка соответствующих символов для элементов HTML, атрибутов HTML, комментариев HTML, CSS или полей заголовка HTTP делается таким способом, чтобы избежать изменения структуры сообщения или документа. | 1 | +| **1.2.2** | Убедитесь, что при динамическом построении URL-адресов недоверенные данные кодируются в соответствии с их контекстом (например, кодирование URL-адресов или кодирование base64url для query или path параметров или пути). Убедитесь, что разрешены только безопасные протоколы URL-адресов (например, запрещен javascript: или data:). | 1 | +| **1.2.3** | Убедитесь, что при динамическом построении содержимого JavaScript (включая JSON) используется кодирование или экранирование выходных данных, чтобы избежать изменения структуры сообщения или документа (чтобы избежать JavaScript и JSON-инъекций). | 1 | +| **1.2.4** | Убедитесь, что выборка данных (Redis, Memcached, чтение из файлов, обращение по API) или запросы к базе данных (например, SQL, HQL, NoSQL, Cypher) используют параметризованные запросы, ORM, Entity Frameworks или иным образом защищены от SQL-инъекций и других атак. Это также актуально при написании хранимых процедур. | 1 | +| **1.2.5** | Убедитесь, что приложение защищено от внедрения команд ОС и что вызовы операционной системы используют параметризованные запросы к ОС или используют контекстное кодирование вывода командной строки. | 1 | +| **1.2.6** | Убедитесь, что приложение защищено от LDAP-инъекций, или что реализованы специальные меры безопасности для их предотвращения. | 2 | +| **1.2.7** | Убедитесь, что приложение защищено от атак с использованием XPath-инъекций с помощью параметризации запросов или предварительно скомпилированных запросов. | 2 | +| **1.2.8** | Убедитесь, что процессоры LaTeX настроены безопасно (например, не используется флаг «–shell‑escape») и используется разрешенный список команд для предотвращения LaTeX-инъекций. | 2 | +| **1.2.9** | Убедитесь, что приложение экранирует специальные символы в регулярных выражениях (обычно с помощью обратной косой черты), чтобы предотвратить их ошибочную интерпретацию как метасимволов. | 2 | +| **1.2.10** | Убедитесь, что приложение защищено от внедрения формул CSV (CSV Injection). Приложение должно следовать правилам экранирования, определенным в RFC 4180, разделы 2.6 и 2.7, при экспорте содержимого CSV. Кроме того, при экспорте в CSV или другие форматы электронных таблиц (такие как XLS, XLSX или ODF) специальные символы (включая '=', '+', '-', '@', '\t' (табуляция), и '\0' (нулевой символ)) должны экранироваться одинарной кавычкой, если они появляются в качестве первого символа в значении поля. | 3 | + +Примечание: Использование параметризованных запросов или экранирование SQL не всегда достаточно. Части запроса, такие как имена таблиц и столбцов (включая имена столбцов «ORDER BY»), не могут быть экранированы. Включение экранированных пользовательских данных в эти поля приводит к сбоям запросов или SQL-инъекции. + +## V1.3 Нейтрализация + +Идеальной защитой от использования недоверенных данных в небезопасном контексте является использование контекстно-зависимого кодирования или экранирования, которое сохраняет то же семантическое значение небезопасного контента, но делает его безопасным для использования в этом конкретном контексте, как обсуждалось более подробно в предыдущем разделе. + +Если это невозможно, необходима нейтрализация, удаляющая потенциально опасные символы или данные. В некоторых случаях это может изменить семантическое значение ввода, но по соображениям безопасности альтернативы может не быть. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **1.3.1** | Убедитесь, что все ненадежные входные данные HTML из редакторов WYSIWYG или аналогичных программ нейтрализуются с помощью известных и безопасных библиотек или функций фреймворка для санитизации HTML. | 1 | +| **1.3.2** | Убедитесь, что приложение избегает использования eval() или других динамических функций выполнения кода, таких как Spring Expression Language (SpEL). Если нет альтернативы, любой пользовательский ввод должен быть нейтрализован перед выполнением. | 1 | +| **1.3.3** | Убедитесь, что данные, передаваемые в потенциально опасный контекст, предварительно нейтрализованы, чтобы обеспечить соблюдение мер безопасности, таких как разрешение только тех символов, которые безопасны для данного контекста, и обрезка слишком длинного ввода. | 2 | +| **1.3.4** | Убедитесь, что предоставленный пользователем файл .SVG проверен или нейтрализован, чтобы он содержал только теги и атрибуты (например, относящиеся к рисованию), которые безопасны для приложения, например, не содержат скриптов и foreignObject. | 2 | +| **1.3.5** | Убедитесь, что приложение нейтралует или отключает предоставленные пользователем скриптовые данные или выражения шаблонных языков, такие как таблицы стилей Markdown, CSS или XSL, BBCode или аналогичные. | 2 | +| **1.3.6** | Убедитесь, что приложение защищено от атак с подделкой запросов на стороне сервера (SSRF), проверяя ненадежные данные по разрешенному списку протоколов, доменов, путей и портов, а также нейтрализуя потенциально опасные символы перед использованием данных для вызова другой службы. | 2 | +| **1.3.7** | Убедитесь, что приложение защищено от атак с внедрением шаблонов (template injection), не позволяя создавать шаблоны на основе недоверенных входных данных. Если нет альтернативы, любые недоверенные входные данные, включаемые динамически во время создания шаблона, должны быть нейтрализованы или тщательно провалидированы. | 2 | +| **1.3.8** | Убедитесь, что приложение надлежащим образом нейтрализует недоверенные входные данные перед использованием в запросах Java Naming and Directory Interface (JNDI) и что JNDI настроен безопасно для предотвращения атак с использованием JNDI-инъекций. | 2 | +| **1.3.9** | Убедитесь, что приложение нейтрализует данные перед отправкой в Memcache, чтобы предотвратить атаки методом инъекций. | 2 | +| **1.3.10** | Убедитесь, что строки форматирования, которые могут быть использованы неожидаемым или вредоносным образом, нейтрализуются перед дальнейшим использованием. | 2 | +| **1.3.11** | Убедитесь, что приложение нейтрализует вводимые пользователем данные перед передачей в почтовые системы для защиты от SMTP или IMAP-инъекций. | 2 | +| **1.3.12** | Убедитесь, что регулярные выражения не содержат элементов, вызывающих экспоненциальный возврат, и убедитесь в нейтрализации недоверенных входных данных для предотвращения атак ReDoS или Runaway Regex. | 3 | + +## V1.4 Память, строки и неуправляемый код + +Следующие требования касаются рисков, связанных с небезопасным использованием памяти, которые обычно применяются, когда приложение использует системный язык или неуправляемый код. + +В некоторых случаях этого можно добиться, установив флаги компилятора, которые включают защиту от переполнения буфера и предупреждения, включая рандомизацию стека и предотвращение выполнения данных, и которые прерывают сборку, если обнаружены небезопасные операции с указателем, памятью, строкой формата, целым числом или строкой. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **1.4.1** | Убедитесь, что для обнаружения или предотвращения ситуаций переполнения стека, буфера или кучи приложение учитывает размер доступной области памяти при строковых операциях, копировании в память, в арифметике указателей и т.п. | 2 | +| **1.4.2** | Убедитесь, что для предотвращения целочисленного переполнения применяется контроль знака, диапазона и типа допустимых входных данных. | 2 | +| **1.4.3** | Убедитесь, что динамически выделенная память и ресурсы освобождены, а ссылки или указатели на освобожденную память удалены или установлены в значение null, чтобы предотвратить появление висячих указателей и уязвимостей, связанных с использованием памяти после освобождения. | 2 | + +## V1.5 Безопасная десериализация + +Преобразование данных из сохраненного или переданного представления в фактические объекты приложения (десериализация) исторически было причиной различных уязвимостей внедрения кода. Важно выполнять этот процесс осторожно и безопасно, чтобы избежать подобных проблем. + +В частности, некоторые методы десериализации были определены в документации по языку программирования или фреймворку как небезопасные и не могут безопасно применяться с недоверенными данными. Для каждого используемого механизма следует проводить тщательную проверку. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **1.5.1** | Убедитесь, что приложение настраивает XML-парсеры на использование строгой конфигурации и что небезопасные функции, такие как разрешение внешних сущностей, отключены для предотвращения атак XML eXternal Entity (XXE). | 1 | +| **1.5.2** | Убедитесь, что десериализация недоверенных данных обеспечивает безопасную обработку ввода, например, используя список разрешенных типов объектов или ограничивая типы объектов, определяемые клиентом, для предотвращения атак десериализации. Механизмы десериализации, которые явно определены как небезопасные, не должны использоваться с недоверенным вводом. | 2 | +| **1.5.3** | Убедитесь, что различные парсеры, используемые в приложении для одного и того же типа данных (например, парсеры JSON, XML, URL), выполняют парсинг согласованным образом и используют один и тот же механизм кодирования символов, чтобы избежать таких проблем, как уязвимости взаимодействия JSON (JSON Interoperability) или различное поведение анализа URI или файлов, которые могут использоваться в атаках удаленного включения файлов (RFI) или подделки запросов на стороне сервера (SSRF). | 3 | + +## Ссылки + +Для дополнительной информации см. также: + +* [OWASP LDAP Injection Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html) +* [OWASP Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) +* [OWASP DOM Based Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html) +* [OWASP XML External Entity Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html) +* [OWASP Web Security Testing Guide: Client-Side Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/11-Client-side_Testing) +* [OWASP Java Encoding Project](https://owasp.org/owasp-java-encoder/) +* [DOMPurify - Client-side HTML Sanitization Library](https://github.com/cure53/DOMPurify) +* [RFC4180 - Common Format and MIME Type for Comma-Separated Values (CSV) Files](https://datatracker.ietf.org/doc/html/rfc4180#section-2) + +Для более подробной информации о проблемах сериализации и парсинга см. также: + +* [OWASP Deserialization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) +* [An Exploration of JSON Interoperability Vulnerabilities](https://bishopfox.com/blog/json-interoperability-vulnerabilities) +* [Orange Tsai - A New Era of SSRF Exploiting URL Parser In Trending Programming Languages](https://www.blackhat.com/docs/us-17/thursday/us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf) diff --git a/5.0/ru/0x11-V2-Validation-and-Business-Logic.md b/5.0/ru/0x11-V2-Validation-and-Business-Logic.md new file mode 100644 index 0000000000..2a2e4d18ed --- /dev/null +++ b/5.0/ru/0x11-V2-Validation-and-Business-Logic.md @@ -0,0 +1,73 @@ +# V2 Валидация и бизнес-логика + +## Задачи контроля + +Цель этой главы — убедиться, что проверенное приложение соответствует следующим высокоуровневым целям: + +* Входные данные, полученные приложением, соответствуют бизнес- или функциональным ожиданиям. +* Поток бизнес-логики последователен, выполняется по порядку и не может быть обойден. +* Бизнес-логика содержит ограничения и механизмы для обнаружения и предотвращения автоматизированных атак, таких как постоянные небольшие переводы средств или добавление миллиона друзей по одному за раз. +* Критически важные потоки бизнес-логики учитывают случаи злоупотреблений и действий злоумышленников и имеют защиту от подмены, подделки, раскрытия информации и атак с повышением привилегий. + +## V2.1 Документация валидации и бизнес-логики + +Документация по валидации и бизнес-логике должна четко определять ограничения бизнес-логики, правила валидации и контекстную согласованность объединенных данных, чтобы было понятно, что необходимо реализовать в приложении. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **2.1.1** | Убедитесь, что в документации приложения определены правила проверки входных данных на соответствие ожидаемой структуре. Это могут быть распространённые форматы данных, такие как номера кредитных карт, адреса электронной почты, номера телефонов, или внутренний формат данных. | 1 | +| **2.1.2** | Убедитесь, что в документации приложения указано, как проверять логическую и контекстную согласованность объединенных данных, например, проверять соответствие района и почтового индекса. | 2 | +| **2.1.3** | Убедитесь, что ожидания относительно ограничений и проверок бизнес-логики задокументированы как для уровня отдельного пользователя, так и для глобального уровня всего приложения. | 2 | + +## V2.2 Валидация ввода + +Эффективные средства контроля валидации входных данных обеспечивают соответствие бизнес- или функциональных ожиданий приложения относительно типа данных. Такой контроль валидации обеспечивает высокое качество данных и уменьшает поверхность атаки. Однако такой контроль не устраняет и не заменяет необходимость использования корректного кодирования, параметризации или санитизации данных при использовании данных в другом компоненте или для их представления для вывода. + +В данном контексте «входные данные» могут поступать из самых разных источников, включая поля HTML-форм, запросы REST, параметры URL, поля заголовков HTTP, файлы cookie, файлы на диске, базы данных и внешние API. + +Механизм бизнес-логики может проверять, что конкретное входное значение представляет собой число меньше 100. Функционал будет проверять и ожидать, что число ниже определенного порогового значения, поскольку это число определяет количество повторений конкретного цикла, а большое значение может привести к чрезмерной нагрузке и потенциальному отказу в обслуживании. + +Хотя валидация по схеме явно не предписана, она может быть наиболее эффективным механизмом для полного охвата валидацией HTTP API или других интерфейсов, использующих JSON или XML. + +Обратите внимание на следующие моменты при валидации по схеме: + +* «Опубликованная версия» спецификации валидации по JSON-схеме считается готовой к использованию, но, грубо говоря, «нестабильной». При использовании валидации по JSON-схеме убедитесь в отсутствии расхождений с приведенными ниже требованиями. +* Любые используемые библиотеки валидации по JSON-схеме также следует отслеживать и при необходимости обновлять после формализации стандарта. +* Валидацию DTD не следует использовать, а оценку DTD фреймворка следует отключить, чтобы избежать проблем с атаками XXE на DTD. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **2.2.1** | Убедитесь, что входные данные провалидированы для обеспечения соответствия бизнес- или функциональным ожиданиям. Валидация должна осуществляться либо по списку допустимых значений, шаблонов и диапазонов, либо путем сравнения входных данных с ожидаемой структурой и логическими ограничениями в соответствии с предопределенными правилами. Для L1 валидация может быть сосредоточена на входных данных, используемых для принятия конкретных бизнес-решений или решений, связанных с безопасностью. Для L2 и выше это должно применяться ко всем входным данным. | 1 | +| **2.2.2** | Убедитесь, что приложение разработано с принудительной валидацией входных данных на уровне доверенного сервиса. Хотя проверка на стороне клиента повышает удобство использования и должна поощряться, на неё не следует полагаться как на средство контроля безопасности. | 1 | +| **2.2.3** | Убедитесь, что приложение обеспечивает обоснованность комбинаций данных в соответствии с предопределенными правилам. Например: возраст должен соответствовать дате рождения; страна и почтовый индекс; количество товара в заказе и на складе. | 2 | + +## V2.3 Безопасность бизнес-логики + +В этом разделе рассматриваются ключевые требования, гарантирующие, что приложение обеспечит корректное выполнение процессов бизнес-логики и не будет уязвимо для атак, использующих логику и поток работы приложения. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **2.3.1** | Убедитесь, что приложение обрабатывает потоки бизнес-логики для одного и того же пользователя в ожидаемом последовательном порядке шагов и без пропуска шагов. | 1 | +| **2.3.2** | Убедитесь, что ограничения бизнес-логики реализованы в соответствии с документацией приложения, чтобы избежать эксплуатации её недостатков. | 2 | +| **2.3.3** | Убедитесь, что транзакции используются на уровне бизнес-логики таким образом, что операция бизнес-логики либо выполняется полностью, либо откатывается к предыдущему корректному состоянию. | 2 | +| **2.3.4** | Убедитесь, что на уровне бизнес-логики используются механизмы блокировки, чтобы гарантировать невозможность двойного бронирования ограниченных по количеству ресурсов (например, мест в театре или слотов доставки) путем манипулирования логикой приложения. | 2 | +| **2.3.5** | Убедитесь, что для важных потоков бизнес-логики требуется многопользовательское (multi-user) одобрение, чтобы предотвратить несанкционированные или случайные действия. Потоки бизнес-логики могут включать, помимо прочего, крупные денежные переводы, утверждение контрактов, доступ к секретной информации или обход ограничений безопасности на производстве. | 3 | + +## V2.4 Анти-автоматизация + +В этом разделе представлены меры по борьбе с автоматизацией, гарантирующие необходимость взаимодействия, аналогичного человеческому, и предотвращают чрезмерные автоматизированные запросы. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **2.4.1** | Убедитесь, что используются средства противодействия автоматизации для защиты от чрезмерных вызовов функций приложения, которые могут привести к утечке данных, созданию ненужных данных, исчерпанию квот, нарушению ограничений скорости, отказу в обслуживании или чрезмерному использованию дорогостоящих ресурсов. | 2 | +| **2.4.2** | Убедитесь, что потоки бизнес-логики требуют реалистичного человеческого времени, предотвращая чрезмерно быструю отправку транзакций. | 3 | + +## Ссылки + +Для дополнительной информации см. также: + +* [OWASP Web Security Testing Guide: Input Validation Testing](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/README.html) +* [OWASP Web Security Testing Guide: Business Logic Testing](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/10-Business_Logic_Testing/README) +* Анти-автоматизация может быть достигнута разными путями, включая применение [OWASP Automated Threats to Web Applications](https://owasp.org/www-project-automated-threats-to-web-applications/) +* [OWASP Input Validation Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html) +* [JSON Schema](https://json-schema.org/specification.html) diff --git a/5.0/ru/0x12-V3-Web-Frontend-Security.md b/5.0/ru/0x12-V3-Web-Frontend-Security.md new file mode 100644 index 0000000000..0215d4a612 --- /dev/null +++ b/5.0/ru/0x12-V3-Web-Frontend-Security.md @@ -0,0 +1,100 @@ +# V3 Безопасность веб-интерфейса + +## Задачи контроля + +Эта категория фокусируется на требованиях, направленных на защиту от атак, воспроизводимых через веб-интерфейс. Эти требования не применяются к решениям «машина-машина». + +## V3.1 Документация по безопасности веб-интерфейса + +В этом разделе описываются функции безопасности браузера, которые должны быть описаны в документации приложения. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **3.1.1** | Убедитесь, что в документации приложения описаны ожидаемые функции безопасности, которые должны поддерживать браузеры, использующие приложение (такие как HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) и другие соответствующие механизмы безопасности HTTP). В документации также должно быть обязательно определено, как приложение должно себя вести, если некоторые из этих функций недоступны (например, предупреждать пользователя или блокировать доступ). | 3 | + +## V3.2 Непреднамеренная интерпретация контента + +Отображение контента или функциональности в неправильном контексте может привести к выполнению или отображению вредоносного контента. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **3.2.1** | Убедитесь, что реализованы меры безопасности, предотвращающие отображение контента или функций браузерами в HTTP-ответах в некорректном контексте (например, запрос API, загруженный пользователем файл или другой ресурс запрашивается напрямую). Возможные способы контроля включают: не обрабатывать содержимое, если поля заголовка HTTP-запроса (например, Sec-Fetch-*) не указывают на корректность контекста; использование заголовка и значения Content-Security-Policy: sandbox directive; или использование заголовка и значения Content-Disposition: attachment. | 1 | +| **3.2.2** | Убедитесь, что данные, предназначенные для отображения в виде текста, а не визуализации в виде HTML, обрабатывается с использованием безопасных функций визуализации (таких как createTextNode или textContent), чтобы предотвратить непреднамеренное выполнение содержимого, такого как HTML или JavaScript. | 1 | +| **3.2.3** | Убедитесь, что приложение избегает затирания DOM при использовании JavaScript на стороне клиента, применяя явные объявления переменных, выполняя строгую проверку типов, избегая сохранения глобальных переменных в объекте документа и реализуя изоляцию пространства имен. | 3 | + +## V3.3 Настройка файлов cookie + +В этом разделе изложены требования к безопасной настройке чувствительных cookie, позволяющие обеспечить более высокий уровень уверенности в том, что они были созданы самим приложением, а также предотвратить утечку или ненадлежащее изменение их содержимого. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **3.3.1** | Убедитесь, что у файлов cookie установлен атрибут «Secure», и если префикс «__Host‑» не используется в названии cookie, необходимо использовать префикс «__Secure‑». | 1 | +| **3.3.2** | Убедитесь, что значение атрибута SameSite каждой cookie установлено в соответствии с назначением cookie, чтобы ограничить подверженность атакам на восстановление пользовательского интерфейса и атакам с подделкой запросов на уровне браузера, обычно называемым подделкой межсайтовых запросов (CSRF). | 2 | +| **3.3.3** | Убедитесь, что cookie имеют префикс «__Host‑» в названии, если только они явно не предназначены для совместного использования с другими хостами. | 2 | +| **3.3.4** | Убедитесь, что если значение cookie не должно быть доступно для клиентских скриптов (например, сессионный токен), для cookie должен быть установлен атрибут «HttpOnly», а само значение должно передаваться клиенту только через поле заголовка «Set-Cookie». | 2 | +| **3.3.5** | Убедитесь, что при записи cookie приложением общая длина имени и значения cookie не превышает 4096 байт. Слишком большие cookie не будут сохраняться браузером и, следовательно, не будут отправляться с запросами, что помешает пользователю использовать функции приложения, зависящие от этого cookie. | 3 | + +## V3.4 Заголовки механизма безопасности браузера + +В этом разделе описывается, какие заголовки безопасности следует устанавливать в HTTP-ответах, чтобы включить функции безопасности браузера и ограничения при обработке ответов от приложения. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **3.4.1** | Убедитесь, что поле заголовка Strict‑Transport‑Security включено во все ответы для реализации политики HTTP Strict Transport Security (HSTS). Необходимо указать максимальное время не менее 1 года, а для L2 и выше политика должна применяться также ко всем поддоменам. | 1 | +| **3.4.2** | Убедитесь, что поле заголовка Cross‑Origin Resource Sharing (CORS) «Access‑Control‑Allow‑Origin» имеет фиксированное значение, заданное приложением, или, если используется заголовок Origin, оно проверяется по списку доверенных источников. При необходимости использования «Access‑Control‑Allow‑Origin: *» убедитесь, что ответ не содержит конфиденциальной информации. | 1 | +| **3.4.3** | Убедитесь, что HTTP-ответы содержат поле заголовка Content-Security-Policy, которое определяет директивы, гарантирующие загрузку и выполнение браузером только доверенного контента или ресурсов, чтобы ограничить выполнение вредоносного JavaScript. Как минимум, необходимо использовать глобальную политику, включающую директивы object-src «none» и base-uri «none», а также определяющую список разрешенных адресов или использующую одноразовые коды или хэши. Для приложений L3 необходимо определить политику использования 'nonce' или hash-конструкций для каждого ответа. | 2 | +| **3.4.4** | Убедитесь, что все HTTP-ответы содержат поле заголовка «X‑Content‑Type‑Options: nosniff». Это предписывает браузерам не использовать анализ контента и определение типа MIME для данного ответа, а также требовать, чтобы значение поля заголовка Content‑Type в ответе соответствовало целевому ресурсу. Например, ответ на запрос стиля принимается только в том случае, если Content‑Type в ответе — «text/css». Это также позволяет браузеру использовать функцию Cross‑Origin Read Blocking (CORB). | 2 | +| **3.4.5** | Убедитесь, что приложение устанавливает политику реферера для предотвращения утечки технически конфиденциальных данных сторонним сервисам через поле заголовка HTTP-запроса «Referer». Это можно сделать с помощью поля заголовка HTTP-ответа «Referrer‑Policy» или через атрибуты HTML-элемента. Конфиденциальные данные могут включать путь и данные запроса в URL-адресе, а для внутренних непубличных приложений также имя хоста. | 2 | +| **3.4.6** | Убедитесь, что веб-приложение использует директиву frame‑ancestors поля заголовка Content‑Security‑Policy для каждого HTTP-ответа, чтобы гарантировать невозможность его внедрения по умолчанию и внедрение определённых ресурсов разрешено только при необходимости. Обратите внимание, что поле заголовка X‑Frame‑Options, хотя и поддерживается браузерами, устарело и не может быть использовано в качестве основы. | 2 | +| **3.4.7** | Убедитесь, что в поле заголовка Content‑Security‑Policy указано место, куда следует сообщать о нарушениях. | 3 | +| **3.4.8** | Убедитесь, что все HTTP-ответы, инициирующие рендеринг документа (например, ответы с типом содержимого text/html), включают поле заголовка Cross-Origin-Opener-Policy с директивой same-origin или same-origin-allow-popups (при необходимости). Это предотвращает атаки, злоупотребляющие общим доступом к объектам Window, такие как Tabnabbing и Frame Counting. | 3 | + +## V3.5 Браузерное разделение источников + +Принимая запрос к чувствительному функционалу на стороне сервера, приложение должно убедиться, что запрос инициирован самим приложением или доверенной стороной и не был подделан злоумышленником. + +К чувствительному функционалу в данном контексте могут относиться принятие форм POST для аутентифицированных и неаутентифицированных пользователей (например, запрос аутентификации), операции по изменению состояния или ресурсоемкие функции (например, экспорт данных). + +Ключевыми средствами защиты здесь являются политики безопасности браузера, такие как Same Origin Policy для JavaScript и логика SameSite для cookie. Другим распространённым средством защиты является механизм предварительной проверки CORS. Этот механизм критически важен для конечных точек, спроектированных и предназначенных, чтобы вызываться из другого источника, но он также может быть полезным механизмом предотвращения подделки запросов для конечных точек, которые не предназначены для вызова из другого источника. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **3.5.1** | Убедитесь, что, если приложение не использует механизм предварительной проверки CORS для предотвращения запрещённых кросс-доменных запросов на использование чувствительного функционала, эти запросы валидируются на предмет их происхождения от самого приложения. Это можно сделать, используя и проверяя специальные токены для защиты от подделки или требуя дополнительные поля HTTP-заголовка, не входящие в список «простых заголовков» (CORS-safelisted request-header). Это необходимо для защиты от атак с подделкой запросов через браузер, широко известных как межсайтовая подделка запросов (CSRF). | 1 | +| **3.5.2** | Убедитесь, что если приложение использует механизм предварительной проверки CORS для предотвращения неразрешённого использования чувствительного функционала между источниками, вызов этого функционала невозможен с помощью запроса, который не запускает предварительную проверку CORS. Для этого может потребоваться проверка значений полей заголовка запроса «Origin» и «Content-Type» или использование дополнительного поля заголовка, не входящего в безопасный список CORS. | 1 | +| **3.5.3** | Убедитесь, что HTTP-запросы к чувствительному функционалу используют соответствующие HTTP-методы, такие как POST, PUT, PATCH или DELETE, а не методы, определённые спецификацией HTTP как «безопасные», такие как HEAD, OPTIONS или GET. В качестве альтернативы можно использовать строгую валидацию полей заголовка запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, навигационного запроса или загрузки ресурса (например, источника изображения), где это не ожидается. | 1 | +| **3.5.4** | Убедитесь, что отдельные приложения размещены на разных именах хостов, чтобы использовать ограничения, предусмотренные политикой same-origin, включая то, как документы или скрипты, загруженные одним источником, могут взаимодействовать с ресурсами из другого источника, а также ограничения на cookie на основе имени хоста. | 2 | +| **3.5.5** | Убедитесь, что сообщения, полученные интерфейсом postMessage, отвергаются, если источник сообщения не является доверенным или если синтаксис сообщения недействителен. | 2 | +| **3.5.6** | Убедитесь, что функциональность JSONP не включена нигде в приложении, чтобы избежать атак с использованием межсайтового включения скриптов (XSSI). | 3 | +| **3.5.7** | Убедитесь, что данные, требующие авторизации, не включены в ответы ресурсов скриптов, таких как файлы JavaScript, чтобы предотвратить атаки с использованием межсайтового включения скриптов (XSSI). | 3 | +| **3.5.8** | Убедитесь, что аутентифицированные ресурсы (такие как изображения, видео, скрипты и другие документы) могут быть загружены или внедрены от имени пользователя только по назначению. Этого можно добиться путём строгой валидации полей заголовка HTTP-запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, или путём установки ограничительного поля заголовка HTTP-ответа Cross‑Origin‑Resource‑Policy, чтобы браузер блокировал возвращаемый контент. | 3 | + +## V3.6 Целостность внешних ресурсов + +В этом разделе приведены рекомендации по безопасному размещению контента на сторонних сайтах. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **3.6.1** | Убедитесь, что клиентские ресурсы, такие как библиотеки JavaScript, CSS или веб-шрифты, размещаются только на внешнем сервере (например, в сети доставки контента (Content Delivery Network)), если ресурс статический и имеет версии, а для проверки целостности ресурса используется механизм проверки целостности подресурсов (SRI). Если это невозможно, для каждого ресурса должно быть задокументировано решение по безопасности, обосновывающее это. | 3 | + +## V3.7 Другие соображения по безопасности браузера + +В этом разделе рассматриваются различные другие элементы управления безопасностью и современные функции безопасности браузера, необходимые для обеспечения безопасности браузера на стороне клиента. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **3.7.1** | Убедитесь, что приложение использует только те клиентские технологии, которые по-прежнему поддерживаются и считаются безопасными. Примерами технологий, не соответствующих этому требованию, являются плагины NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL или клиентские Java-апплеты. | 2 | +| **3.7.2** | Убедитесь, что приложение будет автоматически перенаправлять пользователя на другое имя хоста или домен (который не контролируется приложением), только если этот хост или домен указаны в списке разрешенных. | 2 | +| **3.7.3** | Убедитесь, что приложение отображает уведомление, что пользователь перенаправляется на URL-адрес, находящийся вне контроля приложения, с возможностью отмены навигации. | 3 | +| **3.7.4** | Убедитесь, что домен верхнего уровня приложения (например, site.tld) ​​добавлен в публичный список предварительной загрузки (preload list) для HTTP Strict Transport Security (HSTS). Это гарантирует, что использование TLS для приложения будет встроено непосредственно в основные браузеры, а не будет полагаться только на поле заголовка ответа Strict-Transport-Security. | 3 | +| **3.7.5** | Убедитесь, что приложение ведет себя так, как описано в документации (например, предупреждает пользователя или блокирует доступ), если браузер, используемый для доступа к приложению, не поддерживает ожидаемые функции безопасности. | 3 | + +## Ссылки + +Для дополнительной информации см. также: + +* [Set-Cookie __Host- prefix details](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#cookie_prefixes) +* [OWASP Content Security Policy Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html) +* [OWASP Secure Headers Project](https://owasp.org/www-project-secure-headers/) +* [OWASP Cross-Site Request Forgery Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html) +* [HSTS Browser Preload List submission form](https://hstspreload.org/) +* [OWASP DOM Clobbering Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/DOM_Clobbering_Prevention_Cheat_Sheet.html) diff --git a/5.0/ru/0x13-V4-API-and-Web-Service.md b/5.0/ru/0x13-V4-API-and-Web-Service.md new file mode 100644 index 0000000000..ca15f7df32 --- /dev/null +++ b/5.0/ru/0x13-V4-API-and-Web-Service.md @@ -0,0 +1,64 @@ +# V4 API и Веб-сервис + +## Задачи контроля + +Существует несколько моментов, применимых только к приложениям, предоставляющим API для использования веб-браузерами или другими клиентами (обычно с использованием JSON, XML или GraphQL). В этой главе рассматриваются соответствующие настройки и механизмы безопасности, которые следует применять. + +Обратите внимание, что вопросы аутентификации, управления сессиями и проверки входных данных, рассмотренные в других главах, также относятся к API. Поэтому эту главу нельзя рассматривать изолированно или тестировать отдельно. + +## V4.1 Общая безопасность веб-сервисов + +В этом разделе рассматриваются общие вопросы безопасности веб-сервисов и базовые практики гигиены веб-сервисов. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **4.1.1** | Убедитесь, что каждый HTTP-ответ с телом сообщения содержит заголовок Content-Type, который соответствует фактическому содержимому ответа, таким как «text/», «/+xml» и «/xml», включая параметр charset для указания безопасной кодировки символов (например, UTF-8, ISO-8859-1) согласно IANA Media Types. | 1 | +| **4.1.2** | Убедитесь, что только конечные точки, предназначенные для взаимодействия с пользователем через веб-браузер, автоматически перенаправляют HTTP на HTTPS, в то время как другие сервисы или конечные точки не реализуют прозрачные редиректы. Это необходимо, чтобы избежать ситуации, когда клиент ошибочно отправляет незашифрованные HTTP-запросы а из-за того, что запрос по HTTP автоматически перенаправляется на HTTPS другим сервисом без обработки на входе, утечка чувствительных данных остаётся незамеченной. | 2 | +| **4.1.3** | Убедитесь, что любой HTTP-заголовок, используемый приложением и устанавливаемый промежуточным уровнем, таким как балансировщик нагрузки, веб-прокси или backend-for-frontend сервис, не может быть переопределён конечным пользователем. Примеры заголовков: X-Real-IP, X-Forwarded-*, X-User-ID. | 2 | +| **4.1.4** | Убедитесь, что разрешены только HTTP-методы, которые явно поддерживаются приложением или его API (включая OPTIONS для preflight-запросов), а неиспользуемые методы заблокированы. | 3 | +| **4.1.5** | Убедитесь, что для особо чувствительных запросов или транзакций, проходящих через несколько систем, используются цифровые подписи на уровне сообщений, дополнительно к транспортным средствам защиты. | 3 | + +## V4.2 Валидация структуры HTTP-сообщений + +Этот раздел объясняет, как должна проверяться структура и заголовки HTTP-сообщений, чтобы предотвратить атаки типа request smuggling, response splitting, header injection и отказ в обслуживании из-за слишком длинных HTTP-сообщений. + +Эти требования актуальны для обработки и генерации HTTP-сообщений в целом, но особенно важны при конвертации сообщений между разными версиями HTTP. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **4.2.1** | Убедитесь, что все компоненты приложения (включая балансировщики нагрузки, файрволы и серверы приложений) определяют границы входящих HTTP-сообщений с использованием механизма, соответствующего версии HTTP, чтобы предотвратить HTTP request smuggling. В HTTP/1.x, если присутствует заголовок Transfer-Encoding, заголовок Content-Length должен игнорироваться согласно RFC 2616. При использовании HTTP/2 или HTTP/3, если присутствует Content-Length, веб-сервер должен убедиться, что он совпадает с длиной DATA-фреймов. | 2 | +| **4.2.2** | Убедитесь, что при генерации HTTP-сообщений заголовок Content-Length не конфликтует с длиной содержимого, определяемой рамками протокола HTTP, чтобы предотвратить HTTP Request Smuggling. | 3 | +| **4.2.3** | Убедитесь, что приложение не отправляет и не принимает HTTP/2 и HTTP/3 сообщения с заголовками, специфичными для соединения, такими как Transfer-Encoding, чтобы предотвратить HTTP Response Splitting и HTTP Header Injection. | 3 | +| **4.2.4** | Убедитесь, что приложение принимает HTTP/2 и HTTP/3 запросы только в случае, если поля заголовков и их значения не содержат последовательностей CR (\r), LF (\n) или CRLF (\r\n), чтобы предотвратить HTTP Header Injection. | 3 | +| **4.2.5** | Убедитесь, что если приложение (бекенд или фронтенд) формирует и отправляет запросы, оно использует валидацию, очистку или другие механизмы, чтобы не создавать URI (например, для API-вызовов) или HTTP-заголовки (например, Authorization или Cookie) слишком большой длины, чтобы их не принимал приёмник. Это может привести к отказу в обслуживании, например, при отправке слишком длинного запроса (длинный cookie-заголовок), из-за чего сервер постоянно возвращает ошибку. | 3 | + +## V4.3 GraphQL + +GraphQL становится всё более популярным способом создания клиентов с большим объёмом данных, которые не жёстко связаны с разными бэкенд-сервисами. В этом разделе рассмотрены вопросы безопасности для GraphQL. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **4.3.1** | Убедитесь, что используется белый список запросов, ограничение глубины вложенности, ограничение количества или анализ стоимости запроса, чтобы предотвратить DoS-атаки на уровне GraphQL или слоя данных из-за дорогостоящих вложенных запросов. | 2 | +| **4.3.2** | Убедитесь, что introspection-запросы GraphQL отключены в продакшен-среде, если GraphQL API не предназначен для использования сторонними клиентами. | 2 | + +## V4.4 WebSocket + +WebSocket — это протокол связи, обеспечивающий двунаправленную одновременную коммуникацию по одному TCP-соединению. Он был стандартизирован IETF в RFC 6455 в 2011 году и отличается от HTTP, хотя и работает поверх портов HTTP 443 и 80. + +В этом разделе приведены основные требования по безопасности, чтобы предотвратить атаки, связанные с безопасностью коммуникаций и управлением сессиями, которые эксплуатируют этот канал реального времени. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **4.4.1** | Убедитесь, что для всех WebSocket-соединений используется WebSocket поверх TLS (WSS). | 1 | +| **4.4.2** | Убедитесь, что при первоначальном HTTP WebSocket handshake заголовок Origin проверяется на соответствие списку разрешённых источников для приложения. | 2 | +| **4.4.3** | Убедитесь, что если стандартное управление сессиями приложения не может быть использовано, применяются специальные токены, соответствующие требованиям безопасности управления сессиями. | 2 | +| **4.4.4** | Убедитесь, что специальные токены управления сессиями WebSocket изначально получаются или валидируются через ранее аутентифицированную HTTPS-сессию при переходе от HTTPS к WebSocket. | 2 | + +## Ссылки + +Для дополнительной информации см. также: + +* [OWASP REST Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html) +* Ресурсы по авторизации GraphQL от [graphql.org](https://graphql.org/learn/authorization/) и [Apollo](https://www.apollographql.com/docs/apollo-server/security/authentication/#authorization-methods). +* [OWASP Web Security Testing Guide: GraphQL Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/12-API_Testing/01-Testing_GraphQL) +* [OWASP Web Security Testing Guide: Testing WebSockets](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/11-Client-side_Testing/10-Testing_WebSockets) diff --git a/5.0/ru/0x14-V5-File-Handling.md b/5.0/ru/0x14-V5-File-Handling.md new file mode 100644 index 0000000000..118568c67d --- /dev/null +++ b/5.0/ru/0x14-V5-File-Handling.md @@ -0,0 +1,54 @@ +# V5 Работа с файлами + +## Задачи контроля + +Использование файлов может нести различные риски для приложения, включая отказ в обслуживании (DoS), несанкционированный доступ и переполнение хранилища. В этой главе приведены требования, для предотвращения этих рисков. + +## V5.1 Документация по работе с файлами + +Этот раздел содержит требование документировать ожидаемые характеристики файлов, принимаемых приложением, как необходимое условие для разработки и проверки соответствующих мер безопасности. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **5.1.1** | Убедитесь, что документация определяет допустимые типы файлов, ожидаемые расширения и максимальный размер (включая распакованный размер) для каждой функции загрузки. Также убедитесь, что в документации указано, как файлы обезвреживаются для конечных пользователей (например, как приложение ведёт себя при обнаружении вредоносного файла). | 2 | + +## V5.2 Загрузка файлов и содержимое + +Функциональность загрузки файлов является основным источником недоверенных файлов. Этот раздел описывает требования, обеспечивающие безопасность приложения от вреда, связанного с наличием, объёмом или содержимым этих файлов. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **5.2.1** | Убедитесь, что приложение принимает только те файлы, которые может обработать без потери производительности или отказа в обслуживании. | 1 | +| **5.2.2** | Убедитесь, что при загрузке файла (включая файлы внутри архивов, таких как ZIP) приложение проверяет, соответствует ли расширение ожидаемому, и валидирует, соответствует ли содержимое типу, указанному в расширении. Это включает проверку начальных 'magic bytes', перезапись изображений, использование специализированных библиотек. Для уровня 1 — достаточно проверок для файлов, критичных с точки зрения бизнеса или безопасности. Для уровней 2 и выше — для всех файлов. | 1 | +| **5.2.3** | Убедитесь, что приложение проверяет архивы (например, zip, gz, docx, odt) на максимально допустимый распакованный размер и максимальное количество файлов до распаковки. | 2 | +| **5.2.4** | Убедитесь, что для каждого пользователя установлены квоты на общий размер и количество файлов, чтобы один пользователь не мог переполнить хранилище. | 3 | +| **5.2.5** | Убедитесь, что приложение не позволяет загружать архивы с символьными ссылками (symlinks), если это не требуется по бизнес-логике. Если требуется — разрешён только строго определённый список допустимых символьных ссылок. | 3 | +| **5.2.6** | Убедитесь, что приложение отклоняет изображения с числом пикселей выше допустимого, чтобы предотвратить атаки 'pixel flood'. | 3 | + +## V5.3 Хранение файлов + +Этот раздел содержит требования для предотвращения исполнения файлов после загрузки, обнаружения опасного содержимого и предотвращения использования недоверенных данных для управления путями хранения файлов. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **5.3.1** | Убедитесь, что загруженные или сгенерированные из недоверенного ввода файлы, находящиеся в публичной директории, не исполняются как серверный код при обращении к ним по HTTP. | 1 | +| **5.3.2** | Убедитесь, что при создании путей к файлам приложение использует внутренние или доверенные данные, а не пользовательские имена файлов. Если использование пользовательских имён или метаданных необходимо — требуется строгая проверка и очистка. Это защита от path traversal, LFI, RFI и SSRF. | 1 | +| **5.3.3** | Убедитесь, что при обработке файлов на сервере (например, при распаковке) игнорируются пути, заданные пользователем, во избежание уязвимостей типа 'zip slip'. | 3 | + +## V5.4 Скачивание файлов + +Этот раздел содержит требования для снижения рисков при выдаче файлов на загрузку, включая защиту от path traversal и инъекций, а также проверку содержимого. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **5.4.1** | Убедитесь, что приложение валидирует или игнорирует имена файлов, переданных пользователем (включая в JSON, JSONP или URL-параметре), и указывает имя файла в заголовке Content-Disposition при ответе. | 2 | +| **5.4.2** | Убедитесь, что имена файлов, передаваемые (например, в HTTP-заголовках или вложениях в email), кодируются или очищаются (например, по RFC 6266), чтобы сохранить структуру документа и предотвратить инъекции. | 2 | +| **5.4.3** | Убедитесь, что файлы, полученные из недоверенных источников, сканируются антивирусом, чтобы не распространять известное вредоносное содержимое. | 2 | + +## Ссылки + +Для дополнительной информации см. также: + +* [OWASP File Upload Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html) +* [Example of using symlinks for arbitrary file read](https://hackerone.com/reports/1439593) +* [Explanation of "Magic Bytes" from Wikipedia](https://en.wikipedia.org/wiki/List_of_file_signatures) diff --git a/5.0/ru/0x15-V6-Authentication.md b/5.0/ru/0x15-V6-Authentication.md new file mode 100644 index 0000000000..5f1cb68a52 --- /dev/null +++ b/5.0/ru/0x15-V6-Authentication.md @@ -0,0 +1,166 @@ +# V6 Аутентификация + +## Задачи контроля + +Аутентификация — это процесс установления или подтверждения подлинности личности или устройства. Он включает в себя проверку заявленных данных, устойчивость к подмене личности и защиту от перехвата или восстановления паролей. + +[Документ NIST SP 800-63](https://pages.nist.gov/800-63-3/) является современным и основанным на фактических данных стандартом, особенно актуальным для государственных структур США и организаций, взаимодействующих с ними. + +Хотя многие требования этой главы основаны на разделе NIST SP 800-63B («Руководство по цифровой идентификации — Управление аутентификацией и жизненным циклом»), акцент сделан на распространённых угрозах и часто эксплуатируемых слабостях. Эта глава не охватывает весь стандарт. Для полной реализации NIST SP 800-63 необходимо обратиться к оригиналу. + +В тексте используется более понятная терминология, отличающаяся от формулировок NIST. + +Многие современные приложения адаптируют этапы аутентификации в зависимости от уровня риска. Эти механизмы рассматриваются в главе «Авторизация», поскольку они также касаются авторизационных решений. + +## V6.1 Документация по аутентификации + +Этот раздел содержит требования к документации по аутентификации, которую необходимо вести для приложения. Это критически важно для того, чтобы правильно настроить и оценить соответствующие механизмы управления аутентификацией. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **6.1.1** | Убедитесь, что в документации приложения описано, как используются механизмы, такие как ограничение частоты запросов (rate limiting), защита от автоматизации и адаптивные реакции, для защиты от атак, таких как подстановка учётных данных и перебор паролей. Документация должна ясно описывать конфигурацию этих механизмов и предотвращение злонамеренной блокировки аккаунтов. | 1 | +| **6.1.2** | Убедитесь, что задокументирован список контекстно-зависимых слов, запрещённых к использованию в паролях. В него могут входить производные от названий организаций, продуктов, идентификаторов систем, кодовых названий проектов, названий отделов или ролей и тому подобное. | 2 | +| **6.1.3** | Убедитесь, что если приложение поддерживает несколько способов аутентификации, то все они документированы вместе с описанием применяемых средств защиты и уровнем стойкости аутентификации, которые должны быть одинаково применены ко всем способам. | 2 | + +## V6.2 Безопасность паролей + +Пароли (в терминологии NIST SP 800-63 — «запоминаемые секреты») включают в себя пароли, кодовые фразы, PIN-коды, графические шаблоны разблокировки и, например, выбор нужного котёнка или другого элемента на изображении. Они относятся к категории «что-то, что вам известно» и часто используются как однофакторный механизм аутентификации. + +Соответственно, в этом разделе перечислены требования, направленные на безопасное создание и обработку паролей. Большинство требований относятся к уровню L1, поскольку на этом уровне они наиболее важны. Начиная с уровня L2, требуется использование многофакторной аутентификации, в которой пароли могут быть одним из факторов. + +Требования в данном разделе в основном соответствуют [§ 5.1.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver) [руководства NIST](https://pages.nist.gov/800-63-3/sp800-63b.html). + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **6.2.1** | Убедитесь, что пользовательские пароли содержат не менее 8 символов. Рекомендуется минимальная длина в 15 символов. | 1 | +| **6.2.2** | Убедитесь, что пользователи могут менять свои пароли. | 1 | +| **6.2.3** | Убедитесь, что для смены пароля требуется ввести как текущий, так и новый пароль. | 1 | +| **6.2.4** | Убедитесь, что при регистрации или смене пароля введённый пароль проверяется по списку как минимум из 3000 самых популярных паролей, соответствующих политике (например, минимальной длине). | 1 | +| **6.2.5** | Убедитесь, что допускаются пароли любой структуры, без ограничений на использование определённых символов. Не должно быть требований по обязательному наличию заглавных/строчных букв, цифр или специальных символов. | 1 | +| **6.2.6** | Убедитесь, что поля ввода пароля используют type=password для скрытия символов. Разрешено временное отображение всего пароля или последнего введённого символа. | 1 | +| **6.2.7** | Убедитесь, что разрешены вставка (paste), использование менеджеров паролей браузера и внешних менеджеров паролей. | 1 | +| **6.2.8** | Убедитесь, что пароль проверяется строго в том виде, в котором он был введён пользователем — без обрезки, изменения регистра и других модификаций. | 1 | +| **6.2.9** | Убедитесь, что система позволяет использовать пароли длиной не менее 64 символов. | 2 | +| **6.2.10** | Убедитесь, что пароль остаётся действительным, пока не будет скомпрометирован или не будет изменён пользователем. Приложение не должно требовать регулярной смены пароля. | 2 | +| **6.2.11** | Убедитесь, что используется документированный список контекстно-зависимых слов (например, названия компаний, проектов и т.д.) для предотвращения использования легко угадываемых паролей. | 2 | +| **6.2.12** | Убедитесь, что при регистрации или смене пароля проверяется, не входит ли он в список скомпрометированных (утёкших) паролей. | 2 | + +## V6.3 Общие требования к безопасности аутентификации + +В этом разделе изложены общие требования к безопасности механизмов аутентификации, а также различные ожидания для разных уровней защиты. Для приложений уровня L2 обязательно использование многофакторной аутентификации (MFA). Для приложений уровня L3 требуется аппаратная аутентификация, выполняемая в аттестованной и доверенной среде исполнения (TEE). Это может включать: ключи passkey, привязанные к устройству; аутентификаторы, соответствующие eIDAS LoA High; аутентификаторы с уровнем доверия NIST AAL3; или эквивалентные механизмы. + +Это достаточно строгий подход к MFA, но он необходим для повышения уровня защиты пользователей. Любое смягчение этих требований должно сопровождаться документированным обоснованием и чётким планом по смягчению рисков с учётом рекомендаций и исследований NIST. + +Обратите внимание: на момент публикации NIST SP 800-63 рассматривает email как [недопустимый](https://pages.nist.gov/800-63-FAQ/#q-b11) механизм аутентификации ([archived copy](https://web.archive.org/web/20250330115328/https://pages.nist.gov/800-63-FAQ/#q-b11)). + +Требования в этом разделе опираются на следующие части [руководства NIST](https://pages.nist.gov/800-63-3/sp800-63b.html), including: [§ 4.2.1](https://pages.nist.gov/800-63-3/sp800-63b.html#421-permitted-authenticator-types), [§ 4.3.1](https://pages.nist.gov/800-63-3/sp800-63b.html#431-permitted-authenticator-types), [§ 5.2.2](https://pages.nist.gov/800-63-3/sp800-63b.html#522-rate-limiting-throttling), и [§ 6.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#-612-post-enrollment-binding). + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **6.3.1** | Убедитесь, что реализованы меры защиты от атак типа credential stuffing (массовая подстановка учётных данных) и brute-force (перебор паролей), согласно документации по безопасности приложения. | 1 | +| **6.3.2** | Убедитесь, что в приложении отсутствуют или отключены учётные записи по умолчанию (например, root, admin, sa). | 1 | +| **6.3.3** | Убедитесь, что для доступа к приложению используется либо механизм многофакторной аутентификации, либо комбинация однофакторных. Для уровня L3 один из факторов должен быть аппаратным, обеспечивающим защиту от фишинга, устойчивость к компрометации и подтверждение намерения аутентификации через явное действие пользователя (например, нажатие кнопки на FIDO-ключе или телефоне). Ослабление этих требований допускается только при наличии обоснования и компенсирующих мер. | 2 | +| **6.3.4** | Убедитесь, что при наличии нескольких способов аутентификации, они все задокументированы, и для них единообразно применяются меры защиты и уровни доверия. | 2 | +| **6.3.5** | Убедитесь, что пользователи получают уведомления о подозрительных попытках аутентификации (удачных и неудачных). Это может включать попытки (например, подключения) с необычного устройства или места, частично успешную MFA, попытку после долгого отсутствия или успешную аутентификацию после серии неудачных. | 3 | +| **6.3.6** | Убедитесь, что email не используется ни как однофакторный, ни как многофакторный механизм аутентификации. | 3 | +| **6.3.7** | Убедитесь, что пользователи получают уведомление при изменении данных аутентификации, таких как сброс пароля или изменение логина/email. | 3 | +| **6.3.8** | Убедитесь, что из сообщений об ошибке, HTTP-кодов ответа или различий во времени ответа нельзя определить, существует ли пользователь с таким логином. Это правило также должно применяться к функциям регистрации и восстановления пароля. | 3 | + +## V6.4 Жизненный цикл и восстановление факторов аутентификации + +Факторы аутентификации могут включать пароли, программные токены (soft tokens), аппаратные токены (hardware tokens) и биометрические устройства. Безопасное управление жизненным циклом этих механизмов критически важно для безопасности приложения, и данный раздел включает соответствующие требования. + +Требования в этом разделе в основном соответствуют разделам [§ 5.1.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver) или [§ 6.1.2.3](https://pages.nist.gov/800-63-3/sp800-63b.html#replacement) [руководства NIST](https://pages.nist.gov/800-63-3/sp800-63b.html). + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **6.4.1** | Убедитесь, что начальные пароли или коды активации, генерируемые системой, создаются с использованием надёжного генератора случайных чисел, соответствуют текущей политике паролей и истекают через короткий период времени либо после первого использования. Эти секреты не должны использоваться как постоянные пароли. | 1 | +| **6.4.2** | Убедитесь, что в системе отсутствуют подсказки к паролю или вопросы на знание («секретные вопросы»). | 1 | +| **6.4.3** | Убедитесь, что реализован безопасный процесс сброса забытого пароля, который не обходит активные механизмы многофакторной аутентификации. | 2 | +| **6.4.4** | Убедитесь, что в случае утраты одного из факторов MFA проводится удостоверение личности (identity proofing) на том же уровне, что и при первичной регистрации. | 2 | +| **6.4.5** | Убедитесь, что инструкции по обновлению истекающих механизмов аутентификации отправляются заранее, с достаточным запасом времени для выполнения замены, при необходимости с настройкой автоматических напоминаний. | 3 | +| **6.4.6** | Убедитесь, что администраторы могут инициировать процесс сброса пароля, но не могут задать или выбрать новый пароль за пользователя. Это исключает ситуацию, при которой администратор знает пароль пользователя. | 3 | + +## V6.5 Общие требования к многофакторной аутентификации + +Этот раздел содержит общие рекомендации, применимые к различным методам многофакторной аутентификации (MFA). + +К таким механизмам относятся: + +* Lookup-секреты +* Временные одноразовые пароли (TOTP) +* Out-of-Band (внеполосные) механизмы + +Lookup-секреты — заранее сгенерированные списки одноразовых кодов, аналогичные TAN-кодам (Transaction Authorization Numbers), кодам восстановления для соцсетей или таблицам с наборами случайных значений. Эти коды считаются фактором типа «что-то, что у вас есть», поскольку они не запоминаются и должны быть где-то сохранены. + +Временные одноразовые пароли (TOTP) — аппаратные или программные токены, генерирующие постоянно меняющиеся псевдослучайные коды. Это также фактор типа «что-то, что у вас есть». MFA-варианты TOTP предполагают дополнительное подтверждение — например, PIN-код, биометрию, вставку USB-ключа, NFC или дополнительные значения (например, калькуляторы для подписания транзакций). + +Out-of-Band (внеполосные) механизмы рассматриваются в следующем разделе. + +Требования этого раздела в основном соответствуют [§ 5.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#-512-look-up-secrets), [§ 5.1.3](https://pages.nist.gov/800-63-3/sp800-63b.html#-513-out-of-band-devices), [§ 5.1.4.2](https://pages.nist.gov/800-63-3/sp800-63b.html#5142-single-factor-otp-verifiers), [§ 5.1.5.2](https://pages.nist.gov/800-63-3/sp800-63b.html#5152-multi-factor-otp-verifiers), [§ 5.2.1](https://pages.nist.gov/800-63-3/sp800-63b.html#521-physical-authenticators), и [§ 5.2.3](https://pages.nist.gov/800-63-3/sp800-63b.html#523-use-of-biometrics) [руководства NIST](https://pages.nist.gov/800-63-3/sp800-63b.html). + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **6.5.1** | Убедитесь, что lookup-секреты, внеполосные коды/запросы и TOTP-коды можно использовать только один раз. | 2 | +| **6.5.2** | Убедитесь, что при хранении lookup-секретов с энтропией менее 112 бит (например, 19 случайных буквенно-цифровых символов или 34 случайные цифры) они хэшируются с использованием разрешённого алгоритма хеширования паролей и случайной соли минимум 32 бита. Если у секрета ≥112 бит энтропии — допустимо использовать стандартный хэш. | 2 | +| **6.5.3** | Убедитесь, что lookup-секреты, коды внеполосной аутентификации и сиды для TOTP генерируются с использованием криптографически стойкого генератора случайных чисел (CSPRNG), чтобы избежать предсказуемых значений. | 2 | +| **6.5.4** | Убедитесь, что lookup-секреты и внеполосные коды аутентификации имеют минимум 20 бит энтропии (достаточно, например, 4 случайных алфавитно-цифровых символов или 6 случайных цифр). | 2 | +| **6.5.5** | Убедитесь, что все внеполосные запросы, коды и токены, а также TOTP-коды имеют ограниченный срок действия. Максимум для out-of-band — 10 минут, для TOTP — 30 секунд. | 2 | +| **6.5.6** | Убедитесь, что любой фактор аутентификации (включая физические устройства) может быть отозван в случае кражи или утери. | 3 | +| **6.5.7** | Убедитесь, что биометрические механизмы аутентификации используются только как вторичный фактор — в сочетании с «чем-то, что вы знаете» или «чем-то, что у вас есть». | 3 | +| **6.5.8** | Убедитесь, что TOTP-коды проверяются по источнику времени, полученному от доверенного сервиса, а не от клиента или недоверенного источника. | 3 | + +## V6.6 Внеполосные механизмы аутентификации + +Обычно внеполосная аутентификация предполагает, что сервер аутентификации взаимодействует с физическим устройством пользователя через безопасный вторичный канал. Например, путём отправки push-уведомления на мобильное устройство. Такой механизм считается фактором типа «что-то, что у вас есть». + +Небезопасные внеполосные методы аутентификации, такие как электронная почта и VOIP, не допускаются. Аутентификация через PSTN и SMS в настоящее время [считается ограниченной](https://pages.nist.gov/800-63-FAQ/#q-b01) по версии NIST и должна постепенно заменяться на временные одноразовые пароли (TOTP), криптографические механизмы или аналогичные средства. Руководство NIST SP 800-63B [§ 5.1.3.3](https://pages.nist.gov/800-63-3/sp800-63b.html#-5133-authentication-using-the-public-switched-telephone-network) рекомендует принимать меры против таких угроз, как замена устройства, смена SIM-карты, перенос номера и прочие аномалии, если всё же приходится использовать телефонную или SMS-аутентификацию. Хотя этот раздел ASVS не требует строго выполнять эти рекомендации, их игнорирование для чувствительных приложений уровня L2 или L3 считается серьёзным сигналом риска. + +Также стоит отметить, что NIST недавно выпустил рекомендации, в которых отговаривает от [использования push-уведомлений](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#fig-3). Хотя ASVS пока этого не запрещает, важно учитывать риск push-бомбинга (массовой отправки уведомлений для перегрузки пользователя). + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **6.6.1** | Убедитесь, что механизмы аутентификации через телефонную сеть общего пользования (PSTN) для доставки одноразовых паролей (OTP) по телефону или SMS используются только в случае предварительной валидации номера, при этом предлагаются альтернативные более безопасные методы (например, TOTP), и пользователю сообщаются риски. Для приложений уровня L3 использование телефона и SMS недопустимо. | 2 | +| **6.6.2** | Убедитесь, что внеполосные запросы, коды или токены привязаны к исходному запросу аутентификации, для которого они были сгенерированы, и не могут быть использованы повторно для других попыток. | 2 | +| **6.6.3** | Убедитесь, что внеполосные механизмы на основе кода защищены от атак методом подбора (brute force) путём применения ограничения частоты запросов (rate limiting). Также рекомендуется использовать коды с энтропией не менее 64 бит. | 2 | +| **6.6.4** | Убедитесь, что при использовании push-уведомлений для MFA применяется ограничение частоты (rate limiting), чтобы предотвратить атаки push-бомбинга. Также может помочь механизм сопоставления номеров (number matching). | 3 | + +## V6.7 Криптографические механизмы аутентификации + +Криптографические механизмы аутентификации включают, например, смарт-карты или ключи FIDO, при использовании которых пользователь должен подключить или сопрячь криптографическое устройство с компьютером для завершения аутентификации. Аутентификационный сервер отправляет случайную строку (nonce) на криптографическое устройство или программное обеспечение, и устройство или программа вычисляет ответ на основе надежно хранимого криптографического ключа. Требования в этом разделе содержат рекомендации по реализации подобных механизмов. Рекомендации по выбору криптографических алгоритмов приведены в главе «Криптография». + +Если для криптографической аутентификации используются общие или секретные ключи, они должны храниться с использованием тех же механизмов, что и другие системные секреты — как указано в разделе «Управление секретами» главы «Конфигурация». + +Требования этого раздела в основном соответствуют пункту [§ 5.1.7.2](https://pages.nist.gov/800-63-3/sp800-63b.html#sfcdv) [руководства NIST](https://pages.nist.gov/800-63-3/sp800-63b.html). + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **6.7.1** | Убедитесь, что сертификаты, используемые для проверки криптографических утверждений об аутентификации, хранятся таким образом, чтобы исключить возможность их модификации. | 3 | +| **6.7.2** | Убедитесь, что nonce (случайная строка), используемая в процессе вызова, имеет длину не менее 64 бит и является статистически уникальной или уникальной на протяжении всего срока службы криптографического устройства. | 3 | + +## V6.8 Аутентификация с использованием провайдера идентификаций (IdP) + +Провайдеры идентификаций (IdP) предоставляют пользователям федеративную идентификацию. У одного пользователя может быть несколько различных идентификаторов через разные IdP, например, корпоративная учётная запись через Azure AD, Okta, Ping Identity или Google, а также потребительская через Facebook, Twitter, Google или WeChat. Этот перечень не является рекламой данных сервисов, а лишь отражает реальность: у многих пользователей есть уже существующие идентификации. Организациям стоит учитывать возможность интеграции с такими внешними IdP в зависимости от уровня доверия к процедурам подтверждения личности у этих провайдеров. Например, государственная система вряд ли примет соцсети в качестве логина, так как там легко создать фальшивую учётную запись, а вот мобильной игре может быть полезна авторизация через соцсети для роста пользовательской базы. + +Безопасное использование внешних IdP требует тщательной настройки и проверки, чтобы не допустить подделки личности или ложных утверждений (assertions). Данный раздел описывает требования, направленные на снижение этих рисков. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **6.8.1** | Убедитесь, что при поддержке несколькими IdP, невозможно подделать личность пользователя через другой IdP (например, с тем же user ID). Стандартным способом защиты является регистрация пользователя с использованием сочетания ID самого IdP (в качестве пространства имён) и пользовательского ID внутри IdP. | 2 | +| **6.8.2** | Убедитесь, что наличие и целостность цифровой подписи в утверждениях аутентификации (например, в JWT или SAML) всегда проверяются, а неподписанные или недействительные утверждения отклоняются. | 2 | +| **6.8.3** | Убедитесь, что SAML-утверждения обрабатываются только один раз в течение периода их действия, чтобы исключить атаки воспроизведения (replay attacks). | 2 | +| **6.8.4** | Убедитесь, что если приложение использует внешний поставщик идентификации (IdP) и для определенных функций требуется особый уровень, метод или срок действия аутентификации, то приложение использует данные, возвращаемые IdP, для проверки этих условий. Например, при использовании OIDC можно проверить значения полей ID Token — acr, amr, auth_time (если они есть). Если IdP не предоставляет эти данные, приложение должно иметь документированный план действий по умолчанию, предполагающий использование минимально допустимой силы аутентификации (например, одноступенчатая — логин и пароль). | 2 | + +## Ссылки + +Для дополнительной информации см. также: + +* [NIST SP 800-63 - Digital Identity Guidelines](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-3.pdf) +* [NIST SP 800-63B - Authentication and Lifecycle Management](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf) +* [NIST SP 800-63 FAQ](https://pages.nist.gov/800-63-FAQ/) +* [OWASP Web Security Testing Guide: Testing for Authentication](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/04-Authentication_Testing) +* [OWASP Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html) +* [OWASP Forgot Password Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html) +* [OWASP Choosing and Using Security Questions Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Choosing_and_Using_Security_Questions_Cheat_Sheet.html) +* [CISA Guidance on "Number Matching"](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implement-number-matching-in-mfa-applications-508c.pdf) +* [Details on the FIDO Alliance](https://fidoalliance.org/) diff --git a/5.0/ru/0x16-V7-Session-Management.md b/5.0/ru/0x16-V7-Session-Management.md new file mode 100644 index 0000000000..9823970c9e --- /dev/null +++ b/5.0/ru/0x16-V7-Session-Management.md @@ -0,0 +1,91 @@ +# V7 Управление сессиями + +## Задачи контроля + +Механизмы управления сессиями позволяют приложениям связывать взаимодействия пользователя и устройства во времени, даже при использовании протоколов без состояния (например, HTTP). Современные приложения могут использовать несколько токенов сессии с разными характеристиками и назначением. Безопасная система управления сессиями — это система, предотвращающая получение, использование или иное злоупотребление сессией жертвы злоумышленником. Приложения, поддерживающие сессии, должны соответствовать следующим концептуальным требованиям: + +* Сессии уникальны для каждого пользователя, их идентификаторы нельзя угадать, и ими нельзя «поделиться» с другими. +* Сессии становятся недействительными, когда они больше не нужны, т.е. при бездействии пользователя срок действия сессии истекает. + +Многие требования в этой главе основаны на [NIST SP 800-63 Digital Identity Guidelines](https://pages.nist.gov/800-63-4/), с фокусом на распространённые угрозы и уязвимости аутентификации. + +Обратите внимание, что конкретные требования по реализации различных механизмов управления сессиями приведены в других разделах: + +* Требования по безопасности HTTP cookies — в разделе «Безопасность веб-интерфеса». +* Требования по автономным токенам — в разделе «Автономные токены». + +## V7.1 Документация по управлению сессиями + +Нет единого шаблона, подходящего для всех приложений. Поэтому необходимо проводить анализ рисков с документированием решений по безопасности, касающихся управления сессиями, до реализации и тестирования. Это обеспечивает адаптацию системы управления сессиями к конкретным требованиям приложения. + +Независимо от того, используется ли механизм сессий с сохранением состояния (stateful) или без (stateless), анализ должен быть завершён и задокументирован, чтобы продемонстрировать соответствие всем требованиям безопасности. Также необходимо учесть взаимодействие с системами единого входа (SSO), если они используются. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **7.1.1** | Убедитесь, что тайм-аут бездействия и абсолютное максимальное время жизни сессии задокументированы, соответствуют другим контрольным мерам и сопровождаются обоснованием любых отклонений от требований повторной аутентификации NIST SP 800-63B. | 2 | +| **7.1.2** | Убедитесь, что документация определяет допустимое количество одновременных (параллельных) сессий для одного аккаунта, а также поведение системы и действия при достижении этого лимита. | 2 | +| **7.1.3** | Убедитесь, что все системы, создающие и управляющие сессиями пользователей в рамках федеративной идентификации (например, SSO), задокументированы вместе с механизмами координации сроков действия сессий, условий завершения и случаев, требующих повторной аутентификации. | 2 | + +## V7.2 Базовая безопасность сессий + +Требования этого раздела обеспечивают безопасное создание и валидацию сессионных токенов. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **7.2.1** | Убедитесь, что все проверки сессионных токенов выполняются на доверенной серверной стороне. | 1 | +| **7.2.2** | Убедитесь, что приложение использует либо автономные токены, либо ссылочные токены, которые генерируются динамически, не используя статические API-секреты или ключи. | 1 | +| **7.2.3** | Убедитесь, что ссылочные токены являются уникальными, создаются с использованием криптографически безопасного генератора псевдослучайных чисел (CSPRNG) и обладают энтропией не менее 128 бит. | 1 | +| **7.2.4** | Убедитесь, что при аутентификации пользователя (включая повторную) создается новый токен сессии, а текущий — аннулируется. | 1 | + +## V7.3 Тайм-ауты сессии + +Механизмы тайм-аутов сессии уменьшают временное окно для угонов и других атак. Тайм-ауты должны соответствовать документированным решениям по безопасности. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **7.3.1** | Убедитесь, что есть тайм-аут бездействия, после которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями. | 2 | +| **7.3.2** | Убедитесь, что установлено абсолютное максимальное время жизни сессии, по истечении которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями. | 2 | + +## V7.4 Завершение сессий + +Завершение сессии может происходить как со стороны самого приложения, так и через поставщика SSO, если управление сессиями делегировано ему. Некоторые требования этого раздела могут быть реализованы на стороне поставщика SSO. + +Завершение сессии должно требовать повторной аутентификации и быть эффективным во всех компонентах: приложении, федеративной аутентификации и других доверяющих сторонах. + +Сессии с сохранением состояния обычно аннулируются на серверной стороне. self-contained токены нужно отзывать или блокировать, иначе они могут оставаться действительными до истечения срока их действия. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **7.4.1** | Убедитесь, что после завершения сессии (logout, истечение срока) дальнейшее её использование невозможно. Для ссылочных токенов или сессий с сохранением состояния это означает аннулирование на сервере. Для self-contained токенов необходимо реализовать механизм отзыва, например, список отозванных токенов, проверку времени выпуска или ротацию ключей подписи для каждого пользователя. | 1 | +| **7.4.2** | Убедитесь, что при удалении или отключении пользователя все активные сессии немедленно завершаются. | 1 | +| **7.4.3** | Убедитесь, что после изменения или удаления факторов аутентификации (например, смена пароля или MFA) приложение предлагает завершить все другие активные сессии. | 2 | +| **7.4.4** | Убедитесь, что на всех страницах, требующих аутентификации, имеется простой и видимый способ выхода. | 2 | +| **7.4.5** | Убедитесь, что администраторы могут завершать активные сессии конкретного пользователя или всех пользователей. | 2 | + +## V7.5 Защита от злоупотреблений сессией + +Этот раздел направлен на снижение рисков при активных сессиях, включая атаки с использованием действующей сессии жертвы. + +При рассмотрении требований этого раздела нужно учитывать рекомендации для конкретных уровней, приведенные в разделе «Аутентификация» + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **7.5.1** | Убедитесь, что приложение требует полной повторной аутентификации перед изменением чувствительных атрибутов аккаунта, которые могут влиять на аутентификацию (например, email, номер телефона, настройки MFA или данных восстановления доступа). | 2 | +| **7.5.2** | Убедитесь, что пользователь может просматривать и (после повторной аутентификации хотя бы по одному фактору) завершать активные сессии. | 2 | +| **7.5.3** | Убедитесь, что перед выполнением критически важных операций приложение требует повторной аутентификации (по крайней мере, одного фактора) или дополнительной проверки. | 3 | + +## V7.6 Федеративная повторная аутентификация + +Требования для сторон, реализующих логику Relying Party (RP) и Identity Provider (IdP), основаны на [NIST SP 800-63C](https://pages.nist.gov/800-63-4/sp800-63c.html). + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **7.6.1** | Убедитесь, что срок действия и завершение сессий между RP и IdP соответствуют документации и включают повторную аутентификацию, если достигнут максимальный допустимый интервал между событиями аутентификации. | 2 | +| **7.6.2** | Убедитесь, что создание сессии требует согласия пользователя или явного действия, предотвращающего несанкционированное создание сессий без участия пользователя. | 2 | + +## Ссылки + +Для дополнительной информации см. также: + +* [OWASP Web Security Testing Guide: Session Management Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/06-Session_Management_Testing) +* [OWASP Session Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html) diff --git a/5.0/ru/0x17-V8-Authorization.md b/5.0/ru/0x17-V8-Authorization.md new file mode 100644 index 0000000000..eb25da0fc1 --- /dev/null +++ b/5.0/ru/0x17-V8-Authorization.md @@ -0,0 +1,56 @@ +# V8 Авторизация + +## Задачи контроля + +Механизмы авторизации обеспечивают доступ только разрешённым субъектам (пользователям, сервисам и другим клиентам). Для соблюдения принципа наименьших привилегий (POLP) проверяемые приложения должны соответствовать следующим концептуальным требованиям: + +* Документировать правила авторизации, включая факторы принятия решений и контекст окружения. +* Субъекты должны иметь доступ только к тем ресурсам, на которые у них есть разрешения. + +## V8.1 Документация по авторизации + +Полная документация по авторизации необходима для обеспечения согласованного применения решений в области безопасности, возможности аудита и соответствия политикам организации. Это снижает риск несанкционированного доступа, делая требования безопасности понятными и выполнимыми для разработчиков, администраторов и тестировщиков. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **8.1.1** | Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне функций и на уровне данных на основе прав субъекта и атрибутов ресурса. | 1 | +| **8.1.2** | Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне полей (как на чтение, так и на запись) на основе прав субъекта и атрибутов ресурса. Эти правила могут зависеть от других атрибутов объекта данных, например, статуса. | 2 | +| **8.1.3** | Убедитесь, что документация определяет, какие атрибуты окружения и контекста (например, время суток, IP-адрес, местоположение, устройство) используются приложением для принятия решений в области аутентификации и авторизации. | 3 | +| **8.1.4** | Убедитесь, что документация по аутентификации и авторизации определяет, как используются факторы окружения и контекста в принятии решений, наряду с правилами доступа к функциям, данным и полям. Документация должна содержать оцениваемые атрибуты, пороговые значения риска, действия (разрешить, отказать, повысить уровень аутентификации и др.). | 3 | + +## V8.2 Архитектура авторизации + +Реализация детализированных механизмов авторизации на уровне функций, данных и полей обеспечивает субъектам наличие прав доступа только к тем компонентам, которые были им явно предоставлены. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **8.2.1** | Убедитесь, что приложение обеспечивает доступ на уровне функций (function-level) только субъектам с явными разрешениями. | 1 | +| **8.2.2** | Убедитесь, что приложение обеспечивает доступ на уровне данных (data-specific) только тем субъектам, которым явно предоставлены права к определённым элементам данных, чтобы предотвратить IDOR (Insecure Direct Object Reference) и BOLA-уязвимости (Broken Object Level Authorization). | 1 | +| **8.2.3** | Убедитесь, что приложение обеспечивает доступ на уровне полей (field-level) только тем субъектам, которым явно предоставлены права к определённым полям, чтобы предотвратить BOPLA (Broken Object Property Level Authorization). | 2 | +| **8.2.4** | Убедитесь, что реализованы адаптивные меры безопасности, основанные на атрибутах окружения и контекста субъекта (время, местоположение, IP, устройство), которые используются для принятия решений об аутентификации и авторизации, как это определено в документации приложения. Эти меры должны применяться как при попытке субъекта начать новую сессию, так и во время существующей сессии. | 3 | + +## V8.3 Авторизация на уровне операций + +Немедленное применение изменений авторизации на соответствующем уровне архитектуры критически важно для предотвращения несанкционированных действий, особенно в динамически меняющихся системах. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **8.3.1** | Убедитесь, что правила авторизации реализуются на доверенном сервисном уровне и не зависят от элементов, которые может контролировать клиент (например, JavaScript на стороне клиента). | 1 | +| **8.3.2** | Убедитесь, что изменения значений, влияющих на авторизацию, применяются немедленно. Если это невозможно (например, при использовании автономных токенов), должны быть реализованы компенсирующие меры: оповещения о попытке несанкционированного действия и откат изменений. Обратите внимание, что данный подход не предотвращает утечку информации. | 3 | +| **8.3.3** | Убедитесь, что доступ к объекту осуществляется на основе прав субъекта, инициировавшего запрос, а не прав промежуточного сервиса, действующего от его имени. Например, если пользователь обращается к веб-сервису с автономным токеном для аутентификации, а сервис затем запрашивает данные у другого сервиса, второй сервис должен использовать токен пользователя, а не токен первого сервиса для принятия решения о доступе. | 3 | + +## V8.4 Прочие аспекты авторизации + +Дополнительные меры контроля, особенно в административных интерфейсах и многопользовательских (мультитенантных) системах, помогают предотвратить несанкционированный доступ. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **8.4.1** | Убедитесь, что в мультитенантных приложениях реализованы механизмы, предотвращающие действия потребителя в отношении арендаторов, к которым у него нет доступа. | 2 | +| **8.4.2** | Убедитесь, что доступ к административным интерфейсам защищён несколькими уровнями контроля, включая непрерывную проверку личности, контроль защищённости устройства и анализ контекстных рисков. Недостаточно опираться только на IP-адрес или доверенные устройства. | 3 | + +## Ссылки + +Для дополнительной информации см. также: + +* [OWASP Web Security Testing Guide: Authorization](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/05-Authorization_Testing) +* [OWASP Authorization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html) diff --git a/5.0/ru/0x18-V9-Self-contained-Tokens.md b/5.0/ru/0x18-V9-Self-contained-Tokens.md new file mode 100644 index 0000000000..7ca2676c0d --- /dev/null +++ b/5.0/ru/0x18-V9-Self-contained-Tokens.md @@ -0,0 +1,36 @@ +# V9 Автономные токены + +## Задачи контроля + +В оригинальном RFC 6749 OAuth 2.0 от 2012 года упоминается концепция автономного токена (self-contained token). Она относится к токенам, которые содержат данные или утверждения (claims), на основе которых получатель будет принимать решения по безопасности. Автономный токен следует отличать от простого токена, содержащего только идентификатор, который принимающая сторона использует для локального поиска данных. + +Наиболее распространёнными примерами автономных токенов являются JSON Web Tokens (JWTs) и SAML Assertions. Но автономные токены получили широкое распространение даже за пределами OAuth и OIDC. Безопасность этой концепции зависит от возможности проверить целостность токена и убедиться, что он действителен для конкретного контекста. Этот процесс сопряжен с множеством подводных камней, и в этой главе подробно описываются механизмы, помогающие приложениям обходить их. + +## V9.1 Источник токена и его целостность + +В данном разделе изложены требования, гарантирующие, что токен был выпущен доверенной стороной и не был модифицирован. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **9.1.1** | Убедитесь, что автономные токены проверяются на целостность с помощью цифровой подписи или MAC, прежде чем доверять их содержимому. | 1 | +| **9.1.2** | Проверяйте, что автономные токены создаются и проверяются исключительно с помощью алгоритмов из списка допустимых в данном контексте. Список допустимых алгоритмов должен включать только разрешенные алгоритмы (желательно либо только симметричные, либо только асимметричные) и ни в коем случае не содержать алгоритм None. Если необходимо поддерживать оба типа алгоритмов, потребуются дополнительные средства контроля для предотвращения путаницы с ключами (key confusion). | 1 | +| **9.1.3** | Убедитесь, что ключи, используемые для проверки автономных токенов, получены из доверенных, предварительно настроенных источников. Это предотвращает возможность указания злоумышленниками ненадёжных источников и ключей. Для JWT и других JWS структур заголовки 'jku', 'x5u' и 'jwk' должны проверяться по белому списку. | 1 | + +## V9.2 Содержимое токена + +Прежде чем принимать решения по безопасности на основе данных из токена, важно проверить два момента: что срок действия токена актуален на момент предъявления, и что токен предназначен для использования принимающим сервисом в тех целях, для которых он был передан. Это предотвращает небезопасное перекрестное использование токена между различными сервисами или использование разного типа токенов от одного и того же эмитента. + +Конкретные требования для OAuth и OIDC рассматриваются в соответствующей главе. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **9.2.1** | Убедитесь, что при указанном сроке действия токен и его содержимое принимаются только в том случае, если срок действия токена не истёк. Например, для JWT нужно проверить поля 'nbf' и 'exp'. | 1 | +| **9.2.2** | Убедитесь, что сервис, принимающий токен, проверяет его тип и соответствие назначению перед обработкой содержимого токена. Например, для принятия решений об авторизации могут быть приняты только Access Token, а для подтверждения аутентификации пользователя — только ID Token. | 2 | +| **9.2.3** | Убедитесь, что сервис принимает только токены, предназначенные для использования с этим сервисом (audience). Для JWT это можно сделать, проверив наличие утверждения «aud» по белому списку, определенному в сервисе. | 2 | +| **9.2.4** | Убедитесь, что, если эмитент токенов использует один и тот же закрытый ключ для выпуска токенов различным сервисам (audiences), выпущенные токены содержат явное указание целевых сервисов. Это предотвратит повторное использования токенов в не предназначенных для них сервисах. Если идентификатор сервиса (audience identifier) назначается динамически, эмитент токенов должен проверить audiences для исключения подмены получателей (audience impersonation). | 2 | + +## Ссылки + +Для дополнительной информации см. также: + +* [OWASP JSON Web Token Cheat Sheet for Java Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_for_Java_Cheat_Sheet.html) (но имеет полезные общие рекомендации) diff --git a/5.0/ru/0x19-V10-OAuth-and-OIDC.md b/5.0/ru/0x19-V10-OAuth-and-OIDC.md new file mode 100644 index 0000000000..4d26a8e666 --- /dev/null +++ b/5.0/ru/0x19-V10-OAuth-and-OIDC.md @@ -0,0 +1,169 @@ +# V10 OAuth и OIDC + +## Задачи контроля + +OAuth2 (в этой главе именуется просто OAuth) — это общепринятый отраслевой стандарт делегированной авторизации. Например, с помощью OAuth клиентское приложение может получить доступ к API (ресурсам сервера) от имени пользователя, если тот дал на это разрешение. + +Сама по себе технология OAuth не предназначена для аутентификации пользователей. Фреймворк OpenID Connect (OIDC) расширяет OAuth, добавляя слой идентификации пользователя. OIDC поддерживает такие функции, как стандартизированная информация о пользователе, единый вход (SSO) и управление сессиями. Поскольку OIDC является надстройкой над OAuth, все требования, предъявляемые к OAuth, также применимы к OIDC. + +В OAuth определены следующие роли: + +* OAuth-клиент — приложение, пытающееся получить доступ к серверным ресурсам (например, через вызов API с использованием access token). Чаще всего это серверное приложение. + * Конфиденциальный клиент (confidential client) — клиент, способный сохранять в тайне свои учетные данные (например, client_secret) для аутентификации на авторизационном сервере. + * Публичный клиент (public client) — клиент, неспособный хранить учетные данные в секрете. Вместо аутентификации (например, с использованием пары client_id и client_secret) он лишь идентифицирует себя через client_id. +* OAuth-ресурсный сервер (Resource Server, RS) — сервер API, предоставляющий ресурсы клиентам OAuth. +* OAuth-авторизационный сервер (Authorization Server, AS) — сервер, выдающий клиентам access token'ы. Эти токены позволяют клиенту получать доступ к ресурсам RS — либо от имени пользователя, либо от имени самого клиента. Часто AS — это отдельное приложение, но при необходимости может быть интегрирован в RS. +* Владелец ресурса (Resource Owner, RO) — конечный пользователь, разрешающий OAuth-клиенту ограниченный доступ к своим данным на RS. Пользователь предоставляет это разрешение через взаимодействие с AS. + +В OIDC определены следующие роли: + +* Relying Party (RP) — клиентское приложение, запрашивающее аутентификацию пользователя через OpenID-провайдера. В терминах OAuth оно также является OAuth-клиентом. +* OpenID-провайдер (OP) — авторизационный сервер OAuth, способный аутентифицировать пользователя и предоставлять RP claims в рамках OIDC. OP может быть IdP (провайдером идентификации), но в федеративных сценариях OP и IdP могут быть разными приложениями. + +Изначально OAuth и OIDC были разработаны для сторонних приложений. Однако в настоящее время они часто используются и в first-party сценариях. Например, для аутентификации и управления сессиями. В таких случаях протоколы добавляют некоторую сложность, которая может привести к новым проблемам с безопасностью. + +OAuth и OIDC могут использоваться в различных типах приложений, однако в OWASP ASVS акцент делается на веб-приложения и API. + +Поскольку OAuth и OIDC работают поверх веб-технологий, на них распространяются общие требования из других глав. Этот раздел не следует рассматривать изолированно. + +В этой главе рассматриваются лучшие современные практики OAuth2 и OIDC в ​​соответствии со спецификациями, представленными на и . Поскольку RFC часто обновляются, при применении требований, изложенных в этой главе, следует сверяться с их последними версиями. Подробнее см. в разделе «Ссылки». + +С учетом сложности темы крайне важно использовать проверенные стандартные решения (например, авторизационные серверы от крупных вендоров) и применять рекомендованные параметры безопасности. + +Терминология в этой главе соответствует RFC OAuth и спецификациям OIDC. Однако OIDC-термины используются только в OIDC-специфичных требованиях. В остальных случаях применяется терминология OAuth. + +В этом разделе под «токеном» понимается: + +* Access Token используется только ресурсным сервером (RS). Он может быть ссылочным (reference token), проверяемым через introspection, или автономным (self-contained), проверяемым через криптографически подписанный материал. +* Refresh Token используется только авторизационным сервером, выдавшим токен. +* OIDC ID Token используется только клиентским приложением, инициировавшим процесс авторизации. + +Уровни риска для некоторых требований зависят от того, является ли клиент конфиденциальным или публичным. Поскольку сильная клиентская аутентификация снижает многие риски, в случае конфиденциальных клиентов на уровне L1 возможны послабления. + +## V10.1 Общие требования безопасности OAuth и OIDC + +В этом разделе изложены универсальные архитектурные требования, применимые ко всем приложениям, использующим OAuth или OIDC. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **10.1.1** | Убедитесь, что токены передаются только тем компонентам, которым они действительно необходимы. Например, при использовании схемы backend-for-frontend для браузерных JavaScript-приложений, access и refresh токены должны быть доступны только на backend. | 2 | +| **10.1.2** | Убедитесь, что клиент принимает значения от авторизационного сервера (например, authorization code или ID Token) только если они получены в результате авторизационного потока, инициированного в той же сессии пользовательского агента и в рамках той же транзакции. Для этого клиентские секреты, такие как proof key для code exchange (PKCE) — 'code_verifier', 'state' или OIDC 'nonce' — должны быть непредсказуемыми, специфичными для транзакции и надежно привязанными как к клиенту, так и к сессии пользовательского агента, в которой началась транзакция. | 2 | + +## V10.2 Клиент OAuth + +Данные требования описывают обязанности приложений-клиентов OAuth. Клиентом может быть, например, backend веб-сервера (часто выступающий как Backend For Frontend, BFF), интеграция backend-сервиса или frontend-приложение одностраничного типа (SPA, то есть браузерное приложение). + +В общем случае backend-клиенты считаются конфиденциальными (confidential clients), а frontend — публичными (public clients). Однако нативные приложения, работающие на устройстве конечного пользователя, могут рассматриваться как конфиденциальные при использовании динамической регистрации OAuth клиента. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **10.2.1** | Убедитесь, что если используется механизм authorization code flow, OAuth клиент защищён от CSRF, вызывающих запросы токенов либо за счёт использования механизма proof key for code exchange (PKCE), либо за счёт проверки параметра 'state', который был отправлен в запросе авторизации. | 2 | +| **10.2.2** | Убедитесь, что если OAuth клиент может взаимодействовать с более чем одним сервером авторизации, у него есть защита от атак смешивания (mix-up attacks). Например, клиент должен требовать, чтобы сервер авторизации возвращал параметр 'iss' и проверять его в ответах на авторизацию и токены. | 2 | +| **10.2.3** | Убедитесь, что OAuth клиент запрашивает только необходимые области доступа (scopes) или другие параметры авторизации в запросах к серверу авторизации. | 3 | + +## V10.3 Сервер ресурсов OAuth + +В контексте ASVS и данного раздела сервер ресурсов — это API. Для обеспечения безопасного доступа сервер ресурсов должен: + +* Валидировать access token в соответствии с форматом токена и спецификациями протокола, например, валидация JWT или интроспекция OAuth токена. +* Если токен действителен, принимать решения по авторизации на основе информации из токена и предоставленных разрешений. Например, сервер ресурсов должен проверить, что клиент (действующий от имени владельца ресурса) имеет право доступа к запрошенному ресурсу. + +Таким образом, требования здесь специфичны для OAuth или OIDC и должны выполняться после валидации токена и перед принятием решения об авторизации на основе информации из токена. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **10.3.1** | Убедитесь, что сервер ресурсов принимает только те access токены, которые предназначены для использования с этим сервисом (свойство audience). Эта принадлежность сервису может быть включена в структурированный access токен (например, в поле 'aud' в JWT) или проверяться через endpoint интроспекции токена. | 2 | +| **10.3.2** | Убедитесь, что сервер ресурсов принимает решения по авторизации на основе claims из access токена, определяющих делегированную авторизацию. Если присутствуют claims, такие как 'sub', 'scope' и 'authorization_details', они должны участвовать в принятии решения. | 2 | +| **10.3.3** | Убедитесь, что если для принятия решения по контролю доступа необходимо однозначно идентифицировать пользователя из access токена (JWT или ответа интроспекции), сервер ресурсов использует claims, которые не могут быть переприсвоены другим пользователям. Обычно это комбинация claims 'iss' и 'sub'. | 2 | +| **10.3.4** | Убедитесь, что если сервер ресурсов требует определённой силы аутентификации, методов или свежести аутентификации, он проверяет, что предъявленный access токен удовлетворяет этим требованиям. Например, при наличии, могут использоваться claims OIDC 'acr', 'amr' и 'auth_time'. | 2 | +| **10.3.5** | Убедитесь, что сервер ресурсов предотвращает использование украденных access токенов или их повторное использование (replay) неавторизованными лицами, требуя access токены с подтверждением отправителя — например, Mutual TLS для OAuth 2 или OAuth 2 Demonstration of Proof of Possession (DPoP). | 3 | + +## V10.4 Сервер авторизации OAuth + +Эти требования описывают обязанности серверов авторизации OAuth, включая OpenID провайдеров. + +Для аутентификации клиента разрешён метод 'self_signed_tls_client_auth' при выполнении предварительных требований, указанных в [разделе 2.2](https://datatracker.ietf.org/doc/html/rfc8705#name-self-signed-certificate-mut) стандарта [RFC 8705](https://datatracker.ietf.org/doc/html/rfc8705). + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **10.4.1** | Убедитесь, что сервер авторизации проверяет URI перенаправления (redirect URI), сверяя его с заранее зарегистрированным списком разрешённых URI для данного клиента (allowlist), используя точное сравнение строк. | 1 | +| **10.4.2** | Убедитесь, что если сервер авторизации возвращает authorization code в ответе авторизации, этот код может быть использован только один раз для запроса токена. При втором валидном запросе с уже использованным кодом сервер должен отклонить запрос и отозвать любые токены, связанные с этим кодом. | 1 | +| **10.4.3** | Убедитесь, что authorization code имеет короткое время жизни. Максимальная продолжительность — до 10 минут для приложений L1 и L2 и до 1 минуты для приложений L3. | 1 | +| **10.4.4** | Убедитесь, что сервер авторизации для конкретного клиента разрешает использование только тех типов авторизации, которые необходимы этому клиенту. Обратите внимание, что тип авторизации Implicit flow и Resource Owner Password Credentials flow больше не должны использоваться. | 1 | +| **10.4.5** | Убедитесь, что сервер авторизации предотвращает атаки повторного использования refresh токенов для публичных клиентов, предпочтительно используя sender-constrained refresh токены, такие как DPoP или сертификат-связанные токены с mutual TLS (mTLS). Для L1 и L2 допускается ротация refresh токенов с обязательной их инвалидацией после использования. Если используется ротация, сервер должен отозвать все refresh токены при попытке использовать уже инвалидированный токен. | 1 | +| **10.4.6** | Убедитесь, что при использовании типа авторизации «Authorization Code» сервер предотвращает атаки перехвата authorization code, требуя Proof Key for Code Exchange (PKCE). В запросах авторизации сервер должен требовать валидное значение 'code_challenge' и не принимать 'code_challenge_method' со значением 'plain'. В запросах токена обязательно валидировать параметр 'code_verifier'. | 2 | +| **10.4.7** | Убедитесь, что если сервер авторизации поддерживает динамическую регистрацию клиентов без аутентификации, он минимизирует риски вредоносных клиентов. Сервер должен валидировать метаданные клиента (например, зарегистрированные URI), обеспечивать согласие пользователя и предупреждать пользователя перед обработкой запроса авторизации от недоверенного клиента. | 2 | +| **10.4.8** | Убедитесь, что refresh токены имеют абсолютный срок действия, включая случаи, когда применяется скользящее время истечения срока. | 2 | +| **10.4.9** | Убедитесь, что пользователи могут отзывать refresh токены и reference access токены через пользовательский интерфейс сервера авторизации для снижения риска от вредоносных клиентов или кражи токенов. | 2 | +| **10.4.10** | Убедитесь, что конфиденциальный клиент аутентифицируется при взаимодействии с сервером авторизации через backchannel, например при запросах токена, pushed authorization requests (PAR) и запросах на отзыв токенов. | 2 | +| **10.4.11** | Убедитесь, что конфигурация сервера авторизации назначает OAuth клиенту только необходимые области доступа (scopes). | 2 | +| **10.4.12** | Убедитесь, что для конкретного клиента сервер авторизации разрешает только те значения 'response_mode', которые необходимы этому клиенту. Например, сервер должен валидировать это значение против ожидаемых или использовать pushed authorization request (PAR) или JWT-secured Authorization Request (JAR). | 3 | +| **10.4.13** | Убедитесь, что грант типа 'code' всегда используется вместе с pushed authorization requests (PAR). | 3 | +| **10.4.14** | Убедитесь, что сервер авторизации выдаёт только sender-constrained (Proof-of-Possession) access токены, либо с сертификат-связанными токенами через mutual TLS (mTLS), либо DPoP-bound токены (Demonstration of Proof of Possession). | 3 | +| **10.4.15** | Убедитесь, что для серверного клиента (не выполняющегося на устройстве конечного пользователя) сервер авторизации проверяет, что значение параметра 'authorization_details' исходит из клиентского backend и что пользователь не изменял его. Например, это достигается использованием pushed authorization request (PAR) или JWT-secured Authorization Request (JAR). | 3 | +| **10.4.16** | Убедитесь, что клиент является конфиденциальным и сервер авторизации требует использования сильных методов аутентификации клиента (основанных на криптографии с открытым ключом и устойчивых к атакам повторного воспроизведения), таких как mutual TLS ('tls_client_auth', 'self_signed_tls_client_auth') или private key JWT ('private_key_jwt'). | 3 | + +## V10.5 Клиент OIDC + +Поскольку OIDC клиент (relying party) выступает в роли OAuth клиента, на него также распространяются требования из раздела «OAuth Client». + +Обратите внимание, что в разделе «Аутентификация с использованием провайдера идентификаций (IdP)» главы «Аутентификация» содержатся дополнительные общие требования. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **10.5.1** | Убедитесь, что клиент (relying party) защищается от повторного использования ID Token (replay-атак). Например, это достигается проверкой того, что значение 'nonce' в ID Token совпадает со значением 'nonce', отправленным в запросе аутентификации провайдеру OpenID (authorization server). | 2 | +| **10.5.2** | Убедитесь, что клиент однозначно идентифицирует пользователя по утверждениям (claims) ID Token, обычно это 'sub', который не может быть переназначен другому пользователю (в пределах конкретного провайдера идентификации). | 2 | +| **10.5.3** | Убедитесь, что клиент отклоняет попытки злоумышленного сервера авторизации выдавать себя за другой сервер авторизации через метаданные сервера авторизации. Клиент должен отклонить метаданные, если URL издателя (issuer) в метаданных не совпадает точно с преднастроенным URL издателя, ожидаемым клиентом. | 2 | +| **10.5.4** | Убедитесь, что клиент проверяет, что ID Token предназначен для него (проверка audience), сравнивая значение 'aud' в токене с 'client_id' клиента. | 2 | +| **10.5.5** | Убедитесь, что при использовании OIDC back-channel logout клиент снижает риск отказа в обслуживании, вызванный принудительным выходом из системы и путаницей между разными типами JWT (cross-JWT confusion) в процессе логаута. Клиент должен проверить, что токен выхода корректно типизирован со значением 'logout+jwt', содержит claim 'event' с правильным именем участника и не содержит 'nonce'. Также рекомендуется установить короткий срок действия токена (например, 2 минуты). | 2 | + +## V10.6 Провайдер OpenID + +Поскольку провайдеры OpenID выступают в роли OAuth серверов авторизации, на них также распространяются требования из раздела «Сервер авторизации OAuth». + +Обратите внимание, что при использовании потока ID Token (а не code flow) access токены не выдаются, и многие требования к OAuth AS в этом случае неприменимы. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **10.6.1** | Убедитесь, что провайдер OpenID допускает только значения 'code', 'ciba', 'id_token' или 'id_token code' для параметра response mode. При этом предпочтение отдаётся 'code' по сравнению с 'id_token code' (гибридный поток OIDC), а значение 'token' (любой Implicit flow) не должно использоваться. | 2 | +| **10.6.2** | Убедитесь, что провайдер OpenID предотвращает отказ в обслуживании (DoS) через принудительный выход (logout), запрашивая явное подтверждение от конечного пользователя или, если применимо, проверяя параметры в запросе выхода (инициированном relying party), например параметр 'id_token_hint'. | 2 | + +## V10.7 Управление согласием + +Эти требования касаются проверки согласия пользователя авторизационным сервером. Без правильной проверки согласия пользователя злоумышленник может получить разрешения от имени пользователя с помощью подделки или социальной инженерии. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **10.7.1** | Убедитесь, что авторизационный сервер обеспечивает получение согласия пользователя для каждого запроса авторизации. Если личность клиента не может быть подтверждена, сервер авторизации всегда должен явно запрашивать согласие пользователя. | 2 | +| **10.7.2** | Убедитесь, что при запросе согласия пользователя авторизационный сервер предоставляет достаточную и понятную информацию о том, на что даётся согласие. При необходимости это должно включать характер запрашиваемых разрешений (обычно основанных на scope, ресурсном сервере, деталях авторизации Rich Authorization Requests (RAR)), идентификацию авторизованного приложения и срок действия этих разрешений. | 2 | +| **10.7.3** | Убедитесь, что пользователь может просматривать, изменять и отзывать согласия, которые он предоставил, через авторизационный сервер. | 2 | + +## Ссылки + +Для дополнительной информации об OAuth см.: + +* [oauth.net](https://oauth.net/) +* [OWASP OAuth 2.0 Protocol Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/OAuth2_Cheat_Sheet.html) + +Для требований, связанных с OAuth, в ASVS используются следующие опубликованные и находящиеся в статусе черновика RFC: + +* [RFC6749 The OAuth 2.0 Authorization Framework](https://datatracker.ietf.org/doc/html/rfc6749) +* [RFC6750 The OAuth 2.0 Authorization Framework: Bearer Token Usage](https://datatracker.ietf.org/doc/html/rfc6750) +* [RFC6819 OAuth 2.0 Threat Model and Security Considerations](https://datatracker.ietf.org/doc/html/rfc6819) +* [RFC7636 Proof Key for Code Exchange by OAuth Public Clients](https://datatracker.ietf.org/doc/html/rfc7636) +* [RFC7591 OAuth 2.0 Dynamic Client Registration Protocol](https://datatracker.ietf.org/doc/html/rfc7591) +* [RFC8628 OAuth 2.0 Device Authorization Grant](https://datatracker.ietf.org/doc/html/rfc8628) +* [RFC8707 Resource Indicators for OAuth 2.0](https://datatracker.ietf.org/doc/html/rfc8707) +* [RFC9068 JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens](https://datatracker.ietf.org/doc/html/rfc9068) +* [RFC9126 OAuth 2.0 Pushed Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9126) +* [RFC9207 OAuth 2.0 Authorization Server Issuer Identification](https://datatracker.ietf.org/doc/html/rfc9207) +* [RFC9396 OAuth 2.0 Rich Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9396) +* [RFC9449 OAuth 2.0 Demonstrating Proof of Possession (DPoP)](https://datatracker.ietf.org/doc/html/rfc9449) +* [RFC9700 Best Current Practice for OAuth 2.0 Security](https://datatracker.ietf.org/doc/html/rfc9700) +* [draft OAuth 2.0 for Browser-Based Applications](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-browser-based-apps) +* [draft The OAuth 2.1 Authorization Framework](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-12) + +Для получения дополнительной информации об OpenID Connect см.: + +* [OpenID Connect Core 1.0](https://openid.net/specs/openid-connect-core-1_0.html) +* [FAPI 2.0 Security Profile](https://openid.net/specs/fapi-security-profile-2_0-final.html) diff --git a/5.0/ru/0x20-V11-Cryptography.md b/5.0/ru/0x20-V11-Cryptography.md new file mode 100644 index 0000000000..9d9a9a4ff1 --- /dev/null +++ b/5.0/ru/0x20-V11-Cryptography.md @@ -0,0 +1,107 @@ +# V11 Криптография + +## Задачи контроля + +Цель этой главы - определить наилучшие методы общего использования криптографии, а также привить фундаментальное понимание ее принципов и стимулировать переход к более устойчивым и современным подходам. В ней рассмотрены следующие пункты: + +* Внедрение надежных криптографических систем, которые являются отказоустойчивыми, адаптируются к меняющимся угрозам и ориентированы на будущее. +* Использование криптографических механизмов, которые одновременно являются безопасными и соответствуют лучшим практикам индустрии. +* Поддержка безопасной системы управления криптографическими ключами с надлежащим контролем доступа и аудитом. +* Регулярная оценка криптографической отрасли для определения рисков и соответствующей адаптации алгоритмов. +* Обнаружение и управление криптографическими сценариями использования на протяжении всего жизненного цикла приложения с целью обеспечения учёта и защиты всех криптографических ресурсов. + +В дополнение к обозначенным общим принципам и лучшим практикам данный документ также представляет более углубленную техническую информацию о требованиях в Приложении C - Стандарты криптографии. Он содержит алгоритмы и конфигурации, которые считаются «утвержденными» в соответствии с требованиями, изложенными в данном разделе. + +Требования для решения отдельных криптографических задач, таких как управление секретами или обеспечение безопасного соединения будут рассмотрены в разных частях стандарта. + +## V11.1 Инвентаризация и документирование криптографии + +Приложения должны проектироваться с использованием надёжной криптографической архитектуры для защиты данных в соответствии с их классификацией. Шифровать всё подряд — это расточительно, а не шифровать ничего — юридическая халатность. Необходимо найти баланс, который обычно достигается на этапе архитектурного или высокоуровневого проектирования, в ходе дизайн-спринтов или архитектурных исследований. Проектирование криптографии «на ходу» или доработка её после разработки приложения неизбежно приведёт к гораздо большим затратам на обеспечение безопасности, чем если бы она была заложена с самого начала. + +Важно регулярно обнаруживать, вести учёт и оценивать все криптографические активы. В приложении приведена дополнительная информация о том, как это делать. + +Также критически важно подготовить криптографические системы к будущему появлению квантовых компьютеров. Постквантовая криптография (Post-Quantum Cryptography, PQC) — это криптографические алгоритмы, разработанные так, чтобы оставаться надёжными против атак квантовых компьютеров, которые, как ожидается, смогут взламывать широко используемые алгоритмы, такие как RSA и эллиптические кривые (ECC). + +В приложении также содержатся текущие рекомендации по проверенным PQC-примитивам и стандартам. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **11.1.1** | Убедитесь, что задокументирована политика управления криптографическими ключами и описан их жизненный цикл в соответствии со стандартом управления ключей, таким как NIST SP 800-57. Убедитесь, что ключи известны только тем сущностям, которым они должны быть доступны (например, ключи не передавались более чем двум участникам для общих секретов и более чем одному участнику для приватных ключей). | 2 | +| **11.1.2** | Убедитесь, что проводится инвентаризация криптографических средств, которая непрерывно поддерживается, регулярно обновляется и включает все криптографические ключи, алгоритмы и сертификаты, используемые в приложении. Также должна быть задокументирована информация о том, где ключи могут и не могут использоваться в системе, а также какие типы данных могут и не могут быть защищены с помощью этих ключей. | 2 | +| **11.1.3** | Убедитесь, что используются механизмы обнаружения криптографии для идентификации всех случаев применения криптографии в системе , включая операции шифрования, хеширования и цифровой подписи. | 3 | +| **11.1.4** | Убедитесь, что ведётся и поддерживается инвентаризация криптографических средств. В неё должен входить документированный план, описывающий переход на новые криптографические стандарты, такие как постквантовая криптография, чтобы своевременно реагировать на будущие угрозы. | 3 | + +## V11.2 Безопасная реализация криптографии + +Данный раздел содержит требования для определения (выбора), реализации и дальнейшего управления основными криптографическими алгоритмами в приложении. Основная цель - убедиться в том, что используются исключительно надежные, утвержденные криптографические примитивы в соответствии с текущими стандартами (н-р, NIST, ISO/IEC) и лучшими практиками разработки. Организации должны убедиться, что каждый криптографический компонент выбран с учетом рецензируемых исследований и практического тестирования безопасности. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **11.2.1** | Убедитесь, что для криптографических операций используются утвержденные в индустрии реализации (включая библиотеки и аппаратные реализации). | 2 | +| **11.2.2** | Убедитесь, что архитектура приложения поддерживает быструю реконфигурацию, усовершенствование или смену в любой момент случайных чисел, аутентифицированного шифрования, MAC, алгоритмов хеширования, длин ключей, количества раундов, шифров и режимов шифрования для защиты от криптографических атак. Также должна поддерживаться возможность смены ключей, паролей и повторного шифрования данных. Это позволит беспрепятственно перейти на постквантовую криптографию (PQC), как только станут широко доступны высоконадёжные реализации одобренных схем или стандартов PQC. | 2 | +| **11.2.3** | Убедитесь, что все криптографические примитивы используют как минимум 128-бит стойкости с учетом алгоритма, размера ключа и конфигурации. Например, 256-битный ECC ключ обеспечивает примерно 128 бит безопасности, тогда как для достижения того же уровня безопасности в RSA требуется ключ длиной 3072 бита. | 2 | +| **11.2.4** | Убедитесь, что все криптографические операции выполняются за константное время, без использования «short-circuit» операций в сравнениях, вычислениях, возвратах функций для избежания утечек информации. | 3 | +| **11.2.5** | Убедитесь, что все криптографические модули обеспечивают безопасное завершение работы при ошибках, а обработка ошибок реализована таким образом, чтобы не создавать уязвимостей, например, таких как атаки Padding Oracle. | 3 | + +## V11.3 Алгоритмы шифрования + +Алгоритмы аутентифицированного шифрования на основе AES и ChaCha20 составляют основу современной криптографической практики. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **11.3.1** | Убедитесь, что не используются небезопасные режимы блочного шифрования (н-р, ECB) и слабые схемы дополнения (padding) (н-р, PKCS#1 v1.5). | 1 | +| **11.3.2** | Убедитесь, что используются только утверждённые шифры и режимы, такие как AES с GCM. | 1 | +| **11.3.3** | Убедитесь, что зашифрованные данные защищены от несанкционированного изменения, предпочтительно с использованием утверждённого метода аутентифицированного шифрования или путём комбинирования утверждённого метода шифрования с утверждённым алгоритмом MAC. | 2 | +| **11.3.4** | Убедитесь, что случайные числа (nonce), векторы инициализации (IV) и другие одноразовые числа не используются более одного раза для одной и той же пары ключа шифрования и элемента данных. Метод их генерации должен соответствовать требованиям используемого алгоритма. | 3 | +| **11.3.5** | Убедитесь, что любая комбинация алгоритма шифрования и алгоритма MAC работает в режиме encrypt-then-MAC (EtM). | 3 | + +## V11.4 Хеширование и функции на основе хеширования + +Криптографические хеш-функции применяются во множестве криптографических протоколов, таких как цифровые подписи, HMAC, функции генерации ключа (KDF), генерация случайных битов и хранение паролей. Безопасность криптографической системы напрямую зависит от стойкости используемых хеш-функций. В этом разделе изложены требования к использованию надёжных хеш-функций в криптографических операциях. + +Для рекомендаций по хранению паролей, вместе с Приложениием C - Стандарты криптографии, рекомендуем использовать [OWASP Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#password-hashing-algorithms) + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **11.4.1** | Убедитесь, что только утвержденные хэш-функции используются для стандартных сценариев использования в криптографии, включая цифровую подпись, HMAC, KDF, генерацию случайных чисел. Запрещено использовать неустойчивые хэш-функции, (н-р, MD5) для любого использования в криптографии. | 1 | +| **11.4.2** | Убедитесь, что пароли хранятся с использованием утверждённой, вычислительно затратной функции генерации ключа (также известной как «функция хеширования паролей»), с параметрами, настроенными в соответствии с актуальными рекомендациями. Настройки должны обеспечивать баланс между безопасностью и производительностью, чтобы сделать атаки перебором достаточно сложными для требуемого уровня безопасности. | 2 | +| **11.4.3** | Убедитесь, что хэш-функции, используемые в формировании цифровой подписи, как часть аутентификации и целостности данных, устойчивы к коллизиям и имеют достаточную длину. | 2 | +| **11.4.4** | Убедитесь, что приложение использует утвержденную функцию генерации ключа с использованием параметров расширения ключа (key stretching) при генерации ключа из пароля. Параметры должны быть сбалансированы с точки зрения безопасности, производительности и устойчивости к атакам полного перебора при компрометации результирующего криптографического ключа. | 2 | + +## V11.5 Случайные значения + +Криптографически стойкая генерация псевдослучайных чисел (Cryptographically secure Pseudo-random Number Generation (CSPRNG)) чрезвычайно сложна для правильной реализации. Как правило, хорошие источники энтропии в системе быстро истощаются при чрезмерном использовании, тогда как источники с меньшей степенью случайности могут приводить к предсказуемым ключам и секретам. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **11.5.1** | Убедитесь, что все случайные числа и строки, которые должны быть непредсказуемы, должны быть сгенерированы с помощью CSPRNG и иметь хотя бы 128 бит энтропии. Учтите, что UUID не удовлетворяют данному условию. | 2 | +| **11.5.2** | Убедитесь, что механизм генерации случайных чисел является надежным даже при высокой нагрузке. | 3 | + +## V11.6 Криптография с публичным ключом + +Криптография с публичным ключом используется там, где невозможно или нежелательно распределять ключ между несколькими сторонами. + +Также существует потребность в утвержденных методах обмена ключами, таких как Diffie-Hellman (DH) и Elliptic Curve Diffie-Hellman (ECDH), чтобы убедиться, что криптосистема остается безопасной к современным угрозам. Раздел «Безопасная коммуникация» содержит требования для TLS, так что требования данной секции применимы в ситуациях, где криптография с открытым ключом используется отдельно от TLS. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **11.6.1** | Убедитесь, что только утвержденные криптографические алгоритмы и режимы операций используются для генерации ключа и инициализации случайного значения для его генерации (seeding), а также для генерации цифровой подписи и верификации. Алгоритмы генерации ключей не должны генерировать небезопасные ключи уязвимые к известным атакам, например, ключи RSA уязвимы к факторизации Ферма. | 2 | +| **11.6.2** | Убедитесь, что для обмена ключами используются утверждённые криптографические алгоритмы (например, Диффи-Хеллман) с особым вниманием к обеспечению использования безопасных параметров. Это предотвратит атаки на процесс установления ключа, которые могут привести к атакам «человек посередине» или криптографическим взломам. | 3 | + +## V11.7 Шифрование данных в процессе использования + +Защита данных во время их обработки имеет первостепенное значение. Рекомендуется использовать такие методы, как полное шифрование памяти, шифрование данных при передаче, а также обеспечение как можно более быстрого шифрования данных после их использования. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **11.7.1** | Убедитесь, что используется полное шифрование памяти, которое защищает конфиденциальные данные во время их использования, предотвращая доступ к ним неавторизованных пользователей или процессов. | 3 | +| **11.7.2** | Убедитесь, что минимизация данных обеспечивает раскрытие минимально необходимого объёма данных во время обработки, а также что данные шифруются сразу после использования или как можно скорее. | 3 | + +## Ссылки + +Для дополнительной информации см. также: + +* [OWASP Web Security Testing Guide: Testing for Weak Cryptography](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography) +* [OWASP Cryptographic Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html) +* [FIPS 140-3](https://csrc.nist.gov/pubs/fips/140-3/final) +* [NIST SP 800-57](https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final) diff --git a/5.0/ru/0x21-V12-Secure-Communication.md b/5.0/ru/0x21-V12-Secure-Communication.md new file mode 100644 index 0000000000..531de161f5 --- /dev/null +++ b/5.0/ru/0x21-V12-Secure-Communication.md @@ -0,0 +1,57 @@ +# V12 Безопасная коммуникация + +## Задачи контроля + +В этой главе изложены требования, связанные с механизмами защиты данных при передаче, как между клиентом конечного пользователя и серверной частью, так и между компонентами внутренней сервисной архитектуры. + +Основные концепции главы: + +* Шифрование внешних коммуникаций, а в идеале — и внутри системы. +* Настройку механизмов шифрования в соответствии с актуальными рекомендациями, включая предпочтительные алгоритмы и шифры. +* Использование подписанных сертификатов для защиты от перехвата данных третьими лицами. + +Кроме того, помимо общих принципов и лучших практик, ASVS предоставляет более глубокую техническую информацию о криптографической стойкости в Приложении C - Стандарты криптографии. + +## V12.1 Общие рекомендации по безопасности TLS + +В этом разделе приводятся первоначальные рекомендации по обеспечению безопасности TLS-соединений. Для постоянного контроля конфигурации TLS следует использовать актуальные инструменты. + +Хотя использование универсальных (wildcard) TLS-сертификатов само по себе не является небезопасным, компрометация такого сертификата, который используется во всех управляемых окружениях (например, в production, staging, development, test), может привести к нарушению безопасности приложений, использующих этот сертификат. Поэтому при возможности рекомендуется применять надёжную защиту, управление и использовать отдельные TLS-сертификаты для разных сред. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **12.1.1** | Убедитесь, что включены только актуальные и рекомендуемые версии протокола TLS, такие как TLS 1.2 и TLS 1.3. Наиболее свежая версия TLS должна быть выбрана как предпочтительная. | 1 | +| **12.1.2** | Убедитесь, что включены рекомендуемые шифронаборы (cipher suites), предпочтение также стоит отдать самому сильному шифронабору. L3 приложения должны поддерживать только те наборы шифров (cipher suites), которые обеспечивают прямую (forward) секретность. Пояснение: Прямая секретность (Forward Secrecy, FS) — это криптографическая особенность, при которой сессионные ключи уникальны для каждой сессии и не зависят от долгосрочных ключей. Это гарантирует, что даже при компрометации долгосрочного ключа злоумышленник не сможет расшифровать ранее перехваченные зашифрованные сессии. | 2 | +| **12.1.3** | Убедитесь, что приложение проверяет доверенность клиентских сертификатов mTLS, прежде чем использовать идентификацию по сертификату для аутентификации или авторизации. | 2 | +| **12.1.4** | Убедитесь, что включена и настроена правильная проверка отзыва сертификатов, такая как Online Certificate Status Protocol (OCSP) Stapling. | 3 | +| **12.1.5** | Убедитесь, что в настройках TLS приложения включена функция Encrypted Client Hello (ECH) для предотвращения раскрытия конфиденциальных метаданных, таких как Server Name Indication (SNI), во время процесса TLS-рукопожатия. | 3 | + +## V12.2 HTTPS коммуникация с внешними сервисами + +Убедитесь, что весь HTTP-трафик к внешним сервисам, которые предоставляет приложение, передавался в зашифрованном виде с использованием публично доверенных сертификатов. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **12.2.1** | Убедитесь, что для всех соединений между клиентом и внешними HTTP-сервисами используется TLS и не происходит отката к небезопасным или незашифрованным протоколам. | 1 | +| **12.2.2** | Убедитесь, что внешние сервисы используют публично доверенные TLS-сертификаты. | 1 | + +## V12.3 Общая безопасность межсервисного взаимодействия + +Все взаимодействия между серверами (включая внутренние и внешние подключения) должны быть защищены, предпочтительно с применением TLS-шифрования. Соединения с другими системами также должны быть защищены, желательно с использованием TLS. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **12.3.1** | Убедитесь, что для всех входящих и исходящих соединений приложения используется зашифрованный протокол, например TLS, включая системы мониторинга, инструменты управления, удалённый доступ и SSH, промежуточное ПО, базы данных, мейнфреймы, партнёрские системы и внешние API. Сервер не должен допускать откат к небезопасным или незашифрованным протоколам. | 2 | +| **12.3.2** | Убедитесь, что TLS-клиент проверяет сертификат сервера до установления защищенного соединения с TLS-сервером. | 2 | +| **12.3.3** | Убедитесь, что все внутренние HTTP-взаимодействия между компонентами приложения используют TLS или другой подходящий механизм транспортного шифрования, и не происходит откат к небезопасным или незашифрованным коммуникациям. | 2 | +| **12.3.4** | Убедитесь, что TLS-соединения между внутренними сервисами используют доверенные сертификаты. Если используются внутренние или самоподписанные сертификаты, потребляющий сервис должен быть настроен на доверие только к конкретным внутренним центрам сертификации (CA) и конкретным самоподписанным сертификатам. | 2 | +| **12.3.5** | Убедитесь, что сервисы, взаимодействующие внутри системы (intra-service communications), используют строгую аутентификацию для проверки каждого конечного узла. Для проверки подлинности взаимодействующих сторон должны применяться методы строгой аутентификации, такие как аутентификация TLS-клиента, с использованием инфраструктуры открытых ключей и механизмов, устойчивых к атакам повтора (replay attacks). Для микросервисных архитектур рекомендуется использование service mesh для упрощения управления сертификатами и повышения безопасности. | 3 | + +## Ссылки + +Для дополнительной информации см. также: + +* [OWASP - Transport Layer Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html) +* [Mozilla's Server Side TLS configuration guide](https://wiki.mozilla.org/Security/Server_Side_TLS) +* [Mozilla's tool to generate known good TLS configurations](https://ssl-config.mozilla.org/). +* [O-Saft - OWASP Project to validate TLS configuration](https://owasp.org/www-project-o-saft/) diff --git a/5.0/ru/0x22-V13-Configuration.md b/5.0/ru/0x22-V13-Configuration.md new file mode 100644 index 0000000000..79b0cf80a5 --- /dev/null +++ b/5.0/ru/0x22-V13-Configuration.md @@ -0,0 +1,68 @@ +# V13 Конфигурация + +## Задачи контроля + +Стандартная конфигурация приложения должна быть безопасной для использования в Интернете. + +В этой главе приводятся рекомендации по различным настройкам, необходимым для достижения этого, включая те, которые применяются на этапах разработки, сборки и развертывания. + +Рассматриваемые темы включают предотвращение утечек данных, безопасное управление коммуникациями между компонентами и защиту секретов. + +## V13.1 Документация конфигурации + +Этот раздел описывает требования к документации, связанные с тем, как приложение взаимодействует с внутренними и внешними сервисами, а также методы предотвращения потери доступности из-за недоступности сервисов. Также рассматриваются вопросы, касающиеся документации секретных данных. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **13.1.1** | Убедитесь, что все необходимые доступы приложения задокументированы. Сюда должны быть включены как внешние сервисы, от которых зависит приложение, так и сценарии, когда конечный пользователь может задавать адреса для внешнего подключения. | 2 | +| **13.1.2** | Убедитесь, что для каждого сервиса, используемого приложением, в документации определено максимальное количество одновременных соединений (например, лимиты пула соединений) и описано поведение приложения при достижении этого лимита, включая любые механизмы отказоустойчивости или восстановления, чтобы предотвратить ситуации отказа в обслуживании (DoS). | 3 | +| **13.1.3** | Убедитесь, что в документации приложения определены стратегии управления ресурсами для каждой внешней системы или сервиса, которые оно использует (например, базы данных, файловые дескрипторы, потоки, HTTP-соединения). Стратегии должны включать процедуры освобождения ресурсов, настройки таймаутов, обработку сбоев, а также, если реализована логика повторных попыток, указание лимитов, задержек и алгоритмов back-off. Для синхронных HTTP-запросов должны быть заданы короткие таймауты, а повторные запросы должны быть отключены, либо строго ограничены по числу попыток, чтобы предотвратить каскадные задержки и истощение ресурсов. | 3 | +| **13.1.4** | Убедитесь, что в документации приложения определены секреты, критически важные для безопасности приложения, а также установлен график их ротации в соответствии с моделью угроз организации и её бизнес-требованиями. | 3 | + +## V13.2 Конфигурация бэкенд соединений + +Приложения взаимодействуют с множеством сервисов, включая API, базы данных и другие компоненты. Эти сервисы могут считаться внутренними для приложения, но не включёнными в стандартные механизмы контроля доступа приложения, либо быть полностью внешними. В любом случае необходимо настроить приложение для безопасного взаимодействия с этими компонентами и, при необходимости, защитить соответствующую конфигурацию. + +Важно: Глава «Безопасная коммуникация» содержит рекомендации по шифрованию данных при передаче. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **13.2.1** | Убедитесь, что коммуникации между компонентами бэкенда приложения (включая API, промежуточное ПО и уровни данных), которые не поддерживают стандартный механизм пользовательских сессий, проходят с аутентификацией. Аутентификация должна использовать индивидуальные сервисные аккаунты, краткосрочные токены или аутентификацию на основе сертификатов, а не постоянные учётные данные, такие как пароли, API-ключи или общие аккаунты с привилегированным доступом. | 2 | +| **13.2.2** | Убедитесь, что коммуникации между компонентами бэкенда приложения, включая локальные или системные службы, API, промежуточное ПО и уровни данных, выполняются с использованием аккаунтов, которым назначены минимально необходимые привилегии. | 2 | +| **13.2.3** | Убедитесь, что если для аутентификации в сервисе используются учётные данные, то используемые потребителем учётные данные не являются стандартными (например, root/root или admin/admin). | 2 | +| **13.2.4** | Убедитесь, что используется белый список (allowlist) для определения внешних ресурсов или систем, с которыми приложению разрешено взаимодействовать (например, для исходящих запросов, загрузки данных или доступа к файлам). Этот белый список может быть реализован на уровне приложения, веб-сервера, межсетевого экрана или комбинации различных уровней. | 2 | +| **13.2.5** | Убедитесь, что веб- или прикладной сервер настроен с белым списком ресурсов или систем, к которым сервер может отправлять запросы или из которых может загружать данные и файлы. | 2 | +| **13.2.6** | Убедитесь, что при подключении приложения к другим сервисам соблюдается задокументированная конфигурация для каждого соединения, включая максимальное количество параллельных соединений, поведение при достижении их максимума, таймауты и стратегии повторных попыток подключения. | 3 | + +## V13.3 Управление секретами + +Управление секретами — это важная задача конфигурации, необходимая для обеспечения защиты данных, используемых в приложении. Конкретные требования к криптографии изложены в главе «Криптография», а данный раздел сосредоточен на аспектах управления и обработки секретов. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **13.3.1** | Убедитесь, что для безопасного создания, хранения, контроля доступа и уничтожения секретов бэкенда используется решение для управления секретами, например, хранилище ключей (key vault). Секретами могут быть пароли, ключевой материал, интеграции с базами данных и сторонними системами, ключи и seed-значения для токенов с ограниченным временем действия, другие внутренние секреты и API-ключи. Секреты не должны включаться в исходный код приложения или артефакты сборки. Для приложений уровня L3 необходимо использовать аппаратное решение, например, аппаратный модуль безопасности (HSM). | 2 | +| **13.3.2** | Убедитесь, что доступ к секретным ресурсам осуществляется в соответствии с принципом минимально необходимых привилегий (least privilege). | 2 | +| **13.3.3** | Убедитесь, что все криптографические операции выполняются с использованием изолированного модуля безопасности (например, хранилища ключей или аппаратного модуля безопасности), чтобы надежно управлять ключевым материалом и защищать его от утечки за пределы модуля безопасности. | 3 | +| **13.3.4** | Убедитесь, что секреты настроены на срок действия и ротацию в соответствии с документацией приложения. | 3 | + +## V13.4 Непреднамеренная утечка информации + +Конфигурации в промышленной среде должны быть усилены, чтобы избежать раскрытия избыточных данных. Многие из подобных проблем редко оцениваются как значительные риски, но часто используются в связке с другими уязвимостями. Если таких проблем нет по умолчанию, это повышает уровень защиты приложения. + +Например, скрытие версии серверных компонентов не отменяет необходимости обновлять все компоненты, а отключение отображения содержимого папок не исключает необходимости использовать механизмы авторизации или хранить файлы вне публичных каталогов, но всё это повышает уровень безопасности. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **13.4.1** | Убедитесь, что приложение развернуто либо без метаданных систем контроля версий (включая папки .git или .svn), либо так, чтобы эти папки были недоступны как извне, так и для самого приложения. | 1 | +| **13.4.2** | Убедитесь, что режимы отладки отключены для всех компонентов в промышленной среде, чтобы предотвратить раскрытие функций отладки и утечку информации. | 2 | +| **13.4.3** | Убедитесь, что веб-серверы не показывают клиентам списки содержимого каталогов, если это явно не предусмотрено. | 2 | +| **13.4.4** | Убедитесь, что метод HTTP TRACE не поддерживается в продуктовой среде, чтобы избежать потенциальной утечки информации. | 2 | +| **13.4.5** | Убедитесь, что документация (например, по внутренним API) и мониторинговые эндпоинты не доступны, если это явно не предусмотрено. | 2 | +| **13.4.6** | Убедитесь, что приложение не раскрывает подробную информацию о версиях компонентов бэкенда. | 3 | +| **13.4.7** | Убедитесь, что веб-слой настроен на обслуживание только файлов с определёнными расширениями, чтобы предотвратить непреднамеренную утечку информации, конфигураций и исходного кода. | 3 | + +## Ссылки + +Для дополнительной информации см. также: + +* [OWASP Web Security Testing Guide: Configuration and Deployment Management Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing) diff --git a/5.0/ru/0x23-V14-Data-Protection.md b/5.0/ru/0x23-V14-Data-Protection.md new file mode 100644 index 0000000000..b403f6c5be --- /dev/null +++ b/5.0/ru/0x23-V14-Data-Protection.md @@ -0,0 +1,60 @@ +# V14 Защита информации + +## Задачи контроля + +Приложения не могут предусмотреть все сценарии использования и поведение пользователей, поэтому они должны реализовывать механизмы, ограничивающие несанкционированный доступ к конфиденциальным данным на устройствах клиентов. + +В эту главу входят требования, связанные с определением перечня данных, подлежащих защите, методы их защиты, а также конкретные механизмы реализации и ошибки, которых следует избегать. + +Ещё один важный аспект защиты данных — предотвращение массового извлечения, изменения или чрезмерного использования данных. Требования для каждой системы, вероятно, будут сильно различаться, поэтому определение «аномального» поведения должно основываться на модели угроз и бизнес-рисках. С точки зрения ASVS, обнаружение таких проблем рассматривается в главе «Журналирование событий безопасности и обработка ошибок», а установка ограничений — в главе «Валидация и бизнес-логика». + +## V14.1 Документация по защите информации + +Ключевым условием для защиты данных является классификация данных по уровню конфиденциальности. Данные следует классифицировать по нескольким уровням конфиденциальности, где для каждого уровня требуются разные меры защиты. + +Существует множество законов и нормативных актов в области защиты персональных данных, которые определяют то, как приложения должны подходить к хранению, использованию и передаче конфиденциальных данных. Этот раздел не пытается дублировать такие законы и нормы, а сосредоточен на ключевых технических аспектах защиты чувствительных данных. При работе с данными следует учитывать требования местного законодательства и нормативных актов, а при необходимости консультироваться с профильным специалистом по защите данных или юристом. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **14.1.1** | Убедитесь, что все конфиденциальные данные, создаваемые и обрабатываемые приложением, идентифицированы и классифицированы по уровням защиты. Включая закодированные данные, которые легко декодируются, например, строки Base64 или незашифрованные данные в полезной нагрузке JWT. Уровни защиты должны учитывать требования по защите данных и конфиденциальности, которым должно соответствовать приложение. | 2 | +| **14.1.2** | Убедитесь, что для каждого уровня защиты конфиденциальных данных требования к защите задокументированы. Они должны включать (но не ограничиваться) требования по шифрованию, проверке целостности, срокам хранения, способам логирования данных, контролю доступа к чувствительным данным в логах, шифрованию на уровне базы данных, применению технологий повышения конфиденциальности, а также другим требованиям по конфиденциальности. | 2 | + +## V14.2 Базовые меры по защите информации + +Этот раздел содержит различные практические требования, связанные с защитой данных. Большинство из них направлены на непреднамеренную утечку данных, но также есть общее требование — реализовывать меры защиты в зависимости от необходимого уровня защиты для каждого типа данных. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **14.2.1** | Убедитесь, что конфиденциальные данные передаются на сервер только в теле HTTP-запроса или в заголовках. URL и строка запроса не должны содержать конфиденциальную информацию, такую как API-ключ или сессионный токен. | 1 | +| **14.2.2** | Убедитесь, что приложение предотвращает кэширование конфиденциальных данных в серверных компонентах, таких как балансировщики нагрузки и кэши приложений, либо гарантирует их надежное удаление после использования. | 2 | +| **14.2.3** | Убедитесь, что заранее определённые конфиденциальные данные не отправляются ненадёжным сторонам (например, системам трекинга пользователей), чтобы предотвратить нежелательный сбор данных вне контроля приложения. | 2 | +| **14.2.4** | Убедитесь, что для конфиденциальных данных реализованы меры по шифрованию, проверке целостности, срокам хранения, способам логирования, контролю доступа к данным в логах, а также применяются технологии повышения конфиденциальности в соответствии с документацией для соответствующего уровня защиты данных. | 2 | +| **14.2.5** | Убедитесь, что механизмы кэширования настроены так, чтобы кэшировать только ответы с ожидаемым типом содержимого для данного ресурса и не содержать конфиденциального динамического контента. При обращении к несуществующему файлу, веб-сервер должен возвращать ответ 404 или 302, а не подменять на другой существующий файл, что позволит предотвратить атаки типа Web Cache Deception. | 3 | +| **14.2.6** | Убедитесь, что приложение возвращает только минимально необходимый объем конфиденциальных данных для выполнения своей функциональности. Например, показывает только часть цифр номера кредитной карты, а не полный номер. Если требуется отображение полных данных, они должны быть замаскированы в пользовательском интерфейсе, пока пользователь специально не запросил их просмотр. | 3 | +| **14.2.7** | Убедитесь, что конфиденциальная информация подлежит классификации по срокам хранения, чтобы устаревшие или ненужные данные удалялись автоматически, по расписанию или по мере необходимости. | 3 | +| **14.2.8** | Убедитесь, что конфиденциальная информация удаляется из метаданных файлов, загружаемых пользователями, если пользователь явно не согласился на ее хранение. | 3 | + +## V14.3 Защита данных на стороне клиента + +В этом разделе содержатся требования, направленные на предотвращение утечки данных на стороне клиента или user agent приложения. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **14.3.1** | Убедитесь, что аутентифицированные данные очищаются из клиентского хранилища, например, из DOM браузера, после завершения работы клиента или сессии. Заголовок HTTP-ответа Clear-Site-Data может помочь в этом, но клиентская сторона также должна уметь очищать данные, если соединение с сервером недоступно при завершении сессии. | 1 | +| **14.3.2** | Убедитесь, что приложение устанавливает HTTP-заголовки, достаточные для предотвращения кэширования (например, Cache-Control: no-store), чтобы конфиденциальные данные не сохранялись в браузерах. | 2 | +| **14.3.3** | Убедитесь, что данные, хранящиеся в браузерном хранилище (например, localStorage, sessionStorage, IndexedDB или cookie), не содержат конфиденциальной информации, за исключением сессионных токенов. | 2 | + +## Ссылки + +Для дополнительной информации см. также: + +* [Consider using the Security Headers website to check security and anti-caching header fields](https://securityheaders.com/) +* [Documentation about anti-caching headers by Mozilla](https://developer.mozilla.org/en-US/docs/Web/HTTP/Caching) +* [OWASP Secure Headers project](https://owasp.org/www-project-secure-headers/) +* [OWASP Privacy Risks Project](https://owasp.org/www-project-top-10-privacy-risks/) +* [OWASP User Privacy Protection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/User_Privacy_Protection_Cheat_Sheet.html) +* [Australian Privacy Principle 11 - Security of personal information](https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-11-app-11-security-of-personal-information) +* [European Union General Data Protection Regulation (GDPR) overview](https://www.edps.europa.eu/data-protection_en) +* [European Union Data Protection Supervisor - Internet Privacy Engineering Network](https://www.edps.europa.eu/data-protection/ipen-internet-privacy-engineering-network_en) +* [Information on the "Clear-Site-Data" header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Clear-Site-Data) +* [White paper on Web Cache Deception](https://www.blackhat.com/docs/us-17/wednesday/us-17-Gil-Web-Cache-Deception-Attack-wp.pdf) diff --git a/5.0/ru/0x24-V15-Secure-Coding-and-Architecture.md b/5.0/ru/0x24-V15-Secure-Coding-and-Architecture.md new file mode 100644 index 0000000000..49a5c2c210 --- /dev/null +++ b/5.0/ru/0x24-V15-Secure-Coding-and-Architecture.md @@ -0,0 +1,77 @@ +# V15 Безопасная разработка и архитектура + +## Задачи контроля + +Многие требования ASVS относятся либо к конкретной области безопасности, такой как аутентификация или авторизация, либо к определённому типу функциональности приложения, например, к логированию или работе с файлами. + +В этой главе представлены общие требования безопасности, которые следует учитывать при проектировании и разработке приложений. Эти требования касаются не только чистоты архитектуры и качества кода, но и конкретных практик проектирования и программирования, необходимых для обеспечения безопасности приложений. + +## V15.1 Документация по безопасной разработке и архитектуре + +Многие требования по созданию безопасной и защищенной архитектуры зависят от четкого документирования решений, принятых в отношении реализации конкретных механизмов безопасности и компонентов, используемых в приложении. + +В этом разделе излагаются требования к документации, включая определение компонентов, которые считаются содержащими «опасную функциональность» или «рискованными компонентами». + +Компонент с «опасной функциональностью» может быть разработан внутри компании или представлять собой внешнюю зависимость, который выполняет такие операции, как десериализация ненадежных данных, парсинг необработанных файлов или двоичных данных, динамическое выполнение кода или непосредственное управление памятью. Уязвимости в таких операциях создают высокий риск компрометации приложения и его инфраструктуры. + +«Компонент с повышенным риском» — это сторонняя библиотека (т.е. не разработанная внутри компании) с отсутствующими или неэффективно реализованными средствами контроля безопасности в отношении процессов разработки или функциональности. Примерами служат компоненты, которые не поддерживаются, находятся на этапе завершения жизненного цикла или ранее содержали серьезные уязвимости. + +В этом разделе также подчеркивается важность определения соответствующих сроков устранения уязвимостей в сторонних компонентах. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **15.1.1** | Убедитесь, что в документации по приложению определены сроки устранения уязвимостей на основе оценки рисков для внешних зависимостей с уязвимостями и для обновления библиотек в целом, чтобы минимизировать риск, связанный с этими компонентами. | 1 | +| **15.1.2** | Убедитесь, что ведется реестр всех используемых сторонних библиотек (например, Software Bill of Materials, SBOM), с обязательной проверкой, что компоненты получены из предопределенных, доверенных и регулярно поддерживаемых репозиториев. | 2 | +| **15.1.3** | Убедитесь, что в документации приложения указан функционал, требующий значительных временных или вычислительных ресурсов. Необходимо указать, как предотвратить потерю доступности из-за чрезмерного использования этого функционала и как избежать ситуаций, когда формирование ответа занимает больше времени, чем установленный системой таймаут. Возможные меры защиты могут включать асинхронную обработку, использование очередей и ограничение количества параллельных процессов для каждого пользователя и приложения. | 2 | +| **15.1.4** | Убедитесь, что в документации приложения указаны внешние библиотеки, которые считаются «компонентами с повышенным риском». | 3 | +| **15.1.5** | Убедитесь, что в документации приложения выделены те части приложения, в которых используются «функционал с повышенным риском». | 3 | + +## V15.2 Архитектура безопасности и зависимости + +В этом разделе содержатся требования по работе с уязвимыми, устаревшими и небезопасными зависимостями и компонентами посредством управления зависимостями. + +Он также включает использование методов архитектурного уровня, таких как «песочница», инкапсуляция, контейнеризация и сетевая изоляция, для снижения влияния использования «операций с повышенным риском» и «компонентов с повышенным риском» (как определено в предыдущем разделе) и предотвращения потери доступности из-за чрезмерного использования ресурсоемких функций. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **15.2.1** | Убедитесь, что приложение содержит только те компоненты, которые не нарушили задокументированные сроки обновления и исправления. | 1 | +| **15.2.2** | Убедитесь, что в приложении реализованы меры защиты от потери доступности из-за функциональности, требующей много времени или ресурсов, на основе задокументированных решений и стратегий безопасности для этого. | 2 | +| **15.2.3** | Убедитесь, что производственная среда включает только те функции, которые необходимы для работы приложения, и не предоставляет лишние функции, такие как тестовый код, примеры кода и инструменты разработки. | 2 | +| **15.2.4** | Убедитесь, что сторонние компоненты и все их транзитивные зависимости загружаются только из ожидаемых репозиториев (внутренних или внешних) и отсутствует риск атаки через подмену зависимостей (dependency confusion attack) | 3 | +| **15.2.5** | Убедитесь, что приложение реализует дополнительные меры защиты для тех частей приложения, которые документированы как содержащие «функционал с повышенным риском» или использующие сторонние библиотеки, считающиеся «функционалом с повышенным риском». Это могут быть такие методы, как «песочница», инкапсуляция, контейнеризация или изоляция на сетевом уровне, чтобы задержать и предотвратить продвижение (pivoting) злоумышленников, скомпрометировавших одну часть приложения, к другим частям приложения. | 3 | + +## V15.3 Безопасное программирование + +В этом разделе рассматриваются типы уязвимостей, включая type juggling, prototype pollution и другие, возникающие из-за использования небезопасных паттернов программирования на конкретном языке. Некоторые уязвимости актуальны не для всех языков, тогда как другие требуют исправлений, зависящих от конкретного языка программирования, или связаны с особенностями обработки функций (например, HTTP-параметров) в конкретном языке или фреймворке. Также рассматривается риск установки обновлений приложения без криптографической проверки. + +В данном разделе также рассматриваются риски, связанные с использованием объектов для представления данных и их передачей через внешние API. В этом случае приложение должно гарантировать, что поля данных, которые не должны быть доступны для записи, не будут изменены пользовательским вводом (mass assignment), и что API избирательно определяет, какие поля данных возвращаются. Если доступ к полю зависит от прав пользователя, это следует рассматривать в контексте требования к контролю доступа на уровне полей в главе «Авторизация». + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **15.3.1** | Убедитесь, что приложение возвращает только необходимое подмножество полей из объекта данных. Например, оно не должно возвращать весь объект данных, поскольку некоторые отдельные поля должны быть недоступны пользователям. | 1 | +| **15.3.2** | Убедитесь, что при вызовах внешних URL-адресов бэкэнд приложения настроен так, чтобы не выполнять перенаправления, если только это не предусмотрено функционалом. | 2 | +| **15.3.3** | Убедитесь, что в приложении реализованы защитные механизмы против атак типа массового присвоения (mass assignment) путем строгого ограничения разрешенных полей для каждого контроллера и действия, исключая возможность добавления или изменения значений полей, которые не должны быть доступны для данной конкретной операции. | 2 | +| **15.3.4** | Убедитесь, что все прокси и промежуточное ПО корректно передают исходный IP-адрес пользователя, используя доверенные поля данных, которые не могут быть изменены конечным пользователем, а приложение и веб-сервер используют это правильное значение для ведения логирования и принятия решений по безопасности, таких как ограничение запросов. При этом следует учитывать, что даже исходный IP-адрес может быть ненадежным из-за динамических IP-адресов, VPN или корпоративных файрволов. | 2 | +| **15.3.5** | Убедитесь, что приложение явно проверяет соответствие переменных ожидаемому типу данных и использует строгие операции сравнения. Это необходимо для предотвращения уязвимостей, связанных с type juggling и type confusion, вызванных тем, что код приложения делает предположения о типе переменной. | 2 | +| **15.3.6** | Убедитесь, что JavaScript-код написан таким образом, чтобы предотвратить prototype pollution, например, используя Set() или Map() вместо обычных литералов объекта. | 2 | +| **15.3.7** | Убедитесь, что приложение защищено от атак типа HTTP Parameter Pollution (HPP), особенно если используемый фреймворк не различает источники параметров запроса (строка запроса, тело запроса, куки или заголовки). | 2 | + +## V15.4 Безопасная работа с параллельными процессами + +Проблемы безопасности работы параллельных процессов, такие как состояния гонки (race conditions), уязвимости типа «проблем синхронизации проверки и использования ресурсов» (TOCTOU), взаимные блокировки (deadlocks), постоянно повторяющиеся блокировки (livelocks), нехватка ресурсов у потоков (thread starvation) и некорректная синхронизация (improper synchronization), могут приводить к неожиданному поведению системы и создавать угрозы безопасности. В этом разделе рассматриваются различные методы и стратегии, помогающие снизить эти риски. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **15.4.1** | Убедитесь, что к общим объектам в многопоточном коде (например, кэшам, файлам или объектам в памяти, используемым несколькими потоками) используется безопасный многопоточный доступ и механизмов синхронизации, таких как блокировки или семафоры, чтобы избежать состояний гонки и повреждения данных. | 3 | +| **15.4.2** | Убедитесь, что проверки состояния ресурса, например его существования или разрешений, а также зависящие от него действия выполняются как одна атомарная операция, чтобы предотвратить условия гонки времени проверки и времени использования (TOCTOU). Например, проверка существования файла перед его открытием или проверка прав доступа пользователя перед его предоставлением. | 3 | +| **15.4.3** | Убедитесь, что блокировки применяются согласованно, чтобы предотвратить взаимные блокировки потоков (deadlocks) или их бесконечные повторы, а также что логика блокировки инкапсулирована в коде, отвечающем за управление ресурсом. Это гарантирует, что блокировки не могут быть случайно или намеренно изменены внешними классами или кодом. | 3 | +| **15.4.4** | Убедитесь, что политики распределения ресурсов предотвращают нехватку ресурсов у потоков, обеспечивая справедливый доступ к ресурсам, например, используя пулы потоков, позволяя потокам с более низким приоритетом выполняться в течение разумного периода времени. | 3 | + +## Ссылки + +Для дополнительной информации см. также: + +* [OWASP Prototype Pollution Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html) +* [OWASP Mass Assignment Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html) +* [OWASP CycloneDX Bill of Materials Specification](https://owasp.org/www-project-cyclonedx/) +* [OWASP Web Security Testing Guide: Testing for HTTP Parameter Pollution](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/07-Input_Validation_Testing/04-Testing_for_HTTP_Parameter_Pollution) diff --git a/5.0/ru/0x25-V16-Security-Logging-and-Error-Handling.md b/5.0/ru/0x25-V16-Security-Logging-and-Error-Handling.md new file mode 100644 index 0000000000..9ad8c623c1 --- /dev/null +++ b/5.0/ru/0x25-V16-Security-Logging-and-Error-Handling.md @@ -0,0 +1,84 @@ +# V16 Журналирование событий безопасности и обработка ошибок + +## Задачи контроля + +Журналы безопасности отличаются от журналов ошибок или производительности и служат для записи событий, связанных с безопасностью, таких как решения по аутентификации, контроль доступа или попытки обхода механизмов защиты (например, проверка входных данных или бизнес-логики). Их основная задача — обеспечить обнаружение, реагирование и расследование инцидентов за счёт предоставления структурированных данных с высокой информативной ценностью для аналитических систем, таких как SIEM. + +Журналы не должны содержать конфиденциальные персональные данные, если это не предусмотрено законом, а все залогированные сведения должны защищаться как актив высокой важности. Процесс журналирования не должен нарушать конфиденциальность или безопасность системы. Кроме того, приложения должны отрабатывать ошибки безопасным образом, исключая необоснованное раскрытие информации или disruption (нарушение работы). + +Подробные инструкции по внедрению см. в OWASP Cheat Sheets в разделе ссылок. + +## V16.1 Документация по ведению логов + +Этот раздел обеспечивает четкий и полный учет журналирования во всем стеке приложения. Это необходимо для эффективного мониторинга безопасности, реагирования на инциденты и соответствия требованиям. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **16.1.1** | Убедитесь в существовании реестра, в котором документируется ведение журнала на каждом уровне технологического стека приложения, включая какие события регистрируются, форматы логов, где хранятся эти журналы, как они используются, как контролируется доступ к ним и как долго хранятся журналы. | 2 | + +## V16.2 Общее журналирование + +В этом разделе устанавливаются требования, обеспечивающие единообразную структуру журналов безопасности и наличие метаданных. Цель — обеспечить машиночитаемость логов и возможность их анализа в распределённых системах и инструментах мониторинга. + +Естественно, события безопасности часто связаны с конфиденциальными данными. Если такие данные регистрируются без должного внимания, сами журналы становятся секретными и, следовательно, подпадают под действие требований шифрования (прим. автора - законодательства), более строгих политик хранения и могут быть раскрыты в ходе аудита. + +Крайне важно регистрировать только необходимые данные и обращаться с данными журналов с той же осторожностью, что и с другими конфиденциальными активами. + +Приведенные ниже требования устанавливают основополагающие требования к регистрации метаданных, синхронизации, форматированию и контролю. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **16.2.1** | Убедитесь, что каждая запись журнала содержит необходимые метаданные (например, когда, где, кто, что), которые позволят провести подробное исследование временной шкалы, когда произошло событие. | 2 | +| **16.2.2** | Убедитесь, что все источники времени компонентов системы журналирования синхронизированы, а временные метки в метаданных событий безопасности используют UTC или содержат явное указание смещения часового пояса. Рекомендуется применять UTC для обеспечения согласованности в распределённых системах и предотвращения ошибок при переходе на летнее/зимнее время. | 2 | +| **16.2.3** | Убедитесь, что приложение записывает и передаёт логи исключительно в те файлы и сервисы, которые указаны в реестре журналирования. | 2 | +| **16.2.4** | Убедитесь, что логи могут быть прочитаны и коррелированы используемой системой обработки журналов, предпочтительно с использованием общего стандартного формата логирования. | 2 | +| **16.2.5** | Убедитесь, что приложение применяет соответствующие меры защиты при логировании конфиденциальных данных в зависимости от уровня их чувствительности: например, полностью запрещает запись в логи таких данных, как учетные данные или платежные реквизиты, а для других данных (например, сессионных токенов) использует хеширование или частичное/полное маскирование. | 2 | + +## V16.3 Инциденты безопасности + +В этом разделе определяются требования к журналированию событий безопасности в приложении. Фиксация этих событий критически важна для выявления подозрительной активности, проведения расследований и выполнения нормативных требований. + +В этом разделе описываются типы регистрируемых событий, но он не претендует на исчерпывающую информацию. Каждое приложение имеет уникальные факторы риска и эксплуатационный контекст. + +Обратите внимание, что, хотя ASVS включает регистрацию событий безопасности в свою область применения, функции оповещения и корреляции (например, правила SIEM или инфраструктура мониторинга) не входят в сферу применения и обрабатываются операционными системами и системами мониторинга. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **16.3.1** | Убедитесь, что все операции аутентификации регистрируются, включая успешные и неудачные попытки. Также следует фиксировать дополнительные метаданные, такие как тип аутентификации или использованные факторы проверки. | 2 | +| **16.3.2** | Убедитесь, что ведется журнал неудачных попыток авторизации. Для уровня L3 это должно включать в себя журналирование всех решений об авторизации, включая журналирование доступа к конфиденциальным данным (без регистрации самих конфиденциальных данных). | 2 | +| **16.3.3** | Убедитесь, что приложение регистрирует все события безопасности, определенные в документации, а также фиксирует попытки обхода механизмов защиты, включая проверку входных данных, бизнес-логики и системы защиты от автоматизированных атак. | 2 | +| **16.3.4** | Убедитесь, что приложение регистрирует в журналах неожиданные ошибки и сбои механизмов безопасности, включая, например, ошибки TLS-соединения на стороне сервера. | 2 | + +## V16.4 Защита журналов + +Журналы представляют собой ценные источники forensic-данных и должны быть надёжно защищены. Если логи можно легко изменить или удалить, они теряют целостность и становятся ненадёжными для расследования инцидентов или судебных разбирательств. Кроме того, журналы могут раскрывать внутреннюю логику работы приложения или содержать конфиденциальные метаданные, что делает их привлекательной целью для злоумышленников. + +В данном разделе определены требования, обеспечивающие защиту журналов от несанкционированного доступа, изменений и раскрытия и безопасную передачу и хранение в изолированных защищённых системах. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **16.4.1** | Убедитесь, что все компоненты системы логирования корректно кодируют данные, чтобы предотвратить атаки типа внедрения в журналы (log injection). | 2 | +| **16.4.2** | Убедитесь, что логи защищены от неавторизованного доступа и не могут быть модифицированы. | 2 | +| **16.4.3** | Убедитесь, что логи безопасно передаются в логически изолированную систему для анализа, обнаружения угроз, генерации оповещений и эскалации инцидентов. Это гарантирует сохранность журналов даже в случае компрометации основного приложения. | 2 | + +## V16.5 Обработка ошибок + +Данный раздел определяет требования к безопасному и корректному завершению работы приложений в случае сбоев, исключающему раскрытие конфиденциальной внутренней информации. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **16.5.1** | Убедитесь, что при возникновении непредвиденной или связанной с безопасностью ошибки пользователю возвращается только общее сообщение, гарантируя отсутствие раскрытия конфиденциальных внутренних данных системы, таких как трассировки стека, запросы, секретные ключи и токены. | 2 | +| **16.5.2** | Убедитесь, что приложение продолжает работать в безопасном режиме при недоступности внешних ресурсов, используя такие механизмы, как автоматические выключатели (circuit breakers) или плавное снижение функциональности (graceful degradation). | 2 | +| **16.5.3** | Убедитесь, что приложение корректно и безопасно завершает работу при возникновении исключений, предотвращая опасные сценарии по типу «fail-open», когда, например, транзакция ошибочно выполняется, несмотря на ошибки в логике валидации. | 2 | +| **16.5.4** | Убедитесь, что определён обработчик ошибок «крайние меры», который будет перехватывать все необработанные ошибки. Это необходимо как для предотвращения потери информации об ошибках, которая должна быть записана в файлы журналов, так и для того, чтобы ошибка не остановила весь процесс приложения, что привело бы к потере доступности. | 3 | + +Примечание: Некоторые языки программирования (включая Swift, Go и многие функциональные языки в силу их парадигмы) не поддерживают исключения или обработчики событий «крайней меры». В таких случаях архитекторам и разработчикам следует использовать подходы, соответствующие паттернам, языковым особенностям или возможностям фреймворка, чтобы гарантировать безопасную обработку исключительных, непредвиденных или связанных с безопасностью событий. + +## Ссылки + +Для дополнительной информации см. также: + +* [OWASP Web Security Testing Guide: Testing for Error Handling](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/README) +* [OWASP Authentication Cheat Sheet section about error messages](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#authentication-and-error-messages) +* [OWASP Logging Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html) +* [OWASP Application Logging Vocabulary Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Vocabulary_Cheat_Sheet.html) diff --git a/5.0/ru/0x26-V17-WebRTC.md b/5.0/ru/0x26-V17-WebRTC.md new file mode 100644 index 0000000000..fafc396930 --- /dev/null +++ b/5.0/ru/0x26-V17-WebRTC.md @@ -0,0 +1,75 @@ +# V17 WebRTC + +## Задачи контроля + +Web Real-Time Communication (WebRTC) — технология, обеспечивающая передачу голоса, видео и данных в реальном времени в современных приложениях. По мере роста WebRTC обеспечение безопасности инфраструктуры WebRTC становится критически важным. В данном разделе представлены требования по безопасности для разработчиков, хостинг-провайдеров и интеграторов решений на основе WebRTC. + +Рынок WebRTC можно разделить на три основных сегмента: + +1. Разработчики продуктов — поставщики, создающие и поставляющие продукты и решения WebRTC как с собственным, так и с открытым исходным кодом. Они специализируются на разработке надежных и безопасных технологий WebRTC, которые могут использоваться другими. + +2. Платформы коммуникаций как услуга (CPaaS) — провайдеры, предлагающие API, SDK и инфраструктуру для реализации WebRTC-функциональности. Они могут использовать продукты первой категории или разрабатывать собственное ПО WebRTC для предоставления этих услуг. + +3. Поставщики услуг — организации, внедряющие WebRTC-решения (на базе готовых продуктов или собственных разработок) для создания приложений для онлайн-конференций, здравоохранения, электронного обучения и других областей, где критически важна коммуникация в режиме реального времени. + +Изложенные здесь требования безопасности в первую очередь ориентированы на разработчиков продуктов, CPaaS-провайдеров, поставщиков услуг, которые: + +* Используют open-source решения для создания своих WebRTC-приложений. +* Применяют коммерческие WebRTC-продукты как часть своей инфраструктуры. +* Разрабатывают собственные WebRTC-решения или интегрируют различные компоненты в единый сервис. + +Важно отметить, что эти требования безопасности не распространяются на разработчиков, использующих исключительно SDK и API, предоставляемые поставщиками CPaaS. Для таких разработчиков CPaaS-провайдеры обычно несут ответственность за обеспечение базовой безопасности своей платформы, и универсальные стандарты безопасности (например, ASVS) могут не полностью покрывать их потребности. + +## V17.1 TURN-сервер + +В этом разделе определяются требования безопасности для систем, использующих собственные серверы TURN (Traversal Using Relays around NAT). Серверы TURN помогают ретранслировать медиаданные в сетевых средах с ограничениями, но могут представлять опасность при неправильной настройке. Эти меры контроля направлены на безопасную фильтрацию адресов и защиту от исчерпания ресурсов. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **17.1.1** | Убедитесь, что сервис TURN (Traversal Using Relays around NAT) разрешает доступ только к IP-адресам, не зарезервированным для специальных целей (например, внутренние сети, широковещательная рассылка, loopback-адреса). Данное требование применяется как к IPv4, так и к IPv6 адресам. | 2 | +| **17.1.2** | Убедитесь, что сервис TURN (Traversal Using Relays around NAT) защищен от исчерпания ресурсов при попытках легитимных пользователей открыть чрезмерное количество портов на сервере. | 3 | + +## V17.2 Требования к медиасерверам + +Данные требования применяются только к системам, использующим собственные WebRTC-медиасерверы, такие как, SFU (Selective Forwarding Units), MCU (Multipoint Control Units), серверы записи, шлюзовые серверы. Медиасерверы обрабатывают и распределяют медиапотоки, поэтому их безопасность критически важна для защиты взаимодействия между участниками. Обеспечение безопасности медиапотоков в WebRTC-приложениях является приоритетной задачей для предотвращения перехвата данных, манипуляций с трафиком, атак типа «отказ в обслуживании». Эти угрозы могут нарушить конфиденциальность пользователей и качество связи. + +В частности, необходимо реализовать защиту от флуд-атак, включая: ограничение частоты запросов (rate limiting), проверку временных меток, использование синхронизированных часов для контроля временных интервалов и управление буферами для предотвращения переполнения и поддержания правильной временной синхронизации. Если пакеты для конкретного медиасеанса прибывают слишком быстро, избыточные пакеты должны отбрасываться. Также важно защитить систему от некорректных пакетов путем валидации входных данных, безопасной обработки целочисленных переполнений, предотвращения переполнения буферов и применения других надежных методов обработки ошибок. + +Системы, использующие исключительно peer-to-peer медиакоммуникацию между веб-браузерами без промежуточных медиасерверов, не подпадают под эти специфические требования к медиабезопасности. + +Данный раздел относится к использованию Datagram Transport Layer Security (DTLS) в контексте WebRTC. Требования к документированной политике управления криптографическими ключами приведены в главе «Криптография». Информацию об одобренных криптографических методах можно найти в Приложении С - Криптография ASVS или в таких документах, как NIST SP 800-52 Rev. 2 или BSI TR-02102-2 (версия 2025-01). + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **17.2.1** | Убедитесь, что ключ сертификата Datagram Transport Layer Security (DTLS) управляется и защищается в соответствии с документированной политикой управления криптографическими ключами. | 2 | +| **17.2.2** | Убедитесь, что медиасервер настроен на использование только одобренных наборов шифров Datagram Transport Layer Security (DTLS) и защищенного профиля безопасности для расширения DTLS, применяемого при установке ключей для Secure Real-time Transport Protocol (DTLS-SRTP). | 2 | +| **17.2.3** | Убедитесь, что медиасервер проверяет аутентификацию Secure Real-time Transport Protocol (SRTP) для предотвращения атак с внедрением Real-time Transport Protocol (RTP), которые могут привести к отказу в обслуживании (Denial of Service) или вставке поддельного аудио-/видеоконтента в медиапотоки. | 2 | +| **17.2.4** | Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика при получении некорректных пакетов Secure Real-time Transport Protocol (SRTP). | 2 | +| **17.2.5** | Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетами Secure Real-time Transport Protocol (SRTP) от легитимных пользователей. | 3 | +| **17.2.6** | Убедитесь, что медиасервер не подвержен уязвимости «Гонка ClientHello» (ClientHello Race Condition) в Datagram Transport Layer Security (DTLS), проверив наличие известных уязвимостей в публичных источниках или выполнив тестирование на воспроизведение условий гонки. | 3 | +| **17.2.7** | Убедитесь, что механизмы аудио- и видеозаписи, связанные с медиасервером, способны продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетов Secure Real-time Transport Protocol (SRTP) от легитимных пользователей. | 3 | +| **17.2.8** | Убедитесь, что сертификат Datagram Transport Layer Security (DTLS) проверяется на соответствие атрибуту отпечатка (fingerprint) в Session Description Protocol (SDP), с немедленным прекращением медиапотока в случае несоответствия — это гарантирует подлинность передаваемых данных. | 3 | + +## V17.3 Сигнализация + +Данный раздел устанавливает требования для систем, использующих собственные серверы сигнализации WebRTC. Сигнализация координирует peer-to-peer (P2P) взаимодействие и должна быть устойчива к атакам, способным нарушить установление сеансов или управление соединениями. + +Для обеспечения безопасной сигнализации системы должны корректно обрабатывать некорректные входные данные и оставаться доступными под нагрузкой. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **17.3.1** | Убедитесь, что сигнальный сервер способен продолжать обработку легитимных входящих сообщений сигнализации даже в условиях флуд-атаки. Для этого необходимо реализовать механизм ограничения частоты запросов (rate limiting) на уровне сигнализации. | 2 | +| **17.3.2** | Убедитесь, что сигнальный сервер способен продолжать обработку легитимных сообщений сигнализации даже при получении некорректных сообщений, которые могут вызвать отказ в обслуживании (Denial of Service, DoS). Для этого необходимо реализовать: проверку входных данных (input validation), безопасную обработку целочисленных переполнений (integer overflows), защиту от переполнения буферов (buffer overflows) и другие надежные методы обработки ошибок. | 2 | + +## Ссылки + +Для дополнительной информации см. также: + +* DoS-атака WebRTC DTLS ClientHello лучше всего документирована [в записи блога Enable Security для специалистов по безопасности](https://www.enablesecurity.com/blog/novel-dos-vulnerability-affecting-webrtc-media-servers/) и соответствующем [техническом документе для разработчиков WebRTC](https://www.enablesecurity.com/blog/webrtc-hello-race-conditions-paper/) +* [RFC 3550 - RTP: A Transport Protocol for Real-Time Applications](https://www.rfc-editor.org/rfc/rfc3550) +* [RFC 3711 - The Secure Real-time Transport Protocol (SRTP)](https://datatracker.ietf.org/doc/html/rfc3711) +* [RFC 5764 - Datagram Transport Layer Security (DTLS) Extension to Establish Keys for the Secure Real-time Transport Protocol (SRTP))](https://datatracker.ietf.org/doc/html/rfc5764) +* [RFC 8825 - Overview: Real-Time Protocols for Browser-Based Applications](https://www.rfc-editor.org/info/rfc8825) +* [RFC 8826 - Security Considerations for WebRTC](https://www.rfc-editor.org/info/rfc8826) +* [RFC 8827 - WebRTC Security Architecture](https://www.rfc-editor.org/info/rfc8827) +* [DTLS-SRTP Protection Profiles](https://www.iana.org/assignments/srtp-protection/srtp-protection.xhtml) diff --git a/5.0/ru/0x90-Appendix-A_Glossary.md b/5.0/ru/0x90-Appendix-A_Glossary.md new file mode 100644 index 0000000000..d4b6b3c79d --- /dev/null +++ b/5.0/ru/0x90-Appendix-A_Glossary.md @@ -0,0 +1,89 @@ +# Приложение A: Термины и сокращения + +* **Absolute Maximum Session Lifetime** (абсолютный максимальный срок действия сессии) — также известный как "Overall Timeout" в NIST, это максимальное время, в течение которого сеанс может оставаться активным после аутентификации, независимо от действий пользователя. Это составная часть механизма завершения сессии. +* **Allowlist** — список разрешённых данных или операций, например список символов, разрешённых форматно-логическим контролем. +* **Anti-forgery token** (токен защиты от подделки) — механизм, при котором один или несколько токенов передаются в запросе и проверяются сервером приложения, чтобы гарантировать, что запрос поступил из ожидаемой конечной точки. +* **Application Security** (безопасность приложений) — это анализ компонентов, составляющих прикладной уровень эталонной модели взаимодействия открытых систем (модели OSI), и в меньшей степени – инфраструктуры, например, операционных систем или сетей. +* **Application Security Verification** (верификация требований к безопасности приложений) — технический анализ приложения по стандарту OWASP ASVS. +* **Application Security Verification Report** — отчёт по тестированию конкретного приложения, в котором аудитор документирует общие результаты и даёт сопроводительные пояснения. +* **Authentication** (аутентификация) — проверка учетных данных, предъявленных пользователем приложения. +* **Automated Verification** (автоматизированная проверка) – поиск сигнатур уязвимостей с помощью автоматизированных инструментов динамического и/или статического анализа безопасности кода. +* **Black box testing** (метод «чёрного ящика») — метод тестирования программного обеспечения, который проверяет функциональность приложения, не заглядывая в его внутреннюю структуру и операции. +* **Common Weakness Enumeration** (CWE, список общих недостатков) – разработанный сообществом список распространенных недостатков безопасности программного обеспечения. Он служит общим языком, мерилом для средств обеспечения безопасности программного обеспечения, а также основой для выявления недостатков, их устранения и предотвращения. +* **Component** (компонент) – автономный блок кода со связанными дисковыми и сетевыми интерфейсами, который взаимодействует с другими компонентами. +* **Credential Service Provider** (CSP) — также называемый поставщиком идентификационных данных (IdP). Источник пользовательских данных, который может использоваться другими приложениями для аутентификации. +* **Cross-Site Script Inclusion** (XSSI) — разновидность атаки межсайтового скриптинга (XSS), при которой веб-приложение загружает вредоносный код из внешнего источника и включает его в состав собственного содержимого. +* **Cross-Site Scripting** (XSS, межсайтовый скриптинг) — уязвимость в системе безопасности, обычно обнаруживаемая в web-приложениях, позволяющая внедрять скрипты в контент на стороне клиента. +* **Cryptographic module** (криптографический модуль) — аппаратное, программное и/или микропрограммное обеспечение, реализующее криптографические алгоритмы и/или генерирующее криптографические ключи. +* **Cryptographically secure pseudo-random number generator** (CSPRNG, криптографически стойкий генератор псевдослучайных чисел) — генератор псевдослучайных чисел со свойствами, делающими его пригодным для использования в криптографии, также называется криптографическим генератором случайных чисел (cryptographic random number generator, CRNG). +* **Datagram Transport Layer Security** (DTLS) — криптографический протокол, обеспечивающий безопасность связи по сетевому соединению. Он основан на протоколе TLS, но адаптирован для защиты ориентированных на датаграммы протоколов (обычно поверх UDP). Версия DTLS 1.3 стандартизирована в RFC 9147. +* **Datagram Transport Layer Security Extension to Establish Keys for the Secure Real-time Transport Protocol** (DTLS-SRTP) — механизм использования DTLS-рукопожатия для формирования ключей сеанса SRTP. Стандартизирован в RFC 5764. +* **Design Verification** (верификация архитектуры) — технический анализ архитектуры безопасности приложения. +* **Dynamic Application Security Testing** (DAST, динамический анализ приложения) — технологии, предназначенные для обнаружения условий, указывающих на уязвимость системы безопасности в приложении, производящийся во время его выполнения. +* **Dynamic Verification** (динамическая верификация) — использование автоматизированных инструментов, использующих сигнатуры уязвимостей для поиска проблем во время выполнения приложения. +* **Fast IDentity Online** (FIDO) — набор стандартов аутентификации, которые позволяют использовать различные методы аутентификации, включая биометрические данные, модули доверенной платформы (TPM), USB-токены и т.д. +* **Hardware Security Module** (HSM, аппаратный модуль безопасности) — аппаратный компонент, способный хранить криптографические ключи и другие секреты в защищённом виде. +* **Hibernate Query Language** (HQL) — язык запросов, внешне похожий на SQL, используемый библиотекой Hibernate ORM. +* **HTTP Strict Transport Security** (HSTS) — политика, которая предписывает браузеру подключаться к домену, возвращающему заголовок, только через TLS и при наличии действительного сертификата. Активируется с помощью поля заголовка ответа Strict-Transport-Security. +* **HyperText Transfer Protocol** (HTTP) — протокол приложений для распределенных, гипермедиа (гипертекст+мультимедиа)-систем и совместной работы. Основа для передачи данных в World Wide Web. +* **HyperText Transfer Protocol over SSL/TLS** (HTTPS) — Способ защиты HTTP-соединения путём его шифрования с использованием TLS. +* **Identity Provider** (IdP) — также называется провайдером услуг аутентификации (CSP) в ссылках NIST. Сущность, которая предоставляет источник аутентификации для других приложений. +* **Inactivity Timeout** (таймаут бездействия) — промежуток времени, в течение которого сессия может оставаться активной при отсутствии взаимодействия пользователя с приложением. Это составная часть механизма завершения сессии. +* **Input Validation** (форматно-логический контроль) — нормализация и проверка корректности недоверенных входных данных. +* **JSON Web Token** (JWT) – RFC 7519 определяет стандарт для объекта данных JSON, состоящего из раздела заголовка (header), который объясняет, как проверять объект, раздела тела (body), содержащего набор утверждений (claims), и раздела подписи (signature), содержащей цифровую подпись для проверки содержимого раздела тела. Это тип автономного (self-contained) токена. +* **Local File Inclusion** (LFI) – атака, использующая уязвимые процедуры включения файлов в приложении, что приводит к подключению локальных файлов, уже присутствующих на сервере. +* **Malicious Code** (вредоносный код) — код, попавший в приложение во время его разработки без ведома владельца, который обходит имеющуюся политику безопасности приложения. Не путать с вредоносным ПО, таким как вирусы или черви. +* **Malware** (вредоносное ПО) — исполняемый код, который попадает в приложение во время выполнения без ведома пользователя или администратора приложения. +* **Message authentication code** (MAC) — криптографическая контрольная сумма данных, вычисляемая алгоритмом генерации MAC, которая используется для обеспечения целостности и подлинности. +* **Multi-factor authentication** (MFA, многофакторная аутентификация) — аутентификация, использующая два или более различных факторов. +* **Mutual TLS** (mTLS) – См. TLS client authentication. +* **Object-relational Mapping** (ORM) – система, позволяющая приложению делать запросы к реляционной/табличной базе данных, используя объектную модель, совместимую с приложением. +* **One-time Password** (OTP, одноразовый пароль) — уникальный пароль, сгенерированный для одноразового использования. +* **Open Worldwide Application Security Project** (OWASP) – бесплатно распространяемый проект и открытое международное сообщество, занимающееся повышением безопасности прикладного программного обеспечения. Наша миссия — сделать безопасность приложений «видимой», чтобы люди и организации могли принимать обоснованные решения о рисках безопасности приложений. См.: [https://www.owasp.org/](https://www.owasp.org/). +* **Password-Based Key Derivation Function 2** (PBKDF2) – специальный односторонний алгоритм для формирования стойкого криптографического ключа на основе введённого текста (например, пароля) и дополнительного случайного значения — соли, которая затрудняет взлом пароля в режиме offline, если вместо исходного пароля хранится результирующее значение. +* **Public Key Infrastructure** (PKI, инфраструктура открытых ключей) — механизм, который связывает открытые ключи с соответствующими идентификаторами сущностей. Привязка устанавливается посредством процесса регистрации и выдачи сертификатов в центре сертификации (CA) и с его помощью. +* **Public Switched Telephone Network** (PSTN, коммутируемая телефонная сеть общего пользования, ТСОП, ТфОП) — традиционная телефонная сеть, соединяющая как стационарные, так и мобильные телефоны. +* **Real-time Transport Protocol** (RTP) и **Real-time Transport Control Protocol** (RTCP) — два протокола, используемые совместно для передачи мультимедийных потоков. Применяются в стеке WebRTC. Стандартизированы в RFC 3550. +* **Reference Token** (ссылочный токен) — тип токена, который служит указателем или идентификатором для состояния или метаданных, хранящихся на сервере, также известен как случайный или непрозрачный токен. В отличие от автономных (self-contained) токенов, сслылочный токен не содержат собственной информации, а зависят от контекста сервера. Ссылочный токен либо является идентификатором сессии, либо содержит его. +* **Relying Party** (RP, проверяющая сторона) — как правило, приложение, которое полагается на то, что пользователь прошёл аутентификацию у отдельного поставщика аутентификации. Приложение проверяет токен или набор подписанных утверждений, предоставляемых этим поставщиком, чтобы убедиться, что пользователь является тем, за кого себя выдает. +* **Remote File Inclusion** (RFI, подключение удалённых файлов) — атака, эксплуатирующая уязвимые процедуры включения файлов в приложении, что приводит к подключению удалённых файлов. +* **Scalable Vector Graphics** (SVG, масштабируемая векторная графика) — язык разметки на основе XML для описания двумерной векторной графики. +* **Secure Real-time Transport Protocol** (SRTP) и **Secure Real-time Transport Control Protocol** (SRTCP) – расширение протоколов RTP и RTCP, предоставляющее функции шифрования сообщений, проверки подлинности и обеспечения целостности. Стандартизирован в RFC 3711. +* **Security Architecture** (архитектура безопасности) — абстракция дизайна приложения, которая определяет и описывает, где и как применяются меры безопасности, а также местоположение и категории информации. +* **Security Assertion Markup Language** (SAML) — открытый стандарт для единого входа (SSO), основанный на передаче подписанных утверждений (обычно в формате XML) между поставщиком идентификации и проверяющей стороной. +* **Security Configuration** (конфигурация безопасности) — конфигурация среды выполнения приложения, которая влияет на то, как применяются меры безопасности. +* **Security Control** (мера обеспечения безопасности) — функция или компонент, который контролирует (например, меры контроля доступа) или приводит к действию по обеспечению безопасности (например, регистрирует запись в журнале аудита). +* **Security information and event management** (SIEM) — система для обнаружения угроз, обеспечения соответствия требованиям и управления инцидентами безопасности путём сбора и анализа связанных с безопасностью данных из различных источников ИТ-инфраструктуры организации. +* **Self-Contained Token** (автономный токен) — токен, который инкапсулирует один или несколько атрибутов, не зависящих от серверного состояния или другого внешнего хранилища. Эти токены обеспечивают подлинность и целостность содержащихся в них атрибутов, позволяя осуществлять безопасный обмен информацией между системами «без сохранения состояния». Автономные токены обычно защищаются с помощью криптографических методов, таких как цифровые подписи или коды аутентификации сообщений (MAC), для обеспечения подлинности, целостности, а в некоторых случаях и конфиденциальности своих данных. Распространёнными примерами являются SAML Assertions и JWT. +* **Server-side Request Forgery** (SSRF, подделка запросов на стороне сервера) — атака, которая злоупотребляет функциональными возможностями сервера для чтения или обновления внутренних ресурсов путем предоставления или изменения URL-адреса, по которому код, запущенный на сервере, будет читать или отправлять данные. +* **Session Description Protocol** (SDP) — формат сообщений для настройки мультимедийного сеанса (используется, например, в WebRTC). Стандартизирован в RFC 4566. +* **Session Identifier** или **Session ID** (идентификатор сессии) — ключ, который идентифицирует сессию с сохранением состояния, хранящийся на серверной стороне. Передаётся клиенту и обратно с помощью ссылочного токена (reference token). +* **Session Token** (сессионный токен) — общий термин, используемый в данном стандарте для обозначения токена или значения, применяемого в сессиях без сохранения состояния (которые используют автономный токен) или в сессиях с сохранением состояния (которые используют ссылочный токен). +* **Session Traversal Utilities for NAT** (STUN) — протокол, используемый для преодоления ограничений NAT с целью установления одноранговой связи. Стандартизирован в RFC 3489. +* **Single-factor authenticator** — Механизм проверки аутентификации пользователя. Фактором аутентификации может быть что-то, что вы знаете (запоминаемые секреты, пароли, парольные фразы, PIN-коды), что-то, что вы представляете собой (биометрия, отпечатки пальцев, сканы лица), или что-то, чем вы владеете (OTP-токены, криптографическое устройство, такое как смарт-карта). +* **Single Sign-on Authentication** (SSO, аутентификация единого входа) — пользователь входит в одно приложение, одновременно получая возможность войти в несколько других, без необходимости повторной аутентификации. Например, когда вы входите в Google, вы автоматически входите в другие сервисы Google, такие как YouTube, Google Docs, Gmail и т.д. +* **Software bill of materials** (SBOM) — структурированный и исчерпывающий перечень всех компонентов, модулей, библиотек, фреймворков и других ресурсов, необходимых для сборки или компиляции программного приложения. +* **Software Composition Analysis** (SCA, композиционный анализ) — Совокупность технологий, предназначенных для анализа состава приложений, зависимостей, библиотек и пакетов на наличие уязвимостей безопасности в используемых версиях компонентов. Не следует путать с анализом исходного кода, который теперь обычно обозначается как SAST. +* **Software development lifecycle** (SDLC, жизненный цикл разработки программного обеспечения) – пошаговый процесс разработки ПО, начиная с первоначальных требований, и заканчивая развертыванием и сопровождением. +* **SQL Injection** (SQLi, SQL-инъекция) — метод внедрения кода, используемый для атаки приложений, управляемых данными, в котором вредоносные SQL-выражения вставляются в точку входа. +* **Stateful Session Mechanism** (механизм сессии с сохранением состояния) — механизм управления сессией, когда приложение сохраняет состояние сеанса на серверной стороне, который обычно соответствует токену сеанса, сгенерированному с использованием криптографически стойкого генератора псевдослучайных чисел (CSPRNG), и выданному конечному пользователю. +* **Stateless Session Mechanism** (механизм сессии без сохранения состояния) — механизм управления сессией, который использует автономный токен, который передаётся клиентам и содержит информацию о сеансе, не обязательно хранящуюся в службе, которая затем получает и проверяет токен. На практике службе потребуется доступ к некоторой информации о сеансе (например, к списку отозванных JWT), чтобы иметь возможность применять необходимые меры безопасности. +* **Static application security testing** (SAST, статический анализ безопасности приложений) — набор технологий, предназначенных для анализа исходного кода, байт-кода и бинарных файлов приложения с целью выявления условий на уровне кода или архитектуры, указывающих на уязвимости безопасности. Решения SAST анализируют приложение «изнутри наружу» в статическом состоянии (без выполнения). +* **Threat Modeling** (моделирование угроз) — метод, состоящий в совершенствовании архитектур безопасности для выявления нарушителей, границ доверия, мер безопасности, а также ключевых технических и бизнес-активов. +* **Time-of-check to time-of-use** (TOCTOU) — ситуация, когда приложение проверяет состояние ресурса перед его использованием, но состояние ресурса может быть изменено между проверкой и использованием. Это может сделать результаты проверки недействительными и привести к ситуации, когда приложение выполняет некорректные действия из-за несоответствия состояния. +* **Time based One-time Passwords** (TOTPs) — метод создания OTP, при котором текущее время является входным аргументом для алгоритма формирования пароля. +* **TLS client authentication**, также называемый **Mutual TLS** (mTLS) — в стандартном TLS-соединении клиент может использовать сертификат, предоставленный сервером, для проверки подлинности сервера. При использовании mTLS клиент также использует свой собственный закрытый ключ и сертификат, чтобы позволить серверу проверить подлинность клиента. +* **Transport Layer Security** (TLS, безопасность транспортного уровня) — криптографические протоколы, обеспечивающие безопасность канала связи по сетевому соединению. +* **Traversal Using Relays around NAT** (TURN) — расширение протокола STUN, использующее TURN-сервер в качестве ретранслятора, когда прямое одноранговое соединение не может быть установлено. Стандартизировано в RFC 8656. +* **Trusted execution environment** (TEE) — изолированная среда выполнения, обеспечивающая безопасное исполнение приложений вне зависимости от состояния остальной системы. +* **Trusted Platform Module** (TPM, модуль доверенной платформы) — тип HSM, который обычно является компонентом другого оборудования, например, материнской платы, и выступает в роли «корня доверия» для этой системы. +* **Trusted Service Layer** (уровень доверенных служб) — любая доверенная точка принудительного контроля, такая как микросервис, бессерверный API, серверная часть, доверенный API на клиентском устройстве с безопасной загрузкой, партнёрские или внешние API и т.д. «Доверенный» означает, что нет опасений, что недоверенный пользователь сможет обойти или пропустить слой или элементы управления, реализованные на этом уровне. +* **Uniform Resource Identifier** (URI, унифицированный идентификатор ресурса) — это строка символов, используемая для идентификации ресурса, например, веб-страницы, почтового адреса, места. +* **Uniform Resource Locator** (URL, унифицированный адрес ресурса) — это строка, указывающая местоположение ресурса в Интернете. +* **Universally Unique Identifier** (UUID, универсальный уникальный идентификатор) — уникальный номер-идентификатор, используемый в качестве средства идентификации в программном обеспечении. +* **Verifier** (верификатор/аудитор) — лицо или группа людей, которые анализируют безопасность приложения на соответствие требованиям OWASP ASVS. +* **Web Real-Time Communication** (WebRTC) — стек протоколов и связанный с ним веб-API, используемые для передачи мультимедийных потоков в веб-приложениях, обычно в контексте телеконференций. Основан на SRTP, SRTCP, DTLS, SDP и STUN/TURN. +* **WebSocket over TLS** (WSS) — практика защиты WebSocket-соединения путём размещения протокола WebSocket поверх протокола TLS. +* **What You See Is What You Get** (WYSIWYG) – тип редактора гипермедиа, который показывает, как на самом деле будет выглядеть содержимое при отображении, а не код разметки, управляющий отображением. +* **X.509 Certificate** — электронный сертификат, соответствующий общепринятому международному стандарту инфраструктуры открытых ключей X.509 (PKI) для проверки принадлежности открытого ключа идентификатору пользователя, компьютера или сервиса, указанному в сертификате. +* **XML eXternal Entity** (XXE) — тип элемента XML, который может получать доступ к локальному или удаленному содержимому через объявленный идентификатор. Может привести к атакам инъекции. diff --git a/5.0/ru/0x91-Appendix-B_References.md b/5.0/ru/0x91-Appendix-B_References.md new file mode 100644 index 0000000000..ccd2905473 --- /dev/null +++ b/5.0/ru/0x91-Appendix-B_References.md @@ -0,0 +1,43 @@ +# Приложение B: Полезные ссылки + +Следующие проекты OWASP, скорее всего, будут полезны для читателей/последователей этого стандарта: + +## Основные проекты OWASP + +1. Проект OWASP Top 10: [https://owasp.org/www-project-top-ten/](https://owasp.org/www-project-top-ten/) +2. OWASP Web Security Testing Guide: [https://owasp.org/www-project-web-security-testing-guide/](https://owasp.org/www-project-web-security-testing-guide/) +3. OWASP Proactive Controls: [https://owasp.org/www-project-proactive-controls/](https://owasp.org/www-project-proactive-controls/) +4. OWASP Software Assurance Maturity Model (SAMM): [https://owasp.org/www-project-samm/](https://owasp.org/www-project-samm/) +5. OWASP Secure Headers Project: [https://owasp.org/www-project-secure-headers/](https://owasp.org/www-project-secure-headers/) + +## Проект OWASP Cheat Sheet Series + +[В этом проекте](https://owasp.org/www-project-cheat-sheets/) есть памятки, которые будут актуальны для многих требований ASVS. + +Сопоставление памяток с требованиями ASVS можно найти здесь: [https://cheatsheetseries.owasp.org/IndexASVS.html](https://cheatsheetseries.owasp.org/IndexASVS.html) + +## Проекты Mobile Security + +1. OWASP Mobile Security Project: [https://owasp.org/www-project-mobile-security/](https://owasp.org/www-project-mobile-security/) +2. OWASP Mobile Top 10 Risks: [https://owasp.org/www-project-mobile-top-10/](https://owasp.org/www-project-mobile-top-10/) +3. OWASP Mobile Security Testing Guide and Mobile Application Security Verification Standard: [https://owasp.org/www-project-mobile-security-testing-guide/](https://owasp.org/www-project-mobile-security-testing-guide/) + +## Проект OWASP Internet of Things + +1. OWASP Internet of Things Project: [https://owasp.org/www-project-internet-of-things/](https://owasp.org/www-project-internet-of-things/) + +## Проект OWASP Serverless + +1. OWASP Serverless Project: [https://owasp.org/www-project-serverless-top-10/](https://owasp.org/www-project-serverless-top-10/) + +## Другие + +Следующие веб-сайты, скорее всего, также будут полезны для читателей/последователей этого стандарта: + +1. SecLists Github: [https://github.com/danielmiessler/SecLists](https://github.com/danielmiessler/SecLists) +2. MITRE Common Weakness Enumeration: [https://cwe.mitre.org/](https://cwe.mitre.org/) +3. PCI Security Standards Council: [https://www.pcisecuritystandards.org/](https://www.pcisecuritystandards.org/) +4. PCI Data Security Standard (DSS) v3.2.1 Requirements and Security Assessment Procedures: [https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf](https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf) +5. PCI Software Security Framework - Secure Software Requirements and Assessment Procedures: [https://www.pcisecuritystandards.org/documents/PCI-Secure-Software-Standard-v1_0.pdf](https://www.pcisecuritystandards.org/documents/PCI-Secure-Software-Standard-v1_0.pdf) +6. PCI Secure Software Lifecycle (Secure SLC) Requirements and Assessment Procedures: [https://www.pcisecuritystandards.org/documents/PCI-Secure-SLC-Standard-v1_0.pdf](https://www.pcisecuritystandards.org/documents/PCI-Secure-SLC-Standard-v1_0.pdf) +7. OWASP ASVS 4.0 Testing Guide [https://github.com/BlazingWind/OWASP-ASVS-4.0-testing-guide](https://github.com/BlazingWind/OWASP-ASVS-4.0-testing-guide) diff --git a/5.0/ru/0x92-Appendix-C_Cryptography.md b/5.0/ru/0x92-Appendix-C_Cryptography.md new file mode 100644 index 0000000000..d639aa96a1 --- /dev/null +++ b/5.0/ru/0x92-Appendix-C_Cryptography.md @@ -0,0 +1,304 @@ +# Приложение C: Стандарты криптографии + +Глава «Криптография» выходит за рамки простого описания передовых практик. Она направлена ​​на углубление понимания принципов криптографии и поощрение внедрения более надёжных и современных методов безопасности. В этом приложении представлена ​​подробная техническая информация по каждому требованию, дополняющая общие стандарты, изложенные в главе «Криптография». + +В этом приложении определяются уровни допустимости различных криптографических механизмов: + +* Допустимые механизмы (A) могут использоваться в приложениях. +* Устаревшие механизмы (L) не должны использоваться в приложениях, но могут использоваться только для обеспечения совместимости с существующими устаревшими приложениями или кодом. Хотя использование таких механизмов в настоящее время само по себе не считается уязвимостью, их следует как можно скорее заменить более безопасными и перспективными механизмами. +* Запрещенные механизмы (D) не должны использоваться, поскольку в настоящее время они считаются ненадежными или не обеспечивают достаточной безопасности. + +Этот список может быть переопределен в контексте конкретного приложения по разным причинам, включая: + +* новые разработки в области криптографии; +* соблюдение нормативных требований. + +## Инвентаризация и документирование криптографии + +В этом разделе представлена ​​дополнительная информация +для V11.1 «Инвентаризация и документирование криптографии». + +Важно обеспечить регулярное обнаружение, инвентаризацию и оценку всех криптографических активов, таких как алгоритмы, ключи и сертификаты. Для уровня 3 это должно включать статическое и динамическое сканирование для обнаружения использования криптографии в приложении. Такие инструменты, как SAST и DAST, могут помочь в этом, но для более полного охвата могут потребоваться специализированные инструменты. Примеры бесплатных инструментов: + +* [CryptoMon - Network Cryptography Monitor - using eBPF, written in python](https://github.com/Santandersecurityresearch/CryptoMon) +* [Cryptobom Forge Tool: Generating Comprehensive CBOMs from CodeQL Outputs](https://github.com/Santandersecurityresearch/cryptobom-forge) + +## Эквивалентная стойкость криптографических параметров + +Относительные уровни безопасности различных криптографических систем приведены в следующей таблице (из [NIST SP 800-57 Часть 1](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final), стр.71): + +| Количество бит стойкости | Симметричные алгоритмы | Конечное поле | Целочисленная факторизация | Эллиптическая кривая | +|--|--|--|--|--| +| <= 80 | 2TDEA | L = 1024
N = 160 | k = 1024 | f = 160-223 | +| 112 | 3TDEA | L = 2048
N = 224 | k = 2048 | f = 224-255 | +| 128 | AES-128 | L = 3072
N = 256 | k = 3072 | f = 256-383 | +| 192 | AES-192 | L = 7680
N = 384 | k = 7680 | f = 384-511 | +| 256 | AES-256 | L = 15360
N = 512 | k = 15360 | f = 512+ | + +Примеры применения: + +* Криптография на конечных полях: DSA, FFDH, MQV +* Криптография на целочисленной факторизации: RSA +* Криптография на эллиптических кривых: ECDSA, EdDSA, ECDH, MQV + +Примечание: в этом разделе предполагается, что квантового компьютера не существует; если бы такой компьютер существовал, оценки для последних трех столбцов стали бы недействительными. + +## Случайные значения + +В этом разделе представлена ​​дополнительная информация +для V11.5 «Случайные значения». + +| Имя | Версия/Ссылка | Примечания | Статус | +|:-:|:-:|:-:|:-:| +| `/dev/random` | Linux 4.8+ [(Окт 2016)](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=818e607b57c94ade9824dad63a96c2ea6b21baf3), также встречается в iOS, Android и других операционных системах POSIX на базе Linux. Основан на [RFC7539](https://datatracker.ietf.org/doc/html/rfc7539) | Использование ChaCha20. Найдено в iOS [`SecRandomCopyBytes`](https://developer.apple.com/documentation/security/secrandomcopybytes(_:_:_:)?language=objc) и Android [`Secure Random`](https://developer.android.com/reference/java/security/SecureRandom) с правильными настройками, предоставленными для каждого. | A | +| `/dev/urandom` | Специальный файл ядра Linux для предоставления случайных данных | Обеспечивает высококачественный источник энтропии на основе аппаратной случайности. | A | +| `AES-CTR-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | Используется в распространенных реализациях, таких как [Windows CNG API `BCryptGenRandom`](https://learn.microsoft.com/en-us/windows/win32/api/bcrypt/nf-bcrypt-bcryptgenrandom) при установке [`BCRYPT_RNG_ALGORITHM`](https://learn.microsoft.com/en-us/windows/win32/seccng/cng-algorithm-identifiers). | A | +| `HMAC-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | | A | +| `Hash-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | | A | +| `getentropy()` | [OpenBSD](https://man.openbsd.org/getentropy.2), доступный в [Linux glibc 2.25+](https://man7.org/linux/man-pages/man3/getentropy.3.html) и [macOS 10.12+](https://support.apple.com/en-gb/guide/security/seca0c73a75b/web) | Обеспечивает безопасный доступ к случайным байтам непосредственно из источника энтропии ядра с помощью простого и минималистичного API. Он более современный и позволяет избежать ошибок, связанных со старыми API. | A | + +Базовая хэш-функция, используемая с HMAC-DRBG или Hash-DRBG, должна быть допустима для такого применения. + +## Алгоритмы шифрования + +В этом разделе представлена ​​дополнительная информация +для V11.3 «Алгоритмы шифрования». + +Допустимые алгоритмы шифрования перечислены в порядке предпочтения. + +| Симметричные алгоритмы | Ссылка | Статус | +|--|--|--| +| AES-256 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | A | +| Salsa20 | [Salsa 20 specification](https://cr.yp.to/snuffle/spec.pdf) | A | +| XChaCha20 | [XChaCha20 Draft](https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-xchacha-03) | A | +| XSalsa20 | [Extending the Salsa20 nonce](https://cr.yp.to/snuffle/xsalsa-20110204.pdf) | A | +| ChaCha20 | [RFC 8439](https://www.rfc-editor.org/info/rfc8439) | A | +| AES-192 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | A | +| AES-128 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | L | +| 2TDEA | | D | +| TDEA (3DES/3DEA) | | D | +| IDEA | | D | +| RC4 | | D | +| Blowfish| | D | +| ARC4 | | D | +| DES | | D | + +### Режимы шифрования AES + +Блочные шифры, такие как AES, могут использоваться в различных режимах работы. Многие режимы работы, такие как Electronic codebook (ECB), небезопасны и не должны использоваться. Режимы работы Galois/Counter Mode (GCM) и «Счётчик с кодом аутентификации сообщений цепочки блоков шифра» (CCM) обеспечивают аутентифицированное шифрование и должны использоваться в современных приложениях. + +Допустимые режимы перечислены в порядке предпочтения. + +| Режим | Поддержка аутентификации | Ссылка | Статус | Ограничение | +|--|--|--|--|--| +| GCM | Yes | [NIST SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | | +| CCM | Yes | [NIST SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | | +| CBC | No | [NIST SP 800-38A](https://csrc.nist.gov/pubs/sp/800/38/a/final) | L | | +| CCM-8 | Yes | | D | | +| ECB | No | | D | | +| CFB | No | | D | | +| OFB | No | | D | | +| CTR | No | | D | | + +Примечания: + +* Все зашифрованные сообщения должны быть аутентифицированы. Для ЛЮБОГО использования режима CBC ОБЯЗАТЕЛЬНО должен быть соответствующий алгоритм хеширования MAC для проверки сообщения. Как правило, он ДОЛЖЕН применяться в методе «Шифрование-затем-хеширование» (но в TLS 1.2 вместо этого используется «Хеширование-затем-шифрование»). Если это невозможно гарантировать, то CBC НЕ ДОЛЖЕН использоваться. Единственной опцией, где разрешено шифрование без алгоритма MAC, является шифрование диска. +* При использовании CBC должно быть гарантировано, что проверка заполнения выполняется за константное время. +* При использовании CCM-8 тег MAC имеет только 64 бита стойкости. Это не соответствует требованию 6.2.9, которое требует не менее 128 бит стойкости. +* Шифрование диска считается выходящим за рамки ASVS. Поэтому в данном приложении не перечислены какие-либо утверждённые методы шифрования диска. В этом случае обычно допускается шифрование без аутентификации, и обычно используются режимы XTS, XEX и LRW. + +### Шифрование ключей + +Шифрование ключа (key wrap) и соответствующее расшифрование ключа (key unwrap) — это метод защиты существующего ключа путём его инкапсуляции с использованием дополнительного механизма шифрования, чтобы исходный ключ не был явно раскрыт, например, во время передачи. Этот дополнительный ключ, используемый для защиты исходного ключа, называется ключом обёртывания (wrap key). + +Эта операция может выполняться в случае необходимости защиты ключей в местах, которые считаются недоверенными, а также для передачи конфиденциальных ключей по ненадежным сетям или внутри приложений. +Однако перед началом процедуры шифрования/расшифрования ключей необходимо оценить характер исходного ключа (например, идентичность и назначение). Это может повлиять на безопасность и соответствие требованиям как исходных (до передачи), так и целевых систем/приложений, включая требования по аудиту действий с ключами (например, подпись) и хранению ключей. + +В частности, для шифрования ключей ОБЯЗАТЕЛЬНО должен использоваться алгоритм AES-256, соответствующий [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) и с учётом перспективных мер защиты от квантовых угроз. Режимы шифрования с использованием AES применяются в следующем порядке предпочтения: + +| Шифрование ключа | Ссылка | Статус | +|--|--|--| +| KW | [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) | A | +| KWP | [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) | A | + +AES-192 и AES-128 МОГУТ использоваться, если того требует сценарий использования, но обоснование этого ДОЛЖНО быть задокументировано в реестре криптографии организации. + +### Аутентифицированное шифрование + +За исключением шифрования диска, зашифрованные данные должны быть защищены от несанкционированного изменения с использованием какой-либо схемы аутентифицированного шифрования (AE), обычно с использованием схемы аутентифицированного шифрования с соответствующими данными (AEAD). + +Предпочтительно, чтобы приложение использовало утверждённую схему AEAD. В качестве альтернативы, оно может комбинировать утверждённую схему шифрования и утверждённый алгоритм MAC с конструкцией Encrypt-then-MAC. + +MAC-then-encrypt по-прежнему разрешен для совместимости со старыми приложениями. Он используется в TLS версии 1.2 со старыми наборами шифров. + +| Схема AEAD | Ссылка | Статус | +|--------------------------|---------|-----| +|AES-GCM | [SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | +|AES-CCM | [SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | +|ChaCha-Poly1305 | [RFC 7539](https://datatracker.ietf.org/doc/html/rfc7539) | A | +|AEGIS-256 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +|AEGIS-128 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +|AEGIS-128L| [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +|Encrypt-then-MAC | | A | +|MAC-then-encrypt | | L | + +## Хэш-функции + +В этом разделе представлена ​​дополнительная информация +для V11.4 «Хеширование и функции на основе хеширования». + +### Основные случаи использования хэш функций + +В следующей таблице перечислены хэш-функции, допустимые для основных случаев использования криптографии, таких как цифровые подписи: + +* Допустимые хеш-функции обеспечивают высокую устойчивость к коллизиям и подходят для приложений с высоким уровнем безопасности. +* Некоторые из этих алгоритмов обеспечивают высокую устойчивость к атакам при использовании с надлежащим управлением криптографическими ключами, поэтому они дополнительно допустимы для функций HMAC, KDF и RBG. +* Хэш-функции с длиной выходного значения менее 254 бит обладают недостаточной устойчивостью к коллизиям и не должны использоваться для цифровой подписи или других приложений, требующих устойчивости к коллизиям. В других случаях они могут использоваться ТОЛЬКО для обеспечения совместимости и верификации с устаревшими системами, но не должны использоваться в новых разработках. + +| Хэш-функция | Ссылка | Статус | Ограничения | +| -------------- | ------------------------------------------------------------- |--|--| +| SHA3-512 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| SHA-512 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHA3-384 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| SHA-384 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHA3-256 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| SHA-512/256 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHA-256 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHAKE256 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| BLAKE2s | [BLAKE2: simpler, smaller, fast as MD5](https://eprint.iacr.org/2013/322) | A | | +| BLAKE2b | [BLAKE2: simpler, smaller, fast as MD5](https://eprint.iacr.org/2013/322) | A | | +| BLAKE3 | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | | +| SHA-224 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | L | Not suitable for HMAC, KDF, RBG, digital signatures | +| SHA-512/224 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | L | Not suitable for HMAC, KDF, RBG, digital signatures | +| SHA3-224 | [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | L | Not suitable for HMAC, KDF, RBG, digital signatures | +| SHA-1 | [RFC 3174](https://www.rfc-editor.org/info/rfc3174) & [RFC 6194](https://www.rfc-editor.org/info/rfc6194) | L | Not suitable for HMAC, KDF, RBG, digital signatures | +| CRC (any length) | | D | | +| MD4 | [RFC 1320](https://www.rfc-editor.org/info/rfc1320) | D | | +| MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | | + +### Хэш-функции для хранения паролей + +Для безопасного хеширования паролей необходимо использовать специальные хеш-функции. Эти медленные алгоритмы хеширования снижают риск атак методом перебора и перебора по словарю, увеличивая вычислительную сложность взлома паролей. + +| KDF | Ссылка | Обязательные параметры | Статус | +| --- | --------- | ------------------- | ------ | +| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1
t = 2: m ≥ 19456 (19 MiB), p = 1
t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | +| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8
p = 2: N ≥ 2^16 (64 MiB), r = 8
p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | +| bcrypt | [A Future-Adaptable Password Scheme](https://www.researchgate.net/publication/2519476_A_Future-Adaptable_Password_Scheme) | cost ≥ 10 | A | +| PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 210,000 | A | +| PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 600,000 | A | +| PBKDF2-HMAC-SHA-1 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 1,300,000 | L | + +Для хранения паролей можно использовать допустимые функции формирования ключей на основе паролей. + +## Функции формирования ключа (KDFs) + +### Основные функции формирования ключа + +| KDF | Ссылка | Статус | +| ---------------- | --------------------------------------------------------------------------------------------- | ------ | +| HKDF | [RFC 5869](https://www.rfc-editor.org/info/rfc5869) | A | +| TLS 1.2 PRF | [RFC 5248](https://www.rfc-editor.org/info/rfc5248) | L | +| MD5-based KDFs | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | +| SHA-1-based KDFs | [RFC 3174](https://www.rfc-editor.org/info/rfc3174) & [RFC 6194](https://www.rfc-editor.org/info/rfc6194) | D | + +### Функции формирования ключа на основе пароля + +| KDF | Ссылка | Обязательные параметры | Статус | +| --- | --------- | ------------------- | ------ | +| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1
t = 2: m ≥ 19456 (19 MiB), p = 1
t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | +| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8
p = 2: N ≥ 2^16 (64 MiB), r = 8
p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | +| PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 210,000 | A | +| PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 600,000 | A | +| PBKDF2-HMAC-SHA-1 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 1,300,000 | L | + +## Механизмы обмена ключами + +В этом разделе представлена ​​дополнительная информация +для V11.6 «Криптография с публичным ключом». + +### Схемы KEX + +Для всех схем обмена ключами ДОЛЖНА быть обеспечена стойкость в 112 бит или выше, а их реализация ДОЛЖНА соответствовать выбору параметров, представленному в следующей таблице. + +| Схема | Параметры | Прямая секретность | Статус | +|--|--|--|--| +| Диффи-Хеллман на конечных полях (FFDH) | L >= 3072 & N >= 256 | Yes | A | +| Диффи-Хеллман на эллиптических кривых (ECDH) | f >= 256-383 | Yes | A | +| Передача зашифрованного ключа с помощью RSA-PKCS#1 v1.5 | | No | D | + +Где следующие параметры: + +* k — длина ключа для RSA. +* L — длина открытого ключа, а N — длина закрытого ключа для криптографии на конечном поле. +* f — диапазон длин ключей для ECC. + +Любая новая реализация НЕ ДОЛЖНА использовать схему, НЕ соответствующую [NIST SP 800-56A](https://csrc.nist.gov/pubs/sp/800/56/a/r3/final) & [B](https://csrc.nist.gov/pubs/sp/800/56/b/r2/final) и [NIST SP 800-77](https://csrc.nist.gov/pubs/sp/800/77/r1/final). В частности, IKEv1 НЕ ДОЛЖЕН использоваться в промышленной среде. + +### Группы Диффи-Хеллмана + +Следующие группы допустимы для реализации обмена ключами Диффи-Хеллмана. Уровни безопасности описаны в [NIST SP 800-56A](https://csrc.nist.gov/pubs/sp/800/56/a/r3/final), Приложение D, и [NIST SP 800-57 Часть 1, Ред. 5](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final). + +| Группа | Статус | +|------------------|--------| +| P-224, secp224r1 | A | +| P-256, secp256r1 | A | +| P-384, secp384r1 | A | +| P-521, secp521r1 | A | +| K-233, sect233k1 | A | +| K-283, sect283k1 | A | +| K-409, sect409k1 | A | +| K-571, sect571k1 | A | +| B-233, sect233r1 | A | +| B-283, sect283r1 | A | +| B-409, sect409r1 | A | +| B-571, sect571r1 | A | +| Curve448 | A | +| Curve25519 | A | +| MODP-2048 | A | +| MODP-3072 | A | +| MODP-4096 | A | +| MODP-6144 | A | +| MODP-8192 | A | +| ffdhe2048 | A | +| ffdhe3072 | A | +| ffdhe4096 | A | +| ffdhe6144 | A | +| ffdhe8192 | A | + +## Коды аутентификации сообщений (MAC) + +Коды аутентификации сообщений (MAC) — это криптографические конструкции, используемые для проверки целостности и подлинности сообщения. MAC принимает сообщение и секретный ключ в качестве входных данных и создаёт тег фиксированного размера (значение MAC). MAC широко используется в протоколах защищённой связи (например, TLS/SSL) для обеспечения подлинности и целостности сообщений, которыми обмениваются стороны. + +| Алгоритм MAC | Ссылка | Статус | Ограничения | +| --------------| ----------------------------------------------------------------------------------------- | -------| ------------ | +| HMAC-SHA-256 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | | +| HMAC-SHA-384 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | | +| HMAC-SHA-512 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | | +| KMAC128 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | | +| KMAC256 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | | +| BLAKE3 (keyed_hash mode) | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | | +| AES-CMAC | [RFC 4493](https://datatracker.ietf.org/doc/html/rfc4493) & [NIST SP 800-38B](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38b.pdf) | A | | +| AES-GMAC | [NIST SP 800-38D](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf) | A | | +| Poly1305-AES | [The Poly1305-AES message-authentication code](https://cr.yp.to/mac/poly1305-20050329.pdf) | A | | +| HMAC-SHA-1 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | L | | +| HMAC-MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | | + +## Цифровые подписи + +Схемы подписи ДОЛЖНЫ использовать утвержденные размеры ключей и параметры согласно [NIST SP 800-57 Часть 1](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final). + +| Алгоритм подписи | Ссылка | Статус | +| ------------------------------ | ---------------------------------------------------------- | ------ | +| EdDSA (Ed25519, Ed448) | [RFC 8032](https://www.rfc-editor.org/info/rfc8032) | A | +| XEdDSA (Curve25519, Curve448) | [XEdDSA](https://signal.org/docs/specifications/xeddsa/) | A | +| ECDSA (P-256, P-384, P-521) | [FIPS 186-4](https://csrc.nist.gov/pubs/fips/186-5/final) | A | +| RSA-RSSA-PSS | [RFC 8017](https://www.rfc-editor.org/info/rfc8017) | A | +| RSA-SSA-PKCS#1 v1.5 | [RFC 8017](https://www.rfc-editor.org/info/rfc8017) | D | +| DSA (any key size) | [FIPS 186-4](https://csrc.nist.gov/pubs/fips/186-4/final) | D | + +## Стандарты постквантового шифрования + +Реализации постквантовой криптографии (PQC) должны соответствовать стандартам [FIPS-203](https://csrc.nist.gov/pubs/fips/203/ipd), [FIPS-204](https://csrc.nist.gov/pubs/fips/204/ipd) и [FIPS-205](https://csrc.nist.gov/pubs/fips/205/ipd). В настоящее время для этих стандартов доступно не так много примеров эталонных реализаций. Подробнее см. [объявление NIST о первых трёх финализированных постквантовых стандартах шифрования (август 2024 г.)](https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards). + +Предлагаемый постквантовый гибридный метод согласования ключей TLS [mlkem768x25519](https://datatracker.ietf.org/doc/draft-kwiatkowski-tls-ecdhe-mlkem/03/) поддерживается основными браузерами, такими как [Firefox версии 132](https://www.mozilla.org/en-US/firefox/132.0/releasenotes/) и [Chrome версии 131](https://security.googleblog.com/2024/09/a-new-path-for-kyber-on-web.html). Он может использоваться в средах тестирования криптографии или при наличии в библиотеках, допустимых отраслевыми или государственными органами. diff --git a/5.0/ru/0x93-Appendix-D_Recommendations.md b/5.0/ru/0x93-Appendix-D_Recommendations.md new file mode 100644 index 0000000000..c51830efae --- /dev/null +++ b/5.0/ru/0x93-Appendix-D_Recommendations.md @@ -0,0 +1,49 @@ +# Приложение D: Рекомендации + +## Введение + +При подготовке версии 5.0 Стандарта верификации требований к безопасности приложений (ASVS) стало очевидно, что ряд существующих и вновь предложенных пунктов не следует включать в требования версии 5.0. Это могло быть связано с тем, что они не входят в область действия ASVS согласно определению для версии 5.0, или же потому, что, хотя эти идеи и представлялись полезными, их нельзя было сделать обязательными. + +Не желая полностью потерять все эти материалы, некоторые из них были включены в это приложение. + +## Рекомендуемые механизмы, входящие в область применения + +Следующие пункты входят в область действия ASVS. Они не должны быть обязательными, но настоятельно рекомендуется рассматривать их как часть безопасного приложения. + +* Необходимо предоставить индикатор надежности пароля, чтобы помочь пользователям установить более стойкий пароль. +* Создайте общедоступный файл security.txt в корневом каталоге или каталоге .well-known приложения, в котором будет чётко указана ссылка или адрес электронной почты, по которым пользователи смогут связаться с владельцами по вопросам безопасности. +* В дополнение к проверке на уровне доверенных служб следует применять проверку входных данных на стороне клиента, поскольку это даёт хорошую возможность обнаружить, когда кто-то обходит клиентские средства защиты при попытке атаки на приложение. +* Предотвращайте появление в поисковых системах случайно доступных и конфиденциальных страниц с помощью файла robots.txt, заголовка ответа X-Robots-Tag или метатега robots.html. +* При использовании GraphQL реализуйте логику авторизации на уровне бизнес-логики, а не на уровне GraphQL или резолвера, чтобы избежать необходимости обрабатывать авторизацию на каждом отдельном интерфейсе. + +Ссылки: + +* [Дополнительная информация о security.txt, включая ссылку на RFC](https://securitytxt.org/) + +## Принципы безопасности программного обеспечения + +Следующие пункты ранее присутствовали в ASVS, но они не являются требованиями. Скорее, это принципы, которые следует учитывать при реализации мер безопасности, соблюдение которых приведет к повышению надежности этих мер. К ним относятся: + +* Средства управления безопасностью должны быть централизованными, простыми (экономия времени), проверяемо безопасными и допускающими повторное использование. Это позволит избежать дублирования, отсутствия или неэффективности средств управления. +* По возможности используйте ранее написанные и проверенные реализации средств управления безопасностью, а не полагайтесь на их реализацию с нуля. +* В идеале для доступа к защищённым данным и ресурсам следует использовать единый механизм управления доступом. Все запросы должны проходить через этот механизм, чтобы избежать копирования и вставки или небезопасных альтернативных путей. +* Управление доступом на основе атрибутов или функций — рекомендуемый шаблон, при котором код проверяет авторизацию пользователя для функции или элемента данных, а не только его роль. Разрешения по-прежнему должны предоставляться с использованием ролей. + +## Процессы обеспечения безопасности программного обеспечения + +Ряд процессов обеспечения безопасности были исключены из ASVS 5.0, но всё ещё представляют собой хорошую идею. Проект OWASP SAMM может стать хорошим источником информации о том, как эффективно реализовать эти процессы. Ранее в ASVS присутствовали следующие элементы: + +* Убедитесь в использовании безопасного жизненного цикла разработки программного обеспечения, который обеспечивает безопасность на всех этапах разработки. +* Убедитесь в применении моделирования угроз для каждого изменения дизайна или планирования спринта, чтобы выявлять угрозы, планировать контрмеры, способствовать надлежащему реагированию на риски и управлять тестированием безопасности. +* Убедитесь, что все пользовательские истории и функции содержат функциональные ограничения безопасности. Например, "Как пользователь, я должен иметь возможность просматривать и редактировать свой профиль, но не должен иметь возможности просматривать или редактировать чужой профиль". +* Убедитесь в наличии чек-листа для безопасной разработки, требований, политик и стандартов безопасности, а также в их доступности для разработчиков и тестировщиков. +* Убедитесь, что существует непрерывный процесс, гарантирующий отсутствие в исходном коде приложения бэкдоров, вредоносного кода (такого как атаки типа «нарезка салями», обход логики или «логические бомбы») и недокументированных или скрытых функций (например, «пасхальных яиц», небезопасных инструментов отладки). Выполнение требований этого раздела невозможно без полного доступа к исходному коду, включая сторонние библиотеки, и поэтому, вероятно, подходит только для приложений, требующих высочайшего уровня безопасности. +* Убедитесь, что в средах развертывания реализованы механизмы обнаружения и реагирования на отклонения конфигурации. Это может включать использование неизменяемой инфраструктуры, автоматическое повторное развертывание с безопасной базовой конфигурацией или инструменты обнаружения отклонений, сравнивающие текущее состояние с утверждёнными конфигурациями. +* Убедитесь, что усиление защиты конфигурации выполняется для всех сторонних продуктов, библиотек, фреймворков и служб в соответствии с их индивидуальными рекомендациями. + +Ссылки: + +* [OWASP Threat Modeling Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html) +* [OWASP Threat modeling](https://owasp.org/www-community/Application_Threat_Modeling) +* [OWASP Software Assurance Maturity Model Project](https://owasp.org/www-project-samm/) +* [Microsoft SDL](https://www.microsoft.com/en-us/securityengineering/sdl/) diff --git a/5.0/ru/0x94-Appendix-E_Contributors.md b/5.0/ru/0x94-Appendix-E_Contributors.md new file mode 100644 index 0000000000..1b845cc51e --- /dev/null +++ b/5.0/ru/0x94-Appendix-E_Contributors.md @@ -0,0 +1,71 @@ +# Приложение E: Участники + +Мы выражаем благодарность следующим людям, которые комментировали или открывали пул-реквесты после выпуска ASVS 4.0.0. + +Если вам известно о каких-либо ошибках или вы хотите, чтобы ваше имя отображалось иначе, пожалуйста, сообщите нам об этом. + +| | | | | +|---|---|---|---| +| Johan Sydseter ([sydseter](https://github.com/sydseter)) | luis servin ([lfservin](https://github.com/lfservin)) | Oleksii Dovydkov ([oleksiidov](https://github.com/oleksiidov)) | IZUKA Masahiro ([maizuka](https://github.com/maizuka)) | +| James Sulinski ([jsulinski](https://github.com/jsulinski)) | Eli Saad ([ThunderSon](https://github.com/ThunderSon)) | [kkshitish9](https://github.com/kkshitish9) | Andrew van der Stock ([vanderaj](https://github.com/vanderaj)) | +| Rick M ([kingthorin](https://github.com/kingthorin)) | Bankde Eakasit ([Bankde](https://github.com/Bankde)) | Michael Gargiullo ([mgargiullo](https://github.com/mgargiullo)) | Raphael Dunant ([Racater](https://github.com/Racater)) | +| Cesar Kohl ([cesarkohl](https://github.com/cesarkohl)) | [inaz0](https://github.com/inaz0) | Joerg Bruenner ([JoergBruenner](https://github.com/JoergBruenner)) | David Deatherage ([securitydave](https://github.com/securitydave)) | +| John Carroll ([yosignals](https://github.com/yosignals)) | Jim Fenton ([jimfenton](https://github.com/jimfenton)) | Matteo Pace ([M4tteoP](https://github.com/M4tteoP)) | Sebastien gioria ([SPoint42](https://github.com/SPoint42)) | +| Steven van der Baan ([vdbaan](https://github.com/vdbaan)) | Jeremy Bonghwan Choi ([jeremychoi](https://github.com/jeremychoi)) | [craig-shony](https://github.com/craig-shony) | Riccardo Sirigu ([ricsirigu](https://github.com/ricsirigu)) | +| Tomasz Wrobel ([tw2as](https://github.com/tw2as)) | Alena Dubeshko ([belalena](https://github.com/belalena)) | Rafael Green ([RafaelGreen1](https://github.com/RafaelGreen1)) | [mjang-cobalt](https://github.com/mjang-cobalt) | +| [clallier94](https://github.com/clallier94) | Kevin W. Wall ([kwwall](https://github.com/kwwall)) | Jordan Sherman ([jsherm-fwdsec](https://github.com/jsherm-fwdsec) / [deleterepo](https://github.com/deleterepo)) | Ingo Rauner ([ingo-rauner](https://github.com/ingo-rauner)) | +| Dirk Wetter ([drwetter](https://github.com/drwetter)) | Moshe Zioni ([moshe-apiiro](https://github.com/moshe-apiiro)) | Patrick Dwyer ([coderpatros](https://github.com/coderpatros)) | David Clarke ([davidclarke-au](https://github.com/davidclarke-au)) | +| Takaharu Ogasa ([takaharuogasa](https://github.com/takaharuogasa)) | Arkadii Yakovets ([arkid15r](https://github.com/arkid15r)) | Motoyasu Saburi ([motoyasu-saburi](https://github.com/motoyasu-saburi)) | [leirn](https://github.com/leirn) | +| [wet-certitude](https://github.com/wet-certitude) | [timhemel](https://github.com/timhemel) | RL Thornton ([thornshadow99](https://github.com/thornshadow99)) | Thomas Bandt ([aspnetde](https://github.com/aspnetde)) | +| Roel Storms ([roelstorms](https://github.com/roelstorms)) | Jeroen Willemsen ([commjoen](https://github.com/commjoen)) | [anonymous-31](https://github.com/anonymous-31) | Kamran Saifullah ([deFr0ggy](https://github.com/deFr0ggy)) | +| Steve Springett ([stevespringett](https://github.com/stevespringett)) | Spyros ([northdpole](https://github.com/northdpole)) | Hans Herrera ([hansphp](https://github.com/hansphp)) | [Marx314](https://github.com/Marx314) | +| [CarlosAllendes](https://github.com/CarlosAllendes) | Yonah Russ ([yruss972](https://github.com/yruss972)) | Sander Maijers ([sanmai-NL](https://github.com/sanmai-NL)) | Luboš Bretschneider ([bretik](https://github.com/bretik)) | +| Eva Sarafianou ([esarafianou](https://github.com/esarafianou)) | Ata Seren [ataseren](https://github.com/ataseren) | Steve Thomas ([Sc00bz](https://github.com/Sc00bz)) | Dominique RIGHETTO ([righettod](https://github.com/righettod)) | +| Steven van der Baan ([svdb-ncc](https://github.com/svdb-ncc)) | Michael Vacarella ([Aif4thah](https://github.com/Aif4thah)) | Tonimir Kisasondi ([tkisason](https://github.com/tkisason)) | Stefan Streichsbier ([streichsbaer](https://github.com/streichsbaer)) | +| [hi-unc1e](https://github.com/hi-unc1e) | sb3k ([starbuck3000](https://github.com/starbuck3000)) | [mario-platt](https://github.com/mario-platt) | Devdatta Akhawe ([devd](https://github.com/devd)) | +| Michael Gissing ([scolytus](https://github.com/scolytus)) | Jet Anderson ([thatsjet](https://github.com/thatsjet)) | Dave Wichers ([davewichers](https://github.com/davewichers)) | Jonny Schnittger ([JonnySchnittger](https://github.com/JonnySchnittger)) | +| Silvia Väli ([silviavali](https://github.com/silviavali)) | [jackgates73](https://github.com/jackgates73) | [1songb1rd](https://github.com/1songb1rd) | Timur - ([timurozkul](https://github.com/timurozkul)) | +| Gareth Heyes ([hackvertor](https://github.com/hackvertor)) | [appills](https://github.com/appills) | [suvikaartinen](https://github.com/suvikaartinen) | chaals ([chaals](https://github.com/chaals)) | +| DanielPharos ([AtlasHackert](https://github.com/AtlasHackert)) | will Farrell ([willfarrell](https://github.com/willfarrell)) | Alina Vasiljeva ([avasiljeva](https://github.com/avasiljeva)) | Paul McCann ([ismisepaul](https://github.com/ismisepaul)) | +| Sage ([SajjadPourali](https://github.com/SajjadPourali)) | [rbsec](https://github.com/rbsec) | Benedikt Bauer ([mastacheata](https://github.com/mastacheata)) | James Jardine ([jamesjardine](https://github.com/jamesjardine)) | +| Mark Burnett ([m8urnett](https://github.com/m8urnett)) | [dschwarz91](https://github.com/dschwarz91) | Cyber-AppSec ([Cyber-AppSec](https://github.com/Cyber-AppSec)) | [Tib3rius](https://github.com/Tib3rius) | +| BitnessWise ([bitnesswise](https://github.com/bitnesswise)) | damienbod ([damienbod](https://github.com/damienbod)) | Jared Meit ([jmeit-fwdsec](https://github.com/jmeit-fwdsec)) | Stefan Seelmann ([sseelmann](https://github.com/sseelmann)) | +| Brendan O'Connor ([ussjoin](https://github.com/ussjoin)) | Andrei Titov ([andrettv](https://github.com/andrettv)) | Hans-Petter Fjeld ([atluxity](https://github.com/atluxity)) | [markehack](https://github.com/markehack) | +| Neil Madden ([NeilMadden](https://github.com/NeilMadden)) | Michael Geramb ([mgeramb](https://github.com/mgeramb)) | Osama Elnaggar ([ossie-git](https://github.com/ossie-git)) | [mackowski](https://github.com/mackowski) | +| Ravi Balla ([raviballa](https://github.com/raviballa)) | Hazana ([hazanasec](https://github.com/hazanasec)) | David Means ([dmeans82](https://github.com/dmeans82)) | Alexander Stein ([tohch4](https://github.com/tohch4)) | +| BaeSenseii ([baesenseii](https://github.com/baesenseii)) | Vincent De Schutter ([VincentDS](https://github.com/VincentDS)) | S Bani ([sbani](https://github.com/sbani)) | Mitsuaki Akiyama ([mak1yama](https://github.com/mak1yama)) | +| Christopher Loessl ([hashier](https://github.com/hashier)) | [victorxm](https://github.com/victorxm) | Michal Rada ([michalradacz](https://github.com/michalradacz)) | Veeresh Devireddy ([drveresh](https://github.com/drveresh)) | +| [MaknaSEO](https://github.com/MaknaSEO) | [darkzero2022](https://github.com/darkzero2022) | Liam ([LiamDobbelaere](https://github.com/LiamDobbelaere)) | Frank Denis ([jedisct1](https://github.com/jedisct1)) | +| Otto Sulin ([ottosulin](https://github.com/ottosulin)) | [carllaw6885](https://github.com/carllaw6885) | Anders Johan Holmefjord ([aholmis](https://github.com/aholmis)) | Richard Fritsch ([rfricz](https://github.com/rfricz)) | +| [mesutgungor](https://github.com/mesutgungor) | Scott Helme ([ScottHelme](https://github.com/ScottHelme)) | Carlo Reggiani ([carloreggiani](https://github.com/carloreggiani)) | Suyash Srivastava ([suyash5053](https://github.com/suyash5053)) | +| Mark Potter ([markonweb](https://github.com/markonweb)) | Arjan Lamers ([alamers](https://github.com/alamers)) | Gøran Breivik ([gobrtg](https://github.com/gobrtg)) | [flo-blg](https://github.com/flo-blg) | +| Guillaume Déflache ([guillaume-d](https://github.com/guillaume-d)) | Toufik Airane ([toufik-airane](https://github.com/toufik-airane)) | Keith Hoodlet ([securingdev](https://github.com/securingdev)) | Sinner ([SoftwareSinner](https://github.com/SoftwareSinner)) | +| [iloving](https://github.com/iloving) | Jeroen Beckers ([TheDauntless](https://github.com/TheDauntless)) | Joubin Jabbari ([joubin](https://github.com/joubin)) | yu fujioka ([fujiokayu](https://github.com/fujiokayu)) | +| execjosh ([execjosh](https://github.com/execjosh)) | Alicja Kario ([tomato42](https://github.com/tomato42)) | Sidney Ribeiro ([srjsoftware](https://github.com/srjsoftware)) | Gabriel Marquet ([Gby56](https://github.com/Gby56)) | +| Drew Schulz ([drschulz](https://github.com/drschulz)) | [bedirhan](https://github.com/bedirhan) | [muralito](https://github.com/muralito) | Ronnie Flathers ([ropnop](https://github.com/ropnop)) | +| Philippe De Ryck ([philippederyck](https://github.com/philippederyck)) | Malte ([mal33](https://github.com/mal33)) | [MazeOfThoughts](https://github.com/MazeOfThoughts) | Andreas Falk ([andifalk](https://github.com/andifalk)) | +| Javi ([javixeneize](https://github.com/javixeneize)) | Daniel Hahn ([averell23](https://github.com/averell23)) | [borislav-c](https://github.com/borislav-c) | Robin Wood ([digininja](https://github.com/digininja)) | +| [miro2ns](https://github.com/miro2ns) | Jan Dockx ([jandockx](https://github.com/jandockx)) | [vipinsaini434](https://github.com/vipinsaini434) | [priyanshukumar397](https://github.com/priyanshukumar397) | +| Nat Sakimura ([sakimura](https://github.com/sakimura)) | Benjamin Häublein ([BenjaminHae](https://github.com/BenjaminHae)) | [unknown-user-from](https://github.com/unknown-user-from) | Ali Ramazan TAŞDELEN ([alitasdln](https://github.com/alitasdln)) | +| Pedro Escaleira ([oEscal](https://github.com/oEscal)) | Josh ([josh-hemphill](https://github.com/josh-hemphill)) | Tim Würtele ([SECtim](https://github.com/SECtim)) | AviD ([avidouglen](https://github.com/avidouglen)) | +| SheHacksPurple ([shehackspurple](https://github.com/shehackspurple)) | [fcerullo-cycubix](https://github.com/fcerullo-cycubix) | Hector Eryx Paredes Camacho ([heryxpc](https://github.com/heryxpc)) | Irene Michlin ([irene221b](https://github.com/irene221b)) | +| Jonah Y-M ([TG-Techie](https://github.com/TG-Techie)) | Dhiraj Bahroos ([bahroos](https://github.com/bahroos)) | Jef Meijvis ([jefmeijvis](https://github.com/jefmeijvis)) | [IzmaDoesItbeta](https://github.com/IzmaDoesItbeta) | +| Abdessamad TEMMAR ([TmmmmmR](https://github.com/TmmmmmR)) | [sectroyer](https://github.com/sectroyer) | Soh Satoh ([sohsatoh](https://github.com/sohsatoh)) | [regoravalaz](https://github.com/regoravalaz) | +| james-t ([james-bitherder](https://github.com/james-bitherder)) | Aram Hovsepyan ([aramhovsepyan](https://github.com/aramhovsepyan)) | [JaimeGomezGarciaSan](https://github.com/JaimeGomezGarciaSan) | [ValdiGit01](https://github.com/ValdiGit01) | +| iwatachan ([ishowta](https://github.com/ishowta)) | Vinod Anandan ([VinodAnandan](https://github.com/VinodAnandan)) | Kevin Kien ([KevinKien](https://github.com/KevinKien)) | [paul-williamson-swoop](https://github.com/paul-williamson-swoop) | +| [endergzr](https://github.com/endergzr) | Radhwan Alshamamri ([Rado0z](https://github.com/Rado0z)) | Grant Ongers ([rewtd](https://github.com/rewtd)) | Cure53 ([cure53](https://github.com/cure53)) | +| [AliR2Linux](https://github.com/AliR2Linux) | Ads Dawson ([GangGreenTemperTatum](https://github.com/GangGreenTemperTatum)) | William Reyor ([BillReyor](https://github.com/BillReyor)) | gabe ([gcrow](https://github.com/gcrow)) | +| [mascotter](https://github.com/mascotter) | [luissaiz](https://github.com/luissaiz) | Suren Manukyan ([vx-sec](https://github.com/vx-sec)) | Piotr Gliźniewicz ([pglizniewicz](https://github.com/pglizniewicz)) | +| Tadeusz Wachowski ([tadeuszwachowski](https://github.com/tadeuszwachowski)) | Nasir aka Nate ([andesec](https://github.com/andesec)) | [settantasette](https://github.com/settantasette) | Lars Haulin ([LarsH](https://github.com/LarsH)) | +| Terence Eden ([edent](https://github.com/edent)) | [JasmineScholz](https://github.com/JasmineScholz) | Arun Sivadasan ([teavanist](https://github.com/teavanist)) | Yusuf GÜR ([yusuffgur](https://github.com/yusuffgur)) | +| Troy Marshall ([troymarshall](https://github.com/troymarshall)) | Tanner Prynn ([tprynn](https://github.com/tprynn)) | Nick K. ([nickific](https://github.com/nickific)) | [raoul361](https://github.com/raoul361) | +| Azeem Ilyas ([TheAxZim](https://github.com/TheAxZim)) | Evo Stamatov ([avioli](https://github.com/avioli)) | Tim Potter ([timpotter87](https://github.com/timpotter87)) | Gavin Ray ([GavinRay97](https://github.com/GavinRay97)) | +| monis ([demideus](https://github.com/demideus)) | Marcin Hoppe ([MarcinHoppe](https://github.com/MarcinHoppe)) | Grambulf ([ramshazar](https://github.com/ramshazar)) | Jordan Pike ([computersarebad](https://github.com/computersarebad)) | +| Jason Rogers ([jason-invision](https://github.com/jason-invision)) | Ben Hall ([benbhall](https://github.com/benbhall)) | JamesPoppyCock ([jamesly123](https://github.com/jamesly123)) | WhiteHackLabs ([whitehacklabs](https://github.com/whitehacklabs)) | +| Alex Gaynor ([alex](https://github.com/alex)) | Filip van Laenen ([filipvanlaenen](https://github.com/filipvanlaenen)) | [jeurgen](https://github.com/jeurgen) | [GraoMelo](https://github.com/GraoMelo) | +| Andreas Kurtz ([ay-kay](https://github.com/ay-kay)) | Tom Tervoort ([TomTervoort](https://github.com/TomTervoort)) | old man ([deveras](https://github.com/deveras)) | Marco Schnüriger ([marcortw](https://github.com/marcortw)) | +| [stiiin](https://github.com/stiiin) | infoseclearn ([teaminfoseclearn](https://github.com/teaminfoseclearn)) | [hljupkij](https://github.com/hljupkij) | Noe ([nmarher](https://github.com/nmarher)) | +| Lyz ([lyz-code](https://github.com/lyz-code)) | Martin Riedel ([mrtnrdl](https://github.com/mrtnrdl)) | KIM Jaesuck ([tcaesvk](https://github.com/tcaesvk)) | Barbara Schachner ([bschach](https://github.com/bschach)) | +| René Reuter ([AresSec](https://github.com/AresSec)) | [carhackpils](https://github.com/carhackpils) | Tyler ([tyler2cr](https://github.com/tyler2cr)) | Hugo ([hasousa](https://github.com/hasousa)) | +| Wouter Bloeyaert ([Someniak](https://github.com/Someniak)) | Mark de Rijk ([markderijkinfosec](https://github.com/markderijkinfosec)) | Ramin ([picohub](https://github.com/picohub)) | Philip D. Turner ([philipdturner](https://github.com/philipdturner)) | +| Will Chatham ([willc](https://github.com/willc)) | | | | diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 8bb601ccb9..833fdf8728 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -111,11 +111,11 @@ If you are interested in creating a translation, here are some pointers for how * French, see [#3188](https://github.com/OWASP/ASVS/issues/3188) * Simplified Chinese, see [#3191](https://github.com/OWASP/ASVS/issues/3191) * Korean, see [#3204](https://github.com/OWASP/ASVS/issues/3204) - * Russian, see [#3223](https://github.com/OWASP/ASVS/issues/3223) * Spanish, see [#3238](https://github.com/OWASP/ASVS/issues/3238) * Panjabi, see[#3252](https://github.com/OWASP/ASVS/issues/3252) * v5.0.0 * [Turkish](./5.0/tr/) + * [Russian](./5.0/ru/) * If the language you are interested in appears, it would be great if you could reach out to the translator to see if you can help them. * Often there is work to do in creating markdown files or updating the translation to keep it up to date with latest changes. * We would request that you base your translation on the 5.0/en folder in the v5.0.0 branch as this is now static at the 5.0.0 version. diff --git a/README.md b/README.md index 46233782b4..8c279bad6d 100644 --- a/README.md +++ b/README.md @@ -55,6 +55,7 @@ If you think you can help with translations, or indeed ensuring the current list Currently available translations: * [OWASP Application Security Verification Standard 5.0.0 Turkish (PDF)](5.0/OWASP_Application_Security_Verification_Standard_5.0.0_tr.pdf) and [other formats](5.0/docs_tr). (Thanks to [Ata Seren](https://github.com/ataseren)) +* [OWASP Application Security Verification Standard 5.0.0 Russian (PDF)](5.0/OWASP_Application_Security_Verification_Standard_5.0.0_ru.pdf) and [other formats](5.0/docs_ru). (Thanks to [Khalina Daria](https://github.com/whitealisia), [Shnayder Eugenia](https://github.com/ZhenyaShnayder), [Smirnov Vyacheslav](https://github.com/Borgc), [Mukovkin Dmitry](https://github.com/shipko), [Nadezhda](https://github.com/yoshtvoumed), [Fomin Danil](https://github.com/EvtDanya), Sluzhevsky Anton, [Zolotarev Maxim](https://github.com/kibertard), [Gorky Kirill](https://github.com/ToxicSnail), [Nosenko Aleksei](https://github.com/avnosenko)) Historic translations of the v4.x versions can be found in the [TRANSLATIONS.md file](4.0/TRANSLATIONS.md) in the 4.0 folder. From d96e105ee0a96e2f5b79f3a68ed53c056cad8a35 Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Sun, 19 Oct 2025 14:16:48 +0300 Subject: [PATCH 62/93] French translation of v5.0.0 (#3188) (#3279) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Bring Fr translation into local branch (#3188) * FR translation * corrections and 15.3.4 update, #3048 (#3089) * update 15.3.4 / 10.4.6, closes #3048 * oidc logout-related requirements, closes #3080 * Update standard-asvs-issue.md * one mfa (6.3.3+6.3.8) requirement to cover l2 and l3, #3094 (#3101) * one mfa (6.3.3+6.3.8) requirement to cover l2 and l3, #3094 * Update section wording --------- Co-authored-by: Elar Lang Co-authored-by: Josh Grossman * Clarify 2.1.1 and 2.1.2 wording and update level to resolve #3100 (#3102) * Add reference to AuthN chapter to resolve #3103 (#3106) * Update section titles to resolve #3099 (#3108) * V15 titles, closes #3107 * french translation * French translation * Clearer text around section 6.6 (Fr Translation) * fr translation * Update 0x03-Using-ASVS.md Tournure de phrase * Update 0x05-For-Users-Of-4.0.md coquille * Update 0x11-V2-Validation-Business-Logic.md Tournure de phrase * Update 0x12-V3-Web-Frontend-Security.md Une exigence non traduite * FR translation * FR Translation * Update 0x15-V6-Authentication.md traduction manquante * FR Translation * Update 0x19-V10-OAuth-and-OIDC.md Traduction manquante mineure (dans les titres de références) * Update 0x20-V11-Cryptography.md crypter / chiffrer * Update 0x23-V14-Data-Protection.md traduction manquantes * Update 0x24-V15-Secure-Coding-and-Architecture.md traduction et remplacement de codage par développement * Rename 0x25-V16-Security-Logging-and-Error-Handling.mdd to 0x25-V16-Security-Logging-and-Error-Handling.md change extension file * Update 0x26-V17-WebRTC.md traduction manquante * Update 0x91-Appendix-B_References.md Traduction mineure * Update 0x97-Appendix-V_Cryptography.md crypter / chiffrement * Update 0x99-Appendix-X_Recommendations.md * Fr translation * FR translation (Final) * Minor corrections * Minor corrections * generation Doc & Pdf * Minor Correction * Minor corrections * markdown-lint-check issues * Frontispiece correction * Update 0x01-Frontispiece.md Consideration of randomstuff's comments * Update 0x02-Preface.md Consideration of randomstuff's comments * Consideration of randomstuff's comments * markdown-lint-check issues * markdown-link-check issues * Consideration of randomstuff's comments * File correction * Ordering * Diverses corrections * markdown-lint-check issues * Fr translation * support randomstuff's comments * "liste blanche" -> "liste d'autorisation" * Remove generate scripts from .gitignore Removed scripts related to documentation generation from .gitignore --------- Co-authored-by: Elar Lang <47597707+elarlang@users.noreply.github.com> Co-authored-by: Elar Lang Co-authored-by: Josh Grossman Co-authored-by: inaz0 * Revert mode changes * Linting * Linting * Fix structure * Fix some newlines * Structure fixes * Structure * Add other info * Changes from @randomstuff (#3280) * Add missing section (KDFs) in FR translation * Add info about FR translation in README --------- Co-authored-by: Gabriel Corona * Outputs and clarify contributors * Fix spelling --------- Co-authored-by: clallier94 <48221724+clallier94@users.noreply.github.com> Co-authored-by: Elar Lang <47597707+elarlang@users.noreply.github.com> Co-authored-by: Elar Lang Co-authored-by: inaz0 Co-authored-by: Gabriel Corona --- .github/workflows/config/local-custom.txt | 9 +- ...ecurity_Verification_Standard_5.0.0_fr.pdf | Bin 0 -> 579610 bytes ...ty_Verification_Standard_5.0.0_fr.cdx.json | 3057 +++++++ ...ecurity_Verification_Standard_5.0.0_fr.csv | 347 + ...curity_Verification_Standard_5.0.0_fr.docx | Bin 0 -> 225553 bytes ...y_Verification_Standard_5.0.0_fr.flat.json | 3109 +++++++ ...ication_Standard_5.0.0_fr.flat.legacy.json | 4489 ++++++++++ ...curity_Verification_Standard_5.0.0_fr.json | 2774 +++++++ ..._Verification_Standard_5.0.0_fr.legacy.csv | 347 + ...Verification_Standard_5.0.0_fr.legacy.json | 7259 +++++++++++++++++ ..._Verification_Standard_5.0.0_fr.legacy.xml | 1 + ...ecurity_Verification_Standard_5.0.0_fr.xml | 1 + 5.0/docs_fr/fr | 0 5.0/fr/0x00-Header.yaml | 16 + 5.0/fr/0x01-Frontispiece.md | 46 + 5.0/fr/0x02-Preface.md | 29 + 5.0/fr/0x03-What-is-the-ASVS.md | 195 + 5.0/fr/0x04-Assessment_and_Certification.md | 47 + 5.0/fr/0x05-For-Users-Of-4.0.md | 90 + 5.0/fr/0x10-V1-Encoding-and-Sanitization.md | 103 + .../0x11-V2-Validation-and-Business-Logic.md | 73 + 5.0/fr/0x12-V3-Web-Frontend-Security.md | 100 + 5.0/fr/0x13-V4-API-and-Web-Service.md | 64 + 5.0/fr/0x14-V5-File-Handling.md | 54 + 5.0/fr/0x15-V6-Authentication.md | 166 + 5.0/fr/0x16-V7-Session-Management.md | 91 + 5.0/fr/0x17-V8-Authorization.md | 56 + 5.0/fr/0x18-V9-Self-contained-Tokens.md | 36 + 5.0/fr/0x19-V10-OAuth-and-OIDC.md | 169 + 5.0/fr/0x20-V11-Cryptography.md | 107 + 5.0/fr/0x21-V12-Secure-Communication.md | 57 + 5.0/fr/0x22-V13-Configuration.md | 68 + 5.0/fr/0x23-V14-Data-Protection.md | 60 + ...0x24-V15-Secure-Coding-and-Architecture.md | 77 + ...V16-Security-Logging-and-Error-Handling.md | 84 + 5.0/fr/0x26-V17-WebRTC.md | 75 + 5.0/fr/0x90-Appendix-A_Glossary.md | 89 + 5.0/fr/0x91-Appendix-B_References.md | 43 + 5.0/fr/0x92-Appendix-C_Cryptography.md | 304 + 5.0/fr/0x93-Appendix-D_Recommendations.md | 49 + 5.0/fr/0x94-Appendix-E_Contributors.md | 71 + 5.0/languages.txt | 2 +- CONTRIBUTING.md | 2 +- README.md | 1 + 44 files changed, 23814 insertions(+), 3 deletions(-) create mode 100644 5.0/OWASP_Application_Security_Verification_Standard_5.0.0_fr.pdf create mode 100644 5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.cdx.json create mode 100644 5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.csv create mode 100644 5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.docx create mode 100644 5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.flat.json create mode 100644 5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.flat.legacy.json create mode 100644 5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.json create mode 100644 5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.csv create mode 100644 5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.json create mode 100644 5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.xml create mode 100644 5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.xml create mode 100644 5.0/docs_fr/fr create mode 100644 5.0/fr/0x00-Header.yaml create mode 100644 5.0/fr/0x01-Frontispiece.md create mode 100644 5.0/fr/0x02-Preface.md create mode 100644 5.0/fr/0x03-What-is-the-ASVS.md create mode 100644 5.0/fr/0x04-Assessment_and_Certification.md create mode 100644 5.0/fr/0x05-For-Users-Of-4.0.md create mode 100644 5.0/fr/0x10-V1-Encoding-and-Sanitization.md create mode 100644 5.0/fr/0x11-V2-Validation-and-Business-Logic.md create mode 100644 5.0/fr/0x12-V3-Web-Frontend-Security.md create mode 100644 5.0/fr/0x13-V4-API-and-Web-Service.md create mode 100644 5.0/fr/0x14-V5-File-Handling.md create mode 100644 5.0/fr/0x15-V6-Authentication.md create mode 100644 5.0/fr/0x16-V7-Session-Management.md create mode 100644 5.0/fr/0x17-V8-Authorization.md create mode 100644 5.0/fr/0x18-V9-Self-contained-Tokens.md create mode 100644 5.0/fr/0x19-V10-OAuth-and-OIDC.md create mode 100644 5.0/fr/0x20-V11-Cryptography.md create mode 100644 5.0/fr/0x21-V12-Secure-Communication.md create mode 100644 5.0/fr/0x22-V13-Configuration.md create mode 100644 5.0/fr/0x23-V14-Data-Protection.md create mode 100644 5.0/fr/0x24-V15-Secure-Coding-and-Architecture.md create mode 100644 5.0/fr/0x25-V16-Security-Logging-and-Error-Handling.md create mode 100644 5.0/fr/0x26-V17-WebRTC.md create mode 100644 5.0/fr/0x90-Appendix-A_Glossary.md create mode 100644 5.0/fr/0x91-Appendix-B_References.md create mode 100644 5.0/fr/0x92-Appendix-C_Cryptography.md create mode 100644 5.0/fr/0x93-Appendix-D_Recommendations.md create mode 100644 5.0/fr/0x94-Appendix-E_Contributors.md diff --git a/.github/workflows/config/local-custom.txt b/.github/workflows/config/local-custom.txt index 0f7d4aa805..896e092b9b 100644 --- a/.github/workflows/config/local-custom.txt +++ b/.github/workflows/config/local-custom.txt @@ -105,4 +105,11 @@ Sluzhevsky Zolotarev Kirill Nosenko -Aleksei \ No newline at end of file +Aleksei +Cédric +Lallier +Alexandre +Joly +Vacarella +Sebastien +Gioria \ No newline at end of file diff --git a/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_fr.pdf b/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_fr.pdf new file mode 100644 index 0000000000000000000000000000000000000000..af1a69a3c1d833fe6db573c113311cac25933732 GIT binary patch literal 579610 zcmZ5|bzD?m(6@nrpo9o0jkKh~(ku;%ERB?;LayG^;W`6~8E1KC^xLD%xKIZ{} zz+gOQ7bi1gTRe~PKWX7QlRdvAx`;)E0@>w_h;KS!(L6DFe}nm!B9;W!Jz}1i8yH$5 zL%AK+5rXGWU-oOQ1GsbZ)zO5H0Ew+^405kv5emZ$UH9XZv>YwpN6t2g9@)~DN;!Q zqLFq&&Yu4(giBi+{}mqsT0)JH@R4bNJjSX?VLG<(LbHZ+8$+WLifBBBkzbbOSZ%?u z=db|Mi=bld7v_&gK%j%NdOHsR%(Q2E<|p5NN;lP48{o0nW7fUVtC3yL(2ThxB9#4V z`0$y&gWg5q(`ib8A~Bn=)SP$ES#NzkW``L=$TY?8AVL$K)5lmxN!0O)n5O4#uvPs!1(xWqj+zMxg%k*1D9)mC#DsZD2;N(RouJjyn>6f>9Y47)wm>c8y8cH=PRE zTLQxyH-t^`2dEB7^2@$r^to||S^7xP2BVEc$j!2pvag6&hqkwXA+9RbLh|0JikI-uLJReCV1sZoL-m}vAf+Y^Q+`f!be46mH|mmC1Y?>D-Y zVqOZ%V`khSf|z2!xiN%w{TCZSC_^%aQD!i}luo%qh=~$oA`xWp-7k6I;sgH@X?C~` z20+XA%!1Fl(ZU*7#|qvy?h($Pe1 zxlQM-*AicJmnqOl{Z=u<=s(XWBD6#wtn50xgK;Mvzu=bW18rFVynx@c4}0EQ#yq9L zDBaQC&E~oC>{*K15XP=2S+!3+a2+LO-GRaTpg;SJr{4Kwdk5CLWv*xYwBoD#Pi^$L zF0cIYzxJb7?UVQEfO)tXmdJN7a~A>V#!}0n`X7@Mf5S?Skq=vAgu2|oeJqF@IDGSC zQHb$t<=t10BZ_}scIQO8jL3sH9|5=9%zQ|dg;n$f{MW00os-JGzASs+EqE7$sYJP{ zmZOFs6xIMQm|A*6?zsz!eXG-y{<`WdX5F|)QZUVnyhBEH{JF_kx;9ToxhV{uxG{s$ zFk4@((deT*jReEUa^HArOu!LQNrv$ig_!ftz3KlY&>KKYE`sqn9cvpz)SfI+C&a_} zL`pzM&D_dAcFLW^_9k#->16H797&q%whqC@3gIpx4+>J zC|Z1TH%{?ny;O3;c=wpTWHECChTtT^l_d58y2{69p4t4~qM5I4Xv^7w)+5iZ% zFe0)6I2o}F!0vPG@}44LdAD7@-5`sSfB=Qaacm+Zn?gg@rGc)IbO)D=# zPj3T4c{-zUO04>q-!Jp`sMB8h^DT5^$oa_0T4h{lzY1)M`-l84L(DZwFGU%#G%ZL6 zn()ETgI`?3Ei}o3MGrIXHNUt&iiro}ilS#gX=n~vqyt7Do+0$QFcY5rH240lhw+c~ zn+&30%O6it7_%`8amJ_*5F_53#>-$3FK@S9_Y{-md;1YFMjT58P)?nlwsw+K<<$e` z8(oek3U5Cc0<6yD=8B~HrY@t7mB)gsx{oO}Pk12x!sH!GW2*R!~y0Y`YC8? z>BM8wn4DFw!@G?i0gWhm(b9w@d4mae9)v1y8oG7~C?i@e5w|c2V-#B1wz;`Pm|jh= zq#0ukDE<8d#F?Lo@&%!V9={`|jN%UPv5l1~x`7?hk#KTR8-TPLn$ylY!Fw)qrJvp~ z=G@yV2@nVG%ZI5}xNU{TtFw^cTrb%646&R)ui8K_PP+gDrtmN#MbBE}-NI7dxLi*N zX?MxYr&rgui@&?we!d#$5AF0K8MD_@BIaM$;P!VWSWuBIuulsD z+Atc!HYGcG3GQ!J$jkGlKLbdDfJFfhPS8zT2>nk@}UWPMP7gs+TR4Xs_>u@E{t5o z@O~exgR#P}lUL?)>fcZM(dPr@D!^)8#lM}`WcECmA7Hsbk(#=3VH4re6=*JWmdpil>d z?7g@@H886R2ru}dz+a$l^Ff+^ZRX2HJrt<>r3`PxsI*f%G@cfw&2!>0!+1zR1MCRj zGga90b!an5`67;@1NSiS1xc0k5r?IBMd_xY)+q^r)Hf20vQO~i`DFXV{*i9CB;P&2 zlDW*+%kP8fVAv2~b)#9+qq?2}+t_8%$yLg**G_{q5n&i(aJO7d1BcOkZ_w~Bo`7r# z`-HuymtuMEZ0za2WMTBak-O+D^MtxzS;LRR3R8U6)Tay2e~&#xnhICkCg8XO?89m2 z22Aarb@^+}ab8FRh4BSt?)iKrt>}2wAe)yA6sWrrELrjlzyN9D!_+wu}SvxLAMAi=J0-Ve6=88p^vU%GkA_qt7kl!GpcygG_9ydMQ2|C z%})T|kRTH-a=-7`eD}d2%;QZw8KCJ0W{QxyUF@03#7OaF9AWV{oglVDLV*6HcZVFF z42Kq$C=}H)%W4Ca;Folcn+SX@L$kR4BAb+Lm^D_m8&E1>QRR1jxE1#Ix1~u2CN+W9 zzZ?KP)TE7bnA?c3VksF8hYdmltt<3_8bJ4wwv~^>^qZdgSN{6{XiN|Jp(e1_#>pAN zt8DEuwN}s=CfPm^?NNfBAsmh!>(47svX3Yi_2UmQDidJnApt+P&`T|;7lUV{0&mwc ze!2n0B0z)H{u$y+@*Ag)1j)}nH_(;a%p(J%AFfQS1;$&M0(DvPAeNJoZ?OX^I07|w6EXf_H1LM-FJi+7Os zk~FoQy|T{qUZduhEDyD%fKYi)y7uUy-o`C+fJyZ3#m%*G9rSGjK!1tU7qle6!icBA zC4SfgPraVvgkb}U%52h@IMl!TU99$fKPUJXVjZ6Z=!^m$5gUM4K4cD_q;X%J7u(wX z%GK4mmQTF4cBhwbE-b(wUhqiiQj7Cnf~T$( z1(Ha713JJ;tjWYc@u-B%&)Ol6#f8p%D=H}>Ff~>t!15(TEiilD9qiQbfD=a1F_#C( zo@3Bei@$JIjk_|qT;og9;{(0FuJx@9$s`>g&EFI^4wRI?Os7~}PGtb5uMRvdXTnm2 z*Ltuzq5RxVMPzeUA7Zu&T&nI=I<>&Jspfrzlb0j&uem_)c`&H|ezA;I=a$GPRFJ9} zsaujEQuer9_`W*!^B_Q+l$;YNeth#e&2s;5tuPs1x65%x_PR<703bReM(035R+Ye+ zy2|HCofmt`gkLSY6}C(89b+iAw9zrvxXj3W+)VBwhe1LMO5K)piWlYRpRN(VW9_aKe4|pflbV81{sv9wTUV} zcrCQ^K=c%|zXk_R@@y~ECd=q_o)l|3>#3l>eq4s;d|C0KsO#W^V_INidM)c8?T^R1 zE1YDkZ=N?y%{KGJmbIMBpZEzZb{_>m^?*r|^kl<~>85S5R}l9W(uw;C4RB&)WS8Nh zc#7QCAl-T`U=~*Jn*+DR0mME3jnXzv!M*q;?y+XS=E&e73sat+fD5%cb4* z^h*0i;=p~)$|-C9$kCa&Z_wrV_O$IoWZ|g%`bA@p1o?fs_I*cEW>} z*sEr9rdy#u8kCvY>wTWP6FQ^2uEGx5Uk_yw7EYhz-@EfQleu>VURcL@eptI_n*}>r z`_eumTzhwADx5Pb&(NueYUyMZIJZ%s?JY@KSe;j{A~`m#ALPq99NimuclJw-lU(;i zxfwZHW9frlX%$f&=pe?2R`}Qz!*T{T4znj^Kvre= z4|Rl`_7sbT^!1Qej0a*0cRp%^1f#nbZa4@n?#<+*`nzzc?Aodo>e zeLqsj1^dGp8BpDpe&WeD)+R$){h8c_6tlTH@I$)PNoJa!$F{$jPCQ&Z zGYBRp`N;W@5+CcgLcFT;SHNZ`O}IN1u$~&bY}lKlPy>6a;l4k0lo472NzPLo#jl{` zu}J4~K`6=xnn07?VIqkr7ykLegY{SQT({VW@Om67V``U=^d2MpP$>%FofFE z{IM41fe)UK1Oynd#kd%cc5^e}`+NL_IIop-Pn9As_2+ay`sv9=$Mzx;?sN zQ8ye|_=?yO$vPd^bKrf9aw*ybG}P#Qv|b_1=TtWRt1CtPw?2!i-CO?qbme0LPbvL# zI0(8tIYx!A);jrBA*CY115rKvZ`XohC*Q~?6cs?U<7P|qk_vY|2s+o37d_o1M{>R` z+%=Yr#ozW#nNq!B6|dF_TEMe5kGI4|kZzujH}&QK$n~=Df;nHB*Cib-YB-M%%?p3zz7f#4uG;C_mlb0%vW>|{|evW{4US{MM! zn+=xd*&pltb#%hmRiil$%Q1V zD_YF&Ts#B)sJcol@ZXvN;PJ( z`Ljg71^YlGUwU2+4XYIo}7WM3YjuSr!G{awQpN?jvWtxO> zLu$Fjqj&mv(FH*k(NKcZdUVnAEN(c=Yd}tU{at@Q)xN}S708+tpWB^BhRf!LL_aPk zixnn)-bngWsU7v5KFJzuXAJ>OkfuZEp8+#klzdC9nj+^@y_IO zW4b2=A~$f?@La8`ky85bJ?~QWJ&k}q>=P;h?@s6}Obuixeczf{01D=#I3T&9f|xUK zchqD&>URaofW7he_aJ8Whq~JDnyGNar!0v6t9DW8=?&B5TT7rpt6=mcE1u3CAo!M?6IlT^M^pLb!; zx|!;%XjzMib~^Fd%Iw}q#l(|MxiU8D{AIc_Jxc)uQOoC>{cf5WE14S3d@x#_r|Bxc z?u5j+A*hoYSZX%CdR+Wt1UOA@Z zPOp=;&*d)@m5JCsqYyHb=&|eR$jF$$CtP<1vEDDJiS%A8*pA11MoIK>cak=9}; z>F*_u!~E)|viPg=?`vPo|y6O$pC6oIOUho4nEppW@pDMtYa=s}Tr6-J^ zw$qo0DzL21Ny!GST1sHrUoG)F}myR4u=~AA1M@T_wv$kHX2Ryk^8W4 z^WfROBw;YL-XrmO2DiK##lc9*8?@ELpA~`aJ*G?41>arjcu#_wW<8;@vK7R{-M)>0 zyg|?3&y6AN(n;@Gf<>INVeR!>HMNaU>|JVOK)S zuI?18CW^K^pL^vv6#39Yv{>?73Ltau%qG$rd;s4DMoqRp488vbM1*<=Uh= z)q_lGE>6eeBaYL(`xH5m&PyORZiX(r^1ZCFo|s>E+-f=3lYMxP7De^T6<>2?N)gF% zSxaeqVH(jl#gZeIFD!QGbJ1kV)n16V1=c|QS=xM(BOr;`5=B`VZorgNKr_avd6Ok6piHMV`y9}jYwY=@I6q@!IZC-Bh-ko9c^t^sFdnSvVNE zJRrqga+c+^%Xihil=EXxY|udy>GMg!v;kWZ!jRtRIJG>Uhk$MG`5T0w>r1Z+?K=wk z>krt`*gMVF^O&Z_I+&-WFhjod^yqZ9}5cWH|Xx%Y0VCQP8RA0 z$E7sE%1StThB`ysy}5d2C?XhiATVh!&nls=75Pm43fjA8&6e{6$9arh8ieCKCH1Vf zlYC(|zB|&yu;arBmrqFU)+@(R-!HGcllCBMH2DqCbkB3Ut8RHbJ<)qd?(dIrB_YVx zGd7X)9BXjHRfEDp*@lmco>UV4?P4o4-gY!XSt&y!qzFsp^rr)z&jtiFq*Qh_#&@-s^RCv#<=X1!B>Ou9WZFD65ahnk6#K{>|3WUcSa3r zpe~H_M(5n`!!dVm{79(NRA8EpNDF$W+jQaL>rxFDHE`N|)JbAH3GUB6x8vMy6H`$v zJUQniHN;QWS7kP=dlB_M6D~9$*+aD~>%TMkQ$lnR~I{AHEW3A;d{v$gH`$Nm|=&lmQRIUcM}_xry#IBc+3 z*iMY$n7G}U4=ch}@gpCE1bvA9IbswD69Xr&I8#h3SEg&O>u>dJ9PHTXdAOhhy@L6* zidL&(EDzoveST#6O{~5-)mzER%YUnBz>2L<=)*?!*uBMz`0gKFWI6Rp_~mLxC(0Sh ze3Z1~_iQS}RH_Pv9)#DqXW)i2-XR|T!$dXUZ8lAM-@}h(`|?a6PuSIK`FZC_&Clgz zD>sN6h(;49aVp`bt*7F>3PF8)H|n*KCFatJ*FMM6E3nXPxKP+N&Z-5QsJNN)IF=V6Y%MgxjTeh z^VdZ2iA^I8jd{(JPl4x5*asQY$&2Ugyh5AoDcL0I8qSYKr@Y-B_p_i6gFz&GFo|to zFHq=F!hRP&E#fKTo%vf6`P^Z)y2qWU>%8+Px^GWk>9F$3FtzEVaAuLyU03R=$gj`M zcX4i(I<6dELlSg~4Z8gR!akOenhccT+O2eI9oL7ySmHB|@afosL1);Ylu8}J0d#JD zcoz+;ALMR8oZ;`w=dgq-FC}W1CrH6z7Aw#5Vjq=U{EIcJU;+RFkgR`9CzSIJfE=AbZFCKf4D|&@<8wp#EnXDjokUe zpLZWs5H&0EMaLO3OjZL-csa|SUwqUJ&OL?H1U4m}*$k?^!1#mRP^O+B}0u z-J6ea*Yi+UmK-ol6>&-Vpx$TwL09)aF2SeXN{IXwyWD&jlNhcA+M>X2Gcpug(J`gO z>S9}XpM1u750Zshna1$! zJpcZFqz>5}Pc!9Me8XAa@J5h?MMLK&PeR7p>`xz{htb6Dp0J}^AW;!_HrdyvSBtN@ zT@=1WyyJ&_jvGk2d$w_3Xxn%3CI8H(j#uiRW!YVjw`ZyC)TNhj!t3SWvz^pUChwU* zZm_U2+J0*)bZStp-`Sb)!-RJzlwh{ro1@uN+iJ+;y@I}GEdGwyVu%kRV@>v_kI=*W zHd~h?vOhMah$EhGUv}$LF2n0|8t!>UqATS3tF{d+$>eEZ%iIe8DLAa1^?@l;cpO)gv(V4ToQw)ee% z_6}Ay)y?$iOD^o<(ESgAwL)>JUB>3a++pJs;c?HJH;$zfM$Pf$6FxdR{+Ba}CkfjI zIw(8+D4p}#`JPrzkN5O17)4KBSn^&j2MQp--nTlIne&%#lume981H~oqx9AJj(+*n zQ=Z-ixx0VmaWp9u>akNm`&+IkzR1pBUe;oESdU{*Y(CkZkL~HT_n(Ldk1fO2WL;lB zK6(JznkDcNOp#eQAc_Vx{lQhN>fOu5ukO3&FKX`y@DV}ve$at^Vs#zA=FrQ8Uylgo;}sGd?Zv~uZ5>Xcfomf=1$B1| zlP_HcII?`T0)_V6GE?v>U-t zS9CJ_glJ6XsBcu*1CeOLH%Sq^ed2_|afi{zGbxaFUjq5^%}+;d`ISzDlO@k0<48!` zOHgsCBDSZZxy-w4h315#lN2H!w8dvcO&GIb12cNw0)_j5sVBSRo7fPtZe}dng)A9r zmQfP7cI%igNroocW_nNegQ3j+Q=y!_?YAQ1&pxJ*rj$rjc|)iMkUZM#r~{S)*m7yz zfit;af>ZB3wfUdDJC?B1nR?V}Uq$=^$Mnj)nP`IL_ZY3g`!#8ss9nCB?Zb3ge&i^{ z%X$RGYpS9q!q1$&KRF#f%f5q?e-%}(41MxVUlf9Rlf?S#%u#_#p>C;R%e@E6SmlbA zpA>wX2;l~_)SlkOs~}{ha+p2q%is1mGaJ&I~@N!9*}&3pNxx; z=T$CPYaIGcJLHE2gw^VZnkEEUHGyDXeXy}I(be|N3UyZ<`%_-~L)|dNd zscc?e`7v8cmPs6i$)~QA2$mc?C`BoU!c>Z?R7=LAz<8P$mhw^+g;ua%Ezd4F%l(?I zs~*9uOR=)*tSK6ZR*q|<{=j`vi^Qzc>n?YuEH|H4XTptDB+ZGWLFz4b@%Ew>neZ_? zNLG4JKCavwNk}`*3%QGrfND(p(GTbVdFnjaYp^14S?N{Dsn!CA^1?@mA*C0i)4-e3 z%oHD&ulG~nNUh{x4h`Oe4gRlTzx#e##;LL5Sybf;!+KPGz37rtUTJ~uGYF-O=XH!P zY}Ix+=sU}z&ezydRlDIW9J22^=#pBc<9nmwUT5rzBg>{5K(b%dLn;DIdW=24vvwSJ z?@~rN5XPz!G9u9|#jsGFRZ1Tfql?B!qkB^zEyBVJ)LRk@KjH8t?2Ch)Tj7#iT7&U4 z{PO0K6v-z*3Ld+r{M7a_H+Av)tQc!lQSm?-f&hzsP{fC5gYHL?+Nij{J3uSN2hKBh zfoSusk+>Ed6>E+>4{`fNis$VrrfG*HCCi%Kf^3W*b4!3oFsL!Nh1`g*tLRH4A*qXI zXZu-&^D+4kyclNw$xy(?@T<5$#ezY_+_32SNMm&3FdFH2tZLkq%Qo}m!=uI0h=y)8 zDW97mOw1x!GF}E6yt^CxcZ+3eiHsgpxl)HjI@Mbb-tJa(Q-2MqEMGodVRIN%SmFGA zi~qwTTm7pw?f1Or48iO6V5HU?e$!Ay+UH`!@JV`%os?Cqqj`PxuNmTEdYUFeCvJz= z8vZJ@s!H5LwmE2TLeyh#!?8Lfid@cPN5TXlzNojT*q zhbYDK`uh(Cb9%)EsKRB*d?3w(kMbIrzv9H5z0w6CWE?k7XAP~rpFPI!rTiGguPV^u zR+4YQ66TqyHA90CGkiCfj1BE?FSq)=+fxhV6rh+5XH*%{=1)uY=%4$@*(2GwJSfjpsw+?Wl4?mg-Ea6uB47*+wjg4%zi%R9!HSZXl4RLg|kXejjVUskn zhCz5!dRQ(LWfcPQBGCVk{L$|1Rx&j9sVejdmPty<8RG9P+5#aidzS zuFHs8!lZR{x6C=VmEdOFQgMeS@`Wh4KLo3>)8`#`14V46bNB}Fo=81|f zQq?$XKMaynD*NRQpbGqpVDPz&ev!G4CdhZc0ysq+DxB-WeoBP9PSPtb#8ht8wsGg6 zB}=T{K~CZfiAxo(f7%Y$k^Z#mrHZI3o1jymv0&1TXHD&(cDn-S^x-{s64y|7ds?-e zBJg?4Cetv`#!*(tT^)9+r7v)6iNS15`@48~v#!(p@Y_O^Zz%a%xz$KbChSektOWUr zS6Mff#(bPG*)u|y8EV#w(vS5}SZd2Yz0{NP#otH4q!mG@;rb~!Zn8H+ruviybR$!I zw)evjajNwE;dg{JNKg-Ll)&|6TRC6#P*LBeVGG@M>xEVoN(aVnCbUmBX!TYU_xUCT zQZwNlo>+EXD1cY>yB^TAbZGL9C<^E8t!Uf$8hscEfc6lS(YAFMgf0KsH^ur&q9L&8 zy#COE_R)E-1P}{#j$FUc-xT+_uoA28CvLpu+}!YR``8GDnI1N_$eyXm*usnzpZ!rA(d9UKrrr=`NM2$pDybM$Ug-(dx&V z5xxIzzF0NW_LRqt7ViE$ozUnvU!fag+*vR*8y4r!JH>993A;IMvR7#36w%gz4K-Z< z={0~`u&PQj{wv}FuRh)pN>pey`0V9R+`@2Z>HBK1_L2PhYtUN|g9dV<79_kX5;=Z+ zdxfBd8#j7K*!7Img?uT-1oZ@f@SY(k=fb>RT}bqJ zf-(F_%TswGhMQ!q<%W{t4i4$wM;BMmir^CsG9YC0)=eK?C8Rd?hoM*~-dmO0(-J5} zN0O_4Pc^SS-0MpfAc7js1V}auaFj-?(n?2iU@!CGlDE^EPLvPx ztX|0mRG{xJlTjKUu8y#;ayd0OxGQ`ec`ON1g%}n-2DtL!HLc%mA?Mnf$V{@03HzOC zeg^q+Tzc2oCplucmC`jc{(mwpPj7@m0J~&Bs)(Bh5^F{9ZezF@sq1a@?e5Zz&zde* zsnl-jmt$4;(b#_mB;AQ#P=!L>W(3%W;xb|R%m9AbFiFutftk#UYW^|Fdcujc|Rk2`Mrl7v^x6td})oBO0Qc>C$Nv7a25zt`Z4 zZVtUK_`4V*G@p5Q9K~Fx#zU}tZypz@6gVuFI z&O~fv$m;?DySvDY?V2>zZIvlWr^M#7i@$Kq@!MP@dt$DFm<_$9 zp{@!l2@>~e2q{?IBE~Uel0K(O1>gFgDGB4Og>{lE#WheU4Vivw62nelB=2|EuV9`R zzLkHG_Tk0gN7__81U}3;Yy4fY7XDdz%D@=N%2V^dZUhzs-U6b?##cCPB=++&UCYgo z_`76(eA`aHXL=E09Q}8qRaRo5mHwJ;&hU_4MLd$Ymie-g?#xMkd`S(EfPoPRCB(ia zT71HA{fRH5c-pKVchy0~@dy5lY=5N|=U&=OeJqM=fz6Kr21Nr8CPP-9qNiXWu!{ z?C@R51dQ((a*>P5PZp& zKu88CRA-0n1Sk}x0V=7f6w)`pa7=Z3?uCrnO7wU6AiB{xcQYT}6w6L47V|gI?g60* zFNKXb(jIv6Y?mG}N{&rFZhaGWX%4ygb?c_>_$4a2YQXlR*_!#$niY0@dSl3AzOpx0&{_?}S zn-6zo<6g=XyUq;2xA2PRi~3i~4S)1>^M8Mb>VMa7`009Hp~HE3Wml)bHJ4OYu2eQ1 z(jLqWDxNsXlK^XD{8az=rz&LHAhpn{0dK>j$Xu~P2j##1nzyJ!IL8|2?w31b@|&)- zxBgp%xiGmFs!Kby;!|Y)uwv}ByJpFyo*%2dE<_SkB4E9~EC=Mmf0hDU-ocaN0of4= zv&!Tvmj%m1d7r#8*a#^ZaF+Fd!UWh_g?W~bcG_;3IUgeR(-WLb2J;?*y(fBL^&&F= zCWcFcE;x<%4zsl&6UBGsaWd`W5DPCQT=`Qr@RM}ZdU8SWDv%9@ql~s=Bf#nL8|HLJ z1+ek1{cPCXBDn4A!SnBDVqxmTO+qO`m(e39s5N(v5j`1=8sh6x^w&35fW}JIbOZ^& zR|h9Vvg$&`1#g-riAN}PHB$ut4+hmx-J%`?>L1a{G59Uyg9ct}m!Njo-PBig9o38p z>)1>Hv@)O*^LZ5nU$sUS46K0^W@k;6*QALRyF84n9O>OgDM}HVQ5bhen>DDU_57ds z0Ccd$b5pu1<#QydocA9xG9YzU|1hYR zDr7=|CreX&ry^!LeXW#lW#M8kM|yM=ZNAGrX3yC~K)3J;YXkBGcF_2bb=NZ%o7xml zo-_w$pn(?eopI+O+`RiRtW-J$&4BoZKKDqqKb=|cO`d$#9sS1nY3$#yS7a=F zX$;Y|Y*GDITXXK~hhJ-Ne6>-+9j;e%GHaN0IXVd^w?svmP?*6BzS1k63gaHv} zRT6aETrpU*o9)M0?%{TR-lud+H!YQ06&B4$quXBnsPY|w$=keyb{wlRv3D0PU%7K!>@{1SgN z7gpWyyR8?`DL(~mMG|NU{Y8TaJ6I}{|N5QvUo;qO4;j_?qwmCh2|0YEVcRuJR~a~> zl5i%=b;dxNlvEjyG)hmk^J-$SvCxPplKYq19!>J`zAoXZ8}Fd?nve~w{m(QS27kzN zhY67!xk5q%x4dlFu=s7!fe+>XgROCTVX^RRCXL$oW0lHVRMk`mnc-Sc_POqFa!-41 z?qL((PS3}`dDSObi6*sI8@**Qr8?gJ$A%cpL*k6-QyXJGTpCqH9mp`n@P_Q_cZWbq zZ}Rvk*{|`FSKHY>6dy0~3EdS!{yH~m#+z>_bWr`BDuPH8>1OOm@ilM}I33$2o=r7m z=VDFL^87$pBn&mV+^cL!EWHp4_@B}l?aepVr=%TE1}%kEuk>{onz9e{UXglgwOAKr zICpMyh=|=i5R#?&eQsTMrnx=K_%AHZrx)tFze{5ni(%Ca4$tLr7V$5&q9PCjITTZ% zZ+3h7j+$8K?+dLu3c}|43;v4??^tF}$sD&bNoK38E4Ir`!Y|ryt*uh*DGS83wsWYoRwv@}mw0ZgFu!@gY{1L(qM8cfIiZo$K0W@4Envc&xBl2Id`E6t2 z!<6IyB52nqw#7NVMJ!qr@(|@x0$WH?!I^D+*4$%K+gBMWSQ9*VhJ`u<^Rbz z24oOC03@utbZ?v}zT>>xLpjumK9w+;uxJwK0SX!HYKf^_$CS|XEVoqfz0t(5_{r6O zHFC609{FIRmYH+-MrG4?TD=L2@dRW{Jp(c_UftW%_cygFP0Z-|moe9Le?-Jo3q$Iy zm(^jU`FD2y!^b!FhbJY#ud&9x5rr4T(m?U*>gVCBlnlMA;Vy;OW5=~C>wX8$(~Jw~ zYlX96YdsMsWDI*i4bbQ8dah;SCX-Sjn`?7cAsCK#BLCPeM9rn)eo}RO)C<#D;|{I{3BB7zS8E6T`?_=3TYX#?Xqa^P#q9DR2TG z&d!SQxbbGw{{ng@XGm!ECxC1g)Gzzx*oUbEsQ4MvY-+T7D1S=t*y*bi9-c-{e~p@h z7FWub@^5uEUzCjhx6|I7d^;1!hhpkYsZv1~-9edXa!QCD8?Z>On zz{Pc6L^;L}NAoFAj<$D!7sCE~m;Y19++xMrVZBD32gSxRc_GjO=5H~@is;wqK{TOc zZT5NdoUOkVe@#g6gBBaIFy-_J+TXiE5FDPl!rScHDjXJN{#vxt-F50OB;!vjH^;5{{_ zO>Iu*+1i!cNm!)EXW@K^x)<=L+F?fz%r|!iX*qZ{$8=B*U+Q0sWJ`N+UCG&c75uo< zq*MgxY5%-~0>4O_$bo_@?+Cs@Qf;F2^?o1|=y%J_GY`oA)t$SGG@ts*^l&YZ8u`l- zn(@G!Z&o`emX;OizLOUHsjH%L^E0Sj!_&~~f`e(mnYq}jJF9Dk_}p(3E9vHcf%;9} z$E8+8^E;y>r;E%TTh{EsW<+K!hFrG%s_w-OUDA1oe}SK@vZd;G_aet(#D86QlSx%K zfAKt|0!E**jDwnNz2bnY$lgKn0!!O%gYIx>(0-pldE>H(T-)HHZKb%ewnJyOEq1xP6-&G`RTc}^vI zh0^k0L9gl`{yOK{3+l4L=VIN|`M1q5XL=7$me#2XA{Es0LYiAEPVoyLS6IRFm-pv) zXBzRWX%Jw$@q(g__YFZ3)_;SbTYzLxOt>&^?_KcvlOd_IOH@hVttp3kp54}{>U%Af zIk8EC;@S;mRcTkLgtJHqOb`ISbI32Q?Pb+wNwvLYwSL<&i#ZGuDzwiW8N?81fNox2 zOPo70bMbfeTA0t6DVOvyPO%-&xY8w9PA|i|PHPQhtC*K70_RCtBwqj-v|Pc`o0Siv ztDj}t27Xn`RRgz{C*MTHyrH3dts`$={C~Z~-3^+HhUMEs@PZte*wwo3A-4Oth9dmr zO>6$E1%J;^-00XaXo`4@z@gyonE7Wbhkx}M%Psa@?Q*=sC8Z8bxR9*?Mn(3p+zLEu zwmp2DMBGP6Ua$L(yJwrSYtx)Y6GnuIMw@)*iU%py;KO^wC|L>#e9#LgIZ)aheeSmJ zuaS|O3+N4xyVlLe7CKw@6b&gGI((IoS16yC>DlU17?5~vb?y#;v@WD6rD3Nxbn{!| zSl=a9{os>b_0t|~n7a@vKH=vQp5_*ql;LAvOC-IK5W{heE^rpw=-p=@VU(e?>Kdnl zNcTt0{fxBg*=fF$k!pX^ySd`3bP5g=V;5L6ccqqA^7?%LZ`d>^-`IZEz}D_3HwP~u z%nX^1QiUiwBVHpm?avNg3Jxsn7g48{DY{&kc!{)>O8FCGumOs5zPSbPi~KF_R9nky zXHJQXQJ@q@`NT&?XQr(h4eb00to;U2`cPN!>_=V#!lQRnp! zEgi;zjV$1ojuXyuNA1k)8oc_*a}T4V!=WPt?#{WExV>su_HSS~r?9YnF<}_6Q zdbfAeZ~ZiX><`0Exo~HwB=9%=BC89#iC1r?EO+5f0{oC0Xr1nn(#)3Ty6j2r=|0=> z$^d0{OvoqP2ZAYDPzdqF+XeW@^IKz+k(@ea#Eo&JPUsl?!FCGF;_R|xylJE*v%NXtLtxzxx0T{v z6mRhNDLeF51>Do^3Oo~RJrhrpIi=g!&=J|M$@{J@Sa^GeLlb@B$VU`qRjSi5oeLvJ z9&F}cCVsHiErcsY{#U7wy`!}F zuVj%i#paM{cl$e}_^aWt<@(I!t=1!7=An&<%mUMZ3&bs(-G5oz;T+q!D>yO;=N(gQ z3W3?6QfV_`FJa54(>^P+XLA`n{Vd#utEvymIy1qyuj2_|tV`TI(zZpaLOu=at-g9L zpJYF+20HrnlKf>4-zYZ79cO(2JxR_6EA~vp(Jm~#$p2AOd4RzdS`bo_QN*?q1ri7`F1p%$NqPbD&ir; z`J(j$HS9;;X3a;bcR)cH9;=A>_pFwB^!d}7nNNK|OGLT{K1fI05c7^9)5;FF$yM;u zdsAHd4e8xFcrJAP-u6ELWPD=HfdA(p$Ez0jKyjk-yXl3`P*x7?E^ImUU40O=l-nv{ zN;GzSm;Cqtn6lIjJgXXXRC=T5i$)3>LZH#{`!*upq7 zyyCtBC``iRLMnO15ItDqP%R&Ulan`9bj6>n_y?5_Z~L+}y&Y`lt2CI8e5SU!GIdE+ z_rIZ|#JV@1(RlB;m5m1S(WT5T;bGN2o`(7)pS{??B7fq-+Vev{JNFr_$x_TQA}b}} zSz$&)Tnpk=W~C;lp_fPNa*_zMRyz$|5OT6=s$$}IL$1wYZ?~js!}TE>P`L}&{A@V( ze8d|esZh;WwJlV1AdE2Utp+bg{8#wc#PO7i(1rH~tAkT|!2jyi%)0la7?P^XbpDSa zPazvt@dhGl_&u@QG%2yg7c}SDZr<^~YMn9-^!iJ&MSWR>-91`2mqdg;B+^h%AV?Od zw=n>3yTuI0JiGMtmT3H6mQV@0kT{n&yi*2ZXSRIu9=JwXu*)}w3-MzU=PjRV9@y`{ zgy*gsh)^3wH)&J6gJ78EUF=S~z+h7J=f=fgP`CN~IM4w}%W*3soFU(%;YK9np96s=i&Spfp- zUrxXKxUzI5`cO_SzbqMAW~VFUqqB~S+CRRvsMDm@kd@iXv-1c%bGh+A6OtCuavh`D zu&9oKoC0*)3%v)>HPnm)FaOz@JgRf^L#vyDVOm+uS6wJL|EI4+(Y}gRTu2Rq7=JfpK)w!AY<$09u;yAJXN$6+jp}$AbbbejlDhvoA{bL*0HVtl{PaA=bDuh1XLi%U7T@)p1 zL9;_9YoQ3|Kohw%qCyV|wf1p#8^z6=U2lk0_8;%Rb-zhBx@J3IGU9H5UCnb=Dp)z&5 zE^U+~s0m5XxbC;z;u#~wZHMCV^7vtY=@GrT zEbMap91hXmKzg70lq`>YIoe zA8fp&d0J2=!R1)3B=_aa(mz3=YJTj{m>+%0U(45$-WxgAC_qmMn6;uOv2H$(>_M-p z^myy`9C(t~=XW4=h%ygW&$@j!EpdtoA$r`goyLEY;$U9F0?n84HSd+iaKAwRndOt@ zg6DgZdJUv=EP3P7eE#=3x9BpgcGF9(Kkwswxq*5YKr7)D&i?F_d{philTzN8yU3tD zxXb)rD1DXvsdU2FFAu(`RqAl{mqqXg@qbrvq{xYGp9?KpmCN8K>#YGqUp_K5gbIrX zOo<6x&^&|*{vbQxE73(eD1n3m_}%o$nLFZqF3sGYPIg&c-n4`-{c!!fb5yM0%3m(< zN^<9hi2n`X!O~`U`bA)dyGp22o(o~&&rzlVIEB+xlN}A@EKGaENk<#8LW9;(TxUkT zZCCoZ+yVY+x^jf2umhnEL?rn`Eo|@w1Eo;s@6#>+=3K3Mji#@+4*LHc6GhDMhEbX) z%v6YJBIjXYqjk4W_;kki`Q@-*Vo90&Hc9HLBx{SYm;BE_lDY>xEGG{m%HXtL0-wZn z$kW;;IXB%%FaB1+v(Sq1Liiba2f3deMVP|#B78$W?C$w8jtjvCJ)bRM zx0+y~^$nc#XcN@`yp=dMrT`n{R-u}GQ^g6>mtjBW$*CURdEH=9l+^j3A@7WeS(`x< zPd{P82A$k$WXrq4UQPY*C_qN07=C#TIDFx-D{X@IXKW)sZ2NNGbli!gi~+++ ztorenfxpn$$cbLdGcv?X_GalFXEVQDR*Jea$w%Wt&WBNt!14>}uK*te9I4($ltrms z+=12K8`PRovC3Ryeyk_cQY*kWE;M_mLvh8lD!px|VSwmAd+uc+@czE-3ab~}y3BQ) z3d4bI_v=r~^F#Mf6yc<}bCji%lj!b7NvOj=EyLy(zfoQsWjj0Ns&U-zn3+nGY6pL5 zF`gxhB~gifw@q@vM&2%r%7-uK+g-^nX8B&^T09*k%SKN${sVE!Z}0E~=lPnjU=58rZQ zuy{?1`^8Yj?=tqE&Zs}{D?&uHOoj~)*^7(i`5#6Gq)a6Hv`b;saXkV%3N9UZ|J!*B zwT~cikcCVMbY+TMT-nX_z~7g8uap-SNA@2_t`>>Ds3CY*o^tKFP>O(kaLP$Yw--hZ ze|D}M_XaU2-fBH@{uunQe%O+^4=>CK??#7B$UjD+?6DCU&vd?DL>2ly^&S?cd1H6< zpnWoC>Eyk)Uft6|%70@NxTp}@*jc`%ylP{>t_}bnIXH??12?avd7Bq4I)5>AT$KN( z=Td9gi9ufeFSi4*2ybeL$;lVbuv|$F;)QKzJ>b3fcP|bY8fiOQhVOL;TPv?BXARHS zW+@uqJT0t(2f2q7PCA@H**b;FI+W(HJo^j_{=?1HFxn6EC`*0zMP_UAYTsnIPsnZj zAc>UK3NBSG-J$Q*ed6*T@O#*x;PZIPA1Sx)4D?4V@%?&D%9I=jP-_r(!%fkf8Co4vzF<@J+{&MIZRbKSR@>pS@yTllBkD>?J{)~epCQ!f)>gP5 z;waVr(k>_oKL^<6C~4&GInsYH$jAGCgY)H$zKPReL65(04;RkQGHhU(s{juc0GpVA zYrH;*FRXneryu14$kgM7JXd%7@Jt?)ed|#tN#~8Hu$R=NASio1hGR^)8 zaJDOs?9h%DGr&hCckI+y{{gg3E$)1V1>0wtjEV90dOh6dl*ckUv7Z=d_Tug94#&ny z9<2q|5c|*S6Tn?Tlqyk82xm;bFeVr_)+M~4WrF)jlT6#dVGS%>pay$V703^^yOVi> zy1>~E@bNFuM){+O`n}N#v2~)7@Hk7-kXNmjOaqJ+>UgE%42TVF$otI>a~Hlq57rutTqdAZt%>ya&XG7X9-9+VIr1kZ#n+irF7?{~{W1^kEODy;a%hK}{CcLd-)AyvJ<{ptR^6Z8t{4APPe!n za|iPdVR_R%Ny)8xWzsWH#oFW6=qW&_zIvF5j5>So_z!@Jtk;LN^Se|aQ)Zcz$@(3; ziGc=ZLvK}Xee|1k?hIV=$Q+n^OSremWAxDwbL`cQzxX`DT3;%#0J zyDUxExXh$hPN=UTks|B;=@&DwccbAHSEPO=R|c2+pGi;j>*Ews?}TpXs!DaJ{fNw6 z4XM(e(}d3WzdG>er=h$OcPc0?cEV{&?G<(qM=bIL0vF$VdbeOaY$CWwp~xvU zOKO_-{e)z0ppP$`wSdM#J}+veH9tC$A>STc9I`eVj6*en30o+rVq*Dudy!w?!jqOB z`Qz2eAcl}#b%r13pmttCf`;+@1#u`*k?1RhJMPr zVMSj*wS#~AT;9O%eY4s}1oi8>jEa&l&;F2ib16{|a^Z_G!O7*$I6+`rtRXAw$z`yo z?vtAg$~Xwj%B;W^0ccskjY%Cy!}qp0?g65O;iBZk#2u+X)xfkU`-rzcO-Hu+J@1tk z|B@;;nV)i_Rf0^J8}CcxS&SINT&6OqZl&5qi-a6eY+;Txoau(PK-*gku}Rp*4!w6b z6dnr~7~3#1+E0itVJm=9KP+Ln@CIY-Mmm`^tUv zh>WJ#fe(r>J~s$ta$>^-f=~)g6LPcOMae+3^60~fqH&WJ%tLB2 zuU)@jlW|1)b)DE49hfy~jg+gx?m~6qa7Zyirs#^o(y~_;@?J~0-dQxOCHDn$0o-h{ z;N3BaO$+rD(EZ8jk2ucT-^LfVi)s@j8cZFkxg41$#MgaGDa+9?t!bv)s=^K>s2A8C zT55P%;Argx$yy-8Zi@})p+O#$z}?=ktof-(B3c;ELinPxEJ|r79Em)kaRb~bn$zRrI_T)~H8QznFgzt_n`A2!QeDMPMW&35w zVWFFFk+Y^pP+|L)#@jyuy(;7FJ3uk%J zw=BY{)&043A~E!bPLgASs0bqcr+T8DH+xZtf^Tv0c)q6Y>xbAxd5>-)4@%+u&Qu}> zzeqFu^5GbyswE8RwSts@{DZdIrvMIvR z3=MtdL1g?q&WFrgDB>e~{pzhT3|Rf-pg(#&vbQwM_Dr9DE)BKq_~aksUJ$J|t-gs( z@KZR!#$KBHmL=OK*~B6S2!bmx{&yg+VH1aiKxuLBfTz?A`lq9$mAS=939G8-xdmjm z91Oc2b1Wb}nHlo~_us?F3X3b)U8HYY3Fc6Q^HU4Wl!FfeyWc?RWqHofN?;~MtwRyQ zw%F%KS0NN}i7U)G7tVr5sXOSSAs6r=$Rsl9rD>fz&9^7~e)x|`>5^JJs6JbF){rUh zv_~CKvFYIAzP#1&NBf3*RJ*`^;X$*3)^Kl!TY8 z^&|Mt-tMa&ug6+Xl1ymA>JDdg=@g&vZHN>}bNofMt~(M-=$N|kLKFH<>`=nI`aP#% z^4>{ame}od+;VG-!}6cyGGf#Nu|1=|w;lN4@71JS3u3=8Rp1`Y^pMH>e6qYSx{oAA zCU>e7?6NhIKP;#m?BqV+adQn$t}*jr4o&x4m5+Fk#5r~ZN|2qcvnYlu%)w=fAW1h`sKKK z_u`cCD%0rI(`tPo3?x|>O1P?;;?X9y31F?AS^IU0V*ggFk7hl*b@7VrDTR<9^6gix zCC(a$)m|;Or60!`Il?x{uU4cgW}2>k(@zRLXiiW+RDtyEj#k|KAT*h|K&?`OurS#c zUnTeamTN8HC4&`NZv8VHvOP6y3|%BpVkr(< zrhU#Zco!_>Kl-yuAd^5%iBc0U-?<&CSX8DUmmL>h(N#TsYf=4kb$*Ueq{Osv~;=6lfM;R)?stJa)D%+5v!I1erE zBUVjlxWCX2|9i%rSiQ#H5UbKv;h$gV`+U1!X=>JYwEyxu-a}CLjE)Sg)-$?MuWo8x zF}Y3&J(Z#~c`bMeZkHTo7~XjAakg6Uou7dRtBn+<{f%KT4WjT2YB64@96~#A*P&1J zyi$d|R7}F*d@-Wk{)5qbV^fL9aj5Gt@cFr?iir{VB4e`~9tP1uTCm-z8}vI~>x!}w zO#3^-pv{`xGdZbLos}INB+R?2lu%$}&ZeqBe80*HU~B)k1_qN~iQIy8WsS6L$VKUp zf5k2J>L|sUdvd)(fz8Ff{wed3G4}TJ7V*;k8nPXvC$T3bY*Rl9;629sIIQIr-N{A?D1hkV&+nXI1_D5fgs-Fwd=Lzu)~l zP~7|2Lc14}$q-n)zK8|W{=sl|C^x7@K3h+lb4-n7Q{T#m&(&7@(Hl?JIcbjDutA-W zul_WH&y4R34YRDD{k~c2|J~}X`1agO&eFiHSwvjO$qyZ#Gt8~BOr|cqpX!bB(!dU7 zywq7P5Z7Si6ZzT&d)sS9X+(>KfN7wqre_gkJBzgtFS{G=CV-%}P}sS;>`5HF%r6_C zJ|)QJ>D&yu7tl8Q6DCtLGoE18RFDf7Kb~$Qx@BcIj39dbP+bwy$B>XYQ!cJ62X*O+uvO%fHK02{TWX=URqu8zT{?jWRemX`>9md zn0sfc&pgEi`D*W1NusJ2l#xrTL-<|C=DjtUz!__4>9_ZJir#*lGhd&e5sUd=n_>GV zn?^WPJ=;c1Z09O2JZ32mZg^~)QZ+hMC1uS+^;~~fx}Nc^=1bhL(EPiVGiTGs!AHfC z9ww?+z54O^B%CRmETUg|V}4{i=?<0P^!;h``l4Na-%8N)uIdvaj;?f?Y6x;la6{Kr zBu?EWKpE1oGulXGzZ&FNe=gm)b&%PSO0h}ug52}tA#UZY&2Zs1XbAiD!RiD|o0;;f zx~v{J)9xEJGFxKd{^yIwru_OYFPp6Dj0C%qV#to8FL)xlrQbh4^xzSpW_ZrK{lRVH z7bc?2JO1dN{Pua3y^(ZT`?>R1JiOgO705HDnvfl{w9F@B9y+kzE_-F)!Vc9z9t}37 zo7R5i?1o>Fv+u&&Igjx3q+Ujg=^v5nu03nG03tzTwWn2am-t_-K7t|U4|^QhmQrf~dQ0lY0iUoKu*)9-M}EQLRr9)^60JNqk6{faxC z_wm$ogmOXGFmSyfpSb<;V9#TL__v7Xhu+5(oLv-wFW)0+w01Sx%AV_ZeT{U}3gBif zuI_P2DlOiWIuaf7lG--!oa21t6T|$Kx2VdiIxk#Y8C*pIHP?*iGi}bd%hq}Q%KjGX zO<(m$5(D|?_p-JZfXivj$3WvyACUmy>h|qRc0r94&bTkFjQt6ag0h92oc3YqO{< zr33M+Iurkt`>Q)1{?Wr_y?G+>T3cG^V#Q;y^zv9v>|T8}>yx|Vw$GEv4Ua44O(I?H zmnm;okA7bKsuIiCE-+m5X3C?6t&1{pkf-X;&hOV>O^)|oGgkd^5PltGbc>M`QRW-J zCsCW~RDJnu=BB}`oS0PuAUcWADbvXdLgf5~^i{;4Wf_o_Zlqp6>0f$T;iS76#sQ zd#dXR1YgDWA@E|1^iO6~>v?lKu-q<>Az?kOg!0aOsez_od-S&OU>nO|+Mn6#UaenG z-|zJ~y_IX$%xRES!?=oPAIsD%3w&w6xoGirpN3t5|Myf-VT_#Ct7O*R=c~2@nM4ea6e`9Gv6f}8gG4@Sg4TI=UtUU3NLFlGsnw*=g(SWqB7Rf z3{&&$-+uSP$xQeV8!HSPYiiY%Z&f@DOHEh_Vum1*X6(jG zNR!f4kIdG*SrhRT(>lqIIn4U4q;V|FOk`qHnbEJk#SPH>Qc~#K(8Qx7Gkr(Luw0KNkMGtr@v-;-fG<)?_SX84CO?e#D&?% z`4~x1I&5dVE&GKHs9459pX#FhAy6`@c?OHiSjtPuI*5sOp8 z%LlhRwxI?mKkU`P!$=(>4$^pGRm${rfgGr|{k^EWYl z>5i$|9EEN6y_;Ql^%a*b7XIo!pM!r5x?`IXnvAw%%9}yvnD{l9#tPG|3-ojiF zlOMlXdz$6Fr11Cc9)(1X=|A$?A1AgPcS;cjKAe!>t@ujcyqJ8`<PI|R%wLLA~t<)S?eqrzi=fM|u-P##Lo%}L^g(Y@BnKtq>TS`CP|82O-*4p96i_p91xP45O*LZ56bnwDAa!hDn{Tt4T8B29_ zA|3MfHwGY&N-mK=d38CwiSqrg3q8wK23>uRAH!}ro;(x1+K-_bcB7;B8#O%JO(G}_ zZOhvbaXatb>@&B|OFqN*|C~){J58oEE!-&uzKTjuV>*)kqNeF3;^OO{2(I7dt*BXb z*OLu-B4k25gdeQ{QF?)b^7U82R9# z0Qc#SpqQmM0G1pg7cDVe#nQ?SkqN|f$6QL zn&KvXUz*b$$a5ub7T|rgZp%e2a339OCSyq69tc=VVY~to|Agb#L@P=u{uC116wkuj zwHm(g#rblA8-lhN;`6-Jc-d3iU9aJ!q=T= z&tm!!5aoXfCy#38U6#s5bTp3V~qQk@$Hv?B84NDT+8moKM#IXBZG40wLf*0egDvpPClG zYqiR`*IV}^xV*4AlE6TeX)73;y^@s>jO5L|m8*tm}p!kZ~WE-qodg1W~3 z0ey_3CJ+9TGlGk40t*6gEy+SY$r`kR`_5t{R0mp?1*TyG&^{~d zfoD;#VCRLt3)O{|5tN}}+gT_kR|dcwWXGS%i>J9sCIF6q#l!TINI?r=n7526GWqU0 znid$;+XH{~(+x_XydMg7(R7Rfp`;Ejod03_;r)aPV#Tu5BlP@D8IVRm_CaJggsW-; zs}?h~$CJO7%s&JUh-?OKG^bvVb~IO|H)1Tdk4Bbqpwvlx%RGY}$Ah6*T+OA5yiE)Z z`wmROVS%@BQ!mL=XWv@#!SO19AR<~{KZ(r~M-`cUd*s7PoKMLCDnPv`K+Qn@*$Yi` zO&m193d+E7aCyJ(E}gMxM8y!NGFQ=vS02Y_C^?!V!IQ@+g7;PGV@kqDZr;LfOZ!nb=&p&+0!Ua$dQLKuSXs|v= z#Kpiagu5dfr|$u#oKVvtDR0UZ5hW*z;G%k5;s z#zkDGP+`MN`f=V|P zdE?UnIL=w?4drw=4we<79el$3rlNa@&>P3d0=qEwU=_;U>7^m+0mB`%| z2XimW1Q%p-#loX^KyL->Ck))qf8EBTtHc#pUTnF2q;(iO32;t~bNu=pJDDtbW=*jT zk_?Ks42A*Vw#3j$FhmuoT`dVSq-H~nw&ic_gqk40O&2wyoeB;Tjg*1DLrhF!k)M22WS!jes2lLHl@@{=fOe1e-^ht{*fgaJ_O5{M)l+y|07~i| z{?zh|Xk{AAmLkX<3IyHw0UcK`1e_-*(&Nc8TmC3GORgRAAX|y- z-Oo?jgj4+~J^iqS%5*~+I|gYk7G3a0A`r!K zcEbLJXl=e4%I7T4?@4Yle!H#iS^Vk4QviSOXz7Y{J}h6z_?EU^m6ApkkU{603-DlK zgN$$M8(dpg`R2xBBOstf%EP23AnSwdDW@G)c#G18rjfP=1QLA_uZnUlRM_HWas{Wk z-)277wl%NL#P`$SCIQoJu$*i4YZ}F&mz-@|+xN<>y|u?A0d;lDvy11{IdPJz&|$HB z9AfjNN5T+VOUu39z(ZWj><7Xu0`tuPvdSm$S3 zRIWMGn8!4ywn8$@$L~kgfoK-lq3SBEIe>?`O;B{-f@G9!rZeo4D_>a-HIzU!ESMP| z%pHg2({!N?VYymu9}fUfQ(Kw>b_&bj$XX|j%7Z)WebAv5pc>R`wEwL5us|$WGn%{B z=G%6>J)Yb{Dd0gwl%a8EI5vHah=#RvO$*lMx$GY0g{V#&&O^YwP1BQ`>}6WTOb1~n z^lG}U!&M*bpUGyh0J_M_*WI%fvIp`qRb$b7?o|$^$7vCj{VAzzV8mLaM84< zd54h!w9g4%;1@3fSUjK6#9gj9&SK8qVujFN*#6(FPrqBN{WX6FZ_jA{RxPan^m?~3 zm^U48b=@^BykyUtEjK^A8qj(>%EX-i+*5Y>orRu-bM-$5_9m|Tjo-+qgGWQ+_)zO7 z&1a~*U3cc{oZE^OCsQ_;TP&ARiPZ|(1VU;eormF@@NxXJ9KV9oWv&IlnSj*E;t33U zM&*tIDjrxd3c!pdKcZylPILe+UB0PhW4wDapz+}NyjZit6r~anT?_k<`EB1cnu&ng zGdH-^obPv__7_Fp_Yua@cva=b@5V=y=iQqxvo$=cQ@?Wp$d(|{AM>h-RV}ES9WI9o z8Ekx0EKmb2A=yD!g+OB_LZprE=zf0h=M!0!)F2;MXkF-v(fD#j?lMBN^AVb^WHY-B z&P?lSJ=;-}*kJ;DF)*q@Z;X<xXW1kqm>_EF!JtE}hU0=x0!%5jF)Yy2lJn<~k)*L6 zofLm!=dC;jHbD9l>p^B7@x#U6>jY!<7iw2+qnIG~A$Z^EU9LZb1dVFiK*PmNZ{g{J zQ)KME9FUJA;@umhu__!Sdt{)UHfUUycIZm96?Dvt1zM`)sm2M=Z#69cL$EBbD%n%^>E~;3>6#5l+s|ok@`aBfT(Olw zSzbCR9FTYAxsWnqLvO3_=qvw<@!E4*5}XiFuoTs$>qye!gSRKT2VGfd7LrY8;4@6n z8DG!0T#iS$7ayr?Uc3qI!juDb1AD+8BlwxZR~aY6TZwPlo3#Q#rY1cl_JthBm0kxn zKYsX9IS}(a_az-*ZEKz&N*VjNvK~x_^>4i-Wwv8n_^Iy)`N(kkYUoxHU-3XR5GKo7oe``Ok z6@F&@mSxSPmxyBcMsS``(~o`^;@voFrVcTO4^@roKqXV`)Zses_QIXFi)BNZd`A-N zZdjn(PCu0nN^VaqGJ4{EX0mCGCIL~s{}Z$RGFy1RKLdr!ZKWnMsMJm{Ez9mV9f%4_ z7_&ayXt(eB2oF+{u`-Y!N%_f!5cI0>5@x;6^ZSxm9Go&}kgWl&mOlM(Blu3zs8iDD zT%ot%#*amWSh@S%HKl`aOi)3qQK~_QMqAVZtAfABtflTJe5bh^!L>R~I@T`9%k0H! z$QrRqk9+z1vLIQ8Ju&)&rsf&vWg+$-o2PGwb}O@RFhF%`>P<`^r#4#$Y(&1ae&)A! z=5`K1f@Fm=HvCdIGK-wY`{+#WPjJj|!@DdGVunNrK$fiWZK0hk-b7+hmsFiVLn|X5 z?l@5J{0j1Dz3bF@yl9kTtC4HJ@RkAP=VW$JLO}(Ga98BQTJ7X``CUt?w3EKU6bcoP zY@9m~XZmgt^udB_6yg?At(090?tCZkBS^Nmn6LIk=WEfhao3ckPRgN+4(>R$OdHUz zSwH;AF51j%XD)$wt2P}385~wRk19yKfw9=~CInfeDi&+z~!Ouq{(+Ht#e*Uo)nEsjy48dPd*Nu3+fgM zpEJC(mr7B|3<8lNjc}Cu(;7TLrnAyR*-FDYZK}~g#zRB>Au=YF1?IaLAU@y2I^D4O z^%+7CUG$6qr@U^J^MNA{h)~Jb?u)hZq@EhUgu<=NDM6)vh4yHmH67J69cwubC}@dK zj8Q0Pq}}iy2FSG(7<#erVLf`VD{ z28)3@u;VSj-}bPFu!Fiy=!i*xsVi*IZfp@3B)V54R!t^1f(4o;n$p=(YPG)!1qB0f zT*=IumKOk>fZl|i47eRE*y(8jf1W1S`)Y<8uRnP?bOUr*nK2dp>#1EsqY^1-iPmv8 zprqNJ{03-AqN1QHJH-POoMSgctK=g!7z+XgDWzxQ==h`@8pE(a!6p{=`{Z;tF+e`_ z+L>L&E>K$xQ2SF4VeK%+EnRQaALz`$J)J*qCaPZF1%cYL!w+2QT?s)o_{erQg;SY^ zV+WvDrejwh&Ia7sbwsgWHj{Cw@?^m{6Lte+I`w&Vdb~Ib4^*R~(*BxZ_s2s}a7W3Y zINd_L^X@i~agR#T>nWpF*I-blV5}JMiY@QqM@B2s<}*d@1SDv48n+f*`8xISEd911 zs9ROu!;o=REN@3z`8z&{udY?Pl4y&v$eT190|V5r&;rfGao6PRiv=!i2cIun>%;&% z0zcI{1~bR!+h+Qp9M%{h%PPd9a<$6hQW;Px~|5kk1wr zN~9z}-G%$sUL>3Ci(FC>1D1{;5TQJI;|sx1f-Ekl$I%}!K}$?9 z7$Cal)@k-3_gt}|$q` z)TD)$V|3>|)`uWaC%HtfD_c8NKX)r_zeg|&KL-mjOJ*5qu%wT;kCUqtKm_dL9V&eP|@ZZ7=P;nv;6V$-W8vb&>tp81%g@8d>*R!z3k~hz`Pk}z*!Vv}d%%2Mt#}_> zdANAFTUY_$EdLqrz|8QA}GYquOuiZ%*UrBDyl4^B*rfwCkFY~R?XSN)6Chz z3Plvv*6x4W3jTk#6<2V#GV^qChq<^o{xcOdM@KKfyiwI)1#Mw4C)CWs&e_w&!FFDGY@Yowa)R+e@aC_CVXNK5l7+c|n#x$`PJnt57X zWBljS1o$8jf&cMpKC?d;9Gq!CHezckFUdM~Thx8Kb89U9_O#%rRySS5xB405c;mK7 z`Jk0ITm7((HkqBBE@^3LZxA%#Y|pEL=zMF~r32W-0}5Y!2RkU5iie)}P+e^Xcq0VL zSVAtQhAMT^lmqEEadb_$KI?k7SI?fG6Q==c#|PM5QVSu({cpPO-i95gfo!?92*8NuCdCxk$6(Q={M@y#o9z80kNr$ zn5jPY*tv~o_m{9Z01`2g<)xsMi+U#pwkQ&?=$A<{v;)9uzXtl9-cUiRg_~!m7?exON-h_p5!|*!B^xpDu&HNTsQxk(92bYmK>V%M6}48_WZS+4OREz=6FHD{$Z zq9*T6IQ}T$A4oJ-_P0+%@0eZxQ2v#vCJ`(9#iyYcUm$XE*PT?sE@z`!=dpBo3jWKm zE+7-tj95)TWx`*~8h{Ac@5E~SHvZM%tBpiG@+KrRP+qy_xLbk5bNO{PW?vfFU+S(O zW7xs$zr{4|oNC+AQh}OEVx+qK${$`}u9K(OG6GxZO> z=-i6`tDI?HBJl-Z4t`=w?lE8w2?ayr*_x<#;|3*L-!*YQK|FDKpwSY3^4~_Qta2q> zGh%!r=4{te1<&{piEl>^zxbxhjSr;o2FgRFkVp8BIZfBeAF`k;x>+UrvRhd-WZ^{v z3JYjq@&+2pXs#8uEzTogMu9v=~@70|k6f!>xpGhJ^2v{94`)x(YDa zY;()C?y#6QfB6ykP4?_FaSo=g3>v`H(|%;;fghGW_Os|~xxqIf>yFIQIHFZAQx(xL zRM}YBDV9ngy(wj2nT;yn_sE{TVQ0*bLB{tBn{U*q`jrBQHb8l`UL7A#RN3v`quNNz zY#=m|VOe@@6D6$c_t`WpTc|@61Tp>&<-Nq*`pB9Db$7X>n@PYXD^Ol1=I#fJCScyl z^$k-4j_-i7p*GT@@>7IEEay}B$u*S6>s*g)AD6q#Qi6nn*ZnsQKs`uLdjlG#>!rJH z$fGuLLeyfcyDUx$6f`a$)sUgCLeEdQYXjN?+UTk!E)vg6rqnNTG&ZZ|tH90^P|DRt z61xdBjv`tdnXlPbQXR43aHmbKA=satxb~&dNx8%7AB5>fX{=i_u9<+b$>k(#I)Rsk z2K?$7(5P$`LZn&bW{DMT^|9__&|Ld48lb6?BSlvCZ3m3WYi8F~L!|F$8R*LkR1oQ- z4yn*i_Vj+Q#SOd~6M!1I&etK12DqHkX_gs$q2WL=-> ze=AO6Yc}|}Ip!6$-ym`@& zkn$zhPrLsBT?H6lppQ8s)e>g5c%4hTI&II~bg)PxuneHY9 zPdRV`3Y3TPA=0c|FxtnQH6aF_=ql5@BnQ87bL^8OUla{IzU~3Q42YChVJY2s75@fB zdInY?Yksj`*h5pd`p#=@lN|6zrfnv2zX%^fB?boyo$3eB$iT9WMubVBspr^7X(W6AH^E&fBE1Jq1xM z;Db9gFCe7&s6AH@s3I3z>Xw$~olR{s#7WhipVH`B%~YBLVl1k;Ph;IA(QLr^4p4+& z=N@yM&8Ysu)K{-8x&{j?X@17OH>0|ONvDU2A98W+sZfxtRnzi@*ha?GLLtVeJzEe+ zcc1Lo8H>DJtsmr20lC(_y=Lg*OIsVrC}E9jWsT8v9vX7VfaHKMjC8C2eK7e}gmR4r zTD9HoZnl6ZL2`wCy^g%qt*^muPs8I zF@QjZk3$zD2UZOPXmiJA&3$X1Ut{DZIiTnz(nxf!C-ZggH0?VjXMrE z26bui<2r!D9iR-Uj%<;L-RBs@XswW>c^7wW6)GeL(P0E%@M?qOw&L0PJFjbTNDd5p zZ{vTe3I;nQD%Z53sRd(o+`92zp7|blBHB``?jyRAPYln`H$R+>RY!Ijsm3yWJy)iu zVs-H4^^joP?WVEny5=hQ^7PN2ky}NPqztdsZ|HiJUr&f(Mc5rwa$gieD7q0=yVs!o ztm{^h#0(^gH$tn7Q+Xx8XaV*Uaw)-*%^H_jtok2?LITmFE0|h!q=|%fp2HghID)vg zF{*H^K++fQ0x>wiGjMBzdJeRz6Ed-~@2)(QT|R`e%rh&ZZQIn7 zJuxV=%9*IiyT+K}rCV0k&(AQU5On(y6a2A_pP<$?-W9ccRJp?rWch6DrY>p z9>&TXa?j&bm+symF(v4YLmQ4P2FU>jE@l-8{SBYk@IbV04W?sVSC6{EqxK3kq^lHb zdW?2OrnV#pN?4#YEG5vSvOgzU>QAa81`3K;rr}19BGG=co0D}tzGe5hvMAOs*X*~j z*@tKbsS>d+Zah05?hgaqPe->*NWr>b_@wki+9>J|5@f&mRT_Ny-MYp zeRMT(0@eki^D-l@7pS7?$OMhAm`!fYWSI_B?(8pry*67;$h{iuILij(bk723z(5&K z%8ePmV(+<8gE1F_mS72(N#iq~KX3Z^tcNx?X;&tQ;p*aI+iP#KhH)ky-6&F);PhuN zxh!SL?~@-_c91to)z{rPvM_ zU-n=kAWk5@sFBv_RGce7lV0!lAF%<}8a0|K?AKP6n?_A~@M-r;%BRrP==$<_D5EamXBfs8cKy8zvqR-Z{2it!v*!}-4k z6n?_+?6Pg#SbGCv8wt*q9LfUvSm7VoK!5~dRh)yDPt-Y1d9mtQvy4 z9WPk+FNftJG_twjd-%A6Kk#VA*cxhOZuA;H{(BUr7x;>CJbKI%9uNkVbN^)Do=)t8 zeL+%GF?@_QaxW%upnU;j)J=qz1}FK8Oanl)oROljpZUeUZ2|VFR$Y#vkcs`CuvXE^ z>KkwlebHkphaBM;2X_cV0di~XhmgeEt;S#if`Sy8^-MY}suDm8JblW1t1}xK3fR0; z2r?xMr))+!s6S6hthR!xW7yuo_j0}J!2gPzl1R3Viq#CTZFMv>5sarhc)=l+A)(w!W9pP!k1 z7z$TN!Q&G5De|iIeBVzi;%+&Z>7k5i{9pzJ_^peahJMyxD}_72R0y+g;b<|+ssF?> znlE*S*LmT{>Q>&_Lu#pA%Y}z$s7}rJ8Ia-0Ixj0h{iU;ISg|x$3AR@k7%ykAj7vb< z8#kxcuFf)t0}wXvqNYR+`O=eGnDk&0b!SfgZ(%v--=CjD`YP-8m5eEXYMVq8Fkz@W zqzksUx85DAK-=IP{h9Lwoe%z?S6)MH)YzM79r`&j7_*@~O}pI6q$c%#S*V6Lh&d$U z7K1bRPtFG=kCm%BeS}zQs+fq}V+?F)Ur0AuEeQJVT_+s=ZV#dMe*89tnx1Xvi0unN zan{}~+!btN#vp}smxGg3fwX%mP2PXyr$Yjpzd^->*(gyGJrOoT;_(QLQSGH1(DEg; zP0Z`c(#mu50gqD;$u-6*qZR1H!)e`ZT|Xh^zm-{api56|{HZ`uDIbAHAN2<~uraq3 z0^x7ZA*p2+p>G$4^1(h+wZVDSQRqnb8BguE3-XbokLHj)_vK5A+SqFpa@r@|!=J<; zzPTM`eEQIF9GwU4OTf*$3YmALNLzd|;?Jr4{_7`3E`;>@E_DB$d)+tLyK0hpcR7X; zm~x)Crp>0x)tq5Oj)qSB)PNa5WTBOG?2@D9w~|C@l*0R@Ety~#fOsj8^4&RZv1orpu`?2>Ye@84 zGdsg6pcFebHrYO=OBFw1!9Cc*1Ncb$NmKj1J6Cdl9&<&I6`Ow)BL#cuM?-?mq5AI? zf5+!Hww&|vo1Nw>KX!-hdz+GsDI+Vle7$m1;@Td=@2IYxNx26zUOg?JMI+K12mF9z z4_|I3v?>EixzpBhiD~yyr<^nw3O??4Ib`6_RCFgj!fx+4pXjGvb?YWxem@BQ&qdjF z7~v~pxol5J-e&3t)cp(JHsmfbsYo{-zeZ~1@az0X$kgN$5S7x2k3YtIXEf1k4x|Q` z>9yR=++{*TnbKtGM7;at)nyn9aewrweooo|RZ{1p+%tvJ;m+qs&scI&T9$XId*5tsZ25Zwo`b zY~(_QT)yCwYo2;Fq@FgXBye&qt2lEp7xlC=je{B}_(Ugri?_!l*gh6^Jy2pll?jHC z+r4tTorL=?UbzksS{M%zT$WtbjbOj}A+A_LWaQeHP5U0RTSrIQIcXJ9WTq%KKr2uc0~2)%Tb3?{*hYAb-~PJmQOL|s<+ zqdzDCD#3i@T>ZRb-@SJvUb1A*7g8Y}kxFIg<1KJ^e*(td0F1 z%81Fpg%#Kr;7sA>V$^lcLLLnK+BW=ZM!$xCJ$3hWn?oP~OY7%`39$hl5ze;mc6SU@ zz(G|)&oRO`4z@zLV{adX7K|jZ*+=)k5H2tBX*<~aJ$emUnKC`ivPokPt^lE;Ckyc# zE&giLI`6yG>4^BSXK#rnLt+h12M*j}8~v6y;FA3Dubi}Tb^z%Vqcu=H7b(bHD)UM# zPCVViY?}`&@c607Tk5&HS{grUkzOrMVJ<8h=d)Imug$8S)GnKLZ=-T9r*;{7#mV^; z^93oX7gAfw?-F|M@$0$pIFd0O-fX~njP(tX#Vvh%AiAFc_ne8*VTHEiwDbntCK|*{cSd{~3nqr7Z>&$3OqG?cKWBKU*?90n zlj*>{QMjJeZUE{|Vz$z8kw$*@Oe!o6LoDjI&-UpB?)i>W5Alo6oqULmX0l(U0vRgu z^0Q(Ki3VOzyBa(A-J_pXe;{A%+r#zeV6ssN_ezQO}|Ty{3N$uIpNQot{) zil*o|GtLn_*4H#s?W}vyOOAeyVT@9LgyS_`3_8{Pm67#r{*FW8N4bFNmtsoy7B$Lc zT|_6{@zFhj_$l6hOW(h@h7>L?GrSo$r$J`@S%(tL72wNc6o@@TJkep;w`VDG{lkfb!>{o!<#}C!Q{mX1zzU zMmwbZtBhA}xU!Ku!r4n*xz4M>^RK&d1(cyZE#O}n|NQNIr%#*5ob5EfjO@!dz}=*R z5+uK;RoImGq?bhSo#RDLRY;T^$(A=>jcs4K1n7OO=I!C_Dd;u{W}Dp1*+pF~oOdUB z7D?ysUn4aRNNoNp+WHwiv=ijPZ>puyn!!8X)nYh;%={Q&tSmhSS}YJRkMMljE_X=2 zzjM9esdSGjLnt>Z)>)0=<&RX&bU{6fRSWbF+k$12`MmBA6LVL-bYN-dfZpq<>qofd zKGFGZ<{Z#dYZXSn2@lNIOf~&VcKa1 ztKZG*z@;+Eqc%8)I6Z0)TI!VYm2-97{KyASjx(+TJuBYmbMwo{PUFf840VcAf~i-( zUa}YhCnro3dYO2V-DwymFuyhH+>tHG=}Y%1>;%vDg?AUdU*xZu->@iLNS1XcMn-Zl z_8Ze=e~d`QY38~0`75e9kNLe>TB%ll$VUY{Qm18kqF>N0y>u>su)KP0I`En!_BHxg z+?MpUQyIw-2kG22EuWI^T&sbpw%=A!ITks_{lhd(rOT2U*a|P`w%-civcBGQTV}Fl zS+dM0%F7q_?Iznpsej5dKl+jVEwM{KP9hv0y#zpBa7=sf9y9YIU!KY~rc-73iB{b+ zZQ9e?8!y(MR3B~pQ6J`;UM$7ISvGP?0X%sgjrh=`|62FiW{#id?5WPzELhynj^IiW zF`oatIpBQfbVO`$i_F*gSW=nehDP7sjZd(gXAD&=8=r~Cf-0{70-r$c^Vo>K_*3Tf z&%%n_U-k6VY-*iVFGosT?kfYMJB3ct^)XxHzO@~t~YT7ynO@6&-rrD3V$IUJCTjITfV@Ooi?Gs z+KtPOA#FE$JM8XUOFdZbQ;s3gZZ8RpV(IZY zQL_ADFsm~xkc0LN78&9nb+Reqo=?-0^5Z|BTI^-tS~=e5j}R-5^pdQ{=ecjV!*8+! zJ)-lyB#@owsfe#Q=T)V4XoiF@`nV3J^+%}c?)#G;(lV@?+=xpff zz(7;gcry$)mH$f5=R_+wBBEz~#VcHWRkuz{9#lKu?xkf1cZ2@{^~?N2DW8xQKkmF+-R!xN{b z#(m4h1*%U8Lu=+bDCq(>SK~Sl`wXqjylsy>x_^NIKA$NtDC)`Im|gfSBUnC4fu8w~GPzIV>x zIJouVsaBPNeJ9JKq@g*|R4v@Oj0(t?1y2cQyLZ}AtGu)}v#CSO$_?UZ@sD*GzZFVa z1@)*vzTt+I%UZP}d0l{9pS-m~jwc}zp@my>gR_3hx%$k-%te#JbJGH_g6}X;Z=wbS zo_aeqKX{-#gtyU5Fm^IHrC-qyf;D*akE+!ESy&<$7{;|=qDU{zN{~;(L`_8bq*gHI zRe*S}2-|_NvIQ(O(J)fiIA5-xt5Xr)PT|4v`!3h1ul=}%JvH8I=xlohyg1{m6g#M; z^9Pqf^{_G4mX%t+Ma~~`@nkYsstIWb&ZnC@&;oCmLqo#{2S7D1!8Y(26Dvwr{CY$~Ufozgi@^-NXwEH&hDUj~3 zqUzQ-W1m->cB=Rf9tG%TeqZWw5C%jqfBZg7_&Gi|BW41+L>e<2CEbaQ7E^Si3X+yK zX&N79p5=hzk5QX^`KIftGr_;c1|4c^DAJ>Ur{h_{Dh%>I#gRX5jy0hvfpRLAR)|K4o$~vqjBP~#d zz=ab4;O5scOb5!Nv-cIX(%zmtsTW@@nf&?Fg{c$Fx1eh_Xa7g5h;JiddBG8(=YPZbX?l&60;OAe`gN_3VD9wps4?=UendPR<^LGyq(rN%S4U zr|HP35IW9V3jyi#m%z(oK_v`Ni`)wW9fV6q%~GcJ-l+HOkguU%x)e|2IzW*)`0V9F z0pO-61jc-L0Pa9@9s~Nrj#g$LdTeapTaCqwaZyzpJepm%huYOD+C)9rbbNaSi?jP! zqK8*y{sq}hY{kz$XcX59TnMDQg~h!*Zy`j%&TO51+e26nr~5%M2`a()3zLwEskj@* zL>Qc99b=(;F2;pTg!FPeHb)S4B<$b%?|Sj`DRtKtbmn8pBx&CrRshUD984Ga^aa|- zOD}Rd!P+k7pRJ*3c$Stt%1w) zhQz|Rb0mWJNifp{{4i2ddCn&WB=G8!(xr#*jd{`kDQw&m-PkDTeSfSydFv9I(Ek0CSxs36PU7z%MrwUbr+%>XCk* z{D*gtV&f2CLaJc-9P~8A0soJuCO(TM4Ee9GUVflL0stAd<;)Td^*JnBi2*6%S zTd2!kGUz+i{xAIznH|B&qgb&I1oX=X@Kmu!iG&VxF)E)r*`O@02V=03r$!5%Pk2A1Yk0! z%VypU-l@MR=!^a6^gmaAq?VZ}=s+2&K411+D=@z4*d|FkkeAY-$An4c{9_lsr{&lS z6&;`H2&|LMVMCOe$T(DJ1={3TelF=;qu2pKx-+Q^RoqJbD)g<`a?~CE_){_k`Nv|e zQL7UnCQ+jTO?Zkm5SV(>B#M_w3s@WdHTJ^G#PRiyg@0FqctXh|pITq}Xv5(P=m=?* zr@1^7z3K7wTftY2KdG8pLeyRq2cYnjIte@9zshvUR;U0p<19=U&1hQXYxBHtg^)j? zT&497B#&OPy2#>ryL;D5mVVmsHXpkp4efnvcCVzR5c<1{;NGTyW)Tg1TWa?!*uCr?QO;p3n=plIAv= zu5*$nQ*9N8!U(fsGmN<&GoUm5Nwey1YUB#+1}I>Z<8W~rv#JzamF4&Nm67F8``x$)lZs1L5Oo2RW@Gu~H1S+&HWsDfH zc^@fSSiLAjb`LvWYQBlWz}<<{HT!obwlFqV>kD?m;v~-qK|OJf2j__T5vUUz$5(D@ z2WZ$ie?@A{zYTg5HutX+@d~ z7jT}B$-|Wjg8-7%kPYGNviIfK!XrXIZ6x!{uDL8X{k6%=`tC?>RPRHJ`}P)rPPjH- zXFe(M(sWAx-1ani{D(*$>(FQ(AZ29*gW*lO6Icd5k=vx*7qt*2vgk=p@&s_Js3UP# zu)w#U;C-HceRoy(mT6|m*Lv8P`1HeJq>I2PUhz+sOkkagatE zf*O+~c{Rz2+;Yu7zb91#vhNfaN^UxkQ=?cqG1o}0BO{%CRcx>?XQNP90gZ?+8YfS@ zj;{Oh@*TwE&wRN584tp2wW3h9q8j|BlN94RH%~3&-wb&)j$_N!jt+A^>dS{vCoUCm zY{0=@Pf*q$sI-hm)e33w=g4A@8~<(!0&9HUjAxjjaZiOw7>4&F(|b=XYw9WB-e*)$ zS7+j>nG*U&6fV`4UW7mqtkpI>!Qif3%Q*OW0L|SG_HTGuDZYd_0iAckRtN(#CKdC$ zJN8!OS!29x-dz>AfZ)u5qaW)&$~UV(yy3r{U_|x?;C8Z#t4gfV&i1TWJh)~(M`>5e zBlI9cFH1H{6Wx6kvP%#XJoB5kFi2s@F(b8#6X^V>lhs?BL#(_Hu4;lwf@8D^T0j)3 zVxGHGFdnzi1kxCUotq7og3)Q_89QOL41?<_Qs<79{bqNHA!`mclM)|3!;GCm!Erg) zmCK{2L5G@4!foZsQs~%0Bm0HYE2uxet{a8vCiH!z=i`t{>qw3v<+PeWp=88Z7Ipkn z_2U;1w&%df;&#+-)*VGY`4~rX)i$NH$YlwqGa7$}gK zCmur6--;m#fiyl^3dxSDEh(f8I3)497G?`XZmsRZa_lAPr zx9J5+Oq09PY{jjOVEdJuH7eoF&$Sc{0Y!^V~M8PjRe}arBu@T(uW5M_j1l zbTA-B>b5P6S!{Wd`VNMkBA!65G(2rPX)KVJ?;)1FbU(qROZi@Y(Yy)lM261ZPCDhQ za<+64!waGSow%s%@O(YjyGpi|fj$e3URj%mnqr3FsL=BPL;&MB0&A z zUqmHafaMMQ;1^^f5DMP%7ILVKqut)wRcIk9S&ClvW?;uiWKolQKLk5$k%5vI(n9ni zl^PT5?>mGUaJrCTW@eVWOyxzpVWLof;@vV+j^5@V7?4Ram0prO5S-16eqp*IP^1G^ z8$bSP{K6)h0rK$$C5abu%#tu7;B@(COz6RD)}|?$Nq`3;Mhh3uV)6BVNp=;IF~{Ne z(IO`?n)^e1sOPQx24j#S@XY7!KPmpX;#PsXTv}0yyfNHZOxVO=$E?!r$>4`jOqSha zBUeFYe?*dpiYih?;7#e4(h9&-3x=LxbCY+}s9Jtf;sr1UvYT0`LUH~0>OnbfqzVwu zJFvd5+yF5cuKBH{I#WA|a2D*9K(#?P+mgdXiH&eRWi*5k(TR7nlAV7qsTF@Qp-)IW zA6~v_MZu;dvm)(m0?Jp^~u#Ga*#V?jfRBG<4{K)U7k%7(~6&MThL0louf$cALD|%J~y&F)Sg6ghDl`OwXe_o z7Kmv+nfH-IR&Je5WjD`&)H%(HH82J~5WP4`PHK~PgYy~33dckibVE<$4*xC95H`DS zxT&@#yS&4&2^)#?h&VRC`wjM{LwIdddSW!o#?c#?@1Tkg0DKu0Rrm{RmrUy{G@iiG ztgMQ(cV#u!EdQN`!VqyBY6sy+L6zG3Zq&~+!71r=8(gU4`vKiSPL*4u-8|}b^`cM} zUB|xv{1fmTQggM_D^6<1Kly#LzVDP4LcB_gxHQU29t|^RYn6r>-Lm=xK zR101M?C6--x;F&q6-d%&{yP}1#MgM>UU6&EML80cKNy2cE2_Z^Mk0^_`V0wH{L01} zNGyHcVh_Zf1AWlsZ@c10+|}mrT@|;m=Bvu!`B`F#<7=s1-(C3mdx$KD0OvQ6N&V_w z=+&N7I72@ecFLKtGX@Z$jY;rP`;69;A1&Bq59CbSkf+oALhb^bY^(a2z23U|FU{Rd z4xL@4=1znSgFba~-Low)P+LL)p5=c-C#g5+=(LhA;&x0~_J@-ZhQ*2fvu7U}xY57De9`x($ z@NsmAk>QwUS6RZwbB-WY2~s|Li= zj-|pHYsQrM0@6uQPR$n4C?8Ww0r75KF*W*FN)v4?jvXHe2ChIrInSm@je#~apSA^b zVjq)@-fXxexnfsb8xeAvU20eWN4-wDeGyoGTpI(!2WlRZR&)AgiOlSgx(H#C*L#t3V5%FaCoKPBIy{jn|H# z>e{j{(&m1k4Y5bM$)tB5c&aWQVgpbm{hUqAQR1hWF9n)p{xhb0(}SJa6(`B92GAUG^ty3p@AE^lNhN1VzzY=4-`y6NU#>b zbO)n@-9wX9Hw1k>48u?t!}ouk7lObsUe1zg12F-m9P}FipY9R{h41FQDl*Ux zo6u|C8H27M0O&9li$5QYx>~aLHW_p_x(9O`|J>r5`~wX_mG@`3437S0p*M!Cth0Z-)~ z5vzjE4GJ#;E*vIAhOl9dpeJErtK*Qh62NUrvSBqpAgPgBVlw~1lF^BmDpw~=LpyWX zex2abtO!wrAbcBv21$s@ntn=&@dg8gFVhQ>e458l1T_s0GUh-S_|GpxY3bWH68m1h z3!NUP*aZX>yl@(Wq!HA-*!Z zfXZ8VW^XWM6#Qb&pV8V*v_T2N(e0$e*(}}HLcG7hSrocWb>>$b#k64+?n~#)E=bxB zNqz8?QiK!m>cj5`n>wpIc~!MAP{abp@!q?cRqd*0!U|zlqdWF<7{v)II1XF4#YYY| zshtTVMt%olpU7j^f8a?WTmhvP2GuaS?d=r)7VYyA?xwGlk9!507T|(f2-KjO>h=s| zPx=(hK##+%ijov=mkzFeq`E~!-+4gcT9$M!th2(`-S}ftQ~nAQNl(|~9&(ebF0C6N z8t&p-?Pl>+tf0j9nNeoP=fgb30AkVh4BV8x!xwqV3h3aNG) z!R$dhAu#0#{=e`ZJoTDvNb_BDuCcS!Z>uI0PluIJ6FY$onQA?p`2#W1CF%kLOx1^8 z7*6!FH3~o2AqE-h>oPob!>I;Cm@qieqz<`@T z0sQ0FiJpY&{AFHee(&QAUOMV-5|>1#t}tU1sh?6CwAqYJznP~d>Gjq4D8>9?1sc;{ zPB|sK1n{jTtibSS9zOIVZ3vhlQf>M8rfJ>MW3n|77x(QGKJ=jd>9^i~Zgm?205^&d zLw7nADjfi%-;ZH<9w%RfBskMRqmrGZG)wqtkdMZar=0$+`aqJK$W@9*oG7i$(=* za$#}`slBqVr^BBb7GOUE&Yo2GmG5_`7r{IwFs%ouPZ2v<+_FqH@~Qp%(YF>x&|8ya zv@N+2wfZQzT!j(OqmEeaZ)5+>ci#7G->Wp*o6(pND(sp4Q^5G!Y<#04j{E8YP#x{6 zh&HWxdFT9^z)21S7hnhU$`b7-tLm4!)XYNxhk(>FI784HQ9;%Hv1;=Pb_`_U(7 zz5C6!{_ZCB;@cfV{cKJc>H5(^Ly$mqJi|UzBTk3NFFx?x`I9}z7G2|eHs%RRvLa~bj#OsHk0FJ zc2?3nBaUh00L3zV0B;&FD;~73gkirbPe~@n{cs328dPA}`|P@+;Kg-v-O_!f-xAOJ)*uB~(KTegau3b^neE;Ub0qBybUidZ! zLv37$TGd{a26s7-=M*-vpP8)w)z?m|FE--0nQEASj`GxqzO1)0P1w69c9TaR1Ck%| zum`z0u4e*y)T%Qj9*NTdNruOcl0hnfQb^?Ixqb2yQjs~n%|sP%eEc*7Qj;7<0|zyE2`Bc-^G)eqb{sPwx_2n^5t@Gv$0tDmDRO-X$qPN-SVZ=^`}+x~O{ z32T$hNqrxSt{`AzGBZbyW!09nO_x0^AO-{SdggruYB1H#A@0suCNhNxBI3ZwK*T;> z5*!n%BSJmqLi;!4uF?fiYz5dUIw<{md==4BGm}nlVF4QR85J0PKnF?caWZvlW`MDc zDDHqZV4N0H1RrA1krUOD8uqU!+b9N(RVR*ZTUa-phTJip%c;MHV zPJIdd815IcG!z%hg5w?}CehRjXubQy8FD#3%={84hP|Svtt(FqKM^C(P@EPhWP3&L z<7FFFxlcIv!Vl*+VbS_Yntn*jM;d8M?dYjx10!l$lmQ^Oto=%OS9*_{^uo{ULTohP zMaT`&D`1yrif4Cq(go!x=^ph%79L@Yk+@u%9kvX*LW@kX9f@|#>+v-D&M|&lNxIgs(;Ic+gZ@wJ*%DK$Nw?dqQ z2KR|QU)6l*8GJk~FFgx9b_I@63perDG^kaw&==@`9GiiF=1ZIj#D(_Y-w`-NR7N|) zXuz}1_4|xYXjF9U&l?#1UK9c0KU&RQp{LG%vF32e7c;@@mL|H-%@TmCm6*ezQ649LXVpNxE zQ6{`-8bG6;d;L=Hta&V9FL<;*_EA9=8?gGm`Z@J@u2%V@DJR+&@0Kwx;xbAD#*sq;UE>_+`P$C=b{Pv`*q@~?xisGYgaG=7Ey#oNpr zQ{USAm_E-pWs5$U$oaNW6L!k5`tfOuNNEgE-FHPBk(Z7i6~na}5Pcck8{>ON2D16G zU*1dDg8_}t$9V+=Ky3vWb3N-eT6D40Hjb~wSy|t%{lc}#JqvI?&Vh1g0AlAut_@}v z5?}*jc1P8atOPMI@Z|=D!KAafu(;N+e_OB4C!{uNk!!r#MuEjY?wLWE1n?*M!^b(H zseq|-x1T~9HI6%5l+;0lef!n4_kKAVYLa!C77a|%Qj?%xOwUb;DaF(U`v)seqj6}8 zBQZ)kTH_8K4Ct1|LH9%AAPm`{KLD6V*L6a@#5)-G45Gm2q(W$dMk$x%=Ps;R=0`Bo zKkSf;1HiCcCnDtHP`JO63TwNNZj2Sx;y0rtgMhD_^CG9y}b zM0R3=d^G{4&OU=T{fYKC%;o?vw%3WU_cC#&@Ix?e;`UKqV9Lny1#)x1hfa=!U@-;= zHH;LqnvYc*d|cZT;J>winb?4CbNJJ8q)rx7z&TzeDR2|&RxjojH8I`)ngt!y!>Ll= z0TnvS$dSNDf8LHme1P%u1u01aI*2tV-!xDflo91fXR$yvKeRRk+2)zsYQ;1^aWYuW z_Cr#b>6#JMmuYcd-+qL^07X6cc!36hPdYADofJOt0h*?BG8`F_sXqY%Th^!)fuJj8 zb8TQiGOL5k2NfLcx{K#QQ{$!&r$&gCmm@XLp@0C&RWrBSW~}wd4M1@>U3DuDec0+} zh6ysHD1HhA?K20#A%uW59FUIdWtkX+2!adE5FxWT;b0~Y8VY9!{-0fj{>a`t#V)Rt zlHjm*b$JVf&$)zD^*M<{W?Rmb)$-o7wFeop63UeWY=xE>8{)rXTsw%t_qJ;&WMXjg zHNz~!aN$>l*1kaCex|k|8@%687jkKLq97cA*85s!+Hfjd(|4Ie=x-$gqb63g-msvR zTp7_SPL!AqY3)5OEXWRDWGTSuK#5=gF533aZOAPEESn2zDaN6I!a({%(@_cgeXU~; zsXf8Lz#AC(1Ft%v7pPc)WfcD*A8|f0jhgrg18wa)R~ZXm??>%GM8(w@ktspx1$_Br zGd9Tfkea`PC_~xSfRME@F;v3@1TQZ}vCrWI>3i{^rKpXoj7_K4ETFCg@#Y!Fm>u{I z%fqFAo(66o7K~$g=IhUk5`5t@tG?b*5 zQ0XxG3?h#+!@KB-yDVr-N$R0xk6@7}O5*#(&|l2sLQ33wxns`-LG;OLmLu^I!4<(? zhYF_bm#XR+`gIkENitaVufw281pLx=(HpDqGsGko2gUz_oNf>!@eM~Lc;ZB2w)d*h z5JcQg4?gtjKe1`14Z#n?kt^*`f1fn?Uo*b3hy))zn_$BP#a1;YthL}B#S1tDs;|{R zc(cUA|4Q*qMzAhm*ub^0+b3IZ0Kh&I%!1VZWA<;aQ*%xQc&Yk4+Ia!m{h(oO&rGdb z^X@7p7$k{ps3fIBI^O9Q=ATXn^&GPQ6-AOw6~O<}3hpJABAlJ|hyEvpa{(F5{P{Yg zgOr0A#R`hCW!)H68`BiqiToBrYIux33IWwHB&(+X3U&~ff3=kCB=ZOGzekw&`gUoY z#CtgR-u5mEd^r!z#6TzNAg1&0u~IGbq0cN$u4k(*L)#Lg!n&~#LppZ#EMT@@df|o~ zWg6fU5}^ihc;U%gBZ6W_C|3S-aw>1yK~-V`UKpgA8#B}tFNfT_K!v-hVa4dv&w++F zib2R#7!sWXXzLBHz}q>sCr6M9+WVqV1&smGNrKGfq9`1D5XqKUY6!tL=%-k8us+wD~_J2?6Al#DW)`LpsHH@9@4 z#_pN;cgD^?b8C_G(s7mfUn!<$H!!Uq_hm}PD&HLQo5g|cB{M`kVhlW-ak|ComsnS& zYr-m8K$U{ya|2@h5kWPP*r?@z7*d5_pu@)rXp3SLSvT&&k!JVj;qoUNDf#;`B3k?= z1=X?k^uK=mJRPXseVfwM4tzEshTblBE#|FzJn2$qAw{P23X`l7j-JV|*0SW$-mt&e zs2I8o8e_pvK&wcXP<^+HKI6oh#L6RI$Dz_G@EM1DxtCSHa$L0*(%I%q3#V*x)7!i2 z-{VW9?>Wzl%y4y)K%IMKPxDdN$Sb$Ml&#o%U#rM;_9yF&qgS(hImbzF4gF*OanDAmZyP!d;bGbHj+nB2|ykVIk$y-S9k*O~6R-!wMMf+kJb(?Xz z&Fh!6vr83GavAdP06$MS`D$ih7tpeNn43eFC=%zC97&(m`fV#t!sn%&5?ug=qrRMr zx-IS7o?m*6P{HFywRC8hH;>off$$q^;3$>gF zOS2N(1SF1-lHBenTi#E(d*6+xYKg9JB_ z>q^Hg4emijxSOmSaACttx=c*x;5wzqk9C7r$LP1gJxs|UMRmo2wiJ^#-$eoUVnu)(@jEw|7(M9FU3st!QB{Bdff`zQhh;5tIloETUU@k}+^G*ESa_B3Q9v zy;w%>iPgQNt)Zm=y9pMtO}#qa^KzzohJrpbQYFoBGlX^RqP;C8^PdPBWyEH~!dUk& z>f2HzBY3tHo|}!ZXG2^%WqS(hXnqG?_gQS;!@a|#Q3 zHqZ3hYy3cE-M9w9!319?UTm2XO>c-k>;s+wh5n`Hn1;$SUrL{oU>{4ckFY!Cpa+FM z76rZx6{RRnK~)T?5`VXZ8kWxr{U+X@)LL-9eVvnTAo-AY2#hL%x%!CI70PS?epc*R zu*Xs;bOrzfaHV}_NrXHN3Uz&2*6?guVGOyS?P@8Tb&5}p)OL*%%{gHSjREkbgMp{K zXwCsW%I^mm_{>%bfUS&L^^o}qN5N1~nGBT28buEWq`>#GGI-HJWBimZ0qOY6TwZkj zDn-Nrjo@QhV7zu7?r@zL1+~iQlvQdSb|~#j42TlCsi@~iDGDsXmK95{qI>fpR{Sji zq7)F9iMP6c7c2g{fbtvM3|2+FX!=u^AqY4cVG?$Fa5X*fD`hi+`==Z&w3vS7?%{7S z@QEs+MV4TSE(7qMjWP|?8xZW0h4cYHsQ`R_?5Z$2)ggp}61a7z#qw!-(OpQX@k3f!Zmm(>c zKe2mr$p6PfiZbAvh~yVn!DkHr|IZQ1$twNtV}$ptK6$;DW^7)Q_(R1MFwj;Lb1U}@ zF~H@A=eNkB_sDZU58{z@AiO)0=; zsq-NJb>vogKFxN!M@$B%~h9{C{hUYWIV zcBt0+-1u5I-{~g_-Hv5wPgADEtGMO%&yQ_R>nE1~TvuVr+k>UPPMrBeYtNO%lUJzG!Xvp z#ZdU4XK(-iiy?+&h6T44PTxe3Nc!!oB**(=_ZvogT+>bdX6=i%FY_Di4m-1s5e{$v z{TT?`5$D0TSu%Vwo>YqzF8D#q32V>G`OV*#Mdcl-VTHdQRL*!Qy>)W+x3Yc7>NUGX z&8=0DKV?7fc@=TGHshPaqoz9#=mU%DPj)|g7`HzKtmYJk7QT3a(q6A9c*|(hym`!Q z{pN5A&E8q1b2R(!|H#FRcAWiFHF$53$l0A*JiYFaw%w=bE_I8e*xNhn6^xC`p$^5>L zWk=Gv|Na{-zn}aME{lhm$}6gfwW`zB47a)VG!}ce2(x#*i(g%;RKNBtg;kKZKG<`h zUUc0y-|MUSl^Dq(Uid(8vF_zp9vDYK<#j|%JCU7gXoM}(}$`!1y?_u z+%;;CT{!0kPx;qcBb%wE^3cLJineSMwC6vV+7&53ms`gjJN?b#t*$4>7s1OzJ`1Np z1T&t0yhPjAQbuAB@|byUJdtETh~?Vgz05RnW5Xr%_oawbM)e%+^6g)PFmg8 z2=Ug`@eb!!v}1H`mX4}^IksFhznPEEqnXCTZT{l`ZZS;eW00?I?p58Az_(s8ysYmn zo~bhZ;#uY!SoxCT%p3&Z88bX#MhgrO$M`WA1or+AR+gUw~92k`5Hb zeLnt$o6bttL3Nnf^Tu%tM^virL@qzihbkByPB%w+uldUO7-L`zPITxEcj~2vJD1|j z-Rf1{zu*5U#@n(T$1GGyau=a9zoPggFrpi_p_F~hDi?K3Ufp=#eUY%~M6}BF|;dO;w zsxbJSZ-HleXhXfnnG$}+{%59|cM1o86}!BrVoEq2A{bHNAT?Izh&kTynIWf6Ru>a= z;WSI{Z=&Jf?jJ^&FAb4blP?9ttf~tvs9h-2m3ZB%taz=eWbP5qaZkqkI9rG1ck{oC z-v<<}9SLtX;5d3s;rtyoq4T9ib$MQW#&4cHHeYOfAH=R3+kPP>3lGPbR*nZ6Ef}QF zZLYk(&DoXyg|@4gBi&H9-V|mzcU|kjFV*GWTLmfgU8(eAWxKfF0<6voX5Zcfs)+=2 zeP}S^3Q*cSQf4K(a4VF4UU2`Op^Egg!qgvkE31rUet0OiB)?uGU5Jiu@II*|sML}o z*wF#7taJ*z(TQx$4U{p;|Gi6S3++ZeSU4~7zW&tS@_O)d0Veew%%yh@y2umAuH1R? zO%v|42S-0v31%9H-nm&PFkIu1>WMTIw$Wt^JhzeUF2@FsO6X|x9I4o7hL*_`$}f`gBNU86XzoC>rxj^T)8uMZak$%QK7?p#QWN* z`mFcj$74?TxiHbQPdzu5P`zLx$-QKm)bnkiE>>*~e|<63_FGSOb6qu;)s23+)x8b9 ztmA@=S>S&;5|~f;Zey$`=uv6jD}}Ku28}f z$s+uF>4|xg2W+5#=e_5t=PIX{#~DJi%Ky?;otrjzDd#?AI+~vm+t8eMYSo%Ge{0?> z-*|?ey&(BMC&EtKO~LF`?B>RKPo(tv>3PzUoLtD;@axS-iVf(7V)pF&va%YSG4yY@ z!D^P-JEH{_joWW_n{&Kts$U=H4)eUB^GFn- zEvb2bKI5!tV$GwZ_aX~#uUG_jNWIXJ-qjP0{HlnU80MAkvYq=sl)VFREz!Cy9NXHl zy`vS|-mz`lwr$(k$&Sq(+qP{x`E%a;U%hkhJ@?jmtE#Jd&hDPQW`A8>qrWkFd}}N< z1@j}*Cgutx#y4_MrcnqX{8)0>Y{_VzPbEB`>P`~JIBVo^_E`Ibhp1slO+VO6!rrt zFv~^{50#n7stLA^vW{sw zkt^Vs1cjC^aZRhu2#NCC7kS(D$zvGgEH%mF|#Ot+TUHBfcn<&!;0VA*x zsq2T+nB2MjN)0M339wc^a3b4b1A@c}WKlqZIMlQ%%VF7YXo$NN{KP#IdFG$3v%&FbxP~+tG^*-kdIVijPUqKRp;h(&} z{|A)B!ulUD>xI@>%vlTa#?jAv(A2&sP=*euIOww*l43QCo zt+kEIR>8iwKPhDf3;LbqJF))oXrIe^&w33ci||WZJN;Wbcew*M)%1Pz-M{_icgqa> z#@M|KBcLoG2BGJ?+*&`*gsD(XMP-xZ&tjA6nG`?Syt)S*(ReQ_OR7n{_MNCd$FjQZ zdrJKW@7NCMb0(pl$@M5xLvNpIVFQ0&UAJNwYQJB*XF0%OZb?&ApKQJ3Lu5f9Gb3`t zvrZ6gVnC!EU#S?!417q72dTuODE? zRF7{xH>WB?7w-{(B2WI_@l_WLk$e7lBWxrejd*_R?&AyHYC4!8cmD+qM70m!k9=fR zq;DjrCr##}Wo3 z(}04-6P43?1V_V39~B-f1Q9C=j_VLH?)3~!?zg+EY zDLh0Faeb}w#wlp0uW*lnEw;hTs7fNk=gw?2OyD#`f0sMqS*yOGI=W zu$$E9=%I`C$7^ruef^_F(CfZMA@=Gpg8}+4V-{v%oww~u7Z}hq)}xXIP)8XT?K3AY zshLAQz#Nj7S3!|z@`-pf00zT>HHU?goTaxc+;3QCPbT#;G+*l1^$Z&M6aR`Q5sZE7 z4|zh0-t51dPA=!bIMkeoI@eFVlvU3Je7M44y`Umj!NlW-tWhpO>{52bJ+QKFFaaiG zexxnS6Jex&KL?K!{u+j`|v`&XSfshnf_u>MDP zvs|17au2VE^$tukUkYWyO4gV~3Bt-x#nU?MAY^y-B*{KKXOx7MdQ_;>pd+u6%8MsZ zJ4vC2MfAYWtnG6@Yy(mHc~bTX@=|Cr1QhvOENF8qsA~6z)&%=I!xr^P_Uem6%tmoC z^cde4u<*fAQA}M-reh{v9+ab5*FFyzSZ?pkhbVrR$P7(2Mv)Vf>I31r7mE~B)GK)o z7d4rQa1;>q)r8q{4dBD`xUY#H`F^PqHF<_Rsw1!hu)U+fIqT-qLX9oOiD{Mu|EkmU~oh774Bjp7!uCs%H)KV*wmuQ z25;0uSzqD9>e|G39c^VLe?J$A&y$zAbQEp~C=xfGdHKkY8MNkNaq(P&3%cX6KCM4{ z?iB!%0X?t>Iv7i)@2#hTtbl>7wDj2pgPN^-Kh#7EsvnO+ut3@+A0Q*;XQV zdoPh+@RPF%pD1!yQiDy+w64X(EWQ~H^%4*6GqCV@~vSe);^Ou)nm9o*i6e9+Pe_ma;&okspx?nu%4_5o+U$^kdY> ze`9?_0iF9H7%1a#a$!>k`PXWXvei$^A-xg)C5wShUjD+X563s=Zc>>puwFlGviFSm zgHV>6H54J-a<^OkqwZKX7jk0@#oq);gILS;S5QreU2-PXiORsCyy1Os_;4d;eJ32h zge(^rwFSb_Jyj|J%8brLHX9XGL0Z<2Y}>H5=q@Ftdy^rhnIu?KW1;>qeRZBRSm9TsA;I4PMJz8_#vy#&(RHD%1TDu+0=iNP@tH_pdWM z@H?w0vmR%JImK{XTP7i_2@A`WLbSLjH*+fe4ol0m3Xy#RoeM}mctFPwD?wChH&`pf zcpyX=z;BedkKg?Y)A4m4@A@9yIv6mp(}A+*kh!}-T#G%Qk=hcqE_Dwin)QyDGY#D<#@3XSBO_Z_kEiDQS zOR$j5udt3ncb`Zahr}|3?J)?3f+6ooR#hl1NsQ+}bLk8My_jzw>CC<)w`T7~;#t2! z^p0oi2KY0e-JUxlW=(ggVlE7-syvWi9ovtfl^?DK+>!nNoE_N2tg%(!i8gAqm6}OH0Boh+_0cYvYp=D(Wb*pZf@@*xHU)DIx zwjC19qOs8rU>jklNKQ|#)@B3YijNWjHo_CNYB_-8LE^S3ZEYM4uHJMi?Qr{<#{4c4 zJsX=1_ccrT3Ou362X58f$OGITVLUkVww)B~q8%^kz1G|}tObwVZK?r1rnpYw$Wdw> zs@bPRsaFXfCT`1f9NjXkxvM^fR-B)Ysb8Qe+=8+H0!}jjTNzMBMh>=rPJv!z{fgad zLH4_PL4O6EFusw_+Y$2H0BWV3Z6<_lUYjKITvq)2#K<)mX$UzTiYnE_#B{MFjrjel zhFDj2G6hW@^QBj3P&deQR60lCwoUN-a<%ZZm0P0gGlyz-*cy6r!pP%ilCTC121-&= zn(E8vfN%@+9uMkzlL^c27vsBkmFg9>H$>p{?A{X#6ME~r(ia#<%E2Al<_GMLO4Wj9)uSfC4)?NlaM3l4|K6J2`X@5+CWar#tAC0ST z!12=UrRn6=r_=!U%l-AJsL1p$x+H6ObgrV~4N5W>q}ciTO;T4bk z7@wy36Jl3C#?O`)F`+P%8T3WY8rqU8U|Zi&n2Q$^$f0a`i{`%5RUM4$|qVI$ch-0@|h#GQGvUy5DRt z)r3Xt^*W<)oFJu!U78q}kxX55%yt_#WZ4X9Me-PATUi_00w)Yvg3%wkj_1#q>nP?% zw6b=y>q6CUZg2@?zjLmaxV9!yVYWXFHyIDCV{19K8z4207RKh^jjaytX#b8c($DS^ zn7*x;2#rY)CdhGQNbB$M=C6cj^mU*eOK}}sqvhs8s zj+iGj7ir~Jff2#_y$D?=dy(ndWtkUaJgrHObgokceU-! z&bqSdVOkGzi0Lzi1AgcdO)*it?{0Fr^F`hjS*(p_GD@jE^kA{Ij#ceU#oH?uLtIv= zdOBDq}=4&>qcNs|^$$SSkXqR9<%B8escu#yKT^7FVv>PPT!s zsx=(ACO9W)JUMLZhv87SZ#*pCZdAx%VtAoDmYh*D z7OmRL06j9dtwU;d&{VveVzKDu{!bKJDR8WeDApSvo252O z=-8|kRAaUfi^Ox3x4`zvnITl`+1wa<;s+2_{R=vaU`b8PeLsu5>}-F7bTqQaOFU#* zPFiHbX^5^!XeC<~|Lt^83E>BHwqR?ZI%K8cYBn^epJ(Z_U7$ww*|5pv%9~=E3AgB7 z7V%F~xak5?nfTa)V=`L^gUwmb1y1m@CoH%JV=wnrTZl#K6`P2!LI?-C1D!#36wT8k zvgZLKhQf41meWZ~;{j*(&=;&iRA(U|Te2tLPP?g(w-$?Q%{J}wS=@7MYV^3m^pk76V$Xz!uEb#hGLyy~;Y(CjXspR|c z6>aVM$%Ag46JZJFRS>k}oq zGSE-M5_uO7C-S-pTY5!9-WkH}Xe0jlWmtB)_Q$H;R^`tjF}8Qp?V3XTb4gwTlPN?~ zw{S(hVl(VwM5YVzSQGlxWyuz}D)DUC*|TL>)Qyzi#rA3?u(9afPa)gRAX_H1O(rNy z?;=Dl)Thomq2z^9>v!j&?;`bK)y;{2wX{{cbMQNTzAgjN%_|PyVKzO=zA!cqp00e~ zV2jC;5&i{!VrTq!7-U8O+jqq~nE$`Z=QnAo#TC29igbDR^B!{C?mPWe1{DV;{==x9 zFt{^ij#T9L`^Pm|1c|)o{syP%IW%lvlS)Yl6Ty)*!WSHa+!JJ=NuWv!CRfMj1>O6( zj<3z8uNzj^mjnWTcrivu>YE*i1p5Lg14slsee>2gV@cqjLnVj0Nfn4}^nA&?HOq3U z%n^47m0$BKyV1Npu>QQL z>y`aAQNo@_5H!bKLohx?^g)BLdo`)50}4peM%}qD4Xxyc0{`j*_wUg$30tituFuZ7#U+)D4-B79Uc2+o7(C@pN?m^gLD|XMd<?`fUhx+)2NZ^Uln3pz&jmpNvoqUSEm$H1Po|SXz=JD*#irWSia`V)+EqBfM6^ z%;0wScitNKNGl;lzPJy3Y~1>W9}!u|`QJW8xIWXw!;zQ0VY_`UP}oAuHDbheG4ac3 zd*{arv4<#-vr`Nh9UudvdsjPBQA=Kyvb5QyDl%D9SZ7JRe)TI+kt)-mP&S+jto~CTy#dQM0KP+ zQaJ=y5DX-thKeKjycb2{>J41tNC)lc4qP(*&{4a}Co%Cw*WxuZcG5$y{Tuioxz=Nm zC9-?i1I+6&n%~GP8WbC>F{CXNHl_7USVnF5PBrwrH1N|&zk|aN?}x31(mb`V~$;)@7FS<9KiJuG0Yfr#zIRUa;;PnZ>W~oCt)20_L$4a zk2JXlO1h$z%SaTT8Mqpa0eTS=`*ZG;tf8}O+Zic@B3?;%L)NDPX$z2$rD+xD%O4kw z^XV9IURW0VsK(C`1+n`Oyhn~)b|GM>c7v<-C9U<7=RK2D9;5zgu{&7?`HS{T+gY4K z5~DOF`=gykE<7h~8J7*1(jS;3mJ`i`hqxZ$9B$N{+_MQ$$8lXQTt&EOfKlFXp@=e$ zzh6-ZR2cGVf*tD4j+4+ebx$V_k=g1vr49M%l^HIwY#|5DHUSP5(Q8Sjfp-@ED!AIN ze0%QBF{RgC#QoCixAfn?8KFzVN>$peC#Tlojkh8~h`$tw_ z|AmDLq|eq8?7;X#bUI#i_Ie9Y@F-pfZDSE#hw>@A21*6?Z}xLo%cI=j+174Qz@Fbp zyB}&TvtNB@cOS5n&W2OWH|eKBFxHt!>Ib zj`FT_>zE9wQGx6Q)*O)w>g%r9XE@ka?=+}Cta1929Q|9h0H>N3?fs~T*B11#;)7uT z3q+k?rykS>sbuovutTW(Xag8TY6B~qF&|V{3nJ~0uFap_u%l)|n)JI<%`1zM>PXiM zI@s}_HDE+f*UDB-!wM!eBPRjB?c{At5*>8ZRY(n6hLcU#kdKNwm@|6x^|r7y!&-qg zFPxE1M3I%w^(vP4^in}Nx%ml!`)$XI$+jOe5ci-#-6EGSWgxHMAnwwfHQd1SFnUZM1NSA3F+T?(sD*yE1KzNYzk!!ImObw1h#fjGae`$OF3m` zN9>{Fr8Qr8x;=rx&e-u^bQQogFz46u1ecZ<`1==s_t_9hl_TX$Cr$C&avANQwe*xV zV3ws4Egeg|S8a<3xRqaP5y_Jc#zMlY7{dN-&$Rl+$uoY$3*o9~M@AQ>?ukD~-b_mke!lW;*eh1>3_kdB8J z5&pV?(yW#ekdkA?+zr~ju`GBFyWG}{U!;Mxh~>4l<2{QTrVf*dgV)Xz_)wJ1W4}uu zqd$>)N>N+2<@<5T*Dk{m@n2C4Bjdk^Vi;KdGpT5E&I-5j^z$85UZj%-xQ7O&0le*J zhW5+=cl(L^`*= zK8-_L^;5YzAq2khpmGLf{yPVZ{}5iq{BIaj%9l$8-Ua$9D!}`Met~I+3eyz)% zBKBnK92eUu+AagfCAt;Rza~g>dFpj|9GriS1TLFv*y5{Bxz(#n-whvt1EQoh0ns?) zXg0Y;Twqtz+m%s9!gGNT zJYZLg4+C(fyEiCg2N;z`zDdCpo7YTAdQjvP>P)b7?q^;o6aLxBrWRNQokf(l-0bxy zWA4GqY;QS9V@UH-p8wJkl7cPx!xA4;spBH6(A(}~*u1H! zZ^f|i03K>2Q8WQVWoGR5KU>5m2`wtlZvgEXo@nzWE`s85^2LwtNo~A z;^2p5%JHOTX&9j>(=z8;UjGHIsC|4ogoqv6H|6iLC#LZQZt<*m#`c*v!A(&s-Ih1_OCtsa zw=lyk5>c8?b=!1_cCUk1p=VFj|4FO27KS@WjV~yO+;9%ocvm2CiGyA}QTHGfpOhjN z*SF`uqXBw6Lq)m3I_7|POC_(eAp{cZ3NjrfMIa4g6d_%B7T^YSB_u4#h89l0v=iGM z6-cDOu-6Jrp)`_2XF!2o-Ln}$IpQce(rm>@3&YL}PVoo>ivf5rae*_|7@f9>b#NoH z4aRgF%FsBq4E(exBYtqNjPR+numr2Rk}8&`&kW{+NF5Y?Xh~#?GdF?G%lmCIM_z00 zXU?;6m3Es$o?xmGr1-!nZQdy*Yno6|54<~UiRl_=OX{e%b+mAv2@ptfK8zLUj%Qv| zau@!LmTutQSv5m_L_<}UbI7xm{HrcA-^{j(aNv|vVgvsIt`nm0zQCMA{D^=N{9Qp# z9ZjW2pbdV|hh`++?~s;8I@1p6Jc~Hg#k9n$JrDj z$YX`(T|kmBPCnIssmG6XxJng{7G|%rcE6KfJ1RBUGE&GkXA2{jrZU;&yKsd3Xm9B+fz3lIvol(#s0xMY zl#g&?amTKKqh$B=ryLWr3tOG?>8PXXKfRMGh4RTW__j;Hkw?HQx=KUI)*@vXgryhq zDsEqzH1Zb-F3OVzdgwJ1ad4V>_JOQ_>zD=&#*r*6;Jxsdnn85M1rT(9MqIWu)zT!> zdTGOiK9%s6gZ*0VlLSn1R3BY{tHTsvDc$-ORZbNirq%TFtiDF_Siy<#heNDJNY5Lb zp|s{1!1BJuUpDS*_)%Dmk1CVxU~G5(tcyG4se85L2ZJKU>}J{#>$Ez4#tb6BS=fu& z;(rbXB8Hz2`ig`8B6?=l;r2|p+w75k0olDt_MXZDGLwIZwCyANfl^+r2p%I0TvW`CFH*1QuxDOdODCo1@!pTRtFMeNm-kj2FHFu9(4>~M3=GY0}D36rq z4882%`DRmL%h$iFnk``}a_(HUWMU?XJZM~;I@Pch0eLwyuUkY0N2YaxkwI?a8-`dY zYU-3Z^2VyGd!#9T8g1JNIvCfhY9OT`f`+4sIcB9*Qn0{(fhv_k<)tqD%9=x32s_fA ze};#jEd=v)d|J($5QY3l8B`lJ)3@*9{pYVO%c*r4!k+`1{4Qc~^1XlOVV;cdhLoL2 zW;^8shB2nMGjp!ZZqtEgEf+-AA@~!NZ>_^#bLB#!;^bXU#nPQ40wO&5{B$1c?E9~{ zgOh4PqgDrX#IPkSM2%jUHN{Er97V}r*}wLQ5Z!U(xJtZNJ1E`+p$`g9DV>OIe^1AW zqE74xC@_d;z#kzd2TIg~r&CU)d{V<3Q;cyV_MLIVg{{145hs@z#{>ss?Ng|FdHq=T zrN=Y-Nw)I$F-%VgqYc~=7wU&}jkI~j-8~3X*e61aHB>Zz+V6}l!J(luSMb?5DyI2Y zOYbDi@Pan*M%Y`+n+K+B^}pnB(eN4ms@}Fa=K{a>P-o+6QD#+?J}3vmRra#W5l)T! z=7;h)m&>p`H|T4$%vN^?(9e0J7yT{be_okNPi}d?Ff)#sGchpzbIN2v zTf5r0+1mT6dO21a-$_KFfRvB{Y0b_uj~{+b1QydhEKy(^BOQ7jF#Y*fReZ;Sx`}#k zJcsZt>6ql)V~Z}EL?Ia!`(cW;~7-y@TGYdStD9F z%YTmBPCN}w%fIC;g6EP#w2$wDlV;<)P8nZ86k3QF4LKY*(g&rL9tpg;56fYu8^8NAm;X$FA6?I8ATb8*?Z+n7%sMtus8W?W_H^e%A(c&1Kf6&vDzG{8O44M!AyO%brHS^VoqZ z$8*7u1#T5(89YeagXR=c`ww(+-Kc?alrK7^Lk|!`4J90!hKMI>a15|UWD}#S^!vCq zS50KwX%#H&?`X2s1gVtiw6wY)f+!puF~{9X#Toplh(`U2waV*OAw9Jk&K^XmNV0oi zM-ymo%0V2md1Y*vRl)F*fF`+&NtD-VksbhefB!SWD+5AjO;w{dPHyw2x*)-!mkDq3 z#0T`fzGaQ;{S2MM_LVeOvGCbMp6-fcv18Xw>5CpT%WBdFg=9s2(A3kYtR05)!4bp! z>t4==)_YQDIkclaeD!wu9@J8KPiq z(4$u!I9%s*KqE96jwYAaZ-4b)D{_o6u16hL?XLF#ubQBg!J=@!ottBxOF}1NO~mfQL@AXn;qIG>LQ6 z4~Xffqe6mFUbnCBpyhiBZ=l12Qz?Ya9a8i#D1%I(FY?V(rgNwtLQUn%BFGv_qZ1La z<(*G$kt>JtWC-i&H28>CsfR$E{afY-i6625m?J-}EkeIC48aAG%V9^8-Rmbh=+T*1 zj2?**M6Z&!maP5@14cIBKCE`xSQQ}Xv=8s; znA!BUge$J)^IznmjrZ`Iu%0MDJfcyl(yhwY5GJtkQc)}OIP&OY-QX}uYdmcbKB#}* zS2V0TEo;Zu!1mk+sMf;B6Prl@b9lTTveD~yc)sOy*Cgp3yuTj6{^f(s^}4+!_h^p&y`$IZ^1kD{x_P|%x<9NRtCpqj?t0&#$bARp zeYyDhJeU}>-Rkmw`aH=-j$&{yf=ezS80S8u|+1=KKCL zyQc`hnR{}Tc-2nOF9reel1LAlU4i}4cxpU;cYrAnOEXejkwqUqPbjH7 z!20Ns&vaObzU&e}i7jmY+?fha#Y(kG)2I{J9_$xQ)sGG$qhpTcQqW`69$Tl)ZHbB2krUBPF>VM?4jWoF zF1n5%{7L?v&bTOvM3!b1%F2lcnrqy1b8Zd1C&P;RphxbEM$zE>4sq-n;N9Cl^RfhE z-k|hK*99Yokl^kg>y<-EAa00QsI7LdR|Ma}dD8u)vaQqHI(kkkh6&#bq@F$59xeEU z$#pWTIu&06Zk~bB&VKpV*Q!XL(kxjOM#8cIqr+8!VHPsxqUIOWv> zD+I0-T=RerjlgiNGJnC{zU}Ska*kOrP}bmZyGXA@2wt6~toYLzKX4Vn-$&%|Db^3T zXqUjj&NDKHO_?(kMS*w=IW_b!lYt1>Bb%v?(LrWTe;f!~AW;Wn+TxabK&nXb2ZM|c z`0WreD&bifS*7LZ;2L_7$NlxbJ0Ng~EyNq<5H@~GA5Db|G;YWH?!C`@Ri z9Ozv`VbDagf}FE-ke5g8+{Op?kf_yQMjP4q_DYPgVaD&f^^#=NOv_-XfGop1gI+;s zrs0}{!2Jr&{tG&|uTykYG(3vrdRk7Jb>$6mPTQ@QwzMcwutnep7|u3{-Di; zN}#x#GRA3laK7=wv}6XsR$i4Ltqh96_+oXldj zG110GrRnlSR1xF3@Kaa%&gf>b_@Gq+X4xqSj(rayixtA#VSDQScD6Y4j)k3#^IULb z2b&h_6_Z5PaJ~#C^b123h+v&&q%jyVsc0pTL)4WG9R6k8ge*L;7pZiS+;@TL9oJ<< z)DACwz{E;n#2^EZ3(qB&Hc%V!5`5(hDd8d}l$;*CBL#VL2*iyjpt(LUl0dk+>a2-Y zl!anWx9KC{xhbVq?YEdsI&uRZ+i$zT5fAz?piay_#--kMfVRS_b1ElFlb!*v?;j4( zE>HZI`w0)WbgVkzM*`j}vRb%IGXIC|W+O1-{$7lM8Y*M3fF2~0#JrjuIEjFb(*Wml z(&`bjO`S#_V+3^uEfC4M>{qqlx-B+bv@kc~`%rHd;O|WSDQLK;dMC=oQiquJ3Zj}z zZJ?38GnzbowU+VMs^krN#K1PLD)^1b1u14t$)JtD3$M63-dzz)`;yDmL52dqto zW^{}aq7iBLKrM`V_~W43f6lWETHJmy<`qNEp^umJtS_87VYIkinob?!uY>9P`MWPC zI@kf%AeQ}AbViZz0s5L;>XI>~*%F~8(f$M34&I{NTFJvTqf%7KRr>j*C+=&bb6*J8 z!hkv)4Z>ZUw*weScA4GB%6Kf@r<4ouZ{~JTdZ*&DSY&hc;^cabBP*fOX`R^tySi(g z38jp8YX=lEB$gbZ7P`ud?r&5z9LsqAJ?Bcr_z+J~owbw*U&ZT7e>p1^!Nd;$L!tn1 zxQ>&PDeoed|gv^eh&BQu}kqF%wEt zO}e53C2uY$EJG@6>M0o3tNoK(HCZf7##c0K^YE@U=vXK&4r>$R?y(&05YU)y#-%#= zT#4N(MxQ;jRCSjw@t3yGRHw%Zr$*O3#8R3(U7!Jhp4^bDD`16Hk1tl2x^T=x0!W7h z^iZWJRKGg#lW9D}6e0bSixl+GAgT&_B5?CtV#H;1r#U6A8Vlf5$QwoVTzXj#3Jsj( zJ6CZ|w<)9mhBfGUk9jv`uuT(Q0jr|)s z!d^gHO*-Gp9Yl5eBY~fSTyc~%;)Y!zPtqh~2(KBKJ|c@~%xlmeyJ_aF#RdcN_YLk! zG^p~=zz)Oz)99Q#DE)R&79j3nO{=a>CDp(m8ajNL_ZkkRiPv+?IrDsWU>tTZ4nuL@ z8FcjKUzJST3kFV;z$)lx$EA|PXF3{5m4@wWwEPKrV1Rom>dz?Fb%Py91EXY!dnxJ9 zxU%vDkL#NW;=LcDGcv7<1pXV)+z=S~Io zhC=Z&3H@Sf#*A?HGcIz2a4ZDW9ofY@^Jtmm23TOxIl^6VWbIpw4+e=1{tT=6U77B{ z%~{tQVw{s&q324X?9QVgVLxnObd`cNiWQ`-t7B634LhTO8ojB8MoIWtas=Cv^IS#G zltAu@#JT$?GbxVk|2pOvH4O5C#OEgs!?00(ARC_})mnz6V(;1E4cm4IgzAgxs6gzi z5_~@m6flQ%-@5L~r1t)p+o@SXj1REmu2**kwyas>Evr?|UFkr%tZl!K*V6A$%fN&W zak3cu5jQR_cF7%1_Jh1hGx?E)>|odAs&@3KJ?&&boLA=ne*)l^fNC6dofh3-5bGq; zS^B)OXY4F#vzNSYJb;yl2R-8%T|5COLmihD6@JK!{N0mqX*kuS+9)5!SGR8Pxzg`E z#ux+a>(M~U4(grACc zDyogNd%5@P5Ei_lgL~T5vFeVQK<1B4ndTV6ff_Nxz9aGkHm!&?9ZCpnCqj2k8;nU!IAN@|QuM@#g&e*R8H@^Mo zuXUfeD(26*`P`f+)4|B2nOqD|&!@nf80%6s{10n>hf&)sXMR1Mc`p>+z06{oefbh&J?c{C+AF zmnb@5zm%yLRBc6mqqxbj#lb&mmB%soZ7cgVeEVUFL2vq_8WW)5;5bys1cIapaM z9|?c*NsZBK9h6+8e+v%qs3q{BOsf0NUgLxCz`&;=&E#0(%YVYB=gXFBSR&5`0&ZZAzy}_&Ro?;#{e%s1xF|gw;;In5pR$mVyign{` zm)qbhM1g=SK+#qE7riUPc4HMWm6HVA`AaW0@tW*`Y6Cp~;x(LCm^}|;O!n43l(XI$ z>R8Hu&6qH<{(Ikb0oeXSR^&o!!e&ntuIq{F9wZ&l z;S*RW6l4RWlQu(hCNO)s(+Sb@^vv~>CCOO*mR#MG1S|k=rGz~zcApJba-$i6^YSZ? zX&LJx&3R)^)pys`_ucXF^~~_;r2f>8X$a3Lw)7Gh4Rzhg502R-cFOmH9dZVA%YK`+ z%OMC~>3yr)ck-x(Ppi6jEs@WNJ(-X30~7`>K;{FqpFWhSw;NR_siI)_N)PcfQ_Po} zrS4JQD|v48`c|9$MTvLN5Ct;`N(UTLUmxzpR6_jOh35_}dB<%yB2_ifhwqP4()H6G zK{i?paO!5=h}C;q|3L0=CGL5r!&~XShu?GG7C!x?ocqTjV5jo*vx3P8^Xbd?qG(Y{ zJ^t&f`K|tqk#7s>P*V~y&ZMi;VVpygd5D`K)kHot9fjwV+jU#(J%s@E2}0qOqkGRD zKd|+&Q;G>W)+ithBh@Hs(7P&KDa)Ry+(gpMm(usVTHVH^5{A3wp{+LJuGXU&YMO;O zA3q@x6W|g7l!bp$)ocB-tSLRW+^0_${jr|wZ+{?G37=RN!6md9D z5PjFO4}?EL=Zj{-@|=qF1CNRF^`!m;R}n>fK8&j*-vgTW?47KDjq#801L<~W7{(JY zggmL2Oo4)#3LCGFOkI<_p3&j?)M}!s;I}*>U+&lXYI-!|{D*KM67i)+!00UB)^=do(8@{gXHSZF;$O z-#DK5b2;TGEiRv~(8ly72fab1vJGV-9`spm!oku;d1DT_prw0tUd>+u%o8u9{H(<4 zz=xN_@N1vohe5Ba#_U<{-F9c{rtd+>zfIOPy_%*ok~&FWeobV}(kHxEhp^dg(;tcs zz5=D`xNjVk6^C?yH-V(j*YFw)vIqzK!SRjb&q}aYmm5qZ_Ko|N5oUmur%`N@T(IGG z8g~?xbc4IkG6p(NEE$#wg@H7mzfl;OHXTYr4UEi6QGfts9m988-IgJ2E87x*+ zRu6|~1b$n>?{ARM!=j`**m~tI;>H!4qM)T-=mzlCkSK8`re8OY6n4R@ zkdO!34em^tzSziV=`kj@JR;004Mi)Ot_EDT21lXbqrn{LLj^-9YGHN0E2d=)emrcn z0m6AAn{NdjKH}D6!orG{q2N?AH&anEM-on2qe_CiD$k%*b4r|H)8aKZEh?oeAF?Ep z7nA-BoUE@mU?#@QST*-cs645KAw;N(M6)Z3o)*iFMZvyrsX{+I?S-5MtNT607(TWQ z&Es|483qW9)yrDS9-+^Md^ezIS;rA{D4RlrQ61gD0KC7_Fh@Swj%=zowjINJG{@8i!rv3=>mM~(Hm829>$9E;r%@X)}$D`7XDwhB+H=&mwcXPv&5Jb@-f z;twOdu1!CZaAu`-(q%}PU74vz#=KYHa=DTZ*Z%E6znSz%^;?Oq<#c8Pdwr%eP&}QH z!O}=mE|09uTFz_EO+-r9uh9Thi`wW|y!@-TYF`-Q;XYlnwkq0tX7FzTj_%Yba!2PJ zBL}1mGh}h&DZnNkCR3EBn^$D01qbJB56BxFH{72ZSDyp7(b%~ah*8$(5|!4E(3>Bu z7)zoxIDYe_sUWk$2BYEBDiho_sNO|~dfbjN6;H9`dEQXXI~4`V1~8K7c$s^PUEx^7yQ3N5WG4&K@? z9exxks%y*9#9T{Cl4rkm70i^SiM@bb2$VLru+cIi5A`db6alxb4hJ_rK?$+(##8V}lB4RYS7DL0-`?P6vjjl1VULT#>aZIi z?`?vx7^Y3#F|mOox^5H+tpny)d#vO<^~;d=RLVwhp34st{DV_+@iW*{sEmR5-P+_2 zOWUp$El)wKGqB;6TvCbdwIq4d(-4|(mp3GJB=7OuPV7%W`%Nk<`~}1tM1kt-<{2i{ zzh0Pz@!>ok^1R{Hd04(k>uz5UQon$4tYNzT6^8lGw2#_1?_+G}M6c*<;Pej~NWxm* z)R(P*JPw)g!x_wzZY$KX?-ULb2m*oW&k4-2O%9JfRUA%kd6Vs!Nf#J z$HcjQ?nTpM!--o0nIcUQt@#(GrG{^&i1i zp#NWV-oGE$e-WVnIfCCI{$KZkBO%j&6G6bYl={C9At8W~ne9J*tmX}Er@7=#2ds4t zREyF->b)fqKHsHYXEau2%|ZWb$a?oYd&wkw(z3*x{_d6Y!jUmiW-YzpE^FD|ilTOp zw8@Ang-o-FMjrObo1zE(O%REc|NM&U|6}YNn{#QSC>`6*iEZ1qZJTdw+s27)+fGhw z+jwFdlle3=RZ~;bf1tanyLat-?Q5^~l7K`e-AbDzZGM20QIHS2<^28dv-|S(qt!1} zq6`Z9C12+3=7!Mc%$XgdP%Cf+YmXE^T18FM)YJqoPV#VGRrmb(Obdny1`?=AEJdE& zeu~QS6=`tiQCQS8l+WSw+>~dwv9YnG?@mopGHZ$vZm2a5Xzk%-*f6%k|qmMIA@~CDdxN zoZfizX44}^KHj}DBuRg(8oYQ9w+vqVznd@T4qO*F+mX{dE;x=WlBKo1I;>g`-VDiM zlRE+G5m4_U07wB4AJi0NTAJ{KzCR`IK{X&tlvsSWv9XC69cC-+IwXC_N?^kQG{X57 zD_4;)f>uJLfUIp3RTrw38_ZF^H-G^nvhlHVN|q~rH2R-Oq$P21lN$XX6n4*iJr-1_ zElq2W3DM&n0fwz{HwqBYn z{h~EnbsOm#&3CvMx+Vb(ZK9-?-p=>VcLpG1WbeS35i3?qsPhruFiMbg@8K;YBSVWj z2OrIj^)FqiC2JH%>EtUpeeH%pfT!~J%zT+|D3i4voMLu&%D1YFeWhKLLxK}0o)274MYZVne~a)QLwL;0 zf8&3y;ppR=v7U2YWcv2e`Uo}wapl_0@A2c zrE8Y4rp3cXMcPRVS~>L_a)&oI%XOwi`ACrZ|wmC!|yo*ec9XTyg8{h6Jffk#9D&Dei^=EBhz<(A;;65z;UGySHoq0}2@>6XpEi#HRJ<731Q# zqU%3FUVLYHE^Qrci7<(O68}I0ff7Iw)v}hfv}<@-RQmPX3Dm`w0=>5A)2HoU+W9aU zbT0vC^i`BB$C}m`Hgp{rK7>yNavYe>FGdm{VXYv)yGz~{-lxT`PCFck4}sm0tou$x z6)1xCSIfy+NvG1Chi`zT>ct|9u zyZ>4D`M5&KrAii}8XGe=GHrWyOqqivij}cD13vERZevD9M%Dp@IHZ&Du6#_knpsrl#@i^mLsB14U)sY&*t&0ZULM zR}XGoXH!ckI=8NE`7&5LEc`!i-rWwg5n6U>7%!lIlE;?_{)v_6<=0s5E)6f8-Hx@K z*wmxC>cG_~Qi@Wv{DIGpm*n9$AjKF`(KP#m$iN^1Mhr9Xo)A25Nqg|*$)|tO&W0Z= z#5G!|^r%RlJb>A@ByzhyZt63^eOSNw`)CM{h{jk)PM(gAcRPIEnVEm&%$@!8d$ntb zYvsOWglu?lpF<5DY+aU&8)6h>_Y^EFPH*?-gb9)0AYMU)q_i4DiN)$}$hC&(1VO+w zFIrXt1A!%B{?_LIB6yXJ-Q9(S-QAs?6Sm_W1$vJq@?d){t@Y%*FI6EW;5ihjn;fpx2%Ypr&-Ww1e8K#Bh88E} z2=r%2=gjOROP1^=4h{`9%@TF0EOqcL22@BrEfPwQnU7C*T^*vAgR!x(n;V9&zP|py z&3!j4q8xqq&jyJk|UC@!##{Qc_bj9-Y*S_7MT3lXqHe>?Etv7GzJZX|q6ZHqB4&% z2Y`8wG-)aD{XY{&@mc=Frtnv66e1L>R~a>mHWpV@K<^DG%f4##eU5Zt?sV-efSeEH zc$k?xog8E8KYM?*z_*Bvh*4diEK;WnYV)=u`P^*7;+H`x#$z5cQ~fi4x#nwMD34?E zIDFdW`$*0soSV<-d&}zcJQ#+4L=Xlp6-=+HtnB^DxoO|J-rqO!fa`pjd2`>pQ|>_P z_zG{s{rkRBvHRlsJfO0Vl=roDx`z$<5ln_qfgEaqo z9STcFN5{~88?O6B?!0bw6skdvDU09-@Z5aW=n+loWH)|Ga4 zmX?;*wzf7jG!P0Hkf-m~rpQc?d%*pbq@K<} zGysOc^KpJ+Lb^vkuNScm90Q|P?>}I%1*WET+k~S86`QVrYXUAGEE0G#!?sOK5Lo$e zXM6LRq-2t`i1~Y0bh>*b8JTEFeRGRapHUhP4{&`ZY%W<@aK{-0o%G@VJtV;Ugy|3L3QpF*ANd0{YKr9} zDQ|xrjK~iK58LJ8%kSf1>gh?;4zy34Dw#00-zsXX0unTI$}$i-64?8Fp;0R*FAGv> zZC&aASVVv);D?LRAH0wtA9b;R`&6ZoLyy@G%D&cMGTPhYy)UkuVM}MXAM2r%m-F@9 z;p{>3ck<>TT`jFLg&KcI?~s@#G)>XcYJ&T1Q^P-;7r~r0Yg)noE*cU6H-O5L2_kae z`=;lm=``jm@rayx_=xVp#%b%(ejC&YS2?ga_2uc_#8G=?k+Vu|+I$Zk|X=9xTR ztWF&+A^zKD=vLO(D^@KkuSj;`#o)(^g+qpiLrQpcb~=I|5<bXmb(9?2#4MjzDZ49g(K6#Xu0GT1@Pd z2@|21pX|uGM@KWd6JjmY96Nv^UR&R26XO3FkQuWwS`UUq1bLZj?4n3VB*J@ab^LIP zfuBRcCZt21mYYR*ModvlX+ZHkeE7f}GZkdQLe-^0fdPgqDJenwS#Seemy3y?otkQH zZ4OxCqhAH7aQ)}?@t)vs)vWD;TaXtf>(eMo%yjmIh|BMDy~Wjy=NE7XnzfgKq{hJt z3<)2xd2(_K*|!%OH8H`RW>+!0FK^lS!k~Y7b@kK)0>wUWZZ$^;7wPOBXaC9Q+!mK!9!g@a?_{=K?FmdBP;Ho|&0h1i>1%iT~9`iwuEJ0ODUU2Z_V!^eh6uS0lSLgqdNBzhQQp z@MW`8)6)a9-S~C07b=wK)HPlz)}&K*BLeYsKLrA)CMH-c{XL3=b2yLwA8r2Lk84b~ zyFH1MIk?~r%G%2JvH$sirUfP4TwH*b$HB#GI?;xXgeqq|9$M!-b-*3%Z_%n+Ac4Y3 zNSqBRtvrMD0a3q0LTvJIJJ$T*-Xa`eZSYe82O9^V5oE?J|WLF=Z;Hv#k7+1c$Oi;~=99z`0w4r1o}5K)~q?Pbnch=_6bUhjJKYBe0CfVdCTRVWbU}6bzOtP-X6g})Z0Io-UqIzvnVG>j71Slfo!Ta4&IRSb{KIXD$X zrB;`K;?qt+8Yfbg7c^JHnKb#Wz>0{ef?9}KRQFsj)ji@6^|*H0LX8K+J7AyPW3z}y1O(#i2w*!xj6-tm^okUCGXk3QsjQHaQ$xM|pfg`v7;OzVmP)kBW;=#&^^OuW_ zOHIdMG;WiR{_&um#-A~2GSTd4*@J#+daFR$kAgx{=91?NH2`d#+n(@2G4gdf6}nN9 z7A012MbK%0h0w;3G>mR_P{oK3j>d`O-IBDQI+on?AscruWGc35Ic1k*9*YoiEqJy# zj|3yp8o1_y^Z>d$W60_9UqfyOo^vu8ngc?7^ptDCChJXrXb%;wWLh8CTrk5dBnayW zF?xE>~YB@ z>B{aO1O{lMNF~iYqA~|&9ie5R5p$@Nc#cuR zz<}bEHClnx@4{_2Z`L*fVsHyG1&!zHc`g`pAX%tka!H3(t{x$z%Ta?=NkY#p>_-aN z-GrQWvRhU3?JI9gtnbXq?k1wP7%XGRu_;V5Mx;Szz`R=eH)vN6;4h9a) zYpE*2dbW^9)369oryolYvoN<7mpb%f;n|QZPaA^TI1~}sB5WZAY$g`ncI~6 z3%zq<_?GCrd(jF4u}WoXNPoTP>VWmm8qu{AN!UCZpoWVK#W*^M{(u|pi-1?B+a4V3 zZ6e7<9fMoaPvBX?2RPQi3uYOAS?1FR%?7F*M7C$phRKtjetpBwtk&C1A%zZ$5jvg? zkG><4%KQNXkv_N7@9cA_02L;Xy3etMs!Yy|?(5V&Nh^+Od*{wU1y7~WfaRYMr(F>lEDlIIqRT8I;?i`W!b7!$ z%sA4W-g6XEespndYi$nP-p8%SGff%DAH9hl7=f-r{|EB)`8krOp{C~M;`a3N0_tjL zmMRTR9&{gGfh%9Oecf-V*Rx>Dlrb?m0T6|rH~S-}FC=8+?TsrJK~Y*}kuDrjGu%@F zCXIKCm>~>Yj6g@fZrAE^bx#h44kb(OEYu6xXlUw^Qi$hw(9=nqGhjFeXuK}gM8=w| zJ{@Oa2{lG0*=ypVF4vZI^u*=NlO)E75Jh?|A|YXfdY3mrxyfnN_J2>#>;C!vc2nmJD)?e4|eI#j; zPEJm7_?}2`F!jJA{f(ZU9SQULe2KD zaiVgf)TvA)J?vDld*o-Q#3QM*whz9*uX{EN+@7_E$6tv4_lZ%Hc!8azCDT^T@6p{a zJXaE3<;X{#-7f^~Uc1fbW{AGyKR7r|Jh=TR8M@>F`G*e49M7HkBw+vMfZ!@AP=Fhg zT-6%Zq}fw4tQs|M70X6JIfcN;QSa*fj%l#1T{BN^iA@Q*!KTT%0tY+}?nbR#1LUt0 zT)7I6QiJh6R2e`V9XPK@$n@@_IU1Tf@+TVp364@3h!(3|A|cBvGLJ9;4|Q7)B+8 znj4+eS__ptcoP*vXbJ8EJE4k2NL#aIw+~y9-HyQ^2etm2NQ)m2T*HzNz=exlsio^* zlyYmv1wfygGX@_#J4oTC3ONm3qK!DkmrB zYNCR=AzCtZ3#HYHVyp)SmQpcA%3`0@Oc34SX&uHJpEDg>S0mfR>OU z4nqbNbaGKmRT9C@z3|HU%65htAq@_%8(4@OQ@9AY<-r#f;MJ2LG6t6-WZqvE0s_E(RXIHb~GW3TcYieT(#NPqHGhSMa|$Q&(u^Si2sEX1)K*E0JuCGKb#Cp`G{ z;g@P^YSw}&G2RjIf1l>CurQ~lp+2e>?;R;v5uneIt=)YVaz;H1_WvCH;bUbDaZH^s zeFJ}^P6eS)B4^en>!$%13!U4pp{sfQoJ^-5;B<9$O*l8r4V{%Z{{SfXzrXy~GrM*?7qhczYAw(!Kp5Xl+ffRcrH*zB?Ha#h`$EQap2SWJi9}^`sSo2U_ zPJ7V??@7`ng;HB({9o8I_V%7)BRF+^*M_TGWsxvrhSZcEudjC|67d-5=oxb6)(&l( zUndnRt2)|(tj3X8mrcGFMY;vD^LVa0fyAV~=ulYv$zkw}i0l1Wkx=Rv>=BaOJs}O* z897%M0N^GN6sxn(?wa>X4J>}Y&4_r?Bturwzg)QydhdG+gT{=^M!r|e8bUA> z^1Okf5W&r@SkgL4GZd?7OABd$i!0xkZTDU74|W<`7Fi7Ep=Uem)Xb^T>fOB2aU>~G zuVlX;(2oLb@*4H7MaPpV>;MTlIe2kA0@#V2w*L&2jEKJb)s@^HfMTT*m}T3XPvsMk z2N2oIPfkv}yuAGGCJhcS9Vo5(;~+c`ha8AJ+A8TAm5V_k9PABg2f@uzs#iWlFWE^O zPbl$6Z$%Oi;1L(68`^&dSkAUSxC=RGSi{D*(X!NJ$xHkMU|hp6k5mUB*7;Rk9}}rG zK8+P>`OB6S(R19&rmhR&KGm92w}0WU8%jx`mZ8&^%`V6($On)YS(>h{YOsg`1tZWd z#Uo=T#ja5;){`&kb#ngcO!5TGeg^_a0CjE0r5T5?YQrPxQ=&A|8N}aG(T7hJpG`yj z)`??XZQURM1O!A1);Dcqfi5K)VHF6((8ie4K5?_3$f+O@J2*IaGlW9pR%mF${CwcI z9}r4@;w9@!G66_pz!Z?}&N}cEUCborT__3>esbEyEhvzndaL|I5`q4bbra!8!7QIW zVs=kUkKXHI-t|Tgj$d$G&-eQUk}+e(>c#iutU#CbjduWl)`<``3H#4UpU(0VYMPLnk%0Pn^g#;;vbz`I3)i!82 zI4eCpUC-CEXDm6a!`JX({NlO08an5U;%$4q`vrxof8@%A~faIPY8(j54Q%c&zN z3SQn{!4-Q(EP&nH+nYojE;c?szvn$E7BJTp&hH&~{P7{k%=V7WLO^7*lamqqLnuWC zp$D^Gs>_LIk11CGBHlYKyCvOxabS3WzbAxw+XfOfIs{eC*{B&H{#x?GkjU z93@E)d_P{=aS^(v`I%W8>yi2ifBUD|kFQ&&2+;PyU(KcOrRSyuJWZ8&r`3)pgi8y7 zgCm>>*rWS?g63CRy%W`~P#z=w^s!e)p5iM-3ow<0fSRS&gsreP9 zUS&y}Dde-uD{8=p2VF8QL|LC^7`r0SE9AU&HamV(=7&TJ@88&-*x-3uk57(+=nvgTVafq8_cX!q0GLmoY1$+)tz`mivm zrKtvGnVpdfIJ1XFqJ%%N!fO1h$~7;LS4b|yEg3AlkI z(TqJ6J!AR=PfkwkQtZEf3R{u0LYD_3g?F5?(19TJ6%{psEc@xKznmGp*OomJhF`dK z7!Kf(+lN-JoxNlh3oC&g#Ga`g>WBdEPoROkW{nGC%{-^s__$J)Y679|^B!@3=i-&P zJr^I__U^7lPPQm6Ndi*KTj<+fdUiK%r0hiQypzTo*EO)bGv`)g6f+0q=y6y!BqtqR zVoAcDK-VI4U?a1$jCuUwz8P~~Xn<(@AkX-lGTizRFff>(kfe+$id(MdMVl`ue8Ro9 z6WwwPn_r#3n-|8|?)Emk8`!su1^}og5U=n1sV~T}K-8|agK^zh1cryL#nrfhlFm#} z6KHnU_uBb4<{py&@Y|A=7!7J4W6sj6h=~te;pDkcY3`wY8Rjf#5ed6)6?+Ow@tgb_ z0y0TRYm%7-HY$38W`e%=CD7H!*wO*&9@Sqx>VWyRK7}5j2}dW?R*Z_vT?KjPcs2$~ zc3g6Tt3sUis>vgJcn220PlSMo&j$t`D-qn{tIweOywPHl&R`&}5$GTs7%*Fk@GDC& zU(C|C5lXB;foZL430~Y+-gkd?=XAO4FD6~)j>gcn|J~d(jEWE?#3H3m$sD>4XvW9G z?(hL9tE;Dl(8-rUqC>+bVH)aj=Bp5E=>)y~il7f%9$LO9z=dlnn_6WLQjfRE}NQv%efsmqAIs^8v zz%S+jqaYk#IO(2po^C}J@T&wqECh-{Q>9Sg7 zpx>U1cyp}HX!10=p~R@BWlQBuyg;p&m$uGvq184D_NLYWbf4rZK4E!O6lQ!Xao8D* zqW=W{>s!5oZ{)&+(ykzcw8Vyc?;i9i(I!iaFjK}33vMbs^2pN*p=~{a4Rz{}ZRmsm zx(Xu>G*wA(_8i996>91ogkNTtJNdjEV?H||7yR15KB;LRtCT=UGE!cOGU-mH%2S;< zWl2z95?iC9E|4z4h#U!U_kc)Ht0BVPElpw2kl)>NEWvW?fUB+0S^`ovJnHu`B*FsA z7Q{+iT%IDY$HC2vFmA1FZ-J!nGIh3<=)Qv)gLk}{1kO` zqFG&=o~0BK1N=X4!v%cqMljdy{KqQ6ypoCP2ob#)bJsSCqSy2tM1_^~g=)ubiBo1~ zVCENr0brbA31;GrR-vDvlk1ObB}kK}uqo2twLM(`6tfM4=Oe~2eHWcMuecp;Ok^l< zD3S`%KgSYWwg*Tu!(0_`p(sJMduKzV^x6LD_Vjr8*k1xaj|%?JlpP6MWo!V5FHq{! z-?^3-pd>w8o+9TaOkKd~5h@8BE-V095NA8xnKN?JqWWaTW`_UcG+Gi_{T0d^#>s&^U?Edp2SXBGZcP5Acu%H9EQ) zdeP93d^oHWriWt;-zrcCaXV7SE8h*E)fn?4BxN9~YS}nNdU~n?H49dh+@<+>U@~y48uh9I z^y_A%3zB_21dFEinQZ=TpJQnQ1A>4kS)j;q{?^Qmb6P!i6yD;kLz6@Nvhaxyh2D`p zKV4i>$1OmG)!4vgwe11%cFuP3#x!_bQY<&A*{bzd_^Hi>HK9Z^_QudC0;u_xJjW8M z=G=5zE1{uCK?$Gtv#PrKw$t}f_@cBIxv#zbb%sSQm*=^vp(_poyP5h>FcKLZAVevw7&jtlYzst<1e}opQz9L? z)YjVo9MpHEjiVR>(mysf)-?NV>fqq8yVD~kHe#MEMVuPNe_l@CJ%95cCoc!WuC24_ z_qAc;!K(Iz^%+$uZTi^)@9MHYTkQG=Ku}KiC$dyI?>DB#w`Z(i zCGXXH`Qa=BG{Ki_96UU%ydgFY4iUAP$S|S5R0+RMTTN|o^O7O+aG_G$B%fIe0wVn4 z;4y|0ocFWeL2H17O3Y(#Y6}-NPeXsvX{24f5ug&YMKek7d9>E`c$-qCX1vx)<{EUr z^d*rIyQ*qzWkqCsUyU?^Vno?dNvlDUQr(92GHDwvW%TiAX{*}qSJjRXR;P=J-Is5N z`qy4xE*b2i^&6BSh}sk$kUVbV0nw;cHZ&kSwsdwjHg$>XV`DbiC|t05QDswg-o|E% z(})gpd@y)$ximH0zRYdZbEWhzOT6m{$pS)Pp{%sA%6&Yl{gED>I;q_3EZVk%CHVS! zea|wng7UdgV&$Jnad{_hWbLuN_F73nS8ik5j2QE^ix&%CYe@;&nJAEWtNw1gbJs6h z;RmdwtgF7XyScl#y}7!4@$v?!ETqw>J3xGD#f@IKZ52FAI%L9z=m|OsaSr$^%t7!e zmu6#;l!~3ImipVIJ#DrT%||s>p-Y5^&F1lOuyL{7yzFM-_I5c*ikGTtD=QbyTQ_ge z1_GUPM#as_D#XXePnt1zYip}-Y%jC%$i%q{8dO$QxpvalGb+wm=M<;5#j=7X?OL*) z937z@oep_TCfmV+eYV5L4RT~(@O9{20Y%346R<$t|vm-Sq0A|}Rw;023QTeol)ymvs+BH%rK z83Z|xR#Jt!%DUrl z9F?>^WP8i7X*19JS?gj6P4Mnx_vibf@8haT;0-V}1sC?{=th4)xp^HlS z{gC%{Ig+lQnVZpZdIiWjA-0KyDnGNn8CIlHqbYIkO~@M`qoJW8vJ(PJMqOFY;L0cY zfJdhh?D6Y^uF0Q+ok`5f(@<5_R93QP%}h88+Sr$z+>e;t$0ERnbe;#7(~)4Zveu|j z%^%6#>2=@rENgE5Z9dyNE6)oKNBut!2{!FoL*L#qGqscFBjz{y{QZB=yPv);rlwwA znQ5mS`9bP&G>w|H#svwq$mi$OGz@jWS4~xLlQNTrfkt|Ix`pBF2L!*&9XC%_JHVOn z<$$>Phf&VJy-vD>HFNAUH9-xleToYsL$`Et!uZsYGcXkBl?PeIUq$eq{NJe~c58?% zuWbJ+4xH-~8zJV*@%UU$ zd;NjFAJ1&In;0;mS8fs-?k~C9UB3qft$ubVSFp*GPs^F0W%J}fs)E3Wwc?8&hGIBC{{v%2nFlW`34-4A1r?hC} z8JyhZcK&zzB4nP!`v$>#0-N{4t7_^e1l+9T@9(eU?fox2SJGJ{Ro8mc0m`FLwL*}? zBV>F3^$nJx`@YHmq+~5sVq!GUCkYt}$ySXSv7=?A3nMLq{7RP3bs@V}18I(6vH3;hoyFJ|gWhf-iqd_|SaAd2<7KLgqhDss?P|yOcCO%9a`@&& z&*Np=|0n(jsGrq-7lF+C?&}5FWB>U0m(%Io;9h%*pA=gF@Nl(KgV;(A7c%AT-aL84 zn3HHixD4g4Q?>D8@2Wm@X_9)6KE>GCF zewky3SB!D`vdGfQ;gqt}(-onJq%fSQkjw2lVa&X!a)pS``}(}zgb+?*+2-B^I~_>; zT2fO3Z$*(~zh%fgQhz##esmmImm`15bJH!tezCH2X=%-Uca#i-2t^2G!Aw=KC^c+c z&ie_{$CU7196}$}h1hD$kHLsCpCTJ3VmQPIfsP02I(aJ~R?03T(x->iOq~|7kV<)e z6A|EG%Z%V+)A z3A8UB&wI?0H7zZb&DN&f>G+%gbH4fsT{|lD4axLKhT9YFBb7DdS9JU)N*xao)=t;` z3gg)Pr|6nJDTI*5Z{k8NZ8x1;3nLNg-l&X4)RiS_k z4?A-+V@%WylNF{XgM@Y9Aaej@5+bb&8ssVc7P*?Qm9{>3lc+IZ=D`;RT}CW;Q@t+H z`;)BydVR06XD`TJr%d=CGG_nA{)0r|n_F1$^6#aH>yS8XTmw=PK3~K}uIxqve!SHA zo=DrnN#+-HI>Um}?@W%t?MUg|ckr*zpnlFWSYsjB&c~@y&l5b__L~!YSikxdh+)8`fj$`4fThM$jGN(#IEjA zQqq$8QKh%Fwt%a*l?%c3Ja5?a^Y-oLN$$jlR*9mCd=rLQwtqtFKVp^Q81(m6POKVp zrt?Wg;6JD5N^TBEw|SLN{JTqe%n)8cqNUBQB_O&18jYE@w6}NX^r6OeSwZ&*6|>;1WZv=@ zzWe(>fh6iA^?&?Y*ze;lD`LaOj{5pLKagtY9RB~e)e+ABwL0?u$bV#H`9D&!YqZAg zNjQ*tPHEmDhm8_#=>rNx5~c_{+vBHh=0RG7%o7y18VvNS=%mEO<}%SU$Bd_?)=W$9(;<+YTnR|NPt~#~U z>%-gX_!*(#pGRA_tZq|B0J2I-FetS<=kW_kF{Hm=?;j#B|C|s6zufO*C@!MAk4e*N z^rqG0kKM(a#g~f(u&LUQpUt+|k+vjk#y|{t?^Sb%Od{c1)1u9)BVuV#C+Lndlx@lD zO`5zS{~_xQybz|p16S8gnCc?ydOA~O2_k7OP{qQZUSsPX1>VN}u2X-sSmPp3U3y`i zqImd9U9x7WRw1_QR_A7lYQtPoPm`MdohHHLRhQF-QxAklR9YqMhg(m;wpEUYG-S%Y z>arDpg`3m19>$oRdRe~TB^x?*X+2G+ zGh1zNCNq(Sy1;c^)C@HmW1aw=O(dQFzScIe$~G}?I;}XIyW}2W%K(Ir-`-UFhD5R~ zt=L9gv9-L?42(-RO4v}xwzW>x=%48NUk9uyZVZOW(!JeH@_)9N-Te|_&6V0Kv#Z1B zsVc0m@UK%2sw4UkW#I#zq+@L3io@!(D@r(cDBYpzOU$5WsT3~ zeeHJmmv&hI(Yvszig;i@TpkzNj^`BSj%jmFF?^(%Un>a6{;%6%Qw~qse!Dq!#*<;2 z^TGGIT>R@>pwKa z>rkH#gweXh26w2~r1I?31|S`Bhsk2$&Ap2;=ORqz8@^L)Lf>A-aQ_gRKKUIZ3zeCY z42j@+g!OYUe9``WvoiBgGW$cY$K!O&zkcs!`~SEg>g~$1LK|E6+fORIasoz_%7F1) z`HJ||B#f#rz9~xi=zHxtaNvR477C~3%uCa|)*syj*&voESIu+`P<$s+Z88JMMx_QC zhLK6sif{}hPyut)NoY?jv3A@a>&+~p$1)nHf*H`nh8L1;;mMF6p{~&MnS7ZlT;4=tSad zXyC~@NqDLuMWnJF*Q|Ikx8m^fMIme0-RQEEo3xE-*l@Of=`XD|8}CVxHcW06PeC3QkhhPkDX;|b^JxYb;TDlb7h(1m08xegYbLyrocpN2Kpxg-qU)3j8+Khd>nBR$w2yrE7p zvn}H}SzH>Kdu5rQoHk(gg7E!m=Iwa}y252i(czq@6mHH5xU zj!$4S#AJ{E*D9w7f-~6Zj0YoP?X)#?qoEs!0o(!u5Wpx5k*iD#gaq2 zovxIbxb{*|$~4Atih}(RCE_l{v}rq}HhWd+#LT^3zKr}42J`|O#lWQ*vt7}H2oh~W%|#EXA-r|C zQ=^kJ?wWpMVBpjDWui*SQ$m}7gNg>y4*966v$jxj%|}K(>9N6~RwUqQ!IfO#MNKN( zXB1El2c~e@*3Pf4pV+Yz7R&{*HVdTR=rpol%6ZOcy2l#Q`(YA=9f z%*J>4qn)9Q00ZYr9u&TUVqKEni%P%`n#fsEAXXY1`-voez7A_<*esdmoRp$&A)e0& zq^Q)_R*V#wybDdTj zmVK}QG|gbLP$8cfuM-R51v>}DHMk7|72M}q>o%dD+#*)~N5;zX3O8>{b+QP25{D)| z9bHs;ar`qAE=csbo|;Dl?Gl$EmiIABiRt`8lZ^ND><|}0b9Yn2(9ka$_RBNBY@k5I z--9p_J~-Mw6oVpjF6!0_8H2dWc-lkcW;SIHXxscDZI~C48lj{(Pu9N_h$T8H4Gcvh zHaM|{*2`4a{1Z$Vsl$8Mxa3V`1~~iWt7T?~3}ZauKr!1LHDubIcRWs>Ki@AA+}^bHf(vw*xZgBR7be*d4>l8?7j zaUF)8uGn^Zod~fT3q9GVc8fYN(_S=_LmTNmX-N)UT%W&(wIn)FwGJ zagoHHt^3`cs?kfc9VcgY3;ku5Nf4fzmzd_XYw zdKMYljmaVA5{r|GQg2kO09tEa>e@P~0bC1KHB)p$qOav(Jj4EQ->{roKgN+9+vE~g zDe%kUR2Fo#RHibx0UL;8*1<(GYB00O!f+Z?J9j!X0krygy$W;rDNvJ~>mzQH6Ra+b-n9b*jhfzg{?% zmWkl50Jaiik&2MOdaS&0s9}Um5+=&}a~lMZ^94*mJNSR5``$Ubt_ZeC3D&0{Hm1gY zTQ>AniA9u;34#q*z;IfJ^n=R1*pR?@gABJ9YH+Lzw>_wuCVc^chM6uOYm2*Ja_W*o4oZX4L(LbbP%PNek{Q86I={jo!KztF60l{ZPfS^5Ra@U9Wq!pVme0 zVf#@_6sjr@v&=gNi9YB8L6EZ0cV&C*4$F<=>LoO-?4Z>O8*&65z+$ZHr{$+zt4#5b zU6Y@C-Sf@Dpue+V5~v{?B_v#?BJe!QQ6OBCuLD8j4hncc;J8c4EFP4j_?cx)ft{Ld z_8S868sknwk`?QPVqXGG-JE9Kx$hB*fGs1)TjV@#$L^}jhbeQ@wn*NciS(?!( zZfPql?GTdA$t{#pri{&D5L#n+a#z#1oIcCCHhPt*+lIq&bG-E(Mj++oNQLcxV$@B! zkyO`rZ1)XSfXs!y_Q0Vhh`WLQLpr*aEqw;H&m9AVD2f^ruDYcwD!DRxxQ*vRh@fO` zvKLCvDV#&F>BPL)xo7P$!cS$1rgGjLkh-|yOUwD_&y)Iqf+b{S1qf8*9j4GkUg8BW zDvof{fGX-ed_=`{j)(mYDwV4G!x0CbTPG97&CWUMi^8JV%|$w!c`XZu^Y@v*mnqWv zVrO*6eNsdcD5jqFZUUM6z)q`x05CPyn9nvd&aS|6P(AS$W6Bz`VLqyyA+)Kg33(Sv ziRwym^2!6Fh0_cXt(a${{Uv05Iq;5%@vzPf&8{M1i?+7$4@kEDg?Iy#0a^8bf26-y zmySU=#f3fw$oNO-qi6Ur^14z_KhUOO%T3lh!Q|IIiq1ckTAwhkOkVu$IAaliZ23sK zM6--nT^p>c_B-5GyX)f;RN=!W>`ui{$Xk-^7K}gh`%LuqN0mO>PGCm0TPmX`8V7NX zKBZ_#9T(M$lovEoh$rq=E`(l;&v*68r~gdF)>+IRNv+uk z6)ASW&RseGY;Y}G0Y#RO%Y;j3H-Q{n*NEl0 z>(#axAxhUQH8Tgoc-iQ{1Z6Xb)>$1j7f+O8wRlfMSdCZ*Gj~R^|JzW%YX72r5Am2I zfHS#a3$cPd-T<%Q#|l&u?L#$Q%o+ZX+h`*?*#;+0am;xu#-Oq-)4&Q>=Q6Lvz4$~q zoUHLG;*VX#vYUU_g%)K8%s=ObE5@{1T=DN$yPQPL;ViTT?D%R+tx}HYWewMKcqM~d zuPRo_^SdZfZhhr|GhlH?e|e-Zo4ZID^ygvX&~d&#Mx9U9mC5E&ISFSKl(HN($V zwHk;_#;$9);HEpUbWY!NF0qqW`|(!#qiALsGow-Hb0y?$vJ z)UULm=2)E8xMhJ+xC!9^AS8>CA{&@J0m&-~ipiVsUNaZ2*4UBWCVIfqIw4cY#=tD# z9ayLufFFEGk5B9=4mFU&+2^3)(WAPs${UUy z#M)-_Qe4;ur^Il5%lut=Fq(~ZL>23^a=ZuwLvmkUxjs69`X7v)Q;1XDu8X@MB-tgsf?X*i)LNU=Ag7;uKa2 z33Kdq)!&TIYjz-*oKOtR_&aB>27DH>plJ}wfpg_c^m~WPspCK~8=Ct1Ce4njqU6*&GG+N^{+9QNZgS)kQMh#XOg>_SU z#Zso=P>5+uy%*dNgqq-#;)(UONIkrIEWkd)ZIVF|Vpb)$EczowI=IRcQJ2SI<`j(3 zaT2I2ifTumNjoPSqo3UmA2Vc>t?xABPixbfIWNWz>%L~6X~m0O8oZms@K8Pg#w#2V zW)u5J&XqTmO$VDqnI#r&Gf!`2zU`^9KLs{$W?OQp?(qsU=S+H~m`|d2j(d3xOonfi zG6%C*F!-~c)jXS7=uOe6Dq(-NKFr)VVC3sRoM+XDHJ0=d)Ag1dEf)?>2BYPbZ_^W=lHLeQVq=o-2`eDOwEzZ5pk)!=i5W+CG z-I*_&S`?Bk2&LtKa!j9f(HdU0meYyLbzyrH6%@bMbB~0zWug2%-jxkB?W%uD$z|OA zS3kG`-@z(~nGY$RHI2raXqUP(>{lbRYxr*G>t9BN}Vkl&>p_YXo$=^sk zDlEz&^N4H%($EndvTuP6vBw*%$MRrd&UWl*SG(kg__2oyBkVuhIiT{GD^R}r=tB4|*5LSHgGzKY0^b?en zL~cHGICTEu?QEKm(s85v$m79Z*V`z|zUrVP+QGjc|0*HuUaX$`tbF z&(C+Us)oQ{3Qd$OjRc+C!U#?d@zYuLFW&&3d;7dFEULa=4q7S?=MVjrcx{oduTM$s zE{wXrkALKTdA>h_a{*Hgt|=dygZHCyqcpyim7btXQ53*6RXh!F^5;l8YZALk?HwI- ziLpeG`sMk%lr^GL0X>?-tM^@df-4HtV};WLiAqpaX4&CRri*)yY`Qc1arI#FljS>}=;^ zPML7XA6)P}G?I)&8ye_t`ZPvIJ=bDyH2rR>q#{;SeP0q*J;-*wE8F%qjiW{&y#q)r z;%M|1ZSV%;!8y7em0^_M=K#RB`8M36@Dny%i?QLp`QuQPCR4Puz6uN5^}Wl>&fJ2= zAM)VF&p@ZCEleK}ZvCN43D;^H<4b_|>3{;<0QCte z8xuBAIK5`p0*pUsK)zsig>`+~5qZ}WAvBUY9C1cO1DF|liKo_~cnvs2T!Q>6V7AE- zDLGPN)R$1fjkzdo9GsMRB0Wa}$V*yzF{@0i5~N>V*gZjz47*tDU6Lkz4Y=9Q?W?(2NFz?9IodB)5z1| zdS*^e$FdD?=il4dl2|xVO$;A0y7_FZOcetN=R2VGzi=?tZ59egnlN*iAi))m?&>mxVRGcb78$(wR zog-7^u1dpqq;z3i3^6Z4FeTuD(BH96{BXF2_tY^+0= zRncmXQJ+lVoYUp0&d@ONDp*h7ofubTn4V@W%RIb{DL97$aWB-bo|XV5lnY^1*(lXK7wo?B(z+t-- z#Z`UmWT?s@laf6|=hAHIuF~C1&T(PAT}5PyP$u@XVKiEZHwUd4uHK(Z zJ160^Qv2SeDg-of_^G8&UMDvfXf{UABau-I;mDBjUFax#(o4M{4e0qSS^hDN3Prn9=sZ(d zhZg%B%tt{@PToRh`BY46ErxHJ`#8bU_}V7c15Y|!Q@v#__mRSy*^%K3nv@lO&J@n* ziGv)@bH|h204;3--ej9qrM(Uu(HXT$df`&|nsS#$!ZbqwCv}Y=1&9%dH$`Q2M#|rw zsUaq0N(HAAuO|ZIAtS6FRz=v5S~j|c&hqWp2fiBz{W-33I3mHL&{g!m$7 zEvD^5XaWB+JDc%3(gLaPuUXk;N(m4(v#q?DCyvWx>*B zH-7#d>HuR!$llRq2O~=<%2f8phQY;a3@XOOS_1z8Rd3Qy`HNX=`a$6hz6JTnZbl$vPW zp5jprvf4-3IO6=7I&YjrN1C0E*HO1+sBt*s-vk#s1alMej8C{WQmgEfgB{zs#mvzH zZYlM4dp^a-=O}smKJU-vQ~oS98pFRKAAX+<-cOqv@O^<#ty{=WDy^HFv+EVJc<)uYrq2^F{tUzQ&Ji?@>57%&?MSb-i?hwUVgcc$YH|N7PwLM)ubd` z5o{zgkJ6-AID@QlBY#ZOGj9v2!)2a%oGLta7hSI~bT@;_Fo3_XWVU5wDWILctr+t3 z3QwOqen#=Ad)&(3!9~l(?M<#aiz3z6r4#xh3Rj`Rx|ok%&d~dAz1uX!_C4&G(aol% zcdEI9_L_U{jnXk6ag^KI-OyRAmrQF;N)dq>S1tyO)J7riT{WhX85^zQ>(*-83f>)6 zGW=2zu~Px&mMcz*gy^WDF0|CY4btRixNqTLQuvs+%QCe9l_=`+n{{WYmc?j^y1kZM z+V!}2gHb4GQ=(e5lEWysb52f~b*4Ta4fk^4U+s%y$v-Qs{lJ&$uKs4n-97KWz2G=d zjnH0t&6CMgS5wF%__<|)4;E(sB+X7o?eJF>`T{n)^DDIjmaVV)e$i-JZR%!0>%4KV z>wfyt*-i5;ymoTuyiv&yXLbJhffwaJ`lXRK{Lra9_d&fXd{rEUvp zwy%$Dn4&aKo`F>qQE+1IfAiFqtv2{V3(Kd}(eDo8g1E+?%HRa?1LKS$!s_;xg8E8- z|JdsNemTCKsJkmDiD0fA9Jz5&kw?RTmxMfg+&O-aNlKZ{O63+ON_(bg<)l#OEqzk+ zC7tu<>iT(0|FZE9)(yUw$IJ%XofT09Jt8OVW{6NBRWQlxs$g}L{?dzGDvcxK$`LQb zy&tH5Yt;!bATuUHm>YS*bHIilFFYMrF%UnKGwJCAPvgX8y+6Q{Sv~05-y$X!LNEBpatdq`o4W0w4py` zrz0`ajo%9oypzUg3Hzocz0+XDDZ!RY5WH?AMH?_~ zhFKA2O0w*in=Wzj|uG+Gc^o!wUS$8Rj#tJZbV-qSUC{EG^F1l$h3}4i6U_!zE63AKpW*Iiw)?TBNxNR%p*ay?QfI3k_UmK z$K)>|*K^xW1C~2T#VKEs9Yk2`fr>b?vs!^8`+Ci2o52^F=mMy~B*vIeQ*{RjAx&In z!0LoO&nxK9D@W=SOWY_|kmGkL+%LW}dgAcnYFcO7YEcaP6UrKmb z%cM$%tLBk!1AMb%n=|zr)lekpK^8m8?$#$3i35NqrWa&uP&zMvATO*rddk z4O*v);s7KHh7SVr=^#PT)qqJI5>Mryr3mv2=!S-km}rh}{j{MA%2UW-*|3-U{InWo zz`3cQZiDL*Q9y4D6~n)J>CGd#Eg`(;-G8x&@C|u?qCSM#{qA-7ng)g2k!OE9@*VO~U{in`d6t$-QPRLT#EwaXJJrci;_lxFqhuTUC^uYfe! zYY~fLNIFt>bv6qV(pp2wTauxikyf2_#4m3nyaAcf50>W-TTAY45iC2a-xJ@unZ@-# z#^WCmzzO=etnf%XyaSqgOLvD;;S4QNEIsgOK>6Qy4fMkOcb5$A) zCkAh9DIpUAuVV{`ds~h_cN_5k9cGGSKxwhwvntq-Z!woj3ozoR4{Ww6R1N|vSbQ5~ zX`mY`t-nB_F*t`ZNHty^yzyh%TrTeoJ*K{ed$WWF;;*AYyECGjan54%zeU9Dl9pi- z9)?tj(pS(i!RzT8)Jh}sZ%hu*)2~vZiQ?!!IrJdObByrq;bMc<=d>}VNV8sHNnSL& z)p8C^3>GAjy|!_syD!+ZYLVIuy!FaZm|U#{U3Se9NNZ67>FI{jlTSuOxU$2GQnU`% zT>jg%6j@U)xyGj;JNU@nA?ZD}>^vP#YBjh9IkIx?)=F~Ij%YwOr3H-Y9)DtuuE-vt zLb#@`&-y4^0;Ks_DnuZcjybD&$%_nGpGihd(4y(!FB>y3 zuv)JJ-lj$J(bJ9YmY@DwyA?Xi0xFOsc8~i>R5*+{C#ugU8&t0w{F#UGKm*kU^*2#O zDJ3JXxzVJi=ys%q{-WNcM2pd+{-?#-8&Gt_yG&Pj=3(Uf5|U;3MDR2&5GT4&W#F|1 z%+$^iuFY1o%l4aqIN=~dS;+RlL^}q%%=>i+eC}Niljjk)*ogf5)gP{jHoX#`70rWs z>3%u*qkPr|3QC15^s6Ky#--1e3*R?BJysEUDWlDZgW( ze>KihVxec}fV?9I$3rREe*uL!UEVJmc?s<0SX)W7(CX%4>8HW=c$jisLzX8mBXhsO zQL@r8r5*i_+nlFOzrLBYqVlh-eYFI{dIlV%cEP~^fu;1IUl97^!eYVbsVvbuPsAM; zGkcu>5@lo}el8+!*>jfBOiG2VCH}@ZMq^=(O0**EaA1Qd{EE*j(-cqObuu2&N8N7-j zlLUvJ^13na!0@7#6Am|%T|e__%`v1TsDDxqS=XE)sS66*2@vU^oL4XG&QUwp30<8D z9j#gzlcIC4OfT0}S!AQK|L*1J|?0kyy{F=5@N%n?it`qT@ak2iy3Fq@Xj0v*l za=Nu7ibk5%mRIw-`OS&8pZBA)kHSrZ+dLa&ux*+4FlAT4g-KPp8SanP{~KhWz%9y(G$2DpYw zT4IY7i~ZQ8IHBwPZN{cadESAyI~`Q)dnw_+~TOTvfyci0h3*)!dK6%%CO&XIo5@r_LeX1>=> z1(d$8gQR3>AcxJBZ#I|b^Xo@*q6^9=ez+XDZ`eFTI0mmmD_&TJ?ZkkcTfGZgi} zi%mlwiQ($4v;YZ`Db4OCoP9k!0?1jN}D)g2w0%@xNy z5(TR#2UFh<*>)ST+eg3ymW;R!T?o64xRz;nd_5{%X5S6q#STz3Xt2n-cAW0@#vZr! z+46$Xib82zoz*;9{6MeWKezFJqf3uS{ik^g$Nxx-#LURa@_$#CYOtqbfh+EF>+ay& z(+(H>mmdg~*p%$5rfDY!m~VEaU+T-g{QRl%^DVo0F=J@rwiHmF{oWtWK(Enk+-=pnz@e$GA*ixm!1hj3VE*`m$fcmWfm_%2w#NQ^Y))~5t z8t5dy1BDAi-2Z&Lqy9sy4uTOtp$H&ua1YlE8!)_bGNCRcHZCv3)2F@7FGeN!_BzH- zr}YjQ43{k07=b!aLYo;M5MBV(s7N=c-_ZhC3FrdEf}ph-9HD%wESbt_ z`(afA$EF$e?O(|$%Rl`VZdSYjFzQ6frI-8HNVsj?v=3bNl%ptpKq!$C&B49q`RRsq zQCUaegSFL=dgro+eaNoFOR_6Xfgm^pcS7@yE0Gp@DXvM33cvS*+TmZ&dIv#{&AGxJB!9`KGWu1qam0Tv2r@7P{Fc zg&+d%yom!8SdjS^xio7-^0JJR5S<<*(u-A-n)jTL7GLFn7^lf9cqrWW8~OoOBntA` zyaPs6`2U?6?7;eR$a8}r z3zu~Q47lKBE+huDyKhXJtA-rPZ+iE%KDq!$voX9u?KiF3Kpje!MDrlqq&RC^>)R%p9f-Z4wmODD z5QI~KYGqJOC}1o4ii}!PPX??hZwxzG0INTR>xf@k#%oA9BqfO!LnDKE z(GoT+p8m2S3(*uv6>pm&1g^FOILt0|cH@h%KJrxfCmNXJ3=0AP8CeFEchYt}HdZ>H z=-@KXihtxOhC4+|FP*3kWD_;+KUE!3k2Yq;!;Ee#38BV7E<6kfMY{A?5KZbGg&`@d z=tq(p=7y3fCwc3x0qe?dCDu}BxZ(=-%)4^gUxF0-r$9@GdSNb+qhiBjUXuEb#g-cY z=Pv$HHg;J^hk#=h+c3up8tYw7M|76-72sLQQz^zek4v<@!2f<_nkOg$!wSx_?K_qT zLPC<{s%JQ}OYLH%AP{`4lukN;RDI3b;we^*EN8Cv02bZQRW>}98Yi~P66P4OGGIhs z^@`s;8d6-h5JEBXBa2YfqFpJY)U^V7oiy_Lkc`%UOge;p*6V*MjCu{Ql~A3obsSNT z={z^Vd-YLct>tq$kxnQ)b>+&lF@Q-e7Wz!pGRdL`&KH$`S- zc4Dt@)5L$N;TsE9qV7w`2S{0wY9>0BQn}zUEhWP#cpi}VEU(kWPe(sv*Esqu<2fOW z`g(}Y%OD++-alIVW{|tFMp34~R92CBZ5PekXnj2A>-G&=S8m5+~oTD7LSb$ z;@Oy)*E-aih{Gxai+@>BIB@W}-elqLW{;z`wtraQm9*A0ZM99(^I_mFb4Gk5n!lilo!!#BVGx(2dFVM1a?sW?K>Z5bO8tpIyNXoB zQu3&$6Ti>XHZjvu<^yg{&Uu+vDR4*&)Jx}16;GneQW+FU2|hQt&|<<}Vg)mmRJt&L zB2MNv-rmn1vFoQroR_D{8}*MZ*Bh|KYR%6bbCVv0kWMO0LD_>RADL}qm+B3_nXw_abNaV(z$UFdP;p*j!`0j+yfMhQddxVs@?=l!^<$b&MX@t%h{VG$L5*?U|h^(!BN z+}IBev%ac}EElnc_8ZRNVAU?sjajQ!y;|y&+AHDOXvit%l7!JR%|BRR%hJh#NhY3p zfSEX(8e4ri!olm=gu#z<=hS*T$j80nSI4Kflj?6sOcOLKOnYz9Jv!pj3ke?)<8H??6cKT~k9$TsfpW!hfrsfk_37_c33=^V)(Yi6A6 z$BK=tK5qh$mDe;DLcvTzrQxD>q(nz0(m0DU0fCkR{ zzRTSeb<~vW>56QToAU~j2FWO$Mx)tu1(xy=TG5=jH<^ohP1K)rPTzc~9Cd+MT!iOi z-YGRvzD~t7*jnYfKVcpjsnaf|e$4Rv&TS5FcE)!*HB6`A(VQR}3C~tyoCGY@4>#%J z1M!$&f&+kn>$(+6*K23D1sJAWHj=U*E4D)W6<>+W^cn0hqYpHNvGVw?m|(BZNlbAd zand$cGm(MdV=KlmxooE?H&rEmV33e^vhEFD6^ZF$6e@ntD6}W5b=ZU>anpXC(e)1~ z)ofz~fms1>sh6TW3tlv&^!Q`bJe|v|(Zps0RW%0=eC4o|AdP0YT8&NTc}C^y#Ro@w zNg+#qphQnE)r8?V2_@~wnN&J~IA2@)Jf6fUH4xnLfWXG1!TLMpTw;#+}%O*07RZ$jF} zCTGxT8gGyiN5I-E;MzKTaOe@#bVO7_01e=^qXvI%E_$0ht zxbMzJoE1^mck9B`LH$C4#mafar-VlrCZ(?e&`<-c-m_$<^PP7f2pMaEV|uWtXeVTE zizXO<%E6JDSzC9*ou^Bz=9)NP3HhZ~Z$0-%b#D?$%9o%x)8&tAFC!F@9%+$ z-|sd3FEE+fS?7P4oN)Y?ILqG13hJN5>;F?2V`cqsX4f8_so2YQ#D9gcFW{PkEFyy^ zA^|c1x1cAw@xirJ^CZn_sy_V45pmUoMABDL2gid{nS>D|UOC?5sXTN~#QVH%57&D- z8Rz!x-*EOHyx-ql-=F8phpD<3q7f94__VsS6X8us=syWoiE_HVc)y)cgwJIt>VzZN zd?AT>i=~%uuf%)E_kZ4+FZ1T!_Nv<+)PEj@EnDQCzP{ou@4Upv`dqT9mMa#WAIOfz zNq_o^I_xYzxZrb%XYp6FULRVt32?%Wzz5%GdMh>hIel6-i1rSe_vWWg-#y-rI{fc`rjJzV{*j0 z-*${MGVV*C@Bf`H9sWF=!SIdZBGbO<3z6i}C8>pf$TnzLB?q8i#Eh;HuJXFS5iTEp{PDR z-b*8;kqkB zG;M4G9PAW5WdgYmUZl4@#2v3nUH@FYk8pp-NXYk?mUpx8zGBzFDEei8zc+fp1I5~Z zM`v&jl=iP9L*{;XMC)t6^zpc!ohK7fHxJ@7)}vn3JQ+bfQsV`6iiQv7Y)k_G14uKR z9cFmq5pOy5Vgf3jLG8XDx@u8%o?m&Th{qTLN}Bvw936$HCrjm(7A*+_#Jh^~x;A-1 zU|NOh#jv@FCaBlswR{5BSQwZYtzM?% zSV&eC4P>vzC|G1cF{;*g2J1Zys0{l`qWYyh-gGAvvBZZ6GAD9b$J6!$q0Q3ab$sc^ zolk>XpO=MN;wZwJbh*--fg^$tLtwH8*h-Auw?7hFK24#v0WX{QIF3crc+pwd3D5G3 zSzZG(ihjYZz%8ppEv@-D{~NVngZ3q!<=^RZI!nVSZ_w8EDdU|1Mx zE*1xj9-`0X(@Fb=c$AZ}m#c_RE8bGNyr98|5MWp`WlpsR4`e)rm|Rg*?37Ou^07sJ z^gJa>$dNni28TR;8X0Um@7w!#&bs#?1FK;pEWYAkvk%!N;jqFkU*TUE2$N% zb!>BD%;OVv_7D5aT8C#W#4a2`c!(kz z)+BGeAA5&pDeDav41O4s;S3e~zxV|*yB5Yf(S`1Di$}e4nAEsnisUxXAZl!ilc500 zsu?dt7EC-AnH^1`+(Fq#2JRaK>=fZ5-3Ry{H+oLuq+d0y4S$tq1;;5JBBbIaCTfC{ z%FFYM6&jmcgV|U3FpO~^_T8gF#>)Dm8lCH?) zSXC+q$IlIXA37B@rH->XCcx=GNU#SixLCL|HYb2vw!}q z&2ANG8xYubJ!jlIXzE2bCdDbrpWo0EHv2RjC_~BhCo?!}xTK_;;usO6z+}dNOi@F2 z37SkZwo0kxoWhYvsV2|uV%)^k7nJ);q(z?#k_$faeHq@8t1U5P?u8AbQk>0?f?1Yuwah2sSu25|0(+6MyqJ(tZ{d5mnUN%~WT8bu?wbWCp zW+9a8_>n9{RY*wicr9J8?uC$!#hbEj>S<~LA{U6}X>B68#EeIX!Io#B43`4AYQE2E z7>x6d1S_W5z5-FtjDLs;orG9SlVgE;0#~Z*WzoF^K1wi3#ucWtw@N6ds;A~eg{U>e zeOXTcL&*S(*uC-PkddNPj42j-X27PH;GK$ijN9XdqXvF}1cT5he5l z`7k(?NvNIc8^^mp>IGgJe}T+XS8xZ7%V}HtTcp+JW`JOzB}nl2kfvh~l`>0XlR#EL zt;YYNroejfJ5UolIDooKkTpMB3#eHGnE2-oW&AksEX|?Q8?}kPOKdZUUxlyAz_4}&6=6Wz!*xgZ6uz3`xjE%fTp&0Dmx@M=;wIEFP*m?~%roioqd zHYFWZr1X|0hkk@hRtpfa91RQz^F;NZprtZret-9w<<7;fQMzU+uuV3!yvdHcZ6I^} z*Afzk181h{PN~Jv2aur^;L9R2uvhPg1~RGjC!YHF94E7EggxPts8s79s&2Cp!6O+q z*oiB-J@c)aga|0%&qAG%402p4Va2^?!gv;n%T?p(v!IbpFGNkmA>r7fKn-e4aclF&e8(5)R3`2LO{ThjPaMC9=qjwnQI5O z5RmingL?ZQ=I_b@2?xoC+=CA?q<-#SZQT{tp}aD9Q%25z+ipV&r`0xLE+4BP&bi^H ztzZBw@-z@}v9CyjM;gJ5?l0VEOfg`HYS;);iP5kAFSM-(of+FV#qlH}<}PovZL;uv zXl3ATWLn6^yOz2%s>#YdQJYu!hO!}G>Jq?0Sdif?==7tUFioT!CcADe(ew3-$~w2* zsCp9b8Ms4gzH99kLGr5y?D=r!B?YXJC4!w8eHb|7N-p7sigr8c>2u}B)DX;%E*&jfEb7_Tl!Y(95f!OHi<1HPc-YLKGq5-5sL!dLJEh& z=9Y2d_67&DA9?Yc)Zeds&LWI&sx??5t-A+GL9X5Bs6a8yeg@1|32ZX69qe8c7Ks-F zjh}_pUPK`D+B=SJuFORWZxKeV=C~SFO#`Ec*FCf^QdRW2kKAJE8w6rg6fSBx~)2kiQm6_jDyam1f60${P z+G7!qMy#(*3#ly78YB=L*o2;-8&t&jCT~*7&5}7P&!yt8YB`7wB0Gl?&9Gk$glN49M&9#h zS)R$8T7RSl4pzai9kL>k#ZzhGSP4cS%sISophq2O=dfyXB1C2$3xJ6a%t6H+YdxW( zU>1!sl>xwytZXZEZHw*R=iK(ux(J+bDHeW@dCO{!#=E_IftoyUcHoprWCh%_g3a3q z^P9YnYLYO4saZd-(au(pL|-@M+Y+!P_YmjvQmHdUZD?VHpy!Uq1{|FD`I5BeqPfGy z+{Ga(A7ah3_fL~TwPGwk$1+ewBG(*vuPnoNy~3ocaA7xUW2I1u@7`nJzHFEAGfm++ zCl6$muvHI#Y{6EiR|1Jxfa!Z@DH0AGv2q*hatcN@N?l&7Ze&AeUguyJ%3wg<{H98O zQL&7#kGng3JZQ@{#=l;^uN!`N;PPsJA+zD@hDk_%{u#-wzl1ry9^3l9;EhynUj9=~ zWcwfGL`IH(sQLfnsP4g@s=aJ=-1|4^(m418#Lz>rfO0{9x{9Q`BIe98OHlpOhr&r> zE+LiblXQ64zsB@WwE9^xb&Kw2c!1xh;n*-LKdayS2O9nd@5k?&@At#?{oLI5z~*84 zacb?->BK8>TCY959Wkx$U7vllz1!K%IJ@I*0;JCww=e8>?k+ln|IgaxAN>RQnz(&( z?>;C>HG#U%l(CUZWXvCOUM%Hrk-9m;p=+K~ni>?nrXxm^nr%7=QzK4zlIflzy0_)l5L-~M5X&#MkpkX$ zdYzpsK!Ltty^4YH9L(Vfl-Hv;nrW-oYRN{UZq7KK$@6bTb)h2dZ%~sMP9*MwcAlx#KQIAqn=7)uUAg1kgNbw+F zsimMkwr8ib6D^ZNQHy{BQ`-!>=^GveNN?b2q%A8ACLo^JghEZXrO}L+*ek*St%O`w zYxcAJu=7)z*ZWL()R32WHYSP|H|mr^i$S)71r@j=kT64D2RtHLa0rp<4IrLxN##S# zl|&&zqjrcvwCQEe0j9RPNwf51k+_$cDD(J7Q)jtwaT=w1&OyH%>IILehb6>JTwoUO zzh^>scpOH8mku&%yJDyEQZ0a%OP;Ewe#%zCDp0F3z8-iM_H`m|=iVp3Ih3{^kYdt< z8K8dk*?H0zDar);$?iU=DdeW05~!#jywT$8d_OlO3}RA7T{iD3ej%^njwxR*qa%xUSTL~-I) z%_pKR(HIKZ2MtaSX5my&*-Aioy)ht3Ruh`1^g(t3!U@p{zu;k^5kd(ef2#EJQP#+g z5raC}BXzP|F`Bx$9rlRBkgU(ewpmi!>vG9NnYIlD+Dmmd0RuJcEK1^+DNCTv&$z09 zz<)R?UeCzb+AZd4Zbk&P^tO?0 zA_#&Kw`wXm6ns>HSeCcoC^irHprD%&%(NpVz{mY(K#+cm#(|HmS$yesz}^*{A-*fr z*S9jj%y%-w*2Z8*;FLPUP3d&mcM?0adNPw5A8WKqWq}U`3NzSDd=p#(q?*t|H}(oI^R=-EEv*F~DTdkn$*j znymd&5VlblZZdkw>@s|opO2a~u45i&Tl|T^0X%rDBvLcdbs{KM!828<-*J=v)i2;? z)3@b~tXo7EQJ&ZOcM-yz8*$BGKCEAJG= zEq5V-?q+b92<3oD;|~bNtHPr|Q&EsKi*IBhQIn5=JKD?Ddo76n9Zgq<HoF#Q|1p zqQI3vw~lwFEqSPF4MKaKrUeO=gG(tz!?~mAi;g^|t_gkV>x7r-kNBJ1`q-H>#4GhI zf^rSWukOvx*g6Ii6;&j1e0tHpSl*9B56>WtV0PeraDiMD0#|Tsl5D5k!ujg)4t_!T z&Y|d6l$+S|_?_!m~6JqPkJHC zUMpzAwSP_CahY{P1^}~pD}Qq*dZBAj~~i`6M~D`T*Mp(CU^BGx&lUz2YQhp*WiN#dEe z$R=Eic;*m+j53xlpMsA(>d2$3@UL{|Qf$ixb`umm?UaSdv-EWB+^+TL<=dnyOcNi}{$DV{Y}jUY+yHr}%(6g~%Q+DmoFowFT3u8h38oR6Ar-?nc)chHO#n{ui< zdo%my?Cc+9vH!)`Ic*6RuF1C2wr$(C?X0wIR@%00+qP}nwyl%hcYB<^*iW%m{9nYJ zw!4cO5FQ)B911V+WW^oxr^0MoL9c2Xe@Pnu*cS+PN0zjUB54=B0&jmP|0q!5VV~xu zK;$l!7I84y+5&kR-u+RQmWgQ|T#(#uhPFp5kKb`h$Oz7%_X=*5uD^4U`CI54wQusO z=j+PcVL2*YvL^<~V^S~!!)LX$P|HT&8C5oQ5|D6+S##&9WLcrZKFI&Lo81b=_)%#F z**6A7=Fj5xKz~a||G}Wg;(0?M!X9502kODEE?7&DvHrJgenZi}z&ipTNW{&#*Z^8` zenZ4A+?983E0&9Qt^#?}IS|t&K%Krp)ayQ8ipy3lo%QTizd>m|Y=iH!DG1q%ipTy) z6lbsq?{7hYMVqLs=tRe}q%*LC8P2saXy27|Ij)f&Z{76oHvi>cP>+z0uM`va^SBOp zxk~fUiA;cm1?wGOO&{?Sr%Sb1LSvE0%*^8hn^@jzT#DX5jf2bE3z)ZBjr@Qurt;XE z9`wF3Pi~jbuB)elIF{{yH*3dG4B9^k+HO7fV`EsPzLy*0Cnh#a-C_kDDSD^KDk~{V zS-F-B=n|rFL=?T|+d5cM5^PFRBLg+_!b0Zh?izjh%Sl7iv414s<7yWDm&xy!f(LG` zqP`~22okHoV$SN{I~ns%KZuPtn|k5JkJ9n*Xrzz*BP1AlK43w{Q>jHGyK_SBGl`vG zi9dteKL}Ps&}c*f__A^>NCQ#oyT0bI5&~~_ApdH}4VOe1BcszMbGL(DkH43}OrWo{g~b^iE2)LL5S?%JL=qbV2}};|yl}*;^=y zy@e(HirzutLHb&+Z0^|1b09d3>j1{2a($e&5((HqSRHV05waJDL>UnM1%^~|RW z511Ol+YCzPe@h3TXkZANlWizY^_nP*g2I=>AoVcbebBma=`IA`4*#nY9)L01P|sn% z`ncy$SPrA)d3+U2_|@Kysd~RH$>_6c1ZziWq^pk_*gMp*7tb|iRw)=Ih1HKt_1xPa zIt~te3m0V(Tfot5S!IQ@8k(95<{`zaka5mMkWi9euKnu zp)$udE3o6DXzbvtuc((w%0-AMkQ0J7puJ%Aj=dXUWna?D)CjRntHxO}mQNalJ4hwg zNfJn&A`KIfe0<|?ENJ<54VghJ`dvvkZHO6P?CZ%j8p}0jj@6BBh2qNzib*-TB*1sk zw03$V9fKoR@-{_kLw0ayOQ|;0KUW2=OwRZV4W2`;Q7gO4Xo`Dmj+jQQvQuqd#7e$~ zw;lG6CZF}=&bJ;PkM@t+7CkVL`%KtFxtPybB--;$WsbJX0ZKbzV*zu+GxLVI^S6-- z`JT5*Wab%?hD4oGHAG;YNgoXnS`_q4inJ7`=J(a3Oe8oYk0)VwhmZKtfX%f{mf(1l~M{rcu-G zZ|S*vJb=kzxPiSU_CP4^1{g5ELK)hHG3*|o>P4Vp%GM*l;<6WUi1pR9f?Bml`jN~5 znUA{~Fww{ILsY}l-+15$T6?UJL(5(%R8rkj78wH-?|ON2|BB;Nqe=R{@u=)u#hd#eNvW zh_I=G6OY1nz&A!WVTWA8BlMsk1H>t7%^S7?*|ZVd>nCE(h^3i8^ao`t5#Ie#t;*p$3--pnp}KCjEtWTVk+t zX-Ix~_~}NQIRGP-UB#>sMyNVUX#@789GL2yi8u?l+>%vaC3acc4FtTDg6XM2wA|@} z9acHKSfWf$Y$7^W_rJn2ZgnKjQ$i033rjo|}3l~@wEWL`QjY^<+&xb#%arwBHmYB9z2;k*g<A7RX`*c5{rTjYC6g;H2q+{2*@n_02w! z=a?O^hf<#4RvE36$)u~^XG^9D1q6Z3Y{pr9sOYd#RyLv7X1SkswCZfbcckpV+fZ!d zt+)Eay~}D>6X+CuPr4PDkKGZXyPq7y?`SlqF#4U4HE#!bGilyDcsHC}ks&Xqe3@XY znZq^t%(J5ZB?Q6f-AL+gQtY~6QoxN=Z;CHK%DcRM^2h)fH*!NXdx&U;9SSL+MnO2Z z%xYiCdYd0MAJP~v*IBgmkhZHZQ=*(yT-OxI=uv1a1J^5Jl%Wj`%|?pp)6lzb55 zpohaNCoAPB^*|@w5VD|26<`kv?o!+;srr&82=h1vOyBSFGt@JzR9*s6Ob>Sux?Q+a)Y$%RzI5NDcJNcCBntd^MI;lvB}ZJflu%3W1(|R|}KXMG1fF zbrL%40?Uc)l$*A#+0Pmj7BrUZYWlrfb0J#udE$ZEp4?jQne}b?>1xS=^DI+3a9ZWJ zh;)lh&Q10}9$(7&b9nSh(jG7|vTWng`Yq;2_3BDzr8)MoZR0buCXun-y{RuJXlOny z_m_%i2RQHW^{Q)F74eSP=H{3}{F3pHtp##eEUfJJMUWLg7+gAZFN+n67le-5|ORF>R=j24p97T)dTTWOUIV3NrV2 zGBqPpm$rK*BMgxX?l2ZrNjM%wCpNb1E#+AY4Cy`wXJN+P=`EJqTN4d)D$`D>gM+T< zecEn$OT-`3d^BQb#gh_fowGyb)FjtPQFiO?V?Ao){6x>31Qz zvz}A!c$%S^)O-?@)vLKLNI9b;lfE|YL+bcZYTF<(3>8DfA5?!D=>s^-KF-RV%!0#y zy{$FfSX{IlnfqhfFD2inn_jtrc=#FH>d2l}W3q4^(8pK*4a%dikDboZr@p^DPgdam zcjkZis0k*c>2>l4)B|RJ22jl$2HVD~8D61*$TkFJWbD^-o8$z4J7rb%`2+kJp4$w# zv$%VT+ZF{dyoUWP0`wy4qWNKA;Iw4o+4Juz42RzIrU%8qqjPSAvPA5*0dQgK5a2XA z)=!e0S+GyY#jzj%LIiAXNVw1tUFj;LsSA9hnxxNUt!U`0?KFD*wq95$wh7X$pg}dB zhTva<;3H1-x`OAtOa-=EI)dSVDVzVeo{b-JZ8O0bS^`=}U*CIdIztEZWOF@E3v&nv zr6sNl4Kf9`HlcNPq8@4Wb6a8Vg>HWqv8ujD#f(sog;G+V3=7pK3VAHrEHw_{(zk3r z@S5(H5s#+EH@62mmu6XyS8E1GP!Y{J->M3{0JoE9pb}sEw|Cd5aQ?y6Z3v@&@-)n~ zv;OqRVLWA8rV)(gw$0~d$L53{D#ANx^1*HHb`X4*OsWIqY^#dth;S(W5ezzftIXk| z+ds#2#D8t0_LeBFh^-iJLP4@}-C;M`w=u*YZ2~YK%=r>&)g9OJwpu=SeALlL9jpv{ zTs%CP{%e-KSbsi@k5W#@aDEJj2P7Dvc7NCcaHD=aM1S5ka=xL2x`hb;kAGqg#{cG@ zn2CYqKbX5+niJJT{|gHH1gf5EAO;9V17HNG$0~FYKl*1fDn7X~6i;BSET=+5+Oj-p7jPUd`K2&%Yd>Z~NCXQ=eH23Cgp9m@B(Q z?>b8CM)gMvSib5Xc8a1a^@@af%4Ip@NA-_)o*%CvOUfTPQ{C^)d!N6wdsTM4n3mzW zSDuScdk#a#JyxhmYRWhzbew!{6F)scl~O1(4uz4_d`S^IP8*y2dI$z6P_+Hyn0Dyk z6mkzqH=G#8-FEwr7J7Q9&Or9gp#x)QQrVkFSiC(>IIk&q zE-sFB6zP?;I#xj=ae$q#d={lg>kA?P+VByNga~ zL1*Z-OOZ<*HWhS>=U zg&(J~yKs7>rdQ=Xk*>b9x;dhO^h=)1>Cik;*Hr~HwDl+}5*SU~WDLbGI6yz>#$7`$2CW$5$%tG-9y6;aeO6xJG z;6s)*{H-c$D(1jtl_Ir~oaBZ_&8l!qlyN2Z0puFGb80wNh!x%bMl61Y!!$PyBvlc2 z5G~n>y|EfK%GNh~H3qNF74yoVNDb&6-*v@iw7Ko|xCdknb0-B&6?QV8qR(+Esb&)@ zFPAz@+LLw3QTw0{!!Lme=tI-9ATgLr;1~)95t^<5&BSx1W!-OkP?&;9WW_)=P+c;~ zuc{?RnCX3L7*G<{wrg$5h*YOxbFurqv)5RJwJ^9GN?{BRLXi-HLCO6HT3;3$xe0;3 z%m$EQRYJ5=SJj?G($tzYHtI=U6U}_YxI+ig7#|V9TlfW2HTk6Bs(R_($TgUv5HM58 zmSG^ZCdmAC%lLBIuTyciRq6^#4$i{9)m7aWYG)({YXyD>%0O6pEO=ePR_qtRW5Tzm z0}C>~KC`_FV>P$^6WQ{j{DssEm7Yx4!NgdiriEXDGGo%K;vxMhJ^|ZRMO3*ktLFFX zfMM+-i8_HSMgYLM)Rc3TO}DD)H$^eLx07hHpTiX%*K%K445X+FEC}MTvxc!HOKYU` zGzBDcjfL6(o}~q@u;se=@F*V5Pu*e+pmwjaNUL*wYU?3aFUjFh4{`CvPOp8SDUfLK4bXy|W>f2|n&}uGyUiL1 z9SAX6i1r!^YI=FSjfMrp<^R>7p>Q`O=|u@UaQcwb413T6je{SUxNzcN0qc{zweRA{ z4&Xj}r@cgE-uF&1_3%vPb9t7?7OLs;x^dIZia9B(_^KB-JsV86MTtLQ&lFytX6GE* z-9d>SdJAA?2SI()G4@E}9dnu`XEO%7l=lqxV=0Y}#Oq=}&q~0bMPAgGWGp=(-f0qT zYYzh{RKjboQkYLnWanVbCyX}cUJB_Dg@d6#qnJ$F?jIC>b}}tVJG=H~aqccB10G&Y zAnSe0d7C~s8eerd zgEezlis_dC8~-;pasWL>L5um2;r`*xD|CiQ-JaIto?W*W7QotKFZ4OcWeXiB?J2-L|CWq@h^1>#hBZc_XQWaCh7OlfcM1!2$+^OeA_Psn~0DD2)aI7yh|`2j-cW;N55a6`#| zW6`)sRr}}pz|07>(zsu8-pkmVOwY=MZBDWqc*llN+FY5=%@f<|WBOW#yxvCJK!dM0-{x>b&!}k|qyPtfDTETet%;F`jy;N%E`ze`>drp!jNJ9* z+Xz4rottFQ2{}}U%)v;535WM)6?sqavXHr09%(mnqgu0Pbia=acL7=4YjVz{;~>Cp zo;4~ULd%S+FbV9*9BxU|B?0}4$>^&8d~V5e0#<+UgI5e)x+7Nnfwn(#Eh3mc@yHcH zACp;_XU#SfQ#!E%{msiN;d)!0f4x35t@w_*jKtp4CsCOcK}oz3Prv}BWrXF>066S5 zDyQS$tLZ|(?aO_e5ke-ljiL|2a6hb+@3xz`;L zDm@dD3d>~|k+frSahN9vr={bl@wz`f0?Wg0@6um{YHD3zg)>M0!4_Pafjzoa#Ce6 zNAjC6_6*~Zq|R8HOYfw8(N6MS7g5OEQJ%5&AGO&>Ov041B$UMxb`FHKvnzR8s}`Ed z6Ytgfgm%DrSPR9CyQmGtXzBBhc=L(JUOI(wZ}Z=|3#STy!Nx5|J%|ttO5GoTjF^{T ztMjona_DV=p=C3ja zLH-G_wUOg^B2Ni)OfL~Bfe!k>tYs$n1(*^(iq4U(I~&8C__^ut%OZTuVc1%sW#_uh zOV!@NnMWI$pxJOC}fq7BwYVHiS+ zo7r2^?$1-hsL_J;_xFV0RsHI z*F7hsS;)2+OZe@r*&t&4&5-l&X*`KA8 zy+-hPMfCchsysbbO3>!LRV1q|2B($6;aK9qyTVYfP8FJmXYRbz#9-bvajHQxFMCPg za)mQq9!pfZm+jN$Akev^!EvU~3&&K>AnmQoK)dDs!7ew2JMMj%E~lx(SxqRZhNn|bEsaRYo>_q?o= zMLHmHKC3UfcLZCy6u?0;koXr>Sj8Y4J=UVDJI2gj4t23xnQ&Ny=%J z8i;Rp{VU$#Ct}Qy-a-)as2XIRCYU2M2CI219iP>KCpkNEd|#Dvy=f=7vNtaa7|aQq+5GhM`;Xoq zBUmT+biF(5b}89fy&z8S*x%iIT)5wF5z#)|1AHjDdw-uDP!$LLu2Yx_hwq}Gea7e$ zYlMot?Sf_YN_uj*6K2`U;m8g_)EkyxZCe@rH73@!Q#}{$mG90BLy@k)mS=l9Zwr7>^`N5{3 zu2IG&5^xZ@S`TY6gU;!da;@6vb1hc5bx=48{fe-VMK1H32OIPzB3pY~0Wps2V@em9 zC6YM`FyJgKVmYK(TnQ&nkgGI0syVq%vj z{dDm1qR|;wEzFuZ(^8ByxHXcQbD9k#SK1gr^3wL=5mooiF{@(zcs{FOB9e9Bx6}k7 zh)U0Au2AM0zVk6DCr&M#Qyp8V{ftM`22F4jPbs*v3aK4ozQ}V@XcTfzYl%^o4f{Qi zUU0sX^_8z2G>PszR>_*ftew>=+Mlirup$h{Vm>*V5%7#B)B1re13Z-jvLCbQt1U2V z%MtYjSf|ue9^)W?k=J-m@1=VOV0xsM5Ekb}`Ii$XybaPOnmY%VmOMA6V+oZe!R0No zaK=3Ib{Rqs(gZX!LL?f*R_=dW0b95Ck>AvRx>Ia#-Vq5VlIPFJ@ut;d!}&|W*^&-rR~K7olik;<-vvD;kmtIX_xA~EYx$I!;6 z9M<}+P?b%vaz81#I@!v&9d^y!#qLU96x`-z`*zkd)7czghG~7a$tFHf7UK{9IoMyt zbeCaAN2#|~6IT9)O_2b`Tk%%DZ6hC#TYcbS;VKWo#E5kr3&gk^U65G>5FK0WqaTxG ztOlX%^l+ONC-(zDFg3y|4~w%Ms>moUz?WFEo}hb%I?w_Rh_k+2nOVb&(JY#0sRD-| zLRH?7HdV@dDW>1R;=5JS?wt%tZ$pYUCx{8XCLlTW>IHj8ArbdrB{6%Il9Ycmd9ORm zI_Jaq17~%{7k+XAIg2a@&ZuRMkol=1uxY;A_cE>x`Q9fd^>gM+%i<~Tw=O3n0K*cr z4W10REu?MsYC6UlmY>gE)q z?^!$QniOWncPtK#MRhjg#Vr>?u=BSR7M9#IxE?G{@-mtOKM|`GOs&hYX^(4PFq%-Y zay$St;F@DmWD?-{!f{93^@mkQi_N;$3su{-QI%F~rRr*O>Mzonq9VN_P*GoMue5rL zFXEWUMFEm=SNB@lef`PkQuv|rAWDR?33u(=cH*h%g5dlC@j$9&yb*Y@ zUzj_|u;5^?*lfR99%tYCHghUAvj@2^p#{c_p~d6Z$UX{98t_vvu%GvMlZ9@NEsM+{Yin%+&TQo$}hyGYmpz)AhaDFy;BX&!lPKU*wad=;g=k4syY`^NW>aEj~ zRN@v>EY?Sn(SFLMJ~F$~^Xqfzdn~@NH7szG6_G3!z?MVg85A)_dZIp&lfsjs8=r%N zIO!zWcNLn7Eth(0Kpb#Zk_O_F1-W?j=fQe4wSTkVdLv0k>?xSp;U^UCof!pQE ziut{I&9yc8!IF2#;{1aD8MP9X2-F?Ch>1H^K(r9k$oO9?)MmR&thtKfeI;^XQHz%? zT}g9my=W|BC{4!KX{K$_(Z9mD!e(hnv0fKra36w>1?Qr$iSuvN5Myab7(2WHJmPX! zs;J`-X)w5z4WSTe2f-K4AEnMDjbdur9qFnP2Xc0^?a{t27M0<*+-SyM^l_WL=B3;Q z+>pJNQ?a9C_r7|sHPxdvo8p>hQCZt+K4@6jgs1RD7XPvUYc@Y?Aj~#{HUD(`_1ZtgutC55uc9YzMW&iZ1{5di7V;zt5z)5t$k(TF z12@^IO>#t1nJG(oe6RHa_lH2NBR3kAtdnb{rMDv}fpda>8;%1}yu7=y0y-zyvbX^&7pDwx)Cx?cInZE79r|I(esY_-!i8;@Rde)&dSQ%J3H@h1^sZX>1O`{I4y84~j4wlIFx9 zDMr`PBs*FN_Gj32uoh43G>#3@sytkPTw!EtED}_R=^q{siZmF^#jY4&gD+z=M9&;U z_txISTZu0wZfzzLZt0Km5=Z)j0z*c+t9|OByE5zF`GPd@q!^mttQ7rHfv{>6c5vk- zEJdj*k!(8z@D|N_BY|njhRD|0IaSU2k1g{2Ts}@3kiiHIWpJIE**Sq-9V*=XrA9D+ zDF+=YE5;g5RU~MuZ`*cXSRATN#3}ty_f1xlki7r-OE85;j*~SmD$n)feU;Zl6^R>4 z7pPWEc>#0JJ0BNCP{!J;(8SX8#jvMyyP0rjxun@~jDO+9lqp`V+!OpYLkSwnPRkg3sWCXEszoAqij5DLKb_ zt#=8408TU(4|T3vfvwtcs(UOs=8*mLVtNzmOIfdn{+YnEwBQ*OzlVBjLYKfwt$w&= zsn>_*`V+A4#MdpF3?ao(z}it0XFT8wpFJ~f?HKS(h}Bxk8$FL&XD80Mu?v;;8-4l&QF z7*#e%{4p5um$i3tpe+Ei7s&?GMbj{mDt~0tZ}{LI%i#}IDLyZxZrW;P46`ZdA+Z3T ze=Mzxqi#criFx&frLpJ0;El>`Yhu=Mb^k{g7{YD_%YA9v1DC~{=F}&Em_ca{-^d08 zBqTFKLoc6`OIb3(MMDrnot! za#Y-{4cgaQed5(CHccx30mbtKZgA(a| zk`=qhq@>Ge_hJeq;$RnKakp!*;#7|lHZv~rVP5_v@dcYTM)+zf_^p+Z+ z?$&(}_X%#u#^N4)=^>oXdE8h0H5Etu%ZQ>g;J)c=ZeC`2)z)EmEi~zfJzD^K6{@@X z-u4)YX>Q9ytx5mkZ5#k2#G}O17TBO-SgX|J<1pbbLmw_ zzh_qmeGapY@Wu1>iLrwAUT5Wp=k%;(oX6ibA0mT|Hb$nIGdlsy!kkX=>?GL+$EBtF zVfvDC6^V*rx_{8ml135C~Tc&%%=EL{jFH}~t z3OkffhXC>gvogevc|EUhM$sZR^fQK+3AOh13S-sGF)2I6a|cx80xLe~=)~3XJ@uO5 z5DyX+GIMI%$l>~O%~Q4y&oYZZZt;;6EReE|wnyR%nTtT(R1Vc@_e<*$81IV%?iYFA z10{Kp^Sek)LlXQgxrrxY1h1;g-3niXW3xXK>|=`kdBt1ILFBJ-=TUdg=^gF=&#X-J z{~ZC2iTyvzWms*|RBa3|e^0>{CqDjwLPER3uxq{=2LqWeI_$%+-rr=%sG>xO#Vn?W z3=Qzh(bTI|ew;7hk+~tB<#4+>-_z0(Wb^vS!F^|ce=~W0KaHIIBGDwmNy5qH_;5=a z8Y57@iI)hoIKNtdE`-3#=oCG{DFnZfC3Om?b{2kaZlw!*Ti$3q)PS>Gi{rQ*5wylzS6N9o_Z7?qZwa(3*IzY6G~lL_Q32p~F z-j@#Ge80vWPEe0`Jo`~PLa(1MqfAY!+1sz45}#~uuHKWtMMOjX$Qm>fNb}G&3=gD2}G%aHPmW;8kh`Tw(|m~LKS_@B=dhW&`OZ9AJnsi^3EYojLOwVUmB=)3Bm`~ zNVts*71+vwR1*ODbq=j>kD5al;g=`-QQ%gwg>9vi>TqoIz^|fWL&ur-VuQ@&MHqhy z2xC+B$|kHU>t`U~9l(-iC!Whs z@>yFs=2@V5QK6GPD~(+QdFWaf2+Y%#a|6}4>+{S}6qMtOK5Vh|P00O}qt0#mQxC1U z#5VQ+@=68&KIw7YBxz@mpHOl7lI~(sac!7FtWNs3o~Duj;ge*L9)j^v1F;Ho?3UWL z4T95{nWHEJT?QGm#TKKaSoEpQj-unlRlOeAGi;pj^f8L3UX7OVi|_U}oonQetD{Uj z`|9#P>{9Gww+{K9;L}SkNhuS=<}qTV7**KC6|+Mv)mEyd*30QYSUE6lX#aNXa`p|P z!ZU`X);oa1hSj%lD$OVJH8Pi$e9=@^@|B*tEcfY*{$;mG6+$FX7KJ~G9+m>&qOIFe zHL1_S?rSu4A|iWI^U_rO6-<`WbGuJGRF|4KKO8aJL8+Zilo1`F89r0ZJ$w?-(a4or z;U~U_6HmoC@qxhWeFZ$#!2x5>5*HX|)=Cu*NtTj-j&<$CptTBLar?T=Ig%J3N`=Sz zp;jU;ZW0b-R=F^a)LK3WF0CUtI71~na7{Y~&mx4>XfWluCm9$S#2Oi;paL$T9vLbT zpU)6#Meds5BojC>0nPwpo+tLl2z1K1G{__zpgwGR@J1NSdd)6H?zn9t1~fJP%n!Wq zqTpa<3!Ff^59y5}y;mMrq+eY%fe&B>q^{PE_yY^n0%!W9Q1Cro+G(Q8V(Zt-Ceu%?d0-FxqosRGdk;|KAMo ze4XV@Q6A!4nlh-;-a4 z!njJy=#hU04Hl(ZhieEVvrbFtxrPivdiG6mW9pikUxCqr19=q~$OD}~GU zJ&HldZ4KOMA=0uh!~JOoz&F;#4(GMpY|)7XEfe&V>$OQjD5amfmISr;?aLkpnnB?* z$U(`J(vTgl3ltHLy;HWTGYBTW_Zx;eSK=k?fl#KVN7)$?(W6)|N(Nlkm((Xr)l?8; zA4L>3n;9bfZTEqf)CocC)cy_-o*fJt_z#G78IF>t=MHtb2@$^=`rgN^fubq2mO+6tRdmUH1e; z>Pv=m&Fuq+scMf=)`e9PR_X(!4A*K1_D;Og)2U|M74te!cL|F7StJ~$Dc7fQ{=#D> z$*ZhjYeFg7D0GPK0c{Af^o-xDPRNHoQbQ!`GbrHE1bB}W)I)J=__OX*PgVx{^&)K> zY33zq71}qf3OE(v9=|nWdLYRlH0lAC)#SjtT`Mqc60n(T%vO|`JZhB1=lH@KvTF7c z&f$SEncxf>bX{P6Qgk%L`X|;j1P_S>k@_hYWr&#tE<5FaPmrA4B?MRJ6N` z1*PLSqe-OhFmit81(YA(f2Mx1w?t@9Ft!J}o=FU+!)W`iCeql>|I}R3&R<6d^elP$ zZ(QFP_~5Iqa4|yJTO%N#@q(w2L8P|-rjDYOWPD(&y1C)o-BoT*vYx$CZFyxTY@Icw zx~v%0@~88&e~PryD`vsVNsYYuEE1&-$^qCCfc{0LIadV8iX6r_`#1_rys?CmnERE} zb6OAy5l%aGNMPlevYo;q(RLGfk-KB5sjQpr2`+F*W42i1n-#i_98kc|8rldFJXia5M|276U@DFNY*kJM6cDPs7*-v5 zU2P~n@l~W?=EG!_i04%l2Y^+HWC5?tD4jdjG^1-Fo+ktSfv3yswHY;8O4_tZ3$H?& z=~GaPWd@OIdm)-hCllqO>z69pv^4*gixwVV?Z~J$qHQTsOku%rsdjCk14)Awz=$!z zas)^Wsyt)xkMnU%NhSpv_R*O=qgo@6!1m)3lziFVX|$7B%_>_K1wJk5bfdyjZqCr2 z9+1FaHb}$;)RY#wfW*rpLBA9#z70&q)n_i^!m{u}_8tZ<#Om!N&}-yl>R-l9EG|)` zJP>%fmhd*@8CLJ+I@GB`M~vvj0~2!_26K%2Ff5%yni`Ca~ zSD*Ubd%b&HPq=$%XPY_d^wmyOL?nyxi^odgP`pofiH4Z3v6_}0i+%sfv2NSsHA zsfoiMi*oGKE7AcZdET&C=pDowtiP{14gv|F&H^D&{D_N_>r>$*#)0C{tmDLHkJ zJuWo67<)ch+`vk6Kz4aBQ{VMOlV=F9Se@8|=7atnuat3 zIS&&0nSwt`kU#PR}*V*J0>P7<{9#q_fh2HTAS^~+zi;#6pM&|OLFt1 z_n_?fd_VuHe)U@t(oMEsObO-gpZshooyHh0nk zIrg>36Q1wX$I$Nk61pN4jZ^P;e{Oc3xjQPzvnl zx5WwGkBNdP6Pq}_+Rx|g$Xr^W1!3xp5#SzRkrJksuG()e7Q{G~_2`AVAZeJNj79s! z>fjjOAIRTAIK#z;dc;DNu^W6jmY5G|dgRlOMiLO3u(Jn+%U)J2vd=`IBswZ?@og22Wu?M``J}bp$+V;$T>r@-?bAdbnFBzs^5!q_A@^YVW_ewLY4>4 z5Wmb|jwilud^?SmI7VY_sl^Lw&kZ;A4quMSYNM&nOuAU7GVKK2kV`{=r8x3t6C$Pb zgjOS6jC3+*V-6?M9AY`sh5IJElPZ{DDj3{^sZn~eetjw?YEqraM8p(l*|KFfC~ENm zS|hEKdpU;Dy9v<4rTR~l>&zcJsh8=Z++Cz}US8jD=xDlZb(Yi0qr4c`Vn-YU1?J@b zfQ~4ReQn-fZPNoQdyUlLP-t@+IqXeoZ{`)W8-ED_-(x&2Bccu{!!H(Lo}unvOI}4Mc>8H?tP(bu+aV zw$XMhYyhG*mGG9CHg1NB1x6i(cZ<(6V{UeXnwp|uEHvm1E)s>b<*DpSzn(7vJ1UvT zM}9b?AW2cqI$&wqvkB_oU7Xb=rX>z%X*X?e5VYytpvwZKeFcBg(zt|;!U8X_hh^jb z)|frm3a-t#?9{Jb0OR^4RE=P+zD{W-VQKovpA&-8E+@P4b0pfFLGA8L++37FLGfA4PFD4U^E)nIYCZ7!l1B5Y1h7Rc+zUZ zwe6a#cqH#(!!$t;9JKA!r1I;iv$82< z&;{e{t5<2bC(Em@QF+v|Jq&b6n07(cYr_jk)YlT})Y(Z^~jN(5MpKag>LYesyD!O4fz@K1W zs9M&;QoP@iA790bEAm2nVbT`G!5ti7=5(SmRlpk?P5zLXs4nA%B$haH(^zcPoo(Y= z-YXXaDVfclkEb9cCeitVbYdsjAsKA(Qikd9iMrpkecc7yFS&`?qQkNkoU6S^E^2{p zl=RkOxtY*!T)WpND*fQgjtM7M*pTucX&vO#6?B3RUka~ltcy_~>*+~Kt;jg#h%q3& znVEl=RBQmK?!m%*EZGX;#d@nBz0kHq2jj2a`n}ReB@Vc(*(erF$<7-J+ao-wz1+{h z<}5HVt2aqsL=h6J1p++*XHyz>q=$Ra+#p98X<8wok?W_x#Xok((*q~A2R)RdicKEh zX9jDqCPhhW$EDa^ib00m8Ek2`yvs)O%LgB5SQ}-dtv=)In4%7`*L4~xEdE|wGh>0k z%G2xA$^#Mx%&jf4OQ*5jqe{@X!0EoC^9ZR!qxA%!GUyQCdiF*Yth4PzTo?W@hvd}* z^~gE3_HV#$RE+}dV*UkXlh>r0(C8ul5Ys~-oYoKo6MiHNdWs%v0HmD>05>@jIwjEY zw`Jgz0ink7J3-!S%5pxpMMoy5k|VcQIlTvqce}HaV`GU2)zTf&CFO0D;$fX&!YGU3 z@vLO)!OE*+D{fMt-&}<*jjNirI~Qz}?|JkzXQHse+@!cVjqb>zSh}KCrz+edJa}SM zDoGru7HU&`rnROi6ja)hsW<$0?ErM9#->_Wk?f*0daYjNs@^n_(;S{=b;ikI&bUfd zMn3t0Mii8D%`y>X=uDwyr`Z)&8{#}yhm6}aN%_RxB{|6q9|SLu<_*UI4VxLX$I~&< zY-Hao@e%f?-MeB4wh8_T*nmFi&>=)9B980rCmx&c&405+i zlbaKM@EWB-CJ_jQuTF0^(h4VC_4b9tL$3zq$dtV7qxorvYMHPkJ#+&4`Z#r!sr?N+ z#YmFs9d(T<$-QPbmhNrekfynti&j<;Y%{}VPT7chLx$Q}U6u82VDR7-+4B-rn#6%1 zIBBEE`1Wfk_@+z7sy>dr?a7xL0R^MAgT_BTs)~`uCQBj>6njB#A#hi#ObzPl!j+7| zJPdRfQYoNGi7p*CF0I!=Rt0?{AZVm#pjdznUY(9AzE4{}J|D*Sw>vQZEcTxExjv1f zP)WlWayB^X!R4hrQj1GY($2k%n$$|d(H0idZhxu*;=_D^ zC}Fo{U_%H3b#BS4UF~!A=D`Q}S^leTNmem$1my+Lm@7`@yyQ=1b{1+0G&;K8DE0_a ztu8{_MNJ(MT3Tt=|EpuP!P;_pGOiIqSh2K(+>t!vhymalkq-<&-^>vg_^)h8U5n;UJMblw-y{!+OOtRc9#*Ngk$56We|v|4-xa|FRl8~Y>Emgg;_B!aCTzcL5HVks*N*_g-N z|6}YPn*;&6ECH8o+qP}nwr$(CZQHIcv&*(^o7?a1#70cSe3)O6c{1;P&eU9qh`f^E z=5#eCywqCsy8mBret3H|g!597F(+Uvfc^FdC8S$&>}4-T`8SR!_UxadhdFt`N+g7- zZZQ0TGv(m;a!X%(U9?Vash+t}1vs)=QR2q4UOge_Kzo>~z9#Q6Dn+SOyW9_GdXBAMK>AmfT zy|!@{#`UOh@dN-?=pbu_&_GkxZk2P3t;C7cCDF=kRuuUs*pGb0yM1PFP<;$`U9N8hw+F`S3uIi}2kflY+VB0i zC>!oY2Cc{wyuQA38q_*oii6e&(S-rD?g_eV30|K!2kGicA^-z=`Ze(<_6%`-{@;uK zfc8bpSN~I_`QKSD2VDuEp z(%~7BkzRnDf;9E`^#76EfEQo~R017u>JlA+k-I~``W~_&@qL-seb#Sh*GNAm_V`MF zZ3~}Y0Pjz(qo9734JqZNM^5+P_Gd_a@@#6ob@EpBtwWx_-R?8})1tcj=QKW^{g}$xX-+dw<>LA9*m#?>_zM{ymU69pnHjCcn}t>*Q;FVUJXu zQa4dOu=4=p!!w=(A~a{mv|$%>@!VYqLE9?9ca<#G6MT_vKK)U7`;5M6yUJNe_5R|; zOZ_8RvS5Pbx)jipEL0UlWmohs_ITeX&o9_3B~HlgneYj|XWf@cxjALU7AeC?4{bA$ zdb1);h@g9l#ziE>u1qJv&Jg=1g&r*uGnQ=^yA1iWL-9Bv z+C`D4*XCk)+C{@sxY#`y%u1$8R&n_&qd00G30w1ORtF2sCbRJI%T>4tCz7#BQiO^Z zN1E&cVGu&DZZoa{@bl^K-NMFH)^IV?6@ts$9&8J^lFHb{=GN~G+o1r4C&wCxEA(e+OgRfqBi6IBM6wLnIf6c z6Wfl-AR&C5B!U6}*`*0U=<4!UC2_*w@rv;t*uo|Pl#{^*Csy}RfKZ~H?*fVBPYn>K z*vuKbO^m^Mcuq$L z%pL)}-ZBF$16c20M;3CY2o^!d@TAKqY(OD#15s#Ab`$NIww}y>MLUG>s>%PF#Tax| zg?B{_Na_GVrTLu|sG@0wJW9rt3AJA}9S)J6UARgJL!dta;u6`)`4t(Y4^wxAmV?!( z)%hy&7l8m*`A{IrKI93DEL&M=?&kr)3i_ph7fGgZ4Y`2W>4su(n!EwD-wul@bT4@u z6Lc`<=OEyH_L372Kcu32G8Fk1nH)da?;~WHDz%Y%9{4h#0mcZ==>x9RkY8({vF@p1F81pp;Wedpqkg0;7}{PiC$B-K}JT;pY}I$hM?oU zD1F+H2HsG(i6x3)TYBM1sl(8=B8>nyf>dKIBigs=;8g{x4%>M!nl{3eJmxi6{dlZ= zqhBN0sX;ZTh9d49Fh>&6S=ntEy8I&$7*%$l9znm%F#o{8B3SMdt_#2*BE{zEEZhM_ zLL9haA$C%>A)h^w&faV0pr9tnVasX31>lMgpe!Ym5dbNltO?F=P`~LtVH6w0;FQ=C zgHPFG49=ZkMne5D@S(v1&pfcvCS{19xV6{D~Rt8rSenFs_*W{ziT@%zus!l4cSVE0uXp#L| z&Lk4aVcT6NQ4W!j6UALEuZAh5N4$xlIp4LDGK-{;q=~rD+)xBay^1Q<3BHDhiRY%Z z&PphOK5KBTf`cpmS8UKu$M}U=Sf6Bvv|@&L zq5?X8QWg3Q+&c5cLo)sn%)(gu6>G`=aYs&H3PL{P+if6M6B~uCG?~$y1Gnc5AbG-~ zaM`toS&>Ac9?`@~jJX6p`3Fb+GkOp^P3N6K&Xj;hWLsDXT{ZNd`Bq#vkzO{@V? z247mLqLXT?k%VFf9eZ*q!B`T8D>I*vjJ3FQZ%@O`U%!W=7mxa?ZX&#JJjaH(g`a z54Q67r2fpaV@4Tsj$cG&!6L~! zmOj+omjdMYRAD6hWL4mdkT}?muzDs5=7t^Wl?FnSL|JXssFD+^!gN5RLP|>Mp1M={ zH`j(uY+#&@GpPy1%>+Hq|v@h9TXY|D0~9CMdn~L#b=aRbOgDa`SP!TIp{;kiK;pj=xFrSt*;;oY>*1 z8nt!JT6Cq8U9th+`_BS&GG_kn6ulKM3fzD5=13pUY`&<}^YjjiSd-`Y#n zPt57C@#BWHy0xey;roha0zq4dIe!{QUkHLR-=3FeCd;;PwuzA6CQd-Be(5Dr&8#x>_UNb3Sk};1v~h zKU$1eQtR~e%Bd8wXKU74MH&RG>R}UJcTaWo7>#PHPWu}nN5Sirs|^&J&r1%H4O=FQ z?aZZvr3F@PNiE|udl*xvpowTps)*ORDDBtGG!X)p0gY-f!1LaSXwQ@yh=vL#^swNF z*g;^aTOwoXVdw(>$2;6L8H<}#vxm>d?a|pxHR$E!#-p) zLA|l3pUMXzN%U5zrx81D+zUNsE3y0zJ|>Ct%i5%KOB4&0u21wgJEm)9t4`T-emabo z-T%g+TF=1qV^)`~FX+rCd2yDyH{&bj&-d-NxeRbDxreV*TOt9g3-FAXE?H8G4RfpUxFe9P z*CEYMmDMb7|HCl8kOU3%0^b352sxX!7M2Fkslkc$b(ZX)r`sVRbanDdyY|PK5x+y->;AsOzYY9U`kk-rrOUl@hu^Yg1E0va{)>*40n(+O4@8IK z-e13hD_teWj<{W7I{!i1E>fjzwSQ-;Rh8iI-Xt^!&Sc{N+@% z_IG!G9D#7zC<&a{nq{{hoh+eH4vt8X+~3Ff>zQP~HrtP3m-GE|*l_=Fe#6_3+Y3jwRkf{N^ks^>KL`?skmG+PM~RNHNJtL$-aLgDoDbET?_mE2~U)KFEmY$0bd zsPt-g$W+|Fo**skf%TKOl-*%s4r;l&03!a6dAmL)K@Ll2D!&abT=?fuLagsZ)Dzc= z?aEfl8>)|d$`cmR@Kq$Mz$p)%ug-B=@lTXe!xCZ0^Sa~0E`JI<NJw z3MOoH8))-Kg+Ek8vcY6U!JAkg84sWek8H-n)f?CbGN-R85(sl%vBC^CI28{2Tjoce`RJR z#(@zvCduvTan|63K+=1YirJ$QNe3NvZP3;dB{%Rgng`-^t}|FAN$h0^@pM+R3&ea| zMv%+4fbC_kPoVegW?R%Gux=EsmO{O=s zB_)%M3B}Sj$3C3YaN~_xt4eUKH?zUBu`5tk#Xu5$_l-0n6X!dCFx*MzrP!g~q-G}f z`1QlVUiJJF%&{5)SNbGWWAY8;`!`l&@}Wa#m<|TM8>UVpF1~6q2mFB$T7y3_3MzT1-%|2-TQlHL z6e@;c4I*b0Gp(HcziZrZ1&I5(YpLTA2gtiBYuEVzTX^)$rM9><{Wq!~b4}s|3mNbg zpqwSpJZzKcWgO#-&}o~J3j@f_RxKJBnYoTi$gIQ4@6A>}x5cdX8T7OC6J*tPe<|7GbMi3B-Fj*BLV1=Dve9Nj6cSmZ8*p^*lz-o^1fQGOl z=dFQsOe$fKVrW)5G9HanV8+Sn+bPyxonjE3pS4fGZoUdSSt9$DjT*uin@skP15h)p z`%gX0wLZ^=;{jQ6Ihp7OAgJS90YFjDxEtF&ekJkugpZX z^8?R-#azO8_~A9FqS!^@S(-!V#i}JGQt{AONF9_F%yqO2G($U~S`w&R4YmHZd8Wk{ za%1j2%1lI4b{8Phk7Oa-WQjU@reWvlU>dW0I;nTqsICy=CFS)zc0~W!pzHX?1X(;N z582#n2FSX_W5+5b;xkod%zV%g&lHd~7jk%ples44S0*NI*lys3_ zAtm^e$VJ^NVjNMH`!U(9$nBF)Ss$Bw)|N*MzL#QAl!vTM9qJs2t?id9|;RUnsZQJVC z>`+ikKzb=bL0JY< zY})-w(L?}+HdbwV%RsxB&ZuMgs3FN%g?+EHKG}l0ScaPcYG$FdbkNZM69U_h^XHA| zB3z(NY7`_WgEaqh&61MIVnsnCSOrTWtPk02Tb@WKX=7ajg( znqm3}5?89J_$UXJ%R0}oBJ?8HW`Lq>fr0$$VGYdn=be!+uhMq`3<2gU7lARv+cOa2}^%sOzv^bi1nxIFO~G**Ra0V8PdMU5W&! zERLkLke>FT++0l-7SCX={?8%{#@$|7cs2%A^w^M33!Q|M@$wj#hJ zD$Ju&?Yfnh3a1GhFp?D|J6DHBbk=qvgC?~R#fKA}{a#ftsA$b9t-5fw^j|@9I(97p z`=MFJmP+S0xOo^t_N}!)XVJ4IQFst z*GgSG8<|9clUPcp0Og4}&t^$V*9T9IQ!OnKAu9$*+F$h_o^uMz<;e1F5~Xa~HwK*g z=I4cr`IXb~1GH32_8hb{)(57Z0n&vkzUBg7>K2Gj`BZNkPw%UqvyORjYUxt)=L6^C zRiwX$-}5Xlea!>KuXQHLpUu^0{P82)(kQ$DmAUSUqWekNP%o`!RqUYN-t$9y_NC_j zE21!QA}vjr<#_cuRty?ZB7xbfS)1rN_DKXklCK)O;2}|gp(nj4Z?3_hYs}{h)8O62 zFwr+0uO`Kmp#FIww#J4%3!fC+h`>Tn`KGIqu0?63{m&;9{EjJhq@S+7i`DqL3w2>i zj1}DAw6B;97{wwE;)d}^<9Bb-xr(s;omxT3YGcVhh2)s>1H0NaPTlO=>Y8@IYnRwkyvYf;)elrSGK z$w<<5$sE36Qc^)&G4md_gardmwvFX@U$UO9fq{kRz5uc2mZ=NSpJh)tA7r}*%5^|# zwCQJi3q?<)N2OXgkG*G$+E3-QhSg3bqD8F%B~fZ}Ssm79V%77!EisJRpr?-36U$aa zJi=|=-hK7hf4batt7vZ#Ayx!zajhNQ%vVC#R|mP47pkZ5Qp&GQ>EDkB$02$_fbe-?ylalQ*e0qIiJi6#jBWMuSKkdjQNcg z%z0Pw)N(sZ7fP35eMN7Diha;UQaT=IVG&oJWYTqEg@WKDC#Yd7hk8!C;Uj}HUXdWB z9W{lHgAwJ=-AWEsXQghAhZ`0RxC5h?EPa6|+POzF6g;oXHq|0qh`4SdXwr_)H!Xmg zr(n>gnZ~~wq03G^e{h{W%~uCq?*r-7t(N(4<|+C=Jwf%5fkCnnfQFrN*xuRRTegV( zCB1;Y{=%4S%5Ds^KL!B(`Nh`-owKtSr1P%lW_SFbrnR zbYvrPlhb1YB`hl?edqJ^>_5|S?Byabm*@G{{o;>(Tl2qP|H^Q|E2Txg{)Z^a_`gCC znK)Sg+s9k&zmg;BO2_g)uXdLk1sDcdCO=%$AF?z3dg88#1}fK?P#0Qttd zom>x%vcif>pMmoJIZu+M{Jsw-N9`RU9v^SKuwO}feXzIw-)a}!I)e1YQ^Xffmx95+*V=7)Fms$LH=f@8Sd=IP5jby-F zb>_Ncr-<2n>mXD}6-{!xE?J%BtKh+|)O(O{;fZ@=Ja3Bl*|-2^1Zs$TFf{pq>3|75 z*({|TUePXGE5J4G}JvNr&AG!GCseWk~@`S!l+CI|a`y(bDk ze#R^t8EeXa5yQWV7G8Jd?Kaa`HNJlG7y0G;_`=)HmZN`v-%Od_^iyDb7u@dIJm@gb zF{EPxXCO@GQc1d!pd`{IvFMbOa*^*b6QNV_B>9XC2M(=#aC;6f!)kaO(%j+-JWv82 zXeCqYnch3V5FiP~O~0**wc0_}H|pOM&I{2`ljIz|Y7EzF>Ygf2xihQ?e48lLx?G&L zuYYvtX9=%QEZV`54OO2c8P_PVHdMS z+>~tt?GiG*(#|U$Q+WmAT09me+MGrEU3(cRss&4N%^eJ9avh0?YD`$-YatS)lA37EVkrncz4m(m zP^ic?D)OuvNLZje@(X+4f+Kv|x^wPo-N(Ip^DOQ|khnGSL8Xahe;Hw+J zd@AGQ_a9O)DyWdB04r13nubdVGO$6N1vB9SLsU`Sxoc!vj{F#iOH*pjZ{FBX7bRW@1WKl=Lm{^#Y9y}%rwYNa#)V5JcFA8@j0IVWX_Xoe9?=pfX>b#z3 zh`0|TQhdl0f0&3F-oe^yJ44BoE3Md=LTod28be8(`6!Xoj41A%q6~Hf5)8VD6036D z>Alp|qVfrN5Hn+67$BM7F6DmT`ikje7n%1-<30&uTehh-EosQI zM&yyebNH{8epNVc_Fgv)0Am{Vh+}?Uf}NZMrjGWuDF9Ng&rkFEpi%5)h~z#EYIXl9 z0>w)s#`zgE+mJv9Ci$OvE8U=tog>(B87KudJ2kB{h|gt@uENbuQDPzl;D;x>8eX9t z?%5xb+;d1QF*9e75x2P5roGmKO~sH~fm5yM*iV+vqHiS=T@tcsJ)NYKnJA0plqT8W@Fz_V@1f(ON!`xg+5 zH*+6MsDulm?X*;x6c7Wxs83dhc1$Q^B;w6;d8-H>R#l8uc#*v$qMPluM33-CmR?9e zfK;2-2tt)48|COqf06j&E05UDKt$Ww)g)nx{jP}JvQ7izcfclxJBQDhR!F7A$+yY1 zbS81_49LHF2#d@Kaf&6mmGjaCK_y4Mq#Tm_~zK zQeE0`{{foZ1ux@Kq;O?K{lroX<*c*<^m*zLp6ZkP8ryAK+s{sn~-n1qj z*3+Wc;rL4vemJ%dXr@n^zj{=w>xn4z`dnWv;d$Hi0*VW<4};=X>r%PTD!VFJ@v$5d zO%X1`1%+yz+VCP~lB)M{M)uS;Ri#N7lZqoD0;jXf`nW^E+wY`|Os1}AADH=}r#)i1 zvjD+df~dx*9NgWf0%ezMo{1#@t-A=)_WLNC{HJ+m`p;QAzqF)O{(;O2zw&0bWYmFc zdi+7lt2EI%FlY1gG}Et`EGD@#BA`uG#G5AZ1#IG76*{CnT~k{mvG?lKi?AR3xKo_^ z89ijmDi7TqKN(%XD0_Vk=B1gO=p07wFv(Yz#pQBZ>`0Kjhdt95_+AJ;rAnNkOA!*Cj6LK64#Ma(sB{M zBK@_NW4kb@<549`zxXyk0{EB#Qc^<%+Oxn3+Sx8Na>0sM5A6aJML@E+I+ zKSndfi3CSU0Te9e6MV?Hx}743EOTHUnqBEv87Qf(Yb`u$Vs`wo z5(aG-S(~#vB`NjtijUq^uh}oHt^RW*9}zqnR7@v!S@2g0-4)`BEvbWl4rK$%TRuSu zdJkHN-O`roEZxcsBB?uA_k}$`C^?9e2Glf=CM}KAZS!Pc=Bjd5*uu~B=u*TNVo(zJ z_o;W+VR^lQP3$tDJq5`47FhhDdEC1vJi%}M?=9X=IGmcaMt3yGBV1;(=*kaOsSWT= z)8MvX+WLBP^kE82ylmb1vXgJKlG~HEk!jAdJFbsEJp>kLPkDzf@o(+GJUhu(d7+Fe%$(A$ic|3ZVv`QKS`2DZvE=>p zdFrkeNFs4^($H!jr=xYR)S;ZY{WH?VvD;hWa4|Uh55mEfY}7i-FD(eH@4YjG&+qep zZrsU~L;ur_oArOikh3uTH$9z`uR=-ZX7I z2Dl;+SRC+ZYl`g$f<{)}ce!B*PwJ4v_UZ3aky6C}%O})+0SSfYPH&R6@#tI>K|4CY z4(s+kzQQVv^?k4L5`O(Wwou$oo%gv2xgqYq;*kVr%t+x79>t*xTP$kY2tf zSt3V%db`b=+f2Q2)nBGj$X_QG)oQ-cGWuf?jx(E-fm%Y7oj{*Ioz0GBQr-h99$B`&XVJnNcMjxmRd(Mp9;Fn3pC_K z#{Uxv^1h5(o)R5XpdK2EwkAHcHdwYu)0Zidt}CdJG?O~Irx4V*W(ZbAtBsi{Qa}{N z;&k@j#q=e6%5Ikm)zcN_+q3BGg;StWU_1+_$<$6`6PYEtoo#c&k#Y&w94?Buw990Q z?Ve?>Y{pP%W(N0#IqUlJuNGoEaKa1fGP}*G(Z*rh^hq5(?arbo!eM=nmVG5}(V?4+ zZJN507@f-`uthS}mWOYcPpDwVa>6emeVGQp>UCa5j>H3vfJvy+%R_M5 zqK>huBn~QPJqJ#@NzM*v%9PEeG?qm5;GsupZ;R^`#% zGKHAC6xXU-k6+Ae!d>UUos8$$ytu*c;X7vqSU$v9Z^u|CBDr_}-DR9W-dCqP+mIEF z2D%LFE({!8qnWgt3W4ref6>%7qksigW9wWf;+ zs%~@0c7_L{IHKgJX+)i84U=)PrU|k8MPLqh zGIENb2WUjuaTXtq%1z^UnI2C7+>TYAj zk>KDAX(uD99wDvr{xj&<=g$<-uzMH)S7&z8IDYUH_nK(6dt>y4jTEI4fp*i!w7L~@}-KB zbmKwMRi`tq%TTw7X?LkC$!Pw%*q<7B&wo!u9TVEs8G2r@Y7c*$f0oUL7zGupi3=&! zc~ms_157)*p49O?%0QVkK= zjtS)Eg`#$|r~#^^mz>UnqBd4dO)WiEFI=obR_x29^1uk>cck&>L&Uh?M8aUU(oLMh zD<~~02ly$@b=T?YF;;_F6w~RJKr_EoHYatUqxfXK!84I9Y++}zJTgtFJaM<9$&Qc5;`yf{vITQ<6Gn6`p!HiFGKqXXP&iIVie78AQlE&TY$84vnS<{gA{mrJx*j$Re-g z0}_5;wX~eeTbtVwRg(lD<@BJr)`2tBz%Rw1T_k9?dfJjZ13{zFUT1)crp8s>@lF?* z3D%V$WM`ySspU{zXIzRDQaRE4*HiMT%IsYvuAxK+N?ix{87 z)o;F2CRUP)a^oz94RDd#Up4g>9tBbYJK{qn#$|g;kZ#+ftIpD|q=ue=x(dpd%kt!AyZWW6MrXB#+R3Ufr*V5Mm`%?&Zbz29E z)?HAsU$rPjIiTZ7bay_pehP}NKdQVis6#S!H~j{p^63SW5P%Oa#ppj zwyt;Mq3SgmwYnP>Iy-hJkMPdL9p%~p(b-_quVlo9XN)fkowolrm-Rw?2d_`Z&$ z9m``{D)`ESTnIma-ue)r&SQ1VW!Ze0Y6eKaDd5aX36xV9LltDlU{SNFHVG6sE`8SJ zD917U$QiwAWRm`wD1yxG@mQt|G27~4kxU0QJ_dIFoWxaDcSel{vV(CZq#e&$tGI_e zIDNrQ0cVXD5D+#R*!_tq4+UR$)OpC1M-Rme6Q)_X__X| z9%WEA`8PJV2qQj1FEatlb$A)V6*F1*Nfh%O>rRu`l1}3v(3qUjhfCOIS8&wXsE^ki z_16`@*mw0cy`slltAf?vUqKm{+D4+~(a&-$-AETpe~Kb}`eT1hN;JSPJw9G9KUVxc z|IdFFsxR0Y>Hkws``-=eF|q#loc3=eiTc0lqI8R2ff@clBtRx?6S$+B?6>JQ|D`cY z-Hj(vLZYnPayvaJ+P`dyB27f`^cd#)_DmvA{P~-#PJVlUc5wb8-gWo-^!oYq{(pm7 zD>-EwMG?>Unmqo3oz`2jO18_z)8S8jGlG(S2?sQ#(EER&JKFz1cOJ6;f$rY>yg!)V zk$#To@ujM1Ec$%LnK<<4&;7X~qhwV&<@HRl-X;9mi7vH<**R6jlJFl#w7)fZ1q{%N zM3Hksk6HI@2}t7Y)a^`}gnSQ%FU!L}SCgrb{tLPz3zf_QZH)wvpl-*=$@x?ESJ(dT zopLhP|I^W;@Z8Z37A*ZJf0yq*0jhpcr3<09tPl&|mW zLf)}iY=nm;61|E}Y8w~M@L=hr#tvHEi^dN@&~y*lqA%l`9=}3E7mQlLjTyjgKVlN$`j@%!#;J@8`-mZHA-AP zJQy6s{f`4Y@ebz1UJZ<=JoX4kGAI@i3ZA?ghb(BFND+K6+}XL-;9KZ<@i-tcN&#CNaiTC>VvQ^>SYNf!QJ3{RJZbCqB~U|pl2y%hT3G|oOBnf6GKUItx37&1 zWbWi~cWF_E%0JY@&xSt#P~;fTx2U=#bR+b0=`vT1w&Z3f+F;>hY%%z@6?vquaiv?; zveAa^(k~eL`UQC0Rj4HG(e+>-=^!o$>B2UUl$N%KwXbd#j?gkvMPt+cKBzVW*RJ}C zu5Qc}WH5h=B;7}Q*|BZB`#bASWEp8tPp&gThkC6~cQFAy*R_xdtGjoK7T{Ep}8lCR!z)vQF4o z$s9JM(1J~v<~{6L45+xGps;07u~<2bs_k~LFCT!V=X|e-#~8p$O3%xHp@J^e=+9qV zv~ik3#N;Bj`r45b;YZA^CfGbrmFOyn3PX5^ZoQ!tEsei+w8P9EBGwogjkYROg4g@q+*v@i`s(=u!1QIVJc;`H>KZ)(S8&f zLj+naD^32e69=$+XDbV2D@|N6GYTi{EVACxdCLYk4 zjy*5m;}}ddx{_W8u5Yn7S~?0dg7-XP$6rI`f(w^v?%E%DRWX-(NGjc|t3|XmOH6qE z8cGc^bE3LJQljt5h#Wx93eF&%w;@n~(8u4<^F?ueXx5kspC(0hK52}$3$X;_Y)Qzb zOH6)-vL$Sg_2-Nr*Cf||NoST6dbFEeNbpf1vjFFsA^;evyvj!8;G1G~h((OE zGUu<9r7r0vA#lb~+S}z6m%@rgg`Wms>r%OpkCqOHE>=+F(}Oiws5Mxr!7kWoS>Z6v zM!hAYhmfSRz*{gP$*a;O*}AO@jdfup2~LK&0zny$)g)gEqu(1DkNs1AklgS|*il$A zfmxZsgmLAiL_8nZflwlXx$;E&sN1dwL6FGO9LDt3nl-@VuQ-_YFedQo zOt^lSUv*?XjdB?jzrBAGcKv34@koI+E||Wo50SInZv|`B<3->0m6lC)mx9#J#^5n* zE}GsoW7{BgFFl60WH{%R9~@S93% zLDstpIe=0tk(zC3w@rQ~crrqRvc9|3lv?s^7Z#{|t)6>i*4%L6nD+t7h1B=_{V6W@LY32Q3TFW2<1DS@OcIM2{P+kQ-ZSOpT^+F41?I-ItgmVi?`;%6 zPx32{VWYB{e{1K4PI?MeX_u@PD_lvQ60ly9(xmI}btxvBMBRs0mSW*dqt(gwKsOGj z$5~AX49OXR#lRBu?l=LtXG1R&HP6N#e6p6(QA?B9NQ_O-Gk6`%)P)qqg4nuxRsZ&+ zGGED0l5xM6UT*Cn-QH?kyg)DgMjJwL81=)eL~|%^&wD!ea2w5Hs;E+{5tl$ohGnr8 zjaR^xyK{HN%JyuQVnIrAD_X7IdkA2U~eE-q0hOI zrT_NmtqJ2-as1;6LUS%L-}@b7oKM zOe$A4r0_>Tetw*fKon-Y@?&Uo5Q`3HPS=&rn9$`G7S5KP=L7jthn5gi0ZBL98!<7p z5*e$IHY^`w?_a=a$iu6>1Q% z#3nSir`KYy#{*jk!1r?JZ!n7iYzM$>ZWGIShB+3&oVu6zLkt=F)tN}t=Y-cX@N0TzgVw#-(?3e zgn%p@`BvchbA>jsy&aOUki~-|*rO6v!Byj*w0&8#xk72=jLIi68&kIaRYgkTy*mr#IHYDxxEndBPbuU-y?OW}9sdWP;q` z+6|Pl^{tEbT;76)stYlof>^GjtI<63m48Epn0Yr_X=FDDNY3H!fUsLZN#2}$-H~>V z%nR5C8n`VbR9xHjV|57Zt#?axWr6ZVC+=0B=HTUZtfd|0FtMLt!i)RO(UWg73k}{$ zVcRIxxfcNdfxg#+f#D2{-gm&xV8WCu zzK8+gk7;E3Ot*f7ugJkZr90-jR?J0_ydD87tsX_L5ne$!ll|>-3G_}y{iijXXcuI5 z!Dvm=evB-SN2_Bl!!09|YFEhdAJN=k=tlDgTGDb7;~8+O}<_ zD{ZUN)|a-eO53(=+qP}nwr$(?t9#>hZp3Mv|F9c#?zPq!ikDZlN$?K&!w2)C4MB;v z>!uM`j7Dg7@Cx{*QH*FA<)F_ZiNivqwVG#Hf$@Ar_qno{q<+V|r-J6tHeTLF=7@hx zz-?bxM3iHU6xCWL3}vyJV60pYo(-o(!auww(Y}}ln_XqJC)(h%dtT6e+vAN}3Y^G1 zy3BR)Ci+%a`0cc@7sdi`N=1%iLg<2Xwe;#It9@nRF5BIo@>fyWXzgt1VDZ2&o;V32 z?b_y@Ri1eWsAhYR7d|5J1#jGa9E1`3xA9r&e2JH|sOn$&>~8v?iFA5^O)IxDSxf%W z)6if@9b9?skXUtEvAgBX4t@73 zm;|n{N7?L74mb1^1lgRP5{RC{o*kANpD(tr#|CckIw8cPvjaB{$qv&!S$UfIvW1ZY z9dv@iZV5X?`M`V1#7+qfo{|@MPttjv&h^jdv~MZzK%KV>HM1lj?iv#{v=cIpt_4WN z%G_}tw}k&s_|^c@*|Wuf^qz$0J+o*6?u8MGfMNrgaOt)BMO;%Y%L5G%*g~{(f2#F~ zR`k2QiRsCSjE+Ddl|vgPRsN;Yj3Femjbz^<>)JI@e`kZ=fs?<&D-#jjm;J56euy5& z^WzPereQJt{QTdwu{(cvU6LG4X2+gP2+A@BE}#D=`u zcr?09tNIMhJp)dqc4U08M&QZ zC;?{J2U3g0hiSOZEsQg|!$s#sngc%9MKbvns4k98b--ni2@rR6TD7kxD)-LY?RZj$35NncO^^XFuAmcQqoP93A-7GomSdTJQeoog8~ExCk87kX9GndAgLC$N zLw=khI0sEJi@%Z}$AOoA{>ua-Ze2QYwFF8m@E#mi0jxn`Q>|@@k_`hyQgw@!VVa zuysiTrO%7L8U5amX;Ti0OCLMfwOD>1x#+u14p?(`kQF)vgGR)LUTv32eR7nh7#(+y z{M$U+fn=e53w*^|0A5)DYDTc7-O1=hz#d7qkAyYpJ}+E^J7Uz}JmLGpgcF6y-%Vwn zZ-vcXI3^P>c#g&OE*d19(PMGWy{gV!xaNV1n|u*`kT4f1ofc=4-sfVL%9Jk{ANjB7 z-Fec$UhHcC34^diW5q`{Gu-t6WDh#3mZEZDDuipYZre*h#NUuZv8u` z{d?Nc{k@BZg7qj-@u_oX<(}R=-92l{uITWToBa$|w(dLTZpf5#{|6_@MS?7ye8m6^ zGp3U9b4io1^C~VcHMx2$7s37wEX^GZn(=k1g^ux@d9cMVxckB`{p>PNmq=M< zr|dE}a^JgfSzn*Enz!tN&N{7bQ}~hWqtSls)rNZ4k#zk10pv3(om)M9KKl3}uJ}~I zgy%74HjG|fT@g>hae0Dkt%5Hb zyRj$Tg#w@~J{cv7T?|h`aUV7~7@;qAkzwXq`sB|a{@xNR)@$aZ zVbFq5@-qCJkrJJm^=AA%QP}kSMuA*>2@dpgXZPQxx!c{pis?3jEbUtu@c|(C*a!<@gUyNIl^y8){iTUs=5^AjOB?UG(}XM|OjUbp z)mPu0LyVq?L`_$1y?!3@1kt8yZU?Wf> z4=GvcZ(`w7{a*7?w9RiYgb&Fb!zlPphu{|N6x1*0aVymp7gIYdw6o2Wx#bC%r=iN^ z7;-e7NaQ=s=%n5=^aykXtx$atiT3w?(=VSJxUnkf_&Rq6g8!D0FugO{(YK=RC1T&0 zNZ`$rVv$zQ(W3twv2JnI1hcr@K|4iy2K7v{bbd}#89FC}4=P$A+0(v!<2N>Hc?n#m zQvBy#82hOk{&`h89XfK^0Tj8z)n>vMWh{w8;mW0|8)Ps5N|Cm&QJtfWt;zwWQ`IE2 z-gr1~sCz26ZBfZRqdT{BDpiU^c0DAy)v$Gq3;CA_aHtxyRt6TTZO2Im8z@@Sz^ORt z1D^9{LO#czR45k>8GUW|e-i1LC_iGVdnc1rIZs!=qLx~u0!kB4E2pIf@Qv`%n=}79 zbB5_o60G#i{NCK*GhvMnXJIC6HeM>l-i5ME-MpCQm3TXl;!dZO?vSkq z1n8E%TXUAZrLKKg(>LIemT&qhLWFgq0(|eXb}z|?%{V;jC*9<+Xuk^>&3AGDWnrUF zc|wnofM%Toz~Y}kxiE)FJFOn|=|{quQZafd$*VKw>6Loe97AwhPVqO4k6Kem$q-*l%ynjwKLbyyEb<)e5~SBBh4|;Nb9XU@PhR7O2XD= zWm<&)rd*>^ezggI1#t@BQU;iC(F81%ODIfm+pEGTN-l2QFe$x!^gv=ky~<5As{hN3 zCjI>!B@o#Fp|C081dY|<%=#E0qd>#6c96yt4uA!d0vRqtD! z;W_IbA#|GYj0`-vh+X9upTe2}A`(PmszcMOlp*BbuNA1<6~}Qw*8WUi zt2#WPtZ&*_xzQ4rh^2&A@tu+APD+EriJ#eHT_@0mztc_W?5KsXuyw8q3p{?*>TY^a z!&SAGMiD0nLu_gcvN{g6roXU{ltCF#t3!EZyXeSg#c_}qc#O+zw+KAY?Fhht)0x*weAQkf!Tp`LA%(Mmx!$c4JQxe{N5OtO z9Iwh-Y_H8yZL#?e0fC}VtsjfRP^v@-MeanEFd<&Mm(G*Eiw!o{{y$dyC7EiXbG|LU( zJjqX6$J!_;_xy9A>1OUXe0Fvv&sQ8mbi&5NK& zwL*@O$5RkIX`^!k8JtGe{|Y91(Xr2|svl9x-0qh+gB? zTesKUwIBaXp&fU#oSaVhac8fExF%(R;){e8ZLQkqq#KU8z{4(4LWW$6DfOCeIv!Y^ zfgWANXl7)xE|q!~3YpTa%gkI38$jlDuAZ1pc4+0utnG^0K)Y#Ba1W3h|D^B~N`yFD z?wsT_L;RRhB$ZtFNEb|9#2NQC#gPrw^6)fT^X}A~BwrtBxOaz~pK;&OSIFKU4*v-y z1vBsd_`&ay!uxJ95^}%ec%?P7?Wd(wUN{Mw3P_C2;j2|31xG>cAQp~3rxeV2$tCez z7NWclVY&nDus%X(U1Y`l<$Y&B&>kiArWN{SB08_QVm8eq0SBT$Gky)OnvrcbRx*^1ZzlfK*}440|7j^4@CW{@-ckcLv8LSb z{(hV!YAV!w<9Y1GqxUyI6=m<-p-7kCNHpJS_PUZl2;MZN!9frd2yVYXWk|6#U|;i-rA zrFH53fFykx*XS5=Ca)bi>wqclc35qc<1X2qi^zUgtX-KYqenP-Iz4iJx%(r-|MZQ8 zCopHT`@FxBXueW>eww_0UbHOy!zUoy9=C-ow0u2+r;A(5{=vYodw2d=Nppxr-!*~T zERv<&1?Kp|_3lZs;QD-xi0--G6CIK~qVjMOTwOZu<5KtbyXduft+acLDdk>Y zT6%I4A7NUd;-~ZvG)PmDOZ#y&K^#_MKHuQX_IA2)v;Tg5J`EPSyg&9h3;Z+lzR-~w z!7Rum_xyPL8~>c3PqWhxb-Dx{G^VxI#gMZ()@}$3fvx&a7S-OJGmqm~t}6dgFj6d} zXsfxeLb^W+-N3Epsm8HXPl(~+!m&ORqmavpX{MDEU&5jZqD@x1TiwYBHwJ%>ixWwD z5oO8V929DgZw0~YK@bx@m6m%WSFkgY#|v+zS4iTNWFU7@jKlYCB%5hO;>phT&o$Fl zmPTe(uqHI2PMy2TMh8voo^VbW?WO>lq(Dv_rqA`x*2#VX*M`prwdpoa2`WYj5{P3fEFn>A_2j)Ygg66@uNW7}RMfGR12e;J z=`5YmZj;s|eh7ugyq;UoX8eijv4{GOP6%>fge|m7`gIA-9H+@(pgkWysEulXSYsNp zk;8(Ah`t6PXdJEcF&(a!cV#2}+6SSo(8AM()n~M@Y@I2@jg(|5apajW3@)jUbeLN= zC>F%E0O1kYf`2~Uh)D>xhwW%iggj+4eDHWq1LgQFZ~CyZ;jFM{yl zN=MyFz_Wr&5~3*knQlWIEJUnfwCvb19u&$P9GB*Q87EKlG2z3E-nd6aEHB3>6UllRs5r>P z7^V?ltXCle!0-U#a%*#y67iAKD#ViExr&>mvu32b4IolPr?*Ikwz`yuYO69E!FKhh zy08M@LF+-xf*y-IIp?G-%@ZOy#|wYbak}p`6GnQA<_f6rMLbhqC-`&Bg(Lz&36`nc z-Mkl!$aDZ<_3Q%F5juM57YJ&c=|!RG2>`HWAj>n9L2>w++qZP~M4n0i?!!Pp)04v;TAi4#H<2?gPS)uRBO(oJBg_jqU0xJHn9GQi6-1Sn<~oaMZRw)rP=<*_>GN50RA~G8zzn z^A>P1AwjWmnyc{v&xy63W9(;fwVul5sXeT~@bb+?5^4HPV{Ss#3tAIip-_&z+0K5q zB>sL6CXuk7yOg$kqfJZ7Z)8?4rcw&*r0Hw@DUkGCSDD8V-YgOFR2e*6}!`jiTj z?1W?Foo^tM$gtWQqPHC zniU{Nvj;q0BK?PV83Mx$iwa?bZuZ+MEuiAEAo zpit^;^0wE%%*|HLXyt~gfnV;V*!aPhOvP>~8tr&wYSXj5^npj+Fr(8XxNKgXM44F} zBWRvxjoQd*!e?u_Dg*~;^Nb+NaWHIH33YjqwNTJHbp_tYa`RvHzbI_yK!kWp~R&J?Mn+hl-LMQ`jp9Jg%+mgEOmi-7!7IX!S(>R{Fk zFV}qD%3V|4>53Ke`V~Ap{}(Rg8#;F{2JY4UzneeuOWNm4q??}bP-6)UkzwA+4b%24 z5et&U8MKxT;n+h7O$xckA>7o|hHk}=EDaxk>M01opr_3=)$~mh@%V!svtBtyrx|MW zM)Y~Z6O?-7aZw`4@T0shw}`qgd-7C2^%#sf&u+97PA|aVkt`7b^{--$uSs$S+;PvT zO9*fUYv;>2hPwaZ5d6`S-&O3N^kjDx?ak0v8}1$2z+y^uFHHlOqD=02LQkgT?*dspdAh`>k!pvnl}do>P)-ycatg)hSGJhoXA zPfgvEO4+7b`C%`)=@i;vRQL@dNaA^^LUTFN#|eZc5UA@g?vwKTraFP{e}ud`Q?n5x zLi>YOt5N8&i4BETVKX!JbdSzjt{P+R!TzL${CxO>k}%q#$Q8297;Rt7feOO`^Dnev)scA>^SN2Q z598Sv1Z$fiKF*R|^=sg?yhKjO;=ELlwJq}k`yfkGGR_;MaeX3&Pq;{R#@5#Jp7kM$Af08I6_J zwBQZ4CRnXa5h{gL`);`Q@$%KsNduw%W<7@k&YB=9`e&ZNF$vvW=QDYpJ;B7;bvv%D zvIm{%)@)YAU>J4kb^K=@k_HD4SjhdOnxI1mMc-2tR_>RowFwx90^_V3USUZ9OIEZI zK>=7L4$nYEzUjrH%24Rmueb+Cfpj{27(gN%XPkq7lhuG`h+vA+TI~IKHL9o;Dhm@0 z<^xAi-yw9(G{lA6z}sJ9e>@Q$+E`ea*FB!^Lyu52Cry0O#nsCTc<)o43axrLArKBr zn%=Yn#3nH8x!xGI^4;x3Mq?!~e3*()gKr}_tGB$GY#i_+p;c=jh6C8?5bl}p-jAtE zzw!S8=3gTgiLTG`pfMBbcl0V70Srk`BkI5E-u2Qw;gZ#0K~2Wfg{z7nco#jyuD3vTVKNB}bXC^}c;9s@AKI~2Y zI8;el30PVk%zQTAw@W?n(*6=-Tx2a`zcj#@ff<#3^LZUK%p+jD8RohDnW82!SK#d} zcj_psFxzBfQL>L+=eKWcOG&B5HYdQXt%*_jXufdrp|_g{{pY34bf1Z+y4t~VXl5P2Q+r0^o_8t+0KEVpL$S*Sen-AiW_##Es}UKVbMFCbj&@9 z;!T9$tLpl=1^m7_b&4~p2c_xcV5013dCOcX)Fn#vP367Lk#KpfPt?kdz(HIB*L4tGRD`>(|+n%y95nMlA5YRz)^||>r_S- zY-+(jF$c}c(F2Gy-jSpSc69Oagw>Pt(*T8fIL`pp@rw;Y3@Sm|Gk5P4QQ$j_!tYb6 z2f4T3-w(py6VJTEVfEBZ1HFM*F;3<#u>p6w96w^p0d^|XoLkXB1>|v$k*+ACgZTBw zv8oD-(g@&o3#yInTU|lz=F!?-XwHq*%F1bmpP8czB>39PN$tte{-iw=~D%iAG@m0r$=!Qpdf* zPIvhc;|Vn17y*QLvxMwGwG*F=w5s}<;Dk-=2*u| zVQ&%}s1)`%J-bT`P_(bhKSwaN=kXjcU^l_r_0ZHje=nEZogW@ z&7~7j&pvuedSrW^3lOxleLjlb-$U>-5Q~WMKKnuICUf^5;@-i#fXwt^HR;$G#zll} zrw5q$xxZWT@sghKnXy&M<~+MT^-wB)FNsY!bV`X>?9X8w9BDuJqv76|`uW09l8A{E zCaOZ7i4_>_GgW-U7qmbOaMNZY!d-x#2g2tPOzE*$)~C}G74zaPY?i0gjq|f(_-E5X zC7P)%0(ERrbj-{Z_kVb$J=m=glMJ5}(hiSL&4PwU7VMR_Kk#r2bgpB)Xa22oUJtp=q1FG4$^xOu56=+UqAJ9C97WNwBu$9 zkf4g|gn7gc=5!!BA4)-VH)5x$Si_H{0xsr^&;{M2#QtrnSxPvGK?s9D^d{A*+aPm% z6dRLgR^$JVe?%nVdJ^gkyN&9JUP-^C-!hPD*uc1in6%R(W>;5;VxI70_{PDinM@k3 zi+C;^<0uF*9KnHCKD-6$pLGY6;ubz)D_&^}9TyjjF&+JYQKm0u&ZbS7B*|! zLeHgRU>Fm(B`$`cSl3}vDj#sx=V2|0;EFSuO88S0Z3dN<~1omj(K>}LZ! z=Ny}tZ6{MqG-LuCK#m`98o3%T`ERr2cTeJ&8z21Gi71ddlc}SQaagieq=tV(Ify6v zXR!QVV*b(U0FceurjYqvLrPRQoFiCEZ=p%`ed_c81PaDt3{N@dO$~kgXRGjcOOo># zv5>!k&|m&RgGR{xzEmAr$!j$=08t76Rn1BQ~(GcAO;sRyO^K4e>$&Oo}k0yqx5JXrF{8&{s!nyE5pVp<7N#k13RA1COaNPry zf99QI$t;p1loO_CjHp{wB;%%3z8^RCxv@$9JnODR=sE_dADV*Q*gBhp0>|4;Zx*8F z{UTEm;vJ)v01MF&1SOs>^Dn@)lgcjL_5B3JxW>{;)uGrkT(gHX5p30iEQ!DBsN8c5 z1|$n1Tgjp#$m_L9h`Soq-2BEm^F_|ArhQ5Z_6N47kP$^G<-37FjI4&+Qw}^Qc776q ztDy0nF%E%{z!i_12%mqknEaTB(iPIPhn7Q|POxVq=*ZX@?B8aX&DR*=Leoa1^}=n> zh0Et>*xw*$8_>OUGK)F%ED&qY`gMOp4Wvoene=ygj#SZ0ZDqGLUf7HIM-1i!`ui|l zZoLsB_FjyM0u*aZeH$dXT&Hf4t!n>=^Y}%7Ju^U5A_IOTI+LZv&x*`O<{)NZm-CCm z?IAcJH+_3uKIWgBY~#{E-enw5O=sku1C?I`nI>c>!GRAy1OcUuxTNI1U$^0NJOESW zjnnC_^hfErXPUxJih>`{#I{&!j*LTGTIM;;KUzOuw!sgO%b1#v62vG~s<)*W6x`Zi{L2+IYW!ud8) zC24d7*?nZW8%YCxOOr+v4R0iZXu2GUQK!8%WW{NUH%*dT-n?wuM|E|NQZF=^~Qc53Awt_(KNftJ*!N&1zl+ujp6 z*B{sy&_L0#kdm@x!GgdLa`)Kh#~4bH!MS{Y;f0-Evp1}+3LY6qqs83pT--$6-pc(1 z?Qj8$WQikZYDYt9-MnKS4^J(|_o87Qt?f*ogLQB#h(zcIXsMMrw8o+WE$;*EQ5-*< zHXU6u{c~vT`P@8;HX6!sBqnsp(DJID&FZrvmnr37pB5_6--UiHK~6eyRGenj*N@R1 z2T?ChZR;4V>}1CkU=Cs>zzHSi<${E9jeV*D#v`GJ5G;P87QEIH*cHiR*tC9@hfpC{ zOMB<0G~^VcA{t2xF;BH~<*m5D(I+33)k&5{jGGjMus=C8MD#?}?M9a^>h_j>?TxL8 zJIp%tsMztU6jXH6{SY5v{>Vd?A_XIoX)#FgViWe~L{g)sGLC_a&2vcKwA$ic^_J`} zYY5hxNYO?g$b7f0FE3(!XTrMQ#lm9fKX0!3KOZ`XH60($E_Wz}##v5fn9 zEfbG3Db_XxT@@-4eS5$e&I&8fI3(wk*OGKI@lBVbVO6-#2lGg30h0zHRY7-4Sj1zp zx)yOutbY;Vm9qwoRk16Y8QnHoni^?$3YfvMl~e)#Z*fxY(e@ML zo4Ft#mhZfIzuGstCY_@sxDf7N8GFvJWfsOxMRZ|{`Pbe|Sf+EwIIoY?ix|}Xr7KEQ zrL67B`$4Tr(K3!stGoSRmYh~kt118b+pm;gR7>o8PHYZ!Ey>Q)^i`SPDypd2_`*{0 z1VE(0tOj{L@snnj%yhuZQb?pacED$ni$^kPXpppYk=NDbxfkQO7K@iutn>^ocohH9 zF@O@}ViUrCrB!uC!4e2!ICda!R7NWen?O;Aq?d5=7q9^D8>tGSdV&g=&Nl+@BG`!K zH<;`80QRa4vkm~~{o-4tPoa$kLae!>imEH}4|~q@RTAi2l+tjUw+IzTMYB~5iNi*Y zkjtV&&(DY5*!m;Q>YX~}I+htcJ0z1XE`Q5&=+GOWf}djKVu(HvNhv_nv9iozEh)u4 zy{QzFY~ZiDUl&te$3cJ*w;1W1VY7sGIS<;p(EraA>?d|+5>8+2@vGQIB+0^Kw@q?; zaSPt5;JB;aRWS(DS;H|V2kxFK@xh3f_vAY#j??J3Y}o=WvjQw#^tZfkDBfbZpc1S-iU%kpZ%nx+9 zRi|P|zAm{2Ejd{Sz3%okM>SJ36LvD>=pn^*ujKV5X6pogCz#!5!VE)cXnAk7GM1Z`($OA^>sS z+J@WIps!u>DodC)t7^HIzI$5V@`qLRC4m zu;Xsr#5i~YUboY`z219TvH14I#z(smO3D_OL}PGxMSzxWt~aw)^!PgG=t1x>h}WBQ z@!#CVNsrRC;S-wq5F=*CN3F4G(iLpyr|r|}%}q8)?ek+oc57t^$*M1MF7Y+v?#ur z;d(A{ZM(#~Fcj59elk#+)a7(2plYeWKSC!WasFX18LdWiP$m1{LqjXdOgX$g@g#=V z-~{QXUY+6+tr^J3Wa9G*;8oq0EV({o``AI<8UmX+FlwTdSP7MfM=4o%f6}5j`OviO zVGn^9saYS_VqkF74so5doXM%yXQK?EDTJJuVFI(8H|B~M>BfZnRsm^UAN^ZgS3*06 z84AN zq(!f|P3f%mHM8OOKvihNewTmBBgfzqlf{ML`3x|u{Z;Ez{BASd9K?SkQ0y{LLJK?h z|GF;1&&P=qgrW*Nx=hLo?lJy7&sLndqb3kkCcrTJB|TWrqc;#ri;uJ-_hHpj!GnM& zq7Y|Ur+J7mlrIJF_BxH!Yi-7|uk(AN*S%3fcNqw5H|)mzQDoNhe9XALStR@jnei<& zQ_3@dQ~l%U#Q)0P!E35AVwz$=ykzZAd|wtyRl{xAMGmM)Te?P#6Za;ppP__e9x8=` zhUhQ%=s4kKP7`QW0m=iUKON9COGg^mO`?!VHv0a6Y0;}1?w5Z*`1U=`n6A3u^}yMSvM2v z@QXYeDTkD=)t3(}?*tf}-Lp}O3j$>}QeH@Rh*%&6@(<~|!7geBIM30EXi&@4W@AZ5 zzRMcfHPXgqbs_im1#I$Y;_iJ&U__sYEfHD;4zvhMPh@|cp7A=v4II!FFSo9Zxo$G7 zvF3zN$ZD2jsv_@%RcI;bkdtdEB|MExHw$VO7C28OAMG*A&~ND(xe3bQOmBT4uG|!O zx0{5wBMEdS$(d<$P-qUA>GU-CtO9R1L{r?@6CPrfas$UK-)xo04hu+kV9DYgx5{Q<88{3(**(A z{*qwUGy}~h(EZ|SIE?O8Rx0QNMGgHJW@30};0rIxe^Z47J<+f=gDnxMfNY{EfiCn% zJ%>H9zI9s{X+Ba!*Ln^V$^L1+!-nl2X0ZN^KHsoZ^@Be4Q>J`!;VzdGZvSPxdLl%o z1csCEE_1)hFfo1^f!Z&DZvnCj29T>GU{0sipWdxw(X?Q4bEyKTr1>W#mjnZ~G0yxr z4qoMa>9O6CDlbt9nT!OO@1@4v#4WQr<5;aL) z&%m4OlYklR51?JeD=CRT2TLp`8SzO7vCHe@2qn$|6b_pRJf|*2!bn2DO(bUhi2i*p zo)tR4#N=QlB}eKE`cs7|x-sed&B->E=wA5E&&_&d2GKiQb_M|raXKHvkPG)S-gXgD zh|@~012^qMOpodPx^!E94cm)`bUL25SqD2#%26^yrqN9!#93;>UjF32Q2#X=%snZVC_n~qO+@0X-1-n(^+{aXp1K2`3y*Je$>>9V#u!C^@)psuo7 z+6}oQrVIJY6bS3PUk$;nSExK)>x&p3lB88u|h>=wGJQ*>>f)&dQx=&|aCi(~JW91;And_W#2@N~>oxmKq? zZsR(`b-tP)H7@yX@=;!rxgL4;6D)!~@Nv50-y#kIaB)7&L;l%RR_!_ZS`o8OtZ1V* ztIJWnDOP@fC+XEh!Fcua5i|u-L*o?zo&|78>VkFPCL$JRJ#5OMGXO^DnK8_Bz0la|3>t5f)RPYNB=L!#Sdh+2pzWzNCbMyu!D)W^HSl~H4e zL(Z$D3dYZbW%`SnB`|j`x?a*z+&GXMzS7<(7*V(_pcC6ieolGf_9tYJM&Hg&@Rjiq z_j#8DIoq?bH+n0a2bRwo_|T%Qe+L9Ww6FoL)T(n|ybJhr$0dW*X=95O%<@NiXxJ6A zuLW{*xs&%B?UrN%Ch=vuL{!=h2#0K5%}Zwu%~vOB3z_UD*fx|rM35gq4q5L_M$@N$ zEjL)U8}58-F8a?7OrFaysg9lUXM|E%hk?f3@`6XOM9lgen6vn_`VIz`J~9X2cYJ{` z!Ed($6&8Zzg;)LVu7A`0`a};<4a9ESRw{tgn0H+|vm5@EkeDnw7-T#|)=n451xIgP zACde+vv{(TaLuiQIU+pd6UjA8BX73U%nK^_hbJ`o6-pGH4?|V>C;*t*j$^7JF9IN| zX;1v>Sjo5nk^)!IV0B8M578!SX92O9uia&<@tJ4Z0Rpd)lSjx@B|cE4ReC+3ac^jR z4@g2W3ATuMO7EO$P)5xQxL(pMm$_1W7y=U`>I|J;%luf$G`AYpL7pq-OzxTtex1>1;Q;C@;I?tvQWk=A@@GoZ@k-60Z|!JX0sRS4dYuY+ z?z6K-ygv6$?hS-2w2v#&DpcM=#k66-*QzA_Ymc<@y?jZhqTeWPoFIJJjAicLLrpfD zh#PZzqgUU;)hS)9C0+%t7=oitTWZ-h>8rn$~cYQkcPmrVlQprm%7N zF%;ejduuQ~YN=WB_#pEFwmPcIM|$1MJzyfxKr@@h5#9uz361sk(+`}C+k<@Uh*Zl8C^E=f#obZv7 zyiT+juT-@e?a1uE08&8i!d;TC_JKx=h4+fppBA4S4pOAdA%Scbhl`?smhzC9oS$2p zb;ynG|I}}o{+oUSUA&Ae~e{6O?i7NqkX*a zyIE|VQwaDfrdbH!1=(5;BI1ky6oWgp+2KPR=!6Ot8+hHK3<5j51tLG$G_TE zV;oENWfz|OfpPPW+<|=RIEgNG`r`png^qf<2mJ82N?R8AOOW?)8QMqN2%_P%)(vio~>ei+2`Fl^08um^`v_@;LVi5zSj zCbzElUV*-cd%A4Q$#H$~Q|Z-Vf5x!VFHeCCsQS$1^j$$~r%` zjeZm)6nD_Si}eT(7t-E=EI_c*vM;}Y*9sjGKndTC)bCn%{x#WnpIFOTd7?MVaauLOT@-70 zICu;H77`p@V3Vj{Ma+arDi8}!{?R^ceUM48Je3QEEB%H|YvP@O0VqaDmUe1!H^Am6 zV|AA&{F-^1mTi*LH~6)KAzbsQOhT$J{Ss~YtxC26C-@UMc$78%A)@5hkU=TqEE8Au1>>$qWER((~bPvQrzZ$R=DS8Lxir*v62U zx)MFZ0wlG8@3XN-m$`9kqNN(fFE3+ANkFMYQ^`tkgO5rr$r zT^|8|bI-RL%Uh#8^Kwnfn$}~i>qT*oDt>*HuACPA)j~`;EcBLB-p`*?lSWRMEJe_- zuWdFcbyo+0wIF$BzHvWrX9yjsMifti;e1ih&BNoJpJ;eW_0Wu&p?mAu~r?@H=R4G%RAk}kUvH2&V>mVd7K_WVIwe;@tpt|8@`o;pp_iOdu z;#GUpu$^3=MGf7i6VW7I{*(u8xYj+s!X`%_%2}|So%G8=g-J`n;ZC5 z9L#&H$DUFI1e+1LDY0;ic}(1LfemdVAPKMGoLZsRYYLQT>FNOs=SXdcq73|+=;sMX zd{dI8Nmp3AXj~CHDWN~9YXJMHEyydGLF!<|Z;4Z|7UE=*VI$Bm!;i*hzZT4#b7yU* zq=2saw5gVTXGonbRj?_lP&UUUM^#GXUY^!<`v}#$-XL!qM7`hQuT(tfMjf`Lm~;Wx zUv2NM?v|gOtzG?StmnWBlG(l+xUVr15oEw0k`!cn#$X>fzDk`3_?8a=Cu(-yWt_r* zWpB^z_2Q&|^ZVq-A09##W^=c4NUO@IHU{HMcsnC5wxCEZYf?TtSR;>&H`9~ANM`x? zlNr-L?>{PDDL;qc7t8C3_?0m8~&ok$YUStQ}VtnM%@n}Wcd_h;!J7+0SC zSDmAyiZtHq1Szd;d%E}1s&9KS=>@qSK@>eQO*340ahyTyBln7G7Tfw1tj5s1=oyEv z_XL=(M$ODZITi`Gkh~mAk_eHbk7=_N$YLS1c{^sdh2qDxCItr69#ds;zicJ4z>lnbd~KPDuv2Ox1JoJ0|ypv zg@=c=_}poPLA`;!@QdVPzWV7Icu?ywi4;fP$(K^i_n?J`?ro3j2by=sj;<<2ksUpa4V`afax zr8#N}yUNmZKghpL8=AF_f{;3n+5xg{-g#>FRNkx~K6!jySoKD3?sRp=JC1ELR;TPv zB&KeftQVYKI@{)K4DZbWnH;{s{iW91EkI+#syYc#Nu3_i`J|+Qo>=p*JbRj0IrRAc zWGckcw~q;*=k;!bC0mmCVoP3sE)}0z+KYDf_i2(6kCisNdB7X0OpIEY;*v)-Jt2Q# zwA6J-2i=_uk+}PAui~!uBW9OqlqC4n#(ftOHKBed(<#ZyPW1#LNmeyV^izeVEY4YK zJbl1z(R70LD^OQ+C^L7CD|eF|U1_z_Sr`;*VsBuSC|H>rFtP2HM(v&1BQ%hhJvA^WJ1e#j0@LUmXBnaQJ!z0VI)B><3%dgu za-W5hpjtak!U!uOhD28KFNfkw#d%2&yE6}GEb3leQgcbflokGq=60JN-=1_zLF^Ec zMAwTf8>1vF>phaT}mJzU}hpdgY&R8&fhDip`nv*4qDLoGP+YtJP})6hph}$ z1H#*InrL9_j=3M;Da_vPK$tGVK2W4K9J7P;ye;x12fz5{j1l?o`Va zDwKnR8s!KssTazjs5U!Oc&8^U^s>(0wNk^(9#-lb!n|bBtzHT=Hq3eg4B0>2lZu*i ze>bylSIj}pviGOcsuYH`r!XC;4{`OeD5E(S*oA_R#b7?tp;#i7V9gv_zdCS1FH#_>FK&=)7TFK6P){hJSe z!5qqjoSa&o8v|_W>&FqQpFcqiehf@9&C<1v(x@yS_A~6!`g5=nUa<#`+)&183^rHb zL`(hOhc{(f@Kmb(vykzSdP`H{GUQa zs+h76tMUx@Hk|3n1Ui~Bo_FjlKkl?lC-cXkq0^_?J}HyE29^2ricZW~D~M&ycf5LY zXUf~Wjw#*Z+Rn11<|%tKmg+r$Ck?X|rv((O{oCW$H#uq5DVVf`8d{bF>KA>zA{(@- zRdbil;yD^kE2_zv=|t}V=iBu{uh9%&>3V6+;)JZ|-t*}~k)+#!D!;ID+PCs|Y#|v= zt|nI-H%n`WV;ye z`64tEpoCw=M&5pQ(;YmANlQ-^Whs#C4Qg@qi85IRXC*zK=wCj3{QoKMvi>)Dmyw?3 z|K!~zjgEg9t^dIte}N1b-AU`__WHU2nOMjgvz?}0JMY6fBmZ>2QPz(dTNI{cP}4dV z<*gdlsXCpP9ld~|;eGe%59vplOw-}_1o`RoU+|W^^mNnkepRCHPCCF(Y}9r78pm&d zfr1bvw_NGeWCnBs`5g6Xxt{=A=PvB*Jtz;m{$ssHd1%wq61r)z(W1@##hZv2Tyy&8 zxEvVrAi&wN^7j5;$EA&r&i~#}WKLNgcxcmd=R?`mg6}WKe15~7_4RaVZ6kF5bkm<@ zX@9HOi~{h!zpdnk>8}jmK6)m2Q*>^2SgC(WmHojy><0Nq;R`{xZc7ffc);5RS?T+5 z%)S-gEwMd1rPS(~X{nilkcsp}0_=#jTPwYy)I>VC`@PkCDZe#t1ybb<*c$)X1<->l z!|XR71nW`ckSRl1_jelu>}noi$%8tA4K(pfsxL2?EleH`g-Ymd_Q9WbMTuwQ)sDwO6!H)eNnWVIxi*{h1U~FX(gZOfdkY}|mYdKjri;&(B&Es2{dhJN@pwu}Ntf~;5JQ~^mkFj@bt~6}7wPTwd+ja*X z+jcs(ZQJ&YZKq?~wr!g`&)RRjwRY9|uztk6>m1iSjxih)kMV38*+nn*v#s|I2J~1# z^?gs`YbL~auakw11<#|nx+VNYPf^^z&6wPdcH9;y&C72|GVmjLDq(B>b>Q$WUc6x>hNdle71v4=-<)-PS^ixK{FYYjgSv)%Rm&pqyIN3r=YUP#CFd?; zh{2pF*OneBZW&oe2_Oq}Z&@f|p!T%XEYJMqA8|{tiKtWwVX*=Uu z%iy`&lC8_Xj-zNw=Kfd3qdt9fuY$KQ8#Z$-_b%Z2=P*A!Zt@0&F1y4<^u8R;-7$6g z@8Ht1#K+qU|Hg8R+oj9t~m)1n^D>ArP+9-Kvbxgt(LwVz_L8MJ-EmZ#;h5EDI>=aOdMcV-RuYZX{y9WGrHj`2jv?7Gqpc*E`ezPK2y86`^!hx~T&VTVx^J z#66>B7Zh`N;B2!ec6nD92a_E}u*@trP8LuBGx-+3K!!)=OG0Wdc#54#3?HMIJ z=>!E%!O!*aGlwV7X(MG|!y6<9)LcK)^YZY%ccKH!>9@|mbqH8wTLtJWJ4JK5R0(Lv zTcMfz8_`m~kYtF|h4!_mMLokU%SKCe@hM11?E7BkM6A|=v_+NcDKK)K}fr4e+b#nXXfBu(2 zG^n8`-#E^*^P`SoctppKegRY31C@oQ7hFsXYl&`)BlLt};Mv(y%m?s$FukdGmOM)` zs!K@Q^>K``Vv%1f?jKJ=#%R=i>oLELYOINJ44}5+Vb?@G@iRgQRPl{ z9Wd66)E#W_Ofo1$6D6{juha`YF_^F!IZ{<4s6UYL43i!~KgfVwB=EDekH2p1b> zD$$;1C5%ZxizAIBXyEA!_I_XBA(qifT_~s33hx(BWEptbvIy#e4?h&8cYZyWUQN$4 zPY7}4m4=}%@Z(2Dn$79W4k{A?tA#J&yb=Rfo3Ns{f{ieB z(c8m88-t(Y`DkoE3x-$O_s#7-5496x@3$j8+ z0k?~J0c4fjDk)`jxoH*>6X3oz3e+nNgtKyIDAysv1y5)p;!ma)H*$Z!Wu8&|(0K={ zuD=rG@~*Nf1(a7LW#wXdLJ_L?5ma= zE(vL8`6Uq@C7KxZR%f;|Xnjym{GcaZ0Vf^!oZCyI0E% zvKzqbiLM;)s-apvYNDFA=bj^%B1*@D%F(DDATA;-Jup3GfKCbr$p^|!PA@eyY`p@a z-R8`ikxsnOQ944>dy_uaJKGIqJ*e1k9^Z&$)K_+nOr124xr&c2g@B#qgcgzA?%P9Df(xoR zvN>fT&)s!2s~UwYK*DvtIiaaJ`DBjQ|B_6^pgx!gkCbyC(j~?J`KzglvEq(zGdItP za8qk8FFtXpz6LW~Vz3D4CN1aM!a{a)dNLJ@jjSs{z7H@LmexS=Xhb20hhNCEj;Rr% zQVWqzrLOfmQlqDUhLI<;9{7$G*VBYZS^K1;fc~jf{y2=y4mSv&^fQ-MB6QjDyLeWK z8ETer;zGTd>8rj6)d}ds@#~u^0)ID22=Ac!4fP8__&$_yEoXd1kZWzR zs7A69Z}bw#TTKW?1k|ld9IN}#vTiv-sr#X{urv>-6+uL{Fj3U)t9~ZWx}}z)zsQP8 zHCm#}<$=C*`)rE)kB?emF+TC>exE_G3S1#C`dGUKhzV9{=FA7Ha+k&+lFklDomdVD z8G6Og{9L9$YY=BZ>Bpv-CSlR@;@opuG zPIRY3kIQc3uy!rRSKd@w{-Ci?Ms%`r@ChxC*XMafZbbVN8NG4dusEO?ib;o_=73pTE^x6} zOWvTBu8mitT`z`q!Eg$zzQj-Js<5dq9#uJ=Yu_YqO37nUC?clN5=A-5^fTO(XTP}n z;yHbT;_|7Sk+cH!1ATHv0h5yk=1JB&*NNg~ zUn`c8lU9FM?t}AsQ-M2PH?6+RS_0F|B4^BWwCMvcyDMOEoScvJY1UZGVqM>5oAR{n zPNgl;G5g9#UPh!pr4n1=FdLP_X^eTwB;;01Mkj~-<62HTPs>h68m9=YDq2%eY5q{A z10?lb)prcgdf6vhD>{|qXwY@4jW69@NUl1vw#s=l)zb}rv(OzBBd>)`l;z_b^JYd) z9B#9%DIFvm;hVbW7}cHb=({k?)-m8)Z20pmS~Bvua!+nfk~pU@=i40&5lgrCa&EqOZ#GxghP)d;ukTTA5sPNr1k4rc!k8G`M9 z#RM^PFme2MeE(2Os%F0pe(PE71yLCN5yLL-r;!t6bJN8|1d}s-Q|5Yas@S)CVLpkL zTNVK#E&rF1!=5_p;IWuux=)VY-U}i*4Y?(cqfgs+2&PZ(ayR?6?;HE)ErSQh6wfoG zw^lK%8F_0KKO>{T+tbT1@7Yb`j7j6 zI`GNQ+Z5!T^YgytA+-B1um2>l`Wq8p@Ba(jw<%*(()|JVUtj*rKomFS4=@m>gG!C0 z(p-WzLl~tswETrJX_5*+5*)D3ck6Ri;b|M;lVCS5OZ2Mv5+5`lf{(vTNGUUtA;vP) z#3yBNPrgN^VoVYs0Rxw&5($p0feQkfX^H1|PCw1JA4fnbvGcTZqZK$m{Y;rCM$Hu@ znR9m4tHFTyLI$I7W_xLr)76oR+5kzBHnlk+d!Hbuclop#HpbY4;GMU=3fq>a9__xx zx)I0KY9n=^kJvAC3m}3R8KxhjHP&!)-WG<4H%?$@uO*LJW0y9|IqbyYikNW23CzeU zMkO7-x&}LsXWBpSoe#LKK zlx&tyJ9K4K<#KmI)dy*azQjW0&7^kANRo&#Vb+@Qkj3a>Dg3eUK>QeK=NB&XP~Oj7 zD5+?DX+F}XEFI_`?r1-*PiCi`zdWaYMTZU8n3YSeu7EaI;}Dr<(yeA^-#DoD;fFnX z9B+RJ&6Kt$-AEFQXL#dowp>@A-zZ+f;6) zD`SSESFwj8L6D^YXzmg}O`&QbZ+R>`ac{AmS1&9yTU!T;ji>N6$(tZ)6}2RJ4FG%2 zvfHv(m8UrbKB_4!>wAVx=Qe2`PO!%(2fslTHQ#jx=DUaK@9;nRh8lW{L{88Fo8wpa zL=Ni#Ghik``XE{W8HRg%cy`yEB4VmENdv2c987U-Q37aKsvZ?8A!p#*FB|*`q||Vp z@P@yK2i7FaEhxfYvbv|Ng^Bi5u+(!Fni*>(#43cgKUHvqF9=kQlKcw`dV4cXU_Zx} zLNgfORcFJ!GhlYKnC?Uc1#mAhE3C^42>Eov+Ha}3rOhK0W`vLmCP8DRPs<5#Q9r85 zo5w$?HsP#gG)!lHGi_k}O1GjYWweHpnyd)A#}T?_p98F+T4d5(fl# zAir9XV8ZQ7mm{!$vf^Ox3iS7MLU{I)k_p}P537Lr)m3r=C$XN|0K*+Mkc3F;r;+P+;C2>v@YB!?4BYR06M~pB>8HQv*>(^yjAs_Va6x)pX0-)1`|*AEwRzpvyn|j2g}ETX z2|GWrhvw$R9NzQX6mAd5uW$Js$`IU;i0FlTNRA6%q`%10gU5#x#i2PaO08-@GM^)M zm0ellJbu6>_mnPR-VCCwchXiSpSKZ;-j9{`h~=KVwdhuTv2LiXDW(J(U0Jp?S_28n zNuoXkU9m==m*^H(#6get+Wy;qKO$+X2BTJxiQ-eUmwLR?4--Z`7(6jK^Ui~l+i_Jk zJLop*+~h%-J~~vZ>_jX({YObBIudaRt!%T2GB>^xr6ll7jeVls5CaV#jkEE!iXcKF zQzPfam6SRX)wZZA;&l`)`f@qh!d?WwqPs?DkG@joy0URiSw**9WS0seK?<6(5EouQ z-Ry;%7NKHdBScCPWhPT$FFpM7BEt6LDAvMKtcgMhOlOVYv{UVb8Y4%(9qt%=Tr6y7 zcSQp}#rQ(Z2Pf^U25Nt4S;OpB}Zga@4%TmpVk z-OLGmXJ(a-hzM@XDY`!N!pFlr^UF!xD?X&$*k#1p7_NlfakBEa`ox*?jKSbOWDZ8N zV%W|H_gpcJTqt1LvYh>TbP7b3aWXH_sI}344%R7&+15Mz4+BtOD!@|=$jKP4xGTKK ze|+laLRXrEd|V$`^d_MUR&Vo5T1);wrRD7@c*up%NG3~h1wBT%~(|7ehOL)VS7_sJ|# zM3CEf(;A);#O9@Jg@eg(+~nG5{iWmIXusrz8{$ioO`qJG%kqo5-zc5>r~g(>%5sJ%5?SJ!SbA6*uOL0W^y+K{v1?rUVZBWQ zD8rWUY_YZJR+O+H!wPkkcWb!gfuWE9#HzFrG#|ze8fbcwUvS&~)4`cEsJiZC!WDA;lE;@G@j7#Jkqgj~bOh;}HLA>J3QNSwD2eQ=l zBPVrHe+v+YVH+*~%$-jFHM$_dhiKjQ%iFHfuYVm-fhx2c7mQYsY0Su%JH?28SLIcj z>ohJZ_=9pUmY>&^u1Idg8v?BDZ_IWx#EYA<&|;)RS$ayvzhiagzxJM+E~(O!r`S)| zp=2}TQY^#EfvyvqN>HsxaRnqJ&h^4y%rt}9cgJXFJj?&Y+cJcD1m4zhV6-pI@ z$obsa%}ldtve?kwf_g|cArPgYXCKQjBsI)zG!c-_(~`yZd)pk%9eZ>QQ5`vjM^O{3 zv+WgRMJ8cWiBdNGxrc-};c+c?>PsU1d|X?75hJ2m(iL>tR}_Ze!oAcJKLF!Wx3!dw zJ-+O6$0)b*e$mSHxZ=GgH820dICWGp`f!g2b{N79l#O41Qg)p04F;RLyDQ>RP(4hZ zhfmJ+eQQtbvln1K-z*Zpa#sEQYbW!#dsFcQZ^$5{4kb-;)bslh@f*AuW#NC~-r4?FTnGyjC)0nwaXYm}tN(v4#1Y>wvK>kfXJl%0 z9bDsq&>fZGBHEV^pdq4orn-&U-*UBVQLaq81n+8@C$jn_*X?Rg!vZxO$>S`*Ry_rcLxN8KH3Z zwB7FZug{Ss@vkr_O=w61eZ<#hVbaQKwX1lnG28UpJM+0u$715(Z?E@Z;$V^}NrqKY z_BL{dTa5H{L$&FR$826(+O3!Uf19Y(Io&^vq7^B8=g?S!pU>MEWo!zn2iM;^Uriql zdmZ5Vs`S}xdjJ`)hRZESwyoh`_L}=RRNnmIcg5)SW`hNkbG0|f(~R01du6~?7Lhi$ zQAV1&^cf?UhYX@x;F_aPCzI1LdhS}5*vA|@R-STD!!3<~A1!he%gHVinifwf_XU3P8* zSkD_Wj!bodbQGQ<+0ApmO6d>9yIX4qsC*>56J5yFS_Ouqqna*PhzLBTx?wwxQe2g_ zDGREvFkw5^AZNBL_j23JFpV8l>yn;*rMvUgZ-z?MnF1(p0}zTtJh=+@5R92Bu))`D z{t1GD=Q-)RaBQf`0Mmf+l(hI1GNL-WblkyMVWD;cV=6qwb6T|*_Q>R_q?L%%TJTR| zdF39{$&F}v61wlpIAt^VTu0R~=ipJSCt%4FkT$tuSDSsMfE#clcIC^Xp)+Ju887x0 zm!!vtpk5X!!SwSMkH@`I_{P&}H))qgB(6G0kuh@1X?Vw$A{sKXFypFQcY@F2fdGA> z4@7n}gp;61BiVD!co>v7d{70y=tRGCb-P86d8K=y9jMB&uz$KV| z=_FH2TUaRvpwQt4fh6x!OkniUR8RhE^~^BH^? zhMp<(Xg?SY05n`OTjT@u!F`gF8jyGk8xcUnF-@Wn?Tc&-L#TJZA0~Y*a*kR`;f|EV zPo^4tAP9$iqHrW!Uu9MTmqV+OkNvrGQv=LW2PgA%=MWuBMpm?^y^L8+;_FL1h|7EDd$el z2xRfRP?2u7NN$jow(s>a zCgDUZ2&FAj=cj+d>Z^9i3fmt*=hON3h&X+|A5Wj0695~V3R6MrKf$VXktQIS*Q7G8 z@N&7zR6?Ug$?;mbTyEf4?TECz7+#{6hH!}{kL0C4iHIhO7w#eYSFi)GXH?3&7yDfI{j+w4MolgWeZk-He)-uDq`*AvbD54e^4Qq|K zgWxhcb>tH$|1Efh)7tB}?*{l1G3`(i92hKjdA}ZeAL<%z2bY=8Y%?yevXD*Xfc1}> z$U*e0XER!d;Su6AcW&Qh5LQFquAYWFtUY$xEjxCVxwq$yTm6O4Pvjyl(~D7P;D^Bm z_dc%n&(9iKFcI+=g3Ss--YvdnT}n~>o;9$c`fjMz!i9J=+BUCXLI%51gmG_20LSb+ zLf|lM;FV}=n~IVWHz4J+)Q%TGaL^B7&V1kryLe(d*ZdcC#W@l3yMOg>Jkh$4+Z~Aq zT<7P^`#<_tDRK%gnFD3tW}xS0ojLbE@(bu?dNdHHXZM?cx_~y&GQ6qiHy!X@m&9r*Xdm2e&qGPa(IQrQw$gP8Dc3KsbK%n z*T3xJdAG*{meL1`NTk^y?`gS_8!n9S>+>o&i4U#OYV_vFJS;)6_Sp^T=pwYS);T-z8rABc%ed6 zOj_Pc+*i#h@pHfTyoTb&#mPEuD^QIKlcE^&o^el}l9}soRL4d@kBW^+_bx4C-ZaGa z+$P{4jW-Y^j8_;x<~i?8`7Muqn|%x(9@pTx6MWvB0Jxujk!&)B@iHfC28UjaBw+|0 z_RiA)PqnVcb*_G)d$)r>}j*6lbP8 zI{v-!bX}%rz-y<~CE5MC&g?r>F&rbFDC2n1Ys-y*nwHEF%x% zrWH_>QzH85UzV`bCjNNaZTo0JY;BgKL)}cVY|dksa=p~np3EZM-`v#gDD^vB_XsEU zlGLX9Zr#O9bMGjg<&s~TGAx6|tRzcWIYMi|Ge~X}b&5x4VAIGtp-+<{wfq5+eiSMX zwIZYt`(wPk!5Lx!efp*v)DV^SCxms;rYEGT=GqR|_^Zg`6FI6(xZqkr_UlKAV3&Ef zd4K#MqJBLfMaP=!OopZGNtN(TG{V(V{T{`cOL<*Um-KD1qMH|hp3BBNv#5*)52NSf zhmf4Ds^5x$2Ik;e@R=OuIGsWqXu?cHVqPgjo=>pjKzpC3VkB5vc%5yK*b8M*gX?S} zuDd9OGbB>REi7#j=ZB`Om;6PtCimy@51`I7%F<L077vw0-JD7wF@FM=Y&D0V?D}~TM z=nuATMD!$itpM?1t@N0p1sc6^lP$`PPW8UK7U;?~$7^~OK_g4)YnspvC6n^C{30pB z#vd-W>A)2S3r?OE!9LM_3InU_DbO1FJ_x9!+0OI;*c-IQ}=0PkR3* z-6H(YDXTXX1ba_ZX0wE5x0S0R{RS>OYDh#H%ysn;(Ll?jFa}rhgZeMjbt|PzDZxk$ zH=j~vqdS(fc?_mv3d6T6_XWn!IG0ve-;Qj~zQa*_h^*siaI~;2X6@m)7zC?S?&EXs zqp3;CV^<*qSo^?y2I=B^>8v5Q+6ha@$%LAke6y;YDK=%XWEGvjd>j4+u>n5#@IVs- z8mRdubOV!>^nV;6#S(}5+|7E5=U@pb1ziu_M6^#41` zhnbD#zo(Z?t*cXOOGR5V()Y(H zW=+sEV$(QRQ@I$o#dOL0iq(PZ{&gAVoLZy%`4eBxxBK69yLEhCBy@g}#c;X2x@cER zBMVFh+xM|{d#!)D7bJxvirOYA;A~Tw5=akTf8D42#1{twYA>D-sSv4GihKLR07${% z;pD;I-H4l)Cs%b2;&u?IAG;{EfkyL)P{>DS?Ugv4fKxM9J64$Q;F zf9ceC4GzkGrDOixlF8uH{duFWvGr{i--Rleb7ZfJz6#d{5Z~{uY%*MZC2#R*0Dj_2 zQP9}CEhaHQC6%u{2rlpIy$19Di!ZGo`*-884o{K9Q>(;gpG12he@cRr{xu#>cxnh| zl1?4q*@Z4ai@g?)+3IsmwM^dCc%a%U`g}^O=XDf zV~Qmm&|Breik6~^D0|JjBN?DjXf86D10&D@WU)|}g?HaN4F+R<^d~@I%V09lq7+ae zoiD<*S@DT{rp4H zO=zq=hjV4)_XmL4`E01YYCl~4J8tu=ul$cl(Yf`6KqyEf{g#D%g4<(WLSd^V*=`W* zeMo}x97VnaXs*?KvS~27n5TYn=Mqk&L9;t4&4-*16v93?AvKB8=S05A=%&h~Oub}M zWW)%PUR=n;6980LJ;Hmkgwb?{!*gnZwWB4M2bVfk`ieJE2Rd6r^g=5@Y#q+BeYh#S zvSmUHjNRti8!?{aL*Dl1S!w3-yF7t(1PZ6>&iTD03l*AM3EoRw;344@G?c6T*e# zG}tfP^rLXuH!P`(o*cZLC#VUi35p%EWB&58DLAM)l6P1&pwM5vC=YNFb~5vQ(E&mJ}9szY8!+*i)Hac^+&tyrT>%Z*L%B>KHWw;Y)c!#(#LW0^Avy%df z%pd-SK$I~h%fyxaF0^a0X-mi&pw!1@`oIDkw~Q*c2Pub5$hkn$bXkWRLy@6GGj=%W zb0Cg7V=diM0%>0neZ;2p(NSo>hvk#X>&KhXGUg8wU(s*{P>Zv#3r>Ty|9 zCb=1%-6EQb-C)aTEDiI=!3MI`Y*&6EH#d~aUDUZhyK73I&JfbUuE&MD8D8RM97dPf zX<|ny2M2Y{TijsSNePKyuT%BcX~U$ps^0MOes~mei8BX_I5z_!|AEkv9QY09XpzYE zeXdrP{BfP-8wO-OiAAWOz4FtCY%e+0l<9p#Y$TRJ?t9yc5d-_Jyp=(1!-<;tAPXbI zX#2K)XF+AflHW#^A+BB4@$4Zg=@f!d$Zd6^TfDE?1*RZ77d^>mUwueNXcDtASH>2M zsiqHM(3PKHo2B%>Guua(BFzPre$m32l(idPai|`M0>$I1D>`pO9I!3p(ziJFyyglM z@^!HdWBe|)Bvqw4;dbl^ywLl`8J2Fm4igg*^g-#a$?ZQS(-WGN)2DsuyeyU}Z?x(| zs_9p1{r6C;LGZ8b7D*FuR-=|07;qi`@~ePel%-`mstPx0@l=Aao;2C1*JJuA)C#`E zdQ~a)n;>8u*n6f>R6KLgU547_5}yyKiE4|RU7bDj?;*H^?l3*Lm4h5G2gN>M6idM!Wdow>~91 zh$U474djUZQMv2A)3=QI>#O>Rx1cmwuuGmUU%37<4KHO=hmtmaX9TM7426D)beU#M z37~J&>Ud@|k{fCuP3|T&;_xSHdvHHc0}J7#qZ95$5LQ-0IdeEiVJFr^+-i0b1`S2% z`E4x&L8H*gy9$VeNK9G-D_K^VS1{^}8i5LU#4%87@)!q&cwU!pGYS4~*paAH9Y zEvwX}_L)+n;fofQ%rv$!(j8%RP=ICJ%kx$aK#S*SKpG~?yGmA9jtKq*#ai-6ZA!Qx z(=Xk;qe&<&YA#@(km`m&m}-MYv7vKcpTDKLOPO+xDkl?#)(K27x=pD}5lqfn5ebEm zzO0hh*61WI!NdwqC3|;Kz~MiNXcpGYzggXrE&G80>qnW?2FSGppdFBUP<{)Az^$J( z3b@#(p1i%i{{+nIJkPN(MU-Z_nlA!<#Q+40&Y;ZF0+yM94E|nN?g#Bes+Zr$OT^kA zbx(dOj`{ZYT8iL7NwrU6)T+qk0yM8_B9%v)%(&hG$Xf~MM}ctzzhYkE7@Q}Ku7R=M z{wrVVR0EK&G#r!18j>O+k9_zh+7+Z4O@FZL!xN2(Ul#I?!~oY8LFhj7Ua36uF1#IY z%Xc3iXMAz2g7v+id3LzN6&SaWZx@xqHl*^&YRh?EZ<3ZET!>*p7HuGcfT&(aJ z#c){X$ZX(pbap2>U@qT$)u&p5sOF~MXmM)F=YC2(Nv>ZWd{_c+72+aVtHcGMo#!ro zhgr;8m<|KwNjV|5Y|fYEv`A{znhKQ8*Epi4T6ry1>go;8mnCIzR#XE)aiHyOmPqU7 zcvq}J{haYo!&nk3yATdnxyCVxeo$!ZZ=nu%BU8Y&F?9YAoNrG@ynHP|mtN@bB_SCG zgwmQTyuG_h;X51H$%AoeR7PiJwMYSv3ZBHWjjQ?L&4Da#17|%mJ5T&27s#28;d6~J ze#;f>*xW^EC#9iV^?_hhP+TyYZ9GCu*4)=+O}HmKZK?f+S_-;OWBc45#d)JpZA0^0 zPhAlz-qLAlOX~tPhb*fe7@XfT`h1BJy4`eH@3ZtniGh&iZ>}+!nTjXlfu4N0K(#bAwqqQmQ>*$9$$SYyUJ{)NEG?=Br$^!=Ct8a6ewK@D69Jck_)1(ax^qQrqh$ zSAWg9b!GTVWy08(I1r5GG-S`K22@cP%G2e(2h#Fn?0NWOdWG0=S@8@;selF2KTuA0 z&78moiki7j%<^xYfzILiG%VGi6O`aGTK(*tEXLhB(bnI~3QuOej$jZQ?usB8VQar@ zq-(M!ghPQP@9c(4aPO(w*`mC8)r7Lhj7E#Npw$%TTIuWV)M$H3@iZ?8^3{b!)bamT za*i!98$g6-yS%Te_W~N<6$H7;zxw;TZ3ziippd4Jr#1#5Ne$r;v=|^}HK!CcQAXXU zOrcRDm8aDjl8gqJyI>-QbIMGTo02V-M)!&bX&alr19yJrT6Ao90qqGVxQmX5oTXPq zMHw-sk7azasKq4^JfMGJb$5VVE|Z>)L!Kq#kH$K`7X+udj;iR{YmfrIT*s;G+VwOd zaHsUITaZ#?n=2!PP0PN(WDAsiMI19u+V6S3r+cmqvao#ktO4NO&)NH*L!omacF{0j zhjXLzhD3&h_#5004{61`;|}F-aOFY1r*hx;IiMqWo+bkm#={}G-&MR!zyyeeB6i55 zKM!;EP|^S5v)kdJpZXDO*Ar8ti;d-K-z;|%rIdjmI8@Wl!@Qccow6jLvs3cx=M{cG z?$#xLzJLYYu(g6I|cuG;6Gn|FGK5?sG2s0!3lj zd%~|^^ZM&y(N2;wP)=}J>fUat`};2S8-(4Xk>`KNKJ1MD8^eK_{r@$37k`Z2^OpZ> z^d8l|AW7uziug?ct;#sK3ShWsjgdE`S>3(wX3{3qleW)`+wEHZGg2t>0C1_$%5}>z zD!e0-50bOt zR};VvPQX=Edb zm!dK{8AXn+}x)^liIl3;*G{g^_S#?KB??8M`=rHPkt6V_RdYC%T)Ohx&F`)$OMO{%ea_07}sjE!J}1`D?h@$c;fW2BtbQ%vre}($>_K z_K_RB2{RTJp>UIDSdNcsVqJ>+mKA|wuKw+dg9_bCL)J)SbW5I#{$_ZZ!fyJlN(2PGxW2Cb#M*q|xT6LSgK zl})%81%}s=!JjM#6GJ_6>5S5TLc^4mD$6+%W73kvtb7}dDy&C6kBPK?dG zjOLpvS3=$|AESha!)+FFUL z$&ivv7!Kfk1xXj^WV^-$PIU$X2V_9{0cJML0Z<}nf%`zjmCoq4b(hElCA|Vfth)`J z>AHVyh<2G3Lu%bMG5p-%3*J@^(aT>}O6v@I8x1qtFGSeaV=u@G(t70g!C}kl1A1$f zBjs)xCm%xCbAhA={Xj^fW>ukEf;}SF7W~v^stjz6;cw$Vo)}qh!J^pN!vT{-HAq69 zEg+FQ%17pmmLhP=6o#BV@J^$r>Bp)E%l*6!Ox%HH_5|gXB@nG=+#RdA+@vL_(Mkt{ zR|*Fx2}H35pyd`=7iVlh4u(*mEE?=I0;W;!;J7Tej#s8s(xg5KT83k&1BiuxhB(r< z-w^I2^U02$g`0`)h4Q_bDv7aGZ-e!$5JkKdRLPcz@NMK%)^Hq*(@;EIMvuvcwRZF5 zg2X!dp>jddlo4vM*AjoweVEYE`jok{f*omGe#(?tmWI80x1B6@RYyc%-l?9q_tLwT z;%3lTwo>2lGe_e=3Ss9m<3pJaOcutxmDuQ{jV%lZd$a6c+0(-55wF1X|>PYOH|>(FFo9A7Wg17REJE7f4`^XvzhRv zQ32DFXPPD{>MFh4W$rgtu^QYKn1ZnH<1zT8p$PwKNWR#~+M^gvDbJzkgRdYUT~8%n z>>}zo*BlwoLD`MSU$ozg0NF$b=V^9l4lS~tx-})06}Oav)tL~;)Bhd1@F%LegsW^P`65*i`6rVye(X-aCoZpbjqlU$>ZYF%GRR9zJf|{v395B6L1=%KP zX?YOh_Q=LbY;Yo8O}rE_TwuWCQq}_keSs-)`h}!|Xt^wiyTDs^@3{K~2e0$J20*Xf zrfH~bd2oE5%ml|HlH|~&wD~}E1q=D~`8V%b4TRZ#X@0H|EkEqZxNCR@G>`G;Y>kit zOL;gvLS zg(Tgonu2aF@0MR`Ck(a49?tr#w+MDQWMW^W=6+bUA|G*%-nOhHCf^%tmls;hG0KmL5Or(V9 zqI{;)+64jiir0kc^3M?h;B2XTO%{hTm#vH)9XKci8M-%MH3E0^?M*Ff{toQ#%=G~7 zXz#ED*3+>;j5M^gAHYTj@{j7{%Sb!nauEYK;W7)OSI_B@)N6R;)8S zy(ex+GRrqo_Gfa4PSXYMn86@oy@y11lJ^-mzEYN*sigvC;p{BZ2hj+oa`v;pOB*O1{_ZC&5@a@kJb96@BNEuUSDutT()iYBrIdHI111^t#ogKATY400!Z>)$v$_ ztLV|xtll*NdoBIbs=~Pzfmt3Ug4A^N4XzEYHI(1n_)wO`Z1U&@<9d-w2Q|l^k+%c- zO<5>tFl1f-N-dW4J@>LJ%d=g%Gj$wmk)IZ2hJY}5MHe=dx5rZv+Q}7fEYLSmQnD_; zTD~AUUytmUzt5(G`-+vg!EjlknxHxMp#{0dVF&U+;Fi_#{o6*fiW=id><~dH0@XIf zw%2%s!FT2$83pUXk5x9K=<)pX|B0SWsoG|C`%t3PPLzXr7}ac>5Ta7OW=+jY>u4`_ z7mS6PHer|#mb!{KL4Wi4WB$u{V37GF|(V|95Hdq*Fk zAPD@b#MO8^-*NQ0%=ZB~))Q9pKi#7LyP|t$mj9>deo?bE2A2crzieBfIyY2xX}unl z9qA{Nkie`g8wyoIvM+B;jgCymssnI1{RI}QdUZ@)yp6+i5ZGbgTJ<{h{q+0sb4=Wq zpqy@(>71NYM1n^Ufcurc`&J6*4<=5TMUi+Fq^=Ic>`ABb`HQ2;5bu>YKga*Z3)gkD zY(N&^A9fIIM~Go0J{~5XrX%{7ghd;Gvj1vs{s|}(-<>|z#U%R!S}osD$lit0+9FJL zv;&^*>0WdUz1OFk&7eui*G(_&QIhH#5&T2QzmMlf>937Gyk8$aAKrsLrN99+nCUM8kja>@qfDF4_fxYo zGa$1*gP`aJn;94kSJp<5MI^(t?ilmFcQwGPM;~PAT zHp5KR`L6=>GQuBxN%B4hzh7; zMwawFUg(hc3&-lZq0IE(uftxS{eth|>TconX6ZY$vc465?Nd`_6O8XkD#o)Jap5;^ zcfJ8vr{CPc!(^!?@^nv6o>iQ@bP3YT{I-R+$L=OYE^1xe62 zwaVn%M_on7I_-6!W4Z^s4o9zbfXk<16O~#ix#^lf$YTR2PoY|v98Xt=Nofo8B^l4p z1*x4}aokPNLNgWtuF32(P6No1Mu{}CQ2h(%F4$)7=wP;g%dNzm(n5Ark0QTXk7HJY z`OK0#4yxR?@!HLu)|jRVhL*l@r)m~qAokBqIDAYo3~$#1tTgMKD_IPTlFau9Usq%EsY0Epbgj)j^QQ!$J)4GBdhtOYSLM8a>E4*_M(T%8;^$zYlLaFRCsM{FzvhUc-B7#Av^QAi73{6l7Qw_=$fa|Ko zS)qjuc|P^{0SD7E&5Fb-@Tm|RaQQ3^p3@BS-c|D)E^sA9 z5o&HgkBH!lu;IRua1%*#6G-RNwt0q-Y3yaq#;$RS%!PAKmt*qVE$am2{o17$g+mK! zMFpga!yvFtH}wyA&X=|eLd@c;mfVWHJh7R@-mR0kl}peG+Z9l(iC2$$H(3`8{3Jr} zC=FgGU$G0ry)BUBLDIRfxJjt?3s6bqJ5542!xHE9(J&AvJCcOr`U*sJDLUjFu78^s zBDjuCliz%<(1!a~lz+Slh2`az^MXWu)e8Ss^|9VUPkbif)RXNaW40okj3c#}vbO!S zEuMTm)&|k8ek?lTa@@`~*3oV8pBpWqoQ(q^`B3<_@;3WsW||ec zDVQkM&ejPVB}5JnGw#b{jn@lm`G-lXu@qPI2frcL%@7Pezbt|S6Q9OBUu=4rkdP5< zoxGJJo@GvsDxvFGlY*SN_7jg3udS$QqX50$X+y?`!sd8*O1(CM-z;b zS*~SXfx-*Aiiv+daDn&Q$>}HFRNga#x-`fLT198DlM9Ug(C87v-BX9TnHyryMR^pQXz}(!Hz|7nSA&;~K_&iR-#K z^8oQe9a4AjUOj`|M)Dhm>DL4Su{6tw-a8wa$HWiVox*hizJQ>-2p|g) zMh0+`-p97YB0&6`$pIOu0**QJ$NI*!L|1~ALn6e>B_FwxCX3;sL+uYrJ<}*J+b-1l z9oZa+4$!|^&DX_m`*O8@eSIzQ1vW<8C-@&uAddf)EXcyd#Qfh;gvB2ep}z&W^FIZ9 zN3|`ej9yT2|A(=6Y7zx%lQqk>ZQI&q?y_y$w#{9(ZQHhO+jdQTb2?^DNAyMCu3wNV zGv6mM30lP8(GGWQB-@POm{UG|S{qtNliU9!fWWp`tLH~FtyIk4|7sv--&(U~Gvn~O zi4pqiUfJuX*uAe<+X;BSaZrl7#s2$d+W%N_T>!+ntM|{Z8%YYg?76B?i$SjAyI@RS zt~vN;7|!&b3Ev0DI{m*hKW7`k_Q&Y!Hs}!KAHsy(m5YqXV9Ui10jFsK}m&nTOZ748lK=e;iTpE=>y$&n`QWq5vNC1NQ|2jt~~n* zU-9yvl^+-gM~8MlqjlWwZ(5B7PRq9veF|WTy|JtvfeH8XTwMd z)NOp{g^_UNM6)U?>&>vkvtAD)5>$7sJ7n)0Dd?|_NMNzdRIS=w>)f=U1>&Q| zQrM=RNAwbKhGS z8O%R68YKr07w#xGhaqxdIf&PW*P_D-LA@W=P!~P2)LIKE4BCP-$RzI9B8LK4x;34H zw3p*`zNc1TG9#)>1?eZsv1m`b-A~jB;oJ>Lb(|)fzfM*hgI2q=cuTb-SO}B(J>lK( zJjH>_hq2?f`{t;w+p8~^Z#DlWi9iLhD1$rC4qAJq{`mupDn*ov(W<37zdaoBY^+&< zy)M7P!+wLLTRiRFbUIbuEH!kdpytSAIfln|0%F>b#JJ2GT_;46&T-EBaY3bZcy4ub zCPxcW6{%zRwDqohk{nPG(?*Q{g4fswu;*acnqa58;BTrzuC)ZbW96j8ElC>Kq8cs! zxW;!xbV;6_;(hBq2++DJEg3uBa0kD)%n38;{TI>g9+;yu44pw7As0cotS^1XkW=&t zAJ*&`wj*X0IFsjGW4b zFnp;q6c{gD9@mK=h*0ZoBlu|w&!cwwm4*gTz3cd-;$4R)M%k}vS7@@O)kxPlCRyav zJ2`@Su`q#ySa(CCi;9Jg7N3)F-5-587Xd*=38pI)X@T5EPCG=F?25*z7*}fI8_Ww< zCDEbJc1vMWk~U6ow8deT7pmONGfD%`wc!-IFMuc(k`2Uf}?w z`p982k%ru)^vYGgm^Fpzw7BDKOHEDcp%e9jtFd%Odf4f{_^e4;`kbvFNmt_=*1l@x z99YKb4}d?Z41PeL%Y@-|J*3GibW_{m0vDqQci@~Qd9}H)^j;jRGS)Q0Iu$wfiCoIl z+!qBDT1~yQqH#H5)z~%K+vC^pA*x|0yBy{Simd$`&RuI$kiWK;*_=iT;HeP{%`Qhu zlwCrdeE~!(f-4S|DV?UX=USxAhHCAdutvym&MceAF!p>mny@J=sw<3MNkz^BPt9d> zrezC;!?sTRDTYh^CAEqA9Au(mMpnCH>6RH~CGxo7infzO%M3@jx(wsy$&JVfS(;b4 zIAVMw*`w(njy3g$_e9nLeuW1FoHpw9pxe2;Wm~_qFYV%c$GBC$ODj~BBI%SO{tCM- z>oFPQQNxRNx_^zI#J!H5dU(T~9rC{8J5c!JKIrn+Un;JxV8 z%a+Hv5@)lq7JRdTht6h!CGu*0+do3SblbZzBsB;`?-*4;mQ$RFvP1oL!m?a1{8A+MtTBUkd#f8}9EF|cGTl^&=FC%LO#zm1V z>^LyTas_fIaI+FIPDEN0gY3Df{>4m!D;V52`{9=`puyv5w|f}{J$c^7Ft@~YEUvqpEjoZ} zv(ch^p`rD@w1h7dNJf`Zr#*W{{9VqiA>0gPB(O#cVm)u|z4`-~A2Qi1c{_Vph)*{e zvWnx(U@t1H#-e+4=U8!M_G$JIU=EYxT?dL-IFyEZCV^~5JM<(;+`N&$IZ9d1DJ(+^ zblG%h!#d(tuo{xkh6OY3;?yKRj8}3y0Z7i((>h!p_3f;h*tYHQS`)Q}@*?*LffhB{ zz`!LrFFNaxgP4)9wZx0#EVR=zF1}<%n)@IhwsG(=ot_}`zf?Hf%n6iba+u2>F9t=0 zlopD>w>Wt30kh)7Zb=1EW>VK>k{KzJfCg16&sX!0n7K(Q&EcGE1ooWC!A9?{aOSLp zHORwE?H5t1Cz*#>YHwa)HX$nM@?LZ1eH9al;cUAO^;IKi@gOx6MHrU#Eme(#HdJn( zg=x5uBP0ZE3ut({Ik+QnC-8c_J&`i$>rj|{e--jqknrjrLpNcPGTwq z1P8pov}s&Wx`y(bx z?LP6ZQ_rj{4mO~0bRaGCt<4BX-=3|Etr;!a^KgwMng|{^VToB-*%zQ{>ST48PWMpo zWT9S%q+~FDr|^UzbL}A+4lTVIv{C2bAzotbjmk=So=kr%!@K4j-A(s`I#^%)vjMr0 zQ#RD1v&o6>kRmt7j>iLKJ_DnBg|pZR9nm_*b;}qA_)M52jP@9KK zxjA+-sgw!K7F)~eqkW(hg=Y?U#VpACqXMo&Ak-EYA$iL^Kc&Q*%^+9ZeMlNmqnpkk z2Nrfjv*OmhY*(~#hb1d6$zkewHkcv`!(`ny>?yd}IBaR=nbjPmpUi8m58OB&Z6|D z3rmvcwsU{)_^DdAyb7?r$}Ra;eW*@%=&`h_3|4f5n`VjQG4}2b!|mG%+>tj>(uYe# zG?r6YObr)rL=ow269{r`OF(!`qAM zD<6{-r_Xm+~cZ0lpj_mv&`2Lttg`fmKM?lze?IsO})6Z2VjLi099>JB`Svdnr7q=ltfQd@&-ubzUc8pWq-Ql?9>~sWF zo!$H6(_QilC%G>F8bQ?^*Ol=751gc5wo!*3!RA@@H}~X7qE-yHzXfzV38;}}S`ka_ zo)kLieaq^3P5Yrq=E%ztzGte-nXDm%jZAp$m`Iu-fI)8|ar0@h|5Phw7~t#qaaNdT z+=XJrUK&o}(8kD*x4ZT4_x2io!4C5G{qF7%diy#F7iYit9TpA!bzi?qe)%MiGz%}j zvc5S!o74SL?q64-#~1WIHhLP=TyLNx8GZ3*4@u8}n!rp}%^bggk|!Kg!XStV;iuOg z)Th(RpVGBf$*kjzEBJ=VbbF!3&S8BjjfAjaj8M-hNgbz8erOoySqcF_MG1M*LTX@A z02Uh(yN*exxz{K8xRV^`ga4_b+3O1V75vwE&tRcPR!+lYjA3@@z`>guFUg0!t! zaU-XFvn;kLjLcv+%fuNOIA`Kaba;?l2Q4(Y%_%d)08H8mA`;t7SMiTGL{K(T4WquT z-M01G_A_u<)T6Ss=0Oc7JIRSEyq?2RC^1(9nHnP7t-9Qn%Q9-% zK?m$G@bkYfp`Uftsz*C1?MulqzGj$lpmI){j;nOrIXA5q6k%JJU(N?Y)%b8#tuI4Y*DV#IMQ_R?gPO9qj!{y=AUm+irm_+`>Yoyi- zJ|>w7$}`?byfC0>Q%$c1CZ%gUly8}Ac_`dwl7{@ z!?65>;_T?cqTME}u1tK+Qb!``GY29x;pqB=t4{_)$rS2}R}$))pvx+kT~ z2DiMTaa7p|=IGHM;gkh;z=u#t6$C@|~% zp=f3s$3)di%xCKa|C%yZjg(=egkx2TSMxcic(=7HSF`Y-(cc!vhIMIdH2k31I)tQ` z8n!FQ{e>}lH$Z2QG&6I+F)N}S}Oy)`(WDtA>xoMH8cB4nST@UmSE}FgU6>P zSOVinnt?=lS`pR67>shIACYUH0TO3%FCR|#^A@qo9rS}%n#aTH9tG(kuyi}|MCQ>* z1NTqc40^#&{vAVR(AfhHx(ceZxW^a z33Tg$#mrXKt%^R`+`JU^NR)*oRRfPq_JV&Lwy&W?3W5Zh1H{ypC_jaDazile-hYetU~j1x-K>wfGH41BU>3-w(cb18 zykS8Jm%e=2*$M^2r3*sbiX_u&%o_ri~4Nz=8;|nhqGe zFkhBOH{v}T?Gn5c-&7Cz*IzL5;s%j!Fy!XKW4tRIj}w{^CDF-+cOc!&l-fQJ z4`YD9%9J;DSs3WSuqyu{4Jfg=)`lQ_34YBP~&szU%jm1w5ND2+gXI!n$ z3)8d>glr1zIDtRj6Sl>>PM6uC6*=~5p7^~0k2uCMQ662q@-(8F@vBqLC53NmBEM1g zM<%y&7st(T&BU~ys7oOQ8YN z#q$z4%LgV9hu5tcK|h;|5x9w_Lqn^%V@_2(>tinM$c}6Czy%t$LzRhag+v^EG|>#| zdJPi5KJPKBC;7Xd1hi$w7O9)GNjnz?_LH@s_V06;B9~2mmU<}DdZp_;DTcZ4szWj$ z+1+>1#2t*7jW7>%jxDSrkcj(WJ11drjo5xM=w!V>_Owf1k4LkXXU?W z>%*JIpEU|$OCglx&$3ouI!rLUxL!NhHz;b>hklhAiU2c#_uen3+J-l^&x*TwBi*qP zd#2O&wA#R5yTYhSWfFBON@hcw6nx&~yY@I28^DEu$hnPMWLbtln=HTqyjua?s<8~1 zmY6GC57q=F;DWI4t)s1UN2=))7{MXUb9Asi=?uKS z@1Ref874IzERC*+#i9|0#b)qw;_cLM8sD-;nJ0B3!UWE?5Hll&3)gL{ZtCDHJ9fz? zDvu!QK9FP|&*ZG?c9Wf6Ih{TLnYncx$x_!U(W=209rq>rqaB&r6 zf10BkoIO)J^+C?<_qy!5JQ1Rembv1T)bYQ1pH5q6>PZorSr_t{Rv5B@5A!~Be`nk_o_9x7K3!1Xv6~v8NtBUaaOq)4-7AO0vne6{gkwV78v*1n_s3Eft(ks%zY<@jTKFgB0am&14~$R79^ zaLCK?xQYjG)@9O45dQ~BmYCbeJH2=;8bD)w){vffhI3Mj34hF7!6l`lLy-L)tFYdE zm1)gpa|NSzR#3gc=g5;Qly-`7kniQ%b-Y95=nitPY9Ib}Y{xEkXDi54Oo$}KtBmm8 zX($DoNSm{r``!Ohk19(;LIo%TwaUsiKgZ^y<2>>=U-%~`J8~%br>FXQ+xK(87f_FK z2L69i{Qt{aM|Ot)J7Cz-`v3dBzluMMWcJp;@4qBJbO)(%g8Jld-}6e&_t*)t=p#$m~Zbwck2T_XCdc@h&*>t4tU{&O`9J{ zW(g#!cd~fq2><`9`+EMT?z`ps*%@SrqI*nrH3F;Kj|at9b`flE0={02Zb!aBjKgP- zGhUdt>1+qg?Krfe%D6lQn=?!~(t8)p^NQ+gQh`4U*Kdxs3TLu{K=%;1+OY7Co*i@i zT7Ume`|V;R!GZYm;h`pBHv|BcLYEBhNEpG#kVK0<91|b3pe7XM)$anG}alvPo(H9+Sd`-(vbUtaGBjM4ME?FlVV@=ez1GT$M zLKOaA|J>gV9|!`$Fa?OcQGN)3BuvK5YWMcPTJ>OjimiF?w6E<8uh%Ba5OTRlV~t#L zs-VChwE+iAl%2XI;>APxmp0eA%mETx>Pi>m0JEvm<|i)-BO4Qxc%Yd9DJ(W*{7i+c z)@h{xgi*#=onb-_SXG;`NX30w=Ix42LU z3!L^gwNrrPQYdL1&jC<~m;dSQ))r;_ePB?vF>aY!iA3c@?Sh~RYcz#&E$W2okfIA1 zEW_@LJ~Wox3YZ#!aF>&yaJdFG?x(kWwMr5Jv+oainZs9k+J9RNY`nw3q9HR6y$$5= zJo-D*>Ax3Aj>?27#u+4;#y%00#j@|Py6X(SD*beYCwglpc~LdWMaQH^UZh<=4ZkQN z*MH)89w3Qg-lXouy}zO%UZ$}$%297}Yt=*69-WsENSiCzx(&PGE_rhb1d%u@XOY1d zy$|q+wtb>-P8yLIZ`FBCe0v*0!jZ?oo^e9rBzd}vE}FHx+dhwL1_Iq}`UcS|I$c7W z^H5lpHbpaXyI!5+sebploMy~ zs@;8Rgjd!-U6V}2`#2h(8o&-sm4t=eV4tDOKvGCY81I(L^N__1?}r&}ACmxI&Ed$p z(0tzMlAFYZ9@=Gon~~Y5b@AgGtcBtJ%RR#!G42Oa93hjjtkI;>o|AvTI!4O~mH0a% z`vOT?HNc~0Pz1{j)&W64Q53%&@Vmi4#baz_FDz6LgH|wtPLtf*95iNkL4H$kCMXqq za4SNEW(g1oqkdA{%WQYK4Ym`*%Jw(@d4xwS= zr_FBE-%rlNq&&bSjkgcsf`X#%$>e6IG)u6ztn%z?zr%R%@hT41N?Qg%nrbJaGB^c|B0*sDgB*)red*%nL1wvp**;X0UX*mz2{(H(~G48Lh} z{%DDzpf|`kW4^XxR!L->VNBg^3_kwPk$ET16c6eNbT&6Z={!|g)` z0Sd1`WO<m@H@*~0yjZw#xW zc+#qe&%$Vyis^fgi1*Y@`d8s3>UA^%0TSxSIWaa)^rBkwNGkG~Up%MF-8pHt2gv9Z zTP$gO$XNybY{Zr53R~LLiC)({Bng+uJ~o0cX$$Bp{K5}HZ>>F3^P$RynRGR>yzohO z9P9hmG%DTDSW2^Z7W9J8{T(>f`w^2AQYQRkk#U(#$FYMuT1IW#C8X&Z3#&6g4!b6J z#vh4&B!_q6PGwIui}6<+dfxu2RHXf_*6l52TGBN)*Ik>gr*b7Ub<);ULj1Jx$K8pT zPBq;;^bAlCwQtklkr6XjEypY@h=Ga~c>&2TuZ96LE1GE*ZM=j_u7^EZ)w?O$R+{V6 z_Z+WJ(Z&~?$OSxUx(=7m+T0jqFm;YJDq{0SPc3(`#B#$vkgGZ%2BCOE}&s!yRlJ zTJP&S3@Hk5sK&%0TWz$4yS2Eq^Ow()8+t=a!+s!0&B zU^SCWunt=@Pg^g@tu`i^pE1NT0BAYOykeIw(xeM{Sf}XR0x!1&N%L>I%C3;qJ&}RS zav#$)+NmAXR}|kV(wAo`NPf=t@+6Y|W47h{$DSq8PVeS&sLIw)Gx%H2hRa};2!AIO zZ7f-nXs^r_@U+%7&p1cKV{3qjdB)w}-|_&bPC8Rsk8!>5Tz{+TDqE82NpUgJj{@cv zlJR$FZZOtUSad22%lh6Zzlj#B&Y8sZ6CyScJIX&5$EZWLn#SZP0tF&_#Cvi#>05_l zs;h4KW19$rSR!YfJSdegCA{1xFOvrYMKC#FU?-wGy9rtgzM|Q`J#0%fIFORXxRYo} z<#**hMoozk4GtVVEI$$`sRG<@ri*}wqrs?TafV^APyG8L%KBK*| zOz6Dh^6@3zEEkTVMT7Ibeb2BTzXc+Bl2j-z8OZTKg$<5-;+~KInoawSLD|xRtP|I@ zE84}O8F2rsGt;J}q?~E!6#0Oug3S4~jprju;ioVe1&7k^DN%u&#Rp?@BroBL31K}E z{!9DT!XS=aEJlKKMQPgAt0xZ$t3`cO33cYzJ`RVb}(52KY%tgSSE%LoGGM+jfjEau>AyNfTd`M8OXnrAuz^ zc8Ie-1X9+>nkvX(i>WrBqluZs`;(;;uqv#Mf!U6;p-i8h`|6UV8$^D|Kuw|0@!b6jooh z2!2xMfG};g#eDf;K8L81_(Lc2d?;Jz$6Ao9HoLjaB3&L^Gy2|0GhO~;OI|c( zM(@bh8;ku=A_6(*%ISfeZ{zIPt)em;Roy_8f)ISjkog@_k7bz(gG+Y%bE zHCIYRWkwoRoG>(Fa&`HK^)F})^dX8oxo^ZMC$p0qJ(e53pR=BBTh!72;WNbXzdL^9 zVE=E0^R3_bV#3jh%+LuD2Xabx)kEEW%bDD6jy6_YqpK65Dqnwiz#@Q{ z`PxDwKhWmIyc5Op#nmUg<;!5sX8v2aS~&TC3s*O~6*D(I(mP)izn>um=!F*Jc0ZEL zb4U!pp<>%uUoA>dA7GCne(Bdj7#o5C*Owb`yn^eQ?ZTgv{qG>Yp#N%IY5Z5?>MOFN z$V!Jw3*6Ptbo%qG=gS#s6DhafoUJ^1+P=*$oPTfkI;g{Ucm^H<{rlE>LGbKhCEU*P z@G-}VP`dQvdx9j9Xx{Gg`{wLsVTSzjGKgpyE3tKfjYG4qelv*u8|RT$CE`JB^$YDu z#S5r9qunBTY{z7g72XBH=TO!($un(wDuOf+tLH;rHu-N~isB&3f=;Kyu*(X#IMblqCeAN&iax6XEO`Hv@v$0 zrw+q|qIZBWq;1*c4A8#@fY6ItBUU5k1BN46>mBjym?(?CKlt~s?*gSWHXl2VDm*cc zWKE4^guWP83q@8Cn&bf1n?#GEX3RuC7AOl>)#^I0p?aSu!ggq8X19ej=>A>Yuyqi5 zFv_%zL(<<*a2+Ter~ZIR1DtP4#uU&Vge5AACR`DrOX1)jt&P=8tM%$|lKIWRi^WQ% z+8TX7Wh2wB&n@`7y&+Qsw#&6+x*#k-adfLwiV9kfAe;2-@cPz47VG#(IxR8pF4mq* z&Yb$}&R1S#`N>Bq4>jHxn&47J;_84njNvKKfQ#Ya;gHl_DM|9s#EF4zrz~2W^Qm$a zHf$@4rVaf>9-7v&FP(*%r73}^EDCNllEnDmyiEV4odW}Q+)>?2!f=m^S#0RrL&eP7 z9)8$)NiKFZP;GeIuW+#xi9cr}iUDE?Tz~qoGsHiVKGF?wj!rzD~rRI`*3CJNc=w`QHN6&7|~>SFmo$6Uy&I;~1>*ut^Kfz)kT zcU)HD!5GRT1%dMJRYY1O>Rk9K7ryJdXdE>Ob2;QzAvDD501ns5*5#|vdXd%MMmk)u>cGu9$C4|&P@HEB&mq93S@_CYv219@@i!5g=l*YKn9 zKh2hdWcB@2F{=v7O_<4UX=Zi=bHfPc;7_|an#~pr5oSf$th;&DbNrP7$3OaC-+HYR z!GQXrGU#-E6mkg$Hhc{JP9tSmJ{cuND-8S#oq9o zgRMs2Dkq?R0CDP1cFM@?4-q@`r*4l9?8U2z=`UOmQ}wmn0%*F?Apb$Y*3n}oTdF{w4hrp znO1CYW)ZCH>q%YIqj@Anr8WcYjIObsH*sETU_)>XuSAIXJpdI&QvzAC$6 z0o#E_{W`V~F$t>ZQzq46WmP0npx?syqH*e+)SB&t!*Kx(A{A!F+^!Y3}dOHY*&4IG-$wHGpt~ius-%dln~ebfLi5)-|n2E79qqA+#tm% z5Eh9W-cupjkH+cZCov;twG?P%_))VEqjruD`voPyZ@!24!_9I=@lTQAE)W6it1+LX6;MT-v#cShn_xWn}d`4PB0wkAuVN=yQ#*Dr$D%zUC3cY7BR3R*Pk~UZG*teYD8*m?;qw65=U5iJ9FWi-1Mgu6{eUriW z=^sHrpAkhmB|0W9xJU}M*-%@41$T8T{CPK!Z}WYyBkFN~p!nB9H?=L6Xh%#Zbs4I# z{gWuZ$&J~j)6}2<5C&%=$IhXR;s*zNr}WY$Xso-f*pz3S{>P>B6Nbk|;@WVwP;AAG zQ4)t{bCAFD+;q5q3{Uo9y}Muqj?1Wp-~?#h{h*(UnjJ}!wf({oHSju#Cf=+KG<)U@ zTYcA{Kf9-D$vZ|FEp~-pF})^|d9acTM`Zu#(dU+kcX>xP>hnOnKD<7B6tt8(5#M6c z%bdFBul?Vo(B@DRD-x*capf-Yq!oEB-F=1$z5#LWZavOEKN^E?$ zko9k)-HG8CBh7!jmy=TYn^4=zudI~jMcuZ6o-;IdEvH4^2yQRDi6hT4n;4Icp4u-+ zWKph6`6WQe=6bAMJPV5^*4isOqeW%63GG;~66g_k`v4t|EHaRi>f*&NpkIN_&%xDW z#IR08%p7YzeCnSX3yg>GV^6wajxh@e)Auq0+CLNp*u*f^7Hor!it*?AooTxaJK<@{>#ZXIU6_ zo{F38%T=g@fiKt&&e8G^+Ja4%bHgYoLrO?Bm+lHPSLWq&*72Gb)C{mA>TriA;n7!A z?(1{@?*QKNam`kbW^*s$qQ7cb)D`yA1``~ZhHAPYoYlyOf<*~h&pYL1tB9(5O(j!!fkHis1h zy}}Cf47U_w;tjnq{5;uRblhs=`tkEIH)bV1#JT$h`1!gvU&(hO%o1AKa(qCUaM3%g z*L=R;6TX0jVi{HclLTk}U-3uS+5TG|@qhD2OkRs2FmzxTFbO)uJ9^bIFUO|1n7rMS58NZ%v zEesOXEY==>@gv1yxh4jg3{xesCq31PO!kJ45|~+E)JK=Yi9gsrzQdL%K9|yMx~i}L zt`)o{HtDqN$j!R6Q+w955pOd9CW^=en}<-g%ip9ITB&%|H_7qOfEViVxG?yAH~dcO2p2TwvGAy$y6401Eh1sN`9*w>@u(MGXyH_iLj11a5H8X=To6A zwJR)IMvgvuV!D6jnD!bt2AYXmQFi$#ErP9KHJfS?;WE&6BHfu3|3HU=-&DB zkVZD9G@&TCAK}e&unSLC9Wi)h^}~Qa@pjSBc199*h8``>UIW|1&!-_BBIG}y%~=CJ zPDL?8j0eHX`&Hl042&~ZCP==jQBboi(hHWP>rpO+FIB$ptWaEu=$2`55aX2d0Jw|O z93&jeA=g1ZSLX%28Kx~8K0zj=%h}aN0|j?AaEOO9wpU8`R#30HpsAwsV@ZguRbEjC z&l1F+a76(^TKTuIxhK`?CJ1#-S^?246#B6^ztae$t^c05VT@wy z;-3%(d6XIG+Cz=XN-oC1KJz&m3{`yT28A$1)GwR?_2!Pb)>viQHWn-?2%M^08Vgr4 z8>S2_kWo=oSERvEvpo+KC7V_9jz1((wr^vUXN*^Q!6CLedg$iynlqG#Ef=%y{vAu_ zID9pMjpUaJswk^dm;8r5_exVL(3~AiTS^9NWb1;nSV*)S24|nrdIpwVlo>vIYcKx| z#`}Q3&i~w<5cyqvF>toMTuz@EnZS=PP}m?|3+`t@ldxy&F0I|sY#tT`L?Amw|L>pw#2Fgqo*@U%)@HSiR*d_4eK8h6Ff=xZWxr_Wzsm%NgmPy$BqBAE5NXE`Xswe04B3L7s!#|yUGJF;jo%SJ9F!sWV@yH?v@~GZ^ys! zfg$~9XszdKM)xzR3K=@}Hub_AMtc%Q%*_r1g1V0S%3ukqQsvfe_U3bDV(g^*ju5;D zG0nH{@SDv~+L!EXgH;yIX^?~CD0E~C+?w8)94atYgC>W=G)=Y8FrHngpaUGZ1B2f%0t7E%gTBPmKoj?9{=2H<)Vr-|6XuI?9I(0TF)9X9iWYdhkp4 z$ThaIV~7{Jx4CBm!dW1+KF;&akZ8w*Z*47(3E*BGkft(;oy0eOPbmlR=_7SOV@Os9 zDbf>ACGUfPkKxkvEwr98FAW|W`K1Dcjj^skgt6|I^as;j!P|>7y5*4N(UAo2y=@4k zhyobA2V-!OxLmfQKezlJ%%D|}wnEay$nmvk7B)atv1NOH>H)h=X6MtJoXX#dTcn|qKL^RyJ?F4DT7(v^c z+_KbdBn9p~fT(oQ;8Q@dpwtAj0P5UwZvP~Z zER?S;N|BhA-vMh7k|s3qzNoO1990bA=BBKcE*Gy5hCaY`q15CeW@2=ppgWq#`Kc<+ zL})CzSUWX>E?fJP;>7b#sRo9*?JExIce6d5%)BEyIn-Px0w_EYwUjnxcRFwQQ3b47 zdN!XaC=%+jPdsO*T!gZFqRHQ~#3SMEt+7JfM8lNCw;#NpfA?2Nune%Y-Wb~SmlRKi z4(GZV81VC@&B>YP$e$0Bwt%&v_R4WKl48*}lfQnXaLzjBS^AQ=gtSIjeQ(o@W45lc z2=6s9%qV6}z@`O6B%{K>N;Z|CY%v;|u6ab=_c9~~AZ4YyhV&_oRK$SMvRNekaY>kM zXgYy$cZsa9UWoecn+}dH;N-x-$-@|6tNy*Y?he2GS687rA8Gty9@U36k>ZN zyOAw2G%^{86GolM;J&iU6ou~J(I?WC(p44;lgyF$5dZLy`Rs>nM0C0C5tX05KiU%- zFW3Rv;IT2+VuZ&Vl|Y8dyU|FIFAY?KQdzz5qqv7QTA%j#=>disD(QpvQ__8y_uUVo+9ny8TztPpJcbHQL!ExB*&%cCTT`M7h@ zfguBFtQ?y{hpRbXDdj=xqYY^ddcAn!S`7NwmWVO+%v?Z%S}6U0qE-u+dFuRr9L6B?XAIi#prJH!#=&m z{_!cc#NoRx{>owYN$g3qS=$i#yGNdGiw*(*@t?8K|I^2}1NU<1pCM1Xz$>PInB}zd zIidGC-Y|$jeitX9NB$W5#G0?=2={H*dV}e=yZak(Vv9Xe1C46(dNQI5PKx^<7K*&J zSHwavAr&OJE6VjZW)D6B*!Pj)g5cZ7ioZDf`5xbpV6y$^*FsVntB zuHDXsduR1I;}l86k(@R627wyKclv&mB=iozj^9g!RD*ARl;a!@(){0R3|v+JLy(Xm{m)0)|39 zcaoUY(b$YMG1Syq7NSz*>A^gLGrJq@d3RmuV5^a{jJ z2+kIU>I1-Ce6GCj)`dP>A2mn%Hbb5^Q(G$b$k>=!6m)4DJ>>rTW1wn8>z&N!;Ab6+ zYUcLG5YOi6_J@s%lw*>92h^GdYxiJBWXJs5K{Q)Qb1UFX+b?A3=%FPiJ*Vf*3qs0L z1bN?hang^Jl2O+@VV@}g7MnI^WHZ{a7yzwRlpgZf$+zLqN!uFv@-fPPrB?)dRv#@f z2pb5t;tnfx1cIj=EJVVr5r7~~4h3_(2o5KedG?cU^0(k_+XkTrv!5;pbV)v7Z~Y^O9~O3sJ(+u&lIpSQ=388e}F1XIC`BBhCpxiD zdUN-WMr7~_t|o|h4^I2Z{VSiT$ z67r}CrGvHcBPA6Ql?F(B^w<-TJ3lByJ$SEovAMGI4wDu9aVOqxW0%M=enc;xwxWuV zi@PA?F>KBwd@u(ET834@y%C6*yINgkBIqIxsVZ`vVU(Br=7@HSa2@oC`{r;eazL{~ zl<`rkG|vO)o`1w^Z-OJ>psmjf(=ocEBmrMKHz%b#M2W+ifvbT)pu^rJ*>UDATY$uO zMz?rjeKA9$9PBeON9*$vC$fmo+&`tfp(RcX)Lep zEI(i&vX;HYwJgi1tKX-q5()r^;MrL(NHb*Hf)h1~iy138L3_%qzef%`z7p`7H2N9q zCCSn{xzzmW^O`|fqn`Br98P0+0$OF(mWF0+I8G9?$BPzT?bOQWo3GM2m`2d&T|7$g zQbj%w-Q~c}J2rmCtEnX!cF>E+$^usreNb#v?lxm>3YpaVk9KaA#pH+7GXGxts%P{U znNBX(R*^rwF5lz=IPLi$130%5dQe3*qnWSupR+g|`CJ+btBq12E}D@>xZYVvn4HZB z7?#tNu1UbKk7d$xgSw`(4yp?y7%@)#)<76FQ#!J#&+?lsnMwgwiicB-1I#frqc|bm zieQqk?m)_Xsf7HYiwimAL!qFh99x3*A5_n0X|$?^UJ5m7g|YX#!IG;7hdI|XGK*Ne?_Q5k&qC3@ez!GbR}I18uQ25MA5VqMFwMw)glu!D?FL8C-G`x z-bvB0X*JYAWS$h8St)p^`PuyOmTuC5&Nkk$C1pf5cdBt_Kw|| zh26SsRcza~&5CW?d1BkPZB%UAwr$&XDmi)gX{WWd_E{g+UzqdDxX0+%)uCpplk{e) zwX&tJnW?xuCS$mi`Q1U!RU_I>n_MjrXvAB)CAN*%DH@2M<_q-uNN*sLT$ggZSNM*Y z)EfHo0(uqd392Qn56m9rLrRi|beK}lg|^peS2TEeNb)win%{UV(RLXU7H_1`Q^Qu; zv*3<2H=Pv3GFGXRfTN+VQKj0&IqP%qJI8p~4w#B(rOOQ?(2}+9;<55np_<&%s3x|} z+qO3QwOrp}2U#8QiG#-q0yvJFU$8#IZ=lUGfC?x2Bm&B{y}FVcGa&xTDgK!Oyj^Ug z7j4s)@omgqQUx}F=}mokqDJx;;v=46Zu221r@m|JqEC{wC3wbHwR{+tjbRgpTNV%F zfB}5f;*rY6G7TK1!dnsnKQDddGexvd$qC}b%Efz*={kp*0#iSF54<~2Eo^l7FW=e6 z+u*S+r|2)h>0NQ1XU#9~Q?rqDLo3*M6eU%k12~92e+=USWBoiin?lCgIT9j}>Wgxx z4`ivM0EtU}wtsSK=Cox>zI#q ztD@yZrI)vey8YfA6e(z%pAgS=sK9LN0GrKQQWWKrIfYhjk-NVNZ86&F8+hx)1l{$iP(F0LBKBn?yp2y@zJrNu$#&+;CYV{K%*Is9 zwT*tMMt%;NnG!G7X^Iu?YS`OyRNYFt>FOk@hWV8=VSB~n0}u~F7R+-NI=1o|Q%5@) z^GsB1QnUR0%lFG{HspR3vk<_E@d=b=(jN^yLLh}9A-CMaaJdz{E&gh`_0=o-q=U7p z5dkB1r?vu^IC&qRnjeo<|M*)EKcm6R!qbXaG1Z?Lf)3l5G zD{09pndf^K1&sbppb8sEOMni;yWQq%4FSbk5S=I1dYgZD-_CaI)HGuw!fPRKv0j%9 z{d7EHptNxAWFzN;!}DA!MbPbKJvmXyPs#|8$<$w`Et^vjE#xS18FbLg^muUu)HLC7 zU(c4t-Fcp^lB`DJ;yF}rT)U#{2dtD2o*M|K?tQ^dKO{cl&mvt%8`i_N? z^lKtLu^##Ph(4IU+Fg(KTMGTfMR~#Owfs?F+{gGcR=RUvj z*)uP%3AOlr0U|9GdiP~x5!o5sW8JcQlV6I{mrjF zX-UQY#8kUa{xcO%5K+d1VEq9ZrHk7jbA)!VYbnyM56zbP@`;EgiiB^w%IWJh(kd<` zx_DYryF8i!MGODdud}GjM4zU|_uUQNxqbR6f3Dd{(eu$kkL#C$pJ*{^>!oUJgr@kN zsoA~t{X|B3Neb;x~+J6M#{Q;l885n|p*SIq8X9!OL>@#Sn3w6`VAc>|@<11j4 zZ8z*b+AREY%-e_g{(62HGNb3m+FWb2c92^b(vn7lv!U3$BJS!D>b$evk!2OW@ud^= zY@z$6#;OuhKHdeTIuHThN^iQ$t%kKHAAg_$~0t=Wp~7s1UxOce{2qEJBCv6c67z9naabs#3RJEuIJMfiC&>#Kf}-IZz4%nd98)F zNFx|-y)-mAXPM-+%X&^sV~9kWMlyC$zM_bMaqUd**ekY9Sv7$AWHc@9Q1o_B<1XAu z&6_nr(BYS097iQWCLRlC6F)>Nl>X~ag&f+EHow%~Y!!ViWYc^7fpgtBsm6K0SZ0!> z2W4ayhEls$MdxVe!l^aO4J{o%IJ+Gf-xXm>2kp>(_&+n+C};Y0xs(bwW!Q8dxBFhhN>- zjiv)G&DZO1h}Gcoq4t~q%KMRG4lD%8y3yAPDS!6F0A#=T>V_0vTGnZ`90ew#iCt3P z?$lK@(9MbNv_|?_xE7ki6=Th&6m5;BW7lI(ciD8*IHt~uyx*z%^+O|CuEnkYKnQq( z!S~A@RVA>y~17+*v-LK#`962QHZ4rMOe5S z8ty##wiybfcGkhqgWN59!ysQKle8eQteq};kQ?z>XG?$v4avj*Iv-f&>~3RpzAe6; z(RqfzW+B2YtL61s()AJ9B9K@|8Zx{Kl*S~mmmz-AfS;UVhMt_h-J8teQnDo3-q0Z8 zlJF}V!`an7)Y*$Tffn94=wnL8H^NGbSVTCVwPd48xvMN?#}qb3HuPInHxwfouz1tW zttx>QthHXc$w(}%xKfHegk=Lwr#Vujl%QY|D=9lD1A~s?Y0doZ>4!IYkO?PRxx(FP z3Ak23sxal;gGwvEYhjqL6FF0aP7=SD{3rO5&$`j_c=CZg0m585Yur*y2{7^VenarRu3|Y0Zj`w*O#AoBh z&MG98XlF}`R$6o9QA8}6yneV^mNw#feMS2R8Z6b&z|ncvG-qC>+kH_6Uu;lSHy*T1 zuLryvbg&&uwpBZ+38)j0CDpb#Pgl@l)4#?L2>*-sqg=27zTOPqm!@(~v%peYjb)S0 zx49eJ)V?APn>bf7hTt+kV@f>a_E7Y%NafTYvv6^K%x-w6vVz>8oxg8<(>r=ma(#bk zl}nwP*bN7G*HNm$(L%XRp6XZV!{J!5azG|Fq4s1mep;bxz>l)SWGo&+;1 zs&}ZYu^8snuE7UcF50pgs4a|z)O};^kM?>ajn8av=6_!D!785lE4L+EaMb6}$*21N z_UO&XhFT6wX)iBcmltKc6QvDLv6k%i^jY10X95Ss2|r-=l8vs{GO4p)K$z&nuog)V z9<2t7`MpHS5sUXk0fEIL=tc`BDX7W0;s#gDQgmvgU|lGdWRfp#S^3PEgVbyl9S~S= za)XTqnB`64o$%K$T{R6jo2xuV`8KlnQc8?6;5uoK6!6_}Dv`AY`><0}Jx5Bb{1hfu zObllp9c7DGT1rAWiwJy*W;V~NrJzh3%}J^)WwoDnW&=LS2`-=bfONQKv^Lx#x1_y| zjpJxYrtIYqQsfr!72(l>cA!dBQdeGc)2#xnSU1Pj(xezBGGB;2Rk*czC2*%k(T33h zhFX2DZ+wE09XoWi0;ea~Xy4Q*6ZiV{c*2 z@I>__3N@xLG!70E`p8I(Mpf;5pv0UYvvrO|XZnND3%Z;pXe8kt{!qc}R5ybZbeDfm zmTUSCBF~eTYGhyfQBbkt-W%~RPwe(f=S@gE$fS=7q}xhzbsQ#Jwf9#y<=pYzC#4S`6)8KXbV`j}_B&v+uMf&^|8?|tbbceD+yB4=oDo2{Hg1zXbeov|bz z+0(~{{4hp-{biyt3wXPW)ln{ca-&C8%ApQ6nm6BFl~YCT+$n}ol6Tb@7QTW!oY9SG z+qrNX>=8%c5%WQXD0_lvRF;dZThlbe5S-B)TH>>~MSWD4@-=!kh4w&#-dVQ&;gItJ zOTw`=Y+#;P7m5eat+_{)SnQ5+Rb6O8|G;y?y(i6T{Hc;oNn|F|D zwGNryeT#a8}$eWvKQa^PhDoZX;X#g-OiXd_hmpbghOs>$2XM z=$om?`O}#XJw74mMeDtj(JhTX5OrzXC0VNv6rR3tK!Y40%a(J+fmpABi5oKx?yd{_ zF`BQG-4J}1_?~!H4hqt}yNi_5Sx(m^Mr|-5t!w($W#nE*^L%R^)xqkC-`blEM@+Zm z#&5uGVAcvMTCc=Mrk;Hp)V1H~O+24|3R$W|dQUJtQs_K8i>8-13}c>Q!t(>Vnd}qi z$qWLgh#8c<&AR3^MiNJO!A`t)N@?sWaGa}2fl|k3Xq1eU$lJqwjJO>#f1R-`Z9fkH zeC@d980>&fJYhEGED>_Rt1Y!ItGffc`D^O+&+GzV0}}{Kj<%(L@YpBK3b6 zHQEB-eMAv>HSa-MR!Pf6EyjL}@EDOD4QrI3~zhk`4tsX?_TIb{qB+*Y1Y(_hayOz70v+s;FMGX1bHkl>7U&jw=iwGfsn`V_nZFYwo&e*FW= z#epGfog(ROczPRIraEM^FROY%h^{ErVPfSx4^Y1L%F~i^bye{d!y9myg^oi`?r?Io z#&~sXvAvl=rXXdr2-lQXd|!1{fX7SyC=J6mvv4x%m9l_=lJ@?L-jzzYPJYN~e%i#X z;xtHgtR-gD>K}a&Oa~@qNgKR)P{y}xE<|Q>GevaUf)&L4`8sUw zQ#e~B_eDb0^Zk|j4ZH*V?|-65IRAIe;T-J$tv2)jTALFl^!lU!PWaiIcm4Ohx!jp} zv#no#>+Mn<30&yIr-}Igk=T5KCmJSZz|NVxf5O^+2ITrWul$VDe4jM`Z>Y7!`9BGjSJYE*(DJQhrq%$box2;cRiMs>eX&)oz4-q)Y*J=Dy8JxX zw)bAq#T3cn9S(NEUXKHEX9AX|;^mwqvBY;)Gjs14wRi-if)<2Vks2%^26zxZT-qPb z((*3xFk;n?Mq<+)P`=)-{!66Q&A}!NVzLi5y~F$c0(Y}Fx7*r+;)fuCVAquWmcaT? zqIKuLCR#1!f+x=&TJ*|meAWM>uOYpIw#yelJv_+v2-x;B$w!SjiJ~a$BET@RNvFX3 zpa~Zfee)dip#2H7F5Q%xNt|knyFU#CwU8Z0&%w7OoUn|&LQ^6n36O&P7KTuOBHT1D zl%9lH`i}ANT$r*q;Kw*W10o1xG|9lM1|xG)0XBU9;SE$fe}2OUQvp{=z&`g z6!FbATS9x#T$}^g1;P~_O`?CeV3#O~E=C=v~UBW=_; zOIcA(;U>9tokVXA4cu^c#nUPppgon;qz5S-Z^r|#=}=bvK|{H;DjHVh_;4dpB6g9d zmg+j!!FSUj`sml4!l)QES*5zPm~3KdxhfPQ*3%&q$;8=(4L^#Fh()-O&B(vDkd;DY z$UAE@7)0!_@P}mVCM*C765c_Nma{r!w{tbpDB*a~j9c`pN~%MWDO|g*_mEUQsC@xo z)gK5t!T*F!aOrUL;4h#_O$Nj^zK z@p3Pukf(;t0thN&@I>s^_z9MogM0yy974&A19y>mZ)LTUAak3Ctu!bKFfpM3!f=I7 z3Cxx!Gff;nV0mF^rMy5p%P2lCyv$w`IpIRk>A?!JzsU2-$__$DULzItR7`(D?GTAo z2MsGmEZfB(?UfY~Ah>;k}PN57a#~rPh4b&`VqF|*>{MxQYG8Hh# z<)AAl1YGu$#%Y{#JsuCGq+_d>t{dOP;Q^_SKMTvvUpIH*HD~eP|N3{~u7>1f zRDXX^0&aps&=^2kH#wU+kE$uP#hJ^`V@Q|3$G@0Ud~2>3b;&BNjMaY=(C4ih9P1sb zv)J8WSkBZdTTa>1Ha?zjopau~pz)Y6&@31yk)ToX-al(|)b(rh(a!%jihC$aTBYe) z=?w(KyCS^G3qf@^dUYQN{S3Mrr%4+Se5Z5A-?>ZarpyWYr0;@LpVH5rcvT>^J6sJd z!CU4)q>D`}zanorBy_ zXxh_s4pU2Y4?$$lca&*Cx(^KvThsMKP$cqBR1B}((vqg!fgR|EML1Puzh^dbh1kQp z*wicswl*M-SJ%_t=&yh`ELbItn48{WBtOa7agsqAp0jso8>sASRCp{^y`N?<8FR%s z)v!lJ!ahSY$oRn#ngGse2Ij#M_c-#V$v^sJKX0Q3YsVx&`F2!QP!G$5uXX0Q8FtKZ z8fOhJng9K+D$Z1IytvqU_&tez>2^V2h}T78CO%~38|5U*%OEx-RsfRYo8I{rDJ30tXM4&1ZImSeifH>a|0pw?MUtfkqqt|_T%K)wZK%rRPS#%-dH zD9S*7Q1YuI#o(X87O_@O_ZWe7JjYFQ^kx|dVoNGfn$D0<-g4n|(25g>i#j;bW3aB4>1MQ!~!%tPwrVZmyNvUhGX0omZuTpfA>@6m_xWzbeD^|0sv{UHpY!Qj5SE;k@p^clqJ8wZ?X(NY^DH)_u<9%B zJoSCn+8)6ale=&Q1w8*FrRS0C-}Ux1avOXt)87+)W&6#tGh5q3Zu|Yx1-L`EyR2Ed zL-?Tv(AxLMx4dZY#62Q7T!{50G(M!!HAGvg*j^qj`QgEr$FglI%AI9;sBwPZtp1zF zCXf4XswO-+TQT3Q`*Yo1ikl+*Y#gaH%au(TZZ|?4W+D@|^_q&8lNhqD^`nl!qLXK# z-w0*hp7?ohOOt;sP(;qG+4fEJFkHcbBD3$N2J8ji`u|ZdqfwTH4^}t_^!4_a=j`w} z*?H3Gk-@iUb>`CnpAFzQmQb-!F}$7*Lo~1M8c(;*F%sfsN{1zcQ=~tm6Z<@&s=X!k zhk*`O4^>Md4C2v88N_YIj|iCcUSZ-s=*0i_g=cbOESqk{`F(TW!Bhc+ieXzzV=NqS zJ+V8$XC(?OW)={fU+<@w)RP6HvlyWLZMhL?n55rI6RSIwf+}5I1$peGIbC@n=fX|bk?%J{kv5$ zM$N2>XK^)Jb!0uasUP#mD(4!~@X;IWKkzlQcd%z;z)zXk*$>v+pYe6c_5G*r^S(wC z(9j#G{-^nf1V(9-R*=cy=-&Q&CEYQPE+DsU_m8gwC0+mF&E1P<*YJT{Yue)lny*v4 zvTfUh1XViOIvsgDzO0(^r_4~9U?x>8vKnHp_Q4E!#zjVn?ZYnT{wJZ%XV8WNEpo90 ziY;=<*gW2OEt7;tyUyEWJ-XIvxC+v;966 zy6ZohT=sbIud4%jq1(5Qe&t(}H@$^8BOae`>$zp71C@VYJ4d+_H6I#j)_mWu!CwD} zr)bj{vE+P^BHZ_8AMJv>^=E8ew^W6ej@5|CyCbv!94luUd-|Mj5BLa4bu?#c?DuEr5rDLE*hEOMyDZMA+*IQHx z5afr}b8WAXbbcz?8l?uGQ;k2#zBBSl=|1pK*1LbDLBKe_^YhM*K>@BT z&>1XwW+RU_>hCghbS~1@@>uQDbluH7zb7LPNkSz}tdL+eEB}j!0XeUk7}=Rub}zJ4 zY2-vxJP%}o>7Faq*!x@rdOKD?(!Gv_upm{ll^o&ChW$d|SCgV8b8ZhY;trAWI~6?_ zOt?Ut60#?tr!0K{j;>!Uz6O9+c8^rg{9$PA4tgOZCE1HPa6_G`dtNNkyz(6K zjvCHoF<2x~ho56`o~-%@j{DXxM}i=Jp%vv<3A%Dam=WC=hL9VW63spj^n{--5t8w24L^-MYLYhxIv%(VKqPAR6;w8c7Q-VJxGb22m(3T3@m{fAOn@kOMf~8 z6G2T6W>xczZWvfS&(CLzbQK#8R|B|sLp8fL>gJESQm`(IN%A!8-{Vb$R+O>&6E3*A z2pHSbS6LkMUwf|OTxIEMc`MHAjO0TPfNZw9Rz;yP_pKb-3i88%RC_X^)nE_vX}u&a zH^j2{=id*?=;i6d6Ve)hAmHCJX_} z>EN*k%B=a={XuDvq%`|uDS@1>?Zla~-Sb{-%B#KhDgqYRPT()EQ$9cK4E8FcHTrN! zsXUJqMfB|UlDVmK3<%pyL3iEn+=J_M1n#vxWEg&%erOHP998lWdXB?PE<r+eoH}v3PwLOX=99_hEWIEmn7l)y&kA{V8N%3OZ zJ?_1Ecmkf}7RFpyez)~r!AYB3a-L+#6_=**sy%q?UuO5U+{%qvRtd<&$l zjvzcE+T;dQN3Gh7Tp+;2GTa>PRl1`u3;#8N6(}7W(~}RTqro*E!}$qb{HB!d7m|g| z61npZ`J7P>u$T;klJZRJXv{D~_qXlP#z*xH!yJR|)y_VIPfNzK^Kep{{Z_*fui=wZ4-@(h0l8^ppQ}t=(30@vvZfzFG6)?3 z^fHv`p*PZ8KU7pNG)3$u%%b)zDKPtGPps*NuhhRnkTOAJp`g0VWpsnlPnY$~5c9mj zkDN0uVh5-4F)T9X9FSIe6{-F&Ogy(eONH@I_=}SK;e!}2%H9}ckt~IBt%~H3#VCy= z6L2Ha-xaN;qGfxsvQf$ek265M6nVKBl=YPdZLOPjptjdqHxO$N+>HiT;CT=c_m?3vmK0SwhYUAyEPZI79MCO z-pJ=nj>3G!Cqq=XEKU94@qR4c+7kmyZrhOic&>3NC*B}c+!wb{JX>NlsS|10)_^X+XW5)nr^{}!$ z!Kb}f*Cv()%pIx(*jndG`1cCLxe6OV_*6`)5C6Ol6ejJV%v{G-pX^lt|wJL`}J3ohh$tJ7_& zz`)6Wi0|gp0fzr+cIN!wuq{l?|JUrS`QIwoky~$x_?h@!5+CVC`@2&b#%PLvhG!HF zBKAU222rL^tDZ{#)61>G9=TqdMZ>?L?PtG`O;)LF9kNoq~^5tKN?F9a}A$lCq zIK)KDhXW9G3gu#;vln6o@4#~5QCpcm#p>W zrKm|N`0@aGKX4W?+{2O(Ax%{i2)&y~?eph{=8(=gdt{08kw)jcux>)?6Bd>t%L*gK z9A_d*$T_CYO~)*&4!(Q8`j7fjdM|h9s~rOuR6H<)v}r7P^oX>W0UX`<`d(s3Z4~0?FY6yx$9zc~&a$@jY+<0J^S{qyVP{^jU|7j^IThhYxM-9ffSSkB0Kg=~b_ z<-UI!Z|&Rm&w{{Pu_Wz;ErcjiMnhgoysq=GTH-TLscfA4H2ab!RVUObIpU^eK9q^b ziccY*vK-^`$p`i4!bsBR$1w6BO`=97{RLxCIIC^Lse!`z%N|P2_|(OA2i+kv8VHsv z9&py1%PYN4Oew47;+DXia4G>>D&Kt;`DOFi`)+|UR9}_voN7q+K*2;B0!*M+=+nsX zOH7U9qmKiWvsZcFbaZ#O9C3kcGMci^WPLduRu1Jr*947LVH(9bh2BVc6d?tt$^cno zfF6-oV8|FIyV774=ls}&jC*NBb~mWLZZ(Dg5wZh_x2~4Xl$$fp*$jJaO;nPjBGdM9 zwzxdPq)~tbC^lHU5p|*3Ujod{ZxK|!VZKJAixOdO<$TEEXvR=wSoL`vIVjerWa%NN z9;54Fp6Fz}-Iya+91f#Zw1@l+P`u<_PO-VgPAz$knM-Eih@tSu!iUR9(|j+>^W13~ z3VCt(?AgPIGL(=2H7Z6>KpUZl7Ui>=Kbeq)3*&2szr8DM@3D}-G%lc@jD;mq31YKW zJqgbK`J;VP4_Kjh(Wr@6aPC7bjakv{2Fv!R&rb!9fjz%*;M0Vy^BZ*~8AiJA-$*))A~p$O6H#}Rq*wLA4g60th>onJZg@K{Lf7?4A#eq-cvr|Xvr zVH+s_C5Z-n_VgU;c6^P^BaHieRHygVkZjb0!JKzO#!AnUH5+6{L< z3U%&+_RC?Z{kNr2zz@_z{di*Loy=E!jCZ?(bRCIe}IF zEg=uU`gCo#AZchwW>EpY`0oo@Q!?+)wWGYuP@U4ivJmu?Ica5`vo}2^{85XC1$0r) zM!?|ZotKs;i_AEcyg4tGPXcp2RQQBsCRC8>h?j%CgXGjNt13*UTv;Xc_zAeU^v1D;}_E_sy6hB#$<4qEmkfyXuyq4HN2L6P9@Odm^k(= z?{6jby*8pIKmGYzm=5Hl2<|PuTzcULu}h4R4CG_fKq%?O@6HkC0usmIx98)*2eL`3( zn2xD^mTSB?cb`f3v=BoP&x?aCCPgc*(Jfkr0kS}OiPLa*-Q0X@PXHb6L8r2w{0pC> z@5E}og1aVBgOohdWoVyQK6Lzz$Q`Yxzribg@NJvB_Na4pMUcZmE)DCIQT{>U@xK(DdYB(07c zw{7=r{THb5ccaPhsCzbv{a_P3W!p6qF9$j9O!m#_^KG#nz3Zev%w<*C>Cvh*U3N#)vsmZQt!N)dKdr?? zEGs?`-^<@XIe7VtC2j;nM|!tl;K>+k>cG8YQ00)^|WLt9PR^ZVf7g@UdHd z?W^Y9SL=<#@t33aQfI0s%gzB|x`>ud(@t#U1rc(`lRjTEUY$rEQ>xxTeyQYbhl2>g zQCj5JmIE?kWmrnyd>i-wH1+;q9tXlBnsWPi=Y&*(B35F}7dKuYN;Fi9&~*7dK4&$LfF5^G%Dh%v%Z`~#DC7kF=2B?D0tLzr(ggUfE=hrrF~Gk%2X zdkKZgdwf_KyCed&unQIU*G1iyZduxKgF9dIPyS3R+3IJ29_=YM!7ur0ArokTJuA(% zu{Rx|x*$I`%9DuMdg^tKT(252=+0bHA8u<9dHIU)t;?s7G<(aFg_-BZ@O}?ioL=AB zK-s#)=-leD{q-CowDY< zl7G2_&*L6!5%7g7*zI(Sws-t-!uN^3@y`DHf0&~f|98nbw*QU*{GTETHl&{&cNz&W%z4^`n zVFxL#&49HiuvDMcBg(h4Yv|wl(|>{c8O+yxb1m=j&xmMq(&3%@CXQ^;=gS*O5|Q)a z^{wTMZ-M?FmGDuI@3*%1=Ry^%u%thF&o6Rjvqmp2#ht(G1R^HZH78MKoZuo1!=FZ) zPpvog9>(*&vsSA`q7P5cA1WpirGlE<{Qx3$WawcGI@gR7mWx+^w6Gccj zEShAZ0#7}9UA(6^KOjKbRtYqPY@=$T;j_6uP+E9B)~923vue+;xL&?!%RpO6DIEJ zXhYY`cAV)9rn@jps?eg{_08_^&JKw(MT;e3AMM~4=L;M)1Bl3I1lt7iC!v#e0|LIn z{VNG(rYd~2fYfh}OCdNC#}COZJVY`XeaCV~*JGlaX)Js%xZd3tcyq4Im8_yWd&=Pw ze_`S#@WApLvWKl&Hc9D-SrDx{F4t$;@>#vK$7q)!sYn0hEc(#bF#Fst25Ubiaa$FF z%L2;L3MP)#i~H_f>gL$jHb;?2;T7l-G9&NpWzSnjTs2s*163C?zQsqeWkW^9WxCX7 zNM+*PD$Vx|1L@6oVRHh`y$D;4OF->A9Y*%8a`VptFd|yPD3+`WGXyW)?4TM`zhDW( zop8hMZ>WTJ2#>K1#vz^;OUpzgAa)CnX0@R^Y8Z$U!o*`yONO9Y%B`KXfs9Ff3(}^wikG$%GL8TYAh2^G^7&58i8>OTY>k66B>P1( zN84QLril8AsgPhQ`OJx@!+QvO#>H(zzr~{!U?>YYV&1+6oGZD1n1+0bFQgBLI0g|| z2OI4+<>O`$BRcIto>8b1$$!l=E_6`u9kIYDU}6JRhMZvrM$VBPH)ytvFun0kQ-ODg zmLfx4Tz*J|hgCxF52_VU`<4SMt3)3~Wf%d)n*1qR)V`sX=^VgFm~Wn1ZGmSe@lXN9 z&6%ps1}~&h2x5Sl)j1yrj_zp_B_@^xky?-8G_J|EX^zr(#U2;Ts4{=gpwc30;{5kG z37(cQP2!!3`&et_Ls1CMr5%Uz(~v$$5B zW-%BE4pvkIbhudon&c{bepg5svhZ7Q;mD95CxChWiU&hl005<@_UMjWP?H<)~_n=*n;7tgE4{5DUdp=qe|G8*}%; zJW3a$m3V5Ed?;}b9WkH-G z@fdoiI<24S8dEsGl0y{5l;Z|*~r-MPS zFVDZ3r|$iQvH~TwDSb}F!nEAtgIx#MpT%a&(poXK=j{fq6*jM_`g0#MdO6F)?kT07 zPy9t#dVYvG>%f-UKbeo8XOHo4E0@~Z(E>^@`-86@!zDEWVfByX91|4=luE=JFU|iv z(AxP%u&|svL8XuVrMO{Wb&5R*l2?+^&eoZ;(fLhvXVk`GOvuHAMHB3s=Fo>sg~oY> zKvn62`_efh^eN2^SEpZlS~E0WXZE6=Bd2V=mA#wo=${FaEhfN>^Era-7Wc_etrF?W zFxF#)Q~o3!-zDe9*^G4#M3f(CgKg?ncIWSn*n7LfN0f(?cSWrnA9bR;1&#e>jX%}1 z?6x|C+QBmOIXHBue|872>2lnphxdBrg0e_@>%QmSn#qvxZ!hyROZf_jWE3(;CE8F8 zXBA$7=N6wKw_$t3RGwe#-feYeFvIu0lBFij&E8B8GszkgO|-E4xpY&Kbl&!MwOPSAR`=67*-WWpTE8fmwj23QANR#Riy@uZ`U!v!ZLEdFqAYcS(USB~9o zO3+l5Q8BY(BG|D{Y!8#Ru4t3&H9C2V`a29;EvOTpSs3}^C zDkAl7dnGWu4@pi2DP@t2WVn6Y;+M;np^Ii@_?xftsi-ag-9zF%KSrIMoy8qMF&5kh z=LxWtXXd66SIv_%r$tnoFfDgCDJwdO;<7pE@JAUHj8elTtTzRvTNzSaTJY9$_wMoh z0<&E3tjxOqI-fyssjrlil_aiKd=GC!+i9d0EokJBF2?M1f$74=k{n{ugffF&Xz9HS zv-`nU=57YT;`t@>wOMr>2^vO`QJfwd8oo{d=u=kZzhBW!-e#v`Co@*`xVeUVB-A0Pv@7-|2dsM0?YiI&cV7E^sz^$$1VeCJc^5~_Jg~|ZbFGPj8R3( zmUv%)*yxU*qev8o43{{c^nch@!~MJ5w5+Tw*vZfz&eLr#_4Ofl>Lm7N0iG{Y!Vb+1 zVc~;GC&(b8LqeRaGHd(h+v7mHv|`s*+b;J{8;Y92{LatuyzM{7^Ngnz(y!Ae#kQkr z^s+;)Ift&W$6F7Pp&jKcs>QN-4twOgG0rcq{5Bi&cP{uG;%WTl$Xq+EY4?6-q@jz! z3*!r{@mij-cc-rV^q{@_0tmQVx>$VZWRusIj~((VAY^T^DU+rOQ=+U^kv*H- zw+Ep@f4;7pYXq;aKa8lI>0fHDql|dpU)J;gxt_m$^epg|=(RL3X!-t_klr3*oo)J} z=G^Wh1a1lt&`WlzjA&(?W0BDs2-z94wk!QH*lxa~PPKbgH z2>r$Y?dY`p3b4EqzGL&VC2A0Rc}&N;LfiC{?WWx(bn<@?PkZvXnrlE~_dqH!Ez19HI>6zo+%`va5pw~xGB2$L__PeU zcRrPkgYSLLth^o6C1`HD>ir~pKRiJ|IXa0Zr9F&?RpTk7=p-7}qP3>hV2fP}*6gRx z1sb>*adBvf$&PN1cv#{|#@nl5#uY)pf9y7zaY{di))*rUd%tGfiHg)r4E=>FvuGCo5*fRk)7}IcCb%Yj>4LUf62~=-6i0nE?kI^N$wv zTyezEON?%;Q-a_3jo!8dQ2r(?V&BUjP7RI$E`K27isJ?;^uJ2NTGMS0y6Sm&1Si2u z8wqfny|v{($@TylBW=A4n0A}n41did?WIOIk&3`vlQQ=!@o>fy!!n7W*Vv0F4mp@- zMI9HKAX!o!0n>2}9#UNAtDpw9DzMvJihV{M6AO+PKdH3iK!+brwe%ySok^#7cE$jC z-)Z-nAtZ1j5$!c9RR_0Iu

OXcy{M%?OB=yWWOiqwt2i*S2W8+Bf12&8-RUno9?s zN#3j8@~>So?e@apRS)yAYl+;k=}lR>xLJ^-?B+qU^?Khg5R=9IFdJ7&%5iE*S7|6N zA@9Jp>qrpu2e5h*pDB!3XfjV0(*QAs=I*v_)Xlw7nflUDJWw2g^~l>jY=9T0yoeou zS!CBe*nLXMH2(1)+-Dd*!17Gy2Lrib7EjI4p5Eoc5?QXi-|pXt*g0$=)$oS2PGnd|enW57UCj6>GboL1bL0uAWEVW4MKxB4FgKV)< zUa^1ue@5q(`hE_|)&=YgT2#tt1Qg5)){iGVNdS-DWl64h^M z??yF@|Ecs%c`t;Q))Mr#JF`kp@+@xqid>OMwu=I<3~@NZUX)M?yNR~&ZIUfdG7xS5 zgQ_`x@{c-LG45(fkTU+tl5z$5_&Zp*7#57C9NlJUQAQR=trQ96%y)fMx`j0$R3uzmjKk=D{+P9f{me6a&`TjO}dujLb0Lk!YAQ4l| zm;gTi(}&>UH03lI)n<$EZk}}sJfPGoDRa5kiZ%bUg@6317w=Stx+xC<@~DoLZC58- z%KD*0iyEy_am5ck+EDY4+DS#>ALKnzPcW8nVyC-iCE5bf)g{#qew$Q>nPq&3p&j+% z?Eit5 zwRCjWMF_D?&@}FEw8!PgQdt4*4UY7#eOcS<3xl zD~l47{G|57!163p?U4o(sE3oKe)HuUg8m#u7_anYOwO(6_1JAafDe&1Z_;&;gQ5Cx zbtlg`1p@1&>2wTbd)vwM!lSvgtKV5gn3>XS(_=GKUh+&~(i8^B>0X!Ul zn6qA`R?(BO^CZ;lkKw2O*Ou~Nl^!XPw2<5<53!H|6Q`_7^Mk5U$ensJ6VdS z-Puru_r5$t&^r&Ivv+Uw)`+gcNw@3RP)ai47`U)Q(`6m+>~`o4NsiJ?kb*P+_1?d6 z=y=gPBA-xrFO{#k7W27o-o-aIa}SiW+O02;JF)$!dx4FsrlXdBEWqN0tT%9&Lu%Va zl`C?@5-Tz3qm^q&C6bB5)#Hgg8lk`+moK4!wXB~jc~x_qIIjn+Rd**P(*Mn3rACwv z>}QgxJFFHVl!Q5&wE7B5%-fB7@JnM`!!Y%sB0qku zu)f>gEUmA$`h%Rvo0Ztx`F-5B&f1VY-L@j+4KC=~Xsy_4OF?8JF(j7nWbZ#oF{j&n zM0G?YWD3jlJ%XmVbi1y2f4{f<0Pi39fc%GiMD6h2`g1`IQVJc~ z0I)Y-5o-sS!29pT6&rbPMpw$KBbX28-z}9Vhd9ZB;KmWi*&cg-KNo89y>S^cd^JM0 z*1!&#=0$ok-Nh|S|2r?7&-{wR6!frgB02QP&_0Hph7K{Wwg@jWgWz_ookx@VcWP;4 ze-Ga`ulbQF0;e5ogLI{P8?!Kxy&deJHs8Yq?EGMlH?~Bm&QGezQC8ZwCb5wzBJU6H znQ>Z_;_DmV|4h>_6_b*0A0u>ABewR|sZn!YcgUq{{>BpvVjX=t{>f`=^txkfm?;

gZ{0-P5Pni5nP?&*B~=P;mM7`mx<+=>-NV zn~tS=7>xHq9OyM(og1B2$v9?;D)fJdS{v4~YV>$!A7D zR5(U(AT&sJ@a5jfZ%-aIWZ#^|8k5Vke^VVe?cV^6qgJ1g4y!c#K~^Jz{q04|s1z$% zpvTa)V%LffFn-^O4DYD$d!Z&}rcV6fk$0adri2l`8tRqXOko&Ql0Pk<08?|wv?Za| zl7DOHU#(VBuS?nG0U7s27QI0RI0i&>)u0*}A5}1)BuXtMHuy~>&HS#QwU}3$FUE>p z0bHif!T>Z&)FAi?>L}6alBuwY~a@yd)zUY=!n)J(6jokLW^ldfhZtflsy* zpwY%;eE0ILIlxtF^u5(0z0agFzR0nze&}jBtH<-Ms-agbEr%1heus z!H+B#b5-rl7BXAr1+jn0qRWkh$lk^Jx_gf+7nQA?v-)?e#QVO_9Xz9ek(IOvo^GpJCd%Ta%^+pR&7-#*Q#ph;I(Bt6Vu`B6DktCd3N^a_+^zo zo>75fTkRWccm(Cfc?EBaFk|ZSz=d}N3_BL&BYsWRa*AzYrTn_+jw#YlN;n_g%nX6K z+{&Lp()B@L9I#*niZI)kyB=-Ty$Kx#+CP?et37PrlN56>SOZVZ(nk*u2ROrb?0-N8 zYDu)fl(HYk?}9J>ax=X#tjb-jd=bD4Xda^C#KkZI5rri zXeHhIB=45^p|KJ>M?JXBMI~jD6NeMrIoO&C?<$4je#Y6ZcazZ&u5U|6Vy^p?!g~$% z7!w6>O;lH$m5T_ZzBQKvMUx%B1;#V!J$qd>A|9HAs-;P zSt86xBn26cMo%>}(;AsrWfQ0r>KhmZT{8dh;$;Zkp_61|TEw0b^Tv$Bb8phvFqFYI5wlaj z6T5+ZN))Wpcp8k2R0C|E>fJz<-aDB(2UlY{&&X?)1s(17UMp4>FT&E@a`t8~zT@aT zqzziGEvs;;`6?L*Z{HB~f+advA{~Y#1+R@3?-AM`NQD*>+Ro_+-|>gVV_ZA`IW&ol z1o+7WfP~TAFvt+X6$Yd3ob!)kWdwJLN9e;_J^ne=dhfGc;woLEG{ve^*)H0K7S8D} z)eJrC6wM?b(on_;EHud)4m6fA5StV6Z{m5#O?m3|G%qqy%uL}wAXgV#fdL}y8l)fu zPeC`If!S+`$MLBi^6I|ceMAb&_Y>I^#R*#rRmDOgvU%t}8~85Kcx-E)$`4&M_+{Rf zXb%0OifKn2m<6m5WsojF~$o7>M8sv7Y0hj;v z7N=gB+83WwOv`BD$R7$*w7@4AnO;UwX}!YX=sDU%LONFy%oSeQcv~=jN2nM@S>q6H zZQd~|pLQ_bkWvd5!k0A1vCk1Y%bm(5Mq6>s>A3kNkU}+>`(tDu0@vfy` zbwygPa9m=bkgk=3nFd4+7Kd4yvl>aFu*!g`=~e)u~RCo*>vQ`f@7cJ#<8f;Osq|vnYE}M-~wS5 z4Y&h|wUziogmEpID;;Thz>-o7wsG!A92%ougO5B>Zas5Z9bSX71v{F=rLrg{o*#ya zkZ>8^q|6FZ-EEL5)JgC!ouMe*-#Uq;59Ty9d*d@hYH=u4rp`p!VZc`N&gsWAOwzXS z9-JHVqspplwj)64?NFi&lx$U~2vfS9)_I+>xX7AIaSGm2UWSKC0wS{=i;zYSMF5m; z=$d(&kciEsRySt?TWQ2V+KEfJttTc45CSz7%JhF7l=|QO*AOP?@;=sg6Mh>K!7Y~1|-!1XivpbeG*UIz@Sb4CTd=zSFc`!6J|4Ahm zghyZJS0KB|bnfJcGdFNzm@iF;op6Z|=Tvi#;3-u`?xyb+nZRTgH|@Q%RxZxNH9=E) z@|prz(ATwnu90n`=7=b3M?$o=^}d%@J!LXTdmmXw?!C}Lu$Lv1x}guDcbu;?^s`cw zUQ`nmq9hl99E?dUIO-->M=7&h!n3bJFFz|fvhatmBMjBD0ZF0MI~J-EE=TO$yM zrSizNPxmo-h&QBmHJx_hvS3ZDY2dzWz+eyX&nVhU>QJgV7D(={-LSuT(SQpfA zPiA3VYz~G;Y&q2^qw^7!2lP>`z8OFhrl0#H;A{eW8(6^?vxu1B?-i39(QE<8u_0!N zHG1)7jYMDFbFjc-UoL!&y(`WcNRIAX1{lG`1d=YrlSM&ueEm$tV9 zeWY1|Z>gRD-4)N+x~Pmx-W&prV(JeZNDWkGP1fGrrzFT z6N~LEUvy1GB<>=NJwuchrpF>}F;8xuy>n)<;9I6~mS`!w7%q`f81BcMWt;p?ZY~*v z%f8Y{BFl7C=SZ`0kHW8@qo_a*20?;A?bBFnKJTPDtmLTbzcn4#ZjSD1ZCwV=h9Bd@ z=!|F4Z;`=;pe>xOJ+-Q)Qm?A)i>t%%eP7ep$nb#F;9Q~S(*C(iY~`i+htB z7)#l+%P$1Zr*y94`!(?c&}?-X_@4yBf3<{XVr2YZ`L+L7FpT_s^rqK? zyp?v@fx%my`c;8}PIEU@DWQ|2RbtODU_e9q&dNqcmv@Zk_aDK!YOgW6m91(AY$tR% zJ;BgDK{G!gH$6SNKJV(f>>Jz;VHYa&sV}?h>$q8blh9mHKVt57-DaNlsqFf+?#FxX2|lK zr4ONTB#35T?)J&P)i2ZZhzZpRu)~IUdJWUWIytksi-fOM#F z!#^L@0D0bknZ=ed?zY#}Cw5>Ozqkc%HuuGN`%um^l=(!jpPe|_itz(Jf+;sz- zJv+$K3;G67X>`$th2kYpq|wUoSuooxGIH`X46S{{j|fr3D0kpX z2`;qit;bfRq;wx%lHz_?&+5R(4cpJl84`g=jSre;ehjsSFfSJ}@794X_M#Am5uAJ!VOn&$ zO7bQpHNZK8k5%>Qi*S};^QD~3RKx}Dx z*kqOh_JsLhtLh@=is(usR$k!gKecEsa6Xg{R#6LKbXq1q25rrs(oe}S!9_cz|1ji{ zn$72Wk1tU<5e@e&gJ7VwE%y3;l6-iG30=6AwiNbHpZ#i^Vic}TcPI z0uW5{dWy!l{}i(0yc6SCvT9OQHYr{b-#F813B#W@WwFG7PMOCxK~`!mG1R{5zOYJ- z7*%63O@YAW!NJC9_iaV^C4p-Jz1KQLjdJ-XngeRdx&^8nqz>h))jngt_@+xDvl8ct z6BF$cC3$q7s`m6d^H@Uk%mSD#B^+Bx*;pwqpK-wB9rO2n0UF=<&rio$C$_6g{lcFy;t;R1pQg{(ZNveF2?g|h^ zNkz#_6p5q?2-+66@0wa1T z2g*wvsEZKkQA*%Dwie+D0k|_SMF)PAOJ)^^-An0fUcNbPW>{hGq&E@vD6j&_!R=6*3pTcLdk+V-G3FUv(E zH~51(uOkZ8itLs;?0oWUkWCzCmU}2rdQ`8-&I$7wE%i0$x#3t6{6(9j(rWPNYAF66 z)H`LfS{Laz*=1A1C>2A)Nj{VV&E8&$7?)=LhA8b={(nWv;>}gm7;cJO?=YKr_ds0F zyh71%U(h7TY z1=X{>_%(>tCiv5`8wZqwL-jI%$aw{v+?ktR5IFcw_neTR!=2p~I1>EHFpjYQoNQW) zaGxYkl`&>!$&pkG+>c7n4^J#;YYmGiI=ss(=b4QNN9`Rtu*Ns^|fJ*DkWG|7U3r590Mgq}gMJ`X5 zpf`p_?Kye$C9ehMf>4PIaMP^hmY1!?mn#;6Gcvk5ZLJ(A zz8ZugpawuLq)u@sX;mXq-8P|kw=-+Da%ULN{1FpLdk8r$n2ho(eyCj(&RCFwVIF<) z9-_(XHIrW7oXe*N-i4mglM~-`u!uYo`I?ekQ;y0h1?4E94bUKtwmu0aRj}l#1@c}&TH%`x#b}aU;Iw5#As`cWr$rx$Mxe6obc`m0yE@Biu zGjn}voT;)9`Uqc8atH1{*8lG9G~gSQKPik6EETT2LNTOUR}S7NPALl(1BO%y$O>*Q z;D9aj8pl*<|0AOwfvhd7OPRaSTn>p&;V9w#QfsPS#P{hk#B}26Xg?tet~)cKk9NX2 z_;Q+-T@mmwn8=+oRjgNPTfS-o!xd9gCx`B^)g@Y&?wUBcllJ?d@xWzq*DOw>n&x3p zz;7ebb+6upl_N@_T`LA%8>+6_W_=YVtTG6#bB!gexV8>ZJFMA^WRWbP1D(6D+IH=DKo7& zX}T*Z_7jpLNAF66?i?jButo+S4n9iI*mm|Isyy8mX}lC*DFmI*$STWs>WT|326R8H z0-I0)iDV8@5EP9;qmyZ>$9QV{uS%Be2FJ^=kjpOZ*0BX zS9q`?Fc!@GDZ8)VQ7W>=w`%+6nc?#_0oxBr2o?tK!462AT^X1jhzN_<=Ev*T9nUq( z2Boy&I=+ij_!a59^T`lS_duJ%XX+Jp6#FC5mGj4RLh#`O@-ilc2>WNhH8D(b?O_+@ zbpld%#j2`7o3}cl#{VMYXqUxninL|79-_p4&$#Xg_tV@a?r7z1bO}mmZ3r57JBh1@ zCQ*CuB}Nyl4;GM8u0h7y$zftmF$f)Qntb!^e49>B_VYt@MR4zH#^0{s=r+fUK$zU; z+YsSEtnm2zq3543Ob>1?6O?e|oWQV~a8^qgTT5rkQ+yg{CUNE@x-Hnz%u>?GFpH8q^fq9tGn~kPau7Nv zr*G|n#sW4=w_iUj&VyIQc1aYAs5wtnBd$nFQi!d10mVCH#Z|R;Zs=wx zuR)aNJYMcKfbf8y-3stpPj+k~go=3h3;I`f=S`9d1(dgE9kic;87&ad^ zg|;uvxL9NVLlNnu8&$3-ox?8BgerrLv7Ob8&~gc-7`gUxbv{X+A=-BXmo$5-;kJC{ zcy(LaHHCjJ6co;G78c7f=dEb@EtyHszHf(z_pHvrpdUR*EHb^oACs84y{%q+4vf2f zU+DoYOY~fRln@9OII_h6fNNN9{l2t7#}dzNx{TbvdsD)5t!OF>SoKLV>_{ZS6quk- z)wyx*zchqU@M$?xQX01jIpV&<`q4L@{>{c|CF*~96aae99V9F?WwTKFou1N1WpH;k z;s_Pfc)kjO0%Yo+9=Lx{LH;_Kx?p|9KxNS@;ly-X1oE{uLaj{K0!p-pr=db;xs^N1ton9l8ew{`Vvc}>v20r)>g`r@+%8Vkz)D0 zI-~F%LZ+8sC->Jcmg)b!lq07?O$;ZECg4lm0I3$>gW*Ffaw!Ai-b{&(D|TAU=jSEVryX*x zn_(Jrb7vmug;VTd|JK#dtpe!OwKIgMFUai$XA&7VNk@#58Z%|8wu)cRnbIo+0c<(} zd{8`_oIsmj3$dGWQW<^DELj3oiiR&1p8vYDJPxgEHHcEk-JJtOi}fKHJ!iNd4}4}< zry6r`ol-*w3ozBi#h#d7OaY4UH;46aI1r+OKdFcHb>djPD&HFGxE2N1$?bP-wr?+5%@4$*Ck?%kwkthdrLUNP>dxE$p7Z4~;)$#+;?vLX zT3=s!`&QMC2~M}d%O6HD$5jn$En#*AU*& z@oM`7Yfx1GTTAUZXk}RiGRlAmtI=3OZun4bA-@fZ$wx?kf5)Pg?I_J$zV7&jNQ5#7 zNISzUy1!*9ZQS(=-s%-gWA_HTm#)#y#Uy*c>Q)HS2R_g>E5prSJ!#Sf)6Ko?k**%kgt)8RjBKa>*4bL)clnhp=KzW34 z0&!}R>C)a(%;yu#o$^$#Uwe1?25fs?ITcg?R{3=G&J^BdL`Ay_L)?H0{0Z<40!F2A zaTU-Wg~bxp{l>vYs6pIw!-a7dw`umT8K>OPWs`U{a6s}k((@Ws zlHwy78yfdwUzgE>!&Ykl3Sv5C9qHGR6UIPv4v)M=vOeb9To+XiyMiFoI3`-kxP_BH z5TJ`B@J!fWRiVnze3e_Csvwu6USj!vY)hL^FRCbDXcfpM^Y(5=w+(`LZJQ+KiYa8r zCR3rmPaT+n=7i*)q$$>e#@eCyAyh>=ilGojSC@Nn0eYEEnt`8bgo9&Gr|bj?7oM=l zdes`pWw3?ip&{zs(Ap|U7lZCq8b3O@=~lLfvqbhs4Qq=s4Lq#a>)_ag_6B)%JHs=} zgSoq{R@%RaVf^+aeqC_*q@-UwZd8}H_<3%RN>9CRM&)_DsabJEg{UaFdnX?UJ3@{W z0~Vy!Avprq`kRN})#jN%P3djQ(|5A9cDOI&8>DrY2k)v0w#_Mi%D(YZK}N>H;PxCC_f~bs528LK?HSV;xIVc&^by zSA<d`W*B4qK~(^>@f7lv8zwu~gGby-13a=HYu1mh|j=5h8ptB>2aH*|(#3t40FB z+N#gHMMWZkZqW~eV6U31$TEwOb&Gzqh-eSlZgfA~%c(|ipKGvR>{Jw?*^`=%Lr;D} z0wL{%*OaS>;GPSdwEZVCQ<*61PS$SgNt+-MR(SM!*N9Y(jhnzQo^S-c>=S)QD;M(3 zbaIWX!yp1$OmowCZI>j{)w=`LXh{uz*v}5y2W<0@Nr>L395P8Ji385MEX#$duxE@j z?3s+sqGjaG8bSt5ChK|K0hU44AJ)&b(F$-folS&|4Va6XwmQ*5FQYw%SBY%edTggy zeQfV-S8SHyzfZLlT#G)dU*7{af)b3BQdi-?b7H+blymv03*PtNg|(f5@K?xZ zD|p|~sQ`-N|6$l={;yzkOe{?Q%TeE@_5Z=>9)X1#UP>t`c1wg;g- z6L#Ro_6tT$B)8Jr&_gQa*)ph?4;BNLULH>%Ww<}V$*5$O-Ht!c4r1)~R&L+CpT1sf zOLBbX$aW_k;Y(~^7O>1n+j#u-^ajs1u69hP1$6v!IP6k>OBA6`f0y~*6Dw}7uMyF{ z+XJFQl5fdfosbm!e_tlB3j6NDVSLBvlWG);PIjU650QBBjH)fuyQhUtARa#4?g}>1 zpk@A$#dXSHlSO!r#_SQ>|Jv!}LihH0kafCgc=^aEr*3m>f7mI`Fzis-BdiXfWm0hE z)7V?V_N(z;zu?aLa(b*KO1*yE4StvT@488`#@wIZ2ZfRP>tmlEJte+bKAzOJ?11z| z0VW9U;QOgB)exHwG&^mqdqltky(QitYib;Z7od|I+YvE{N531Noo# zox?q zMGk>}&Csx%bY?h4pAG%v({FS`}{Cao4-3OKT_$4eToDUzO=r4J;CA zc!*=%nD(+#t`AoHsQo=LSTPg{-zC$U8pPoFr5l{gM`hY%gM%e@S2rN(b;Bi zlVDW_T4$7fI^bvkwJ15>=Nf#xA;zp1a9)|OlgL-?p^?usM(?-8h06N5WfM$d%(fNW zau!rH40if!HnA}4X>}+bYsT~8f#6LM(uV=zE6c>fWPU+yEh=tlS?Z7ulc<-tTg7DE z<%R2ZS~2oLypVAA-qxXGk?rpjCcN*^QTm7??jtD$g-6JS*G@yOwD-#(?(dE>E}>D| zMQtD(CyH*-{KfMNC`$>89xOvdNJpK+5A(BiF0q%@e?JxTUK+w|R3=x2HJiIQ9;G&{ z<7G2}s$Y4PWG#lw`J?WP8AcIs>z=9USy{iSF#_sVtnt|>IW{-9x6HM|z^Sa2Jc{T= zhw(^n9TBF&vLw>JXRuo;uikL4MYsWYN}ng5Q~EP+`X!oAufV@qn%%f56@hxtt_q}l zchm(wO`58YlOzGr*V-JY;Vh$6vfDD9%I$#G4c@J_dev4~o)W0FPfsuYGc zudArWobK+4g4S?{Y>(Ddf{QqXcP0LTI;d)&t06Ltmm3ai3y)%ZAu{qpTeezN@Bf`&)qq z?>_gi7hX%AIiBtsnW?$7D^H~Ojt5Q>L!BuTAPSBI;XSd_-F`*<(|M}#jb?H+f#VV{O&?xL%?nXWh^p;zeS zvNvT)p^+{_X9^XMS({g8AoR1tY`b<9g*ae1h z5rnii6F(}Y6*MAG7=q;|ZRm0nxLFj5_L_uH^Op+r50-8^_BBu0i%r7CpwC8Ydaj9l zo`aO88%LuVaWiKa80jD-4W>fB%n0f54a^da>9i05wf34Oi)3{PNsE$Xi7$ z?HUEO^a~eEiM`3EkDzQs-W-e;41wJ=N(ao--)6Mbbu5aSQI~7uZ#H8Ijk9&k#|(b? z_E0k0d~_2ZZ-b5VA#Gwu&X6i27tZ%uSFuUA?#xj>vO)Z&pnOVCcavi-q6$ncbr_t2 z)p5#Fs*Tmi)n^v4-3CTU8Vw^=Y762fl|BOh$}kEZ!6{shH$rOkcDp=qTd&HG@`wfo zh&eTda2+63vv@;Sb$+wT}{7V@|F6ZRHgb8Fs1e%*#7BAlqg0grKIdd-pt4 zXx@@mDGwOp1STwfzMoIUB-ADZljBaFD;$;16B#3s24q@nwNIPc3L$+%dfrjVn9+gP zl3JS#55&s{3_*Lp#f*l5H$Up9KoJ8_pp#%1xEm6Uxt!A^o7Gv5RjT6yNQB}&@~0}KR&rjG7_AMK%?n2+3Ir} z5G#79$@0gc4I(_dj3kFVdVA8Rs7$UyUTw&xrUImn-KXNIB~Vgi1=_au?TW^AzWaca&S=!8%5ddc|?1L)$ zY^wT4tpfK+eSJQxT%YLH34^9Chd-Bsl}k_3$|gLlNw1vuTIDeJ2w zI|i{21tw*PWH?bWd;r=9&M{Ri@oPdRs%{yuh>0ZRiRu6-a=(MRqFD+V9hXv|I3{Cs@Nxc?MUk>uXKu&i0iJ%_eCd2JwkZyr{Yt}gj%Cf*f2Kt84~6m~O%$h? zZafN}@D>6cNR5YMR5nD}Za5)rJmApGt$g~DD ziDiFD5T890AdGistnv8k?syAU>r{gc z3_a~&QNi&YU#eXp8m@0CF8j+GcjTb0q{_gndryH{lb$1ML z!)B8LQ4>C#<#;`O_5RZl!uw>0%;2IRX1;#G!C!pdwEucB2BcH8tBttvRAz^SOj@o1 zZBEN;G)Q~Q|2#pCIXB`Xu7o(tZ5$9Sd_?y2Asg~%(}%@$zRDw})Kc9neDnQ|0Yp;- zB*U=*8h&N3+5vteAbr5w3|QqE`ZLB7l&eEPn^=_Yq)Bhny8 z%_SN6Dl^s5y`gGIHXPecp4a`N`~i^hZ*!eGOZPKG^}j>aKodhmD2G`X0&aN%@hv-7+zLo30dAiQlo&pcRMk4EL zSj1S-dC>sGnTWZ~*s?A*MDQX^*4t$fBz~)TdWg0KqN%-ks*bw#^}K8p$L#-48suo*9k`Y6}uGAq^utyQO<|P3i)s|zk5PDxpmjcD4 z!CUXY-LazwJmRW^E(&0e;AbvdRror`BL0RC4y-C$m(>tyIuw$aFcg;0s*h_4E9j3!%99S^rPU@V{#bV*9@lK~vQit+3lK6rVuy!e44gcCo_# zE`Ha=JRSKFhlAI}4XJC7Pm*8h@x~)E(^`6VaT&-X`6S_=Vm?YCy5N7d{u6I->|5B3m;I|wWN0cY#wBJ=V_RByrW z9?fHv>wZA*xnD5|2kJr?i_oK+tRaAn5d7Ra8dpt)L4RSs`?T4A{Vog$^7Z}pmYZkT zg<`>48ZIHHg^@RRup1cL>fZmr>F@3FvALG>`Ek~pSLgYxx%^e?d_Rn(_D1XDk8eE# zeE)J*6js%AeqPJoUo%o*e=FmIb@>^gLqca%&%rBU&5V|J-6&G$SSbY|5R=2s?{-k1 zPAh*(*IFf`jxVm@6)H`{SR<4gtIg;*N>v86lp#w8VP`s z4XIW8z;3S92-?2b4jmiUETDy>d#6AH6O@vfP+JB3*dq4;Psd&XJuv3NX{hOM^ZGuq zz(9+gqW+MZ*xtP_H&NQphu-GkLbIXCN@uY0xR1Y@9364Z$*s0zb@md-DRsjCT^ z)k1waJ4$GBXyIloBYYyH$%shY26L-NhrQd%gQisqFRt&J(}`0D?>r4fw9RUYFa}si@rJ1T%2#*j~aTmH`!m^_0QO z^uChI4AXvvi>h5v5PSrr)t?el+t^-*P4LOrZtvN^?l1y?6afaYK?FhVAkNqV31?tnZF1W6 zCS&ZyUsHFBHxd5pgfJHa7bUq4#YGUoAZ)aU90=EZ-~h45v%IN@=WE!EenHYnzF;=g zU@9K&Qz+VPKMF!0s&BX9CgXyQnq2=Up+iltOV-djI~d%U6zkfk6UXyadev@t)SujG zs{zQw(c{Hxx1^yO(~w=WEMAs6gyQ33`ZPvHl&M`^K(*tzR2ePFXfe|`?OmfH&0K8^ z6A)}sm!dSL`Y_IxPJQVhg>goX{e}3~s6RzM{NZmjeL}sW>2M2%*=GQl9 z7T1#JpK4yvMH46k?)*8mP0m1KH#+!Mck{UiqT5XIc`YBDJn$zBNxF6b#=&EdP>3Dt z$=JW&vDeo<{&Q1m_e)C|V1GZ6UgI4vPjd!qoZIYV>wP$Ov*Wt7A;D5-i|;HV_#M1g zA97{26DM6q#l7QpmO_{_C&U$l6h%`|OnE@-s2#koQu?9wpbUNjp3XQ%I$bMi(^%PV zx4)YIjC_qTBMabu^Bep*qoeh8QrXBB5#;M;zsYm?`i__jOicKP1gJBj%S9Zm#66tG`b<%un25tAQYBw#uh)gGwrza~la;F(9$~Nt9Wpt8_t?lIT<` zHdoTQdc8D66yTadK85c2gL|D3j#sVxvi$Zlp`FUOK-iVm1lI~tH}N_=dyh&qm+9wp zS;Z8mL@Kr|Ip-m_mEE4>oy5LvgZ~iVSYH%z;RTP+a7~c3a@JMqQ|`Ko*)G3pcTkN}1ev6D;^nt$37i%EI4KN9_{_7R>v&8F*9@Z`h?2Bv z?qeWrbc!X0d10Fp!U98)?CDG{b$?E^l~E=Rb&b4nb}dfOJ)Ww1ga`-Jm7+zO)g{a^ zU}d~p!G%6iy)tcGCzFzs_CzTp>2}KGX?}+|1(%ZD$9^Fo6a#%q;2Ry#+M>~-H%{}W zLjEC=C}giBG#XXHr+qWE>~lfB)Gx+Uf#xk*X7MyA8kF-tG=%Tm3P}^nlYLr4Ppp73 zH>^(cPoYxQkk}z11eAT^)AiCkK|bYuHeWn)0Tk7{5K)=nq3J8vq!h}1?F-75OlPA` zWv-kCJkgqZ$5fB*4!M*|I#yM43I#GA&j;^~sDmqUd?c=x+BXb_dHv!JVSpXOyhtBy z88a5?k}HX?pde^K!|zUhkmj6mK$~t}yt~YGC+tp=apJepgk!Io50#?Z-{COPF)`^S ztFramrs4+4`Wmo_5QKqMVG1Ut#okRQ;D7R0^3>Qi8VfTe|J5_0Fd5K19}}&+8-bZ=miBLswoZEq9yjqwVVYc8q_&(%#Sw2n z4OcW8Z8o)iYAt70%!aORsy3G?1__@X6L*RRm3>HID2;dH*&6N4vlsi3?wpO!skAgm zS-cj!w72zH6raDINJ{_adWd8=l+ez}S@thSYgyUnLLbm7A}!Qp;L+!vcg_Zn+Kyy4 zrw`k+S}kmLCW>9|HxfXd*5@C_#dw?3G{WmrZq?6)lP#`zqj8~dlYp6UjJAv!<`|Mp4g^`@ z3#_a9=h4{!OJOpNF0|HU%1sncBVbhk4~vG%ls@Fr4VXpg?Df*!RnacWwJ7#>I%6xU zM^(1jY#PrQY4hi1C#=E?wtzNxgkGJ_p>mpmCZKe9go~#+T46LP**j(0_nSIA!fI1j z98RJ3bbxcE_zzI>YQzgJ*iG*H28wO&Y_3zTsF#SxTr!RB0v;cKl8hv}8@|DKGEgHm zPcc@SH#(xonH@|3n_rLHINgiaD{GCaa>>?r%I5Rt?{oD@e?IdPk{a#!)fps+=L5*{ zRMy-?kH3!nZS?&xF1m?YvAN;?unm(JFP0-T35a{t(IR6i$G0T5N zA^(j`GyR_!qApGGYUUQ$?GqGd|777QAj~cZg#W=1ZGfsj$|e0zgHM|eu{>~*!qe>~ zh)Bmzbv$`EA)n0u!`L|lXBw{UHnwfsw(WG(vF&_8$F^;DY}>YN+cr+`+4-yXU{}54 zXZBXzy4LcTsDY*Xw=s!Ck7Uo`?%DK(M)ZNn^}Xu;`E2^UEzt90o#Cg`-*5z(B5Q$# zf{>uokM+&shI9w^IqubcKL%mQTe!Ksk@OiJ7}0nBJi!p45g4zzJR&O$3u>N#p5J{H z3-KKj8dq1gB+wy_(iu2Wu+T+)lL?)Ndi3^kW2_m903$^nqurCDyCzl?B>^~lJ1R~( z04AbR?IRyf!U(gQmYMW7V35(^(sTV?i@mbd2|(#1E_(^4>hRg0UjRhs zx?V;d`Qa2g&zJkh^Y3v@o}lDL$w4;(DXy;a_r$?CK+Z>gL4g+M*^{1?XPr9JD{oyl zYF#!JVwge1t{zpafy6{aNjg6o9k&jb?_vDQq{eiRU#uIkS>mPk(gAIU&&Y7jy816) z3i8fI#_DwG-Ph1HbuYeE;c(Gq4hqAf((&Z2bsb0wtVOf1>6&c_H_~^BW@mBaKb%1o{p@*^_r>vByN>fLkB_WbJL^di-~DM1t~xT}?>rN|MW-xIZXM2P=c&_69Xku2dFC-^_Za z#Jp^0{%nX^5PjAGw5*Fx1G5Kcm@$V0JODxz-9Sa6#} zmYX$Ctq~3|8eBvFQtV%)owF6^V~A$q@j2$H+fY^uJWL103C^Q|iK{S9A9hBW3OZ#b ztaROX&N7|%IZiOel@TRlcudYu?~5+<4C6I=%}19SL9W* z#4L)ohC1;gQAsHJk=77pAU;<`K#IK*15*V`Kd0taE=^D(>vxO-X;k$j`Buu3zm*M;}4m|qJWx`J?sxSgR{;|ndoE0_gy>Ox{@C- zjM>&Ki09_!6UAx_1hI*$6LwI2C+3TvxLQ)|9>HtdN zdcob#V>OO$r)@_I{G5ENX`Y+rf<@#1>L$t?ey-|1cr{Z=)E zpBkVm&3M%-FKt=Mv{2IxCOivp(89;wvRN(!;u3}4NoXpku_%*Fmv(XvU_I6n2cfNN z5^0W%Dwb2g$PHzZ~(RG{Q3$c{2N_`73`~s-|k3GxETzaZ`=pss@ko5yuyOQ+OCFp44>61*@XH#f3qX?wMbS{ z!#JL7lu>u`?M0Z3RaII%H8o3W?>Rq_ai1CXOu;eqC9Md9c~AB_LJ9t{g%`>D!E2{^ zr|W&fWBr$q9jm%6=R|fvUf}9a)s$TY3fBCZ_DR#Vv3I$Pm19&9*zNCp<1LNLd`7ED z>o29r%oCD-6NrDc#Z}QIQ;MWGd#LcF;WAnz@Aas<^>or(Py4yfH)%Cb!%Ip9 zLvVSxwt`85wnTt^zXdUu>qPp7Uf1njy!Nz;UaM((2JH~NB>0>}bU0Otc}Z)s5e7aB z082E*&+k2Z9P25wszN0r?|pR0`rDl+bkX8hZmwKQiarGuR>DZY)ghNVzKhQL#zj{x zhps_I#7#-IRk665S5$UmIy(tFpXF1F&nl5L7S4cLqwY*OQHVfyJ28FYu=lpW{S%Rd z-^h@%bl8Kn9ETIRI?#jNWb{Tho};9*^=s<9is5K|Sct_=s;=*s@PdbtE_-%`MznF5 zeca|TSAGBjy|5v+Ihr=YoHU=YfXq zktS4M0nyDv@(FeZ?E1|VCt3*0Jz4M+DU(G9o(?$$d3jcV`?S#2oy`i#>VX_wiX6=2 zEy5O?eS-()XgceiYRaZ?gLf}W2c^g;y7H0%xTS!76*yqqNx8&F2N$ID?}hLJRZYWl za@w_NWd2m)1OI_j22|R=ucU5+&LbVn(K`WE5j|)4+U+l%lt>Eb3^9Ct2ki=3K?Rl4 zQbmthEy(_7UOta)r{!zYTHBuMvf78E@gMa~q>)8?u>Zix^zPXx{8+$l+I}Izi6XJ3KO+chK#(dUySzuoYkKlY%HP-2gn%~ zOc=jklx;9PkMpNXqe|i&?}L*L;5$*^769d92H@_JcVCeD3X+=XI503FMf#k%MJ&;Y zp%Pa1;G?SWeJ_nrPSD2DeZTc~RHV{I&lKhE1x!PB5x5s|2JL(Yaugj5 zUG;V(_hy0Q%gWow{EVNQfSdcPd(2eu@w{qR?ENF|e_)L{%E5vD~%-JJQ&db zyW6Yd^B`K8VjJ7LAPVP4p4-!W{3oP`@eb#oIa&RB22@~PH=^b7BOLachi6-HQt+}G z>Qz=qox}CtE75(4yj}vo^fPY+UIIV-zN=VQA8n|Lo_)Lo zLs>80=T;KSQ+Y09r1miOJa@&h`+h&mK0P3=aFWVMZ@z^?8>LBXmC!x` zbpclmT39f0&5eTzJ4}DE2=iU*VZ_SZBPPIWS&`{i?7SGE{iRK~N6r{CkmtiPwzwu^ zv`D#wr$&ksCI=e}OG1Gq*0U^>yBsh7@xHkd7aR^}?H5+0v<^#|7&oN1Q3|MJdL;aC zZ0t9!T+hLqG|*Lm5wp~Y1LAcWX9#U5zU|T-kGRQAFBH3AmzTpjEAlcmOI|;Mc~5y7 zq*}PifahpgX#eHj0ztkO1!Nt+Xp+0QxRsud%NT+!5Rr5dL z>f=8X+*)&aCW00b5OL*uD_AV@?Hxvsv7xUdnIy@yHg)X_U!1r*&x_u5=Rmw6{sOt* zU)?J%3uusm0w)^PaHx?)&b2MtZGnUTF3iK5x55cr=ZchV7`H*J=W0Bp^27`qG2nHq zl=h;_<0xpae+Ox8;&v(uL%9#(b^^+@xfcgC4gvW}s=I330&VkrjrZ$y<0%>vrw&48 z_WrWU=k6ecEh70H2~pI-U)?I~Obw4r8+Fu?$||=bd7mJ}rJAzB>c9)qS*0;!qi4{b#4VtdyXsDvQI5+C7(LFE!?fo-P1g3yENTOC2BM9W)7Q;c1)1@x1S4=@8X2u zJxpGMGI{=%1^eyqYQJ9LmQ~2TQ-Wyj7zQBn){%(TQt0OhWipMuGPNV%U92n^k#OA~ zn6{mf6J3TN&){dMb=~LeO4P>mobU(1ulO61UloBcFfR|UwDiyY=!U+{bMi#Q_xno! zNRB_~DN__IHID3(ZL=LJTon_25P4QrLN^IF>n)A#O1|2!LDFWDJx>FUFTGhZYgRLw zOW+7-5$N>c{5pWOF6|FsT^S~m(|0OK^v2!fIV?J;=PDgryy|y@RRaK&LQ!%TMYc zuo)`(W6!iJ(S7Z*fRudbT=(bqoDUJd&VaMld?K;GD>e`V<#v>M#;)V>)F*x}@NNqW z(9u7Km){CD&>&a;E7v=sI@>i4GwZC!kxv zhC#rH`&MLl8S2h-Y*oSOR|ZP?@-R^TfZ{Q`9@9Wh7Yr3-<~&6U3P0HTMDTtNAccqt zat5c98U_mCS zO(4c?$GNQ7sq2N2J05M26zhH{`Hx2-`koGzG?q0RRQ~S;@(eNOe7YKzv=eaf)yD-E zo-w7Ntm!Qunj>c`N)OgD)DOarP1Y{~>Fl2>+D=yRPXmE0S>Qnt?-1ioR(OIe+*4iF z1)dgo}qkQT`$0A#<$8;GQQ}@>zj9?+MV;i_$cXiEtGJ zh8o_x)e5(>m>~J&aSM(%o!*;>pCGOg@#;m)9jBZX5;fbO$C@Xh1BODp1HSKsAs zpvuo=DnDgPyU_;*J9pvIyDUgrds!;6O%a?@aM7JMs|pEETOVRnq}IS1oI;ld8;+|; zyvPUGG;EGN4-!@Xm{?(Pgigg$;<%ys+&|uL=DY?O+ojYsRS9CxzB9P%3cY2>T{*Fc zr<}a}ju3|X)51DNYJHd97MqiXCNeMki1Cn#MOeXHUd$=U4nJw!QVm90hDgyTi3-@khA3j|PLC>mHv~raG)$v;F>!n+_Aa1gI;TrTkMarle-^4Q^T{ z!>iLiPWk)}C=LKRSSlZkruW9M|7gU=XPR)8u9tDD%Q#6;F=)nv+x^NcHA}vBV^Gg7D`rDloI9zwA-m-vEm2kJ6k%W3 z%%ShCIDQ^eT}bLga}4FSG;X&r2}AIUgP>YYZ5Y5qwWmtqZFj4V7t!}+GZlT+^fNz-aiz_>dYzI$FUBErv=BSnO0;9;2OXYD*;8O4 zS21#s%jFRFhm6#_0Cw^KK^5o?5>M_}qaq08kr?hlUI2WjYHUJrnZn%1jB@CjRCUZL z-SQwhh9#}NDtNzVQy5W7-ZiVsQN)va_KpH@?6@Q2Q z$ZVBw8MGZ#&!!wX1sN0DXtQDVc9AFbsRmK&?*ceOc1B>EjqP1ODC>I)DfXeFWhh~# zw4|M(zEW@tDQx{0yrdy7QQz=A&=!S_?qby*q*RzrAf5}Aw^^%xbSk9D=7$hrLFeB-Qe6Nn>VkpTdKhJ{i3mrOBXp=QHLLRtL^7*9dR zo}I`pS1;+BzjK^a`21(lB#=J+Mr`Y*=5YZ4*vh$z?C+uqgi<{Y zy(s3ig&1?*eFU7qiKK8?4UV3Pq;m3luhe7W zp9QSB&fw8@4~DtHXd)eFM#QxJNypZW6-6N174QTmSn*6xR-m&z<_~~^ z%s6B8_rRiMdDE2aM%}xkylQ}QCW?t6bAjLHmSN~5N+&B>48DSqbQL5Z#-1gdT-4Dp z*kb$~LGRbe0MZ&H%K6rsXg<|q@}obXYRqZx0sYB>MCy+A^VfJym9r`%-fL+LfChky zorq*2ZD*#JQM5p#t#+uK%*GL6KPyD-r<$*7TO^+wSO@E|W4I4-&>DVT@xJtqdsBwU z0xbjllR6;{D-kuxNZSx`qo8juXsG}V){wSZESs3RnfWg${HSm6LVNq)O8Wn84Z!|? zFJ!uO#;R#s{$nF}hZJkzVv`n{B@wbA;-$35H2LeXoa?iU>Tui|cs9YIE5tfB1s2dp zSIju!Tb&iy3Ebnj%hBls%sIQq>!UZ%8pG(i@O==%ctlu~J9+i*I0n?V1vY5-JA6

7^`-)({nts1}#F;M($9K8B+yf$XW}@ z49W*BVF-M{^Bm$#v1WUSKQ))Fuf|gR5v8E^nm!T|@nj`C(0dGs=XL474XYJH{^>Tb z0n0F6XWkU=ld2oXV91MZY*U3Fn~|ioGCrFoCb9#m2SBl&)SWy|2y!ln%qAwklz%|` z^Q@R+_L=&=oa8-S<+A8#X>`W3*|^04=fuQC(ZN$(TjB`iqH->%TwBLOoI<9fm?^6uiggRn6;7 zkz~ijC*Tpt+cOlGaDiEF`V-4tsm*HsJLOr8oEcZlY_13bGY2AQgYC^h{yL}*1U2hr z?|NRdGC`8CkC7>X$xhzNE_0_iNQs{zl?&{&f9q+AZ7eU!N7hn?9t3f$vx1H=EG z8CRn85%eYXiszxHOz2VJ^5EVK zm~pJPGJ;<92@o(Y#gH8PJ=3>e7U-b#PpmvUnN;gX{Pb|{&?&X(fiAT`p=It`XtzUK zv?y-H)hxSg8nR80ZfCfQZc4V}q?Brk*#>fEdJJ{(5oUXgbSXjUBYUwLR5u`$LN!yL z7%SXLHGiqyCrQsi!Hl7^9E&9uaonkARzxrJZkzW3)ki&n`Auwh>kCo3sQs}&kDyUz zNJ?Pn$6rhNyVyHm+YmqJLUy>2JUa(lL&!552= zH@u>>5Zm@~os;S6jy!J-^UU()hu~POO>J`>FQ$A!eecO!6jOmtqDw6(&~=NnwBSmW zG_M+u;D+8JKUl=pgHR>>aFZ2WmhzyvF$>9kRC#PV#?8@dP!X9UM-*!v_oj3-YO)sa zRN}O%L_2Z!+RDh-mWx0iJg7#c)oW=Al42DDR_8LjSt-l2@6|<7mt!ARo5hn-)Q*BxNbTB^ z0yR8F_o|7t-Q8QRNT8q2XJT5PhkB*rc%<=X3aVdUghue*3XQ2=&v1M(vg;&&ZjLOekdbyQ>5xKGFutYR*$1VpA3k zy32b0>FHKs?=1cc59AjE*=K_{ZAH(BUc?u~`208@rLgHr@+aK?6Ky2n(DT`>B>tvY zp|d&o=}D^4pAy3DFG_{-{NAf)P9A08c^h#{Lk-&|IEostTW4eV-r__C{xYZCgq5ht z0b>WSVqZv0z{pN7Nm|N%l-b>$bH?it1yL@D23DfRUXnlt#V~t>8@XtZE$W?Rei&sQ zkEg{vSl3mKGK>!`PsC0l5#Lx2 zUP~qfJ4;a!lPh0RzhFsoSQc;oRViB|ruKBh)LO8p`YrR9(kvnNNi;*WlV7@B-(>1j zL)6NYI_2Xk8l|;cc-Sd_S|_GQ8+jlq zDnv0!EIouI@V&`pv;hCk0-8N6zE?C1i(s45$|Eba7wu$wlR8Bywo`Tg(fFNBMd-qUVW zDi%d$?i%hhpxYl5D(D^%^)%)cx%ea9*wGM@16l4*f9<-PC*1MV3T=j3crr%oVM?_KmaALv&mH5Y0r`8xaSZn)ewF7?qOlcs&P85moZ;PSNzu**`ecw@#z}pNQ&Va+Q8>M1Jpm_4r{H ze-eTJ9E{^(bMW3?SMHyq)#X=zU)a&Xb1d@-0e#=>?>6aNKp&XXJ8sX;EgnK@@9FCk z9^F4hE3qdh6eUsq#}Vk+k(+pkEmPcmvI;hYI;3sQ-aAoKO}JOFusP^E-}Wa}>~IE@ z7*T@yK)eP31b$Lvf8%LJ-5?}V-l)rKoyTWJrQmipwwF%I0~`Q0Zc=~8nkX%d$^^06 zxA{cv>m!8yni{JEmprSBLH1ur#)=S{gS{8}NTv{T^1GMb)Lwf2-n^4O)Q4@tQDCN4 z`+UtF;I~+Vqy{J|=skz~va3h#ZfASVZpleYWr-C}r4g+&*9Nilf#|U;Wum|Z{<}BY zI65yQV^d%|OL_tfHp!1r{Hy(RwE=NKNCsFE)Z*~W{!}h|D3d0d8zaMEW7p4$t}dtH z@~t|0D)QAPmvJ0RCu>Qbzq_hPvN_;O$q}U(aI8lYLi(lbt4$|1FHK8{K%-U4dy#rV z>kVgnL~h5d(-e_3&ij(68#B@{m%rXPIRaQ@(24LgSKnpQP~Ie&NQoxPQO0O4uN=DY zs~PAVWgXwB&1+9t~mICsv6L zcB?3kUTqgB?F~9yu66r}e>Dlk52l3VrKm#iwrH52-Z$j8W^L!kffuzD={*}#IE%w_ zX37*BR0tC@xo;2MnPWqlN!cB*ATZ~V}9OTeq0N4`NOq4y|e#PXrwmcrdQq5GcM)RMkAisiubHgYI zK54;y+Sg&gBu0^I`7JG9HV%BIcf9dQsbJs}6WF$^lq`w%5IXf7I6RCYD_*mxG&h+e zBfn*ZYKAEVW-%- znjssMSVbtOf+9~w;{Js%lIMk}4-Wc!cm9VbOWPNNuZ>Z5b$do6?qBRv{7Is@$ji!( zibNv`tNrd7e&P_m2|RK`s*^OIofirq{>PBm+LmKnt5>9JY$hmK@O8>Ure?Ab zCd^_#*j58C)bel>_)UeSyw`Nym~07XI5Oqf@<;Z@kFrFnbc+dHn|N>%r!L9z20KeH z%n-4LIDBlEBq>?z7YolfX@y-ZrD}El(H5+;uEm*lsb6!#2aW`16&J_mCn; z$n%uc$+beKV)k8}4$~nSI8vv14VGgbCj5)8Ltqn*s-`k8-e^%d$Y@Da&3lZeFKVV4 zh9@@vPB!nsNgo;#QGLAb8KT!>#=R8*LM|tE0p*9(} zjs+&HJuqRluHX}+6JEr%H>1-ki z9WLltsmE_N1Oyl#R*35|SfnBW4&I%Lf_D~`l?ysaeR_f=u0Qt4yHh5v#5#zQ6;3Xc z4Lr$~aY}X2#2JpUX}89}R&`;n-PfuF+V^ z6GA8kaj-g%rZ3e7gW71_cgbR+z*OuV3+K`oypJbKU8F61=qI6Li1s{`tj5Ku6?xT8 z?n4-A`et4q)x?OdF%l(JlAjq$OE039NQ=!|Jwr)O2G!vRrR+~OZZ>C#$VNT2zwgL; zWk~*+*@&hc#$trr4De3Ak~>_QA$n59(h@#m|1;- zF-HDi7v=J|kD;R#DNCH~0m^ky+*!ofGwtr!L^@>IvgFH;35hJFO`$G7ttr;S|M>Dw zs=$r|Ys+iX0>mS?#i-q<2Qp+1Z>OVW4wyQ(&O_ltP8}V(~T>`*{-dD zyj;LI_raa}Zft<v+h}D( z41P#GYZ_n*EelQ(H`ewCR;^spkR|~ExDwy?uaiarz%GqBMBYUhAT>!vYSD5vCzw^+~$bh44!B)zS@q9q(*RY(`U-h*at_6KWm zKs`t6V|}=@&*k^QNlD}qIQ!;Ghi#;j9l8j}^iW-uE2aJslXw9%U~Yl1 z#!8{%wQ8rqCy6$_y1VxYSSLI4bhz#!-3A5Q{)BbR$kxQskg=mNQfq%sQA>Lz_7NqnB!L0F z35e}fryK~p=Jq{yJZW;X<~XiJHhD02m!`MRG75`TyJ;^`P}io77qLi>&irA-eiLcb zipHVHiqJheHgRR?4AK^fL3<_1z`z>2p0tNHG@>mfJ_NgF#3}B-bx>(7=2#Q~vXGaB zwFitb?aBV^NjkP41Niv0(^tG4|MVW`yiHr0KJxc)D}f)CI3r%YO?0G(wp<xp5L`Ou=;mWB*zetvH-CNVk_IO1X2#F^gh^o^_rb9WKW zf$Q0)stZXl3qW|c*w1m&^V)evmKoMWkw?o2-e+W>Cj=(Exb;!|h=yy1u+5r}HA*am zH(Tg%?BOplYLjX=YNfe+N@qG7ylWPqBuEVP@MUDW1+_0-D==vQb*Uo&?x|@yreM5n zApt{q>Msf!p$+}hAN7T!bJ;NDf6`MtCCtF#QVY=yv&{i!#AeRyhkn2jP8I%yCc|Lt z6A2E7rB?Pjywc8j`RfWs)kU|p_-v+jNbBI19V-}sOrm?Q)7PUPH}UvL2S1TW&b4`e zgU{Xcc-8de=r~$=h*8Q@{nGID%l(_ph};3+5`@FSsP5_f^Aqr~XC-Hz^WI5LZFmoL z*roMZS#+gKV*PV}Y9xAFnAa(M_b-!Qz~%S-{zo~FYS{Zse@L2n_w%er8P zaDMwDqT~4vk4(fc1$o%Jf70%{U48wznLf$&(fNMGa74-i!y7tU^=OA4M0Ld=Os~7Y zzqp%4m<9{sUnKD)sFaqb9e-MpeomcgxVtsFxrrKa*x zuCG++oVXg&86r=8{SkfdIJvguZ;D;>mB8qoux=L!Ek_x)94&8b0=ELsE-Jl9uI0g^ zu)ne!N98!{wbmz zUC+S7l&rs;7xCxZidcULsND~jb&Km{?#CF;7C`~7=3otzXGKKQ&bas=8;IPzIa(1N zilRASR%!_^3LSeKTg~tm6VNH^YGfTkwO-rQ7AR8qvd>=APKZ1@KNFqnsE10Ovb`%` zf(u@YEou{53i5BASx;+~%y+!bYVV)G*034sP8q3Ix2)Qs%O+9}@k7bt8!uC$Wu4-r zRiF+TAi&DRiLONyj^fE4XZi-Xa+n}nG|K6=hUe3A)}vk{L&+Bz)qspWswu5f0PKEN zvJujx^BO9Eg)d$9lDHug7^~Sh-W|!hGVW|HCpxL<9hgwyD|=NpUtkOEu&*t(K?cyY z+!22Nm_=Ehao@yzM48U|l>WkkQ)fN*26 zkw;O0&VUBHSj5he^M(RsGO*A3w=gI2GC%RvwXvGY@LH$S=9O%gnqVT<1B5}l%X8v( z7;26zH~wByV_Y8(y$~L{(9JXmT)pB{r7fRpxe6(>0G?!zy;<-itf>f8vz*AEK-m4N z1|VbQ(1I!?Pa^WIp~=~Bn|F@dPSW zP*EQZViD5ap5p1nICK2vi;2?^(7a4!2P;QO!?pLY|NK^kWxuJ!OcUwV?q{w95K~UA z4^-Jxs%%ud+Y+@>8Ci*gRbuQ0#c|ugB|frGZYb1A%{f7tkCK}AVcltGK(J@u&yvNX zTt!|7<65f=Y^xXU=#B06#GgK=Wy^#8Mdkt5HY5WS1Rr=dMsd!Q>28} zwJ)qc%kjeq1CvLCD1cqP9xSP4PS(VM5n%|kp$>rFU2Hi+G7iG%v_I>Ln5cZMFe7YO z+dlHcfff`$@~W`bekhJd9rYCNMk0g5%ym~8PTUQkA z@BUYoU2dIaok<-Q!Fc_K#IPq|;%^_Sr#(jDnvOuU=m1JTT9UC`r)1 z4vsk~tBw^f_v&kL+TfQCa+vN=J2k9|g9T*>uA}T9d^o!6E8yRTooW=ZLugh@lB!}rePeJ zi-BI8&%!>>BFJ(`7^{wMu0DV>5@8|lGW>C4*%->11hFlO_hm0_L3R62{HV;-`06F% z>AK1_Q`BwDTi}B17Q`u+t#h7T+gW9~-{8JD9`vjm1uGJdQzit&f3Nt^)30TN#HT*Z=TspKd%Fhxs?DMmMsvK2KTXDZ6n4b^(C|0T(|; zrf|W8kv|eZCB-f&L3%P`DuEjKFQFE({u2%SClE-rlQKB9B%5k6!;t?HS&gWnmSsM} zIMzWSv*BPm+IN!?yM`=a^%80vzKyO%|9rrT1rsoU@=j2ZB*s83FKW~iFrC(L7xk%c%-Y600&>VUHQ z;}fKOfOO~nqh6+gvoi|2?7jY+Ryos`oHv|8rGBa9-+Ziy%yG%aRPnVbOR^@OVUwma z`Fbo7NIt^2*I>Wc)O(n35RkH$-`Rg;$NI8z4nGu^oL8#uHD`9DJf{>JbdZEto&t<2 zRb)X{PX%D;D-8P8MIdPxbvZ86_YYIr1H+>&;2xS{jLB;SL1(Ch0;LO#w=& ze~-`%K+Q={J&1O6v@lu|KeZ;%1eKT_@;`QBh_E#$;kyz^1H#|XzC}+u#bm#e@aBVp(_QTq?rl1$2H{{Za zWTCTQqNx6Bwv;tKO53y^4{2ouPaq>DVX|V!UjHo=Ag0IeiY=m|JoB9f8t-PD3qkl~ zt^+o~_shhs9jE9;$WHm1eaDlK-H+jzO!}UKJ3aF~Bo#$6yv-^XU2A+%Xs5zyKOEr{ zzCVq^S*A^yG(u;wYsR7#P;N3QjdGTXL(Pt}LR;hVBxXsur9B)niApLx8kOkT7f78% zL?8t`=Ll3lWJYId(1R7DK`Wv^7+H$G6 zD*lizg$uMAeFN)Qv{=>98W*xb9&5cIC`h_rl{4_j2B#$g=zBxdzo?Oh3VvGWp&()} zzGQOA!Pb&i1^?ZDMQ4;5igAj|StEDxmUiXHCFY=o2Blu^Rz|WjyjZrxq%ekg2hym_ zHg88MvbC~LNSDTY=|`o%UT=zWST^&xR+p4IN2m z)9}gU8Jtdio#zC;*o65{#uUtrLM=$mQUsluyA{Ed50xCzNNhGxmZNY}P*iVX>ZqW^ z9-kBP`zwdL$_tjJl5~KOigVpRve5%_pt@keKzy{TG7z?daj3nMp8z~9A0Disa%8vh z5Y`(o)2I->Qr&MeKs;6I77!v!Ko(GmNRNXSs6~+;J{yf%RL-e{SY%R1!#!35T^I%P z`hwG-X|p{T5+X76vjx%sj->Wx4ljbF`|M$P9UtYoLW+GaoLHXZFcBi<5)xN3c;k6z z%LU0=Rj5Pog5WV85ZmHZb5vq0zit6l$9?qIU9_Rl`oYJKiCV`YU6I|*G&ykV>CEqq z7*F+*)q%lAB2C6!_@a9*fZN_dGARpvvwApzBQJaW!V{kouuWt1h>J4(+=rR%dW>+3 zj`p}vhr?!zt89PE&YqKce&bxW7=p^JYSWmF^odUyha{a@c0YnhYOu=|>KBA!%I+61 zqCeN~aMij8W|ItN(;+rNBHO=CL$c#kIvPz;cbR>9PTV$r%=IcpckNKV`6neeI!O_1 zWjr6u>Ad=*gOWxSv?7h1)eT8eO_5w;!IE`t8b2O&p*d-FCQ8J%tfDF{s)hPs&@=Db zxX1y?%Ra2jBIw}&YfR2s5*H4$%K*>wB zS3Pd-*N|e5L=e@MNN|nDD?5*lQ{%7}PSTT!SD7W=nH*?BXIVw<M{B{Q6 z*UVDU`+ddh-GT#pFb)Chfk_GxaQXP6TP51Tt=cvWIc8&(QpC?$_Sv8*Pv#XKT+tRU5zgw!2A56h^HfO}c{uR(699;K>d*;8sgyo% z9rrFn@z9^`nBC~$nStP!m~DUW6n*rS@6932ngwZ#_U=ox7rjsI_SH-8q2X(MhG>SdT5GzVy2LTXMImh5v z(!K_!Jor%FBcb^%LQA}7OrXYQzm+t8b6NDi+70z>@v5lW>Hcm4WwW63rXpKrwN4?( zJD|F#k?uAH0WVv@SL*p2dza;aJU7I}{4>k^#N{zuZ7ulog>^HkoxK%V%`tdck4z(z z<-)q3jaMCbo$`P+*ws>cP`vgq?nY?^9-Wl@y&r--B?Mcp>Sk~~Ks}zc%6}pJLT**d zmF?3U^27#_xf5lJzXLIjl-NFOu)S^_D*DypQ57W~nL5)yxic=PL>wy=s>_9=UQqU< z-SwY-EoWlP+3B(=Tg@mg2`?6C%4(ahLAjC_NtDC zgt9`NqlfZn%b;EbO#i8z3iWq18SA#!&9CC&OlP|W)sp6_m6X(t!mmo1KfPok*9^Kk zhjcDw4#N7RJgJ#zKP3dAOGrbCL!}|moKEx(AAyNX2-=5 z26g6CjJIfsC}lIUH<3ai%IE@Aai=?oQKAxK#(L=}(DJ2a2K18|>gW)3UbAMmJ(z0s zU`gf#W8Z{6J#Mb(jCe$#1NbF><_*pk@|^Rz!BnL)Ix=KGpUj9F5KZf|bdUCm19$L? z24p~3SWc-gRXe_L(|IZO)JchU(sr!Ta5hVGz2Pgm@oCn+sr_DA5fr|1d z())J2*EXS_fH+M?vOI?oJGx>*#^#@Rf#&dxpWGe!ESJaK`JRrBFvsRc4&giD`^WL& zL7rdE_j5R>NTVR^{_(*6J;7yuAh$@XNVydMr8hS??w#l#{RnA7KL1d3{oeKc>rZa@ zBmW<(@2B|h%+Io(`&9a3)$3FHw}hjEPm$6cr*o>78Yyn~e{f3Huip5cn&OWYge&4F z{D(oD9yMyGH17EV=Pd3?%d+Xb#7}2W2kJzm^G>3qwoe`xlxXha2?-YwTnA) zy*>4_N_6w>${CBuhGi%#4Ykbi>PNh~DCy198(I`t{)+PW zswbO@DwW-0#-S1<0XQ!h?=0|*`F=|%>!S9&AJBiJVpyt7Y1=qScvi>rE^jTzVj7kW z|9yt5A@O}Njsj#!@(^zoScz=imOVlmsn#(8yfi}xlF2yZ&Pn|RsjH4G*`Y1X`Tw@B z-?^IhOkw|0Roe1G6xWMozG}82i&K6vH!)c#3gvE4FlUo#5u*Bt-^N@|0FncOkr8itQ z$i`ihGG+4n+VR4^&lIbDPU zTY!#=*$(6xeNBBUJ+oz-idr$@O`shSd{ah%q~47B8d49{2n2Wr>>4Jc6-{e{S)o7$ z)vWcerqc&u!A4N|e(sUGXKz^T7a*0b)Fl@v6Vx`SiR#aMG~nuv(w7*t%1!Us=V%yt zkkD+pxtZBZ2?w#PyU}UooTlJ@81CK!>8hwFEK>X=a1@OQ`W&LxW60^}rUf8!BNrBr z8^uUr4^gUijY>X6nkw@J8Vu5Y8ES+`wUC)?KekVpZkYF;Q*4_$|EHRoLw7_*TN7}JV7S%MM)U*)1_%s)qBl$}acReu1Pg_%ttr8EQvvz1+Nn)iWrWbEb=> zePS+WsHQq9`azY!%*ZaD9Yl@m`FK1+o2T#+-SJh<=~^Io$=r1I;d( zn$jmEglU+vOfFX-$rmlk3B|B?VOdfs870#4id*yUF3G35FPFyoMUhal7eNmr$g~9s zC0LR@{wVtdd(blul~QL4^n6Jufr)HrR3JGi%F#v<#=Kw>Ut%F0BakK@`~nAphI@zdM>gFm5`V{TYr(%n zuur95c7>zF;%!|`gGCgvDT37mFSkv=K1vwqiCK9-Sl^_Rs&`Ri)$=`_?|Ws+wEY=q z5?A-KOfKqV=YeTqc9gKN*hmh&O}+}m2y7_eB z#C%7klgiM1L7()OI;xN1m>0`FvEi(6UHXWxJq3YTVF}A`8^e4^f2;pgFXnn>z++MFiAz0AuNE@?x$ie|4^mco~QHqgK zl)GYX!sf6>->FFQ2>$?4V-3kcr)yOA(Eqiip%j6_Be}bQF!RHo+OO6s-Z{9Tg0G{C zN{eGi=pvR~clbYyy;GAY(SmimYnN@?w(VWEZQHhO+qP}nwr%UH(=YdS#Chn*Kadgm zkePGMIR@1#@RdD}oD7`%OtBBSo*7!buNOcm-bH6}P;JUA!E*n+r}2}Ou{gn4s6B5L zd{ADv?jwgD3-TyjOj7}lo|tSABuYy8`i;h_DAv$F{mLTQ{;vLimORjy;4gnM!9QSF z{>IO%k|0dIROYirJTa=yO?GA{(Q}iFlz#&Li8;z7b(PO*2{Q|LBBb7bHm!9|2e$*~ zs(?j!!W>+3FkqB4A~Kr$dUNd>#Pgw*M4l5|OxHufJ5m%td_=ydOGYRNO*hFMs(=lc zZ(DKUi;%OC-=U%T3|3Dk1&%_9fR=Ia|Itw_SdiQl`89Hr2X3HHu(&))4FBm@BdBiY zXiYix*aFul%Q@a`R+Z4z75GL&*+5+9M#q`pa{gNrcD>!{9LwoEeLVR%dlsvo5gDuS z_)K>qOD({-AKQN6*sET8z^-fNLLU|x5jWz1jd0%v*IyJYtdCYZM}Dt(7}0r=s%?pq z?=&VphM~<;1q3KCB1bd65tb?i#Z0tg7AtjOwLB46}g^-$roDBel5YZZ8HG40w@0u^Ua4hy~GHuD*YW`MDi9J0eg}D||5-FQpK1);WM?Fp*!K_dz&~z!$E4w2P zEgmVw8AZvt(9DftmWijJY+Z5H>fpW6wRAwc$mpJzHMmoW?q7O-Rd~MWcNUWDKl7t3 z*9vKh?j(Paz)j?TNTx;P-p(2KcdHcTBn=N4f&33Gq`+e=JX?CcZ`0PnXGsD=2G{dd zaTqSGBaLUE2~2@e8x&(w<>AY2^1fMXBlLVX+Z;rDi+RwM0gd&4N}2`rKfjmg5fHqB zrAe9mP#3^lX&imjTsxoQ4-bBS=!Ucct>by^u^Qnl6cg;CFiSW#!l3ua!ET5SA5D(! z_y)Omlc-z?O5BpSs+Di8oSYkb2SgKguSM=8myzmvP?)sEAPvQ)J@?bjS}}c~=-0{$ z&Y0vjBMyzopl%lvF%tA9*F+`?oiz~a<0Cg@6DUy@22OW_Rq;fcvUNZl=+0Py(=^yX z5idB2g2Mst20aEDzedAHeZ;f}x2R7Jgi)t>bizotK5`7h^G2EZ!EL@und1aY=xZj| zy%k=Ny{}8rp4Vh)ADNPd-|LX-;49Q1uUbWBn%K)>`i3pD1x`x<35?k0c)YA}-rG=L z*YRXYfsLr1M?VAUYE~8tNQ=L;UEy?|Yf4z)Gt*%{+f*D>VcDAoKMw)9g)&h3GJsHh zc_-Z}$-x)n1$_6zFi!g-%_P)m;7Rzt^3AwuaW+GN;K2~oMg95E-Lw&`Q1zZ> zKsG%hRVEN}HqEEVryD=uhichMc)%hGP7bCEk1LIVYqqvhWkz@?r|X?((&{_Tkg-v{ zDjkg#p+8SYAh&c`Nj0htNJZOeYGnipyzO{CsqS)!Z*=6!&jyg(=0r+`Jy3;x`=V~m>T))!V4^x@%n&(s!S<>K(>v}{ZaaQ9elql%kik~o8N03P+?uPKNTWe(6P^ghz)~(z)Y$E~1#Hr-we`)Hf6!}*}gh5a6Cd#sY z8?R|_1(K1RKsz^?NPR7lsiV(V^^rRP6+rMp-yq2V_b=g~srh)L;ToiD}1V1NLhRYMlG_7_;C8|97j6Bu$AZo15Jekkb}319DHF~kr&U-`0>)vLz=8#F61 zZwyDg96!&YkgkZh*VKyeWRFjVrtFQG4wmF-F@}bTLtou<*$Y>=T2;YXU3n0;Jy{s6 zBO%YKB=FXe?mm@NjgmeF9bLT{1Z}-Vpd6?p93&2|YgOrU{^M7MfG04bhX_ehoaCy^ zcZA&~yT{`iwtY2FTnJnEw)?nQtUlU_Og)_D6N~!t5xX=>Ji5~gWCHdFQ;(G0eDlxM zQCcYzo6yUnIT;t?QH8W6T6^pxM`q@|d5^RlR<*(>^m$k0DV9r^V6(UOyh4ijbh2Be zlVz6z$L0sTQDnoC+*hD?lCjo^70E>XIDO@8JPPX2hdalQv8Jy;%+GuxxGJaOD9@KH;N3q zdj+=m7VC*VAq9uK&}C&!Oh+Vl_n}-~_C4!C{y%1B*OeK_1pH{0H9MOceym%%u4SgL zpt$;F5RVX@kb8|Ip1Xq;)@;LT!Lci5Q+zys2&ZDNd=tvtJSOxSFxdxg_Gp?%romAu zwRJ=ZkesyA3tO-rlJ0QHviU65*XUOTZ&2g;%c}9zi$e67 zfy+@1>91t($h>_`b*|!N!V8_JWQ1lFyXu72_k=_cW7Z~B)Dc5+Hq+T=3q>I{YwPo` zleL`f<2X^Zrp6Q7GoXLT#p~*4YGK+sGA&}aS4=8p+7u|vuy%hC#JWQf53=wx;^Rg{ zal3#yua1$5$jzM!>xUYSuV@>T@QOx8+7%QFpZzM9BIw^4zj7ZX>CpbjyVIbxLQK^- zX<)v6*}iDl)bIQ4*Y#_hwW#{ETIBXEj&yofMF~Z}u8>l4bLfm+xdRK^biAviR9MGl zjFlu9ae29AeNqIhQs>-FyEJ=W)JlHI zi0S{bNMxd8|6kCWCe4ZIi`L(sIQjkGyHjrfe<}z^2uIe_HDs;Bp9IGRwaM}t9kD_( z@#KV6#(;o;&pPTfgs~WvqsI-gY@v5j8SSjj2#L^=8=Zxqo|2y*HLvfdk+YJVE3t6m za55R*?2?AY2$XN4C4wxDuhyRng1|);@?S2EEKg9pirK`=;|q4pf6^eU?}xPS3{P;I zw+l71BvN3wn$yP=X$9f*^2h|%v~179pB>9;jkN6JJ%_?KgYH)?n+j0LRMI(r zlIesa=3Tl}B3>z#Zb*6oFZ{iyg@IRgIip~opVyJG(^gTv`QKVg7^tL5FdC8cHiF$R z_wqB|X!n1(m)_sb{}TrNaxZm+-oG!#*jiR|?>>BFez?Bw0dk5o^BqcrezPDx|Al|a zPxZe~Nn^vhm!x-_P~-tHou+hh6f@G@`t}0y<H>R86}DCoRP z8ZbPi4@YB>nxjGXFN7?;oaJB{wq`SjA9Qh+aQwOY`^l0OM1u`{QW!=DH~cP~{4Mvx=01H5p3WLp zspgqZU=i3$3QjIg z8v!DKTkRLkpEU18JI+(!w1&$92b;P@-Q32LXE@zQMt)-Vw&CvhVc6#C&3+MwnW3T} zeqkcakbqY@QJT2{-|w#A!lpj=w=Q~vgYUuYy0R(~wf$KOJxn4KTm{V-2VS;?3$ZZ* zCzHH~$r$L;`L9lK$Ff;E-ZwDh)gHvG9)_U&?r-gQ; z;#S(HjdBP8BVKDd>Qt&i zASriO;c*wZcpx$p-Hlq~m@G+r;=OBtpXoAe-S5EGrHn@0SPU(q`jfzjm*0ML)E82t z;3DnZF(2Ui1UEFg1#Ox*-OQx;e%zWJT1KDjR8(H7y?Onq*~jUL!eB0IiTEF)-a^ZRPmC z^3yu+f>$CP7~0b==|r?-kC;PNgYOkqOQK~awF2r`x|wwkDI%)jw=5WzqOw1SbnAQh z#KBf%1bRY$A)3U!tw4F1i~1kl3b3l;9iY3GF>Om6)7IDTT26-fe9JLHyt)b?IpBOju?ggSEIpcp)7bn#G=rNgP=e_GQiU zF)4%$*QB66E#8DFXK}q_kfou`mIv)PEoyzw^Z=dAWQQV5E}t1%Wo z6SbAv@v!#cHMwZHafjf(1(6|-k+9VE8oPVZdvHY`HP(|r#@Q%Yiitx7?@<-zz|95z zPCzgwFp73cg|!Mx;SmgWvQ-rn;Z?o+B(f@ZL3;J_R}>8edJMQ|BuB(4AipPDvWSbx zg|x8oh3F_CZ^^cF0k5uOUNSm%)HZ&>)V*RY3g3_G_{x3}RLXZ*X|1fUtXw`Tiqffb zIRj8UrhTV^C{m{S!@`j!_F&z>_8Nfk*K*;9t7u+iRddk5bS+`|@{Y7+YY-;Ic`I4v zN!hn5f@#_v6R}buRR5}=e9Qf2AbncqaMNnaG)Pf?acUHLFMqze@;KU(&0W$+)wJR@ zbS_t+$i&H88aQPkSg0D-hli|H6+lJgtfXL8o=J|GBGasFIG3Eb{ytkvY7NpW(>CPV zl#Ktg8DwG%V7^#}_Z0hg3&u&OSgIEvXF!0l=@jl_L*1T(3Y!$Iu~+sO_TsJM43IS% zzfP+h1(rKZWE z9OvkKe`_cVl)#>W_eeS&Uq^dkQ5$b`x|dCnW@Y-2N_X3u>;hbw*5>BWFLEp&i#(GL zS!Xeb6^)<#8h}Ue?8k`Lv(7JOq3iEI#u3+?luQd7!?jQ1xQw)kuEGnP`0xj5F(g z#L?aF8GU7JA3 z?^76OaESRx<{B({)VUtP0H2!U`W3VADxvWW0o~AG_i|Zs;p7tQjt^WHlCR>XG?TG4;GNrKm%|iJeTs@A6l1SlbB%F?p{hzEx#y3 zpNwuaM_4E*PU{|VC`U2|A9hkJM(B4nU)tmvx9Inv76oZzr(YtJM$)^61G_S+XSTNB zeiZYtrZCI} z8JmHc3wed(ZzFP8`|V!cmKA1&K={()_UBgI120!Prfy+S9nzPz-*9Is;a7ga_kt?3 zSyZVxXC{X3P^PtNNs||vSLw%SSgUDKw5}@ak!W>G$jHl!5RTUqM^y>zn%x0Sd12$l~oSIxMm9>iOwOd$5Zu4wF105he; zKn;`)LvIw@cT3JExDFOiq@Kj_8sufpMa0m4ZtHK*5dgVQIf>EeC2spzHMd9t(&wt| z?0m`=u6AIzcGdQ??yw*mwV|$LO3TpP`y%bvA|RSu$jd_&swFI0VgtFWn(YcTkpW9< zHd(fqRTjlZN_|;}U#!Q_L>6NsHXTWR?AYJuZjH7j{wdgzX4|o~VWA{1m{_1d=<02d zKxPv?&{*h3vMH=y%TA&r`C^Y2uM9>#AD6F6?DoPRbYTs*R+Wr4r@H%7wiM`dPkrRs zp(zzRa(xN$BDst)&kvUz-C_K|OoXy0{q6is&WZ~%%KQp2ARULJy`6s2a8YBj;Td1M z2CT43!7pcgnrr4I#!J4ayz9BAzOBoe^2!U#@ztA_VGL^?%HO^TvPDSGnob|z$E4HC zrRMTN38h?FUj8Av=6iR}Av)3@3zm!?DvWd;29iOMUiWXOJ$p&LATSmKt_G|jlav872uM{C9B*B@bi z{(!6Jwy@}EE^Agtxy6GDP_OqZAX50BzOk`{2EB*9$1jWj*~jQ~%1L;E& z^q!4;Jpvdj^k?x|>mHqrJmH$)^J(#A0)yr71_eT;}R-LO0bIv-Ged>Yz#9v+==ctkRJ3nO+O8#?y_%@Bys z2hHjmgBhSm#avb>chb=Cdm#26&ul+4OSuMkeLk-Wl~(yqN7W27TK62?LTLv3Oo*-@ zFnN3MU_T#Xj$r0aY)YhnZKQw7I1gFidw$&Km#v2@?!R_QdUCwo^l|{2b+5?h8-sQs z`&dWVMpd)ZK9gQJ8cq^c2U>crr7+9I(9$gjuY51OG@r70n*3HuV5wQmu;M{qescle zwfkkQn`cB(MZs;)IFiF^iH_X`f14Cj(;XcGDzt1QT?dR>v9ywh1u%xGds|WLN`c z4d{|AlJ@6?J87sj(=(;w3Pek;oZOL6*HOX!iUI*^oeNSzSCT?U#!;07;gc6GQuRYS zpel!;DT=6MXfo-9c{XFbOw+U9`1Da#a$V6 z+eg1DX!=5=$iAW_b_p{i=nC(Lu3-xgs!5d+P(?N2R?=!Y;IrxthcWQMqbI)qAvrq8 zXe6P_*~S9?p*_`-dy66suv(LhEB<&c`}I*P1G@@BtTn{7La4^t{tYVu^OuW55;~=~^^6 zg*0~!<~%4*K;VdIr0a=zCGFp4=x2*EfqyHlync>-w{zWFb09x!kZ+p}4&=iE?j{G5 zKZMi&=zcl=>S1&^2_~UEwhpt;;y2vb?SSsHD7gtr-#xOn6MM8{KDkc?dy@G?9 z0Ky>=On=6h?0$=PKf3*Ce?^&fzGpKjc9SxKfb>JBUR8TuOl+XMyNSgrw4~k8V5CO_ zxLM3zK+Q2(dO}p7Dl<`*;zo*W9gyPZb|V=iN;IhvxdA4TEE(wt9>6qvFeMQ$ai6@= zu5wO3xI(k$fC?zHN@}Y#|G6@WBjR>N0pM5@Mqv2Qrv0Dl+{H zZgR8_kl~uVWSno*>oFWu>9cH*93;7o5NxI0G^vE-I?45tf4I2AG;=-Jk@}u$^F6s+ ziQ(>8hX!^>VDx^iQ3w6MhDVfYa}sFyoPVwauz$-7P$KQX&%i0&Gq>;Zcq$;f?L-jM zYlXsP(*zU>1@*zcu2B7n{7H+ulCyzZkzNJ{b;YIZx_1{sQTcQR+D9FEREbiEjk}G5 z9n~u~k<^yB&&G5*T^aGGO>#+{=_C;8_P6<|0rWQkDhNyO2aER>(L4v$)_e65QqQEbW!|o(U+Kx+`lsvfUg* zr-bi#sZ{2qoZPle4W+0#2R@=3^0=C7=TjV0Ox)~_JQln|!o~@r5)gie&j&9a)5ini4&8OQfJ-KQMvv4SPQGwi?hw(P)E z2GU9%vW;jMiiffTF1odh{}c%7Ig}zF;$r|SAsLP4`)DaLY`yZu$>Z^)Oq}A(J(W&E z0Nbyh2dHKXXW%5{XmyD?X0}I}g(XFA!GJ!9k5Tt(l#N)Q4(Mt-{FF3O1o!J3q)>Qi z^}e@jqU!6kAMVIHJg#GhKOUf*C#O;}v1dOI*my)Hc&izwO&N;J|5=sUT(NhpKoBlJ z`j<>f_Aps#T&pp=S6k=*!C}X#7J}t}PJsU?qJ80qJc@ptcbm z6S|yC?_2?JbyMB>5=~3u<55%%m%FM#{gld76%}E1aMAGMbWrWCzGt52=+|jRgRu}^ z@A5or0Sh#qXepD;HPEzS=VfuJYB`&ljRd`Sn+l9(>AfsTI08dOwL@zVufFMnkWic7 zf@bes#KUX&S5t7MgJ)6vL}7=TgP|ihIO&Iq8_fcnY@kPZoBmR(>-55KoKo|(DtR}@31a1&++Fn4lqVG`Pfc||5t>8r zB~|b&*c*wG3%U!`dOjbp(w2@IeiJ>T9qQKG>Tj?Y(ye`#QmC+$@SmDZ2-TPC=0Xz* z@lh-Yd@{)amFaZTn`;k2(P3nTpyC`$j*SNwTF!Gee!}NbZ8KQAT1Vn z`+((e8Mm^aW!=1D&?kAEOi?Nq?XEJN;1<@8AVnSQiWH>9jgGingR*Mh*A5zkF0IWw zk{|nrOrJcxuV?gGppiE-JGaLCxoggwHyz=exuu7K*D2LU^b)!6hW(RiQtkOMoQ(0` z1z9ueL9H1!YF;e&d2_64{hvjLBXq!jRL*t8pWfE*!*uyVKN@k@ZMv2G>88{gSR(=` z=a|K+a@rvQr~{>62{%ZohD)%83Wy!sz;r0G8p3HlFnFcf%R7{R;#G?_F`6E2PeTQb z|8;!Uv#!rNVePiqLu$6!Dy`pm4vXjkZ{v5Xhq!HkpNkOO9?(u!EY71n6ZmcaS%j&X zM5vSd-Yy$ZC>vtD%3(?Aa02yR>ts`v8#Ec%N(PI2;U=KwdV68!v}T&<7CqrucDAd# zwpMSHXEC|jWca$)TX;un8LNGX7X}VIk^?Ym!TW*T7{95x?2s>+zD~K@-2H3jBcz}2 zgz2yY-S04=;T3Z;!?Tnw4JqsESLLi*bu+H!Jm{pvLN8>KFvY@?-f;Vk19oQ#8@O6^ zU39;rn(twx(N1PAvR5JF*|w^BnTnj@WIxCe5e?RJ8JfzUT;k4k=I!nL{q)2*2@7*T z1!Llca-y)Ys|qgy#PM{9L6GreJ9x^6=F|AmzQ~q=={37ceP!I&v$jeMso-{`8$Pl8 zdPVO~lH3I`5xJc4Xyc^sEO-`(hP|6aFcE44BVV*eiCpO;Tr&!aONcaZVWel4WR>k2$<~=7YGX#{v=7CX5e8WqDwfd`R zorpVCW1}DaC2&NQBe<4buej@!lNPj7*sN3sN!X|P8{^;hCg-se)wc9B02nW|cW2?i z^uNrv<+6EevT@d|uiOJfPl;4#tw*=XJjXa+J>qp9`|r-uy(6F|E{V5rX{OstZy&r~ zS{ZxSCiGoe9I{_In3lw zCG~?q-I{9ccdKb4l(iqP&|Bxh^Jn}V$NmyYsA@@<@29@;!z;y#WzwXvnYu%>E0f7{bIz6c1>i=yX^&X zKZ-TIj!QA zPHDI@y2?LtAWDILa%v929*vImR^OEt9@)G*$;8fM?^Ut1Sd%>fajMxb09MQ~B_#dt4CZ>H3?XR6YG|Io_b6t#7I0g8k`6Y#3~I?dC7~?1sT-aoIaMH_ zG3Y@KQ=LD}zV9oWxpMK_V(;+YD(VNL+85p+7`|8+f3r1M81=lb=KX-;IFW=)t-VCg zC51fEdSXm7q(0cXcCekH|A_(P3;YRa!5fE$wEWMKA?wHyf~Dr{il|ICSzGbdXqfzkmhjV-0mQ3!M?{r&N=J;% z`};oR=P%0B|0v2_x8MqX<=4J|rYj#wT-^XrGsj-OZkbiYK$%I|lcYyZgJr z?dPIpfwm_dF_bv;Pl?UN8Q^4oAg7;Z@AyK?M$fc>Z@VuWBpgo1#^3R?xbVHKpEyc;`2zw1tMaOp>VEC zJF?tAo>gMTQ6Vvcxg6qQs>^SKBixk|s>%01u?C76Ry63vN+Wi!WO%31y7SqzFd%KU zDPL|FF}?>vE>spv1fv)2>6iBy#56QtF#mD%gr>5AdIXnoJuoFog+LrlB}+52nX8`t z&AX=3hu}F^VlMdM$Ua1Q*xkqo@VT|0aYwJ769|r3;&wI76kgMUM>`2VdAtw*+Mx@D zhSqgg*-m(Y7nw;GOmxGUr3r9d#I_l%Hf%Q{QD$X3+}B3UaZeMQ{Yu$k z>TR$Od`w~~dv==8oM7T? zVgkfEnmloDtQ~p`M%MDA_gat*LsczZBiL`CSBtuZ7i9mx~VGnWQ z++_$lFiJl$glFR)nO)iRS^5>Nx`k3O(Ry!4&wR37r^3e+20CeSk35G*q^&VEu@2ms zw;e^e`}FU%W1ipm4Bt7HQ$XU@24vtN<^L2-7|~dPA@Vo(WpP1#hj2Q;sq6I78x_hG zxi6PiC^uJER!oVin4qz0evn0sHQGYTuDv>oRe_kl75EU$R0DPw0M0m$zY7qoy;uYe zKy}Lv<_ilx7PDQ4>gGjSr}Hm}c6Yf(c$y_D~%ibJ}bD3H79N?k$c-Xm1L1uN$`V1jgi5^>DnG_kf zVqsrOLL}?$pF?e2XsMsq+@sokZJz_)1)gwppaLtI4glz^-1WFgJSO3=1o*9S<|^gT z;P82a)zAViF1*~nQ6!>}eS;wMqM(CD;VKtrq$($%zMm30E}Pn5?EOnOc?Du~+ei(9 zb~xCdmb%PKQC`DqDb;SzOv@vPS0b|Sft_pt{ z-^bBo=1m3oy9U|pP9BG-VD;AUP4^Mc4tD%WI?en@&;c|YwV4OW;jxAff%n>jZHe2L z%1^-Ti>_ZpoX}qU)5CJY(Ww%h<@%Ua!5Am?Q2?x`8>_H0MpZ`<^xNz6jHZV=b{G7} zB>w80J`;)h3lzea_c6}2=VBk5GvXF86fB1QTbFuikEFcA)UD+{Vz;Hbl~MVLXoz3D zX;P5g%yeGFUze*joh?|}LRYy9$j=-`;)!MAz9SRg?8PxI?rMUaw<7s60kRvh(h$gx zyW(u#V)hzpE@IkD`8`PqzFGy4{wHk=36!w9w#;EsO$SQE32;sVbZ2+h9fbGd89aE( zL`|4OjEEs=*Y33)a+0_p61C*p}YzO&T74dG}9w$Q8_k)OVU&@mT9P#nUC8$QCihGi$UOugMR6zV9|W+5-!oiBk5 zw!ibMv9{^!Lh42fA(WMzhdeJ}AXnS0y)Yjg z(TrBaqZ0T@vn5JJyZE?^G_gE43XyjfG-)Zs!4#CnztJTP;fG8*zD1}!i3)*b9>T?F zI#Sy2&I`t;lZlo9)0a;$FqhjR$yvj;9}lyLSSdDD?zBt8->UY+DQRk`$^cHS@t5tx zLj+?2=wF$#|4o5$doHW+Q_9ZSSf^1g6+CHfm3j{&O^+S9clXyn&SLi=D{Ci4N%WPU z*(n~b?lbilfPGdsvP!*VhE=Ty8`X87af9qManGGKQ|4Y3%25MQRMXKVRjT>p%0xt3 zTwhVSIiQ~IP*9@Rk?_$^4*IXuSR@GgK7g5CM815q>`oWLONSmXd-Cj9<)nE8Ka^Tp zH=xzeQsF8UNy*e@da3roD^r#uN)bQ`F^konewk}-Ip%&f_>wNk1J^bBf=FQ)8`$v@ zCfTXh9o;po>knhFe69|7{@Xx^!}+YRjNIf}lTs@09?s9S){Uv3*)!Q!p5FO?h2hQKndRSEJ3M zLRcV8KWHw^vhUelx(*Jb$;GG@V7TutDTg!V_|0(!Orm(?eIPjgslQkKRorG0(MkG< z`Cvsd8bRN%{yx?;7|l+g2wWVxN_Py+sIrvVEJv`MJm4)uIoS((jY*RKAP2usbYV6w zq>TK^exKfKmzX^ueM!3((V^)2z*m|^UI?u(O>gg65|iwThzKr%UHMYt5t*X+z*RZL z>^L#$((1ImVGmFrKUnJHptA&kLh@o56sCuG{aWCEJssH8Sc+nErUcRLaKof1xjv|L zAwAsBxemD`SK8=(duxtITFLX}W1M!U7RGmvsRKaYPcF}qeboVCYm$VFm=CGJl?-68 zPHkL!k$VzFukBy?Ahx9NBn>i?Z;M{dg*C?!ZOe-;Y3=1%EdV_Uhn|B6_30#ga293zNiJ%CO3E zMPIf|}y4O{yznk|I5F<6MR%p&qBjq`BU3KIQd zp0+6KuZBlZ$izUeXmd={D1q}pEjp@B!dA?2-&457R0B%}S8IgN06p)gby_ox%)%t0 zRgX0s9CGOqCv%Z*^48i)g!xxS81E~}gBHq&$W>fAEIxjKZ$S^Bx0$A9v*(9nj|!))A^+IU5ji_<02Sd*-(&h91JN{jrd zTGDGuOu^f5q!q)+_h+2iqw0{*1gNteJr$_vMe<|wkr-&5p}W+a~>+IiC>OS z*|9Hi0_rK5&jC9ocuSLQDuwh`P>$BUxX4GqQ_K^))*Ufwb**LmqrG^?=%pAEA@V{nJnU3SM_Zpc*Met%GpzKez>X1A%XMzf zhUVC(p4)US5>WfI#O>xnd>iw&{Tu$qN*E~J#;>{h%*D-SWskbVc?-1S1SylIvI+@> zMwZ`_(%Vcrn4;9)vs|1!jOQT@3LPvxdwK(L=YGo%v)C$r1toE8_8}apgKX(7MYF~X z&Z@{I*Bxe&v};D#yo(KB#9S`>kizhk%cXkJ&DQ8a&I@*i8)PL#lL_)k4ojD{C<~QQ zQI1;@t3WCa&CN+;#0C~*x?Gt)pLqay4V?I6eo58_MX&p&xn5p@F79x&zWre;8r`k;l#e*}LNSeOg?TGl&l4LES zmVA};-nilrEY(eAv6>&|ZG68qdY#?PoRF3SK*U*#=HRpqifoW9`|?PCP&bap3MLw+ z(lyz~@_3mVN*!g8HBVon|Fg&@7DIStqu#NcD)O#t)jhl<$7h77#=2zl>Vm%bDP$}=Z0eR8O4^ISOn1hr}#v;f;~W1#fp#ng|ekt!-RPq zsVS;qydj|?_UB*j0R!%xoZ+R9$^5ll6x_!E)8=^egbzCJu;{3` z<*#!sxoMn&zeC-2qxC>y+uWRIEzogWb`ZnBClT{*AA4uQ>Va45qz+9g9rGC=B>IA2zSnMB!!Ndrh0ib+*YX8E$Vj^5j;P z%N3jpkq2B)tR0_^i5~!=Z8M$!7LoiPMk=xlnr#5Ak2$eN1pZdw7q+Je?9SPsJoL6uqn7P6QI9d<1Sxa-NB=gFCCR>ewzPyjsK$(_{-r1`_pq`!u9zk zJo3ZSpA#N)FXQ|MCqL+iGXYvSd>01wlb}bY6C(b#3zBz)@!dVD+QQ_C9TE*c{BpOa z@}^eFri&$X&tZ#2b&c;bz^{Mten?3j95K^*dv8|v<0)qr_@9Z0u-J@mg>Aj7rRUI| zJZcguXiIJD2CBEW!1?P6ZU+)YPLEFNqqNSq2Du?R?2b*QBI1^b}r+e zhhfeB^wgK?**D4@mCc;Yxku>rLg^T*y+|44V}FG`ZY=HY0mcEhboAOsF219Yj-#4L2r z1G98}sOb0zVT>Vdwi&S}78zEAV{s(mHC=`jwVV~t-sR!B8ig}j#^ z;|$s#e|97(ZeDioxvXt6cvFIAl3c3JO3^}{`(H;wiYgnu7qdsVnmn0CHehh z_7(RS??EjE{1Lm{4SLtwpo>>+m5@9SFG-RsK#W-Nhw-_bVgDMz3lH;QG^i*Mtc8`r zK&ql0LN#0e^&>bj85b8+$WXWlYL~83ycl?L~&GtlWW-N zi-Cg@l!J370k$9L#|C%SG1rCAZpK9iq?Yz$_BkQxihRgk^;23Rod_bS+!D)}!pdz^ zuTdk*ePYN+s}eEE2d!q;awvU8tiu6sqxwh4jTYJ_cJ_CzyPzA2bM*zVEP#fkkj2A> zFx*z1x0gLEEsNh7%BI2w_~JPeh>N^{I#@`?z*6D!!g$$)8euz`syncUgU9rVcQO=O z6zb@s^-(u?4$$RDnQfMx!64=(I+UA@^52~wc3D^jv>ALR)(Csp&qh?)nor>kTmX$H z!*UtJfM;^g#{Xm6Lw+Jh8ZXcLhBG23O-ml>Ox-O3*Ctcx^u?6Z_*;F@QqH>EPwao6 z_ZzqC$tCy9#;ULj>TtMBB_<3$BB9+(OnMHu5?IJSR);QQQCE|;syTHgk7PlXGD^C! z9U>_9lwfa>r^7n&E6qRY%yQq$ds##n|M z-`5`Wwe(USWRShj(^fu=$&%r4poychv(H7xp`OcLi!=Fd_W`pK@3*drFPRzi18ger z#>iGhLi!L6%oe^j)kf)7l(%uaAjn(%`IzHFHp3*2*3&}P&A#)qlod@Mtc@)7T&}l=* znp~hRa7qlWFL9^ItjK!Ia353{oDX|WGPAzM#tCf>*bN?L8}2tJ>tJO4<*w9cezKkK zX1eU(mNs?HpG(u34kyjzkjF%eozQCC581exmu7}( z2s9R1JM2so0&0A}8`egy0MMO+NV%)(LEOFi$C5)Vr20q{lGoJKH5B`ikPQ){g*?n7 z8ST#z_8Gk^<4CTve&ou@={!oXFYk4{k!F`1#@Zb!8%49OE#oa>RUc&vEjhvsaQ9!| zKU4(vD>&sN*!f#*7z@kXx6)k$n%(i)Y|pr1NV9Oq$TWcbA|sOrb~#Gz+{aX1 zDS}n92UfOuDT$l@2)=kI*fznMQ3iZ6TqCu4r^|+c%U#-_8I$iW0UWKod`HwTt?WysLIU^ojZhgvqc&g{PM&dIQhhBzsu(~-fx zWYlS}03LOy4U?)YlVqaTD+Uvr!}&Y_1mD!JZz>h`idRgO(05d6y@SDk?{UI4`DMy5 z5p?O7%3`f4fzTqA7Gg%@%-k<)>1U2o!?>_e;^b*yz7qFyHS!+C-7N{J8p{nTg8upi znACaU?8>W%84v_w$;{&8{$`7+S83l7+36JsfIgaxWf@7gqg)Xd7a&&7D+<)IapJPj z%Btzkl_j7f0M-~JU__0(sR8=zxQ}>%nG>jj7J@FwL`+73fs1kuI+XfBR2e@V5VR*d zFc`;RwF+Y{Lk#cY)7C6W>abpO7&h~Q?o*9i_K`I&$5z>fOLF~@TiU~zvI@+hMI&Y< zN99XmtIh<>)No=(0A$e`-{V`o7A83z?jAbWiwP8ZoMyfEgFR*__T$dl2_ewRsBDsl zkE00z^;%SDa!ZOZQ~|IpJ~5zDux3N%IG*{+xL+8~RNsaSnOqn&TT0UCtY#)rpf^hv zGRy+O(iEB>9n@1>JQiIJtxhIkZU#%sY9`T{D7nK^Oj@BAR0jag%OYz{La`l#F}x2t zW11eQmH;<_{<{uvu=0URuPJmm5r+>M<~fmrnh)KIYJ^o6KsPoc$PwoJ1DUx-&(BUO znyg#DJ=sb?j4?q<->MItS_xJb@V|(2i z?h#x~mJ|{ytKpE|PKZz`CcSx)82)DR*!Zz(hD#pbY?Lr7G|U3>GH8zOxy1km2ulel zi+3s4M^a8LjVJ-8v>r@s!KrS?#6F-GDKVTbl&UEY*-r#N07JT1W+WdeLek*9)qy$4 zvdJ(7-BY7YJ1g%=^y#58N-=4+O!A-s>-{0tC8QmWFj66`2O5^ol)sdTiAxueawS2m)5ParaX z68!(({w=emm3!}x6`BlhxbPhFSo=`NZJH-1!RJPbEi*R=Txz4L5dA?~CJvCauj4CL zZLb#T0J@sTd=h+C>UfAp*&;yiDcJBJ3<+X?K&z!Zsk6)#cuum`8tt4mbl%)E^kGxW zNclDcti~#-N{s&_*YV&06#{H3W>TmXLXIpv{_nzxuv$o@W{k0i@s;WbJtb}fkvm+F zD8=iVr)3|w=b*ED(v+?9T7Blu!L{)Jx1uABM~FTv-5UaHvdR)rzw`iOF8_3pwYQ22 z8Aiiq3UAslk1&Z09IZFDpWB+hLVz63At;b2T4%WnzPinuijEL3g! z%Fg!kBUIeQ==1;#7SI}HJ9&pYd%8>c(}XD|A|)2*C5zpvlg`~uvz*@ey&l5poUCH_ z=IZS-|7G+q<2c1_T;6v$%9Pl$986%0A+0+lspjP>nQcVla@*@-n)hB)jF>=P z3%4UqE#m2kDq+oTpV*yMeXYD+xrgJFa;^ zEE+c61TJXCHw1TkA85$~_~60&O+c*mI=3#>rs0EMTe8Ff+l&D&yo)^$ph}++>B#Sg zdSzjUsUMsqpxlpMkiw*DmzO0e5?2W2~_bVN4E69x>@F!~H$ zX-HZfAbKIvO%(D@q1vf!g%Dlp&aS^90o>cf+%WCQLenJ$R&}3y%A{o{=q20A-kGU< zZjI!SYzc1QKxRcL*E<~YO~DlCrO%R%dc(3ejRz!59s z!8gft%}?oE@=^=L+S~0#mGu$g-W1@g&M=}#{-iJrzTiXkt-}x+1WLYS?nfU%q1X`x za`iAV7CV^Ch?OJnxQkRFA$WF$NhSM4$x1$zvx%?CyUO&bTYvo$!TNvf9_uHWorV<~ zdg<47fnVAaYMv};m+@=(KAR&s&>dclZ$qG5GB@Z+)7j3JXADlRVL%%@zEE#}HXE83 zvcla!mM6?$C044tbZ%U5L$`WZ?gk-e0<_{;!B#{cQ^8{Xbwkd5Lxm7n|BHXX^gl%` z80Z-o|1)B-tuYyM#RR|oi2Ux)LX&zJx^w}8h*u9}5~}v(gvhcrY&>{-D4J}@d7kdX zC_w0xoQX3^lUgamow$Dq5D5LNS7%W-0(Ba?nM!wO*!Huw)$57g^R17?2T98fO*?59 zAfML+L44@R4nYK4(8z`CwmxaojVWT$O{9vx;GYKx4K~d zJJEx?!h$Mecdx1Zn1mvsPp`RywS%)@PtbT>^n!chZnt6j3&tuTRWml~TSY@|6k1>> z1-R1}y7P52k`;H+Cjl>u36u~{G!$72BoQe=+(@ixE|iHnk3^a{B*>SP^*u@9twW)_ ztEXzR!OQpqGBJ5^aTRDgm*n7s(0?YoR`(QYdvgJ-%9tGp#KP}#ZNSB^bK|27eI#tdmYIb=&6GCh#n3rcYIYgIziKZ-7_o&gPCYbbFuP55;IWJ3MKkG_llpg+8CCU< z62BZ^&7~{*u}vGTCLmWZIu!mgpwpgbC4*_b-d-2NH!@e=z!scN?=bc!!%yo(06-`j zw@2gQ5uR+~UhNH+CC3^lfd)5@=}1b4kT4IZ3`9ko`aLymD_K!AhBYuoojBP|GX4n& zE1dR{9__653A!3Jg&>nd1tv(*dTVxEncUpiTjTegh7Oq=M?Fm@vQwCEte^*&0%!Jc zNyuqJw?Cnn{paCiHm3W}ZM>s28P+k5yP)8;ZV30A*&Dv|GVCMvj3F^ znYj$+WQNb%@;CW0v7BrEGQM+3)?ljNDiH9YWEkZAZ{A>4Q>&q_u6mre>M@U6+isRr zG1|Dg_&Z<}U(4Ma;eu>z0nUQhJA!_uDt>HHS1VO5govFRvF8CvPb3xDuMC_ zJ+4E{MmYUn+--Cof6pqCW`}TwaR%zd)r-($e&5Z6TCC84vf%lo@qtP&_V7%2Sx#U`zV8FQ}(whmkv8$K$}T4}{gu z=|JU~v^*J?y@LE~74J7pGn|+xuc|8+*Tr5R(l?vzT*=G|>y2YPvS{m;6?9xI-8jk3 z71Eu-I?35x!_q9J#k!bWbfXux&{MIKq>tY2JuTV?Fpy?f)R^?wC*Mm{8`>hh9SHaK&N50L9%wy z>Dt^(58~IyF9VleO0JIN9^hDcRmI3%+%2CGtmuEMDVyUj2y{a6;FmvBc4B#4Sikf> zy?Ga!b!L_El9u|-7?pSaoPGLo&W>IF63}Hng<2~<&6#O$`Xp31o%TRbaSm3opJUl} z^g3y~fy9Xg5r@ftlaqbfbtq*JrGmA|b4JdPvD<;l-)tEIv9d{Iw0>x&Th?A0{j}gf zQGK&AtXB7C!q#eZy_sMVZOdeON$$(P+4NM;`-?dGgO`g3wWVw;ZR{h-6`KsaVWyvJ zJ+&Okiv}plSw~!BOoi4m=<394V29Jf*-xtaZKLW!Mc^)X3mdfbGajSR_~CbwNVB`# zWiM*QJMYoTnQ3I68TyZliwfR>-Fnm>5aR^ zY`Mq%I#%(*A|&|QdmqC|%gFLpPKtfIbwi3kh_MgNlPom0z$iuD2MN~Ov#vdnx%jXz zr7eRhAN`zQlS_E}6EM1T8A|!P-q|~!_H^;yj#aGg%_eZ|Rmz}@eEKmy#_ZkPmv2V& zsHU&v%lbr{h+GQ1HXY96&wf!+-5syQO%G8?(t9<2$$!bP0A9W2NY25jxQjNmk<2FV zZ8;-t85Dg2G-n;)ICqvKl`}@@P2M{@dGVs4B z66XI2kIYEN@c+$TZDUTx9JO8N)ZW205lS==14eTIkI}?!k~l&+lwCA9j^nVTe)$mb z7)i8LR(gPn)uFjvwGcRB+Rh_&qTav#ne zIG*Ov1gK7B?dv~|o|L5tltBJF6G(X!FWJNMw~8{L){ZF(nm0KW_hFp|xDLR+ZG#G*5RWw4XXWsj$7=Dni*XQJ(Hb(#3l)6EtIyjcheH4}!qr)m($1VWr z&--S1(9zE(UB})8Kbesf%APR3jtkPg=AImcB+tz2kiu>KW~a?3vBL@ zQ>}_T%M$34PUh&Q{t+4S_x zcvffRRz|;&JCA!&L>L;`$JGL<+!`ClHJD7TGekLwR|uF|C^4O?3UMzBv8j#t%rU$T zVnJ6uQ@0{X`IqNN4WA+u@F3%=QTq)l-V?rlCt_0u={+jlgL|p zG&eayRBABWJ3u0g?if}skd4~~s2)EfvIgtx8tM|?ELDQaestatgF7C#CISUNa#J9U zU_&8tbHC5507tZ-b8anY1jfY*Tn zSM9&<0Fl#261B{(nLiq}pgEYvcWt=;RhcF}mb0U*6{6#+sW8cLK!xdt`b8;LbM(7I z8pZxHtZ4^SY&x(xbq9iaL^FT~3PgpGnzez3ULeXyHt#T@Ch-5)MSXseSD+I6fzT#u zBhjjIU!{-g8>S{XNvyxf=ZcAsoHVmbNCtH3ix?)%_XDQ zI{TfC=`t_2l=z#C;E7h~Y%p{qOt{hrlLnPfT#&&bd8M9_G+j* zLNoOEmULooCb<6O2`x$z&`Ac%0|qRrsy9h**9k&&*=-V9jZssJPGP%E5|J-xnczYs z@#wLIe6eFA51}ow&spvfqCbI+PrPTnqAh$1PM11AMu$1Lf_adZ$U}HW#3^!^46j&T zk&bdYPb2T@!oowCh7ru-PuY&tMK3|ji#)iVHwLjm9we#h;vtb8A0{yz6x~1kBfNR8&3aN6Ko{?PoTNA1wOz1KjrE zabtI>x|NYiqwo7duvJRfL4P{l`Sl?99aaS3hG6Pg~ojrDimGN01U2nJR@c zU9;=56YHC(MIaKB$c1|e;HXG7u^M8SMoZ}hK-3~sQ&LC!7;bX#u(G@#W`@M8V33^wd0_+X}p#<5NlF)MI|B4*QDVot& zlhc0#NcUs))gjv^(PVVZS_e%)#)*LG`%0AFh%iYz+zniUdz+X+EgK$uc9H;!MDX}r$iSay#vrx4FItxZhYwb%k>YRg5)79lckzkL;D%3#Ci zrmT3#Ro~GTp*jY@H?873pc+G3f>eA<#2Nghb7Xz7YJfe}=)w1~wghx`EO_zvI)k-h zIXxHpdcIQ19|&yW^fFuz=3p02+4zDqXJ-W3wG!{Lb`PSN^!TkYp=G!chP&Ax+J}dn z*dRn6U^!H9GQ&N}pNRRpPeYptywsZ^$*?t8&E-2~7Nnj%XT{czejl^rRandr`}o9=~{*sMFInvrhZBQWG^i@`}wYgjWiUlZWa zD`m3jd4`nWjbiEG0Al^YAWsgmi2CquV27fk>a*64?r8$M!iD799=LVEW6zIS!OgB^ zefj=I>(Sov!>D6}K%4qZ(Pp}(wLMc_l{fj|Oys;3v@TkG(j`W#_|i5^^A`sDnw(ZtCigJs;Y*`zHk ziY$~-McU)4jZ{nBv8`!u#y0A$ z1*4>%nD_e;R`Y&-6V-S4J%;-Q>5~?%{x7Ei%l~v5Ft9N*{ij(utT`ET*@p115B3Cf zQup>3a4-@e9k3y@$dw<(MRS6rF>U?mRj?sKR=!0eJ92Me)jFMG`BAApBF86J@8Abl zN=0ggjivMak=1t}_4i}-FNG!G}$qZbx#%6 zE9O?K560>1>epw1`9}AqWH7hVx7;qgr=c}6jsRZ67Bwt#5c&K!At!0F=)l_!tk>bb zb~a*#J7Lzz0wbpf3YB+p)qp?1KkO*o4iCjBZ!=CzExXoB#H7s){_uSJ;M=f-AlTRE z%UNN8es97OWqAaZ2-Q}82y2Vm@m1E#m#^!d7Pk{c;T|YNdIGJ) zR6O@z4b1!Fxw%{akDi44Y}wUyy5Y=pxFh0}rs+%zjKePQ?4RY9R}*L0-w0dF4)|m* zxC+5ZQO7A5@r8MqlgpJIA>(kk&NV)M;X&{xrVh#~6#M8jq(Hde1flE1oTyHRX1JLcugfu7wOb3#;Twl=6fCCO9q$@*B$3^ zA6M*wJXa4smq9tN6c|X-vXrY}0aH=uXl>V7 z#i9*Us~Q*nS2SirpvD(yX6j0#edP@z^CS`Red7lEPJ|SC5!&SBMH-c8bEEIV<86p# z0_F;0K4HYa{j&7cdTFRW_dI-|gUNQfiCH9?@m);RwMywdNphn?GWtPc)s=EDkUOBO z8f*A*u?yi3clk%De#8p0`!d8?Yn7CTiTc=F>a#sP3c5i|P7tf>D)D8LWTiF?axjqN zsalC=VWz2klgXm9vCr$PCyt zK<^A^QbdATQCHhfkvczQW8wnPt?M@%K}q5x)zw#CHtN8{1ALvd=W*`&ZGI9Mj%Vd}IO8en-Yy0%Bj zUTB2G!yy0;ERrt~Er_V@dw)S%E=R0E5vDZ*w6FEA9>5?+*cfwm1zPS$_zbt>8)8L#BxS^AX3*#z?C(Z zqGx5>@nU1ax62xOt2O}E)(*r&8-&tm324;q(viKFkb%uk?C*mpnOt$~LEKKtNW0xY z${H;355p>c1P3oO$7vjB#rCm(2;}3P!NP5UNL(d_d>Sqg%F4MSGl?p~m=W+Q4%!P& zqA~NM=NLY{!;Q%3)-C+q#L2;jq=)9nYGx^OJ)6wUw|X|rFU*no!=y|qZPXXm01KLSQ#x(%J0kf2*_jLTprHuBe8Eq91M#$ z!i&_=MvkO*tBlSsZBhZDO9++epUX~+>a$ZVS%DSpQq0Ra>BTdpZ<|pbr{iqpyfu5t zUr)Rhy%sC}8DJ*9JAuV*Iu?%fzh4~-=AYJR3$rB!RWHl+0$s(|+*+<49HQ8}P_>%9 zs|nL{AKcm(C%!!nfhWIWy}f9;2bY|>J0NxSjEgd)(r=S^*H5Di)nJ4Zmb<7pM)|X{ zzaB)h{B#rnxTdojB_@s;o$3t69w!6PD}tt0Dr0Ix>3X}2SN_cLH|jrnut-?*^lB0V z5}|;+j{xk12(q0aHphZl%WdH6qG5{!?nC-B?K(vIBT*^@*?KA(<5yQQjFjIl+Zdht zC?g-D)dm95K;L&7uZczwu%ziu9xdar$9dv@#!A&MpZIM(M5Bv>>x>hZIEW9kGmY$)KaT_cWzYpgBj4`|C2Mvp*;^+@_b8 zp;jkn>b&5FXCRd2st_$||6B%rpu}Vww(hA--{2iZsC+9s_5|idy?pq4kS5b$U*ZKZ z25_0-u}6hp_b{+|G8=8|o>)wqd>=D{nZnijc;^)b-}|N^DF&U)tSSc8!aAdDLPy3l z(VS7pp!k(sET?rwSsdJjWSo6zB=6LyH|bI00z30u*(X!c4$x|TPmBbQ; zdZ*qTsT}(nfy6Z<$5hIBw(Va;L0)qDR;jKWzWp1Id%9xjE@CNIWd#$l^kreH-gvbP zl%8Itj01gXg=_y3RwJo`W+WpCvhfvhCcU$9fhrPHcJH*>~&9)`H; zB52-akXk4x_AoLqf|}a1#D91B=;hv%ke&8E7)v0}Hc>5MI$l%bMX6QWoXHX8iNCcc zlovSN^uDgL!LcrLFsWuxLTiO|pFUJn@Qio6k;Tte6`T}jZ#n+9Nii`EOZ0dg_TCJl z>I7PBm;AX%`<|&4zi{Mwfj^S@Jt-^^Pb56-XzQoMB;DTz z+?AqEkB{LuwZHMCYO}aY!O4yFAeeR%%Evx`Qc16@vCI-37_;B~m69=^0e;&KNbWNM z(H3mI(7*lhxikPV#k$C~JC>~V9Zufy{a*A1MCjra`!8afjq!h3jbvbC`TxcjhBYK> zFGv32Csfbi+!&6!{Gn(ei2yq!Jza!RU+S}@8^u`OKaZ#EauSXWcL9VQYK+wj*u1>H z#^xVB|3nu3>e;ukVFtlXp4vJcn0|aZKfb@l9*5>m{ZRl$*L!cHC8ZM(Zv}v?YxCOr z`IeTDGmYCN63gWw9zd7+kQrs=Aw8$flIH4K%#A61BX#A;A0RvP;oqNG zSn#$3>~JXVot0T34zG3aKqulIO3Xbr)oSb`6B?&rgN(G?+iZw)bLM_bPx?nqAD%3o ze7&ViCi*%(#En$p_ggYrw_<5Gu|G$dp6Cxw>hwC9r7Xhq{c=0Ye|Y~SP`WdDZ}b?0 z5a0FHY-%2G8{Ylx{I@%9Oewtf@j9CuTI(ycju$oGeTPK0-|u`dnSKwr2_Qf#l{bkD zY3fx!^bI|JJFmx6%`WEOk^#B3&L3WYD1WJE4D3aW*w{)Yb}-mywx7pdQZeY-BqpX> zh-j99%U}8?&~d2=<@ZOa9VnV*`4d%FL$H$KvPXG#;eM0X^7&i!E6SNVkWIfv3=-(4J5%q&P`@Ihc zKT1R$MIEIe?bFMLMuT*;oWJoI^vv35kWwW12$04TkwM#)RJ}s`2Akbpw=)mOttajpuk^&xXo-NhV+;eKjmv zofgf?)0hH?&r*!HLBg!&A?(ohiW)S{T-eK8Wh${1lW4y9pR*BpdMty{!PUdh*5B>m zrxR*lbH!0LC9QAinDYHpz0sgdnOICjeQ0tyVn zM$ET)Pz4Ao@2~S9Fva?R>H4777zJdV(r}NSDqLK!#r-2CE)B>eYzSkF^G5a_#AvOk-%%XK!@!Mh zJdX*$+_+etuuvzVPh>G4x>4Zf6e$Tb=RL$~hzu4Ss`_{7aj>h%*$hbaQFdy_cO1}_ z)JGFt{!Cp>eFx)GMc4&4WE8=p1DH}4854}(NJR!YM>S69$Yh|Qy|Gi)ibtL3`Oh5Z z+~4xZmxTmUW?r-4QKXRqsSVgyc8RAm0Tm+I8VFR?V^$s#dKUy~5FwG@}C4qH#0q zk(sdWn7jB<y^a{BJs%*wXNTX-@T>ajvs)Xao#T^R2*`Ydk)^bf3I&!na zZ0QeWAc;?)NMy z1VWV0&2uW}lw8j#73|H@Cvcux)7-ynJGLw|C;{%yoQiuiNs)=Y@kHj~tbFCCpVaLQ z(c>J{0H=xfr_TPm11KbVhLox5rdsmLg6k-*V2O#bJmzoW?Ijq_cOKDmZiWU%tD4}R zk*J+J!nuWLSrpvoRKwF}Ka4iiu}v2w>-5S>X<;toM~R zpht1{d?pOIo`uGJh85+EA3&9iu{?M5UpRbfnk~ zW=Etg!#_9#b14q9jJ+0f-L>yMhlH*lTsxS4Vc$K3doL&X<;*Di2ArF=FAB=BHVJrQJQ2H3rIVPR55o)DG0qTdh85_<4jWhc0_lCTQ8qH|xt#MD@2!_IH@z<9-0)PLI+D}zaBD|B@>i71S!`mhE4(&J z4tz2_&Q16ovLMX;@7iiX-@EF4T8cMEHo3U*behraZHVC@c{jNIV;;3R2crTjJ3g~M zcp%w(aT|f2t)jp5kz{2O_j4psb>~VsAUb z{e@`2l50e?wLHM|N7J?_)7%M#Z*J*{!7gbsynDSp0K`& z<7}L@7f04g9QXXgnlrI`zOc+R1s-Dt;yl+g-HrS?Gqve#tP^dccZrN(Q|3VZLB1ai zLQ3>pl$x>7D9dgF5(GH5^kr*%0`$VX3NBp7-lrN>;VXb8FN5GY_GE9v+WH8EzpIt= zA;G^#G&>q*TE5sqZblcpqPFM8-n$)=$zp^SrL#&~xG6MPWqB6M z&GEc1L2=LNF@g9+gBGRM5F8nX%>BbWIb*rF7?ZXM56^1`znn|Bf_Zg)v4LBG%lM{2 zo9F4{9ut`Tlr?~r`mx0~cTe6hh>MPPr8pv(pC|7A1Dgp2m?Uv~#@2T#2{ z2Lbqk_>7cZL{7q*N$h6|=B^-5h#@tS#Lz90(+ha&T3R5TB?9R;GCtj}SlsK@f|8lG z&uud*^)b^>$-#@$ZAg607uYrI6A9=#_`qN00WB|HLMU@g0%!9b14rz(?zl@ zS>zS&!YQ>`^H99{skA8i{@E=#Bt{uO<}Q)!qd5Y0D5mNjeGQJjhW!otG_gMvrc%@H zvq$_!VJ+G(eedh@ei1Z+x3j9xWSA!Q?G5f;(wgkM6E z9#j4cyWM4m;fBcJou)&wz9;>fFH~t3<}3rp+}%ESd7`Hf4#bA+qQn%sz1|i+K92K{ zVMzqRlp*`)2KHkoe#Fu^=7K97r=F00fem;;&H?UAP*i70s12@=yo_W<6=ggTrypXZ z=3}wD<qVD%sjt5iHNGKe7!kePlxKOXse zCxQX>A;}@={SeIrIrrf0xVmtLW)r_hmwPDjb_-oFV>>b4EI)ywStjG&M z`vwWGr4WBTJ>o;mDp|yhi-7~!F-N0RiI2axcSuNuk3x_(f|H|63&9t^fJ>T%DNm#u zyBRWD$heN+HokH!yWsY+wNMRT9Iyw8s}ak5DQ4XHO1VG~qq%I|{JGB|qW5kT+aGk#i<{kF#K!$54BYQ$$~Jjz#q=!VaYMLl=Hx2enhOL`ON^R0XbrJb_C3PCUIbbrh#&%CC*4-MnqIE1^Q(P^}bVR>jvf%J{D>mqPyW7i# zq};IASx7*0`YUIVHEpk^?G}YOvRxlGt`!_V@~#y+IcQaFIecwF%*pisEs|uQr!J3* ze1A!wV6?N}lJ_KdcdQ6YVUMP9kD)ij@a{6pDG1-Xj{uyUWus=?-ldZ+)pL>Rq2YR} zpaCjS)^0i!8F3l=xz~$JuyZDuw||nEP*UcJMu%M-W@p4XsG5z+7C>cW5va|i=RMx1 z${S1xX|#jYYiD~Ttg^Uwb2=ECpkAnNjPh$Se#*A;4C>`sd=b~7+LY+I&9m0>oQ&Gl z6h>@IGw7%>E6RUfaHVipBnUE*CRQiI8#ro1s&sVDckQn6ZYseheakP1HdMCpr$Du_ zQim}vDUC`exlE=o$a}NWT8Ly1Y1kE;Y`BL`kX$+!Zxqasl{EE{5hRLwo)^wvwg+1( z$UkSrmOXV6?WzhuUX#ECU5qt$KNwbn=WPA6s>Ft|#wz(_~zQfiLc zv>4}ER-k`OcM2#ehlX|gnHJ9SI&tIDHk`)nAEVw3Zs+(;Xx~Kk zz`!zjHv08(0oPu%ZYm6PfGWCRnQEk1-6*NspgCfZ#Gi!9W$5B-LqJ5=_V?bb>s2s@ ztKC*K=8m;`hOm?aDPWRMhy=mM={5_ZHqA=~;~uO-g=r%h!V%_<>+n z-rr9l@0>PcOY|HYLRsxjDnkPH2A21U#Q4mvNy?FVLQ~EjzJpPzq_6toUTXc;m{;d= zLIx%=%qLo@b%^vUS!N6ytX)1s4R5t-b(1aNr@If0^{8`8FzxA#7{xMhoAJ6TKajMZ zldWw&^Ak08=~>a=y-kWFaedb6%&&g&okot|TymXjH_i&udMh;OOiNXaL>mXj51cWg~+jFqk!J8EkTF;lkgUQh0y zjBh(wsu$RME9H}p-%y-)u3WTn?*_A3Hj z0M0b}%o#M@lac$w;rkMxPt$6Aw&r-XgfYugkx4%oE(g_vXMEk0QRXr)@AL>f63o~l zxAIq0t#!c=EPasQub?s|rJ(1R=Mv$vD-rjSif0ccUeD(`1wxRneuc*9q9WRHI-KPN zdoGOB6t=dh^;n=NY%_4Ma+oQEqUdg6@O<>pDMZ-JTs9B5 z>f-6}rxuQ!Uzg8EERLpI0t8iU;q>lD#+u>leG+l^-y}r1^iy(oRllzs_6c;~k zFi6BEL>K#P@`7Qr`-7owBp2spy^DeZ&m!hX+4FQ=;oq=HHiWy5!UF>bW~*d_1m5BO z2a7@x*$^UG0^-|cT@J9B$?xHSusW=14>b4@v>u$LhX)TTd^EPP6qYB{th;(pQKrRq z@eFn!sGSI5TIco@4(wimN8b#k-Lw)H6+9)mqpPa9etxs5ImnHipEa4-)ssWMvAx)$ z35myfQKbeIv{szuF?0PD{`^sprO~#lT1pTXWDELQ^XC{nV^sWP4i4?(0ngjdcbo?h z>*l%{-%V7$5GQ1-;VewYKktILrX$1eiQbq=sFfS8Qc8PmQE z5(!k5#7u)#a_J2>56~pU#1QpEE>0Rd$h-o4Iv3{b0ouUIK>=?Z`q3REx!T?q3@9>GJmGoOnUf%SoTms9-fN&g zOYzCi4>t|Wb?n#@8NA78G`lBj%6) zWJpGk%Z4O7s@3RIYTeqO8=7Z7Z%1;nwH8xUS|N4x$&n3$n5&1FU%43w)ulwG?TDYF z)5=N3_hzfX^|~b>Mj!*F2~c8$)y77SZ~A*};2{I9Aj8?7;BFH@@EZu8h%VBk6vLOW zOJ^mKNC1255cES6PG>Ng5z%j{-*!pYIKLQiqBJvNR1LifOGEhGk%buXu_H6y)jvRRb zK>ch1r#D|>y1qK(yAgtO?XPHY?T_SgG$Q2Vg2RXO{}?-mAW@<&TbFIywr$(CZQHtK z+qP}nwq3VuzuOUS&>h`_f0m<+6LBJUZmj*SAv9mxB-i=aP+qBPwe4^x%}B=xjId<& zg?fP>|rd1ObRby#hBmybITG&EK zpKqN=snlGb%{&DR}PF@NvF#Bt&1hh+={xO0_4q z+=qImdgRR!xTP#)1h9}L`wor*t(?0!Q7#G}y7c7HuuR*VU{Igu>d{46tIc=`&Z}|B zPQSfJpiN&DDGB3^QGk*;ZVF}fd%~$gI$x?Q(fxE(K2v~Llnnz@DAT;=!n|esw_%8x z3~2O2XmSA@9I0yKXqkwxlmphq=kFdNtkw@dNTs*-0>4NFc&s54eG% zQ=K7Pm!-iEqBUt_&-L}KSQ)vs^Ye=acPpE(p{Sq9u+c=! zOz5_BB+WC}fr2@LpB}~-QrdK!sobp<$GO_h)4ZQWEca57#Ve|XmtMsBj!#IBs`sJ@ z?)oeccg{^`n?r?#Pg2*$o?>XsY9~36R1fE>ePdI{c3${S41yH6YoAmPAk>G#7<|G# zLn`$-JArRW$l{mOe6<9z(nBWZ6k_75%+)11x&MXN=ob-WPZYJI?q%OShtFu0$s;Do9~(U|b{!Oyc=>rW!u#L8o8A!`FxuIhp#v{8=lm6KGD z!m!(IOT3jl5JWoZGNQN@IY`V&sR|h%Oc$qXop4j6Hxf2hmW`{pJhFvxUJZQTwL&bj z-iZz1+k%Beld|zv+34&foLKLP{EQBa_F#@gtzfktepG-k>dQwQ-KB1xYD&NRfgpA0 zs(9Kqr?01)-+>~K{qP+{U>d)SdzkyR#aQnPCAuo!%ubGwj8e!5v_Pn<8Sqn|nn$yN zEzgD!ukULXsGqk)Nsy(0?eZh*vYIDx^VSytLwDQ9HG}SUAGfyeU6hPe;}IF|L$21C zwa*Dv6wq^mbjZy#e2G_O<6^LDOMV+&IV8n+4jJ2>+*|%e9*Et81c>3`#0S^?d5-0@ zm9hD-RqTS?UxRLLTXKIP0meDae6GU~m*WfOYlv!Xd{|Q59{;^NMoJIcKH>5n#nSK( zfdx+JqN#n}&g$$!3u*Pg-m^Wsf)Iup*L&NG0La6of^D-!Bz;hhbKjd!MR|Db`|%rm zUw+pqh<5M9ku2iJR%+q~RTJ8E zpp`?hYYbl|O%kR!CZE@ET96IzGwWk>@c3U)3l;;Xcql$DW>3y$?9iE@EEU6z?L#)6 zdTV5^3$`(;92+I_u?SAn6}hd!2u?U37SfKHeLd}~1lYQxlYi{cn+cvj_R%RXTmGE> zjOdL(poJv9th0Xj^c7~~p-|V#(`WTKC`H?f40pV^&&=q?HLR|87{5K+cg+xm0{L@o z1+3)|W+K()g!IYpMB(_m__RtvL4LW9l~|sYjqP03`M>jTw&zy-?`nvH@jp|HvaquL z_iE@`tE-l|4e{m?xn%T(%a}WO`R!IN*zl&R_KQ>y2bzkqrF>)cRkCF$c z%|`nJTxQgt6WavcUaT;cFx&a+iDSCYDxw4n>SkJ`f9&pQDvzi`nOO{E~o9!mN_YG2FV%TwHIa`CeYQc3GmK?qN#wNh; ziU#=2 zBgYWypciTuL{A%c{oa4U{d)_rMlZ)3>3jQ?IbjEou(=?wLI5x%P*yGL(={#7n{4Zb z%eqNQ8nbVFm{$Gwp^(%q4Z&XeXt2Lip8F0nlXLMEt&yg(X`8T}a0q!;3I#NL;rhM2 zSeb|$YzQIvsOv;Vra)Ynfd|?WfK$iDbXPSp6xKA7(j6=5 z%a~CzI-zWtl=;VkgU-PcbIH?Ypp-_2w9#1t0o&QwWT5JwB{fq%9pIu1#lR^iWR&(c zqH%9)(0sMx1opa0r(3}&w&e=*TrHAEX`B&2>1+B8aZbBdIPND2&4>S`j z9%-z0%T42_jMyG5D^R5EBfo(4kK(y#zX>qXAPfBU+;bJTa=p zFF481T>0?_StHKa41T`12&u1}Z-=1oL5izSRY#O+QE(I{)zWp}6W~a@v`65-tb|!u z_?vvmPPb<32U1@oo4mOq(;(;RrBEB~zFoDSFzE+6cL9Z2*jUVP#SHqW*kWwjrX^m| z^EfD!?@`vgH#Zrql&gu21G{=K^yQ{(2$Pq;B}B>!m~TNRU0!3;e`ursfvW{uf_O>A zB=<#}pcI>$FYl5$LEx9dAsa(L99_<-FB&i{N2YL}wR#v_uu2bB`YNVHJC(9A0*i{PzBJ-BL z##UCwI6(*69T_s3oeHse^~%j{zZzom*uywV;-m22Ja9l@qMsFH#{qMTDb8{DrlT@(dt1$VrFwtD@_3@6X|z`{qU+dmA> zwT{J(7%swOcZ_eIvU|W>Y0|)I5{iyvPl0}A;IWb@j}IC+%iDBpjaPZ*9`hZyA9W7=yQ!E-r%oFpV`YjUSgfJo5;%dk2r zH!NFUB^2wCYN40Uz)a@`xx6)P7HL7y4Y+TKbIzk_cJi9MLm{qaf`Ts&w3^H*Mq!3* zhGm9W$e|+(eofidN+`M`b|a1lepCLYWwymH4%w>^xUaR-g}R|;T)J~DUFZ}W-!2cF zWW|aZl4{R}*oYDEEAiB&)zs>Y2s~sAn3}ts+Lm~Jhe&?*`mwm{Ya(Oc@`N1Y)!WSv z$K3c>Zr9zS!}};V@>m9LM&L|1TPVC{d6la6!nT}Wg~LXd-D5-FQDIHnrQY=F($(pC zP!7(nTeD$@2;iRXb0Y@#AKLL&GCa+h2AGBB%I&q}UcU+3lO5F1?b90!X;YjLB`Zj4 zSnNle;zm^z_)M!4hK9w2(p^^ste!oD!nUH<)Kiq8MOV~76C z958;Sv6u}?=ny0JQt1QjU4OYoG7=Zvf8-z#&0cs7$h6B>X>preP;Q%t8iUFG5?E+e z6-$Yfi#4(G!P^Y3CZFX+ZdDjsUpx&jxILFL*H`SyGql@idtHK{~@24)Pd<;T-fgG5slS8?0ghsBugZH-(6b>){DQH;mtjN2o$icDDtU1e2X z_H1z;_b=}3zN5ECno!qX4?YcDl^58#JkoB)d)44gyN}+Zm5i&u|HcuzHqWlLzxGw~ zw$BR5Q&h(cum2bs=-ZZe6LmV^#n~uYBNxXpNCQ;8`Xb0ZtYn>^z#B>78ab1Zm7~+r zM|l%3b^na5`~KD~-u@ri9TUfY((7ho=KLSi@gA+I+Q(MJ-B-#dAhYoUSr8a{D3<>( zQ5+j{Vw)k_czWi>fvZcj)g*`YdrO-Uh6{K8HXFWZlaxjJt(X`() zx_n=Yy9md>E-r>(D!(}5%SlGn`j8A%fGdsr=MAMq<*WEWlahTwDX5!VviJ5qYK+8x zV05&`?I(kC$p1bC$s!{3IwiSq%u#rsC8ksmU+8+Nd@v2luMb-zPo#g|%o6Vx5v>0{ zS5Fd@5Rn?{K!P^cKZTUQ(G~53$c$7w?cw*)?3YDZcy}AuCocwGP%Jn>)-XYuP(&J* zp`16qeWvcEhf4dkH6{#ua%P`2Z`iuz9~IUe|Ms~y!9o7F`u)|v)L)Ljt^z`x@As|Z z^WD3+CZwg5)K5ukdXoM4QKE0a7?{fvVRu#)gU%xj$%_Fuh5x2#PdbuB520 z7}QcyLksM{g+j^CFuP#gY!kCBLItJq&!}QWI?JOTt4yjhJ(L%rP$1A>5{qPp(PpIM zgdL>j^WLUOq-muHq=TZ#xp5AxMq%g92FU`B6I$nd=5Q#Nvwqd8NRQXKxv!tbjM&XeHP>3xBiTX9JHI9>M+6zGkjVf~wl0F?C`dDO z0Y_4w|8kGc+a?N7!8e24$)*(3=4wGl$LMS00^kcyKX!3Aut%C^)@Oqa>NfZnI7?#I z#9V62>Cn6Q2jp*9B55cdOol;Bf)x=j&Pmcg3dc+Z}*>$YFO zN@Ch?iWLBK4bBR#mjw$I%Q2&MA;`3>2Z$8<$aA|QX3?j38 zZ#d~*(u2yebJZ>GHs1+T4YUN#PaXi`i@(_F4lRMOf$6X<$fAy#-sR9lA-lOK3*l26 zvsayW5Ar=yLMx}0D!g5kEK3kuP4=8>>`0f2ji-V-M$dQg5jue{zrjiBox1F`vLn&V zVSxV59-2{`Rs1NJOTa1M7CM9Jfv<_w;Al-M9J(S!XVieR<;#H8kD=aXPW~IO2{6@OVmMH3!ZHmvXftZ=GDy+W4wyeLDlCEhd zB!ew|gc(VmTKFWjNB(rS5G2X4s8QT(3#hrZFy%q0y?L5WjHT-Z$wtvrNyj9ztg~+u zU1!UNRb0F1>UB}MX2vTH;=Btc3jp4x=qpFZfn;9Cg&vMofF7+R*!c7^^6`|X(^kjS zfj10l_6)tPhN)**Cer;0^c#N4M&daHr@qF}ZKNZVlqQuFLeFBoO|Q0s7>sXLl-iwF zUs$;$jx!Zha%tF-x~M9J*Z}Wttu28uPrqhR;gJ2KauF6a5tP$)_;uf4lykSJ%xEiO+RDH*M%>5WUoT$f8rOmqqvRO?IipkY&fK_8%`ylgqaI-^D|V6M|2(xaSns zR}VLy^`NLKDep9NhG|CG zu%u?TF}2+{V7j1|Uq_&G?pVBq4!HjzhPLDKQ8C0x}4BG5q$tqKe3}?Aw*I zhKNQM68sI<(cNX^;xe;n2Mg?ZWEgUg#>eMiB~$w9kF4_2wX0~RKv zE2_9U=1g{GZI6zW!^=^X^;*de>&fe0dD3fVa_jB;&K@bN6u|`QFU-mJ{@|R&Y%9V# zSaBAvLEe^4Y2md8-(DJKOG>mHpsc%DsB8G0c_}RDJH9eJa3qnqoqJ>(55$dK?lK-uF(7{=9@fvzHtkA&rMMQWQdZ_rW2{Erq#gvoJr)cZ5o`yMihaxC2#?4}u z^kyW6D}}P0zF!wNACQmtKjzoqG9lt^!$jj2GuQ#26Su)SQAQ80~(H zH;`CxKJqILerL0R3JjdJ^7NIW{DtSYG7o8!&%82NY~L9rxMxKr z8^`%Iw7h23#~&fCNdN9Kn5VuAO1c-*XGeKQg5)6e+{90cJ6d@|J$P@av8%iz%ISxH z@8SF@EyFn~sl;+dO80b^6BGc~uJkX=w+sIbK6`pPSm8Z{l~RMEDJ@G{lbQ~*mrefU zQRhz7(HG?Nj0dvrMa-&CGWzYigt)%lY=6#(JbsKo0$vZ4a7`GCVj%K(5-p_gM|^sKa!0n&jHLawAC;w0|e#dp-Betq~XsFX)_!W8_Nw=$|@lDlv8f|?XFmG>X}`>wYy zG|^43ua}07Z?t+vtfI7iU@Fc+?f$gX7w}eO3j%7v3?wM_3ksiDjfmr}#jtvSU`@$U za|9*I)N#iVuRPMi#4yKlb0NGcq)%iHWoe2@jf(7^!Sij`-c!NpI?qL`?jJe1s;|g1 z>wl7Fx%uB%p~PoP5T>uNBc;4$hoZhGw5(sm&sN5tK>>+8JmWFG?qdZp-X4oWjV;sbG#+K1O-j zfN|!hmC6TTKXvm%+TocP6-eZylJ7g+Eku}lUH?i!!I~bGkRF-J^=y*Sa@U3>)-=d! zsNNcBU@!4BtJ1A{QX5(u^>wQlg4n-y>$)Tn6t?%Q3dk1@e08HWj(^6YiWRPF62;38 zLs69`fao_a*PWiPb+FEkCz}2=QPY{(-sI%0wD1;O|LIU~UcUON}Eaybh#(Z(-)2Dzh^re3`$_>?e`&MkLVL&U>XNxgX?j_%UR>nj8 z`1d7R+ym`kGV{E%cC5Wty}re)yN)~fy?H9Xla9MgQskZlse)p%%1@P>CM|JiHo{_Gezrx19#=RFHBeSs5Kh}e2z!cyGog;d2 zz4{_+$6@Wnl{v>3BBiw6tsN?XhJ~r(ahbgz=g^IJIPM+3TPzp52kXbp2{ydX>DATF zcbfF;V_mDT0v?ZBTFKP{6>P1r5{H6&#t#o*J|A&5fMGH>LhiyO^Kb4V#@)#r+n3H8 zlOaWq(^)PHX#UA|kqjJhroUy_1E|#M0jlTe^qO?2E9zU2vN1z1d@%hx>kJ}8fCWWA zAkBDus%ShzS9CW7X1+F2?k!#I9yuw5zpmd^^b6ELy;;$wL99dLFo~0gsnc4TM_&QW zmkVdJLa+aA@=MY64<(ut)Z4qZd6?jaV%b?=7k?-HD}@!s+HGFe7(O6&N=qr&tzs3T zE@+5GCR;fuhK+)WFAyQF>z`_Mnz;#)KCW44_J#qMd9MwYm8LJnH z4b}(cviYmo4$cy@36zLyBtBz?A|{I}HM4c|7So+oQ+i)|Zd0TAZhPVCg6J)J`n=@! z3WTW+eHL=y%S^(neBJm2kPS^<){oT*3O=ZUIEHX`^IYrk)AQ%QE21G@stGf9!4cs~ z3n?f)$J#sl@ax~{1?zE>70w}19V@S5SSP(E2V!@fK^(fLcOGmajn05JVSy0Izy_Z1 zQem!xe$5g&(|Bf>##X|LYlEzJlv4$gj#T(#RY{a)W3&~54xc}#nia#o0MYjpIur|y ztf}l5vLU(0B&sfzZ1`(BvbnTc@93DZj#9|J05Gjl-??`}pG3=sYHog~pYz6bdK|lj zqv{HTbXzHjO8{B~JExJTlz?@JWoYnXq4CsHpq3+ZlO-|Yi*{lhrQmhC*nu|TPc)`X z@e^k_+5WuyM7A(cj9JpC4+qYBBMZw_WGKs3%q31@ww$=cE0!gzmZ-cdU`@FwpL(R) z&KhCEZo->3xI1aiNXmI`Y9Z^_!DWTYm-~42Fxhmhn^RwW>Wx{IAv92yF3tOKlV&qG z9L5)^3ECO7z^h{Nu-VRS3fO!EoV)2<79DlQ9|3DgL3{RC z&nxjyZiyI@mJ6GtB#eP|SSAtAQeZ|erUpZL>j!Cv@|Hoj>fRRdh3@QiZHqh66Kb|d z=8NjURwRLJH%B>a)1jTu|Urkjq|*O}ia%?y>k z54`S@@X$%VMc}>avT~WHI0?lSFfK~E| z9f{+&HT~0z+98u6eZ*67E+vkw39783q8ei2DnPqJ=kt*4oA>lSUF8}m!8T@*kYt(| z{g~g2b32Qk5zpIF87=O=)ztrYajhWIHZ7LWeHM61neWQ^x|2tpuc*Mstae!^+I3%a zMNr-Mt36HXC6*grX`;E?Exmm$CxGbqX4q1tXrTPA9hH6S?w-@+76Qe<7ezA+PL7!U zm7f0_dhF^J;r|GxZ0!F@pNx@%mFd4vL07b-Hie_5Tf=4L+?)`)>(^QAx)rjvBDPL4(+GtMKL16 zh>*~S05{Z!e`yjSnWZIIgA9r01upHB-mVFXLiP3iY*SufI)rA++8h}Zq4O(Z;^-i3 zpJd+f4#WHV>?9-X^ts7+m38$+h0q+mef=|8Ww7XhzV~=m@AMqy{u5d54ajKi>u(*r6T8l z#?oLse;Hzl8RHD_V7+K%=pr-Mn;=%x9+0JiDS;!i0w%IU<@HB8FnW%>VO|O){hfP( zg;U@jS$$_JG@Qr|5;I(6P#(@0Qdsy-mov(zHPfkwzPm_y|py;xErXroDOw}iIR=>4$ z6oxQ-v&#{z+F(1mljz?P^fYu(?mvcBm;zD!WXl?>!9F^Bdk_B-rsip@$Vaz!Ml5;z%4eoc81K1lyE!&eyTQBD<(ROSJUcE- z+lYCUv&h(3rWGHd)W&gEI}W`(b8ZRw6;F>sRkq1Li_3O@55A`^U!0PD|l;j3Jv-Jy6OT_{2h*lLAzml}+Ei z|I^hLH;H_lyW_o# zElusAbwPvk4!KqCFcTH-Tk2GLp|pQwr(e-wq&MJ2O+nCE@1|RU1FNPZs(W zHiHF=K_aq*QdHn>v1W0Re#pfPEDpF-3BJk7l_RY{afr0>ZqyU7x6=X}iEVPQeg=LL)k+1LBk_ z%DYS0uET|=O3D57xXb=nHP{euzH_n``oUwBb=X}MNrInSxzZxe|A$7l^25V?p-}JO ztm;Q#q+NG#%R<`OuUu$r^x{Ybd_jZkymZ1(Wc^7ZwmRibg@Zzs(e(1Asl#j0;m zmWx0Arlz#k#(C%s`&q=EjMIiIzfwD57c3cz+GN`XuOk1sTm$kU+DAg_c}`|DvkaBn zK!mH$Mbb_Eek#S<7&Sq#6G*Z->V$>GH@w8IL?(d0lbpP;qPCWiY@r@82PCNrSLyqZyg?1b`4tzKg9H*i4`YPMlOWr>V1wm(^OyZ_G( zz9zFp+yDLrv$FrUwG5SiwzTx}Mpnu$w)AoYObiV4VwO(ME(DC6Of3H%ZCp&9=*4Ud zT}(wxjqOcL>19mq%v~%9SlOBX#~kZgSKE1eG{tXEKd{nQ5^w(elQe~cbm~P6)l=P+ z>Rvd}D3FFT?H+2FfF} zB~&@pT;~8La4agvnFkmoG#?rsLg$Gin6M*x4g?PS*JC1KALiF8_XSKIEI=^&EdY+! zPbAA9RS>hAWt_+YI9)KxfMxEDNMnY%0YdIxhDwMaL=g=GA1|&l0;~Kv-=bL{E3P+! zPG8ExK?m~bl%KDIC~Ta$RYK|TpOM)kYCHYOm|)oPye5F7vV#v5Dy3yEU`mOMjb(E) zum(wc^LwRe)HI5OH)g;lz#%mzWXmD)c^!c-3LSNGzk(DZAVIDYmIhRQn-ZEk_{?Xv zh<`qZRsd(fu@q>p`lF@*jLLy#je|SDLo!?9*?d&%-#Gw2muT|=94YY$=hQFkJH35f z%o7i|TZUmTfFufFJ^^TZW)T~Jr2x-6~Jirm(eI!##1VEd@>J}fMZ%ukn z)bEXWi9s4VoCMK1x!~VF1`wf>AYxHL=>4ygphifJz@(A5Y8MN}HmTmiQ#`RR!@1qdwK=bTdWL?BQs z$7r%{k%EulBq0Phopq!%8 zpl-1Hy0okvAUc(%qa-Uy(;k0RNCUsXQA$mAGRn#*;^@v)RJ<_DWL53doiO+Va|kK|djP2DIi>ccy$t}N@OZt8ED-1M zm$7p}w>Oit78DqfcOfte3V~&TKA`toZEy@Y2(S?ofhq&p`w49BZR1gJDZmj`mI+W$ zQ9gj3JW#&@b@&4H?l8naa>byx5eO;kf#2AL_*_Wb@|O&dip`+EOQKo(Av%sI3PKGT zBvd8f+XLo(K{VMp1 zi_~f{NZI&2t3Fp+latTfwOy{T@2S>hwFy5TR`y!t*1`R&8tH%TSJZ!>Ep-b8wYuh( zzH94(1%5TV{J-rsROZm4+{)!@=fHlvIJLVgdhNO_m%e2S<=^8juaLLBl)g(o8WcQ+ z@+#3+9%ow2tEBn6_xJX6;D#E1bya2Qvb@gev&_!3>{g!&dul#QEV`n)(kj(m_x27| z%gBYd0IQeIx;?xGs}7yoGk;&5e8oLAU(=dKL^bE=H|^MT^q%`bDfn5E4(w;4nbP6} z*CmLPLkbU5v^0`_a>T51P|>uYdP5=R$!A3pc#%*8gWf1{{KLI-!$_-c%hgARv$>&m zc6U>!YQG`dY3;L`8tuu}1m3%xEItBR+S_wwvnuf~n>>{_9>z}pK5aO0=E+_fuF}cL zufFE>>h0)HsMKbao!Pp77%TU2`tJ5&s>p zhoQ-q6%tBN~R)`#~ zX79^SPkw#q` z)vlTB&skA=U0l~+x{{~Y=cmeBN1hgUpB@ZMX~;#>9|t((Fo?Ik$V=yjIV0OK`oI@< zAY^6c5Uq`A9+Lk-5de4HsDi|A&i;I?yD{^@9v4srM1!a7F2+D>AB}dgpL&bTThzCI zc~OP>#nB23P!{`bnE4%bT|n zMN8|TBV#t@x#a(LDU~y44!zCMQJp5dlp>Y#>@+c?_TF|z8d7DCh??94S~ycxJ%wK= zI&{#O-;ja?hk?sTSN;j$@{RKz3#Df&(M4=uIKXJ;}4nqSU_1Hxv+hq=Swk7KVA7ucmijfFYS4ZR+aa zsm?*Hv?{B0?Qf3?Tg}KtRcBRQW+2>VnC`1W@xHQ@8ClN$anmY;haSGP<`>u6t0+0u zAurxn>(%(5XCtn&75rY`mzmc+J`(}d=6HmK;bCJ6mD#ipM~V^iwINc~Pp@uo=YZ#) zD^f5mHXLWql_y?_ja%4N&H+i!q{Midhlz{TglYU98+tm4&bSIc(?kcdwG4TrYp}KUmnpq1huBv!E}J6(R;?IEWR5xzkd)Da*vuk)hfPsp9hU)y;yAY zWfN@HG~?tZPj5w9tzrF>=Ig1ftM|f-%chNNuX;Xya|uXUi05@!HKVy_>KnF_4HZq-Lzd^iw(_g9bP} zuiEg>05rXpT#VLXk1(W#uaTEb!C1+g@`Yj3Frz~_^?sOQgt*uW=-oSWEJ3rms{UFe zm`*GN@OWTfJPMXdh^n?AG012r-t!MWKgsXGF%P-e`Sz+SN-x~bHF(bzq!}9tk@m>^IpSceL$aOm`WG?~k zQi94u)v7u;03HsQkL@y#=h3-Gua$!v8NL{1epy);j1G4!zbyem=l_S z4X7A=cLAOw?Fw+nLFG^;I^_s?YLwfvE>k~c1#O;mia{sg!_Ai9kH2)rb8%ye28FdI+EwD?HiO|{p;$NU7hE<+)uE(SMp}fWYv6hPBm&t z)Jm!fI#8l{rc(20{yFU7BCD^0%IxZdTF`@&R?+h|L{zlDlUC2!XuIjzHWNbH%q^3CFc9_Wp9_^W>MhjIOqxv!ev)+CB<};?i zs_WkOKH>FZfJpNY!UZ?~O`!^Ec%MRVI(Yc7QFT_NH=Fr_qAJg0$Gz&+pZzdoM=an; z+HzAr#}$%`3Zg}9AF*F0J(sEz= z0gPTfe)yIRZ4+(JQt?qZ@I}EWyFT_p?eFvYIef}WN?O8JzEt8>6Fedn4ag?&4jm^A0IoD1K|jCt-kiQ!6l6-x%-R5t)c3OH4UyqVa~XIV)~=K78z_Im#U z4&E4LWOBv?)}D%?ZkIWieDKe6W^ggdA$!v6$KT>$qoYV~xO1tzyYl>&*QmxfkFtFB z=jY@0R9%Fou8Dtzy~9J@=X4?m4Rt&&^n^uICJxI243z{~KHbQ)<*>9!U+PoAKZ^_~ zh+AsSS%zl94XR+Ra+BR#-Z^&adAk4nen1PC(5AMF0%9&}U-%>T7j+Eakz~kcRWIcX zq1l(tWuLDN4xUmr7tzk^!!@JoIVJ^q#YsW+)xor=kuZ%(qmPcjNf875l}d`~AgL22 z+qt3?7C>hPL`~{K+(=}0*=isL8wmQ+c^IRFi>aK853W*~VZ#x)a!k|Trn>aiU`5~_ zya$j~9b)t-Xp%BjTrlO1b|w{&1+|<@M{*PpHO6BIz&1A=-m~UoLX|a-wsudg3c9-t zYxAZwSN?MabwF7`u3!6kY~u-Dab$GL;dGE>!)vp+{JJ^UOPQR1LH2sCnX77UW_F*! zeLy#;IJ~;)VGnx7*H#Txa4c6d6ja*%0g&wsxcj)7l=&I&11guh+Kc1u?{DqDW+>g+ zOeqatm&&tMs%?^uU{P?1MIG7o!_EeG`bXdI>681{^j;~ZI0~YdFN^OMdnCxg*5K8q8v|7Ku5KZjeW&hE>Q7Y*2 zTd}pbh+hWGOkwv;l{Uw~wJjf(?#h&=YwCBYm7`v**42<`(>Y#zm?Z^ND4;wiSRER;8p&MVYy}vlI@K1_%NAkj%P45Gh@?<5wBL4i5i(3(VJK6@G4kNw^ zj)OR-c?X_&t|u>xx9$ow;AbPpRoRAQhecSJbJdi)&@I4m;{-|*a;5KXG`&0o=1`-k zy9a`BnC%I(p5q^C>a`6fcR;q+ZwuJ9xaW`UH4&$y{`7sP;ch&LgR6qH1%3Js%qiS5 zC?#)4wHkDqZN~~LPRLTYn`qJ^_k8f>Z6gN4b|U!zb`94FL0=1gJi9gaMWMLYoATtr z;0RyUf4)8D#IjW9;-p?lDm~H-8oWS$QHXpFLF&xxkSbAi`3^c4#spOyMOf zPrCHtRJ{#GcS?P#!v$qGHcNj+EhFdY0Kv#MauR#g(Y@(7)7Da-N%n@V(PT@&oKnF!dv|2Q$$9xdHX5 zX3_H#D4*U=Fzn>Emqdia^ZEh$I~aKK%EPt|9Sl7;6^pJn98NY&`${z&e!8zYst-_i zXd<-fSQqvTOMD6*qJ139`dJA8{dXGuoa);K<}Dg`dgwRD(+pFaWLFxKTVs(`G*UK zdN8iBIqtnk+rpP%0h(;^y#f{Mz37CPFF@tW8F34&YBKn3HX5zUbJQzbg*sHt&_^Rh zjl$MlLllAZNFxDi_PDSHR>@If)rSYSVaxS4N^;U41{p7xy)Um>P&8l^W*{cEk0%># zF0Q@$Jqm3nOPE<>Xh$8Kv5LH^yCHQ_MeNG=4hKl=%E^!VAL@$HK&1!}-ar%6eP7dK z8(e;Ho0iq@{qNjfrjx~`ZPpT_@5)Nsis}x$ta{GO6?;qve_3Z>UY_7VTEPR~B+U_| z(A7dEdaaq-m&dMFInOq1#WXBhWFCFS{ZF}=E~9hlz6xjChe<3g{}}!VOzV2 zY*@;Dxk9Bc1#B~8-+f2mqGMiroEl`DC34Iw47*^=->@lr4a*kT-Zx%0z&Ej5#xs)u>0b~zPcpY9}_k*a6R(oSL8Zv z^X3PA(uhTiEnX|&z|E#VmZel+62R)fZe>Sv=#vQj+9cax1T-=KjWRqA%0_>$tVOr` z2Yr69&Y=&h4V%mj>(HmS&2H}IcmVZb>JyEbk2b9bciP=f&Dn8Rq_be)Z0p}!q2#zXJym2Q*_2s>B;(U3-1x3Yti_6*tS_i$ zD^a;}q>P;PldYHF3?D`n*5$GPZSR?y)~jU3S8a!{8|fmv>4h;pske^B@WG_r#`NSxDg-QgvIw?t)agDJ zM8DeKD^4fy7U$f_@~lV9A#_$U*xZZ3T{3+I<*%pQNb~C{69DrihX($ZYH68>my$4N zcG!4(rj!eBb6Rr17j^xF=dBboGLhO|A($L*Whc9K=3h|v1NgeGG%0+4*dVU5Fuy6# z>ILU_df+&s`#Gk3e{5e@ZYR>iF(yuOb~^Zc;Tr`o0%-4$&G&lQ4j&|Y`u_OIYC`_i zRs}8NPmh3GPXvTJl?F=Y3#=&gWOA2BkEFZRdW1ocLC+JD>udWy3r#f%XaXq#O7a|( z)$U}}tW{6+fx5X6O|{9UhS>*ptlKB|Kr1|woq_;D)M9-Y?~m?}nf>}TmC+CI$Uy}W zkz{2dofvYFb2oEo0Yg_)gWpoWU_jwLGD&OBqqvkmvv3IXIXT4(!VYjM6gU=x4CEDa zvEUu0`5mE>VJ;vVM~i5>U0DY&c;9wZcn7F+Q7s>XG(<-gboS0It-$B{19TbNk}sIv31=a z?_sT7N(ycVK#{fhT~;U)FC-qObekzFFUW$Vs5giLMk4SegV#n$X*E5SeP)h@X~b!$ zNt}44e*2VLibUOhX)@wWc@HRIaYC+GX3Rij@U@R4l>E$L3OOh@jX>|4heLFi&(#m7 zr{0Q9a*fQwf;6X(xP(z!5NQ&G+iVZ(jp2Q?JV?H}w^_&KLm43Y2f0y7`L*`O|Fp(zS3awOT@l_}G z6aI?th1f`9AE$5~EsE}OE_Y|ox!qS($?1NKyD2(V~CB;H;Vj$Ah9y{KAxn1>)bM%;0~zFs)DML zEh5goWOSIHoUOgvZUiKWRK5=Mb_KSkM|jNpE?3-V!TE1qyg*M0BTTKW0leqVx>CJZ zSSQlc^``%jOo@B%++7yXKs|oj0^FHhtYjM2lQ~3lmWS^XW|4i@;LTrq%?f##{_Nu< zsLag%DStcn%wnM@P2>L9{LF*@lV(+)nQ0A2OkN!g-OG26voTjeBxfbk(MP z2nE3pH23D?WeQUlVv(6D{@?b@DPNmS{ zA&(6!jU4d)Q)s*frP5`+BKY=H_Fla<+x29`xoAN-w#@}om6>J26t+n#>Gs5PnAm8K&IMy=?_ zL|=eVbAEN2tDV$%YZexXqM|?ad3`>dO|Hf@v%f=kl2$xQjcD(e!l36$3gX3I(`1m) zrzj=ly| z*lU&|XtQ-MlaZ@0+kZ7UIZxLJAEBs*nUxa}A6uh6vd&OVV0H3!>y?~ii42)P=qwEq zipYYX@Q*(0o73ZqC1J!ztwV_G)AZ5a8rt2K?#?ve-k(6Ej~D9n`It$`BRzuHDiaCk z@c_o(FmnP)0&S5kq6SaQqK5O;K*W}~LtIu$RlJU8gC{rpXI;U$nm2+9s2LKid6NQB z%3Vadds~C9*z9<<333zq+pGCUr9x(wU{FidV@&G=QmQe*6eU0dy$k)z#E3g9J!o4z zLo;o)6BfOATQ~Ma4IQIFqSQVH2}2UZr(F;oBLXn~8b|3U9nd|PmRf2kT`B0re_u?$ z!^pFTX5Br^qh~&29)QlqR341Xd^qV-<$#F~nB5sUkms}uoWs3^YO{sypiSvf++(=&Sv_W2G1RmN**U-)a+2;5(s02t< zw3i*ho&(F1t-M0(L?MV-J1Yx)qydo>J|{#N4v^QCa;K!?ozMuAgr1&!5FvgdjZo_v zpWn;3ccNJDg++UrcpWHe)9aCSZj99B89*C&Hc7Q(_!`@={~N}*3OnkTOt6oTK4-~u zt|^1NOuw8}8SmdOQE}VZ_~5a%|B>SR2`S-+De}L)T>hI4|Nrl_Gjg*14?5!3ZxU{k z4W|1=?G-+f>f8b_f)m9Y=rP&FRs{aRfqsgx?eQjs=&5leTW9825o9{jB#h`S4xe%c zZU+p5WBtjsXR1BEAsbkH}O78;7^QjmNLRhK>|$r13APH5bwx7TmvNav(G*C^>n0Ng{&u z?fPcJzy%Qx$Tn#i!;UB*C8GoK zm9`P%bs=xAqGPSlMXPU+;)BJN#V zoZ<*38S}~2z^tI;`Aza&55p?OV*sP!QfG)-_DXH4m}G)?;<4r|#+!9ZI$k^7bk&w1 zzlWJMv^GRNcFW}&91c$^mAO#cN|TmNdKhxFm_P^IFuO&g1Pu(h0~K;RrOS~2O6xLG z(p9*^h%v0p1u$x=Gc@q{jgZi{#_)V7Mxx4b5iUEVKT^rykeKWOSEE+wdB{K{s8g->ts?eV*=0)0*e$9B6bu+Cp z8uq>^{0A~(Bi};10t5lq7N+?|hCMn*(_Cjgviar@sr5{fBVnv9jdiJP6D~RY8X_#w zgo$bUVp2?4YyW|!5-YX>v(oJp%R|*lIF&VE=~Af3PMPSNuo4ux@rnvubU}GkoE!M_a4|UC@$sQDOLqHGw*Ko| z0>0sU89xefRc+r9b8ve*OPLw{Ugfl-;`vf@v74jn8mBTh?zO7rJgW$Lrgl`NI2ne< z*wuq3S2H)Wr})+gOk8WSI{2@a%fqVZbgi9u(fmyCmtFOCtKfk^-IXu47Yj}Gtb*=H zS!(0RjUt+MCSBdYexg0Kq`KB^KEIx0YMbh>#V`u$@=&_h>25OW6kz4qIR{bZof3L+ z`_k^9XJGl2(V8^`enBM`mVbdneYl`t z?sY?02ZMacnYkg0A#K}2a?K&Ctlx{V3b+fAQe+QK3Z{ZqKmT#8CP>iNoIqY%wf_uD z=!c^GV8h&MPu-qzuVltbuawdNa_%gM(86B4>|N3D55@PRqV6XC*TT>~X0uUU*>iu= z#mmgr)yr!(cwiG*_bH%RP~YeP8gQWhYqeOEs+*7AfY8@PHg}d*oB=6YW3?^8as(44 zHVT`k5v-dM+{~L>L5J#7oJp!xGy7z;Axk?m4eZpm(Ow@~`;Wx8SL~M=a1J1f3z@75 zH3~#8*!hQb>h>ukeoRUlOYKmRSAL7@-Bi|OSGiA_7(GqOro9t#T4nW;j4eBu1mqXc z5C*Pr??ww&!ENPk+^gwuVZaPw+i~n5Ev*d9=jyz+XME8rEXc!rcC8Cx=^Y9iSQoY+ zEX8Pfn*nmkyAj02V2mGwRs;ILb~?KOhCv>G=O2cqwAVR|b_KtO4@M_~VUOu992GYU zMf?2i(!>@RUnCy=1+-osN-@RuCO6AX-p|C&UI0%?m0Su| zGV0TOJ!oGZ3pPLGA1j~lhR$?vD~AOrB8}SB6!X3#Wo_AK-k9X_5|y{1=cSKiVw?KCxqxACv}^jk+eD-^0USHjAKX;z5d*s}HC<>w&-6MMds^(|l@<5qb-8Dbo@koz| zhbbVK_Z`Z1AQ?4x4^5R4UPA>k_+nmZjmqEu_rgbF!Gn*rm8Hhwvp_+uDE-9A1i0zk zyO{A;tH6eo7Hq8aPpCB(a*qrw?6?>wr6yi#qnN(Q&el_-l6swa z=>aP!0I)#N@R!*Z*Y+7iIob^z&!T(u3I5#W>$&j=-TA=^jP8T`slvM#+<(dmu$NuU zop{0@upOY6qU>K)= z<6!MF9suh*G z@RRgcFXcZ+_`n*IcEhZ6X=3IxP~AMWV|HhdAJ&GE?D-?w55oAp=fV?>10TGRF9dcK z;KTM&_ZHIlOnhi*pWXx$WzjKBL>`*F%K{~iiX47-7G&)jvrka3L`swuqD-q1EfG0z zfB50L@U|su@eH39v`DWD@gfk@>d{eqS<8xCybWp(rW5W2XsBs(cRdj~Ad%Q}OE?|< zR+h4QNi|mc+1XmDCw6`hG& zhEdTP5wYgF<*3FI&15T+8N+>G*i4k=5qNM4_j;v~ZEiw3f|KrIzhc<6%96gUE=LiZ zN=X6O>(YJnh+4ge*pnq3h9U@RCom&$>r5RLi0Vy%**zlnn(`@2C)q{m%6PR{#kO-< z^%D+Iduk~5c?lKjsn%OTSR}v%Q4hLT! z{+2+I4hPu3lI(jKo)3HT?T>iws8Fs=Rj?MKRp^iph5UpB9#&D;FeA`or||$)llws= zRdd7|N=@V6#;?i)iU!Mw^^+dclZ&eM9is1viwiakP3jJKfZdEkZ5pvDvH@qwiaHDP zOW@WQ3@7Q0sj!f1-&iQe0`=qh*UvdsdD9IsGstRs6%cE|!pne{oustVb{YQDWH*YG z{##1#6+lURCnc}AHxiKoWp@5oi3SyW!r>G)h7}EY&N4f9axqn=;9;m~$~gpPAAXq; zB3_qUTiScL@!>xC(|vB2u1=|9+s&P~i0kT=t6b^z_ zp2sZxpJJ#k-9u+Q015Oly^=ihqMDw0P1_9f9D&kRt#Z8gGGiJ8Uf%bQ{WOLCrAa93 z8Ow;BjlNj%T(XzHNS}deC~r-DX$Ik!&YG;o1;C9iF5^%~{Jl7bit0)f^t0!~#<{!J zs%RYD%N1DtjRW$A)f%lUCS8!fC#C}T-eKBn@DMd7;)*5EQfYIc=KI>k=VZpzMsQ)% zy1P=4I>jWAivoU>mGURRW=gT0*8=jy5me>~kK(ZQ%zj+zfP^$CJ7+Q^KIr5oifVs1 zqbY`9@(Vxo6Qctkh7*kDOzkfo@h*}d;O~ZS{q$?+N4Vlo;jlQ0b>LV4Q z+Ca7)i_;{qrSvn?hx?ZmQ>ZczX~WZb47+C|I+ZEl*l@nqrfu=O@dNLoW4@O)K0wOV zUIV>B&c(uEmJ?>~RYfW~Jb3x8s&zslWby}^mhvg#JQB8fv_;Y!T6JRrLchXmNJIZn zDHT)IH{x@$IdJJofv!HKXxN&Y-CO{}soBsH>s!Ba@qryAZ3tM-l=4pUdYoV9;9sd( z?G4{8N{^J<2U<8FsBxoWDb61Bp5H5LCj85r%>G;AMLH~&0q=gAJ3*5_4OpD*0-W@i z+$~1BEMkzfp(CPxAgnASAtc}7L~x^ua3)ogBht|JprW#R;E?6zz)&^x{3&c8NQ#zwoR$JjpU4 zt=k0^w9|rFaWv00&A4Tr6kJ2CCoXc{*X#rQx_fc9L6mTF7#)5mdwt62lfbQ>*0s53 zg#z#%@DO+5hRB~86Cv6-4`y6o#k$CTjf{jAlGI$GPM==ba%CAPVklcRI<#bf`* zJQ$#+xT|5~6Q-VW{fS}!{5`?<4bBQL1o6K-E13SHb}|zy)Bk8ESN$3w)GhxtME?#h z{O|<;LJPDCR`1BvK>!_vw>=2$nXn@lr$Q2OnJjwV);fEo5TT=U!=-X~f0B;|`Ll@h zh~$ODNSng9J6v=7=I#9TF>=2^Z=;|{lD2qnuLm~{Nj#9>D6dP8zv7Euqs6d4| zp&eO##{~Mj84L~`%u#3Ma)!gz1#P)@c=$wo<{ku?>2~pe68;l8kE4m8(*4b&%OM- zn;)I;rqAYLBCn6nhn2kxy|iYeX${%W+{jQW1b5r_tUJ&c+|%5y*kKiwQ$w=F;^GVU z+Q>zHD%=Qz21SzCd%=#y#E+T!lQ8xniK7jh@Zv&rOyoeu;)J@PEGDU?)uFIn zSEJe2Y-Ne9(3ih2vEbWrQJ+DWAQ%R<{=i+LHXxmhm>MKC!9UPfZ>H`80@QhZGH?>m zkjo^nrm!UX`^}qr%yh2fYdi;;l?75 zLdCh<8)c=V^*-9~dy}p3yi8OEuq)XRUIwG{oRBHq8&#@|o6JP-z~<)T=)oHBp`1zO+Bf|s z^K;20;BzvIwRO{#kjbd>WmGCUq0joMxYhm~mXLM4YwuEDhX0V+61a1dN+xMr%8L1- z871@e1w&0#69YXvo_ zPap$xq1tcu8!^PImqoz-#Qs!$(OK>lfq@YPhQ=&iT_@&G7xCwDw+4q?Qi6vlvif>! z0%4}mC{4HAGQyrv*aQec(*Rkwh97mYCQxCl~_>mo69*I8pN=Kc3>1>g-1WcQKwzF83YjN&tdop6zjkK%GAMT1lnPU z4ilHgsSZv#fdW5zD4zV-^u&-MrNzu%T(G#&kAsJuOsl#Tn4%ZE&i2Lp;U=!U?M=HN zq^RQxT=qR$O%Ol=9wvJOSC0ZchiB~fi=DiwR@c1BS5RypMye^wM%w1^k-p@yNp=@_sx_NIp6m7<(1260&T9z@jYamAfI zy3l9Tgi7oGJ9eoFFt%dAjPzx*$`5_&zk$sL22&jMCD}By6b{vv=t+8+yEF$t%d|}d zVMvi%A7A~_wdDYh8t>s+T6yHNRQu5%@VbSKN8GWLs4wPpY=)2a8bEdcBUeA=_!9cqq+ z*2J1qhB5Jv(O+!p+n6rE(Jm5L#_$k*R~Mm`K>R2^NpztcBa{R3<<_RRVeAIj3}iy# zA&+LjI9C$5H<-L1e`^LGrE2MQM$5?kD;XWVBtf|sI*mQ)Cs9I$-3(e@A8XI>;wJ|B z*#Woh$7R&ACV~NbE1Qcr2Q|EN*Y(=gTom9FQ~-&huu$R0QBdv_NMB6y*{W$*mF+* zpwqA*zFUA{V!9`@JNYYfBQFUBboTL*MCj`o1sQCNM|&`JF%nVmDNH*eiu10a!nozT zAPVX0XaigZ7H(71fgRzN` zp`7@$R0u6gv2iWoHe#i6^#2{`ZdU+@2i-K#X09+sn7`gj4sxj2k@j@hb&V~N#R`F> zkQ{g5w^Yi5f+~;nw$nHS3PXm9MAa3tpzm-n3fn>0hDP0@Yc&+JZz0cxcNK=`0;x`l zO~1U69^^>d=O`IO_R9Bexd>Jfyj)_bD+5sItV*^qTdwEJB3@nh+oJOyc;NWUU*2Q| z`fTJWumb8W)MrK_Rzq`#5rR0JrmB-u)J$OoP-=wCU!ZQkXxhxU%Uwf)-8`guLAJ2W z(ZzG9V~20{C}H%QIy399{U@a7euHYkyJtfV{u<0{jSAD=#(JJ(R7sfFM;q+!X<($- z!-d1J>(sm#V1~9S{4^)q2k%eTC{wm7+;01lt7U(UIH+w&QM!vMcMu2i)`lhffK6AAyIjwCU{-jy_MwW;YLb0|gj zesJDoB&WR6N&|5H$CSm-l{GOKDSeSA*-!-@kfnTY1Tzz{0&eE^AZ_ET?k-Z2=B7~6t*!y>tWF6>9UHV50ORs0XgMeUT1+B21_*+B{1`RuG2lZr(ok0BhP3)QP%1~8+T3rTt?v9Vu3<3Thoao;ORU}xbvH`Cu9QI z6Ksrcl=!(H3N+t1KMV?45wvXs3G2}R(7}?*>5u%qGc_CPXHx$2m^ql~jh^jdVzY{{ z*A>EaK6wlhLyYEZ{fNw6vMM={C0iIsnFYi0j8`7Zyt+S@bi1X>d<>W?`QRfKpFTV} zJjTt2d8Jzq%1p>wGLox@dHR-p8UU%uQ-_*{*#mp^KVS%zf%{wwEjOj=_gPKA!p}rNCq?> zV5^9?BOf})h%&=8&g!>rlf{f;B4va4$2fZPgv`M@KZqUKD&nA4=;WUN^Zg%L#F^X{$cYeA* z5AG-au#+{C{``EMj1BRHn}$XJnD%K@Vj5shdaA8ZL_m0L+akZ9*vu#Dp#72byQuZR z6E2%7@QRQ;3f~SrB3pQ&kW2ZApY_@?k zo{)&PF8i0RM!LupQ6_YZ~pM=%_ghuWCveif}}-p|eiq$p`(gc%m#o_|J`VB*w69;<;#TZW2j8y22W-On zi8cC#1F)`@Xz8cUYKC+URmZAxSJ`Wu@J(`+I4ZoRRk_ueW{nkj7z$A}J6vQ>I^4!* z+SdGT-`4IJb={|IrI+*e+rC=2JO+^1d4EM|M>u&t#jUh5+nTk}NW8JX2|}B|Ugx2L zLDV_d{8HG~0`vQN!~0T1Jw?alglLAPURWNczVXUo7F#z3W>!}h+m8B6#i`}C4f8^x zF({br90R(%b-~|H$^0w4N^51j@^EHcWdO}rrIpI*RZuez-f_L{^qAYA(0YxEH`X!w z1^Ftt_DmL}w#-*dX%>l4v&_9PT_Z?V5$z4bdgt%kgf6$@BxwUc6oxDBsI7a0af1D6 zQf4eouNg&3O_tVRL;9^+Jg1HN>*t8%P_5jmn}=zd7Dsf0V9jzzN429o>kUbcf=W`e z@Sgbbka|FKf9yoJMoXM5Q?4m?uBjYzWOBuW)gA%-Yb5!oj)gTDkW!X|^UdQB^4Tap z6zq4F+sS}q8*&p=W`Sa}V`ZR-N0wTUk%I~i6(s@WcpsKYrh)x(rB4}uwS=R?kftM; zJNBJFriWe(_eIQu*F1GT2)IP!O0?9H)G%s*mHnk@GPZ|{>-xyI?P4<|bSI2qG&QQ@ z&CT&fqkrKkX0-tbdQfVN`zp7@lt$9$5ImUbw0h@?8n!{&Px^$fgW%jn(5Z0ni9;^2 zN$>)Y6Ggx)a5u?A3j!xbG>P+2COx!NxOn82A?d8fAN2AYG$380BSF53oz@x^^ExA*i^!aD2EGavM5w$?jq?R5LTkm1PVyalQe> zYW}-a&1Fcb9VS#+w}Zu7oxBzM&DGbmp$_@bMy9MY2gaicMK}|0 zDUJ)r9hSjKrwLXSU2S$%x!D48Owh)}^onbfo}6(UlB8(~XlBtWcY!?BZj_JX=|6$S zLWnc`Q>KNOO%x+{MdUm>#0xjo)IemR6c z0GOQW_957l_lMK5rc>SM&k)Qq@V5;)W3>xuz}$;u8^Ga6A@A+3?4&0RH&IZ403K8` zf%JRrd3<^TZ|h?<9H;!@U2w?KC>i#YZ^_|Ofl5ikZdL;O&OD63BU#|PO|H4aNlR{J`M(RO2oMTL=C|zukR?{Q6Ab65 zbDTvR2m_^ShOpCRC>$jK1F|WW)O(kqq)5K0ipH{Cn{$y#OY=;0l%|ezZMp}!mk7{N z_Rh<3$D+{=&!mn?@OV=WQVEVEG@a8*pq`DKc${YqH|!EykH+}8!jYh-71kjV)6d9z z<$=@6yJex*V3(R>mjX;3*Wy%A(xl*%7pSt;WnNjju3_p`ILK7}24-o{(UUD+na_ba zmNq7OQ!F1dw8;~?G>)^@I&c@PIITE|h~``(8w-R=DRn6Q;aW?w&|R|l9Yr;U)Pb`< zNEijx3um`3jy(Y7LIfKe0PWSdO?Dmh6_6_1PE)*l7pV0ZoGS;2<0MW%<`v|HMoR#j zcYBe*WQiad!Zpse?^;rsj#%1Ml@~m>B&k{1h*Y*wau3~-sm&ywcV{1Zt>_7F%n^u) zwIpCIvZY4@UJ30pjxp{b1cj3h!{4AxlnCBvx+U|a94hl&e7esq#SW^rJ+##R&McFfIq9qsKYfJ69V3pOGhI7rc{1Iw0$~9T59ms_#kf;4} z)i|Iu?!-z9w&93lDiyRm0@>dts8b!{rOdIZ5H<X~+)3kos9v?}TCo#ybYUyVkoFJ?k)ZD0u?S2Xnf+C=G5|!KL53hMi+Z zw`!Mo!cHdSiJ0I{BQqIh6MS;1>%_frJCjND(m)_i^VQklb7Q*7+4U%8lw3$`|G7Zx zRg~V9_AI_UrU5soPyp6^XY%lYrM>yb`^6xz)5v4n1ZCZ|4eQF}b#x!KuPEb}ZI<1d zzA{S$R6)(@h8aJDRNmMTEtN(tb{G3vSQuVxcG^Sa6j&&V$1{d{Gpf#&*7J{^Q^Z2c zi|F5?-!CR&nVqzHFuMZ7KKNsC>@Vz%8uY^@K1x7R6X}(jHlxu{={H;nHY*W{Yw3c8 zxZesbI7cNy$W~jNG}l`+_ef$waBE!vQ9pE>>w8OM2X}8#5HRwQ--fEfq?A>__+Z67 znM$@=Gw1?TrV;P^Seuk*DGozR+$)SOQs&K=!%6pm2iY!9uK9dhg5*8U9=88&6j%5y z>=-ZXWb!vw=85qpq-jCAHQ~OhjgDL;&ZU3ru$OB*brppCaH;7~;nh_5m;7%551bl~ zjL2d)TGgd+&Z(Xk+MO&SS}6C<%BCUv0QO4H8X0lEDPIs*LAmcbCk_Mw^f-}h8F(UH z9TCCWp4n`TYAxj!-`|ZB6ToD^w^bi-3iUI5a-|pF;`u=SXmm`nvkyo?jj+!_iLPPhdQBoojq; zNOSMo1FS=Lm_G~s&Ew~_&4;HMKr0%I<&Qo}#lajG-KC33USa(2|JsQ}1=_v4Zz&89 z_KE~~eRs+ero3D}&Zvf+_{k-4x+03gwqJL`TUhHu@s-2@VzELy9VYt4B(+wSda9Bh zc=E0rX7=QRNwLQEemcHbrUO?OD<#ND!n>D;Q(%Q&lO=h(lFNmLr2C6Uzcf}stZ6ubF#?&T@BDRvmHGeWfwISGWh^DmRC}mk(U2>#9!pL02 z4W=V7WR97Id7?73Xe=JasJ;XiJFUMW&Eu_)9^!)xH&B82LXXhBJlfAhE3(#ys3%p}5a zW)8|+SIJ!s(5eKagBz%=kMfc(q6T}3|JHUZy+HobXa!Jgz8zpykvqeFbEBvN^hTNW z0SFu8FyqyZgefFx7$|_PIaaI=pq~&d6V%^TGAZI|)Mrhff8wsG)vY$+$QkIm1gKG( zwl8cN#SxJ;!ei&X60xns87Gc$R@ex(Mn6>jhxYG>SLHlQSua!1x|3`0G)O5Xfadp4 zm;5IEa6x$Am$)frVuw#K?(0(sxsBbmb|3t1@23aZ$2NsKxLJlh&OQzCfp14~r}fse zB~in_WCifjVr$saHPR=2j75=F>5LVQ`%jZv!RIIqlc89PxSB2IH3PU`(|eOkG?hR%>N@o*M!p*&D>V?UyeEt`MF+i zzlfiqiu;#2i6jwe)YaV!E*kWPQCL33cf$Qy405LMXFx&%x!J(} zz}d&k>+a3n58uG=pq5f7-p{3ny24_=0}zey<1wULL4O zbo%oruiwEl!k_Ty4P811J==JDYS#|Qk~V(J6PWY6S7G5d${?szr7ZB(2x8j@KkWaU zWp=4?posh7HwJF*n>x+>un|b9c41eW!84QpSruF)+yq9(>V>+wJG+15l!5H+floVF6mP0OcFWl91NS8d^aD#HA2^z zW9m49jpCexi|*`!54JN{f_2@&Gu6{M#1DZ#Ce@~6lw_cC=J(v`jwFHVVBRlX4k{KY(`M_C65s?6X-^0rw!^ zC}&H;Q?oMr0ziEv0Z>zu;*u~M?Z0+V-%zlhEb*Asa7A8YN^>=K76O&CpPY70QYZca z8L0`>Pj9#GQ|i)wSyUKQPKpkcAad5qsQ^|cCMzeZwJk;DQV8w54b~ay=e|rI(zVcI z85S$*HJ=zkC=ZBj#!#eB>B9g>IS!LqAdQ16jNYjW;)LJV-bx{yU=)|)BW_u|Q z4Wr7NiNnr#zXI&uA|H^#jN*j`<@!g>gS`MwqMNuW z6Srp5*vMrmgX~)o#;t2#<_f8{2c91~4YJ`I=u$i`JVBp~p}4LsNj^){I+V2AqKZ}1 z+nFqyg+59-u+-r&Cs(z@x8=E;AxqSAc@$lT5~zU2i?3MYc8RdR{(BkU3gdOk z%5OH(ygI^ZH;C@Fh^AmK#8qnNFc_z@RLJ#JKiP+3FJz_aE1ly@ebCIFeLxk#w=u*# zmrcFUL>1L3w_JMH_iGE%J41akB2vHc2kU1|KW%K5S4jH%uVU7qPsJ-Zxw5t(+68bn zQJt6RF)nQUACjZB<1XBtPA#k|6X3FNwOtoz>&nwZ{xn}G`bOw!mQ0&Kuw5$l`JHxJ z=Opn$qsIW-<=*}fQ6^vDgf5NJ9YP>7GpZ5(HNP{t=wmvon9;gEG z)u$0WfqgG-8hE3gRirQHOXH|DpEAFsJw6ovwkvR7R%n=PXZ%)*dZm)iQrzsiDs1Tf zS--)v5%UC0mVFEnaR`jekZaLMN;k9P3MKvSiI357K*_kxZ3#jIt&KYYBNtv(lAXHO z!aA`M;ek0sgj2g&<`=<*0t-ln#lkvxx-hp;Y=k{1G1ik#!dXi9gT`M3EOTKDv0Ok` zswpW%I5|LVf^7cJ>=|09o@?U+=(T!{r6zmUh^JYfl`IKL^f{!!SqUt_t%un8*^aG6 z`V%Ml^x!g%CkZSNF$H)aeADTJfoqxfzsoVbk5g7?+NOxvV_c^Y0X83?Sv=!zHW+v3 z{%7b`mC4LOl&wwQ1*^;X5a)R9t7f|yxYe88L#bQz9m~s+P)xxd z%GqtM@7ZNal(ZxbCA2L<=o7UwnL}Rv-F|2Q@;onfVtzXywl&`Ul58R zz-k*z2fQ*AZb+VHcnYR-^YFnPEAdKG@`6bXNPwvFuzC~UE(O&kc#u(D>VKT$S6A=M zO&z7)-P_?zJ3Btzzu}IA!K$e(hdTl@XtqCy-d#=dt`NWq{(f6-qFY-S|8*9YN$I<|7_=q>5J5LzN^TK7F z1MltUNH>9N7g5AeP0VZl(jTb2R(n%yokQAT(y3*(c{Rb&-RN)tt2Dbo6y-sYzD&_#E)= z6#?U74^mG)rTAObtgK7Y%EarpEoM9#k)Npc2Ke`?M53_mYA0{&5PIWAm0!GG$D^Xm zHr82dj5rYQsiE`-+90fNf$>j4S`M9{r{bV_5Xrekd7bBRT^+Y3vb-uyf435_DRT~X zjP`N%(wnCv&od=MUFi|JOsI2}0y^)7VrfoRb=cfwpZpEKCcD=qyJqA@9w`?RyP;{y zeB+f{=~Nx9++wf|S0o7n%*B9y@oZl=kl`M;LMe$Z$N@UW{?PcOYS(_-8Zju!v1OaW z*H|NQn}chzWPTEGf~@+8n5`Is?Z}Ke`MR=1y%?GhRD~rmQnGOdUv|$&b#NQBv2dXI z4@bEhQ8NGKaI|4>2pV(Cr>!}VRGst=?<7jjm?2~@H4BNoojfA(gJ%b#)1HoP*D6a_kBModsYa36jgIzCBy#2Q za_gxEe``3xFpW;jtt_SfZIoryFw&xc;d|kB)>!7-lEe)1-d@CVr!gkhO4+@82V1r+ zQOiMA#=K{kwzYl^U6d8DI|>NFx+2wdBJjdgpU!Q|TW=cfD9RY`D@_$5GDN1)Soa z&+&PkC5xlb)O<8k+fpUyXi9pDtERN6kbAli`zJX@pm-{&4A1Uj!QRa-rZ>9U4N!eL zQQT@qx@5@`sdmdL-?gta1601$*$0wvX_ODiX{y9wxCTpWFsyK%9otkX!P?ODqA+8N zNTMg4wkpV$d+%yB2$!LYuc2P5ktyyMRM6a$d}~(FsQ5~`;8Xd&yU+2_iDpP__^a*1 zzy9GHQu>R;1x>4!?r%~vVi6~xxQ7fqUpS}Y(k<%ir={?UmyM&{jX7r$!BQp7I7Xcl zPFgKSS4YL|_|E?#4Dw(oW^>N2ORu@;&?3uD!eA^o$_%bx(>1?W+g8yI>4dNB?|z22 z%wJzVz2VBTS~!-9ZBV3znFRt4V@;SVW4eXa-~<=^GEb*Ft~+^SG>3~*wN8eX#s*$u z-#E%~g{plqYJ2E&+W@BKwrwT&$`&=tTN?~=L>>)5){=KVa1FuQ0Tov?e{~uH5?BPx zOt7DWOghG*Mx1?Gfdy)ln@Bj922)A*eRz!Zmo!Mi2%I&NUN@GS;TZ{0;e`h7QtR!X zwnr?V3t`jy+bYfKh_~awXKp5fDQ?k~gKEfY9MXUf0#nPH z`_YEum#p6#Uc&YvcS-+q*@Uzy)3_|_w3l@tvvt{g@&UW^H&Y$T-(Es%i^}u5g+He4 zaByT@MFX15$wLyfM>G-1?C18hC~l-JY_{dfA!Tp@aShA0FrR-Mi5o)|8n{bG?p;Wy z7=b4!%eL%jMb%|-!J7_AftTt ziW>$q9v8wpwS{l_?2gm*;E3gNxL&MDs!A?h;r+re+5)zKx0;l(R%-DvN^_3WyBrIX zmLjlmEc9iZW14thawHq7*X@lv0Nk&`+AQ97v!DweLvYQt#F1C437U4e9X4IMW~cgX zaT@x!FRSk>u49r6<8D}<=EG*P@IjGJ#Olb@K^xKQq5WCHcwe*~O|1~v&h7$TyP!b5 z6C>puh&%fRv-CR^eYi?sid#fcFP8xHw_%n@1J#Ij)1Ti$-PMQt>#|tI#od0RDLIBU z!4I01>dRAkty;z`4<|BzfN{Rl2$P}s=G$z#bUWQcM#cuwuj`Bjv8-s?of*+pXpY4E z#mW4F+*XG*e!&JRpGaWxhynaH@hu-5@ILzHoAqoN93cy9lp*?|MIit_>anA%*obnd_c8LWfIb<45e9uSbdR}i?Hu=M-FdGO8uwm+xSb=^<(pAj z-|yS=^2wcr;Gij96mBzj@X0$G6nsfUo;XvXt+~2a!y~^$nTyH{A8o zqf`0PFS4-x^K*YQQL{s6ORU_8P9Rf=LcL}AmRY8`Q<5mY{ebaUqt7okcQF}r+|rYaU)R926~D+hLAdFGX}Ns!AD&3N&| zg0@R;(0I-+Qx_ryUh;6L2TZezDEfF&g<;%F5-B8Tf5FesMM_kJFU$I(2qvO5%p$Zu zL?8V6V%bFgyE*)t@q*VsMuJ;q@q7LPkbLb)ujI8oiF4Xy!vDkAJ2q(+HA>oD=(26w zwr!htsmr!)+qP}nw(TyPJ@w3&dC#2pM9dG^5$nT_9XoSfnMv<#d#_zX#X`T4M9@=c zw0;Z!k@F#o2~TfTim68T>{PkMa(0)or|h~@&+Gc-S(T;JONlUQURgNgxyUV5xsy_s zdXhAgIF77=H=_rv5jQEN>0<; ziXvjiFtz978Mnkp%gvOb2bBsIQPrYgH*6K-#oVh}OF&XP^d26?4Sm&~WhVq;TJy5O zjiO-sMqA>0ERvp;CiZl|j~yCA$^ybk%Pg?JZzas82nXYjiQ&^C9Mzt7$K+22)QJgo zDG3d6&xTvn-{mj`AsKQ&tsJ*Dq99ShBzw16J83z=ie*M2mu!rG>=}a{tki6fuXF;%NOi08uUKy%9K(w)wLMePk*qukbX z<%JN79u|ZRUOD@}FM{lH_5nD4Wq+q`PZrp{zCdDE^BOK*d&-{(nUh8`DfMN z6s&ph=`}73Mr4vM?^c8;kVAMI(jX2)fBWfsuRDiM>3;R#XOGZzTQslohjI>+U@vkM+JHO^&rG&QOIqG!ivshS}B2pE|qIQ)9nOWr6{}ueypqc**uxDh|CasK$ z@F&}jucrJJY#_ecvsh0k!^EXs=LtksOu$1kC*8w4E(8}-uz=iAO~{eDHmX*wwnptH zD_27K_;vXT0~0wfU)dAkI^$rohwCC{uCcNLa^?5b(H>hs?jsUxp|)FH2K8y+v?mIq z;l1!o$@Hw=SWiUIvQY_fMiUvTeL&*_bBu%GQ`tj#xF_^N-w`~5M=?;o7YPy8*bOSU z?Z%tz^}@abBtQUF=o>|W@GBd2*lv%SALw+cO1FU?PCP(MeI|u9_hn88xZ-MNLRjBe zu@49+>2Dp@UM#TWE9UoFjB8ohha`WgMKGZk2Tw}yTDIzrUw|Zn0{60!W#e^*Iwq}E zbEjZ}-|=TtKOvWZ{HXaw4v!Wh*f0@%m6AaX{WP|_N&YVq-KYKBCn|`^yK+b^0RM57v{GBo{NC< zP7_6>hgA2x8fh}pU%h7J$BI+`kxG&Swm`YUd{C{E0e2ST0JN3hz=Cx4#kVXqp~(9CI!6A!hyE0zRYa-k3t!#xHg>%$>?F^zFK}($KUz zS1WmfweOZ+CjArw9nA^Wk~r3pTeOR7JBI|j4t*%R)t^jeT;ogo7M#kOo3HO^=80D! zkV#nc$di+!*C@AsQ0Cpb=aos-NV^pY`7ur`5S7!h`=V5+g+XxV#5R%RiEH{nm-0yRF)REU~G$Lxd7MSA5mazz!q{y)Rg1sT*a~IDj8yF&pi2DjaQYA7zNUCf>2P zEQUG`6IK|@uj8F}v8U*C$~ zw6(v^DAB}}oRtFD<;Fy+Ae5)|sgPD>-=_TTKx4HwlF)yvm)fgREB-5597Q`oq9_(I8Ra8H>VdGMP6URg#XAKqfkD~uR)Kf$vzvg^{~%TN)d z?;;HZrSGGao#KoaGxSHAMKHE@HI$QSuV<0s*(R=3UxzBs%pS zX#GG%eD~Z{y)?l#@Ek$lzjxFa-yScLaIVZHfiC zp z*FmNMGF5=m%oDY2)xb-BiF@BqIS|lWA2^gaq@7?U*QpGquLQk*ygO2I=rc30`e;6t zyiRbQD+VG_5jit49=7tS_rUh^yAD2Y;d1^!1NU3|M0p+)57uhpD~)8gObBT7{^y51 z(Cn}Hp0!1^#u#c#Isp+$D>C&2CN&R8clW~yo*m7-<7A-OP3VD)b1HfKk52|R1}n#3 z&}>C-0@IXrj`uua&TH;XNVSO! zDfVI3LxP0w9op4kDNWyIO^AA-pM~Hp)0Jg=B&GAfoTZeu^;=Tf2#>B}la_}ZS)10C z@dYJ_=sj3sjQ~Qz3*4C=P1NA12Nj2pdJpU)jjz3A_^@ZJ!ElIR#4S(yfMLW@wZqOk zDjXNE)y(UoDj~GM!pN6IPl>%`--1J@%uTyEX*F9@Nytjiu+j4d5;4n}$mLoh+`{wQ zQe21OjZ-c09Z7@2+*_fHPGO#)m0Y!Cg>suo^k&5-hL*(7BLTJs|E%^oQ7p}f*|9~e zLic`%b^-}swUEjhlfZl7QAHC>$~Aw%0Cop^eTLb8`#{iJi%`Zm0uJ-fY^q}R$MnQ) z?&DAT0&dV+P`B2Pp{8F8ce{dTv%TL}^bzZgy#HNqG5(}(|DUcB*;xL|F4g}QT%BUUxU#ZQ=~*>d6IUbtF2=DRCoJ+2)p{Ps;%DojXTTlM&#nJ)^rQa=^5qJ^6w z-9C17H*X@X7m=R%eilEUFn0dSQHOC*V#HzWeF>VH{7)L>@Ld~MzD47m ziw+>L%bjd0LJ6>V7bLa>4cethBHuF{v@d0EWTXL7LMN9oM*KzH4GDsrmHekD$ED+I zmz_H3=HIN~tY{o3=Iw_YzxJpzi8&~`92YY|JcfhjFQ@z8i&z@aUn<=1e|rYE&`@y4 z$$fT^d#qM9#jjGWW6VFl$DpL$z!SCuHlVqNNXUy>rl|O*C4cJBf-qAig_}v&hrouq zpYy9);5Loj= z8MY<0FNOTerTnMCz#V-3wok-Y^3o_x(;<>`#G39yNYcAp!A7>FUUZyGhD5I_#g}<_ za@uyiUgvpL90V≫gKp(V3re@VI6QbPnws#Ehi+a6oFus)*--z4m_<01Op>)d;!g z!iXQFelyD)tbtC-BnY8uhq)iXhY5kehjmCE1fh;Y0=(748kzcV8771aKs zGv;3~LeAqCQ_gvue+-)e`7w9ZlYA-&Cj7(MW^zidMB0jq{<6mhw9{28vTxK4y z;1(2lBX$Jzf;d6HGpPSu_?|(g`9IGD_`fD+_$MQ zM6O5JQzxkcC#CDn6*vWMJBY?)aV(A8%zXf7GBeI1x&mdY-4*64X3aXbVg@K;vr}u zk}IPABN5U*A5$lbJ8qW+Yo$S+abKBp7~N;Xp)n?JbqCfi&y0va0A4#9Tcx zo+}$S)zAP!+Tj(OqKDixM($)or(Xc%z6LtEqv09XG`;hDjmruf!uX9 z4%}Et_y>>_1~S8#CzZ;UhJx6!d(sF{IJyggIua)nih<2R8=SURJM(+dv`oyH&wC|@ zzm3^y5f4j-%8usSic?D{3}9VkZQTMnjqS2J1*fpgPFb}_VFE~SCZyR;z;6PBJP*WV z>3iwDXegDe8J4_HON!FfjV+qo3INvBo^gb9(G^Qxq$;BkTd?2MQ}JB@F-|`4Nk-@T zR(3q#x`Y_;hxn62tI@bdC1wMlYACH$0o%;|D@`8)I2356#N$u;Cc#{tjoj z>=A{kG7^BZ)(gp5W~L_}ZekLYQc*>Dh!2P>2_Kc5aO9{6dkEubeaVmZH!W1@ijmky zb{ArsO)d}Q_LOO175A~)oif>tZO2WFQj#CG%kP&8!pAT-{}P6_-LU3LNA1;#4DwOu zb@R1f)P^G#N+g9$vJI5=7U2(^qloB>{jkCWqP;|QezaTSVy($BW17rps`R2cPfkclCNt{=#DPf1? zSj2we;)w2b_?3i{6Pl5xsvVy;|2o0p>JXIlLUK*MpgJ>bythXFTatpqBG{*W6OupM z(bgV)CW~N3OqEA-&WEtrCUb4$LBViy1pWXYqsW^kjO)Gm-9{@}94pT4_YU?-GLB)2 z{L4}28Wu@o%fxnZ;`hzUQgA~(uIBP`P568dmySK z_MA4^92i7Ax+c$uMv1-|yhs`qXp={6S4rnwb_`>c`{4-GOH1EfO zayM{h1ty&*xKxpYb$j6%*S!u!No_f>R$X4)F2;}}DEkSgs8{=*t6&STOs?271lo(2 zDUarucUq=zJobW#``A0;w~9m2@5L_o3IFt@(|o3zIJaU4Edx7~ zCI1i|QVG*{&2-#}*kjkR%43EuK--3jn)8$jDEU~uR#68;hHX_2|MYrdrVpDlONWnN{j@TNyYAqBrF5i^h#B zs0}oZ)JHa>?M0^8t!otnWzL&Zx9tir?W2A*tBw3L{jDlB90eWllx$^+7LSGKj_>r| zqvb)xv@a{bTKI`+vToNXlxXdxSpHtV`SlmX5^c#X^l)|>$n}n^)gcsl5rJ4F(~bzF zP`9Y4PLVJ=xagb3N?_%N|K94bKMIO+)I_y)5X zDj=jY7?wnH)iXyPVbusE3h!k-_|U2Eo+O=v#gfnLZ6fRRUus3dRJ(0|6#0Ck3t%V` zoTrcZq-_yxQKzCGuqaFKNLc;a4_%ZR^LVhdl z(s2fF-VV)^fL`+P!wT^jBo%gS#LIvL>Zbz^4N;dvGK{s7*{(6)l3fz?9#=~HBJ1sM zkxK!9<+>;}RAr9HXf7pewB4)O`(Mn7?aLa#fDG zHn;;wPY#ut%cdczvecnS$}T3!@okJeug7#06UcI-gh9&mwuK_wqz{;Cxpqjmgp9g4 z<2Vp061YroMA9Lq8S(5!;$vv3ovPp1csQ<_KC7!thw5SZ1??^HF}YS%MX4N(Qy&tr zBNBeD73|C8zM1FB5(J}ywZLyh8FRYJA^Ri zgGJ6T+F7BMVpZMM!w5#>L}FZrGIRb7>%C;&Pt+P6FUf9uOJ18X28k!b{AWgVZxIyb zjGh9GR-Q}p-Z;E5Z-fc9iJkqgmZ?Y5_II8DFB5+O*rlRUH<%31y`gaGbY zsy?`@Nd~d-s@eHW@#V@AKA#l~jvaD_tLN5J9Z=Pzwa z#23~Gw~wR<9VGsOE_478vX*Z6pacTt&fQP~@7wS|Ew=HcnFq^cdR3F0rf%bLT5xRn zlj+dhjd?T<1z@_+x?g&53~(fC@Kar!>$vD{kry|rvqMW@S9iZ3eZ{NIn*X~3^7cF zzT4rovMwfoB(@ic=Ss-9d#&xQB~%oKzp}atBqUd@XCM;wGIL_@z>fZNuF@a5ur9t5wZDiemh}1<{M0}pt(cU;=T6w>@H4|GA-KDj8iCCsL)cU(U4yW)2X3MnrgV@n zTHDoXHYVi2)A(2sr?g0_D?vL~$R5mcoR9?+3|;G22{=bJjBZ14iK4q6+6HjjC_ND7EMmbNo?97zpnrZo6fq+T zy^}#xzNd^qRZ$47Uy==2a#wNYTQ2XyaQv*C%Q*q9BR&}V^i|JWetIN){J6) zucnb*0Kt!<+V-J$9X(1!qv1uNae(|QwwX(a@qs2o%s2zyYZFWS8hx5r~a3&BP&UKRaGYui~L86f7kcBrOA>T+ARSopw zRS{H`=nIquHH+{|B-g>Yde)WK4S|vP0(*fM^$|17K1L=C<<$A%2Q!OU!#O~mg36L; zNVFxGjSvC~j+nOnq>Bl(>>)6XVF>0$TjEl(B~u{L)?MRzUAd>IokBWm!U|0;W#I+bW{Gc*}W4 zh3pCiSD%ze!V4rE&vS>)D;6LKNgsr45&b9ENQv|$Gsn-jh@l*sAqq4RNs__JaLftB zBasIZR7AZ%mYw2}ELj#faHj}yiIGe~DzihO2uwP?N7Qy9_lep=nJ5}qh9vnBy&Aei z{%DZYgXRg0U=KV22d*V~qEr#kLt4VhI-dz9V^P3ft&^ao)Jf(HbCzw5kSyrL%AWf$QlI~OhT zdVMM~zV0_$HixcnaM*tR8@=D;-tuVu+`RXNzME#BbWzYYH=ebU8!~2Fa>BFHgPX>gL z$=Zoo%v(%GeU7s4eroGAec5X|^bBR(Vo|JC1;zLw8L|)-1DXW<+c7mb`R9CvRuHS% zV7UBbn8fbk>W!s3YvHbgq3MQj)A#-ieU<9ubpzzq(b@I{E{<0xz&0?&T3*M%HXKWm z-?i2OMc2vjd zNBfqE0i~tnE8Df`_R6rAzRT&>H;Wq@A?APeD(`r?m!fW~daq!#Wm`KQaU}1%)~cE|dZ)`@a4`#Y&Szl^qBr|P{LZOz_sk5j0CxyFYd zb#OfoTd&Gu49o>T@wrq*40U`fLKpWvfrcnZL~)$lJO5|P+q-fs%uz>_Z{)4>am>f4V(%q# zT}9K->8>Cm%P;X_>Z%L7l?TpneOiqYL_dCVASr`06SzF;ITi+VWgHty08+ENAW0}N zqk~~Vz@7^Vmf6JGfCc=5KDwc{gA$hSX&L)x~zpQE?P&Ur$`2u zoy4B$_};2=9G2ovcUDw-yb+TiRiC_QYcB|L9}Ozb4o{emiBJroRHP^$Tkph__(B|$ zUX%3zidZP2F8m@Jrd9cxCdh~-fXYwH?=FQF1F}8}ng&S-Ivvi5lK&#&8~JmljIB_t zch97m97(sr_*k#MrH=cp5;@eg9NMOdqwRI)TRI0*I!MHJdHp64;W`hWzaC_>IC}!p zK;G>Sj3$%Xqzex69%&1IjAs=wv8Y$bJcZ#MT`1*c8`PE@*m6GbRky~kYOvNS|J9=f z!zxj~^Y`FD;pWf)QnD9LNbzqDn_;q1laaJG{6vwr;fQDq!A$;_!m_i(t5M_YChk#L z-5I!vdza(CkhkW&bOV z?14*02DSJ}f`hP08?-ntLH#O^#wYYp=f)7@T{lV?zmw{@${Xs75!T(o{LN-{KUUw@ zhP}Qf|j*Kju0NlS+(R5isLMa>o-;Stdc3oM6#Sdw6k6q(7v7k4O}Uh zOud&QPt09}zJB}(D`{2=WfMeVQ2Br&%1C8ZU99fMFM&ut95`k^mpTSYT^T`M%4(og z=30lf{!okUW^Ye^5@!$-_lsI3^i1nz5eDN%-RDe?n2f<(5?_pnZGrv4)*wgYdr`rU zQ(64bHC=y2n?Q6sO5KI+0Ab95{G=wh<3QD2;RyW76B83f6b^z_w5`;JWESP5Oam#5 zJ`+A;Yup!aRqKt>)Zc;JfI0OHN~X3g*fJN0<Fc<;z6 zP*pjrR$$yooKmJFnM-;BAZo|L&o-_Ww^f}k0~T?DQWb1lS?Xg*DI}s)0C+db2ZPO< z4_#K3uNip_STM9>8T~p+5c@qg{+3YzV`zA0J#14I?zSQgx`x>^ybhPO=4}yog*nCI zM<+4L1uQsobAJ@Rye3T7ETP8TA<2RmLsC(UypLoK?CGKfrLFNlTaesV!mZVE&f7C8 z8)35XT~z7#oAf{{n;$K zVTyRJtH{BVxh%GBCao6!OM|ehO?0tFyw983J{B2UT2&u_tLXg9x(U;`RG@yG zFB3j{B|-*fWPd!;xeOxpUB1~aSz-4VLZ_RX-pvO3rlL{>1j~Auj26w2Qw}Y2lQVk7 zRl#oa^uv?@F}}e3c;Mtfc~+mPSYl`8iubbW=3>?~o$;cd$f&VHqP1IsLCqLPnqG>i zW(lnWDNdt_Sia6M*HS$s^Q9FiS+RlB5G{9u{(yJbQ*H+aHlsGHxD(V$OHun&^z|)5 z#+BiAjSz2_9oDBTR~yJ^*1RCM7VG&?qEdu=HM0~2S#yoy>5~<65y~9q!C$upPNr7~ zG1H`guSMj#?lTsLBZ>}}epb57b$i~&&NW=L7kO+95oVu4p0Gx)!2(I&!L}q5vF4U= z*5Jy6`s{L@a&t`u$=ve>8SXZnW0ua=s{-iK6Xfd&3HCihCpaGd?T#NBAD41sjFB`u z7PL@tq^!8fjcWzsftGj~juyiPF-CQ{nfaJH7~o{3IAGFx9z@x@uS@Udw>975y8gY? z`ON}zInxDaT=fRT;JI6Z>8&vFhEJ!}p?lf&wS zF&!~Igr`mA7ZGzqO|&zA)3(9Mv>W_Ns1h;?NU0J|hIuwK$2uMyytUPzi7VhJmqn%S zu&q8J5YxB0ocCZPW{?=*GD?^N!Un$VM(3@QCR*RKSCOzC^U2IbMH556eTGqUd^@h!wb&NGGIb?<%8LIW8u)Gp2Tw7NM z3MIYZTh!z(9m|)!YnJ&$ycv`aMD^r)__O2L4#=352_B`GC#gyRCHHU-wC?t^?FH8l z-8(7WGpr&NPoSF|9brLq5e!Ccij^&&z+gkaZj1~uM`7n4< zaRq0o+?npUZbD`**zydE7${Pr~SxPc{0%@}SpZPDyIlWf3AaPMsF^ z7AuA)b6BSg^*L6`=~84;Y7trCfx>5MrB68(RK*d9g#!IJTt`Ryaba5^j z>aAzPocgJ@6<*4<}q;mw3>N z84NdY8X+5;;U6$CPV*>>6%of|NM$GAj#JS8(5M5Z(LE#NWzlO-xe}nf$k7ub3P2NE zDj(9DEVHhcy2`MF&&pC)0kd`#@RW^*mzD4JP_g+nWSfXQ*(~e`N)-%g1%^(0Y6?E; zBV|v*8aJ&5Vcp7&3fmAdaDf^e5bOPrG-n(D`%BIE&!wpl zr7ccp+B)@^kjE~OoZAL+_(tqajV!L&Y_`S`ON#Tl(djKrr))!a8q0}YHI^-Ss$qHF z=7i~z+Gi+#r_2v>@G89_wiQ_G)9W`O_lfbW9{^v81Zid zNl98`pOHFs5twu6o6rf{Y{&h62Q%wALs9kg?;hN7xg}q{kpQ@&Q+kCIa|NB;(jr&k z``Y8>w(=RD8{;9{#HX`LmbNBWgc3!>>7OW{(!>$ln9)vo5|wBt=}f&OrqoQEn~LO% zits~M*_}>>XgM_vDcULNW>r>}`kUN5SJN)CJ|h#4TEUHBm52psN3Pp_h2cM};WB!S zqV#iSs;CU!jl!NBLl&<(&pTmsvb0~>*t)x;8u&tsQ%@Vev1kib0{FO_ly~`?mT5k8 zm5%9ZDL%4GGsx=u~r{JneD;BJX#63~AWf z^Qjov|8NlV|Hsqf-4N-rmd+*n@PyESq*RGE3HKDV;P(W8RJX=~_2Uf$bGzA`*mT6AFI(Poi( zoF$6Q+*Y9RV^Mhddhp@sl^69^fnIaO=xX}!+`&hij~TfS8!F`Cj;^w4a7lvu8?$NX zGeU@(uh$k;x7BgRqUX-yL`>BU-h1TrYjl=gUB+Y%(?{uYV|}jd(XvL%S@t=7**89O zyY=UPx7`^TSs4G1@BTkq>&$E%|7Ae({|3JV!9kvX^+a#84}z;oa{d?aD>_7rinbrX zkb*9KavU4kX7@@?C#RPMI~6*)dUHEMfBS0v^qGpE%KvX#2h`Lb-2Sazr)Gd*cw1D0 ztg7qN?ej9wG2bS@*RJ2&^Olb0oY9aNI z8%mFo02QnJk=q{qcAA{02cg=NX!i_&CBQ$#-g_~6pAIQT6u~|audyZkrb&j>yS?)! zHD&jviBUUC_s=Ku2mIRQ|MvOc;FknjWHdi>`y;Y$8nP?k`a3z7U-UoV*WVlk@9)C_ zmD`j1UKgPl``3?`$d(k$+KJtN?Vk_#ml;rvS9h`cW4ZsLn|?Ek86BttRT!ZV>F;8q z0s5iteTn#c($U(b`bp~Cnt`7S1cy-;Z}S~)$rlmiir4mRX`VYa?{kt5rvC=344Og}S z^M#mFu;uOy`_;7m&LfA)n&z$A%L#{Nn#o*<6f;C$B>weeXGj-KmLi9Nt9@09EYNTU z_+x|t&P7#jkJ_qp+!n z3{>+}7iJw9?Idfz70`o%3Ti8=DRru@{JT&gR3QPJxKztHnafn1E*(!##LGs|J0jH+ zwSLoYA!`*|&l*o*7%JwG#3E+m1`2`ZZpQp$5z@r9l zoO(eX6k<@oZxSh1%FFy zdyX+b=XW1vx85*v9%>RJc+Fj<4W_=eHbr3b+)jOC;;_jwQ5`@`0^@kmPyC6zL3C8- zDuh{ccw;4ZiidnZ&}>e@RE(S5BCAw&7nRiKqa^V5sU`z3C~}5X8wafWA{-oN-R`g! z&xXl7VeoOA@vUn=NahOmMEPr?q#x6MCB1md_AaicCoPRmagn&Zr!uZ(_F-+yYmOQ_ zDmx78t^w#GK{Tl69CpPyZ=rMO7V5yfU}HkSlpPy2@`>W2Nh7Zt+#ye?o%uuC%1}~5 zS`a{#R7hVhXu@RCT2>u0D9Kxc4Gy#|e(5zE4m>k~_!5v$qcu+Dc{ao*I#} z1Me2PHu<1ojko>KU3u}~TkxP0{TDGA+9VKbg|a|lnsnTL1UfANz;J6XY6!zXF{ZI& zjCJplaY7ET@tbVu%U(7Tcv$V?DuvFxq`W~GGt96^1(8|77>%QIgd@+4PPJLW-DIP; z?ujK}rQ+bA(*<_L&lr{*0@^;s4Pc%oQ++@~5Heca3S5zle~LF5!PZk3D5)!-oE2Tt zg8x{sc2%%d4CAAlxdFtgW0+ddU!~vQsMBk|PyyV4SMGssi_!F$U&P_1KqF=~6`Q71 zR%u$-xDCffw2F3E^T&P*+~mFDzNr<=c?=-)ZN-&MGitB?T4jdzyZsM-F!}#Vo%*tuYG@pu|nYQ zHl`|r=nO$jC225!@WH4AijvhE(33z_p0sXkG;@hT2K-DrQ1iEombvn3F01ZS5l+b+ zeAJv2_b{R1gf$NqOBvSm*}^C&n0fHV#yj()eL?@KTyeYwDl$KT^(4Yj3aNFF_R-qGA*n$nEgkYCzvUdyvih^dO15 zdj2KlkrP@hd6;V=hX9dM>=BffSP_Mm?J}zF)A`&<06r!kc7W;dswrRDtKFdyx*FIK z^wLh*kY_QJ2}|OD>($h^suhZe-Q-&Gd^vF`kXYGp+t9kua8*|)KheEh+-VHMXJXQ& zy^(4Xl8gPFslxDIvJU;iOa+#xT58&XT^#b_UF7d53mIoaq-4;`M)T^k>D0n$cyk%px9G(igvwJENr7g z{xOG9F@rA5WJv5`$xtYpi#J}yOQKxM8X}szx9nSK_K$UPOc+dxv+cNOk(p;XCHh2T zJQ$v(^0QJ=7D;!a_urFFWzFb4TR~QH*+pgg?$nYgEY|yu$k?!b0f{CvdlO^*h6jgh zWXU0g4t>#pR^q-w9HN(Cr(BS#Is>7ad+%g zl3J(Uc~v`wHb#YTIwah^EX@hMBpS-u4$xmv9w_hp$)0d2p>timLYVVuGa%uuO}Z}p zvx9X6$&)U2c-IItIAsU<72&_Mx54ves1kLI8dp6x3JZ{(=iRjCM^6Fk5%3XHS~vnA z!%47%4(*IUmMb#c;9*+2{tAfEOYQa)rN;Z$+Zn=H;YWxci_Ihrn^)WMOmn&iI8`x(-Ik-dl`vbeJ2;+&P>0g>^-M*7-%eF zNMm%6!%%we9G&WoipD`KG0ZvY>^=D67QPzw0Sj4?nPOYjuM85Jws#6r%6E5ej0n@T z&sQ5 zGYpV0FmPTvd**8XRSCqDc`-0@k`Ev+OE7pj7RjTdu<|Hq!pH~@0XdRoQA;!wTd_QP z=B2k7ov0ppD+;dGn*JwZ_q%vS+ZEP$Ynj;E~lEVu~P$~1b{9?T3 z_tB}Rb;%Oh-^RCm|A*EzdPI zI?t7I0p2-rRzG%Q6nmE-=ImnE@OCwn^W^&=x|mIxqJc8k%e8WD(C6el6DcpWO_2v0 z_!Lyb2VBQ!HTBtb(He(NCY#OxV29!bTR?MTzMwsS)&8W)oztMzFX1W-YzF^+G9_*xxT!`=UIg^6A+sSBxFzAEqzNiVlu81M(Sd2*P_ zx>>G2aG4gSDe+2$s+Q;HuDrsU6PRtav#VQdNtn(|viYO8f7S;_t&9k@ezl#}_ueuB z$42Mt*x9SWgUau28z{xlIxSrFpPMS=dA{N3I_aCL+PT_w>Dg`s(B9G&aUKQT0^r=& z7}e+A+@9bx|60KtJtJh0=Y`JIrd6a8S9?e-OWsn(x4xNBIed%KZw{+3Syi<`b9r^J z4#^|f_0A3z`DI38N4+BJULAPoRgu&fEka*=XP(n_7fs*GcChId=zK=!4__}tg{ola zgD`BB7HvZcq_f`u2}(w2l}x4XjSKLcaHuPM$Zl`O2Ng#iGdgPr*}TYsJR@lH>?l`p z1{o3QWnoI61j$HO?eo^G8r@$`MoojC$H2dAV6Re^@lI#+eAgRuGuFMQ-_Jx zUkHyKGlj#Sx6O4&alKcw3%Fh8h}EN`sBtaUq*o=lc`N^xKs=aaZKSs`Xca=8g`b_RUJT^;=BgI1U8U{;=g@1_4hWbpSZ|9_H3Bvl#z zuc;qx$yn-k*q+m$#b6D@W@xjYIzmi>R>>XOv3{G*lLSr~y0?#fHjDD&?TXM)pO#6w zh=ccdL*4JTzTiXtHVymw5$03++}^`r{o9+?<)4g_&i5y~H_!~vi`{>uYF_%$GjM=E zVk-WuueTlCJ=kX;i0fT4ben%n?%hvT=+lAhlozB%p+VB>GkI)STjdYj_1I59shf{r=XDjo6N{?WS10XJ zPXAjRt0C&}beI08!aaK`_n+h2>G3Kn>YuY4{9Y&gf7oUqi(1V?wSFaqCc-^BKQeVk z;Ki4OUoR?B=Qo2tjUMct9!f@O4*PVa)6~J2=2*deY?R?~*BSS^ z5d#pVRMgZSaq=X z*6wS|jB;L*Y*7mklOuQJpjJdnwn?Auc@^MoW)jT#Sch;G+NOW)h++ZpA@}ngxyJBT zB}zDT>x74kg>z~GRO3i)M8fwqOqIz1rlXw~Do|0=K?MLvo4_H0N^8^Mc|nyTC-el9 zR88e<)z=;`bhA~Y>qGA{X%Z#2JkNeHkCy0zI`5_vPM6UP)uYmIJ=&SJ=LMs*0BAnm zW@JmM{`eg&qfd<|rksJIW=ag7%cY_UuZKE4URd(bj(&99SNvegU)bo9sEl3%bWDCT zlg6md6u>)UH6@T!K&dxYx9lOY5-XZ->f2adLrUv|kea6tCsTd|s#e1ru6js>8Fb0J z>-uK5fec0q`A{7L@utn4phx^6Xfg6P>lO{h63+}WhD$%%31ZJ>Z zNh5b&nk9KW##~V>*i=D4ad!&!_oOE=EjxI)rgEaBB$> zWw^guA~&_8n&M{hO!gDcOWI}?A6|p10 zvf|$D{B9I@vizzyr+y?IBV2b>-|9bJmo1eNVm*w3)lUse%Y_V25!-~FUvnQ05p7y9 z4My=wdTAl=^4X;hK7lwy$2^Zm@(vj(f}Bl*?h~ha#U)E!{lJkokenPuC=2!HPT)8} z&YcTZufi6m?Oc-+)4xsOk3E#kh0YrKEV3cwF9i^U<8(2wgPO!v!(I8|1;lk9L>gT) z@F=xa{yt<~!#(C|%fpH+Zd#6^PH*ecIPxCf?#6f{bsCO}Xc;AMdr}3GW@0$0J&%%L zYS~2(y2wCL2$aui9q!1_gmCqIuSlGYo~TrcDWNlZ@AMQ4gzT-67iFs;F#hqbAN55) z|0ZPAB}$vCv)+@Pw%B+nUfB2cpRV-`R&CO%o^m}~_gOg%1>l)~_Sqfg;snpyvz3_>j}a#JdrQB}dKw__O-1TL!SNHOuTMsw-6 z@QUC*_p^%XQ`OXWKV5zqRN20h$=0OobW@g^;~Jpb14mV-xE}A7;FOIka33*R!a><6 zJb{k1H{f?H{SKm3?k)Cgd4(FpIh;)dD_g}%wI@+X--=^c>5s#?>X4-3K3dJe8elbH zEG#G(aJjYt4_SYICSuan;}X8PH^P3R4E8_$EG3B$)nTzEOaxSsgTO3GkPuLmmvHj7 zVA2~cMPe>N;G{hxMEO{qOyx(Oh37!QBpH#$&)V5Qr}h70A5&IJOqzB0+kO<(H;Z=G z%e58}4e*^BvyI-Lv)aH=Ad8lEK_0+focpd2p?t1UOlue7<2g|)URuQNUDT__n z_?z{cmX@zwYAygNqn=q&Zbyc1yE&;M=zhHtd=)OQS?oxwXwgL`Yy-RLd)n>fm+T;! zn`upm{n%#)6<@5Upr)leg&X@XcYWg zWnU}Qnmv&%#E{MPR_3WQQNrj5x_iyJ8H}HSutXhvnNUi4Zx8bYb*aBju88# zH39f(%$SXviTfWUmjPzqXBQ2Lb!MVGonFSUFf#ks3&e66noPb#MNgbl>$ggI?RXg> z=Fhuk3#d#7W*d)Ah1oFMBO#_EHIPeX(IsS%3Q?IuTD$eK#i_DgI9&mG5w|2|V0#V{ zRGC#&>!F2!!V~2WKFB1a^=~~_L&~V;%XqEHx-g)mqlax1L5f$Ub$u!hgL9}6B^eF}$zJeZi z`snC=P7#x9YC-^G1`HBI=y#|`UY-zhWxhZY(+4Rr1snNW2Li=7#Cv+Z`|u z%CcuFmL92wGLr&>h6R%77~MRX= z!lPBw>@yV*zk7X#{QPHsx#o4+S(+em1gQ&)sx^%}?+>r>>?HIyN4Oij*EOwg$S1K% z`N`d&(ALLS#o+6oa7=T?sfFjL;)w;(t69 zwc~!uRvfR-W|#X?f+QHiPO5ghAd`!klpM+WgNx#Dv%6ydr8jWI`S~O3*O46EpI{{nxy3c*wg4> zDwXJ+f&&+hCpXy?pzuIzx%^1qMw>Z394QK$94iaVuLf0a>?a{Uz#pZFjhbM8K zK~BU}MSDxV6V%zzDFtXs1$QkoY39Ne97DwQK{4Z);qbwl_m6miWe0-%_|1Me?k4T` ztYlR^*j8rwyO=S}HFx>zj^BB-}L>ZzWV~w?>=x z*Z6$p$0w2X1zOJkC;MRL`7hbWe+y9g&OQDIfC?u!=l|73o7S^&+UIus%GJ-0Yb-|v zc7c~yRjk!W_3)F~APUJ})5Q zBIFetwi`!z_d8Ny%E9oDg^VE(E{a%%LU+&7dz)a6*z>Q3?B@^75y^_vm&&)zx)*Q` zgs{F97WJd4alU-lfDF__Seth|2y-6-*-URuFm>x@qx9@8MKW~k8Ol^Vb?uFnMpgs) zPH%>=NS!C7#QN3TNioRD&Eyz@=V28*N#NlarbIM@95VFAbc0!2M0 z0n88N5xB6%)Xny+(7q4L<#`l1e=`j9Sz8-Lak!J6(5;vgw4zbdslf8tsi}fo*riG- zlIMaIZFS4?z`o@LmIJ8rMf`stldeiPC>kOIib3mzGeMFOCW3bOk=FMG%rO}ZkQhy< zi|5*4MX{|WT?`lj!!SSi=e@21$wSv+F`XOPGk2%~u&^|<;775FhEQ6#z;q$W8}ZdV z7XMTaVsd&(dW1OkSaeXcDd_S*+jvzggCYFxG|rPyTZsxIby~%2LY8fwWK;J2aclhe zJg0(RWkNP7DEVx-z%>KM%vY0Q11C9z>A|j1B8DA7ZnNH!SAR**+Ga#|WpEpR@KPAr zCx3YSJxk~^9&TA{SN9@VN`sNxQG20jVS&MX>l@Z!G*6I_h)rySqHlVTq_Q0m^K=@{ zm41_l(a`b!ezr`pe$O(4d}K)mJc}V=ggbj?-YH-WWja*Bxta&{;lmg>#+XPE z2Yep^Ej9cM0e+6Kp0JPuY3DGR8nLZE#!axvpFRxLS$_rQWbG+LVG9Su=Skup?J$@! zZ;Y zIFEadEqT6gAdq<=FEEH>w}HETq0i_{cwiSLsvOJ#t{4*oYL4L>}O4h=4mJGTqu@G!jE)gFC0-gp^<{LwU zPOWBG076~dZv&I3s(DE6Pr4FQ4waV-eoJ1T{Q~YxzAN&9a)On9+9#|`T%|$1R7UK? z&PJ^!3>P$SKo65=@lyyG1&iqCJUn5+&mfvu?mN^LCc3+b3Zgz)9hUa}SlOO93#_~tiftK4-&XKqBy zqcu1hKvy@>yMpj}>fF}z@!Wi^Bs%Ljtrfhg_3C<;)!NqkTy6Tb{gtRvm+ z+4b0f)VN&lX+6tc|xI!`;iw>NrN{dYdKW-I-_Yc3O43DK!*e%~7%dC;5?!|SzN~?P6`_xoQGD`y`GtNI zY!IPe^1A&`HVT{PW(h-QMVo%jpLWgxO7zJ(t3QYv9bF9P4PUz1jW)qR+>ALeUOuah z1{-&u>|7c1%qMVkWpi{-ZZvg>3}bO-C;0%+t*R@+*q^{Mx%nF7p3%qa_{i}%% zy0K*CF}Bp01{k2pU~sxlhn|igrc3ME_GPO$T{cf*%#n$F=e&|g?hy2#F2M5!!{Mf|HZZ@(+x!se18Ui>L&e?C@!Z&7PjhET%`t?N?Wi z18s24)OiEWI<@$P#eIt9J3`&Buhr_vvuL|$ zcZqlTQECV(I5=(0gJ{shp zm-ikyO)~&tc6F@d93`hplk+qq*0A`mNJ_fj$T7=wE~A}0wO(EI)utUE+t&5dkj%Z5uc))hHAYkL)U`zB4%tGx z@Yb~iE)x5I0dG(K+4i)9F%5rrUk) zW+h4$Zp3B&eOxM$3?rwJ-Qg0O%qwex!$ebjXbpTk<*{-a`AmmI-zP2|ecv9Yq-pAD zMT}So=qZy}vN$`C^%;eYJ*1dx->X_5{cK2EB|-c-?EIs&>jlhzKHT@#i+0<{b zKj&-<2=Z+Z=<1@!{la`=X^eWV6>opM&Z_qF)NiV6cu5D~aKTME;{RqOPr|tpw~VuU zi6(jV!(8g{)_>yRE8G@lFJudYOKvx%>jd6Y-1bH%2(`__1aKD;(_2>{dZ(NT8Z?-oreb`{^(HG5Sof!}dCKb4WqWm^+B_x0-Ys=`-}s zVph_(=&3MuG66lik)^q$Xi}!*lWyW@566V9?O*Kg1(~3IfC5{B&81W!(b1Ro$5Q7R zv&PiS#wK_9nq037YgKvG-7u|3%#3hUvg>s`8sD&f-Zhc^hB$)0L>?rE&F?PAQ?O#?|{Uv9)>Y01@XpffV=5je+}&PJ8s+gDm;@8_<9#_tbNzsLKQw#Qzg zpT77%eRCD6i7M{EOXZ)DN-x;kVgTd7CRCL?EAmnyqY>msAEoUcyYAW_ua|#Xe@FWE z3Ph_ApqPSk`1g?aRp;x{1=p z3}ncCIV3h?+wm)+)TT;)vUJX-+ZOJu;%9UUi(hPH<`0{l8x`Iavj2*81#$=^#81h; zTMXS^5D#hOYVn_DTR@0<(|b$*3_b=2J^QsLr^$Cm9<*BC<)boel3FppLz zxaHR#rn8>D${!n*mUrg3&wT7ar-M&iSTZyCw=dd*MMl48hVqL#3;5@Gx}+SKdaeZ*S0##Uu3|5vp{3K;X#IiBqQHjPyJ0Sm$gUp z9w1K^PuPWf(GGz8WuMbPaE|bK>+9&qb(``zjP}Bj)JoY$ee|vE^eB=aS4-iWKbZ`22^aq#-6-3nSyy`5X{eLzGUjv->f6UEjSM9R5W@I4?P6i%-_6bTc*-vm?6f8#Ayz@7B7|H(mS1$FG4Pc&P(Zh8MeQD^wXq)@jDF6(tvG{bU&z;IrZ%PBZG#kBg z3b>zY=wa$?D5ttFX`jBSZd<#zuJ!TxwAMQ&kC=)pAKzrg$Nlp=3*WZCLNc{zP2w3- zX>gijZ){EJy@BRE{z4gJWy|D_T^<$q=NPND%sX*Aa8-`r-Y;V)Ip@dcGt@Rw-bp8| z_vQKNq9yDuyfwcY>Wz7?ot=+B4i^xvr{2hS=da4tlZHNrIf+g(yye0Xo@SG~?q7^J zNm*Dz(n6O0RLh~g`{NZ~tCrv1Ufb+8ez_x&bO3K-#d$$Up7>?ciB+D#IInF?=_`bG zSnnj>65xVWh*-s%aN*@vB*?qt(Ilyn)Gg~C9`W*{sn)W2`Kz%!gH2&D^L^>!6Jf?Y z7w}jkg=yW%EtE~!TQ4oiL_3Vl!^}K8E9>mu*GORn6BZm8Y(JXoBU zT4c0EK<538soKlc7i0TQF|rc=jYwou$*h-aS4}6zuvyl<^AaeNcPT=z8w=mhA5A^) z>AAg0yYyEcMpjLfb`pP#uGrTxfKrjBZl+5)$H=h_4#MwLEPj!8|1@7yYZG%y`mTixc2pU4l`^1Sj9p=>wRy3 z-iSWj{`@@Kws(y89kIU?EsS=#`AKo@gl>VJ{UGQ)Wwd>_>h=+gyIw>U3zmispf&JN zCRXaB994Fpcj8SI5lwg~Qi`uIRm`L8Y%yNp|8coqkT31&NGLR~f7ZD6sz}3N0*xGm zM!_FMnI9BPC_+Y!JQD<|lhwg0shvHhpdBW6sP3K{S&*tN_ zjn1sxzu(>0u}0mqCw!A}Me+v*jK1PQ2&2SZ~{Y(y{ z)dzF3?)ce~%ioVV{oYW{r|j5TIoqVCF7CF?;M2X?{6K<1F#+T#-G!o47g& zQ%%@)^Z8(=lb9tMH&j{?r-JoEN>P!b%dh6sQOBE5DLx3Jl&^#~&AN5{C9AJoZ^Qd( zNH*Qy-DLtjFhJrN>Ck3p8Ztn^s{j=GoWfc!5fjgo!A|BOnm6dNZogn;G)_awTX`NW z=XRw}^ zTo7ooDIK!}gK;Yecb9G$TE=}o-Av;p&%PLn`bjfdkB0(;&$8s2vt>mN5%ehzo1VP{ zeb^;=xYT!)hI3Or-D{}lO^!@c6Ro109iTW=-I2CJ<+sB6qy(?1CcF$VL5CHZt?cHw zAmW0hHlcI{p6N_GeoLFFmGc@~N_jUzsFJxv)z5xQ9MXdJFIr&`(M*-5AQep1dvJXa zWLTH5D}L)Za8|1waOW9ullxF(aTKgpT)4Xd)-#28erH+raMePg z!BZt9&|{*hPE*#~q7zz~E4=l@sO2y6Eo7Fr4=Ii9>v;cfjzv$^_aT+{ zO(JPDOw&kz4cN8F5cdv)L*)E0@}x}fdJ`C&z|HNO z6Ej4rf$n^xaEhwAjLC^}0JW3%*XW%WD+2`LUF_r*@g*ebItj8DC+FomQ$`)^?LbUb zD9)wYlq7ahWKh@Zn)%-w}+1)BB8*ISB(q1G4 zxM4@gFe?4}$d=3?WQ-PYd}N<3o=duP9;g=mEe9`YS}&G2R74T}I!G8msn=foXD?MD z+T65Pi}vgkRoZG@J4eA^Z^2NjaG2qO|1ZbN?|O}Pn8!?FtMseWxm}INp&|Qtt|c1PoxL9*fCaGbFPLsoN%nL|@B(f>2bvBmlDc}ky(g@k$IIqEod*n+XzZ~;(<o| z?^ICU`y~6fh&0!UY00Bw?YXH1_wC-Ip0=vTnt{E=Ajx^eEZ@4X2|G;K3cnWeh(g(x z{U`IXP=Gv~NQAVk2-&;D2qjqbeSqXs6gN>Q+s74XY%i>RUAd-xU|%;ikhpNv_Y9 zb6BDemvb0ub^{%E$Fekm2V`Gf68wVEg+yqpxC7KV?F{O2tH>%rE&De-B!zB)xw0m1A{@UAqEKxhl5dk7?Zt)m5Zv5Qxl zr@XEy6)|{NWik5i2R<%A&@>jxgGin8R%a5*@te{QKih-WSs*vTt9 zaf0U^yj6NQmA{Zr?hZ+SfWl3DU#`L)3E9&fx);pFsO(oh$ZC`rLqxxLK`O+Pkun1g zN>ZswijZ896=*#>Z?X`53?fB5@{!tkaJ>ZIy~PpvhnO9p)lFPto z-1)Y1$RM^b-~-PlnZ8JNS0=;L67WIt}R55uuYHd@}_3IYD~>&!(I?$=E5&1 z2aa0rRvOR-`NRks{I`<7KS*1#pPY~pYWE7=>Ma< zZBp;Y!jGcCZuFr&VcgerP{xs`X*M5fs7R{HuTuCJP8@1eOR5)#6o&|fQW$ACXhhjD zg{x_`0o&}zt^Bz{b!`KO4tY`i6D3udHTh|~PuKBs65vR!yRt=g!#bP01xJ51UY324 zPhM@@2ZG0AGa_#t7E;3K;*VtKE<-PHi@;u56t1?tdp9u|9te>>Z6^ZXa2LiG-T!=4 zLX<3H8CSPdX&kzL`tCX&#Ul!FHzSlUUFz3*LL66mnbU@TNGG)nKPKAvc>0vHa+kLe zSxg?eU%%Hyo0p_PZK}N!N|x;wgq;a?h6$w^_q{Axu?{oURFkN&c3)e8bETRbBV2XH zt0F^fa~{TPaMbN}*3-l&QNnN^x0-DnbyO+aJyc4X&|dkDBusWZ+gyg}BIogJCJTLE3iucwJl45}b)ag1mL%4f&zcI_2nbDA!y zik6u8qM#JOPY z7Eqb^1|$$Eu_~6QS%rHzdm$ox?xb|FkX?p5r6R_;f+K%ULGM`g6~$A$GKZAn^1O5m z=zBofTLP62lyG8tA@NCpVL1JTQP};P8sfD%n7CTrA_5mhStecy(NQbHyC9iV`%;WY zqsgSnS*apiM3wGMN&*j)c8aPUUBjNwfgbzN*9cKdyMVE>MBMtg>X!+x!yJbg|4Oun zmIRfDxI||SNr5s5fAKsGif|-6IU{7Xs|=42oiJJXtN5%`q;Z12icLIeNr`+q74ZZl zXtnDEiv6-ssa!)*lSy(jlZ<}s_xq#c$)nIvtx}Sf&>6-cFYLzfCs3d;ikUc61^iO2 zDPOniz6;P{^0RN_FB zfJ}o$97&w7FhZzkic_^?PoAr6!vGguPg=Lp5h1lUNwi#4l5pjsX#rB7On zThL)s;9SCJC<;F2`QXb7kjjfMm$MnG&YmRk3m2N}i53)*2^pbL@PQ`rG<<7DY^EGOjb{pI6wY%Z-@oF@`tr zX0p;LuTWBwC;k>N5J}x40m@MuxnJ04y@bz-*#!kNo`}IJWnlovPRZd^hI}vMsfFQT z0#kzF9?ttBU|r3i(N&|;*HDBPQ5nIf77cYI$sLC<2-H~&ot#02VHQ05gQsTm4Mb?x zE7!m>or^H9Dm+v2(OnG7(nu4_L2Phf=NoLFF;q2%v`OKNC0u3CbnJ19p=mwF&B&q&uA@OctADY-O zG9Ph^iFLS7iZq~=rsSx>sq8HI(x~xf3)OLyLNzGkw(Dkz+eHzobUM(eAj#IEW#D$kt))?L9F4Ej@5fBs z{l@#?@qG|GVUJ+Xr}z8AueaE9Uy=Fqg<6H*L?m!dckIU>8~f*JVZV=8 zxY|FCUtdo#f=mg!q;WFzS^g3EeV+F+OnEKAIq%*#TD&|3J{^~i)+*RpN zJ%3J1yKlX}e-C={`?}=?zLOLBij$V6t*} zE*AsOA0opGSM)QOH94Vhf?SN54eNM#d*xW}fnS!_wdU^L5apFGe*8Wj@0~+|>rCbP zT6f!&x%^yjz*!S>$aPW5C>Ya8eaIj@L~yG^O27I-m9;sT_%sA_(A$PxIu6r8H7n^( z@r^T!4Y#Ih()Kr<-F!o9a9!(s8A;skA343gZ-pR0)2gmP-N(Ux=hHN zhOOzy7Z;dlfy-M)A{8#(WQ3|oJR|GjWt&=D z>ze+O7pcrfZVwMVmF!I74d;>$A~4Gw_;a!?8pn5Ek#yn$EWCQc2-OO*7PHsW)JjhYaDIa^4S;w|+53FO;mUEVdlU6T2zl_xo zDA61spp3!aG|0qFkTfQm=}JA_%Lu^N;&&3M9cCNkULR$vy`i@SG2fBKoPp;b-_rsi z&=QKW>PE8A8g_X^r?HBk4u?Fe4=EB7Xo){r^btFwt*AT?fu&m`RW_v15u^1U#7uxy zY5R+UR56Zk%uX746dcZ%=w$q3xcYJScwmr^VXLn6^lyfJ8J{Q5A zGRhp>@jI@1>cg+2W3`v-3`A%^SvK%$3AZrc)T^(xzOK0>Xi;#PZNO?VkCF>>JaJnxi7i$NO#ZfVqbyssYwZ;*R+_fD@VYk3PMA6lsp{Z#k3p~wHVQbC=r8=>MmQzb3zR+ zf>KmRFg~=Ifmo`!<}lViZ#Y3yLI^m#{$OuxyXiYoBR1mDhIpoa2iX2>2(n;Un7mF$ zi(=pdu(z!?fTI?rJ+0_o2^y_P6aN{;B!t-0wcceZ*RZDYZqj!{u8lT#1E+y$c7diT zZu*bAct@G2Y?HcDS3+I438wY<4pLa#>$t@$PyD>H_vuirH&w;{w&FOzR;@O5^^^Xc zJchE-217w!Iftg0u*$DhN$2LGNi>vX4o&|4U%%?y1C`Zv=!L$kGy55n$_aaCO2i{a zeN`noLVeVg)ffPng@FfP?qXBQZOTJn{uI@jHOiAc)ISxSPMm9382z2wiNdW zUvvLtt(Lv4Dlx3nR5;*QlY1bTh7KL^wCeh(lXyURhwS(BhW{O;MIN(lE(SZ;BU$XB ztlXU2+*DeU!!rUtHpcraFPE#Y>NZw;uWk|`plWASIg0^wH+ zDH0d6;U(pZ8M!0Z+lxuxXvvZKc9;KUG$v6LT(S z+aZQX$MJN`hZmPmW&Yes$8*cBlg%h@O}LZ@l03Oe!@*x+?Y0i)AszJu?`mBa0Y^33 zVq)iJlofZqo-vZII-J0}Nnl{d{%HSRb1ZhlQu;~obn*AMslcU8et+hvO>uum=ecii z4TzhaRUp~2)xL`8+%nEo@Xx3*a+2*`kDi-mUfRfS)0Par(xB<;@R_*SgQ?M}97fY^ zRga=d|7G*;USpfw;8lq3Bo-@}71CWsB3A{8<0tCBOm`TZU# z+FP9!Ro1OKLMbKd%Alx5aPQ$YSHC+_2ui}S;i$)q8=Jv`_&Igx>g2b+KWxHwN(Geo zQM2DX_G)wtq-}odBHQ{-re02ixa3W1=7{j9>jfbY$qj2pppL~{Tf48WJRmyh#-$-V zncDD$^>G$DmnlceSjZcg3vf({>==zYH!?{SpvxHR-7IXD=LUmHxis0`0Wj@M!a^42Z((!?Fpn2az@&1(~oj<+o*1U03T3(=`& zMyvDTD@q+rpYs&e6Zr>!3x~5;8^l#(8vO&|S{sl~A}y%6Ccn?N-apWtL&u9;AlK$H zfqgpFM@R#nqaB{Z5`dMYh;}u?`Mowgv`iRZ>6ckwIexbz%_#bPDC@_BKEG{BySvvEuUc#svFKqHgckdOzn>FiOk0`V2$fRb ze_BJGYZc&KoofZ)O`Vr3_;eDg{C;K}LlBtUkqlgsw4GjZX@{w_gaZ@BmzByB(KhAz zL#yhz6H#6rThoV*8#OVJ1>g4QAaboiL#KS%la!a-frp%;w1F!car5;HSXnyEm;+^Z z^;Atcdt`eag*j`f2$6DSh&7Bc<8VC?c<=fyh(>MKS}d+&^UaRiyftiy)3GH=Kxz#H zme};=p*?&L8h!=EML1J4wFU&rzh1`zaNo84bJ0soICP>!ZqENjIw?-}|%g4~X;MTAPl_W&9iV<3I9b)RHa> zugFd<=}zm+=>f!i>5bYK28;zp$D&hf-;(pPkV5JBQ#i=#d}pnynJ;OOKSlP;3v+2tlZ+s*oJ)EaFrQED|d*k#vt4)#HWkC60D+54#AOOs=M&pX4qRJwkher+tM@OzT8VW?kQuIjwR#5a%=2qPPbrvt@iOmyvB4W)YgYgH=lQ9TC~WGmL7&;pg;ro4no z+D&mGdzE1I2EEA*n$u$W^>2E?WOcvb72qjV!ua8#(|t&p8tExsvM{!KHjb4|sV#Wz-mraT-T4_&p!i7228wXDT_*RhJSv4W643EmD-EjxCVvKjFZD`-O*Vcag3ZPO2Y`2rk`|{Li1q=9ejXlAAJ&Nk;tgcS9Lde_nR=@; zT}4(>`u8>7QCH)FZmsAb*fVQ~w{gIkD(XYD#gO5{$h7q<6&XZj?Q@e%D& zb$|08UfdaUZ@!3FUuLxNPb1jG+i|I24^Ipb-R$JBjhZl^3^~~Oo1djptQ2M|pAyPJ zT_n20FuGgkqV0yARkNQGM5~t#s@6eR*4KXn`FD>sod&G45!HEerOhGORzBzZ1tuL_ zo|IchZ3ieJmP3ah8Vqkf$>5a?vPSEx(cgO$?2zeZ6YNM=3qs^pIp}biF@GbT9n=GD zhe31mvQ*0J%_1Ek_%}S$JY=~jun*s$aOmQw5p87v*)lOH$jPFc7yUCj&_B-m_3<}R zL0o7#mV>s-7d4T-WZc4*?sjI#_)7!b-#BL$%iL5VQx3S(A>t$mz4q!Bjk7*HqLk~D zVM`Z{i_zuFM`dUbWd;5mSsXN!gW(?}dsZb6ls{_Hgs7a?D@P7$$6a2c)aYasl-bG; z(XH5938>f1A(Hj1%heC#Yx2lAk^cPN^`id!c&o<6h&flWxfCvCWa6zTu{L5KhV5e- z<9_EOaC9ywh&M6>9pGKL51+^{zQqIT6-uGA1Uvo6M)v;DqT%x6p&TYVfEN=YhN8NB zJhRBYbM&0Rv(y~WrD|^QiVYN78ttu?3ehR_fR(o5@RaNVgmOM!4!qQO&`wV-#?o7zzsQ3^%)c{dWqO*Z-mwolAawKlkru|qsoj}$~pJH zQ&{8E`WQXCSF!nd;ZgI`Rbg?DTX{Ct8taa$>grC5ds>@k4wMDl6n=6kF8ND~@wP&# zr`k&`<+SIKj8#=9ZDm%x6O3h<@s3?T5MM=f$m0BSw+|L-x#eTL*=}!4!*V6|2oVV1 zsqb(3&~ySH_e<{?4p^yO2?H1Ex96MJEzLzOa(|*{R8H zJKfV#Q@~P44zAzwH(!9iy}SF)^pg;MR{q^TYrH-lzTc-wep>9Lm1<-##*F?xoI zW<@v7Z$|@Pt%OIKEom6?shGT2JttZ|?nrv|$C=t%7>d;%s;rZxO4=Ig3#tC@+zxj* z!NA~%1S&0-IXmSe5&!k4y*h3_P_#USeq>3jIAexZ^CD(s<> zs9uT51_J~ge(18q`Mm_!c!Mzt-*03)A$g0?;q9VnuK|9~w!{z#k7y_%cv)DIaP!a2 zi$Dc-H6d>XaT9t)Gf|KX@1DITA-^Hql=pKf`_tvu$AbGYn?;f}Z9<1N2E!3+2$~ZQ z$U66zSopR)JES~Vo1=W)Fzb6@o5I|}>brAS--LuMu*Na-XSX~{;lhZMu=@5* z&@eE_-Po_k{(jhL@wN%oUPy`FKv?K{9J1h=?0UWspg(>$0BgcItgeFOji+ez4 zA=%N}QTs%XH`6)q#B_;3{~hBy@jmGAMiBf+O*<*umHocyET``ux0hUlqVj7a({BgA zNS<^iadKGa z`g{(Dfmr`pz4bfj}jlUq!r5!^heRwVr2xHvM6r7NM zEjCt@ql7g;V|4r%Q@@yQBy`pQc5Qxe9C3aS&fQS(zFGP=S;u+CmZWWh&BYNI$Q|2S z%!n1Yd*{6T8=|iR9SJX=&~AE=k$^~(0TQ8jGf#stn@s#lz&2f5kfu;{^TcyF1V zQP0UxH%vr1{1d!=DjOrIpv;Gq}vu>c2AMwSun zJ&Rz`emgst= z0VSbSQ07z?PMJ`7d1zY8VIy&ZY$Hf!zZhe6av%!htkS^By`s`UKbjFJ4?gN+U8rFh zInfwBG8+a8^eSlr<#sqZ2=pHbN@3HJ#4!<#pPW+pY)%1Jq%l*8FK9j&#W<UURfY#RBzOf7IWiIy_!izx|BJM93eGIxlYS=7#I|kQw(U%8+s?!`o=j}p znb@{%J5TV<>Rfeo|Nh+~609atC;@QEC@j+yB{exGv&y5El{sIe4z3+tzN|KTc#{6_3f49DR~ z!SCnR-jt86K0%C+EgeVRgX0y@oi#Zv*eDBDC;GZ>D&{AYLK?D?=0M=6e8v&vkTv~k z!ccNKUp~R8Wdv)hvyF56VEiuAag&ReNlf1~9{fLqqpKD3TpDD-o`7E2K{?*trbvoMjT8ynEW64`lJq z1Fs!7^s^V7R1G)ne*+{-H$XNVv5!{f`Q0f;h;Dwcma*nbqSUrqySr<%779Zqn5TA(RD@hhK4 zviTBg%)U=g9>4N>?$*M#tXJ$`d>dh;6?7DmhEHuHIAW6sHyhUe*+s zATYAGQ4umj#$+o8u4nbu!LiV~;n-RV%PFjl$DU*X?8r?IR_eq#K+zDT7PM-xEhf%8 z#d`gRmU&t;j`a5rgPmztY&uDFtm8cY~70q@u=?RRC${@&-39*_1e(kZsR( z!aF@2A0W=|mqX9xI$k%?({#4z*3G#5N0U(5_6cI*QFD9X`R{QNFdrYNXz8GTXIP!{ zUu;aw*;{)MFm9hebBo-2Ic8=~wj+CR-2Imo+MOml*X#n%exE`7mG0_9LE;Gr_i=+@ z0w|1_P(mDEE0Xzj=w}mPUFUWT65wR^;|U^@lGmqyX18vngW)Uu4eFy7rY?*=jD z>h9T&+fvpL!fiz&xps1d(Zv^c!?-{AicYk6S;x(kKG1BF;xo}}Nwylr|ErrSqkqPY@|xZN^>;rxz|%~tFt9t{W;92`J* z2G0icN4yR1JbFG-FzUn+^Oz`a{*uCS^pQ`jfoN+=hu>Gk)c2C%w5DFQ?Goomn5kXmn~Ol5 zO=+s)6atTpd&ShkZHE(A_o$m%%Pxugv|U?a7&xnxvnrFEU zVyFJJKq+&t9;_Dut)_`B>=1;ckPkf!dYf zW_+V3^2x!jq08hYa1LYm(>i#cB-PSsLyyRqe;dRIJxS4`&*~!SKdCt-6 ze6mYtKW-c99R=G=p?Ol z2vo5V+{MWLD7*r_4l2UOH_Nyr`Ly>`x58!?Rj~V-{)CH*vLCrgq&{O zYhmm4b^e*rSH}G9s%MjdJKAvjfKCa)5V*DWxngFlcj-VA^vDO3s)k4c^!=GN9#>E0P z4$YsGso+A#e`EEkc_R0uUBKuuj{ObgjETATd){go{0;vq#sOtR@oY@HOnkxLhP$8M z?wi{MDS#4+YL;Bw+D}TXP51h*;CEQoRqtcwX;9eX!jJsA<`CkQ5Cx!_84&f_9m)U8 z&rce5X=hqq(2<{J+W*9*-ES}8Dr7Oh)~%Lq>ez z6Iu$M;pc#2xBrEI-19}i_sn+<-t>Lb-&_aWgL6+_ysx+P9b+Gdsb&3nUA?MKx0}*O z9rX=U;8RksvQz_C&BmDbE%*0zgf(|}i!RzBNjI!{G*G^En?K>`QN!W0?pl{~>uyAt z>$EnR=F(#$xvh=1zZiMNdQj@I zH~emNJ94DOn^Fw(a_3d@Fw8t$OkE#_S_Wpk&gA^a>F%F z%Mk_^G+k+w*0V*O?h*2)_2hLZ3V&hsuz2ZLv`q6Q#NXmH>tzwl7DpVq^PulV>edq6 zwlYMt1Pe~TRnH@yD(e+~O{0CqQcQeddwS;Up71*nWJkP7alzbR!h^4E|9%CC|hiqkL#U^?QwdrZA7#8wG^+4H@qUZg{-z40qll z*Gn39Q%#Ah*JXWYOf9x)nWH0w3&mh{=kMY2paHn4lYa+>5DRc|#_F7mcB>GD^t-R_8G*=%VPVhDc}rxV19RwOBZ_Hl#JEF=#knhwnJeV#?mVW>7t&X zk1UgUMVIth1C|V|a?NCU_YH(+N=OB`(qh@Qol}QK(wNO>e_3p@Vx+5{{rT)ie=jV? zby`Co;{Nlpch_!5_#FC&i-X_0g@&${_V8LOyIw{7{;axj;sO%i32QUGLWJLFz_W^1 zb5qOFq%OpN4s+GiSHov|E#hCjCB*X&pDM$WmDFvW&X`!7)q<@M6UNgj`lzAUp@U&` z7GQMV8ZrNt^TvTEY5l~iwcd8iW-&pMKu+Mwsg` z0I;(tvvktzoL&1!l2H$TL_7`*YXwjvGC=qn0X8a;}+zXbdo(_sNc zE0(YOA)N&fmXH0w09!K4|IqBu!uEez)Me)8VErEoOITP~nEtETld7ek#8wXP`$ByV zjwLPC$NpjJW8zR(@6glBdKMYZQ1RwYYVK`~L-v?Xt!zA0;~SY}@Y)Y>7jGYw)#GP~ zM51evt>XHc*qmcL8z=8ngH7L88L7oy#^sFGqsa9cH)GHWZeu?<_C|NIPpjM|^j)Y? z88Pq0OES)5WIXuY)`gLGqG^hkDBJVbF;rJinf0Zq(maEKs}6^AAQ8u;QLmYkPPnU| ztA4WyMnYhSHdPQ-?H!UwLu+7qEM zH~&x;y|*=5L}I!mDkUn>(5?>;G5Sf05K{HWxH*5ex*jhU*bzq)emtEO6At~v(exVD zU1f}A;7lwY=qW=05sZcQYZU^;F=;n6T^w@TNPUj40g;~PHazf8s3mL)#zbM;Z7#Ay zDw#Pm+3OnYmb?XxH7^gOFQmbJNgc-x_xp}-ZSKt|@NOlByq`i64 z*rrx9kDEAeuS0CXlp0krlp1tML8bjQhj#dnQDxla=)(`?s;nqCB?E?+tT$Dvqc~P% zNP=jn%+Qve#9QDACt+e3RIH{>YGNbFs-T3|w&Xu|asok$`{Su51$-Z{w!qK38*;g# zaLlY3&mUxFgW4G#LOA~PMXD2FR}RvE!dyhE<5!m@N6^T*7^8DX&=1l)t2dE*8|-Ny zRmu;Go6gOo{n-mWAmJ2ABG#6BW1#fP6rgGzrC*r zet!bKNkCz!E4EPa-W~!1{*jM@{*^>yFWyCof0NdIx`{ae7o)-=-5*tr@mtH}l&^1% z2u+*IK_lRu0n6B1$$s$IZz+;VsJq^?H|0Guwe18?jgt<~D^kyX*eU5si#zcivP7`} zH>gmDz0|CGpYCyPetgu4sjlB@cH@8n&BweRCPh{rlmJyd{JGkj%aJYqUBM*}HxT-b zJAUcO^Y+>hag~6G(pCKcczGu|MeRzLM#QJAE;(S!xgGaXNWhZm(oV}`TH3yyphZUZ zmx@Z-&AV{$nC*INac`mTWvB1&>UUCS_yi*$Zj?K8~WXPhCe zhnJi+HP8bn^e%nb=_hvL{l))nNjGXyT%MS`Nrg&s)3Eyp64H_e%>{V&z|U76@30|HXWk{pA_LGw-l=Ds49QE&1Tz zfLP8`t@{iwkY(=j5S!ag-@W0N4L^%l>eijB>yy^_LX68Joaf-m#_i*v>oEMgS1llt zo>#~)cWr^U1IIhr?_@Z5%)%M9 zrY-1c=-1!#Z0CHsOY!F4vpX{$%iFs87r)bAZz*|9m|)cnki3%o`3^nxV#=I3b2EX} zt7&?^y*lf8vO5nLmUyel8|*=vF~}-2a){Vv@l4iw&=;sEGJp7(@@0$T=Dbv8w@;=v zzxU0q-2J+|=nC3$fUuMPg1Y-a@=;*UBzKrpVb+xU=x zZ97Qx_P=D5{m9N8xsPu@cKVd_L);8(r#oa@d1div<>DNU*WEaHdwK68Yk^}Re7dXD zT}b}2s}Ze~F*`2Z?w7UqA^?76z0b6p7BBZw2uAdDTiGl>`jYx&adWI|+?i2q%y2wz za(H<$>KkSZH4Da|C2JE%2*jAaxspDBRiNZRV zU16@jX(G!RN%wNgrkq1HpSkZoN$IE()LZey_X1h~-6{{w4E%Inj(CPWE??mjJD7>2#=T_T!8Bmr)f8i}Kz5ljgzh{rd-%jDymDNWa)PIsW(b>wgnO%SinlIhMjg;x$JpdVqv!0C&ZNePS9dDRf8oAI&sZ3Mmf z#dHOuzy-vH5H;MHzixZop}&wSkzD0kt0KTLT2<(UiE{mO@AxeeC(Ec2vSvre1*%J@`{XBAI52`Ae;>2rJe)l~ku#Z=bD_ zh9bwkSthK^ligAY8!+Gg1C(r-Y6b?94{ zOxMYWo5W@<@700AfQtVnv|@s7oHYWUv62kgPcS1H?SnKejC1*=Jj+q2;b)5Ab{zwU zPs|^#`0%HFmo1`^o!3O|jULOYtTL>PMNB7pZ!?@w+!u?~Y}?ISo~eO2NE`c)U4nW> zJaP~9AIv(iGl@W=QJzivQBZcscJ?@HVlm=h-~r8v^Q397$1!piJ-kgLwt`J*#1qI) zX17@y`xSq&gmUu34V$pt5d2A}uojp4G;WI$=uh=WI)Zp2B2vo!ox{22Gn~Q~D4-EE z1o6P$jtk{l_?t|Jdc;M|zxqMBy%^s=9|A zh&Vrw4N*n97eiJb)PbP2DwM12o*yT%LBxq$7{o)@64cRWTTEGyqbAC(Kgi~h1qswG3krX@5w%cK}3EI;tyj_PxIy`k2I~~I!$E6(cc!5Q1 zPZG8>YMzh7H7PNkgb)_zW+x{t z)}NV_5EjZDMs+Nab{Qr!@Um|q(aGG?a*s4S*GoXa*BhYsGpN!2p^k|d)!_}{kIX4oQiV+Hu=cZfdj?U~sHwGU z`&byOJQqkBS@R&TE8=SSu-n|(rCV|H>6hs-w(#LCKx0a?@s>p=a6zez0{Xo27I?Px zosoO!jqyQ{Q;#|JOU-3olfqtjCItS1lOVT)a0{TS-6Y4UysJ4te1T++`9&S&3)p{v9INH$dvdW)aHyj$o zEt(F%SIf0We4TI*N=>QqVH{a2$P22LT1j8U%9Fk86N~^BD?a1+^@NgAr#{HJ+>{C7 z2Ti|ZJ|S=3?7x#amCUYd7}=$PbeBvui!+0P25dvT?#q}*S{@}G^^0LBs4VYW&rw}$ z-+Jzjdvdr}LTKfA>uaB`EAS_O0_5xgzrvy~O?lSOfX9w@7x6i7f5VFQDXFV!Zd9eU zj;>6LTC~jPUT1ho4`4~xz{-X=fiFo70U8Lo8)B#FIeuIL)fTP_OOhf1WFIX#waH!S zJ@VtDu%tej(k9#Aa{+$Yi-=F}GBgb@h&KhCz*)rH&-sBji}{257ul1-N=4?e?`2O( zRyPh^+i8!fb#j-yN8JVj&52~Tb&*re%iFV)V_xcH?{w=IE%=x26#7BrGV^Dx$$%zF zMwJT_SA!?1X=|+Z;ljhNCF`zZH zbPDKiptJs3QZQBV#r<=xfNj4Q)Rp_*C)Bfr;g}6FBm^R;qy>Qc?Rd$5% ze!e-tH&x^%fVDYd89H$u@?Y;gW1R622VenC#7`(e1=MdIdpGM1zRpwyo8}oZY|k}c zle(*M8VpG82k9=}!Yf<_n9DBGd5@h(cw-&>a%0M|b#I8m$WQ1ZzmEL7w|8pOL2i0e zduOjjdxQN&o?MjgI8@X9f4mI5sS4gfwAZtljE0>#N%s?XfsEhY@`SIPhq&87!1k))7O{Sd*&ehRz3eAbfm*iSg`zV zbi7u#P7$+wsY}Jq+WYbk?(!Q%-?F_o%MHvYFfHz?MqV?Oyfcfe8W4@LBmZ!`^}38w zbNqI+^|7a~cN{SWksE&d^nfg!emP(!YWvW3ls(Y>ma_gqSn6T<=TGd+YDaNNZ7rv_ zd(k&kD~z@1e-tzS2bAZ36*C;1|4qzj>84#$pnSa0G=W0iL)Z=&w%lamzfJ;PZvOQ< zgoYO7y|=y0LL9QPuqZP}(mNDK+0p1)Ronl`mSWI-sm@re-UVcstnezd*%xDeGzPmI zRN3wyIPQRh5>0W^b6x6iy5&tI>^Ls4IcVfK+p-qAGFX=it#!o=^t8tgm_3}MVd)-@ z)6+G%$hMS)Ir~<6Wz4lyu!-7LGEep~;&Y&nS}D;%7V1DFn#{#U_+2C*aKjUDuA}PS zaM3{ojgjz$f?>NyDcjo%XSV78vO69H0ri%To zIGd7d=a?9Q1BorMjB8?pxO{@MzUr`XH9CjoVyOy2asR3 za@yi5Mc58%H8guLr^F@=gb4N_3xDe6(Uv3UKHyZ^%V zx(W1O%T&d^r_d)I@wlt_`Su{OW(~+8mTM#MLs8-t>bPsQ+3 zp;@a!SnkD1yn)iUNYMy)V6AYj`#C5x@E93CW~ zM!EXYCm_nU=~Bq!M4F(Nai#i=(eTH&M*|Z;bt@hqtsceEq#D@k(8xr8TA_2cSyzD^ zPQ4pZgD?MkEJnEPwYeF|(zhWzi|gq@eL|M!^{7)pY0h&}Ig@%3p=1M%cI$C^{$y-! zP}x=$#NgI(`zn#q{gzMwhw&yahC%Z(n}hkRHl-GGe+aMoYk$dMo?1PD+d$*G#H%eM z6tSJ^PxQP^`|pG@IAEW1D2i?gyhEbu%S1;cmcPECwg@U1WcS0w=fhRY;-@pw{tAu_OGj4>6 z>0{r~Kp{;#p9ikOkb zuWs)czp+nY-#8cp%@_V=;DrHu^Sk4g+q8mV0n`oq^X01g^8taM!K%kk@R`3y!?tCz)C z%4s#cb6B2ny_}9wi`UY9z}QtoWA$FVF=2%y0ccu zJ>zZ8=t|lppnx-ZC+u~}8-iDUi5Aw!$a!stKf+^fsZ$yQ$c1%%{bKR5avmZ+cIgke zpJHqTvU>nS%em=8?D{*E2rf0@O8%sueS3QZ>W_a93q>28(d9Z9gtR2QP)F$8n z^*!?6(HGM_??~TC3aFFhm}H2J>`svTLTbC@VxDq1!+zu-@UW2Ot?H`9e9l8)w7MTB)?RAziM0hX&#s@ z9DSJ;Colphh`yOV=mw$>%g+(FR@;35LyKi8^3So zOx@xcp{if5xwpHWX0HBG$}iWY4m5V*u7;WE-2_>56fbpCp9- zDYxefm2RoE&GNO=PuWq0ZkN>?N9}Ge#qPi63cs9R$vm*&w`-sMc8<8e+}_FxGjd84 z3mOn=9w;}|dmSA&ZFB{{Oe0>e3kMVnC)RoSj^i~j4;?M1GyzrQNA8ShHUOX4*HjR1%yp`+#-3s>iLuX`RGfd($7CBLJ1wR%+P$XCf;e5jj94xeOYu?o-6vHjUYz@Q4vMfbx21tH>) z670wH;TR}_EL<`{PLf|I6S3T$2O4UJAi?byuds*2G!yu|dkdLK)Y07Db(%qopEWE5RgJHPQ&md?rup5icyDeH$u z)S!%TQ;Li*rfl(UREyOyO)^|u0?5X$be7T|Y1K2WOO$GG3!{YUf@HMe-Bjo(tpkbA zeRBIl9(_?)C5=6{MlgvgLo4 zr1hKOg%+*z#flPX2PI%e>B`X{Xe-esTcTDEDN>_WQR*vxhgs90*CW*s{SX4(w#tX& z5=s62H0lfAv`PGqW9fx)$zqYu%EqKg-KG-!L#ATRxfqgNFp*q~xdOXyG3(Edu}V4R z%V5K)IS^NxWHmgJ!bugSUA)YFJT40gvEg50%k?Nh1<)qa4rrwG`$2M~Bt~BO`&wRA zpxwhN2N|x%x6{C%uxj{(p`FOIeHeO<2)$kk^~U>Xf$X!nTxNoCw+`!;~+(#qTwE^?8FdgKh0A~eyP(yn2MF7%@XMpgPdg0LL5?16!e3K zhUl1K$YUUij)E=_-1IR*tq0M;Ru%L?X@sTm9@3~0LkOY%L|sncI?l)8GpGwb`fD62 zr1>+GC=uf4Wq+dzSry3yW`aqN8aCBRL8?f7R4V96kxtwPQ}NMHA9fO z6l>F6JC1^P2E{e>bCuQPjIqgAIIch7KT5e93UD{`P@5?!T!itz!{oLeUm^hCZ;V=31_WGo5~Hi`c@Q z*CPtPF|2joG=fopgV+GE>#N5B(%N^hx(z@2SwX#*Oh(=v?F?CgbVRnvq3NT-iOI9$ zui)FO#~HJs$;F-ZsT9ln=|!a-xY#tYj+W!UR#`kEjtkmAM+)xVZ4t%ui!!cHXqe7pXtx{ zbJsd=^LrB!7=~Ukj0;X)byc-RBMD1ticRtVOwO9_uiM(KOOt@L^w!lwO~rVpbH2CP zqhq|8OcNY{o16by2qt~!+KmlV|5{+HtimSoG1~OgK-bzSX0&_%iwpJ1<95>-JwLz1 zX3L9fGhyRex^#$>sWo4?Cmoyx=c2 z_Bg3=PIz9fKE@XIoL-kPZmm+x$B6qG4zf36M|%V5hFY4mc051{C0)jpUlCLUTUW1! zb@UvM9XDI;i|a>;`4B%BQWb)}-s)=UZ`0OJL_P6_7;j`@YrGnV2VU{!)9o2z8izzb z<4-5>Kcsx^y!!=XzdQW~Hk;zEx(?v)c4p+)vewtqk3oQ+Spoch!WX|!KFEu;A9Dn2 z#^?o%<7XCAT1~Ai4QB{j=iC{ZYn~2t8jlTU0I!B89Abr?9LFtP?k-0y0#EO6m&-P? zjN66p(paIGCKihi^@yDBUgDZ(_Vkt?!U%KiYM63EoEO0tJSKFFX%BvGw>`NQl9nR1 z2aAVLho7-rY@F5?F|tw9Y)lHuI$86@?=o-U<;C47&*h0(<q~_0H-7vehPu;eRXkpJfmbhBmk<|Fq>AtgHuCxN5|Nw^1NoS zb9pg#stsz|I^wNSE*z_Rygh*JK*I@dXF{M?tJvjpP*m`9+2)7f{PhFp6gS`kGuYt) zXyAA5kSjecv2helelI)yc@or{4J^w3_ZfMY~w}uc?jWIQ(fMRX3t|XIWYD$ zl^sEt*VE;@hk56Hd!^e0Jo}u8DCL|{oSB*C=Q#lvj1<%wJelYacxu3$D@dY0xxFag z)$ih?h5z=x4P~DmYWM)&T@4TtUl1Y&yge?IMiBY~k1hgw`1pIez8~*i8b7bEHX;aj z{QTcvo!=%EaKD}(d($T@-bKYjYQ~EzjeZV9XE6S)Y*?-$OlR$&@zO?2k(C_(e0@9X zP4A^>st6CN@IuCJ^^aKw^7eFA@GDJpCK`0iO(;Cd$j8`4Hs+pUrZp1GczS7Q#_gY* z6`8D_Vkx>lM%(`yT9)sH0M)G8A|j%d=XXf&#@(uo{MK6(^GZr{kl+EJ9~;) zKR0F9m8IxP%Ns9Hi++Bb>%8Q*i@j#1W?yXBllDA6#qQLVmh7A-%PuhSR@ycEppo~1 zaZyo2swHRjj8>Rfa%1nJbn=C-e6ZWBpxh6CBL z{qWTcwp2y1KYId?BnvwjjaVbJi11r;#O_@+QFu@1C$Qw^)gjRI0CTIL!Is8{yZo{w zTG6%oCp&1+%?)%4Y0!$0ZInAVHRdt`*vhPL?dPwe>5}U-*SNi#JY^mAeW}zo<)bPs zW~}y1wQG6e>Q_D#0LT7BVp^Z zYW~$qaZ|Xy7rb40cM7#Rb#mD6X620(`7N#aT^-JGX)xL=Ps{6~-~4IjMc#UNt7c<0 zv3g)`^wldWKKSYP_>v9{*2-5Ur`poI$Qr=JUQ#9km@cuj@BU)++8ttp>)$h^cN2`EzvF6 z-BefmL+;GF?}LW3CDD#|x*sxj=}7KI5(l{gfwSe@M(D^^OAFl*k>L zcUXJCT(X{b%{^O^3?c`niPA`=BQsV+L_Xtim?uC3bG3ylivyDhE8x!_D8_v2GbqBm z#XD&KVCm_Vh+=#SiY&&dg)2J4vPe4m%JLa&muH~Z5B+vA{xaEBl%{+};bNzLJO%qnAjPLmL*7rEu2#nQQwYOfH&^gzs+#_nNmWkte{sWo6~y^ zQP*^p>Ed60Ipav&1y*W0L#%;A(4YJ%f!XQ&BdT}M0ym>5xu&C#Y#M25*}N!1vC1~*wPlT z!3!f65)KAg9h2CcLE^+xuz$wb3nd?q&RKezY|mMq&i91|{!Q3*5$jO3!r+fRj*(7h z%L*X_6WHFh2h3YCtV-3!H`KV9CO-zbk|;|&qL%O^9auHxqbiXl(1^7!CnBNSHyrJo zDcvmyDQ>FG|Mpxd(f1YUvWae#OlRYna>_}QYFZaDrD~8@O%W*GsVHM|mHwvSm@gG0 zNR-$iUz*RBO?ORSR_1jooMW36np;7+!T{^fN1%T_BG& zVTy~??IIS-9eBl3()HG21L4sDiRl8}w9oIg7YRi6zO`zyW5BLL`vA5D~?_WR<;&lag!<$gDRXaeH;vg5nvJH z;mQ^$?iG=mDXtwAS{HL`8mCY&Z9+C5DEpFf4^2Tk=r)ytqxLK4pEJv%BU3e2YhaY> z!$u!s77QrH=!8ic-)*B;Q0Vw{K}G8}lr%ZB*D_k{O-uT3a7U ztiofWCz3hKLI$45!Xh`vSEOjgrtlM7oB;;$dafKpswK zhL_>V{>+g`HWS{&&;O%vMe0FZez z!^@_FZ_i}_dOlINz72Q2uF?fR?yn5Lo*4r^xxYO8fKTzgA7?k;bM^r*3yM4b z-=8!82LHUHHCiSD{DGf<+Hcfvv-#eygZJLvZ4sRJ6-B{MdG@ZUf#N?q_5=HYMXvCz zf@hrxH}Qb84U5Rfc$hP9F`lN#t6xXH6bJ~Q`}`{jkx^pCU%lKJQr}-~%u3$^!N@nV zGc2tZLpvpR_pAr3`zIf*ciZ@7SI?CEHcTxxQ!c_kQB=O)M+Cpge-xuAeSdv2j#T*r zPYl0gsJ=qB?qcGe`dHs>8GhD~{-jW>o+eTLvO8LoNg0(!rJSoD+SxdDF;|IpKF=j$ zn2e-FDxr459*1;-`5OJ5C*L1xv_sN1T5)n%SxwrWAw4>u70!_KwwypQRJ6$#$8JwL zA3~(>CdG+e{PHnk{wFM^VVbocona?=c6z^&7G3k7Ut#kxT@|&NwIs|Rc);Poi|5Uh zOqe+Zuz4oPAjV33Jk8Of*c0!X{8S)Ks|Z9a3fLR`pcQ$|mp z^dOIe<1C*P?8aAdg}>B>$ZZw9!(+X}D=tdliQhvE8xj}gb|*$fPJEVxv8nNn^Ao1` z2yYGHnw)g5Z+8Z>x%oV@FW+vkN9(oV-CqM6nCy4dg^ej-B+BoP(`%>W+}k!JyNAM< zVCDoIZ{p#!j>yaP{Ji|TFC4@;p~1CFEf5QA?_?5ZhG*0W+|u23LtQv{gqESrzZ`<& zA9X$q-PGxs(MGX;CoTRdp_Cu^H=v+d0v*&?sqGTlfXl7yC_Yc`%*5z1~s z!A;N{6#LAP94~Ybw)`%B7zz68BKuKqc0bRuHM$WQ)}sXt3VmH^0jthCM(axf)-xoe zp-C?yu?2&@mm3xoHN<*+OF}>PCdcuY!x)S}58(;=Qk=e-<`%j{r@Xc@M2o}fS5?#K zK?ZLz^@m4Vhy%IKxKn2%7~|;FfEDXPnzBlIdS- zDx1!H^>-3uzAJ#5C&E2cCjjPHdrC>yOfl?)1#G4{{%cNJf7xm=J}2j$VWm}^FN?#7 zSX@UW3#H9Z2p_+ZDt)2RG~N7E7`D4Wiv-o&TN^WB;*e+G9}Sc4qRm&)?r+VnR7t#B zuB3#dxz%)?V=d>aowe!pUs(gVmc&yfOn5=KaT|P1RU}bks7}puekU3+Lz#}_^rl0y zDCM2Ay$$604mSm4Y0kH*p@&jLaKCJI8bK49(9AEzP?aZ%)40*w4Y*jSc$246+(@l= z$EeJ;#~t3f$;pv8{R@s1<1i>PdD52F?Ch$YRzw%t_z4+exVB~1jY;=u7i7mWal%{=)v^4BVQ~xtm$$0R5v3FV`V<1uYnHiXV^eu< zKwi5UVYp$HX`WT6E6SwCoA@>1qPfUG7e=k$3$!$9z;DN&O7_j29CNdwBzlH05*3&G zxN3%&?ukL^vxI@GDcY?VM0#|erHoEe=BZpQZQE@do42fKjwujMTKQMC1tYOF%W^IS zpR>c7QsQO-c3sHao~{rGFM=xZ<{2RxQz)^^AZ(|Ay8L?#LQ)0Et9CZ1%`b? zIGZVqv}7=jzHQ_Jl%j);4T+Vm)uhyQttEH4VIU*2i1v5aA^e~HJiQhE$Uf8$%}&a) zs&K8%4LgwDwCk|~G~Ljlsyi}$x0a5EZQq^^Twe<_UY})uXyhg$8Wb95KMi`25<-xw zL~z*|Iwly&$00Dd&mIl##+3A($Xb~? z+I?}OUwi5pYv;(wtdn`n5C9Um2(sUYkiSiD;k%8i>n*Cyn(VJMbuTJb*M1V(Z5dh1 zHD`Fvo^!~;D=atPcoCXr+iSLDj8Qj{$(X?!l|86SyM-4^Ro%8NGX|z)9(0BPJJJ~W zB%J-Kzwoa!s{&eAwCdpld1vKtnK)CjD;zsPr4Hk4wLr?~v~X z_`Fo2C6dF);zFV3K~^L4%H6TQJ6r|oc=WpKMBlXuj;$h{NCzTGhz8OjOzlliOI+MZ zM85H6eA~?G^``x~pp2+M>t^Bmim<=$L8@rDC6EL6s6axj+kKs7UMa#4xczh$CBLe9 z-96J^iV!*cqNhllNb*H``yNqcx6|OcTxuL!rEgN}&8Q2U5n&8zprry@kcIqle~^LF zz`=r`gXU~{MM^Jefx|n98bAKV`Xg+wO9Xi>KAvULT?bGNAy#H0kpah3=pJ|W#zSHr zDp)iz$24TrTv2bZAwpkVxmH|_lB(cx1RT#q_V2jPHYfv;*!F!^#3vT zjWj(C9Suxny|JhaB8Rzf zb*S#Ub@bG7caGrbPeQrYJza&=?h?lF4Sj~v)W$p;`&QG3^(~q6uN#wG&$3ge8`eei z!tw?O0nzM?n6&ZB2D1h$g0@)JRqGfQlLs_(E(}ziQ%C7ja2BEo~>??0zTMt38rdb zO|4|i0}9H8jA*hc-k|W=U*vgl;E{l$v2*u`R!1{`JD7-6<|D%W%6fqWc>A!r9)x0@ zSjJXWtWwytLU1F#&#uPA=|}S~4wVrwGWT**ZmJ9gab^*fot1uR`XJ%(Kk6eBZPh`- zudGJho>=mJJvY$QM&1B{zY3ObI`Q!w2lWX%{+epm;P7JroevDa#+o084)#G=yr&d1X={TQduZJ;LP-cLiPHDKxz zRM33#1&~iipd=*z3l*#y!WJI$L`Z4}DjdBm#wwpj2Gkqjfz3ciNU)!pF4y|%dXZ=F z?7%*x@paVvsGddeH*rDQZ37b$RI*RV$#3&A$LF)UV}nGzu!;k`1-YJ!QsEp@FL#Uz ziXS{Q*QSU$+1~-CKcQ54ysb7h5thGUALN|KqPY7{pw30Yli6Wfy>S#NFRt+qe1_T( zqB4O;qzTWpjS6^%R5D;58R-Z|DhxIw=&8{Hfk$?SgBiQL{myfPcxA4=TOgEz2a)we z08Dg^m#Cw{(xw;9`!6)C=gr#D{4$qB*38;F-QkLs`f6L&8>Uzgn-W39`DbQBq)>x2 zo4lk`Dr9vBIaLaDt`VFFRDd2FDteGI2yU#lEJHXUNwwYrHG?^-u(dSmXBgj}Q?f1* zoVw4k5Cjg75oI*yZ^HdAx%gl~W&QY9#7S#bi|v{0dNooQbPS4ayS8^@m=#!LN8nMe z^w*?eo~{JDrZpZ@(aP53iE9dvKf2du#-oc;b28gg^UK{F61x%6Q?6)Eu3k*pcegqR zQujvervAjU`KOkV7%2P;qa{?n$wJN5wa+TrYRyc!EZk{UlvzNQRICkijUZw`!0R-C zLkf7|cCI_tjPNf!XT6s{W$ONIHlIfDrqfwqU`#X&prX~@voqN&7cY8f=<3hDxVQ%J`Uj%n! z7G*MLs>x{#OOi?$v^p9TDRdiiZsB@Dp~56vj#35(MC81GH6yFb94i98Ms@Y+fUM2t zg!&A1kZ;qh&D>Ou&-2;OLAZ2)xHN#cOsIF`C0!que#OQg6{Y88cd7R&I{W(fPbQcY zdvCd3QyWnlFmrcFdlX};Q)#G8KM-K375EE}TuA9|tvNN=Qp9G|r&=?4`no*BV}i!! z@X%Tr{W6120W*uz2AbrO7yJU~>t`u#i=*0@1w*7S%o{{5vM=p~LUv-o^~RUA2_FL#Dr{Md&C1PXcE+tbV;fQ3jKv}B-s6oh1z>PAoC}-Lu|vE%dId_(o!+{ z%A1Plx8!RNr*$uv@y;+z?h7D!bJ;I@He8?HCZuTml=aNns(RWOvj+ib#vzp>ibLB) z0w{BPrlzsm?_P?Be1+-9gZ=6qt8@3;YjpqR*mY+Do1M8KOL%MyZZzEmrnIXJN)%rWZ3pt(?oGGdu3pgQ*q%C`YiyIHcC)w{9KH75!n{wSFlkAU1zA3pAUbJ$$` zEE_^B7dm~O&_rlqXkFMOPy1JwsV`{lu1_0jTl`TXGa&(A1FfWv8Wwzgzz(B;US+FX z_ofsUOMvP-YGGV=#Bed3=1AT1WFoGze{r&mZOUgKt{ugVXCaYE{nvK~JhniQCLFRk zDmc<6%CE($nS1$T9Bz2Miu<_;{PMN$nDqW%j0L7-1v*B@ zj0VdyQ!|T;%EIQuabQAoR1A-1x;Ycc?a3ojBi4iI_57F?>+x`inhz-QpBb4>!u~WvBLG z1*)V4x5>a~iX&Z-FqSS>1w-w6WOGh#Fg#|a4o)LvRoZ?w7P6JZp%OV~0|)4Jd`Co?NI7n{}kZyl#&qnK#_ z9)c`Y(I8zu*;3a{xi_ia%WTUD6>Z%ef1u8=Fla45HtLB~CbvC0@42uWKI&;~%?(9H zRb0|kfr=>BZZ$s+>R*`0l;0?P#C3EG^+w^(Gs_FNgl1|CUCY04rg{CVU<<3fS7^5B z_w&Q5&vm?#ql6N-r)Y3hCZi6xJD~CW3TJ%b;~V}Nl|PW$tRX9GB!|u7@@=8RqO5{~ zk|3DwBU$y8M|;~BNV^``uu&#qQCInIcu4H3I2&1R8u%`2JkDzFZH6MIl5 zSv>0-Aq8Pd+=}#n_2kJ!+bez}eSy}m_}+>Vj_B6cFBpC)YGOk+IYCwvSbvM=F)N|N zue-(XBy1r%s~QJcU$Mw~1re9cTptuU)U=S@R}1$b{oDvIQ9*nM&>649&U zD9D|?xyu=^oRbG<`kvI7Uo?iLj$NBH5WMl~S3nVJl!ISMtJ9wG#<94kT}LWX`DwF7 zf-6=V44&hyqRShYLyWoAq*V+Mb()2EQ+f(W6qu4k)=C>TJPHyp#O>#5!0P$O;m5owb5zFE(9Np0Wzya}c4)w^%l?%&mP^MJcE` zQtCYJT+vJ0y1)y4hRP74GJ-$tmx`CZOwg(+NGL@nvA%KnDO=kAApyin$Nay6M=`Vg z4~6}VtStXg$Cj$?4I!Y8Lm3l6SKovra?=A)=*YJ9%wI2gK>th5zY5SuE7s zfn0fqXU&{EZAMsu!s=F-bRpuoE+*-@hMO^LS%i6X2pinmm7sN8&2?UfU@`Z-b1)9*5O|N0ms^jPRjx`*RsfNzcHsCeVd9e+?Z@RaOOGVT2 zjv^lC5fl*zvqZV6Vdiq0a@p+iV1s?IV+s3kkxbqA>4wQ6o^X|Cxp~p%1)K&>OX$E4 zp`$Hk6WqzKPW|-ODe8;fO;QY%yA;lr%dYl(0o>Mt*mIKS^!pQ;_`Ki^lAI-K%wWM+ zxHT=QJ6(1)d>(Xm))==HttxbZRxQQX@(C3e*5o!C-Q}eUWxIP)EZVy}t*Ikh4DVxn1g2WU zOKr3wjcNJblFeraD+Z@p@dzIDyCRg$H`CH>UxPA?H}(iR{CkFtGL?-xDKx9IgHknq zer9I|i^hAmp1GLL;KX^y%7DJ=56}9_Q@-WJHNtxpd+VR%yOh}ug&}NM-aEHg6X-&9 zF4^fsHqS)jpb4BvmpgG4)85vBYV2qi>pg-|$#pG~QOVRw{p47 zs2E}cVH^0m4(A_=KMQLySVx|Omq+)~*OTft(P%Omr2-=Qr|S(mmP@cX@V2SF% zg5S6A(W8#$Q2W8Eh*2csQA!3J2&lwHH1hJ`x2!di*o@!@^Q47K&%^yT_|J9xpx z{eHbD9mVDC{rkGt+KVdQ>;7=OCws%o?Hz;H>-l~A659Jc=WGA*6dK#>_1g6%gVXb| zw^-P!p#cxu^YQqKtK08r-TVFgx--lDa;s~*{dq1VJ8Jtk6Gm`*-Pz_{;N}t0=Yb#e zCKK`T-cseX+^m%Lyj*%V7=+q7V2Uo7jWnhtE|6T|TKn(!>*HOjEH4jFyKn30&flAz zSe_AH++5HIq{`mcy~Z6k4@v0f?B89^I&O=KB|hfZ+_~qd=c#{aH)$7W*J+n&zqqft z+g}d16Fp^rgxFDUuIn3dT-kTG1^J>vG12%K0&HQ92q&a7vUT~ULNn3%m;!8J&IlKz zE3$RD?QWKmE7j=otC!ADTVAi%*SB)gHrg51ZC{K<7XXU`p3kE%Sy|i8B%;{|18uJh z*s4g|pVz)7>P`oI6(+tb;h{~?ro4mbI5x3s(tiuZi)I%&Kk(iMrhHuvi8Hd|!lW35 z{}%qlC~!(#ku?|oo3H>*KOIRsR2hDz<9&ONBNoG$NXKYv9y-ifYT!MxWCu*^0#`We zQPtjtPy?>I3x5md2GrHx$j?L<&BqM50%k;57tO~CxC0gxIaH+U4+`==5kh&(Ck{vo zUPM%vz$Xbv3qC|dm&n0e_<1{E~M2L>Iq$_EA$bjk+? z8}!Nt1{Vaz4+bBE#t()NM8*%n1^lm)UXT$4GRa*k|0bYi1T)E9YX3H%V}vrvT^j!` zpl5_r$z59iJ|GZ8GO1lUXM|bC)p0M5K!$0((!cf~Pw66IfI)P8##E$mAn|^15McFw za8O|LesC~gcYbhiVDSFuYPlnT!N?Y)2+fAkfYpd**?bp38l-a^{>$J^GE6F5yZ

$V}Pjyv36vvS%Z&&rgr|RmDm=C}~V8xAj4U1w=wgL177S@(8g^03`fG z;$cMK@kICuL_!HcVhMF)q*eFelU@n&ssONFGP{m|xrnb>eJ4OXq_^z;v*2Db90VUY zYOm%03IV7?^!@AWW10{2!1esEH{`IF={v7 z7nzb~*A#WXVDvCrLAee|P^;E(6u?ylzn^+$D-hecItT#>+I`ScV}t=NNVyq&Hti6- zpP7{+-E_g~q~O&|exaD`I$#s*6b_b!)OW*yw$l-!nj8*L6*_>#iqK4r1*8ApFIA?U zPRmb^r$revolZPfj4^Q@*be%3)GPQsW_CL0UTDB0e`rI#Iv^kodlN@PNMo^KfwU)_ z;i_oaXWxz;wb0W~R)dUngpQwhf==`-J|YA2!TQMr>Y@p#u+E%x2QIwFuk;>zglI%; zcvQIMCG|Cd#-C^eN~i&7UEsU6g*OGXwuHMDeszNBToSl-N5-+w{of8gt!?41WqqU* z)Qc?-RD8!g-!)-3%sOMFFZdQYWCNw(wj5<~x9r9pD2)?}@G74Yo#=V$Bi%K}4W{SSi$G#il1dD>LUWHW$6g5&5 z+%ni*APoeaP!z<#9nab!MF0uOIUpx#0TZk8k1LPVpP%hTSHara1a+`?$#;+77v*@9 zEWq6yJ&KIfU$d=XgLWp!3hRKdH>)4A)1QeOVImb9@RzH_;YY+Unt%l=)aNNtm68rM z@DTLCpC3o5O=7!Xk?wo+U?ONXI>8XRq(NYcUd&;DDjAe&oP53GH7>X8XVS)$md->)UzgDdm|hRuo&1q3qp_h;ghzgR2dm1j!gE|_HAZIRxgt2sOg=7^JxEmmjJ~ooRIulioX?xLZI84-BemJR;Fw; zW3|zkHIZ6r-=H??7St3jR(W}FNUm{g<|@W|PpEXq#D#w1vSvX_zQ}WDP~wq}W|}u1 zYtpTX>taAc5D?x|D%bguVW3$eP+1g+Fo9#bc2x1vLr2`R08i|zGGXs@7u7dcnxMed zO**ITc`x3Sk}l#@D+9gf2b6ZZL>DEU5*90*BRH>woyO&-ckcD5>K^Dzi>ZDJIi2Omrf%1y6mj z3$_^*ce5qh)2I)f4sCIW7fu|{xX`pwROX9$Q_I_mJ;Ejq6lJ)hCoTvcs86wyCx@vj zu_9(TdN`H@lLk-?BA`_6g3}7vD#>OlqH7iI)F}qa2{I^p;1rcGkkPXVAXU8ZOXzy` zA?c?}OVn2gC$Sdpqs?aujl@&&Czl-aR+fW-Rd|$A;(MolRZ$7Zk+0z2b93l<<{iPE z$pb7c0+!W4<{8Vt+CtS%m8*%r-x3@-TM$3e2ETO z*ku~)U~p#yqeuiD)Q&Cyt%e@fEp*JmtZq(G&wG&eD|SLBn8#)`E#uVCIIWvesGI@B z`irw$MQ3s$_^DafPN#AegFav?o^na!vtoa%4mv+dD&TJ4r+*O(b)Gb`whyVA_D#CtNgEG)3HY#r#wQDVvLzyyE z?;G#P8fGjQi*4OBAbi^h&&Z-ntAcy3nWOlj!o6_>Z594*DJ+4s)kX=PcyxvXL{OreD}V3Fm?mGSAJXAec4D zMGTO?aM%~~5srv6sjd7{_MUd`l`?QeJnFqmgd^9ut+#J5%Ar^pa!6VXx~s8j{~RiD znSf3o#A%ZNLeU}wb==Y> zf}P#NYSsWycxuNKeFM-%0~@~tc2SVILCxz$KzE1U4-H3(BgxIGF2cCIm!^;SosVx-vuLgDqQQoAx_#bWQIo9h6$sj=|=dbEFsVOOH+5 zA=O>v%-!5EL^8=Zej)>g79TY$@~>Y2&2J0l|71I6y8r)|#{XbDI;MZOo%XzB$)bNM9HPA@H&%Ni-U0sIe#{Me*t6 zXQ8WC!93E#G9mTf%3CA}Lo8{^${DD=42B-K7hIK{{|#Ar?@@i;3bKfyFVgeoZ_@+W z+MXqAKZ4YRF+D}N7`eIRdg5~t;Ta!CJjEXxeEDwd7YX->efaQ-hajO&yQ)-^n=;}p z-3xagU;dp;Rm;Q6&3ma;J}W<8O6%PvLr%5a;0IX2sAQpkR6G6uM(xbZ|8WVVcan5$ z=D(KACj@S5g-ZY6ibwZcU{{>)A?dV9+&BNoCo?U z!!?^vTU08%CHdu-R502*GS6IEB_k2t+%DdD;!WC&p8Gq;O0oSFuNtvC=ZVOa4`(Z= zUvGxPHp$r?f}gL8IJC7-kFWPuMid&JeuEDiX29;-$x9pVEv4GNXhSB5VD%cC9S>aH z;h;+}o*(_y-nr|ERt%kmv+q5AMP*u>~&(?95ZhIza}Pvia~{qnui6+FPBytHvM zxe<@g@yD72lFU`90oIgDO2`tjy4k6L<8b4%Oi~L zp<|ZLFWkJy(EG8KuqYK&}fGCJ3L<)$6gRBg2FoI8s9syu}M|f-iCF!4a zx9p3*EPhb(Q**5dUdXI|Q}{#>f6W2VcbEahi6p23i4w#i;3C8zf((^F1XjptsNf~g zL-BAEHG>`0XtIyXZs{H2o(m8TJyAfUoYlwu%3zFKXUb43!4tum&U26Jy?*_M>0w>@M`vUB-#8ls3;Tbp@i=MAK{}|An{Q+em#Bo; zA9f+IB%@%bst+;F)%p75slxi`1FZX-lhyoCa3eRP?gY2O0t!lUDxn*ZdJO6&0f)dq z3}`{KI>ZDba=ZRZfp25(B_ax)a-KyTe2;H7uk0S&*@=pbiF~&1&+{izmxJhxrzZ!g zmcDxEh{+=Oh2YAD9FRzFVohLm5dZ>G#6V`mDi|&1SGtvLC{aQq&`L}B4+(Ay??Ig6 z;IzYb+|(e%^nEt7i8;A7{BZ+Rb|X<#cK-3dU$y}i=4-IbHJsFlE7>FCir40dW~gSE zX1HdkWnfLPO7GN@UG6(p%UhHz7zZ`aF&@0fi@`&kXBubfM-Q-trherAs8h!Ol}?%d zeu$=-~6 z6c{TqOL*kzsyv`@Ln(kq%FLz^KC(#&FF*wy`cxVmBQgf1;7(<&2Ju}yxNd!M!Vf^qd|MGLa3%&gGP8ZDO(4B;XLc*H8wknl z?Su`Rz<+t9dxVxtM#YGKP7y@7LmY?s1=Bico*qXLOCBHX`!giV1xK8~Bm4JXws6xu zn)R~^#70@g6LOb=DkuHAYFiRf`vJ#dY`KE6dmFs>la(ralReL6FC$f?##(Q*VB1>q zaRnyjGwIf+;xrssa4I2xVpH5}Xb9$88i^b0(3NZ&%lb98fp@is7DiWk@QC*yT5l^` z2+Oir0|zL@h@#e#_FZIW(xQV8BTy|J9n@78^%#;xQzw=MpPp5s=LhUR!)Ds`=Ss&r z>1T~6l9|-TZO@(&=?3EK_>*5tpVs+g(l+MzeoYJn0YBG61LG4poG?-A-5Qhn$ur}r zcJV6zc9=$jBYzGvB#3Pl=PCeL_0(*dK|nN>vQp?)5*?wFP&- z*$k%&|Iu*&mI3*HZx@)D>Hi~?ByL3v(7^@Yd?2+usTcK%BNgqc0Q0-1R`c*#kJ|K? z5HCaS_-thLM^ck{r5nwpOO4DvXLg%|?D=lgOqs*2j3}jCZw;mp(I~NwKoZI`AN3u6 zPqv(L^Kznmna(HNHd=M^TyDdT8k%;{rTvxrYD0GM;kgnZrsyzuI9p2$OMCgDOvEkQ z%Csa^p_B#l z7DN?c9;pVnjt>$cI79>n5g{IkWVT0kjCNrTcR_Dm=Ll)=1RS=+FTP8*?zcLLFr<^V zOU&PVfKu8wq{9a3sXqWsa+}bXZV-?P)=IQztmOnm8v(9k@W?;X_688dV@495RVGUT zXA#%d4|a~g!+a8i8oo{8HZOHcu&3A`X<`8Usw5Y8T0KB*PI5Y&g~*yeFCB~{ZZuyN z(_>i!i){XfR6ahWL#JbOy4KC(c+st=q|r-_6DBfKpEYE0h$%$JaNG6EY2xb}pycjV z?H@hi--@CB-=4ro_n)2+uWK1dhcvwNh4f-?h$Ma7fg*JJ4r*k{n&NW9((W=4gA9kGSJ|3AgP+sNW``pv4rsGrAJgB#v)gi>XQ`!&{qicpCoY!P6j@&+EF%Vt1%lNTtzJT&)PEiUio7<>`R@ z26Tm7#JTff^L#0ZZ6s~uq(aUvYjosY&4Z2;a+k3W$Xu-MpGn5>HkU;+7VmW!WBH*9 zZaO~xNYWma@J-G6)1XQ!PT^3%z8GcR&qRuVSzsK|`o8m2jdNgRj_!tE z*6Ba$oc(_jHtGN4oK^Xk_puKYpwF+d`=6#{`M3T5e;?H7@faBynCSn9947q_pWS~X zF|WMAy|h%_Z`fb9)tNF)m_7*3Vrop9qMw&Es^)FR6R0G0m}0Oc?+I?`Te^tq@rfb( ziQx9*IQ#`NNaV}}L|M$GFaq+e+-Z?~pf_r7n2VZX6;6LIqH45=-T2OQyD}vl!I3?x zZa-{lZQbNNWZ!swyv?MG3y|RtNnGO*l&{grYrBr_9@;l?#d=z-jI+BZ*1l&4&4FEK zbc>q8&MIl%5DB4?4C!ZbJ6&x1<0c9SWF-bExjkQ{Z)1NXruIsRZQw`Qu7`$X)v8as z`2yYyf56OU`&cQ?h~9n^3wUk7Y&BSR{FU0+L155Jkm>Blri~-c;Veoc~ zJ(%5w)p6nC3tRAhT+J!m`RrR01#dsF+#Tf;%9nD>LF=1k|AiIzbe^~^b#8{PQEeih zB*Y)5Lp(qL79sTE^yFfT#}JQ-I($RTB^vh1y-thxj=wBg3jtfdhQ75kZ~|+;C1Hb{ zwM*LYis6p7Lhc~Z7CS98w$HIQuy6U88d*zSbJW&ld&j(|_(-wNQm3;gyxr@6Im#?E zGVHU*_=xnTYES85gRh!;tk4G)y)^O-TQm_?8`HQ=#XiRYb`b5=qWYa@Zi14-eAM113!yKTKXz^);dQD zvi?jqBRu_by?83bj?XaW&;U;d$DtIVf8FB0MAc~qk|N|xEd8(XB|8K7sVFp z)}Lq|V(Af*mm-??vOdxz1oL`=tE+UQhhlGTZVUmnZR*n6sN&++mdN5i+l#H0wAPoI zQ66KD1GOvL`#Hu`ds6vVTYtGi`L((9R7HTqx7P!AKUMNrmRnJJ4Y z^*_k#v8vgDJQ5IQ>EKd@awW8Ni46~z;_+9bj4IPH`L58FQb;tVI-mE3#7hITRA?iT zCCj6Tm z)@i57s>E0G>9AoczpTIr(wmF$#sOY&`7Rs`wMT;j)kA0h>wY%p-7LRFVV%PFxMD)>1_>W1BSZNxgilB z*e})N<($4sqZQ|x2vm#DU{I)&&xBM;X&2v6nj0A^8FS9KN?azu6K1O0YO>(Y(Up}* zOk2F<$4CQf3C2cqAPx;@4SwGAKh6H95y!=HOXA~trttGTQ-yk6swc;7v=6F~(pl?C zh%6K;a&H!a4Nx36GKV`k3wL1LsYS}6#nl>08+QonhkrrS4@kXpYz;lY7~(#(Ia$AT z`Fnhj#3Q9AJ*l6!Nwq4KWFjhmKTkMK)(Qk0-T=O1q=mg2I3#oRDF7;Qx?OMjG5BFIga^Z_qf#nB z7VE$=ZANS!Nq+c~;AfApt#?H`l~!{jd(J46H*EUAFm0q1jw@4iH_4wZ*B?D1O_GmC zC#Dju;f2zQ+Y6E{O*2#ji)-!?CViJT)tef($<$kw)<`JK{;?sp?kk9}DL3VSa*HtT zNH#3#$GGoZfW@Rt%g?P=OTpoRJgsI3FE~~rOaP10_Zvj7$%lxD3P&>(7}BLqq?ra5 zHCu7UFI<9KamsHJl*Uf4X$pRMq5N&7U^3i{j?AF1BwadQGEUKs4asq!W0{1mn?b%X zg0>CPXoOd96tZXBzJiQ_Z zyWe7|e&gn5rEdFDVYp)^BulWRaVLWKOtN5&eA0*cKo91ut%TM@p&bbCtz~qaYp?vU zNH*7@Jf9v&0hUW4lq1pm<6He2g|KhT+8(>DN5fJiDWmJiMHN)O;U!EwpmBbhlup%E zgPNMcO7o8e;)(M8ct3c~L7XKpf=%sY8-XNP?NV>8~2?p)Z>QeXU^im#{AkA=3BKbeqb)h)=-VEmWXHWxS?0e9h(jJEM2(xHG zwg9nPO`+V9dW#bQb_xQt0b=QkA6jj?utzm2_omA62HE@V%R(Fx0y!C!Wbasc_M0FY z;9D#31bd;Kn1VKx5sn z4DMFVz3Xd+uHB(JC(tj8g%boF#BuHtN{qO>cxI27(t+Y(1_uiGhSUk{)ZV zF2rXBhwAV;Esjl1^N#JioYCsbR-l?IF%`!@r}>Ig#qSrM>~ni zP+~v#;;9`qyT1>WhrhVUz`)#(2*CNqdULtSH!7%dx4x7->unr$c#Lu5Tz4mD}?ueC=UT-wL zec#P&&ClyKCZJWV@*v&ZLR&XL_uky*i?S?}ll$giKuPcN&;FbfBJdFnYiod*S# zNw&eomL68Z9q@V-O`DadNCcmvC4ex&e@IYwLHG)*z{js4J2XYir6{+(Qeh(MSr=zyktY$~ZFdisIt^PYX< zw~w3Sp1o+;avod_A@17{x;6o#3n3>z5!zm)FH}Z^QM86^!gy{H86?P`8=6@YhmxVf zoNdxBQe3}n%(O6A{$jKJ-nZ=EeJ@s5?B!8yTJJ(>hj6aV1*cTUikcJn1tw~I$K8&Z|A zgQzy31n0tWCHyJ=f$H%O{q^w5DRI=ear_KIe3%((n&w~~-C$H%<%k76x)_ac*ek`S z@LhsQNw7#X4O(6GJdX?)+q>V6>yXcH$uJ`A|-_KFpfJxfVAPrQXcDsxY*S~KG zfBU}cEcF=*ItYW(5Xxni_@HP~jbQBxZU-Jt+i#vKO__RlV(Np7DAeJdF!#X6I0zmD z_F$5^x##`m@X4Xf!ei`D9^Ni8Gcva5z#L;uhK&^Bsv&`DT@S;(QB-4+4w^2#_pwW` z#4R>^j!HblC+GzNRPQ&8+NpClYxOJDG1D4_h|W=BsV&}-`C<# zwzH>Zur?d7grG1zwu2#|uvl(JpVp3yjG{49Q&Z;b)gd2Yq3#4#eOmS??Zk=TOlREg z?JmcZcV+U;6*((Nwj`6i9oIs>f31Krx*ch%!^ZCF9X$H%8Mkko%?^s4|9DspPHa9@Q zPoiM>*GmzTnvITXR)Wo}SPChBn?#BTQOxIUV9DiSZ^y(OF}>{CH(o zmUaDBZ!7B~!ycyElx6 zGO3QY@;AXyL>-IAeZ;=Fvhq3|Z^R7Mg;vd5golC;$4AG%@26lbSiSr#~i$>p#Y7f-g6c6s_x zj#Q9+S?iD|R+d***R5w?$Fbem*>Gv|Qo0TwpFQ$||-v(nTZe1{#hy*ZZ|E|dsNHM@}Al@MQ+V<|lpBvlELynyyZ zQIkqDpR0?IWjfR4lRU`-w#ItP0bEb6z=E}qkRFu>(>WZ4Fe9v;k;lbNb0p63-r|X4 zVQuqsYeRMmC~l!A>bCRZ?ymIX&_H1~eNUAxpNtuZ5KJ?N4ZiAgcu zUHhz;-WdE?GS;urkNjx zhYhA<8Ia;3$!;WfHHooGX>tw6ZPebbE}C5I3H>%z9=k)3*zEw-$1o$JgI0=*Jsuj3 zw@V#g6hW7Y9X4G~L@l?}x5mL!;J3&|mVu-C1(mhX{0LK!$My$p!ydgO(u|q}O$m!e z4LlF^q|0hwF5~CTOrP_jymvyW(>HNdJeHtae4I8f%t$CKuQs}FK703D`R@S%?{iyo zZ;JyM4ESAB%X{tz*E&`BQ>+S`{(B@zRz*V4&hRAJtO+`*@R7D`R9Z|b%E*J%RphEk z4laz^v_9_j*&t^gn^%hIE|?kv!cn_vA7i$hb;xL_rA9C+U|X&?J=Y1wze@Brxz}~fHrCl&m{nsw zx)k4rMPq0`Yv02hHcz&V$fsXE+NZR`_;YW`s}O<@X_e?5egNdhqCn$#76_)TbHwfs z__O2iMB+K?voUFHa(~LeyLqYs$U6YRBiQowEtCz=*d({A4tr2YlO^80btDG(ZS!mA z^cgdwK=$)-8dCs}5nG6K79)}s$qhJB*HN#=Q>{j4CEvP*uM(H8I7ttrH4%(+6f~7= zka(W{*pc~OX@;=wth;ykzUEB)%{lSQL>WZo0oDaO^F-p^C=v&KtA)8TAbWQb6H+aX+p7SaLz)@O}iL_-86EBawQfmU=_~eQ5fji z2#($qBc&~?aMj$Ct%HDm)kjuBNC4ujwnCooSWv+@sc;#-ShW!EQnoI3g$!tW(7-aG ztOafM9V7HS(hA)Q$#YU{Wj~nLA|o6= zZ&%HAHowI`vyw=EPqQWe{&*x~Rpz}W;XUC!_>1mjq}^5~&?FqqeI zAd-l$BoPI3*^3BC9! zCHlB$KG-Fv~n4(eWcJ zI%C>sz2Nw??mR|1oqot@0?M7Sun=vl&a3IVazMseylrOH$l3&rW6pxabKA}fMvFaJ ziDTW;lI-lt0{0v(zyc*#a)cKx~0+wnpfXu3c;oDn#rf7T&41?00HOk zIfp4yqlH$h3Ijp(9hg~nyKx_O%J2M!vG*w4xHf$A-%FhWoK0Y3I!p&F6aQ zdfUWSCq7*VCIzyV;LFGb53%qgBfCgmS!`h~uU^hh90h(E)yLNx#dNTiC?OKcA_oFT z=|BW0^3Sxs_jJ)FH)(f9+SHf^_l$2m>732;`kW`?a;)QfS?rzaemxCP=AIdP?$!+F z&T&oUN`~arD_RjYwQ~n4^8)H~<|h&sYH)01!H=9d$Z!#g%)h-@h%`ZMdfj zGoU|M(O$~SPEH-@c7kN^4=fu>?OTZ)3)rN+%{z=AHM zQyr3s?~^m`@kBS}RFZH>#VAoAfkUNnIZ=PY=v`M4Pn=>L!fc$QEw&f@)f}yTeJXdg z>XF8-GWe~uSUEm05wTF9v9-<&`LHhdB6@p+kC})P9})CcFw>n`+g_E&-8==m_R);f zk%4O=W%_|%nJ&T*BUbBzqGa-s-_di+)n*{;`^?)``r^F3u;D3bdJ@0AO_-gmtemWz zoUDO7N6$*{Q*iJ{tidvE39w5=lk~MOFcT@RmB>-p0xzBp#RHY4dcUq`#&EWxJhXbk zi@Y6M1bJ9fxW~&;n7ZAPHkwMT%Y1Db)S|MIsM?*mt@Al8zC5XfoL`su;42;b7wDPZ7rwI)ey>G)3mG;ljL4N_A+QZ4_TG@sDDudt;R&UtD8A8zJ2uw&0 zd-c7;0lMX4d>wnl4D)HFO?NBbDs|Nj^U&s6{FDfVYC&mTcOuy5#f4Oy8Vl^acW*bg z>u5Csms-Y!y?oWyt~i&_2torGB3za(~NN(wQ2z+_0c7nT~ialqzy%4ucO?R%^;jDAwS6!sI2(k>|DjVMP7f z9c-whb;*^Xj~23c``E>kdtisHFH29CGG}Cm8|s1XA=!j+7{bk=-=+g4{dg58wN)zn zz?80F42kT;Gmh)lDv+~nKIbbk<(QcA?93|BA`9|^AJ1L zGGE&)u>jso*=PtvY+B>O6W|?Ze?+mj5OHCPSB^Xu-*)q9Ua7`r#Mu_eLgm$2Pn9IQ zLe2JJ0Dfy>m}zy}v7dGL$9YD)K?ah>`!Ju#<& zqo4ZEU$B5$ymNZz%Q8$vUqXX7gU{o6zBkQClGD?ZP}N}Ga@Gqm}|I zlu)*n|2 z*44jm-MaNocb)fiPrqlXXXeA{^E_Q?6n<@}hjM$Dr|equ_QHvDOnk3@_ZAIXiEqa@ zeheU0-7>47W=@*+c>g#;gsq(B;{R6*V0aA20L)F7!pU*Jsi2|kfKoww2aI;;6!&)d zf9z#GZMiwtH((}YZPr0FQhZGvkZa+K@Rg*Z)nY00$|8G5JpQz?$;I26dMfMCURtv% zZ>nyU@iDya!ovHg58@ zF`;-g4J5UbNW(rqr=s3#ByF7Slj}L2Y|Q@=KAU1SC@>M0$uoWGx!+hp6TavWqQUi4 zEsdwPUdNciud>)#iR|%yb>OIczzzXOxD=Ky?fX|7R99A3H#a6>@o8H@qcLvLeAC*v zSa_H?+TWQ)B57+3eqU3jCMmSOD zjdFR2gozU0d4I=ngM_REE{3sjB*!FGT0AkQ8bydc`73;}NCnzMIP7IWF`Ndg%14A#(QvGSwBdTkvqcGCbLUOTtT6gIyW-$C_Ey?$Rj>E=vXxRG$!hRU9Ua zhJBcWd<=s_s6OrxC$~(#<_;NCT^_g1rW)RgEMb6?`w>o?(3gnrhrVBQ+EW&9d-7(l zLU%U{1_eC0gcZKW`we-v=le}GZun-0(>HB?-lb;q)`a)=4C4N0r7ic;VyG$HMKeXo z*lZCt z8~_epcYl@zG__Bo#O%cF3MQJXx$q)U1DXb@t_pTwtP8?An$P84taIw-C&MJQ{P z7KgQ9a5fMHpRC}EwUK}e0PY7Zdbjn$IHbG*3w0`q6CKrP(4rw8Ctx{OWsx>$NYc~= zcC91W+EVpVuMD4hz$^(xH~YRmx5y!(O5K`l4FyUlJ8Td7@Lrb!-=cN&ULORztN%6s zwdV+RSNjDgBTh{r6xj`G;QJ3=tGDA_yGrlzFaT?(9&?}qs5B=nJ~QoYf2ar5x;D*` zl1E(fBRg;ie%qjm~-k``n8S}wz#;oz$vwNc{u|&T7QmY3M^8lm1WJs>qKhWdNZ%pv^@Lu@&SAc)o zIJQz~6=6Wdf?hdalYe?~6}9@~A%?QPwh*Y-IXs6PsiKPRh;xd~GdthfsW-5SBd>wV z$dSVDUE@R^d5B)AtGKSD+I5{+<+5pi)~9E@Yox=`IGFKkAP7Y4q1Oy(L87`dvl19Wf6a=7u`tdav zb(6?)UB`;DXRai)$NGpwsx1N5;)nshbjr81mrhSw=bNMMg) zC6vqy5V6EL8PqyPq~gl&jrmJ9xz=sglsdQoOpPmw^gY&>z?^2wjK;IX#MSM*-P&nY z6c=>PA{*9_vClMvK^2U&wdaFwGqKAcJr!&l>a8onx*F@qRMc^(#c4b{3s4aD?b(l# zRqwW^V~IxYwSm8l3)oi&FA%#4F5V)wlEl>%;&=KcY#!kHnuUlnAbLqCr3y#IwNsQQJ}}DYv-TK^e?q>z* z$*!xH7fy3!Z9zkAZ9_q=I%Dv41weY4ax9VoTgqYLje)wX;8hSNx2hPqCvE2c=?ysL0-bSfn zDIegBIMD-);uI=laEmy))KywxICqt0fZ+eKZiEw=oN-)#Zj~ zZ^d<0Lt`+yxj46QiHoR+&4Wt|O6=%g*`$>U3IaL>@*3eMlw$v&DIBSz<@~Im*^E9` zV3muS_qKI5nq?aY+Xj&|s64UdEjo-y8mjuLha$6~0=^2Ty1J$=C!L%olTCD6&#P2T z_UE^GTzAr$JuTsfxEgCs_?iNeaVF3S7roXs&(1WO{QC-@C)g2j-j5tJ=64KxV=`-n zosXKn0#XL97@rp(05W&SL%j~w+3L?3FE!8nzSOt8X=C*AU%bk95clL0!JLH^(Yu*_ z!c0ND63H{Q&kp)f-^grn)Z66{xrp_kw@O!^jEEVDjq2acHRx6%8~no`KY_(F-Qpg= zUSSa9uQe@zxoEwv+J!jA`Te8hSF)|>xaFVm6jTHbZHZ^P`jCEnXLdp`fVsJ%Vh(bBC~E{2YWj+di) zpX%-wu(SX7>+9br| zf6eZ{T}_eR6(gziHEA1mj|r#=ReL&(kUuxij zL3tp@ju`i6`aX74d27^$5b*ixr0r$s!NUXh8CQqgVLR&$xZQs~%kID#z0vYnu2a<$ zc|PQ{-)6VjqP4CS-KH~nKIK7hRSZnuMCbWu`gC>Cw(Kx_$N6!))OiZHXKzDrn@0N7 zMCkv00AfJgE{=dCr@k!=6n#s^W$XKlHw}3AV~qY_*Ck<=gI!scz$x;DWlJvG+}~s0m#;@yD_xBYYKrp91kz_oqETcxA`3B<<{Lfm|Qa z+0}<{inr>cXI&8p8lc6>kPI6bW?2zm8=SVN2~P-z#mW%fi<^qZzAl0E5Q}9g?$t4f zzi;&pm+_3oJl*!m_&ZqMuxV6vaI!F(5wryNpHFdey&=B(w6C;W7-m^+Gk69OV! z%xeBj42iO;k!%hPf3I?I$Y((hER`jdbw$i*J^?a)q@OG^DphTQ4}OXeq`sn8MZwg1 zR`E|)Ynri0e39@OcylZ7oE<;Z4U z?@IjflzB}!$}wL>uUn6sjQ^%@cVRCc^2i4}{3CMld~Ppa4+Pc)Ig)82B$QZ|gP6a+ z(M0JT8j;gfF$;$jOh#K3QNc**tHrOjNe5Ij22wlKNJ!X%oz!i;&fHbioE|La<&wFEc;5#-mL;(!56E|B46}%_ zE(oNvR9P|F9$vo_gS-U^?;MMDl>kXx)PZQmU@-QEj&(sO+VQ36-$^pfUeL>DKhdo1 z|4}gdw2XyA0McF1D^NFxKfCkm<~iD&!STFX)SsAS*XLia39$LI+JfPI>8lK~-{#}{ z5#HD}<_zy_ayh-%>pe*DLEDgc^Lo!#a>K#fkn8_3^Avqsa;CuE*_6t@M=>(Ly|G`h zza4|ZSuon*um0oxjQ5}WFD3uo=G|nL?>BvReTOGD`JNRq`j4{s&!qVGgW2k|znzdW z*`KWrAmD?niQB4nnqLrZI`>d-=m(QSBD(MPjt6AJvim-80EF{4E8K5Eox!%rLs`Sy z`U+%SUm9x|4;{~NpE|o<*=XG~-jFl-d(1trIC?=ZD6jmqI-vLF4Sd9W!LjT}m`#a< z)!(J~80Dhj*)IP{iqBXMS*n{Shm5KDls6tT-oVx@(P)}3#L8q0+?(p>3m;N%`S+Hk zCsC}2T)0O5UE*vAR5oiodnWPh{koD3F9A;^-f5FYEsZq9$~!7)ed1XDe=h;rEl>M= z!EY?FUzSA7%Yu8sgHHxU{Ak%GECQ!{W%W#6x?R@O=sCU94wtojoeypZUP1lINvDF1 zARJJWrhksrJ9xp;c_vGz1o@}Skj121H0`2IIJ|$UyzrQ`g7a+Z7?)3drAA0i`#&;c z4X)Af^229@+XFzc(Ez;msYc>JO#+o_j?*WxE{)TBUSFeI(s;% zEr*i^*`>Z+`>;TMh99JFbF9D1RLby$bvyZ<|J)07)UURMO(pceKs3Tn?RQFOh_lct zepZIKJmpX}LeJ?xp(cio;1GTU^TE%tyT=>$ipUt)-ZVRfIzqZ1GeSW@sK-3`k^1Kx zTJMs`<3R5b`&+7iY{6hf~v&7)0?^73h zis00a&29#MFiV7~+iJzz4BPM_ALy!)LU@i zV=Mk+*e)20;qPz6HD;7P0%nSb>I#7WIPo;Q(`pF2KB(*i`p^8kbfFt~3{Vf@flkz8>KU}zE~9wlc2}ZT zEJoY|9!c-sY18Y%Z1%1QSh1>R#~fx%n|Q+5^FTY9^00LSv=3|sZ&wKNZVl1)7sbXk zxcmHd?Zl|nbYV?&ebga>)ISxBHdlKZ={s1fFlN7L+CZ}EL%UsWzKB)P_ndyezCN$O zo5hMFX60Y|32gQ2HCAVP98l<=Z@J$y;D~rc7vV1&(9lKM1EU?bl<7ARzc|L6rZ}qi z>VUh*pRZ_1x%rw&Zo_tbCg?Sf_EM?qS3g<2L8sLxsiW)>5FND7x@uAA%S3UG>KNAP z9;QLLMu+is#ryIl9BTt`6mKWfPxhv<4 zoS?tkZ`ibL(?+(v7m45=cI8GrgW}JE@pBDTdQt2*H}}XsUMm}D+*K?##%Cr*0cLA8 z$32!y_hNsmd1oJbw`9M0ty1w+6y>5ScO1zxcSE8srUf%^e5|p)Q#nlBEDF- z9r7$!Zm8zEc&fuy7BpBaB2Y~nFIL!vM6XTXMWumwyu6klpRczpS*xq$N?&U^Wq2$+ z*d+~L<>(mSiM=X!j^71M!hp_V4gXnv!NcbRbuQ7i!Fu_rBv|4UgZG3(t-{&yrHbZ}gaYvfVbJ zvGKdF73kY8hjbxG!#Z)fq~t=SIL*1E>Gv3EoE*-v+Dp;xrjM^E2vH?vEZgQ{%YI(S*|vcMcVGt2aR|q5&tZ zS~OIi70<7Xh6=^BGWW_}G;alAA9$LQT~DD*J9C=wY6ly*E7XgAqj3MJ*9@O~M8zy% z+-DZobNZ2f)7Ju=IW^kFu8zmnxPPa$@^jk4S+ZaKE#=Y!5xj8~zpSQLXw9SkI;unK zq-|baR8$XeIJ^pPtWJ*hVP}lN1<>L&KQvB(nfJl@2_XRGW7=;{KT!_XJ!kaH)}<`v#EH=})z+bA;MA zY^oWDz;Z_2jyv7}8yvqn{!dU>FjsUOyr{5nn zo`wrL0%+)8Vq;ZS;_W;E2R}mzXvULtLvfdTorh#_*qv~fWtb|tYvbBS!iSUrX|i;WE4$>e)yZsHBU z83tTG9E8%tLYTbSP`R0{%12wXPuj+JmSqNt$ZkEdS|ZKTm%o87F!u zk7{DER&)JEe!LD$G&$aPbhvqB;=`6j!tzSONsHO>9Y6hGLi4#%Fi7~#!^6isVCj)5 zuf#jC#C`hA=Gt%brMTnYxH%AZE(VLWcp=;ysN2w_GMnWcroCvSg;Cl~6{=;&-T zNNIM^bW?VQxAI0%bx)ppm~l^;Sg2Sh_z>_Ch_`gpZVG-iR`{Fy;Ze_nYeRoJpZXQD z3Y=yYI*B)p(9>&zP25`*&}FE}`m}S1ebr!S#T{$M75{*Bi!+E(Wj6C^ADI?><+HT3!)A>=L9(*;S&1n(pf8Zeii|wX2j1HI6G1{e%AY~JJ zJlJ<`m{RCiy?5-<+U|MpozumNb=GsWV8y1_iudDq9`{4hFKBtqLc7AyDe-IxPwBy{pcy66WD(cw!aAYN;vlOWH*e=x52G79^IIPIhdBc_dYLzPs z>a#=Rd&W)?49aC|uF@K=19wh$Yy#&_ofO&;$G^DhzZf&BjPK)+?}~DTfImx1CJ8ky z?~$~N^LPx5M-@NF@q_^fr2&p|clRegS+OqP+m#3{_ryZ&$9bbWUK)8a}~qxpK8Hdproe z!vj!aml`1jxkjABr?1J7V3R|#nL@ir3?7i}hDa=QnC#D%AAZYdGiV!olf9`Te6g%3 zgM6)M2m4&;K!1Isg+FUOSl748JRm6-BNitir%$I6p= zt<&X;NpWJnPHS*1R+-f^9{EA6E$;0i>dnmA5*7?xRoG}eN&+hWjO?}vPHl?-0|xjH z-7DcJC$ke{*@_5)Wl%Q&#q4C3h460yCK?Kkaa0AuSWNlB2)S!&uG2a?l)s`xXjmq+ zi$rMdP<;!nLQG5?ovK%c66$E}NqTWBx@`TI{Ghn%b)+mN=we~|H3Da+4qVWg zLjlU|BS}*d-X3wJy+Uny7Z9e6Tv;0_UC?4>t3_J%z%*y8>ECbl2Xpom6tT znqXI;`(ofphb8_nHmTZ8uJN@(+klc^Xn*TUXoRT6=si^OtocI^vd417t@< zP9(3d|CU>xjxXVlP`}PCx6o-gu>CDK-y4Q&=qtDTJ_0!mu|0}C zUiwsrWw2C-Z@hSDE;c5={11H6R2O0G( zWUbnSIr$rOK~Z+?7;T~JgEQo<+HknX&WtRBmj)-`&EdK6A$G$Gpv5mE*I?db0h_+e zG$)=YJtrtxjsHxS0wRu0rih`l=G8V@NgmMn_Nb>)Vk%n}10p`yMv&l4rAIKV*$E9> zz&f-gZ-EEIQ{KtYm~We8Mi<#b61~@$znOwOq((4+5Lb_+ZrO+5_Uvyveo9R3c68#u zT?aBFxc>;E>oN07dZoV8ba~yJe>7P`uUO8OSUN+(ST1vDa3iAbG?J%s(~hP_uH#rP z4^@te4|5scbS$8LG^_y|Q^iPuOgxF?z^Bh%%5lB9`- z=l;|gNOmfERXgpDHFULnlUOcS+x_b~iFby2lLnrFJ4a&FpezlyzkjYBmh?Ru6m2`s zWme^7JwY6Mf9WP>8;p}gSk4?JUf#Gtl_))ssZffvyoS%ZFeX2*%~%rPps4RRuhF0{ zh(zb6YHla5t}bs!*}U&QaERdPV3Pys<7L;SEdR4s?%KRy#6^%{5?EXE9Mh?8l4O+w zFC1kM%vv6RnXIdJVqtBynYMi~gRA+&F+GnO`+=#o$L^zcof(#Sal-TMQWQ$5yn-$J zl4rewN=4Y)b@wz3SXKsvIlYFOpR1k2^(vI5%ZL}rqPbj`Z@UiOQ2iu_(krB)dP-I& z#Z*aMqEP5dp&6rcE>RbLn3Ra49EMN=-Ec(C~)@+!BY8;~=`sML$=Q4v?BAXPgeWNQ9nyFE3> zBk8n&f*qDDJYi?FyDXxdet5X4yJtUXMEkImie_YdQmPoabl{uc%$2X%y0mJEx}qtv zlBW^DE8n`&+R|ckEshqQ16KDE$NM?7<29{KyHI0rrD;TNq(}*&&9R#gr_!qK>L=Wl zgQeMGV+Wh+dT-3i>-$zcEZ{V072_M@W<^D~QG+cvh6wQtOHcx}Z zX%0p(5rZc91uYz>o{-%1(C?mQMeBmf@u0x`6zefUx~{O-qO{MVk=3SDg{my|B@fT) zFfeeEVa>Qv0@HYTagFb!?CR5K`7yLf(6FxK8uz?crnA093Ok`o`D}Zx8IW7Nzc8~S zwR|aBA9m6ImJzk|7jdq&MT~Ic=+I_-vBSE8B)f0`FWwuJKjXgD=9rpk{m{huPM>Q~ zjd!z7X_Kgyt_xit*L8Yoa#Fz<|g`D%@eQcmfKhWZ6vNrH|mN5eE6inLV zHK;RE`BHhVz4Ntbr8f{?tTDIhtSqoNCLZ$O!0S0q(E9e}JkF8u5k+xw&h9|sfNI2v zd*hUCEY`jvq|2D|jOL<3PNPL9AuM5@uhr|#$YVJ6ay{D7a=YHtW4Xt-)6m4swJ6`v z#MP{bn1!?M>SWf7IG!jgSkK>oi)r6%dQuKWILWzKvOyAj27xB^?$#QqG0~G+{TH#K z8XlwQ#7r5ob70&^=qkRtB%8KQ(NT51btfqep>qt*K}m(9T3uN3-EN&SJ^457sdgzf zJu|Zx1}|4!`6Vg-44ftb=6 zonw)DsY+R6O1kU5iq6}J;KLB)s^x6o52L|A$S|P~GbYRqBDZH(H!o~qfM9nxaO`>}6p z`H+)`U2C+FxxLQ0?gIIc`=W{_`30_)?g87On{0WqI$u$7wqH>(c>Ql~Q&Se+TWfKa z_fcwbHWzx!c`wv-me+M}yIMxs^&QrIn|XbAZx*z6VBCcLRGyiJuO4Nvusy>$nTzzI zNLF$Z-KtWunL|hjd`W8#nY*ry==Z<#yqtre>4DgEs$X2wo}_dz9_MC9<8twfXJ!0b zn{~U5n9AD(pB&tmZtRs1d;4fM#BZ7?EoFgf)5)z!7^?m^KN|G|!-BFg{Q%RYiEL#J zi)9$B>^vDdMzUDqPtQ<^u$6Y9CS3I;lF25n@r}s$ThPs>4#Y3xCs#M=Q()6$XM5Wi zd!jpR!R6PfEo*{xWP@|mn&!ABZ&$CLUNZAGG3%4pa+Wqe@HCW_(WecaeqK0DfKPJ9 zePDjOqTz7Z$NmgRvGlMHj={X%}> zbs*@PKz&@GD}NVu^LC)wdoB4Hp++fMtlt`em9(_+r+;pFM6i_DsUT`0mPVF2WIvadl z#GTA9@obQ?!dDmzflBrmgN`eS;(}85h=Qw_r{JNj{O!Dt2Gu+zD;3ehUM-~mnIS?t z7Y|zRiKkjn_k$g&B6CDl2z^!d)9#^%))I0$;|4{auOUS$M}|>HW@|6) zi;LOMMF>ANQ!BDO-v^~`=zopqp>o|qU-_%A8Puav))Wb2nLlj# z1e+m(X>JT!tSGM$*^|1EaD>hwIXh_ zp<+G)L|OSO{b=V`>A3Nk(!*vkA#q(S4^WBkIbBF_Qu_X+?2^w>9Zx2(Z?R7|7XcGA zSYzIbJCzR^+a3LP zGQeb{cWBb=vd}ovH8QWDBUaE7zE`;Q55W(2LCsc4@1pb{J!}N8@-?qtreoetHaJ~Q zN1whQta*{GmL7T|S{Jb`5^C$kcRoN=3wuZp95=}r49;IWdhl-BvWz(*mn+YULG!J( zzeBe^hWA6#lqFIrS)coRh;$fti+c!Fu*+W6QPh#+iM||e8DyYZD5I0;j-x8Q zDEYi8-8hD?ONm{sqd>Rwgk0QN@h;~EabkA}+M)wyk}>`7v(6sx#CSqSPG?{YTTIZJ z^|_p|8q0IBKrw}XgoR31e(#|F3ZON`dGbkQ#0#rU@0UlZ+jrqcCi=p+{ONT_pI`&C zrW$asEjiaUq{@d#X{n9l%_OUP(3P^(ncD#|b|=n!ocy5AW<8eh6!&O4Lms`$6$C(7 z#+>V7tSdN|Ka@=r%{etc#EFL%zXMnp-*mOm9l{G;JK^z)NKSMO%u?fI>mngCL)G9g z(f^sc!_fXCGi6t5H*oAW57vmf%%%kk~#MAzFC=E#^-IjHK?H_=;icM>IcP)zAw;X*LL5tgtu@Y)|!5(j`doZsq z4{~|wWZ-Zpk*=X>Kdge9bIN7>bq>ZZk!0{?`0pIV0n60gJMF+51YPK8SI7gsArM+= z+aYAqCB81TBe*LRvkAM)|6CK=YGI_Xx{*yDn!bAHJ-_jZdi(G$B~W{0z0t0+IT>SE zSf{`H67N}e&c=J+`mWX_^Ao3Ax<@+T<j7zj6PS1( z&{d|8X)LyQ>WR&U8wN>GY-`a-<6)_RNI4kzsZ6qZ&c9WrY{ieTg1-AGkhcsOX0#KE z5C2lxn#evQoB%x6vA9)t>X@9WTuaaJRWN>NRz)KL=V_Lh@RNycaa_=1e|OZSu(Lb7 zNr(UbjGB?@Fg6>xW;vEl>hK5zSE(((%NQw4GFp}B9Dm`6Jja+`q3|YGS@4NCzbxv+ znIfCxy0dK2dv;wO5DbN=GJuKk&L)PV;h&5qa01+9*Fj9_upCon+H=-WJ+v zeo=sQ!3ocun=WbzVc+G)ex~Pg%?U#NR}lOY$U={djQ&c& z!)+K2!Q=ZmRNxK6>Te=Glc5!0%F$BxUQ@cVE8GL)q~R2e%}$q$Eh4{r5bMCnLD(6` z;BtiD`Oo78*H4-2PW1k2b=3KdK1#fCAuF0I^m?MA7J8cI@q6){dCyDeE?9C#m-3bI z3JvM>30!Uucy+7iNDC7q%AnsHM~VBR%KNBSM?6c+JX|K512Oy1)|=qXBNc_>);Hj< z)1`8fu#ViZ4qJkTm#iJtbI2_M!rd6*0IAOsnm-Pa6q-SW*#s}RlB1|dA@^f z0@dakRbXKjZu;@2u#GpAD|JUUG^M1XF+YAIQ6_Ygk?wVi%jWI`x}sb5mWyZTyvrFL zdns(Dtl3RoJ|ABoEOoM!^qlXu{T+*o?1kAa?ASnLqH?Joi2aUrD^s~5SWa5`@`ylL zaWq+Fmr>0%^cJ-WBKZE2ezM$rQe6`GUWCbYXK(LdEk$3>7XXC+1A z=#bP}jmCqqpEtlsrYRO1nXzYyEo%GMbSHqA)&Al}RK1lluhp9x3*FT~BWcxYw=#O( z%*4}U9c^a~4Y>KoiY854yRb=nO?;|+=2nXe!Essk_oWxb01|A(+kmfH5m4_qeo^hYLbz7Qv|)G15^z> zMliPFPjCjBU-p(i2M7tt+a*E4yLMt|Xnw_!LjS@MM>ycU~akLe-W_9ebsolO0cChXVzyUF zqYll?-J~^GL;4+t-`&4cPrHS9Y`-uA!n^}qrNDKA!GAKUGUPMlg}3iDQUq1bjHBOz zdxG>|o0W;_17joe~QKwEZYMVBnk4AO$u)=7-G|5w#SLs;879G;4TI=E&9%eZz zBu`aI$g$D02rl4<0!6hdvkMsR;2&|O%20q>CUfdzyKqGm`Z07+R;5o9_1mM;tC{=U z{eYv~lqILPl{^DQ`?0m#uW-AVnh`-l-+5?Hao;?OUnfgv>QTS4G$|JBq;2Lfi398p zU^acp6UE4WL-RWqFji%%wL3RJ><^szWnFx%G}?*2?cA%~UW8uY4`D*GKWHz_tgWnt z^`}afou{W$gZJJv9i(W~ma*|9z(|}wnT#=eV3&-@JAUF8Ww#=>{<)&drcW&~++*Y& zZ~NfOUWY(2FU^@F;LiPZmDy^{(e?T-YR57{x0rPpURslx)s#gOP`SqCZRBr%F%tyb z1pLN2e`rsrOBydKdSo3(ZLeal3mJ*I{^Z=z_S^Vrj)vj#d&n)|@NnZ3Z@)`Bo6~2U zVu-)zGZYN0+&XitOTg9gVrBce^+R<#rL_W@`d=rz^{S_#tlXNddT_FR5M`A_&mp*! zIC+g=VS3bgjxYllf4J-4XKneyPp1eQIU%B3e~jsKYT;r2A3_uAz16xKHO1DO*noDr z(si$vKkhgP^gA`#7*LJThZxonaABH^I`LkGzuw=lxu2HA{R78#9UZ7o$YPeIsS=l^ zWms?2u)t5A$TPX*qGh0{)_A?{u19F=o#IJza)q?VlU^lVRE8L~LWCRjn9>u<5ho{b zG$yeSE^3;9=`D|JmBbxfS|~q%_V3Tetj6x2Q(OyQFeA45;vX|@-L7N~@I~v*a|CU> zKDz8nJwjnrlfj$dq^o?NXWGTM2bW^I82#mqO$WH#(j-?uz~Lf=_prdCuMpixC({0>C$D>FGpXwv{3EISSCZUM)jgyTTXnWXi6sW4A^bs|A5?5u z5sTIUEfU)rylxF0p=&v~ACIqz>1mbD^-~73>W4{*f?Var_Lq^G@>$kLWIcz}J%Jyi zEixo~I8d_pjBHZpKe)O-T;g>->&UtJZHL_>mgP?m-O7d^!t~@mg&qlhO8xUc23HYI zz7@NH{84RJ+L5%*OZFRBmQU+1QHlcoEYghzoZ<$WO6fzamH&#)0bsU}!;!`TMN{1bdsh{$Un zcRt2=pjuc4F1|vSLqFyxa|bQnSGfCu7mw0c2v0sB)ubfj(Yn(l^}+CcOi-WS z2Bu@29DXfD2FcOe3S&%_uVQ4X^gbIp+2ZSO&_QghWAG?9I0Oo8U9af0R7DN#^_wcGWH2H}M`y^(yA9d$T&>UjX-9Dj zRVBYwKN}AO9`b>_0T`^cHn~$iOli8G_rhS=NYLKM>LpKUu=W&mmsw zZ{CIA8vSEn?ygv2S%c`QasF)HpIB;4n(v+Vb!>X8^YT)gf0tG@77FT0+FmsjBj_4D zE|C6VkKqD_!Q8qg_C=GRy;&C;nk}p2bHmfdKS(|TbjKdk+(G2xYJzxKP z09~b@)YekBdrX@oV7q3jd*w~-+I{GyP2T1DCkhR?M{5gq_!Q31m4RRCMlL7sa$G(E zP=E2>d-$Tzjd5K|#@Wg_zjK+8k4+wWK^Yvx! zKgp5|*2V2Sek0ZsR^6O=J8QG?%=As>d8&x`F~ujdgU<_toTQKX2x56%IKdVLB;`Rj zi!>c5b5hl5KUfYCc#Nu9_P5Teb+1QQAR)J~%B2DN(D0)8ZP#@hhTLSe|JVkUZL|2wC<}^hQ zJY1?)04Mgfe~KMY!E(!=Zb&{=ZgAMf9m?^<`z$j7PXG< zLMeP7^`qT)+T9!V9r?co7H}BCt@8s!{R8J*=r1%)s>v{jQ1Ga`(&&qmi=@E@o;r`Z zDYIE->C&e7ecMhADy#RQVU~wmnY`TCME#8x{G;vxhRFHT`*Z<`V{i7)kG_Z;U#J^5Cyv(*Xq^^&sV2 zW{WAx5}AK!8!Ij(`F@|kQt)oPj51gE*?@GzD1~bDL<1gP1i{r|&6DvRv7(1>ogtXS z9DGJ}e_qe+{45cB-(ax-Gi_EuL=aUl6>o^^ar17jeaPtDD#InlUJ96#cCIFG$!%_a zmpXJW^%V3`r^1UY+N(b#T_mmgHI#c?h#**2TGYV573WwWy+*}$I@dJx76b+&?qxRs z7y0N|S4x^`EyAg*0NarHi{K{`3aTk*#?Q@6 zlC8^j@hflET$QngD^I#)*ul^=FB9yUr3807H(sx$Q@Dadi@iYcEOU!5)~r%B1% z(?SXfHkdu>NrTToqUuVBgC;D zgy%D|xT7hf=|j+@w~-K%Bm{z#LH`arlS3l^r#CcpO=Z`8cu?6PGSWd=*+E*`K{<74 zNvfz&IBScI!PUh0Fx4MyeQpkhAl3%!)Ni`l!X3)85$W&aN>Q!?a@=gt@rwJ!MwJOc3lh<@fy~E27RiH4q)!)fT zml<0{TE?<~r!3{y3=uh=(Wy>8<%%iV#LTF;76l2m%-ETDx?cY(h=;U$-rDA#g-Y)j zaC)jgbaKtv(qiMR&mKy%j_J*8a|z-4lg%gm;P!&m&yQe43)(RX$`jV3C-YD68%b07 zqz!0>l*F2YK@8R#sAW!xhLz%oB?xB)(pm8>6<>RidO0v=yx=uxj_$Zb_B7Wm=IJ_- zXrIqMh={Xh4Fke&9rnpFCA|HP}5&}$GD^z%EiNB zQii0{wQZub&Ki`{ktea=*o71aT+g21J9VHwC?Yw|CNR0)+a`bw6zxDh_T8^-Aj2mP z`QuH$*kquy4v#EAFtauWXxHfjbSWUK(dyQIR!c(4s z`wsPN^-dHze^<-q^TB09Ytgn$2bxGM1O8=&=tx_o@hbk(8#dU1)8N8<3Z**W z2HqVKJ~i(RlP+CsH~Can-C6e*ZKaqvT7}P!v$A}va4F=3=|}IiV^`OxJwHqIG^_v`$+}x~XJgy09t2y3ZT#g8CfAO$vX>-`fKYh1? zXl)TWSWpIU!_lrxZ5Sw-5u4yjRHv!Hij{-K-45T>!BwlV5zi3tKrwEwU*BF# zGqdsEID4m9QKGF)d)c;)y=>dIZQHhOYcJcjZQHi3fB$`TzT~9S-FJ0SnUz#hqvptX z=KHAV(acjF83sw1AWf8NiL$jUJv*yPPiA#w)9MAzJ~5kc8ri^}V}(YnUsKBXd{3+_ zh3j%Cf^VwPhGzSL|K_&CtuR#q2rOg_Ij}%Jbvv-YneC4BSG2cZJ|p9;K9RKvB$u}GpwR(3Udm32356%5*}tC?62 zvAgIlXMb6yk;Wf9s9UKIsT~?kDeQMsu87h&R>w z=`Ci*vMiBXH>*a|W$&=OEI)>P*2=S0iN7W*$N1G59Zu}5pj8VLO!jyT-kkgKD(&0v zc9qjIsA}*fkaPv$kM08Q2Qa%G7^RLSJ(gbv#T<;Z2IFpMdRYZPP`qvl?$+@(G2s6&V zZ+gb@-9q1P%H!cyS8HXpon*V{ap#Rqgc_!Y;geg%Y`(6o=6O!oFUr(|C&H)Wx8Z-i zaYG#vZ4G!wAm+=q?ec#M-F{iM#kS{k$)LP5cm?79PT4XuwqlRJz4INSc_Xv&a!FrL zM-IOEa7&FK$Lzf}`hEeysV%4@?uKZ&W8Os_T~Ci1i4a|fpzH5GGlK-d;>r0C$lp@5 zpbqji3l%!-bxMwIa*aqyjdE>_O68pV!whH}+bg@PH?wCU)dG9f{xbg6FBe13c_>Cf z6Ps{GYnQBT+_=QG%l$%Ku79YLtyY+jp=_4o@ojijAt>zY$~xl1#J^A0FUR-}*dUq4 zeNYWNAuhXUdI;M|V*fxsMQ!Xg+O|c*`92(47y49=7~ydZ>ep3AG(#qN9qxjE()#ml z@nj(IJ0J2BN%|c}^Q1=m)G470@nMsVQ)g=M)ris)6y%rqQ$hMIhW}@C)dd;)_GHmv7VaYa!358N>_F;z=%a%8J`7S|F z4P!IO+o9jqN%bMlEj;AW<(VcGfjkCXC(*WV8ly`J%to5-rsgnUK;N*E4B3UiploQg zU$M-rjGo=Fv7$^AIv%(hbXSop+OBAXbu(Mh#7Sas1hO)>p%Ld%>C>?GGHK|dM#Zdo zHdm8dcv7N9iU=_)F=L(mxBWP>4$Os3PZKCXq+G;$(%O(aw5n)q$o`j3{lDHs>Jwkf zoLMEE+1}7^8H%1vB&4qt|}Q@WbN7_$ZS4G2vf(7 z7)iP$E0ok$ndl8k!ZWuFUI9HFi(^r=TpS&bW)n(gQhM}i&@Ty(#X^H0pL;{^jdD}D zH+tOej%M>fo&veO0G?iQVLM7kZcZMdCQn|tG_-Px(K)6uoofTg_cEp@;UCBiee2Xy z-u3*z-;26o0rW+x7Z`-QO%~xC7NO}`jlq07u6uS5&TpSfR;xZAIF+()A;0fSTYizl zy~=nnF})I35=MA0C=9b<fcN# zQ^at!6hPl7c)yrN!t{tfq2HrE&8z0pE`Og5`OfO_M}DK*;m??8isMH^Qc0jiIcwQI zy-gcetytGl6+_f$RW^=&lg8yJA9b=89fwC|eO(Vx(Mn^Yez65;tthtU6x*<>!$W;J z+RmK?c4%x4x5e!NYHDRVuPA$~#E&3VRR0*K1yiFn7Pj(q_@n$9Rtu5MV=a=ZiXmDh zp<5kb*)dSDTB#R?pH|$QzBoCux2^=B##JsMf?<#T%v z$HRkL?0s`^3~j@YMSM#1x{b>nq_ieD^=BSx2`HR3VJzwe>GmIf>l9u+2a2_WWMK*U z+ar%3wY)rR_l<0iy{*D)=Cthjz8jJD^Ej_dMDI2C!Z^+zrj3nA#RT?AoC`k%E%3qDUY} zi#q-;1S~|6a4$>Qngd{|Y#Ga=xH4M>^Ib4R(E{NCuwhf4NCnHn_Y3Tce$9a?kcj|n zH#N!_ZTGd|DJVUJPQZtwb@swYyXx{WiO%fd)E*Y3YiQ4hWPo(B{?CHKfOr#Sw~!`v zGL&UOhcfrhL3y~w6>#Msu7LJX#gl8fs60uTxVh53y%s@&eR}q`Z!5Xde1TJ?HkwRg z`)o#&B?_Ds#GxYicpTPUXxH~>FZq-Y1wZf8&?&sm&ZgJ< z++0sjkB?AN*h&=#Gl$1#CQEB=8CJ~j=t68!3Pp-$^!ZIJWw{P1?0w?MO(hvw&Dm9# zq2WQrP2XKUjg~DgR)@=Es?Z=C*+^yODoOE01l+p4-|t`kwU!yd)h09F&{Ke2Dxq!u z`c%VHaoV@K0Fq^bmP5$%RcIW!Ej8JD^_#1NUrQCap4)+aG@m6@)eYs?Saw#i1wpSy zzBLqUJnH+6!c578;d4u#&=Gd6gAk6R`+e^qf?!d%zKg&X5+)$otDu{c$?4VsSM_?J1%)Mf0ZO18|x6CwFg z)8n%V#!gB z1U+U?p+VSvpU)kiOPbZjS;u$Zp;4Qm?P{f!FUWg$F^SLOR(PHFZlGV1b+_bkaQ<`6mN@g4cKPL z3pM%VQW3%~dkK0X@-&pJa(b`ZI>;()cJuB6udSZ_=?ym&aEI+YQzS+8{Hld`|;! zY)2*oj9-zXfiMM>*1tq&Ob5L{)AEURuUt-obcA2j@ z@0KrqH*r-d$U48Yb#b{^XgXQ#AHT`BiN67?C*Pmr{(T2FU&ii3z27o*n`60CI*-@C zte@Wu_pPM@kDPb6-SVaRx=_ymj`uaB95Kj!U&L>hdi7FhgxB`mgWgru-}}$s-_cFq58mt{Z}N*EO^J&E9*)>9_ZDG(>@N8%IU+!(fr&e&HeUr0ZuU(+ACw^0xE#@5>_*igzw_ z9u)NCF^iOnxD?f6f5+=xb=L3giS<&Ip2`JUs#v){gnv*gPJSmB`~n?oH4Ai$dH(_W zKav9PCih}kJ)$M^meg2rWJMC@mOs!F{-$ZBttXU!c1w;6lTfSGFBeCkBs*QjJB7Tq zEmFAhy=6XGazawG^1HI=KAPog-o@UNkLMsK_d_1)eojAj&;3S;{tRo&2ETJ`M1h#6 z`l2@&2mSr^${QwYGvoz^zci<_Fk%LAE7Ae+Y0U?2XB9=m8E?ic@_!4ndL$6Voo;>y zH3Bh5*-f#6CN%vfSVhav!ceQB5k)%LY6@6hx7u%hGoF?JJS>k%DF$gC;^fAF5~d0!Q)pujH9bcs!&;yt-vYeyC)vq7 z;_r9}17Z`Nrq-SYLWuqdhdJDcUGNG3_co*pI4AaxtdJa4^cIvHZW%g(H6aEL7&An- zS%2BH`G^6CJLoIDW4vHGaF!E5HOL8=dk5ypt^X&4yiRCh8CIEXXnHTaX2>JD8M*&t zabr7&4}B$Q%$x(40ZIN`J;;OT*``SQ7F0GnzbT^T} z!6@81^=bEA70|NwC5;WGx7u=hOhr*3sc z$IDHaWoom3O89v_p!eE{H;5}~fFE%QN(I!d;Of3%QZ@)u#w5*Q1*mtxS($}zne@n#*6=ef2t2o@)C@?xO==9gO75dkPIlQ) z*Wk<$waDv++oI>$`LC=y->7!rvGMPEw5!Ner4&YJb#}@MRVMU~n`Q!>!hHlcZc$bk z9hk7nw>f3w_U%qD@j^6v+}ankXU}F*rjJVGgKJ)vr?x2g%0V^jzjD6+EQ9huy6=d+ z_I8kd>fttB^0FkuT)Dxv`@{>fpX;{a{182H`tmeUrCv?Tlx}74@kU*ZKbLMKyf4W4 zvrNe4CWkKOxM?bX;n(zC9sf7{i0wbb)k-dg&K~wAbV3rsqIR~<%KxtEh5k1u@fjHY zrw%tp*+yDP4TJX;&DQ7^@P0tVpjaCuryx1*-NTpy%+|N~x2A`{RRnVpBN^F*A z_LKYellL}jM=Bs4gI_`UfmR~*CERs&_@|>(bG2rG}ssx~4xa9WxzNb-^D9 zCLG*kk7p0eMjt|2!9kg~IjW-IqU>==ZV8`R#B7dk5&SIaNuO%J5rt3zOng>m50V~^YN4eJGmmojM`#3pd>a?+vpNE#GqELsAas0my-)ujr4f_q;|z?Zdsl)?xFmG znP3)Uc(M2uy1mWUSbg`FzTkH|j$Lq?*0jm{%-eVTC`TCYXeA)wk7@s@J^M8SKaM$? zJgpy!B_$6^#IGq~A0*K;Le3yWj{I3k$}{e zvBy~Q=iCF;^S9a~YXkQMj{Cz;BL<`$)vM1R2XBfT#;Dwu$d4SRT1g+n4;{v+Voq=; z1ZPrCAJW%|qlv6~p#@j1Vn7)H&;HZ}#Q}uxV7@JAQXMLEsnQn7A0V_&c?9X5AcT$f zVd>^*eke$MjR<#4t-RtpL|6#L1o7nXhplR!4QB$nGFs<2>{!;ZdAh7oWBtSg2sY1Z z)EW6|jTC~MoBrnhz6hE3xBoRFQ2)HaEn6%j={(6So7dxo3`@w$>Hk6VKebe^Q zkM8mK=f4)V|078{1M`21jjiT+l~gcz zOYvJhZ#C9$R;Z_Hx}zBkYVfsQ!Xo%EqOOEYA_fYE(l?u%a&+t#b#j;x4)B9q88V|& zXoX=KrUS@^0)~gM=)-A$7~;$J;Mu}I_hDeu-DS^txl4}Epv zOMwvvCQeaQJapmUt}kvdA=Woi{IlBgNaGNlKs3Z@NYG&GEhSQDx5Jw%Z>w@yp#>WI z%UYQOuj>n~#x$Y(Hn1uR!&)qW8*NahIOot@wS}MmY627N`6E6BvGpO+L-v5T_E9zs zT-(#(1ltWJ-63@W){m6cTfCSnPoK%Q9y~a=^9U^0#$G835*zfcmP*phoTzF=H5O}3 zfQW1PRA5;;v4@6*T{AweeWnPEvUU!YBz_4cQkNU7Ut=Z@)=EwQTC^6p1LKubt=Y{A z*Y%Tfwl8f{)zAN4f89D-a{&|PT|Jcj{DdXq`qt{!AUy}{My7)|&%R+B!j94e7ZaXOz(d(EKq>xZe)W~gGCcf!j9oLcB{Zq55VOH z%?14I2f)a8qk<~w^RUO%24?HWh1dfl$_Mj=4-k%li!xS1TTv{mMU&7$vo)+!A<1f- z8`#rLSVHe3Ot2moWD3F$FCv7t!uXOVi9-kRBTuXbP4Pn?Z}FxbjVNM(W@A(*Pb6=M z|CVYa7gQ$HdN;fk*=ZZBU^D3ht6IYHog@?PLvDLW;WvA$5ctp@YZ6Z>j{S-tW#2 zl1~vxCr?{%z>_cFcqWGq{1L_IrK(EQvRCZ)KoLiy3t zV{7Kn(qMnZVdG~?L^;$>IiW7Xmk%CwnrYsR+)$Z0l3|(cu^RulULidzzuNEZNx9~k zuOi-d=fBpT|06&5|4d){|Ld7P5CF|KK+u0(^8ZOcEl1%F0MNxMi2vV~WdASvX$B@% zdiwv(Hj0K!e6ZK} z#Ks?wK3*lRTzWd)c!ZA*7|^#tfXB7QvjV@3bG6%Sy`D$&4CTllyP$tvoWM&;EAX4X zfe6v1qb^TMW2uq2J_rSGI5Fy|rKfK*-W3*^pS%zf{m>)CBe?@25r}Sykn0NK{0^)V z@U;w-sgY45q972p5ZY4+B$<9C+>ArxK{XsX92j0L`c$IBs3CU6PVcCWbR%I^(etMP ziX*zPH;_oghRaa${WmIHL9~fnNc82oU=pU^NN;-5(s(_s4=`SDrKFCw(cz17hrn!a z+nwHkZRB_*1WryQcqF5YoqI(uoIA2-idC%Y6LK>bG%Ndy zYZ)`D0{;93?+X6{^?<*k0l&%*C;Q8AR+S$S-ym|o(=*N!Y9C?Kl5zB&0SgBXLYC(!b z;Zqil8y_5$FHe6qK!`n(S`)Bi%QZ5hjO_-|8aM4eoy8cXG!k35*{=2h(f>~@7NJ~0 z98pV1>4M2wuR!T^kyZi?Ca0%E8s1qF?f?z^d`k&0ZT4)#J^tnerB?w>eWE*iU6N8|8pxs^QPYdy@ zQta8QQUQiU1cGT)#>)Y&&YW{|_ua47m_GXD9&uXS`joXa@OsFQHZf%k9S-_UobL9%$hfO=^U>7|7H zEUy5zo5A~y5nd%x-q?q&~k0W*%Lj?nH7)3hM!d*=FXtff*2 z_87*v!F&3nz~2~Y%GfyT9s2*i1yxl|s%d>6dj*vG!h87V8*%LJ6|Bzg3TdlwoQrDP z&XX4ov>wMefhrGld@JF7`(QwDV}Gd)EyK$B4a#QL%Ju8TL_8sObEb@nCl^mE8w=eR z<{cH=qj$y5YutQozXs37g99zA=sfY@0WoB=T)+`{)=?z#0|0oURCDmY#`>{h*AO5q znLRdPOvH5&up9w3UY0Q)_t#o4_XOT;p)q1$In)?_ex*qvZTKIY!2@xe(u0&ywXEL^ zWW=u&z2snu>k%9=Uih}A!0obY^=bODeo-Lx7`~`tqr$E4$*nA-gIu+`j6@yBdxI}2 z+cFXuaY>RydbThz0#kYXHgIo#AtTX*X{om}V=`vijxPf&{*`RNTXAYRupq6p!-(SQ z{=FkdA_O+9L%@HDZ_?&lTC#G{c{>LVal1_>(A-AfY$js1SQu>yu2|$+mc5` z2^kZiaq^dd>%QglMtOinN@R=EK3HkjT+3J-40hU&H<017E=IUH+XwQG##)oHWnN)^ zK}kwKU(vmaMpl%(`nIJ?+!lD!sBOW2P~W49sahRUn=d| z^k>xbd7-znB2f0cQ7{rhf}(6O_h8?9iR=bByUms@*QeLnzM{eCJ8bMYomlHmsR{NYX~DkOh9TK za=VrCF1+22b9IV)rp1%;^|~9xFWf86doxD#?j8E(k-?SY(E%wx;%-q`ll1TIThxKj zDq60wfCeD{Ooemx={}|H3i*6v_YEINKBc7;$~U~x{=E^cDE}BI*%=spw2DCW3GaeK z{j<8)TFK&yj>z*|2F5ML=2W8sj9Ox&}~^u z&0>jy)xKKpxM5u*UC`33p;q*#p_$Dq{Y{Q^8~Nx;(Y`>aO3|3dXOiD%fkCotL3KWBuduO(j0gMo6ZR zP5dq05Lr-v zOaD=B8I|h%b2X#Gqny|XOq&4Pj86k8o)#7!M|xF_r?dcO_gl%<=;1&upq`^@wf|6X zL65&!j;f^zD7J~T-XU@f2UT`QPl~i@d8Ln;{D6;MV$74LO{&gY`HT&j*4*T~QPkkN zP{delTf1Qyow0R{(&ozGs@gcbJkR9u-{$xn-Z!AZJ~c*tH$_wiewqp+GP_v)Y}+&r z?H5Qlp)epW>lEAW?C=Oln*P=41Hin6_1iDa$||ERgZi~>(X`^4U~yqjJFm7wt5{tz zOyvN3UyA9BaJalMb;Xd5e#@p0Z$vp8ox#@kJ1Zv!nVKvlWD$@aBCB~$AYNIsxRAwl z-7qsrGbPNpps2Mf*UITz#SH4nZ!Mjyo3%wA&CRVXCUw1DH$UgH2mbYBQ`4<;hfQfX zLCShYOvq8>efxz%>ech-=JJn|h`MDxo48aJlLbVb)=n#};(w>V>)JP48`lbr+JCsl zrYGs!Oy2{QETIEAO~fbQF^Q+XEDX_3DYWg7A&W9C}w7dQ6rx zUH*9U786@#*tn{m&8|cXb&2$(T|a=m^ZSqZrH@2h}{HnzXByIEsIHG?%TZpJQ#$)_s2SIjnQalt@ZM6uhKfZF^9* zp>K+6QtF5%RQki|&KMDxJ&JNvt_pQ;lP+K6pHx})kK3h2;GcQ^lK;@@2{vBI={ayj@PW;&?I2mvpF@Ww(P zKvnh#2u*`AV^-Q3GhUV3r9X9&wcyo7uTY*VuP~yzEKf8`_NSkX&BSYIxyI>BNBbt4 zyq`Ee>BT-tg*(HxEiNVR!t7fnO}bG?fR;$t&$6~#f*yH$SA%R7GY6sDggYZeR1%=< zRRkOhe@eQ|N{Tsp{PWWS_`w#R2Ymxml^;FK_4O;;ul`)RUU%63(q7I5rP*bN@gmg(W-An03cp z#?scgYWOp2PuExn*t`c?R(|}JGP%6;trzZ7^xHVSmfqzG?K^d-;7I&t06J8IGoZdk zMH$kaR$2buW*#0tE>?(trloPyxf)bl-ygB^n2=xqB{O3)f_WqH6~1(sa4atiCxlK* z--D{(Wa@8)v?mEGNJyi+@MSQ75V3a+-&(b^FwlLqZT!UMm;X3+{-?(Jip2|~9p4); zTgS5~Uk~p5vfplk8}D4w2<+^{5la#7ZrY=Rt%o@x_<>va?hTnHj+51Gc{pOoY{9b` zN$$AuU+nJg^3`yjQzxqS_sn)KR;7qds#gcSufT~bx)Wb-3?F>T;Oe4(Y4AqR2wX~w z3VDGY?}Xp;%!L7F&t(jk%peqc&!hhvEqSZ+6CojdTc2;U+E^K=#*^cE(tZdsyKm5z zVC6nP1fxkH%F3lIx))8RUy#xA`}OrnNfGHmQnI*Y5ng_P=;ld)I~3 zatkaxYipT<8-JPFh$oKjplKeqxbmrs%X2Qgx=%fT9)L# zN5H%4(u-sYudRV{PH;t;A@QC z%rRlDf3%Y<7xjz1*K`ZqZd;2rHSW}cyX{mCxuYZT8lt+3!Wh;7APWtF$bvtXR-2yD zW`ND6?#{i&F;{Ir{^1K<7jj+?ELA$+oD+NxKis0biF#{i)vGZ_v*9B|?Hsc@3UK0vem1pJct+ zzqIwV?n?KZaDG?Hit6wdfH?UX5{MYAh3DX>=uwM%R(2LR8p6ZMTk)E$UZn=-!v18} z7C26>*Wb;Z>MT(torwiTF1P&`Y;fD0>9MboLM1SpNAohb4R~%r)&V{sy!|aKdjqPq z4s+dr>n*W+B|gQyJUu@9dr(zkwm|9`V4GonEv9VL^Q`PTemp%(5hx|nS~;~`@Njjx zRPfBoX4}%~U5{;->+-?+?eZB3x3_r-r7`(7BE&8TzN zF}og*cEC>`ZWj#;M9SdHP-s1XDSb9uANZI=E2*k3BC)!+SUyvs%~%_7XRK-LoJ@m)4mGDVD>t-VdzKL49Pm0_)GDl`Lv2ze<7Bn= z6*GosZA$ZFK2-n)wlt!HtVY`jJDY3jcg~tRt0c8TUN;)N$Baw_;!2mlSj2i8(?9%Z z?mp1g#3;T+4jG@fM%=24BifxkX%o^XjZctJWrO-P6!w=cbBc4!)Kq6(U2}DGI5sh# z@ObLnmo9l4n%sj!)s~?3c8NiQ6-E`z5?ki@^ZCVd>J*X?%lDw8P z>oI)@Hp$kcz9j>Rf+sov&$`Dx6gaLg34J5RVuS-VeMLT9{z3!&Pzo@x+66!3XzhNW zU58^@&4>BmI+m=pwPpw%{9Bf!%zpE5;{;pMRSQ14>@<%5feC+OKahw+|79 z8%wY~xpIJyOzxYo0r)+#4NwT@1KsIB{0+(s1Xu(Y)zj=!N&h3d|EBhSzq19hBl{EZ ztt)XDp3EnVt$Y-fI#XtMzt=CK*R&Y;9K@D)R+Z;|o~osrS$50q!1Rmf3&aNLW$}!$ zKL|^b*z2>|{jeqL9qpa5VAKalJvxDT^YvYjp|?9d>J>cH2k-5g+>#?kG!Jj_Ih?os zY4Y=aDrdiYnwypu4q4FaiL`&JEA6*m-1|5oME?uy0U4xx7x3o%Z^W3DMGjBI!4Xtt z47fhF+s_2;2EGL^_)FAqkhRa7#074JUwBxcRF>_Hjyax0-;2F6e@eb*5qQc_MEV;n zeMA>8{bWNz>_$MLQQ$eHBgI@6dL_siXy6NC%fYz+EiPv%Pmv+QxdrA%@G8IvH|tu2 zoFjnM0Dpr}l@sc+UH5}69+W3y${mz!3_g`|LL2Vf4qXIC5zafhf2zO{B2+a7ZC^bE z%goI5MYl+B>hlC2f!sRp{p%--;DW$)z8-Va3u#UxTRidXlkHj#4Nbety9tjJ{n^IT`aFBNr?yJ6E4H|C2a zM0dV0T_IbAyZWuTLHb$@_t45h+RC1s+-QvO|qLFL46FVo-ZRYfnV;t;#0Qzfsn;_~(!68Iuj zsSLs}e6r8_P-qy=UM@-(;wXQhjvDP>G<2W5klD5^}ryi#7C zXb&`VlY~5&RrD}%RHGAVq_fCG5W6sE!C~d4-(CHqY;L4X@55+=wkGhtjGD5E0V|m% zvT{hl0qRDzt#e4`PbjrvZ(BqROT;09S|L4B0A^I1Mi=A?=$f@AP7rGEuMlt5G+AGx%9muG()&nUqJ(Uzj%G0 z5uUjGsPHB?VjWm}fS8h9C&8vZ^{rFxdjYsL`7?E0+4{G*?cH&&im6QZJc14G2d&eq z-Muu~7TEqd*8oaD_h^{jZw=T}0i!@wXS562HAHEaL9Sy2;x0l~h0rvWszwL3{T1-9 zv`ypRc$#>o|ETL@n5|pd0mjmbjsgwt(p0%4z9>%5FhQu3VW^u{&LzH2(=m@Uv^D_WG`hi6#d)BSE?h>T|O|}{8 ztjQ3vpB=bDxnmtQUGXu9+?OddSow$Zc}F;_0+6Nb6Gba<)Y7Z#mZWsk^MQPR(&Zmr zn>1zdczj<2y&uu|pT=6odFo@mXz|Nx-0@kyTaYzVCyk+*#}wf8@qx*0$OW0j^}P~2 zd1c@$oX7ULadCt9_j<0w*gQJvOtFH`lW>3Pht}lRy+S*qeE9 z`QLJw;wNu-JGX7=@@igFu8m3=0B9~sOMzqbss(Gt&(~xxe&~}xJPJ{hld&ERfixla zG9@z~^(Dt+V+K>5j7sg-3dw~h&BfY|tzO$@Rr@)iPcM$QPA(W8+Xb)?!s#T0R&Kkg zD1VVtO%AaB*SXby&;tLrlYM4ZMwb7i2x8PBwUJj>@*pw@2%wB8O*gp8n>Q>)E>uOV z`c+XtY*5*h5l9eL_{G(cSN!`3I!zEAls3HLW)Fq_niET3q#dn0(S+ zeRoOx`(HPF^~4#sxZG}dUbBCHw|*o1>srV_fC38RYHNu^@2f5gsvGECl;anc+7rBz zy`r1NaERDN`y@*3_k9T@yY!#M!8j-goTJl_D`L>ZI{d zP$^Y{CBKb3i!R(V7Wd#<`v7k?Wv-VmoD@VDw+^@oOOP&fNUNVTMN5=S|V${JgDWT<#waG^>fg-)Tj7++v2h` z$F0tBZ4cqX-pBLdiO%eZeS@pUq00Gdonq@8xztYy{0}#iAU7;Gj{0CN*v-AL0JwEK zyjE3PwylH9&HfXTa&n<53v=!W3nX|$Q;34IG$qxf;a!tLw|u4Hqf>fxcJ>srgfo{` zoG%%+=K4*pFl)5My9xx=SSoq2L4>ukGu39_m-I?&<2H;ho@+!s(>q)jmGcx)5-9I`aL?%q$K!!z2 z!0%0TNeV_cFRb)d_fI|}_wLJ2yI)z=DRaSAVdg9f%v{d2HGJ;@ogr!#LSl5;MRFYg zYt{=a@5jaZ=J%a3!{99r5)6XA{l^9b)*&A8GgcZvK4}g@=1~%jD)Q%-iRs$ zdHe=DD`!PawGpRibG>mz;;sgl)*wHiL^;2^$&t~C1_lbam?sUt6CnVO#6=-prVlX& zkFUxV{=)-fFoigPu;PlIb1k$!PTL&M!9!5kqa@F)-?6g7pMMM;+BB{oJF46vFl0uIxFNg-+)h}DqT!Fn_`Dt1y_?n?VG_+rhZUl{1! zQ(AAFc6;4yb*KadXYz*3YyAfq7={AwCR$E*R{5mJJNWt+bFqxsP)~^tGn$bVb^ne# z@|~JHh_!9pmciRvpBPxb4DnE$xp(wpPnAigShJ-Rbf84~Gpe`&$Kg9f?gv!v47ed-X}4V99Z_zKO*+FrwizJ5A9ACA zc<~I9mI=3vxh8N_5vNiFP@7^s$%!4Ox>5Lwr7QR<5~5~P&ZvLDjDA>N#C;?Ov{#RN zXMQ=NY}%me1*1b^r8#5o5NI}{yvGKRYPF~7cx3GRax2L+=RCuho1`d?E=f!8wDjRS;O!g30+2}(~HY_nQ#cTiKT>@sy)V{YE@bq@*7 zCaG>7DS^(;USF=10H>m!gllle#n(4P>sEW-+!^`rwf#~L05>}VPCLvE20dfevKY2Aa&G2XL+Yl) zX6|vX19ey?_|U$9Dx1Tsduz%dT-hZ2-bvTOAXGvh85)e$}}M>RGlV#EvR)Ft*4<4HY{fhw**KrA>x4`v^Q=o1E8+v=;8t zHDzCc{^aE3G!}^tWf#cIv#R)%yjpN8`>%aC^$c`vOaCOWet*P`cTktVOa{V1b-3jU z4_@ZS?LOHg+h(r?XnEWroL>>poKleKa=!!mjfmi0yFc9SCiH)uJWx#lLl9cn3l4m zqca0dRTaIu716is15k(ghuxNp#0|FCC|5Q$_02F! zj+>ct$jWP)V)a^)g>cM6xDR~Ziz?rV{_!9N5)k@nx*W=k0o<36fMAXKq1ukN1SZEt zmm0@HmUt7(;8&OXdF$_Me`JZIfglf!MywoUwoLFqIRvO)1vSNg8DDn}wu?V^RHeN& zs>Em$P<^iVLC!!;bkAyeV9h|3vDYM^wjKgbQkRUjWMC-g(Z^$(`GEIz4!px(#iRgk zHS=!Zpyy5%yw8@9gSQ88r1g^k+}_jI$qX%kd9?x|d>Wv|v&p`n^z zH%?PMuQ|NqtY7C><|+rMZ?a1HJd9D=($ z!Civ8JA*q3?hsrDOM<(*4-kU8yUid$2A9kCop=A|oOjRtzxQs{tKQYsy{2o=uHCy= zuivU(zXgaCz0Danh83Lg+b^2cty*^QAP6>CuN7m7LRUsn%P%7OBneAOSgAF{Ia|DT z7v;b~%8w^4{D1+E5!HtUV!xRqFuLU@So}~p9*+tnb10QNm)2pF&w8_883F$^mWX7q z-j0Zbe`hfozy(?wqMK1w6Eh=cQSqiW)WA`2&KNMpmLzWo%#%`8R+9~$umP$X8EQ`| zduijMu^HHAADT{N@c)Ww6{TaaJhrsQ5Mn|Ke-1CwTzKhK4|pr&MY?YofgAM}=<{su z0Hq{00se{2{P`1IT6+GA?4mJNkdCAbX{;Qp372=4%W2+qRU_MzAqU|E_PxG<5sk*V zJ5PEl^}_cHTNpG-GCs#&nMjCc=dTXTpNGJYm$rfz887xXC>5Mon^ZwVZ+!NTb0<_vw^s*mgicK``^vhL^glFNOxpa} z!WCXz?Ql!LFA}`=W06XbTtC}=!UhW7nj6}F8T@(Ki`tniok+xBt!%!0eMPe&+C}$) z|09W-sQcc+FqsIUzzdc~uf^nMRD}@{>_z|zPWOHvbRCkH9^?_89+fh)r*N?GygA)w zISeCoyXNhPzW|O-E`JX^zZ1zon@=J~_yRMsP*PP_(ehaxxPpTpa$|07@byGlc%_-R zQZUF~pK;A-T5~*){e?}h*ZGm~o#(^pu(1rUSBr6MaVme*QkJ}-9N9a@+I&3Lo3!5; zgQ!0ZztM6EYEzA{C^Xs@5eYmjiM+QtUd=U=3(MQ4XqMalZZ%ElZ26J@AkghjL{aiQ3>xL= z?xtZl$zzv87^@UgG{3jlbfwU2ZxwQ?B->cCqe&c$Fw8q|73qnC4&{*b39s z7*i&<-Y>S*}XS){dpTlI7E%C30Y2U7JLc0Y_k8 zr+vrh%b3B)o-6-$6j3}aRb4$*hDRa7+?r2@aM>C^5{L|s;A9sA?LaOye}v-f+%75t zgau?;>6KgU0qOt#O5oM*PPnHAV}9|e1Su-1pZ z=s8w~TaZf#y-&LzFIxpyaJZLUyHCLR-WCNYEIf2??+tD8b?9cK<|db?W(3lUYa*@E zFl0wX&rO8h%6Z%urGV6nRU&^!pzpaP2|QHj`|c85%d!Tiy`;^z1RL1IcJuRjx73rX z`B9-j9o`8WwFz#{(VoQSzDNr$(780hi!&aRg|B@!AmjC7V%RFhi}y&<`QmH}vx?=Z z{E_ab9+m_z5~aTifzcp}UR!OLu=<1RHprFp~#e@gDXN3N6|C(;18>cq6zjn93NZp8Mp3!ZOdaV z={+zU7uQ{T!s{2Ui5c1!9BEB!8rV5+6pLyad|uS?z8#~AIC-TO<9v~M?6&;E;QSxm zP5+YjR@&CV-O`m++QHP_Qp(cY*}{_bA3We6I5_{+tz>Uvk~qnxy!u>oy)huOaR26G zBZBCEy!rnbN%9sVze->|0XK>t-VZ^;J7S(Ii+@?^&#ib5brAP&@0sXA8R=$dfJ%tR!S{&ex$Pu4GY)je)37w-vFuk}}LPB@OgJ1>f#hLRv{SD9?W_4WXQQCE5S@-rIC zr@L(t5r-SIOv;VkzIU*Yg}=br`_}EIqHa&`_+>?H6yD&{1eSBL2PU5@l-O(wb|e3z zx}>7IGo7>M8P&*{uvdY5!TqQV*%r`%KglnBcy8G5?AwC+Sx3l6ie8^h+*9OP7`~WK zjXIjHWX%d(M1!H6^ET&m3ktw}pcTt}Q}GxLH;?S|p%_lfa^B=K)3TQsl~_y})*wTa zsg_bhWYVGLZLDp^F@%hiTT7JVG*?MtLsD&iO*kt? z3Xa~AK#QSt#>r%{&e)!m9Y|B{M`wwJ)n&)5w{>n_2uLg=S1aq@b0A}65#c&Js`X(; zAQYAS^?9U^xw%QNtU5=~TC)E8xO!l|1WcmYp21RdMQYc>!~1^ZWsx|78nPUsaQn15 z+cAB>; zMb3+Sz({KDMOM4wQy+?=sY*<^M8z3ON&xzCNl8-yEDu6WYtjU9|L z{TX!sxj_?lO5Giw8o{}~9{2U9YGccb%h}q)XE&Kc)B<9-|=TmPSuw#jb!txfIk;4Tv8Ws-Jd<#$iU;|ASso8G?Np`Zy0)yqZ*pjTItpMeFyX#DoobQ-`f=0 z3_|s#OFX)-zom~)N6VT(DDRxp<|Ng%2bV5Y_P$#|Rj%VBx@QyX%FRNG2J{=vtHIP=H`WlSz*K#2k3U za+dsyXPIcPJb|CvT!3A)mpX4FDra*L?!^jm9D)+#_WDEV#`=|mAF9IX{8W9xmP0Y) z)ccKNXQyu`@fTlPsDiocv+sqv3kt6py+{cazgfq$2Js&|e%rO^;_MgEB6wlkl|egd9CXA(Kn(qqfU_8OHhukgS5beA(?&%D_1G=!-%wmqpQ>j z{aUmRN2Fymama^$3CPIO^bkWKCGEWD4WUW~@3l%+yk*Ky&UsGaG4y&y?2EQ&n)VGD zdtdX_3+Uyif_v$@DZ3bHTP;rGdY#cQ`>s0Q&Uvw8Vhw{CW&6=(8-Jl3cY>LnK9!Sz zLIxHLckWg&V?}j|V_wQxTw7nqV!$F<9JeFV^Vnogz2*k8CDF3J#sLPor=cS|THJ;+ zIv1`2PIA#T`Gv|rii9G7$az@^2@epU+EcT$b_fcK)s`?WMH znmK@j$i#wOMYYj>l?xyzj&B{)Fm4cSh;B)KbT6^!W~1lQS>ql$s$w{~zVT#LS$iLR zr28CjtVBkBLg@~kUb6SazGJ0)alCaq@v8A0(d?rj`yl`wYw|J}C7mR0`BEqty+Z)sf$uL2)UH!ZUDuw> zz3;4?r=_mJH>QhcrR#&V4Hi>~ZI zf-|MdFjK9eJoaJ;qkJ~t49Q!k7>Vm!gR+|mm7sf81jkbO%-e=os@eTY%kr-*p*vuVgpzvIcR3h7X5j>+(gyMb_h?F1bVp7cM# z)EX5dk>GJV5U#RDcTd{BZ6EMraJ<|JOfOX^MncWnhwGlCNjX32wH6ze;2oAw9het6I&M)9+wUvfZh(qVv-0z$LYxq|4!xaEX_auzns`+g*yKmI>ACDI@%}PC2jD+&auKX{xfF%Z~Uwkt!Er{x}_!l`2>v?FTFE6y-Fh5O0RS$ z%JL&tP0sA8{kJO-(5HAPfr;=3HVRzo+x-&jPWxgH-F$BuX7K+ z^OLN!r(KS-URGWmp$du|8<=j()RAbrYHieXflq@j4Rfu!h!|A|Y5B<=O19arb*w*T z&fM=5ALg7sR4_2>h<;iqQEj0J&ldL5pnpb)S1F76PsT9Yzu4D*ab&QnnAvH#JF+T& zU}yi!B6f9i|G>`1&HvvR$6Q=&|7IL_>f5^!57j;ajcdt&xUw$-y*AWK#t?1tP4n0N4ZrXV8q*gzRxyb5M;rM1cI$gUn;*QOJimLufqY(D%8$Kx zlA=68`7Q+-cNXeaRRI-_M8Q1s^p-OTmlm-A{BsHoYhF7^utC1ENKd5U zNY|)$sJRqG5NrsCbchR51xFUHG6~DTNm3>;a^MJFi2Xvx@cm#~;*KMcK(R_@o?8{o z@~eeR7~ZbusdfFVqzFqRo$Ayq>4D-6yQB{L8#OJsmzFN%@Cbu6U`+01#s_@&U<6pn zpE_q=JyD;2?|%6vaU_pH>Y7>{jqW4GHgxhld)Kx7K-P)Vwp?I`qLS-n_OWEouq4{$ zpc7xzCxJ}RAXK!lda~dW$u~8$-Icq+>kyDjaud^~^>)HLzvlci%m#>h`0|q{+ zU=}Xjg7!C=5Ud#=Zz%l@!YW?CF~P?$g2L5=m{L1LVgyq-^NYj>WXwrMGRe{yWhQm8 z%)?MkxQb}97dF}igO5_D>Um)}a)*bI9Jn0pbS&Co5zY552?ss=bF7jH1!`WzjfF}MSjWMwPQKda#y3gX{5t4CsVCG zV^j;1>qKFLU8Z-9d^<;r_-;~f8|mT(ZsYsTN7d*;Yzc84C59-a$q}ZyzEl&la1-5O z)|8(9aqZ@)FoVzv6WF;o?sCClA)E5MzF5n{s3Kw?5YUhuFl|2}8f%%h8tlC1`Y~B= z60(YuBV{(gh0#pnHZm@`KxcC@th z_ndH1D4CdCUmfMWsrBE)^YTwafLEC(rV};F8P%XRW>c#vX8-IStB>-~+_WzEFw++4 zGS7lJ8Xh^Q^<|{KynJxYaWsg)h7yBf<~b2#Mxb2U^v{**n{}Eu(CoJ<07OqeNj71r zh(ZCE?h6tG(wJph#}gwc6Yqrlx(%}}qyf4dj+t-}SnL-$uQjT){dH(0&PV8`L)5}2 zvT>2?*Nw0tyh_B}44$LHTb9li9G93knV#4m97-CnDNivluN#o>QjK&|haFv{zSL=a zX<_J@u9-Q$XJ6)P=FKQlTKM2x}yW+Us!JtZDvk=VCURVjAtZnX#MqAyx zo9ZiKL)@r!-m&d7co~f^T}iOIE)l`Zn1-M;ReH-(srX(qHNOm2i>BnGxE4~GyylD) zx01Vg+2EQ_7_Vkbw$Bf>Dr9_*i;`rzT%n^~xu+z}TCS|!>F2)h%%(OBit46G$jMp+ zmF@iHY`S41c1sm$V|KcgI=c35^UFDnJO_o|ma}!0<0n5984n~aSB1Zy3(8_^=9ZWh z`^~VN$+t6?Gjk3k?JD#Vlg1FqDVVX?eJ_+Y$7tND8_uRs-dl&ocb(tac%PX(^3DZ89%e$Y7Cwiw@0x@T|JSuUes~L>=9*UeRMHg z^^E#@>5ibsd^nWLEupNfHdu=eqcWX2p3B1ne676GIim_m`H`zvpdsi9{-R6=!Ex1) z9r8n2s(V%)7ET6FivHjwt}3&dYEx@)!l@+w1d;wnQ?x94qw<$@34V8Jv@z`zmS#qN zpN$y)*dtABm^_lt*+{=tiMQ_;(#HL?8a-HiW`R#J%2S0Jg=JV;sU>AnjrN-DcHNyaeiQ_(+%{5ATCUQaZ7KA{j= z^x7=)Yp?TjZl*b&U$2_F77GIR6;KCGa;)igx-=Or3}zy&5)>}g+N{y*@kXES@x=BB zCO2*4c@zXvmQNE z9ot?fCfnMT%!WtlX|v|chCU8+SMz0B?@>FyugwNLu*Ll+W1UMDT6e8`am-VmPC>yd zILr>wO~0ioR`BOfP$1V~Ap)QN`Bxqoy=@UDYmzlT-_E;_XN~Lr^Fg_D>wmia?}T#a zN!v%ifF70;S>JRyIqapa#)c~hGym#m>T+`0TUm|$uE_kW|LHt>+t#F(mUG?$l=a)2 zEA#x+qG|7{(gLsV-EB!Z;dS{5mHkHxrLc<9L~h)=pAz$$!&%6>8Whkhlqm`bAH*91 z3z33QLo6UT5CRUu|FzU{T3EkE+vHLRN_vJLqb?EtEm%+Nr0|ox4nIa)BCg}La320k zfFOw;PJ+r$;L5gZGTfUO@(%$T|7&)hU7O*l#3BkA$@p-RzXTk+7Q-WnGdg4ge@>-Z z&iiqowv5=ztQxLU-{onwI7;i}QkBXa)GcRtv%8kA#(p~U>^clDCB{(TOR|I;ptcgY zvhSJ=5B@E%l6)=iEdHxB)X<>l*Zu!p{g^UFXFtB)=XZSaBuHb_HQ*{`+8vPq{=cn~ zDCi`W!*fuV`qG#jM*feh#YE=7k?nM*f2nc@t06<4F$C9s*uSCK4}+@L54iwGkJ{gg z3fAy1`Nl+@js&k)<8>&?@@%eo0@yZEsx!eEPk5CakUW12ddoBytnP)_xf&rdYH$}o;{x>vPt^(88yf}_)xg{l#~Hlz3D#4qRGVtNgUgW(rvqn^4MQV?uU;It z7gx=9d(1$;r@NVx2APAC-Q6RNI`l;@pMZO$ucs2DX4rnOF8W+F;Bq!;!F^c1909!fYN?JLTWGitA_(!nR6!(Tx$`OR+bC)R!eqjV+n&PUtfuC-N`BUES zawYUcM|O3^L{X*{>7o{nphD6aOsv-7GClX*L{pEhI8l%m%yYsdX0}(EQiYV*CsgY% zabORxLSWEm62B18D|dPw!tz2(8g74Em9&Yk3ytRt!Pb^7A^a9Z%drwsGL)?sdk^0R z%Zu_xocDcmtAPm&K!g7-X*UuTkM!c67h1^H)lYu0KF}{l7AR{bw5T6wmBgEt6jex~ zDW0v`Lp850r@Ya#xXrsHGAdWGJIFg0fw{-}h7%cYKk3rIER)(gc{g7L&(!T?bV3iQ zB1(rvid`TF%jD|AL8XC%`DR>4Wem&Qog_3UBTCILgT;CgKFwTRqnAv$2)YcK@AG+Y zzn`>NcXq|;c3k}4a$h(H(eJKj`j>M#C;2E&VNb7%&ACl~Lv(21;pJ=hkuo9!%?kIj z#|J3}H*^mblk>_8>O&8s6+E@=BhN{VI!r@5>dJ?mBVT`06R=Ru4Cyc?MjJIbiedc2J&qHL)Xc$T7l=(;aep`~9- zPs!bTbU|c@&hzVxoB`RE7-HEXfZFVeCe5D^F_fq+i%J*qG=P+W_V~@19UD}*``!V4 zz!v7|i%En=JDANyXC3z!1*;rZ0RS193%!?&Med76T)-C6Pg^0m+B;I7&*Tdx={(ol zR6Wr_CSG}aY}QU9Os#ro^@yzn+384yp>>d1 zJAbv48LX>=xj3EpNO;L@MrxW&+lWR5ny^Uq^LeCgBTbp)IaLYN(9eDk+_OZgy+`Ek zHWfD3K%OJPr%p*CS>4U*d&eiBUsVb;Z+zv1zH4sR3p2_Y_G;av-2kqSL*}$aJALj> zp}fuztm~7bxk}M{Pk@gRxp3wNaLvHL{Af0wbRO1;pG$RI#xcJ6E_W~Duw zH368*8kj8#>}ciB+b}Q)@W0w7QRs_lXHB5!fkO8llPli)rA#K@xKg`abdi43{OuLf z-NEPM;VWD_1kc#-p+-C5GyyA*{3I2=H~P)X_5x4+Y1-5;B-roi>2Z5U6k28d@_hTe z{dk(U*<5Y2@yqU9c6#PpXiRb?Zb)J>KK(4d^+c73(Rh2{#pA^l)hlf{l zZBS!NuISNT0wf5caCXkS8S+V%94H}~DS?M97{@4`Gm6#WxCwqY!OC&~t+DB@MbU99 zjJ|8Tm}-2axWGSEoO*Q0a&ezR~fN z%inEA!a@HqDeQLKU(hjDut+{$a1e9{jX3M#W!QYc*doIktj>tsT)sImxF-MbP30Zd z9iKAgD%Y^2r5Gi?F9ms8D0;Tb9n1?GUKm-7C_hsC1W(Lq{YkX6Pqy^l8=^Jd5fPz6 zE(z-8WZ8H8T@R3Y?MX#Rw zCnDD;0^406jWr(zwo1T;o8|^1pU;fkk07yA-G_QmmLHle*S8n`L~Vvn4uVq&s!y3Wv&;W z$zkO&3|@|{rkwPv)aad5=}D7(Je2_SK|*nVhRBUZ0|VXsT_5{>Kav=$9aOg#qF2=x z`#(uEwH6wcTkxYX5-QLnzrgI4KC}LaQ2jVd1Fdpxn(1J?cc?BMrLYI*avrCKP3zF0 zL=+e7?3@8R{h!B1wX5;8QNZ11m@C_+elL_vu0NO~qBj^3_6$Dz1I8JQu`muPZz>iG zTdQkn^7|H^(jTWOWDr3kNisf^L1q(z8WSuJXxJ(MNK`RNo$ES#Z?9#{5F$3lgkW`$ z&)rUWGo&E^z`K1?-QtfPuo9B`a&fWLZaRJbDQ!YlV0>sru&eJ1CiFU<*q{!m?7e1@M9Wy%WmR78CQu;#t>{jfS zW;|wG{M`Iz{QP{J+*VxX7FPW1TpV0{+-8;{|IZ@~S=F7L-I4#IOI2r;bFy;&@K?xy zI;)1QujL00K7KYV`}GX0lW}BMW^drl-t(BF#kj!8xq*MQ zWPFEf8u+|Ov|_^6H0ZfVCTJpq+N+A%?{XZ9Nf4FGj$BlW;yLKFNa|;zvU6*S@8|Ce zuxRjNUnG7oF+Pr{T_i`?6e9@@0U&}*g=jZbNy7WtF=aMo75mgOVvE?}GyteSw{#ST z0DNS0n^HNUgc-IZqRP#Fm7HaSP@J4-T|Ts8bDr^@%#4tFHhk+HlAM@J)dL-}{i5-- zuogs*CZ^sWEvV@`$OchxI+5iyh}t_u1~Cv9VJEiuyu3QU&TpOb{H;j5J9w+nD=va~ zJLs!X?Jm5hy`3!>3NE5#Js~>LmfnaMJD5yEMLJ)HYOoS^kc6U&YmilT2!&z}{&WBy zPa{05S!)*B?pd~JI%2i|d^GB}>xk#Afp^|!?uhgH!?ND5*OB0H`-Xg*%0Cu*3!Asi z=^xMfho-A<;TC?w>|Iy?4d}f1(ldy7$r#E^{)Z~CZ(?!xGN#(u{fu!-!}t)XdlEaa zfbLO3>|WDWNAF3-W@xt#G17g_c| z(g2Zl%oxv+3da}UFMx2FCI1h1COgNtw#nkulChkp5Fk2j6z_P7@uCHyTrj}u^AdHu zMFwDe-6GjLX$#b9QL2O`E3J+(Xv#-|4S==Fq$UX);Um(Bbvq$#AJ?4Ew8$BhapVZM zNCBi-E>g!)&+(OmRxFt0h&%-1`_K7c=!gzd$rtzNYW>>)>(2<;7KyQ(JFrTa#ozYMD4esC|&WLLrquIV4u_Ql<$CQ#lkT$U8)fA*W1mQ|Rn? z5&8XBOH9}4lz9^8EcAAurTMz4QpHwSQ-+X#=5d4D*0 z2yZfTpU*tv&(};lp)Zzs1uO(!P}OYWBn8k@ez{T(b^2?Nb+VEH^+Jj8AIWVSnjkx&kRY>Uwj^s% z^3@p+5}l9S8WI&7mY_L~v^oB9^jb~(xuT8p!cVm!#+?x(C+s+Zbpn;ZFeNUqx4jUY zaYBML(OImuLWL67w9WU^kbqip5Rr;pm!UdU1O`Y$%_13wS_$O#T&D!j(F7n+86(L? zr39#9fG7we&Ow(oMTQ(-Y1TlO0==}7avh+{TqqBrG?s}_kg;X*7PWxBv6AjrTa@MDg>XxB;5Ztx{KBN=CdU>W89$;bRjwk>KS%z?1uuy6yz0(6v&_18*=H7j3AzIiJ zc-8H%i=rp4g|K<^^J@4??V|U>dc#Iz$l3H<1Gd+e(`twxfIMw8Q0NOn+$$?qdz1S7 z{FwL6ShF0VoC;Xdn;^l2pKNgFZ&hFZ2NpP>0rIPuta{;sBov4wSpQ)H_M>=XvTj*+ z1Z&6LtV*>v*;goO`*Ir%5$lA2lbyF5cPgJ7pN>gIh!q0x=QifI11dPz^@WcwFmwVx zKqdV{p(R~cNFx2kwzfm!f|?f5 zSIiNPBPj@?O$p+2V{fu09t<)47ZAa+$FXVzafUUFp8cnb@BGYIkK@=E5gyD$cb=Lt zu8Ga>K-A!8&;ulI#sAHn4freQ;Q&4x5}zn9Ob}s00xF6JtIh(5@ z%0hQ;*K$6#;h{8!FZ-K!?1ZVq3WYjKd~U9d?+AZ8nnlD89Ec zW?1ok79?>D8PVo!XhUXy?O7!!ng1W&@IOr-+7CtZWRAvpch5lj^4E zHVlwi5Q&sMCiFc?xWIFHsmwP0Jb#QYRpsj>_^^yipR5Uh;aU*W^REXNis09v#^PNT zq${ggQZml(8iV{!AE3-`a2Qi%&Kpv7-%ivjHv%~G$}Dq}btc|o<-X|aaHKxM4n?t1Rvz69zC%`1@BgM;`9%)m{ z?g1ySGafOo(m>X)zw0-Wx1&H3+s1NTE5mpPYTbqI(#$4|2Xy!r*?mnOV*$Rg8%)zzgY79EM>v}&L~-<$y#&yw0S| zKvd7-o5_~KZ&IC|_m|#DCk=rnxur}mvHpyAGGJY%>IqL1xj0}PTwop}35Z!Ig>gaQs_6Qw$?0Eyc$p^W&=>6Yz#g7N!u;RpcHm&qLZl*c|8I6YY z8+eN6uNSu8RTMY=1#A3AwPJg_c8SVSd%p4^*4sKt3S+wgSbW$#UJ0d%gkHb8^Gw}Wf!-^#WS<^f?g?Ha<(JsuehFkk2Koc^SQ+FGz?7BuqWV@ zJL0E-V9F6MZrFN1$H9(bZNjPdpnldLQZhBpuJ=$7c%JMH@8JX?vH7mTwurhiCGbT6 zb!bcT;_K|I#>U@%odRhztFe>e(R0{VAS+8Ds7-(uZ-!`yovGioqGzW8q>=5NOb zWz@rVp+~0*iix}ZW-!Wot{WoY`_4w``+OSRCffz(tSb^YzUWEII7O-sd7;R+Ky9}9 zkBCSgT?4o|@M|>yXGp4h*~X645elYai<-w#q>+;r?slLfm+ZubGS#O;6Mk~X?J{@u zOJCH^lGjF&t$z)%RT=_NBk`fiBqkIqziP`d-uNFLZ$~~Fgg^i&mDr`twU6qv*fKmi^zi00%*m_?pAWbVYYsCrF;Gc z(P0ha`6A(T=S)TgS`+(3a`UzOog@f`+5CJlQWN+zI`UNk{vpoiq+p@EF@aoa#!`=_ z-v#s4)f>KVt)|KZQ>tu)iOG5-cbD6XO3ss{QHXGDa(>o|zu}RAQr|g@=q2GOetPOc zaiL(LRFTQ$Odi2^^Ad?^!|F5`)$6YM^=5WWUi-&5%^IA$mtZhhC9R-p4}MnXl(SX( zGfYW)0_d&{*{mSqNH0;QQQfJJ+dF&z{v!7`L1boo!Q4-bOsMRqzTDcAG1*A}~`e`Y_gcsEnE5 zyF6Fjgfxc@MzRquTNke~vd8c0<6RUh2LibC=Dn?u?>w&oA3!^*vu9Q2bsfkK9pdHjK8i?Yoh`d45csih>#8gg|YCb^rEsnbfZVl zxmx%2x#|I!)mut>Ds^6PE$F<3(gEO^D?hX?jb*E~z4AX?BR(C`0@hp@MY<_0B~vEO zdQhg!C?cpWP8s`ef7h`e27B7*#acJC!h>G@9wqj=R3&32_PcOhKcQGqziWCtgqp@t z+fGHpNPAV`FIAt{va1TmSM2my>vLn&7WzEExFuB8J1$Z4#Ip-atO#Ibwf^OX@oet| znj+gdR*x7dsuPjLyhk3WW==S#3wotj$<21)?D3CNW3N)w@;=D8KCT-AD3V^$;M-Yu7TLG_@1{Kra(&&M%R+u5=M?lIy9>629&WFS~W%?HVl2thX zs`@fCD>CC#f98pV2OC z@NrRncXn2~h@EGrW>ur&ja!5=<#&@BNR5FGS&frx=zR3MAb9JaUXL)Gk)G5D+xtak zIcLhO!(aorD_=hpVL|mFb~M|i{HEz7PK+qLV-3^ z1@Oz*qh4FF3f+EzLWmZG6ondr0?_o&hJxUB^a3j;50OKHYjek}xwBs!;L@v6u>WB~ zn+C+$F+{Ov(D_kVdaU|!zVqs#a6>QTwbGN&a$B z#gVcT2%7xupb`u>q5IoGg&5oSib~elh}uoGk0XR@=&t(+j^hGqSkZfRjuYOwd_eE( z%?Je$Bp~tOL~OYz4q)}K>a;1!UtDuhNs+r zlo7|thT-Odx4-R>6XFIS8z1_Sk?@zA?Hg=?MR6hg8$j}!{X63D+WNmCj-mgFIHn>H#d_6`Ml|82IZI+CZV2FOLIV+@-v;>Z;CMhn=XrJTjf>n4ylUXU2zU zD4m3uvA)R?&hp^O2*g>z4Buk)Gb}I~Tqhvk3l}wi3SDm-{;;1_?20XYEIEO}H(v(Ea6)v--A>8pH(?Bq!-k zuO>9FZO>U^)An;taBc;M(3d@LM8?{;DuwHQ)7iSk=ak?vrcUi2%|EWB=de5CxJ#Nd zuhx^-4a;QK97VU>{Nq?_U_`h5#%VfRC$Zv?DxSiGhpvKH`Pkn>tMfzHUfsri4lxCb zm_=-;uj%YS1?xXff;(#wuKS)}Vd>WU*>1V{?wJ{V0^cBNGHBNbz2d+(KKNvII65;T z@LJ+I?Phw=33>Bl+w7Th7xdvlqWk51{4D4>Z{sC!|0dz=MD5pLDeb1p`SYX751zaj zUD}$7?)!_LE+n3bep_0X!!QsN0)1%%O+P@9#)+u4AWgQv@7QikNki;3F?liA znz{GrN-`RZH#&<};DfSe826HH9Dxy5Dl;F(pVODleLNlwrdtOgqEZuv@dD93Fc!oD zG!Kb&U}z+@UUQ^ZKWC1MFFps>?{@E)um-_k2Xl>hG>_EbDTs zVa%P&l;B9itQchn8$D#LMyq?4?^$a}KUY?_puBQmCg%KJj zfwcdieD==fC}iqAQ*xN{Sq7J%cqM(5g8C=ky1>ZoYzD|rk_6cy5C+YH*+>4k2+f2DA7f@(x_W$HnM)p>ObQS6kP96*c4 zVjJsGN!L>>fJ^Y_|8@Q_l)_B`Zm$i{zaBuoTCF5d3O5C4A%W8XTG)h50W?U(nSYi2 zUgFGr4?^ku3Rrxv7b%MCRakKm9eo2(O9KQH00IaI06+Noe~dmdUru;%oQpS5O9KQH00IaI06L^H{K8I|PP4>-+ zlOwleTMI2)QES->5FjX4O?H=DtfK2esn?TVH}+#*PJq1uVZX#$0rHfWjrFF+{v+#` zoN=4Csv^}bHz_LVV8v?Qs%Fj0xPIdsfAe>5W@)fcMVaK;m-mLdgL{F>qC8Hr^DpoH z{>9h*qkDh%w}12ci#U(!naZjFzMqv}y#DguMODqec<`W%F4Qb6ck{W*;InC7%)$y@ z7UvIM=S4g(@<^2>TyB;=*c%KE9?ZfdyC;{KUFS0Sbecr!kqkgzq`J@-DL(chg-XK; zp1ZtA=B2(`{^h;8$i9$E^=C;`W{bDgo_4i&62iLeZPMZEj zc%3JUi}3Z5>76IhM_d7ZRn>)gyw~%OxQ4&}6cZKRi58ZO_7@ z`hN1tdG$@0rmDC!GAW$EBj(fKB+n|4G$lQv`S$O#Ifn~Q)H$jTc!;E^F2B526}6H_O|r5oUZ^+A z2Jrn!@Q-=$S3lQz_1DAxi2n%w@gn%gKLr0+;}FahRt%t2^RUocXz9097VEh&Pxru| z;Rj}+CwczUEG&LHt6){&N=f|Xz0m+4G7D#Lv1tLnNy<5?^arcgMiypxgO&N(UcPfp zx`wys4Dae~A2jJaFZ*%bFI-)B-O=vdV6<1i1bnw3u7hH!X8o`n_&O=d3eG`zUWD_D z8;syo1)fF^VikB=65mL}!0HHiqYPZR8{B_rUj=81zIPdbu(TI}>CWP?h<5^2RzaP? zHIuSZLHy@m{zbh>&cO_#p((>D%gmYXE6@Q(alS$sbzZl-| z=NtrVnq-Rp1SyM~A$kK&-EeR`K7@&jK%kEYd!x|-&o+E(I)zR9n7=#u@*b>UO8+hB zzZLzLzlvIoHcAAa(PWk|91pGGqg61xXoIk-x2m{z(zrj2C z+rNRo(8J+BvIX1|rv+a`-!1G|cON9P@LZJ-WYD{FRID`KQP+6&1^99y-r_Wmeky}3 z2L+U!tA|CAzrKL&Si;=ivu~Gkm`i#KSINK3gVq=)X)^yhNmIN9{v8xwsM$opu!<+~ z-cY6v6sD@83;c5mUw#gEpsPEdJn*lEuS(b;!Q}PRJcefr>ngv87kD!*X812Sn!y`d z*-O2?A?}xzo8^K1{TzEcu6y>L;I5Gac!Ps4yX=Ms z{VVW_(K7ld>Gu8|$dtegEUbvuEA%`*z0ydQ%68P@T?e*pQ$w z%e*dw-{d7;fW241BK`#DBay=~zGtpd$k=>Up?_m+#AhE|u}B3cg@RdIz#pJgQ3*b* zsv?=xY%YN9sUD`uPbwI(a+Qi7PvgI zTBtt+Nfx6EQv^{OCWWGv4C^=W{~%{dF<^?B(x!@@G}{_bum#z z*BSKZ?}0gz9kS(Mm25e*vgN$U>$xK7BI0Wu;^iB@3kn#y%YRu3Gdw=(lrSIt{#Hn& z7x^R!!B)7)z^>k^Q}sMd=NG|4um!;a*shUXhFS2in1L;lZ<#3nCY%%`i*guR_(4hZ z$+q27bq-!<@VhX=IO|qTA(+ZpmITj=8vN5_tA++X9h>suG)zI1Z`I%)$0`f{AuQmZ z6|;676?nKx1s+)y$i{s?$}@HfFpk)tg|G16btuD!>`Zv~3*>(PW!2*6VR)at%2g4Q z>HU+Mfw#L=N9RcyhEZ^;UawMgpIl_aNeoWHB2$-JHF;;Sdy72yCak01D0hxl$(>_2 z0pJQ8RrL#%V)A57V&}w@H>wKk?QR&3`RH`OcNl327Z_DavM7ZYPR0q7FI|!`4&m$R zpMUum(5LE+3LbADdUOW2OHvTZ8RoX?jM7GNQpsRKXUy_Ri8+p5uuyf9rs@xY$_jOk zVJ21J@2e#G38uWPi{P82`nH~MUh3+P@C8^1c;c*?Vv!$*XNEpUNhNci2nNY0athJkKHp5xQ^jMcPV49jJnZu~(u#ypMO*O;G*bOKkYL8n4QZv2! zl{RtXQg|VKQ@9YuKLr|D+N)-i88v@jR zG+LEh9gVGQ#c@u<^*|Y($+b5nHNQ$!woqBEjPzO9v}y~W@Nqx^*#A4L*TRBNpNCd=M1ehV4Az(?pxd`jBN~SAu7o;&@B}sP9Id=g+wjc{mJRvHA z;0<&!Z=Fd*2KbN(Uj9clfgyt6%9gNk_Z-ppO+vVJfVe}g2F(_ z#aaqJy!sWDZ@8dc0Dr;lW-x>Jc4JA>{2aus0ui{0`NOHg$HcWwNmZlF4QWxcd^Ram zUApEItvT5!es-rvZ_X6{f)Gv|1a_jcvQucY$%clfr93L=1K2?%hl+EV!VsLCa5%dtXuneC4wkFhpq(da0#^;D2rs}-&^|(` z0Jnidi1&72cfH`uL9_kf>17zc2l3kl*Byk7k^a^Kg|V{{ied>K67MHxjvS*XG9wJh zL_-K1t9}@0h$dP~nWS)}|Dz)89?D@nl%-(c5;P6Th8De1spx{Ry=72>Z5hEc;0qpb zg&-@IGj{B3Wxv6BpiwJ%1wYGBc%k40qZfw=Hzzmf!xD58+p9pu1BV05SQKwDqZp&4 z6k+PwQ3CeRd(H@Gv5AtZF)OhJh=gW+mR_Dt-7f58SX3iVafLxhU;S%1fsKe?gQ9W&fdp}-yT;yla*FTs$@Fb?OeBWr|ImgI5y z!$mPda$};(JYj1CX0yF(wqc#WOBM>B6zmMGwr~Z})P{-Db_sel_d<_G2CA-e(T=`T^@gh%aZNh=?fJ+CniI)xIoNPHfO!A{(NGhIX6KP<@2V2cp zyNF#A%kh^h7<;N`AhWoj-Y>zk1Y>|UA`F;-fX;pQf_yqH*mhcoU@%51Iq+!a(u(?P zUkZ%4C+4SIZ-kO-4uX<)l|2X6w1Ufk=?juNEJ1w1yW1fK7(Wk6L+SVeA2gK};Ik** zVMk9|&fg*_U>QdH1Ls+B1}I=bcI5C7&*(hCI2Vgg^U|01as*ND(xx%d05H4c)RR3I zqQ4JsV1xwp{d^w6`JW`LxfoXs_a#jMx6pq4`?q9rSMT3ydy;odbAzU6iJ!A?b8TyF zZKOVPx?1qPScS6y61aTfsjOD8m}n90?8z9A3RU2akEi zW&$Xauw*fzW1{{AMLptBVWuh$D;F%R)N~4dM(O+Ha-6sffWCHKCo$h*Cc6Ls{Bym~ z0YyKS(!=rKnbg*xr`vI?oAv`mNwEEjj(wp=5=;}Sh5|X*HP)03eu~&wut}T2<%VUS* z6>{moiD;pItNM}Z!yh1+%Eh(QF*k`K{(a477jDF7RgU%hw|}>>FxRcr7-8tphP7G- zZ!3V+yaEP%bVTa4n(PLTVPBBxRV7u;#t3d1_;I8-0G(i{KNkGnJBK3ElAq4Zx}>Vptr_+gmV+Tyhju^AY-HVVi&K(Cx;jY=zE!pf4@tJD^t z3vZ6?R_cLHsKOb`^PIec*}NGQ?D<&~iVs@rm23=daeREAGIv{<#KU3^Xk48j@{S?uag=WPf)*g?`d>!m(glk| zwS=K7H>64vDJ;MNIeGHno7gz5lsyKI&4rtH8J#qbEQ{ha6;(??eDxdUR1gA#Q z8P#>A!RSUA33K^PNq}Y&NCofz?fqNlIp4p1|0nG*kiA54ByF$pp&?jA(`4^y`~YmM zl*9gLrCt3;JNW1CtOO%i=LH#n+Ofa^lj1?oqOr8@_Gws_;6b9x7-o_zL6lDrQYLDdvSZEZj}F-bCr%}po9Ao=SfI13 zKf;W{&}Bw9f~Fwf1H2kM`Xt0EbW&)oW_gTH1oH#p7w$lEl`?k)Sju(snfxSWui; z*@0lRQw+(0Tr^e_CL86}6a#*4ln;Calys^9uPa-z6=6TSK}jdz4rBGlXCs;v6$!;Q zLzAwUAqWRO40H&+Y4`U!=&RCEJVr!Y35*qcA~rdART>};{to@{p7_3LGD~zImz=Cg zLc``yDRz`ZCeDi(AGi&fyf7J81lL7blgasEQVpv>5Sk@ zyAlb`IShOQGyX`ipy~x>(wZZ*5Y3aP8UW=BTcv#`Q6Rk6IE!6bZ9*9u3QG25iQx=| zkrS12ls={i3Jg=BZP>AJ6rh34&3ECLgcc-91j$8SkmB&HUomu=%Lm&&gmaHkyH1gV zdqw$o)mx;o#5_Zd-Lm`vVTLj%pr&OOK?P9SEO~U7d8C?Vy7xPL*PD<2}71dMQOYXwFohP&S4iahZvuYx#HN)qg=VeF7=EBGqWWQ45K%S zPzV?iK=uv%$T~fu&Ww~`taqJ?^@qOyEM%xoj^P3l;WM-wIWL{ju;0J^JBl!HN{><< zykQoUKjSqfH`SOu8a4>y3QjImSoO~?6g*z={!g63wj$}ePbKVI5e>r1J$#0U((Jc3 z;`eV6!UXTNI9(;pIKfLS)wx&(TI+i}RfVQXm|F*|MnP!Ql#F#5QV+H3|6t`l^UEz7B$? zLwT&Kgc>=OPi}IhB}X4$qv)a+%+oNF zY@}Nl(*`a`h6>LwvzY~qg(u=~ z!5EC29i|%!2|S`a35NGc^K%H^JsUm7^?4Bw_-)8VfmmY;&s9;ej&sV%D$&^9c36&# zT@a>x3d!UxDOH70_+CJ`F|?r*U21~|QA6Q)NR$S#z-TvenYPkdFxwSF9LN*4db9` zQQ5$cc|1SY5naG+6bw!W^MiL}#hwJ|FtoI>syT!9= zs6mgv9%_NjJE+JJlB_y{|8ea(OzpIn>~NTzOHp6WCV`zwmX#yCP=iDX??l)NlzH?5 zEgGc+2gC9LWBdI9!U)eKD`-zRb5hR(@gP^<<0%F;O+2Kr~d$+JG^C;1A z7%w!?Lc@Ukz53tH#d8lvLv%1BvW8}w?599$$iXluG)68d$&;Ped|fE~j-gN<3@}WZH~v8DV*v#5oi>u%V2krlA2A9 z2nrxYTV~uqA?J{x8JW)<0y2h7a7z1QZh=o^D;ePgKU@PF->qN*vpUq(X)Cp%_)TnZ zWs!C2<#8}}>n`hN@R^jhK`LhxAn*h5UXVa#EafClsw&s;@eec+MK6-L#%1DU1C{G& ztJXJ!aG#aA!}q`l6{;Dlxat_I-;^7&Dw%}^YcXKom>tmQs6oJ3^ZU#iwXu?*n8x6) zf4aY>3bLX-OxmQ{k@To2O2=gv^+Lx3v}4MhKRn;LG)+pR08*D7`i=qvj3h|lit6_I z^DN84n_vJB%pk~QsBY*W)|eUOfpL$eELquf@oey&E9>)l;cqC!(J?e)nkQX2VdSWw zOHdI62kb;DI^qt~zmgcCm?VSVRACEAVWZ$+LPprpk8ZpNf`ML5jiCCX>2$D^fn z0(vYfQpJL2X^pg>oAfPOc33SXKkT83oar9yQ3A;>*$|i;;TzdvCa`fHBEL}<|K7@a|E*XRv&P##zVVJ<{roOjWQ}dOk^r)W=9! z7bk$PO~Em45-&L)tzzdGJIIZfqv_%FaBv)}!~KK(z2UJM98JREP(>pZO{aTD(`h)E z#>dwUZQi8r<2xG+x?zRW#-RoV9PU+_e|Y3QEkLCBI;_u0J+u9Yot7|J!SpPGfWdC+)1i9QC(F^c(q`R zQ7MrYQ!)tm;v!yUXQiy?LNC^Y&z8+trKgj19jaSmNRmch*gw^pR>&fwPlvtWbPum{ zI?|S;)BU5e)}`jha6uxQ2Q7!94*-Y#?&g)5vd$5Ia%O_<{ym)MHbv#$EGdNXhhlUwWC?aFdg7rbfP9z}? z0@)BeiY*iifdpId;y_rGddFyPP;TcCC2_=&)}Rl!?#qSOkyN_+Z{}9+PT5>K-kCP? zm{`2JxNmoWPPrqOO}J=PDgPEsDm#L-5S>9ciEuF$+lojg!&#Zb2fsT@N++pq$%jI? zdy4Q5P3RCZMAb?>O}8Rp99;kp(j1Y_T>dVObSvVTI`WCgB*-Z=5de&M=}4a~qa~nx zNa2i0sJX8+pA@HWHe*#TnFxujvoQXdyfyHE$=7n9SD?NwbqNL-IuO04o~WGw>*0J> zY+0LxPibR@v4sqSOIntOM}=}8R94AuPEWfRh_lnlOAfGtHq{PvPxN?9o{v|>ld|gDEpm+u(c1otN^gXy;((PGj`}~`1bwbI+W;l!V9%2 zt$AW*)8NAVodohGnNeCAZA2Y0^Xuw#nMFq(hN?V*2l#%%RWjfc`yCARQ`4Z za2U`rS`1<{+z>S5`&tuX`TJ+}JarrXxGG#$CbYmWQGYX8S0i| zR}x_?Cy&4q*&3%H(4v70ZW|t3gQU*a1h8TkOy;1gqv{l1g&I@5fOF5qn*x5=3<}}Y zK9g6D=UA}@Lr%~uHsp0@X;aNdi8(NLfkz=TY!*BN^Q#OfLD+y>b$*=ys z!l-mo5RP{Tya0pf*2x@WK{jha*uZco{~D?BYpbCqv5}{S#w|6pw?;Lzw=w4}#C=Z+ zp+(rkQ>(=2C08d>g-%>a03&kkdDrE7EQ(}*r6LiJ(efkqG!)x0(>hYz1l0B_H?-n9 zTz$X$X_Il$`<|tTtb)BASAgnLBCf}mFK%2#IR)RXN?b>$u(&juMT4#_qEANx1&%10 zN%aBEqzyl#`q=JRsrum7R-3t*?NvIyTnXL)d#6!42kUG?hko$mNmk!>LbG8ql$5r$RU}c;f*HE$5XUI!J zE_2tlL*Gv8W41`?h9ij6Nuoqd+a@sJ+FN;5CHwfmqt#0#(AYN;dL8@v?=iKflOXy= z8>Q7-!k^}pVA!Sum=Uc^?rBM;qRj=d6diBAwE!dX*%Fp-8wBuwoN@W*R71Tywbtu^ zHcJQn?WZpl%I{!*F3tTsrUD}1@47IAPC>xvn@T?#6Y zB_h+2TKhmMj7!7f)=cwIi4yq*2%#Y4ir6s|?s-KwWL}0C{N*qunrv!Pl2E}iH}jAw zj?#oM_jX?;*;EIY;FaNn=7Ayj*@r#KU11%GfB)LTr^y=Ne6*@^eShS(VI#;@UuV+S zM?R>lUk%X2*nQoysZ*jlHTQx+9qDR5C~ip`(n)$}gh_9zJ^lQXsm3pZ2S~FMqbe3bnB<;& ztI>CEj3GEng6|*J)dfE3k81M##fcXQ&_%R8ig4IRH<4cpBNEPn^DHNRyX%UTRfWsr zWA6lpn5IeS2+r%tI@t=(%+1KGus7SJVdLDkWK=;}bL9Z0)}%!OhE1L_xA^W;Zr-$e zk{3itKjm6z4k%|e7_>!RYG{JQnVB3<-vxGOUP$?l>0;-M!=o`bFciKr?vCu--N@b# zd2Gyou0hX2Mc(oCNFHIqzaV@L{p6N=78spkezm;g={0SV_G}>~!*kPTKtG@~1?&;5 zUQlS2YYfnQ;?cWgk(`wNLi#WlYTHQNYrGu0L@T(+7-8{FY%jP!cLfl2{0jPibzc27 za-Q!Fmb9tc*2(4_hLioslazjziumv~^>kT-MV!pIHzs*%ApT{7C1!b^<`c}^BE$wM zS!7kz$4t2P20cCv2B0KVec~?&ErMB);pes>_6&b$O`K(DOo5c?NlGTJDRHb<&jN^c zD70J>5I-?%*^CvskvmL4IAe9o5qQ}g&9>rq_8C{M-C%ckjkUW)-Qm*D(y`_mq}VrMz_F^Bzj_Wi?W zjwW;qskD0r8j$S~-8hH}F=-Hz7!wEL16!|A83LD>Bhtm}=d>xfu2R@v)#iHNX`As<9Sx6mW}SO15d&``pq2PEt$sQ?qBTw#hT_$CWkx^Cvv%_ zyZ!l>|L+FhehlVYjL}`9=c}sx5?JKhGpc4+ytE*qnl|h42mE0>wC30yo=b_8XvLX&6A?%_0 z0v!)Dq2BqN+Gwu&x;XcyfcfY8>W`>Gzdxf!e8{6!=-_{yQQVD06GfNbRNRb>n>m># zT8MFRN4(iEymf*J(7Hfxco7zfvb4B*SGZ(dI8BY6A)&aryp0&yp40b`!|Xa5izp3_ z(Q~2%C${W)EEa@oAg7$t%3;>pc%SY>E>Nn;yr59)YY(qd#ZrGAw~G`ke2mM!70Ong zc`FQ&mPI_l@FtU~$(C)ml-iD2BmvvMsa#*9O?UOKBstVdx`n|$i9(mg@XlVovzOO0 zQ_3+y-oK?ovK!oInqE*O4km%9jAqQ~x6L}i(XapXkyh~T&P}bYo2Qqat65mUnMWMN z>2Kbqw>6<_+GZL`!C4)H4s+Co=I{~ogOKfpYgejN3C~lPQN58~7iS5JHrHIEB%4mK zNmB+QuoZjQ#P+vkJsSt)Mg|Zi@q9}2)7HZ6)Y33zr=aHPGTRy2(}ws z{i0b!qzKeAi;;CCPiv|drk<@Ff#;T_?`BK{ih;REV_IR4{aojXZfhKC$`C>LP{YpNd*whN39G_&VJ|xzdQT>JA7bv8hTQyq`8r% zLgeMHvZgI@>FSXyES$+4Upw8piotH*p-n=h#7zqXZUnrc>u(-pua;4YR7pW}BKb72 zWk_*8H>Bp=91kg>5er+En(Mu0v&^Tkg9XE{VmT$}@mt6f3o)TG83vcE!j{x+z8-T_ zr-&LM&X9ncEc`^yss+YSA7|Uh2)=Y4Vo7O2fO{WA(qKqput-n;fFB%5TDSo^l^5tf zA<-R*q=6zSZ;B#0mGvX7thomZO+9GJp3IJ9)!+z=CYNB*rV`x4{W)rGF9(&>D3rLa zaB1?#I3KO5>ECzC45F~?$Bvx4alOxts+2m~fPBizAE%#&>7K@w@49V9LtVEE@~Lc} zIcB5?h>8xeTsAR=pNS7kS&_&Vs$W3(cWlqG>k@*~I{MRbv1iGSU!THWNPBAT=23R?D2!%A=qmSS)pcfpP+=z>8oGmC+b zaf=r{FRD!q=wr=X3rhMra%VF<9JuG*8Fngx-ImuZVohnO%Q|l(x9&sC@)+USrPElD zTRG*(Qo+>dDOT9Aau!4_L#$Rj9L2xMY~Y3tuxS|h>C~&60kQG?>&)^#Gy%X;d(`X= z-J#DMD=-W%$PBkg-y^`zZZWe|<4|i;^<4&_UQ~$}PEjBwvXk!syTb-<8j@WmY zBVHb;>G4rCJUos^@xgF~375xJ(FM8Of#4#INj$S9TnlEtp zR*Y;$v)YIyVZVn>-0nV$mQbl0Pu@i=XngN?X*kK5dBdZxPo&JGerS7t7td&9omhT)4g!IH<>Cm z9PJ&94hBbq>39&T;WSjCQfhB7I*5nE!8+ssby>DToH?~%e^h3(I83L~6s@ju6tfuK z+PFlpUEW=8C1jcLDaX(>)I>p^Nl*l1f=Q~8b)zh;J;(`b(o zqeysiJj8rY&#yf)Tyu4)veKJnG&$QPj6}TF>a|1#1g5!&X4eUX!b%$-mRWRCCu!X5 z9%N?8DQMuyYA}#eIi|K{!oW0W;a}_4aQeQrG-t#jw8V4?RJvulXs1%EA;$gi#DD+_ z$u46P)=&g8OyO7Zph|3ELCsJoY{-FdYy7a5;noqvs1{6$x{|M3u*K=4htF{F&d{M3 ztI7~_y*xW}yRHZ|pXMlW27^q8uXAkQLNzx!o=NNLa3MMtA3S}UV~@F7?*r$1%|Q|d z8k7f8MAa$(nqn8yuPLsb!Sq_sfDaa3TO2ouNIY@uHo-U?45R&UxF7Ey>>uxsM*D~R z@n|nTIy%@t9LIYgl!t0KI9!J~ekME6RAF{B=K9q3m{aH@1`0-ib>lauIh|8WCPzpc zJB_ zJ)(Xt@Ks@TM)ry@;f+e?N}~0hMjw?rvYA4xlw4})JkzN=sO5I37DKufQJZ!KT^e!K zQp-VK3U`oe2!XwnAdQgUyH?wB!@>KvwuyL#Ye<|!^f1(Q0R|lgWfzl7fIZ@rU*M&j zui~njLOe7>W8K5S>GfOIuar?BUQ?vfH{w4gfVYxJ$f4tTc{~dD#>2^UZ>;u@#{=-T zjwS~xJlKzqrr~sYbU2Ro2FGh*=JX;kA-W7MxeL}gl&-2Pt%u<3m``JHq4J{QB4Zjew2RIlMSOr&?n%i+d0SRBf^iBm?dV~!m0xdYmv6u$radg}jcX~M``{#ok zpdGusNqOUZw5mk?z$sBT6#5*T?yIb?`yQ?%Q2o#__PYX2-*J=4GuRA7YeXPQ(p+Gr zXhSAh*cxUb^2d}3=WKkR5uC zn>5$G?%_LF-d*irRc`v=xVxo~s`|)eYuwW7p1$En_Vq!&dG~(TPGB7DxwXvkc(kt$ zrw4JkKNw8I@$l$)6om)l(L_bZ69p=Dcrcl)LzFzrt*Ss_^8Jqw&z>3c#(OqeZAMPn z?k&`nXVcj+8YFj}F-=Ik%r5Nt2`DVg%cgZy5V2>bYVvlZ-7Zy6z?m?OOap3vto2RL z32z9otZl6Mg7ewbIRR6u&Vj{tq#>nUJ7)@e0{C<4W`1*`r8NVR5pX0=WraG2vu+Ug zavdhgls5D-F{t)Y%2;koZ+1-Y)cL$l*p@X}LUgP#bYgjm=S9stJZ?K;`$Y3Jj4-}! z`a9zBj}!<0O$%zC41X>Pg>#+oW$~Ks#4wn7{X&_Y6u)<FrFR ziL`VqEPn&|4RUCu%_Hmn5v|9zTfjS!*OsTNdbS)KwYfh{a0o1yzN0()>!t#AqEbFN z$tOv*Ym&tUSQ>0C%=8lBx4F&ww7Vm>v_@~n+We=o)~@*M=M*8t2XQiGgs6U3ag5c zK~NbTWtd}d#w9-Cq+Z|uo0Q5)&*tF$pGf~?iV%R>0j1#SI}ja_Puv6RUDyd|3%X_; zFrdaMIzETL)(G%ebrv%Fy2AfRXCb%?Tqy>dX+CYC7?e^EO#@$#Qbu<*g^d^&sxduo zR-jEPmno+svxFfirtQO|u=5xaV@o_%ddoZcBqU-b*e~KMsvU0jLpW2btY%ypk>N}U zxFA(BSJ2}2D?9Q zj;=lJb{*2idc4X_yd4-B+*!kI6J%Y{Rx|YuOdA62e2b5Em6q*A<4|@@zl$evS>HRT z?QML-G;C2#&Oed{rDD}UgOTQjx+g8+L^X&zarqd&qcpOuaUyESX|bC*1jXe8}&{p9XM9F3{%z9 z@~G9t!9VubR#U6cPzO%h&B9l*ZLec-ZrqROxsI?hZ}8 z(`yT2Ujf;astXH|G#|F^=;(#lGoA3X9B|?s=XGHYE5>Q1FhG&LVHl9LYy(*pF}-gq zzk+shlrV8X3mb{@&p;(sJ>Tgb4&-!Xd`3YDaIJ@>gM_)R5qwqVJkvztfPO?;VeJt% z14S^2?SSlIWh{!Bi4Dm7(jE$9ONHEkM1K)3;M+Yxz07eLOKCnI!Ql7<_M?q+ffa_C zaG;78d`gA|CbgX8B@-sN04eqZ_~cnYI|tM1=~Uu4u!Q-9xlx;O7Va6@Xmaj45_oM2 zYbopKJAj-GwaVzIL@=`;YT1`pY5OEdrjZiG9Qv!v2yIVfg+v3bfF~B;54Wgnsu+xB zKL!B?johUfgWzr#Q${e!syJvi>DTSHle|H|!bSE*gJ>{1K0Z8}9v=;lhT;CPiud;> z(Y`t!438(H!{{(P9vxg)uZ?eH9|eR`qMgeO9(vz4p^={g$d?zTZl~lAt_9q5M%Mt6 zcYQs+gsC^#HVhBwWK$FH|LEb_3qnT0zaXS3s4aZ#EZ|(Hz!8_pT%}3Yfh^`SSgolI z<&hR{CN|>_SR5W}PreGtB85{?5*)(`%al51-4gR0ayd^C^MaMn6_^umctDwn0Ow8+ z*D5a}J}JeagTra<{z-v-QcZL@WYm^Cmtzlx9B4^vBmC)rSAqmw^5h#3Nd{3(VHZJD zm%t?wlpj>l2Z$0y=HIYiPbm@1Mtv2P#SIC;-D$yS=k%z*v;N&mmT z48-E(rT}bgmNe@y87Kj+?Ub)7O*n8$6H?WubB!Gx`m~_bMT_F1RdFNV{G)9cqwT%h zZpvUWJN0zfBIFzI4gx}RQD_ru?q|04)iYGy|C?u32JinA+$W{p>VrY=vTp~*3A^-k zUu2UF8TO4QE)I*B79Pv3QCjHm9pTG#ybcuw2V+s`u(~inOM|oV^1*?^%x)MdX5o{p zFiJNI+^3(4`hp#)>v%R4{S(3BG>_-rbx!M=7U19Mrc~PY)68+;^c{hTFZ()(HzipM zmV!)3J5Cfd>r2^P6BX?=F46O@-h>9oys}=iqw*E2>eGkbl^&n(?PK zxPNguDKMt6BRFtO8Ss{2ONZkmKE7L3U4fU52v4t(#<)h}R>0;Z8r9kkrHOFctF;2S z8XsS_G}yHT{_-xY2Tky_^U-p|>A@<*>5*IXK8^N|j?^$dI-ZWzbP%b*aBnm?IGP?F z?jP?(!|8B5fw$KIfP3ooeL|B+CscTWtsH-IZ8!hWLDS+Qv#7|k{_wg_a1#*96Xy<_ zL?E~gnL(p~J(`4q-sWyo-sH7tM}^6|&{S9&P=z5q-5s8b5yDl?Bpb`LzdP_#m+;G^ zDU>8Z6mpS|+qW)Eg^%NVS3KNrH@93b>e#NsVc1M_isi|aR z$i51PGo^i?U#vLXCsagPPnd{|*?2hEsacjHlyKbSP%F(8gK1JLOuejkgNJoc!OW(; zU^qB-D<4Nk!C&rJ@LyUt-R2l^y%|>kw+V}px^92qU^g6WzSl)@@5ud<)7TFcYMj@T zRDhkMq4UKl$ylZippDs8zRBe{@~-_Y@>6m$WjAco)jEl-*t%tYB|DNf49EG! z3l0-q8RW?qn3RU;<6nuBlO0Xu8d8X1HfifKWUM5wyLnj`(kf97guk_!2dN0wb<^}3 zYaUGo`$zD8dww73Zcl=A%|5<4td=qru(s&`^?0MOn9bIJ`JtR|V>_>2T~Ygv_)}h$c*w6E+&J z@}cYZ0+$%(>R&Z|f>%1LbKFQcM@c5iQc(!Sj~0;cR$~Z8XFYT=TTk~L6pdF30J}2H zz63x@t=54ZttG^NPIB?Ec zEIE$Wp^(m_sGgg+fiojMh#3J7w24zmi&8jTqIx;`LG`t(pbuA-R2({RdISEWV6Gip zUt4oHr0e^$H<6H!%&l8H#ol`3q1{vj++5ciet3*JsVE)22{~0}gl09I3X`FfdXF4Kdv2;mM-n^Y*Xa4-Gb||29Ce`M=`TS% zB8mth8HNNvgA;Y~htgJbXlImK&Vv8*&-Fr*j!p!#A)*Bk8QNM;m+wS)Ru~k7Q;dm` zLR`1?pZ3*Z_9{gmXi= zt+3snSHRq{8YzQM*kHYz=1ISuam1n(OTlzH15uA@!K|l{(*v!6~9!?HM2S|%I zJ~&e2LA*a2A4P+3r1l2;`{U6#9PM435bq|Ajvp&D+0Rs_L{9e`!$G<+DP=LD=GGmC zxP&653z8*Q_pkx-5ZCDxb)$A^Cbf5K?b5z~SXUP~@83UpbQ1jemwygUm|Tw@N{8Zg zaKhASFoU6#ej~+X9_5y#lEh2O)F*=3lVpH03D*k`=$5iG*kmQ)7!#o)nrJXNtnG>KdYMi(K)$#!cOjLTyT_H9yD{q$($=vnMM z(jl2H-h7rNy_`zsSEuYaqykDeZN#oyKEj(@7Oc0wqs|;hs1BwD85nR&HSvV4APC#S zwgJO+$!4*^eYi-@x%N$zF;eYF^^!w_Sq4(hw`gs>_l(eSt>*mMnphjS4&%a!Ak#+hb%uZhz3iJ7 zKwySO%VF2yjEbzv+Y*oqz(V4tve7oz%||tR?^nyTvCYV+?~`jv6tBNdjp8u zg9)9cx^;rkRg)D;FglVq9r1(W>eusBmG&wgq6MS+QrKu0OV-ymsWS&wpw1gAISI2U zQO+?%t@Y5^_(T@@=U@Ii{Lgcj-oG81YGjij*$vKY>vr&|vHVPf3EByp3!xA9$Pb*f zyw`I@dR6$TXN6j@NG7!;9UZ??A4Dp9@HdMrFAAjE)^n-qHnNYa5TS<-iPg*D-gr7x z$J22C;CQe<3is4eI0A1yjKOG!u1~+8)c2UT3Xzygs+!7Gr@G^JgK+4NT^9+XENur+TKuKE8kQ z{P9kYD-Vld~5-k_CNh zj40TmY>Keq!3v@Tv+HOaU%v+I&}DTWsqiq`593%JMF&Tty~F*(gX3YO#)IMh{^8&_ z9*zzNd*kaKl$(UvPe52xNf5TGL-)ogWryn?_7u&C?)}0T4BUc@fY>xe;|+%v+=mT! zG#K;`Mmxd%i>jKJUp#m)$Etu`(BswadA@kSpZ7-(c8L9o>uspd6jlvXppsiX>kN3? z4Oe#shXi^n!Dy+l=uE7dGDIunO|~2X?YWNVhRB`d;9G4G2A5lLY@90`~%i2X0>o7S1^`QApez;Zc};tw`Zncpp);xzEd`J>pw3 z4-cuq$cFQr7@e)5F$_VzhyWi{S8tcZee9ZaB>@`J+;oBWbEdRM1Pe#X*RoY=x|its zs&^GJ`Ju~RJPD(C6o-@1=wR<)98cgs$HRC!Jr4JVhm$A@2Zu_H*FsEw=1fST1F&s! z`e{hi7p3GRsNv9k5WhEVmiwEC(!6`U{^H^i)+9}`pMrv>w0II99^Nw->TIL>t^SR^ z_39p~SO2X!5ntPhI9WLnW^^BVvYT)gFa|-+Q1}MJG>I}uTyL3t?@m)kasv%he;RXa z8Y7@yAucLbj9o|6tO)^DJwyDh&vXYe(6^?sZVkqX*W!4)2s^Kd!VJzH6?}nwVXC8! zZ04JQYkA#}o@Kh>{uW@RqkktQ7W%4qa~5x%DAsEq<>i3+!+v^JLGwa1bu9FcdrqV)!i6~l!8#}1{$oJ#g>Bj;wH&W zC(X5Hp2CTb^VeA~c=qV)UhwGqlb1cetMbdIr@O(kT;iCT%Z!avFcHyMfyWTUft0~g z2qbfpb;Mpm<>Y1S@=kdv#%ctW;Z9K5$PP)c?`AD8kDLk_p4omZL9IT`BSk9KVWfO# ziA&{%fxY1-U712v)chl-+KreUN>io+g^f!Jnf>2)p~WB}qGTao!*FfBk>k+5}=>@5>{kw`N> zwIHUID#)=GBH~JBQ6SQ8+Ic2h_aj`^mEQ6`bOnBo>WIS{YQ`y=D6dH(iMTF_&xe$~ zZad|$dQxGd^#NECI{;U&2Lm>YZ$UMCO|aC6yD#C~4EK(L?p2eF29?v`2YZJ{J?<(o zK6wB3FPjrdVwtcFhl6WgaWvkSEA9>Oir2JGj#gC|962!kG)b8;QTRf+M4ctiI?nAW zA#DvwBYV2`mYX`czt6Dxg>q0xR_wGL&XYGC2sYc)y2BC`5GQvum?M5TrsJa7A&{D1 zLqC?4j_M#9-i(^0Q?rb2EB5d}Ts?aeWcc+UO*9909*JU?`n6`z!ipr6~g5H8>nIT$;8?c+we{`q} zTNp_SLo<;XBqMJMTjDQ}*5$ln4kZ)8*x4#-wEDCn%&^LEi$AYFqhEXlI^Y#4%t$lp za2ZP~t+n7JgA_|BBWhw}4yd|rk@MiR3Ad`jTyCO-F64&KSMP{Azt@ch77xoo8OsT< zS%7=n@>*=TUW1WXod;I%u!!>cHrE9ympHVg!!b@dRb*VZDdDshgSN*q|&J{3z4 ze?RQVJ`SxCwZbD^OBD`QYwG(_XhGkXtZBOMCc{w;ZanS1I&}STa$H^myN*3F6H8{R z)|=S2vzpau zmCzv+b?U`+S8iGoAc9nDVW?4+UT4p)_e8f_ZM51M<7m5Fey7I&?@U@S6v!cZLXgS>bXcgRhIB-H;i(y}b z2Cy8|APUyO1@XfWHhp9uGUi^_cWWJ>y0(^3keNfVj-cH4PF22FVy@*&bTW3wEIt@(E+_sohx*$9%!0gB?1Z5;;bY{;TfVO9TZM-@a$z2WSRIFl$Af5kbhxMDI2uROct1Qo z*c-*_NX2R&cAL63%;P57;fLYwFmN$%68f}iE><7VbZZKL8uXh*(dc|$rMY{S6x7J! zBMIx$ruqVwBk-g_sOcmZ7B}>f+3CK1DFv}f!fKIdMxsu=#yZD|DoURfp=bo9s9U0d zW>Zv}Wc3=@*>uGP|G+J~c-yYAu!$rtt0=2H`pIQ%7p6y!80TopXJX6fpAb=v`5DbR z`ac}$p?x8qyGTxaCWW~fN(PvD z8B$e<+x)=!QpEp#R(wdxxUllqU%ZO+`$U6P+~Ab|MaMEfup{}c<4M)@W)=E|P++~| zy74@5PHOp}9@qt6_XuUPOioHsZP&uKfR5Q6Zq;J{Ak>I|Fg>euwvTYINJy&XT$X39 ztTUyOED^zM${BIO<#|Z#fl*a1{xQ84?G-IIh;A(*BAY)Kk;_4Nz6BXAVrD7k>ohzM zM1>g=I#Y}(t+n0k@qzN+ObfOHa^{``=@E0^oe)n^V_@+j9Jv-f2;z99v!+dwB5Zv@q%%+5mCY= z*())?*W`BW1<&j)h5ka{a+9%jx4pvhjoP!a5iM^pU*9A%!+c$5wtL<@uavMk@+GuW z+-r1Z&?pK&NWfl**RJs!uZLvsCdbRokP%%}u^@~z)!1q{J7Phc>}aTeY}!@1>4#)C z!(zs;a!SJd<3y=r@bl60`8^@9i9TeZaS^8D5v3Ez8_E$hk6o;sNE~s)5Y4DWFDxSk ztdwqB_@M=KsJA!4@)Sxgjv*p%G~Id`Op-~Ot&KHp6~&+^G~IX~v8?3v=+??@amUTA z46~R&3?h|=XJwL8a}@_5Y*;Bu8ic@YD=OLb-lOa5CKLAUle06O?*M&9Rc17Veua4x zd0Zh)3x+u02sk`42R z{sKcLL=>y)ltE)H|EX*kJ1KawttS|>Ifw6g-C$@{9&grAZNk8!QWv6ZBkG!Ku*e7!p2PNgY zTnJFmYzFci+TyF1@u=VJ{Ey%H2cPrK@4`^V-f=j6^za$C|M&nl+;0qlmW^pF-8f-< zNmBwbOUl(q?@zfqKkwA!-tOUNv^y!(W9$cak1nwiUOo$v64dLb8(NX+QsY~3OYW&> z?ND-KHc!%RGz>oX4S2N88;~(>n02AriPP|fdZ{xk*)%z?3n4Z!rEwNr*bbi%O2ckN z>NZA#Pm>T3boI}_{BwB$iny=JD4Z)pSYhhdA3lrwM=e{<)X!HeE}S*v9-PVFBkQ zpD@u1HhV8hwc`g(Oz$NNZN-XXw=TnNdVx|sbjEzQk8e4{H291*@^Wjz2{xRZ{lLAw z%{wt8_G+p>Ic-wqBK`;&tT4G=c%?vbE4FC5vY7K?(D2|D;BCSDk}%`*uTO&U@Mz#g zDd2cXg{}@a!f@Rx>-KlUT3Bf4$-tB$q@z;~Z#Zg@5Ntx>{`-c?>*eWL5C8KLfBF5R zuXlPYq`-Y!%86?0OJ*3sKmQ;5XW#z$|JpyjU9@_QiM{te47E;a2}l*X4%yTsh3)nl@-?yX4c}dK$GZ>G7zfLj$Ljob)E2&LiBdOG=Ow00_ z-Q!XK6XhvZ8o7ab_pAD2++5#3fAsiy@YO%C@s%l4WQgO^%pDp{EOLSnKxH!=>y+EN zKjDoP*|f01OqqE>df=vGf;-XLYA|8fE@NsoclTg~M;?rDbn^n-8=?kB!FL-kMhZz1 zXl8E^&YIX;0(^~)t0k^Yo!W)~Iz4JYfecf1t0&#q8y6&cTiq?)4{LKpW>^-8AL#`F zfhFge<(n-rCz^3BrGuxlqaj>is<^oqrcAp*fU*T0(4%dC*``4z{2CKFRbi4ELJLin z?sf;-L{X&MDA7f~gKQ`EykU7*q;WEv+vC1!+Wt zgY@!!%a@R|Ik093P^Gn-cd);?ElFVd=?3`RmqEzH0d+*W4b{BqN_q$LyYc%EUf;p| zew$f-2lHE_6E@mvn4d$HYHHL8yyqg2Ko2jNkcfSzIAKz-AOGR($&df=jSxy{)^0Kf zS&n-RP`yxsi_5k^L1pX9L*1X#rya2Rfkru@Mj}KjPW{bnEN|QF{m(loHri&4T}MQW zT2_1Zor2rk-_cvm_}1QTE1RVfWLDy~HAo`IYdJ$wh4bLC38@9AU}n^~H}9X#AD?nZ zGaB1O*s$^M6qy03Fr%ky-^r5j91nI)6o)U^eK9AhRih;XzT5P-zUj9bD(B)wnK&vD za@1?pMQL;o`c)|Ana;KZ|&u20wuRnis)07*9x|5`^s!-|Pfz z!O|DFhk~g(b>%AhoK#rN+>?5{%U+~AC9SPH!S=+;v?H;_1U3#Ublfl?%`Ao7DM_}& zY{z)goK4@*SB>)UjGtMv8=;Gg2acYv)V*tv*{7mrGzA^#yHjz?r{Z&hztJ{M*p3D( zCZtwB?%9cvKp;C8T$!+SX=s|ZUKr)i`)tJ-B6)8#&{WlydxswUWJae(uOM198BdUYM3P{^n*5qO1QPcpBaXvtegv&oS`@o*;>K z9USZ|rojzea8FR(zNQfTYrd&=Cs;-YqhD3{w})}%KM zi}wiH7*i>SswHR$Gmvz*tGYWyAAgEICxl(8Rv)Am2wzh*;!c&qD-E;jq;z!ojXjgx zqxZa?qpQh&oD_|5bhU>)^N|1EplYkRy4+%yc~U!Q}OT)}s+U9Xx%>)k>5*RUJ6IW@Ul+&RkI4el8-#?(Z_xs?KfA9X<r1D3N_Ev92mH*44~N1&tTR(|G9=e={?@+ zo8P2Y@SlJAA2;~+B#eH7LlON1X6ub^@;}!!d;~yeLdu8b<4snPrAB&FU2t%us<5eb z)0la#9_2*n^SsW&*Wo3+ajxEM+X=o27`Ou}+U#BIK}C-p#{1FXVKj)xYBW-Nqw&FD zavUB^C!8y|(o2S?+HCa}D15a~F03TGoHARm|+iIg-u0Wwu_z8wu!`6{k_ zAFK=N&(kqYtA_cTi0~bfd+w9VN`)KsxXq7Xz}tju`uz18J2*4*K$2sJjhq(3@H|$YXV6Q7!EXCrPu;#P5^qU~76PYLU=e@uIoreLovCC&pY#1S< zN$Peyx16d{-{HVWY$#WVq!SLlQ4c_gzF}vOLYixp3H>OaYaY&$qs;gtOu@v;*+X37 zKu~mJwD$~|2S`NC-_&*Fc!U1QXfx@&xQw^+4vD(r{Rgk_kf^`S_PRr&uF=vSZ#5Ei znSP7ipu|kg^5U{zhEpmRKs_*LiWH;d6nBmci=?`s_CW&K*TNHvEI>v^Cf17e5nLUJ z^mtz26+WWwX+~q9$nQC-gC%Pf-bE&Ed8cl>OK98D;RaYZ-M(t79N}F;&Dw24C%54R zDO*$TU$*114Qs_{^SiBf%Uf-$L7t%}*f2*P zHM#DiZU;llu(W;QcAx&0p^M`cp^M{zSLM3jM{pY+k5JD~-*K(i6tvh69yRakI`kWh zNRWf5dy%{K%C>7hqSDzM-KmCP-$K(nU+vKcc*RU)9T90 z8o;TE=je;~1zH2IF_wq#p-#16g-cIP-L+KPFKml1Sapg0Zm~EnT*tP$x{EK|`2D;1 z!d-k}i%seM&nmv4p;&5bELBhg<(Al|*r$UjC@epQGE*i39u$0$aIJykVYF&0od~nb z`4VaX32Qr-dK#<2u=}}b9L*&S)=ypnkE8A)F9~*<29NP-m%;s)FCX6#t>5xF-|Fa0 z*kO1rvut!PXO0=3W8cD7!p>%)y+SRYrF3;60h%bKTen4xIN%4fq|$`~t?wB3n#@Bu zeJS#xIE|fGfJ9p}z&uRWbX#Je5_?P}O|b0<*tl%=;?9&|?y@XP+9Y&L%1+4mmYvAY zJBYQv-9aqeZON45PSu^RZG6|B7}MF&tCNxjSxhXY{oN&vA?{3>)_1Yf%H70t+jw{L z(iJe~)>S*Ev2w<}UPG`dFS&z>2~9=$1xq!~JDN@o=Da$=lDN@P&#w&h8V{9DJS#9o z<}0}U;b)8$k@u;;kbwbF5KdIO`ylk7Pb7&sO`;1T&@_@dkiHdItfH%6Y=vf%Kv8~A z*?<@@JX!S91aEtdYI-{%lC(U zmH+2%LFM<<_MfA^*(@#G7JZ9=(9WzA* z!H?0jCV%?m>Eqx9dih`^(dS|ROd%J01>*gOkP0sEpPc=$ z6MUUCy|)if;06pj+hw5CeTA(v)14NtUB3iOLM9dZ17YH8sQH*PsgX4tlM@i zh!ZY&QHBY~n1{i4>UHqA2yxcXwdR>jNS|Ym?q?Kxfw>G`AOXGTFan$4-3M_JzeWeIx=nl zj3W@m*>d*ufD}R*V){eT6BB(Hu_1HkS`3+2x}lzQWeQV?C&)X zCz<20R=BxkI0lmh{wxJ_!tHygdf9>WCbPNx+LhcMNg;ljp5_kpd*k;XyuJhd-hqDC zzLFmYJpvKD-JstNDcqD!B5#G%qf>%n&m^_}c(+r6JN5*2svwj)tZJOy?Q`cZ`A z!d>jT;g0ZMVsJ}sf}92RyDei7xyf$dkt#S(^GRrl-&u)t1EV06?8d7fp>oY*m68$%U% z!8zO{#DWIy2&*)^fC{n%Ulu6b@pt$sH-Y6lHQM$vqOvE^DQ;P9yZG9Mfx-Y@dR^H4 zCc@4m=-$EHX@M}5ROkU$6+|{>K(U0$s6vIFE;hQ}9JiX&h!__fJ7MdcL(SGr7i{X_ zh~}ik-OrKG40m0Ta6vNmZ(&*qH-jtWJJ|194AGi`5|q$qi_-F z37od)U5lWw{ff|^-@bV9Og;rsk#K*F(&9;}^8j(}^`sqBseH3QBBu|ZJu#(Y8(4zh zXZ8qp1#`%bw|;_2d1wY0Q$kJ}2xH;6UBSX37G=a}Ce(xcZ7>`Rc7xw%N}qZEoG-bN zz7&<=dzZsA!xig6iJA5u`U<$2!lk z>RZqG9j_zngYsB&cFb$o0&wn0E=vn>X(}IeMTqUQ@&ZZwh!Q)Rko@4HJWxS@tYnW6 z5oI1ThotUI9uguS-k(b>8ICM=5yG*R)G!Z6v>WLD?8Lt-o8u2l=Re@Gng(gFv>o6k z=eof;=y3eUjelTXGqH4+C7V2ka5YNM2n2O>+o{dlU*s3If3nxpxNXza98&sW4*o@lFx6f!qYX0p-@^t6PH(xuIiw`v+sy>0gB#Um*$?W!zg zkDj=;;WxGY3G7a%SF}w~xCP{Go;3%YmJ*AvB;BQ?{N-bpLKbdwm%_O5`*$gfyA;M2 z$E^0YG=)*LY49oNw2-!DrBDH&t6a_*BXYgS0J`5*?#$grDSA#;t9~yyCm@BrB&9l&|})R5aH*YXxZEDL`x$uC+0sQ2b-A$#9Q}mPti$z|QI-6r5Ql`bi;tY$KIYnyubo$4}i5 z%7iLXB0)ug?10`6F@}>wx8_*t|9zgsWp!i%LQ6ADo32^ z675-{BrNe;C6)mcVmegeeEanM=WSn(w%fn@5Tc&VMHk%8hzbm=^E(3L{16__VQkcK zXN}jKhDn+(9ROz&HNB!CW7@ub`gudvM%(QN=>o1$Qf1A?F^-Ghxr-3dOU^f9QM4+KOe0e{iqv zK$o|^gU4IGgB!%N3+#M|FaX45eP{!F8@|)mQeIaaieH6XRL3G7cjWy>QDm7=O&lGM zi>r56{|lp0(hvs`^O*|8_DB{SGuUxkDA))VLBI+or;Zi;hO)2(F3pm8orb<2c0K3o z?ks%#S=it5v#_)-bxHzy(Wpx`&_}~VImeW>E$~DNMk+^j?BKF(b5K4ZU@byS%r;qr z`#y{!Dn-RpB5+U2l2D;Cf|l53CTIuSO;U5{R2R?k3?+U-Xd~VErR1+Uqb>~}K}etC zGer^hIYR14LMk~mu2C8yAS}@>ZUop$wcoZepObhIu1X5r;7r0ftfwJnmtdZ^?Xdke zR>`4|kSq)79eE+WaUZ2(-xQ0}1g|NIHx3@Q@AYW{cZA7DKy#zIzGE_$C>KJ`g$Am` zNa~AvM*Va-s;qvlx$BY*P{(S97~4j5zD77MbT*gH=Uv0yyCB>rQBQY4xHZ}$+ud;Y z8sd-y6qvGHhaoVC9KAs7zGh)@pxm(xRfD$~L#H7p!k^)U`!Gu(P;fMA5aV4VhEcpm z^=6u+mGw<+>vRsdpn2Z<5QH?^Kl)o__{>ozn>vP{>%77q^f96;4ohTix;k<+gw?ygEot)z?t__?9<4OIC9&tpgtN zQ>i$3aZxBF2&r;f;)mAMS|2~Jvxgn)GWNl1av6m zVUroo{cL5$|7hsMqI_^!-Jcd%#+=3d*J^TI-F+h_S07YX2l|G1UOM$=x544C7If3N z?ybY}_{21>Buqne`tl-C9&FyC<_#cj!Tk`qWc)CA9hh-7hnk5 zy(|XW9E7}NV9=G*Ekw7YkJT)UE1lOsI>+Hk+~?52eZEwaLv=KU z8%^WU{?YzmGMcD^@L+tXj@8lO==k_(dNhg$>)7Q#jCO~?BM(a<OI!v8~a60usd} ziw(T}12R!p_*pE56_KUWQn^Jdr+W=cAs+HHUxdZEkL^I>i?bf{Uz|~Y^56xA&4_ov zIKTJ5J$rGs(+f^WmpC6h%i(^P*kI+^4kq)2JEMVLah`^51g0~1%9xAZ*$p0>nm#8w zV@Q2d)o94rp37927=)ySZy9w>tWH0oEkxYYSweL!epA>GNkbCffkkzc*TE#sxrEH* z;Qy2LT_p2nh4JHL$X_0fC!^zWG#nisA1H8j!s&Q?Jc&nYx_>yHsQt;o;qfF=YchWJ zxS0upBqc^*CZ-Zn?aC~{ zo66K!_5#BxNnJPaJvd+pdyFUf8~OcVlUcHqN63Z2mNOei1Uy5r!h!u36 z*45R2Fes7jIR9(R0eSTLeUQl(g#h7Dvy4mGOg0NgOG(Y`7M>RPF^|vjW99+*RjQkI$n~Lf@{-{uV`ZN zRfer(&$q5w!*6x(S0jXu-K690s82*U=XGJ3#)WfuO-}s?RkyvP%X0kba~C$drYV5T zI2{@9ju|eKiCL$q$EH|^kr0iq!!$&^phzgh=q1hnD~4DZFz}s@A1ECv>*{ERh^nQ} zHQtK5(pmMvda*8yqCo!38ihh$8y?rZAC)l;D~ii-YEL|KmF6Ud0F-8 z`z}L}u9r1b8KC~z?ZtcdIGg=Lu+D@DgbHBjn=39x11hP~Si1 z9uH6OuMp%*WHtvz#e(Mev)5yS=|P1dfu%Qc&LRP)Q0+S1ATGfB-M)H}&wU4OGY_Ac3(oT50qfzZo>Zz=<(J{L*2B-)PZOjZ38 z9`*Y_-5rwKJtSLA&>`5HcEFLsCg#ZWnA0UYuQ>+6eJKf`fl^!Ad)wnyo1;cGrf|?o zPJ)f!za1PO1bI}cs?=#TRuff`&w~X<0Fn%eWil#7)p#EY9Gb|9Ynu>TsQGRT#ugKZ zWsCgMr~)R<5!0lnV(*@J=33O@ zp=O8G#ASE2UEya%oJ2p)iR5YP{N&F&&bjSW9$n||g@%(c(Ooo4?ElZ+ zyDZ0zWm%%X0_zdk?XKYak$1$DLRrdIgjk{?GiG6M;J6bCIN*r~CB>+wJ-(A_vo5o+ zo@A)gtVT6y%URIwkJOjkvmfW2eE_(Vl-wzJBnFuwlJ0n($KGqNz1B!bwZb26*g?uO zWkhFKYxjf_+IZcp-B+W;<&)qlLA+|k^Y~rxUzb%8M%Jg+V#;Ps3CQiWB7+&SjueU) zw)8wq#r00bzJsQX_#Jm9meN@=9n64QM$W{ffp!t5`WUunX|(@Jqyh12AmV*)I0E_& zQP-4|tZy@W#ab{WYR|IDh9$!JBqiDY5M1a@QD5}Do{t*4E%SxCrktMq_{>7q)E75P zb(e8jMBW%!{e~XaJN>T@_;i*(uv@yRy|J##)~^>##>aZp{PrIV#!)6~#$k`t8Qcoo zUch3pMtlfALXU+hJ=)4FnNG4(x|F=rUa=}}r4aH}R-=r=FE`P!Oy+Zn*3h9gUR1EyZltipH3 zgK%f^zJ%SlJv_ENK(}bDSkch+cp&W?IOYUa1(#l1i8u&{i>z`>R91N9rj`ViqXjBh zo8pt}gK%ti?~w2{xPG9Ge-)Lbcm)ep%$1k9g&q*+!_#5AIZ;8cYs4XXs>o~kydqYARU zXLV8i$pn72ye!$u^kAyIR#R1|!ka0zHQ*#-x*q)10eTdnC9!9<|kV;%|RuPcMHGUZ(4+NH3s5(S#fFS0bPGMAes8+Pb!o1 z32AwQ$B?OrbQEEq9fQxnniSTRm6j)J8#?iH$PY`~X}1?Us|Px<4vIpGUyM5K?Z+p< zw|TV^1N(mb9G?$|N~2(6%z_sMd7f~7OeJZr2bP-5@=2Mex4*O*GhpEYRHBWaP64^O?djT9h#rgxG@_N-)nGNZBfwK`2 zN$kJ9cxWYTag-DG;wkCC8>^J|s>UG}TNe4EUcg^Q!pD4~N+_FhE?{yKUwSi~)ZFDN zy_XDC7*P&vH!XudCs~}o8wH+sT2O_PESyY0JepjkLC}h-Ul5zj5&7G?^%nlKl;3q= z2rAwDu6@bx+CMou+dn(oS9>Ru$Yvd z+h!+(DL{S^QrAl(MS{^Tp+d@sjywY}_)8PLF92c6rS5PL=AX^ypBGH#%homyqFxm8s%kcWd%7>}K;+zDdN0YnCzflHOFmOuR8 z=kW*7Rd~o_@1nN3Y#fv6NI4mlR(eh^MZYXNl$;v{HU1X!Iwi9=jJyEM@Ga=->Keq$ z;2B_Q&#rUgmzFu+7!CGA^g?z=cywo3T5^+7Hsi{hH5*+fse=$|hzjpIPZ0@|+3vZ& zsBrgdP>4=Ma09PPCsA3HEU@n%#FLeDd?isG2BcP!5~(#wHFz(^EZeLF_{v0~QF$(v zww=pjEKEuUc&EV{bpQ>uw2XZL1j&I2fB|6%5F{_;?o^)xn#L>iACxD7FX$Jh$j94U z(#C>?hv+@)2yy}PJrB8>hsiuY{ zW?3Z_F}&nkLAxdM(r-wm&`N!Ws~X{kH@Nh(kfBIb&rg4&1JC%uzyIppz%w3r#=S*d zj(f~ARzy~8#L>>Rp-!k!&W+Tc89{W&EjHS$T~XJ!IxhW6ac8J#qvR2)F1sV+s%*HE zWgFDTvOJ$yR^zPKkS8)l8cujPqdA4`jBLf|@1HuX1*IttVo8&yLmLrMuCiWOT__CC zo14nAZ_8JK&$$ez3OGP;Gf`rS@Yrs7hrP$pR{vXJh#vQutlhclh$Uw;%S}U8Zsmg0 zp_J{dFgoH!IAU%TQ%zTeO1qgX2%197XK#b2HwxCN4B$SRv~8}d zFfs2Q3rQ~^-BME_v|9A1` z=|4dz_w4JJU%&Z!WH3?xaE8lVGL8p?tn&8n`i@8(CL~iVu7dMg4%gtF_Mg7Kcs2@N zUA}qo>f0+g=O4a)L+y4q&JdABN$(X93T^EcM%3sypbb-SU5Mssj+9~Wc#{|xH!i^9 zp4Z$=rC8&LKk09596WN6Y;;YKhhhv?+GuZ$;V=nS^lVCPH=pac->hob&-8%8E}cRVfX!uAr^=@jp6VO=6iu{3y;Zd3 zCe5-nAI*#P;$)VYZUU~y!X&^>i}HgG5Z^ETDsF)T#c<6-veyjYb|MXC$d{sBrAnZ~ zIml`#=EKtM80QjQph^tt&lf)CMQkf9n{rY014Tp0NGFJVY8&XVHg@s5~9CRE8g;L#UI;@(d4HTwf#{SUT#M%EX;`=r}mf*RvpIf zM#gTR8MKXvP;z#Z@A(4%CC1-~8P_^}&G`otkUAet8?Wx#V3cx4j#;V8*EK*`t^jci ztx$$krV|bL&N&mvkFePTHKA^IM(JONBx@~8Fq{t4q3)3qlg5q6i#ysp9+3Kac&wlJ zQu)X0(!N{&058v@0KZoBN)46XM)Om8&fMr)G@C1xGYWOhn*|FBZr{QH|5;A;++Ruc zJn$SvPR2Y|A)-J(5jSndz^j8!v<*=`PrxwLoV&Ry)h_Pb&?tnQM~e}R|v`*Rxh04otli=h$FH-a4m1BUzZsAz;0in z>k^@mHj3w!bXSH)gpCxQpJxetXSfX=q(M)5BBUo6he;aS3@YPEO#SNhi(OxEj23%> zS&EK>c-MiNVi>XjV?dn0NsPwS!$~Rzirb0JPz3Xt14^v41MUB9T~<`6j&MtIU-Y_j z?YVn4tv@$-IanFI9Ev`bgT0ee6;IEj^V5^F^Jsc>etdd3IXF2uIX&AuIowxgr{~k@ z-iCsg)8K+K0tgQvXE40}lB7`jB}I%FywZ<3PEfZYwAbEk4y@-+mprz-DNj~xp2w_N zKsbTus#x(X{55HakB0bYh>w0t@zH6&lvsGe|v>y z>Cg3wbv+8MuJh=}cj1kWK`yXA`Fs7lB-L9$n#`_sZ1?TO)0ZZUgJ%Ifvk?2;y)u8v zsj=O4rqe$2QCqX3P;pX#cw2~&|D1wtLKqu3CPo%uqw1B>!ATxET2Y5u5DkKzCil%m zBjDB7?rGia!b!0w){4Es5Z0m6?Y~!?Tu3osS+E!e^m+$$zZr9G@Bw(O=8#(%tKas3 zZzQQnrJhu2yvt^mSZURZe#K7nf|UtSy`XIwPN` zq&0_SIE9)naTc@OHN|^gRi4FVS($wYr2lAJQNeewUk2Ak)XZeA9aDJZS`6}qqdbIJ zR&z^&qg)Q-a=qiS*Q~B)n++9Z^)jV6K6hYTV;j(sy&hAA(N%8_SgLMfiP8L-^gwo5 zH&$RCz8^7s>|;#M9UaYw1lo}KnaM4dd6x;4g;~J;BQ1U|I(WDW9Xu2+WkT(=92-n= ztr*~IafZhN^-zp_fyOq7NLzCWy@8`GrJ%I`?#_$K>N)*GXN0K*uJ~E$KfZ{~FZcKM z_swP6Z!I4p?q;q(EFjm+ehdnHN5zYH|KRAqG#8q}e;MXW|K(oGjPd}J6 z598ov0`E-qhSNt#Xs3eKGyba!MUNL%E2lT6348rv*r ze7K1a=M|sIl;iPKj~43yp%b*zVEP~6PXGBO!Z{GMFA|ao1EPc8 zjk&2PL;T)cVkKJqo6-CN5|0dCJ=2W$@CyA$YZS<>Q#5g8%bdE`fRo~M0<$Ej^hHt$ z+cu;nAnW~ciRM(-8ncq8aOkZuPxi;|ZI0twE;eHxOmL?gVJhgegQBLWzl#+p5NCg^ zdF>Mu!bx7lc1n2D+)cAiQiT%E6L2dE+5|!rbI~8efivP^8yd|)C`x>o={HVbFnDCO z4m8jZ9{l^S-VHQ_frijiR8lX1y`~{_+iehl4MtZB3>mv0x4)RymeSbOSn~o>ILTvnq>A+CqYC!YQc~i581=h1&&Ow@ z;KkLe@!8q&`FMX910kIz8NDpMy~Dam_k8;?PV{d6;^Ny2B&-r$_1C|Vh<)(u-$(Gn zSN}~vW&HyL8t^0i)HmdFn-vgX3iX+@P^vmDnMhO2lMF_YC*-_iBL33i>?GH%dJSsD9$X|K>ThdUeWoPbn7A9lj?fQx9r$%lOQ{Rflr*O^U>CSmlW z%Hpx!m&Vfqx6F9dVRKcGcaOMWSrgQk8m43>$NQh(h}kxj`+oddh3WXk-awNg_Y%p&#{Q?Ga zKj{~R9TaG82F|r*kkxZWo=C!BE|qk|fWfST`f=Ha8$3}^EvG4_s0Sz&$Cd9t0p3@Z zb7u`9>>y|UGkzrGuR!jESE9%MFEV=3ABMl_4@1afGBH)?D?sM!q#%jL4`qc=>GqBA zuimX-U>vSyU>u45tW&jrbQ(@3;dBy(>TrK=a=ss`C_LMb;-k~U=pfpgOrx_6p`Hi9 zpCsap=wVgVWSbmIeJ5B?zYO?^i#TEc5OQagf01g1h6BYmX3CHZWS)pM`G!QkoyIqN zTqF(g6xjwEvJm#f_+i`lAI)c{1x=33$r2i2ml1bJzBT6HUYtW7Tl#7;LgP8if~2eU zBJ{+{7kVSgW=s0z*IM6rs!H2W!CR9pwg~ACJ=x7pOD;18nl^*WzXkKx`aP#rtc{}& z9Mvh-8}L{Oa?i-phqqpS3EaopKD0uia$%BDnx0qszyMx9`1b>NJ%HCej_D414PNVf zzU1QFoQmvaXHSKnZ^)dylu0?kL;76fsjAOOrV&uCzB6 zSUN+lq2u)>G07`BX?-VH#JwG69TpbYu(LTGvgKPQEyuyLkXPof_Mf~*vHx!19y=zc zI>G-si}DzqDOvrgq(WvF%KuVjv+9~;1K4?cmgNQX?Rls=-OTIfPlJP#{gWrb1ymRC zq7ERQ#eW^HxVXmo8drvK0Gc8K!qRpwgvfwA0;2qyd%uivDs1$%K`1Nm<}QP07jG{5 z7Bz1-$Z^n9^u8d#S;Rgo1FO*;KHEGzv852>B*UB6lOavI2A!*j*@eV9YC=gXF0i^) zV>X#bd8+tAy4C{ayT_p0@~?lx6#;ch=Jjlr!p!bpaca9^kAq%A-mR_<9G+OA$*BL; zSjslXyIh@V@Gg_N7ZkXXSNjMOwf9KNvX#@;CL;!Nrywj$gm&5|ipH=-lm2E`>NgDY z^$znsL)Bfw+zjk);|e{z_2}W@Z3W?Zc&o~J^vIE(SqelZil$8Xf+YUw>tM%wOsj8V zcNDyQ{;+Srq3fA{)@u_Up;I*P#}(|Xsq zS>H>DmXC8$SJ!!w{A8fcJQ{Hi@mbCsdiUq`1>Ud^yD$I3x17wo72#=|0|RJ8bKJRI%7y; zpnz8sBZT-K+qYt@t~ng7tT`NeTk>9EImH1EdUnoly`7_m0gJgMy87DYYSFre; zzCHz}9DR!nwi{PH>?y9=Wfe(+5js9C7rddHfrcS9a0QHmQ0aVwbeNkI68q7!B(5XM z8OpGpnuG;dWqzc>EtU{rwA>YSU@Y1zu`<4mV{>)Xdb~1fJ@KN}Bj^Pza~*h98;VajPk(<;nBBnlb) z%$RiGXYl6f<&)q=8iYE3h1EL)#T1`q{Nn33&ruTG6vNTqtrE&!`mDEqtqoy~1$y*yZ;S+i?ZL&!qoYGO^4Z>_kX*W)Eud|02 zqWL9Nj+E?l2ykxnW_m9U@jUvNYY;9?hcL12fDEOdVpm6Zq?Qc`{R%1t$O3jW4cW$! zZ4BAQZzT$NA+>VM%JjinH{Q2t2camT`-Mp@pVao8{RJ!l?E%e#$X2qjEhvgpK zK}RmLJW8Acx)@T4-ldZ;RZCb8-W{$!fAE0M{^!5^>jOSbu51rF{Qun0g~Ob?p$E;e zosL$K@UP{UuPLFgH!R{VVq?20&}O+K z3~}G83K4Q>Pef;E+1+AP{R1_ff_#ZBa4~&Pkv`F~(7ao2M-bSD@w?vf+iU)X7;K&6 z!tE^nU^M#-)qE$whQlr=+d%@UHRN}E9BlF?v2#$aowII(Fj$p495z)YmeW8fx;&5` z+$HuvSo;7<^?Dl{eJ(6?vI-VD5<+jDgzZN3-TuKOZ0)1@Y`Mh4jYx04{`%^T6KZ`V ziOo-YC@V*mGQN5OWcEoN(<1kUF&`EOcD|A|3w$z*;7MN0Ry_Xo#jiTXSoafIv!>_8 zB2Ux&lOM+2Naq)t%tw2hn9LwaXXo-8tcJ{jKh#OAerG2I|GIzEyYn&aKlWoXKiW{> zK1$vlTkcU)t5N=KWk2(=)Nwo>b5w;k*>-8h4A_ZDX7E8dc zHDviN>ZEj}c{I9$izW|UJ)pyxS|t(d(muSt8ANIY=`zuE-&?HoXeEK}ND%10kN5UN z6&@U&=$UbTeio|Zv&qr%!NGLz{NV6RogW{c?M>o)Ya~CYNO}BZKX}Ft9PH3RvY)g2 zPKJ$l>{}mIc%AtqWfvJzx}q!RA{p!9=@hMG^-*ie;oV1*w%Qzptj3jRF=bIOM#2q`krUrtYWwPxhKEwxgMa_kyP=del+t<%Umf>c1r>}O zy``VU-iWARB|+V)X|~&P#G7RW5GrSSxQ^?5 z2{`Vq=eyo8UP3#*+m9(My#;OdPl9K}(jJjgk@{(T1LTsOEVbXFkO3wmc^ zultQbbw?{1Tt|Yz^*zWL?N5%Qqr{J3sJ?mw@q{8JFxL}KDyZ%XbjSrEy>n!~N4;2DBpaR zZ+((X(j>30Z+}6giTKl@r=SX#A_Oso@{L#`o&=YiVX!~?%YA4`M%DScBE#G)LUEl! z8iN~#yIpD=!v#-{m>KJC#+dP7rUnwh@W!x7T;fnt&*VvP`!CcYf`UEf!VdVtoZyu4 z#e%nPb;;T=+ps9DcTwswsjIaZ+4aL48ZOx{8%_JT^2~l3LDsJ4Wgdg}wNEYV02Lgq zkX#lVmH^XN4_=lD<}dhw#SP~x0)(KBLHaC6*mft&7>h1N?NUg>I}NUqfs!5CvtP`uEg&xiRW z$2g#L4XPL@pax%~u?*T{6TRq%^SpF83duKQbXpg`J4}l8PKuK)niPe4i}+@Wef${ryE#F&wIux`cZEgr9$I4S1sodD zQyppGu29ciNOC_JGMxlDT?9C8@1o|wLyZrBTBWRe}KP31pVouoJNa2)=Oiak86D>0W?HjXPh#fb9?1 z{($XoXH3v%C8GvHA$Nbwt5_%7u*MMNBu90z0-|;WtYz>q##;4CsRK|w?H2V!#~ZXp zazT^VZ}>FmD!>{~<}@U2uh(V zVueMj2mXIlHlWDzxz8jj^Ln0?T~3crf~%zaI}CsT%pKZmx!*w>c1{*gCv7r;4%jYjf!RzNQcA1Mc4bxIqMub>ZV}aSZx_bS*cNy`vFB826?ptIw zhX8qF!w{sQ666r`CKfXyV-(J)MbDud%`A+hx@V)OfD8w@sZ%tnm?X$=@{QCsC(iJ{ z9`Na(l0{Ia$>KpL__qgqx^ENmb1?x!&+Enn&OA)uXx!vr3T$9Q(7+MX`~>gQt+`(Y zA?Rk_IeuSKp5C z|1aSj-@Sf`=mFQu6c?Ih^_etcR~m9XOUgxV)IU7mpuU9;+s$I=wcy#3feH-KCf$aI z)N;EJ<2r>>X>8lQNN#_DpyO?xpdT(OCXMHz-rIKxjZ)xt#lRUQ%5A34GQ-4^gOih8 zLt+CipuWMPVJ2PMrXKWS>DEg1Ba>nHuXXtMJCzm5tI=1|1I$nwP1B2CyCN7BHRcV- zi;B5X2$I5jTM%FA@LmDH`6Mca17HJ;FkEN=#zDIJrW_6mc--p=ynNI_~Mr1P}9l^Kt zB9#|GSWFU~TNfYnLX-j`8^&AmnAWUL^Y#0MUMkswY}y5it>Y}6;NLn9yaXv+$DzLo zXGs+N{zKJR+tzyZoiJptpEyXG1%FO{Ocp9m!h1}bjy>#ng;3G)N}-~2vA^A%jGY`K zWsmpWO80&&G-tX6ijFt2F@JG^qUMW1PH2i1IH;J{e%CUR^ePv;@ z?96lWTUvx=H<+;M4Ss@$#>>ws>2&T_N9*0MzI_4Ok(a^Q-ro46l@4u0vC#DFgQben zZzP7A`UpDzW5DI1J|CmWh^lXZjg2NBWyP8oU`Hhi`^5~5NzJ&^=?YkJ0jC8U26Z-H zy6;2c6xFHD`wNO^o#e4FA>~>`IEMiqg(&z9QV2jIghM6J)u(4MG&UG&%Cav$!U+34 z*~uWzK`kBN*X3(JM?x!%nT?Z>XpO9t73;gx&t)zuG$b^S?`Q{|S>fgQ!{ztbllY9R zb#Bl$Dh=shJcZqy)sY%J7r4@KYXg7>Y{k0jAo>syH~A(}(Beq`rtTI*JE5g>=ocDB zs8LnJqQWhYkVA*aCo0*?s0pmybh^oATHZTH_=ve;q#$hZP40ML3 zYT$AI6rfa$$xsW{2S@a)pi6m#p=kAMptntLM@g2a`7A-Ct8pVNeqKy-fR&ReUG|73 zntRiRlvC=*j(l8TuFE51;!4&&48bv0%`+M%W18dzZ4$6WEs>j9^P~7KYfJvnWhw+3 z1wvoaO+W)*L`0(!X)e_9k)(Ey4&!iPXaummFP4pH>P{iblDPTr8{IWYGxL>CLp)Dh^{q56sE8ErU44oV<;5mprx5ymU!a9q*r z+w7IOw|L?4N)?`C>7#b?WPj}GD~;n%jf5Xmnm=g?7k0hR$BHvs6?*Ow@oV({65mqa z>Kc!*7ylX!E`Ynv2xr8*Mx;AQLSfLsSe=hRE9Be{f=IP+{Gf4R4QIItmLYl2^54JN=f zo++=u#Rim%9(v$xGiw;;Vt<(izWcYLp(vGPfN_ZB(D!W6ZH6X<#kMV04zAkiC*a^U zacyIiQ^Z9l#*7F_@vL_PfL>iWx-n59(1uK49wTe6oK*0G&AF#Z$cbtBp{yXar_UNj z1$5_>{N=Z*^8d&>T-=EenB_)QQQxM;HZu@lTJ)HKFfwXca!VrBDoj}uOd@acWJz$1 zLQ8twj3ag@V>3%JdrAkNE!7s6`$cCA51`z#t`!fAiSlc#u2)+~Bm3&z3J$~Z%C7X| zb1&6B7`umyjufycK@9~Lr48k|2f>wZ^X#pJk5)-(o_G{6vPtS{I`=J5UhVedoK>PR zWIt-zNrzNH__NRQ4rvB*)9zbJA5_aH_ASnN7a z%A~;Sgy;o&->$=oU>8|nsVgL`r;LYL4LHCvIV|F~HiN}rStsVUP-=^Tvw;2x_Hkb4 zrNYP#K}H|}g#dp4WWqU;n>G-g4IJr64hLEa4lp3a!f=o7Y|box*w(XXsbqnyRYB9C z45JNn?IgEVxg@I93n$be8mGZ07+dwceS*;_q{hE-t0BmGfPfeQ+z9gWce>T?4o0St z&|z_1FJWG%`X_!3ctXMuN9_>}`2cE-(Ndezs56qs3@tuNWvx}@XuQ-2>Pk@Mv2OLo zl*K@p>#ohM+1>5ezXmA3-;SL(QkRSCbw7_aTdSeHlPM;A@*^35z6bw)0Qv@?ug6(b z&&9S|J1E0?-5tZmSOd**^%p_X;LNx}=`2R?$rCF1)6P5BM*^iTef0ff`8lZcSCBVV zMzanAvJglXeM^6~8{6u+zP4%@x-1k0>hnA{{4G7~^ax$aiyDT|?{v@BP2 zfSkF`YB@Fx{Ukw|LH|$s;y?|PJcTmI2XO@xpWqsY6hRrr+FHk2e`Sfgc0z7DwZ8Az zw^yiHQdV5uLBV+>hXBM;uNs+{w=yl&^gao}ZM|2jtW#3743$JU$d)ADel~$PUDcU z^S5;w)u}B7>A&$WMzm2R(`jM<>V=NcLbo#5Q46IjQ3imSafFVu^T2O zaYDU?lBu3hCIVaqe)%phVxk|+!xGE>&_9h|e-Z%x=d&nz-f$yC;o1nKIvT9SQ)sKz zN7IRs-W)8EfExyGKh6ph2{o<}FGK&H?B0-C3tR*{=;`8yp}pRrecI=t-436T`;zOG zx*$R<(qzig$l0|5ggVH=8}NgM@yVQZE+}L$HqBSW76C+rBD3AzZXF*+-dacAS)WJV za*LX~axOi7LZhr&>4c3Xt%49}<$44c>h`a7$M-nE2q9Kbj34mXJp(S#;M0>LM3oD@ zR?=_uS8Z=O#R>z|u=Wvq-sch920~@-b#l}|FMGYTZ8z`e;K}}8uSZH_2_vXmE@6=6 zC?jsAa}->9s32~ZGfa|D+*1dJ1rtSyu8{-kpjRgEqlH4uD%HtJ@Um$)!zm2OT_-a# zxHRA3$}&1==vC2Z0ZSs@Fn-rOetTW=2@RW65Jm6BEVYIc4dqzLIcbH1(=bX>;)BHM zCdme~x3!P9zE^lY4_3tkxM;4Oq&x&#ZH>-4>7#w-=Ta`uS5YocgiOWvp*oAsPtW$l zx3hOmAg)`o? znq9Z^&GU=ht^*$012PoGZIZ2{g%vt=r64~Dn*whbMx0Y+H%S4i8s|IGZZ#rA$d47a3LwMmTKt`&M@*oyyIia{s~68MuHeJWNsNuG zGD&@WOch?i%lu+@*&&D|?tKqgxJE`me=aYA3;V~HN(W`ZVX$*?@$zt&Qcy`mg@*q` zk6-=W$5UwFNE7Y?wIiHLijg`sL!2y6W(ApE8Y*MR5ar6@H8OsIwvU$LRQ-^Z^k=3> zxvbxU_BDxA8Y_n;VE~)*k-8sL)Q)wd%uCE`J%USTw;1`POb7bwkpm0&EW?pX;XDXs zQ6ra8p|DK-*l=Eb<9a$a1nKGg+~DsxT?hb%*PR%hVy5$NdY_ausNqQr6?$#OD(`Pu8q0 zms!7eU|BYw_(sUC_amq8e1V4%<%`5P+w0l#$xoxx_hijO_x>bo(w+cZhyDh$ZOx;y zpLF99?WJK$K64GzaLw9LOF#|6bR9g9jV9!4CVjFL#578|WD5;3Ga@v^Mlj z*Km((RxH!^*x64!Gyn_@07C=7KV${|;kt-lEQB{bL#GfA4y(vSgcqlo^!IXjJ6%_o!=De<}p|$sS_N+dc|= z-MG*g5158_cf2@ip$`Mz-3ra*6+PM~2{gTP_3bXK`CdKkUvgk>cRlW~&s`3mubPsi zL58S3mXMik1z$j;7gxhdYzad1Q>jw~6==;E!)#;x^DHalw z>^htz(2q8eMdc`g8Nd&E8#i$VNq^d4f;}F~5|!hftS~ z;Ru;<9wQf=r}hpyuG3x_AJ45L;-TsHgU({8|J}Fgdbh=Hzo%=z+bdA?yntQ=D5pli zzC{umZX+dy(}r2}sj@sUK;17(ij#C?KMb`s54B#mJ9O?0V5wXsrCFVjkA(W;dc3^N z+0KFWq?ZLf9_WEe_Q2Fg!qk~N+ynoB#+=Y+rbB-P7?3s+)!Y)?!x#$fioG9)(Y)T# z-0K#K=4d85Fh#3^cYBbjMq!Dpg9`0TzM$OQoFwPpGz$iUKfmJs8a z>bpP|>8By--O~mBvy|0$veGl)wjyP1_m6W|CM>w?Bcz#Z3S&yZzD9 zM6x0bu-SB02pu7@SJaJ`eqLz>^g5mV{&5xb@^w>MPEIycJ8vVqn|U6c2AID&iqAkO zc<}GPdN&XX20}q^^OmFD6AJvAKIO{wds3#bX#`UCtK^0vE$*f;{X4012Jlp&n>Bzi zg~qcyA@3y-GK~zW9W`eV?ait#H6*EAkm=xx)Q+%t!QWT!7fFGvcL$gPrd0{RRNtBf z7?7~8=5&F=X#rXokYb85-u9_b_omI~Vx|9?6dl|M&<+Wg+ChEENwwXjtd zBCE9_bK~xo1M<(b?vq9oJ;Z3*`elNwJe;B=#0m!H?JrOiSxR;o#@%|yU4JPI+yr9{ zoZZUG2#*hdn)+5Jas!#EN9iKhT=EyK^g^0(A^BnS2j;)h%=uxr? zI`W4ImX}l!*VvY{K+k4`Q0Sm7-GXCdfUUqMmZG^IBLH}2K=i}v3pzQhezWjFZ;=RQ<|Ib9jfO}ibT?4-ZIiiOxe z%il14n0QRzx-W~M)$@)ec0`7^>{QBkQDDSCnv782LL#u9i^A-=Z)1PED^o{3FX@-W zkOjqthHf{81*8em5hUCxxIEICT|$M{2->}Ynu7Th$|iDtQ*OSeMfB@+!g;UEo z$&|Qsj^Yk-2_napEmML1+%nSXsxlH3g=`rqI-4Gc(P?yete~89ei$C??VleVA06(i z)BWl3>CyR7yl2W%>n45CdRTeD-{epa}O-l%zfd` zN))*NpDgM=%gs^Cn>3-BCuEM z$x`HY?t)mL4arb)GNjdF=gq~pyCeLLq*!KmzGR)9zYsdXU> zwIO<>pAl)5Sh%!=-O(y<-<5bnQY4J{?)KqZ5uVVr}0Nw6tT^?$6sF|fyt zvms1JDwZ=Yir#k=?v_;^{Rl(doET`bkG1xF;uLgai75e#>klPG(SYC?)&TAbtp7}} z5FS^sC{-QjV}W!x&x{6);5-mw{$PRPNIl|9CWa5(uiKV#qCJoWqdz(DgZf7FuYrif zo7jK;%fE35=$t$Vwl~7u%%g?}bNS+1CPj_lVKr?jC9`5gpuK*C!FN}`XU!eZ21>Ad z@!RK5N0Q@A(?!3^#e$tG;lhI*dLp=~hiO!&9Q;C0Lo&-qQr4f_yR@l;J|0Qjc(G>l zMeg8enI>7-N%dRvkbWkKj|MBAcQ3~#TA{$kbiIW(;3+|}Xh|o=24-S|8zO`|z6>?w zWX+|2riOfmRKmJ%@O&dT_~}fKb>HCWnuT)s20Lm?U+xyyugC(oc-*I3T)!sE@#l%o ztY5O^bThInk3+ip2hmj;NLLU3{a5b>($zq^+W4FNR7n1~_oS;X6oU+2Vg=5slx;@K z(L@>Uv(?KdXS||GrC}9j%37q>YE3zyrB$badD1(Q$#$1fJEF7xjN6ebrDMJg*bb@* zVRi`vEc#LD(b(lvxNOK9kKzzrWD_dQ?(ZK26Vo20pK*aQmOK0BzUN%JxDE-mV*z{z zm%-dQJaU$D;!lk4T!(-v^Y{jMA)Vz#Qe7irfPckXQ{pz81VpQO47!Zu^+iBXsZvRG z)L%HH8+sCamnqv7)Pb#-3ynDm`PPxmk{*E=u!Oa5BD zpAh)AxgDfQ_cgl8No?UiQ%NHlkYa1dvJI7%K~#KLR5?}!;Ead_2{PNx)2qwZ-~M5@ z;b@^s3z-A%f0LA8$2v@bHBW&)bIq3SFFdgC8A#;$f*^&F0Lu-CN}xdJy1(W3`# zOedZD5_5<2;X2iphk^U)1Gn$gv_k!*)>}UK;L-TUE zW-It!53BT=2Ya8nXkh)Ynh?D6fp{tjX@3|)5K)BPl_4_h_Bs0K0uhq#auL`J`cF=uhjwG|8$G#z1ojY^03OOE+44p{UVK5n4MnbTvlK zd&(Vjdh3`n8~#%_t&wdpbu*}e?V;+rVHu*7QkN0g@7Mjx*RO(u%&12qWPm^99Ls~u zT(khFakn#yazHSpK`1;GnRsd~_ChElT)p@P|Au84s&gPm z#m@?O*f;B6d)F+_C6+PMRVlz$eeyJBFm9(N@x!v__itb<-@hBPB{q2dbUL z6h&Z|GC{|H+46{CASw++rGcolow&tGPl-y!{lPR|W~n)syPm{ekFg$k&QhKSvJE@0 z-&{WBGOpgQu?1tElqItw?xzKfxc|cs@t2p!)6Fqwm=(f zSTS)g#EuonET6eJ$hCO_(IP1FNsT>cI}PFK)pwzPHl-7NJXOpSFf?YkM{LaIMijXx zi*y>$98$6F&>wE>CPG;hNnCWLRz6fmAi-tMO(mX}xOFZM4l#z3&y1@&{Me-|7N-`V zoSF@__zkQYJ*J8IB*wc7n65m}igR50#EIa{xfYvUA|0&4?*ZmXI*!H2_U#3+H(zp{&LxhB+ z+KJ3dB1c6IbV1AwGgv4+&qmnTr0wFYxc%P|05hMFfvx)NfBwt=dI$m$g4lF2Pb!_0 zJm@U{_JB`63BJz2+;XO$yVwhz^MWdD$1NhpXmStq(UYS#UuT%1>z$!JCW4JbsMnS8 z`=ws9(s#mFQmzAbsehp9_mJyH=-ybq1>rQIy?BWsZOp}$PILo6VCV?Wix{hu2-+A~ z24a1N zQdSc=h4}ILi)XK>wk6$w5CsOwDiAR)NNO0A3rJAFnMt(H%gkv#_>+tsaA9pieF5C? zx>hOR>aDJ=Vg(fO=Paj5MMOW?GR4&(W6G*qG%t=cKuJb{fOTsd1CIv0?+VKzK;eew z-LVpg^7NpE0yL2hSGY*9mO*KtQY+L{F7#3K{o?vUnZlgw2kc4R_TMmBhdG4Fd~Fj* zi;7-C{s15c7F|%-n%iECN&&8EPsO*?V-j-*B-0T{)rYS_R>FNgYK-bY(@m)^pOluhTijcLrG^S=?o>EZOe~Ods@Tf{;9jl6t-?8E-WfWRbePe6laU?-2v~4H!Yr=2S+6;y zw{JAAgcQ!q&e{zr>EY#nVcS;Lm!c7LDVel)~ZU?9t?EqM;< z=q1xDFtde!iAijpJ!Gw2yFDPJRAgoZbt?OJeH9}?gmdRN$hab!oh#p8`~>X(i)W+Y z)sIy;3NH0)(}%(DeSrD&hdiGFv6|^`?vS8-5St>uJK%Hu;9#JQf;aCHoemWvJ_H=$ z&+6%QSdD1g0n`Agj4%b6I}Pc${#C}F^uRt2(a~vXUFFWfN+5bDHmLc$bn7PxC!1iei4~WT zHyg}g;Oop8Wj*z$!YESkq#I+}F;7r#H|3FUJiTEwE{uJ+fgDOp=qyR|mal3WMhSJW zvJhwtZ?!HPuZWG5#c$p!)TY))12vCC=;es{rVsWOh6MK;;AJ5ln_6los>~B4!IbWe z>T7@j=%53jp6J(z+>cV+y;B>eyR{>>2+9zuk#zpNCVk-uOl=A+yoHEhZHeHx~vKd@amY}O!y?*RL> zNUDYlFTR5r$ivg}!+e|}x*T6??< zEl5sIG68X^h1H&$_^3I5X(W#wAmZwF7BYBH4bCY!e#xy~T+A+3mGv%J7eZwV`!jU- zNPSR0LkStF2#Z;dl`dhraRtL1mS1Fz4t2Pk~2 z93hsw)VO62)4m2%j#_&7zNNC;&4M}WH?R^KZZ9=?i|l|WZRtet4atI?!s`2Be{xQC zed&*XeuJFsi*H^sskzE)9eEa|AysqcQ7DL;>F-daY#awWQuU>pYG(Ms7@f%*&>zC1 z4ou^95A*)gF;#P@z*ysx%| zCJg9$7>4T|hW+9kUL~ytQ0AqsL?{^>i~+9Bq6$W$9yt(+)u;IPo41&Dk<_OTAU7QHDL&;=mhEs@tLPvL)V~-jEwMyIsO388h_N!?}sXx zBRMD70r~|*sUJZNHU#ax;3_e<6J*MI!%=Us{}e{82Z-b^VpS~@8%hij8k%~y~R-TA?xR6vK0%P3ZU>E-&0pBghSSR%MiXs>X&yrbEg{dowAO}bvu>GP00jN(;Xw7aU4Y3aWh)mhe6z%jB zdznmC^dZtG`6kS`pt2>8>u93`>iNY#Z^?65vrx{fKVRsl@Mkp%t`xSVehA(Gvoo8~ zjQXAZQLjUdA+;q>Y|T0|^u#Xp*846m;^3;v(F*VBwF;}?>RPF7nNe$&{h;UaJTGQC zII)js`yR`hxvBJ6o?hp939|@R;qUNYcE0^{O;qY~3m?{+iOo-6TwUP0gH1<`6=sd+ z>102z`3`j@)(UlebWkpX#d~BgORgKT z4*4<>O`=C8>3jIbW*LaV-Xv5_(m%LPxw~mly}S1$vz0V%d$-Cy zR@ej}9p+Avowt4}>it6h6aK0)3$~g{he3c~CAe8uH{Qsa_RJ$gHoECtgP-W7<33PY zdP|t7DG{ObfTS3aYI?0lo>$tR*qt8WV{tR+9Rtir{_nuja>k|nd&2s%weBt@1> zJEq|aq!p=$Qkqk#?U6MsRQjaAfHP0J;nAvzyA5q$2M( zIA@Zg`PACi&(n>pA(4)u68&G;bj=#->GaZY5UOE9L$kHpcJyrvtugOuta%7`nk5DM zTG68afJc3w$NR^|Wi5Z6U75s6#r$)TNqirv^XXX}9Zt@U&yS8Lr$;C1`0Q|hqV|sW z; z&GrpCu#v{AIs`yWarr36R7zlTYHd>lSel$0i;5aUr4IOPIOT?Ac^eVh}fwlb_Vt$j6(4mdJ4EaxyjYsCmNOBN7(HCxm^i%dr@?q>!+^g zIW`XHqzl?vY+l8MY4iT1E;Ve2zf}12WC@xG^7uOE*qK=v9vNtJ8`8duu1Lr%3Kt;{ zIM^e~DH<~PBX-$(1!YDdJzqiW{Ta!h1%?HGFe&TwMYgEs&N#G0qq*E z_gDN4l9BX6$W~I4rcUUcG<>kBwNV}p?Gb7DMX@aEzIt1iK0yiH{$TwsD&j@zQ|Cq1 z*l4MFt+lQr9B0 z)$}#3y1s9!?`@*cjfg}e!D6z;xRskYspnTJiqj?Wbo4GQB<~E0Gph=0e}<8~-jUpA ze!9)6T+1=)=)o$UA^mp-#PlY>-__O=g)r*aRSCRKmgP30AK57lkT|^)VRP4madUI4 zaCIE91yC1#o)tc^ki=`IX*o(n(QC$AI0h*KHEDvJv$E1)KNS+k5BfFCufJJ885N-;Nd!`ScVvR2eqxc=zCjV@P7YZdf5|%IYN+_-g9U~zozK7Pcu&cI+GsV}C z=NgRPY9f^_hb(i*GKVblH~FJ2MHRAE9kY znhE!9k6!VPwqlI+Iz?-YG1L4e29hgxp-@gB`ex(?8h_A%j@526hEU!0fe72;tMTp6 z;~1TPLmMm;x5h{UQ?EQ}A;ZYMxO_n}am(aahH?7o74RJ`VL@4XYd}It>j%oEd_Iw)6Dr z^7XfWKuHLpC1!OJ_Ycnc?}4)IqrPAL$g5Xp9D39MuZLZYtUvChb-O(PTDH*H(Qev6 zq({LA1kFIGg;M?Im(Z?muKx$6#jZ1w;rI3p%+;yA;Tm_R_NS6!{p4^=^?-4Vl)RAn z*5foZjOz{M^@qVTSBP-u_A3aFmB@E+nSoTC3*wQ>zu_yyioniiGR9Dz*CFt~pljRu zT$?WgtV@**Bb>*~Tw>OECv`Mirq(LrQrwI0Fr@qs{{4{h4=I0-H~hmMr~E91O?0w4 zTUKMPRBFm=T?JR75*Z@^f2XVYI5g|MZ3NOODL#E`A;M7$ay5 zO7$@A0*oLi#|{H_&4s7amC@;$7o8rBb>t4==w@Tlqu_ZWW4uQTJHud_GztEODL7+= zb{u3z;mAW((^QSI>1`xF)RtddO;{|G05u*_@STdmavJDCT!tX^94RFGiVGAyJtpQw z4{=a>P9Ab0$m67z8enCHMVqzhd0CNEHn&ZP);vQnrFyYbhN_dt5SVVgOC*3|$II=% zXR26MScb)buAE?U9jS219kG*A&6(fYc>g0_u+Zr5Jse2L`tRsBU{NHa+$qp^^vhEY zQ7S-${t=#%b$D-NTQ(tws=px+hXD;JqJ}{m4GtFrV;TE03^K3;+L1wWtC2M*v;yW& zf@hZ3;H13-Xv{KbDBD`1IF{++L4*vUH?OUYz`NUzH~C*`YP+1I^v}owfJWurimoHD zmVkJqJ_KZVH>4p6TsGXo(6$D}@=c07q;^AUH>7sIrPS`I$Els*8Mbyf?EKM7V5;}& zYut7`!9Vzu-JJAt=$5eEwr(NzUc`x^Xi2YzI>k16RTqsQ{YhZ=lO^>PcFT2aNU^`5 z3Z>I<^r2;IhnUxVqkc)3zShvI^a7&uO>PJIV0QBBk?}D01eZna&quqa*8*+__I4 zG~$4?XCm9$HY~lk>o;y|VWJb4rT=uzG-yE0ubV}(kHMTm}DbTb5`-s+{+F^1EJh%=TLj-Lf_le}Yfmtjoi8v6gFu(l;@BN$S7rmP_+l{gw^}5#Y!3r}O$e6&QUCbwa zYW5icHA}8dKxs~>k(@2xSW7$$?F^K`5ji(qeoqHeKxIGGM+FpPAY{35rQ-&>sVTWC}24 zNosd$tRK%9C=Hv(?T>*&LMJzF&Nw_Kb@>I*{QLOv-BA9gSGBOx3t3hx(oQ3jOT8uv z0K7Fu4XecX&e@UMTjv>%}uQA&qbL6cMOp&hEN zx#!hO2Eh2izaIeO0Wj`yh<4m>z_^h`H;i+;YM@RPD75y2+&RzeN}1Wx4yAX{BAL{c z(RW?oipO@!*yU^r!y#@c?77<}3A?^z_;U<-xZV}V^Ds#<0VZ#{9P{zpkLm5l#dV&k z5f@*D39!z5t=cN#0G?x!*sp0T2%8zVy^-w;Df>NLdJTp)(g`_iljvHZ^vVtcND#|W zTp*(+Z1*s{daQBSRtzu$Bm8JLu>1`4IIovstu-)9$a9|Ky)26)Hk68=1g|@`b$8k?lZ2OILubO}jY{*yLb1PQ#KxM$hw|u9 z!OrW;UG5yc!%h*jAH4(&u*o{*-VeRaXVC27J%ZJDaStizgS|ETK=^W3Pn$37-g?iS z9wSRWYeYE>%uB^c#=NDnLU38dtRL46fLi*v&#X|Y0`|2arj7z>lP*N#&^Ei6C+XY)D9P8XyPVG{UxexbcG$=YJ2m zhd#u}Slz%-C#gjLr@HjOLf-&V;o z9_)+Bdvi8sfE)++eP{23Z1K*ZJZVqSIaj(D86h9pZHITdiPh%I+Tpp11xucIP7v@{ z;y7X86h(QVQ(f+WBdk>?yB-W|m4nM*NB&`Cnwd%=ClRI4N>uJLC7zp7iCw@wPl^bE z35o~n-`ynX?JqMOpI*Ltc?pdCCSRSQIx1KgDT>>ViyV*Oi(I;NUMgy0kE4Mi;*gQ5p1Nl;L|E{)QBQ&?Irk5 z*CM$};O1aY3f!DM*&lmK-sAXFR?P>2p=T|}pXO+KtThQNbbK9i_5L~pk^CEK8Ic!7 zE0YkbCB}}mcr>M|rA_Nb+n>APeKp!Bzs5ii;(8-KGn_-s@k2oaGq@mH(UF8R(kTZzO0J{?MayUs<*~X7YEgm8W zOhXsv5>DU%Rt{k009I}%E_2p*W0#g=MJs|a78bFLbI`XJ>Rl2X;dN9n7nNk;Tlo^x z9jRAM`?vPCqN7e3JCGQGPv0p;u+TR+W}Ex1&bH2HW$CC*SB%>3AzK2`79j2&FpaCp zua8*S`iI@SMr|wPy=&YC&Kouo7i-u&`c4*P+#>j4`VqPg2FYi`xJT!+2%6f7W>r#< zv_>>H`Yf55W4klz4A%oHzvg+=Ytl|@9<_-)-b`|1t(l8*Kn|H|4ZKL#UpN9&*pd)+ zAXa=}SI>ev0Io%U{#$NS;NE~a>IW??0Z7{Ai%T5DbnRiGl5`iToDHF5E081a5c3t| zj_blsYqhqmhw`z@(6}y-i`)1#<=+RwM z(U6AQ5EIsgspiqz$owtQ?0771zT$XyK3k>I8192nZWW}jc(^Q z8)wMN(DqzAec5Qlm)AO?yDcmJsZi6pg#TpNHYC@N=2P!o!|~@){t(1k0dbvq5ZA#N zc<$@6VmpI6mD-Q@fCtH4d76w1kN06suc`~(u03LAW8$G)Z=Jp zyG)#x)iWm{pzI~N<~WF`tSCKTTYG;=B>jg*qnD{dnALAUg4R6RdW{6#bF@hrF&~3m z!+^t493usiTUtsFe)0RdkqAn-jqT(wrTQF28;s)U03(7^Kyk|RecXBR?A2>a5N(1` zHg>m1D)i%r^Y8rr)yw_~?QHuT={3r8&pF~L6k?3J-r2!n?|o*&qR1yH+5EO5?`Cm$K<+(olMfxxf7XT1UIr1o3;rSt$X0sx-<8^=|kcr*h zX&zaPw7X$SgeZ0LDRR$+ktdZ%*}&JgHDSBS z7Ki-@y9m$H15OWQMn7@NyPUttG%f45oJ;H9&yuX^Nz%x5chMp`W1lGI0M!X05=hrx_-; zaJ|RIPysJt7WvB!JxU}WnlFr`{~K{r^kjqw#TVd%B_mi4D!o(NZJ$1dPis66bxwv> zi$KJh!y)ZyJbKn0EB5xy^woI5N(HC=J%<;3zpsu}xHmc53r|%%iT0wSX}llqogSYZ zPgHaiAD*6{?oCV!>AG=)Bft#`rZ6P2Q`zd`$31#K)3c5XYZb?@I3H4Lr1ch` z!_hkpu~*GC_2B(-VWyGz&+D{G#+8EeKqnCDc%XQ(#TU@Kp{pfnfC?V``vEE#pn@KU zQav|tYc_U!i6Yk$*J~^3xXh9*lx*qu=h9W79|0Jue@K`a$gOd+hnU2QV;e8NYT zT8e3gc^Y0nMIE5cZ&(|zLmgi)@&u=rf#3W&#f0rt>K3#DCG?d>>;lbd83CcT>%x@l zC!w{(TGD;pw~6|has2+?$~gXTiMG;4)K31fw3S?t`PoWA`}>crtpp|?dOrNrnJleQ zPHCMFX(Iwu-h=pjB_)_}UoHDvQ)S7Uss|$FzBwNg1Ut46?0x6!gVdDHgFiNq-p(1) zy|f(PrKohai8bcSDk`af`&ukYZXX@i_Fz#U~m86N$?^?pU`BMAr41}CeI?{&TA1fRvbs0T1@L7|kRh5j8mzA4GCBNb`+5b?1;Q8J zQ$Qw^sg2B`Ue|=jG`;on zSPQGKk&lhgwKvXXv_NC1l=RZ#J3(=aVjTW$bDAN>0P z3?0DG-oi=eeHTh{QAi^`!F`gEMpuhf)SC;zVu-j7xq%_oO2>xZTs(D~mR<{CRo9b` z-AK`3$*gszcIynzB8z)4k|zB zX;T%{Eu<$-D1R|xt|1;7f&_bXIJZ4|@ax}x{rRGf>g?B_fBpND;3{dI-a8Gjle}NF zomEjD@;WSLs>Ql$RhCOCVhC>qe%c(Y@^pu|r#9ZSkv>B2cuU(pnS0G!f@$S*(oj@H@;a_T#rJMde zUK-3PjkX2e1AzH_K30~7jB>daEAMrM`b8GnQr-v&Vq{JjBE6 zXU4~8kvu^0C`pK*39>+Pa?{N{2CC=)XbgbH0BHQS0F7Sj^f1X>E!$p7NY!F$R&i~t zuK&bFjFC#~WE>^1-j%klR9or@p%oB{Va|$fTru_XHYhZ3PL|i?Q&IznxxxlXej&oj zktK$^VjBd9*<>nXMfHBs6)QTwlI@H5`aJ>q44;UYs8Er*p;9P^WR!HF-QkCYa)o3b zOIpR1IDch+Cvvx(((N0*$353zRK1_hy3M3h|8K>ai zm>OdioSh-jFy*3;i@ZK0F7gk^{7EXs?sMkyhVi}L@!c=+pet;$6CjvPFAcQ?T2nE( z1W*gD&mb6L=$0u6@sg46(pLnxX_S}N#Hd|W(nm}PM>cpK`t&ya3iwEprsEkV(WK-i zM?NbQ$^Yi($XPe;9B4-ZBb8qq=l}Dfr^ix7DjeD|cSHFV5 z`{wG;?qEw#lA0xt$_IK=HX3EVIV7x6s@&~-Z(Wn2**PozcCeC-e=OMeH~V|z9Kv8= zeC0_TZG_;vzZbj;1!B1J9(_9U;a&9J^G(d|FG}x4aP>e(j?fUV_Y?wK87{D>>Mm|R zdLx?_`suvOiyy(>CX2%&c8GT~2-Jt00p8Kb*k;A;|JH}rn>wCr6f_0HNO?w4xN4=^ zq3h`4@RhESS|!w z`Z80>IJVMdi6K_leXg3x5E?M492o*sc3;01Iu4Bnq!v$G5bMhgcg9d+z&2i zW+cF};jzhTsp`S%CXg@eBJm$z`YZuxiao?N`Fowo!W1xC0k6uwIE*2dklakG&`)wLSh&m3TtbX>WDdmDKxtIpQc*C zqA*|6K^wg2E4)*)&ou9tTFxRc>&EPE2hNJU8`1UcN4>l4!UPhiF1ND~Z$)3!>nkDH zyA5N*iq9L04=6+sn_d-`l z4?7O&EwosPVT$KSs;icrhPAQ(Zv8_ULF8rTvmX3l&<7N>gtntR%JshxTp>l*NEQ0H z8EyNidQZYPY&VFbQ)M%x%NEq)TeI&WtftMb^vA-c%*$R$ZIBJgOepmiOXF0`%0VWP zzPS3+l~wbzNDMV!TigYz%!-A2Tkjr_cRqlQlpo=#-2M*)m58l{(AKKwWTg?|QPE(+ zVtGDeyR30c&D}Bb@}ui4hrcPju_i(#F?%+ZMRi4fP-PRLs&brSWwSLrV>s1`CztvW zC&bcsZAXvrFrUiTY}?zhVO>G*I(9HDU|AY9U{y{vZt941d^m zxr3`xmP{yODIQQ#X_jBQ3QPxURMP_;$c~u+XhzAE1pECU^Yo=xo_CByXBcL8}4%nmX`LNb8 zMm2i)rD(ta{VlY zg3+N5_c%o)ow$H3cEWpy>vC(?Fo*|C;|zxxjBdMubuF3rH2)vky)!ExpEgd3pE6LV zJ3oBXhJj1kI=FZOr0EQ!r{s1sIa+2*81EKK3aT z76ml~ZhFo6@bL!nw+=*Ygu$wCU~q9x4z3GS?Gt@bjE#udLGWf}qTWWbV+mj0^YVHQ zldLLoSmbf)u^LpXeY0CTfB-tZYy(#;tdV}U=1hA1Z{m;cnS@i|U`5xEW)jnj-v@U> z-|-@viyp#c%#SlYb6fK`+657sll(;dPK53U!+;7s1_TlGaJ$xn6w>(=w&5>{tqJ3M zk{@Ly0nQ^=rr73;#s=+cZ&33AA=Ue=^5dNjB4t+*vm11Hxqolfs)MG0q0b6B@)%4YTV)rv zG3RHnt$iA`=|SziaQ5KJEvw?}eoFdSBetnwg?5|%#xMKHr6RL#yY5fB)6Hq1AI}_1yTI{IuQ%SmpZM>nYm|F#A{8P5uG3MjU&A?7in? z=uHcqPBF2Aa{~D*erTe~JjojT$UAnxc^-p;WiSb&A5|8Q^>#d-7T6mXFWCx(xu29> z&fZmc-W`;Zrfohkf`U+)qpO8?@A8%3fhPU5Gm^d%z|iymGEdd{3UL0VrYWhpcA8*IBm z0t+S-4d@2Y8h69g!;2qG6Rfd`_9+R;VdhQQNX3U){e=Xq#{E^7r6Lem0Eyb>^y;Baeq=ZnRli zF_jgW)mz6m^JV)4=(B`gG%Ekim!28(xc9IQRgS|&DJR;%ET`%$E$gbT3r-ol5FL~y zc2E{-2JSex2g!y_)_1#;y*VVZLn1pQvRfLi_g}QgqTU>E%c|Q*1oX_11~x^hEJzHb zCyV}Nl~JN4=oce5Uv?QOvwx{cl(L}#D3eiGU+c`!I(UmKR~-!bvL&{0?L57D4Vx~q zG!4LSR$QiS3jI4~YO72Dj5^G0w6+-;+4}_L9Fw~PvrGXVSv5NuTzJkvg7r}`6w|)@ z@@{!f-D_bbGfBN^h%u}6VI+3Av)fxrctBFc1E=tU+Js0;xdBy~?gI?WtqSMT{Jwzk zonQ_}a6m^}k4{BR(@+{3-6%63!14t+^zB2_$KBt1s^7l#6Q$>xO8#EOt7k)42^d(o znZVwGRIMF0m1lCL>}G2Yv|UFJcUw;wLyrd@GkjPdtxhU%?MV6!tOqw5+DbrHT`veeC&T9P|@=eZTrH^$I^%Zr$Fvi$nis-fA|^yVdf$F;(-)<+$f zc0eoN0kE>|-z13Hb>Go;@Cj7HPnS??c3At&2#8ix0hf+jM-nB3jJ2qe9?KOTwpV+T z;8sX|-zIVj{jm$v!l`SbA$YAiv|9vvm@a$&16K9m-w#;TfK~N5x9No<$(d8-&x%i@tJ0S!b(?azg;CA#}q^lL_q6_U@JuVLP_D6 zP}-IM5G!m|!Vh4$WSa1HycjLBFn#g5qF+PAklk9s)h%CP@}1CEZfnQ9{7IVj&nNE)pn<*F-c*hqjn6k4y*ZPaRe&n8)MJ773PKI4_#J-VaqWr>&5$MDJ@5 z;12U+&GX~9SM%eZ@tqN#Z?C?pBm23@(Ml2+pn!^{*pZ{UKf4nf2YK2joIY;33xO13 zSYftIfsK{4nBPjX5nS1*w2w9MZ))I^2X9_pNsqS!{wx0!JX3Rh=!z$DJ`FC5T>n4( zBQFhkbm!S+e%VQE+ve)ZN^{ABbHBQBUgEo9|(x@XxLXI zQm%}m9PM{h3gwC@v*5iuTz#qc(gQhNuO5hLI_w~CY(yXhN$Bf-CTq4Q0A+`>)4kSi zc7Gj|&S5>E`U9#zp!!=H+#YQWs^8p;Z;WYR8GQHp1qHuxQt-O(ftCz6EHNY#8KCGw zf{(#*VgIu%{ciCPlJC>8i2*XAYjj0|z(YTh-gO;qv(F_C*&gHVhL3qS%W+u;W0TD& zOkXpvzGNGWobr{bQFJt60WZWn3`y7&f7tpD=)?8<VgeYYRqf|9Cr zJog;hIsnbl%IAT!jzZ}#slp>Q3lmVVK+BPwQsuShxXC&-*jb1Tfm=X_-umg+XZ(KY zv_g?RG_wJHni#6CAhRCwKhYpLf!@^j$vjMry--!D1mstP{k>qGWGFncOi%_!>Pr-# z+~?0O`{>~?B-cD7`-NaPb_8CFZDfH$v8z`_D^xFO3oRV4NvdnQe?*2K_ayk%3H7zU z26%D>UUi5i?_j?V)^4JtQo9CmUW8@&E-zy7p{Dg;mjD;BDwoUN?@GA{RGjp8x4|ZS z?UQ9&;Oy34fr0`WuL0;{DaiCu|JOD%T@kBsq-6&Cawy;=yiJmzX3TM&rl zVE~Q}b_8^t&AM>w-G+*xho5sA0!xZ2c&^FrG^sWY82Y>hmE>S&u78l;&z&0>0*CtR zZjo93P}{*MQ98)K!XCtv>byrdm}EEI1aEnACbP;Fab>93J_6F~TSgnm09bm~X7sD< z)xr;D#c1%bX03V6I_dA4MJb;iDS1>Cd9u7!_7fI1Y~lj~qotz6$}6!U`tY#6Q?UTJ zZr4^T;GL6{yZYb)xLwa`%;?iXiDgE`Y0fJ3Orf2gWagQd**d@?4HF7P@IKnd{6S}$ z*ExnEd?#ILF7+~s>uizUn}%Ucah$$Q;VrMCA3Ztk?-afZv}t;qrk-@i+!OEcggdxA z&ILM@P1561Z&Goc;6}|Vu1#|cCrG1{(Hn3+2#HzpBJ~a1Q|7sZlvODA&5>ue$|$Ks zGDptWJ+C_(C3UaY!+xp7vkXuiP$HFZK$>j~$wa2V!YYDhfV$z`h&NhNI-}J&2b>yp5_Fz& z@p{+HMR^#UXinZ|=w{l;Fzz`cU>L^3Fuu<)?lntbT{WRlVkgXIRX@!0n6Q@^wKVOV z3A;7LeF-wcMES6YuIorSFGw`whJ~7;GMdFT^;US0IfU#+{N~Qd!HpTqKQASM;aZ?K zYUhvot9_dB5ayQ?D`#-S_YZg8_q{&9J)|Dwom zD3Y?)BEnCg*@O&7&)7AUs!?f0+THEQ$d=lcbulkRz1y+QonINkokyF7J+3IPvgR|R zc_qb|o1{BBKV46BSKqW};-`ZlPl7oNqT<7%%CQ44K_vsMJR_3^u8HUuWdgprD152& zg$7NB`$~7c;*{LWyqB{2k^Set{Obcg-Dr7x(0Tsn13o=^z-J%QVD_-PUD52fu{*~V z4i+psFpA^`m%okOCY(X9=0E(XKK$_Z-9tReA9!oqxBS9?miG^z^Cfil4cWe8^^*^b|XFGx+{ri3F=T}>MtKTOOf-_*-e+Ew1sRxhI%*5Ygu>h`ta90?<@DtJ$uD=#PLxM&jRQ z!>8T~$iRL9Sx<&chN12B!N33N-OzUWc>&qbcDl*<`?&9Ir$$#;F7+K7!|uIF=^ech z9Vk3-mcvqq+vc1;z>n5^1nk#K533j2f+_(qs~mS8f!##ZGCPsRCQy6pKgnDKJJw!o zX+~>LvqJlxE&+GNgWiQ&TV4n|?sK=Sm}yR>PC7)gXx=K}x|Sg2@(DK*5r!$Bwe(i4 z+9db`nT}h)h%DD9L~U%=UR@%H7wjy!&6W)%ti$NCC~6q^>mK+$FKF?=$KGeQ!38T? zHYMcYvUJH5>@NDO-ZU00*X|;7J_-)d6;cWbnyvaoVrhcuH)*#h$E#d>nVz4){ zre1NvhG(?X;rbu7j*H3)b}xfDNP-GDce&Jp2lkE%-CPKn&8V~2l&XC{-C?$^dA9Yu z#K$9mJbW9%-8U02L7 ziZ?ZidtICZ1KDPcjd6V*WqRdQ@0kSevE9hddkMPb&%&^w$4&k@ z1q5IQfMztbf0I;f(QJlbDT^J?sp#O>pIN733**U^nDwDSyt*;#eIK(v8H+%Boa=No zi8lpZp9Ifasqq&?u)8HG19V6t;_Q5`?k9A42b{fH;j=#gw~j#(SrMYkb`e?{0_;G; zDs=h#4!FA`9Zg4Fy6qVde{d>;CK1`U>D59n6Lsl5Mgi%qBelV%Fj^-4~7IYA4B(DluHd?&NWI!~vz8fj?X)ls0YOJXxKC?61s0 z4*VSCbUXtHDbL1nJ(l_kn@U7ZgFny-k&Yow_*mJ9FSf4})SJR|Dbb8_qHuTVO)yxy z3|D>BG#v{*I0w1D)Nrn?4F=G4$q2(cey~I0(K8sz zPl+lL2>GK#@1jGLKScRMl>eKG@=yC7<=@?gaSu5l;P_sLq&U&d{6HbVMm5r^tNTjU z|37>0(&V<0rj7m;oH?7S2vV;5#b2C-T#{{dOID4lzFHl|`08H6v!)swxslB;L$?FVFiteB=921Df_e zzHMQhBGz`jYv`NjlJwl%d+oaCMR}LmivizlI!N9{p#VWwJ@VTqCE{HjV3zfGjD33C zI}s^FlW;Q!+#;cZhwr9GEje}O#YHLM0-g0NWMQtRUt$F8%V4JgbMX~i9Z<@^E8Y9@ zVU=KOu*s@DZEv2wfwnGxfh*|;OD%BBXbLH+v3PvjF{$TykFs5%D_)_!2EsI*XgC&N zk<_W4hyi4Us0`?lyQZYLXclW}%5NbsOXfukF*o2^mc9G@>I!spO zP+CD&8jZej?(kT_CuUKQLA=RJJ_zP{Qn)qNFYg>wR!`|4NjgtWgu`>C|M()7U+(W6 zoXRlGw-%d-eV8uIufxODYJQ={-;+$WQUH$VSDzmLXtj_3`VUX9E=4f%$sRCmBQJJv zaihX2xVljfo|#ozt6yJ*L?IFP(|{2#@$~BZD=Nf-d>i&!;-{2Bz`+S!QU8Aa13Dkc zoLvv3P&7pPzx=dfvp-widp};e)ZNMH(Rpxvqnx+@)NLORzAp4;_%1JgT<6kQ;S`;$ zVTz9T?l(nW24AVL&ze}hl2>`GwELmY<0}O{ z{MCoxLZ3ar(o3h%hRoOMMJG>B4o_I);P>hSls)v!=>6*Xd*&w}ec@J^)QHcwo!|Z8dKcE# zIKkp?;hvBYXe`kOH)M-CT5(VTv$lV5;`-Hfd86XSvU{VTCcY{A_|b|(516C_z48|M zRtTOff)`~835^#X_;5pJZ1qn2`Qf>1R&SE%X0wfI^-lZw(b2hg;N77l73=`t+wO+U z*Xq6X^V7XO9lexQa8VZsN4PBXV8Bc8H+FH`H)N((?5D>?IIf)8fVugq$lvKd55Eda z*xVg`k`0-o6}#p%M{dBpzoMMN+EbudhGOK}1pvGvfQ6|#NmKP_n{Quvis*c0FY|cC zv4cMu`oEy^x?Vqcg_E)3FyZT`moL0cP@La;Oh-p4;<#CgaQ}9=tW0ro=3?mfhaTnJ zeJd6F55mpu2N&*5I_w{jKaP_u;ZAXY)u|c^<1=tlh#o~G>fA0yTeRjPwfF7^ zL6~G^5{Oz>l0|ijwLpT&P5}{qqeC)6)@E@Cg&w*X+**G=nL*XixhRfBQUAQkpr0-j zNjs=CrZsiPD}V5Wb?^kUt z%U<*=K>X`i`2YMnpg0lG{GqHsFTP_Ei+ogL zV21U=Y*FV^k7nj=i&8TRv!v{t7-u@*Apy><&txXY>|7g&$cPppm3lQ1uk@0HMpr{t z!3F}eG7%&)O47mOFPWQx<*hawn#WzuXcXwPuSy5!+ka!Z{Wtx^nu%F&KThhDm~D{U z_yg2YniE62qv6A$Z8XbkfJVMIod$YFaCPzD!*rs((CP+E3p-#kJ+07m87;sV_h^b< zG`JTk-+02(X@ln0=cXxP`%YK~X|97{fEj*>QWs;?LM5SwmU0vjLpUR7$AiP961Wl@ zDWjW=s4(p4`9)}3)wW^! z)imclp#*{D0=E& z|9t;ET!+i7y?h<3zsLYh2`EiGP8BI@cn!$#at7Topy>R+ z0K8o!D2B@)rBA6qUwo31;RioxV~k-;PlC6gqoLP9ngC@6!no<-Dq6m6S~lT1K^_s2 zzjhuR+@Rjp(c?rk(7TRC&?iB96YB)gkpmrv zHOLBsI5Mu#99=t{^pD^@fu9$A-%3`wN6l<`<_nMaJObV20{ev_5_^=>pv~_R6*csJ z;qs)I2aO1(Zb^iN8lfUDQ%}g- z10;)Y9mB0*(0)|fb4#C5s_?1)VWs7T-lCZb(cG;hQbmNNm34`WbCmKKt+ye?{dUd( zQqbGRX%ie9_#`O_2fVp@%3fMqnLv+kq}N!QLZcHt>GO+=PEMQ^zwmq5soPwLC}sfI zix4e5p*U80FPkRB2gnXlM$VLeYmR32mMrAqzyIRhwvDhco^2c9>PPr1yEe49+T%7t z>a@@?4!D}&_|5V(p30w8MQC`G#(;#!cHgbh}{_{)R@7O;=31D z*TL0gaJIKMJU->nGgk8=OuX(Y=|nVCCv+i~qe<`0LvXyp3H4fe^lRv)lN$nKf=HZN zqe`ntD{-4#gtDLFx**9Lw^Ny~&?s0>WfPg*dcM^9+rmhR)x-v_&4>@2OW>qVDUUjZ zl&s2XZkO^rZJ;I7t`YRl4qV1UPQgIHr%G#YgJwd;3K4d!N$Z{=bAz96!;%OEeon55 zw+i-sVFl@lpl&Wmf=eP7^k=PeDkIsv5 ztc)LmXNcsU+vT?6<<{$dL{)kf9pS{m2(`WZycV0XmAZGi&umgRZM;m ze4vVELSM}xPPFv)oOgkhGN2qtbOUt+q8x-k4ts?AX0{tG83< z*8e|>_x8?@qVt3EXtY0CSK|C2XkY={9AyVox2yOLviE=FOgj34iLKpt?0kus+Ih)0R4Q_h|_d7p() z3-s_5khO{65aj`5{a0d`N;thbOHqLbs(%DO0Ih_q!ZpT=7ijB~NlkjyZa@Qp(;#?p z_4ElcGcHFt>n^X>zNt*KhC`lT(W)+q z+0M9ZICpyE6Z+i>km7hK+Ul4c@HT0-O`2_!W}j2i?4ZX-EFc0*esJ9X50tZvWVc&3c?6>2!aq3uJyQiD5kf-ZCZ%#8SN}fKX2J*|jQZ{f;;5E9K;sza zNy($=*r5QlL2uoOB*;$#F0^S_GP>&zZF|AU1|UTnCl>plS2OgYCtQWY3+rzj?wuac*YRiv z{X6Yb6pJ2syJS|pWcryWY%Q5(?jAXbaL8%HC6G#m6qO~UsvG&}U;c}^RHLyXeohkS!MH}U`v#(`Zw9;JiS2_vi{4pS zq4wD7E)NR5vb<)VQ?eU(H?NEvs)_;~MYQdS1V}FU65JnjrHpe#aD+NVcyxD!>r=0D^U2}Raoe#i(z@a6%2Xc)PyJBAx#weL zrC+uKmPK(+3F%D1`#pVr1;%>u?Nj}K2Ya;VCKVbsbans!F>P8@vaBZGiZ#y9luN7+h!PEpL3Q_JuN%aePoVK{>bzXz>$mj%x^AU zHIO`8+gY*g^f`~@^~RC;P@5cXDGn@<6S@>+5Hmfe$TLssU_d2mOM(ue2{$lj1Y4fo zeyna-@o7hG%~cd!7BEVhrG7C>1j& zq6ul5OR6L^J@yFoK$So#-{|PL#sj&=j_~e7x6z4*-2nte34`w=D|lBaF~8uxCOilRXb)J#(WI#Fr+i<{#VOnaHv{oOZvs{Qf^Gj;~hF^`lju|}JAXH03Z`{iV5Hvp9 z$x66lPEt~DxztbhE-&KXO1sza=&0RN-XY!cu%}t}S)$1)LbrFRCRnh3hf27qOd~hg z*cM&7&Ak2w{?In_x=!!+sMncSZXal!_;Rc{bP}J+R^(H>!lVkyNv1o0ms_Ek|88B99~5OV4-YwM)&s!e# zK0)7k8aVs9iPRPyLega&g>hj?K~1`y6Zr%@b|}{jrK02~2eh`B{ECzoVL9n=U5^Dv z2x}rQ%iEu0A=UI?>LZ`T7S21+N)PQdBh|Vj@I0X9W8`KoC}{h{W7Z?7TfJMrDJKA4 zK%u`NQ@jhh30?Pc=(`}Q&ND7y43jCQS$_Tf1$Me!vMXM)y)HF0dPo?A-Olvfag3Ih z8rnOQfCf)T-^BNBzUMGUc3u~_ck~s=4Mf`0qAQ2hxS5l*9w#9TbUM5J z8?rwxJq=^#vCkQKD9G|=(hTY2>fWIXKT*E=ScIs%bs_eAbm8$(4-)p%p%XT&E7^P; zd`~xXW0XfrD!0QWDag(AW*+D63^Z+}*<=&!TwGng`R+gQKoxYubq)6XEAI1sDd zgtz~l`3jjjrL)fsO8^CTll6`v`bcjxZRg*`&pW&hPjh;xE)kn=G{0^o+T z@0|xvg75OmiRIqDeen!w#8o*12ny%wA}r~_9-d(DT+bHAhQ|xXJ48ECWrslK-e+e4k~6JLf6NxUKYk^4TPzujgNcLxIf=b_C!Va#bbahWHdTlbk? zQv0npA;|(zlnKPIqFe@-mar6xcJo|Q+6KmYn9Fk)XtJziQals`u zzbO-DAW6PU9cMM!UOGB;kYB%W1ybA)3AJRp;UqYi>z7xQA!taIMrvc|qjzrGI zP*Vd2XM8D2VAb(^pOMQyR+G%s%dDu_5Cu5KXVI=&hPa~ggm9_FIT5$*Pkmfog! zYIx#Z>;ZoWWliK0{$YdjVcN@6J|#?snAsf%fz$csPyhi3i1%e8uGFU>;v>x9zE(h; z&^NDk!^5eQUWZe6uEV=lTc@+Pv%tgCt{Wf-fE6?(-jK+$f8FgvT7sTtna61yZL?O9 zoNQ7x>netJ3pJm#D_P5p!377#FQawH`$bEPsF6l?Yop)~k^Eo`tXSCFqCL?ml!Iz? z9)T&0K}L&Mzk0S5KQ+MIUm9Q@IBf%m2jRi_!FU`+rz#E)_x8qnqr?62+3|67aDH-h z5Fd}#`QG8Wg3QxKkm=U-sl86Rp&ZZp5hG8){R^Vq9U6e-k%}AAcNM6XaQ{l_W1v@u zdj6lk{Ko@64OksfKB-eZzz5ywKOgXEAk6b*Nj)kSuStgi93-`tVo%u=T#Xj@VABea z`!2!mpeA#1+UOP~m=(8-BD@6Wpt}8gWf}a!SplMbj!A8!vu$*?jm|!+=%NH=&DI%@LY4fn& z8|XCk++O<}zo0HdmP~CF>sTM>gDd$YQP4t47{9~xSoTCmsEa<0QIyWutLH~)8^u%p z&%-$sXj`lh-Z`&;(^fB47H6Ma&tb$B}Z|WpgUz#8Fbm`B9Ke|ELhvqanJ)M1;w4-%Q znj4%(e!pvQbw|T%pC;#cwUhJpi_5EE|7dU6+OK;0{3ok@eqX)x9&^yOS2w90+`pYI z+s9AOT!6sAFmfxWLnoPi-(7wGAzs1$L9nn?+qt85pG6LJg@`aACn=-~Z~vaE;r{+Q z4yD&3_(VxXy4Pc!P8Uwe8-eA*w9rM6fK_uRQ(MmT5859yg1bK2473pxs>VfXX{2D& zDWbQ9+5iM}fHwLRWvZM&09rG{lqG@TQ4&DNhtZFE__nme=rSh3pihCwVukg7_%?s# z5wH_4Dd`L;WVbsOres=+n5cahrS$8SH45zA?XEm%A3OL}``EJQyJ{uDkk{KT%C>*Z z5JWwXC_AIys?r7kN;m8e4df%3rNfWh{ic57dAQ(qO1ANaOsK~zs!e z8Nu(y@!hEQ&JB{IsTtnXGg%BRTj`1Vm39hD8)1XA$zAArH1Z~CRp54#nC(Qb#uDYy zXgNXIxllE?uyV7VUM-2`inCX@(wVey404}US~A{{eOh9D#kgjDQP`^8pY;XjD$Qpz zlXL=s%3bJQs#>joF3^$c^{IKu;E&mv(bswsyv>wbJyb*xDjKG4v#}?Ue)sgo2?Xm= z#U0krCWdL2syPwT7cIvd<;{|%$**nAYg_Z$*1R^fhM>>WUe~-FMkL4m2G9;}qW(q| z*Oqh<_dVRqLf}Vf@eIMAK^9wYvh>eGgxLy$vjE*aSNMr-wFd8O*{m4 z+2`7pW0xfeT(zRd#u3^u#KqrBB`n|&0C^5R0!4|aqqD!LoG8)&TwMp_<)LvHiR_tJ zZ<*5vfKoT0zPMy881{vZ2MJUtKrf9N+^{}~J0;lB;my0Sh^ak0`mo!#wXo4RRagtX zX7*{&gv>z>*;w*dgiDo2D7)Z=J$_@HzAicCNmAp)J{>Y+O7Sba88k zH;libSRbCm8U|RWz}!5uP?7G*OsZMK`$^=)E+A*`m_ndLYZ|!Yw3*>$H{W!UBeWh z7nKjXgzQx|$DE!Ns|NO=U2lU5w&Mg7>C%q7O<_Iw_uCZKHigw^PvD@}DJ(e4+n{U_ zy2&!+?`73`A5dX9&zc*gBRLCu=>R^7R6MBRO`O?3byb#Ht*gv#VXOXqJIpsci*?ZJ zELQjN>$h??Ye{mB`XY53XgAB9z@_bwr*1ps`SIcC_$(alt9|Vc9*z$V_C|-HisN`R ziuVqW&cbmtIv%gf2|Nt0{3>H($Vd zp&O3Fo<|8!+&|yrHPN5M9TSDUh`pE^keOP>r9n6F3`*p?d!h$%3g$_;rDEB7ja#qr zv-2AJEW%AV7Q5q#e+GG+yPQf^P_{cGoB&ivf@bKvV7~jthS`X-n~+9l6GbgDCW?p@ z6|)$r6dSn8z-<)-XH@G~QaiPy!shye8 z0J2bJL^K9@fBm1QmoLm=f}~+`++@se4+jeQ%Fy2PlXNVKT3=J`yx}AF&ehrQT0*}y z$%(0ls#dV*sJO*xQP(#v)a_quQ^Zo@^5|<6M!;DNv4=_1jW?n`S4hEd^e$2}!C!+V z)u*wbR*RY5rky&~gAxec-4u3N2(witmjx4q0BguC1PyX5q>hoEBmijxPKP+PEwam& zZE3Y-v_v4;!F>=2=tYDb*=F%9PXMs~j5?^Q8)Slv zyRbNT?N-}P|pv^(Gh=g5i(7sb{4Cm*ol|nc$B3tzZ*i^VpC{ zS}`MqJ4scZr}}^Nj+-eESP6d2@^^Z6@;q)&T5I*+Te5z|&Auy~+ZD52ydGYK<4Uhl zTC0~u4jc+F!jDt43WQ&@YCU1yTZH9o+UXkR%g+;n|JzBW$HpXvtpY@>mdn`krglZ9Aa zao=o$pLrzqjk5j$l>Nd{Uc?XzCs~x%+`o)+f8gq~H#|1|Do&liI?V3tUsw`nB7<38 zqQ9^BMjm-D%MISUlm2vRC;ge%Nq_ice;DUc4O2`!JhY%6z6m`HGNA7pJag}BaxF{u zrM36Yck8v_D|QEK>28RM#(TG2+X5!v7c$I9p~&l~Rz6Du(UnVcitv?F0#^T#WMAV% z`=VJgN>c7sQI;Jgj9}r~zd3_>0voa9qui+`*tPdC{VvICfO+QcjCP0HG%t|2%an)G| z0~xqUKoQGc7pC8UOK_>Hkl(3lIRT}PvL!emmPNW zWQ)pFk(-vBas`bumXtz-R!&$TdqS#$@l0m=Z?Z;RuLuoQ{gvQ** z7_?eHX}P3fLh8%!XGvi<7@{S8b~;P?!+VMA6;$0hJ;!lFPT6{ljBn;nBc_^0~zZ_tLk5ng)N|k-(+s$vqn_sW-Fb~=MQk!woM>Evx0T|19 z4v$N&3$g`$V_^#HE(xg>7P*t(QT6*_l;DaNVQrK=%j4UhNo#@hcBL$CGcZUtQ$$I~ z!fJ5qyqJJ*&`WBKPpmngEp7ikbKAee@c4ND^yK{H>>%7bJvfZQlUT(^Cntx8@yYRt z-VP3q^#86ajd$Qz6L`n>qcJ8>ezcUmYLF0Nsx6!(Xw8(0v&z^OE0JkaotnM!>E#QO zu5KOD=ziMH9-F>}gBUFwh!`F82&A^5od+ReM4M!?e?mU%I`LCDOEQFSMObzhc7`TV zuoOdRI0SPC zevKxBQV~V6n<8C$UfCl#l_R;?vSl)`d96dyMl?=c8~{Gh|k3=eT4J*c2cM_m>j5LeP~5C|m^CU6{07*Y&?Q4_2t9d09& zOj76cGV~;uitbOc$IxrWns+j2=tv7EL};haT2ae$s6zYZF>iPxx&IsspSILnt(a0K zN%IJ5!C-&2&4FPia9U8g?rJELIAhr$CWO*&xl0Sgv^BT4cYjSP&_*$?NB)Jd=!Le<5t z=O>8_TI#k~0V56TAj6Quq_E&PvWX<9J2?E5@6-r?)(@nHV^vF12&P^?@hHi{q@;XU z15Syj+;%;#cs=&JtNuLdtaT-gINJ3d+;s7J>qvKjA*8-b=TlL8T zuzYljsc8>5L4Frp1*+9)3S}eerS_mFX8dD|1#{r|wF zXd>NhnKkWbfNnGcnEly_DXbiyU8_V*XA7u40RXiBQUNGv3idHjl5p_m;$G?Fm!DjH zY4yubzx;!XR*?s$r|lwQ@;~WVE@vvLJW!1i%8{h9ScNUPd|MUSRz*I?sz~oS?_dv1 zYdP&Zc62M)!CH?w)N_YGGlBbQiVQCuk#+=RM8!Zm40-e;{KJ&+3pb!uxB=^>nUF|Q ztAOr;bVQ!I1wIfgU{~#+h64cQl2aM+fOAja$Ou5rWLw)H2;qe`!AC_fMO&8OPw0y! znWWR4qKV$?wZ}%K6o)63pUQ2I@+uv4u*t`WO>Zu>Cl2gA*o2;A2$C>l>Pm0}C|F<* zz~eU#`FI-DNg6Y95bHV4mtGzYpv5sXSiqDL9G>x*DMnY&HJER&UiHl--0*;^=LCL! zvdRhJ!H{o%t|;*~!^kRCM*W%4aS4j0+3LpDbXIISeXe3SbgC|Nxgp72wku_xtT}Bv z(>$&TXX%_JiQcaOnNF;(?E{TC13SNJHn?4mTOiF@z?N-cTiwT(bNnD75}t$nuz@2d zq~P4W$%~S4qOCFXZ7pm#kh%ZFesc1oz1y5A`xls~ArmBDpiq>JVRk+XJH8hzdh@Jn zdERCzmDSmypSL+0BE!KjcI%PDB%9}{o_naLuPcdj6nqVLZt+b8?#&-9siRsX7=%k@ zIrc^YnMu(Itk7!L&?cA6>vUoa&iKecSsIBfFES?Uhw||@VF3jI( z6*REyUT26fNgFHay&mNgAm^20T**qkrQzLgx)e5v37o$Ll&B4E%5hfPE@@N0w=_Xg z7N&+*+zyF2%Ep}zdf!ZT!!uJyz0OPt3>@1i0oas@DM>n>+Sp6(qJR#2Ra7}r2SOT@ zB~A3^8rEZg>!P!X+Pd#yLzHqb67SVp+gh=0^*YmILL0ZOSZLmfqv86^(~IY1bfrY2 zIuvpmknXi54%&Mnr6IewIK2T^g4WoYdTz!r#X3dJV>G)~n4aOARB<{Yl%I$zehGqwS4QV!pd5uz{YL(uUVhj-H(M z*_2FM!#nM+H9+U2{Q+=ZfH4?#WiM4|@E{PwW~JC0|J?@}EnT>a&{(c z-#oj8|17S|94@WQ94`_XSqtI%KbgqLkqq;b6%5W+ETKWd1rS;pS&?f%qh*ue8_>-7 zvO&HRYJ+;FARC7B^eW6k>YkFXH7D+V@&;gjUo86D$r8go+}n3cibq2WW=1Ty6u<6k z#19iXI0DIsF6?xt`E)NlN8M+EM0mXplGJ&_EE*j|-{#Jw*YqozqSJ&%f96LNyCq8Z{EE#I#Ehd6N zzeLSnabcV;vy^v=>pQgG1hSo0h^hft7g?7hJq~`SW4+?3i%yyUWIPT#({k4;kZC*RTQx5sda=h%D$0X3ec`w zeNO^D(t^eOqWqL_(R+(!oHeC;{QdvTVcLt&!-MnF^ZotsbZ`H7G>S&?!QPSDA4TJE zbbcJ4?Cl?g;dniun4^|pM!D3$AM3Dqi~Y{bvyAD9Fa<03nwn@ATecLz-mrxZ_H70z zm=8Ee7bQ>^vzI>!UZk-806gI>F-!4BeckVg$tN=s7-)EI6C!-aDl zKH>|=Ny1Q1X!L|$2JL4K+M6U^5b5ovNoi0uel}GP91^o>>K@S2#4nv>+Q{aR+Qk4t zTT`Jhe+$7QY*PRqA@Ul0l=MCe1b6lJj0jlDZC%rMt#1Eb8Lz?EBR_*9(?V?ucO5>? zbAGStL_hnV@uGDqoWA(dKw`7`LV<1vorMm%#4$$G`gN%kCaD%)XO$-4p~V5X)(3U+jL(och>FR{0}xa-)&t$lrN;rQJjt|{bjoErC-;p5ql z4;FX^5LBqLc?Hikt4u1^Ju>utfno#?st!b!zIn}jkN91^-Ov&Md+^vP{iDB#@B(T(9`XCvj-Gv#Ku=e@|pYC}+?%cJqq7@Y9n0d51mZJ@Ue^ggRVum8;Ri~K()yh6f4 zYNWKpo5t(Wd)RcwUPLi7sw^rSR={kCRS`&yO$aWE*7i zaY*f3C@V8+=QI%dPiSaoPIm3UBHc+~+3)-2<7{+W$5G#j*PG$-bawkU0AN9;UBJpA zvBGt(32W|7r-xY$1FH~#eMTSk5uYZbLev8}p zVB}0ZBFl=4TzWr_5M&6QQwgTveC{fjRmAHF>^c9##v5|4drthaFN865v1ngTkvzfA zx2z&X)Goi8oBJRhl@)5Dqsij#?9sC4=tv@&!L_nL?Q9X;W(q_Ic|-rNSyjayU`h?J z9MCdn1?>|&kY6DiAA5va17u~$Az^mf2r@=8mJMVg52W`=VH6CR=coz-L};P%{5YH z`rMh~!ogi%5z4`HKwVF>QFhd)ANQnI4yTD{`1uGZB7bJJ5FsiPsuO0Y;yhiIbJc_# zVuD#TRKeNf19>4vVU)p0m8jN6{$rU`buR<3jkoi&O}2B#(zt2Cu=~(&Ors(#34;#m z-ft~-)t9a6`r76hBK&7@W%_(sW%_*2uS_2 zc8S7cN$v(Kdx>N>DF(F#ZK*8SCB03|uiA(=r!Wi~zmpDgVlQvkM;!_Su7qZ{D{YI| zUdS7v`T0c_tM@8?_7!$dV6rU#F#+za?$mqRfCoar3hmr86JD@DQGX#jp9o7n7k{{$ zvtw@&+00s~F8;~LW{zc;pG-D$zQ05 zA0Y~+PXP6dch1~U*ra!ZG;Y1v4&IqQ%;>>tXVmZ44@bH7GCSs|3`QS4de+`%U`OAmOzCM1AT!|F*BdpdnN?!vn`f7Ac7uElOo{5nNkIufZwU=U0(dSA+vb4+F5*IS6`t2PkUV6Jgo3e!MZN| zKY#g;bzQoVs9WC?{O88aI{A$ovS`j%yJ-G!0|Ce^)L(){1LT;P!3v%!j^XbyFYTZh z!`?3z{cV3)zzig;h9vB0|734;dVU<8sl(Axc(i|XaC)pxN73Q=xf+koN2mMY{^;H$ zVGm=xJPw}Sew?c`pUt>~N(UT81Tz*@;9GOo22hQ6hPB-ZfrC3qFpt)e8Td^}FrTR) zLmj@_?>OdKEO6!ly@kFil3F4PC#e{B8RyfGgyFbv81>mOnQz)=OzDG!+PG}uGY+}} zZUgrQh(~Q)y`kFD(am6P*@9}OZlBpR=o zA(5^jm+mf+MmH2vk9jTT{CWW;SgM+{LY7-h-`t&TcePQ6A@XVAM`|Rn=HgOVmt|ro z#cU(H*N+}|T#|UOA#v)Ee@WZBGcoWMy$4&m;@#bDnM&y4o}&`_$K%o2nc6!!+dDZv zJva{c_fO)3@kw|Zjn4Ex!^3F*?C@|jS`RSfxSJADHQ%tR+OOuWjqnk76hylMl4+DC zEHvLeQpKW?V{Pr!(gcD!Su9ozU-i2ukU5B33&E<0upL!WN?I6t6JXlEJIDqc!}2VY z`D2~#L;|RwY?J_BA6MDa$LGL<>v1>s69sgy6?fV+rfs0#Q^h4Vgzd)O-rN)hZOgC{ z#y@0C&@cbhA*dB*6UCPB%RgZIwF0jC^Umdg?2tHI7m=E-bnf0}_U2|Y4w)s2nUO#oq;Q3b=*-Gt;>Sf; zRz=O5OJ0}5A3`iZJ&tvO4Oz1=){VvkU+pSK9EA>{a)3{Wx|BxI3gOxe4Vfpjew;;$M?Ty+y8Re4&3fAgjWTq1 zqug3|V{LG0GRZs&9Nc4hOp)UG2e?BaCs&FN(+s_>#EKvS7Ka;>+6&F!rK`oh>=qlj z#YV0X6S2ict`7lo+;c+HRy%V$Cb!V8)YwIYKltO|oL4ZD!e~^Z8??m?~;=Vy?HX6ow+*=yZ zKbr<)ZRTN`Pim3*f)+`lE7uOaB~8+yv5w5NOAT%*unR;a9k6rt)$3Qg1L?Si+lW?~ zLl@kzQ*s$?CDPvHKt~$SQ{>1^Dkpo9WHCgo1!WgRJ`|~;YZP_jZfHTDCz7aC(n{K?c_ZpDt$~B0 zJ&XPERLF5bGr?=!pp#(?1uQfM<0*bnT9bSlN=%!`Rcbpy(3ppT_EhQ9Q8j5Xod~!z z5>~ z^K0!+INCZspWpuP`zE=G-P3qvn`e4oyjzT^$FkUxqS=uP5eUQm@zLlYI*-oPINCpr zPEJ*Hbaob=kM>Uvk4O9ahi6JsPAe~(9RyF^`cg}#jjKxGV*>L1B%!0au~-w)Empfj z?x;xNc8BWfK9dEObZsH<5t5bP6XRN8wjiu2!h%Q#MYcFas~4JV0^V@-&w2xJ3mNSK zSF9T6kh~T6`;MV8mB`BQ!MQx}oYq#muBQoQ_)l5Y>Pc?Y4UEM1TKU_`~MW_H=j^a`lRB%H0(PVd~b4bRtZ7F&7P zU~FYyYpk+TO6%$#=WpDVD*{ucEnZg64X#)Ln>5)=^a+IFmit zpZN#@qsmg5@_^7NzsC==ZVP=nLk+)BFSy9U<2WmiidK+U2V&;B6iA@+OntNX4bOJ= zoEE%Ub2Gp^C8ZiJ6XB*Sf0PZ~aORujr|Ug*<9u7_ST7HP5J!*%qD%yTYe7zbaVp<| zPnJG@k{P=ZZzx4B6wk1!q)$#6abt>2895S@&E%1)!UE!ZIFa-MuQAxS?BOP0v6xoH zKx3NoPP7b)$^sBD)bkpIpq<`BUZGD-CQCn6cQX0dW#>G8ayax4_946I$-TSG9-2Zv zZ1$O%JN`Ba<0!}QB(=EeHtf|!fan4IkY|$=*@uYTzeIbV^gEbUoC*s1PC! z77KO`tlU|5I#h?(c}%5Wr&-5OHdB66A7ZKAA>i*$Hy12q^)K|8EkALtjCW5T~p+l7x$0LmKG+<$8zl zGU-aZ0vMXmJ0V7!pv800IpBOs@nKfwXn91vs)WPLK;W9aVUJWHz=k&Wv7FAfE{I)M zLLNFbt5UXN(^x=<+U-X^?ixC!j$|)f7QhN&1nqOSV4(1NKq~;=U^wq zo)Wt@^{uIbAZ`MTzl0_Wj^Gvzs9^OfP?61x(s&tGrCGj2PAB2H!Jhb+|9co9)sRR#(+sULmZK%_Ll=p zaOkZ%g7kvbnZY{($a0>CpsS?E{31E2nH`_tp zbi@%dTz7VdZnMRoV5ohsk$7G^l=Vu>3ZRC9w3j+3Mxk>4!zP2FC1KY zLQqS$E^VnsiKUc;F1fcgXFfj`bzR$gp4&RuLv9Xo%Z2v*I<==L(BS!T60t z?>~UaPLnuJ)w{4zR96{8-UAWan0v7(z%YhNw+dcdQV?Gxz?Ih#Hk#B%LS?~@a8+89 zSd3CKN!Br88iPfF^Ek<%&Cdyx8|BQ@id6y)7kw8W3l{+|DtSiJW!T^zQl|A$s`!4{ z-sgRA8!nK`XM`$#7&3=AqZBjOurg`n)7!rZ&r1h%cK>J+j(+YkmEk~02nui6i zRLp1r76$0Oc-;hyQZX)}2eZYKX<`+cxdS+4vn`>840s--G*nEPB*dU+yIO+1w60f9 z9WHqkH1|aD_$bK){13jo!^D?@Cvg% z7|AeKlPiv+hDI{RToD&ZIGiE&M2=?*e*|@L*mxCNNv*Az~XkA3*8mOwIGaAM;KJw#6r2S z`w=pxdCQpcU?~2xqaDH9|0b7FemQ7VON;6! zeo_4h=uNc?iozsAhlFokHT9$5!rstj{p)z@Ww-y;CH0pCiW#N1KTl0r$qdLe=%Ak> z^1RKD4Z8h_>(>|8uipkc*U3~3^YQQkv_pnfK9pa)E!FOT^{3DqY2h~2Hob;8_^^d^@X2w76c#*RkVl5pSdi{Yq~gfnW3IP) zaS6CoE(XCem&OUC>wMr%1DK4VPzdKwhVA+GCfkbJgMa_UyKTj7TXE~J7j)F`iW@ip zj1|%6VK}kOt?Z*u>r@A?xYat1nwaVW;&tAo4Xq}NvGFy5Xq723y+Rl`>_GaFAo7?u z@?EA>^g$npQEpH^yQwdNXwfBxWjGd=WPRUAM-e5TW{uOqo@mI5rHTR)csZdZ^v$OF z^vq3)+YOiXc^4;Lryp~Iz?oB9H91p(?Ag-VaP;v}ze{~!Q}mn2hyFkz!B*Q$Uz2dN zm)M`I{eLtlW*+r0L<4b4LPjq`eph7<8}z^k??Tpy3)ooaKmv0ogQR_soQQ3S%&n0a zTIlByO)2aU)7Q)1Esb@ZsBgDG|v}N1+($WTySNd_n9D^hxW37|4a%) zn@<2J{(_s*_P(S)2JpdRyD(S0Fne9vbT)gBk)-spPEmeCeJ#r0|K$=AdElA~biAVf z01FTP9w};k(QB?0!l+m(oHdK$G9EX_z8FOLm*EE_BZi|_FGgE<36T$vPAVQdNCi%C z_wew681q91W=Z_;$|uTzpUj3s&&8?fqBS?&1tSk=nPg!+SIpYWrB#`~X_(Fxj1p&% zlf+RPV*MnqO^(>WMz?ElwQI1?rBd|&@-(R&k&6^Ue&aLQcHcms3b%iYZWPHBlt2*K zj{i-Kr7Vf8KHxLp_M<)>D_jkb=yltO8!2O`&Eyt|Fw66_bnY?W;t75LE+zNIMu8+J z&os%P9S(e21C~fI!WXnZQ`%8^ChKF_<5OE#PL^fa_V*WQ3$H~%=$}km_(X>JsiIwn zdn?up6gg9_*94a)eSTReIAoH?6Y*T(EUj1%kY?$XJ|u&uI{uwxXe1jwLn{`4qZzvR z5T$vhp8YZSO1l^!X!=UK_n-w*23Io`nGj?%CTV|f9g_rz9HaSqjgYlT@J*e>>Pz#Z z-kY#q1p%1elfl6?EAt+6*RlQYH!R))ZXb?6z=Vvh4-$-JWNIJB>0_=P-;=+x!iNwUxpM`=T6>z208*-3*_{U*KrvB zrgC~vTq4{Tl-qqdDXDi(YGHe^pM(qmO|amrRDma|Q2pWcsX(f-LQV9Q3eH~WnCp8)k z3782b@Z)4&rxQaXfQ4Sklj|T!+rwi>P+bbI1BwYGsbxcRXs!_Kou=3|4xfWw?>|%8 zM$g;O6f`)INCz&Ft<(E#a96r<$h~D4_m?ut?z_ijymzRg!}Fuj-toB_9qAMEeD8RC zdKkvzv(ee%d3<(q9EJz$I92p<*)7A^vPf@>d#rQEuhAPIW(_7MN)#lMND2;+4UlYh zd;CO_!L4WXp;-c{1z8<)1+ai9!JQVs!bFTSlRg7IGn^KK9QqgzmPoGT?*AT3KI~0N z7A2(UrHCQ}*04SYakb`p5lzEI%V&!n*kT8^*ny2qom4Jz)=u8Q!f+^K!EzT;L2ECJJRc*^rAgzG3Sz&`>4dumr{4zdKu zRv!JRhdB_@PtuFU;wm(Tpvo`axnB?(9lYPugkAFXeI*eEgvmz4jo{jxG{PZc@{N!K<0@^ zsnG!+5YEMS>eK!SHx(}`#7eO1F%JAGRQ3BI_O`(=j9?iSS-DCJQ>85h1_MOCOvUR{$J`|2ae+@W zkPo=ExyE*cg$?N{;wYaG>o&M^RF|-kmT7R}q+9)O#jofE^~B?ITMs-&wg=RqE2Kz| zxEcLXhsu?aW3IBSc|%@eDx9kb(Jk0pSmsG)78_Ugop{~8_Q$bM`+}on7~?ofQJBXW zX-I2~^DGYWxK0J{))oFVRz03~4Nx6eC?B~D|1mkPZE&&;PPW0xXBC|ETRwr~3Qn0j z0f4J7kyVoakf z$wZyGP6g9x#C5W5M_jeN_8l_pWcW!BA?_xYh+E+*`SRv8mLiN?_$JpD6;{wx)jr9Y z5^|wiYl$6F8Q0tE3rgbal|*)rb+Hg(iTY;bOi8;tg$3{(@V5#DRSmtMgs;fND_EPj z;Y_)~7`x8DCo$BOv)=>Q@VMN?9a6`Z>LSf&2+%B&bFRxw$f16YUklP{L zs*Zr_QZ*$XjIWR6TV9I`*PRoJ;EYxd*L^&h>kUuf^xWY3j&e0NBv@*uO|DrmyeN=~ zm-%;;=m#?wmHD>h7zczlwbewQ>j1hVDE4Zf53uFdTSlr?8{j6<(BQwhqoA4W&J6D# z9Ge!h;fQH_nJmuhbeBoH@?BnwPh{xLZ8Cu&FZy?)j*gxVcN4leTB2D>IA`UrEJPK= z2~yrXv$W@3xA{R;LN*26hLF5)njYwKenL(JMs7kKTM)DPG}JD<{x?xjF@w4`aL)Whan49%0*Oj(E3~v8zkuUpLd3zssz@nyiN!oT~+?IId zA@l|&T`JCq2a3X(==(;kGMS4`NVye=fncV|)#XJf>vE?5rq_>y9YYusg}Qj0LFz8C8H^k_Sgoc8wTiD3SWz)UtSLMcs=NVQW4*FYjw@BL=NcTmGk#>XZuy`y;Ss~vez zbp7{Q`@6I|!#)dpEGm>~m${W1Y)YdI8X97T%CR*l_T0_EXBw>sivh$@o`MQXAL%kS zJXGx~GrrSO?{rI$JsHjm-%QEe(|j_iS=k{cT2T&L41t>L$LcCbC+(vBr~8wX{XaR zc%!0b*Ikn<-u95m=dWL0K}5)sE1PF*%hPeo`4&$7bllOx^i(x*!1sY zkmZJtm5B2?{D@y2@)Jd+z%dn)2Dir%@-|VT0AN`y>dXTGC&J&$M#31=W3-D}vK(OX z(rz^5BR-;P5B3qpv=!GtqytwiEQh-RbLxv583)4Uc}cgDe`C9Y*y)Bk((T6>C0e)@ zQ4jfrGhC9PF9@P%Q+-CFo5hE0(;qYAHKGIC0V#mWjF^nEM=9Yxspuw8-rEPT`oF(L zDzGaP+ku@%uGvo0^*Eu)2Slk#BU;0q2Vq(|^lu__VS%!a-lif$Ky8p|g4GBkwuyym zC^xj!V|`q-`)7#k$~;{Nir(g}wt1^<-fBbryMFV@-Vd$@f3a$zK zV0Pmzq-I^V)z36h2c(ANpN&T*r!wSpI*(;I6qmCaZf$ABw$$siOUstT`|{f097+r7 zbuu28W#weG4rcWyI+KA%tU~orDw0ogaQDf>c3~~uy>m`4A4!8ps6ePa);#ri30jS@ zF0YB60TD}QGLU2gt$leQe7ZCcKJx?N;~{f6VHC_shjj(P$H6!EB#ip4kSI%fN4+2r zQYtwDzO@a_sBI9->&_~{q&I~*$b4z~AW8`?@9c=%h9}$bWE-Ar=&^s?Tt0S$P9)&aH%x>S%h-s#j*ynj0hYGUc94Xwp6=X7%oe3D|y{ov6(Dh_FxPKWRrl184pu7P^d6bYqj{(eE`eaKE{@COx zO(xjrB}&ow+p3+oa90A90R5UNaIQF{m~I=TWwPl=bvUjTO0yTl5(_B|pN6rPuDRL? zR>uP)^cZqmz6_ppUbBSNDf_ml9-_an(n9GQH4O{B=lt^1m)ZufK?^`d*#w)$caYHR z>RmF{8{;>*eq{s0%`^jWszVnfdnp(t2*8xsx0vPAQ2}Ljb4}}Dq~$KY;|vIKg`DfZXV8MhlH?nOoqQ zs_OP*b(4$KdWC*J69QQuhP6xOSp^L%62RpG{T(meBDrcrx{HXn;oE>*Z)xf)&@%TNbMmtC(`4>Dzp9zBaIA@Qs$SFI@eald~vNXU%u`BVs zSN&}Ci_&8-lCsj5t)m18(idvB`{ghnRBUmJoP)w3$GC|=LU42Yaip}Xs_#Y82Dd*? z3W3sFh#n2=QCJ{@DfqS|<-oI{y-Cw&1tg&WiO??$rd-d+1l>pN{IAw+Icsd8_Z$B+ z-w8K485m#iH7k(d-!RvcV1cn9CqAEn@Frh-H`}Fd~0RM6I?Dtkz##^w0TXqKEk?|26j3gSFV8BF=#JSB;x}k%!rtP(#5bZCsY8Gj|H6SGHfwZVy6Le z__TR!HV(N4m&QXk_fKkUSaf1B;RWRBqJ%_<%p^)hR`5l;?EwEw%SX{? z#|w-I-}H*lj`LsTelMFe%VZdP*5{rXLWbfk_=eSywf^$c|JtkvHj9|IE2PXQv}**6 z)()Kv)wkUZdgC6oxwF_eDxRuzx-=ZN1nK@<@G?pFD%{tVXY-aL|IwB`)0-#QvcvVF zEUyf!`Ql9hV1QCEBaV8=vbNVhEMz;E>V1^fP+2t)Z8^m0V3!TSaH_Nq0&dWbn#t9{ zg3lYW7S>w8I~P{h+#J?v4Gddi*`t&xLK_+fbvgVYjD+Qf&mZe&3`9{WgC85;b`c`P zFN54T=t*Z(j3AjNUzI%GTOKzqAH4NdCQBCJ4(s?C@UN=rcr{<-yc~U@5o|5z!cj8w_OCcF+JDkF| z4Ln^!Q}R=ZGRoGTA-=2UA?Vhjn%{&~(ILY1nzu`?$N)AT7=no@VVtB@;rEo0YejB? z5H~puaMJUJ34vLyZ){q{E#PB|=6vw)zj(Jrb8gX`Yk!l!5+rfjYXLGu+ej+nz8kqT z1o?c=K7`F|gD)--9D#drF-Oml>0ZWA9d}9k8pL+I!@oCx%>naFV}HgduOpyJ*T;%w z-b2zF*F|fNWqt(vvi|Q$-#`l+jRXQC?=?o#G4i|2Tdx4U4t9eKATlMn_+?!pBmmJe z_WUk@_tr&g3Z65zeiP-pfk7atlBpuv7y-8B^&IkCfKviBVg`6%{y@hj!cHJQ6E4uc z+3iEXHeKHOQu2+1Q{P)Z7?NAKE z&6KM;{zowQ(?4R)&yNkf;ZGo&Oqop4u8=@_oa%{jKWs=eKroNVA8d5fBJAbfS4-Gy zlawWkXWZn|97WGcq8_0b_neu)qdHB1TR2HuvU3p6 z(Nj4p$&ft8fZ=ogf@1nGZLmbkRtgq9EHUihJSu zS;B(azW$sc6hMJRs zvw?Um)DNmcjv!9fIiN5vZ|5#x+u`H9XSv-pOd(l?%r2Qz5n*}V`63oJMY!G&*+ILp zgL;Z_BV*7c?tDPkM&IVuEdcn&hZVm)Vw!V%IczNj>!ai#o3bciecKJOk0g$0Pa@c9 z`P8bD#+fB@U0&tKwV9bx#jwhU@L%3+vv3X^Qn>HvEs{yZsn`iC0w$Ia3*AQreu{n| zrd6VK#RRO-xGze5d65X9JQYPUeCz7x%awu8m^jO*2FSgLp92tIn2E0xo=mVopLvFT1Sh$FtI!ZpOX`<9H7Zo37 zRgP{FO*CWevDRjXb)z>8um?csUpQY;fX^q6T@OAlEM5XD?zj<@Ew#ICm0|_Mj;m74 zEX*<;e+J$?)jFixAASOhCMevLd z3&@l38S*mxpqG&Wrt=X38#i}6f%9Tmgp5uJ`B!{!e8LgYw}i)rC+hmH;AxUwuB!;f zCPg}_QW_8%S|2IP_zh2Gov^R$NVErFzS@ZIvh!WfV<4d!{qs0UCGKE9&8h!U^%VW5 z3b+OIU-53{_f|oiOMh(hTz19F=24zDytqaP=-d$(!7(mQe{u6n#j7y|9jx96rHFdfOe_Ov-JS#)_9lf4jby9w7>eYedqGc{&PkQ7G6h zn0r94DF3@)vM89rga`T%0GKSLnPMl+^nfKe4by;AQd|36v3>ShQ*?dyIn!Q{sMw}C zB}gA`nA!>9gk|g`o*HG$zM1UZWyqeJ?8)YttXCoT*}LX-iqKPLh+uoR2R#7l>VgEA zfBCQAB8BYnw<=BZ;Fo{UNq+xGG!s__Y!(Q?7O${bJxWc6S`Q+t8I%g1x&DkM@S=q9RqDk zWih(#Verpt^=Cb{dZ^F*%6y@TI5Bc8!Wn*^<$!fm3D6EQG#zjj3aWX{bRd%z*(^zH zQ`mtOBG=aa>~eQNi>Sh_9jfDcy)}bFJTO8Tnool^XfVvUQFlb=TKj^Vw;13*ive0o zNudwUe1O*BuuLXaq+ne*t;68Ty-mjxF1zV^8!9?lC|b>+otQ1KUiYbNMK)~wA~gq7?6QWZ+}8`j%O(zbE9vRg1BL3td@?5U|=kCMu|o} zw$wP~bLbG`#QV04{ovn!@ornj-j=cZ>yGwYcZHPN@)9TOiE8Hrk zsLN|nSjcbVKiI>DT74xG$h29Thsvf2J1Ygzj47WU!XQEyilpcAHNF9p8fWxM9ig{Gi1R7;VX_!U+4El^F-Sm(vBnthNi=lIhR?M6F=Ie{# z@c4Ky7y`uQ%iw88q8xd7F_V4`nRJI$be&|gtDLkIv#a8yo$l}JNxQz`Rl2;^5bPj~ zZ9}H(aP`x5e0p-Er|aGs_2&j;SmnXAG;?K?wj`hU9 zo`dVE-hJsTWSJzI(XWd9o&MhNtFTn@CNA>hwM^cLo;+im7kW05SQXrv1JkxqhsViU zrsz~p5qoB4rk;v&f?lB;GC8NKog4#R#&yPJl}iL!-;1QZBc3^I#xw5U&X>hHNBcI` zp*FB#IGm(8^%vha+<6G^_ETy$dm4Nhd?WW+ZG^G^t6u#lWKvw4_WLV8!4F>c+5h>= zzXwl8B`Eeey^)TBib>QtMDI|Kqo((9Ld>PqfrxCSsv<}bmq8pNuqG{@VZy!rNE~>b z*L32?lq%cMJSoyz5SAcxDzWYLh78<+TOfI;Ji>g{bhy8Pp~Oha6I{U`z`+5PhBsjr z=hNiR^pUcG#?yC%CC25&QE(>_$S9|KIR3tnaqeOekd3AI9GqoTyJ#!fS$obI*SqBj-D3K%Qd};&Y*dh>yk5G@V zA>Lp*RIk%qb`anfx&4b!Vqy;+(Lor7e|aGQS%iBb=g@%5|J-e-$E{LGoL)V>y54vb zY&5v6@d)|ega3#k0&eHdf1mV_!z`bDQ`e!bD=A-L(hI>%cww z#4tbg9sarpf@J8lu46ZKSnsj6qvxZJ%NgXND0x}+Wdg1`Q)(ox7O=g zH2VoQY&n0!%lppjh&Ltsp-GbU)3iIFv8km zyytu)15`+r*q`8rfTS_gqV#@s>5|5}Et-wdeUs-C_z3=`2=6@{Ml_Us0ZaDt|K{~| zJyHYt!?QfXXyTh`n53I-k6$He8sy{Pm44HO-a<sMrdFOw30)-0XD zJ_kflDV!P@4NC8gjjQ0aiEGr2^&`AN@U>{hk_HRDR)@CL(@CNRHjvLDBi09pbSRV< zjRGpBE30JV;!S_|7uKcwiu3nxM)Z?+8XelNOFQ0qVY9^ zOwrp=$I`EmsW!L+P`eVBzkjhyw*(|nG2uuhg47{8$K-Dt56YhR=neCQzy^SuQpj$+ zz_G#JruWQ&{0<00GulSMH>nNh0g|$1wL^zyCSv0a3lbM`rz2_*XKV8?o?d{5afR)k z9+z#a#mLFQY6mq;qdIj0|1bqnv+9N}BO)vE6#6y;8(=jXh)5O)n39;0mbyU#ud8VD z-|}*e%yqqCQQm}o@Ksm}1q+nI2JpWZ`ae({(?2}Bgn?gOzy0ouMfBgBWgCvv%A-|? z8h6EnKHPU{g($?%?=Jey#Z{rt;PseBrpI|TU$X`!9D>G|qmDW1yjSQ8bdRf{7~y}A zj+tC^ZXpHW#|PkNa9(m?LYCb%EmK5H z!D5zA^<-lOBv#Ds3;lXfox@}&w4<>Ol-bhtk&T+QbO@n?h8M5_oedc_|Gfz1uQ-nu zJio?Qbq&Q@BL8nxK77Z@4rbsc%z|kW6*-T1fLQ}Lm@(4lgt2zJZvT!|cKO+S%IOX$ zYjViI0atoKb0#~^(U9m~@$JWHSTvNnNJ|$k2d=xyDDnfskM|-qqpAo*2?8LLCL&_{ zbzmXJ9ty1W%XR{EC?5jID@6LfBsUgxWlgdMYhVo-RGc=*`YVhF^u_Z+Dw_C`SwF!! zd2AaI1U3-iV1F`we&bDBTSz&)g1pfcHTPwcbvcfIyt*Q<@%uJyOzQiMR zvhhS@_k&T72&ieX6jK-Lb-B5-dgI^Yhloz?d7@ZDfpO&oiQ%Nl+Hy+IUP?qzh=KSpbvlVIgbPT5 zHtCh#iBMkG%Ou=0zf7h8X$J4w52y=Pb!fmb8u~7DdbpKZ_9Zwb6IM)1H-ZtFIF4~R z<6Lptl7(@iPS8K64cg=3Z|o)WBn;j@yWD*eJR?>K-Uh+|0Ho*pN2e5>Vq4Gtlf#WS zAsq;Z2`B0Rx;I~QnDLC#$U=&gLenl3Ib1;#ta>uN0gj2}&0$rKN~9`_MTx>e8~W)z z2e0GcL7=9}<iGzmhVPRpBx&`W=4owH>HM^7w1L}y zYr#>_v5T!SI`3eT=A$r0SC3&BAnrirBl9ZpJ;n5Z=E)vvWTEyXP&U!ei9#HMUx#h2 z1oo2jPV@WcwzTJ*b!RU=_~WaWYjYX@_?%9n>kl(!nv&t>`lcQRgLN@K#?+FH@ICbG zv~v-KDJK7ulGq3JDNttyMvQcZqG<$h;xsG(>SH^rfrhY7sJub4>kH|bH~rn-{u>p6 zYz}T5BKu5Bm9itPn&C)osI zRk{NfivUF~mtaOf!!eb^+HXQn?ZsK}%W2)VT=ZgPve_^PoAyg;Q@!u#ueT4n=@#|e z6%=nKh1Z@(*|~oH9O_YTGhf-9ng0`JVoLNO3GOQeg>WFW15FV;C#Dg82%>9hOP1*a zEE7mHbveW&qK?s-Y&RSKZcT4w6P3MKDa&)vKUK29$?rT)@yiN91Pwr-OWf(!J9PXp z$)kjRd52Dgh_f^`0O5uvW>H?y0`07uZbo0bikrBT>Lmz3#725@ZP|;fH(%5He9AmS zE|nmO9dP|53#ARA_VL0g98ucIU{J316n@ANk?TQVL}Q!u-^hhP)=UHY>om0_Qu;E6$?VU92c6ebRe6>6&9{}Z3SK-zH}FI7I!lvmZCHk{ zUp#x=?vOz&OxcaEXyhRqa)Qw8gbqUGiRg7*X`pXY@yVfAx(mlemLY;*Vd*{9A;}o= zId0N^=lb#$%LOym*59JvUVTN`_f5A4DQr@5u}J2&LIOwnD0FKWQ(T z-#`2MfOixNW2v(wP6~<>G7uQT1|=Pv2snaeYT*FmoEbbpGxet5HN&6*4`p!UtT4&a zFK7Z@G01uHU36IajM1+}2(R?V!xR8{&{?OaY-ae=pwrGE*7a5ru@~fzd_iL$4*B-4 z7SQLvh8rMyOOpw*YBGBjj0n<%bqZ@qVJfiH4#1D_T$~Feam?Dk7|OjD$wco8n{U~0 zCg_La&L;zRTbJ3sh}o-YXK?s{;=w2j){R>sPOx)vb-8PcH7=nQ=5}-_#xXpcvU2jF zyMw3Xf}J&&2Cz1I`LlY{ODA`2f%nxtU%dyrM2mS6T=8pD-7VGn&CNp-H(AUcDMBoL z=iz7j%D)j@3%~O$pN`-eXL_3Bd}z1fmQo|NbgeyZ))w*RyKgvjp4@-521bH?Yl(JR zz*~luo+>;b(6nq-2iCpoCIK~~D+}D!-nei)OQx;V`w~3R#v6{qmFS5xv!8$aajqxF z@-nU+UAA-e;`u9t{F)r9>EV`v>d}PQ7akkkQo-dm=pU0T!u_S`u3~KfQVKe<0kk0V zOoq07-t0Y%FIr^{Ws|oOk74g*Vq1}YG`pGKKRE@IyqG}5|5d0x)L>iHibQ|d%fW%i6S$geRfgStnH?KDS zMOYR-U6jKLTI8P?VFL7EUr8}Las`POMP$hJU z=J^Ln7^!Sn;md^@CGrUPU7=317B%{l+!{mVplXR_E=0~i)f@b5xD@0MZ^G$}^8$(hh{Q|GMO81DnMukdLLvcWBn!s*0eS|xt98X1yD5+ydC;A4QAv3sn}RP z32N7%+XUM$Hfg45ILe_+J1#LZqwP$4QB}?P7VT#nC_?B%vOH&r)5w3wi!=`Y00#93 zHQMx7{=%v3|r^>cK z&S29=ge$hrAeon5-a}}8CUkWQMAM(y3tKNnDX%~E!oTt%pRNDd(DoogZkm`>5-~i7 zx}%d%6)5y5)NWoDKjDp1dw_U+=!l5|HAdz#f_gw;DHJ85@`HXlEHyN+5d1-D+Rezd ztWDy&>pP#5LGz-oGYUS}cIv!+`{EhxK5sK_<<6V16d8+nij;$MjU^^#C4+9+_%{Kp zCIV5=p3@CTS_l+uZ2|6^uV45DWnnhtGQSRq0IOCP=Gd1}I?}k(1M7PZ15(S;$BXTD zSoVmY=L-Z-U;TbvukYoO*OxAReeM|jSJ`fVz3-c(XN8>F4^Z`EXTNMf06wetOj#d- zOO#2qHizwxS6BR|zYmK9ON~v*sgBVE)XKy#90z^uI{454UqBvmMyNvOlbnX>TqW9j z&&-kPxqt>$s|*nN_U8#9N?ba)&!cVW#a;9v>w57>N`f5=mV6A06p5SYvMeUB08QZw zAw4sNuyP_Yl|KM#7@7mqBuq+HjbfCSA-0&A4yg_iYs!cNR6dy(NUavT%p@=ng0ZWL zuSY$+26tyaOXR*68(;BwVVe1_{&j6YbA9OqiWt|1syJ@;5#sV~P>%2>QFNe1lQbuE zD77`XTqpj50G0$}_VLKcI z2g*+o166_ZS0||LzahfHlFXLl2HfXG~ww#>dUS>qx7uaYa*uo@4;w51hCvW+kA%IdQSr6UV^eISK{8c*3*EC zdK7p8WhvPnVM}})L)rQyBS^QPNv5}dn_|R=S8jr^-F#f8+|7eHO?+ZzJ&Xc8zn__i zhj&8mDDqnnI4sm#9dfF4C02=(HLvBianb69v`OmEW(ll6>HhpZ{EX=f-iW;r!#mrc)t51vgqP{0_ea>-kY9O6k{JD_TPL+fH);3QxV7;O9mC_3JfBJU zRB{fgq`=D|@xwQr$`#yNxcLV9r}j--x$=#FQ$Rdmv}=^x2e^J9!b=~BAYw=cXyoXl z$(pq}XmGV&P^;p`=aycDDWECWG}FTXGb7-o5wWF74tZc7rYeDyu+M-suyyegH#d{x z2k1Pwslv0!v~}o181z{a>#VO$zim+H3 z8c3DP-q7tD({6CM@!*qggR>FZ+6?aPB3pB!Ly>oAg@v}#0of5kdok)%{P$M(k#h^M zK5XU$^3Kqc{UBQ~86C568C3>4>1yLka`b`aS0Njh*-2qRGs+DSG;8AXSfNhXCt zh@_qt33?qVUp|3avXD;{YE`45L8*&;47kXE|%c0Dvy$w8uVK}i8CXx0< zJdDjeDIr$j%A%Akb&yp;fMg`6-HzRodEk*)oNj_8OvsLqh%{z26T;bm3IaMoL^Iz! z+8w3%C&BmHC-~*3FF)Z`W4}+DWIqPQmr4Bp{7dm7K0Mm{m!_E(o>_k@U;3AO8SPC~ z&B`yo_~PBWcTe(nVL5xEXXlINN;D(6>k&474PRdpLlA*!wISc=;A4HsqE}4%)W)As zm<8kc|J!@F-bQw8P4KS})j-3EmTcWE?}KVUmYvRvo$0c?Gk2YbDNqrVL^~AJCL?4! zpX#-r`>BD`jXjMX%+4O5pU%UaIsH_|`6Km9hKpo`LQ+^6c2ZJEsj5PytV@twTwGlD zk3Ig&WF}C?r_;oGmCgGSd%jnjPr74Bi@{NVb$v#bq;s`pOZ7B^ONB9B87)o%(QMD=n|H_(9gdOUVg zPh8O9G&l&_dkPU{<5N$rFZjt0y)N1(jO(dS`_4Z7roW5Ai7 zn1_@YE{(d98dN`J9h+90D$NpheDXWc9_jtW#-93Q$huPMZoC6kNfm;w2=O7!m+eb44FdC=iF`@>Z}q_yt>$nTRehzYRxAZ*c`V`BB$`DCN;O8z+tO z=XT3@mlMsMv=hfCZ6GKn}F_dQYw6bV1Ac8uwqmzm7?IQ?dVROe3h zXVPpbS?FWu?W+O=sDj6T4m56*DaDUlU~2d$)iXeQYFH?WHy9=#70(zLy!)s{nEZ1p zb#l|W>00@M*yI0Fx$bmnUe#HHBY<(^_^?KDz(WWLrUN<5H)b#xxegDZZ=32D8kMN4 zd^pI_i=SfvWFlaPE!Z?klLuc?EG6QxBC)V{((0J(cvXkQ;_?4hm|Lc5BG9e% zOag{hVuk6)7v-6c7oyFk=4*l?!Bm;g6kO59Z?4qkimX?ZGSRt30Yia#BNR)!->*Nm zuRs2*vLI<-Ag>lT&M;=-RLa|2hBA&K{u2i@;RS$yg;K%5q&O+K0^N69!>TBppg>0! zrwwc}huD!sfTMmgK|Nvky6KOK8oLmU0E10sKR{CJ2gPNqGi=9o-w4&n0UAkA-(iE~ z4W$;g4UDLATV3?gC)&oil-k-I;^L&6 zW=dig-17>Qn0y~7@#gOg6xD)NWJH;Z%)^!TX_gy|nH6`RaqgO_~72C7rmP z>z_X)<~OP8MetLT>SboE+uxGtj@R3@JbUDyp7HGwrd$K@(C1*2{r#{1bxG6L@Ip|l zPiEi>qb5Wm-G|X^)Hgn;2a$nc2;zBJd_6RB=#xtSo%KoRL}>_6Y&s=X3{4du2@_C? zWJ)4oTB+bm6e1uariA_s*i;WYFiR4-exfPLDVa_a6NE*catHi4666WDWvzL%>5Tdb zbm>W8F)AEg($*GH8%qs7MyfH@3G?GmW&426-=nGt)m&x9ZV&mXsn&ry77%(%+>4)QAZ-m4 zc4Bma_F^Y&j{|Zfal9=f<Qdfro5^jl!-eIDQd{aN149YWAsNrvd}v+vJ7d2)mP+W?g5a7TCs|~AkKYjN zQomnL+vF!m+EN3dHGxd<*X$I7w#jPcL4P*Z6Xx(ZE%bgUxr zst#NUJt*iDp-^f~+!KF-3TwJ-Cu}EifL%5UqJX}Rh^Q2i*+Q$?-J05wT4S;!W|GAb z2c*f79I)t;qNhrsvTjV}8HBksM45~?bvxS?9+j61kEiOR)Lve*5h|CWnn7f}#;vlP z8n;P(+uhw=ainKo4A`hBMaH6v@nlsnQb3bU|c zpchu`!@@RlpX5nV@Ovc6mlXE*r?$%d8AS^!I%Yu|xi1~o3ly|!3nGOIUf}{1cLTCY zJOufO7q9H^R(+MbCGc>#nfs#?kKvw$&cI8$aLSd&N_RsosyNV#%CawMI%i{%&RIK} zXgI%+MziVmu;bJY%Wi|Xl~NCv-MT}Ls)vcm&U&1k9 z7&>$b4HcTpIs1~saUcdn5}0s^vrmM3=q`j)QL!7y{q zo^Q^ki2r(Zq4=-Qi+@v)5ENY^in_pQHJ+}hZ*;PwzSNSlT79 zQbRsw3)U+JYF#ho$ofK#Je=o9D5@!%JkR3N*-)48n5@zzFkXFWCb0a2dqgbF{H@kk zZ2m?Idd4l6#&CxVqb{{X)CHiwGKX27!(1)(WSiFNqR~!>MiMHRATuQPf(Ljyv|=fu zV)t}3te+04F#r&SKxZ@S?X&efV@PlYY%T)U8@59C0 z>#I{Fe>YSZIr!EGQFSVxPfV?g<()aS?7N8#_B*maq|lA*8yygHxCxi-w-XgQ(wc?b zmC$#nXa8&*Ew2gX$f1#@ETV;M=#HG=0MBm=+B<=KlyP;xvR_75&<$L7r4Y(En(DkD zgeoS!1cYdfE^m7)8%yjb`s7wdjf2F2B-39cIsP)P7AwW_{>bfZ-ZsZUqfqZH=k$L~XyceeI73JEd z9aJwf&Kk8D<1G2vB2PiB)|^Y1bBZyG6=&;wmzX@)hUB@4GBrE$s;s_qXkCRzpqVN- zgLYyb8pvRbrCC>WiTC(h6l$fqd8j51uix()isq`_*G#4*)y0a3?xT|lQgzCC^& zMAf<^PFd4Q%}HvghVb$U#8+6!eFGw?EXxS`*_7DN_771xfKX~pRk5V*A2*a=RJ~JB zTiK(U4NL>36s(y9ezmJW(mXE)2$rN%K)I$0sGwVU#26v!VanbW2}}yz|D7uXJHk_1 zyay|Yn@-Up#s!s+jM^jVlvvKXla%IUur~?kI?KyXrBA+C{vKMFzvt74wBI3clTwvN z$SDz}5gccSwz6sA2o zhTiP6joTw6-5C&Q1>!~Z;-bDMYCZt|L0yIULK3(gfGgNTd5F1D? zkX}=&SR!tvT5HzIHFp_-thYW~KhWVr0nbK_y>%axH5oqoP({e@Pip@OZC-UKS&~GH z`is&jN=f!zOf2-NT;9*n4%kXsr3fYfdCJhzJ#Uqop!#~V&}blzx;$qmTZr(Ub$6u% zaH0-5YFtFq;Ts?{b*hg1REcmn2BD|m-n4BcWwPm!T0oj^j8pRnDHpI8%0Kqer9pBq zhD;SOYk{!p@_=4@ju-M24Q0~pRm5!t)Uy-qDx+dsmN9vb*^DhXi=G>yOT)8b0@!d0h>apI&yYXYES|jRZKeI8!7@3lp>^A{`Wwmj5z?S zLp;5B-6~cj3zg-vf>2)d)~}7D7s=LCf0yM91Z|&R$o&OuLVr?EIJ24cl>f#?KbO;irYPG9yPno!*Z=z zYSdlQXjHmor&no~aHCOgF5}{qlyQ`n^D87_c-n{MY6vYnlxLKuxLa1|Iuu5z-p_#$ zdsy2~GhU)eck8*EOanNpL*oarLF>qC1)3SjbF?RKEG4ns?`g-7%Gs6!&L7@NS>3rr z%~GjYKSTyiuDpOz7q6j!M*D~5*)p+cXM?V1{xOs4dQ+3X2KpK1l%IW;?+0>ZmAJ%! z&F?1CLwPymvp{IMMqa={-j?QzBye{H3tT!DMDDo?k10j}6f1O34!s;IijWiL3R^w$1nm zux5OkuX(+e&tN>Mn?f^4X~O4fmTjq0cBSRwd4Nzj+c#%wb_bKwwU(*=doTEhKS~Lm zEBaNgPflC8n$bD>BPy3FwI!Lo&-v~Lm`WpG8+MyUo^?;ErwLW8RI2Mee`&hbq2-LQ za=G$N17LkyQO)Inu9RxcoE+#%&d$zl8hO?|sh%cOu~M(+@IYHm{VP}Ih@Yba-8$_Q zQ)amKBV8>WR+e;3pM9k3ja-rEHjO;%o>Wg0s#tC2@s75f*;ziy^Bt{@^!yChexwf@ zGuFxaj&!w|zgv2aJnNoRPZO$GFVA`Ua&V+Ar~IY}`J5f;yj?@elCD=9c{$VddBbV# zXL_DK>z-9lQ|do_^F+fx+7WLx?tYq#xF!?sY=>Lxu`}LUD$7(Fv-15;oU4%he$r_b z(CgPHZwlz*PoFk!HN7d9EVyGKH9@t+?WEcK`Cg5qT(=_OyH$I1+E%-C>gs>mSvSj4 zi1CUHF_&|JsW?*!J0cv7n1HU$3b5G;eZ;s+eT{;m;5bz;ZeKMzht#>h{q_$?P-qJl z5HI;{@9`@RR2Q~ogquI*U?EzRo%_jUAy!(L-m#efqdq$r$cOE2~v*&DvA6T&L z(C@S7B*kwK&NbOwqVe|h3{!11xvNlpHEa)X{G-KY+JQ^P2V5TT+;QkR^}~Bq+iy;* z*3T2+sg|zg-p6~)3HDK?RBpUlVDT=VH>CXav8g_Ya-4L66aCmJpqB4SEyGpGrAnPq zd0mraDUAz0@)$LFz?UC8Z+`(uW0g!HFDpgPeRK@(z#F!SYB_`Q>UI0DUOif+3*p%u zs)2bFo=4A0h&!{ZmnxdSa?FdcA{$z@E%6G zk^4Yigka%gFDi!`K`Jd*NKEp~I00DXiA5r5CaN~@b8WA8C&k`L0q=VI`l@(xb$qr4 zI;Y+T%gNw|1n#5K+~(y!%rTFJ0Gf!ZI=(q?R9s6`df-+O3|mB;mr_$yQ}OdAh{T5Nllzm@g#5(-`Y`SSWN zS0B#)(mFr;c=h)B&Bcq!v{RLqcmce*Xtj6J-@q0pksq3|z8Kq6~zDK(bs_a+l zbEzXs^0e6|i)EaMA$C4?P`R|9l1!5;dn)OeU`_zw4$0_m1njLUlqtCCOg9QL3aL=t z5tTP%#+hLpHU-q@kN@2vQEL}4Y)m&r=u9Y;^&$4iKDvZ-0@J9lfE4=lWixF-okT!LWQIGjf)PrMyodMv$f%quiV6~38Qxwr1&0?h% zdO*d>19G7yneLu}qxO8JhmuZ6NwoXOocPgPh-Pw>fLBa3NdY_^XF#Dd6>!`#@;{Qb zy3o&JGFs}&ewZ{6{3Kme1D@&%8t|Mio<_`@rjdf*(P%ac4gvK)}Udfi6N+G>** zw}&;>Rc*b~RyTq(*3epG#~IqelwZzRQd_iW@O4vuE;g1Q$^+riUiIX(b0Gh(wS*Yu zZWF#awYNL&Uk~B0+DmAAvZMPqr*`bIyB-yT9r4$phV8h1J%pE+?2k-$_(umH(}Uu* zNl+XTBWAQ*fp`Ma9zCx+Gm-LA(RQ83U|ax#S{QTn1`tJ|~EXZaMarSSX?@>V#M=@6u+td_=b&!gPfKw+eD4QRZOI|U#BHG80 zu6#bJArs3zos)n#)#jpH@OAINsvIrr=KS`K^V2!sa`nSB=eKv9zkbd?p4)}B(*47t z3v!j5Z@CU;n)6p$LvJtgwOyRwz9{AkxnL<$Kb7`tSlj}a*H*FBY5O==Otln&x?`#p z%c|EqrrI%;?dxX8R6C}!E~&1sc1*RUOa=cep*lJ0YHuIJp&ZS^8c@JB3w5~5MA4#X zqzZ*ig~*ZtG_jB552vf6p$H!0R!Cal$bbCm$Oo#5b_m-E!5lgPw+;P7u`9Z0wUbrc zs`z@WdhJ7bZZxxfbn2u2<5wR-n_dCRvy%^*F68#;uc2-!=wSr)kOP?6-~OM!{npko zL5@^CKa5HE-+ueszoNY%mTz32cTjo1VircA@qh66&%xYdpn_aK!UP%BLtgEp4wW;L z-}VUvZKEmmF*IhQ1+|`tNFPqo$;Y?X=(5$B2}ACqbBqKDJ(3JVBKG(%@PK4kQ$VdVfTHaJE|z~3>6`6)KHfO zVj4tzAGL`?HGYQB(R)b}sKHm=D?E*>(T7+VYV23`kL1%RQg2D-l3PM01k3T9EXeooetr}SqHyd zcM9m2(_i4-^Q+G~^)3bjXlkA^c@=(0vk}A~iFC*heJ|9KT z|0bi_%JNaoVjMgYp{KWFPthDnK1*!fD|0y#UCHkxKzt(ZoMIi7{lNm$O=Ie}8uSMG zpg^+7%-D`T^u@>DiqPX`{wuGh`q;pL4)&=SlG#kDnMNH2gnQIiaz_d!H4&JV&Z zYT|;0155)*;feS`FBQ%*EXJfX!Jj}+IjT-Hy9xX7p$~mnDEwR$pf!$O`j|aTJwgy) z?TkhvfcF*30S@nz4}jmxyFn1@&jFfEQ*bdUp3}pnO-96*E0j{#P=pRgj05kh6f!Dr zd@07|4}3_N0?iBni9mM02ha(AFTrC4CCsJ5DJ5nk5HTQ`>DJV*3@FeXL*ua-MkuQF zu_8Q>8xEq}3+M5x3xmxu)WP)0FF?a$sJu#*?TO&!|0YVx4-_-A?mtUbD_TDsWqt9R3eDb>Oxnw?opJA zn=vJ2&H{^6jeR5n=G=nHrY^$~haA0_`BrfDR6j0Aq;o)O=nXM_ zH&^u7vs4^zimioYXj>?_XJ>iwkM>QKrB0}GUK-zCgtqU~g%ei2+vj#ma znV&f$*o}grlVPxl$7rECW5w$lcjB<|tty$3@)lKVR;cBj?PqB(JvV>;MXgDdk6(r$2u>{ct^3 zLm`yc&cViPOE|4!w^9KqcPqeeN(DqJD*AKf57m!znG?d@qHIJ}lmRNbKQ>0*oONtG zGDd~Z?wDvSbWAiSj)|#iq=Ykk8BU7!6O}8ga#%e6)oc}bh>UA>$}1HbuapMWjRA?G z-~pM99vHh+e@QE(fr=nV?Q`O!0$VcnT*rP$OilFeP6yKW4JJXRmeosxarW z%Jy4bP!;1VsknuDDIeN8d9{lApJ~Hc+aEJJb`+lA$z{O=C*H(;bP8>SwG&~2PADyg zuC!eFB6>uRfTKPishNDNXr-(@@TK!mn}G8{7Wpd(j;w-qGf^6t?_7{ZISC~5-7p3H zJ7G6v)hU}>iYAQ@tt>3L4_&G;s$xvHDXTknwh2S^WSqiCF9X{4@hUvfT1nt?nn(La(KIiJ~HLsbdot zo%+h$2m2!Kd5`v_K3!gf+P-6@Z?IBc`Z4ZUX&YE+359k$Uiz_k$q=*%L@r*mmQczY z&11I-PfiVxveX6;y&K!R3Eyst3;#^FElb7@nlrJ3^IEiHYl=Uwfb*pf{;(`Of_^L%ou<>r7E*8r3KmF~+fu*TUE+v9Tzm&_R zQuPSqDrr<34N^TkJginL-G*Cpo7F=i->)B4Ylq7SCZ%nBlxr+f!*o&XB)nf0gPaqj zau^|fQ0Ev;B~4H7Okx?6>}j!hNi*R>kyv8^1;i6NYZdl8%2E@^4~LNRy_8y>_~=?p zYtKL=2Jr=7Clbq(7pUZPq2d<~B&Xjahk24}I6ix1R^Np3OxRXD)rjm zep6K^Bb9{g2ho--;AFYsVXvn$8p$^sSH`j=k+PbQ1yP!`(Qkl;#$<86G98E`l8JS$^2ea%f*;7&S}9Ie35_ zqpe4vRhvsdYS;<19iL4LwA`@SPM~cyqgC^gxv&#xTg_*np&jIg)pkN{yP0jrXgfw* z1*5$`%?+pRZqIGyv*UB%vjvX6RkE4o^mM(ppOB!?kAxSH7-CPo=s{u^7U<$+F6ny5 zgKOf!?v4j{Jh)yStmcCSE#r3Rr6C3x4xtXy8SW!v!XNGigwF-Vb{x1K)1tC-%&m>l zR-eqiXf_{6l!&FXF(8v9Jx^_t3{-$rpr==n2M$-BnjM$#xO|(ryqX_D{^MEhI|g5Y z7%%68yKDAqm8<2$MdEugX`WM(K!Rs{dG^7n)Uezk4XDv5AMGx)ANZ`dui9u&x9#$n z-w#R1=jt4nWRI<3wLc2N(Zxwlw38+DnkZK*r5sDFABV+q(axk+vRoT(SZq%J`Egkc z{&}iiRux1ZBtM(3iLEBeB`cM~O1W2WmJh2va@43bj;cpT?orRF5T|$8JuJyjdX1Hr zOHMk~yQ*`#hQ5*4yI5H%ttuJ{{di`k^iG(T`BQT$=n|pSN~_1OE=_6FIjQggh>hv; zxWvyrRh1S5k6(R&ywME}quMy=4c}wjA*jnkU2g?%xw?+PSM6H~bo%V8N?%{0Ex5GT zqfY1rY9YwMp8P}g9p&<=sU+VO8CiS(;BM23jHJ4pD}6t&MMWTEG-#DToctQn)ra>N z`VVs6%@OlH^DETNhyHS8Uw=6&m*(<{a-_cm=#QxU6B?qw|EK>8)eg(08rrKh&;>ny zRX`*7@EML1cvvNRSox?{Z=k*M(Tg7jPpQU_t5ljz`MAoHk6Sk>bKG)9EUD4V3(i>C zvXfl3JUlAr*>N_~XY7OGn3E5PgplcC(LrBwS``X;8ZQPTs+c9c$d;VxMSQ!9cMs>c}{3?*yF$Io1{GF zsoL@K6DsYoRQ@YPaGMwNRFYe^oGzF|r72ezg;^KVtMCkwn<=*RBc@6~TNQ4)yr|2l zTq=}GyEFU3Gn8t^~xoPvFO^>iG6SnAqBB7G{(qnr??BAv&B|tx_Si=3$Mvy%NFo!?H^%PPO7z zYloG}QLRxXWj9jzS8azS4xF^Z7pI;62sYU+1#)MrWt`V81@gP*w@ZQCr9kddAeTM0 zT?*tn8Dp0Mx&0?>mo~O$<8>F%-ldK0(#CdYcGJ%6E^Ta=Hnuyln{;9~KW!|{mHjl_ zxJs3J+Ra_5Pu$$Y$FC0dsTdLgc~s5-`+X88Q7t2X>S8jYLOYEHjeXlGWLY$YWuuTg za<^B7LXM|UfC+f{fh1@Yc0GkP3*h99XMm1Z5?wT6aM$83xnD-uq7$RXzCZnCRlE4J z24{8@|4e|V;jePJf)p|^3(?361v>fo_Sz&j_T^B1Kus%;fQ1^pRvw37z}%-;v!HR| zY4-Kpx`mCNSZ%Hz9Ad|Mb`oHv7AQuH2b0ViXCRr6tFjk7CJwsl zw2GJS+ns+`M&t7S5;7p8nXY@AJ}^I5Z1bE{FRNu$A0PikDe+0&-RSD_1@i;+(>JXf zKOE{8)Ej%Ta%@Nh6E~Yn(z&o2gt&v#Td+PVULki`F^vbn%^8a3UX2t@E_q{`Oid+1=Nw z@w3muF#*!kiIYURQ$Cz(oA|QTF@=PLD+^uQJMxD-<|Gc$8BZe_L@ciMSan>Y{qoP{Is5o^tSpf&SlcoEO^NHaFTs>B+URGYQV z-1%{#w1_X287ClIKWSdWnWgL_7{sSz0&;KKYpF&8KRgG&rFIx%EgR8{@IiZnAQ*|C z4h|f_oqc(a1^azAK9CorI1r-)`L%<3;{YG<>VdrGu=lE+)EQnxiV9qeOLh1 z2b`nj0+M_ zsQ^)?k$k~-`LEgOR&N-()f+pyWv5%UY4}aP*wHOJ-RhOHrki}Rqg&Rgy)Ra(RYkWz zzPR1dEj!(s5#5?Qx;=w#wbGHMn|!gOTXwqD54C&?Vd% z%TBkXeB042JKd7|Ct2a3H@gh zY$x=eNw5tR`tZ+_RfCYzaq!e<^+nkr)kG9I#0b}R`*rSB2EDq`ik6-&bX#^5E5~Di0{!P9U`q8la=w~0vk&&FT+;HN{ z{{@ibj3(cK=Y+n_Spi21fBapeHLITQzeBc>{PgjwO3{bX$v6)Y_2|7^nTL_2B2>r0 z8g-frjHwpuVcsW@%oOJ=#RYMY?Zg7+uqdOE4Tqs0(QblhE%y|FqscuPjyzI8*XNys zPUrlU&c`toeLRI0hCoT0O|go}*nts%EF{YQ4JdgcIrK+JVA)mY{l``ecMgo4t9u}? z-4(x;kh2a_5h-Og+Wdl6kLy-9a@W+RvV>;rm2&Cj?UUD=E^N8!xNf9z)ST~!lA}f% z3zW^5&L$c-pJ%VyT)la;JA1pcw>x|JX~4KUd%LsugPgth^6Zr>t9R0;GFo$q9od?5 zb=x~`TMM`4#<_N@p`gNXmitTlH5>rLs60kFBwWGOSIGds8R+rc+pxRti zBfmR*t2=yWc{zMl%S{-j*=??M&W_zyzRpYLJ(R1ZdQtLSK3L9j!;9+yLCHl%@zi1* zeANM5h>P#|aqaw=vj*%tFWV3AWn0hyefv({4m^2ne72yG;4=6O{&_P0uDY<}QuQd& zuATOMtTMxjemI2WFGvboMn+vH9tkBzN+H^!alb2d&UA%S*wOZ(>g z2X`Bsu9iGVE5COZ-WMC1x3+F2;?zCqw9wwEtBOwx=+v#%n)z^MS8MiFie_mch|;>b zCC6n8zZg!LR4NxxROOu$eyQ8#7ro*gx4cNKv=y_Mc59}4m}-WV6JD|GCNTJAja=iG z<(OZf8~#-XTH<$d;?-P&J=-jm7d7zRvByI8=qwvBVaFxk>GfDQm#8bphl;ErU~drg zYp9yYPulo{X`hn|$a134MqEJ8f!;`SaxH|PtQ}6AT)OMO!kbjEE2=`UIAS6w{u)9# z->+fhf3WKE`k=;DoHiL3O^=&GgQYpZpp&?mX(c`jS}{F4sk8m5{R+8^j$!KZX(QqU zP#p?xyk&qX)GTL6z)2`pN-xhBv5l2mTLM-tbUu3V0@oUns#y*f8)_^{jr@iS6FvS_ z)$tApc!#B!Q@2I|Q4hgoLhh*u0C7{GF2SM0!jY1HFoPbl<0sk-y)pus# zOVoGy#8ZV_Dn`twT~!zi)y7VI%J$JEyrBR_<*(ewuW*ft0va>QZSRTYv_XRhz+j0` zTJ0Gm0Oe@sj6!8L8B!?zj+VPvW+K(~ABwf10w1%-e+^KjRH@C~<=^SJep(E_0PpD> z$GES$eBW^xcOx|f%FNN=q06Z|Cxb_v$#>*pZSS*XkJ`|?CBwr;^FFn6-E!oS2mpjh z17tV@sQx!B224eLhmI8N4<6G#4&;fJ97jBXW-nd~#I)>gk{3Pcv3oQI$Wi8_?}2+? zuY|YkTWJqC87xN6-eX++ z8p2%wPlYc{1p4H8UHKCs0uehE;X4D-}fDfMf zY!=mhN_DO$RA-IjQgn-)K*J2|yZY+NsxFtG<8g>EV}3$c)1xh1^R(KZh;36ph{1}A zm1QXSZxbV|Op%vdW;AzzZ-R())cploqnKk+-!GYWH1y7-wTqMd`V^G8Vn)w=L0+t_ z&Zo{RrT73Z%g-ddKZBCr4zgWtL;(%$(ovgR33-e>&wm3 zsP0la1=NRi0dWNoLTY=45}FFoKSxr5Nl_v1Eve!?)gs2Kit<4+2@5@J=p*Op%DE`m zdWR%;7#i3peNE$rIdVamN@79_9;xHVg*tc?ggkD)P+;wS^j34A zJc@kwET(WFu(DLxjZEl)Uu~#81Mynb!BF~_{5jW}85@oQGC6P<-q*dONK)t|+AuxA zCP|V#3oo-45z!i6=Fh$qRxZpO4)rv`nri&Sw7MYaDI)qt=esA3IiG4H4^!7TRJ8VC z^wh`SB5A`_`z#hr9;VDdAb#$N)Q0w7Utj_9<{3a=F+miO9`=KKd8s&3un46f;ZUQl zIwpULV@C=}WjY(Sf!j_>8sI~;emEFy?7tPVBWb%Wq_xQU>hlzP0_gizW8mUot($&s% zYm?&o@t>6t_mn`GW?e<*UqjH5;ifYV32*9QaxXRVV0_3O7CHk>AvrpAh#_!~Vs#HX z7`z?oI)^QYd>q=@C@Ab(;&dRaHU|!ox>QvLo}BwXdvlXlM=X%9AhQp+L~gHA5@uK? z_uF+k96kO|Ny9IC<~=x12B&wV`pXI83++21$%7@}wG=Uu0+A9Hcf^xIMaddhT~-6a zVUOVW!3fliWORIXC8tZF1}C==ojT$d1IZY~__CzABahQB#VhsA;x+C^&M)ACE_iK- z@`GUX=KA71dSc#*f38eBr5;6MT5iM{T+V+wFC=h@VSBK&1pCS;G;JCg2fm#-7~1!) zk45x-APmr1o~l4{vC^<3&DVU@jH##^0>uUM#_C8&d8Y;hD9u3QAoszu822iiOhbTg zaRBE)USaaPJ*>TtQZ1DSZe{4si7Y)~8|}RQA|6O{VAL%~Boy+latEuVVPkEFHtY-RX`Nt(mrOWQD>RPs3g~9B1*vQ3FwUO*I`i3(M&xwJ z2u|v&LgYxn(OoNru+dH6o!Bj*^_YY}p3zg>&?r*MsPdJ+UpY*q+6%WkcCr}#Yo_yw zxt*l>3*j<(C5@QYI|`F~63%W~>?IC13wuCKT~DEasx_^ZdnNjvcA6&dN^?W2 z2FBWqSa>wxTtUr)x-7rQZDqM9_*)lfV;nDF7smdF8H(x<)8p@OeQ0H5N{x>(-L(xW zzxfr+Pz4swd|#24sEEIiUvNzOUHU1_-8Fy-UW7NuUbV!0{fgXl*+ zvAb#dO=Y2e(@5$!3=E`j4f>54I1l>GW$e8lJu$6`M^}WS5x6$LYUNe=#g)@r={xd~ zfl_pgZ(G`Qk^$hcH&Tjx{M_nXqE74LLUCJC41rY$(KV#Sj8Tlmh?=lQ%$+lWJh~#4 z)FX)nM7oMMt-HaUqGa6A#3AHDbU<&SxxsJ{O>jUSSyyrntqYY;Q_cFLGp&xfw%eTt zM_;aEN)qBy6V+2LmND_zXhfm|9g*pAaiT4P3>|s$;!DQe1Ss~wVVJyWR#N93E=l4&=?p%SV<3`7`zNcXbi5AS$P=Wk>E^|TcDh3 z-pwl?+owKK-fI>0Osu_tZXyLRx^;;kEA2#Ok?9&|V0cZ}A&5iHdeqxT z?}&;Ksa!3rSYQ1DOxzH(GT`(0haNG%gU3PAwVsV1xx@H#X!ZBM{@2Z6MTiialn?49 z08*qRQCWktHjh-+z=b=J%mtH67>B)QYqMLqGH4rph~15N6N-r@yz5qfqz@wZt{mJ z;G;cdW9>|n(pAONV%uMd4tUH|YKl4_*w<{V9qRWpg4)xr0i^?yv3(P9**BWvutaWw z3gD}N8z{Z%bWZ|g=7@7iiO8{{U6fkoh{8RyscceP@YsWCZ}DKX2bUAYB5_^~?rZ-@ zx{e7EgdWE+!W5#zVThIg#~e>i^gvYaD42xc^cGr!jQlTggh(XiA&G?B6lVv9AN60b zYNf3L*I^E0c*?C1;K1Z>D@L3m%2eXrhOq`5Re92=5EHc>&+NGpW4)dvRA~GQ@m(;2 zlr5#&>C;J9;$f+oNRgIWweQmVA}JP&O1%dcE-2PZ zNs>0Bp;J^u?c`{y651c&B7t-&c?GcuT2bC4pjgB)(#SvJDT5=X3jClDzo}etCY>rU z?@E;z`w_$?xep+zMP2oykg73Jde~eGN&(@<#%L z!M&dTTBT+6*DB==CUVsk(C^p)`>6Ba3Ib~U-i%))Rg7A$6c=Xj1rl`e8dhIGzi2id zNC}l<=w~CR<&Jt@PY=E&Ebw^-018%-_u{nAs| z5_(=hoeJ^L8RmT&dR|6-$Fi9->_@|I30bf3NRjm<^dS(IiKe!pxG>Z{F2!yESk*;9#a>c5F8Ao2G=Lq2y594iHfsaJYLGxyl#>AjtzX&#+)-RqtLT#&O9)M zB`}};yrEqCjtml{JvI84kn;iu0b%G8(qA&s)3Tv+QG@X>w}hG< z(!~ODUQwS);|*scsbxE-bIGV5)L!1$EXU%s6Ob{K>>9tvF~%9ifMvsH>~`hQTf(*P z2q(h_bjJz&`!yoZ)epBpt1M-IP1luaW{)3)WpG3^({fcXzO*3+-3<6!PG z)S;aA!%QsHv~0_8>IgOZHcG#1HpJo!`pj9EWYZ>_mhGV6u7bBklWcj!$LJ*N5;3^V z=09s%wtnO`VwlC2Q1lA-luwcqlI>b<+D4yJ6Hw#7ynkse?+E8IC+<9wq!J&$tcm31ruN-bbHtMpr@8vf*%hcPEG5pmVcOsb$=SEUS>wSozMG}Xbknke?-CEP;>c)Q;ze)$K0{YH%<7ju zvTPVoIew9=@wZXoJ)!&-eTHhejO4X!O}P9{4ZbDZdcmYbLjOpapUu8MvTQvJVf-Q< zQOdVP09;}y7rsR&cMn;4)Upi$MWTEpr@^+xFw=plwukv`HmCHFWi!Hs2{>x}BHm6< z0=~rqXgvS1k3}{&^^s+RBrsE8FoP}O+!nvZE~V(t_?C?c6tHI@tYvFQvMqJX_3gQ| z0``DKh&s3%@{AXkWy@%2=1>%B4jV+-RO(o^b38)%qFBhvC12{IEt@h@F)RW?0}aB3 zNrh|L(;`q81W!?pAR!>3iXm@(}BzJg&KZKxb+>8OY+fY zfFd4>Y(a>6$+GnT71%d&8XH8@RI*ss_p#6Xhan3^aUr(cx>@Kw9&+#-W7-Qn4-c}j zkYyF#C9ip@-(M8$-&moiQg~1Yx;6GmknvKntj`OWgNUZEK?ijqVMh;~WxPl%TL3=e z!N46cZ(GW1-avD&H_&>5XY!8JOP0-xft+6r%XlmI2;j}-HmK<}pQKG)E=%rq^Y?Fww+b#Oe z%Tw9%#kx@og-_VQoOoU~L$6}lq-oJ!Eg0azmJs!t`E*D*dQSxw%y%=zYwH!;k(gUO z{FV?^3VhZnk}*UdR6Wb6Vg2Ws68@Li?^y?VuZ zd}O?pnqJ)1i3$Pj>od{Tc5K99-a`;>Pe?dGE%2j>j9DQS%chA`?gDYM5Px8k=y`&r z_57IvtbI1~xnjG9L{8vNkG~}(eaC$N0d<^#PlKSJQMapFwnNk;CUe+E>Dr;*m}2zl z@qc*P%#x~QvqY!~$X{-F25G%&yR$ELZu>YO;;_1A%_nuWmd%5*yo&nWGGC;^tXn2s z(_zR_G21b*Y$60OHv4iLE~OTA-BRcba}o^D8}dN1U7%IVX2w7swlU!W+oTGCRKnN} zUW`W6Ti7UVZ7a2{NQ1<(ohDe*1`IBT|8)v^ZP z3Op>{NGT+R&<2U1MYFk+f&;zA9O4L>Xj-$ZzQY81di*URX-iI7D(hG(%{OG6EjUxN ztguU6-3-4aM7_kJhc28p_Om%dYL*p!Duz^$5#CPKu9LBgZoOvNqUhk88|+@PkZ-h@8 z;$&kU%O*&20vpaib<38-HSJb8T^Rq%l^{B%flq|^EcMDvtW>vbBXsrncXIp<;-rNl z1P>|kyDSqhUA=DEM2JV<5^72%gt+K}WJA5G*Dad{H$yq{_x2#n7e%9VI6}N(RztRK zJB>-0(YH~zJLbfP=9wS={@4G~X1>p|nI*Qd=tCiH*w!H6Dab~Ou4#}B@V8#K9o~Qm z1i`kz{X&Uu@lyAOe0@W_jJK6#D+C8#cu#|+RO+u%iL?z22)*+l(6}jDg zP(yEzZKr$xUJ&TNl8K&{Z4P$`LpQgjg+$9E_qvOOG@5BP)y6iKdB6tFU{TMO&9##; z=@4HKnk}8!HlTSI%U5dnE#cNr)OUyGY=pH9$RYn9rm?9)FO^1?Etd;?>*LPp$2FhN)TP=k|Hl0G3*oF%sw^_p)_r!) zDIR7!E|v`g82E&B0bNucn=O$`xT5P;ygmj2L!Hpe z=pnF;`_1I=0!H5;R!yUeb=YsrJrCbCn$3ES#hmW0fZnkI_R$;W4N32Y@oeE(+wk9b zAjhZM(iq?h^hrs{*PKGT(rgs9toHLBr_0f1*QI#b2Js#e5eEIx?=LKr!YNsJzd*Jm_x_J=2I{8*IGiv0~R-M3r1gxwDW;>nW7_ z&dKA~o(BbvnRv-Ih(U~OZKM}uz(pSC>e++g$`+MQ>iXTv&{IUC}D z)wU(cw?kc@JfJJuC6s5RsO`?S{6-jkXG@5BhP#{+s0ri0hS~J-hHdQgv+hH^v5nI7 zgp)g!;_H3MMp(;+j?0A_e1mv3l`OVF35iSj0I$0vXzEgJx4crV(gK!aqvMMCJ|*b2 zhl8xm_8Yc=$T=JNY$+(j>lQ(m1M1Pyh(NKy)q|7C&D^k!Lq0N-a0!1{SSy`3X|!lI z7uX9jc?BD`VaSKrt1cyAw@N{0*>p~xJfI9dVK!!2}N*dO2w9VifbbuDk=9tI}Whk$;H;?}#?0Om7Of+l*X-Cs|gEvXj zOr?xv9X#}JeRk&;L-}{H$620Bcv~JtS9l0rZP0b=-~QXl>G|o0Z2V+f&-Q45h3jo) zhtEsma)wTYgXMY6C-y@ow!|eeR^@xy2{2>mhF@4A^hiR z(>cm^(Y92hID1%FY_o20)L{eE!2!$WEU=FI%?1Jn-*m>YY$|ZlXB^94;zb#uxspQ) zUb2`iE!j4Hw;sDoAuZ9}s6LqsB|FDM^oETE89m@^c7kmXZ!D)Uh-R=sWKE@wWkvrT zrbBYZhUCi`<_^W3T&5}8#>@VMJ(r%*pp+TSbKQc8-eJHJ&U%6@Yui)|*xlBk7=NNZ zb5YC33XLrjJuNHgY6fNkTSCQ;S8$`}jx>#1;M>zC~chvJJ z9t!3c#T{E%c(8Jzmr4Z7`ZJGhh5sO5=)G=qoP3bz}!VXoygSZR~$ zw-(LjjAK7QAN_vTG9TM;*qq!2+tQq-9dc5yW+J0)=xj#~y$m|8OTgI%%Wiq}s&Y>K zFwfz*mMhQ+zLU35HZHPV^^5)f87IWQCPVqdYaE2zl8W$I-|y&(JY>TZZrFyyK9)03 zqi+dC`?#Ae_rNv)cHiObZmUF{?J@!^9MxiT&5|y4t(KK{FQh_Xn%R50hJ(_Pce9T! zupi!Lb?@26iXPt=w+E>4lCprKGmrk;|L0S3N1be)9BczkkNO_{VkWSu(rD4tuCYr( z@dbT`WFUZ;%|>O*_CcU$aTiTuOL+JL7L+4=i_r(1v1HvgMm2zQZkA9;rHbu#LL>;J zNsQs&MVUS8W}tH{4fZ!UD{xA~Ht;lz|7I)29+9`TL(r+4(M@X`qMFEoHyq}?VH<1u z9Tr3Cla9Ou7Pd}W_o;00&_^9Q#x52aRXy7<(gDF^>{GExEVO7ge-1_1LuZfwlr7)M zHiYy84BzXA8{0;Ap{(QV0ou%o0roNho;GX)Nki7u&`e-U81@>g#?P1h!OtiGEE^`l z2!`GgYJQ;3EqcG7jgXdY4_}T=dvw!PWZO8<9JA1?HZ~?Nr1gc6A$sdQ;A|l-+n~6dZwD!lW0FND7dp&;~RUJuRCx zdIDye+ZacZ@^c=Ow+($exx>7)LH6l(&+=oOJP0 z@`KhbOW$G0^0;D|Gp}qzU*Et4iqs!dLD{yLi^oJt)vV48+o0K9;&->mk?{_SZ7$^% z@z7=&yHwi-)mHUB-a~n#T8=K7&F29PRP&B=+|73EZKG=6!3>~xhbL#Sje@o1k$ZH8 zAN-7YUbaEGu^fL(xb-#kh(}|EFiZT5@i5!)-94CuoP(#PutAhfC5~mg=!S&6zmO_x zTd8G>Me6tLf_Rx>GuAGKOjG&yArG=8DA~rk#t+3?{IEd>X3=b}*$`dJmyGdjrN_2` zuH^)x@wbGe%yZE&W0cx9%C$?zgyU^;=P*E(@*n>gTgc;p)wlS;&M-D#T7WBAd%)6Ll(BrUF<+5sVmhFtLP{VJd6ulz;<5zS=!mQa2 zw$ZFx@>OTkOCAnwV^TZv+Q!c9hGe=4}onvEHw?A zKqF;2rX-f2?$savP%51sH7ZBtKSXa`a(J`Rt{xqiqBo^VAHciiTDfHsB?kmc(S1dF zrkXQmk0ba|Ab0PNe;{Mxn_-{)dbvFLzDs&I^dg4tF&3o%q?S6w)8DT?HN?}iDouXU zqg;G@PL=c@jQX7~@`J%2|4?o;YwD?Y@^$%0+8EI{9IP=o_)~)Nl1hQ0vrI8TK(&{K&dUYgBIHDcwC#yX-Sm8ufRgxP*wP^ zzuvauyDig(EBXD4crq`je~U>|YhCmbIyer*&MetSYt zoDd8b4wvJvKNZSKWzTqXay}Kui(eZ>rCN9C1Y&vuaevK^;rRX8>H7_%HPgq5`|}_k zhJ6%3JpL3x`tL>%e~KXacOyt1vd&kSgTt_oBS=3*@Tbo~2toEKfE}niKgPv3Os!_^-HMf8VxA=8qJyw`}o&{mVVh#Sicurh#J3 zwr<@b<>}e;7wkavVjy~6Y2G0m9Kw! zzj!57d58pHf1b1SiwG^LVfEsF=5zFPe!&A}?lKjqHEZ^K`hMVoEq?8UqBTz1rq92Ugk{V=bL?hpa1gn;&)aqZq$a!1wdK+oo*>g zI%n~-$$aU!~3u30raMdZRXO}>CqwOTp7h?B18uf%)0ep3}KdqFi$BRw5Ie=WWT zDZ02ahOeZ%Axip^^!fJbFV2HbP?8l-i)WMdQTbuExRd<(d>JJ0Wq14rX(#}YD?-Ie zfj`}}D55^;`1uyjwN_SH7}A9XMF0OmeZ=YW$^GzVeshY3V5BY?Ki{RAGvjv37w@SA zK1M5Kv;6ra-Za_~H3-qAhN$a!`4d~NwFTm?zPx3qFWI%SWx zD@HoMfXx4S|88*)dhrH?szo1?OlLm%s@jeLdiT3grAPa2WL2b9FY7d-Y{ktsjz?X+ z#6Uro`V8@V&@HW^PKkY-j&lOz<>NG&VS%1{qZRkijqI08!6MVK3J+pm?C4X(w}uKs zVY=gZoQyLp;1l1-0sE}FtRkvMCG0s8fBw#gaUryv+IqnMv@ylTB&W+ z^`$s&TAHY4mU02?6HUisl21rSwIwm!XG`*E$p->3kmcL*`jjjKfZ^wHHYO<^?Ah2C z+;|N8bWF0S@9G#40jbZGdX#_y2tb7WDeK`3J0hk}y*~P5*k=POtc}3I!a!EyE8=*REcY;u zw7JiTa#aqb)IcKBWXR4WwChmpawonV#m}T{n~<2C{Go3f?s@Km(m+nN)GKmZH5C3M zryb*ON|0~U45#f`Y3uU*>t3j%!CA0#hx9H-G)-Q+i&_L;|* zTJl;^AvgtDjcD)AW1_6M9f69JObp|8eF?X1Blux|8yzmV??hJVEfuvnTp78KT&6Sp z`75u#pT<*Gj3;G20iysG%WRrtHLZ)3&Wb8wv?!Cfq)Qax!rT`w1bUjj9CT7_lw6gu zMv;b<`?4a=z+UlXW*gdIz*_hO&^cDYKP2xQ`=CJUYtC_w76c;LRT!Y=zEIgYR4b_Y zX)twB!~im1G2$8CzrDNq$D5Q`MnArGr70%TbQb{*z#Nr=Zdi(?;3F$M2JJaTRBmd9 z0cjBs7=L4OO6}UwuzigUAHX)CtJ%D2 zl(@qHIP>Kno)ul}ZcCM83mv-9+_J@j`au{eB+{4(O785i$q zUE`3onXg3W4DAQ%GC`2&Fwb7n1E{qcQ95ob~XN9k^`x)N(n^%^j za3r&U#+_d)E^UTl7bo|n&YWYV>ou*fRj;Yw7yzff9xe|6OG~BOwmfdCYi1Z|w&vIn z{k=jV($YX+^>H$)fs9hM1Td_SsOkVQ)p%T@5PEq)=*=r-?N3a!IOf&YN$ni1TG}1e zY|gQGos+;0$Xvl#oNh2+Ez--OlbavO4XYZCf)xs1{pLB?hF#tMFAn{e&n}B-!1|i@ z(u}=zSY5le@Qu5>Lvfel?(XjHE=7u4f#UA&?!~=0EQ-536nCfZYWF_(>~p_+zxVxP zJ#);gk<4T!BhO5JBMF>^5>CIik@s%NaW;9*?i7Ki-!fDCwt0nTtceA@Ve};T!ou4P zD5RQU;5N6~{04KEI^3|vr)}9Kf#4T>O!i;#t1NJ<{7j6B=Z<1&T{R+V|}Zf;6QWXuzp46CCq(9}puuxyZ^hDAn00 z>n-U2*kzG&uLs|j3>ZsQ%d0cHd2Q(1S2<2^(#6mkPL&6vO3te=M`QA7I{)9E>nxIY3tq|x58NKz>TFGdF zX*i|~^Npd!8$%0x6w6f>5!<$TFdlE`#Ow)#;W7XPHe&CV6t?a(WwF8#mOxGyqCps> z`a3EklMmwcWc>MP=#G|N;MdR6eQZgg&IC68)HQ=y);r(wmHOUL4ekd zo0kV5^nNfbO`WJt7;VT06Mt#uQz}q#p-X4sbx^`#7AG(QFK$D1l~rnu@FdVO+VXM6 zh%wo&bmf<{2_>?|$y4yjKA6nYz%bKj0zHHeiJJib4zdL&>@nyXQGhEe&~+NZ+bYvI zAE6p9vT4!%UU?Xh4(h1P&Q(-hD?J0OZ50B$Ovr>Ay6pF05vwWj5tl0@hx=6mbGq8DK*1D@}X83 zc9W$#fhC3#v#qx81iVwXdDlsiATvgrWV_Pcn0ac{s~_f!h2+ODXsD6k(Unbzh?H4( zAvUoQCW2Evk|cvk-nSwPhFYNiMJ^voSM@Sh$R0xwL7jODCwTN-s z1;p5=I)=g-Ipwl1q;Um0wynmog+JMllZqBs&bDzdKr;azL37|$ycY3l$9sXa*?8wI zh0jQmll!D`xnnjsaF9xdf@7cZ7^B_Y!h#`p#!1Hq6OR&9%bk|A18d|@Q`BukMA0z1 z1?DZaQZZ+{P$JY`Dww!q*xH4RM-t#S?8`BdqzO?jchWmg)QQ+lL8f_FxfdH^r0;FQX$9S5t-_fS)zx1J9S(Cfc_Zw9I8+6&;!ZdccE10KqQr?-I$R%wgW>AtpKLgXg>bv6&IyOGA|q;epex4^I}#L(>qku4{#z{QMyx;q#Dc>ir5Mt?A{epbf%lkJ zA8!P$8=(zh-m@k%Eb$mIqA5s*Y7Uz)32eRlJ{_Y4zhJUkOllOHW6F(LEXV~DAMMs= zwIVK3g1|Z#S-0YEgY|?&N5}|TZKQ+fumh1{I>=fUA%-202b=EF z%M-uZU`B;_0($~3LHJkc-GmkAI!BW8D&RKtI(Z{6qu?P$84lc^t-vJbD4h_38RH>< zO}m9@LIchs1ujBF7$b0Zk9}2}z+7u~T%g^+hMb2JzNi{Zp`YC_zswN;P7CV9fgmSI zz=vYBkcWvr^j%&_tS=(qtXQ2YUaRTK{DaX^Xh#_|RF!8QZdHCman|cA641at4<$+A z*&K|TlZ~s%oHE4Ri->O_ATdK!X?PR7%Mnoz@)8`;XtIl9wkufUTw(>H zM1!vH|4?xAcLqUX_-3)h!l_@&OE5ji=fqsHZ8DxM94QiqX>H`EZd#_!#Zwps&RV&6 z@VSHzs?{?OGn6GNJVgcrb%-y{$&r5E+|YjJ3P*g@f#|C@?szl6RY9FZTAv=wo-b;j zK=KlZVvo_&0orhTmpWXR{xOg}~W#8_uGwjZJ!KbjfCtCYkN z8+!eMmls1njDpjFwLPS?Llt}Q>ac%S$pH5}OL4Fgb*t6Dkn~O^je9nx8v|es4oRVo zRMbZ`58G+wbz6q_{rHeW#&`=7z3yJ zp|$b-4JYDT1nE{2_=1BJc22?4^!V&}bDLYAgj0ABSGRib z&SeVew@wU%+K(9g1vhb|s&5I7F#8##)>&vHxGmWmyH2x_y)3beajPo!by-=dknSJO z82hG~{m^Dwy!%{Lww(yT(3(^6%iR-hL#-R;Dh5G#kduyXhpI4R9wo7uZTbqT(@UsV zKrI4?xVJJ@3BnQ&0#*H6IvZp*3yc;>yXh@jI(KK37(G*Vn32H_0~{S;6MS;%ry_iZ z>C4la*Y3H-b|VAeR@v8(yp@7dq|}zp4V*l`Q)_*gWL*7*bd+F&0~N-A&ZS^hi(n{C zE~$DDxO?(|hjDHf^xcpe%wVaT^UbC0r!tOVJ*T1aY|T?D4iuruC)BerMnR8$EmXLz zZgh<7H4`0acR7R8q-M&9MpyTguUGQQFDCBM^(DcEv^vP(g&;r28+DKear&b}1LcQl zH4QkT*lg?~Me2&X3x%LLh?+WQ#_TJQU;DBYK~1z5Y&c)#6TiCi(b9EY*pa91UH*Ku z94vB|=TlB|EoU0PEf)(qQyW!>_=QfZQCDL>i*}BL6jU0%ciTT_S^7;4X*cztPGyS} zp-jDnI3MM$ytWM_AcsJVCiSh_Tb8HYWT;DKQd(-7J|B>JOV(0wBFpOXLR^@&RDQRLzlV?aocgL2oDvO;v0Z>rqie~tD z1;HW=Hq%(QzSK#i)ZQoq*|})JJcfWY)#hlSn1?KtYUC3CGGH=e-Lw}JZ^l9?ixf9~ zG%#@J^ctAa4_&09(lGYja6+mRr!fEfVwmVz*)bAXyQZ0ZOA_-j9*+%1RML}*qGFjx z2cewn>OC44b^FhD@4nVnYqmo7?K*h!(vg8~g?nV{K=wL!0Qkod`{0I*r9dRnDpFnz zG%r%rVHrhVe$F>B#O&U$);Nt)buTe;-ViU{Xfh4YSkRZ36|K-eior+dm1Vamv|y!5 z1Rku}nINlavvnTJsOVX-jz}trUNy)E9&h_qzY2r>8g)5_*{p~eFvZwP92IYJM>0Sa zP35AWoYR~;mqhfpHh)Ut9{+Ab5l3%icp)hW8QRPM2XMYNGr+~7Cd;e0vD7vd%6)DR z6%5@Vgkef!DNCuSC7n_11!eEt*VQ=-Kd=bi`|zls;hhCF?qru<)ZKXUT9=(1uC++n z4c;!8iDqg|qm>lDsoloqfqyW3!Q_Cn89M~)S-h7}>*f0hm3+6ue)467cPjEhZ3YwH zfXF|{IK{+}_(v_bENL^EW2G#CX2-i|0?2WW8pc6m@7{7>ez^YwKX~O%+ zeUEc6plSVpSxO!=O4kQU$Z{zv*FgE>y(?lw5FHg~;eiia6rkQ@4D1R0Ph|^VGHw#% zDonn6II^}DIBET@v&3ENm7Qn-xkNH0;j$$3#5cd?ik zNem%Q@F;NO0q02)%JIZ6F~dHzZ;+QZrBM`eHkZO{`qHE3(SsG&ZeZS|_S$IZIJNr= zXH7Z$rp4hQyxT?wo63QT6wGhGgz{=VuF+uuyYwF%Sl}d5<}eLV&3PNl@f1aD`8)-} z4xDr1nz2*JC@-E~(>oxSP7&*hK9A&ZN!_&FC{i+f$k3612;28i!q(A_q$C_%(I$1ZZCvqW*fFj4TjemeK^RY8P2pt#VpP=|#$r;TEJJ`VAA3rdw>0D#0X0 zJ-R^L=5)2^7CnC3sm=$Qnh)x6w@MOu(COA?R1-oRR(;2o5Urr}`!4fyGvnK(f9o?9 z8q)QE198~vwP6uKA=eJ+eKw~X?&m15&j-9D#{!=r>o9TJiQ-Jd-xA$V>oh$n2i(bI;9xNk>8G~d#eSALeThWay(PEY5hrdq@zpJ= z44uP~(E^S`dbmwnXY6kbwQlovaYO*PnPEfYBS(?+x^GMl>$Qkd3^KKm~D z1s3+Z@6fHn&4xqxX7GKlmTQ-Pj&-lr&HhmlU9|F1*v5RM89TvR$7S2y{utOf1`mU0 zsIJ0^xl9}@N0CV*-p{8P7Tifm_h*UBe8c92A zAXdlTboOI$mFhyWMe8*lusAdszi(UM{Oj_^o|u_U;Lej-w@g%E94k7~$fFz5m{4PJ zd-M()ZuEL@6dq;rEH)SQ6~qz&1<+5une~f3w8E#_SfWeUvUn=VAOujJZF?_jvICDQ zfm6fx%F>zpYC0!38W)8gd|7jOcBECtEAuh#XUzTNLVvNBqq2rx6ZQo{$qTOtf~GWH z@}iw=)ko}FA{WCivX$$P%A8n4Ck)nev$dF{8%b8T|(#m6D zg{Y05ktCd$dFvKpW?$pMuk!BCI1R=0iHA9-?bP#&Q6ap=9c<@}=nk*-d}neVP+&Ek{-l6JXr-qCL2pob%iN4UjOqgwK`{71 zBfVDj(0q-n;H*1h3cfY*b5wz>1IPW~8PRa|5IRBY?quc#-)IS!lb}gDf2g-k9@jWI zzCY19*cS@8weG!h_*SY$9O(05pM6Ou#bK6+VC|2aee~GQrCjZdKLlbGOSB_Q^h$mW~Koo-TfY z|0k_R`SQapn-BzqN*xpgc=;!-ws3TGb#Qbw|MU-BZSS$l(eO^kKbq<-D1>21aklIb zn^`2?F1;JQ=05pW0G<#B0}G)Al0^UOnK$oL%fYx$d1b=RFveV#G#8ox!2*gkxX0gP zJ;JeB4!>rvWpZcwahX$2qvF8j?yNDl){kV?a`SEXf;c@7OTZX!Bi(U}ZpP=Os=oO} z7bCsGn1P*ao(1;e53V-6qy1^sluw66vFnU_ylczn{dvN%=AO`d40GOPlqa1Im5tC3rnonjL*CER4)_$$=#lSQfvnv@fqtkXmB zZFOAw&T{O$KV10j0@n2Z(A`Sg$8SYD%be5xaY`BTzocLsKo{+B8bhr?cvN_8+P8@u z%_nM@4tfBR(e{vVP~nI1Sw>E`8m`l;P!0o?+enev=hcI2U7S)Qmw@DP;n^` zNOt*a*)FQkZT4IfNngOa|4DXjuqnp5(z7S7_ro3{u|<+8d|-avWEC5VeJcu`kMy5B zJo5YlcI|1EYO9u?UjKmI^WR|CVfJPbv*jxg>=yk7yJHvdcHMtIX0TCy;MF=&UOicC z#sYh020!!t9U1#HJ&>fqSXWu)>#RY`S)YgN9hZM`-LcG%JAT1lYSH0pDRCBbc3u$>>o!{Z>bx@Ru1WiK>p{T^ zTsQ~{eUFhkQmu`B$GKmIK)wca ze0rh2rs*R;>!!~cuA|z8K)pU~1oo>JHUzDLqQXJtK-YxHG9L_&7^oHx|D)JeWC>x6 z(lj$Z&lMflFy9F2TN7*L7R#{QX$m}OpQzoGLT#$smNsqXtSn~Dq#f&e&Kh*lw_h7>M zRoWo0FV{S0Dp%Bwy_!QVmaB0b98q1osYF(mgID29;tUXqPKRKuzRo-ofoMzSRL49e z<0DQGJL7`9o09p$t6Vb{n1o0DQ9krkPNV~AkkMmjT=`YbV)e_w-Ujh=`*zMJ;v^`Z zd6n7`w|S+<*tH8Be|3>=`PA7jw+&$IM5aQ5FQ=uTTaBN2{2Y+*Qz1gs%)0?M%&~T% zVqf@dWl($t+L&k`+uKZuN*TU(r>&hd)kbch`}u)A`$U0v4Id#D<_=L031nxn-Y4>j z2MS0}PID*vgo<2Ib)VHRKkxXp`{);r><&UsD@MMw{?rt|fWHWxRvh9+x;;E12zzfU zVjv3*r*K}LGBVSY)9rSBx!qE{#e(GD6qryw0zzHEVZ7{Ucmi}X-eHuCL0GinTke`W zs#{pBQSRZW%wkq@Q~wwmmhm{8{AF%hHxArFW)WZoaGUB<>K(?SCO2tx67d9EHJfFO zMu^+C7st0vTt|nx8s4J{ROk>S`5^D*s4T*Apj0?A@#>xBAa_oIr^~p#xHzUiM^@TvQ6_cDjv4t3VMH@Sh{?< zJCm0+q_x;sN!Y%;gx_rLN8KT&aa^{YZ^&F!)6Du&E(W@~xO53>2X4!rsTqyNi34KU z{n~HZ8*x1U&~B;n5yRF!C#N~gPfg|A*oUIUJp|lkdsT)j=v5I4?lCv(L;Th(*j0?p z4HWp)8g`-p)R^_l4Eq#Dk~IdU&cXNvm&mI?V@kO!g3^toh-_}&OmxwWCNZ!&MEZYX z!8}R05yH`o?9Rd=Y#EfYM5r~J_^gQdD>^QP?W-3)tD8DMVmw(72(mD4%(f5Z+p-#l z|3F=doih(2(eCH-mPXE7u!-s~NYCNu6PTeeH*uO%GRwj29y*u&d{}Fs74tnF07iHI zs^V=6Nb$93F38JM#yWYHiR?=<}+Bdea#v$fkt5o)l z4Mod0OM-ohT3r^TA8u5IkVG|lm;$ai6*_67Q)QvsxL}Z_rdz>g*lK>}yv*WL%-~5D zguBoIT+QGy6!-!uKOs+>mwb)Zyc0%&(&JCg*glTao#$UpRsK(>-y)!@n5>zqji5qU zvLKr|Yce*hcerDc$tD$F#5FtR*e{f$?6xbfxQABS{RIjFe$p}Xg;uQ4m9)rgFWE5q zz^+O<`R5lL)V2{8)~(;{+-|*pH;2Ub<{k!VzT7tzgsA)p54(UHqva*Q-^Dg15uQ>w z1?_2+pe(G*>Lk8 ziosyEemw4C)kn2$>xI2|Qq6g~HmzEX3^8*khE(IwR>DwUq?E`@v89E~S~@k}WVTRN zNaGN}tT1DoJhyG*{G(hIIWUIz;KT-G;Y#w^qIPjK4PSDgt?;WckQ$AAR&p7%C)|Pu zNMSzfGs;4`f*`%|@Y_2i%cUS=#EA$I|qLcpxFt)p`M7&(+&Er4%qF5 z06&Z@bi#l)EIwgTVZD{=2XWguVe^M*D#&ZBK;$x{PO>9Xf&$TmX{Reu#hB2#KDK6B z>r>CD)&TlMoY)_n^mrkp;a*~?2aB#gXOI&H+fxsIXx1j-?m?@`NIk}l;OhV^lD*?F z7|jwk;e~A{LnAP0N_J{!@nr;zR5YJ};s8Ess9;ch*OuD18PgnKlPS1#jOgvIJ~2xu zyd3m}UU>txy1njy88^70i0GRDXSZax=T6&&3)w2^p7kIONX~)CGSLgA} zlPL{-IV3cpboMG-yva0cjV*?oR3g7uu0!cjmJZ7^|$ctt*xH0mWukz<7JswdwP^}o$cytV zA4s?TH_}!3Uy*L?e<9rvAkr278|mi!KOG}nz6KuS4fBor4rjg+U1$8vkR=$` z%1d(YrMqWI$hs3sA6y~aSGIQ=;H3Pp%`St+*s|tC;C3#ar+ks&@Wf7!{t6XxbPx!U z!Cu)`P9GECvPB-iuG<_{+rkwQ+8B5Aabm@Ho*E-OLY$=0Wy0$-@*u)E7%#wfgK^u0 zYfhNRDy0e7QrHc=7CVQ_?Hy+g=}crFc3W)_>U!!*ocFHzS?N`A|OcuA!!qK{O4dpe76l>G;zKhzz)IfLr(Zam<)6G4xaP_4<9@YZOz)LYdGy z?M-wg){!PL`-uSrmlgRUvl$v(a+g98Hseh)g2UAX`YJnN&(+ljfZCysh&gjhn+=C-eRE5Pu_(oe$l52}x^}1Qb0qgr-=mHi zlFlPpJ>$HtX=Wsi5V^tHoh_LFbsDxQdEf$rPYh_Ax{~R$MNo?5BI(Mwpz-P0ysg73 zm5Sj&%F2a&FLIVX;~L;Z@mNs1BV|z9d)o^XQIT&U;A0CUvq9$y6;723DiF_GO|_td zB$I^{uNV3U)SdkUb!{E6q;w&(LT$T6lsD6$Qy_YmnVAWlM}+dUgEi!E;5mg+A?d)H zQ#G>1Oy-A5lLPYc&kKlvZWVzRb)jP^F4wcX7)IdRxT>VqW$9F<(e$b`^(|a0@R)(D zT)ilDI%m$0te$xo7fyMldh-b4BV_P)5o_6kKY5Ccdvzg1*q{~|J=`l^!oi)a3fTK& z+K#=}x4$wT1O~GpV(XqG=wL)tNrCTH;)zy&pT;#Oz|rpFXt8WJ2>`YPW1Rjpt8y_^ zV*ohp!;p&p{X8XMta8%nL11fYz1_InVG101d8Bw=bXa}X?pKb(K+&tH`6x|998)Q~ z&^V-%79Y{_W&+upe4$OJ*^6@PYnGVMAPr0&RF|y_L(jmR+Dq&(KSb_Mw);bp zZA6i?42k8MyH{+#JQLV3U%QZlY*U|$iviYB$hQs%$^J)atFCqUl0>+$U6iT1t~IHq z#3D|)#9|Ews434pu~JTpYNr9gh5%)FEc*#I@o6Mxc(xy)n^`+tS!~Ez&mH^8>d$x~ zby!!{>>c}rsi7{TjTm8`C|uA!-tuvKFJ^%nr@R)@gWvX>hn0y8AyVq}`_Jm2DXhZH zXm}am85MCtsP~qwGZ#ShRS;AAjK?8j(3k1@HPJ?=lRUQ`pSwaKJvfB7nJ_?^>^3v~ z+Vt+IqiUBjYs;(`UnxT)k?PyN-ixN@W^U{JjdeGEW8KWoB^rBq49nwFYSi7zg8RW! zJX3k-O|@@Cj8R}^Op`YJ7^VoEc#L*D8g17N+cJei&D0pWKY8I?QFfKb>8jUCo=J!S zPZ)VA=GE@~lWgHu!-WkqFFzz)q>*YJ{HxODYQm}D5*hEz(*=^rmlTrq#4iQ&O(1Vp zI2g9iw@5x`NGS-)`MS%b*Jx&aogTvr)BKP9=^X({LOX8w-tjm^3EG~G}z^U4)F>n%9>2hbvM*s zhnFXieHbsE(vC`7ZYrl=U0jVcOpLK!C?}o(5lKa#%REaKQk6t+rc?}%51s%PyYPgj z+bNG3@N|~)G31TZ^w|U0ew|@yB%sIXOXn+pW8K%938N%jg1k?gBOAd2B>F+4;^%0Q z(xvkW@Dd4wY4qGe5{;CU0%5zzc1Zpt$q5PSSbjDVJA*ig@P@=lO@$@AdedE`z(MsF z>BTAKLX;vvs+U)+SIcUjP>Vg2a8N;HO^0e!WTgbF4K`ATkV}Nz>518|ICwx{6FSk9 zumgV5`~VUkLVd)kmh=(7H~}mF-QC)4A|6j5>MXNGywL+;`aR6OFGZ5s9Xrz2wze~L zmMnCfc0me>EHio>g73NRd?$jAdb|1dERS(|eQ$7;*QIWJ+*LKQ;)h^}_r$vy2A@hE zv{>Z;MM|pFCezCZob~}@&ywx}cR`y+X}a+ifHsx}U7#7*i={G8n$eb^L6;3-ml=1=;m%BrxL zw5jGc0u4G#6Ka+&ukYz_BxvsMwqNNaX~?jEsgbf3)+caXSgA5! zH++eP>-d-5-am!fKO0#YSf2r1z3So5#fS~{JAHn^^|z9DFX;I1w*rWw#%qCGm+4PxnCijHh7)WFU?*GW z>ZeCxkcp6w@b-uGJwLi92V3G0I_wvjHDYkP_Kq%ZHn5}0CNI3#LvrYKvZR%`?oS2f z^;SlPs|}@}WWs-jWrw2Cv#K;Qfb{l_V^h2%7?iKZ^SU^Ot3uI%`ICm3QJJ`}fgRx8 zMjGiCl9MGYXU|a6UYl-Sr77+k22{C^X?-t(A|6;zPSRV@s-iWds-tolPe|*%({Wfg zIGJYE$k1vI`#(_HoVxQLi@vYKmK>F%WWuf!=)&-3O|lI%WEj`i4!!l z3p5@Bc@Q0%J(u^FnGNjp+(%L_xt@NP{NyI98D*a?vK#<|n|NEl%B1>um92eLP*SbW zWq6U!0+C!jLrk+weQm~3xE|XHM0KbY9USd%tgFH@ULi3}%6@-l_$+P4ML@p^3Kt9d z&h~R!l%0Uz@ETKCStR*UC+y3k+GhfZ&4ps(cVz5eBBa7OOJ}=rxxXaFSR%+6O*TDM zO9O|g11!726V8J)L39K2b>W)uXgd>}6U2A5#rhW4;$v1qd*4Pa3_sSP7sLDH$G;CO zvfsum+2>3M!GSLUQl~wj7YuaS1~asOrsswIJloD_ssQwx$fN5wwsT-Wz7CWcMxin; zBBo?3S30z!U`#lb3Sc@s|4_$|)pOwJsO;2Bo<4IQ(66BC%-gj|n2|P+kc!C!dIE#E z`}7k>z3Ouj7_@c*_o7>p_u?GxB~jo{*>`9OF3ta<(*g03b_+vl>o7B z2_~m2vn@gkK#W~?#$ahASuMScml4<1xkwZjYMY^~>O&sg%K|Q9K(&iH*q7irrsH5Q z^n}<_%oJxSpEIX*uDW(svIX0DLp<Hj7f3R){F1s9Ui@}!B4s0Dak1#V5R>U@!p07`%K5^ATV8hX1G(;~q{Yar6r;h9!$^A>w4joFsRO!Qrzo~14K>Y) z2px`FQ?6_G0`gePI`xp?nR zlMM2r`%kW*o<5P79h6GIV)+f51HrVrq4*K(nlzupGzBOA%Z_{OuEH)X(%RKwv`3Da zDnTo8J%Fg6pFt_hJRw>T*#mS84bs8T>sY%`4`tUguWr4R7|g* zW^uTQ{RRD>T-VTcKbi{(1Z4g@CE%}Ljdvqj>jkJAh8Iwd=O0l=Tq(bJ@-@PEr7 zW>^(J{Z)jkqF%!|-}5qzHu(NCGdA*RR6e10*8Kh;smonKF~P36Q>yX7QQ_A+qu+kE z-_0HHFz1GoLC*wiNkzC|J6{g@M&ivZ1AC6j#%U}54jHW3yAyGq@zj(3{ewHZHXH^f zrdjQe?IWeca2==~X}q*m3UtWu&eO}mL<}j|qk4L31{TD;FL8y-^K6^s#18^mmQ*%- zv7PN?8~v!CB(mo9!-#I-Iy5+)BzSWk8SilJ6PV{G6y@oHp4jl z@A^OXXzh<{HyB_O_nH`(GfbSXF_#Vo$O?K#rd(4;k4>&Ezn>WFRTb0HLU$hI730uC z8?5)yTXQ4&9hh89`mON_9(N_RpA=={tG8+U>#V_3pBxN1_W%GD^4jZg z?G>eA>Kx12Yu=}tOi*EN`5xEU3XPe^UKi(G*&Tw1<0tbQx;BSrt8Xs9jGLNo?)v9l z)d4Dz%gZgm0}llFbFt@@M;?llwnm!|6x=cOy0cEjoK^e`N-28eCKoe(cvgKpx~LI< zT$^>#Se#wZR>3lIN(=l*v=(NE1m|adyf5HuF3xj1em}L~VTu{yLNl&XRFv2+AH4HP z?3Q;(c8vyO-L1&irCCdY8{aMa@BM*sTie9hngee!+4&|-eu(?uJ%s(W%g zm5ol)n|)%#(OIc=HDK(ai+g@;x!cqA;r#WU!oVWaExqrKp5fNIVQEnF0c_ObtFZ4!c&^Yz!u#K{fhW2N^Wz}WuDetEGa`C{&*agqDqKoV zZ5@H$5Cx}eXQyKx+WF|BVF3srSJb_BPF4T7R;2d%0xsaUzUmao-;yqKV;SqG5k3Z2yKw+5j_mo1Jb*r29_vqPxBxlL z;J+mV3%?H*DeM*p3K-lv?F)d@qmkK+!pVO>9SjeGHTX|H;4L)VEG$eFp+0^yKakEN zRCHeZhaTKN^xRJXfDn`#-QvbypI8Z~u3LA{{@3zUodD=tjqicBxJcG?1*&Zld? ztb`N1Y=R8=m6;IcO-2c@J_C|~iV*)+jH6~%oh9M6C@JnUW?^MVM9NBk<6(VSF}34s zHa}2O_+A%B^!NMwU1A6}nBVR#K#9XUV~!IHV?TuwU7$Y1BEJbCgE&k0Oqa%HO729q z+*p{kiK+Oj2rD~mLa>Dn9sw2`@Hxs>B_+ZxQ*yGw{XrHscmzCbiymMYGwEFUn(N_f z_!;_~a8%u~9jsHoKYm`;RS_Xt9)dAL&uR#0rfs{dPB75e1MB(&`r;cV^?JR&20xAk0LIKbk+G{G~h zZBhQjAr3frwg~v{F@8w5x|x&ThHcFW#s;1NI`Kz4Jpk%&X&EZxqytpOvZ@tZ>jG+o z5VLj6`JNl<->SG%a=O8PB0YhyEw+FsMOfqVE=*N%d+-yP@(TUeqyICLfq2R|1d=B4d6eP5~R-;u;!aP+?=Oga3vGf~se zGuFA<1JSlq{aANWw>OTJztw=b=tj7pZ1MaqPW|fMJMX4-4h(kf(g>Jy(|R_KRFW>m zTyiB$d1w$n`nVCnl@WFa0iwJ~C?77=x>DI~a=z|nTC-OZNi3d!5?X`b?r_wee#xorKC(+SH2G6gge(XcrGPakDK7fPV+=<)x=Ug+cy~15DcbAMGv-Y2t2uI*CB`!}ody zHrXFV_iQ=jAb)2xzyfIJe^)%dRn0|A$t%mQvyrcNXapuUs2|LK6~hAUzv+<@@vhz2 z=W}N~3bS2JS^vBBKq7+u)#Mrxffge9DIMW6j{4JS53de&!IJfgN*cGGO)6xUz|=f) zrs7RU+D6IA#KWx5vp{Z5&3kNJ#)2YwXvqAWAE_`#W%-+2IDy7*3#!WiT964l(1QAH zep{r5>g?83eS5dRPG2iJ;ot&t@y%WuJSr!@VepDL7rRx78=?U4y}BbR{6CnXe+IrB zDI?W9dYZTBrz>vh+`-S?P=A{rcm|EtU*-j#VV~F5ZJEc5G-TuRfDSw-n;^C;oD&x0 zFZ=r4+9~sd|2B^101M?!RwY*d(=QHp=sg=#1QlQzO&4dMejE3{ZL;|?8^dLbk<^phxB{){+_fmLK$5)E! z=nk}#gY|cc5lqLyF#RwJ!)6%B)aurnle(CXvky!n+b!TVHT^EY;Np`eu%ep&87AE? zGCbA2B`0;AsSF~iR~iG;d{tB+U!UKtd0 zz>&s~IubB8Uk?wEBxh|7(mSXn8KZ7vRq6FC}fh z5sK~Pk3`=##_v;~*nM?hivrI+*MBm5JtkYN*E$>-U==&?^d(JHBwmi;&70Q{e!D4T3{5+(h-7~}$YTaC;>dcxPTcmY5j3!da?@qa%yRI_}T6nslOechn5 zpJeNQ7+YnXxazvTmuvK??c|^3+oW@xWSjjHdpPL2-bCF5GRP0(gHC={DdH`?Xqw@Z_r- z@VY>H^0i9%w)}uJ=d?97;h}>4lD1(jm^HR1 z97_fV>JJvpY{_v~qT3~CA1z0eMAoQ3{tnE#ZO#7@MHkMT95+1$jHL`G3d!=RE)?!# zN(b|Vu!N}STN=Cm`A^@^+LxJ8h|AS0DPhrwunrs?d#%e$afcSBqBWV(h%WXV9MsLr zOC&26rs%wExS5an%S$ES<#49$>{N{@Gpsn8%bC$t+3;7@(!%L8qU~t`5I7S<9GDj0 zqby7_;aK}58tdgl(t*R1-_f@IiuV3jw9vnzN&Jo`x1^R>@-J*z>aOUeTJke}@lOp@C3c+MPr z)Lhm(pv@fDGoKw*<;dpy=LNHbM{Vic?LjD__P>uabI0|Cd2vBN6q!IlkpDH#{N(Cs z_m|u7nZCBiDi_dWn9nc6b406SParY9@Q%{5LH^V|hX$@;xkO4oAtLep4m>E5#NXBBgkB61sKfh&8DDx&RzDGc>G64ruJV)dRhY>LD46hU0siF7IzjdR~P6qeh5iuUJG0;IQO-}(fL@zG#P#U3)Z-kq zz7ezDbkcS;Ic`wO+CE|=f}Uj5;YQd1lhq&d$WrN#ixx`?<>z{FUPy2@4ROW-!}-GO zB!w}JdftiQXxZThI!g#6#JdO^OuaPpD=&D|Yaq|+&LQm0@sJQSlsO;=ggFRQP7EaM zwJgk8+V-0394eHR)@cnf47lnBz#JCtcb1^=0r~8`6(JJGN&zez%?Tn<0kJ;f(u+{M$%Z9)$wN zr&!DLP<{$`3`MfVgG%~FOX(+H75yNOQMF^m=OK?(Z|`Y*jM#(t%c;gU-e)KIRUdET zFvprwpIJwyufGl+P9i(;-q_!==Q{yI9@<2A-H*v#8U?88v=t_c#*RRRU6UrW>bJUi^M0qGD#nXWz zZGHZsWLOEsfv>GB<3h*5Ge#Yh40pLz#eIoQY(5Ps5{e5mkE1#neA=>_)h&C^_}Bd^ zB>jP2T0*|`d7xNRDDYNaAlZh%GK@g=*`XuAB`IRE@*cJmazN+?8oBF4^fJNe23mkZ z)^DK$D6IV!dVm69256~6+FcH97BS~yi#^JK9|}4hr69_dU2af)D+(-gI-K-ZRt1Et zxhZpW*H2u-7CnJCKK?MN!{j!NLDfxe7f2t%Gd!{%H^U|Sy~j7~s7WYIq;^D)$lyGr zn#sw#MU^NBQ0G7SnmmQA_pluQe6a?rGep_5&5+w*okvg~pSkoW5 z=vRt^A|yJ10q($nvyWU5E92+g5$vGLP^)U#EC49qlvp$M-E zs2K7%Z*6=K7g!8)v&-xCLRjT3QeX<&S!M|;B2+it4@J!p8F6M2ds5xG?(V;ajC~V3 zT0un+?jMtYYYE1slo0Id^%VLDxbQodmNIP(J5Z|Zy$O}3U%~_svkx?N zP7N}-$SmW=A3a(lqr$d?v$j5bMvf|V9g~8t^AUNf}-Er#!m z^i{y@ixLYsLMO=@5uX_8!Pn1f0Mx4yoX=s|#Q8`Wpe8ZtpasadsxCMr5;8z~V0h$k z$@P6|YN>B(>ND_%(>LYR7Enj`RaA5dZy^7}DYDFTUDp5M>>a}^YqquF*tTukwr#s( z+qP|^V_O~DUUAZ~txo#Ov(Gv2KKs4CU+<5qS*zAP##&d+F-v32yFd}(<#!zML2JrL z|0!YNWcM($v3Z$VTHdc3YMFJH#j_mr3>g2IG^<+zt&Kv`1e2nf6?==!smq5EY9yoY>VNpC)W-L30Gqz7&#sDs; z4#HZO_1n9Mhh;#`jR05Qf(IF{sS^)6M9V%Fw4WCH-yn=`3(vCOTueQS&fiF@e~`=n zAX)xFV*eLXp7P>bZTdeFQ%**nWyjy}e<_~e`i7hR1DE*+PX7=5U$B{P82RCUz*7Iu z@Baf^d74Eqg?&K!enA#E-0jWNnOGBKmSMkn{YZP_t?>=U>i+RFyq}!5+)r`VWKK|1 zhK5qVv1w}Xo>M!c`Dyi05{q23vdqDaCuG8tPut?=YDspf_%TN1J-IhdT8ekUbj`Om zrKC%$%PQP``$^h4L;LRVg1EDDCSH&XGxG>^nyC3=y(4CU=MDEw-oiGK4?bG?2kn@C zij&J)U?Xv@oy_fAUn-ry^Y4-xqNJ!EA_rf8hY0OE<=Oj;x+-XX!k4j<5$YmBsEq&_ z9;d9o#VBIMm-rv?(;_B<(^wlz5t6IFr%%x@T7(z9sXL?edQ-xYigmPs-Rcbf z&~Y_H5>goJ5nSn8={d?PsAiEk{Ff# zxFoGwalE}&q)Cfdl{>6yKkt-_yQ&9F_<&_6fk>!9&7`qgh^b4&f6QO4B&SZVaD5YS zs4NLmRys8Y93v;|2TLs=k%)_$QR4_WP~+sLptaJlM+cI0R}^zS6ZMyoq)|q&thpyQ zJ51e|cI}D~Lv?cc!^Nrv1E2E7fKMSS=klqEiM}a!(pdGfT$9_`U6nP7{C(KjMZ0qF zXOa*kaG)(`oQ^v2Ygt+g={?p@ur-x-YEOaubMY8!&n_~)h-n=;wS=ILK?;oYrJ7jK zl-!nV0Fi!qg?^TgKfajzyXlKNB2pzpeC|jfKiqBwwlR1CA%^#Zuj7qvaqBa(4c1|6F!A3Na8 z15`EB*YEzua+$gCs1oIJSiM{nuDm~n!WyYDM;Q}fdz<$Mhf`rwGRDFzP?;$(>*P8e zpYA(uZ75I9%_I@CFHeiedGB9`*fyM+WZs;U@!i&ts=YQN?%NVZHw6;gDW}5b!rI|A z9<(&L1^IL`!j2PiG8&J_iuBE&*w{{7mYRvS5)-fJWmM-BBp}k2WM+saVhtZDb&)58 zQg~ZqY`xMm>ohy1bk?f#D_SmA+$*_k$GgLy9Bfwm`OJd_whg4zNJ!+cx@w-6 zWlrbN=2uhgS^;Lwp@7(c8=%Kjn??FVY0!ECQOLS@z14s-&66VVi{LS~rHqfWWmQi5 zQ`hDv+jl9RiL+&E(e8rYcnJwjIObsXPbHf()7^${n0LGFBXj5P5 zh7L?yIjiQ$kMXq(}z5GsN1tX(wCP-9{WQ`_(X*@d$IYx zYj78W@*Vq@7nj&Zu5n>n6Sd?CC@~4FJtB$w#*%O-Mjo!~?Iy=BHwL-Zc*gXpGi$Py zI|i+>f}o{GKDATnVZ7}H?Abbt=(pl(R9rO43Ugv__6$bR_^QuIO`FG56z`oy6>LsE zO=GWBi4(oDGHD}Ey$`1Qp^mh8LnN%W4Q;L9+|4Pwd?L-u3x9v;`#1G_%*3)Y%miZS z`_*h}-J(?-nyk|A`)M+suG?kTTXvF5RDh7uuavB21&U#<{o3d#+Y}GJS==9RSCGD8cucO(dz1SaSZ#>X@A$ z0mDBxe9Y+PYJmE?-Z}I@vrnhw1r;l+|w>^S_IjFT!H2M(amp3CRto950LN6&_?JnLG8V z$VtS<1+S~GTC9YQ3aXzK*<{0S3Mp8LTG9%&u{FU&94Se5&lFM;DzE*CvA3Xg=}C`Q z$1F_;ULg#ml$2+h(Vutbdx1Dn67`%~@|tfJZ`_W!t4D<c7@Ahzl<}!#-7L|-!RJ#MhHnqq9|F0va~|(e`Hx% zCb9&F!8l`hkV{&PXKvV(Mpuy4t&aZrJciLm!GJeq@8R=V#0)h6n>Ci~tx9;_5lg#Y zqkk3{_xY{E;zIoGgJ-}mTPKW*9ttUSXTJN@dqd`)S7OKOrD13mcBd{&uQ+p@>@z4s z=~#n6|h2G5%T)8r)ShFl%76y3<(VfTO$ z7nVFYC=q{g6)YDDCHG@@A{{D2!&GkvPTF+hJf9%En&|F^Nk?`n!x*)N;CsQ#NO#u+ zGk-~EKo5j0SBdro?ob<@NS`ULQSJ*#0$BIdf@5-l!>cRp#?La zo9)k3GW%M5WA*-j^;Bov4%&S7iV=yWGPn&&Q-cX%y2);I>p$M3RCIMQa1)>0rVdp7 zL^j_i)nf8$8{3?F+NW*Z!t`^)-I0!k&e$gW%2Rx5zIZTG)gK(8j`oq_B8GlU4H=HG zVz3F>?->_GJ|pDoWT0wd+udeb3>;Uy1unJ+Y+J^6#u;Uhne`>pLr2{pq4GER2}atv zo4R?{KrT}(*8qBW2^eJ}z(^^GSV*?#iMB#V@cc|Pz*9qis4Zms?%F)qtjL{ZCMmJHfrA|krqbn=@G65AVJdbDjUdhSU55HiYU{iA(33Hq(Eie zqcG363al);u~4`GPgPl&$eewwi1AQlMZ2w=tfoLyOmQ|BF`G*ReBhUq9^n(U`9hH*8V6tJ(F zxy6$qHSvrMEHlvZMY?g1OS_{3UaVF`4-Z+~}LEH;a&zzi6$_{2egOkMkn6)0X51;zrFv zsREl48HF4SKbAXK3s(W`({k-`ju${`lLE!=xABha_jv<>Y+d32Y@yk^-_cT_zx4-T z{M)R*+!bZQU|gi*;QAZ^Gb6g59YNV)3qPtx@%O?z&ZVuOzFwlhtR`k@n05_$YUu%7 z-<>|{BH*J}a%cYZ9KH;!9b7Rbk6{HUyjf;-kV8j3JiIARLtaF5M521%ace3jpMfox zu43sCRV40oQgCs{_Q0^aTIXERnp^i3vPfwY~usXQ(r zg2v$iip|?^_1-O|u6Fc2C5x9wk?DREMGARl%^dwZilA1a3dP5VeIucpKH&wWJ*@tPC601AsmFKhG~)>Ad?MwA(e zil?9tt?bF!B*s%y2?JnDS7|fGH(eNf8LPx%vQ6SXYu_}>k{pr%=>*)m8vYp=oO=~H zuZ59C!bD^|k%;qSiQLLXl9)7g#@Som>7Q!#SL@qOx+_iS36ea;4lTNGIRoxKO%%lh z^UN$Oh^Knd#XyH@N)?P_>>!-4vJrWO(!V9VE_}%h;VG>R*PP>=ajSRPNr~1Q9AImA{Lht2)%_#44S@l_1g22W?}5QO@uq?M32U~(TYy|KGt9k$xF?D zQxaI}P~wR$2Aar`d|X86D?uUct5F`4?49WFE`#C9*(k~}BP@Hs(p)V)+^)X%yxil> za>DXlhV@r_&GNnL3=b%HA!|7lVz|=NCXJg}{OCwp9(X!*S3_&6LTR-*Gf(qCf_BnqvzJto8qbe zSLT{(QxLEp;(I`yA=v5I^U{7f4ITD7J$la9|F1bG2>9WuQQ<`mhtGToYd$8_3oIC6SRpoA#Xx0y5C+b& ziI|~*QfD(xP~o9o2<=?zR5MliU$hk5^u7*yjRr+oT{P<%Gy1C6G4GHSM5N?s$v*^) z;gDGUiv5C^BTtHxCKCk%%OW8^F2>$a>M5wy;HXqK+FGeBEr;2Akt2{%uArg(UiHs&;qrTj&EoyzQhklc>JOpqZ-u;0zW!E){=tKX| zC#AW7cc0zWar*qM>>qh^m763Ad`ha`y3sDvfMbRrC(juOKE{W*aH*99!GB1zXCZbA zn%6p>9-!*aJ|+_8WyFA3Wm@PirWJo?nXJb}nUQd@+a7;8$w5iy+(7b&&C=Sx$7>WoVbIZT^mW~9WAbQzCW5uZB+;bp z5i@iss^PuWq3c$Ntc`|BZUN5CZn?3Q`PI1girhyM2|`|Rakp!2rKV<|43CbUK^B{mfQPOE={|2&jVJtrJy-CMtVVn^@)xA_49 z5d&F9d1L^8H@OHH5D?P0`Td_}H+FRVr`2=SrtCMFka{pr1(ABjQgbC?Lo5<`sGKdW zK{YN}MQd$~(WDb&kzX#llT9@2y`vRayO%vXcv<@W?BKbDA^{uR^pxP_MrqZp+cRgX zPoD?0W%~=i%8Hi>s%EdsefV{e?HGoa($oDt#Bwpi@Mlg zT4&V~>{DT&(-0*ea}YjY1EMSHx8F>JkM<+tQF#GSIcvD3CYj(JtU2#ZiW*t4onxWW zz3iM`-Qz5sEz?d^o}o1tTmKuOn2H-0XtzsA(&;U%8Tf9*0HP8_K}l}PW>zA1*UO`1R9HZ}5tlWVQA^d0jL;@abe?{~-Jlh`$n~&CQZ;Tsw*0t?#R%uzX8Mxz; zZHZ1PG(T)3vi0PnJ=(e7-p3|NTCl?Fk`@MA4RrKSr=VUQX$9UUw>_YJbVt0L(DG{) zK3X$iGH=@DRAv#m&?5z!)f`vBh=ZkvLYN{iu^8&i^4uzqn&Eri^e~&`AO<+oar} z$={Y-NDf#6(w{B( z&vp1i2;NmBCAq(=_j-kazB-iUDNtaL97bpMP1nay_|}%*;+Cw#r2@>Z#p$TMsS#hC zXo%MJ;^0ZX8-d%*X`~|x4%)T&)flrkuHSrCm7`?~SLi#?z`Vj`a;M9@`F?$A?jZo_ ze<&yJ`=&(_>2WUc4x2oW?rMaCs zf?H;pg!P9mkT^nF)M6ErfLpb+wzVIQFz?MIysel3! zk93$>j$h$jc>t6O!8UBQ>~xKXAWIMF2)u-Zl3g6nD!J9!^sx__u^%6)930r9_=a%F z)rho|=bQ!EgncjT8m+RySxy%uqM@yZfX$cgkE&9qP7~)0;&dK}MzMG`bB6^9g=fK# zw>|h4I37^B_f4U=E_{rGjRAwJP_=hij)Thi8LN|dCGu{!r>HhT*z!m_el)|2g1FS8x#NJ zePyt#Ys9W((DHiC`SDa0wDxC>^H!hn1IrV9GUgh>pX*VRd0EJ7q4_)J;6Wd>UdXGl zF~~uq%dg#P51opFE6=u&)}Z7XvsqtcG*z#8a5JCRb`|3my{e|RZc6}tb5#fAMwKHK zC{2&b5oXvodXy=Vix7p+1nY92Djn7VMs?EMrAz}`DkHxk%Ph4>+z9`&*A{o;r7M$#2^j+7j=*1^^vikhCpD!6c?n{W5 zE8Rj*T-PHp3B9Aqh0fH%9tu4j=ch8koe1HEjSX}mX2mBK86XnN-L$oD>J)zIO2za6 zyiD*hC&}$a!FNJZuO#{L+?i&|)#f_kT&yR&iZLid*()293(w#uub2}Ub+K=IFtaTB zJ@539rmge|HRWSB+d+%Xd~#8mMy5X8XXjIL@vCmFnQi;DH!*}guCyy&b@>p3_f9pq zN!Cuia%^>Zex!!I9@uyg&MxXo*<->!_PX|GT>tHLb=aIcVO*z;)5v%|sH)o{)4jPe zl^YMrL~R*M>vG}lb)>>o7ssY2L@jTmV+dz;L=LHf!$L1GLM9w`q=~4kLMG{R#CKvU z)5}M!+BoOEAZj)%2=}sS)#1yM0j1Koy7#3999fawuS&Q)LAANoTPJy|F+iEM{S6Q0 z$doR&Ctje#nIkH)aA%+cU|`fve`;Wy+a#fP{so%$U%uVSP118nEM%HewKp_-*<$Ub z&pd9iNk404tvgAv3JGo7l0yNo#2QDg=FD-gU8&2!duvm1Sh4BekgR1z)>wf`&){&S z`_x@aa{}kO=Qj3WPnxi#eR-DWB#K#$K@XG6{}tCRkBt%d?S!DJ|Mmx!4ha;D(z*7+ zis&p_w{>;;*i(3-l@^oH`CL|!1t&q7sI8@@s)^CVu9mJ&h1L%qAd@_A%MtoStA5{nPn8i zx>_Rzz-<84vY#&NvWe}qQ!(&fHG>d&U{Gm|TTgL%+NbyC=cS*AJbYIQ=RopE z4_eKph=CGh`kQ_ak;Y){$tK^hs-;JGqP9CtW$I#8R)4Nq6Vjk{@n(f!vM`dX()(>) z^o>vSIEIt4%J1+>Rz*7WJQOlR}!8Qcgv3o;JSpzrX4Q|8{wOV{~n zP`&(&+pE&Q&-pRbchd?Oia_8}F>2R+*&Z!aw^sA(|II;z{i)Ht>}u0mw|UtHVgIsE zvg&+1;(=^1V)H`yJ!bsp4C0?rh1HcT81OyeY=r-hRinMDnz4!Pzb5*>)8!R6nXtxg zQl9aPw}=@_>x+q~TyxmC;L7v#$LwlG+|9b_dk6ha@Y@oYt{SAfZ|!KDj%Y6%Q$&<; zS1-e?N;Gg!8b9X_4f6vQueMp!c}z*r(R&Uda{4Zi;>G3O8V>seuI$+KC9Q@{Q(+W% zu2ZQzJWkG1uB3g4Iy4Y!PO4@c$K+dP0r?e9qrb9l1mGzI%F)%kF8VOmMKI=v(PfBzc)_cI9Y^S$cCxXMWTXsLTAvhwW+lTUfaeNb%S)+gB+y`<0rJ)<1C8y2PVbwaWt1I zcTeX%g-=eBwULxcv&HQ4BeGeVNy9f8!}X+=6@{U%lRz`^X>I+9bzK_tGy7DRt68mF zhK&X$QlG@F53vtKl7PZTsjfQw;dSLSaVLFr{CmSSm^OvtF6Fk^xFNuGWf3#+0Ho}hDL4-87=3fk{# zjxab@cZk?!F)DzJmQphBHZ-}ILasp>@*)bgN^6KH4RmoVc7kCdNy=H|BQE50aG59O z&=YAxL;tS6KL>if0Ul5Lrj3_&F*UZ*VEc$# z1BM|Q;u=1Vu$uiAA_0U{SP&1-5jLZ?dpG=QE-ze+XG{xa1T3>&Yy{pEt|E8*1lf53 zd3gaj`g+r|f*ITs%Sx~YQk^N2nV*OX-U^G%3uq-{r{%>Z?tTBibLl)XW`gMNZ`z^% z*UI0;+|~8_ZODJE{983PRW_xN{C4Xd&%DCSP1or$Da45oiZ0>RNj6TBmYaB|#aCFH zR((I8rEp-Q;bqB#Fxe{R9(#R!pRWnYC3%TrBp8b)lu_b@PRfOPwZ#mt)9(rvx*wV? z><73it)#oJMNd>HW#ytsqyUOJv;m&5pQF zGSehg(sMrWjf1(d>}4@7CCA%GUxppRg4XFmFk{33dJPWC=6m*Yo&^|IlomwcLIfFi zM({>emfP&Lb!#|u^enuZBQx5!Ej?CggCzEP%6oIrG~uM{TF_QDz{Wxcefg$r2RcrA z?G?EUB%Ady?*O)RvKfY3&mvYuT!=2uU%TOe1R@L5#>j)H3V+GW$EM~xRCPJJX~WU& zr16_I3&>tg@Tl;TFDWfO+(F1^&G8l#?vR1b!zD8B(Jz?aOaW0bZOJBrmc2L(0ei>0 zgeC#r#8h8`UFf_BaPCku^v87+r;hnmgW+(lkPKG9I_JotuFyAN zN^RFv5#7*3RF)UFqv+hqVZh%_aZ-DaMY0#3_1oS_y1_x z8NV5mKbN~Fh+DOzYDZwetQTO6z>#--0?_uhYoQC|zl<#sUS<000UHUyf+;Dd~zJgnJ^GoULx-G@D^Bs0=-)z?Kg0to04N3~wl*H{Kr_tAKktat#|Y zmPcvKEmnsg@KY#}^h7Uv+1)S`Y<5-k!f1aq`qGTAoBOl)N-j8%$Vy)xy0PK~|ZEkOu{dtC{pEN+<%W{dZUQWu#d zmqa0xX1x7)f|p)K5`z3}Quqz{J0aXICjkPtD9gH8&{eT`&=n-W?k2j1OoV(P zG1YU)&`_rd)hA`BD@KcNn!K3$0iHb}e5gp^&-3<4SN1lhoo4v4N!_fG0BtrO-PG~1 z$=6y1;cmxU%|)|CmUbXMo4sr-#GZ$;H9>T=C5zXScSRRo4Sgf9CG<=ecj= z>HTK$Y*%vwO?JlvPm9~?Si;pz@hl+VTEpR9slKVNho-tIK#K@yuASv-?Puu41q-7< z=$|@5zc?M0p@tC@pF;&eHgS@nvl313x&~p|CQOvrJ zW>2O~0(h0i&fp?7O+^sbTp$6|y`ER!-0)3nI+H2CJZG<51i|yvDgL~_Ygzn3bzBO; z?w_Xw=QGGFZ*Oy)@|MljG&JH8&6dX-L_Ke~KHVE|BdA4SQIz z&O_JL4Zg2TmtAvJr$`SYVT)UWOQLWgW%XvPCqW^YjG6Te$CEiW zu)qNV;WVuFjL=>9h>-BC_J}UvsIY4k;!UaC1h>*x?h~V&XFY+2*o2TD`l~o&H}NAf ze1}1(8;r~=$)bp-aE2g+Wx=FDC8t4!skLdO!60pH(5)G{RDSLEyg-=pQ2kRv*7lh? z!2i}AGD$^R#0QVJ>TTj+-XH@K5xqoHLMKh97#0EXs1OxEHb`o5G$~k@0+le~WqHWP zONv>%xEExE*YqIcSvoK@JPnEzIyT`2SB8nXiQTd?IlyHZ^`>a+f0ZgK>#iq&_E50? zXEc#S0;k?C@}K&Oag|sYQ!%86g4I7_k*nJDlz(Y;0yt4|+6@hUd_Dt)jOylfWjCMn ziM`J)MGDbN(v1YNM6Vtq7e-L6ICtJDxD+no#lCk`2l(L~lnBz+;-&1Xvj_28m;XwOM;tHcObnG`@CbLD*y>*P3C)WBc5u=9?<=~LE z<0^I(q17!B`jY!C)x)-!=W8Y+&KQe9*+2+=VQ^+BR05f&77=PikAXpaDg%Pe(%$~gE~N>YK{xxN zkPU???%wZo-|V=|@t*{w`xq{2r`c_`>6n|BsjK0!`L&jol67m;DeujNf!x~4%Erj& zvrUA<<63x;N@y*rD)PIzFCEKkcr?wvKVR8=zQ44$wQ)S1T^7jp*R?+2fDfLEwLlXMVtE|@P+o-dvn;bT$r{tLaNO`1&9_`aWkq#;ZAM!crB6kJEoc{gFxHYZs zqtxymO+OYWxG&Gs?5Yi7lAe%uKOHx=v9)d@m5kS#oMP;^eX#G{kch{zBE6S<^@_5! z6(jk)65_-+gSE3>gTErZaFA>6PX%!Sx=GHHPJYjoh4qHE0_0|`+;DjNYv`nqzHd#1 zI!Y*;7jI}`eG=Gb&TCsZ}uZzEUm>YwI-{4(T7zT;1-S^arJaae|(BM=&=fwR(S zwZKY3@^nT{Yiqm8Gs@Pyc)jyO-~`%as0JlB+C>&lIOf0+Er3RI>O@6a3hcP^*${75rDylX0*RZMu zRlMf7JGu^%2>6ZX*37M$rG0${FYtH^7JiS6&N%ZiGlIT2Si$2L@I?-hOGC;O^F>4N{(x*8oZ8M-ZG5kS#v*;0T{PM26x+}DCsb2) zz@6zBoE?wlyb!Z~bQksluyA7JV8_cstaB0Z%)EEk3Jtr!X1jg6C?uk`oqTPc6&LB* zHrB$H1CB6qC?;xALCbU_;4nQS;|F#YHp9$*H99kge3(gw=5T=@*p|LZ zOk)Be?=?+LSC!0gWg|{yvnft#ulbRC%l%JwHa1skFCqvmLBslijS%{JqTQ9Pz3+Zk zchN^|07@2FIEi3d;cix4-ADlo9D03u-pps}1yB?%+IGLK-gds7#xUahi(5Htu84^$ zm5J*Sv3=!KD=V{lfC5d?)pN1lu#26u@+Jeir;}AAazag2`>^Wcc3`N@MY6KipcSAX zQw>Hn?xl|okm2=6yS~4xs;zCjLmkx}_z5C?PbYn+Cy(>K@?i>Y#~9OC2?PgiCNx8k zO4#G-Q(3KV@oC)46|M$#V~oU$8nc^#Ct#v3S?!xlgxpkm9)1LmI&`ub8ih*FL2-Ou zA0QDhmS-7WT_glKmK6*a0p9t1y=`NoS?4qX2{uqT@e;)|4*`#7W)-Y2gir|i8J={0 zevao%R2fB01gEf^*AN1U2>7#U-{^EW7PTO$JDZ4CK(_F^?{xzo03aDx>b!}p)$Sd2 zPrq(y$}@LA7>3T6Z=vTE+zkJH3;^;Q6*v$##zR&RN~JO05RE|8Z4F&(TFcldcf++a znGl=GAT#{ag7tE1WDKthuM3g!L;-l{)VmE{YkVC#@iV+l3V)@fn$38} z#-TOfVd?F9oxC#%F;O!vGu|w39*FUkyeCAR(bhh{GUKvar(*HXCH`IpUGUVO7`(Cx zm0r-;JGJHg2xrm!;wajza=3hU9uADKBJxXJzu7-Uhm&+ zyID6@uR^5lm(X$e1U$JPtV0WT9dcNmo8c1Sg1zfUm#s=Vp0vbjjoJ=%J+-;7=&Y4u zwf`yvX=N;jW-E7$jU(h#2qvG);^`{rOf1fm>&de|S-sjUEvjDrD%sglk^ZbY$0;Df z%IXw#{`79a2DG(Lk~6z6cR&>^RQmZmOOs!iW-`#x$wsB)q#RR63x`Rj z(H9HdPXd}9|1oQ6q{!0-mXnWmmz|wms|>0{Dsn}?Nt+PI76O-TAuT~BWnocHA!+t1 zVR!!7&*Y}78*{bkBb0K}fMp(MhpG^U3;~B_bU2LnVBa-S*KHqP>K=qX3PZ1}1pAVY zd+t5vC_qAJn+G;10?dpt>_?MFiYYP}&NeaFx_nY`kpfV6u5m?9n}qfGb`^1dT; z*iuphR3ZB!&1RdO3nH8xzr{3G4xd*tI%bBJv{R#e7K`@i1r;a8;SI1UC@ZJ^mZev4 z{KxZEGdwPb_htfK<+54LlhMR{PtoG(nLyIrtEJAc=2A&P3WY+h=d&rI|JEp4oD+LQ z_stNqo|zXxTB`P+EtAbw(+qXIpN?m^WXv~O6Jd>+r9yo(`K)6y6lq#*WOn7H=;^Mz zeO3aQKU>ewX=rI_QxKhFaCLmx8qm?v8AfI!&#;Av;HO#C?901vy2mVLv#dVJkq36P z4tn*Ctb5p*CIkMQjv$VFF6|HHQ-+Vt)3;@{of4XCe>8~toJ4oFeIrQ5l@IPnT0eUv9gOtxn zQQw08I`^Z;F{036A00x@kVSV@pC|iQ70M(uY6 zt<+9Nv*}3q_?d!75u3d1wO2ye>T}&aCqd;-=!gRrA3?IQu_3@zYj^m~L+3(`FPsSR zF;gF4Uf=r_UaQj!Ack2hYC}vVY%o0E83R);pUJflKa9S#Ef~-2B%9P56mJ1yHBfM|3u{5a|PKI zF)dvEJ&|&SyZfgce+7(+p56@;PvA&1qt9CIITjfEnxq$Lv|QhEG$a3Sik)`<2qme? z`+%a~WY$~y+XKDqiadu<#U4XaM+qneZPG*yMZF# zUFhB!vF_I_jKkmBDv$MBcH%M|>?qa(bfiuRhoG z$6kSAzmcDrZCtZx|H|2#i^55q+krIs2?G05-$2Tc#8OyC-}Xm`{b($4hWt;#~Em=?lkAhpbAh_{A9DCb^AoLc*c34Yz8z_(zAi4h_J&8g=OushRXp^ z$TS${$DLUWBrv;|!tMRM#ye=u05Frbn~Q$!C25OFTBuPHA1_qs4pzzU zt*xy9ntZ*3KB+BB<=02O`*};aUWl;ZzqiXbc86W?*OS4CQpBZj7>|En#{ydB{yZ7# zI!Q;F8e7~Sp^@k<^IJb!enhI_*D*yJh$;kLZ&OJS(IWfi7fBIblYfU_FT02no4-{l z(#W*iO=;-1nv|v8P-nQxXOw4~2)+&=US4DM5EL{K5- z>r)&(AoTx`d|_a=03Yl}^xKDBWN7D#iytSiy{CxzM1`lxWwKD;R&#yyEtF&OksbAHz@?l1f=R5xT}kZ2@f z!o9f&ObtIh_=r5Q64`#T`i|6kOR8`zb8-z~VvM@hi7cu3MRj;&Txs-U_0Y(dyVDY|{fk;lhm{@#E@9)4-`RE)~IzWUG+-Fy5Wp^|X-Ur%_T1wL9AMj9-Wl4I`rm zXx79u8D3!zN+z#-V}hAgyAq>cPwpbRX#r$3)23V0&MXyNEO`HZFTB7*X0Iy{CP9Pg zKrnb+K9NAk4r-V;@eW?4a3&agL^TZ<9KvvO8Gn{dO7fEqg=Gkjole#rM{3b6YYXX>KF#$RKv z14vBhpjd*1K}J#Dh;F3Z6qZJP?<@5@$3xa*FLBmnY;p!~>rSTp)RYG2#N1 z-D-XC&*RsmZAyJo6@eOiz4sMbGcLzV($ps*E8Q#Q9HFE@@n8Vx zF~*}1XJaOrj(v;?aJ&8sX%ppN#1MN{BpT7V;4X3o`-_-JTNAZY-fQ177GgmnE+eLX zJcI?Tl}gNM>UX;C{XOk-wc(daO2bY-#4MT7z;7vso^|8kfpt%Q$2VhC#~T@|gcAeL z0b*M8`2r{##6`1My-c}V)odXs;wDZvjEZNeGYu0LP96}B!KaX_ioLF&O8ZRSc3Dx# zn(!nr<~gVsNE4>pY3BybL^K2AEkX~kGaky)Yj`ItU$$>vg*)&SUT@dwmEQ{3sx8QH zQC*uAd~sH+#eh+`BXDw3eMm=#7=p3}?&Kr@vc@bd3QYJrrSp(m0U>3=Tsxii zrR_iTVR#k-Mmv-x_!bE!<~~I}e?#3BGu4Sj&P7X-eYr9g*!a^e1az5Q{&Z1RV20DD zXO{>@429c)_RY$J1&bU!?2?Fe*GmbWRU(48reS#^q632tyGVq?A}0gA!#=*7D2z%Z zr{j`P!8sGc1-Uc+>9i+~Ejp!H<2V6qdXo`eq!1~2_A7TkJmYSbC>b?QH_C@74a*FG z16b+w_D8Ir9b-7+1sN=g?vgYSl!I+{W!Uq$@5crORE>6NMm0jA2__c(oCv zggHUzx=e?qyyL$|ID%F=Dj=!Et~psTYd{w*%va?q@_OBITSovUV`IY0T~bh=du2xz z6y)70h_6y@*^4FFFh)sa#D}2`*~z8MpvIDO+s)LB)Nj`7Lfr;HP_j?aWFw)F4>`#< z%1h0XBR6&_L9}hLH0muskDl>2@xOADf*_QGu(8zI$8~?TzPbhpqA{I`d6E2obiHGE zWlh^H8m!ppSRFenPCB-Yj-8He+crB+r(@f;ZQFLT^Ss|V`#NX8&%Ul&Ki2#)XU)5+ z#;BTA_ZZ^Yo;R4CS3#LTHmmM($mD!P)~?CUH@*_FPu2n6>n1sK$&yA2?;a;7!XtFk z`T6Us)sWw4sSw>=Jo@Hg^M4i2*CSgz779s5r#J|TKg7E@W{)*sr9<>UWVh{}AAMfg z7rmF5J`dx>@?hpRI93MU)6jt~dTNLcW$L1&{s`isA;Av%o&z91_2=kumN%vz+&y;6 zr3ME0`}!L_ex_L^w?c-=ki^vmdK>n*j`8A*U5=@iZ446nNLLQ>v_^z=UFzpx1>PHM z^fPoE4J@Q|Jc+bQ`9;#D12|qkFY{wsxFS#WQu+Igy5U1_+pbnO-`9O=Aq=k4m`$2r zVf?pV$5U{TAvaepK7{ZqG&)AC+uSNpTkUyBqJN+%u+(+@AO&JP&0xk2+}D@BPJLda z65<5+d>x4WcI1yqs#DsWg!L0@QHdhWH=r-)8VD1*^u61O;9dat1+>Phn5Vj%gAxI1)TowqfP_`N?;+)wu&&vs3`f_pcwF*rSgz!^fk3LZ8Iao)7WuGVC_$Y5YwtktSI8O*{{kRp^RD z9qZ?#tO-QhQJ_Mn6b`b6kQ}U4PKOsxMmF{C)j0d6V_Z62I;!XE$zsO>iVWhrP-vX$ zm@xleP9>9Hlrfr8OMPpehgv$W^RCmB_L4Ju$2EF z{?K>_2%nX3{sVsYDMrJCK zL-vM>1blXDjM=MHIBk9CsR|mz>fbNMKyipfb_#f)F(6E*=Dn&QE|g#yK90eb;XdC9 zKXMI;fltCa9aJk*m+G~@vJKT-R0!Qx04A|(Wk+98CLQI8u(*8hDF~~BvkKZSAuFDa z?Fbb@V?-y15};dArCJ3XM^%|8H13b;zQjuiJ{RkcaR%cKZ4kR5@#0g$8)MddLbcw!>mb%K}#tGDn zlLa0ju#eT_CPhRZ`on-~JuUjYZ%%|_`C$1m4CTrRA^-sc^wc;e4u=~@qU6op;B#(@ zY<71JNRdNBu489S>`rKzSbysSpEk_Ugux%#*s`bfB79+XPAOy58iFG?wx4?~yDmU0 z8uVG}kin(-j-_&N@w#22r){`#rf55^eis@%dF1N8)n{T(9J&--h<0;;ady!I#(m5D z=z%-i5Ypg=6jJ83CxquPGO3}aSg8qpta_k5pi7K8&XPVbxe5L>K%X?!qO3$4F4($A zdBT~xAEp^%1e+?vn2y08Tdt^G2c|m)w^Oop62}viA(J8 zTLB6BYdI)H94Jg3v&ptL6-fQpO%sOv{`-@Rwgrb_Vk?}P-f5Q##-!@{M2!4(5aj$M zpoO6)zZ?I4YJWTGDQyL_nuh(_p|Sh!KS_u_4(qK;J`fn&g~8RS8{{ux`JR;Y+c*Fc z>884mvhPoKJ?y&Ot(`8swBEsxKiKDcYR_BbxQD+>lhyIhPH(dYyI%6ug^TMQQEBJ} zd)cHx8ZL?v(><4!FObg$@i@Yfo_r=8GTZhCq{v3%qXeZ*S{B${7Y0yqA%GlqyP}g~ zz{~7Nr-Dc$Vu1`G1Pl`Sp~dn4RR#ka^GwAIMnr@CwcYPhfzTP^Y-ina5tc6W5-7M= zecQafRM%-3j2{9k}09 z_xU#YxtD918l9Qe!x&T}1=$Qms(3m5yS;qn1!QsvOC+4JKs|2aeRG zjekW;YuaIVc4JC56Bh-NY6#x&Hf2g}f@0@D(=n{d70|;-ip87`mVh6dzDkS-oh%fj zfC>LX@mzInpA#(}($@-hNA!;N77`A41?BU1H0cILc*YTbLBSU9m4XIm6l|e91Nis| zy2&pIW#{iV^IWi5M-ka6O?*998cA6dbi<<2^zs$%wW$|YrCd%kIFD!bMLw^ZA&^Mi zww)e=dZ|xf=sAHfVtdMr;oVHirjVy69wm3LEi8 zF5xfT{CDHEeWb+?(p&tD6gW0~Rr1XU9Hau4VOb!>qme-GxCVZ24WmvZlsvPk5ddx~ zma#>^ZJi%;fZ0^)L7+S7wN&?WrS`?wVq@XdVTe^p^-kN zc>#W__0-GAH`p|0KWKve1Io?Z-_>Sl0SFFI16Lj;*2(66LTK7eNOj#?h6afEY;!-S zK`z!wv0e1v0nC7{|2 z?$NJW-)IIpl;{>)!xnyR@&RQvF+WNmitUyMnpJ(NG5sCJubDs*Y5X+z5edkKFD~Mu^-{krUrxq}VYd}bbiyJ!hQevrDB zl9F-u`}`U&5ga7ufAejwiv&%twwo_ zu}^6Baddo;)ac3&97|qY#5u|7rMN~*M64R6s|@``p!15H*5?rabzDh~6a414d-%XN zH*@;cu4)-=b(ux8`6q=Jq^c)opSS#0FuU!Ug`Icl_(J;Wm&ez76jqY;_;N=()~FO4Zru_Faf^!>Wst%1_(0$8W=w!F8S92W zsU2HD@)2qdfOk3LaMMU^Ue~#IrP;8EbP>h`OEm=<)Yv}2L|-e}*z0w5GnzbiMRHgk z|EZF(CGO>~0~R<{Ifbn24d3W(4SJjZLgS`W>+Zovx|$W;iRRYEtz(VM>(TFdqcrk> z>OUo_kJR<`s8|KewtQyEj-zeX_|DEy(`ClN+6D@o1=3P|6^IGH{99NX|LrJ%<3hhP~wt_)sStg;!sf&s(A z?C5@S8>;nb%5VcEI&C0lY862QO+Wlt_~lo6|K#ykdGNYdE)Kf7wot3OFeK4qXK2Ae zMvCNN;j^wtpbh*H62`^`D9hO%`jvNU&~gg?Msef*JH|i9M3YDb53qPvg9^#*iRh_E zugLc%C3IpBlfdSmjpuy^9^Q%zjpBp^qF2f8G~-8`vA2|{P8mU!aJ`iRX(_If$a>H}$g}wfgbXD_$({(G{PfPUu_4Obe{G9B@?6GOYigt?$*m4H zGN%#;8-V`m|A77ZdbSApAo$+Pp9@4;+TF4FCThaZ2r0pBBY%e)1h*?UA5Y%1i61X1 z40)3C!dr+Rw$uP}KYA}C87r4?4MAeK1po8Ox2NkW4>1zg)*vkv$_lKvwV(da#4M@g zY|Ge@XJ_5uM~*%)mYJ-45c(4%LO;3vI{5*2E&op2YK_utfChcdc#3{cI9pM6R6-^c z#D)XOeTMMrt{l#$_PQUfPQ<3;)hEt7MMI5xV1zPo!Jo@og^Q^@s!RM~*U+Hm&o#cj zhiM2T@g^W3Wq2424$R^^{xW;?qFq*>uPA+%mSuHMDueJgZ&%mGFLTpbGQ(27otz

jQ1gRQCu6u2~DoXj@>RjeXVox6AYxa-#MM;<^l7`V;Nm&50Y1VN0-68afsfxY*% z+4JlwZyR)-*9C3KrBxt<%OH{-nqVbvb zb5wHFG9Z2i+2HI30-S`~e=zJ}mUjT)Dx4L*YiCB&fFKG^^f&gbNo$wF{K&$l{R%uJ2rxBXuf$jwl^lgg+-(r3~ta)!HBP<1qa+kNu z_jDQh*3<*1sHC#U^bq93xii4%WP`!0Jy5&nE)$4L=p@jh`cc85gh7iut=6JxklWg< zZdEr$qq=aaQ2&b8U^}CzXE1i>)57qA0WDczS2j98ubXe+|FWpmV9yq+1;>pu|j^5A!*aG%bamP!(ZG>0$Wf3*y)kt`s6wj#ds+@ zk#rs=356kd1H4xzyXbpd(gtA64>~dAdNxmg83HlBs^nR$;av#8u}4V9&8W9{&!9I3 zvMf+7-Rv`XO%u57d8{DnrMGTl6=Y==`>E@nT>5;zKETmIfu9E8UUwq?bmjaya}tcP zkw&9V{3EoPEXdGMG=le;-YMFjC*fk-V6w60l#9dgwh5sC&aGRfSZ2l(C7{No_F+sR z4@q6q>j(egez_oR-Rej<;?0B$|?}%t>GA&+%!(Pj7Ot0`_-#Q2i*4zeQd&4-O)u&yJ`tHd%a1`LBKIIazaZ&5_()vOwUkw%i*5jM zOTQ$}mlrx#K%uO_tgjf%5WKlZWalB>V;<$XtEvjE~i z>gAebz0m@R1g_#$xQvD0*s*xXf*moYG`@%Ed4q#8uY%t}%~tNroM+$MX3!;HD!GoI zseRlp)$pBC`AT%)IBUcdctGAV`?tr_oWlR(PAvYH{u& z$9HZ8ugYzy!Q>YIDpxd~xe<4zOW%lNO-+QFu`<r_=!`D0( z!;0L05}vY02c|N51WSn!Gy}EAgzeGg)37H}@BZ~J%uqJXzy0}jCIg4DTdZPOS_XvQ@MU&|lr+4BF6hJ{&*X+F5 zLM};sO$YBIv}})3VA6!PkL$&6Go>qjfUfh?M4JB14K^KmdHq>hN8qbNC6Ine?JZh* zt5Lp3E$Ff>#90^S$6#Z?4MAx9Ks9Ld@%cWM6N@ho*AMeNGJ8|sw z-vYP|BB3D#TwkONuv9%wb*nHH+O6V3V!MFBfrAT}`>YJ00W zRx5v}9w4o-Dy$5;>oYqAi(}g;;b$oKbuiH*@7hqdU;sfJSROzY`QW6BT)$kax}fzd z{UZr~!UCa*RG!gwuE3|bgI3bQl#aH(rPz4oX<_WjTm;OUi7q9`5*yOMIC$X-cU|MT z-*NSbbTF3Z^fb3+oNS?)Im&BMBVc7yfMCR_0F&OTPH13kx%;CeKYv1&9zmoR#&!G$ z@K4p$;IXt}z`$i7YGz)d>Wc7YYGN&^w7vb^8a50$(+l*>^hK8GYS2_$tHXpJ@oza; z=EUeYuB)+GpSxJ97`}kf+5emi0il5oJx?n=Crr1}&uKl(}yX5dQKEPAZhU zmsM=kA@=F(*~RG7cNPepHMsmmql6H zQ2B9{QLBlA(_V*Mn+g-P4H}`$slDy=_u6~T=?O`$hreA`wB4&Y5%0J?pJK%XhD-X& zU-;&ExfLT3VsbuS7CSD`kQOf{eZIT`f_7lIi-PT1(^FsDBJt%oAmPp01fE-gh%{09 zKa{OXYK|cPz+crV#uxd5?YpbsaU5+MR`jp-cm%E!4`ZAl0bo8Z`AMq5JXFdV7KCv z(9@+PI`38@S!xUM#g(v*WPHrdy{uLndt?Hoj|(2-rP{M#Za_Jcl!jwyOolT!<5!06 z6p0P68WN?1@-G_Bi^mez+2cT_{XUMa%l751>xlHnsF`O`EOMRmQ2xZdj$~+h)~gkm#KAmGF)p6sDP?@Eoc&F&;&Kxh*bTw zcxol{vX#^zkV?B`tzr=Z{#Bqpwc?~=Xvv$<)h1H@2_+GOaH&qLNf8E?so{u~8r37& z_O^rT5oJarq!JgDPV)|VBEDha^0LZ07kM6-%ikreZkm_FQ|C!N$rsb-SF9C}kyckw zK?H*m<`3jj6sLm91erEsr|=b};sfXqT?e*HD{1cw)xJSdS5TXEgMf2E!^QTD8iDg( z8`yUi%x~8Zny(|eT{N3`sXQIt&#^`h2?`)v0+N%;RZ#iJrg6l_uXlErbNDkls-Hl_ z1#y>n&kyCe_2u3V7AqJzkbYi@)%RPf0s@L>THzFY8*C^mE2K3dk940 zuZ)09OSBOHuM=YUjz^Q!s?>=WH=Ycv(h8xc)U9Ylt(jo>xjo{bhS91m&F2?-0Md!a z2TOf47)j3zVcE&)2XR6@w?O6-M6>;`7EBH5A-&iw+Nd#$@UR4G>AeUec^};tcGTMX ze(*gF%V`Yv8R!Q3X$)%C379otwP7vUw7*BUm%m{)1b}zgPVC0;9B7inp2=;ZY5S}8 z_P?wadDCE;HIL7}t7kOxt7Xu!M4RojSI`lDyo>SKA2FIdSh53C%$^Cr!aeODh%+nt zNyZ}iECvt(!Eve8W7Y)}-(3l6dVie;Zu@=bM|~T&D%Y?ranNL5{YiQ1kRp-*Sq2$^ z3To`nUp=eg=ODS%p(wi8(f*1jwfnp^Tqn*)zA~={eZGUZUTad>P6sKnf13`}_vZ`u z2&f@Z{|oO>+ZHZTHx-3&>qbmZKs@K6*CYIZlCHpz0FC8enw06RQ-|_MOTUh5(>Cn= z`O5dS0p#Y5Nz}to0_VFHy{65ij^gy_e`0EUa7SBSkSagTBXw?q3EYMV*ggCO;tMWD zjp#udTW@`)AD4m0(+hwMQt1ArV73_af?6zcGOO+$SGvQ6BXM$zCuFaNNF`zMzT%_+ z6i0)$fu9NPhN+xtDBb_9g{x>{7gpWhJ@f{~4(m4X<_`h)c8pMl#$60EYR{zz5xeAh zaID=leHC~Y7y>2GTf+k1$yl9gb2*xfT{$vz@AXvYhiIX+ypF+6^hB7S0ybNFC|-({ zG5P%b{L#lkE}`~q4lUu@V35^zMMN7D=R!0vw6CGJO^*YbMZPuo7vh*Q&^QM*(VlxZ zS_N~f$@@KjemkvE9JOqrM^Kdocu|25K0 z2}y~@&}fVpt>Zk1mXf0kP4Qsi3jLI&7xGue{%AxLT^~Lgbq{p6f7x3)_?w!-k)uR} zf&)lZ{YdmO*W!VX?qW*X|{cclZ(r#=j)lm9r-D}n{H6Fi?FMI9- zIi-UECONT!fwR}PS6otAYCix<31s3EmVqH8#pelu7X8p$vTQc`vD09I$8H87(x`7u z)AiSMO)b2$G?oCpZ(}_U6mF2Dn#x@q`>@Y^uWt_S3lq`N?+AW$v{%Nnc=kEhe*xRm zXzc;Pk(lzP8Ep(CbG#T4p6|GuSJj5=#J0OKZsKZmyQSk~ak^6j8Qi14MLN9-ys&rW zMuI702TvL_ZIm>w)1&Q9!kl%bf2WKuZU2G~WNy4-D^&QT6#q`j@47@Gm7gbIVRAOa zzGIF%7OgM>*k)e*IwI}fbYPw`bBEa%<0tJ7q8`JK+903=|n<5D#769 zRBXkt{{2W{i$wrjWmE@*FQgp7lxn87q-8|OzI*BG2(}X;yL@?3ol*`}RdixVe!4RE zq*wCWDbO@PF@}cqI?L-oooB<{lI6I-ZsG6w*Aje}xnT)hj^-3~T)2SKvdPU@jA*Bo z)bF!aJei26!ZH5?^#W;^Xj*TqOIX0S3msH7sKcHB%+Eo;!MDBlI?G$kHxSb*r#u(` zjes1ByQf-yXLbDYCpc1^oNz2nkW8yWfcV0bXvl!BM<)v`fP`HOAB(#!WYaC=!tVj^ z@+9-=)?>%P6IbvZXl;sl>DS$RJ+bJ>OE7U-?g9YI!f6nZ{q8wZaywC5-H3CW;+}00 zx&BH5hm`Ot_aPM@8B&X7`BxlrS5iD;gQB~h>w`=YWPqHJ0V87h6Wphn&l;$6zWt7O7yl7!t} zXK&l~tulnrvN{Jw1RjvgHdo68?4^oIbYQ1#>K^>|GlLGhfi7gBAh{I}d^Uc&m1}$@ zif#hkXoh}(j~P>w#86A_VjPZb8b%!}&arR{F#9!q|D(HaMTtPY;(TevAk%;tAk8ZB zj0jWPw=Kk_(Kk(y`E9D!HnNE{1g-ZOSYU!sE`YYD1L_a0T@-fWjWyqxSOPiJ3JWN~ zDcEo-_=K+T!5_AYe>)XlCpWXjFIJFMukE5D;cU}V%K8q|=xJyi+G(W@)dfFnlvEJL z4K{o66Dx7g<|idsWqPbrJ`$QIO+Jc5tAa=_iNok^&fVqQhormwQ%cH6Kx0^^ZJI*c zxH!Gj9tH)~p8o-{tXg|-t%cbYQw34$qyLhz8LRbVX7cL3*twZ%!41HYq;t$C8DnIV z;)ip@H-*rZ{HVZDP8u?71c>V2JM3u~f{e{0A z{UwyL_L60@H8Jm+W7zz$G2h*j5bee$hz&9(lg@dHG@bLvvh#T|)2DQP19-crM?XEK z!Y9Mj2SNpGMr^ODhN;9#(a{AMaphxzbwKZtMoZ{dNTGyS!5rWzFd^mIe7{E%f3Q_a zp=Il(K4J(v;*T#WcEA7-3Cvh{S||}a;w!E}hYkh;`Z-VnFGD%Ac;pTk1}e92Z?;zx zt{<~~utyZkUCuEHvA3x_Y2gX}mUj^ni&2H6eW&82>%8*JcZa*au35|LUrl+LoQh%?eX`UpbO$j<;C*4dPl*NwSvSF*(L8OpJ z)A!gr^{^&?YzUf&;8_UoA6pg9Ig*2g0h6pL3txoipY8mJSIyDwfC#R%*S<#Z5~X@)X=uv_3>q290`h0<~v{0^}<58+3o%} zbsnK0Pm8WqgRVu)zx|J+kS_jPy3)LcHJ0anc|ru(Un4fxQWpJNQW+JTL)n8dD38UohcmOm+V?7EY1Srb|?TPKm##s9v;lHUo%`rGK$zGRo<-U@@ zB3fh>(+mL-f6Ncs&k)1RKj1Fuw7ZYCz^*p z*TeAf?3A%hUPeSIu;8snpYSTPi>lTQhQ@q;Y3Tj8HqL9W@`m`AHcsf5BFO&%Xw3hJ zt$hJnbO!KCRDk9lKlT#MVW^nWhykO1Tzh_<*LRVlTf;L}M)2kV9}U{f>}TK}7+S{j z+obESz57`S^o=;|(Ijbk;C(NTVG{#JLFMhh6X8Dx07!B^^H{!JB zws$O%$=Hg1)!-Ar@i408Vncw7(7_X&&b`1kG_oreq?fWIySd-*5&~1UF935dc;=Yl z%hZe{3G(`~ZJ|0zP~8=8cSL;${7jcnTcaWohw&LFfHT-YatG6sk^C5d)5-EXX3&7& zzVQkqu4+LQPF$B!GstC96;_v0fcb%i&Hj*3+MYn5dzO(~4-|UqOf3i}03;ZnbF!8B zs!^IbR8)SWADGc&wD~?5lgSaD_g*p6-DUr*>mkXId*&;&$9|33FY-Lt*F|VcjA&Pn zMZ7)9qe%urcn335pEE=pK`sMV_ynx|3pW zwe$w!_MTI|rV(xW=!lMrxc`=1j>ZeW`BnJm6L^26m<1P$LMRcJa~WwgM%1RhdjQA2 zAlD>j<^5keH2=t1oU(Nr{v-c6hWKB-j_E(WF2%|wp96VtGuv?!^qLm}6&k>*UGH|J zQX)I;{OGigMUmrgwY(=$^nStKz&MQGs-50piZwPi=@T;u-u`Z1CTSuUNQ?Emr90~K zN1#FSH%Bg~P9IG~)WtZ~JZx%gGNni1g4g|vNj_^Nvn&{>ykco2Jh}C@3bzwC)WZV7 zn?KZ5dhu2#xMS2YR%{UD8-8J9xG#Q{bo5x{iapBA!e0(@2#AEQ(@cJd$Ys8{Ar7SG z_T0?=NJ7LmJ7n5ZSFp%swpfk|`AGQ#S&H+ZK|lTYRYK6U#a@PY1{ULjwG}<_&F09+ z7UO>GD?7nu+6iuN2ZzDV+tM`X1of>(BY})5XqQFQ{FUpv8^j2JeQ^#V4mF3Fr+fu| zf1pl|vrklq&1m5gm?ig~8lX8Y4zrMaVsQ27Dg7c) zU}NmNN5s<4!h5c(oI|^36_4}`_M>HfTD>LENXFykD>@Q0ECSwa`F<*Q0)$b<);x}W&T4^4-UlB>Ob`j);LtKe zw-S2QzQ$~tRk3d8H)$GPF^?bYxdAVzPavgKpQ9vHd=v*{VtDRKL9<14#$e@A@__y` zex4uhP;(5Hr7fljc=+?sYg|wE+d$MmcrbT>Z)hsU^u!X%7+hJ092f;S8<%GR^lb@a&J&Vw+*8Fy``FPc0z2B~ick{^J(OkFJE2EH zZQENlEAOZHST!;PnD5X)-`mcnB>#2~d!qMA;Zu(pC6)sWapjiD@-%58r@9|gM1StC zurLGNG^T2D`i5cEeZZ?q%R?62t?3H;=hfv<`Z>{lRNj(mjbYf``WgkvKANThx-Ban zLyD@Prf%@>zheQmDe-#Pw$NNfx;Y4_%|^^>zc=Y%EhTDH)K-JqOS~G}dVS6V$@Obvqbg}4+{Ng0d zSd&7$(f1>ty`219R%eiRP$n^<1LiuF*7VaLkH=AeZ?5G^!mq=-hP>1JFN@z9&!-fZB( z&)Pb2nZL#!dz9Fn=sxM*UFd#I%Kw|?Cf+CD{)^@Q(G54Y|2LKs8uAnQPUDoX++5nS z3U!5pR@M)-JaK%^h5R3uv-RtK@cc00CUAT9L=AG$8?YxsLyz>@W0X)C*{2ui++fRx zc3VJ6ix-qg&S9=Sa=X7Dy}>e>aMh!;@|_&t!&*6R|CWXN1ZwHfUkdC&yRBZf3a=)Hn#I&c3K%luZ z0ouy0?B>x@D)>{5$k578;g@p#i$J zz5b~&?F67|XoH(>-Rsz?A8p;p^n8$%V5Kwyfye8C5E#_PBB^ZXNjdFtc2;~XD=9O( z5nk&o7=L0uF%#C)nC+ZI%{lig}lZY2ZLLy2nL?CRrBxV(E+` z2}R|mf4w89w9DUVFSq_BJc`zOmuw^It_8wB4{?mn?U(}OG z#Gg%)^B1xXogGiUWhwhwzG~;c&aDXIPq5J-KtRO4)Jy*N-0FXN-G5lFE=B4e!6x5- z1e*Zb7?fK_`t6owwXwR(Ah>05O|2mfP@;L3Z1I$_j%Rg8K9}+ZMidj|;j;(GVZGaf z*b_o`gL19J>=%r?fypGZoV7CGDKIh;%{XbD^oQ+3EKU5z;r1FkanHWZ&&O|v*}T>v zX?l=l^v|}MWF!uB!mM?)S!H&9PwE1wqMYM>>Vj|)zpy2$>I-S>wN|T78^fmo4v3mE z@@_Fr#dgDAX5z-Ca1mrvwehS5V3!Z@hvUebIBL_3Lp-1Wf|d!!lFwhtdJ?74{2LNP zRVSf)*`n?P&08$-9@4OKB=<2A(`E(vj?~d;nW{~J!;v*$FjzH7Dn!nW#qJ;#u|$oe z6g!})&Qp5GRF|?<(5m%;dD$Il$Qlqbb{lfIu=r`Xs)+Y5I;}eCyvnEd`Rd&*PnF5i zW;Il{ROXX(!44d78aJ%PE3gc*h248Ceruh3eO__w?yDomYV>^Oa!O8#9(tI!_s^Kk zHE+gwhAyF@!gVw)saLL(1My%rww>1!Vh*-VvV)K_AZsN2v0Kpyo%+J*`ed)LNq95W zEI85O;d`;~-9PYOmy`?PEfLRz@5z#b$Z`ge| z>S9P^G16$&1nRe!3#OL@Jv#%7mU;M7ym(g9Ld;{`F(lDCnmP9m{-DpVk7QVZ2uzU3 zvIPd@G7<;tTZY69zYU%du|Mbi^>EnwT3SjHalLrQ)86)iw=&;tyv99A{;Ej6xWPYm zIN!-cWws-nZ)*eNM;5^vIyT9gwyMpIiDM2Y2&dXhdL0 z!;mBMX|WkDZbKWc4*}-?+}?fIqpqRXz&2@hyh>wCKqY zaDbTm#{GfSHf-ak=FRO1-Dp&6k&9INIX z%3torH|AlYt1_U}k4V1HxP=n`og3@j!*A{YN}U3RnKB#q>;gQN%ey8$8DIaqdHd$N z5Ya<<5w&Y~gqZ1f+CRb9;z&e&Lb-YyoT8pauf~HE07D0{q-sHN(kWXmoKlGSa-pC; zf<6;IpI>)Xq=41BaVDW548EBCcPo1v7!XW&%a&tE$2<4}WZ2Zd~{d$H zbO+sOKxaQq)2!LJi;bWp{Ss;(iN{E+&}Uq=ajKzn%(#OgitZSE@6$WxuDP=pV}?(A zM|eswppNE~M9O=Mevm0&cs(HIA+A+=P=NaZ$%TsQjy=5{l}!CxfLQB83K6I~lV{|cZRh?KWvUjTaY-vIib zuWfy)nl`I!=)Rj!XME7^RKTw3{$w&-C)nW>7XAPni3MIu4?WTq48gAtZiBKR?~nN5 ziAIZNI~=Wh-KfL8F^2;})R%mga0Wbj^!6IjmX~AobXtE{Mo0IDKJJ|t!Yrl4m4Ag! zp~jqv(Vih4@_pWUGi!-kcb_T3v(w@)(@-r>*$KDwK%kn4WZ6?631$`6*&Z3h6)i2x zXK{9%HqYbkvh)jfDH>pB4Z3PQ@KH$3rSo6o)ud%pq+%Vha-hHv&hR zJDeix_w=6b1Tq#oc4;3!DyG-+juUWm^8tv`Qx&3YSuTaiRhoiNuvS$%8q&G7H$8Ak zf0n$@&9Wi5hxd+rcOMD-a|)JHQ?s_6>dRnCrOIjH>}p4i0Qr-3Z<~{Z09J9-D%EAr z`B}j&-SlTem*E`y2Sez>n_J!?0m|2k;TK+h&qsPaImADFE>W>;SK(p=S`7LDnv=al z0_Qy*3g0WSieJL<9H*IoaP*f_cH_qaS5356v+|*~PNL zeVcsk1`*SIYp_baw7bpq_#LZ}wKC*@73G57QDX_t7Lptk(prdTQxz2XPGr^lzdF|o zia}kxUl7_xa=>_auwPoQ;6ZJx-2^HyNditJRd|l&$4I^hYi2hR={Ps?OS8ZjMn|0I z%&i-3*F{-UgByJ7+5R5Bn^XQU+B5HtV2=P9d)bI$p1FsMbPl z0s&HgiSVyVX$9xc-wIRN@XAGtxJ-T1WJjpd6zu}+@JS2KNGfs6;g~c;DASc=uQD&3zVPs2Q{F{a3vl34Y!}=wj3UncMr-4@AV%sxEP-Rm z60zQ=`<2)n7Xw&q@acn|V|^}x=xeP08{)Nyr5eSFPylnAB`GFAWFo;9teG~V^X{xE za)QXP&CMKdqeIFNwAZ+$rBZxi%M=Z9fV9NhcyQf6S5vm>Q(f_A5p#C=@U--4LDBcu z0bju|(%3gOvcNt$jWX3V(sz#OFl%wL-wu+PDpgsU3Rxc3Nj{$y5KUtm`zqF{1(mjG zEJz7JhDv|&==APYt@sgEb z+tC~Cp56X;O=41(7bimnI=<($)veRJJ_Qn(7+Hs(pU zqK0h@UP4upRZzNMST-BAPB$O^O7_GNSyN?JG5?{$zW#k9qt9hRmq7)l=pW2{C(iBy z+~>mj=q~XbFzlDLx9a`{uh{%;%*CHZ0lR7uj996q5_~k6!94L_*erd}Zfe8Yw|Abxm@yq&Q;1Qbi{_cM^zMQfnFB0=<++xIXSW&a$3sJWiWr z%&32U9(&)lgqA&ElMG**j>+jvd;cr{l#nBKw0#BX`~NLi|Cz@BCs>h_)#1HBc*w2y zoJ+krcG(|^yP*k%ct&*R;Lw_O(uT`R9lJLVtd3^6y;1Q`orL$h*}DAm3k~e}4blgX4d69L=osO^p99LXHru zU($`~{}FQBh%9RV`h#vJBqT2(Bt-OOs`Sgu(ijAUGR{y>Pf?tfa!4OlPj6_Ph6>i+ zMKLrqQcRRA&pS&a2Sg1Ch55BY6fnZkbygnkDRw2TIT2Yf0*LMHP;GbZRj21ERS zhksK-F)$B?hX;FshkrdFO~FVKh|)J=`lUzI2L)09BY{LRy5;>9>VMO=0L%;e6@d{+dUL5Og4>7BW5 z|LoRw*54f%`<>?TdFXb~T>CiDcIoEB%w@NMHl0O<0t*uh@_#K$f&9`LM-r?O{On+l zmz$Whj~DB+$*(83+xcQQl&)@1@~^MMyMs5%%WwLRJ}-M=++Hurv)|qCj)i9u0`{-qF-@#p`EA#k<9 zWrL6TNw1sia5y>I>~OfpoeYOrclo86LA+vrU!tWXRb@8=4+(T6mr9n7CzGQejwhdA z00#pjRXLf9r&ghsDCezydVS5vC3q$Mm*;#vToXBT;L1T0kAk`wy35w>U<{kneJ?bV z!%a~(izC-7OYyWwE_;ESt{pTEeyP@dt)20b|eHN>Qszi=={=Y}jmjNwD zVKybEBWTcD-A$WdsZ$pb06DTP6tZ`<-D@w5&5Xi!aSAp$VYys0d|KH_zdRSuY$EGM z;^9o!x4yV+`$ozS_TQyLz*kgelVc*8V1HjK#ptj?yT)XaV7U@L?e*~-4U3g38Z8us zB-m&;Uc`QXgzPJ7$!%`8lCt##T+Wt*xZBD9eanBY=%InJn6K>dyG5kSDR<*z(KlMH zQ**go%q7>FOuCO=(Xt|<)A(ajz-Ow#exs+QQubKGMqb7HA%CF?~B%Ew->Mym6FjBd!HKp|$!hgqze-r#@&1!{o zwn#2zzvOB%Uo580?Jr(N7(lU5lC0i*Ft5V_gF@ZIlLMG z@xSQ$>W8elU~9z(q#LBWyGueEq`OP$?(P&MmG178?huqlN{~iCLb{u8^WOW@C-)EF z;hcT;o>^AX(HgYmSEr~Pp>4S&WcvWcI&TO~5;sPAx_lY}6=`dMYvAokRz zTKNnypE?cr>I-5~3ctsfVZ|#pyXBUR7vz6XD`ZK`Ds?BSjYLZ{YjQ8IuC%n&b|jwq z6+Ip_D7uQa=>> zllIccwE4m^Z}ct2I= zR}80tPn2wq>r!z1_FYukDst%V!X&1{$;!=du`I@OLySk$uli7Q$)AkU0ZCwKuh3Cj z@8I75`7Qp@c(&TeF}Tlf*Y&d4jt7z}8N-x7r}inaLR&hKL96Fipuv;p{*n*uVH;1F zuHR_w8kO+@ zFJSsRAMUM0_e$8{cqE@?rcIY>B!LYimC9j}KA)oV`Kid`{&+`PzJ2&+)6beueYY>#Xe)1MpZ*V zgK8Wkl5*wXfO#a1J4vEc+cTZVA#yLW;>oAb`~==3k)L5K;W20-67g&L-kfO&Bg+9m z(1ie1qFnIloRCinOO2KAiktSyc+epVjxYkz-!K&7!C*KHc@l8vRXtgI3ch=Yu7^XkwxL+tGy}h<9=qb(S|- z#%s64_2~auWBV(bVEkLv+ zQ&3$kEV@)3dSMdT;r1XHH4&$Lb_*tfoc*0ia^0JM1V;i@&%B<*D=d-V%Z27dHLZGG z><_GD`F=WD`(9h>(VOgi1x?xyvU2=XiHgke`T(WY7voPH7Ru6vKR;8*Gr*x!z-s+2 zbHQP|yS>%j0duv@91U=}g8~EBe^%%?p8S#9J4w85^W00-ZFUr|)a_s>w)9)=f#&tQ zZ)@0BHd`1lg0h&%kJE4WlpatnAXo~+|Mb)b*GvNsNF*o-rl-Y@X7CMw3@@-yd*S+$ z+~m)23Z)N#PfCoqY^L$2+mlwIvN)`(HD+o7NdQ)ujb$c)IjQ|6pQ$$>*lINJeYr$} z-sWo4HbojBLv4gr>QPF6qG*`RfPZpR2LsG#s!0@j=d$(WY9lJ#JE?;S)=nt9^%s ztk*JVX8U6@DT~2lGZf>p>W$cJ6N;td_n9P=Ic-K0e(@N>{`JM9*7Vf7Gy+$NjLM(o z^!^2mR0^93+0uv3C*S11Pyj=i_<~Nh$t4X;RqjU%@~n2NJ?v%3j!ZsGrq?e|##WbS zmc5Gx^N<@&=6_avaoy7fSvo3R)q{_A6{A?CvC{kD?n1lo=CE<4@yTeRP7Y4$s3Zid z+V5)P6>c$q7m8Rd4U^_5?`qEl~2PBGWXv?oMLV z3l=4I@GC77%e72qf8=~pDd5k3`c)ni6(13~YK`s9UgH;sH3>qUdOMY3KK){QBift$ zn^aPaQ1XZ?2vKnzEUZdcfYYyu0>}GXkCTKi{xF9`w!neTVKE_QzyEYLD}O{S8PQ0Q zq8X~J*f!*gy(Rn}9O?-ftQR1Yd`e^d<#oYd`qo3-r2qCX zFNVToF#en-mGrA(XxjN}bOeGWl>iFwR zlr}Sa!Nb(P1lu>>8ZI< z4Sg2xIswf;C(geQl;^8HTRPlL|(OXL$Soo(G7fAtw?`zwxv!33W$&Wkd!2Av@(&t*63^KCv|Y~ZR{H{h@!6fbg3FhN1gqq2|<&uAiP}j^>)mx?|KhIRvjas zI9!I(V72+|fwA}(nOqtN+B){BDI6?p>@^aeRK}R#X9ygI=ZPXO*9+L)#a4}P(S-Ce zNepq+3Yj=Rf?QG=v`XV6aacuG+NDXK$gt>#{Ew*LP|zSG)lCsAmRQgmr!VpRj@Rpa zcR~}_hF-0d!q?aLoDi0?5fZ>|HVWG_;rFn|T{YU8LT)B+lTNFgUk!1i6MkYVc8K{) zj7UYFA7=R_3J1Z6e+g;#8%$(O^S&G5)?SiTXKlQwsmnc|sWO;}_?umgeLU`&moJ;5 zOhxm;HkyF9&B2`jr@%o5>)B&0Jkv#2`CH zpFa(SAw|GY67x`T9J$GLRp%hs-jTb5@eOE!f+A5>fIAnSj>${^OKrPeft_+Sq15Sf z(@j6WjR6*1G=Sf2Kb@o4zyO($4|7N7riyISz-l8!D^CJwr1Xh* zFMH8uQ=d87BI9$(nvSJX7H96uO~}f9AbH6=$?HC;w4wPgTq&0V>-`Y@*3d9}>gG3s zaB+F#2ZP;N?dkJBjM`EFbhMjj5`-n8^4PEVpKgtda@ozTQ<8fMM#j*q$7lIohhxC% zyQuQw{0rsE(6W_O2;=lxT`gcnbQ*27_AZ;s$0Uh;C^Gomu!GZ8q`C$niHv%5?Ve}o z?)IJ^5=k8hp4!&5P=a<-3vC{?9G0_+fq{VxE{3{lR2r4K$D%Wp z%EgML8fh!O6e|u;D5}qMj@G^n0MTQ8f3cP5VEF?w7!OR>S0B6AX8d7k1}e;#S9UW;=az{lDfZMj4gE7;H775$1Ps0m)X z4p+FASF^Vj70G7M0a#NL$Tt=6&x86y+5-I*@HjUgj>76}=G6gweD^mfSXL#| z$P!El$Dr!Z77kipYWI?GH8GzDP(CrG)^xnug2seP{-3C^f&lUUR?Mq|MP#vDnPC%S zF`Uf00i?4;(~&e85XY=vBh$%4?W6KIUDwsAJbdqOw$KRpPKB6;DBk!NEr03Xjiyer zf*~zK zPNxmWp#GVFg#Q#@H6UF%lNgyUQTqh4vztY- zQZF$=INvw~lr$z5&sn($EPARS-)m`rQ;fK$OPJx3MGUXLm`s$YP&YfQh0@-&P6ECz zZW2fri1}Kcz%6yPTDH(cLc(a~>mEVOgwgt90Mn1mj{l*l%!1t%STg zGXE^GAh!jM=-{wen0192v79a&0@{%IkGfS} z$%G1->}$UV4GU{7B^J*qnkzXqv8O4An0yyKKWCPJ7gdFJLww)ISCWF-2zL<+9w6){ z0Np@aioO&?1Mz1eL34GsjE@7?N4nniejr^_Th0DNDKjTwM)&rgmwp44NwtC{G2-iU zGq^RLConR)asP=*j_&>U=mhVplhy?oH^4*fBfEeqRshZ~n?!+o^+%wn4>4egWRXiE zw-(C^Je4Q&Al7zMw`Vg31w(Gj9+;`GGfYO)wW#D%DF7pME5h9eA7F*zxh}o$iihV@a5_%E@`pyeOZ5BnTMQ^&oVoa!wR0kKtQTP50kz|0=-5e ztxC~E_SNr&H9R=?^f!R*8W*ym&-LA~9(FyqC^?3n-{9LkdNGLn?|XYE`ZGqQa@#G% z7s{p1ew&Av2qzT{i^$5#8p|{%;DOT&c_Y7Z_o3Rhb-hft*0UawfTfG>viRi_dq*?S ze=jnX=6YOPja|^`PbB3ti9$#z4yeQ!%r#iO`ek|>1(E9d3W=>kCrYDy8-Hj&R_PKZ zVm_3}aNjq@=W)Y0mw{Y?6X zwkXL+vHnqTBnBp7=X)mm3(bkd;*Sij13trSm1KyR4*b9WKWrGXJfC;B%;a$p>A3rY zALP)q%pZyLxk$D~PP6QW+!TQVHL**3Lwd17hnx2uMwLi@I1Z0_>{N*k_wE~p%UArI z^XwTR&@qT=|Ej!)9M5%dI1iTE=?%DS=o;;o&pC*Tu4R&0a%3OQG-y?eV^wY(-lHE< zL8%nUf!o{~rL#JG*6;6b8gM|+8qWvf#Do|YNo@;*S~DjQ@!z{}mJmPj)o|XDgdP{~ zn3|*Taoq1UE)NPl+~$eOeB+E`&|!f;#Oc0x$P2zFA zTk@!x!)Oa>94$V;zqDDZ8<^m;TWC@O%!6ioqM)`eQ#JaDTpmeg=%FwIve95}2tpKI zC(|C4LZ+@M$WV4|N1;r6HE8J7>;ZH2mNIYN_;Uq&octL81C^~g(}BRH&F8vfY>|;A z=tK7yQ~+7k)>fdC{O7~Gfs#P0u2VVz32>rOfjIA5rA+H%{u3DmkiT5U%Q_gcD^KFO zJ3FCT@XP)g&QEYy9`1wnO=j`>8nH_6o0Jrj$dE&v0f5WVpW8oVb?R>YQIjxBW1HE&V+r6KV?*^ zm3mbo2x+bSG4iSjs}ez5-Hew6V+^WkzW zM!DW{`hzdm-Hl`nk@R0K8*3GdC1*p`f54km7d@=zXtBrHj+(`CN4v=?_(2tkC_GB> zkJ$C)(W;SD&9{Q~J zh53osU`g=bh)gAn7d{zGpf3~&FF(nGK}iI~D9HvmKd_jWG0#e~0nk*x`3tf};-~`d zFX12~*Z)nx{aoy4jTS0Jg9d(gCZ))`=}&B1e(^44iIEbO!v0dVGJa0iqMPlh=33Qq z&GGHKrWbIRYyp;PWg+W7b*t?IY?OeIDy*cY_RW{{yAPwl9vsDaIoPQNs z@#PT$$|k4P&son)kj$nK)9&x@6A50zSKJ+aC;q>FTL1B)j>A#<-&miD+ z8U#gR(TI$#IUWEqiAfK^y;0Ht-PDa&E>|y|=Z%(BB0P%9TjPula6TbsG5d?q`e~R? zEXtueRAFbFL6g1k<9(CT9f$p?#UgSQJ8>q`=Bg2p9@1xP21oDu>J8-6c}SC(^x)0t zy?oTZsM2m9t;Hm&USFU6Jtl7-V)U>s#{4Jb`3pj1xh?MxJ0AvsT7QZg69?;BZVc`3RNdTzgO~t> z{J%>~_!Q3#sO@*AN>Cx7r~%QL%c5PFd4GiP zxd(?+*cZp=V|`SL70&UZ3Hdj9^>N71@SOwet1LZGrLry9!?_$*H+ zb`J{J>MBv!PhcMZAqcL2j9zXlaQ#n@v$)l30j3R3h7Tc)6nyj&$FniO@^>- zZUNs-sKZ8_{<*fITBWbIGgVP0snXJLbkO-Qm>-VeV)HrbsgsiOzrR0DE;&r#)a2uK zFfO{}`M1K}Z!L*pMH*@o+yQCqMzoFap3n2N_@_p<2s9x2AGO`beAI|D1e_nKdN2FB-$fsXd%9?`*XBOQ|rC8MPn2|NjN^Aw*y;P zi)%)|Um~vOo%}2^6ciicK-pr*s;b=-4jmSsnAN$x&(5A6zP2whJ_e zU!29M?vk_cWJNT!fxDo416XVbZUqeX;If)0iZZu3dK;lNyqPToDcH@9y$=zyVsAq z`CWIDx#DV^e4?5|@mk)i*hYPMht>#;|>^c625$vP7gEZ^PEDRxzFapYuhE6Q}%L}5i^-peQ zkqb%xMfWZOs8A|T(LQ5(52!wc*f%W~TSmwh=R0SRN`p?O&(sQuZXY}8fw1Oa+2-EV z3d-CKF`b>ADmOdztVA41RhpF^8h~l^RG7N$&0#4=Qh}gw4DRY`ozCRmMLakJ7~!n~ z0+w7FmrE&!<&@Nlv`h{4^EO!h7H4Ul$`Y%7H8pF*3%&B?78e=YV=L9pWi0v zp>G+w|BklFk_lOZ@Bft{`9t_C=A{$y0=Mw0pBTkAjFmy*)1Oosr9V+6`1?PzG1__M zm1#8v93@@ca0@LSDonaNZwBSKwn_*=?C3JYJZ}TFJIINJYWR}Y|^puy;sBmn*Zu;A)iLQ8Oa$z@X5)! z-zH^dfPLnY8b(9+m>}t9k>`U)E|qIm=_al0%DcN1ZIbbL6%oYxE?&}>w>n`iVw3IO z(Z3fNFBf{LN2kSjgdSc?Vo<)#uV3|&3?Zj_K8DINTpW%t&}86yG)zOVyU}{kF{xin zu#lb>=dS`e^oRbsLVWTN8;XR-SAPI#he(40s*rGhOOZNoNRa@MK@FvB45@7Y{I%IW z!JZM+o@%M;z^T2b+xNVg`!jrwSZD<7{!9U{Q_G18SNjfRLN>AMk{)5qzvx}T-$6*( z2-c1+gA4m?$y;`utIy-7&u;2D@ey4=O><>nJ7T5p*|(8+fco%EWXEDz^Nf{0o~O`$ zUMYzGA7jM|FO)m>o4Q!nETxNA3s&-3f{dF}0x%c2vTa^(4U+@M;Xamq(!~8_A0u6n zc#6wrevurxb06p>ms)4x!{^wqR;WIUvPqiGRGkhgJELWr*(Y>r*rQ6`@7QKOkBN@5 z1k?~=w9~3~PpMkM2?|XXC@|w5A?A;&$ik=qgrZAsn5^U!KR6Tm>vfsbDw+5rVNzEL z^K>T-SQ%WRPppb3{8YZVek39F87Zj^7To)(eXjc)K|$#Bb{5nxqDe7I}Z|EvHKRD~ePr)JK%j z&^@C^5*k=Y>&-4~e^pRvIK;rIB22)ndi>CVM009FP5YdhgoA3BvELffK!Et7nSD(6 zvb%nPX3(<biP@kbG?2;s`Fnw-sA_`QPN4;C!_#3-q zl}!J9+3SSbCPF&~_gIx?a~mc2Z6ELq@vl2dU*KOtY+V#In-B#aGtw6L&mxB`$Wn14 z$|d2X3?H^?uRYBBu?Svel+cxr)BP@D0s|wUT?u62;c&#CJ)FkA7IuSV#vHU?WPa7l z5V+_mPN6X(3%hVK6XoYPy{ri{edAD+(SP12%Eq66^eGUZUA!*L90yHOn<9%cQdS5B zp9!vi zo62Zds~Yl)??E;4@1z8U!IBOmUAoSIm8zen`kQ`QS5tOkzNGQetZns_S&# zR^BUI$nkkOkjhy`-BM>wT$Av;O<}o1d5Dab^{|H>^!08Ofm_LkhDRg1-vg0gnoTlf zcx5sr7tWQaQK{u?f3y41JDctoScvJctbId8YNnAqM0p{^J6(Cxn~iB6F)sx`oabC5NkFpythT9xpc2 znrFc9r{I^28lGt;W_t|V{KpS(elmd;(Eq*vBS6p44$AVlOR)+>2gDraJ8n&J zUp6n6{gP5a@sCm_J~k^M2&yA5)*lzL(i`yC1W1q@dK>nN1&$^ud?pbjNDcRYz*eym276D__REiXOBvnsuWxwWmULB4;z)=GLDkGS zqNV?;#aR*MJD8OR-5qozrM43FTkttWQ&?O@Z|lJzFyG_6+ZR+0({8G$%zFey6Lb{q z4tWwrj)lBa&$$27N%2wNRL*Fzn+<|6%Z!A_@q=pIXeA#<=Gpdpzzj%sHJ1s`;Q zzu=v97?&*}v|_8TdIwsv=5JS3r=q5By3LHd0nE zHWy6ndnpW0yBQ6Lu0@|h6kc_ugj}1fCZz}c@wv;+!Y>+I>m*1IW$fMAF6lBcucsJ- zILZ}SV8X{FrqHWCsXQvg2-utIz~OXG6(9kTcBKEMB_a6_`G89O}@{>hZfXMl&l#ZY*$8%MZ(&N8=2lp4x^OyW*@FTImM-!ce zlKyf;><>pe;Bg<=Uv3;re9t1XJ(R>GtzpvZUZqMqLXQz@7-0stqKERCXe0ip9f-Q{ zkr|liET6johBY4D{WW)^1Pa^6fc>bBkpsb$OlX-<_U5N-yGY95RE1-XP z#hjThpTU2QH;^`xlUzbKGs^zg{?(%^_x72c}3s;PJe54r8&3k>PHn6K0q6iit z=nb%9h_oy=8NKiK6r)d?DmSeLu5DewR?%*Y_Ol)v2-@Y`@Pj22nDHkRXV+Vq^cMPx z=kGi3uFJAf5&Br6UQdZVk4z~}j`-yeaR$56?ORG`s3{>ZTcuq;=n1b({zwKt_&=*O z0EX;D6t(dXxrbYfZuQ$aS*YaX?*cH}&j{oMObRh%_b2CTSRLI~+_uB^F+!ecscH$?{M6nuGI5QmeA*SlAFJAMTND=67q0MD zRiI#!Z6AvTLCGI>!#j)Xk{SMyBU%7tSx2D$6uYfp7h*I4oBE@f;l8Mi%fg@Q&R+2` z=F-5fq^cFk6K>BmG7Bu{8k&S;f!k@yL-NSO@~iT*gwaSaUkEcfMAX9prCY*sx}5d} z4B}zR$>f}5@EkP$f{;3z+RcLOTFyr$r(a)80)xBMW1&jf2z#EKD!D?q!^mbwPKCu5d=x3C3= zlUg=gZ^Uxs-MZ^v?2z6(s5Dxslybkg^l312r)m<5y03FoZTXjvy; z+^kzqCmyI(s=;qu=0UBpfkA!Cv<%Wg$ zMi`hk=x=;iOS8O1n00Q5L@ec@^ktrr<^sa?yiDPn=ic)lMuwn(JwpcUOvi|0KeK$! zQy7wk3|=Z*_aH(^eO8piQbEjs8bK78rG|rG__r5GUhE%_%owz;YpyjYVHC`{wQT8O z@x!(Y4wYK^KO#K+ks3l`%2-+zsy$)ISA$yDC?H*ZFR3PWpWhh1>d|om83;JFGhi)p zJAbh4ZW=M&v4`1`x4GbORxr5*?)R^d29Yz?K?PB?ebuSArL^g=B}c$!ipA%)4Ms%D zY&d8;iH?8BZd)HpQ}})L9pMUT;7l?akM?Y5<}(}yb?`4{V{!})Mc&sSc~Ds%=Kh6S z``&pOWQ7+1jOvy!a&Dp&A13i2E6vDXpMSK~Tys}M04IE$pIu4mwYy`Y?5@lTI5~6d zFX#fjK9X#D5}N#Q=KM0K!{h#yXNBH3c0;I9(=hW2z!F1 z%zIlJQGZzq*b=oav+yugv_@zH^NtVcS4qUAweK-uB!O<$i+nC>QhmTk>k;96Rr#^b z`j;~3bIYmOT`X%fT?hWZne*-;C^{%E%LS=#QN(5`Jv_yM`nBp6u?{KCP%%bSn0^kB zSgSgtAeg`;%!murCikOU?;J$fQ}x5l_k(e<{(5kagbbK!-VK>%~@wN}>Gtw=5oqcTq#> z%}$UU{+y2wBoDO7Jv8ZzIt{RAqI3a`OP(@1c-*!O#SOqYIGq04PkyC60ypOoEuL9U zga1btXt{0*A6e7?{Q3t}X8mVX+s`5)@G0S6(S68YD&cR4BLuZB_5#+2P9;kdj!rot zxJLKYm%n}mW0TJ}rUKhrLgj%TxFTb>2ImQgHZT3WO21Y52zuno?eZ(Cam3kS5ly;H zufK_9JO7P=(tDWvt!VMMCR2?ljYV@TgdC}?VOiHC$funL?wr!3qpstL7TO$ zJ6EqS1)X$4_?HzglG1hrF|$rq-F*Hb~@C3J}tKYh`;V=yy6 zR~)tPT%AQ?IJT3Ro$cBp1a%ueW(3$NtS&wkOZ-h#I=R4Quk$-B=3~8fTOipgu;4IR zwi0sLnVM)(vl>YbA1CMj;~($>uz2LTubReUhQ+;K3EEmo<{RuL=|)yfaWmuTHRM6g z!aByV%`7hG*Tffu$NFAEx{N<@wLa2`<_#e`!_n_{sm_&> z=PP(G#w6F#TY8+v>2M`xx4$fq1I^#a|X@NX@!lmf=5Z;pBk>K>7pWn>+9Ks zKCPc~D6LWDK>FCeIYuxhnD#zqUN`K5U)dI9mRKqtTEP3>k24DWFGzL=o(SiHxpk z=>44?4ROa4ev}hu&d5G&l@O!N{T_T=b5yYvi_Ky_p^9td2CeorWIPTjKG)r1YA~i4 z$`)<5-l^!1Dx1Xg*oU2mpC);KFgEIsTG?PVh3QIm{Np?BabI&LZnVEIW9 zUNKFFzDVC#A*UZ*0jAD(Z?oKK zn2Y(%PSyv=Fa5eWVI<_r;HVU;yIu(J3)fJpots}-Cj!h;eJ-^l>V=QR)U<6AO z^LcBoY}aatYg#Lf{r)Z@E*jDpL*0R&O*I0vFIv#)av|o{au!hcy4~w+qC&t8UxX1V zy~wU~Gke#rEk|y*@NL52qN&~z@u*t&m;lSQB$Yj8*ZO{E#I|61mL+fbs2V-aswDkp z>L<##QfO*PT}k=Q+Y_m*3-jM2oe*7N+`Fxajw}T(7hg%ZmlgJR1*2AG5WaSaI7Mx? zp3-gitfwqJ?&cYnP?OG$^;d%6aa!kxyji0p_~PB?Xj6#7>qz#waoO`VP)zn>)7Z)K zsCq~ufPvNOXF1&D`T@J|Ob4(^`XnFd-Mv78YVw$qhJQuJ035j`q$mN0>EgmU;JGZP z_v6ekLis7)NESG+Z^J;B;r81D?(N&@zECM{pdE2n(E@WH<{xiucwUN|Cr^clngp6lC{qSrw)l$k*h^pY6) zVr*;8{9?G=8XN~o8^YJoo};kX`FjBv!!R2>L6};H99%MdZu{j}@6QTU`Rk`Sp=RC~ zyb@z1BgCKzM!vhLQWrH$a^&w47_=7dB}nJ9C;T9#d)_JG-HMfOS#NplcxFz&B~A!h z9ZW0ZWH3m%x&sMf`n_;d+N`@4S~i+zOvP^6bXj2MSD%~r{~$GTl$NOLBwy~#G3D5! zYQ5M^RLYYau;S*weEkpP17)o%q_8VD-i_UQ;Lc z9*bYeVeP`-+Od88ye7$W^$_o1bMj~87$9q_Rm;bQGYuRL^53vkqoGLnr5vb}#$|&> z3$lLReO7TGN!HHze+A41-Fs#$3mEg(y@77oaL9D zM1hm6?@tY0(@k3Sw5eLf13{mov?;r}G($M)Sl z%5&bEQ@cLhC&y(s<|wZ!#*@&jQKQQlQzhN%pmHA&)7MZKd`-7**20#5Un0V2xNx|e?wD8P{}+c-|KB^9n2}wC;GHU40Eicq;zx%01OX6I`+J2vb zAk*~QTs0mq1RHIGgn3RAIR5^dxzPa8UVMgD;5r2{6G`_eL?XI>M-82f{r9Cv0D^oD6@T4Lrfxh zYe=HkcCj@C44YWQ{yCJucyX*Tw@mXcFYJcf(UMH)lO8mTJcTxB?`X;qrP0h@IjN=; z^$Krsz-cH)%?-9^q+jQcOilLH>5`dLfwr-?Nhypx?<`gH3l>z-NA=%4Wd;U(;*(9U zT~c@>*M3Iv|C&k2;a2$8!Y^p^V=ShcYD_6CN*sIG+rNFxi-3}Pp?diMuZB|-e5`&J zOwy~uYz9q!7Sc^9Zp%;VF4Qe{e2hh(pBm8z zhtVmy*)@tPE;HU&a)m06%-dqA4X#c{yd<_uth1OL3>!={9QO+;9mb}ZzgAe6>92?R>8aD{h;o_;qks$ zr#Joz0YIZ7*zAdB>QZSl^%8;5;&?o5UugxT(a^gtLx?EyKKr6-UGz9F_xG}a7T}=J zNyJ=I`c6v?r62{AuKb{5Sutp*x0jGu8Pq;2Ntz;L9#@@bm${e7My1x(*aFJ3ol?I>b zld8;@cr_)(i_^Gm2S;?c>m$aSx=AU}5F%5$C8XP(?HdURbX6g}&@}s24)qH>O~NFS zB3laO-#-#7(7R#?>3i?70}HEmF^8Z}4ao=g-M>Cc3ZunZKjr8+paM^xhYofNAt7Vf zMlajHxCX|IK-9b+fw`i39S3C1j(;Xh`2$4}P#qDOg)y-_wG>J1u8ud9^*8EZvDcIN zU2l_DR&oBK>C+tZZVHe{gBp7+qdr<-O*$0R!cU z(Ia-;Ye7$8uX7&N4(AOSxrlb*#e@f*j4hnaN7sOEQHK{Fc<9P(k>hbE;9N55~(+`8iP4LU*! zaq@OhNBXwrYBOJ=)rai3JIjj1K3WnQg=ZOh{(Hytvyg%BNE)`pJ9mxW!~%8SO%H2+ z`5AVaE(~Y9Zd5OZAxbwHNm}4Jh7(o2%Pq>;Y`UQ=)Ml%Ik|KP&k zMPM@J9#01!bP#I2R=-9f8t?MdP%$m&3PtW zT>*(wM(@{oqRjCx{`|63E{le*d%+CL4k6FvmEEqe1*|K@{NxdF
<`2 zy@#LTbojjQyn3a6YiT#6mb26!8yhFo=mR{Lz3a}DG`o~UJgV<4q`5)ZTtSzdlxbJEQ{zj$pkR|uB&KJW8{3*MA z+pXVsIgbyWIb${bP^}dBmo(ye&K!523lvQ*Bzk)4Be>VYCz?>8)Z-Vqh0uR0;3?TN zW&s{`9LhuQJmE=!7Ab+iTnDvM)i_{=X`a!9crmLi$rbZIIO3Q<(!6%9g1JPw^B~B? z{p8VbZzHTA6NNI=on>U1S;Z%lG_Bt})xz(9r!SB{0u$Xn_}RqPh^i7S5CK_s+k%Oj z!fa=&g+c8SJ2z1!Gqp^u=EHoWUD&SmPxuHkNZ15l>5Edz41N>e*|xmvIg{5oLyFV* zGGb6)sUy>#4`kuHSUX`?KI8QOa4UU9Bqe)c_FF96 zWMW+!t;LkQ{VOnyAeuQ+Z^`5M>|K8k`S^WUKPHnS~0~ws4=+%_)@+jVa zi`15?!iqq|iq>Z%dfA9!XyJ$6 z-x%K%ew5-cX*Q88^!{eX=Rp(nRT=RXr|3VhTo)(F_1(J`a9s3kRl<09kvx2*-+Z1% zt1+S}*1nQNKG&O4Ptc z>xtcpc7-BGh@ehpOqjL~pogonYBq%B^eXR|5Nd;oArK&Q?@t3tbN1kcn_kCf7$khD z`km?ZvP1*vs-<>t?C)N!0dJ_2HT94-g> zT+FhhED6x4(H^$MJ6Gny>R?QVyb)w=aR*k2)%wO@yCXf*syexHEwb!tfk8w$`^|Gv z9+H^dq0Gxr=Uxe5)AJ5|Ms@903dJfRb%w`DVYk#K!Lc`K!=;At38+Kd!2wvx2<`mU zBM(?2K386D4-!-Q^R9afHla72V$Yz(jl|eQxXNHf;NhA?p3$E9DvtX|!10H_DuL}W zbeJs;M`g%ksOTQ#Io6V)>~j&1=ulA=yxt<$aNQ83LVts^1)T2Cp)i;wBK=UuD!%u9 zo62jGc*pf@=%>U#41CpWN0YV0Rx^R#o|emsC@(dPJT~%YB+ZIfTu!MsjIU3$5VXfA zMB;pN3jUSKIHZIz3d`|G`IP$EL4Guhhh?t+ifs@g>h)*C zkARA*Q`;Lp_=+wSz55m^UF8^rESSlzQ*UV^^%s<$B3URCNC_pzX)+Ja_ZRW|)GO~6 zlv(Sn23cn$c2n99JC{dE-XCdUS%kkE1OX)E4WZhPS}^gAETPL$XA$hvT^Fh7x9`gpne}Z9nLb&_ts)L7tDW0Iy1;uta93tr-a2#*`YlWxJ%cE3zodbWH}MH zy{hPDO@g!SwXqUDe|$&q+}-k>u>8Ar=*_;@;vaVw8Rmia{!kd|CP8Tume!!7?Y!Jd zY~ETW{|jCJghI%rJ{aAhK_Ha_*^G*$dsT|HewZT~x^5;LPZKwFd#XZ@I8N_Eqf?nq zLW!5|b&8EyD;Gx=vNZBVfSB}$h937&aXd!#{1)T9>b-$jS5L=UtP;j6U3wfSt5#f* z=-(oHa}AUHt@p|fmzW2X{_FFauDc6prm_8IaPQ4pPPZw1T251QFusifA93(6`4}Pl zj&_4TKD2lG7QZgXBt~#ddPgKs^!8?9CKOdmbo-)9Tg%yd2Ep_)ric5Rsv(=L8gkQb zZR5ojQ$v4>c7%!8w=v(tO{rVFiDa?tsg3xLe|e(9A|g)ZrD)8(+2ZZvfdZ=H1Y+8n znh|#UMm8UH`MW88(7(L&b#kt(G$ORuv@U|wdYpz#UC}9D;b5ud0+Q4-YG5?o7N}I`yqAzu72tlofNJFBNl_Y-v;CLLz-qb)_)FZ{e|-`7 zi1EgD_U`4mm5jNXQaO!J=;|4Kog~Nl^Jgk|-iunf1Z*qA=mZC8O zX)_Kdwl_99S%~ig8ci>37i9(7{7MHa+NYx+Gb(oI?lL%}#55>)5l4_E4U|O|B64G0 z1=gLmA1abS6{Ijkfhv;En9x(o7otBYU-={uq8 z%l83E8AMP)QlP?7Uv0c@E;eBsVTbXihHO~AgI_eqDXAelY>SC z8tLxt?(P!*>)hYH_w&ww=FI2}ejoenz1Ldr`@ByKX9%|x)7uLpAhphOtLDo)JlxnL zT-#Yyvp;96=g(*TQAGeVqxwe89gr{Ui)+;bGsUwbg8hHl0ylczEK`&R6rT3>cC%_4K=T$rI)W*|kR=6t>b&H*ZZ{aL;i26Ft+wDqU9x zbWCSqgcDD|gkv&p)K@`~{f*79auN#EIzZ$Pax5GOX!O#70=N%3P7z zDN#bp##qD>*E+*kpMEYz=;-}@GEmr{tcv>#pok3+ivpaNl6ah-iFmU&VWP$gkZe;y zSzFJK_T#F%1P=KL9y$JGN!JLuxbaQMY68m=0jp$fA+sNlV40)mu>=5R8EdY6z@HUu zVDNE%t`uK^Z*UN!zU}k-ayrlP+YtSlW#3wmIztc`$O^GE`RI(rHNl3j%nHr2W(GS2P79P;l9) zQy*d?}WA3W0EipvY%M-ewypq)<%_~% zZlma{!nO~Rh@@MQnFRJJbtr5Cxt>TdZRE?Vlu(!@7KH z?0wdVdTe~N1__6m1iK)%JgHJV85cMLaH9orjb>Gu&l!WUC9hd^JVnc|BnnG;9f&EM$= ziC8OjJtcn|f@km3)*9q$8D@$|wy6dDuAGktLL9|isb@1cky=OLjwL<%S=EUcRC2cX zp5Y*##U+}U{bb2i`<+{a^2hz>h_Mg{ep#%qDH2rJ!dASH8}}9oM@^k)_0%$-%=r^8 zNynwWKDef*opkB6(Q{9ZBvVP#Y1>IaxivtgA7Jq0H9hq9ezKR`aOGZGuuBNTe!i5dd7q8@O+N^ST9)3Z8ehsSE>s=>LTtOTUlJpNiD-r{w z*D}@2DM)8FP}?B^DKa1kQQ5BMOWz+c5nLrdZATa8P`3>D(YiiE*nya%PQOLUwmHGl z7TXna-j2g_5C@(q2dpF>JS@sd9~)}40w320vDpyEcCA#&9sK~m!CCv;xvM1)pSwBx zi>cFQ0}%s$iB?Io39pkCKP%<<;Xxd#=ArC1@FyM`#ul%~gqb^t)gDj_^p5o%#&82( zN_nc?iuv0ws`yTT7YK(==jF#g*7ax}baux_I)ceaz=%SL9`LBOwp@8o#uUt<&S@w$m^bzuqp0| z!VY1uP~<|Ef*0#ua$IZR5GeGTy*{{voO?WTyWsbw?^7TtEXwc*Z$VbgaZC5bT!`cm z7ElTj1OkY!GAorso%}2bKOY}W(0Xa_xhNhUPIIL4t2x$$wn@3mcGu51pGN$o(OiAF z_`beVy6(N`3tRMg;*uR)-1762=0bf3Gh;Ve)tI)|MiV{CDy0^j9x;IkAPj*SluY?9CE-n$0sTt*?1-l0Z zcAlP;D7_jy!i(_j@Qk8l-$e`SC^#%^=4yH;{JyDA%7HEMLlGLLbJRmJVEIL3wo6Gv z-RR~bmScUVv1h7`!{dOU6aEi}COg!0N6%q%V6);EX?zycOhu=`WfIx(^iS_C5H)%p z^R~ned4Bb788PIM6sW*I)i3PUY-);hgU5>{9WU5D{D#^s1sjCT(uV!&mE$9!&w}nz zE24NBCVXe&Wz?Q6<&csP!t2*Mf0iRz>ff(EOl07^=kWIheE^mG*EiQ?hC$O5XC4Rh z4cv_x0#|9cx)V7Bj40(NjPn%+{t<-2iWtL6^Kw0+^&{?y|Fx>#rrzX$i`yMR! z$+)Rvf9N{xM&Bd@mJ_Y?rz3co0X)`D;q(>=6?$|;5}PcL5bnnBZXv1W+8OxS7lO&Y@Rm2jaK9I( zo6WZl6aKYn64;B*czb4ZRvxb^QQY9G+HQA+@N4yPVd+frTw#Xnjsy5z4lt@oSAZtW z9QR0hPq{>s_2rvP-+?slx4=%qy2zef*0>G^X-8iFxVb4=ncb=SXI7hjXy6A%zZv^A zFmvp%0*(h=E;us#DGIOXUxZqq{khoKRSo{(?9`4|G(yyQ4gr+AEYELXo2qB%g$LUd zqXJlch{x>d!W*L~KYs{wk}Vfi8%2a@uHNn*DBFF!-+>o^(^`FS%0PKvfecgXJG0te zUxa-`IBgOuK5T#?DqWNYNmqd~X(|o7WRu2>4|4gOsbPK~5}^p}Og%2ldcy)HheHb{ z_d6b-2imIKm&DesE5<}m&_$Bn7R5K1h%+5_n))&b)d>3DL)YI1kzf+)f_%Vl>B?Ov7Nz4!%-|0-{ zdJnkB=(no2?$i$tp$;FHn>>Fk{pOiWPZJxaB+vxs zS)N{tPnG#O4b*}a&ggnu|?Rl@fu>mo&~g#-p%P3w;mUGqu(ibT_jgfQ)2G1w@5fpGnb>+C^6HxPB?fmx%(e0O?@1gCDRBBLi+|I64sQ&kE^O9 z{Sr6aK;uY}dYJ$~;y)w;binChx`FiDT(x)%nG}Lrt{vt}&CE=wr3Rb#ol~91VNp(l z1AjPn2&r(hNkKp*+l+o;=^xXI4v)2tP-+t#q)vmKnsayi{V68gq+9u$XwxI4XSRbt zmHaio0~iu2?57a_|3-??!?trum(?Qq_lIO)pxp~(72iJx#LoS?YzEGdu;>#|Ne-YQ zZYYir)4pHbN~ee>6aBQ^)z{HSmqb-brJNxXm!)$5Fzk!upQk&ydA2c_gWn{`Db#fD zCwdMHn%0hw%c0;C5-jz^Wv6`37TDf5SKEU>NJ#r(16rVKGyB4TqLp;&Tl5=flKy->5{jFa4s z>tDL@H$wEoebW36t5R;~ZL!lsZIH1o(k76}Zn0ElLL3fM_edxyP(>ptJm>#K3ApvUoJ>o#C{nYu&MsQ*5*4-A#3KNGt49WHa3; zK%|u9IF8{;LR_HyN_hw&>EdajBRF{~!we9A%E@HjEWJRW9PRl7g;Z8uY}h)sa~97Uv94kyLS-u zfYbt_e#Un-(gz3MO(*>5qg#B{O4O9kwt5*xbELS72vz4wZ|q+m{!GE;I~dB0rB>*o z5IuS_VZYpFp<=ccfW%k3qpfN}pq4fs_dhnf5bTgb3y~crS8JlceC}tpK=-dt&RQ;Bj+eFgQ;Iqi{4bmKD>8kFiOKK#(}%2X z7Bb*BTf!PFEDoR%4}gBA)L<{q3wW&M0hJV+&x70TRf;VzonrLhv@Uk3G8v@zhe!JY z7NuvP=sD0G8-B+KJk7&XPcX&?rV0@ofu;zI10>WA!RpB{b)H)I+qxHSMgPGixzI zeOkdxCwOtB|1k{gBop`9P!`xwg25Kc0n{<@igbn<5anaBX_b0_{!@&8kuuoCA@^NR zoR-7p5Ov@)+=M5_5ubjTY|6$P4=wQ4@?`^Ib8UR{QW;}e4rn(yt-qe!d^{iIR@l$@ zpACmcYK3!CE$0W3u#fgJ&3~`9qu^FeomPA&Q|l8^sBP0_g4W{u=H(Sxlfh;y8o-H( znY7gK%#%_B2U4zbj^rl_S(jKr&#NA&NNK;eG-gX8@W&Q#y{|F;9dyZNGJxlo$mUQ4 zOt9Z`SuK#guwtu5f^#}r0Or`c+MRU)jg2Nqf}DdC!+*Wft(>rS6(jF$mKqD2j$7^h z|8Me-iO6b^&gfVwq+zRPLd>_^}z77)^p@Aa*Kda4&DjMv|#P2;vCtNPelIvCSUg+5YFCbrt z6Ai|P3660&Y(wDMkvJrN{FF26Br!L{~cK9tK@i~&Z|2E znbwztKMv;!gLgz^%$85PN{;_rH$ls5!2P0PDN`OG_uVhll2nMeDX8z-7)%^a{Z;+; zpG}<%<{J_jYQmD_AQ)Kn|H~*~Sjh1m>CwM7nkWo#3rXH)^_$3|#fsAm5;c6g>q5bI zAPpM&7$UoPvI9hK1GDT7R|8tSu8*l21(M|_&T99P(pCVv%LCq)UjTVm303Qd51?k! z0E#nup?=x>cHNngjE|2mPfV=c7<=dw!;(u5s?r3~!$Of5sK@+N)|z;7 z=7=1$Sl`?<5caxx^GdIdak@-5)^fVMcaV^K^D1o~TC^W6w$R@E?p>!nyO>q=L&(=- z6n1Aivcv)t{y`821#GQjX(G3n!h8%H5RlB{xsE$n)VR-1DsT> zg*ZmHXWP>a=FqciWgWtilRvA=$zgGKqh(gPn)7D3Lk8Oz)H~0|jy;##RP)ns-Hi6-<-4MCX^OpBoq7kr}YW?SF<_*$!gfa-?xk3fJ)5a z_{b4`wOfhgS(xFklXNP3EO*fCbC$2H{PzCM4#tfHgl?)Sb2WuPoh1j9!Uw1YJn-N>4#yaYNH+1DG#X5vq~IwCD#!LEFI8F= za#(4Fk;|T`HvNpUBP;@jf8X3ik_$JcnBISHlR0S%klG5{WY`#46~`=s48Pr&wE|eu zhCBb~R6$pb{zZ@7HR?KG{-a&z@w)gfYQz~Yff#pVyAaqbdc9j$m2y43JA52oa&Mir z^R|D`pWbV_Uh@3>oEjqPL=o~lhU}fwmmQr8EaflJ0d(X6WPun>2wF|=jWLVMu3AhV z-BWaG8-WNa?b@f?^uW{BhWDBuu=7$qk9diW{7_T6KTCNF7>V(OZ*H@lW?N%Cf%*3* zT5N?g=0r6}IW~T?LYHaTBYbN(L+Po6iX0-M?-RtYqOIUWZg%R8s9mt3EOxsI^7XZV z1)yXO;1A-Hd@6DdE&9k+Z!=rf8S=K5+QAny-*z*4c;awAqK-ul}yt zi+8e6Cm4%b*63nz*;x18SeXw0o#TB*jeWc14?)@4H@%_xZtF%GTGd8*C9_p3cTT&J z9cl^aQzpbF{mJTuU2i*%Wfk3483f^Xh#(?Q{{7J=Z!PwAdpZHk?R5&bRJ71?Cbx4w zn*mUt!|g=B4`|ipE|u}1|F{hsdg*?w9a#Yx8KfUpdG%MyHzB}7K=N6OwlsrANkyZr zE5Fyx3Ay#1F*c`LHO%e(y(;)0g|5Fpn*Z_H=l1f&T%Dt74eP6%{lu2fn|%p68!x|% ze-?hk(@{1Aed4v*COSi*bMX{rUzKjThR@^-u%|_7-|tc&q@C+6qMlTZ3Gma8ak zK9F}zoD)nNGi7I2cyZs)$jThaYK>~^~9>?k8XPl&$q$ZQCs^f8f znVA19fhREih!u{a&oJ*DMyK`Uj$?`C6GAsc8&4hOe{(PA&b4V#Iwy0C-Af{X_iss* zj0;`7vq~L7sM$y0QMVk)N;=sdtR>M zg+y7+rm8mrPd3HLb!w`EQvBEoQxgEY6^Qu3#z`&|v}WRCvkqUKS9!-fXssG0_1Wjx z{&R^H{C+lz^_bn2KUBahST4isfi<4#eZpSzDSRXW?-w87OJDDDm>h4B$qfFZ6wHvp zYRVxGhhDt*@SW&OY+V6dmo#=VR9$z{9rnETYXM7PU70#7r>%Ih7>g*)_=ZU*Pl37< z_bMUrJO2mcAaA_RXSzisSXfw{x?UxpM1n4M)tv~ZXl+E=->f`^?hF6-nF)KsPiB|u zg?sjJ>&WM@fjF4PpUCI3BVybim&KMRH_m_DC{7ueg3DNZIr^-ea1;^|`JZnD8VsR97b@lT1 zT~_EsPv5P4Sl}MwK$Wa>UDgGJwYYg1Ck{L@2(HZ^Z0|-nU0I*&rA0*N4<3$t7a!A; zwQGULgrtdclrVv=?#pXr>*Y$p2dNs1OL|HJ%Mt{ zR%2MAD2s;xBnm2Z@wLe`zA%FW9Qa|NG-3bb0ZJLq-jQBOrDpCRaQ_P^PcC*<$N8@t zHYF%9#ywG|_1{5Y(4^p)jWK5$joB5FIYN!RLXCEbR2#BBi{&t_MX~N*6pmxgZEQew zHSRC@8$W7)w77I(cvs`5tm&@!h6B_hMY>J(nlvg2pp?g~MQ5JCkOuy-m0nV>kGVTg zX&`@JY%>Hf{bhgOU4I*GW9?9ED^>;`X4Y1#ms?_u?9mlF;3agM%Xh%pbY9bgz`(b+j13(Jo`0 zS}}LLgH1KojsNNRSU86J`_q43S#aYd6nzaXNnVgQ@=U}n24*;-5%K6-t#-G`#5imW znB(y{p0izjj7-z2Hl`F7ZaH~nI0!T9wLTn{XM-pd3&3+VeXa4J#70kif!{tq{PxlpKt1 zDC=BsRM`9~M;T%}5b>r>5LVCo5|`<>PoZbL^_%d-=TfvsjKbSjiW#A16C1+>+!pdc zksgkrWD5RJdyGGu&|{Rr=k&lK=5wNJ^C{cLXjY!7Gz_jh9g70lT&jR?8fxh1;PN_z z2)3xa9C(G2qphI9{HM|YB}WA_OnPp5i$2VE+vRkZFi#IXsF(i;I9Vc@9=;lOhP?*4 zFG%M*M&jRM3Z&iK&ahlT6(X_$xw##&I&CN(DdytN{3xCs23(rZWsT5*2>vBv;^Lnymen6dtFbaF7|yKkvR1 zS?l$~vjBth#VBHP&^+@M7{q=zr|aXN0-u?KV5*v( z{qh`!z3O`a3&=NG&sI^x!l5;ElcY%wD0b@^9LPtiTVnF8M!I4Ho7A9PIJLdP-XMHL z#ILV?*;AC#*^+$j54o$8Cu-Ax2{zEm53Z!JCWMweAtZG#>dzUx!zwjblK`nNd(MRX%O)c@&?UTr1c0gv)jA>!J^1#rS@J1=Jy})UsEnkO~PVgAchhl zo?fd@(`9H=SNqdY1}}p^6h&Y-UP=xcAt!JCHc+318an7A)r$#44byy-gu6p$@tGku zKIJw6E4&h&R3Jo4Chotz1ayT{!(6dwH-C6K2vQn=u<*;Nm43gUS-}OsC_;XKiU@zM z6Sp^67Ln57=_;8@j)_7ag8&~nnLaJ7U-##fvRB)?$`%vybe~YgMOv|8flqoqAc~Fv za8b~_OT)QXtx(JgBSP_LxkV{mUegZ#!eUL&XiR&c&w)`P*bCrvl2xQp*z1KSY|oaU z9jv)(0W%`in^frpKVm(1r(&jiv0DC6Ring4f!&PH6;Nsyf2;HoI1q0f`2=2s12{Je z3wsg~r2k$RMzjK1B+Dz12k?mtdAJP-S~0tq0(vN08TLU~#%th<4Bw>HBIHdQ(R(lh z3j^~n?e&P$2g=+NesT(cmY;sr=Z-Y6)HFIEu-=1lV&=|G8fnA;}`ZMa3*z zGpzY=SU7N9ocTizoWv_XU^*N6M(1~-RT3MA%>vJwDLW$Kj>HOZzN2a{ND|WF>jdPv zgpoZbjLdK$$V?`$SI0@>r` zgvnr%OL~Q`TR@AEdBO);*S*ie9DhASTnIqA6`;g7X}0=EXx|EWJ~UAu5n`lPK;^(; zxg}qunFSk3%pSxu&jA5>x)pK(&o(xOOyo!~-*eSQ1f{9t%r>M_2Rfj^W@Tjsi8=yW zdDLgGEoM`J;gs$=-;s0zPJDW1^AJTglO8iXu4lOPI2u4~Z_44_<#Y#(GTVjPpM8g@ z>6&JQQR)8A3${$%+CNgPQ7nlqLDVBi(SQBod`lS|q%XhOeevxf2R{VxvH}PJ$jg&U z7y*LBO{V}2(N-B)XtG5twGKmqu%3{?1db%4`q~THsG_pba#SQdxuMso&-FOW?rv|D z=UuGRge-n>`=`AkR2Pkk$B#X++7DT!EP%ct;t_UK5BiVc5mC+O|9rSex;4 zr$AvvWgt%PRoXmrj7Oh8`Xny6k95MzXY;@_2jHH|G|LgnKQlkfM%$c z2i}-aIVKE9+F77M2F~_vTd+)9K?}~zM%IitkbRxXC>>w$;H}JQa`EincU%J#kISh* zT_=kaqar{Aq^;5cokCZaRugfXA~vuFBjd6=b9v`RoPKl7ybbHyA@7^f>v4G?!(VIr zVs$~1PJxD?x|VKL0rH$#m(iF9un@WCE>-IUSfbj3tzW8*7T^H?cf~y6*H;31@vn61 z-w3>jZTf03u|bHyC0oaK`=&}lCYh>=I0{2JPCLUG*vtkc9%lOa>(8j!VKq2B3}`5A z9*55wihBMRX90h)Ks=%H1{3AT$i(vCMDQ9AlJukb(=u0YO&|24xF@xOV`UdOZE|d% z55EKfGt4hqY02~{{C-os02XBL<*iOz@&OEQ+ISkyWFoE>YM4}1^f+4n2zl;P7Y)TL ze&fdHuI_W{(Q@I`)0^ONy7vnISpj(qvw27ENe{W9v1Y&_onn4fBj=Upti#O{JT4tE zb6JD-Y3$4;oKOKupFN7xiYhBew{Mlw?{%bTO=U$JMPRjig52*&>vfCK&9kz)5 z?G14NX)OnsL;ci_{n$#HgyXmcpzT+LoLZ}(dQ$!K_}d&*jU7SeTqTtTvF(T#$J5Ky z$4ZGXnPL!F`toY}k9rg$t%Uz<^G{$hC|Y$xfO|J9DBMl`X$ZN9;gy0-w*l+D7gLPE z%iY%78zhTaEH?{!17!16Ir4=D4PIg$1nNFHD8~+>)YNLsl*J8%<9j`#CE6BZyHeiG z*E!O9ztUdwR_D1zBmA?Vh1IHcG=PORp##JjKT<3w3NSYZQ>Ix=;1LkUT`=2?rw+6x zzRSJ+F)#6Y8nK{psOZ7lJ`zjT|F3=tkav8B`jWuj-1OMy>mHxn-h;oj__9#|&@fNM zWRBfD0g3&t;yrh=peb5mMEfx@2W!{~#Adl!0a&Oa|A{FqFAinFiE^A$GS-%hCy~g< zdTp4G#pAez5}CoW)Z=4n(avR20$4h6at|~0lwe0&EPQTGd^K^Q2CdP?zbSk(AOD75 zsSM5oTO-->x8>>I6mpueA!;=H%D4Ax5CWXPyNoA(EU-XnPqsv_UW9Xn-}0043ns4s zKXI4hV?Qqd0~^weL1;1u$Q&YIvCB*ghFRpKXk8A4`7pVKig~P&0OrlYCFXhk!=%AM zK`%eOAZvxp^xMsx7+jpJif24kskPGbsD4bb`TS=};aq@okj3Im1dCQt9u5H|7X+A& zFEDS7HQt^VfL*0a!G9j^_3Lkl0zMBjg$``UotW&a|8q=WfP4eMCsRQ>J!pIHwi>N> z5WUXgmVU?WLd$H-%|N7i^Jvtxh5Mykqfl(~Poy$kF=@>{A*3skSni;QN^T5n)vMZ< z=ODyw@@>SS(1}62dW4-<#glGsd_fZqdw705+^C${YAL19LAH`#$bw z7*?)RetvAe+bdS9cQSwX=iH;-eV-;GnPk+d>kYTAJ<%veGGH2hXWE2tn0Ycalh6* zJ^6rdsGr_pYhX7N$(KdXM#MRhc%vC0O+boy!WJXm1EkYA!z?NRb6DLuIas4ckxXYBOJ zsP8z0U_B12KlfrKa~Ya2WC-M6bRK0Krit+f3sR8&Cng%oK4$` zUu!y)itkO%ynOG{|DzBvT=FB%u1e?gYu3#+9sX1WK)- z5uzF{*D8ASNDKD=@d7x-RZMQmMG^X|paZ+(Ad($c94Im{O{p`uKQ_l`Ps+yE=_$HF zVElFv!8Z(qMj;z&^(;P;aP>Noq_w39A<4;aUUZ`qCX_?-}1G-eO6pFl;YU`wOV)2>oQW7 zD-_-VH<*{Gzn$ok1Pkr%NgdbC*%Z^gSJwlLM7enD+6vu)GizH@^&@pe@)Wz&=f7W| zB`LBjO&Cs>1s;0ks@%$h#C5&CFCf?#I#ekDnTS>OA`JxCZVxxC#Jmmxj|;VtwV~F- zOHDXMBfW(lmwTWTYo`mnrB>M~bico{ZrA^?H8xKt6-GRVvBKQ@^K{*7>i%==H?O}4LH;7)ou2jfPs|KI<0(2ZJ3IZ zLb{HAy9r=s=cr@xH-)!Ohd1YgpLSh(F`gH$5&uPc4&k;9ky6+Z6lx{bqq>4 zyT%SZLQF(7G>sxA0nYd}sqMe74bX}Wt*f%Wnc}d*58{ErZAv6{7YME6%;9C4zbSCF zMFw1X6>j$UwfMwF?Nsr;(`E49Ce1e1)UJgYvKwv<;2j3~$l!Qbob7+PhoqPE@-YM&gQk%3(WYO^#%mRrAB>?TcLdpn%yO%PgNkU)nC*Yh zASi5dGIj#R#Xz9!fc4GtlpE3=*f9&hic^`J&Qhi-n_8ulC~b!r{A30i^@*pCi|dI3 zufy=3^)j}iFIF{98SO>Z>d>BmBQp77ma3o4sIDw)f#BHHCxbq$wVo|dFvGYfFr3Ar zZ-u@=A)P~o`eldhGqLc3?9V>`cer@@f$8AyLa*DiW)?N;E*`@!lsU35X<{NG2(aGw zS9!v9_ut|nT8a#Cbksn`tvhk% zW+Gy)+5yJJ7qJ_lU_Tk#1@E*n!20s+c&H+hF)%8UpP2I5F6Kv$FLr4h7P`+$MQSUO zk~6>TsTQ!DDm(o$`jabyMj`plxyhhT@rKDR(DeP(V!yK>`ZM(wb!;?t)U&*A-*Qi_ z@FEEA@P9X;Er@QZN}z1wD<)%{U^L<{W3LFF`t=}Iz)hOQ(yBJN98$~^Z<#odGvlG;(lME~V6-eH^mxI@=@OlNmxrktd1jrv zi#{^lPv7#{t~8vyz!ZKCaPe?;%qOLwCl1K$OrVuTLPCn^T3vhUW+Cg(kY$jrrT&us z<6E^TLhpY{S>Hv(6XcAMkvFQ`XnId8gM3?Bgw;#msmq#HOiTX?lYHt2FikAl#(SGy zEO77B=H(+wNb!MG?V?cChI>t>^V#;WrwXw%Crztx1iQ)5h^9Dik^S>NfOV)I%ygyt zr7C8dscT$09v!Vw<8kJ+mTh(ym6tv=0GQ^V!ha;A)pglh3UKB))JMTIL*@9h5ZiYJ zj^~_y^c1yQVCiPRTG=9Tv#3Wxo6M$ub36Ig9K=IF2|{N5yw&G_BnMIOQ(rRVp?D@N zHoC{Ekj19rG}9Aql1k}4V}4UBueCS-jkz-vyW8Ocg!@n=^$)9iK5C&&Y!Rmmx+?A> zjxjvwDD&Alq5baxgH5NK9S}!y9QuHVfx!|k0*D&BIYQnA@4j1@aLNQJt6sKm^PZld z=H#1qtAz&*rSr@6zh#^jdr=%mr(T6~`Qm6i^}AdkkW7hM`~YbqIpD#_gicea+ml*9 zG=9i2fyd+Yz8Gk)_`8-Yp@{}&kASO%v{+|ovo;fqPWny|=VCh$5{C0q?AZB89@Jf2 zf)W{(LK>HBqFfeY!11WtC<#!SZ&irm!3bm=cnOEBCl!1Fn5OhG!BX-VX3Eqr0MRH| z_D=@!2q9NxG{~ZE{{2fuTD@Tb$Ihk20f&=R$PJ^D#0v#>6nn+At^RTkpOyV>sjdPT zkg+ai_7dQ|G6pk=P+h`aPxa38I042CYoEn>=LD8n?gm-}Q9guRa8Zo)w_r&p5$B{B}Pl|H>^BRD%=fnecm%5{78^aVphzU?c zAf!5}Mfu08$#T66P*H4IssHH5mmDmifowayhf_Yi3B^uVlhTPqgn;g?jroN|Zj81% zbOr~QpIIP}p^lh$l+QFdkqNlWCoDdlh*-oM7#faE4eZ$}6X#+QdcVI~J5V?O zlp-rdz|YOuI|aiK<-@jZGJOnb#x@eQk~e<3xV=S1>ZP)UeuE}8&*`A_crZSSqkolnVy$<37F_p8F`AmH{@WPWe%BY=90PsH}>tWk~>IHrmH#2SCgU! zzYzoK-fs@YN)@_DMG+~_3G=yTv;r$=^U<}}N8I|c$$*-jL+*bmjl3apwb6?W=rwig zrPLoQA&Xc8Hm+^D;~z=+w_LoH7-%r6y}=CZq6UBB@7wb4#=y@E>A`dY_^Hf&s&a*X zFRl;fhmN)9K$9=h+O?L#W5ggP>F;zkO-07|g{a@jR8-G^%+9qzph<0=|$ba%8^Ec)(3 z04O$z&AJ!gH$8r-jyr6;a=uAiL&{zVqwUfDL|u2Hx+;TOnf}C+K|GcAiLP?>ms8>` z+~?6fNIfgW?n*Z}VA6~X%SIDaGBQ8pEfCLwZ)!?1vdE1X;BL|NLR1WZKDkyCMA#=2 zy|I0FQr$^rYQG&ORI)rhZe-NN1brF=OAuoU#0j!llWrU+(y1&f|rj=~ttg z2VdDbgeotb9So59fnhSSVR8Em$F8)tH}9Ik2ansGM|XK)izy{kkh4h{E6hs2JqRra z92w@kjbK9_QQG%W$$tMP`g{LkJjz&CT2XTp!0DG0E*>N#MXH~Y*qLBEmkHvh+p!Iy zZ%blVsu9JMj#>Q@H=U3$c0=p?_ccXW(wKS#f<2={UZl(Qb(h5J0m{=uEHBh<=UTs@OKeOo36*1wP>3hk}ScR;KS;EU4i0 zCR1m(x0;YxU|>>01^pK$vFcZ*ZLa1^=s+`xObEgu?J7TIEX*7{j5;J2XcuhS&)RP#KDm}ec%t|J$`miB z$&6Q4{T>|imef2J;fKW}eLdhY_LdgemZ|ls0DC2>yezyA*(c*l!lOVJNUX|gen0z+ zo`*;C-M!h2H>}j-T{wxb&w&pd$&`F74JuGA^|fnEs3oq3x+--v1!^jZz`N?$>=@&{ zJ$84`7FHT+ZMZ&iR}mbmzox3eH<#jiIC=C($hTxNZ0mEP9wkFG6A|e;PW?gqWpbsW zDYp#{sb!b#NKjXWh}72?0YXt?sB&n~9z+m@`ISlr3q2^Hs0s;0Ag3hww5YjoC;V8> zc7J98=EC-j3ObvTC#Y*y=S5(tGt_eG7Mjpj{{aR^{Z>LtFE6rs?~$A+@OHl##6TbC1y;$I$t#NgT$#7CCN4}%}X zfRBw^@2FOq5fLh@Eu~JXenE=uhd7l2Mxm;pH#01vv=(MIUjz_+&DCfHFXTCst^_*O zKz>S2+I}gO?AMSW6cVx0ci+e6GJ7dg1U+k?ACyCM?1?!nq-iSvbz;|BV%o1XG8rp@ zZYl7aiPN|68gI6r`wrsF?LUzz-%otYj&R&9la4?NP4&ge$qyKzh_U>vB-*+JF?twU z3^uLbqzyzl*2KRiN$?j9)>R<;q#P^tF4s&s4{oW>FnH{7)cpbiEtG&zA*4Av@@lI$ zEjV8>P1d+SVN!R0(bHudO`(}o^ldbw^bhPH!;&L)ftPA(<2*G(M8y&mykBP>+MkI# zeI1mR^aQ+jmZsT&P^_e-e123KP=2Rbj86S>C*UN(H*hhk!M{X2_)e?Y=K8kl`=YK| z784?m6x5kz2-hiV0uYGS#msRy{acBV2G+a7O@l1V;2^n}ZoLIsz$n=~jd%P6l%lCG zgV@3l?HtI|kt_yC&QdOyb3uEG*$p$H!$Y|P@b2%**!Uygd2tNFi1?Uh7 zpr~*#Lw#rmb+27kJ=aLMl`Nlzp5U3tsVKCq_3$Ve7=_zpZCND5s1X+z+CK?(xgBqJpTc|Of`(OuRB z@Ye3A=3}#2V9MFcBmPbOCE88g?TOG2kEzS1^TqjBu?D zs%PoiYd|=(A~sd;vW-$)*23KmC=%k`DxalTf3TC1!bg8@rN5381Kimga=yHsjybjK zX)SxUt^=T@rsOn!|5yY4#M3l;Q>y|v*m~^fQ=J%R)XB6w+22NZUySh@)!D?Bm!wvV zl@vPr5oVvA0J`Og(3ma@1u@oyTUe#UDHezKoYQ-J4&M2jD&u|u;`+i%V?0!O^$`TZ zdr-B+N7cK9V#(fL*Er&HTM3AE_a2i?Vez;=HtrI8R4d0C=l~xACleRj6F`Tg+W(>0 z#cScZRMHZ0{wDFbjGKrw;#UJw55S>w@jbtZmyoyK${3YkeX+OE6o)k3Ap0doBtPgU zQkp8}tuHsaSA+NRwjWY!yR4X+wp50Nfgu7gNg-51E_rh{M%No_ToO07#up2toyx(n zv^|Ithi0T7btqfA#hnEdCUqanFg@#PN)VQFq@o%Z@P%R|eFayHIzr@=8Iw5Dbj*2d z7JlL=iCKY^KE6p?7#qNf2E&3y1YQT;~48l9}}$`PQY8=iQDEXT{9c{BfV2 zB9BD?-;zi^+ZhKGVcQ!mxh7*q+YyIMt~Yzb*7Lc7Ui|zIY{q>&@74Mp%*XTdK%(7m znG0z>w0W4yC||}UFeIq3!C<|J1H&>r*`Lk#kcebvQT|t>Cv??^iSQp{(T(t@K=73< zHtZX0$OM)?0tS8;13!OffgnZM_0Z|1aR~95QV$;YTn)OPbjAt@(fQ^CIf#cpex4Uh zCbr%3aP~~6(T%mu)WvQ6_*jW}&NUNg#9||YMHui-&eXNgchmO(MEVUfSX}P0>rN4a z&jn3k_;BJM5 zhF@3AU9GL1M{nA_4H?S!B7(thajrtK9*XSwAxjLN(!-sR z`jxi9=_Z_X{08F@V@}(C7v6!G**20XHi47DDeOZ(-&YVLJkB37jR|{g3NHkWDiZ7! zciNtLxPjXmnG8xpswK5Bi($%m!|B3f&=9HsZh4won8u4J?kmL2CBEX>aNC3*LMmS$GyK%^hwU8=EiFx_uZW%0WnvgvS74zuN>BcgutHG*YJ zPvaR{FN~$7wv5_xcLuzHdwB%%^;8xe8IGNE2nDAFTRd3m^nulYzJrW}q+H}*?)td$ z3+~Qm_PX}h8=%>vbb)$uH?>(t{K^n^)qVe1Pt82`JkF@o=g%Q`uVBZ57jI|F3s%b= z?NC5A=Y2cUsUjTOOCI6{yYF)+BTHK~^vpGWkfOKet{9OM?pD}OkIL<#xyNO^E0Wn~ zqx$&zU{+iJ#;A6Oi`?MqW`qRstAa?^#;g6GNG;4Jq(zBy>)SBtWNh!N%y4|V4=S?+ zkI6Cel&if0k!7WN`!k)~G~XhN+HV6%Nj5*04cj2ebA<0llhrRG0X1dJQ%mHgc)Bb( zvcKl4;$eX!j)arSu&$H=*P^!-=VU=kEjB^MM383i6d9V*UY} zDVM`EKIgC*$2YYgyfehDt$jMM{Bu>~Y&Z_n-o6{F4~AXn6I$;GT!sWW=hT;8DvZL* z6dxkQH=v$SxnPVTYfcm^u2PY$9E&7jJ^?NDHbJKP#*wyV6p%jJqka(d15_73C?(dr zTk+~Exi>rks~6<*U^aF}b(}CTHrx*JiOwdlPnY)1zFB#oN|-NFq{?fDeANmj2N(tr zM!u>}4j&nM;kb=Om_@#Y4K?w@l$w1=2!(}(l}@Of*YUpftFEB39Ry(t^~DL(6Dh3T z^~Q!t=eOG(Nci4bU|7iT@;U`{T5;UAx_Xk~mHr@)7o;3W-%`16d0)+%_8n{KfQ=Iw zXfnQJn*$6dgjR(d6mx!bk;x@)uRE8Lvpzicr2K%U<%4$m!!o1_-)JE!~U=O0u!O;z3 z%LO{=4x}9?Y^|l7j}NB^w+^s`L$b{dd4Mf8!+%xG+%j=^Q6*2R>mw}pg*;7g$m!we z9sCPoKi?FH5%oubijTrfi8vN*gION0IUg67PR@r_x+wOwqq7+aF3n+qLn#9Tm&I9( zRyg%eLPn;SczI5+ekU?+WF7$UIcd}Vu3akquY-pA*PDJntVC?HRT0&!$Tp@h;Bf~0gR0s_+A-Jo;`N_QiO5>iS_iXb5%A=2F)3iu7@+&t5TW=6RlRZDN02P1bo5t#~WMGJc>35-F09z*PC(TVaxJ zpL2c#uLMv$9gb#5_QrLmq*62twMlR4)9r0cqyvf)6VD;d)zCfdO?W#PPRtMdk8~`)t4gIL*@ZRw%81!VCJmbK=pWeI}&J~6N449#O~m}ht<@66Y?P1`sARY0zpnA z?g;1GjfLnX)M4sv9gt(hf#O5aF;Vy&yMu4#u~hfpeczBxB`7={wcw}qwWh+6q|(eb z_PuWUqOx~~*tt0nQx9V%-~sZrdqq@F6!RXp0AB#O2>-wbvg$9dp1j49qIM^LWOG4E z7vYhMdq3Nc*u#lkuD7+pgWG%{3KCheF7ep6GSVgH4T8U;oDnVH>_DTyK_kn@S6@_` zqX~IY)8Y& zl3adVk|oAY-Ppj+!T2hYTtJe1v?~7F_ci(;nh$y~t5o$u}j-4$j! z_{5@Iiz1)QFVE7tERzy49N!8hRlZL_1|dnTd^?D8z>%y--N5Zx!p8$iX7;#@1<=1; z?j26J2{1%+)>=$(l;2?UP8BfQg9)k0bJ7*NuikW8RwJPjU30aN>p!7UzC*i}!SX$+-Rmqq zHpZxwD?=y)RL<|1e9F;c?`yZ(NXw57CQ_LqXyhJ()WBI@YI;_LBY>QEd8nAZ>|!}4 zavolAUw$HwmF6`4{i^|wtJuGvdc2CD^3()GhcKb71ka9pTb9t{e^-9LF zYi0Lh@Z3VT5=Ye~(&oe44=P+8Qc_{9?5k-?FbJ>&4vY@|H5xeKJi4r^jPRkml&}*( ztVM`RYZD7I_OBtHDl4TZjdw(S@pAp8JUBncLt}$QGvw75FrG zkG8%(Uax^L7;s{MCsZ}ba4T}YD^cuY5>GDavs3~;L;tEGn$0A9}{dgpCi!fvru)m^EDn0UbiiUt|uFSI>>5t}EYrejY$Tvv1H6D*v zSjei=-H=2tY7c$ z@}Iam?|*6ylWA|IrZH?wRpWo-BVeLP*}ZNZU`saBk?v*Oa>r1S^`+dQuoI7T*X$!>?WCluE~@saf~N{gdY@{1JwZj<2KaD;DI+8UgT)edl4xUnhT1d)si z@-{$_FGcV>nRYGqRVv246>IVIP<1`ty#Mk};6SCez;p;RM3sF_P{xV$XkI3b&8*l# z2qc2e>ALl)%h=(qV8*(ev_kFG^KVvP2VjnZ3m)?oa}*Ux6`jv$;AO6#@>v1(7G6o5 z9dz5QfI;CRo`xw?O+$9^eg7lRNa!$hM+UKBvaJ?A-5) zffI3Z{fm(JA7w7I!d>?Hq1V)l5(-`qR35(j4$~)>h{l*=Vg(ZX;^sb2+EjC8B*4XY zscqGTLHQXE`#0rm1}qo&Ns*m&*cI-=aQMq~haC;FB#j?|bJlfpKAP z!ZZ5N#bn_L`8`MC�uF;CYx>f-ZLk2H`cl_9}e?dl0#A{@~VmF|FLNEu|!YQva|z zONNi&gGZ`B;qv$^Z-6)e9%$4s1Qqq#`*sT`rY>1&T~9PXgdd#}A|z6FxhAsZ+;*k# zkDPSxZy}#UA{cFr(07{-Bu3E9UZdHr zP}>_v*me?e!tzYL#KcBPDN1Y2Ri&Wty8ke>Veox9C&Cw1mcf&9uK76L2nUwHU7Cn0`4O&s2Kv zu25deQf6*q^A6TKhZ2PA`<}7H^T=NRalE-(-96U9tM@+%v+I#@8eba3L)TDqlY32V zJQIl7*7n#~F^5JXR0#xd3Pj#LI`czmu}aBnzmCj2;-qwV*$CjTPfr_8Il`&H)9LH9K@zX&_CE-^Ze|c2 z9EjaIz3fax+^tA3806b8`H^4WIKhBFpMad87e z5&bZemi>x}!5rb#tJXlddcOvy)8&-GqsMI8`6<`&MwGvy8;nX$yrKE`PxEn!Bq628|(r5FUaCMQ2$b0wQFoBwFH&Zbjs=otwnuqugs ziFr3Yf+&z!Sok@mg<3&~_w7b!6xW-4x?hM`?q{gE)ZZ%IisTL2^w(4<%^KL!Y96YG zV+S51|NIK&#Ep>=OcRnKBklE#c#e) z9zNxCZ((i$C~w&ftuJ57OeKJzny~M@A0ck&^NZC(I5H zf1$42^q*`H{v@)!fp`p?l-|vN7Qda@(1vw<_`SYK0aM)J!SY~drP#yl z!F=WH{Afw^Cwvbs*wnN<<2UiIvn8Ww_pIN_E8BE2TPN17&^Db4VjliL8H}h_;RVrd1Pc~`pI(TXw*Yv$m&(y4}Gqp zkS1uxVmGBh8*GBY=badCJ&@@usLQ+XGX1slMGN-k{Zr zjWCV}t`-;2d#)?!8>s6&4w$(xR%8&B$;&>I&h6oxa9duI@?JTFIRt{kb9ekRKR(e% z70Y{kjTGg%T&m1@3<6tEf_+}Vq3*WUx((cMt$qKd9b@HvGqLkD`Bx=S6_l~G^@EHQ z5Obo_1w)#LxcB+X!%C>1slQ1`CF^FJagkKSTB#BdG}tt!Ktmgj^_3kF0yUZEt$a5* zNm@9Ok8Nu#k2rcr+%lbuQr<2`M+#?3<1@a?I6@|MnHZ%$WeQJPr_f$l+1mb^F2P_q zs3L7RwKtg1X4#v{{LE?C$?f&BgVfNe8=iIMn?w__7+$n?N5f*(U_s>7EkV6$ad&yT z;$Rsl!!d1BzcsRAr1qfeG$lTvn*co~3q$vzvyUk@if1B1K$GQoTb9->lHFl5uXLxb z2awCmz)KkCVhL|WMSo*BFngJhOi{j~$Th!^o}CJQTjE zPXIdYz@pgdrZJuo@JOXu4J&JTaIIYyuRVfN5wqn(ZUP-pNXt#P^l9I!%NdnUI3b5f zge&os*gjA_bH2Dy4ijw(4!@Q^?hoJ=U;T2iU1NTNNnsro38@C(wj;meu@z_!5E%qk z<(UM%yTmS!b*HDTi#hta67c7QRM9GE>7#V$j(fG&{m1&WCA3!BB@OER)K~?RwNwp} z4xFawNNZ6FwZHGzKWX|rQ><0R=2c}Ff@{(F`CN#&+bLkAF-WbbVSDf=C|l^t1f&<= zS0;AFAKoJzw93!=W0kH;B9qbDl=8LT{45MpsZkSob+Af*PG-876~_bbJq_L=t8RS? zpC>8`O0A!7r=+|$&ZJ!I3!_17;me7a@2=>zpWe*ahJf+cdqN-aFgF(44Tu zBe8IG+eO}mod)X(=2NMMAX{MZl>TY)$!Y-_HSPX%JEf0YI{JpAjYj3_wf5Nf0w~oN z3^KOsgA1IbUc)6CAgiQ%vs|UUqcf%9`?|pNo7^IqGj><*8xsi{QuPiAoiz1`(jX_; zvT50U6#+bxga7b(n2~-{UOhHLWDJ(NJu2Yq^6nO@tFo0QA&`;BMH`K>8H5`L3sj|! z4sR9?$Lo6KKEM{ZTB1LPQ8mE!Apd&ACDU{+<45!RH3|32lsq=p>BSt2MrQiWJIpG=Br!+j#W_iRGsV@>i zdT@)V@Z#|GIg8G_H)RhP)4gRJT3(w8w!Cq+{sz(=5I0`Zn#we53q`ly=+6{0tH1Lh zN``LCmrv2xAklea{3{<3_&ARBG%`S8zr)y@uS`4o#w?mhLGcr+ML!mw-=zCf+j6fU ztd@>-pcz}CjB%L9v8q4e2t&O&*iX>vBxNZh3DG{F5DJbk#o0qa z7QZCE|KWJ;V4?sH^peAfJpmH_3JlL91j}4)3Gm*mKhl!i3--M?I%s%yk<6^eOJ3&REN5Dw# zW6~bBIuCLzQT&O?;JO=h%yT@=M@n3#6~4SmE}%bq$KdVFXF3wyXz7o9tx@=%>?~9I z^TdIt0UA^1xsQ>hw-&Q<|Q85TGtfxcRj^7mdriRu>Yniq4hQAl18A9Nqi z{Nc1R1fwsK<}SB#llZ_(GtMMon_Et6pJG>|oCH4kxlRS8WIl<(oNkV=z=tKNt> z9LKuM7gZT79a1&n{l!sHBV_{|=56#^HZsHEHyzS-hZUfTd#vD9i+cKXnoa~{&T;^c zrUI;n3UBY-t>%EKWVyz*YnOy)x0}}^X&zRYPmwz8lSvql=SQ}Hc7kcd8#{01!}%@w zr*DglBa$W$Xn<%9yvRC@^fyx(Bds1R;V#_?)(LZbrBbpDAGp zTE25BbWqxdrTH=tqZUj9Ha~n@dY-6~7!l3qAWP)mv6@{;l#OB?*ce~9WV#^=6zM~XyAJ7Vf?cepT5%`e>rEezu zRi6bGB5)EI6W2scBiVioe?tYl;WaspZn62a`@-OD7nD6}#7U2{@8ZJK7B+Jkl=UjttwN}jJ}PCUhN9E1aY0ff%^Lc19tbv_#YgEuRy6?3AjfV>MC8oyAt5lEcw^(suvxG8gtWf^mCK2Opr+ zK|1b6gKBc+`*8;{#mKrhWE7P5W2qM&=G}SvXtc`4#uA_joN>i=4?eBYgd?}lR+g1e zM`Knw1rSfJ(3m}2PnSbzxPc@kZYo#d-iEy-YCu0incL-H`b}2Ef=y zj>;dc!-TNLnJm%Va9%dF^pu|&ME)YqvJDs+)yWB;=J!X)0B4)Wi@pVi?K}*cu$uyO zOQ)p!O*orGu;rfFV{{ACRv0(vPQ@7p2Tm~}Fd9@}g*u<;*1A3oC1REVQa+WAHC8F5 zA4pf2zTyf`nkP#GRm}bYv;Ho#uI77qVTRXgW6smWi}<2_Y4qE3GnjgLK;}M~e?QGh zZftA^^Oho+PQ9l_5e-RscW2%<2CdYs8yX*cE)p<39DARf>ZSQO)4UjY;+n0X*f?L? z2Ix^peD^@b_H4x1UtHb$I0VsMxA@i^FMOQ`qZUd5^#3)Xvr9gv0Kh15y2JnlCRC;*&CF`Qu2x z4Gdl3XgNjE4?)deNW1j7PR_N>H=ebC$Qy0qs`dV}U^+}3oJ|JgTCQx39b;t%cNL+} z5VThYAttp#z3->Q0C5NE+h={U)D{+gMhoA?+rB;)Jt6d3K*Y#(&^Mr6h|QqFsJ0I% z3XW(lDcO=%pCWbQu`QY6NFDz4TvqCgcc|n2fp>HDt>2s4YKpq}z3C`gcpJQz)}Je; za&*hEw$7nq2qiq|SqCL4JL^;0)9sr_A}NnoBX**Aw~~4qOs2;iQhelsdsxR^-`YR0 zdqR)1a5-I(x#h_4m{4|(6C<0Clyl@h)=?zFr>7?j^%V9brR%!b{!jbuv?qIsEUB*Z zOwD!pBzjqHojjqfpEwp;h-esERqjaMIw8^#JtlXy>`JL~J91^T`FdmmM8fjk{9J^utUsenIf=(ma$~ z7w0JLjBai7FG`4Vk~`cKXIFf48!{R2-((QjX|Jq$OEQUQ4Vst1cdF<;FXQW*h=MW8 z{?OPVuQDJZDQ&8jNzlChaQb2o$&FHH#;L7e#C;G*HVloDGCJEIGv)X!(LHi@uHq}C zwHLe1p>ND^TsL*!N%SopN%Uowl)tc<7Tk~*W=WutRb}-hFO0wU9Eu!uBT}|oppulI za(`KN(+z2{)@KjNXJgfMGC^i_IRnG-SEArQNP0ge^aNw-4(8W#pFL0Zm;_$Cw*vz< z{7~-RLD;E?2$3HOjgBlFuMN33lxxU{F{df~VCU+sc3K%LWXb&eozjyk^DYyZ$l1!`x|oY~;b3pegJ1>rwS5^Q73CB6o3mBSoIlxEo(yaOJ`oLbnx-)6++m zBxY7Bp@L$7(!@>~sJ{T+AxZ!rap^|2Y~!uz){uC%Wg5tj({xv(BO%#PE4{g+#~QTF zq!yXmuh|qLSpW&B-qLKTY-YW+BEUr4|3dA4?kBYPf6c&)o?t#;NM3!gIF)yGUcJU? zg-AYyukSdpj|Pp2MyW*PHto6eto7_wo?To)?reYj)+Zpy+K=*d>j7~`ssQgGhzkGz z?p3zYG20lXeu3p%`#xv$xo)WMoV368)xs!#@gm>`C%Zg=EfD{?z6KK%9h~fG1F@ec z^V(GFD62$Z*SI`~+?2FA`NyACxBj()ukTwFIbQSE?m{iirEF)iamy18!qoHWY*Hxh zt}+=9G`tuv$qd|br01=JZdLy{bA8~H{D73(Aw=8;NEv;SluY1W{G@6R`Iqx1(@ z7^lr&x973hPq&~a-E_!fTNc5_*$ftGl_9Ly$#2f_+X>oz_ZXGSwh^&#?Y`1BR42(9 zF3mkAyPqLc{a?HOA4OwR0{K&#zVLFt)U`BDldg>DrZ@1$YVhyGau5=-YQm1un7?#9 zHHl(;M*XXQH2dr<9ta!~>Gks;|BrU`KfVP#d(IVZII2nj1ch5&3tQ6z*pVPd7wLMF z9|dJqAp?9|P0T6K!_r*JF600*Oy1GXyjiYJdc9Z0&ha1yPR!3tqJQtW_n9wOHbdk+ zUYn0Vlfz}idITYUbYL;00Veas$Lndg++IYmRbOoi)J?nZw!fOlb2W}d;~A)9ja5%U0!H_k$YP@t>-}D~i&$~nbpgs!5D;1^JE-r{xS~SlCZE7G}3fuh~L7LGh z83EHYksqW5&%kA4FD#ttUCkvGcN_iAaT#sTE?(5AjThqTjA1sgD_+F6-=0{&&5@a|<=cr$6c#*e5?Cy0uyLB;r^3`MC z8&5yg)!f5pw!8$m@eDDEzj(s zWjU;Lac}B~Y)|hp=%S?xxUelFW9-)szNVk+ij}?HvxxWC+kF_K%o%dWbUSlX?UVE{ zTEF(9cAs5s!2RQ(3nvzP|1Dpf;Rj5>vSmvr!&sc$*0_>8)~~|ph^^hLl#;s zRrTjQpn8abBpaUe(hSZ&Ou);?W3swOODx`$p(uRR@^T*Z5SgfZ;S@=K61buEJbZj= zPvwZ8i7EKP?nbdnz@6{wG=d8^9g+SvELPV|%lTGd@7H#8 z0wyKjvqG^kO(0|wyI-ue(3P#;leP;8I@4SdMHbL|)47(Kap^DX;v2EEUauW27Z$5T zByoT3Q#B`7NU+;q)hO`Fu)~Rx&TuQ6=SYq$wSoa5&IQEo(RweB7Hn?Uc6?dEcR*AB zzX|)_7gmE`0-8c4ftRj`+MPo#pC+Zf*NaG<5lNTUPXKZPrMS%7 zZTDW>&D>ud409Dl|Jyn^ zE-DhD99&a=kPnP z=BMf?q5Wl;3Q}jZ%kBBUvme%zU?wQEqw}rZW(gD0G7vrPH^pBI0i8r zOIg^RFHgv|Msn#?yk4Get`yg25nj7@|EpE_$(G#}US}2{B{H_XX8PBxav?eI5D02r zY4O`?zZ%+^CSw4v4^%kL_)X5W)(;x2TTU)vVh$?sGNB;fz%~7@@FgMiVMEA27#%oF zbCyc%B)K1abt!n5DLT&`9QW^<@XL1*d}Nu3B)EaRDOyR>M>JU^pvInE@AXam7-vJI z@xqyqwk#y^%hXhL_Xa@8kIV@#uo>hD?|=A`*bN%sqC)Qbj(JQU{77O7TzpB_s5V!AZy|(!TLjzjzum5>VSP1;bMs(64QSm8_z#J&5kzw z2;s4G25RKc_F^@jfnd=k?2mBfzuz_-`y`3SLK2iZTyil!{B1XWg=VTZAeYL|jY%PR zU(5EK#Jw4at(p~55}X6Rak=$i(liKNkFfO%hv9#5!Rr(BIZgQ%+)DteVmztYS1|Kr zVnZ)rk{C*=0-xX)d;ha4m(yniC`T`qm?-Zp4_2VGZf(P~Nd&pyqFiq!3=|sL#qdvXt@oWmTTG|w2qDT`TmJLB2$Niq3uqrv_x0<~gLc0p<*w{Ur5fxQlUko>sT zTL=>`lgTj_nDTuhECNG&n<8f#yuW>-(M=)eURtM_i%~&%CBP{b0vzto&-FjO|*?KCfi%&`BI!Ciz-w zfO@7e4yEm9F3Y_5^0mrF_bSwN;y>TZ`ImM2zMP0`wy{X9Yv9n+?m)b5&tskE3cHJa zv|-p+s?Q+}{j&;y;?s(|1fxaEUKK-Ub@Xz=JxhrB43vtYzG_$?ysDOgMJ|xUW6Xu} zhusm#&Quw>%F*v&utt7EkCacH0~SSwwRR1ji4=&$uA`h``Cj9FLqS1VyyY3cC*Z!z zRN=KiUJWAholdV_L_t}^BtA1dkWT4*!PbZUmq#$YEuxjp&~G+WM1HsEfyPB8W#&?l zkcD6?v5?0;%L|%AGL&+vs9Rp{=0KJt(4I!$Ft>T8%BZM9`jlW5B66D87F`K9VgSAM z%E{mU_q_oYF{;PDpC#q@Z-E4YNlV-1)VcP-!UAApZVnF|QQhW!ED|=)$^?gmyneLc z1);R0luIvLwQQ7aZA+F?x-3glgIB)0ztS}3390;ZE{Qbqpp^5NbF{`VtA6UzD7&+8 znDmm7ln3BaUat%`O4D#A7#b;JH=I3(9MQIBT6yc_2{C~skf6zBqrh9FtKL`F?-j?a z8h8PVY|+t;0Oj{F3PaY0Hlt2C+Rx!xv|nUZHSAc$YwtshWMY`~ zu0BRV$4eMZ3vJs6ggI+K&^)j{?>cTcrb9)*%q33aJ7JN_17K7}?oGhwI< zWBHHCba#N_%cX6^TWi+OuuL_r3Umr3XLX7y;n|tU0&w#vsvckX+e=tSu{0WhqLvvN zWhQ4Nw2B4q#a?P!o(bS3ln)VNd}Htf+^!0M=H#!`YDXj$s=vzW-l&rTHe#M_)X1G| z$%y=jP2`}zY$FIXoRJUt9jGi&y@1PUlq-~6%V+Rrn0@mF%te@_d_y840>}Wq-qowZ zmhZb}H{Fs~ZeT=P*1~ZHd+CSO;??TsSM}S(Od_;W5%z^_zjM9MuIbB**E_*+8GR36 z!YXjCpdHDckOIDV9zz5ve*5ZUUr1PNFZ3vamACG*3S8k%7jzQ^X{!u7gLZd8>uV%; z;#jT#Ks<=g;diB@e-@)Ny(3Gr0mDI{TFA*;MezkY&E?!a+wC^u+2*QnaC$>UzPOC4 zKt(6PPs}i4Cc56w4^Kyth3yng>G(EIbW#{89zxM|Iccs;*FJ( z^2U5JEbWHH@&afcL3@Pbx%iB7C6B9n`-0GH=eJ=6eJiAobzTou@nc2?)l;$pW~-6f zk+o7yZM#Qrbb$3Ux@_G?`L~5au@R;*oN|(wr>D=BRF7V)^T6g;5E3U77NBFWTMTa) zSIjUBdA95Rap)@v6MN(n!1ZgvGUT|ssBFGDpX>-AiNfmLH|e*$zA4px+Y_=z#r)sR z|KAVrHcBd#qp{IEg3mPR0EBIoJX0oP_`thR;$pS?-U} z#IM}fn0lV>os}n_G`#%%GmwwJWylg=yOH^qod>6c5a|mkccL?R!=|T?&JzfGdwyx0 zsIs9Pe5Dodyf$h?nwpvKfGDg39fM6n9yE+(=b z3I+j_$SVC}XpVGhTkLdP3?>#<9whJjKyAoc+Q-=G8PE$LC&*xDiupI!*;ix$rM4}< zL+qta9lzK1(sSj=d(A?t@;siy*O%F*EpI_GKnyeUSuw6Dl&mCVx!=2__gp^y^U~{k z1W;icG3YgeIa=yfL-;lEvlJjzFGV^C&}nm6^_u?82_B=HybD9E7o^sfM=J`G`3CN4 zu})j^SoZpMrwJ7*pzmHnek20N)_j}v`WPth^4t|rSMLh!?-6{PPqqoaw2-nirqJ}V z;duEPZA@V5ZeY=0wvLQY-=QnqR}4W7B+Gg2OQHUw01`3%hc0j-vEpFo-ijs)ToR{TwnflQ#bl zXP(rT{4jxowXd?E#heGu{hRx$UR!|0>l4IP1%1q{NS|n9SfUE3e1DeLT|#@Snsa9xEA$ zu|$o;##BP~P}V`5CL5T2cg!dw{^r&4;%@@9(L^*II3f_q=#OiU!sNCrfl^HvrAVmA z$XC%E-K+4y2e|pE=;ACp&eFnb;n@vI&Qoi&?D;a29zz!s_wQs?j-$Iv%J$rKVqAaQ z%5)?f3nP*|UmhPHn^s3epa$}enxtR3kP^nTE4lM}BTNx1h!GXU@Z@2?cQZQ%4u;PX z=LqE{hl7rFeNUcF*XjsAV6a}8^>+}Bv=guWEnvinqAx@|EqA*n-VJJg)X{QeZ;Vy| z$V)omI`tl5hZewT=G2ghzhDuBT1fk{6UsK|%B1L}M64C4KF?#H_trC%trDFoR4@J% zMJ;AJ6Nq`w5jY4p4BAzoI81IuWZ+*WaU(I>VK^*F42i?ISvmE10xGuCMCc`ybtYKu#`IiEnG7IOB3MX=`Y>?xNg}JjJsQz5Ch@;zpSsW zl8w*9lfpxVcqUc`LLd!0edT6r#mULZ65tLOA7kI5Qs4v492+{@Z@XqBy$ua(j5Mz3 zKMv9H0oo=x?wW9&;V-*?Ns4dJ74Ae^Q&T3Vwb8--&iigGtFLZC5j7AfqiYE8^;O4l z-JV7Nm?)H-r;sd}8A&nXE=M*L->$6Hf^;S?@aHE%tdTJyDf~$U1B8?E1`F>cimB*b zOL5Hsfu%OrXLRx}l<*xfk<;*pYh2ht6fF4k^t(+Dsp^>Mm@lH4Pb=5_ZfjD8$6xMt zlMVS6Oo`^h)e%k-n7UqYeATg2i>8+~zRUwShfl9(S#^-G9``euXrF=V<;CUlg2-v(N7=2#k-O+Ca73#TgK-0|3Ub zH_K(;1N=$8swP;b+_>trO)tlcUmP>*#ElX`W~S?95{|&5`Wra@NIW#9{=93 zegp}(Y47B_7;cMu0h)kf2u=d1qrKcPV8q3>-y3^Caj4snEaWC+y5DP@B&PirE0ka( zUFL2kheA)^LIb_O6_m0FjkQ;LcW8WqShbCzv{bFU7NtzFiZ>i1xPWx@P1nPPa_p|t zg57a6>K#$MXHmX5F*%phENJ~Or<*Rke=nL@(aAxDJooN=z^m%7rA1*Jdv^CQ?%LKo z8b%s5Qnsr$b&Xm^WU1jbT@FRLE)s}9LP8g%p}z1w%|VM;_VMh}f$heImr3{7#D>d; z(1NEfc#-y3SUr=s#~NR*ZW z1xEyd^wYOT3cfkULSnB?dMM<1I~u^n8*&)@Dm?Phf8A#iNj{N7;>L{|>sW!~HIf-Q zIpXX|hVyV<*Y00va|BPMPjjZWn=EPfS(dMs84pzf)eIY7~7#M^HsY zI;kM;{7s zf4<*;Zhx7Osz8IiGu`{;%a;R|(Ivx`R$r>d=GJAQa76FRkuq)|=v0{Xw|#xr`#l4f z&vnwbEc*zwqy_h$jM^YeiHk2Lnxqdx@w56P&UD;g4T2-mh>c9gZR6{?^obtaP$`=t z9k0g%U%hTpQ{RqeQ2ZQ2`Q!eYd{*>1zdW>An~5SwteXS3N#1RYyQihCZMi|mTjS=< zn?*~UGobl2`F^?S)736xte*zOzulvy zAf!J^j>gBwTf~hB9Rq35Y&LqmPKcJa+0ABB7~+39IdlgXM0>QvAA%g0`$@%6Onm%v zsEF}eV%brQ9y{qr?_qrUsoK=kl=UK;m-z42=m%>gU$5on=1vlDDO#8)b7PIrPC7lH zm0V2oSnq?-{K(poCKa}iu+MtRxchf2#>BTa6SuIXz71uzR#_Di>v}4`ef!qO>#6SV z1`(m6I_vyhJ;^d;ypD3~HO<)ASg#owQ?KK9*gp9HLSbfLU?@js)coD@ z52!>`%FbU{0@=}T>N`bs*tZTd&YL^f5S}TG0AHW`10CN+^$J^SdwUIU0?x|OyK|^1 z;`5r(T`WS5Of6YII&If1h)%t_$>dY{_t@DtG5?rBk0fE*U&NHq)=rIM*DZ4E5vF|B z*;i~-9ztEC3MY(gF2hBo3hoX1Su{4JhGIk*dcU%ce!fBg|1zb6_b0`AE#62QP$CWm!iSz zwLq-TZl9Fki|0w3y+{j;6Lg?SW93d@FdCBKv zYnc0Z*YJZ<{Qzup7oS+>wJ+Bg8QZ08N9UH&YlHet9-Bw6@Pr(l#<4=xvghU&7G9s@ zw60b9L|&ZlaWN*U;lA)K;`cY4j~+F!I~8oh-H{_j;U*4cAKzkY*|`kDFs@#!{KECH z5n+_P&3p2_Y($AOa5u`0()jjmKj(yJ>FLFQDdWlJ*$_@jPA+t7I1G3e9bHGsf=lz; zYCcH~^Ys>mTun%Cw($2v9-HyinYdbIulx5CKq)8_(D3|o&JNx0-#>ioF4SxhAMNwn zqbf8s^t2&Lq!{%@T6$Ji)@}>FqUopEj=cwSjK7Z{95iRRfHz6zpiOP&LYjvHFy#(Z z!^X`R*w_^6K6>zd-(AWc&l}!(RW*LK=8AGY86hFz>kSLm@iM8_)>Z{(R@Om)---rg zv`%+*cYpRt7!q@YDsZjKIW&JFHFKqjX1RsT}-lwtKY5{o0$AEJIJbC%~YYv=)^%^;b7vl zJgf}+fs(yUsEVAljLf!$eqml-o3z~M+*IXosj%JgnDu3+CO}d0TPz-E>J}H-cLiYD*b|~tblgF+`s%)aCmr21X zt1tVpXpjtzs@EPF4l(_JFfFP?M`u-M=BEDbQG7*|(7=R`^h!8Sh+x5nV#isPNl;DAUu^ zyHI%CV!7NbG(6l<>iH7=pNoSuw2mJ3{N4*&-`=jOVnKQNKozF405S#cWlrPp9g?7Z zV@{?&H>Aya*pR5mXGTXgUvVX))xpLEV39DYHTtijR3*qzp>_!0Vc{w#Cua$HrqiF} zv=GK=gFSD3>5lQj>W|~W;@xDZij1EM7Ng3|&ArLVDOFN<(+BI1)g}iT#$WmlrHIQP zzC(WXvC~01a)|+%l|3pY<)zPQhvJ#aRs|HVo+HhW{NuW|0nl9iQvaX=9HiA@;TZzS z|Dx0Pj3|O^4|$Q!pvl09z17;*<}Rq&B=*}biSQ$Z^{Do#Qj`ubou5aKu`n^AeWLip ziju^RLr(q*a`_gYS4U)IWX!z-27Z6d2;?*zs)D6$y{?IR?Ta6cMb94{u|@i?)7svh zTrr&Q`o5tqBlBVKqNnKZmqkJehue-kzA}6zIgE&Hz&Uz$R;2M2GPr}?U2@4?H}kW7NG5pK{$TK9UT6{#>2=WtX!Bh2LfUrBBigG2m;)r{;G2>2v;f<9XoO z0|(UIiH4I`5cSCo4aFdq5*@0ei;9iST{33e!KIaCqM>P$&BVR<$2}b0hDk*k^*A#G z{ItE#Uu-OnUK@Se?N@x9DZ5ME0y!nxy%X3V0n}z>Y#exh*Z+4P0fEfQ3_CbIx318VXK*WYRAkJpQ#@&<`c{NaI8-2q?!LWc-S7AXj@ z_d)((FG(ZG8~kk%M?W5+t2jhNc`4LlTz1pqXQE25F;PUsl>F%f;eZcxE|bF0>hs`W z0hO?>P5n_G6nDr7GcMpqMV80Cqo_CpJpaAOJcuTiGT+_2^oKR5Y{g*F+xv z)pc~zw!1Effm?)Kx`=-81w~Uz!fd!Vv-&zu1m4MU&AZ2`8i}AT9iN){w^4xt>!dN&fcChtnOQ-ZL$$o^`bb&( zTwm{r4ZdlAUWC29J=Z4|cFMTq!r|dzo0?RMKcB)^7oOrMSYNqR7*4#`JEyNZFcd=GC;zR%`V z(5Nv+=fF8ZDoo2;{QR0D=PsCTX59V&zB^ztEGDDJ0)O*R;8&D0|Lx(JSk@p^WLXl6 z9y?yd_E7>iWVKC<%#S!YJbb`v;(HqBMTaP9!+ih%MR+3%v+Vvk$w{bTq~hKm8x=%K z9w_hlNS;TqK34EaEGS8xT9NloV|PneSC^WzbLEAExmgVjjnI$~v)-~X|G(T)HmuGM z$zpMq`i~qI)XFX5!C@)yOmX?K70D0f8G^+(lCL*6HSMMrX%8Oke;I^y;Pc(Z5mj7V z+*!8`&wiDS&H00l!+4cVI?O8P6I9W|&{V&~r%y8h=u_C^ z(ohJY@O(HSy%vc3^ZblJ)**tGaISCfj^*IsAU_ai%eH#Kb9Q{sq6M|KOP-M3%t}fk zi4=D`xejjIAU&)6gtVf1;7H4JU}Se2-*S%M-rU?=5q?kj#}Y5nm<>}+h`%Hg=N`D! zx4y4(g0sIA%-pV+(u>a7-`~Aoo-WKe*A#H^w!B_^*q0n55DXt+=Du4npJLvfD&NHM zN|rb`QQY{!g9l3OA`5?;0pRoOR`IPJ-OZSvmbja6;F$I*zxRr2{q^)7^?NWmW$w;D zI9lj&=E+apbL$(k>8Tv}{COF0GzxE_6mfbt!&4GHW2sRWwZP=xrZT!Q zwu@C0Gx`Rp{)P`cYaO2Oc69jrqtI7aJkMznui)(H5_d4J%+>utXL{)mM?jEj)5lR^ zC-qWup#lQFq$L!@i$otjQj$eNMj!}akf0$%G*q=}i6T?VkPwJU30UFllPMet!E5Q9xf2)v&< zLLe^f{--NzCo6p;doyd3zdclXr}k}uD+q)lI}!r>m-ddx$p1c+gQJ_}zjyGvL2D8C zW<+3f*>i~BEXw(7nFi zfy)Q|(fld}G6LR$lD&Vv!N-9f^5~hAKQ-60 zwf%4FpNH`nN*Q(yT>RUG--mH8^-rx0oE#i&tp3}<&zFCpLO($Zjl)O~2*O`3UrYO+ zhj%nJvNB@-=lhMnb;0RK_h=NJpcM0W`{P~xpZ%>J)%5f&|7U@ppCOg*21O{myDIeG z?N7$~pY{$$j*c*N{%8N6pFrne7-0v-6E-^Q^yja^>;Gx)Vx+J7TMz%<02F3{wO~lE z=xrGf0&({D*B)HC|I>q&k)fF$yS=m_#|<`HYm>7v@bf)fp}C%s4fo&!gZI~$sBQV5 z9!!n&42|snYQXQ!YU6jnfWcsZUt6=mnEYo&__sCZ-^{ z($PPU@>@q|m#0R&pJ2YdHH|=={rz<=iNNCU&wKoL9GO|^nHc?NAf1QFhd_|PpLqDm K&>SWL;{O4g+IEZp literal 0 HcmV?d00001 diff --git a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.flat.json b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.flat.json new file mode 100644 index 0000000000..4cf21ad9ef --- /dev/null +++ b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.flat.json @@ -0,0 +1,3109 @@ +{ + "requirements": [ + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.1", + "section_name": "Architecture d'encodage et de nettoyage", + "req_id": "V1.1.1", + "req_description": "Vérifiez que l'entrée est décodée ou non échappée vers une forme canonique une seule fois, elle n'est décodée que lorsque des données codées sous cette forme sont attendues, et que cela est fait avant de traiter davantage l'entrée, par exemple, elle n'est pas effectuée après la validation ou la désinfection de l'entrée.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.1", + "section_name": "Architecture d'encodage et de nettoyage", + "req_id": "V1.1.2", + "req_description": "Vérifiez que l'application effectue l'encodage et l'échappement de sortie soit comme étape finale avant d'être utilisée par l'interpréteur pour lequel elle est destinée, soit par l'interpréteur lui-même.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.1", + "req_description": "Vérifiez que l'encodage de sortie d'une réponse HTTP, d'un document HTML ou d'un document XML est pertinent pour le contexte requis, comme l'encodage des caractères pertinents pour les éléments HTML, les attributs HTML, les commentaires HTML, les CSS ou les champs d'en-tête HTTP, pour éviter de modifier la structure du message ou du document.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.2", + "req_description": "Vérifiez que, lors de la création dynamique d'URL, les données non fiables sont encodées en fonction de leur contexte (par exemple, encodage d'URL ou encodage base64url pour les paramètres de requête ou de chemin). Assurez-vous que seuls les schémas d'URL sûrs sont autorisés (par exemple, interdire javascript: ou data:).", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.3", + "req_description": "Vérifiez que l'encodage ou l'échappement de sortie est utilisé lors de la création dynamique de contenu JavaScript (y compris JSON), pour éviter de modifier la structure du message ou du document (pour éviter l'injection JavaScript et JSON).", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.4", + "req_description": "Vérifiez que la sélection de données ou les requêtes de base de données (par exemple, SQL, HQL, NoSQL, Cypher) utilisent des requêtes paramétrées, des ORM, des Framework d'entités ou sont protégées contre les injections SQL et autres attaques par injection de base de données. Ceci est également pertinent lors de l'écriture de procédures stockées.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.5", + "req_description": "Vérifiez que l’application protège contre l’injection de commandes du système d’exploitation et que les appels du système d’exploitation utilisent des requêtes du système d’exploitation paramétrées ou utilisent un encodage de sortie de ligne de commande contextuelle.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.6", + "req_description": "Vérifiez que l’application protège contre les vulnérabilités d’injection LDAP ou que des contrôles de sécurité spécifiques pour empêcher l’injection LDAP ont été mis en œuvre.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.7", + "req_description": "Vérifiez que l’application est protégée contre les attaques par injection XPath en utilisant la paramétrisation des requêtes ou des requêtes précompilées.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.8", + "req_description": "Vérifiez que les processeurs LaTeX sont configurés de manière sécurisée (par exemple, en n'utilisant pas l'indicateur « --shell-escape ») et qu'une liste d’autorisations de commandes est utilisée pour empêcher les attaques par injection LaTeX.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.9", + "req_description": "Vérifiez que l'application échappe les caractères spéciaux dans les expressions régulières (généralement à l'aide d'une barre oblique inverse) pour éviter qu'ils ne soient mal interprétés comme des métacaractères.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.10", + "req_description": "Vérifiez que l'application est protégée contre les injections CSV et injections de formules. L'application doit respecter les règles d'échappement définies dans les sections 2.6 et 2.7 de la RFC 4180 lors de l'export de contenu CSV. De plus, lors de l'export au format CSV ou vers d'autres formats de tableur (tels que XLS, XLSX ou ODF), les caractères spéciaux (notamment « = », « + », « - », « @ », « \\t » (tabulation) et « \\0 » (caractère null)) doivent être protégés par une apostrophe s'ils apparaissent en premier dans une valeur de champ.", + "L": "3" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.1", + "req_description": "Vérifiez que toutes les entrées HTML non fiables provenant d'éditeurs WYSIWYG ou similaires sont nettoyées à l'aide d'une bibliothèque ou d'une fonctionnalité de Framework de nettoyage HTML bien connue et sécurisée.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.2", + "req_description": "Vérifiez que l'application évite d'utiliser eval() ou d'autres fonctionnalités d'exécution de code dynamique telles que Spring Expression Language (SpEL). En l'absence d'alternative, toute saisie utilisateur incluse doit être nettoyée avant d'être exécutée.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.3", + "req_description": "Vérifiez que les données transmises à un contexte potentiellement dangereux sont préalablement nettoyées pour appliquer des mesures de sécurité, telles qu'autoriser uniquement des caractères sûrs pour ce contexte et raccourcir des entrées trop longues.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.4", + "req_description": "Vérifiez que le contenu Scalable Vector Graphics (SVG) scriptable fourni par l'utilisateur est validé ou nettoyé pour contenir uniquement des balises et des attributs (tels que des graphiques de dessin) qui sont sûrs pour l'application, par exemple, ne contiennent pas de scripts et d'objets étrangers.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.5", + "req_description": "Vérifiez que l'application nettoie ou désactive le contenu du langage de modèle d'expression ou de script fourni par l'utilisateur, tel que les feuilles de style CSS, le Markdown ou XSL, BBCode ou similaire.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.6", + "req_description": "Vérifiez que l'application protège contre les attaques de falsification de requête côté serveur (SSRF), en validant les données non fiables par rapport à une liste d'autorisation de protocoles, de domaines, de chemins et de ports et en nettoyant les caractères potentiellement dangereux avant d'utiliser les données pour appeler un autre service.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.7", + "req_description": "Vérifiez que l'application se protège contre les attaques par injection de modèles en interdisant la création de modèles basés sur des entrées non fiables. En l'absence d'alternative, toute entrée non fiable incluse dynamiquement lors de la création du modèle doit être nettoyée ou rigoureusement validée.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.8", + "req_description": "Vérifiez que l’application nettoie correctement les entrées non fiables avant utilisation dans les requêtes Java Naming and Directory Interface (JNDI) et que JNDI est configuré de manière sécurisée pour empêcher les attaques par injection JNDI.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.9", + "req_description": "Vérifiez que l’application nettoie le contenu avant qu’il ne soit envoyé à memcache pour éviter les attaques par injection.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.10", + "req_description": "Vérifiez que les chaînes de format susceptibles d'être résolues de manière inattendue ou malveillante lors de leur utilisation sont nettoyées avant d'être traitées.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.11", + "req_description": "Vérifiez que l'application nettoie les entrées utilisateur avant de les transmettre aux systèmes de messagerie pour se protéger contre l'injection SMTP ou IMAP.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.12", + "req_description": "Vérifiez que les expressions régulières sont exemptes d'éléments provoquant \"backtracking\" exponentiel et assurez-vous que les entrées non fiables sont nettoyées pour atténuer les attaques ReDoS ou Runaway Regex.", + "L": "3" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.4", + "section_name": "Mémoire, chaine de caractères et code à mémoire non-managée", + "req_id": "V1.4.1", + "req_description": "Vérifiez que l'application utilise des chaînes memory-safe, une copie de mémoire et une arithmétique de pointeur renforcée pour détecter ou empêcher les débordements de pile, de tampon ou de tas.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.4", + "section_name": "Mémoire, chaine de caractères et code à mémoire non-managée", + "req_id": "V1.4.2", + "req_description": "Vérifiez que les techniques de validation du signe, de la plage et de l’entrée sont utilisées pour éviter les dépassements d’entiers.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.4", + "section_name": "Mémoire, chaine de caractères et code à mémoire non-managée", + "req_id": "V1.4.3", + "req_description": "Vérifiez que la mémoire et les ressources allouées dynamiquement sont libérées et que les références ou les pointeurs vers la mémoire libérée sont supprimés ou définis à null pour éviter les \"dangling pointer\" et les vulnérabilités d'utilisation après libération.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.5", + "section_name": "Désérialisation sécurisée", + "req_id": "V1.5.1", + "req_description": "Vérifiez que l'application configure les \"parser\" XML pour utiliser une configuration restrictive et que les fonctionnalités non sûres telles que la résolution d'entités externes sont désactivées pour empêcher les attaques XML eXternal Entity (XXE).", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.5", + "section_name": "Désérialisation sécurisée", + "req_id": "V1.5.2", + "req_description": "Vérifiez que la désérialisation des données non fiables garantit une gestion sécurisée des entrées, par exemple en utilisant une liste d'autorisation de types d'objets ou en limitant les types d'objets définis par le client, afin d'empêcher les attaques par désérialisation. Les mécanismes de désérialisation explicitement définis comme non sécurisés ne doivent pas être utilisés avec des entrées non fiables.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.5", + "section_name": "Désérialisation sécurisée", + "req_id": "V1.5.3", + "req_description": "Vérifiez que les différents \"parser\" utilisés dans l'application pour le même type de données (par exemple, les \"parser\" JSON, les \"parser\" XML, les \"parser\" d'URL) effectuent l'analyse de manière cohérente et utilisent le même mécanisme d'encodage de caractères pour éviter des problèmes tels que les vulnérabilités d'interopérabilité JSON ou un comportement d'analyse d'URI ou de fichier différent exploité dans les attaques d'inclusion de fichiers à distance (RFI) ou de falsification de requête côté serveur (SSRF).", + "L": "3" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.1", + "section_name": "Validation et documentation de la logique métier", + "req_id": "V2.1.1", + "req_description": "Vérifiez que la documentation de l'application définit des règles de validation des entrées pour vérifier la validité des éléments de données par rapport à la structure attendue. Il peut s'agir de formats de données courants tels que des numéros de carte de crédit, des adresses e-mail ou des numéros de téléphone, ou d'un format de données interne.", + "L": "1" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.1", + "section_name": "Validation et documentation de la logique métier", + "req_id": "V2.1.2", + "req_description": "Vérifiez que la documentation de l'application définit comment valider la cohérence logique et contextuelle des éléments de données combinés, par exemple en vérifiant que la banlieue et le code postal correspondent.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.1", + "section_name": "Validation et documentation de la logique métier", + "req_id": "V2.1.3", + "req_description": "Vérifiez que les attentes en matière de limites et de validations de la logique métier sont documentées, y compris par utilisateur et globalement dans l'application.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.2", + "section_name": "Validation des entrées", + "req_id": "V2.2.1", + "req_description": "Vérifier que les entrées sont validées afin de respecter les attentes métier ou fonctionnelles. Cette validation doit être basée sur une liste de valeurs, de modèles et de plages autorisées, ou sur la comparaison des entrées avec une structure attendue et des limites logiques selon des règles prédéfinies. Pour le niveau 1, cette validation peut se concentrer sur les entrées utilisées pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau 2, elle doit s'appliquer à toutes les entrées.", + "L": "1" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.2", + "section_name": "Validation des entrées", + "req_id": "V2.2.2", + "req_description": "Vérifiez que l'application est conçue pour appliquer la validation des entrées au niveau d'une couche de service de confiance. Bien que la validation côté client améliore l'ergonomie et doit être encouragée, elle ne doit pas être considérée comme un contrôle de sécurité.", + "L": "1" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.2", + "section_name": "Validation des entrées", + "req_id": "V2.2.3", + "req_description": "Vérifiez que l’application garantit que les combinaisons d’éléments de données associés sont raisonnables selon les règles prédéfinies.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.3", + "section_name": "Sécurité de la logique métier", + "req_id": "V2.3.1", + "req_description": "Vérifiez que l’application traitera uniquement les flux de logique métier pour le même utilisateur dans l’ordre séquentiel attendu et sans sauter d’étapes.", + "L": "1" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.3", + "section_name": "Sécurité de la logique métier", + "req_id": "V2.3.2", + "req_description": "Vérifiez que les limites de la logique métier sont implémentées conformément à la documentation de l'application, afin d'éviter que des failles de la logique métier ne soient pas exploitées.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.3", + "section_name": "Sécurité de la logique métier", + "req_id": "V2.3.3", + "req_description": "Vérifiez que les transactions sont utilisées au niveau de la logique métier de telle sorte qu'une opération de logique métier réussisse dans son intégralité ou qu'elle soit restaurée à l'état correct précédent.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.3", + "section_name": "Sécurité de la logique métier", + "req_id": "V2.3.4", + "req_description": "Vérifiez que les mécanismes de verrouillage au niveau de la logique métier sont utilisés pour garantir que les ressources en quantité limitée (telles que les sièges de théâtre ou les créneaux de livraison) ne peuvent pas être réservées deux fois en manipulant la logique de l'application.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.3", + "section_name": "Sécurité de la logique métier", + "req_id": "V2.3.5", + "req_description": "Vérifiez que les flux logiques métier à forte valeur ajoutée nécessitent l'approbation de plusieurs utilisateurs afin d'éviter toute action non autorisée ou accidentelle. Cela peut inclure, sans s'y limiter, les transferts monétaires importants, les approbations de contrats, l'accès à des informations classifiées ou les contournements de sécurité dans le secteur manufacturier.", + "L": "3" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.4", + "section_name": "Anti-automatisation", + "req_id": "V2.4.1", + "req_description": "Vérifiez que des contrôles anti-automatisation sont en place pour protéger contre les appels excessifs aux fonctions d'application qui pourraient conduire à l'exfiltration de données, à la création de données inutiles, à l'épuisement des quotas, aux violations de limites de débit, au déni de service ou à la surutilisation de ressources coûteuses.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.4", + "section_name": "Anti-automatisation", + "req_id": "V2.4.2", + "req_description": "Vérifiez que les flux logiques métier nécessitent un timing humain réaliste, évitant ainsi des soumissions de transactions excessivement rapides.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.1", + "section_name": "Documentation sur la sécurité du frontend Web", + "req_id": "V3.1.1", + "req_description": "Vérifiez que la documentation de l'application indique les fonctionnalités de sécurité attendues que les navigateurs utilisant l'application doivent prendre en charge (telles que HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) et autres mécanismes de sécurité HTTP pertinents). Elle doit également définir le comportement de l'application lorsque certaines de ces fonctionnalités ne sont pas disponibles (par exemple, avertir l'utilisateur ou bloquer l'accès).", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.2", + "section_name": "Interprétation non intentionnelle du contenu", + "req_id": "V3.2.1", + "req_description": "Vérifiez que des contrôles de sécurité sont en place pour empêcher les navigateurs d'afficher du contenu ou des fonctionnalités dans les réponses HTTP dans un contexte incorrect (par exemple, lorsqu'une API, un fichier téléchargé par l'utilisateur ou une autre ressource est demandée directement). Les contrôles possibles peuvent inclure : ne pas transmettre le contenu sauf si les champs d'en-tête de requête HTTP (tels que Sec-Fetch-\\*) indiquent qu'il s'agit du contexte correct, utiliser la directive sandbox du champ d'en-tête Content-Security-Policy ou utiliser le type de disposition de pièce jointe dans le champ d'en-tête Content-Disposition.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.2", + "section_name": "Interprétation non intentionnelle du contenu", + "req_id": "V3.2.2", + "req_description": "Vérifiez que le contenu destiné à être affiché sous forme de texte, plutôt que rendu sous forme de HTML, est géré à l'aide de fonctions de rendu sécurisées (telles que createTextNode ou textContent) pour empêcher l'exécution involontaire de contenu tel que HTML ou JavaScript.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.2", + "section_name": "Interprétation non intentionnelle du contenu", + "req_id": "V3.2.3", + "req_description": "Vérifiez que l'application évite l'écrasement du DOM lors de l'utilisation de JavaScript côté client en utilisant des déclarations de variables explicites, en effectuant une vérification de type stricte, en évitant de stocker des variables globales sur l'objet document et en implémentant l'isolation de l'espace de nommage.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.3", + "section_name": "Configuration des cookies", + "req_id": "V3.3.1", + "req_description": "Vérifiez que les cookies ont l'attribut « Secure » ​​défini et si le préfixe « \\__Host- » n'est pas utilisé pour le nom du cookie, le préfixe « __Secure- » doit être utilisé pour le nom du cookie.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.3", + "section_name": "Configuration des cookies", + "req_id": "V3.3.2", + "req_description": "Vérifiez que la valeur de l'attribut « SameSite » de chaque cookie est définie en fonction de l'objectif du cookie, afin de limiter l'exposition aux attaques de réparation de l'interface utilisateur et aux attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.3", + "section_name": "Configuration des cookies", + "req_id": "V3.3.3", + "req_description": "Vérifiez que les cookies ont le préfixe « __Host- » pour le nom du cookie, sauf s'ils sont explicitement conçus pour être partagés avec d'autres hôtes.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.3", + "section_name": "Configuration des cookies", + "req_id": "V3.3.4", + "req_description": "Vérifiez que si la valeur d'un cookie n'est pas censée être accessible aux scripts côté client (comme un jeton de session), le cookie doit avoir l'attribut « HttpOnly » défini et la même valeur (par exemple, un jeton de session) ne doit être transférée au client que via le champ d'en-tête « Set-Cookie ».", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.3", + "section_name": "Configuration des cookies", + "req_id": "V3.3.5", + "req_description": "Vérifiez que lorsque l'application écrit un cookie, la longueur combinée du nom et de la valeur du cookie ne dépasse pas 4 096 octets. Les cookies trop volumineux ne seront pas stockés par le navigateur et ne seront donc pas envoyés avec les requêtes, empêchant ainsi l'utilisateur d'utiliser les fonctionnalités de l'application qui reposent sur ce cookie.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.4", + "section_name": "En-têtes du mécanisme de sécurité du navigateur", + "req_id": "V3.4.1", + "req_description": "Vérifiez qu'un champ d'en-tête Strict-Transport-Security est inclus dans toutes les réponses afin d'appliquer une politique HTTP Strict Transport Security (HSTS). Une durée maximale d'au moins un an doit être définie, et pour les niveaux L2 et supérieurs, la politique doit également s'appliquer à tous les sous-domaines.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.4", + "section_name": "En-têtes du mécanisme de sécurité du navigateur", + "req_id": "V3.4.2", + "req_description": "Vérifiez que le champ d'en-tête Access-Control-Allow-Origin du partage de ressources cross-origine (CORS) est une valeur fixe de l'application ou, si la valeur du champ d'en-tête de requête HTTP Origin est utilisée, qu'elle est validée par rapport à une liste d'origines approuvées. Si « Access-Control-Allow-Origin: * » doit être utilisé, vérifiez que la réponse ne contient aucune information sensible.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.4", + "section_name": "En-têtes du mécanisme de sécurité du navigateur", + "req_id": "V3.4.3", + "req_description": "Vérifiez que les réponses HTTP incluent un champ d'en-tête de réponse Content-Security-Policy qui définit des directives garantissant que le navigateur charge et exécute uniquement du contenu ou des ressources fiables, afin de limiter l'exécution de JavaScript malveillant. Au minimum, une politique globale doit être utilisée, incluant les directives object-src 'none' et base-uri 'none', et définissant soit une lliste d’autorisations, soit des valeurs nonces ou des hachages. Pour une application L3, une politique par réponse avec des valeurs nonces ou des hachages doit être définie.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.4", + "section_name": "En-têtes du mécanisme de sécurité du navigateur", + "req_id": "V3.4.4", + "req_description": "Vérifiez que toutes les réponses HTTP contiennent un champ d'en-tête « X-Content-Type-Options: nosniff ». Cela indique aux navigateurs de ne pas utiliser l'analyse de contenu ni la détection du type MIME pour la réponse donnée, et d'exiger que la valeur du champ d'en-tête « Content-Type » de la réponse corresponde à la ressource de destination. Par exemple, la réponse à une demande de style n'est acceptée que si le type de contenu de la réponse est « text/css ». Cela permet également au navigateur d'utiliser la fonctionnalité de blocage de lecture inter-origines (CORB).", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.4", + "section_name": "En-têtes du mécanisme de sécurité du navigateur", + "req_id": "V3.4.5", + "req_description": "Vérifiez que l'application définit une politique de référencement afin d'empêcher la fuite de données techniquement sensibles vers des services tiers via le champ d'en-tête de requête HTTP « Referer ». Cela peut être effectué via le champ d'en-tête de réponse HTTP « Referrer-Policy » ou via les attributs d'élément HTML. Les données sensibles peuvent inclure le chemin d'accès et les données de requête dans l'URL, et pour les applications internes non publiques, le nom d'hôte.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.4", + "section_name": "En-têtes du mécanisme de sécurité du navigateur", + "req_id": "V3.4.6", + "req_description": "Vérifiez que l'application Web utilise la directive frame-ancestors du champ d'en-tête Content-Security-Policy pour chaque réponse HTTP afin de garantir qu'elle ne peut pas être intégrée par défaut et que l'intégration de ressources spécifiques n'est autorisée qu'en cas de nécessité. Notez que le champ d'en-tête X-Frame-Options, bien que pris en charge par les navigateurs, est obsolète et n'est pas forcément fiable.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.4", + "section_name": "En-têtes du mécanisme de sécurité du navigateur", + "req_id": "V3.4.7", + "req_description": "Vérifiez que le champ d’en-tête Content-Security-Policy spécifie un emplacement pour signaler les violations.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.4", + "section_name": "En-têtes du mécanisme de sécurité du navigateur", + "req_id": "V3.4.8", + "req_description": "Vérifiez que toutes les réponses HTTP qui lancent le rendu d'un document (comme les réponses de type text/html) incluent le champ d'en-tête 'Cross-Origin-Opener-Policy' avec la directive 'same-origin' ou s'ame-origin-allow-popups', selon les besoins. Cela empêche les attaques abusant de l'accès partagé aux objets Window, telles que le tabnabbing et le comptage d'images.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.5", + "section_name": "Séparation de l'origine du navigateur", + "req_id": "V3.5.1", + "req_description": "Vérifiez que, si l'application ne s'appuie pas sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher les requêtes inter-origines non autorisées d'utiliser des fonctionnalités sensibles, ces requêtes sont validées afin de garantir leur origine. Cela peut se faire en utilisant et en validant des jetons anti-falsification ou en exigeant des champs d'en-tête HTTP supplémentaires qui ne sont pas des champs d'en-tête de requête CORS safelist. Ceci permet de se protéger contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.5", + "section_name": "Séparation de l'origine du navigateur", + "req_id": "V3.5.2", + "req_description": "Vérifiez que, si l'application s'appuie sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher l'utilisation inter-origines non autorisée de fonctionnalités sensibles, il est impossible d'appeler la fonctionnalité avec une requête qui ne déclenche pas de requête de pré-vérification cross-origin CORS. Cela peut nécessiter de vérifier les valeurs des champs d'en-tête de requête 'Origin' et 'Content-Type' ou d'utiliser un champ d'en-tête supplémentaire qui n'est pas un champ d'en-tête de la liste de sécurité CORS.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.5", + "section_name": "Séparation de l'origine du navigateur", + "req_id": "V3.5.3", + "req_description": "Vérifiez que les requêtes HTTP destinées aux fonctionnalités sensibles utilisent des méthodes HTTP appropriées, telles que POST, PUT, PATCH ou DELETE, et non des méthodes définies comme « sûres » par la spécification HTTP, telles que HEAD, OPTIONS ou GET. Une validation stricte des champs d'en-tête de requête Sec-Fetch-* peut également être utilisée pour garantir que la requête ne provient pas d'un appel inter-origines inapproprié, d'une requête de navigation ou d'un chargement de ressources (comme une source d'image) inattendu.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.5", + "section_name": "Séparation de l'origine du navigateur", + "req_id": "V3.5.4", + "req_description": "Vérifiez que des applications distinctes sont hébergées sur des noms d'hôte différents pour tirer parti des restrictions fournies par la politique de même origine, y compris la manière dont les documents ou scripts chargés par une origine peuvent interagir avec les ressources d'une autre origine et les restrictions basées sur le nom d'hôte sur les cookies.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.5", + "section_name": "Séparation de l'origine du navigateur", + "req_id": "V3.5.5", + "req_description": "Vérifiez que les messages reçus par l'interface postMessage sont rejetés si l'origine du message n'est pas digne de confiance ou si la syntaxe du message n'est pas valide.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.5", + "section_name": "Séparation de l'origine du navigateur", + "req_id": "V3.5.6", + "req_description": "Vérifiez que la fonctionnalité JSONP n'est activée nulle part dans l'application pour éviter les attaques Cross-Site Script Inclusion (XSSI).", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.5", + "section_name": "Séparation de l'origine du navigateur", + "req_id": "V3.5.7", + "req_description": "Vérifiez que les données nécessitant une autorisation ne sont pas incluses dans les réponses des ressources de script, comme les fichiers JavaScript, pour empêcher les attaques par inclusion de script intersite (XSSI).", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.5", + "section_name": "Séparation de l'origine du navigateur", + "req_id": "V3.5.8", + "req_description": "Vérifiez que les ressources authentifiées (telles que les images, les vidéos, les scripts et autres documents) peuvent être chargées ou intégrées pour le compte de l'utilisateur uniquement lorsque cela est prévu. Cela peut être réalisé en validant strictement les champs d'en-tête de requête HTTP Sec-Fetch-* afin de garantir que la requête ne provient pas d'un appel cross-origin inapproprié, ou en définissant un champ d'en-tête de réponse HTTP Cross-Origin-Resource-Policy restrictif pour indiquer au navigateur de bloquer le contenu renvoyé.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.6", + "section_name": "Intégrité des ressources externes", + "req_id": "V3.6.1", + "req_description": "Vérifiez que les ressources côté client, telles que les bibliothèques JavaScript, les feuilles de style CSS ou les polices web, sont hébergées en externe (par exemple, sur un réseau de diffusion de contenu) uniquement si la ressource est statique et versionnée, et si l'intégrité des sous-ressources (SRI) est utilisée pour valider l'intégrité de la ressource. Si cela n'est pas possible, une décision de sécurité documentée doit justifier cette décision pour chaque ressource.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.7", + "section_name": "Autres considérations sur la sécurité du navigateur", + "req_id": "V3.7.1", + "req_description": "Vérifiez que l'application utilise uniquement des technologies côté client toujours prises en charge et considérées comme sécurisées. Parmi les technologies qui ne répondent pas à cette exigence figurent les plugins NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL ou les applets Java côté client.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.7", + "section_name": "Autres considérations sur la sécurité du navigateur", + "req_id": "V3.7.2", + "req_description": "Vérifiez que l'application redirigera automatiquement l'utilisateur vers un nom d'hôte ou un domaine différent (qui n'est pas contrôlé par l'application) uniquement lorsque la destination apparaît sur une liste d'autorisation.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.7", + "section_name": "Autres considérations sur la sécurité du navigateur", + "req_id": "V3.7.3", + "req_description": "Vérifiez que le domaine de premier niveau de l'application (par exemple, site.tld) ​​est ajouté à la liste de préchargement publique pour HTTP Strict Transport Security (HSTS). Cela garantit que l'utilisation de TLS pour l'application est intégrée directement dans les principaux navigateurs, plutôt que de dépendre uniquement du champ d'en-tête de réponse Strict-Transport-Security.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.7", + "section_name": "Autres considérations sur la sécurité du navigateur", + "req_id": "V3.7.4", + "req_description": "Vérifiez que l'application affiche une notification lorsque l'utilisateur est redirigé vers une URL hors du contrôle de l'application, avec une option pour annuler la navigation.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.7", + "section_name": "Autres considérations sur la sécurité du navigateur", + "req_id": "V3.7.5", + "req_description": "Vérifiez que l'application se comporte comme documenté (par exemple, en avertissant l'utilisateur ou en bloquant l'accès) si le navigateur utilisé pour accéder à l'application ne prend pas en charge les fonctionnalités de sécurité attendues.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.1", + "section_name": "Sécurité du service Web générique", + "req_id": "V4.1.1", + "req_description": "Vérifiez que chaque réponse HTTP avec un corps de message contient un champ d'en-tête Content-Type qui correspond au contenu réel de la réponse, y compris le paramètre charset pour spécifier un codage de caractères sécurisé (par exemple, UTF-8, ISO-8859-1) conformément aux types de médias IANA, tels que « text/ », « /+xml » et « /xml ».", + "L": "1" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.1", + "section_name": "Sécurité du service Web générique", + "req_id": "V4.1.2", + "req_description": "Vérifiez que seuls les terminaux utilisateurs (destinés à l'accès manuel via un navigateur web) redirigent automatiquement de HTTP vers HTTPS, tandis que les autres services ou terminaux n'implémentent pas de redirections transparentes. Cela permet d'éviter qu'un client envoie par erreur des requêtes HTTP non chiffrées, mais que, comme ces requêtes sont automatiquement redirigées vers HTTPS, la fuite de données sensibles passe inaperçue.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.1", + "section_name": "Sécurité du service Web générique", + "req_id": "V4.1.3", + "req_description": "Vérifiez que tout champ d'en-tête HTTP utilisé par l'application et défini par une couche intermédiaire, telle qu'un équilibreur de charge, un proxy web ou un service backend-for-frontend, ne peut pas être remplacé par l'utilisateur final. Les exemples d'en-têtes peuvent inclure X-Real-IP, X-Forwarded-*, ou X-User-ID.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.1", + "section_name": "Sécurité du service Web générique", + "req_id": "V4.1.4", + "req_description": "Vérifiez que seules les méthodes HTTP explicitement prises en charge par l'application ou son API (y compris les OPTIONS lors des demandes de contrôle en amont) peuvent être utilisées et que les méthodes inutilisées sont bloquées.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.1", + "section_name": "Sécurité du service Web générique", + "req_id": "V4.1.5", + "req_description": "Vérifier que les signatures numériques par message sont utilisées pour fournir une assurance supplémentaire en plus des protections de transport pour les demandes ou les transactions qui sont très sensibles ou qui traversent un certain nombre de systèmes.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.2", + "section_name": "Validation de la structure des messages HTTP", + "req_id": "V4.2.1", + "req_description": "Vérifiez que tous les composants de l'application (y compris les équilibreurs de charge, les pares-feux et les serveurs d'applications) déterminent les limites des messages HTTP entrants à l'aide du mécanisme approprié à la version HTTP afin d'empêcher la contrebande de requêtes HTTP. Dans HTTP/1.x, si un champ d'en-tête Transfer-Encoding est présent, l'en-tête Content-Length doit être ignoré conformément à la RFC 2616. Avec HTTP/2 ou HTTP/3, si un champ d'en-tête Content-Length est présent, le récepteur doit s'assurer qu'il est cohérent avec la longueur des trames DATA.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.2", + "section_name": "Validation de la structure des messages HTTP", + "req_id": "V4.2.2", + "req_description": "Vérifier que, lors de la génération de messages HTTP, le champ d'en-tête Content-Length n'entre pas en conflit avec la longueur du contenu déterminée par le cadrage du protocole HTTP, afin d'empêcher les attaques de type « request smuggling ».", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.2", + "section_name": "Validation de la structure des messages HTTP", + "req_id": "V4.2.3", + "req_description": "Vérifiez que l'application n'envoie ni n'accepte de messages HTTP/2 ou HTTP/3 avec des champs d'en-tête spécifiques à la connexion, tels que Transfer-Encoding, afin d'éviter les attaques par fractionnement de la réponse et par injection d'en-tête.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.2", + "section_name": "Validation de la structure des messages HTTP", + "req_id": "V4.2.4", + "req_description": "Vérifiez que l'application n'accepte que les requêtes HTTP/2 et HTTP/3 dont les champs et valeurs d'en-tête ne contiennent pas de séquences CR (\\r), LF (\\n) ou CRLF (\\r\\n), afin d'éviter les attaques par injection d'en-tête.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.2", + "section_name": "Validation de la structure des messages HTTP", + "req_id": "V4.2.5", + "req_description": "Vérifiez que, si l'application (backend ou frontend) construit et envoie des requêtes, elle utilise des mécanismes de validation, d'assainissement ou autres pour éviter de créer des URI (comme pour les appels API) ou des champs d'en-tête de requête HTTP (comme Authorization ou Cookie) qui sont trop longs pour être acceptés par le composant récepteur. Cela pourrait entraîner un déni de service, par exemple lors de l'envoi d'une requête trop longue (par exemple, un long champ d'en-tête de cookie), ce qui fait que le serveur répond toujours avec un statut d'erreur.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.3", + "section_name": "GraphQL", + "req_id": "V4.3.1", + "req_description": "Vérifiez qu'une liste d'autorisation de requête, une limitation de profondeur, une limitation de quantité ou une analyse des coûts de requête est utilisée pour empêcher le déni de service (DoS) de GraphQL ou d'expression de la couche données en raison de requêtes imbriquées coûteuses.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.3", + "section_name": "GraphQL", + "req_id": "V4.3.2", + "req_description": "Vérifiez que les requêtes d’introspection GraphQL sont désactivées dans l’environnement de production, sauf si l’API GraphQL est destinée à être utilisée par d’autres parties.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.1", + "req_description": "Vérifiez que WebSocket sur TLS (WSS) est utilisé pour toutes les connexions WebSocket.", + "L": "1" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.2", + "req_description": "Vérifiez que, lors de la négociation HTTP WebSocket initiale, le champ d’en-tête 'Origin' est vérifié par rapport à une liste d’origines autorisées pour l’application.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.3", + "req_description": "Vérifiez que, si la gestion de session standard de l'application ne peut pas être utilisée, des jetons dédiés sont utilisés à cet effet, qui sont conformes aux exigences de sécurité de gestion de session pertinentes.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.4", + "req_description": "Vérifiez que les jetons de gestion de session WebSocket dédiés sont initialement obtenus ou validés via la session HTTPS précédemment authentifiée lors de la transition d'une session HTTPS existante vers un canal WebSocket.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.1", + "section_name": "Documentation sur la gestion des fichiers", + "req_id": "V5.1.1", + "req_description": "Vérifiez que la documentation définit les types de fichiers autorisés, les extensions de fichiers attendues et la taille maximale (y compris la taille décompressée) pour chaque fonctionnalité de Téléversement. De plus, assurez-vous que la documentation précise comment les fichiers sont sécurisés pour le téléchargement et le traitement des utilisateurs finaux, par exemple le comportement de l'application lorsqu'un fichier malveillant est détecté.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.2", + "section_name": "Téléversement de fichiers et contenu", + "req_id": "V5.2.1", + "req_description": "Vérifiez que l'application n'acceptera que des fichiers d'une taille qu'elle peut traiter sans provoquer de perte de performances ou d'attaque par déni de service.", + "L": "1" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.2", + "section_name": "Téléversement de fichiers et contenu", + "req_id": "V5.2.2", + "req_description": "Vérifiez que lorsque l'application accepte un fichier, seul ou dans une archive telle qu'un fichier zip, elle vérifie si l'extension de fichier correspond à une extension attendue et que le contenu correspond au type représenté par l'extension. Cela inclut, sans s'y limiter, la vérification des « octets magiques » initiaux, la réécriture d'images et l'utilisation de bibliothèques spécialisées pour la validation du contenu des fichiers. Pour le niveau L1, cela peut se concentrer uniquement sur les fichiers utilisés pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau L2, cela doit s'appliquer à tous les fichiers acceptés.", + "L": "1" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.2", + "section_name": "Téléversement de fichiers et contenu", + "req_id": "V5.2.3", + "req_description": "Vérifiez que l'application vérifie les fichiers compressés (par exemple, zip, gz, docx, odt) par rapport à la taille maximale autorisée non compressée et au nombre maximal de fichiers avant de décompresser le fichier.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.2", + "section_name": "Téléversement de fichiers et contenu", + "req_id": "V5.2.4", + "req_description": "Vérifiez qu'un quota de taille de fichier et un nombre maximal de fichiers par utilisateur sont appliqués pour garantir qu'un seul utilisateur ne puisse pas remplir le stockage avec trop de fichiers ou des fichiers excessivement volumineux.", + "L": "3" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.2", + "section_name": "Téléversement de fichiers et contenu", + "req_id": "V5.2.5", + "req_description": "Vérifiez que l'application n'autorise pas le téléversement de fichiers compressés contenant des liens symboliques, sauf si cela est spécifiquement requis (auquel cas il sera nécessaire d'appliquer une liste d'autorisation des fichiers vers lesquels il est possible de créer des liens symboliques).", + "L": "3" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.2", + "section_name": "Téléversement de fichiers et contenu", + "req_id": "V5.2.6", + "req_description": "Vérifiez que l'application rejette les images téléversées avec une taille de pixel supérieure au maximum autorisé, afin d'éviter les attaques par inondation de pixels.", + "L": "3" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.3", + "section_name": "Stockage de fichiers", + "req_id": "V5.3.1", + "req_description": "Vérifiez que les fichiers téléversés ou générés par une entrée non fiable et stockés dans un dossier public ne sont pas exécutés en tant que code de programme côté serveur lorsqu'ils sont accessibles directement avec une requête HTTP.", + "L": "1" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.3", + "section_name": "Stockage de fichiers", + "req_id": "V5.3.2", + "req_description": "Vérifiez que lorsque l'application crée des chemins d'accès pour les opérations sur les fichiers, elle utilise des données générées en interne ou fiables plutôt que des noms de fichiers soumis par l'utilisateur. Si des noms de fichiers ou des métadonnées de fichiers soumis par l'utilisateur doivent être utilisés, une validation et un nettoyage stricts doivent être appliqués. Ceci permet de se protéger contre les attaques par traversée de chemin, l'inclusion de fichiers locaux ou distants (LFI, RFI) et la falsification de requêtes côté serveur (SSRF).", + "L": "1" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.3", + "section_name": "Stockage de fichiers", + "req_id": "V5.3.3", + "req_description": "Vérifiez que le traitement des fichiers côté serveur, comme la décompression des fichiers, ignore les informations de chemin fournies par l'utilisateur pour éviter les vulnérabilités telles que le \"zip slip\".", + "L": "3" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.4", + "section_name": "Téléchargement de fichier", + "req_id": "V5.4.1", + "req_description": "Vérifiez que l’application valide ou ignore les noms de fichiers soumis par l’utilisateur, y compris dans un paramètre JSON, JSONP ou URL et spécifie un nom de fichier dans le champ d’en-tête Content-Disposition de la réponse.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.4", + "section_name": "Téléchargement de fichier", + "req_id": "V5.4.2", + "req_description": "Vérifiez que les noms de fichiers servis (par exemple, dans les champs d'en-tête de réponse HTTP ou les pièces jointes aux e-mails) sont encodés ou nettoyés (par exemple, conformément à la RFC 6266) pour préserver la structure du document et empêcher les attaques par injection.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.4", + "section_name": "Téléchargement de fichier", + "req_id": "V5.4.3", + "req_description": "Vérifiez que les fichiers obtenus à partir de sources non fiables sont analysés par des scanners antivirus pour empêcher la diffusion de contenu malveillant connu.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.1", + "section_name": "Documentation d'authentification", + "req_id": "V6.1.1", + "req_description": "Vérifiez que la documentation de l'application définit comment les contrôles, tels que la limitation de débit, l'anti-automatisation et la réponse adaptative, sont utilisés pour se défendre contre les attaques telles que le « credential stuffing » et la force brute des mots de passe. La documentation doit expliquer clairement comment ces contrôles sont configurés et empêcher le blocage malveillant des comptes.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.1", + "section_name": "Documentation d'authentification", + "req_id": "V6.1.2", + "req_description": "Vérifiez qu'une liste de mots spécifiques au contexte est documentée afin d'empêcher leur utilisation dans les mots de passe. Cette liste peut inclure des permutations de noms d'organisations, de produits, d'identifiants de systèmes, de noms de codes de projets, de noms de services ou de rôles, etc.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.1", + "section_name": "Documentation d'authentification", + "req_id": "V6.1.3", + "req_description": "Vérifiez que, si l'application inclut plusieurs voies d'authentification, celles-ci sont toutes documentées avec les contrôles de sécurité et la force d'authentification qui doivent être appliqués de manière cohérente.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.1", + "req_description": "Vérifiez que les mots de passe définis par l'utilisateur comportent au moins 8 caractères, bien qu'un minimum de 15 caractères soit fortement recommandé.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.2", + "req_description": "Vérifiez que les utilisateurs peuvent modifier leur mot de passe.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.3", + "req_description": "Vérifiez que la fonctionnalité de changement de mot de passe nécessite le mot de passe actuel et le nouveau mot de passe de l'utilisateur.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.4", + "req_description": "Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou du changement de mot de passe sont vérifiés par rapport à un ensemble disponible d'au moins 3 000 mots de passe principaux qui correspondent à la politique de mot de passe de l'application, par exemple la longueur minimale.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.5", + "req_description": "Vérifiez que les mots de passe peuvent être utilisés, quelle que soit leur composition, sans restriction quant au type de caractères autorisés. Aucun nombre minimal de majuscules ou de minuscules, de chiffres ou de caractères spéciaux ne doit être exigé.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.6", + "req_description": "Vérifiez que les champs de saisie du mot de passe utilisent type=password pour masquer la saisie. Les applications peuvent permettre à l'utilisateur d'afficher temporairement l'intégralité du mot de passe masqué ou le dernier caractère saisi.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.7", + "req_description": "Vérifiez que la fonctionnalité « coller », les assistants de mot de passe du navigateur et les gestionnaires de mots de passe externes sont autorisés.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.8", + "req_description": "Vérifiez que l'application vérifie le mot de passe de l'utilisateur exactement tel qu'il a été reçu de l'utilisateur, sans aucune modification telle qu'une troncature ou une transformation de casse.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.9", + "req_description": "Vérifiez que les mots de passe d’au moins 64 caractères sont autorisés.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.10", + "req_description": "Vérifiez que le mot de passe d'un utilisateur reste valide jusqu'à ce qu'il soit découvert comme compromis ou qu'il soit renouvelé. L'application ne doit pas exiger de renouvellement périodique des identifiants.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.11", + "req_description": "Vérifiez que la liste documentée de mots spécifiques au contexte est utilisée pour éviter la création de mots de passe faciles à deviner.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.12", + "req_description": "Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou des modifications de mot de passe sont vérifiés par rapport à un ensemble de mots de passe fuités.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.3", + "section_name": "Sécurité générale de l'authentification", + "req_id": "V6.3.1", + "req_description": "Vérifiez que les contrôles visant à empêcher les attaques telles que le bourrage d'informations d'identification et la force brute des mots de passe sont mis en œuvre conformément à la documentation de sécurité de l'application.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.3", + "section_name": "Sécurité générale de l'authentification", + "req_id": "V6.3.2", + "req_description": "Vérifiez que les comptes d’utilisateur par défaut (par exemple, « root », « admin » ou « sa ») ne sont pas présents dans l’application ou sont désactivés.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.3", + "section_name": "Sécurité générale de l'authentification", + "req_id": "V6.3.3", + "req_description": "Vérifiez que l’application exige que les utilisateurs utilisent un mécanisme d’authentification multifacteur ou une combinaison de mécanismes d’authentification à facteur unique.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.3", + "section_name": "Sécurité générale de l'authentification", + "req_id": "V6.3.4", + "req_description": "Vérifiez que, si l’application inclut plusieurs voies d’authentification, il n’existe aucune voie non documentée et que les contrôles de sécurité et la force d’authentification sont appliqués de manière cohérente.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.3", + "section_name": "Sécurité générale de l'authentification", + "req_id": "V6.3.5", + "req_description": "Vérifiez que les utilisateurs sont informés des tentatives d'authentification suspectes (réussies ou non). Il peut s'agir de tentatives d'authentification provenant d'un emplacement ou d'un client inhabituel, d'une authentification partiellement réussie (un seul facteur parmi plusieurs), d'une tentative d'authentification après une longue période d'inactivité ou d'une authentification réussie après plusieurs tentatives infructueuses.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.3", + "section_name": "Sécurité générale de l'authentification", + "req_id": "V6.3.6", + "req_description": "Vérifiez que le courrier électronique n’est pas utilisé comme mécanisme d’authentification à facteur unique ou à facteurs multiples.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.3", + "section_name": "Sécurité générale de l'authentification", + "req_id": "V6.3.7", + "req_description": "Vérifiez que les utilisateurs sont avertis après les mises à jour des détails d'authentification, telles que les réinitialisations d'informations d'identification ou la modification du nom d'utilisateur ou de l'adresse e-mail.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.3", + "section_name": "Sécurité générale de l'authentification", + "req_id": "V6.3.8", + "req_description": "Vérifiez que les utilisateurs valides ne peuvent pas être déduits d'échecs d'authentification, par exemple en se basant sur des messages d'erreur, des codes de réponse HTTP ou des temps de réponse différents. Les fonctionnalités d'inscription et de mot de passe oublié doivent également bénéficier de cette protection.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.4", + "section_name": "Cycle de vie et récupération du facteur d'authentification", + "req_id": "V6.4.1", + "req_description": "Vérifiez que les mots de passe initiaux ou les codes d'activation générés par le système sont générés de manière aléatoire et sécurisée, qu'ils respectent la politique de mots de passe en vigueur et qu'ils expirent après une courte période ou après leur première utilisation. Ces secrets initiaux ne doivent pas devenir des mots de passe permanents.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.4", + "section_name": "Cycle de vie et récupération du facteur d'authentification", + "req_id": "V6.4.2", + "req_description": "Vérifiez que les indices de mot de passe ou l'authentification basée sur les connaissances (appelées « questions secrètes ») ne sont pas présents.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.4", + "section_name": "Cycle de vie et récupération du facteur d'authentification", + "req_id": "V6.4.3", + "req_description": "Vérifiez qu'un processus sécurisé de réinitialisation d'un mot de passe oublié est mis en œuvre, qui ne contourne aucun mécanisme d'authentification multifacteur activé.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.4", + "section_name": "Cycle de vie et récupération du facteur d'authentification", + "req_id": "V6.4.4", + "req_description": "Vérifiez que si un facteur d'authentification multifacteur est perdu, la preuve de vérification d'identité est effectuée au même niveau que lors de l'inscription.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.4", + "section_name": "Cycle de vie et récupération du facteur d'authentification", + "req_id": "V6.4.5", + "req_description": "Vérifiez que les instructions de renouvellement des mécanismes d'authentification qui expirent sont envoyées avec suffisamment de temps pour être exécutées avant l'expiration de l'ancien mécanisme d'authentification, en configurant des rappels automatiques si nécessaire.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.4", + "section_name": "Cycle de vie et récupération du facteur d'authentification", + "req_id": "V6.4.6", + "req_description": "Vérifiez que les administrateurs peuvent initier la réinitialisation du mot de passe de l'utilisateur, mais que cela ne leur permet pas de modifier ou de choisir son mot de passe. Cela évite qu'ils ne connaissent le mot de passe de l'utilisateur.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.5", + "section_name": "Exigences générales en matière d'authentification multifacteur", + "req_id": "V6.5.1", + "req_description": "Vérifiez que les secrets de recherche, les demandes ou codes d'authentification out-of-band et les mots de passe à usage unique basés sur le temps (TOTP) ne peuvent être utilisés avec succès qu'une seule fois.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.5", + "section_name": "Exigences générales en matière d'authentification multifacteur", + "req_id": "V6.5.2", + "req_description": "Vérifiez que, lors de leur stockage dans le backend de l'application, les secrets de recherche comportant moins de 112 bits d'entropie (19 caractères alphanumériques aléatoires ou 34 chiffres aléatoires) sont hachés avec un algorithme de hachage de stockage de mots de passe approuvé, intégrant un sel aléatoire de 32 bits. Une fonction de hachage standard peut être utilisée si le secret comporte 112 bits d'entropie ou plus.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.5", + "section_name": "Exigences générales en matière d'authentification multifacteur", + "req_id": "V6.5.3", + "req_description": "Vérifiez que les secrets de recherche, le code d'authentification out-of-band et les mots de passe à usage unique basés sur le temps sont générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) pour éviter les valeurs prévisibles.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.5", + "section_name": "Exigences générales en matière d'authentification multifacteur", + "req_id": "V6.5.4", + "req_description": "Vérifiez que les secrets de recherche et les codes d'authentification out-of-band ont un minimum de 20 bits d'entropie (généralement 4 caractères alphanumériques aléatoires ou 6 chiffres aléatoires suffisent).", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.5", + "section_name": "Exigences générales en matière d'authentification multifacteur", + "req_id": "V6.5.5", + "req_description": "Vérifiez que les requêtes, codes ou jetons d'authentification out-of-band, ainsi que les mots de passe à usage unique (TOTP), ont une durée de vie définie. Les requêtes out-of-band doivent avoir une durée de vie maximale de 10 minutes et les TOTP, de 30 secondes.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.5", + "section_name": "Exigences générales en matière d'authentification multifacteur", + "req_id": "V6.5.6", + "req_description": "Vérifiez que tout facteur d’authentification (y compris les appareils physiques) peut être révoqué en cas de vol ou autre perte.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.5", + "section_name": "Exigences générales en matière d'authentification multifacteur", + "req_id": "V6.5.7", + "req_description": "Vérifiez que les mécanismes d’authentification biométrique ne sont utilisés que comme facteurs secondaires, avec quelque chose que vous possédez ou quelque chose que vous savez.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.5", + "section_name": "Exigences générales en matière d'authentification multifacteur", + "req_id": "V6.5.8", + "req_description": "Vérifiez que les mots de passe à usage unique basés sur le temps (TOTP) sont vérifiés en fonction d'une source temporelle provenant d'un service de confiance et non d'une heure non fiable ou fournie par le client.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.6", + "section_name": "Mécanismes d'authentification out-of-band", + "req_id": "V6.6.1", + "req_description": "Vérifier que les mécanismes d'authentification utilisant le réseau téléphonique public commuté (RTPC) pour la transmission de mots de passe à usage unique (OTP) par téléphone ou SMS ne sont proposés que lorsque le numéro de téléphone a été préalablement validé. D'autres méthodes plus robustes (telles que les mots de passe à usage unique à durée déterminée) sont également proposées, et que le service informe les utilisateurs des risques de sécurité qu'elles présentent. Pour les applications de niveau 3, le téléphone et les SMS ne doivent pas être disponibles.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.6", + "section_name": "Mécanismes d'authentification out-of-band", + "req_id": "V6.6.2", + "req_description": "Vérifiez que les demandes d’authentification out-of-band, les codes ou les jetons sont liés à la demande d’authentification d’origine pour laquelle ils ont été générés et ne sont pas utilisables pour une demande précédente ou ultérieure.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.6", + "section_name": "Mécanismes d'authentification out-of-band", + "req_id": "V6.6.3", + "req_description": "Vérifiez qu'un mécanisme d'authentification out-of-band basé sur du code est protégé contre les attaques par force brute grâce au \"rate limiting\". Envisagez également d'utiliser un code avec au moins 64 bits d'entropie.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.6", + "section_name": "Mécanismes d'authentification out-of-band", + "req_id": "V6.6.4", + "req_description": "Vérifiez que, lorsque les notifications push sont utilisées pour l'authentification multifacteur, le \"rate limiting\" est appliqué afin d'empêcher les attaques de type « push bombing ». La concordance des numéros peut également atténuer ce risque.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.7", + "section_name": "Mécanisme d'authentification cryptographique", + "req_id": "V6.7.1", + "req_description": "Vérifiez que les certificats utilisés pour vérifier les assertions d’authentification cryptographique sont stockés de manière à les protéger contre toute modification.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.7", + "section_name": "Mécanisme d'authentification cryptographique", + "req_id": "V6.7.2", + "req_description": "Vérifiez que le nonce de défi a une longueur d'au moins 64 bits et qu'il est statistiquement unique ou unique sur toute la durée de vie du périphérique cryptographique.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.8", + "section_name": "Authentification avec un fournisseur d'identité", + "req_id": "V6.8.1", + "req_description": "Vérifiez que, si l'application prend en charge plusieurs fournisseurs d'identité (IdP), l'identité de l'utilisateur ne peut pas être usurpée via un autre fournisseur d'identité pris en charge (par exemple, en utilisant le même identifiant utilisateur). La mesure standard consisterait à ce que l'application enregistre et identifie l'utilisateur à l'aide d'une combinaison de l'ID du fournisseur d'identité (servant d'espace de noms) et de l'ID de l'utilisateur dans le fournisseur d'identité.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.8", + "section_name": "Authentification avec un fournisseur d'identité", + "req_id": "V6.8.2", + "req_description": "Vérifiez que la présence et l'intégrité des signatures numériques sur les assertions d'authentification (par exemple sur les assertions JWT ou SAML) sont toujours validées, en rejetant toutes les assertions non signées ou ayant des signatures non valides.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.8", + "section_name": "Authentification avec un fournisseur d'identité", + "req_id": "V6.8.3", + "req_description": "Vérifiez que les assertions SAML sont traitées de manière unique et utilisées une seule fois au cours de la période de validité pour éviter les attaques par rejeu.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.8", + "section_name": "Authentification avec un fournisseur d'identité", + "req_id": "V6.8.4", + "req_description": "Si une application utilise un fournisseur d'identité (IdP) distinct et attend une force, des méthodes ou une date d'authentification spécifiques pour des fonctions spécifiques, vérifiez que l'application les vérifie à l'aide des informations renvoyées par l'IdP. Par exemple, si OIDC est utilisé, cela peut être réalisé en validant les affirmations de jeton d'identification telles que « acr », « amr » et « auth_time » (le cas échéant). Si l'IdP ne fournit pas ces informations, l'application doit disposer d'une approche de secours documentée qui suppose que le mécanisme d'authentification de force minimale a été utilisé (par exemple, une authentification à facteur unique avec nom d'utilisateur et mot de passe).", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.1", + "section_name": "Documentation sur la gestion des sessions", + "req_id": "V7.1.1", + "req_description": "Vérifiez que le délai d'inactivité de la session de l'utilisateur et la durée de vie maximale absolue de la session sont documentés, sont appropriés en combinaison avec d'autres contrôles et que la documentation inclut une justification de tout écart par rapport aux exigences de réauthentification NIST SP 800-63B.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.1", + "section_name": "Documentation sur la gestion des sessions", + "req_id": "V7.1.2", + "req_description": "Vérifiez que la documentation définit le nombre de sessions simultanées (parallèles) autorisées pour un compte ainsi que les comportements et actions prévus à entreprendre lorsque le nombre maximal de sessions actives est atteint.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.1", + "section_name": "Documentation sur la gestion des sessions", + "req_id": "V7.1.3", + "req_description": "Vérifiez que tous les systèmes qui créent et gèrent des sessions utilisateur dans le cadre d'un écosystème de gestion des identités fédérées (tels que les systèmes SSO) sont documentés avec des contrôles pour coordonner la durée de vie des sessions, la résiliation et toute autre condition nécessitant une réauthentification.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.2", + "section_name": "Sécurité fondamentale de la gestion des sessions", + "req_id": "V7.2.1", + "req_description": "Vérifiez que l’application effectue toutes les vérifications des jetons de session à l’aide d’un service backend de confiance.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.2", + "section_name": "Sécurité fondamentale de la gestion des sessions", + "req_id": "V7.2.2", + "req_description": "Vérifiez que l'application utilise des jetons autonomes ou de référence générés dynamiquement pour la gestion des sessions, c'est-à-dire sans utiliser de secrets et de clés d'API statiques.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.2", + "section_name": "Sécurité fondamentale de la gestion des sessions", + "req_id": "V7.2.3", + "req_description": "Vérifiez que si des jetons par référence sont utilisés pour représenter les sessions utilisateur, ils sont uniques et générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et possèdent au moins 128 bits d'entropie.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.2", + "section_name": "Sécurité fondamentale de la gestion des sessions", + "req_id": "V7.2.4", + "req_description": "Vérifiez que l’application génère un nouveau jeton de session lors de l’authentification de l’utilisateur, y compris la réauthentification, et met fin au jeton de session actuel.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.3", + "section_name": "Délai d'expiration de la session", + "req_id": "V7.3.1", + "req_description": "Vérifiez qu’il existe un délai d’inactivité tel que la réauthentification soit appliquée conformément à l’analyse des risques et aux décisions de sécurité documentées.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.3", + "section_name": "Délai d'expiration de la session", + "req_id": "V7.3.2", + "req_description": "Vérifiez qu'il existe une durée de vie maximale absolue de la session de sorte que la réauthentification soit appliquée conformément à l'analyse des risques et aux décisions de sécurité documentées.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.4", + "section_name": "Fin de session", + "req_id": "V7.4.1", + "req_description": "Vérifiez que lorsque la fin de session est déclenchée (par exemple, déconnexion ou expiration), l'application interdit toute utilisation ultérieure de la session. Pour les jetons par référence ou les sessions avec état, cela implique l'invalidation des données de session au niveau du backend de l'application. Les applications utilisant des jetons autonomes nécessiteront une solution, comme la gestion d'une liste des jetons terminés, l'interdiction des jetons produits avant une date et une heure spécifique à chaque utilisateur ou la rotation d'une clé de signature spécifique à chaque utilisateur.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.4", + "section_name": "Fin de session", + "req_id": "V7.4.2", + "req_description": "Vérifiez que l'application met fin à toutes les sessions actives lorsqu'un compte utilisateur est désactivé ou supprimé (par exemple, lorsqu'un employé quitte l'entreprise).", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.4", + "section_name": "Fin de session", + "req_id": "V7.4.3", + "req_description": "Vérifiez que l'application offre la possibilité de mettre fin à toutes les autres sessions actives après une modification ou une suppression réussie de tout facteur d'authentification (y compris la modification du mot de passe via une réinitialisation ou une récupération et, le cas échéant, une mise à jour des paramètres MFA).", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.4", + "section_name": "Fin de session", + "req_id": "V7.4.4", + "req_description": "Vérifiez que toutes les pages nécessitant une authentification disposent d’un accès facile et visible à la fonctionnalité de déconnexion.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.4", + "section_name": "Fin de session", + "req_id": "V7.4.5", + "req_description": "Vérifiez que les administrateurs d’applications sont en mesure de mettre fin aux sessions actives pour un utilisateur individuel ou pour tous les utilisateurs.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.5", + "section_name": "Défenses contre les abus de session", + "req_id": "V7.5.1", + "req_description": "Vérifiez que l'application nécessite une réauthentification complète avant d'autoriser les modifications des attributs de compte sensibles qui peuvent affecter l'authentification, tels que l'adresse e-mail, le numéro de téléphone, la configuration MFA ou d'autres informations utilisées dans la récupération de compte.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.5", + "section_name": "Défenses contre les abus de session", + "req_id": "V7.5.2", + "req_description": "Vérifiez que les utilisateurs peuvent afficher et (après s'être authentifiés à nouveau avec au moins un facteur) terminer une ou toutes les sessions actuellement actives.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.5", + "section_name": "Défenses contre les abus de session", + "req_id": "V7.5.3", + "req_description": "Vérifiez que l’application nécessite une authentification supplémentaire avec au moins un facteur ou une vérification secondaire avant d’effectuer des transactions ou des opérations hautement sensibles.", + "L": "3" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.6", + "section_name": "Réauthentification fédérée", + "req_id": "V7.6.1", + "req_description": "Vérifiez que la durée de vie et la fin de la session entre les parties de confiance (RP) et les fournisseurs d'identité (IdP) se comportent comme documenté, en exigeant une réauthentification si nécessaire, par exemple lorsque le temps maximal entre les événements d'authentification IdP est atteint.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.6", + "section_name": "Réauthentification fédérée", + "req_id": "V7.6.2", + "req_description": "Vérifiez que la création d'une session nécessite soit le consentement de l'utilisateur, soit une action explicite, empêchant ainsi la création de nouvelles sessions d'application sans interaction de l'utilisateur.", + "L": "2" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.1", + "section_name": "Documentation d'autorisation", + "req_id": "V8.1.1", + "req_description": "Vérifiez que la documentation d’autorisation définit des règles de restriction de l’accès au niveau de la fonction et aux données en fonction des autorisations du consommateur et des attributs des ressources.", + "L": "1" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.1", + "section_name": "Documentation d'autorisation", + "req_id": "V8.1.2", + "req_description": "Vérifiez que la documentation d'autorisation définit les règles de restriction d'accès au niveau des champs (lecture et écriture) en fonction des autorisations des consommateurs et des attributs des ressources. Notez que ces règles peuvent dépendre d'autres valeurs d'attributs de l'objet de données concerné, telles que l'état ou le statut.", + "L": "2" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.1", + "section_name": "Documentation d'autorisation", + "req_id": "V8.1.3", + "req_description": "Vérifiez que la documentation de l'application définit les attributs environnementaux et contextuels (y compris, mais sans s'y limiter, l'heure de la journée, l'emplacement de l'utilisateur, l'adresse IP ou l'appareil) qui sont utilisés dans l'application pour prendre des décisions de sécurité, y compris celles relatives à l'authentification et à l'autorisation.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.1", + "section_name": "Documentation d'autorisation", + "req_id": "V8.1.4", + "req_description": "Vérifier que la documentation d'authentification et d'autorisation définit l'utilisation des facteurs environnementaux et contextuels dans la prise de décision, en plus des autorisations au niveau des fonctions, des données et des champs. Cela doit inclure les attributs évalués, les seuils de risque et les actions entreprises (par exemple, autorisation, contestation, refus, renforcement de l'authentification).", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.2", + "section_name": "Conception d'autorisation générale", + "req_id": "V8.2.1", + "req_description": "Vérifiez que l’application garantit que l’accès basé sur la fonction est limité aux consommateurs disposant d’autorisations explicites.", + "L": "1" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.2", + "section_name": "Conception d'autorisation générale", + "req_id": "V8.2.2", + "req_description": "Vérifiez que l'application garantit que l'accès spécifique aux données est limité aux consommateurs disposant d'autorisations explicites sur des éléments de données spécifiques afin d'atténuer les références d'objet directes non sécurisées (IDOR) et les autorisations de niveau d'objet rompues (BOLA).", + "L": "1" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.2", + "section_name": "Conception d'autorisation générale", + "req_id": "V8.2.3", + "req_description": "Vérifiez que l'application garantit que l'accès au niveau du champ est limité aux consommateurs disposant d'autorisations explicites sur des champs spécifiques afin d'atténuer les problèmes d'autorisation au niveau de la propriété d'objet (BOPLA).", + "L": "2" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.2", + "section_name": "Conception d'autorisation générale", + "req_id": "V8.2.4", + "req_description": "Vérifiez que les contrôles de sécurité adaptatifs basés sur les attributs environnementaux et contextuels du consommateur (tels que l'heure, la localisation, l'adresse IP ou l'appareil) sont mis en œuvre pour les décisions d'authentification et d'autorisation, comme défini dans la documentation de l'application. Ces contrôles doivent être appliqués lorsque le consommateur tente de démarrer une nouvelle session et également pendant une session existante.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.3", + "section_name": "Autorisation par opération", + "req_id": "V8.3.1", + "req_description": "Vérifier que l'application applique les règles d'autorisations au niveau de la couche service de confiance et ne s’appuie pas sur des contrôles qu’un consommateur non approuvé pourrait manipuler, comme JavaScript côté client.", + "L": "1" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.3", + "section_name": "Autorisation par opération", + "req_id": "V8.3.2", + "req_description": "Vérifiez que les modifications apportées aux valeurs sur lesquelles reposent les décisions d'autorisation sont appliquées immédiatement. Lorsque les modifications ne peuvent pas être appliquées immédiatement (par exemple, en s'appuyant sur des données de jetons autonomes), des contrôles d'atténuation doivent être mis en place pour alerter un consommateur lorsqu'il effectue une action alors qu'il n'est plus autorisé à le faire et annuler la modification. Notez que cette solution alternative ne limiterait pas les fuites d'informations.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.3", + "section_name": "Autorisation par opération", + "req_id": "V8.3.3", + "req_description": "Vérifiez que l'accès à un objet repose sur les autorisations du sujet d'origine (par exemple, le consommateur), et non sur celles d'un intermédiaire ou d'un service agissant en son nom. Par exemple, si un consommateur appelle un service web à l'aide d'un jeton d'authentification autonome, et que ce service demande ensuite des données à un autre service, ce dernier utilisera le jeton du consommateur, plutôt qu'un jeton inter-machine du premier service, pour prendre les décisions d'autorisation.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.4", + "section_name": "Autres considérations relatives à l'autorisation", + "req_id": "V8.4.1", + "req_description": "Vérifiez que les applications multi-tenants utilisent des contrôles inter-tenants pour garantir que les opérations des consommateurs n'affecteront jamais les tenants avec lesquels ils ne sont pas autorisés à interagir.", + "L": "2" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.4", + "section_name": "Autres considérations relatives à l'autorisation", + "req_id": "V8.4.2", + "req_description": "Vérifiez que l'accès aux interfaces administratives intègre plusieurs couches de sécurité, notamment la vérification continue de l'identité du consommateur, l'évaluation de la posture de sécurité des appareils et l'analyse contextuelle des risques, garantissant que l'emplacement du réseau ou les endpoints approuvés ne sont pas les seuls facteurs d'autorisation, même s'ils peuvent réduire la probabilité d'accès non autorisé.", + "L": "3" + }, + { + "chapter_id": "V9", + "chapter_name": "Jetons autonomes", + "section_id": "V9.1", + "section_name": "Source et intégrité du jeton", + "req_id": "V9.1.1", + "req_description": "Vérifiez que les jetons autonomes sont validés à l'aide de leur signature numérique ou MAC pour les protéger contre toute falsification avant d'accepter le contenu du jeton.", + "L": "1" + }, + { + "chapter_id": "V9", + "chapter_name": "Jetons autonomes", + "section_id": "V9.1", + "section_name": "Source et intégrité du jeton", + "req_id": "V9.1.2", + "req_description": "Vérifiez que seuls les algorithmes d'une liste d’autorisations peuvent être utilisés pour créer et vérifier des jetons autonomes, dans un contexte donné. La liste d'autorisation doit inclure les algorithmes autorisés, idéalement symétriques ou asymétriques, et ne doit pas inclure l'algorithme « Aucun ». Si les algorithmes symétriques et asymétriques doivent être pris en charge, des contrôles supplémentaires seront nécessaires pour éviter toute confusion de clés.", + "L": "1" + }, + { + "chapter_id": "V9", + "chapter_name": "Jetons autonomes", + "section_id": "V9.1", + "section_name": "Source et intégrité du jeton", + "req_id": "V9.1.3", + "req_description": "Vérifiez que les clés utilisées pour valider les jetons autonomes proviennent de sources préconfigurées et fiables pour l'émetteur du jeton, empêchant ainsi les attaquants de spécifier des sources et des clés non fiables. Pour les JWT et autres structures JWS, les en-têtes tels que « jku », « x5u » et « jwk » doivent être validés par rapport à une liste d'autorisation de sources fiables.", + "L": "1" + }, + { + "chapter_id": "V9", + "chapter_name": "Jetons autonomes", + "section_id": "V9.2", + "section_name": "Contenu du jeton", + "req_id": "V9.2.1", + "req_description": "Vérifiez que, si une période de validité est indiquée dans les données du jeton, celui-ci et son contenu ne sont acceptés que si la date de vérification est comprise dans cette période. Par exemple, pour les JWT, les déclarations « nbf » et « exp » doivent être vérifiées.", + "L": "1" + }, + { + "chapter_id": "V9", + "chapter_name": "Jetons autonomes", + "section_id": "V9.2", + "section_name": "Contenu du jeton", + "req_id": "V9.2.2", + "req_description": "Vérifiez que le service recevant un jeton valide le type de jeton et son utilisation avant d'en accepter le contenu. Par exemple, seuls les jetons d'accès peuvent être acceptés pour les décisions d'autorisation, et seuls les jetons d'identification peuvent être utilisés pour prouver l'authentification des utilisateurs.", + "L": "2" + }, + { + "chapter_id": "V9", + "chapter_name": "Jetons autonomes", + "section_id": "V9.2", + "section_name": "Contenu du jeton", + "req_id": "V9.2.3", + "req_description": "Vérifiez que le service accepte uniquement les jetons destinés à être utilisés avec ce service (audience). Pour les JWT, cela peut être réalisé en validant la déclaration « aud » par rapport à une liste d'autorisation définie dans le service.", + "L": "2" + }, + { + "chapter_id": "V9", + "chapter_name": "Jetons autonomes", + "section_id": "V9.2", + "section_name": "Contenu du jeton", + "req_id": "V9.2.4", + "req_description": "Si un émetteur de jetons utilise la même clé privée pour émettre des jetons destinés à différentes audiences, vérifiez que les jetons émis contiennent une restriction d'audience identifiant de manière unique les audiences visées. Cela empêchera la réutilisation d'un jeton avec une audience non prévue. Si l'identifiant d'audience est provisionné dynamiquement, l'émetteur de jetons doit valider ces audiences afin de garantir qu'elles n'entraînent pas d'usurpation d'identité.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.1", + "section_name": "Sécurité générique OAuth et OIDC", + "req_id": "V10.1.1", + "req_description": "Vérifiez que les jetons sont envoyés uniquement aux composants qui en ont absolument besoin. Par exemple, lors de l'utilisation d'un modèle backend-for-frontend pour les applications JavaScript basées sur un navigateur, les jetons d'accès et d'actualisation ne doivent être accessibles qu'au backend.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.1", + "section_name": "Sécurité générique OAuth et OIDC", + "req_id": "V10.1.2", + "req_description": "Vérifiez que le client n'accepte les valeurs du serveur d'autorisation (telles que le code d'autorisation ou le jeton d'identification) que si elles résultent d'un flux d'autorisation initié par la même session d'agent utilisateur et la même transaction. Cela nécessite que les secrets générés par le client, tels que la clé de preuve pour l'échange de codes (PKCE) « code_verifier », « state » ou le nonce OIDC, ne puissent être devinés, soient spécifiques à la transaction et soient liés de manière sécurisée au client et à la session d'agent utilisateur au cours de laquelle la transaction a été initiée.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.2", + "section_name": "Client OAuth", + "req_id": "V10.2.1", + "req_description": "Vérifiez que, si le flux de code est utilisé, le client OAuth dispose d'une protection contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF), qui déclenchent des demandes de jetons, soit en utilisant la fonctionnalité de clé de preuve pour l'échange de code (PKCE), soit en vérifiant le paramètre « state » envoyé dans la demande d'autorisation.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.2", + "section_name": "Client OAuth", + "req_id": "V10.2.2", + "req_description": "Vérifiez que, si le client OAuth peut interagir avec plusieurs serveurs d'autorisation, il dispose d'une protection contre les attaques par confusion. Par exemple, il peut exiger que le serveur d'autorisation renvoie la valeur du paramètre « iss » et la valide dans la réponse d'autorisation et la réponse du jeton.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.2", + "section_name": "Client OAuth", + "req_id": "V10.2.3", + "req_description": "Vérifiez que le client OAuth demande uniquement les portées requises (ou d’autres paramètres d’autorisation) dans les requêtes adressées au serveur d’autorisation.", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.3", + "section_name": "Serveur de ressources OAuth", + "req_id": "V10.3.1", + "req_description": "Vérifiez que le serveur de ressources accepte uniquement les jetons d'accès destinés à être utilisés avec ce service (audience). L'audience peut être incluse dans un jeton d'accès structuré (comme la déclaration « aud » dans JWT) ou vérifiée à l'aide du endpoint d'introspection de jeton.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.3", + "section_name": "Serveur de ressources OAuth", + "req_id": "V10.3.2", + "req_description": "Vérifiez que le serveur de ressources applique les décisions d'autorisation en fonction des déclarations du jeton d'accès définissant l'autorisation déléguée. Si des déclarations telles que « sub », « scope » et « authorization_details » sont présentes, elles doivent être prises en compte dans la décision.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.3", + "section_name": "Serveur de ressources OAuth", + "req_id": "V10.3.3", + "req_description": "Vérifiez que si une décision de contrôle d'accès nécessite l'identification d'un utilisateur unique à partir d'un jeton d'accès (JWT ou réponse d'introspection de jeton associé), le serveur de ressources identifie l'utilisateur à partir de déclarations non ré attribuables à d'autres utilisateurs. En général, cela implique l'utilisation d'une combinaison de déclarations « iss » et « sub ».", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.3", + "section_name": "Serveur de ressources OAuth", + "req_id": "V10.3.4", + "req_description": "Si le serveur de ressources requiert une force d'authentification, des méthodes ou une date d'expiration spécifiques, vérifiez que le jeton d'accès présenté respecte ces contraintes. Par exemple, s'il est présent, utilisez les déclarations OIDC « acr », « amr » et « auth_time » respectivement.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.3", + "section_name": "Serveur de ressources OAuth", + "req_id": "V10.3.5", + "req_description": "Vérifiez que le serveur de ressources empêche l'utilisation de jetons d'accès volés ou la relecture de jetons d'accès (de parties non autorisées) en exigeant des jetons d'accès limités par l'expéditeur, soit Mutual TLS pour OAuth 2, soit OAuth 2 Demonstration of Proof of Possession (DPoP).", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.1", + "req_description": "Vérifiez que le serveur d'autorisation valide les URI de redirection en fonction d'une liste d'autorisation spécifique au client d'URI préenregistrés à l'aide d'une comparaison de chaînes exacte.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.2", + "req_description": "Vérifiez que, si le serveur d'autorisation renvoie le code d'autorisation dans la réponse, celui-ci ne peut être utilisé qu'une seule fois pour une demande de jeton. Pour la deuxième demande valide avec un code d'autorisation déjà utilisé pour émettre un jeton d'accès, le serveur d'autorisation doit rejeter la demande de jeton et révoquer tous les jetons émis liés au code d'autorisation.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.3", + "req_description": "Vérifiez que le code d'autorisation est de courte durée. La durée de vie maximale peut atteindre 10 minutes pour les applications L1 et L2 et 1 minute pour les applications L3.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.4", + "req_description": "Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement l'utilisation des autorisations nécessaires à ce client. Notez que les autorisations « token » (flux implicite) et « password » (flux d'informations d'identification du propriétaire de la ressource) ne doivent plus être utilisées.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.5", + "req_description": "Vérifiez que le serveur d'autorisation atténue les attaques par rejeu de jetons d'actualisation pour les clients publics, de préférence en utilisant des jetons d'actualisation limités par l'expéditeur, par exemple des jetons DPoP (Demonstrating Proof of Possession) ou des jetons d'accès liés à un certificat utilisant le protocole TLS mutuel (mTLS). Pour les applications L1 et L2, la rotation des jetons d'actualisation peut être utilisée. Si cette rotation est utilisée, le serveur d'autorisation doit invalider le jeton d'actualisation après utilisation et révoquer tous les jetons d'actualisation de cette autorisation si un jeton d'actualisation déjà utilisé et invalidé est fourni.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.6", + "req_description": "Vérifiez que, si l'octroi de code est utilisé, le serveur d'autorisation atténue les attaques par interception de code en exigeant une clé de preuve pour l'échange de code (PKCE). Pour les demandes d'autorisation, le serveur d'autorisation doit exiger une valeur « code_challenge » valide et ne doit pas accepter une valeur « plain » pour « code_challenge_method ». Pour une demande de jeton, il doit exiger la validation du paramètre « code_verifier ».", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.7", + "req_description": "Vérifiez que si le serveur d'autorisation prend en charge l'enregistrement dynamique des clients non authentifiés, il réduit le risque d'applications clientes malveillantes. Il doit valider les métadonnées clientes, telles que les URI enregistrés, garantir le consentement de l'utilisateur et l'avertir avant de traiter une demande d'autorisation avec une application cliente non approuvée.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.8", + "req_description": "Vérifiez que les jetons d’actualisation ont une expiration absolue, y compris si l’expiration du jeton d’actualisation glissant est appliquée.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.9", + "req_description": "Vérifiez que les jetons d'actualisation et les jetons d'accès de référence peuvent être révoqués par un utilisateur autorisé à l'aide de l'interface utilisateur du serveur d'autorisation, afin d'atténuer le risque de clients malveillants ou de jetons volés.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.10", + "req_description": "Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.11", + "req_description": "Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.12", + "req_description": "Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement la valeur « response_mode » dont ce client a besoin. Par exemple, en vérifiant cette valeur par rapport aux valeurs attendues ou en utilisant une requête d'autorisation poussée (PAR) ou une requête d'autorisation sécurisée par JWT (JAR).", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.13", + "req_description": "Vérifiez que le type d'Autorisation « code » est toujours utilisé avec les demandes d'autorisation poussées (PAR).", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.14", + "req_description": "Vérifiez que le serveur d'autorisation émet uniquement des jetons d'accès limités à l'expéditeur (preuve de possession), soit avec des jetons d'accès liés au certificat utilisant TLS mutuel (mTLS), soit avec des jetons d'accès liés au DPoP (démonstration de preuve de possession).", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.15", + "req_description": "Vérifiez que, pour un client côté serveur (non exécuté sur l'appareil de l'utilisateur final), le serveur d'autorisation garantit que la valeur du paramètre « authorization_details » provient du backend client et que l'utilisateur ne l'a pas altérée. Par exemple, en exigeant l'utilisation d'une demande d'autorisation poussée (PAR) ou d'une demande d'autorisation sécurisée par JWT (JAR).", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.16", + "req_description": "Vérifiez que le client est confidentiel et que le serveur d'autorisation requiert l'utilisation de méthodes d'authentification client fortes (basées sur la cryptographie à clé publique et résistantes aux attaques par relecture), telles que TLS mutuel ('tls_client_auth', 'self_signed_tls_client_auth') ou JWT à clé privée ('private_key_jwt').", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.5", + "section_name": "Client OIDC", + "req_id": "V10.5.1", + "req_description": "Vérifiez que le client (en tant que partie utilisatrice) atténue les attaques par rejeu de jeton d'identification. Par exemple, en vous assurant que la valeur « nonce » du jeton d'identification correspond à la valeur « nonce » envoyée dans la demande d'authentification au fournisseur OpenID (appelée demande d'autorisation envoyée au serveur d'autorisation dans OAuth2).", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.5", + "section_name": "Client OIDC", + "req_id": "V10.5.2", + "req_description": "Vérifiez que le client identifie de manière unique l'utilisateur à partir des déclarations de jeton d'identification, généralement la déclaration « sub », qui ne peut pas être réaffectée à d'autres utilisateurs (pour la portée d'un fournisseur d'identité).", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.5", + "section_name": "Client OIDC", + "req_id": "V10.5.3", + "req_description": "Vérifiez que le client rejette les tentatives d'un serveur d'autorisation malveillant d'usurper l'identité d'un autre serveur d'autorisation via ses métadonnées. Le client doit rejeter les métadonnées du serveur d'autorisation si l'URL de l'émetteur figurant dans ces métadonnées ne correspond pas exactement à l'URL d'émetteur préconfigurée attendue par le client.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.5", + "section_name": "Client OIDC", + "req_id": "V10.5.4", + "req_description": "Vérifiez que le client valide que le jeton d'identification est destiné à être utilisé pour ce client (audience) en vérifiant que la déclaration « aud » du jeton est égale à la valeur « client_id » pour le client.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.5", + "section_name": "Client OIDC", + "req_id": "V10.5.5", + "req_description": "Vérifiez que, lors de l'utilisation de la déconnexion du back-channel OIDC, la partie utilisatrice atténue les risques de déni de service liés à la déconnexion forcée et à la confusion entre JWT dans le flux de déconnexion. Le client doit vérifier que le jeton de déconnexion est correctement typé avec la valeur « logout+jwt », qu'il contient la déclaration « event » avec le nom de membre correct et qu'il ne contient pas de déclaration « nonce ». Il est également recommandé d'utiliser une expiration courte (par exemple, 2 minutes).", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.6", + "section_name": "Fournisseur OpenID", + "req_id": "V10.6.1", + "req_description": "Vérifiez que le fournisseur OpenID n'autorise que les valeurs « code », « ciba », « id_token » ou « id_token code » pour le mode de réponse. Notez que « code » est préférable à « id_token code » (flux hybride OIDC) et que « token » (tout flux implicite) ne doit pas être utilisé.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.6", + "section_name": "Fournisseur OpenID", + "req_id": "V10.6.2", + "req_description": "Vérifiez que le fournisseur OpenID atténue les risques de déni de service liés à la déconnexion forcée. Pour ce faire, obtenez une confirmation explicite de l'utilisateur final ou, le cas échéant, validez les paramètres de la requête de déconnexion (initiée par la partie utilisatrice), comme « id_token_hint ».", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.7", + "section_name": "Gestion du consentement", + "req_id": "V10.7.1", + "req_description": "Vérifiez que le serveur d'autorisation garantit le consentement de l'utilisateur à chaque demande d'autorisation. Si l'identité du client ne peut être garantie, le serveur d'autorisation doit toujours demander explicitement le consentement de l'utilisateur.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.7", + "section_name": "Gestion du consentement", + "req_id": "V10.7.2", + "req_description": "Vérifiez que lorsque le serveur d'autorisation demande le consentement de l'utilisateur, il fournit des informations claires et suffisantes sur ce qui est consenti. Le cas échéant, ces informations doivent inclure la nature des autorisations demandées (généralement en fonction de la portée, du serveur de ressources et des détails d'autorisation RAR), l'identité de l'application autorisée et la durée de vie de ces autorisations.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.7", + "section_name": "Gestion du consentement", + "req_id": "V10.7.3", + "req_description": "Vérifiez que l’utilisateur peut consulter, modifier et révoquer les consentements qu’il a accordés via le serveur d’autorisation.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.1", + "section_name": "Inventaire et documentation cryptographiques", + "req_id": "V11.1.1", + "req_description": "Vérifiez qu’il existe une politique documentée pour la gestion des clés cryptographiques et un cycle de vie des clés cryptographiques qui suit une norme de gestion des clés telle que NIST SP 800-57. Cela devrait inclure la garantie que les clés ne sont pas sur-partagées (par exemple, avec plus de deux entités pour les secrets partagés et plus d’une entité pour les clés privées).", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.1", + "section_name": "Inventaire et documentation cryptographiques", + "req_id": "V11.1.2", + "req_description": "Vérifiez qu'un inventaire cryptographique est réalisé, maintenu et régulièrement mis à jour, et qu'il inclut toutes les clés, algorithmes et certificats cryptographiques utilisés par l'application. Il doit également documenter les emplacements du système où les clés peuvent ou non être utilisées, ainsi que les types de données qui peuvent ou non être protégées par ces clés.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.1", + "section_name": "Inventaire et documentation cryptographiques", + "req_id": "V11.1.3", + "req_description": "Vérifiez que les mécanismes de découverte cryptographique sont utilisés pour identifier toutes les instances de cryptographie dans le système, y compris les opérations de chiffrement, de hachage et de signature.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.1", + "section_name": "Inventaire et documentation cryptographiques", + "req_id": "V11.1.4", + "req_description": "Vérifier la tenue d'un inventaire cryptographique. Celui-ci doit inclure un plan documenté décrivant la migration vers de nouvelles normes cryptographiques, telles que la cryptographie post-quantique, afin de réagir aux menaces futures.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.2", + "section_name": "Mise en œuvre sécurisée de la cryptographie", + "req_id": "V11.2.1", + "req_description": "Vérifiez que les implémentations validées par l’industrie (y compris les bibliothèques et les implémentations accélérées par le matériel) sont utilisées pour les opérations cryptographiques.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.2", + "section_name": "Mise en œuvre sécurisée de la cryptographie", + "req_id": "V11.2.2", + "req_description": "Vérifiez que l'application est conçue avec une agilité cryptographique, de sorte que les nombres aléatoires, le chiffrement authentifié, le MAC ou les algorithmes de hachage, les longueurs de clés, les tours, les chiffrements et les modes puissent être reconfigurés, mis à niveau ou échangés à tout moment, afin de se protéger contre les failles cryptographiques. De même, il doit être possible de remplacer les clés et les mots de passe, ainsi que de rechiffrer les données. Cela permettra des mises à niveau transparentes vers la cryptographie post-quantique (PQC), une fois que des implémentations hautement sécurisées de schémas ou de normes PQC approuvés seront largement disponibles.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.2", + "section_name": "Mise en œuvre sécurisée de la cryptographie", + "req_id": "V11.2.3", + "req_description": "Vérifiez que toutes les primitives cryptographiques utilisent un minimum de 128 bits de sécurité en fonction de l'algorithme, de la taille de la clé et de la configuration. Par exemple, une clé ECC de 256 bits offre environ 128 bits de sécurité, tandis que RSA nécessite une clé de 3072 bits pour atteindre 128 bits de sécurité.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.2", + "section_name": "Mise en œuvre sécurisée de la cryptographie", + "req_id": "V11.2.4", + "req_description": "Vérifiez que toutes les opérations cryptographiques sont à temps constant, sans opérations de « court-circuit » dans les comparaisons, les calculs ou les retours, pour éviter toute fuite d'informations.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.2", + "section_name": "Mise en œuvre sécurisée de la cryptographie", + "req_id": "V11.2.5", + "req_description": "Vérifiez que tous les modules cryptographiques échouent en toute sécurité et que les erreurs sont gérées de manière à ne pas permettre de vulnérabilités, telles que les attaques Padding Oracle.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.3", + "section_name": "Algorithmes de chiffrement", + "req_id": "V11.3.1", + "req_description": "Vérifiez que les modes de bloc non sécurisés (par exemple, ECB) et les schémas de remplissage faibles (par exemple, PKCS#1 v1.5) ne sont pas utilisés.", + "L": "1" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.3", + "section_name": "Algorithmes de chiffrement", + "req_id": "V11.3.2", + "req_description": "Vérifiez que seuls les chiffrements et modes approuvés tels que AES avec GCM sont utilisés.", + "L": "1" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.3", + "section_name": "Algorithmes de chiffrement", + "req_id": "V11.3.3", + "req_description": "Vérifiez que les données chiffrées sont protégées contre toute modification non autorisée, de préférence en utilisant une méthode de chiffrement authentifiée approuvée ou en combinant une méthode de chiffrement approuvée avec un algorithme MAC approuvé.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.3", + "section_name": "Algorithmes de chiffrement", + "req_id": "V11.3.4", + "req_description": "Vérifiez que les nonces, les vecteurs d'initialisation et autres nombres à usage unique ne sont pas utilisés pour plus d'une paire clé de chiffrement/élément de données. La méthode de génération doit être adaptée à l'algorithme utilisé.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.3", + "section_name": "Algorithmes de chiffrement", + "req_id": "V11.3.5", + "req_description": "Vérifiez que toute combinaison d'un algorithme de chiffrement et d'un algorithme MAC fonctionne en mode chiffrement puis MAC.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.4", + "section_name": "Hachage et fonctions basées sur le hachage", + "req_id": "V11.4.1", + "req_description": "Vérifiez que seules les fonctions de hachage approuvées sont utilisées pour les cas d'utilisation cryptographiques généraux, notamment les signatures numériques, HMAC, KDF et la génération de bits aléatoires. Les fonctions de hachage non autorisées, telles que MD5, ne doivent pas être utilisées à des fins cryptographiques.", + "L": "1" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.4", + "section_name": "Hachage et fonctions basées sur le hachage", + "req_id": "V11.4.2", + "req_description": "Vérifiez que les mots de passe sont stockés à l'aide d'une fonction de dérivation de clés approuvée et gourmande en ressources de calcul (également appelée « fonction de hachage de mots de passe »), dont les paramètres sont configurés conformément aux directives en vigueur. Ces paramètres doivent équilibrer sécurité et performances afin de rendre les attaques par force brute suffisamment difficiles pour le niveau de sécurité requis.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.4", + "section_name": "Hachage et fonctions basées sur le hachage", + "req_id": "V11.4.3", + "req_description": "Vérifiez que les fonctions de hachage utilisées dans les signatures numériques, dans le cadre de l'authentification ou de l'intégrité des données, sont résistantes aux collisions et possèdent des longueurs de bits appropriées. Si la résistance aux collisions est requise, la longueur de sortie doit être d'au moins 256 bits. Si seule la résistance aux attaques de seconde pré-image est requise, la longueur de sortie doit être d'au moins 128 bits.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.4", + "section_name": "Hachage et fonctions basées sur le hachage", + "req_id": "V11.4.4", + "req_description": "Vérifiez que l'application utilise des fonctions de dérivation de clés approuvées avec des paramètres d'extension de clés lors de la dérivation de clés secrètes à partir de mots de passe. Les paramètres utilisés doivent concilier sécurité et performances afin d'empêcher les attaques par force brute de compromettre la clé cryptographique obtenue.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.5", + "section_name": "Valeurs aléatoires", + "req_id": "V11.5.1", + "req_description": "Vérifiez que tous les nombres et chaînes aléatoires destinés à être non devinables doivent être générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et posséder au moins 128 bits d'entropie. Notez que les UUID ne respectent pas cette condition.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.5", + "section_name": "Valeurs aléatoires", + "req_id": "V11.5.2", + "req_description": "Vérifiez que le mécanisme de génération de nombres aléatoires utilisé est conçu pour fonctionner en toute sécurité, même en cas de forte demande.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.6", + "section_name": "Cryptographie à clé publique", + "req_id": "V11.6.1", + "req_description": "Vérifier que seuls des algorithmes cryptographiques et des modes opératoires approuvés sont utilisés pour la génération et l'amorçage des clés, ainsi que pour la génération et la vérification des signatures numériques. Les algorithmes de génération de clés ne doivent pas générer de clés non sécurisées et vulnérables aux attaques connues, par exemple les clés RSA vulnérables à la factorisation de Fermat.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.6", + "section_name": "Cryptographie à clé publique", + "req_id": "V11.6.2", + "req_description": "Vérifiez que des algorithmes cryptographiques approuvés sont utilisés pour l'échange de clés (tels que Diffie-Hellman), en veillant à ce que les mécanismes d'échange de clés utilisent des paramètres sécurisés. Cela permettra d'éviter les attaques contre le processus d'établissement des clés, susceptibles de conduire à des attaques de type « adversaire du milieu » ou à des failles cryptographiques.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.7", + "section_name": "Cryptographie des données en cours d'utilisation", + "req_id": "V11.7.1", + "req_description": "Vérifiez que le chiffrement complet de la mémoire est utilisé pour protéger les données sensibles pendant leur utilisation, empêchant ainsi l'accès par des utilisateurs ou des processus non autorisés.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.7", + "section_name": "Cryptographie des données en cours d'utilisation", + "req_id": "V11.7.2", + "req_description": "Vérifiez que la minimisation des données garantit que la quantité minimale de données est exposée pendant le traitement et assurez-vous que les données sont chiffrées immédiatement après utilisation ou dès que possible.", + "L": "3" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.1", + "section_name": "Conseils généraux de sécurité TLS", + "req_id": "V12.1.1", + "req_description": "Vérifiez que seules les dernières versions recommandées du protocole TLS sont activées, telles que TLS 1.2 et TLS 1.3. La dernière version du protocole TLS doit être privilégiée.", + "L": "1" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.1", + "section_name": "Conseils généraux de sécurité TLS", + "req_id": "V12.1.2", + "req_description": "Vérifiez que seules les suites de chiffrement recommandées sont activées, les suites de chiffrement les plus puissantes étant définies comme préférées. Les applications L3 doivent uniquement prendre en charge les suites de chiffrement assurant la confidentialité persistante (forward secrecy).", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.1", + "section_name": "Conseils généraux de sécurité TLS", + "req_id": "V12.1.3", + "req_description": "Vérifiez que l’application valide que les certificats clients mTLS sont approuvés avant d’utiliser l’identité du certificat pour l’authentification ou l’autorisation.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.1", + "section_name": "Conseils généraux de sécurité TLS", + "req_id": "V12.1.4", + "req_description": "Vérifiez que la révocation de certification appropriée, telle que l'agrafage du protocole OCSP (Online Certificate Status Protocol), est activée et configurée.", + "L": "3" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.1", + "section_name": "Conseils généraux de sécurité TLS", + "req_id": "V12.1.5", + "req_description": "Vérifiez que Encrypted Client Hello (ECH) est activé dans les paramètres TLS de l'application pour empêcher l'exposition de métadonnées sensibles, telles que l'indication du nom du serveur (SNI), pendant les processus de négociation TLS.", + "L": "3" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.2", + "section_name": "Communication HTTPS avec des services externes", + "req_id": "V12.2.1", + "req_description": "Vérifiez que TLS est utilisé pour toute connectivité entre un client et des services externes basés sur HTTP, et ne recourt pas à des communications non sécurisées ou non chiffrées.", + "L": "1" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.2", + "section_name": "Communication HTTPS avec des services externes", + "req_id": "V12.2.2", + "req_description": "Vérifiez que les services externes utilisent des certificats TLS publiquement approuvés.", + "L": "1" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.3", + "section_name": "Sécurité des communications entre services généraux", + "req_id": "V12.3.1", + "req_description": "Vérifiez qu'un protocole chiffré tel que TLS est utilisé pour toutes les connexions entrantes et sortantes vers et depuis l'application, y compris les systèmes de surveillance, les outils de gestion, l'accès à distance et SSH, les intergiciels, les bases de données, les mainframes, les systèmes partenaires ou les API externes. Le serveur ne doit pas recourir à des protocoles non sécurisés ou non chiffrés.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.3", + "section_name": "Sécurité des communications entre services généraux", + "req_id": "V12.3.2", + "req_description": "Vérifiez que les clients TLS valident les certificats reçus avant de communiquer avec un serveur TLS.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.3", + "section_name": "Sécurité des communications entre services généraux", + "req_id": "V12.3.3", + "req_description": "Vérifiez que TLS ou un autre mécanisme de chiffrement de transport approprié est utilisé pour toute connectivité entre les services internes basés sur HTTP au sein de l'application et ne se replie pas vers des communications non sécurisées ou non chiffrées.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.3", + "section_name": "Sécurité des communications entre services généraux", + "req_id": "V12.3.4", + "req_description": "Vérifiez que les connexions TLS entre les services internes utilisent des certificats de confiance. Lorsque des certificats générés en interne ou auto-signés sont utilisés, le service consommateur doit être configuré pour n'approuver que des autorités de certification internes spécifiques et des certificats auto-signés spécifiques.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.3", + "section_name": "Sécurité des communications entre services généraux", + "req_id": "V12.3.5", + "req_description": "Vérifiez que les services communiquant en interne au sein d'un système (communications intra-services) utilisent une authentification forte pour garantir la vérification de chaque endpoint. Des méthodes d'authentification forte, telles que l'authentification client TLS, doivent être utilisées pour garantir l'identité, en utilisant une infrastructure à clé publique et des mécanismes résistants aux attaques par rejeu. Pour les architectures de microservices, envisagez d'utiliser un maillage de services pour simplifier la gestion des certificats et renforcer la sécurité.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.1", + "section_name": "Documentation de configuration", + "req_id": "V13.1.1", + "req_description": "Vérifiez que tous les besoins de communication de l'application sont documentés. Cela doit inclure les services externes dont l'application dépend et les cas où un utilisateur final pourrait fournir un emplacement externe auquel l'application se connectera.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.1", + "section_name": "Documentation de configuration", + "req_id": "V13.1.2", + "req_description": "Vérifiez que pour chaque service utilisé par l'application, la documentation définit le nombre maximal de connexions simultanées (par exemple, les limites du pool de connexions) et le comportement de l'application lorsque cette limite est atteinte, y compris les mécanismes de secours ou de récupération, pour éviter les conditions de déni de service.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.1", + "section_name": "Documentation de configuration", + "req_id": "V13.1.3", + "req_description": "Vérifiez que la documentation de l'application définit des stratégies de gestion des ressources pour chaque système ou service externe utilisé (par exemple, bases de données, descripteurs de fichiers, threads, connexions HTTP). Cela doit inclure les procédures de libération des ressources, les paramètres de délai d'expiration, la gestion des échecs et l'implémentation de la logique de nouvelle tentative, en spécifiant les limites de nouvelle tentative, les délais et les algorithmes de retour arrière. Pour les opérations de requête-réponse HTTP synchrones, la documentation doit imposer des délais d'expiration courts et soit désactiver les nouvelles tentatives, soit les limiter strictement afin d'éviter les retards en cascade et l'épuisement des ressources.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.1", + "section_name": "Documentation de configuration", + "req_id": "V13.1.4", + "req_description": "Vérifiez que la documentation de l'application définit les secrets essentiels à la sécurité de l'application et un calendrier de rotation de ceux-ci, en fonction du modèle de menace et des exigences commerciales de l'organisation.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Configuration de la communication backend", + "req_id": "V13.2.1", + "req_description": "Vérifiez que les communications entre les composants de l'application backend qui ne prennent pas en charge le mécanisme de session utilisateur standard de l'application, notamment les API, les intergiciels et les couches de données, sont authentifiées. L'authentification doit utiliser des comptes de service individuels, des jetons à court terme ou une authentification par certificat, et non des identifiants immuables tels que des mots de passe, des clés API ou des comptes partagés avec accès privilégié.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Configuration de la communication backend", + "req_id": "V13.2.2", + "req_description": "Vérifiez que les communications entre les composants de l'application backend, y compris les services locaux ou du système d'exploitation, les API, les intergiciels et les couches de données, sont effectuées avec des comptes dotés des privilèges les moins nécessaires.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Configuration de la communication backend", + "req_id": "V13.2.3", + "req_description": "Vérifiez que si des informations d’identification doivent être utilisées pour l’authentification du service, les informations d’identification utilisées par le consommateur ne sont pas des informations d’identification par défaut (par exemple, root/root ou admin/admin).", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Configuration de la communication backend", + "req_id": "V13.2.4", + "req_description": "Vérifiez qu'une liste d’autorisations est utilisée pour définir les ressources ou systèmes externes avec lesquels l'application est autorisée à communiquer (par exemple, pour les requêtes sortantes, les chargements de données ou l'accès aux fichiers). Cette liste d'autorisation peut être implémentée au niveau de la couche applicative, du serveur web, du pare-feu ou d'une combinaison de différentes couches.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Configuration de la communication backend", + "req_id": "V13.2.5", + "req_description": "Vérifiez que le serveur Web ou d’application est configuré avec une liste autorisée de ressources ou de systèmes vers lesquels le serveur peut envoyer des requêtes ou charger des données ou des fichiers.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Configuration de la communication backend", + "req_id": "V13.2.6", + "req_description": "Vérifiez que lorsque l'application se connecte à des services distincts, elle suit la configuration documentée pour chaque connexion, comme le nombre maximal de connexions parallèles, le comportement lorsque le nombre maximal de connexions autorisées est atteint, les délais d'expiration de connexion et les stratégies de nouvelle tentative.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.3", + "section_name": "Gestion des secrets", + "req_id": "V13.3.1", + "req_description": "Vérifiez qu'une solution de gestion des secrets, telle qu'un coffre-fort de clés, est utilisée pour créer, stocker, contrôler l'accès et détruire en toute sécurité les secrets backend. Ceux-ci peuvent inclure des mots de passe, du matériel de clé, des intégrations avec des bases de données et des systèmes tiers, des clés et des graines pour des jetons temporels, d'autres secrets internes et des clés API. Les secrets ne doivent pas être inclus dans le code source de l'application ni dans les artefacts de build. Pour une application L3, cela doit impliquer une solution matérielle telle qu'un HSM.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.3", + "section_name": "Gestion des secrets", + "req_id": "V13.3.2", + "req_description": "Vérifiez que l’accès aux ressources secrètes respecte le principe du moindre privilège.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.3", + "section_name": "Gestion des secrets", + "req_id": "V13.3.3", + "req_description": "Vérifiez que toutes les opérations cryptographiques sont effectuées à l'aide d'un module de sécurité isolé (tel qu'un coffre-fort ou un module de sécurité matériel) pour gérer et protéger en toute sécurité le matériel clé contre toute exposition en dehors du module de sécurité.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.3", + "section_name": "Gestion des secrets", + "req_id": "V13.3.4", + "req_description": "Vérifiez que les secrets sont configurés pour expirer et être renouvelés en fonction de la documentation de l'application.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Fuite d'informations involontaire", + "req_id": "V13.4.1", + "req_description": "Vérifiez que l'application est déployée soit sans aucune métadonnée de contrôle de source, y compris les dossiers .git ou .svn, soit de manière à ce que ces dossiers soient inaccessibles à la fois en externe et à l'application elle-même.", + "L": "1" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Fuite d'informations involontaire", + "req_id": "V13.4.2", + "req_description": "Vérifiez que les modes de débogage sont désactivés pour tous les composants dans les environnements de production afin d’éviter l’exposition des fonctionnalités de débogage et la fuite d’informations.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Fuite d'informations involontaire", + "req_id": "V13.4.3", + "req_description": "Vérifiez que les serveurs Web n’exposent pas les listes de répertoires aux clients, sauf si cela est explicitement prévu.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Fuite d'informations involontaire", + "req_id": "V13.4.4", + "req_description": "Vérifiez que l’utilisation de la méthode HTTP TRACE n’est pas prise en charge dans les environnements de production, afin d’éviter toute fuite d’informations potentielle.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Fuite d'informations involontaire", + "req_id": "V13.4.5", + "req_description": "Vérifiez que la documentation (comme pour les API internes) et les endpoints de surveillance ne sont pas exposés, sauf si cela est explicitement prévu.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Fuite d'informations involontaire", + "req_id": "V13.4.6", + "req_description": "Vérifiez que l’application n’expose pas d’informations de version détaillées des composants backend.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Fuite d'informations involontaire", + "req_id": "V13.4.7", + "req_description": "Vérifiez que la couche web est configuré pour servir uniquement les fichiers avec des extensions de fichier spécifiques afin d’éviter toute fuite involontaire d’informations, de configuration et de code source.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.1", + "section_name": "Documentation sur la protection des données", + "req_id": "V14.1.1", + "req_description": "Vérifiez que toutes les données sensibles créées et traitées par l'application ont été identifiées et classées selon leur niveau de protection. Cela inclut les données uniquement codées et donc facilement déchiffrables, telles que les chaînes Base64 ou la charge utile en texte clair d'un JWT. Les niveaux de protection doivent tenir compte des réglementations et normes de protection des données et de confidentialité auxquelles l'application est tenue de se conformer.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.1", + "section_name": "Documentation sur la protection des données", + "req_id": "V14.1.2", + "req_description": "Vérifier que tous les niveaux de protection des données sensibles sont assortis d'un ensemble documenté d'exigences de protection. Cela doit inclure (sans s'y limiter) les exigences relatives au chiffrement général, à la vérification de l'intégrité, à la conservation, à la journalisation des données, aux contrôles d'accès aux données sensibles dans les journaux, au chiffrement au niveau de la base de données, aux technologies de confidentialité et de renforcement de la confidentialité à utiliser, ainsi qu'aux autres exigences de confidentialité.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.2", + "section_name": "Protection générale des données", + "req_id": "V14.2.1", + "req_description": "Vérifiez que les données sensibles sont uniquement envoyées au serveur dans les champs de corps ou d’en-tête du message HTTP, et que l’URL et la chaîne de requête ne contiennent pas d’informations sensibles, telles qu’une clé API ou un jeton de session.", + "L": "1" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.2", + "section_name": "Protection générale des données", + "req_id": "V14.2.2", + "req_description": "Vérifiez que l’application empêche la mise en cache des données sensibles dans les composants du serveur, tels que les équilibreurs de charge et les caches d’application, ou garantit que les données sont purgées en toute sécurité après utilisation.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.2", + "section_name": "Protection générale des données", + "req_id": "V14.2.3", + "req_description": "Vérifiez que les données sensibles définies ne sont pas envoyées à des parties non fiables (par exemple, des trackers d'utilisateurs) pour empêcher la collecte indésirable de données en dehors du contrôle de l'application.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.2", + "section_name": "Protection générale des données", + "req_id": "V14.2.4", + "req_description": "Vérifiez que les contrôles autour des données sensibles liés au chiffrement, à la vérification de l'intégrité, à la conservation, à la manière dont les données doivent être enregistrées, aux contrôles d'accès autour des données sensibles dans les journaux, à la confidentialité et aux technologies d'amélioration de la confidentialité, sont mis en œuvre comme défini dans la documentation pour le niveau de protection des données spécifiques.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.2", + "section_name": "Protection générale des données", + "req_id": "V14.2.5", + "req_description": "Vérifiez que les mécanismes de mise en cache sont configurés pour ne mettre en cache que les réponses dont le type de contenu est conforme à la ressource et qui ne contiennent pas de contenu sensible et dynamique. Le serveur web doit renvoyer une réponse 404 ou 302 lors de l'accès à un fichier inexistant plutôt qu'un fichier valide différent. Cela devrait empêcher les attaques par empoisonnement de cache web.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.2", + "section_name": "Protection générale des données", + "req_id": "V14.2.6", + "req_description": "Vérifiez que l'application ne renvoie que les données sensibles minimales requises pour son fonctionnement. Par exemple, ne renvoyez que certains chiffres d'un numéro de carte de crédit, et non le numéro complet. Si les données complètes sont requises, elles doivent être masquées dans l'interface utilisateur, sauf si l'utilisateur les consulte spécifiquement.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.2", + "section_name": "Protection générale des données", + "req_id": "V14.2.7", + "req_description": "Vérifiez que les informations sensibles sont soumises à une classification de conservation des données, en veillant à ce que les données obsolètes ou inutiles soient supprimées automatiquement, selon un calendrier défini ou selon les besoins de la situation.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.2", + "section_name": "Protection générale des données", + "req_id": "V14.2.8", + "req_description": "Vérifiez que les informations sensibles sont supprimées des métadonnées des fichiers soumis par l'utilisateur, sauf si le stockage est autorisé par l'utilisateur.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.3", + "section_name": "Protection des données côté client", + "req_id": "V14.3.1", + "req_description": "Vérifiez que les données authentifiées sont effacées du stockage client, comme le DOM du navigateur, après la fin du client ou de la session. Le champ d'en-tête de réponse HTTP « Clear-Site-Data » peut être utile, mais le côté client devrait également pouvoir effectuer la correction si la connexion au serveur n'est pas disponible à la fin de la session.", + "L": "1" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.3", + "section_name": "Protection des données côté client", + "req_id": "V14.3.2", + "req_description": "Vérifiez que l'application définit suffisamment de champs d'en-tête de réponse HTTP anti-caching (c'est-à-dire Cache-Control : no-store) afin que les données sensibles ne soient pas mises en cache dans les navigateurs.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.3", + "section_name": "Protection des données côté client", + "req_id": "V14.3.3", + "req_description": "Vérifiez que les données stockées dans le stockage du navigateur (telles que localStorage, sessionStorage, IndexedDB ou les cookies) ne contiennent pas de données sensibles, à l'exception des jetons de session.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.1", + "section_name": "Documentation sur le développement et l'architecture sécurisés", + "req_id": "V15.1.1", + "req_description": "Vérifiez que la documentation de l'application définit les délais de correction basés sur les risques pour les versions de composants tiers présentant des vulnérabilités et pour la mise à jour des bibliothèques en général, afin de minimiser les risques liés à ces composants.", + "L": "1" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.1", + "section_name": "Documentation sur le développement et l'architecture sécurisés", + "req_id": "V15.1.2", + "req_description": "Vérifiez qu'un catalogue d'inventaire, tel qu'une nomenclature logicielle (SBOM), est conservé pour toutes les bibliothèques tierces utilisées, y compris en vérifiant que les composants proviennent de référentiels prédéfinis, fiables et continuellement maintenus.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.1", + "section_name": "Documentation sur le développement et l'architecture sécurisés", + "req_id": "V15.1.3", + "req_description": "Vérifiez que la documentation de l'application identifie les fonctionnalités consommatrices en temps ou gourmandes en ressources. Elle doit notamment indiquer comment prévenir une perte de disponibilité due à une utilisation excessive de ces fonctionnalités et éviter que la génération d'une réponse ne prenne plus de temps que le délai d'expiration du consommateur. Les mesures de protection potentielles peuvent inclure le traitement asynchrone, l'utilisation de files d'attente et la limitation des processus parallèles par utilisateur et par application.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.1", + "section_name": "Documentation sur le développement et l'architecture sécurisés", + "req_id": "V15.1.4", + "req_description": "Vérifiez que la documentation de l’application met en évidence les bibliothèques tierces qui sont considérées comme des « composants à risque ».", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.1", + "section_name": "Documentation sur le développement et l'architecture sécurisés", + "req_id": "V15.1.5", + "req_description": "Vérifiez que la documentation de l’application met en évidence les parties de l’application où des « fonctionnalités dangereuses » sont utilisées.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.2", + "section_name": "Architecture de sécurité et dépendances", + "req_id": "V15.2.1", + "req_description": "Vérifiez que l’application contient uniquement des composants qui n’ont pas dépassé les délais de mise à jour et de correction documentés.", + "L": "1" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.2", + "section_name": "Architecture de sécurité et dépendances", + "req_id": "V15.2.2", + "req_description": "Vérifiez que l'application a mis en œuvre des défenses contre la perte de disponibilité due à des fonctionnalités qui prennent du temps ou qui nécessitent des ressources, sur la base des décisions et stratégies de sécurité documentées à cet effet.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.2", + "section_name": "Architecture de sécurité et dépendances", + "req_id": "V15.2.3", + "req_description": "Vérifiez que l'environnement de production inclut uniquement les fonctionnalités nécessaires au fonctionnement de l'application et n'expose pas de fonctionnalités superflues telles que du code de test, des exemples d'extraits et des fonctionnalités de développement.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.2", + "section_name": "Architecture de sécurité et dépendances", + "req_id": "V15.2.4", + "req_description": "Vérifiez que les composants tiers et toutes leurs dépendances transitives sont inclus à partir du référentiel attendu, qu'il soit détenu en interne ou qu'il s'agisse d'une source externe, et qu'il n'y a aucun risque d'attaque par confusion de dépendances.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.2", + "section_name": "Architecture de sécurité et dépendances", + "req_id": "V15.2.5", + "req_description": "Vérifiez que l'application implémente des protections supplémentaires autour des parties documentées comme contenant des « fonctionnalités dangereuses » ou utilisant des bibliothèques tierces considérées comme des « composants à risque ». Cela peut inclure des techniques telles que le sandboxing, l'encapsulation, la conteneurisation ou l'isolation au niveau du réseau pour retarder et dissuader les attaquants qui compromettent une partie de l'application de se propager ailleurs.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.3", + "section_name": "Développement défensif", + "req_id": "V15.3.1", + "req_description": "Vérifiez que l'application ne renvoie que le sous-ensemble requis de champs d'un objet de données. Par exemple, elle ne doit pas renvoyer un objet de données entier, car certains champs individuels ne doivent pas être accessibles aux utilisateurs.", + "L": "1" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.3", + "section_name": "Développement défensif", + "req_id": "V15.3.2", + "req_description": "Vérifiez que lorsque le backend de l'application effectue des appels vers des URL externes, il est configuré pour ne pas suivre les redirections, sauf s'il s'agit d'une fonctionnalité prévue.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.3", + "section_name": "Développement défensif", + "req_id": "V15.3.3", + "req_description": "Vérifiez que l'application dispose de contre-mesures pour se protéger contre les attaques d'affectation de masse en limitant les champs autorisés par contrôleur et action, par exemple, il n'est pas possible d'insérer ou de mettre à jour une valeur de champ lorsqu'elle n'était pas destinée à faire partie de cette action.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.3", + "section_name": "Développement défensif", + "req_id": "V15.3.4", + "req_description": "Vérifiez que tous les composants proxy et middleware transfèrent correctement l'adresse IP d'origine de l'utilisateur à l'aide de champs de données fiables qui ne peuvent pas être manipulés par l'utilisateur final, et que l'application et le serveur Web utilisent cette valeur correcte pour la journalisation et les décisions de sécurité telles que la limitation du débit, en tenant compte du fait que même l'adresse IP d'origine peut ne pas être fiable en raison d'adresses IP dynamiques, de VPN ou de pare-feu d'entreprise.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.3", + "section_name": "Développement défensif", + "req_id": "V15.3.5", + "req_description": "Vérifiez que l'application garantit explicitement que les variables sont du type correct et effectue des opérations d'égalité et de comparaison strictes. Cela permet d'éviter les vulnérabilités liées à la confusion de types, causées par des hypothèses du code de l'application sur le type d'une variable.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.3", + "section_name": "Développement défensif", + "req_id": "V15.3.6", + "req_description": "Vérifiez que le code JavaScript est écrit de manière à éviter la pollution du prototype, par exemple en utilisant Set() ou Map() au lieu de littéraux d'objet.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.3", + "section_name": "Développement défensif", + "req_id": "V15.3.7", + "req_description": "Vérifiez que l'application dispose de défenses contre les attaques de pollution des paramètres HTTP, en particulier si le Framework d'application ne fait aucune distinction quant à la source des paramètres de requête (chaîne de requête, paramètres de corps, cookies ou champs d'en-tête).", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.4", + "section_name": "Concurrence sécurisée", + "req_id": "V15.4.1", + "req_description": "Vérifiez que les objets partagés dans le code multithread (tels que les caches, les fichiers ou les objets en mémoire accessibles par plusieurs threads) sont accessibles en toute sécurité à l'aide de types thread-safe et de mécanismes de synchronisation tels que des verrous ou des sémaphores pour éviter les conditions de concurrence et la corruption des données.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.4", + "section_name": "Concurrence sécurisée", + "req_id": "V15.4.2", + "req_description": "Vérifiez que les vérifications de l'état d'une ressource, comme son existence ou ses autorisations, et des actions qui en dépendent, sont effectuées en une seule opération atomique afin d'éviter les situations de concurrence entre le moment de la vérification et le moment de l'utilisation (TOCTOU). Par exemple, vérifier l'existence d'un fichier avant de l'ouvrir ou l'accès d'un utilisateur avant de l'accorder.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.4", + "section_name": "Concurrence sécurisée", + "req_id": "V15.4.3", + "req_description": "Vérifiez que les verrous sont utilisés de manière cohérente pour éviter que les threads ne se bloquent, que ce soit en s'attendant les uns les autres ou en réessayant sans fin, et que la logique de verrouillage reste dans le code responsable de la gestion de la ressource pour garantir que les verrous ne peuvent pas être modifiés par inadvertance ou de manière malveillante par des classes ou du code externes.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.4", + "section_name": "Concurrence sécurisée", + "req_id": "V15.4.4", + "req_description": "Vérifiez que les politiques d'allocation des ressources empêchent la saturation de threads en garantissant un accès équitable aux ressources, par exemple en exploitant les pools de threads, permettant aux threads de priorité inférieure de continuer dans un délai raisonnable.", + "L": "3" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.1", + "section_name": "Documentation sur la journalisation de sécurité", + "req_id": "V16.1.1", + "req_description": "Vérifiez qu'il existe un inventaire documentant la journalisation effectuée à chaque couche de la pile technologique de l'application, les événements enregistrés, les formats de journal, l'endroit où cette journalisation est stockée, la manière dont elle est utilisée, la manière dont l'accès à celle-ci est contrôlé et la durée de conservation des journaux.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.2", + "section_name": "Journalisation générale", + "req_id": "V16.2.1", + "req_description": "Vérifiez que chaque entrée de journal inclut les métadonnées nécessaires (telles que quand, où, qui, quoi) qui permettraient une enquête détaillée sur la chronologie lorsqu'un événement se produit.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.2", + "section_name": "Journalisation générale", + "req_id": "V16.2.2", + "req_description": "Vérifiez que les sources de temps de tous les composants de journalisation sont synchronisées et que les horodatages des métadonnées des événements de sécurité utilisent le temps UTC ou incluent un décalage horaire explicite. L'UTC est recommandé pour garantir la cohérence entre les systèmes distribués et éviter toute confusion lors du passage à l'heure d'été.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.2", + "section_name": "Journalisation générale", + "req_id": "V16.2.3", + "req_description": "Vérifiez que l’application stocke ou diffuse uniquement les journaux vers les fichiers et services documentés dans l’inventaire des journaux.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.2", + "section_name": "Journalisation générale", + "req_id": "V16.2.4", + "req_description": "Vérifiez que les journaux peuvent être lus et corrélés par le processeur de journaux utilisé, de préférence en utilisant un format de journalisation commun.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.2", + "section_name": "Journalisation générale", + "req_id": "V16.2.5", + "req_description": "Vérifiez que l'application applique la journalisation en fonction du niveau de protection des données lors de la journalisation de données sensibles. Par exemple, certaines données, comme les identifiants ou les informations de paiement, peuvent être interdites. D'autres données, comme les jetons de session, ne peuvent être enregistrées que par hachage ou masquage, en totalité ou en partie.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.3", + "section_name": "Événements de sécurité", + "req_id": "V16.3.1", + "req_description": "Vérifiez que toutes les opérations d'authentification sont enregistrées, y compris les tentatives réussies et infructueuses. Des métadonnées supplémentaires, telles que le type d'authentification ou les facteurs utilisés, doivent également être collectées.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.3", + "section_name": "Événements de sécurité", + "req_id": "V16.3.2", + "req_description": "Vérifier que les tentatives d'autorisation infructueuses sont logguées. Pour le niveau 3, cela doit inclure la journalisation de toutes les décisions d'autorisation, y compris lors de l'accès à des données sensibles (sans journalisation des données sensibles elles-mêmes).", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.3", + "section_name": "Événements de sécurité", + "req_id": "V16.3.3", + "req_description": "Vérifiez que l'application enregistre les événements de sécurité définis dans la documentation et enregistre également les tentatives de contournement des contrôles de sécurité, tels que la validation des entrées, la logique métier et l'anti-automatisation.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.3", + "section_name": "Événements de sécurité", + "req_id": "V16.3.4", + "req_description": "Vérifiez que l’application enregistre les erreurs inattendues et les échecs de contrôle de sécurité tels que les échecs TLS du backend.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.4", + "section_name": "Protection des journaux", + "req_id": "V16.4.1", + "req_description": "Vérifiez que tous les composants de journalisation codent correctement les données pour empêcher l’injection de journaux.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.4", + "section_name": "Protection des journaux", + "req_id": "V16.4.2", + "req_description": "Vérifiez que les journaux sont protégés contre tout accès non autorisé et ne peuvent pas être modifiés.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.4", + "section_name": "Protection des journaux", + "req_id": "V16.4.3", + "req_description": "Vérifiez que les journaux sont transmis de manière sécurisée à un système logique distinct pour analyse, détection, alerte et remontée des informations. L'objectif est de garantir qu'en cas de violation de l'application, les journaux ne seront pas compromis.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.5", + "section_name": "Gestion des erreurs", + "req_id": "V16.5.1", + "req_description": "Vérifiez qu'un message générique est renvoyé au consommateur lorsqu'une erreur inattendue ou sensible à la sécurité se produit, garantissant ainsi l'absence d'exposition de données système internes sensibles telles que les traces de pile, les requêtes, les clés secrètes et les jetons.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.5", + "section_name": "Gestion des erreurs", + "req_id": "V16.5.2", + "req_description": "Vérifiez que l'application continue de fonctionner en toute sécurité lorsque l'accès aux ressources externes échoue, par exemple, en utilisant des modèles tels que des disjoncteurs ou une dégradation progressive.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.5", + "section_name": "Gestion des erreurs", + "req_id": "V16.5.3", + "req_description": "Vérifiez que l'application échoue proprement et sécurisée, y compris lorsqu'une exception se produit, en évitant les accès en cas d'erreur telles que le traitement d'une transaction malgré les erreurs résultant de la logique de validation.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.5", + "section_name": "Gestion des erreurs", + "req_id": "V16.5.4", + "req_description": "Vérifiez qu'un gestionnaire d'erreurs de « dernier recours » est défini pour intercepter toutes les exceptions non gérées. Cela permet d'éviter la perte des informations d'erreur qui doivent être loguées dans les fichiers journaux et de garantir qu'une erreur ne paralyse pas l'ensemble du processus applicatif, entraînant une perte de disponibilité.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.1", + "section_name": "Serveur TURN", + "req_id": "V17.1.1", + "req_description": "Vérifiez que le service TURN (Traversal Using Relays around NAT) autorise uniquement l'accès aux adresses IP non réservées à des fins spécifiques (par exemple, réseaux internes, diffusion, bouclage). Notez que cela s'applique aux adresses IPv4 et IPv6.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.1", + "section_name": "Serveur TURN", + "req_id": "V17.1.2", + "req_description": "Vérifiez que le service Traversal Using Relays around NAT (TURN) n'est pas susceptible d'épuiser ses ressources lorsque des utilisateurs légitimes tentent d'ouvrir un grand nombre de ports sur le serveur TURN.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Média", + "req_id": "V17.2.1", + "req_description": "Vérifiez que la clé du certificat Datagram Transport Layer Security (DTLS) est gérée et protégée conformément à la politique documentée de gestion des clés cryptographiques.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Média", + "req_id": "V17.2.2", + "req_description": "Vérifiez que le serveur multimédia est configuré pour utiliser et prendre en charge les suites de chiffrement DTLS (Datagram Transport Layer Security) approuvées et un profil de protection sécurisé pour l'extension DTLS pour l'établissement de clés pour le protocole de transport en temps réel sécurisé (DTLS-SRTP).", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Média", + "req_id": "V17.2.3", + "req_description": "Vérifiez que l'authentification SRTP (Secure Real-time Transport Protocol) est vérifiée sur le serveur multimédia pour empêcher les attaques par injection RTP (Real-time Transport Protocol) d'entraîner une condition de déni de service ou l'insertion de médias audio ou vidéo dans les flux multimédias.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Média", + "req_id": "V17.2.4", + "req_description": "Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant lorsqu'il rencontre des paquets SRTP (Secure Real-time Transport Protocol) mal formés.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Média", + "req_id": "V17.2.5", + "req_description": "Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Média", + "req_id": "V17.2.6", + "req_description": "Vérifiez que le serveur multimédia n'est pas sensible à la vulnérabilité de condition de concurrence « ClientHello » dans Datagram Transport Layer Security (DTLS) en vérifiant si le serveur multimédia est publiquement connu comme étant vulnérable ou en effectuant le test de condition de concurrence.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Média", + "req_id": "V17.2.7", + "req_description": "Vérifiez que tous les mécanismes d'enregistrement audio ou vidéo associés au serveur multimédia sont en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Média", + "req_id": "V17.2.8", + "req_description": "Vérifiez que le certificat Datagram Transport Layer Security (DTLS) est vérifié par rapport à l'attribut d'empreinte cryptographique du protocole de description de session (SDP), en mettant fin au flux multimédia si la vérification échoue, pour garantir l'authenticité du flux multimédia.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.3", + "section_name": "Signalisation", + "req_id": "V17.3.1", + "req_description": "Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation entrants légitimes lors d'une attaque par saturation. Cela peut être réalisé en implémentant une limitation de débit au niveau de la signalisation.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.3", + "section_name": "Signalisation", + "req_id": "V17.3.2", + "req_description": "Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation légitimes en cas de message mal formé susceptible de provoquer un déni de service. Cela peut inclure la validation des entrées, la gestion sécurisée des dépassements d'entiers, la prévention des dépassements de tampon et l'utilisation d'autres techniques robustes de gestion des erreurs.", + "L": "2" + } + ] +} diff --git a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.flat.legacy.json b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.flat.legacy.json new file mode 100644 index 0000000000..da3d145c8e --- /dev/null +++ b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.flat.legacy.json @@ -0,0 +1,4489 @@ +{ + "requirements": [ + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.1", + "section_name": "Architecture d'encodage et de nettoyage", + "req_id": "V1.1.1", + "req_description": "Vérifiez que l'entrée est décodée ou non échappée vers une forme canonique une seule fois, elle n'est décodée que lorsque des données codées sous cette forme sont attendues, et que cela est fait avant de traiter davantage l'entrée, par exemple, elle n'est pas effectuée après la validation ou la désinfection de l'entrée.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.1", + "section_name": "Architecture d'encodage et de nettoyage", + "req_id": "V1.1.2", + "req_description": "Vérifiez que l'application effectue l'encodage et l'échappement de sortie soit comme étape finale avant d'être utilisée par l'interpréteur pour lequel elle est destinée, soit par l'interpréteur lui-même.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.1", + "req_description": "Vérifiez que l'encodage de sortie d'une réponse HTTP, d'un document HTML ou d'un document XML est pertinent pour le contexte requis, comme l'encodage des caractères pertinents pour les éléments HTML, les attributs HTML, les commentaires HTML, les CSS ou les champs d'en-tête HTTP, pour éviter de modifier la structure du message ou du document.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.2", + "req_description": "Vérifiez que, lors de la création dynamique d'URL, les données non fiables sont encodées en fonction de leur contexte (par exemple, encodage d'URL ou encodage base64url pour les paramètres de requête ou de chemin). Assurez-vous que seuls les schémas d'URL sûrs sont autorisés (par exemple, interdire javascript: ou data:).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.3", + "req_description": "Vérifiez que l'encodage ou l'échappement de sortie est utilisé lors de la création dynamique de contenu JavaScript (y compris JSON), pour éviter de modifier la structure du message ou du document (pour éviter l'injection JavaScript et JSON).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.4", + "req_description": "Vérifiez que la sélection de données ou les requêtes de base de données (par exemple, SQL, HQL, NoSQL, Cypher) utilisent des requêtes paramétrées, des ORM, des Framework d'entités ou sont protégées contre les injections SQL et autres attaques par injection de base de données. Ceci est également pertinent lors de l'écriture de procédures stockées.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.5", + "req_description": "Vérifiez que l’application protège contre l’injection de commandes du système d’exploitation et que les appels du système d’exploitation utilisent des requêtes du système d’exploitation paramétrées ou utilisent un encodage de sortie de ligne de commande contextuelle.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.6", + "req_description": "Vérifiez que l’application protège contre les vulnérabilités d’injection LDAP ou que des contrôles de sécurité spécifiques pour empêcher l’injection LDAP ont été mis en œuvre.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.7", + "req_description": "Vérifiez que l’application est protégée contre les attaques par injection XPath en utilisant la paramétrisation des requêtes ou des requêtes précompilées.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.8", + "req_description": "Vérifiez que les processeurs LaTeX sont configurés de manière sécurisée (par exemple, en n'utilisant pas l'indicateur « --shell-escape ») et qu'une liste d’autorisations de commandes est utilisée pour empêcher les attaques par injection LaTeX.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.9", + "req_description": "Vérifiez que l'application échappe les caractères spéciaux dans les expressions régulières (généralement à l'aide d'une barre oblique inverse) pour éviter qu'ils ne soient mal interprétés comme des métacaractères.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.10", + "req_description": "Vérifiez que l'application est protégée contre les injections CSV et injections de formules. L'application doit respecter les règles d'échappement définies dans les sections 2.6 et 2.7 de la RFC 4180 lors de l'export de contenu CSV. De plus, lors de l'export au format CSV ou vers d'autres formats de tableur (tels que XLS, XLSX ou ODF), les caractères spéciaux (notamment « = », « + », « - », « @ », « \\t » (tabulation) et « \\0 » (caractère null)) doivent être protégés par une apostrophe s'ils apparaissent en premier dans une valeur de champ.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.1", + "req_description": "Vérifiez que toutes les entrées HTML non fiables provenant d'éditeurs WYSIWYG ou similaires sont nettoyées à l'aide d'une bibliothèque ou d'une fonctionnalité de Framework de nettoyage HTML bien connue et sécurisée.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.2", + "req_description": "Vérifiez que l'application évite d'utiliser eval() ou d'autres fonctionnalités d'exécution de code dynamique telles que Spring Expression Language (SpEL). En l'absence d'alternative, toute saisie utilisateur incluse doit être nettoyée avant d'être exécutée.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.3", + "req_description": "Vérifiez que les données transmises à un contexte potentiellement dangereux sont préalablement nettoyées pour appliquer des mesures de sécurité, telles qu'autoriser uniquement des caractères sûrs pour ce contexte et raccourcir des entrées trop longues.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.4", + "req_description": "Vérifiez que le contenu Scalable Vector Graphics (SVG) scriptable fourni par l'utilisateur est validé ou nettoyé pour contenir uniquement des balises et des attributs (tels que des graphiques de dessin) qui sont sûrs pour l'application, par exemple, ne contiennent pas de scripts et d'objets étrangers.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.5", + "req_description": "Vérifiez que l'application nettoie ou désactive le contenu du langage de modèle d'expression ou de script fourni par l'utilisateur, tel que les feuilles de style CSS, le Markdown ou XSL, BBCode ou similaire.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.6", + "req_description": "Vérifiez que l'application protège contre les attaques de falsification de requête côté serveur (SSRF), en validant les données non fiables par rapport à une liste d'autorisation de protocoles, de domaines, de chemins et de ports et en nettoyant les caractères potentiellement dangereux avant d'utiliser les données pour appeler un autre service.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.7", + "req_description": "Vérifiez que l'application se protège contre les attaques par injection de modèles en interdisant la création de modèles basés sur des entrées non fiables. En l'absence d'alternative, toute entrée non fiable incluse dynamiquement lors de la création du modèle doit être nettoyée ou rigoureusement validée.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.8", + "req_description": "Vérifiez que l’application nettoie correctement les entrées non fiables avant utilisation dans les requêtes Java Naming and Directory Interface (JNDI) et que JNDI est configuré de manière sécurisée pour empêcher les attaques par injection JNDI.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.9", + "req_description": "Vérifiez que l’application nettoie le contenu avant qu’il ne soit envoyé à memcache pour éviter les attaques par injection.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.10", + "req_description": "Vérifiez que les chaînes de format susceptibles d'être résolues de manière inattendue ou malveillante lors de leur utilisation sont nettoyées avant d'être traitées.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.11", + "req_description": "Vérifiez que l'application nettoie les entrées utilisateur avant de les transmettre aux systèmes de messagerie pour se protéger contre l'injection SMTP ou IMAP.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.12", + "req_description": "Vérifiez que les expressions régulières sont exemptes d'éléments provoquant \"backtracking\" exponentiel et assurez-vous que les entrées non fiables sont nettoyées pour atténuer les attaques ReDoS ou Runaway Regex.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.4", + "section_name": "Mémoire, chaine de caractères et code à mémoire non-managée", + "req_id": "V1.4.1", + "req_description": "Vérifiez que l'application utilise des chaînes memory-safe, une copie de mémoire et une arithmétique de pointeur renforcée pour détecter ou empêcher les débordements de pile, de tampon ou de tas.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.4", + "section_name": "Mémoire, chaine de caractères et code à mémoire non-managée", + "req_id": "V1.4.2", + "req_description": "Vérifiez que les techniques de validation du signe, de la plage et de l’entrée sont utilisées pour éviter les dépassements d’entiers.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.4", + "section_name": "Mémoire, chaine de caractères et code à mémoire non-managée", + "req_id": "V1.4.3", + "req_description": "Vérifiez que la mémoire et les ressources allouées dynamiquement sont libérées et que les références ou les pointeurs vers la mémoire libérée sont supprimés ou définis à null pour éviter les \"dangling pointer\" et les vulnérabilités d'utilisation après libération.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.5", + "section_name": "Désérialisation sécurisée", + "req_id": "V1.5.1", + "req_description": "Vérifiez que l'application configure les \"parser\" XML pour utiliser une configuration restrictive et que les fonctionnalités non sûres telles que la résolution d'entités externes sont désactivées pour empêcher les attaques XML eXternal Entity (XXE).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.5", + "section_name": "Désérialisation sécurisée", + "req_id": "V1.5.2", + "req_description": "Vérifiez que la désérialisation des données non fiables garantit une gestion sécurisée des entrées, par exemple en utilisant une liste d'autorisation de types d'objets ou en limitant les types d'objets définis par le client, afin d'empêcher les attaques par désérialisation. Les mécanismes de désérialisation explicitement définis comme non sécurisés ne doivent pas être utilisés avec des entrées non fiables.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.5", + "section_name": "Désérialisation sécurisée", + "req_id": "V1.5.3", + "req_description": "Vérifiez que les différents \"parser\" utilisés dans l'application pour le même type de données (par exemple, les \"parser\" JSON, les \"parser\" XML, les \"parser\" d'URL) effectuent l'analyse de manière cohérente et utilisent le même mécanisme d'encodage de caractères pour éviter des problèmes tels que les vulnérabilités d'interopérabilité JSON ou un comportement d'analyse d'URI ou de fichier différent exploité dans les attaques d'inclusion de fichiers à distance (RFI) ou de falsification de requête côté serveur (SSRF).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.1", + "section_name": "Validation et documentation de la logique métier", + "req_id": "V2.1.1", + "req_description": "Vérifiez que la documentation de l'application définit des règles de validation des entrées pour vérifier la validité des éléments de données par rapport à la structure attendue. Il peut s'agir de formats de données courants tels que des numéros de carte de crédit, des adresses e-mail ou des numéros de téléphone, ou d'un format de données interne.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.1", + "section_name": "Validation et documentation de la logique métier", + "req_id": "V2.1.2", + "req_description": "Vérifiez que la documentation de l'application définit comment valider la cohérence logique et contextuelle des éléments de données combinés, par exemple en vérifiant que la banlieue et le code postal correspondent.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.1", + "section_name": "Validation et documentation de la logique métier", + "req_id": "V2.1.3", + "req_description": "Vérifiez que les attentes en matière de limites et de validations de la logique métier sont documentées, y compris par utilisateur et globalement dans l'application.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.2", + "section_name": "Validation des entrées", + "req_id": "V2.2.1", + "req_description": "Vérifier que les entrées sont validées afin de respecter les attentes métier ou fonctionnelles. Cette validation doit être basée sur une liste de valeurs, de modèles et de plages autorisées, ou sur la comparaison des entrées avec une structure attendue et des limites logiques selon des règles prédéfinies. Pour le niveau 1, cette validation peut se concentrer sur les entrées utilisées pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau 2, elle doit s'appliquer à toutes les entrées.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.2", + "section_name": "Validation des entrées", + "req_id": "V2.2.2", + "req_description": "Vérifiez que l'application est conçue pour appliquer la validation des entrées au niveau d'une couche de service de confiance. Bien que la validation côté client améliore l'ergonomie et doit être encouragée, elle ne doit pas être considérée comme un contrôle de sécurité.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.2", + "section_name": "Validation des entrées", + "req_id": "V2.2.3", + "req_description": "Vérifiez que l’application garantit que les combinaisons d’éléments de données associés sont raisonnables selon les règles prédéfinies.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.3", + "section_name": "Sécurité de la logique métier", + "req_id": "V2.3.1", + "req_description": "Vérifiez que l’application traitera uniquement les flux de logique métier pour le même utilisateur dans l’ordre séquentiel attendu et sans sauter d’étapes.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.3", + "section_name": "Sécurité de la logique métier", + "req_id": "V2.3.2", + "req_description": "Vérifiez que les limites de la logique métier sont implémentées conformément à la documentation de l'application, afin d'éviter que des failles de la logique métier ne soient pas exploitées.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.3", + "section_name": "Sécurité de la logique métier", + "req_id": "V2.3.3", + "req_description": "Vérifiez que les transactions sont utilisées au niveau de la logique métier de telle sorte qu'une opération de logique métier réussisse dans son intégralité ou qu'elle soit restaurée à l'état correct précédent.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.3", + "section_name": "Sécurité de la logique métier", + "req_id": "V2.3.4", + "req_description": "Vérifiez que les mécanismes de verrouillage au niveau de la logique métier sont utilisés pour garantir que les ressources en quantité limitée (telles que les sièges de théâtre ou les créneaux de livraison) ne peuvent pas être réservées deux fois en manipulant la logique de l'application.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.3", + "section_name": "Sécurité de la logique métier", + "req_id": "V2.3.5", + "req_description": "Vérifiez que les flux logiques métier à forte valeur ajoutée nécessitent l'approbation de plusieurs utilisateurs afin d'éviter toute action non autorisée ou accidentelle. Cela peut inclure, sans s'y limiter, les transferts monétaires importants, les approbations de contrats, l'accès à des informations classifiées ou les contournements de sécurité dans le secteur manufacturier.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.4", + "section_name": "Anti-automatisation", + "req_id": "V2.4.1", + "req_description": "Vérifiez que des contrôles anti-automatisation sont en place pour protéger contre les appels excessifs aux fonctions d'application qui pourraient conduire à l'exfiltration de données, à la création de données inutiles, à l'épuisement des quotas, aux violations de limites de débit, au déni de service ou à la surutilisation de ressources coûteuses.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.4", + "section_name": "Anti-automatisation", + "req_id": "V2.4.2", + "req_description": "Vérifiez que les flux logiques métier nécessitent un timing humain réaliste, évitant ainsi des soumissions de transactions excessivement rapides.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.1", + "section_name": "Documentation sur la sécurité du frontend Web", + "req_id": "V3.1.1", + "req_description": "Vérifiez que la documentation de l'application indique les fonctionnalités de sécurité attendues que les navigateurs utilisant l'application doivent prendre en charge (telles que HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) et autres mécanismes de sécurité HTTP pertinents). Elle doit également définir le comportement de l'application lorsque certaines de ces fonctionnalités ne sont pas disponibles (par exemple, avertir l'utilisateur ou bloquer l'accès).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.2", + "section_name": "Interprétation non intentionnelle du contenu", + "req_id": "V3.2.1", + "req_description": "Vérifiez que des contrôles de sécurité sont en place pour empêcher les navigateurs d'afficher du contenu ou des fonctionnalités dans les réponses HTTP dans un contexte incorrect (par exemple, lorsqu'une API, un fichier téléchargé par l'utilisateur ou une autre ressource est demandée directement). Les contrôles possibles peuvent inclure : ne pas transmettre le contenu sauf si les champs d'en-tête de requête HTTP (tels que Sec-Fetch-\\*) indiquent qu'il s'agit du contexte correct, utiliser la directive sandbox du champ d'en-tête Content-Security-Policy ou utiliser le type de disposition de pièce jointe dans le champ d'en-tête Content-Disposition.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.2", + "section_name": "Interprétation non intentionnelle du contenu", + "req_id": "V3.2.2", + "req_description": "Vérifiez que le contenu destiné à être affiché sous forme de texte, plutôt que rendu sous forme de HTML, est géré à l'aide de fonctions de rendu sécurisées (telles que createTextNode ou textContent) pour empêcher l'exécution involontaire de contenu tel que HTML ou JavaScript.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.2", + "section_name": "Interprétation non intentionnelle du contenu", + "req_id": "V3.2.3", + "req_description": "Vérifiez que l'application évite l'écrasement du DOM lors de l'utilisation de JavaScript côté client en utilisant des déclarations de variables explicites, en effectuant une vérification de type stricte, en évitant de stocker des variables globales sur l'objet document et en implémentant l'isolation de l'espace de nommage.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.3", + "section_name": "Configuration des cookies", + "req_id": "V3.3.1", + "req_description": "Vérifiez que les cookies ont l'attribut « Secure » ​​défini et si le préfixe « \\__Host- » n'est pas utilisé pour le nom du cookie, le préfixe « __Secure- » doit être utilisé pour le nom du cookie.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.3", + "section_name": "Configuration des cookies", + "req_id": "V3.3.2", + "req_description": "Vérifiez que la valeur de l'attribut « SameSite » de chaque cookie est définie en fonction de l'objectif du cookie, afin de limiter l'exposition aux attaques de réparation de l'interface utilisateur et aux attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.3", + "section_name": "Configuration des cookies", + "req_id": "V3.3.3", + "req_description": "Vérifiez que les cookies ont le préfixe « __Host- » pour le nom du cookie, sauf s'ils sont explicitement conçus pour être partagés avec d'autres hôtes.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.3", + "section_name": "Configuration des cookies", + "req_id": "V3.3.4", + "req_description": "Vérifiez que si la valeur d'un cookie n'est pas censée être accessible aux scripts côté client (comme un jeton de session), le cookie doit avoir l'attribut « HttpOnly » défini et la même valeur (par exemple, un jeton de session) ne doit être transférée au client que via le champ d'en-tête « Set-Cookie ».", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.3", + "section_name": "Configuration des cookies", + "req_id": "V3.3.5", + "req_description": "Vérifiez que lorsque l'application écrit un cookie, la longueur combinée du nom et de la valeur du cookie ne dépasse pas 4 096 octets. Les cookies trop volumineux ne seront pas stockés par le navigateur et ne seront donc pas envoyés avec les requêtes, empêchant ainsi l'utilisateur d'utiliser les fonctionnalités de l'application qui reposent sur ce cookie.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.4", + "section_name": "En-têtes du mécanisme de sécurité du navigateur", + "req_id": "V3.4.1", + "req_description": "Vérifiez qu'un champ d'en-tête Strict-Transport-Security est inclus dans toutes les réponses afin d'appliquer une politique HTTP Strict Transport Security (HSTS). Une durée maximale d'au moins un an doit être définie, et pour les niveaux L2 et supérieurs, la politique doit également s'appliquer à tous les sous-domaines.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.4", + "section_name": "En-têtes du mécanisme de sécurité du navigateur", + "req_id": "V3.4.2", + "req_description": "Vérifiez que le champ d'en-tête Access-Control-Allow-Origin du partage de ressources cross-origine (CORS) est une valeur fixe de l'application ou, si la valeur du champ d'en-tête de requête HTTP Origin est utilisée, qu'elle est validée par rapport à une liste d'origines approuvées. Si « Access-Control-Allow-Origin: * » doit être utilisé, vérifiez que la réponse ne contient aucune information sensible.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.4", + "section_name": "En-têtes du mécanisme de sécurité du navigateur", + "req_id": "V3.4.3", + "req_description": "Vérifiez que les réponses HTTP incluent un champ d'en-tête de réponse Content-Security-Policy qui définit des directives garantissant que le navigateur charge et exécute uniquement du contenu ou des ressources fiables, afin de limiter l'exécution de JavaScript malveillant. Au minimum, une politique globale doit être utilisée, incluant les directives object-src 'none' et base-uri 'none', et définissant soit une lliste d’autorisations, soit des valeurs nonces ou des hachages. Pour une application L3, une politique par réponse avec des valeurs nonces ou des hachages doit être définie.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.4", + "section_name": "En-têtes du mécanisme de sécurité du navigateur", + "req_id": "V3.4.4", + "req_description": "Vérifiez que toutes les réponses HTTP contiennent un champ d'en-tête « X-Content-Type-Options: nosniff ». Cela indique aux navigateurs de ne pas utiliser l'analyse de contenu ni la détection du type MIME pour la réponse donnée, et d'exiger que la valeur du champ d'en-tête « Content-Type » de la réponse corresponde à la ressource de destination. Par exemple, la réponse à une demande de style n'est acceptée que si le type de contenu de la réponse est « text/css ». Cela permet également au navigateur d'utiliser la fonctionnalité de blocage de lecture inter-origines (CORB).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.4", + "section_name": "En-têtes du mécanisme de sécurité du navigateur", + "req_id": "V3.4.5", + "req_description": "Vérifiez que l'application définit une politique de référencement afin d'empêcher la fuite de données techniquement sensibles vers des services tiers via le champ d'en-tête de requête HTTP « Referer ». Cela peut être effectué via le champ d'en-tête de réponse HTTP « Referrer-Policy » ou via les attributs d'élément HTML. Les données sensibles peuvent inclure le chemin d'accès et les données de requête dans l'URL, et pour les applications internes non publiques, le nom d'hôte.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.4", + "section_name": "En-têtes du mécanisme de sécurité du navigateur", + "req_id": "V3.4.6", + "req_description": "Vérifiez que l'application Web utilise la directive frame-ancestors du champ d'en-tête Content-Security-Policy pour chaque réponse HTTP afin de garantir qu'elle ne peut pas être intégrée par défaut et que l'intégration de ressources spécifiques n'est autorisée qu'en cas de nécessité. Notez que le champ d'en-tête X-Frame-Options, bien que pris en charge par les navigateurs, est obsolète et n'est pas forcément fiable.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.4", + "section_name": "En-têtes du mécanisme de sécurité du navigateur", + "req_id": "V3.4.7", + "req_description": "Vérifiez que le champ d’en-tête Content-Security-Policy spécifie un emplacement pour signaler les violations.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.4", + "section_name": "En-têtes du mécanisme de sécurité du navigateur", + "req_id": "V3.4.8", + "req_description": "Vérifiez que toutes les réponses HTTP qui lancent le rendu d'un document (comme les réponses de type text/html) incluent le champ d'en-tête 'Cross-Origin-Opener-Policy' avec la directive 'same-origin' ou s'ame-origin-allow-popups', selon les besoins. Cela empêche les attaques abusant de l'accès partagé aux objets Window, telles que le tabnabbing et le comptage d'images.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.5", + "section_name": "Séparation de l'origine du navigateur", + "req_id": "V3.5.1", + "req_description": "Vérifiez que, si l'application ne s'appuie pas sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher les requêtes inter-origines non autorisées d'utiliser des fonctionnalités sensibles, ces requêtes sont validées afin de garantir leur origine. Cela peut se faire en utilisant et en validant des jetons anti-falsification ou en exigeant des champs d'en-tête HTTP supplémentaires qui ne sont pas des champs d'en-tête de requête CORS safelist. Ceci permet de se protéger contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.5", + "section_name": "Séparation de l'origine du navigateur", + "req_id": "V3.5.2", + "req_description": "Vérifiez que, si l'application s'appuie sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher l'utilisation inter-origines non autorisée de fonctionnalités sensibles, il est impossible d'appeler la fonctionnalité avec une requête qui ne déclenche pas de requête de pré-vérification cross-origin CORS. Cela peut nécessiter de vérifier les valeurs des champs d'en-tête de requête 'Origin' et 'Content-Type' ou d'utiliser un champ d'en-tête supplémentaire qui n'est pas un champ d'en-tête de la liste de sécurité CORS.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.5", + "section_name": "Séparation de l'origine du navigateur", + "req_id": "V3.5.3", + "req_description": "Vérifiez que les requêtes HTTP destinées aux fonctionnalités sensibles utilisent des méthodes HTTP appropriées, telles que POST, PUT, PATCH ou DELETE, et non des méthodes définies comme « sûres » par la spécification HTTP, telles que HEAD, OPTIONS ou GET. Une validation stricte des champs d'en-tête de requête Sec-Fetch-* peut également être utilisée pour garantir que la requête ne provient pas d'un appel inter-origines inapproprié, d'une requête de navigation ou d'un chargement de ressources (comme une source d'image) inattendu.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.5", + "section_name": "Séparation de l'origine du navigateur", + "req_id": "V3.5.4", + "req_description": "Vérifiez que des applications distinctes sont hébergées sur des noms d'hôte différents pour tirer parti des restrictions fournies par la politique de même origine, y compris la manière dont les documents ou scripts chargés par une origine peuvent interagir avec les ressources d'une autre origine et les restrictions basées sur le nom d'hôte sur les cookies.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.5", + "section_name": "Séparation de l'origine du navigateur", + "req_id": "V3.5.5", + "req_description": "Vérifiez que les messages reçus par l'interface postMessage sont rejetés si l'origine du message n'est pas digne de confiance ou si la syntaxe du message n'est pas valide.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.5", + "section_name": "Séparation de l'origine du navigateur", + "req_id": "V3.5.6", + "req_description": "Vérifiez que la fonctionnalité JSONP n'est activée nulle part dans l'application pour éviter les attaques Cross-Site Script Inclusion (XSSI).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.5", + "section_name": "Séparation de l'origine du navigateur", + "req_id": "V3.5.7", + "req_description": "Vérifiez que les données nécessitant une autorisation ne sont pas incluses dans les réponses des ressources de script, comme les fichiers JavaScript, pour empêcher les attaques par inclusion de script intersite (XSSI).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.5", + "section_name": "Séparation de l'origine du navigateur", + "req_id": "V3.5.8", + "req_description": "Vérifiez que les ressources authentifiées (telles que les images, les vidéos, les scripts et autres documents) peuvent être chargées ou intégrées pour le compte de l'utilisateur uniquement lorsque cela est prévu. Cela peut être réalisé en validant strictement les champs d'en-tête de requête HTTP Sec-Fetch-* afin de garantir que la requête ne provient pas d'un appel cross-origin inapproprié, ou en définissant un champ d'en-tête de réponse HTTP Cross-Origin-Resource-Policy restrictif pour indiquer au navigateur de bloquer le contenu renvoyé.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.6", + "section_name": "Intégrité des ressources externes", + "req_id": "V3.6.1", + "req_description": "Vérifiez que les ressources côté client, telles que les bibliothèques JavaScript, les feuilles de style CSS ou les polices web, sont hébergées en externe (par exemple, sur un réseau de diffusion de contenu) uniquement si la ressource est statique et versionnée, et si l'intégrité des sous-ressources (SRI) est utilisée pour valider l'intégrité de la ressource. Si cela n'est pas possible, une décision de sécurité documentée doit justifier cette décision pour chaque ressource.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.7", + "section_name": "Autres considérations sur la sécurité du navigateur", + "req_id": "V3.7.1", + "req_description": "Vérifiez que l'application utilise uniquement des technologies côté client toujours prises en charge et considérées comme sécurisées. Parmi les technologies qui ne répondent pas à cette exigence figurent les plugins NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL ou les applets Java côté client.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.7", + "section_name": "Autres considérations sur la sécurité du navigateur", + "req_id": "V3.7.2", + "req_description": "Vérifiez que l'application redirigera automatiquement l'utilisateur vers un nom d'hôte ou un domaine différent (qui n'est pas contrôlé par l'application) uniquement lorsque la destination apparaît sur une liste d'autorisation.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.7", + "section_name": "Autres considérations sur la sécurité du navigateur", + "req_id": "V3.7.3", + "req_description": "Vérifiez que le domaine de premier niveau de l'application (par exemple, site.tld) ​​est ajouté à la liste de préchargement publique pour HTTP Strict Transport Security (HSTS). Cela garantit que l'utilisation de TLS pour l'application est intégrée directement dans les principaux navigateurs, plutôt que de dépendre uniquement du champ d'en-tête de réponse Strict-Transport-Security.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.7", + "section_name": "Autres considérations sur la sécurité du navigateur", + "req_id": "V3.7.4", + "req_description": "Vérifiez que l'application affiche une notification lorsque l'utilisateur est redirigé vers une URL hors du contrôle de l'application, avec une option pour annuler la navigation.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.7", + "section_name": "Autres considérations sur la sécurité du navigateur", + "req_id": "V3.7.5", + "req_description": "Vérifiez que l'application se comporte comme documenté (par exemple, en avertissant l'utilisateur ou en bloquant l'accès) si le navigateur utilisé pour accéder à l'application ne prend pas en charge les fonctionnalités de sécurité attendues.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.1", + "section_name": "Sécurité du service Web générique", + "req_id": "V4.1.1", + "req_description": "Vérifiez que chaque réponse HTTP avec un corps de message contient un champ d'en-tête Content-Type qui correspond au contenu réel de la réponse, y compris le paramètre charset pour spécifier un codage de caractères sécurisé (par exemple, UTF-8, ISO-8859-1) conformément aux types de médias IANA, tels que « text/ », « /+xml » et « /xml ».", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.1", + "section_name": "Sécurité du service Web générique", + "req_id": "V4.1.2", + "req_description": "Vérifiez que seuls les terminaux utilisateurs (destinés à l'accès manuel via un navigateur web) redirigent automatiquement de HTTP vers HTTPS, tandis que les autres services ou terminaux n'implémentent pas de redirections transparentes. Cela permet d'éviter qu'un client envoie par erreur des requêtes HTTP non chiffrées, mais que, comme ces requêtes sont automatiquement redirigées vers HTTPS, la fuite de données sensibles passe inaperçue.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.1", + "section_name": "Sécurité du service Web générique", + "req_id": "V4.1.3", + "req_description": "Vérifiez que tout champ d'en-tête HTTP utilisé par l'application et défini par une couche intermédiaire, telle qu'un équilibreur de charge, un proxy web ou un service backend-for-frontend, ne peut pas être remplacé par l'utilisateur final. Les exemples d'en-têtes peuvent inclure X-Real-IP, X-Forwarded-*, ou X-User-ID.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.1", + "section_name": "Sécurité du service Web générique", + "req_id": "V4.1.4", + "req_description": "Vérifiez que seules les méthodes HTTP explicitement prises en charge par l'application ou son API (y compris les OPTIONS lors des demandes de contrôle en amont) peuvent être utilisées et que les méthodes inutilisées sont bloquées.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.1", + "section_name": "Sécurité du service Web générique", + "req_id": "V4.1.5", + "req_description": "Vérifier que les signatures numériques par message sont utilisées pour fournir une assurance supplémentaire en plus des protections de transport pour les demandes ou les transactions qui sont très sensibles ou qui traversent un certain nombre de systèmes.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.2", + "section_name": "Validation de la structure des messages HTTP", + "req_id": "V4.2.1", + "req_description": "Vérifiez que tous les composants de l'application (y compris les équilibreurs de charge, les pares-feux et les serveurs d'applications) déterminent les limites des messages HTTP entrants à l'aide du mécanisme approprié à la version HTTP afin d'empêcher la contrebande de requêtes HTTP. Dans HTTP/1.x, si un champ d'en-tête Transfer-Encoding est présent, l'en-tête Content-Length doit être ignoré conformément à la RFC 2616. Avec HTTP/2 ou HTTP/3, si un champ d'en-tête Content-Length est présent, le récepteur doit s'assurer qu'il est cohérent avec la longueur des trames DATA.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.2", + "section_name": "Validation de la structure des messages HTTP", + "req_id": "V4.2.2", + "req_description": "Vérifier que, lors de la génération de messages HTTP, le champ d'en-tête Content-Length n'entre pas en conflit avec la longueur du contenu déterminée par le cadrage du protocole HTTP, afin d'empêcher les attaques de type « request smuggling ».", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.2", + "section_name": "Validation de la structure des messages HTTP", + "req_id": "V4.2.3", + "req_description": "Vérifiez que l'application n'envoie ni n'accepte de messages HTTP/2 ou HTTP/3 avec des champs d'en-tête spécifiques à la connexion, tels que Transfer-Encoding, afin d'éviter les attaques par fractionnement de la réponse et par injection d'en-tête.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.2", + "section_name": "Validation de la structure des messages HTTP", + "req_id": "V4.2.4", + "req_description": "Vérifiez que l'application n'accepte que les requêtes HTTP/2 et HTTP/3 dont les champs et valeurs d'en-tête ne contiennent pas de séquences CR (\\r), LF (\\n) ou CRLF (\\r\\n), afin d'éviter les attaques par injection d'en-tête.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.2", + "section_name": "Validation de la structure des messages HTTP", + "req_id": "V4.2.5", + "req_description": "Vérifiez que, si l'application (backend ou frontend) construit et envoie des requêtes, elle utilise des mécanismes de validation, d'assainissement ou autres pour éviter de créer des URI (comme pour les appels API) ou des champs d'en-tête de requête HTTP (comme Authorization ou Cookie) qui sont trop longs pour être acceptés par le composant récepteur. Cela pourrait entraîner un déni de service, par exemple lors de l'envoi d'une requête trop longue (par exemple, un long champ d'en-tête de cookie), ce qui fait que le serveur répond toujours avec un statut d'erreur.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.3", + "section_name": "GraphQL", + "req_id": "V4.3.1", + "req_description": "Vérifiez qu'une liste d'autorisation de requête, une limitation de profondeur, une limitation de quantité ou une analyse des coûts de requête est utilisée pour empêcher le déni de service (DoS) de GraphQL ou d'expression de la couche données en raison de requêtes imbriquées coûteuses.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.3", + "section_name": "GraphQL", + "req_id": "V4.3.2", + "req_description": "Vérifiez que les requêtes d’introspection GraphQL sont désactivées dans l’environnement de production, sauf si l’API GraphQL est destinée à être utilisée par d’autres parties.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.1", + "req_description": "Vérifiez que WebSocket sur TLS (WSS) est utilisé pour toutes les connexions WebSocket.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.2", + "req_description": "Vérifiez que, lors de la négociation HTTP WebSocket initiale, le champ d’en-tête 'Origin' est vérifié par rapport à une liste d’origines autorisées pour l’application.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.3", + "req_description": "Vérifiez que, si la gestion de session standard de l'application ne peut pas être utilisée, des jetons dédiés sont utilisés à cet effet, qui sont conformes aux exigences de sécurité de gestion de session pertinentes.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.4", + "req_description": "Vérifiez que les jetons de gestion de session WebSocket dédiés sont initialement obtenus ou validés via la session HTTPS précédemment authentifiée lors de la transition d'une session HTTPS existante vers un canal WebSocket.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.1", + "section_name": "Documentation sur la gestion des fichiers", + "req_id": "V5.1.1", + "req_description": "Vérifiez que la documentation définit les types de fichiers autorisés, les extensions de fichiers attendues et la taille maximale (y compris la taille décompressée) pour chaque fonctionnalité de Téléversement. De plus, assurez-vous que la documentation précise comment les fichiers sont sécurisés pour le téléchargement et le traitement des utilisateurs finaux, par exemple le comportement de l'application lorsqu'un fichier malveillant est détecté.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.2", + "section_name": "Téléversement de fichiers et contenu", + "req_id": "V5.2.1", + "req_description": "Vérifiez que l'application n'acceptera que des fichiers d'une taille qu'elle peut traiter sans provoquer de perte de performances ou d'attaque par déni de service.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.2", + "section_name": "Téléversement de fichiers et contenu", + "req_id": "V5.2.2", + "req_description": "Vérifiez que lorsque l'application accepte un fichier, seul ou dans une archive telle qu'un fichier zip, elle vérifie si l'extension de fichier correspond à une extension attendue et que le contenu correspond au type représenté par l'extension. Cela inclut, sans s'y limiter, la vérification des « octets magiques » initiaux, la réécriture d'images et l'utilisation de bibliothèques spécialisées pour la validation du contenu des fichiers. Pour le niveau L1, cela peut se concentrer uniquement sur les fichiers utilisés pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau L2, cela doit s'appliquer à tous les fichiers acceptés.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.2", + "section_name": "Téléversement de fichiers et contenu", + "req_id": "V5.2.3", + "req_description": "Vérifiez que l'application vérifie les fichiers compressés (par exemple, zip, gz, docx, odt) par rapport à la taille maximale autorisée non compressée et au nombre maximal de fichiers avant de décompresser le fichier.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.2", + "section_name": "Téléversement de fichiers et contenu", + "req_id": "V5.2.4", + "req_description": "Vérifiez qu'un quota de taille de fichier et un nombre maximal de fichiers par utilisateur sont appliqués pour garantir qu'un seul utilisateur ne puisse pas remplir le stockage avec trop de fichiers ou des fichiers excessivement volumineux.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.2", + "section_name": "Téléversement de fichiers et contenu", + "req_id": "V5.2.5", + "req_description": "Vérifiez que l'application n'autorise pas le téléversement de fichiers compressés contenant des liens symboliques, sauf si cela est spécifiquement requis (auquel cas il sera nécessaire d'appliquer une liste d'autorisation des fichiers vers lesquels il est possible de créer des liens symboliques).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.2", + "section_name": "Téléversement de fichiers et contenu", + "req_id": "V5.2.6", + "req_description": "Vérifiez que l'application rejette les images téléversées avec une taille de pixel supérieure au maximum autorisé, afin d'éviter les attaques par inondation de pixels.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.3", + "section_name": "Stockage de fichiers", + "req_id": "V5.3.1", + "req_description": "Vérifiez que les fichiers téléversés ou générés par une entrée non fiable et stockés dans un dossier public ne sont pas exécutés en tant que code de programme côté serveur lorsqu'ils sont accessibles directement avec une requête HTTP.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.3", + "section_name": "Stockage de fichiers", + "req_id": "V5.3.2", + "req_description": "Vérifiez que lorsque l'application crée des chemins d'accès pour les opérations sur les fichiers, elle utilise des données générées en interne ou fiables plutôt que des noms de fichiers soumis par l'utilisateur. Si des noms de fichiers ou des métadonnées de fichiers soumis par l'utilisateur doivent être utilisés, une validation et un nettoyage stricts doivent être appliqués. Ceci permet de se protéger contre les attaques par traversée de chemin, l'inclusion de fichiers locaux ou distants (LFI, RFI) et la falsification de requêtes côté serveur (SSRF).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.3", + "section_name": "Stockage de fichiers", + "req_id": "V5.3.3", + "req_description": "Vérifiez que le traitement des fichiers côté serveur, comme la décompression des fichiers, ignore les informations de chemin fournies par l'utilisateur pour éviter les vulnérabilités telles que le \"zip slip\".", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.4", + "section_name": "Téléchargement de fichier", + "req_id": "V5.4.1", + "req_description": "Vérifiez que l’application valide ou ignore les noms de fichiers soumis par l’utilisateur, y compris dans un paramètre JSON, JSONP ou URL et spécifie un nom de fichier dans le champ d’en-tête Content-Disposition de la réponse.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.4", + "section_name": "Téléchargement de fichier", + "req_id": "V5.4.2", + "req_description": "Vérifiez que les noms de fichiers servis (par exemple, dans les champs d'en-tête de réponse HTTP ou les pièces jointes aux e-mails) sont encodés ou nettoyés (par exemple, conformément à la RFC 6266) pour préserver la structure du document et empêcher les attaques par injection.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.4", + "section_name": "Téléchargement de fichier", + "req_id": "V5.4.3", + "req_description": "Vérifiez que les fichiers obtenus à partir de sources non fiables sont analysés par des scanners antivirus pour empêcher la diffusion de contenu malveillant connu.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.1", + "section_name": "Documentation d'authentification", + "req_id": "V6.1.1", + "req_description": "Vérifiez que la documentation de l'application définit comment les contrôles, tels que la limitation de débit, l'anti-automatisation et la réponse adaptative, sont utilisés pour se défendre contre les attaques telles que le « credential stuffing » et la force brute des mots de passe. La documentation doit expliquer clairement comment ces contrôles sont configurés et empêcher le blocage malveillant des comptes.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.1", + "section_name": "Documentation d'authentification", + "req_id": "V6.1.2", + "req_description": "Vérifiez qu'une liste de mots spécifiques au contexte est documentée afin d'empêcher leur utilisation dans les mots de passe. Cette liste peut inclure des permutations de noms d'organisations, de produits, d'identifiants de systèmes, de noms de codes de projets, de noms de services ou de rôles, etc.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.1", + "section_name": "Documentation d'authentification", + "req_id": "V6.1.3", + "req_description": "Vérifiez que, si l'application inclut plusieurs voies d'authentification, celles-ci sont toutes documentées avec les contrôles de sécurité et la force d'authentification qui doivent être appliqués de manière cohérente.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.1", + "req_description": "Vérifiez que les mots de passe définis par l'utilisateur comportent au moins 8 caractères, bien qu'un minimum de 15 caractères soit fortement recommandé.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.2", + "req_description": "Vérifiez que les utilisateurs peuvent modifier leur mot de passe.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.3", + "req_description": "Vérifiez que la fonctionnalité de changement de mot de passe nécessite le mot de passe actuel et le nouveau mot de passe de l'utilisateur.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.4", + "req_description": "Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou du changement de mot de passe sont vérifiés par rapport à un ensemble disponible d'au moins 3 000 mots de passe principaux qui correspondent à la politique de mot de passe de l'application, par exemple la longueur minimale.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.5", + "req_description": "Vérifiez que les mots de passe peuvent être utilisés, quelle que soit leur composition, sans restriction quant au type de caractères autorisés. Aucun nombre minimal de majuscules ou de minuscules, de chiffres ou de caractères spéciaux ne doit être exigé.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.6", + "req_description": "Vérifiez que les champs de saisie du mot de passe utilisent type=password pour masquer la saisie. Les applications peuvent permettre à l'utilisateur d'afficher temporairement l'intégralité du mot de passe masqué ou le dernier caractère saisi.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.7", + "req_description": "Vérifiez que la fonctionnalité « coller », les assistants de mot de passe du navigateur et les gestionnaires de mots de passe externes sont autorisés.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.8", + "req_description": "Vérifiez que l'application vérifie le mot de passe de l'utilisateur exactement tel qu'il a été reçu de l'utilisateur, sans aucune modification telle qu'une troncature ou une transformation de casse.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.9", + "req_description": "Vérifiez que les mots de passe d’au moins 64 caractères sont autorisés.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.10", + "req_description": "Vérifiez que le mot de passe d'un utilisateur reste valide jusqu'à ce qu'il soit découvert comme compromis ou qu'il soit renouvelé. L'application ne doit pas exiger de renouvellement périodique des identifiants.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.11", + "req_description": "Vérifiez que la liste documentée de mots spécifiques au contexte est utilisée pour éviter la création de mots de passe faciles à deviner.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.12", + "req_description": "Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou des modifications de mot de passe sont vérifiés par rapport à un ensemble de mots de passe fuités.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.3", + "section_name": "Sécurité générale de l'authentification", + "req_id": "V6.3.1", + "req_description": "Vérifiez que les contrôles visant à empêcher les attaques telles que le bourrage d'informations d'identification et la force brute des mots de passe sont mis en œuvre conformément à la documentation de sécurité de l'application.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.3", + "section_name": "Sécurité générale de l'authentification", + "req_id": "V6.3.2", + "req_description": "Vérifiez que les comptes d’utilisateur par défaut (par exemple, « root », « admin » ou « sa ») ne sont pas présents dans l’application ou sont désactivés.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.3", + "section_name": "Sécurité générale de l'authentification", + "req_id": "V6.3.3", + "req_description": "Vérifiez que l’application exige que les utilisateurs utilisent un mécanisme d’authentification multifacteur ou une combinaison de mécanismes d’authentification à facteur unique.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.3", + "section_name": "Sécurité générale de l'authentification", + "req_id": "V6.3.4", + "req_description": "Vérifiez que, si l’application inclut plusieurs voies d’authentification, il n’existe aucune voie non documentée et que les contrôles de sécurité et la force d’authentification sont appliqués de manière cohérente.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.3", + "section_name": "Sécurité générale de l'authentification", + "req_id": "V6.3.5", + "req_description": "Vérifiez que les utilisateurs sont informés des tentatives d'authentification suspectes (réussies ou non). Il peut s'agir de tentatives d'authentification provenant d'un emplacement ou d'un client inhabituel, d'une authentification partiellement réussie (un seul facteur parmi plusieurs), d'une tentative d'authentification après une longue période d'inactivité ou d'une authentification réussie après plusieurs tentatives infructueuses.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.3", + "section_name": "Sécurité générale de l'authentification", + "req_id": "V6.3.6", + "req_description": "Vérifiez que le courrier électronique n’est pas utilisé comme mécanisme d’authentification à facteur unique ou à facteurs multiples.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.3", + "section_name": "Sécurité générale de l'authentification", + "req_id": "V6.3.7", + "req_description": "Vérifiez que les utilisateurs sont avertis après les mises à jour des détails d'authentification, telles que les réinitialisations d'informations d'identification ou la modification du nom d'utilisateur ou de l'adresse e-mail.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.3", + "section_name": "Sécurité générale de l'authentification", + "req_id": "V6.3.8", + "req_description": "Vérifiez que les utilisateurs valides ne peuvent pas être déduits d'échecs d'authentification, par exemple en se basant sur des messages d'erreur, des codes de réponse HTTP ou des temps de réponse différents. Les fonctionnalités d'inscription et de mot de passe oublié doivent également bénéficier de cette protection.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.4", + "section_name": "Cycle de vie et récupération du facteur d'authentification", + "req_id": "V6.4.1", + "req_description": "Vérifiez que les mots de passe initiaux ou les codes d'activation générés par le système sont générés de manière aléatoire et sécurisée, qu'ils respectent la politique de mots de passe en vigueur et qu'ils expirent après une courte période ou après leur première utilisation. Ces secrets initiaux ne doivent pas devenir des mots de passe permanents.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.4", + "section_name": "Cycle de vie et récupération du facteur d'authentification", + "req_id": "V6.4.2", + "req_description": "Vérifiez que les indices de mot de passe ou l'authentification basée sur les connaissances (appelées « questions secrètes ») ne sont pas présents.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.4", + "section_name": "Cycle de vie et récupération du facteur d'authentification", + "req_id": "V6.4.3", + "req_description": "Vérifiez qu'un processus sécurisé de réinitialisation d'un mot de passe oublié est mis en œuvre, qui ne contourne aucun mécanisme d'authentification multifacteur activé.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.4", + "section_name": "Cycle de vie et récupération du facteur d'authentification", + "req_id": "V6.4.4", + "req_description": "Vérifiez que si un facteur d'authentification multifacteur est perdu, la preuve de vérification d'identité est effectuée au même niveau que lors de l'inscription.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.4", + "section_name": "Cycle de vie et récupération du facteur d'authentification", + "req_id": "V6.4.5", + "req_description": "Vérifiez que les instructions de renouvellement des mécanismes d'authentification qui expirent sont envoyées avec suffisamment de temps pour être exécutées avant l'expiration de l'ancien mécanisme d'authentification, en configurant des rappels automatiques si nécessaire.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.4", + "section_name": "Cycle de vie et récupération du facteur d'authentification", + "req_id": "V6.4.6", + "req_description": "Vérifiez que les administrateurs peuvent initier la réinitialisation du mot de passe de l'utilisateur, mais que cela ne leur permet pas de modifier ou de choisir son mot de passe. Cela évite qu'ils ne connaissent le mot de passe de l'utilisateur.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.5", + "section_name": "Exigences générales en matière d'authentification multifacteur", + "req_id": "V6.5.1", + "req_description": "Vérifiez que les secrets de recherche, les demandes ou codes d'authentification out-of-band et les mots de passe à usage unique basés sur le temps (TOTP) ne peuvent être utilisés avec succès qu'une seule fois.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.5", + "section_name": "Exigences générales en matière d'authentification multifacteur", + "req_id": "V6.5.2", + "req_description": "Vérifiez que, lors de leur stockage dans le backend de l'application, les secrets de recherche comportant moins de 112 bits d'entropie (19 caractères alphanumériques aléatoires ou 34 chiffres aléatoires) sont hachés avec un algorithme de hachage de stockage de mots de passe approuvé, intégrant un sel aléatoire de 32 bits. Une fonction de hachage standard peut être utilisée si le secret comporte 112 bits d'entropie ou plus.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.5", + "section_name": "Exigences générales en matière d'authentification multifacteur", + "req_id": "V6.5.3", + "req_description": "Vérifiez que les secrets de recherche, le code d'authentification out-of-band et les mots de passe à usage unique basés sur le temps sont générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) pour éviter les valeurs prévisibles.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.5", + "section_name": "Exigences générales en matière d'authentification multifacteur", + "req_id": "V6.5.4", + "req_description": "Vérifiez que les secrets de recherche et les codes d'authentification out-of-band ont un minimum de 20 bits d'entropie (généralement 4 caractères alphanumériques aléatoires ou 6 chiffres aléatoires suffisent).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.5", + "section_name": "Exigences générales en matière d'authentification multifacteur", + "req_id": "V6.5.5", + "req_description": "Vérifiez que les requêtes, codes ou jetons d'authentification out-of-band, ainsi que les mots de passe à usage unique (TOTP), ont une durée de vie définie. Les requêtes out-of-band doivent avoir une durée de vie maximale de 10 minutes et les TOTP, de 30 secondes.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.5", + "section_name": "Exigences générales en matière d'authentification multifacteur", + "req_id": "V6.5.6", + "req_description": "Vérifiez que tout facteur d’authentification (y compris les appareils physiques) peut être révoqué en cas de vol ou autre perte.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.5", + "section_name": "Exigences générales en matière d'authentification multifacteur", + "req_id": "V6.5.7", + "req_description": "Vérifiez que les mécanismes d’authentification biométrique ne sont utilisés que comme facteurs secondaires, avec quelque chose que vous possédez ou quelque chose que vous savez.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.5", + "section_name": "Exigences générales en matière d'authentification multifacteur", + "req_id": "V6.5.8", + "req_description": "Vérifiez que les mots de passe à usage unique basés sur le temps (TOTP) sont vérifiés en fonction d'une source temporelle provenant d'un service de confiance et non d'une heure non fiable ou fournie par le client.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.6", + "section_name": "Mécanismes d'authentification out-of-band", + "req_id": "V6.6.1", + "req_description": "Vérifier que les mécanismes d'authentification utilisant le réseau téléphonique public commuté (RTPC) pour la transmission de mots de passe à usage unique (OTP) par téléphone ou SMS ne sont proposés que lorsque le numéro de téléphone a été préalablement validé. D'autres méthodes plus robustes (telles que les mots de passe à usage unique à durée déterminée) sont également proposées, et que le service informe les utilisateurs des risques de sécurité qu'elles présentent. Pour les applications de niveau 3, le téléphone et les SMS ne doivent pas être disponibles.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.6", + "section_name": "Mécanismes d'authentification out-of-band", + "req_id": "V6.6.2", + "req_description": "Vérifiez que les demandes d’authentification out-of-band, les codes ou les jetons sont liés à la demande d’authentification d’origine pour laquelle ils ont été générés et ne sont pas utilisables pour une demande précédente ou ultérieure.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.6", + "section_name": "Mécanismes d'authentification out-of-band", + "req_id": "V6.6.3", + "req_description": "Vérifiez qu'un mécanisme d'authentification out-of-band basé sur du code est protégé contre les attaques par force brute grâce au \"rate limiting\". Envisagez également d'utiliser un code avec au moins 64 bits d'entropie.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.6", + "section_name": "Mécanismes d'authentification out-of-band", + "req_id": "V6.6.4", + "req_description": "Vérifiez que, lorsque les notifications push sont utilisées pour l'authentification multifacteur, le \"rate limiting\" est appliqué afin d'empêcher les attaques de type « push bombing ». La concordance des numéros peut également atténuer ce risque.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.7", + "section_name": "Mécanisme d'authentification cryptographique", + "req_id": "V6.7.1", + "req_description": "Vérifiez que les certificats utilisés pour vérifier les assertions d’authentification cryptographique sont stockés de manière à les protéger contre toute modification.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.7", + "section_name": "Mécanisme d'authentification cryptographique", + "req_id": "V6.7.2", + "req_description": "Vérifiez que le nonce de défi a une longueur d'au moins 64 bits et qu'il est statistiquement unique ou unique sur toute la durée de vie du périphérique cryptographique.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.8", + "section_name": "Authentification avec un fournisseur d'identité", + "req_id": "V6.8.1", + "req_description": "Vérifiez que, si l'application prend en charge plusieurs fournisseurs d'identité (IdP), l'identité de l'utilisateur ne peut pas être usurpée via un autre fournisseur d'identité pris en charge (par exemple, en utilisant le même identifiant utilisateur). La mesure standard consisterait à ce que l'application enregistre et identifie l'utilisateur à l'aide d'une combinaison de l'ID du fournisseur d'identité (servant d'espace de noms) et de l'ID de l'utilisateur dans le fournisseur d'identité.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.8", + "section_name": "Authentification avec un fournisseur d'identité", + "req_id": "V6.8.2", + "req_description": "Vérifiez que la présence et l'intégrité des signatures numériques sur les assertions d'authentification (par exemple sur les assertions JWT ou SAML) sont toujours validées, en rejetant toutes les assertions non signées ou ayant des signatures non valides.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.8", + "section_name": "Authentification avec un fournisseur d'identité", + "req_id": "V6.8.3", + "req_description": "Vérifiez que les assertions SAML sont traitées de manière unique et utilisées une seule fois au cours de la période de validité pour éviter les attaques par rejeu.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.8", + "section_name": "Authentification avec un fournisseur d'identité", + "req_id": "V6.8.4", + "req_description": "Si une application utilise un fournisseur d'identité (IdP) distinct et attend une force, des méthodes ou une date d'authentification spécifiques pour des fonctions spécifiques, vérifiez que l'application les vérifie à l'aide des informations renvoyées par l'IdP. Par exemple, si OIDC est utilisé, cela peut être réalisé en validant les affirmations de jeton d'identification telles que « acr », « amr » et « auth_time » (le cas échéant). Si l'IdP ne fournit pas ces informations, l'application doit disposer d'une approche de secours documentée qui suppose que le mécanisme d'authentification de force minimale a été utilisé (par exemple, une authentification à facteur unique avec nom d'utilisateur et mot de passe).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.1", + "section_name": "Documentation sur la gestion des sessions", + "req_id": "V7.1.1", + "req_description": "Vérifiez que le délai d'inactivité de la session de l'utilisateur et la durée de vie maximale absolue de la session sont documentés, sont appropriés en combinaison avec d'autres contrôles et que la documentation inclut une justification de tout écart par rapport aux exigences de réauthentification NIST SP 800-63B.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.1", + "section_name": "Documentation sur la gestion des sessions", + "req_id": "V7.1.2", + "req_description": "Vérifiez que la documentation définit le nombre de sessions simultanées (parallèles) autorisées pour un compte ainsi que les comportements et actions prévus à entreprendre lorsque le nombre maximal de sessions actives est atteint.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.1", + "section_name": "Documentation sur la gestion des sessions", + "req_id": "V7.1.3", + "req_description": "Vérifiez que tous les systèmes qui créent et gèrent des sessions utilisateur dans le cadre d'un écosystème de gestion des identités fédérées (tels que les systèmes SSO) sont documentés avec des contrôles pour coordonner la durée de vie des sessions, la résiliation et toute autre condition nécessitant une réauthentification.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.2", + "section_name": "Sécurité fondamentale de la gestion des sessions", + "req_id": "V7.2.1", + "req_description": "Vérifiez que l’application effectue toutes les vérifications des jetons de session à l’aide d’un service backend de confiance.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.2", + "section_name": "Sécurité fondamentale de la gestion des sessions", + "req_id": "V7.2.2", + "req_description": "Vérifiez que l'application utilise des jetons autonomes ou de référence générés dynamiquement pour la gestion des sessions, c'est-à-dire sans utiliser de secrets et de clés d'API statiques.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.2", + "section_name": "Sécurité fondamentale de la gestion des sessions", + "req_id": "V7.2.3", + "req_description": "Vérifiez que si des jetons par référence sont utilisés pour représenter les sessions utilisateur, ils sont uniques et générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et possèdent au moins 128 bits d'entropie.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.2", + "section_name": "Sécurité fondamentale de la gestion des sessions", + "req_id": "V7.2.4", + "req_description": "Vérifiez que l’application génère un nouveau jeton de session lors de l’authentification de l’utilisateur, y compris la réauthentification, et met fin au jeton de session actuel.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.3", + "section_name": "Délai d'expiration de la session", + "req_id": "V7.3.1", + "req_description": "Vérifiez qu’il existe un délai d’inactivité tel que la réauthentification soit appliquée conformément à l’analyse des risques et aux décisions de sécurité documentées.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.3", + "section_name": "Délai d'expiration de la session", + "req_id": "V7.3.2", + "req_description": "Vérifiez qu'il existe une durée de vie maximale absolue de la session de sorte que la réauthentification soit appliquée conformément à l'analyse des risques et aux décisions de sécurité documentées.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.4", + "section_name": "Fin de session", + "req_id": "V7.4.1", + "req_description": "Vérifiez que lorsque la fin de session est déclenchée (par exemple, déconnexion ou expiration), l'application interdit toute utilisation ultérieure de la session. Pour les jetons par référence ou les sessions avec état, cela implique l'invalidation des données de session au niveau du backend de l'application. Les applications utilisant des jetons autonomes nécessiteront une solution, comme la gestion d'une liste des jetons terminés, l'interdiction des jetons produits avant une date et une heure spécifique à chaque utilisateur ou la rotation d'une clé de signature spécifique à chaque utilisateur.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.4", + "section_name": "Fin de session", + "req_id": "V7.4.2", + "req_description": "Vérifiez que l'application met fin à toutes les sessions actives lorsqu'un compte utilisateur est désactivé ou supprimé (par exemple, lorsqu'un employé quitte l'entreprise).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.4", + "section_name": "Fin de session", + "req_id": "V7.4.3", + "req_description": "Vérifiez que l'application offre la possibilité de mettre fin à toutes les autres sessions actives après une modification ou une suppression réussie de tout facteur d'authentification (y compris la modification du mot de passe via une réinitialisation ou une récupération et, le cas échéant, une mise à jour des paramètres MFA).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.4", + "section_name": "Fin de session", + "req_id": "V7.4.4", + "req_description": "Vérifiez que toutes les pages nécessitant une authentification disposent d’un accès facile et visible à la fonctionnalité de déconnexion.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.4", + "section_name": "Fin de session", + "req_id": "V7.4.5", + "req_description": "Vérifiez que les administrateurs d’applications sont en mesure de mettre fin aux sessions actives pour un utilisateur individuel ou pour tous les utilisateurs.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.5", + "section_name": "Défenses contre les abus de session", + "req_id": "V7.5.1", + "req_description": "Vérifiez que l'application nécessite une réauthentification complète avant d'autoriser les modifications des attributs de compte sensibles qui peuvent affecter l'authentification, tels que l'adresse e-mail, le numéro de téléphone, la configuration MFA ou d'autres informations utilisées dans la récupération de compte.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.5", + "section_name": "Défenses contre les abus de session", + "req_id": "V7.5.2", + "req_description": "Vérifiez que les utilisateurs peuvent afficher et (après s'être authentifiés à nouveau avec au moins un facteur) terminer une ou toutes les sessions actuellement actives.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.5", + "section_name": "Défenses contre les abus de session", + "req_id": "V7.5.3", + "req_description": "Vérifiez que l’application nécessite une authentification supplémentaire avec au moins un facteur ou une vérification secondaire avant d’effectuer des transactions ou des opérations hautement sensibles.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.6", + "section_name": "Réauthentification fédérée", + "req_id": "V7.6.1", + "req_description": "Vérifiez que la durée de vie et la fin de la session entre les parties de confiance (RP) et les fournisseurs d'identité (IdP) se comportent comme documenté, en exigeant une réauthentification si nécessaire, par exemple lorsque le temps maximal entre les événements d'authentification IdP est atteint.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.6", + "section_name": "Réauthentification fédérée", + "req_id": "V7.6.2", + "req_description": "Vérifiez que la création d'une session nécessite soit le consentement de l'utilisateur, soit une action explicite, empêchant ainsi la création de nouvelles sessions d'application sans interaction de l'utilisateur.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.1", + "section_name": "Documentation d'autorisation", + "req_id": "V8.1.1", + "req_description": "Vérifiez que la documentation d’autorisation définit des règles de restriction de l’accès au niveau de la fonction et aux données en fonction des autorisations du consommateur et des attributs des ressources.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.1", + "section_name": "Documentation d'autorisation", + "req_id": "V8.1.2", + "req_description": "Vérifiez que la documentation d'autorisation définit les règles de restriction d'accès au niveau des champs (lecture et écriture) en fonction des autorisations des consommateurs et des attributs des ressources. Notez que ces règles peuvent dépendre d'autres valeurs d'attributs de l'objet de données concerné, telles que l'état ou le statut.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.1", + "section_name": "Documentation d'autorisation", + "req_id": "V8.1.3", + "req_description": "Vérifiez que la documentation de l'application définit les attributs environnementaux et contextuels (y compris, mais sans s'y limiter, l'heure de la journée, l'emplacement de l'utilisateur, l'adresse IP ou l'appareil) qui sont utilisés dans l'application pour prendre des décisions de sécurité, y compris celles relatives à l'authentification et à l'autorisation.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.1", + "section_name": "Documentation d'autorisation", + "req_id": "V8.1.4", + "req_description": "Vérifier que la documentation d'authentification et d'autorisation définit l'utilisation des facteurs environnementaux et contextuels dans la prise de décision, en plus des autorisations au niveau des fonctions, des données et des champs. Cela doit inclure les attributs évalués, les seuils de risque et les actions entreprises (par exemple, autorisation, contestation, refus, renforcement de l'authentification).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.2", + "section_name": "Conception d'autorisation générale", + "req_id": "V8.2.1", + "req_description": "Vérifiez que l’application garantit que l’accès basé sur la fonction est limité aux consommateurs disposant d’autorisations explicites.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.2", + "section_name": "Conception d'autorisation générale", + "req_id": "V8.2.2", + "req_description": "Vérifiez que l'application garantit que l'accès spécifique aux données est limité aux consommateurs disposant d'autorisations explicites sur des éléments de données spécifiques afin d'atténuer les références d'objet directes non sécurisées (IDOR) et les autorisations de niveau d'objet rompues (BOLA).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.2", + "section_name": "Conception d'autorisation générale", + "req_id": "V8.2.3", + "req_description": "Vérifiez que l'application garantit que l'accès au niveau du champ est limité aux consommateurs disposant d'autorisations explicites sur des champs spécifiques afin d'atténuer les problèmes d'autorisation au niveau de la propriété d'objet (BOPLA).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.2", + "section_name": "Conception d'autorisation générale", + "req_id": "V8.2.4", + "req_description": "Vérifiez que les contrôles de sécurité adaptatifs basés sur les attributs environnementaux et contextuels du consommateur (tels que l'heure, la localisation, l'adresse IP ou l'appareil) sont mis en œuvre pour les décisions d'authentification et d'autorisation, comme défini dans la documentation de l'application. Ces contrôles doivent être appliqués lorsque le consommateur tente de démarrer une nouvelle session et également pendant une session existante.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.3", + "section_name": "Autorisation par opération", + "req_id": "V8.3.1", + "req_description": "Vérifier que l'application applique les règles d'autorisations au niveau de la couche service de confiance et ne s’appuie pas sur des contrôles qu’un consommateur non approuvé pourrait manipuler, comme JavaScript côté client.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.3", + "section_name": "Autorisation par opération", + "req_id": "V8.3.2", + "req_description": "Vérifiez que les modifications apportées aux valeurs sur lesquelles reposent les décisions d'autorisation sont appliquées immédiatement. Lorsque les modifications ne peuvent pas être appliquées immédiatement (par exemple, en s'appuyant sur des données de jetons autonomes), des contrôles d'atténuation doivent être mis en place pour alerter un consommateur lorsqu'il effectue une action alors qu'il n'est plus autorisé à le faire et annuler la modification. Notez que cette solution alternative ne limiterait pas les fuites d'informations.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.3", + "section_name": "Autorisation par opération", + "req_id": "V8.3.3", + "req_description": "Vérifiez que l'accès à un objet repose sur les autorisations du sujet d'origine (par exemple, le consommateur), et non sur celles d'un intermédiaire ou d'un service agissant en son nom. Par exemple, si un consommateur appelle un service web à l'aide d'un jeton d'authentification autonome, et que ce service demande ensuite des données à un autre service, ce dernier utilisera le jeton du consommateur, plutôt qu'un jeton inter-machine du premier service, pour prendre les décisions d'autorisation.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.4", + "section_name": "Autres considérations relatives à l'autorisation", + "req_id": "V8.4.1", + "req_description": "Vérifiez que les applications multi-tenants utilisent des contrôles inter-tenants pour garantir que les opérations des consommateurs n'affecteront jamais les tenants avec lesquels ils ne sont pas autorisés à interagir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.4", + "section_name": "Autres considérations relatives à l'autorisation", + "req_id": "V8.4.2", + "req_description": "Vérifiez que l'accès aux interfaces administratives intègre plusieurs couches de sécurité, notamment la vérification continue de l'identité du consommateur, l'évaluation de la posture de sécurité des appareils et l'analyse contextuelle des risques, garantissant que l'emplacement du réseau ou les endpoints approuvés ne sont pas les seuls facteurs d'autorisation, même s'ils peuvent réduire la probabilité d'accès non autorisé.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Jetons autonomes", + "section_id": "V9.1", + "section_name": "Source et intégrité du jeton", + "req_id": "V9.1.1", + "req_description": "Vérifiez que les jetons autonomes sont validés à l'aide de leur signature numérique ou MAC pour les protéger contre toute falsification avant d'accepter le contenu du jeton.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Jetons autonomes", + "section_id": "V9.1", + "section_name": "Source et intégrité du jeton", + "req_id": "V9.1.2", + "req_description": "Vérifiez que seuls les algorithmes d'une liste d’autorisations peuvent être utilisés pour créer et vérifier des jetons autonomes, dans un contexte donné. La liste d'autorisation doit inclure les algorithmes autorisés, idéalement symétriques ou asymétriques, et ne doit pas inclure l'algorithme « Aucun ». Si les algorithmes symétriques et asymétriques doivent être pris en charge, des contrôles supplémentaires seront nécessaires pour éviter toute confusion de clés.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Jetons autonomes", + "section_id": "V9.1", + "section_name": "Source et intégrité du jeton", + "req_id": "V9.1.3", + "req_description": "Vérifiez que les clés utilisées pour valider les jetons autonomes proviennent de sources préconfigurées et fiables pour l'émetteur du jeton, empêchant ainsi les attaquants de spécifier des sources et des clés non fiables. Pour les JWT et autres structures JWS, les en-têtes tels que « jku », « x5u » et « jwk » doivent être validés par rapport à une liste d'autorisation de sources fiables.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Jetons autonomes", + "section_id": "V9.2", + "section_name": "Contenu du jeton", + "req_id": "V9.2.1", + "req_description": "Vérifiez que, si une période de validité est indiquée dans les données du jeton, celui-ci et son contenu ne sont acceptés que si la date de vérification est comprise dans cette période. Par exemple, pour les JWT, les déclarations « nbf » et « exp » doivent être vérifiées.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Jetons autonomes", + "section_id": "V9.2", + "section_name": "Contenu du jeton", + "req_id": "V9.2.2", + "req_description": "Vérifiez que le service recevant un jeton valide le type de jeton et son utilisation avant d'en accepter le contenu. Par exemple, seuls les jetons d'accès peuvent être acceptés pour les décisions d'autorisation, et seuls les jetons d'identification peuvent être utilisés pour prouver l'authentification des utilisateurs.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Jetons autonomes", + "section_id": "V9.2", + "section_name": "Contenu du jeton", + "req_id": "V9.2.3", + "req_description": "Vérifiez que le service accepte uniquement les jetons destinés à être utilisés avec ce service (audience). Pour les JWT, cela peut être réalisé en validant la déclaration « aud » par rapport à une liste d'autorisation définie dans le service.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Jetons autonomes", + "section_id": "V9.2", + "section_name": "Contenu du jeton", + "req_id": "V9.2.4", + "req_description": "Si un émetteur de jetons utilise la même clé privée pour émettre des jetons destinés à différentes audiences, vérifiez que les jetons émis contiennent une restriction d'audience identifiant de manière unique les audiences visées. Cela empêchera la réutilisation d'un jeton avec une audience non prévue. Si l'identifiant d'audience est provisionné dynamiquement, l'émetteur de jetons doit valider ces audiences afin de garantir qu'elles n'entraînent pas d'usurpation d'identité.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.1", + "section_name": "Sécurité générique OAuth et OIDC", + "req_id": "V10.1.1", + "req_description": "Vérifiez que les jetons sont envoyés uniquement aux composants qui en ont absolument besoin. Par exemple, lors de l'utilisation d'un modèle backend-for-frontend pour les applications JavaScript basées sur un navigateur, les jetons d'accès et d'actualisation ne doivent être accessibles qu'au backend.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.1", + "section_name": "Sécurité générique OAuth et OIDC", + "req_id": "V10.1.2", + "req_description": "Vérifiez que le client n'accepte les valeurs du serveur d'autorisation (telles que le code d'autorisation ou le jeton d'identification) que si elles résultent d'un flux d'autorisation initié par la même session d'agent utilisateur et la même transaction. Cela nécessite que les secrets générés par le client, tels que la clé de preuve pour l'échange de codes (PKCE) « code_verifier », « state » ou le nonce OIDC, ne puissent être devinés, soient spécifiques à la transaction et soient liés de manière sécurisée au client et à la session d'agent utilisateur au cours de laquelle la transaction a été initiée.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.2", + "section_name": "Client OAuth", + "req_id": "V10.2.1", + "req_description": "Vérifiez que, si le flux de code est utilisé, le client OAuth dispose d'une protection contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF), qui déclenchent des demandes de jetons, soit en utilisant la fonctionnalité de clé de preuve pour l'échange de code (PKCE), soit en vérifiant le paramètre « state » envoyé dans la demande d'autorisation.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.2", + "section_name": "Client OAuth", + "req_id": "V10.2.2", + "req_description": "Vérifiez que, si le client OAuth peut interagir avec plusieurs serveurs d'autorisation, il dispose d'une protection contre les attaques par confusion. Par exemple, il peut exiger que le serveur d'autorisation renvoie la valeur du paramètre « iss » et la valide dans la réponse d'autorisation et la réponse du jeton.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.2", + "section_name": "Client OAuth", + "req_id": "V10.2.3", + "req_description": "Vérifiez que le client OAuth demande uniquement les portées requises (ou d’autres paramètres d’autorisation) dans les requêtes adressées au serveur d’autorisation.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.3", + "section_name": "Serveur de ressources OAuth", + "req_id": "V10.3.1", + "req_description": "Vérifiez que le serveur de ressources accepte uniquement les jetons d'accès destinés à être utilisés avec ce service (audience). L'audience peut être incluse dans un jeton d'accès structuré (comme la déclaration « aud » dans JWT) ou vérifiée à l'aide du endpoint d'introspection de jeton.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.3", + "section_name": "Serveur de ressources OAuth", + "req_id": "V10.3.2", + "req_description": "Vérifiez que le serveur de ressources applique les décisions d'autorisation en fonction des déclarations du jeton d'accès définissant l'autorisation déléguée. Si des déclarations telles que « sub », « scope » et « authorization_details » sont présentes, elles doivent être prises en compte dans la décision.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.3", + "section_name": "Serveur de ressources OAuth", + "req_id": "V10.3.3", + "req_description": "Vérifiez que si une décision de contrôle d'accès nécessite l'identification d'un utilisateur unique à partir d'un jeton d'accès (JWT ou réponse d'introspection de jeton associé), le serveur de ressources identifie l'utilisateur à partir de déclarations non ré attribuables à d'autres utilisateurs. En général, cela implique l'utilisation d'une combinaison de déclarations « iss » et « sub ».", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.3", + "section_name": "Serveur de ressources OAuth", + "req_id": "V10.3.4", + "req_description": "Si le serveur de ressources requiert une force d'authentification, des méthodes ou une date d'expiration spécifiques, vérifiez que le jeton d'accès présenté respecte ces contraintes. Par exemple, s'il est présent, utilisez les déclarations OIDC « acr », « amr » et « auth_time » respectivement.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.3", + "section_name": "Serveur de ressources OAuth", + "req_id": "V10.3.5", + "req_description": "Vérifiez que le serveur de ressources empêche l'utilisation de jetons d'accès volés ou la relecture de jetons d'accès (de parties non autorisées) en exigeant des jetons d'accès limités par l'expéditeur, soit Mutual TLS pour OAuth 2, soit OAuth 2 Demonstration of Proof of Possession (DPoP).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.1", + "req_description": "Vérifiez que le serveur d'autorisation valide les URI de redirection en fonction d'une liste d'autorisation spécifique au client d'URI préenregistrés à l'aide d'une comparaison de chaînes exacte.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.2", + "req_description": "Vérifiez que, si le serveur d'autorisation renvoie le code d'autorisation dans la réponse, celui-ci ne peut être utilisé qu'une seule fois pour une demande de jeton. Pour la deuxième demande valide avec un code d'autorisation déjà utilisé pour émettre un jeton d'accès, le serveur d'autorisation doit rejeter la demande de jeton et révoquer tous les jetons émis liés au code d'autorisation.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.3", + "req_description": "Vérifiez que le code d'autorisation est de courte durée. La durée de vie maximale peut atteindre 10 minutes pour les applications L1 et L2 et 1 minute pour les applications L3.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.4", + "req_description": "Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement l'utilisation des autorisations nécessaires à ce client. Notez que les autorisations « token » (flux implicite) et « password » (flux d'informations d'identification du propriétaire de la ressource) ne doivent plus être utilisées.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.5", + "req_description": "Vérifiez que le serveur d'autorisation atténue les attaques par rejeu de jetons d'actualisation pour les clients publics, de préférence en utilisant des jetons d'actualisation limités par l'expéditeur, par exemple des jetons DPoP (Demonstrating Proof of Possession) ou des jetons d'accès liés à un certificat utilisant le protocole TLS mutuel (mTLS). Pour les applications L1 et L2, la rotation des jetons d'actualisation peut être utilisée. Si cette rotation est utilisée, le serveur d'autorisation doit invalider le jeton d'actualisation après utilisation et révoquer tous les jetons d'actualisation de cette autorisation si un jeton d'actualisation déjà utilisé et invalidé est fourni.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.6", + "req_description": "Vérifiez que, si l'octroi de code est utilisé, le serveur d'autorisation atténue les attaques par interception de code en exigeant une clé de preuve pour l'échange de code (PKCE). Pour les demandes d'autorisation, le serveur d'autorisation doit exiger une valeur « code_challenge » valide et ne doit pas accepter une valeur « plain » pour « code_challenge_method ». Pour une demande de jeton, il doit exiger la validation du paramètre « code_verifier ».", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.7", + "req_description": "Vérifiez que si le serveur d'autorisation prend en charge l'enregistrement dynamique des clients non authentifiés, il réduit le risque d'applications clientes malveillantes. Il doit valider les métadonnées clientes, telles que les URI enregistrés, garantir le consentement de l'utilisateur et l'avertir avant de traiter une demande d'autorisation avec une application cliente non approuvée.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.8", + "req_description": "Vérifiez que les jetons d’actualisation ont une expiration absolue, y compris si l’expiration du jeton d’actualisation glissant est appliquée.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.9", + "req_description": "Vérifiez que les jetons d'actualisation et les jetons d'accès de référence peuvent être révoqués par un utilisateur autorisé à l'aide de l'interface utilisateur du serveur d'autorisation, afin d'atténuer le risque de clients malveillants ou de jetons volés.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.10", + "req_description": "Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.11", + "req_description": "Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.12", + "req_description": "Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement la valeur « response_mode » dont ce client a besoin. Par exemple, en vérifiant cette valeur par rapport aux valeurs attendues ou en utilisant une requête d'autorisation poussée (PAR) ou une requête d'autorisation sécurisée par JWT (JAR).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.13", + "req_description": "Vérifiez que le type d'Autorisation « code » est toujours utilisé avec les demandes d'autorisation poussées (PAR).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.14", + "req_description": "Vérifiez que le serveur d'autorisation émet uniquement des jetons d'accès limités à l'expéditeur (preuve de possession), soit avec des jetons d'accès liés au certificat utilisant TLS mutuel (mTLS), soit avec des jetons d'accès liés au DPoP (démonstration de preuve de possession).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.15", + "req_description": "Vérifiez que, pour un client côté serveur (non exécuté sur l'appareil de l'utilisateur final), le serveur d'autorisation garantit que la valeur du paramètre « authorization_details » provient du backend client et que l'utilisateur ne l'a pas altérée. Par exemple, en exigeant l'utilisation d'une demande d'autorisation poussée (PAR) ou d'une demande d'autorisation sécurisée par JWT (JAR).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.16", + "req_description": "Vérifiez que le client est confidentiel et que le serveur d'autorisation requiert l'utilisation de méthodes d'authentification client fortes (basées sur la cryptographie à clé publique et résistantes aux attaques par relecture), telles que TLS mutuel ('tls_client_auth', 'self_signed_tls_client_auth') ou JWT à clé privée ('private_key_jwt').", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.5", + "section_name": "Client OIDC", + "req_id": "V10.5.1", + "req_description": "Vérifiez que le client (en tant que partie utilisatrice) atténue les attaques par rejeu de jeton d'identification. Par exemple, en vous assurant que la valeur « nonce » du jeton d'identification correspond à la valeur « nonce » envoyée dans la demande d'authentification au fournisseur OpenID (appelée demande d'autorisation envoyée au serveur d'autorisation dans OAuth2).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.5", + "section_name": "Client OIDC", + "req_id": "V10.5.2", + "req_description": "Vérifiez que le client identifie de manière unique l'utilisateur à partir des déclarations de jeton d'identification, généralement la déclaration « sub », qui ne peut pas être réaffectée à d'autres utilisateurs (pour la portée d'un fournisseur d'identité).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.5", + "section_name": "Client OIDC", + "req_id": "V10.5.3", + "req_description": "Vérifiez que le client rejette les tentatives d'un serveur d'autorisation malveillant d'usurper l'identité d'un autre serveur d'autorisation via ses métadonnées. Le client doit rejeter les métadonnées du serveur d'autorisation si l'URL de l'émetteur figurant dans ces métadonnées ne correspond pas exactement à l'URL d'émetteur préconfigurée attendue par le client.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.5", + "section_name": "Client OIDC", + "req_id": "V10.5.4", + "req_description": "Vérifiez que le client valide que le jeton d'identification est destiné à être utilisé pour ce client (audience) en vérifiant que la déclaration « aud » du jeton est égale à la valeur « client_id » pour le client.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.5", + "section_name": "Client OIDC", + "req_id": "V10.5.5", + "req_description": "Vérifiez que, lors de l'utilisation de la déconnexion du back-channel OIDC, la partie utilisatrice atténue les risques de déni de service liés à la déconnexion forcée et à la confusion entre JWT dans le flux de déconnexion. Le client doit vérifier que le jeton de déconnexion est correctement typé avec la valeur « logout+jwt », qu'il contient la déclaration « event » avec le nom de membre correct et qu'il ne contient pas de déclaration « nonce ». Il est également recommandé d'utiliser une expiration courte (par exemple, 2 minutes).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.6", + "section_name": "Fournisseur OpenID", + "req_id": "V10.6.1", + "req_description": "Vérifiez que le fournisseur OpenID n'autorise que les valeurs « code », « ciba », « id_token » ou « id_token code » pour le mode de réponse. Notez que « code » est préférable à « id_token code » (flux hybride OIDC) et que « token » (tout flux implicite) ne doit pas être utilisé.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.6", + "section_name": "Fournisseur OpenID", + "req_id": "V10.6.2", + "req_description": "Vérifiez que le fournisseur OpenID atténue les risques de déni de service liés à la déconnexion forcée. Pour ce faire, obtenez une confirmation explicite de l'utilisateur final ou, le cas échéant, validez les paramètres de la requête de déconnexion (initiée par la partie utilisatrice), comme « id_token_hint ».", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.7", + "section_name": "Gestion du consentement", + "req_id": "V10.7.1", + "req_description": "Vérifiez que le serveur d'autorisation garantit le consentement de l'utilisateur à chaque demande d'autorisation. Si l'identité du client ne peut être garantie, le serveur d'autorisation doit toujours demander explicitement le consentement de l'utilisateur.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.7", + "section_name": "Gestion du consentement", + "req_id": "V10.7.2", + "req_description": "Vérifiez que lorsque le serveur d'autorisation demande le consentement de l'utilisateur, il fournit des informations claires et suffisantes sur ce qui est consenti. Le cas échéant, ces informations doivent inclure la nature des autorisations demandées (généralement en fonction de la portée, du serveur de ressources et des détails d'autorisation RAR), l'identité de l'application autorisée et la durée de vie de ces autorisations.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.7", + "section_name": "Gestion du consentement", + "req_id": "V10.7.3", + "req_description": "Vérifiez que l’utilisateur peut consulter, modifier et révoquer les consentements qu’il a accordés via le serveur d’autorisation.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.1", + "section_name": "Inventaire et documentation cryptographiques", + "req_id": "V11.1.1", + "req_description": "Vérifiez qu’il existe une politique documentée pour la gestion des clés cryptographiques et un cycle de vie des clés cryptographiques qui suit une norme de gestion des clés telle que NIST SP 800-57. Cela devrait inclure la garantie que les clés ne sont pas sur-partagées (par exemple, avec plus de deux entités pour les secrets partagés et plus d’une entité pour les clés privées).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.1", + "section_name": "Inventaire et documentation cryptographiques", + "req_id": "V11.1.2", + "req_description": "Vérifiez qu'un inventaire cryptographique est réalisé, maintenu et régulièrement mis à jour, et qu'il inclut toutes les clés, algorithmes et certificats cryptographiques utilisés par l'application. Il doit également documenter les emplacements du système où les clés peuvent ou non être utilisées, ainsi que les types de données qui peuvent ou non être protégées par ces clés.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.1", + "section_name": "Inventaire et documentation cryptographiques", + "req_id": "V11.1.3", + "req_description": "Vérifiez que les mécanismes de découverte cryptographique sont utilisés pour identifier toutes les instances de cryptographie dans le système, y compris les opérations de chiffrement, de hachage et de signature.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.1", + "section_name": "Inventaire et documentation cryptographiques", + "req_id": "V11.1.4", + "req_description": "Vérifier la tenue d'un inventaire cryptographique. Celui-ci doit inclure un plan documenté décrivant la migration vers de nouvelles normes cryptographiques, telles que la cryptographie post-quantique, afin de réagir aux menaces futures.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.2", + "section_name": "Mise en œuvre sécurisée de la cryptographie", + "req_id": "V11.2.1", + "req_description": "Vérifiez que les implémentations validées par l’industrie (y compris les bibliothèques et les implémentations accélérées par le matériel) sont utilisées pour les opérations cryptographiques.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.2", + "section_name": "Mise en œuvre sécurisée de la cryptographie", + "req_id": "V11.2.2", + "req_description": "Vérifiez que l'application est conçue avec une agilité cryptographique, de sorte que les nombres aléatoires, le chiffrement authentifié, le MAC ou les algorithmes de hachage, les longueurs de clés, les tours, les chiffrements et les modes puissent être reconfigurés, mis à niveau ou échangés à tout moment, afin de se protéger contre les failles cryptographiques. De même, il doit être possible de remplacer les clés et les mots de passe, ainsi que de rechiffrer les données. Cela permettra des mises à niveau transparentes vers la cryptographie post-quantique (PQC), une fois que des implémentations hautement sécurisées de schémas ou de normes PQC approuvés seront largement disponibles.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.2", + "section_name": "Mise en œuvre sécurisée de la cryptographie", + "req_id": "V11.2.3", + "req_description": "Vérifiez que toutes les primitives cryptographiques utilisent un minimum de 128 bits de sécurité en fonction de l'algorithme, de la taille de la clé et de la configuration. Par exemple, une clé ECC de 256 bits offre environ 128 bits de sécurité, tandis que RSA nécessite une clé de 3072 bits pour atteindre 128 bits de sécurité.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.2", + "section_name": "Mise en œuvre sécurisée de la cryptographie", + "req_id": "V11.2.4", + "req_description": "Vérifiez que toutes les opérations cryptographiques sont à temps constant, sans opérations de « court-circuit » dans les comparaisons, les calculs ou les retours, pour éviter toute fuite d'informations.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.2", + "section_name": "Mise en œuvre sécurisée de la cryptographie", + "req_id": "V11.2.5", + "req_description": "Vérifiez que tous les modules cryptographiques échouent en toute sécurité et que les erreurs sont gérées de manière à ne pas permettre de vulnérabilités, telles que les attaques Padding Oracle.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.3", + "section_name": "Algorithmes de chiffrement", + "req_id": "V11.3.1", + "req_description": "Vérifiez que les modes de bloc non sécurisés (par exemple, ECB) et les schémas de remplissage faibles (par exemple, PKCS#1 v1.5) ne sont pas utilisés.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.3", + "section_name": "Algorithmes de chiffrement", + "req_id": "V11.3.2", + "req_description": "Vérifiez que seuls les chiffrements et modes approuvés tels que AES avec GCM sont utilisés.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.3", + "section_name": "Algorithmes de chiffrement", + "req_id": "V11.3.3", + "req_description": "Vérifiez que les données chiffrées sont protégées contre toute modification non autorisée, de préférence en utilisant une méthode de chiffrement authentifiée approuvée ou en combinant une méthode de chiffrement approuvée avec un algorithme MAC approuvé.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.3", + "section_name": "Algorithmes de chiffrement", + "req_id": "V11.3.4", + "req_description": "Vérifiez que les nonces, les vecteurs d'initialisation et autres nombres à usage unique ne sont pas utilisés pour plus d'une paire clé de chiffrement/élément de données. La méthode de génération doit être adaptée à l'algorithme utilisé.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.3", + "section_name": "Algorithmes de chiffrement", + "req_id": "V11.3.5", + "req_description": "Vérifiez que toute combinaison d'un algorithme de chiffrement et d'un algorithme MAC fonctionne en mode chiffrement puis MAC.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.4", + "section_name": "Hachage et fonctions basées sur le hachage", + "req_id": "V11.4.1", + "req_description": "Vérifiez que seules les fonctions de hachage approuvées sont utilisées pour les cas d'utilisation cryptographiques généraux, notamment les signatures numériques, HMAC, KDF et la génération de bits aléatoires. Les fonctions de hachage non autorisées, telles que MD5, ne doivent pas être utilisées à des fins cryptographiques.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.4", + "section_name": "Hachage et fonctions basées sur le hachage", + "req_id": "V11.4.2", + "req_description": "Vérifiez que les mots de passe sont stockés à l'aide d'une fonction de dérivation de clés approuvée et gourmande en ressources de calcul (également appelée « fonction de hachage de mots de passe »), dont les paramètres sont configurés conformément aux directives en vigueur. Ces paramètres doivent équilibrer sécurité et performances afin de rendre les attaques par force brute suffisamment difficiles pour le niveau de sécurité requis.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.4", + "section_name": "Hachage et fonctions basées sur le hachage", + "req_id": "V11.4.3", + "req_description": "Vérifiez que les fonctions de hachage utilisées dans les signatures numériques, dans le cadre de l'authentification ou de l'intégrité des données, sont résistantes aux collisions et possèdent des longueurs de bits appropriées. Si la résistance aux collisions est requise, la longueur de sortie doit être d'au moins 256 bits. Si seule la résistance aux attaques de seconde pré-image est requise, la longueur de sortie doit être d'au moins 128 bits.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.4", + "section_name": "Hachage et fonctions basées sur le hachage", + "req_id": "V11.4.4", + "req_description": "Vérifiez que l'application utilise des fonctions de dérivation de clés approuvées avec des paramètres d'extension de clés lors de la dérivation de clés secrètes à partir de mots de passe. Les paramètres utilisés doivent concilier sécurité et performances afin d'empêcher les attaques par force brute de compromettre la clé cryptographique obtenue.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.5", + "section_name": "Valeurs aléatoires", + "req_id": "V11.5.1", + "req_description": "Vérifiez que tous les nombres et chaînes aléatoires destinés à être non devinables doivent être générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et posséder au moins 128 bits d'entropie. Notez que les UUID ne respectent pas cette condition.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.5", + "section_name": "Valeurs aléatoires", + "req_id": "V11.5.2", + "req_description": "Vérifiez que le mécanisme de génération de nombres aléatoires utilisé est conçu pour fonctionner en toute sécurité, même en cas de forte demande.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.6", + "section_name": "Cryptographie à clé publique", + "req_id": "V11.6.1", + "req_description": "Vérifier que seuls des algorithmes cryptographiques et des modes opératoires approuvés sont utilisés pour la génération et l'amorçage des clés, ainsi que pour la génération et la vérification des signatures numériques. Les algorithmes de génération de clés ne doivent pas générer de clés non sécurisées et vulnérables aux attaques connues, par exemple les clés RSA vulnérables à la factorisation de Fermat.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.6", + "section_name": "Cryptographie à clé publique", + "req_id": "V11.6.2", + "req_description": "Vérifiez que des algorithmes cryptographiques approuvés sont utilisés pour l'échange de clés (tels que Diffie-Hellman), en veillant à ce que les mécanismes d'échange de clés utilisent des paramètres sécurisés. Cela permettra d'éviter les attaques contre le processus d'établissement des clés, susceptibles de conduire à des attaques de type « adversaire du milieu » ou à des failles cryptographiques.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.7", + "section_name": "Cryptographie des données en cours d'utilisation", + "req_id": "V11.7.1", + "req_description": "Vérifiez que le chiffrement complet de la mémoire est utilisé pour protéger les données sensibles pendant leur utilisation, empêchant ainsi l'accès par des utilisateurs ou des processus non autorisés.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.7", + "section_name": "Cryptographie des données en cours d'utilisation", + "req_id": "V11.7.2", + "req_description": "Vérifiez que la minimisation des données garantit que la quantité minimale de données est exposée pendant le traitement et assurez-vous que les données sont chiffrées immédiatement après utilisation ou dès que possible.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.1", + "section_name": "Conseils généraux de sécurité TLS", + "req_id": "V12.1.1", + "req_description": "Vérifiez que seules les dernières versions recommandées du protocole TLS sont activées, telles que TLS 1.2 et TLS 1.3. La dernière version du protocole TLS doit être privilégiée.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.1", + "section_name": "Conseils généraux de sécurité TLS", + "req_id": "V12.1.2", + "req_description": "Vérifiez que seules les suites de chiffrement recommandées sont activées, les suites de chiffrement les plus puissantes étant définies comme préférées. Les applications L3 doivent uniquement prendre en charge les suites de chiffrement assurant la confidentialité persistante (forward secrecy).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.1", + "section_name": "Conseils généraux de sécurité TLS", + "req_id": "V12.1.3", + "req_description": "Vérifiez que l’application valide que les certificats clients mTLS sont approuvés avant d’utiliser l’identité du certificat pour l’authentification ou l’autorisation.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.1", + "section_name": "Conseils généraux de sécurité TLS", + "req_id": "V12.1.4", + "req_description": "Vérifiez que la révocation de certification appropriée, telle que l'agrafage du protocole OCSP (Online Certificate Status Protocol), est activée et configurée.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.1", + "section_name": "Conseils généraux de sécurité TLS", + "req_id": "V12.1.5", + "req_description": "Vérifiez que Encrypted Client Hello (ECH) est activé dans les paramètres TLS de l'application pour empêcher l'exposition de métadonnées sensibles, telles que l'indication du nom du serveur (SNI), pendant les processus de négociation TLS.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.2", + "section_name": "Communication HTTPS avec des services externes", + "req_id": "V12.2.1", + "req_description": "Vérifiez que TLS est utilisé pour toute connectivité entre un client et des services externes basés sur HTTP, et ne recourt pas à des communications non sécurisées ou non chiffrées.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.2", + "section_name": "Communication HTTPS avec des services externes", + "req_id": "V12.2.2", + "req_description": "Vérifiez que les services externes utilisent des certificats TLS publiquement approuvés.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.3", + "section_name": "Sécurité des communications entre services généraux", + "req_id": "V12.3.1", + "req_description": "Vérifiez qu'un protocole chiffré tel que TLS est utilisé pour toutes les connexions entrantes et sortantes vers et depuis l'application, y compris les systèmes de surveillance, les outils de gestion, l'accès à distance et SSH, les intergiciels, les bases de données, les mainframes, les systèmes partenaires ou les API externes. Le serveur ne doit pas recourir à des protocoles non sécurisés ou non chiffrés.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.3", + "section_name": "Sécurité des communications entre services généraux", + "req_id": "V12.3.2", + "req_description": "Vérifiez que les clients TLS valident les certificats reçus avant de communiquer avec un serveur TLS.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.3", + "section_name": "Sécurité des communications entre services généraux", + "req_id": "V12.3.3", + "req_description": "Vérifiez que TLS ou un autre mécanisme de chiffrement de transport approprié est utilisé pour toute connectivité entre les services internes basés sur HTTP au sein de l'application et ne se replie pas vers des communications non sécurisées ou non chiffrées.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.3", + "section_name": "Sécurité des communications entre services généraux", + "req_id": "V12.3.4", + "req_description": "Vérifiez que les connexions TLS entre les services internes utilisent des certificats de confiance. Lorsque des certificats générés en interne ou auto-signés sont utilisés, le service consommateur doit être configuré pour n'approuver que des autorités de certification internes spécifiques et des certificats auto-signés spécifiques.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.3", + "section_name": "Sécurité des communications entre services généraux", + "req_id": "V12.3.5", + "req_description": "Vérifiez que les services communiquant en interne au sein d'un système (communications intra-services) utilisent une authentification forte pour garantir la vérification de chaque endpoint. Des méthodes d'authentification forte, telles que l'authentification client TLS, doivent être utilisées pour garantir l'identité, en utilisant une infrastructure à clé publique et des mécanismes résistants aux attaques par rejeu. Pour les architectures de microservices, envisagez d'utiliser un maillage de services pour simplifier la gestion des certificats et renforcer la sécurité.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.1", + "section_name": "Documentation de configuration", + "req_id": "V13.1.1", + "req_description": "Vérifiez que tous les besoins de communication de l'application sont documentés. Cela doit inclure les services externes dont l'application dépend et les cas où un utilisateur final pourrait fournir un emplacement externe auquel l'application se connectera.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.1", + "section_name": "Documentation de configuration", + "req_id": "V13.1.2", + "req_description": "Vérifiez que pour chaque service utilisé par l'application, la documentation définit le nombre maximal de connexions simultanées (par exemple, les limites du pool de connexions) et le comportement de l'application lorsque cette limite est atteinte, y compris les mécanismes de secours ou de récupération, pour éviter les conditions de déni de service.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.1", + "section_name": "Documentation de configuration", + "req_id": "V13.1.3", + "req_description": "Vérifiez que la documentation de l'application définit des stratégies de gestion des ressources pour chaque système ou service externe utilisé (par exemple, bases de données, descripteurs de fichiers, threads, connexions HTTP). Cela doit inclure les procédures de libération des ressources, les paramètres de délai d'expiration, la gestion des échecs et l'implémentation de la logique de nouvelle tentative, en spécifiant les limites de nouvelle tentative, les délais et les algorithmes de retour arrière. Pour les opérations de requête-réponse HTTP synchrones, la documentation doit imposer des délais d'expiration courts et soit désactiver les nouvelles tentatives, soit les limiter strictement afin d'éviter les retards en cascade et l'épuisement des ressources.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.1", + "section_name": "Documentation de configuration", + "req_id": "V13.1.4", + "req_description": "Vérifiez que la documentation de l'application définit les secrets essentiels à la sécurité de l'application et un calendrier de rotation de ceux-ci, en fonction du modèle de menace et des exigences commerciales de l'organisation.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Configuration de la communication backend", + "req_id": "V13.2.1", + "req_description": "Vérifiez que les communications entre les composants de l'application backend qui ne prennent pas en charge le mécanisme de session utilisateur standard de l'application, notamment les API, les intergiciels et les couches de données, sont authentifiées. L'authentification doit utiliser des comptes de service individuels, des jetons à court terme ou une authentification par certificat, et non des identifiants immuables tels que des mots de passe, des clés API ou des comptes partagés avec accès privilégié.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Configuration de la communication backend", + "req_id": "V13.2.2", + "req_description": "Vérifiez que les communications entre les composants de l'application backend, y compris les services locaux ou du système d'exploitation, les API, les intergiciels et les couches de données, sont effectuées avec des comptes dotés des privilèges les moins nécessaires.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Configuration de la communication backend", + "req_id": "V13.2.3", + "req_description": "Vérifiez que si des informations d’identification doivent être utilisées pour l’authentification du service, les informations d’identification utilisées par le consommateur ne sont pas des informations d’identification par défaut (par exemple, root/root ou admin/admin).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Configuration de la communication backend", + "req_id": "V13.2.4", + "req_description": "Vérifiez qu'une liste d’autorisations est utilisée pour définir les ressources ou systèmes externes avec lesquels l'application est autorisée à communiquer (par exemple, pour les requêtes sortantes, les chargements de données ou l'accès aux fichiers). Cette liste d'autorisation peut être implémentée au niveau de la couche applicative, du serveur web, du pare-feu ou d'une combinaison de différentes couches.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Configuration de la communication backend", + "req_id": "V13.2.5", + "req_description": "Vérifiez que le serveur Web ou d’application est configuré avec une liste autorisée de ressources ou de systèmes vers lesquels le serveur peut envoyer des requêtes ou charger des données ou des fichiers.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Configuration de la communication backend", + "req_id": "V13.2.6", + "req_description": "Vérifiez que lorsque l'application se connecte à des services distincts, elle suit la configuration documentée pour chaque connexion, comme le nombre maximal de connexions parallèles, le comportement lorsque le nombre maximal de connexions autorisées est atteint, les délais d'expiration de connexion et les stratégies de nouvelle tentative.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.3", + "section_name": "Gestion des secrets", + "req_id": "V13.3.1", + "req_description": "Vérifiez qu'une solution de gestion des secrets, telle qu'un coffre-fort de clés, est utilisée pour créer, stocker, contrôler l'accès et détruire en toute sécurité les secrets backend. Ceux-ci peuvent inclure des mots de passe, du matériel de clé, des intégrations avec des bases de données et des systèmes tiers, des clés et des graines pour des jetons temporels, d'autres secrets internes et des clés API. Les secrets ne doivent pas être inclus dans le code source de l'application ni dans les artefacts de build. Pour une application L3, cela doit impliquer une solution matérielle telle qu'un HSM.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.3", + "section_name": "Gestion des secrets", + "req_id": "V13.3.2", + "req_description": "Vérifiez que l’accès aux ressources secrètes respecte le principe du moindre privilège.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.3", + "section_name": "Gestion des secrets", + "req_id": "V13.3.3", + "req_description": "Vérifiez que toutes les opérations cryptographiques sont effectuées à l'aide d'un module de sécurité isolé (tel qu'un coffre-fort ou un module de sécurité matériel) pour gérer et protéger en toute sécurité le matériel clé contre toute exposition en dehors du module de sécurité.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.3", + "section_name": "Gestion des secrets", + "req_id": "V13.3.4", + "req_description": "Vérifiez que les secrets sont configurés pour expirer et être renouvelés en fonction de la documentation de l'application.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Fuite d'informations involontaire", + "req_id": "V13.4.1", + "req_description": "Vérifiez que l'application est déployée soit sans aucune métadonnée de contrôle de source, y compris les dossiers .git ou .svn, soit de manière à ce que ces dossiers soient inaccessibles à la fois en externe et à l'application elle-même.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Fuite d'informations involontaire", + "req_id": "V13.4.2", + "req_description": "Vérifiez que les modes de débogage sont désactivés pour tous les composants dans les environnements de production afin d’éviter l’exposition des fonctionnalités de débogage et la fuite d’informations.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Fuite d'informations involontaire", + "req_id": "V13.4.3", + "req_description": "Vérifiez que les serveurs Web n’exposent pas les listes de répertoires aux clients, sauf si cela est explicitement prévu.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Fuite d'informations involontaire", + "req_id": "V13.4.4", + "req_description": "Vérifiez que l’utilisation de la méthode HTTP TRACE n’est pas prise en charge dans les environnements de production, afin d’éviter toute fuite d’informations potentielle.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Fuite d'informations involontaire", + "req_id": "V13.4.5", + "req_description": "Vérifiez que la documentation (comme pour les API internes) et les endpoints de surveillance ne sont pas exposés, sauf si cela est explicitement prévu.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Fuite d'informations involontaire", + "req_id": "V13.4.6", + "req_description": "Vérifiez que l’application n’expose pas d’informations de version détaillées des composants backend.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Fuite d'informations involontaire", + "req_id": "V13.4.7", + "req_description": "Vérifiez que la couche web est configuré pour servir uniquement les fichiers avec des extensions de fichier spécifiques afin d’éviter toute fuite involontaire d’informations, de configuration et de code source.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.1", + "section_name": "Documentation sur la protection des données", + "req_id": "V14.1.1", + "req_description": "Vérifiez que toutes les données sensibles créées et traitées par l'application ont été identifiées et classées selon leur niveau de protection. Cela inclut les données uniquement codées et donc facilement déchiffrables, telles que les chaînes Base64 ou la charge utile en texte clair d'un JWT. Les niveaux de protection doivent tenir compte des réglementations et normes de protection des données et de confidentialité auxquelles l'application est tenue de se conformer.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.1", + "section_name": "Documentation sur la protection des données", + "req_id": "V14.1.2", + "req_description": "Vérifier que tous les niveaux de protection des données sensibles sont assortis d'un ensemble documenté d'exigences de protection. Cela doit inclure (sans s'y limiter) les exigences relatives au chiffrement général, à la vérification de l'intégrité, à la conservation, à la journalisation des données, aux contrôles d'accès aux données sensibles dans les journaux, au chiffrement au niveau de la base de données, aux technologies de confidentialité et de renforcement de la confidentialité à utiliser, ainsi qu'aux autres exigences de confidentialité.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.2", + "section_name": "Protection générale des données", + "req_id": "V14.2.1", + "req_description": "Vérifiez que les données sensibles sont uniquement envoyées au serveur dans les champs de corps ou d’en-tête du message HTTP, et que l’URL et la chaîne de requête ne contiennent pas d’informations sensibles, telles qu’une clé API ou un jeton de session.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.2", + "section_name": "Protection générale des données", + "req_id": "V14.2.2", + "req_description": "Vérifiez que l’application empêche la mise en cache des données sensibles dans les composants du serveur, tels que les équilibreurs de charge et les caches d’application, ou garantit que les données sont purgées en toute sécurité après utilisation.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.2", + "section_name": "Protection générale des données", + "req_id": "V14.2.3", + "req_description": "Vérifiez que les données sensibles définies ne sont pas envoyées à des parties non fiables (par exemple, des trackers d'utilisateurs) pour empêcher la collecte indésirable de données en dehors du contrôle de l'application.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.2", + "section_name": "Protection générale des données", + "req_id": "V14.2.4", + "req_description": "Vérifiez que les contrôles autour des données sensibles liés au chiffrement, à la vérification de l'intégrité, à la conservation, à la manière dont les données doivent être enregistrées, aux contrôles d'accès autour des données sensibles dans les journaux, à la confidentialité et aux technologies d'amélioration de la confidentialité, sont mis en œuvre comme défini dans la documentation pour le niveau de protection des données spécifiques.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.2", + "section_name": "Protection générale des données", + "req_id": "V14.2.5", + "req_description": "Vérifiez que les mécanismes de mise en cache sont configurés pour ne mettre en cache que les réponses dont le type de contenu est conforme à la ressource et qui ne contiennent pas de contenu sensible et dynamique. Le serveur web doit renvoyer une réponse 404 ou 302 lors de l'accès à un fichier inexistant plutôt qu'un fichier valide différent. Cela devrait empêcher les attaques par empoisonnement de cache web.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.2", + "section_name": "Protection générale des données", + "req_id": "V14.2.6", + "req_description": "Vérifiez que l'application ne renvoie que les données sensibles minimales requises pour son fonctionnement. Par exemple, ne renvoyez que certains chiffres d'un numéro de carte de crédit, et non le numéro complet. Si les données complètes sont requises, elles doivent être masquées dans l'interface utilisateur, sauf si l'utilisateur les consulte spécifiquement.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.2", + "section_name": "Protection générale des données", + "req_id": "V14.2.7", + "req_description": "Vérifiez que les informations sensibles sont soumises à une classification de conservation des données, en veillant à ce que les données obsolètes ou inutiles soient supprimées automatiquement, selon un calendrier défini ou selon les besoins de la situation.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.2", + "section_name": "Protection générale des données", + "req_id": "V14.2.8", + "req_description": "Vérifiez que les informations sensibles sont supprimées des métadonnées des fichiers soumis par l'utilisateur, sauf si le stockage est autorisé par l'utilisateur.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.3", + "section_name": "Protection des données côté client", + "req_id": "V14.3.1", + "req_description": "Vérifiez que les données authentifiées sont effacées du stockage client, comme le DOM du navigateur, après la fin du client ou de la session. Le champ d'en-tête de réponse HTTP « Clear-Site-Data » peut être utile, mais le côté client devrait également pouvoir effectuer la correction si la connexion au serveur n'est pas disponible à la fin de la session.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.3", + "section_name": "Protection des données côté client", + "req_id": "V14.3.2", + "req_description": "Vérifiez que l'application définit suffisamment de champs d'en-tête de réponse HTTP anti-caching (c'est-à-dire Cache-Control : no-store) afin que les données sensibles ne soient pas mises en cache dans les navigateurs.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.3", + "section_name": "Protection des données côté client", + "req_id": "V14.3.3", + "req_description": "Vérifiez que les données stockées dans le stockage du navigateur (telles que localStorage, sessionStorage, IndexedDB ou les cookies) ne contiennent pas de données sensibles, à l'exception des jetons de session.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.1", + "section_name": "Documentation sur le développement et l'architecture sécurisés", + "req_id": "V15.1.1", + "req_description": "Vérifiez que la documentation de l'application définit les délais de correction basés sur les risques pour les versions de composants tiers présentant des vulnérabilités et pour la mise à jour des bibliothèques en général, afin de minimiser les risques liés à ces composants.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.1", + "section_name": "Documentation sur le développement et l'architecture sécurisés", + "req_id": "V15.1.2", + "req_description": "Vérifiez qu'un catalogue d'inventaire, tel qu'une nomenclature logicielle (SBOM), est conservé pour toutes les bibliothèques tierces utilisées, y compris en vérifiant que les composants proviennent de référentiels prédéfinis, fiables et continuellement maintenus.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.1", + "section_name": "Documentation sur le développement et l'architecture sécurisés", + "req_id": "V15.1.3", + "req_description": "Vérifiez que la documentation de l'application identifie les fonctionnalités consommatrices en temps ou gourmandes en ressources. Elle doit notamment indiquer comment prévenir une perte de disponibilité due à une utilisation excessive de ces fonctionnalités et éviter que la génération d'une réponse ne prenne plus de temps que le délai d'expiration du consommateur. Les mesures de protection potentielles peuvent inclure le traitement asynchrone, l'utilisation de files d'attente et la limitation des processus parallèles par utilisateur et par application.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.1", + "section_name": "Documentation sur le développement et l'architecture sécurisés", + "req_id": "V15.1.4", + "req_description": "Vérifiez que la documentation de l’application met en évidence les bibliothèques tierces qui sont considérées comme des « composants à risque ».", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.1", + "section_name": "Documentation sur le développement et l'architecture sécurisés", + "req_id": "V15.1.5", + "req_description": "Vérifiez que la documentation de l’application met en évidence les parties de l’application où des « fonctionnalités dangereuses » sont utilisées.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.2", + "section_name": "Architecture de sécurité et dépendances", + "req_id": "V15.2.1", + "req_description": "Vérifiez que l’application contient uniquement des composants qui n’ont pas dépassé les délais de mise à jour et de correction documentés.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.2", + "section_name": "Architecture de sécurité et dépendances", + "req_id": "V15.2.2", + "req_description": "Vérifiez que l'application a mis en œuvre des défenses contre la perte de disponibilité due à des fonctionnalités qui prennent du temps ou qui nécessitent des ressources, sur la base des décisions et stratégies de sécurité documentées à cet effet.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.2", + "section_name": "Architecture de sécurité et dépendances", + "req_id": "V15.2.3", + "req_description": "Vérifiez que l'environnement de production inclut uniquement les fonctionnalités nécessaires au fonctionnement de l'application et n'expose pas de fonctionnalités superflues telles que du code de test, des exemples d'extraits et des fonctionnalités de développement.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.2", + "section_name": "Architecture de sécurité et dépendances", + "req_id": "V15.2.4", + "req_description": "Vérifiez que les composants tiers et toutes leurs dépendances transitives sont inclus à partir du référentiel attendu, qu'il soit détenu en interne ou qu'il s'agisse d'une source externe, et qu'il n'y a aucun risque d'attaque par confusion de dépendances.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.2", + "section_name": "Architecture de sécurité et dépendances", + "req_id": "V15.2.5", + "req_description": "Vérifiez que l'application implémente des protections supplémentaires autour des parties documentées comme contenant des « fonctionnalités dangereuses » ou utilisant des bibliothèques tierces considérées comme des « composants à risque ». Cela peut inclure des techniques telles que le sandboxing, l'encapsulation, la conteneurisation ou l'isolation au niveau du réseau pour retarder et dissuader les attaquants qui compromettent une partie de l'application de se propager ailleurs.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.3", + "section_name": "Développement défensif", + "req_id": "V15.3.1", + "req_description": "Vérifiez que l'application ne renvoie que le sous-ensemble requis de champs d'un objet de données. Par exemple, elle ne doit pas renvoyer un objet de données entier, car certains champs individuels ne doivent pas être accessibles aux utilisateurs.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.3", + "section_name": "Développement défensif", + "req_id": "V15.3.2", + "req_description": "Vérifiez que lorsque le backend de l'application effectue des appels vers des URL externes, il est configuré pour ne pas suivre les redirections, sauf s'il s'agit d'une fonctionnalité prévue.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.3", + "section_name": "Développement défensif", + "req_id": "V15.3.3", + "req_description": "Vérifiez que l'application dispose de contre-mesures pour se protéger contre les attaques d'affectation de masse en limitant les champs autorisés par contrôleur et action, par exemple, il n'est pas possible d'insérer ou de mettre à jour une valeur de champ lorsqu'elle n'était pas destinée à faire partie de cette action.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.3", + "section_name": "Développement défensif", + "req_id": "V15.3.4", + "req_description": "Vérifiez que tous les composants proxy et middleware transfèrent correctement l'adresse IP d'origine de l'utilisateur à l'aide de champs de données fiables qui ne peuvent pas être manipulés par l'utilisateur final, et que l'application et le serveur Web utilisent cette valeur correcte pour la journalisation et les décisions de sécurité telles que la limitation du débit, en tenant compte du fait que même l'adresse IP d'origine peut ne pas être fiable en raison d'adresses IP dynamiques, de VPN ou de pare-feu d'entreprise.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.3", + "section_name": "Développement défensif", + "req_id": "V15.3.5", + "req_description": "Vérifiez que l'application garantit explicitement que les variables sont du type correct et effectue des opérations d'égalité et de comparaison strictes. Cela permet d'éviter les vulnérabilités liées à la confusion de types, causées par des hypothèses du code de l'application sur le type d'une variable.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.3", + "section_name": "Développement défensif", + "req_id": "V15.3.6", + "req_description": "Vérifiez que le code JavaScript est écrit de manière à éviter la pollution du prototype, par exemple en utilisant Set() ou Map() au lieu de littéraux d'objet.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.3", + "section_name": "Développement défensif", + "req_id": "V15.3.7", + "req_description": "Vérifiez que l'application dispose de défenses contre les attaques de pollution des paramètres HTTP, en particulier si le Framework d'application ne fait aucune distinction quant à la source des paramètres de requête (chaîne de requête, paramètres de corps, cookies ou champs d'en-tête).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.4", + "section_name": "Concurrence sécurisée", + "req_id": "V15.4.1", + "req_description": "Vérifiez que les objets partagés dans le code multithread (tels que les caches, les fichiers ou les objets en mémoire accessibles par plusieurs threads) sont accessibles en toute sécurité à l'aide de types thread-safe et de mécanismes de synchronisation tels que des verrous ou des sémaphores pour éviter les conditions de concurrence et la corruption des données.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.4", + "section_name": "Concurrence sécurisée", + "req_id": "V15.4.2", + "req_description": "Vérifiez que les vérifications de l'état d'une ressource, comme son existence ou ses autorisations, et des actions qui en dépendent, sont effectuées en une seule opération atomique afin d'éviter les situations de concurrence entre le moment de la vérification et le moment de l'utilisation (TOCTOU). Par exemple, vérifier l'existence d'un fichier avant de l'ouvrir ou l'accès d'un utilisateur avant de l'accorder.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.4", + "section_name": "Concurrence sécurisée", + "req_id": "V15.4.3", + "req_description": "Vérifiez que les verrous sont utilisés de manière cohérente pour éviter que les threads ne se bloquent, que ce soit en s'attendant les uns les autres ou en réessayant sans fin, et que la logique de verrouillage reste dans le code responsable de la gestion de la ressource pour garantir que les verrous ne peuvent pas être modifiés par inadvertance ou de manière malveillante par des classes ou du code externes.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.4", + "section_name": "Concurrence sécurisée", + "req_id": "V15.4.4", + "req_description": "Vérifiez que les politiques d'allocation des ressources empêchent la saturation de threads en garantissant un accès équitable aux ressources, par exemple en exploitant les pools de threads, permettant aux threads de priorité inférieure de continuer dans un délai raisonnable.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.1", + "section_name": "Documentation sur la journalisation de sécurité", + "req_id": "V16.1.1", + "req_description": "Vérifiez qu'il existe un inventaire documentant la journalisation effectuée à chaque couche de la pile technologique de l'application, les événements enregistrés, les formats de journal, l'endroit où cette journalisation est stockée, la manière dont elle est utilisée, la manière dont l'accès à celle-ci est contrôlé et la durée de conservation des journaux.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.2", + "section_name": "Journalisation générale", + "req_id": "V16.2.1", + "req_description": "Vérifiez que chaque entrée de journal inclut les métadonnées nécessaires (telles que quand, où, qui, quoi) qui permettraient une enquête détaillée sur la chronologie lorsqu'un événement se produit.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.2", + "section_name": "Journalisation générale", + "req_id": "V16.2.2", + "req_description": "Vérifiez que les sources de temps de tous les composants de journalisation sont synchronisées et que les horodatages des métadonnées des événements de sécurité utilisent le temps UTC ou incluent un décalage horaire explicite. L'UTC est recommandé pour garantir la cohérence entre les systèmes distribués et éviter toute confusion lors du passage à l'heure d'été.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.2", + "section_name": "Journalisation générale", + "req_id": "V16.2.3", + "req_description": "Vérifiez que l’application stocke ou diffuse uniquement les journaux vers les fichiers et services documentés dans l’inventaire des journaux.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.2", + "section_name": "Journalisation générale", + "req_id": "V16.2.4", + "req_description": "Vérifiez que les journaux peuvent être lus et corrélés par le processeur de journaux utilisé, de préférence en utilisant un format de journalisation commun.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.2", + "section_name": "Journalisation générale", + "req_id": "V16.2.5", + "req_description": "Vérifiez que l'application applique la journalisation en fonction du niveau de protection des données lors de la journalisation de données sensibles. Par exemple, certaines données, comme les identifiants ou les informations de paiement, peuvent être interdites. D'autres données, comme les jetons de session, ne peuvent être enregistrées que par hachage ou masquage, en totalité ou en partie.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.3", + "section_name": "Événements de sécurité", + "req_id": "V16.3.1", + "req_description": "Vérifiez que toutes les opérations d'authentification sont enregistrées, y compris les tentatives réussies et infructueuses. Des métadonnées supplémentaires, telles que le type d'authentification ou les facteurs utilisés, doivent également être collectées.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.3", + "section_name": "Événements de sécurité", + "req_id": "V16.3.2", + "req_description": "Vérifier que les tentatives d'autorisation infructueuses sont logguées. Pour le niveau 3, cela doit inclure la journalisation de toutes les décisions d'autorisation, y compris lors de l'accès à des données sensibles (sans journalisation des données sensibles elles-mêmes).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.3", + "section_name": "Événements de sécurité", + "req_id": "V16.3.3", + "req_description": "Vérifiez que l'application enregistre les événements de sécurité définis dans la documentation et enregistre également les tentatives de contournement des contrôles de sécurité, tels que la validation des entrées, la logique métier et l'anti-automatisation.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.3", + "section_name": "Événements de sécurité", + "req_id": "V16.3.4", + "req_description": "Vérifiez que l’application enregistre les erreurs inattendues et les échecs de contrôle de sécurité tels que les échecs TLS du backend.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.4", + "section_name": "Protection des journaux", + "req_id": "V16.4.1", + "req_description": "Vérifiez que tous les composants de journalisation codent correctement les données pour empêcher l’injection de journaux.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.4", + "section_name": "Protection des journaux", + "req_id": "V16.4.2", + "req_description": "Vérifiez que les journaux sont protégés contre tout accès non autorisé et ne peuvent pas être modifiés.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.4", + "section_name": "Protection des journaux", + "req_id": "V16.4.3", + "req_description": "Vérifiez que les journaux sont transmis de manière sécurisée à un système logique distinct pour analyse, détection, alerte et remontée des informations. L'objectif est de garantir qu'en cas de violation de l'application, les journaux ne seront pas compromis.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.5", + "section_name": "Gestion des erreurs", + "req_id": "V16.5.1", + "req_description": "Vérifiez qu'un message générique est renvoyé au consommateur lorsqu'une erreur inattendue ou sensible à la sécurité se produit, garantissant ainsi l'absence d'exposition de données système internes sensibles telles que les traces de pile, les requêtes, les clés secrètes et les jetons.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.5", + "section_name": "Gestion des erreurs", + "req_id": "V16.5.2", + "req_description": "Vérifiez que l'application continue de fonctionner en toute sécurité lorsque l'accès aux ressources externes échoue, par exemple, en utilisant des modèles tels que des disjoncteurs ou une dégradation progressive.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.5", + "section_name": "Gestion des erreurs", + "req_id": "V16.5.3", + "req_description": "Vérifiez que l'application échoue proprement et sécurisée, y compris lorsqu'une exception se produit, en évitant les accès en cas d'erreur telles que le traitement d'une transaction malgré les erreurs résultant de la logique de validation.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.5", + "section_name": "Gestion des erreurs", + "req_id": "V16.5.4", + "req_description": "Vérifiez qu'un gestionnaire d'erreurs de « dernier recours » est défini pour intercepter toutes les exceptions non gérées. Cela permet d'éviter la perte des informations d'erreur qui doivent être loguées dans les fichiers journaux et de garantir qu'une erreur ne paralyse pas l'ensemble du processus applicatif, entraînant une perte de disponibilité.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.1", + "section_name": "Serveur TURN", + "req_id": "V17.1.1", + "req_description": "Vérifiez que le service TURN (Traversal Using Relays around NAT) autorise uniquement l'accès aux adresses IP non réservées à des fins spécifiques (par exemple, réseaux internes, diffusion, bouclage). Notez que cela s'applique aux adresses IPv4 et IPv6.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.1", + "section_name": "Serveur TURN", + "req_id": "V17.1.2", + "req_description": "Vérifiez que le service Traversal Using Relays around NAT (TURN) n'est pas susceptible d'épuiser ses ressources lorsque des utilisateurs légitimes tentent d'ouvrir un grand nombre de ports sur le serveur TURN.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Média", + "req_id": "V17.2.1", + "req_description": "Vérifiez que la clé du certificat Datagram Transport Layer Security (DTLS) est gérée et protégée conformément à la politique documentée de gestion des clés cryptographiques.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Média", + "req_id": "V17.2.2", + "req_description": "Vérifiez que le serveur multimédia est configuré pour utiliser et prendre en charge les suites de chiffrement DTLS (Datagram Transport Layer Security) approuvées et un profil de protection sécurisé pour l'extension DTLS pour l'établissement de clés pour le protocole de transport en temps réel sécurisé (DTLS-SRTP).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Média", + "req_id": "V17.2.3", + "req_description": "Vérifiez que l'authentification SRTP (Secure Real-time Transport Protocol) est vérifiée sur le serveur multimédia pour empêcher les attaques par injection RTP (Real-time Transport Protocol) d'entraîner une condition de déni de service ou l'insertion de médias audio ou vidéo dans les flux multimédias.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Média", + "req_id": "V17.2.4", + "req_description": "Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant lorsqu'il rencontre des paquets SRTP (Secure Real-time Transport Protocol) mal formés.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Média", + "req_id": "V17.2.5", + "req_description": "Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Média", + "req_id": "V17.2.6", + "req_description": "Vérifiez que le serveur multimédia n'est pas sensible à la vulnérabilité de condition de concurrence « ClientHello » dans Datagram Transport Layer Security (DTLS) en vérifiant si le serveur multimédia est publiquement connu comme étant vulnérable ou en effectuant le test de condition de concurrence.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Média", + "req_id": "V17.2.7", + "req_description": "Vérifiez que tous les mécanismes d'enregistrement audio ou vidéo associés au serveur multimédia sont en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Média", + "req_id": "V17.2.8", + "req_description": "Vérifiez que le certificat Datagram Transport Layer Security (DTLS) est vérifié par rapport à l'attribut d'empreinte cryptographique du protocole de description de session (SDP), en mettant fin au flux multimédia si la vérification échoue, pour garantir l'authenticité du flux multimédia.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.3", + "section_name": "Signalisation", + "req_id": "V17.3.1", + "req_description": "Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation entrants légitimes lors d'une attaque par saturation. Cela peut être réalisé en implémentant une limitation de débit au niveau de la signalisation.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.3", + "section_name": "Signalisation", + "req_id": "V17.3.2", + "req_description": "Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation légitimes en cas de message mal formé susceptible de provoquer un déni de service. Cela peut inclure la validation des entrées, la gestion sécurisée des dépassements d'entiers, la prévention des dépassements de tampon et l'utilisation d'autres techniques robustes de gestion des erreurs.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + } + ] +} diff --git a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.json b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.json new file mode 100644 index 0000000000..dc558e6b1a --- /dev/null +++ b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.json @@ -0,0 +1,2774 @@ +{ + "Name": "Application Security Verification Standard Project", + "ShortName": "ASVS", + "Version": "5.0.0", + "Description": "The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.", + "Requirements": [ + { + "Shortcode": "V1", + "Ordinal": 1, + "ShortName": "Encoding", + "Name": "Encodage et nettoyage", + "Items": [ + { + "Shortcode": "V1.1", + "Ordinal": 1, + "Name": "Architecture d'encodage et de nettoyage", + "Items": [ + { + "Shortcode": "V1.1.1", + "Ordinal": 1, + "Description": "Vérifiez que l'entrée est décodée ou non échappée vers une forme canonique une seule fois, elle n'est décodée que lorsque des données codées sous cette forme sont attendues, et que cela est fait avant de traiter davantage l'entrée, par exemple, elle n'est pas effectuée après la validation ou la désinfection de l'entrée.", + "L": "2" + }, + { + "Shortcode": "V1.1.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application effectue l'encodage et l'échappement de sortie soit comme étape finale avant d'être utilisée par l'interpréteur pour lequel elle est destinée, soit par l'interpréteur lui-même.", + "L": "2" + } + ] + }, + { + "Shortcode": "V1.2", + "Ordinal": 2, + "Name": "Prévention des injections", + "Items": [ + { + "Shortcode": "V1.2.1", + "Ordinal": 1, + "Description": "Vérifiez que l'encodage de sortie d'une réponse HTTP, d'un document HTML ou d'un document XML est pertinent pour le contexte requis, comme l'encodage des caractères pertinents pour les éléments HTML, les attributs HTML, les commentaires HTML, les CSS ou les champs d'en-tête HTTP, pour éviter de modifier la structure du message ou du document.", + "L": "1" + }, + { + "Shortcode": "V1.2.2", + "Ordinal": 2, + "Description": "Vérifiez que, lors de la création dynamique d'URL, les données non fiables sont encodées en fonction de leur contexte (par exemple, encodage d'URL ou encodage base64url pour les paramètres de requête ou de chemin). Assurez-vous que seuls les schémas d'URL sûrs sont autorisés (par exemple, interdire javascript: ou data:).", + "L": "1" + }, + { + "Shortcode": "V1.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l'encodage ou l'échappement de sortie est utilisé lors de la création dynamique de contenu JavaScript (y compris JSON), pour éviter de modifier la structure du message ou du document (pour éviter l'injection JavaScript et JSON).", + "L": "1" + }, + { + "Shortcode": "V1.2.4", + "Ordinal": 4, + "Description": "Vérifiez que la sélection de données ou les requêtes de base de données (par exemple, SQL, HQL, NoSQL, Cypher) utilisent des requêtes paramétrées, des ORM, des Framework d'entités ou sont protégées contre les injections SQL et autres attaques par injection de base de données. Ceci est également pertinent lors de l'écriture de procédures stockées.", + "L": "1" + }, + { + "Shortcode": "V1.2.5", + "Ordinal": 5, + "Description": "Vérifiez que l’application protège contre l’injection de commandes du système d’exploitation et que les appels du système d’exploitation utilisent des requêtes du système d’exploitation paramétrées ou utilisent un encodage de sortie de ligne de commande contextuelle.", + "L": "1" + }, + { + "Shortcode": "V1.2.6", + "Ordinal": 6, + "Description": "Vérifiez que l’application protège contre les vulnérabilités d’injection LDAP ou que des contrôles de sécurité spécifiques pour empêcher l’injection LDAP ont été mis en œuvre.", + "L": "2" + }, + { + "Shortcode": "V1.2.7", + "Ordinal": 7, + "Description": "Vérifiez que l’application est protégée contre les attaques par injection XPath en utilisant la paramétrisation des requêtes ou des requêtes précompilées.", + "L": "2" + }, + { + "Shortcode": "V1.2.8", + "Ordinal": 8, + "Description": "Vérifiez que les processeurs LaTeX sont configurés de manière sécurisée (par exemple, en n'utilisant pas l'indicateur « --shell-escape ») et qu'une liste d’autorisations de commandes est utilisée pour empêcher les attaques par injection LaTeX.", + "L": "2" + }, + { + "Shortcode": "V1.2.9", + "Ordinal": 9, + "Description": "Vérifiez que l'application échappe les caractères spéciaux dans les expressions régulières (généralement à l'aide d'une barre oblique inverse) pour éviter qu'ils ne soient mal interprétés comme des métacaractères.", + "L": "2" + }, + { + "Shortcode": "V1.2.10", + "Ordinal": 10, + "Description": "Vérifiez que l'application est protégée contre les injections CSV et injections de formules. L'application doit respecter les règles d'échappement définies dans les sections 2.6 et 2.7 de la RFC 4180 lors de l'export de contenu CSV. De plus, lors de l'export au format CSV ou vers d'autres formats de tableur (tels que XLS, XLSX ou ODF), les caractères spéciaux (notamment « = », « + », « - », « @ », « \\t » (tabulation) et « \\0 » (caractère null)) doivent être protégés par une apostrophe s'ils apparaissent en premier dans une valeur de champ.", + "L": "3" + } + ] + }, + { + "Shortcode": "V1.3", + "Ordinal": 3, + "Name": "Nettoyage", + "Items": [ + { + "Shortcode": "V1.3.1", + "Ordinal": 1, + "Description": "Vérifiez que toutes les entrées HTML non fiables provenant d'éditeurs WYSIWYG ou similaires sont nettoyées à l'aide d'une bibliothèque ou d'une fonctionnalité de Framework de nettoyage HTML bien connue et sécurisée.", + "L": "1" + }, + { + "Shortcode": "V1.3.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application évite d'utiliser eval() ou d'autres fonctionnalités d'exécution de code dynamique telles que Spring Expression Language (SpEL). En l'absence d'alternative, toute saisie utilisateur incluse doit être nettoyée avant d'être exécutée.", + "L": "1" + }, + { + "Shortcode": "V1.3.3", + "Ordinal": 3, + "Description": "Vérifiez que les données transmises à un contexte potentiellement dangereux sont préalablement nettoyées pour appliquer des mesures de sécurité, telles qu'autoriser uniquement des caractères sûrs pour ce contexte et raccourcir des entrées trop longues.", + "L": "2" + }, + { + "Shortcode": "V1.3.4", + "Ordinal": 4, + "Description": "Vérifiez que le contenu Scalable Vector Graphics (SVG) scriptable fourni par l'utilisateur est validé ou nettoyé pour contenir uniquement des balises et des attributs (tels que des graphiques de dessin) qui sont sûrs pour l'application, par exemple, ne contiennent pas de scripts et d'objets étrangers.", + "L": "2" + }, + { + "Shortcode": "V1.3.5", + "Ordinal": 5, + "Description": "Vérifiez que l'application nettoie ou désactive le contenu du langage de modèle d'expression ou de script fourni par l'utilisateur, tel que les feuilles de style CSS, le Markdown ou XSL, BBCode ou similaire.", + "L": "2" + }, + { + "Shortcode": "V1.3.6", + "Ordinal": 6, + "Description": "Vérifiez que l'application protège contre les attaques de falsification de requête côté serveur (SSRF), en validant les données non fiables par rapport à une liste d'autorisation de protocoles, de domaines, de chemins et de ports et en nettoyant les caractères potentiellement dangereux avant d'utiliser les données pour appeler un autre service.", + "L": "2" + }, + { + "Shortcode": "V1.3.7", + "Ordinal": 7, + "Description": "Vérifiez que l'application se protège contre les attaques par injection de modèles en interdisant la création de modèles basés sur des entrées non fiables. En l'absence d'alternative, toute entrée non fiable incluse dynamiquement lors de la création du modèle doit être nettoyée ou rigoureusement validée.", + "L": "2" + }, + { + "Shortcode": "V1.3.8", + "Ordinal": 8, + "Description": "Vérifiez que l’application nettoie correctement les entrées non fiables avant utilisation dans les requêtes Java Naming and Directory Interface (JNDI) et que JNDI est configuré de manière sécurisée pour empêcher les attaques par injection JNDI.", + "L": "2" + }, + { + "Shortcode": "V1.3.9", + "Ordinal": 9, + "Description": "Vérifiez que l’application nettoie le contenu avant qu’il ne soit envoyé à memcache pour éviter les attaques par injection.", + "L": "2" + }, + { + "Shortcode": "V1.3.10", + "Ordinal": 10, + "Description": "Vérifiez que les chaînes de format susceptibles d'être résolues de manière inattendue ou malveillante lors de leur utilisation sont nettoyées avant d'être traitées.", + "L": "2" + }, + { + "Shortcode": "V1.3.11", + "Ordinal": 11, + "Description": "Vérifiez que l'application nettoie les entrées utilisateur avant de les transmettre aux systèmes de messagerie pour se protéger contre l'injection SMTP ou IMAP.", + "L": "2" + }, + { + "Shortcode": "V1.3.12", + "Ordinal": 12, + "Description": "Vérifiez que les expressions régulières sont exemptes d'éléments provoquant \"backtracking\" exponentiel et assurez-vous que les entrées non fiables sont nettoyées pour atténuer les attaques ReDoS ou Runaway Regex.", + "L": "3" + } + ] + }, + { + "Shortcode": "V1.4", + "Ordinal": 4, + "Name": "Mémoire, chaine de caractères et code à mémoire non-managée", + "Items": [ + { + "Shortcode": "V1.4.1", + "Ordinal": 1, + "Description": "Vérifiez que l'application utilise des chaînes memory-safe, une copie de mémoire et une arithmétique de pointeur renforcée pour détecter ou empêcher les débordements de pile, de tampon ou de tas.", + "L": "2" + }, + { + "Shortcode": "V1.4.2", + "Ordinal": 2, + "Description": "Vérifiez que les techniques de validation du signe, de la plage et de l’entrée sont utilisées pour éviter les dépassements d’entiers.", + "L": "2" + }, + { + "Shortcode": "V1.4.3", + "Ordinal": 3, + "Description": "Vérifiez que la mémoire et les ressources allouées dynamiquement sont libérées et que les références ou les pointeurs vers la mémoire libérée sont supprimés ou définis à null pour éviter les \"dangling pointer\" et les vulnérabilités d'utilisation après libération.", + "L": "2" + } + ] + }, + { + "Shortcode": "V1.5", + "Ordinal": 5, + "Name": "Désérialisation sécurisée", + "Items": [ + { + "Shortcode": "V1.5.1", + "Ordinal": 1, + "Description": "Vérifiez que l'application configure les \"parser\" XML pour utiliser une configuration restrictive et que les fonctionnalités non sûres telles que la résolution d'entités externes sont désactivées pour empêcher les attaques XML eXternal Entity (XXE).", + "L": "1" + }, + { + "Shortcode": "V1.5.2", + "Ordinal": 2, + "Description": "Vérifiez que la désérialisation des données non fiables garantit une gestion sécurisée des entrées, par exemple en utilisant une liste d'autorisation de types d'objets ou en limitant les types d'objets définis par le client, afin d'empêcher les attaques par désérialisation. Les mécanismes de désérialisation explicitement définis comme non sécurisés ne doivent pas être utilisés avec des entrées non fiables.", + "L": "2" + }, + { + "Shortcode": "V1.5.3", + "Ordinal": 3, + "Description": "Vérifiez que les différents \"parser\" utilisés dans l'application pour le même type de données (par exemple, les \"parser\" JSON, les \"parser\" XML, les \"parser\" d'URL) effectuent l'analyse de manière cohérente et utilisent le même mécanisme d'encodage de caractères pour éviter des problèmes tels que les vulnérabilités d'interopérabilité JSON ou un comportement d'analyse d'URI ou de fichier différent exploité dans les attaques d'inclusion de fichiers à distance (RFI) ou de falsification de requête côté serveur (SSRF).", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V2", + "Ordinal": 2, + "ShortName": "Validation", + "Name": "Validation et logique métier", + "Items": [ + { + "Shortcode": "V2.1", + "Ordinal": 1, + "Name": "Validation et documentation de la logique métier", + "Items": [ + { + "Shortcode": "V2.1.1", + "Ordinal": 1, + "Description": "Vérifiez que la documentation de l'application définit des règles de validation des entrées pour vérifier la validité des éléments de données par rapport à la structure attendue. Il peut s'agir de formats de données courants tels que des numéros de carte de crédit, des adresses e-mail ou des numéros de téléphone, ou d'un format de données interne.", + "L": "1" + }, + { + "Shortcode": "V2.1.2", + "Ordinal": 2, + "Description": "Vérifiez que la documentation de l'application définit comment valider la cohérence logique et contextuelle des éléments de données combinés, par exemple en vérifiant que la banlieue et le code postal correspondent.", + "L": "2" + }, + { + "Shortcode": "V2.1.3", + "Ordinal": 3, + "Description": "Vérifiez que les attentes en matière de limites et de validations de la logique métier sont documentées, y compris par utilisateur et globalement dans l'application.", + "L": "2" + } + ] + }, + { + "Shortcode": "V2.2", + "Ordinal": 2, + "Name": "Validation des entrées", + "Items": [ + { + "Shortcode": "V2.2.1", + "Ordinal": 1, + "Description": "Vérifier que les entrées sont validées afin de respecter les attentes métier ou fonctionnelles. Cette validation doit être basée sur une liste de valeurs, de modèles et de plages autorisées, ou sur la comparaison des entrées avec une structure attendue et des limites logiques selon des règles prédéfinies. Pour le niveau 1, cette validation peut se concentrer sur les entrées utilisées pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau 2, elle doit s'appliquer à toutes les entrées.", + "L": "1" + }, + { + "Shortcode": "V2.2.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application est conçue pour appliquer la validation des entrées au niveau d'une couche de service de confiance. Bien que la validation côté client améliore l'ergonomie et doit être encouragée, elle ne doit pas être considérée comme un contrôle de sécurité.", + "L": "1" + }, + { + "Shortcode": "V2.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l’application garantit que les combinaisons d’éléments de données associés sont raisonnables selon les règles prédéfinies.", + "L": "2" + } + ] + }, + { + "Shortcode": "V2.3", + "Ordinal": 3, + "Name": "Sécurité de la logique métier", + "Items": [ + { + "Shortcode": "V2.3.1", + "Ordinal": 1, + "Description": "Vérifiez que l’application traitera uniquement les flux de logique métier pour le même utilisateur dans l’ordre séquentiel attendu et sans sauter d’étapes.", + "L": "1" + }, + { + "Shortcode": "V2.3.2", + "Ordinal": 2, + "Description": "Vérifiez que les limites de la logique métier sont implémentées conformément à la documentation de l'application, afin d'éviter que des failles de la logique métier ne soient pas exploitées.", + "L": "2" + }, + { + "Shortcode": "V2.3.3", + "Ordinal": 3, + "Description": "Vérifiez que les transactions sont utilisées au niveau de la logique métier de telle sorte qu'une opération de logique métier réussisse dans son intégralité ou qu'elle soit restaurée à l'état correct précédent.", + "L": "2" + }, + { + "Shortcode": "V2.3.4", + "Ordinal": 4, + "Description": "Vérifiez que les mécanismes de verrouillage au niveau de la logique métier sont utilisés pour garantir que les ressources en quantité limitée (telles que les sièges de théâtre ou les créneaux de livraison) ne peuvent pas être réservées deux fois en manipulant la logique de l'application.", + "L": "2" + }, + { + "Shortcode": "V2.3.5", + "Ordinal": 5, + "Description": "Vérifiez que les flux logiques métier à forte valeur ajoutée nécessitent l'approbation de plusieurs utilisateurs afin d'éviter toute action non autorisée ou accidentelle. Cela peut inclure, sans s'y limiter, les transferts monétaires importants, les approbations de contrats, l'accès à des informations classifiées ou les contournements de sécurité dans le secteur manufacturier.", + "L": "3" + } + ] + }, + { + "Shortcode": "V2.4", + "Ordinal": 4, + "Name": "Anti-automatisation", + "Items": [ + { + "Shortcode": "V2.4.1", + "Ordinal": 1, + "Description": "Vérifiez que des contrôles anti-automatisation sont en place pour protéger contre les appels excessifs aux fonctions d'application qui pourraient conduire à l'exfiltration de données, à la création de données inutiles, à l'épuisement des quotas, aux violations de limites de débit, au déni de service ou à la surutilisation de ressources coûteuses.", + "L": "2" + }, + { + "Shortcode": "V2.4.2", + "Ordinal": 2, + "Description": "Vérifiez que les flux logiques métier nécessitent un timing humain réaliste, évitant ainsi des soumissions de transactions excessivement rapides.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V3", + "Ordinal": 3, + "ShortName": "Web", + "Name": "Sécurité du frontend Web", + "Items": [ + { + "Shortcode": "V3.1", + "Ordinal": 1, + "Name": "Documentation sur la sécurité du frontend Web", + "Items": [ + { + "Shortcode": "V3.1.1", + "Ordinal": 1, + "Description": "Vérifiez que la documentation de l'application indique les fonctionnalités de sécurité attendues que les navigateurs utilisant l'application doivent prendre en charge (telles que HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) et autres mécanismes de sécurité HTTP pertinents). Elle doit également définir le comportement de l'application lorsque certaines de ces fonctionnalités ne sont pas disponibles (par exemple, avertir l'utilisateur ou bloquer l'accès).", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.2", + "Ordinal": 2, + "Name": "Interprétation non intentionnelle du contenu", + "Items": [ + { + "Shortcode": "V3.2.1", + "Ordinal": 1, + "Description": "Vérifiez que des contrôles de sécurité sont en place pour empêcher les navigateurs d'afficher du contenu ou des fonctionnalités dans les réponses HTTP dans un contexte incorrect (par exemple, lorsqu'une API, un fichier téléchargé par l'utilisateur ou une autre ressource est demandée directement). Les contrôles possibles peuvent inclure : ne pas transmettre le contenu sauf si les champs d'en-tête de requête HTTP (tels que Sec-Fetch-\\*) indiquent qu'il s'agit du contexte correct, utiliser la directive sandbox du champ d'en-tête Content-Security-Policy ou utiliser le type de disposition de pièce jointe dans le champ d'en-tête Content-Disposition.", + "L": "1" + }, + { + "Shortcode": "V3.2.2", + "Ordinal": 2, + "Description": "Vérifiez que le contenu destiné à être affiché sous forme de texte, plutôt que rendu sous forme de HTML, est géré à l'aide de fonctions de rendu sécurisées (telles que createTextNode ou textContent) pour empêcher l'exécution involontaire de contenu tel que HTML ou JavaScript.", + "L": "1" + }, + { + "Shortcode": "V3.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l'application évite l'écrasement du DOM lors de l'utilisation de JavaScript côté client en utilisant des déclarations de variables explicites, en effectuant une vérification de type stricte, en évitant de stocker des variables globales sur l'objet document et en implémentant l'isolation de l'espace de nommage.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.3", + "Ordinal": 3, + "Name": "Configuration des cookies", + "Items": [ + { + "Shortcode": "V3.3.1", + "Ordinal": 1, + "Description": "Vérifiez que les cookies ont l'attribut « Secure » ​​défini et si le préfixe « \\__Host- » n'est pas utilisé pour le nom du cookie, le préfixe « __Secure- » doit être utilisé pour le nom du cookie.", + "L": "1" + }, + { + "Shortcode": "V3.3.2", + "Ordinal": 2, + "Description": "Vérifiez que la valeur de l'attribut « SameSite » de chaque cookie est définie en fonction de l'objectif du cookie, afin de limiter l'exposition aux attaques de réparation de l'interface utilisateur et aux attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).", + "L": "2" + }, + { + "Shortcode": "V3.3.3", + "Ordinal": 3, + "Description": "Vérifiez que les cookies ont le préfixe « __Host- » pour le nom du cookie, sauf s'ils sont explicitement conçus pour être partagés avec d'autres hôtes.", + "L": "2" + }, + { + "Shortcode": "V3.3.4", + "Ordinal": 4, + "Description": "Vérifiez que si la valeur d'un cookie n'est pas censée être accessible aux scripts côté client (comme un jeton de session), le cookie doit avoir l'attribut « HttpOnly » défini et la même valeur (par exemple, un jeton de session) ne doit être transférée au client que via le champ d'en-tête « Set-Cookie ».", + "L": "2" + }, + { + "Shortcode": "V3.3.5", + "Ordinal": 5, + "Description": "Vérifiez que lorsque l'application écrit un cookie, la longueur combinée du nom et de la valeur du cookie ne dépasse pas 4 096 octets. Les cookies trop volumineux ne seront pas stockés par le navigateur et ne seront donc pas envoyés avec les requêtes, empêchant ainsi l'utilisateur d'utiliser les fonctionnalités de l'application qui reposent sur ce cookie.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.4", + "Ordinal": 4, + "Name": "En-têtes du mécanisme de sécurité du navigateur", + "Items": [ + { + "Shortcode": "V3.4.1", + "Ordinal": 1, + "Description": "Vérifiez qu'un champ d'en-tête Strict-Transport-Security est inclus dans toutes les réponses afin d'appliquer une politique HTTP Strict Transport Security (HSTS). Une durée maximale d'au moins un an doit être définie, et pour les niveaux L2 et supérieurs, la politique doit également s'appliquer à tous les sous-domaines.", + "L": "1" + }, + { + "Shortcode": "V3.4.2", + "Ordinal": 2, + "Description": "Vérifiez que le champ d'en-tête Access-Control-Allow-Origin du partage de ressources cross-origine (CORS) est une valeur fixe de l'application ou, si la valeur du champ d'en-tête de requête HTTP Origin est utilisée, qu'elle est validée par rapport à une liste d'origines approuvées. Si « Access-Control-Allow-Origin: * » doit être utilisé, vérifiez que la réponse ne contient aucune information sensible.", + "L": "1" + }, + { + "Shortcode": "V3.4.3", + "Ordinal": 3, + "Description": "Vérifiez que les réponses HTTP incluent un champ d'en-tête de réponse Content-Security-Policy qui définit des directives garantissant que le navigateur charge et exécute uniquement du contenu ou des ressources fiables, afin de limiter l'exécution de JavaScript malveillant. Au minimum, une politique globale doit être utilisée, incluant les directives object-src 'none' et base-uri 'none', et définissant soit une lliste d’autorisations, soit des valeurs nonces ou des hachages. Pour une application L3, une politique par réponse avec des valeurs nonces ou des hachages doit être définie.", + "L": "2" + }, + { + "Shortcode": "V3.4.4", + "Ordinal": 4, + "Description": "Vérifiez que toutes les réponses HTTP contiennent un champ d'en-tête « X-Content-Type-Options: nosniff ». Cela indique aux navigateurs de ne pas utiliser l'analyse de contenu ni la détection du type MIME pour la réponse donnée, et d'exiger que la valeur du champ d'en-tête « Content-Type » de la réponse corresponde à la ressource de destination. Par exemple, la réponse à une demande de style n'est acceptée que si le type de contenu de la réponse est « text/css ». Cela permet également au navigateur d'utiliser la fonctionnalité de blocage de lecture inter-origines (CORB).", + "L": "2" + }, + { + "Shortcode": "V3.4.5", + "Ordinal": 5, + "Description": "Vérifiez que l'application définit une politique de référencement afin d'empêcher la fuite de données techniquement sensibles vers des services tiers via le champ d'en-tête de requête HTTP « Referer ». Cela peut être effectué via le champ d'en-tête de réponse HTTP « Referrer-Policy » ou via les attributs d'élément HTML. Les données sensibles peuvent inclure le chemin d'accès et les données de requête dans l'URL, et pour les applications internes non publiques, le nom d'hôte.", + "L": "2" + }, + { + "Shortcode": "V3.4.6", + "Ordinal": 6, + "Description": "Vérifiez que l'application Web utilise la directive frame-ancestors du champ d'en-tête Content-Security-Policy pour chaque réponse HTTP afin de garantir qu'elle ne peut pas être intégrée par défaut et que l'intégration de ressources spécifiques n'est autorisée qu'en cas de nécessité. Notez que le champ d'en-tête X-Frame-Options, bien que pris en charge par les navigateurs, est obsolète et n'est pas forcément fiable.", + "L": "2" + }, + { + "Shortcode": "V3.4.7", + "Ordinal": 7, + "Description": "Vérifiez que le champ d’en-tête Content-Security-Policy spécifie un emplacement pour signaler les violations.", + "L": "3" + }, + { + "Shortcode": "V3.4.8", + "Ordinal": 8, + "Description": "Vérifiez que toutes les réponses HTTP qui lancent le rendu d'un document (comme les réponses de type text/html) incluent le champ d'en-tête 'Cross-Origin-Opener-Policy' avec la directive 'same-origin' ou s'ame-origin-allow-popups', selon les besoins. Cela empêche les attaques abusant de l'accès partagé aux objets Window, telles que le tabnabbing et le comptage d'images.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.5", + "Ordinal": 5, + "Name": "Séparation de l'origine du navigateur", + "Items": [ + { + "Shortcode": "V3.5.1", + "Ordinal": 1, + "Description": "Vérifiez que, si l'application ne s'appuie pas sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher les requêtes inter-origines non autorisées d'utiliser des fonctionnalités sensibles, ces requêtes sont validées afin de garantir leur origine. Cela peut se faire en utilisant et en validant des jetons anti-falsification ou en exigeant des champs d'en-tête HTTP supplémentaires qui ne sont pas des champs d'en-tête de requête CORS safelist. Ceci permet de se protéger contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).", + "L": "1" + }, + { + "Shortcode": "V3.5.2", + "Ordinal": 2, + "Description": "Vérifiez que, si l'application s'appuie sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher l'utilisation inter-origines non autorisée de fonctionnalités sensibles, il est impossible d'appeler la fonctionnalité avec une requête qui ne déclenche pas de requête de pré-vérification cross-origin CORS. Cela peut nécessiter de vérifier les valeurs des champs d'en-tête de requête 'Origin' et 'Content-Type' ou d'utiliser un champ d'en-tête supplémentaire qui n'est pas un champ d'en-tête de la liste de sécurité CORS.", + "L": "1" + }, + { + "Shortcode": "V3.5.3", + "Ordinal": 3, + "Description": "Vérifiez que les requêtes HTTP destinées aux fonctionnalités sensibles utilisent des méthodes HTTP appropriées, telles que POST, PUT, PATCH ou DELETE, et non des méthodes définies comme « sûres » par la spécification HTTP, telles que HEAD, OPTIONS ou GET. Une validation stricte des champs d'en-tête de requête Sec-Fetch-* peut également être utilisée pour garantir que la requête ne provient pas d'un appel inter-origines inapproprié, d'une requête de navigation ou d'un chargement de ressources (comme une source d'image) inattendu.", + "L": "1" + }, + { + "Shortcode": "V3.5.4", + "Ordinal": 4, + "Description": "Vérifiez que des applications distinctes sont hébergées sur des noms d'hôte différents pour tirer parti des restrictions fournies par la politique de même origine, y compris la manière dont les documents ou scripts chargés par une origine peuvent interagir avec les ressources d'une autre origine et les restrictions basées sur le nom d'hôte sur les cookies.", + "L": "2" + }, + { + "Shortcode": "V3.5.5", + "Ordinal": 5, + "Description": "Vérifiez que les messages reçus par l'interface postMessage sont rejetés si l'origine du message n'est pas digne de confiance ou si la syntaxe du message n'est pas valide.", + "L": "2" + }, + { + "Shortcode": "V3.5.6", + "Ordinal": 6, + "Description": "Vérifiez que la fonctionnalité JSONP n'est activée nulle part dans l'application pour éviter les attaques Cross-Site Script Inclusion (XSSI).", + "L": "3" + }, + { + "Shortcode": "V3.5.7", + "Ordinal": 7, + "Description": "Vérifiez que les données nécessitant une autorisation ne sont pas incluses dans les réponses des ressources de script, comme les fichiers JavaScript, pour empêcher les attaques par inclusion de script intersite (XSSI).", + "L": "3" + }, + { + "Shortcode": "V3.5.8", + "Ordinal": 8, + "Description": "Vérifiez que les ressources authentifiées (telles que les images, les vidéos, les scripts et autres documents) peuvent être chargées ou intégrées pour le compte de l'utilisateur uniquement lorsque cela est prévu. Cela peut être réalisé en validant strictement les champs d'en-tête de requête HTTP Sec-Fetch-* afin de garantir que la requête ne provient pas d'un appel cross-origin inapproprié, ou en définissant un champ d'en-tête de réponse HTTP Cross-Origin-Resource-Policy restrictif pour indiquer au navigateur de bloquer le contenu renvoyé.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.6", + "Ordinal": 6, + "Name": "Intégrité des ressources externes", + "Items": [ + { + "Shortcode": "V3.6.1", + "Ordinal": 1, + "Description": "Vérifiez que les ressources côté client, telles que les bibliothèques JavaScript, les feuilles de style CSS ou les polices web, sont hébergées en externe (par exemple, sur un réseau de diffusion de contenu) uniquement si la ressource est statique et versionnée, et si l'intégrité des sous-ressources (SRI) est utilisée pour valider l'intégrité de la ressource. Si cela n'est pas possible, une décision de sécurité documentée doit justifier cette décision pour chaque ressource.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.7", + "Ordinal": 7, + "Name": "Autres considérations sur la sécurité du navigateur", + "Items": [ + { + "Shortcode": "V3.7.1", + "Ordinal": 1, + "Description": "Vérifiez que l'application utilise uniquement des technologies côté client toujours prises en charge et considérées comme sécurisées. Parmi les technologies qui ne répondent pas à cette exigence figurent les plugins NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL ou les applets Java côté client.", + "L": "2" + }, + { + "Shortcode": "V3.7.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application redirigera automatiquement l'utilisateur vers un nom d'hôte ou un domaine différent (qui n'est pas contrôlé par l'application) uniquement lorsque la destination apparaît sur une liste d'autorisation.", + "L": "2" + }, + { + "Shortcode": "V3.7.3", + "Ordinal": 3, + "Description": "Vérifiez que le domaine de premier niveau de l'application (par exemple, site.tld) ​​est ajouté à la liste de préchargement publique pour HTTP Strict Transport Security (HSTS). Cela garantit que l'utilisation de TLS pour l'application est intégrée directement dans les principaux navigateurs, plutôt que de dépendre uniquement du champ d'en-tête de réponse Strict-Transport-Security.", + "L": "3" + }, + { + "Shortcode": "V3.7.4", + "Ordinal": 4, + "Description": "Vérifiez que l'application affiche une notification lorsque l'utilisateur est redirigé vers une URL hors du contrôle de l'application, avec une option pour annuler la navigation.", + "L": "3" + }, + { + "Shortcode": "V3.7.5", + "Ordinal": 5, + "Description": "Vérifiez que l'application se comporte comme documenté (par exemple, en avertissant l'utilisateur ou en bloquant l'accès) si le navigateur utilisé pour accéder à l'application ne prend pas en charge les fonctionnalités de sécurité attendues.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V4", + "Ordinal": 4, + "ShortName": "API", + "Name": "API et service Web", + "Items": [ + { + "Shortcode": "V4.1", + "Ordinal": 1, + "Name": "Sécurité du service Web générique", + "Items": [ + { + "Shortcode": "V4.1.1", + "Ordinal": 1, + "Description": "Vérifiez que chaque réponse HTTP avec un corps de message contient un champ d'en-tête Content-Type qui correspond au contenu réel de la réponse, y compris le paramètre charset pour spécifier un codage de caractères sécurisé (par exemple, UTF-8, ISO-8859-1) conformément aux types de médias IANA, tels que « text/ », « /+xml » et « /xml ».", + "L": "1" + }, + { + "Shortcode": "V4.1.2", + "Ordinal": 2, + "Description": "Vérifiez que seuls les terminaux utilisateurs (destinés à l'accès manuel via un navigateur web) redirigent automatiquement de HTTP vers HTTPS, tandis que les autres services ou terminaux n'implémentent pas de redirections transparentes. Cela permet d'éviter qu'un client envoie par erreur des requêtes HTTP non chiffrées, mais que, comme ces requêtes sont automatiquement redirigées vers HTTPS, la fuite de données sensibles passe inaperçue.", + "L": "2" + }, + { + "Shortcode": "V4.1.3", + "Ordinal": 3, + "Description": "Vérifiez que tout champ d'en-tête HTTP utilisé par l'application et défini par une couche intermédiaire, telle qu'un équilibreur de charge, un proxy web ou un service backend-for-frontend, ne peut pas être remplacé par l'utilisateur final. Les exemples d'en-têtes peuvent inclure X-Real-IP, X-Forwarded-*, ou X-User-ID.", + "L": "2" + }, + { + "Shortcode": "V4.1.4", + "Ordinal": 4, + "Description": "Vérifiez que seules les méthodes HTTP explicitement prises en charge par l'application ou son API (y compris les OPTIONS lors des demandes de contrôle en amont) peuvent être utilisées et que les méthodes inutilisées sont bloquées.", + "L": "3" + }, + { + "Shortcode": "V4.1.5", + "Ordinal": 5, + "Description": "Vérifier que les signatures numériques par message sont utilisées pour fournir une assurance supplémentaire en plus des protections de transport pour les demandes ou les transactions qui sont très sensibles ou qui traversent un certain nombre de systèmes.", + "L": "3" + } + ] + }, + { + "Shortcode": "V4.2", + "Ordinal": 2, + "Name": "Validation de la structure des messages HTTP", + "Items": [ + { + "Shortcode": "V4.2.1", + "Ordinal": 1, + "Description": "Vérifiez que tous les composants de l'application (y compris les équilibreurs de charge, les pares-feux et les serveurs d'applications) déterminent les limites des messages HTTP entrants à l'aide du mécanisme approprié à la version HTTP afin d'empêcher la contrebande de requêtes HTTP. Dans HTTP/1.x, si un champ d'en-tête Transfer-Encoding est présent, l'en-tête Content-Length doit être ignoré conformément à la RFC 2616. Avec HTTP/2 ou HTTP/3, si un champ d'en-tête Content-Length est présent, le récepteur doit s'assurer qu'il est cohérent avec la longueur des trames DATA.", + "L": "2" + }, + { + "Shortcode": "V4.2.2", + "Ordinal": 2, + "Description": "Vérifier que, lors de la génération de messages HTTP, le champ d'en-tête Content-Length n'entre pas en conflit avec la longueur du contenu déterminée par le cadrage du protocole HTTP, afin d'empêcher les attaques de type « request smuggling ».", + "L": "3" + }, + { + "Shortcode": "V4.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l'application n'envoie ni n'accepte de messages HTTP/2 ou HTTP/3 avec des champs d'en-tête spécifiques à la connexion, tels que Transfer-Encoding, afin d'éviter les attaques par fractionnement de la réponse et par injection d'en-tête.", + "L": "3" + }, + { + "Shortcode": "V4.2.4", + "Ordinal": 4, + "Description": "Vérifiez que l'application n'accepte que les requêtes HTTP/2 et HTTP/3 dont les champs et valeurs d'en-tête ne contiennent pas de séquences CR (\\r), LF (\\n) ou CRLF (\\r\\n), afin d'éviter les attaques par injection d'en-tête.", + "L": "3" + }, + { + "Shortcode": "V4.2.5", + "Ordinal": 5, + "Description": "Vérifiez que, si l'application (backend ou frontend) construit et envoie des requêtes, elle utilise des mécanismes de validation, d'assainissement ou autres pour éviter de créer des URI (comme pour les appels API) ou des champs d'en-tête de requête HTTP (comme Authorization ou Cookie) qui sont trop longs pour être acceptés par le composant récepteur. Cela pourrait entraîner un déni de service, par exemple lors de l'envoi d'une requête trop longue (par exemple, un long champ d'en-tête de cookie), ce qui fait que le serveur répond toujours avec un statut d'erreur.", + "L": "3" + } + ] + }, + { + "Shortcode": "V4.3", + "Ordinal": 3, + "Name": "GraphQL", + "Items": [ + { + "Shortcode": "V4.3.1", + "Ordinal": 1, + "Description": "Vérifiez qu'une liste d'autorisation de requête, une limitation de profondeur, une limitation de quantité ou une analyse des coûts de requête est utilisée pour empêcher le déni de service (DoS) de GraphQL ou d'expression de la couche données en raison de requêtes imbriquées coûteuses.", + "L": "2" + }, + { + "Shortcode": "V4.3.2", + "Ordinal": 2, + "Description": "Vérifiez que les requêtes d’introspection GraphQL sont désactivées dans l’environnement de production, sauf si l’API GraphQL est destinée à être utilisée par d’autres parties.", + "L": "2" + } + ] + }, + { + "Shortcode": "V4.4", + "Ordinal": 4, + "Name": "WebSocket", + "Items": [ + { + "Shortcode": "V4.4.1", + "Ordinal": 1, + "Description": "Vérifiez que WebSocket sur TLS (WSS) est utilisé pour toutes les connexions WebSocket.", + "L": "1" + }, + { + "Shortcode": "V4.4.2", + "Ordinal": 2, + "Description": "Vérifiez que, lors de la négociation HTTP WebSocket initiale, le champ d’en-tête 'Origin' est vérifié par rapport à une liste d’origines autorisées pour l’application.", + "L": "2" + }, + { + "Shortcode": "V4.4.3", + "Ordinal": 3, + "Description": "Vérifiez que, si la gestion de session standard de l'application ne peut pas être utilisée, des jetons dédiés sont utilisés à cet effet, qui sont conformes aux exigences de sécurité de gestion de session pertinentes.", + "L": "2" + }, + { + "Shortcode": "V4.4.4", + "Ordinal": 4, + "Description": "Vérifiez que les jetons de gestion de session WebSocket dédiés sont initialement obtenus ou validés via la session HTTPS précédemment authentifiée lors de la transition d'une session HTTPS existante vers un canal WebSocket.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V5", + "Ordinal": 5, + "ShortName": "File", + "Name": "Gestion des fichiers", + "Items": [ + { + "Shortcode": "V5.1", + "Ordinal": 1, + "Name": "Documentation sur la gestion des fichiers", + "Items": [ + { + "Shortcode": "V5.1.1", + "Ordinal": 1, + "Description": "Vérifiez que la documentation définit les types de fichiers autorisés, les extensions de fichiers attendues et la taille maximale (y compris la taille décompressée) pour chaque fonctionnalité de Téléversement. De plus, assurez-vous que la documentation précise comment les fichiers sont sécurisés pour le téléchargement et le traitement des utilisateurs finaux, par exemple le comportement de l'application lorsqu'un fichier malveillant est détecté.", + "L": "2" + } + ] + }, + { + "Shortcode": "V5.2", + "Ordinal": 2, + "Name": "Téléversement de fichiers et contenu", + "Items": [ + { + "Shortcode": "V5.2.1", + "Ordinal": 1, + "Description": "Vérifiez que l'application n'acceptera que des fichiers d'une taille qu'elle peut traiter sans provoquer de perte de performances ou d'attaque par déni de service.", + "L": "1" + }, + { + "Shortcode": "V5.2.2", + "Ordinal": 2, + "Description": "Vérifiez que lorsque l'application accepte un fichier, seul ou dans une archive telle qu'un fichier zip, elle vérifie si l'extension de fichier correspond à une extension attendue et que le contenu correspond au type représenté par l'extension. Cela inclut, sans s'y limiter, la vérification des « octets magiques » initiaux, la réécriture d'images et l'utilisation de bibliothèques spécialisées pour la validation du contenu des fichiers. Pour le niveau L1, cela peut se concentrer uniquement sur les fichiers utilisés pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau L2, cela doit s'appliquer à tous les fichiers acceptés.", + "L": "1" + }, + { + "Shortcode": "V5.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l'application vérifie les fichiers compressés (par exemple, zip, gz, docx, odt) par rapport à la taille maximale autorisée non compressée et au nombre maximal de fichiers avant de décompresser le fichier.", + "L": "2" + }, + { + "Shortcode": "V5.2.4", + "Ordinal": 4, + "Description": "Vérifiez qu'un quota de taille de fichier et un nombre maximal de fichiers par utilisateur sont appliqués pour garantir qu'un seul utilisateur ne puisse pas remplir le stockage avec trop de fichiers ou des fichiers excessivement volumineux.", + "L": "3" + }, + { + "Shortcode": "V5.2.5", + "Ordinal": 5, + "Description": "Vérifiez que l'application n'autorise pas le téléversement de fichiers compressés contenant des liens symboliques, sauf si cela est spécifiquement requis (auquel cas il sera nécessaire d'appliquer une liste d'autorisation des fichiers vers lesquels il est possible de créer des liens symboliques).", + "L": "3" + }, + { + "Shortcode": "V5.2.6", + "Ordinal": 6, + "Description": "Vérifiez que l'application rejette les images téléversées avec une taille de pixel supérieure au maximum autorisé, afin d'éviter les attaques par inondation de pixels.", + "L": "3" + } + ] + }, + { + "Shortcode": "V5.3", + "Ordinal": 3, + "Name": "Stockage de fichiers", + "Items": [ + { + "Shortcode": "V5.3.1", + "Ordinal": 1, + "Description": "Vérifiez que les fichiers téléversés ou générés par une entrée non fiable et stockés dans un dossier public ne sont pas exécutés en tant que code de programme côté serveur lorsqu'ils sont accessibles directement avec une requête HTTP.", + "L": "1" + }, + { + "Shortcode": "V5.3.2", + "Ordinal": 2, + "Description": "Vérifiez que lorsque l'application crée des chemins d'accès pour les opérations sur les fichiers, elle utilise des données générées en interne ou fiables plutôt que des noms de fichiers soumis par l'utilisateur. Si des noms de fichiers ou des métadonnées de fichiers soumis par l'utilisateur doivent être utilisés, une validation et un nettoyage stricts doivent être appliqués. Ceci permet de se protéger contre les attaques par traversée de chemin, l'inclusion de fichiers locaux ou distants (LFI, RFI) et la falsification de requêtes côté serveur (SSRF).", + "L": "1" + }, + { + "Shortcode": "V5.3.3", + "Ordinal": 3, + "Description": "Vérifiez que le traitement des fichiers côté serveur, comme la décompression des fichiers, ignore les informations de chemin fournies par l'utilisateur pour éviter les vulnérabilités telles que le \"zip slip\".", + "L": "3" + } + ] + }, + { + "Shortcode": "V5.4", + "Ordinal": 4, + "Name": "Téléchargement de fichier", + "Items": [ + { + "Shortcode": "V5.4.1", + "Ordinal": 1, + "Description": "Vérifiez que l’application valide ou ignore les noms de fichiers soumis par l’utilisateur, y compris dans un paramètre JSON, JSONP ou URL et spécifie un nom de fichier dans le champ d’en-tête Content-Disposition de la réponse.", + "L": "2" + }, + { + "Shortcode": "V5.4.2", + "Ordinal": 2, + "Description": "Vérifiez que les noms de fichiers servis (par exemple, dans les champs d'en-tête de réponse HTTP ou les pièces jointes aux e-mails) sont encodés ou nettoyés (par exemple, conformément à la RFC 6266) pour préserver la structure du document et empêcher les attaques par injection.", + "L": "2" + }, + { + "Shortcode": "V5.4.3", + "Ordinal": 3, + "Description": "Vérifiez que les fichiers obtenus à partir de sources non fiables sont analysés par des scanners antivirus pour empêcher la diffusion de contenu malveillant connu.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V6", + "Ordinal": 6, + "ShortName": "Authentication", + "Name": "Authentification", + "Items": [ + { + "Shortcode": "V6.1", + "Ordinal": 1, + "Name": "Documentation d'authentification", + "Items": [ + { + "Shortcode": "V6.1.1", + "Ordinal": 1, + "Description": "Vérifiez que la documentation de l'application définit comment les contrôles, tels que la limitation de débit, l'anti-automatisation et la réponse adaptative, sont utilisés pour se défendre contre les attaques telles que le « credential stuffing » et la force brute des mots de passe. La documentation doit expliquer clairement comment ces contrôles sont configurés et empêcher le blocage malveillant des comptes.", + "L": "1" + }, + { + "Shortcode": "V6.1.2", + "Ordinal": 2, + "Description": "Vérifiez qu'une liste de mots spécifiques au contexte est documentée afin d'empêcher leur utilisation dans les mots de passe. Cette liste peut inclure des permutations de noms d'organisations, de produits, d'identifiants de systèmes, de noms de codes de projets, de noms de services ou de rôles, etc.", + "L": "2" + }, + { + "Shortcode": "V6.1.3", + "Ordinal": 3, + "Description": "Vérifiez que, si l'application inclut plusieurs voies d'authentification, celles-ci sont toutes documentées avec les contrôles de sécurité et la force d'authentification qui doivent être appliqués de manière cohérente.", + "L": "2" + } + ] + }, + { + "Shortcode": "V6.2", + "Ordinal": 2, + "Name": "Sécurité des mots de passe", + "Items": [ + { + "Shortcode": "V6.2.1", + "Ordinal": 1, + "Description": "Vérifiez que les mots de passe définis par l'utilisateur comportent au moins 8 caractères, bien qu'un minimum de 15 caractères soit fortement recommandé.", + "L": "1" + }, + { + "Shortcode": "V6.2.2", + "Ordinal": 2, + "Description": "Vérifiez que les utilisateurs peuvent modifier leur mot de passe.", + "L": "1" + }, + { + "Shortcode": "V6.2.3", + "Ordinal": 3, + "Description": "Vérifiez que la fonctionnalité de changement de mot de passe nécessite le mot de passe actuel et le nouveau mot de passe de l'utilisateur.", + "L": "1" + }, + { + "Shortcode": "V6.2.4", + "Ordinal": 4, + "Description": "Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou du changement de mot de passe sont vérifiés par rapport à un ensemble disponible d'au moins 3 000 mots de passe principaux qui correspondent à la politique de mot de passe de l'application, par exemple la longueur minimale.", + "L": "1" + }, + { + "Shortcode": "V6.2.5", + "Ordinal": 5, + "Description": "Vérifiez que les mots de passe peuvent être utilisés, quelle que soit leur composition, sans restriction quant au type de caractères autorisés. Aucun nombre minimal de majuscules ou de minuscules, de chiffres ou de caractères spéciaux ne doit être exigé.", + "L": "1" + }, + { + "Shortcode": "V6.2.6", + "Ordinal": 6, + "Description": "Vérifiez que les champs de saisie du mot de passe utilisent type=password pour masquer la saisie. Les applications peuvent permettre à l'utilisateur d'afficher temporairement l'intégralité du mot de passe masqué ou le dernier caractère saisi.", + "L": "1" + }, + { + "Shortcode": "V6.2.7", + "Ordinal": 7, + "Description": "Vérifiez que la fonctionnalité « coller », les assistants de mot de passe du navigateur et les gestionnaires de mots de passe externes sont autorisés.", + "L": "1" + }, + { + "Shortcode": "V6.2.8", + "Ordinal": 8, + "Description": "Vérifiez que l'application vérifie le mot de passe de l'utilisateur exactement tel qu'il a été reçu de l'utilisateur, sans aucune modification telle qu'une troncature ou une transformation de casse.", + "L": "1" + }, + { + "Shortcode": "V6.2.9", + "Ordinal": 9, + "Description": "Vérifiez que les mots de passe d’au moins 64 caractères sont autorisés.", + "L": "2" + }, + { + "Shortcode": "V6.2.10", + "Ordinal": 10, + "Description": "Vérifiez que le mot de passe d'un utilisateur reste valide jusqu'à ce qu'il soit découvert comme compromis ou qu'il soit renouvelé. L'application ne doit pas exiger de renouvellement périodique des identifiants.", + "L": "2" + }, + { + "Shortcode": "V6.2.11", + "Ordinal": 11, + "Description": "Vérifiez que la liste documentée de mots spécifiques au contexte est utilisée pour éviter la création de mots de passe faciles à deviner.", + "L": "2" + }, + { + "Shortcode": "V6.2.12", + "Ordinal": 12, + "Description": "Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou des modifications de mot de passe sont vérifiés par rapport à un ensemble de mots de passe fuités.", + "L": "2" + } + ] + }, + { + "Shortcode": "V6.3", + "Ordinal": 3, + "Name": "Sécurité générale de l'authentification", + "Items": [ + { + "Shortcode": "V6.3.1", + "Ordinal": 1, + "Description": "Vérifiez que les contrôles visant à empêcher les attaques telles que le bourrage d'informations d'identification et la force brute des mots de passe sont mis en œuvre conformément à la documentation de sécurité de l'application.", + "L": "1" + }, + { + "Shortcode": "V6.3.2", + "Ordinal": 2, + "Description": "Vérifiez que les comptes d’utilisateur par défaut (par exemple, « root », « admin » ou « sa ») ne sont pas présents dans l’application ou sont désactivés.", + "L": "1" + }, + { + "Shortcode": "V6.3.3", + "Ordinal": 3, + "Description": "Vérifiez que l’application exige que les utilisateurs utilisent un mécanisme d’authentification multifacteur ou une combinaison de mécanismes d’authentification à facteur unique.", + "L": "2" + }, + { + "Shortcode": "V6.3.4", + "Ordinal": 4, + "Description": "Vérifiez que, si l’application inclut plusieurs voies d’authentification, il n’existe aucune voie non documentée et que les contrôles de sécurité et la force d’authentification sont appliqués de manière cohérente.", + "L": "2" + }, + { + "Shortcode": "V6.3.5", + "Ordinal": 5, + "Description": "Vérifiez que les utilisateurs sont informés des tentatives d'authentification suspectes (réussies ou non). Il peut s'agir de tentatives d'authentification provenant d'un emplacement ou d'un client inhabituel, d'une authentification partiellement réussie (un seul facteur parmi plusieurs), d'une tentative d'authentification après une longue période d'inactivité ou d'une authentification réussie après plusieurs tentatives infructueuses.", + "L": "3" + }, + { + "Shortcode": "V6.3.6", + "Ordinal": 6, + "Description": "Vérifiez que le courrier électronique n’est pas utilisé comme mécanisme d’authentification à facteur unique ou à facteurs multiples.", + "L": "3" + }, + { + "Shortcode": "V6.3.7", + "Ordinal": 7, + "Description": "Vérifiez que les utilisateurs sont avertis après les mises à jour des détails d'authentification, telles que les réinitialisations d'informations d'identification ou la modification du nom d'utilisateur ou de l'adresse e-mail.", + "L": "3" + }, + { + "Shortcode": "V6.3.8", + "Ordinal": 8, + "Description": "Vérifiez que les utilisateurs valides ne peuvent pas être déduits d'échecs d'authentification, par exemple en se basant sur des messages d'erreur, des codes de réponse HTTP ou des temps de réponse différents. Les fonctionnalités d'inscription et de mot de passe oublié doivent également bénéficier de cette protection.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.4", + "Ordinal": 4, + "Name": "Cycle de vie et récupération du facteur d'authentification", + "Items": [ + { + "Shortcode": "V6.4.1", + "Ordinal": 1, + "Description": "Vérifiez que les mots de passe initiaux ou les codes d'activation générés par le système sont générés de manière aléatoire et sécurisée, qu'ils respectent la politique de mots de passe en vigueur et qu'ils expirent après une courte période ou après leur première utilisation. Ces secrets initiaux ne doivent pas devenir des mots de passe permanents.", + "L": "1" + }, + { + "Shortcode": "V6.4.2", + "Ordinal": 2, + "Description": "Vérifiez que les indices de mot de passe ou l'authentification basée sur les connaissances (appelées « questions secrètes ») ne sont pas présents.", + "L": "1" + }, + { + "Shortcode": "V6.4.3", + "Ordinal": 3, + "Description": "Vérifiez qu'un processus sécurisé de réinitialisation d'un mot de passe oublié est mis en œuvre, qui ne contourne aucun mécanisme d'authentification multifacteur activé.", + "L": "2" + }, + { + "Shortcode": "V6.4.4", + "Ordinal": 4, + "Description": "Vérifiez que si un facteur d'authentification multifacteur est perdu, la preuve de vérification d'identité est effectuée au même niveau que lors de l'inscription.", + "L": "2" + }, + { + "Shortcode": "V6.4.5", + "Ordinal": 5, + "Description": "Vérifiez que les instructions de renouvellement des mécanismes d'authentification qui expirent sont envoyées avec suffisamment de temps pour être exécutées avant l'expiration de l'ancien mécanisme d'authentification, en configurant des rappels automatiques si nécessaire.", + "L": "3" + }, + { + "Shortcode": "V6.4.6", + "Ordinal": 6, + "Description": "Vérifiez que les administrateurs peuvent initier la réinitialisation du mot de passe de l'utilisateur, mais que cela ne leur permet pas de modifier ou de choisir son mot de passe. Cela évite qu'ils ne connaissent le mot de passe de l'utilisateur.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.5", + "Ordinal": 5, + "Name": "Exigences générales en matière d'authentification multifacteur", + "Items": [ + { + "Shortcode": "V6.5.1", + "Ordinal": 1, + "Description": "Vérifiez que les secrets de recherche, les demandes ou codes d'authentification out-of-band et les mots de passe à usage unique basés sur le temps (TOTP) ne peuvent être utilisés avec succès qu'une seule fois.", + "L": "2" + }, + { + "Shortcode": "V6.5.2", + "Ordinal": 2, + "Description": "Vérifiez que, lors de leur stockage dans le backend de l'application, les secrets de recherche comportant moins de 112 bits d'entropie (19 caractères alphanumériques aléatoires ou 34 chiffres aléatoires) sont hachés avec un algorithme de hachage de stockage de mots de passe approuvé, intégrant un sel aléatoire de 32 bits. Une fonction de hachage standard peut être utilisée si le secret comporte 112 bits d'entropie ou plus.", + "L": "2" + }, + { + "Shortcode": "V6.5.3", + "Ordinal": 3, + "Description": "Vérifiez que les secrets de recherche, le code d'authentification out-of-band et les mots de passe à usage unique basés sur le temps sont générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) pour éviter les valeurs prévisibles.", + "L": "2" + }, + { + "Shortcode": "V6.5.4", + "Ordinal": 4, + "Description": "Vérifiez que les secrets de recherche et les codes d'authentification out-of-band ont un minimum de 20 bits d'entropie (généralement 4 caractères alphanumériques aléatoires ou 6 chiffres aléatoires suffisent).", + "L": "2" + }, + { + "Shortcode": "V6.5.5", + "Ordinal": 5, + "Description": "Vérifiez que les requêtes, codes ou jetons d'authentification out-of-band, ainsi que les mots de passe à usage unique (TOTP), ont une durée de vie définie. Les requêtes out-of-band doivent avoir une durée de vie maximale de 10 minutes et les TOTP, de 30 secondes.", + "L": "2" + }, + { + "Shortcode": "V6.5.6", + "Ordinal": 6, + "Description": "Vérifiez que tout facteur d’authentification (y compris les appareils physiques) peut être révoqué en cas de vol ou autre perte.", + "L": "3" + }, + { + "Shortcode": "V6.5.7", + "Ordinal": 7, + "Description": "Vérifiez que les mécanismes d’authentification biométrique ne sont utilisés que comme facteurs secondaires, avec quelque chose que vous possédez ou quelque chose que vous savez.", + "L": "3" + }, + { + "Shortcode": "V6.5.8", + "Ordinal": 8, + "Description": "Vérifiez que les mots de passe à usage unique basés sur le temps (TOTP) sont vérifiés en fonction d'une source temporelle provenant d'un service de confiance et non d'une heure non fiable ou fournie par le client.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.6", + "Ordinal": 6, + "Name": "Mécanismes d'authentification out-of-band", + "Items": [ + { + "Shortcode": "V6.6.1", + "Ordinal": 1, + "Description": "Vérifier que les mécanismes d'authentification utilisant le réseau téléphonique public commuté (RTPC) pour la transmission de mots de passe à usage unique (OTP) par téléphone ou SMS ne sont proposés que lorsque le numéro de téléphone a été préalablement validé. D'autres méthodes plus robustes (telles que les mots de passe à usage unique à durée déterminée) sont également proposées, et que le service informe les utilisateurs des risques de sécurité qu'elles présentent. Pour les applications de niveau 3, le téléphone et les SMS ne doivent pas être disponibles.", + "L": "2" + }, + { + "Shortcode": "V6.6.2", + "Ordinal": 2, + "Description": "Vérifiez que les demandes d’authentification out-of-band, les codes ou les jetons sont liés à la demande d’authentification d’origine pour laquelle ils ont été générés et ne sont pas utilisables pour une demande précédente ou ultérieure.", + "L": "2" + }, + { + "Shortcode": "V6.6.3", + "Ordinal": 3, + "Description": "Vérifiez qu'un mécanisme d'authentification out-of-band basé sur du code est protégé contre les attaques par force brute grâce au \"rate limiting\". Envisagez également d'utiliser un code avec au moins 64 bits d'entropie.", + "L": "2" + }, + { + "Shortcode": "V6.6.4", + "Ordinal": 4, + "Description": "Vérifiez que, lorsque les notifications push sont utilisées pour l'authentification multifacteur, le \"rate limiting\" est appliqué afin d'empêcher les attaques de type « push bombing ». La concordance des numéros peut également atténuer ce risque.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.7", + "Ordinal": 7, + "Name": "Mécanisme d'authentification cryptographique", + "Items": [ + { + "Shortcode": "V6.7.1", + "Ordinal": 1, + "Description": "Vérifiez que les certificats utilisés pour vérifier les assertions d’authentification cryptographique sont stockés de manière à les protéger contre toute modification.", + "L": "3" + }, + { + "Shortcode": "V6.7.2", + "Ordinal": 2, + "Description": "Vérifiez que le nonce de défi a une longueur d'au moins 64 bits et qu'il est statistiquement unique ou unique sur toute la durée de vie du périphérique cryptographique.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.8", + "Ordinal": 8, + "Name": "Authentification avec un fournisseur d'identité", + "Items": [ + { + "Shortcode": "V6.8.1", + "Ordinal": 1, + "Description": "Vérifiez que, si l'application prend en charge plusieurs fournisseurs d'identité (IdP), l'identité de l'utilisateur ne peut pas être usurpée via un autre fournisseur d'identité pris en charge (par exemple, en utilisant le même identifiant utilisateur). La mesure standard consisterait à ce que l'application enregistre et identifie l'utilisateur à l'aide d'une combinaison de l'ID du fournisseur d'identité (servant d'espace de noms) et de l'ID de l'utilisateur dans le fournisseur d'identité.", + "L": "2" + }, + { + "Shortcode": "V6.8.2", + "Ordinal": 2, + "Description": "Vérifiez que la présence et l'intégrité des signatures numériques sur les assertions d'authentification (par exemple sur les assertions JWT ou SAML) sont toujours validées, en rejetant toutes les assertions non signées ou ayant des signatures non valides.", + "L": "2" + }, + { + "Shortcode": "V6.8.3", + "Ordinal": 3, + "Description": "Vérifiez que les assertions SAML sont traitées de manière unique et utilisées une seule fois au cours de la période de validité pour éviter les attaques par rejeu.", + "L": "2" + }, + { + "Shortcode": "V6.8.4", + "Ordinal": 4, + "Description": "Si une application utilise un fournisseur d'identité (IdP) distinct et attend une force, des méthodes ou une date d'authentification spécifiques pour des fonctions spécifiques, vérifiez que l'application les vérifie à l'aide des informations renvoyées par l'IdP. Par exemple, si OIDC est utilisé, cela peut être réalisé en validant les affirmations de jeton d'identification telles que « acr », « amr » et « auth_time » (le cas échéant). Si l'IdP ne fournit pas ces informations, l'application doit disposer d'une approche de secours documentée qui suppose que le mécanisme d'authentification de force minimale a été utilisé (par exemple, une authentification à facteur unique avec nom d'utilisateur et mot de passe).", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V7", + "Ordinal": 7, + "ShortName": "Session", + "Name": "Gestion des sessions", + "Items": [ + { + "Shortcode": "V7.1", + "Ordinal": 1, + "Name": "Documentation sur la gestion des sessions", + "Items": [ + { + "Shortcode": "V7.1.1", + "Ordinal": 1, + "Description": "Vérifiez que le délai d'inactivité de la session de l'utilisateur et la durée de vie maximale absolue de la session sont documentés, sont appropriés en combinaison avec d'autres contrôles et que la documentation inclut une justification de tout écart par rapport aux exigences de réauthentification NIST SP 800-63B.", + "L": "2" + }, + { + "Shortcode": "V7.1.2", + "Ordinal": 2, + "Description": "Vérifiez que la documentation définit le nombre de sessions simultanées (parallèles) autorisées pour un compte ainsi que les comportements et actions prévus à entreprendre lorsque le nombre maximal de sessions actives est atteint.", + "L": "2" + }, + { + "Shortcode": "V7.1.3", + "Ordinal": 3, + "Description": "Vérifiez que tous les systèmes qui créent et gèrent des sessions utilisateur dans le cadre d'un écosystème de gestion des identités fédérées (tels que les systèmes SSO) sont documentés avec des contrôles pour coordonner la durée de vie des sessions, la résiliation et toute autre condition nécessitant une réauthentification.", + "L": "2" + } + ] + }, + { + "Shortcode": "V7.2", + "Ordinal": 2, + "Name": "Sécurité fondamentale de la gestion des sessions", + "Items": [ + { + "Shortcode": "V7.2.1", + "Ordinal": 1, + "Description": "Vérifiez que l’application effectue toutes les vérifications des jetons de session à l’aide d’un service backend de confiance.", + "L": "1" + }, + { + "Shortcode": "V7.2.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application utilise des jetons autonomes ou de référence générés dynamiquement pour la gestion des sessions, c'est-à-dire sans utiliser de secrets et de clés d'API statiques.", + "L": "1" + }, + { + "Shortcode": "V7.2.3", + "Ordinal": 3, + "Description": "Vérifiez que si des jetons par référence sont utilisés pour représenter les sessions utilisateur, ils sont uniques et générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et possèdent au moins 128 bits d'entropie.", + "L": "1" + }, + { + "Shortcode": "V7.2.4", + "Ordinal": 4, + "Description": "Vérifiez que l’application génère un nouveau jeton de session lors de l’authentification de l’utilisateur, y compris la réauthentification, et met fin au jeton de session actuel.", + "L": "1" + } + ] + }, + { + "Shortcode": "V7.3", + "Ordinal": 3, + "Name": "Délai d'expiration de la session", + "Items": [ + { + "Shortcode": "V7.3.1", + "Ordinal": 1, + "Description": "Vérifiez qu’il existe un délai d’inactivité tel que la réauthentification soit appliquée conformément à l’analyse des risques et aux décisions de sécurité documentées.", + "L": "2" + }, + { + "Shortcode": "V7.3.2", + "Ordinal": 2, + "Description": "Vérifiez qu'il existe une durée de vie maximale absolue de la session de sorte que la réauthentification soit appliquée conformément à l'analyse des risques et aux décisions de sécurité documentées.", + "L": "2" + } + ] + }, + { + "Shortcode": "V7.4", + "Ordinal": 4, + "Name": "Fin de session", + "Items": [ + { + "Shortcode": "V7.4.1", + "Ordinal": 1, + "Description": "Vérifiez que lorsque la fin de session est déclenchée (par exemple, déconnexion ou expiration), l'application interdit toute utilisation ultérieure de la session. Pour les jetons par référence ou les sessions avec état, cela implique l'invalidation des données de session au niveau du backend de l'application. Les applications utilisant des jetons autonomes nécessiteront une solution, comme la gestion d'une liste des jetons terminés, l'interdiction des jetons produits avant une date et une heure spécifique à chaque utilisateur ou la rotation d'une clé de signature spécifique à chaque utilisateur.", + "L": "1" + }, + { + "Shortcode": "V7.4.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application met fin à toutes les sessions actives lorsqu'un compte utilisateur est désactivé ou supprimé (par exemple, lorsqu'un employé quitte l'entreprise).", + "L": "1" + }, + { + "Shortcode": "V7.4.3", + "Ordinal": 3, + "Description": "Vérifiez que l'application offre la possibilité de mettre fin à toutes les autres sessions actives après une modification ou une suppression réussie de tout facteur d'authentification (y compris la modification du mot de passe via une réinitialisation ou une récupération et, le cas échéant, une mise à jour des paramètres MFA).", + "L": "2" + }, + { + "Shortcode": "V7.4.4", + "Ordinal": 4, + "Description": "Vérifiez que toutes les pages nécessitant une authentification disposent d’un accès facile et visible à la fonctionnalité de déconnexion.", + "L": "2" + }, + { + "Shortcode": "V7.4.5", + "Ordinal": 5, + "Description": "Vérifiez que les administrateurs d’applications sont en mesure de mettre fin aux sessions actives pour un utilisateur individuel ou pour tous les utilisateurs.", + "L": "2" + } + ] + }, + { + "Shortcode": "V7.5", + "Ordinal": 5, + "Name": "Défenses contre les abus de session", + "Items": [ + { + "Shortcode": "V7.5.1", + "Ordinal": 1, + "Description": "Vérifiez que l'application nécessite une réauthentification complète avant d'autoriser les modifications des attributs de compte sensibles qui peuvent affecter l'authentification, tels que l'adresse e-mail, le numéro de téléphone, la configuration MFA ou d'autres informations utilisées dans la récupération de compte.", + "L": "2" + }, + { + "Shortcode": "V7.5.2", + "Ordinal": 2, + "Description": "Vérifiez que les utilisateurs peuvent afficher et (après s'être authentifiés à nouveau avec au moins un facteur) terminer une ou toutes les sessions actuellement actives.", + "L": "2" + }, + { + "Shortcode": "V7.5.3", + "Ordinal": 3, + "Description": "Vérifiez que l’application nécessite une authentification supplémentaire avec au moins un facteur ou une vérification secondaire avant d’effectuer des transactions ou des opérations hautement sensibles.", + "L": "3" + } + ] + }, + { + "Shortcode": "V7.6", + "Ordinal": 6, + "Name": "Réauthentification fédérée", + "Items": [ + { + "Shortcode": "V7.6.1", + "Ordinal": 1, + "Description": "Vérifiez que la durée de vie et la fin de la session entre les parties de confiance (RP) et les fournisseurs d'identité (IdP) se comportent comme documenté, en exigeant une réauthentification si nécessaire, par exemple lorsque le temps maximal entre les événements d'authentification IdP est atteint.", + "L": "2" + }, + { + "Shortcode": "V7.6.2", + "Ordinal": 2, + "Description": "Vérifiez que la création d'une session nécessite soit le consentement de l'utilisateur, soit une action explicite, empêchant ainsi la création de nouvelles sessions d'application sans interaction de l'utilisateur.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V8", + "Ordinal": 8, + "ShortName": "Authorization", + "Name": "Autorisation", + "Items": [ + { + "Shortcode": "V8.1", + "Ordinal": 1, + "Name": "Documentation d'autorisation", + "Items": [ + { + "Shortcode": "V8.1.1", + "Ordinal": 1, + "Description": "Vérifiez que la documentation d’autorisation définit des règles de restriction de l’accès au niveau de la fonction et aux données en fonction des autorisations du consommateur et des attributs des ressources.", + "L": "1" + }, + { + "Shortcode": "V8.1.2", + "Ordinal": 2, + "Description": "Vérifiez que la documentation d'autorisation définit les règles de restriction d'accès au niveau des champs (lecture et écriture) en fonction des autorisations des consommateurs et des attributs des ressources. Notez que ces règles peuvent dépendre d'autres valeurs d'attributs de l'objet de données concerné, telles que l'état ou le statut.", + "L": "2" + }, + { + "Shortcode": "V8.1.3", + "Ordinal": 3, + "Description": "Vérifiez que la documentation de l'application définit les attributs environnementaux et contextuels (y compris, mais sans s'y limiter, l'heure de la journée, l'emplacement de l'utilisateur, l'adresse IP ou l'appareil) qui sont utilisés dans l'application pour prendre des décisions de sécurité, y compris celles relatives à l'authentification et à l'autorisation.", + "L": "3" + }, + { + "Shortcode": "V8.1.4", + "Ordinal": 4, + "Description": "Vérifier que la documentation d'authentification et d'autorisation définit l'utilisation des facteurs environnementaux et contextuels dans la prise de décision, en plus des autorisations au niveau des fonctions, des données et des champs. Cela doit inclure les attributs évalués, les seuils de risque et les actions entreprises (par exemple, autorisation, contestation, refus, renforcement de l'authentification).", + "L": "3" + } + ] + }, + { + "Shortcode": "V8.2", + "Ordinal": 2, + "Name": "Conception d'autorisation générale", + "Items": [ + { + "Shortcode": "V8.2.1", + "Ordinal": 1, + "Description": "Vérifiez que l’application garantit que l’accès basé sur la fonction est limité aux consommateurs disposant d’autorisations explicites.", + "L": "1" + }, + { + "Shortcode": "V8.2.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application garantit que l'accès spécifique aux données est limité aux consommateurs disposant d'autorisations explicites sur des éléments de données spécifiques afin d'atténuer les références d'objet directes non sécurisées (IDOR) et les autorisations de niveau d'objet rompues (BOLA).", + "L": "1" + }, + { + "Shortcode": "V8.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l'application garantit que l'accès au niveau du champ est limité aux consommateurs disposant d'autorisations explicites sur des champs spécifiques afin d'atténuer les problèmes d'autorisation au niveau de la propriété d'objet (BOPLA).", + "L": "2" + }, + { + "Shortcode": "V8.2.4", + "Ordinal": 4, + "Description": "Vérifiez que les contrôles de sécurité adaptatifs basés sur les attributs environnementaux et contextuels du consommateur (tels que l'heure, la localisation, l'adresse IP ou l'appareil) sont mis en œuvre pour les décisions d'authentification et d'autorisation, comme défini dans la documentation de l'application. Ces contrôles doivent être appliqués lorsque le consommateur tente de démarrer une nouvelle session et également pendant une session existante.", + "L": "3" + } + ] + }, + { + "Shortcode": "V8.3", + "Ordinal": 3, + "Name": "Autorisation par opération", + "Items": [ + { + "Shortcode": "V8.3.1", + "Ordinal": 1, + "Description": "Vérifier que l'application applique les règles d'autorisations au niveau de la couche service de confiance et ne s’appuie pas sur des contrôles qu’un consommateur non approuvé pourrait manipuler, comme JavaScript côté client.", + "L": "1" + }, + { + "Shortcode": "V8.3.2", + "Ordinal": 2, + "Description": "Vérifiez que les modifications apportées aux valeurs sur lesquelles reposent les décisions d'autorisation sont appliquées immédiatement. Lorsque les modifications ne peuvent pas être appliquées immédiatement (par exemple, en s'appuyant sur des données de jetons autonomes), des contrôles d'atténuation doivent être mis en place pour alerter un consommateur lorsqu'il effectue une action alors qu'il n'est plus autorisé à le faire et annuler la modification. Notez que cette solution alternative ne limiterait pas les fuites d'informations.", + "L": "3" + }, + { + "Shortcode": "V8.3.3", + "Ordinal": 3, + "Description": "Vérifiez que l'accès à un objet repose sur les autorisations du sujet d'origine (par exemple, le consommateur), et non sur celles d'un intermédiaire ou d'un service agissant en son nom. Par exemple, si un consommateur appelle un service web à l'aide d'un jeton d'authentification autonome, et que ce service demande ensuite des données à un autre service, ce dernier utilisera le jeton du consommateur, plutôt qu'un jeton inter-machine du premier service, pour prendre les décisions d'autorisation.", + "L": "3" + } + ] + }, + { + "Shortcode": "V8.4", + "Ordinal": 4, + "Name": "Autres considérations relatives à l'autorisation", + "Items": [ + { + "Shortcode": "V8.4.1", + "Ordinal": 1, + "Description": "Vérifiez que les applications multi-tenants utilisent des contrôles inter-tenants pour garantir que les opérations des consommateurs n'affecteront jamais les tenants avec lesquels ils ne sont pas autorisés à interagir.", + "L": "2" + }, + { + "Shortcode": "V8.4.2", + "Ordinal": 2, + "Description": "Vérifiez que l'accès aux interfaces administratives intègre plusieurs couches de sécurité, notamment la vérification continue de l'identité du consommateur, l'évaluation de la posture de sécurité des appareils et l'analyse contextuelle des risques, garantissant que l'emplacement du réseau ou les endpoints approuvés ne sont pas les seuls facteurs d'autorisation, même s'ils peuvent réduire la probabilité d'accès non autorisé.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V9", + "Ordinal": 9, + "ShortName": "Self", + "Name": "Jetons autonomes", + "Items": [ + { + "Shortcode": "V9.1", + "Ordinal": 1, + "Name": "Source et intégrité du jeton", + "Items": [ + { + "Shortcode": "V9.1.1", + "Ordinal": 1, + "Description": "Vérifiez que les jetons autonomes sont validés à l'aide de leur signature numérique ou MAC pour les protéger contre toute falsification avant d'accepter le contenu du jeton.", + "L": "1" + }, + { + "Shortcode": "V9.1.2", + "Ordinal": 2, + "Description": "Vérifiez que seuls les algorithmes d'une liste d’autorisations peuvent être utilisés pour créer et vérifier des jetons autonomes, dans un contexte donné. La liste d'autorisation doit inclure les algorithmes autorisés, idéalement symétriques ou asymétriques, et ne doit pas inclure l'algorithme « Aucun ». Si les algorithmes symétriques et asymétriques doivent être pris en charge, des contrôles supplémentaires seront nécessaires pour éviter toute confusion de clés.", + "L": "1" + }, + { + "Shortcode": "V9.1.3", + "Ordinal": 3, + "Description": "Vérifiez que les clés utilisées pour valider les jetons autonomes proviennent de sources préconfigurées et fiables pour l'émetteur du jeton, empêchant ainsi les attaquants de spécifier des sources et des clés non fiables. Pour les JWT et autres structures JWS, les en-têtes tels que « jku », « x5u » et « jwk » doivent être validés par rapport à une liste d'autorisation de sources fiables.", + "L": "1" + } + ] + }, + { + "Shortcode": "V9.2", + "Ordinal": 2, + "Name": "Contenu du jeton", + "Items": [ + { + "Shortcode": "V9.2.1", + "Ordinal": 1, + "Description": "Vérifiez que, si une période de validité est indiquée dans les données du jeton, celui-ci et son contenu ne sont acceptés que si la date de vérification est comprise dans cette période. Par exemple, pour les JWT, les déclarations « nbf » et « exp » doivent être vérifiées.", + "L": "1" + }, + { + "Shortcode": "V9.2.2", + "Ordinal": 2, + "Description": "Vérifiez que le service recevant un jeton valide le type de jeton et son utilisation avant d'en accepter le contenu. Par exemple, seuls les jetons d'accès peuvent être acceptés pour les décisions d'autorisation, et seuls les jetons d'identification peuvent être utilisés pour prouver l'authentification des utilisateurs.", + "L": "2" + }, + { + "Shortcode": "V9.2.3", + "Ordinal": 3, + "Description": "Vérifiez que le service accepte uniquement les jetons destinés à être utilisés avec ce service (audience). Pour les JWT, cela peut être réalisé en validant la déclaration « aud » par rapport à une liste d'autorisation définie dans le service.", + "L": "2" + }, + { + "Shortcode": "V9.2.4", + "Ordinal": 4, + "Description": "Si un émetteur de jetons utilise la même clé privée pour émettre des jetons destinés à différentes audiences, vérifiez que les jetons émis contiennent une restriction d'audience identifiant de manière unique les audiences visées. Cela empêchera la réutilisation d'un jeton avec une audience non prévue. Si l'identifiant d'audience est provisionné dynamiquement, l'émetteur de jetons doit valider ces audiences afin de garantir qu'elles n'entraînent pas d'usurpation d'identité.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V10", + "Ordinal": 10, + "ShortName": "OAuth", + "Name": "Oauth et OIDC", + "Items": [ + { + "Shortcode": "V10.1", + "Ordinal": 1, + "Name": "Sécurité générique OAuth et OIDC", + "Items": [ + { + "Shortcode": "V10.1.1", + "Ordinal": 1, + "Description": "Vérifiez que les jetons sont envoyés uniquement aux composants qui en ont absolument besoin. Par exemple, lors de l'utilisation d'un modèle backend-for-frontend pour les applications JavaScript basées sur un navigateur, les jetons d'accès et d'actualisation ne doivent être accessibles qu'au backend.", + "L": "2" + }, + { + "Shortcode": "V10.1.2", + "Ordinal": 2, + "Description": "Vérifiez que le client n'accepte les valeurs du serveur d'autorisation (telles que le code d'autorisation ou le jeton d'identification) que si elles résultent d'un flux d'autorisation initié par la même session d'agent utilisateur et la même transaction. Cela nécessite que les secrets générés par le client, tels que la clé de preuve pour l'échange de codes (PKCE) « code_verifier », « state » ou le nonce OIDC, ne puissent être devinés, soient spécifiques à la transaction et soient liés de manière sécurisée au client et à la session d'agent utilisateur au cours de laquelle la transaction a été initiée.", + "L": "2" + } + ] + }, + { + "Shortcode": "V10.2", + "Ordinal": 2, + "Name": "Client OAuth", + "Items": [ + { + "Shortcode": "V10.2.1", + "Ordinal": 1, + "Description": "Vérifiez que, si le flux de code est utilisé, le client OAuth dispose d'une protection contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF), qui déclenchent des demandes de jetons, soit en utilisant la fonctionnalité de clé de preuve pour l'échange de code (PKCE), soit en vérifiant le paramètre « state » envoyé dans la demande d'autorisation.", + "L": "2" + }, + { + "Shortcode": "V10.2.2", + "Ordinal": 2, + "Description": "Vérifiez que, si le client OAuth peut interagir avec plusieurs serveurs d'autorisation, il dispose d'une protection contre les attaques par confusion. Par exemple, il peut exiger que le serveur d'autorisation renvoie la valeur du paramètre « iss » et la valide dans la réponse d'autorisation et la réponse du jeton.", + "L": "2" + }, + { + "Shortcode": "V10.2.3", + "Ordinal": 3, + "Description": "Vérifiez que le client OAuth demande uniquement les portées requises (ou d’autres paramètres d’autorisation) dans les requêtes adressées au serveur d’autorisation.", + "L": "3" + } + ] + }, + { + "Shortcode": "V10.3", + "Ordinal": 3, + "Name": "Serveur de ressources OAuth", + "Items": [ + { + "Shortcode": "V10.3.1", + "Ordinal": 1, + "Description": "Vérifiez que le serveur de ressources accepte uniquement les jetons d'accès destinés à être utilisés avec ce service (audience). L'audience peut être incluse dans un jeton d'accès structuré (comme la déclaration « aud » dans JWT) ou vérifiée à l'aide du endpoint d'introspection de jeton.", + "L": "2" + }, + { + "Shortcode": "V10.3.2", + "Ordinal": 2, + "Description": "Vérifiez que le serveur de ressources applique les décisions d'autorisation en fonction des déclarations du jeton d'accès définissant l'autorisation déléguée. Si des déclarations telles que « sub », « scope » et « authorization_details » sont présentes, elles doivent être prises en compte dans la décision.", + "L": "2" + }, + { + "Shortcode": "V10.3.3", + "Ordinal": 3, + "Description": "Vérifiez que si une décision de contrôle d'accès nécessite l'identification d'un utilisateur unique à partir d'un jeton d'accès (JWT ou réponse d'introspection de jeton associé), le serveur de ressources identifie l'utilisateur à partir de déclarations non ré attribuables à d'autres utilisateurs. En général, cela implique l'utilisation d'une combinaison de déclarations « iss » et « sub ».", + "L": "2" + }, + { + "Shortcode": "V10.3.4", + "Ordinal": 4, + "Description": "Si le serveur de ressources requiert une force d'authentification, des méthodes ou une date d'expiration spécifiques, vérifiez que le jeton d'accès présenté respecte ces contraintes. Par exemple, s'il est présent, utilisez les déclarations OIDC « acr », « amr » et « auth_time » respectivement.", + "L": "2" + }, + { + "Shortcode": "V10.3.5", + "Ordinal": 5, + "Description": "Vérifiez que le serveur de ressources empêche l'utilisation de jetons d'accès volés ou la relecture de jetons d'accès (de parties non autorisées) en exigeant des jetons d'accès limités par l'expéditeur, soit Mutual TLS pour OAuth 2, soit OAuth 2 Demonstration of Proof of Possession (DPoP).", + "L": "3" + } + ] + }, + { + "Shortcode": "V10.4", + "Ordinal": 4, + "Name": "Serveur d'autorisation OAuth", + "Items": [ + { + "Shortcode": "V10.4.1", + "Ordinal": 1, + "Description": "Vérifiez que le serveur d'autorisation valide les URI de redirection en fonction d'une liste d'autorisation spécifique au client d'URI préenregistrés à l'aide d'une comparaison de chaînes exacte.", + "L": "1" + }, + { + "Shortcode": "V10.4.2", + "Ordinal": 2, + "Description": "Vérifiez que, si le serveur d'autorisation renvoie le code d'autorisation dans la réponse, celui-ci ne peut être utilisé qu'une seule fois pour une demande de jeton. Pour la deuxième demande valide avec un code d'autorisation déjà utilisé pour émettre un jeton d'accès, le serveur d'autorisation doit rejeter la demande de jeton et révoquer tous les jetons émis liés au code d'autorisation.", + "L": "1" + }, + { + "Shortcode": "V10.4.3", + "Ordinal": 3, + "Description": "Vérifiez que le code d'autorisation est de courte durée. La durée de vie maximale peut atteindre 10 minutes pour les applications L1 et L2 et 1 minute pour les applications L3.", + "L": "1" + }, + { + "Shortcode": "V10.4.4", + "Ordinal": 4, + "Description": "Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement l'utilisation des autorisations nécessaires à ce client. Notez que les autorisations « token » (flux implicite) et « password » (flux d'informations d'identification du propriétaire de la ressource) ne doivent plus être utilisées.", + "L": "1" + }, + { + "Shortcode": "V10.4.5", + "Ordinal": 5, + "Description": "Vérifiez que le serveur d'autorisation atténue les attaques par rejeu de jetons d'actualisation pour les clients publics, de préférence en utilisant des jetons d'actualisation limités par l'expéditeur, par exemple des jetons DPoP (Demonstrating Proof of Possession) ou des jetons d'accès liés à un certificat utilisant le protocole TLS mutuel (mTLS). Pour les applications L1 et L2, la rotation des jetons d'actualisation peut être utilisée. Si cette rotation est utilisée, le serveur d'autorisation doit invalider le jeton d'actualisation après utilisation et révoquer tous les jetons d'actualisation de cette autorisation si un jeton d'actualisation déjà utilisé et invalidé est fourni.", + "L": "1" + }, + { + "Shortcode": "V10.4.6", + "Ordinal": 6, + "Description": "Vérifiez que, si l'octroi de code est utilisé, le serveur d'autorisation atténue les attaques par interception de code en exigeant une clé de preuve pour l'échange de code (PKCE). Pour les demandes d'autorisation, le serveur d'autorisation doit exiger une valeur « code_challenge » valide et ne doit pas accepter une valeur « plain » pour « code_challenge_method ». Pour une demande de jeton, il doit exiger la validation du paramètre « code_verifier ».", + "L": "2" + }, + { + "Shortcode": "V10.4.7", + "Ordinal": 7, + "Description": "Vérifiez que si le serveur d'autorisation prend en charge l'enregistrement dynamique des clients non authentifiés, il réduit le risque d'applications clientes malveillantes. Il doit valider les métadonnées clientes, telles que les URI enregistrés, garantir le consentement de l'utilisateur et l'avertir avant de traiter une demande d'autorisation avec une application cliente non approuvée.", + "L": "2" + }, + { + "Shortcode": "V10.4.8", + "Ordinal": 8, + "Description": "Vérifiez que les jetons d’actualisation ont une expiration absolue, y compris si l’expiration du jeton d’actualisation glissant est appliquée.", + "L": "2" + }, + { + "Shortcode": "V10.4.9", + "Ordinal": 9, + "Description": "Vérifiez que les jetons d'actualisation et les jetons d'accès de référence peuvent être révoqués par un utilisateur autorisé à l'aide de l'interface utilisateur du serveur d'autorisation, afin d'atténuer le risque de clients malveillants ou de jetons volés.", + "L": "2" + }, + { + "Shortcode": "V10.4.10", + "Ordinal": 10, + "Description": "Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.", + "L": "2" + }, + { + "Shortcode": "V10.4.11", + "Ordinal": 11, + "Description": "Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.", + "L": "2" + }, + { + "Shortcode": "V10.4.12", + "Ordinal": 12, + "Description": "Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement la valeur « response_mode » dont ce client a besoin. Par exemple, en vérifiant cette valeur par rapport aux valeurs attendues ou en utilisant une requête d'autorisation poussée (PAR) ou une requête d'autorisation sécurisée par JWT (JAR).", + "L": "3" + }, + { + "Shortcode": "V10.4.13", + "Ordinal": 13, + "Description": "Vérifiez que le type d'Autorisation « code » est toujours utilisé avec les demandes d'autorisation poussées (PAR).", + "L": "3" + }, + { + "Shortcode": "V10.4.14", + "Ordinal": 14, + "Description": "Vérifiez que le serveur d'autorisation émet uniquement des jetons d'accès limités à l'expéditeur (preuve de possession), soit avec des jetons d'accès liés au certificat utilisant TLS mutuel (mTLS), soit avec des jetons d'accès liés au DPoP (démonstration de preuve de possession).", + "L": "3" + }, + { + "Shortcode": "V10.4.15", + "Ordinal": 15, + "Description": "Vérifiez que, pour un client côté serveur (non exécuté sur l'appareil de l'utilisateur final), le serveur d'autorisation garantit que la valeur du paramètre « authorization_details » provient du backend client et que l'utilisateur ne l'a pas altérée. Par exemple, en exigeant l'utilisation d'une demande d'autorisation poussée (PAR) ou d'une demande d'autorisation sécurisée par JWT (JAR).", + "L": "3" + }, + { + "Shortcode": "V10.4.16", + "Ordinal": 16, + "Description": "Vérifiez que le client est confidentiel et que le serveur d'autorisation requiert l'utilisation de méthodes d'authentification client fortes (basées sur la cryptographie à clé publique et résistantes aux attaques par relecture), telles que TLS mutuel ('tls_client_auth', 'self_signed_tls_client_auth') ou JWT à clé privée ('private_key_jwt').", + "L": "3" + } + ] + }, + { + "Shortcode": "V10.5", + "Ordinal": 5, + "Name": "Client OIDC", + "Items": [ + { + "Shortcode": "V10.5.1", + "Ordinal": 1, + "Description": "Vérifiez que le client (en tant que partie utilisatrice) atténue les attaques par rejeu de jeton d'identification. Par exemple, en vous assurant que la valeur « nonce » du jeton d'identification correspond à la valeur « nonce » envoyée dans la demande d'authentification au fournisseur OpenID (appelée demande d'autorisation envoyée au serveur d'autorisation dans OAuth2).", + "L": "2" + }, + { + "Shortcode": "V10.5.2", + "Ordinal": 2, + "Description": "Vérifiez que le client identifie de manière unique l'utilisateur à partir des déclarations de jeton d'identification, généralement la déclaration « sub », qui ne peut pas être réaffectée à d'autres utilisateurs (pour la portée d'un fournisseur d'identité).", + "L": "2" + }, + { + "Shortcode": "V10.5.3", + "Ordinal": 3, + "Description": "Vérifiez que le client rejette les tentatives d'un serveur d'autorisation malveillant d'usurper l'identité d'un autre serveur d'autorisation via ses métadonnées. Le client doit rejeter les métadonnées du serveur d'autorisation si l'URL de l'émetteur figurant dans ces métadonnées ne correspond pas exactement à l'URL d'émetteur préconfigurée attendue par le client.", + "L": "2" + }, + { + "Shortcode": "V10.5.4", + "Ordinal": 4, + "Description": "Vérifiez que le client valide que le jeton d'identification est destiné à être utilisé pour ce client (audience) en vérifiant que la déclaration « aud » du jeton est égale à la valeur « client_id » pour le client.", + "L": "2" + }, + { + "Shortcode": "V10.5.5", + "Ordinal": 5, + "Description": "Vérifiez que, lors de l'utilisation de la déconnexion du back-channel OIDC, la partie utilisatrice atténue les risques de déni de service liés à la déconnexion forcée et à la confusion entre JWT dans le flux de déconnexion. Le client doit vérifier que le jeton de déconnexion est correctement typé avec la valeur « logout+jwt », qu'il contient la déclaration « event » avec le nom de membre correct et qu'il ne contient pas de déclaration « nonce ». Il est également recommandé d'utiliser une expiration courte (par exemple, 2 minutes).", + "L": "2" + } + ] + }, + { + "Shortcode": "V10.6", + "Ordinal": 6, + "Name": "Fournisseur OpenID", + "Items": [ + { + "Shortcode": "V10.6.1", + "Ordinal": 1, + "Description": "Vérifiez que le fournisseur OpenID n'autorise que les valeurs « code », « ciba », « id_token » ou « id_token code » pour le mode de réponse. Notez que « code » est préférable à « id_token code » (flux hybride OIDC) et que « token » (tout flux implicite) ne doit pas être utilisé.", + "L": "2" + }, + { + "Shortcode": "V10.6.2", + "Ordinal": 2, + "Description": "Vérifiez que le fournisseur OpenID atténue les risques de déni de service liés à la déconnexion forcée. Pour ce faire, obtenez une confirmation explicite de l'utilisateur final ou, le cas échéant, validez les paramètres de la requête de déconnexion (initiée par la partie utilisatrice), comme « id_token_hint ».", + "L": "2" + } + ] + }, + { + "Shortcode": "V10.7", + "Ordinal": 7, + "Name": "Gestion du consentement", + "Items": [ + { + "Shortcode": "V10.7.1", + "Ordinal": 1, + "Description": "Vérifiez que le serveur d'autorisation garantit le consentement de l'utilisateur à chaque demande d'autorisation. Si l'identité du client ne peut être garantie, le serveur d'autorisation doit toujours demander explicitement le consentement de l'utilisateur.", + "L": "2" + }, + { + "Shortcode": "V10.7.2", + "Ordinal": 2, + "Description": "Vérifiez que lorsque le serveur d'autorisation demande le consentement de l'utilisateur, il fournit des informations claires et suffisantes sur ce qui est consenti. Le cas échéant, ces informations doivent inclure la nature des autorisations demandées (généralement en fonction de la portée, du serveur de ressources et des détails d'autorisation RAR), l'identité de l'application autorisée et la durée de vie de ces autorisations.", + "L": "2" + }, + { + "Shortcode": "V10.7.3", + "Ordinal": 3, + "Description": "Vérifiez que l’utilisateur peut consulter, modifier et révoquer les consentements qu’il a accordés via le serveur d’autorisation.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V11", + "Ordinal": 11, + "ShortName": "Cryptography", + "Name": "Cryptographie", + "Items": [ + { + "Shortcode": "V11.1", + "Ordinal": 1, + "Name": "Inventaire et documentation cryptographiques", + "Items": [ + { + "Shortcode": "V11.1.1", + "Ordinal": 1, + "Description": "Vérifiez qu’il existe une politique documentée pour la gestion des clés cryptographiques et un cycle de vie des clés cryptographiques qui suit une norme de gestion des clés telle que NIST SP 800-57. Cela devrait inclure la garantie que les clés ne sont pas sur-partagées (par exemple, avec plus de deux entités pour les secrets partagés et plus d’une entité pour les clés privées).", + "L": "2" + }, + { + "Shortcode": "V11.1.2", + "Ordinal": 2, + "Description": "Vérifiez qu'un inventaire cryptographique est réalisé, maintenu et régulièrement mis à jour, et qu'il inclut toutes les clés, algorithmes et certificats cryptographiques utilisés par l'application. Il doit également documenter les emplacements du système où les clés peuvent ou non être utilisées, ainsi que les types de données qui peuvent ou non être protégées par ces clés.", + "L": "2" + }, + { + "Shortcode": "V11.1.3", + "Ordinal": 3, + "Description": "Vérifiez que les mécanismes de découverte cryptographique sont utilisés pour identifier toutes les instances de cryptographie dans le système, y compris les opérations de chiffrement, de hachage et de signature.", + "L": "3" + }, + { + "Shortcode": "V11.1.4", + "Ordinal": 4, + "Description": "Vérifier la tenue d'un inventaire cryptographique. Celui-ci doit inclure un plan documenté décrivant la migration vers de nouvelles normes cryptographiques, telles que la cryptographie post-quantique, afin de réagir aux menaces futures.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.2", + "Ordinal": 2, + "Name": "Mise en œuvre sécurisée de la cryptographie", + "Items": [ + { + "Shortcode": "V11.2.1", + "Ordinal": 1, + "Description": "Vérifiez que les implémentations validées par l’industrie (y compris les bibliothèques et les implémentations accélérées par le matériel) sont utilisées pour les opérations cryptographiques.", + "L": "2" + }, + { + "Shortcode": "V11.2.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application est conçue avec une agilité cryptographique, de sorte que les nombres aléatoires, le chiffrement authentifié, le MAC ou les algorithmes de hachage, les longueurs de clés, les tours, les chiffrements et les modes puissent être reconfigurés, mis à niveau ou échangés à tout moment, afin de se protéger contre les failles cryptographiques. De même, il doit être possible de remplacer les clés et les mots de passe, ainsi que de rechiffrer les données. Cela permettra des mises à niveau transparentes vers la cryptographie post-quantique (PQC), une fois que des implémentations hautement sécurisées de schémas ou de normes PQC approuvés seront largement disponibles.", + "L": "2" + }, + { + "Shortcode": "V11.2.3", + "Ordinal": 3, + "Description": "Vérifiez que toutes les primitives cryptographiques utilisent un minimum de 128 bits de sécurité en fonction de l'algorithme, de la taille de la clé et de la configuration. Par exemple, une clé ECC de 256 bits offre environ 128 bits de sécurité, tandis que RSA nécessite une clé de 3072 bits pour atteindre 128 bits de sécurité.", + "L": "2" + }, + { + "Shortcode": "V11.2.4", + "Ordinal": 4, + "Description": "Vérifiez que toutes les opérations cryptographiques sont à temps constant, sans opérations de « court-circuit » dans les comparaisons, les calculs ou les retours, pour éviter toute fuite d'informations.", + "L": "3" + }, + { + "Shortcode": "V11.2.5", + "Ordinal": 5, + "Description": "Vérifiez que tous les modules cryptographiques échouent en toute sécurité et que les erreurs sont gérées de manière à ne pas permettre de vulnérabilités, telles que les attaques Padding Oracle.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.3", + "Ordinal": 3, + "Name": "Algorithmes de chiffrement", + "Items": [ + { + "Shortcode": "V11.3.1", + "Ordinal": 1, + "Description": "Vérifiez que les modes de bloc non sécurisés (par exemple, ECB) et les schémas de remplissage faibles (par exemple, PKCS#1 v1.5) ne sont pas utilisés.", + "L": "1" + }, + { + "Shortcode": "V11.3.2", + "Ordinal": 2, + "Description": "Vérifiez que seuls les chiffrements et modes approuvés tels que AES avec GCM sont utilisés.", + "L": "1" + }, + { + "Shortcode": "V11.3.3", + "Ordinal": 3, + "Description": "Vérifiez que les données chiffrées sont protégées contre toute modification non autorisée, de préférence en utilisant une méthode de chiffrement authentifiée approuvée ou en combinant une méthode de chiffrement approuvée avec un algorithme MAC approuvé.", + "L": "2" + }, + { + "Shortcode": "V11.3.4", + "Ordinal": 4, + "Description": "Vérifiez que les nonces, les vecteurs d'initialisation et autres nombres à usage unique ne sont pas utilisés pour plus d'une paire clé de chiffrement/élément de données. La méthode de génération doit être adaptée à l'algorithme utilisé.", + "L": "3" + }, + { + "Shortcode": "V11.3.5", + "Ordinal": 5, + "Description": "Vérifiez que toute combinaison d'un algorithme de chiffrement et d'un algorithme MAC fonctionne en mode chiffrement puis MAC.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.4", + "Ordinal": 4, + "Name": "Hachage et fonctions basées sur le hachage", + "Items": [ + { + "Shortcode": "V11.4.1", + "Ordinal": 1, + "Description": "Vérifiez que seules les fonctions de hachage approuvées sont utilisées pour les cas d'utilisation cryptographiques généraux, notamment les signatures numériques, HMAC, KDF et la génération de bits aléatoires. Les fonctions de hachage non autorisées, telles que MD5, ne doivent pas être utilisées à des fins cryptographiques.", + "L": "1" + }, + { + "Shortcode": "V11.4.2", + "Ordinal": 2, + "Description": "Vérifiez que les mots de passe sont stockés à l'aide d'une fonction de dérivation de clés approuvée et gourmande en ressources de calcul (également appelée « fonction de hachage de mots de passe »), dont les paramètres sont configurés conformément aux directives en vigueur. Ces paramètres doivent équilibrer sécurité et performances afin de rendre les attaques par force brute suffisamment difficiles pour le niveau de sécurité requis.", + "L": "2" + }, + { + "Shortcode": "V11.4.3", + "Ordinal": 3, + "Description": "Vérifiez que les fonctions de hachage utilisées dans les signatures numériques, dans le cadre de l'authentification ou de l'intégrité des données, sont résistantes aux collisions et possèdent des longueurs de bits appropriées. Si la résistance aux collisions est requise, la longueur de sortie doit être d'au moins 256 bits. Si seule la résistance aux attaques de seconde pré-image est requise, la longueur de sortie doit être d'au moins 128 bits.", + "L": "2" + }, + { + "Shortcode": "V11.4.4", + "Ordinal": 4, + "Description": "Vérifiez que l'application utilise des fonctions de dérivation de clés approuvées avec des paramètres d'extension de clés lors de la dérivation de clés secrètes à partir de mots de passe. Les paramètres utilisés doivent concilier sécurité et performances afin d'empêcher les attaques par force brute de compromettre la clé cryptographique obtenue.", + "L": "2" + } + ] + }, + { + "Shortcode": "V11.5", + "Ordinal": 5, + "Name": "Valeurs aléatoires", + "Items": [ + { + "Shortcode": "V11.5.1", + "Ordinal": 1, + "Description": "Vérifiez que tous les nombres et chaînes aléatoires destinés à être non devinables doivent être générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et posséder au moins 128 bits d'entropie. Notez que les UUID ne respectent pas cette condition.", + "L": "2" + }, + { + "Shortcode": "V11.5.2", + "Ordinal": 2, + "Description": "Vérifiez que le mécanisme de génération de nombres aléatoires utilisé est conçu pour fonctionner en toute sécurité, même en cas de forte demande.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.6", + "Ordinal": 6, + "Name": "Cryptographie à clé publique", + "Items": [ + { + "Shortcode": "V11.6.1", + "Ordinal": 1, + "Description": "Vérifier que seuls des algorithmes cryptographiques et des modes opératoires approuvés sont utilisés pour la génération et l'amorçage des clés, ainsi que pour la génération et la vérification des signatures numériques. Les algorithmes de génération de clés ne doivent pas générer de clés non sécurisées et vulnérables aux attaques connues, par exemple les clés RSA vulnérables à la factorisation de Fermat.", + "L": "2" + }, + { + "Shortcode": "V11.6.2", + "Ordinal": 2, + "Description": "Vérifiez que des algorithmes cryptographiques approuvés sont utilisés pour l'échange de clés (tels que Diffie-Hellman), en veillant à ce que les mécanismes d'échange de clés utilisent des paramètres sécurisés. Cela permettra d'éviter les attaques contre le processus d'établissement des clés, susceptibles de conduire à des attaques de type « adversaire du milieu » ou à des failles cryptographiques.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.7", + "Ordinal": 7, + "Name": "Cryptographie des données en cours d'utilisation", + "Items": [ + { + "Shortcode": "V11.7.1", + "Ordinal": 1, + "Description": "Vérifiez que le chiffrement complet de la mémoire est utilisé pour protéger les données sensibles pendant leur utilisation, empêchant ainsi l'accès par des utilisateurs ou des processus non autorisés.", + "L": "3" + }, + { + "Shortcode": "V11.7.2", + "Ordinal": 2, + "Description": "Vérifiez que la minimisation des données garantit que la quantité minimale de données est exposée pendant le traitement et assurez-vous que les données sont chiffrées immédiatement après utilisation ou dès que possible.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V12", + "Ordinal": 12, + "ShortName": "Secure", + "Name": "Communication sécurisée", + "Items": [ + { + "Shortcode": "V12.1", + "Ordinal": 1, + "Name": "Conseils généraux de sécurité TLS", + "Items": [ + { + "Shortcode": "V12.1.1", + "Ordinal": 1, + "Description": "Vérifiez que seules les dernières versions recommandées du protocole TLS sont activées, telles que TLS 1.2 et TLS 1.3. La dernière version du protocole TLS doit être privilégiée.", + "L": "1" + }, + { + "Shortcode": "V12.1.2", + "Ordinal": 2, + "Description": "Vérifiez que seules les suites de chiffrement recommandées sont activées, les suites de chiffrement les plus puissantes étant définies comme préférées. Les applications L3 doivent uniquement prendre en charge les suites de chiffrement assurant la confidentialité persistante (forward secrecy).", + "L": "2" + }, + { + "Shortcode": "V12.1.3", + "Ordinal": 3, + "Description": "Vérifiez que l’application valide que les certificats clients mTLS sont approuvés avant d’utiliser l’identité du certificat pour l’authentification ou l’autorisation.", + "L": "2" + }, + { + "Shortcode": "V12.1.4", + "Ordinal": 4, + "Description": "Vérifiez que la révocation de certification appropriée, telle que l'agrafage du protocole OCSP (Online Certificate Status Protocol), est activée et configurée.", + "L": "3" + }, + { + "Shortcode": "V12.1.5", + "Ordinal": 5, + "Description": "Vérifiez que Encrypted Client Hello (ECH) est activé dans les paramètres TLS de l'application pour empêcher l'exposition de métadonnées sensibles, telles que l'indication du nom du serveur (SNI), pendant les processus de négociation TLS.", + "L": "3" + } + ] + }, + { + "Shortcode": "V12.2", + "Ordinal": 2, + "Name": "Communication HTTPS avec des services externes", + "Items": [ + { + "Shortcode": "V12.2.1", + "Ordinal": 1, + "Description": "Vérifiez que TLS est utilisé pour toute connectivité entre un client et des services externes basés sur HTTP, et ne recourt pas à des communications non sécurisées ou non chiffrées.", + "L": "1" + }, + { + "Shortcode": "V12.2.2", + "Ordinal": 2, + "Description": "Vérifiez que les services externes utilisent des certificats TLS publiquement approuvés.", + "L": "1" + } + ] + }, + { + "Shortcode": "V12.3", + "Ordinal": 3, + "Name": "Sécurité des communications entre services généraux", + "Items": [ + { + "Shortcode": "V12.3.1", + "Ordinal": 1, + "Description": "Vérifiez qu'un protocole chiffré tel que TLS est utilisé pour toutes les connexions entrantes et sortantes vers et depuis l'application, y compris les systèmes de surveillance, les outils de gestion, l'accès à distance et SSH, les intergiciels, les bases de données, les mainframes, les systèmes partenaires ou les API externes. Le serveur ne doit pas recourir à des protocoles non sécurisés ou non chiffrés.", + "L": "2" + }, + { + "Shortcode": "V12.3.2", + "Ordinal": 2, + "Description": "Vérifiez que les clients TLS valident les certificats reçus avant de communiquer avec un serveur TLS.", + "L": "2" + }, + { + "Shortcode": "V12.3.3", + "Ordinal": 3, + "Description": "Vérifiez que TLS ou un autre mécanisme de chiffrement de transport approprié est utilisé pour toute connectivité entre les services internes basés sur HTTP au sein de l'application et ne se replie pas vers des communications non sécurisées ou non chiffrées.", + "L": "2" + }, + { + "Shortcode": "V12.3.4", + "Ordinal": 4, + "Description": "Vérifiez que les connexions TLS entre les services internes utilisent des certificats de confiance. Lorsque des certificats générés en interne ou auto-signés sont utilisés, le service consommateur doit être configuré pour n'approuver que des autorités de certification internes spécifiques et des certificats auto-signés spécifiques.", + "L": "2" + }, + { + "Shortcode": "V12.3.5", + "Ordinal": 5, + "Description": "Vérifiez que les services communiquant en interne au sein d'un système (communications intra-services) utilisent une authentification forte pour garantir la vérification de chaque endpoint. Des méthodes d'authentification forte, telles que l'authentification client TLS, doivent être utilisées pour garantir l'identité, en utilisant une infrastructure à clé publique et des mécanismes résistants aux attaques par rejeu. Pour les architectures de microservices, envisagez d'utiliser un maillage de services pour simplifier la gestion des certificats et renforcer la sécurité.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V13", + "Ordinal": 13, + "ShortName": "Configuration", + "Name": "Configuration", + "Items": [ + { + "Shortcode": "V13.1", + "Ordinal": 1, + "Name": "Documentation de configuration", + "Items": [ + { + "Shortcode": "V13.1.1", + "Ordinal": 1, + "Description": "Vérifiez que tous les besoins de communication de l'application sont documentés. Cela doit inclure les services externes dont l'application dépend et les cas où un utilisateur final pourrait fournir un emplacement externe auquel l'application se connectera.", + "L": "2" + }, + { + "Shortcode": "V13.1.2", + "Ordinal": 2, + "Description": "Vérifiez que pour chaque service utilisé par l'application, la documentation définit le nombre maximal de connexions simultanées (par exemple, les limites du pool de connexions) et le comportement de l'application lorsque cette limite est atteinte, y compris les mécanismes de secours ou de récupération, pour éviter les conditions de déni de service.", + "L": "3" + }, + { + "Shortcode": "V13.1.3", + "Ordinal": 3, + "Description": "Vérifiez que la documentation de l'application définit des stratégies de gestion des ressources pour chaque système ou service externe utilisé (par exemple, bases de données, descripteurs de fichiers, threads, connexions HTTP). Cela doit inclure les procédures de libération des ressources, les paramètres de délai d'expiration, la gestion des échecs et l'implémentation de la logique de nouvelle tentative, en spécifiant les limites de nouvelle tentative, les délais et les algorithmes de retour arrière. Pour les opérations de requête-réponse HTTP synchrones, la documentation doit imposer des délais d'expiration courts et soit désactiver les nouvelles tentatives, soit les limiter strictement afin d'éviter les retards en cascade et l'épuisement des ressources.", + "L": "3" + }, + { + "Shortcode": "V13.1.4", + "Ordinal": 4, + "Description": "Vérifiez que la documentation de l'application définit les secrets essentiels à la sécurité de l'application et un calendrier de rotation de ceux-ci, en fonction du modèle de menace et des exigences commerciales de l'organisation.", + "L": "3" + } + ] + }, + { + "Shortcode": "V13.2", + "Ordinal": 2, + "Name": "Configuration de la communication backend", + "Items": [ + { + "Shortcode": "V13.2.1", + "Ordinal": 1, + "Description": "Vérifiez que les communications entre les composants de l'application backend qui ne prennent pas en charge le mécanisme de session utilisateur standard de l'application, notamment les API, les intergiciels et les couches de données, sont authentifiées. L'authentification doit utiliser des comptes de service individuels, des jetons à court terme ou une authentification par certificat, et non des identifiants immuables tels que des mots de passe, des clés API ou des comptes partagés avec accès privilégié.", + "L": "2" + }, + { + "Shortcode": "V13.2.2", + "Ordinal": 2, + "Description": "Vérifiez que les communications entre les composants de l'application backend, y compris les services locaux ou du système d'exploitation, les API, les intergiciels et les couches de données, sont effectuées avec des comptes dotés des privilèges les moins nécessaires.", + "L": "2" + }, + { + "Shortcode": "V13.2.3", + "Ordinal": 3, + "Description": "Vérifiez que si des informations d’identification doivent être utilisées pour l’authentification du service, les informations d’identification utilisées par le consommateur ne sont pas des informations d’identification par défaut (par exemple, root/root ou admin/admin).", + "L": "2" + }, + { + "Shortcode": "V13.2.4", + "Ordinal": 4, + "Description": "Vérifiez qu'une liste d’autorisations est utilisée pour définir les ressources ou systèmes externes avec lesquels l'application est autorisée à communiquer (par exemple, pour les requêtes sortantes, les chargements de données ou l'accès aux fichiers). Cette liste d'autorisation peut être implémentée au niveau de la couche applicative, du serveur web, du pare-feu ou d'une combinaison de différentes couches.", + "L": "2" + }, + { + "Shortcode": "V13.2.5", + "Ordinal": 5, + "Description": "Vérifiez que le serveur Web ou d’application est configuré avec une liste autorisée de ressources ou de systèmes vers lesquels le serveur peut envoyer des requêtes ou charger des données ou des fichiers.", + "L": "2" + }, + { + "Shortcode": "V13.2.6", + "Ordinal": 6, + "Description": "Vérifiez que lorsque l'application se connecte à des services distincts, elle suit la configuration documentée pour chaque connexion, comme le nombre maximal de connexions parallèles, le comportement lorsque le nombre maximal de connexions autorisées est atteint, les délais d'expiration de connexion et les stratégies de nouvelle tentative.", + "L": "3" + } + ] + }, + { + "Shortcode": "V13.3", + "Ordinal": 3, + "Name": "Gestion des secrets", + "Items": [ + { + "Shortcode": "V13.3.1", + "Ordinal": 1, + "Description": "Vérifiez qu'une solution de gestion des secrets, telle qu'un coffre-fort de clés, est utilisée pour créer, stocker, contrôler l'accès et détruire en toute sécurité les secrets backend. Ceux-ci peuvent inclure des mots de passe, du matériel de clé, des intégrations avec des bases de données et des systèmes tiers, des clés et des graines pour des jetons temporels, d'autres secrets internes et des clés API. Les secrets ne doivent pas être inclus dans le code source de l'application ni dans les artefacts de build. Pour une application L3, cela doit impliquer une solution matérielle telle qu'un HSM.", + "L": "2" + }, + { + "Shortcode": "V13.3.2", + "Ordinal": 2, + "Description": "Vérifiez que l’accès aux ressources secrètes respecte le principe du moindre privilège.", + "L": "2" + }, + { + "Shortcode": "V13.3.3", + "Ordinal": 3, + "Description": "Vérifiez que toutes les opérations cryptographiques sont effectuées à l'aide d'un module de sécurité isolé (tel qu'un coffre-fort ou un module de sécurité matériel) pour gérer et protéger en toute sécurité le matériel clé contre toute exposition en dehors du module de sécurité.", + "L": "3" + }, + { + "Shortcode": "V13.3.4", + "Ordinal": 4, + "Description": "Vérifiez que les secrets sont configurés pour expirer et être renouvelés en fonction de la documentation de l'application.", + "L": "3" + } + ] + }, + { + "Shortcode": "V13.4", + "Ordinal": 4, + "Name": "Fuite d'informations involontaire", + "Items": [ + { + "Shortcode": "V13.4.1", + "Ordinal": 1, + "Description": "Vérifiez que l'application est déployée soit sans aucune métadonnée de contrôle de source, y compris les dossiers .git ou .svn, soit de manière à ce que ces dossiers soient inaccessibles à la fois en externe et à l'application elle-même.", + "L": "1" + }, + { + "Shortcode": "V13.4.2", + "Ordinal": 2, + "Description": "Vérifiez que les modes de débogage sont désactivés pour tous les composants dans les environnements de production afin d’éviter l’exposition des fonctionnalités de débogage et la fuite d’informations.", + "L": "2" + }, + { + "Shortcode": "V13.4.3", + "Ordinal": 3, + "Description": "Vérifiez que les serveurs Web n’exposent pas les listes de répertoires aux clients, sauf si cela est explicitement prévu.", + "L": "2" + }, + { + "Shortcode": "V13.4.4", + "Ordinal": 4, + "Description": "Vérifiez que l’utilisation de la méthode HTTP TRACE n’est pas prise en charge dans les environnements de production, afin d’éviter toute fuite d’informations potentielle.", + "L": "2" + }, + { + "Shortcode": "V13.4.5", + "Ordinal": 5, + "Description": "Vérifiez que la documentation (comme pour les API internes) et les endpoints de surveillance ne sont pas exposés, sauf si cela est explicitement prévu.", + "L": "2" + }, + { + "Shortcode": "V13.4.6", + "Ordinal": 6, + "Description": "Vérifiez que l’application n’expose pas d’informations de version détaillées des composants backend.", + "L": "3" + }, + { + "Shortcode": "V13.4.7", + "Ordinal": 7, + "Description": "Vérifiez que la couche web est configuré pour servir uniquement les fichiers avec des extensions de fichier spécifiques afin d’éviter toute fuite involontaire d’informations, de configuration et de code source.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V14", + "Ordinal": 14, + "ShortName": "Data", + "Name": "Protection des données", + "Items": [ + { + "Shortcode": "V14.1", + "Ordinal": 1, + "Name": "Documentation sur la protection des données", + "Items": [ + { + "Shortcode": "V14.1.1", + "Ordinal": 1, + "Description": "Vérifiez que toutes les données sensibles créées et traitées par l'application ont été identifiées et classées selon leur niveau de protection. Cela inclut les données uniquement codées et donc facilement déchiffrables, telles que les chaînes Base64 ou la charge utile en texte clair d'un JWT. Les niveaux de protection doivent tenir compte des réglementations et normes de protection des données et de confidentialité auxquelles l'application est tenue de se conformer.", + "L": "2" + }, + { + "Shortcode": "V14.1.2", + "Ordinal": 2, + "Description": "Vérifier que tous les niveaux de protection des données sensibles sont assortis d'un ensemble documenté d'exigences de protection. Cela doit inclure (sans s'y limiter) les exigences relatives au chiffrement général, à la vérification de l'intégrité, à la conservation, à la journalisation des données, aux contrôles d'accès aux données sensibles dans les journaux, au chiffrement au niveau de la base de données, aux technologies de confidentialité et de renforcement de la confidentialité à utiliser, ainsi qu'aux autres exigences de confidentialité.", + "L": "2" + } + ] + }, + { + "Shortcode": "V14.2", + "Ordinal": 2, + "Name": "Protection générale des données", + "Items": [ + { + "Shortcode": "V14.2.1", + "Ordinal": 1, + "Description": "Vérifiez que les données sensibles sont uniquement envoyées au serveur dans les champs de corps ou d’en-tête du message HTTP, et que l’URL et la chaîne de requête ne contiennent pas d’informations sensibles, telles qu’une clé API ou un jeton de session.", + "L": "1" + }, + { + "Shortcode": "V14.2.2", + "Ordinal": 2, + "Description": "Vérifiez que l’application empêche la mise en cache des données sensibles dans les composants du serveur, tels que les équilibreurs de charge et les caches d’application, ou garantit que les données sont purgées en toute sécurité après utilisation.", + "L": "2" + }, + { + "Shortcode": "V14.2.3", + "Ordinal": 3, + "Description": "Vérifiez que les données sensibles définies ne sont pas envoyées à des parties non fiables (par exemple, des trackers d'utilisateurs) pour empêcher la collecte indésirable de données en dehors du contrôle de l'application.", + "L": "2" + }, + { + "Shortcode": "V14.2.4", + "Ordinal": 4, + "Description": "Vérifiez que les contrôles autour des données sensibles liés au chiffrement, à la vérification de l'intégrité, à la conservation, à la manière dont les données doivent être enregistrées, aux contrôles d'accès autour des données sensibles dans les journaux, à la confidentialité et aux technologies d'amélioration de la confidentialité, sont mis en œuvre comme défini dans la documentation pour le niveau de protection des données spécifiques.", + "L": "2" + }, + { + "Shortcode": "V14.2.5", + "Ordinal": 5, + "Description": "Vérifiez que les mécanismes de mise en cache sont configurés pour ne mettre en cache que les réponses dont le type de contenu est conforme à la ressource et qui ne contiennent pas de contenu sensible et dynamique. Le serveur web doit renvoyer une réponse 404 ou 302 lors de l'accès à un fichier inexistant plutôt qu'un fichier valide différent. Cela devrait empêcher les attaques par empoisonnement de cache web.", + "L": "3" + }, + { + "Shortcode": "V14.2.6", + "Ordinal": 6, + "Description": "Vérifiez que l'application ne renvoie que les données sensibles minimales requises pour son fonctionnement. Par exemple, ne renvoyez que certains chiffres d'un numéro de carte de crédit, et non le numéro complet. Si les données complètes sont requises, elles doivent être masquées dans l'interface utilisateur, sauf si l'utilisateur les consulte spécifiquement.", + "L": "3" + }, + { + "Shortcode": "V14.2.7", + "Ordinal": 7, + "Description": "Vérifiez que les informations sensibles sont soumises à une classification de conservation des données, en veillant à ce que les données obsolètes ou inutiles soient supprimées automatiquement, selon un calendrier défini ou selon les besoins de la situation.", + "L": "3" + }, + { + "Shortcode": "V14.2.8", + "Ordinal": 8, + "Description": "Vérifiez que les informations sensibles sont supprimées des métadonnées des fichiers soumis par l'utilisateur, sauf si le stockage est autorisé par l'utilisateur.", + "L": "3" + } + ] + }, + { + "Shortcode": "V14.3", + "Ordinal": 3, + "Name": "Protection des données côté client", + "Items": [ + { + "Shortcode": "V14.3.1", + "Ordinal": 1, + "Description": "Vérifiez que les données authentifiées sont effacées du stockage client, comme le DOM du navigateur, après la fin du client ou de la session. Le champ d'en-tête de réponse HTTP « Clear-Site-Data » peut être utile, mais le côté client devrait également pouvoir effectuer la correction si la connexion au serveur n'est pas disponible à la fin de la session.", + "L": "1" + }, + { + "Shortcode": "V14.3.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application définit suffisamment de champs d'en-tête de réponse HTTP anti-caching (c'est-à-dire Cache-Control : no-store) afin que les données sensibles ne soient pas mises en cache dans les navigateurs.", + "L": "2" + }, + { + "Shortcode": "V14.3.3", + "Ordinal": 3, + "Description": "Vérifiez que les données stockées dans le stockage du navigateur (telles que localStorage, sessionStorage, IndexedDB ou les cookies) ne contiennent pas de données sensibles, à l'exception des jetons de session.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V15", + "Ordinal": 15, + "ShortName": "Secure", + "Name": "Développement et architecture sécurisés", + "Items": [ + { + "Shortcode": "V15.1", + "Ordinal": 1, + "Name": "Documentation sur le développement et l'architecture sécurisés", + "Items": [ + { + "Shortcode": "V15.1.1", + "Ordinal": 1, + "Description": "Vérifiez que la documentation de l'application définit les délais de correction basés sur les risques pour les versions de composants tiers présentant des vulnérabilités et pour la mise à jour des bibliothèques en général, afin de minimiser les risques liés à ces composants.", + "L": "1" + }, + { + "Shortcode": "V15.1.2", + "Ordinal": 2, + "Description": "Vérifiez qu'un catalogue d'inventaire, tel qu'une nomenclature logicielle (SBOM), est conservé pour toutes les bibliothèques tierces utilisées, y compris en vérifiant que les composants proviennent de référentiels prédéfinis, fiables et continuellement maintenus.", + "L": "2" + }, + { + "Shortcode": "V15.1.3", + "Ordinal": 3, + "Description": "Vérifiez que la documentation de l'application identifie les fonctionnalités consommatrices en temps ou gourmandes en ressources. Elle doit notamment indiquer comment prévenir une perte de disponibilité due à une utilisation excessive de ces fonctionnalités et éviter que la génération d'une réponse ne prenne plus de temps que le délai d'expiration du consommateur. Les mesures de protection potentielles peuvent inclure le traitement asynchrone, l'utilisation de files d'attente et la limitation des processus parallèles par utilisateur et par application.", + "L": "2" + }, + { + "Shortcode": "V15.1.4", + "Ordinal": 4, + "Description": "Vérifiez que la documentation de l’application met en évidence les bibliothèques tierces qui sont considérées comme des « composants à risque ».", + "L": "3" + }, + { + "Shortcode": "V15.1.5", + "Ordinal": 5, + "Description": "Vérifiez que la documentation de l’application met en évidence les parties de l’application où des « fonctionnalités dangereuses » sont utilisées.", + "L": "3" + } + ] + }, + { + "Shortcode": "V15.2", + "Ordinal": 2, + "Name": "Architecture de sécurité et dépendances", + "Items": [ + { + "Shortcode": "V15.2.1", + "Ordinal": 1, + "Description": "Vérifiez que l’application contient uniquement des composants qui n’ont pas dépassé les délais de mise à jour et de correction documentés.", + "L": "1" + }, + { + "Shortcode": "V15.2.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application a mis en œuvre des défenses contre la perte de disponibilité due à des fonctionnalités qui prennent du temps ou qui nécessitent des ressources, sur la base des décisions et stratégies de sécurité documentées à cet effet.", + "L": "2" + }, + { + "Shortcode": "V15.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l'environnement de production inclut uniquement les fonctionnalités nécessaires au fonctionnement de l'application et n'expose pas de fonctionnalités superflues telles que du code de test, des exemples d'extraits et des fonctionnalités de développement.", + "L": "2" + }, + { + "Shortcode": "V15.2.4", + "Ordinal": 4, + "Description": "Vérifiez que les composants tiers et toutes leurs dépendances transitives sont inclus à partir du référentiel attendu, qu'il soit détenu en interne ou qu'il s'agisse d'une source externe, et qu'il n'y a aucun risque d'attaque par confusion de dépendances.", + "L": "3" + }, + { + "Shortcode": "V15.2.5", + "Ordinal": 5, + "Description": "Vérifiez que l'application implémente des protections supplémentaires autour des parties documentées comme contenant des « fonctionnalités dangereuses » ou utilisant des bibliothèques tierces considérées comme des « composants à risque ». Cela peut inclure des techniques telles que le sandboxing, l'encapsulation, la conteneurisation ou l'isolation au niveau du réseau pour retarder et dissuader les attaquants qui compromettent une partie de l'application de se propager ailleurs.", + "L": "3" + } + ] + }, + { + "Shortcode": "V15.3", + "Ordinal": 3, + "Name": "Développement défensif", + "Items": [ + { + "Shortcode": "V15.3.1", + "Ordinal": 1, + "Description": "Vérifiez que l'application ne renvoie que le sous-ensemble requis de champs d'un objet de données. Par exemple, elle ne doit pas renvoyer un objet de données entier, car certains champs individuels ne doivent pas être accessibles aux utilisateurs.", + "L": "1" + }, + { + "Shortcode": "V15.3.2", + "Ordinal": 2, + "Description": "Vérifiez que lorsque le backend de l'application effectue des appels vers des URL externes, il est configuré pour ne pas suivre les redirections, sauf s'il s'agit d'une fonctionnalité prévue.", + "L": "2" + }, + { + "Shortcode": "V15.3.3", + "Ordinal": 3, + "Description": "Vérifiez que l'application dispose de contre-mesures pour se protéger contre les attaques d'affectation de masse en limitant les champs autorisés par contrôleur et action, par exemple, il n'est pas possible d'insérer ou de mettre à jour une valeur de champ lorsqu'elle n'était pas destinée à faire partie de cette action.", + "L": "2" + }, + { + "Shortcode": "V15.3.4", + "Ordinal": 4, + "Description": "Vérifiez que tous les composants proxy et middleware transfèrent correctement l'adresse IP d'origine de l'utilisateur à l'aide de champs de données fiables qui ne peuvent pas être manipulés par l'utilisateur final, et que l'application et le serveur Web utilisent cette valeur correcte pour la journalisation et les décisions de sécurité telles que la limitation du débit, en tenant compte du fait que même l'adresse IP d'origine peut ne pas être fiable en raison d'adresses IP dynamiques, de VPN ou de pare-feu d'entreprise.", + "L": "2" + }, + { + "Shortcode": "V15.3.5", + "Ordinal": 5, + "Description": "Vérifiez que l'application garantit explicitement que les variables sont du type correct et effectue des opérations d'égalité et de comparaison strictes. Cela permet d'éviter les vulnérabilités liées à la confusion de types, causées par des hypothèses du code de l'application sur le type d'une variable.", + "L": "2" + }, + { + "Shortcode": "V15.3.6", + "Ordinal": 6, + "Description": "Vérifiez que le code JavaScript est écrit de manière à éviter la pollution du prototype, par exemple en utilisant Set() ou Map() au lieu de littéraux d'objet.", + "L": "2" + }, + { + "Shortcode": "V15.3.7", + "Ordinal": 7, + "Description": "Vérifiez que l'application dispose de défenses contre les attaques de pollution des paramètres HTTP, en particulier si le Framework d'application ne fait aucune distinction quant à la source des paramètres de requête (chaîne de requête, paramètres de corps, cookies ou champs d'en-tête).", + "L": "2" + } + ] + }, + { + "Shortcode": "V15.4", + "Ordinal": 4, + "Name": "Concurrence sécurisée", + "Items": [ + { + "Shortcode": "V15.4.1", + "Ordinal": 1, + "Description": "Vérifiez que les objets partagés dans le code multithread (tels que les caches, les fichiers ou les objets en mémoire accessibles par plusieurs threads) sont accessibles en toute sécurité à l'aide de types thread-safe et de mécanismes de synchronisation tels que des verrous ou des sémaphores pour éviter les conditions de concurrence et la corruption des données.", + "L": "3" + }, + { + "Shortcode": "V15.4.2", + "Ordinal": 2, + "Description": "Vérifiez que les vérifications de l'état d'une ressource, comme son existence ou ses autorisations, et des actions qui en dépendent, sont effectuées en une seule opération atomique afin d'éviter les situations de concurrence entre le moment de la vérification et le moment de l'utilisation (TOCTOU). Par exemple, vérifier l'existence d'un fichier avant de l'ouvrir ou l'accès d'un utilisateur avant de l'accorder.", + "L": "3" + }, + { + "Shortcode": "V15.4.3", + "Ordinal": 3, + "Description": "Vérifiez que les verrous sont utilisés de manière cohérente pour éviter que les threads ne se bloquent, que ce soit en s'attendant les uns les autres ou en réessayant sans fin, et que la logique de verrouillage reste dans le code responsable de la gestion de la ressource pour garantir que les verrous ne peuvent pas être modifiés par inadvertance ou de manière malveillante par des classes ou du code externes.", + "L": "3" + }, + { + "Shortcode": "V15.4.4", + "Ordinal": 4, + "Description": "Vérifiez que les politiques d'allocation des ressources empêchent la saturation de threads en garantissant un accès équitable aux ressources, par exemple en exploitant les pools de threads, permettant aux threads de priorité inférieure de continuer dans un délai raisonnable.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V16", + "Ordinal": 16, + "ShortName": "Security", + "Name": "Journalisation de sécurité et gestion des erreurs", + "Items": [ + { + "Shortcode": "V16.1", + "Ordinal": 1, + "Name": "Documentation sur la journalisation de sécurité", + "Items": [ + { + "Shortcode": "V16.1.1", + "Ordinal": 1, + "Description": "Vérifiez qu'il existe un inventaire documentant la journalisation effectuée à chaque couche de la pile technologique de l'application, les événements enregistrés, les formats de journal, l'endroit où cette journalisation est stockée, la manière dont elle est utilisée, la manière dont l'accès à celle-ci est contrôlé et la durée de conservation des journaux.", + "L": "2" + } + ] + }, + { + "Shortcode": "V16.2", + "Ordinal": 2, + "Name": "Journalisation générale", + "Items": [ + { + "Shortcode": "V16.2.1", + "Ordinal": 1, + "Description": "Vérifiez que chaque entrée de journal inclut les métadonnées nécessaires (telles que quand, où, qui, quoi) qui permettraient une enquête détaillée sur la chronologie lorsqu'un événement se produit.", + "L": "2" + }, + { + "Shortcode": "V16.2.2", + "Ordinal": 2, + "Description": "Vérifiez que les sources de temps de tous les composants de journalisation sont synchronisées et que les horodatages des métadonnées des événements de sécurité utilisent le temps UTC ou incluent un décalage horaire explicite. L'UTC est recommandé pour garantir la cohérence entre les systèmes distribués et éviter toute confusion lors du passage à l'heure d'été.", + "L": "2" + }, + { + "Shortcode": "V16.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l’application stocke ou diffuse uniquement les journaux vers les fichiers et services documentés dans l’inventaire des journaux.", + "L": "2" + }, + { + "Shortcode": "V16.2.4", + "Ordinal": 4, + "Description": "Vérifiez que les journaux peuvent être lus et corrélés par le processeur de journaux utilisé, de préférence en utilisant un format de journalisation commun.", + "L": "2" + }, + { + "Shortcode": "V16.2.5", + "Ordinal": 5, + "Description": "Vérifiez que l'application applique la journalisation en fonction du niveau de protection des données lors de la journalisation de données sensibles. Par exemple, certaines données, comme les identifiants ou les informations de paiement, peuvent être interdites. D'autres données, comme les jetons de session, ne peuvent être enregistrées que par hachage ou masquage, en totalité ou en partie.", + "L": "2" + } + ] + }, + { + "Shortcode": "V16.3", + "Ordinal": 3, + "Name": "Événements de sécurité", + "Items": [ + { + "Shortcode": "V16.3.1", + "Ordinal": 1, + "Description": "Vérifiez que toutes les opérations d'authentification sont enregistrées, y compris les tentatives réussies et infructueuses. Des métadonnées supplémentaires, telles que le type d'authentification ou les facteurs utilisés, doivent également être collectées.", + "L": "2" + }, + { + "Shortcode": "V16.3.2", + "Ordinal": 2, + "Description": "Vérifier que les tentatives d'autorisation infructueuses sont logguées. Pour le niveau 3, cela doit inclure la journalisation de toutes les décisions d'autorisation, y compris lors de l'accès à des données sensibles (sans journalisation des données sensibles elles-mêmes).", + "L": "2" + }, + { + "Shortcode": "V16.3.3", + "Ordinal": 3, + "Description": "Vérifiez que l'application enregistre les événements de sécurité définis dans la documentation et enregistre également les tentatives de contournement des contrôles de sécurité, tels que la validation des entrées, la logique métier et l'anti-automatisation.", + "L": "2" + }, + { + "Shortcode": "V16.3.4", + "Ordinal": 4, + "Description": "Vérifiez que l’application enregistre les erreurs inattendues et les échecs de contrôle de sécurité tels que les échecs TLS du backend.", + "L": "2" + } + ] + }, + { + "Shortcode": "V16.4", + "Ordinal": 4, + "Name": "Protection des journaux", + "Items": [ + { + "Shortcode": "V16.4.1", + "Ordinal": 1, + "Description": "Vérifiez que tous les composants de journalisation codent correctement les données pour empêcher l’injection de journaux.", + "L": "2" + }, + { + "Shortcode": "V16.4.2", + "Ordinal": 2, + "Description": "Vérifiez que les journaux sont protégés contre tout accès non autorisé et ne peuvent pas être modifiés.", + "L": "2" + }, + { + "Shortcode": "V16.4.3", + "Ordinal": 3, + "Description": "Vérifiez que les journaux sont transmis de manière sécurisée à un système logique distinct pour analyse, détection, alerte et remontée des informations. L'objectif est de garantir qu'en cas de violation de l'application, les journaux ne seront pas compromis.", + "L": "2" + } + ] + }, + { + "Shortcode": "V16.5", + "Ordinal": 5, + "Name": "Gestion des erreurs", + "Items": [ + { + "Shortcode": "V16.5.1", + "Ordinal": 1, + "Description": "Vérifiez qu'un message générique est renvoyé au consommateur lorsqu'une erreur inattendue ou sensible à la sécurité se produit, garantissant ainsi l'absence d'exposition de données système internes sensibles telles que les traces de pile, les requêtes, les clés secrètes et les jetons.", + "L": "2" + }, + { + "Shortcode": "V16.5.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application continue de fonctionner en toute sécurité lorsque l'accès aux ressources externes échoue, par exemple, en utilisant des modèles tels que des disjoncteurs ou une dégradation progressive.", + "L": "2" + }, + { + "Shortcode": "V16.5.3", + "Ordinal": 3, + "Description": "Vérifiez que l'application échoue proprement et sécurisée, y compris lorsqu'une exception se produit, en évitant les accès en cas d'erreur telles que le traitement d'une transaction malgré les erreurs résultant de la logique de validation.", + "L": "2" + }, + { + "Shortcode": "V16.5.4", + "Ordinal": 4, + "Description": "Vérifiez qu'un gestionnaire d'erreurs de « dernier recours » est défini pour intercepter toutes les exceptions non gérées. Cela permet d'éviter la perte des informations d'erreur qui doivent être loguées dans les fichiers journaux et de garantir qu'une erreur ne paralyse pas l'ensemble du processus applicatif, entraînant une perte de disponibilité.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V17", + "Ordinal": 17, + "ShortName": "WebRTC", + "Name": "WebRTC", + "Items": [ + { + "Shortcode": "V17.1", + "Ordinal": 1, + "Name": "Serveur TURN", + "Items": [ + { + "Shortcode": "V17.1.1", + "Ordinal": 1, + "Description": "Vérifiez que le service TURN (Traversal Using Relays around NAT) autorise uniquement l'accès aux adresses IP non réservées à des fins spécifiques (par exemple, réseaux internes, diffusion, bouclage). Notez que cela s'applique aux adresses IPv4 et IPv6.", + "L": "2" + }, + { + "Shortcode": "V17.1.2", + "Ordinal": 2, + "Description": "Vérifiez que le service Traversal Using Relays around NAT (TURN) n'est pas susceptible d'épuiser ses ressources lorsque des utilisateurs légitimes tentent d'ouvrir un grand nombre de ports sur le serveur TURN.", + "L": "3" + } + ] + }, + { + "Shortcode": "V17.2", + "Ordinal": 2, + "Name": "Média", + "Items": [ + { + "Shortcode": "V17.2.1", + "Ordinal": 1, + "Description": "Vérifiez que la clé du certificat Datagram Transport Layer Security (DTLS) est gérée et protégée conformément à la politique documentée de gestion des clés cryptographiques.", + "L": "2" + }, + { + "Shortcode": "V17.2.2", + "Ordinal": 2, + "Description": "Vérifiez que le serveur multimédia est configuré pour utiliser et prendre en charge les suites de chiffrement DTLS (Datagram Transport Layer Security) approuvées et un profil de protection sécurisé pour l'extension DTLS pour l'établissement de clés pour le protocole de transport en temps réel sécurisé (DTLS-SRTP).", + "L": "2" + }, + { + "Shortcode": "V17.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l'authentification SRTP (Secure Real-time Transport Protocol) est vérifiée sur le serveur multimédia pour empêcher les attaques par injection RTP (Real-time Transport Protocol) d'entraîner une condition de déni de service ou l'insertion de médias audio ou vidéo dans les flux multimédias.", + "L": "2" + }, + { + "Shortcode": "V17.2.4", + "Ordinal": 4, + "Description": "Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant lorsqu'il rencontre des paquets SRTP (Secure Real-time Transport Protocol) mal formés.", + "L": "2" + }, + { + "Shortcode": "V17.2.5", + "Ordinal": 5, + "Description": "Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.", + "L": "3" + }, + { + "Shortcode": "V17.2.6", + "Ordinal": 6, + "Description": "Vérifiez que le serveur multimédia n'est pas sensible à la vulnérabilité de condition de concurrence « ClientHello » dans Datagram Transport Layer Security (DTLS) en vérifiant si le serveur multimédia est publiquement connu comme étant vulnérable ou en effectuant le test de condition de concurrence.", + "L": "3" + }, + { + "Shortcode": "V17.2.7", + "Ordinal": 7, + "Description": "Vérifiez que tous les mécanismes d'enregistrement audio ou vidéo associés au serveur multimédia sont en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.", + "L": "3" + }, + { + "Shortcode": "V17.2.8", + "Ordinal": 8, + "Description": "Vérifiez que le certificat Datagram Transport Layer Security (DTLS) est vérifié par rapport à l'attribut d'empreinte cryptographique du protocole de description de session (SDP), en mettant fin au flux multimédia si la vérification échoue, pour garantir l'authenticité du flux multimédia.", + "L": "3" + } + ] + }, + { + "Shortcode": "V17.3", + "Ordinal": 3, + "Name": "Signalisation", + "Items": [ + { + "Shortcode": "V17.3.1", + "Ordinal": 1, + "Description": "Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation entrants légitimes lors d'une attaque par saturation. Cela peut être réalisé en implémentant une limitation de débit au niveau de la signalisation.", + "L": "2" + }, + { + "Shortcode": "V17.3.2", + "Ordinal": 2, + "Description": "Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation légitimes en cas de message mal formé susceptible de provoquer un déni de service. Cela peut inclure la validation des entrées, la gestion sécurisée des dépassements d'entiers, la prévention des dépassements de tampon et l'utilisation d'autres techniques robustes de gestion des erreurs.", + "L": "2" + } + ] + } + ] + } + ] +} diff --git a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.csv b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.csv new file mode 100644 index 0000000000..15b13d7673 --- /dev/null +++ b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.csv @@ -0,0 +1,347 @@ +chapter_id,chapter_name,section_id,section_name,req_id,req_description,level1,level2,level3,cwe,nist +V1,Encodage et nettoyage,V1.1,Architecture d'encodage et de nettoyage,V1.1.1,"Vérifiez que l'entrée est décodée ou non échappée vers une forme canonique une seule fois, elle n'est décodée que lorsque des données codées sous cette forme sont attendues, et que cela est fait avant de traiter davantage l'entrée, par exemple, elle n'est pas effectuée après la validation ou la désinfection de l'entrée.",,✓,✓,, +V1,Encodage et nettoyage,V1.1,Architecture d'encodage et de nettoyage,V1.1.2,"Vérifiez que l'application effectue l'encodage et l'échappement de sortie soit comme étape finale avant d'être utilisée par l'interpréteur pour lequel elle est destinée, soit par l'interpréteur lui-même.",,✓,✓,, +V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.1,"Vérifiez que l'encodage de sortie d'une réponse HTTP, d'un document HTML ou d'un document XML est pertinent pour le contexte requis, comme l'encodage des caractères pertinents pour les éléments HTML, les attributs HTML, les commentaires HTML, les CSS ou les champs d'en-tête HTTP, pour éviter de modifier la structure du message ou du document.",✓,✓,✓,, +V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.2,"Vérifiez que, lors de la création dynamique d'URL, les données non fiables sont encodées en fonction de leur contexte (par exemple, encodage d'URL ou encodage base64url pour les paramètres de requête ou de chemin). Assurez-vous que seuls les schémas d'URL sûrs sont autorisés (par exemple, interdire javascript: ou data:).",✓,✓,✓,, +V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.3,"Vérifiez que l'encodage ou l'échappement de sortie est utilisé lors de la création dynamique de contenu JavaScript (y compris JSON), pour éviter de modifier la structure du message ou du document (pour éviter l'injection JavaScript et JSON).",✓,✓,✓,, +V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.4,"Vérifiez que la sélection de données ou les requêtes de base de données (par exemple, SQL, HQL, NoSQL, Cypher) utilisent des requêtes paramétrées, des ORM, des Framework d'entités ou sont protégées contre les injections SQL et autres attaques par injection de base de données. Ceci est également pertinent lors de l'écriture de procédures stockées.",✓,✓,✓,, +V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.5,Vérifiez que l’application protège contre l’injection de commandes du système d’exploitation et que les appels du système d’exploitation utilisent des requêtes du système d’exploitation paramétrées ou utilisent un encodage de sortie de ligne de commande contextuelle.,✓,✓,✓,, +V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.6,Vérifiez que l’application protège contre les vulnérabilités d’injection LDAP ou que des contrôles de sécurité spécifiques pour empêcher l’injection LDAP ont été mis en œuvre.,,✓,✓,, +V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.7,Vérifiez que l’application est protégée contre les attaques par injection XPath en utilisant la paramétrisation des requêtes ou des requêtes précompilées.,,✓,✓,, +V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.8,"Vérifiez que les processeurs LaTeX sont configurés de manière sécurisée (par exemple, en n'utilisant pas l'indicateur « --shell-escape ») et qu'une liste d’autorisations de commandes est utilisée pour empêcher les attaques par injection LaTeX.",,✓,✓,, +V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.9,Vérifiez que l'application échappe les caractères spéciaux dans les expressions régulières (généralement à l'aide d'une barre oblique inverse) pour éviter qu'ils ne soient mal interprétés comme des métacaractères.,,✓,✓,, +V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.10,"Vérifiez que l'application est protégée contre les injections CSV et injections de formules. L'application doit respecter les règles d'échappement définies dans les sections 2.6 et 2.7 de la RFC 4180 lors de l'export de contenu CSV. De plus, lors de l'export au format CSV ou vers d'autres formats de tableur (tels que XLS, XLSX ou ODF), les caractères spéciaux (notamment « = », « + », « - », « @ », « \t » (tabulation) et « \0 » (caractère null)) doivent être protégés par une apostrophe s'ils apparaissent en premier dans une valeur de champ.",,,✓,, +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.1,Vérifiez que toutes les entrées HTML non fiables provenant d'éditeurs WYSIWYG ou similaires sont nettoyées à l'aide d'une bibliothèque ou d'une fonctionnalité de Framework de nettoyage HTML bien connue et sécurisée.,✓,✓,✓,, +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.2,"Vérifiez que l'application évite d'utiliser eval() ou d'autres fonctionnalités d'exécution de code dynamique telles que Spring Expression Language (SpEL). En l'absence d'alternative, toute saisie utilisateur incluse doit être nettoyée avant d'être exécutée.",✓,✓,✓,, +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.3,"Vérifiez que les données transmises à un contexte potentiellement dangereux sont préalablement nettoyées pour appliquer des mesures de sécurité, telles qu'autoriser uniquement des caractères sûrs pour ce contexte et raccourcir des entrées trop longues.",,✓,✓,, +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.4,"Vérifiez que le contenu Scalable Vector Graphics (SVG) scriptable fourni par l'utilisateur est validé ou nettoyé pour contenir uniquement des balises et des attributs (tels que des graphiques de dessin) qui sont sûrs pour l'application, par exemple, ne contiennent pas de scripts et d'objets étrangers.",,✓,✓,, +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.5,"Vérifiez que l'application nettoie ou désactive le contenu du langage de modèle d'expression ou de script fourni par l'utilisateur, tel que les feuilles de style CSS, le Markdown ou XSL, BBCode ou similaire.",,✓,✓,, +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.6,"Vérifiez que l'application protège contre les attaques de falsification de requête côté serveur (SSRF), en validant les données non fiables par rapport à une liste d'autorisation de protocoles, de domaines, de chemins et de ports et en nettoyant les caractères potentiellement dangereux avant d'utiliser les données pour appeler un autre service.",,✓,✓,, +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.7,"Vérifiez que l'application se protège contre les attaques par injection de modèles en interdisant la création de modèles basés sur des entrées non fiables. En l'absence d'alternative, toute entrée non fiable incluse dynamiquement lors de la création du modèle doit être nettoyée ou rigoureusement validée.",,✓,✓,, +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.8,Vérifiez que l’application nettoie correctement les entrées non fiables avant utilisation dans les requêtes Java Naming and Directory Interface (JNDI) et que JNDI est configuré de manière sécurisée pour empêcher les attaques par injection JNDI.,,✓,✓,, +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.9,Vérifiez que l’application nettoie le contenu avant qu’il ne soit envoyé à memcache pour éviter les attaques par injection.,,✓,✓,, +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.10,Vérifiez que les chaînes de format susceptibles d'être résolues de manière inattendue ou malveillante lors de leur utilisation sont nettoyées avant d'être traitées.,,✓,✓,, +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.11,Vérifiez que l'application nettoie les entrées utilisateur avant de les transmettre aux systèmes de messagerie pour se protéger contre l'injection SMTP ou IMAP.,,✓,✓,, +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.12,"Vérifiez que les expressions régulières sont exemptes d'éléments provoquant ""backtracking"" exponentiel et assurez-vous que les entrées non fiables sont nettoyées pour atténuer les attaques ReDoS ou Runaway Regex.",,,✓,, +V1,Encodage et nettoyage,V1.4,"Mémoire, chaine de caractères et code à mémoire non-managée",V1.4.1,"Vérifiez que l'application utilise des chaînes memory-safe, une copie de mémoire et une arithmétique de pointeur renforcée pour détecter ou empêcher les débordements de pile, de tampon ou de tas.",,✓,✓,, +V1,Encodage et nettoyage,V1.4,"Mémoire, chaine de caractères et code à mémoire non-managée",V1.4.2,"Vérifiez que les techniques de validation du signe, de la plage et de l’entrée sont utilisées pour éviter les dépassements d’entiers.",,✓,✓,, +V1,Encodage et nettoyage,V1.4,"Mémoire, chaine de caractères et code à mémoire non-managée",V1.4.3,"Vérifiez que la mémoire et les ressources allouées dynamiquement sont libérées et que les références ou les pointeurs vers la mémoire libérée sont supprimés ou définis à null pour éviter les ""dangling pointer"" et les vulnérabilités d'utilisation après libération.",,✓,✓,, +V1,Encodage et nettoyage,V1.5,Désérialisation sécurisée,V1.5.1,"Vérifiez que l'application configure les ""parser"" XML pour utiliser une configuration restrictive et que les fonctionnalités non sûres telles que la résolution d'entités externes sont désactivées pour empêcher les attaques XML eXternal Entity (XXE).",✓,✓,✓,, +V1,Encodage et nettoyage,V1.5,Désérialisation sécurisée,V1.5.2,"Vérifiez que la désérialisation des données non fiables garantit une gestion sécurisée des entrées, par exemple en utilisant une liste d'autorisation de types d'objets ou en limitant les types d'objets définis par le client, afin d'empêcher les attaques par désérialisation. Les mécanismes de désérialisation explicitement définis comme non sécurisés ne doivent pas être utilisés avec des entrées non fiables.",,✓,✓,, +V1,Encodage et nettoyage,V1.5,Désérialisation sécurisée,V1.5.3,"Vérifiez que les différents ""parser"" utilisés dans l'application pour le même type de données (par exemple, les ""parser"" JSON, les ""parser"" XML, les ""parser"" d'URL) effectuent l'analyse de manière cohérente et utilisent le même mécanisme d'encodage de caractères pour éviter des problèmes tels que les vulnérabilités d'interopérabilité JSON ou un comportement d'analyse d'URI ou de fichier différent exploité dans les attaques d'inclusion de fichiers à distance (RFI) ou de falsification de requête côté serveur (SSRF).",,,✓,, +V2,Validation et logique métier,V2.1,Validation et documentation de la logique métier,V2.1.1,"Vérifiez que la documentation de l'application définit des règles de validation des entrées pour vérifier la validité des éléments de données par rapport à la structure attendue. Il peut s'agir de formats de données courants tels que des numéros de carte de crédit, des adresses e-mail ou des numéros de téléphone, ou d'un format de données interne.",✓,✓,✓,, +V2,Validation et logique métier,V2.1,Validation et documentation de la logique métier,V2.1.2,"Vérifiez que la documentation de l'application définit comment valider la cohérence logique et contextuelle des éléments de données combinés, par exemple en vérifiant que la banlieue et le code postal correspondent.",,✓,✓,, +V2,Validation et logique métier,V2.1,Validation et documentation de la logique métier,V2.1.3,"Vérifiez que les attentes en matière de limites et de validations de la logique métier sont documentées, y compris par utilisateur et globalement dans l'application.",,✓,✓,, +V2,Validation et logique métier,V2.2,Validation des entrées,V2.2.1,"Vérifier que les entrées sont validées afin de respecter les attentes métier ou fonctionnelles. Cette validation doit être basée sur une liste de valeurs, de modèles et de plages autorisées, ou sur la comparaison des entrées avec une structure attendue et des limites logiques selon des règles prédéfinies. Pour le niveau 1, cette validation peut se concentrer sur les entrées utilisées pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau 2, elle doit s'appliquer à toutes les entrées.",✓,✓,✓,, +V2,Validation et logique métier,V2.2,Validation des entrées,V2.2.2,"Vérifiez que l'application est conçue pour appliquer la validation des entrées au niveau d'une couche de service de confiance. Bien que la validation côté client améliore l'ergonomie et doit être encouragée, elle ne doit pas être considérée comme un contrôle de sécurité.",✓,✓,✓,, +V2,Validation et logique métier,V2.2,Validation des entrées,V2.2.3,Vérifiez que l’application garantit que les combinaisons d’éléments de données associés sont raisonnables selon les règles prédéfinies.,,✓,✓,, +V2,Validation et logique métier,V2.3,Sécurité de la logique métier,V2.3.1,Vérifiez que l’application traitera uniquement les flux de logique métier pour le même utilisateur dans l’ordre séquentiel attendu et sans sauter d’étapes.,✓,✓,✓,, +V2,Validation et logique métier,V2.3,Sécurité de la logique métier,V2.3.2,"Vérifiez que les limites de la logique métier sont implémentées conformément à la documentation de l'application, afin d'éviter que des failles de la logique métier ne soient pas exploitées.",,✓,✓,, +V2,Validation et logique métier,V2.3,Sécurité de la logique métier,V2.3.3,Vérifiez que les transactions sont utilisées au niveau de la logique métier de telle sorte qu'une opération de logique métier réussisse dans son intégralité ou qu'elle soit restaurée à l'état correct précédent.,,✓,✓,, +V2,Validation et logique métier,V2.3,Sécurité de la logique métier,V2.3.4,Vérifiez que les mécanismes de verrouillage au niveau de la logique métier sont utilisés pour garantir que les ressources en quantité limitée (telles que les sièges de théâtre ou les créneaux de livraison) ne peuvent pas être réservées deux fois en manipulant la logique de l'application.,,✓,✓,, +V2,Validation et logique métier,V2.3,Sécurité de la logique métier,V2.3.5,"Vérifiez que les flux logiques métier à forte valeur ajoutée nécessitent l'approbation de plusieurs utilisateurs afin d'éviter toute action non autorisée ou accidentelle. Cela peut inclure, sans s'y limiter, les transferts monétaires importants, les approbations de contrats, l'accès à des informations classifiées ou les contournements de sécurité dans le secteur manufacturier.",,,✓,, +V2,Validation et logique métier,V2.4,Anti-automatisation,V2.4.1,"Vérifiez que des contrôles anti-automatisation sont en place pour protéger contre les appels excessifs aux fonctions d'application qui pourraient conduire à l'exfiltration de données, à la création de données inutiles, à l'épuisement des quotas, aux violations de limites de débit, au déni de service ou à la surutilisation de ressources coûteuses.",,✓,✓,, +V2,Validation et logique métier,V2.4,Anti-automatisation,V2.4.2,"Vérifiez que les flux logiques métier nécessitent un timing humain réaliste, évitant ainsi des soumissions de transactions excessivement rapides.",,,✓,, +V3,Sécurité du frontend Web,V3.1,Documentation sur la sécurité du frontend Web,V3.1.1,"Vérifiez que la documentation de l'application indique les fonctionnalités de sécurité attendues que les navigateurs utilisant l'application doivent prendre en charge (telles que HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) et autres mécanismes de sécurité HTTP pertinents). Elle doit également définir le comportement de l'application lorsque certaines de ces fonctionnalités ne sont pas disponibles (par exemple, avertir l'utilisateur ou bloquer l'accès).",,,✓,, +V3,Sécurité du frontend Web,V3.2,Interprétation non intentionnelle du contenu,V3.2.1,"Vérifiez que des contrôles de sécurité sont en place pour empêcher les navigateurs d'afficher du contenu ou des fonctionnalités dans les réponses HTTP dans un contexte incorrect (par exemple, lorsqu'une API, un fichier téléchargé par l'utilisateur ou une autre ressource est demandée directement). Les contrôles possibles peuvent inclure : ne pas transmettre le contenu sauf si les champs d'en-tête de requête HTTP (tels que Sec-Fetch-\*) indiquent qu'il s'agit du contexte correct, utiliser la directive sandbox du champ d'en-tête Content-Security-Policy ou utiliser le type de disposition de pièce jointe dans le champ d'en-tête Content-Disposition.",✓,✓,✓,, +V3,Sécurité du frontend Web,V3.2,Interprétation non intentionnelle du contenu,V3.2.2,"Vérifiez que le contenu destiné à être affiché sous forme de texte, plutôt que rendu sous forme de HTML, est géré à l'aide de fonctions de rendu sécurisées (telles que createTextNode ou textContent) pour empêcher l'exécution involontaire de contenu tel que HTML ou JavaScript.",✓,✓,✓,, +V3,Sécurité du frontend Web,V3.2,Interprétation non intentionnelle du contenu,V3.2.3,"Vérifiez que l'application évite l'écrasement du DOM lors de l'utilisation de JavaScript côté client en utilisant des déclarations de variables explicites, en effectuant une vérification de type stricte, en évitant de stocker des variables globales sur l'objet document et en implémentant l'isolation de l'espace de nommage.",,,✓,, +V3,Sécurité du frontend Web,V3.3,Configuration des cookies,V3.3.1,"Vérifiez que les cookies ont l'attribut « Secure » ​​défini et si le préfixe « \__Host- » n'est pas utilisé pour le nom du cookie, le préfixe « __Secure- » doit être utilisé pour le nom du cookie.",✓,✓,✓,, +V3,Sécurité du frontend Web,V3.3,Configuration des cookies,V3.3.2,"Vérifiez que la valeur de l'attribut « SameSite » de chaque cookie est définie en fonction de l'objectif du cookie, afin de limiter l'exposition aux attaques de réparation de l'interface utilisateur et aux attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).",,✓,✓,, +V3,Sécurité du frontend Web,V3.3,Configuration des cookies,V3.3.3,"Vérifiez que les cookies ont le préfixe « __Host- » pour le nom du cookie, sauf s'ils sont explicitement conçus pour être partagés avec d'autres hôtes.",,✓,✓,, +V3,Sécurité du frontend Web,V3.3,Configuration des cookies,V3.3.4,"Vérifiez que si la valeur d'un cookie n'est pas censée être accessible aux scripts côté client (comme un jeton de session), le cookie doit avoir l'attribut « HttpOnly » défini et la même valeur (par exemple, un jeton de session) ne doit être transférée au client que via le champ d'en-tête « Set-Cookie ».",,✓,✓,, +V3,Sécurité du frontend Web,V3.3,Configuration des cookies,V3.3.5,"Vérifiez que lorsque l'application écrit un cookie, la longueur combinée du nom et de la valeur du cookie ne dépasse pas 4 096 octets. Les cookies trop volumineux ne seront pas stockés par le navigateur et ne seront donc pas envoyés avec les requêtes, empêchant ainsi l'utilisateur d'utiliser les fonctionnalités de l'application qui reposent sur ce cookie.",,,✓,, +V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.1,"Vérifiez qu'un champ d'en-tête Strict-Transport-Security est inclus dans toutes les réponses afin d'appliquer une politique HTTP Strict Transport Security (HSTS). Une durée maximale d'au moins un an doit être définie, et pour les niveaux L2 et supérieurs, la politique doit également s'appliquer à tous les sous-domaines.",✓,✓,✓,, +V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.2,"Vérifiez que le champ d'en-tête Access-Control-Allow-Origin du partage de ressources cross-origine (CORS) est une valeur fixe de l'application ou, si la valeur du champ d'en-tête de requête HTTP Origin est utilisée, qu'elle est validée par rapport à une liste d'origines approuvées. Si « Access-Control-Allow-Origin: * » doit être utilisé, vérifiez que la réponse ne contient aucune information sensible.",✓,✓,✓,, +V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.3,"Vérifiez que les réponses HTTP incluent un champ d'en-tête de réponse Content-Security-Policy qui définit des directives garantissant que le navigateur charge et exécute uniquement du contenu ou des ressources fiables, afin de limiter l'exécution de JavaScript malveillant. Au minimum, une politique globale doit être utilisée, incluant les directives object-src 'none' et base-uri 'none', et définissant soit une lliste d’autorisations, soit des valeurs nonces ou des hachages. Pour une application L3, une politique par réponse avec des valeurs nonces ou des hachages doit être définie.",,✓,✓,, +V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.4,"Vérifiez que toutes les réponses HTTP contiennent un champ d'en-tête « X-Content-Type-Options: nosniff ». Cela indique aux navigateurs de ne pas utiliser l'analyse de contenu ni la détection du type MIME pour la réponse donnée, et d'exiger que la valeur du champ d'en-tête « Content-Type » de la réponse corresponde à la ressource de destination. Par exemple, la réponse à une demande de style n'est acceptée que si le type de contenu de la réponse est « text/css ». Cela permet également au navigateur d'utiliser la fonctionnalité de blocage de lecture inter-origines (CORB).",,✓,✓,, +V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.5,"Vérifiez que l'application définit une politique de référencement afin d'empêcher la fuite de données techniquement sensibles vers des services tiers via le champ d'en-tête de requête HTTP « Referer ». Cela peut être effectué via le champ d'en-tête de réponse HTTP « Referrer-Policy » ou via les attributs d'élément HTML. Les données sensibles peuvent inclure le chemin d'accès et les données de requête dans l'URL, et pour les applications internes non publiques, le nom d'hôte.",,✓,✓,, +V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.6,"Vérifiez que l'application Web utilise la directive frame-ancestors du champ d'en-tête Content-Security-Policy pour chaque réponse HTTP afin de garantir qu'elle ne peut pas être intégrée par défaut et que l'intégration de ressources spécifiques n'est autorisée qu'en cas de nécessité. Notez que le champ d'en-tête X-Frame-Options, bien que pris en charge par les navigateurs, est obsolète et n'est pas forcément fiable.",,✓,✓,, +V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.7,Vérifiez que le champ d’en-tête Content-Security-Policy spécifie un emplacement pour signaler les violations.,,,✓,, +V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.8,"Vérifiez que toutes les réponses HTTP qui lancent le rendu d'un document (comme les réponses de type text/html) incluent le champ d'en-tête 'Cross-Origin-Opener-Policy' avec la directive 'same-origin' ou s'ame-origin-allow-popups', selon les besoins. Cela empêche les attaques abusant de l'accès partagé aux objets Window, telles que le tabnabbing et le comptage d'images.",,,✓,, +V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.1,"Vérifiez que, si l'application ne s'appuie pas sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher les requêtes inter-origines non autorisées d'utiliser des fonctionnalités sensibles, ces requêtes sont validées afin de garantir leur origine. Cela peut se faire en utilisant et en validant des jetons anti-falsification ou en exigeant des champs d'en-tête HTTP supplémentaires qui ne sont pas des champs d'en-tête de requête CORS safelist. Ceci permet de se protéger contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).",✓,✓,✓,, +V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.2,"Vérifiez que, si l'application s'appuie sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher l'utilisation inter-origines non autorisée de fonctionnalités sensibles, il est impossible d'appeler la fonctionnalité avec une requête qui ne déclenche pas de requête de pré-vérification cross-origin CORS. Cela peut nécessiter de vérifier les valeurs des champs d'en-tête de requête 'Origin' et 'Content-Type' ou d'utiliser un champ d'en-tête supplémentaire qui n'est pas un champ d'en-tête de la liste de sécurité CORS.",✓,✓,✓,, +V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.3,"Vérifiez que les requêtes HTTP destinées aux fonctionnalités sensibles utilisent des méthodes HTTP appropriées, telles que POST, PUT, PATCH ou DELETE, et non des méthodes définies comme « sûres » par la spécification HTTP, telles que HEAD, OPTIONS ou GET. Une validation stricte des champs d'en-tête de requête Sec-Fetch-* peut également être utilisée pour garantir que la requête ne provient pas d'un appel inter-origines inapproprié, d'une requête de navigation ou d'un chargement de ressources (comme une source d'image) inattendu.",✓,✓,✓,, +V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.4,"Vérifiez que des applications distinctes sont hébergées sur des noms d'hôte différents pour tirer parti des restrictions fournies par la politique de même origine, y compris la manière dont les documents ou scripts chargés par une origine peuvent interagir avec les ressources d'une autre origine et les restrictions basées sur le nom d'hôte sur les cookies.",,✓,✓,, +V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.5,Vérifiez que les messages reçus par l'interface postMessage sont rejetés si l'origine du message n'est pas digne de confiance ou si la syntaxe du message n'est pas valide.,,✓,✓,, +V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.6,Vérifiez que la fonctionnalité JSONP n'est activée nulle part dans l'application pour éviter les attaques Cross-Site Script Inclusion (XSSI).,,,✓,, +V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.7,"Vérifiez que les données nécessitant une autorisation ne sont pas incluses dans les réponses des ressources de script, comme les fichiers JavaScript, pour empêcher les attaques par inclusion de script intersite (XSSI).",,,✓,, +V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.8,"Vérifiez que les ressources authentifiées (telles que les images, les vidéos, les scripts et autres documents) peuvent être chargées ou intégrées pour le compte de l'utilisateur uniquement lorsque cela est prévu. Cela peut être réalisé en validant strictement les champs d'en-tête de requête HTTP Sec-Fetch-* afin de garantir que la requête ne provient pas d'un appel cross-origin inapproprié, ou en définissant un champ d'en-tête de réponse HTTP Cross-Origin-Resource-Policy restrictif pour indiquer au navigateur de bloquer le contenu renvoyé.",,,✓,, +V3,Sécurité du frontend Web,V3.6,Intégrité des ressources externes,V3.6.1,"Vérifiez que les ressources côté client, telles que les bibliothèques JavaScript, les feuilles de style CSS ou les polices web, sont hébergées en externe (par exemple, sur un réseau de diffusion de contenu) uniquement si la ressource est statique et versionnée, et si l'intégrité des sous-ressources (SRI) est utilisée pour valider l'intégrité de la ressource. Si cela n'est pas possible, une décision de sécurité documentée doit justifier cette décision pour chaque ressource.",,,✓,, +V3,Sécurité du frontend Web,V3.7,Autres considérations sur la sécurité du navigateur,V3.7.1,"Vérifiez que l'application utilise uniquement des technologies côté client toujours prises en charge et considérées comme sécurisées. Parmi les technologies qui ne répondent pas à cette exigence figurent les plugins NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL ou les applets Java côté client.",,✓,✓,, +V3,Sécurité du frontend Web,V3.7,Autres considérations sur la sécurité du navigateur,V3.7.2,Vérifiez que l'application redirigera automatiquement l'utilisateur vers un nom d'hôte ou un domaine différent (qui n'est pas contrôlé par l'application) uniquement lorsque la destination apparaît sur une liste d'autorisation.,,✓,✓,, +V3,Sécurité du frontend Web,V3.7,Autres considérations sur la sécurité du navigateur,V3.7.3,"Vérifiez que le domaine de premier niveau de l'application (par exemple, site.tld) ​​est ajouté à la liste de préchargement publique pour HTTP Strict Transport Security (HSTS). Cela garantit que l'utilisation de TLS pour l'application est intégrée directement dans les principaux navigateurs, plutôt que de dépendre uniquement du champ d'en-tête de réponse Strict-Transport-Security.",,,✓,, +V3,Sécurité du frontend Web,V3.7,Autres considérations sur la sécurité du navigateur,V3.7.4,"Vérifiez que l'application affiche une notification lorsque l'utilisateur est redirigé vers une URL hors du contrôle de l'application, avec une option pour annuler la navigation.",,,✓,, +V3,Sécurité du frontend Web,V3.7,Autres considérations sur la sécurité du navigateur,V3.7.5,"Vérifiez que l'application se comporte comme documenté (par exemple, en avertissant l'utilisateur ou en bloquant l'accès) si le navigateur utilisé pour accéder à l'application ne prend pas en charge les fonctionnalités de sécurité attendues.",,,✓,, +V4,API et service Web,V4.1,Sécurité du service Web générique,V4.1.1,"Vérifiez que chaque réponse HTTP avec un corps de message contient un champ d'en-tête Content-Type qui correspond au contenu réel de la réponse, y compris le paramètre charset pour spécifier un codage de caractères sécurisé (par exemple, UTF-8, ISO-8859-1) conformément aux types de médias IANA, tels que « text/ », « /+xml » et « /xml ».",✓,✓,✓,, +V4,API et service Web,V4.1,Sécurité du service Web générique,V4.1.2,"Vérifiez que seuls les terminaux utilisateurs (destinés à l'accès manuel via un navigateur web) redirigent automatiquement de HTTP vers HTTPS, tandis que les autres services ou terminaux n'implémentent pas de redirections transparentes. Cela permet d'éviter qu'un client envoie par erreur des requêtes HTTP non chiffrées, mais que, comme ces requêtes sont automatiquement redirigées vers HTTPS, la fuite de données sensibles passe inaperçue.",,✓,✓,, +V4,API et service Web,V4.1,Sécurité du service Web générique,V4.1.3,"Vérifiez que tout champ d'en-tête HTTP utilisé par l'application et défini par une couche intermédiaire, telle qu'un équilibreur de charge, un proxy web ou un service backend-for-frontend, ne peut pas être remplacé par l'utilisateur final. Les exemples d'en-têtes peuvent inclure X-Real-IP, X-Forwarded-*, ou X-User-ID.",,✓,✓,, +V4,API et service Web,V4.1,Sécurité du service Web générique,V4.1.4,Vérifiez que seules les méthodes HTTP explicitement prises en charge par l'application ou son API (y compris les OPTIONS lors des demandes de contrôle en amont) peuvent être utilisées et que les méthodes inutilisées sont bloquées.,,,✓,, +V4,API et service Web,V4.1,Sécurité du service Web générique,V4.1.5,Vérifier que les signatures numériques par message sont utilisées pour fournir une assurance supplémentaire en plus des protections de transport pour les demandes ou les transactions qui sont très sensibles ou qui traversent un certain nombre de systèmes.,,,✓,, +V4,API et service Web,V4.2,Validation de la structure des messages HTTP,V4.2.1,"Vérifiez que tous les composants de l'application (y compris les équilibreurs de charge, les pares-feux et les serveurs d'applications) déterminent les limites des messages HTTP entrants à l'aide du mécanisme approprié à la version HTTP afin d'empêcher la contrebande de requêtes HTTP. Dans HTTP/1.x, si un champ d'en-tête Transfer-Encoding est présent, l'en-tête Content-Length doit être ignoré conformément à la RFC 2616. Avec HTTP/2 ou HTTP/3, si un champ d'en-tête Content-Length est présent, le récepteur doit s'assurer qu'il est cohérent avec la longueur des trames DATA.",,✓,✓,, +V4,API et service Web,V4.2,Validation de la structure des messages HTTP,V4.2.2,"Vérifier que, lors de la génération de messages HTTP, le champ d'en-tête Content-Length n'entre pas en conflit avec la longueur du contenu déterminée par le cadrage du protocole HTTP, afin d'empêcher les attaques de type « request smuggling ».",,,✓,, +V4,API et service Web,V4.2,Validation de la structure des messages HTTP,V4.2.3,"Vérifiez que l'application n'envoie ni n'accepte de messages HTTP/2 ou HTTP/3 avec des champs d'en-tête spécifiques à la connexion, tels que Transfer-Encoding, afin d'éviter les attaques par fractionnement de la réponse et par injection d'en-tête.",,,✓,, +V4,API et service Web,V4.2,Validation de la structure des messages HTTP,V4.2.4,"Vérifiez que l'application n'accepte que les requêtes HTTP/2 et HTTP/3 dont les champs et valeurs d'en-tête ne contiennent pas de séquences CR (\r), LF (\n) ou CRLF (\r\n), afin d'éviter les attaques par injection d'en-tête.",,,✓,, +V4,API et service Web,V4.2,Validation de la structure des messages HTTP,V4.2.5,"Vérifiez que, si l'application (backend ou frontend) construit et envoie des requêtes, elle utilise des mécanismes de validation, d'assainissement ou autres pour éviter de créer des URI (comme pour les appels API) ou des champs d'en-tête de requête HTTP (comme Authorization ou Cookie) qui sont trop longs pour être acceptés par le composant récepteur. Cela pourrait entraîner un déni de service, par exemple lors de l'envoi d'une requête trop longue (par exemple, un long champ d'en-tête de cookie), ce qui fait que le serveur répond toujours avec un statut d'erreur.",,,✓,, +V4,API et service Web,V4.3,GraphQL,V4.3.1,"Vérifiez qu'une liste d'autorisation de requête, une limitation de profondeur, une limitation de quantité ou une analyse des coûts de requête est utilisée pour empêcher le déni de service (DoS) de GraphQL ou d'expression de la couche données en raison de requêtes imbriquées coûteuses.",,✓,✓,, +V4,API et service Web,V4.3,GraphQL,V4.3.2,"Vérifiez que les requêtes d’introspection GraphQL sont désactivées dans l’environnement de production, sauf si l’API GraphQL est destinée à être utilisée par d’autres parties.",,✓,✓,, +V4,API et service Web,V4.4,WebSocket,V4.4.1,Vérifiez que WebSocket sur TLS (WSS) est utilisé pour toutes les connexions WebSocket.,✓,✓,✓,, +V4,API et service Web,V4.4,WebSocket,V4.4.2,"Vérifiez que, lors de la négociation HTTP WebSocket initiale, le champ d’en-tête 'Origin' est vérifié par rapport à une liste d’origines autorisées pour l’application.",,✓,✓,, +V4,API et service Web,V4.4,WebSocket,V4.4.3,"Vérifiez que, si la gestion de session standard de l'application ne peut pas être utilisée, des jetons dédiés sont utilisés à cet effet, qui sont conformes aux exigences de sécurité de gestion de session pertinentes.",,✓,✓,, +V4,API et service Web,V4.4,WebSocket,V4.4.4,Vérifiez que les jetons de gestion de session WebSocket dédiés sont initialement obtenus ou validés via la session HTTPS précédemment authentifiée lors de la transition d'une session HTTPS existante vers un canal WebSocket.,,✓,✓,, +V5,Gestion des fichiers,V5.1,Documentation sur la gestion des fichiers,V5.1.1,"Vérifiez que la documentation définit les types de fichiers autorisés, les extensions de fichiers attendues et la taille maximale (y compris la taille décompressée) pour chaque fonctionnalité de Téléversement. De plus, assurez-vous que la documentation précise comment les fichiers sont sécurisés pour le téléchargement et le traitement des utilisateurs finaux, par exemple le comportement de l'application lorsqu'un fichier malveillant est détecté.",,✓,✓,, +V5,Gestion des fichiers,V5.2,Téléversement de fichiers et contenu,V5.2.1,Vérifiez que l'application n'acceptera que des fichiers d'une taille qu'elle peut traiter sans provoquer de perte de performances ou d'attaque par déni de service.,✓,✓,✓,, +V5,Gestion des fichiers,V5.2,Téléversement de fichiers et contenu,V5.2.2,"Vérifiez que lorsque l'application accepte un fichier, seul ou dans une archive telle qu'un fichier zip, elle vérifie si l'extension de fichier correspond à une extension attendue et que le contenu correspond au type représenté par l'extension. Cela inclut, sans s'y limiter, la vérification des « octets magiques » initiaux, la réécriture d'images et l'utilisation de bibliothèques spécialisées pour la validation du contenu des fichiers. Pour le niveau L1, cela peut se concentrer uniquement sur les fichiers utilisés pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau L2, cela doit s'appliquer à tous les fichiers acceptés.",✓,✓,✓,, +V5,Gestion des fichiers,V5.2,Téléversement de fichiers et contenu,V5.2.3,"Vérifiez que l'application vérifie les fichiers compressés (par exemple, zip, gz, docx, odt) par rapport à la taille maximale autorisée non compressée et au nombre maximal de fichiers avant de décompresser le fichier.",,✓,✓,, +V5,Gestion des fichiers,V5.2,Téléversement de fichiers et contenu,V5.2.4,Vérifiez qu'un quota de taille de fichier et un nombre maximal de fichiers par utilisateur sont appliqués pour garantir qu'un seul utilisateur ne puisse pas remplir le stockage avec trop de fichiers ou des fichiers excessivement volumineux.,,,✓,, +V5,Gestion des fichiers,V5.2,Téléversement de fichiers et contenu,V5.2.5,"Vérifiez que l'application n'autorise pas le téléversement de fichiers compressés contenant des liens symboliques, sauf si cela est spécifiquement requis (auquel cas il sera nécessaire d'appliquer une liste d'autorisation des fichiers vers lesquels il est possible de créer des liens symboliques).",,,✓,, +V5,Gestion des fichiers,V5.2,Téléversement de fichiers et contenu,V5.2.6,"Vérifiez que l'application rejette les images téléversées avec une taille de pixel supérieure au maximum autorisé, afin d'éviter les attaques par inondation de pixels.",,,✓,, +V5,Gestion des fichiers,V5.3,Stockage de fichiers,V5.3.1,Vérifiez que les fichiers téléversés ou générés par une entrée non fiable et stockés dans un dossier public ne sont pas exécutés en tant que code de programme côté serveur lorsqu'ils sont accessibles directement avec une requête HTTP.,✓,✓,✓,, +V5,Gestion des fichiers,V5.3,Stockage de fichiers,V5.3.2,"Vérifiez que lorsque l'application crée des chemins d'accès pour les opérations sur les fichiers, elle utilise des données générées en interne ou fiables plutôt que des noms de fichiers soumis par l'utilisateur. Si des noms de fichiers ou des métadonnées de fichiers soumis par l'utilisateur doivent être utilisés, une validation et un nettoyage stricts doivent être appliqués. Ceci permet de se protéger contre les attaques par traversée de chemin, l'inclusion de fichiers locaux ou distants (LFI, RFI) et la falsification de requêtes côté serveur (SSRF).",✓,✓,✓,, +V5,Gestion des fichiers,V5.3,Stockage de fichiers,V5.3.3,"Vérifiez que le traitement des fichiers côté serveur, comme la décompression des fichiers, ignore les informations de chemin fournies par l'utilisateur pour éviter les vulnérabilités telles que le ""zip slip"".",,,✓,, +V5,Gestion des fichiers,V5.4,Téléchargement de fichier,V5.4.1,"Vérifiez que l’application valide ou ignore les noms de fichiers soumis par l’utilisateur, y compris dans un paramètre JSON, JSONP ou URL et spécifie un nom de fichier dans le champ d’en-tête Content-Disposition de la réponse.",,✓,✓,, +V5,Gestion des fichiers,V5.4,Téléchargement de fichier,V5.4.2,"Vérifiez que les noms de fichiers servis (par exemple, dans les champs d'en-tête de réponse HTTP ou les pièces jointes aux e-mails) sont encodés ou nettoyés (par exemple, conformément à la RFC 6266) pour préserver la structure du document et empêcher les attaques par injection.",,✓,✓,, +V5,Gestion des fichiers,V5.4,Téléchargement de fichier,V5.4.3,Vérifiez que les fichiers obtenus à partir de sources non fiables sont analysés par des scanners antivirus pour empêcher la diffusion de contenu malveillant connu.,,✓,✓,, +V6,Authentification,V6.1,Documentation d'authentification,V6.1.1,"Vérifiez que la documentation de l'application définit comment les contrôles, tels que la limitation de débit, l'anti-automatisation et la réponse adaptative, sont utilisés pour se défendre contre les attaques telles que le « credential stuffing » et la force brute des mots de passe. La documentation doit expliquer clairement comment ces contrôles sont configurés et empêcher le blocage malveillant des comptes.",✓,✓,✓,, +V6,Authentification,V6.1,Documentation d'authentification,V6.1.2,"Vérifiez qu'une liste de mots spécifiques au contexte est documentée afin d'empêcher leur utilisation dans les mots de passe. Cette liste peut inclure des permutations de noms d'organisations, de produits, d'identifiants de systèmes, de noms de codes de projets, de noms de services ou de rôles, etc.",,✓,✓,, +V6,Authentification,V6.1,Documentation d'authentification,V6.1.3,"Vérifiez que, si l'application inclut plusieurs voies d'authentification, celles-ci sont toutes documentées avec les contrôles de sécurité et la force d'authentification qui doivent être appliqués de manière cohérente.",,✓,✓,, +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.1,"Vérifiez que les mots de passe définis par l'utilisateur comportent au moins 8 caractères, bien qu'un minimum de 15 caractères soit fortement recommandé.",✓,✓,✓,, +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.2,Vérifiez que les utilisateurs peuvent modifier leur mot de passe.,✓,✓,✓,, +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.3,Vérifiez que la fonctionnalité de changement de mot de passe nécessite le mot de passe actuel et le nouveau mot de passe de l'utilisateur.,✓,✓,✓,, +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.4,"Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou du changement de mot de passe sont vérifiés par rapport à un ensemble disponible d'au moins 3 000 mots de passe principaux qui correspondent à la politique de mot de passe de l'application, par exemple la longueur minimale.",✓,✓,✓,, +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.5,"Vérifiez que les mots de passe peuvent être utilisés, quelle que soit leur composition, sans restriction quant au type de caractères autorisés. Aucun nombre minimal de majuscules ou de minuscules, de chiffres ou de caractères spéciaux ne doit être exigé.",✓,✓,✓,, +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.6,Vérifiez que les champs de saisie du mot de passe utilisent type=password pour masquer la saisie. Les applications peuvent permettre à l'utilisateur d'afficher temporairement l'intégralité du mot de passe masqué ou le dernier caractère saisi.,✓,✓,✓,, +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.7,"Vérifiez que la fonctionnalité « coller », les assistants de mot de passe du navigateur et les gestionnaires de mots de passe externes sont autorisés.",✓,✓,✓,, +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.8,"Vérifiez que l'application vérifie le mot de passe de l'utilisateur exactement tel qu'il a été reçu de l'utilisateur, sans aucune modification telle qu'une troncature ou une transformation de casse.",✓,✓,✓,, +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.9,Vérifiez que les mots de passe d’au moins 64 caractères sont autorisés.,,✓,✓,, +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.10,Vérifiez que le mot de passe d'un utilisateur reste valide jusqu'à ce qu'il soit découvert comme compromis ou qu'il soit renouvelé. L'application ne doit pas exiger de renouvellement périodique des identifiants.,,✓,✓,, +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.11,Vérifiez que la liste documentée de mots spécifiques au contexte est utilisée pour éviter la création de mots de passe faciles à deviner.,,✓,✓,, +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.12,Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou des modifications de mot de passe sont vérifiés par rapport à un ensemble de mots de passe fuités.,,✓,✓,, +V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.1,Vérifiez que les contrôles visant à empêcher les attaques telles que le bourrage d'informations d'identification et la force brute des mots de passe sont mis en œuvre conformément à la documentation de sécurité de l'application.,✓,✓,✓,, +V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.2,"Vérifiez que les comptes d’utilisateur par défaut (par exemple, « root », « admin » ou « sa ») ne sont pas présents dans l’application ou sont désactivés.",✓,✓,✓,, +V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.3,Vérifiez que l’application exige que les utilisateurs utilisent un mécanisme d’authentification multifacteur ou une combinaison de mécanismes d’authentification à facteur unique.,,✓,✓,, +V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.4,"Vérifiez que, si l’application inclut plusieurs voies d’authentification, il n’existe aucune voie non documentée et que les contrôles de sécurité et la force d’authentification sont appliqués de manière cohérente.",,✓,✓,, +V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.5,"Vérifiez que les utilisateurs sont informés des tentatives d'authentification suspectes (réussies ou non). Il peut s'agir de tentatives d'authentification provenant d'un emplacement ou d'un client inhabituel, d'une authentification partiellement réussie (un seul facteur parmi plusieurs), d'une tentative d'authentification après une longue période d'inactivité ou d'une authentification réussie après plusieurs tentatives infructueuses.",,,✓,, +V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.6,Vérifiez que le courrier électronique n’est pas utilisé comme mécanisme d’authentification à facteur unique ou à facteurs multiples.,,,✓,, +V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.7,"Vérifiez que les utilisateurs sont avertis après les mises à jour des détails d'authentification, telles que les réinitialisations d'informations d'identification ou la modification du nom d'utilisateur ou de l'adresse e-mail.",,,✓,, +V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.8,"Vérifiez que les utilisateurs valides ne peuvent pas être déduits d'échecs d'authentification, par exemple en se basant sur des messages d'erreur, des codes de réponse HTTP ou des temps de réponse différents. Les fonctionnalités d'inscription et de mot de passe oublié doivent également bénéficier de cette protection.",,,✓,, +V6,Authentification,V6.4,Cycle de vie et récupération du facteur d'authentification,V6.4.1,"Vérifiez que les mots de passe initiaux ou les codes d'activation générés par le système sont générés de manière aléatoire et sécurisée, qu'ils respectent la politique de mots de passe en vigueur et qu'ils expirent après une courte période ou après leur première utilisation. Ces secrets initiaux ne doivent pas devenir des mots de passe permanents.",✓,✓,✓,, +V6,Authentification,V6.4,Cycle de vie et récupération du facteur d'authentification,V6.4.2,Vérifiez que les indices de mot de passe ou l'authentification basée sur les connaissances (appelées « questions secrètes ») ne sont pas présents.,✓,✓,✓,, +V6,Authentification,V6.4,Cycle de vie et récupération du facteur d'authentification,V6.4.3,"Vérifiez qu'un processus sécurisé de réinitialisation d'un mot de passe oublié est mis en œuvre, qui ne contourne aucun mécanisme d'authentification multifacteur activé.",,✓,✓,, +V6,Authentification,V6.4,Cycle de vie et récupération du facteur d'authentification,V6.4.4,"Vérifiez que si un facteur d'authentification multifacteur est perdu, la preuve de vérification d'identité est effectuée au même niveau que lors de l'inscription.",,✓,✓,, +V6,Authentification,V6.4,Cycle de vie et récupération du facteur d'authentification,V6.4.5,"Vérifiez que les instructions de renouvellement des mécanismes d'authentification qui expirent sont envoyées avec suffisamment de temps pour être exécutées avant l'expiration de l'ancien mécanisme d'authentification, en configurant des rappels automatiques si nécessaire.",,,✓,, +V6,Authentification,V6.4,Cycle de vie et récupération du facteur d'authentification,V6.4.6,"Vérifiez que les administrateurs peuvent initier la réinitialisation du mot de passe de l'utilisateur, mais que cela ne leur permet pas de modifier ou de choisir son mot de passe. Cela évite qu'ils ne connaissent le mot de passe de l'utilisateur.",,,✓,, +V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.1,"Vérifiez que les secrets de recherche, les demandes ou codes d'authentification out-of-band et les mots de passe à usage unique basés sur le temps (TOTP) ne peuvent être utilisés avec succès qu'une seule fois.",,✓,✓,, +V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.2,"Vérifiez que, lors de leur stockage dans le backend de l'application, les secrets de recherche comportant moins de 112 bits d'entropie (19 caractères alphanumériques aléatoires ou 34 chiffres aléatoires) sont hachés avec un algorithme de hachage de stockage de mots de passe approuvé, intégrant un sel aléatoire de 32 bits. Une fonction de hachage standard peut être utilisée si le secret comporte 112 bits d'entropie ou plus.",,✓,✓,, +V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.3,"Vérifiez que les secrets de recherche, le code d'authentification out-of-band et les mots de passe à usage unique basés sur le temps sont générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) pour éviter les valeurs prévisibles.",,✓,✓,, +V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.4,Vérifiez que les secrets de recherche et les codes d'authentification out-of-band ont un minimum de 20 bits d'entropie (généralement 4 caractères alphanumériques aléatoires ou 6 chiffres aléatoires suffisent).,,✓,✓,, +V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.5,"Vérifiez que les requêtes, codes ou jetons d'authentification out-of-band, ainsi que les mots de passe à usage unique (TOTP), ont une durée de vie définie. Les requêtes out-of-band doivent avoir une durée de vie maximale de 10 minutes et les TOTP, de 30 secondes.",,✓,✓,, +V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.6,Vérifiez que tout facteur d’authentification (y compris les appareils physiques) peut être révoqué en cas de vol ou autre perte.,,,✓,, +V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.7,"Vérifiez que les mécanismes d’authentification biométrique ne sont utilisés que comme facteurs secondaires, avec quelque chose que vous possédez ou quelque chose que vous savez.",,,✓,, +V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.8,Vérifiez que les mots de passe à usage unique basés sur le temps (TOTP) sont vérifiés en fonction d'une source temporelle provenant d'un service de confiance et non d'une heure non fiable ou fournie par le client.,,,✓,, +V6,Authentification,V6.6,Mécanismes d'authentification out-of-band,V6.6.1,"Vérifier que les mécanismes d'authentification utilisant le réseau téléphonique public commuté (RTPC) pour la transmission de mots de passe à usage unique (OTP) par téléphone ou SMS ne sont proposés que lorsque le numéro de téléphone a été préalablement validé. D'autres méthodes plus robustes (telles que les mots de passe à usage unique à durée déterminée) sont également proposées, et que le service informe les utilisateurs des risques de sécurité qu'elles présentent. Pour les applications de niveau 3, le téléphone et les SMS ne doivent pas être disponibles.",,✓,✓,, +V6,Authentification,V6.6,Mécanismes d'authentification out-of-band,V6.6.2,"Vérifiez que les demandes d’authentification out-of-band, les codes ou les jetons sont liés à la demande d’authentification d’origine pour laquelle ils ont été générés et ne sont pas utilisables pour une demande précédente ou ultérieure.",,✓,✓,, +V6,Authentification,V6.6,Mécanismes d'authentification out-of-band,V6.6.3,"Vérifiez qu'un mécanisme d'authentification out-of-band basé sur du code est protégé contre les attaques par force brute grâce au ""rate limiting"". Envisagez également d'utiliser un code avec au moins 64 bits d'entropie.",,✓,✓,, +V6,Authentification,V6.6,Mécanismes d'authentification out-of-band,V6.6.4,"Vérifiez que, lorsque les notifications push sont utilisées pour l'authentification multifacteur, le ""rate limiting"" est appliqué afin d'empêcher les attaques de type « push bombing ». La concordance des numéros peut également atténuer ce risque.",,,✓,, +V6,Authentification,V6.7,Mécanisme d'authentification cryptographique,V6.7.1,Vérifiez que les certificats utilisés pour vérifier les assertions d’authentification cryptographique sont stockés de manière à les protéger contre toute modification.,,,✓,, +V6,Authentification,V6.7,Mécanisme d'authentification cryptographique,V6.7.2,Vérifiez que le nonce de défi a une longueur d'au moins 64 bits et qu'il est statistiquement unique ou unique sur toute la durée de vie du périphérique cryptographique.,,,✓,, +V6,Authentification,V6.8,Authentification avec un fournisseur d'identité,V6.8.1,"Vérifiez que, si l'application prend en charge plusieurs fournisseurs d'identité (IdP), l'identité de l'utilisateur ne peut pas être usurpée via un autre fournisseur d'identité pris en charge (par exemple, en utilisant le même identifiant utilisateur). La mesure standard consisterait à ce que l'application enregistre et identifie l'utilisateur à l'aide d'une combinaison de l'ID du fournisseur d'identité (servant d'espace de noms) et de l'ID de l'utilisateur dans le fournisseur d'identité.",,✓,✓,, +V6,Authentification,V6.8,Authentification avec un fournisseur d'identité,V6.8.2,"Vérifiez que la présence et l'intégrité des signatures numériques sur les assertions d'authentification (par exemple sur les assertions JWT ou SAML) sont toujours validées, en rejetant toutes les assertions non signées ou ayant des signatures non valides.",,✓,✓,, +V6,Authentification,V6.8,Authentification avec un fournisseur d'identité,V6.8.3,Vérifiez que les assertions SAML sont traitées de manière unique et utilisées une seule fois au cours de la période de validité pour éviter les attaques par rejeu.,,✓,✓,, +V6,Authentification,V6.8,Authentification avec un fournisseur d'identité,V6.8.4,"Si une application utilise un fournisseur d'identité (IdP) distinct et attend une force, des méthodes ou une date d'authentification spécifiques pour des fonctions spécifiques, vérifiez que l'application les vérifie à l'aide des informations renvoyées par l'IdP. Par exemple, si OIDC est utilisé, cela peut être réalisé en validant les affirmations de jeton d'identification telles que « acr », « amr » et « auth_time » (le cas échéant). Si l'IdP ne fournit pas ces informations, l'application doit disposer d'une approche de secours documentée qui suppose que le mécanisme d'authentification de force minimale a été utilisé (par exemple, une authentification à facteur unique avec nom d'utilisateur et mot de passe).",,✓,✓,, +V7,Gestion des sessions,V7.1,Documentation sur la gestion des sessions,V7.1.1,"Vérifiez que le délai d'inactivité de la session de l'utilisateur et la durée de vie maximale absolue de la session sont documentés, sont appropriés en combinaison avec d'autres contrôles et que la documentation inclut une justification de tout écart par rapport aux exigences de réauthentification NIST SP 800-63B.",,✓,✓,, +V7,Gestion des sessions,V7.1,Documentation sur la gestion des sessions,V7.1.2,Vérifiez que la documentation définit le nombre de sessions simultanées (parallèles) autorisées pour un compte ainsi que les comportements et actions prévus à entreprendre lorsque le nombre maximal de sessions actives est atteint.,,✓,✓,, +V7,Gestion des sessions,V7.1,Documentation sur la gestion des sessions,V7.1.3,"Vérifiez que tous les systèmes qui créent et gèrent des sessions utilisateur dans le cadre d'un écosystème de gestion des identités fédérées (tels que les systèmes SSO) sont documentés avec des contrôles pour coordonner la durée de vie des sessions, la résiliation et toute autre condition nécessitant une réauthentification.",,✓,✓,, +V7,Gestion des sessions,V7.2,Sécurité fondamentale de la gestion des sessions,V7.2.1,Vérifiez que l’application effectue toutes les vérifications des jetons de session à l’aide d’un service backend de confiance.,✓,✓,✓,, +V7,Gestion des sessions,V7.2,Sécurité fondamentale de la gestion des sessions,V7.2.2,"Vérifiez que l'application utilise des jetons autonomes ou de référence générés dynamiquement pour la gestion des sessions, c'est-à-dire sans utiliser de secrets et de clés d'API statiques.",✓,✓,✓,, +V7,Gestion des sessions,V7.2,Sécurité fondamentale de la gestion des sessions,V7.2.3,"Vérifiez que si des jetons par référence sont utilisés pour représenter les sessions utilisateur, ils sont uniques et générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et possèdent au moins 128 bits d'entropie.",✓,✓,✓,, +V7,Gestion des sessions,V7.2,Sécurité fondamentale de la gestion des sessions,V7.2.4,"Vérifiez que l’application génère un nouveau jeton de session lors de l’authentification de l’utilisateur, y compris la réauthentification, et met fin au jeton de session actuel.",✓,✓,✓,, +V7,Gestion des sessions,V7.3,Délai d'expiration de la session,V7.3.1,Vérifiez qu’il existe un délai d’inactivité tel que la réauthentification soit appliquée conformément à l’analyse des risques et aux décisions de sécurité documentées.,,✓,✓,, +V7,Gestion des sessions,V7.3,Délai d'expiration de la session,V7.3.2,Vérifiez qu'il existe une durée de vie maximale absolue de la session de sorte que la réauthentification soit appliquée conformément à l'analyse des risques et aux décisions de sécurité documentées.,,✓,✓,, +V7,Gestion des sessions,V7.4,Fin de session,V7.4.1,"Vérifiez que lorsque la fin de session est déclenchée (par exemple, déconnexion ou expiration), l'application interdit toute utilisation ultérieure de la session. Pour les jetons par référence ou les sessions avec état, cela implique l'invalidation des données de session au niveau du backend de l'application. Les applications utilisant des jetons autonomes nécessiteront une solution, comme la gestion d'une liste des jetons terminés, l'interdiction des jetons produits avant une date et une heure spécifique à chaque utilisateur ou la rotation d'une clé de signature spécifique à chaque utilisateur.",✓,✓,✓,, +V7,Gestion des sessions,V7.4,Fin de session,V7.4.2,"Vérifiez que l'application met fin à toutes les sessions actives lorsqu'un compte utilisateur est désactivé ou supprimé (par exemple, lorsqu'un employé quitte l'entreprise).",✓,✓,✓,, +V7,Gestion des sessions,V7.4,Fin de session,V7.4.3,"Vérifiez que l'application offre la possibilité de mettre fin à toutes les autres sessions actives après une modification ou une suppression réussie de tout facteur d'authentification (y compris la modification du mot de passe via une réinitialisation ou une récupération et, le cas échéant, une mise à jour des paramètres MFA).",,✓,✓,, +V7,Gestion des sessions,V7.4,Fin de session,V7.4.4,Vérifiez que toutes les pages nécessitant une authentification disposent d’un accès facile et visible à la fonctionnalité de déconnexion.,,✓,✓,, +V7,Gestion des sessions,V7.4,Fin de session,V7.4.5,Vérifiez que les administrateurs d’applications sont en mesure de mettre fin aux sessions actives pour un utilisateur individuel ou pour tous les utilisateurs.,,✓,✓,, +V7,Gestion des sessions,V7.5,Défenses contre les abus de session,V7.5.1,"Vérifiez que l'application nécessite une réauthentification complète avant d'autoriser les modifications des attributs de compte sensibles qui peuvent affecter l'authentification, tels que l'adresse e-mail, le numéro de téléphone, la configuration MFA ou d'autres informations utilisées dans la récupération de compte.",,✓,✓,, +V7,Gestion des sessions,V7.5,Défenses contre les abus de session,V7.5.2,Vérifiez que les utilisateurs peuvent afficher et (après s'être authentifiés à nouveau avec au moins un facteur) terminer une ou toutes les sessions actuellement actives.,,✓,✓,, +V7,Gestion des sessions,V7.5,Défenses contre les abus de session,V7.5.3,Vérifiez que l’application nécessite une authentification supplémentaire avec au moins un facteur ou une vérification secondaire avant d’effectuer des transactions ou des opérations hautement sensibles.,,,✓,, +V7,Gestion des sessions,V7.6,Réauthentification fédérée,V7.6.1,"Vérifiez que la durée de vie et la fin de la session entre les parties de confiance (RP) et les fournisseurs d'identité (IdP) se comportent comme documenté, en exigeant une réauthentification si nécessaire, par exemple lorsque le temps maximal entre les événements d'authentification IdP est atteint.",,✓,✓,, +V7,Gestion des sessions,V7.6,Réauthentification fédérée,V7.6.2,"Vérifiez que la création d'une session nécessite soit le consentement de l'utilisateur, soit une action explicite, empêchant ainsi la création de nouvelles sessions d'application sans interaction de l'utilisateur.",,✓,✓,, +V8,Autorisation,V8.1,Documentation d'autorisation,V8.1.1,Vérifiez que la documentation d’autorisation définit des règles de restriction de l’accès au niveau de la fonction et aux données en fonction des autorisations du consommateur et des attributs des ressources.,✓,✓,✓,, +V8,Autorisation,V8.1,Documentation d'autorisation,V8.1.2,"Vérifiez que la documentation d'autorisation définit les règles de restriction d'accès au niveau des champs (lecture et écriture) en fonction des autorisations des consommateurs et des attributs des ressources. Notez que ces règles peuvent dépendre d'autres valeurs d'attributs de l'objet de données concerné, telles que l'état ou le statut.",,✓,✓,, +V8,Autorisation,V8.1,Documentation d'autorisation,V8.1.3,"Vérifiez que la documentation de l'application définit les attributs environnementaux et contextuels (y compris, mais sans s'y limiter, l'heure de la journée, l'emplacement de l'utilisateur, l'adresse IP ou l'appareil) qui sont utilisés dans l'application pour prendre des décisions de sécurité, y compris celles relatives à l'authentification et à l'autorisation.",,,✓,, +V8,Autorisation,V8.1,Documentation d'autorisation,V8.1.4,"Vérifier que la documentation d'authentification et d'autorisation définit l'utilisation des facteurs environnementaux et contextuels dans la prise de décision, en plus des autorisations au niveau des fonctions, des données et des champs. Cela doit inclure les attributs évalués, les seuils de risque et les actions entreprises (par exemple, autorisation, contestation, refus, renforcement de l'authentification).",,,✓,, +V8,Autorisation,V8.2,Conception d'autorisation générale,V8.2.1,Vérifiez que l’application garantit que l’accès basé sur la fonction est limité aux consommateurs disposant d’autorisations explicites.,✓,✓,✓,, +V8,Autorisation,V8.2,Conception d'autorisation générale,V8.2.2,Vérifiez que l'application garantit que l'accès spécifique aux données est limité aux consommateurs disposant d'autorisations explicites sur des éléments de données spécifiques afin d'atténuer les références d'objet directes non sécurisées (IDOR) et les autorisations de niveau d'objet rompues (BOLA).,✓,✓,✓,, +V8,Autorisation,V8.2,Conception d'autorisation générale,V8.2.3,Vérifiez que l'application garantit que l'accès au niveau du champ est limité aux consommateurs disposant d'autorisations explicites sur des champs spécifiques afin d'atténuer les problèmes d'autorisation au niveau de la propriété d'objet (BOPLA).,,✓,✓,, +V8,Autorisation,V8.2,Conception d'autorisation générale,V8.2.4,"Vérifiez que les contrôles de sécurité adaptatifs basés sur les attributs environnementaux et contextuels du consommateur (tels que l'heure, la localisation, l'adresse IP ou l'appareil) sont mis en œuvre pour les décisions d'authentification et d'autorisation, comme défini dans la documentation de l'application. Ces contrôles doivent être appliqués lorsque le consommateur tente de démarrer une nouvelle session et également pendant une session existante.",,,✓,, +V8,Autorisation,V8.3,Autorisation par opération,V8.3.1,"Vérifier que l'application applique les règles d'autorisations au niveau de la couche service de confiance et ne s’appuie pas sur des contrôles qu’un consommateur non approuvé pourrait manipuler, comme JavaScript côté client.",✓,✓,✓,, +V8,Autorisation,V8.3,Autorisation par opération,V8.3.2,"Vérifiez que les modifications apportées aux valeurs sur lesquelles reposent les décisions d'autorisation sont appliquées immédiatement. Lorsque les modifications ne peuvent pas être appliquées immédiatement (par exemple, en s'appuyant sur des données de jetons autonomes), des contrôles d'atténuation doivent être mis en place pour alerter un consommateur lorsqu'il effectue une action alors qu'il n'est plus autorisé à le faire et annuler la modification. Notez que cette solution alternative ne limiterait pas les fuites d'informations.",,,✓,, +V8,Autorisation,V8.3,Autorisation par opération,V8.3.3,"Vérifiez que l'accès à un objet repose sur les autorisations du sujet d'origine (par exemple, le consommateur), et non sur celles d'un intermédiaire ou d'un service agissant en son nom. Par exemple, si un consommateur appelle un service web à l'aide d'un jeton d'authentification autonome, et que ce service demande ensuite des données à un autre service, ce dernier utilisera le jeton du consommateur, plutôt qu'un jeton inter-machine du premier service, pour prendre les décisions d'autorisation.",,,✓,, +V8,Autorisation,V8.4,Autres considérations relatives à l'autorisation,V8.4.1,Vérifiez que les applications multi-tenants utilisent des contrôles inter-tenants pour garantir que les opérations des consommateurs n'affecteront jamais les tenants avec lesquels ils ne sont pas autorisés à interagir.,,✓,✓,, +V8,Autorisation,V8.4,Autres considérations relatives à l'autorisation,V8.4.2,"Vérifiez que l'accès aux interfaces administratives intègre plusieurs couches de sécurité, notamment la vérification continue de l'identité du consommateur, l'évaluation de la posture de sécurité des appareils et l'analyse contextuelle des risques, garantissant que l'emplacement du réseau ou les endpoints approuvés ne sont pas les seuls facteurs d'autorisation, même s'ils peuvent réduire la probabilité d'accès non autorisé.",,,✓,, +V9,Jetons autonomes,V9.1,Source et intégrité du jeton,V9.1.1,Vérifiez que les jetons autonomes sont validés à l'aide de leur signature numérique ou MAC pour les protéger contre toute falsification avant d'accepter le contenu du jeton.,✓,✓,✓,, +V9,Jetons autonomes,V9.1,Source et intégrité du jeton,V9.1.2,"Vérifiez que seuls les algorithmes d'une liste d’autorisations peuvent être utilisés pour créer et vérifier des jetons autonomes, dans un contexte donné. La liste d'autorisation doit inclure les algorithmes autorisés, idéalement symétriques ou asymétriques, et ne doit pas inclure l'algorithme « Aucun ». Si les algorithmes symétriques et asymétriques doivent être pris en charge, des contrôles supplémentaires seront nécessaires pour éviter toute confusion de clés.",✓,✓,✓,, +V9,Jetons autonomes,V9.1,Source et intégrité du jeton,V9.1.3,"Vérifiez que les clés utilisées pour valider les jetons autonomes proviennent de sources préconfigurées et fiables pour l'émetteur du jeton, empêchant ainsi les attaquants de spécifier des sources et des clés non fiables. Pour les JWT et autres structures JWS, les en-têtes tels que « jku », « x5u » et « jwk » doivent être validés par rapport à une liste d'autorisation de sources fiables.",✓,✓,✓,, +V9,Jetons autonomes,V9.2,Contenu du jeton,V9.2.1,"Vérifiez que, si une période de validité est indiquée dans les données du jeton, celui-ci et son contenu ne sont acceptés que si la date de vérification est comprise dans cette période. Par exemple, pour les JWT, les déclarations « nbf » et « exp » doivent être vérifiées.",✓,✓,✓,, +V9,Jetons autonomes,V9.2,Contenu du jeton,V9.2.2,"Vérifiez que le service recevant un jeton valide le type de jeton et son utilisation avant d'en accepter le contenu. Par exemple, seuls les jetons d'accès peuvent être acceptés pour les décisions d'autorisation, et seuls les jetons d'identification peuvent être utilisés pour prouver l'authentification des utilisateurs.",,✓,✓,, +V9,Jetons autonomes,V9.2,Contenu du jeton,V9.2.3,"Vérifiez que le service accepte uniquement les jetons destinés à être utilisés avec ce service (audience). Pour les JWT, cela peut être réalisé en validant la déclaration « aud » par rapport à une liste d'autorisation définie dans le service.",,✓,✓,, +V9,Jetons autonomes,V9.2,Contenu du jeton,V9.2.4,"Si un émetteur de jetons utilise la même clé privée pour émettre des jetons destinés à différentes audiences, vérifiez que les jetons émis contiennent une restriction d'audience identifiant de manière unique les audiences visées. Cela empêchera la réutilisation d'un jeton avec une audience non prévue. Si l'identifiant d'audience est provisionné dynamiquement, l'émetteur de jetons doit valider ces audiences afin de garantir qu'elles n'entraînent pas d'usurpation d'identité.",,✓,✓,, +V10,Oauth et OIDC,V10.1,Sécurité générique OAuth et OIDC,V10.1.1,"Vérifiez que les jetons sont envoyés uniquement aux composants qui en ont absolument besoin. Par exemple, lors de l'utilisation d'un modèle backend-for-frontend pour les applications JavaScript basées sur un navigateur, les jetons d'accès et d'actualisation ne doivent être accessibles qu'au backend.",,✓,✓,, +V10,Oauth et OIDC,V10.1,Sécurité générique OAuth et OIDC,V10.1.2,"Vérifiez que le client n'accepte les valeurs du serveur d'autorisation (telles que le code d'autorisation ou le jeton d'identification) que si elles résultent d'un flux d'autorisation initié par la même session d'agent utilisateur et la même transaction. Cela nécessite que les secrets générés par le client, tels que la clé de preuve pour l'échange de codes (PKCE) « code_verifier », « state » ou le nonce OIDC, ne puissent être devinés, soient spécifiques à la transaction et soient liés de manière sécurisée au client et à la session d'agent utilisateur au cours de laquelle la transaction a été initiée.",,✓,✓,, +V10,Oauth et OIDC,V10.2,Client OAuth,V10.2.1,"Vérifiez que, si le flux de code est utilisé, le client OAuth dispose d'une protection contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF), qui déclenchent des demandes de jetons, soit en utilisant la fonctionnalité de clé de preuve pour l'échange de code (PKCE), soit en vérifiant le paramètre « state » envoyé dans la demande d'autorisation.",,✓,✓,, +V10,Oauth et OIDC,V10.2,Client OAuth,V10.2.2,"Vérifiez que, si le client OAuth peut interagir avec plusieurs serveurs d'autorisation, il dispose d'une protection contre les attaques par confusion. Par exemple, il peut exiger que le serveur d'autorisation renvoie la valeur du paramètre « iss » et la valide dans la réponse d'autorisation et la réponse du jeton.",,✓,✓,, +V10,Oauth et OIDC,V10.2,Client OAuth,V10.2.3,Vérifiez que le client OAuth demande uniquement les portées requises (ou d’autres paramètres d’autorisation) dans les requêtes adressées au serveur d’autorisation.,,,✓,, +V10,Oauth et OIDC,V10.3,Serveur de ressources OAuth,V10.3.1,Vérifiez que le serveur de ressources accepte uniquement les jetons d'accès destinés à être utilisés avec ce service (audience). L'audience peut être incluse dans un jeton d'accès structuré (comme la déclaration « aud » dans JWT) ou vérifiée à l'aide du endpoint d'introspection de jeton.,,✓,✓,, +V10,Oauth et OIDC,V10.3,Serveur de ressources OAuth,V10.3.2,"Vérifiez que le serveur de ressources applique les décisions d'autorisation en fonction des déclarations du jeton d'accès définissant l'autorisation déléguée. Si des déclarations telles que « sub », « scope » et « authorization_details » sont présentes, elles doivent être prises en compte dans la décision.",,✓,✓,, +V10,Oauth et OIDC,V10.3,Serveur de ressources OAuth,V10.3.3,"Vérifiez que si une décision de contrôle d'accès nécessite l'identification d'un utilisateur unique à partir d'un jeton d'accès (JWT ou réponse d'introspection de jeton associé), le serveur de ressources identifie l'utilisateur à partir de déclarations non ré attribuables à d'autres utilisateurs. En général, cela implique l'utilisation d'une combinaison de déclarations « iss » et « sub ».",,✓,✓,, +V10,Oauth et OIDC,V10.3,Serveur de ressources OAuth,V10.3.4,"Si le serveur de ressources requiert une force d'authentification, des méthodes ou une date d'expiration spécifiques, vérifiez que le jeton d'accès présenté respecte ces contraintes. Par exemple, s'il est présent, utilisez les déclarations OIDC « acr », « amr » et « auth_time » respectivement.",,✓,✓,, +V10,Oauth et OIDC,V10.3,Serveur de ressources OAuth,V10.3.5,"Vérifiez que le serveur de ressources empêche l'utilisation de jetons d'accès volés ou la relecture de jetons d'accès (de parties non autorisées) en exigeant des jetons d'accès limités par l'expéditeur, soit Mutual TLS pour OAuth 2, soit OAuth 2 Demonstration of Proof of Possession (DPoP).",,,✓,, +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.1,Vérifiez que le serveur d'autorisation valide les URI de redirection en fonction d'une liste d'autorisation spécifique au client d'URI préenregistrés à l'aide d'une comparaison de chaînes exacte.,✓,✓,✓,, +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.2,"Vérifiez que, si le serveur d'autorisation renvoie le code d'autorisation dans la réponse, celui-ci ne peut être utilisé qu'une seule fois pour une demande de jeton. Pour la deuxième demande valide avec un code d'autorisation déjà utilisé pour émettre un jeton d'accès, le serveur d'autorisation doit rejeter la demande de jeton et révoquer tous les jetons émis liés au code d'autorisation.",✓,✓,✓,, +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.3,Vérifiez que le code d'autorisation est de courte durée. La durée de vie maximale peut atteindre 10 minutes pour les applications L1 et L2 et 1 minute pour les applications L3.,✓,✓,✓,, +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.4,"Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement l'utilisation des autorisations nécessaires à ce client. Notez que les autorisations « token » (flux implicite) et « password » (flux d'informations d'identification du propriétaire de la ressource) ne doivent plus être utilisées.",✓,✓,✓,, +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.5,"Vérifiez que le serveur d'autorisation atténue les attaques par rejeu de jetons d'actualisation pour les clients publics, de préférence en utilisant des jetons d'actualisation limités par l'expéditeur, par exemple des jetons DPoP (Demonstrating Proof of Possession) ou des jetons d'accès liés à un certificat utilisant le protocole TLS mutuel (mTLS). Pour les applications L1 et L2, la rotation des jetons d'actualisation peut être utilisée. Si cette rotation est utilisée, le serveur d'autorisation doit invalider le jeton d'actualisation après utilisation et révoquer tous les jetons d'actualisation de cette autorisation si un jeton d'actualisation déjà utilisé et invalidé est fourni.",✓,✓,✓,, +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.6,"Vérifiez que, si l'octroi de code est utilisé, le serveur d'autorisation atténue les attaques par interception de code en exigeant une clé de preuve pour l'échange de code (PKCE). Pour les demandes d'autorisation, le serveur d'autorisation doit exiger une valeur « code_challenge » valide et ne doit pas accepter une valeur « plain » pour « code_challenge_method ». Pour une demande de jeton, il doit exiger la validation du paramètre « code_verifier ».",,✓,✓,, +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.7,"Vérifiez que si le serveur d'autorisation prend en charge l'enregistrement dynamique des clients non authentifiés, il réduit le risque d'applications clientes malveillantes. Il doit valider les métadonnées clientes, telles que les URI enregistrés, garantir le consentement de l'utilisateur et l'avertir avant de traiter une demande d'autorisation avec une application cliente non approuvée.",,✓,✓,, +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.8,"Vérifiez que les jetons d’actualisation ont une expiration absolue, y compris si l’expiration du jeton d’actualisation glissant est appliquée.",,✓,✓,, +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.9,"Vérifiez que les jetons d'actualisation et les jetons d'accès de référence peuvent être révoqués par un utilisateur autorisé à l'aide de l'interface utilisateur du serveur d'autorisation, afin d'atténuer le risque de clients malveillants ou de jetons volés.",,✓,✓,, +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.10,"Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.",,✓,✓,, +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.11,"Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.",,✓,✓,, +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.12,"Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement la valeur « response_mode » dont ce client a besoin. Par exemple, en vérifiant cette valeur par rapport aux valeurs attendues ou en utilisant une requête d'autorisation poussée (PAR) ou une requête d'autorisation sécurisée par JWT (JAR).",,,✓,, +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.13,Vérifiez que le type d'Autorisation « code » est toujours utilisé avec les demandes d'autorisation poussées (PAR).,,,✓,, +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.14,"Vérifiez que le serveur d'autorisation émet uniquement des jetons d'accès limités à l'expéditeur (preuve de possession), soit avec des jetons d'accès liés au certificat utilisant TLS mutuel (mTLS), soit avec des jetons d'accès liés au DPoP (démonstration de preuve de possession).",,,✓,, +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.15,"Vérifiez que, pour un client côté serveur (non exécuté sur l'appareil de l'utilisateur final), le serveur d'autorisation garantit que la valeur du paramètre « authorization_details » provient du backend client et que l'utilisateur ne l'a pas altérée. Par exemple, en exigeant l'utilisation d'une demande d'autorisation poussée (PAR) ou d'une demande d'autorisation sécurisée par JWT (JAR).",,,✓,, +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.16,"Vérifiez que le client est confidentiel et que le serveur d'autorisation requiert l'utilisation de méthodes d'authentification client fortes (basées sur la cryptographie à clé publique et résistantes aux attaques par relecture), telles que TLS mutuel ('tls_client_auth', 'self_signed_tls_client_auth') ou JWT à clé privée ('private_key_jwt').",,,✓,, +V10,Oauth et OIDC,V10.5,Client OIDC,V10.5.1,"Vérifiez que le client (en tant que partie utilisatrice) atténue les attaques par rejeu de jeton d'identification. Par exemple, en vous assurant que la valeur « nonce » du jeton d'identification correspond à la valeur « nonce » envoyée dans la demande d'authentification au fournisseur OpenID (appelée demande d'autorisation envoyée au serveur d'autorisation dans OAuth2).",,✓,✓,, +V10,Oauth et OIDC,V10.5,Client OIDC,V10.5.2,"Vérifiez que le client identifie de manière unique l'utilisateur à partir des déclarations de jeton d'identification, généralement la déclaration « sub », qui ne peut pas être réaffectée à d'autres utilisateurs (pour la portée d'un fournisseur d'identité).",,✓,✓,, +V10,Oauth et OIDC,V10.5,Client OIDC,V10.5.3,Vérifiez que le client rejette les tentatives d'un serveur d'autorisation malveillant d'usurper l'identité d'un autre serveur d'autorisation via ses métadonnées. Le client doit rejeter les métadonnées du serveur d'autorisation si l'URL de l'émetteur figurant dans ces métadonnées ne correspond pas exactement à l'URL d'émetteur préconfigurée attendue par le client.,,✓,✓,, +V10,Oauth et OIDC,V10.5,Client OIDC,V10.5.4,Vérifiez que le client valide que le jeton d'identification est destiné à être utilisé pour ce client (audience) en vérifiant que la déclaration « aud » du jeton est égale à la valeur « client_id » pour le client.,,✓,✓,, +V10,Oauth et OIDC,V10.5,Client OIDC,V10.5.5,"Vérifiez que, lors de l'utilisation de la déconnexion du back-channel OIDC, la partie utilisatrice atténue les risques de déni de service liés à la déconnexion forcée et à la confusion entre JWT dans le flux de déconnexion. Le client doit vérifier que le jeton de déconnexion est correctement typé avec la valeur « logout+jwt », qu'il contient la déclaration « event » avec le nom de membre correct et qu'il ne contient pas de déclaration « nonce ». Il est également recommandé d'utiliser une expiration courte (par exemple, 2 minutes).",,✓,✓,, +V10,Oauth et OIDC,V10.6,Fournisseur OpenID,V10.6.1,"Vérifiez que le fournisseur OpenID n'autorise que les valeurs « code », « ciba », « id_token » ou « id_token code » pour le mode de réponse. Notez que « code » est préférable à « id_token code » (flux hybride OIDC) et que « token » (tout flux implicite) ne doit pas être utilisé.",,✓,✓,, +V10,Oauth et OIDC,V10.6,Fournisseur OpenID,V10.6.2,"Vérifiez que le fournisseur OpenID atténue les risques de déni de service liés à la déconnexion forcée. Pour ce faire, obtenez une confirmation explicite de l'utilisateur final ou, le cas échéant, validez les paramètres de la requête de déconnexion (initiée par la partie utilisatrice), comme « id_token_hint ».",,✓,✓,, +V10,Oauth et OIDC,V10.7,Gestion du consentement,V10.7.1,"Vérifiez que le serveur d'autorisation garantit le consentement de l'utilisateur à chaque demande d'autorisation. Si l'identité du client ne peut être garantie, le serveur d'autorisation doit toujours demander explicitement le consentement de l'utilisateur.",,✓,✓,, +V10,Oauth et OIDC,V10.7,Gestion du consentement,V10.7.2,"Vérifiez que lorsque le serveur d'autorisation demande le consentement de l'utilisateur, il fournit des informations claires et suffisantes sur ce qui est consenti. Le cas échéant, ces informations doivent inclure la nature des autorisations demandées (généralement en fonction de la portée, du serveur de ressources et des détails d'autorisation RAR), l'identité de l'application autorisée et la durée de vie de ces autorisations.",,✓,✓,, +V10,Oauth et OIDC,V10.7,Gestion du consentement,V10.7.3,"Vérifiez que l’utilisateur peut consulter, modifier et révoquer les consentements qu’il a accordés via le serveur d’autorisation.",,✓,✓,, +V11,Cryptographie,V11.1,Inventaire et documentation cryptographiques,V11.1.1,"Vérifiez qu’il existe une politique documentée pour la gestion des clés cryptographiques et un cycle de vie des clés cryptographiques qui suit une norme de gestion des clés telle que NIST SP 800-57. Cela devrait inclure la garantie que les clés ne sont pas sur-partagées (par exemple, avec plus de deux entités pour les secrets partagés et plus d’une entité pour les clés privées).",,✓,✓,, +V11,Cryptographie,V11.1,Inventaire et documentation cryptographiques,V11.1.2,"Vérifiez qu'un inventaire cryptographique est réalisé, maintenu et régulièrement mis à jour, et qu'il inclut toutes les clés, algorithmes et certificats cryptographiques utilisés par l'application. Il doit également documenter les emplacements du système où les clés peuvent ou non être utilisées, ainsi que les types de données qui peuvent ou non être protégées par ces clés.",,✓,✓,, +V11,Cryptographie,V11.1,Inventaire et documentation cryptographiques,V11.1.3,"Vérifiez que les mécanismes de découverte cryptographique sont utilisés pour identifier toutes les instances de cryptographie dans le système, y compris les opérations de chiffrement, de hachage et de signature.",,,✓,, +V11,Cryptographie,V11.1,Inventaire et documentation cryptographiques,V11.1.4,"Vérifier la tenue d'un inventaire cryptographique. Celui-ci doit inclure un plan documenté décrivant la migration vers de nouvelles normes cryptographiques, telles que la cryptographie post-quantique, afin de réagir aux menaces futures.",,,✓,, +V11,Cryptographie,V11.2,Mise en œuvre sécurisée de la cryptographie,V11.2.1,Vérifiez que les implémentations validées par l’industrie (y compris les bibliothèques et les implémentations accélérées par le matériel) sont utilisées pour les opérations cryptographiques.,,✓,✓,, +V11,Cryptographie,V11.2,Mise en œuvre sécurisée de la cryptographie,V11.2.2,"Vérifiez que l'application est conçue avec une agilité cryptographique, de sorte que les nombres aléatoires, le chiffrement authentifié, le MAC ou les algorithmes de hachage, les longueurs de clés, les tours, les chiffrements et les modes puissent être reconfigurés, mis à niveau ou échangés à tout moment, afin de se protéger contre les failles cryptographiques. De même, il doit être possible de remplacer les clés et les mots de passe, ainsi que de rechiffrer les données. Cela permettra des mises à niveau transparentes vers la cryptographie post-quantique (PQC), une fois que des implémentations hautement sécurisées de schémas ou de normes PQC approuvés seront largement disponibles.",,✓,✓,, +V11,Cryptographie,V11.2,Mise en œuvre sécurisée de la cryptographie,V11.2.3,"Vérifiez que toutes les primitives cryptographiques utilisent un minimum de 128 bits de sécurité en fonction de l'algorithme, de la taille de la clé et de la configuration. Par exemple, une clé ECC de 256 bits offre environ 128 bits de sécurité, tandis que RSA nécessite une clé de 3072 bits pour atteindre 128 bits de sécurité.",,✓,✓,, +V11,Cryptographie,V11.2,Mise en œuvre sécurisée de la cryptographie,V11.2.4,"Vérifiez que toutes les opérations cryptographiques sont à temps constant, sans opérations de « court-circuit » dans les comparaisons, les calculs ou les retours, pour éviter toute fuite d'informations.",,,✓,, +V11,Cryptographie,V11.2,Mise en œuvre sécurisée de la cryptographie,V11.2.5,"Vérifiez que tous les modules cryptographiques échouent en toute sécurité et que les erreurs sont gérées de manière à ne pas permettre de vulnérabilités, telles que les attaques Padding Oracle.",,,✓,, +V11,Cryptographie,V11.3,Algorithmes de chiffrement,V11.3.1,"Vérifiez que les modes de bloc non sécurisés (par exemple, ECB) et les schémas de remplissage faibles (par exemple, PKCS#1 v1.5) ne sont pas utilisés.",✓,✓,✓,, +V11,Cryptographie,V11.3,Algorithmes de chiffrement,V11.3.2,Vérifiez que seuls les chiffrements et modes approuvés tels que AES avec GCM sont utilisés.,✓,✓,✓,, +V11,Cryptographie,V11.3,Algorithmes de chiffrement,V11.3.3,"Vérifiez que les données chiffrées sont protégées contre toute modification non autorisée, de préférence en utilisant une méthode de chiffrement authentifiée approuvée ou en combinant une méthode de chiffrement approuvée avec un algorithme MAC approuvé.",,✓,✓,, +V11,Cryptographie,V11.3,Algorithmes de chiffrement,V11.3.4,"Vérifiez que les nonces, les vecteurs d'initialisation et autres nombres à usage unique ne sont pas utilisés pour plus d'une paire clé de chiffrement/élément de données. La méthode de génération doit être adaptée à l'algorithme utilisé.",,,✓,, +V11,Cryptographie,V11.3,Algorithmes de chiffrement,V11.3.5,Vérifiez que toute combinaison d'un algorithme de chiffrement et d'un algorithme MAC fonctionne en mode chiffrement puis MAC.,,,✓,, +V11,Cryptographie,V11.4,Hachage et fonctions basées sur le hachage,V11.4.1,"Vérifiez que seules les fonctions de hachage approuvées sont utilisées pour les cas d'utilisation cryptographiques généraux, notamment les signatures numériques, HMAC, KDF et la génération de bits aléatoires. Les fonctions de hachage non autorisées, telles que MD5, ne doivent pas être utilisées à des fins cryptographiques.",✓,✓,✓,, +V11,Cryptographie,V11.4,Hachage et fonctions basées sur le hachage,V11.4.2,"Vérifiez que les mots de passe sont stockés à l'aide d'une fonction de dérivation de clés approuvée et gourmande en ressources de calcul (également appelée « fonction de hachage de mots de passe »), dont les paramètres sont configurés conformément aux directives en vigueur. Ces paramètres doivent équilibrer sécurité et performances afin de rendre les attaques par force brute suffisamment difficiles pour le niveau de sécurité requis.",,✓,✓,, +V11,Cryptographie,V11.4,Hachage et fonctions basées sur le hachage,V11.4.3,"Vérifiez que les fonctions de hachage utilisées dans les signatures numériques, dans le cadre de l'authentification ou de l'intégrité des données, sont résistantes aux collisions et possèdent des longueurs de bits appropriées. Si la résistance aux collisions est requise, la longueur de sortie doit être d'au moins 256 bits. Si seule la résistance aux attaques de seconde pré-image est requise, la longueur de sortie doit être d'au moins 128 bits.",,✓,✓,, +V11,Cryptographie,V11.4,Hachage et fonctions basées sur le hachage,V11.4.4,Vérifiez que l'application utilise des fonctions de dérivation de clés approuvées avec des paramètres d'extension de clés lors de la dérivation de clés secrètes à partir de mots de passe. Les paramètres utilisés doivent concilier sécurité et performances afin d'empêcher les attaques par force brute de compromettre la clé cryptographique obtenue.,,✓,✓,, +V11,Cryptographie,V11.5,Valeurs aléatoires,V11.5.1,Vérifiez que tous les nombres et chaînes aléatoires destinés à être non devinables doivent être générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et posséder au moins 128 bits d'entropie. Notez que les UUID ne respectent pas cette condition.,,✓,✓,, +V11,Cryptographie,V11.5,Valeurs aléatoires,V11.5.2,"Vérifiez que le mécanisme de génération de nombres aléatoires utilisé est conçu pour fonctionner en toute sécurité, même en cas de forte demande.",,,✓,, +V11,Cryptographie,V11.6,Cryptographie à clé publique,V11.6.1,"Vérifier que seuls des algorithmes cryptographiques et des modes opératoires approuvés sont utilisés pour la génération et l'amorçage des clés, ainsi que pour la génération et la vérification des signatures numériques. Les algorithmes de génération de clés ne doivent pas générer de clés non sécurisées et vulnérables aux attaques connues, par exemple les clés RSA vulnérables à la factorisation de Fermat.",,✓,✓,, +V11,Cryptographie,V11.6,Cryptographie à clé publique,V11.6.2,"Vérifiez que des algorithmes cryptographiques approuvés sont utilisés pour l'échange de clés (tels que Diffie-Hellman), en veillant à ce que les mécanismes d'échange de clés utilisent des paramètres sécurisés. Cela permettra d'éviter les attaques contre le processus d'établissement des clés, susceptibles de conduire à des attaques de type « adversaire du milieu » ou à des failles cryptographiques.",,,✓,, +V11,Cryptographie,V11.7,Cryptographie des données en cours d'utilisation,V11.7.1,"Vérifiez que le chiffrement complet de la mémoire est utilisé pour protéger les données sensibles pendant leur utilisation, empêchant ainsi l'accès par des utilisateurs ou des processus non autorisés.",,,✓,, +V11,Cryptographie,V11.7,Cryptographie des données en cours d'utilisation,V11.7.2,Vérifiez que la minimisation des données garantit que la quantité minimale de données est exposée pendant le traitement et assurez-vous que les données sont chiffrées immédiatement après utilisation ou dès que possible.,,,✓,, +V12,Communication sécurisée,V12.1,Conseils généraux de sécurité TLS,V12.1.1,"Vérifiez que seules les dernières versions recommandées du protocole TLS sont activées, telles que TLS 1.2 et TLS 1.3. La dernière version du protocole TLS doit être privilégiée.",✓,✓,✓,, +V12,Communication sécurisée,V12.1,Conseils généraux de sécurité TLS,V12.1.2,"Vérifiez que seules les suites de chiffrement recommandées sont activées, les suites de chiffrement les plus puissantes étant définies comme préférées. Les applications L3 doivent uniquement prendre en charge les suites de chiffrement assurant la confidentialité persistante (forward secrecy).",,✓,✓,, +V12,Communication sécurisée,V12.1,Conseils généraux de sécurité TLS,V12.1.3,Vérifiez que l’application valide que les certificats clients mTLS sont approuvés avant d’utiliser l’identité du certificat pour l’authentification ou l’autorisation.,,✓,✓,, +V12,Communication sécurisée,V12.1,Conseils généraux de sécurité TLS,V12.1.4,"Vérifiez que la révocation de certification appropriée, telle que l'agrafage du protocole OCSP (Online Certificate Status Protocol), est activée et configurée.",,,✓,, +V12,Communication sécurisée,V12.1,Conseils généraux de sécurité TLS,V12.1.5,"Vérifiez que Encrypted Client Hello (ECH) est activé dans les paramètres TLS de l'application pour empêcher l'exposition de métadonnées sensibles, telles que l'indication du nom du serveur (SNI), pendant les processus de négociation TLS.",,,✓,, +V12,Communication sécurisée,V12.2,Communication HTTPS avec des services externes,V12.2.1,"Vérifiez que TLS est utilisé pour toute connectivité entre un client et des services externes basés sur HTTP, et ne recourt pas à des communications non sécurisées ou non chiffrées.",✓,✓,✓,, +V12,Communication sécurisée,V12.2,Communication HTTPS avec des services externes,V12.2.2,Vérifiez que les services externes utilisent des certificats TLS publiquement approuvés.,✓,✓,✓,, +V12,Communication sécurisée,V12.3,Sécurité des communications entre services généraux,V12.3.1,"Vérifiez qu'un protocole chiffré tel que TLS est utilisé pour toutes les connexions entrantes et sortantes vers et depuis l'application, y compris les systèmes de surveillance, les outils de gestion, l'accès à distance et SSH, les intergiciels, les bases de données, les mainframes, les systèmes partenaires ou les API externes. Le serveur ne doit pas recourir à des protocoles non sécurisés ou non chiffrés.",,✓,✓,, +V12,Communication sécurisée,V12.3,Sécurité des communications entre services généraux,V12.3.2,Vérifiez que les clients TLS valident les certificats reçus avant de communiquer avec un serveur TLS.,,✓,✓,, +V12,Communication sécurisée,V12.3,Sécurité des communications entre services généraux,V12.3.3,Vérifiez que TLS ou un autre mécanisme de chiffrement de transport approprié est utilisé pour toute connectivité entre les services internes basés sur HTTP au sein de l'application et ne se replie pas vers des communications non sécurisées ou non chiffrées.,,✓,✓,, +V12,Communication sécurisée,V12.3,Sécurité des communications entre services généraux,V12.3.4,"Vérifiez que les connexions TLS entre les services internes utilisent des certificats de confiance. Lorsque des certificats générés en interne ou auto-signés sont utilisés, le service consommateur doit être configuré pour n'approuver que des autorités de certification internes spécifiques et des certificats auto-signés spécifiques.",,✓,✓,, +V12,Communication sécurisée,V12.3,Sécurité des communications entre services généraux,V12.3.5,"Vérifiez que les services communiquant en interne au sein d'un système (communications intra-services) utilisent une authentification forte pour garantir la vérification de chaque endpoint. Des méthodes d'authentification forte, telles que l'authentification client TLS, doivent être utilisées pour garantir l'identité, en utilisant une infrastructure à clé publique et des mécanismes résistants aux attaques par rejeu. Pour les architectures de microservices, envisagez d'utiliser un maillage de services pour simplifier la gestion des certificats et renforcer la sécurité.",,,✓,, +V13,Configuration,V13.1,Documentation de configuration,V13.1.1,Vérifiez que tous les besoins de communication de l'application sont documentés. Cela doit inclure les services externes dont l'application dépend et les cas où un utilisateur final pourrait fournir un emplacement externe auquel l'application se connectera.,,✓,✓,, +V13,Configuration,V13.1,Documentation de configuration,V13.1.2,"Vérifiez que pour chaque service utilisé par l'application, la documentation définit le nombre maximal de connexions simultanées (par exemple, les limites du pool de connexions) et le comportement de l'application lorsque cette limite est atteinte, y compris les mécanismes de secours ou de récupération, pour éviter les conditions de déni de service.",,,✓,, +V13,Configuration,V13.1,Documentation de configuration,V13.1.3,"Vérifiez que la documentation de l'application définit des stratégies de gestion des ressources pour chaque système ou service externe utilisé (par exemple, bases de données, descripteurs de fichiers, threads, connexions HTTP). Cela doit inclure les procédures de libération des ressources, les paramètres de délai d'expiration, la gestion des échecs et l'implémentation de la logique de nouvelle tentative, en spécifiant les limites de nouvelle tentative, les délais et les algorithmes de retour arrière. Pour les opérations de requête-réponse HTTP synchrones, la documentation doit imposer des délais d'expiration courts et soit désactiver les nouvelles tentatives, soit les limiter strictement afin d'éviter les retards en cascade et l'épuisement des ressources.",,,✓,, +V13,Configuration,V13.1,Documentation de configuration,V13.1.4,"Vérifiez que la documentation de l'application définit les secrets essentiels à la sécurité de l'application et un calendrier de rotation de ceux-ci, en fonction du modèle de menace et des exigences commerciales de l'organisation.",,,✓,, +V13,Configuration,V13.2,Configuration de la communication backend,V13.2.1,"Vérifiez que les communications entre les composants de l'application backend qui ne prennent pas en charge le mécanisme de session utilisateur standard de l'application, notamment les API, les intergiciels et les couches de données, sont authentifiées. L'authentification doit utiliser des comptes de service individuels, des jetons à court terme ou une authentification par certificat, et non des identifiants immuables tels que des mots de passe, des clés API ou des comptes partagés avec accès privilégié.",,✓,✓,, +V13,Configuration,V13.2,Configuration de la communication backend,V13.2.2,"Vérifiez que les communications entre les composants de l'application backend, y compris les services locaux ou du système d'exploitation, les API, les intergiciels et les couches de données, sont effectuées avec des comptes dotés des privilèges les moins nécessaires.",,✓,✓,, +V13,Configuration,V13.2,Configuration de la communication backend,V13.2.3,"Vérifiez que si des informations d’identification doivent être utilisées pour l’authentification du service, les informations d’identification utilisées par le consommateur ne sont pas des informations d’identification par défaut (par exemple, root/root ou admin/admin).",,✓,✓,, +V13,Configuration,V13.2,Configuration de la communication backend,V13.2.4,"Vérifiez qu'une liste d’autorisations est utilisée pour définir les ressources ou systèmes externes avec lesquels l'application est autorisée à communiquer (par exemple, pour les requêtes sortantes, les chargements de données ou l'accès aux fichiers). Cette liste d'autorisation peut être implémentée au niveau de la couche applicative, du serveur web, du pare-feu ou d'une combinaison de différentes couches.",,✓,✓,, +V13,Configuration,V13.2,Configuration de la communication backend,V13.2.5,Vérifiez que le serveur Web ou d’application est configuré avec une liste autorisée de ressources ou de systèmes vers lesquels le serveur peut envoyer des requêtes ou charger des données ou des fichiers.,,✓,✓,, +V13,Configuration,V13.2,Configuration de la communication backend,V13.2.6,"Vérifiez que lorsque l'application se connecte à des services distincts, elle suit la configuration documentée pour chaque connexion, comme le nombre maximal de connexions parallèles, le comportement lorsque le nombre maximal de connexions autorisées est atteint, les délais d'expiration de connexion et les stratégies de nouvelle tentative.",,,✓,, +V13,Configuration,V13.3,Gestion des secrets,V13.3.1,"Vérifiez qu'une solution de gestion des secrets, telle qu'un coffre-fort de clés, est utilisée pour créer, stocker, contrôler l'accès et détruire en toute sécurité les secrets backend. Ceux-ci peuvent inclure des mots de passe, du matériel de clé, des intégrations avec des bases de données et des systèmes tiers, des clés et des graines pour des jetons temporels, d'autres secrets internes et des clés API. Les secrets ne doivent pas être inclus dans le code source de l'application ni dans les artefacts de build. Pour une application L3, cela doit impliquer une solution matérielle telle qu'un HSM.",,✓,✓,, +V13,Configuration,V13.3,Gestion des secrets,V13.3.2,Vérifiez que l’accès aux ressources secrètes respecte le principe du moindre privilège.,,✓,✓,, +V13,Configuration,V13.3,Gestion des secrets,V13.3.3,Vérifiez que toutes les opérations cryptographiques sont effectuées à l'aide d'un module de sécurité isolé (tel qu'un coffre-fort ou un module de sécurité matériel) pour gérer et protéger en toute sécurité le matériel clé contre toute exposition en dehors du module de sécurité.,,,✓,, +V13,Configuration,V13.3,Gestion des secrets,V13.3.4,Vérifiez que les secrets sont configurés pour expirer et être renouvelés en fonction de la documentation de l'application.,,,✓,, +V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.1,"Vérifiez que l'application est déployée soit sans aucune métadonnée de contrôle de source, y compris les dossiers .git ou .svn, soit de manière à ce que ces dossiers soient inaccessibles à la fois en externe et à l'application elle-même.",✓,✓,✓,, +V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.2,Vérifiez que les modes de débogage sont désactivés pour tous les composants dans les environnements de production afin d’éviter l’exposition des fonctionnalités de débogage et la fuite d’informations.,,✓,✓,, +V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.3,"Vérifiez que les serveurs Web n’exposent pas les listes de répertoires aux clients, sauf si cela est explicitement prévu.",,✓,✓,, +V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.4,"Vérifiez que l’utilisation de la méthode HTTP TRACE n’est pas prise en charge dans les environnements de production, afin d’éviter toute fuite d’informations potentielle.",,✓,✓,, +V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.5,"Vérifiez que la documentation (comme pour les API internes) et les endpoints de surveillance ne sont pas exposés, sauf si cela est explicitement prévu.",,✓,✓,, +V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.6,Vérifiez que l’application n’expose pas d’informations de version détaillées des composants backend.,,,✓,, +V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.7,"Vérifiez que la couche web est configuré pour servir uniquement les fichiers avec des extensions de fichier spécifiques afin d’éviter toute fuite involontaire d’informations, de configuration et de code source.",,,✓,, +V14,Protection des données,V14.1,Documentation sur la protection des données,V14.1.1,"Vérifiez que toutes les données sensibles créées et traitées par l'application ont été identifiées et classées selon leur niveau de protection. Cela inclut les données uniquement codées et donc facilement déchiffrables, telles que les chaînes Base64 ou la charge utile en texte clair d'un JWT. Les niveaux de protection doivent tenir compte des réglementations et normes de protection des données et de confidentialité auxquelles l'application est tenue de se conformer.",,✓,✓,, +V14,Protection des données,V14.1,Documentation sur la protection des données,V14.1.2,"Vérifier que tous les niveaux de protection des données sensibles sont assortis d'un ensemble documenté d'exigences de protection. Cela doit inclure (sans s'y limiter) les exigences relatives au chiffrement général, à la vérification de l'intégrité, à la conservation, à la journalisation des données, aux contrôles d'accès aux données sensibles dans les journaux, au chiffrement au niveau de la base de données, aux technologies de confidentialité et de renforcement de la confidentialité à utiliser, ainsi qu'aux autres exigences de confidentialité.",,✓,✓,, +V14,Protection des données,V14.2,Protection générale des données,V14.2.1,"Vérifiez que les données sensibles sont uniquement envoyées au serveur dans les champs de corps ou d’en-tête du message HTTP, et que l’URL et la chaîne de requête ne contiennent pas d’informations sensibles, telles qu’une clé API ou un jeton de session.",✓,✓,✓,, +V14,Protection des données,V14.2,Protection générale des données,V14.2.2,"Vérifiez que l’application empêche la mise en cache des données sensibles dans les composants du serveur, tels que les équilibreurs de charge et les caches d’application, ou garantit que les données sont purgées en toute sécurité après utilisation.",,✓,✓,, +V14,Protection des données,V14.2,Protection générale des données,V14.2.3,"Vérifiez que les données sensibles définies ne sont pas envoyées à des parties non fiables (par exemple, des trackers d'utilisateurs) pour empêcher la collecte indésirable de données en dehors du contrôle de l'application.",,✓,✓,, +V14,Protection des données,V14.2,Protection générale des données,V14.2.4,"Vérifiez que les contrôles autour des données sensibles liés au chiffrement, à la vérification de l'intégrité, à la conservation, à la manière dont les données doivent être enregistrées, aux contrôles d'accès autour des données sensibles dans les journaux, à la confidentialité et aux technologies d'amélioration de la confidentialité, sont mis en œuvre comme défini dans la documentation pour le niveau de protection des données spécifiques.",,✓,✓,, +V14,Protection des données,V14.2,Protection générale des données,V14.2.5,Vérifiez que les mécanismes de mise en cache sont configurés pour ne mettre en cache que les réponses dont le type de contenu est conforme à la ressource et qui ne contiennent pas de contenu sensible et dynamique. Le serveur web doit renvoyer une réponse 404 ou 302 lors de l'accès à un fichier inexistant plutôt qu'un fichier valide différent. Cela devrait empêcher les attaques par empoisonnement de cache web.,,,✓,, +V14,Protection des données,V14.2,Protection générale des données,V14.2.6,"Vérifiez que l'application ne renvoie que les données sensibles minimales requises pour son fonctionnement. Par exemple, ne renvoyez que certains chiffres d'un numéro de carte de crédit, et non le numéro complet. Si les données complètes sont requises, elles doivent être masquées dans l'interface utilisateur, sauf si l'utilisateur les consulte spécifiquement.",,,✓,, +V14,Protection des données,V14.2,Protection générale des données,V14.2.7,"Vérifiez que les informations sensibles sont soumises à une classification de conservation des données, en veillant à ce que les données obsolètes ou inutiles soient supprimées automatiquement, selon un calendrier défini ou selon les besoins de la situation.",,,✓,, +V14,Protection des données,V14.2,Protection générale des données,V14.2.8,"Vérifiez que les informations sensibles sont supprimées des métadonnées des fichiers soumis par l'utilisateur, sauf si le stockage est autorisé par l'utilisateur.",,,✓,, +V14,Protection des données,V14.3,Protection des données côté client,V14.3.1,"Vérifiez que les données authentifiées sont effacées du stockage client, comme le DOM du navigateur, après la fin du client ou de la session. Le champ d'en-tête de réponse HTTP « Clear-Site-Data » peut être utile, mais le côté client devrait également pouvoir effectuer la correction si la connexion au serveur n'est pas disponible à la fin de la session.",✓,✓,✓,, +V14,Protection des données,V14.3,Protection des données côté client,V14.3.2,Vérifiez que l'application définit suffisamment de champs d'en-tête de réponse HTTP anti-caching (c'est-à-dire Cache-Control : no-store) afin que les données sensibles ne soient pas mises en cache dans les navigateurs.,,✓,✓,, +V14,Protection des données,V14.3,Protection des données côté client,V14.3.3,"Vérifiez que les données stockées dans le stockage du navigateur (telles que localStorage, sessionStorage, IndexedDB ou les cookies) ne contiennent pas de données sensibles, à l'exception des jetons de session.",,✓,✓,, +V15,Développement et architecture sécurisés,V15.1,Documentation sur le développement et l'architecture sécurisés,V15.1.1,"Vérifiez que la documentation de l'application définit les délais de correction basés sur les risques pour les versions de composants tiers présentant des vulnérabilités et pour la mise à jour des bibliothèques en général, afin de minimiser les risques liés à ces composants.",✓,✓,✓,, +V15,Développement et architecture sécurisés,V15.1,Documentation sur le développement et l'architecture sécurisés,V15.1.2,"Vérifiez qu'un catalogue d'inventaire, tel qu'une nomenclature logicielle (SBOM), est conservé pour toutes les bibliothèques tierces utilisées, y compris en vérifiant que les composants proviennent de référentiels prédéfinis, fiables et continuellement maintenus.",,✓,✓,, +V15,Développement et architecture sécurisés,V15.1,Documentation sur le développement et l'architecture sécurisés,V15.1.3,"Vérifiez que la documentation de l'application identifie les fonctionnalités consommatrices en temps ou gourmandes en ressources. Elle doit notamment indiquer comment prévenir une perte de disponibilité due à une utilisation excessive de ces fonctionnalités et éviter que la génération d'une réponse ne prenne plus de temps que le délai d'expiration du consommateur. Les mesures de protection potentielles peuvent inclure le traitement asynchrone, l'utilisation de files d'attente et la limitation des processus parallèles par utilisateur et par application.",,✓,✓,, +V15,Développement et architecture sécurisés,V15.1,Documentation sur le développement et l'architecture sécurisés,V15.1.4,Vérifiez que la documentation de l’application met en évidence les bibliothèques tierces qui sont considérées comme des « composants à risque ».,,,✓,, +V15,Développement et architecture sécurisés,V15.1,Documentation sur le développement et l'architecture sécurisés,V15.1.5,Vérifiez que la documentation de l’application met en évidence les parties de l’application où des « fonctionnalités dangereuses » sont utilisées.,,,✓,, +V15,Développement et architecture sécurisés,V15.2,Architecture de sécurité et dépendances,V15.2.1,Vérifiez que l’application contient uniquement des composants qui n’ont pas dépassé les délais de mise à jour et de correction documentés.,✓,✓,✓,, +V15,Développement et architecture sécurisés,V15.2,Architecture de sécurité et dépendances,V15.2.2,"Vérifiez que l'application a mis en œuvre des défenses contre la perte de disponibilité due à des fonctionnalités qui prennent du temps ou qui nécessitent des ressources, sur la base des décisions et stratégies de sécurité documentées à cet effet.",,✓,✓,, +V15,Développement et architecture sécurisés,V15.2,Architecture de sécurité et dépendances,V15.2.3,"Vérifiez que l'environnement de production inclut uniquement les fonctionnalités nécessaires au fonctionnement de l'application et n'expose pas de fonctionnalités superflues telles que du code de test, des exemples d'extraits et des fonctionnalités de développement.",,✓,✓,, +V15,Développement et architecture sécurisés,V15.2,Architecture de sécurité et dépendances,V15.2.4,"Vérifiez que les composants tiers et toutes leurs dépendances transitives sont inclus à partir du référentiel attendu, qu'il soit détenu en interne ou qu'il s'agisse d'une source externe, et qu'il n'y a aucun risque d'attaque par confusion de dépendances.",,,✓,, +V15,Développement et architecture sécurisés,V15.2,Architecture de sécurité et dépendances,V15.2.5,"Vérifiez que l'application implémente des protections supplémentaires autour des parties documentées comme contenant des « fonctionnalités dangereuses » ou utilisant des bibliothèques tierces considérées comme des « composants à risque ». Cela peut inclure des techniques telles que le sandboxing, l'encapsulation, la conteneurisation ou l'isolation au niveau du réseau pour retarder et dissuader les attaquants qui compromettent une partie de l'application de se propager ailleurs.",,,✓,, +V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.1,"Vérifiez que l'application ne renvoie que le sous-ensemble requis de champs d'un objet de données. Par exemple, elle ne doit pas renvoyer un objet de données entier, car certains champs individuels ne doivent pas être accessibles aux utilisateurs.",✓,✓,✓,, +V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.2,"Vérifiez que lorsque le backend de l'application effectue des appels vers des URL externes, il est configuré pour ne pas suivre les redirections, sauf s'il s'agit d'une fonctionnalité prévue.",,✓,✓,, +V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.3,"Vérifiez que l'application dispose de contre-mesures pour se protéger contre les attaques d'affectation de masse en limitant les champs autorisés par contrôleur et action, par exemple, il n'est pas possible d'insérer ou de mettre à jour une valeur de champ lorsqu'elle n'était pas destinée à faire partie de cette action.",,✓,✓,, +V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.4,"Vérifiez que tous les composants proxy et middleware transfèrent correctement l'adresse IP d'origine de l'utilisateur à l'aide de champs de données fiables qui ne peuvent pas être manipulés par l'utilisateur final, et que l'application et le serveur Web utilisent cette valeur correcte pour la journalisation et les décisions de sécurité telles que la limitation du débit, en tenant compte du fait que même l'adresse IP d'origine peut ne pas être fiable en raison d'adresses IP dynamiques, de VPN ou de pare-feu d'entreprise.",,✓,✓,, +V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.5,"Vérifiez que l'application garantit explicitement que les variables sont du type correct et effectue des opérations d'égalité et de comparaison strictes. Cela permet d'éviter les vulnérabilités liées à la confusion de types, causées par des hypothèses du code de l'application sur le type d'une variable.",,✓,✓,, +V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.6,"Vérifiez que le code JavaScript est écrit de manière à éviter la pollution du prototype, par exemple en utilisant Set() ou Map() au lieu de littéraux d'objet.",,✓,✓,, +V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.7,"Vérifiez que l'application dispose de défenses contre les attaques de pollution des paramètres HTTP, en particulier si le Framework d'application ne fait aucune distinction quant à la source des paramètres de requête (chaîne de requête, paramètres de corps, cookies ou champs d'en-tête).",,✓,✓,, +V15,Développement et architecture sécurisés,V15.4,Concurrence sécurisée,V15.4.1,"Vérifiez que les objets partagés dans le code multithread (tels que les caches, les fichiers ou les objets en mémoire accessibles par plusieurs threads) sont accessibles en toute sécurité à l'aide de types thread-safe et de mécanismes de synchronisation tels que des verrous ou des sémaphores pour éviter les conditions de concurrence et la corruption des données.",,,✓,, +V15,Développement et architecture sécurisés,V15.4,Concurrence sécurisée,V15.4.2,"Vérifiez que les vérifications de l'état d'une ressource, comme son existence ou ses autorisations, et des actions qui en dépendent, sont effectuées en une seule opération atomique afin d'éviter les situations de concurrence entre le moment de la vérification et le moment de l'utilisation (TOCTOU). Par exemple, vérifier l'existence d'un fichier avant de l'ouvrir ou l'accès d'un utilisateur avant de l'accorder.",,,✓,, +V15,Développement et architecture sécurisés,V15.4,Concurrence sécurisée,V15.4.3,"Vérifiez que les verrous sont utilisés de manière cohérente pour éviter que les threads ne se bloquent, que ce soit en s'attendant les uns les autres ou en réessayant sans fin, et que la logique de verrouillage reste dans le code responsable de la gestion de la ressource pour garantir que les verrous ne peuvent pas être modifiés par inadvertance ou de manière malveillante par des classes ou du code externes.",,,✓,, +V15,Développement et architecture sécurisés,V15.4,Concurrence sécurisée,V15.4.4,"Vérifiez que les politiques d'allocation des ressources empêchent la saturation de threads en garantissant un accès équitable aux ressources, par exemple en exploitant les pools de threads, permettant aux threads de priorité inférieure de continuer dans un délai raisonnable.",,,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.1,Documentation sur la journalisation de sécurité,V16.1.1,"Vérifiez qu'il existe un inventaire documentant la journalisation effectuée à chaque couche de la pile technologique de l'application, les événements enregistrés, les formats de journal, l'endroit où cette journalisation est stockée, la manière dont elle est utilisée, la manière dont l'accès à celle-ci est contrôlé et la durée de conservation des journaux.",,✓,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.2,Journalisation générale,V16.2.1,"Vérifiez que chaque entrée de journal inclut les métadonnées nécessaires (telles que quand, où, qui, quoi) qui permettraient une enquête détaillée sur la chronologie lorsqu'un événement se produit.",,✓,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.2,Journalisation générale,V16.2.2,Vérifiez que les sources de temps de tous les composants de journalisation sont synchronisées et que les horodatages des métadonnées des événements de sécurité utilisent le temps UTC ou incluent un décalage horaire explicite. L'UTC est recommandé pour garantir la cohérence entre les systèmes distribués et éviter toute confusion lors du passage à l'heure d'été.,,✓,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.2,Journalisation générale,V16.2.3,Vérifiez que l’application stocke ou diffuse uniquement les journaux vers les fichiers et services documentés dans l’inventaire des journaux.,,✓,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.2,Journalisation générale,V16.2.4,"Vérifiez que les journaux peuvent être lus et corrélés par le processeur de journaux utilisé, de préférence en utilisant un format de journalisation commun.",,✓,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.2,Journalisation générale,V16.2.5,"Vérifiez que l'application applique la journalisation en fonction du niveau de protection des données lors de la journalisation de données sensibles. Par exemple, certaines données, comme les identifiants ou les informations de paiement, peuvent être interdites. D'autres données, comme les jetons de session, ne peuvent être enregistrées que par hachage ou masquage, en totalité ou en partie.",,✓,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.3,Événements de sécurité,V16.3.1,"Vérifiez que toutes les opérations d'authentification sont enregistrées, y compris les tentatives réussies et infructueuses. Des métadonnées supplémentaires, telles que le type d'authentification ou les facteurs utilisés, doivent également être collectées.",,✓,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.3,Événements de sécurité,V16.3.2,"Vérifier que les tentatives d'autorisation infructueuses sont logguées. Pour le niveau 3, cela doit inclure la journalisation de toutes les décisions d'autorisation, y compris lors de l'accès à des données sensibles (sans journalisation des données sensibles elles-mêmes).",,✓,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.3,Événements de sécurité,V16.3.3,"Vérifiez que l'application enregistre les événements de sécurité définis dans la documentation et enregistre également les tentatives de contournement des contrôles de sécurité, tels que la validation des entrées, la logique métier et l'anti-automatisation.",,✓,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.3,Événements de sécurité,V16.3.4,Vérifiez que l’application enregistre les erreurs inattendues et les échecs de contrôle de sécurité tels que les échecs TLS du backend.,,✓,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.4,Protection des journaux,V16.4.1,Vérifiez que tous les composants de journalisation codent correctement les données pour empêcher l’injection de journaux.,,✓,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.4,Protection des journaux,V16.4.2,Vérifiez que les journaux sont protégés contre tout accès non autorisé et ne peuvent pas être modifiés.,,✓,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.4,Protection des journaux,V16.4.3,"Vérifiez que les journaux sont transmis de manière sécurisée à un système logique distinct pour analyse, détection, alerte et remontée des informations. L'objectif est de garantir qu'en cas de violation de l'application, les journaux ne seront pas compromis.",,✓,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.5,Gestion des erreurs,V16.5.1,"Vérifiez qu'un message générique est renvoyé au consommateur lorsqu'une erreur inattendue ou sensible à la sécurité se produit, garantissant ainsi l'absence d'exposition de données système internes sensibles telles que les traces de pile, les requêtes, les clés secrètes et les jetons.",,✓,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.5,Gestion des erreurs,V16.5.2,"Vérifiez que l'application continue de fonctionner en toute sécurité lorsque l'accès aux ressources externes échoue, par exemple, en utilisant des modèles tels que des disjoncteurs ou une dégradation progressive.",,✓,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.5,Gestion des erreurs,V16.5.3,"Vérifiez que l'application échoue proprement et sécurisée, y compris lorsqu'une exception se produit, en évitant les accès en cas d'erreur telles que le traitement d'une transaction malgré les erreurs résultant de la logique de validation.",,✓,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.5,Gestion des erreurs,V16.5.4,"Vérifiez qu'un gestionnaire d'erreurs de « dernier recours » est défini pour intercepter toutes les exceptions non gérées. Cela permet d'éviter la perte des informations d'erreur qui doivent être loguées dans les fichiers journaux et de garantir qu'une erreur ne paralyse pas l'ensemble du processus applicatif, entraînant une perte de disponibilité.",,,✓,, +V17,WebRTC,V17.1,Serveur TURN,V17.1.1,"Vérifiez que le service TURN (Traversal Using Relays around NAT) autorise uniquement l'accès aux adresses IP non réservées à des fins spécifiques (par exemple, réseaux internes, diffusion, bouclage). Notez que cela s'applique aux adresses IPv4 et IPv6.",,✓,✓,, +V17,WebRTC,V17.1,Serveur TURN,V17.1.2,Vérifiez que le service Traversal Using Relays around NAT (TURN) n'est pas susceptible d'épuiser ses ressources lorsque des utilisateurs légitimes tentent d'ouvrir un grand nombre de ports sur le serveur TURN.,,,✓,, +V17,WebRTC,V17.2,Média,V17.2.1,Vérifiez que la clé du certificat Datagram Transport Layer Security (DTLS) est gérée et protégée conformément à la politique documentée de gestion des clés cryptographiques.,,✓,✓,, +V17,WebRTC,V17.2,Média,V17.2.2,Vérifiez que le serveur multimédia est configuré pour utiliser et prendre en charge les suites de chiffrement DTLS (Datagram Transport Layer Security) approuvées et un profil de protection sécurisé pour l'extension DTLS pour l'établissement de clés pour le protocole de transport en temps réel sécurisé (DTLS-SRTP).,,✓,✓,, +V17,WebRTC,V17.2,Média,V17.2.3,Vérifiez que l'authentification SRTP (Secure Real-time Transport Protocol) est vérifiée sur le serveur multimédia pour empêcher les attaques par injection RTP (Real-time Transport Protocol) d'entraîner une condition de déni de service ou l'insertion de médias audio ou vidéo dans les flux multimédias.,,✓,✓,, +V17,WebRTC,V17.2,Média,V17.2.4,Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant lorsqu'il rencontre des paquets SRTP (Secure Real-time Transport Protocol) mal formés.,,✓,✓,, +V17,WebRTC,V17.2,Média,V17.2.5,Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.,,,✓,, +V17,WebRTC,V17.2,Média,V17.2.6,Vérifiez que le serveur multimédia n'est pas sensible à la vulnérabilité de condition de concurrence « ClientHello » dans Datagram Transport Layer Security (DTLS) en vérifiant si le serveur multimédia est publiquement connu comme étant vulnérable ou en effectuant le test de condition de concurrence.,,,✓,, +V17,WebRTC,V17.2,Média,V17.2.7,Vérifiez que tous les mécanismes d'enregistrement audio ou vidéo associés au serveur multimédia sont en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.,,,✓,, +V17,WebRTC,V17.2,Média,V17.2.8,"Vérifiez que le certificat Datagram Transport Layer Security (DTLS) est vérifié par rapport à l'attribut d'empreinte cryptographique du protocole de description de session (SDP), en mettant fin au flux multimédia si la vérification échoue, pour garantir l'authenticité du flux multimédia.",,,✓,, +V17,WebRTC,V17.3,Signalisation,V17.3.1,Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation entrants légitimes lors d'une attaque par saturation. Cela peut être réalisé en implémentant une limitation de débit au niveau de la signalisation.,,✓,✓,, +V17,WebRTC,V17.3,Signalisation,V17.3.2,"Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation légitimes en cas de message mal formé susceptible de provoquer un déni de service. Cela peut inclure la validation des entrées, la gestion sécurisée des dépassements d'entiers, la prévention des dépassements de tampon et l'utilisation d'autres techniques robustes de gestion des erreurs.",,✓,✓,, + diff --git a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.json b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.json new file mode 100644 index 0000000000..a1fdbe08df --- /dev/null +++ b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.json @@ -0,0 +1,7259 @@ +{ + "Name": "Application Security Verification Standard Project", + "ShortName": "ASVS", + "Version": "5.0.0", + "Description": "The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.", + "Requirements": [ + { + "Shortcode": "V1", + "Ordinal": 1, + "ShortName": "Encoding", + "Name": "Encodage et nettoyage", + "Items": [ + { + "Shortcode": "V1.1", + "Ordinal": 1, + "Name": "Architecture d'encodage et de nettoyage", + "Items": [ + { + "Shortcode": "V1.1.1", + "Ordinal": 1, + "Description": "Vérifiez que l'entrée est décodée ou non échappée vers une forme canonique une seule fois, elle n'est décodée que lorsque des données codées sous cette forme sont attendues, et que cela est fait avant de traiter davantage l'entrée, par exemple, elle n'est pas effectuée après la validation ou la désinfection de l'entrée.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.1.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application effectue l'encodage et l'échappement de sortie soit comme étape finale avant d'être utilisée par l'interpréteur pour lequel elle est destinée, soit par l'interpréteur lui-même.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V1.2", + "Ordinal": 2, + "Name": "Prévention des injections", + "Items": [ + { + "Shortcode": "V1.2.1", + "Ordinal": 1, + "Description": "Vérifiez que l'encodage de sortie d'une réponse HTTP, d'un document HTML ou d'un document XML est pertinent pour le contexte requis, comme l'encodage des caractères pertinents pour les éléments HTML, les attributs HTML, les commentaires HTML, les CSS ou les champs d'en-tête HTTP, pour éviter de modifier la structure du message ou du document.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.2", + "Ordinal": 2, + "Description": "Vérifiez que, lors de la création dynamique d'URL, les données non fiables sont encodées en fonction de leur contexte (par exemple, encodage d'URL ou encodage base64url pour les paramètres de requête ou de chemin). Assurez-vous que seuls les schémas d'URL sûrs sont autorisés (par exemple, interdire javascript: ou data:).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l'encodage ou l'échappement de sortie est utilisé lors de la création dynamique de contenu JavaScript (y compris JSON), pour éviter de modifier la structure du message ou du document (pour éviter l'injection JavaScript et JSON).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.4", + "Ordinal": 4, + "Description": "Vérifiez que la sélection de données ou les requêtes de base de données (par exemple, SQL, HQL, NoSQL, Cypher) utilisent des requêtes paramétrées, des ORM, des Framework d'entités ou sont protégées contre les injections SQL et autres attaques par injection de base de données. Ceci est également pertinent lors de l'écriture de procédures stockées.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.5", + "Ordinal": 5, + "Description": "Vérifiez que l’application protège contre l’injection de commandes du système d’exploitation et que les appels du système d’exploitation utilisent des requêtes du système d’exploitation paramétrées ou utilisent un encodage de sortie de ligne de commande contextuelle.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.6", + "Ordinal": 6, + "Description": "Vérifiez que l’application protège contre les vulnérabilités d’injection LDAP ou que des contrôles de sécurité spécifiques pour empêcher l’injection LDAP ont été mis en œuvre.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.7", + "Ordinal": 7, + "Description": "Vérifiez que l’application est protégée contre les attaques par injection XPath en utilisant la paramétrisation des requêtes ou des requêtes précompilées.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.8", + "Ordinal": 8, + "Description": "Vérifiez que les processeurs LaTeX sont configurés de manière sécurisée (par exemple, en n'utilisant pas l'indicateur « --shell-escape ») et qu'une liste d’autorisations de commandes est utilisée pour empêcher les attaques par injection LaTeX.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.9", + "Ordinal": 9, + "Description": "Vérifiez que l'application échappe les caractères spéciaux dans les expressions régulières (généralement à l'aide d'une barre oblique inverse) pour éviter qu'ils ne soient mal interprétés comme des métacaractères.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.10", + "Ordinal": 10, + "Description": "Vérifiez que l'application est protégée contre les injections CSV et injections de formules. L'application doit respecter les règles d'échappement définies dans les sections 2.6 et 2.7 de la RFC 4180 lors de l'export de contenu CSV. De plus, lors de l'export au format CSV ou vers d'autres formats de tableur (tels que XLS, XLSX ou ODF), les caractères spéciaux (notamment « = », « + », « - », « @ », « \\t » (tabulation) et « \\0 » (caractère null)) doivent être protégés par une apostrophe s'ils apparaissent en premier dans une valeur de champ.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V1.3", + "Ordinal": 3, + "Name": "Nettoyage", + "Items": [ + { + "Shortcode": "V1.3.1", + "Ordinal": 1, + "Description": "Vérifiez que toutes les entrées HTML non fiables provenant d'éditeurs WYSIWYG ou similaires sont nettoyées à l'aide d'une bibliothèque ou d'une fonctionnalité de Framework de nettoyage HTML bien connue et sécurisée.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application évite d'utiliser eval() ou d'autres fonctionnalités d'exécution de code dynamique telles que Spring Expression Language (SpEL). En l'absence d'alternative, toute saisie utilisateur incluse doit être nettoyée avant d'être exécutée.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.3", + "Ordinal": 3, + "Description": "Vérifiez que les données transmises à un contexte potentiellement dangereux sont préalablement nettoyées pour appliquer des mesures de sécurité, telles qu'autoriser uniquement des caractères sûrs pour ce contexte et raccourcir des entrées trop longues.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.4", + "Ordinal": 4, + "Description": "Vérifiez que le contenu Scalable Vector Graphics (SVG) scriptable fourni par l'utilisateur est validé ou nettoyé pour contenir uniquement des balises et des attributs (tels que des graphiques de dessin) qui sont sûrs pour l'application, par exemple, ne contiennent pas de scripts et d'objets étrangers.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.5", + "Ordinal": 5, + "Description": "Vérifiez que l'application nettoie ou désactive le contenu du langage de modèle d'expression ou de script fourni par l'utilisateur, tel que les feuilles de style CSS, le Markdown ou XSL, BBCode ou similaire.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.6", + "Ordinal": 6, + "Description": "Vérifiez que l'application protège contre les attaques de falsification de requête côté serveur (SSRF), en validant les données non fiables par rapport à une liste d'autorisation de protocoles, de domaines, de chemins et de ports et en nettoyant les caractères potentiellement dangereux avant d'utiliser les données pour appeler un autre service.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.7", + "Ordinal": 7, + "Description": "Vérifiez que l'application se protège contre les attaques par injection de modèles en interdisant la création de modèles basés sur des entrées non fiables. En l'absence d'alternative, toute entrée non fiable incluse dynamiquement lors de la création du modèle doit être nettoyée ou rigoureusement validée.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.8", + "Ordinal": 8, + "Description": "Vérifiez que l’application nettoie correctement les entrées non fiables avant utilisation dans les requêtes Java Naming and Directory Interface (JNDI) et que JNDI est configuré de manière sécurisée pour empêcher les attaques par injection JNDI.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.9", + "Ordinal": 9, + "Description": "Vérifiez que l’application nettoie le contenu avant qu’il ne soit envoyé à memcache pour éviter les attaques par injection.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.10", + "Ordinal": 10, + "Description": "Vérifiez que les chaînes de format susceptibles d'être résolues de manière inattendue ou malveillante lors de leur utilisation sont nettoyées avant d'être traitées.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.11", + "Ordinal": 11, + "Description": "Vérifiez que l'application nettoie les entrées utilisateur avant de les transmettre aux systèmes de messagerie pour se protéger contre l'injection SMTP ou IMAP.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.12", + "Ordinal": 12, + "Description": "Vérifiez que les expressions régulières sont exemptes d'éléments provoquant \"backtracking\" exponentiel et assurez-vous que les entrées non fiables sont nettoyées pour atténuer les attaques ReDoS ou Runaway Regex.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V1.4", + "Ordinal": 4, + "Name": "Mémoire, chaine de caractères et code à mémoire non-managée", + "Items": [ + { + "Shortcode": "V1.4.1", + "Ordinal": 1, + "Description": "Vérifiez que l'application utilise des chaînes memory-safe, une copie de mémoire et une arithmétique de pointeur renforcée pour détecter ou empêcher les débordements de pile, de tampon ou de tas.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.4.2", + "Ordinal": 2, + "Description": "Vérifiez que les techniques de validation du signe, de la plage et de l’entrée sont utilisées pour éviter les dépassements d’entiers.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.4.3", + "Ordinal": 3, + "Description": "Vérifiez que la mémoire et les ressources allouées dynamiquement sont libérées et que les références ou les pointeurs vers la mémoire libérée sont supprimés ou définis à null pour éviter les \"dangling pointer\" et les vulnérabilités d'utilisation après libération.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V1.5", + "Ordinal": 5, + "Name": "Désérialisation sécurisée", + "Items": [ + { + "Shortcode": "V1.5.1", + "Ordinal": 1, + "Description": "Vérifiez que l'application configure les \"parser\" XML pour utiliser une configuration restrictive et que les fonctionnalités non sûres telles que la résolution d'entités externes sont désactivées pour empêcher les attaques XML eXternal Entity (XXE).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.5.2", + "Ordinal": 2, + "Description": "Vérifiez que la désérialisation des données non fiables garantit une gestion sécurisée des entrées, par exemple en utilisant une liste d'autorisation de types d'objets ou en limitant les types d'objets définis par le client, afin d'empêcher les attaques par désérialisation. Les mécanismes de désérialisation explicitement définis comme non sécurisés ne doivent pas être utilisés avec des entrées non fiables.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.5.3", + "Ordinal": 3, + "Description": "Vérifiez que les différents \"parser\" utilisés dans l'application pour le même type de données (par exemple, les \"parser\" JSON, les \"parser\" XML, les \"parser\" d'URL) effectuent l'analyse de manière cohérente et utilisent le même mécanisme d'encodage de caractères pour éviter des problèmes tels que les vulnérabilités d'interopérabilité JSON ou un comportement d'analyse d'URI ou de fichier différent exploité dans les attaques d'inclusion de fichiers à distance (RFI) ou de falsification de requête côté serveur (SSRF).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V2", + "Ordinal": 2, + "ShortName": "Validation", + "Name": "Validation et logique métier", + "Items": [ + { + "Shortcode": "V2.1", + "Ordinal": 1, + "Name": "Validation et documentation de la logique métier", + "Items": [ + { + "Shortcode": "V2.1.1", + "Ordinal": 1, + "Description": "Vérifiez que la documentation de l'application définit des règles de validation des entrées pour vérifier la validité des éléments de données par rapport à la structure attendue. Il peut s'agir de formats de données courants tels que des numéros de carte de crédit, des adresses e-mail ou des numéros de téléphone, ou d'un format de données interne.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.1.2", + "Ordinal": 2, + "Description": "Vérifiez que la documentation de l'application définit comment valider la cohérence logique et contextuelle des éléments de données combinés, par exemple en vérifiant que la banlieue et le code postal correspondent.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.1.3", + "Ordinal": 3, + "Description": "Vérifiez que les attentes en matière de limites et de validations de la logique métier sont documentées, y compris par utilisateur et globalement dans l'application.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V2.2", + "Ordinal": 2, + "Name": "Validation des entrées", + "Items": [ + { + "Shortcode": "V2.2.1", + "Ordinal": 1, + "Description": "Vérifier que les entrées sont validées afin de respecter les attentes métier ou fonctionnelles. Cette validation doit être basée sur une liste de valeurs, de modèles et de plages autorisées, ou sur la comparaison des entrées avec une structure attendue et des limites logiques selon des règles prédéfinies. Pour le niveau 1, cette validation peut se concentrer sur les entrées utilisées pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau 2, elle doit s'appliquer à toutes les entrées.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.2.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application est conçue pour appliquer la validation des entrées au niveau d'une couche de service de confiance. Bien que la validation côté client améliore l'ergonomie et doit être encouragée, elle ne doit pas être considérée comme un contrôle de sécurité.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l’application garantit que les combinaisons d’éléments de données associés sont raisonnables selon les règles prédéfinies.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V2.3", + "Ordinal": 3, + "Name": "Sécurité de la logique métier", + "Items": [ + { + "Shortcode": "V2.3.1", + "Ordinal": 1, + "Description": "Vérifiez que l’application traitera uniquement les flux de logique métier pour le même utilisateur dans l’ordre séquentiel attendu et sans sauter d’étapes.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.3.2", + "Ordinal": 2, + "Description": "Vérifiez que les limites de la logique métier sont implémentées conformément à la documentation de l'application, afin d'éviter que des failles de la logique métier ne soient pas exploitées.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.3.3", + "Ordinal": 3, + "Description": "Vérifiez que les transactions sont utilisées au niveau de la logique métier de telle sorte qu'une opération de logique métier réussisse dans son intégralité ou qu'elle soit restaurée à l'état correct précédent.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.3.4", + "Ordinal": 4, + "Description": "Vérifiez que les mécanismes de verrouillage au niveau de la logique métier sont utilisés pour garantir que les ressources en quantité limitée (telles que les sièges de théâtre ou les créneaux de livraison) ne peuvent pas être réservées deux fois en manipulant la logique de l'application.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.3.5", + "Ordinal": 5, + "Description": "Vérifiez que les flux logiques métier à forte valeur ajoutée nécessitent l'approbation de plusieurs utilisateurs afin d'éviter toute action non autorisée ou accidentelle. Cela peut inclure, sans s'y limiter, les transferts monétaires importants, les approbations de contrats, l'accès à des informations classifiées ou les contournements de sécurité dans le secteur manufacturier.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V2.4", + "Ordinal": 4, + "Name": "Anti-automatisation", + "Items": [ + { + "Shortcode": "V2.4.1", + "Ordinal": 1, + "Description": "Vérifiez que des contrôles anti-automatisation sont en place pour protéger contre les appels excessifs aux fonctions d'application qui pourraient conduire à l'exfiltration de données, à la création de données inutiles, à l'épuisement des quotas, aux violations de limites de débit, au déni de service ou à la surutilisation de ressources coûteuses.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.4.2", + "Ordinal": 2, + "Description": "Vérifiez que les flux logiques métier nécessitent un timing humain réaliste, évitant ainsi des soumissions de transactions excessivement rapides.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V3", + "Ordinal": 3, + "ShortName": "Web", + "Name": "Sécurité du frontend Web", + "Items": [ + { + "Shortcode": "V3.1", + "Ordinal": 1, + "Name": "Documentation sur la sécurité du frontend Web", + "Items": [ + { + "Shortcode": "V3.1.1", + "Ordinal": 1, + "Description": "Vérifiez que la documentation de l'application indique les fonctionnalités de sécurité attendues que les navigateurs utilisant l'application doivent prendre en charge (telles que HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) et autres mécanismes de sécurité HTTP pertinents). Elle doit également définir le comportement de l'application lorsque certaines de ces fonctionnalités ne sont pas disponibles (par exemple, avertir l'utilisateur ou bloquer l'accès).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.2", + "Ordinal": 2, + "Name": "Interprétation non intentionnelle du contenu", + "Items": [ + { + "Shortcode": "V3.2.1", + "Ordinal": 1, + "Description": "Vérifiez que des contrôles de sécurité sont en place pour empêcher les navigateurs d'afficher du contenu ou des fonctionnalités dans les réponses HTTP dans un contexte incorrect (par exemple, lorsqu'une API, un fichier téléchargé par l'utilisateur ou une autre ressource est demandée directement). Les contrôles possibles peuvent inclure : ne pas transmettre le contenu sauf si les champs d'en-tête de requête HTTP (tels que Sec-Fetch-\\*) indiquent qu'il s'agit du contexte correct, utiliser la directive sandbox du champ d'en-tête Content-Security-Policy ou utiliser le type de disposition de pièce jointe dans le champ d'en-tête Content-Disposition.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.2.2", + "Ordinal": 2, + "Description": "Vérifiez que le contenu destiné à être affiché sous forme de texte, plutôt que rendu sous forme de HTML, est géré à l'aide de fonctions de rendu sécurisées (telles que createTextNode ou textContent) pour empêcher l'exécution involontaire de contenu tel que HTML ou JavaScript.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l'application évite l'écrasement du DOM lors de l'utilisation de JavaScript côté client en utilisant des déclarations de variables explicites, en effectuant une vérification de type stricte, en évitant de stocker des variables globales sur l'objet document et en implémentant l'isolation de l'espace de nommage.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.3", + "Ordinal": 3, + "Name": "Configuration des cookies", + "Items": [ + { + "Shortcode": "V3.3.1", + "Ordinal": 1, + "Description": "Vérifiez que les cookies ont l'attribut « Secure » ​​défini et si le préfixe « \\__Host- » n'est pas utilisé pour le nom du cookie, le préfixe « __Secure- » doit être utilisé pour le nom du cookie.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.3.2", + "Ordinal": 2, + "Description": "Vérifiez que la valeur de l'attribut « SameSite » de chaque cookie est définie en fonction de l'objectif du cookie, afin de limiter l'exposition aux attaques de réparation de l'interface utilisateur et aux attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.3.3", + "Ordinal": 3, + "Description": "Vérifiez que les cookies ont le préfixe « __Host- » pour le nom du cookie, sauf s'ils sont explicitement conçus pour être partagés avec d'autres hôtes.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.3.4", + "Ordinal": 4, + "Description": "Vérifiez que si la valeur d'un cookie n'est pas censée être accessible aux scripts côté client (comme un jeton de session), le cookie doit avoir l'attribut « HttpOnly » défini et la même valeur (par exemple, un jeton de session) ne doit être transférée au client que via le champ d'en-tête « Set-Cookie ».", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.3.5", + "Ordinal": 5, + "Description": "Vérifiez que lorsque l'application écrit un cookie, la longueur combinée du nom et de la valeur du cookie ne dépasse pas 4 096 octets. Les cookies trop volumineux ne seront pas stockés par le navigateur et ne seront donc pas envoyés avec les requêtes, empêchant ainsi l'utilisateur d'utiliser les fonctionnalités de l'application qui reposent sur ce cookie.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.4", + "Ordinal": 4, + "Name": "En-têtes du mécanisme de sécurité du navigateur", + "Items": [ + { + "Shortcode": "V3.4.1", + "Ordinal": 1, + "Description": "Vérifiez qu'un champ d'en-tête Strict-Transport-Security est inclus dans toutes les réponses afin d'appliquer une politique HTTP Strict Transport Security (HSTS). Une durée maximale d'au moins un an doit être définie, et pour les niveaux L2 et supérieurs, la politique doit également s'appliquer à tous les sous-domaines.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.2", + "Ordinal": 2, + "Description": "Vérifiez que le champ d'en-tête Access-Control-Allow-Origin du partage de ressources cross-origine (CORS) est une valeur fixe de l'application ou, si la valeur du champ d'en-tête de requête HTTP Origin est utilisée, qu'elle est validée par rapport à une liste d'origines approuvées. Si « Access-Control-Allow-Origin: * » doit être utilisé, vérifiez que la réponse ne contient aucune information sensible.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.3", + "Ordinal": 3, + "Description": "Vérifiez que les réponses HTTP incluent un champ d'en-tête de réponse Content-Security-Policy qui définit des directives garantissant que le navigateur charge et exécute uniquement du contenu ou des ressources fiables, afin de limiter l'exécution de JavaScript malveillant. Au minimum, une politique globale doit être utilisée, incluant les directives object-src 'none' et base-uri 'none', et définissant soit une lliste d’autorisations, soit des valeurs nonces ou des hachages. Pour une application L3, une politique par réponse avec des valeurs nonces ou des hachages doit être définie.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.4", + "Ordinal": 4, + "Description": "Vérifiez que toutes les réponses HTTP contiennent un champ d'en-tête « X-Content-Type-Options: nosniff ». Cela indique aux navigateurs de ne pas utiliser l'analyse de contenu ni la détection du type MIME pour la réponse donnée, et d'exiger que la valeur du champ d'en-tête « Content-Type » de la réponse corresponde à la ressource de destination. Par exemple, la réponse à une demande de style n'est acceptée que si le type de contenu de la réponse est « text/css ». Cela permet également au navigateur d'utiliser la fonctionnalité de blocage de lecture inter-origines (CORB).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.5", + "Ordinal": 5, + "Description": "Vérifiez que l'application définit une politique de référencement afin d'empêcher la fuite de données techniquement sensibles vers des services tiers via le champ d'en-tête de requête HTTP « Referer ». Cela peut être effectué via le champ d'en-tête de réponse HTTP « Referrer-Policy » ou via les attributs d'élément HTML. Les données sensibles peuvent inclure le chemin d'accès et les données de requête dans l'URL, et pour les applications internes non publiques, le nom d'hôte.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.6", + "Ordinal": 6, + "Description": "Vérifiez que l'application Web utilise la directive frame-ancestors du champ d'en-tête Content-Security-Policy pour chaque réponse HTTP afin de garantir qu'elle ne peut pas être intégrée par défaut et que l'intégration de ressources spécifiques n'est autorisée qu'en cas de nécessité. Notez que le champ d'en-tête X-Frame-Options, bien que pris en charge par les navigateurs, est obsolète et n'est pas forcément fiable.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.7", + "Ordinal": 7, + "Description": "Vérifiez que le champ d’en-tête Content-Security-Policy spécifie un emplacement pour signaler les violations.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.8", + "Ordinal": 8, + "Description": "Vérifiez que toutes les réponses HTTP qui lancent le rendu d'un document (comme les réponses de type text/html) incluent le champ d'en-tête 'Cross-Origin-Opener-Policy' avec la directive 'same-origin' ou s'ame-origin-allow-popups', selon les besoins. Cela empêche les attaques abusant de l'accès partagé aux objets Window, telles que le tabnabbing et le comptage d'images.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.5", + "Ordinal": 5, + "Name": "Séparation de l'origine du navigateur", + "Items": [ + { + "Shortcode": "V3.5.1", + "Ordinal": 1, + "Description": "Vérifiez que, si l'application ne s'appuie pas sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher les requêtes inter-origines non autorisées d'utiliser des fonctionnalités sensibles, ces requêtes sont validées afin de garantir leur origine. Cela peut se faire en utilisant et en validant des jetons anti-falsification ou en exigeant des champs d'en-tête HTTP supplémentaires qui ne sont pas des champs d'en-tête de requête CORS safelist. Ceci permet de se protéger contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.2", + "Ordinal": 2, + "Description": "Vérifiez que, si l'application s'appuie sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher l'utilisation inter-origines non autorisée de fonctionnalités sensibles, il est impossible d'appeler la fonctionnalité avec une requête qui ne déclenche pas de requête de pré-vérification cross-origin CORS. Cela peut nécessiter de vérifier les valeurs des champs d'en-tête de requête 'Origin' et 'Content-Type' ou d'utiliser un champ d'en-tête supplémentaire qui n'est pas un champ d'en-tête de la liste de sécurité CORS.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.3", + "Ordinal": 3, + "Description": "Vérifiez que les requêtes HTTP destinées aux fonctionnalités sensibles utilisent des méthodes HTTP appropriées, telles que POST, PUT, PATCH ou DELETE, et non des méthodes définies comme « sûres » par la spécification HTTP, telles que HEAD, OPTIONS ou GET. Une validation stricte des champs d'en-tête de requête Sec-Fetch-* peut également être utilisée pour garantir que la requête ne provient pas d'un appel inter-origines inapproprié, d'une requête de navigation ou d'un chargement de ressources (comme une source d'image) inattendu.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.4", + "Ordinal": 4, + "Description": "Vérifiez que des applications distinctes sont hébergées sur des noms d'hôte différents pour tirer parti des restrictions fournies par la politique de même origine, y compris la manière dont les documents ou scripts chargés par une origine peuvent interagir avec les ressources d'une autre origine et les restrictions basées sur le nom d'hôte sur les cookies.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.5", + "Ordinal": 5, + "Description": "Vérifiez que les messages reçus par l'interface postMessage sont rejetés si l'origine du message n'est pas digne de confiance ou si la syntaxe du message n'est pas valide.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.6", + "Ordinal": 6, + "Description": "Vérifiez que la fonctionnalité JSONP n'est activée nulle part dans l'application pour éviter les attaques Cross-Site Script Inclusion (XSSI).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.7", + "Ordinal": 7, + "Description": "Vérifiez que les données nécessitant une autorisation ne sont pas incluses dans les réponses des ressources de script, comme les fichiers JavaScript, pour empêcher les attaques par inclusion de script intersite (XSSI).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.8", + "Ordinal": 8, + "Description": "Vérifiez que les ressources authentifiées (telles que les images, les vidéos, les scripts et autres documents) peuvent être chargées ou intégrées pour le compte de l'utilisateur uniquement lorsque cela est prévu. Cela peut être réalisé en validant strictement les champs d'en-tête de requête HTTP Sec-Fetch-* afin de garantir que la requête ne provient pas d'un appel cross-origin inapproprié, ou en définissant un champ d'en-tête de réponse HTTP Cross-Origin-Resource-Policy restrictif pour indiquer au navigateur de bloquer le contenu renvoyé.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.6", + "Ordinal": 6, + "Name": "Intégrité des ressources externes", + "Items": [ + { + "Shortcode": "V3.6.1", + "Ordinal": 1, + "Description": "Vérifiez que les ressources côté client, telles que les bibliothèques JavaScript, les feuilles de style CSS ou les polices web, sont hébergées en externe (par exemple, sur un réseau de diffusion de contenu) uniquement si la ressource est statique et versionnée, et si l'intégrité des sous-ressources (SRI) est utilisée pour valider l'intégrité de la ressource. Si cela n'est pas possible, une décision de sécurité documentée doit justifier cette décision pour chaque ressource.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.7", + "Ordinal": 7, + "Name": "Autres considérations sur la sécurité du navigateur", + "Items": [ + { + "Shortcode": "V3.7.1", + "Ordinal": 1, + "Description": "Vérifiez que l'application utilise uniquement des technologies côté client toujours prises en charge et considérées comme sécurisées. Parmi les technologies qui ne répondent pas à cette exigence figurent les plugins NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL ou les applets Java côté client.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.7.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application redirigera automatiquement l'utilisateur vers un nom d'hôte ou un domaine différent (qui n'est pas contrôlé par l'application) uniquement lorsque la destination apparaît sur une liste d'autorisation.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.7.3", + "Ordinal": 3, + "Description": "Vérifiez que le domaine de premier niveau de l'application (par exemple, site.tld) ​​est ajouté à la liste de préchargement publique pour HTTP Strict Transport Security (HSTS). Cela garantit que l'utilisation de TLS pour l'application est intégrée directement dans les principaux navigateurs, plutôt que de dépendre uniquement du champ d'en-tête de réponse Strict-Transport-Security.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.7.4", + "Ordinal": 4, + "Description": "Vérifiez que l'application affiche une notification lorsque l'utilisateur est redirigé vers une URL hors du contrôle de l'application, avec une option pour annuler la navigation.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.7.5", + "Ordinal": 5, + "Description": "Vérifiez que l'application se comporte comme documenté (par exemple, en avertissant l'utilisateur ou en bloquant l'accès) si le navigateur utilisé pour accéder à l'application ne prend pas en charge les fonctionnalités de sécurité attendues.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V4", + "Ordinal": 4, + "ShortName": "API", + "Name": "API et service Web", + "Items": [ + { + "Shortcode": "V4.1", + "Ordinal": 1, + "Name": "Sécurité du service Web générique", + "Items": [ + { + "Shortcode": "V4.1.1", + "Ordinal": 1, + "Description": "Vérifiez que chaque réponse HTTP avec un corps de message contient un champ d'en-tête Content-Type qui correspond au contenu réel de la réponse, y compris le paramètre charset pour spécifier un codage de caractères sécurisé (par exemple, UTF-8, ISO-8859-1) conformément aux types de médias IANA, tels que « text/ », « /+xml » et « /xml ».", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.1.2", + "Ordinal": 2, + "Description": "Vérifiez que seuls les terminaux utilisateurs (destinés à l'accès manuel via un navigateur web) redirigent automatiquement de HTTP vers HTTPS, tandis que les autres services ou terminaux n'implémentent pas de redirections transparentes. Cela permet d'éviter qu'un client envoie par erreur des requêtes HTTP non chiffrées, mais que, comme ces requêtes sont automatiquement redirigées vers HTTPS, la fuite de données sensibles passe inaperçue.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.1.3", + "Ordinal": 3, + "Description": "Vérifiez que tout champ d'en-tête HTTP utilisé par l'application et défini par une couche intermédiaire, telle qu'un équilibreur de charge, un proxy web ou un service backend-for-frontend, ne peut pas être remplacé par l'utilisateur final. Les exemples d'en-têtes peuvent inclure X-Real-IP, X-Forwarded-*, ou X-User-ID.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.1.4", + "Ordinal": 4, + "Description": "Vérifiez que seules les méthodes HTTP explicitement prises en charge par l'application ou son API (y compris les OPTIONS lors des demandes de contrôle en amont) peuvent être utilisées et que les méthodes inutilisées sont bloquées.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.1.5", + "Ordinal": 5, + "Description": "Vérifier que les signatures numériques par message sont utilisées pour fournir une assurance supplémentaire en plus des protections de transport pour les demandes ou les transactions qui sont très sensibles ou qui traversent un certain nombre de systèmes.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V4.2", + "Ordinal": 2, + "Name": "Validation de la structure des messages HTTP", + "Items": [ + { + "Shortcode": "V4.2.1", + "Ordinal": 1, + "Description": "Vérifiez que tous les composants de l'application (y compris les équilibreurs de charge, les pares-feux et les serveurs d'applications) déterminent les limites des messages HTTP entrants à l'aide du mécanisme approprié à la version HTTP afin d'empêcher la contrebande de requêtes HTTP. Dans HTTP/1.x, si un champ d'en-tête Transfer-Encoding est présent, l'en-tête Content-Length doit être ignoré conformément à la RFC 2616. Avec HTTP/2 ou HTTP/3, si un champ d'en-tête Content-Length est présent, le récepteur doit s'assurer qu'il est cohérent avec la longueur des trames DATA.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.2.2", + "Ordinal": 2, + "Description": "Vérifier que, lors de la génération de messages HTTP, le champ d'en-tête Content-Length n'entre pas en conflit avec la longueur du contenu déterminée par le cadrage du protocole HTTP, afin d'empêcher les attaques de type « request smuggling ».", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l'application n'envoie ni n'accepte de messages HTTP/2 ou HTTP/3 avec des champs d'en-tête spécifiques à la connexion, tels que Transfer-Encoding, afin d'éviter les attaques par fractionnement de la réponse et par injection d'en-tête.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.2.4", + "Ordinal": 4, + "Description": "Vérifiez que l'application n'accepte que les requêtes HTTP/2 et HTTP/3 dont les champs et valeurs d'en-tête ne contiennent pas de séquences CR (\\r), LF (\\n) ou CRLF (\\r\\n), afin d'éviter les attaques par injection d'en-tête.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.2.5", + "Ordinal": 5, + "Description": "Vérifiez que, si l'application (backend ou frontend) construit et envoie des requêtes, elle utilise des mécanismes de validation, d'assainissement ou autres pour éviter de créer des URI (comme pour les appels API) ou des champs d'en-tête de requête HTTP (comme Authorization ou Cookie) qui sont trop longs pour être acceptés par le composant récepteur. Cela pourrait entraîner un déni de service, par exemple lors de l'envoi d'une requête trop longue (par exemple, un long champ d'en-tête de cookie), ce qui fait que le serveur répond toujours avec un statut d'erreur.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V4.3", + "Ordinal": 3, + "Name": "GraphQL", + "Items": [ + { + "Shortcode": "V4.3.1", + "Ordinal": 1, + "Description": "Vérifiez qu'une liste d'autorisation de requête, une limitation de profondeur, une limitation de quantité ou une analyse des coûts de requête est utilisée pour empêcher le déni de service (DoS) de GraphQL ou d'expression de la couche données en raison de requêtes imbriquées coûteuses.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.3.2", + "Ordinal": 2, + "Description": "Vérifiez que les requêtes d’introspection GraphQL sont désactivées dans l’environnement de production, sauf si l’API GraphQL est destinée à être utilisée par d’autres parties.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V4.4", + "Ordinal": 4, + "Name": "WebSocket", + "Items": [ + { + "Shortcode": "V4.4.1", + "Ordinal": 1, + "Description": "Vérifiez que WebSocket sur TLS (WSS) est utilisé pour toutes les connexions WebSocket.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.4.2", + "Ordinal": 2, + "Description": "Vérifiez que, lors de la négociation HTTP WebSocket initiale, le champ d’en-tête 'Origin' est vérifié par rapport à une liste d’origines autorisées pour l’application.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.4.3", + "Ordinal": 3, + "Description": "Vérifiez que, si la gestion de session standard de l'application ne peut pas être utilisée, des jetons dédiés sont utilisés à cet effet, qui sont conformes aux exigences de sécurité de gestion de session pertinentes.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.4.4", + "Ordinal": 4, + "Description": "Vérifiez que les jetons de gestion de session WebSocket dédiés sont initialement obtenus ou validés via la session HTTPS précédemment authentifiée lors de la transition d'une session HTTPS existante vers un canal WebSocket.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V5", + "Ordinal": 5, + "ShortName": "File", + "Name": "Gestion des fichiers", + "Items": [ + { + "Shortcode": "V5.1", + "Ordinal": 1, + "Name": "Documentation sur la gestion des fichiers", + "Items": [ + { + "Shortcode": "V5.1.1", + "Ordinal": 1, + "Description": "Vérifiez que la documentation définit les types de fichiers autorisés, les extensions de fichiers attendues et la taille maximale (y compris la taille décompressée) pour chaque fonctionnalité de Téléversement. De plus, assurez-vous que la documentation précise comment les fichiers sont sécurisés pour le téléchargement et le traitement des utilisateurs finaux, par exemple le comportement de l'application lorsqu'un fichier malveillant est détecté.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V5.2", + "Ordinal": 2, + "Name": "Téléversement de fichiers et contenu", + "Items": [ + { + "Shortcode": "V5.2.1", + "Ordinal": 1, + "Description": "Vérifiez que l'application n'acceptera que des fichiers d'une taille qu'elle peut traiter sans provoquer de perte de performances ou d'attaque par déni de service.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.2", + "Ordinal": 2, + "Description": "Vérifiez que lorsque l'application accepte un fichier, seul ou dans une archive telle qu'un fichier zip, elle vérifie si l'extension de fichier correspond à une extension attendue et que le contenu correspond au type représenté par l'extension. Cela inclut, sans s'y limiter, la vérification des « octets magiques » initiaux, la réécriture d'images et l'utilisation de bibliothèques spécialisées pour la validation du contenu des fichiers. Pour le niveau L1, cela peut se concentrer uniquement sur les fichiers utilisés pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau L2, cela doit s'appliquer à tous les fichiers acceptés.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l'application vérifie les fichiers compressés (par exemple, zip, gz, docx, odt) par rapport à la taille maximale autorisée non compressée et au nombre maximal de fichiers avant de décompresser le fichier.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.4", + "Ordinal": 4, + "Description": "Vérifiez qu'un quota de taille de fichier et un nombre maximal de fichiers par utilisateur sont appliqués pour garantir qu'un seul utilisateur ne puisse pas remplir le stockage avec trop de fichiers ou des fichiers excessivement volumineux.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.5", + "Ordinal": 5, + "Description": "Vérifiez que l'application n'autorise pas le téléversement de fichiers compressés contenant des liens symboliques, sauf si cela est spécifiquement requis (auquel cas il sera nécessaire d'appliquer une liste d'autorisation des fichiers vers lesquels il est possible de créer des liens symboliques).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.6", + "Ordinal": 6, + "Description": "Vérifiez que l'application rejette les images téléversées avec une taille de pixel supérieure au maximum autorisé, afin d'éviter les attaques par inondation de pixels.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V5.3", + "Ordinal": 3, + "Name": "Stockage de fichiers", + "Items": [ + { + "Shortcode": "V5.3.1", + "Ordinal": 1, + "Description": "Vérifiez que les fichiers téléversés ou générés par une entrée non fiable et stockés dans un dossier public ne sont pas exécutés en tant que code de programme côté serveur lorsqu'ils sont accessibles directement avec une requête HTTP.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.3.2", + "Ordinal": 2, + "Description": "Vérifiez que lorsque l'application crée des chemins d'accès pour les opérations sur les fichiers, elle utilise des données générées en interne ou fiables plutôt que des noms de fichiers soumis par l'utilisateur. Si des noms de fichiers ou des métadonnées de fichiers soumis par l'utilisateur doivent être utilisés, une validation et un nettoyage stricts doivent être appliqués. Ceci permet de se protéger contre les attaques par traversée de chemin, l'inclusion de fichiers locaux ou distants (LFI, RFI) et la falsification de requêtes côté serveur (SSRF).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.3.3", + "Ordinal": 3, + "Description": "Vérifiez que le traitement des fichiers côté serveur, comme la décompression des fichiers, ignore les informations de chemin fournies par l'utilisateur pour éviter les vulnérabilités telles que le \"zip slip\".", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V5.4", + "Ordinal": 4, + "Name": "Téléchargement de fichier", + "Items": [ + { + "Shortcode": "V5.4.1", + "Ordinal": 1, + "Description": "Vérifiez que l’application valide ou ignore les noms de fichiers soumis par l’utilisateur, y compris dans un paramètre JSON, JSONP ou URL et spécifie un nom de fichier dans le champ d’en-tête Content-Disposition de la réponse.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.4.2", + "Ordinal": 2, + "Description": "Vérifiez que les noms de fichiers servis (par exemple, dans les champs d'en-tête de réponse HTTP ou les pièces jointes aux e-mails) sont encodés ou nettoyés (par exemple, conformément à la RFC 6266) pour préserver la structure du document et empêcher les attaques par injection.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.4.3", + "Ordinal": 3, + "Description": "Vérifiez que les fichiers obtenus à partir de sources non fiables sont analysés par des scanners antivirus pour empêcher la diffusion de contenu malveillant connu.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V6", + "Ordinal": 6, + "ShortName": "Authentication", + "Name": "Authentification", + "Items": [ + { + "Shortcode": "V6.1", + "Ordinal": 1, + "Name": "Documentation d'authentification", + "Items": [ + { + "Shortcode": "V6.1.1", + "Ordinal": 1, + "Description": "Vérifiez que la documentation de l'application définit comment les contrôles, tels que la limitation de débit, l'anti-automatisation et la réponse adaptative, sont utilisés pour se défendre contre les attaques telles que le « credential stuffing » et la force brute des mots de passe. La documentation doit expliquer clairement comment ces contrôles sont configurés et empêcher le blocage malveillant des comptes.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.1.2", + "Ordinal": 2, + "Description": "Vérifiez qu'une liste de mots spécifiques au contexte est documentée afin d'empêcher leur utilisation dans les mots de passe. Cette liste peut inclure des permutations de noms d'organisations, de produits, d'identifiants de systèmes, de noms de codes de projets, de noms de services ou de rôles, etc.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.1.3", + "Ordinal": 3, + "Description": "Vérifiez que, si l'application inclut plusieurs voies d'authentification, celles-ci sont toutes documentées avec les contrôles de sécurité et la force d'authentification qui doivent être appliqués de manière cohérente.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.2", + "Ordinal": 2, + "Name": "Sécurité des mots de passe", + "Items": [ + { + "Shortcode": "V6.2.1", + "Ordinal": 1, + "Description": "Vérifiez que les mots de passe définis par l'utilisateur comportent au moins 8 caractères, bien qu'un minimum de 15 caractères soit fortement recommandé.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.2", + "Ordinal": 2, + "Description": "Vérifiez que les utilisateurs peuvent modifier leur mot de passe.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.3", + "Ordinal": 3, + "Description": "Vérifiez que la fonctionnalité de changement de mot de passe nécessite le mot de passe actuel et le nouveau mot de passe de l'utilisateur.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.4", + "Ordinal": 4, + "Description": "Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou du changement de mot de passe sont vérifiés par rapport à un ensemble disponible d'au moins 3 000 mots de passe principaux qui correspondent à la politique de mot de passe de l'application, par exemple la longueur minimale.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.5", + "Ordinal": 5, + "Description": "Vérifiez que les mots de passe peuvent être utilisés, quelle que soit leur composition, sans restriction quant au type de caractères autorisés. Aucun nombre minimal de majuscules ou de minuscules, de chiffres ou de caractères spéciaux ne doit être exigé.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.6", + "Ordinal": 6, + "Description": "Vérifiez que les champs de saisie du mot de passe utilisent type=password pour masquer la saisie. Les applications peuvent permettre à l'utilisateur d'afficher temporairement l'intégralité du mot de passe masqué ou le dernier caractère saisi.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.7", + "Ordinal": 7, + "Description": "Vérifiez que la fonctionnalité « coller », les assistants de mot de passe du navigateur et les gestionnaires de mots de passe externes sont autorisés.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.8", + "Ordinal": 8, + "Description": "Vérifiez que l'application vérifie le mot de passe de l'utilisateur exactement tel qu'il a été reçu de l'utilisateur, sans aucune modification telle qu'une troncature ou une transformation de casse.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.9", + "Ordinal": 9, + "Description": "Vérifiez que les mots de passe d’au moins 64 caractères sont autorisés.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.10", + "Ordinal": 10, + "Description": "Vérifiez que le mot de passe d'un utilisateur reste valide jusqu'à ce qu'il soit découvert comme compromis ou qu'il soit renouvelé. L'application ne doit pas exiger de renouvellement périodique des identifiants.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.11", + "Ordinal": 11, + "Description": "Vérifiez que la liste documentée de mots spécifiques au contexte est utilisée pour éviter la création de mots de passe faciles à deviner.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.12", + "Ordinal": 12, + "Description": "Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou des modifications de mot de passe sont vérifiés par rapport à un ensemble de mots de passe fuités.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.3", + "Ordinal": 3, + "Name": "Sécurité générale de l'authentification", + "Items": [ + { + "Shortcode": "V6.3.1", + "Ordinal": 1, + "Description": "Vérifiez que les contrôles visant à empêcher les attaques telles que le bourrage d'informations d'identification et la force brute des mots de passe sont mis en œuvre conformément à la documentation de sécurité de l'application.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.2", + "Ordinal": 2, + "Description": "Vérifiez que les comptes d’utilisateur par défaut (par exemple, « root », « admin » ou « sa ») ne sont pas présents dans l’application ou sont désactivés.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.3", + "Ordinal": 3, + "Description": "Vérifiez que l’application exige que les utilisateurs utilisent un mécanisme d’authentification multifacteur ou une combinaison de mécanismes d’authentification à facteur unique.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.4", + "Ordinal": 4, + "Description": "Vérifiez que, si l’application inclut plusieurs voies d’authentification, il n’existe aucune voie non documentée et que les contrôles de sécurité et la force d’authentification sont appliqués de manière cohérente.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.5", + "Ordinal": 5, + "Description": "Vérifiez que les utilisateurs sont informés des tentatives d'authentification suspectes (réussies ou non). Il peut s'agir de tentatives d'authentification provenant d'un emplacement ou d'un client inhabituel, d'une authentification partiellement réussie (un seul facteur parmi plusieurs), d'une tentative d'authentification après une longue période d'inactivité ou d'une authentification réussie après plusieurs tentatives infructueuses.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.6", + "Ordinal": 6, + "Description": "Vérifiez que le courrier électronique n’est pas utilisé comme mécanisme d’authentification à facteur unique ou à facteurs multiples.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.7", + "Ordinal": 7, + "Description": "Vérifiez que les utilisateurs sont avertis après les mises à jour des détails d'authentification, telles que les réinitialisations d'informations d'identification ou la modification du nom d'utilisateur ou de l'adresse e-mail.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.8", + "Ordinal": 8, + "Description": "Vérifiez que les utilisateurs valides ne peuvent pas être déduits d'échecs d'authentification, par exemple en se basant sur des messages d'erreur, des codes de réponse HTTP ou des temps de réponse différents. Les fonctionnalités d'inscription et de mot de passe oublié doivent également bénéficier de cette protection.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.4", + "Ordinal": 4, + "Name": "Cycle de vie et récupération du facteur d'authentification", + "Items": [ + { + "Shortcode": "V6.4.1", + "Ordinal": 1, + "Description": "Vérifiez que les mots de passe initiaux ou les codes d'activation générés par le système sont générés de manière aléatoire et sécurisée, qu'ils respectent la politique de mots de passe en vigueur et qu'ils expirent après une courte période ou après leur première utilisation. Ces secrets initiaux ne doivent pas devenir des mots de passe permanents.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.2", + "Ordinal": 2, + "Description": "Vérifiez que les indices de mot de passe ou l'authentification basée sur les connaissances (appelées « questions secrètes ») ne sont pas présents.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.3", + "Ordinal": 3, + "Description": "Vérifiez qu'un processus sécurisé de réinitialisation d'un mot de passe oublié est mis en œuvre, qui ne contourne aucun mécanisme d'authentification multifacteur activé.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.4", + "Ordinal": 4, + "Description": "Vérifiez que si un facteur d'authentification multifacteur est perdu, la preuve de vérification d'identité est effectuée au même niveau que lors de l'inscription.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.5", + "Ordinal": 5, + "Description": "Vérifiez que les instructions de renouvellement des mécanismes d'authentification qui expirent sont envoyées avec suffisamment de temps pour être exécutées avant l'expiration de l'ancien mécanisme d'authentification, en configurant des rappels automatiques si nécessaire.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.6", + "Ordinal": 6, + "Description": "Vérifiez que les administrateurs peuvent initier la réinitialisation du mot de passe de l'utilisateur, mais que cela ne leur permet pas de modifier ou de choisir son mot de passe. Cela évite qu'ils ne connaissent le mot de passe de l'utilisateur.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.5", + "Ordinal": 5, + "Name": "Exigences générales en matière d'authentification multifacteur", + "Items": [ + { + "Shortcode": "V6.5.1", + "Ordinal": 1, + "Description": "Vérifiez que les secrets de recherche, les demandes ou codes d'authentification out-of-band et les mots de passe à usage unique basés sur le temps (TOTP) ne peuvent être utilisés avec succès qu'une seule fois.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.2", + "Ordinal": 2, + "Description": "Vérifiez que, lors de leur stockage dans le backend de l'application, les secrets de recherche comportant moins de 112 bits d'entropie (19 caractères alphanumériques aléatoires ou 34 chiffres aléatoires) sont hachés avec un algorithme de hachage de stockage de mots de passe approuvé, intégrant un sel aléatoire de 32 bits. Une fonction de hachage standard peut être utilisée si le secret comporte 112 bits d'entropie ou plus.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.3", + "Ordinal": 3, + "Description": "Vérifiez que les secrets de recherche, le code d'authentification out-of-band et les mots de passe à usage unique basés sur le temps sont générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) pour éviter les valeurs prévisibles.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.4", + "Ordinal": 4, + "Description": "Vérifiez que les secrets de recherche et les codes d'authentification out-of-band ont un minimum de 20 bits d'entropie (généralement 4 caractères alphanumériques aléatoires ou 6 chiffres aléatoires suffisent).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.5", + "Ordinal": 5, + "Description": "Vérifiez que les requêtes, codes ou jetons d'authentification out-of-band, ainsi que les mots de passe à usage unique (TOTP), ont une durée de vie définie. Les requêtes out-of-band doivent avoir une durée de vie maximale de 10 minutes et les TOTP, de 30 secondes.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.6", + "Ordinal": 6, + "Description": "Vérifiez que tout facteur d’authentification (y compris les appareils physiques) peut être révoqué en cas de vol ou autre perte.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.7", + "Ordinal": 7, + "Description": "Vérifiez que les mécanismes d’authentification biométrique ne sont utilisés que comme facteurs secondaires, avec quelque chose que vous possédez ou quelque chose que vous savez.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.8", + "Ordinal": 8, + "Description": "Vérifiez que les mots de passe à usage unique basés sur le temps (TOTP) sont vérifiés en fonction d'une source temporelle provenant d'un service de confiance et non d'une heure non fiable ou fournie par le client.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.6", + "Ordinal": 6, + "Name": "Mécanismes d'authentification out-of-band", + "Items": [ + { + "Shortcode": "V6.6.1", + "Ordinal": 1, + "Description": "Vérifier que les mécanismes d'authentification utilisant le réseau téléphonique public commuté (RTPC) pour la transmission de mots de passe à usage unique (OTP) par téléphone ou SMS ne sont proposés que lorsque le numéro de téléphone a été préalablement validé. D'autres méthodes plus robustes (telles que les mots de passe à usage unique à durée déterminée) sont également proposées, et que le service informe les utilisateurs des risques de sécurité qu'elles présentent. Pour les applications de niveau 3, le téléphone et les SMS ne doivent pas être disponibles.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.6.2", + "Ordinal": 2, + "Description": "Vérifiez que les demandes d’authentification out-of-band, les codes ou les jetons sont liés à la demande d’authentification d’origine pour laquelle ils ont été générés et ne sont pas utilisables pour une demande précédente ou ultérieure.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.6.3", + "Ordinal": 3, + "Description": "Vérifiez qu'un mécanisme d'authentification out-of-band basé sur du code est protégé contre les attaques par force brute grâce au \"rate limiting\". Envisagez également d'utiliser un code avec au moins 64 bits d'entropie.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.6.4", + "Ordinal": 4, + "Description": "Vérifiez que, lorsque les notifications push sont utilisées pour l'authentification multifacteur, le \"rate limiting\" est appliqué afin d'empêcher les attaques de type « push bombing ». La concordance des numéros peut également atténuer ce risque.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.7", + "Ordinal": 7, + "Name": "Mécanisme d'authentification cryptographique", + "Items": [ + { + "Shortcode": "V6.7.1", + "Ordinal": 1, + "Description": "Vérifiez que les certificats utilisés pour vérifier les assertions d’authentification cryptographique sont stockés de manière à les protéger contre toute modification.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.7.2", + "Ordinal": 2, + "Description": "Vérifiez que le nonce de défi a une longueur d'au moins 64 bits et qu'il est statistiquement unique ou unique sur toute la durée de vie du périphérique cryptographique.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.8", + "Ordinal": 8, + "Name": "Authentification avec un fournisseur d'identité", + "Items": [ + { + "Shortcode": "V6.8.1", + "Ordinal": 1, + "Description": "Vérifiez que, si l'application prend en charge plusieurs fournisseurs d'identité (IdP), l'identité de l'utilisateur ne peut pas être usurpée via un autre fournisseur d'identité pris en charge (par exemple, en utilisant le même identifiant utilisateur). La mesure standard consisterait à ce que l'application enregistre et identifie l'utilisateur à l'aide d'une combinaison de l'ID du fournisseur d'identité (servant d'espace de noms) et de l'ID de l'utilisateur dans le fournisseur d'identité.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.8.2", + "Ordinal": 2, + "Description": "Vérifiez que la présence et l'intégrité des signatures numériques sur les assertions d'authentification (par exemple sur les assertions JWT ou SAML) sont toujours validées, en rejetant toutes les assertions non signées ou ayant des signatures non valides.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.8.3", + "Ordinal": 3, + "Description": "Vérifiez que les assertions SAML sont traitées de manière unique et utilisées une seule fois au cours de la période de validité pour éviter les attaques par rejeu.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.8.4", + "Ordinal": 4, + "Description": "Si une application utilise un fournisseur d'identité (IdP) distinct et attend une force, des méthodes ou une date d'authentification spécifiques pour des fonctions spécifiques, vérifiez que l'application les vérifie à l'aide des informations renvoyées par l'IdP. Par exemple, si OIDC est utilisé, cela peut être réalisé en validant les affirmations de jeton d'identification telles que « acr », « amr » et « auth_time » (le cas échéant). Si l'IdP ne fournit pas ces informations, l'application doit disposer d'une approche de secours documentée qui suppose que le mécanisme d'authentification de force minimale a été utilisé (par exemple, une authentification à facteur unique avec nom d'utilisateur et mot de passe).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V7", + "Ordinal": 7, + "ShortName": "Session", + "Name": "Gestion des sessions", + "Items": [ + { + "Shortcode": "V7.1", + "Ordinal": 1, + "Name": "Documentation sur la gestion des sessions", + "Items": [ + { + "Shortcode": "V7.1.1", + "Ordinal": 1, + "Description": "Vérifiez que le délai d'inactivité de la session de l'utilisateur et la durée de vie maximale absolue de la session sont documentés, sont appropriés en combinaison avec d'autres contrôles et que la documentation inclut une justification de tout écart par rapport aux exigences de réauthentification NIST SP 800-63B.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.1.2", + "Ordinal": 2, + "Description": "Vérifiez que la documentation définit le nombre de sessions simultanées (parallèles) autorisées pour un compte ainsi que les comportements et actions prévus à entreprendre lorsque le nombre maximal de sessions actives est atteint.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.1.3", + "Ordinal": 3, + "Description": "Vérifiez que tous les systèmes qui créent et gèrent des sessions utilisateur dans le cadre d'un écosystème de gestion des identités fédérées (tels que les systèmes SSO) sont documentés avec des contrôles pour coordonner la durée de vie des sessions, la résiliation et toute autre condition nécessitant une réauthentification.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.2", + "Ordinal": 2, + "Name": "Sécurité fondamentale de la gestion des sessions", + "Items": [ + { + "Shortcode": "V7.2.1", + "Ordinal": 1, + "Description": "Vérifiez que l’application effectue toutes les vérifications des jetons de session à l’aide d’un service backend de confiance.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.2.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application utilise des jetons autonomes ou de référence générés dynamiquement pour la gestion des sessions, c'est-à-dire sans utiliser de secrets et de clés d'API statiques.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.2.3", + "Ordinal": 3, + "Description": "Vérifiez que si des jetons par référence sont utilisés pour représenter les sessions utilisateur, ils sont uniques et générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et possèdent au moins 128 bits d'entropie.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.2.4", + "Ordinal": 4, + "Description": "Vérifiez que l’application génère un nouveau jeton de session lors de l’authentification de l’utilisateur, y compris la réauthentification, et met fin au jeton de session actuel.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.3", + "Ordinal": 3, + "Name": "Délai d'expiration de la session", + "Items": [ + { + "Shortcode": "V7.3.1", + "Ordinal": 1, + "Description": "Vérifiez qu’il existe un délai d’inactivité tel que la réauthentification soit appliquée conformément à l’analyse des risques et aux décisions de sécurité documentées.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.3.2", + "Ordinal": 2, + "Description": "Vérifiez qu'il existe une durée de vie maximale absolue de la session de sorte que la réauthentification soit appliquée conformément à l'analyse des risques et aux décisions de sécurité documentées.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.4", + "Ordinal": 4, + "Name": "Fin de session", + "Items": [ + { + "Shortcode": "V7.4.1", + "Ordinal": 1, + "Description": "Vérifiez que lorsque la fin de session est déclenchée (par exemple, déconnexion ou expiration), l'application interdit toute utilisation ultérieure de la session. Pour les jetons par référence ou les sessions avec état, cela implique l'invalidation des données de session au niveau du backend de l'application. Les applications utilisant des jetons autonomes nécessiteront une solution, comme la gestion d'une liste des jetons terminés, l'interdiction des jetons produits avant une date et une heure spécifique à chaque utilisateur ou la rotation d'une clé de signature spécifique à chaque utilisateur.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.4.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application met fin à toutes les sessions actives lorsqu'un compte utilisateur est désactivé ou supprimé (par exemple, lorsqu'un employé quitte l'entreprise).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.4.3", + "Ordinal": 3, + "Description": "Vérifiez que l'application offre la possibilité de mettre fin à toutes les autres sessions actives après une modification ou une suppression réussie de tout facteur d'authentification (y compris la modification du mot de passe via une réinitialisation ou une récupération et, le cas échéant, une mise à jour des paramètres MFA).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.4.4", + "Ordinal": 4, + "Description": "Vérifiez que toutes les pages nécessitant une authentification disposent d’un accès facile et visible à la fonctionnalité de déconnexion.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.4.5", + "Ordinal": 5, + "Description": "Vérifiez que les administrateurs d’applications sont en mesure de mettre fin aux sessions actives pour un utilisateur individuel ou pour tous les utilisateurs.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.5", + "Ordinal": 5, + "Name": "Défenses contre les abus de session", + "Items": [ + { + "Shortcode": "V7.5.1", + "Ordinal": 1, + "Description": "Vérifiez que l'application nécessite une réauthentification complète avant d'autoriser les modifications des attributs de compte sensibles qui peuvent affecter l'authentification, tels que l'adresse e-mail, le numéro de téléphone, la configuration MFA ou d'autres informations utilisées dans la récupération de compte.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.5.2", + "Ordinal": 2, + "Description": "Vérifiez que les utilisateurs peuvent afficher et (après s'être authentifiés à nouveau avec au moins un facteur) terminer une ou toutes les sessions actuellement actives.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.5.3", + "Ordinal": 3, + "Description": "Vérifiez que l’application nécessite une authentification supplémentaire avec au moins un facteur ou une vérification secondaire avant d’effectuer des transactions ou des opérations hautement sensibles.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.6", + "Ordinal": 6, + "Name": "Réauthentification fédérée", + "Items": [ + { + "Shortcode": "V7.6.1", + "Ordinal": 1, + "Description": "Vérifiez que la durée de vie et la fin de la session entre les parties de confiance (RP) et les fournisseurs d'identité (IdP) se comportent comme documenté, en exigeant une réauthentification si nécessaire, par exemple lorsque le temps maximal entre les événements d'authentification IdP est atteint.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.6.2", + "Ordinal": 2, + "Description": "Vérifiez que la création d'une session nécessite soit le consentement de l'utilisateur, soit une action explicite, empêchant ainsi la création de nouvelles sessions d'application sans interaction de l'utilisateur.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V8", + "Ordinal": 8, + "ShortName": "Authorization", + "Name": "Autorisation", + "Items": [ + { + "Shortcode": "V8.1", + "Ordinal": 1, + "Name": "Documentation d'autorisation", + "Items": [ + { + "Shortcode": "V8.1.1", + "Ordinal": 1, + "Description": "Vérifiez que la documentation d’autorisation définit des règles de restriction de l’accès au niveau de la fonction et aux données en fonction des autorisations du consommateur et des attributs des ressources.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.1.2", + "Ordinal": 2, + "Description": "Vérifiez que la documentation d'autorisation définit les règles de restriction d'accès au niveau des champs (lecture et écriture) en fonction des autorisations des consommateurs et des attributs des ressources. Notez que ces règles peuvent dépendre d'autres valeurs d'attributs de l'objet de données concerné, telles que l'état ou le statut.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.1.3", + "Ordinal": 3, + "Description": "Vérifiez que la documentation de l'application définit les attributs environnementaux et contextuels (y compris, mais sans s'y limiter, l'heure de la journée, l'emplacement de l'utilisateur, l'adresse IP ou l'appareil) qui sont utilisés dans l'application pour prendre des décisions de sécurité, y compris celles relatives à l'authentification et à l'autorisation.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.1.4", + "Ordinal": 4, + "Description": "Vérifier que la documentation d'authentification et d'autorisation définit l'utilisation des facteurs environnementaux et contextuels dans la prise de décision, en plus des autorisations au niveau des fonctions, des données et des champs. Cela doit inclure les attributs évalués, les seuils de risque et les actions entreprises (par exemple, autorisation, contestation, refus, renforcement de l'authentification).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V8.2", + "Ordinal": 2, + "Name": "Conception d'autorisation générale", + "Items": [ + { + "Shortcode": "V8.2.1", + "Ordinal": 1, + "Description": "Vérifiez que l’application garantit que l’accès basé sur la fonction est limité aux consommateurs disposant d’autorisations explicites.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.2.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application garantit que l'accès spécifique aux données est limité aux consommateurs disposant d'autorisations explicites sur des éléments de données spécifiques afin d'atténuer les références d'objet directes non sécurisées (IDOR) et les autorisations de niveau d'objet rompues (BOLA).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l'application garantit que l'accès au niveau du champ est limité aux consommateurs disposant d'autorisations explicites sur des champs spécifiques afin d'atténuer les problèmes d'autorisation au niveau de la propriété d'objet (BOPLA).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.2.4", + "Ordinal": 4, + "Description": "Vérifiez que les contrôles de sécurité adaptatifs basés sur les attributs environnementaux et contextuels du consommateur (tels que l'heure, la localisation, l'adresse IP ou l'appareil) sont mis en œuvre pour les décisions d'authentification et d'autorisation, comme défini dans la documentation de l'application. Ces contrôles doivent être appliqués lorsque le consommateur tente de démarrer une nouvelle session et également pendant une session existante.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V8.3", + "Ordinal": 3, + "Name": "Autorisation par opération", + "Items": [ + { + "Shortcode": "V8.3.1", + "Ordinal": 1, + "Description": "Vérifier que l'application applique les règles d'autorisations au niveau de la couche service de confiance et ne s’appuie pas sur des contrôles qu’un consommateur non approuvé pourrait manipuler, comme JavaScript côté client.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.3.2", + "Ordinal": 2, + "Description": "Vérifiez que les modifications apportées aux valeurs sur lesquelles reposent les décisions d'autorisation sont appliquées immédiatement. Lorsque les modifications ne peuvent pas être appliquées immédiatement (par exemple, en s'appuyant sur des données de jetons autonomes), des contrôles d'atténuation doivent être mis en place pour alerter un consommateur lorsqu'il effectue une action alors qu'il n'est plus autorisé à le faire et annuler la modification. Notez que cette solution alternative ne limiterait pas les fuites d'informations.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.3.3", + "Ordinal": 3, + "Description": "Vérifiez que l'accès à un objet repose sur les autorisations du sujet d'origine (par exemple, le consommateur), et non sur celles d'un intermédiaire ou d'un service agissant en son nom. Par exemple, si un consommateur appelle un service web à l'aide d'un jeton d'authentification autonome, et que ce service demande ensuite des données à un autre service, ce dernier utilisera le jeton du consommateur, plutôt qu'un jeton inter-machine du premier service, pour prendre les décisions d'autorisation.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V8.4", + "Ordinal": 4, + "Name": "Autres considérations relatives à l'autorisation", + "Items": [ + { + "Shortcode": "V8.4.1", + "Ordinal": 1, + "Description": "Vérifiez que les applications multi-tenants utilisent des contrôles inter-tenants pour garantir que les opérations des consommateurs n'affecteront jamais les tenants avec lesquels ils ne sont pas autorisés à interagir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.4.2", + "Ordinal": 2, + "Description": "Vérifiez que l'accès aux interfaces administratives intègre plusieurs couches de sécurité, notamment la vérification continue de l'identité du consommateur, l'évaluation de la posture de sécurité des appareils et l'analyse contextuelle des risques, garantissant que l'emplacement du réseau ou les endpoints approuvés ne sont pas les seuls facteurs d'autorisation, même s'ils peuvent réduire la probabilité d'accès non autorisé.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V9", + "Ordinal": 9, + "ShortName": "Self", + "Name": "Jetons autonomes", + "Items": [ + { + "Shortcode": "V9.1", + "Ordinal": 1, + "Name": "Source et intégrité du jeton", + "Items": [ + { + "Shortcode": "V9.1.1", + "Ordinal": 1, + "Description": "Vérifiez que les jetons autonomes sont validés à l'aide de leur signature numérique ou MAC pour les protéger contre toute falsification avant d'accepter le contenu du jeton.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.1.2", + "Ordinal": 2, + "Description": "Vérifiez que seuls les algorithmes d'une liste d’autorisations peuvent être utilisés pour créer et vérifier des jetons autonomes, dans un contexte donné. La liste d'autorisation doit inclure les algorithmes autorisés, idéalement symétriques ou asymétriques, et ne doit pas inclure l'algorithme « Aucun ». Si les algorithmes symétriques et asymétriques doivent être pris en charge, des contrôles supplémentaires seront nécessaires pour éviter toute confusion de clés.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.1.3", + "Ordinal": 3, + "Description": "Vérifiez que les clés utilisées pour valider les jetons autonomes proviennent de sources préconfigurées et fiables pour l'émetteur du jeton, empêchant ainsi les attaquants de spécifier des sources et des clés non fiables. Pour les JWT et autres structures JWS, les en-têtes tels que « jku », « x5u » et « jwk » doivent être validés par rapport à une liste d'autorisation de sources fiables.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V9.2", + "Ordinal": 2, + "Name": "Contenu du jeton", + "Items": [ + { + "Shortcode": "V9.2.1", + "Ordinal": 1, + "Description": "Vérifiez que, si une période de validité est indiquée dans les données du jeton, celui-ci et son contenu ne sont acceptés que si la date de vérification est comprise dans cette période. Par exemple, pour les JWT, les déclarations « nbf » et « exp » doivent être vérifiées.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.2.2", + "Ordinal": 2, + "Description": "Vérifiez que le service recevant un jeton valide le type de jeton et son utilisation avant d'en accepter le contenu. Par exemple, seuls les jetons d'accès peuvent être acceptés pour les décisions d'autorisation, et seuls les jetons d'identification peuvent être utilisés pour prouver l'authentification des utilisateurs.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.2.3", + "Ordinal": 3, + "Description": "Vérifiez que le service accepte uniquement les jetons destinés à être utilisés avec ce service (audience). Pour les JWT, cela peut être réalisé en validant la déclaration « aud » par rapport à une liste d'autorisation définie dans le service.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.2.4", + "Ordinal": 4, + "Description": "Si un émetteur de jetons utilise la même clé privée pour émettre des jetons destinés à différentes audiences, vérifiez que les jetons émis contiennent une restriction d'audience identifiant de manière unique les audiences visées. Cela empêchera la réutilisation d'un jeton avec une audience non prévue. Si l'identifiant d'audience est provisionné dynamiquement, l'émetteur de jetons doit valider ces audiences afin de garantir qu'elles n'entraînent pas d'usurpation d'identité.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V10", + "Ordinal": 10, + "ShortName": "OAuth", + "Name": "Oauth et OIDC", + "Items": [ + { + "Shortcode": "V10.1", + "Ordinal": 1, + "Name": "Sécurité générique OAuth et OIDC", + "Items": [ + { + "Shortcode": "V10.1.1", + "Ordinal": 1, + "Description": "Vérifiez que les jetons sont envoyés uniquement aux composants qui en ont absolument besoin. Par exemple, lors de l'utilisation d'un modèle backend-for-frontend pour les applications JavaScript basées sur un navigateur, les jetons d'accès et d'actualisation ne doivent être accessibles qu'au backend.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.1.2", + "Ordinal": 2, + "Description": "Vérifiez que le client n'accepte les valeurs du serveur d'autorisation (telles que le code d'autorisation ou le jeton d'identification) que si elles résultent d'un flux d'autorisation initié par la même session d'agent utilisateur et la même transaction. Cela nécessite que les secrets générés par le client, tels que la clé de preuve pour l'échange de codes (PKCE) « code_verifier », « state » ou le nonce OIDC, ne puissent être devinés, soient spécifiques à la transaction et soient liés de manière sécurisée au client et à la session d'agent utilisateur au cours de laquelle la transaction a été initiée.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.2", + "Ordinal": 2, + "Name": "Client OAuth", + "Items": [ + { + "Shortcode": "V10.2.1", + "Ordinal": 1, + "Description": "Vérifiez que, si le flux de code est utilisé, le client OAuth dispose d'une protection contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF), qui déclenchent des demandes de jetons, soit en utilisant la fonctionnalité de clé de preuve pour l'échange de code (PKCE), soit en vérifiant le paramètre « state » envoyé dans la demande d'autorisation.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.2.2", + "Ordinal": 2, + "Description": "Vérifiez que, si le client OAuth peut interagir avec plusieurs serveurs d'autorisation, il dispose d'une protection contre les attaques par confusion. Par exemple, il peut exiger que le serveur d'autorisation renvoie la valeur du paramètre « iss » et la valide dans la réponse d'autorisation et la réponse du jeton.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.2.3", + "Ordinal": 3, + "Description": "Vérifiez que le client OAuth demande uniquement les portées requises (ou d’autres paramètres d’autorisation) dans les requêtes adressées au serveur d’autorisation.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.3", + "Ordinal": 3, + "Name": "Serveur de ressources OAuth", + "Items": [ + { + "Shortcode": "V10.3.1", + "Ordinal": 1, + "Description": "Vérifiez que le serveur de ressources accepte uniquement les jetons d'accès destinés à être utilisés avec ce service (audience). L'audience peut être incluse dans un jeton d'accès structuré (comme la déclaration « aud » dans JWT) ou vérifiée à l'aide du endpoint d'introspection de jeton.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.3.2", + "Ordinal": 2, + "Description": "Vérifiez que le serveur de ressources applique les décisions d'autorisation en fonction des déclarations du jeton d'accès définissant l'autorisation déléguée. Si des déclarations telles que « sub », « scope » et « authorization_details » sont présentes, elles doivent être prises en compte dans la décision.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.3.3", + "Ordinal": 3, + "Description": "Vérifiez que si une décision de contrôle d'accès nécessite l'identification d'un utilisateur unique à partir d'un jeton d'accès (JWT ou réponse d'introspection de jeton associé), le serveur de ressources identifie l'utilisateur à partir de déclarations non ré attribuables à d'autres utilisateurs. En général, cela implique l'utilisation d'une combinaison de déclarations « iss » et « sub ».", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.3.4", + "Ordinal": 4, + "Description": "Si le serveur de ressources requiert une force d'authentification, des méthodes ou une date d'expiration spécifiques, vérifiez que le jeton d'accès présenté respecte ces contraintes. Par exemple, s'il est présent, utilisez les déclarations OIDC « acr », « amr » et « auth_time » respectivement.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.3.5", + "Ordinal": 5, + "Description": "Vérifiez que le serveur de ressources empêche l'utilisation de jetons d'accès volés ou la relecture de jetons d'accès (de parties non autorisées) en exigeant des jetons d'accès limités par l'expéditeur, soit Mutual TLS pour OAuth 2, soit OAuth 2 Demonstration of Proof of Possession (DPoP).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.4", + "Ordinal": 4, + "Name": "Serveur d'autorisation OAuth", + "Items": [ + { + "Shortcode": "V10.4.1", + "Ordinal": 1, + "Description": "Vérifiez que le serveur d'autorisation valide les URI de redirection en fonction d'une liste d'autorisation spécifique au client d'URI préenregistrés à l'aide d'une comparaison de chaînes exacte.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.2", + "Ordinal": 2, + "Description": "Vérifiez que, si le serveur d'autorisation renvoie le code d'autorisation dans la réponse, celui-ci ne peut être utilisé qu'une seule fois pour une demande de jeton. Pour la deuxième demande valide avec un code d'autorisation déjà utilisé pour émettre un jeton d'accès, le serveur d'autorisation doit rejeter la demande de jeton et révoquer tous les jetons émis liés au code d'autorisation.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.3", + "Ordinal": 3, + "Description": "Vérifiez que le code d'autorisation est de courte durée. La durée de vie maximale peut atteindre 10 minutes pour les applications L1 et L2 et 1 minute pour les applications L3.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.4", + "Ordinal": 4, + "Description": "Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement l'utilisation des autorisations nécessaires à ce client. Notez que les autorisations « token » (flux implicite) et « password » (flux d'informations d'identification du propriétaire de la ressource) ne doivent plus être utilisées.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.5", + "Ordinal": 5, + "Description": "Vérifiez que le serveur d'autorisation atténue les attaques par rejeu de jetons d'actualisation pour les clients publics, de préférence en utilisant des jetons d'actualisation limités par l'expéditeur, par exemple des jetons DPoP (Demonstrating Proof of Possession) ou des jetons d'accès liés à un certificat utilisant le protocole TLS mutuel (mTLS). Pour les applications L1 et L2, la rotation des jetons d'actualisation peut être utilisée. Si cette rotation est utilisée, le serveur d'autorisation doit invalider le jeton d'actualisation après utilisation et révoquer tous les jetons d'actualisation de cette autorisation si un jeton d'actualisation déjà utilisé et invalidé est fourni.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.6", + "Ordinal": 6, + "Description": "Vérifiez que, si l'octroi de code est utilisé, le serveur d'autorisation atténue les attaques par interception de code en exigeant une clé de preuve pour l'échange de code (PKCE). Pour les demandes d'autorisation, le serveur d'autorisation doit exiger une valeur « code_challenge » valide et ne doit pas accepter une valeur « plain » pour « code_challenge_method ». Pour une demande de jeton, il doit exiger la validation du paramètre « code_verifier ».", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.7", + "Ordinal": 7, + "Description": "Vérifiez que si le serveur d'autorisation prend en charge l'enregistrement dynamique des clients non authentifiés, il réduit le risque d'applications clientes malveillantes. Il doit valider les métadonnées clientes, telles que les URI enregistrés, garantir le consentement de l'utilisateur et l'avertir avant de traiter une demande d'autorisation avec une application cliente non approuvée.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.8", + "Ordinal": 8, + "Description": "Vérifiez que les jetons d’actualisation ont une expiration absolue, y compris si l’expiration du jeton d’actualisation glissant est appliquée.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.9", + "Ordinal": 9, + "Description": "Vérifiez que les jetons d'actualisation et les jetons d'accès de référence peuvent être révoqués par un utilisateur autorisé à l'aide de l'interface utilisateur du serveur d'autorisation, afin d'atténuer le risque de clients malveillants ou de jetons volés.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.10", + "Ordinal": 10, + "Description": "Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.11", + "Ordinal": 11, + "Description": "Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.12", + "Ordinal": 12, + "Description": "Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement la valeur « response_mode » dont ce client a besoin. Par exemple, en vérifiant cette valeur par rapport aux valeurs attendues ou en utilisant une requête d'autorisation poussée (PAR) ou une requête d'autorisation sécurisée par JWT (JAR).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.13", + "Ordinal": 13, + "Description": "Vérifiez que le type d'Autorisation « code » est toujours utilisé avec les demandes d'autorisation poussées (PAR).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.14", + "Ordinal": 14, + "Description": "Vérifiez que le serveur d'autorisation émet uniquement des jetons d'accès limités à l'expéditeur (preuve de possession), soit avec des jetons d'accès liés au certificat utilisant TLS mutuel (mTLS), soit avec des jetons d'accès liés au DPoP (démonstration de preuve de possession).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.15", + "Ordinal": 15, + "Description": "Vérifiez que, pour un client côté serveur (non exécuté sur l'appareil de l'utilisateur final), le serveur d'autorisation garantit que la valeur du paramètre « authorization_details » provient du backend client et que l'utilisateur ne l'a pas altérée. Par exemple, en exigeant l'utilisation d'une demande d'autorisation poussée (PAR) ou d'une demande d'autorisation sécurisée par JWT (JAR).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.16", + "Ordinal": 16, + "Description": "Vérifiez que le client est confidentiel et que le serveur d'autorisation requiert l'utilisation de méthodes d'authentification client fortes (basées sur la cryptographie à clé publique et résistantes aux attaques par relecture), telles que TLS mutuel ('tls_client_auth', 'self_signed_tls_client_auth') ou JWT à clé privée ('private_key_jwt').", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.5", + "Ordinal": 5, + "Name": "Client OIDC", + "Items": [ + { + "Shortcode": "V10.5.1", + "Ordinal": 1, + "Description": "Vérifiez que le client (en tant que partie utilisatrice) atténue les attaques par rejeu de jeton d'identification. Par exemple, en vous assurant que la valeur « nonce » du jeton d'identification correspond à la valeur « nonce » envoyée dans la demande d'authentification au fournisseur OpenID (appelée demande d'autorisation envoyée au serveur d'autorisation dans OAuth2).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.5.2", + "Ordinal": 2, + "Description": "Vérifiez que le client identifie de manière unique l'utilisateur à partir des déclarations de jeton d'identification, généralement la déclaration « sub », qui ne peut pas être réaffectée à d'autres utilisateurs (pour la portée d'un fournisseur d'identité).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.5.3", + "Ordinal": 3, + "Description": "Vérifiez que le client rejette les tentatives d'un serveur d'autorisation malveillant d'usurper l'identité d'un autre serveur d'autorisation via ses métadonnées. Le client doit rejeter les métadonnées du serveur d'autorisation si l'URL de l'émetteur figurant dans ces métadonnées ne correspond pas exactement à l'URL d'émetteur préconfigurée attendue par le client.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.5.4", + "Ordinal": 4, + "Description": "Vérifiez que le client valide que le jeton d'identification est destiné à être utilisé pour ce client (audience) en vérifiant que la déclaration « aud » du jeton est égale à la valeur « client_id » pour le client.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.5.5", + "Ordinal": 5, + "Description": "Vérifiez que, lors de l'utilisation de la déconnexion du back-channel OIDC, la partie utilisatrice atténue les risques de déni de service liés à la déconnexion forcée et à la confusion entre JWT dans le flux de déconnexion. Le client doit vérifier que le jeton de déconnexion est correctement typé avec la valeur « logout+jwt », qu'il contient la déclaration « event » avec le nom de membre correct et qu'il ne contient pas de déclaration « nonce ». Il est également recommandé d'utiliser une expiration courte (par exemple, 2 minutes).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.6", + "Ordinal": 6, + "Name": "Fournisseur OpenID", + "Items": [ + { + "Shortcode": "V10.6.1", + "Ordinal": 1, + "Description": "Vérifiez que le fournisseur OpenID n'autorise que les valeurs « code », « ciba », « id_token » ou « id_token code » pour le mode de réponse. Notez que « code » est préférable à « id_token code » (flux hybride OIDC) et que « token » (tout flux implicite) ne doit pas être utilisé.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.6.2", + "Ordinal": 2, + "Description": "Vérifiez que le fournisseur OpenID atténue les risques de déni de service liés à la déconnexion forcée. Pour ce faire, obtenez une confirmation explicite de l'utilisateur final ou, le cas échéant, validez les paramètres de la requête de déconnexion (initiée par la partie utilisatrice), comme « id_token_hint ».", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.7", + "Ordinal": 7, + "Name": "Gestion du consentement", + "Items": [ + { + "Shortcode": "V10.7.1", + "Ordinal": 1, + "Description": "Vérifiez que le serveur d'autorisation garantit le consentement de l'utilisateur à chaque demande d'autorisation. Si l'identité du client ne peut être garantie, le serveur d'autorisation doit toujours demander explicitement le consentement de l'utilisateur.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.7.2", + "Ordinal": 2, + "Description": "Vérifiez que lorsque le serveur d'autorisation demande le consentement de l'utilisateur, il fournit des informations claires et suffisantes sur ce qui est consenti. Le cas échéant, ces informations doivent inclure la nature des autorisations demandées (généralement en fonction de la portée, du serveur de ressources et des détails d'autorisation RAR), l'identité de l'application autorisée et la durée de vie de ces autorisations.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.7.3", + "Ordinal": 3, + "Description": "Vérifiez que l’utilisateur peut consulter, modifier et révoquer les consentements qu’il a accordés via le serveur d’autorisation.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V11", + "Ordinal": 11, + "ShortName": "Cryptography", + "Name": "Cryptographie", + "Items": [ + { + "Shortcode": "V11.1", + "Ordinal": 1, + "Name": "Inventaire et documentation cryptographiques", + "Items": [ + { + "Shortcode": "V11.1.1", + "Ordinal": 1, + "Description": "Vérifiez qu’il existe une politique documentée pour la gestion des clés cryptographiques et un cycle de vie des clés cryptographiques qui suit une norme de gestion des clés telle que NIST SP 800-57. Cela devrait inclure la garantie que les clés ne sont pas sur-partagées (par exemple, avec plus de deux entités pour les secrets partagés et plus d’une entité pour les clés privées).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.1.2", + "Ordinal": 2, + "Description": "Vérifiez qu'un inventaire cryptographique est réalisé, maintenu et régulièrement mis à jour, et qu'il inclut toutes les clés, algorithmes et certificats cryptographiques utilisés par l'application. Il doit également documenter les emplacements du système où les clés peuvent ou non être utilisées, ainsi que les types de données qui peuvent ou non être protégées par ces clés.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.1.3", + "Ordinal": 3, + "Description": "Vérifiez que les mécanismes de découverte cryptographique sont utilisés pour identifier toutes les instances de cryptographie dans le système, y compris les opérations de chiffrement, de hachage et de signature.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.1.4", + "Ordinal": 4, + "Description": "Vérifier la tenue d'un inventaire cryptographique. Celui-ci doit inclure un plan documenté décrivant la migration vers de nouvelles normes cryptographiques, telles que la cryptographie post-quantique, afin de réagir aux menaces futures.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.2", + "Ordinal": 2, + "Name": "Mise en œuvre sécurisée de la cryptographie", + "Items": [ + { + "Shortcode": "V11.2.1", + "Ordinal": 1, + "Description": "Vérifiez que les implémentations validées par l’industrie (y compris les bibliothèques et les implémentations accélérées par le matériel) sont utilisées pour les opérations cryptographiques.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.2.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application est conçue avec une agilité cryptographique, de sorte que les nombres aléatoires, le chiffrement authentifié, le MAC ou les algorithmes de hachage, les longueurs de clés, les tours, les chiffrements et les modes puissent être reconfigurés, mis à niveau ou échangés à tout moment, afin de se protéger contre les failles cryptographiques. De même, il doit être possible de remplacer les clés et les mots de passe, ainsi que de rechiffrer les données. Cela permettra des mises à niveau transparentes vers la cryptographie post-quantique (PQC), une fois que des implémentations hautement sécurisées de schémas ou de normes PQC approuvés seront largement disponibles.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.2.3", + "Ordinal": 3, + "Description": "Vérifiez que toutes les primitives cryptographiques utilisent un minimum de 128 bits de sécurité en fonction de l'algorithme, de la taille de la clé et de la configuration. Par exemple, une clé ECC de 256 bits offre environ 128 bits de sécurité, tandis que RSA nécessite une clé de 3072 bits pour atteindre 128 bits de sécurité.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.2.4", + "Ordinal": 4, + "Description": "Vérifiez que toutes les opérations cryptographiques sont à temps constant, sans opérations de « court-circuit » dans les comparaisons, les calculs ou les retours, pour éviter toute fuite d'informations.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.2.5", + "Ordinal": 5, + "Description": "Vérifiez que tous les modules cryptographiques échouent en toute sécurité et que les erreurs sont gérées de manière à ne pas permettre de vulnérabilités, telles que les attaques Padding Oracle.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.3", + "Ordinal": 3, + "Name": "Algorithmes de chiffrement", + "Items": [ + { + "Shortcode": "V11.3.1", + "Ordinal": 1, + "Description": "Vérifiez que les modes de bloc non sécurisés (par exemple, ECB) et les schémas de remplissage faibles (par exemple, PKCS#1 v1.5) ne sont pas utilisés.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.3.2", + "Ordinal": 2, + "Description": "Vérifiez que seuls les chiffrements et modes approuvés tels que AES avec GCM sont utilisés.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.3.3", + "Ordinal": 3, + "Description": "Vérifiez que les données chiffrées sont protégées contre toute modification non autorisée, de préférence en utilisant une méthode de chiffrement authentifiée approuvée ou en combinant une méthode de chiffrement approuvée avec un algorithme MAC approuvé.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.3.4", + "Ordinal": 4, + "Description": "Vérifiez que les nonces, les vecteurs d'initialisation et autres nombres à usage unique ne sont pas utilisés pour plus d'une paire clé de chiffrement/élément de données. La méthode de génération doit être adaptée à l'algorithme utilisé.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.3.5", + "Ordinal": 5, + "Description": "Vérifiez que toute combinaison d'un algorithme de chiffrement et d'un algorithme MAC fonctionne en mode chiffrement puis MAC.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.4", + "Ordinal": 4, + "Name": "Hachage et fonctions basées sur le hachage", + "Items": [ + { + "Shortcode": "V11.4.1", + "Ordinal": 1, + "Description": "Vérifiez que seules les fonctions de hachage approuvées sont utilisées pour les cas d'utilisation cryptographiques généraux, notamment les signatures numériques, HMAC, KDF et la génération de bits aléatoires. Les fonctions de hachage non autorisées, telles que MD5, ne doivent pas être utilisées à des fins cryptographiques.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.4.2", + "Ordinal": 2, + "Description": "Vérifiez que les mots de passe sont stockés à l'aide d'une fonction de dérivation de clés approuvée et gourmande en ressources de calcul (également appelée « fonction de hachage de mots de passe »), dont les paramètres sont configurés conformément aux directives en vigueur. Ces paramètres doivent équilibrer sécurité et performances afin de rendre les attaques par force brute suffisamment difficiles pour le niveau de sécurité requis.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.4.3", + "Ordinal": 3, + "Description": "Vérifiez que les fonctions de hachage utilisées dans les signatures numériques, dans le cadre de l'authentification ou de l'intégrité des données, sont résistantes aux collisions et possèdent des longueurs de bits appropriées. Si la résistance aux collisions est requise, la longueur de sortie doit être d'au moins 256 bits. Si seule la résistance aux attaques de seconde pré-image est requise, la longueur de sortie doit être d'au moins 128 bits.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.4.4", + "Ordinal": 4, + "Description": "Vérifiez que l'application utilise des fonctions de dérivation de clés approuvées avec des paramètres d'extension de clés lors de la dérivation de clés secrètes à partir de mots de passe. Les paramètres utilisés doivent concilier sécurité et performances afin d'empêcher les attaques par force brute de compromettre la clé cryptographique obtenue.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.5", + "Ordinal": 5, + "Name": "Valeurs aléatoires", + "Items": [ + { + "Shortcode": "V11.5.1", + "Ordinal": 1, + "Description": "Vérifiez que tous les nombres et chaînes aléatoires destinés à être non devinables doivent être générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et posséder au moins 128 bits d'entropie. Notez que les UUID ne respectent pas cette condition.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.5.2", + "Ordinal": 2, + "Description": "Vérifiez que le mécanisme de génération de nombres aléatoires utilisé est conçu pour fonctionner en toute sécurité, même en cas de forte demande.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.6", + "Ordinal": 6, + "Name": "Cryptographie à clé publique", + "Items": [ + { + "Shortcode": "V11.6.1", + "Ordinal": 1, + "Description": "Vérifier que seuls des algorithmes cryptographiques et des modes opératoires approuvés sont utilisés pour la génération et l'amorçage des clés, ainsi que pour la génération et la vérification des signatures numériques. Les algorithmes de génération de clés ne doivent pas générer de clés non sécurisées et vulnérables aux attaques connues, par exemple les clés RSA vulnérables à la factorisation de Fermat.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.6.2", + "Ordinal": 2, + "Description": "Vérifiez que des algorithmes cryptographiques approuvés sont utilisés pour l'échange de clés (tels que Diffie-Hellman), en veillant à ce que les mécanismes d'échange de clés utilisent des paramètres sécurisés. Cela permettra d'éviter les attaques contre le processus d'établissement des clés, susceptibles de conduire à des attaques de type « adversaire du milieu » ou à des failles cryptographiques.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.7", + "Ordinal": 7, + "Name": "Cryptographie des données en cours d'utilisation", + "Items": [ + { + "Shortcode": "V11.7.1", + "Ordinal": 1, + "Description": "Vérifiez que le chiffrement complet de la mémoire est utilisé pour protéger les données sensibles pendant leur utilisation, empêchant ainsi l'accès par des utilisateurs ou des processus non autorisés.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.7.2", + "Ordinal": 2, + "Description": "Vérifiez que la minimisation des données garantit que la quantité minimale de données est exposée pendant le traitement et assurez-vous que les données sont chiffrées immédiatement après utilisation ou dès que possible.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V12", + "Ordinal": 12, + "ShortName": "Secure", + "Name": "Communication sécurisée", + "Items": [ + { + "Shortcode": "V12.1", + "Ordinal": 1, + "Name": "Conseils généraux de sécurité TLS", + "Items": [ + { + "Shortcode": "V12.1.1", + "Ordinal": 1, + "Description": "Vérifiez que seules les dernières versions recommandées du protocole TLS sont activées, telles que TLS 1.2 et TLS 1.3. La dernière version du protocole TLS doit être privilégiée.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.1.2", + "Ordinal": 2, + "Description": "Vérifiez que seules les suites de chiffrement recommandées sont activées, les suites de chiffrement les plus puissantes étant définies comme préférées. Les applications L3 doivent uniquement prendre en charge les suites de chiffrement assurant la confidentialité persistante (forward secrecy).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.1.3", + "Ordinal": 3, + "Description": "Vérifiez que l’application valide que les certificats clients mTLS sont approuvés avant d’utiliser l’identité du certificat pour l’authentification ou l’autorisation.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.1.4", + "Ordinal": 4, + "Description": "Vérifiez que la révocation de certification appropriée, telle que l'agrafage du protocole OCSP (Online Certificate Status Protocol), est activée et configurée.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.1.5", + "Ordinal": 5, + "Description": "Vérifiez que Encrypted Client Hello (ECH) est activé dans les paramètres TLS de l'application pour empêcher l'exposition de métadonnées sensibles, telles que l'indication du nom du serveur (SNI), pendant les processus de négociation TLS.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V12.2", + "Ordinal": 2, + "Name": "Communication HTTPS avec des services externes", + "Items": [ + { + "Shortcode": "V12.2.1", + "Ordinal": 1, + "Description": "Vérifiez que TLS est utilisé pour toute connectivité entre un client et des services externes basés sur HTTP, et ne recourt pas à des communications non sécurisées ou non chiffrées.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.2.2", + "Ordinal": 2, + "Description": "Vérifiez que les services externes utilisent des certificats TLS publiquement approuvés.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V12.3", + "Ordinal": 3, + "Name": "Sécurité des communications entre services généraux", + "Items": [ + { + "Shortcode": "V12.3.1", + "Ordinal": 1, + "Description": "Vérifiez qu'un protocole chiffré tel que TLS est utilisé pour toutes les connexions entrantes et sortantes vers et depuis l'application, y compris les systèmes de surveillance, les outils de gestion, l'accès à distance et SSH, les intergiciels, les bases de données, les mainframes, les systèmes partenaires ou les API externes. Le serveur ne doit pas recourir à des protocoles non sécurisés ou non chiffrés.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.3.2", + "Ordinal": 2, + "Description": "Vérifiez que les clients TLS valident les certificats reçus avant de communiquer avec un serveur TLS.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.3.3", + "Ordinal": 3, + "Description": "Vérifiez que TLS ou un autre mécanisme de chiffrement de transport approprié est utilisé pour toute connectivité entre les services internes basés sur HTTP au sein de l'application et ne se replie pas vers des communications non sécurisées ou non chiffrées.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.3.4", + "Ordinal": 4, + "Description": "Vérifiez que les connexions TLS entre les services internes utilisent des certificats de confiance. Lorsque des certificats générés en interne ou auto-signés sont utilisés, le service consommateur doit être configuré pour n'approuver que des autorités de certification internes spécifiques et des certificats auto-signés spécifiques.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.3.5", + "Ordinal": 5, + "Description": "Vérifiez que les services communiquant en interne au sein d'un système (communications intra-services) utilisent une authentification forte pour garantir la vérification de chaque endpoint. Des méthodes d'authentification forte, telles que l'authentification client TLS, doivent être utilisées pour garantir l'identité, en utilisant une infrastructure à clé publique et des mécanismes résistants aux attaques par rejeu. Pour les architectures de microservices, envisagez d'utiliser un maillage de services pour simplifier la gestion des certificats et renforcer la sécurité.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V13", + "Ordinal": 13, + "ShortName": "Configuration", + "Name": "Configuration", + "Items": [ + { + "Shortcode": "V13.1", + "Ordinal": 1, + "Name": "Documentation de configuration", + "Items": [ + { + "Shortcode": "V13.1.1", + "Ordinal": 1, + "Description": "Vérifiez que tous les besoins de communication de l'application sont documentés. Cela doit inclure les services externes dont l'application dépend et les cas où un utilisateur final pourrait fournir un emplacement externe auquel l'application se connectera.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.1.2", + "Ordinal": 2, + "Description": "Vérifiez que pour chaque service utilisé par l'application, la documentation définit le nombre maximal de connexions simultanées (par exemple, les limites du pool de connexions) et le comportement de l'application lorsque cette limite est atteinte, y compris les mécanismes de secours ou de récupération, pour éviter les conditions de déni de service.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.1.3", + "Ordinal": 3, + "Description": "Vérifiez que la documentation de l'application définit des stratégies de gestion des ressources pour chaque système ou service externe utilisé (par exemple, bases de données, descripteurs de fichiers, threads, connexions HTTP). Cela doit inclure les procédures de libération des ressources, les paramètres de délai d'expiration, la gestion des échecs et l'implémentation de la logique de nouvelle tentative, en spécifiant les limites de nouvelle tentative, les délais et les algorithmes de retour arrière. Pour les opérations de requête-réponse HTTP synchrones, la documentation doit imposer des délais d'expiration courts et soit désactiver les nouvelles tentatives, soit les limiter strictement afin d'éviter les retards en cascade et l'épuisement des ressources.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.1.4", + "Ordinal": 4, + "Description": "Vérifiez que la documentation de l'application définit les secrets essentiels à la sécurité de l'application et un calendrier de rotation de ceux-ci, en fonction du modèle de menace et des exigences commerciales de l'organisation.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V13.2", + "Ordinal": 2, + "Name": "Configuration de la communication backend", + "Items": [ + { + "Shortcode": "V13.2.1", + "Ordinal": 1, + "Description": "Vérifiez que les communications entre les composants de l'application backend qui ne prennent pas en charge le mécanisme de session utilisateur standard de l'application, notamment les API, les intergiciels et les couches de données, sont authentifiées. L'authentification doit utiliser des comptes de service individuels, des jetons à court terme ou une authentification par certificat, et non des identifiants immuables tels que des mots de passe, des clés API ou des comptes partagés avec accès privilégié.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.2", + "Ordinal": 2, + "Description": "Vérifiez que les communications entre les composants de l'application backend, y compris les services locaux ou du système d'exploitation, les API, les intergiciels et les couches de données, sont effectuées avec des comptes dotés des privilèges les moins nécessaires.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.3", + "Ordinal": 3, + "Description": "Vérifiez que si des informations d’identification doivent être utilisées pour l’authentification du service, les informations d’identification utilisées par le consommateur ne sont pas des informations d’identification par défaut (par exemple, root/root ou admin/admin).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.4", + "Ordinal": 4, + "Description": "Vérifiez qu'une liste d’autorisations est utilisée pour définir les ressources ou systèmes externes avec lesquels l'application est autorisée à communiquer (par exemple, pour les requêtes sortantes, les chargements de données ou l'accès aux fichiers). Cette liste d'autorisation peut être implémentée au niveau de la couche applicative, du serveur web, du pare-feu ou d'une combinaison de différentes couches.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.5", + "Ordinal": 5, + "Description": "Vérifiez que le serveur Web ou d’application est configuré avec une liste autorisée de ressources ou de systèmes vers lesquels le serveur peut envoyer des requêtes ou charger des données ou des fichiers.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.6", + "Ordinal": 6, + "Description": "Vérifiez que lorsque l'application se connecte à des services distincts, elle suit la configuration documentée pour chaque connexion, comme le nombre maximal de connexions parallèles, le comportement lorsque le nombre maximal de connexions autorisées est atteint, les délais d'expiration de connexion et les stratégies de nouvelle tentative.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V13.3", + "Ordinal": 3, + "Name": "Gestion des secrets", + "Items": [ + { + "Shortcode": "V13.3.1", + "Ordinal": 1, + "Description": "Vérifiez qu'une solution de gestion des secrets, telle qu'un coffre-fort de clés, est utilisée pour créer, stocker, contrôler l'accès et détruire en toute sécurité les secrets backend. Ceux-ci peuvent inclure des mots de passe, du matériel de clé, des intégrations avec des bases de données et des systèmes tiers, des clés et des graines pour des jetons temporels, d'autres secrets internes et des clés API. Les secrets ne doivent pas être inclus dans le code source de l'application ni dans les artefacts de build. Pour une application L3, cela doit impliquer une solution matérielle telle qu'un HSM.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.3.2", + "Ordinal": 2, + "Description": "Vérifiez que l’accès aux ressources secrètes respecte le principe du moindre privilège.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.3.3", + "Ordinal": 3, + "Description": "Vérifiez que toutes les opérations cryptographiques sont effectuées à l'aide d'un module de sécurité isolé (tel qu'un coffre-fort ou un module de sécurité matériel) pour gérer et protéger en toute sécurité le matériel clé contre toute exposition en dehors du module de sécurité.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.3.4", + "Ordinal": 4, + "Description": "Vérifiez que les secrets sont configurés pour expirer et être renouvelés en fonction de la documentation de l'application.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V13.4", + "Ordinal": 4, + "Name": "Fuite d'informations involontaire", + "Items": [ + { + "Shortcode": "V13.4.1", + "Ordinal": 1, + "Description": "Vérifiez que l'application est déployée soit sans aucune métadonnée de contrôle de source, y compris les dossiers .git ou .svn, soit de manière à ce que ces dossiers soient inaccessibles à la fois en externe et à l'application elle-même.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.2", + "Ordinal": 2, + "Description": "Vérifiez que les modes de débogage sont désactivés pour tous les composants dans les environnements de production afin d’éviter l’exposition des fonctionnalités de débogage et la fuite d’informations.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.3", + "Ordinal": 3, + "Description": "Vérifiez que les serveurs Web n’exposent pas les listes de répertoires aux clients, sauf si cela est explicitement prévu.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.4", + "Ordinal": 4, + "Description": "Vérifiez que l’utilisation de la méthode HTTP TRACE n’est pas prise en charge dans les environnements de production, afin d’éviter toute fuite d’informations potentielle.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.5", + "Ordinal": 5, + "Description": "Vérifiez que la documentation (comme pour les API internes) et les endpoints de surveillance ne sont pas exposés, sauf si cela est explicitement prévu.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.6", + "Ordinal": 6, + "Description": "Vérifiez que l’application n’expose pas d’informations de version détaillées des composants backend.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.7", + "Ordinal": 7, + "Description": "Vérifiez que la couche web est configuré pour servir uniquement les fichiers avec des extensions de fichier spécifiques afin d’éviter toute fuite involontaire d’informations, de configuration et de code source.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V14", + "Ordinal": 14, + "ShortName": "Data", + "Name": "Protection des données", + "Items": [ + { + "Shortcode": "V14.1", + "Ordinal": 1, + "Name": "Documentation sur la protection des données", + "Items": [ + { + "Shortcode": "V14.1.1", + "Ordinal": 1, + "Description": "Vérifiez que toutes les données sensibles créées et traitées par l'application ont été identifiées et classées selon leur niveau de protection. Cela inclut les données uniquement codées et donc facilement déchiffrables, telles que les chaînes Base64 ou la charge utile en texte clair d'un JWT. Les niveaux de protection doivent tenir compte des réglementations et normes de protection des données et de confidentialité auxquelles l'application est tenue de se conformer.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.1.2", + "Ordinal": 2, + "Description": "Vérifier que tous les niveaux de protection des données sensibles sont assortis d'un ensemble documenté d'exigences de protection. Cela doit inclure (sans s'y limiter) les exigences relatives au chiffrement général, à la vérification de l'intégrité, à la conservation, à la journalisation des données, aux contrôles d'accès aux données sensibles dans les journaux, au chiffrement au niveau de la base de données, aux technologies de confidentialité et de renforcement de la confidentialité à utiliser, ainsi qu'aux autres exigences de confidentialité.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V14.2", + "Ordinal": 2, + "Name": "Protection générale des données", + "Items": [ + { + "Shortcode": "V14.2.1", + "Ordinal": 1, + "Description": "Vérifiez que les données sensibles sont uniquement envoyées au serveur dans les champs de corps ou d’en-tête du message HTTP, et que l’URL et la chaîne de requête ne contiennent pas d’informations sensibles, telles qu’une clé API ou un jeton de session.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.2", + "Ordinal": 2, + "Description": "Vérifiez que l’application empêche la mise en cache des données sensibles dans les composants du serveur, tels que les équilibreurs de charge et les caches d’application, ou garantit que les données sont purgées en toute sécurité après utilisation.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.3", + "Ordinal": 3, + "Description": "Vérifiez que les données sensibles définies ne sont pas envoyées à des parties non fiables (par exemple, des trackers d'utilisateurs) pour empêcher la collecte indésirable de données en dehors du contrôle de l'application.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.4", + "Ordinal": 4, + "Description": "Vérifiez que les contrôles autour des données sensibles liés au chiffrement, à la vérification de l'intégrité, à la conservation, à la manière dont les données doivent être enregistrées, aux contrôles d'accès autour des données sensibles dans les journaux, à la confidentialité et aux technologies d'amélioration de la confidentialité, sont mis en œuvre comme défini dans la documentation pour le niveau de protection des données spécifiques.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.5", + "Ordinal": 5, + "Description": "Vérifiez que les mécanismes de mise en cache sont configurés pour ne mettre en cache que les réponses dont le type de contenu est conforme à la ressource et qui ne contiennent pas de contenu sensible et dynamique. Le serveur web doit renvoyer une réponse 404 ou 302 lors de l'accès à un fichier inexistant plutôt qu'un fichier valide différent. Cela devrait empêcher les attaques par empoisonnement de cache web.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.6", + "Ordinal": 6, + "Description": "Vérifiez que l'application ne renvoie que les données sensibles minimales requises pour son fonctionnement. Par exemple, ne renvoyez que certains chiffres d'un numéro de carte de crédit, et non le numéro complet. Si les données complètes sont requises, elles doivent être masquées dans l'interface utilisateur, sauf si l'utilisateur les consulte spécifiquement.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.7", + "Ordinal": 7, + "Description": "Vérifiez que les informations sensibles sont soumises à une classification de conservation des données, en veillant à ce que les données obsolètes ou inutiles soient supprimées automatiquement, selon un calendrier défini ou selon les besoins de la situation.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.8", + "Ordinal": 8, + "Description": "Vérifiez que les informations sensibles sont supprimées des métadonnées des fichiers soumis par l'utilisateur, sauf si le stockage est autorisé par l'utilisateur.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V14.3", + "Ordinal": 3, + "Name": "Protection des données côté client", + "Items": [ + { + "Shortcode": "V14.3.1", + "Ordinal": 1, + "Description": "Vérifiez que les données authentifiées sont effacées du stockage client, comme le DOM du navigateur, après la fin du client ou de la session. Le champ d'en-tête de réponse HTTP « Clear-Site-Data » peut être utile, mais le côté client devrait également pouvoir effectuer la correction si la connexion au serveur n'est pas disponible à la fin de la session.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.3.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application définit suffisamment de champs d'en-tête de réponse HTTP anti-caching (c'est-à-dire Cache-Control : no-store) afin que les données sensibles ne soient pas mises en cache dans les navigateurs.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.3.3", + "Ordinal": 3, + "Description": "Vérifiez que les données stockées dans le stockage du navigateur (telles que localStorage, sessionStorage, IndexedDB ou les cookies) ne contiennent pas de données sensibles, à l'exception des jetons de session.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V15", + "Ordinal": 15, + "ShortName": "Secure", + "Name": "Développement et architecture sécurisés", + "Items": [ + { + "Shortcode": "V15.1", + "Ordinal": 1, + "Name": "Documentation sur le développement et l'architecture sécurisés", + "Items": [ + { + "Shortcode": "V15.1.1", + "Ordinal": 1, + "Description": "Vérifiez que la documentation de l'application définit les délais de correction basés sur les risques pour les versions de composants tiers présentant des vulnérabilités et pour la mise à jour des bibliothèques en général, afin de minimiser les risques liés à ces composants.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.1.2", + "Ordinal": 2, + "Description": "Vérifiez qu'un catalogue d'inventaire, tel qu'une nomenclature logicielle (SBOM), est conservé pour toutes les bibliothèques tierces utilisées, y compris en vérifiant que les composants proviennent de référentiels prédéfinis, fiables et continuellement maintenus.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.1.3", + "Ordinal": 3, + "Description": "Vérifiez que la documentation de l'application identifie les fonctionnalités consommatrices en temps ou gourmandes en ressources. Elle doit notamment indiquer comment prévenir une perte de disponibilité due à une utilisation excessive de ces fonctionnalités et éviter que la génération d'une réponse ne prenne plus de temps que le délai d'expiration du consommateur. Les mesures de protection potentielles peuvent inclure le traitement asynchrone, l'utilisation de files d'attente et la limitation des processus parallèles par utilisateur et par application.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.1.4", + "Ordinal": 4, + "Description": "Vérifiez que la documentation de l’application met en évidence les bibliothèques tierces qui sont considérées comme des « composants à risque ».", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.1.5", + "Ordinal": 5, + "Description": "Vérifiez que la documentation de l’application met en évidence les parties de l’application où des « fonctionnalités dangereuses » sont utilisées.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V15.2", + "Ordinal": 2, + "Name": "Architecture de sécurité et dépendances", + "Items": [ + { + "Shortcode": "V15.2.1", + "Ordinal": 1, + "Description": "Vérifiez que l’application contient uniquement des composants qui n’ont pas dépassé les délais de mise à jour et de correction documentés.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.2.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application a mis en œuvre des défenses contre la perte de disponibilité due à des fonctionnalités qui prennent du temps ou qui nécessitent des ressources, sur la base des décisions et stratégies de sécurité documentées à cet effet.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l'environnement de production inclut uniquement les fonctionnalités nécessaires au fonctionnement de l'application et n'expose pas de fonctionnalités superflues telles que du code de test, des exemples d'extraits et des fonctionnalités de développement.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.2.4", + "Ordinal": 4, + "Description": "Vérifiez que les composants tiers et toutes leurs dépendances transitives sont inclus à partir du référentiel attendu, qu'il soit détenu en interne ou qu'il s'agisse d'une source externe, et qu'il n'y a aucun risque d'attaque par confusion de dépendances.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.2.5", + "Ordinal": 5, + "Description": "Vérifiez que l'application implémente des protections supplémentaires autour des parties documentées comme contenant des « fonctionnalités dangereuses » ou utilisant des bibliothèques tierces considérées comme des « composants à risque ». Cela peut inclure des techniques telles que le sandboxing, l'encapsulation, la conteneurisation ou l'isolation au niveau du réseau pour retarder et dissuader les attaquants qui compromettent une partie de l'application de se propager ailleurs.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V15.3", + "Ordinal": 3, + "Name": "Développement défensif", + "Items": [ + { + "Shortcode": "V15.3.1", + "Ordinal": 1, + "Description": "Vérifiez que l'application ne renvoie que le sous-ensemble requis de champs d'un objet de données. Par exemple, elle ne doit pas renvoyer un objet de données entier, car certains champs individuels ne doivent pas être accessibles aux utilisateurs.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.2", + "Ordinal": 2, + "Description": "Vérifiez que lorsque le backend de l'application effectue des appels vers des URL externes, il est configuré pour ne pas suivre les redirections, sauf s'il s'agit d'une fonctionnalité prévue.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.3", + "Ordinal": 3, + "Description": "Vérifiez que l'application dispose de contre-mesures pour se protéger contre les attaques d'affectation de masse en limitant les champs autorisés par contrôleur et action, par exemple, il n'est pas possible d'insérer ou de mettre à jour une valeur de champ lorsqu'elle n'était pas destinée à faire partie de cette action.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.4", + "Ordinal": 4, + "Description": "Vérifiez que tous les composants proxy et middleware transfèrent correctement l'adresse IP d'origine de l'utilisateur à l'aide de champs de données fiables qui ne peuvent pas être manipulés par l'utilisateur final, et que l'application et le serveur Web utilisent cette valeur correcte pour la journalisation et les décisions de sécurité telles que la limitation du débit, en tenant compte du fait que même l'adresse IP d'origine peut ne pas être fiable en raison d'adresses IP dynamiques, de VPN ou de pare-feu d'entreprise.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.5", + "Ordinal": 5, + "Description": "Vérifiez que l'application garantit explicitement que les variables sont du type correct et effectue des opérations d'égalité et de comparaison strictes. Cela permet d'éviter les vulnérabilités liées à la confusion de types, causées par des hypothèses du code de l'application sur le type d'une variable.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.6", + "Ordinal": 6, + "Description": "Vérifiez que le code JavaScript est écrit de manière à éviter la pollution du prototype, par exemple en utilisant Set() ou Map() au lieu de littéraux d'objet.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.7", + "Ordinal": 7, + "Description": "Vérifiez que l'application dispose de défenses contre les attaques de pollution des paramètres HTTP, en particulier si le Framework d'application ne fait aucune distinction quant à la source des paramètres de requête (chaîne de requête, paramètres de corps, cookies ou champs d'en-tête).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V15.4", + "Ordinal": 4, + "Name": "Concurrence sécurisée", + "Items": [ + { + "Shortcode": "V15.4.1", + "Ordinal": 1, + "Description": "Vérifiez que les objets partagés dans le code multithread (tels que les caches, les fichiers ou les objets en mémoire accessibles par plusieurs threads) sont accessibles en toute sécurité à l'aide de types thread-safe et de mécanismes de synchronisation tels que des verrous ou des sémaphores pour éviter les conditions de concurrence et la corruption des données.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.4.2", + "Ordinal": 2, + "Description": "Vérifiez que les vérifications de l'état d'une ressource, comme son existence ou ses autorisations, et des actions qui en dépendent, sont effectuées en une seule opération atomique afin d'éviter les situations de concurrence entre le moment de la vérification et le moment de l'utilisation (TOCTOU). Par exemple, vérifier l'existence d'un fichier avant de l'ouvrir ou l'accès d'un utilisateur avant de l'accorder.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.4.3", + "Ordinal": 3, + "Description": "Vérifiez que les verrous sont utilisés de manière cohérente pour éviter que les threads ne se bloquent, que ce soit en s'attendant les uns les autres ou en réessayant sans fin, et que la logique de verrouillage reste dans le code responsable de la gestion de la ressource pour garantir que les verrous ne peuvent pas être modifiés par inadvertance ou de manière malveillante par des classes ou du code externes.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.4.4", + "Ordinal": 4, + "Description": "Vérifiez que les politiques d'allocation des ressources empêchent la saturation de threads en garantissant un accès équitable aux ressources, par exemple en exploitant les pools de threads, permettant aux threads de priorité inférieure de continuer dans un délai raisonnable.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V16", + "Ordinal": 16, + "ShortName": "Security", + "Name": "Journalisation de sécurité et gestion des erreurs", + "Items": [ + { + "Shortcode": "V16.1", + "Ordinal": 1, + "Name": "Documentation sur la journalisation de sécurité", + "Items": [ + { + "Shortcode": "V16.1.1", + "Ordinal": 1, + "Description": "Vérifiez qu'il existe un inventaire documentant la journalisation effectuée à chaque couche de la pile technologique de l'application, les événements enregistrés, les formats de journal, l'endroit où cette journalisation est stockée, la manière dont elle est utilisée, la manière dont l'accès à celle-ci est contrôlé et la durée de conservation des journaux.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V16.2", + "Ordinal": 2, + "Name": "Journalisation générale", + "Items": [ + { + "Shortcode": "V16.2.1", + "Ordinal": 1, + "Description": "Vérifiez que chaque entrée de journal inclut les métadonnées nécessaires (telles que quand, où, qui, quoi) qui permettraient une enquête détaillée sur la chronologie lorsqu'un événement se produit.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.2.2", + "Ordinal": 2, + "Description": "Vérifiez que les sources de temps de tous les composants de journalisation sont synchronisées et que les horodatages des métadonnées des événements de sécurité utilisent le temps UTC ou incluent un décalage horaire explicite. L'UTC est recommandé pour garantir la cohérence entre les systèmes distribués et éviter toute confusion lors du passage à l'heure d'été.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l’application stocke ou diffuse uniquement les journaux vers les fichiers et services documentés dans l’inventaire des journaux.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.2.4", + "Ordinal": 4, + "Description": "Vérifiez que les journaux peuvent être lus et corrélés par le processeur de journaux utilisé, de préférence en utilisant un format de journalisation commun.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.2.5", + "Ordinal": 5, + "Description": "Vérifiez que l'application applique la journalisation en fonction du niveau de protection des données lors de la journalisation de données sensibles. Par exemple, certaines données, comme les identifiants ou les informations de paiement, peuvent être interdites. D'autres données, comme les jetons de session, ne peuvent être enregistrées que par hachage ou masquage, en totalité ou en partie.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V16.3", + "Ordinal": 3, + "Name": "Événements de sécurité", + "Items": [ + { + "Shortcode": "V16.3.1", + "Ordinal": 1, + "Description": "Vérifiez que toutes les opérations d'authentification sont enregistrées, y compris les tentatives réussies et infructueuses. Des métadonnées supplémentaires, telles que le type d'authentification ou les facteurs utilisés, doivent également être collectées.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.3.2", + "Ordinal": 2, + "Description": "Vérifier que les tentatives d'autorisation infructueuses sont logguées. Pour le niveau 3, cela doit inclure la journalisation de toutes les décisions d'autorisation, y compris lors de l'accès à des données sensibles (sans journalisation des données sensibles elles-mêmes).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.3.3", + "Ordinal": 3, + "Description": "Vérifiez que l'application enregistre les événements de sécurité définis dans la documentation et enregistre également les tentatives de contournement des contrôles de sécurité, tels que la validation des entrées, la logique métier et l'anti-automatisation.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.3.4", + "Ordinal": 4, + "Description": "Vérifiez que l’application enregistre les erreurs inattendues et les échecs de contrôle de sécurité tels que les échecs TLS du backend.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V16.4", + "Ordinal": 4, + "Name": "Protection des journaux", + "Items": [ + { + "Shortcode": "V16.4.1", + "Ordinal": 1, + "Description": "Vérifiez que tous les composants de journalisation codent correctement les données pour empêcher l’injection de journaux.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.4.2", + "Ordinal": 2, + "Description": "Vérifiez que les journaux sont protégés contre tout accès non autorisé et ne peuvent pas être modifiés.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.4.3", + "Ordinal": 3, + "Description": "Vérifiez que les journaux sont transmis de manière sécurisée à un système logique distinct pour analyse, détection, alerte et remontée des informations. L'objectif est de garantir qu'en cas de violation de l'application, les journaux ne seront pas compromis.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V16.5", + "Ordinal": 5, + "Name": "Gestion des erreurs", + "Items": [ + { + "Shortcode": "V16.5.1", + "Ordinal": 1, + "Description": "Vérifiez qu'un message générique est renvoyé au consommateur lorsqu'une erreur inattendue ou sensible à la sécurité se produit, garantissant ainsi l'absence d'exposition de données système internes sensibles telles que les traces de pile, les requêtes, les clés secrètes et les jetons.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.5.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application continue de fonctionner en toute sécurité lorsque l'accès aux ressources externes échoue, par exemple, en utilisant des modèles tels que des disjoncteurs ou une dégradation progressive.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.5.3", + "Ordinal": 3, + "Description": "Vérifiez que l'application échoue proprement et sécurisée, y compris lorsqu'une exception se produit, en évitant les accès en cas d'erreur telles que le traitement d'une transaction malgré les erreurs résultant de la logique de validation.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.5.4", + "Ordinal": 4, + "Description": "Vérifiez qu'un gestionnaire d'erreurs de « dernier recours » est défini pour intercepter toutes les exceptions non gérées. Cela permet d'éviter la perte des informations d'erreur qui doivent être loguées dans les fichiers journaux et de garantir qu'une erreur ne paralyse pas l'ensemble du processus applicatif, entraînant une perte de disponibilité.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V17", + "Ordinal": 17, + "ShortName": "WebRTC", + "Name": "WebRTC", + "Items": [ + { + "Shortcode": "V17.1", + "Ordinal": 1, + "Name": "Serveur TURN", + "Items": [ + { + "Shortcode": "V17.1.1", + "Ordinal": 1, + "Description": "Vérifiez que le service TURN (Traversal Using Relays around NAT) autorise uniquement l'accès aux adresses IP non réservées à des fins spécifiques (par exemple, réseaux internes, diffusion, bouclage). Notez que cela s'applique aux adresses IPv4 et IPv6.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.1.2", + "Ordinal": 2, + "Description": "Vérifiez que le service Traversal Using Relays around NAT (TURN) n'est pas susceptible d'épuiser ses ressources lorsque des utilisateurs légitimes tentent d'ouvrir un grand nombre de ports sur le serveur TURN.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V17.2", + "Ordinal": 2, + "Name": "Média", + "Items": [ + { + "Shortcode": "V17.2.1", + "Ordinal": 1, + "Description": "Vérifiez que la clé du certificat Datagram Transport Layer Security (DTLS) est gérée et protégée conformément à la politique documentée de gestion des clés cryptographiques.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.2", + "Ordinal": 2, + "Description": "Vérifiez que le serveur multimédia est configuré pour utiliser et prendre en charge les suites de chiffrement DTLS (Datagram Transport Layer Security) approuvées et un profil de protection sécurisé pour l'extension DTLS pour l'établissement de clés pour le protocole de transport en temps réel sécurisé (DTLS-SRTP).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l'authentification SRTP (Secure Real-time Transport Protocol) est vérifiée sur le serveur multimédia pour empêcher les attaques par injection RTP (Real-time Transport Protocol) d'entraîner une condition de déni de service ou l'insertion de médias audio ou vidéo dans les flux multimédias.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.4", + "Ordinal": 4, + "Description": "Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant lorsqu'il rencontre des paquets SRTP (Secure Real-time Transport Protocol) mal formés.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.5", + "Ordinal": 5, + "Description": "Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.6", + "Ordinal": 6, + "Description": "Vérifiez que le serveur multimédia n'est pas sensible à la vulnérabilité de condition de concurrence « ClientHello » dans Datagram Transport Layer Security (DTLS) en vérifiant si le serveur multimédia est publiquement connu comme étant vulnérable ou en effectuant le test de condition de concurrence.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.7", + "Ordinal": 7, + "Description": "Vérifiez que tous les mécanismes d'enregistrement audio ou vidéo associés au serveur multimédia sont en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.8", + "Ordinal": 8, + "Description": "Vérifiez que le certificat Datagram Transport Layer Security (DTLS) est vérifié par rapport à l'attribut d'empreinte cryptographique du protocole de description de session (SDP), en mettant fin au flux multimédia si la vérification échoue, pour garantir l'authenticité du flux multimédia.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V17.3", + "Ordinal": 3, + "Name": "Signalisation", + "Items": [ + { + "Shortcode": "V17.3.1", + "Ordinal": 1, + "Description": "Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation entrants légitimes lors d'une attaque par saturation. Cela peut être réalisé en implémentant une limitation de débit au niveau de la signalisation.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.3.2", + "Ordinal": 2, + "Description": "Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation légitimes en cas de message mal formé susceptible de provoquer un déni de service. Cela peut inclure la validation des entrées, la gestion sécurisée des dépassements d'entiers, la prévention des dépassements de tampon et l'utilisation d'autres techniques robustes de gestion des erreurs.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + } + ] +} diff --git a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.xml b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.xml new file mode 100644 index 0000000000..4225c650e7 --- /dev/null +++ b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.xml @@ -0,0 +1 @@ +Application Security Verification Standard ProjectASVS5.0.0The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.V11EncodingEncodage et nettoyageV1.11Architecture d'encodage et de nettoyageV1.1.11Vérifiez que l'entrée est décodée ou non échappée vers une forme canonique une seule fois, elle n'est décodée que lorsque des données codées sous cette forme sont attendues, et que cela est fait avant de traiter davantage l'entrée, par exemple, elle n'est pas effectuée après la validation ou la désinfection de l'entrée.FalseTrue✓True✓V1.1.22Vérifiez que l'application effectue l'encodage et l'échappement de sortie soit comme étape finale avant d'être utilisée par l'interpréteur pour lequel elle est destinée, soit par l'interpréteur lui-même.FalseTrue✓True✓V1.22Prévention des injectionsV1.2.11Vérifiez que l'encodage de sortie d'une réponse HTTP, d'un document HTML ou d'un document XML est pertinent pour le contexte requis, comme l'encodage des caractères pertinents pour les éléments HTML, les attributs HTML, les commentaires HTML, les CSS ou les champs d'en-tête HTTP, pour éviter de modifier la structure du message ou du document.True✓True✓True✓V1.2.22Vérifiez que, lors de la création dynamique d'URL, les données non fiables sont encodées en fonction de leur contexte (par exemple, encodage d'URL ou encodage base64url pour les paramètres de requête ou de chemin). Assurez-vous que seuls les schémas d'URL sûrs sont autorisés (par exemple, interdire javascript: ou data:).True✓True✓True✓V1.2.33Vérifiez que l'encodage ou l'échappement de sortie est utilisé lors de la création dynamique de contenu JavaScript (y compris JSON), pour éviter de modifier la structure du message ou du document (pour éviter l'injection JavaScript et JSON).True✓True✓True✓V1.2.44Vérifiez que la sélection de données ou les requêtes de base de données (par exemple, SQL, HQL, NoSQL, Cypher) utilisent des requêtes paramétrées, des ORM, des Framework d'entités ou sont protégées contre les injections SQL et autres attaques par injection de base de données. Ceci est également pertinent lors de l'écriture de procédures stockées.True✓True✓True✓V1.2.55Vérifiez que l’application protège contre l’injection de commandes du système d’exploitation et que les appels du système d’exploitation utilisent des requêtes du système d’exploitation paramétrées ou utilisent un encodage de sortie de ligne de commande contextuelle.True✓True✓True✓V1.2.66Vérifiez que l’application protège contre les vulnérabilités d’injection LDAP ou que des contrôles de sécurité spécifiques pour empêcher l’injection LDAP ont été mis en œuvre.FalseTrue✓True✓V1.2.77Vérifiez que l’application est protégée contre les attaques par injection XPath en utilisant la paramétrisation des requêtes ou des requêtes précompilées.FalseTrue✓True✓V1.2.88Vérifiez que les processeurs LaTeX sont configurés de manière sécurisée (par exemple, en n'utilisant pas l'indicateur « --shell-escape ») et qu'une liste d’autorisations de commandes est utilisée pour empêcher les attaques par injection LaTeX.FalseTrue✓True✓V1.2.99Vérifiez que l'application échappe les caractères spéciaux dans les expressions régulières (généralement à l'aide d'une barre oblique inverse) pour éviter qu'ils ne soient mal interprétés comme des métacaractères.FalseTrue✓True✓V1.2.1010Vérifiez que l'application est protégée contre les injections CSV et injections de formules. L'application doit respecter les règles d'échappement définies dans les sections 2.6 et 2.7 de la RFC 4180 lors de l'export de contenu CSV. De plus, lors de l'export au format CSV ou vers d'autres formats de tableur (tels que XLS, XLSX ou ODF), les caractères spéciaux (notamment « = », « + », « - », « @ », « \t » (tabulation) et « \0 » (caractère null)) doivent être protégés par une apostrophe s'ils apparaissent en premier dans une valeur de champ.FalseFalseTrue✓V1.33NettoyageV1.3.11Vérifiez que toutes les entrées HTML non fiables provenant d'éditeurs WYSIWYG ou similaires sont nettoyées à l'aide d'une bibliothèque ou d'une fonctionnalité de Framework de nettoyage HTML bien connue et sécurisée.True✓True✓True✓V1.3.22Vérifiez que l'application évite d'utiliser eval() ou d'autres fonctionnalités d'exécution de code dynamique telles que Spring Expression Language (SpEL). En l'absence d'alternative, toute saisie utilisateur incluse doit être nettoyée avant d'être exécutée.True✓True✓True✓V1.3.33Vérifiez que les données transmises à un contexte potentiellement dangereux sont préalablement nettoyées pour appliquer des mesures de sécurité, telles qu'autoriser uniquement des caractères sûrs pour ce contexte et raccourcir des entrées trop longues.FalseTrue✓True✓V1.3.44Vérifiez que le contenu Scalable Vector Graphics (SVG) scriptable fourni par l'utilisateur est validé ou nettoyé pour contenir uniquement des balises et des attributs (tels que des graphiques de dessin) qui sont sûrs pour l'application, par exemple, ne contiennent pas de scripts et d'objets étrangers.FalseTrue✓True✓V1.3.55Vérifiez que l'application nettoie ou désactive le contenu du langage de modèle d'expression ou de script fourni par l'utilisateur, tel que les feuilles de style CSS, le Markdown ou XSL, BBCode ou similaire.FalseTrue✓True✓V1.3.66Vérifiez que l'application protège contre les attaques de falsification de requête côté serveur (SSRF), en validant les données non fiables par rapport à une liste d'autorisation de protocoles, de domaines, de chemins et de ports et en nettoyant les caractères potentiellement dangereux avant d'utiliser les données pour appeler un autre service.FalseTrue✓True✓V1.3.77Vérifiez que l'application se protège contre les attaques par injection de modèles en interdisant la création de modèles basés sur des entrées non fiables. En l'absence d'alternative, toute entrée non fiable incluse dynamiquement lors de la création du modèle doit être nettoyée ou rigoureusement validée.FalseTrue✓True✓V1.3.88Vérifiez que l’application nettoie correctement les entrées non fiables avant utilisation dans les requêtes Java Naming and Directory Interface (JNDI) et que JNDI est configuré de manière sécurisée pour empêcher les attaques par injection JNDI.FalseTrue✓True✓V1.3.99Vérifiez que l’application nettoie le contenu avant qu’il ne soit envoyé à memcache pour éviter les attaques par injection.FalseTrue✓True✓V1.3.1010Vérifiez que les chaînes de format susceptibles d'être résolues de manière inattendue ou malveillante lors de leur utilisation sont nettoyées avant d'être traitées.FalseTrue✓True✓V1.3.1111Vérifiez que l'application nettoie les entrées utilisateur avant de les transmettre aux systèmes de messagerie pour se protéger contre l'injection SMTP ou IMAP.FalseTrue✓True✓V1.3.1212Vérifiez que les expressions régulières sont exemptes d'éléments provoquant "backtracking" exponentiel et assurez-vous que les entrées non fiables sont nettoyées pour atténuer les attaques ReDoS ou Runaway Regex.FalseFalseTrue✓V1.44Mémoire, chaine de caractères et code à mémoire non-managéeV1.4.11Vérifiez que l'application utilise des chaînes memory-safe, une copie de mémoire et une arithmétique de pointeur renforcée pour détecter ou empêcher les débordements de pile, de tampon ou de tas.FalseTrue✓True✓V1.4.22Vérifiez que les techniques de validation du signe, de la plage et de l’entrée sont utilisées pour éviter les dépassements d’entiers.FalseTrue✓True✓V1.4.33Vérifiez que la mémoire et les ressources allouées dynamiquement sont libérées et que les références ou les pointeurs vers la mémoire libérée sont supprimés ou définis à null pour éviter les "dangling pointer" et les vulnérabilités d'utilisation après libération.FalseTrue✓True✓V1.55Désérialisation sécuriséeV1.5.11Vérifiez que l'application configure les "parser" XML pour utiliser une configuration restrictive et que les fonctionnalités non sûres telles que la résolution d'entités externes sont désactivées pour empêcher les attaques XML eXternal Entity (XXE).True✓True✓True✓V1.5.22Vérifiez que la désérialisation des données non fiables garantit une gestion sécurisée des entrées, par exemple en utilisant une liste d'autorisation de types d'objets ou en limitant les types d'objets définis par le client, afin d'empêcher les attaques par désérialisation. Les mécanismes de désérialisation explicitement définis comme non sécurisés ne doivent pas être utilisés avec des entrées non fiables.FalseTrue✓True✓V1.5.33Vérifiez que les différents "parser" utilisés dans l'application pour le même type de données (par exemple, les "parser" JSON, les "parser" XML, les "parser" d'URL) effectuent l'analyse de manière cohérente et utilisent le même mécanisme d'encodage de caractères pour éviter des problèmes tels que les vulnérabilités d'interopérabilité JSON ou un comportement d'analyse d'URI ou de fichier différent exploité dans les attaques d'inclusion de fichiers à distance (RFI) ou de falsification de requête côté serveur (SSRF).FalseFalseTrue✓V22ValidationValidation et logique métierV2.11Validation et documentation de la logique métierV2.1.11Vérifiez que la documentation de l'application définit des règles de validation des entrées pour vérifier la validité des éléments de données par rapport à la structure attendue. Il peut s'agir de formats de données courants tels que des numéros de carte de crédit, des adresses e-mail ou des numéros de téléphone, ou d'un format de données interne.True✓True✓True✓V2.1.22Vérifiez que la documentation de l'application définit comment valider la cohérence logique et contextuelle des éléments de données combinés, par exemple en vérifiant que la banlieue et le code postal correspondent.FalseTrue✓True✓V2.1.33Vérifiez que les attentes en matière de limites et de validations de la logique métier sont documentées, y compris par utilisateur et globalement dans l'application.FalseTrue✓True✓V2.22Validation des entréesV2.2.11Vérifier que les entrées sont validées afin de respecter les attentes métier ou fonctionnelles. Cette validation doit être basée sur une liste de valeurs, de modèles et de plages autorisées, ou sur la comparaison des entrées avec une structure attendue et des limites logiques selon des règles prédéfinies. Pour le niveau 1, cette validation peut se concentrer sur les entrées utilisées pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau 2, elle doit s'appliquer à toutes les entrées.True✓True✓True✓V2.2.22Vérifiez que l'application est conçue pour appliquer la validation des entrées au niveau d'une couche de service de confiance. Bien que la validation côté client améliore l'ergonomie et doit être encouragée, elle ne doit pas être considérée comme un contrôle de sécurité.True✓True✓True✓V2.2.33Vérifiez que l’application garantit que les combinaisons d’éléments de données associés sont raisonnables selon les règles prédéfinies.FalseTrue✓True✓V2.33Sécurité de la logique métierV2.3.11Vérifiez que l’application traitera uniquement les flux de logique métier pour le même utilisateur dans l’ordre séquentiel attendu et sans sauter d’étapes.True✓True✓True✓V2.3.22Vérifiez que les limites de la logique métier sont implémentées conformément à la documentation de l'application, afin d'éviter que des failles de la logique métier ne soient pas exploitées.FalseTrue✓True✓V2.3.33Vérifiez que les transactions sont utilisées au niveau de la logique métier de telle sorte qu'une opération de logique métier réussisse dans son intégralité ou qu'elle soit restaurée à l'état correct précédent.FalseTrue✓True✓V2.3.44Vérifiez que les mécanismes de verrouillage au niveau de la logique métier sont utilisés pour garantir que les ressources en quantité limitée (telles que les sièges de théâtre ou les créneaux de livraison) ne peuvent pas être réservées deux fois en manipulant la logique de l'application.FalseTrue✓True✓V2.3.55Vérifiez que les flux logiques métier à forte valeur ajoutée nécessitent l'approbation de plusieurs utilisateurs afin d'éviter toute action non autorisée ou accidentelle. Cela peut inclure, sans s'y limiter, les transferts monétaires importants, les approbations de contrats, l'accès à des informations classifiées ou les contournements de sécurité dans le secteur manufacturier.FalseFalseTrue✓V2.44Anti-automatisationV2.4.11Vérifiez que des contrôles anti-automatisation sont en place pour protéger contre les appels excessifs aux fonctions d'application qui pourraient conduire à l'exfiltration de données, à la création de données inutiles, à l'épuisement des quotas, aux violations de limites de débit, au déni de service ou à la surutilisation de ressources coûteuses.FalseTrue✓True✓V2.4.22Vérifiez que les flux logiques métier nécessitent un timing humain réaliste, évitant ainsi des soumissions de transactions excessivement rapides.FalseFalseTrue✓V33WebSécurité du frontend WebV3.11Documentation sur la sécurité du frontend WebV3.1.11Vérifiez que la documentation de l'application indique les fonctionnalités de sécurité attendues que les navigateurs utilisant l'application doivent prendre en charge (telles que HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) et autres mécanismes de sécurité HTTP pertinents). Elle doit également définir le comportement de l'application lorsque certaines de ces fonctionnalités ne sont pas disponibles (par exemple, avertir l'utilisateur ou bloquer l'accès).FalseFalseTrue✓V3.22Interprétation non intentionnelle du contenuV3.2.11Vérifiez que des contrôles de sécurité sont en place pour empêcher les navigateurs d'afficher du contenu ou des fonctionnalités dans les réponses HTTP dans un contexte incorrect (par exemple, lorsqu'une API, un fichier téléchargé par l'utilisateur ou une autre ressource est demandée directement). Les contrôles possibles peuvent inclure : ne pas transmettre le contenu sauf si les champs d'en-tête de requête HTTP (tels que Sec-Fetch-\*) indiquent qu'il s'agit du contexte correct, utiliser la directive sandbox du champ d'en-tête Content-Security-Policy ou utiliser le type de disposition de pièce jointe dans le champ d'en-tête Content-Disposition.True✓True✓True✓V3.2.22Vérifiez que le contenu destiné à être affiché sous forme de texte, plutôt que rendu sous forme de HTML, est géré à l'aide de fonctions de rendu sécurisées (telles que createTextNode ou textContent) pour empêcher l'exécution involontaire de contenu tel que HTML ou JavaScript.True✓True✓True✓V3.2.33Vérifiez que l'application évite l'écrasement du DOM lors de l'utilisation de JavaScript côté client en utilisant des déclarations de variables explicites, en effectuant une vérification de type stricte, en évitant de stocker des variables globales sur l'objet document et en implémentant l'isolation de l'espace de nommage.FalseFalseTrue✓V3.33Configuration des cookiesV3.3.11Vérifiez que les cookies ont l'attribut « Secure » ​​défini et si le préfixe « \__Host- » n'est pas utilisé pour le nom du cookie, le préfixe « __Secure- » doit être utilisé pour le nom du cookie.True✓True✓True✓V3.3.22Vérifiez que la valeur de l'attribut « SameSite » de chaque cookie est définie en fonction de l'objectif du cookie, afin de limiter l'exposition aux attaques de réparation de l'interface utilisateur et aux attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).FalseTrue✓True✓V3.3.33Vérifiez que les cookies ont le préfixe « __Host- » pour le nom du cookie, sauf s'ils sont explicitement conçus pour être partagés avec d'autres hôtes.FalseTrue✓True✓V3.3.44Vérifiez que si la valeur d'un cookie n'est pas censée être accessible aux scripts côté client (comme un jeton de session), le cookie doit avoir l'attribut « HttpOnly » défini et la même valeur (par exemple, un jeton de session) ne doit être transférée au client que via le champ d'en-tête « Set-Cookie ».FalseTrue✓True✓V3.3.55Vérifiez que lorsque l'application écrit un cookie, la longueur combinée du nom et de la valeur du cookie ne dépasse pas 4 096 octets. Les cookies trop volumineux ne seront pas stockés par le navigateur et ne seront donc pas envoyés avec les requêtes, empêchant ainsi l'utilisateur d'utiliser les fonctionnalités de l'application qui reposent sur ce cookie.FalseFalseTrue✓V3.44En-têtes du mécanisme de sécurité du navigateurV3.4.11Vérifiez qu'un champ d'en-tête Strict-Transport-Security est inclus dans toutes les réponses afin d'appliquer une politique HTTP Strict Transport Security (HSTS). Une durée maximale d'au moins un an doit être définie, et pour les niveaux L2 et supérieurs, la politique doit également s'appliquer à tous les sous-domaines.True✓True✓True✓V3.4.22Vérifiez que le champ d'en-tête Access-Control-Allow-Origin du partage de ressources cross-origine (CORS) est une valeur fixe de l'application ou, si la valeur du champ d'en-tête de requête HTTP Origin est utilisée, qu'elle est validée par rapport à une liste d'origines approuvées. Si « Access-Control-Allow-Origin: * » doit être utilisé, vérifiez que la réponse ne contient aucune information sensible.True✓True✓True✓V3.4.33Vérifiez que les réponses HTTP incluent un champ d'en-tête de réponse Content-Security-Policy qui définit des directives garantissant que le navigateur charge et exécute uniquement du contenu ou des ressources fiables, afin de limiter l'exécution de JavaScript malveillant. Au minimum, une politique globale doit être utilisée, incluant les directives object-src 'none' et base-uri 'none', et définissant soit une lliste d’autorisations, soit des valeurs nonces ou des hachages. Pour une application L3, une politique par réponse avec des valeurs nonces ou des hachages doit être définie.FalseTrue✓True✓V3.4.44Vérifiez que toutes les réponses HTTP contiennent un champ d'en-tête « X-Content-Type-Options: nosniff ». Cela indique aux navigateurs de ne pas utiliser l'analyse de contenu ni la détection du type MIME pour la réponse donnée, et d'exiger que la valeur du champ d'en-tête « Content-Type » de la réponse corresponde à la ressource de destination. Par exemple, la réponse à une demande de style n'est acceptée que si le type de contenu de la réponse est « text/css ». Cela permet également au navigateur d'utiliser la fonctionnalité de blocage de lecture inter-origines (CORB).FalseTrue✓True✓V3.4.55Vérifiez que l'application définit une politique de référencement afin d'empêcher la fuite de données techniquement sensibles vers des services tiers via le champ d'en-tête de requête HTTP « Referer ». Cela peut être effectué via le champ d'en-tête de réponse HTTP « Referrer-Policy » ou via les attributs d'élément HTML. Les données sensibles peuvent inclure le chemin d'accès et les données de requête dans l'URL, et pour les applications internes non publiques, le nom d'hôte.FalseTrue✓True✓V3.4.66Vérifiez que l'application Web utilise la directive frame-ancestors du champ d'en-tête Content-Security-Policy pour chaque réponse HTTP afin de garantir qu'elle ne peut pas être intégrée par défaut et que l'intégration de ressources spécifiques n'est autorisée qu'en cas de nécessité. Notez que le champ d'en-tête X-Frame-Options, bien que pris en charge par les navigateurs, est obsolète et n'est pas forcément fiable.FalseTrue✓True✓V3.4.77Vérifiez que le champ d’en-tête Content-Security-Policy spécifie un emplacement pour signaler les violations.FalseFalseTrue✓V3.4.88Vérifiez que toutes les réponses HTTP qui lancent le rendu d'un document (comme les réponses de type text/html) incluent le champ d'en-tête 'Cross-Origin-Opener-Policy' avec la directive 'same-origin' ou s'ame-origin-allow-popups', selon les besoins. Cela empêche les attaques abusant de l'accès partagé aux objets Window, telles que le tabnabbing et le comptage d'images.FalseFalseTrue✓V3.55Séparation de l'origine du navigateurV3.5.11Vérifiez que, si l'application ne s'appuie pas sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher les requêtes inter-origines non autorisées d'utiliser des fonctionnalités sensibles, ces requêtes sont validées afin de garantir leur origine. Cela peut se faire en utilisant et en validant des jetons anti-falsification ou en exigeant des champs d'en-tête HTTP supplémentaires qui ne sont pas des champs d'en-tête de requête CORS safelist. Ceci permet de se protéger contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).True✓True✓True✓V3.5.22Vérifiez que, si l'application s'appuie sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher l'utilisation inter-origines non autorisée de fonctionnalités sensibles, il est impossible d'appeler la fonctionnalité avec une requête qui ne déclenche pas de requête de pré-vérification cross-origin CORS. Cela peut nécessiter de vérifier les valeurs des champs d'en-tête de requête 'Origin' et 'Content-Type' ou d'utiliser un champ d'en-tête supplémentaire qui n'est pas un champ d'en-tête de la liste de sécurité CORS.True✓True✓True✓V3.5.33Vérifiez que les requêtes HTTP destinées aux fonctionnalités sensibles utilisent des méthodes HTTP appropriées, telles que POST, PUT, PATCH ou DELETE, et non des méthodes définies comme « sûres » par la spécification HTTP, telles que HEAD, OPTIONS ou GET. Une validation stricte des champs d'en-tête de requête Sec-Fetch-* peut également être utilisée pour garantir que la requête ne provient pas d'un appel inter-origines inapproprié, d'une requête de navigation ou d'un chargement de ressources (comme une source d'image) inattendu.True✓True✓True✓V3.5.44Vérifiez que des applications distinctes sont hébergées sur des noms d'hôte différents pour tirer parti des restrictions fournies par la politique de même origine, y compris la manière dont les documents ou scripts chargés par une origine peuvent interagir avec les ressources d'une autre origine et les restrictions basées sur le nom d'hôte sur les cookies.FalseTrue✓True✓V3.5.55Vérifiez que les messages reçus par l'interface postMessage sont rejetés si l'origine du message n'est pas digne de confiance ou si la syntaxe du message n'est pas valide.FalseTrue✓True✓V3.5.66Vérifiez que la fonctionnalité JSONP n'est activée nulle part dans l'application pour éviter les attaques Cross-Site Script Inclusion (XSSI).FalseFalseTrue✓V3.5.77Vérifiez que les données nécessitant une autorisation ne sont pas incluses dans les réponses des ressources de script, comme les fichiers JavaScript, pour empêcher les attaques par inclusion de script intersite (XSSI).FalseFalseTrue✓V3.5.88Vérifiez que les ressources authentifiées (telles que les images, les vidéos, les scripts et autres documents) peuvent être chargées ou intégrées pour le compte de l'utilisateur uniquement lorsque cela est prévu. Cela peut être réalisé en validant strictement les champs d'en-tête de requête HTTP Sec-Fetch-* afin de garantir que la requête ne provient pas d'un appel cross-origin inapproprié, ou en définissant un champ d'en-tête de réponse HTTP Cross-Origin-Resource-Policy restrictif pour indiquer au navigateur de bloquer le contenu renvoyé.FalseFalseTrue✓V3.66Intégrité des ressources externesV3.6.11Vérifiez que les ressources côté client, telles que les bibliothèques JavaScript, les feuilles de style CSS ou les polices web, sont hébergées en externe (par exemple, sur un réseau de diffusion de contenu) uniquement si la ressource est statique et versionnée, et si l'intégrité des sous-ressources (SRI) est utilisée pour valider l'intégrité de la ressource. Si cela n'est pas possible, une décision de sécurité documentée doit justifier cette décision pour chaque ressource.FalseFalseTrue✓V3.77Autres considérations sur la sécurité du navigateurV3.7.11Vérifiez que l'application utilise uniquement des technologies côté client toujours prises en charge et considérées comme sécurisées. Parmi les technologies qui ne répondent pas à cette exigence figurent les plugins NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL ou les applets Java côté client.FalseTrue✓True✓V3.7.22Vérifiez que l'application redirigera automatiquement l'utilisateur vers un nom d'hôte ou un domaine différent (qui n'est pas contrôlé par l'application) uniquement lorsque la destination apparaît sur une liste d'autorisation.FalseTrue✓True✓V3.7.33Vérifiez que le domaine de premier niveau de l'application (par exemple, site.tld) ​​est ajouté à la liste de préchargement publique pour HTTP Strict Transport Security (HSTS). Cela garantit que l'utilisation de TLS pour l'application est intégrée directement dans les principaux navigateurs, plutôt que de dépendre uniquement du champ d'en-tête de réponse Strict-Transport-Security.FalseFalseTrue✓V3.7.44Vérifiez que l'application affiche une notification lorsque l'utilisateur est redirigé vers une URL hors du contrôle de l'application, avec une option pour annuler la navigation.FalseFalseTrue✓V3.7.55Vérifiez que l'application se comporte comme documenté (par exemple, en avertissant l'utilisateur ou en bloquant l'accès) si le navigateur utilisé pour accéder à l'application ne prend pas en charge les fonctionnalités de sécurité attendues.FalseFalseTrue✓V44APIAPI et service WebV4.11Sécurité du service Web génériqueV4.1.11Vérifiez que chaque réponse HTTP avec un corps de message contient un champ d'en-tête Content-Type qui correspond au contenu réel de la réponse, y compris le paramètre charset pour spécifier un codage de caractères sécurisé (par exemple, UTF-8, ISO-8859-1) conformément aux types de médias IANA, tels que « text/ », « /+xml » et « /xml ».True✓True✓True✓V4.1.22Vérifiez que seuls les terminaux utilisateurs (destinés à l'accès manuel via un navigateur web) redirigent automatiquement de HTTP vers HTTPS, tandis que les autres services ou terminaux n'implémentent pas de redirections transparentes. Cela permet d'éviter qu'un client envoie par erreur des requêtes HTTP non chiffrées, mais que, comme ces requêtes sont automatiquement redirigées vers HTTPS, la fuite de données sensibles passe inaperçue.FalseTrue✓True✓V4.1.33Vérifiez que tout champ d'en-tête HTTP utilisé par l'application et défini par une couche intermédiaire, telle qu'un équilibreur de charge, un proxy web ou un service backend-for-frontend, ne peut pas être remplacé par l'utilisateur final. Les exemples d'en-têtes peuvent inclure X-Real-IP, X-Forwarded-*, ou X-User-ID.FalseTrue✓True✓V4.1.44Vérifiez que seules les méthodes HTTP explicitement prises en charge par l'application ou son API (y compris les OPTIONS lors des demandes de contrôle en amont) peuvent être utilisées et que les méthodes inutilisées sont bloquées.FalseFalseTrue✓V4.1.55Vérifier que les signatures numériques par message sont utilisées pour fournir une assurance supplémentaire en plus des protections de transport pour les demandes ou les transactions qui sont très sensibles ou qui traversent un certain nombre de systèmes.FalseFalseTrue✓V4.22Validation de la structure des messages HTTPV4.2.11Vérifiez que tous les composants de l'application (y compris les équilibreurs de charge, les pares-feux et les serveurs d'applications) déterminent les limites des messages HTTP entrants à l'aide du mécanisme approprié à la version HTTP afin d'empêcher la contrebande de requêtes HTTP. Dans HTTP/1.x, si un champ d'en-tête Transfer-Encoding est présent, l'en-tête Content-Length doit être ignoré conformément à la RFC 2616. Avec HTTP/2 ou HTTP/3, si un champ d'en-tête Content-Length est présent, le récepteur doit s'assurer qu'il est cohérent avec la longueur des trames DATA.FalseTrue✓True✓V4.2.22Vérifier que, lors de la génération de messages HTTP, le champ d'en-tête Content-Length n'entre pas en conflit avec la longueur du contenu déterminée par le cadrage du protocole HTTP, afin d'empêcher les attaques de type « request smuggling ».FalseFalseTrue✓V4.2.33Vérifiez que l'application n'envoie ni n'accepte de messages HTTP/2 ou HTTP/3 avec des champs d'en-tête spécifiques à la connexion, tels que Transfer-Encoding, afin d'éviter les attaques par fractionnement de la réponse et par injection d'en-tête.FalseFalseTrue✓V4.2.44Vérifiez que l'application n'accepte que les requêtes HTTP/2 et HTTP/3 dont les champs et valeurs d'en-tête ne contiennent pas de séquences CR (\r), LF (\n) ou CRLF (\r\n), afin d'éviter les attaques par injection d'en-tête.FalseFalseTrue✓V4.2.55Vérifiez que, si l'application (backend ou frontend) construit et envoie des requêtes, elle utilise des mécanismes de validation, d'assainissement ou autres pour éviter de créer des URI (comme pour les appels API) ou des champs d'en-tête de requête HTTP (comme Authorization ou Cookie) qui sont trop longs pour être acceptés par le composant récepteur. Cela pourrait entraîner un déni de service, par exemple lors de l'envoi d'une requête trop longue (par exemple, un long champ d'en-tête de cookie), ce qui fait que le serveur répond toujours avec un statut d'erreur.FalseFalseTrue✓V4.33GraphQLV4.3.11Vérifiez qu'une liste d'autorisation de requête, une limitation de profondeur, une limitation de quantité ou une analyse des coûts de requête est utilisée pour empêcher le déni de service (DoS) de GraphQL ou d'expression de la couche données en raison de requêtes imbriquées coûteuses.FalseTrue✓True✓V4.3.22Vérifiez que les requêtes d’introspection GraphQL sont désactivées dans l’environnement de production, sauf si l’API GraphQL est destinée à être utilisée par d’autres parties.FalseTrue✓True✓V4.44WebSocketV4.4.11Vérifiez que WebSocket sur TLS (WSS) est utilisé pour toutes les connexions WebSocket.True✓True✓True✓V4.4.22Vérifiez que, lors de la négociation HTTP WebSocket initiale, le champ d’en-tête 'Origin' est vérifié par rapport à une liste d’origines autorisées pour l’application.FalseTrue✓True✓V4.4.33Vérifiez que, si la gestion de session standard de l'application ne peut pas être utilisée, des jetons dédiés sont utilisés à cet effet, qui sont conformes aux exigences de sécurité de gestion de session pertinentes.FalseTrue✓True✓V4.4.44Vérifiez que les jetons de gestion de session WebSocket dédiés sont initialement obtenus ou validés via la session HTTPS précédemment authentifiée lors de la transition d'une session HTTPS existante vers un canal WebSocket.FalseTrue✓True✓V55FileGestion des fichiersV5.11Documentation sur la gestion des fichiersV5.1.11Vérifiez que la documentation définit les types de fichiers autorisés, les extensions de fichiers attendues et la taille maximale (y compris la taille décompressée) pour chaque fonctionnalité de Téléversement. De plus, assurez-vous que la documentation précise comment les fichiers sont sécurisés pour le téléchargement et le traitement des utilisateurs finaux, par exemple le comportement de l'application lorsqu'un fichier malveillant est détecté.FalseTrue✓True✓V5.22Téléversement de fichiers et contenuV5.2.11Vérifiez que l'application n'acceptera que des fichiers d'une taille qu'elle peut traiter sans provoquer de perte de performances ou d'attaque par déni de service.True✓True✓True✓V5.2.22Vérifiez que lorsque l'application accepte un fichier, seul ou dans une archive telle qu'un fichier zip, elle vérifie si l'extension de fichier correspond à une extension attendue et que le contenu correspond au type représenté par l'extension. Cela inclut, sans s'y limiter, la vérification des « octets magiques » initiaux, la réécriture d'images et l'utilisation de bibliothèques spécialisées pour la validation du contenu des fichiers. Pour le niveau L1, cela peut se concentrer uniquement sur les fichiers utilisés pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau L2, cela doit s'appliquer à tous les fichiers acceptés.True✓True✓True✓V5.2.33Vérifiez que l'application vérifie les fichiers compressés (par exemple, zip, gz, docx, odt) par rapport à la taille maximale autorisée non compressée et au nombre maximal de fichiers avant de décompresser le fichier.FalseTrue✓True✓V5.2.44Vérifiez qu'un quota de taille de fichier et un nombre maximal de fichiers par utilisateur sont appliqués pour garantir qu'un seul utilisateur ne puisse pas remplir le stockage avec trop de fichiers ou des fichiers excessivement volumineux.FalseFalseTrue✓V5.2.55Vérifiez que l'application n'autorise pas le téléversement de fichiers compressés contenant des liens symboliques, sauf si cela est spécifiquement requis (auquel cas il sera nécessaire d'appliquer une liste d'autorisation des fichiers vers lesquels il est possible de créer des liens symboliques).FalseFalseTrue✓V5.2.66Vérifiez que l'application rejette les images téléversées avec une taille de pixel supérieure au maximum autorisé, afin d'éviter les attaques par inondation de pixels.FalseFalseTrue✓V5.33Stockage de fichiersV5.3.11Vérifiez que les fichiers téléversés ou générés par une entrée non fiable et stockés dans un dossier public ne sont pas exécutés en tant que code de programme côté serveur lorsqu'ils sont accessibles directement avec une requête HTTP.True✓True✓True✓V5.3.22Vérifiez que lorsque l'application crée des chemins d'accès pour les opérations sur les fichiers, elle utilise des données générées en interne ou fiables plutôt que des noms de fichiers soumis par l'utilisateur. Si des noms de fichiers ou des métadonnées de fichiers soumis par l'utilisateur doivent être utilisés, une validation et un nettoyage stricts doivent être appliqués. Ceci permet de se protéger contre les attaques par traversée de chemin, l'inclusion de fichiers locaux ou distants (LFI, RFI) et la falsification de requêtes côté serveur (SSRF).True✓True✓True✓V5.3.33Vérifiez que le traitement des fichiers côté serveur, comme la décompression des fichiers, ignore les informations de chemin fournies par l'utilisateur pour éviter les vulnérabilités telles que le "zip slip".FalseFalseTrue✓V5.44Téléchargement de fichierV5.4.11Vérifiez que l’application valide ou ignore les noms de fichiers soumis par l’utilisateur, y compris dans un paramètre JSON, JSONP ou URL et spécifie un nom de fichier dans le champ d’en-tête Content-Disposition de la réponse.FalseTrue✓True✓V5.4.22Vérifiez que les noms de fichiers servis (par exemple, dans les champs d'en-tête de réponse HTTP ou les pièces jointes aux e-mails) sont encodés ou nettoyés (par exemple, conformément à la RFC 6266) pour préserver la structure du document et empêcher les attaques par injection.FalseTrue✓True✓V5.4.33Vérifiez que les fichiers obtenus à partir de sources non fiables sont analysés par des scanners antivirus pour empêcher la diffusion de contenu malveillant connu.FalseTrue✓True✓V66AuthenticationAuthentificationV6.11Documentation d'authentificationV6.1.11Vérifiez que la documentation de l'application définit comment les contrôles, tels que la limitation de débit, l'anti-automatisation et la réponse adaptative, sont utilisés pour se défendre contre les attaques telles que le « credential stuffing » et la force brute des mots de passe. La documentation doit expliquer clairement comment ces contrôles sont configurés et empêcher le blocage malveillant des comptes.True✓True✓True✓V6.1.22Vérifiez qu'une liste de mots spécifiques au contexte est documentée afin d'empêcher leur utilisation dans les mots de passe. Cette liste peut inclure des permutations de noms d'organisations, de produits, d'identifiants de systèmes, de noms de codes de projets, de noms de services ou de rôles, etc.FalseTrue✓True✓V6.1.33Vérifiez que, si l'application inclut plusieurs voies d'authentification, celles-ci sont toutes documentées avec les contrôles de sécurité et la force d'authentification qui doivent être appliqués de manière cohérente.FalseTrue✓True✓V6.22Sécurité des mots de passeV6.2.11Vérifiez que les mots de passe définis par l'utilisateur comportent au moins 8 caractères, bien qu'un minimum de 15 caractères soit fortement recommandé.True✓True✓True✓V6.2.22Vérifiez que les utilisateurs peuvent modifier leur mot de passe.True✓True✓True✓V6.2.33Vérifiez que la fonctionnalité de changement de mot de passe nécessite le mot de passe actuel et le nouveau mot de passe de l'utilisateur.True✓True✓True✓V6.2.44Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou du changement de mot de passe sont vérifiés par rapport à un ensemble disponible d'au moins 3 000 mots de passe principaux qui correspondent à la politique de mot de passe de l'application, par exemple la longueur minimale.True✓True✓True✓V6.2.55Vérifiez que les mots de passe peuvent être utilisés, quelle que soit leur composition, sans restriction quant au type de caractères autorisés. Aucun nombre minimal de majuscules ou de minuscules, de chiffres ou de caractères spéciaux ne doit être exigé.True✓True✓True✓V6.2.66Vérifiez que les champs de saisie du mot de passe utilisent type=password pour masquer la saisie. Les applications peuvent permettre à l'utilisateur d'afficher temporairement l'intégralité du mot de passe masqué ou le dernier caractère saisi.True✓True✓True✓V6.2.77Vérifiez que la fonctionnalité « coller », les assistants de mot de passe du navigateur et les gestionnaires de mots de passe externes sont autorisés.True✓True✓True✓V6.2.88Vérifiez que l'application vérifie le mot de passe de l'utilisateur exactement tel qu'il a été reçu de l'utilisateur, sans aucune modification telle qu'une troncature ou une transformation de casse.True✓True✓True✓V6.2.99Vérifiez que les mots de passe d’au moins 64 caractères sont autorisés.FalseTrue✓True✓V6.2.1010Vérifiez que le mot de passe d'un utilisateur reste valide jusqu'à ce qu'il soit découvert comme compromis ou qu'il soit renouvelé. L'application ne doit pas exiger de renouvellement périodique des identifiants.FalseTrue✓True✓V6.2.1111Vérifiez que la liste documentée de mots spécifiques au contexte est utilisée pour éviter la création de mots de passe faciles à deviner.FalseTrue✓True✓V6.2.1212Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou des modifications de mot de passe sont vérifiés par rapport à un ensemble de mots de passe fuités.FalseTrue✓True✓V6.33Sécurité générale de l'authentificationV6.3.11Vérifiez que les contrôles visant à empêcher les attaques telles que le bourrage d'informations d'identification et la force brute des mots de passe sont mis en œuvre conformément à la documentation de sécurité de l'application.True✓True✓True✓V6.3.22Vérifiez que les comptes d’utilisateur par défaut (par exemple, « root », « admin » ou « sa ») ne sont pas présents dans l’application ou sont désactivés.True✓True✓True✓V6.3.33Vérifiez que l’application exige que les utilisateurs utilisent un mécanisme d’authentification multifacteur ou une combinaison de mécanismes d’authentification à facteur unique.FalseTrue✓True✓V6.3.44Vérifiez que, si l’application inclut plusieurs voies d’authentification, il n’existe aucune voie non documentée et que les contrôles de sécurité et la force d’authentification sont appliqués de manière cohérente.FalseTrue✓True✓V6.3.55Vérifiez que les utilisateurs sont informés des tentatives d'authentification suspectes (réussies ou non). Il peut s'agir de tentatives d'authentification provenant d'un emplacement ou d'un client inhabituel, d'une authentification partiellement réussie (un seul facteur parmi plusieurs), d'une tentative d'authentification après une longue période d'inactivité ou d'une authentification réussie après plusieurs tentatives infructueuses.FalseFalseTrue✓V6.3.66Vérifiez que le courrier électronique n’est pas utilisé comme mécanisme d’authentification à facteur unique ou à facteurs multiples.FalseFalseTrue✓V6.3.77Vérifiez que les utilisateurs sont avertis après les mises à jour des détails d'authentification, telles que les réinitialisations d'informations d'identification ou la modification du nom d'utilisateur ou de l'adresse e-mail.FalseFalseTrue✓V6.3.88Vérifiez que les utilisateurs valides ne peuvent pas être déduits d'échecs d'authentification, par exemple en se basant sur des messages d'erreur, des codes de réponse HTTP ou des temps de réponse différents. Les fonctionnalités d'inscription et de mot de passe oublié doivent également bénéficier de cette protection.FalseFalseTrue✓V6.44Cycle de vie et récupération du facteur d'authentificationV6.4.11Vérifiez que les mots de passe initiaux ou les codes d'activation générés par le système sont générés de manière aléatoire et sécurisée, qu'ils respectent la politique de mots de passe en vigueur et qu'ils expirent après une courte période ou après leur première utilisation. Ces secrets initiaux ne doivent pas devenir des mots de passe permanents.True✓True✓True✓V6.4.22Vérifiez que les indices de mot de passe ou l'authentification basée sur les connaissances (appelées « questions secrètes ») ne sont pas présents.True✓True✓True✓V6.4.33Vérifiez qu'un processus sécurisé de réinitialisation d'un mot de passe oublié est mis en œuvre, qui ne contourne aucun mécanisme d'authentification multifacteur activé.FalseTrue✓True✓V6.4.44Vérifiez que si un facteur d'authentification multifacteur est perdu, la preuve de vérification d'identité est effectuée au même niveau que lors de l'inscription.FalseTrue✓True✓V6.4.55Vérifiez que les instructions de renouvellement des mécanismes d'authentification qui expirent sont envoyées avec suffisamment de temps pour être exécutées avant l'expiration de l'ancien mécanisme d'authentification, en configurant des rappels automatiques si nécessaire.FalseFalseTrue✓V6.4.66Vérifiez que les administrateurs peuvent initier la réinitialisation du mot de passe de l'utilisateur, mais que cela ne leur permet pas de modifier ou de choisir son mot de passe. Cela évite qu'ils ne connaissent le mot de passe de l'utilisateur.FalseFalseTrue✓V6.55Exigences générales en matière d'authentification multifacteurV6.5.11Vérifiez que les secrets de recherche, les demandes ou codes d'authentification out-of-band et les mots de passe à usage unique basés sur le temps (TOTP) ne peuvent être utilisés avec succès qu'une seule fois.FalseTrue✓True✓V6.5.22Vérifiez que, lors de leur stockage dans le backend de l'application, les secrets de recherche comportant moins de 112 bits d'entropie (19 caractères alphanumériques aléatoires ou 34 chiffres aléatoires) sont hachés avec un algorithme de hachage de stockage de mots de passe approuvé, intégrant un sel aléatoire de 32 bits. Une fonction de hachage standard peut être utilisée si le secret comporte 112 bits d'entropie ou plus.FalseTrue✓True✓V6.5.33Vérifiez que les secrets de recherche, le code d'authentification out-of-band et les mots de passe à usage unique basés sur le temps sont générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) pour éviter les valeurs prévisibles.FalseTrue✓True✓V6.5.44Vérifiez que les secrets de recherche et les codes d'authentification out-of-band ont un minimum de 20 bits d'entropie (généralement 4 caractères alphanumériques aléatoires ou 6 chiffres aléatoires suffisent).FalseTrue✓True✓V6.5.55Vérifiez que les requêtes, codes ou jetons d'authentification out-of-band, ainsi que les mots de passe à usage unique (TOTP), ont une durée de vie définie. Les requêtes out-of-band doivent avoir une durée de vie maximale de 10 minutes et les TOTP, de 30 secondes.FalseTrue✓True✓V6.5.66Vérifiez que tout facteur d’authentification (y compris les appareils physiques) peut être révoqué en cas de vol ou autre perte.FalseFalseTrue✓V6.5.77Vérifiez que les mécanismes d’authentification biométrique ne sont utilisés que comme facteurs secondaires, avec quelque chose que vous possédez ou quelque chose que vous savez.FalseFalseTrue✓V6.5.88Vérifiez que les mots de passe à usage unique basés sur le temps (TOTP) sont vérifiés en fonction d'une source temporelle provenant d'un service de confiance et non d'une heure non fiable ou fournie par le client.FalseFalseTrue✓V6.66Mécanismes d'authentification out-of-bandV6.6.11Vérifier que les mécanismes d'authentification utilisant le réseau téléphonique public commuté (RTPC) pour la transmission de mots de passe à usage unique (OTP) par téléphone ou SMS ne sont proposés que lorsque le numéro de téléphone a été préalablement validé. D'autres méthodes plus robustes (telles que les mots de passe à usage unique à durée déterminée) sont également proposées, et que le service informe les utilisateurs des risques de sécurité qu'elles présentent. Pour les applications de niveau 3, le téléphone et les SMS ne doivent pas être disponibles.FalseTrue✓True✓V6.6.22Vérifiez que les demandes d’authentification out-of-band, les codes ou les jetons sont liés à la demande d’authentification d’origine pour laquelle ils ont été générés et ne sont pas utilisables pour une demande précédente ou ultérieure.FalseTrue✓True✓V6.6.33Vérifiez qu'un mécanisme d'authentification out-of-band basé sur du code est protégé contre les attaques par force brute grâce au "rate limiting". Envisagez également d'utiliser un code avec au moins 64 bits d'entropie.FalseTrue✓True✓V6.6.44Vérifiez que, lorsque les notifications push sont utilisées pour l'authentification multifacteur, le "rate limiting" est appliqué afin d'empêcher les attaques de type « push bombing ». La concordance des numéros peut également atténuer ce risque.FalseFalseTrue✓V6.77Mécanisme d'authentification cryptographiqueV6.7.11Vérifiez que les certificats utilisés pour vérifier les assertions d’authentification cryptographique sont stockés de manière à les protéger contre toute modification.FalseFalseTrue✓V6.7.22Vérifiez que le nonce de défi a une longueur d'au moins 64 bits et qu'il est statistiquement unique ou unique sur toute la durée de vie du périphérique cryptographique.FalseFalseTrue✓V6.88Authentification avec un fournisseur d'identitéV6.8.11Vérifiez que, si l'application prend en charge plusieurs fournisseurs d'identité (IdP), l'identité de l'utilisateur ne peut pas être usurpée via un autre fournisseur d'identité pris en charge (par exemple, en utilisant le même identifiant utilisateur). La mesure standard consisterait à ce que l'application enregistre et identifie l'utilisateur à l'aide d'une combinaison de l'ID du fournisseur d'identité (servant d'espace de noms) et de l'ID de l'utilisateur dans le fournisseur d'identité.FalseTrue✓True✓V6.8.22Vérifiez que la présence et l'intégrité des signatures numériques sur les assertions d'authentification (par exemple sur les assertions JWT ou SAML) sont toujours validées, en rejetant toutes les assertions non signées ou ayant des signatures non valides.FalseTrue✓True✓V6.8.33Vérifiez que les assertions SAML sont traitées de manière unique et utilisées une seule fois au cours de la période de validité pour éviter les attaques par rejeu.FalseTrue✓True✓V6.8.44Si une application utilise un fournisseur d'identité (IdP) distinct et attend une force, des méthodes ou une date d'authentification spécifiques pour des fonctions spécifiques, vérifiez que l'application les vérifie à l'aide des informations renvoyées par l'IdP. Par exemple, si OIDC est utilisé, cela peut être réalisé en validant les affirmations de jeton d'identification telles que « acr », « amr » et « auth_time » (le cas échéant). Si l'IdP ne fournit pas ces informations, l'application doit disposer d'une approche de secours documentée qui suppose que le mécanisme d'authentification de force minimale a été utilisé (par exemple, une authentification à facteur unique avec nom d'utilisateur et mot de passe).FalseTrue✓True✓V77SessionGestion des sessionsV7.11Documentation sur la gestion des sessionsV7.1.11Vérifiez que le délai d'inactivité de la session de l'utilisateur et la durée de vie maximale absolue de la session sont documentés, sont appropriés en combinaison avec d'autres contrôles et que la documentation inclut une justification de tout écart par rapport aux exigences de réauthentification NIST SP 800-63B.FalseTrue✓True✓V7.1.22Vérifiez que la documentation définit le nombre de sessions simultanées (parallèles) autorisées pour un compte ainsi que les comportements et actions prévus à entreprendre lorsque le nombre maximal de sessions actives est atteint.FalseTrue✓True✓V7.1.33Vérifiez que tous les systèmes qui créent et gèrent des sessions utilisateur dans le cadre d'un écosystème de gestion des identités fédérées (tels que les systèmes SSO) sont documentés avec des contrôles pour coordonner la durée de vie des sessions, la résiliation et toute autre condition nécessitant une réauthentification.FalseTrue✓True✓V7.22Sécurité fondamentale de la gestion des sessionsV7.2.11Vérifiez que l’application effectue toutes les vérifications des jetons de session à l’aide d’un service backend de confiance.True✓True✓True✓V7.2.22Vérifiez que l'application utilise des jetons autonomes ou de référence générés dynamiquement pour la gestion des sessions, c'est-à-dire sans utiliser de secrets et de clés d'API statiques.True✓True✓True✓V7.2.33Vérifiez que si des jetons par référence sont utilisés pour représenter les sessions utilisateur, ils sont uniques et générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et possèdent au moins 128 bits d'entropie.True✓True✓True✓V7.2.44Vérifiez que l’application génère un nouveau jeton de session lors de l’authentification de l’utilisateur, y compris la réauthentification, et met fin au jeton de session actuel.True✓True✓True✓V7.33Délai d'expiration de la sessionV7.3.11Vérifiez qu’il existe un délai d’inactivité tel que la réauthentification soit appliquée conformément à l’analyse des risques et aux décisions de sécurité documentées.FalseTrue✓True✓V7.3.22Vérifiez qu'il existe une durée de vie maximale absolue de la session de sorte que la réauthentification soit appliquée conformément à l'analyse des risques et aux décisions de sécurité documentées.FalseTrue✓True✓V7.44Fin de sessionV7.4.11Vérifiez que lorsque la fin de session est déclenchée (par exemple, déconnexion ou expiration), l'application interdit toute utilisation ultérieure de la session. Pour les jetons par référence ou les sessions avec état, cela implique l'invalidation des données de session au niveau du backend de l'application. Les applications utilisant des jetons autonomes nécessiteront une solution, comme la gestion d'une liste des jetons terminés, l'interdiction des jetons produits avant une date et une heure spécifique à chaque utilisateur ou la rotation d'une clé de signature spécifique à chaque utilisateur.True✓True✓True✓V7.4.22Vérifiez que l'application met fin à toutes les sessions actives lorsqu'un compte utilisateur est désactivé ou supprimé (par exemple, lorsqu'un employé quitte l'entreprise).True✓True✓True✓V7.4.33Vérifiez que l'application offre la possibilité de mettre fin à toutes les autres sessions actives après une modification ou une suppression réussie de tout facteur d'authentification (y compris la modification du mot de passe via une réinitialisation ou une récupération et, le cas échéant, une mise à jour des paramètres MFA).FalseTrue✓True✓V7.4.44Vérifiez que toutes les pages nécessitant une authentification disposent d’un accès facile et visible à la fonctionnalité de déconnexion.FalseTrue✓True✓V7.4.55Vérifiez que les administrateurs d’applications sont en mesure de mettre fin aux sessions actives pour un utilisateur individuel ou pour tous les utilisateurs.FalseTrue✓True✓V7.55Défenses contre les abus de sessionV7.5.11Vérifiez que l'application nécessite une réauthentification complète avant d'autoriser les modifications des attributs de compte sensibles qui peuvent affecter l'authentification, tels que l'adresse e-mail, le numéro de téléphone, la configuration MFA ou d'autres informations utilisées dans la récupération de compte.FalseTrue✓True✓V7.5.22Vérifiez que les utilisateurs peuvent afficher et (après s'être authentifiés à nouveau avec au moins un facteur) terminer une ou toutes les sessions actuellement actives.FalseTrue✓True✓V7.5.33Vérifiez que l’application nécessite une authentification supplémentaire avec au moins un facteur ou une vérification secondaire avant d’effectuer des transactions ou des opérations hautement sensibles.FalseFalseTrue✓V7.66Réauthentification fédéréeV7.6.11Vérifiez que la durée de vie et la fin de la session entre les parties de confiance (RP) et les fournisseurs d'identité (IdP) se comportent comme documenté, en exigeant une réauthentification si nécessaire, par exemple lorsque le temps maximal entre les événements d'authentification IdP est atteint.FalseTrue✓True✓V7.6.22Vérifiez que la création d'une session nécessite soit le consentement de l'utilisateur, soit une action explicite, empêchant ainsi la création de nouvelles sessions d'application sans interaction de l'utilisateur.FalseTrue✓True✓V88AuthorizationAutorisationV8.11Documentation d'autorisationV8.1.11Vérifiez que la documentation d’autorisation définit des règles de restriction de l’accès au niveau de la fonction et aux données en fonction des autorisations du consommateur et des attributs des ressources.True✓True✓True✓V8.1.22Vérifiez que la documentation d'autorisation définit les règles de restriction d'accès au niveau des champs (lecture et écriture) en fonction des autorisations des consommateurs et des attributs des ressources. Notez que ces règles peuvent dépendre d'autres valeurs d'attributs de l'objet de données concerné, telles que l'état ou le statut.FalseTrue✓True✓V8.1.33Vérifiez que la documentation de l'application définit les attributs environnementaux et contextuels (y compris, mais sans s'y limiter, l'heure de la journée, l'emplacement de l'utilisateur, l'adresse IP ou l'appareil) qui sont utilisés dans l'application pour prendre des décisions de sécurité, y compris celles relatives à l'authentification et à l'autorisation.FalseFalseTrue✓V8.1.44Vérifier que la documentation d'authentification et d'autorisation définit l'utilisation des facteurs environnementaux et contextuels dans la prise de décision, en plus des autorisations au niveau des fonctions, des données et des champs. Cela doit inclure les attributs évalués, les seuils de risque et les actions entreprises (par exemple, autorisation, contestation, refus, renforcement de l'authentification).FalseFalseTrue✓V8.22Conception d'autorisation généraleV8.2.11Vérifiez que l’application garantit que l’accès basé sur la fonction est limité aux consommateurs disposant d’autorisations explicites.True✓True✓True✓V8.2.22Vérifiez que l'application garantit que l'accès spécifique aux données est limité aux consommateurs disposant d'autorisations explicites sur des éléments de données spécifiques afin d'atténuer les références d'objet directes non sécurisées (IDOR) et les autorisations de niveau d'objet rompues (BOLA).True✓True✓True✓V8.2.33Vérifiez que l'application garantit que l'accès au niveau du champ est limité aux consommateurs disposant d'autorisations explicites sur des champs spécifiques afin d'atténuer les problèmes d'autorisation au niveau de la propriété d'objet (BOPLA).FalseTrue✓True✓V8.2.44Vérifiez que les contrôles de sécurité adaptatifs basés sur les attributs environnementaux et contextuels du consommateur (tels que l'heure, la localisation, l'adresse IP ou l'appareil) sont mis en œuvre pour les décisions d'authentification et d'autorisation, comme défini dans la documentation de l'application. Ces contrôles doivent être appliqués lorsque le consommateur tente de démarrer une nouvelle session et également pendant une session existante.FalseFalseTrue✓V8.33Autorisation par opérationV8.3.11Vérifier que l'application applique les règles d'autorisations au niveau de la couche service de confiance et ne s’appuie pas sur des contrôles qu’un consommateur non approuvé pourrait manipuler, comme JavaScript côté client.True✓True✓True✓V8.3.22Vérifiez que les modifications apportées aux valeurs sur lesquelles reposent les décisions d'autorisation sont appliquées immédiatement. Lorsque les modifications ne peuvent pas être appliquées immédiatement (par exemple, en s'appuyant sur des données de jetons autonomes), des contrôles d'atténuation doivent être mis en place pour alerter un consommateur lorsqu'il effectue une action alors qu'il n'est plus autorisé à le faire et annuler la modification. Notez que cette solution alternative ne limiterait pas les fuites d'informations.FalseFalseTrue✓V8.3.33Vérifiez que l'accès à un objet repose sur les autorisations du sujet d'origine (par exemple, le consommateur), et non sur celles d'un intermédiaire ou d'un service agissant en son nom. Par exemple, si un consommateur appelle un service web à l'aide d'un jeton d'authentification autonome, et que ce service demande ensuite des données à un autre service, ce dernier utilisera le jeton du consommateur, plutôt qu'un jeton inter-machine du premier service, pour prendre les décisions d'autorisation.FalseFalseTrue✓V8.44Autres considérations relatives à l'autorisationV8.4.11Vérifiez que les applications multi-tenants utilisent des contrôles inter-tenants pour garantir que les opérations des consommateurs n'affecteront jamais les tenants avec lesquels ils ne sont pas autorisés à interagir.FalseTrue✓True✓V8.4.22Vérifiez que l'accès aux interfaces administratives intègre plusieurs couches de sécurité, notamment la vérification continue de l'identité du consommateur, l'évaluation de la posture de sécurité des appareils et l'analyse contextuelle des risques, garantissant que l'emplacement du réseau ou les endpoints approuvés ne sont pas les seuls facteurs d'autorisation, même s'ils peuvent réduire la probabilité d'accès non autorisé.FalseFalseTrue✓V99SelfJetons autonomesV9.11Source et intégrité du jetonV9.1.11Vérifiez que les jetons autonomes sont validés à l'aide de leur signature numérique ou MAC pour les protéger contre toute falsification avant d'accepter le contenu du jeton.True✓True✓True✓V9.1.22Vérifiez que seuls les algorithmes d'une liste d’autorisations peuvent être utilisés pour créer et vérifier des jetons autonomes, dans un contexte donné. La liste d'autorisation doit inclure les algorithmes autorisés, idéalement symétriques ou asymétriques, et ne doit pas inclure l'algorithme « Aucun ». Si les algorithmes symétriques et asymétriques doivent être pris en charge, des contrôles supplémentaires seront nécessaires pour éviter toute confusion de clés.True✓True✓True✓V9.1.33Vérifiez que les clés utilisées pour valider les jetons autonomes proviennent de sources préconfigurées et fiables pour l'émetteur du jeton, empêchant ainsi les attaquants de spécifier des sources et des clés non fiables. Pour les JWT et autres structures JWS, les en-têtes tels que « jku », « x5u » et « jwk » doivent être validés par rapport à une liste d'autorisation de sources fiables.True✓True✓True✓V9.22Contenu du jetonV9.2.11Vérifiez que, si une période de validité est indiquée dans les données du jeton, celui-ci et son contenu ne sont acceptés que si la date de vérification est comprise dans cette période. Par exemple, pour les JWT, les déclarations « nbf » et « exp » doivent être vérifiées.True✓True✓True✓V9.2.22Vérifiez que le service recevant un jeton valide le type de jeton et son utilisation avant d'en accepter le contenu. Par exemple, seuls les jetons d'accès peuvent être acceptés pour les décisions d'autorisation, et seuls les jetons d'identification peuvent être utilisés pour prouver l'authentification des utilisateurs.FalseTrue✓True✓V9.2.33Vérifiez que le service accepte uniquement les jetons destinés à être utilisés avec ce service (audience). Pour les JWT, cela peut être réalisé en validant la déclaration « aud » par rapport à une liste d'autorisation définie dans le service.FalseTrue✓True✓V9.2.44Si un émetteur de jetons utilise la même clé privée pour émettre des jetons destinés à différentes audiences, vérifiez que les jetons émis contiennent une restriction d'audience identifiant de manière unique les audiences visées. Cela empêchera la réutilisation d'un jeton avec une audience non prévue. Si l'identifiant d'audience est provisionné dynamiquement, l'émetteur de jetons doit valider ces audiences afin de garantir qu'elles n'entraînent pas d'usurpation d'identité.FalseTrue✓True✓V1010OAuthOauth et OIDCV10.11Sécurité générique OAuth et OIDCV10.1.11Vérifiez que les jetons sont envoyés uniquement aux composants qui en ont absolument besoin. Par exemple, lors de l'utilisation d'un modèle backend-for-frontend pour les applications JavaScript basées sur un navigateur, les jetons d'accès et d'actualisation ne doivent être accessibles qu'au backend.FalseTrue✓True✓V10.1.22Vérifiez que le client n'accepte les valeurs du serveur d'autorisation (telles que le code d'autorisation ou le jeton d'identification) que si elles résultent d'un flux d'autorisation initié par la même session d'agent utilisateur et la même transaction. Cela nécessite que les secrets générés par le client, tels que la clé de preuve pour l'échange de codes (PKCE) « code_verifier », « state » ou le nonce OIDC, ne puissent être devinés, soient spécifiques à la transaction et soient liés de manière sécurisée au client et à la session d'agent utilisateur au cours de laquelle la transaction a été initiée.FalseTrue✓True✓V10.22Client OAuthV10.2.11Vérifiez que, si le flux de code est utilisé, le client OAuth dispose d'une protection contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF), qui déclenchent des demandes de jetons, soit en utilisant la fonctionnalité de clé de preuve pour l'échange de code (PKCE), soit en vérifiant le paramètre « state » envoyé dans la demande d'autorisation.FalseTrue✓True✓V10.2.22Vérifiez que, si le client OAuth peut interagir avec plusieurs serveurs d'autorisation, il dispose d'une protection contre les attaques par confusion. Par exemple, il peut exiger que le serveur d'autorisation renvoie la valeur du paramètre « iss » et la valide dans la réponse d'autorisation et la réponse du jeton.FalseTrue✓True✓V10.2.33Vérifiez que le client OAuth demande uniquement les portées requises (ou d’autres paramètres d’autorisation) dans les requêtes adressées au serveur d’autorisation.FalseFalseTrue✓V10.33Serveur de ressources OAuthV10.3.11Vérifiez que le serveur de ressources accepte uniquement les jetons d'accès destinés à être utilisés avec ce service (audience). L'audience peut être incluse dans un jeton d'accès structuré (comme la déclaration « aud » dans JWT) ou vérifiée à l'aide du endpoint d'introspection de jeton.FalseTrue✓True✓V10.3.22Vérifiez que le serveur de ressources applique les décisions d'autorisation en fonction des déclarations du jeton d'accès définissant l'autorisation déléguée. Si des déclarations telles que « sub », « scope » et « authorization_details » sont présentes, elles doivent être prises en compte dans la décision.FalseTrue✓True✓V10.3.33Vérifiez que si une décision de contrôle d'accès nécessite l'identification d'un utilisateur unique à partir d'un jeton d'accès (JWT ou réponse d'introspection de jeton associé), le serveur de ressources identifie l'utilisateur à partir de déclarations non ré attribuables à d'autres utilisateurs. En général, cela implique l'utilisation d'une combinaison de déclarations « iss » et « sub ».FalseTrue✓True✓V10.3.44Si le serveur de ressources requiert une force d'authentification, des méthodes ou une date d'expiration spécifiques, vérifiez que le jeton d'accès présenté respecte ces contraintes. Par exemple, s'il est présent, utilisez les déclarations OIDC « acr », « amr » et « auth_time » respectivement.FalseTrue✓True✓V10.3.55Vérifiez que le serveur de ressources empêche l'utilisation de jetons d'accès volés ou la relecture de jetons d'accès (de parties non autorisées) en exigeant des jetons d'accès limités par l'expéditeur, soit Mutual TLS pour OAuth 2, soit OAuth 2 Demonstration of Proof of Possession (DPoP).FalseFalseTrue✓V10.44Serveur d'autorisation OAuthV10.4.11Vérifiez que le serveur d'autorisation valide les URI de redirection en fonction d'une liste d'autorisation spécifique au client d'URI préenregistrés à l'aide d'une comparaison de chaînes exacte.True✓True✓True✓V10.4.22Vérifiez que, si le serveur d'autorisation renvoie le code d'autorisation dans la réponse, celui-ci ne peut être utilisé qu'une seule fois pour une demande de jeton. Pour la deuxième demande valide avec un code d'autorisation déjà utilisé pour émettre un jeton d'accès, le serveur d'autorisation doit rejeter la demande de jeton et révoquer tous les jetons émis liés au code d'autorisation.True✓True✓True✓V10.4.33Vérifiez que le code d'autorisation est de courte durée. La durée de vie maximale peut atteindre 10 minutes pour les applications L1 et L2 et 1 minute pour les applications L3.True✓True✓True✓V10.4.44Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement l'utilisation des autorisations nécessaires à ce client. Notez que les autorisations « token » (flux implicite) et « password » (flux d'informations d'identification du propriétaire de la ressource) ne doivent plus être utilisées.True✓True✓True✓V10.4.55Vérifiez que le serveur d'autorisation atténue les attaques par rejeu de jetons d'actualisation pour les clients publics, de préférence en utilisant des jetons d'actualisation limités par l'expéditeur, par exemple des jetons DPoP (Demonstrating Proof of Possession) ou des jetons d'accès liés à un certificat utilisant le protocole TLS mutuel (mTLS). Pour les applications L1 et L2, la rotation des jetons d'actualisation peut être utilisée. Si cette rotation est utilisée, le serveur d'autorisation doit invalider le jeton d'actualisation après utilisation et révoquer tous les jetons d'actualisation de cette autorisation si un jeton d'actualisation déjà utilisé et invalidé est fourni.True✓True✓True✓V10.4.66Vérifiez que, si l'octroi de code est utilisé, le serveur d'autorisation atténue les attaques par interception de code en exigeant une clé de preuve pour l'échange de code (PKCE). Pour les demandes d'autorisation, le serveur d'autorisation doit exiger une valeur « code_challenge » valide et ne doit pas accepter une valeur « plain » pour « code_challenge_method ». Pour une demande de jeton, il doit exiger la validation du paramètre « code_verifier ».FalseTrue✓True✓V10.4.77Vérifiez que si le serveur d'autorisation prend en charge l'enregistrement dynamique des clients non authentifiés, il réduit le risque d'applications clientes malveillantes. Il doit valider les métadonnées clientes, telles que les URI enregistrés, garantir le consentement de l'utilisateur et l'avertir avant de traiter une demande d'autorisation avec une application cliente non approuvée.FalseTrue✓True✓V10.4.88Vérifiez que les jetons d’actualisation ont une expiration absolue, y compris si l’expiration du jeton d’actualisation glissant est appliquée.FalseTrue✓True✓V10.4.99Vérifiez que les jetons d'actualisation et les jetons d'accès de référence peuvent être révoqués par un utilisateur autorisé à l'aide de l'interface utilisateur du serveur d'autorisation, afin d'atténuer le risque de clients malveillants ou de jetons volés.FalseTrue✓True✓V10.4.1010Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.FalseTrue✓True✓V10.4.1111Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.FalseTrue✓True✓V10.4.1212Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement la valeur « response_mode » dont ce client a besoin. Par exemple, en vérifiant cette valeur par rapport aux valeurs attendues ou en utilisant une requête d'autorisation poussée (PAR) ou une requête d'autorisation sécurisée par JWT (JAR).FalseFalseTrue✓V10.4.1313Vérifiez que le type d'Autorisation « code » est toujours utilisé avec les demandes d'autorisation poussées (PAR).FalseFalseTrue✓V10.4.1414Vérifiez que le serveur d'autorisation émet uniquement des jetons d'accès limités à l'expéditeur (preuve de possession), soit avec des jetons d'accès liés au certificat utilisant TLS mutuel (mTLS), soit avec des jetons d'accès liés au DPoP (démonstration de preuve de possession).FalseFalseTrue✓V10.4.1515Vérifiez que, pour un client côté serveur (non exécuté sur l'appareil de l'utilisateur final), le serveur d'autorisation garantit que la valeur du paramètre « authorization_details » provient du backend client et que l'utilisateur ne l'a pas altérée. Par exemple, en exigeant l'utilisation d'une demande d'autorisation poussée (PAR) ou d'une demande d'autorisation sécurisée par JWT (JAR).FalseFalseTrue✓V10.4.1616Vérifiez que le client est confidentiel et que le serveur d'autorisation requiert l'utilisation de méthodes d'authentification client fortes (basées sur la cryptographie à clé publique et résistantes aux attaques par relecture), telles que TLS mutuel ('tls_client_auth', 'self_signed_tls_client_auth') ou JWT à clé privée ('private_key_jwt').FalseFalseTrue✓V10.55Client OIDCV10.5.11Vérifiez que le client (en tant que partie utilisatrice) atténue les attaques par rejeu de jeton d'identification. Par exemple, en vous assurant que la valeur « nonce » du jeton d'identification correspond à la valeur « nonce » envoyée dans la demande d'authentification au fournisseur OpenID (appelée demande d'autorisation envoyée au serveur d'autorisation dans OAuth2).FalseTrue✓True✓V10.5.22Vérifiez que le client identifie de manière unique l'utilisateur à partir des déclarations de jeton d'identification, généralement la déclaration « sub », qui ne peut pas être réaffectée à d'autres utilisateurs (pour la portée d'un fournisseur d'identité).FalseTrue✓True✓V10.5.33Vérifiez que le client rejette les tentatives d'un serveur d'autorisation malveillant d'usurper l'identité d'un autre serveur d'autorisation via ses métadonnées. Le client doit rejeter les métadonnées du serveur d'autorisation si l'URL de l'émetteur figurant dans ces métadonnées ne correspond pas exactement à l'URL d'émetteur préconfigurée attendue par le client.FalseTrue✓True✓V10.5.44Vérifiez que le client valide que le jeton d'identification est destiné à être utilisé pour ce client (audience) en vérifiant que la déclaration « aud » du jeton est égale à la valeur « client_id » pour le client.FalseTrue✓True✓V10.5.55Vérifiez que, lors de l'utilisation de la déconnexion du back-channel OIDC, la partie utilisatrice atténue les risques de déni de service liés à la déconnexion forcée et à la confusion entre JWT dans le flux de déconnexion. Le client doit vérifier que le jeton de déconnexion est correctement typé avec la valeur « logout+jwt », qu'il contient la déclaration « event » avec le nom de membre correct et qu'il ne contient pas de déclaration « nonce ». Il est également recommandé d'utiliser une expiration courte (par exemple, 2 minutes).FalseTrue✓True✓V10.66Fournisseur OpenIDV10.6.11Vérifiez que le fournisseur OpenID n'autorise que les valeurs « code », « ciba », « id_token » ou « id_token code » pour le mode de réponse. Notez que « code » est préférable à « id_token code » (flux hybride OIDC) et que « token » (tout flux implicite) ne doit pas être utilisé.FalseTrue✓True✓V10.6.22Vérifiez que le fournisseur OpenID atténue les risques de déni de service liés à la déconnexion forcée. Pour ce faire, obtenez une confirmation explicite de l'utilisateur final ou, le cas échéant, validez les paramètres de la requête de déconnexion (initiée par la partie utilisatrice), comme « id_token_hint ».FalseTrue✓True✓V10.77Gestion du consentementV10.7.11Vérifiez que le serveur d'autorisation garantit le consentement de l'utilisateur à chaque demande d'autorisation. Si l'identité du client ne peut être garantie, le serveur d'autorisation doit toujours demander explicitement le consentement de l'utilisateur.FalseTrue✓True✓V10.7.22Vérifiez que lorsque le serveur d'autorisation demande le consentement de l'utilisateur, il fournit des informations claires et suffisantes sur ce qui est consenti. Le cas échéant, ces informations doivent inclure la nature des autorisations demandées (généralement en fonction de la portée, du serveur de ressources et des détails d'autorisation RAR), l'identité de l'application autorisée et la durée de vie de ces autorisations.FalseTrue✓True✓V10.7.33Vérifiez que l’utilisateur peut consulter, modifier et révoquer les consentements qu’il a accordés via le serveur d’autorisation.FalseTrue✓True✓V1111CryptographyCryptographieV11.11Inventaire et documentation cryptographiquesV11.1.11Vérifiez qu’il existe une politique documentée pour la gestion des clés cryptographiques et un cycle de vie des clés cryptographiques qui suit une norme de gestion des clés telle que NIST SP 800-57. Cela devrait inclure la garantie que les clés ne sont pas sur-partagées (par exemple, avec plus de deux entités pour les secrets partagés et plus d’une entité pour les clés privées).FalseTrue✓True✓V11.1.22Vérifiez qu'un inventaire cryptographique est réalisé, maintenu et régulièrement mis à jour, et qu'il inclut toutes les clés, algorithmes et certificats cryptographiques utilisés par l'application. Il doit également documenter les emplacements du système où les clés peuvent ou non être utilisées, ainsi que les types de données qui peuvent ou non être protégées par ces clés.FalseTrue✓True✓V11.1.33Vérifiez que les mécanismes de découverte cryptographique sont utilisés pour identifier toutes les instances de cryptographie dans le système, y compris les opérations de chiffrement, de hachage et de signature.FalseFalseTrue✓V11.1.44Vérifier la tenue d'un inventaire cryptographique. Celui-ci doit inclure un plan documenté décrivant la migration vers de nouvelles normes cryptographiques, telles que la cryptographie post-quantique, afin de réagir aux menaces futures.FalseFalseTrue✓V11.22Mise en œuvre sécurisée de la cryptographieV11.2.11Vérifiez que les implémentations validées par l’industrie (y compris les bibliothèques et les implémentations accélérées par le matériel) sont utilisées pour les opérations cryptographiques.FalseTrue✓True✓V11.2.22Vérifiez que l'application est conçue avec une agilité cryptographique, de sorte que les nombres aléatoires, le chiffrement authentifié, le MAC ou les algorithmes de hachage, les longueurs de clés, les tours, les chiffrements et les modes puissent être reconfigurés, mis à niveau ou échangés à tout moment, afin de se protéger contre les failles cryptographiques. De même, il doit être possible de remplacer les clés et les mots de passe, ainsi que de rechiffrer les données. Cela permettra des mises à niveau transparentes vers la cryptographie post-quantique (PQC), une fois que des implémentations hautement sécurisées de schémas ou de normes PQC approuvés seront largement disponibles.FalseTrue✓True✓V11.2.33Vérifiez que toutes les primitives cryptographiques utilisent un minimum de 128 bits de sécurité en fonction de l'algorithme, de la taille de la clé et de la configuration. Par exemple, une clé ECC de 256 bits offre environ 128 bits de sécurité, tandis que RSA nécessite une clé de 3072 bits pour atteindre 128 bits de sécurité.FalseTrue✓True✓V11.2.44Vérifiez que toutes les opérations cryptographiques sont à temps constant, sans opérations de « court-circuit » dans les comparaisons, les calculs ou les retours, pour éviter toute fuite d'informations.FalseFalseTrue✓V11.2.55Vérifiez que tous les modules cryptographiques échouent en toute sécurité et que les erreurs sont gérées de manière à ne pas permettre de vulnérabilités, telles que les attaques Padding Oracle.FalseFalseTrue✓V11.33Algorithmes de chiffrementV11.3.11Vérifiez que les modes de bloc non sécurisés (par exemple, ECB) et les schémas de remplissage faibles (par exemple, PKCS#1 v1.5) ne sont pas utilisés.True✓True✓True✓V11.3.22Vérifiez que seuls les chiffrements et modes approuvés tels que AES avec GCM sont utilisés.True✓True✓True✓V11.3.33Vérifiez que les données chiffrées sont protégées contre toute modification non autorisée, de préférence en utilisant une méthode de chiffrement authentifiée approuvée ou en combinant une méthode de chiffrement approuvée avec un algorithme MAC approuvé.FalseTrue✓True✓V11.3.44Vérifiez que les nonces, les vecteurs d'initialisation et autres nombres à usage unique ne sont pas utilisés pour plus d'une paire clé de chiffrement/élément de données. La méthode de génération doit être adaptée à l'algorithme utilisé.FalseFalseTrue✓V11.3.55Vérifiez que toute combinaison d'un algorithme de chiffrement et d'un algorithme MAC fonctionne en mode chiffrement puis MAC.FalseFalseTrue✓V11.44Hachage et fonctions basées sur le hachageV11.4.11Vérifiez que seules les fonctions de hachage approuvées sont utilisées pour les cas d'utilisation cryptographiques généraux, notamment les signatures numériques, HMAC, KDF et la génération de bits aléatoires. Les fonctions de hachage non autorisées, telles que MD5, ne doivent pas être utilisées à des fins cryptographiques.True✓True✓True✓V11.4.22Vérifiez que les mots de passe sont stockés à l'aide d'une fonction de dérivation de clés approuvée et gourmande en ressources de calcul (également appelée « fonction de hachage de mots de passe »), dont les paramètres sont configurés conformément aux directives en vigueur. Ces paramètres doivent équilibrer sécurité et performances afin de rendre les attaques par force brute suffisamment difficiles pour le niveau de sécurité requis.FalseTrue✓True✓V11.4.33Vérifiez que les fonctions de hachage utilisées dans les signatures numériques, dans le cadre de l'authentification ou de l'intégrité des données, sont résistantes aux collisions et possèdent des longueurs de bits appropriées. Si la résistance aux collisions est requise, la longueur de sortie doit être d'au moins 256 bits. Si seule la résistance aux attaques de seconde pré-image est requise, la longueur de sortie doit être d'au moins 128 bits.FalseTrue✓True✓V11.4.44Vérifiez que l'application utilise des fonctions de dérivation de clés approuvées avec des paramètres d'extension de clés lors de la dérivation de clés secrètes à partir de mots de passe. Les paramètres utilisés doivent concilier sécurité et performances afin d'empêcher les attaques par force brute de compromettre la clé cryptographique obtenue.FalseTrue✓True✓V11.55Valeurs aléatoiresV11.5.11Vérifiez que tous les nombres et chaînes aléatoires destinés à être non devinables doivent être générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et posséder au moins 128 bits d'entropie. Notez que les UUID ne respectent pas cette condition.FalseTrue✓True✓V11.5.22Vérifiez que le mécanisme de génération de nombres aléatoires utilisé est conçu pour fonctionner en toute sécurité, même en cas de forte demande.FalseFalseTrue✓V11.66Cryptographie à clé publiqueV11.6.11Vérifier que seuls des algorithmes cryptographiques et des modes opératoires approuvés sont utilisés pour la génération et l'amorçage des clés, ainsi que pour la génération et la vérification des signatures numériques. Les algorithmes de génération de clés ne doivent pas générer de clés non sécurisées et vulnérables aux attaques connues, par exemple les clés RSA vulnérables à la factorisation de Fermat.FalseTrue✓True✓V11.6.22Vérifiez que des algorithmes cryptographiques approuvés sont utilisés pour l'échange de clés (tels que Diffie-Hellman), en veillant à ce que les mécanismes d'échange de clés utilisent des paramètres sécurisés. Cela permettra d'éviter les attaques contre le processus d'établissement des clés, susceptibles de conduire à des attaques de type « adversaire du milieu » ou à des failles cryptographiques.FalseFalseTrue✓V11.77Cryptographie des données en cours d'utilisationV11.7.11Vérifiez que le chiffrement complet de la mémoire est utilisé pour protéger les données sensibles pendant leur utilisation, empêchant ainsi l'accès par des utilisateurs ou des processus non autorisés.FalseFalseTrue✓V11.7.22Vérifiez que la minimisation des données garantit que la quantité minimale de données est exposée pendant le traitement et assurez-vous que les données sont chiffrées immédiatement après utilisation ou dès que possible.FalseFalseTrue✓V1212SecureCommunication sécuriséeV12.11Conseils généraux de sécurité TLSV12.1.11Vérifiez que seules les dernières versions recommandées du protocole TLS sont activées, telles que TLS 1.2 et TLS 1.3. La dernière version du protocole TLS doit être privilégiée.True✓True✓True✓V12.1.22Vérifiez que seules les suites de chiffrement recommandées sont activées, les suites de chiffrement les plus puissantes étant définies comme préférées. Les applications L3 doivent uniquement prendre en charge les suites de chiffrement assurant la confidentialité persistante (forward secrecy).FalseTrue✓True✓V12.1.33Vérifiez que l’application valide que les certificats clients mTLS sont approuvés avant d’utiliser l’identité du certificat pour l’authentification ou l’autorisation.FalseTrue✓True✓V12.1.44Vérifiez que la révocation de certification appropriée, telle que l'agrafage du protocole OCSP (Online Certificate Status Protocol), est activée et configurée.FalseFalseTrue✓V12.1.55Vérifiez que Encrypted Client Hello (ECH) est activé dans les paramètres TLS de l'application pour empêcher l'exposition de métadonnées sensibles, telles que l'indication du nom du serveur (SNI), pendant les processus de négociation TLS.FalseFalseTrue✓V12.22Communication HTTPS avec des services externesV12.2.11Vérifiez que TLS est utilisé pour toute connectivité entre un client et des services externes basés sur HTTP, et ne recourt pas à des communications non sécurisées ou non chiffrées.True✓True✓True✓V12.2.22Vérifiez que les services externes utilisent des certificats TLS publiquement approuvés.True✓True✓True✓V12.33Sécurité des communications entre services générauxV12.3.11Vérifiez qu'un protocole chiffré tel que TLS est utilisé pour toutes les connexions entrantes et sortantes vers et depuis l'application, y compris les systèmes de surveillance, les outils de gestion, l'accès à distance et SSH, les intergiciels, les bases de données, les mainframes, les systèmes partenaires ou les API externes. Le serveur ne doit pas recourir à des protocoles non sécurisés ou non chiffrés.FalseTrue✓True✓V12.3.22Vérifiez que les clients TLS valident les certificats reçus avant de communiquer avec un serveur TLS.FalseTrue✓True✓V12.3.33Vérifiez que TLS ou un autre mécanisme de chiffrement de transport approprié est utilisé pour toute connectivité entre les services internes basés sur HTTP au sein de l'application et ne se replie pas vers des communications non sécurisées ou non chiffrées.FalseTrue✓True✓V12.3.44Vérifiez que les connexions TLS entre les services internes utilisent des certificats de confiance. Lorsque des certificats générés en interne ou auto-signés sont utilisés, le service consommateur doit être configuré pour n'approuver que des autorités de certification internes spécifiques et des certificats auto-signés spécifiques.FalseTrue✓True✓V12.3.55Vérifiez que les services communiquant en interne au sein d'un système (communications intra-services) utilisent une authentification forte pour garantir la vérification de chaque endpoint. Des méthodes d'authentification forte, telles que l'authentification client TLS, doivent être utilisées pour garantir l'identité, en utilisant une infrastructure à clé publique et des mécanismes résistants aux attaques par rejeu. Pour les architectures de microservices, envisagez d'utiliser un maillage de services pour simplifier la gestion des certificats et renforcer la sécurité.FalseFalseTrue✓V1313ConfigurationConfigurationV13.11Documentation de configurationV13.1.11Vérifiez que tous les besoins de communication de l'application sont documentés. Cela doit inclure les services externes dont l'application dépend et les cas où un utilisateur final pourrait fournir un emplacement externe auquel l'application se connectera.FalseTrue✓True✓V13.1.22Vérifiez que pour chaque service utilisé par l'application, la documentation définit le nombre maximal de connexions simultanées (par exemple, les limites du pool de connexions) et le comportement de l'application lorsque cette limite est atteinte, y compris les mécanismes de secours ou de récupération, pour éviter les conditions de déni de service.FalseFalseTrue✓V13.1.33Vérifiez que la documentation de l'application définit des stratégies de gestion des ressources pour chaque système ou service externe utilisé (par exemple, bases de données, descripteurs de fichiers, threads, connexions HTTP). Cela doit inclure les procédures de libération des ressources, les paramètres de délai d'expiration, la gestion des échecs et l'implémentation de la logique de nouvelle tentative, en spécifiant les limites de nouvelle tentative, les délais et les algorithmes de retour arrière. Pour les opérations de requête-réponse HTTP synchrones, la documentation doit imposer des délais d'expiration courts et soit désactiver les nouvelles tentatives, soit les limiter strictement afin d'éviter les retards en cascade et l'épuisement des ressources.FalseFalseTrue✓V13.1.44Vérifiez que la documentation de l'application définit les secrets essentiels à la sécurité de l'application et un calendrier de rotation de ceux-ci, en fonction du modèle de menace et des exigences commerciales de l'organisation.FalseFalseTrue✓V13.22Configuration de la communication backendV13.2.11Vérifiez que les communications entre les composants de l'application backend qui ne prennent pas en charge le mécanisme de session utilisateur standard de l'application, notamment les API, les intergiciels et les couches de données, sont authentifiées. L'authentification doit utiliser des comptes de service individuels, des jetons à court terme ou une authentification par certificat, et non des identifiants immuables tels que des mots de passe, des clés API ou des comptes partagés avec accès privilégié.FalseTrue✓True✓V13.2.22Vérifiez que les communications entre les composants de l'application backend, y compris les services locaux ou du système d'exploitation, les API, les intergiciels et les couches de données, sont effectuées avec des comptes dotés des privilèges les moins nécessaires.FalseTrue✓True✓V13.2.33Vérifiez que si des informations d’identification doivent être utilisées pour l’authentification du service, les informations d’identification utilisées par le consommateur ne sont pas des informations d’identification par défaut (par exemple, root/root ou admin/admin).FalseTrue✓True✓V13.2.44Vérifiez qu'une liste d’autorisations est utilisée pour définir les ressources ou systèmes externes avec lesquels l'application est autorisée à communiquer (par exemple, pour les requêtes sortantes, les chargements de données ou l'accès aux fichiers). Cette liste d'autorisation peut être implémentée au niveau de la couche applicative, du serveur web, du pare-feu ou d'une combinaison de différentes couches.FalseTrue✓True✓V13.2.55Vérifiez que le serveur Web ou d’application est configuré avec une liste autorisée de ressources ou de systèmes vers lesquels le serveur peut envoyer des requêtes ou charger des données ou des fichiers.FalseTrue✓True✓V13.2.66Vérifiez que lorsque l'application se connecte à des services distincts, elle suit la configuration documentée pour chaque connexion, comme le nombre maximal de connexions parallèles, le comportement lorsque le nombre maximal de connexions autorisées est atteint, les délais d'expiration de connexion et les stratégies de nouvelle tentative.FalseFalseTrue✓V13.33Gestion des secretsV13.3.11Vérifiez qu'une solution de gestion des secrets, telle qu'un coffre-fort de clés, est utilisée pour créer, stocker, contrôler l'accès et détruire en toute sécurité les secrets backend. Ceux-ci peuvent inclure des mots de passe, du matériel de clé, des intégrations avec des bases de données et des systèmes tiers, des clés et des graines pour des jetons temporels, d'autres secrets internes et des clés API. Les secrets ne doivent pas être inclus dans le code source de l'application ni dans les artefacts de build. Pour une application L3, cela doit impliquer une solution matérielle telle qu'un HSM.FalseTrue✓True✓V13.3.22Vérifiez que l’accès aux ressources secrètes respecte le principe du moindre privilège.FalseTrue✓True✓V13.3.33Vérifiez que toutes les opérations cryptographiques sont effectuées à l'aide d'un module de sécurité isolé (tel qu'un coffre-fort ou un module de sécurité matériel) pour gérer et protéger en toute sécurité le matériel clé contre toute exposition en dehors du module de sécurité.FalseFalseTrue✓V13.3.44Vérifiez que les secrets sont configurés pour expirer et être renouvelés en fonction de la documentation de l'application.FalseFalseTrue✓V13.44Fuite d'informations involontaireV13.4.11Vérifiez que l'application est déployée soit sans aucune métadonnée de contrôle de source, y compris les dossiers .git ou .svn, soit de manière à ce que ces dossiers soient inaccessibles à la fois en externe et à l'application elle-même.True✓True✓True✓V13.4.22Vérifiez que les modes de débogage sont désactivés pour tous les composants dans les environnements de production afin d’éviter l’exposition des fonctionnalités de débogage et la fuite d’informations.FalseTrue✓True✓V13.4.33Vérifiez que les serveurs Web n’exposent pas les listes de répertoires aux clients, sauf si cela est explicitement prévu.FalseTrue✓True✓V13.4.44Vérifiez que l’utilisation de la méthode HTTP TRACE n’est pas prise en charge dans les environnements de production, afin d’éviter toute fuite d’informations potentielle.FalseTrue✓True✓V13.4.55Vérifiez que la documentation (comme pour les API internes) et les endpoints de surveillance ne sont pas exposés, sauf si cela est explicitement prévu.FalseTrue✓True✓V13.4.66Vérifiez que l’application n’expose pas d’informations de version détaillées des composants backend.FalseFalseTrue✓V13.4.77Vérifiez que la couche web est configuré pour servir uniquement les fichiers avec des extensions de fichier spécifiques afin d’éviter toute fuite involontaire d’informations, de configuration et de code source.FalseFalseTrue✓V1414DataProtection des donnéesV14.11Documentation sur la protection des donnéesV14.1.11Vérifiez que toutes les données sensibles créées et traitées par l'application ont été identifiées et classées selon leur niveau de protection. Cela inclut les données uniquement codées et donc facilement déchiffrables, telles que les chaînes Base64 ou la charge utile en texte clair d'un JWT. Les niveaux de protection doivent tenir compte des réglementations et normes de protection des données et de confidentialité auxquelles l'application est tenue de se conformer.FalseTrue✓True✓V14.1.22Vérifier que tous les niveaux de protection des données sensibles sont assortis d'un ensemble documenté d'exigences de protection. Cela doit inclure (sans s'y limiter) les exigences relatives au chiffrement général, à la vérification de l'intégrité, à la conservation, à la journalisation des données, aux contrôles d'accès aux données sensibles dans les journaux, au chiffrement au niveau de la base de données, aux technologies de confidentialité et de renforcement de la confidentialité à utiliser, ainsi qu'aux autres exigences de confidentialité.FalseTrue✓True✓V14.22Protection générale des donnéesV14.2.11Vérifiez que les données sensibles sont uniquement envoyées au serveur dans les champs de corps ou d’en-tête du message HTTP, et que l’URL et la chaîne de requête ne contiennent pas d’informations sensibles, telles qu’une clé API ou un jeton de session.True✓True✓True✓V14.2.22Vérifiez que l’application empêche la mise en cache des données sensibles dans les composants du serveur, tels que les équilibreurs de charge et les caches d’application, ou garantit que les données sont purgées en toute sécurité après utilisation.FalseTrue✓True✓V14.2.33Vérifiez que les données sensibles définies ne sont pas envoyées à des parties non fiables (par exemple, des trackers d'utilisateurs) pour empêcher la collecte indésirable de données en dehors du contrôle de l'application.FalseTrue✓True✓V14.2.44Vérifiez que les contrôles autour des données sensibles liés au chiffrement, à la vérification de l'intégrité, à la conservation, à la manière dont les données doivent être enregistrées, aux contrôles d'accès autour des données sensibles dans les journaux, à la confidentialité et aux technologies d'amélioration de la confidentialité, sont mis en œuvre comme défini dans la documentation pour le niveau de protection des données spécifiques.FalseTrue✓True✓V14.2.55Vérifiez que les mécanismes de mise en cache sont configurés pour ne mettre en cache que les réponses dont le type de contenu est conforme à la ressource et qui ne contiennent pas de contenu sensible et dynamique. Le serveur web doit renvoyer une réponse 404 ou 302 lors de l'accès à un fichier inexistant plutôt qu'un fichier valide différent. Cela devrait empêcher les attaques par empoisonnement de cache web.FalseFalseTrue✓V14.2.66Vérifiez que l'application ne renvoie que les données sensibles minimales requises pour son fonctionnement. Par exemple, ne renvoyez que certains chiffres d'un numéro de carte de crédit, et non le numéro complet. Si les données complètes sont requises, elles doivent être masquées dans l'interface utilisateur, sauf si l'utilisateur les consulte spécifiquement.FalseFalseTrue✓V14.2.77Vérifiez que les informations sensibles sont soumises à une classification de conservation des données, en veillant à ce que les données obsolètes ou inutiles soient supprimées automatiquement, selon un calendrier défini ou selon les besoins de la situation.FalseFalseTrue✓V14.2.88Vérifiez que les informations sensibles sont supprimées des métadonnées des fichiers soumis par l'utilisateur, sauf si le stockage est autorisé par l'utilisateur.FalseFalseTrue✓V14.33Protection des données côté clientV14.3.11Vérifiez que les données authentifiées sont effacées du stockage client, comme le DOM du navigateur, après la fin du client ou de la session. Le champ d'en-tête de réponse HTTP « Clear-Site-Data » peut être utile, mais le côté client devrait également pouvoir effectuer la correction si la connexion au serveur n'est pas disponible à la fin de la session.True✓True✓True✓V14.3.22Vérifiez que l'application définit suffisamment de champs d'en-tête de réponse HTTP anti-caching (c'est-à-dire Cache-Control : no-store) afin que les données sensibles ne soient pas mises en cache dans les navigateurs.FalseTrue✓True✓V14.3.33Vérifiez que les données stockées dans le stockage du navigateur (telles que localStorage, sessionStorage, IndexedDB ou les cookies) ne contiennent pas de données sensibles, à l'exception des jetons de session.FalseTrue✓True✓V1515SecureDéveloppement et architecture sécurisésV15.11Documentation sur le développement et l'architecture sécurisésV15.1.11Vérifiez que la documentation de l'application définit les délais de correction basés sur les risques pour les versions de composants tiers présentant des vulnérabilités et pour la mise à jour des bibliothèques en général, afin de minimiser les risques liés à ces composants.True✓True✓True✓V15.1.22Vérifiez qu'un catalogue d'inventaire, tel qu'une nomenclature logicielle (SBOM), est conservé pour toutes les bibliothèques tierces utilisées, y compris en vérifiant que les composants proviennent de référentiels prédéfinis, fiables et continuellement maintenus.FalseTrue✓True✓V15.1.33Vérifiez que la documentation de l'application identifie les fonctionnalités consommatrices en temps ou gourmandes en ressources. Elle doit notamment indiquer comment prévenir une perte de disponibilité due à une utilisation excessive de ces fonctionnalités et éviter que la génération d'une réponse ne prenne plus de temps que le délai d'expiration du consommateur. Les mesures de protection potentielles peuvent inclure le traitement asynchrone, l'utilisation de files d'attente et la limitation des processus parallèles par utilisateur et par application.FalseTrue✓True✓V15.1.44Vérifiez que la documentation de l’application met en évidence les bibliothèques tierces qui sont considérées comme des « composants à risque ».FalseFalseTrue✓V15.1.55Vérifiez que la documentation de l’application met en évidence les parties de l’application où des « fonctionnalités dangereuses » sont utilisées.FalseFalseTrue✓V15.22Architecture de sécurité et dépendancesV15.2.11Vérifiez que l’application contient uniquement des composants qui n’ont pas dépassé les délais de mise à jour et de correction documentés.True✓True✓True✓V15.2.22Vérifiez que l'application a mis en œuvre des défenses contre la perte de disponibilité due à des fonctionnalités qui prennent du temps ou qui nécessitent des ressources, sur la base des décisions et stratégies de sécurité documentées à cet effet.FalseTrue✓True✓V15.2.33Vérifiez que l'environnement de production inclut uniquement les fonctionnalités nécessaires au fonctionnement de l'application et n'expose pas de fonctionnalités superflues telles que du code de test, des exemples d'extraits et des fonctionnalités de développement.FalseTrue✓True✓V15.2.44Vérifiez que les composants tiers et toutes leurs dépendances transitives sont inclus à partir du référentiel attendu, qu'il soit détenu en interne ou qu'il s'agisse d'une source externe, et qu'il n'y a aucun risque d'attaque par confusion de dépendances.FalseFalseTrue✓V15.2.55Vérifiez que l'application implémente des protections supplémentaires autour des parties documentées comme contenant des « fonctionnalités dangereuses » ou utilisant des bibliothèques tierces considérées comme des « composants à risque ». Cela peut inclure des techniques telles que le sandboxing, l'encapsulation, la conteneurisation ou l'isolation au niveau du réseau pour retarder et dissuader les attaquants qui compromettent une partie de l'application de se propager ailleurs.FalseFalseTrue✓V15.33Développement défensifV15.3.11Vérifiez que l'application ne renvoie que le sous-ensemble requis de champs d'un objet de données. Par exemple, elle ne doit pas renvoyer un objet de données entier, car certains champs individuels ne doivent pas être accessibles aux utilisateurs.True✓True✓True✓V15.3.22Vérifiez que lorsque le backend de l'application effectue des appels vers des URL externes, il est configuré pour ne pas suivre les redirections, sauf s'il s'agit d'une fonctionnalité prévue.FalseTrue✓True✓V15.3.33Vérifiez que l'application dispose de contre-mesures pour se protéger contre les attaques d'affectation de masse en limitant les champs autorisés par contrôleur et action, par exemple, il n'est pas possible d'insérer ou de mettre à jour une valeur de champ lorsqu'elle n'était pas destinée à faire partie de cette action.FalseTrue✓True✓V15.3.44Vérifiez que tous les composants proxy et middleware transfèrent correctement l'adresse IP d'origine de l'utilisateur à l'aide de champs de données fiables qui ne peuvent pas être manipulés par l'utilisateur final, et que l'application et le serveur Web utilisent cette valeur correcte pour la journalisation et les décisions de sécurité telles que la limitation du débit, en tenant compte du fait que même l'adresse IP d'origine peut ne pas être fiable en raison d'adresses IP dynamiques, de VPN ou de pare-feu d'entreprise.FalseTrue✓True✓V15.3.55Vérifiez que l'application garantit explicitement que les variables sont du type correct et effectue des opérations d'égalité et de comparaison strictes. Cela permet d'éviter les vulnérabilités liées à la confusion de types, causées par des hypothèses du code de l'application sur le type d'une variable.FalseTrue✓True✓V15.3.66Vérifiez que le code JavaScript est écrit de manière à éviter la pollution du prototype, par exemple en utilisant Set() ou Map() au lieu de littéraux d'objet.FalseTrue✓True✓V15.3.77Vérifiez que l'application dispose de défenses contre les attaques de pollution des paramètres HTTP, en particulier si le Framework d'application ne fait aucune distinction quant à la source des paramètres de requête (chaîne de requête, paramètres de corps, cookies ou champs d'en-tête).FalseTrue✓True✓V15.44Concurrence sécuriséeV15.4.11Vérifiez que les objets partagés dans le code multithread (tels que les caches, les fichiers ou les objets en mémoire accessibles par plusieurs threads) sont accessibles en toute sécurité à l'aide de types thread-safe et de mécanismes de synchronisation tels que des verrous ou des sémaphores pour éviter les conditions de concurrence et la corruption des données.FalseFalseTrue✓V15.4.22Vérifiez que les vérifications de l'état d'une ressource, comme son existence ou ses autorisations, et des actions qui en dépendent, sont effectuées en une seule opération atomique afin d'éviter les situations de concurrence entre le moment de la vérification et le moment de l'utilisation (TOCTOU). Par exemple, vérifier l'existence d'un fichier avant de l'ouvrir ou l'accès d'un utilisateur avant de l'accorder.FalseFalseTrue✓V15.4.33Vérifiez que les verrous sont utilisés de manière cohérente pour éviter que les threads ne se bloquent, que ce soit en s'attendant les uns les autres ou en réessayant sans fin, et que la logique de verrouillage reste dans le code responsable de la gestion de la ressource pour garantir que les verrous ne peuvent pas être modifiés par inadvertance ou de manière malveillante par des classes ou du code externes.FalseFalseTrue✓V15.4.44Vérifiez que les politiques d'allocation des ressources empêchent la saturation de threads en garantissant un accès équitable aux ressources, par exemple en exploitant les pools de threads, permettant aux threads de priorité inférieure de continuer dans un délai raisonnable.FalseFalseTrue✓V1616SecurityJournalisation de sécurité et gestion des erreursV16.11Documentation sur la journalisation de sécuritéV16.1.11Vérifiez qu'il existe un inventaire documentant la journalisation effectuée à chaque couche de la pile technologique de l'application, les événements enregistrés, les formats de journal, l'endroit où cette journalisation est stockée, la manière dont elle est utilisée, la manière dont l'accès à celle-ci est contrôlé et la durée de conservation des journaux.FalseTrue✓True✓V16.22Journalisation généraleV16.2.11Vérifiez que chaque entrée de journal inclut les métadonnées nécessaires (telles que quand, où, qui, quoi) qui permettraient une enquête détaillée sur la chronologie lorsqu'un événement se produit.FalseTrue✓True✓V16.2.22Vérifiez que les sources de temps de tous les composants de journalisation sont synchronisées et que les horodatages des métadonnées des événements de sécurité utilisent le temps UTC ou incluent un décalage horaire explicite. L'UTC est recommandé pour garantir la cohérence entre les systèmes distribués et éviter toute confusion lors du passage à l'heure d'été.FalseTrue✓True✓V16.2.33Vérifiez que l’application stocke ou diffuse uniquement les journaux vers les fichiers et services documentés dans l’inventaire des journaux.FalseTrue✓True✓V16.2.44Vérifiez que les journaux peuvent être lus et corrélés par le processeur de journaux utilisé, de préférence en utilisant un format de journalisation commun.FalseTrue✓True✓V16.2.55Vérifiez que l'application applique la journalisation en fonction du niveau de protection des données lors de la journalisation de données sensibles. Par exemple, certaines données, comme les identifiants ou les informations de paiement, peuvent être interdites. D'autres données, comme les jetons de session, ne peuvent être enregistrées que par hachage ou masquage, en totalité ou en partie.FalseTrue✓True✓V16.33Événements de sécuritéV16.3.11Vérifiez que toutes les opérations d'authentification sont enregistrées, y compris les tentatives réussies et infructueuses. Des métadonnées supplémentaires, telles que le type d'authentification ou les facteurs utilisés, doivent également être collectées.FalseTrue✓True✓V16.3.22Vérifier que les tentatives d'autorisation infructueuses sont logguées. Pour le niveau 3, cela doit inclure la journalisation de toutes les décisions d'autorisation, y compris lors de l'accès à des données sensibles (sans journalisation des données sensibles elles-mêmes).FalseTrue✓True✓V16.3.33Vérifiez que l'application enregistre les événements de sécurité définis dans la documentation et enregistre également les tentatives de contournement des contrôles de sécurité, tels que la validation des entrées, la logique métier et l'anti-automatisation.FalseTrue✓True✓V16.3.44Vérifiez que l’application enregistre les erreurs inattendues et les échecs de contrôle de sécurité tels que les échecs TLS du backend.FalseTrue✓True✓V16.44Protection des journauxV16.4.11Vérifiez que tous les composants de journalisation codent correctement les données pour empêcher l’injection de journaux.FalseTrue✓True✓V16.4.22Vérifiez que les journaux sont protégés contre tout accès non autorisé et ne peuvent pas être modifiés.FalseTrue✓True✓V16.4.33Vérifiez que les journaux sont transmis de manière sécurisée à un système logique distinct pour analyse, détection, alerte et remontée des informations. L'objectif est de garantir qu'en cas de violation de l'application, les journaux ne seront pas compromis.FalseTrue✓True✓V16.55Gestion des erreursV16.5.11Vérifiez qu'un message générique est renvoyé au consommateur lorsqu'une erreur inattendue ou sensible à la sécurité se produit, garantissant ainsi l'absence d'exposition de données système internes sensibles telles que les traces de pile, les requêtes, les clés secrètes et les jetons.FalseTrue✓True✓V16.5.22Vérifiez que l'application continue de fonctionner en toute sécurité lorsque l'accès aux ressources externes échoue, par exemple, en utilisant des modèles tels que des disjoncteurs ou une dégradation progressive.FalseTrue✓True✓V16.5.33Vérifiez que l'application échoue proprement et sécurisée, y compris lorsqu'une exception se produit, en évitant les accès en cas d'erreur telles que le traitement d'une transaction malgré les erreurs résultant de la logique de validation.FalseTrue✓True✓V16.5.44Vérifiez qu'un gestionnaire d'erreurs de « dernier recours » est défini pour intercepter toutes les exceptions non gérées. Cela permet d'éviter la perte des informations d'erreur qui doivent être loguées dans les fichiers journaux et de garantir qu'une erreur ne paralyse pas l'ensemble du processus applicatif, entraînant une perte de disponibilité.FalseFalseTrue✓V1717WebRTCWebRTCV17.11Serveur TURNV17.1.11Vérifiez que le service TURN (Traversal Using Relays around NAT) autorise uniquement l'accès aux adresses IP non réservées à des fins spécifiques (par exemple, réseaux internes, diffusion, bouclage). Notez que cela s'applique aux adresses IPv4 et IPv6.FalseTrue✓True✓V17.1.22Vérifiez que le service Traversal Using Relays around NAT (TURN) n'est pas susceptible d'épuiser ses ressources lorsque des utilisateurs légitimes tentent d'ouvrir un grand nombre de ports sur le serveur TURN.FalseFalseTrue✓V17.22MédiaV17.2.11Vérifiez que la clé du certificat Datagram Transport Layer Security (DTLS) est gérée et protégée conformément à la politique documentée de gestion des clés cryptographiques.FalseTrue✓True✓V17.2.22Vérifiez que le serveur multimédia est configuré pour utiliser et prendre en charge les suites de chiffrement DTLS (Datagram Transport Layer Security) approuvées et un profil de protection sécurisé pour l'extension DTLS pour l'établissement de clés pour le protocole de transport en temps réel sécurisé (DTLS-SRTP).FalseTrue✓True✓V17.2.33Vérifiez que l'authentification SRTP (Secure Real-time Transport Protocol) est vérifiée sur le serveur multimédia pour empêcher les attaques par injection RTP (Real-time Transport Protocol) d'entraîner une condition de déni de service ou l'insertion de médias audio ou vidéo dans les flux multimédias.FalseTrue✓True✓V17.2.44Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant lorsqu'il rencontre des paquets SRTP (Secure Real-time Transport Protocol) mal formés.FalseTrue✓True✓V17.2.55Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.FalseFalseTrue✓V17.2.66Vérifiez que le serveur multimédia n'est pas sensible à la vulnérabilité de condition de concurrence « ClientHello » dans Datagram Transport Layer Security (DTLS) en vérifiant si le serveur multimédia est publiquement connu comme étant vulnérable ou en effectuant le test de condition de concurrence.FalseFalseTrue✓V17.2.77Vérifiez que tous les mécanismes d'enregistrement audio ou vidéo associés au serveur multimédia sont en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.FalseFalseTrue✓V17.2.88Vérifiez que le certificat Datagram Transport Layer Security (DTLS) est vérifié par rapport à l'attribut d'empreinte cryptographique du protocole de description de session (SDP), en mettant fin au flux multimédia si la vérification échoue, pour garantir l'authenticité du flux multimédia.FalseFalseTrue✓V17.33SignalisationV17.3.11Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation entrants légitimes lors d'une attaque par saturation. Cela peut être réalisé en implémentant une limitation de débit au niveau de la signalisation.FalseTrue✓True✓V17.3.22Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation légitimes en cas de message mal formé susceptible de provoquer un déni de service. Cela peut inclure la validation des entrées, la gestion sécurisée des dépassements d'entiers, la prévention des dépassements de tampon et l'utilisation d'autres techniques robustes de gestion des erreurs.FalseTrue✓True✓ diff --git a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.xml b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.xml new file mode 100644 index 0000000000..1dfb448a78 --- /dev/null +++ b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.xml @@ -0,0 +1 @@ +Application Security Verification Standard ProjectASVS5.0.0The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.V11EncodingEncodage et nettoyageV1.11Architecture d'encodage et de nettoyageV1.1.11Vérifiez que l'entrée est décodée ou non échappée vers une forme canonique une seule fois, elle n'est décodée que lorsque des données codées sous cette forme sont attendues, et que cela est fait avant de traiter davantage l'entrée, par exemple, elle n'est pas effectuée après la validation ou la désinfection de l'entrée.2V1.1.22Vérifiez que l'application effectue l'encodage et l'échappement de sortie soit comme étape finale avant d'être utilisée par l'interpréteur pour lequel elle est destinée, soit par l'interpréteur lui-même.2V1.22Prévention des injectionsV1.2.11Vérifiez que l'encodage de sortie d'une réponse HTTP, d'un document HTML ou d'un document XML est pertinent pour le contexte requis, comme l'encodage des caractères pertinents pour les éléments HTML, les attributs HTML, les commentaires HTML, les CSS ou les champs d'en-tête HTTP, pour éviter de modifier la structure du message ou du document.1V1.2.22Vérifiez que, lors de la création dynamique d'URL, les données non fiables sont encodées en fonction de leur contexte (par exemple, encodage d'URL ou encodage base64url pour les paramètres de requête ou de chemin). Assurez-vous que seuls les schémas d'URL sûrs sont autorisés (par exemple, interdire javascript: ou data:).1V1.2.33Vérifiez que l'encodage ou l'échappement de sortie est utilisé lors de la création dynamique de contenu JavaScript (y compris JSON), pour éviter de modifier la structure du message ou du document (pour éviter l'injection JavaScript et JSON).1V1.2.44Vérifiez que la sélection de données ou les requêtes de base de données (par exemple, SQL, HQL, NoSQL, Cypher) utilisent des requêtes paramétrées, des ORM, des Framework d'entités ou sont protégées contre les injections SQL et autres attaques par injection de base de données. Ceci est également pertinent lors de l'écriture de procédures stockées.1V1.2.55Vérifiez que l’application protège contre l’injection de commandes du système d’exploitation et que les appels du système d’exploitation utilisent des requêtes du système d’exploitation paramétrées ou utilisent un encodage de sortie de ligne de commande contextuelle.1V1.2.66Vérifiez que l’application protège contre les vulnérabilités d’injection LDAP ou que des contrôles de sécurité spécifiques pour empêcher l’injection LDAP ont été mis en œuvre.2V1.2.77Vérifiez que l’application est protégée contre les attaques par injection XPath en utilisant la paramétrisation des requêtes ou des requêtes précompilées.2V1.2.88Vérifiez que les processeurs LaTeX sont configurés de manière sécurisée (par exemple, en n'utilisant pas l'indicateur « --shell-escape ») et qu'une liste d’autorisations de commandes est utilisée pour empêcher les attaques par injection LaTeX.2V1.2.99Vérifiez que l'application échappe les caractères spéciaux dans les expressions régulières (généralement à l'aide d'une barre oblique inverse) pour éviter qu'ils ne soient mal interprétés comme des métacaractères.2V1.2.1010Vérifiez que l'application est protégée contre les injections CSV et injections de formules. L'application doit respecter les règles d'échappement définies dans les sections 2.6 et 2.7 de la RFC 4180 lors de l'export de contenu CSV. De plus, lors de l'export au format CSV ou vers d'autres formats de tableur (tels que XLS, XLSX ou ODF), les caractères spéciaux (notamment « = », « + », « - », « @ », « \t » (tabulation) et « \0 » (caractère null)) doivent être protégés par une apostrophe s'ils apparaissent en premier dans une valeur de champ.3V1.33NettoyageV1.3.11Vérifiez que toutes les entrées HTML non fiables provenant d'éditeurs WYSIWYG ou similaires sont nettoyées à l'aide d'une bibliothèque ou d'une fonctionnalité de Framework de nettoyage HTML bien connue et sécurisée.1V1.3.22Vérifiez que l'application évite d'utiliser eval() ou d'autres fonctionnalités d'exécution de code dynamique telles que Spring Expression Language (SpEL). En l'absence d'alternative, toute saisie utilisateur incluse doit être nettoyée avant d'être exécutée.1V1.3.33Vérifiez que les données transmises à un contexte potentiellement dangereux sont préalablement nettoyées pour appliquer des mesures de sécurité, telles qu'autoriser uniquement des caractères sûrs pour ce contexte et raccourcir des entrées trop longues.2V1.3.44Vérifiez que le contenu Scalable Vector Graphics (SVG) scriptable fourni par l'utilisateur est validé ou nettoyé pour contenir uniquement des balises et des attributs (tels que des graphiques de dessin) qui sont sûrs pour l'application, par exemple, ne contiennent pas de scripts et d'objets étrangers.2V1.3.55Vérifiez que l'application nettoie ou désactive le contenu du langage de modèle d'expression ou de script fourni par l'utilisateur, tel que les feuilles de style CSS, le Markdown ou XSL, BBCode ou similaire.2V1.3.66Vérifiez que l'application protège contre les attaques de falsification de requête côté serveur (SSRF), en validant les données non fiables par rapport à une liste d'autorisation de protocoles, de domaines, de chemins et de ports et en nettoyant les caractères potentiellement dangereux avant d'utiliser les données pour appeler un autre service.2V1.3.77Vérifiez que l'application se protège contre les attaques par injection de modèles en interdisant la création de modèles basés sur des entrées non fiables. En l'absence d'alternative, toute entrée non fiable incluse dynamiquement lors de la création du modèle doit être nettoyée ou rigoureusement validée.2V1.3.88Vérifiez que l’application nettoie correctement les entrées non fiables avant utilisation dans les requêtes Java Naming and Directory Interface (JNDI) et que JNDI est configuré de manière sécurisée pour empêcher les attaques par injection JNDI.2V1.3.99Vérifiez que l’application nettoie le contenu avant qu’il ne soit envoyé à memcache pour éviter les attaques par injection.2V1.3.1010Vérifiez que les chaînes de format susceptibles d'être résolues de manière inattendue ou malveillante lors de leur utilisation sont nettoyées avant d'être traitées.2V1.3.1111Vérifiez que l'application nettoie les entrées utilisateur avant de les transmettre aux systèmes de messagerie pour se protéger contre l'injection SMTP ou IMAP.2V1.3.1212Vérifiez que les expressions régulières sont exemptes d'éléments provoquant "backtracking" exponentiel et assurez-vous que les entrées non fiables sont nettoyées pour atténuer les attaques ReDoS ou Runaway Regex.3V1.44Mémoire, chaine de caractères et code à mémoire non-managéeV1.4.11Vérifiez que l'application utilise des chaînes memory-safe, une copie de mémoire et une arithmétique de pointeur renforcée pour détecter ou empêcher les débordements de pile, de tampon ou de tas.2V1.4.22Vérifiez que les techniques de validation du signe, de la plage et de l’entrée sont utilisées pour éviter les dépassements d’entiers.2V1.4.33Vérifiez que la mémoire et les ressources allouées dynamiquement sont libérées et que les références ou les pointeurs vers la mémoire libérée sont supprimés ou définis à null pour éviter les "dangling pointer" et les vulnérabilités d'utilisation après libération.2V1.55Désérialisation sécuriséeV1.5.11Vérifiez que l'application configure les "parser" XML pour utiliser une configuration restrictive et que les fonctionnalités non sûres telles que la résolution d'entités externes sont désactivées pour empêcher les attaques XML eXternal Entity (XXE).1V1.5.22Vérifiez que la désérialisation des données non fiables garantit une gestion sécurisée des entrées, par exemple en utilisant une liste d'autorisation de types d'objets ou en limitant les types d'objets définis par le client, afin d'empêcher les attaques par désérialisation. Les mécanismes de désérialisation explicitement définis comme non sécurisés ne doivent pas être utilisés avec des entrées non fiables.2V1.5.33Vérifiez que les différents "parser" utilisés dans l'application pour le même type de données (par exemple, les "parser" JSON, les "parser" XML, les "parser" d'URL) effectuent l'analyse de manière cohérente et utilisent le même mécanisme d'encodage de caractères pour éviter des problèmes tels que les vulnérabilités d'interopérabilité JSON ou un comportement d'analyse d'URI ou de fichier différent exploité dans les attaques d'inclusion de fichiers à distance (RFI) ou de falsification de requête côté serveur (SSRF).3V22ValidationValidation et logique métierV2.11Validation et documentation de la logique métierV2.1.11Vérifiez que la documentation de l'application définit des règles de validation des entrées pour vérifier la validité des éléments de données par rapport à la structure attendue. Il peut s'agir de formats de données courants tels que des numéros de carte de crédit, des adresses e-mail ou des numéros de téléphone, ou d'un format de données interne.1V2.1.22Vérifiez que la documentation de l'application définit comment valider la cohérence logique et contextuelle des éléments de données combinés, par exemple en vérifiant que la banlieue et le code postal correspondent.2V2.1.33Vérifiez que les attentes en matière de limites et de validations de la logique métier sont documentées, y compris par utilisateur et globalement dans l'application.2V2.22Validation des entréesV2.2.11Vérifier que les entrées sont validées afin de respecter les attentes métier ou fonctionnelles. Cette validation doit être basée sur une liste de valeurs, de modèles et de plages autorisées, ou sur la comparaison des entrées avec une structure attendue et des limites logiques selon des règles prédéfinies. Pour le niveau 1, cette validation peut se concentrer sur les entrées utilisées pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau 2, elle doit s'appliquer à toutes les entrées.1V2.2.22Vérifiez que l'application est conçue pour appliquer la validation des entrées au niveau d'une couche de service de confiance. Bien que la validation côté client améliore l'ergonomie et doit être encouragée, elle ne doit pas être considérée comme un contrôle de sécurité.1V2.2.33Vérifiez que l’application garantit que les combinaisons d’éléments de données associés sont raisonnables selon les règles prédéfinies.2V2.33Sécurité de la logique métierV2.3.11Vérifiez que l’application traitera uniquement les flux de logique métier pour le même utilisateur dans l’ordre séquentiel attendu et sans sauter d’étapes.1V2.3.22Vérifiez que les limites de la logique métier sont implémentées conformément à la documentation de l'application, afin d'éviter que des failles de la logique métier ne soient pas exploitées.2V2.3.33Vérifiez que les transactions sont utilisées au niveau de la logique métier de telle sorte qu'une opération de logique métier réussisse dans son intégralité ou qu'elle soit restaurée à l'état correct précédent.2V2.3.44Vérifiez que les mécanismes de verrouillage au niveau de la logique métier sont utilisés pour garantir que les ressources en quantité limitée (telles que les sièges de théâtre ou les créneaux de livraison) ne peuvent pas être réservées deux fois en manipulant la logique de l'application.2V2.3.55Vérifiez que les flux logiques métier à forte valeur ajoutée nécessitent l'approbation de plusieurs utilisateurs afin d'éviter toute action non autorisée ou accidentelle. Cela peut inclure, sans s'y limiter, les transferts monétaires importants, les approbations de contrats, l'accès à des informations classifiées ou les contournements de sécurité dans le secteur manufacturier.3V2.44Anti-automatisationV2.4.11Vérifiez que des contrôles anti-automatisation sont en place pour protéger contre les appels excessifs aux fonctions d'application qui pourraient conduire à l'exfiltration de données, à la création de données inutiles, à l'épuisement des quotas, aux violations de limites de débit, au déni de service ou à la surutilisation de ressources coûteuses.2V2.4.22Vérifiez que les flux logiques métier nécessitent un timing humain réaliste, évitant ainsi des soumissions de transactions excessivement rapides.3V33WebSécurité du frontend WebV3.11Documentation sur la sécurité du frontend WebV3.1.11Vérifiez que la documentation de l'application indique les fonctionnalités de sécurité attendues que les navigateurs utilisant l'application doivent prendre en charge (telles que HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) et autres mécanismes de sécurité HTTP pertinents). Elle doit également définir le comportement de l'application lorsque certaines de ces fonctionnalités ne sont pas disponibles (par exemple, avertir l'utilisateur ou bloquer l'accès).3V3.22Interprétation non intentionnelle du contenuV3.2.11Vérifiez que des contrôles de sécurité sont en place pour empêcher les navigateurs d'afficher du contenu ou des fonctionnalités dans les réponses HTTP dans un contexte incorrect (par exemple, lorsqu'une API, un fichier téléchargé par l'utilisateur ou une autre ressource est demandée directement). Les contrôles possibles peuvent inclure : ne pas transmettre le contenu sauf si les champs d'en-tête de requête HTTP (tels que Sec-Fetch-\*) indiquent qu'il s'agit du contexte correct, utiliser la directive sandbox du champ d'en-tête Content-Security-Policy ou utiliser le type de disposition de pièce jointe dans le champ d'en-tête Content-Disposition.1V3.2.22Vérifiez que le contenu destiné à être affiché sous forme de texte, plutôt que rendu sous forme de HTML, est géré à l'aide de fonctions de rendu sécurisées (telles que createTextNode ou textContent) pour empêcher l'exécution involontaire de contenu tel que HTML ou JavaScript.1V3.2.33Vérifiez que l'application évite l'écrasement du DOM lors de l'utilisation de JavaScript côté client en utilisant des déclarations de variables explicites, en effectuant une vérification de type stricte, en évitant de stocker des variables globales sur l'objet document et en implémentant l'isolation de l'espace de nommage.3V3.33Configuration des cookiesV3.3.11Vérifiez que les cookies ont l'attribut « Secure » ​​défini et si le préfixe « \__Host- » n'est pas utilisé pour le nom du cookie, le préfixe « __Secure- » doit être utilisé pour le nom du cookie.1V3.3.22Vérifiez que la valeur de l'attribut « SameSite » de chaque cookie est définie en fonction de l'objectif du cookie, afin de limiter l'exposition aux attaques de réparation de l'interface utilisateur et aux attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).2V3.3.33Vérifiez que les cookies ont le préfixe « __Host- » pour le nom du cookie, sauf s'ils sont explicitement conçus pour être partagés avec d'autres hôtes.2V3.3.44Vérifiez que si la valeur d'un cookie n'est pas censée être accessible aux scripts côté client (comme un jeton de session), le cookie doit avoir l'attribut « HttpOnly » défini et la même valeur (par exemple, un jeton de session) ne doit être transférée au client que via le champ d'en-tête « Set-Cookie ».2V3.3.55Vérifiez que lorsque l'application écrit un cookie, la longueur combinée du nom et de la valeur du cookie ne dépasse pas 4 096 octets. Les cookies trop volumineux ne seront pas stockés par le navigateur et ne seront donc pas envoyés avec les requêtes, empêchant ainsi l'utilisateur d'utiliser les fonctionnalités de l'application qui reposent sur ce cookie.3V3.44En-têtes du mécanisme de sécurité du navigateurV3.4.11Vérifiez qu'un champ d'en-tête Strict-Transport-Security est inclus dans toutes les réponses afin d'appliquer une politique HTTP Strict Transport Security (HSTS). Une durée maximale d'au moins un an doit être définie, et pour les niveaux L2 et supérieurs, la politique doit également s'appliquer à tous les sous-domaines.1V3.4.22Vérifiez que le champ d'en-tête Access-Control-Allow-Origin du partage de ressources cross-origine (CORS) est une valeur fixe de l'application ou, si la valeur du champ d'en-tête de requête HTTP Origin est utilisée, qu'elle est validée par rapport à une liste d'origines approuvées. Si « Access-Control-Allow-Origin: * » doit être utilisé, vérifiez que la réponse ne contient aucune information sensible.1V3.4.33Vérifiez que les réponses HTTP incluent un champ d'en-tête de réponse Content-Security-Policy qui définit des directives garantissant que le navigateur charge et exécute uniquement du contenu ou des ressources fiables, afin de limiter l'exécution de JavaScript malveillant. Au minimum, une politique globale doit être utilisée, incluant les directives object-src 'none' et base-uri 'none', et définissant soit une lliste d’autorisations, soit des valeurs nonces ou des hachages. Pour une application L3, une politique par réponse avec des valeurs nonces ou des hachages doit être définie.2V3.4.44Vérifiez que toutes les réponses HTTP contiennent un champ d'en-tête « X-Content-Type-Options: nosniff ». Cela indique aux navigateurs de ne pas utiliser l'analyse de contenu ni la détection du type MIME pour la réponse donnée, et d'exiger que la valeur du champ d'en-tête « Content-Type » de la réponse corresponde à la ressource de destination. Par exemple, la réponse à une demande de style n'est acceptée que si le type de contenu de la réponse est « text/css ». Cela permet également au navigateur d'utiliser la fonctionnalité de blocage de lecture inter-origines (CORB).2V3.4.55Vérifiez que l'application définit une politique de référencement afin d'empêcher la fuite de données techniquement sensibles vers des services tiers via le champ d'en-tête de requête HTTP « Referer ». Cela peut être effectué via le champ d'en-tête de réponse HTTP « Referrer-Policy » ou via les attributs d'élément HTML. Les données sensibles peuvent inclure le chemin d'accès et les données de requête dans l'URL, et pour les applications internes non publiques, le nom d'hôte.2V3.4.66Vérifiez que l'application Web utilise la directive frame-ancestors du champ d'en-tête Content-Security-Policy pour chaque réponse HTTP afin de garantir qu'elle ne peut pas être intégrée par défaut et que l'intégration de ressources spécifiques n'est autorisée qu'en cas de nécessité. Notez que le champ d'en-tête X-Frame-Options, bien que pris en charge par les navigateurs, est obsolète et n'est pas forcément fiable.2V3.4.77Vérifiez que le champ d’en-tête Content-Security-Policy spécifie un emplacement pour signaler les violations.3V3.4.88Vérifiez que toutes les réponses HTTP qui lancent le rendu d'un document (comme les réponses de type text/html) incluent le champ d'en-tête 'Cross-Origin-Opener-Policy' avec la directive 'same-origin' ou s'ame-origin-allow-popups', selon les besoins. Cela empêche les attaques abusant de l'accès partagé aux objets Window, telles que le tabnabbing et le comptage d'images.3V3.55Séparation de l'origine du navigateurV3.5.11Vérifiez que, si l'application ne s'appuie pas sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher les requêtes inter-origines non autorisées d'utiliser des fonctionnalités sensibles, ces requêtes sont validées afin de garantir leur origine. Cela peut se faire en utilisant et en validant des jetons anti-falsification ou en exigeant des champs d'en-tête HTTP supplémentaires qui ne sont pas des champs d'en-tête de requête CORS safelist. Ceci permet de se protéger contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).1V3.5.22Vérifiez que, si l'application s'appuie sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher l'utilisation inter-origines non autorisée de fonctionnalités sensibles, il est impossible d'appeler la fonctionnalité avec une requête qui ne déclenche pas de requête de pré-vérification cross-origin CORS. Cela peut nécessiter de vérifier les valeurs des champs d'en-tête de requête 'Origin' et 'Content-Type' ou d'utiliser un champ d'en-tête supplémentaire qui n'est pas un champ d'en-tête de la liste de sécurité CORS.1V3.5.33Vérifiez que les requêtes HTTP destinées aux fonctionnalités sensibles utilisent des méthodes HTTP appropriées, telles que POST, PUT, PATCH ou DELETE, et non des méthodes définies comme « sûres » par la spécification HTTP, telles que HEAD, OPTIONS ou GET. Une validation stricte des champs d'en-tête de requête Sec-Fetch-* peut également être utilisée pour garantir que la requête ne provient pas d'un appel inter-origines inapproprié, d'une requête de navigation ou d'un chargement de ressources (comme une source d'image) inattendu.1V3.5.44Vérifiez que des applications distinctes sont hébergées sur des noms d'hôte différents pour tirer parti des restrictions fournies par la politique de même origine, y compris la manière dont les documents ou scripts chargés par une origine peuvent interagir avec les ressources d'une autre origine et les restrictions basées sur le nom d'hôte sur les cookies.2V3.5.55Vérifiez que les messages reçus par l'interface postMessage sont rejetés si l'origine du message n'est pas digne de confiance ou si la syntaxe du message n'est pas valide.2V3.5.66Vérifiez que la fonctionnalité JSONP n'est activée nulle part dans l'application pour éviter les attaques Cross-Site Script Inclusion (XSSI).3V3.5.77Vérifiez que les données nécessitant une autorisation ne sont pas incluses dans les réponses des ressources de script, comme les fichiers JavaScript, pour empêcher les attaques par inclusion de script intersite (XSSI).3V3.5.88Vérifiez que les ressources authentifiées (telles que les images, les vidéos, les scripts et autres documents) peuvent être chargées ou intégrées pour le compte de l'utilisateur uniquement lorsque cela est prévu. Cela peut être réalisé en validant strictement les champs d'en-tête de requête HTTP Sec-Fetch-* afin de garantir que la requête ne provient pas d'un appel cross-origin inapproprié, ou en définissant un champ d'en-tête de réponse HTTP Cross-Origin-Resource-Policy restrictif pour indiquer au navigateur de bloquer le contenu renvoyé.3V3.66Intégrité des ressources externesV3.6.11Vérifiez que les ressources côté client, telles que les bibliothèques JavaScript, les feuilles de style CSS ou les polices web, sont hébergées en externe (par exemple, sur un réseau de diffusion de contenu) uniquement si la ressource est statique et versionnée, et si l'intégrité des sous-ressources (SRI) est utilisée pour valider l'intégrité de la ressource. Si cela n'est pas possible, une décision de sécurité documentée doit justifier cette décision pour chaque ressource.3V3.77Autres considérations sur la sécurité du navigateurV3.7.11Vérifiez que l'application utilise uniquement des technologies côté client toujours prises en charge et considérées comme sécurisées. Parmi les technologies qui ne répondent pas à cette exigence figurent les plugins NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL ou les applets Java côté client.2V3.7.22Vérifiez que l'application redirigera automatiquement l'utilisateur vers un nom d'hôte ou un domaine différent (qui n'est pas contrôlé par l'application) uniquement lorsque la destination apparaît sur une liste d'autorisation.2V3.7.33Vérifiez que le domaine de premier niveau de l'application (par exemple, site.tld) ​​est ajouté à la liste de préchargement publique pour HTTP Strict Transport Security (HSTS). Cela garantit que l'utilisation de TLS pour l'application est intégrée directement dans les principaux navigateurs, plutôt que de dépendre uniquement du champ d'en-tête de réponse Strict-Transport-Security.3V3.7.44Vérifiez que l'application affiche une notification lorsque l'utilisateur est redirigé vers une URL hors du contrôle de l'application, avec une option pour annuler la navigation.3V3.7.55Vérifiez que l'application se comporte comme documenté (par exemple, en avertissant l'utilisateur ou en bloquant l'accès) si le navigateur utilisé pour accéder à l'application ne prend pas en charge les fonctionnalités de sécurité attendues.3V44APIAPI et service WebV4.11Sécurité du service Web génériqueV4.1.11Vérifiez que chaque réponse HTTP avec un corps de message contient un champ d'en-tête Content-Type qui correspond au contenu réel de la réponse, y compris le paramètre charset pour spécifier un codage de caractères sécurisé (par exemple, UTF-8, ISO-8859-1) conformément aux types de médias IANA, tels que « text/ », « /+xml » et « /xml ».1V4.1.22Vérifiez que seuls les terminaux utilisateurs (destinés à l'accès manuel via un navigateur web) redirigent automatiquement de HTTP vers HTTPS, tandis que les autres services ou terminaux n'implémentent pas de redirections transparentes. Cela permet d'éviter qu'un client envoie par erreur des requêtes HTTP non chiffrées, mais que, comme ces requêtes sont automatiquement redirigées vers HTTPS, la fuite de données sensibles passe inaperçue.2V4.1.33Vérifiez que tout champ d'en-tête HTTP utilisé par l'application et défini par une couche intermédiaire, telle qu'un équilibreur de charge, un proxy web ou un service backend-for-frontend, ne peut pas être remplacé par l'utilisateur final. Les exemples d'en-têtes peuvent inclure X-Real-IP, X-Forwarded-*, ou X-User-ID.2V4.1.44Vérifiez que seules les méthodes HTTP explicitement prises en charge par l'application ou son API (y compris les OPTIONS lors des demandes de contrôle en amont) peuvent être utilisées et que les méthodes inutilisées sont bloquées.3V4.1.55Vérifier que les signatures numériques par message sont utilisées pour fournir une assurance supplémentaire en plus des protections de transport pour les demandes ou les transactions qui sont très sensibles ou qui traversent un certain nombre de systèmes.3V4.22Validation de la structure des messages HTTPV4.2.11Vérifiez que tous les composants de l'application (y compris les équilibreurs de charge, les pares-feux et les serveurs d'applications) déterminent les limites des messages HTTP entrants à l'aide du mécanisme approprié à la version HTTP afin d'empêcher la contrebande de requêtes HTTP. Dans HTTP/1.x, si un champ d'en-tête Transfer-Encoding est présent, l'en-tête Content-Length doit être ignoré conformément à la RFC 2616. Avec HTTP/2 ou HTTP/3, si un champ d'en-tête Content-Length est présent, le récepteur doit s'assurer qu'il est cohérent avec la longueur des trames DATA.2V4.2.22Vérifier que, lors de la génération de messages HTTP, le champ d'en-tête Content-Length n'entre pas en conflit avec la longueur du contenu déterminée par le cadrage du protocole HTTP, afin d'empêcher les attaques de type « request smuggling ».3V4.2.33Vérifiez que l'application n'envoie ni n'accepte de messages HTTP/2 ou HTTP/3 avec des champs d'en-tête spécifiques à la connexion, tels que Transfer-Encoding, afin d'éviter les attaques par fractionnement de la réponse et par injection d'en-tête.3V4.2.44Vérifiez que l'application n'accepte que les requêtes HTTP/2 et HTTP/3 dont les champs et valeurs d'en-tête ne contiennent pas de séquences CR (\r), LF (\n) ou CRLF (\r\n), afin d'éviter les attaques par injection d'en-tête.3V4.2.55Vérifiez que, si l'application (backend ou frontend) construit et envoie des requêtes, elle utilise des mécanismes de validation, d'assainissement ou autres pour éviter de créer des URI (comme pour les appels API) ou des champs d'en-tête de requête HTTP (comme Authorization ou Cookie) qui sont trop longs pour être acceptés par le composant récepteur. Cela pourrait entraîner un déni de service, par exemple lors de l'envoi d'une requête trop longue (par exemple, un long champ d'en-tête de cookie), ce qui fait que le serveur répond toujours avec un statut d'erreur.3V4.33GraphQLV4.3.11Vérifiez qu'une liste d'autorisation de requête, une limitation de profondeur, une limitation de quantité ou une analyse des coûts de requête est utilisée pour empêcher le déni de service (DoS) de GraphQL ou d'expression de la couche données en raison de requêtes imbriquées coûteuses.2V4.3.22Vérifiez que les requêtes d’introspection GraphQL sont désactivées dans l’environnement de production, sauf si l’API GraphQL est destinée à être utilisée par d’autres parties.2V4.44WebSocketV4.4.11Vérifiez que WebSocket sur TLS (WSS) est utilisé pour toutes les connexions WebSocket.1V4.4.22Vérifiez que, lors de la négociation HTTP WebSocket initiale, le champ d’en-tête 'Origin' est vérifié par rapport à une liste d’origines autorisées pour l’application.2V4.4.33Vérifiez que, si la gestion de session standard de l'application ne peut pas être utilisée, des jetons dédiés sont utilisés à cet effet, qui sont conformes aux exigences de sécurité de gestion de session pertinentes.2V4.4.44Vérifiez que les jetons de gestion de session WebSocket dédiés sont initialement obtenus ou validés via la session HTTPS précédemment authentifiée lors de la transition d'une session HTTPS existante vers un canal WebSocket.2V55FileGestion des fichiersV5.11Documentation sur la gestion des fichiersV5.1.11Vérifiez que la documentation définit les types de fichiers autorisés, les extensions de fichiers attendues et la taille maximale (y compris la taille décompressée) pour chaque fonctionnalité de Téléversement. De plus, assurez-vous que la documentation précise comment les fichiers sont sécurisés pour le téléchargement et le traitement des utilisateurs finaux, par exemple le comportement de l'application lorsqu'un fichier malveillant est détecté.2V5.22Téléversement de fichiers et contenuV5.2.11Vérifiez que l'application n'acceptera que des fichiers d'une taille qu'elle peut traiter sans provoquer de perte de performances ou d'attaque par déni de service.1V5.2.22Vérifiez que lorsque l'application accepte un fichier, seul ou dans une archive telle qu'un fichier zip, elle vérifie si l'extension de fichier correspond à une extension attendue et que le contenu correspond au type représenté par l'extension. Cela inclut, sans s'y limiter, la vérification des « octets magiques » initiaux, la réécriture d'images et l'utilisation de bibliothèques spécialisées pour la validation du contenu des fichiers. Pour le niveau L1, cela peut se concentrer uniquement sur les fichiers utilisés pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau L2, cela doit s'appliquer à tous les fichiers acceptés.1V5.2.33Vérifiez que l'application vérifie les fichiers compressés (par exemple, zip, gz, docx, odt) par rapport à la taille maximale autorisée non compressée et au nombre maximal de fichiers avant de décompresser le fichier.2V5.2.44Vérifiez qu'un quota de taille de fichier et un nombre maximal de fichiers par utilisateur sont appliqués pour garantir qu'un seul utilisateur ne puisse pas remplir le stockage avec trop de fichiers ou des fichiers excessivement volumineux.3V5.2.55Vérifiez que l'application n'autorise pas le téléversement de fichiers compressés contenant des liens symboliques, sauf si cela est spécifiquement requis (auquel cas il sera nécessaire d'appliquer une liste d'autorisation des fichiers vers lesquels il est possible de créer des liens symboliques).3V5.2.66Vérifiez que l'application rejette les images téléversées avec une taille de pixel supérieure au maximum autorisé, afin d'éviter les attaques par inondation de pixels.3V5.33Stockage de fichiersV5.3.11Vérifiez que les fichiers téléversés ou générés par une entrée non fiable et stockés dans un dossier public ne sont pas exécutés en tant que code de programme côté serveur lorsqu'ils sont accessibles directement avec une requête HTTP.1V5.3.22Vérifiez que lorsque l'application crée des chemins d'accès pour les opérations sur les fichiers, elle utilise des données générées en interne ou fiables plutôt que des noms de fichiers soumis par l'utilisateur. Si des noms de fichiers ou des métadonnées de fichiers soumis par l'utilisateur doivent être utilisés, une validation et un nettoyage stricts doivent être appliqués. Ceci permet de se protéger contre les attaques par traversée de chemin, l'inclusion de fichiers locaux ou distants (LFI, RFI) et la falsification de requêtes côté serveur (SSRF).1V5.3.33Vérifiez que le traitement des fichiers côté serveur, comme la décompression des fichiers, ignore les informations de chemin fournies par l'utilisateur pour éviter les vulnérabilités telles que le "zip slip".3V5.44Téléchargement de fichierV5.4.11Vérifiez que l’application valide ou ignore les noms de fichiers soumis par l’utilisateur, y compris dans un paramètre JSON, JSONP ou URL et spécifie un nom de fichier dans le champ d’en-tête Content-Disposition de la réponse.2V5.4.22Vérifiez que les noms de fichiers servis (par exemple, dans les champs d'en-tête de réponse HTTP ou les pièces jointes aux e-mails) sont encodés ou nettoyés (par exemple, conformément à la RFC 6266) pour préserver la structure du document et empêcher les attaques par injection.2V5.4.33Vérifiez que les fichiers obtenus à partir de sources non fiables sont analysés par des scanners antivirus pour empêcher la diffusion de contenu malveillant connu.2V66AuthenticationAuthentificationV6.11Documentation d'authentificationV6.1.11Vérifiez que la documentation de l'application définit comment les contrôles, tels que la limitation de débit, l'anti-automatisation et la réponse adaptative, sont utilisés pour se défendre contre les attaques telles que le « credential stuffing » et la force brute des mots de passe. La documentation doit expliquer clairement comment ces contrôles sont configurés et empêcher le blocage malveillant des comptes.1V6.1.22Vérifiez qu'une liste de mots spécifiques au contexte est documentée afin d'empêcher leur utilisation dans les mots de passe. Cette liste peut inclure des permutations de noms d'organisations, de produits, d'identifiants de systèmes, de noms de codes de projets, de noms de services ou de rôles, etc.2V6.1.33Vérifiez que, si l'application inclut plusieurs voies d'authentification, celles-ci sont toutes documentées avec les contrôles de sécurité et la force d'authentification qui doivent être appliqués de manière cohérente.2V6.22Sécurité des mots de passeV6.2.11Vérifiez que les mots de passe définis par l'utilisateur comportent au moins 8 caractères, bien qu'un minimum de 15 caractères soit fortement recommandé.1V6.2.22Vérifiez que les utilisateurs peuvent modifier leur mot de passe.1V6.2.33Vérifiez que la fonctionnalité de changement de mot de passe nécessite le mot de passe actuel et le nouveau mot de passe de l'utilisateur.1V6.2.44Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou du changement de mot de passe sont vérifiés par rapport à un ensemble disponible d'au moins 3 000 mots de passe principaux qui correspondent à la politique de mot de passe de l'application, par exemple la longueur minimale.1V6.2.55Vérifiez que les mots de passe peuvent être utilisés, quelle que soit leur composition, sans restriction quant au type de caractères autorisés. Aucun nombre minimal de majuscules ou de minuscules, de chiffres ou de caractères spéciaux ne doit être exigé.1V6.2.66Vérifiez que les champs de saisie du mot de passe utilisent type=password pour masquer la saisie. Les applications peuvent permettre à l'utilisateur d'afficher temporairement l'intégralité du mot de passe masqué ou le dernier caractère saisi.1V6.2.77Vérifiez que la fonctionnalité « coller », les assistants de mot de passe du navigateur et les gestionnaires de mots de passe externes sont autorisés.1V6.2.88Vérifiez que l'application vérifie le mot de passe de l'utilisateur exactement tel qu'il a été reçu de l'utilisateur, sans aucune modification telle qu'une troncature ou une transformation de casse.1V6.2.99Vérifiez que les mots de passe d’au moins 64 caractères sont autorisés.2V6.2.1010Vérifiez que le mot de passe d'un utilisateur reste valide jusqu'à ce qu'il soit découvert comme compromis ou qu'il soit renouvelé. L'application ne doit pas exiger de renouvellement périodique des identifiants.2V6.2.1111Vérifiez que la liste documentée de mots spécifiques au contexte est utilisée pour éviter la création de mots de passe faciles à deviner.2V6.2.1212Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou des modifications de mot de passe sont vérifiés par rapport à un ensemble de mots de passe fuités.2V6.33Sécurité générale de l'authentificationV6.3.11Vérifiez que les contrôles visant à empêcher les attaques telles que le bourrage d'informations d'identification et la force brute des mots de passe sont mis en œuvre conformément à la documentation de sécurité de l'application.1V6.3.22Vérifiez que les comptes d’utilisateur par défaut (par exemple, « root », « admin » ou « sa ») ne sont pas présents dans l’application ou sont désactivés.1V6.3.33Vérifiez que l’application exige que les utilisateurs utilisent un mécanisme d’authentification multifacteur ou une combinaison de mécanismes d’authentification à facteur unique.2V6.3.44Vérifiez que, si l’application inclut plusieurs voies d’authentification, il n’existe aucune voie non documentée et que les contrôles de sécurité et la force d’authentification sont appliqués de manière cohérente.2V6.3.55Vérifiez que les utilisateurs sont informés des tentatives d'authentification suspectes (réussies ou non). Il peut s'agir de tentatives d'authentification provenant d'un emplacement ou d'un client inhabituel, d'une authentification partiellement réussie (un seul facteur parmi plusieurs), d'une tentative d'authentification après une longue période d'inactivité ou d'une authentification réussie après plusieurs tentatives infructueuses.3V6.3.66Vérifiez que le courrier électronique n’est pas utilisé comme mécanisme d’authentification à facteur unique ou à facteurs multiples.3V6.3.77Vérifiez que les utilisateurs sont avertis après les mises à jour des détails d'authentification, telles que les réinitialisations d'informations d'identification ou la modification du nom d'utilisateur ou de l'adresse e-mail.3V6.3.88Vérifiez que les utilisateurs valides ne peuvent pas être déduits d'échecs d'authentification, par exemple en se basant sur des messages d'erreur, des codes de réponse HTTP ou des temps de réponse différents. Les fonctionnalités d'inscription et de mot de passe oublié doivent également bénéficier de cette protection.3V6.44Cycle de vie et récupération du facteur d'authentificationV6.4.11Vérifiez que les mots de passe initiaux ou les codes d'activation générés par le système sont générés de manière aléatoire et sécurisée, qu'ils respectent la politique de mots de passe en vigueur et qu'ils expirent après une courte période ou après leur première utilisation. Ces secrets initiaux ne doivent pas devenir des mots de passe permanents.1V6.4.22Vérifiez que les indices de mot de passe ou l'authentification basée sur les connaissances (appelées « questions secrètes ») ne sont pas présents.1V6.4.33Vérifiez qu'un processus sécurisé de réinitialisation d'un mot de passe oublié est mis en œuvre, qui ne contourne aucun mécanisme d'authentification multifacteur activé.2V6.4.44Vérifiez que si un facteur d'authentification multifacteur est perdu, la preuve de vérification d'identité est effectuée au même niveau que lors de l'inscription.2V6.4.55Vérifiez que les instructions de renouvellement des mécanismes d'authentification qui expirent sont envoyées avec suffisamment de temps pour être exécutées avant l'expiration de l'ancien mécanisme d'authentification, en configurant des rappels automatiques si nécessaire.3V6.4.66Vérifiez que les administrateurs peuvent initier la réinitialisation du mot de passe de l'utilisateur, mais que cela ne leur permet pas de modifier ou de choisir son mot de passe. Cela évite qu'ils ne connaissent le mot de passe de l'utilisateur.3V6.55Exigences générales en matière d'authentification multifacteurV6.5.11Vérifiez que les secrets de recherche, les demandes ou codes d'authentification out-of-band et les mots de passe à usage unique basés sur le temps (TOTP) ne peuvent être utilisés avec succès qu'une seule fois.2V6.5.22Vérifiez que, lors de leur stockage dans le backend de l'application, les secrets de recherche comportant moins de 112 bits d'entropie (19 caractères alphanumériques aléatoires ou 34 chiffres aléatoires) sont hachés avec un algorithme de hachage de stockage de mots de passe approuvé, intégrant un sel aléatoire de 32 bits. Une fonction de hachage standard peut être utilisée si le secret comporte 112 bits d'entropie ou plus.2V6.5.33Vérifiez que les secrets de recherche, le code d'authentification out-of-band et les mots de passe à usage unique basés sur le temps sont générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) pour éviter les valeurs prévisibles.2V6.5.44Vérifiez que les secrets de recherche et les codes d'authentification out-of-band ont un minimum de 20 bits d'entropie (généralement 4 caractères alphanumériques aléatoires ou 6 chiffres aléatoires suffisent).2V6.5.55Vérifiez que les requêtes, codes ou jetons d'authentification out-of-band, ainsi que les mots de passe à usage unique (TOTP), ont une durée de vie définie. Les requêtes out-of-band doivent avoir une durée de vie maximale de 10 minutes et les TOTP, de 30 secondes.2V6.5.66Vérifiez que tout facteur d’authentification (y compris les appareils physiques) peut être révoqué en cas de vol ou autre perte.3V6.5.77Vérifiez que les mécanismes d’authentification biométrique ne sont utilisés que comme facteurs secondaires, avec quelque chose que vous possédez ou quelque chose que vous savez.3V6.5.88Vérifiez que les mots de passe à usage unique basés sur le temps (TOTP) sont vérifiés en fonction d'une source temporelle provenant d'un service de confiance et non d'une heure non fiable ou fournie par le client.3V6.66Mécanismes d'authentification out-of-bandV6.6.11Vérifier que les mécanismes d'authentification utilisant le réseau téléphonique public commuté (RTPC) pour la transmission de mots de passe à usage unique (OTP) par téléphone ou SMS ne sont proposés que lorsque le numéro de téléphone a été préalablement validé. D'autres méthodes plus robustes (telles que les mots de passe à usage unique à durée déterminée) sont également proposées, et que le service informe les utilisateurs des risques de sécurité qu'elles présentent. Pour les applications de niveau 3, le téléphone et les SMS ne doivent pas être disponibles.2V6.6.22Vérifiez que les demandes d’authentification out-of-band, les codes ou les jetons sont liés à la demande d’authentification d’origine pour laquelle ils ont été générés et ne sont pas utilisables pour une demande précédente ou ultérieure.2V6.6.33Vérifiez qu'un mécanisme d'authentification out-of-band basé sur du code est protégé contre les attaques par force brute grâce au "rate limiting". Envisagez également d'utiliser un code avec au moins 64 bits d'entropie.2V6.6.44Vérifiez que, lorsque les notifications push sont utilisées pour l'authentification multifacteur, le "rate limiting" est appliqué afin d'empêcher les attaques de type « push bombing ». La concordance des numéros peut également atténuer ce risque.3V6.77Mécanisme d'authentification cryptographiqueV6.7.11Vérifiez que les certificats utilisés pour vérifier les assertions d’authentification cryptographique sont stockés de manière à les protéger contre toute modification.3V6.7.22Vérifiez que le nonce de défi a une longueur d'au moins 64 bits et qu'il est statistiquement unique ou unique sur toute la durée de vie du périphérique cryptographique.3V6.88Authentification avec un fournisseur d'identitéV6.8.11Vérifiez que, si l'application prend en charge plusieurs fournisseurs d'identité (IdP), l'identité de l'utilisateur ne peut pas être usurpée via un autre fournisseur d'identité pris en charge (par exemple, en utilisant le même identifiant utilisateur). La mesure standard consisterait à ce que l'application enregistre et identifie l'utilisateur à l'aide d'une combinaison de l'ID du fournisseur d'identité (servant d'espace de noms) et de l'ID de l'utilisateur dans le fournisseur d'identité.2V6.8.22Vérifiez que la présence et l'intégrité des signatures numériques sur les assertions d'authentification (par exemple sur les assertions JWT ou SAML) sont toujours validées, en rejetant toutes les assertions non signées ou ayant des signatures non valides.2V6.8.33Vérifiez que les assertions SAML sont traitées de manière unique et utilisées une seule fois au cours de la période de validité pour éviter les attaques par rejeu.2V6.8.44Si une application utilise un fournisseur d'identité (IdP) distinct et attend une force, des méthodes ou une date d'authentification spécifiques pour des fonctions spécifiques, vérifiez que l'application les vérifie à l'aide des informations renvoyées par l'IdP. Par exemple, si OIDC est utilisé, cela peut être réalisé en validant les affirmations de jeton d'identification telles que « acr », « amr » et « auth_time » (le cas échéant). Si l'IdP ne fournit pas ces informations, l'application doit disposer d'une approche de secours documentée qui suppose que le mécanisme d'authentification de force minimale a été utilisé (par exemple, une authentification à facteur unique avec nom d'utilisateur et mot de passe).2V77SessionGestion des sessionsV7.11Documentation sur la gestion des sessionsV7.1.11Vérifiez que le délai d'inactivité de la session de l'utilisateur et la durée de vie maximale absolue de la session sont documentés, sont appropriés en combinaison avec d'autres contrôles et que la documentation inclut une justification de tout écart par rapport aux exigences de réauthentification NIST SP 800-63B.2V7.1.22Vérifiez que la documentation définit le nombre de sessions simultanées (parallèles) autorisées pour un compte ainsi que les comportements et actions prévus à entreprendre lorsque le nombre maximal de sessions actives est atteint.2V7.1.33Vérifiez que tous les systèmes qui créent et gèrent des sessions utilisateur dans le cadre d'un écosystème de gestion des identités fédérées (tels que les systèmes SSO) sont documentés avec des contrôles pour coordonner la durée de vie des sessions, la résiliation et toute autre condition nécessitant une réauthentification.2V7.22Sécurité fondamentale de la gestion des sessionsV7.2.11Vérifiez que l’application effectue toutes les vérifications des jetons de session à l’aide d’un service backend de confiance.1V7.2.22Vérifiez que l'application utilise des jetons autonomes ou de référence générés dynamiquement pour la gestion des sessions, c'est-à-dire sans utiliser de secrets et de clés d'API statiques.1V7.2.33Vérifiez que si des jetons par référence sont utilisés pour représenter les sessions utilisateur, ils sont uniques et générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et possèdent au moins 128 bits d'entropie.1V7.2.44Vérifiez que l’application génère un nouveau jeton de session lors de l’authentification de l’utilisateur, y compris la réauthentification, et met fin au jeton de session actuel.1V7.33Délai d'expiration de la sessionV7.3.11Vérifiez qu’il existe un délai d’inactivité tel que la réauthentification soit appliquée conformément à l’analyse des risques et aux décisions de sécurité documentées.2V7.3.22Vérifiez qu'il existe une durée de vie maximale absolue de la session de sorte que la réauthentification soit appliquée conformément à l'analyse des risques et aux décisions de sécurité documentées.2V7.44Fin de sessionV7.4.11Vérifiez que lorsque la fin de session est déclenchée (par exemple, déconnexion ou expiration), l'application interdit toute utilisation ultérieure de la session. Pour les jetons par référence ou les sessions avec état, cela implique l'invalidation des données de session au niveau du backend de l'application. Les applications utilisant des jetons autonomes nécessiteront une solution, comme la gestion d'une liste des jetons terminés, l'interdiction des jetons produits avant une date et une heure spécifique à chaque utilisateur ou la rotation d'une clé de signature spécifique à chaque utilisateur.1V7.4.22Vérifiez que l'application met fin à toutes les sessions actives lorsqu'un compte utilisateur est désactivé ou supprimé (par exemple, lorsqu'un employé quitte l'entreprise).1V7.4.33Vérifiez que l'application offre la possibilité de mettre fin à toutes les autres sessions actives après une modification ou une suppression réussie de tout facteur d'authentification (y compris la modification du mot de passe via une réinitialisation ou une récupération et, le cas échéant, une mise à jour des paramètres MFA).2V7.4.44Vérifiez que toutes les pages nécessitant une authentification disposent d’un accès facile et visible à la fonctionnalité de déconnexion.2V7.4.55Vérifiez que les administrateurs d’applications sont en mesure de mettre fin aux sessions actives pour un utilisateur individuel ou pour tous les utilisateurs.2V7.55Défenses contre les abus de sessionV7.5.11Vérifiez que l'application nécessite une réauthentification complète avant d'autoriser les modifications des attributs de compte sensibles qui peuvent affecter l'authentification, tels que l'adresse e-mail, le numéro de téléphone, la configuration MFA ou d'autres informations utilisées dans la récupération de compte.2V7.5.22Vérifiez que les utilisateurs peuvent afficher et (après s'être authentifiés à nouveau avec au moins un facteur) terminer une ou toutes les sessions actuellement actives.2V7.5.33Vérifiez que l’application nécessite une authentification supplémentaire avec au moins un facteur ou une vérification secondaire avant d’effectuer des transactions ou des opérations hautement sensibles.3V7.66Réauthentification fédéréeV7.6.11Vérifiez que la durée de vie et la fin de la session entre les parties de confiance (RP) et les fournisseurs d'identité (IdP) se comportent comme documenté, en exigeant une réauthentification si nécessaire, par exemple lorsque le temps maximal entre les événements d'authentification IdP est atteint.2V7.6.22Vérifiez que la création d'une session nécessite soit le consentement de l'utilisateur, soit une action explicite, empêchant ainsi la création de nouvelles sessions d'application sans interaction de l'utilisateur.2V88AuthorizationAutorisationV8.11Documentation d'autorisationV8.1.11Vérifiez que la documentation d’autorisation définit des règles de restriction de l’accès au niveau de la fonction et aux données en fonction des autorisations du consommateur et des attributs des ressources.1V8.1.22Vérifiez que la documentation d'autorisation définit les règles de restriction d'accès au niveau des champs (lecture et écriture) en fonction des autorisations des consommateurs et des attributs des ressources. Notez que ces règles peuvent dépendre d'autres valeurs d'attributs de l'objet de données concerné, telles que l'état ou le statut.2V8.1.33Vérifiez que la documentation de l'application définit les attributs environnementaux et contextuels (y compris, mais sans s'y limiter, l'heure de la journée, l'emplacement de l'utilisateur, l'adresse IP ou l'appareil) qui sont utilisés dans l'application pour prendre des décisions de sécurité, y compris celles relatives à l'authentification et à l'autorisation.3V8.1.44Vérifier que la documentation d'authentification et d'autorisation définit l'utilisation des facteurs environnementaux et contextuels dans la prise de décision, en plus des autorisations au niveau des fonctions, des données et des champs. Cela doit inclure les attributs évalués, les seuils de risque et les actions entreprises (par exemple, autorisation, contestation, refus, renforcement de l'authentification).3V8.22Conception d'autorisation généraleV8.2.11Vérifiez que l’application garantit que l’accès basé sur la fonction est limité aux consommateurs disposant d’autorisations explicites.1V8.2.22Vérifiez que l'application garantit que l'accès spécifique aux données est limité aux consommateurs disposant d'autorisations explicites sur des éléments de données spécifiques afin d'atténuer les références d'objet directes non sécurisées (IDOR) et les autorisations de niveau d'objet rompues (BOLA).1V8.2.33Vérifiez que l'application garantit que l'accès au niveau du champ est limité aux consommateurs disposant d'autorisations explicites sur des champs spécifiques afin d'atténuer les problèmes d'autorisation au niveau de la propriété d'objet (BOPLA).2V8.2.44Vérifiez que les contrôles de sécurité adaptatifs basés sur les attributs environnementaux et contextuels du consommateur (tels que l'heure, la localisation, l'adresse IP ou l'appareil) sont mis en œuvre pour les décisions d'authentification et d'autorisation, comme défini dans la documentation de l'application. Ces contrôles doivent être appliqués lorsque le consommateur tente de démarrer une nouvelle session et également pendant une session existante.3V8.33Autorisation par opérationV8.3.11Vérifier que l'application applique les règles d'autorisations au niveau de la couche service de confiance et ne s’appuie pas sur des contrôles qu’un consommateur non approuvé pourrait manipuler, comme JavaScript côté client.1V8.3.22Vérifiez que les modifications apportées aux valeurs sur lesquelles reposent les décisions d'autorisation sont appliquées immédiatement. Lorsque les modifications ne peuvent pas être appliquées immédiatement (par exemple, en s'appuyant sur des données de jetons autonomes), des contrôles d'atténuation doivent être mis en place pour alerter un consommateur lorsqu'il effectue une action alors qu'il n'est plus autorisé à le faire et annuler la modification. Notez que cette solution alternative ne limiterait pas les fuites d'informations.3V8.3.33Vérifiez que l'accès à un objet repose sur les autorisations du sujet d'origine (par exemple, le consommateur), et non sur celles d'un intermédiaire ou d'un service agissant en son nom. Par exemple, si un consommateur appelle un service web à l'aide d'un jeton d'authentification autonome, et que ce service demande ensuite des données à un autre service, ce dernier utilisera le jeton du consommateur, plutôt qu'un jeton inter-machine du premier service, pour prendre les décisions d'autorisation.3V8.44Autres considérations relatives à l'autorisationV8.4.11Vérifiez que les applications multi-tenants utilisent des contrôles inter-tenants pour garantir que les opérations des consommateurs n'affecteront jamais les tenants avec lesquels ils ne sont pas autorisés à interagir.2V8.4.22Vérifiez que l'accès aux interfaces administratives intègre plusieurs couches de sécurité, notamment la vérification continue de l'identité du consommateur, l'évaluation de la posture de sécurité des appareils et l'analyse contextuelle des risques, garantissant que l'emplacement du réseau ou les endpoints approuvés ne sont pas les seuls facteurs d'autorisation, même s'ils peuvent réduire la probabilité d'accès non autorisé.3V99SelfJetons autonomesV9.11Source et intégrité du jetonV9.1.11Vérifiez que les jetons autonomes sont validés à l'aide de leur signature numérique ou MAC pour les protéger contre toute falsification avant d'accepter le contenu du jeton.1V9.1.22Vérifiez que seuls les algorithmes d'une liste d’autorisations peuvent être utilisés pour créer et vérifier des jetons autonomes, dans un contexte donné. La liste d'autorisation doit inclure les algorithmes autorisés, idéalement symétriques ou asymétriques, et ne doit pas inclure l'algorithme « Aucun ». Si les algorithmes symétriques et asymétriques doivent être pris en charge, des contrôles supplémentaires seront nécessaires pour éviter toute confusion de clés.1V9.1.33Vérifiez que les clés utilisées pour valider les jetons autonomes proviennent de sources préconfigurées et fiables pour l'émetteur du jeton, empêchant ainsi les attaquants de spécifier des sources et des clés non fiables. Pour les JWT et autres structures JWS, les en-têtes tels que « jku », « x5u » et « jwk » doivent être validés par rapport à une liste d'autorisation de sources fiables.1V9.22Contenu du jetonV9.2.11Vérifiez que, si une période de validité est indiquée dans les données du jeton, celui-ci et son contenu ne sont acceptés que si la date de vérification est comprise dans cette période. Par exemple, pour les JWT, les déclarations « nbf » et « exp » doivent être vérifiées.1V9.2.22Vérifiez que le service recevant un jeton valide le type de jeton et son utilisation avant d'en accepter le contenu. Par exemple, seuls les jetons d'accès peuvent être acceptés pour les décisions d'autorisation, et seuls les jetons d'identification peuvent être utilisés pour prouver l'authentification des utilisateurs.2V9.2.33Vérifiez que le service accepte uniquement les jetons destinés à être utilisés avec ce service (audience). Pour les JWT, cela peut être réalisé en validant la déclaration « aud » par rapport à une liste d'autorisation définie dans le service.2V9.2.44Si un émetteur de jetons utilise la même clé privée pour émettre des jetons destinés à différentes audiences, vérifiez que les jetons émis contiennent une restriction d'audience identifiant de manière unique les audiences visées. Cela empêchera la réutilisation d'un jeton avec une audience non prévue. Si l'identifiant d'audience est provisionné dynamiquement, l'émetteur de jetons doit valider ces audiences afin de garantir qu'elles n'entraînent pas d'usurpation d'identité.2V1010OAuthOauth et OIDCV10.11Sécurité générique OAuth et OIDCV10.1.11Vérifiez que les jetons sont envoyés uniquement aux composants qui en ont absolument besoin. Par exemple, lors de l'utilisation d'un modèle backend-for-frontend pour les applications JavaScript basées sur un navigateur, les jetons d'accès et d'actualisation ne doivent être accessibles qu'au backend.2V10.1.22Vérifiez que le client n'accepte les valeurs du serveur d'autorisation (telles que le code d'autorisation ou le jeton d'identification) que si elles résultent d'un flux d'autorisation initié par la même session d'agent utilisateur et la même transaction. Cela nécessite que les secrets générés par le client, tels que la clé de preuve pour l'échange de codes (PKCE) « code_verifier », « state » ou le nonce OIDC, ne puissent être devinés, soient spécifiques à la transaction et soient liés de manière sécurisée au client et à la session d'agent utilisateur au cours de laquelle la transaction a été initiée.2V10.22Client OAuthV10.2.11Vérifiez que, si le flux de code est utilisé, le client OAuth dispose d'une protection contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF), qui déclenchent des demandes de jetons, soit en utilisant la fonctionnalité de clé de preuve pour l'échange de code (PKCE), soit en vérifiant le paramètre « state » envoyé dans la demande d'autorisation.2V10.2.22Vérifiez que, si le client OAuth peut interagir avec plusieurs serveurs d'autorisation, il dispose d'une protection contre les attaques par confusion. Par exemple, il peut exiger que le serveur d'autorisation renvoie la valeur du paramètre « iss » et la valide dans la réponse d'autorisation et la réponse du jeton.2V10.2.33Vérifiez que le client OAuth demande uniquement les portées requises (ou d’autres paramètres d’autorisation) dans les requêtes adressées au serveur d’autorisation.3V10.33Serveur de ressources OAuthV10.3.11Vérifiez que le serveur de ressources accepte uniquement les jetons d'accès destinés à être utilisés avec ce service (audience). L'audience peut être incluse dans un jeton d'accès structuré (comme la déclaration « aud » dans JWT) ou vérifiée à l'aide du endpoint d'introspection de jeton.2V10.3.22Vérifiez que le serveur de ressources applique les décisions d'autorisation en fonction des déclarations du jeton d'accès définissant l'autorisation déléguée. Si des déclarations telles que « sub », « scope » et « authorization_details » sont présentes, elles doivent être prises en compte dans la décision.2V10.3.33Vérifiez que si une décision de contrôle d'accès nécessite l'identification d'un utilisateur unique à partir d'un jeton d'accès (JWT ou réponse d'introspection de jeton associé), le serveur de ressources identifie l'utilisateur à partir de déclarations non ré attribuables à d'autres utilisateurs. En général, cela implique l'utilisation d'une combinaison de déclarations « iss » et « sub ».2V10.3.44Si le serveur de ressources requiert une force d'authentification, des méthodes ou une date d'expiration spécifiques, vérifiez que le jeton d'accès présenté respecte ces contraintes. Par exemple, s'il est présent, utilisez les déclarations OIDC « acr », « amr » et « auth_time » respectivement.2V10.3.55Vérifiez que le serveur de ressources empêche l'utilisation de jetons d'accès volés ou la relecture de jetons d'accès (de parties non autorisées) en exigeant des jetons d'accès limités par l'expéditeur, soit Mutual TLS pour OAuth 2, soit OAuth 2 Demonstration of Proof of Possession (DPoP).3V10.44Serveur d'autorisation OAuthV10.4.11Vérifiez que le serveur d'autorisation valide les URI de redirection en fonction d'une liste d'autorisation spécifique au client d'URI préenregistrés à l'aide d'une comparaison de chaînes exacte.1V10.4.22Vérifiez que, si le serveur d'autorisation renvoie le code d'autorisation dans la réponse, celui-ci ne peut être utilisé qu'une seule fois pour une demande de jeton. Pour la deuxième demande valide avec un code d'autorisation déjà utilisé pour émettre un jeton d'accès, le serveur d'autorisation doit rejeter la demande de jeton et révoquer tous les jetons émis liés au code d'autorisation.1V10.4.33Vérifiez que le code d'autorisation est de courte durée. La durée de vie maximale peut atteindre 10 minutes pour les applications L1 et L2 et 1 minute pour les applications L3.1V10.4.44Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement l'utilisation des autorisations nécessaires à ce client. Notez que les autorisations « token » (flux implicite) et « password » (flux d'informations d'identification du propriétaire de la ressource) ne doivent plus être utilisées.1V10.4.55Vérifiez que le serveur d'autorisation atténue les attaques par rejeu de jetons d'actualisation pour les clients publics, de préférence en utilisant des jetons d'actualisation limités par l'expéditeur, par exemple des jetons DPoP (Demonstrating Proof of Possession) ou des jetons d'accès liés à un certificat utilisant le protocole TLS mutuel (mTLS). Pour les applications L1 et L2, la rotation des jetons d'actualisation peut être utilisée. Si cette rotation est utilisée, le serveur d'autorisation doit invalider le jeton d'actualisation après utilisation et révoquer tous les jetons d'actualisation de cette autorisation si un jeton d'actualisation déjà utilisé et invalidé est fourni.1V10.4.66Vérifiez que, si l'octroi de code est utilisé, le serveur d'autorisation atténue les attaques par interception de code en exigeant une clé de preuve pour l'échange de code (PKCE). Pour les demandes d'autorisation, le serveur d'autorisation doit exiger une valeur « code_challenge » valide et ne doit pas accepter une valeur « plain » pour « code_challenge_method ». Pour une demande de jeton, il doit exiger la validation du paramètre « code_verifier ».2V10.4.77Vérifiez que si le serveur d'autorisation prend en charge l'enregistrement dynamique des clients non authentifiés, il réduit le risque d'applications clientes malveillantes. Il doit valider les métadonnées clientes, telles que les URI enregistrés, garantir le consentement de l'utilisateur et l'avertir avant de traiter une demande d'autorisation avec une application cliente non approuvée.2V10.4.88Vérifiez que les jetons d’actualisation ont une expiration absolue, y compris si l’expiration du jeton d’actualisation glissant est appliquée.2V10.4.99Vérifiez que les jetons d'actualisation et les jetons d'accès de référence peuvent être révoqués par un utilisateur autorisé à l'aide de l'interface utilisateur du serveur d'autorisation, afin d'atténuer le risque de clients malveillants ou de jetons volés.2V10.4.1010Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.2V10.4.1111Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.2V10.4.1212Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement la valeur « response_mode » dont ce client a besoin. Par exemple, en vérifiant cette valeur par rapport aux valeurs attendues ou en utilisant une requête d'autorisation poussée (PAR) ou une requête d'autorisation sécurisée par JWT (JAR).3V10.4.1313Vérifiez que le type d'Autorisation « code » est toujours utilisé avec les demandes d'autorisation poussées (PAR).3V10.4.1414Vérifiez que le serveur d'autorisation émet uniquement des jetons d'accès limités à l'expéditeur (preuve de possession), soit avec des jetons d'accès liés au certificat utilisant TLS mutuel (mTLS), soit avec des jetons d'accès liés au DPoP (démonstration de preuve de possession).3V10.4.1515Vérifiez que, pour un client côté serveur (non exécuté sur l'appareil de l'utilisateur final), le serveur d'autorisation garantit que la valeur du paramètre « authorization_details » provient du backend client et que l'utilisateur ne l'a pas altérée. Par exemple, en exigeant l'utilisation d'une demande d'autorisation poussée (PAR) ou d'une demande d'autorisation sécurisée par JWT (JAR).3V10.4.1616Vérifiez que le client est confidentiel et que le serveur d'autorisation requiert l'utilisation de méthodes d'authentification client fortes (basées sur la cryptographie à clé publique et résistantes aux attaques par relecture), telles que TLS mutuel ('tls_client_auth', 'self_signed_tls_client_auth') ou JWT à clé privée ('private_key_jwt').3V10.55Client OIDCV10.5.11Vérifiez que le client (en tant que partie utilisatrice) atténue les attaques par rejeu de jeton d'identification. Par exemple, en vous assurant que la valeur « nonce » du jeton d'identification correspond à la valeur « nonce » envoyée dans la demande d'authentification au fournisseur OpenID (appelée demande d'autorisation envoyée au serveur d'autorisation dans OAuth2).2V10.5.22Vérifiez que le client identifie de manière unique l'utilisateur à partir des déclarations de jeton d'identification, généralement la déclaration « sub », qui ne peut pas être réaffectée à d'autres utilisateurs (pour la portée d'un fournisseur d'identité).2V10.5.33Vérifiez que le client rejette les tentatives d'un serveur d'autorisation malveillant d'usurper l'identité d'un autre serveur d'autorisation via ses métadonnées. Le client doit rejeter les métadonnées du serveur d'autorisation si l'URL de l'émetteur figurant dans ces métadonnées ne correspond pas exactement à l'URL d'émetteur préconfigurée attendue par le client.2V10.5.44Vérifiez que le client valide que le jeton d'identification est destiné à être utilisé pour ce client (audience) en vérifiant que la déclaration « aud » du jeton est égale à la valeur « client_id » pour le client.2V10.5.55Vérifiez que, lors de l'utilisation de la déconnexion du back-channel OIDC, la partie utilisatrice atténue les risques de déni de service liés à la déconnexion forcée et à la confusion entre JWT dans le flux de déconnexion. Le client doit vérifier que le jeton de déconnexion est correctement typé avec la valeur « logout+jwt », qu'il contient la déclaration « event » avec le nom de membre correct et qu'il ne contient pas de déclaration « nonce ». Il est également recommandé d'utiliser une expiration courte (par exemple, 2 minutes).2V10.66Fournisseur OpenIDV10.6.11Vérifiez que le fournisseur OpenID n'autorise que les valeurs « code », « ciba », « id_token » ou « id_token code » pour le mode de réponse. Notez que « code » est préférable à « id_token code » (flux hybride OIDC) et que « token » (tout flux implicite) ne doit pas être utilisé.2V10.6.22Vérifiez que le fournisseur OpenID atténue les risques de déni de service liés à la déconnexion forcée. Pour ce faire, obtenez une confirmation explicite de l'utilisateur final ou, le cas échéant, validez les paramètres de la requête de déconnexion (initiée par la partie utilisatrice), comme « id_token_hint ».2V10.77Gestion du consentementV10.7.11Vérifiez que le serveur d'autorisation garantit le consentement de l'utilisateur à chaque demande d'autorisation. Si l'identité du client ne peut être garantie, le serveur d'autorisation doit toujours demander explicitement le consentement de l'utilisateur.2V10.7.22Vérifiez que lorsque le serveur d'autorisation demande le consentement de l'utilisateur, il fournit des informations claires et suffisantes sur ce qui est consenti. Le cas échéant, ces informations doivent inclure la nature des autorisations demandées (généralement en fonction de la portée, du serveur de ressources et des détails d'autorisation RAR), l'identité de l'application autorisée et la durée de vie de ces autorisations.2V10.7.33Vérifiez que l’utilisateur peut consulter, modifier et révoquer les consentements qu’il a accordés via le serveur d’autorisation.2V1111CryptographyCryptographieV11.11Inventaire et documentation cryptographiquesV11.1.11Vérifiez qu’il existe une politique documentée pour la gestion des clés cryptographiques et un cycle de vie des clés cryptographiques qui suit une norme de gestion des clés telle que NIST SP 800-57. Cela devrait inclure la garantie que les clés ne sont pas sur-partagées (par exemple, avec plus de deux entités pour les secrets partagés et plus d’une entité pour les clés privées).2V11.1.22Vérifiez qu'un inventaire cryptographique est réalisé, maintenu et régulièrement mis à jour, et qu'il inclut toutes les clés, algorithmes et certificats cryptographiques utilisés par l'application. Il doit également documenter les emplacements du système où les clés peuvent ou non être utilisées, ainsi que les types de données qui peuvent ou non être protégées par ces clés.2V11.1.33Vérifiez que les mécanismes de découverte cryptographique sont utilisés pour identifier toutes les instances de cryptographie dans le système, y compris les opérations de chiffrement, de hachage et de signature.3V11.1.44Vérifier la tenue d'un inventaire cryptographique. Celui-ci doit inclure un plan documenté décrivant la migration vers de nouvelles normes cryptographiques, telles que la cryptographie post-quantique, afin de réagir aux menaces futures.3V11.22Mise en œuvre sécurisée de la cryptographieV11.2.11Vérifiez que les implémentations validées par l’industrie (y compris les bibliothèques et les implémentations accélérées par le matériel) sont utilisées pour les opérations cryptographiques.2V11.2.22Vérifiez que l'application est conçue avec une agilité cryptographique, de sorte que les nombres aléatoires, le chiffrement authentifié, le MAC ou les algorithmes de hachage, les longueurs de clés, les tours, les chiffrements et les modes puissent être reconfigurés, mis à niveau ou échangés à tout moment, afin de se protéger contre les failles cryptographiques. De même, il doit être possible de remplacer les clés et les mots de passe, ainsi que de rechiffrer les données. Cela permettra des mises à niveau transparentes vers la cryptographie post-quantique (PQC), une fois que des implémentations hautement sécurisées de schémas ou de normes PQC approuvés seront largement disponibles.2V11.2.33Vérifiez que toutes les primitives cryptographiques utilisent un minimum de 128 bits de sécurité en fonction de l'algorithme, de la taille de la clé et de la configuration. Par exemple, une clé ECC de 256 bits offre environ 128 bits de sécurité, tandis que RSA nécessite une clé de 3072 bits pour atteindre 128 bits de sécurité.2V11.2.44Vérifiez que toutes les opérations cryptographiques sont à temps constant, sans opérations de « court-circuit » dans les comparaisons, les calculs ou les retours, pour éviter toute fuite d'informations.3V11.2.55Vérifiez que tous les modules cryptographiques échouent en toute sécurité et que les erreurs sont gérées de manière à ne pas permettre de vulnérabilités, telles que les attaques Padding Oracle.3V11.33Algorithmes de chiffrementV11.3.11Vérifiez que les modes de bloc non sécurisés (par exemple, ECB) et les schémas de remplissage faibles (par exemple, PKCS#1 v1.5) ne sont pas utilisés.1V11.3.22Vérifiez que seuls les chiffrements et modes approuvés tels que AES avec GCM sont utilisés.1V11.3.33Vérifiez que les données chiffrées sont protégées contre toute modification non autorisée, de préférence en utilisant une méthode de chiffrement authentifiée approuvée ou en combinant une méthode de chiffrement approuvée avec un algorithme MAC approuvé.2V11.3.44Vérifiez que les nonces, les vecteurs d'initialisation et autres nombres à usage unique ne sont pas utilisés pour plus d'une paire clé de chiffrement/élément de données. La méthode de génération doit être adaptée à l'algorithme utilisé.3V11.3.55Vérifiez que toute combinaison d'un algorithme de chiffrement et d'un algorithme MAC fonctionne en mode chiffrement puis MAC.3V11.44Hachage et fonctions basées sur le hachageV11.4.11Vérifiez que seules les fonctions de hachage approuvées sont utilisées pour les cas d'utilisation cryptographiques généraux, notamment les signatures numériques, HMAC, KDF et la génération de bits aléatoires. Les fonctions de hachage non autorisées, telles que MD5, ne doivent pas être utilisées à des fins cryptographiques.1V11.4.22Vérifiez que les mots de passe sont stockés à l'aide d'une fonction de dérivation de clés approuvée et gourmande en ressources de calcul (également appelée « fonction de hachage de mots de passe »), dont les paramètres sont configurés conformément aux directives en vigueur. Ces paramètres doivent équilibrer sécurité et performances afin de rendre les attaques par force brute suffisamment difficiles pour le niveau de sécurité requis.2V11.4.33Vérifiez que les fonctions de hachage utilisées dans les signatures numériques, dans le cadre de l'authentification ou de l'intégrité des données, sont résistantes aux collisions et possèdent des longueurs de bits appropriées. Si la résistance aux collisions est requise, la longueur de sortie doit être d'au moins 256 bits. Si seule la résistance aux attaques de seconde pré-image est requise, la longueur de sortie doit être d'au moins 128 bits.2V11.4.44Vérifiez que l'application utilise des fonctions de dérivation de clés approuvées avec des paramètres d'extension de clés lors de la dérivation de clés secrètes à partir de mots de passe. Les paramètres utilisés doivent concilier sécurité et performances afin d'empêcher les attaques par force brute de compromettre la clé cryptographique obtenue.2V11.55Valeurs aléatoiresV11.5.11Vérifiez que tous les nombres et chaînes aléatoires destinés à être non devinables doivent être générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et posséder au moins 128 bits d'entropie. Notez que les UUID ne respectent pas cette condition.2V11.5.22Vérifiez que le mécanisme de génération de nombres aléatoires utilisé est conçu pour fonctionner en toute sécurité, même en cas de forte demande.3V11.66Cryptographie à clé publiqueV11.6.11Vérifier que seuls des algorithmes cryptographiques et des modes opératoires approuvés sont utilisés pour la génération et l'amorçage des clés, ainsi que pour la génération et la vérification des signatures numériques. Les algorithmes de génération de clés ne doivent pas générer de clés non sécurisées et vulnérables aux attaques connues, par exemple les clés RSA vulnérables à la factorisation de Fermat.2V11.6.22Vérifiez que des algorithmes cryptographiques approuvés sont utilisés pour l'échange de clés (tels que Diffie-Hellman), en veillant à ce que les mécanismes d'échange de clés utilisent des paramètres sécurisés. Cela permettra d'éviter les attaques contre le processus d'établissement des clés, susceptibles de conduire à des attaques de type « adversaire du milieu » ou à des failles cryptographiques.3V11.77Cryptographie des données en cours d'utilisationV11.7.11Vérifiez que le chiffrement complet de la mémoire est utilisé pour protéger les données sensibles pendant leur utilisation, empêchant ainsi l'accès par des utilisateurs ou des processus non autorisés.3V11.7.22Vérifiez que la minimisation des données garantit que la quantité minimale de données est exposée pendant le traitement et assurez-vous que les données sont chiffrées immédiatement après utilisation ou dès que possible.3V1212SecureCommunication sécuriséeV12.11Conseils généraux de sécurité TLSV12.1.11Vérifiez que seules les dernières versions recommandées du protocole TLS sont activées, telles que TLS 1.2 et TLS 1.3. La dernière version du protocole TLS doit être privilégiée.1V12.1.22Vérifiez que seules les suites de chiffrement recommandées sont activées, les suites de chiffrement les plus puissantes étant définies comme préférées. Les applications L3 doivent uniquement prendre en charge les suites de chiffrement assurant la confidentialité persistante (forward secrecy).2V12.1.33Vérifiez que l’application valide que les certificats clients mTLS sont approuvés avant d’utiliser l’identité du certificat pour l’authentification ou l’autorisation.2V12.1.44Vérifiez que la révocation de certification appropriée, telle que l'agrafage du protocole OCSP (Online Certificate Status Protocol), est activée et configurée.3V12.1.55Vérifiez que Encrypted Client Hello (ECH) est activé dans les paramètres TLS de l'application pour empêcher l'exposition de métadonnées sensibles, telles que l'indication du nom du serveur (SNI), pendant les processus de négociation TLS.3V12.22Communication HTTPS avec des services externesV12.2.11Vérifiez que TLS est utilisé pour toute connectivité entre un client et des services externes basés sur HTTP, et ne recourt pas à des communications non sécurisées ou non chiffrées.1V12.2.22Vérifiez que les services externes utilisent des certificats TLS publiquement approuvés.1V12.33Sécurité des communications entre services générauxV12.3.11Vérifiez qu'un protocole chiffré tel que TLS est utilisé pour toutes les connexions entrantes et sortantes vers et depuis l'application, y compris les systèmes de surveillance, les outils de gestion, l'accès à distance et SSH, les intergiciels, les bases de données, les mainframes, les systèmes partenaires ou les API externes. Le serveur ne doit pas recourir à des protocoles non sécurisés ou non chiffrés.2V12.3.22Vérifiez que les clients TLS valident les certificats reçus avant de communiquer avec un serveur TLS.2V12.3.33Vérifiez que TLS ou un autre mécanisme de chiffrement de transport approprié est utilisé pour toute connectivité entre les services internes basés sur HTTP au sein de l'application et ne se replie pas vers des communications non sécurisées ou non chiffrées.2V12.3.44Vérifiez que les connexions TLS entre les services internes utilisent des certificats de confiance. Lorsque des certificats générés en interne ou auto-signés sont utilisés, le service consommateur doit être configuré pour n'approuver que des autorités de certification internes spécifiques et des certificats auto-signés spécifiques.2V12.3.55Vérifiez que les services communiquant en interne au sein d'un système (communications intra-services) utilisent une authentification forte pour garantir la vérification de chaque endpoint. Des méthodes d'authentification forte, telles que l'authentification client TLS, doivent être utilisées pour garantir l'identité, en utilisant une infrastructure à clé publique et des mécanismes résistants aux attaques par rejeu. Pour les architectures de microservices, envisagez d'utiliser un maillage de services pour simplifier la gestion des certificats et renforcer la sécurité.3V1313ConfigurationConfigurationV13.11Documentation de configurationV13.1.11Vérifiez que tous les besoins de communication de l'application sont documentés. Cela doit inclure les services externes dont l'application dépend et les cas où un utilisateur final pourrait fournir un emplacement externe auquel l'application se connectera.2V13.1.22Vérifiez que pour chaque service utilisé par l'application, la documentation définit le nombre maximal de connexions simultanées (par exemple, les limites du pool de connexions) et le comportement de l'application lorsque cette limite est atteinte, y compris les mécanismes de secours ou de récupération, pour éviter les conditions de déni de service.3V13.1.33Vérifiez que la documentation de l'application définit des stratégies de gestion des ressources pour chaque système ou service externe utilisé (par exemple, bases de données, descripteurs de fichiers, threads, connexions HTTP). Cela doit inclure les procédures de libération des ressources, les paramètres de délai d'expiration, la gestion des échecs et l'implémentation de la logique de nouvelle tentative, en spécifiant les limites de nouvelle tentative, les délais et les algorithmes de retour arrière. Pour les opérations de requête-réponse HTTP synchrones, la documentation doit imposer des délais d'expiration courts et soit désactiver les nouvelles tentatives, soit les limiter strictement afin d'éviter les retards en cascade et l'épuisement des ressources.3V13.1.44Vérifiez que la documentation de l'application définit les secrets essentiels à la sécurité de l'application et un calendrier de rotation de ceux-ci, en fonction du modèle de menace et des exigences commerciales de l'organisation.3V13.22Configuration de la communication backendV13.2.11Vérifiez que les communications entre les composants de l'application backend qui ne prennent pas en charge le mécanisme de session utilisateur standard de l'application, notamment les API, les intergiciels et les couches de données, sont authentifiées. L'authentification doit utiliser des comptes de service individuels, des jetons à court terme ou une authentification par certificat, et non des identifiants immuables tels que des mots de passe, des clés API ou des comptes partagés avec accès privilégié.2V13.2.22Vérifiez que les communications entre les composants de l'application backend, y compris les services locaux ou du système d'exploitation, les API, les intergiciels et les couches de données, sont effectuées avec des comptes dotés des privilèges les moins nécessaires.2V13.2.33Vérifiez que si des informations d’identification doivent être utilisées pour l’authentification du service, les informations d’identification utilisées par le consommateur ne sont pas des informations d’identification par défaut (par exemple, root/root ou admin/admin).2V13.2.44Vérifiez qu'une liste d’autorisations est utilisée pour définir les ressources ou systèmes externes avec lesquels l'application est autorisée à communiquer (par exemple, pour les requêtes sortantes, les chargements de données ou l'accès aux fichiers). Cette liste d'autorisation peut être implémentée au niveau de la couche applicative, du serveur web, du pare-feu ou d'une combinaison de différentes couches.2V13.2.55Vérifiez que le serveur Web ou d’application est configuré avec une liste autorisée de ressources ou de systèmes vers lesquels le serveur peut envoyer des requêtes ou charger des données ou des fichiers.2V13.2.66Vérifiez que lorsque l'application se connecte à des services distincts, elle suit la configuration documentée pour chaque connexion, comme le nombre maximal de connexions parallèles, le comportement lorsque le nombre maximal de connexions autorisées est atteint, les délais d'expiration de connexion et les stratégies de nouvelle tentative.3V13.33Gestion des secretsV13.3.11Vérifiez qu'une solution de gestion des secrets, telle qu'un coffre-fort de clés, est utilisée pour créer, stocker, contrôler l'accès et détruire en toute sécurité les secrets backend. Ceux-ci peuvent inclure des mots de passe, du matériel de clé, des intégrations avec des bases de données et des systèmes tiers, des clés et des graines pour des jetons temporels, d'autres secrets internes et des clés API. Les secrets ne doivent pas être inclus dans le code source de l'application ni dans les artefacts de build. Pour une application L3, cela doit impliquer une solution matérielle telle qu'un HSM.2V13.3.22Vérifiez que l’accès aux ressources secrètes respecte le principe du moindre privilège.2V13.3.33Vérifiez que toutes les opérations cryptographiques sont effectuées à l'aide d'un module de sécurité isolé (tel qu'un coffre-fort ou un module de sécurité matériel) pour gérer et protéger en toute sécurité le matériel clé contre toute exposition en dehors du module de sécurité.3V13.3.44Vérifiez que les secrets sont configurés pour expirer et être renouvelés en fonction de la documentation de l'application.3V13.44Fuite d'informations involontaireV13.4.11Vérifiez que l'application est déployée soit sans aucune métadonnée de contrôle de source, y compris les dossiers .git ou .svn, soit de manière à ce que ces dossiers soient inaccessibles à la fois en externe et à l'application elle-même.1V13.4.22Vérifiez que les modes de débogage sont désactivés pour tous les composants dans les environnements de production afin d’éviter l’exposition des fonctionnalités de débogage et la fuite d’informations.2V13.4.33Vérifiez que les serveurs Web n’exposent pas les listes de répertoires aux clients, sauf si cela est explicitement prévu.2V13.4.44Vérifiez que l’utilisation de la méthode HTTP TRACE n’est pas prise en charge dans les environnements de production, afin d’éviter toute fuite d’informations potentielle.2V13.4.55Vérifiez que la documentation (comme pour les API internes) et les endpoints de surveillance ne sont pas exposés, sauf si cela est explicitement prévu.2V13.4.66Vérifiez que l’application n’expose pas d’informations de version détaillées des composants backend.3V13.4.77Vérifiez que la couche web est configuré pour servir uniquement les fichiers avec des extensions de fichier spécifiques afin d’éviter toute fuite involontaire d’informations, de configuration et de code source.3V1414DataProtection des donnéesV14.11Documentation sur la protection des donnéesV14.1.11Vérifiez que toutes les données sensibles créées et traitées par l'application ont été identifiées et classées selon leur niveau de protection. Cela inclut les données uniquement codées et donc facilement déchiffrables, telles que les chaînes Base64 ou la charge utile en texte clair d'un JWT. Les niveaux de protection doivent tenir compte des réglementations et normes de protection des données et de confidentialité auxquelles l'application est tenue de se conformer.2V14.1.22Vérifier que tous les niveaux de protection des données sensibles sont assortis d'un ensemble documenté d'exigences de protection. Cela doit inclure (sans s'y limiter) les exigences relatives au chiffrement général, à la vérification de l'intégrité, à la conservation, à la journalisation des données, aux contrôles d'accès aux données sensibles dans les journaux, au chiffrement au niveau de la base de données, aux technologies de confidentialité et de renforcement de la confidentialité à utiliser, ainsi qu'aux autres exigences de confidentialité.2V14.22Protection générale des donnéesV14.2.11Vérifiez que les données sensibles sont uniquement envoyées au serveur dans les champs de corps ou d’en-tête du message HTTP, et que l’URL et la chaîne de requête ne contiennent pas d’informations sensibles, telles qu’une clé API ou un jeton de session.1V14.2.22Vérifiez que l’application empêche la mise en cache des données sensibles dans les composants du serveur, tels que les équilibreurs de charge et les caches d’application, ou garantit que les données sont purgées en toute sécurité après utilisation.2V14.2.33Vérifiez que les données sensibles définies ne sont pas envoyées à des parties non fiables (par exemple, des trackers d'utilisateurs) pour empêcher la collecte indésirable de données en dehors du contrôle de l'application.2V14.2.44Vérifiez que les contrôles autour des données sensibles liés au chiffrement, à la vérification de l'intégrité, à la conservation, à la manière dont les données doivent être enregistrées, aux contrôles d'accès autour des données sensibles dans les journaux, à la confidentialité et aux technologies d'amélioration de la confidentialité, sont mis en œuvre comme défini dans la documentation pour le niveau de protection des données spécifiques.2V14.2.55Vérifiez que les mécanismes de mise en cache sont configurés pour ne mettre en cache que les réponses dont le type de contenu est conforme à la ressource et qui ne contiennent pas de contenu sensible et dynamique. Le serveur web doit renvoyer une réponse 404 ou 302 lors de l'accès à un fichier inexistant plutôt qu'un fichier valide différent. Cela devrait empêcher les attaques par empoisonnement de cache web.3V14.2.66Vérifiez que l'application ne renvoie que les données sensibles minimales requises pour son fonctionnement. Par exemple, ne renvoyez que certains chiffres d'un numéro de carte de crédit, et non le numéro complet. Si les données complètes sont requises, elles doivent être masquées dans l'interface utilisateur, sauf si l'utilisateur les consulte spécifiquement.3V14.2.77Vérifiez que les informations sensibles sont soumises à une classification de conservation des données, en veillant à ce que les données obsolètes ou inutiles soient supprimées automatiquement, selon un calendrier défini ou selon les besoins de la situation.3V14.2.88Vérifiez que les informations sensibles sont supprimées des métadonnées des fichiers soumis par l'utilisateur, sauf si le stockage est autorisé par l'utilisateur.3V14.33Protection des données côté clientV14.3.11Vérifiez que les données authentifiées sont effacées du stockage client, comme le DOM du navigateur, après la fin du client ou de la session. Le champ d'en-tête de réponse HTTP « Clear-Site-Data » peut être utile, mais le côté client devrait également pouvoir effectuer la correction si la connexion au serveur n'est pas disponible à la fin de la session.1V14.3.22Vérifiez que l'application définit suffisamment de champs d'en-tête de réponse HTTP anti-caching (c'est-à-dire Cache-Control : no-store) afin que les données sensibles ne soient pas mises en cache dans les navigateurs.2V14.3.33Vérifiez que les données stockées dans le stockage du navigateur (telles que localStorage, sessionStorage, IndexedDB ou les cookies) ne contiennent pas de données sensibles, à l'exception des jetons de session.2V1515SecureDéveloppement et architecture sécurisésV15.11Documentation sur le développement et l'architecture sécurisésV15.1.11Vérifiez que la documentation de l'application définit les délais de correction basés sur les risques pour les versions de composants tiers présentant des vulnérabilités et pour la mise à jour des bibliothèques en général, afin de minimiser les risques liés à ces composants.1V15.1.22Vérifiez qu'un catalogue d'inventaire, tel qu'une nomenclature logicielle (SBOM), est conservé pour toutes les bibliothèques tierces utilisées, y compris en vérifiant que les composants proviennent de référentiels prédéfinis, fiables et continuellement maintenus.2V15.1.33Vérifiez que la documentation de l'application identifie les fonctionnalités consommatrices en temps ou gourmandes en ressources. Elle doit notamment indiquer comment prévenir une perte de disponibilité due à une utilisation excessive de ces fonctionnalités et éviter que la génération d'une réponse ne prenne plus de temps que le délai d'expiration du consommateur. Les mesures de protection potentielles peuvent inclure le traitement asynchrone, l'utilisation de files d'attente et la limitation des processus parallèles par utilisateur et par application.2V15.1.44Vérifiez que la documentation de l’application met en évidence les bibliothèques tierces qui sont considérées comme des « composants à risque ».3V15.1.55Vérifiez que la documentation de l’application met en évidence les parties de l’application où des « fonctionnalités dangereuses » sont utilisées.3V15.22Architecture de sécurité et dépendancesV15.2.11Vérifiez que l’application contient uniquement des composants qui n’ont pas dépassé les délais de mise à jour et de correction documentés.1V15.2.22Vérifiez que l'application a mis en œuvre des défenses contre la perte de disponibilité due à des fonctionnalités qui prennent du temps ou qui nécessitent des ressources, sur la base des décisions et stratégies de sécurité documentées à cet effet.2V15.2.33Vérifiez que l'environnement de production inclut uniquement les fonctionnalités nécessaires au fonctionnement de l'application et n'expose pas de fonctionnalités superflues telles que du code de test, des exemples d'extraits et des fonctionnalités de développement.2V15.2.44Vérifiez que les composants tiers et toutes leurs dépendances transitives sont inclus à partir du référentiel attendu, qu'il soit détenu en interne ou qu'il s'agisse d'une source externe, et qu'il n'y a aucun risque d'attaque par confusion de dépendances.3V15.2.55Vérifiez que l'application implémente des protections supplémentaires autour des parties documentées comme contenant des « fonctionnalités dangereuses » ou utilisant des bibliothèques tierces considérées comme des « composants à risque ». Cela peut inclure des techniques telles que le sandboxing, l'encapsulation, la conteneurisation ou l'isolation au niveau du réseau pour retarder et dissuader les attaquants qui compromettent une partie de l'application de se propager ailleurs.3V15.33Développement défensifV15.3.11Vérifiez que l'application ne renvoie que le sous-ensemble requis de champs d'un objet de données. Par exemple, elle ne doit pas renvoyer un objet de données entier, car certains champs individuels ne doivent pas être accessibles aux utilisateurs.1V15.3.22Vérifiez que lorsque le backend de l'application effectue des appels vers des URL externes, il est configuré pour ne pas suivre les redirections, sauf s'il s'agit d'une fonctionnalité prévue.2V15.3.33Vérifiez que l'application dispose de contre-mesures pour se protéger contre les attaques d'affectation de masse en limitant les champs autorisés par contrôleur et action, par exemple, il n'est pas possible d'insérer ou de mettre à jour une valeur de champ lorsqu'elle n'était pas destinée à faire partie de cette action.2V15.3.44Vérifiez que tous les composants proxy et middleware transfèrent correctement l'adresse IP d'origine de l'utilisateur à l'aide de champs de données fiables qui ne peuvent pas être manipulés par l'utilisateur final, et que l'application et le serveur Web utilisent cette valeur correcte pour la journalisation et les décisions de sécurité telles que la limitation du débit, en tenant compte du fait que même l'adresse IP d'origine peut ne pas être fiable en raison d'adresses IP dynamiques, de VPN ou de pare-feu d'entreprise.2V15.3.55Vérifiez que l'application garantit explicitement que les variables sont du type correct et effectue des opérations d'égalité et de comparaison strictes. Cela permet d'éviter les vulnérabilités liées à la confusion de types, causées par des hypothèses du code de l'application sur le type d'une variable.2V15.3.66Vérifiez que le code JavaScript est écrit de manière à éviter la pollution du prototype, par exemple en utilisant Set() ou Map() au lieu de littéraux d'objet.2V15.3.77Vérifiez que l'application dispose de défenses contre les attaques de pollution des paramètres HTTP, en particulier si le Framework d'application ne fait aucune distinction quant à la source des paramètres de requête (chaîne de requête, paramètres de corps, cookies ou champs d'en-tête).2V15.44Concurrence sécuriséeV15.4.11Vérifiez que les objets partagés dans le code multithread (tels que les caches, les fichiers ou les objets en mémoire accessibles par plusieurs threads) sont accessibles en toute sécurité à l'aide de types thread-safe et de mécanismes de synchronisation tels que des verrous ou des sémaphores pour éviter les conditions de concurrence et la corruption des données.3V15.4.22Vérifiez que les vérifications de l'état d'une ressource, comme son existence ou ses autorisations, et des actions qui en dépendent, sont effectuées en une seule opération atomique afin d'éviter les situations de concurrence entre le moment de la vérification et le moment de l'utilisation (TOCTOU). Par exemple, vérifier l'existence d'un fichier avant de l'ouvrir ou l'accès d'un utilisateur avant de l'accorder.3V15.4.33Vérifiez que les verrous sont utilisés de manière cohérente pour éviter que les threads ne se bloquent, que ce soit en s'attendant les uns les autres ou en réessayant sans fin, et que la logique de verrouillage reste dans le code responsable de la gestion de la ressource pour garantir que les verrous ne peuvent pas être modifiés par inadvertance ou de manière malveillante par des classes ou du code externes.3V15.4.44Vérifiez que les politiques d'allocation des ressources empêchent la saturation de threads en garantissant un accès équitable aux ressources, par exemple en exploitant les pools de threads, permettant aux threads de priorité inférieure de continuer dans un délai raisonnable.3V1616SecurityJournalisation de sécurité et gestion des erreursV16.11Documentation sur la journalisation de sécuritéV16.1.11Vérifiez qu'il existe un inventaire documentant la journalisation effectuée à chaque couche de la pile technologique de l'application, les événements enregistrés, les formats de journal, l'endroit où cette journalisation est stockée, la manière dont elle est utilisée, la manière dont l'accès à celle-ci est contrôlé et la durée de conservation des journaux.2V16.22Journalisation généraleV16.2.11Vérifiez que chaque entrée de journal inclut les métadonnées nécessaires (telles que quand, où, qui, quoi) qui permettraient une enquête détaillée sur la chronologie lorsqu'un événement se produit.2V16.2.22Vérifiez que les sources de temps de tous les composants de journalisation sont synchronisées et que les horodatages des métadonnées des événements de sécurité utilisent le temps UTC ou incluent un décalage horaire explicite. L'UTC est recommandé pour garantir la cohérence entre les systèmes distribués et éviter toute confusion lors du passage à l'heure d'été.2V16.2.33Vérifiez que l’application stocke ou diffuse uniquement les journaux vers les fichiers et services documentés dans l’inventaire des journaux.2V16.2.44Vérifiez que les journaux peuvent être lus et corrélés par le processeur de journaux utilisé, de préférence en utilisant un format de journalisation commun.2V16.2.55Vérifiez que l'application applique la journalisation en fonction du niveau de protection des données lors de la journalisation de données sensibles. Par exemple, certaines données, comme les identifiants ou les informations de paiement, peuvent être interdites. D'autres données, comme les jetons de session, ne peuvent être enregistrées que par hachage ou masquage, en totalité ou en partie.2V16.33Événements de sécuritéV16.3.11Vérifiez que toutes les opérations d'authentification sont enregistrées, y compris les tentatives réussies et infructueuses. Des métadonnées supplémentaires, telles que le type d'authentification ou les facteurs utilisés, doivent également être collectées.2V16.3.22Vérifier que les tentatives d'autorisation infructueuses sont logguées. Pour le niveau 3, cela doit inclure la journalisation de toutes les décisions d'autorisation, y compris lors de l'accès à des données sensibles (sans journalisation des données sensibles elles-mêmes).2V16.3.33Vérifiez que l'application enregistre les événements de sécurité définis dans la documentation et enregistre également les tentatives de contournement des contrôles de sécurité, tels que la validation des entrées, la logique métier et l'anti-automatisation.2V16.3.44Vérifiez que l’application enregistre les erreurs inattendues et les échecs de contrôle de sécurité tels que les échecs TLS du backend.2V16.44Protection des journauxV16.4.11Vérifiez que tous les composants de journalisation codent correctement les données pour empêcher l’injection de journaux.2V16.4.22Vérifiez que les journaux sont protégés contre tout accès non autorisé et ne peuvent pas être modifiés.2V16.4.33Vérifiez que les journaux sont transmis de manière sécurisée à un système logique distinct pour analyse, détection, alerte et remontée des informations. L'objectif est de garantir qu'en cas de violation de l'application, les journaux ne seront pas compromis.2V16.55Gestion des erreursV16.5.11Vérifiez qu'un message générique est renvoyé au consommateur lorsqu'une erreur inattendue ou sensible à la sécurité se produit, garantissant ainsi l'absence d'exposition de données système internes sensibles telles que les traces de pile, les requêtes, les clés secrètes et les jetons.2V16.5.22Vérifiez que l'application continue de fonctionner en toute sécurité lorsque l'accès aux ressources externes échoue, par exemple, en utilisant des modèles tels que des disjoncteurs ou une dégradation progressive.2V16.5.33Vérifiez que l'application échoue proprement et sécurisée, y compris lorsqu'une exception se produit, en évitant les accès en cas d'erreur telles que le traitement d'une transaction malgré les erreurs résultant de la logique de validation.2V16.5.44Vérifiez qu'un gestionnaire d'erreurs de « dernier recours » est défini pour intercepter toutes les exceptions non gérées. Cela permet d'éviter la perte des informations d'erreur qui doivent être loguées dans les fichiers journaux et de garantir qu'une erreur ne paralyse pas l'ensemble du processus applicatif, entraînant une perte de disponibilité.3V1717WebRTCWebRTCV17.11Serveur TURNV17.1.11Vérifiez que le service TURN (Traversal Using Relays around NAT) autorise uniquement l'accès aux adresses IP non réservées à des fins spécifiques (par exemple, réseaux internes, diffusion, bouclage). Notez que cela s'applique aux adresses IPv4 et IPv6.2V17.1.22Vérifiez que le service Traversal Using Relays around NAT (TURN) n'est pas susceptible d'épuiser ses ressources lorsque des utilisateurs légitimes tentent d'ouvrir un grand nombre de ports sur le serveur TURN.3V17.22MédiaV17.2.11Vérifiez que la clé du certificat Datagram Transport Layer Security (DTLS) est gérée et protégée conformément à la politique documentée de gestion des clés cryptographiques.2V17.2.22Vérifiez que le serveur multimédia est configuré pour utiliser et prendre en charge les suites de chiffrement DTLS (Datagram Transport Layer Security) approuvées et un profil de protection sécurisé pour l'extension DTLS pour l'établissement de clés pour le protocole de transport en temps réel sécurisé (DTLS-SRTP).2V17.2.33Vérifiez que l'authentification SRTP (Secure Real-time Transport Protocol) est vérifiée sur le serveur multimédia pour empêcher les attaques par injection RTP (Real-time Transport Protocol) d'entraîner une condition de déni de service ou l'insertion de médias audio ou vidéo dans les flux multimédias.2V17.2.44Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant lorsqu'il rencontre des paquets SRTP (Secure Real-time Transport Protocol) mal formés.2V17.2.55Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.3V17.2.66Vérifiez que le serveur multimédia n'est pas sensible à la vulnérabilité de condition de concurrence « ClientHello » dans Datagram Transport Layer Security (DTLS) en vérifiant si le serveur multimédia est publiquement connu comme étant vulnérable ou en effectuant le test de condition de concurrence.3V17.2.77Vérifiez que tous les mécanismes d'enregistrement audio ou vidéo associés au serveur multimédia sont en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.3V17.2.88Vérifiez que le certificat Datagram Transport Layer Security (DTLS) est vérifié par rapport à l'attribut d'empreinte cryptographique du protocole de description de session (SDP), en mettant fin au flux multimédia si la vérification échoue, pour garantir l'authenticité du flux multimédia.3V17.33SignalisationV17.3.11Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation entrants légitimes lors d'une attaque par saturation. Cela peut être réalisé en implémentant une limitation de débit au niveau de la signalisation.2V17.3.22Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation légitimes en cas de message mal formé susceptible de provoquer un déni de service. Cela peut inclure la validation des entrées, la gestion sécurisée des dépassements d'entiers, la prévention des dépassements de tampon et l'utilisation d'autres techniques robustes de gestion des erreurs.2 diff --git a/5.0/docs_fr/fr b/5.0/docs_fr/fr new file mode 100644 index 0000000000..e69de29bb2 diff --git a/5.0/fr/0x00-Header.yaml b/5.0/fr/0x00-Header.yaml new file mode 100644 index 0000000000..baa283a0b7 --- /dev/null +++ b/5.0/fr/0x00-Header.yaml @@ -0,0 +1,16 @@ +--- + title: "Référentiel de vérification de la sécurité des applications" + subtitle: "Version 5.0.0" + date: Mai 2025 + titlepage: true + titlepage-rule-height: 0 + titlepage-logo: "images/owasp_logo_1c_notext.png" + table-use-row-colors: true + toc: true + toc-own-page: true + geometry: "left=2cm,right=2cm,top=3cm,bottom=3cm" + CJKmainfont: "Noto Sans CJK JP" + mainfont: "Source Serif 4" + sansfont: "Source Sans 3" +--- + diff --git a/5.0/fr/0x01-Frontispiece.md b/5.0/fr/0x01-Frontispiece.md new file mode 100644 index 0000000000..17644d009b --- /dev/null +++ b/5.0/fr/0x01-Frontispiece.md @@ -0,0 +1,46 @@ +# Frontispice + +## À propos du référentiel + +Le Référentiel de vérification de la sécurité des applications (Application Security Verification Standard) est une liste d'exigences de sécurité des applications que les architectes, les développeurs, les testeurs, les professionnels de la sécurité, les fournisseurs d'outils et les consommateurs peuvent utiliser pour définir, créer, tester et vérifier des applications sécurisées. + +## Copyright et licence + +Version 5.0.0, Mai 2025 + +![license](../images/license.png) + +Copyright © 2008-2025 La Fondation OWASP. + +Ce document est publié sous la [licence Creative Commons Attribution ShareAlike 4.0](https://creativecommons.org/licenses/by-sa/4.0/). + +Pour toute réutilisation ou distribution, vous devez indiquer clairement aux autres les termes de la licence de ce travail. + +## Chefs de projet + +| | | +|---------------------- |----------------- | +| Elar Lang | Josh C Grossman | +| Jim Manico | Daniel Cuthbert | + +## Groupes de travail + +| | | | | +|---------------- |------------------ |------------------- |----------------- | +| Tobias Ahnoff | Ralph Andalis | Ryan Armstrong | Gabriel Corona | +| Meghan Jacquot | Shanni Prutchi | Iman Sharafaldin | Eden Yardeni | + +## Autres contributeurs majeurs + +| | | +|------------------ |-------------------| +| Sjoerd Langkemper | Isaac Lewis | +| Mark Carney | Sandro Gauci | + +## Contributeurs et relecteurs + +Nous avons inclus une liste des autres contributeurs dans l’annexe E. + +S'il manque un crédit dans la liste des crédits 5.0, veuillez enregistrer un ticket sur GitHub pour être reconnu dans les futures mises à jour. + +Le référentiel de vérification de la sécurité des applications repose sur les épaules des personnes concernées, de ASVS 1.0 en 2008 à 4.0 en 2019. Une grande partie de la structure et des éléments de vérification qui sont encore dans l'ASVS aujourd'hui ont été écrits à l'origine par Andrew van der Stock, Mike Boberski, Jeff Williams et/ou Dave Wichers, mais il y a beaucoup plus de contributeurs. Merci à tous ceux qui y ont participé précédemment. Pour une liste complète de tous ceux qui ont contribué aux versions précédentes, veuillez consulter chaque version antérieure. diff --git a/5.0/fr/0x02-Preface.md b/5.0/fr/0x02-Preface.md new file mode 100644 index 0000000000..6322e99ace --- /dev/null +++ b/5.0/fr/0x02-Preface.md @@ -0,0 +1,29 @@ +# Préface + +Bienvenue dans la version 5.0 du référentiel de vérification de la sécurité des applications (ASVS). + +## Introduction + +Lancé à l'origine en 2008 grâce à une collaboration communautaire mondiale, l'ASVS définit un ensemble exhaustif d'exigences de sécurité pour la conception, le développement et le test d'applications et de services Web modernes. + +Après la sortie d'ASVS 4.0 en 2019 et sa mise à jour mineure (v4.0.3) en 2021, la version 5.0 représente une étape importante, modernisée pour refléter les dernières avancées en matière de sécurité logicielle. + +ASVS 5.0 est le résultat de nombreuses contributions des chefs de projet, des membres du groupe de travail et de la communauté OWASP au sens large pour mettre à jour et améliorer ce référentiel important. + +## Principes derrière la version 5.0 + +Cette révision majeure a été élaborée en gardant à l’esprit plusieurs principes clés : + +* Périmètre et orientation affinées : Cette version du référentiel a été conçue pour s'aligner plus directement sur les piliers fondamentaux de son nom : Application, Sécurité, Vérification et Référentiel. Les exigences ont été réécrites afin de mettre l'accent sur la prévention des failles de sécurité plutôt que d'imposer des implémentations techniques spécifiques. Les textes des exigences sont explicites et expliquent leur raison d'être. + +* Prise en charge des décisions de sécurité documentées : ASVS 5.0 introduit des exigences de documentation des décisions de sécurité clés. Cela améliore la traçabilité et prend en charge les implémentations qui dépendent du contexte, permettant aux organisations d'adapter leur posture de sécurité à leurs besoins et risques spécifiques. + +* Niveaux mis à jour : Bien qu'ASVS conserve son modèle à trois niveaux, les définitions des niveaux ont évolué pour faciliter son adoption. Le niveau 1 est conçu comme la première étape de l'adoption d'ASVS, fournissant la première couche de défense. Le niveau 2 offre une vue d'ensemble des pratiques de sécurité standard, et le niveau 3 répond aux exigences avancées de haute assurance. + +* Contenu restructuré et enrichi : ASVS 5.0 comprend environ 350 exigences réparties en 17 chapitres. Les chapitres ont été réorganisés pour plus de clarté et de praticité. Un mappage bidirectionnel entre les versions 4.0 et 5.0 est fourni pour faciliter la migration. + +## Regard vers l'avenir + +Tout comme la sécurisation d'une application n'est jamais vraiment achevée, l'ASVS ne l'est pas non plus. Bien que la version 5.0 soit une version majeure, le développement se poursuit. Cette version permet à la communauté de bénéficier des améliorations et des ajouts accumulés, et pose également les bases de futures améliorations. Cela pourrait inclure des efforts communautaires pour créer des guides de mise en œuvre et de vérification, basés sur les exigences de base. + +ASVS 5.0 est conçu pour servir de base fiable au développement de logiciels sécurisés. La communauté est invitée à adopter, contribuer et développer ce référentiel afin de faire progresser collectivement la sécurité des applications. diff --git a/5.0/fr/0x03-What-is-the-ASVS.md b/5.0/fr/0x03-What-is-the-ASVS.md new file mode 100644 index 0000000000..fe9cf4ebac --- /dev/null +++ b/5.0/fr/0x03-What-is-the-ASVS.md @@ -0,0 +1,195 @@ +# Qu'est-ce que l'ASVS ? + +Le Référentiel de vérification de la sécurité des applications (ASVS) définit des exigences de sécurité pour les applications et services web. Elle constitue une ressource précieuse pour quiconque souhaite concevoir, développer et maintenir des applications sécurisées ou évaluer leur sécurité. + +Ce chapitre décrit les aspects essentiels de l'utilisation de l'ASVS, notamment son champ d'application, la structure de ses niveaux de priorité et ses principaux cas d'utilisation. + +## Périmètre de l'ASVS + +Le périmètre de l'ASVS est définie par son nom : Application, Sécurité, Vérification et Référentiel. Elle établit les exigences incluses ou exclues, avec pour objectif principal d'identifier les principes de sécurité à respecter. Elle prend également en compte les exigences de documentation, qui servent de base aux exigences de mise en œuvre. + +Il n'existe aucun périmètre pour les attaquants. Par conséquent, les exigences de l'ASVS doivent être évaluées parallèlement aux recommandations relatives aux autres aspects du cycle de vie des applications, notamment les processus CI/CD, l'hébergement et les activités opérationnelles. + +### Application + +ASVS définit une « application » comme le produit logiciel en cours de développement, dans lequel des contrôles de sécurité doivent être intégrés. ASVS ne prescrit pas les activités du cycle de développement ni la manière dont l'application doit être construite via un pipeline CI/CD ; il spécifie plutôt les résultats de sécurité à atteindre au sein même du produit. + +Les composants qui traitent, modifient ou valident le trafic HTTP, tels que les pares-feux d'applications web (WAF), les équilibreurs de charge ou les proxys, peuvent être considérés comme faisant partie de l'application à ces fins spécifiques, car certains contrôles de sécurité en dépendent directement ou peuvent être implémentés par leur intermédiaire. Ces composants doivent être pris en compte pour les exigences liées aux réponses mises en cache, à la limitation du débit ou à la restriction des connexions entrantes et sortantes en fonction de la source et de la destination. + +À l'inverse, ASVS exclut généralement les exigences qui ne concernent pas directement l'application ou dont la configuration ne relève pas de sa responsabilité. Par exemple, les problèmes DNS sont généralement gérés par une équipe ou une fonction distincte. + +De même, si l'application est responsable de la manière dont elle consomme les entrées et produit les sorties, l'interaction d'un processus externe avec l'application ou ses données est considérée comme hors du périmètre d'ASVS. Par exemple, la sauvegarde de l'application ou de ses données relève généralement de la responsabilité d'un processus externe et n'est pas contrôlée par l'application ou ses développeurs. + +### Sécurité + +Chaque exigence doit avoir un impact démontrable sur la sécurité. L'absence d'exigence doit entraîner une application moins sécurisée, et sa mise en œuvre doit réduire la probabilité ou l'impact d'un risque de sécurité. + +Toutes les autres considérations, telles que les aspects fonctionnels, le style de code ou les exigences de politique, sont hors du périmètre d'application. + +### Vérification + +L'exigence doit être vérifiable et la vérification doit aboutir à une décision d'échec ou de réussite. + +### Référentiel + +L'ASVS est conçue comme un recueil d'exigences de sécurité à mettre en œuvre pour se conformer au référentiel. Cela signifie que les exigences se limitent à la définition de l'objectif de sécurité à atteindre. D'autres informations connexes peuvent être intégrées à l'ASVS ou reliées par des mappings. + +Plus précisément, l'OWASP comporte de nombreux projets, et l'ASVS évite délibérément tout chevauchement avec le contenu d'autres projets. Par exemple, les développeurs peuvent se demander : « Comment implémenter une exigence particulière dans ma technologie ou mon environnement ? » Cette question devrait être traitée par le projet « Cheat-Sheets ». Les vérificateurs peuvent se demander : « Comment tester cette exigence dans cet environnement ? » Cette question devrait être traitée par le projet « Web Security Testing Guide ». + +Bien que l'ASVS ne soit pas uniquement destiné aux experts en sécurité, il attend du lecteur des connaissances techniques pour comprendre le contenu ou la capacité à rechercher des concepts spécifiques. + +### Exigence + +Le terme « exigence » est utilisé spécifiquement dans l'ASVS car il décrit ce qui doit être accompli pour la satisfaire. L'ASVS ne contient que des exigences (doit) et ne contient pas de recommandations (devrait) comme condition principale. + +En d'autres termes, les recommandations, qu'elles constituent une solution parmi d'autres ou des considérations de style de code, ne répondent pas à la définition d'une exigence. + +Les exigences de l'ASVS visent à répondre à des principes de sécurité spécifiques sans être trop spécifiques à une implémentation ou à une technologie, tout en étant explicites quant à leur raison d'être. Cela signifie également que les exigences ne sont pas construites autour d'une méthode de vérification ou d'une implémentation particulière. + +### Décisions de sécurité documentées + +En matière de sécurité logicielle, planifier la conception de la sécurité et les mécanismes à utiliser en amont permettra une implémentation plus cohérente et fiable du produit fini ou de la fonctionnalité. + +De plus, pour certaines exigences, la mise en œuvre sera complexe et très spécifique aux besoins de l'application. Parmi les exemples courants, on peut citer les autorisations, la validation des entrées et les contrôles de protection autour de différents niveaux de données sensibles. + +Pour tenir compte de cela, plutôt que de formuler des affirmations générales telles que « toutes les données doivent être chiffrées » ou de tenter de couvrir tous les cas d'utilisation possibles dans une exigence, des exigences de documentation ont été incluses, exigeant que l'approche et la configuration du développeur d'applications pour ces types de contrôles soient documentées. Ceci peut ensuite être vérifié pour en vérifier la pertinence, puis la mise en œuvre réelle peut être comparée à la documentation afin d'évaluer si elle répond aux attentes. + +Ces exigences visent à documenter les décisions prises par l'organisation développant l'application concernant la mise en œuvre de certaines exigences de sécurité. + +Les exigences de documentation figurent toujours dans la première section d'un chapitre (bien que tous les chapitres n'en disposent pas) et sont toujours associées à une exigence de mise en œuvre, où les décisions documentées doivent être effectivement mises en œuvre. L'essentiel est de distinguer la vérification de la documentation et de la mise en œuvre effective. + +L'inclusion de ces exigences repose sur deux facteurs clés. Le premier est qu'une exigence de sécurité implique souvent l'application de règles, par exemple concernant les types de fichiers autorisés à être téléchargés, les contrôles métier à appliquer et les caractères autorisés pour un champ particulier. Ces règles diffèrent d'une application à l'autre ; par conséquent, l'ASVS ne peut pas les définir de manière prescriptive, et un aide-mémoire ou une réponse plus détaillée ne serait d'aucune utilité dans ce cas précis. De même, sans documentation de ces décisions, il sera impossible de vérifier les exigences qui les mettent en œuvre. + +Le deuxième facteur est que, pour certaines exigences, il est important d'offrir au développement d'applications une certaine flexibilité quant à la manière de répondre à des défis de sécurité particuliers. Par exemple, dans les versions précédentes d'ASVS, les règles d'expiration de session étaient très strictes. En pratique, de nombreuses applications, notamment celles destinées aux utilisateurs, ont des règles beaucoup plus souples et préfèrent mettre en œuvre d'autres contrôles d'atténuation. Les exigences de documentation permettent donc explicitement cette flexibilité. + +Il est clair que les développeurs ne sont pas censés prendre et documenter ces décisions individuellement, mais que l'organisation dans son ensemble les prend et s'assure qu'elles sont communiquées aux développeurs, qui s'assurent ensuite de les respecter. + +Fournir aux développeurs des spécifications et des conceptions pour de nouvelles fonctionnalités est une étape standard du développement logiciel. De même, les développeurs sont censés utiliser des composants et des mécanismes d'interface utilisateur communs plutôt que de prendre leurs propres décisions à chaque fois. Par conséquent, étendre ce principe à la sécurité ne devrait pas être perçu comme surprenant ou controversé. + +La manière d'y parvenir est également flexible. Les décisions de sécurité peuvent être documentées dans un document littéral, auquel les développeurs sont tenus de se référer. Alternativement, elles peuvent être documentées et implémentées dans une bibliothèque de code commune que tous les développeurs sont tenus d'utiliser. Dans les deux cas, le résultat souhaité est atteint. + +## Niveaux de vérification de la sécurité des applications + +L'ASVS définit trois niveaux de vérification de la sécurité, chaque niveau augmentant en profondeur et en complexité. L'objectif général est que les organisations commencent par le premier niveau pour répondre aux préoccupations de sécurité les plus critiques, puis progressent vers les niveaux supérieurs en fonction des besoins de l'organisation et des applications. Les niveaux peuvent être présentés comme L1, L2 et L3 dans le document et dans les textes d'exigences. + +Chaque niveau ASVS indique les exigences de sécurité à atteindre à partir de ce niveau, les exigences des niveaux supérieurs restants étant des recommandations. + +Afin d'éviter les doublons ou les exigences obsolètes aux niveaux supérieurs, certaines exigences s'appliquent à un niveau particulier, mais sont soumises à des conditions plus strictes pour les niveaux supérieurs. + +### Évaluation des niveaux + +Les niveaux sont définis par une évaluation de priorité de chaque exigence, basée sur l'expérience de mise en œuvre et de test des exigences de sécurité. L'accent est mis principalement sur la balance entre la réduction des risques et les efforts nécessaires à la mise en œuvre de l'exigence. Un autre facteur clé est de maintenir une faible barrière à l'entrée. + +La réduction des risques évalue dans quelle mesure l'exigence réduit le niveau de risque de sécurité au sein de l'application, en tenant compte des facteurs d'impact classiques de confidentialité, d'intégrité et de disponibilité, et en déterminant s'il s'agit d'une couche de défense principale ou d'une défense en profondeur. + +Les discussions rigoureuses autour des critères et des décisions de nivellement ont abouti à une répartition qui devrait s'appliquer à la grande majorité des cas, tout en admettant qu'elle ne soit pas parfaitement adaptée à toutes les situations. Cela signifie que, dans certains cas, les organisations peuvent souhaiter prioriser les exigences d'un niveau supérieur en amont, en fonction de leurs propres considérations de risque. + +Les types d'exigences à chaque niveau peuvent être caractérisés comme suit. + +### Niveau 1 + +Ce niveau contient les exigences minimales à prendre en compte pour sécuriser une application et constitue un point de départ essentiel. Il comprend environ 20 % des exigences de l'ASVS. L'objectif est de réduire au minimum les exigences afin de réduire les obstacles à l'entrée. + +Ces exigences sont généralement critiques ou basiques, et constituent la première couche de défense pour prévenir les attaques courantes. Elles ne nécessitent pas d'autres vulnérabilités ou conditions préalables pour être exploitables. + +Outre les exigences de la première couche de défense, certaines exigences ont moins d'impact aux niveaux supérieurs, comme celles relatives aux mots de passe. Celles-ci sont plus importantes pour le Niveau 1, car à partir de ces niveaux, les exigences d'authentification multifacteur deviennent pertinentes. + +Le Niveau 1 n'est pas nécessairement testable par un testeur externe sans accès interne à la documentation ou au code (comme les tests « boîte noire »), bien que le nombre réduit d'exigences devrait faciliter sa vérification. + +### Niveau 2 + +La plupart des applications devraient s'efforcer d'atteindre ce niveau de sécurité. Environ 50 % des exigences de l'ASVS sont de niveau 2, ce qui signifie qu'une application doit implémenter environ 70 % des exigences de l'ASVS (l'ensemble des exigences de niveau 1 et 2) pour être conforme à ce niveau. + +Ces exigences concernent généralement des attaques moins courantes ou des protections plus complexes contre les attaques courantes. Elles peuvent constituer une première couche de défense ou nécessiter certaines conditions préalables pour que l'attaque réussisse. + +### Niveau 3 + +Ce niveau doit être l'objectif des applications souhaitant démontrer les plus hauts niveaux de sécurité et représente environ 30 % des exigences à respecter. + +Les exigences de cette section concernent généralement des mécanismes de défense en profondeur ou d'autres contrôles utiles, mais difficiles à mettre en œuvre. + +### Quel niveau atteindre ? + +Les niveaux de priorité visent à refléter la maturité de l'organisation et de l'application en matière de sécurité applicative. Plutôt que d'imposer un niveau de sécurité normatif pour une application, l'organisation doit analyser ses risques et déterminer le niveau qu'elle estime approprié, en fonction de la sensibilité de l'application et, bien sûr, des attentes de ses utilisateurs. + +Par exemple, une jeune start-up qui ne collecte que des données sensibles limitées peut décider de se concentrer sur le niveau 1 pour ses objectifs de sécurité initiaux, tandis qu'une banque peut avoir du mal à justifier auprès de ses clients un niveau inférieur au niveau 3 pour son application de banque en ligne. + +## Comment utiliser l'ASVS ? + +### Structure de l'ASVS + +L'ASVS comprend environ 350 exigences, réparties en 17 chapitres, chacun étant lui-même subdivisé en sections. + +L'objectif de cette division est de simplifier la sélection ou le filtrage des chapitres et sections en fonction de leur pertinence pour l'application. Par exemple, pour une API machine-to-machine, les exigences du chapitre V3 relatives aux interfaces web ne seront pas pertinentes. Si OAuth ou WebRTC n'est pas utilisé, ces chapitres peuvent également être ignorés. + +### Stratégie de publication + +Les publications ASVS suivent le modèle « Majeure.Mineure.Correctif » et les numéros indiquent les modifications apportées. Pour une publication majeure, le premier numéro change, pour une publication mineure, le deuxième, et pour une publication corrective, le troisième. + +* Publication majeure : Réorganisation complète, presque tout peut avoir changé, y compris les numéros d'exigences. Une réévaluation de conformité sera nécessaire (par exemple, 4.0.3 -> 5.0.0). +* Publication mineure : Des exigences peuvent être ajoutées ou supprimées, mais la numérotation globale reste inchangée. Une réévaluation de conformité sera nécessaire, mais devrait être plus simple (par exemple, 5.0.0 -> 5.1.0). +* Publication corrective : Des exigences peuvent être supprimées (par exemple, si elles sont dupliquées ou obsolètes) ou assouplies, mais une application conforme à la publication précédente sera également conforme à la publication corrective (par exemple, 5.0.0 -> 5.0.1). + +Les informations ci-dessus concernent spécifiquement les exigences de l'ASVS. Les modifications apportées au texte environnant et à d'autres contenus, tels que les annexes, ne seront pas considérées comme des modifications majeures. + +### Flexibilité avec l'ASVS + +Plusieurs points décrits ci-dessus, tels que les exigences de documentation et le mécanisme de niveaux, permettent une utilisation de l'ASVS plus flexible et plus spécifique à l'organisation. + +De plus, il est fortement encouragé aux organisations de créer un fork spécifique à l'organisation ou au domaine, afin d'ajuster les exigences en fonction des caractéristiques et des niveaux de risque de leurs applications. Cependant, il est important de maintenir une traçabilité afin que la conformité à l'exigence 4.1.1 soit identique pour toutes les versions. + +Idéalement, chaque organisation devrait créer son propre ASVS personnalisé, en supprimant les sections non pertinentes (par exemple, GraphQL, WebSockets, SOAP, si elles ne sont pas utilisées). Une version ou un supplément ASVS spécifique à l'organisation est également un bon support pour fournir des conseils d'implémentation spécifiques à l'organisation, détaillant les bibliothèques ou les ressources à utiliser pour se conformer aux exigences. + +### Comment référencer les exigences de l'ASVS ? + +Chaque exigence possède un identifiant au format `.

.`, où chaque élément est un numéro. Par exemple, « 1.11.3 ». + +* La valeur `` correspond au chapitre d'où provient l'exigence ; par exemple, toutes les exigences `1.#.#` proviennent du chapitre 'Encodage et nettoyage'. +* La valeur `
` correspond à la section de ce chapitre où apparaît l'exigence ; par exemple, toutes les exigences `1.2.#` se trouvent dans la section 'Prévention des injections' du chapitre 'Encodage et nettoyage'. +* La valeur `` identifie l'exigence spécifique au sein du chapitre et de la section, par exemple, `1.2.5` qui, dans la version 5.0.0 de ce référentiel, est : + +> Vérifiez que l'application protège contre l'injection de commandes du système d'exploitation et que les appels du système d'exploitation utilisent des requêtes OS paramétrées ou un encodage contextuel de la sortie de ligne de commande. + +Les identifiants pouvant varier d'une version à l'autre du référentiel, il est préférable, pour les autres documents, rapports ou outils, d'utiliser le format suivant : `v-.
.`, où 'version' correspond à la balise de version ASVS. Par exemple, 'v5.0.0-1.2.5' désigne spécifiquement la 5ème exigence de la section 'Prévention des injections' du chapitre 'Encodage et nettoyage' de la version 5.0.0. (Ceci pourrait être résumé par `v-`.) + +Remarque : Le `v` précédant le numéro de version dans le format doit toujours être en minuscule. + +Si des identifiants sont utilisés sans inclure l'élément `v`, ils doivent être considérés comme faisant référence au contenu le plus récent du Référentiel de vérification de la sécurité des applications. À mesure que le référentiel évolue, cela devient problématique ; c'est pourquoi les rédacteurs et les développeurs doivent inclure l'élément « version ». + +Les listes d'exigences de l'ASVS sont disponibles aux formats CSV, JSON et autres, utiles à des fins de référence ou d'utilisation programmatique. + +### Forker l'ASVS + +Les organisations peuvent tirer profit de l'adoption d'ASVS en choisissant l'un des trois niveaux ou en créant un fork spécifique au domaine qui ajuste les exigences en fonction du niveau de risque applicatif. Ce type de fork est encouragé, à condition de garantir la traçabilité de l'exigence 4.1.1, garantissant ainsi la même cohérence pour toutes les versions. + +Idéalement, chaque organisation devrait créer son propre ASVS personnalisé, en supprimant les sections non pertinentes (par exemple, GraphQL, Websockets, SOAP, si elles ne sont pas utilisées). Le fork doit commencer par le niveau 1 d'ASVS comme référence, puis progresser vers les niveaux 2 ou 3 en fonction du risque de l'application. + +## Cas d'utilisation de l'ASVS + +L'ASVS peut être utilisé pour évaluer la sécurité d'une application, ce point étant approfondi dans le chapitre suivant. Cependant, plusieurs autres utilisations potentielles de l'ASVS (ou d'une version dérivée) ont été identifiées. + +### En tant que conseil détaillé sur l'architecture de sécurité + +L'une des utilisations les plus courantes du Référentiel de vérification de la sécurité des applications (ASVS) est de servir de ressource aux architectes de sécurité. Les ressources disponibles pour construire une architecture applicative sécurisée sont limitées, notamment pour les applications modernes. L'ASVS peut combler ces lacunes en permettant aux architectes de sécurité de choisir de meilleurs contrôles pour les problèmes courants, tels que les modèles de protection des données et les stratégies de validation des entrées. Les exigences en matière d'architecture et de documentation seront particulièrement utiles à cet égard. + +### Référence spécialisée en developpement sécurisé + +L'ASVS peut servir de base à la préparation d'une référence de développement sécurisé lors du développement d'applications, aidant ainsi les développeurs à prendre en compte la sécurité lors de la création de logiciels. Bien que l'ASVS puisse servir de base, les organisations doivent élaborer leurs propres directives claires et unifiées, idéalement basées sur les recommandations des ingénieurs ou architectes de sécurité. De plus, les organisations sont encouragées, dans la mesure du possible, à préparer des mécanismes et bibliothèques de sécurité approuvés, référencés dans les directives et utilisables par les développeurs. + +### Guide pour les tests unitaires et d'intégration automatisés + +L'ASVS est conçu pour être hautement testable. Certaines vérifications seront techniques, tandis que d'autres exigences (telles que les exigences d'architecture et de documentation) pourront nécessiter une revue de documentation ou d'architecture. En créant des tests unitaires et d'intégration qui testent et analysent par fuzzing des cas d'abus spécifiques et pertinents liés aux exigences, vérifiables par des moyens techniques, il devrait être plus facile de vérifier le bon fonctionnement de ces contrôles à chaque build. Par exemple, des tests supplémentaires peuvent être créés pour la suite de tests d'un contrôleur de connexion afin de tester la présence de valeur par défaut courante pour le paramètre username, l'énumération des comptes, le force brute, l'injection LDAP et SQL, et les attaques XSS. De même, un test sur le paramètre password doit inclure les mots de passe courants, la longueur des mots de passe, l'injection d'octets nuls, la suppression du paramètre, les attaques XSS, etc. + +### Pour la formation au développement sécurisé + +L'ASVS peut également servir à définir les caractéristiques d'un logiciel sécurisé. De nombreux cours de « codage sécurisé » se résument à des cours de piratage éthique, avec quelques conseils de codage. Cela n'aide pas forcément les développeurs à écrire du code plus sécurisé. Les cours de développement sécurisé peuvent plutôt utiliser l'ASVS en mettant l'accent sur ses mécanismes positifs, plutôt que sur les 10 principes négatifs à éviter. La structure de l'ASVS offre également une structure logique pour aborder les différents sujets liés à la sécurisation d'une application. + +### En tant que cadre pour l'approvisionnement des logiciels sécurisés + +L'ASVS est un cadre idéal pour faciliter l'approvisionnement des logiciels sécurisés ou l'acquisition de services de développement de développement sur mesure. L'acheteur peut simplement exiger que le logiciel qu'il souhaite acquérir soit développé au niveau X de l'ASVS et demander au vendeur de prouver que le logiciel satisfait à ce niveau. + +## Appliquer l'ASVS en pratique + +Les menaces varient selon les motivations. Certains secteurs disposent de ressources informatiques et technologiques spécifiques et d'exigences de conformité réglementaire spécifiques à leur domaine. + +Il est fortement recommandé aux organisations d'analyser en profondeur les caractéristiques de risque spécifiques à leur activité et de déterminer le niveau d'ASVS approprié en fonction de ces risques et des exigences métier. diff --git a/5.0/fr/0x04-Assessment_and_Certification.md b/5.0/fr/0x04-Assessment_and_Certification.md new file mode 100644 index 0000000000..b6805320ce --- /dev/null +++ b/5.0/fr/0x04-Assessment_and_Certification.md @@ -0,0 +1,47 @@ +# Évaluation et certification + +## Position de l'OWASP sur les certifications et marques de confiance ASVS + +L'OWASP, en tant qu'organisation à but non lucratif neutre, ne certifie actuellement aucun vendeur, vérificateur ou logiciel. Toutes ces assertions d'assurance, marques de confiance ou certifications ne sont pas officiellement vérifiées, enregistrées ou certifiées par l'OWASP, de sorte qu'une organisation qui s'appuie sur ce point de vue doit être prudente quant à la confiance placée dans une tierce partie ou une marque de confiance revendiquant la certification ASVS. + +Cela ne devrait pas empêcher les organisations d'offrir de tels services d'assurance, tant qu'elles ne revendiquent pas la certification officielle de l'OWASP. + +## Comment vérifier la conformité ASVS + +L'ASVS n'est volontairement pas prescriptif quant à la manière précise de vérifier la conformité au niveau d'un guide de tests. Il est toutefois important de souligner certains points clés. + +### Rapport de vérification + +Les tests d'intrusion traditionnels signalent les problèmes « par exception », en ne listant que les échecs. Cependant, un rapport de certification ASVS doit inclure le périmètre, un résumé de toutes les exigences vérifiées, les exigences pour lesquelles des exceptions ont été constatées et des conseils pour résoudre les problèmes. Certaines exigences peuvent ne pas être applicables (par exemple, la gestion des sessions dans les API sans état), et cela doit être mentionné dans le rapport. + +### Périmètre de la vérification + +Une organisation développant une application n'implémentera généralement pas toutes les exigences, certaines pouvant être non pertinentes ou moins importantes selon les fonctionnalités de l'application. Le vérificateur doit préciser le périmètre de la vérification, notamment le niveau que l'organisation souhaite atteindre et les exigences incluses. Il doit s'agir de ce qui a été inclus plutôt que de ce qui ne l'a pas été. Il doit également fournir un avis sur les raisons justifiant l'exclusion des exigences non implémentées. + +Cela devrait permettre au consommateur d’un rapport de vérification de comprendre le contexte de la vérification et de prendre une décision éclairée sur le niveau de confiance qu’il peut accorder à l’application. + +Les organismes de certification peuvent choisir leurs méthodes de test, mais devraient les indiquer dans le rapport, et elles devraient idéalement être reproductibles. Différentes méthodes, comme les tests d'intrusion manuels ou l'analyse du code source, peuvent être utilisées pour vérifier des aspects tels que la validation des entrées, selon l'application et les exigences. + +### Mécanismes de vérification + +Plusieurs techniques différentes peuvent être utilisées pour vérifier une même exigence ASVS. Outre les tests d'intrusion (utilisant des "credentials" valides pour une couverture complète de l'application), la vérification des exigences ASVS peut nécessiter l'accès à la documentation, au code source, à la configuration et aux personnes impliquées dans le processus de développement. Ceci est particulièrement vrai pour la vérification des exigences L2 et L3. Il est courant de fournir des preuves solides des résultats au moyen d'une documentation détaillée, pouvant inclure des documents de travail, des captures d'écran, des scripts et des journaux de tests. L'exécution d'un outil automatisé sans tests approfondis ne suffit pas à obtenir la certification, car chaque exigence doit être testée de manière vérifiable. + +L'utilisation de l'automatisation pour vérifier les exigences ASVS est un sujet qui suscite un intérêt constant. Il est donc important de clarifier certains points relatifs aux tests automatisés et en boîte noire. + +#### Le rôle des outils de test de sécurité automatisés + +Lorsque des outils de tests de sécurité automatisés, tels que les tests de sécurité dynamiques et statiques des applications (DAST et SAST), sont correctement implémentés dans le pipeline de développement, ils peuvent identifier des problèmes de sécurité qui ne devraient jamais exister. Cependant, sans une configuration et un réglage minutieux, ils n'offriront pas la couverture requise et leur niveau de bruit empêchera l'identification et la résolution des véritables problèmes de sécurité. + +Bien que cela puisse couvrir certaines des exigences techniques les plus basiques et les plus simples, telles que celles relatives à l'encodage ou à l'assainissement de sortie, il est essentiel de noter que ces outils ne seront pas entièrement en mesure de vérifier bon nombre des exigences ASVS les plus complexes ou celles liées à la logique métier et au contrôle d'accès. + +Pour les exigences moins simples, l'automatisation reste probablement envisageable, mais des vérifications spécifiques à l'application devront être écrites pour y parvenir. Ces vérifications peuvent être similaires aux tests unitaires et d'intégration déjà utilisés par l'organisation. Il est donc possible d'utiliser l'infrastructure d'automatisation des tests existante pour écrire ces tests spécifiques à ASVS. Bien que cela nécessite un investissement à court terme, les avantages à long terme de la vérification continue des exigences ASVS seront significatifs. + +En résumé, testable en utilisant l'automatisation != exécuter un outil sur étagère. + +#### Le rôle des tests de pénétration + +Bien que L1 dans la version 4.0 ait été optimisé pour les tests de « boîte noire » (sans documentation et sans source), même dans ce cas, le standard était clair sur le fait qu'il ne s'agissait pas d'une activité d'assurance efficace et qu'elle devait être activement découragée. + +Les tests sans accès aux informations supplémentaires nécessaires constituent un mécanisme sous-productifs et inefficaces de vérification de la sécurité, car ils ne permettent pas d’examiner le code source, d’identifier les menaces et les contrôles manquants, et d’effectuer un test beaucoup plus approfondi dans un délai plus court. + +Il est fortement encouragé d'effectuer des tests d'intrusion basés sur la documentation ou le code source (hybrides), avec un accès complet aux développeurs et à la documentation de l'application, plutôt que des tests d'intrusion traditionnels. Cela sera certainement nécessaire pour vérifier de nombreuses exigences ASVS. diff --git a/5.0/fr/0x05-For-Users-Of-4.0.md b/5.0/fr/0x05-For-Users-Of-4.0.md new file mode 100644 index 0000000000..be7360d367 --- /dev/null +++ b/5.0/fr/0x05-For-Users-Of-4.0.md @@ -0,0 +1,90 @@ +# Modifications par rapport à la version 4.x + +## Introduction + +Les utilisateurs familiarisés avec la version 4.x du référentiel trouveront utile de consulter les principales modifications apportées à la version 5.0, notamment les mises à jour de contenu, de périmètre et de philosophie sous-jacente. + +Sur les 286 exigences de la version 4.0.3, seules 11 restent inchangées, tandis que 15 ont subi des ajustements grammaticaux mineurs sans altérer leur sens. Au total, 109 exigences (38 %) ne sont plus des exigences distinctes dans la version 5.0 : 50 ont été simplement supprimées, 28 ont été supprimées car doublons et 31 ont été fusionnées avec d'autres exigences. Les autres ont été révisées. Même les exigences n'ayant pas subi de modifications substantielles ont des identifiants différents à la suite d'une réorganisation ou une restructuration. + +Pour faciliter l'adoption de la version 5.0, des documents de correspondance sont fournis pour aider les utilisateurs à identifier les correspondances entre les exigences de la version 4.x et celles de la version 5.0. Ces correspondances ne sont pas liées au numéro de version et peuvent être mises à jour ou clarifiées si nécessaire. + +## Philosophie des exigences + +### Périmètre et orientation + +La version 4.x incluait des exigences qui ne correspondaient pas au périmètre prévu du référentiel ; celles-ci ont été supprimées. Les exigences qui ne répondaient pas aux critères du périmètre de la version 5.0 ou qui n'étaient pas vérifiables ont également été exclues. + +### Priorité aux objectifs de sécurité plutôt qu'aux mécanismes + +Dans la version 4.x, de nombreuses exigences se concentraient sur des mécanismes spécifiques plutôt que sur les objectifs de sécurité sous-jacents. Dans la version 5.0, les exigences sont centrées sur les objectifs de sécurité, ne référençant des mécanismes particuliers que lorsqu'ils constituent la seule solution pratique, ou les fournissant à titre d'exemple ou de conseil complémentaire. + +Cette approche reconnaît que plusieurs méthodes peuvent exister pour atteindre un objectif de sécurité donné et évite toute prescription inutile susceptible de limiter la flexibilité organisationnelle. + +De plus, les exigences traitant d'une même préoccupation de sécurité ont été consolidées lorsque cela était opportun. + +### Décisions de sécurité documentées + +Bien que le concept de décisions de sécurité documentées puisse paraître nouveau dans la version 5.0, il s'agit d'une évolution des exigences antérieures liées à l'application des politiques et à la modélisation des menaces dans la version 4.0. Auparavant, certaines exigences exigeaient implicitement une analyse pour éclairer la mise en œuvre des contrôles de sécurité, comme la détermination des connexions réseau autorisées. + +Afin de garantir la disponibilité des informations nécessaires à la mise en œuvre et à la vérification, ces attentes sont désormais explicitement définies comme des exigences de documentation, ce qui les rend claires, actionnables et vérifiables. + +## Modifications structurelles et nouveaux chapitres + +Plusieurs chapitres de la version 5.0 introduisent du contenu entièrement nouveau : + +* OAuth et OIDC – Compte tenu de l’adoption généralisée de ces protocoles pour la délégation d’accès et l’authentification unique, des exigences spécifiques ont été ajoutées pour répondre aux divers scénarios rencontrés par les développeurs. Ce domaine pourrait à terme évoluer vers une norme autonome, similaire à la gestion des exigences mobiles et IoT dans les versions précédentes. +* WebRTC – Avec la popularité croissante de cette technologie, ses considérations et défis de sécurité spécifiques sont désormais abordés dans une section dédiée. + +Des efforts ont également été déployés pour garantir que les chapitres et sections soient organisés autour d’ensembles cohérents d’exigences connexes. + +Cette restructuration a conduit à la création de chapitres supplémentaires : + +* Jetons autonomes – Auparavant regroupés sous la rubrique « gestion de session », les jetons autonomes sont désormais reconnus comme un mécanisme distinct et un élément fondamental de la communication sans état (comme dans OAuth et OIDC). En raison de leurs implications spécifiques en matière de sécurité, elles sont traitées dans un chapitre dédié, avec l'introduction de nouvelles exigences dans la version 5.x. +* Sécurité du frontend web – Avec la complexité croissante des applications basées sur un navigateur et l'essor des architectures exclusivement basées sur des API, les exigences de sécurité du frontend ont été séparées dans un chapitre dédié. +* Codage et architecture sécurisés – Les nouvelles exigences concernant les pratiques de sécurité générales qui ne cadraient pas avec les chapitres existants ont été regroupées ici. + +D'autres modifications organisationnelles ont été apportées à la version 5.0 afin de clarifier l'intention. Par exemple, les exigences de validation des entrées ont été déplacées avec la logique métier, reflétant ainsi leur rôle dans l'application des règles métier, plutôt que d'être regroupées avec le nettoyage et l'encodage. + +L'ancien chapitre « Architecture » ​​de la version 1 a été supprimé. Sa section initiale contenait des exigences hors du périmètre, tandis que les sections suivantes ont été redistribuées aux chapitres concernés, les exigences étant dédupliquées et clarifiées si nécessaire. + +## Suppression des correspondances directes avec d'autres normes + +Les correspondances directes avec d'autres normes ont été supprimées du corps du référentiel. L'objectif est de préparer une correspondance avec le projet OWASP Common Requirement Enumeration (CRE), qui reliera ASVS à divers projets OWASP et normes externes. + +Les correspondances directes avec CWE et NIST ne sont plus maintenues, comme expliqué ci-dessous. + +### Couplage réduit avec les directives du NIST sur l'identité numérique + +Les directives du NIST sur l'identité numérique (SP 800-63) (https://pages.nist.gov/800-63-3/) servent depuis longtemps de référence pour les contrôles d'authentification et d'autorisation. Dans la version 4.x, certains chapitres étaient étroitement alignés sur la structure et la terminologie du NIST. + +Si ces directives demeurent une référence importante, un alignement strict a engendré des difficultés, notamment une terminologie moins reconnue, la duplication d'exigences similaires et des correspondances incomplètes. La version 5.0 s'éloigne de cette approche pour plus de clarté et de pertinence. + +### S'éloigner de l'énumération des faiblesses communes (CWE) + +L'[Énumération des Faiblesses Communes (CWE)](https://cwe.mitre.org/) fournit une taxonomie utile des faiblesses de sécurité logicielle. Cependant, des défis tels que les CWE par catégorie, les difficultés de correspondance des exigences à une CWE unique et la présence de mappages imprécis dans la version 4.x ont conduit à la décision d'abandonner les mappages CWE directs dans la version 5.0. + +## Repenser les définitions de niveaux + +La version 4.x décrivait les niveaux comme L1 (« Minimum »), L2 (« Standard ») et L3 (« Avancé »), ce qui implique que toutes les applications manipulant des données sensibles doivent au moins atteindre le niveau L2. + +La version 5.0 corrige plusieurs problèmes liés à cette approche, décrits dans les paragraphes suivants. + +En pratique, alors que la version 4.x utilisait des graduations pour les indicateurs de niveau, la version 5.x utilise un simple numéro pour tous les formats du référentiel, notamment Markdown, PDF, DOCX, CSV, JSON et XML. Pour des raisons de rétrocompatibilité, les anciennes versions des sorties CSV, JSON et XML utilisant encore des graduations sont également générées. + +### Niveau d'entrée simplifié + +Les retours ont indiqué que le nombre important d'exigences de niveau 1 (environ 120), combiné à sa désignation comme niveau « minimum », insuffisant pour la plupart des applications, freinait l'adoption. La version 5.0 vise à lever cet obstacle en définissant le niveau 1 principalement autour des exigences de défense de première couche, ce qui se traduit par des exigences plus claires et moins nombreuses à ce niveau. À titre d'exemple, la version 4.0.3 comptait 128 exigences de niveau 1 sur un total de 278, soit 46 %. La version 5.0.0 compte 70 exigences de niveau 1 sur un total de 345, soit 20 %. + +### L'illusion de la testabilité + +Un facteur clé dans le choix des contrôles de niveau 1 dans la version 4.x était leur aptitude à être évalués par des tests d'intrusion externes de type « boîte noire ». Cependant, cette approche n'était pas totalement conforme à l'objectif du niveau 1 en tant qu'ensemble minimal de contrôles de sécurité. Certains utilisateurs ont fait valoir que le niveau 1 était insuffisant pour sécuriser les applications, tandis que d’autres ont trouvé qu’il était trop difficile à tester. + +S'appuyer sur la testabilité comme critère est à la fois relatif et parfois trompeur. Le fait qu'une exigence soit testable ne garantit pas qu'elle puisse être testée de manière automatisée ou simple. De plus, les exigences les plus facilement testables ne sont pas toujours celles qui ont le plus grand impact sur la sécurité ou les plus simples à mettre en œuvre. + +Par conséquent, dans la version 5.0, les décisions de niveau ont été prises principalement en fonction de la réduction des risques et en tenant compte de l'effort de mise en œuvre. + +### Pas seulement une question de risque + +L'utilisation de niveaux prescriptifs, basés sur les risques, imposant un niveau spécifique à certaines applications s'est avérée trop rigide. En pratique, la priorisation et la mise en œuvre des contrôles de sécurité dépendent de multiples facteurs, notamment la réduction des risques et les efforts nécessaires à leur mise en œuvre. + +Par conséquent, les organisations sont encouragées à atteindre le niveau qu'elles estiment devoir atteindre en fonction de leur maturité et du message qu'elles souhaitent transmettre à leurs utilisateurs. diff --git a/5.0/fr/0x10-V1-Encoding-and-Sanitization.md b/5.0/fr/0x10-V1-Encoding-and-Sanitization.md new file mode 100644 index 0000000000..6c022ba7a5 --- /dev/null +++ b/5.0/fr/0x10-V1-Encoding-and-Sanitization.md @@ -0,0 +1,103 @@ +# V1 Encodage et nettoyage + +## Objectif de contrôle + +Ce chapitre aborde les failles de sécurité les plus courantes des applications web liées au traitement non sécurisé de données non fiables. Ces failles peuvent entraîner diverses vulnérabilités techniques, où les données non fiables sont interprétées selon les règles syntaxiques de l'interpréteur concerné. + +Pour les applications web modernes, il est toujours préférable d'utiliser des API plus sûres, telles que les requêtes paramétrées, l'échappement automatique ou les Framework de création de modèles. Dans le cas contraire, un encodage, un échappement ou un nettoyage des sorties soigneusement effectués deviennent essentiels à la sécurité de l'application. + +La validation des entrées constitue un mécanisme de défense en profondeur contre les contenus inattendus ou dangereux. Cependant, son objectif principal étant de garantir que le contenu entrant répond aux attentes fonctionnelles et métier, les exigences afférentes sont décrites dans le chapitre « Validation et logique métier ». + +## V1.1 Architecture d'encodage et de nettoyage + +Les sections ci-dessous présentent les exigences spécifiques à la syntaxe ou à l'interpréteur pour traiter en toute sécurité les contenus non sécurisés afin d'éviter les failles de sécurité. Ces exigences précisent l'ordre et le lieu de traitement. Elles visent également à garantir que les données soient stockées dans leur état d'origine et ne soient pas stockées sous une forme encodée ou échappée (par exemple, encodage HTML), afin d'éviter les problèmes de double encodage. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **1.1.1** | Vérifiez que l'entrée est décodée ou non échappée vers une forme canonique une seule fois, elle n'est décodée que lorsque des données codées sous cette forme sont attendues, et que cela est fait avant de traiter davantage l'entrée, par exemple, elle n'est pas effectuée après la validation ou la désinfection de l'entrée. | 2 | +| **1.1.2** | Vérifiez que l'application effectue l'encodage et l'échappement de sortie soit comme étape finale avant d'être utilisée par l'interpréteur pour lequel elle est destinée, soit par l'interpréteur lui-même. | 2 | + +## V1.2 Prévention des injections + +L'encodage ou l'échappement de sortie, effectué à proximité d'un contexte potentiellement dangereux, est essentiel pour la sécurité de toute application. Généralement, l'encodage et l'échappement de sortie ne sont pas conservés, mais servent à sécuriser la sortie pour une utilisation immédiate dans l'interpréteur approprié. Une tentative d'exécution trop précoce peut entraîner une altération du contenu ou rendre l'encodage ou l'échappement inefficaces. + +Dans de nombreux cas, les bibliothèques logicielles incluent des fonctions sûres ou plus sûres qui exécutent cela automatiquement, même s'il est nécessaire de s'assurer qu'elles sont correctes pour le contexte actuel. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **1.2.1** | Vérifiez que l'encodage de sortie d'une réponse HTTP, d'un document HTML ou d'un document XML est pertinent pour le contexte requis, comme l'encodage des caractères pertinents pour les éléments HTML, les attributs HTML, les commentaires HTML, les CSS ou les champs d'en-tête HTTP, pour éviter de modifier la structure du message ou du document. | 1 | +| **1.2.2** | Vérifiez que, lors de la création dynamique d'URL, les données non fiables sont encodées en fonction de leur contexte (par exemple, encodage d'URL ou encodage base64url pour les paramètres de requête ou de chemin). Assurez-vous que seuls les schémas d'URL sûrs sont autorisés (par exemple, interdire javascript: ou data:). | 1 | +| **1.2.3** | Vérifiez que l'encodage ou l'échappement de sortie est utilisé lors de la création dynamique de contenu JavaScript (y compris JSON), pour éviter de modifier la structure du message ou du document (pour éviter l'injection JavaScript et JSON). | 1 | +| **1.2.4** | Vérifiez que la sélection de données ou les requêtes de base de données (par exemple, SQL, HQL, NoSQL, Cypher) utilisent des requêtes paramétrées, des ORM, des Framework d'entités ou sont protégées contre les injections SQL et autres attaques par injection de base de données. Ceci est également pertinent lors de l'écriture de procédures stockées. | 1 | +| **1.2.5** | Vérifiez que l’application protège contre l’injection de commandes du système d’exploitation et que les appels du système d’exploitation utilisent des requêtes du système d’exploitation paramétrées ou utilisent un encodage de sortie de ligne de commande contextuelle. | 1 | +| **1.2.6** | Vérifiez que l’application protège contre les vulnérabilités d’injection LDAP ou que des contrôles de sécurité spécifiques pour empêcher l’injection LDAP ont été mis en œuvre. | 2 | +| **1.2.7** | Vérifiez que l’application est protégée contre les attaques par injection XPath en utilisant la paramétrisation des requêtes ou des requêtes précompilées. | 2 | +| **1.2.8** | Vérifiez que les processeurs LaTeX sont configurés de manière sécurisée (par exemple, en n'utilisant pas l'indicateur « --shell-escape ») et qu'une liste d’autorisations de commandes est utilisée pour empêcher les attaques par injection LaTeX. | 2 | +| **1.2.9** | Vérifiez que l'application échappe les caractères spéciaux dans les expressions régulières (généralement à l'aide d'une barre oblique inverse) pour éviter qu'ils ne soient mal interprétés comme des métacaractères. | 2 | +| **1.2.10** | Vérifiez que l'application est protégée contre les injections CSV et injections de formules. L'application doit respecter les règles d'échappement définies dans les sections 2.6 et 2.7 de la RFC 4180 lors de l'export de contenu CSV. De plus, lors de l'export au format CSV ou vers d'autres formats de tableur (tels que XLS, XLSX ou ODF), les caractères spéciaux (notamment « = », « + », « - », « @ », « \t » (tabulation) et « \0 » (caractère null)) doivent être protégés par une apostrophe s'ils apparaissent en premier dans une valeur de champ. | 3 | + +Remarque : L'utilisation de requêtes paramétrées ou l'échappement SQL ne sont pas toujours suffisants. Les parties de requête telles que les noms de table et de colonne (y compris les noms de colonne « ORDER BY ») ne peuvent pas être échappées. L'inclusion de données utilisateur échappées dans ces champs entraîne l'échec des requêtes ou une injection SQL. + +## V1.3 Nettoyage + +La protection idéale contre l'utilisation de contenu non fiable dans un contexte dangereux est d'utiliser un encodage ou un échappement spécifique au contexte, qui conserve la même signification sémantique du contenu dangereux mais le rend sûr pour une utilisation dans ce contexte particulier, comme expliqué plus en détail dans la section précédente. + +Lorsque cela n'est pas possible, un nettoyage devient nécessaire, supprimant les caractères ou contenus potentiellement dangereux. Dans certains cas, cela peut modifier la signification sémantique de la saisie, mais pour des raisons de sécurité, il peut n'y avoir aucune autre solution. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **1.3.1** | Vérifiez que toutes les entrées HTML non fiables provenant d'éditeurs WYSIWYG ou similaires sont nettoyées à l'aide d'une bibliothèque ou d'une fonctionnalité de Framework de nettoyage HTML bien connue et sécurisée. | 1 | +| **1.3.2** | Vérifiez que l'application évite d'utiliser eval() ou d'autres fonctionnalités d'exécution de code dynamique telles que Spring Expression Language (SpEL). En l'absence d'alternative, toute saisie utilisateur incluse doit être nettoyée avant d'être exécutée. | 1 | +| **1.3.3** | Vérifiez que les données transmises à un contexte potentiellement dangereux sont préalablement nettoyées pour appliquer des mesures de sécurité, telles qu'autoriser uniquement des caractères sûrs pour ce contexte et raccourcir des entrées trop longues. | 2 | +| **1.3.4** | Vérifiez que le contenu Scalable Vector Graphics (SVG) scriptable fourni par l'utilisateur est validé ou nettoyé pour contenir uniquement des balises et des attributs (tels que des graphiques de dessin) qui sont sûrs pour l'application, par exemple, ne contiennent pas de scripts et d'objets étrangers. | 2 | +| **1.3.5** | Vérifiez que l'application nettoie ou désactive le contenu du langage de modèle d'expression ou de script fourni par l'utilisateur, tel que les feuilles de style CSS, le Markdown ou XSL, BBCode ou similaire. | 2 | +| **1.3.6** | Vérifiez que l'application protège contre les attaques de falsification de requête côté serveur (SSRF), en validant les données non fiables par rapport à une liste d'autorisation de protocoles, de domaines, de chemins et de ports et en nettoyant les caractères potentiellement dangereux avant d'utiliser les données pour appeler un autre service. | 2 | +| **1.3.7** | Vérifiez que l'application se protège contre les attaques par injection de modèles en interdisant la création de modèles basés sur des entrées non fiables. En l'absence d'alternative, toute entrée non fiable incluse dynamiquement lors de la création du modèle doit être nettoyée ou rigoureusement validée. | 2 | +| **1.3.8** | Vérifiez que l’application nettoie correctement les entrées non fiables avant utilisation dans les requêtes Java Naming and Directory Interface (JNDI) et que JNDI est configuré de manière sécurisée pour empêcher les attaques par injection JNDI. | 2 | +| **1.3.9** | Vérifiez que l’application nettoie le contenu avant qu’il ne soit envoyé à memcache pour éviter les attaques par injection. | 2 | +| **1.3.10** | Vérifiez que les chaînes de format susceptibles d'être résolues de manière inattendue ou malveillante lors de leur utilisation sont nettoyées avant d'être traitées. | 2 | +| **1.3.11** | Vérifiez que l'application nettoie les entrées utilisateur avant de les transmettre aux systèmes de messagerie pour se protéger contre l'injection SMTP ou IMAP. | 2 | +| **1.3.12** | Vérifiez que les expressions régulières sont exemptes d'éléments provoquant "backtracking" exponentiel et assurez-vous que les entrées non fiables sont nettoyées pour atténuer les attaques ReDoS ou Runaway Regex. | 3 | + +## V1.4 Mémoire, chaine de caractères et code à mémoire non-managée + +Les exigences suivantes traitent des risques associés à une utilisation non sécurisée de la mémoire, qui s’appliquent généralement lorsque l’application utilise un langage système ou un code à mémoire non-managée. + +Dans certains cas, il peut être possible d'y parvenir en définissant des indicateurs de compilateur qui activent les protections contre les dépassements de tampon et les avertissements, y compris la randomisation de la pile et la prévention de l'exécution des données, et qui interrompent la construction si des opérations de pointeur, de mémoire, de chaîne de format, d'entier ou de chaine de caractères non sûres sont trouvées. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **1.4.1** | Vérifiez que l'application utilise des chaînes memory-safe, une copie de mémoire et une arithmétique de pointeur renforcée pour détecter ou empêcher les débordements de pile, de tampon ou de tas. | 2 | +| **1.4.2** | Vérifiez que les techniques de validation du signe, de la plage et de l’entrée sont utilisées pour éviter les dépassements d’entiers. | 2 | +| **1.4.3** | Vérifiez que la mémoire et les ressources allouées dynamiquement sont libérées et que les références ou les pointeurs vers la mémoire libérée sont supprimés ou définis à null pour éviter les "dangling pointer" et les vulnérabilités d'utilisation après libération. | 2 | + +## V1.5 Désérialisation sécurisée + +La conversion de données stockées ou transmises en objets applicatifs (désérialisation) a toujours été à l'origine de diverses vulnérabilités par injection de code. Il est important d'effectuer ce processus avec précaution et de manière sécurisée pour éviter ce type de problèmes. + +En particulier, certaines méthodes de désérialisation ont été identifiées par la documentation des langages de programmation ou des Framework comme étant non sécurisées et ne peuvent être sécurisées avec des données non fiables. Pour chaque mécanisme utilisé, une vérification rigoureuse doit être effectuée. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **1.5.1** | Vérifiez que l'application configure les "parser" XML pour utiliser une configuration restrictive et que les fonctionnalités non sûres telles que la résolution d'entités externes sont désactivées pour empêcher les attaques XML eXternal Entity (XXE). | 1 | +| **1.5.2** | Vérifiez que la désérialisation des données non fiables garantit une gestion sécurisée des entrées, par exemple en utilisant une liste d'autorisation de types d'objets ou en limitant les types d'objets définis par le client, afin d'empêcher les attaques par désérialisation. Les mécanismes de désérialisation explicitement définis comme non sécurisés ne doivent pas être utilisés avec des entrées non fiables. | 2 | +| **1.5.3** | Vérifiez que les différents "parser" utilisés dans l'application pour le même type de données (par exemple, les "parser" JSON, les "parser" XML, les "parser" d'URL) effectuent l'analyse de manière cohérente et utilisent le même mécanisme d'encodage de caractères pour éviter des problèmes tels que les vulnérabilités d'interopérabilité JSON ou un comportement d'analyse d'URI ou de fichier différent exploité dans les attaques d'inclusion de fichiers à distance (RFI) ou de falsification de requête côté serveur (SSRF). | 3 | + +## Références + +Pour plus d'informations, voir également : + +* [OWASP LDAP Injection Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html) +* [OWASP Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) +* [OWASP DOM Based Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html) +* [OWASP XML External Entity Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html) +* [OWASP Web Security Testing Guide: Client-Side Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/11-Client-side_Testing) +* [OWASP Java Encoding Project](https://owasp.org/owasp-java-encoder/) +* [DOMPurify - Client-side HTML Sanitization Library](https://github.com/cure53/DOMPurify) +* [RFC4180 - Common Format and MIME Type for Comma-Separated Values (CSV) Files](https://datatracker.ietf.org/doc/html/rfc4180#section-2) + +Pour plus d'informations, notamment sur les problèmes de désérialisation ou d'analyse, veuillez consulter : + +* [OWASP Deserialization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) +* [An Exploration of JSON Interoperability Vulnerabilities](https://bishopfox.com/blog/json-interoperability-vulnerabilities) +* [Orange Tsai - A New Era of SSRF Exploiting URL Parser In Trending Programming Languages](https://www.blackhat.com/docs/us-17/thursday/us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf) diff --git a/5.0/fr/0x11-V2-Validation-and-Business-Logic.md b/5.0/fr/0x11-V2-Validation-and-Business-Logic.md new file mode 100644 index 0000000000..98c9dec4b1 --- /dev/null +++ b/5.0/fr/0x11-V2-Validation-and-Business-Logic.md @@ -0,0 +1,73 @@ +# V2 Validation et logique métier + +## Objectif de contrôle + +Ce chapitre vise à garantir qu'une application vérifiée répond aux objectifs de haut niveau suivants : + +* Les entrées reçues par l'application correspondent aux attentes métier ou fonctionnelles. +* Le flux logique métier est séquentiel, traité dans l’ordre et ne peut pas être contourné. +* La logique métier inclut des limites et des contrôles pour détecter et prévenir les attaques automatisées, telles que les transferts continus de petits fonds ou l'ajout d'un million d'amis un par un. +* Les flux logiques métier à haute valeur ajoutée ont pris en compte les cas d'abus et les acteurs malveillants, et disposent de protections contre l'usurpation d'identité, la falsification, la divulgation d'informations et les attaques par élévation de privilèges. + +## V2.1 Validation et documentation de la logique métier + +La documentation de validation et de logique métier doit définir clairement les limites de la logique métier, les règles de validation et la cohérence contextuelle des éléments de données combinés, afin que ce qui doit être implémenté dans l'application soit clair. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **2.1.1** | Vérifiez que la documentation de l'application définit des règles de validation des entrées pour vérifier la validité des éléments de données par rapport à la structure attendue. Il peut s'agir de formats de données courants tels que des numéros de carte de crédit, des adresses e-mail ou des numéros de téléphone, ou d'un format de données interne. | 1 | +| **2.1.2** | Vérifiez que la documentation de l'application définit comment valider la cohérence logique et contextuelle des éléments de données combinés, par exemple en vérifiant que la banlieue et le code postal correspondent. | 2 | +| **2.1.3** | Vérifiez que les attentes en matière de limites et de validations de la logique métier sont documentées, y compris par utilisateur et globalement dans l'application. | 2 | + +## V2.2 Validation des entrées + +Des contrôles de validation des entrées efficaces renforcent les attentes métier ou fonctionnelles concernant le type de données que l'application s'attend à recevoir. Cela garantit une bonne qualité des données et réduit la surface d'attaque. Cependant, cela ne supprime ni ne remplace la nécessité d'utiliser un codage, un paramétrage ou un nettoyage corrects lors de l'utilisation des données dans un autre composant ou pour leur présentation en sortie. + +Dans ce contexte, les « entrées » peuvent provenir d'une grande variété de sources, notamment des champs de formulaire HTML, des requêtes REST, des paramètres d'URL, des champs d'en-tête HTTP, des cookies, des fichiers sur disque, des bases de données et des API externes. + +Un contrôle de logique métier peut vérifier qu'une entrée particulière est un nombre inférieur à 100. Une attente fonctionnelle peut vérifier qu'un nombre est inférieur à un certain seuil, car ce nombre contrôle le nombre de fois qu'une boucle particulière aura lieu, et un nombre élevé pourrait entraîner un traitement excessif et une condition potentielle de déni de service. + +Bien que la validation de schéma ne soit pas explicitement obligatoire, elle peut être le mécanisme le plus efficace pour une couverture de validation complète des API HTTP ou d'autres interfaces qui utilisent JSON ou XML. + +Veuillez noter les points suivants concernant la validation du schéma : + +* La « version publiée » de la spécification de validation du schéma JSON est considérée comme prête pour la production, mais pas à proprement parler « stable ». Lorsque vous utilisez la validation du schéma JSON, assurez-vous qu'il n'y a aucune lacune par rapport aux instructions des exigences ci-dessous. +* Toutes les bibliothèques de validation de schéma JSON utilisées doivent également être surveillées et mises à jour si nécessaire une fois la norme formalisée. +* La validation DTD ne doit pas être utilisée et l'évaluation DTD du Framework doit être désactivée pour éviter les problèmes liés aux attaques XXE contre les DTD. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **2.2.1** | Vérifier que les entrées sont validées afin de respecter les attentes métier ou fonctionnelles. Cette validation doit être basée sur une liste de valeurs, de modèles et de plages autorisées, ou sur la comparaison des entrées avec une structure attendue et des limites logiques selon des règles prédéfinies. Pour le niveau 1, cette validation peut se concentrer sur les entrées utilisées pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau 2, elle doit s'appliquer à toutes les entrées. | 1 | +| **2.2.2** | Vérifiez que l'application est conçue pour appliquer la validation des entrées au niveau d'une couche de service de confiance. Bien que la validation côté client améliore l'ergonomie et doit être encouragée, elle ne doit pas être considérée comme un contrôle de sécurité. | 1 | +| **2.2.3** | Vérifiez que l’application garantit que les combinaisons d’éléments de données associés sont raisonnables selon les règles prédéfinies. | 2 | + +## V2.3 Sécurité de la logique métier + +Cette section examine les exigences clés pour garantir que l’application applique les processus de logique métier de manière correcte et n’est pas vulnérable aux attaques qui exploitent la logique et le flux de l’application. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **2.3.1** | Vérifiez que l’application traitera uniquement les flux de logique métier pour le même utilisateur dans l’ordre séquentiel attendu et sans sauter d’étapes. | 1 | +| **2.3.2** | Vérifiez que les limites de la logique métier sont implémentées conformément à la documentation de l'application, afin d'éviter que des failles de la logique métier ne soient pas exploitées. | 2 | +| **2.3.3** | Vérifiez que les transactions sont utilisées au niveau de la logique métier de telle sorte qu'une opération de logique métier réussisse dans son intégralité ou qu'elle soit restaurée à l'état correct précédent. | 2 | +| **2.3.4** | Vérifiez que les mécanismes de verrouillage au niveau de la logique métier sont utilisés pour garantir que les ressources en quantité limitée (telles que les sièges de théâtre ou les créneaux de livraison) ne peuvent pas être réservées deux fois en manipulant la logique de l'application. | 2 | +| **2.3.5** | Vérifiez que les flux logiques métier à forte valeur ajoutée nécessitent l'approbation de plusieurs utilisateurs afin d'éviter toute action non autorisée ou accidentelle. Cela peut inclure, sans s'y limiter, les transferts monétaires importants, les approbations de contrats, l'accès à des informations classifiées ou les contournements de sécurité dans le secteur manufacturier. | 3 | + +## V2.4 Anti-automatisation + +Cette section comprend des contrôles anti-automatisation pour garantir que les interactions de type humaine sont requises et que les demandes automatisées excessives sont évitées. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **2.4.1** | Vérifiez que des contrôles anti-automatisation sont en place pour protéger contre les appels excessifs aux fonctions d'application qui pourraient conduire à l'exfiltration de données, à la création de données inutiles, à l'épuisement des quotas, aux violations de limites de débit, au déni de service ou à la surutilisation de ressources coûteuses. | 2 | +| **2.4.2** | Vérifiez que les flux logiques métier nécessitent un timing humain réaliste, évitant ainsi des soumissions de transactions excessivement rapides. | 3 | + +## Références + +Pour plus d'informations, voir également : + +* [OWASP Web Security Testing Guide 4.2: Input Validation Testing](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/README.html) +* [OWASP Web Security Testing Guide 4.2: Business Logic Testing](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/10-Business_Logic_Testing/README) +* La lutte contre l'automatisation peut se faire de différentes manières, notamment par l'utilisation de l'[OWASP Automated Threats to Web Applications](https://owasp.org/www-project-automated-threats-to-web-applications/) +* [OWASP Input Validation Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html) +* [JSON Schema](https://json-schema.org/specification.html) diff --git a/5.0/fr/0x12-V3-Web-Frontend-Security.md b/5.0/fr/0x12-V3-Web-Frontend-Security.md new file mode 100644 index 0000000000..2e74c3eb55 --- /dev/null +++ b/5.0/fr/0x12-V3-Web-Frontend-Security.md @@ -0,0 +1,100 @@ +# V3 Sécurité du frontend Web + +## Objectif de contrôle + +Cette catégorie se concentre sur les exigences visant à protéger contre les attaques exécutées via un frontend web. Ces exigences ne s'appliquent pas aux solutions "machine-to-machine". + +## V3.1 Documentation sur la sécurité du frontend Web + +Cette section décrit les fonctionnalités de sécurité du navigateur qui doivent être spécifiées dans la documentation de l'application. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **3.1.1** | Vérifiez que la documentation de l'application indique les fonctionnalités de sécurité attendues que les navigateurs utilisant l'application doivent prendre en charge (telles que HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) et autres mécanismes de sécurité HTTP pertinents). Elle doit également définir le comportement de l'application lorsque certaines de ces fonctionnalités ne sont pas disponibles (par exemple, avertir l'utilisateur ou bloquer l'accès). | 3 | + +## V3.2 Interprétation non intentionnelle du contenu + +Le rendu de contenu ou de fonctionnalité dans un contexte incorrect peut entraîner l'exécution ou l'affichage de contenu malveillant. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **3.2.1** | Vérifiez que des contrôles de sécurité sont en place pour empêcher les navigateurs d'afficher du contenu ou des fonctionnalités dans les réponses HTTP dans un contexte incorrect (par exemple, lorsqu'une API, un fichier téléchargé par l'utilisateur ou une autre ressource est demandée directement). Les contrôles possibles peuvent inclure : ne pas transmettre le contenu sauf si les champs d'en-tête de requête HTTP (tels que Sec-Fetch-\*) indiquent qu'il s'agit du contexte correct, utiliser la directive sandbox du champ d'en-tête Content-Security-Policy ou utiliser le type de disposition de pièce jointe dans le champ d'en-tête Content-Disposition. | 1 | +| **3.2.2** | Vérifiez que le contenu destiné à être affiché sous forme de texte, plutôt que rendu sous forme de HTML, est géré à l'aide de fonctions de rendu sécurisées (telles que createTextNode ou textContent) pour empêcher l'exécution involontaire de contenu tel que HTML ou JavaScript. | 1 | +| **3.2.3** | Vérifiez que l'application évite l'écrasement du DOM lors de l'utilisation de JavaScript côté client en utilisant des déclarations de variables explicites, en effectuant une vérification de type stricte, en évitant de stocker des variables globales sur l'objet document et en implémentant l'isolation de l'espace de nommage. | 3 | + +## V3.3 Configuration des cookies + +Cette section décrit les exigences de configuration sécurisée des cookies sensibles afin de fournir un niveau d'assurance plus élevé qu'ils ont été créés par l'application elle-même et d'empêcher que leur contenu ne fuite ou ne soit modifié de manière inappropriée. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **3.3.1** | Vérifiez que les cookies ont l'attribut « Secure » ​​défini et si le préfixe « \__Host- » n'est pas utilisé pour le nom du cookie, le préfixe « __Secure- » doit être utilisé pour le nom du cookie. | 1 | +| **3.3.2** | Vérifiez que la valeur de l'attribut « SameSite » de chaque cookie est définie en fonction de l'objectif du cookie, afin de limiter l'exposition aux attaques de réparation de l'interface utilisateur et aux attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF). | 2 | +| **3.3.3** | Vérifiez que les cookies ont le préfixe « __Host- » pour le nom du cookie, sauf s'ils sont explicitement conçus pour être partagés avec d'autres hôtes. | 2 | +| **3.3.4** | Vérifiez que si la valeur d'un cookie n'est pas censée être accessible aux scripts côté client (comme un jeton de session), le cookie doit avoir l'attribut « HttpOnly » défini et la même valeur (par exemple, un jeton de session) ne doit être transférée au client que via le champ d'en-tête « Set-Cookie ». | 2 | +| **3.3.5** | Vérifiez que lorsque l'application écrit un cookie, la longueur combinée du nom et de la valeur du cookie ne dépasse pas 4 096 octets. Les cookies trop volumineux ne seront pas stockés par le navigateur et ne seront donc pas envoyés avec les requêtes, empêchant ainsi l'utilisateur d'utiliser les fonctionnalités de l'application qui reposent sur ce cookie. | 3 | + +## V3.4 En-têtes du mécanisme de sécurité du navigateur + +Cette section décrit les en-têtes de sécurité qui doivent être définis sur les réponses HTTP pour activer les fonctionnalités et restrictions de sécurité du navigateur lors du traitement des réponses de l'application. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **3.4.1** | Vérifiez qu'un champ d'en-tête Strict-Transport-Security est inclus dans toutes les réponses afin d'appliquer une politique HTTP Strict Transport Security (HSTS). Une durée maximale d'au moins un an doit être définie, et pour les niveaux L2 et supérieurs, la politique doit également s'appliquer à tous les sous-domaines. | 1 | +| **3.4.2** | Vérifiez que le champ d'en-tête Access-Control-Allow-Origin du partage de ressources cross-origine (CORS) est une valeur fixe de l'application ou, si la valeur du champ d'en-tête de requête HTTP Origin est utilisée, qu'elle est validée par rapport à une liste d'origines approuvées. Si « Access-Control-Allow-Origin: * » doit être utilisé, vérifiez que la réponse ne contient aucune information sensible. | 1 | +| **3.4.3** | Vérifiez que les réponses HTTP incluent un champ d'en-tête de réponse Content-Security-Policy qui définit des directives garantissant que le navigateur charge et exécute uniquement du contenu ou des ressources fiables, afin de limiter l'exécution de JavaScript malveillant. Au minimum, une politique globale doit être utilisée, incluant les directives object-src 'none' et base-uri 'none', et définissant soit une lliste d’autorisations, soit des valeurs nonces ou des hachages. Pour une application L3, une politique par réponse avec des valeurs nonces ou des hachages doit être définie. | 2 | +| **3.4.4** | Vérifiez que toutes les réponses HTTP contiennent un champ d'en-tête « X-Content-Type-Options: nosniff ». Cela indique aux navigateurs de ne pas utiliser l'analyse de contenu ni la détection du type MIME pour la réponse donnée, et d'exiger que la valeur du champ d'en-tête « Content-Type » de la réponse corresponde à la ressource de destination. Par exemple, la réponse à une demande de style n'est acceptée que si le type de contenu de la réponse est « text/css ». Cela permet également au navigateur d'utiliser la fonctionnalité de blocage de lecture inter-origines (CORB). | 2 | +| **3.4.5** | Vérifiez que l'application définit une politique de référencement afin d'empêcher la fuite de données techniquement sensibles vers des services tiers via le champ d'en-tête de requête HTTP « Referer ». Cela peut être effectué via le champ d'en-tête de réponse HTTP « Referrer-Policy » ou via les attributs d'élément HTML. Les données sensibles peuvent inclure le chemin d'accès et les données de requête dans l'URL, et pour les applications internes non publiques, le nom d'hôte. | 2 | +| **3.4.6** | Vérifiez que l'application Web utilise la directive frame-ancestors du champ d'en-tête Content-Security-Policy pour chaque réponse HTTP afin de garantir qu'elle ne peut pas être intégrée par défaut et que l'intégration de ressources spécifiques n'est autorisée qu'en cas de nécessité. Notez que le champ d'en-tête X-Frame-Options, bien que pris en charge par les navigateurs, est obsolète et n'est pas forcément fiable. | 2 | +| **3.4.7** | Vérifiez que le champ d’en-tête Content-Security-Policy spécifie un emplacement pour signaler les violations. | 3 | +| **3.4.8** | Vérifiez que toutes les réponses HTTP qui lancent le rendu d'un document (comme les réponses de type text/html) incluent le champ d'en-tête 'Cross-Origin-Opener-Policy' avec la directive 'same-origin' ou s'ame-origin-allow-popups', selon les besoins. Cela empêche les attaques abusant de l'accès partagé aux objets Window, telles que le tabnabbing et le comptage d'images. | 3 | + +## V3.5 Séparation de l'origine du navigateur + +Lorsqu'elle accepte une demande d'accès à une fonctionnalité sensible du côté du serveur, l'application doit s'assurer que la demande est initiée par l'application elle-même ou par un tiers de confiance et qu'elle n'a pas été falsifiée par un attaquant. + +Les fonctionnalités sensibles dans ce contexte peuvent inclure l'acceptation de soumission de formulaires pour des utilisateurs authentifiés et non authentifiés (comme une demande d'authentification), des opérations de changement d'état ou des fonctionnalités exigeantes en ressources (comme l'exportation de données). + +Les principales protections sont les politiques de sécurité du navigateur, comme la politique de même origine pour JavaScript et la logique SameSite pour les cookies. Le mécanisme de requête de pré-vérification cross-origin CORS est une autre protection courante. Ce mécanisme est essentiel pour les "endpoints" conçus pour être appelés depuis une origine différente, mais il peut également constituer un mécanisme utile de prévention contre la falsification de requêtes pour les "endpoints" qui ne sont pas conçus pour être appelés depuis une origine différente. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **3.5.1** | Vérifiez que, si l'application ne s'appuie pas sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher les requêtes inter-origines non autorisées d'utiliser des fonctionnalités sensibles, ces requêtes sont validées afin de garantir leur origine. Cela peut se faire en utilisant et en validant des jetons anti-falsification ou en exigeant des champs d'en-tête HTTP supplémentaires qui ne sont pas des champs d'en-tête de requête CORS safelist. Ceci permet de se protéger contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF). | 1 | +| **3.5.2** | Vérifiez que, si l'application s'appuie sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher l'utilisation inter-origines non autorisée de fonctionnalités sensibles, il est impossible d'appeler la fonctionnalité avec une requête qui ne déclenche pas de requête de pré-vérification cross-origin CORS. Cela peut nécessiter de vérifier les valeurs des champs d'en-tête de requête 'Origin' et 'Content-Type' ou d'utiliser un champ d'en-tête supplémentaire qui n'est pas un champ d'en-tête de la liste de sécurité CORS. | 1 | +| **3.5.3** | Vérifiez que les requêtes HTTP destinées aux fonctionnalités sensibles utilisent des méthodes HTTP appropriées, telles que POST, PUT, PATCH ou DELETE, et non des méthodes définies comme « sûres » par la spécification HTTP, telles que HEAD, OPTIONS ou GET. Une validation stricte des champs d'en-tête de requête Sec-Fetch-* peut également être utilisée pour garantir que la requête ne provient pas d'un appel inter-origines inapproprié, d'une requête de navigation ou d'un chargement de ressources (comme une source d'image) inattendu. | 1 | +| **3.5.4** | Vérifiez que des applications distinctes sont hébergées sur des noms d'hôte différents pour tirer parti des restrictions fournies par la politique de même origine, y compris la manière dont les documents ou scripts chargés par une origine peuvent interagir avec les ressources d'une autre origine et les restrictions basées sur le nom d'hôte sur les cookies. | 2 | +| **3.5.5** | Vérifiez que les messages reçus par l'interface postMessage sont rejetés si l'origine du message n'est pas digne de confiance ou si la syntaxe du message n'est pas valide. | 2 | +| **3.5.6** | Vérifiez que la fonctionnalité JSONP n'est activée nulle part dans l'application pour éviter les attaques Cross-Site Script Inclusion (XSSI). | 3 | +| **3.5.7** | Vérifiez que les données nécessitant une autorisation ne sont pas incluses dans les réponses des ressources de script, comme les fichiers JavaScript, pour empêcher les attaques par inclusion de script intersite (XSSI). | 3 | +| **3.5.8** | Vérifiez que les ressources authentifiées (telles que les images, les vidéos, les scripts et autres documents) peuvent être chargées ou intégrées pour le compte de l'utilisateur uniquement lorsque cela est prévu. Cela peut être réalisé en validant strictement les champs d'en-tête de requête HTTP Sec-Fetch-* afin de garantir que la requête ne provient pas d'un appel cross-origin inapproprié, ou en définissant un champ d'en-tête de réponse HTTP Cross-Origin-Resource-Policy restrictif pour indiquer au navigateur de bloquer le contenu renvoyé. | 3 | + +## V3.6 Intégrité des ressources externes + +Cette section fournit des conseils pour l’hébergement sécurisé de contenu sur des sites tiers. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **3.6.1** | Vérifiez que les ressources côté client, telles que les bibliothèques JavaScript, les feuilles de style CSS ou les polices web, sont hébergées en externe (par exemple, sur un réseau de diffusion de contenu) uniquement si la ressource est statique et versionnée, et si l'intégrité des sous-ressources (SRI) est utilisée pour valider l'intégrité de la ressource. Si cela n'est pas possible, une décision de sécurité documentée doit justifier cette décision pour chaque ressource. | 3 | + +## V3.7 Autres considérations sur la sécurité du navigateur + +Cette section comprend divers autres contrôles de sécurité et fonctionnalités de sécurité de navigateur modernes nécessaires pour la sécurité du navigateur côté client. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **3.7.1** | Vérifiez que l'application utilise uniquement des technologies côté client toujours prises en charge et considérées comme sécurisées. Parmi les technologies qui ne répondent pas à cette exigence figurent les plugins NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL ou les applets Java côté client. | 2 | +| **3.7.2** | Vérifiez que l'application redirigera automatiquement l'utilisateur vers un nom d'hôte ou un domaine différent (qui n'est pas contrôlé par l'application) uniquement lorsque la destination apparaît sur une liste d'autorisation. | 2 | +| **3.7.3** | Vérifiez que le domaine de premier niveau de l'application (par exemple, site.tld) ​​est ajouté à la liste de préchargement publique pour HTTP Strict Transport Security (HSTS). Cela garantit que l'utilisation de TLS pour l'application est intégrée directement dans les principaux navigateurs, plutôt que de dépendre uniquement du champ d'en-tête de réponse Strict-Transport-Security. | 3 | +| **3.7.4** | Vérifiez que l'application affiche une notification lorsque l'utilisateur est redirigé vers une URL hors du contrôle de l'application, avec une option pour annuler la navigation. | 3 | +| **3.7.5** | Vérifiez que l'application se comporte comme documenté (par exemple, en avertissant l'utilisateur ou en bloquant l'accès) si le navigateur utilisé pour accéder à l'application ne prend pas en charge les fonctionnalités de sécurité attendues. | 3 | + +## Références + +Pour plus d'informations, voir également : + +* [Set-Cookie __Host- prefix details](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#cookie_prefixes) +* [OWASP Content Security Policy Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html) +* [OWASP Secure Headers Project](https://owasp.org/www-project-secure-headers/) +* [OWASP Cross-Site Request Forgery Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html) +* [HSTS Browser Preload List submission form](https://hstspreload.org/) +* [OWASP DOM Clobbering Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/DOM_Clobbering_Prevention_Cheat_Sheet.html) diff --git a/5.0/fr/0x13-V4-API-and-Web-Service.md b/5.0/fr/0x13-V4-API-and-Web-Service.md new file mode 100644 index 0000000000..92f8afa0bd --- /dev/null +++ b/5.0/fr/0x13-V4-API-and-Web-Service.md @@ -0,0 +1,64 @@ +# V4 API et service Web + +## Objectif de contrôle + +Plusieurs considérations s'appliquent spécifiquement aux applications exposant des API destinées aux navigateurs web ou à d'autres consommateurs (généralement via JSON, XML ou GraphQL). Ce chapitre présente les configurations et mécanismes de sécurité pertinents à appliquer. + +Notez que les problèmes d’authentification, de gestion de session et de validation des entrées des autres chapitres s’appliquent également aux API. Ce chapitre ne peut donc pas être sorti de son contexte ni testé de manière isolée. + +## V4.1 Sécurité du service Web générique + +Cette section aborde les considérations générales sur la sécurité des services Web et, par conséquent, les pratiques d’hygiène de base des services Web. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **4.1.1** | Vérifiez que chaque réponse HTTP avec un corps de message contient un champ d'en-tête Content-Type qui correspond au contenu réel de la réponse, y compris le paramètre charset pour spécifier un codage de caractères sécurisé (par exemple, UTF-8, ISO-8859-1) conformément aux types de médias IANA, tels que « text/ », « /+xml » et « /xml ». | 1 | +| **4.1.2** | Vérifiez que seuls les terminaux utilisateurs (destinés à l'accès manuel via un navigateur web) redirigent automatiquement de HTTP vers HTTPS, tandis que les autres services ou terminaux n'implémentent pas de redirections transparentes. Cela permet d'éviter qu'un client envoie par erreur des requêtes HTTP non chiffrées, mais que, comme ces requêtes sont automatiquement redirigées vers HTTPS, la fuite de données sensibles passe inaperçue. | 2 | +| **4.1.3** | Vérifiez que tout champ d'en-tête HTTP utilisé par l'application et défini par une couche intermédiaire, telle qu'un équilibreur de charge, un proxy web ou un service backend-for-frontend, ne peut pas être remplacé par l'utilisateur final. Les exemples d'en-têtes peuvent inclure X-Real-IP, X-Forwarded-*, ou X-User-ID. | 2 | +| **4.1.4** | Vérifiez que seules les méthodes HTTP explicitement prises en charge par l'application ou son API (y compris les OPTIONS lors des demandes de contrôle en amont) peuvent être utilisées et que les méthodes inutilisées sont bloquées. | 3 | +| **4.1.5** | Vérifier que les signatures numériques par message sont utilisées pour fournir une assurance supplémentaire en plus des protections de transport pour les demandes ou les transactions qui sont très sensibles ou qui traversent un certain nombre de systèmes. | 3 | + +## V4.2 Validation de la structure des messages HTTP + +Cette section explique comment la structure et les champs d'en-tête d'un message HTTP doivent être validés afin de prévenir les attaques telles que la contrebande de requêtes, le fractionnement de réponses, l'injection d'en-têtes et le déni de service via des messages HTTP trop longs. + +Ces exigences sont pertinentes pour le traitement et la génération de messages HTTP généraux, mais sont particulièrement importantes lors de la conversion de messages HTTP entre différentes versions HTTP. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **4.2.1** | Vérifiez que tous les composants de l'application (y compris les équilibreurs de charge, les pares-feux et les serveurs d'applications) déterminent les limites des messages HTTP entrants à l'aide du mécanisme approprié à la version HTTP afin d'empêcher la contrebande de requêtes HTTP. Dans HTTP/1.x, si un champ d'en-tête Transfer-Encoding est présent, l'en-tête Content-Length doit être ignoré conformément à la RFC 2616. Avec HTTP/2 ou HTTP/3, si un champ d'en-tête Content-Length est présent, le récepteur doit s'assurer qu'il est cohérent avec la longueur des trames DATA. | 2 | +| **4.2.2** | Vérifier que, lors de la génération de messages HTTP, le champ d'en-tête Content-Length n'entre pas en conflit avec la longueur du contenu déterminée par le cadrage du protocole HTTP, afin d'empêcher les attaques de type « request smuggling ». | 3 | +| **4.2.3** | Vérifiez que l'application n'envoie ni n'accepte de messages HTTP/2 ou HTTP/3 avec des champs d'en-tête spécifiques à la connexion, tels que Transfer-Encoding, afin d'éviter les attaques par fractionnement de la réponse et par injection d'en-tête. | 3 | +| **4.2.4** | Vérifiez que l'application n'accepte que les requêtes HTTP/2 et HTTP/3 dont les champs et valeurs d'en-tête ne contiennent pas de séquences CR (\r), LF (\n) ou CRLF (\r\n), afin d'éviter les attaques par injection d'en-tête. | 3 | +| **4.2.5** | Vérifiez que, si l'application (backend ou frontend) construit et envoie des requêtes, elle utilise des mécanismes de validation, d'assainissement ou autres pour éviter de créer des URI (comme pour les appels API) ou des champs d'en-tête de requête HTTP (comme Authorization ou Cookie) qui sont trop longs pour être acceptés par le composant récepteur. Cela pourrait entraîner un déni de service, par exemple lors de l'envoi d'une requête trop longue (par exemple, un long champ d'en-tête de cookie), ce qui fait que le serveur répond toujours avec un statut d'erreur. | 3 | + +## V4.3 GraphQL + +GraphQL est de plus en plus utilisé pour créer des clients riches en données, peu couplés à divers services backend. Cette section aborde les considérations de sécurité pour GraphQL. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **4.3.1** | Vérifiez qu'une liste d'autorisation de requête, une limitation de profondeur, une limitation de quantité ou une analyse des coûts de requête est utilisée pour empêcher le déni de service (DoS) de GraphQL ou d'expression de la couche données en raison de requêtes imbriquées coûteuses. | 2 | +| **4.3.2** | Vérifiez que les requêtes d’introspection GraphQL sont désactivées dans l’environnement de production, sauf si l’API GraphQL est destinée à être utilisée par d’autres parties. | 2 | + +## V4.4 WebSocket + +WebSocket est un protocole de communication qui fournit un canal de communication bidirectionnel simultané via une seule connexion TCP. Il a été normalisé par l'IETF sous la RFC 6455 en 2011 et se distingue de HTTP, bien qu'il soit conçu pour fonctionner sur les ports HTTP 443 et 80. + +Cette section fournit les principales exigences de sécurité pour empêcher les attaques liées à la sécurité des communications et à la gestion des sessions qui exploitent spécifiquement ce canal de communication en temps réel. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **4.4.1** | Vérifiez que WebSocket sur TLS (WSS) est utilisé pour toutes les connexions WebSocket. | 1 | +| **4.4.2** | Vérifiez que, lors de la négociation HTTP WebSocket initiale, le champ d’en-tête 'Origin' est vérifié par rapport à une liste d’origines autorisées pour l’application. | 2 | +| **4.4.3** | Vérifiez que, si la gestion de session standard de l'application ne peut pas être utilisée, des jetons dédiés sont utilisés à cet effet, qui sont conformes aux exigences de sécurité de gestion de session pertinentes. | 2 | +| **4.4.4** | Vérifiez que les jetons de gestion de session WebSocket dédiés sont initialement obtenus ou validés via la session HTTPS précédemment authentifiée lors de la transition d'une session HTTPS existante vers un canal WebSocket. | 2 | + +## Références + +Pour plus d'informations, voir également : + +* [OWASP REST Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html) +* Resources on GraphQL Authorization from [graphql.org](https://graphql.org/learn/authorization/) and [Apollo](https://www.apollographql.com/docs/apollo-server/security/authentication/#authorization-methods). +* [OWASP Web Security Testing Guide: GraphQL Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/12-API_Testing/01-Testing_GraphQL) +* [OWASP Web Security Testing Guide: Testing WebSockets](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/11-Client-side_Testing/10-Testing_WebSockets) diff --git a/5.0/fr/0x14-V5-File-Handling.md b/5.0/fr/0x14-V5-File-Handling.md new file mode 100644 index 0000000000..74a11f7a7d --- /dev/null +++ b/5.0/fr/0x14-V5-File-Handling.md @@ -0,0 +1,54 @@ +# V5 Gestion des fichiers + +## Objectif de contrôle + +L'utilisation de fichiers peut présenter divers risques pour l'application, notamment le déni de service, l'accès non autorisé et l'épuisement de l'espace de stockage. Ce chapitre présente les exigences pour gérer ces risques. + +## V5.1 Documentation sur la gestion des fichiers + +Cette section comprend l’obligation de documenter les caractéristiques attendues des fichiers acceptés par l’application, comme condition préalable nécessaire au développement et à la vérification des contrôles de sécurité pertinents. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **5.1.1** | Vérifiez que la documentation définit les types de fichiers autorisés, les extensions de fichiers attendues et la taille maximale (y compris la taille décompressée) pour chaque fonctionnalité de Téléversement. De plus, assurez-vous que la documentation précise comment les fichiers sont sécurisés pour le téléchargement et le traitement des utilisateurs finaux, par exemple le comportement de l'application lorsqu'un fichier malveillant est détecté.| 2 | + +## V5.2 Téléversement de fichiers et contenu + +La fonctionnalité de téléversement de fichiers est une source majeure de fichiers non fiables. Cette section décrit les exigences permettant de garantir que la présence, le volume ou le contenu de ces fichiers ne nuisent pas à l'application. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **5.2.1** | Vérifiez que l'application n'acceptera que des fichiers d'une taille qu'elle peut traiter sans provoquer de perte de performances ou d'attaque par déni de service. | 1 | +| **5.2.2** | Vérifiez que lorsque l'application accepte un fichier, seul ou dans une archive telle qu'un fichier zip, elle vérifie si l'extension de fichier correspond à une extension attendue et que le contenu correspond au type représenté par l'extension. Cela inclut, sans s'y limiter, la vérification des « octets magiques » initiaux, la réécriture d'images et l'utilisation de bibliothèques spécialisées pour la validation du contenu des fichiers. Pour le niveau L1, cela peut se concentrer uniquement sur les fichiers utilisés pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau L2, cela doit s'appliquer à tous les fichiers acceptés. | 1 | +| **5.2.3** | Vérifiez que l'application vérifie les fichiers compressés (par exemple, zip, gz, docx, odt) par rapport à la taille maximale autorisée non compressée et au nombre maximal de fichiers avant de décompresser le fichier. | 2 | +| **5.2.4** | Vérifiez qu'un quota de taille de fichier et un nombre maximal de fichiers par utilisateur sont appliqués pour garantir qu'un seul utilisateur ne puisse pas remplir le stockage avec trop de fichiers ou des fichiers excessivement volumineux. | 3 | +| **5.2.5** | Vérifiez que l'application n'autorise pas le téléversement de fichiers compressés contenant des liens symboliques, sauf si cela est spécifiquement requis (auquel cas il sera nécessaire d'appliquer une liste d'autorisation des fichiers vers lesquels il est possible de créer des liens symboliques).| 3 | +| **5.2.6** | Vérifiez que l'application rejette les images téléversées avec une taille de pixel supérieure au maximum autorisé, afin d'éviter les attaques par inondation de pixels.| 3 | + +## V5.3 Stockage de fichiers + +Cette section comprend des exigences visant à empêcher l'exécution inappropriée des fichiers après leur téléversement, à détecter le contenu dangereux et à éviter que des données non fiables ne soient utilisées pour contrôler l'emplacement de stockage des fichiers. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **5.3.1** | Vérifiez que les fichiers téléversés ou générés par une entrée non fiable et stockés dans un dossier public ne sont pas exécutés en tant que code de programme côté serveur lorsqu'ils sont accessibles directement avec une requête HTTP. | 1 | +| **5.3.2** | Vérifiez que lorsque l'application crée des chemins d'accès pour les opérations sur les fichiers, elle utilise des données générées en interne ou fiables plutôt que des noms de fichiers soumis par l'utilisateur. Si des noms de fichiers ou des métadonnées de fichiers soumis par l'utilisateur doivent être utilisés, une validation et un nettoyage stricts doivent être appliqués. Ceci permet de se protéger contre les attaques par traversée de chemin, l'inclusion de fichiers locaux ou distants (LFI, RFI) et la falsification de requêtes côté serveur (SSRF). | 1 | +| **5.3.3** | Vérifiez que le traitement des fichiers côté serveur, comme la décompression des fichiers, ignore les informations de chemin fournies par l'utilisateur pour éviter les vulnérabilités telles que le "zip slip". | 3 | + +## V5.4 Téléchargement de fichier + +Cette section décrit les exigences visant à atténuer les risques liés au téléchargement de fichiers, notamment les attaques par traversée de chemin et par injection. Elle s'assure également qu'ils ne contiennent pas de contenu dangereux. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **5.4.1** | Vérifiez que l’application valide ou ignore les noms de fichiers soumis par l’utilisateur, y compris dans un paramètre JSON, JSONP ou URL et spécifie un nom de fichier dans le champ d’en-tête Content-Disposition de la réponse. | 2 | +| **5.4.2** | Vérifiez que les noms de fichiers servis (par exemple, dans les champs d'en-tête de réponse HTTP ou les pièces jointes aux e-mails) sont encodés ou nettoyés (par exemple, conformément à la RFC 6266) pour préserver la structure du document et empêcher les attaques par injection. | 2 | +| **5.4.3** | Vérifiez que les fichiers obtenus à partir de sources non fiables sont analysés par des scanners antivirus pour empêcher la diffusion de contenu malveillant connu. | 2 | + +## Références + +Pour plus d'informations, voir également : + +* [OWASP File Upload Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html) +* [Example of using symlinks for arbitrary file read](https://hackerone.com/reports/1439593) +* [Explanation of "Magic Bytes" from Wikipedia](https://en.wikipedia.org/wiki/List_of_file_signatures) diff --git a/5.0/fr/0x15-V6-Authentication.md b/5.0/fr/0x15-V6-Authentication.md new file mode 100644 index 0000000000..9120b56135 --- /dev/null +++ b/5.0/fr/0x15-V6-Authentication.md @@ -0,0 +1,166 @@ +# V6 Authentification + +## Objectif de contrôle + +L'authentification est le processus permettant d'établir ou de confirmer l'authenticité d'une personne ou d'un appareil. Elle consiste à vérifier les déclarations d'une personne ou d'un appareil, à garantir la résistance à l'usurpation d'identité et à empêcher la récupération ou l'interception des mots de passe. + +Le [NIST SP 800-63](https://pages.nist.gov/800-63-3/) est une norme moderne, fondée sur des preuves, qui est précieuse pour les organisations du monde entier, mais qui est particulièrement pertinente pour les agences américaines et ceux qui intéragissent avec les agences américaines. + +Bien que de nombreuses exigences de ce chapitre soient basées sur la deuxième section de la norme (appelée NIST SP 800-63B « Directives relatives à l'identité numérique - Authentification et gestion du cycle de vie »), ce chapitre se concentre sur les menaces courantes et les faiblesses d'authentification fréquemment exploitées. Il ne prétend pas couvrir tous les points de la norme de manière exhaustive. Pour les cas où une conformité totale à la norme NIST SP 800-63 est nécessaire, veuillez vous référer à cette dernière. + +De plus, la terminologie du NIST SP 800-63 peut parfois différer, et ce chapitre utilise souvent une terminologie plus communément comprise pour améliorer la clarté. + +Une fonctionnalité commune aux applications plus avancées est la possibilité d'adapter les étapes d'authentification requises en fonction de divers facteurs de risque. Cette fonctionnalité est abordée dans le chapitre « Autorisation », car ces mécanismes doivent également être pris en compte dans les décisions d'autorisation. + +## V6.1 Documentation d'authentification + +Cette section détaille les exigences relatives à la documentation d'authentification à conserver pour une application. Elle est essentielle à la mise en œuvre et à l'évaluation de la configuration des contrôles d'authentification pertinents. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **6.1.1** | Vérifiez que la documentation de l'application définit comment les contrôles, tels que la limitation de débit, l'anti-automatisation et la réponse adaptative, sont utilisés pour se défendre contre les attaques telles que le « credential stuffing » et la force brute des mots de passe. La documentation doit expliquer clairement comment ces contrôles sont configurés et empêcher le blocage malveillant des comptes. | 1 | +| **6.1.2** | Vérifiez qu'une liste de mots spécifiques au contexte est documentée afin d'empêcher leur utilisation dans les mots de passe. Cette liste peut inclure des permutations de noms d'organisations, de produits, d'identifiants de systèmes, de noms de codes de projets, de noms de services ou de rôles, etc. | 2 | +| **6.1.3** | Vérifiez que, si l'application inclut plusieurs voies d'authentification, celles-ci sont toutes documentées avec les contrôles de sécurité et la force d'authentification qui doivent être appliqués de manière cohérente. | 2 | + +## V6.2 Sécurité des mots de passe + +Les mots de passe, appelés « secrets mémorisés » par la norme NIST SP 800-63, comprennent les mots de passe, les phrases de passe, les codes PIN, les schémas de déverrouillage et choisir « le bon chaton » ou d'un autre élément d'image. Ils sont généralement considérés comme « quelque chose que vous connaissez » et sont souvent utilisés comme mécanisme d'authentification à facteur unique. + +Cette section contient donc des exigences visant à garantir la création et la gestion sécurisées des mots de passe. La plupart des exigences sont de niveau 1, car elles sont les plus importantes à ce niveau. À partir du niveau 2, des mécanismes d'authentification multifacteur sont requis, les mots de passe pouvant être l'un de ces facteurs. + +Les exigences de cette section concernent principalement le chapitre [§ 5.1.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver) du [Guide du NIST](https://pages.nist.gov/800-63-3/sp800-63b.html). + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **6.2.1** | Vérifiez que les mots de passe définis par l'utilisateur comportent au moins 8 caractères, bien qu'un minimum de 15 caractères soit fortement recommandé. | 1 | +| **6.2.2** | Vérifiez que les utilisateurs peuvent modifier leur mot de passe. | 1 | +| **6.2.3** | Vérifiez que la fonctionnalité de changement de mot de passe nécessite le mot de passe actuel et le nouveau mot de passe de l'utilisateur. | 1 | +| **6.2.4** | Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou du changement de mot de passe sont vérifiés par rapport à un ensemble disponible d'au moins 3 000 mots de passe principaux qui correspondent à la politique de mot de passe de l'application, par exemple la longueur minimale. | 1 | +| **6.2.5** | Vérifiez que les mots de passe peuvent être utilisés, quelle que soit leur composition, sans restriction quant au type de caractères autorisés. Aucun nombre minimal de majuscules ou de minuscules, de chiffres ou de caractères spéciaux ne doit être exigé. | 1 | +| **6.2.6** | Vérifiez que les champs de saisie du mot de passe utilisent type=password pour masquer la saisie. Les applications peuvent permettre à l'utilisateur d'afficher temporairement l'intégralité du mot de passe masqué ou le dernier caractère saisi. | 1 | +| **6.2.7** | Vérifiez que la fonctionnalité « coller », les assistants de mot de passe du navigateur et les gestionnaires de mots de passe externes sont autorisés. | 1 | +| **6.2.8** | Vérifiez que l'application vérifie le mot de passe de l'utilisateur exactement tel qu'il a été reçu de l'utilisateur, sans aucune modification telle qu'une troncature ou une transformation de casse. | 1 | +| **6.2.9** | Vérifiez que les mots de passe d’au moins 64 caractères sont autorisés. | 2 | +| **6.2.10** | Vérifiez que le mot de passe d'un utilisateur reste valide jusqu'à ce qu'il soit découvert comme compromis ou qu'il soit renouvelé. L'application ne doit pas exiger de renouvellement périodique des identifiants. | 2 | +| **6.2.11** | Vérifiez que la liste documentée de mots spécifiques au contexte est utilisée pour éviter la création de mots de passe faciles à deviner. | 2 | +| **6.2.12** | Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou des modifications de mot de passe sont vérifiés par rapport à un ensemble de mots de passe fuités. | 2 | + +## V6.3 Sécurité générale de l'authentification + +Cette section contient les exigences générales relatives à la sécurité des mécanismes d'authentification et définit les différentes attentes en matière de niveaux. Les applications L2 doivent recourir à l'authentification multifacteur (MFA). Les applications L3 doivent utiliser une authentification matérielle, réalisée dans un environnement d'exécution certifié et approuvé (TEE). Cela peut inclure des clés d'accès liées à l'appareil, des authentificateurs eIDAS à niveau d'assurance élevé (LoA), des authentificateurs avec l'assurance NIST Authenticator Assurance Level 3 (AAL3) ou un mécanisme équivalent. + +Bien qu'il s'agisse d'une position relativement agressive concernant l'authentification multifacteur, il est essentiel de relever le niveau à ce sujet pour protéger les utilisateurs, et toute tentative d'assouplissement de ces exigences doit être accompagnée d'un plan clair sur la manière dont les risques liés à l'authentification seront atténués, en tenant compte des orientations et des recherches du NIST sur le sujet. + +Veuillez noter qu'au moment de la publication, la norme NIST SP 800-63 considère l'email comme [non acceptable](https://pages.nist.gov/800-63-FAQ/#q-b11) comme mécanisme d'authentification ([copie archivée](https://pages.nist.gov/800-63-FAQ/#q-b11)). + +Les exigences de cette section concernent diverses sections du [Guide du NIST](https://pages.nist.gov/800-63-3/sp800-63b.html), incluant : [§ 4.2.1](https://pages.nist.gov/800-63-3/sp800-63b.html#421-permitted-authenticator-types), [§ 4.3.1](https://pages.nist.gov/800-63-3/sp800-63b.html#431-permitted-authenticator-types), [§ 5.2.2](https://pages.nist.gov/800-63-3/sp800-63b.html#522-rate-limiting-throttling), et [§ 6.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#-612-post-enrollment-binding). + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **6.3.1** | Vérifiez que les contrôles visant à empêcher les attaques telles que le bourrage d'informations d'identification et la force brute des mots de passe sont mis en œuvre conformément à la documentation de sécurité de l'application. | 1 | +| **6.3.2** | Vérifiez que les comptes d’utilisateur par défaut (par exemple, « root », « admin » ou « sa ») ne sont pas présents dans l’application ou sont désactivés. | 1 | +| **6.3.3** | Vérifiez que l’application exige que les utilisateurs utilisent un mécanisme d’authentification multifacteur ou une combinaison de mécanismes d’authentification à facteur unique. | 2 | +| **6.3.4** | Vérifiez que, si l’application inclut plusieurs voies d’authentification, il n’existe aucune voie non documentée et que les contrôles de sécurité et la force d’authentification sont appliqués de manière cohérente. | 2 | +| **6.3.5** | Vérifiez que les utilisateurs sont informés des tentatives d'authentification suspectes (réussies ou non). Il peut s'agir de tentatives d'authentification provenant d'un emplacement ou d'un client inhabituel, d'une authentification partiellement réussie (un seul facteur parmi plusieurs), d'une tentative d'authentification après une longue période d'inactivité ou d'une authentification réussie après plusieurs tentatives infructueuses. | 3 | +| **6.3.6** | Vérifiez que le courrier électronique n’est pas utilisé comme mécanisme d’authentification à facteur unique ou à facteurs multiples. | 3 | +| **6.3.7** | Vérifiez que les utilisateurs sont avertis après les mises à jour des détails d'authentification, telles que les réinitialisations d'informations d'identification ou la modification du nom d'utilisateur ou de l'adresse e-mail. | 3 | +| **6.3.8** | Vérifiez que les utilisateurs valides ne peuvent pas être déduits d'échecs d'authentification, par exemple en se basant sur des messages d'erreur, des codes de réponse HTTP ou des temps de réponse différents. Les fonctionnalités d'inscription et de mot de passe oublié doivent également bénéficier de cette protection. | 3 | + +## V6.4 Cycle de vie et récupération du facteur d'authentification + +Les facteurs d'authentification peuvent inclure des mots de passe, des jetons logiciels, des jetons matériels et des dispositifs biométriques. La gestion sécurisée du cycle de vie de ces mécanismes est essentielle à la sécurité d'une application, et cette section présente les exigences afférentes. + +Les exigences de cette section concernent principalement les chapitres [§ 5.1.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver) ou [§ 6.1.2.3](https://pages.nist.gov/800-63-3/sp800-63b.html#replacement) of [Guide du NIST](https://pages.nist.gov/800-63-3/sp800-63b.html). + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **6.4.1** | Vérifiez que les mots de passe initiaux ou les codes d'activation générés par le système sont générés de manière aléatoire et sécurisée, qu'ils respectent la politique de mots de passe en vigueur et qu'ils expirent après une courte période ou après leur première utilisation. Ces secrets initiaux ne doivent pas devenir des mots de passe permanents. | 1 | +| **6.4.2** | Vérifiez que les indices de mot de passe ou l'authentification basée sur les connaissances (appelées « questions secrètes ») ne sont pas présents. | 1 | +| **6.4.3** | Vérifiez qu'un processus sécurisé de réinitialisation d'un mot de passe oublié est mis en œuvre, qui ne contourne aucun mécanisme d'authentification multifacteur activé. | 2 | +| **6.4.4** | Vérifiez que si un facteur d'authentification multifacteur est perdu, la preuve de vérification d'identité est effectuée au même niveau que lors de l'inscription. | 2 | +| **6.4.5** | Vérifiez que les instructions de renouvellement des mécanismes d'authentification qui expirent sont envoyées avec suffisamment de temps pour être exécutées avant l'expiration de l'ancien mécanisme d'authentification, en configurant des rappels automatiques si nécessaire. | 3 | +| **6.4.6** | Vérifiez que les administrateurs peuvent initier la réinitialisation du mot de passe de l'utilisateur, mais que cela ne leur permet pas de modifier ou de choisir son mot de passe. Cela évite qu'ils ne connaissent le mot de passe de l'utilisateur. | 3 | + +## V6.5 Exigences générales en matière d'authentification multifacteur + +Cette section fournit des conseils généraux qui seront pertinents pour différentes méthodes d’authentification multifacteur. + +Les mécanismes comprennent : + +* Secret recherché dans une table +* Mots de passe à usage unique basés sur le temps (TOTP) +* Mécanismes out-of-band + +Les secrets de recherche sont des listes pré-générées de codes secrets, similaires aux numéros d'autorisation de transaction (TAN), aux codes de récupération des réseaux sociaux ou à une grille contenant un ensemble de valeurs aléatoires. Ce type de mécanisme d'authentification est considéré comme « quelque chose que vous possédez », car les codes sont volontairement non mémorisables et doivent donc être stockés quelque part. + +Les mots de passe à usage unique basés sur le temps (TOTP) sont des jetons physiques ou logiciels qui affichent un code pseudo-aléatoire à usage unique et changeant en permanence. Ce type de mécanisme d'authentification est considéré comme « quelque chose que vous possédez ». Les TOTP multifactoriels sont similaires aux TOTP à simple facteur", mais nécessitent la saisie d'un code PIN valide, un déverrouillage biométrique, une clé USB ou un appairage NFC, ou d'une valeur supplémentaire (comme des calculateurs de signature de transaction) pour créer le mot de passe à usage unique (OTP) final. + +Des détails sur les mécanismes out-of-band seront fournis dans la section suivante. + +Les exigences de ces sections concernent principalement les chapitres [§ 5.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#-512-look-up-secrets), [§ 5.1.3](https://pages.nist.gov/800-63-3/sp800-63b.html#-513-out-of-band-devices), [§ 5.1.4.2](https://pages.nist.gov/800-63-3/sp800-63b.html#5142-single-factor-otp-verifiers), [§ 5.1.5.2](https://pages.nist.gov/800-63-3/sp800-63b.html#5152-multi-factor-otp-verifiers), [§ 5.2.1](https://pages.nist.gov/800-63-3/sp800-63b.html#521-physical-authenticators), et [§ 5.2.3](https://pages.nist.gov/800-63-3/sp800-63b.html#523-use-of-biometrics) du [Guide du NIST](https://pages.nist.gov/800-63-3/sp800-63b.html). + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **6.5.1** | Vérifiez que les secrets de recherche, les demandes ou codes d'authentification out-of-band et les mots de passe à usage unique basés sur le temps (TOTP) ne peuvent être utilisés avec succès qu'une seule fois. | 2 | +| **6.5.2** | Vérifiez que, lors de leur stockage dans le backend de l'application, les secrets de recherche comportant moins de 112 bits d'entropie (19 caractères alphanumériques aléatoires ou 34 chiffres aléatoires) sont hachés avec un algorithme de hachage de stockage de mots de passe approuvé, intégrant un sel aléatoire de 32 bits. Une fonction de hachage standard peut être utilisée si le secret comporte 112 bits d'entropie ou plus. | 2 | +| **6.5.3** | Vérifiez que les secrets de recherche, le code d'authentification out-of-band et les mots de passe à usage unique basés sur le temps sont générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) pour éviter les valeurs prévisibles. | 2 | +| **6.5.4** | Vérifiez que les secrets de recherche et les codes d'authentification out-of-band ont un minimum de 20 bits d'entropie (généralement 4 caractères alphanumériques aléatoires ou 6 chiffres aléatoires suffisent). | 2 | +| **6.5.5** | Vérifiez que les requêtes, codes ou jetons d'authentification out-of-band, ainsi que les mots de passe à usage unique (TOTP), ont une durée de vie définie. Les requêtes out-of-band doivent avoir une durée de vie maximale de 10 minutes et les TOTP, de 30 secondes. | 2 | +| **6.5.6** | Vérifiez que tout facteur d’authentification (y compris les appareils physiques) peut être révoqué en cas de vol ou autre perte. | 3 | +| **6.5.7** | Vérifiez que les mécanismes d’authentification biométrique ne sont utilisés que comme facteurs secondaires, avec quelque chose que vous possédez ou quelque chose que vous savez. | 3 | +| **6.5.8** | Vérifiez que les mots de passe à usage unique basés sur le temps (TOTP) sont vérifiés en fonction d'une source temporelle provenant d'un service de confiance et non d'une heure non fiable ou fournie par le client. | 3 | + +## V6.6 Mécanismes d'authentification out-of-band + +Cela implique généralement que le serveur d'authentification communique avec un appareil physique via un canal secondaire sécurisé. Par exemple, l'envoi de notifications push aux appareils mobiles. Ce type de mécanisme d'authentification est considéré comme « quelque chose que vous possédez ». + +Les mécanismes d'authentification out-of-band non sécurisés tels que le courrier électronique et la VoIP ne sont pas autorisés. L'authentification PSTN et SMS est actuellement considérée comme des [mécanismes d'authentification « restreints »](https://pages.nist.gov/800-63-FAQ/#q-b01) par le NIST et devrait être déconseillée au profit des mots de passe à usage unique basés sur le temps (TOTP), d'un mécanisme cryptographique ou similaire. La norme NIST SP 800-63B [§ 5.1.3.3](https://pages.nist.gov/800-63-3/sp800-63b.html#-5133-authentication-using-the-public-switched-telephone-network) recommande de traiter les risques d'échange d'appareil, de changement de carte SIM, de portage de numéro ou d'autres comportements anormaux, si l'authentification out-of-band par téléphone ou SMS doit absolument être prise en charge. Bien que cette section ASVS n'impose pas cela comme une exigence, le fait de ne pas prendre ces précautions pour une application L2 sensible ou une application L3 doit être considéré comme un signal d'alarme important. + +Notez que le NIST a également récemment publié des directives [déconseillant l'utilisation des notifications push](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#fig-3). Bien que cette section ASVS ne le fasse pas, il est important d'être conscient des risques de « push bombing ». + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **6.6.1** | Vérifier que les mécanismes d'authentification utilisant le réseau téléphonique public commuté (RTPC) pour la transmission de mots de passe à usage unique (OTP) par téléphone ou SMS ne sont proposés que lorsque le numéro de téléphone a été préalablement validé. D'autres méthodes plus robustes (telles que les mots de passe à usage unique à durée déterminée) sont également proposées, et que le service informe les utilisateurs des risques de sécurité qu'elles présentent. Pour les applications de niveau 3, le téléphone et les SMS ne doivent pas être disponibles. | 2 | +| **6.6.2** | Vérifiez que les demandes d’authentification out-of-band, les codes ou les jetons sont liés à la demande d’authentification d’origine pour laquelle ils ont été générés et ne sont pas utilisables pour une demande précédente ou ultérieure. | 2 | +| **6.6.3** | Vérifiez qu'un mécanisme d'authentification out-of-band basé sur du code est protégé contre les attaques par force brute grâce au "rate limiting". Envisagez également d'utiliser un code avec au moins 64 bits d'entropie. | 2 | +| **6.6.4** | Vérifiez que, lorsque les notifications push sont utilisées pour l'authentification multifacteur, le "rate limiting" est appliqué afin d'empêcher les attaques de type « push bombing ». La concordance des numéros peut également atténuer ce risque. | 3 | + +## V6.7 Mécanisme d'authentification cryptographique + +Les mécanismes d'authentification cryptographique incluent les cartes à puce ou les clés FIDO. L'utilisateur doit connecter ou appairer le dispositif cryptographique à l'ordinateur pour finaliser l'authentification. Le serveur d'authentification envoie un nonce de défi au dispositif ou au logiciel cryptographique, qui calcule une réponse à partir d'une clé cryptographique stockée de manière sécurisée. Les exigences de cette section fournissent des conseils spécifiques à la mise en œuvre de ces mécanismes, les conseils sur les algorithmes cryptographiques étant traités dans le chapitre « Cryptographie ». + +Lorsque des clés partagées ou secrètes sont utilisées pour l'authentification cryptographique, elles doivent être stockées à l'aide des mêmes mécanismes que les autres secrets système, comme documenté dans la section « Gestion des secrets » du chapitre « Configuration ». + +Les exigences de cette section concernent principalement le chapitre [§ 5.1.7.2](https://pages.nist.gov/800-63-3/sp800-63b.html#sfcdv) du [Guide du NIST](https://pages.nist.gov/800-63-3/sp800-63b.html). + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **6.7.1** | Vérifiez que les certificats utilisés pour vérifier les assertions d’authentification cryptographique sont stockés de manière à les protéger contre toute modification. | 3 | +| **6.7.2** | Vérifiez que le nonce de défi a une longueur d'au moins 64 bits et qu'il est statistiquement unique ou unique sur toute la durée de vie du périphérique cryptographique. | 3 | + +## V6.8 Authentification avec un fournisseur d'identité + +Les fournisseurs d'identité (IdP) fournissent une identité fédérée aux utilisateurs. Ces derniers possèdent souvent plusieurs identités auprès de plusieurs IdP, comme une identité d'entreprise utilisant Azure AD, Okta, Ping Identity ou Google, ou une identité grand public utilisant Facebook, Twitter, Google ou WeChat, pour ne citer que quelques alternatives courantes. Cette liste ne constitue pas une recommandation pour ces entreprises ou services, mais simplement un encouragement aux développeurs à prendre en compte le fait que de nombreux utilisateurs possèdent de nombreuses identités établies. Les organisations devraient envisager l'intégration avec les identités utilisateur existantes, en fonction du profil de risque lié à la fiabilité de la vérification d'identité de l'IdP. Par exemple, il est peu probable qu'une organisation gouvernementale accepte une identité de réseau social comme identifiant pour des systèmes sensibles, car il est facile de créer de fausses identités ou des identités jetables, tandis qu'une entreprise de jeux mobiles pourrait avoir besoin de s'intégrer aux principales plateformes de réseaux sociaux pour développer sa base de joueurs actifs. + +L'utilisation sécurisée de fournisseurs d'identité externes nécessite une configuration et une vérification rigoureuses afin d'éviter l'usurpation d'identité ou la falsification d'assertions. Cette section décrit les exigences pour gérer ces risques. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **6.8.1** | Vérifiez que, si l'application prend en charge plusieurs fournisseurs d'identité (IdP), l'identité de l'utilisateur ne peut pas être usurpée via un autre fournisseur d'identité pris en charge (par exemple, en utilisant le même identifiant utilisateur). La mesure standard consisterait à ce que l'application enregistre et identifie l'utilisateur à l'aide d'une combinaison de l'ID du fournisseur d'identité (servant d'espace de noms) et de l'ID de l'utilisateur dans le fournisseur d'identité. | 2 | +| **6.8.2** | Vérifiez que la présence et l'intégrité des signatures numériques sur les assertions d'authentification (par exemple sur les assertions JWT ou SAML) sont toujours validées, en rejetant toutes les assertions non signées ou ayant des signatures non valides. | 2 | +| **6.8.3** | Vérifiez que les assertions SAML sont traitées de manière unique et utilisées une seule fois au cours de la période de validité pour éviter les attaques par rejeu. | 2 | +| **6.8.4** | Si une application utilise un fournisseur d'identité (IdP) distinct et attend une force, des méthodes ou une date d'authentification spécifiques pour des fonctions spécifiques, vérifiez que l'application les vérifie à l'aide des informations renvoyées par l'IdP. Par exemple, si OIDC est utilisé, cela peut être réalisé en validant les affirmations de jeton d'identification telles que « acr », « amr » et « auth_time » (le cas échéant). Si l'IdP ne fournit pas ces informations, l'application doit disposer d'une approche de secours documentée qui suppose que le mécanisme d'authentification de force minimale a été utilisé (par exemple, une authentification à facteur unique avec nom d'utilisateur et mot de passe). | 2 | + +## Références + +Pour plus d'informations, voir également : + +* [NIST SP 800-63 - Digital Identity Guidelines](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-3.pdf) +* [NIST SP 800-63B - Authentication and Lifecycle Management](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf) +* [NIST SP 800-63 FAQ](https://pages.nist.gov/800-63-FAQ/) +* [OWASP Web Security Testing Guide: Testing for Authentication](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/04-Authentication_Testing) +* [OWASP Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html) +* [OWASP Forgot Password Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html) +* [OWASP Choosing and Using Security Questions Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Choosing_and_Using_Security_Questions_Cheat_Sheet.html) +* [CISA Guidance on "Number Matching"](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implement-number-matching-in-mfa-applications-508c.pdf) +* [Details on the FIDO Alliance](https://fidoalliance.org/) diff --git a/5.0/fr/0x16-V7-Session-Management.md b/5.0/fr/0x16-V7-Session-Management.md new file mode 100644 index 0000000000..18e5450eed --- /dev/null +++ b/5.0/fr/0x16-V7-Session-Management.md @@ -0,0 +1,91 @@ +# V7 Gestion des sessions + +## Objectif de contrôle + +Les mécanismes de gestion de session permettent aux applications de corréler les interactions entre utilisateurs et appareils au fil du temps, même avec des protocoles de communication sans état (comme HTTP). Les applications modernes peuvent utiliser plusieurs jetons de session aux caractéristiques et objectifs distincts. Un système de gestion de session sécurisé empêche les attaquants d'obtenir, d'utiliser ou d'abuser de la session d'une victime. Les applications gérant des sessions doivent garantir le respect des exigences de gestion de session de haut niveau suivantes : + +* Les sessions sont uniques à chaque individu et ne peuvent être ni devinées ni partagées. +* Les sessions sont invalidées lorsqu'elles ne sont plus nécessaires et expirent pendant les périodes d'inactivité. + +De nombreuses exigences de ce chapitre concernent des contrôles sélectionnés de [NIST SP 800-63 Digital Identity Guidelines](https://pages.nist.gov/800-63-4/), en se concentrant sur les menaces courantes et les faiblesses d'authentification couramment exploitées. + +Notez que les exigences relatives aux détails d’implémentation spécifiques de certains mécanismes de gestion de session peuvent être trouvées ailleurs : + +* Les cookies HTTP sont un mécanisme courant de sécurisation des jetons de session. Les exigences de sécurité spécifiques aux cookies sont décrites dans le chapitre « Sécurité de l'interface web ». +* Les jetons autonomes sont fréquemment utilisés pour maintenir les sessions. Les exigences de sécurité spécifiques sont décrites dans le chapitre « Jetons autonomes ». + +## V7.1 Documentation sur la gestion des sessions + +Il n'existe pas de modèle unique convenant à toutes les applications. Il est donc impossible de définir des limites universelles et adaptées à tous les cas. Une analyse des risques, accompagnée de décisions de sécurité documentées relatives à la gestion des sessions, doit être réalisée avant la mise en œuvre et les tests. Cela garantit que le système de gestion des sessions est adapté aux exigences spécifiques de l'application. + +Que le mécanisme de session choisi soit avec ou sans état, l'analyse doit être complète et documentée afin de démontrer que la solution sélectionnée est capable de satisfaire à toutes les exigences de sécurité pertinentes. L'interaction avec les mécanismes d'authentification unique (SSO) utilisés doit également être prise en compte. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **7.1.1** | Vérifiez que le délai d'inactivité de la session de l'utilisateur et la durée de vie maximale absolue de la session sont documentés, sont appropriés en combinaison avec d'autres contrôles et que la documentation inclut une justification de tout écart par rapport aux exigences de réauthentification NIST SP 800-63B. | 2 | +| **7.1.2** | Vérifiez que la documentation définit le nombre de sessions simultanées (parallèles) autorisées pour un compte ainsi que les comportements et actions prévus à entreprendre lorsque le nombre maximal de sessions actives est atteint. | 2 | +| **7.1.3** | Vérifiez que tous les systèmes qui créent et gèrent des sessions utilisateur dans le cadre d'un écosystème de gestion des identités fédérées (tels que les systèmes SSO) sont documentés avec des contrôles pour coordonner la durée de vie des sessions, la résiliation et toute autre condition nécessitant une réauthentification. | 2 | + +## V7.2 Sécurité fondamentale de la gestion des sessions + +Cette section satisfait aux exigences essentielles des sessions sécurisées en vérifiant que les jetons de session sont générés et validés de manière sécurisée. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **7.2.1** | Vérifiez que l’application effectue toutes les vérifications des jetons de session à l’aide d’un service backend de confiance. | 1 | +| **7.2.2** | Vérifiez que l'application utilise des jetons autonomes ou de référence générés dynamiquement pour la gestion des sessions, c'est-à-dire sans utiliser de secrets et de clés d'API statiques. | 1 | +| **7.2.3** | Vérifiez que si des jetons par référence sont utilisés pour représenter les sessions utilisateur, ils sont uniques et générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et possèdent au moins 128 bits d'entropie. | 1 | +| **7.2.4** | Vérifiez que l’application génère un nouveau jeton de session lors de l’authentification de l’utilisateur, y compris la réauthentification, et met fin au jeton de session actuel. | 1 | + +## V7.3 Délai d'expiration de la session + +Les mécanismes de temporisation de session servent à minimiser les risques de détournement de session et autres formes d'abus. Les temporisations doivent respecter des décisions de sécurité documentées. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **7.3.1** | Vérifiez qu’il existe un délai d’inactivité tel que la réauthentification soit appliquée conformément à l’analyse des risques et aux décisions de sécurité documentées. | 2 | +| **7.3.2** | Vérifiez qu'il existe une durée de vie maximale absolue de la session de sorte que la réauthentification soit appliquée conformément à l'analyse des risques et aux décisions de sécurité documentées. | 2 | + +## V7.4 Fin de session + +La fin de session peut être gérée soit par l'application elle-même, soit par le fournisseur d'authentification unique (SSO) si ce dernier gère la session à sa place. Il peut être nécessaire de déterminer si le fournisseur d'authentification unique est concerné par les exigences de cette section, car certaines peuvent être contrôlées par lui. + +La fin de session doit entraîner une réauthentification et être effective dans l'ensemble de l'application, de la connexion fédérée (si présente) et de toutes les parties utilisatrices. + +Pour les mécanismes de session avec état, la terminaison implique généralement l'invalidation de la session sur le serveur principal. Dans le cas de jetons autonomes, des mesures supplémentaires sont nécessaires pour révoquer ou bloquer ces jetons, car ils pourraient sinon rester valides jusqu'à leur expiration. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **7.4.1** | Vérifiez que lorsque la fin de session est déclenchée (par exemple, déconnexion ou expiration), l'application interdit toute utilisation ultérieure de la session. Pour les jetons par référence ou les sessions avec état, cela implique l'invalidation des données de session au niveau du backend de l'application. Les applications utilisant des jetons autonomes nécessiteront une solution, comme la gestion d'une liste des jetons terminés, l'interdiction des jetons produits avant une date et une heure spécifique à chaque utilisateur ou la rotation d'une clé de signature spécifique à chaque utilisateur. | 1 | +| **7.4.2** | Vérifiez que l'application met fin à toutes les sessions actives lorsqu'un compte utilisateur est désactivé ou supprimé (par exemple, lorsqu'un employé quitte l'entreprise). | 1 | +| **7.4.3** | Vérifiez que l'application offre la possibilité de mettre fin à toutes les autres sessions actives après une modification ou une suppression réussie de tout facteur d'authentification (y compris la modification du mot de passe via une réinitialisation ou une récupération et, le cas échéant, une mise à jour des paramètres MFA). | 2 | +| **7.4.4** | Vérifiez que toutes les pages nécessitant une authentification disposent d’un accès facile et visible à la fonctionnalité de déconnexion. | 2 | +| **7.4.5** | Vérifiez que les administrateurs d’applications sont en mesure de mettre fin aux sessions actives pour un utilisateur individuel ou pour tous les utilisateurs. | 2 | + +## V7.5 Défenses contre les abus de session + +Cette section décrit les exigences visant à atténuer le risque posé par les sessions actives détournées ou utilisées abusivement par des vecteurs s'appuyant sur l'existence et les capacités des sessions utilisateur actives. Par exemple, l'exécution de contenu malveillant pour forcer un navigateur authentifié à effectuer une action en utilisant la session de la victime. + +Veuillez noter que les instructions spécifiques au niveau dans le chapitre « Authentification » doivent être prises en compte lors de l'examen des exigences de cette section. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **7.5.1** | Vérifiez que l'application nécessite une réauthentification complète avant d'autoriser les modifications des attributs de compte sensibles qui peuvent affecter l'authentification, tels que l'adresse e-mail, le numéro de téléphone, la configuration MFA ou d'autres informations utilisées dans la récupération de compte. | 2 | +| **7.5.2** | Vérifiez que les utilisateurs peuvent afficher et (après s'être authentifiés à nouveau avec au moins un facteur) terminer une ou toutes les sessions actuellement actives. | 2 | +| **7.5.3** | Vérifiez que l’application nécessite une authentification supplémentaire avec au moins un facteur ou une vérification secondaire avant d’effectuer des transactions ou des opérations hautement sensibles. | 3 | + +## V7.6 Réauthentification fédérée + +Cette section s'adresse aux développeurs de code de partie utilisatrice (RP) ou de fournisseur d'identité (IdP). Ces exigences découlent de la norme [NIST SP 800-63C](https://pages.nist.gov/800-63-4/sp800-63c.html) relative à la fédération et aux assertions. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **7.6.1** | Vérifiez que la durée de vie et la fin de la session entre les parties de confiance (RP) et les fournisseurs d'identité (IdP) se comportent comme documenté, en exigeant une réauthentification si nécessaire, par exemple lorsque le temps maximal entre les événements d'authentification IdP est atteint. | 2 | +| **7.6.2** | Vérifiez que la création d'une session nécessite soit le consentement de l'utilisateur, soit une action explicite, empêchant ainsi la création de nouvelles sessions d'application sans interaction de l'utilisateur. | 2 | + +## Références + +Pour plus d'informations, voir également : + +* [OWASP Web Security Testing Guide: Session Management Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/06-Session_Management_Testing) +* [OWASP Session Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html) diff --git a/5.0/fr/0x17-V8-Authorization.md b/5.0/fr/0x17-V8-Authorization.md new file mode 100644 index 0000000000..1b3d4630fe --- /dev/null +++ b/5.0/fr/0x17-V8-Authorization.md @@ -0,0 +1,56 @@ +# V8 Autorisation + +## Objectif de contrôle + +L'autorisation garantit que l'accès est accordé uniquement aux utilisateurs autorisés (utilisateurs, serveurs et autres clients). Pour appliquer le principe du moindre privilège (POLP), les applications vérifiées doivent répondre aux exigences générales suivantes : + +* Documenter les règles d'autorisation des documents, y compris les facteurs de prise de décision et les contextes environnementaux. +* Les consommateurs ne devraient avoir accès qu'aux ressources autorisées par leurs droits définis. + +## V8.1 Documentation d'autorisation + +Une documentation exhaustive des autorisations est essentielle pour garantir que les décisions de sécurité sont appliquées de manière cohérente, vérifiables et conformes aux politiques de l'organisation. Cela réduit le risque d'accès non autorisé en clarifiant les exigences de sécurité et en les rendant applicables aux développeurs, administrateurs et testeurs. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **8.1.1** | Vérifiez que la documentation d’autorisation définit des règles de restriction de l’accès au niveau de la fonction et aux données en fonction des autorisations du consommateur et des attributs des ressources. | 1 | +| **8.1.2** | Vérifiez que la documentation d'autorisation définit les règles de restriction d'accès au niveau des champs (lecture et écriture) en fonction des autorisations des consommateurs et des attributs des ressources. Notez que ces règles peuvent dépendre d'autres valeurs d'attributs de l'objet de données concerné, telles que l'état ou le statut. | 2 | +| **8.1.3** | Vérifiez que la documentation de l'application définit les attributs environnementaux et contextuels (y compris, mais sans s'y limiter, l'heure de la journée, l'emplacement de l'utilisateur, l'adresse IP ou l'appareil) qui sont utilisés dans l'application pour prendre des décisions de sécurité, y compris celles relatives à l'authentification et à l'autorisation. | 3 | +| **8.1.4** | Vérifier que la documentation d'authentification et d'autorisation définit l'utilisation des facteurs environnementaux et contextuels dans la prise de décision, en plus des autorisations au niveau des fonctions, des données et des champs. Cela doit inclure les attributs évalués, les seuils de risque et les actions entreprises (par exemple, autorisation, contestation, refus, renforcement de l'authentification). | 3 | + +## V8.2 Conception d'autorisation générale + +La mise en œuvre de contrôles d’autorisation granulaires aux niveaux de la fonction, des données et des champs garantis que les consommateurs ne pourront accéder qu’à ce qui leur a été explicitement accordé. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **8.2.1** | Vérifiez que l’application garantit que l’accès basé sur la fonction est limité aux consommateurs disposant d’autorisations explicites. | 1 | +| **8.2.2** | Vérifiez que l'application garantit que l'accès spécifique aux données est limité aux consommateurs disposant d'autorisations explicites sur des éléments de données spécifiques afin d'atténuer les références d'objet directes non sécurisées (IDOR) et les autorisations de niveau d'objet rompues (BOLA). | 1 | +| **8.2.3** | Vérifiez que l'application garantit que l'accès au niveau du champ est limité aux consommateurs disposant d'autorisations explicites sur des champs spécifiques afin d'atténuer les problèmes d'autorisation au niveau de la propriété d'objet (BOPLA). | 2 | +| **8.2.4** | Vérifiez que les contrôles de sécurité adaptatifs basés sur les attributs environnementaux et contextuels du consommateur (tels que l'heure, la localisation, l'adresse IP ou l'appareil) sont mis en œuvre pour les décisions d'authentification et d'autorisation, comme défini dans la documentation de l'application. Ces contrôles doivent être appliqués lorsque le consommateur tente de démarrer une nouvelle session et également pendant une session existante. | 3 | + +## V8.3 Autorisation par opération + +L'application immédiate des modifications d'autorisation dans le niveau approprié de l'architecture d'une application est essentielle pour empêcher les actions non autorisées, en particulier dans les environnements dynamiques. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **8.3.1** | Vérifier que l'application applique les règles d'autorisations au niveau de la couche service de confiance et ne s’appuie pas sur des contrôles qu’un consommateur non approuvé pourrait manipuler, comme JavaScript côté client. | 1 | +| **8.3.2** | Vérifiez que les modifications apportées aux valeurs sur lesquelles reposent les décisions d'autorisation sont appliquées immédiatement. Lorsque les modifications ne peuvent pas être appliquées immédiatement (par exemple, en s'appuyant sur des données de jetons autonomes), des contrôles d'atténuation doivent être mis en place pour alerter un consommateur lorsqu'il effectue une action alors qu'il n'est plus autorisé à le faire et annuler la modification. Notez que cette solution alternative ne limiterait pas les fuites d'informations. | 3 | +| **8.3.3** | Vérifiez que l'accès à un objet repose sur les autorisations du sujet d'origine (par exemple, le consommateur), et non sur celles d'un intermédiaire ou d'un service agissant en son nom. Par exemple, si un consommateur appelle un service web à l'aide d'un jeton d'authentification autonome, et que ce service demande ensuite des données à un autre service, ce dernier utilisera le jeton du consommateur, plutôt qu'un jeton inter-machine du premier service, pour prendre les décisions d'autorisation. | 3 | + +## V8.4 Autres considérations relatives à l'autorisation + +Des considérations supplémentaires concernant l’autorisation, en particulier pour les interfaces administratives et les environnements multi-tenants, aident à empêcher tout accès non autorisé. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **8.4.1** | Vérifiez que les applications multi-tenants utilisent des contrôles inter-tenants pour garantir que les opérations des consommateurs n'affecteront jamais les tenants avec lesquels ils ne sont pas autorisés à interagir. | 2 | +| **8.4.2** | Vérifiez que l'accès aux interfaces administratives intègre plusieurs couches de sécurité, notamment la vérification continue de l'identité du consommateur, l'évaluation de la posture de sécurité des appareils et l'analyse contextuelle des risques, garantissant que l'emplacement du réseau ou les endpoints approuvés ne sont pas les seuls facteurs d'autorisation, même s'ils peuvent réduire la probabilité d'accès non autorisé. | 3 | + +## Références + +Pour plus d'informations, voir également : + +* [OWASP Web Security Testing Guide: Authorization](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/05-Authorization_Testing) +* [OWASP Authorization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html) diff --git a/5.0/fr/0x18-V9-Self-contained-Tokens.md b/5.0/fr/0x18-V9-Self-contained-Tokens.md new file mode 100644 index 0000000000..e347810721 --- /dev/null +++ b/5.0/fr/0x18-V9-Self-contained-Tokens.md @@ -0,0 +1,36 @@ +# V9 Jetons autonomes + +## Objectif de contrôle + +Le concept de jeton autonome est mentionné dans la RFC 6749 OAuth 2.0 originale de 2012. Il désigne un jeton contenant des données ou des déclarations sur lesquelles un service récepteur s'appuie pour prendre des décisions de sécurité. Il convient de le distinguer d'un simple jeton contenant uniquement un identifiant, qu'un service récepteur utilise pour rechercher des données localement. Les exemples les plus courants de jetons autonomes sont les jetons Web JSON (JWT) et les assertions SAML. + +L'utilisation de jetons autonomes est devenue très répandue, même en dehors d'OAuth et d'OIDC. Parallèlement, la sécurité de ce mécanisme repose sur la capacité à valider l'intégrité du jeton et à garantir sa validité dans un contexte particulier. Ce processus présente de nombreux pièges, et ce chapitre détaille les mécanismes que les applications devraient mettre en place pour les éviter. + +## V9.1 Source et intégrité du jeton + +Cette section comprend des exigences visant à garantir que le jeton a été produit par une partie de confiance et n’a pas été falsifié. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **9.1.1** | Vérifiez que les jetons autonomes sont validés à l'aide de leur signature numérique ou MAC pour les protéger contre toute falsification avant d'accepter le contenu du jeton. | 1 | +| **9.1.2** | Vérifiez que seuls les algorithmes d'une liste d’autorisations peuvent être utilisés pour créer et vérifier des jetons autonomes, dans un contexte donné. La liste d'autorisation doit inclure les algorithmes autorisés, idéalement symétriques ou asymétriques, et ne doit pas inclure l'algorithme « Aucun ». Si les algorithmes symétriques et asymétriques doivent être pris en charge, des contrôles supplémentaires seront nécessaires pour éviter toute confusion de clés. | 1 | +| **9.1.3** | Vérifiez que les clés utilisées pour valider les jetons autonomes proviennent de sources préconfigurées et fiables pour l'émetteur du jeton, empêchant ainsi les attaquants de spécifier des sources et des clés non fiables. Pour les JWT et autres structures JWS, les en-têtes tels que « jku », « x5u » et « jwk » doivent être validés par rapport à une liste d'autorisation de sources fiables. | 1 | + +## V9.2 Contenu du jeton + +Avant de prendre des décisions de sécurité basées sur le contenu d'un jeton autonome, il est nécessaire de vérifier que le jeton a été présenté pendant sa période de validité et qu'il est destiné à être utilisé par le service destinataire et pour l'usage pour lequel il a été présenté. Cela permet d'éviter toute utilisation croisée non sécurisée entre différents services ou avec différents types de jetons provenant du même émetteur. + +Les exigences spécifiques pour OAuth et OIDC sont couvertes dans le chapitre dédié. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **9.2.1** | Vérifiez que, si une période de validité est indiquée dans les données du jeton, celui-ci et son contenu ne sont acceptés que si la date de vérification est comprise dans cette période. Par exemple, pour les JWT, les déclarations « nbf » et « exp » doivent être vérifiées. | 1 | +| **9.2.2** | Vérifiez que le service recevant un jeton valide le type de jeton et son utilisation avant d'en accepter le contenu. Par exemple, seuls les jetons d'accès peuvent être acceptés pour les décisions d'autorisation, et seuls les jetons d'identification peuvent être utilisés pour prouver l'authentification des utilisateurs. | 2 | +| **9.2.3** | Vérifiez que le service accepte uniquement les jetons destinés à être utilisés avec ce service (audience). Pour les JWT, cela peut être réalisé en validant la déclaration « aud » par rapport à une liste d'autorisation définie dans le service. | 2 | +| **9.2.4** | Si un émetteur de jetons utilise la même clé privée pour émettre des jetons destinés à différentes audiences, vérifiez que les jetons émis contiennent une restriction d'audience identifiant de manière unique les audiences visées. Cela empêchera la réutilisation d'un jeton avec une audience non prévue. Si l'identifiant d'audience est provisionné dynamiquement, l'émetteur de jetons doit valider ces audiences afin de garantir qu'elles n'entraînent pas d'usurpation d'identité. | 2 | + +## Références + +Pour plus d'informations, voir également : + +* [OWASP JSON Web Token Cheat Sheet for Java Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_for_Java_Cheat_Sheet.html) (mais il contient des orientations générales utiles) diff --git a/5.0/fr/0x19-V10-OAuth-and-OIDC.md b/5.0/fr/0x19-V10-OAuth-and-OIDC.md new file mode 100644 index 0000000000..51ad34fcce --- /dev/null +++ b/5.0/fr/0x19-V10-OAuth-and-OIDC.md @@ -0,0 +1,169 @@ +# V10 Oauth et OIDC + +## Objectif de contrôle + +OAuth2 (appelé OAuth dans ce chapitre) est un framework standard pour l'autorisation déléguée. Par exemple, grâce à OAuth, une application cliente peut accéder aux API (ressources serveur) au nom d'un utilisateur, à condition que ce dernier l'ait autorisée. + +OAuth n'est pas conçu pour l'authentification dOauth et OIDCes utilisateurs. Le Framework OpenID Connect (OIDC) étend OAuth en ajoutant une couche d'identité utilisateur. OIDC prend en charge des fonctionnalités telles que la standardisation des informations utilisateur, l'authentification unique (SSO) et la gestion des sessions. OIDC étant une extension d'OAuth, les exigences OAuth décrites dans ce chapitre s'appliquent également à OIDC. + +Les rôles suivants sont définis dans OAuth : + +* Le client OAuth est l'application qui tente d'accéder aux ressources du serveur (par exemple, en appelant une API à l'aide du jeton d'accès émis). Il s'agit souvent d'une application côté serveur. + * Un client confidentiel est un client capable de maintenir la confidentialité des informations d’identification qu’il utilise pour s’authentifier auprès du serveur d’autorisation. + * Un client public n'est pas en mesure de préserver la confidentialité des informations d'identification nécessaires à l'authentification auprès du serveur d'autorisation. Par conséquent, au lieu de s'authentifier (par exemple, à l'aide des paramètres « client_id » et « client_secret »), il s'identifie uniquement (à l'aide du paramètre « client_id »). +* Le serveur de ressources OAuth (RS) est l’API du serveur qui expose les ressources aux clients OAuth. +* Le serveur d'autorisation OAuth (AS) est une application serveur qui émet des jetons d'accès aux clients OAuth. Ces jetons permettent aux clients OAuth d'accéder aux ressources RS, soit pour le compte d'un utilisateur final, soit pour leur propre compte. L'AS est souvent une application distincte, mais (le cas échéant) il peut être intégré à un RS approprié. +* Le propriétaire de la ressource (RO) est l'utilisateur final qui autorise les clients OAuth à obtenir en son nom un accès limité aux ressources hébergées sur le serveur de ressources. Le propriétaire de la ressource consent à cette autorisation déléguée en interagissant avec le serveur d'autorisation. + +Les rôles suivants sont définis dans OIDC : + +* La partie de confiance (RP) est l'application cliente qui demande l'authentification de l'utilisateur final via le fournisseur OpenID. Elle joue le rôle de client OAuth. +* Le fournisseur OpenID (OP) est un AS OAuth capable d'authentifier l'utilisateur final et de fournir des déclarations OIDC à un RP. L'OP peut être le fournisseur d'identité (IdP), mais dans les scénarios fédérés, l'OP et le fournisseur d'identité (où l'utilisateur final s'authentifie) peuvent être des applications serveur différentes. + +OAuth et OIDC ont été initialement conçus pour les applications tierces. Aujourd'hui, ils sont également souvent utilisés par les applications propriétaires. Cependant, lorsqu'ils sont utilisés dans des scénarios propriétaires, comme l'authentification et la gestion de session, le protocole ajoute une certaine complexité, ce qui peut engendrer de nouveaux défis de sécurité. + +OAuth et OIDC peuvent être utilisés pour de nombreux types d'applications, mais l'accent d'ASVS et les exigences de ce chapitre portent sur les applications Web et les API. + +Étant donné que OAuth et OIDC peuvent être considérés comme une logique au-dessus des technologies Web, les exigences générales des autres chapitres s'appliquent toujours et ce chapitre ne peut pas être sorti de son contexte. + +Ce chapitre présente les meilleures pratiques actuelles pour OAuth2 et OIDC, conformément aux spécifications disponibles sur et . Même si les RFC sont considérées comme matures, elles sont fréquemment mises à jour. Il est donc important de se conformer aux dernières versions lors de l'application des exigences de ce chapitre. Consultez la section Références pour plus de détails. + +Compte tenu de la complexité du domaine, il est essentiel qu’une solution OAuth ou OIDC sécurisée utilise des serveurs d’autorisation standard bien connus du secteur et applique la configuration de sécurité recommandée. + +La terminologie utilisée dans ce chapitre est conforme aux RFC OAuth et aux spécifications OIDC ; mais notez que la terminologie OIDC n'est utilisée que pour les exigences spécifiques à OIDC, sinon, la terminologie OAuth est utilisée. + +Dans le contexte d'OAuth et d'OIDC, le terme « jeton » dans ce chapitre fait référence à : + +* Les jetons d'accès, qui ne peuvent être consommés que par le serveur de sécurité (RS) et qui peuvent être des jetons de référence validés par introspection ou des jetons autonomes validés à l'aide d'un matériau clé. +* Jetons de rafraîchissement, qui ne seront consommés que par le serveur d'autorisation qui a émis le jeton. +* Jetons d'identification OIDC, qui ne doivent être consommés que par le client qui a déclenché le flux d'autorisation. + +Les niveaux de risque pour certaines exigences de ce chapitre varient selon que le client est confidentiel ou public. L'utilisation d'une authentification client forte limitant de nombreux vecteurs d'attaque, certaines exigences peuvent être assouplies lors de l'utilisation d'un client confidentiel pour les applications L1. + +## V10.1 Sécurité générique OAuth et OIDC + +Cette section couvre les exigences architecturales génériques qui s’appliquent à toutes les applications utilisant OAuth ou OIDC. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **10.1.1** | Vérifiez que les jetons sont envoyés uniquement aux composants qui en ont absolument besoin. Par exemple, lors de l'utilisation d'un modèle backend-for-frontend pour les applications JavaScript basées sur un navigateur, les jetons d'accès et d'actualisation ne doivent être accessibles qu'au backend. | 2 | +| **10.1.2** | Vérifiez que le client n'accepte les valeurs du serveur d'autorisation (telles que le code d'autorisation ou le jeton d'identification) que si elles résultent d'un flux d'autorisation initié par la même session d'agent utilisateur et la même transaction. Cela nécessite que les secrets générés par le client, tels que la clé de preuve pour l'échange de codes (PKCE) « code_verifier », « state » ou le nonce OIDC, ne puissent être devinés, soient spécifiques à la transaction et soient liés de manière sécurisée au client et à la session d'agent utilisateur au cours de laquelle la transaction a été initiée. | 2 | + +## V10.2 Client OAuth + +Ces exigences détaillent les responsabilités des applications clientes OAuth. Le client peut être, par exemple, un serveur web backend (souvent utilisé comme backend pour frontend, BFF), une intégration de service backend ou une application monopage frontend (SPA, également appelée application basée sur un navigateur). + +En général, les clients backend sont considérés comme confidentiels et les clients frontend comme publics. Cependant, les applications natives exécutées sur l'appareil de l'utilisateur final peuvent être considérées comme confidentielles lorsqu'elles s'enregistrent dynamiquement des clients OAuth. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **10.2.1** | Vérifiez que, si le flux de code est utilisé, le client OAuth dispose d'une protection contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF), qui déclenchent des demandes de jetons, soit en utilisant la fonctionnalité de clé de preuve pour l'échange de code (PKCE), soit en vérifiant le paramètre « state » envoyé dans la demande d'autorisation. | 2 | +| **10.2.2** | Vérifiez que, si le client OAuth peut interagir avec plusieurs serveurs d'autorisation, il dispose d'une protection contre les attaques par confusion. Par exemple, il peut exiger que le serveur d'autorisation renvoie la valeur du paramètre « iss » et la valide dans la réponse d'autorisation et la réponse du jeton. | 2 | +| **10.2.3** | Vérifiez que le client OAuth demande uniquement les portées requises (ou d’autres paramètres d’autorisation) dans les requêtes adressées au serveur d’autorisation. | 3 | + +## V10.3 Serveur de ressources OAuth + +Dans le contexte d'ASVS et de ce chapitre, le serveur de ressources est une API. Pour fournir un accès sécurisé, le serveur de ressources doit : + +* Valider le jeton d'accès, conformément au format du jeton et aux spécifications du protocole, par exemple, validation JWT ou introspection du jeton OAuth. +* S'il est valide, appliquer les décisions d'autorisation en fonction des informations du jeton d'accès et des autorisations accordées. Par exemple, le serveur de ressources doit vérifier que le client (agissant au nom du RO) est autorisé à accéder à la ressource demandée. + +Par conséquent, les exigences répertoriées ici sont spécifiques à OAuth ou OIDC et doivent être exécutées après la validation du jeton et avant d'effectuer l'autorisation basée sur les informations du jeton. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **10.3.1** | Vérifiez que le serveur de ressources accepte uniquement les jetons d'accès destinés à être utilisés avec ce service (audience). L'audience peut être incluse dans un jeton d'accès structuré (comme la déclaration « aud » dans JWT) ou vérifiée à l'aide du endpoint d'introspection de jeton. | 2 | +| **10.3.2** | Vérifiez que le serveur de ressources applique les décisions d'autorisation en fonction des déclarations du jeton d'accès définissant l'autorisation déléguée. Si des déclarations telles que « sub », « scope » et « authorization_details » sont présentes, elles doivent être prises en compte dans la décision. | 2 | +| **10.3.3** | Vérifiez que si une décision de contrôle d'accès nécessite l'identification d'un utilisateur unique à partir d'un jeton d'accès (JWT ou réponse d'introspection de jeton associé), le serveur de ressources identifie l'utilisateur à partir de déclarations non ré attribuables à d'autres utilisateurs. En général, cela implique l'utilisation d'une combinaison de déclarations « iss » et « sub ». | 2 | +| **10.3.4** | Si le serveur de ressources requiert une force d'authentification, des méthodes ou une date d'expiration spécifiques, vérifiez que le jeton d'accès présenté respecte ces contraintes. Par exemple, s'il est présent, utilisez les déclarations OIDC « acr », « amr » et « auth_time » respectivement. | 2 | +| **10.3.5** | Vérifiez que le serveur de ressources empêche l'utilisation de jetons d'accès volés ou la relecture de jetons d'accès (de parties non autorisées) en exigeant des jetons d'accès limités par l'expéditeur, soit Mutual TLS pour OAuth 2, soit OAuth 2 Demonstration of Proof of Possession (DPoP). | 3 | + +## V10.4 Serveur d'autorisation OAuth + +Ces exigences détaillent les responsabilités des serveurs d’autorisation OAuth, y compris les fournisseurs OpenID. + +Pour l'authentification client, la méthode « self_signed_tls_client_auth » est autorisée avec les prérequis requis par la [section 2.2](https://datatracker.ietf.org/doc/html/rfc8705#name-self-signed-certificate-mut) de la [RFC 8705](https://datatracker.ietf.org/doc/html/rfc8705). + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **10.4.1** | Vérifiez que le serveur d'autorisation valide les URI de redirection en fonction d'une liste d'autorisation spécifique au client d'URI préenregistrés à l'aide d'une comparaison de chaînes exacte. | 1 | +| **10.4.2** | Vérifiez que, si le serveur d'autorisation renvoie le code d'autorisation dans la réponse, celui-ci ne peut être utilisé qu'une seule fois pour une demande de jeton. Pour la deuxième demande valide avec un code d'autorisation déjà utilisé pour émettre un jeton d'accès, le serveur d'autorisation doit rejeter la demande de jeton et révoquer tous les jetons émis liés au code d'autorisation. | 1 | +| **10.4.3** | Vérifiez que le code d'autorisation est de courte durée. La durée de vie maximale peut atteindre 10 minutes pour les applications L1 et L2 et 1 minute pour les applications L3. | 1 | +| **10.4.4** | Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement l'utilisation des autorisations nécessaires à ce client. Notez que les autorisations « token » (flux implicite) et « password » (flux d'informations d'identification du propriétaire de la ressource) ne doivent plus être utilisées. | 1 | +| **10.4.5** | Vérifiez que le serveur d'autorisation atténue les attaques par rejeu de jetons d'actualisation pour les clients publics, de préférence en utilisant des jetons d'actualisation limités par l'expéditeur, par exemple des jetons DPoP (Demonstrating Proof of Possession) ou des jetons d'accès liés à un certificat utilisant le protocole TLS mutuel (mTLS). Pour les applications L1 et L2, la rotation des jetons d'actualisation peut être utilisée. Si cette rotation est utilisée, le serveur d'autorisation doit invalider le jeton d'actualisation après utilisation et révoquer tous les jetons d'actualisation de cette autorisation si un jeton d'actualisation déjà utilisé et invalidé est fourni. | 1 | +| **10.4.6** | Vérifiez que, si l'octroi de code est utilisé, le serveur d'autorisation atténue les attaques par interception de code en exigeant une clé de preuve pour l'échange de code (PKCE). Pour les demandes d'autorisation, le serveur d'autorisation doit exiger une valeur « code_challenge » valide et ne doit pas accepter une valeur « plain » pour « code_challenge_method ». Pour une demande de jeton, il doit exiger la validation du paramètre « code_verifier ». | 2 | +| **10.4.7** | Vérifiez que si le serveur d'autorisation prend en charge l'enregistrement dynamique des clients non authentifiés, il réduit le risque d'applications clientes malveillantes. Il doit valider les métadonnées clientes, telles que les URI enregistrés, garantir le consentement de l'utilisateur et l'avertir avant de traiter une demande d'autorisation avec une application cliente non approuvée. | 2 | +| **10.4.8** | Vérifiez que les jetons d’actualisation ont une expiration absolue, y compris si l’expiration du jeton d’actualisation glissant est appliquée. | 2 | +| **10.4.9** | Vérifiez que les jetons d'actualisation et les jetons d'accès de référence peuvent être révoqués par un utilisateur autorisé à l'aide de l'interface utilisateur du serveur d'autorisation, afin d'atténuer le risque de clients malveillants ou de jetons volés. | 2 | +| **10.4.10** | Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton. | 2 | +| **10.4.11** | Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton. | 2 | +| **10.4.12** | Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement la valeur « response_mode » dont ce client a besoin. Par exemple, en vérifiant cette valeur par rapport aux valeurs attendues ou en utilisant une requête d'autorisation poussée (PAR) ou une requête d'autorisation sécurisée par JWT (JAR). | 3 | +| **10.4.13** | Vérifiez que le type d'Autorisation « code » est toujours utilisé avec les demandes d'autorisation poussées (PAR). | 3 | +| **10.4.14** | Vérifiez que le serveur d'autorisation émet uniquement des jetons d'accès limités à l'expéditeur (preuve de possession), soit avec des jetons d'accès liés au certificat utilisant TLS mutuel (mTLS), soit avec des jetons d'accès liés au DPoP (démonstration de preuve de possession). | 3 | +| **10.4.15** | Vérifiez que, pour un client côté serveur (non exécuté sur l'appareil de l'utilisateur final), le serveur d'autorisation garantit que la valeur du paramètre « authorization_details » provient du backend client et que l'utilisateur ne l'a pas altérée. Par exemple, en exigeant l'utilisation d'une demande d'autorisation poussée (PAR) ou d'une demande d'autorisation sécurisée par JWT (JAR). | 3 | +| **10.4.16** | Vérifiez que le client est confidentiel et que le serveur d'autorisation requiert l'utilisation de méthodes d'authentification client fortes (basées sur la cryptographie à clé publique et résistantes aux attaques par relecture), telles que TLS mutuel ('tls_client_auth', 'self_signed_tls_client_auth') ou JWT à clé privée ('private_key_jwt'). | 3 | + +## V10.5 Client OIDC + +Étant donné que la partie utilisatrice d'OIDC agit en tant que client OAuth, les exigences de la section « Client OAuth » s'appliquent également. + +Notez que la section « Authentification avec un fournisseur d’identité » du chapitre « Authentification » contient également des exigences générales pertinentes. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **10.5.1** | Vérifiez que le client (en tant que partie utilisatrice) atténue les attaques par rejeu de jeton d'identification. Par exemple, en vous assurant que la valeur « nonce » du jeton d'identification correspond à la valeur « nonce » envoyée dans la demande d'authentification au fournisseur OpenID (appelée demande d'autorisation envoyée au serveur d'autorisation dans OAuth2). | 2 | +| **10.5.2** | Vérifiez que le client identifie de manière unique l'utilisateur à partir des déclarations de jeton d'identification, généralement la déclaration « sub », qui ne peut pas être réaffectée à d'autres utilisateurs (pour la portée d'un fournisseur d'identité). | 2 | +| **10.5.3** | Vérifiez que le client rejette les tentatives d'un serveur d'autorisation malveillant d'usurper l'identité d'un autre serveur d'autorisation via ses métadonnées. Le client doit rejeter les métadonnées du serveur d'autorisation si l'URL de l'émetteur figurant dans ces métadonnées ne correspond pas exactement à l'URL d'émetteur préconfigurée attendue par le client. | 2 | +| **10.5.4** | Vérifiez que le client valide que le jeton d'identification est destiné à être utilisé pour ce client (audience) en vérifiant que la déclaration « aud » du jeton est égale à la valeur « client_id » pour le client. | 2 | +| **10.5.5** | Vérifiez que, lors de l'utilisation de la déconnexion du back-channel OIDC, la partie utilisatrice atténue les risques de déni de service liés à la déconnexion forcée et à la confusion entre JWT dans le flux de déconnexion. Le client doit vérifier que le jeton de déconnexion est correctement typé avec la valeur « logout+jwt », qu'il contient la déclaration « event » avec le nom de membre correct et qu'il ne contient pas de déclaration « nonce ». Il est également recommandé d'utiliser une expiration courte (par exemple, 2 minutes). | 2 | + +## V10.6 Fournisseur OpenID + +Étant donné que les fournisseurs OpenID agissent comme des serveurs d'autorisation OAuth, les exigences de la section « Serveur d'autorisation OAuth » s'appliquent également. + +Notez que si vous utilisez le flux de jeton d'identification (et non le flux de code), aucun jeton d'accès n'est émis et de nombreuses exigences pour OAuth AS ne sont pas applicables. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **10.6.1** | Vérifiez que le fournisseur OpenID n'autorise que les valeurs « code », « ciba », « id_token » ou « id_token code » pour le mode de réponse. Notez que « code » est préférable à « id_token code » (flux hybride OIDC) et que « token » (tout flux implicite) ne doit pas être utilisé. | 2 | +| **10.6.2** | Vérifiez que le fournisseur OpenID atténue les risques de déni de service liés à la déconnexion forcée. Pour ce faire, obtenez une confirmation explicite de l'utilisateur final ou, le cas échéant, validez les paramètres de la requête de déconnexion (initiée par la partie utilisatrice), comme « id_token_hint ». | 2 | + +## V10.7 Gestion du consentement + +Ces exigences couvrent la vérification du consentement de l'utilisateur par le serveur d'autorisation. Sans vérification appropriée du consentement de l'utilisateur, un acteur malveillant peut obtenir des autorisations au nom de l'utilisateur par usurpation d'identité ou ingénierie sociale. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **10.7.1** | Vérifiez que le serveur d'autorisation garantit le consentement de l'utilisateur à chaque demande d'autorisation. Si l'identité du client ne peut être garantie, le serveur d'autorisation doit toujours demander explicitement le consentement de l'utilisateur. | 2 | +| **10.7.2** | Vérifiez que lorsque le serveur d'autorisation demande le consentement de l'utilisateur, il fournit des informations claires et suffisantes sur ce qui est consenti. Le cas échéant, ces informations doivent inclure la nature des autorisations demandées (généralement en fonction de la portée, du serveur de ressources et des détails d'autorisation RAR), l'identité de l'application autorisée et la durée de vie de ces autorisations. | 2 | +| **10.7.3** | Vérifiez que l’utilisateur peut consulter, modifier et révoquer les consentements qu’il a accordés via le serveur d’autorisation. | 2 | + +## Références + +Pour plus d'informations, voir également : + +* [oauth.net](https://oauth.net/) +* [OWASP OAuth 2.0 Protocol Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/OAuth2_Cheat_Sheet.html) + +Pour les exigences liées à OAuth dans ASVS, les RFC publiées et à l'état de projet suivantes sont utilisées : + +* [RFC6749 The OAuth 2.0 Authorization Framework](https://datatracker.ietf.org/doc/html/rfc6749) +* [RFC6750 The OAuth 2.0 Authorization Framework: Bearer Token Usage](https://datatracker.ietf.org/doc/html/rfc6750) +* [RFC6819 OAuth 2.0 Threat Model and Security Considerations](https://datatracker.ietf.org/doc/html/rfc6819) +* [RFC7636 Proof Key for Code Exchange by OAuth Public Clients](https://datatracker.ietf.org/doc/html/rfc7636) +* [RFC7591 OAuth 2.0 Dynamic Client Registration Protocol](https://datatracker.ietf.org/doc/html/rfc7591) +* [RFC8628 OAuth 2.0 Device Authorization Grant](https://datatracker.ietf.org/doc/html/rfc8628) +* [RFC8707 Resource Indicators for OAuth 2.0](https://datatracker.ietf.org/doc/html/rfc8707) +* [RFC9068 JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens](https://datatracker.ietf.org/doc/html/rfc9068) +* [RFC9126 OAuth 2.0 Pushed Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9126) +* [RFC9207 OAuth 2.0 Authorization Server Issuer Identification](https://datatracker.ietf.org/doc/html/rfc9207) +* [RFC9396 OAuth 2.0 Rich Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9396) +* [RFC9449 OAuth 2.0 Demonstrating Proof of Possession (DPoP)](https://datatracker.ietf.org/doc/html/rfc9449) +* [RFC9700 Best Current Practice for OAuth 2.0 Security](https://datatracker.ietf.org/doc/html/rfc9700) +* [draft OAuth 2.0 for Browser-Based Applications](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-browser-based-apps) +* [draft The OAuth 2.1 Authorization Framework](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-12) + +Pour plus d'informations sur OpenID Connect, veuillez consulter : + +* [OpenID Connect Core 1.0](https://openid.net/specs/openid-connect-core-1_0.html) +* [FAPI 2.0 Security Profile](https://openid.net/specs/fapi-security-profile-2_0-final.html) diff --git a/5.0/fr/0x20-V11-Cryptography.md b/5.0/fr/0x20-V11-Cryptography.md new file mode 100644 index 0000000000..033da4784a --- /dev/null +++ b/5.0/fr/0x20-V11-Cryptography.md @@ -0,0 +1,107 @@ +# V11 Cryptographie + +## Objectif de contrôle + +L'objectif de ce chapitre est de définir les meilleures pratiques pour l'utilisation générale de la cryptographie, ainsi que d'inculquer une compréhension fondamentale des principes cryptographiques et d'encourager une évolution vers des approches plus résilientes et modernes. Il encourage les actions suivantes : + +* Mise en œuvre de systèmes cryptographiques robustes, sécurisés, adaptables à l'évolution des menaces et pérennes. +* Utilisation de mécanismes cryptographiques sécurisés et conformes aux meilleures pratiques du secteur. +* Maintien d'un système de gestion des clés cryptographiques sécurisé, avec des contrôles d'accès et des audits appropriés. +* Évaluation régulière du paysage cryptographique pour identifier les nouveaux risques et adapter les algorithmes en conséquence. +* Identification et gestion des cas d'utilisation cryptographiques tout au long du cycle de vie de l'application afin de garantir la prise en compte et la sécurité de tous les actifs cryptographiques. + +Outre les principes généraux et les bonnes pratiques, ce document fournit également des informations techniques plus détaillées sur les exigences de l'annexe V – Normes de cryptographie. Cela inclut les algorithmes et les modes considérés comme « approuvés » aux fins des exigences de ce chapitre. + +Les exigences qui utilisent la cryptographie pour résoudre un problème distinct, comme la gestion des secrets ou la sécurité des communications, figureront dans différentes parties de la norme. + +## V11.1 Inventaire et documentation cryptographiques + +Les applications doivent être conçues avec une architecture cryptographique robuste afin de protéger les données selon leur classification. Chiffrer tout est un gaspillage ; ne rien chiffrer est une négligence juridique. Un équilibre doit être trouvé, généralement lors de la conception architecturale ou de haut niveau, des sprints de conception ou des pics d'architecture. Concevoir la cryptographie au fur et à mesure ou la moderniser coûtera inévitablement beaucoup plus cher à mettre en œuvre de manière sécurisée que de l'intégrer dès le départ. + +Il est important de veiller à ce que tous les actifs cryptographiques soient régulièrement découverts, inventoriés et évalués. Veuillez consulter l'annexe pour plus d'informations sur la procédure à suivre. + +Il est également crucial de pérenniser les systèmes cryptographiques face à l'essor futur de l'informatique quantique. La cryptographie post-quantique (PQC) désigne les algorithmes cryptographiques conçus pour résister aux attaques des ordinateurs quantiques, qui sont susceptibles de casser des algorithmes largement utilisés tels que RSA et la cryptographie à courbe elliptique (ECC). + +Veuillez consulter l'annexe pour obtenir des conseils actualisés sur les primitives et les normes PQC approuvées. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **11.1.1** | Vérifiez qu’il existe une politique documentée pour la gestion des clés cryptographiques et un cycle de vie des clés cryptographiques qui suit une norme de gestion des clés telle que NIST SP 800-57. Cela devrait inclure la garantie que les clés ne sont pas sur-partagées (par exemple, avec plus de deux entités pour les secrets partagés et plus d’une entité pour les clés privées). | 2 | +| **11.1.2** | Vérifiez qu'un inventaire cryptographique est réalisé, maintenu et régulièrement mis à jour, et qu'il inclut toutes les clés, algorithmes et certificats cryptographiques utilisés par l'application. Il doit également documenter les emplacements du système où les clés peuvent ou non être utilisées, ainsi que les types de données qui peuvent ou non être protégées par ces clés. | 2 | +| **11.1.3** | Vérifiez que les mécanismes de découverte cryptographique sont utilisés pour identifier toutes les instances de cryptographie dans le système, y compris les opérations de chiffrement, de hachage et de signature. | 3 | +| **11.1.4** | Vérifier la tenue d'un inventaire cryptographique. Celui-ci doit inclure un plan documenté décrivant la migration vers de nouvelles normes cryptographiques, telles que la cryptographie post-quantique, afin de réagir aux menaces futures. | 3 | + +## V11.2 Mise en œuvre sécurisée de la cryptographie + +Cette section définit les exigences relatives à la sélection, à la mise en œuvre et à la gestion continue des algorithmes cryptographiques de base d'une application. L'objectif est de garantir que seules des primitives cryptographiques robustes et reconnues par l'industrie soient déployées, conformément aux normes en vigueur (par exemple, NIST, ISO/IEC) et aux meilleures pratiques. Les organisations doivent s'assurer que chaque composant cryptographique est sélectionné sur la base de preuves validées par des pairs et de tests de sécurité pratiques. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **11.2.1** | Vérifiez que les implémentations validées par l’industrie (y compris les bibliothèques et les implémentations accélérées par le matériel) sont utilisées pour les opérations cryptographiques. | 2 | +| **11.2.2** | Vérifiez que l'application est conçue avec une agilité cryptographique, de sorte que les nombres aléatoires, le chiffrement authentifié, le MAC ou les algorithmes de hachage, les longueurs de clés, les tours, les chiffrements et les modes puissent être reconfigurés, mis à niveau ou échangés à tout moment, afin de se protéger contre les failles cryptographiques. De même, il doit être possible de remplacer les clés et les mots de passe, ainsi que de rechiffrer les données. Cela permettra des mises à niveau transparentes vers la cryptographie post-quantique (PQC), une fois que des implémentations hautement sécurisées de schémas ou de normes PQC approuvés seront largement disponibles. | 2 | +| **11.2.3** | Vérifiez que toutes les primitives cryptographiques utilisent un minimum de 128 bits de sécurité en fonction de l'algorithme, de la taille de la clé et de la configuration. Par exemple, une clé ECC de 256 bits offre environ 128 bits de sécurité, tandis que RSA nécessite une clé de 3072 bits pour atteindre 128 bits de sécurité. | 2 | +| **11.2.4** | Vérifiez que toutes les opérations cryptographiques sont à temps constant, sans opérations de « court-circuit » dans les comparaisons, les calculs ou les retours, pour éviter toute fuite d'informations. | 3 | +| **11.2.5** | Vérifiez que tous les modules cryptographiques échouent en toute sécurité et que les erreurs sont gérées de manière à ne pas permettre de vulnérabilités, telles que les attaques Padding Oracle. | 3 | + +## V11.3 Algorithmes de chiffrement + +Les algorithmes de chiffrement authentifiés basés sur AES et CHACHA20 constituent l’épine dorsale de la pratique cryptographique moderne. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **11.3.1** | Vérifiez que les modes de bloc non sécurisés (par exemple, ECB) et les schémas de remplissage faibles (par exemple, PKCS#1 v1.5) ne sont pas utilisés. | 1 | +| **11.3.2** | Vérifiez que seuls les chiffrements et modes approuvés tels que AES avec GCM sont utilisés. | 1 | +| **11.3.3** | Vérifiez que les données chiffrées sont protégées contre toute modification non autorisée, de préférence en utilisant une méthode de chiffrement authentifiée approuvée ou en combinant une méthode de chiffrement approuvée avec un algorithme MAC approuvé. | 2 | +| **11.3.4** | Vérifiez que les nonces, les vecteurs d'initialisation et autres nombres à usage unique ne sont pas utilisés pour plus d'une paire clé de chiffrement/élément de données. La méthode de génération doit être adaptée à l'algorithme utilisé. | 3 | +| **11.3.5** | Vérifiez que toute combinaison d'un algorithme de chiffrement et d'un algorithme MAC fonctionne en mode chiffrement puis MAC. | 3 | + +## V11.4 Hachage et fonctions basées sur le hachage + +Les hachages cryptographiques sont utilisés dans une grande variété de protocoles cryptographiques, tels que les signatures numériques, HMAC, les fonctions de dérivation de clés (KDF), la génération de bits aléatoires et le stockage de mots de passe. La sécurité d'un système cryptographique dépend des fonctions de hachage sous-jacentes utilisées. Cette section décrit les exigences relatives à l'utilisation de fonctions de hachage sécurisées dans les opérations cryptographiques. + +Pour le stockage des mots de passe, ainsi que pour l'annexe sur la cryptographie, la [OWASP Password Storage Cheatsheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#password-hashing-algorithms) fournira également un contexte et des conseils utiles. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **11.4.1** | Vérifiez que seules les fonctions de hachage approuvées sont utilisées pour les cas d'utilisation cryptographiques généraux, notamment les signatures numériques, HMAC, KDF et la génération de bits aléatoires. Les fonctions de hachage non autorisées, telles que MD5, ne doivent pas être utilisées à des fins cryptographiques. | 1 | +| **11.4.2** | Vérifiez que les mots de passe sont stockés à l'aide d'une fonction de dérivation de clés approuvée et gourmande en ressources de calcul (également appelée « fonction de hachage de mots de passe »), dont les paramètres sont configurés conformément aux directives en vigueur. Ces paramètres doivent équilibrer sécurité et performances afin de rendre les attaques par force brute suffisamment difficiles pour le niveau de sécurité requis. | 2 | +| **11.4.3** | Vérifiez que les fonctions de hachage utilisées dans les signatures numériques, dans le cadre de l'authentification ou de l'intégrité des données, sont résistantes aux collisions et possèdent des longueurs de bits appropriées. Si la résistance aux collisions est requise, la longueur de sortie doit être d'au moins 256 bits. Si seule la résistance aux attaques de seconde pré-image est requise, la longueur de sortie doit être d'au moins 128 bits. | 2 | +| **11.4.4** | Vérifiez que l'application utilise des fonctions de dérivation de clés approuvées avec des paramètres d'extension de clés lors de la dérivation de clés secrètes à partir de mots de passe. Les paramètres utilisés doivent concilier sécurité et performances afin d'empêcher les attaques par force brute de compromettre la clé cryptographique obtenue. | 2 | + +## V11.5 Valeurs aléatoires + +La génération de nombres pseudo-aléatoires cryptographiquement sécurisée (CSPRNG) est extrêmement difficile à mettre en œuvre. En général, les bonnes sources d'entropie d'un système s'épuisent rapidement si elles sont surexploitées, tandis que des sources moins aléatoires peuvent conduire à des clés et des secrets prévisibles. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **11.5.1** | Vérifiez que tous les nombres et chaînes aléatoires destinés à être non devinables doivent être générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et posséder au moins 128 bits d'entropie. Notez que les UUID ne respectent pas cette condition. | 2 | +| **11.5.2** | Vérifiez que le mécanisme de génération de nombres aléatoires utilisé est conçu pour fonctionner en toute sécurité, même en cas de forte demande. | 3 | + +## V11.6 Cryptographie à clé publique + +La cryptographie à clé publique sera utilisée lorsqu'il est impossible ou non souhaitable de partager une clé secrète entre plusieurs parties. + +Dans ce contexte, des mécanismes d'échange de clés approuvés, tels que Diffie-Hellman et Elliptic Curve Diffie-Hellman (ECDH), sont nécessaires pour garantir la sécurité du cryptosystème face aux menaces modernes. Le chapitre « Communication sécurisée » décrit les exigences pour TLS. Les exigences de cette section sont donc destinées aux situations où la cryptographie à clé publique est utilisée dans des cas d'utilisation autres que TLS. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **11.6.1** | Vérifier que seuls des algorithmes cryptographiques et des modes opératoires approuvés sont utilisés pour la génération et l'amorçage des clés, ainsi que pour la génération et la vérification des signatures numériques. Les algorithmes de génération de clés ne doivent pas générer de clés non sécurisées et vulnérables aux attaques connues, par exemple les clés RSA vulnérables à la factorisation de Fermat. | 2 | +| **11.6.2** | Vérifiez que des algorithmes cryptographiques approuvés sont utilisés pour l'échange de clés (tels que Diffie-Hellman), en veillant à ce que les mécanismes d'échange de clés utilisent des paramètres sécurisés. Cela permettra d'éviter les attaques contre le processus d'établissement des clés, susceptibles de conduire à des attaques de type « adversaire du milieu » ou à des failles cryptographiques. | 3 | + +## V11.7 Cryptographie des données en cours d'utilisation + +La protection des données pendant leur traitement est "le nec plus ultra". Des techniques telles que le chiffrement intégral de la mémoire, le chiffrement des données en transit et s'assurer que le les données sont chiffrés le plus tôt possible après utilisation. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **11.7.1** | Vérifiez que le chiffrement complet de la mémoire est utilisé pour protéger les données sensibles pendant leur utilisation, empêchant ainsi l'accès par des utilisateurs ou des processus non autorisés. | 3 | +| **11.7.2** | Vérifiez que la minimisation des données garantit que la quantité minimale de données est exposée pendant le traitement et assurez-vous que les données sont chiffrées immédiatement après utilisation ou dès que possible. | 3 | + +## Références + +Pour plus d'informations, voir également : + +* [OWASP Web Security Testing Guide: Testing for Weak Cryptography](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography) +* [OWASP Cryptographic Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html) +* [FIPS 140-3](https://csrc.nist.gov/pubs/fips/140-3/final) +* [NIST SP 800-57](https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final) diff --git a/5.0/fr/0x21-V12-Secure-Communication.md b/5.0/fr/0x21-V12-Secure-Communication.md new file mode 100644 index 0000000000..a2555e4ea7 --- /dev/null +++ b/5.0/fr/0x21-V12-Secure-Communication.md @@ -0,0 +1,57 @@ +# V12 Communication sécurisée + +## Objectif de contrôle + +Ce chapitre comprend des exigences relatives aux mécanismes spécifiques qui doivent être mis en place pour protéger les données en transit, à la fois entre un client utilisateur final et un service backend, ainsi qu'entre les services internes et backend. + +Les concepts généraux promus par ce chapitre sont les suivants + +* S'assurer que les communications sont chiffrées à l'extérieur et, idéalement, à l'intérieur. +* Configurer les mécanismes de chiffrement en utilisant les dernières recommandations, y compris les algorithmes et les chiffrements préférés. +* S'assurer que les communications ne sont pas interceptées par des parties non autorisées à l'aide de certificats signés. + +Outre les principes généraux et les meilleures pratiques, l'ASVS fournit également des informations techniques plus approfondies sur la puissance cryptographique dans l'annexe C - Normes de cryptographie. + +## V12.1 Conseils généraux de sécurité TLS + +Cette section fournit des conseils initiaux sur la sécurisation des communications TLS. Des outils à jour doivent être utilisés pour vérifier régulièrement la configuration TLS. + +Bien que l'utilisation de certificats TLS génériques ne soit pas intrinsèquement dangereuse, la compromission d'un certificat déployé dans tous les environnements (par exemple, production, préproduction, développement et test) peut compromettre la sécurité des applications qui l'utilisent. Une protection et une gestion appropriées, ainsi que l'utilisation de certificats TLS distincts dans différents environnements, sont recommandées si possible. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **12.1.1** | Vérifiez que seules les dernières versions recommandées du protocole TLS sont activées, telles que TLS 1.2 et TLS 1.3. La dernière version du protocole TLS doit être privilégiée. | 1 | +| **12.1.2** | Vérifiez que seules les suites de chiffrement recommandées sont activées, les suites de chiffrement les plus puissantes étant définies comme préférées. Les applications L3 doivent uniquement prendre en charge les suites de chiffrement assurant la confidentialité persistante (forward secrecy). | 2 | +| **12.1.3** | Vérifiez que l’application valide que les certificats clients mTLS sont approuvés avant d’utiliser l’identité du certificat pour l’authentification ou l’autorisation. | 2 | +| **12.1.4** | Vérifiez que la révocation de certification appropriée, telle que l'agrafage du protocole OCSP (Online Certificate Status Protocol), est activée et configurée. | 3 | +| **12.1.5** | Vérifiez que Encrypted Client Hello (ECH) est activé dans les paramètres TLS de l'application pour empêcher l'exposition de métadonnées sensibles, telles que l'indication du nom du serveur (SNI), pendant les processus de négociation TLS. | 3 | + +## V12.2 Communication HTTPS avec des services externes + +Assurez-vous que tout le trafic HTTP vers les services externes exposés par l'application est envoyé chiffré, avec des certificats de confiance publique. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **12.2.1** | Vérifiez que TLS est utilisé pour toute connectivité entre un client et des services externes basés sur HTTP, et ne recourt pas à des communications non sécurisées ou non chiffrées. | 1 | +| **12.2.2** | Vérifiez que les services externes utilisent des certificats TLS publiquement approuvés. | 1 | + +## V12.3 Sécurité des communications entre services généraux + +Les communications serveur (internes et externes) ne se limitent pas au protocole HTTP. Les connexions vers et depuis d'autres systèmes doivent également être sécurisées, idéalement via TLS. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **12.3.1** | Vérifiez qu'un protocole chiffré tel que TLS est utilisé pour toutes les connexions entrantes et sortantes vers et depuis l'application, y compris les systèmes de surveillance, les outils de gestion, l'accès à distance et SSH, les intergiciels, les bases de données, les mainframes, les systèmes partenaires ou les API externes. Le serveur ne doit pas recourir à des protocoles non sécurisés ou non chiffrés. | 2 | +| **12.3.2** | Vérifiez que les clients TLS valident les certificats reçus avant de communiquer avec un serveur TLS. | 2 | +| **12.3.3** | Vérifiez que TLS ou un autre mécanisme de chiffrement de transport approprié est utilisé pour toute connectivité entre les services internes basés sur HTTP au sein de l'application et ne se replie pas vers des communications non sécurisées ou non chiffrées. | 2 | +| **12.3.4** | Vérifiez que les connexions TLS entre les services internes utilisent des certificats de confiance. Lorsque des certificats générés en interne ou auto-signés sont utilisés, le service consommateur doit être configuré pour n'approuver que des autorités de certification internes spécifiques et des certificats auto-signés spécifiques. | 2 | +| **12.3.5** | Vérifiez que les services communiquant en interne au sein d'un système (communications intra-services) utilisent une authentification forte pour garantir la vérification de chaque endpoint. Des méthodes d'authentification forte, telles que l'authentification client TLS, doivent être utilisées pour garantir l'identité, en utilisant une infrastructure à clé publique et des mécanismes résistants aux attaques par rejeu. Pour les architectures de microservices, envisagez d'utiliser un maillage de services pour simplifier la gestion des certificats et renforcer la sécurité. | 3 | + +## Références + +Pour plus d'informations, voir également : + +* [OWASP - Transport Layer Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html) +* [Mozilla's Server Side TLS configuration guide](https://wiki.mozilla.org/Security/Server_Side_TLS) +* [Mozilla's tool to generate known good TLS configurations](https://ssl-config.mozilla.org/). +* [O-Saft - OWASP Project to validate TLS configuration](https://owasp.org/www-project-o-saft/) diff --git a/5.0/fr/0x22-V13-Configuration.md b/5.0/fr/0x22-V13-Configuration.md new file mode 100644 index 0000000000..7ff625280d --- /dev/null +++ b/5.0/fr/0x22-V13-Configuration.md @@ -0,0 +1,68 @@ +# V13 Configuration + +## Objectif de contrôle + +La configuration par défaut de l'application doit être sécurisée pour une utilisation sur Internet. + +Ce chapitre fournit des conseils sur les différentes configurations nécessaires pour y parvenir, y compris celles appliquées pendant le développement, la construction et le déploiement. + +Les sujets abordés incluent la prévention des fuites de données, la gestion sécurisée des communications entre les composants et la protection des secrets. + +## V13.1 Documentation de configuration + +Cette section décrit les exigences de documentation relatives à la communication de l'application avec les services internes et externes, ainsi que les techniques permettant d'éviter toute perte de disponibilité due à l'inaccessibilité des services. Elle aborde également la documentation relative aux secrets. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **13.1.1** | Vérifiez que tous les besoins de communication de l'application sont documentés. Cela doit inclure les services externes dont l'application dépend et les cas où un utilisateur final pourrait fournir un emplacement externe auquel l'application se connectera. | 2 | +| **13.1.2** | Vérifiez que pour chaque service utilisé par l'application, la documentation définit le nombre maximal de connexions simultanées (par exemple, les limites du pool de connexions) et le comportement de l'application lorsque cette limite est atteinte, y compris les mécanismes de secours ou de récupération, pour éviter les conditions de déni de service. | 3 | +| **13.1.3** | Vérifiez que la documentation de l'application définit des stratégies de gestion des ressources pour chaque système ou service externe utilisé (par exemple, bases de données, descripteurs de fichiers, threads, connexions HTTP). Cela doit inclure les procédures de libération des ressources, les paramètres de délai d'expiration, la gestion des échecs et l'implémentation de la logique de nouvelle tentative, en spécifiant les limites de nouvelle tentative, les délais et les algorithmes de retour arrière. Pour les opérations de requête-réponse HTTP synchrones, la documentation doit imposer des délais d'expiration courts et soit désactiver les nouvelles tentatives, soit les limiter strictement afin d'éviter les retards en cascade et l'épuisement des ressources. | 3 | +| **13.1.4** | Vérifiez que la documentation de l'application définit les secrets essentiels à la sécurité de l'application et un calendrier de rotation de ceux-ci, en fonction du modèle de menace et des exigences commerciales de l'organisation. | 3 | + +## V13.2 Configuration de la communication backend + +Les applications interagissent avec plusieurs services, notamment des API, des bases de données ou d'autres composants. Ceux-ci peuvent être considérés comme internes à l'application, mais non inclus dans les mécanismes de contrôle d'accès standard de l'application, ou être entièrement externes. Dans les deux cas, il est nécessaire de configurer l'application pour interagir en toute sécurité avec ces composants et, si nécessaire, de protéger cette configuration. + +Remarque : le chapitre « Communication sécurisée » fournit des conseils pour le chiffrement en transit. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **13.2.1** | Vérifiez que les communications entre les composants de l'application backend qui ne prennent pas en charge le mécanisme de session utilisateur standard de l'application, notamment les API, les intergiciels et les couches de données, sont authentifiées. L'authentification doit utiliser des comptes de service individuels, des jetons à court terme ou une authentification par certificat, et non des identifiants immuables tels que des mots de passe, des clés API ou des comptes partagés avec accès privilégié. | 2 | +| **13.2.2** | Vérifiez que les communications entre les composants de l'application backend, y compris les services locaux ou du système d'exploitation, les API, les intergiciels et les couches de données, sont effectuées avec des comptes dotés des privilèges les moins nécessaires. | 2 | +| **13.2.3** | Vérifiez que si des informations d’identification doivent être utilisées pour l’authentification du service, les informations d’identification utilisées par le consommateur ne sont pas des informations d’identification par défaut (par exemple, root/root ou admin/admin). | 2 | +| **13.2.4** | Vérifiez qu'une liste d’autorisations est utilisée pour définir les ressources ou systèmes externes avec lesquels l'application est autorisée à communiquer (par exemple, pour les requêtes sortantes, les chargements de données ou l'accès aux fichiers). Cette liste d'autorisation peut être implémentée au niveau de la couche applicative, du serveur web, du pare-feu ou d'une combinaison de différentes couches. | 2 | +| **13.2.5** | Vérifiez que le serveur Web ou d’application est configuré avec une liste autorisée de ressources ou de systèmes vers lesquels le serveur peut envoyer des requêtes ou charger des données ou des fichiers. | 2 | +| **13.2.6** | Vérifiez que lorsque l'application se connecte à des services distincts, elle suit la configuration documentée pour chaque connexion, comme le nombre maximal de connexions parallèles, le comportement lorsque le nombre maximal de connexions autorisées est atteint, les délais d'expiration de connexion et les stratégies de nouvelle tentative. | 3 | + +## V13.3 Gestion des secrets + +La gestion des secrets est une tâche de configuration essentielle pour garantir la protection des données utilisées dans l'application. Les exigences spécifiques en matière de cryptographie sont décrites dans le chapitre « Cryptographie », mais cette section se concentre sur les aspects de gestion et de traitement des secrets. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **13.3.1** | Vérifiez qu'une solution de gestion des secrets, telle qu'un coffre-fort de clés, est utilisée pour créer, stocker, contrôler l'accès et détruire en toute sécurité les secrets backend. Ceux-ci peuvent inclure des mots de passe, du matériel de clé, des intégrations avec des bases de données et des systèmes tiers, des clés et des graines pour des jetons temporels, d'autres secrets internes et des clés API. Les secrets ne doivent pas être inclus dans le code source de l'application ni dans les artefacts de build. Pour une application L3, cela doit impliquer une solution matérielle telle qu'un HSM. | 2 | +| **13.3.2** | Vérifiez que l’accès aux ressources secrètes respecte le principe du moindre privilège. | 2 | +| **13.3.3** | Vérifiez que toutes les opérations cryptographiques sont effectuées à l'aide d'un module de sécurité isolé (tel qu'un coffre-fort ou un module de sécurité matériel) pour gérer et protéger en toute sécurité le matériel clé contre toute exposition en dehors du module de sécurité. | 3 | +| **13.3.4** | Vérifiez que les secrets sont configurés pour expirer et être renouvelés en fonction de la documentation de l'application. | 3 | + +## V13.4 Fuite d'informations involontaire + +Les configurations de production doivent être renforcées afin d'éviter la divulgation de données inutiles. Nombre de ces problèmes sont rarement considérés comme des risques importants, mais sont souvent associés à d'autres vulnérabilités. Si ces problèmes ne sont pas présents par défaut, la barre est plus haute pour les attaques contre une application. + +Par exemple, masquer la version des composants côté serveur n'élimine pas la nécessité de corriger tous les composants, et désactiver la liste des dossiers ne supprime pas la nécessité d'utiliser des contrôles d'autorisation ou de garder les fichiers loin du dossier public, mais cela place la barre plus haut. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **13.4.1** | Vérifiez que l'application est déployée soit sans aucune métadonnée de contrôle de source, y compris les dossiers .git ou .svn, soit de manière à ce que ces dossiers soient inaccessibles à la fois en externe et à l'application elle-même. | 1 | +| **13.4.2** | Vérifiez que les modes de débogage sont désactivés pour tous les composants dans les environnements de production afin d’éviter l’exposition des fonctionnalités de débogage et la fuite d’informations. | 2 | +| **13.4.3** | Vérifiez que les serveurs Web n’exposent pas les listes de répertoires aux clients, sauf si cela est explicitement prévu. | 2 | +| **13.4.4** | Vérifiez que l’utilisation de la méthode HTTP TRACE n’est pas prise en charge dans les environnements de production, afin d’éviter toute fuite d’informations potentielle. | 2 | +| **13.4.5** | Vérifiez que la documentation (comme pour les API internes) et les endpoints de surveillance ne sont pas exposés, sauf si cela est explicitement prévu. | 2 | +| **13.4.6** | Vérifiez que l’application n’expose pas d’informations de version détaillées des composants backend. | 3 | +| **13.4.7** | Vérifiez que la couche web est configuré pour servir uniquement les fichiers avec des extensions de fichier spécifiques afin d’éviter toute fuite involontaire d’informations, de configuration et de code source. | 3 | + +## Références + +Pour plus d'informations, voir également : + +* [OWASP Web Security Testing Guide: Configuration and Deployment Management Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing) diff --git a/5.0/fr/0x23-V14-Data-Protection.md b/5.0/fr/0x23-V14-Data-Protection.md new file mode 100644 index 0000000000..b037d03866 --- /dev/null +++ b/5.0/fr/0x23-V14-Data-Protection.md @@ -0,0 +1,60 @@ +# V14 Protection des données + +## Objectif de contrôle + +Les applications ne peuvent pas prendre en compte tous les modèles d’utilisation et comportements des utilisateurs et doivent donc mettre en œuvre des contrôles pour limiter l’accès non autorisé aux données sensibles sur les appareils clients. + +Ce chapitre comprend les exigences relatives à la définition des données à protéger, de la manière dont elles doivent être protégées et des mécanismes spécifiques à mettre en œuvre ou des pièges à éviter. + +Un autre élément à prendre en compte pour la protection des données est l'extraction massive, la modification ou l'utilisation excessive. Les exigences de chaque système étant probablement très différentes, déterminer ce qui est « anormal » doit tenir compte du modèle de menace et du risque métier. Du point de vue d'ASVS, la détection de ces problèmes est traitée dans le chapitre « Journalisation de sécurité et gestion des erreurs », et la définition de limites dans le chapitre « Validation et logique métier ». + +## V14.1 Documentation sur la protection des données + +Une condition préalable essentielle à la protection des données est de catégoriser les données considérées comme sensibles. Il existe probablement plusieurs niveaux de sensibilité, et pour chaque niveau, les contrôles requis pour protéger les données seront différents. + +Il existe diverses réglementations et lois sur la confidentialité qui régissent la manière dont les applications doivent gérer le stockage, l'utilisation et la transmission des informations personnelles sensibles. Cette section ne vise plus à reproduire ces types de législation sur la protection des données ou la confidentialité, mais se concentre plutôt sur les considérations techniques clés pour la protection des données sensibles. Veuillez consulter les lois et réglementations locales et, si nécessaire, faire appel à un spécialiste de la confidentialité ou à un avocat qualifié. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **14.1.1** | Vérifiez que toutes les données sensibles créées et traitées par l'application ont été identifiées et classées selon leur niveau de protection. Cela inclut les données uniquement codées et donc facilement déchiffrables, telles que les chaînes Base64 ou la charge utile en texte clair d'un JWT. Les niveaux de protection doivent tenir compte des réglementations et normes de protection des données et de confidentialité auxquelles l'application est tenue de se conformer. | 2 | +| **14.1.2** | Vérifier que tous les niveaux de protection des données sensibles sont assortis d'un ensemble documenté d'exigences de protection. Cela doit inclure (sans s'y limiter) les exigences relatives au chiffrement général, à la vérification de l'intégrité, à la conservation, à la journalisation des données, aux contrôles d'accès aux données sensibles dans les journaux, au chiffrement au niveau de la base de données, aux technologies de confidentialité et de renforcement de la confidentialité à utiliser, ainsi qu'aux autres exigences de confidentialité. | 2 | + +## V14.2 Protection générale des données + +Cette section présente diverses exigences pratiques relatives à la protection des données. La plupart sont spécifiques à des problématiques particulières, telles que les fuites involontaires de données, mais il existe également une exigence générale de mise en œuvre de contrôles de protection en fonction du niveau de protection requis pour chaque donnée. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **14.2.1** | Vérifiez que les données sensibles sont uniquement envoyées au serveur dans les champs de corps ou d’en-tête du message HTTP, et que l’URL et la chaîne de requête ne contiennent pas d’informations sensibles, telles qu’une clé API ou un jeton de session. | 1 | +| **14.2.2** | Vérifiez que l’application empêche la mise en cache des données sensibles dans les composants du serveur, tels que les équilibreurs de charge et les caches d’application, ou garantit que les données sont purgées en toute sécurité après utilisation. | 2 | +| **14.2.3** | Vérifiez que les données sensibles définies ne sont pas envoyées à des parties non fiables (par exemple, des trackers d'utilisateurs) pour empêcher la collecte indésirable de données en dehors du contrôle de l'application. | 2 | +| **14.2.4** | Vérifiez que les contrôles autour des données sensibles liés au chiffrement, à la vérification de l'intégrité, à la conservation, à la manière dont les données doivent être enregistrées, aux contrôles d'accès autour des données sensibles dans les journaux, à la confidentialité et aux technologies d'amélioration de la confidentialité, sont mis en œuvre comme défini dans la documentation pour le niveau de protection des données spécifiques. | 2 | +| **14.2.5** | Vérifiez que les mécanismes de mise en cache sont configurés pour ne mettre en cache que les réponses dont le type de contenu est conforme à la ressource et qui ne contiennent pas de contenu sensible et dynamique. Le serveur web doit renvoyer une réponse 404 ou 302 lors de l'accès à un fichier inexistant plutôt qu'un fichier valide différent. Cela devrait empêcher les attaques par empoisonnement de cache web. | 3 | +| **14.2.6** | Vérifiez que l'application ne renvoie que les données sensibles minimales requises pour son fonctionnement. Par exemple, ne renvoyez que certains chiffres d'un numéro de carte de crédit, et non le numéro complet. Si les données complètes sont requises, elles doivent être masquées dans l'interface utilisateur, sauf si l'utilisateur les consulte spécifiquement. | 3 | +| **14.2.7** | Vérifiez que les informations sensibles sont soumises à une classification de conservation des données, en veillant à ce que les données obsolètes ou inutiles soient supprimées automatiquement, selon un calendrier défini ou selon les besoins de la situation. | 3 | +| **14.2.8** | Vérifiez que les informations sensibles sont supprimées des métadonnées des fichiers soumis par l'utilisateur, sauf si le stockage est autorisé par l'utilisateur. | 3 | + +## V14.3 Protection des données côté client + +Cette section contient des exigences empêchant la fuite de données de manière spécifique du côté client ou de l'agent utilisateur d'une application. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **14.3.1** | Vérifiez que les données authentifiées sont effacées du stockage client, comme le DOM du navigateur, après la fin du client ou de la session. Le champ d'en-tête de réponse HTTP « Clear-Site-Data » peut être utile, mais le côté client devrait également pouvoir effectuer la correction si la connexion au serveur n'est pas disponible à la fin de la session. | 1 | +| **14.3.2** | Vérifiez que l'application définit suffisamment de champs d'en-tête de réponse HTTP anti-caching (c'est-à-dire Cache-Control : no-store) afin que les données sensibles ne soient pas mises en cache dans les navigateurs. | 2 | +| **14.3.3** | Vérifiez que les données stockées dans le stockage du navigateur (telles que localStorage, sessionStorage, IndexedDB ou les cookies) ne contiennent pas de données sensibles, à l'exception des jetons de session. | 2 | + +## Références + +Pour plus d'informations, voir également : + +* [Consider using the Security Headers website to check security and anti-caching header fields](https://securityheaders.com/) +* [Documentation about anti-caching headers by Mozilla](https://developer.mozilla.org/en-US/docs/Web/HTTP/Caching) +* [OWASP Secure Headers project](https://owasp.org/www-project-secure-headers/) +* [OWASP Privacy Risks Project](https://owasp.org/www-project-top-10-privacy-risks/) +* [OWASP User Privacy Protection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/User_Privacy_Protection_Cheat_Sheet.html) +* [Australian Privacy Principle 11 - Security of personal information](https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-11-app-11-security-of-personal-information) +* [European Union General Data Protection Regulation (GDPR) overview](https://www.edps.europa.eu/data-protection_en) +* [European Union Data Protection Supervisor - Internet Privacy Engineering Network](https://www.edps.europa.eu/data-protection/ipen-internet-privacy-engineering-network_en) +* [Information on the "Clear-Site-Data" header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Clear-Site-Data) +* [White paper on Web Cache Deception](https://www.blackhat.com/docs/us-17/wednesday/us-17-Gil-Web-Cache-Deception-Attack-wp.pdf) diff --git a/5.0/fr/0x24-V15-Secure-Coding-and-Architecture.md b/5.0/fr/0x24-V15-Secure-Coding-and-Architecture.md new file mode 100644 index 0000000000..536544ca11 --- /dev/null +++ b/5.0/fr/0x24-V15-Secure-Coding-and-Architecture.md @@ -0,0 +1,77 @@ +# V15 Développement et architecture sécurisés + +## Objectif de contrôle + +De nombreuses exigences de l'ASVS se rapportent soit à un domaine particulier de la sécurité, comme l'authentification ou l'autorisation, soit à un type particulier de fonctionnalité de l'application, comme la journalisation ou la gestion des fichiers. + +Ce chapitre présente les exigences générales de sécurité à prendre en compte lors de la conception et du développement d'applications. Ces exigences portent non seulement sur la propreté de l'architecture et la qualité du code, mais aussi sur les pratiques spécifiques d'architecture et de codage nécessaires à la sécurité des applications. + +## V15.1 Documentation sur le développement et l'architecture sécurisés + +De nombreuses exigences pour établir une architecture sécurisée et défendable dépendent d’une documentation claire des décisions prises concernant la mise en œuvre de contrôles de sécurité spécifiques et des composants utilisés dans l’application. + +Cette section décrit les exigences en matière de documentation, notamment l’identification des composants considérés comme contenant des « fonctionnalités dangereuses » ou comme des « composants à risque ». + +Un composant présentant une « fonctionnalité dangereuse » peut être un composant développé en interne ou par un tiers, effectuant des opérations telles que la désérialisation de données non fiables, l'analyse de fichiers bruts ou binaires, l'exécution de code dynamique ou la manipulation directe de la mémoire. Les vulnérabilités dans ces types d'opérations présentent un risque élevé de compromettre l'application et d'exposer potentiellement son infrastructure sous-jacente. + +Un « composant à risque » est une bibliothèque tierce (c'est-à-dire non développée en interne) dont les contrôles de sécurité concernant ses processus de développement ou ses fonctionnalités sont absents ou mal implémentés. Il peut s'agir, par exemple, de composants mal entretenus, non pris en charge, en fin de vie ou présentant des antécédents de vulnérabilités importantes. + +Cette section souligne également l’importance de définir des délais appropriés pour traiter les vulnérabilités des composants tiers. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **15.1.1** | Vérifiez que la documentation de l'application définit les délais de correction basés sur les risques pour les versions de composants tiers présentant des vulnérabilités et pour la mise à jour des bibliothèques en général, afin de minimiser les risques liés à ces composants. | 1 | +| **15.1.2** | Vérifiez qu'un catalogue d'inventaire, tel qu'une nomenclature logicielle (SBOM), est conservé pour toutes les bibliothèques tierces utilisées, y compris en vérifiant que les composants proviennent de référentiels prédéfinis, fiables et continuellement maintenus. | 2 | +| **15.1.3** | Vérifiez que la documentation de l'application identifie les fonctionnalités consommatrices en temps ou gourmandes en ressources. Elle doit notamment indiquer comment prévenir une perte de disponibilité due à une utilisation excessive de ces fonctionnalités et éviter que la génération d'une réponse ne prenne plus de temps que le délai d'expiration du consommateur. Les mesures de protection potentielles peuvent inclure le traitement asynchrone, l'utilisation de files d'attente et la limitation des processus parallèles par utilisateur et par application. | 2 | +| **15.1.4** | Vérifiez que la documentation de l’application met en évidence les bibliothèques tierces qui sont considérées comme des « composants à risque ». | 3 | +| **15.1.5** | Vérifiez que la documentation de l’application met en évidence les parties de l’application où des « fonctionnalités dangereuses » sont utilisées. | 3 | + +## V15.2 Architecture de sécurité et dépendances + +Cette section inclut les exigences relatives à la gestion des dépendances et des composants risqués, obsolètes ou non sécurisés. + +Elle inclut également l'utilisation de techniques au niveau architectural telles que le sandboxing, l'encapsulation, la conteneurisation et l'isolation du réseau pour réduire l'impact de l'utilisation d'« opérations dangereuses » ou de « composants risqués » (tels que définis dans la section précédente) et éviter la perte de disponibilité due à une utilisation excessive de fonctionnalités exigeantes en ressources. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **15.2.1** | Vérifiez que l’application contient uniquement des composants qui n’ont pas dépassé les délais de mise à jour et de correction documentés. | 1 | +| **15.2.2** | Vérifiez que l'application a mis en œuvre des défenses contre la perte de disponibilité due à des fonctionnalités qui prennent du temps ou qui nécessitent des ressources, sur la base des décisions et stratégies de sécurité documentées à cet effet. | 2 | +| **15.2.3** | Vérifiez que l'environnement de production inclut uniquement les fonctionnalités nécessaires au fonctionnement de l'application et n'expose pas de fonctionnalités superflues telles que du code de test, des exemples d'extraits et des fonctionnalités de développement. | 2 | +| **15.2.4** | Vérifiez que les composants tiers et toutes leurs dépendances transitives sont inclus à partir du référentiel attendu, qu'il soit détenu en interne ou qu'il s'agisse d'une source externe, et qu'il n'y a aucun risque d'attaque par confusion de dépendances. | 3 | +| **15.2.5** | Vérifiez que l'application implémente des protections supplémentaires autour des parties documentées comme contenant des « fonctionnalités dangereuses » ou utilisant des bibliothèques tierces considérées comme des « composants à risque ». Cela peut inclure des techniques telles que le sandboxing, l'encapsulation, la conteneurisation ou l'isolation au niveau du réseau pour retarder et dissuader les attaquants qui compromettent une partie de l'application de se propager ailleurs. | 3 | + +## V15.3 Développement défensif + +Cette section couvre les types de vulnérabilités, y compris le jonglage de types, la pollution de prototypes et autres, qui résultent de l'utilisation de modèles de codage non sécurisés dans un langage particulier. Certaines peuvent ne pas être pertinentes pour tous les langages, tandis que d'autres bénéficieront de correctifs spécifiques à chaque langage ou pourront être liées à la façon dont un langage ou un Framework particulier gère une fonctionnalité telle que les paramètres HTTP. Elle aborde également le risque lié à l'absence de validation cryptographique des mises à jour d'applications. + +Elle prend également en compte les risques liés à l'utilisation d'objets pour représenter des éléments de données, ainsi qu'à leur acceptation et leur renvoi via des API externes. Dans ce cas, l'application doit s'assurer que les champs de données non accessibles en écriture ne sont pas modifiés par l'utilisateur (affectation de masse) et que l'API sélectionne les champs de données renvoyés. Lorsque l'accès aux champs dépend des autorisations de l'utilisateur, il convient d'en tenir compte dans le contexte des exigences de contrôle d'accès au niveau des champs décrites dans le chapitre « Autorisation ». + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **15.3.1** | Vérifiez que l'application ne renvoie que le sous-ensemble requis de champs d'un objet de données. Par exemple, elle ne doit pas renvoyer un objet de données entier, car certains champs individuels ne doivent pas être accessibles aux utilisateurs. | 1 | +| **15.3.2** | Vérifiez que lorsque le backend de l'application effectue des appels vers des URL externes, il est configuré pour ne pas suivre les redirections, sauf s'il s'agit d'une fonctionnalité prévue. | 2 | +| **15.3.3** | Vérifiez que l'application dispose de contre-mesures pour se protéger contre les attaques d'affectation de masse en limitant les champs autorisés par contrôleur et action, par exemple, il n'est pas possible d'insérer ou de mettre à jour une valeur de champ lorsqu'elle n'était pas destinée à faire partie de cette action. | 2 | +| **15.3.4** | Vérifiez que tous les composants proxy et middleware transfèrent correctement l'adresse IP d'origine de l'utilisateur à l'aide de champs de données fiables qui ne peuvent pas être manipulés par l'utilisateur final, et que l'application et le serveur Web utilisent cette valeur correcte pour la journalisation et les décisions de sécurité telles que la limitation du débit, en tenant compte du fait que même l'adresse IP d'origine peut ne pas être fiable en raison d'adresses IP dynamiques, de VPN ou de pare-feu d'entreprise. | 2 | +| **15.3.5** | Vérifiez que l'application garantit explicitement que les variables sont du type correct et effectue des opérations d'égalité et de comparaison strictes. Cela permet d'éviter les vulnérabilités liées à la confusion de types, causées par des hypothèses du code de l'application sur le type d'une variable. | 2 | +| **15.3.6** | Vérifiez que le code JavaScript est écrit de manière à éviter la pollution du prototype, par exemple en utilisant Set() ou Map() au lieu de littéraux d'objet. | 2 | +| **15.3.7** | Vérifiez que l'application dispose de défenses contre les attaques de pollution des paramètres HTTP, en particulier si le Framework d'application ne fait aucune distinction quant à la source des paramètres de requête (chaîne de requête, paramètres de corps, cookies ou champs d'en-tête). | 2 | + +## V15.4 Concurrence sécurisée + +Les problèmes de concurrence tels que les situations de concurrence, les vulnérabilités TOCTOU (Time-of-Check-to-Time-of-Use), les interblocages, les livelock, la privation de threads et les synchronisations incorrectes peuvent entraîner des comportements imprévisibles et des risques de sécurité. Cette section présente diverses techniques et stratégies pour atténuer ces risques. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **15.4.1** | Vérifiez que les objets partagés dans le code multithread (tels que les caches, les fichiers ou les objets en mémoire accessibles par plusieurs threads) sont accessibles en toute sécurité à l'aide de types thread-safe et de mécanismes de synchronisation tels que des verrous ou des sémaphores pour éviter les conditions de concurrence et la corruption des données. | 3 | +| **15.4.2** | Vérifiez que les vérifications de l'état d'une ressource, comme son existence ou ses autorisations, et des actions qui en dépendent, sont effectuées en une seule opération atomique afin d'éviter les situations de concurrence entre le moment de la vérification et le moment de l'utilisation (TOCTOU). Par exemple, vérifier l'existence d'un fichier avant de l'ouvrir ou l'accès d'un utilisateur avant de l'accorder. | 3 | +| **15.4.3** | Vérifiez que les verrous sont utilisés de manière cohérente pour éviter que les threads ne se bloquent, que ce soit en s'attendant les uns les autres ou en réessayant sans fin, et que la logique de verrouillage reste dans le code responsable de la gestion de la ressource pour garantir que les verrous ne peuvent pas être modifiés par inadvertance ou de manière malveillante par des classes ou du code externes. | 3 | +| **15.4.4** | Vérifiez que les politiques d'allocation des ressources empêchent la saturation de threads en garantissant un accès équitable aux ressources, par exemple en exploitant les pools de threads, permettant aux threads de priorité inférieure de continuer dans un délai raisonnable. | 3 | + +## Références + +Pour plus d'informations, voir également : + +* [OWASP Prototype Pollution Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html) +* [OWASP Mass Assignment Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html) +* [OWASP CycloneDX Bill of Materials Specification](https://owasp.org/www-project-cyclonedx/) +* [OWASP Web Security Testing Guide: Testing for HTTP Parameter Pollution](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/07-Input_Validation_Testing/04-Testing_for_HTTP_Parameter_Pollution) diff --git a/5.0/fr/0x25-V16-Security-Logging-and-Error-Handling.md b/5.0/fr/0x25-V16-Security-Logging-and-Error-Handling.md new file mode 100644 index 0000000000..38b7b7fe55 --- /dev/null +++ b/5.0/fr/0x25-V16-Security-Logging-and-Error-Handling.md @@ -0,0 +1,84 @@ +# V16 Journalisation de sécurité et gestion des erreurs + +## Objectif de contrôle + +Les journaux de sécurité se distinguent des journaux d'erreurs ou de performances et servent à enregistrer les événements liés à la sécurité, tels que les décisions d'authentification, les décisions de contrôle d'accès et les tentatives de contournement des contrôles de sécurité, comme la validation des entrées ou la validation de la logique métier. Leur objectif est de faciliter la détection, la réponse et l'investigation en fournissant des données structurées et à haut niveau de signal aux outils d'analyse tels que les SIEM. + +Les journaux ne doivent pas contenir de données personnelles sensibles, sauf obligation légale, et toutes les données enregistrées doivent être protégées comme des ressources de grande valeur. La journalisation ne doit pas compromettre la confidentialité ni la sécurité du système. Les applications doivent également être sécurisées, évitant toute divulgation ou interruption inutile. + +Pour des conseils de mise en œuvre détaillés, consultez les aide-mémoire de l'OWASP indiquées dans la section Références. + +## V16.1 Documentation sur la journalisation de sécurité + +Cette section garantit un inventaire clair et complet de la journalisation de l'ensemble de la pile applicative. Ceci est essentiel pour une surveillance efficace de la sécurité, une réponse aux incidents et une conformité optimale. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **16.1.1** | Vérifiez qu'il existe un inventaire documentant la journalisation effectuée à chaque couche de la pile technologique de l'application, les événements enregistrés, les formats de journal, l'endroit où cette journalisation est stockée, la manière dont elle est utilisée, la manière dont l'accès à celle-ci est contrôlé et la durée de conservation des journaux. | 2 | + +## V16.2 Journalisation générale + +La présente section énonce des exigences visant à garantir que les journaux de sécurité sont structurés de manière cohérente et contiennent les métadonnées attendues. L'objectif est de rendre les journaux lisibles par une machine et analysables par des systèmes et des outils distribués. + +Les événements de sécurité impliquent souvent des données sensibles. Si ces données sont enregistrées sans surveillance, les journaux eux-mêmes deviennent classifiés et donc soumis à des exigences de chiffrement, à des politiques de conservation plus strictes et à une divulgation potentielle lors des audits. + +Il est donc essentiel de ne loguer que ce qui est nécessaire et de traiter les données des journaux avec le même soin que les autres ressources sensibles. + +Les exigences ci-dessous établissent les exigences fondamentales pour la journalisation des métadonnées, la synchronisation, le format et le contrôle. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **16.2.1** | Vérifiez que chaque entrée de journal inclut les métadonnées nécessaires (telles que quand, où, qui, quoi) qui permettraient une enquête détaillée sur la chronologie lorsqu'un événement se produit. | 2 | +| **16.2.2** | Vérifiez que les sources de temps de tous les composants de journalisation sont synchronisées et que les horodatages des métadonnées des événements de sécurité utilisent le temps UTC ou incluent un décalage horaire explicite. L'UTC est recommandé pour garantir la cohérence entre les systèmes distribués et éviter toute confusion lors du passage à l'heure d'été. | 2 | +| **16.2.3** | Vérifiez que l’application stocke ou diffuse uniquement les journaux vers les fichiers et services documentés dans l’inventaire des journaux. | 2 | +| **16.2.4** | Vérifiez que les journaux peuvent être lus et corrélés par le processeur de journaux utilisé, de préférence en utilisant un format de journalisation commun. | 2 | +| **16.2.5** | Vérifiez que l'application applique la journalisation en fonction du niveau de protection des données lors de la journalisation de données sensibles. Par exemple, certaines données, comme les identifiants ou les informations de paiement, peuvent être interdites. D'autres données, comme les jetons de session, ne peuvent être enregistrées que par hachage ou masquage, en totalité ou en partie. | 2 | + +## V16.3 Événements de sécurité + +Cette section définit les exigences relatives à la journalisation des événements de sécurité au sein de l'application. La capture de ces événements est essentielle pour détecter les comportements suspects, faciliter les enquêtes et respecter les obligations de conformité. + +Cette section décrit les types d'événements à journaliser, sans toutefois prétendre à l'exhaustivité. Chaque application présente des facteurs de risque et un contexte opérationnel spécifiques. + +Notez que si ASVS inclut la journalisation des événements de sécurité, les alertes et la corrélation (par exemple, les règles SIEM ou l'infrastructure de surveillance) sont considérées comme hors du périmètre et sont gérées par les systèmes opérationnels et de surveillance. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **16.3.1** | Vérifiez que toutes les opérations d'authentification sont enregistrées, y compris les tentatives réussies et infructueuses. Des métadonnées supplémentaires, telles que le type d'authentification ou les facteurs utilisés, doivent également être collectées. | 2 | +| **16.3.2** | Vérifier que les tentatives d'autorisation infructueuses sont logguées. Pour le niveau 3, cela doit inclure la journalisation de toutes les décisions d'autorisation, y compris lors de l'accès à des données sensibles (sans journalisation des données sensibles elles-mêmes). | 2 | +| **16.3.3** | Vérifiez que l'application enregistre les événements de sécurité définis dans la documentation et enregistre également les tentatives de contournement des contrôles de sécurité, tels que la validation des entrées, la logique métier et l'anti-automatisation. | 2 | +| **16.3.4** | Vérifiez que l’application enregistre les erreurs inattendues et les échecs de contrôle de sécurité tels que les échecs TLS du backend. | 2 | + +## V16.4 Protection des journaux + +Les journaux sont des artefacts d'investigation précieux et doivent être protégés. S'ils peuvent être facilement modifiés ou supprimés, ils perdent leur intégrité et deviennent peu fiables pour les enquêtes sur les incidents ou les procédures légales. Ils peuvent exposer le comportement interne des applications ou des métadonnées sensibles, ce qui en fait une cible de choix pour les attaquants. + +Cette section définit les exigences visant à garantir la protection des journaux contre les accès non autorisés, les falsifications et les divulgations, ainsi que leur transmission et leur stockage sécurisés dans des systèmes sécurisés et isolés. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **16.4.1** | Vérifiez que tous les composants de journalisation codent correctement les données pour empêcher l’injection de journaux. | 2 | +| **16.4.2** | Vérifiez que les journaux sont protégés contre tout accès non autorisé et ne peuvent pas être modifiés. | 2 | +| **16.4.3** | Vérifiez que les journaux sont transmis de manière sécurisée à un système logique distinct pour analyse, détection, alerte et remontée des informations. L'objectif est de garantir qu'en cas de violation de l'application, les journaux ne seront pas compromis. | 2 | + +## V16.5 Gestion des erreurs + +Cette section définit les exigences visant à garantir que les applications échouent proprement et sécurisée sans divulguer de détails internes sensibles. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **16.5.1** | Vérifiez qu'un message générique est renvoyé au consommateur lorsqu'une erreur inattendue ou sensible à la sécurité se produit, garantissant ainsi l'absence d'exposition de données système internes sensibles telles que les traces de pile, les requêtes, les clés secrètes et les jetons. | 2 | +| **16.5.2** | Vérifiez que l'application continue de fonctionner en toute sécurité lorsque l'accès aux ressources externes échoue, par exemple, en utilisant des modèles tels que des disjoncteurs ou une dégradation progressive. | 2 | +| **16.5.3** | Vérifiez que l'application échoue proprement et sécurisée, y compris lorsqu'une exception se produit, en évitant les accès en cas d'erreur telles que le traitement d'une transaction malgré les erreurs résultant de la logique de validation. | 2 | +| **16.5.4** | Vérifiez qu'un gestionnaire d'erreurs de « dernier recours » est défini pour intercepter toutes les exceptions non gérées. Cela permet d'éviter la perte des informations d'erreur qui doivent être loguées dans les fichiers journaux et de garantir qu'une erreur ne paralyse pas l'ensemble du processus applicatif, entraînant une perte de disponibilité. | 3 | + +Remarque : Certains langages (dont Swift, Go et, par des pratiques de conception courantes, de nombreux langages fonctionnels) ne prennent pas en charge les exceptions ni les gestionnaires d'événements de dernier recours. Dans ce cas, les architectes et les développeurs doivent utiliser une méthode compatible avec les modèles, les langages ou les frameworks pour garantir que les applications peuvent gérer en toute sécurité les événements exceptionnels, inattendus ou liés à la sécurité. + +## Références + +Pour plus d'informations, voir également : + +* [OWASP Web Security Testing Guide: Testing for Error Handling](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/README) +* [OWASP Authentication Cheat Sheet section about error messages](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#authentication-and-error-messages) +* [OWASP Logging Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html) +* [OWASP Application Logging Vocabulary Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Vocabulary_Cheat_Sheet.html) diff --git a/5.0/fr/0x26-V17-WebRTC.md b/5.0/fr/0x26-V17-WebRTC.md new file mode 100644 index 0000000000..aeeda82a98 --- /dev/null +++ b/5.0/fr/0x26-V17-WebRTC.md @@ -0,0 +1,75 @@ +# V17 WebRTC + +## Objectif de contrôle + +La communication Web en temps réel (WebRTC) permet l'échange de voix, de vidéo et de données en temps réel dans les applications modernes. Avec l'adoption croissante de cette technologie, la sécurisation de l'infrastructure WebRTC devient cruciale. Cette section présente les exigences de sécurité pour les acteurs qui développent, hébergent ou intègrent des systèmes WebRTC. + +Le marché du WebRTC peut être classé en trois segments : + +1. Développeurs de produits : Fournisseurs propriétaires et open source qui créent et fournissent des produits et solutions WebRTC. Leur objectif est de développer des technologies WebRTC robustes et sécurisées, utilisables par d'autres. + +2. Plateformes de communication en tant que service (CPaaS) : fournisseurs proposant des API, des SDK et l'infrastructure ou les plateformes nécessaires pour exploiter les fonctionnalités WebRTC. Les fournisseurs CPaaS peuvent utiliser des produits de la première catégorie ou développer leur propre logiciel WebRTC pour offrir ces services. + +3. Fournisseurs de services : organisations qui exploitent les produits de développeurs ou de fournisseurs CPaaS, ou qui développent leurs propres solutions WebRTC. Elles créent et implémentent des applications pour les conférences en ligne, la santé, l'apprentissage en ligne et d'autres domaines où la communication en temps réel est essentielle. + +Les exigences de sécurité décrites ici s'adressent principalement aux développeurs de produits, aux CPaaS et aux fournisseurs de services qui : + +* utilisent des solutions open source pour développer leurs applications WebRTC ; +* utilisent des produits WebRTC commerciaux au sein de leur infrastructure ; +* utilisent des solutions WebRTC développées en interne ou intègrent divers composants dans une offre de services cohérente. + +Il est important de noter que ces exigences de sécurité ne s'appliquent pas aux développeurs qui utilisent exclusivement les SDK et les API fournis par les fournisseurs CPaaS. Pour ces développeurs, les fournisseurs CPaaS sont généralement responsables de la plupart des problèmes de sécurité sous-jacents à leurs plateformes, et une norme de sécurité générique comme ASVS peut ne pas répondre pleinement à leurs besoins. + +## V17.1 Serveur TURN + +Cette section définit les exigences de sécurité pour les systèmes utilisant leurs propres serveurs TURN (Traversal Using Relays around NAT). Les serveurs TURN contribuent au relais des médias dans les environnements réseau restrictifs, mais peuvent présenter des risques en cas de mauvaise configuration. Ces contrôles se concentrent sur le filtrage sécurisé des adresses et la protection contre l'épuisement des ressources. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **17.1.1** | Vérifiez que le service TURN (Traversal Using Relays around NAT) autorise uniquement l'accès aux adresses IP non réservées à des fins spécifiques (par exemple, réseaux internes, diffusion, bouclage). Notez que cela s'applique aux adresses IPv4 et IPv6. | 2 | +| **17.1.2** | Vérifiez que le service Traversal Using Relays around NAT (TURN) n'est pas susceptible d'épuiser ses ressources lorsque des utilisateurs légitimes tentent d'ouvrir un grand nombre de ports sur le serveur TURN. | 3 | + +## V17.2 Média + +Ces exigences s'appliquent uniquement aux systèmes hébergeant leurs propres serveurs multimédias WebRTC, tels que les unités de transfert sélectif (SFU), les unités de contrôle multipoint (MCU), les serveurs d'enregistrement ou les serveurs de passerelle. Les serveurs multimédias gèrent et distribuent les flux multimédias, ce qui rend leur sécurité essentielle pour protéger les communications entre homologues. La protection des flux multimédias est primordiale dans les applications WebRTC pour prévenir les écoutes clandestines, les falsifications et les attaques par déni de service susceptibles de compromettre la confidentialité des utilisateurs et la qualité des communications. + +En particulier, il est nécessaire de mettre en œuvre des protections contre les attaques par saturation, telles que la limitation du débit, la validation des horodatages, l'utilisation d'horloges synchronisées pour correspondre aux intervalles en temps réel et la gestion des tampons afin d'éviter les débordements et de maintenir une synchronisation correcte. Si les paquets d'une session multimédia spécifique arrivent trop rapidement, les paquets excédentaires doivent être rejetés. Il est également important de protéger le système contre les paquets malformés en implémentant la validation des entrées, en gérant en toute sécurité les dépassements d'entiers, en prévenant les dépassements de tampon et en utilisant d'autres techniques robustes de gestion des erreurs. + +Les systèmes qui s'appuient uniquement sur la communication multimédia peer-to-peer entre navigateurs Web, sans l'intervention de serveurs multimédias intermédiaires, sont exclus de ces exigences de sécurité spécifiques liées aux médias. + +Cette section traite de l'utilisation de la sécurité de la couche de transport des datagrammes (DTLS) dans le contexte de WebRTC. L'exigence relative à la mise en place d'une politique documentée de gestion des clés cryptographiques est décrite dans le chapitre « Cryptographie ». Des informations sur les méthodes cryptographiques approuvées sont disponibles dans l'annexe Cryptographie de l'ASVS ou dans des documents tels que NIST SP 800-52 Rev. 2 ou BSI TR-02102-2 (version 2025-01). + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **17.2.1** | Vérifiez que la clé du certificat Datagram Transport Layer Security (DTLS) est gérée et protégée conformément à la politique documentée de gestion des clés cryptographiques. | 2 | +| **17.2.2** | Vérifiez que le serveur multimédia est configuré pour utiliser et prendre en charge les suites de chiffrement DTLS (Datagram Transport Layer Security) approuvées et un profil de protection sécurisé pour l'extension DTLS pour l'établissement de clés pour le protocole de transport en temps réel sécurisé (DTLS-SRTP). | 2 | +| **17.2.3** | Vérifiez que l'authentification SRTP (Secure Real-time Transport Protocol) est vérifiée sur le serveur multimédia pour empêcher les attaques par injection RTP (Real-time Transport Protocol) d'entraîner une condition de déni de service ou l'insertion de médias audio ou vidéo dans les flux multimédias. | 2 | +| **17.2.4** | Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant lorsqu'il rencontre des paquets SRTP (Secure Real-time Transport Protocol) mal formés. | 2 | +| **17.2.5** | Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes. | 3 | +| **17.2.6** | Vérifiez que le serveur multimédia n'est pas sensible à la vulnérabilité de condition de concurrence « ClientHello » dans Datagram Transport Layer Security (DTLS) en vérifiant si le serveur multimédia est publiquement connu comme étant vulnérable ou en effectuant le test de condition de concurrence. | 3 | +| **17.2.7** | Vérifiez que tous les mécanismes d'enregistrement audio ou vidéo associés au serveur multimédia sont en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes. | 3 | +| **17.2.8** | Vérifiez que le certificat Datagram Transport Layer Security (DTLS) est vérifié par rapport à l'attribut d'empreinte cryptographique du protocole de description de session (SDP), en mettant fin au flux multimédia si la vérification échoue, pour garantir l'authenticité du flux multimédia. | 3 | + +## V17.3 Signalisation + +Cette section définit les exigences pour les systèmes qui exploitent leurs propres serveurs de signalisation WebRTC. La signalisation coordonne les communications "pair à pair" et doit être résiliente face aux attaques susceptibles de perturber l'établissement ou le contrôle des sessions. + +Pour garantir une signalisation sécurisée, les systèmes doivent gérer correctement les entrées malformées et rester disponibles sous charge. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **17.3.1** | Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation entrants légitimes lors d'une attaque par saturation. Cela peut être réalisé en implémentant une limitation de débit au niveau de la signalisation. | 2 | +| **17.3.2** | Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation légitimes en cas de message mal formé susceptible de provoquer un déni de service. Cela peut inclure la validation des entrées, la gestion sécurisée des dépassements d'entiers, la prévention des dépassements de tampon et l'utilisation d'autres techniques robustes de gestion des erreurs. | 2 | + +## Références + +Pour plus d'informations, voir également : + +* Le WebRTC DTLS ClientHello DoS est mieux documenté ici : [Article du blog d'Enable Security destiné aux professionnels de la sécurité](https://www.enablesecurity.com/blog/novel-dos-vulnerability-affecting-webrtc-media-servers/) et ici [livre blanc destiné aux développeurs WebRTC](https://www.enablesecurity.com/blog/webrtc-hello-race-conditions-paper/) +* [RFC 3550 - RTP: A Transport Protocol for Real-Time Applications](https://www.rfc-editor.org/rfc/rfc3550) +* [RFC 3711 - The Secure Real-time Transport Protocol (SRTP)](https://datatracker.ietf.org/doc/html/rfc3711) +* [RFC 5764 - Datagram Transport Layer Security (DTLS) Extension to Establish Keys for the Secure Real-time Transport Protocol (SRTP))](https://datatracker.ietf.org/doc/html/rfc5764) +* [RFC 8825 - Overview: Real-Time Protocols for Browser-Based Applications](https://www.rfc-editor.org/info/rfc8825) +* [RFC 8826 - Security Considerations for WebRTC](https://www.rfc-editor.org/info/rfc8826) +* [RFC 8827 - WebRTC Security Architecture](https://www.rfc-editor.org/info/rfc8827) +* [DTLS-SRTP Protection Profiles](https://www.iana.org/assignments/srtp-protection/srtp-protection.xhtml) diff --git a/5.0/fr/0x90-Appendix-A_Glossary.md b/5.0/fr/0x90-Appendix-A_Glossary.md new file mode 100644 index 0000000000..ebcad83488 --- /dev/null +++ b/5.0/fr/0x90-Appendix-A_Glossary.md @@ -0,0 +1,89 @@ +# Annexe A : Glossaire + +* **Architecture de sécurité** – Abstraction de la conception d'une application qui identifie et décrit où et comment les contrôles de sécurité sont utilisés, et identifie et décrit également l'emplacement et la sensibilité des données utilisateur et applicatives. +* **Address Space Layout Randomization (ASLR)** - Une technique pour rendre plus difficile l'exploitation des bugs de corruption de la mémoire. +* **Analyse de la composition logicielle** (SCA) – Ensemble de technologies conçues pour analyser la composition, les dépendances, les bibliothèques et les packages des applications afin de détecter les vulnérabilités de sécurité des versions de composants spécifiques utilisées. À ne pas confondre avec l'analyse du code source, communément appelée SAST. +* **Authentification** – Vérification de l'identité revendiquée par un utilisateur d'application. +* **Authentification client TLS**, également appelée **TLS mutuel** (mTLS) - Dans une connexion TLS standard, un client peut utiliser le certificat fourni par le serveur pour valider son identité. Lorsque l'authentification client TLS est utilisée, le client utilise également sa propre clé privée et son propre certificat pour permettre au serveur de valider également son identité. +* **Authentificateur à facteur unique** – Mécanisme permettant de vérifier l'authentification d'un utilisateur. Il peut s'agir d'un élément que vous connaissez (secrets mémorisés, mots de passe, phrases secrètes, codes PIN), d'une information que vous êtes (biométrie, empreinte digitale, reconnaissance faciale) ou d'un élément que vous possédez (jetons OTP, dispositif cryptographique tel qu'une carte à puce). +* **Authentification multifacteur** (MFA) - Authentification qui inclut au moins deux facteurs uniques. +* **Authentification par authentification unique** (SSO) – Elle se produit lorsqu'un utilisateur se connecte à une application et est ensuite automatiquement connecté à d'autres applications sans avoir à se réauthentifier. Par exemple, lorsqu'il se connecte à Google, il sera automatiquement connecté à d'autres services Google tels que YouTube, Google Docs et Gmail. +* **Bill of Materials logiciels** (SBOM) – Liste structurée et complète de tous les composants, modules, bibliothèques, Framework et autres ressources nécessaires à la création ou à l'assemblage d'une application logicielle. +* **Certificat X.509** – Un certificat X.509 est un certificat numérique qui utilise la norme internationale d'infrastructure à clés publiques (PKI) X.509, largement acceptée, pour vérifier qu'une clé publique appartient à l'identité de l'utilisateur, de l'ordinateur ou du service contenue dans le certificat. +* **Code d'authentification de message** (MAC) - Somme de contrôle cryptographique des données, calculée par un algorithme de génération de MAC, utilisée pour garantir leur intégrité et leur authenticité. +* **Communication Web en temps réel** (WebRTC) – Pile de protocoles et API web associée, utilisées pour le transport de flux multimédias dans les applications web, généralement dans le cadre de téléconférences. Basée sur SRTP, SRTCP, DTLS, SDP et STUN/TURN. +* **Configuration de sécurité** – Configuration d'exécution d'une application qui affecte l'utilisation des contrôles de sécurité. +* **Contrôle de sécurité** – Fonction ou composant qui effectue un contrôle de sécurité (par exemple, un contrôle d'autorisation) ou, lorsqu'il est appelé, produit un effet de sécurité (par exemple, la génération d'un enregistrement d'audit). +* **Composant** – Unité de code autonome, avec des interfaces disque et réseau associées, qui communique avec d'autres composants. +* **Couche de service sécurisé** – Tout point d'application de contrôle sécurisé, tel qu'un microservice, une API sans serveur, côté serveur, une API sécurisée sur un appareil client doté d'un démarrage sécurisé, des API partenaires ou externes, etc. Le terme « sécurisé » signifie qu'il n'y a aucun risque qu'un utilisateur non sécurisé puisse contourner ou ignorer la couche ou les contrôles implémentés à cette couche. +* **Cross-Site Scripting** (XSS) – Vulnérabilité de sécurité généralement présente dans les applications web, permettant l'injection de scripts côté client dans le contenu. +* **Cycle de vie du développement logiciel** (SDLC) – Processus étape par étape de développement d'un logiciel, depuis les exigences initiales jusqu'au déploiement et à la maintenance. +* **Datagram Transport Layer Security** (DTLS) – Protocole cryptographique assurant la sécurité des communications sur une connexion réseau. Basé sur le protocole TLS, il est adapté à la protection des protocoles orientés datagrammes (généralement via UDP). Défini dans la RFC 9147 pour DTLS 1.3. +* **Délai d'inactivité** – Durée pendant laquelle une session peut rester active en l'absence d'interaction de l'utilisateur avec l'application. Il s'agit d'un élément de l'expiration de la session. +* **Durée de vie maximale absolue d'une session** – Également appelée « délai d'expiration global » par le NIST, il s'agit de la durée maximale pendant laquelle une session peut rester active après authentification, quelle que soit l'interaction de l'utilisateur. Il s'agit d'un élément de l'expiration de la session. +* **Entité externe XML** (XXE) – Type d'entité XML permettant d'accéder à du contenu local ou distant via un identifiant système déclaré. Cela peut conduire à diverses attaques par injection. +* **Énumération des faiblesses courantes** (CWE) – Liste communautaire des faiblesses courantes en matière de sécurité logicielle. Elle sert de langage commun, de critère de mesure pour les outils de sécurité logicielle et de référence pour l'identification, l'atténuation et la prévention des faiblesses. +* **Environnement d'exécution sécurisé** (TEE) - Un environnement de traitement isolé dans lequel les applications peuvent être exécutées en toute sécurité, indépendamment du reste du système. +* **Extension de sécurité de la couche de transport de datagrammes pour l'établissement de clés pour le protocole de transport sécurisé en temps réel** (DTLS-SRTP) – Mécanisme d'utilisation d'une négociation DTLS pour l'établissement des clés d'une session SRTP. Définie dans la RFC 5764. +* **Falsification de requête côté serveur** (SSRF) – Attaque qui exploite les fonctionnalités du serveur pour lire ou mettre à jour des ressources internes. L'attaquant fournit ou modifie une URL, que le code exécuté sur le serveur lit ou à laquelle il soumet des données. +* **Fast IDentity Online** (FIDO) – Ensemble de normes d'authentification permettant l'utilisation de différentes méthodes d'authentification, notamment la biométrie, les modules de plateforme sécurisée (TPM), les jetons de sécurité USB, etc. +* **Fonction de dérivation de clé basée sur un mot de passe 2** (PBKDF2) – Algorithme unidirectionnel spécial utilisé pour créer une clé cryptographique forte à partir d'un texte d'entrée (tel qu'un mot de passe) et d'une valeur de sel aléatoire supplémentaire. Il peut donc être utilisé pour rendre plus difficile le forçage d'un mot de passe hors ligne si la valeur résultante est stockée à la place du mot de passe d'origine. +* **Fournisseur d'identité** (IdP) – Également appelé fournisseur de services d'identification (CSP) dans les références NIST. Entité qui fournit une source d'authentification pour d'autres applications. +* **Fournisseur de services d'identification** (CSP) – Également appelé fournisseur d'identité (IdP). Source de données utilisateur pouvant être utilisée comme source d'authentification par d'autres applications. +* **Générateur de nombres pseudo-aléatoires cryptographiquement sécurisé** (CSPRNG) - Un générateur de nombres pseudo-aléatoires avec des propriétés qui le rendent adapté à une utilisation en cryptographie, également appelé générateur de nombres aléatoires cryptographiques (CRNG). +* **Gestion des informations et des événements de sécurité** (SIEM) - Système de détection des menaces, de conformité et de gestion des incidents de sécurité par la collecte et l'analyse de données de sécurité provenant de diverses sources au sein de l'infrastructure informatique d'une organisation. +* **Graphiques vectoriels évolutifs** (SVG) – Langage de balisage XML pour la description de graphiques vectoriels bidimensionnels. +* **Hardware Security Module** (HSM) – Composant matériel qui stocke les clés cryptographiques et autres secrets de manière protégée. +* **Hibernate Query Language** (HQL) – Langage de requête similaire au SQL utilisé par la bibliothèque Hibernate ORM. +* **HTTP Strict Transport Security** (HSTS) – Politique qui indique au navigateur de se connecter uniquement au domaine renvoyant l'en-tête via TLS et lorsqu'un certificat valide est présenté. Elle est activée via le champ d'en-tête de réponse Strict-Transport-Security. +* **HyperText Transfer Protocol** (HTTP) – Protocole d'application pour les systèmes d'information hypermédia distribués et collaboratifs. Il constitue le fondement de la communication de données sur le World Wide Web. +* **Identifiant de ressource uniforme** (URI) – Chaîne de caractères unique identifiant une ressource, telle qu'une page web, une adresse e-mail, des lieux. +* **Identifiant de session** ou **ID de session** – Clé identifiant une session avec état stockée dans le backend. Transférée vers et depuis le client, soit sous forme de jeton de référence, soit à l'intérieur d'un jeton de référence. +* **Identifiant unique universel** (UUID) – Un numéro de référence unique utilisé comme identifiant dans un logiciel. +* **Inclusion de fichiers distants** (RFI) – Attaque exploitant des procédures d'inclusion vulnérables dans l'application, entraînant l'inclusion de fichiers distants. +* **Inclusion de fichiers locaux** (LFI) – Attaque exploitant les procédures d'inclusion de fichiers vulnérables d'une application, entraînant l'inclusion de fichiers locaux déjà présents sur le serveur. +* **Inclusion de script intersite** (XSSI) – Variante d'une attaque de script intersite (XSS) dans laquelle une application web récupère du code malveillant depuis une ressource externe et l'intègre à son propre contenu. +* **Infrastructure à clés publiques** (PKI) – Dispositif qui lie les clés publiques aux identités respectives des entités. Cette liaison est établie par un processus d'enregistrement et de délivrance de certificats auprès et par une autorité de certification (AC). +* **Injection SQL** (SQLi) - Technique d'injection de code utilisée pour attaquer les applications pilotées par les données, dans laquelle des instructions SQL malveillantes sont insérées dans un endpoint. +* **Jeton anti-falsification** – Mécanisme par lequel un ou plusieurs jetons sont transmis dans une requête et validés par le serveur d'app. +* **Code d'authentification de message** (MAC) - Somme de contrôle cryptographique des données, calculée par un algorithme de génération de MAC, utilisée pour garantir leur intégrité et leur authenticité. +* **Jeton autonome** – Jeton qui encapsule un ou plusieurs attributs indépendants de l'état côté serveur ou d'un autre stockage externe. Ces jetons garantissent l'authenticité et l'intégrité des attributs qu'ils contiennent, permettant un échange d'informations sécurisé et « sans état » entre les systèmes. Les jetons autonomes sont généralement sécurisés à l'aide de techniques cryptographiques, telles que les signatures numériques ou les codes d'authentification de messages (MAC), afin de garantir l'authenticité, l'intégrité et, dans certains cas, la confidentialité de leurs données. Les assertions SAML et les JWT en sont des exemples courants. +* **Jeton de référence** – Type de jeton servant de pointeur ou d'identifiant vers un état ou des métadonnées stockées sur un serveur, parfois appelés jetons aléatoires ou jetons opaques. Contrairement aux jetons autonomes, qui intègrent certaines de leurs données pertinentes au sein même du jeton, les jetons de référence ne contiennent aucune information intrinsèque et dépendent du serveur pour le contexte. Le jeton de référence sera ou contiendra un identifiant de session. +* **Jeton de session** – Expression générique utilisée dans la présente norme pour désigner le jeton ou la valeur utilisé(e) dans les mécanismes de session sans état (qui utilisent un jeton autonome) ou dans les mécanismes de session avec état (qui utilisent un jeton de référence). +* **Jeton Web JSON** (JWT) – La RFC 7519 définit une norme pour un objet de données JSON composé d'une section d'en-tête expliquant comment valider l'objet, d'une section de corps contenant un ensemble de déclarations et d'une section de signature contenant une signature numérique permettant de valider le contenu de la section de corps. Il s'agit d'un type de jeton autonome. +* **Liste d'autorisation** – Liste de données ou d'opérations autorisées, par exemple une liste de caractères autorisés à valider les entrées. +* **Localisateur de ressources uniforme** (URL) – Chaîne spécifiant l'emplacement d'une ressource sur Internet. +* **Malware** - Code introduit dans une application pendant son développement, à l'insu de son propriétaire, qui contourne la politique de sécurité prévue de l'application. Différent des logiciels malveillants tels qu'un virus ou un ver ! +* **Mappage objet-relationnel** (ORM) - Système permettant de référencer et d'interroger une base de données relationnelle/table au sein d'un programme d'application à l'aide d'un modèle objet compatible avec l'application. +* **Mécanisme de session avec état** - Dans un mécanisme de session avec état, l'application conserve l'état de la session dans le backend, ce qui correspond généralement à un jeton de session, généré à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG), délivré à l'utilisateur final. +* **Mécanisme de session sans état** - Un mécanisme de session sans état utilise un jeton autonome transmis aux clients et contenant des informations de session qui ne sont pas nécessairement stockées au sein du service, qui reçoit et valide ensuite le jeton. En réalité, un service doit avoir accès à certaines informations de session (comme une liste de révocation JWT) pour pouvoir appliquer les contrôles de sécurité requis. +* **Module cryptographique** – Matériel, logiciel et/ou micrologiciel implémentant des algorithmes cryptographiques et/ou générant des clés cryptographiques. +* **Module de plateforme sécurisé** (TPM) – Type de HSM généralement rattaché à un composant matériel plus important, comme une carte mère, et servant de « racine de confiance » pour ce système. +* **Mot de passe à usage unique** (OTP) - Mot de passe généré de manière unique pour une utilisation unique. +* **Open Worldwide Application Security Project** (OWASP) – L'OWASP (Open Worldwide Application Security Project) est une communauté mondiale, libre et ouverte, qui se consacre à l'amélioration de la sécurité des logiciels applicatifs. Notre mission est de rendre la sécurité des applications visible, afin que les personnes et les organisations puissent prendre des décisions éclairées face aux risques de sécurité applicative. Voir : [https://www.owasp.org/](https://www.owasp.org/). +* **OTP basé sur l'heure** - Méthode de génération d'un OTP où l'heure actuelle fait partie de l'algorithme de génération du mot de passe. +* **Partie de confiance** (RP) – Généralement une application qui s'appuie sur l'authentification d'un utilisateur auprès d'un fournisseur d'authentification distinct. L'application s'appuie sur un jeton ou un ensemble d'assertions signées fournies par ce fournisseur d'authentification pour garantir que l'utilisateur est bien celui qu'il prétend être. +* **Protocole de description de session** (SDP) - Format de message permettant de configurer une session multimédia (utilisé par exemple dans WebRTC). Défini dans la RFC 4566. +* **Protocole de transport en temps réel** (RTP) et **Protocole de contrôle de transport en temps réel** (RTCP) - Deux protocoles utilisés conjointement pour le transport de flux multimédia. Utilisé par la pile WebRTC. Défini dans la RFC 3550. +* **Protocole de transfert hypertexte sur SSL/TLS** (HTTPS) – Méthode de sécurisation des communications HTTP par chiffrement à l'aide du protocole TLS (Transport Layer Security). +* **Rapport de vérification de la sécurité des applications** – Rapport documentant les résultats globaux et l'analyse justificative produite par le vérificateur pour une application donnée. +* **Réseau téléphonique public commuté** (RTPC) – Réseau téléphonique traditionnel qui comprend à la fois les téléphones fixes et les téléphones mobiles. +* **Secure Real-time Transport Protocol** (SRTP) et **Secure Real-time Transport Control Protocol** (SRTCP) – Profil des protocoles RTP et RTCP prenant en charge le chiffrement des messages, l'authentification et la protection de leur intégrité. Défini dans la RFC 3711. +* **Security Assertion Markup Language** (SAML) – Une norme ouverte pour l’authentification unique basée sur la transmission d’assertions signées (généralement des objets XML) entre le fournisseur d’identité et la partie utilisatrice. +* **Sécurité des applications** – La sécurité au niveau des applications se concentre sur l'analyse des composants de la couche applicative du modèle de référence d'interconnexion des systèmes ouverts (OSI), plutôt que sur le système d'exploitation sous-jacent ou les réseaux connectés, par exemple. +* **Test boîte noire** – Méthode de test logiciel qui examine les fonctionnalités d'une application sans scruter ses structures ou son fonctionnement internes. +* **Tests dynamiques de sécurité des applications** (DAST) – Technologies conçues pour détecter les conditions indiquant une vulnérabilité de sécurité dans une application en cours d'exécution. +* **Time-of-check to time-of-use** (TOCTOU) - Situation dans laquelle une application vérifie l'état d'une ressource avant de l'utiliser, mais cet état peut être modifié entre la vérification et l'utilisation. Cela peut invalider les résultats de la vérification et entraîner des actions non valides de l'application en raison de cette incohérence d'état. +* **Time based One-time Passwords** (TOTPs) - Méthode de génération d'un OTP dans laquelle l'heure actuelle fait partie de l'algorithme de génération du mot de passe. +* **Transport Layer Security** (TLS) - Protocoles cryptographiques qui assurent la sécurité des communications sur une connexion réseau. +* **Traversée utilisant des relais autour de NAT** (TURN) – Extension du protocole STUN utilisant un serveur TURN comme relais lorsque les connexions "pair à pair" directes ne peuvent être établies. Défini dans la RFC 8656. +* **TLS mutuel** (mTLS) - Voir authentification client TLS. +* **Utilitaires de traversée de session pour NAT** (STUN) - Protocole utilisé pour faciliter la traversée NAT afin d'établir des communications "pair à pair". Défini dans la RFC 3489. +* **Validation des entrées** - Canonisation et validation des entrées utilisateur non fiables. +* **Vérificateur** – Personne ou équipe qui examine une demande par rapport aux exigences ASVS de l'OWASP. +* **Vérification automatisée** – Utilisation d'outils automatisés (analyse dynamique, analyse statique, ou les deux) qui utilisent les signatures de vulnérabilité pour détecter les problèmes. +* **Vérification de la conception** – Évaluation technique de l'architecture de sécurité d'une application. +* **Vérification de la sécurité des applications** – Évaluation technique d'une application par rapport à l'ASVS de l'OWASP. +* **Vérification dynamique** – Utilisation d'outils automatisés utilisant les signatures de vulnérabilité pour détecter les problèmes lors de l'exécution d'une application. +* **WebSocket sur TLS** (WSS) – Pratique de sécurisation des communications WebSocket en superposant WebSocket sur le protocole TLS. +* **What You See Is What You Get** (WYSIWYG) – Éditeur de contenu riche qui montre l'apparence réelle du contenu une fois rendu, plutôt que le codage utilisé pour gérer le rendu. diff --git a/5.0/fr/0x91-Appendix-B_References.md b/5.0/fr/0x91-Appendix-B_References.md new file mode 100644 index 0000000000..c982de0e9b --- /dev/null +++ b/5.0/fr/0x91-Appendix-B_References.md @@ -0,0 +1,43 @@ +# Annexe B : Références + +Les projets OWASP suivants sont les plus susceptibles d’être utiles aux utilisateurs/adoptants de cette norme : + +## Projets principaux de l'OWASP + +1. OWASP Top 10 Project : [https://owasp.org/www-project-top-ten/](https://owasp.org/www-project-top-ten/) +2. OWASP Web Security Testing Guide : [https://owasp.org/www-project-web-security-testing-guide/](https://owasp.org/www-project-web-security-testing-guide/) +3. OWASP Proactive Controls : [https://owasp.org/www-project-proactive-controls/](https://owasp.org/www-project-proactive-controls/) +4. OWASP Software Assurance Maturity Model (SAMM) : [https://owasp.org/www-project-samm/](https://owasp.org/www-project-samm/) +5. OWASP Secure Headers Project : [https://owasp.org/www-project-secure-headers/](https://owasp.org/www-project-secure-headers/) + +## Projet de la série de fiches aide-mémoire de l'OWASP + +[Ce projet](https://owasp.org/www-project-cheat-sheets/) contient plusieurs aide-mémoires qui seront pertinents pour différents sujets de l'ASVS. + +Il existe un mappage vers l'ASVS qui peut être trouvé ici : [https://cheatsheetseries.owasp.org/IndexASVS.html](https://cheatsheetseries.owasp.org/IndexASVS.html) + +## Projets liés à la sécurité mobile + +1. OWASP Mobile Security Project: [https://owasp.org/www-project-mobile-security/](https://owasp.org/www-project-mobile-security/) +2. OWASP Mobile Top 10 Risks: [https://owasp.org/www-project-mobile-top-10/](https://owasp.org/www-project-mobile-top-10/) +3. OWASP Mobile Security Testing Guide and Mobile Application Security Verification Standard: [https://owasp.org/www-project-mobile-security-testing-guide/](https://owasp.org/www-project-mobile-security-testing-guide/) + +## Projets Internet des objets de l'OWASP + +1. OWASP Internet of Things Project: [https://owasp.org/www-project-internet-of-things/](https://owasp.org/www-project-internet-of-things/) + +## Projets sans serveur OWASP + +1. OWASP Serverless Project : [https://owasp.org/www-project-serverless-top-10/](https://owasp.org/www-project-serverless-top-10/) + +## Autres + +De même, les sites Web suivants sont susceptibles d’être utiles aux utilisateurs/adoptants de cette norme + +1. SecLists Github : [https://github.com/danielmiessler/SecLists](https://github.com/danielmiessler/SecLists) +2. MITRE Common Weakness Enumeration : [https://cwe.mitre.org/](https://cwe.mitre.org/) +3. PCI Security Standards Council : [https://www.pcisecuritystandards.org/](https://www.pcisecuritystandards.org/) +4. PCI Data Security Standard (DSS) v3.2.1 Requirements and Security Assessment Procedures : [https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf](https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf) +5. PCI Software Security Framework - Secure Software Requirements and Assessment Procedures : [https://www.pcisecuritystandards.org/documents/PCI-Secure-Software-Standard-v1_0.pdf](https://www.pcisecuritystandards.org/documents/PCI-Secure-Software-Standard-v1_0.pdf) +6. PCI Secure Software Lifecycle (Secure SLC) Requirements and Assessment Procedures : [https://www.pcisecuritystandards.org/documents/PCI-Secure-SLC-Standard-v1_0.pdf](https://www.pcisecuritystandards.org/documents/PCI-Secure-SLC-Standard-v1_0.pdf) +7. OWASP ASVS 4.0 Testing Guide : [https://github.com/BlazingWind/OWASP-ASVS-4.0-testing-guide](https://github.com/BlazingWind/OWASP-ASVS-4.0-testing-guide) diff --git a/5.0/fr/0x92-Appendix-C_Cryptography.md b/5.0/fr/0x92-Appendix-C_Cryptography.md new file mode 100644 index 0000000000..aff573636d --- /dev/null +++ b/5.0/fr/0x92-Appendix-C_Cryptography.md @@ -0,0 +1,304 @@ +# Annexe C : Standards cryptographiques + +Le chapitre « Cryptographie » va au-delà de la simple définition des bonnes pratiques. Il vise à améliorer la compréhension des principes de cryptographie et à encourager l'adoption de méthodes de sécurité plus résilientes et modernes. Cette annexe fournit des informations techniques détaillées sur chaque exigence, en complément des normes générales décrites dans le chapitre « Cryptographie ». + +Cette annexe définit le niveau d'approbation des différents mécanismes cryptographiques : + +* Les mécanismes _Approuvés_ (A) peuvent être utilisés dans les applications. +* Les mécanismes _Hérités_ (L) ne devraient pas être utilisés dans les applications, mais peuvent néanmoins être utilisés uniquement pour assurer la compatibilité avec les applications ou le code existants. Bien que l'utilisation de ces mécanismes ne soit pas actuellement considérée comme une vulnérabilité en soi, ils devraient être remplacés par des mécanismes plus sûrs et évolutifs dès que possible. +* Les mécanismes _Interdits_ (D) ne devraient pas être utilisés car ils sont actuellement considérés comme cassés ou n'offrent pas une sécurité suffisante. + +Cette liste peut être modifiée dans le contexte d'une application donnée pour diverses raisons, notamment : + +* nouvelles évolutions dans le domaine de la cryptographie ; +* conformité à une réglementation. + +## Inventaire et documentation cryptographiques + +Cette section fournit des informations complémentaires +sur l'inventaire et la documentation cryptographiques V11.1. + +Il est important de s'assurer que tous les actifs cryptographiques, tels que les algorithmes, les clés et les certificats, sont régulièrement découverts, inventoriés et évalués. Pour le niveau 3, cela devrait inclure l'utilisation d'analyses statiques et dynamiques pour découvrir l'utilisation de la cryptographie dans une application. Des outils tels que les SAST et DAST peuvent être utiles, mais des outils dédiés pourraient être nécessaires pour une couverture plus complète. Voici quelques exemples d'outils gratuits : + +* [CryptoMon - Moniteur de cryptographie réseau - utilisant eBPF, écrit en python](https://github.com/Santandersecurityresearch/CryptoMon) +* [Cryptobom Forge Tool: Generating Comprehensive CBOMs from CodeQL Outputs](https://github.com/Santandersecurityresearch/cryptobom-forge) + +## Forces équivalentes des paramètres cryptographiques + +Les niveaux de sécurité relatifs des différents systèmes cryptographiques sont présentés dans ce tableau (extrait de [NIST SP 800-57 Partie 1](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final), p.71) : + +| Force de sécurité | Algorithmes à clés symétriques | Corps finis | Factorisation d'entiers | Courbe elliptique | +|--|--|--|--|--| +| <= 80 | 2TDEA | L = 1024
N = 160 | k = 1024 | f = 160-223 | +| 112 | 3TDEA | L = 2048
N = 224 | k = 2048 | f = 224-255 | +| 128 | AES-128 | L = 3072
N = 256 | k = 3072 | f = 256-383 | +| 192 | AES-192 | L = 7680
N = 384 | k = 7680 | f = 384-511 | +| 256 | AES-256 | L = 15360
N = 512 | k = 15360 | f = 512+ | + +Exemples d'applications : + +* Cryptographie à corps finis : DSA, FFDH, MQV +* Cryptographie à factorisation entière : RSA +* Cryptographie à courbes elliptiques : ECDSA, EdDSA, ECDH, MQV + +Remarque : cette section suppose qu'aucun ordinateur quantique n'existe ; si un tel ordinateur existait, les estimations des trois dernières colonnes ne seraient plus valides. + +## Valeurs aléatoires + +Cette section fournit des informations supplémentaires +sur les valeurs aléatoires de la version 11.5. + +| Nom | Version/Référence | Notes | Statut | +|:-:|:-:|:-:|:-:| +| `/dev/random` | Linux 4.8+ [(oct. 2016)](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=818e607b57c94ade9824dad63a96c2ea6b21baf3), également présent dans iOS, Android et d'autres systèmes d'exploitation POSIX basés sur Linux. Basé sur [RFC7539](https://datatracker.ietf.org/doc/html/rfc7539) | Utilise le flux ChaCha20. Trouvé dans iOS [`SecRandomCopyBytes`](https://developer.apple.com/documentation/security/secrandomcopybytes(_:_:_:)?language=objc) et Android [`Secure Random`](https://developer.android.com/reference/java/security/SecureRandom) avec les paramètres corrects fournis pour chacun. | A | +| `/dev/urandom` | Fichier spécial du noyau Linux pour fournir des données aléatoires | Fournit des sources d'entropie de haute qualité à partir du caractère aléatoire matériel | A | +| `AES-CTR-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | Tel qu'utilisé dans les implémentations courantes, telles que [l'API Windows CNG `BCryptGenRandom`](https://learn.microsoft.com/en-us/windows/win32/api/bcrypt/nf-bcrypt-bcryptgenrandom) définie par [`BCRYPT_RNG_ALGORITHM`](https://learn.microsoft.com/en-us/windows/win32/seccng/cng-algorithm-identifiers). | A | +| `HMAC-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | | A | +| `Hash-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | | A | +| `getentropy()` | [OpenBSD](https://man.openbsd.org/getentropy.2), disponible sous [Linux glibc 2.25+](https://man7.org/linux/man-pages/man3/getentropy.3.html) et [macOS 10.12+](https://support.apple.com/en-gb/guide/security/seca0c73a75b/web) | Fournit des octets aléatoires sécurisés directement depuis la source d'entropie du noyau, grâce à une API simple et minimale. Plus moderne, elle évite les pièges des anciennes API. | A | + +La fonction de hachage sous-jacente utilisée avec HMAC-DRBG ou Hash-DRBG doit être approuvée pour cette utilisation. + +## Algorithmes de chiffrement + +Cette section fournit des informations supplémentaires +sur les algorithmes de chiffrement V11.3. + +Les algorithmes de chiffrement approuvés sont classés par ordre de préférence. + +| Algorithmes à clé symétrique | Référence | Statut | +|--|--|--| +| AES-256 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | A | +| Salsa20 | [Salsa 20 specification](https://cr.yp.to/snuffle/spec.pdf) | A | +| XChaCha20 | [XChaCha20 Draft](https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-xchacha-03) | A | +| XSalsa20 | [Extending the Salsa20 nonce](https://cr.yp.to/snuffle/xsalsa-20110204.pdf) | A | +| ChaCha20 | [RFC 8439](https://www.rfc-editor.org/info/rfc8439) | A | +| AES-192 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | A | +| AES-128 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | L | +| 2TDEA | | D | +| TDEA (3DES/3DEA) | | D | +| IDEA | | D | +| RC4 | | D | +| Blowfish| | D | +| ARC4 | | D | +| DES | | D | + +### Modes de chiffrement AES + +Les chiffrements par blocs, comme AES, peuvent être utilisés avec différents modes opératoires. De nombreux modes, comme le livre de codes électronique (ECB), ne sont pas sécurisés et ne doivent pas être utilisés. Les modes Galois/Compteur (GCM) et Compteur avec chaînage de blocs et code d'authentification de message (CCM) assurent un chiffrement authentifié et doivent être utilisés dans les applications modernes. + +Les modes approuvés sont classés par ordre de préférence. + +| Mode | Authentifié | Référence | Statut | Restriction | +|--|--|--|--|--| +| GCM | Oui | [NIST SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | | +| CCM | Oui | [NIST SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | | +| CBC | Non | [NIST SP 800-38A](https://csrc.nist.gov/pubs/sp/800/38/a/final) | L | | +| CCM-8 | Oui | | D | | +| ECB | Non | | D | | +| CFB | Non | | D | | +| OFB | Non | | D | | +| CTR | Non | | D | | + +Remarques : + +* Tous les messages chiffrés doivent être authentifiés. Toute utilisation du mode CBC nécessite l'association d'un algorithme MAC de hachage pour valider le message. En général, cet algorithme doit être appliqué à la méthode « Chiffrer puis hacher » (mais TLS 1.2 utilise plutôt la méthode « Hash puis chiffrer »). Si cela ne peut être garanti, le mode CBC NE DOIT PAS être utilisé. La seule application où le chiffrement sans algorithme MAC est autorisé est le chiffrement de disque. +* Si le mode CBC est utilisé, la vérification du remplissage doit être garantie en temps constant. +* Lors de l'utilisation de CCM-8, la balise MAC ne dispose que de 64 bits de sécurité. Ceci n'est pas conforme à l'exigence 6.2.9 qui exige au moins 128 bits de sécurité. +* Le chiffrement de disque est considéré comme hors du périmètre de l'ASVS. Par conséquent, cette annexe ne répertorie aucune méthode approuvée pour le chiffrement de disque. Pour cette utilisation, le chiffrement sans authentification est généralement accepté et les modes XTS, XEX et LRW sont généralement utilisés. + +### key wrapping + +L'encapsulation (et le déchiffrement) d'une clé cryptographique est une méthode de protection d'une clé existante par encapsulation (c'est-à-dire par encapsulation) grâce à un mécanisme de chiffrement supplémentaire, afin que la clé d'origine ne soit pas exposée de manière visible, par exemple lors d'un transfert. Cette clé supplémentaire, utilisée pour protéger la clé d'origine, est appelée clé d'encapsulation. + +Cette opération peut être effectuée lorsqu'il est souhaitable de protéger des clés dans des emplacements jugés non fiables, ou d'envoyer des clés sensibles sur des réseaux non fiables ou au sein d'applications. +Cependant, il est important de bien comprendre la nature (par exemple, l'identité et la finalité) de la clé d'origine avant de s'engager dans une procédure d'encapsulation/déchiffrement, car cela peut avoir des répercussions sur les systèmes/applications sources et cibles en termes de sécurité, et notamment de conformité, ce qui peut inclure des pistes d'audit de la fonction d'une clé (par exemple, la signature) ainsi qu'un stockage approprié des clés. + +Plus précisément, AES-256 doit être utilisé pour l'encapsulation des clés, conformément à la norme NIST SP 800-38F (https://csrc.nist.gov/pubs/sp/800/38/f/final) et en tenant compte des dispositions prospectives contre la menace quantique. Les modes de chiffrement utilisant AES sont les suivants, par ordre de préférence : + +| Enveloppement de clé | Référence | Statut | +|--|--|--| +| KW | [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) | A | +| KWP | [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) | A | + +AES-192 et AES-128 PEUVENT être utilisés si le cas d'utilisation l'exige, mais leur motivation DOIT être documentée dans l'inventaire cryptographique de l'entité. + +### Chiffrement authentifié + +À l'exception du chiffrement du disque, les données chiffrées doivent être protégées contre toute modification non autorisée à l'aide d'un schéma de chiffrement authentifié (AE), généralement un schéma de chiffrement authentifié avec données associées (AEAD). + +L'application doit de préférence utiliser un schéma AEAD approuvé. Elle peut également combiner un schéma de chiffrement approuvé et un algorithme MAC approuvé avec une construction « Chiffrer puis MAC ». + +La méthode « MAC puis chiffrer » est toujours autorisée pour des raisons de compatibilité avec les applications existantes. Elle est utilisée dans TLS v1.2 avec les anciennes suites de chiffrement. + +| Mécanisme AEAD | Référence | Statut | +|--------------------------|---------|-----| +|AES-GCM | [SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | +|AES-CCM | [SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | +|ChaCha-Poly1305 | [RFC 7539](https://datatracker.ietf.org/doc/html/rfc7539) | A | +|AEGIS-256 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +|AEGIS-128 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +|AEGIS-128L| [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +|Encrypt-then-MAC | | A | +|MAC-then-encrypt | | L | + +## Fonctions de hachage + +Cette section fournit des informations supplémentaires +sur le hachage V11.4 et les fonctions basées sur le hachage. + +### Fonctions de hachage pour les cas d'utilisation généraux + +Le tableau suivant répertorie les fonctions de hachage approuvées pour les cas d'utilisation cryptographiques généraux, tels que les signatures numériques : + +* Les fonctions de hachage approuvées offrent une forte résistance aux collisions et conviennent aux applications de haute sécurité. +* Certains de ces algorithmes offrent une forte résistance aux attaques lorsqu'ils sont utilisés avec une gestion appropriée des clés cryptographiques. Ils sont donc également approuvés pour les fonctions HMAC, KDF et RBG. +* Les fonctions de hachage dont le résultat est inférieur à 254 bits présentent une résistance aux collisions insuffisante et ne doivent pas être utilisées pour la signature numérique ou d'autres applications nécessitant une résistance aux collisions. Pour d'autres utilisations, elles peuvent être utilisées à des fins de compatibilité et de vérification UNIQUEMENT avec les systèmes existants, mais ne doivent pas être utilisées dans les nouvelles conceptions. + +| Fonction de hachage | Référence | Statut | Restrictions | +| -------------- | ------------------------------------------------------------- |--|--| +| SHA3-512 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| SHA-512 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHA3-384 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| SHA-384 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHA3-256 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| SHA-512/256 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHA-256 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHAKE256 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| BLAKE2s | [BLAKE2: simpler, smaller, fast as MD5](https://eprint.iacr.org/2013/322) | A | | +| BLAKE2b | [BLAKE2: simpler, smaller, fast as MD5](https://eprint.iacr.org/2013/322) | A | | +| BLAKE3 | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | | +| SHA-224 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | L | Ne convient pas aux signatures numériques HMAC, KDF, RBG | +| SHA-512/224 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | L | Ne convient pas aux signatures numériques HMAC, KDF, RBG | +| SHA3-224 | [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | L | Ne convient pas aux signatures numériques HMAC, KDF, RBG | +| SHA-1 | [RFC 3174](https://www.rfc-editor.org/info/rfc3174) et [RFC 6194](https://www.rfc-editor.org/info/rfc6194) | L | Ne convient pas aux signatures numériques HMAC, KDF, RBG | +| CRC (toute longueur) | | D | | +| MD4 | [RFC 1320](https://www.rfc-editor.org/info/rfc1320) | D | | +| MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | | + +### Fonctions de hachage pour le stockage des mots de passe + +Pour un hachage sécurisé des mots de passe, des fonctions de hachage dédiées doivent être utilisées. Ces algorithmes de hachage lent atténuent les attaques par force brute et par dictionnaire en augmentant la difficulté de calcul du craquage des mots de passe. + +| KDF | Référence | Paramètres requis | Statut | +| --- | --------- | ------------------- | ------ | +| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1
t = 2: m ≥ 19456 (19 MiB), p = 1
t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | +| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8
p = 2: N ≥ 2^16 (64 MiB), r = 8
p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | +| bcrypt | [A Future-Adaptable Password Scheme](https://www.researchgate.net/publication/2519476_A_Future-Adaptable_Password_Scheme) | coût ≥ 10 | A | +| PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | itérations ≥ 210,000 | A | +| PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | itérations ≥ 600,000 | A | +| PBKDF2-HMAC-SHA-1 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | itérations ≥ 1,300,000 | L | + +Les fonctions de dérivation de clés basées sur des mots de passe approuvées peuvent être utilisées pour le stockage des mots de passe. + +## Fonctions de dérivations de clés (KDFs) + +### Fonctions de dérivations de clés générales + +| KDF | Référence | Statut | +| ---------------- | --------------------------------------------------------------------------------------------- | ------ | +| HKDF | [RFC 5869](https://www.rfc-editor.org/info/rfc5869) | A | +| TLS 1.2 PRF | [RFC 5248](https://www.rfc-editor.org/info/rfc5248) | L | +| KDFs à base de MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | +| KDFs à base de SHA-1 | [RFC 3174](https://www.rfc-editor.org/info/rfc3174), [RFC 6194](https://www.rfc-editor.org/info/rfc6194) | D | + +### Fonctions de dérivations de clés à base de mot de passe + +| KDF | Référence | Paramètres requis | Statut | +| --- | --------- | ------------------- | ------ | +| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1
t = 2: m ≥ 19456 (19 MiB), p = 1
t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | +| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8
p = 2: N ≥ 2^16 (64 MiB), r = 8
p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | +| PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | itérations ≥ 210,000 | A | +| PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | itérations ≥ 600,000 | A | +| PBKDF2-HMAC-SHA-1 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | itérations ≥ 1,300,000 | L | + +## Mécanismes d'échange de clés + +Cette section fournit des informations complémentaires +sur la cryptographie à clé publique V11.6. + +### Systèmes KEX + +Une force de sécurité de 112 bits ou plus DOIT être garantie pour tous les méthodes d'échange de clés, et leur mise en œuvre DOIT suivre les choix de paramètres dans le tableau suivant. + +| Schéma | Paramètres du domaine | Confidentialité persistante | Statut | +|--|--|--|--| +| Diffie-Hellman à corps finis (FFDH) | L >= 3072 et N >= 256 | Oui | A | +| Courbe elliptique Diffie-Hellman (ECDH) | f >= 256-383 | Oui | A | +| Transport de clés chiffrées avec RSA-PKCS#1 v1.5 | | Non | D | + +Où les paramètres suivants sont : + +* k est la taille de la clé RSA. +* L est la taille de la clé publique et N est la taille de la clé privée pour la cryptographie à corps finis. +* f est la plage de tailles de clés pour ECC. + +Toute nouvelle implémentation NE DOIT PAS utiliser de schéma non conforme aux normes [NIST SP 800-56A](https://csrc.nist.gov/pubs/sp/800/56/a/r3/final) et [B](https://csrc.nist.gov/pubs/sp/800/56/b/r2/final) et [NIST SP 800-77](https://csrc.nist.gov/pubs/sp/800/77/r1/final). Plus précisément, IKEv1 NE DOIT PAS être utilisé en production. + +### Groupes Diffie-Hellman + +Les groupes suivants sont approuvés pour la mise en œuvre de l'échange de clés Diffie-Hellman. Les niveaux de sécurité sont décrits dans la norme NIST SP 800-56A (https://csrc.nist.gov/pubs/sp/800/56/a/r3/final), l'annexe D et la norme NIST SP 800-57, partie 1, révision 5 (https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final). + +| Groupe | Statut | +|------------------|--------| +| P-224, secp224r1 | A | +| P-256, secp256r1 | A | +| P-384, secp384r1 | A | +| P-521, secp521r1 | A | +| K-233, sect233k1 | A | +| K-283, sect283k1 | A | +| K-409, sect409k1 | A | +| K-571, sect571k1 | A | +| B-233, sect233r1 | A | +| B-283, sect283r1 | A | +| B-409, sect409r1 | A | +| B-571, sect571r1 | A | +| Curve448 | A | +| Curve25519 | A | +| MODP-2048 | A | +| MODP-3072 | A | +| MODP-4096 | A | +| MODP-6144 | A | +| MODP-8192 | A | +| ffdhe2048 | A | +| ffdhe3072 | A | +| ffdhe4096 | A | +| ffdhe6144 | A | +| ffdhe8192 | A | + +## Codes d'authentification des messages (MAC) + +Les codes d'authentification de message (MAC) sont des structures cryptographiques permettant de vérifier l'intégrité et l'authenticité d'un message. Un MAC prend en entrée un message et une clé secrète et génère une étiquette de taille fixe (la valeur MAC). Les MAC sont largement utilisés dans les protocoles de communication sécurisés (par exemple, TLS/SSL) pour garantir l'authenticité et l'intégrité des messages échangés entre les parties. + +| Algorithme MAC | Référence | Statut | Restrictions | +| --------------| ----------------------------------------------------------------------------------------- | -------| ------------ | +| HMAC-SHA-256 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) et [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | | +| HMAC-SHA-384 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) et [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | | +| HMAC-SHA-512 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) et [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | | +| KMAC128 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | | +| KMAC256 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | | +| BLAKE3 (mode keyed_hash) | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | | +| AES-CMAC | [RFC 4493](https://datatracker.ietf.org/doc/html/rfc4493) et [NIST SP 800-38B](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38b.pdf) | A | | +| AES-GMAC | [NIST SP 800-38D](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf) | A | | +| Poly1305-AES | [The Poly1305-AES message-authentication code](https://cr.yp.to/mac/poly1305-20050329.pdf) | A | | +| HMAC-SHA-1 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) et [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | L | | +| HMAC-MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | | + +## Signatures numériques + +Les schémas de signature DOIVENT utiliser des tailles de clés et des paramètres approuvés conformément à la norme [NIST SP 800-57 Partie 1](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final). + +| Algorithme de signature | Référence | Statut | +| ------------------------------ | ---------------------------------------------------------- | ------ | +| EdDSA (Ed25519, Ed448) | [RFC 8032](https://www.rfc-editor.org/info/rfc8032) | A | +| XEdDSA (Curve25519, Curve448) | [XEdDSA](https://signal.org/docs/specifications/xeddsa/) | A | +| ECDSA (P-256, P-384, P-521) | [FIPS 186-4](https://csrc.nist.gov/pubs/fips/186-5/final) | A | +| RSA-RSSA-PSS | [RFC 8017](https://www.rfc-editor.org/info/rfc8017) | A | +| RSA-SSA-PKCS#1 v1.5 | [RFC 8017](https://www.rfc-editor.org/info/rfc8017) | D | +| DSA (n'importe quelle taille de clé) | [FIPS 186-4](https://csrc.nist.gov/pubs/fips/186-4/final) | D | + +## Normes de chiffrement post-quantique + +Les mises en œuvre de la cryptographie post-quantique (PQC) doivent respecter les normes [FIPS-203](https://csrc.nist.gov/pubs/fips/203/ipd), [FIPS-204](https://csrc.nist.gov/pubs/fips/204/ipd) et [FIPS-205](https://csrc.nist.gov/pubs/fips/205/ipd). À l'heure actuelle, il n'existe pas beaucoup d'exemples de codes renforcés ou d'implémentations de référence disponibles pour ces normes. Pour plus de détails, voir [l'annonce par le NIST des trois premières normes de chiffrement post-quantique finalisées (août 2024)](https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards). + +La méthode d'accord de clé TLS hybride post-quantique proposée [mlkem768x25519](https://datatracker.ietf.org/doc/draft-kwiatkowski-tls-ecdhe-mlkem/03/) est prise en charge par les principaux navigateurs tels que [Firefox version 132](https://www.mozilla.org/en-US/firefox/132.0/releasenotes/) et [Chrome version 131](https://security.googleblog.com/2024/09/a-new-path-for-kyber-on-web.html). Elle peut être utilisée dans des environnements de test cryptographique ou lorsqu'elle est disponible dans des bibliothèques approuvées par l'industrie ou le gouvernement. diff --git a/5.0/fr/0x93-Appendix-D_Recommendations.md b/5.0/fr/0x93-Appendix-D_Recommendations.md new file mode 100644 index 0000000000..8c77ce077b --- /dev/null +++ b/5.0/fr/0x93-Appendix-D_Recommendations.md @@ -0,0 +1,49 @@ +# Annexe D : Recommandations + +## Introduction + +Lors de la préparation de la version 5.0 de la norme de vérification de la sécurité des applications (ASVS), il est apparu clairement que plusieurs éléments, existants ou nouvellement proposés, ne devaient pas être inclus comme exigences dans la version 5.0. Cela peut s'expliquer par le fait qu'ils n'entraient pas dans le champ d'application de l'ASVS selon la définition de la version 5.0, ou bien par le fait que, malgré leur pertinence, ils ne pouvaient être rendus obligatoires. + +Ne voulant pas perdre tous ces éléments entièrement, certains ont été capturés dans cette annexe. + +## Mécanismes de périmètre recommandés + +Les éléments suivants sont concernés par ASVS. Ils ne devraient pas être rendus obligatoires, mais il est fortement recommandé de les prendre en compte dans le cadre d'une application sécurisée. + +* Un indicateur de sécurité des mots de passe devrait être fourni pour aider les utilisateurs à définir un mot de passe plus fort. +* Créez un fichier security.txt accessible au public à la racine ou dans le répertoire .well-known de l'application, définissant clairement un lien ou une adresse e-mail permettant de contacter les propriétaires en cas de problème de sécurité. +* La validation des entrées côté client devrait être appliquée en plus de la validation au niveau d'une couche de service de confiance, car cela permet de détecter si un utilisateur a contourné les contrôles côté client pour tenter d'attaquer l'application. +* Empêchez l'affichage de pages sensibles et accessibles accidentellement dans les moteurs de recherche à l'aide d'un fichier robots.txt, de l'en-tête de réponse X-Robots-Tag ou d'une balise méta HTML robots. +* Lorsque vous utilisez GraphQL, implémentez la logique d'autorisation au niveau de la couche logique métier plutôt que dans la couche GraphQL ou du résolveur afin d'éviter de gérer l'autorisation sur chaque interface distincte. + +Références : + +* [Plus d'informations sur security.txt, y compris un lien vers la RFC](https://securitytxt.org/) + +## Principes de sécurité des logiciels + +Les éléments suivants figuraient déjà dans ASVS, mais ne constituent pas de véritables exigences. Il s'agit plutôt de principes à prendre en compte lors de la mise en œuvre de contrôles de sécurité, dont le respect permettra de renforcer la robustesse. Parmi ceux-ci : + +* Les contrôles de sécurité doivent être centralisés, simples (économie de conception), vérifiables et réutilisables. Cela permet d'éviter les contrôles dupliqués, manquants ou inefficaces. +* Dans la mesure du possible, utilisez des implémentations de contrôle de sécurité préalablement écrites et bien contrôlées plutôt que de vous fier à la mise en œuvre de contrôles à partir de zéro. +* Idéalement, un mécanisme de contrôle d'accès unique devrait être utilisé pour accéder aux données et ressources protégées. Toutes les requêtes devraient transiter par ce mécanisme unique afin d'éviter les copier-coller ou les chemins alternatifs non sécurisés. +* Le contrôle d'accès basé sur les attributs ou les fonctionnalités est un modèle recommandé : le code vérifie l'autorisation de l'utilisateur pour une fonctionnalité ou un élément de données, plutôt que simplement son rôle. Les autorisations doivent toujours être attribuées à l'aide de rôles. + +## Processus de sécurité des logiciels + +Plusieurs processus de sécurité ont été supprimés d'ASVS 5.0, mais restent pertinents. Le projet OWASP SAMM pourrait être une bonne source d'inspiration pour une mise en œuvre efficace de ces processus. Parmi les éléments précédemment présents dans ASVS, on peut citer : + +* Vérifier l'utilisation d'un cycle de vie sécurisé pour le développement de logiciels qui prend en compte la sécurité à tous les stades du développement. +* Vérifier l'utilisation de la modélisation des menaces pour chaque changement de conception ou planification de sprint afin d'identifier les menaces, de planifier les contre-mesures, de faciliter les réponses appropriées aux risques et d'orienter les tests de sécurité. +* Vérifier que toutes les histoires d'utilisateurs et les caractéristiques contiennent des contraintes de sécurité fonctionnelles, telles que "En tant qu'utilisateur, je devrais être en mesure de voir et de modifier mon profil. Je ne dois pas pouvoir consulter ou modifier le profil de quelqu'un d'autre" +* Vérifier la disponibilité d'une liste de contrôle de codage sécurisé, d'exigences de sécurité, de lignes directrices ou d'une politique pour tous les développeurs et les testeurs. +* Vérifier l'existence d'un processus permanent visant à garantir que le code source de l'application est exempt de portes dérobées, de codes malveillants (attaques par salami, bombes logiques, bombes à retardement) et de caractéristiques non documentées ou cachées (œufs de Pâques, outils de débogage non sécurisés). Il n'est pas possible de se conformer à cette section sans un accès complet au code source, y compris aux bibliothèques tierces, et cela ne convient donc probablement qu'aux applications exigeant les niveaux de sécurité les plus élevés. +* Vérifier que des mécanismes sont en place pour détecter les dérives de configuration dans les environnements déployés et y répondre. Il peut s'agir de l'utilisation d'une infrastructure immuable, d'un redéploiement automatisé à partir d'une base sécurisée ou d'outils de détection de dérive qui comparent l'état actuel aux configurations approuvées. +* Vérifier que le durcissement de la configuration est effectué sur tous les produits tiers, les bibliothèques, + +Références: + +* [OWASP Threat Modeling Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html) +* [OWASP Threat modeling](https://owasp.org/www-community/Application_Threat_Modeling) +* [OWASP Software Assurance Maturity Model Project](https://owasp.org/www-project-samm/) +* [Microsoft SDL](https://www.microsoft.com/en-us/securityengineering/sdl/) diff --git a/5.0/fr/0x94-Appendix-E_Contributors.md b/5.0/fr/0x94-Appendix-E_Contributors.md new file mode 100644 index 0000000000..40f1767efb --- /dev/null +++ b/5.0/fr/0x94-Appendix-E_Contributors.md @@ -0,0 +1,71 @@ +# Appendix E - Contributeurs + +Nous remercions les personnes suivantes pour leurs contributions, leurs commentaires et leurs demandes d'extension depuis la publication de ASVS 4.0.0. + +Si vous avez connaissance d'erreurs ou si vous souhaitez que votre nom apparaisse différemment, merci de nous le faire savoir. + +| | | | | +|---|---|---|---| +| Johan Sydseter ([sydseter](https://github.com/sydseter)) | luis servin ([lfservin](https://github.com/lfservin)) | Oleksii Dovydkov ([oleksiidov](https://github.com/oleksiidov)) | IZUKA Masahiro ([maizuka](https://github.com/maizuka)) | +| James Sulinski ([jsulinski](https://github.com/jsulinski)) | Eli Saad ([ThunderSon](https://github.com/ThunderSon)) | [kkshitish9](https://github.com/kkshitish9) | Andrew van der Stock ([vanderaj](https://github.com/vanderaj)) | +| Rick M ([kingthorin](https://github.com/kingthorin)) | Bankde Eakasit ([Bankde](https://github.com/Bankde)) | Michael Gargiullo ([mgargiullo](https://github.com/mgargiullo)) | Raphael Dunant ([Racater](https://github.com/Racater)) | +| Cesar Kohl ([cesarkohl](https://github.com/cesarkohl)) | [inaz0](https://github.com/inaz0) | Joerg Bruenner ([JoergBruenner](https://github.com/JoergBruenner)) | David Deatherage ([securitydave](https://github.com/securitydave)) | +| John Carroll ([yosignals](https://github.com/yosignals)) | Jim Fenton ([jimfenton](https://github.com/jimfenton)) | Matteo Pace ([M4tteoP](https://github.com/M4tteoP)) | Sebastien gioria ([SPoint42](https://github.com/SPoint42)) | +| Steven van der Baan ([vdbaan](https://github.com/vdbaan)) | Jeremy Bonghwan Choi ([jeremychoi](https://github.com/jeremychoi)) | [craig-shony](https://github.com/craig-shony) | Riccardo Sirigu ([ricsirigu](https://github.com/ricsirigu)) | +| Tomasz Wrobel ([tw2as](https://github.com/tw2as)) | Alena Dubeshko ([belalena](https://github.com/belalena)) | Rafael Green ([RafaelGreen1](https://github.com/RafaelGreen1)) | [mjang-cobalt](https://github.com/mjang-cobalt) | +| [clallier94](https://github.com/clallier94) | Kevin W. Wall ([kwwall](https://github.com/kwwall)) | Jordan Sherman ([jsherm-fwdsec](https://github.com/jsherm-fwdsec) / [deleterepo](https://github.com/deleterepo)) | Ingo Rauner ([ingo-rauner](https://github.com/ingo-rauner)) | +| Dirk Wetter ([drwetter](https://github.com/drwetter)) | Moshe Zioni ([moshe-apiiro](https://github.com/moshe-apiiro)) | Patrick Dwyer ([coderpatros](https://github.com/coderpatros)) | David Clarke ([davidclarke-au](https://github.com/davidclarke-au)) | +| Takaharu Ogasa ([takaharuogasa](https://github.com/takaharuogasa)) | Arkadii Yakovets ([arkid15r](https://github.com/arkid15r)) | Motoyasu Saburi ([motoyasu-saburi](https://github.com/motoyasu-saburi)) | [leirn](https://github.com/leirn) | +| [wet-certitude](https://github.com/wet-certitude) | [timhemel](https://github.com/timhemel) | RL Thornton ([thornshadow99](https://github.com/thornshadow99)) | Thomas Bandt ([aspnetde](https://github.com/aspnetde)) | +| Roel Storms ([roelstorms](https://github.com/roelstorms)) | Jeroen Willemsen ([commjoen](https://github.com/commjoen)) | [anonymous-31](https://github.com/anonymous-31) | Kamran Saifullah ([deFr0ggy](https://github.com/deFr0ggy)) | +| Steve Springett ([stevespringett](https://github.com/stevespringett)) | Spyros ([northdpole](https://github.com/northdpole)) | Hans Herrera ([hansphp](https://github.com/hansphp)) | [Marx314](https://github.com/Marx314) | +| [CarlosAllendes](https://github.com/CarlosAllendes) | Yonah Russ ([yruss972](https://github.com/yruss972)) | Sander Maijers ([sanmai-NL](https://github.com/sanmai-NL)) | Luboš Bretschneider ([bretik](https://github.com/bretik)) | +| Eva Sarafianou ([esarafianou](https://github.com/esarafianou)) | Ata Seren [ataseren](https://github.com/ataseren) | Steve Thomas ([Sc00bz](https://github.com/Sc00bz)) | Dominique RIGHETTO ([righettod](https://github.com/righettod)) | +| Steven van der Baan ([svdb-ncc](https://github.com/svdb-ncc)) | Michael Vacarella ([Aif4thah](https://github.com/Aif4thah)) | Tonimir Kisasondi ([tkisason](https://github.com/tkisason)) | Stefan Streichsbier ([streichsbaer](https://github.com/streichsbaer)) | +| [hi-unc1e](https://github.com/hi-unc1e) | sb3k ([starbuck3000](https://github.com/starbuck3000)) | [mario-platt](https://github.com/mario-platt) | Devdatta Akhawe ([devd](https://github.com/devd)) | +| Michael Gissing ([scolytus](https://github.com/scolytus)) | Jet Anderson ([thatsjet](https://github.com/thatsjet)) | Dave Wichers ([davewichers](https://github.com/davewichers)) | Jonny Schnittger ([JonnySchnittger](https://github.com/JonnySchnittger)) | +| Silvia Väli ([silviavali](https://github.com/silviavali)) | [jackgates73](https://github.com/jackgates73) | [1songb1rd](https://github.com/1songb1rd) | Timur - ([timurozkul](https://github.com/timurozkul)) | +| Gareth Heyes ([hackvertor](https://github.com/hackvertor)) | [appills](https://github.com/appills) | [suvikaartinen](https://github.com/suvikaartinen) | chaals ([chaals](https://github.com/chaals)) | +| DanielPharos ([AtlasHackert](https://github.com/AtlasHackert)) | will Farrell ([willfarrell](https://github.com/willfarrell)) | Alina Vasiljeva ([avasiljeva](https://github.com/avasiljeva)) | Paul McCann ([ismisepaul](https://github.com/ismisepaul)) | +| Sage ([SajjadPourali](https://github.com/SajjadPourali)) | [rbsec](https://github.com/rbsec) | Benedikt Bauer ([mastacheata](https://github.com/mastacheata)) | James Jardine ([jamesjardine](https://github.com/jamesjardine)) | +| Mark Burnett ([m8urnett](https://github.com/m8urnett)) | [dschwarz91](https://github.com/dschwarz91) | Cyber-AppSec ([Cyber-AppSec](https://github.com/Cyber-AppSec)) | [Tib3rius](https://github.com/Tib3rius) | +| BitnessWise ([bitnesswise](https://github.com/bitnesswise)) | damienbod ([damienbod](https://github.com/damienbod)) | Jared Meit ([jmeit-fwdsec](https://github.com/jmeit-fwdsec)) | Stefan Seelmann ([sseelmann](https://github.com/sseelmann)) | +| Brendan O'Connor ([ussjoin](https://github.com/ussjoin)) | Andrei Titov ([andrettv](https://github.com/andrettv)) | Hans-Petter Fjeld ([atluxity](https://github.com/atluxity)) | [markehack](https://github.com/markehack) | +| Neil Madden ([NeilMadden](https://github.com/NeilMadden)) | Michael Geramb ([mgeramb](https://github.com/mgeramb)) | Osama Elnaggar ([ossie-git](https://github.com/ossie-git)) | [mackowski](https://github.com/mackowski) | +| Ravi Balla ([raviballa](https://github.com/raviballa)) | Hazana ([hazanasec](https://github.com/hazanasec)) | David Means ([dmeans82](https://github.com/dmeans82)) | Alexander Stein ([tohch4](https://github.com/tohch4)) | +| BaeSenseii ([baesenseii](https://github.com/baesenseii)) | Vincent De Schutter ([VincentDS](https://github.com/VincentDS)) | S Bani ([sbani](https://github.com/sbani)) | Mitsuaki Akiyama ([mak1yama](https://github.com/mak1yama)) | +| Christopher Loessl ([hashier](https://github.com/hashier)) | [victorxm](https://github.com/victorxm) | Michal Rada ([michalradacz](https://github.com/michalradacz)) | Veeresh Devireddy ([drveresh](https://github.com/drveresh)) | +| [MaknaSEO](https://github.com/MaknaSEO) | [darkzero2022](https://github.com/darkzero2022) | Liam ([LiamDobbelaere](https://github.com/LiamDobbelaere)) | Frank Denis ([jedisct1](https://github.com/jedisct1)) | +| Otto Sulin ([ottosulin](https://github.com/ottosulin)) | [carllaw6885](https://github.com/carllaw6885) | Anders Johan Holmefjord ([aholmis](https://github.com/aholmis)) | Richard Fritsch ([rfricz](https://github.com/rfricz)) | +| [mesutgungor](https://github.com/mesutgungor) | Scott Helme ([ScottHelme](https://github.com/ScottHelme)) | Carlo Reggiani ([carloreggiani](https://github.com/carloreggiani)) | Suyash Srivastava ([suyash5053](https://github.com/suyash5053)) | +| Mark Potter ([markonweb](https://github.com/markonweb)) | Arjan Lamers ([alamers](https://github.com/alamers)) | Gøran Breivik ([gobrtg](https://github.com/gobrtg)) | [flo-blg](https://github.com/flo-blg) | +| Guillaume Déflache ([guillaume-d](https://github.com/guillaume-d)) | Toufik Airane ([toufik-airane](https://github.com/toufik-airane)) | Keith Hoodlet ([securingdev](https://github.com/securingdev)) | Sinner ([SoftwareSinner](https://github.com/SoftwareSinner)) | +| [iloving](https://github.com/iloving) | Jeroen Beckers ([TheDauntless](https://github.com/TheDauntless)) | Joubin Jabbari ([joubin](https://github.com/joubin)) | yu fujioka ([fujiokayu](https://github.com/fujiokayu)) | +| execjosh ([execjosh](https://github.com/execjosh)) | Alicja Kario ([tomato42](https://github.com/tomato42)) | Sidney Ribeiro ([srjsoftware](https://github.com/srjsoftware)) | Gabriel Marquet ([Gby56](https://github.com/Gby56)) | +| Drew Schulz ([drschulz](https://github.com/drschulz)) | [bedirhan](https://github.com/bedirhan) | [muralito](https://github.com/muralito) | Ronnie Flathers ([ropnop](https://github.com/ropnop)) | +| Philippe De Ryck ([philippederyck](https://github.com/philippederyck)) | Malte ([mal33](https://github.com/mal33)) | [MazeOfThoughts](https://github.com/MazeOfThoughts) | Andreas Falk ([andifalk](https://github.com/andifalk)) | +| Javi ([javixeneize](https://github.com/javixeneize)) | Daniel Hahn ([averell23](https://github.com/averell23)) | [borislav-c](https://github.com/borislav-c) | Robin Wood ([digininja](https://github.com/digininja)) | +| [miro2ns](https://github.com/miro2ns) | Jan Dockx ([jandockx](https://github.com/jandockx)) | [vipinsaini434](https://github.com/vipinsaini434) | [priyanshukumar397](https://github.com/priyanshukumar397) | +| Nat Sakimura ([sakimura](https://github.com/sakimura)) | Benjamin Häublein ([BenjaminHae](https://github.com/BenjaminHae)) | [unknown-user-from](https://github.com/unknown-user-from) | Ali Ramazan TAŞDELEN ([alitasdln](https://github.com/alitasdln)) | +| Pedro Escaleira ([oEscal](https://github.com/oEscal)) | Josh ([josh-hemphill](https://github.com/josh-hemphill)) | Tim Würtele ([SECtim](https://github.com/SECtim)) | AviD ([avidouglen](https://github.com/avidouglen)) | +| SheHacksPurple ([shehackspurple](https://github.com/shehackspurple)) | [fcerullo-cycubix](https://github.com/fcerullo-cycubix) | Hector Eryx Paredes Camacho ([heryxpc](https://github.com/heryxpc)) | Irene Michlin ([irene221b](https://github.com/irene221b)) | +| Jonah Y-M ([TG-Techie](https://github.com/TG-Techie)) | Dhiraj Bahroos ([bahroos](https://github.com/bahroos)) | Jef Meijvis ([jefmeijvis](https://github.com/jefmeijvis)) | [IzmaDoesItbeta](https://github.com/IzmaDoesItbeta) | +| Abdessamad TEMMAR ([TmmmmmR](https://github.com/TmmmmmR)) | [sectroyer](https://github.com/sectroyer) | Soh Satoh ([sohsatoh](https://github.com/sohsatoh)) | [regoravalaz](https://github.com/regoravalaz) | +| james-t ([james-bitherder](https://github.com/james-bitherder)) | Aram Hovsepyan ([aramhovsepyan](https://github.com/aramhovsepyan)) | [JaimeGomezGarciaSan](https://github.com/JaimeGomezGarciaSan) | [ValdiGit01](https://github.com/ValdiGit01) | +| iwatachan ([ishowta](https://github.com/ishowta)) | Vinod Anandan ([VinodAnandan](https://github.com/VinodAnandan)) | Kevin Kien ([KevinKien](https://github.com/KevinKien)) | [paul-williamson-swoop](https://github.com/paul-williamson-swoop) | +| [endergzr](https://github.com/endergzr) | Radhwan Alshamamri ([Rado0z](https://github.com/Rado0z)) | Grant Ongers ([rewtd](https://github.com/rewtd)) | Cure53 ([cure53](https://github.com/cure53)) | +| [AliR2Linux](https://github.com/AliR2Linux) | Ads Dawson ([GangGreenTemperTatum](https://github.com/GangGreenTemperTatum)) | William Reyor ([BillReyor](https://github.com/BillReyor)) | gabe ([gcrow](https://github.com/gcrow)) | +| [mascotter](https://github.com/mascotter) | [luissaiz](https://github.com/luissaiz) | Suren Manukyan ([vx-sec](https://github.com/vx-sec)) | Piotr Gliźniewicz ([pglizniewicz](https://github.com/pglizniewicz)) | +| Tadeusz Wachowski ([tadeuszwachowski](https://github.com/tadeuszwachowski)) | Nasir aka Nate ([andesec](https://github.com/andesec)) | [settantasette](https://github.com/settantasette) | Lars Haulin ([LarsH](https://github.com/LarsH)) | +| Terence Eden ([edent](https://github.com/edent)) | [JasmineScholz](https://github.com/JasmineScholz) | Arun Sivadasan ([teavanist](https://github.com/teavanist)) | Yusuf GÜR ([yusuffgur](https://github.com/yusuffgur)) | +| Troy Marshall ([troymarshall](https://github.com/troymarshall)) | Tanner Prynn ([tprynn](https://github.com/tprynn)) | Nick K. ([nickific](https://github.com/nickific)) | [raoul361](https://github.com/raoul361) | +| Azeem Ilyas ([TheAxZim](https://github.com/TheAxZim)) | Evo Stamatov ([avioli](https://github.com/avioli)) | Tim Potter ([timpotter87](https://github.com/timpotter87)) | Gavin Ray ([GavinRay97](https://github.com/GavinRay97)) | +| monis ([demideus](https://github.com/demideus)) | Marcin Hoppe ([MarcinHoppe](https://github.com/MarcinHoppe)) | Grambulf ([ramshazar](https://github.com/ramshazar)) | Jordan Pike ([computersarebad](https://github.com/computersarebad)) | +| Jason Rogers ([jason-invision](https://github.com/jason-invision)) | Ben Hall ([benbhall](https://github.com/benbhall)) | JamesPoppyCock ([jamesly123](https://github.com/jamesly123)) | WhiteHackLabs ([whitehacklabs](https://github.com/whitehacklabs)) | +| Alex Gaynor ([alex](https://github.com/alex)) | Filip van Laenen ([filipvanlaenen](https://github.com/filipvanlaenen)) | [jeurgen](https://github.com/jeurgen) | [GraoMelo](https://github.com/GraoMelo) | +| Andreas Kurtz ([ay-kay](https://github.com/ay-kay)) | Tom Tervoort ([TomTervoort](https://github.com/TomTervoort)) | old man ([deveras](https://github.com/deveras)) | Marco Schnüriger ([marcortw](https://github.com/marcortw)) | +| [stiiin](https://github.com/stiiin) | infoseclearn ([teaminfoseclearn](https://github.com/teaminfoseclearn)) | [hljupkij](https://github.com/hljupkij) | Noe ([nmarher](https://github.com/nmarher)) | +| Lyz ([lyz-code](https://github.com/lyz-code)) | Martin Riedel ([mrtnrdl](https://github.com/mrtnrdl)) | KIM Jaesuck ([tcaesvk](https://github.com/tcaesvk)) | Barbara Schachner ([bschach](https://github.com/bschach)) | +| René Reuter ([AresSec](https://github.com/AresSec)) | [carhackpils](https://github.com/carhackpils) | Tyler ([tyler2cr](https://github.com/tyler2cr)) | Hugo ([hasousa](https://github.com/hasousa)) | +| Wouter Bloeyaert ([Someniak](https://github.com/Someniak)) | Mark de Rijk ([markderijkinfosec](https://github.com/markderijkinfosec)) | Ramin ([picohub](https://github.com/picohub)) | Philip D. Turner ([philipdturner](https://github.com/philipdturner)) | +| Will Chatham ([willc](https://github.com/willc)) | | | | diff --git a/5.0/languages.txt b/5.0/languages.txt index 467572f40e..883d219491 100644 --- a/5.0/languages.txt +++ b/5.0/languages.txt @@ -1 +1 @@ -en tr ru \ No newline at end of file +en tr ru fr \ No newline at end of file diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 833fdf8728..15c6dad99b 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -108,7 +108,6 @@ If you are interested in creating a translation, here are some pointers for how * Persian (Farsi), [#3172](https://github.com/OWASP/ASVS/issues/3172) * Ukrainian, see [#3174](https://github.com/OWASP/ASVS/issues/3174) * Portuguese, see [#3182](https://github.com/OWASP/ASVS/issues/3182) - * French, see [#3188](https://github.com/OWASP/ASVS/issues/3188) * Simplified Chinese, see [#3191](https://github.com/OWASP/ASVS/issues/3191) * Korean, see [#3204](https://github.com/OWASP/ASVS/issues/3204) * Spanish, see [#3238](https://github.com/OWASP/ASVS/issues/3238) @@ -116,6 +115,7 @@ If you are interested in creating a translation, here are some pointers for how * v5.0.0 * [Turkish](./5.0/tr/) * [Russian](./5.0/ru/) + * [French](./5.0/fr/) * If the language you are interested in appears, it would be great if you could reach out to the translator to see if you can help them. * Often there is work to do in creating markdown files or updating the translation to keep it up to date with latest changes. * We would request that you base your translation on the 5.0/en folder in the v5.0.0 branch as this is now static at the 5.0.0 version. diff --git a/README.md b/README.md index 8c279bad6d..ba2b4f29cf 100644 --- a/README.md +++ b/README.md @@ -56,6 +56,7 @@ Currently available translations: * [OWASP Application Security Verification Standard 5.0.0 Turkish (PDF)](5.0/OWASP_Application_Security_Verification_Standard_5.0.0_tr.pdf) and [other formats](5.0/docs_tr). (Thanks to [Ata Seren](https://github.com/ataseren)) * [OWASP Application Security Verification Standard 5.0.0 Russian (PDF)](5.0/OWASP_Application_Security_Verification_Standard_5.0.0_ru.pdf) and [other formats](5.0/docs_ru). (Thanks to [Khalina Daria](https://github.com/whitealisia), [Shnayder Eugenia](https://github.com/ZhenyaShnayder), [Smirnov Vyacheslav](https://github.com/Borgc), [Mukovkin Dmitry](https://github.com/shipko), [Nadezhda](https://github.com/yoshtvoumed), [Fomin Danil](https://github.com/EvtDanya), Sluzhevsky Anton, [Zolotarev Maxim](https://github.com/kibertard), [Gorky Kirill](https://github.com/ToxicSnail), [Nosenko Aleksei](https://github.com/avnosenko)) +* [OWASP Application Security Verification Standard 5.0.0 French (PDF)](5.0/OWASP_Application_Security_Verification_Standard_5.0.0_fr.pdf) and [other formats](5.0/docs_fr). (Thanks to [Cédric Lallier](https://github.com/clallier94), [Alexandre Joly](https://github.com/inaz0), [Michael Vacarella](https://github.com/Aif4thah), [Sebastien Gioria](https://github.com/SPoint42) and [Gabriel Corona](https://github.com/randomstuff)) Historic translations of the v4.x versions can be found in the [TRANSLATIONS.md file](4.0/TRANSLATIONS.md) in the 4.0 folder. From ff460737a71dfcfdf06b2343e1cfbf629bdb6dab Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Sun, 9 Nov 2025 18:30:21 +0200 Subject: [PATCH 63/93] Fix presentation issues in tables, titles (#3282) (#3283) * Fix presentation issues in tables, titles (#3282) * Change layout for h4 in PDF (\paragraph) * Fix column widths in in cryptographic appendix * Tweak column widths in in cryptographic appendix Interestingly, the column width is proportional to the number of dashed * Fix presentation of the argon2id and scrypt parameters * Use multiple rows for argon2id and scrypt parameters * Port presentation fixed to translations * Update PDFs --------- Co-authored-by: Gabriel Corona --- ...ecurity_Verification_Standard_5.0.0_en.pdf | Bin 516102 -> 514062 bytes ...ecurity_Verification_Standard_5.0.0_fr.pdf | Bin 579610 -> 577938 bytes ...ecurity_Verification_Standard_5.0.0_ru.pdf | Bin 574580 -> 572381 bytes ...ecurity_Verification_Standard_5.0.0_tr.pdf | Bin 545992 -> 544438 bytes 5.0/en/0x92-Appendix-C_Cryptography.md | 69 ++++++++++-------- 5.0/fr/0x92-Appendix-C_Cryptography.md | 64 +++++++++------- 5.0/ru/0x92-Appendix-C_Cryptography.md | 64 +++++++++------- 5.0/templates/header-eisvogel.tex | 1 + 5.0/tr/0x92-Appendix-C_Cryptography.md | 62 +++++++++------- 9 files changed, 146 insertions(+), 114 deletions(-) diff --git a/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_en.pdf b/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_en.pdf index 7d6d6cdf149abd9995852c2f12da38980d14fe1b..2b30d20548dc833a96fc1a5c63d26addd1390c06 100644 GIT binary patch delta 167380 zcmV)RK(oJwz#opV9|$E-L`E$!E;q3Vw9^4KlfBazf2MZ+EukC`Y=YZRZ-~RTwwxxk zz5f9xO{;-6iK=m&+Fu-hw&4r}C?7%45In2Ma6E}&EAsV!txPb#_V?`#<0T`tFTa{) zccvo$8ZT>NK6TJ;2#8gP!9zC!M}>i*(ZUF|fv*2}L_{s?P$h_1L>dyI_~@7@iq_*~ z*Lx98e+@BbuPv7ajc9V9zM=$eY-+@pQK81TM$qyO-+$(_dy_gg6cu}}*^*6qf+js> zn4zM_dhToHW4YdL43HJJWO4;0nsF*RH%F7)+>%?e`8eF5>dYRUKZtg-F5zFg6%9E9 zv!Y-rmf zR`h-$c4w-04?oo3sIr$4=mQh84b`9s17un3ld#>^0dA9r-kL?s>xq;yN5&+^IH|_i&Y$VXNA^FxhDc`ww2VW1FeRxoRIHjVFcrf3X;;o#ZRrvtokBBtLPA+Z4) zbg;r(ih4{BQQxBg^wsaSe;-st2d$v$9Yed5L6xFCG*>RegL*!AXE1jkN%cSuBs~U6 zLaua_r*I!l*O`E|Pe(a8eF@H)0vk3PVAdjq5tO>9{s%`=o40 ze#mgOw7BW!><3iOY{|>x($Lv2rySSMFQ>mUIr3n%cUoKvOc;8rV^uugeH+$Wt;tAe z?9N|&{O_#GMq4I``9<}Xl1o)VkJp4lLT1TIA+FGHf=xKAgNbwv8FPB6Hf%Tg6ldnc zJJOOz#|Km$d!beWJcJ%CkL>rvnya)2w}UDMFf)x?5dc_bdO5rC4`u6~9Zy6t&3JN_ zDVMoIZdM49957sS+_+BTfyyE07Lyj?A%6zo5D~NjM}TBj7uHVCOv>coR1Up3plRcBYn2F_kkK`Jl zM#K`Jc5QHnMldbqgtdZ|HI{+6!pOIT6C_{n9!OR$ogl^JD=`zyI32?!JmFEQySm&X zgSa|%0)06BoKQT@Qq#F#7AcC$d4Fv@A-Jr`!=WX1FZSBv45hFT+-PR zHkYz$(FuxL(N(Oa^Fg8PP!g@NAqrO-7lWA%_y~!l_Ie&?L&TP)2rgNP#|3H>&G;FojII zPB9N$Dt>(mZSEIA$v}^C&wn?76%lyA)!2Y5B~fps0W@d+=bYCUFZU_-h^=%1iiDON zos&|HEPSYot%3JTF=R-G*?PFyBI;Pj*N!5)w0Lc2O4Ek#+bzX(lY0mUVN2neMr85G zSd>pa;H9`8Dm-t?*h}gG#((teM_6Mu)f*-g z%MewZaC3e24%O&p!#I}LM@g8e+V-0H((5jn1~o0d&@6Kq15-$n(_AWDF2JoeaYdzY-$0AG^b_h2pnaSn1e=N~Z;Y3WO^MHQY<;rp?L0=HJKVQV5jauU3- zUkgG7VxTZ-IubR-z<(`Cx4nIzWS~c6`j}{fDxno>s7fxy8q_|+7Txuj0O6J674 z>PqrmkL)lx5BHX}Hd-;(E7tR6!)@9ltn_KtwZZF0`L;_I2AH#Yc9#P%&wSqolkeml ze>UkKpBollQmqtU<58DL28An%@;v%}5{OJEl0fZGoomrEA8h;T%CUKZ5dN@Ur%aa1?PJ$#v!dp| z7=JK6J_>Vma%Ev{3V7PpU0thew+(&ouh@@mAAD@dmSqTme2_L!Xh>382zhAIOG!)b zE$I!k|GsN^&demy8R*MaQaE$QGkb4awk26wl08k1dbD}0aWp?f@nIcm^N@OsIu2=v z^?ryP(-qf`g`)JMRcnXfp|Bf3=}8m7^upJ9w4PJj0lSjM2wEFrXRyl1RVp#j(>VE z1j8^GCdZg)4}W7-!H6AJL6i;L;`m^=gh9fvTF1?XN3CLH7rsJgX2n;IA#NyQP$!GH z30WldG;mBi=ENXQeC2$|53db3t;0D!UJuubf9>!N`cbumKzw=NcD(n) z9i8!U_`>{QYF5J}IQT#&FCGg6hJTCT3k(jLT*iOxSdK|ua^Nw%EBK&Q6vz$-O2l}!mc?BbZ`D)cG?`$kNF9;Zj9D#>WYQ_@oXzVqfN2zz#gjXBR625Pf3|GNq z&5b40EOplaMw8ZeT_}mOgf^rLOL)mJme7XG-8$M3?<}DvSr|gp4|Yb~$A5mQ43-vI zd^uY}X(&r*1ERtbo>%AHY)98%{do1tk)fD?0G7}OCWLfQRK}(VPjwqCEs75Zl>*b3 zvV=B9+Rz4gk@TVsOg2ks1MI>Q1+sRwR4JMqd-mDH*b?e9 z2ntH5&j#;-=rl8D3H6zCoPWT9klMi#YMPak-6`U`Z-aV7CrhAt?!J-6x%X?xtkADA`VgI=RV{m~$pg6?zV?{T6s9~?V8)s0kQo}^QAV8l>b z#&JR$gObg8mw`LcYqSB;Vu`EE5SCEqFg^i}f-LSusqck?CA_TqUQkfN7;zL)Qm#*2 z(rl1k%#)aPjt*WBT9#0s`QYk?m#sZ^T*WAp!nUDkIPQ2sO@Ghhop+u-dh_}%->_0( z;r#UJBWQgV-hKD!Prv`_Z?C@Q)sO!Ho~h4YfAZ~{uRnYB_KT-aKK$tE^H=|Vi_3rh z>#GkgZ|`5;KK}CEcYlE=KmX4^Up>9|`t_T)PoI7F)mwi0-8ZlQ{`CHvZ~yY@+b>vW z{qpJk&v5H!Pk(=S`s2~i!f&5Ge)`~g?Y({JH*Y?F^Yq~_{{?!!dGq?$MSq3+KEMceCtQ9T?10&Nj_(THB z4x43LcG?SV{y`}k334ofWnr=wnsitua21q|GS^C=ByjA&V9+svVO3xe!E0D$^pm+n zEO1Gk#eb;T6f!*N-?TE?Oc)XW@rZPC>e!}Sp&>h%z&27~2LV}Tl|e!4!; z_ybM~EX`8q%pt}DF%@h=2gF*TJJbbS)I5cn9)EaP7ncAU$ykya5f3k8B&fR{6t7P3 zNT*fZx7nf#Jd`smfq!BDmr7p{Ga;ORXt5^V>IDleRgu+o6c+(|^n!vy+ zU=jMmS88D64au3Q5gE9FOX%%hsga2_EJq8EpoL|TPn^XE(5X+M{)b})4^FeDtH7A7I-7@(}}p0PW;6{mE@>k3mhy8 z9wAQAU}q7>=%XxKIn+cBZZtND!qa{rrU5p}QG6EEaKn2i2}a(}YdvNT5r&%nX0lSioiVA@dSU`5}uKT8~KFzVJnkpE7mEvFger&HQXxr1QswB%}$uS4SFyM za9MEW94xZoWruss_zu07XF{$pDWeh>ob(wm{kZ_5UIQWuhi8WyR)qn#j*0J86MyVz z4|env>IUC-nPC8Dr*239x;)q*vr;iI&;XMW{`wRuh8$7!!2Fn}!u7RkA!c2v7IFm9 zg90}=7E&+#Z;P~1E#w$PD=2U?ss)-Lt1!4jFx!`(EJaIxEJdchRHFGX53zt821CuK zozJ=}!o|?rbcnBrq(N`@nP7UX2!9t>EM!Ezz`tWKalo*!<(M8TaPENSUPQexM;xF5 z)xAcJ>4D`dkYiXtnBoD?LYYcIOndbta)R+O2H9kXB*EXdf$gp%BMkHcer!arg-a1} zTi8P_Lzr3(EIgoCmNnR`5OC(gK&n=oNwXArm`gwvrYePI1O$dB}if;I9bTC>HIT1%zu*uFP zSfy5?+R!y3N#sN%87hy71#PvxM0K4|fqHfrQG)TSi}6cl+;AzlK-}6hV&C!titL3c zG-JZ})s1g2%}{zVeuw1K)3MGMYWq~_W(`~`46Lqo(=6M<8-E#=T@PFk%)WU=Q1Q zt3`J3LPG-G~7;9I6H%A7ZG z#yV9*Gcwa+sE!$FOn)|omAkk`)Aqi>=MTZqr;p&ste*oc`h(sDNgy;T+>8NdYr?gd zgNS&_Nc$sflnF#56B}(-AA+L}caN#7XM>}6T4J8&Gc?LX8CXN7W21LcBJlQ%j0&to z=Et0ljNWO9$lDbcrT;nG$++kbXz`dz%ZQ2IlsL0|?X(EPjen3Cv^bH`x%Wf}R(wB9 zv6^J$1GXs-q0wh8emXRIrzOH|&%mhY+AhWE!04Tph_^kXqGAh6i=B^(-f8ieP3So3(43o0cHW7;ePpP)7^Nc!D%|AvEYH1F#!}Cg z=M{E!C@~U>^F{S56PBiC?COZ<8uY6(^ZJU$8XQr}*niehBQUI^3?{a9=Vj0a7ocWr z?1+&$h3=P~*ETkCuh9K6GDwMRTk*cP&THX5QEh~|S_UlTQ!_Rs z#Z7cF=^=7z{DMScs(OkT#h@HfQ0^n&DZJc6469CB&!DA0fgguCAO78iakmS1(g?4vXVk22KBDcCk<7%JmgbGeT018psZ7o&pRO@ ze}8!JcnOAgCi55iG4Q@JFdK;qfWc{ExtwPt9!7=eS)RrZNlSH7(i{=_={goVJj-9~X9e%05;COY?SO2!1m z_*(}JOe(oSuu%Of8Hy#w-#S!34{Z}Jjej~o8|2$EbbpM$btqWp(Pdl;mB$6P;x)s1 znvrqgd=Fn2JlJ`Z;V7eLIC(Jy2O%!|C`QPT917Jho}uRE3;CAMn<3%bbwW3e?^C2G z2HV)xX;e9s^yqQMR9!NYJTVI!WYFeug;v_x2Kfjy>d)N#X}uu`&iF@-4Sm*?pS`cj>G23|a!;a);GE#1ytJ4<3eJUv2y!!JZl;c~{s|P4_m) zG}u#PB=5E#o&(Htu(M!Kjgh>c2KLm}AHklB24f!VsV^Lc`BTB38l!l3*ng9!pe4ed z8jr-h!JZ53D=Q85)ELLR?S)^yQ-0E5PmO`R8|-OgtIIUpQ)3|Sr@=i{{2}hy=iaxK zhI?v^;{8;(r^evh4fh<}{Fn!OYK*;IVb8sF7=C9O?5Q#Kc7;8K2AH1>d;WkHf0*!j z&6+zi;q!i8X-JzO>dC`$n18pS!t7551T*F*2H&oz=M90)LOr$jN2uooLuz@br^e{p z4fW)yaI@v1o*JWX&!}hHCpWA-*i&Ql?FM@~R_8p>Q{$ex8|Zlj_f7>p?}P;FR(YoG zx`eMg+;ArG&7LwnFC>P9FCwd_(s%|KO@5fFL{!XLVxpD&oG{>K14m~ ziSPvCEYwp?9-*E*5R^Z_l7@O}jK5t`PoCSl$0ZB(RI>-DCx?Yom4NU%6&8#_kD>;N8EGG&#P0+GZRp20qTK9Pe*cugp( zX&G7}hVTe8?qBoTM^iDsk_WD3Sf}e@ekD(|cC2dO0~-Ge@B?+ipO=x10TY*45CJFx zH8_`o5CJoP_D0I%wmlYRgkDTZBZ?@!?~+q%P! zPmD9y3Z`%9_yn8Kl1~>r#Fp+1E~b`z`l}wbzwX?B0=97f`lH>1Kf->L(_8D_oOMq4)tafHW_#n!%A=##rTY>)2Phu0nWlYf1_I-%+H+d#NAa`-P# zs3z2X{yGSyh%`KY{&)Cu_;Oo3Fo{P9C(lAWu5-j%ljSqXBpx)4Kg<>9Zsx5Gt)x1* zanVVC64XTbZAUT9&oLZ+nq4CmCZQVcd546QL`uLNlKkk7-Mz`WF+2$lKh-xpo`&ZI z$w%W!8mEykh``dBgnT6@dYwKWTSiQYn;P6l$(1{#JM^_tpRY9_RJyS$O$3v1tU$w3 z12cl}=F~4ocz_oY^E9o3Ltvlg#Q@=pG{~ucjSPdER*_#pd5{;nM9l;)?i3tO%$CyUoFkI7V))2s- zQVwUndrW7<)K6!Cj|MnL_@+C;2g?Wuon|VI+Rmd+`Kw~UUi-s7`pYTd##6$7t@2u! z4fcc0nT?S4I^{e;ykGWP_QBP$r3XS~Xr4W9ldmRnitQ{9cik&tmQY(yz~@=z9jg*e zP+pd&W;?*B@p?QWrkr5*QHIX(kkPwPX?f_1k_)-iI#1@gOvdGS*%?k~#~kVl*#?*~ zolo)|PF$Ya4IPt;Sf8mZr|L(4a(vox!&8uO+tGI1m>^2!q$RIX?@`(&OHz+ICyZhY z#A(6T4Y?T?*$7eHa`hD6%iTJlLjqg^op4_9m-(=C4C(bJ&RwRFll#)Nm z+=kFv0>G;-tPsA%-8z6n!pgwG{Yx9tE zyrc8Lb-=2+11oQD?WSRIWTIFHQQF1ZB0pH)r;Jba*m=qw3A?%BE$zybV}s%<@4JHZ z&J`CDR>q8XU}h}Q6lTT6g3DFqhl(JvF5^I%X&+D6m|(o--!}w=AO$fDs{XCX#|LOG zG~qo+MdyoC=}b}r$`+}AmSeJdnHF8(W{b3RCZx^dFK@Z3tdHmLBl%_IM7tK_jQJ~N z=)k@dx|Ftn5yWQBjm2x2BHdA>6=K+$OtTufO(j#b^aDfB?z?wxOvFr984d6=s=*GJ z&{Qp=i5nucc^FM0eKnWXaW)45MLFVy%-a_EeW7b9c%=;wfze2R*N4E3fT2mtfXQ|X z>6{zQ_3YZmWPI(~Q(2Zm1#(bw_F|Q57m;u}PCc0J6&?+^vxN)^(g`a#of?W=(12D0 z{Ay+rO|u8j!`GqNwEJ#$&YG;)_0aQG`Mj>YC=e!iHJFvUZko{aEuzV2!eq|vH(4?F zUxjkM(g!L6$oEEnn^X4OuxhYBx(C)l5t^1BilQ+TloJW!zA;q3JRrDY$5``(A14*A zPn}Ms*H01=L(^Ceg*v=uB;E!)EQE~RpDBHg|!GLryiWiOE}56Cr!m2ZFCb1UkWDYI^TGIm_jM#Xpt4go7J=M-5qTu zB#~TI{aP`6sE$HY-vd=Ljgk>&q23Zf%T0J^L4SUn-Ji)ncb>%AlgOYQL)dr>8$L~F zc{^0JK&-UYm{uNNKo^?GOjmnBuuz6%=RGQ{pmIb}z^73WdTL>3YQnyo(QZ0SV{zvd zfp=~hOIc-q%G%2fg%QM1n`6YZtt;v<9}k9#Q(yt6TyL5cRVXlB_=s`Y-tRls)i9#8 zs7AM<{9S-UQ+l1aroG|L=xE(ncP=k)4iCRc5UR^V$zoaboNCBN(3@NNg{IBoMW;h8 z`E=OsT5`z@VLa#hw%GO;`y10DNWSHHisbrA&_I}fs_wPM#2 zMTwUArw4*Qf~|;KR9M)rP#N#u?crgIF*mq zzaV%1^~YU<^5>tY$;2?9{$C90CzXExak9=$b1?M#f2V(coqm5~S&~vyjDfXIbKEVU zue2VwY&+QCayB^KIXyAi{=4SC{01P!&T8_ZTETOxX6!I&SKH{XY|Kc@v@cEmR-|Rx(64C%`>BJ2zH#ftfbQ;PoBz7e!*^7#V4d-F1 z3G;A1`w4%$*WShFhDKk&wO&FKD2>-f1COKc{rX84pUwu%-Ull>=Xs8knnPM_J!#{4 zv9Ba#UtA4j0JxD@v=;4RRt=Fg*D(JRv1$tJG=H|aU@Wa>KN zXL9ehN?e61^t5<--HiV8Nub_Y=1((k(s$m7J+HH%UN zOtI10%BKvf#TwzzPryBSHLPOomBiKJ3+ewo0>L7%&+uE;dLLq5dX;K>sY~Qr&5ScRLiAxjR^*7DeN~9TLCiV5ao;1;o-wfgobs_gDRppt9Qg*UXZjP%TYE@ErVB@D(nxlcjDmc3xRKMg+X{HRR&6yq%M7A(pOj%Z#iRoz$iEe zAiyw;FoUIu`RvAF7Z#j5v*Sz^tW8;tWXIrjBG)s!d0OuvSHZP31Y+#>qf&KyV8TL? z(GIn^!_igJB3g!NX+T}li~`q5Av1rEA{@C&aD^?B8}1Khf!?`kUVh|#H*TPzU5ik9 z@_r*H{u23vB=KRc=HM+<(Snqy?uic=1r3dQ6=>E7F4I&z&HMz)FS#=969G}Gi1UxZ zerrZqi)oJ&5Cc@S85<`p$}l$HYCtW}71Lvv6=|XlY?ABjZt0I(7JN)|`?%it zv@Gi^_7Oo2#PA`ubAQ)HN|MMx{Vp@4d8{S=$1*|pbTKnI(>VUz5*wOlW|pjP8I9bF z+T69UTMqIh@`)5^%|SFR>(~pv%eF7(P3x0G3j}{eO9O3Iw}%_>^Ju}nXC?D5xAe|d zc&+e1oKY3HieS36?hd>%zU6=FG!)u_e;t%#Uy&J31HIVdBc_r2!Y+JGw!E(VDa}Bx zBXM@?O_}||Gl6Gx4g6x3h7ll|XLDz{$y~k!v!~213zNyeI;Q z$}D33EvqoD#zUOZI{~Tmf0F6C_yk2&kz^~tU^h&Lc(mBNuy3_ja>Rc-aY{4e6O#{h z>%>9aqk%2qQ#%VnCY*L*r)0ibLO>ClfcQah&#mCLQF2|&KxSG&{)Ccf<&szMytZwTqwLB|xa;`XEwKql`{u z`)|%K@mKk_Hub1VtSl|Q%wpx7KYW;<>6R44AeU!3Lx?(>|S&UC=#-ipdsmJ;N~Z<|SD@9l9}k@|5?;b7_1grDHAoj9JA8r9mI zmSrx~eXnAhZs>m+-2`1MJ-Duc(n1#ri`i?*t4ZrjCudj#IG&+IR+XzfwoCC2QAbqf zfY2N(fhy8;vEJEWOU0VnbE{fx15lEIPjarig&D(qTQunM94m#H&TSDGjweg^aqRA{ z$w*nk{#Bl8<%oc|I?hjY;~K9Xs_nh^2+Kw?O^Hp{lAM2$g#~rrRob(sd2sdww>PUd z>A{q8@_Oie2E%}iC^uK%zA9=r0?ipAO1+2nQ4W!&utNytn6rAfQEeF$ zhufJLCosU26^p{!FXfc$H8{3DSt8D|g2Z(a-C&wNAfvvA4jPuO&>sYv>7loyu-@DI zb1-W6=^1|!Y4+rd2sM2Bh5*Ta^NdJqkch3dByPHF)2xzAVz-WdinHFj2Co!jpG7t% zkFumL&x7O{32ZHcM}9pwalUnxk@Wha(9+P2b1O$2ubPCZu=%v&AMMCN@u?}HMxMM} z`4`vyR0R;6fhoLv9xlbvPM;Bo&dLu9Nl%uxgQS0wDd=G8NnkwI97mOev-WzF3V9=d zr9l5mlkuPP_RcendK5XcZav@hM)FN>Mtsv7=>gtwv7GBQ-bjw+n}B|;l%3wt$xS6c zApm@a0I6eR2(XVz_KMpVMj$ID%&bVp@j#tD^4cYkFeFhp z(7k^E1@`sRXj!Y!z!g42H8FY0hGR0a=L4_gE%GizMglP7!4C$O`@3}FvS@3#;`(WtqOxJ)Yvn=N@EOEoi1MdahDyTrrI!z5bZ99qkbx3Q8dOVQGS1jsw4P%OF672dsnHWy5%-N1^aVOgw^fzt&j6J?-nnyQ zf&^+=f$7hG8BI{x2UoA|RlBfu8zf!!@@$i*nHu>~WjK`6uf9xH8vE*KlswUxZ}V7ID4(8L>9z90V$8h{|co4{QYl#0ol+&hnHco z0Tj0sy#WLaf6I>RxDnmwEA#`c@F|jj;YEOCfb1r@yC4g9Tb@m3G1=tzL$az^MTxTP zzPRvpOD0S8JoTWaKPEk?{7+B8OkqiLOw-rz`Nl8#^V{zGFF&R~|IJTY%}FIa{di0t z+Rs*nNt;7lwR}ae=Gm}fNOKhpLG2&*5p;X+)>vL zeSwv>5WM5cyu-S((w1MtHB`F1Lf`Z`{cF0wkNWHC%bzL#`2Zg2)*UY&*MI-``{e90 z$B?oTP{Q?UaCKbnUhSZa`bFeW;LuN7Nlp6+cS+9l=QTUMd>R zN>HGdrc}J6oG=raMUy*JgA`rH%g$;i8YD^d>|AzUDT$BsVl_&VpQUtEm5btG8f=sI z+Tzd7$FjGWIYu(Gxi7RxKEP&Mu`8IhN$svCe^dd;IZzAPS*l>gsZ;ema!Ak(u@pcL zj+T8}X}}c_+1o<l=WWe>&Jp}E0pO0F|3JZD3l@wJL+G%3QipD`F;hE zf4m!bN`L{lLm_WbH980-L|jvd+>0uuU39+Dkb;D(&rhHs_#r-*6}SX@2@bm*0tk_n zgI!1y*{Km-h#O%eD&OHn5Ttbs(DNO350819jRNqnAL6+J0)WU|4os7g# zyz)~jw^oxTo5!Nk;g`tDL~7Y-|)Iq6k-N&dlx$u1U3kE z7T8C|&rD-NmJc>9uafYEf9pq9AvGBA?i$>-5(fWOAT$V3Gyk3RXfJH)1{bbrf6}Us z_6_0}w$-H;mjl;XdjLS6GFm@Ys#a_q@5rE}F%d+1N$o$QI`BTf%zF z(MaB6y&;G6=;+8T{DLsi;ei_B0g;jd1Nd=Oi4a{BQRCl6!w^rIw{3W^mm_Vmt=jMp z@zF%=V-A-bnzmEIE-H!WSwOYNf1KL8Fm?#LV^7#-_HjX#i-XxvW>=tu2$_Nkn_NZL z66n^-kAMY=tl~B37K@GJ@(1h78wSXyL`SZz0%WDvD->gj9HbKMo6$dPjj5xEvw)e1 zzpxgZ2z-HfyL0Ak^#?5LJj61|jYGjr;kB6as`0B5H;vT;?s=#M4CZMhe^j1dc@p5p zPbmeHz1AYXE?kk^o=J=0V@P&GQBki3MMy=l7DnJDg>0)vBWHbky{lE^c`h$+a>&V6-DiO z+hiNAD}5^pq_vO?r7!~?e`eVP`4*_nZYiuH7+W4S3)y|s3p0CFfxy*+E74=@$^DoM zrjOa^X75|33L{@@oe^b_Q9nsYB_gY7acA$>F~#c4-{Kpl-~>cKfPU}{L#EEwp6G>i zrns4*Mn+u@3RBqi%w++QNnS#Zf#*~wgVj!EWr0E14~Hqu-kF*ne{wL)&IWFpBQEL` zm9=ARYno*_Sy78%D76$fLO9M_SXlO)EN)I(bnoe$kygJ5xI>i&p@y+awaD^;v9&cy zovUY1aNh+5-S>;g;X#@zGUpD@&ABMpAX`^F#8+D%M$* zn!6#yD4IS&;sDa0f13tTMH&{g<@J$q+Z?uJgbS(At|E#qiGCL#@x_qeSvXR>B3RNy zsH+JrR+=ldr)+3Vvj&wmdF>~87^Sx6adtBts6zqsejtLd#Z&9NfH8STSC%-vxj}~DH_4Z7KwP|g##MJ)LuCVvrk4xX;k2 zeHYL;HOHl!>M#2?V%UPk{%lPH>SAo^m`KL^K1@Pae^BW~`bm=*2y!@$Pz3K1q?zVu za@OLubOSQl23r{ONR671xXt!>M{^ySL^rao=>QeND=>yC;yrcucl zPt<32t^d1aT6|jQ#+N%AsD4Xe`C9k4z@jPxI6Y~lKnr)NlbVuw)?KF0$d~j7rR1oA z4t+!dR1$mkgGD4s?NfcSR6IEc|Kd3f48vV$e@#EtTIq|H%U~$NEe)-B5Hp;+>kmUt zmEUtpgf=M_ZoX+}t8@>b+=}{Fy5>b@XgWVr;p}*W=`FyQy?E!SBz#ouLIfpJ3=fN)874@A2%T|Kee|U4G zhkef#UW6W$p{r&O4<;o-zaplIbf6;!Aj5G2SdyyAL+(|d@&}_t9+rlZIF(1Z>R$lS zB5k%o1W0sjZ+^2w$@uBetI_D&^P-e?))v2Y))t3nZEMpOy=MkjYY%Nic$I8YZa~|d z!S+{YGJLPEIfQt>FAc`Y(eLcre}IwTnjFj_s_56_i z{H1>9{k#M>eFUrLNbmCM+g<5Twg0>YiN;8a3t8gQEESNZ)?k^i9Qo`Zk%{G=^agw~z1f!9U{P zAG^=Lf4lwio4;u_1Qqn{+je`?ez0n~X*1~2+`c{ke|=X9j-_}{J2h>xD|b$k5h+dps4j>9~K$OJgy`YnulcRiInIktp!8#i8M{zKz{r~f4h6TZ(c61y3zCvSpb7<5u|+lkF+tH zyy7ftfc3VrJ2TDFx^q570I9MnOZpQJiSnA4RX}(Cq+ipM1;1I{yX(hWT|aNS7M*x! z*GkHSgVIk?c}yrGR1}~t@qExeAHa7fuPFYmw=qkEiq}34#s|3WEG(SOnWnUbe&&-+ ze?Wj)fpJ?|)0o7cEWJQLy4E@UVAzR>WgFA&o{1>4HoP}BBCTN32$znr7PeYdNvb0Z zFy7-XX!th#HFLOf3~!Mi-?6!?plqRIo62)qI^Hf(mgY{hC#v*k&2pu9X$7iCFPgzf z4_2p=Ux1Km2iUdh%%U*RNe~hLa@k$tvBreVmdnJ5vQ5=|0)fxo7OlgdXr%(>l#?78by@|5UE!Ugxzc>^rTQ2%re9GjlgHu8M4|~Yn9Wo6zh>QeTM7tx=!Po4 zoiCD32x@#bVP_Q8Ral`786T2^Y^O{7V@lQ`T(2}+%z6}tJ>lj93ruM@e_;vg1DLX5 z9L1yr4Xh@Ux{&9|K?YnMms#nWHX#xi>DQ6$R11km;Bke;B<_@z)>TsjsUrPe)Il#} zHNZkGXoJ@FS_*<7i>Q9?H0=bbC<*I_ps5_L7_O>Zu>TiKFwLE7>a+46FpVht_hPYp zj*n{Xgjn@CU&7ZUrf|E)e+yF4x~pfo3oo}gVc%3KK{4@;Hi(UdYTWIJWfVeD8| z{Ce!D6c;==O+zVJtzuL8kC;er^i(cY!!+(KL4}DBeq)6o!CnZBcnT|yRu;}y$CO;3 zIq}W`YjDL_cb@A(W+W6|k$kx}Wni!%Z6h#}? zDsELrh=PV|>rPMG?Ha4ukZ51EwlGq96HsO}y)6D=zOrik0=eo7)|2%3*KcP~P4rfS z39hH(Wm_v^CkpG!?h61#8qcRpQNn9(RDkdj9Q2Pd+|Rs(;iHy@S^}YDFE9(gE&4q%m*UjZ-FOCqCQ5}9i7cFgJ+I=!ulC6AHe z6-8A&0yr%%4DcfBtDKV2l#1lE@TUZ6^7$CNw03-h*;`w#f31Blr#PXMWgFXO+2wT4 z8v8+#!Y047P`XLKk>`qq)yBy^f;>k9*ccJ+7;VRG zU9$eQs8nw?`1ur8i?dqx98fZyU}rQ9V@^v2i-idoE!MCR$G`6aD$QyNw*Pt?wujE49x{jh0 zGD2Pue|Qq`&aD4NQ#i7^wCHJF3j7-#j$JR;AL~yrn{g&>qlF!3MTG<Ji*`3P^6Zynu|M@8v?r&s7h z-x3fEVVWqNSF(BG(pGR9e2`)G^8}+fs)Uv)6vVgG%-qTgBN@kW5)SaJ)8 zZUrnVTM!;9{1+;;rLLY z*&3he7sPs6IOAEsR7C0V+M(_{rbxG6ju__GSOBF37mZf%^EqtFz`8*P1Yj<-=sd+7 z`Y<BkNovfzoxu(kkCHh26 zblV;Ip1vxto7qBW?+@`EUA0jOG>NsdJi|LnDI0BJ&Bq&H?Lg_5M*n(lapXuHI_P>< zu~&G}e7DYS8b)Wu6#OMJTmHi@K+4p*TIxm%sw4hY*PrK^l_nq2miMD#eEpV?m1=M~ zK?fblPmU{uW*y^{ z-J-_Oc9O=QaI)t#9NdSvg#pFnL*`(Wp;xw*(cN5_`_GhH$hiEgc(BI|(K~$M-F5GJyN7!aBP0Z*HkewLJI;od?wV_` zo+{(&5|sfczHn;D&N9Rhg)g&K!-vC16-ZftQP2eO^J4sgF7RGKY*hEU-wD01GomUS7NRSrECd-&Dg(UmNDzp^< z@xJ@5N*go{)T6AZ^5}Sj=5%jq5lZtosCEp~xM zi(ZtGR^60lk)ak~0-G9es8h-7bFw%9y~XSYQPb&26!!IgNZAa|nxt52=jJkK@Z*ID zgGl1JDlNdHne((#D7VS@sm{FCuKlZ0+ulI*n1{fld&?f(wBJvHIcSAn(onijBhy;o z!K%m=qq?w?du+L1;Bm*pCFL!&q?GjA^G?_}-Sue9P;p31XLB^5u~)^iZ#~!8Jy516 z7o^mx>Q~|0Y@So@lZF67BewMh%ku(0OH|GR{>W6Wd-hmLTXk|346}Y0Nw0ib_RApW z@RVnRXBr;q6cb(ybhUlzX0O%{I~LoJUqZL8eC&*V-RSJ@&oe;9lx*NXww18|k8QEB zu>NnhRjf5$bJg;n9YE)tKnVgz2TKak(CF+Ygw9viU5_zC-b;|cR`*+xuPZXt*GHQ; zau{0lo5j zoG)|#^82+*DcI7(IA`r1C+OK`WTb3jo=VJwSVyol1A^N1zBA$k`> zatM35@H=zoec8OjG^pon^>Ni9B=x;T?tB*U#~Ud2@hnDw;1baD&Be(R8;PI@)i!9$ z#>tHUnnUd3vwm<2v8$d<@$+@5koWkt%D7P{Gx(#C=L=Bz`;r@&dFrS|`~7YFx_WmB zX%#LLO+-89k`juxsVBc8^BCajE!|0fKo26C@0sHwHV^q}SJrgUIx??i`4|GQuZ(%0 zdl~i2K+ipq>od#gEcS3luJ5PNyN^?WyNHEQUWyPA!N*n*;yi>u3HB1)NuPnpr6h(l zbD&;C!2t-Smg?W9If$ndQ3zLHyqiA3z)Cr<@Z3vl^7vu&OG{K*;zw*mWlE}*6fB(1 z%lKzAW_pq%;ek&jPbHL}{__QZLrui&KlET~$q73O$9{n+>Z!T-jHRz=u| z*`e=YUNMz=4ZPxMP*q9Ld=k#Gm0b51*9D?s?ggkD`Wi9JM>~du``*lQ(g@UR$+DMO z#+=w()5MZJKb`3qsnyj+V^bJgf}XJ~&?JB)X0O>ezE(Xan7vWd;BA{^(bAQkE}J?H z6Zv^3C2KZ#|6!^Ydre5p!x*JLw^<(v6Sf@??d@M<)z?qV5Zr#Lx!P!6-*o+MkbYxoH1j;>8j! z2Nu-@w&`DepxEF>c7^xm*euYXYl=G`+x`oj^mk+=%9<$>FfM0AoNMhVkl9c{S6DsM zh^g#pS}Rq7;Mrv60~{oR|6E90U0F)yQa2z9)5rC}mA=^ks1-3do+;1_;?SeKECJTa zRKYfI3YX6k*RSQoQ#-;Bb%r?0!vsyEtdV5Wo!}4fdYO!|xUsoX35di(KWj=#uHXR@ zN`9rJ{MD$209sY-L-W5fzZWFfJuisA4fb0mYd$981rXdK{mbJyQ}5WE+*ZAw-UlGw z3}R0ANsdFx$#HoK9B~=KHib5#xD5~I>Yxsc;mVXX?Xav!fl4rhQG zD}#0Np@+#Y8}f{GmxFx)n@7RF_5Of(4LBf#M~FL@YlW!Au`nPeTagb>$%! zl+o(|0NKeo41~ug!tE?41<}&Id z3Ghy^zqShQLVdP5*io@HkYpzneiRS_&F*jhI&7^U95ULW61$^nn5na`^j-iYu+HBw zJ`0BxZnuMPa7)QpgV4^0DuQMtse5_y#xd~p15@y0xI18dT##ehX% zaYI0S7MV)!#Y9#C)s6UcUrG~5-bF7-W6h?3D3UTW^rB-+LOxi&YI=*tMfeuay3_tp z|99}+OO6>AlrASm;81$wfH^=Bp^-F$BVWE!TxKX~YU9zEz<+2%bvdAN$yeh@w7lJR zF(|SM?cESYQU}rBjg(SvC$s2nzNt`ZDxo}s;x@NVAbAZIW!2!f45|U{Jk(*oE@hN* z!$vh`I4hdQzO5jFGKGKZM$&?m`lTKY(TR({(0s+^DJFTF@0I9Htr!3}H30aX$cA~W z1jeROdum=`#=C-9d?B8$w%TZvm>@*mD9%&O(kH`8kaA^t$2cmAVMn%^PSjM<9#oM& z;wIYkm#&_aiLhLmv8u18VjbzF-_cYKn>i})_=ysoPiuO zoebD41bMFc_sBEc0EG|BWy-v#M4n~vX4fBz2|g#G{PMKH5Cgdmp{ye~bxh=9_qkIN ze$}JJ%nW&gH=VTEEbtmLu3rlg9_`S0Cr-*9R=hA(Tl{A)Txft)gst0$%2fuI=l1Ji zt{*$M5a+|U%;k|S=^$o;CGdsMB3a)pT5Gvbd;*Ktp2s`e7g?LOb9k4Rbz6ja>4-Xs zO7FRWs7lh*T${`;`%pNasgaB=He{y!L@gXne=pTfAb4%Gz6W2Gaq>Tny35p9X;w+F zi5UF=Eb3s`LwEoynDE*~p>X>9IS$HlS{*WSNxO@owQ6wEh2{#p&C~M|*S-J4c#{2A zCFOnmz%N8EJ2K>)+o`^sNk^+7AUwpUC*@H9#6F(IAO0xAd}ndCMawA0uxi}1eM#8- zBqi^QOidm~`D(r=a6(epQ93Nr0#et(n|E?(;nxSgYj;1B$&$?`O zbr?HD0^R5eW!#CFD@@!+sjTO%^zC(02yRY3?zX5xev@Iti>$Edc0iY1{n{3s`9nYY z7|uyy$`0Ufr0Z@YqRZUD5XNRtoAO7Y8m0~>+=0QpLY!c~10Jb&XV$Dmr#&W_S55~U zl%hrAfPbU4%Ygp-q}<(UCH=pWg`P&2@8E&?s=%8c#&S3q@T*QK)O1o#iP`G=h>nxN zyudNWsvOl8m$sl9DVC$K0vdZBZLKM4w*K;)k}TkXo=GbVOr4O0iZ7UrX7=|SzR7IL z41&MI^dk90>FKeLwBxPl0cCfRH9Bo482e~6-8#|EgyGTrzP>Zt2qtTQPdIHY?p9Io z0xdA|7A@nj-8E^EnGQoQ3#IMo=?VC~tL#G-wPyNx_;bLCsMAGK=SY1)usj-k8JWpe zyA42XypYe1Zn6nWOhN^g@rJwF@MsS$V4o}-LD*lAo#nRTClDo=o2Uy4VPj+P;@uM^ zWq4FQYfh=Q)67D$3TGN0yp6C{S(R?HLXdLw1zgg5xjL`I9_fX%s=8KBY?avxP>@FJ z4nUCI!_rx6Y_>iB=wZu*N8;8ypY)LsIR`vER645?@aIbV-Aum(w7?f=R}p;Zx#ECN z_p}w@is&IJiGDPnS6&c@bfrnq7v*GAp4q{57H*6%z7%bmsxTBy2!&74y?mcVY)xus+GUKackUlm<71Q>T6QUIBy8$q@p%-EU=j~iEBY?=a&GwkyhFDB zfIhw?c>ae7tFHbbLPk#J|BVR$M}Hsur@z0bA0Z4?rqV$}IZ@8h&21Jq(|C@N&ggZ7 z@;%+Eql-l(nNY9<8ZoBT7g7)qjLT1)&nEJhKNiaGWPKu+BFeuAEJXH}?(TN>0=_uE z?k~L;tRko{7DpfctUQ<`3s|z84`=b?|8xK-i>H<=9#_5fnqMy$YyZjb=Px9BU<-?rz1^#vVcGPPkV}I%R~*mK4{IC4C?K)|NSrFV9cwuD;NB-|SX^@%sz3 z^^kh({cG3v#~}fQc`DUwT9ATko1Uy?c4mLZ!r6OE$u7_5*HZh#F25^y1mK5PmK_lC z_Nb3smaF3VeRz~&nh{7h`@{A1@VHs;`B;K~n!um#xo}W|30mU|kskL)B;Igq$Z0u$ zjMetL$`~x&)aR(xi(3(9l)n1DlxDU6d27OCw``^{GigBe(l)sz>LfBcsJM(7AZ&ks zWjgZN3zA((WQX%hb5@%~c00!_pdG-S1$hjzy=t6ZXBcZ5zyrNrasb{rJ3KaYA@C4_ z?L3S`e7%CLRRRj>N3NFoSEbpxy=Z{}t8O8d0`sv0nq$F26AVAs0@RXEQz^cL-g`bX8*p@(jA7-|?jH z4rsRvNHu~tZLkq|d`!Rm?C_!_MBI*5sVyAd z4y|8g3qAfk$T(G)ebR@QTh zKdVCsp9Phw|4!3Z)v57|xM-_y7If!RY89K*i+s_JxP3Y3RVzCfzYkI0{)@x1{@ zjI5?P8YYKHT0uJfeMl{+cb9|{SQ?Bz7J%Y9eVe1Ju_nIGTlTv@Z5*%$ez>pGkPFLc zGLLjTC`34oo6e@fIhSe%S5f9vJ@V$~18P?;(zrQDGYkUGOZ04;*O0f81*Y+}cOrQh zrfF#{z+tVG=BJ9obLN$7DO^W8Kn5vFkT1W0W6cB-2lMERh4baGELKGPtmZ9CVBp)y zwu=m6L4E3ruwhVz%>rlu8gtEA+M{22)j9nixaf~sLRU-kXb)~C)iRE<#j%4qZQ}vfq6{5a%_pLUjra6du z=&Xbenjo}C9!w-8Yo(g6NP?UoszEgX2eyv=rC%P`)(9uu4+MZY+5kqm27snn2IU&tzs zTn|lab*F$(FBuZx+8Q3Y30Nn>LYU^8M=Sy-Abd zq?cY)wse{9s|HLhTj(jRZOeH0+nJ$McG!y11aThU6Z^g`=N_=~BzBXnS+e6x10Lpz zqct{o$;K)k1?8}6Jnf<*{}ruMldm>VUwsm06-+Fel6`vZj$#-$m)dOqWPS)+VP<(} zv)>Oz33((|?U!tfU710|Fn8x+mz4{th{KauRbdp*mH=X$p_J#$R4`QfQpZK-x`O@t zvIB0@w<3tSj%t!#;3`;P{NK&lC>~ph1(?|~%uPI#YAh6lSZL;q*g`OheRx`CRB8RR z&GEt5;Vx|V69j2nM<|rsOwys1$z|1O2_yd*%7#j1QeBSRMg95$FE$Z>W5~vbqezG$ zl!Gdmd;yhu+0!B1EbrkZXU_Cfs16-}u}P_jPiGxp^w`J!*Ly|E9K8P8A#&Kg0@FGP zUGr)8R!sSupPS*mlqri8pbJ!Fr5n2>+plGHUvboKWvuX5S0mM*@htw80MUR!3j$Z1X084W@E0G2QT1~GBnsK*6Ww}43E)vkddsAgL|;% zECHNWoUe32OsG)IhM2__F;9TwhI4htsPQnwy2`4dsnMGSpKycOXVxEcif`%k|6m^X zlj6{>=b6p=I?>;xv;$i_J;-S)a02QHLZb_m& z0CFaaxN*hYZhUns@N(;+8SDT8=P0qrn`zZ&KV?Ynq!0Ice#cQ%encG-ODPJeAOpl) zIwK{N(T5@GVJPm>@#2tmCL5}kij`}f_o%~pQOy>OO@pK`<4|+vs#B zXMcg?15<%Og)r&8gJw8oF%&4DNyeC@rM!7m>-82!D&P^KvYqL{nP<-pzOT;DcNB-m zwD3U{7pF6EY8{}lmo~erh2Q30p#nZM-N4#p7lZl#nKzsWh!=l|$>*eTW7~q^3*DSi zA8ju+_M5yY1q-Y-qV8R7*DlPO(1OWo2!edL1%Qsn8``!HcdoN^1?u_Nc|Ktx4R(j$ zY<(9lG7wloL^UyyObv4>rQvcs+H{CTCa-TGrA4s1eNjSUke2cr-w(Z8U;&TBxu)9u zoK4%~rsqR_)MO%vsy965w8rH6CIz&MUq3|!_94}tR=~^ohD7rbO)1&M4>fmDZ%5{tCfxCl=Ks>9Aa_QMQ~0Zb>2^b zdzYc0p}8dV!XVCG7c5BW#QAYYniAxZ!J_Rg@j%F5;hBOMvu^3R$TkvfVxU!H)hF0Z z==%FsSbeI|7&3)bM-8^RgRx5fK1;$&UJxB!;A_&aSYi;3SIOgqet;H2i2i#T|821b zcw>xSkwW@O&Z6sOuYaXI3R)U_i@?MCXN)O1oP2&9V_S=5oHl1IP zbvYc9vKf8 zwza&|2E*K{SU=!$A2*ow65v*^?$>c4IccRIyf;}>pA%g2b^yl*iKfcI!o$ALt(H!E z+G}W5@r7$nrwAcCN1V=PE8(E^|CT9h4jwMd!;TP=K?_r*`*gn6C%*31W}8MqwWWXe zTwq;Lzrk^x z&JQ4PKVkV@RR>5(;Drc<5sGY}d4?-{+PYNtv+cz-iO*6lGdAJorAiLHwLQ7Z$eKxI zdY8@%P^P78l2=R0eT=<_$Gz#c2+T(fN{!$Fr&7Th9PL@Zngae9oB946sog3#igK{z7Qe|U zV%3pqYueN7GE8n~8?QehVHv^A(HOkRU4qXfFm%fS%j6snvz@;F*Vk^FN`l}7c-I?C$vlSA;y_w!}`^0rFwugyuHsOGFB zDKF4+F3r%WYPevwvLhpK^V9KH%ai+{=4ci@jyvE+JSK3VFV_R{jOc zM~|vrV=?st8&V3PQM(#$dsn7?Adu>oeufFFLY z+fy>F&#&F{+(rA@8 z3(q|Cqzk;GvWPy%{%FW}7`wdR&V!PgOXTuQv9yfA&VT%T9BS0cxTPzK>or}-`?AC> zRq=hztC#U0_H(swR}ajJe*<^}gwU0l$|rPbL)3%RRC2jVcAditIgaSL_Y$Y%nZrZ~ zY|?I$4PCX@#1YHu-xYi+Z`)!)1O$aMzWbn#mO2>dYBu){BK-5`j)4KF;P#n*^O4f=x_L*yjM2D@=s4I77%_Ph2-z(CNi~vCccdN2v73ZFW zc{Zl#a7oAZx9QN+^(Dg`#ys4#)w;&1TCy(jZ5JInimJ~rasDNS5dnHO9o4{y==HLH zcQN%Loof^Ow9p@|302%x{M96f4!vP8F;73~q?M2KWJJK}a)NU%~ZBOg2N6(QcK zDN##{RX}je^Rq9KNdSOp{3IG=Q=}9hzdA^HB6Y(%>W=$I2r+oie>z73WxeU}GU9-~afW1D{Ym&KY-IgYF;*UgX7tbo8!cqP3xQ~9G3sF=MXHghk#~** z8ssN4Z?OaJc$(k0+~_!76CD8#MK!_|lbnY=i;4-Isx0jd{DAe^8$KGF@PA`T{m}uh zPYSjVF})Q9LfHOA0yTryOL+*WMDgn$33i@X%7ygh^X)p&6H8^fX@xvxxU8Pau0klL z3%@0U@-FOK)jpQ19QxPP6W{5dmrJdzGbGE>^S}2zI16aBFLWBtNehrwDm# z>J<^7A#hrgwEZ_Hur+dRiJl5;1$D|l&Ng0vKL8SNcHd(u1Xl!<^ifbdsM%i|3 zuY;B~^gJYVyl#;FD^2^dm}r$pYE^M^v2>x!-h) zVSnk4C6%v6^rGF3CstvtYW}+ro9cJdF#;VU{5+u8_+YGA`^_v~&Piz7^`a~K!Z=jmp($n1 zZtKlJ`_uPAht3n$YjCGABoM9>EEzY5J6r0O7y0hZnP;))zxTk$a2wF7U7!IoPV!lD z!~viqfIRo)oZ=eyqjS68l2)qBU6)v^jk`duPQlGv^y|9{D`=RYJWDX{Ae|6_cDL+DLgdM5Q1_KuYAa0rR2fZ9J z$I@m!XyRmt89a~7fjGzP+FHwpJgJYZ8LYI&;~1f7JaNM~sF~YaOF}?oCY?n6<^e&| zeGE_`?-ymujB%&22L0?Jd|V4a1MM2g8=A7gb9Hen+|!of#!=UgtEIl_7(2QZ%G{Hj2s$p_f?cZ`3fcgcJR2XNBn^+@|ZGn2tU!CYEcr)Dz> zLOnBXGk~5&;cR)z;eYUBmMZ-PS)94YN;axVe&YO*T|7^eAyC6eXZ2H2XT=t#2Y1rY2H|}~jcj9D_JM-y zAY1H3d~0u6u03il>esnMiGNk7UZUI)`_)>s4V(}L8(1uzM}ZK<%>EIfztuQ!Bf9X+ z=|}%3YCXVZkp2M4b^m0T(-9EGKgLm@_#m_m6g$Lax!dyFT$_YAKx+s3GFFrG*@+xux&osU#!@Tn#c8jRk^ zgvOYeKfmiM^`O_EgC|9nT`dKYu4wv1bk zGtpfAdn#yn?3p?RjoAtCoC{G0?81%a_B@+`h_Nwec@5AFrCLDO=$iVUz2$r?GDYRE zPKDx(@F~aUCsWviCrJh@OXQ;|xdBkeb&sk0eK;7s#Q4>H-U~2Vjsy6WGP^;PF)@_> zC;ScgY&o9eWC{u)_2mD-}Zkco72+z(#$e!fw;xP7I5R+ijfRGhwY!=tX^ z%yIN@IMU_9TrFJC)p@z6gkx8FDNUbxO|Z6(yj;u`xtTa=AD=L`)vVWrzU^RZBfhuz z%_o8GQQQX@EzDSWsK>qKIskF!_14lZPJA92R|5Bin^xH!db1Jf_g&&}4Xucq+^#GU z&_0FqIdD&DUUePC)GkuKr)K;_rs!>Ukxa!;?@>}-8is*Mu})~Q_Q(>)jG%|@U!<(b zvysIT*cNFa@hC-597bRGNazB6!0}pAj~6^z&TL_M5MuTI`uV-pFvZ_?PNTsmA^g_o z;!3#r4UqN*FElGY2Bhst%>K-R`TP%h2X&Xj#rY4tQ$m1{16Y`t+5fljU#&e|bJ+&B z^FnnG^7m{sg^qBnpl=FjTh_}>3}ZZ;FLTDoY;m=g_B$-;i1c(TGSV4kvq3Z-_3dw> z)BA&oJo#5+>3a4FVklV-|MzbWUs*seM=s#U_5D2c++-S2wyD&9^W3JiKl9CG+aQn! z;N$iAVHD-4Zog34sbBq`wYX~$rMtK*@!r$l+*#b~&c}1BMANy;wA$D$DBbJ!+Lv+; zCvZde_5G)3rhRu|VCU-cyY?>#!u6=jM(@a@3nS>+@?Fx&m|&A1r3>_ZYm@GS=MRVV>xeqb}E0 zfdhYNd-yIg#cHayu3Qny%Fkz~&fhS$fXT)VO>$eZUYn8+hQjG&VJf@SDyw@V99#5i zs?OIj=xZM`f(hoY(x9%s_L!VyLTpgKERqk&Cfkdb>0m%&>2gvQ&O4&W+(gzex5yJu zW360UqyDjF6){BGjaH!t4@q+*AY+I>5klN>^vJTt=c$-HrX;dZ@QQGJ+`h8&0p)Z9 zWA-U)XPqarhA6;G;UzO}pIoLryiH_(@~)`jIM8UQij1N3v8>>#DvLvlxjcMWiZAt! z3Tg`u9OQG0^0k3ioH7ev4apCWQ9#xj{?IrkqfO;ODyZ_dPCw>OaydQ;pmfx2`qEF7 z;5Ki7(+fleTp;q5FuLaZqIAO`t%Z&rH3%~lr1@0e;xqP?QoJea;x(~-OF#h&#c zj<(9x;}+=OQq7oqImG7~=i>a4$Ay-80E>~eU#zJ1nV_m`OW0HaFjHOCauL~HAHm)= zRDA)hqP_#uY#u=2df4OxJj5CcJ1{?N{&B7+DgF+p%~%lIDrSCIp2ff--t!94A!(N4 z#wEHrh(?_;n-K~NNZ`T+r<*)iB5KLm@)=6l+uhT&Yczj|gM>v@62*rn)QQKvig`oX z8DupPX>*u}!tEcnMixAZc}T>8)WpiAT0fOrA%-rYAnT{WMaB&Mr@P46H^n!N*tA2! zE{}L!SjG-SZL8hr)88nTTcOSL@HJC(&&#+U{S69Sd}*){%#HrtW`HT#Up#2}aV0MB z#hiP<7)@{1ixp7M?cF{a0GAvZJ$S@R;vSR)9tbR2zh`OQ$q824$+-Tfdw$eXqa>Z% zCDxtwZVdDm<}RlJz*BOmA)KVkI}8)xaRP+%8$*Nh0?VI#t(b_cEiKVjG_^w#D44nx zMuADAZvKhzGoT&yz0>Vrt9qfDVw-&ink9_b?m?w*r6O<9p8X25SJ zYHfSSL#oVp@Mb6mSI~v`*QsKX(KuYCY1blrF;CBoi`wtGJ_SC?!K2^VwaJv24d^E# z!P;%GW)!6N1<4NBg>fam;#XoB{@_`tW^bkC9t*0`C2f|QdjkG~LD#id6FZvIML`Eh zEoV}zDQycT04=9P#_RCh=663B(_6cbgl@8h*d4j$`nsVji z1;{~T)JYRSgC2#}7`Wcdq*!(2=u_9zUFCh3;F0i02h#11Zhup(Lr-H3S0Iw&{2-4A z9z}p5J#3NpeeUswJ;KDo9VcnP{L~S$kAyw?q~o7`p?s;u1+ALMi_gjP53Z5@0G` zrHvSCco$r4k&~0vkWlAybt5=TE$J;b-Vu0^dGGwMXsEX}!az68J!I${6;LE?*6Q__ z#hls^-Xq@n-J*kD;;#~KqRbdD!lGyZLHiF?#5LI5?F}GX234SkiN`cux~f{|v0o_` zUYH^i#c4C~e<*M(4UtR;gqa%BBy)W)SfmMU@m~L3k~sTYw$?m=Ve6 zPkqR1^(0|uKd0zP_C3hNF=Gt7g!uJ?Ry!#RPgE3x7D_s_w2c%fuY0@3y|hV5?jO{W z__6zU9i}R61^b)CR`RCv!lywgjd-+VIf`MCD8>|7rY-)D(ja`LTe?uTUMa9_my+3l zy0p3Xma*aob;*ql>c0LJV)KG30PkSp4sDlBx?8~nAkDDC|F<6E*d?)3-LO>1BMMa7 zlEmtTqO_>u=~9<~pWd^Pyt{;5U*>d~GM1l>t!K~FGkHl%Y?~ycZlhuV6hhZ5{rCC% z(z3yeEcV|Y0l@XvXJwzJz?5$~+89h- zX(u;#3b+N5Bk=^<{ZHkcQ@Cz13*!yyX`=;W0%XK|_Xs z6dnP2WI4HndWmAdOGOhBi#>yT9et;lw&gNWr+Uq8X|Tj6uU4M{kQjNe;N2o^0w4S5 z8y&M~WYcX*oHohwfDJh79T<>zx_G1q4v{XVuO^sOY^M$i3O|_)JjZF)UV8Rh?IGn9 zZ_S>Um~OJ!a_LLZ)cdd!+iAJv`R6 zIkKWj1kGlyNfaXh7&Z4)(IHqkWQ?uQCz0TElE^5)yWHGvEz9Y&tRe&6NeKFB{Lkn0 z&j~Yk*reQYRaFA8Xe707$xbi_6sSraO4*e%-fNs6gI7um@y3wHgXk*)2RQo2!CC-Z z(*|ZiJj-@(Se-~ig-AFR^eX+m$|M-Vy@whJGrpLq;%Cw&&^UnTGr80hVBp zcI6R`r6v>JltfGJcM${vcvNxzUez66JA$sC-g%}DhR3yj&$pQH3#}9qmzrwMfbSyk zvJM`vKNA>1;a!`eyK0tM6yHJe;5rXm55Fb1tVr7EqQ|qVhB$4_KCH)JL{l#p&+H6r zIVy$#&!P60e$H}k@7MKD;<}*7e>7tT34{W`!T5hXf@SUTn8y~Ro>Qtv5E5rJ$-Mbc zpnCtUtbgs^d@rpDGXAyHF5fnlcvaNp>hsUkKFmrnM=JEno{d-eUU?_vzXDubZ0%%I z{4)Bz!y)Dm4b5L1l5CS=vbnJU9Y7G`MTMAm#fNG` zX(T`#s(qxl_SK8#_5%H9;7P<1&1-y#xQ5_f$@7ABAJlUMX`?8I+s8#c_0*Q{NVX^E z2b=!5@Uvs%k!2`XJ0B?%|E@##=k0BE{LJ*3UX;8Kezh`Sr(HXrYKGq4`tyT&wsR`* z=iXyX!TXzkn%kY{3sB0uG)>&|!=7%MUcGwveS3bpSi8%a@_Pw40J7rERlwx8cUH97)Wv>23XdR*c5!8!n9z$$YMH2Zt26Og9rPAju}a@LAJ?tu zOsHPL&^aQRWqL9kPCkD#SC;jCu30y_sLDU5L(G&q!^e25HYpdV`duZjYeg8XD1wR+QI&+T)T zM-Vt@sLT35wPU}A2JK(U=LOg&3kt-DolM~&~fy>XjT9*cmV%9`LZSf`JJjTc0Af)Q&>SyIXnj23e2GD}@IqYm+5uSM z=yt|sK>#r)&Z1SYR1*r841d(Doj+LwVh;m&h?Kv%IMG=A)B0b_(;6^IIm&x2H7EQ- zWAcuw$mVXgAj=Iu0{@42{MgN2gVn*_u)s`;Yvv!@C^z&| z9Z-j=X+6PpME|!agQjz3A z*2fSX>JLi)Y|39=UnIk}PAw~QeRS`xMgTS9xV38bzjwB`^~HoN;I{MniRfFWznzK2 zLO-h^@=_uN#}o9=*kyFwhG3Ze!v#I~1rPW*zrvcc&F$I75A;Fq0( zM~_y?3ifZHwDh6ZY;Wg=KbV%?6=32|Wu7}Zz|@)sTSOL{z%vzhIL}nMe&-`Ec>9hF zg@3PO7qnZWMO_c`Pui~I-Q z)r|m~vr+kRWbvT%)rwu3RTJ3_O~UnFVc6CklPc3PO#V0cEp#Aj*8F-A8bGn`#PCm9 zpAzk05(&%puAqZyfe#GaKy+qy!YR_$nuW&GOqYRg)W3f5XH{w&whX`^a>ej~_5ZFWG8MlBHrBtyYgPXS37_$y~vmDmcr`e9HJgJst_>} zHvddAjl8$*k@Ao7iDmI3=ZwsTFJWpDF(YfA*A^0PTPmuNyB`aSc zaCqhB^pbpE_}E%0Y0=c!VwN>%IHD!RNXBNR4YS~t5w|vqcY41h4iI;8AyelSf-0RQ z3^Hck9N`UyU|iSB^=Cy@DPG21|7k!hTkQ#@@@gCuz%l>|-RWtDGfp+k5W)jHixN|f*FPCgBFxiiA^~BA324dUx0FEcKgj9I|B~V!?@}{x=FS+z{7?6xSHGN# z_2rZ}1SVgIn-T(6)Fce!B_}D8Z}ai0Ks(&;tL6^EI6eq)ZD+M)t6RAnv5^%bu&{et;XV{2GZabYSjAdsV<_i ziTdW7KPH9R36oB%T=#{3rOlbs=YLybQ9 zoNWb1)%E?V4%G9>pUaC?R(uqHG{Dgs?TbDXG6P|)1~43>ol7u?=gMV=We|Rr1=K0A zu)ry$T6@|5#d>jqdQ*=<06Eg2TH&8zF@bb9_skCTRw zFv%H`q1bS1GS|DN7k~WFrLPT7?Qo9(Tf764C5nBlkF`pZ$7g8<>yDdzA(5ewUT-Hr z7hbz?1ERnYRN;tNUk!a<M9o| z1QX6xXWiV?H17H-;awWcE#Ld6aJjjQu4^6sO|$=s7W)YA@wW`sPz~+w*&UR|FVdJ& z(gj-ap*t2u^VD~97o-N~n=?blwniVxaQr=e15j2fZ7IQMq3_YpWqCV;5tNR?+lf#% zr$@O)cRsA(L;!h?GbnP#sWp-QsATioY%G4FvXI7Zevn} zKR>V=S=@9psF;5^U*M*Q)X%|~B0R9v%y+CmA)8a+qn3c>m=Nm(?d(16=#2X-t_oQ_ z#ono!y#vzIu_}-@vEku3Z@@)oZf`P;`paW?`*{1u*$<&~2-h@{8)}VJ?$^t#{?DWS z=j)o{e*l&d7lb19b`Jyr@DH}m9Jc)jTg^0dNRb%5q2gfUHc5ScIo%N-CvZ*a+`sRu zkwzAotbg+?3LV;OGmD`|HhVW)yt?@LZvq%)jMBsh%~-Yo^&GwpfFCRVpGVu*L;Xjf zEG#>N*A{q+IhlJ)pne0?!PZfMnJj0=_$}XvP4KZ(lONPmK;2qz=T}dNwPQ2j#0gnx zO>yt$ZW4ONu;>p8|H1E%AQii!KfQ9P2bgy>#ym$HpK2Pm4VTWh+A<3t!LVrj@5bpa?`{zL(nWvkZMQGydVS*$QG2+z@C#`)10Z-ZGUg-lX zOC^8Ax^aJSi0%aQl{s=+cCKTA#5?#nxL55@4VF?=0gSSlVgGETCF2GEvdQlTliwO!Tk9Wt({=Oq!B`xM|y6V*`U2C7U~ z?oc8;$x^#0hb{oSGNw4Wo_G`k%Riz^T8c#F0*L%u!w#Ha$s5^lADn!ka0EUovC(+w z$k2Au%;=zQ;<^ux;a#@ITROA@bI4ez01={07I4_Gx{QhnWP}H@&HVqU`iAIC!bRKI z>Daby+jgg8+vXoT9ox2T+qP|6x6eB7t#$A0o7A8tU+vno3j4J^4JHD2zy-VY*CTXj zofWIPbawgAO-Q^7JpT|Qu&E+TMx~vQQ^r*{mjCBX6~JfV!!H4dyb`u4BWDdzdc+7b zd=>L&ordqT8Sa8;0-?Wltdwq{r&}ar-_^^ATyA=NzWCX^pxUJI`nOu6&!J&uExB3k zF$(-j4rT>1axSljlAR4R)6W=ywC;zG&p;vO^@=z^9V}JZ61tR+PU_;hE2?YJ?A)B0 zsg@L!K*4-wMiW~uXcdtb{KN{d+STP^fM|ISJQfp^#0Agf(y2B=FH=`)(2Z%)P9mIooahZ& z04SohfRr=cQt9{KRt6>jd7@TLGO2`%!N0sB2BWHau8#5QiRM+-3VH}#F!tMdwAN;U z5RBPNpyeTK=);A|2P##WO^zZ~^5O@y6Tw`uU<0>s5Wg8pEQ)w=MaAFqI;603$qH)c zCJ+wj2wGCOf0mfPIF8h$?eV9UG#D+>k)L%KYmL8jwH!C&B?-#`&Lk4Qu#!xoQV;9* zW?uXr`=Q8#+%e{1Km2fyl8yWo2>Ifl=?f_ueIU+o7L)E?cs$lgiVdk^Wx<@8?EXk@ z3lk!|V6AiCFo*Wg6LJ?$x9&|JBx-fIJ|;UM*;l8E{L@(w1~V;|Co)EYo}?PL!kxS4 zf0VlM`%uu-jNf-d5CDe7@f8>q@ot-ijUHa7`fo4kYOxGJf~Gw+SnnGppHzz zL;gjyc5|}_7HO3Q1*bU~nZ^`2zE-)C)q~EpBO3U^vJ|rbL7ss}2~z)(d!+&GqiFim zKf+$nAdPA8>Tv-UsY*}DF|`qyWGE{A)QvPi+3kbOLN z_{WwLoDO|vo+flcPMdvcZE#Ff%Lc7GFLr98+Q!#nvi`t^*NM=2hL&Qc`?0Fw9+s0d zyRp^#VdJd94QUVqjmX1z(YRGdK}ZM^yp_Bif;zl_T(@`%Ts^L;qRBWkSKE3X+yax; z@`A_F`R9sB(X?t+COXu={uQzo6}6p|D$ZM+)LWAr>4wCq$g?O5XTc!9z|$TuEgnX`%**b8rc(~2W$$gVM$GHe9h0-p05WH1ko^~ku_7bQ$bPMImQGBXP^ISGlWz|PfR$}Gmv0<>3FP-XxV}q z5-!@6tZI(2->*}JXU0n+_9cA}9vxUTy(d#blG2=Mn<}2lUYISGoB1~!rD{|6I>!}+ zpBp`v>AR>($ZL$-N&8z5cv$gfN3Kql-2xO4wI-w-r2rFk{qA|wCQpZXdp0uJ@EHR_ zps@{#b{@lcwNgW&7ZKGu2iwKZK@I^aP=&$A(0SW#{6kK20_%^d*`!i~>u>1-sm4%FMRzXN`=-04rmKH8iY<-}XTfezCoT9>TerzjWKbbs z2yGS#WCx%~O1occJ4T(xxUXkOde$H-_m0=Tk4fVH^^I*!j>=?ZLL6vNrR=R?O>Nm3 z4=nrf#`!$K4qgO$ud#&wg2Ol@f7RHB!DTuzHr@1BdRC~AUV5G}BDZV&kUwUIG<-%` z9^5Iyc0jEx`y1Po^{d}QbNz(7v!EAHV*9bc(h6=jP{se42d{J6nOA{w2#%SZ&%5QM z*57imoBC13fskPuSAvxzA4o^=#L7~-Qi=s2wA9Ys3cpF)KY!VkHpBr*V*7eJxytaDfe?uZ1{Y#0h<7r!mvL0 z+K2EdwMPgwGfIYGWD`ezb`OsEnl&)H^#4Y!mQUUj_J^uR8<(@|`lR(w1&bAgyun@% z+|X~DCs9K(cg56!!^@p3C>`!`qx6wm>WGnU0T*;Mt)Wg=ZDcxl-)8F(Bb5oj#u-Sr4AKQ9vTKjPF_??wK^C|Y z?S!{!R)#+!7NZl^|6yR~G3!-R%;rdubI9BIN~x6W387VV^=>>JPYnbt2f4WzDs&Tf z?Kp(Ey>IYTk3u~0_SBy#-_6u-1Di_ImrtJRZLeT&thHqjijaI{9$`;)W=|wAPdwmPLBW=Yl zZ^nLODY3=&= zjOFo-UwUCi6*>B|7x_L3s&{ot;b_LF}0fXHs_GOGH~ za&DLMQG8##!QL$aCQPo>vHG=N1U;>g0WB&lf~mIOnI?E<| z+(aqXiB!m3S5}eL1Ve&K1{!v)lLt&Q3xl&Dl`} z0Aptmd|)`;q1IVX+-r1~CGL$7_Q7je2H{whH&Hi%tYr~PwDLHmi8&trEvqRm=_qYA zapNu|DAiI_{VrwRR8{J7fX;XU{T6P?ELJOv=IfzjA7bmm^WdSm&;)XEKv!gwwlR~u z9pg30mcR8}WKI8m>>1xrk`xv`jPH0ybrSTdTiLO)Q$d;(`ww_Zb zDH;5ogM6zkmbTT6%zdBV+^3aUzIDFcd8Ils6AP!=Bij;gnBcQ`+tkCPfNOlAd-=!k zFw{S4qwqQ_tL0X1H?ybJ+YOPCqUrH}2O`WyRF8Q3H=O!g2v^`lvrEZAb_#%)VJ}JZ zY2W*$Tf2(*@hK`qNnN4P{q(b=>#2Nvzw=tZrW$PehLu#>uRsY|(h+UFm6flPx8DbQ zd+fy7r--Zbow;A)DRH`G0h$B9>oZFKQcGB_HT_%HkzzoIc(wp19N_K%nVjm;_S0lx zOEU!DRZ4PUNTsy6)0iw2hDb4AcjKaEY~J?J4g6uKrgMZmyU!of zX*Fh9aR48@+H<+8rqL$wSUxdX$i!kXnM=%|%X!SU4&HBKiBZz12LxxTCURNazFB{5 z1ceL&xjV9dLD3J{$X2}WM;GoR;wg@GMjfipne<8UJ#SS5cYv>!jo7>MhkPt@!-x>G z?D3@ekzSWIu{82`@T2!P8>-lhco%V z(A>`6|779|sF?@0s35k*5l_yCynrMo6MK`?g}cSUwAl_N0+i$`v#qOf1O;0iijk=# zK(7603AIS(Yl%w&iRab%gsGy^25COJoyVgtKBa+CNQ1*{si93qd67Y(tjWK0Kx(9k~QhB0>U-GoGEee%%d1u$!jXI3oWGMqk$mHR=Z4e~^=$mkkatmYn1ovbPYAz;| zLv;O`np<(yE6wfSqtDoO+D=2>V)#z_m2UCtO+yt;fXDv)?Z-D}2(i1FWTw9rE@(oZ zi3`>rAYlt`dAdsetuA$*zh$eKAEBUS{4?Z^5^detf+3>Vj8U~K%3#$0oaa9F(#p)uTXr_IP7vgB;eEsDo!D3sP_ni<|Bm@IdCw%_~#)tL9fQrQdS#bSPCOyo%D5o^3NMHQB zIMR{r;PTc7t8sL5h z1K@}W;G39)9s5=#%RmuqQM00Jt`;btQh#4h0qYqDuI==quT(rksNgK2A%XsL67OnI z9uF#4UDQl9A;fhw=zFR%nJI!=YTlH&YrY^2JMRovtx_g+3O`X>1`V)AUnN3`>ts#G zrF5VEy-pg$<5K1xy#du;y0k0FGR=vB%oMCRy-sHgF!KMd(#RXjf|7xrzUPj`WgL2K;HOH#`s zKVEWnuGFvCuA0!3iZmdpG9GgAepFzX36t7OuV!2Bp0h5oNl%frjL$XSsw4np14zeB zG?uy+yNN|%tHlYh`D^6y)*hV2M!;Dn|FiV!L=jmAW4a~xc5?_87n{aX4~I z@is$o_BKFyd;)(%_bQOc_@?OBaoDdj%859JWqRlmRe zp(exMAjXm03-OoyDQPnt|Bq;K4JpphCiB;VK*7?%DEYx?tx~{LVQk{LP+`aONInJ$ z*FnIyE-T;q&lsgH;CGXEo#`EbFI08@W2+W+IV{seIl`+~(ZR?6)X z{HHE=afm{-&L zHX_ynhG*!$yN+%g!*lHa;anq{)tj&j@NGw#CO3Bmx&s{P8@i?MMID{$G>CcNiCX4jk#+*rE7T-9N2|MA#Pe-N zKpyQM&Mnadw=4dM7v7@Xf6*hixw7u0-uVIWefhk#7OxHS(GNB(o@+P3H(T7d?w__6u>=^>&>NhR!Bli5#vVz=(#clX ztD9`eWU3*nE})@TWZVyar7vsbu{^uEQ84_)-JPkfBjC)EuGFq$;qJLThmXTFq3R0KKO6TE3I^~LBro# zwPQ`neOt6CJU7qtMl*r3tH1)ZA%2cP`Q~_V>G@`&%6S&f)UXr`VfX9eX1_ zF>kCn1XLO<0=xcu<|AOt(5MW7Eb@l(F^PuM1NCWdqJuf3p*)1p=C8|MRe(z)L(mGo zYn_NrB?+`(b!d!A@2@tIqS*!>5)`Ut!_c*c)J`eb$&UslaxS&!lQ@LS_S%BlO-m{J zN5%YiDr>m7$Bo%70SKH|-mpVJh<7+N&h`Zeofrlsla!ooiEt{JsF&FvA%WLI8D(D3 z15>QCJu}cha82Y$uzXq+1Z`_yG)nM8UTl?Y_g}sT*c=Ck(rmcFAj~GWi}%5tFS^EJ z6FlkXM5RT~>8a~P##K^fWWKffmv58pwrv88=u)e~C>=-Q$Z6atZ8oWZ2jDs@o^mul z2;Eldq406}B_x~ArP|fET^5Hqe#g}(p8b6i1w$k$^hg&U-;nd00ys@u zvkF*x{)SkTs8IEwy}&LWz2JY%{4Dy@ZJrSA3MstLr;=ZZ$=Hfqc1xHPq1#Pf?95G# zi0Eaa-@fkZXJV*z8p^u>2f2uINiIHyam(2-DNnP7t#`^dCP_Tarv)PS-bPI?O> z`>d9JDl!jccCA|o=TJnEtBOiZQW2%yAdwT)VDU-Aa7(C0)STkIQAopX+ui~hyP4yu zk$!(Lv;kWcu3oK!bx~omRDFdSpIx$oNLI^`bVZngO2%hCT_Y$!kYBFsFSXrOld81W z%~hP{sL1%SgE-m}^*RhyqIAb@BN?8V?CpEx))q@Sv1}01Sev4X>&%o9dS-HV^>~NW zan#;5auj{IzN5ZGYoYwkJ|LJmQMX%;5F&esEdY(m8M9y0FX3s7KQu;Nh~xB06&j(` z=S~)Dq)q~2ZdmDn!WTsh5Q#l#=5$~WgbU-TUpQiNP!QWbv4lz2CRx6OFk*yhEBoUR zjRhKk~d74B^RO8@)2;VDB` zG7c?lyy>be{n_H`QA+64p(h536sJ3LmoDA-U^`^-j471?=IUc(SCN&H8jdT$bVevq zQ&Fb9Sxo+2c_u=olJhBUkF~?$4QszElHOb0;^!KF`_v8iQn|k7) zJz^tr^dcIw#6mzis*+0)m{3$ZELxVFR=ito$k5uJBrn~$xlV@hOr~e0rflgp0LWBu z!mVm>w6cz_3F+ysM#{8x-X{GajCi)BtBt$jP=mD|_qs4YD3wV0g2}Lno5ZzTBiJ1S z2G5uWOqjcyHzq)jBq?N?bjo3JMqi^@$wfBt4c;CGNVOo{5G;e~8(pO{=W~M`CivH^ z*y9{zypK~+ct$NoM9BZv40|_`BbY6{_1SPawXZ=Z=V9celC>0|!I5XbgyISjlfpA) z+)+swRL-ij4k=IKQ!|2&vo82-&3-ljmj%8DD2HI;7zrNWfiYVo+Yn}TsRgXt#N`BE z-l?y7`1oEDnNWD2UW0PjolQ8Qf0v>@XK5LUubZc#!bC@~4tNuzdU9l7)+)exen?Y_ z&M~6$$J*e+v{~ypX2v^F%1QMYB>jf*(uoUB;?<<8gpRL59~=YR22> zFD`JURtaUK_OC;oILru>N>X2v;1L6R`ks$Dj__H-XT8>MCHCl zW3LOwoQsw7@KZg7X~e2;YWtCP6p?lS!*qy!FfH!by&5(GOvYuds1s%6IPn-8!{L$bDuXiY5`N!rBBbLkhqMoEmc-mZ56Py0LV zlqiotjuIbJHo(@B)BUCD4Y{3Mnv|hg;8%C~<+@WOpcQ+hFIO`(a5JiX&Bp_qiR5_J zF&kU^+P=cmf26{$RZ-4rwueBMx;TgMnr(nZ=7Pr3+dk6@4?R7B5j)L#=9S=b<`RoO1_JLjaAmw={;}-_*u>>J=hR`5=87?e${JR z!#jlbhK<4AORjjhR3!o!+P3lVaxwBd?B)n$2c4g{N{MgbRs?rg7N6b2s2#sAK>Tfk zp&8F4V&uRW1l>W4e(hFs`v!Js_)I>>y1a}}`9oNa(4M=Po#od=$EbI9I5aQ(xEK4V zl6Ppo`_^Yy0a519)ZpUT&I#VI^5g~rvaPnWbw{CzK{13Y#W;fqdb>P^(9nMIj};~u zX$J%SFDoq12SN$p`ag!@|B%8oEl67*H1CjuwXfua=17F>yIBcq;JS}dh5tC=8}go< z{f<#n89wX{CPZy>(x%sPL%wOMd-@*wTKiAPNVG_{Y_1;f&j1A9-jyEq8-S12_kEYH zAIl6Mt=-EJSh|!g1|nS4@9pXzUZ?3HfS98<#tp{lHeEOBiT%I|q;Gf0jp0yAPi7G6 zDoj6$FIOK|Q=&nym2Eg*Aq<_#>yoZDZcCFNT6PTJ?&OigTif~d^zMMKs*bn)xaMVI z#!i4<8vD3Xg3K7&4kJ!$#MDBLle?0`+o$lwEiCKjxw&HY{`;c8(9QErL9NsTfZOv^ zPid6u$_)5r)_11Ciku=Or7mM_0;1JBXZPZ(X2$>Duv3B3kQ9_tR!$? z5z2}*uha92KQR6~tg4h%Ef%$<1aB{6g;rlx#hPVdRrMHrKa*=7g^lvc7`|`0OUuXMS7)@q7_-?2#2p`aeRGLgf$X2O6ughSKh-B`If8Y zS{m=&i6yDMsO*DI4w-`a^=sRjldkY+v=QK-tinfJi5EC811v>(T*&ZGZ8QbPMUa#> z3W&{6#L{3ES1ZCzfGCM5sOW0-oXGkJ=LOY4nbQ!)-wd}&__mk<%$t?HXmkDTC|)aV zY2NCJ|Lsfwk0ju+UqdAtZs|VQpaJ4#%VM`34mZd0uz=fs;F!)ZN`%Q)mmm}RR{Wi8 zB&oY_K&Y%XD+VJ4YOpeQj1fU6HZ9oP#-Zt3;_ZB1I#U~pwJ*5C%l+rsV>`I5aBrqC zjOkQOp^-Es>C`_Rz&1vlFcf^JGJTtI+o-$AHB|E;9(yKlT@*pII}9iYdodw+Gv4JM zdkyMe#PC@_J38VrmY^-?YlDwB_cu(p@+23=r6=zOWoNoR3`pxI_8G(4 zf0j0^Ko$HQ=1i9Wv>QN0^|t}Y9(gTnM@HkNX4bF1Sr`nT&UPHEeaMH80b;sZMjos7 z5R;T2eEB3KsbT3xR6InRo6{?U%w&NytRTBFr^@PcN}W$GHSB_!_mFLt%t7?C@;!EH zXTe&ideQ#@pg`><2~vYx>42FqS4}H|r>6u24LtL!etFOZuZ3#3hC;=fQOr(a^$6O{ zY9Lm>iRl(d^s%y~;Nwz|uXqp}XZoEs2bN9U3k2lHIltV1w1Rf19eazJB#CapC2hr^*8x(W=dQVoMsmGW5E*s9R}9Y zKR8DbsDLIdte0wL0b43Mk6-i{xw0<%WvJy2pbt0RMXZ)SNIS0IEr>b6Q~KFX%`+Q? zK+^Od=*3?MAS6dvid6iezaNj3s$!>uAv~3QNt_c_wlebj;PngVV;nks|nd~x3& zIA6}x{D~L(_n^r1hnVqx##k@-WEwg^F#d|)D7yf-W?}!C2pn^wwYi4U?>VY((XEcP z(vcBwRnTf-Xvv2pHP9CywP=J8>ACN=BekQ*;%1k|w=~ z4>mgP7?S6H znO|$mBs795HnUV}|Atg^A>deoL-+Ve&WZssv zzWh>!_ulbmh@7?EXijBsBaDtu7w>u-g+S-e;}!t8$ue;P#>6(oxDW&}Wlj8_KF`R^ z_`mh}C9RI>f7{{L52&8NP9A7dz4l0i9fIw0@)(7;b}|j!p{8#`DhFLf3*4j6Qpn5ho;WZm>!+Nc!R_+w|^GGYLCJQ z6#j|P+mLyO!U%<{sbY@}CXo1D zZ~m|M5O-7*c?EygW}(SRdqk&!(PLmI%cVr?1-YyG8hXP1@U&x;yXqt1la@ue^#o0u?Fij zMWyBDr>A_tvUFcIV#D$r|NMTO!+u*gx)xH)u`Kq7f9qYOHYRPv%c?Q#7qYSHZ}Mwu z0i}9orGbnyn8jnHm9lkIFw5#_j@<2SpAN9-tPK?O4E^>FPRiuMhk=urEmNFRy^DCW8v&?i{Euic-3J` z<(FVQ_2tP){gADL!c>j|xq-o{623LT#Dkq}-WUrpmZgcKZuOvJ#YlRREokI~a1jx` zBD86MKt8Y9lVLt+mA#yhRrP~M@oVVVj&JfZdLmN!}`wFgPd(sg+jf~ZX zU*-v7*y<$0eZ+}FPm?m2Jh7{hPdF@XDpzbFdUrC+$e=zNiRWx+%YiSaQC8FX( zYH4PJ|7tU9J(cg;zmE2DjUgzq$GJdE>7DrI67J+fFfBBW-6M*M@VPZk6umg9*1C7ziC$W6@8Ygf1J=jQ1PldS8uj|^iHV3JreTiN}! z`wbLlkqfm9r%JuU8wXzEKS0Z=PVH&D|65C#l%1fP$_8A1&hXB}MJ{&# zath;?p!F&%ks)}}c*K_e*aV_yVn>>3&3iSXVy2Zr#-r z^+VKN0(Q^`?^bpcW~8;q7dRNsu>{F5)X@1Ik<}o_Lm~;GPYvStFUFW#@3Zke^qCfO zW1cR*;Cd;c`m`2FeGFAO|6J;+b_joX3MP6LF=3&pzQc=J=89@bz!T7 zF1k!ZMHf_i)V}|-Y|!jff5?wOzgEE`WB(o=o>*G~l6+Q#{l)+)vY7l32Y(o4;3zoM zKy&+s`Pa76*w}nI0I=s`5lpDXZ=@&wO0=MI_R`yty^&$TDsO*{|}XAO<7$F>+C&e z&b{-U@y0@&eFEDIIA_m3`}~UO@$ux1;u5%)bbBGJiOl{DfZdVl3>PVap8nD#)<(kNfF)MhV5tVI}b>{#c*B2(H-27N-T<$>S3?zZ0u)ZhC1AasL zDgZ3TFR9d2VCzl@Te|PGn_^K?eMMVlHxE6OxX2J;PPPOo=IncsRp4D#ed_JkUe^hi z2_)@uPpU$F2t6S`!|}ixvF$Px+&>+@Cyn|S&Ln3WoqA=NH{kks(d-hYj8Zw`K>G$E z^Cw%qf_F#Bf}kt5fm1||CfgFz3cS17Rcp84h)7cv@OX*|A3w#l9oZp=ARew?{NmrR z@Jr4iaA3P0k*l@X!MIO#4NnT!HME!5rh;rR%1P2cA2dYfHS-T-#Hb^YP^{kkMSxd6 zX;~>5z03J>Vdru-B?6t22RCVYK&k!=Nl~vy1Zh@qmnr)d1cTyoFRx9Zy(+L|Kt~bH zrb6r(p!Dx~+tPB=d_>l8mjarf**lD!-qI&Hw~0d|4>Yrg$*>USSYBT=&KyJIop_7K z@WV13eAZ*)By_g@X%d#pK3sg%0P+OFz3BX1F8i7?-6bKlL2cNh@ztaCuX+9XlVHcj zZZ#M)UsT2QGz=kGD*_=aVzfeXvV`$@@eTJNK=c~WiOaW(5MGlJtVIwU_`#EH*bE~H zl5UNgmT${~%z$>O>-ndz-8Z)>M%WY&#Vk!|)(J%Q@rVxIw;z%8K6}1riz)TdZxl9v zv>08^U!je<%`B?g=5Dr~S#%||H(SEQ4A@$&hQx8qJ z0QK_3N1>SxM)37LAxm*<`6(pdk6t-LD9^qQmofX3`Pw{~E%nZ`ljc{OY%V8KZQybO zAy@;N`=JUWp({g!Ug&God7&O@zw|ia$H0fE)6o({kYYOf~0;>GBNz zU>IB=M|R;H7AD>kZhwn#|4&_F+AHRDz-#uui3tH{c=HxWcyj>zM9o6$`amj)!o$JY z+g@6#E6J#+2!YCXB=u47BZgXOFFMuIawzl5oP{AyU91|s0B=k0CyDlxG0W8}(JzHq z_4nYhfHUWC&PvN%vlBtrv$wpO4F5RN25Ak=|m|HlkC$9NjDYXMoi9_ zT{fdrQ`MUG+FpO{NpJfQb6K7hfHhJC-=muhHcHTaS#>hY<<>UGWMd&}qNY2$G~!O}4Cx8>TSO^&TBlF-y3r$M^H z&N9GP5g`4hqxdoMNXd$>G{%EK9DRBW@&kb)j7Uz6?>Fs>8OXZDOS2_t}@423w zUE6Cljy+8$Px*B3zfiy;{JdVx=DmHighTOE0L~EXONkc0zFp$~ps+y&R(Xd4WC zt0vMelyOvn#>T9A72FHlcMjGvVbt|a1OP$J_U>a2n42%XWN&4gsTgb6dWiOo&X^av zVMjyE`&bh;;1g|{xzshDwC!fv8{8`!*MdddGP=&00KfQ7dhb^`HGKy;71JZAH zLvtpL!{ayKDL6@@E~2izvljT&TH-0`i9n50@BRCivFqIrsE-eV%)o{sDMLJ(ESM%>x5loxwO^$c_E~|X(;$J}`Da_ zlY5<*1xbwE0PK0PpyQxV!pntfS*3M5*>6WZD5T)B^RxWf}pDtgKaZ zDJoavZFL7;oRwq+WIt?t+GVZ%_$YKb=JJ!JlC@y{S7az>GOkMH9s?(z;JBRMH<+}! z)Ygfz=BFmN!VWJ+9Hz<*c9bGhb+}< z2rd>A^s3TLXVD+!)@{EitU=OJRQn(>Hf%7*KLIp;AWuF@PAQFnSPc90R!}*48!zZm z_2NraY*7=nbuPKB{D0x&7X3aQ6-I=Mks;TDe+9O?T34$%CsWBxW}3U*6em?VbFW_F zc<^2L0BX4!UBXEdMuT1{5+a2i5lVwN>h*6iAg*x7XmLQDvqax5qbxIuOU%whQQ>L$)bVZ;Z-l^J>22ytPNHN zf*hXV7I%tK-9cn@_@Ob>!(8UIu7J8$n`foK0a!#wt6~d(cM`jFkcuP}jdp^#udPE$ zF)p<1i8uG+tU{C-6Y|yTw0J?>v{4qf^aByP(Wh>zp>Yf)31ABY+6_`&82Tn)`tQTY zfZRs#aIa7I;hlADaz~;ZYEU!3>~nJ5R4dF6wi4lY-7vE@2)Sn(q-1txk0~bcRuhO+ z0l#H98xnR!>)Ie1DfZAJ%*Xg{g^;fLmY0T8tjwj*n6B?YTQ_&g@)|7KLip=!ehX_f zf3@kqncp1Wh5HG=&hNuNn;IpuN;`fkymGp3Xgww_4ghS|&1B(&VlSk$E@F zg(h!SBzD#K@>gsz{VNsBiV3|u;++D{0|<~l+$d(_zJ}jx|NWSBUl)6851{J$twEF8 zc6JDd`H`lq*SrtEVV;wcp`TF=zN$u*&Ia1;(c=PmpDAg)^&EiiRBxulC< z$H%$>`#)_U5vn zr<>;$)Q6EB$?Gn>vfzAlOk-$T8@4An!9yy7j25lE>xqAi#pxLOk{~-IIzUkpSo*zw z11K=NKI}J5?sLIDshOu&ml^_B=^CTty&pc%l-b1m&}i=+#3!saH$#I)n=>dd!s5W< z7qISU%+SC^`wQcc?i!5+0{pKhib3Y@>Gaus7sy9eF147rJbv z)zfMkr0hjJ-uK)(Hu{?%+-Ki~dXmvf_Efj4n1A&cwPVR|aaX&G+hS|fU%fB@-WU$# zH=h4%JD}42XUk172So-Fl_ z@`)!lD`)D#PBT5Kl+UN6$E%H>(7pg>CHCcE@Wa59hW9P#_jgy@_m|b{HNgRpviq6A z>z@$NC}9~MKV-(Ty^H6Wf<)!4#=(mA%-r@rpIB4|!#ij{0NwpA?t__}U(z(z;1?(! z+`UZAix++^i^yK)4gXGBUiAi>^B~i=?w<()!zuQB(HA-RKic_GkEhADDgV;=zPM4@ zK@IpxvFe;Ts+M@^VrllyoHMT-!x!MfCpSH=XwoY?5P4lVp#t^7Rk7|r7y89gQSv1p zKX5&80yYu=B$e;4PZ5`o4{r7_2iAXYVZPT}zjr3Z*SEY~fnD39-v5`LT7(KMxy;8s zMU9nwU~-OdPB2C z>Br#l*&y{GSCEo*u8+rHijj)wZmD!ANacqgL8bzrp?5_R{EHDj6zQMUfS&(#)~4@5 zc%^>#1e`_rf4Dk_Hcfyo+oo;Xwr$(CZL{9AQE9ul56;{sZ= z%yno=HkUkN1ALte%}}?YicD0^73cgo&W_vM0(%=b4r>imODQ5aM;g?;?z{#L*FETh zW^Rn-AM4+hU|6ED@NPk(Jndhp_6_(WWoz97XZfeejgeL{&zic5)E@DgpE<6W+u6!4 z(&!FDiHbD)IRtG4rgGOipNSNtbz4a5_aAXy)9hJP1#}5cUN6sta##KYOr~R?J7}~o z>nuKZMu9~Tb*rP%q4Ja(;CZt0P1S(a@b1G#H%i!NiBxffcMu?Q1oZvuBF+zyGYQKstngiUc84^M& zHM}zei@Z5}-!b=_sX33P>M!=4! z`fG@IqS+AXO~mq1f?m^%*B^x|^+%O%9!CWuEa48_BCl1&2x)-fK2L4V5@UR$Q6ETc{o-7u&WS& z)n++iy@W~)opSbx^BOSZM(UbCsvNT2b8c>Orx-yjSHD_mvIg4RUQiyB+c=b8Qpwwc z`?JmE=-FYLBs-av|BHd6b_yF>X#282CE0D89eEGZu>x8f7P!J(zeG*nml|Uk|gBvc6y>kuH%s=fvY<{M$Np&9LBBEv%eBH zinS;r1qBD>)!-~(BxvB_tH?DH-?Hsre5sF?(qcdcM(lz^&PVSS7FgZ{7e;`TKY z?&bi!=WRd1&%ICQr(bdH7ooforoW+7g_zD3fUvkwvds=Ts zbmL$G0XYh&-W_?0^;MUjNn-e3)QIDs7uIk`Wp}{&rTj!37KT7^$6zV#x%-M|f1nsnV=W{oW; z+Heb(-+-0&qM-_U0(0-7mlfx=swoNg`bY<9P2|JeR+!n{FtX zslVc$y=T-Se0gW)^IaK)xpDbp&bYTTOdp;gm$rG9;Gis#@cc}EI>aiep@z$u!or<~ z1;{ql*4^RqXOeHzHOZ7$18va47ew`)kflhLNwG^zr4MyILY7GoUqrKoOOj1jWQqX< z9-?YXl*`u6l=K&!_%-EDA5N0BJ3;05zQeW=?})0iyue zV_08|jBSAoi{zWHTaZRpNbyd6zx(GV*smGuP;N=3`hN7!N>PNLWOLuR9xGjFjf&uE zQ%xwUpZ>lrhpl|IhB@IAu-`)!)JKLF^iK#Hw4_Q_!5b2>#$=YthF&n@IjZUxLLZkz za4RSr*?LtckB_dVZ%V{7g1Pd-q*MfSaiOhaBiuR?dSUKHf{g>u9=-z9u`;-3Ly76y zikK*N87yHB&>(A=2!2+C21AB~scyj#RE&%NhHQiC3YB)#Rw)C)^l9VX9p=MaM0nSQ zK9R{og~DeujSom5iGgxvp)tgzQ<57YtL~9q&yHazAgc+Tv81bDOapO~>H`DrrQk@c zs(?#WLLXiwpt9qI6y65F5!KKf6mdp@0gS-Oa~-!)TKfu$oA4U*xO7B6UBjG%>aH+| z!!F(?!0Tw~=_^AdqkhgbAY+bo2K_z=YRDirAmSom%<#*!GIADm2FkPuegD+K!B0`x z7IdmH0>972<@B(D(#R|!j*kM290= zXym%Zm>rF3lXz>pSfg0XW$+kD7faIxQ_?sw0VenqX@Dr@s`_aYJ;eZ%LfA@LDooJ% z>RKS*5KsXaTvGeiMrzxEzQAN$isro(iC{pJ`k1$};AH6shzARk(jHAHfs@Uy&@+yiuR7jhcP49)_vZ+uRSqv_+gCScOQ zflQU)kW@GQNkarA^lt#%;|J)b#zi1uV|;pW0VNQ6aQ@%ybX=0)mRtkf#7g}}vFcL4 zongI|l(Dygp-8x~_QMlE5iss+On|;I?7%B-t>b9KMDppt^vGvHNhj0V#xY__@`;&P zvE+nRfoWW{WQL&pii;2Zj6CW4DY1ly$iWyDM}ehmLq)bsbf>ENQ9u(?AKmFVTKaBb5P27f;qw&!xyqPs{F zrWa`>kZH=$$}FAIijP@mL)3WGmb5RFB7JAq_88=1nw=8gxdS01&>tK2-6P+zDtFPE zYk&=vRE0<(zbydek@e#WcX0ug_-!B^ShGo(ZpZAUVDQ<&RYiNen(0SH(DSW24=wpKUXENXLX3Qa`7 zQAN9#v&(@xDd(A)V{;K;`@2@+LGgIX;gXWYwBKLAp2| z0k2GvNla1;_gNz?EK%`T-o$;@QTa&PgHi7P9P*KD&WG7(Q2gy=;!YQaKRVq$t#%cE zqs2MZ!cQbYd%LYL9V-|+mz*2ll?S*c02+n_`}2e6?oaU|{&(U}?oVAlE>FFG-wXj4 z2JTCm0KnNy{JRBD)7Cx!EcLV3`A*jFhZ&0)xXV*T3TFukZ0XO7#-H@>w_(hmW_ztm zC=64v{McljK8XP{apXw`p*vC~wNawJ5h%q5EPA3H-5_&NsV;~i?>%D^y+jgU+;v#+ zyN7w0vY{(faE}ZB!ZxGOn2ZE)usSDZ=(2i!Kp)G#E>vy=k{Xv-5X>4lJ<(uifca3X zl2p($_@xX!#ETZ!l_&6cgkym_c(;Vsx$G=iDvcdts_w2`8>e_d85%j)(A*dz3GTlo zIMJDNm+DP`s}7rF*73n8vssd1fFtw_gUbg@0jOve$>x+lN4{e<(y9^}b`TRK)1Xlv zAhIwBqtMs6ifsNF!Ghrj(uzW%WhS{Go)EN+%tgu(W=RJ^?;jAdKn{*uj*mt0dRr8# za)>OkBtyhi@WD{k*jW%mP+uo~i281&)3;|nM6!E$4TZ-G0tpMYk5wLG2>C>kp>Jiv zKR*P4X8Z{$X-MXU0)dc<$U8seGc@1?_!asDw^6-Gl2iDTPXUj~3&LBo93p z663y`r++HI>Ovj^lE!4?q;WVI41szDl9+%Y!3NYhG>WIA1%gssuVsT-7xVh>Ppiek z0Um+smCLxeaJvE0ZfX?txZ#jVJ<%L*kgpy!qlNUSQXVNX1K)Iy^N_Ac$^laWP>Szd zy)46|5kxp?1}oyHWJ_s=-AErqhFg96mBcoEc;X`vdOWr zj=Vv03Lwq63etd{1P}+fYQjEN>B4>HSDEgoEwQTq3nxtUS7Z@z48||@YtB??PBDr; z`5EMKC@vEk)(GYTEMg3L{ib^Xz1i@C4L>^-nKhX{R*ad}oOzzn25yxLHp>cG;yaH^ zbDa&fv~5;PA6lks$S`LlBr>7F_V{0|ZI*R52S|U9lM5ok#;Drd<<>+SL$I!O3eT~> z@Lk(=1pPc8Q7MK~W=3TL_1&J(b0&WgTT2m8WPrQF@$^6%5Qkh@h`?ysbm( zEjGdq?MaWX>TDXI*V-_I5Ai9ALKi1N`igf6kVGobra)J4NvC`_y1v324HexlgjYHa zSyjwJGmJs=cI1#L3{1&$i@V&%TNFB6m1oZsr*ujhCDhj06(&AvR`TI`rpB#3#p z6=TGVsFs6%9#aR%%yloD6Bzw<6++M{Y6_fhGd=i^ymLMc=kLE%{Z?BV_8lm>Jii3AK>H@%+)m3~Z+U%9QKc4N|_1u$-?(JRG zNVa(mfx}&_d{_*xDh)`Zr?=u*u35Ve3ri}zp2KSHW@8rV_XOB zc*)kz?HT)&H}c#klCIMx$s`-Eo8HSI%QwK)lv?dHo|JiuJ`J*GFf?}p9-(}W3RJb* zMygMq45D|QWrWruim=;Gst8ygbK>O;GCb?!B<` zr`zxSwbC*7msVLZ23!fK32W+31(De!VlsqGs$uR6;HofC_N|cDzVt@fhzxn|h_42k zMiauBm*m`uadqWHl(RPcxD9XmKl;al39@odtQXR(YCIFG>S&};7;=F_yPrhgCE zTX;VJth25xrQtehf7^3`5o|@RVK+}%kAn?gc`cC3+nFKd(#i?t_7NK9%=h4ETChnET%05p?=lvYUSc4WcMw8W@cTR)w}!8+jj)ga*Zt;^0*Jdu|&-2Rf{W(CHL?)eP)%l##DnYu!A{3-eoLC zNG+kbWsTv1tA)kstQFq45y^3b^QwW{VPy`g*Vv}bd28%21nqibL7cx&7~i?YBr}#W zHN$xPBymp^_bGocju%#t;R3RIIVik=9kcS*sPgxKLLzYINS9$vxTJO+!BiIa;#mc@ z5w#=sGnPApoEx7Zf^#FEJ-h;-Uit?75SJHz?L_&9)`))jH~3*|;1_BAP2=Ak&G=so z@yY8*{lQR|>BQi;a6;sfo1mm5cpMuBOsi(fwI!BU!yN(8JGAtBjX0z!E)svwlaNiG z74NOuf?Z6q0PAK!W`{*2-QLHvIznKYRCy$Kd@TAH?^oB6NA__%T5!JGnk17Z2M!35>@aAD3|-$>B<;6>wjKV4EQ;bz0=QjXN;Wy=s_?X;O#7JG**5kUjcXsH&wYDdMmNVgFZCRiR~bK1IRO9 zn$M88Qyv6pxVi>Ay~6CgTMQ#+FL-=c z201gfo>d))kh6a)$%+jykELJs5F3v_^o+U8c|2HXH7_KDqyIq;gx@d%BGV8P|HLB% z1EE`<>{Pq&7%6w zKAVMa$|PixHk5OT1;Enn>~HC)o~e+eyt1}-xCMUE&X9`+7_D4z&6DOM>N0Y^j~1UR zmi)yeWyE8K{$MfS-m?=jTKYxN%^=)8?!5)#-YN3TglZEVjeU3nQNX>+xI_#)f4(N1 zIz1uM=a@&>gAxw8Z^JI2R&S@BR=#GWPJD0tBF1R9Y04HS5CN_pYv>uBF!>3=b9%mQ zHx4C`6p{=Fh$u3$)h8%WMD&JLS--!dhrP26cd1%#KY=8*HDAs_2--|qFoksA88pLJ zL@)-fOZRlxbVlX(M1RV~mkY=-v5ezZ#DCpo_p>yPI6d$26e zUNV=&biHiEfh(*Z)Z|XB`!L%JX!Sr0GSFoWh?uQ5ED_x{tnkDCNO_a%Zn=<%O07KQ ztlX^us^6!5`Sibk#(g_z$v$~N-INO(V+FIo2=KGu3%S#9mbV2#MwKUYTnGz7FT0oV)&TH3K7fU9xtjx@aqNO zdnJ$O7vvSb$?xmA!dy3 zxtEhB@7>JR+5S4OLOHe^<~YUAUdN$ja3zJ<59X{#82(!V^7?{6R^m{zTf9t{1*i=7 zv0L;!5huJ*_%=r+tk!yz(cJij(EUbYa_2M{uw@2aHAW@9mvqA%Vp?3h4eATPmB>HV zWDfo8$k`0!Cp)e1^@LA+G_AOom-oBN7>A6pJ`Rb0-WFD0|Ix9msDjE~Q?{(=6kZ}U z3Yg$fQ$F^5zbt`Y+WNiir@!obRrtz5(NlNh(OLEZx)e86F;E%~**DKikf_cV_Ung0 z2*$-s0~=Y3SFczD0=gk4xW4o?6sl?g=z?(Ex>bv*n(InKzMSGd zn1F%z#y4vRAe2T|PxSB6bp0eH$zGiBNRrpD;kg!0^&y!^@=%`n)rqeL9j_ARb>gw) zF){u#DgPZe9x6F8K|9{qG2=V>blC)om^~%gTxRpDvNhUcu)hR<)h<%7lY#QzAI%szw1 z%E#7-{L%#gk(9rp@_ur9ex8}Xo(LbnRKT!}-d9UuCq-mA15u2Y9_znPXo}UM0jYPo zTbM>W48LNM>xO46Kf6y%-J|pB^pZ917`UcKk3d%ZN(CtN?xwj!vJMpd_1vRnA6j^K zA!bet2iOfmX3PbCg}u7Yu%xQe5?oIJ1i!hl?L$3@X@EW3=wWUYTFo=|FP%2_Pgnsv z#PHuAe?>!6Zwx65g7ZpuDn)XB1MXha#wcl4Uj)iS;XKGUu3dIixt0PLMW*tTArHi5jcM zup1JIX}j@gHJ3ibfJq$ku66>LMrOYbG8Fnrw2XchF2BZ_M#KY^=EN{-|5XJsX_K3E zmFPFwp_yhq8`KAat0ddSxlAfYJG-s(Z!UjoznseP0CtvJE>?c?-I0IgU?j^Jr50~bm~ z6I^>}T?Bd-albvIzUX8SQ7s?})MF0WK0eWv?6`n+?cySJIQ+g6u;NCbR#L5tYUi;S z9E{iRjE9{KN{p**rX^oYQ|YJYNZjkRbcWQq1u<0}hRT)}!!uU;9=47GaE6bFE0?h- zJhPpPYAV+!V^->b06xcc?m)4t4HH6XK4l9Ad9^yJ!DF;SlPv`GjCUPou!c1xv~;<| z4@R2hOHxZtPIRgVc_z@1_b}icmt|wUd+x{KTl~N0I`WNrqEKo>R%F76c)$vXq(70+ zEV8JExU{AGw=@kOzW?o6o ztSX1`&X{Ogjol3j%`$Z@9NH30Q6U@9-+SrRO0*IV?H*(0{sdzvYm0lbQWu)kS(~e@ zl!xw71K3_hxSMRq(XrJdWP!W86SVMz)2}QC4N~pD+Gly+Z}mq zdGL{)dY;=9!3cy!ydY9JbtutV83KDBRf`(j04Qk+i)lJL*oju$>zjj^j$u<^?!%_7 zg(ahzY#NA87g?`DQqhs#3IlM6$aPg6{xB(P!X$SBA_L)C#MFT2%{=h5wTu5P%Ub# z02oVJ(c#xnjwIFXCv{OdTHXn|Cxq)(d(-7Jq*4GdL}s3oB$e^*R+!f%7D~q$N`zQV2dmziG7URNPQ*@|B7F zXhW@YOjzPgI97L5qEP9eV<>RBvPsj&ACk@Y;`GV2L3SS(WoKLKCMuDZk&x_y>i}(e z(Pwj95prCru}cDuTs^0i0H)$KA_;s z>|j&WE%l*1WPTh|1cYZCdX-u^1L8PWIKLI&BvnZrgG=4Icvcm=Dveim$AYZ=@zL*H z6F>X%N=w(p@dSv;+#Ch@N3q;_rMbOdCqwIUS)CV5^VW6u1A_GYW7>0_yO%Z05no;C z4=R0`9zPe}4Vn+yTuxN}gqXY#N>Gj9Xjy1?={0 zG}Kc#RC>UFq{3^hAC=Y{WMkZT5o8$ctrO$n z;A?6ZuCU8(TAoLj>(_>hMXK1ag~_3@UgINq(NDVi{O3k?(9H|ebFjYW@N+jgQpD=y z`>A>uH>6EJ!Qx2p=7F#Gq5gV5cnWxkwm!j}Wl)etP7%xFN>xQPfEB&y0envos?GGG z|MyfB&Zh*{%BKXb0S3&~nxqD91`i07By+lv>2^?@&_!$%FOqZ=Mg!(#tJIxDl!bIh zZvj6%pG&|sxZE&d&He-%tUTrF;uVLJ5FPPyZ%GLG%5PWYBIvBXOdP4)j7W8n?ksgV z>x7s}_$Ya99x60SlkkXpIg(HSmE1wE=w4k?xqI@_>|~jiep~wz z-T3jromuv*p4)s?l*zOHn>M0baTaT+1zb5zGhr#{p#-7DIaMexS$lxAEK*@>D4>De z`&T2XIy+E$3PhnaRlPPG*zywnH^Lb3{XxX0YqaalE1|&wO!7)6rzJo(e0$(!Rn~x# zlgNtSbR92vMN0#&f$C>j|3mSFBFwc&kb_A354ramd^>BOw15=MxEnxYDxa<%`chL3 zuAQ%Dty*L5^gxKQc%^ekv=fHinkIjEeedihhbi~QvxhV*XdbKDZ^KpR8fD^AP}y}I z^|5OXBCVJ_lFs5Ox$hRoy!^;@5)RsI;`Fu$c(uOWPj zyq7TX$tWRlv!yf`EI9D5O_Vy_a%Ys=i*G3}`p?;P)^vP9o`~lMJ;Eo7;Loc6&z%(~3p*!|TnIMtOCRln6Nnu`9?+k&4QkP|kC&QOW1J2EtEfMq z_FoyUy93^bal`A2U}vvKZx0E<0xtgu<3>0W@SV?Ea*rduwXae22NOr1jO2I4sA}`# z{kxh*tuwzsZBxKF$>c6JAfWjkM?ioj4Y37DT_ zau0n)vUB(a_uMd``tXF;9@d!wDr*JssfR@-UFyT?m26gcfi5kxE0f4!+lUjjB^EiP z{1xJ7y=x@qhHF@bzossI>$8@ER7JGub=)ImcWxV1megK#nz3lS^ zOgY=@V%S15ot+xgFNO>AMeu3}oyZpO6d81mew(1@C)6j2c7!=ev7=YOl7k5J zED>tjG$)40QziCu43NZOci`s?+OhHZH~qUU8o$`_t4rT|!B_CN{@Kc<42Y&j@!vo+ znro}baZneIMuKOHgre=!TqWVYN`Yd15%<{^yYBuRH=9^p&rMDNA z3di@WZvkhyAQ?^N_e{tkd)t?^6`V|=)%$g4@bEr4_iN;jOs5Gkh^Qk12p{VPKnr@g zSf6Q9Ip<1;z-WL<2sfLO6fET5b~5UpzW%Uh)ceoHkT=c4$f)p(%c_(Wq}x**bzQAdgN<% z`4IiP*jx`Z2%l#54;d5te6(H{Dy{HH1&m}88g}EAp3nY=!ZPQ>INP9ET0L>JC@BMS zRqrAVhais3TeFiw$Q50~k5sc0N}54&K&>e?<m4j6sfJ4?3>B=*Q}_04+kS@ zEuc8>4k)x(`@*7PyHDEms7o{@6FOl=?+YQl5!e*)zUEm#m<ViTD?*H?n}iwwv$& z8zS0D(M`}Ki9@g&n4Ycw8bLqHs6;pLMeKs)@CR6At(aWAZcsSNGRH`5gs8(c6s^xf zjKhZ8zln_{QHoPSwcKW@XX~GY+@(CpiReZ^GjJ{C*)?Ze;$7EFysGKe>x(XBB1p4( zl$y4Pp79dUtEE{DGmp=0#`lLPArf6ufsb`kf|l5{MJEhVgjaufl)`SnwMG7vW8LwN z!mMf2_=PWPFo)IwGY$CUhUNhP*e!a4pdVsbv%U8 zjcR903yH2`zG6}OiqS}w!)lS-xX$Ssf!H-Ax;PAIZPV1bn0MkdCKjdwm2)$LY1tkV zzQr?rRNIq`&lNUoCu(0!ufoln#@^o!=NNWMJW||Xn-qY`yv(|)S9wEeVNa~(qH5e7 zi(Y5V6r;|4Ou}pKQ_k=acjk$}m0>Jm;b%dHc&!1F{Empsd^V63)2kUPZ3%SB6<#+` zWEcmmzNRayMtgPg8%AmThAb`OwZJvOz%{aYPFKn=2z+>tBVSn4zTMS7Pf#a0wy)Ap zAzh`NW~J;_2lC7OntoR3^ju{mE?ChR#=UM<{`5*H`2AizYm_C$fmE6=4q0#5RPTpw zB`WRj_1oNdpnxtpd04vPwu#P59vPm-p-lxqv1-!OCLTDS1W-!hDKDZ2dR`7^Lr#y1 zih67;tGbadlq@AzUA9z}P;EeJhN+&^Azq?zJD{79DH1JW3;6PFL&S;zuOq1k0u9JU zWl5^1D`IkE27V_ZIrai^m(Ldp%NHX#D;QfGw#h_3?83ZfNO0X#8&OcPs7tFlV_E|g zzH(pJgha?Gni(`aPBK-8G8dABQfM+nu!A}kaA{1tur2P7D^g!k;GQ_q+peIJ53`T{ zk(}<}IJP44pGN|98RrSpX)D-%qeOt>QnoKnR*5Cyd}^&wZh|F5vyeiz3Gc|oy`NKt zFjsV^j*5(!G|`nRoAi8AmJZyGFKh+SpzDI0Ad^&b6TbdJm+@pwRA>AvURtuVffDQU+AqzCX9edbY z!_`Z(V&-953JJ%bxm>B?ZbLlkX;3DTpX>}wYjy}Z+HvbB3C6!#_M)YV!R;vZo`UPW zZHQddLVH>vIf&bPRpEk0BrOSX)WR%?G4ZAqCE{O6@Y4-y#T+l0mBA}==5*`Z=N5$*}I=T(+Ws)Y27 zXAH59cuLNmz;T^Q^o20q-daS+cOqbF3Jq9Ox2KP}GH^rM8y_d7CzHW|{+B_g<(P(G zdp^$#EvJzadGmBBdB2wLk;F335GzAFOj5Ojqf4V*FwPy$z6*d8znjy}mImEGxVzBn zY?!s*D^bGsUXXMTO;lC6W5#j6EB@|nkR?^A{HZCd@@%LZn|wmn#w%IyU{!BRsb>R1 zH;26WTw5i=w4FIDqno2jd_I zL~mD~>E+&3uen@@WF3%5)gz!Y=nI-itJwUb^aja&L-TeaN+%ou!vYUEYZ+Yab$r&@ z_&y@dkVFebhWd4+h~AndD=mY61)i8XI$FHbeZgjPyM4>pZcDF|ub%egFpa4H9+vW1 z!oJLs$#&k$#T*nNh>@ZdB0W*3c9H#a+&_qoy@QcYa;0eUUtQO{^huy+N8s#e*1v*d zyM#!Zt@swicjqF&r5q7A!e}`|H@vxn>m1I&0v}#Lc8<#gp~xANe&znUmjz|d=99@_ z!cpI532p2u{ug=;3K8FuX(Z~Gu-HJf6mDmDcU7Gh<|9LK7sZ{~A%^a-i$+%A`fQjC9gxbUuQf&@GhI7OGPf{yvXNqaeNKayd4R*;PY67tzq3Q#ki<@@LCzhP7=?b ziP>n*iufL_Pp;%}f**n89>CWi0BD^FBj*1o5KL@fI9bz}@jxg594svV^M9aOXDsfq z<^MGT%Qv>6Vx1xpG4EzwwS#lJwUQa`2m6m*l(wNu+bDeD~nC44bdyPKAHRa z?g-&D;Fi6PKW{(r9X}&h9J6M60SJPhs)&6VCj?ZJ z1@QXG10D&_B)#HzKF{uE$nUfqzCRvHg{23xpUOh$_V}Vc-Tdh8LKgP~4xZ%l z5F;3W4jz;WjvnFzrEeZ@4OPm_{~2io0RLY}J9B$+`@lI#ip|ANWIO4b<`sU_er)qW z0Q4~O$mmj2Xy70KgEysvMt!ZVue#hqyMFAUHYf2?p+_bOGQiBv4^p7lMmZ71}99Uuq~>(hQvh6IJvzLA2|=XhUsC{j8p`P zm8nDvP?PHsiw?VVhL$@T0MdoiFURio2 zcNFn#_xYj2f2F7SmBrk8(Nom8tAeCIgXqJY+2$oY1A9qFIa#4Q%Mx@R>Os7mrP~^( zCk700Q&=T5(q+~k_8Z|JBA1X?VOkMe%8JdPfKARmO~h}l2#P)j0^zWK8I1!KU~6f! zARP;IEKwE|wZX780fw56WsS-i3yFulr>6g|q7L83X&;1X93Xd$R_hB#iqza~g^bSx z;U*7*8gFMYt569mmS1ecB5f@rUz=^0>D5tZQ%R?^dL>cV3f<~39KDmyH+EO?sk5IK zMe@v9*{x$zoE%^&yP`g6W0iZ_mhu#KLqCucVa4yvPq>vyj-=Oh-J+B?>MA*Ke-VnqQ7sr7RU{TA0k(Z zhI~a5XkITawI|TVJyUooGgxeoMcQ##30KP95J!etzCnDAf;-D6J_AwV^eu*ss*`c> zA+n49EyBMs0do5MZ%CT#3{@6bx@qDfMtv;nwc;oid2mX+bcQKL}&Ctmvdo{u5gxfu@Xxe*fb>v z=NIv@>nO2SfgCeZGhbKL$(3s>Vva!d?tn#@i2a)00qS6=B1{+Vwtq4XJ0f&3y-6-w z>A+=0>v=G+q&*$$rC;3>6bEY2i+rbB%?uOf?s}biP7(I$KRc*U_B0viYd&5`x`Pcd zGsr)6n0=Alq$}5)Q?t_y2N=mS(h8wt!+#<7u5%*tw-r2t#DV)mGP`IyAIoTuGCJ9b z-3Y6E?i)GV z_e~hj#y#t@*4DuJxOf{ieM_a}EAH0|CZGGWbo``Lg^f%n&(+SNlt8AMAwi6c9CHE_ z2keY&F71bs2ocRwPvN0Qj(jxVUK+9Ft++yOn6!> zjZGlkHp0>^24|GaoO|QDn{1rrn`-7{#SAAY_5xI<~*W$LAn;=S9^JXZZ(EI zwvf4)VX<1>->b7kr(G+v!d_k()ETcWG0X1k`v9V%oWiI_oo~a!>AbDHQp!_K~sW)=u#TWr8)? zAQ>V`3=7@CS|Gj(yVeySgU=EDqo~NqOC2_TA#&SJT1}Kxn5A^oEL_10k9raQGi9p zvR8mTQh0Zn_eQ}RZo=Jfo+L(693xNV64t;sIBz8CmrGLj%Tl*uQZ&NIP#o6O)ro}g z&cybcCZ%_Um$@oE{#ad7_BZaeB>*O@*G5SqI?~-PmLyuX9=TCm0jQ}3EPzU!ND{(S zg~8uR@@zKlJLN&+v|jsS0R-$*gicP{?wZ)omZ!4Er#k1mXVZA-=b0;apjZmfV4K|u z&5iEk@~IY={nz@TYm)c;UYfzCdtg>htlxwEYZ_s46h1tNnkdeN6U18EsEf7(0z<<4 zdmkIZL&x6t9AhW6k~mcN7G57~kpJc)drZ#TrC!BzS;z?irMTQA0|u4J@}w`EFpCE| zrkRDQyUU7KTuoSf>7Xp!=-<|_ z#L@_fG&7nnM4XK?oJ=FQvM`siduWJ}N zEzu^tZ|i_LH(dARe|9HPro4~Z9Z;Qa&M%3;7k1x;c)4kMQ0pUJK|Y-tQA`bmd5Zxa zeG)Se&jut%=@A}kIMpQYJ zAESGldxj{a(gjPuTj+Sf+G)Wq#ho8B%HJg8PzxXC>w)Mx@6gFWr6n&9H;yVY%_}G~ z=WXG8mv>Am12KQ0YZ>1R@Bz0GA35_dlEC~4ANXBI37Hst4^r6$@Ue@J%QyZyt+4^1 zdtSW^1=&TOHfBZS#(8n;qO8cWm3XZQHgwwmN$Ato4qy_u6Csf%_G^0+=~ncLk=e)w6N2*&fVzmZ?u?@ zD%6;W0q>0JF;zQ5vD4qXJJVq-61%Msv^2y~dKu=LUDaQd3bLoSqHj^rs6Vp|IcZfFb-$0R;#!gnQ86`Pjk@)z)Q)t zil7U1)|^4FZG(z^>hU|6c*`y6w>$wr;OG|e{T!i~FQYVY` zE{wdLVob9>{(uMQtxZaz)WRDp+&;?+aL$EEgk0N0<2Y$gr z6Pgm|QYWir@!?MotK0ZYQ}+fbDWCIhyCn#JC(xmfDc@NjO-BR*CwCPlXD6n*XcX=X zUgMY4W^OA?T>_<62na0{+AbD2(-jQIu@npGUrhtWh& zC-o0z-qAz4HRXABZWZU)L#YH&^6Nu_3;?u9MLicX`$+PUvXm*kw6_KQf%syrW>i7) zaU#E$E<7r*8k{Davm5=#7_|p+{V=cU!8t!iB3tTN8_AqYmL*s9ISv^hTBC`9r$lNU zfO;ZZMpnqPl|aUWvxl37$NZ=>}4C5ir1wD@k&d3Ee5Hi(pXT zM|`g@<~w?75icsc(4j_JB+^7MnUG;WZSuNIj+6>~-joT`-rX9iW1|wHhEZCJV6B!N zkfDF86|e%k&pv`cSZNY!8|T-RFrhax(YW{IkPsBFq*Ifd``Oi6MjpY#OTa3Fry8ve z;bxqO@h7aB=B-ZQdR2zn98*oh%MD`%5iJY(BY^%6vPgf1n>a&X+VmtYz&eP0Zh;-E zDrpBujG#E4?=!niw`}v2mS)@AgX&{xWj-C925Vs1DMO(;t;#Y5mJ-gXc1SHhuLD4* zsffHGGrJCUyTU{Yoz|Zg^zF1WZ<^>yqxTmLY{3zN9*2EQB?Ui^Di78_0&` z#kNHuN#I=0YiiG2Vx)kV(e1gS`yhiP?UezKoJbA+Sr&*Hk&rNZT+qDS{e4vrO9pMY zB%#v5?^oc~qN7FR!+NuDxyUVdOqN%fZyF6Rx*KQAU9-9HQQv`XxK)ozE7K|;RyLxf z2AyeZ!gBr)A43V=Upxy$U)5yKi|^;i&`4%Bi77J|1zKk*1zJ4e9YKgsQjCILEqefU zhp~p`j9N!&SBAjqmK<<7B8$t@r1Y6Vx8;_u07%o-D5(oJlYPO=#Lfk#4wRGcx zn5(8V#KZG!H(sI!UVkx0^^Lowd+j=LI-#c-ZmpL=@7yu~7UYGP_E;Dz2i`Jl40@A# zY=jasx=}{6x+en;Prfw|nI2D>gPB0?yfT6C`BiHnvRmtjk#&mBZE_njBqfAjv@)l2 z#MEGDG960{|G?NR{Ni`Ekj!(v4a#@QxpK&yQB-Z7n_!o*TsNH`O=imB>{b{Ax`H5c z1z-g>AoSNaM)Rp8j&jDB5_QS)VSePcyH$cJXMT=H5vcf|dfgnA_xr z1t6=?5t!9L>NRjTH`>o+xbq%oDQhkt9OkGf!;F||m6y8~U*{^SoGT%!$WqR<2#!xt z+v2d8y8@?KNO_@0oodmo95)xqa$yCyy0VmRP-Hnci6RI4kq*WeiToLyX=Gswr)||M_AG&w@jZc6%8|b zR;d^ntPgd(?7Q`$*1vlIE0!pLn_Xx1Zcp{Bd{pucdWI*_)P zIZHPt&!Fh>mEp@Ma;2`&{a#x$|3S)%1W(j$4XzMYTHeHcCgC;}vswf+ELzuWW|l#$ zQ;=ZJS|xX+Pv2~bitEO*Bb6~iKHP{R{Yjj4rFt7#^TN0~C}Eso4P~rK4A=yIxPd-4 z&m|Zo%T|A}&tm=J%=bgTlwaJ5Xu<11yhqFR_?egMXZmibqtIzQ_zj{bz7Um2?~vnABZKCoRC)2x%utC{Lmw-q46At2YEGuk>-P zdSMfrr%(`#MRXA0$l{*#8DQy-o5I}|xkrEY$D00MlY&=DL2X45tu8|i@g?mQCER(DU}@g6L7HOAD^hlvnMw7Ui1paSN7kQ_Fasb zf_YerK0cBe(oD{eMpb2l2-{82yR2TDngpi?H&Q!N!nAvKhEBOs z#1zcAhoA=W7>*M%GqAB5=}|IQ!6}&3if77^X|grGMQQK+W0?6Ezr82IL8c~Bn*&%^ zLF3*d0e*`2<}Ba8VpEwZykZtjJSrmaTD(BfltF1fYZL+6M2^;(V2$26;uxEV6#0nc zQfsO{o?#6S1ONlk4!WcsQV@9cHTdMr#4JdI3~Rs+$;f7%R%i=}2YDIVb2ZQybMynW zs&P)<7;EZ5m0%B!FMshg%co03tKd4p(ml9-(UPr$)3$dC$jC9-PuQR$K`{bUWCz(o z8*L&v2}UOUd-@eBA}qew$WyJXq+JTVv>-We>m0h1yXFf|pkhbttJD%vJp}^QVzMwZ#mc;BjhpF5P@ zXPd2p9x3M~%=607snl#+;(~g2z8DOlX4P*+OI6|~RkP;)Kn7-y9=^eKUBS%m1QkL|qk zD-J1;ddtZ+Rfb&F)Q4TOh4EadK80C(OqPf+ySQh^J1uBDZ7l^pmHIy?aTnWOiVK_8 z$U0b&`YuwI;GRC-J}?RE?nX*&Sp`?~D%ifdt1vevW>+f&u*u|7^(2$@G$|5W$S{)6 zXDM1FQAhGyJJyfS;36fl^+~M5vDS@yc}2udo{i7Vu^4O)i-_XRx1x&)+4N~QS-{DE z*!muA>((TVSNH=p!gHDi$tDvg*V=g+DPu@+XrKv29{(VF$8fn|kq-}4Lq>$F)f>S+ zrBO>2P)o!>p_wRoqa7FqbLLGAAC%pC>Tw&I`9ZPR#Fsq%>`hmoJxmG;Yi&>$qtX&JWE9(emMRbWhH#Ex->a`0ruYE+j_~$*e1PPEE-Yd1R0hA> zS>5St!}@P!hX_`&7xR+uet7;6K+xE!c1aC;rjEj&OizNy%fR3vGA9~i6#~aq)u73*T1N73RtwX}ofq)r+NOYN8 zdP&ykbVxk>T}rlh(0c1oVncSqs;zgAUoBa)dX$+tKI$%jPlKQ2+B4znrVYHIy$q#5 z0FJar-zHYs^v!c>tq^1*`e(ura?fY#+w^ur-FX1_c9~RSvU-XbP)Uuk<(|i1?QKJ; z3I+WHGIE1f$e9KT$uW-j+6Fk8{UTceZljy7`(M6`7=0HR@$A{+Wd5X}tIXsj%j$qS~SP_|1O3SB<<*lkB>F)0FDpFVd8d5k0@x0(hrfa`diy8K)sMvdC$^p?LFj9 zS5G)s#sNkwSO%q{v*L}H#T(%!>FaeHi_Hu1ZC>Ef9SC-vEvrBs!|<34C^|cu`FbhL zA>`cQAcn30l|>utCZVWYUcfl$HL7(3&~kGXRdosX+g{%mZYu$$=AGgXC7q;(_fv63Aa>pkB3@JnA0Th5{Z= z#Ocw^G2S*O2H~@jE*I`o6!{95U40a77*R3=Mc3}mH3#8*9-0Aa8t1k4P7?VH^tVA{ zgH73}jD1ZYqL>AQlzAmLqr2=>nVpVtU>g6CrB1|e`Y0~$aUa-FP-HeOOyD5Uyz_0eUuq6ji0sU(S4EZ=BA82dS?McQX_ zM5*w1h1Y!3%w)k+TC@3@0BfEdkTrf_HaN*7_+zqMz4O=Fb8_0}L=;kShof=Ice1v9 zi%)ygO>&cW!-9@;+|Gl1un*>mgXvw0iJnQm0c%oRYKJRSy0BixuGYmK9mOdH-XH$< zq_Jb;X6_D%LpIHCBNrr5+3Uq!C-saCVh7ENT)kmtakqU!a7&rj_np}}uqVu>w0!gN zvKYbc=iTqKO$_4{b^lo2T8?T{jf~_)6lQv%0c(dgEi;n^BXW&SU)wFLowVf{Zs_>5 zA)%-=&-H+<`x?inBoSdeiAi-arp&s+K#S@q-*WP?$LHb#4V7Ft8v$;5(eKE#( z^7TX3GWg&B=pp$3CZ_*qUC6V) zO#Am0dNhLmNdt$jdonNh6z!Rh-hhf`)+cd0O#-r>3O#B|WSeD?fmZ*D(SQ!Uz* z`cQ9;VcXGoh*5|WENK5k|5;4mrqU5W!HD6`AD|d7Y?18~yiz}L80C@Gmn{fZNHg_1 z7ZWYC+%J9aZ(J*m^`j-dDLW|128oPwj4ry&y{g;8M*^lYiUkaO)MZD>*z_fNYr0!^ zI<5h3=iu*}Y7Mg5>)v|Tf5?n5JPvyez~10)K{~ir5_jd^ITzxGp8jI& zUmWZ%AqLuuu(28B?#T*Mfga`~_rD{6?87BFC&?pIx`3~!R|faPJ(s>Im6Mqw3W=(BMn3oiq3*NtlMCMIW@B(0HwEs=oPDjB&*ImarFaveMv40|0AQexcpzhIb z;5l|!ByxnM9*-HH7b(9<%AoF&Ew&)pQ9kMn^J=(E zcT~H0k7>+UUH2-X`%d#msur@#^cfPJrseo?^ zdP;ZNA9)neR{DkRB+cA1hMejtC|pe^G!U{hMo{|I2RpzLGyz z7j(rHTXn63J)Jwxj_^Aa*G_T0vl7R@qj3~hl}n=xqGI8A$>oodUp)>dR7()J4n*-8 zxWVyURSY^#H#uC;j=+X^b=HNgobwPljWrD!jg@zG>zf(W;?MGDZ&8GDiRz*BXa^uo zfLh=z`_bP{Q3^{~gM6mHy=-Rh_R_-$FDAp5hgIIB)UZLAfCAxj#~SA`hHu_{e?imv zI-4^Rn2M8JMUd(ZE7br^mdMl-j`SPPI{=$YZo5#*_(i`9lTyF=zNy(*Ain`KIdFSw!U zkkO7`qH`&Eo0qySoZ+>9QhY-8Ze7lo% zYc;prr)c}A0!%fcffK~M)DW|2G!n*kQxOjD*OCc%Izo-EuSNbHl>h=U!j?}#_8|(3 z&Jq!2!)URXQ1(8!352)y@fVQ2r;)H~b*3^P(SA>v|9~3S4X%QSOY@^r!vBkwbQfR+JV@IRVlB@d+DMncL@h#m zUsgu}FRu`CkUKf)9cC+8yBn{Ez2&bcJ$I;9*-%mJ4iy?aO835A;@+J3RyZKB3BIqy zR71YmX--4Hv6TMl6y*s|BF;jj#y3w0hIvOtpt-C%%Z6VYSkQwgXZXu{cC$i0lQ{bHDHt67!8HE5DH z3M_AWFzrzB{MaS*>X;lwh2oK~!d3P;LO0Ny`tZ2k!P1pM#mpjml?7so2@+^ffhv~V zk2E0X^~kl(hl=$m0op#fp7%q$cRGub$d_l79m7<;?WdTNx;2nfIG8f+qhP(S`fRDN z3rQ6{Y0h(;YK%x`1;?{m{C*)p~9tAK6H2`Z$jioXa@z`4%5_#pKR`9KvmIkbln^9z1-AiT!qDwW|Nk8eb zv8orXmsE2iPM&UPGXG&x6EwrN?Z1e?9u`V3atOQEORRRV#Z!?sPhxuJk8PLaAm8^9*4sxe7FKOqzhtLZ7KMoi6Y z=&U-h^+`2X<>eK@jqAc!JVT+NOSpHb@E`qAla!N;L7Oaj^v72iyfPcJsA381Ui|P- zuQ8j_WR0Qu^$&^e`u30s+m=G^9F5?q7AxDl)C!P2zqQD!*B! znS>OP66|rq{a2?XQNdewe*m)Fe=gdayvNMU>FEUo5}@c4jH80fvIKQB@w`c#(cZq>J3adF*^Ynmvg z1tA#94j(sNX>>9>8tq2yS*n{T^)QPr)a1vV$&D*xiidmW@{9eJ`I)lCc9XocKqWj{ zk`$bmuBpBuVwXOja4+m!No;;t9gQqjMaK@j(S1541>oWuq%P=f?Q)?sAvJ8Gl9nE2 zC@(MM?@sXW+H@M-T9xTdsO5G1SuI+8%yIt{rGu9LAkK>jP?y-E?0hT?mQH=saq;3z zTbDJu6e3CB_9q_V%(QH&N$lQP-|dVz3|QZ7v);|L5qmbWTVB*#L*dA_HGU-`Kn(N9JV7H9W;c}OQPsVWON8V@%3?S+B20=V z+k`XHa;@!&*l=I-udty*!2Qj4>MG8`ENnjzya7^;A6%tsu&1}s>g@7!Cfop$=*^Y>TVPX@5b^{~u{ zO=RBO0=7?a%m}bVJ-T*e*;H33ZPfa7ROiI8(3=SE*4@+MCS5rFNxd~D`GtT8jE_HN zewe9g`O`2U$;z@`9&A~7vOX@R(@|>#={>%{K<2Q!I`5}DG=ZByS$wI6CEq;OA3V{> zB4IBU!F*}noH9P}XItyYwAUeiCd>X zV%A}ep;yZS5UmRMyg*_>VZn#%t`1=HK_VekP^p z2PvDzx?Ucax9ge}g-4O2Ya-t;+w?sc`+@(Jd4E|GQDS)SiexXG7k)$N2PzZrUzSzYCyg1za#pMjOXT z+j49|*uMB`tDKwhh8^gx3dx(HPW)*@_On6Y8aVir{7TmEH(T5*8Od>pXU5Vybs_-zemN=4 zGg$Ihm>e8?P{AE`}LbF4BU%cHTLKhUy*GH>HsF={r2Mx~--p zsiO#{C9jrw)M}y`wDtkoW-KTrkW2v#?!_z$?it2imSiAudGYmeJfaELLF%e?<6vFP zi`pd|!C+KNHV{3b{`2&+)R5~FPkq^MQ5 zS|cPi>Pd4x2*6G5{)>n>A;Yg##u_xaRGMnX5G^zJiE}(O8HPb|QSw@0iMdb`biII^ z7ygm@T{S4vWGUO#S7m(KS}A+$sso~NX=2pGU`wgk<2Z;#mDd)xL*S31=9zP;t*dsq zqVtU6yF&Gd6HpI1FW*%+f0LV88n^;jQFINv>;bhvRFaQy7euUW%2uS^|dfAANWhSWslNRqA z62F88B!H0^mJD?w34LPHcvC;j;Un^zgAO}axP52t5%FpgpHXAkEmFY=pz2lR!nOpQ z$pw`e{S!?E;ODnkzBIb7e`4di6rHWeHgt+e49(TPw+F^XngiEMzx4KziRqJ`QHj0A zT6wb3MTsEvSDo?%dgk@z7=A4bF4ANB%FyaOFCS}$azzxo9bEcOx4K^`TTx+j|)O;lSnE)N~5W_pH)Sx8*)f3h1NN(#!Rk6<@0sxrXWm)!sRNs-;bXq*n>c zR#Rh!$kSWmLXC#ntz_9f#hK5C*PAs^Cl8v}$Mp(wFsLs#&YX1MPnmz8`G;W^uKCX+ zhx-UflK_X4VeZW_*_NfIu0o!P(k*r7dkOie49B~Q=xfxq$oo=p{#IQ4h#%<-=n*bq znkNDLCr43smMtLVCKiS%kKaq^n=kSlfzakI>kzKBBr2Hzj~7CFN`D{jiG4hA5HfnT zohm*Ng?|q9Bv048r<1nr{+b-bv&_NlfhXvJ0mSO$6lZ$Hlr5k0&fDQYyeaN)+(ymO zhT#Zf$HIh5M!6gAYLD9Fjmvf9H415Mk8;Hw0o93a0UfPw_!BzVeH1A}vXTMTy~-gs zLU__?BamI_q{WY%4U0B9{F|?b7+OH#DFG^ZdarT}5hnI^%C4mVR?!Q!DU2^UC;pCF z7C4z5ABbPH4N#;0^XGh>x@XT9Uh!XSewOE)0bCp8?bhb?f+IRtVM~T>OG2KRv%9Fv z{v(rgazX;8M29Oa~IFmb%H^*w#StVl{zvN#~2o+XO-Hr;ZBiyHibasP2x>79}r*3U0)X z>na{iRUJf!-?g>OE+-P{I=ae+iMtZ|ejD0u>;s@ap^cD42DUdx!if>J3tIAj>OxDhj}pH=C%-a z<-r!(0kHyy^=j=dP=(<>!{BhpfY6FnTzX@>#GZp#Cw%KPm2f-t$)yt?sWh0>;=k_f ztOqh&siJ^(tyZ{I4AxzJuG2cc2dL!I3{=S(RLPer%>1v`ujzX;a5ESXTt>}y@V|c5 z$k7fICSU4nF|7NNis4QLX~gs=Y~p77M81qv2SAsk4yKM_m7L&u2rKMz0UN=Zv>b{m zc{@C3wn^sHS*~+cIWT;Ky~)-)JXxUzn86-a!8oPCRV%!qn9_IpG_@el`h;UcDmMbiLmhtxx&V@QZ=)~F8EOD)=QA|Kl!s8AI9B-HpI$hTwV*q)@ zHG}5U4w^;I!;st^B5$GrM;RNv{ekAuQU7;`#${1M+#=!e9d4B07pkIZ_w zoHj8O!ii#OyW~2$D=R;!r`^iIcg_41wy0%YXFhM=AY8ohum0XaU+Z@`0G03^k6Qz; z+|C$sQ+JEOOmpkJ@%_B^GEEqPTwAwQp~v=r<1+`OR-!($_Z>RtkN&~I7V7Wncmn-X zR#iRyMbD%ipijMFzZM@TMzg$oF|sGFw`6^wTl8NA@jtl5@m&^T{S-cGY6RU?EX|`x zk>}w@2vo0U>CeRG_ju;rBAz*+8G&E_7{2Xt79&9onW=F#7z;JtzP zdX3ZLEDD-m-G7Srq`@C@!+lkC=!2nr=42=u8HS0$MyeMsAdPO~GRK`uq3)`rvy9xQ z)w^!YIS$cEu|c+o=>4UE)Ha2x6Xt~&;zhwjo2|4)kO@!K5)7Q+Euy^_ey&E#KKucI zNg7@FUU{6~#fY;8x_E37xmOHha7%k z*`yM+6r?dLRTr2e7r(K&FK{r?Gv!B78dmph6jbD$;&4}3qpSV~W&oztt=RajllXrX zkVIB8gwx(>bZK20U#ee=Lc{(zKCFbX3}=jet3t?3CMUnn;Qf?;?|tm{v?>x{me)e$ z03R2*X_EqxKAZo+tp;v%`ap1_#N>HeCsm^(#akF2c(Du9@->VvdoD+@cMmlIyezJKoM&ML5NJ zK7@2Hqb~Bc17mCrMu%z!!m-XKeD_1)uR)=for}m%4zX*3urERlFVi{q;S)=UIk*9| z#(lb?`c{aqQ}`lu@fekH0{#Ykm+sL9gq-7Uq|M#zJr`>_Ad&gzSWbWW0VnY-G4;=R zow~^^MHE?y2dcWp-`S+e##;r00V2#+7a?*?g^=&ub&aTk4g~bVRggp#3)3TS2;cb# z;Lj7dIq3lb*JED1Vq~YV4gl}QQR|hzigoP0%o0-XpOF*mdVyaR1bUhF$83TqETQ}M zdmTg~c;cG2z*dcUqELwDvwZ40Hg*0@V+T$(+;$i66Ta~~uD-m!UZFQm+o}?LlCH{k z;dvXkFAWcTt;dfG)WCuzAFdGw?BT2nl3u1z=OTn5%FmMh1mN6kC$unk@o!{TqK7S| z+w(I&)MDMJJog+o2h4XH;uqT2Ptrr$NJ%YxN&{j9-~!q1SiL|d@ml_&aJ=4MDjLD8 zn79(L+Woqnz+Ne>D5X|?!cGzhv^#!&-GX6U3id@SznN0}!)Nuigm-;9&%_<9b)TbW z$#;E3Ff%UCk>!OFrOMNRL%mAeBx@NE7?mW7NWtKJk<r5mj~klqP?JG6g7+> zXw&IIMaf}%^Y_2N`wHw#b^N9#wx(*(f91s@OXwvk3m+mTv*U!+tkek2MA-7hjE}u% zM50PB?SsmO83VCx3N5A0dQ{UV3kh=J%JAgQz@=Nwea(x@O=b=Id$@W@G%M_Keai-9 zxl13dYG1Xa1HW!SK6T!_npBcj!V2I*cY6|lTYce&hXp}d3zbE{k*g%8KD-Zu+@6cT z{V!Fd6RpB-%KFI1hfSJP>CxT|j@g#odl>UXP|@tF>Kw@>!(2aYNZQh~TIQCwm*Z@s zJJED^KUCJ)QiW>!m0<#07%wfkZQDy(o5dpOJGe*xT-xAQ>gHrVvV-CU-%R%FiF2b# zc$=RtmevnLzO;vED%gVhjXx90BS;@2fwTWIqPUT)D3CPt#FNr`;KB}qJo4VH126a+ z5^RWj(7dU|aVnO<^`SktAorN?^GzN$WqYIvGfq?4XytVTF#oVb<|Z}Fs!Sq_s)(Z> zvEQ!={(04bQH~CI_Hh=L#V#oAA`Pk5NxGkIGYTeO%*HXCG}u}tGuF05zL#N&2TBLg z6aK<``F1*5_^-VVWEci6Hfo|i7bia)e&cWWOk_XWJ%b`Zfh-yi#XfW!OolC zgO-}-&94+9nVq%s5R>+cSZ5HHX~NsL9HMeFz&qaxcJzVV^Ep!zm@FlVR1|~@(z5dF z7QhkF)jqboLK1z~Br+dE0=w0mG@X+)k(kGvC~NAoa8b~K*H`#e)RPR^1B^D{Fh`XN zH7N$69*I;-PEI>g4x0g}jK{IGF%_k%^K-4!W>!G3?!%mfr+E-A6GkNA=ArCKPL7uF zsuNf##LjT6U{+sr4~-A3k3W1S)Na2!HK=70EB(b5_9r1GtTtEIkc~T^@nnQFX;k;V z*nF5C>5O%0l)?98A;3O5X3R= zNLSszzrKn7VxhbQN<{n+enEstH>f%2*}Lrg|Iq?D=%3Zx=|UcUpb9sspL1P<8IIgE zz|+6Z;e5w=HvhQszdS#@VntYO@cd)R@M2Q45o5%&|L|l=@G#u^gxuW4)OdhQod6*z zG64fU5K04FAD`Z_Ky6kt@qZsHHybw->97k&FORDC_YEZoa@1*Iq$s?<4Kd{?YIL!! zC|j$pg@lP%$IZE*ZL9O=+h9Zj(c#5F;Kf)#vZo!v0ct7NgsR?==BP4$pQwytMr$#S z?jO`G>S-5Q3eOxeAgsJwAKNHCM}hN0f0|ka+yQUT6S)ueC2{zc1)#W#@z;mEXNZr- zi&28dGn(567>PMDhMEO5=8>sKs9&>nHKS4_EBnHu@Js<>MlTx zHjnEMNP<9qgoBYxD7UO}!kVgSkWJF53G~SzNE%~sYY=)N5znwF**vlIj8+Q`q@kRc zc=&QNGLW>Cd>dWKq<1aC3Wf{rC?@QK+0y$`XhmsCN$*AteN?W5sW#;l6;eF}dH=Us zGAc4RP%J;C37wfzQM_&ZhB;Ruy;|?V+TadCG|q{yWYSSEInXaNUo;Z6B%Y^*PJ_#s z{ysx4Cdd3N7gHQxsCryX*aA5#Z%wuC$6hqrcS*zD67BfpW7eC z@VuI)3P$Is%(mlcEBDKhL*VDwE_Rs_X`1JBK-yiUx=q+^lq^}gOjheL?H%3=9%G%e z&srNc7Zu;ywBa*;HBiN&D>_?`3;V*4dRZ*7!rRc9gXYFyuzXEi_*S;ucRdyXp5FEu(DlO1Y| z;$8J%E0(`DfWhWO*IyBgJffdl<*IJr*HYg%H}VKZw#lu!r6-@GTcIZRwC?=J*(>bJ z4^G&a-dOA>Bu%D=bl0$H^lIY^X-)s^foE~V$xXp4KXgmXJm~)ZguKZ@KF7g_b2wB= z^a-m)q0V9|cKqv5T8#Vi#w`r$t^NwSxJ9m$7fhEYNH+32K|6>Wa@Z^}I=>>Jb>(Iv z-wAcfkT#uct`^*wm$N?}sbC7z7E(%o|p3>dp% zDWGC$By!qr_m?Lxm;8)*F>d)@aQ9 zielBFYL<;ffkCMi%qq25t+nI4g#KWjz734|WMe)GiM>;fpKl4^;505lW#Jy?`xZh_ zR45{|2Rp7}kHXGY24hiAMMDOV0zQgtYqkDM)oNKFIu0g#{gBD~K|yvZ zTexf1OlH7hJ6FjaF=U5;N3w6}qZ#T=!W{VtYK&~nYop4C;FTkXt16UuR^)a`fTno& zkl{%>BOf(|VW+3~oaSlVGBBuI(|Tmx>}2*ZKYYyqlfANpncH}VV$5m|4rKBrW@v_U z6qbPUBVV2kTCh66P)h`LcS2E*%7$y28iMx|O{l0&=i@;s(g@b1EaG$Z{&Fg4RVJ%r zGS`=ceXXaVx@;d;Ummn)>8!lWEr6`&XIC0~y4C~_2E^oh3c*%t@OxQ4Lsr597QS$6 zvv6z2OOem5F$(jZR|AeRfyuPa-bn7UZ3;{lVwgQ26nS)o`QraZ2?Z-W?F-6oI@`KB z=1R4g@C&rz?_4xhT^ibI+IX(9E&Mt-qiozOd^21Ykf?EUEFB)6JSWk_$+j=>?yVWU zW{yw1x?b1P<|n3|K+AyVt&pcr+jVOJjy~XfnTIkHUE6|)9y<{IK#%Rw+4ylBn|3{2 zIC&bHx2prmOF}FG@2z&ThiILMwWb`~O)Nj&tzZ7qp@7cn1m&}zhhbtdMWd4ii z%k)x6oBuXGvX8s;)@AC6U;Z$bupA-1xY8tCJz|;o2JUBky_akNPzAQCRSs0KSFaRJ zi}vCDBYUA$wAK`03E~ddZNaubem)p7t;;u&O^A93!02THU#|p#-}c)7YTHv{H^3=@ ztnB}bsxYKIQ9aQ7f2qsd1DuAQ%DFJHdg~pu^*5qt#ae|KpMIfu@g(GH$(NhxSnbW! zPF$HMX?Y<#P(R5&`gR>1IiLwc&K=lp(Dc5veLo*tRs>A~YZk+?J7UqhIg5s)aeREzovrl15z-S6fh@wXqK%(CZ!@(V1rPK3V zeN=`zt`1SRUSYTfT>h0f9%eZ5r@gSxu7r8fiMD*(#y|c&-sdJ^Y(t=mZ0~vYzq|g5 z^!g4aAvkTnJAs%#?D5^guzY>@MW*p&eQ$wXgpuw6;x+=C`aP3?U*0bx-w$eZjPvui^QDA^4QB2B6BtB~K&#i@Xf-SIyBriONnYq! zk;}iVoc6h%X81ujKff^6kYjY#ZK^pBEi5)v+C+RV7QL{6CvUELhO8I@inQjeaTfZ% zoM$K7yaOmh8w2Q3WFwOL%mQVDu5zpR&G(&k5t6wix`&)9TBcB{0c&KFN#~0+=e{Od z&|7$XTR-5M)5RH`0I{&ClWE}IehfVeQ?nI7n)V@`ZEGpg#)I`hWTCa`G@N!mFOndt|pD#u3xz6UB|f%9t}$%?Ngs= zh_gV3&KZzj>R(Jyp5j-QQdjz%&Xn(Y7xr};D`!u4VK#b>%Y7j>U9E!nzEYfT1s}$% z*P`jVh*bt>;dbx2Q6-(i1nFbG4WV1^gFq#1&CoBXw`=w7lOJ&AUyHgq{itEvXhlGcbd@m0v2E? zu)X@C{(R0YLq&#u=zAs@-0819kyNG}ljr}^L=iqmP9GPVz$62coIHY2XVv|?xnIp{}TNh=~YbF^^QL{{r;_6Q1oUp%3Bg(FQI6q^@#4dDrg zPe7KO5C{=7v#YNCDi9tOK)9jLpTqx$x{UntnzW7xN6@3^JyCi`=2PJ#OD(zJl z@W#2x*x2AITzF;-u#qD)XO26qS?OC8iuFhpmTU^2Ey>O^-0m4j|3SAf9ob`t{flv%vJ8vM#sGv4*Q9pag{it4oeeC>BzI9ykkcPiEwNb2~j%R8bo6W zPE0jg+yHHAnI<_vp-PHs(!?uyXI#5HhN#*5M)pQ0@ z`^}V%#J0dpxN?_MWtUkKOTHFp!X_wAgrsL*8VV14@k9GeIv;M8xG}V;+aZE(z+k-U1Z(yp z*>VlZWUl$J2x}QM)0hWcp@w6<((ieU9=3&X)lFcp5$;a|P?DF) z)&j6o>fYsa83j)_!kZg$Xt6}i5t^kstxTL(8boDm^tcc{TV4ARpQTo{CnThu`3jU9_UkkxWh^J zKzq@S*X=R;9HAaWNc|_w|^y?UX_oJOkR0l1q4z7 z$n+C0(tWah?=INhC;y-)t5dFH${*gHX-1)>SoSnpxl#qfhL0S0AME9Rv2-}=f*a>S;3J};~ zGwbuo!?ah4(~T8~Gkp4-B5XaChygr({uDnRc&uz!EwP!{}TT9&zvo@eiB5Q1QnS%P{@#I^2QG5_$0E3suoCR`d3K5 zD51oY5e6}%3$5hu43jt`KPOmM#=xnz-2)${T457A1RQqgiytOzpLwpj6xDPW3Dj;t z9_j$G)B-NojH~Z3rDL%_Hl_5Tro}fbU4+naqEL0~Jq|TUzuJGQu)-&#m*)lp+?>r9 zzFD)GnvJ$FJ83s~1xgAF%m65#w;w5>^norjMrLmKj@qrnj(Fl}>kl_(#T{Po$rTEt zKp9G(s)x9u)I}-~k}hFZN;cn$75f+bpk6Qr)XaUr2rMl|_-l>7g5NYknUR>e@06?# z;+`#xSUmi#FEw{rnUMko0zfsJBZnd#OARCCD!DhpY85gsxeGfg;1A5_1$Du}_`ygt z^OJ`1ZGj5Mkm?c^Ao+i&I)}i_!lm8DR>!t&+qRu_Y&-d4+qP}nHafQLba?yxXL8T* zoox+vRXw%VQ;&Z)SV>Yh`nVmLieaz7gT8bwP-U+R;2l-4dE|QX5*qSYmMqoTmz)Pv@dkRU=z$@Bjb+zqFiF>yYy3;L;)&`JUx2mqJ}YV zZbzidrP(h>fG50?)V+M6cFSvo7nqfNz7MLLKoIFfh5x~qWjy+2wDkvRuBjLAVVLA( zq({xw^lWgj`Tck{TI7;zQZni-iDk(PzLbM9N%?$f zVL)MNhnlnp8&fKM@(sl(@e-IT*OF>4Bhxj+i@awpTy^7ib1(Fa0PyF9iw_SF^5MZCIM3{9kp0E6D zW9iPsF6AWeNQtxb1E`mD?PL1dOXX`7qOevDTx%NMXDgrG4Sai^BPqpB6dR1JMo4ag z4sIh=K@fY{`Yj@!u9JIzd~>mOPiWi zwleyuq&h-NJ9$z|#8>#AXP1PFEpRAa`)qVz0c-GRlCF)@MU|FOs93a=k0QAX)h{O4 zpdF3wgAsmmLa90HNsnM*F&22axrM#uuGy4&1wD>LYhLkf?79=Qs@!4<(sixDX%P>l z!TOjslM1^mj=rWw$vRw9Xh*KJDyao(2_tSQ$cbu8DOB;Wr_`mnZY=}OIUlNRLl5)_ z09p4Lq}HwA^3uXTg^^ZC-m=3mDbqt@+mSM@Q5;nG)}P_WXE?LM-s?Q>OyOF#LL*Ix zzccuR-h5io?krPl1Q8Lz$O+&JkX%_|wGZ-LImNS?ONi+;s>{f#tj(yU`nxjVFM=I! zgbJga>Hb!G+Xie}I?kEQW7@{n!e@+A141tiyXW7ajKD;R`$iF=$L}COR(pDUN}2Sn zrVB$H77dp~JZ8Kms8js^*h}I6YB=rL!;U%+YD0^IwniPQS`(grl(Jbz(eK67jQ$u~ z!_G}`(=CSX-LiTiRh8gw&f6-S;d75_vi;Z7^jn(RV{a@%wtasAajv@H7TCz|W%x>! z8L22P*cer$Gk@eJTUOgoUnRDGZAFCOB6-!au}{-+cWc);o$LDq+OQ|o{jUe9a|c`u zz{&MLt#dsc=dIBczg>fXN?$4b`LhqQ6i%_J7x9({`l;k=ND4OaS^pzV5knXtDW*QZ zK162{u4K`X+$d_Di0Biz()*mH(+%Iw{lF=c6XEe@*!IzBFMXAhm^oclEmmxeEV7Y4 z-_qhiMC0+~RrHv2sw4n1HkHcker_={8Y;gOyNVJPtAleQ(WA1Nwsc6SI0+Z4O=-;7 z(p^jIjtPE`H6*S6KK`u(OXs}Ofmuiv3jSHjRJ4=L+cf4-ov>N)*3tQB?mnIJuQQzHGICBp+yYW)oR$kZA{=I4e;#Dg$hddljPc+rK4@O@ zJ_WywAq_T@3_D;SCEDu%>cgV(Xx(Ud#sdPo-Fy#G9P4U;0@suZQ~*0TNVJH941U4s ztb}A~K!)sZ6A+amGl;7{B_-LwCs2SQOk)80y9#OqP`fnO9sOQ_H294DJscV^v!rxB zsm?r)X+mE=OY@2eMQ#C=J#bN_3s4itk)-8(bn0)K2Nu8+q|$-!*&HTgOk-8FvyDi(uhAF@MbN29Ov`ytrx7q51MJF)w&8$Iv%8 zFE{r3knij^8{mo}UWjlaPHC`skz+P5cqGwdx?h;QLn?4YBo_B}(y4)(4Q!Oef6W&N zxD8>y0tf-TpoNvfnA&Fy#RX{P4f$+>ermXP0d>^c(cVC5s!zipJLQ;YI+>L*4N&ZF%sMQvg4?E z%Im)zCBJCHKhe_*gc(U$7m#$)@iNVzpsL~Cz+H=a0#XAo_Dq891_G`9Le2LCKEb_W zL+3)o14=Nz!U5b~cPxP%+~ShD!*wo!T0#KWFEX?Md~9$mEWapyWHx?b7MH?NXA{>0 zk0sZ0p+Vy2X-Q3lW;kt3&gMNaQe0qdbh?daC@Pl3=E3+vwt3iZ986+A*t|lxT+{-4 zR-AT3T=qzDR&6h`3z=YiEHP}!9;GL(UwJrkWnz`lrLJ-FB)UvHfN$sf7e9S83Rl4P z)5!Xa=Um^8?4|q2njBBXh5_kT^QXl9GnO46jUTPw?6QUd8h}P0qfY%FqN4YGpY7*s zzw-8UJ1?@ZgQly)Vq@yy=7v76ZKiIeeeSmMvAb%N+{)iG6aGB8F;fBCi-q-v?*+i-$XAH$-$t%Zi;aajwZC>xl|6Z{Gp0JTbvHjy z!2)}heWE1D&6vd0yrXl}bgZNES`3Cg-}fsTKMf)f(RG!Lx3!g(x0P<%uK#GekOpXo z{t9D7O}&;=Q&vxr?$NUzQSBFX<~pQQ6j#Ec;Cc`?os5oasIJ$V%S*KwX)^#@rarFQ z$f)yfn&gxYp(gq^2jbLU4%iOH>hr1tc2JmGzMy&&${Mnjz1g#ocKZEh$Mi>!jn~d< z%`3Jy{DLCOfeny@vik+{?BKt8^cU~+R9?I9yba$A-eOCqXfwk<{|JVa*|P9gy&FU> z+4s`ysNa4ZJhMT(uN*u)A3Olw$$W+Vmh3OS`aynL=`QVdn!nEEJPlfKp1+f)hl~P# zf(lTh8QI1}GVxSgIea3}hJy0(L+k@u@jc4^s>UBj-iN&)nc{JoDy{^gI{rg+u|WkZeJ(%=&N% zDNn>!KUh|63n{y`{+IN53&XoRAL3;{dNE`4L*O}m*sKSodRt1XNedh+KC4>>8mP-MM{g$|Bd$m)6T(l&!Ei|On1AF`3T=crh`xTbNlWcTZB{*T# zQrB5X%)X&N#{n~Hy+;r1VMb|qDvA`O%6y^)An%Sy#l9?aDZ_b7n@&D?ZA&-XEFNsa zCT3+WuGuzV4%dT@U}6FXn+xY40=068d#q}C)1aio8_e4-{{qp7ib}=Jm!d%37;;>A zEZykGat$UvN;@vTI^V=Z5C0S5 zFgI8D!6zSWl8-KY*>|^bgq8^MCS~Jj_&>#Be>_JeT2+%gDJrvCGt$~olNuSQN~`Xx zTMHo0;1ivyTIvCkAGS~J__&r#IYTyb*3lw*&zHbe7cy|aNU{7d^LE*;yG|{HO=^1% zlUw(K-TEo7c+b5%uD>=H3wtuvOtbRjKB#{nmhF`S{Bx3Amg(S!jPL~3yfHH$wYdD; z)n0r|3doL; zkzM5;C}9XHz78?F;h=f!Ekk^X`PwyFB;-%*wBJl^)L2cz>igQ?OtSC&ahqx)J{1Ks zM|z$g&@Rqa!j}qkbXqc4NM|_rwSxF*@_F(_5Pk$ivYxJ~tr<~vU1RAXnt|b9Fv9JsI2BTAZjcc?StD;hX=OAowtX-RbZu^ax^u5J)w4h<1x=8LcaZ8 zJRSM9-kk&HGG-hdnq67ytA&+EzrO}j@=C^QaJ zj|2|0w~z@*z&+rLuEC?GP=iQXtczwULhu2yK4Duv+RqrE(#0*{a({r>C|khQ_Nk2~ z_f)mm(e|~M3IaO!u2u4X4NVu~&Z!;52Q-aV{@V-9S6#JBmK8dENqoLldf}pweE+?C zL-iF-x4_>3?}vzn_#wK%&*$B)2l6JSEmhN?W^(_{#c z)!BFNl@^L$YSf>;Ou0<%rRi+V6UgrLd1&+a(JenpDnMKjhfif3r>uS$OX|lQKYq0S9f>~Fds}_UKj+dLdB~r_E&^R!Jg8Qyh0mdA~exPTSIqw@dOY1 zZcgJ5KWYQxbNn7A)g-g+7zKjdFF{+tH4AK{sUt{+bST{*1aSj?s2o%zFr>Q#MM492 zR)xLZpcX2R{f)`r=3+7#vBFYk9I>eutyGMD?C4ADU8W{jR5VYMD_qwX|{tOZ-gz{6m_hpJ__l< zej681ljmTjYpddb0MQ!tF`x-xEk+gGf0~cwqCs`<^B`--n2_3FyE*YE z9u-03aHRf62HtMfrKEss^CW7H;-3No6p5!`9Frf}oBuCtrPp!qT7t1(++MBc8p z((?E;+j!2(@DK|^dZupR0B#SFkc{b(ySJ%G=t8$(i$!uGx3sD%gGuhZT!4M2{T8?r=O}{;@TrO~! zn-}RMUFz~_z&A=C*SrLNoV=t>_QCo2wL-(_p1_r;EMEt66uHqB^zp0 zE^lz!f1~tzyZ|58go6b5@)`5fba--H8(l8m%0;Un=b}p$r4c(WJun9b9aF z%uNCYIlg#nC`Nw1eVp7fS+*u?;^XwLR~h?@2REG77#sCUV~h|t)BRu_;L%AOz!oX1 z{o*;9f7VIH<|Z?Z1G>$qWNlZ}OnG{>?R-A`x}1KW^R}bo#Q)=WPJ80+4zEY0GvcQ^ z?CAc}#MN8`sjP+3aREv4@-e@G8#;S&Ca@m;q*8&1hKRtDZPc5E(; zuZy!iRLBKZ)z0TyxEUCxgSxY=VR%n~h^XQ)1(WkVqCo(}cEROg`r7cb#d0vA%ifMp z;Pv-N&?F-cq~OXr!7JW0o(!jtS}oKV1cOaZ4XCY|`9eh@uvWEW|AfGw_(DUwKaB4v zKd-L>->&MbX&ep_0Lxhbp8ZJa$I`y$gf$0xKh0E54o~S} zXEgx)%Exy{4no6Q>lrN#?etYx030(=k{1gqmy)Q@f$?aeYa0{}v{7u!dFDEbHr#BA zH`p2<(oSX?3eKY#)kFupc3a5#xYkzDo#hl52eA<3?DE*Nfi@6;gp%xpD~q+oMT4Iw z+=h_Qg?&I@K`gm%*XvL&Vy5hoIBHoY+6>^upJb>^NZc=mL-Z2XZhPeHMSFE#;1JW; z)zzKuS1;ctsnI?JCCJdn4ugvw6AOr&#cfS>TujCA<+uHa^6^>FKe-*#Ap6df`4`ZB zEZ>4Qt=>C#;vE~l*`l>+c=gqo?POj{q^v z1vo2AjhQ?rp;1Cy^92V4FZWs73r0t*C=B5cp+DevJd<#^M;c5fo&Y2)dp(3%))G9k3quCdM2v!Qq)RjzNL)F|%VCJB zb4R$U@&9Nv$!oygYF1aAURp<_LPcZp+ z1#9l!p+F~#L_8fx5!F)0p91-6vBuHV5p9nH8W;8fl<^q!$Eo8g^$w34Tz2sPb5M}dJyfed zcvoD{N`0@0HR>jbbNu(Oj@W%7RZu;8l&xML2E$S`eceQE1it22R)`%r;L+TEDnH`k zqsu1EiQm$5Q29J4<=U(Z5IdSAdC<^ZsWxen7*iXr;x30*F|um;P7LZ#i<#Z9We`6# z)c-KGSd;gTaAV;Acr>*2Tvqd(siQ<{F;?>=NXcsuIn-u2 zByEaRw@}A8iU_#@O(MV{OZyIlJ<>1t?C@Q{=bZ3Y2#Cl-RBfD=@hJmcby}7nudW+G zg{qsBa>W?i`7Yx#y1clP#l-;Dpizx%hfNvfp(!gc17LQKbx;Hkpmf`KLn4E&7Kn<# z`fr&HkfutdUfK`oWwoC>KI{-T#gRP;ilSRPFFPR4jO0hazC+7`<+`i8$M>0ykD8u_ zPWC9Egfg((=OUm_=MXAR1dAt_}7@&t>1_*8Fpke_uonWbPVH z^#nJ5r1FjnWss+agoMYqK*GF1hLfT+Z(geOE|(6H$s41#$)Rj4jzP#w!OUaG{B=qX zs%BN}l%A;?FcOK&HHud0WuyeroO5RP|BjAh?SLlhXx>UWa%YF=xl^KmQ_wR=Pe~;0 zlHW3-tW};%5M;FzoeX_W$3uR$J^Bq#)?=N94UtYLs7VakdhabjVMN;t?=5KV8h+RF zVz>koZhKR2p*ybWQ+h3vcr~~VLyzQZ`;(225?PnDo?Wp{h$EW{GQeqrJ)ZH8Ui-0} z$AIH~7B>? zc#F9xb%DM#zjD*IqdSLsa_jXNUR`u7;RSxQKqCc89jbe>*JWhDg&o~_6TXkh~Qu+OiCkQm<_ z&X5>Kd^Q6gd|B;Ke6A+{{3q> zvG)U1B%d$+f1^zyFzz{!fp)2S=**vfVLHq?ElKR^**lDv0g#T+dN?ttmRq}pq&mX9^8-JSaP{94E3ra6Nx6kvNt32o8BHvFo z!_WJDo78_)KI6f%`-j92H|=!$!Snm?{g*VpJB0k7OL1jzC3CyvfhB=bgH*+Is%N+`&n9)mrumg#LeDbXE`0*|e0WC|-xsAxQ^6Yg5V2cqjVi{DZ7~?xP4tPV( zNI7^`K_oS0f}N~2zKlOHD2+1lfjX=tyFtO1u7}X|(@uQM%q0F^unt^*i&ZCnL`CfY z*bFHh9s+}W;1+p}le<8NK7AmR=jnmqJ5uo!C1lFrN)v*aMHfsI#BH4V!DmQ-C(>Q2 zVe}(@A~#7~)B}h*@4K+*(sVutu#0DR6D4&T=06;1_z<^2U zow(O@7lh}^&f`8Tw2W&g`?Y?bY9#s3(fO;W+Tdfm<8!)SQ+sTMcjq*L0%u8*8Ssr}lqD~r3UWiZ>{}|+n295jp`^714A&D0ib=WY+@)ZOT}H1ymOdRIZ>P8MgEF*^97m5+^Zp z*im})ZNpCPB4W*&%;?I#3s!bSrLu!mc5DH&g;ya?O}l1`%)%Lo%q%BC+Y!R$3Zv)Y z-$f-Ox8Q&1nOVklmRpvvM5if0{u=>T^7O_Kg6VP?UD$)H&K8U9I+A64P|}UJXN9}w z;oZSpwUXovDXzS6h{N<|;&%dMr}A$2mgB6-NjA9fk?$4TGxOhZ>4?-Jb#BF?3BA-_ zG!qK1>|XYhyQ}fvYgP7bcjf67Aa9ckMt0q8edW&Zs0{CBarC{u#?`}s{i4wgmbZ|G zUY*OGS4_H62B6)|iZjET$00uKUG0+%i&VbP4|DoK?b7Xi7ah&uqODTZCefiz{>(yk zj`(}N8wl>`wUprMuX{&esWbd~Dn?ivYcS8gj%fJ^s`E{9D!Q82Iudn8p|fIQ@EOg0 zQt(yiRycGQH`ze#@#RoJoIGk0kOC;!#<5D$PIlId{idK_G~N3tOKcLHn9Q{Ty?)b6 z%zGEI5-BP{>I4w?5VIx2B_r23tOhov4wIe-ONXwFF#^Spk^vJ_>ySaGM(99 zxyo1>i;tR}{x)G25u(MD0(Fn(xf33RoCLVcYNI1RsbuFB<@?C{{mKX)M^I(X%X(o+^1=?b2A1b@%~g(WrCSJbVpxf^JLJg76R zWZK@;Jd?UM*LJ8nwIKX0t9rNWw zxY-$(r$<2nrbUF6Q?A9#UfuE#*KABEL?0b_wC1~2D#L7w@;_>A4Hpkq!fk8U3vI(q z3647YikkVMD=NU)t%9?OQ@Qt_yMr{V2bgd9UBqx?vGy(xBihkZ1D`(vLr%7YqnI*ctd6KCV)gj>i?z$e#k!xQ!5uV#?sqEx zQ{pfTF@+0wl=`r^Yb^bIJE+YDZ>%9{5+iY%j33;Arj=m&i_uK2FZ_wg0ma02M@50! zVy2l|LZ{dd&P3`;_OYT=n8bC*<>1|o`0|uBfIX}6Oq~xfDoo!$pj+i;MRxr95(EtL zOWf-Lq|p}Yn7`jbJ1%gUP0Jg?5%7vc8SodMhu#L9x)zR0My-r}pJQt?O_Xmh2n6+t zC4$&{PdtBl73D@3_ay)P(mYuP3|cxpBaFM&XcO$g1 z;ZpZrR$gWHaYChv)Fwt4eIso6a2kx$QW7fBgOBe_JoFaZPCH~(Fsq~-OnCO&k^ z0C;CG&z?a1FO-1u|DXhErjnqDfEJyJTAB{{?NgcyNV}F%WoX83sCYZVF8Lk$@xfkt z^CW#2_P<{igjC8U56e*apFY=%g33qxqzZisUdrcrxq%sj$fs=byL}}Leo}RS>z$v^ z-|y$<0+wtNXwOfF{Jxd~I%wp!W-ic-EZHx%v38IZF?=m`oFut}ZOmjjPwY8z*zteL zuflR=*}9ZbE?t)*aC%b^+ao!J40(!J z0}Ts&L^qmFMc{s*mABb_41Yv&u9Mi+3!&n0?g3kKCsK@j!IekKJ=K}lvb-Tw^IO>f z$gcJyH8yTrfU}Nae7zM5!%pIFdmi$zSnM%VW7i!hk~=* zsn154hu7I>?iOdhl}E3|vn$9Rw0_0z(KL9n><75Yjp-I#z%Xa2pJhlAyQHbFGmgd0$%23+r8P;5rsmx+&qdYaiefDgs*`B)w=du(IWC&TanTEC*` zs|e4bO@B0#pV(-$W*X5hAyn;(G*Wm%QU9)m%q0VUG#Jn(l5j=r;Z?dn_vbsoG3s#e zF{4d)x*)D_$kmvrJLi_>Ew*ILI%C9KH3-QC$Zo}O{p=A%Vpc1C&VCz~CWSChIM)QW zQ_E#W0NCr5iu@ByU=j6jo!d9Me-r&jbHNEQ(b9wvPbq@vj1=KV4NEK6d(6J(bW8=f zPqU#g-*5x=5Msmx#dOZhgEW2nzUOJK9*AEIgtl zJYp47GiztcgO1;DOW9~q)27;vxBe)i%Qc*EfD8$vk08xeP9B^pruOFOc8UU5Q^Jws zUCff9^AEQEb34}*|0*Eq!LybDj&&!KfFW*}B?7X%f!PR9lM#;o<`raUP^@BqVdYH7 zN$bn;fI=-v!m323c0(0oxkZF*Q3bh{aqh2vDMM}uXDs`0s``(j_7Jz!Kg#CBt*S3x z0Gogadn4FIFKeVVNrx^4Qtebh34KULo)0{T!L9CA^9>rfo57hjvPj%rv4h!rOEk{a zyR%8PV_0P+FPH$93=Y4(XG_G8o5t*WeRbDxxWVkJ>NQko@)}7ZqNDcr?=K%?;k0(z z?dfbF;$b}{ZlvL&&7N`IsDOJt@kTLNfZ`o15~3SGFfOJ*X@nKNN>N!1BDPv94_Y-+ z=%*a}`+nIPWtyrMW_w>i5nz1pn$hcir%uMXl84KiSFzmxnkb(tI;NC)UiF4VAxbv8 zLM!ZCKXMgXQ!0L=^1l-znxevKJEDyIx$zBX?(@OY-Pj{BkhNhgY8 z&i$o5O4|-Z#^EY!)|P6S^$IFCh&MoRfsn$!wGyK&K(fdM2i7UwkpVBfH`&`%GicrB|I*{lCRp(33I4NZbZ9K_z<$S=Bw1ODIa33&0eqUg|rL|+N^2t5Jf?-ov5l| zrK*7MDCP#GAF}msr#_?-Zt>>Fzo0ZcRU&5SxS+pWs9kUuY@sA_sFrd)U=Gg<&jN{X z(x7OVU+|(!rk$QR8I)^y)+rE*I_S8)o9*z1`nLYEJ_hZHUc_`Dppeg&fh@Xjn_oL0 zh~g@8mLX&Hj1bE%fv2DpYSR$Myf<0DS+T9s=m>s9ZKHt;YVo}TP0(nT_(W4H>a8zq zjb11#ZVFP9(u}$$pqYLVfLtTW3!_TnLfScJTU;05BT#JUpP>}=6U7*2DO~Zxfa0n*v3c<+7%92(=Ll+}gl|&=j zaRbfa+{hSK9n7vLg*{7T2fW5XBOkm*3%~oJg(JYD_17Q~H4NSjK$jc37U_0Qo(0!D zL=d0Z)dSlzWN!SaGKEO=fW+&J)>{~y6BYS-zA~6570;SKqD0CHp)oj*^^VWl-EMWm z*ZA7U?D9*wWr3hV*|Si6;WUi{qOnX8OT2=6TM?%`ctym&eig+yDi}edClMt(Lu%hy4Os!Gn$1f=SQM_Dnezv~{MJcZX`+6T^MOs>awCcFybOSYcw!u+(^SZK=z#gIPqOfHj3{=#!=l8TExIW@d;mAqIm9=ajsN9P`auT zQt-6^pugKV#4byX$fd8##jG|S{4{($R++>@2%chMRW)@NJSvXg7|Ux(?zsQLK2wY` zS%-6Lr3Yw(MK^xPoW<_;E@SK-C|Timyl?LzOixk&*o_%#t*(zLWX>CxPG=FQO+N6! z{r0dtsP9~Pn(j#I_8Cuoqt$PKzp%e<45kbKoN)Ivd^}{bX^SfRUOM!|^_Xh3=~kNs=J&1Ry3LN9^MO zSf~2UMP24Fu9-{35pB(4N}U(581XhT`j&=^Dr&Dc-}xYE0k1o=J7-)G++KhT;&+B0 zVEgOqBW}MeuS}?lsj@tb;L>4X$s&cI8SB|5lpyZM2S8Oay;AwKwpG{pez{bqBF%9A z%JbDXXznc2ckjjYPqyXdU093p1x|9^x(6yzinVG>a{aPu;H%#jJ(Tle#IUpKJs3CB-PL>M-;vUkP{XCYm6xtZwKw|}d5I`Q-7NU8Y# z@xi!(2`Jr1L@y^$d;i?rJMqj89GUyU`R4n42=%%u55hsV{2dK!v3BV$v*MS#`aAp7 zt5BK4#A^md*s(yH50;pGgbZGnf!zXWVMIP_Zzk|U@_-#8c~5A~ZLwW*bvuxI`WqmJ|s|E(0eXsU}?BEss1F9jip&?7TSiJUb$))5n`0$C9 z$KWf1K6SayK8sQFQSi+P*@(N$K{RymuJb373_t^{ zRxCLWj=`8j2X##yK&+aXyN!bm@iAG{J*XK{dn0r+r49r! zqh>6@&E4AAj?8r@m-a>N@WPw91K3J;CX&YWU6_p-_=SN5yW86T`vzi`tV&f|CK@g~ z&)=*>XF35fADUS;t^8*Z9;48g*o!#3ysY+AvM4&-ZUq)3k`Zj%_=G5aaDL}u-iF-k z!=%q^q2>e!!}jmZLo|*m!aOvGsXIxhtTZpG;Se&{KzTfho>GcJ9Yu5sGXM>RXbyPq z`p$Nemc40%86H^}Z9iD@ABrOfK^-w-1+~!*Z6>yd`<;aOe$^I3=FjJknVB|`3=y;{ z8vj5w8=^CzUI;{8YPR$Krg%zL8+E)V&e5+SGBe_^3c|T>RIb!f{*x<7GSE>cv*}_2gEH|c zLd27mf|}h7JvUKm0~pKT02Pb+)Gxhx>IyMvEx7>E;m8t_9${@#r`XtRTpFb4(=Cy- zYR;b3GDmxDkL;AclnfXw&Um70uJKp+>o2|*MB0AFCErGH-0E-1bAYf{J&dW05=;k~ z)$R_;kj$)?=VWFPkNBR9C_}GX9OkQw3@uSL$wHCq1fjo?>Y;qi>V(6+#Cn6i9QOln ze?`ZIEE7HNA)-b1z6K?0r43e?5XirP692*y`_KrnJhEQIU8&0YSeA0n(k;&^6lWY@ zM*cWnpn_9d%mfLi!~#Su`Jhf545Rk;Eosa=v?TK)VJRsW2+Ls7x6)LzS&BoFZzX z+vUkg>AIvP#BgranO#GLV-ZTq(F`m7<8SF_)v{V)*;Z(PXaPqq{KAV<48cQG@4YL> zS$v>!6;K!~<6S80ZG1t=j>{XWH-G$goUs?;n!d^}Xw7?L?FufJhqm6g7;i5j-jcP@ zBKW;O=cy($7;|P%s!U%}@^~YN!Rd5l^$G`#k^3<8*;k=x%bq^zf)$#JQH zzK|kN`>F#jF}>%CcuE##@{j%8?UjW>nsiPc?E72iSRw7Rj54NWWJ?+fLs) zuWU}Jh3-hvWUDcSr-g|Ba!Joe2o26hty-M)LlaVkSHJ@CHg%rxq0hzCwALRyWzmYm zz-oH$Jo1f^^d55c20iUKUok~DmJ}w5De7AtGu2UnLIJpfV0LMFt6Mqo#+vswTLhl` z!i;a1F_-$97;r|GW*0g=T{e98aH}#XvVT|OAbX{jZKo~O5qw}$ZqWeG^+yOnF(89t zQcv|aI)&QDO%4PiIjGGmtG*|9!S>{$YS2X)>=YbKUhdm{ICP4{S#dxi~Uq?00ese|kbokz5!_)fNM!50rAglwIJhwt-TnBotAvc5fTwZK$eT}q?JFS6Ul zqu%7o%S|Y&`CM6L=z04got(@nbf`HTCW(;i5CWjw&HjpV25f}#$v-Y@>zGYER@`>GcWOIod8|c=GiSTh zT?mjv(=f!IL)0N?o8uaf7$$%_TIfqO%)Fy`xZ`H;Z!pX;O~+`%EWpjHD&3MXopFoO z6=p94vCeot(GQNWRjYC&4r_yTlA3liG_~y9y1+MprG4zroPOthv?`hLRlL(bP7I^- zuqR7={`UfV`2MYWlVHiOg_U@9TcQC6N&!G0k3lR}RGyy-sc!w>3zK4hh)}q)mB<=K zo`dm$?hbMX9$!Ab>HFP6#a1q)BEH4bAUOv(si#!3UrKy`&!j;W6pAlpE;TVPN&u@8 zmx;)(+rmx-^04w&qPGj4Gv;3P>sC!+EU$vVd^+E?sR}Ps&RhB%ecUsoQwLtX}=?ZK9q@K_C<|#SEev`h_BrIN%9~K_EWV_lf*oD$4t2jH) zh4`v)91oW9IJ0)T#|(8Y%FOJKL;$9YTj~;J?vXo{`jzeSn10E;7Agqg`dKmHZ-Z^6 za0mrxI)2D(ja^sOtO;LQDR69T&~su>zU}u>7(#`qryb;;P9{yKIC}jqTOA%kSv}$+ z$2F$@t6Zv0?&2ucX0HX&1c?^b{$x^pujZ_v`-fDEn3dJ_yyeXc|E+kxz6+qdIMbT@ z2K(iTd9x$;O2HCi)=DrOWOZ`sVd$;Rx(c|!zW!9(4e(ao{?z+{Yc)QC&ASQQgYgI_ zYB1wfGn==S6x>F;p0iK}`ObkXFOb?O#IsOWvo zH|iMNysd!iOM_i6jEMUjiUOpkHS+(mb7=hO!27MRJI%*Dxeb2-HYd@vZNDWSnQ>nH z2NZLsbhcsAf2SjtdBjEhOCn5rcI(E+l-I%MbV~hK-|lFbkd;uHhxI|O{ai&s^7>?! zl`+*jJ`$C_qb4s&wpPf3kLq5v*|$N+<9qCoN_PF=F1H|Rg1#ux(MMdBK8Fe{}v z4FknZmA%sB{&P;vTCM0c;pErGvtv_~~BRFj2N$3XlhZ1vr`{Dq=-_5*Jd;RqP zH6TFP|C6QX3XI{_ zHTG?_<;zpx=VNSFVb$Z82nf=~KPT39Eq&Sw*TC6@Q_z^X@3-Rd6yU1?mXiO+4}eTA z=Kf9qj2#@@2jJ1V4T&oK`r2I*Q0TjfBTt4M`uTY~9>@YT$EZ@6iZU|Y#RQv%ClgF8SnJ}z zFp?{k(-?79yjAn9o}n&e+mum-2COeDwag^Rv5D+Xzh8gCyIN~}v|^^$FSve8wV7z( z*K9f`)Mcew2HpNCU6dob{)mRpn$Pb7$Hje6F5L;m0Z(tOewYZ!>GVgjFDhl$`h>W- zDanQN)3qe4H&f$hI~M+|tOz3n7^{ke^om%=ToaACYMeQgS3+xnlU~(f05(cm>zYwZ zL*I_Q%8h0%w z3F>9I)vDBOVb_!6sDly?Gro2Hj7zlF9H z|2XxvM0^QrgJBOb>sPM!0sahoY1!28%wL@xE|-#RLOcQ2vAXgp^b~5h_V_LGN)x~f ztkY-3>9V)WaUjriYFwA1RqTuU+|h|CBDHuw3fATbOc2qub0*Kz$$@x-SEiCN^X;tU z^j=tr{Gt+75@1w=-VyPg7*+G|Lj9Tl`6TfsCd+QxLhGrx+BP-W0fg^l;wDP!!~b9a zKW2%+Rf}0TSQ3sv*`p{zky(bQN^Vcc@MR_<>yvx5)S_KaK zf-tZ)?-$CLc-n|z1K5t$R(1(LZd~mUrBCYoO4*H^Vn6kG@?`}EEm~ncAG@3N1Ko`wDjOs>swWE|K!LBo6WfSWuOsG8X5-&b}knn-L%XFy}_hFUW|D$cS8fueBbARXa56vWGGZlclj=)R`YYqnj)UMPV)) z`{htuaXx)v0Rg`(9G0pv=jnoZmYaW_>z4>Pd=WsafAVt_i7}wqtfL`%6W)E!2XMdv zyMS+r8T6F^njf;%458oXxr;3oD$jpkd|To>I?YQHH8eOGTZfFHYiQ~DRlUw_3{T+1e~?r)Z9!p$l-30*)~%QtbOSHBE^ zs~8-8wiP^ps}2U?_55z*cIONNRHaHt;J3gn>UW1mSz8Y%sl7^$D2$u*GP~ z5e}zP%eU8ZPy5?K&>221l-4+As~m!F!y;~M67XeBUC{hv_>0g#T1-?q-4@D;KO@3_@_Gp zt~u%eT#pdVeWy38;Dme?8~iC=R(Sf!o}+u$cELv9QHsDUhdM2j*ghuoBqNC)BX`J^ zdcEAZ{jiNB1?P0qz32D;uz@%GQ=?X zu3*Ga*wb<#@EigywgZ{uV9y$m#qHj_0#w5Q0zb~@Ab7c;xPh7Wd@06OvQtI5D;nXQ zuR%_HuQ3}WkO$=uiCXR{Q?ytXDe%3B2uFu7wpnYkr$GuGJ~@o4XB5-$V@iy|O;b~x z4DN^bzCZl^=AI?H^Vl#Z-Rnr?I~_HTl;N$QbCfWQj8^Hs{$L_dwo-V+QJh~%DIBQ) zf^?&?rzZ@tK#vG0IBhvi#^&4)1M2x0R&?nohJQD&SfbL};gGf`Yi?vXt)613z`h~o zp-8=H@nup^-W$Q@r4=B$@#z{#k2}E**@W$vUlOlJB3+T|>ckZ=j*O_UKv+?mp|!Z|ZXRL!{QOH7@i%+7j)g|TKiwY;v5>NXOm zZj0tWA0f(2iPB)23RD!`~Gjms`V2nvg2qI(&G_ zP<04m`JiyEG5KWh{VRSDMogO_XGHxP)VuFG3D~cG^6m$=LsZzXp#KHY?^X*aEx`KG zFQU@j4X?ai;+PH|uWIsMr%kuCLJ%lbMuDi4JIdsLFiBNYg3H66$n$Am>M}yho!I!B zkYrDBt?w$05*^VyN_5iG$*-rA-TpyA;DSjRsYjMa$`I0&y@}iCk(*Trk1`=1M+@ul z#x1Ai@UK3DtS7k!Xk*usO*|0Z!+5;GxBL_HPKe9?Q)zP0~BMHu?@kh zGEMXOwtaz1H%p29FY%0KKY|ob8_i)ODrPN6UR7eCd#n&ijvV_(f!1QFcioY9thV+?qX^j3uB?STL#|M9c#lFy_*X=7Z&OvX{MmBe+|Ip4 zs?^8ftKV?uFd$n~uYI#JZgp&T1u!=?gf1 zJ1v>Wh~(5DOsFa@K9rWB0@3y7H>s0R2>m@&HxgDg^MCzLTwapGKm*(mfzbV@$VaF*rs@aW%qhe2OJaaEmG+gaBg&oC&S z_>Khq(ex&LxJUADjU4DmT~py@PlG^{aK1}03>cd>qvWU;#MYM4vv=6DnXzGWv$CpP zPV+a_X@*V)C^m#o%HNt`f2A*fT}P8mz2=d{@fGW8c1-(Lt`Mg7$>@kikaP&XeD`ht zVR{PWPC@IuZKzcPNX$`QZh1zp7pZ5zb1q$c%A?F1dCgaxeL29?j-cXmgrd(&N5zK z!si}pI@pZrw>1=*!tHF-oAXv-wf})?Z1uc8(nJt4Xu*#I5Rp?0h?DIZ*4(6SD`+N`fpH z(-Ey)_+)nhn5l&`CuaoeBWWx!#tmi-aczcZR9(WInZb2kT4cJkv4?e)5^U$nCO8LT z*0{ycAvS2cvMOhFe@(-$Dyzd*r&|fj`GwKe2RSU7$A7DmNnsmgTEmkV-)uN35n*&7 zpWbT@5B3RXHDebD%#Om2?JjZUTUrAaS0QVJx-Sd>h!2!3>O<+%dqFH>f9tC|k@`G` z#?SRm$1(40^F0gG+r3`Pv8MVtpcHQOKTMs__@<-B#_84CEQHhFg&3Ave0 zqPLNu98)?v{BA8=r6ARS#>${Tn_TUQh9{z{Jz5`9TWbf66z}*$;p2S)?F-on0y29KQl&w;o zG)mM9r;zJukf&c6>U`KDO-1J2=GY>N?^<8eYiXo!lwh&+fD0uxY?1PCYd$t^r}!Ii z{iy_T$`%vJZ`{y1mZIE18^ZyCG#o^t;xzCm1aluL$%5OjK=|t>o?VjAO$hV5kA~Na zG!R8(077Ee@EK&p(t91dh1g;#|H+_LQB%V`08eQt>S-*7-@{}JhZ%fZTg zW*p}xy0=g91;ilU&(jI5(8Nw{A88;wb(brdjY@LDZ2PCVYCoGTY@}+JJ<34vLl}UY zEwz?c1qIBssaLJZ6jLdI98upa4co;LGB0hvfB-yWhMGZli^pD`+qCcragAZla<8}P zXD(He@9@-pJ9txr)M(-dcrJ_#8NN`20?||WgvJV*ofK!A0w-`-5r}oNVFi^@T2~b( z#ZN7tM2)^NW@W3UrpBreQb^Qhhy@&*U^A!J8_UL_<%TD|`$2!FV=XA9C6ShKA8gAt zD1e7IQ`sy>bIs9zcz;D%f`IY`9`)=9(?4w%$+aP{65PJKKELWrR6+aCH#@xn82PregU!nTk`@O=;h{!niIK*9@ip$4;rg^aDCY9vL9E^tsOT zHd!gQCIzm!CV#F5YZj>s00Tjsf>PZYNfFZ|C2G7Wcq2t{aW zz$7A%Z6CaiQGNhwU0pIl7_@gY9Tb!^Zr2z7cPaZy8szI8{Yy;@gwlE;lnM_l;@mxW@kMAKXICaenn0v2*u0~7Tc_CNS0&;M2 zTOVSPTGQ&rZTTv#(N_H>BpY&d9^A05Olgepmq<$kyTIH>A@{RH0( z2q+o4NNew_(9#Hpy2WxMrSy56L3chNQfSW?;!W5FN(k*FrUsN|FOz~p*4J@?ia*`N zL_~bx9!JA7ydzBRRs3C@hW4qf1abV5lT!F>zM5@atyg1}^|JRF)FxCPq4#a2`VY8k}5^hX&hI^E!P99me0;5ZBnRPMSPl z5pheLjGJJcc9>`VFA=~b4dypmkru`-d!nU1{U;FwH|FC}GW0&P#BKxZSg=ute~k8d zE!H19&fIRLgeVdG@(b8!wGhLKUf9F_b$ODYnSAYF2b}6wZ!^H7I5WJ|gg_3c!cun> zQu`G#2O2|=yoKJ7R>K(kXnz6MsZ*ZIum_+Nh{2?kk5isOUSCIc#l*|k#W@S#o+pEQs_MvhRYLa7OIeqCME zt{)W~qVFh(L`eczS{)iK2QH^x0#O~NI7&GeuYt_n=Z@h)Gp8;m8C(2weB0W8NoWkq zB;oW)IFgoh>OsYPj~M{$Nc>*o#0L?s{-QoM_XF9-9J({+XZULu$7P_ zd>N6nE162Ley{^4kP` zL{+DhE~bg|E@eyo7+5Hd&I$~QM>OsFo_y3MH$3w|J(9vMlpqWV&pdq>mnN#RY`XJV z6Okf>v$OVL$c%F0-RPW8X zQ5J=wm=P|Z&p&M>AqvyQz@}|mmx^@n`AZ%~gO3t`il%RfF*vm8M_@OK2N^O_FP7C` zb~n-8JW)av$?smm-ThH(GUm(e8^8P-XD_cJA#@$vasSS!*yVkCU(P>t9D|zM`mwc$ z6}#-Z2@Ppp-@cXy8BA9~lUM!Gi)8!ka>hN#Ln6o&)T-w4)Zm4dho{KVelTC!s)qbz zq_1rS$jQPLbcIv2L#g_Gm>(&*!-zQ>yNA~?vHF<}AW{4XRETqgb6{SpqKa5bV=bA$ zTY$Jo1J7P=z&t&YE>nFFSmO3F92{~Y=!X&6qb8s=_0gSHO(Q~=A1|5h25+ZI0K5R7 zIK9LeE4HCT4So`oDEY`dxZ)$#UKY$_87tZVZb_YxwxX$#Se7-9Nn(fd?s1TMY~ICZ z@ozAc1ZamcZ1U`2K__e5D(s-CTk5yPgt>7I5``>XU_lJ({!n;_M+##Gwzp+J0TbaN zzu(>r?qfi~U_rGUw8k|TmCO~rj{W*Bh6!dwuWxIYje(G+`_F(tYLzI47M!a1z;Q)@ ztkGh-2JLI7R%KjC`d)I?(c%rz zDX10Nysa3~%oMQO9S56XC~`xbpg=9u{;yL0%aYDq(IP7{ZML^&IPv$d6TM3?PzDlj zXp@GAjN5wu^QOZpB5Y^^0#wfL_e?&RVj3R#e3aKu6BrFn1p)60poLL}4 z%wN!=hFxRVfj``5Y*EYV5=Iu}r+)ck51H*l_BecVbQRSRYpdSt(W)PN=YGU?Iu1uo zhhVy7CY<+XiHr@EHoIkJHq%{7U%HBV;IoJ9G=$GOK{QH=uqc`I%U%2{nu#_9O-VWf zKLQ?j1z2U>V)azY=_UYBDVz^L@J57f`#f8f*5Qm^0XYeYQ?=ot*){ckQv?U8uO$4z z+7fWFebPL3d^CZP5F2as1*_QBGj(2|2HYam^e%Pb=yAJX+l3bt1*P79wab20RhFCMJT-{9IiLb!AC714GE>L-{6vX_wa-)L|Z& zlryPi1ED;AofReqMzxDIsc^o$(LrvM?j^CYzl9S**Bj$gSX6k8zf5(QcuG65IwU=O zVhBWTX0WrgFE2010Y4u;->TN#d0>|ItjiYywH^=WX#vP6p$t|3(aJ`bere$BtfoaB z1FLE>J+!_+!(iwn!vPEcK`J!%#pS+&I7oa$8Gzxw(v)C=xdwR%?#-hzYu!Aw1~hB| zGI0fq^x$gGmw%4301R+bmLm$5U}dXVYG_lQA^g=&vMPl@p{UQ={4WX(p9+oY6+@OQ z!)+xsJ^;bT$b!M4v1;(7;xG}U)08#741_?;r(mSQ;-Z_EwT}#l@Hi9SFKOPO3oW?P zP=ceEui_tKC>YlE>l(_Q)I_feEZ(wdFO=GotoB6ITA2M)CMT5Y&roxmX5-H}jusrT z&TH4WT){1&W>!x6*k#J=&kQE!l{a^db)nYvmJ9bhxP~+sXimv8 zRV(f|tdDuQIAU*KGgQklCs9AqR_483jL}!93<^&kbaXC0*Su%}K9?kKXqLA?y+Y-D z-lnVbEy#7^n0hS>oV=E%n#(vkqAP5ERyU85i1x@0Cm#a%a^r#^v)&=(mrERkz{bux zJ9=$F*&)I~ZJNCA%umTa$!jPP{W+kxKJN5{SYe@cJ@OwWD3eVcwzYGNxk--|1cIAm zEB3T+Mo)F|1@OhdrU}{BRBW#a9ERmB!tN88eT%Azi@A_LEgCD?0$pbWbeO4Z?pWZQ zsoj=d-BAGE>;+>x%~W4m_V%0S`|jp%1^?)2W|uUDId6D6gJ7PV>0@+Rn{c<-hFB*~ zxr`Fj9CX-%$;=jdzCZy<+86g5M8ympVaQ)Ssh2~M4!u<+5bxXa%5z z^W8dq$tMta5Zz-^y&_U*$I!9ABt?&jC@0R-8NOuVSPY-9-8 zqc=&b!AEr>JLzxQ$)xgCV+0i!!L~7^a@t14Dbl0M*0>zX@^u(FI+bVO5lh?dW!yPP zm=pl4r(1a6>C3)eaaco7Xa!Dx;V8eyL!Sk|QlS*hYG~2DpuUb;667L=q&P|f5lmpB z&&9O;z5IzxB#{Z_I?sK7s4hfIGfLeg zCf#H+at+th0wPsq_88WerAj zwISAsqhx`Q;D_hj|3gPQZRDvH%V(0sRV(bvC%J<8Ln?j z(@s#5i$f7rgTRrX&6jg!IhSOg8*5(C;+j3rstx$~r$$4|Y=8b+jsD&G27~;&#Scyj z%<$L10vHRxO3%ph-+Rd|9i7At))b!|y}Xev2!&VDI+kQgvb0HK)-;DAo(=>hB?@st zDQktol*0C{?de!+cPu8+Py*PawN5^ObLLIB=e#)XW87WyXp`)?s>G>z;u!_8XTL_xD@kv z8e>dPnd!I%>!)-wE+07Tk%N`Wcv?z29LoZwPmzC&Te9DoavJ>^<=5&|6!Cn0Cgx_W zC<`bpe&ygK`=)}5rK#iqm8mJ^4EXgu>a8-#aAZ$;dAi2cYjTc8#Vp0{x*}koO}Aig z4*grh?v~%qOcoL2-D&(@lEX=K*OhxqBd)N2r8?vKew1UHWbSKJ;vaNsCSE(;*Zoj;h`iNth6fQ37gAh=(r>p#UG>xJ@44GXB~H8&8j zip9mpOLt>$6z4|ZmH3QXp=?arWf_fMjH9d}5TCENismh(f`aiGh28=B=W~(kV=77z zE}09>=XQ_gO{(h*;pK<eWS< z>bJk^3AL4|2*-4eTfQAzq`N>O@>@$uLbpsM$?{fY5I9yC$(#>2Ft-RR97!#bI`B)E zI2q-?m1rNo-;VeLPXV|`MAX=)bdTbdguC{L;upNXHGU+Qf*5~K@YMFiC%3?1_eD?$ zxQ!FsO{`2RD$GR~#k&!~L*(bh^x+2)05#7EQr*+~Ohk0y28$pkF#bgI@oPG*%CD=P z{iTs&^$D*wuCMsq(|lh8u^0R~(8 zk_6^l25%p*e-eN|VpiBrG~O2E9gdllC9w%r7<^8#xKJP3yqd8QbJpz9ROB24K@H7W zAGu3IhT!+C%W6yE79u(rZpltQjF!SdF9frN+w7oIR<1U5oH$4D^;{D3W0D~7lhSmt z0)G!GWR|br$$s4+44m3D+5MiK%D6E3ty;2XA*m--v=l&Yw{uT%1iyc$qZTI zUSLjzWZbxNR;x(4J!0E0(JiH+c@yxjSn#Vx{gUw3nIgyY2NE zp07*m)8~$l>1~QFl8??;+uQB!dg`n~&-btguoH7&@H#VO$nsc`Ulm%n>Kq$6;J`tB zeKAn$XF5%iZe#upD)&xOJq+-Z7J&+Pn?`9=(gb|ugDmNs!NA_+?07%edBnqqijWL~ zsGcbmYNDpf(rZ-&EbGGPnbXg#)%U`Fc?p*rD}J)t(M47~+L6JV%-!yDFfEK7FC|AcAodv|4oMx^r2;yxQww{%}Sa zTml9x(LeHI4t(aGGKSiV@SS!_r!9og-TYbezW*j4h4ah1iQRdMsn~~0 zEp?e8`fUbu$wZ(Bds|!hB}Gl(Y6+DRbv=hCef&Kl3=+e5avv>M3T!7Fxj<2GJGQz$KG- zg-stK6NKpbbj1RCPKbwh)D?RnYaC?*qKf0!v5&PO#y)*djn`+{iG=wD0>FWX&$;!s zXJj^J8GKue4NCI{P&B* zP48-Xt#(Kq5^{UH3U<@=z!&=t&yvBWi`+nUb}XEDou=J^_s-?MFR%;%Ge{ZLn~fF` zP1|OGS=d)%=!_h+=Xoo%9bh2{g17OubCWCN(|NN^x4VF9=wOQS&q{@QibRXcMrdr% zTKlU<*MVb>0rzdaT3j3F!_zw?$t8o7Hp4bC;4aboO(a!l^Ei~=_T)u}Z-5b!`T1H z25(;taG06awCaI%L!UdPg;wz@m9YlHmg@nMerVh{Lf?4?C~oGFdlHWBeT z?SR-#Lon#c3Cm)x-$mjB1)3`I4Ktu{98~=9Tyhg~<0CBqN_556O(Jg2XpctBac#g@ zoi#2jd{t$?;wkqm^KEv2KJ5E1irQ{A(Sc68T8aESVv0H|mA`6M!tRS?<;L;Hu1 zSfqwZo&+v!3Ps~xJXBqB2FUJvAl1> zdyj70#L{HD09JIu)AQLX{lIw950td*GnOQ(WmDdAuUrS3aW4!mYKY+kpe83U|Dby{ z+P~%TfFsdxOA}x9%Ygy{K4RD2+5+!zTXX;>oIw6s)vV!}CIJF{+-O>a(+!LVuJYz? z7q92UMydw=K`g~_n@uW&8q8Kc1m2>N%{xK9N_ZK?fDH9U7*?5ei)6eFI^gT+rOQV` zGc$c~0j`&s22iabg2xWqk8=h|C@z65<=dvzhTT(=*2a##swoJ#yn6@-64O-tDi8mn zAez*gc${Uu_Eo#?tJpf58jN>B3lQ8~3566A04m{D&2^pbhkzNLJr3@H^1AG9)L)Tg zymcoxfTk`UZx%P4nxaxZEV0~0+MZZLq**2G+{fMzyV20V$#D9*It);_GLpw>F)SIT>NG zNna+9U8E#%mP0T)X7sSo<-xZ{)0Hld7}zocfaMM(dg6Xr?X9lrUEc0^pxG*i3_g8t z8`w#18o9(l+ju(FYks97@A_iOfzraPJq>ADy6w{$D@QqXmGMf(fF{unrc8NWj>?-? zequFJ1%IiIMiOz8}CXYC#(V^dq_kI-4$;|g2M^gGK9 zKnZnfomnCOZ1w!$SRubHL^7=rb1jHc2Iup(cRQG10OpyjKN$!bT;D)bl>hhwa&4C; zONb+6Ds3w*vYD$k!T{^@$J^J!AKE$PZEGmI1bVp)lRpc|NtjpboUGc_5uvt*PEG!e z3_D|vY1fY$M=qUgTb&3a&rHA*!S+C^fZI_K-~J~#hfesSRw#3-TErX@ra&A)H`=j3 z_N)al*IeS8+}P*sH^s~7olVl1Bi`wbZWaBjQO7n*dlI4a&s+3M!Az`I)|%H7@bGn# zT_NEYZn-J&AM)SUVW523YS#El@(Q&i!iBsESEUP;SEaH_%Q&6XvJ;d~s1cUHgXF_*$zf3G_IiW-F)xmZTyo z)N}~#WCs~=aNF*PFZI}w3YX@GpqWbC86mmU8>;Mu+h8?JqMo{Ky8~X<#Nae0dN9gA zrt)SG%~$WPt068ghhNIeC}f`R0I@JBs)XN(RTHg?*dan#BTvo>#{rW`(kqH@@lQI| zA$1ooiTdEru!9ZUb!vqLZ2bhTqivjPS1$-U)@03B0Z|(kXOGIZ#(5&Goi{N9+7sar zCHT(&n6rOQD^CO%u1OCcX#uB0rVre|n_;%3$B1{a?42q?| ziBLM64pcCplqAC(1@dcEL25qjqr{GYl3BXiR#&p!DYKEKl?<9c%)_)>ttNrxWC)WFiB;m(os#16DIK;3godVx{sc9%rq!B9vbH z3bC75Dl7hO62YhIax|na_Q{fqdcZ8@g7!2D{ft`N_1|2@*ILaHX_#|j@g~je59O~Z ze|N$Y);EmzBZsC1fM8e!4o7>|bpV{NLxgcd;6`Zo^>HYvHpl4S+5IS)4d~@7@YUrz z2g_M^LY}L7O;bIlwBHJ%)7;etODr=74oJP42s;a83>AvLnA#>4j@1%D4(?$G$+06$ zpNv`lYTC^HO4f>;rGA8?l~&bvP^LuB3t)RNOU%Ji@1MpW0I8Mc8Mg`>t=NNOCk-Vt zKW@v&RZhO%JX_q0Ta5H~ODsW@N>k&Bdhw(8YcM0&>iUw z9$EiftAx!1ay9Pr6C%RidTSSPaCR+bkfwCsSj-hIH+Rs}#`UV+Oo@GzY^iZMXrHxP zN(9qnK#k*d40X+e813>ENaV!{+PAx_I&}xie0XnJV_IW;jp7t68YDB&m2&a|*xJY* z!J}0wV0*?mEPJ-j7TPM?M69JI#^)n#3ZkG~Fu812vyaki_*C#LO83Z9-6luyr*ERH z6H`guXZ^-dgrC;M_sdguCGzad`z~W(@0w{%8GXFyi}rZpsCcu(v+U!Y^4n`{lWQRw z6$|?T+G)W?Bi05xgiL+MqP)~^N}Q^Fv!A&ifR;?_6yo>6**sAJHol@g7Zk;0RgRH_ zwKl-Je1NX>BD{IOP2zb)osBQ_iBmRM+Hl^uNO|ZAtyqsyW&N1@3;m;3Pu6A) zGc_Qge%sYme~W(6AqGZ?gG=aO*`MVaoH;P8Xr4xiLkbM8oY-tQ3*R#SVN=Y#@^79+ zH9VuZyx4>iCRH(zg4AAd9d-GPhq68vfH#O$TTW*3#-QmMhWR+m{OCbQ>&D1DR8nSP zXZ+k*ySF_N@62V-k+#}pV`*91X=l3Dy)ul&(s4jDgniI8?CFrdhp}FMvLR?u18pCC zFKMb2=trleVl`%GN9MtEX0|nqO54|XfU!|+tW&f$9b3OQtgg1{K*A%@b*6F>pvi1V zmNVe1$+9m<_il1#gWLwy3^&l6okD6Lk)fQ`O-)Q9t*UP~%>G)Z8?E!>%Qtm6giUKP zjnbkbjl@jhL~FZPVPpPY3t#bXH0Mf+C6|30{Cn-J`5Mm%FZ4=zc6wBL-TCD${tMgH zruE}shqTRB+S61qTvyG2j~kVJW5Yt-|B_#q2bM7r-PPy&02xw80^&AY?3~7W&=3f-QN6YTP{X>J&VEd! zaM8A75FuHBF>M9Uo;&NlxuA-)5>Y8+v(G#m!bwgzCT8n;c3_XmFzRSq|LII+CAaXD zftwk)wQJw!Gn0b(^0g>0ZjW1>u{=AQsT-KfP>eQxj3P}eD=9} z-TrY$@pxBlyRjpF(Nq~_XWP5ceui69(d3)3L^Y2Yd^uKj(|q?~Z#_Z^ue9MRp{SA) zs;2!-ycBxf+IgR(L0Cz6Bg@Q0-!;DFXZ|u0+P)EdQW5x4_PQrkT^AgGfW_KC6nS%S zp4S20sDUqiE0b{oxYWRnR%8>;#_90E;Ci^5qY*>uDtyXzZLBB4dJo;R=JX}1`rB0Z zKsNPl@n*e+?&J||w1k|2x7?1Wx?%KSkZ=jk$bcza^arfjS$lg@W7Iasht->UV_=AP)HLudo1m@tLi0viV|EhjM)V6(LtDm3_zUDNDLX9&(( z{MV1L6)mFXAfO}VsaB$(W;;;q$|&T4qbhX>@-=1S(qf1&6yeV9<)(Sdp#dkftTgM+ z0z>o6F79cw`r>0&dM00Y)k0F?Hn_KK?F|w4;-xP7DRc!Y7pd%YPwKgvwPkD@PMgi{ zPZ3#nTA8*dV910Lmr&ze%u#^4py}$})4cz{n+3J$@21Y!eCOL(b2XcbRtv&HRu#;e zI;U{^r}D;%Ps#e&+`Cjr3Ed1u=h}kYhD*zOSC8axzOLI{5b3_BZs6*Xclj0}Af{;6 z1;q?CjSk8)VN>_eZeRGTTAu5ek69}{*#?RkM4NJQEtkN>ErLsTNwQDVb6Wo+S^h6p zLB1E4j}v;GvsOQ&U5m7sEUeACt)?wxz28V5Z$3L$d`ibpnWQi<`zkJ3q#poT9ln z1kGf?)A4j`BgGyS`~%T%et#X@pp(EkEf*l(!|Sod_u%xTxC@@!1NIJ>c=+(Y4|={= zQO!NR4*>mzZtwR!l=2ho-9KOXQ3n6YWxx6U0(5M`6vsV2nEVfP|c1>T+UfUyf z0sM}1jZ~{S?7)75bv&pXCZfFZZbKbV2DNpK32LIMHH?rJX;NYT zZVm_TU5I*6Wxy?oW)TGS+o*e#HXjuffr5rWbb>oc0M+eb!THI99f4$jAGB^BfM;CC zguazi1$>F-xWuS-(R`-QB0ft1#K~SwAxo$>8r}iO#^K?^+xnlWc%;C!@tZ75Gg#0s z2I+Q)84V;3a>kis)o}NP7W{QPN5(%ygO01C-yeXS6297Gj1nk{I=j=CUTy6X!1OD{xpqz# z3HhFeCf@yzKx)`jS71&-kJOT-a;m@i>bweu74+w+B?3pD0Na$(;5Ac}8S1r){ZDd- zfJYj+YLIIjA%cH_!O!nt}HhKvtVqeK2oHt6g*mGrdjTh>(2(wPYy^lg_31d|P)6Dke&J zXQ#LS*JC+QFeHiNQ)MwELhpzI=@GV*uAQA1noC%%UlW-;gd<5j|8^oN8D!h|oXSP+ zTIqBQZ)(Qk160f|bb+A*zrscXQqMcJrBzqfZIJB@yz`8zmMPd4zz_MiGlPb@c{7Ti z6ct>iKSl#ATbKX_8tpQG_-3K}*wRVVmDF;EaWkJax%P6`TmlwlY|G+1v%Y1aw2>30 zd>IbsFQ7^aYD47SqlCJqR|bC@Ss1?kFn95qTj-%Z%6it<@Gh1 zkXbFxBp9YlBE+%AfFnId4aHUE=5c8fJ-M`X?XBH(g7vte$Xh`T)u_E<@Px_5d5Loj zLUMiGpy+&5O)7B?4y3>jBwR6a(9{UCt;EyL75|}ml@A;7tfNt){?0$A$VCBb3l5O` zy9dVzOFUXTwXNh;DK7ls`R*)KofO+r8=3SR`Fe#1i7v3J|N7n3GmUtGN@R-C;FsY= zj5ob&(L@>fL0B%3Nw1V{H7R|?(>uqFyOt|bFOIQ-o^E=Nm?3PL%@a$$+3!*rFp=LgTPJEYpM<6G{SB5y0je*L~$s(g;i%)4yc6MgAE}BFnqfwuj23~`t z@!W3LiA@cTH}Xu5ikpEImJJu@gk+ntCZ+BwpttbMM?-l6^yZmVZin8^UIruwCPVo| zw-x~#4u~Lob1=~Jdg2k2H#*+@&8#@6|2wPXB1M zS%%NqQgNK&IaL0%)*Z2yWh9|yj%qxcH5(eEz#8Xun80yd>p&fvL0_M+$k?sBT|N?M zs9JUDP3>5CSafmxUI5Z*Fnm?Ein_pkJYX#{3D~eoy1B(4%f4PZlpfC+pVc;rui?CT zn4ZqxSZbnhu$z|_Y2&PIu+!sJnSd&)cMEL}U6xt67F(hFDU$^i#}SxPInS*Pc`WcW z9J9BKA1T^ZkAzE@RKey49xJ>Xa4duJw@R7h1PfM_>AOXQU0io~CNhPvd3g15cWDh=rtW>YWlv`OT#gWqV zu5AkSo*inLw7K;KFCd2;9E3{Rhf~sp4Ndq5rSoflT}-Z#Y-9L>Yqy9IlS$;AhC?z4 z8Lg~dYEi4`zUzMN978J`cd2wKagm3c1;Fwnz-EGRHHaa2ox{c(&S8$LsH20Fj7pGmNHej6g7}A-uD8#KlKku zl^y;U{qx{N|E$!au&tOw4#_)Iwm(dlFMN%@nH!3THASc-AokREqrBYwtn!(j2W(wu zMrMhwH?7i(YuMbyNh$2zeHw13VI2o={C-q{>I+&FnjusMeb1IDZ&%56@6lNC*Z%fI zSYh}bk!5f?!Le~`l)tA)4KIx9+*?0MC4c}6@11$#K`3a#k~CovvstdR8X$^G*P>(=qaE2YS5-mh71mW=C!B%)`GU%NX{&JK zf(OE%p79)mLn{xfGQc**yK8uFk!go}riO|kDNTQ(PBVK;zs$F3Q`fdCnOe($ z&;C)Cg?T&4lWp(w$haTJC~4@CPMosrVc^67>+Znoy4arlisMEQBb&5T*U(}ewOPA= z-!jXbx@^_4v9Am@*^Ix)Er5z3L*4dh#m`zu?hggeb=1J4i@9t2A(=3PzV%Bn+e391 z#EXB67ONmVL5Yxd{pZqV@resET9MxpaDQjt6XP4KZE9}3DaGxeuUq>BSW0skWx>Ln zEe*7*Cnbgnt*wXL)Oq6hOLbVG(lTSBzmsfFTY`FuUAX`ch^ois7C(qoIT$@ zBGbxOd2Z)Q;K-d}1sn`@dSI~zNR+{I5OALg;kv@2CG%=86GUd&=uP4ZK7bt}u7j01 zewZ)uQtAfCg?GkKDFNaiepG^~sP+#Ii(zuD9w);JF_T1LJ;d*@XZydb}^qr}=72z5b66k@0u5QEF*ht4r8^_6QqnPO3+b|*0#&Wl8SBAwVf;fRy#V%jX7 zKeGHKiYu;SqyZ=CZ-T}AE-QFQIE7t3kq*6*LEp8S({mJj3jcEGx$@CCR4XyM19A%e zw|UH~o}pDbegL&ufo5h&r$w>BU=Mj16bi^MnI27g4{eqpr8oZx27S8pM%M4>AkU?t zm=kY(vU-UJJRC9?Y&*bG*6wtg^0Aljj_-=T;v-9|5?~Hy&ILN><~da8fkpbg$~;+A zg%6!@NMTRgP#+6*zbj3k00-HWR)8lL z<2ucQlh3UkWmb8o{B&-8S0CdaiPCX)JP@KVAacPKUqwI!=+8j3@2Gz#)gDcu(rGyi zklol}qxp@!8EmU(H@Zj*ZdPS(4;5q+9$*&kpZAg z->$GKt^e0np(@-3#%%c;9}~Yr;`(2?w5{3{X+x^@{YRcIwZzk@<=cLLi?ti7#GQxu zSPP%6{lP1Ot?Fjw-Q?TG$<6B!-RrxJ)7M1oM$S*MU2ob6t}S261`c!L<~Bb){r>a8 z(?6jJXiFs?sc@H_)&5UTiT>aMd57+-!F_i^&W!+U8*C4YcWaMm>z~k6>;4bHWRqe* z@5-2H>j~bycjb}nC;l5UClTI`r&}i>>Zn5PyH)z<`|c$pA%x>X0m>uzf%tywu9+BF zF?1xVX2#h^(EGK94<1#s`d?qzqwLPN7&M?M>fmI@ZXBaHYcl7@>Eq;Tg$C91^eI*^ zJ@yB#(chxVa^H<#%1R@iZpRrmm2LJDZ|p@+l++DaIycM>v=uEFmmsa5PcjluA?~eN zIVqOsjP{?(^j2g(l@Jkog>4ouj)DJ;EtDv+W$fK%m5t9$V9eNwGPddTEP(7yxDE&= zk{bwm4o9bUVpz#`?uC76=~#{`$WCw`3wo+S^BIut zWl*fbVMVqd;jfsM_LhK&QeZnN^@{i4T|i>^$D(F^5j*nPAoN3X&~!!Ht zTefYx%eHNGb#>Xc{grLowr$(C*=2j`pNY6J_r`tMk&*dyGR}#UJ2Tf>Vbl)~(Q5W# z9n7UL$jQl0LTlwTl4PTn|a*o`4RV&rf`UhNAhKK?WBnDiQ+izv%uUkqb>i)FQ?*U;IA~zo{<`L3h+q=`I z$gtO_NdsC`OVA`4Mg_oMI%yQ;5f)5pR|BSz&Sknj1BL^pf%j&9dyz-Q!%dG(#}1fJ zfqfRta&+|>R>7L>CZv?$9sL6S{ z+^AQxz_UdKt3D#&jP7 zCrV9x@m|?XN;xB1*P8Ab6&7-A`57mceY6x=Y}LiMT{+S4FCpK4$)-FpKEdJrOWFNY z90-TgR2+lr{s1Mms+-)u>%b%dZLTBpe9D2dKzCip0lP32jcqjYXreccLJ0S`i1HhD zUYMGZ>4rlXRa^kArc;`Xo^*#c7mAZSf8el@;!AQf{PvM%oY**==j(LNugGV;bNMYuMT8$V2JBMcU!3gWck z#P^`CJ-@Ol_)K`!2N0c&&-X-lwo=-{VDK&3{M?hMZx{iUDAJ6yl0!ny48ZYBiLrq- z6)T(nMDSWH^f79<<;8GuQk%7{lecb4v2%`wZ(z!Whr=NydL#9%*M^}n3eSEo?+g{A z<`J`CaEC*yo1bJL&*SWR;ZFkNk(XuD2e72Wu_HLo4{Q9G@$xfBqj$D)Yf4d&Z6=coakr(36RHKr!RtjG~L8})#u5uCTRD&dyV`Ss|#}eGsO`x8}ljQ^+Myg$a zxjZTW59L8WdTlPk8C|f0RhkXV*KAyL=gz`cIv|qG+fTD4hH5QS&=L!)vI(dR&gsL^yX8O{GQre7> zt9>vkyManx=36SoSYl>-?}HK58|WU7C9SD*v?k!|#3Lo>6;zz6K=3lbb=Ih0^%!w7 zIMa-&DWi^O>DtBBeLqWA1#ifYUvm$!W{^L{^RN?1r)Hu=RekokSry6se18~mw!IXf zp~fHJQNb7k(@C&x28KZCDq4r!6HilgFnMl0_#zjbdjO(q&2pgJdCKR7k1IJNDvR~F z2KSXtme^(OEp`*TcL0qT=_ZFOYI%W4p{U-W@<`JLpL`FUBOF%ruT+_GG!03S^2KIW zecpucCD9#$uqSVTsBN?hxs{)@vYZmI#P$((EJMZ2%!>=5H(|)>L^hF*%xxHV4uPBV zLmNB8x>~A`IXf1ptXBHnqukatAi16DToxUL@mA!U(QuaE-_(ZhX^Xx|TO(-sTvH=K`OM;+e zk(@+{*qRD0xkzAxPTDSQ&50>)U1H=>rfD(?d6V^U4lhM9|RpSVhIRw9ncC3<> zMPp@=gB7!ryL5!DEzW|Fdidr^MG~vd(Kp+4`~g;0>0s@-7>(@thb|9@_Q)j+bd2u6 ziB}iP+tBtax9hmh6c+CZ!$S&{KE|^)=U>t7NhA)897oiFGHnCi0bPwIk^@)eJXT~R z6=bX4$?CpKe7hsA<;5S@*G?~g4gt=}%UJ?5ApP6?5VonH*8>YU36Rf;A*$sr-Ys5LSs_2GmrKP-!1@>}Q zxWero_uvXJEvkL~otjcXsF75I;4}Vs#Bk-`5n-3zM^bNJzSz|YkB#7a_Qhekv6H+- z=K_!Q*ra|`VQKLBpE4M6Mh4>lQwD=Fva_b_zC)0t*tkLv1DM(WcP%`nZEbtN8UN+e z(@*G$P)pLC5HbYB@;<-8(Gel$x{e2&BK@YbpQ)`T1tiy93U`! z*bjw!zSv(Xm}Y*;kT}_|j;(Rof6T>6bjO|wM4I1x;EUCw96)dayJ0VQUIzgvjqAo- zwx1={$3qh%mn$ajLl-&$6A~uxu#?tDxWbqQ8~2wT1!1Ge_07~r0hX)tjq@b|N7VLf zY0Rbe$2I^%?d#X`ly#DZX=2YsKZP(M5BDQX3s{(y0aqmFWCp`Vzb!D7n71-Y$qlG8 zO3elR7-eP>#!+vF_AbL*GbsfW>1?XY0!N(C%hs5&17GBmJfdg`v13)o0z-VzsivyW zsq14=`SR)e51OH{3xbG4&Gxc=(hW!(>WS9RVp0%soiauskVry>76z(E%BBZ8oJJUn zrusvkN@{!@s^`Pd`-U$Tl7*-n=?>!i?!V+k!Z)4jF)=~XbBBm?P6`1WQ^`Zp8-0uH z1Pha3#PV~Ud!alQAZQMDRe4r1Ar~oV&7*8vHE}$;U~fZ%s1*lb1Rj0ftCM4MsgB4up)__3yLF5*KUqo2rAqV$`1%i zcB!)3nfvRf!Xw10Q91&I{`zAO%>?8i2g0tY%~FT;J0c`OgQUem0)%q|8uLOCXlBuW zR5MYH$_jCe70FtpzGm`65$M&CurW)L0=i**&@a+4VB6%C5rX4%DcSmagTzC2se^V;@D++g&XCWX}9uxLO;g?i(*{m9h#PV@m%k~o6Lz%3vFCx@A= z;ip9UAMtqs{Wc`n++dWXW4A~xH*xW_;f@i`#9Z8*1Xj5CT8!GtP?&a)M#o@;?s{;f zTd`~ULegOf`7Az8v5auNLD0XZEf{5`bsRLo z2oM*7eff!(7E-|6GfZ$8MSJySlK8A4msD6O!E3P_LXgm5=(N(mfQra0;FF6$OxF9C z>-1yiLe_lK`dsA1&h`9p{q*N;U~|!|kv1joB6?n@rbYlK0X?t!JvHkYh$9;qfX}i` zfz1!~B}?7!OqJTW@6Y2A#Kp&fDZtjpv%mNE=MUxa^YC+IMJM0np#X;{O0+(=exyS zy~1aw@@GdUj3LX^zfo>aT-ZPl`Z3F_!=R@!Sgt(Q!*G_Y=U_} zN9v0S6$k4sazFER_5J33r}^k=5Yrm#@AOL;!+J9d^ZV;74Z(!7bLY<6;B?|Nnfudd z#<;f0$w}qfi(H+D8N$e0?IWqB3dw~Fl0iH#xI5rgR+^pA)Ag4wVatX^n}-g*?ZgZv zg!%g@(rs+ooCA4Dp4P6adfHSg0eiR4mzR1LoqXTjB{b)rsyOi3M{iQoj^{e3?Fo#ByOBw!BV5!_)2MU4gFkctewtZ`R%@8Q2U`xZ+}pJzl4*_}rXV<`zaqdwKfc zs3^e1dB5tzhHPl}FddgLbA9S|cCInZyJQ()hIn=yEGX`?h18 z<9c0l2gB6yfMP(L@KvR46fUdHcYrmvo9d?hG4!9f{KU@!v(9 zNP&oOuzDEC8XP4$H>wf6D@(nab$Wgkdl*20Z^&n3_1a;#4*L+;eoi(`TC>KL8&el`ha|TmyGke+mI6jfjhf6 zKA5+LSdom3u5a4$EP&?aM@oxW7fl2rbb`ND2*L>(vnY4!{2BEC_4rMsJp29aOAElD zgMKI3dV2U6^DhgxWBkmF=9*P`$>1mRFiWQ0SQ$}W-kt1$89CaJJxjd*%9)Bv!B*H9s^yLMa@)^@9Bt(CE)3zXah+xP zXT5uQ`M~Nw5B8$^M)y>}Uv^KHL2N(>X&y@p_8Xs4`?tf>_~CZ{v8{Phpcjw3`8r!F zOWGdGaQ}6La}of%3aAL|3vM5u{yz#m1{FIYd4+?v2OF9T~&0` zpM5J`9Ct|9eVI5Mkzg;IZlBfUYc6CyAA-NB|CEUfhv1-PgWY^*+W$%iGri zZ(DsUgb`1zxZqil1JlB?llQT=WFb~xVyTB^KAyx=Q*0RTWE+J6~S+D?6Wi#|7V;+npQe&tENDHH00y z*T<;Ubjx3>UhXt%Xo4JwM>o4BqxR1&G->39Y+9tcJO_PI1}Td)29W?HY!PK?D1HIM zDBBH#9gLSti4ZoCx}3yOuX&sj#bL?2D4XHg2L-XMk6Wv1`jXJ_oKz zUp@x+2ZAOZ{#+x;H=QZm-*u7CP65KsHj)~MPbH`zPe)5T&|K=?mDfn(iEb^vL|5Z_ zNYc=H?mO~RB8Y2t9z$m({1)LD76m>-WzG45tem4I`b_Y%J+>)}xQcZfPhjb4dK^bYE;QX((9Nrm zr%dVP4(7~sBuLk2Mq$y}!$)P+XSHali@_wc8!d0(WdAS4vHB}EBa^krKU@IuZjbMg zbGw@YEID%rOgBJsfQ@7h2%I5Ry$w1{~Fmw`{ zEzQ);YzlsW+A1&6-@~*Ue1o5bez>~|5*~8}isS_1(j1`DyjL~R+-g1iwCosymhXp~ zmeyf#kuX9BHJ%9LdhEtCL*}z!(Tn~and0Dj)Xb~6+eP=W9dm7aqdL9+N z*r$$&gOAuRQog2C(6AMb!mDXO2s>v^C@P15ux4I zQ-Ra7{+6F@XBKJ7r4zlNFKxM>f@WzlNp97g6AcInxmy^`6FUqPomQAZ+{(7HP9VD@ z&*Huv^BYZdq8TuJTf_e0_W4^~{>b&fuAWKJonSI)EFbzxD1CkIqFd8)P!iZG4WA>q zyC?lyJ%yU3V8QH9kSzgWe24a(2FZR9<~(=H{ekmFB^CQdq;AENo0P%AKG)u++o$6D zu?QgDhjQp|*^ENLSuV+q&`4X(T(y~)GOH(5%hbznrx`pr*3Ft9aLPH%^3s@R|IqsT-lvHSBlA%a3ka0&&}$_mL4=2@}t+ zmXX6(!ceu>v%DRi8i5#gk^xE}Q`1|;Y8n6yB{B~4)!W09x_b1p_^ zyVHGSch!g-H#eRa=<1D)rL#Te(am^0Kx)EF2#S}g$4%ymHeCbX^ zQ?c{=So^{id!pz4eM&c$PjUl`plOcQoAARrp~q2`Qx&e%b&7UA*>t@wXpe6_4Fw

?lbPu?0<0pp6s)XUFr zy`fTKriH~O*M)s*5kUi-6dtcC>^c}vQAR8U(#&Px<7}z%E%{Tx%LdJUxgfQ%0bZ}a?)S1?? zvS>UYTM_}_fruP|3KAhqg&m&z(l~Z3$Zf}{1$+?^%5f2E9UpFZPWDhe7GV}}-c<4@ zVV+o3-}ui?Fa1UoNd_+GL{#>%D+<>$el9qZ_9&YRf#4JpMiS8j*-$yH3}770fC*i>LNc)V;O$+v94W;ix< zPXLPxH5Av^t$lcaRXEU&sfQZ6>}}S$c#Pdi+YP-}bK_r9WoXj1#Jr9tyGKv7NNST1 zgG&g_CeMadHZ@CImEN-e73`}36#mhWKWIg5AaVdU|1z7*s>I)J1qzW0XfH&1=*GCj zp+tvjtc-zi&8))*wz|8l)BBwct&HEA!-kX}-bb6J9PMZ|?D|LJY)B1_vOjcg+R=)2 zeg*QMV}~`fhmvveW*dv()!QPI0}03~P0m56N(fGks0paPa(6h8117sK<-JY52xZ zLKv~9jUuGrTG_^8b|*v#EFe5o9jiv355U1ddyhKQ@@482pC?yzYgDJwnQ!R51ONWOh@3HMa`RWkC>-gmcE*>;sPlgzl zZEqbjdN@cV`_V+0xGtOTMQWT64E=lm%_ubmrqX0~lqHq1^aztE$Vh#B9%s&H(L&5* zh(VOwo^#XD&=fA}co@XUgjGKz?J_K3sNTZk%b4wYidI?)mj69{NGRj{jh$s?)^M`C zgMwI$(2)+IE{8wJ7G5)lS(%Xteifyu%g>^Ap~ck{W*Nwh4&=iu_wVbCo#h=M2H?`K zJRz!|v?825n^2mvQ$InARJ|#r&s9s&J;tyHOF?y}vrx4NA9~W%RmrhquIeuD?kxu& zYoTLa$__tlYQT$qk7^-EYGwh*89U5rTlPoq3*DQREWbEgD#}rpW)Mf>QpA-a zv-egg#rO3Tk7iIY+p_TKbozVEzL|?BGLNMJilpCt<=nop)ja<=whMlBfdQjAHkPUW zZI3Rd=2VzWxYgkY2A+`lm<1c@w2DCqFdyKr%miBsh!bn)2iZ&$i!KJpHKq5(F1G(v z2higTm|}LS2 znue{XDVgMk1!uS7z-LaO!_Q4X#_3mUOsNLw8XQ&5%nSt$@_*=$pmCb`OxtcnwbMqy1Mx_VE`BRo%i-jW$sYY1 zh*~-RO6r)K$!vA!>KFRfhxQ|-w-9eA+mJnd;0}IScMo^K*?F|@yb8DKwcLVyxnx4v z&~&b{y*bKb^x_M8RkVcmXz9&*x#vclbo#vi`svt;q7EHq{^l_SV6S7zq2sLJdn^Au z+nteWY&zXF+}j%O<3$=F64-6LO~`#UOqH)#<7~KHXI2Jd5ft?>jGXya{pa#s>&BS%oPp3w##ir-X~02vk0r=G{7v?uoyTwmh4E|-cOJb#RX4D@@OUZdH!gXV zNEgLwabTSyv0FA)vI4x+x6cOakcd`M^}71q9;6=V;J5H{7c{_ggNIGF$|~4bj#8ML z>dFGhPZvp)rj7h)mCbqi3#GSMQV&hhaXW@2{LH1c@EcM1S)`O5t@LT5(FUwR2}2#; zwIdJArpA3+Na=$tV>q%a3W*ky?8@Tnp{>3E7YCK92BBk8pObi)iF&Z@IeDUF%w&?y z!^Nm-KH?QwqvF?LceO{+4yH1x#d>1syE!O;0ZA@M#Y25BGN>&XAC_Hn?;^Qgf_$6Q zLhrI1#8aJ)@!rXR=%m%#p?8$;6w8#b>gA`!h4rw0jU5D`xmx<+Phqx$gub_R81t+r z4r(NUR~h5Lihi1yTfI1Pue9A9IRV@Vi>J=c9B4R5JqtJcV)2S~ZPU*SE4qQ`pu{Y| z`_vg+_gsNeVU-Zf8AG#nl&UZcJItg|&0918P2*H23M7q5v=Ru+X-Bysq*o|@W6Ymu z8)rBZtk_0d@iXW5(1NcXc)Sntc$s0a7aEbj6E5(pR$!Vax77D5kYQV-2+KiE6Mn{4 zOX*P&MQuAdec|^jlCSTBx|XwY_uLU+U14s}eq}^#MKyK39d&;4m$7pOXU^0zySJ@- z=M%1cI|=iR`*ke8mEuC|jxEkP@T$^ywpILS)gNPzNJVe>ii-=sg`_$sK5uNs(0A=v zJZJ=-pJ721Eqy;GpO?Q=CqLnVT1ASx2ojY-oFcV{#xJI?AM<=;cURwqYRaG#fD!#$ z1`(c{SNGhW@3S673$wQW&v&A+H8dwvDj_NmIe>-ve^tg;|IY0%*patpG)^HV>s}G1 zdT)*WNqa979_<-n+&9L}8zkA^zNi{1D3wz-8{Vg>`@{@d){N_OO7RzOKYj%b0~kSB zf|<(GLSuIv_ar{wp7tJc9R}P5UV)mVx%+O};V5p$&l&xd7&G>+o^Kif%Z3bjGuW=Q zx$C`PK5sESJ05Ze3hl3-7r_Gb40pNxN2XO{!6g$=;{%>U`wr+*#nKg*K{UIG?w@a# zmU=M%>A3>Llue40ML zdIlH<6k=5uH35F#^&jsNC2-^3E64%?YDj@`3U2wOJy!x0HmbKutW4+^T5{+dhm6tA zwJ;$)jaJ5Pv>LcHG)U@rP}j-2%}(kxoP`Ddyt${tR;d_?#qogOCB~Cw33wLNH6A+8 zKzAYgCMs-46yxe;=khD?NiH>WYz(xv<@1nRKOwKq^|(&Vd9YpsP*B(=737XswwT|o z2n+l)UZQc3#zP3o$b(voU%Wv0*F^ZoP_l~jZ)6H8^`YJ91Bl+;{h;a4g2p#nPM3Q# ztotXb%T4eSq|AUqm1Wg{sF?BAIvv8u4U%geNKdi4jylTMkx%#ON$vqFP8v z!*yRjlox+wzuL?lYJktPKR;yewu%f}H>I3c$orC0*;g(dsfLK1}JZifx1N?X)@?_g?>wr%Uqn1dY?^pCZ!*BBYm5m(l%b=Dj9q!h34p zR~kHuwd-3~?X**@z#IrsT;XZ1;2jWK`8fMr19Zp3}^qv&Kqd?wqf?ZpBWZagUE&@OM4-9Kg+ccP_@92Pe%LmSpa7Hv4U zI@%`QOVJ2PC0K>4+4IPpoi>ETBk_()sxMN+b>7CAQ-4cC@b{xOps9|%>3HG zwU=EGYmIxAK;F?SS!%tNz|vfnd}_v?$CDT7&gfs;Z7@(6ZAM2fJoNgpzqVh0;dQNz zDJ}v_fGVb42j9x6fiAc@A>&W>v@N3ZO??57!?6b_Z0p%aGYf>W+lqPWLk;CbXnK3{ ziDFWgXtklb@<_G?^?Yy|91YBG+4AD@fk|e4r=Q-E!YEd%n0~IIng+SE5?K4&m4=t^ zpPTo4H92e^j9qCH?rVe~$M=LGepkJEs!gWc@7bLLYJ(kum!3G=De^lVG;)H&WO%5r`OW7Sg%<`yH<%Bj(i zeI@|kVDwRV1sd|tq3{uf4xS%iYBHspV571Boo&d5WZSnS*USvD;Q%AGFB~-*ud7Mh z8dh%d#UXFW3;MP$ezb92n?@zmSm_6VUB@D6NcJ5Di>f$0mudP6GSt854O((jbd(@t z!^nOobp8G#=qBuxI9LJ|Iu;~)vckRw)Tr<0%}ZZ*ypYgQ_QJUxojZvO!=sH#6ZSg< z!L!UkZeun}VOy=$zg0#>eM_{${#iEmp2-DdV=DFNw1Q_#j8`rBtrb0m209op^qD!d zDru|q!giOjf;)kzS2^x0cXe?yudd8&zs_WAGOV1vT$iNXzudp<$F7`C6G0)z_L`tc zG@lfuK{tze%6@lP)*-A}i@q*i$j`9EgaPg%leQiPmT5!CyRCmo72oXCX5(UjzhLC2 zLZUwQ;47-P4lqM>UDI+m1 z#r2h?!)7ZDBd`6d+n;cV4km*JT(?~xicDc`*#rMtCG?%fGA*bQx|_O$BrfvkFA8ND z7kBT$8L6s5`|U`u=FRas$)!+sma*oK0&fE5{!7Fzq~G2x{%m@h^%UDu74D4#6B0$R z2k_%Bmv3Z!2P*eEl+}Re&EAs)U|>FzM^Cqy*_gNvY{`XUHWbWE*+w=>hYxH1-xdY~ z$cF*I7$kD#&NL#ycuJkB+o=VZa{Gxq_`_WGom&?q4_BKS!bzU|xP={_-<4iFOtjp` z(v1cTQw_l42NN;s5)KMLV1#TP5{S0|7R z<8{1$k8WX4)|Ua-9gO%7nJiYeHWoSU!`$g(L&qLDBR4iI(k6WFo7bIL)ogIS>8q__ z7%U?$EaNq-9u7Y2X3lP=&TAf(jq)u5zJK@P$zvZRn`h4ou#NEhBuC~tyNKt(r%9s1 zZrYWTKm3oQaBZ7{Jwiz5cq~@T^beq|4CEKsX(Tn|I!rK|5BZ9 z>B!X5{8zneOcK-)D?98Oq5~!T+A8Mz*Svp3ZT;80e|;p2@>vW&^Exxk?)ST2-h~%P z`VmNtS-krC2Ydh+F>#}QPqyz}Z~zW4e%@F1-w#f12WG5)P2;*V`tXOsP?EP|{lc=u z69na`w%n#g=F~UZRZ~?kq&MOS<+l26+XAk9J_fIbYP!>zK zx%>aAPCqvY|5KelzU>U`gc%ro-~{#*KLX9aZqSTmHEOxA1b&sl1bZ_NI`3gP);vMR z&OkX!+`2Jh`#x*n_L2T9aCXMCI;&tgV6P1F=m!~(o6lQz6ZriOGLbHTp#i2#VRcs|}&BIep3VWfibQ(Hez(RUS=)9@( zrm5NFk;{-7M(J&rMMBM|i4u#75vlS4;zXi1OfIrm9fH;aq8ja9nS>NDgfplrkI7`O z1wt;LWQA#Og<$Vb^6>l%pt%N=jnJumD_pqg>c%3sbRf0VD0rx;6opv(5FWEW7-L{6 zx^J`du*otkXa>YuFrx{pPT7(y%BpJiJs7`->KU6a5(T5*^GvV=W9Xf9$mVbXHKw3h zCI*LbG1NxTm8NNjEG>(((abo@zuS)98g}7t;?K1P#`pG76Y0q$JbbzcAbPWwzj{G$ zCoQ~hMHDPPi|TRi5{GjJ6*3;q7t+qN72m*godPFZF5aklGRh;68bs-3vC%*zu5N)~o1zZ)wZUjhZzSS)`sxQBE9A10Gf9m9y)CMd;<4 zCr!t2-P}-r{%Gtw`%|Ar&hElAdTv|m1u)qt!AqxTo+0}?kaD$4_(CA*Vr?};BvIdh zm6=JMttAIvPE%}3cBoJ;dHD17utOzH);)?A`p|8E=}j8_kyA-fsn#;ThP5Urn- z{u9DTbGKs2@;A*v1we#E?4G{?Juhzb$0XxD=%d(KjC5LtA!CgHuOCu?(u^wfjj?!P zdi^mZTQf;V!mo1VElp%Y4dsKHgmx^R$l?-A`dqKjNO?9mxg{g8OtDbu>uNFe z&`Nr~^3SyDil{Lrx+jUove)w07WUB5)G-FA_NCtx@L|8|IoDJ#o?cI7=1-!-)#&rq zGT?CA>x=gp5FDzXC;Y2Ky6d;ci5Lf7j>c;y(}KLOnHwcexB(z&U-6h#O`wqK$eqE(r z9}pPL-~rN<8@60~@{aEei>^CTb-tEABJK29M@1W#==aP5I4<5b3d_nLcRhew4mH&9jCYIYcg0S_B{IDkwuAUjRaBd$Aw4tH*wOJ853civ6#yVrQ?_x8{^ebUQM zgsNU@Jus>X!w~VzDzCW84RO+z%h|546r!barVhC&+LOsxWIWj-EkEC^LUGs;%uO@B!LG za|2%S16wj@&2nun6>3W6gnGDK9M~;oe-3SNAnt2q+##Qy9(if6b<3|Yf+P^L?4%&K zt;eu~yQpS}T3^|SJlqkfce3;QqlF+BydSRlacwB~}68f0cJM=pGF(T!{oi~#Dt`*Oni&gl);X|JBWDaN^lj}0h_9)4aMLAJAr zvxrkn=Yj^ASx%*l$F})oX{SB@HYWwuv#!pDKO_HadT9r0%Ob{1Rt>t+0&lT@U+nzt z;=xZNaP>Z*-ocn6zI%GRT91|9!QXF>O%=ej0s!xCe}S5c*MG$dOf%*+#{j6*uoR(o zPRsG~OOs>Q?s-1>s`UsWBsA+Ob2XhR@3}_3w|Z{2{3Cc)Q6iYGHeCJ~swsqn(;Q(Cy zSgNfhH@?^hk4_dxJu#2*ew1IP(-f$uV9_Ti!I@v-c@BZ1ZN$`*K`^t~Ainm=RWgVM zhl|XT-48)6pDgf7c^Ll^*=5KZUy+qkcuz;vCNO5q3MlUno6|RU8R1@SivbT6E(pC; zqmrFZ_4Tu%Qar4;h^{+O_EN{j4HK z35cjlse)c1&e^iTYj6XqyS@J8_oaNCMl!~mS z`rJ;70hdk?UPdGm5H@t>A{QMTO8CoWg!mv*@04gTJjauOL>J|vC~mGwchwvxdNS>y zs{V9AW)D6U}_^k+P?jDkO=ahF)eG3GCV8Fi`GW>D90eX@E8-#I_EUC76f*z&l`(9 zhogB1*2ojmpvqPQ<@N`C{x4`F0V6QyuYGHIkq3Zd>zkot2MVyrK3X8?P1I)K}tx=-_$`+If4pp=aHobFzNQ3Yn<8PQH+eE}9J#d<)*INj&YF zn<5@DE;`)5974Lsw~}Fhs$_zB8}vy*Wp|mRq?Swog~T*xkyXw-8>A0Z!Kq_cP+651 zY}2Kke5!!~F)I2uE*^=a+|v)A7sX`8qYrWtJee6(kk3YwQV``wZjt0Yi-0 zzv4`5Z+5lE@aMy3Y}$DEDJX$Y6Zs&B8|UwZY&-P&RD1`G)IsmAh|4G~3X$=Z$#Ac& zlYtTe%+MVOSJg+&7s3$v83+`xD;HiR^D^6XU^i7Si^oQ?nX&T+YvUO64Efv$X`<|d zv{<|Ozg^pMWF(wT@;X6OXj-c`V0wKynL_fgYy=&(GNvF)JqpyV7{uV zOyfoH`Zv~UKKDs(xszvEwt9qtQ%vV2q<6TO5WYr@IZ$h2D^b775o|n9I|q{W-U}*M z*~{CS=Z~m0+Jem1J>Ryo2A9U14V?b{pG2dp%z9@L>j68titUcQtcU;s&;K-*CqF&_ zFysTAa6B=a!!DI%M3pNTZ^Blx5IADO_!wT47kqFepST;P!lX9XdkE)y>2fGzK$eDu z#)c-wmUfATMMW=)W!^YzE^{GhLTwe5plz9iFJW#q(m2MWmqnVLIi6AVXyM%DFXucF z*D&1lBGu$(f6lo3&m`$eKVdlT-?Bp{7!2X4@WDN&3d8fz%MzqpIS zCdT_xZ~bW=aQxg2yTf6c5Cb13TV06Dq^!kl;@lyvVb_|}5p1e5T34t_ZtrdYbAWBA z&1a~~RDazie`|UmZmD|9r+;_=h=_++M>#})obOFud%>s2D$kOj^gi#pb zbeF`;urhALnA9k%K%8(tk%}M`)#@K<0+^9xYRZAp(mI^~i9@8Fjjk=vQGn9sByR)(`l`Xujq>Fe6#U#nkYv z+!illhd*Ec;j=VJqGwKkm^@f!E&cd?lc#PGWCUyHl+~Vq1m4j{;6XZp7y78CY)Qwl zPa46i@tlI@(pmR|O<-HEq|NS3BvkwOwp-fHh^WyVXWsp&zhV*vWkl?WyCq;3X>Otd z&@Wp!q1MR^xS`$;^AGf5pC|&E%(;=?4`vWq@k~M^+q1L7*th@szQ+7@FeQv5BngKh zRc+7i%B+98zZo+`BE3A{^TS_-5>9*eG1U-vgzID)hHkK^wNo0kWOg#c82uT%Yz>tEuOXWW87=p8G2GZ<7tctU_~ z$vEFmnP8H%SNR!`7OD2nx!{p_dc2HR3U}VTenCrKe8S)GbP+kI|14yxpYZa6e6_B6 z)Y_$z-LvIZh`t2a3~v^lc$K;)&(7c7(MXJ=|ufD+7&5qOJut)VXwmGQxW(IfH4$%W`)i}$L zdRet}`C(MfNrf2RZ49Nmn^Lk?>x2@l>wL zBN{AkaqG>-C(3Ksd6q_z{f=AYkSYI$uIW6e5^|{r^}M^PJ5CRyxk*e@&8D?H5Ltpo#wgV~Xd73#HxTgzos@mV)89=~ z(gFz|j=sX-8|WPY8lNVdREb;9B9dn=`PSiJ8^&O|l^cT0m0BY6Kt}Nup@(14AxfG< zQ}c_V)5&pAp;1$40}<9d)aiBbxW=`?%*~|0d@FleSw+gR-zs-Q$Lb`ZA=L+LdYUfSATt&T3w)^^#J`I{SGIR$r_B| z4cJD5VD9m*Y@Q}c(l(hr_$HL)UGwYNXJKoB6L{4_N=nHTSpax@Sq>M8o;gBC2Jc#a z&MMin_g_4j>MTYN5Hf(cKKwc&o2!ypUIZl(DBR_a$`W(%E>1;?GObWWyJ~eLTQBce z!7Y+uJ#7L|>j!I)CLiClCGrXnBRzQJDQLf+w^&j^iys&5Y1*(%b4NSyfub4r+H%RB z+=wuW8%W7*!6AF7)uKeE&df;<2*o?+#$;>(fy{V@~tRT z#0^#pbFAOeMsQhhxrnX}TZ6b4^ic~;qfJ3&j&xc&Ypw{k@mY$2wUx(qP*$ythMB-T zJ64JUPRXj-yk>(nCMmG5gWK(>BpGYgxh)t!nDr;q8LElC$K_6O;}98-zMV;d4E-a^ zqNzmK)S)j#hz^544!=PJwrraCIawT}9wMN#<`WEO4ce?p#Y9_$|VHSProoxh= zDUjV%GO}^4$)yR;lrp`Kj+2^SpJ=7X{KbUP&^yRN;|ZWy5Y#GLxeh%$^0(v!(HC~y zOs=E~2Vd4h&+# zuu4Z*u;+Te1GipL-)&HjUq$lf5i6tO z4?a37f4R$M!L8<}zUOu633RTxqQIa9v!u6g37A!e^gQT7uPrr}b$FU#*a1) z?+gG@(TxQSv;`&CQTl!>(^S$cidg1Lbk>W8Jf z%aAN~&MPjeSN0B;!1^SqvkwQ`iUF5& zLYOuVlqO|Ajf+}|ZObpZMgdL~(^GfzK=rgz=Dyx<)|&T~>!{wq>rqJcEo-~gzmb4A z-2~^zU#c&Lb;0sOkx0fAjp&gmHEW-1%b^ zQRg#Ity80nM)N1nBIwpuw|t9}h*yBl)YtigwFvNg&K65GP0RD=k>~IIsvfS*H2B9U zb`)~;ib9J`W<15JVOW8Qw+hIIz^NP%_An$hu75JGesDAFGCn$uP=!Gd1<#SPEX0l? z7mNF1a>y7H28Z`BQE%`2^E;veMiw!`TIYzstWavlY4-4&9A{om+4QpYvk5r434ZP# z!26j%9rNrp69(^=ue{&GN1@?X`CwtU!C%3Ebl|35ky)b%Abe)(luVnH2oI)4NuX&0jpi%d zhe7SRTqGf9s?x-iG18NZ0{scOV7rhzZAncOC9-aNO9|tt{Sp1^B#+!1$dG-&WA z=!=@7;RnQ70cOw9foFHj5d{&v$yEzm9zT%$h= zd@>}Bq2;B+y+NwYYG%GSb!oWN6Qw#ju}G&vAcLslFaQ{2WgW^f)Y53uuR={DFh3-~ zo>DEnB%EncDpbTx6t2Dq9k%uZlouJ7p6w}jsuQEb06HkZYFZ=)^=buEghgb~`jVNp z+wdIvDjHk6A?uHOzolAULcb+^eQ^zI+?w(z&J&-?cxJzKwBrV{e@Qn`j0j@`45<yLGpKoK z^e9HNLh?@Z%n|N)8OA8@kU9+~dlI=UwM>)=a2FIhEQ<+A8M+cCCMr@zV%kIla1t&L zMddpa&n9U&kwmey^9Kq;JhWs~+D+8TDw5MI4MC;^I*@okF@1>Hh~MH<*a7PA|K?Ua zFHQEKC{scNJ_}#tLiJJ$QnUas-yy;7YYK7M`{`$ooV)6dS)QVgcTED01~me`2L9de zW15B^V`J=5pcO~kC)S^JwLJx2H8Xu3`W!0@CJTrww=1Xpj`bEXZ7XZ`oc5iDE4C_*U zn^Al-clWE(NB{W)fzaKBubIFow|g(1YV2KI4?g|=ORuh;n(^$@q?L>D{Ga#cOnA)H zXMEtDC@W5Yvw_j4a5a=MjhH=Z^ntF8vHUClBRa0A(2vDdWRRwzOzI}_B2p=2!SKUt z=ehd^vqu8+@r;anhfsingTtix+9z5wgJafGlOv@j@jrWRwvT>huD&e!>?)$OC2!UB zyOZOGKUN(%bCi!vwpdhS=jVz$HFfo7v}+^Dz*gRW9hJLz-G3d@MSXWxreZcPr6kBu zhl_qmi&0xx@d$%lm0%!W9PX|A_FE=Dvs@{p2ctaj7G#HpOt%3N`EZ}NOM9~;M{0J{G3>{>7Av`R{aot3Xa-G#An?M7j-&wkW}Eu3})Ib>AUm(3{69jo`%7y(j$ zrc8C>$*8-}xS#GUK~;n2fKH21@lF4L)21F8P+PJX6{K(!sLxpUUdAf>x8wF$WZ1gx zbXV1D-^nX|S9l5#XP}~xXNvUej8=*I^EA`K32b9^UjMY^$Y1MV#OtPZTN_5=_P#q_ zxkcO}F06!SkWCatTZr}Cl*bT?|1_*C~#V3Fk&r7y4BV1LY#_Xn5xas)gX7!Er2rYs^P3Yn_GOZ&C*k4tgg zIm+f^aewt%7{e9KkNK5*?VjIp5CT}q>n=MFeV^w5nVdOGI6bb8igeMXRGHLAmx=h= z8^<{rxw_skO{H1P8xBSwJwOfxfAyuJ>`^IM zp7U`1LL>~N%$&YvHF&|CU_Zm#*QsK~4yKV^*N7N%rh%Z*!a0r^lui_^__OSCM_`3! ztOEit2Y+=#YeApnR-D)a(3Ne*x-Yw$JY1ho*)4eH?O}>-JnASlkEAvsN=(hWK-IqANkJmTcZ2b zVWdWg9==S|D-R#h#2PR{{n1A7#fuOqI^GQMJDWK75a^o>zIBgS?|PxmE#L2S*`CJs zb8(jrZ3OS`tAG3aQ*mv15_2Kt*Fd)lQ@;O8^o6xt$ai|i3mMPGg*US;#^SYZ0|R?r zNpC-RZ#={J$@&q3H@MKRL(2exN^k%>v+n1{rv*`HQze6f!J5ARIy~Dv$3>?oDMU6v zg@xrbbWsTh7k2Jk6eb2x|LDIE6#Wti)pyC`V$zc_`|liSm(c(Iqb(js34(#V%*tes z8J%`a_Jb?*U}42cc%k>|dKTB{WA7Q2fC2BRqucJ4P;~v;ZIydK3@JG&LGEs1e>Jg& zsK;h*j@yk0^<$EJAQm}N#TebyA3Fo^>+oz?@v=mqCu?mxLi7RFfqe<`7mSki1yOPP z>5#?I2{fC3=*p{h=^3z|Dqj4;yw6!!x)sHBU6MPu?PR4W>`Pr?v$wl9i!rNCAa{la z>Kw@0nUWBS9KX#p(49AHGcH|M$cIusV5h-S4h>@=iu-c67{=IcN=ZI|E-?y-|FwI} z$P{3gB4{+W+Q69gubZLEXVD45nr8|Qc+?b5=UzFL~vhI z)?fFFmi5(ay7!+7iOFrfD^PMRA*(CryX*^jA{VdkGTQUIQ`R zf;8L%xtu>~{uVBXPZPqCSZ1P*_poa)MeK05ulX8Ay zc8m1VMCxDJHY@!zzSeuCyUk0FvA)0h`%-=wv7f`P*X|Mgc43ANfI;1m$*K%+vqIov zqdqnn5Lr2$ZPQ4sK7}$4nR;^LaBMv|7nrgk>7Y`FKw-L_0B-G1$e~}akPOtZSY1ug zdikz1D0^Rrg-P~IFoH0~2GtSGTi^-+7Exm1CF$n*nMg;6tbq2I;=US))32S3V@7c_ zSJ|PL{U45q=+8WWYb|sM0@~Xclp61)=dReoitfAc>(s};1H@YgFwXcnA1U;~jq6h< z!2N?Ww^UbUMvIwuRMLukPJ;Vh!;>O1_Xo#bo@z1i?OZ>!bw z5{PGbN7QcXo$Qi4nt|-zQ5TlY>6w7<1E(|lDV|9udFdIziL--w<)Ct_9R4iKq_8=$ zG8qK;I5?W%92=urD_bu0p$!?8jb)M89HfWklOtw~-CXErjMwB?a`xreTBfh5XQ*F^ z@|!OP|Fac@!SzEeU*<**5~{E=k7DH%&G+GKq~6Wqd~AH$+|90o?zeOHJaG6+z|zuc zoJan_pq~)1iOunox}x#MujuC7`-9P{Cf_o~`ms-th@kJMby%v#cm%AMCAty!9XUi; zz@HLt1WZ-3QTd2La?lp<7K?KQT-xIY>3`03(0^aK+&7(jh?fR3b$~W&5AxgcKUZ~$ z`gY|Voo||34jQSIT%)0KtzHbA;WMak?yY^b^NfoCmo9~1&mAqkpeH zwK|j-pw!*tJvnIcTxdfc&%sHt!kn4vi^$Ogs-*|m(``0>?AcH>sK^NJlev^?z!A?94BwHf!E7$t;RvY) zR(+HL%r2DYBir2Ok2~Hn>eU51YL0;;D_u5^VD**ZtzC5|O978DMi`-Je>FbbIX-07 z8gE&0I+>(f^Eha1cx%gdmM0Y5RNqu<70y{*=f*~JPGGnfP3w4(DWK227nNtBc^)Qd z*|dE2o@gePTH9f#O-&1?z27m0mv&UKuTb9r=SMC(c1;IBarJu4b&f_%bRO#HCzr*a zj*5EPa6w9V4R@4EiV}ypDvG+Qlvx`f+}Xr&)M>8XUqcN z%wHbRwd6r>_RF)|juPne`TA+`_2upTE`i^NxpkKRNBMcaM}<$U&?z>KJI^MClbW~q z)b6qaZwtC95IV=r9;u!tUIa*8|9S=qY37?O_^a;hsD@{TL$Za7PP6oJ%p3TZ@Yi%S zke*C=IyNRD3(YzE_Vmn|59wD7Py-h?A@^AZk#wPZU1UOWHFmp`@ zAdrMi7e^<33v1HNF>Ttv{kZV9W7H0Z=-V+a31Q?B=RD_s&DW=M_nzb%4t;$7&$?yy zw$Czr*#%XOV2cJwPh=WVI_-Mb+&p-kV|}dAnP|EebbjF>>kal04%3N5{S~@BSNtN; z=YHugNmF_=u71LyL}=X3zL^XNnySm2u*-Kl@Sq8AJ;Tzpv~-Qd3ta@u1P+X~K-ZcK z_z{hn@>DJc^H=CHU!DOAbKHltxw+40r#zEmaKF+QF9x5HpOlYOA-y`Qk+v>S^0T|I zUwwAgO4DSd71pR|>^nBSTi(K_K;mMA&jPiRo_bGOL13PyEt4r57?1#ne@=OP4Vzyc ztdEXpeflyr448e0BqEj|u67%BbAAe^QMosa7e%eOK~>F2)TT+?^lOOD&EE&=l?|PX zisY(kPF4CK8DQ*dmZaR1f+Arlg2W~BlJC6wEA^npSq=p^M_aN$G3G==ZKSdJr20tC z1IIv|GG00OVZ(3V?yUeTyP)pHMr}&@;sXIm;7SI^zmYlnnfRmMQc}%SVuL1*C8PdDSMLh>m-m8K3&& z*LG;ul|kK@Ft6V0i ze&62x&|2!T!IvlvrKK^F^S8K*}KYwGnIa8@@2-xddziwZot%JRddyIkuw2oUC#%9~zSoERzWb${61&2q6iv(I!M?maupK5M#)D63XDdE6Z3V{-KXrFeC!WoVF78Gq;$vp2vjN!r1; z^FBJdm2U!?Y;F_6{q&b4TEJgmjjt!j`%qEC9e`cbBw^^D)AzZ|es6ds2|Rl!;06@F zjECbV9UTCO)6A>@r&w(H4pFHSHa#041^KuA@OOsjtXV#QOo21f_pC^DYzWt;s{8+)`>w8Pm)xJCJ(fC$E z&H6yc4Ka`!DF~oQQmUlN1a#y;4$FURCXDMgeX4``Ta;| zx&>%mArN6(#EdT7fz(9xZ?z&2RS^406(5DLySMq>1a@9ODvY|7%=uoRWBGS_CPbhw zmJN!>hBLtPN%TtpW<5xK2NAZx^Az^!^EsNpEsZ(DG4Q@?Jif=Im^M!~1Z|d>P_=9( zjFN2=pO_Zuh4v3w><9T3KrTRlR#F42n*!iwTrVFg_FKegOzO&cSRHT6x&}y*xr)QT zn-W|r;c|_?BEKGlWXXT4ta)c7rufblY&b4|-JB@^Pm#m!i&ws#r49(&qW@V>KR@Qc z?k$L3fUU&&jn%Q|jr#?jz}}{02mu4p_o|OV{`V;~^Wx4!Fv_9~CLP&yb|@HY|1l`O zM)u)_yMe4uT>&ql?fA$cK+?<`0QW%e@c-k2;N(mvK?k7#u(5Fd-K|(B^ab3O_i~;b_#BwO+dv28=Sf0_~o~R3%I~} z$cE%!D(7&5RJ?xqpfttJcYFGG9vwd=dZ)^lAIqLO?;`*rKTC$$r%j$pOQQot6v&F@ zS4U8bL~3~Yz?Kj&8M1Z<)Xp&aZnRP4M4985;h;?b&&N~04W*>9>2u@f@tLHsUp`-( zf9zBW2yD_;%CIOUWpkLIh{m_Z0I7nELU4e9KHI{(e{UsrSsxF(HiZ>zy?|^z=*c;a zoiEl8)7MK^U(wb!*T2NMJ&D|@i+b>JgW8h8I4b=<;W*y$6^yK$Ey9y`)+vfmda138 zThH~$o-*g1hFrQERE_$ztp^rY^2_uNY4Y^IKImNaSwfLc)uG0%ACV>0(iJWDE(7&1<470%)ca-(c||+LPbQMJ9!PnmDA&d zbuMQaWKI8oKoON?FbnpILSViC29%DLDm9kuKwM0ol4&p{XB|n1WOS#Q zTiT6SonR=o{-9!OJ{6Rys`g(~qxH)=u;m{ky1Y*}rldWI6A2Lwz6(Nj+ z+hFfC2MoMjJ3jwtE%IemDoO5ta&{ikDAd?KT2LkG^W{;Gl9&-P3lB(mg3@mXX=l%s zx>BP^{f;TH%dzzV2T*~prl~XJFH&8`ql_aRLz${YhkQ)UQ!-bDMxT9Ay>1F`9GMB> z_zANc&4Ow^+L0ZbnVDyxkw4oA3|J#3n<}0*1qUd36pe+5;eZ&=3qK!P!Re~ zsw|da+g09x4O{AAX&H_D%Q8+$iw!4IMv{Kvy5m!|2SvyDSVbBvYxZC<|&k%+R=J z!rNXWAD$YO^I>?At7FQd#z$>UiM7JD;hqvV04Gko0ni5QK_g?E-sKkBh5r8KfZXQZ zKIhM^AYfULPP$axTAyg$%s;BkuYZJFri&rTKZAq3{P;twmXE9L`KScYiW0bnMLwWLGKX83FBmUSUf(t17JcE9sINA8A1I8he$kmd^!w;1Rb z0CUjVpiXjAw+NEf7aKYC% z&mc;7u*j`BInLPowxwp&7Wg^(Vwya508Q(+sQK{<1;gzz$f^Z}SI1_iQl zIeK>fn{M#Lk#XBPTmDG$QBMIRdbOuz7O`UOQB2nkH^2TbPPn0&NEapF@5KC4%jo7V zpjZ}H#r72c-b;czLV02277T666KYVW#Mp1k&UEBBJf5Fg81CYD{?%8a?L8Mf0B*m0 z4kG;+62@EC5?dz4_^ri|wmQ^*sjKm_<2Y>i%VB`ty-WqxVhx`(^SiYKCw-v!AVs4i zZeY(UEuBB66-|^hQAx=ncA*Me(88|d;9bH;)PV?7Nzgg} zrk{THxY6ca#h5X6JAPpkm&vA?K2))ASPZdC7jrJz)8mhfrqygmR|Dhhh8WC^+4r%> z)A_9uRpwR;$0kxxmbQiwwRW9M;FeU)kYY1!s5-KJx0SW-gM3(HP(d%b00`2Z7a`AP zN44N$ZwLq3IkNQUoCi2xHv>Aqh!a?&y4Nr_+GD|Ise-*0c!Ai zy}C)?2vaZScaF^U>WunGfcal#=IRA#9q&WQAI^d_Xut{TZo_AW-Um@0KLSv9zG8l1O;L*5s zwhe5gyoE-Dl1C}u1ItT=CvG`_7-eh$^VZB|6gKoiJ)Vz6X=!7k0A<-H6lFz;t{0c$ z;ti&~mPzopCWPBok(Se6MvGnEc0(MulD`|I?u!s4jpOXGIf^WR2~<0TksI>w3mmb) zyYb&s9I+C@=Q0L!50i^C@xrqF%`YV4DmetBO*xq51LqTq(F2ay0>BZqL@^)L7>ROw>DiSq*)6Om%22Y?4Sy2g@e z4kP`%3u#}=WN`Ebh!BjZUsDOKT_ZB=+$2)wfHrkQM_h%L&uajq;NwD#-+?}HCpa~9 zx)f3m7TJ$wEHhG+9_4RPR=kBodBO6qEfMhdOu@ZyX!I_Bh!obHf1gNDHCQdUP*V~Kg^TBn_x~QpPe;(MNaVt>LFm{DiZEd0aN_-dY z_mom=(;As}yr4VX({j&mUm9O%oj|zkb)}X?m4Uk$|^dgaF;Zsk+&y~UdSB0vIW@)BrusZX$ z`Pq3BnB$@W4q=O3=h|<<(bS~7Zso2YpD9ibxA0}c!M121u{mRB1r2IV*Al$Xv)b0A zoU%PGQGOo&TPyO8og?p3%1S;*NqzzI+S{t*G%;cDN8{jgp}oW9Ujr}Q!eb4EO#pH* za=RhMgrZWf}p+y*ud*%OCuwR4)e;}GYI=v2{S z`LEVhY_Ex|Tva^!?iJK>yT72$m~DVaXBZ6`;k}s>J_V zbtjQ&m6ELwt^Td=UoOr;G^7UX;b06wO6J8fa~mmnnZ;ucXtbf0(YE{5@NDLV5fcyl z?`4!J(&^2uqbVzwjID*4Q~1%@W@8Ucd8eP{F!*}(*V-*HxCBvEd0nO}; z)^Q%MJ2Ut#wjAgf`WoEFKL8OkZ+H5W#j)gn#^&TVq>x%Ks=E<{+^nryEW(bTdV zUTRB8>h2dpZS&*@O4Vp)52^obt>h&)Sop;a4dT-&*}Q*iHn&d?80m|3!M)6m8R@NQ z_*t^5)DM6eNZIs9mSeKw7Qa~ea~D#8M5|Pc{FiWL_qg28Kh}gAJpjjl{{1d0(KR^B zx-aBeXb#ohq>q7#RD7vc{hK;M8`bHZu>#ss=j4~;^4JlbP%BGL&_6xb=0e#nr(j9i z)r|p?`xza0>YJr5aEfzP7@xb2s6Rzb7kngElZ3#){&Bm{X7B8t&`g&668*iC3a$(chasn#htiTV}#u>NMvxsv-${cAGmSSP^q(D>> z!Z*%wVNS(>)*m0kH2JWyTWO0|Xby3lmloD`zmOlPmgcW1R1pBptAtZ&V)0wiG!tD# z1-qz4TU7e1fE_(x)k2p~CthLFnht%HmO;(~(VV+U9vAkVbDeN}aJ7{fn<1gO7JHs6 zXn=nKlvps9A(Rk8Y*4SRw=*9+N7k~kqD!e#R?=N7V`_L73bQPT%1HBR+TiD*31s&Y zRBmw_=AC42Z3o~~N?KLgPVEo|Gc+Z>D_Fze@9*r4$~<4R4Qk=HPH)dgZAl!Q3@(mPd;Bu0z#)6tPN0o>6YIPt@ST( z?bm!K`CTevDaeCpw-=q@lq4l~6tw}2q=_FQ7l*ZN z<}GaB7vS~z;XDZz`1n|F*jWz{+X%)fhI2k;=%zakqx&;}HktYfa*minO+ArwD~`dE zNn@*e@Ky?hPdB1HjWIS?G3vgr@q4dHt_o$HRznCe4c8CIw1-L|L$D@@1T02c>2Y(O zQ`TozI~!EQ2i@^pS`Rd@s`+}EGaCX5ye~Y zSYm+DfS7#;{gxdjxWNk>XG<(z-{{8rwt4w}^MZyfkO6vC@bl4|vxk7Yv%}iv6ER8OU63k=bE^LK%{~lZ25-&iNGfsG_ zM(_H`N)SpoEJgLR;$c*iJ7=x+(CH-1OXa-jWTw`1R<{xw0d;&ufGb>=1f>kbW2kQ0z&dx)ms%H(h#d1sIuAiG(#$4Gn(Jg-l z&uXoz)^^TYkUtV)0*<5wW%5h=b3oxn{N}=bVq{6`kQR2KCSG-u<%Fsk=?G(M)MGo? z%baJ3S;Vc5_Lc|90vJ)4I?Hr%QR1K!z?*P@LpMXv_U(zPPO#})K`r)e+ z5nZ>ukHqdz?eC&sHYZS~jm4CaI_V0-@b@2}l(=@Bqz&UQ8X6#C87SJR^FJAuXY;=^ zjM&~_xf5P4(|izHllWpRUR<^;`+XUUMEXJR)LP0z5g{$AH!(*3uCz8i@8MylppTP) z^ZCW4t?Zb$Ep%ktyA6XcYZw{rlnozexTx&Hu26_Ned2rsL zyCe|UUby~Z$=Ke zM^_v0#t{6ZP-+28XDxxnB(jfG@6KeY*^2a< zVOqFjMZmWlkqgYTw6k;q_6%5;U_pa0!R&RBoxxUEV!b=PVSHR_Be3PF$BVqYtV#W0 zE%TJ5{gVv6+Un7FCE#r)jd>rv%AIlRimXe9um)OC z@ZsYk;S0}FV61{sgXqhnOP8r(17*Rc?`Vil2%vKW^$bxl!NF1$l0wPzg`j^|u_cHWc<)oyzlwA^Cm8zzgAMXZ3SErTzeDOwO zP0c;9>}5tb7p!8&)zEAP6ZrN9N#(k>GSw+?kuH@NFY=<)rP9GT4cYJ#VBiiXnHL`-eL&mbV!Ph zhYQ~}1W`}aXqAdOS6sp5CjOwVDS+t?5-_VtHkX7iVyAPw?ZW?zFq4={-N#As!Wdm^ zXRT&yaoKy}uJ|z)*M4dhfXmrmIe!(>-U!)!UFwi+klq&sdPCM!9s!LO94 z?v{@<*Tk-%bbRRCl;B;i9zP;s{Ji~JX&Q>(B?f30jnFY1$w7zm@Nm16AK-y@0{~^l z%P$U;&rof|NcN1e^+^cVUh?T(rg>fddjxV6tnXocAZ3~Iv$La6m0_S4lw>GwB;*6_crp&6Cp<`9MKH7x?lt^Ff1rz-UOl^ zSpkDB^8oZRop0mVaj+yri<^sBc;T0jo}pW?XWInUdlmJmK`VxP)}}48o>QI;cHo7A zVVtI7N|e*#)fEf1ZdHK$>CmExqJg;;Sz{T{o)tKOGwwv%3>`_ zkQUmeUwa6Jk;&;cJYCL96pO_<}fq?IQ82Zz*(_8IqO<>i9ESVEw6d?rT!r$4&ug6ovt6&>mE#LTS zcR6E^qmUTeb+doMLA+y*VY)Un*eUI1IbZW+Q&cFF%EZ#I2{hd4+J|0H{?E@#VYuTS zGJErjhZIjYKnd~LpU~X9Pis=RiTqtxO}_q{iht|{tTc{&-%R35sG_FP5(bALDJX+f zCA`T~L4zs`2Mo5Vt2cUuNQ`)@%fm3-&yL3w=;@JPn$`4&?wXw5)x}hJz|=ZgMTgsW zwWL@GjDhi0tHJc z^HCv(tl}h7@5I|JVa*p3NRwUp>gb@6Xd2&&m_%L|5#yoF_AqiLm!~T3@7S3fceo%n z3%I1~DUB`V9nSL#X-jJ!N*A(g_`w5${zbnCPhAHkWWb?tdZ8v7U##z%5cgDLFP)(Y zuY>L}KIXUs*OOi*=q2~PO)U9($KPB#m$cwnP2KK9Hws=P5c_3M`8(66sYH#gJ(mIZ zDE?dLYWutSORb6FVXt+-&PAA_y*^fMT?5&ep2b6#z0J~TG>vPvV_{ZS(!<$8llO(* zaL*#rABXsLo3M=Ankc*`8Og)H&M*QT`fOt+`E492+E!{EJ^&UNb<^l%={p5Q^6?$* z)eZUa`TY*74Dr^Y;5@_MA7kko!=gs>0^H-Uy`WT&*Y=p>+jsS#iV7}}`Y;geQ>9b@ zJg)Aq*S5YN`27_D>5YFN(LkBG(v3qPDM6Xp+R&~cec%auG(+0ze*m;5w4wd}GVFPr zj>PmI-KY1xV|^kf{`k*J=;?*o5EO04Z;&B~gh~A4w{20gKdVC90eAOej|+!})U@?| zA4gvh0y^0L^NsXAClIQ(0az$(1dxpM4J;^JY&anAfB%O#e&?hxGqL~A%wVh>Z0QUF zPy}tt*ibNt>;i%k^6}(r@v>b!S_D`xQP!8Mv!YAk=Z=6^LAC*_@c(xvE>5=e+cGFp za26(Jw&cRUcmQ^8_Wz0)-qx2*K5S3yy{_MLekO)?M8=DY`kQ(C`!KhWw``*eD#8>r zi8zWPdO1l=UGvKa024*)(dbL+XQj3o0bBS$EO5*lB-Z3swI_aRMslOcqe^XmYXe7i z`q9*2fNnkkcfw{MzMncq*UQ*GB!nRX;CT(F3Duy0tV5Pq;58?yDZhRZNx{^7>`u^I z5JFdR!5tT&jW_gGmpWuBUJG->RP|DoLUJo@3q!@-b7Cmv^6vnbiJ18&xJ2Nkx9l^&B&*A1 z3}VnZNF%*V184bTQr3{m_QpKWl|mm1+4OVR1i6dD=TgA*~6 z^3z-~|5t@hKz7Cnh1KEG7$j!}z}Y=y^O3j_$_hU48*j}Pa7qGe5YnOdBXx`&Je@*d zevfr6W5AXv3r|t-M|npvH~bj2yghhSbfLDC6?w%qLWu;mXueG>{P}FV^zmXl5&<9Qa%5`Q8&Br{1H6;XZlJ5|T(pZ~}3z#v;2Ys2dSYn%SC?)s8nWwdz zcfv&mp+^PcXZ_mEe$bz$#88|JUN51<0T+O`?}QsKkn>P*+KZ5q>BK%BsF!kxR9Bf` zV`kGA(OBxrkjDX}286GpXJQIds#mel5dD!p6LUh$P0xzO3D1zH6IKhFUE%w$=I&j9&L zAq}DZV~f|CHo`=@8WpVH6@JQ0*h$~k?e%9J98el4d_w_<%-b1p-#*$Yc)j5<`@vO5 zor@|)KrKj5N<$p+6w)2#m&O+@>*c(;nCLx>3{2%i!N3$sBPK>*)~!TU9>CMaZBoOR z_)#RzGETCAnv@fsF>_DO)BwiB9#?|Imcq0+ft&=jR5CHF0uz(cyEk6{?}2stn2{1g zOas{qcTfyK9f_e2!XXl58VVvI5~Sk>u>~6%TFz(%FUz8bA6%J)4%bOXF+To&)fLhd#4S#F57gQ+yyA+SuGCMyx!Rn{ zumGY@8%C8i3G*{W``jS6b(Vqm7Pb1J#xET9dz-zqvq0M zs%pJewi~Li$nhCLb(S25ZyyJuZtSO@%nza$Y1KUVMJDAl9&v`U694MM#o3_y5>1%r`kLhc zc7w>_KWmU0P1W&Rr6)KpeL9HZ*lDsPS~ZeY1DY z7&+a2dMl@D?F1MEl;mPcKrBKRWKv53dvXEJ@w<)XXm~o~&pzHZ=Tzhq7D0NO#PtvP z;5J+0y@|*yP~M!8^DS70nRLu$X3Yj%GVRW=8sY%|?>tYQ&Lln|KuC^=G&5DXi`>SE z*D|)xZjV9mVOqH`eOLOd7uC*Ts31Z$I}WTIUWH-BD#l-FR<(S&|)d#2){_RP z3n*nG27An_K*u0N>pnSKds{!@w|`8%-yNIFL^M0)cgr3Ez@^wqDq|l<`5tHulh0pS z_0n%-7X@8&4N9NtL)BbbY5)q^crs$fa`Qzbf3;=2LFDC;CG!5lm+{g zmpDTE);K$s$kTJCY(&N-H5nX?5($HW!Oa!l)lTJ{>lPN#o48-(%zQa>gG|pK^XN}Z z{TkE1rhUIP2tL(g$Xiz;+O>0Zx^KTu=HX8cNjc81PQ_Y17my0qzkPg5b6lXFvT!Hi zaAixMzf5z^0l@5)$Vj%!Ozlvyt!)ie@k(UBinYlS4*lPVF+-*p;i7N9iK<4FLeS4= z1b)Unk`SiPKW@rXGa{2nZ%Bm>lA$^)xozk!gu^IX7_B#cD6P0ly_f=D&I!;fV>X{Y zPzwnTr|9aLJTIsm2mxZP&5|G=MYT?0Qi}5dv7s0*2eZKVb5~6SMdTI_%`x@uD;0$R z6qY`Cxbdw6^zaXpO^=wNC0Y+S=mk?f=1DiIKPPSMz0Jjjoy~Ip7WCiYYVqPjadwcR z3fu4?x~v>^WF`k;5r%{wu~D5ndmzleM4mf##+V-7up+8DTwrC}lpv=+-4B?Gj%LWc*dYZ?^weUXG>1n}coxjj&$vP5y= z(Mp>k^~}a-BLES+8s~MFo0kdji15c9eb)MR9_nZ$2{R7sj%VC9S15ijfATAz#-vN~ zXaDE|FY-D3@l8CxbNND`Xk*>5&VM#mjPStg+SWuo3@#9VBjmuXlZP476NrL{$hwRqD+JD2pJN8YfC4Q zE&x~dy6hootR!75$wh2c9n-VZ5i_)*7L+DZC1SLRmgXC9%(0fSZP%t)@rvjEZ}_}2 zPI2Wtfwbw8W0g4tm+^jkoi^K=`YpV3BNs9p z2vViZ>k}M&lT4gu_#%v_N=OYsdV|cm767$L^%_xvY^Io52_qF;i3p=6vNsAl(VDOM zk>8P-YxoN^Vw*``nRwf`0&HC)o%&%uUTJK9veo?KhI1BRQ17yu-wIMp49;V5Varz4 zFS-LdNJwQtvPphMQC$|3NHXyhW8xDM1zoO}DU(W8+iL0+Z%)UZ_wJ5ewf`1yKn5Vs z{P{IW^79y8A^B6%iDoL+!XC|5r!KnO!@{NX8wilZzeGWBJU=ev8ou4-u@L5ZALV9V zg6G8if7tp4*j|I~&EnR+wcT6Wwr$(CZrfjN+qP}nwyj&+-G1Lco9t#cnM@{U=ABH= zIqzgLXP)P9k|yQYZW-YehoLO#{LtR65r~#N2Nr>NASw`fO^7!c!T4zfDyg_!PQFN% zn-nxqiLXguk|e4fHR97$J3|YtJUOYf8UmE`X{w$~AVP$T)_eP1AZG2Zj>WvdX$9{X z`ML>l`gxsCT+!cd=68sZgFt3!|I{nK^*l%)Q!j)4kaE&*NgsGe|D4ujq&zk{CD|Ksw8aDYNyZmCG3t>9yQX##5C(gcdTW!}}8ObXF{6}yY zsFg}2skrL+=|-h!fG-O&E42P=$&_UDCbl3E>Ql$JZWZ*9bNYrvVp<#Sf?@VGhq-F) zRn;4&lN8Y?c(9jrnBo8=JA|l0vIm6DfX3y1-PwE@&xH(4GGiM*;fxL4ezBTer6&al$?m<6_i;3t;{C4%K z=TAy6!#!JJv7#eqaT2a}?AEr$cy>}Mk?Hx*XU3z(wK-fNwWbIqT(Y{$D%W#p*|d0t`{IjT)>{MHg-BG`wo1SDctSroR9r4veRfOIIYSO5 zP&b#N;LP2`$6UyT+wC%B;MF5YNecsReu;{e*kDsPpycn(1EH%B7nReB#l2{866a-H zi|>N!@n$f4R=KC*ic7^Z71;fmSBWv1P2Pf`*)-zwhdi#}X>fVil=P;k`?$gaR2KfW zCw}pf{rb5xC%|z7u%B*2a^prat%uDailz^gr3FL z$mA4NtDKCDlCQbL9)Qnkx8cP0SOOU_dT1#xFOMuI14v>QmKbZDNgJ#wHX&jA=Nd%H z;c~$AYM{VY96Jp*T@)qjo7`9<=dA)s#b|ouC`vH0x)WjxI>AM^-Ql~S%VepZj=NdM z?Kbtt750=MTo%`grU0!?n5T*Wg4r8 zBkPJ+0U*yZPh;b$Fs5zW-c_MmUO^VNQ{{dw$-=2&P&6geq{6~nca3l0W>!x|V6-^M z-`W^ahLVJSEWJBW7d~ZK&*)Ks)+I<>Bl(%uAk@J(Z26-7xE)Gcm;5yoRefz#8Ixym z?0N|uwMp)xHVuEd`TT6dQsI+QEj?j_B3Hak4+sUwOn=_VKv=!gYkb#6YI2s4u_zO| z!L5{@<(=@Jn2LJ)=)uX|x3^LaB^KXFWn~$QQHB;o+L_LYrk^>NexsT{ov1JIg-nr6 z4@tw2l_7K&PN7)_+omydo?!N_1|3-H`gwqn<&`YL6LZxzUstsDVmk?R2o^+vCTI?w z0E#gKsUMxvq|zN4y)sB-HYPY*kvOCh`h}XHU3fTV2=wKbjuI`-qvZS`cqaH2v@lbg z7>V19d^4nRgxa+TJ2yP9Vh!OG~3x0O01H8&_d+e^lSxde=Pm=m&Y>DeeINMjF`TB+3N274HCT* zfpjANrP!>3P0`cU;&b)W^3`k3g4zNEflUl48(M_>a znYM1=@(R_VYD;v|=cnHNgSID}5 zxG6qg2}o^(Oq7=LD9DIgeAV)i2DHquJ-tCwd2AS%EB(!i5##|oG}`*}$joZ;RX^i$ zis;9?UeCCCUU;kW` zzJS^33pLz5rj8Gx!>J+TB7d6F9SH-mc{8Zq&C0wF-^e@DZ3UA`k+h%s8~~NxMU>Q- zd%16`=8f{$MSbYvuYVM>l9Pj|gK4{X65%10!0O##R8W-J>=9WplX54>p_>=m0zYE0 zH6ycJT}z%@c0rcZ2^kd@w<4)4`}q9|Mp}y3yMmYvKLBK9g$ydFV zw!WDi<52f%O<0rb@^Obc4lvocZ|0;HTnZxd=}uP@+RgL|N?-d)!M0|zKX3x$NfFmX z$=BN9%EcW_yR9N~k4@UOC?xk!ZP(_9m3aZYf{x15gEKp}i~4bk*9U)kN`A!0cAfU9 zY<|`OIirXBv74uc42hNnimEK@HOUxD0Go%9m20Z`s2H2{vmsV6Br=zyw=lYT)T#cQrXSI!6Y?dxW zmXt2zCxnVWMtoYM6?@I6499H>HtjxLd@K0JHaa$*)o8zR<_0#->OiMWZB81?+P%$r z_4=ivl3%G7^YN6j0L!yJ-TrDy5;4;;l~!^xf8T_KR$%CwiqwS;PmV0~mX^*?9J)%z zs;|f`*Gs&qJ?+VPfHNoslBU+3+f)-E4i)I*-r{tjBZ^d|x#D_iUrufazf9h3ce35y z^K#H{bZ^Vz-&%VFx11Wvn)9-A2ykD^aK)61i$6Xf25mKuQ*L-5P=Faz2(duOKv~(D zTWEP9q~VG9#<%Jw#T~uTD=R=ZLafnu%F4T&oaid|URU@&@j00Gy#D(k2nT&i-%kty zn5|_^8iE*>IdEiRWMq6LCPt4&74GzrM(b$)ul46!$v3Dq9&*P28xLThXJ`L!Kp;gy z1A+j+!NKu=BEzP1Y+^RpgbnPgj1^WJoXc5xT;%D5$V(}n!*$_v(!5iVh9D$6tbG% z1RZyaQAggwwT-fi3GJzL=F9;)wBL9=#a!$W2Fm*&;&7~(exmR zy`-oEo4QHS8BtSH%7TnBk8@WFV|T;Tf|SebGz10T9oGC)``NQ;jZFb_VzcCA^w9(g zIPu88VMs|^_YL!y@4YSaB6Cvy1&s#^Pf$Bsekw^3z%&ZC&-VNOHB>`}F&_(BE(1`a ztyB5U>1TOd1?gg#hiRG`bfWdf-f9x)P)FW%jwU{&?Cbb1s2{z*^cUkeiPzOm0`XCx ztGZJZX{uX%Ds|PiUo!z>GVY-p= zBuNcfneFiZyQY6G=s0O%&YIV09juEXjgm7a%7B&`A7^N|8f}ag+siO2{R#Ajkd}__ zYnrfLf%PO5Dv$ zmZH=zAZ{`QOEwh=jkgmCg!|FZp+7_aHeC3DC?l{KDVZD~DOfTHc^#GbASWZ+mypiv zivyWnT-!I+e}g43BO%k}N6kJZkl6>!A!eLU2FH(W8lc-ZM>R+FY5lwARX$>M2nyCt zjhW&3N>m^=9gPwh3x!dfP~1qnP(F=dvX$SN5Zf5Czl==`7O__#Rwf>ley1>$8l@7% zAsks`c8VUrKLC#8)=IBS5dP80W)c=l%g9fIv|zHn!3r143n?C)IHi z^Lgo;b`^n7`_t?3>pW&}E#|WT;rjNQEu(s)>D$4@Mawzk)1|(=MJ?z4eZNno`sI9k zegc29{C%i6j5Lq51?t)L4|3(SVtAnS>k2-==cUENed1c@U_3qo)C?u@w^TMcrkvsn z9~)Ftm`YYG)8xpy%NB}F+76u>#P(#{oq=)MF4v!o)%a7+*d%b8u3Brni zMXZ;7GO2D*t>>ZY()CPbiLtTKaqw;PDDm3hndz-+3cUOBt&8iYjn2HJQ*-OXgi#`J zcnYuh%e7Yy>-!GF4!daG+y!Cd)d9#FopJB589YIXHLu9e!%?;tkw>R1Q9l}bF)8bO zb2D}>r}y*f@*d?0?|GD>zM$t7a|ToTv6)MMlC~-Vr&w;+xObvi*DnIEF!gX;iaJ4SpD2m6agCrSf&b7 ziuGelG7ZbhX>dJYeLb(dj;Xw+qpv~1g{Cx!kalm2H_1S^}I)eJA&F1_7W>>v51 zKQf@Y*Fxq-OG?ILK2r8=ZOdBc_O+Y+PE@N)Sl} zSeVvsjO$!jA7St2hxhtE0ADmN>Sat3fRSv>en=>@fjK~1H@_HDjVZy5agr4r}JJi7Tt)!VPo z)|3tS9hY@6$dp0Aw+E8;426+P6=vUm6pXcGymh;9ty@M3YU{^X9X~TPG(6{c)VW-r zSG~W{+Np|sF&Hvhqop1Jpx_@#5};(`En@6mA}LclHdf~v}oZzGg7%O{c1W`_knVd9@QjvnXq(KT zwir0pHtBKxXAUD%hsK5us?K=C8 z#S_I0f|{e6vNaulB8Obu$3Dh|Nz($vS8xwQdyBr;nA)Rnur>ey>66>nu3AS-mF3u1QDmBj{K(n#ECQ^apG!^u?u3=X&Ga-Gj5QU#-V;iQG&dQNW%0UhG8&@lc5n@f>9F$ZsjbPbUt&%N){ueQF~c#< z6mi~d9?{MTXRBx$R?~9KDzMi<5>g~=I~-xDro*SP!r|aQZzFNm%*q~Zz|KrU5Qnh_ zNVDr37eh;03%)^ym-oO*8Hora{@mm9c9x@RLGA8urNAwQd9G(Y{%Dj++Cevt34b}1?fd0HqQ&j z63Z%;Sm#uX|6Dy*u#OFliWLcGve2lR7i;M{YyP)|sJA=PP=gdZ(2_Ru}B2VG1)MBgB-iaB)lo{uUqJU(k`Of5FYW6TC^Xk#lLB$&bm?(re z3>>ua%f@dHx3)pf8kX`OCU?@8HVyaM4 zv!F87j)RVDs^L$UKL--?S7kiX+%Nt9#w4lZ>5H~~w+KZ6=SDEBaagV8WcXjZj)HA7 zW=h4AyM*DweguKj!K2Z^dd%%BfQw>!Kl@Ljs8zV>OZ)MpNh6h`__&Fi$Xc`&B*b=W z?q@=3&tS`6YMlYKxoIWw^;ul27_f4F1x0oyBkc8+%Z*Y=RFi{JJXn^wG}5DKgw+wx zf8|6y*eYf4Nh8!lO{*V4BPfs8p{lp9w(4vpRs~Vw7~RZVY!MxXDoR|EfNA^PYJ{MX zen%AlX+8JIno*PvmlnHn_dQqxn_ijyi0~a?)@TceH zg^#LLG@bW}48Em`qY>H? zH1i4K%bUQx6yoSac24O<0O71b!B3yHBQ5GNV~JB)OXLC(ps;WbDZ*rykW6C3k6BJm zLaVcsND`BisEwUh%n%9cywF_ij; zYQG<8*bEYuZ-k709z^*Xl#2d15eX1QgfEaHH3$fQofG@vk+6BJ0Yrr>iwPxGX=w#3eg~iPc7~|_*bESgVJUh41Z3C0iETT{J z&R5V<{iVGAM&-s)xyPoWFE!X+K1`9ASz8}U|(tZS{#+T0!q z%Pa|sh(x@B`u?d~r`@v6DwND+4)#5IzP+T9w&m4q<_@U{h6DpWK$M5V%XIDpYM%K# zlSqw2W3s#8G5=9cx7SmhKnP6WNCQI z9ea!A(G21q#nRorcJ0VPQk`h{A>4~W>|vOLW+0gVdvF}e*mH&lrDgj#hkv%m{(59S zP?wPZrPwx0! z6AqjuyqJyUW}aTVs3_J@yb_SkXSbA)?q}CjOOyi06;4px-qCr$-kSz#g`t{+*-F2Z z?yoTNJ3fGa2F7{GG+bEn-9~%$^lX=V0z$r%A8qO=wb$_e+`y5G6&d;W=rHEHP4oEM zb$dH0sa4R1c3egMJCc_Oq@*oLJTCtdRom4KDEd}YLo z>Lmb15WfD=0B#JIGVbh*L$>+M7U&9HTe>aeVtX;6J{nhu`qq~!xSU^ZwA{SaXEv5` z^W3Mb2W!2fdLMS2J+fMKN0`4IJo6KyDBwO8l(J-by~CV^eR)DIpg1&>&UnF@4@@QyTm710cRPk&^+W9$9*Un!n4&koawKxPFpO(SU|^m@CW& z*oaEM?<~E817A=e3au&=ic>N%JD<)S-wp3m^PoMUa34A|4jOsWmUP&dr=71{!t4E_ z8E>((eIDYR2Pc$Nt*;4(A8XQsTM?mKwORNV!kFSIHAPsDyXY0nc~IOkKfp8|1I-8k zQA_jmMPhev?zpvDU&($e-{4 zd>kkbXLhk9PBNqZ4(XYZUEt(L=y?RtzM-fCX%5NUP#Q(}H@?BP;psh^Vi9(k-lc~( zQO_1vzP-Z*joIij=@zu3ibDbjW@cD~NVCbw;#>2fb*lMIH4qvK70xXMq{*g(KN0rS zW%VJ=DDY5!K50d_m!-Qz=e)lIGKnZ8Eq){oiOV`j@^>2CJG)(w=eAaE=g|tF1=%yA zV{3<7LiZw<(Rml4s16?E=}F_UU(dEb7ZE};Y_O17bRwE<7Al(4Fk2233wa|1!_hhO zIwloPW3oQrdQC992lp+MmI^o(us%iD6-0=3d%Mp+DP3Ua8QU7bJcFp<(`gp}I<56h zRM7(r>mCgYDZGz$@ii#<`HTQaA`wCYP;Fj^r<*IZj7JiQ5i;_=4(-F6TBIMutkB&{ z2u~6@UIjgYAsvMG``@J>LgE*UxYh3NFrpdG?=bur-n7`yMdCuth`J$lTQ&%t`a!j>(X4sg=X|=#n#%Zy^1I+*_m;DpfdW0$2 z$rHSEDIs&ZhokzVCQ)~^ zEW~g03`hY<{rQ8)t+@c_+h262>ZNCxHmMBV^_<*B`FuC9Jo2fbCV{g=Xmb_PvJs>3 zh{Mn7A!aXCcd1weiFKj8?c?gg`0j=d* zcl)}hv-{yt7X6mRFL{l}|3C_j4a_a=(VQDBJRnFO6O$e+%aj8CBc>F^ki>wGf;TQT zTbFwQcI3T7h9|994Q?&Lj~LA}=CKj}*!|=63nPT%bTyQnV6iR~2l4z55r|-wZY~ku zfxhtG1ApKGXkGx)8O$lpA_F+Y`m9{9AFDGgd@aMmYACb(O35PFqN$;|Z&Fwsure7q zxOkd{wsa~r7a$APH=W&`pBXs&fGc(yO!2mASd7@S6l&HHqR}&K6w)7=49%n3X(7Kir8ZpR40|t_Q z&QK`OyY=rlf*}1rN&=yI^SR%!7Y*W+z!ywh671$GnSgyExm4+bQnFv1L}h`(VkD?@ zy?ko7m9!t)0jdqT1M*-5^?SLp#S8YoPJ?)kGy{S#5Cfty5F?^3_yxO3#N-pgNg{y! zUa0$picdpt2!2b~OK=Si0#`SC=6bpCpx{w?)3MqEcyYnEU*=9|jRq6#(WPK}0m zP^ZmLJq>^+josbXxO{2zoupgss^Wq&BD-49M+d9{$po~q2{pAd?U|*=c_y94&=!a76Lz;p>)cU8-vUv z$MJgt$P+cp1gI+=W#ZT1WLX^+K{0V1EaF0(I(X=iM<(!ZP3{U@C)j62@Tzh|aOKmv z1b`=N-^ElJBW&#o0|CGIh%eAz9ysyd?QBCk->xtqU_#_Q13&M~P7QrKvfEllldxO`BrjOaTCq`H3t;h z8W((jT{JAn#DYDsf(!zpZ$^E)vIdC(FdJDHDCe-8^+wUgn* z=-EVct2QNYl?bHo!PVDI{ymuh7CUQj&gs|bO_UnHMm2&K?UfQ;v=(x{L;?TgUjqq2 z!*_y>iWPn461!3917t!9K-0ozF+7z$9cUS2|%i%r|6DjqstZw&9j44`y640UJ0QtuOQPqz=6=G){;; z16W8?E?26@@>PLq7pF-QPXP0Wwa7Y(^8?h|0mjU@>z)>5nZUeX(TM_H)3B|w6 z%MD^wTC~z|JKAMOat;7Rabzq#JeG2tZ^+s;KvLKH$txm7*t>_6)uM8Hw5Y9}_Nxa) z?YHfDFT!(;Oia$Q|0MYwb@G3{l@8h`7*aNeMUu_hN>ucsP8sNO+IFcfU54Ak3CEt^ zEXAki{id8+$OzCgqyUh=r;mU-b|GmK%q*_;KMZdjPpw0c5V>BL=M&QY=~1z_Wmgiq z^*C^?whU=EjrovKKn>As+AGIC_$$SpX1aFu)?V9r(R3iM6H(Kl2RS`}=kY-bMmmi- zcE-Ml7x|w5>w6MLSTieYQBS49z{)$Cl82ejFg)i#QfEIrz#YKKz;sk*xtbhm3IDphNK!-{ zCUQ8)x}~68tguY!Sm)!n&l5~*)1OV(##3GWW&c`kK8jAcEWhOhqs2LAYQ&m$oHVG?t7Pm)a4cRT#TEK_NFR-Kc0vC zQ0>AI3o|$lWKfX{`FD3?LCAHA6kqGL70VpYB);vu@``c^(Wfin_N369CAt?EXUS8V zcZtr>2_w&5=i3ShQyQ58xXS2BCDZ0dQii&-^V^vZGwJq8WAWpbLwvI&sU7j~XQ`d> zr5wM!D}#%q&6{B2b~Qf}S`VOcrGp$qmUWpL&@OEHe;`Nw5mR|SPW2p?-SlfX zmf%kPsL-Hh31v*$l-6in&Fh`eP!X84>l^6mOK0&Z%5#<}nc=#Cxkh4SeVcI6Wirim ztz93fbr^^y6}mQ+u4V=Nq&C3PH=fN)E}T4cWp(Isu*_8geX3 zHcTri%+e~?xX#ng{&g)##vu{QA@(7WNks+iLF%N+F4MBaLT53Q!bGVOf2#9*lIm7L zROfr`@+bcniS#E`dztij9qZ<0Ivu(>H1j&@V=_@XsF!d+bxdPy+5(|TC4?Wa6hpKT zDvb(g{#0PnfPeA1?ylE46e#EBsXCh_BRI)YEM$WV7}Z(5FXKl7boHrzIxU#FzBp2h zF%`4R%Q}*@BvAKBq-jerJOTJ6SF4CdShY-+SXM6z7$~#;dL;(XWMddG?zF28n?wq# z=>puZ3A_dXg=|xhu-RCgX$}r$nX>vc5dUDj!3WJZd+Xq zy=&8KUDHOz4CwS&Rqf)eRI#&CnGV-JprOdfA!EPgR8{60oj|f`(p58k!~tNC%=S!a zU*IA^XnM#Ay^PpqOYhileZyTrTmwRaUKm@z%r8ZI|BO{o=RW_ZK-yz)3dq4Wqwrv0 zwVm9!DAHe7|Ku0o%lP%JB*UQTfRuI9C0q~myH#>9Xvih zpVzM&kiHT88M$Tl)bw#qh3SC#0r0Vs?VCYnTBORz)UX&#Y}F|#B#^j!juMvi0k9$? z`QVI5bw82g`%g}=~Qfz?7Z6DgFs0)BWBQ2+B74urXasd z6=BeSWvaP}-1(?aq%r0}-e)*-oHlSaVboSKWsUb$NL4!M-I<;_E2uXu)}D z_jvK(Cu2hMyWAe)SQo?qPYA-vc&ah^Xg!J~cjn;0X^G`xU#V7qEFe;ZQvOq5R3L#9 z-|@rXK;LkI6X2vu#V22AAQOaAAbDO0WwMjMr=7hXPdH3@Vub@9)g?+#W3RMxiMZ1Z z?w7~KA%z1|7ldb!va;8qof`G^Vc>4=wP7n4@F&bA+cqwi+xVUUh>LpAL;@%Geb1!q z{W7p2W+MdCL5wA0U9OwSEh#@UjZPHS6eVtp4jJ<-Buo%MHRiplxnc}NeTgPFk?RKK zNoe8aa9NYId8o%35`!vw45Z_XCJ)iEl+3k0XxBE1L!;Y~Qr;X!{982kWueoU(Fk@F z_og@lgbdxwJ8BhQnY0XFAONrF;qc0)XGl|?|CPF6T^-`tv`3O$=oA>1dp){$SnG=S<5MyS zVW}B-zaeXm`msTG?6fT>^kwtsO05E>_b!k#c{aIY*I4iDiR5e!_k^?8PjRNZb&zq6 z!!QawxwE(U9o^G$;bqL1pf6Blb<`?C_Pv%&MT${HK`EKXfV^ zWZz6mo#Nb7;>jJBRe5r&1W3-@PA*8oAV@QaKDrCXT{oX2O$BF(p_G|gorKDclxp`+ zL5x{g`CtzwP6_!dH@rFmTi$Zt0~TW$gPH>yY1J2}gcK)#BSkL%u>l6lD3$$C; zcYX1VBX@y;vSrp|Lg;el=TBGk1oQL@JEZRz;1ckXbOkk0b&@HNlb3NQjl4YWSnoP@l^ZyrAqqrE!FKef-c4$J1P1l?;pI7tn(7fOq$uaaj!S0EEY(Z%>MTcF{rqglnK3P(@Au68O6J?sV6E8S z*l2lDcyK8Z?<9k?QaVOzq|3YG(dQ|6k^qi_B4SKB+%XSt#vQyC%KKJ|<+`%5@dbd7 zZnnDS$LH&So3UdLFAuMmr`OBV!O2cGujU&%a0%gAfvU&bV}$P8$IIQ#(TLgKKaXcW zQSWa3!S;i!(_yKpIGddufLEYm{56DP@O z=_%wv9d7cdhS!&9z2w{GBX0*|Rl1N70}5^#_@avvO&NX&>P}0fn*726DvV zafK$BF?9s;U{!HksXv#d3MnQ$FAz`T^aX|}-Q#dR0bU(DYWN z+5p?S3IJ(=%~D?ZAa-W&rxL)YBvY*w%% zujfJevO%=6{Y=o6W&?aPW!(Yeb>BQT2fnVa^>emQEKUJp%Y1zle3nL(oA5FA?=87i zH$A7{0NHF`L)%@RYJRc>JUy%^jqz@KUwhm*e#{r7bo9Elgv`xpUWD4i*rA-}8iidFPF(n9&0YDE81XrLC; zoHY>L*&uQ~JtWRI$i|c3s?WsBHPw*qk$SwKA)kl?GyOR_O*ne`rkil^@K>eIU2bhs zWJDS)x_d9WcOg^*o;zw&vW|&W&&9WJKzCUH^U*-=Dk2k(=r89Q8Zpwdapm+t-RVEt zU9yJptufuu+0AIF!o8fDvW9swoia6-0Jen_9kFYc8Tde>7VEUOcjc~2=iIf1wrBDH z%IHl~-jTs;o16EUfcw2p*H#ntD8l@X`iwhOzu+|p#ef0;-2^k2_wDGlYLEE)oOdmj zVFICvvb&As32lE(&q=;SAL6flmqM)R>h!}g*&Bhm6#&1A))wmSTGlf931S^xqlDu+I+?!BJ zo7~ZAVyDGhPczW`dpFrY3(9_?mZtPSt4wrTpq!vGxX(R#V;|#HsAE0<%M=o2`hGXu zP8dUzK9b(5MdRr3PMi|(iA1bofY=6-8(j+Ql ze0IEJtw9F&d^P`Ht`T;motxkDAL`AR&Suy=uwJd;S&-dJSvohrYuk#ki8!ca!e6Mk z0IgsG;G1N^QM?yxHs>}7FWpWXu@X3pGH5OOgf+4sFK-@!bDEvM-aB?XorI7YW#ENk^4;lQU( zvI?$rlPd$Ha+3?UBnd6qXnXgeTc4_-hF1J&!}ZR(*i^@RU4Jc@MRi5hRT2^p5rKd$ zzs_BfQ4PEoKj;lUhIF$azNVF+?YK9rw9f63Q5_(X5n`u=&%d*1W6OIv0kErOy{tO& zvbJV4vSOyls3NRiE&d(UTkmlTuI+(;*g2Y4w5swuq?G7D7RTRG3*KqdB<1MY>DKai z+zG2vmv6!-hfxdLPL>NkkF|Eha@X?9`>tjUzNQ zp9acWXb%Nb32!Y0odbSKt`LPSmDjEzPAAq%|Ap2s0DE875o7~3xn z`f8T*x@Em15DCdXF$g_XdLn>q-x{rvh=PqH5N*GHT8ccBdk2_y40$@z_OSf_ocdMf z3DUe!#L4iv03;*4+v3AqsslNVkBA;%MO7i01Z$q5#yP)tVpfk4iJ}^`HG4dbcRIRQ z6@3n(d}^8^H$1U7=HIl0-|epm32H(w{HMXk&~#Dg8_}X#DwG{Nqi$#hJ7E~c(ek16 z15?R-kqp;uNg@#!Zi&W>`a88qYO|Yv2|@`sKGG8p0-U9Dy&}xF_kx7b_i2I{5f7_E zM#aNg@JtCtKY}5afQuD{Ws9fbETHp*s+Xc>FVDsEF2~W`mrF zo*i8(14z??^fSIfLQWhK`%-)a=XQO?Z*}W=!@1#Qh~vdOO8aJ%w@1XRbq|4uaVF8Q zqRx?ztS)LXpVMNEUY6O`m4%9K83qVvoug%hn=cw!pH~QR2_7iNowI(S&Xp#_go?gw z@2mreoi{*(TdQWgmKi9`wa^uW- zZ{*`;vBl<9X5j*xIsp#BOAPFfcoUn;TDwrKj9LL^V-N^?84r?ZbBX9aix%@yS}eFZ zb^PW^BZAfT&=VczqBwu^(Ygr70D0HI;Wmb`Wf9;&C9E(e^l)-JcL28na#0V;pWN;X3&I`j)biYQ)D0$n9}6^Q30?kHMjpLEQd znrEZ9HfpRCwDXk8t1QFS%1MyMo04aRZIVL%s6iLkqO3o`pyC8v2M+0xmHXr7Qw#d4t8Ch9NfQ0Utw}2Bi9(th zm!U|6S)fus-QYraWAcXMDHr1waU4TQOz_IqCaTjyV3oBgIL?jZm7R0pR2_HIs@g+I z&-#T`!xr;_0gM8m>RJVAePCAtqp|BYn)K{XTNZw=IO#eLx-SB(D^o3>hVz z0}+H#kZS}Iqf&}NDsYFaL z(J%H;td%AcA0uUP)lD8%K>TB*R%eZ&fdy_zknU@-_DBsk9*f<81yuhJGg81c0gxN# zKtQa7MBr`;HB|;u2|SbFAUy1gi5ed2WFowcVZju~WZN6@Rm!AwEYp3>gmv6zb1 z`x`S{N27V|YVhQ@f}hlF-S6jx5l%%a8eZ1J01Ts_F!Lj8Ju_<6G;FMYSrhx9xW{Zg z4E_KS5ruapvfEEeo>MfNJtXb{SDX9y<-0}QB9sl8z%tAG@s|3%eV zh1D5!$r^{?E&&3B;O+#s;O*cX!w@nK@^kXa4)X>%LgM zs_HE{>zWRzq+bdq5+6|HBB}Z#)yW9{b#Q^Un`Ieg2BP}=Kd^<$55oLeq%pv!uK#?z zZz{9GPc{0*A|DfTA1a3GCFRFC~RG>?^K)oP^T+-DmTHIqqY>gm8BMg?pc3+UeL z{>u3CkyVqm`ozS=*i7Q3L&8W+x*Ey;0-#<3pDkH*3aPA&Hfd)@_7MBuUnb7clKv`? zQKc*qS7fvim9w{?o)VwfI%Sa^rK^1|d9@;N0DzoSz0bCDgKq3Q^&5@u@2HQ0eN4%G z-tT~>s^31;&l+X#C$3}uv2~O zf+&{%&&k}{!8zF53NClOJDL&T;$I^C4T*^}3(fOs!X-Pod7f%tSUJ)96F~Iu6-YRi zjJ4@51g~8=zUbo|C>t>k3SSKZu!`K&FP@klSmJezs@UI4@9yh8Et&7modo}4^7guw z+sCR$=l?*N{&hv-#U|QOH^DR7JFc<9*pc3GHfD7ae1}cHd~h!+X^bU}5>CBy7}$LuqI-FEV7>Tw{*W&3T||b7Bqb$DkK6 z?`yZ1wpawUz!=)0Z0235ba8hl5#OzRuya@M-+`da<-3f98$76H9}TUJk=@i|F+XxK zeE+p$d8Q{Nm+4C@3sdU`z~<6z;{$;^Lmz*Vr;4(_%W?mL)3BcL=G8`$rL@unDg<+_ zGsc2k@;T2zg#(SsKzIdaKPe?9~+Y{qtyJXvdEqh-E@Ex~euRjqW*l*xI0Un3CIx5RZJ=l(VO+z;b(OxXS1dhdfk7G5sU1r8u$s7ZUOVl(e zS*bEoAqk(2O+L?=Dy_6yiDWu?wCJyIMm%`XAfwjK8?oFSk!Lzub-g(jaAj!;X@&Si zRkR^nK6_ZaAX~m{jgB7#VbFq zd=wUI3t1$|j4E1~h%Ig%gw#~DVO-Zw^{nuxL(d}~xelS7J|)+)e@3@(mp?1|7R2p* z(|+P&;!*W52sH7~ZIsWxq=nvb@7UWs(a~jxlQRBDN;JHvG|I9`Q#hl&B5zv7|2r=0 zrS;vt{;(RzB-%wYp5Q{4Oo@1%{oI{74v##%b6;(3u)6?M4@EeiFdBYpy*ug)O7z@q zOBPS$Bpga;jEO9IcCgEYA})oVXP*@%g59jlv_#9n03a6&3hPmwHII-G__oid&v7RT zorkVHkd<4dA65FoI1eZbJpQc0R4)a&*RhPB+1i;VlKSw>v&_ls9-n<&rm`o+qRBJ5 zHj>a`f}tPNOy<1KGkBC$GWFIEJ9yFC_kS;Z`7*Ypxn!zt`;$xh5MPYv{)%k=y|Oc% zxm~y42jFGq-LU~rA}XHEUDqs$nT^XdxRV(2+z*h|}tis_9ef^unmbcAc~XF@>ila+~1cIoKnavCqAC$?kD16XW_{^iFfl8NB2@XYFR zgbPZ8(}+%zLTLU{jx#_ZL1sBzmvjv%K0sKBfR|^i7rrDj|MI!VRv*3}i=v?Kmw)JJ z+7O6~?rlqPQZd+96N5{|J3wY5%MlgU`(O+rky>Wn@iGZ}-@CsnJ7Kr0 z0dM*#X=wY+{lcTLtGIG^+8dRm)wk{Nu&{Sukbj1`*_?RstFyFn z;~aoo`4tShMbGcmCfw25GMkEfogCY1ZZVvKb=Nk-@;$A!-CIZXiGMeGLV%{dcnVt6 z>REz5#3$~>Egx0U?1>--b8B~-M*^~4U{#fV5ACF+yGwfmHSQ~(gKS4kl2v+ibNdha zrZw|WR~{vFC<9z?Mbyosi*l8$zfBCF5{9T($8SxCu4cly?amYUME7UaUVN^3PJ+tz zS=B4cVsL2`r-qG12XvBVZ%T2&36(sY5x@L^$K51R;h`!-zL;pLY0Ys2kU4b+Q0Ou_X}NoFJ2wzS6ZX{qCSaJSdet5uG^bJ^ms|_m=uA4-r6m_ z(q1A{O>pg=3xtznh}1LE7;EFKZvW2Vrt)!70K2elQhSX`BpIaW^J^N$OP0ZQMM*+f ze_F_TtZ`2FFM;M7X!$-~?TEB% zBfASU{?v^=xRCbYl_MV@k2-?q;o-|ExD4;oHuzxesof^vo_Q>&dBGbWE&WpRY*0T| zOfD>$UZb%6NXPLNr-5*}iis+@AVb*v;}wspFO-3D{(Mk563<}9%Ykt5(p%o71UgA^ zmLU|fK^wctbMCB9xeai%%)C0;S;ZpVz473pX4c8-t&tAdcLoDKTfmwB9AL}p%Yw6T z)-|{>a~B=jeb;w0C;_ci*%4Zpo<|Sq)rm85 zl*Vx`l}P4h&p4F-%>-q{4RV2ZXJ%dJnHbKevbMQK`0Imxz_YVn48|ctiZk-T^rOFv zo#ab>=#Lcev}63hro{%0-P}zY=XTps3mWaC%hRel9pDUhReP~8=C;eWN4XJ$I3TXk zHGMGq+GLk;;?3A6bsl-J1^cRwR})-HaNb|J60wcwndOz9`GQx+&aID#EO@z6@Uc4`h`5(CwMtVUkpra#CEYu``<{n`)w;bLQ@lhrhJya& zUJ_e7U5$W=l)sJ_8^-E%M;df`-nCOy)otG9&A!kJIsRov^W(e^iy=pbGh_)V64PV+#%pnZ)WH~Hq|m>;QgRL#-N z5f!0W(Dsa|H58p1IjyRXi z6n?xiUYajubRU^1W9X<6cWZ?)%DGdO$oHminOaxNqw;8bt#wMYoV_Z_2-UmG#*i9Tak|QL>g+2{H^H{)M zsi{i+-SxLvt(Iw~J=U_kiJ<=4g6f^<-u79wd)+dHsnKtP$pTiRp`ts??Dz#O<=++$ z_u8WT^ae|n%?jY(l5u4TWVCG0>v6}U3eBq670cuGx$P6QNWCXJh3D=hLb%_~gj~ut7Q3bifPOZCDYzkVA zPqCrvWEW4SgZI>(NC#+uCWP}QghNuPScug~rG{w{gLF%HRC6rn|Ls>exp@A2zakFs z{0I3XQAaN63k~Y(3$8m1>NE7h<;cCj#`jEDa3|$qrY!w%zB#uowJ1RMB{BTgXE!gP zL3|H0(IbHL+u!It2jT*kTnpkK!DcEBy~cxNzqity zEb7E%CxY>Wn4OX%2LTuD(e~@!s|IQNU}9brUQaZ`VXPLFYVl5adXm!1QZlaix)YV( z0s|C}gnUf`p9ZHB((_1|28{W2$)e8=+2<^(llhu>J!s4y@|5|#{#>O{%l3!M6DQiy zi*=CJB3IlFs8N0!N<_9V!?A^>SshAzCm)*CU zbP2K814G@U*zd?tVb%v@{~*AN=LKH4A@A`BL`?`+cd8SyUpDj6ZJwzHx6XknLfnD} z(V|Vii1^!IR=mkq3lxTXKahMcDZ$SlNsMLy-b4^c>j>IIq=~_YIzsaRUJhVjPVKv#*&Uayf(DlipL? z(M_T#Xt}I6r1fmu)SDz@%7wM+g~hI`n#R-=0;&wo;wf(}-f$wz(rO6xf0fj>v`V3G z3Zmt?lBZHik>4#R!MaSEln7<%UUot9>jHGSb>~`VOi|=x#(098di9M zc4H0vXG19+gb@)bgPGs7CIe`H=CseTHq9jmx5X;hXI}T+9sD$fw(+NyEYr9hLdQ^1 zq{CwaQi{l}HZi~)a&CG=JQe|J5pW2$rpn1@%Y;p02Ft}f%PYkloaxWSJjXMLr6z|9 zh~*+dra+P;6g?x3Htt*9m`9oH)Q=843wzT9gein4takXosYYZ2`5@b`4nGw&35`e6 zcZC&x5BYNP!6faNxDP=I&*o?hhC1ds)IoD#TE1cNINTHBW>e8_lJW*eNc)e{QYY2* zi>SFR(C-w^W&4n$DMeaLBW0CK2Cbyl2u09Hasfz9-oCubU3_^~fg6N>p|ah~_|D;O>r_R>r}R$4UXP4aSlkgW6l zXS%yyrm)GEa}$GB3Ihey{DpJj@S6#{m+rKi;>6v)x8mo=(p|FC-Vw*d8Jb7CUXeX@$dvd@6uVn>f(Brk9QHAn0k@MlVyh za$hvZ1v>i5YpdYeac&WA2OH&jm=dsKERJ3f^dH7WLI(c1c z_;5*TN@vtHDMNO5aM#(gaEkIu{#NuzorkgIJyE zFO&G2wQCc*=pIt&s5D{(RN?I&=wn%1QNR{~JNTlTyp366Q&F4RVb&mR5yD)w>@dEA#-byXeXc&<}h z*WY%UgM^`Mn7Ex$UT3M_A?%z#&ckZcPP~>G*0-Gpf&M6-_wsvy=pf8vWdVqK@11gM zo7*)qsr>cE@U{6Byn*9(>tf!D^PYGyzj{|vzmOtPo4%mE{;;jJn6y1RG`zv=!m#3T zv9zH%;lshPWVTy}u$!jYSmyI;yNh+tJCzOw%E~}a=4%_L{EJPwf;R;5B{b_>QA#gk zt@iNuk+r=Q`l^7CqkDOEOH#S7qmIY1f=fuuF zVrKId>V?Snj>$K@I4#eVJ6AnASpXYi$1i;m}i2l@r z*R0l7CkLSQw7sZx!u)>l+PZ`|P2kizl@oxs2ZEOnFcEGVpzY^92gN|o2yNOmiMGi#ASv8KhjF z3cV>sjRTT|RQ4U69z1=8!=j+96JDM4KyCbPsp6l@XFNg*KOzcj+(fmt!|=Q{uS?d z|J!31CrZxg15Fw9?kz19|A20s8f$DCkTrhIYozog}Ea z+gh8}SBzRBG=4!^>Neb7C674B<;az^ccoja`jyMwRICLuG$lrnn(Do|TO{xua?qjp z{EKDA(0g5hlPz$8Tb|sy0~IY-aD%0|d}5bs*(~>>+BrRii;Q#4*YY{U;%>CR26$ST zFn%b~>=ea`1F$nTybV06j=nMlj*B)?YV^O^O6RxAw!gq-oC}op6mC~suT&HKunY`S z^R$h|1RZkvEjP)FYD)hdyh5{s@hhc>E1;Xq8^RCpNBF_YD{^@2o;M+gfH-k-SxOiM z5?Ec|N+PX#84FK-#Dh zG{e0|C*Dk_$hMQSYA&n{(~X!!vY{XBoR0K~?N7u|AKrIz(G`06m~7ib5>W}RW7S~W z{5a)5Gsg~$FjSG%*}d7dvAW455mi5o%$2Pi_U4FwBnb8RbI$39_RD?91tywN$!wrg%C`!S~}($oTi>~wV%&^KzwbW z5M(UMwI2@MXeICI|3TWa2PQ^Jha7QCi_9;0dqiD~v4$o21#Mk93C^n*%*XnnDu)^s zeejsZZmK>q;y9Z-FTxigGTB7TVseaWm;PCfwm;`hbLac8y(oE!Qf{I&>U}(Jhar=h^X>lZ1 z6mMW!#P@Fz*@@BE2;9!|tR@riJg~{dwAx3~)alseh+^oi=pK1ynxt%qQU$iZy(o9# z&6WV^vK$R#Nj9p;K=hZ($V7B5Vs`Cgebr!}MMOelvi1{Md4$I1fgu4eQ8T3B2H*w3J2V^5-G;({PnPn4f@XKN%}wWXebvZq7cYMWsbX3schm$kfKH zX3>8kxf5TgFbmU&>W@s(@csNJCV?gEQW*gsVnbzEjlaob!^EcC2eC^2$S{FMOK?Bm zX^OS)@@Bo{tui{K7*nd40U)JkRBgOpO#%>N7n+dbH5{m$g$)3B zd&=5)6X8m}C10~vxIFY%eC(Lf(1n@xe{*`vru4?qzt4Zrdn$G_x-GjnaFsiw%j$Sn z_!n}wy1(&y|J=DY1KG^V#C&@{ddUC$<-j&`NI?~^>JyX|hFHWse_m8eC1?go=Z*J`#=504c zM`iJ|x);7ItzAhEA;v;Z74EQQ3N0yuhe`n<5)I+Ro*^Pt0ULKaH_P* zGre_+i}9kzhxVqJ+qtN}PYN$0nX!KMkDS~>Y1^&EjBX# zR)vE@>9^qu!X}aT#vS~ZfHRc$O|;&z(u@ACZ+d7%mM0|A=d4557}YQg#%XsQsCD&k z_oaD-ctwQJ?Ish^KpM-@PU@)V*SYWHu4x+G$=uYGMzGgGX0A3t4|Pelp&P>5A8c zchTZIModI|gsjJVr{S*G^6e&pjR!5;*LKk#o!h>?7qIqe{xz%tTsN~qI~j_8+ZNJz z7%g`*lej*r+XWyN4qc|*a3!%#HnB+&`x+F!HY>G%{g#X77#8sS&F)&4>F-x-FCuoH zlfw+3ybQW>U}h9VF>_D!YAVU>lEu^JC2FX6as759PjsBFTih5ks$j)T+h9}AAH%?=WS_edt+pTkP7=QXUSVX zewwvB18ZdMa@Fw!KI~rzj3-9jX(o}w1tGMJTW8P~RFi0@^teN25 z@~L#gGYG@HDQ{Pkhb_72d{AyoM!3N?qDrO^ViYq8YI*?t$`}{mAaO*MD@+46Erves zBsFNn$L{Me_xzguyv>`}D=UNC7`F{ahoGWZah;~PT@D=w{}af~-_@y`B){)%lEwb- zh35GBYCTa(#L+*L2yB+NO#72cfn($(yD*p=mkwe394WO~%k=@W%XM{tK-lccCH=RO zJ<5wTmOIeWd9e?wzVrSrC%E@*MCgR2{l}#H=)I-W?+vp|W5SHX#k_Yubjc+TYL5|4 zd*M#Z)f+DeJF{JjsYcvD4WlsgFt~l3WNL+~WqsQF$UT@?fDCG6Tw`x8R{pLb2cE%l05a`ou!m3O;#yb1MkHe%_m2tXKn|ojuEy58uorDK+ejmQ~-Kow2ai z^_jmDJ_(0wjakc?9~xC&fz!0&0iW4B{ROS03ii~>hgDEho53pp{kPb%;eS(@pe1@F z6j)BK|1qchTb{7~Uq?!!woDQu4fg5@t|QDxFPO?44cC)9v|Ep&m(d7DDichsJ8QLX zLH^PEunC1{LsD3?;(N3Pw@Cc?^&YppVTs5;`DK|F@lp~7Y`-*!_eIUrlWjw*B4(Jx zquQkujpQ(s<9)67tJ!nXCQ7TRt|1B!0>;O$w-ymiPaX2`V|Eg)LP%mMCdSy1TrO<%(1JN@zt(LFm{m;Q6)Z8K2C zcq`kVbvj@WrQxjF-HiI6{z|8es$Qwv-83fLOUS|!-qqhs)L15FH2%xFpNvbA95Aj^ zjX|}(=7kn56z8vQvdG^~J8*=7GoPbhJ78Nh&f;)F3rhTcNK#3UwJIj=-))VnPSgRq z5>lkqiM;HI(zL*uAo zkG{^9(4hdyD66cwIs*wqhKg-{9-_iGMlO!hLOce^hOf1>9K>7v<&r|54S)vJh3*|b zc2)My$OO*)3|8mt5^x;$0Bs$1nGfx(YCQ#U3dl6w^e4Wbw5i!=30^kUy3eb8PIWxg zPDI-Nt6DC|omlwTQ<+bp-kUve{X&CbtS7sw!F$E@x|Uy|Q6(A(HtW#@V81R0?agIR zJ6Qz$MVVaW@l}tJLiz>x83CR&PT5(e>QDg{#(R`We>5oDMOj?LdlmDI}}VKyXNeg9~% z{)JP&faCgUBHEYg2)`15SxwlOb4jQ`3m2(DM)OhAHofaOvF!VIN-ZE(NSjRyjgWnx z{!!FFwhXPhI<{=l?QuxMxzfhsZ*^&JRG3G43JUF?34J`-o7ggh_a|xCk7r{VHfrS- zUv2uWcIhv-DYf8{pBS_PHzX^22+b=$XTUP(8q$tiw1}X&YJLyu$-ryo@v)ZRE`ZO| zja~dC@I(d7G=g#Xx3b%?qibkF+t#ljbg z0+}H;^5ed@y2>H8`>n`Oq(CXH2|3%Ym+-<>hHNY`}VCE9uIJ&orkEC2kw1z&`3?M1q)y7`Pgq`h546dI%Cwmt`~4f zEfg9ro5+r%=_n`+-nX(Q-#{?$!wF=>25MtBcc(zM@fC)7Mb=WZZkBSzTPTozhjJwM zs(q*Q{5NiQoGcNzSQ0kv#n@ANc>F3rMZ=`_n(}E}E%P$Y{H9|C{6ocXD%v-Yu zhp#uTb4lx~l#-lY?arS}KQK`Tt=_Hki2YN|w1#yp;?p5=xI2Fb;l#o}p+$-O<)YvC zr}W#s(8mmjVi8geywOd3(ejom=x2T$XzGTxfX zE(Zml%TN9&q9@Zl6_yBJ(!4&GD}a}bz67rBP|{mnKpdeT&5vA#$p)2Ea{tl8{}$XD zb=8fi^8E&w)>xi4h3ihlgvPRl+ZMP{KbO?&Jij1RN&jxd-w1=XKAE%MnY?7`7vD>p zZ$7$km+4#+ChU%%oX*RF7%Rk0Y+Fv|!4H88oLR!GT_%b`nU-zEAEUhU*e*>4{BYEQk(p$K&B2YnD0m63f}ZX>$CP4 zpxa1jUw0`C5g|*6ChIL--}73XX}A)xj>mhVV}2+2^=nhm`s}!HoGZ#k(R=Q^EwjPF zayYR5;oV|&a-8aCMtIY@CSHf@{k=DHbac1NMI`cD_#3eR>GPQ~0rIgNJN7sZ}U}CL!zc#dGbz zrlyDm;pLf?IQfxX_w3YQ{`f@C{#V3+S{ne-3?6pCf9T-Di$KQ!Y4%xI4r&|iYH&PfGN+E6zVdjDYe;82xKD13aiv}0Id8}Au~5bW8iC9l%!6p4-}hyxuAME-nU+;^YI= zI_jgCpSZZ&t?|FBPPHC;TW>b_%ot=sjGA~T7+S$ZwiT3aw%!&BJ;P4>ojwn{O=$a< z8zgA=%T*QQEpKhZM?aljl1W_dfY@re=kxt6KKnX*zW4c5`deC&n0-kF?!o~=6vOFY3vevrG_1To~el}nU>;07D_0z)D6M%OcYr}h}* zBEN-sC&IeJBTRQcv~e$=X~7Rdv|7Qmv)|88H?WtiB;y_*oyncG&79dnaHH#NGHN-< zyRp*YB|hmb3=ctLrn9U0{}K;3>wil;U!ZwF6u*&301h?|p8q?pbm)wR?G0i5gGAKV zqiLE-?&72(>~yaaaxB(W3%X6Kd7~f%StkGUAbVxSYegrh%4%p3v$WdFK7}lV;>6Ok z9V2oqo|-5VNqj-?Mw@@)-DTCj3VWaVuGZ*(m%?z_hj@UKnc(>w^Wy0{f((`#(2Z)< zqJ5T~84io^;UuE4TZeHz2JxU;8`nSCJ<oVU@~%FlRAPl#%8HQ~oOvtWDQfccdCd zba75oHiVJ*c%q*n>0#nyDQb?=y7)yDfwhGGWAPb8wU@gg&}efB!Sb-900O?4c=J$~ zL_1D|h4I*>e_(85NOip`9CIBfFqgx4ADfc|u<}TobZmzB zs2zko(GxP*hHbqVTk)eGCD1CtXh#wusa<%xGQD}9KdzemF+(g5-1N}Gj9=$>Oo$wtsegCs^d z1fmkM_tM7;H=za(V19-G3G$;t7D z`URM54wJVm?pO2dD3AJn)(b22agZGPzPOKS>ztCOzL`f(x@`6x|FCGtfv}(!*0Vo} zlmzckluM*|s7tz{#ea&9;(}eO#^M{kv25!Y7Ne9b0=wQ7uZde>2O{2ArBT77i5<7< z^!|{4*$<5G+!lMW0EnD@i~khu3&uq?GyW*rZ8-RJlNLl;%|7iEXyhw8gM{l8s$!bG zNu?XrUzs1iWuw^NW_CG{L`p=74HZ8@Eb({7!v2FMVtD)SK4_>@+w{ZH-mGLa61sTw zf?ga{!Yy2>44KjOgKKopydC%NMp;bm*l#HFNjmKO9KM_cfb4vn#vk+T7*R1950b;yp6iKPX^rz1_WNgT^ zgeDxH`TPIaG^6iTw~LpMvj&EYQ+b9AlY|v^kdh`kG>C;AbXBtuV#{B!CY3phjh$@D^Y2R4EfQzbqREoLwgp3pR zwm>#Z*(#sK6W5-qg)45>@6VblKd@}q_4KxBEnnc?SbLp*5>kYkOi|50 z%lNaLSa}r)fu&~*y!==Un~eN`FXy$ww^wJst2zVh-e_MzJx@Njba~4+5L%f$qX~?b zC3|N8Fnlcz_tuHJ)Z5|@>UfPAIGngq`m6EwgJLy<#U-MI2jji<=Jj$Yy7=J5zi*oH z=FsH+k;7%|@9Vnor?-kdo~J}8Sb&-Aw_Sbsd;HQ#wA^y?u2*MICm#6Yi=);@1A8Am z!{sNu)w3_mVtJLDH8m-SEftHl&E5H7{0)16^Y*$xD%XQ*)`~7*MLyx%r01Jrp~9+t-}|<)x+tVe*G`lKCh~ zyD`Z84>f-Ddqn2~AfC9ZQR$!pRX?Xc-<}785s|7(U*V@>oA`fUPfbm>$gM8XeY&ZJ#O}AmbbWhmYrR?D_YsBOj*9UR4$##&wkCmDPB|>hkxNd&ae@Z&d}ry zTO-`2Xi%DxFaBHpVU+CU3LL%CxmmU zK}MEYo0@ia)%EhWIhqB4v#r;3gPf?hAmm@coR-!7+xBaRPn?Om>mpxA@!jGR%c9mf zfw?3OM$3goXJf%ebnP-3OJzUW+tRaTa9UpvSkY@KRsB)W;-#VW{+~z{q->OyI!{E< zt>R7d_Nl^Ns7a|iW1m+@%?Bt{(e$yXGDw^G{iO4S`?06N#CA;&l3w@w%`nE=)AqLt z{VS<{Sr?1O3B%Lo@<+bMYM8fp=XbqLd&f@Bj2sU3XRmXgaIzAiF_sk3M%hioildDow5smSu$SrdPoTuoG7 zOchu9hr^1F=zl#bn3^XU9=?|sn#YppaQ1r~Cz!q5_JN7)9Y?%dR-E#8))3gZwFKB^ zZE_AXD=UjmfWU_XWcAwCaPc%Naz&wJUtaI)4Buij%!4mWb44#3Y>FY)pYIjcYFK~X zbMDi$L;1lzj;uI1Zi^RQm9mxTva*tUMYS>Vjqu?fD*I2Et?J-#h zw$+qg0dDy%v~3oLGX*1IKJ}l3e!)5#7Q5d4F7GO{N)9i`~cgFp9)^NqS6G3=q(B<*e zg_DcgR&9%>oy(SOrOT6c%eD{DiR7(NwL2RN^l)hM;IXgVq)m7==_21nj19ta{`IZ| zuPt={QlCsKlTHdh*&A$xGV(4>=?uACi&OV;g%>>2iy{s-=4p@k{pWVIrlrN?Oyb&- z{U*4>-99Adq~vx!`4M?5T0_mH#AYyBj;|SwVlOqO790}O7%A#k*~(aS}aM?Ni-37 zW$Z>jE3F5Zyww7$_IG|l))o~ON7@(^%vR@H3KdF(44E0fH)T!A4zU!|$WA7vF}N!p zfbzvb3K?p}OV>LMGHIL;Aa~?WzvhV~=H@-7!e-?wSzh(e97vW*&s9O&E5D=0Y`G${ zVJlsQu#r0LMe8Gc2#O%jB;gAS+R6k-^c4P|V9UkI_P_Z(PIizA!@vIrFXw+~w`&Fl z(TqH5-~+8k?3m4Z1DBLnng0Z4+1gZ(<)tzKUL6&;h^O1R7U3>f$4t zdD}XiJ(lmDn)R8r7|t3N1K5cnP&5gRx)ysqG~~+S&8%W}xBivN(v~}bE=70$WPQxQ zfD|o72GHZM7r3lElbBC7v*b`<0X4T3_9;wgmFCD==#^C!C5F#12dcuWxfZ4z1y`E# zc7G?4K-V~1#8xct!-le|g?W$p%!j%b)&WVaY*={Y08ykoI;My_KQmJ}yIB0s1c_+3 zbaJPX$Dy9}-0KJM9t2WqJtIu3h^pGYmnPYh^#BGg6jE9ys;)MfJ1k|o>JDj3{3hW#iqNEQFVZX?cU@dUnGZ zi-{#xIGw`Vv}mKeX#t6juOG+Lig~s*JP4?cLJTh`Z~O`sB>hq68=(WH{~R`vo3`c$ z+jB3wvCfaDxUsB#Ys9k8?ySRtTS?%H!bhT@49RNUEL8cD2^NXYmipNRR{(?XJqF-0 z=vO)l?m5)+(=wImxTT9M^qRs%D29>|k^|lHSU5?x)_1@6CKJ9PuThvT+L75 z$P%@aJN%93as@xQ3kukZB^2ovuck#^zJo?MihB#cq?wXhrizY6jdkrs5Ur7Bg-HuV zCSU6c;`Wjyhc+?0QpK(ufjZqqg#MYweS{dp12^&u%8&q&+A%K8m@pZY188<6>6xWk ze1!X`utcjwD)bv#4h8|%hEE`(Iv|@3T^<9Gea?+#TCVWZMZv!t3pB}tvI_@6UpLVj zeTMrL!2N|0np6cd6mx1mNGVin3d?3F4Sq@j_ur)=HBlTVFe~g5_M$OIN$NuvQiNc3 z@rF|f1{Hshm4YEo&G_R=4nQMi2U_6u#jL?lQ&ON}ULvj|i6HgDgiw4H8m1Nk>64_R zuKU4}Z<6cchKB6R5V2Sy)q>n)VEM_`Li4|YF(H4d;k^2=zcjvO+Zw&DdnA!Al6>1f(8TcVobRbQdrMQ`E z+U3@Y>WaY9>yQ<0vDup;zS%ahko5_rvVMd%M?- zi@RsuFv`%mB{pT#GVYZqbqf}`U3U{BTTnNP;f%fBIaAi`!<8yn>Rle}BQrTgA(3+t z!!dPXFANDCczaNK2VO^A|B(g;JKwHXqK%kYjDY98gHDKNU+2^PiqiY-Y?Toh!GsML z^13(M>7xidJuV2pUaw3V^>3so0dKD-dk6nozmVUr4vbjd6#%TEpw73mYhfd`T?xSZ z<;j&WF>Y@~1v%w+f5=+0>YQ%{Q;I4l3*he_c(EK-!BmH_ z*8rWu;_Ve%W5nfL<^r z*KyYl|9iR!ecMj$G;*nO1Fvp0m~@kA^JqITAcE1Fe10No@#}-P*!Pn^PMgR}NIP|P zFTn?E`{=DOWx261nvDny%}%L3!naSrRp?-GJ?IqJ&(o<63QqfB7SLyBJO*v7xG+{i zf$a=(hShixZ&0DKAI7H~t^RJ^mSbsWVdIpv;*V~G@>J2<$v&1Q=+ED5f&)sI*MHf> zqiBFP&Lk8Q(M1|?*f@}9bvQW`gCdzyp>A|Z$DU4TK2y;8q&tYlBq&$SN$|1t^1o1V1ZOioDcQo)+kGgMef@}4dmU&1qLw==piG2; z0x>GYt1SPrA*s!GK2)>Gk6=s8U2WCY#GUj5dd7;Tq}91d@e@l?zf2RNtUrgz=&&LB z7dJ8r&v8{JT+BZ#V>=pRpATAUMt?p;{q)8m8kH^#T-H{{OjO{+a~^VWd5Oi?11+eWy3!t|;!VN| za5|Bx&_1H=3+knQD6mnuBU(_dpg6v;(+DZ5(&8)P*4vn^^InrTOO2lN70r-03EpyS zmk0til9@F)boDTPMXqCBWkMm2;OZ5x2|u_o{19_2FWJ2|T2kX69nUDBmbWT{2E(FJ z4{bhrXQfc+zW@1SkX5a`MrpK6G#Nr|n zKrEut`k|9DGG!ZEV}3-;+;qNqw;;2Z1(Gk%Gt5?PePU)ugXhd|)MhZVW|_>M?s|bH z-$+@PcZ|D1Ztt}8d=%{cwBQ&UW1t1fbhv+v{9tDMXBfdD&ewWI%nGyMIG$@5U`)}t zq$}r%V;cWe;f7hk>z-GR7YoHMgR&b-7^3S(8N$3dgF@*!)moQRmB)tvvys}+EWN$H z8vOQ_;Js$t>Bh$TBN_gO$qlE*WAn?pDVqbG(E2Ro9AB-_VE{J`6OWk{UP}MjH-9aH z7GIUVO+=kLP%!ktBOtjgv_roN;C4Am^&=RD)eqY>9uZg26lhpVMesGd)eu#w4_crM zBo&_gqYyhF-&{Q&5H8h%-}LSos6*Kz=>V=_&o9qmvjuPjhWmk{ypQ1j(rKI zD_4bCM0FS3EevG}VO?tct9N~YxqPiJ>=;b^a|rktO1$H`;W2ZqxT#<3p$vW7QBnYf z5h^QiXn8z@H-3py`I316a1bGuvxAaDpgF>;AHdSRu^>H_%4@I`NFJZwq$%|?V{@cA zc0obgwe`gDTt_TpYLaV69;U0ekTpg8etaYO(5K3nG~Vo?hpB2-xlX*g&~VpdY_k}j)Z|J0Gftu+rrk3PSJjF4T19ohb^7JS;7Cgmujy(4 z-8c+U1%C33Kqe{@nZkoJjkun*$q)Xkbz1>FmY=ek&AX4L-xiMQLssOq8AGP4$r*bO z-uS$K$#sydj5R|3?(idvjt6vA8=k;ZY;q~;hoQ*-$re1AKNoD*n1_PcPJaxKB2A#1 z<#3o|B%d+!v(zg9@+66|{*j@mkdkfLYDi}uQh$7EN+xo!!jCyBf;ZuXZ{^5X!_4WN z9P@(W)MGwy=SBRU3jf^)*Z1nK`0WyE%n5Fq5o)#$N}gwQk61(1{^ufJk-hHk-HT=8 zU{`mg=kIC{i;Vb#F!XgytdOp_reJ7uJlr+Hod)O?`fuvzz%(-+TpzHaF2ak0iBcS) zkEu-2b)5lDO^9dqoM z?U|~P+sqI%GsMggGcz+YJ^yEB-a0e)-uLd3R<&Bv?$%a!)u)zJ zRctjYC|A$q)+gt~>~;M;EbPC2NY&E(YBPMRWxdoY z-tRm&@8p9?7<{nC_bGt(=kG0a!sUSNN@ z#3X{o%Eh=L+&#kO1GB~9BEAN`grHr>9EE=sTfOG-Too8g$TN~eB*VDXpTdUZ{miq@l{P*RzT zmZq3gxI}0MODrgx=+eX1QeYIAwB3`mZaGs2$F*kujjobzB74%;uwoS+wxh7bB+Ax7 zVdJ>rkqJ3nRbq1JXH_lg?es09(Y{utQaRs^D>6U{*TWiWL4b1p9y_(=Grg#_#b{w3 zpC%7U_q}H6=l5kdjywBcUbCZmcNJUZ22E5RD#YVcpDz6O1dZ@K_T2dA??Fq zQ8dBqC{wfC-kY>*>c?EX6>arEx&|fBVU4@n+z2~06)vdMLKQ&|mt@7PiDbhzBSGsfhV0_z40{4)^ zm&Z534pmd#?N}3cC~DU#W6y~&BiLHn8lTc3G1yr_R;29$@^NVv7?pD>Gcn3A`4KvW zfLJUahJhEdv>H>C;C2`9#BY)Y{dJ6v>2vyTkJzwV6rBTZrm+rLoNgQwIx5G;jwFBQ z4cQd|p=gCJLdv_<73gJIL%QFNw_3m7J&Jv?@NQl>5B`m0>$Nj~Ikb>J`mx>D=`>fV zg}P?vW$)RR{HP+r0Pya$*WiueM4vsunI7+F9h0l4j&wVYEHlA@WW>Tg&f-{O@k=t~ zB%ZI)My|-%F_B}o66r}!`{`TmY2Qr9_STSD&NL-CSh>|5jZY{)NhMGyAXeZ=gD^0<`GDN9zc%lFR)rcA5>; zGsCE3?ZwGb*IM<+suu%I>O?h~{uZQm884jMAuihW5$V|aGz?_vo1MST--uJpL`v2F zzV(llsNM3;-7UR%qo*=Axwo%(Q5P-;O`REr_OGaLd(d!51d1M1Q>uQK*gf(xb4X zJhRQQ^Kpysz~D`G5Ii{Xbl}-KZR=AR?#|E*-?5?~(?tjIaF}^ma%wC+Iy=k+=^F0I zA#)CK(5r0xPIjb2i#9-yKER9ry=z*( za;|K4apQIs*JR+sPnuy=vy2(mUmSc$@n(&x;>gtCk;bVO*STX1CkV}m87bK`kmnaE zb(}_428_Sen-3qRr5L`wVqwb$aeQQ(eMZ}nyk^wh;akN0AP;d7>6 zH)5%`z(i z>9Mj=Bz@HET>tATrGt5L{Yg^wp7*ht9u+1dRoy_TcjhZe_nqUi<+$bzEnT63f=#lp z9l+WtNrA12j>xC(rJUIA^VUKgOvP>@#Qf=+{%C>BQfh%% zBMNI9f!K|Yxc2T!dn<_3XMcIcKZPZRbyq73a-4_gLo4(#%zX9pdUjU5KS_;mQ@JYbHLV-HcCi{1{@K(i)^FV?8xJt(L8Xmf~5^~!yitkp~w{G?w@33Sjk>7Np4vS zSJ!NZ?^RJI%ww~Co-Wx`lJ%@cph8(cX|A8wW~6;rDb$Ny$~}FMgt%h^`0=y)s>M>w zB0SH=CrVgSFy0a36-u8gytEGOu*Nj>1n)=Eba$Vha2%bQ!qr);F1l8Xh-n+ogl&Xq zae#BN@$FZMDILO~zTL1V#+vy5n?Q#5#$o`JAFld@>zKfDM_>kX zr}>7G$>?k6`au@g*Xgw%qv0l3epAaE6?CwsNNi4JKg=_X+$W-Vu%3aUhB>(nQk&)X zfq#1QD!Id962lE}PL8jBlE+MkjgiLga2G0h)+aHaNrpRvCRdL(JC9}&#hq*bU9O7S-EXMyi$q&T9~ zj}m@gZlWf&>;heGqwQBzSJ-Qp;D~^2X5>-*j|Qf?j*B~$Vfze3jxVr}1kzH_UgI0Zn3+E;m zk96B!-)g=0jwf%G_@u}$*Wm3|9}?};fn2Lq^%nl!`G9)0iEsQ-XI9B`zM9qktlO`s zS7_3y@Djt2ASK#iA8pBoifYO1)ou23Mg%cd?Wzu-r@EtOk^IWC(j1f7-Q?867S^x- zYf+9w+wT3#bgE(fH|x^rn3ufK+6J}HydS|PGkn$N2IsWYLd8hcYU}uky47 z{E|O&3m?WbuUPi;r+zn6*V`twQR;k@tN&D7DxnsKu`oTZokO@lrH(d;D@}T)!fi{n zV%oX_Xf;b{SP71qufxJfJh zLQowXzdyzy;hjpjn;{+X0hNRCm0>HM`Yce1-y}X?HyDZP=-Fv1f9BN*yB8<-@iWB4 z+`Cug?xX$?QpLZeNF+R;;mz~Ob>cqa*EvpC1Joxicu%ut0rD2@9~18uuTSdBix>Qh zR)w!1{{{!(_E%G}Rcp@8kbfB}(0OxyxEyx))2`bd>f7_&^7c}J5OqNa?uPaKFq`>j z62_oi!D0)@g7M9i_X>BlR?c&Fi5)u$b$yo26VWBXw?aKojFk-W5-lb}KS2L3*^5mw z1CWKQX3#1dl}MUplVF&KtNx~%6t9v@AS6-q3sYqzS5AnPtm7e38xB>)AepQ$lT4i= zNk9s%rDmM0ZF_{el81ar4r=8Z z<=98|u%2W|5ULab$&EVtyBl)JlPpo|P)g+`u2|fXu<3T$JaNM)eN$`G8MR1jpp=h& zwU}LH*ZT1f-NkhN5C7EXuUBWsSUT>J)3Blg(@Q`7ho5zJ)*ifA1QmAo2A^9uEqW)a z3kQ#_S)Nix#wcnU29NDoo>E6XQ>yuA42=&HP!S6vUtU$q3?0X@@aB)`Q`hJW9fMhT z3q~@i<811s|5|Io4Hnsu?=P)<1XwwX>@*?E5fNEP14jN5v2qL`erCxH7&#|m6&OH7 zVId71K_O-pA3#K9$qi(C@S+ezzPf_9TQD(m*Gl$NH!n}{T z_R}!mOIYwRb2mtS(J+TeTnI38H%j)?q@c8CPZG(<_#~Ixx&2!AY54dNfHIx6@%)dS zc^usT(q<(4!1kXz^H`YJ{(Wa&y3TO>?9%|qs*RT8Ka# z`>&3$BFsg>L%qV1ANf@gjD9yhFN<7n-if8GIU9-TEMGp+bjxQuIFU;2Ro zs3VnH6KgMo-u^Nn>e10-hUb=c5tj1H37iR!`P{nckiW}1pfrE-ZlgfTa$~Y_AaJha z>$u*=)u^4cKtRg<(z4=o$VdEN-du~%#H(6cPK1#b%S$1d#cRdr4Zg};Ll?eTAAgWi z%saRdUV8?O6Zo@e1SND`&QyI?n5nPA0Yb>WasnyKO3NXG%Vf)2oXA28dLFkPQVTHZ zcN6C%334<+@!KCW$Lzg`afElTxJ8{=5gM4nmXv$wx0~;?qO{!5@HN#q!+<{4$u7>_ ziiF*bF@~sG0%oylDF@=VufiVgzJRz4&ZaA&*NB9LQS?dlTL?4Exu?&g=5p}FF67Jrb?vcWX zrR7CQ{f4re4Jt;2HpD<&HzO))Kmb=*wUrG$la~3sC)}!@9asPQLG@G8<3K*zo$OXD z20@t|UwmHQ_x{p)FOCPg2GIxzEKaW)B}dma?UIes-_m7bME7N42jZ(1J`y62>uJ z@nh$Fg%JHt`3$pypx5aR;*u+30@f(XXyf8jMZ6DEXKvDoo2WSYWV){S1>MDjV*f^K z<6)>gVc2k~&of?}^|sD}TK|?l^;|;!zOVQpk%1LocnQ#oyLeYUuZMi2i+4HMu8yQBAUtO2aZz#-gw{) zzm~77sCGm@>Gbrwp?Qx=i(iZ+KBeffhyv~|(*)k)e*uvv{Vrwj_5 zgjG-aBH1+LBRI6O7+6Z(&T8Crb9%W-JM5)Q-aoF&VB=|2Sku&^9;--Y*t3;+7-L`Rl&$ z_t&j!JCW<+Xso;aE8KjnIOQ#eo(rel7;1zs4=>qRbcELb@V^Pr`uLuLufRdenZV2W z&e8avm&1{CwZCBUoEs1_*( zWx;onLB*lSe(NA!M{$JZ0-*3deeUi-QUA5^EdUo;uP)>Dk598+hCR3tV?hVQ z%BSx@#E?i|wKnCqr9}Aq5hOIg0|m%bczadrU$gu+i--NI{J|5z>^LRX)(W+9 z3CaXEo{M3z?>&e>P$IFkpG*iTPf@%mgd8+g4Fodled9{0z3QD?r9hc|h&Q0f`-_$4 zR{yk)b*h8z*fbzJZONiqJk!Al)OLldI-VRz~ii3!{(%^e?UN?#RM!I6sGU zc<^+iEES+6slQEVz29qkmiQPSzXKe0oy_&Fa>O9}PJn;We|IsixCr zk;%9;zj+4zoyo@udSGI!7a@DWNen+%3CtvUMt5=WV2wXDKmP5fp|rO$0w_ru)Q)=~ zGyYOvozRbUOhixgJyY5{w3RX%^gymaxsCq($zg$CIPYJ%%c!i|Eg>4P-ZC(GK03=u z+D-O0u?R7hp7XcF>tE*f<-atmKvm02+I77qKI%0DU$%*)+vr!g_^yE`%8!1PL-vas;>dF znt!|!hQ@E!b(6<;^CxoqUB70s_8^yAyX5?Rg}# zm=b<5s0&jzYn&);@!Z6T-)8U0>4=ADS(d^Bd6hxqj6t$=wZA|BlVLrg`LJyRAxJ<0q@5bhWI!G-;Tx29=#zjmi=m9vl&DOI=_^P2J!Ts+JIm>5W zZQFV}$&-2v(^5iIQ0UUPEtS7o(;wjlLW1Hs`GOgntJf;VK`xv{HA4J9vdls$HJ<1! zi3d7s%|#OGKU>#iw~IyXuPXlJ$X`dRi+8xy@K$#n8!vYEm#DiEp@CB1C5v~JJbs?H z+bcBX{R1G01ZaS#`GO0(h;C53Z^}<)65J}APKOuwT;ob;g)+zwPNYXoaz`Qg;Znbs zz^^zt5o>?SPmYiQL}WZwtU>DWEEef9(Bwu!e)u``vy;d?L?}TF=HgRom3{IgPK%d+ zi!LaL!W39-+O{mZ>OU8qS;8$6(M9ly-lzQ88w6l^V?;Y1kv|yVQ(CF1XQ)YcNm$~1 zQ`ah)oS~sgx->0=EN5`mnYwB(8={-kow`}B_rugwK>rbJo}1N1lNALCPoMSooxpcu zn0?wq@A(dcNoNTW{$c#PMZ?fSv-54vvT?$*A#fZc3WBht=ALfKsv|>8EfqQEWrm8T z2L=~lt(ugc=sNPDvNxz2kR%4bMl)tHB1tT*oufbIUT$3Xc)$F0she{V$&L92x)*Tx zzBrPRfuu-C$|{75(GTJFrzZEb_7Qc(;J9(VjmH_)y~hbgYD{N8!)CNb2qbjv7CM7* zRUBaKll8=^ixIElM5Fv3g@q}n%C>We_rW{?HZB zH9WDd$UU@jZWOxehAta{KgeJkau)7;QwduywfpjI6Ufywbn7WZ2pcdd+n8v9q%}=e`?|m zKa7`R6xyJ?ZOhq<)oOsfT|J<$KxB#2rG7`J(T3h56~{VZeXzK=n`5c4n&;j{@OXFSebA!w%^1#>i<6_~jiu@xBtB zl<4Lkus@AY&E9gQ&5R$P-LbDaZ}Pp3M)8MTy?q$NnWX#Y0|xyA3z!%ek^eHNb<#onRrSb*ZpZNK(zRHAPwZ$1r`}Z`kPI%zM+8le zxt1)dal&4*n^{6)r=v>I5m)3AgvK1L@_M<7Qk>J^-pq8a6Y>9GzUWLqR&9wmdvf#b zVJBiaqa5jZlmWAaCPRG6!gf9VKFERNX(v}tOy5!mn@NQYzZe7ZO(9AvgEYm>tb7MG z9%?_Vw}VRMouVlp%FZhO{=|c;>q41g-YP$)!G6qvQX4?f{E)6L`O{T98@gJ1*#*t5 ze7NG9RoyuSdp zGJy3xudsY}0~NY~$6gQIfCx)F>5JK;CYxr&0q6K2~TxuSy;Co-qvYX~+}0+l6? zw&X{i}iiqi1BurZMTF;!rZD%0x}#5lWZ2*FxIMJ2P$Q1Ed`snawF zic%I?_)A%?saQ=k3qbOoeC6kh5~okcld4EX!oHD-pgV z#zr%!l9GWOeRem|iTAA>h>Sv_7f+rjPu`|YfpDWua-87v{xUZo| z=MMQud_J}kM>USGAFyN-X#cY-nZd;9AILtkvvGrI&SAa+Mk90L;UqYf`FM}nW-2$* z9a6Cz-(k78*RaNqC{75%MRWQyaQ?6on5!KR>8*_#zt5Sb42^Bh-<+5-cDq@Za?PvE z!H|h9vDZ+(+Kt^{mxeRm+}8={R6Qyk11WRk7%gh%`xbm6GaFE{j^|Y%piNU?)Z;NzD z`O5~A9kU@6Xfop@3QNIxf3V8KWX{)xl73JeGS(~?rusD~EV<cSyP;BQ=QlCL8yU;6aw(&x;e9bN4jqfAE-o`Mb@Ox)s`XRMI_N*ry$S) zO9&}R)oMg3NeXHqsvK1!yj&KPW_c&0d{OExlx-8|k^#I#nL=(F-x0jPw%tGx%% z@aR^*Xv5;EbK)E6?$Y_;x7+nNJx)yuo8+gkSw47jUD!IAWF4LO`A2o{x8A=X<&1FN z{f8uE1!t#1Q-TvOVTb`+xcmjp26p=6!+Gi5iTOUK&kuJl$A7z_Soo^-rCODg5)#lc za};tlqcF9Jn>vM~f{EGY;iN$5jfU>TZ`B#rs2FFenU*mqer!qDr-4QKzzU8v{6`Y~H(xD!igGsHOo(ky8vFCi(gL4@gkekJJ~`BWmGM~^ ztx6clt%};hyF9aK$qs>|`#a@RolzZJCrgXGP{^7if*de8xnYY*iQ8WCca8&NJ0>IM76WVkvG*FLFv}dr_VOM1nl~WuBUgTzwH$z%F7?wl~!Cn`j`L6_S6Bpf;nrR4s3Twy=oS^eBoVaal zRrBv)puT&!{L9iRI=JKM6BWSx??9;sa&Y*`gwnTmMg2Hw#(W)~LlFq|5Z7qdjQ9cp z8$vqqji&v43Hdb1(9Y61~=vTeEu2(j<3}f0MX{=8bH>2BB(VoS%(9-B? ztDi;Ro2{KrhG|nn-o@k#fER%?F#N4J3DSa z<|u|IOdkUiDO<*|^e6q=gPO6+Xw~tDpLtpRZha@rWN^x#GmHx~LGA<2{_KDbm2{j< zin)+B4)8^|qx08K6jW}P6kTlJ1vo=hqyh3Xg_-ZV%+R9Y{F_OZeM@AlIS}(}C!cI` z14+VbO!PhGshxP0QNLStZZq|k>aZX&lTKDN}xuP5a{p=@(de%o2aPnyW~v1O%J_64l954LxTe1!j#zT)NJ?*6{dW2XSW z=XuIqO*nw7uAtua#J--yDX)NCA0@oG>=VVEf!@$+YGF(DyW#P^0UIWi>syx%Se5!~$Z6ofrcW^`#3LK9-w5jn_`c zp2hw$ymrX?{U_~&Fk!jVv5-N;#>7)vks_fyjDruvC9`J=Yz|Zy<$ky4-vF=AhSsVo zd9Qk&ldSnc00W)OyTnl@1hkogZp>jt};QF+ik`a zwX{QExeZxxALnRt?}{WYKz_NM^3lsivb^tg8Ee}O)@mPqW1Nq(q>$q z81F(gRY>x0-6iRS4tqXQ*Kt|xnOOh|fqKQ-!bTO5&X4l)O{>$wrxo=PA(P(4m0ps8 z*ef@u13r$XB5g?!1kv*$kjs0@ne6^@#><)`Z8J#W9ciVWDeYVjEAmaV#o*(ypvb0d(v<>ZmaZ z4l_S%uPj0_cfs(R_S`I4|1d@g=dm6dKis1JHg+e4(_BU9F4@vDu`2GX3--7h&*8By zpu;AT((Pzg*Ljp=X9I)94~+7rt^Ze-y^rO|!JoxpQNVVOF!&$X8X_KHw3*%)C*CFb ze-?bDh5e_1n-;bL7n1GWbad_~axk(uEZuvpjT~6C1_g0g8?q1V4K3EN^H5;>OBf1p zlLIURxak%K5!`1D%iKWb2rCE$?!JF7dB4|ZFxVBA5X|`q!vQ{ag~bPlKf<6l;Jd-* z;X-n-fLpC$c^Y0~U|CVYT(q!=V7?q!CGfr&EGM`p2Nn;^D-Mg^aGe8t4-d)74L&b` z!9nC^V-&Y?c5x-*;$n%*-v0`)F*C9MyVPydS#rkfNAerj7|B&-Fo*GjR;E#t%Clmw zx9zVkBRlfT8cgUy?=_2!AAWqoyN2*FFqfirdRJy`N)!JG1Ct~}bECHwMAJlDSAxz9 z|Fg=KOzdusA^!K*$=+X1P$oUt#^BH!2#+uqtj0nHN<$!UGT~b@sVh7AvvI#S&7B`5 z7s6bgJbJ>@vQj1l*hXTyK`$w#(G}xX@p#D%PG^#+DL39kgPGKLX8i(J0wxv1wN4K4JsaqLZTNK$* zq?OdW*bM{9XsPtF|kGLS|st|L)J^NWhSpSw&JG|J-N;2 zsl1IS*g5hTFdNk?V;{2;gT8CB?HL(`NuNT+Q6kZ}tM!Cz#1h19<9+?)(X{SOQrf7f zO!{RR)%Xgd-jEy+1&=zhhbsyT$ROW=23i!Gn}D$ zvft2!5%N`C=sBb-)G0d6&32q}aXd6Rzs#6xs|t2VizauF>ymd-az7g)kN2+2;(2C;E{ZL5o<$ETkX zXk55x-@n|nW{4=^kJ%e!+8bS7C*E90iyg)3O;Z}d=_S#ln z%!~BYiQvw*&yd zh4fF;Dgb)m2yVf>Psp;>s2%E%^Ld#t2WyUyXRhD0T)Grl6Vnyb=V&}UZZ2oX?e&4q*ncvjqw(;$d7NFh_Xj3ob4exs zBZJ%7d3$?cFgA{qQbImD4UhYujN<{X)LW%YkBGI!8rrlLAlu(Rpa5p2_*mVnfu==m zp^U~}?cxU0z~NuSX?t^^H#UM4OQJkl7r%+e*=_r9U?#SNRO4S6$@u>>DB}H(u&k<} zb6HFNeIZ<|CS6zr{Qz+I=h?xds~42 zkGB1t$fulI$Y~N_-O=!%`O`@IROS)KXK&U>lpO~D|x$r_}Yw*J| z)=g6XB=PW3B}0%heGLc`&)n9REbU|p_u{+nzEQNxwtq9d_V)I7dUU>h(!@_8f5VA> z*PSzGe(p{^I9NH}U1&LI@z_@#`ljP(B`Cr^K`6KryF=0DG%@_enUtCNFY z(%qzX_jFTVmh|W`ApUsxZ60UDnM!&+P7lXFbQ4*#!vw z09M{NPmVUP%clnithv22f#=niOR_8_5r^rw%j*M_$%uuSiG!8v!3l%wU$dN4TA!cC z3q_Xyv}EYFaRF0PeIfxazD}H0qCWh*nbH2u>Hc>YrFwdo?NgCY8p)bhnzd|B zr6^oA@b@$_MO_geewzMp$s>O8Cwz($@r|GGk4VgY6>(r?PRT&u!m{r5Iw|^bnGVbY z$2Uf$#v@15{hR3vhPc7u?ybL$AnZDan-J!KOD$qi&{go&MZ_aJgtek+kQ$na&(~iw zr9yFOuH#W6#~A z-p{;7%IuSKutLDo&gnA`H7Y+zXzPRCJBoNCE)WC$q@%p-=F~INyXs`#p}QL3kn@#H zeTmOoGbgfqY!hFCS>1oi!IMrEth+A^h1h!Xydut_1&(qfu=oU>$=E zezv|JQ=3JuW7qrzQL)0qTd38D<$lsoeP6i*XnyE{I{T|mXJLLkYB&BgJS^iVmWVBa z7M|1Setd`$z^2lY;;n4=+t2>cT{H=*idfeduRf$iR{A4gCEQ`V9wUH7HxE`5`CDo8 z7quP@gfD!e-O*v>hy3ZnmL&F*ywQh`A?q=UY@J0r?Uztfhmok=rZeG+7=l6)j7PdFwk0;uJM&b^oi7y^`|%rz@*+f@!*KsdcA!FTE!# zqlJ`=V-|npGo#yExHDIEb=v@E=jg=q&C@9rY)3yo?w2fl;}}%$Ys`q9iKUIycl>{L zx}6!EIGQ?&HK?D)DNkYXcJe7ueAKnhYq^ODz#iI1Dt&C~riXz)y(u~9eF7G=82x?T zZa1G#4IU>{MSO}@Hh&CF{V0(6yM+INSb~yj8q0#QeAPg{#oyJ}>rvl^JNi!OEl~X! z2mX2H*!{6|?(N%~O-u&no6LPS0CzCuQmR<^SKO%3WhP9;ZYShxr+eo`?+)8Omi)`2 zUWYV_o5I^#?%mGJ!ZDswQp?qP!o%S+y2|MF=bm=ld#Br}8R)SL>s-dW(Y64gkbZ-< z2j^ZW$IY#sgHei*;Fjg_?rgF;rvU+{hf=)F=G1Rw!|2~QU9$)yq1yy80kUIt_=NQ1 z!MiGp28%r?X{R`$17fH}{(b?x;#9owmu~Lss|^J}@U^o{=y)yPM>1Y87lpXiAp{x! z4I<1~i$rN;Nh&Zd(KQq-iT>-7h)}x=Wy#{#g%O=Je~KUz^+v;B&XaFTmeNYz7s2o1 zcXHLpF~={>_?xeO~Lq1aqPV`~^q!ypYyf?EJx)T|Sa5lzL+FBtD3e z;^zC#aX0E*DGK(ZGL7-ophhQ<&)%AQ;}a0jsiLYn0!7)o%-x4Um^g#tg7i|VFZh8E=S81`!xRKOwE z)4Ue*GC@Q2(uo8BgUH(3*7iw6H)Ffki?=&_?kg*16%xT>%?Rnv_}|Y7jo?o+LkR7G zD3Od}iTgQwbo0iGoR#F+?zK;hev{c1Hw|(5_B&y(V4nqQ{+8zkIzIAJcm*%Xy;hT- zFkt!x@ucTag2$aX2V_7$|736_(Guvp<-Y0W*L)Cc7-#0Bi;y?9%OvI@uD#V#_X<4R zmtCaiZdwUC+0Sb5aTiV<-EHFg?e*@_bM8e$UT1#m=1Q>YgJkSKlOh-ZHxUz&gRwO{ zA0MNtm!lb@rm~qiqm-x)pQ*VKyQvWq3x_$I5gQjLlZi2l39~u38M_&`5r-+8slfk# z4LwF>2M1Sp=J#7DGfLT;I}ow_E2(1TZAQfMeoaOV7#(IJRw5R?|1g}w#PZ*!E7_Ml zO7S)P3C}qzs>9nnsywPf+wMqiSADQr$Zp?{VpS1xw#H}ZyyVIVo=D)1h@KxGu{%?o zs;g?g&chwkah&=2cLM_V8$P=kK6_&$$u8qtOr)fwTMEF?2-RgvZz1M|`};?nes4w4g~4N<5C6RWTWK^YS9~|Ngd>!MGrEKeV*mU6 zj|(KFGb*JEe4#ULq01)=XG{y1&wI`UdoCXY_r5V~8Z&GtGi*8g$C^GjI83&^PU^qq z0I%V+ji8do6r0AxqsEM{jj;wUXq+wx4bER1Twpw$u{>Om@0tirME% zyTbeI$;*Mv_dQmG+=+Mnw+KyY)GnqK+57NCrjksiify=(Zn%n%wvvRlilwB|8WeB$ z%YV`OmYGwk__f_IutL9yXq?ce-!a~>gvYA}LA)EZ>qS z~|$abzvG zZfP>FFi#ECRHKn{4XTxAiE)>STLs-C`ptu1fceaipplwC@(qNRPwrB?Gk+xG#>wzO zBO!W|roZw`Ko7fdY&diWX{N7Ydu%u)2O!helM*%@nuBbDz74$2*vKniSJ1-}@|i$i zi8n>^+fjoRi~1z*;IoN+N@U!%R5iSvT-^J5QVU$#fK=KDwUm1D+`+AiogmR*u{xI= zQ1EV{ruq=Lf1V-_m|^9LtKs4uv{vI-agL@BA=lFLDIC<5IzHeVQ>YdwNv&u2%cK3m zjph6W%Y_>3hy$k7GLbIi_stHeI%Isn&~O$5v6o0S@6hP zJzuzcr}*MbU-krL8Xm?tWI(0BedQkua+$c&wL9537tqe(RqHR)7oV_N;3j7lL(2X3 zknKUgTH23#kfDiblyUgo&4!vlWR(V)({cHwHfZHsYwuIwb060ubO%Aw2EBL zUXr84;ZhyMzh5ymyQJMfwy+hPH;6xYOXkz}CiVVz@TG2ZkbPVgs&)J_kwM35b(6Cp z+FMkD|HgyBKTJ5v`5Y#AMZb0dCVQIS{dqS!B8Vw<8qjuH*}`&5xq!u!??uA>%XF$G>kxPR$2yb33$%6kjc$a5F2(ds&%D`;Stmob z`fX!;Dz9-{74#BvV09V0&Fco2XiA+ZU;Vb`aR4Nm*?Msd4z8q9n33+hK7-vx{2GYq1^0df9WWX zl>D2tl>_rpWAb*SZW6_NB4JyWAM{TmZkz7@{G~^B%N|ryZI<$$Xm9@VwFWMg0^rs$ z&)4Z2*>D2Y0A49yw4TY^d`C$X zcH|YHG=nnPICl`I)R=>Oft1hS_+j*Mhy3vf!*O5v@fgAJpuW`D+FqVtU+FrSY|mqB zl5Ccc1(YVJt`OG_8X;>CodVdx62eQ#8u~P>CJjI(1i!ZZC;3KA@JSg5PXyl8?&Es6 z1w%!+l0>*8ySabna)ENWgH5=jx8jzKLMA^U;*ISF8$Uy*s-hD;b{&n2oe{wENCb;lU*0SpaCat$Z;IcGUg%eD8T{!yz2 z_l>vxy14(S-0}$h@{rwf#&$VQ{B6C6!%p1t=+&fYVIIi)-*ADV2}U80A8%455-|iP zcb}7Q$iXX;**s&NI%69rV^^!s(=&Q6ZW-+@rF{$f44ZUZ%zs=aQt9*`fG`1|o_=t8 zMsRwidU%E0-G9G}TaF+sUk+L2?`xLu9ie=VRd|SG4sKniZQr(e?ct1^SjS(ZXyOzv zJiCwZ7NJ&eID|~um}5FOK{N@(1j-3Uo>>dei+lBA(G~y6+iZ>2HTM|vRv{Fo? zMWjI-SL_e_TKnts`F`%}|NC9n{fDM=w*tM1h*_21ny_GU)&sy*DBb+B@@str$vyj3 z{ba|Sjj54jQpqDC-qNA#r*THD^0acV>Wb1;r8N=iUqT+W`26DHg3hdrsL~0XA=go| z>ZA$w4Z(>l3zzF!3Hs0l12zWwEwc&P^KD%hJn;*cj_vKj^-GD?l*SL=4qIit(A{MG ziEK$HKZ*7R8fK3~=f!v}EbcKyJBX6%##@}0(j1qH8I@}$z>M9xj&%7LZLi{s!R!ez zyiGLt>Si5`G-fzI?VvvQ#lp+Q$+U=A5x~bAl<$%qWe)i+-IBGaC)WR=a-X)FF15H! z8c6-eQszU;4AeX(r|^<16fjej@RMVh9b{uL27E%fMnE0iRf+y@Gm@~sq3X-d55GGL zaU7~Ao;I}HrgVGApB&CwKL+uVT-sTUtM`yxC{2C@dX?;oV8xat=+h(Hh0O&kiha_O&Kie5(fp@wM4+L% z;bZ&_vPA}`)3GY!G0Y7eesC<_$@4}&T#;HLlO+T`oPX9lJK?z!9t7?0tTXI?Z_w9_ zR|i^G5St-FIZS#9(puB!nlH>H(Lf8omQp*e!}*2fUm1^P&w}zZo#C02k)EO-xm-)O43$-AO->>ky&G;3{x;5JvNqL-rE-TXiIphFz zxfrOM_OU23MQ(L|Tz$htg&T_RpP8`=-;3H!sKt1-r^t&v6t#fZTpi-b)2bo;`$iG%Nx>!XJx4D>)HVHRlmx>|zIJ~>B-)R#huBg(^YW}07?(~q zzk+K%;2LcS%xF9I4a`{tGq&YPx+BDsh_N&Jv6uAfbVP3@8I4#EvWZW)PQ1{fa8Wbf zTUp5Xa|Bn(y}xz{DgT4tx~2g%oh}xR5N}~joL6%!f(FR0#K$`0kITh2o^K`N?1`#E za$Vh)8gO#_xRAWgO!AQ%Bhvn$935V5O+Hp`a66nRv>aE>@$L%Ik~dWlpVajdKr1QyVc zN|!i}&Kf#(ES#x>5Xt>Wx3~Oi7A}8&*da(|9Liqr@p3@F9t&qWQ<7-;KVRC=C7Ul) zL=V~Ijn|l7`COkBWPrwIE4a(&k&87iq6S|H%0Oy^_4?({&&oa_v*FTNux;5k`sHhn z_R>UHgfpNdCzk$s%DkHP6-gIp{l`S+<_8p2AEGe3tBKOTON92gL)nu9l`!Map3o{f z#mR&nUqbnGr+PuYpGD=1->*gW9FHUO4$zW$s$0xES;< zea2KKo<$DmUQMBh%%`lNctf%|FRoA$APBP z9HM862_Xx$%a@&n0(ME=dG1L?oLoiYaPb2gU~hdUz0qL2*Sf~e5)vhY#^23ZaAZ1@ zFNx6K;B$xNCBGkNL%X~k1Qj?Re1XEugHx`?9a8Dn20>v<0nM2L}Q-6KpZhEsKa1mC?L7$|_eZU1n zUJ@m~mUk~$h$V%?=$W_bON+3AwZM4Q53U=ANaz~#0cK()?XXxQMCth%cM1QOS<$`gA@wTyaELLkB{uO!aPaDgV^Av&$DsFJ6=^;GTr zdW$wx_{qW#sNszqB#aa%oSgV*kwGy{R~9_mNaGwa5N!TL3Yh*EfA@MX2}Jb%0It(E z!ac+D;R+?HfeB?k8ZJ$j!8738aH8Jg5~^U&cw?dpRCMxwc~Vb1Zj5fD82zTEoWs-Me-$Xwixv=S3s zdNUfoA(g(zN)6H`SGgj*h;onKn6i@YOJ>e;keR-@a$Y6O)%NufXkyh44|jc&6yl%@ zVEk&hwYKUfGtn`cQ1{AX-3Zi>Y^nC0R}T+G2sjsb;bqFXb`qsdUIR2k>ufvAt@~H~ z10)e?Du%yufEznPyiEyeuE?T|o|MI{6txR42)+&dACj|~SexXoL;p>{{jbL@S3N#AC#WaeO9-l_2fRo@W|79dx18&+ShtAothYr;q={kh#%NXg;8#CY?h zvM2i*iv&?KmW9*4MLoVLYGq}_IjB}v13StJFlYZqG@kq8|CAwBOv1rmU)PePWlB=c zNx)xM_xL?F`QKF<(G+Ia6tO!t6sH)^4tSOS_Eo9^Czp*I$q>;~m zFzDwP4DC1QyI?SgVs=vuhSd%Rt9CH|!56@z{|^{u%{zc0-SfPmxy-C3o!xSW+>+(j zd_!M_v8JHuR5KpMj(*jYF1K8{id>;MYA=4TEw{;D)Hj^w;h+OJK^{)+K6X@~wpsu@j8|Q-*93LHp7$D3!Frf&=B>Oj;B=O50+&?KlaC2{eDpDni|)HD)X;;CIc(Km&W(4j;+f>PvVa5 z8-_uhitI|w&Jb&;FU|n`Mwz?Z-n@Da=;U$L`Hm7gSO&L|{txj%x-PmrV-`M^q|0%F_?nbBM`FGn6#q%+^ z!51cd>xDPBeGe@JRaC0JiancYWZSsqjg7`hW81cE+tw4?Y3#;mY}6Z*mf*?;B3G z1wu$0;@@z*BU6NTu`=N|ndd&=YD(_e(YMhb%omWEJZon7dC)k;>6K%C#h)sp;EtY0 zOo<{fE*oD(EElbKloM?KRpK8}>jLQB#W#K|T@*ei?xvha02zgMJjF=7awyJ8gNX8+ zf;VYXYbc^i(G%gv!zad&^fLU2{H^h?-{cv1@v?}@H|LfJeAxJ_Wq3&}>pmwb)q$qHb!aY9iQ3NJNB=>~I?(^#}q&d6Y2_=x8YWuL->$ zvO4sDhZ=|(K<0Ci6ot*Y>fUcIqz!e^5dYdvQ1}q?H&7l|76%D-IEjAsC}BQIh+{6| zm-7(xD!UgFsd3VtBVm}=n7X}7pD;gDu|c51Jo0FT&OxeEKCu7%6gE`7L2>*YV{HZO z|AE=F?FmQ2|Z*U?s?L-l>=&SCZcz?U>k zn3%@`nA9%)U`%z?h!{HJzUX1`;5soaES~c3Q}(=dF&*bM-@aAGQLHD+rOjnzG=vhz z;^RxY?pLdVh+?CgjjJ}QZ`wtTwCZ^JQRHGM9>85K;Qgsb@F^D6@etNUqDq5Xl(J^f zUgyMterD*Qp=ab*CgkqAnr40c{MK!45#nP%3xU+>5BLXT+d9t&5QEF^wLEW$*u`{# z;hJlSYtL=jixE8g`mZf2nX1On*{2CbCoK1)6Q;#^5VNmjg{tXa{E@M35bRVES|JP~ z8igEM`KTc8nOF1xEY=TUzgXfGDur? zO^GGm^Q7y#)ANDZuP!ugqmJb+;_jFbjdCtsfDmKHhx}< zt`KEaK=u@JWC%?l>}AwaoOqI&;<%t%;=>qX+{Gq4OE=_8^&&53f8xatj|7 zmQE#R?UH7MMICAZe_3dqHkU{H7-6Yg9!=3y7MFs8r|f?2h*~{bpg_{dpd(rcuNYN+moXj^e>M#l?uhx@zJ?k~nUivdvm_fqJj3xusc@ zEq@W`)k;*GbU@KE3deA*(g_^Zgzvc4V{2WQxZ63ZzYDbOZ;Mz`FBr7UOP}NuIBh@u z8|8#fqsFi%S4WK4!B0c0+~>q+kYkJ6BBS}dN$jZc`B2rg=DfUQCWpwoZdi1SN@LRs$-5v4Q>j%*D0=e^XH#_Il{rOTwyz{Y_ z&3WDH`*MEIXwc(-FL-_X@A~WExN)*pk+HYueTypp9a7-s^6T?xdeU*H$N%Z`C_BFg znAQBc8{GKvd3o4M0Q~L`JnewS&#R*aN2SN?binuJNpx;du-EV9Ztb#r=c@JdY^(L! zK;UciE1Xa8Ki4iydPTZxZ_highOx1;w5K@8u@%w_b&MXUqHY(SJf&atlZ{ItApE2= zL+97NVK<+fPu(Bk2*(F~!c!JuDbUl6msI62MlF)a7!Gs%^C@IKE&?!DJ%Xw6#H^pY z)1hfNXx8bPb%LqsBY!s`&O8`kHP08vrWrNt3u6@8f5*_>LxbC-aUxXA8)EtL!FsX| z3yh-~!h}#Tu*UWH-EY>J(4fy}i-XaX7u`!WWr{@kEuwr%Vv{KBlkz>2Wm)DsMTT7j z2M-}+zIp%cUwiNa1r7lH(TLI=gR05>9p=gwze8>y*pa-i(T7{FwTWFA)r=zBpr0)+v`jpwqPE=q2ZHLU8MqnNMp%W6NR~{s? zKe)RaSHV3G1<4T>!ckS-N0ed#c@FVW$&V_ zh~2wO3h5`)s>6vha{vaUCpmGF4!s8cE1Gi(SQ-$kNbZo=FuEB8))0uYVYz*fBZmgX z*ToALvIUa^8V&em^6wTijT^sqL7!7j-|WrOyo04<>~$ zTZT}RoA@q|l$HS6NAIge9!VekC-7M%xkq!Z@+^CxT|yEv-<8O^BU=nhOD1h4IoQ z*h4eJgHOoUYS3wwZZeng+NHoGlZA^L&UM(C0ljoqAWQdx!g8+pkFBk0%hl=FVwS&R zPd%A?6Wb+HBX-F+<>wIi&iy3pcF1qXo#}_Wxl(L4^cXJ>pa-~FL~{_)wV%1zd5ot zlOBZ3Lhh?prD2-`FFnGo)FIrP4fH!}P#OjSy3v_>iQF+xql$#?N(W@j07w_$AFQ`c zy3wR;G9m?c@YEn`PW_!`)si~L$lEXOsqllNDGl7kUSi*)A9TdgVrs>}A}tY}@c`Dw zVnj3rssHD1j!B!BEK5NN>;mRgY5(TZg&S6z*Ole$G0`TJabS@5YKn^!cpXZ4pQ<~W zbO6}b%u0`fCEboVJ(>O=*iLAmO})LEpBJQ2T+Lhd`DG*pI2b$>A+|B0kHtao)fenB zkEeRfAL3^HD?6lC3Jz-Jb5VPz;k8-j^z`H5eNCh&r7>s+?Ll4Nw}T?6le{{aiOBHzx0tWAJd=wttZ*kw?yno>(4zmD1xq*e9Zt(*;+(Q zfn3beS0r*k|0kbjs$`@BAQ8EJeBT~=Dw>#xyNz}KuL9$kxjEO0S99dK8n0cFF?V#O z<~~!pkABe7px+L^&Jgepx0R>N6mCLhq%`I230~tc5==0pEt>R^1~VXoJk}_VFs=>x zWSt7PM9%!=C5JpViLHU34%yb*faf*4*PWHpOkn0wDVRX_U3u9IjR=_$I4vX=J8{sX zqe0s`#Df>izR3?aKP6AL?OSP|H8*J28WmV%jrUoU`ZhRuwFNN12PRgh8L%q&43+1A zzqseOKg2PaIkSN~vP&FQ?{lJTEJ%$ZeB)*qPo%iBMIWiZ->lX$pGfG780Y#;UQ50> zz!yq$hn*}$MX5SL9(~KDQXpfIHA>hD&KRBZW72OV2(Jb7*5-f(TX{>c76+;RGo;J( z{|Vg-z)_h?0g5nbKSxGwZ92IQ(dg*$%c9>{1YMGmYu<(LvkS|Zi+LoP_uh!BztFl& z#z7c(hBWT)Aua+MB_h_7@pSobgUz--A&*Q5t|Wq3Bztc0Lg*0GObM=Jf>_qpo{$KD zYzY6uaD(wV!|%|Q%q^ZpLQz{@6KpVQrdHSeK%hxgGkF5|l14sr0p})PI=DX^nx93) z7i%j{w0EF+u@{VM5p%C|Hr1(fpKG33(}(~>QsJ*L1WuX{RP(>z>utl+@eZ5_#~izaBa9^sG++)jiT}$A zDmY_?Z$0+BWP7SGB4at_|QkHg?~q>KXTF6%e9EdDzVZ zNt>6Kdz6l6h9KVLSpzA;_wefSHM{z?fTz7In7_4o;GfKhD`0i5hHlGV2q+EGne2o9 zcpxWR`rH-&TOV-su@T=S77t%$w9&4ss;WR#7NOo5#0>mea(%Q9^Xoe=q3PpIOHu@U+B#7KgTxg$=O;wt?2m)~D)F*`-1mWs=TUNU=AP)(U zLd#??#d;o8o>TW;(GI3#Mkte`FQ1a^s0I%t+V)KQAzQrM_GD$Ni+CLn7&H8Bmc`7Q z;vyMdE*q+wAW_M{EA592d01FLieAmooWJM~N508KiU!+n$NjqOC!4TK-hB<0a%5Gt zX8HqshYiR}{_tV_o!Yn!r>qc*z^Ntc0#g)NGfw1xzw!h%r;0llK?3e1PKn~?kX`T1 zO)AJ{?)Q7^E-_V5A^PUI#~NZv8*%71R=t}5kIeuc5h(Qe>YVydf4$Q(kb~=H>Hb+U zrm!3T%X-GoefB_*KKx$*(dWYcWuoTi0v6#p-{(Tpr^$bBjJtWi&P0F+o`kO^FTumO zug!qO8n(}c#r(Wj%aNE9P(BuD}_k$|#y$L6*GbNu7ccN3h zaZE8rxefoNqG3U4VO23kxDEepyz}Gv@w@fkvSBihr-xbmNl)6hm+$0lts}mkoLeV| z<$otHBw$=kKV>E;TDAfWQxTi#EmWJk$c(o}v_M zsPc9}GNIJ7I0pTzuX6#pubj+gw9R<0g&x_hkT&bVKn-vk6IP`3BK1(wUznK6mF3 z&fVzZ8wiHcXFT!9dZy(3G27z4kQqJ zo@gE*G6`Ki!9^n=wjjFcvvffrxvSl7D8AC;)`c_8a3p<6=P6*va^rduE)n@7SdaLEM= zf&_M)cR6}oLW$JgcY1-DlQu!U+JTJ}K{KvYL6#3l1jJy456B_L2-bmKbc0`2zxS_= zP(HII0Y3JIf69KT3lleY`dlw+0wbnqIH7O`(6GkFh%c7XQqLaz_ZX>rUSrYenkfN- zf7E{6JRK0{V#I@|Z#RtFy=M#!=Z{qr`~|vQ-pU?)0-pzWh!|&-yg!zi_o~l7t60r& zp1y#~;$=DQq_3~mx5hUX!JY5Nx-uw<7CqfAQ{1|2qkK&17RnKsX#D4Vp1XSQX~gJH zFeK={A)7Ra-4ruSjbob)WF|bZ3l~L1irS%4xm2z zzTT%5ZjPO_kSI9?huI?!Oy-`HK{3mht@J2N;yvJlWWWVkV zY*6ZUki!7){u}p`P(F_mwawMjHO8c|%!ogvT&}4?^rJERZ4^|-gh2c;F90t;VDM`F z5^SAvDHmub*#JGZB1u&Lgfs?uQ#0wz{@}F_YM6U~pyVV}(DiGX%lg$#{vtb_GtZd( zUK`How99xbG4cwQVc@-WR9+I^1>FLXxmYJ)GQutv{0ARM6v|0<)>axxAq5imylu0f zDl(|H$u2nwy3M6Zp#&xMKgHDMJ>D56a0Cv7Cp6`LYu;Lr?dmj=Q*KX02I`*CT>15pR?`^(>fD zq%S0m8y3GuUJ9rr0|k)1(C*Zk%gsEtK9iEG<6<20aP$(HTHxgyh*T;8I&2{UGzcUT zHg>e#=ZJ2*f}t=RNU$oKvks+WKraGnq&m)%1nB7=cHK< zZGH=L5^{#h;Va?=@tM!ysm4abR+4NiH4Cz$6~Ee;!bNMy0NtKgMtWQ)b`|Hrl`7+? zj2B8e+}`&zbEJe044>C2cLXpf4nKQ2XXHT#%KhNtRRdSZ(OfEV7Hv!u6X>C8(>&!= zCyLpDgib8~i9E0A3^(S?H(dxz-NY9idyboK>n76DTBYQem(<(yVPs zRCqOe0mL{NAhdGY{x-;XeN_K9C}Ms8?Z=8fGCK<+rnQat99pFEd?5R0hn8(;$b2cu zmURV1LSbXgLm-l+g6c+yKp<~V&08UiE;rlx-td)hl7xyb^48oi9Pd2H4O9q)Er-M1 z@b=-eh(MkUz6B+2oXPfYyFe?9C<09yv-$)|5#uBrV2D|}ycQMqTPw~H#(nmykURUsA6W_kH(^SSf z61}Ro##n=W=0@r?h8$TCg4m`$<9PCgo!(gwv?)n$b$0qJ9ykuLg|`Xn4w1@aVX`&T zRVtw9uvhY1@Di6Z3~V-m)T1>!m8$p}s5umad3?y!t*?pm2aWXo#y6auK<(;YVBv;U zV1q4bK4*4FLdcfj?-dXqZNtaEH~{m9CWs26B{1eDXf}6m2V+qTxI(87B=Hx5D#4X* z4@=rUYx$jB<$wh=o!ezYdxkc87|>2RaZgoKt#(~u=J@orERFW4C`we$BGcUzyGEFt zK{O4_rx(vM>>>6yIIaZBK5vYhG&_jEs_e2c8~!Tt~+n~s0m@n!0a zNwC!N8TBvn?Ah8TR;O7IpE_ZxQV__cZOZ%8$fh%uPZEr{d~wFYnxEiAIR%oa_+=>3jkRlVDLU_N33Azk;W_c9B)%DNnV=qQ zL$I4>%-#d6oX{wqTg9TA%!}*&c1pg+<){Z5<>UCz701azVQKk9SzKu}=3qiz9m>aL z9XG1B=a98oct~m<=|3LyWCSuZkX!Fow`2@t9tge8oX;SKEUK%5gr%A!z#1DCnP#-V zURcM75PcpC{1LVJ*}upe?p}}5zrgYB5qkdXNzBs43t>@O?+C#AmH>8^|Gm$2>y5{g zwWD^w{d|B-9i(Uj7a>ISLVV_M+Cd~PPCkq|VWRr#$p{zG4Ng0zP1Pn;!7J#z;i@}>Q6 z=!C$6b48$RiT54p!I7VZ_BQs$tWxQb_&?C| zAsH&!V)J(cpo0%kP}AAl+4*#aAmpGSap7nL)e0T91&H z@_`%fla(XC3Y6aLBY+6>G%?y}4FMB0q! zqjWcAHgYYTvz?@*JBRxvxqh`onNd4mu@!4JJ`QJiF^&+etAFdDJyP0Q{$VLF#>vav zquO4)Zav9)xmEfrw!x0mT!eo=*T4@1IIvo}zE~{!l2&3jd6r+JMfEp}vP+dFenl>kMRqT?9l09SKu2zJE@X32P@X+e`Iv@s`#cqmWiKU$X}_gulRf79 zLp1&DOr`RCIk%B6HB4P2Tf~(TA-&2IK9z9X8>)#jsCM$2rZZf^Nh4PuOboaO@^<{p zf}Ivm)xPT7c!oUGe{zl2NqC@<8IlS| z2kDQAx^)$JD_Y6WipuYNhWQWJ4ojGOU~f5nVxCooJe|Es!e7%?gii*@LNLS+s8xuE z{A!gs&vNhk{xhFSvjvQ(d41{};3$}|)32k?9}#_36U&B?7l&fLWAz5NdROO`W2w{pe_;-0+))XtNa74KzR` zR;#jkCY@tLyQcS%tvO=3N~ViTVKld=pp=gd!_&3IKbX|=;E!FcOmwfcup_c_C{R_$ zK@)%Rk20Z@6xfF|-cI4C-u}7qlau{?zi7r<6pR zr3__zT?5~;(D^V1fSOhj;j4t|#ohuk41<9GbiM8z0AHdMVc!^S87O>G^*2Mw=!roXlKj z6?FC?)t5$_&oa7GZL^`S_;O=pUP{y*Iq@8xQqTg_j zWjG{J7exQks-&IaKcpN>Zm}@cM??^Vcu^o*2tBh3B(zw%6|RhX(_e^Vl(ntYYfmn* zsIHH?$1qp#1?_B6eX1sP5ep4wdq;to8Mb{VUY0shog!`cy=5`Q)u>x{Q}r^OZW;_lwdO~lZ27N9Z?XMMlQ5_k4a!_U*h zHD!Bq(QLC*U;aUqoY#Hd7V~L`t>+&bY;~tPXm_g}2*`UR;K!*X5wlce%)HW(%@j~J z7IJw4<`N#e{XJh|#us~BCm-1XLwG`yo9wu3$ zHNV;kX}Uo1OYTBmRxE7Y8%||`zkT+%n1*h)3R)sSt`L2zjB`j+7QkY+tguHlWqV}l z{ij%p3m_4VWW3S?h(z@T$L`r^kA<%I2n$_p4KDGi-ZH?362k!mjbm=keTaLGAoBIr zBM!DNU`eY~l>Sy8XA{3VZhz|8==+6iR8gaTiPmE0Y-#2&{dRpFFRPS!+E353w}Jl- zDpR)YHQ&oADG6X-8ff8tT-!zcneUV3I zL2#al^hP!xR33%Dar4vL)Kl(B#r=N@-;QEXaxNNn-hXL-hyG@&-te4(bv~U@!}eND z4rHt#z0}wqZz7y8A77JfY4WP0Zfy+G!|D+D(;uj962wJ_7K|{_bZUs&JURu z$S$l@_g6fM>rZ1&t&HK*2|kAEg4cujR=>Ge)2UIE8ZF(2Sx=MN@Fn_~3Sh>VWG|6E zj%YBWIh=fo<(j_fw|CVY|8+|R+(sV?NHKtAnr ztA*K5uG#FeygWe*;q~%-wO3*j-PY=7uKGTww|y4=y{11xQ*^A%TO1D+la^|PcV25! zc)c_r(L8S9F!v#Ym{xZ+SO{xli!*_0;ez+0nqN}f@&wYhA_lq#3Uk$2czgr7hMx;; zI5)ec5!pDjF{6WiO$<^lrb`EmfcX-Nn{EkieaH>ftwwGwu78GND4U18>Q-ibZ3$JQ zS!Lag6|3#B)=Yi}onU^#lR<^`^?6lLKvvHbRr4#K^$Oy>%AYkGA2n_>4oEZ`8cv=z zt(dH>Bqr^jCe*Jk434{%A<*L0EA*P8*|OupmJFOaV2*>c%uN-p&&VJ)KyM@Lq;V7u z!Bk{9K$Rf`j6&vP7_C-8rX`p+BzJr}y63KBKjZ2{F#GH4d zG>!Y6H`j@dj+lrI6FmKw<|p47we?a|*%rAu~ND+j5^A&0L-)SX%kH^%4&c7Te-rW5cs)+UHYr<8S%XwkxpKzIQio~2GjT6wu zZk}Uum67_|b%IkgMpOI>sc;pk;B~ZrN($}OtQVA|F(PTL28T1ITX^Y0N3$R}{pq`Q z>Eztf)OLVey}*|N_)`)ItL|tC=p5YJJSn34m9}Eo9!bldQ_y5uXWn_YRVnJT^ zKMML??CZ;j-sQcUgMtdr{K4WZtyAZ}y_G%?yi)EMsn$TG(Wjs8&i{U(I4sd2xbHb# z(0wSQH?DFi7XRHGSRAdPkkw{uAyEb5Z;EBsg+6h%omjE~NclutI(>U<@w+-a^(*PG zQQ?+_>_8(GMIkR4)t>&!= zSWh7ui)+q@Sx2-6R_p%O>bDbFukG5Tc=Y}ogGBzLE{#X|Vy20D2ZDxhvzT1Y*Nd_r zUV1)l2Fxf0(D@vLDM`Da(@EqX5BH5)bg@Gr((r0m81sqe*IY8$l(-2_oweBNUHEP4 z_E)7(SuoYACqv~56T_4o3ng<6Z4^~h^v>b*@KDl{hha0P{AZpMNTmqcv945p+)<~} zE8ryxDZ95;lD3VayYVlfusZEJbc8jbU$b|{XnAoeU>AV=h=GK^o2auVE~Sr{=o2tN z@Z-!|tVbw~NcdMisGL7!=D z*{| z75X_|fCnBOtP``3JY#`3)|po$0t&y|7VQE@sHA=pbn>>}2R)dEw{Y-=h1UDOkBfE# z09J2T`^ib)cV9Mjvk4TzI>p%49b5|^6f7SJZrrYb@0;zrX^+}h+ym|ph~jdndN9p? z8iDoY7hM*#&(4y{40xplh3@YgF4@b zE%jZpdfL*MxluV#HxW{7^<7V)Z}7ZeaZR>&G*7jJmh!*W5Sc6*87PMpCZ|V*irJQn zd(S|OoS)P2oMmE&7iamGeUkURo1m}vOU5tQ3R$uDbdWFvde|pK*e7K3C)7|dz{&K# z!{?>Gz9YV5gMV*taG>Eo10$c;w*wQ@KIgx2*b2Y3{%wKv2jeJ{S(_veI!QEi_Xf;b zNB=%d()3s^rrz`StLmsy&{Wr4u_BXnDUKtenN(z*|FO3aUmgAIMs`9c@G(Xe z5U$Mj9$SRrR4Yvelwja_X<46ul*r7{I_gg6_ZaP`rC!Fu2`kEPo7~A#yF?*TsKnvyF?ONlUR|V1PMN( zTV9^=BzXdfxx?ZSO`7-|l>+g~qy?QqW62rnxu1h$+V7UX#2^#!VvAgH)I(r%p1crL zcOfJOtTxeANz%#Ey&6YirQSRGalD~>5Rd0B0`r)yw*%!uwC}K{aOVzlSFFmDP=Yj_ zTp`?H8qu48f$5A~BP4tW48L8?0I1KKi;N8F{)T=W@!>pSRW^`wtfWyc5`Q!XQV2~X zycjN`S27Myh_iysUNmP>@pxxzk=Zzngdp@Z&0WziE&&ov=~PDH7II3w1sLVzaJ_?c z62^Dq@8!iYZ7@E+9=gJDm06%3(D-$dL?g$Q+s3efJSDsa@fVc|AHEm?X8yKO@`vBQ zjlbPhQWQ^Hmwc9LaZ}#oJ=7x9(&9sQlyY4%_(_r(1d_uW_-c6S~-wUamYYJDVVB1s;Bm(69wyxOU zKEfL5gOw{Tkr8bbCU(cO>9_UbP$H#2Rqp2sh%taTB$|M#3?6k9`7;;YNBoUnL)m18 zJ{0!5@Ht_Bu$oS6a`g6{zypD)L(n|=3%!LhKtW%TdrDz0!+#rgVEqG}mfNQC1Rb?V zDr`>0grQ)>sxS`A%>XYRQyB?OVhe@^j7Ug*7ajZ+(qHoD5mp`a?~qTD5IpoLEHKgb zKCD+&a1~4V@6W~tkkO}dG-j9sL)-~N{E7%9QC7n1^dLpa*r>26D-zfMq!rM9YZMqf zuno=>-4@sci8ON5fiXGxadUYkl z1ctDIN8ht6UBk=A%LbK^wxVIC?pORI+~@Y%V8r5CmD0h8*GL!fM?dFWi%Yo}=#pFyskxJ$2i9P&L=6ed z;gZL&lJeo8Z;n-lnM>G8gaUqG@=)Boo(QJbZZn?W-TH0+JKB3up6xYYyXQOtS}*U~ z3_d5CwLiPx|9x*IN~@jhja%g0`L&ZiJ4tnMO>|QGIp1S5dHuPVOYHtw?705&1y`^F z92}=VzpWUBhLZSFg-tD>g+UW|If_T0UGMna8*Y?RAX_m@Kp`i@4u}%eOT-wpC`PBc z2t^|V`vj(n8_jot24I>gR5;v#)1N#!*mWKP77LuXo1rFkq)KFxtrj$ejSLxo~W~1 z$HcT5$TfgoR*fMvdH(8i*`EEov6fu01CkwMqKM_ltt%&4(UFlE-C-yZ zT9XbfUZip##VRT{By$U%i%32ySO&d5>LP;%1%IGX6*Z}wOmpA`lBr=I^){#t5o(oO z23|ou>sZtJ%D1vaW z4i}E8%fpzTkj>A6QwJ5=Lu>{tA`X0gP7wSCT7tJ4U5nq7Srt+gqNlK63+bo6SU4YB zs1^1vL?)cPK%*fMaoDCHf}ixeqt}60yorX-ylT&}tkLzghhb4Zz{YVcVMgz|wy-7U zRo57DZGs6Ek3H;amHhW8X5x&Tpq_F_m`?qS91oJ_AT-Iy^^Y3H{MpKd*YWd%jiu3h#;J{q z^x2ndMN9wQ)6Z5qs>zP?>=>W<8H>v<^vk=Z9F7#9?InHhhn~|)v{D`KVL|>Ug3{my zrf1{&eX+^8+;CM4L4PnOY34CkZk*nCw+H;!QPEk;E{88*jKtn}GeY0M)M$&FzL?&< zXGQde>G~04{FS$lC09E~`<1nf2t%z8K7;{1#d&rSLA;2uA4+MgTDn`> z`cL}Zb~YJ+u49!$68p)z=26Tw5pit(ETD^9a1dhduRQB|4}XnEe8=IuJX@;yinVv- zGn;FJO7S2^lk^mTNv7*8xa!kj*XiK5`tbPd)L@6@&noyqa4h!_j2|&l-9`EnmrnMr zf74U&gGr#W@k?BI(w#hKHCAX zY@M!LS>W^}EqHNe!SdEw9Pu@_d;E3j(&!({y>y8&Z%${@cMDH1;s-Qy@;FD`*B+NZ zO$_$8t*=(^UiE=rs^*`_jMv1yI$MUc>U^0TyFI5jyRUbF_H;g*4@V{^-P8HP7rFJh zy2F6ulDPWfy>yJhBzP1aE&16LY|`DkmScvmbAh>|HAc>+1 zERGbL2j{cT~?yiDtDrT z!#!936b>1#x0^47B71L5>9k;_qKf_><~u+x$W`GG3LZUd{U49ZqMPOAezAXg*rC;W zURtj^&bb9LoDKG41CLGV;!e!{ncoMt7twddZYgbW%+^g;Hu^LB1LQdg0{I^Tmg@Pq zfv0Xq-kRk~B6sOq&W{0)mbaBvS^LhnrXMX{9o5nK3ekgu>9f&g*H{ZJ<6{r6M=`*D zfsV<1^vV7HQbQi`Jxg`Qf;oG3{m1XD{JcS{v!VUx!@(a)dh!L_GhBst;q{PMXS2;; zEyoW2+S$(>*^ZM~7sOWqj%nTBsszoaQ^3*MxUNUPU>~>)wwnGg?R#|Rx$!F(7eIeF9`wMegds2eAVFK*eR#ggl0REcu#r@0jLZV zH4~Z)&eIgEi7G7k)9R;dW*{Q~6YjH~_(o!$O@($pLeNUis zN5##>5Eih-V%6)XL1JaL{Q}9A{S>Y}8NL`yeT1~4?*$&u3*LKbZe;c0lVhmt-%2Zp zZ=vAJVnXkHxA{@Ry5%AqUKZ(&X)2*S(pr+AUS1+g}*WR15{`u#q{YGMNH@L)yVVlD-OC0dutmgai8CGMQ+d_4K z9`Cf0GgC$6;rXOY5S0I4uypn(i6fKD3jgM^XPlrm-;+1ynAB1d$?|(wgQDcqnI;3{ z8%Al8^~F&9L|en^Bsy}aw;?iT_hqZH6uLIwGBw_=Zi+ev+7QZho=y4IJF*kc%ajAe z=@x{{7d3}?{s7)nN0271Dd-IwKfL}upWK12hm%x@k70DLAR8zHllUgaQ`Sj+x*65* z?8TJ!qNn^~!+FJ@q>d$z#t$D%QWj$U85U8YziF<*b(&lV+)`EkS*p}poYY=moeG$a zcSwhhS`+f$#`DnJTA-{@Yk2iUb9JW6Vz?-7wk?7fq*aasI?HM$#1=Vve7|6p|S;e{8uH?Z^SJh z*yFRh2D{fH2V(nN+f0TAvn|?_@niio;!jpAaJ2BE`GN~`#+;#PTxhTcr$_3DLkH#Z zHBz!z{eWqS-Io`ntv<2qe=%1m%rnKm5`2@@MDiL2BHApAW#**DbdWAEgST*&bL~^M zIET1|rkd<`Fiv7jN_bW@jPs16tJSceWEGWNwX!6jDJ!zO_xdm{y$zeFhLza`8R9Qu zEL^tI>Vyv=lx-R6AR5mX1(^4C8L$YA{B^LYmVnR;hYd!A0xj41#Yx*KqcxMgKe7f^ zIGK7XHnkbf9T~ZbZ^wrB4FaTAsY)5&GuEmlik-B5-ukrK*Zq*&0{{@+oY7;>Z_!6J6e)peTus77OZiV8!j zp8^EBIJVb+8l`*%uKG@`J=1D*H@h;z{)lvk$U;V3tR$o;@E@75h|b=ShhDfion0K> zf45qfi@vg7P@KtV(NMe?*5<8^@!smSPj}?twd2YE(mJVB9z$d^<7~HSWwqs;O5-dn z_j8-i!Lm^L{HfJXTQXtQPg+vlUXr@ux(^^7O>C&&vNUUB^Vvc}y^Y?v5m(o*<;uk~ z!rbcAdX$RQUwB>0n-IT?%`lb*rrI71z|{VVkejG3g~fGaNHGTd z0-j|Eh$0_%x6%w}=Q)yLt&-95QmNZ?8y`>4dIv{Am!nXAHSPni;w&qS(;IwGEkF)Z z3Rp>9_1I+GYw}T}b6c9R_g% zN~21 z<~M9z&LM@YgO)6XY#V_JM|qgItZ-j}ek?*OL{iGfI&>8Q3qNFzw7zOHOyC*LG8Z!q z(+-pHI-BQ8=(#{kK^Ld|YyF=)o~#;TC!Kra zR-#qCZ>T?Ei+T8szKvi|J{8rEjG7Pox12*T)EIW*J~X1=JE7UuLjchv=vPqH!$eW zyeG&c8E zf%~k-(9`*oE&Up`;g1)Bq2 z+kifvPT|9qBop>VnaX&KpE$Apq;irR1Ac$)|K0h*o&1_|37}vnNo~HRPaqgsD(BIN zkbCMed9`I^(oR8$J$$3Jp13tHnWHxTOH_SnEJX9|;yxFUK2gawU~X61;;fKx&UuVGa(Aw!j1tx<*MXQpdY2;A-VN+rgjk-9tD z@A33=oy?u4JuN1+oogNUu4;wX;FTD=2rS9TfAl}ek2^Xy5AlgA6eQjok!{P#54C^uAdC_rPZ4Lvi7WxR0lJ0mo3a_y5}A&Pw~*kwxM$r#Hnd_ z{Cjr+@4m?0xJ}z^o2*zV-Wc`BkVfB{@QpuhSemuAl(-^i`qD6eQck?*N!Rs_lacHT zN|T9WHNrUqs?|9I+H4Kr;P~II=CF=z?ZpVv_LJr*iWkdaSI{>`1aj~WSzixv?0@w+ z@{Lj)FKr{3##-=EC91>XP@VU#PF#6+<4s~`G69KQw`3H;%f3Tnwh*jy8i`i-W1 zVPp>FM}gMZN-ecN*k`p@z+GB7=-DJCr3n;%CWrbbCGwoqHp1ZVMLs(;mZE%Z2ZPiobf zgSZzCYtY@?Wzg{bNcdIZi;DMD_j6ilZk{_C^3DFE&wjSqs6yw-SLVJJCdG{4Q@F$vqs)1Ul{>jB%qe&)C9!63YGrK+x zf*fTbDuVe$Oz2h>U9Z?4&EwTkJvZR%9v;x6kA=jFKt&kvJWd~!3?<6a?RMy=$@1MX zjS8$qtL>+@OXC>{?4zmr?k@}2k-i!Zy-u5E^=W(&v`0DC>rin{>u_#FXH^}B zWR5?{g)wH8cxh9z07>rLX`Q+VX~X zYV#>kahmXt6#rQCEIlnRn631fc5)&o^?DH%mSHpY>w<5;Q8iwkK+s4f#u!X}-&R>g z6x}k24<9N$JP4(OVq`8%sAU|;;?0eb4RMdiRk3+*R$v&Wsf=)9WzG(QOU>e0Of<)i zSYBk6aeC8F{|{T|6r@?SZ0oXZb=h{8U0t?q+pfQC+qP}nw#_cvw|B&OIQ!oFww_kZ zh!rbi%#k_1?4}vb@SlK+jVA<%Gg#BTVK|P5K^b3r9TP*k^RPeSVNSxG$l>01V<65c z(GY9Rdy3bP8ZJ0i_3tv_|Ei+mFr+ZR*r^@gal}^E7)^8qnfg2R6-+=IVISC#QG|pI zWJXhDLOgyg9U0^j)i|Lmn}LP(%1Kiz5p|;PKXaUOcf+Sp77|F4dBqMOq*m*F*G6jt z51g9q=rd-@H=dF&r)LvmW;`x!l#Sv~UJ6Zuw#y4x5FA6=5d)VwhCYshL1{;es&^(P zMfIC!R_H$-3qt7cycRj*cyUg2s@;(z6lKILX;;_>7Q5*%T&JI-m5d;W}FoM{#!orpyH6KE#iyQ!d1{ z9_g4`5pUxBNzt^6t2@QAAd7Qt7%J;dQ6Z0FGH^$_(wv5~BQjRu?_9#U)Q4Fn-ix^& zI(J?}B3FQWw+_}Hgf~yo-pffrd2^b+fydXI;#NB&nd4SeXFkFx}bZv9N={?v+U5McNgwZA#3KPW!bH#o--qUo$#e9An&Wa_oqV?14;xY>bUe z2OfY+9?PB0Qs$=jrMx?#nsY~TIw3*rsAv9)vIVCnL=Ex=wFQINTwu3DhA`JfquYb&g4)k`=#zEyrva** zY=U6#(DLrtc4$btfUH+H|M|ES)*oI_u@S&?7uyu9bu>@xO-H!D2t8zS%^w|YPe_B& zv@M!64-(Pq8zwTyOZp6-UZ0fT^=Vef$02X=4yVE0RU>(icwc03wk|r0BWop2d;Vd~ znZJ5I@yxY^9%2UKyw)>4jQzPYbr@}J678aQNsSRw<{A3S{)5DEuS1A z*P{#GQQLE4Z{3c`lrbWUGFc^r~5kso;^`y-ZH-OIjzgr;nZ2lwA{84 zKIfG-5hKSzaNC)*Hv4iSZ@%}M5n+76kj16BV9kxJVN46@5|`lMF7?NJIl7fDs~A= zqGGxx_U7)({8Nvbr7&qC#px;n05i^Vai{$wm-j88~jCYkM(Xa`i$H z366o1{&gzcvqNCT2g>pNkmar2eZKF6sBUTIFkzMeuiPf~;OBtD-C2%5cMWRi-&waP zwv>DetFVVt$Qd=5w+x-gF#rcr6Ba6dL|Z?*7*#=S;Yuf?`37 z(rd_0%tIFbVP4#^JUlE(+a!nQHG`inB|O3WdVpVGtzcyW(-6(`OmPoNBE|@|V_R3q z*KW4}RDj2JlY9r@7gXyXgdbyA3!%H0R6$D7qW!y<-NBo|Qy;HEAb}tOW98>RCt=Ox z4l@OFe_>9@U^J7&u`QF+3;60B|(*I;xu`4LvhSTW$&cpET zr`4wJGe2?2AvezWws4K)9L*83$1v0I>}zlW81*+8(8qpLn@LZ5%%Uo^ZL(;~J&Fc_ z?Q~yJ5yv5qs4)M1&`CRu)SsXIB<4^?W$~_w3Mm^gkFbnhC;1eS@|^Nt*zGPe3O7Or zgm;<^$pQZ5Kc8vSEG^gvj(NL%3G>8Gp&iMLIK{}Q^?H3QeSMwgVZxG#gK0wc&kY^M zPW;GZ@GXQ_I!?V{`~n*YgIoeUmSAbmk}w#+odc-toDuW^&_-3No;Vp~Fox)?KVI(-g1r;Lzy>f>&`f?P z=EB^2NcOzmxS{8HbnWDl8`e^_iWONHNHx^OVqNO--yE@o9Q#|3Owa=;2$ucEK)9lD zz}gJ#X|w|4p-r7bkuP~X&r(!XG;!_5{#W9p3v4*1rU9MBv;Y^lpin8 z_z?3-b_tVWumDcn(I_>t+{r%U?6?*&bYA1s(SNxCV^RG|2m@*TaD^Ygg4*fuRi1Wu1*Up>^&XkEq&FF1 zyGZ@KlRAxF9dVgkW4kAn>TXP0u{xHosQ)g@c0|8jvf~SOD>dl*csR&~q+D~>SxUlj z`>SM8Hf^t_?G}YOaaP0%d>>Kmi{T1+0Zt-XSJ`4*ogbZIvwdv5YJT5B&va)vbQicdD&!6is7ol7(dXUIvJ`N|5DMm@~~MDv#&AeTxqw8|Sj zT7;Qs@k=`7kb6$Uy2V2du;ry8kOH%jU@=#SW?h$dlknY#qqkWsL8{Czg-dKFC&Yqyn5 zcw?=fpsnP=3s@BrBEgApxz4TOw<=evITh>teMEOhdRC*vl9C_X^Yvi|zMQL* z)#beY;h*U_mT7s}Vf%PhB%t_~`i+!)k}G*R;dZCiq{dj8im{`%#t?HAo9^}G{>k{Z zgQa?*z1LC!nfMK*d6&vXTQ{!NR9gSai_seI_4#=K4gAHBQ4mHIy95r`It`m&5!eD) zrtwG4pxK_RJO~%yIlzFv)#Pl=>F*NGEMG+?(_pwfY!9KyRZm8l>%4;V1K3C~ON;yp znwEO&f)Ql;prBttWlBmx&kx@v@?}>d!6hx<9!9*r?^O!4Fk}4+z41jww9|Ar`}424 zFbXpOLWAXzvOren4G5}NiWPKk;<2kL{kx6Y^$oAP-R~N@>5r$#ccfxsYRCSl2&JB# zQPtLFtDC(6AEFgSQUzcwxwK z8EkipJr{}D)3s_0843ZW<$U_n!XLYJB_F2{x!>T&Oy#NmxL~NM7J(3y{{#Wk|5gOm zTGI_QE#o)37t|V`$nyev3+xrJOF zSk=Yj;ddcX1!UFl>HzFw~9e>awhVQBdGj#1<)co~|eQ6E?|#eA`iYVCcwZootxE zKMdHvw=Dc47xFIxMs~BT#|1ev`86C6R);t3iG?(R)q}rufA2|4gvBwI!v2Vvbz2W1 z#=6)pk-_N;yAvVG;L@JL^{ZFt0g$1*n^xkgN~kP<^tWoRU(kGN4rU|gdrdZW_2f`s zY%jKGLh@l=Ou0c7s}+BF%)($rFn<($X%x`*x0VLn72T4l*5WBf-vpB=nTt#3c);uC z;|>2F+@`s12C#`K5aNt(J)DK>1o9?KU^X)Rmgs|S7#k3YfJRhE`JP^4J( zmXk`bMAzw2xsiKz%5d&7Hjg;d=I;6X_@@26Rc8>(AjzZ$K}u41*X^-YaG+oqrUxJh zz4WN5*|5Ld4y3n5o7oXGrg$>j{(*stBG-nkVgs6hGr9zl74F4Kj2%rfaQN&Z=2sVE zwaSwAWtd2;rYvq2{Ets!w0VFfDK3s;5OQ(S*g@%Cs4A0YMx`pisx(B-;UXh}14nGh z2IPnWyI>X+U^L0RV*~S#OwqY8=Kug|gDi&tzIN=#c9i02dtET3&QSG2;@4nHg5h(S zB2IX#f%_;WqB=j^G_=sW<8S3y2Eu+G-}7O5cGsMf7aKas^=+Xb07|<*W3}|}(pvH< z7TXXYTKPAf;A}*qD*@a1TTOdlyw55Ovl3untn+83A>NawSmCbTN(pXXk{i%a>H=Lx zfmNf!UiQ?rBbjShOPTdyPMd9fIDLFRdxXVz={75D0d`tMu}-;a{IamkKG3rvJjE7G zp|383l0!3GQfmUNOgCT{9O`2^zVqO2IX}r6;k|dCRgI!a*KKr_zLjnYx~N|7(xJ3X zBT5|^ul~10H*nOK(OOJhX^q;^Cr>#DZlMuk@z>o@ zq%I{YZAao9n?YVWzBgMPvDZBTB?28ZO^603tTr}seAC~1gAg5f1s#BBcS5jD3@vCV zd?L0;pHhre!YPxLM4o?-CiM;RTwi^9m;!3HZd%H;Jrv_JRQhKM!*O~8Qr&3;+T^dd zj0g253OxA`4Y4B)giz}2>zA7lI4{@s_W5+h_5TY0O}xyk4>V>Tud;p zi(O|8nxUzid?8EWxZ}ho%0Z zTQnOSxyVios!E+}2-pg&O*v{3ykCp}2V&T0{k?oZFL~ndWF<=F9pKOs@2VZpOPwk< z|5FE1?v#$sr3)YnILLM}x+BilGb*Z6eX+P})Xz>o1ht9AJNUIL3*CC5qvxbpwbNDI zxMIwzVkE_jLMTa8179HF{iPj2-8v9?nvy=pyr~sq#)DTX#>?$1dCQg!gI*sfY|fkG z+kJw>5E`cf!+0VNwa?2GRK&cEAB2B7aT;Ohipsz{M+#uXX^*T|H#ymuJ*9>gn?&S3 z2_54*LqYaI2rD8yq*8r!&AG2*u0!1zMp(>5MS=)gv}@7uv;NeMD8AVBlg(UB@Ej)d73*of9`$8+uPFmJs z1o(G%&KlhAL{NXJVvPQ+njWC2UFsjFVXIYW3P??#)=`#R(9q6LVJI*1@p%xokX8*e zn=P<{u|DIXEli%jpzC5tMGh%`P~Kx;!%)6Ozz38w-|`eLGw0dUy*H3j#cVf^wJ>u! zUfy7bO@wYwfNCUCc)%N)vyN1p6cMpP-8@JHYBEgh`-W-Bi=p(DR+lFfOqh!DpEI0V zJ-Pflwe~>k8sK@2!%s9W}bg1~?{yYL&m%kbRwM9ShPf<-jm& zK$U;QAbwIvtWL)2ra!IkKrR$cGtp%#NC8G)@oA5v8SdX1Dx9Jm*?HePVE#~B*3>F) z+ar?bcoeDMvv&f`oB8HYl78g)ip8uq`SREjQX`l7GO;x~qPS%%^#K6Y`> z8knR*#<|HXIm_Dv@9BX3cX zn#XW22AIE~n|tbpt!;Y;b*p$ShyZ@A&46%cUw5?Hmz#ShcCPO#1V^uQP=H8wbFSDm zG`4T$hHghANkY2xN_GRoyvvUw#@{if(474y^eGNn_>`Qh5+_l-&%mBUPI!^Nyr7@} zoO_OZ5<_=K(m3c`^o+}w1DByJX@%eFBu5Wbb{cE`u(m}qk z+t+*jcEPBbtK1VmEY4>7U9k?H1y8Wj@;T zOogd}KfRqTB&`@U3@Z@qVhZ}$tLomQZ^N@L#Ow2t3GVA9UL0T{U;|isU|Ul4AZgnC z1Y+!JeZOMV+3Mxi^0|$amTWjA|8<|EIcnv7OdSdG6fYHYJ%w28S<$c%=+d0mN?!&| zIhIY%ek=Q$x1I}TdoK=Va4`PPb$6C+F=c6FHe?wyFZ)-&i`#|*ASA#vtC7cb5afJx z&T<7+r9}Wwrqd1By#+8)x!d##mvt+YguV;RbHWx*?(ue1Wfho9sr~hu>E029GEl$T z-C6)b9V!uQohc;kg>jhu+ITF?#c$h-Tj%@qy-G&D1rp9#6sDh`ZD23O_6O6^bh_JsHz zy1Kh!)w27zF!QSv>88>}u!RQ# zmvYGH?QUBk#0BV#OoZEFHW5C(?_pA1G>4yj59Sud%&*_ZDQ~qtVpJF=Tez zD@NIf47ESIO;78@)~~F!8@)c+bxsopg8=@eBv-SEGEi!>gL>t*Bk=&v-Yt?a(4TIj z#TKWfquZCYfH(e)ww&_+ARPXOsQvHB&d?GDm?O2H0+a&4%EtD;uR&Luoi!}2$kz{O zA0P!DIthLL5kM{fj8R$4qPck2#i8Ks*C&=NY)6TR%1QiESl=u?l;K}9-cAIT?>35w zK>*8p&wD2{BH2|vgMG8tkC*LBJ^oSxU&q7*;)$}7Sr;xUim1oL1)*ur_pYx8VM&0= zjHItP8EB7W^~}V+nLFT+4H|IwcVQF#+gkIW_VcYMS~h6qL1O=;$#5?lSg}5C;B-l} ze+K-!2E7_Kfx+1lM}WU%*y>x8L4*;RsR2oLC;{#h3t6IbasoX){yh?Vwl*h+fF&61 z`{}K9JcBZ+$&a?59FsUSR^3!q#}CjxnXKE3#`k)7S`%`AX_v^z)OH?QK*T`m{q555 zK&#F8`NqG{=MQcydG_Xjj%r|Sx&=qio{=%=n*tJ}|2JSz&NpH} z;}WaSt{6!sly6$ZpL&>Jl+P={aPAfHSO>b)EfA?syXrF z`fZ=rUr0btKF-L+SOY^(pAsj0KMF1v^konbmN?pqMO~VPIcB3x?NDhKX>mi=wKww$ zU=IdG&B6fUxtA9AEBUGSAOnz;L!e-VGMPo!i0g<)#Isx=pzedv=jqADOj2)61jSdm zIgz0LZ7XB-cO|2~TYsxwT57c>=dr~0mDV>@o{kK!sJm_lDkxVY?-9Ql#X~Q`#GFKJ z;k?5%N}m6!G>s2^ywODmI!PuO>f994--Zy9CMLS8vVpOnx`B-TND-hXZA!)Dh_-25 z3W$LOpM@vklA}vUD~SkdrMCb9wY9cRN7p+|Y@&MH|Ai?Oji3~tUeeQm!M&wU``Lo$ z-{T^cW(lXznj_3}xj+%Aeo6?Vr{O!uIptFBuoq7`B}<4~mi_#@zlm_+P<`#i4di&w zc-&eMBnMh|wZAzyhZg`lhPW+x(w(GUeVxQv1C%j!U)58VoSksqKqk+W+S~iH<^9Q9 zEJv2r$O*63CJ%2IL)Kf037fK#-CA);rtgCG-szM$KI^?0k4OVcPU6kb8 zJ=SbVpj%Cl;~8s)6bT?!5Yhjt6aOO^T&~TKP;vosKu-&yY)ZUJ1$=B+Ly&)*m$Cc} z09z$V-w1rVGY16KRm`)|P16Xmv5xfeg-3qE@egI&;2#CXX9{-DroWYVfBR^0tCAe84` z+O#`65vZ7>fr|&fvOoCgs$>9{o3|-M#s-{cPA^qfZ4KxZFsDphxc#3`x25*t; z1OLD^sWnrvOu&Z$%|yh^6cu$@H#Tz% z%Mw&y+V~+2OWJ-(p z|KNHJ(U`W%wC)uC+TS%Zr>0IgN6A2k8^x&?O74FUG%dBd?`|OPRWm(0(i`*SWp9@p`(LSH{mRFhc zaX%w|pr>wL!DaL$HhSDdzh1|n<1JNA)XD%4sV}XBPh||T63}cdNgdvPB8B&?LuzE) z@a(-6Fl>h^1)kph(;e#+a#nPiWcdNtkUqsu*$*aJNvm@91-~@n<$dsARsRu;3({rM zEz6Vcls* zA$;z_*n{g#TzY`ML*#jtC>N&}8@c2nmAx8q4Ea_`acLUB+HTZ_*j>)T4V-gdxr({9 zEe1{*9QnWt_6>A_-C!DlpBn*y%vjQxp8e^p^yk%C(}j<%i-4#Q_JO161oV+BIQ{#d z?fWvaA^4d`qt~fmgA9L{NbPIw0Aw4;Nu70Gl6S#0dJxs2Q!iem#H@3`xvlT3^(Xd< z;bB#jEyR=0SO1g^+@y0gdM_<-tH9Cu;H!Hg>^hgayx>-xV%$Wb#uWo}3A@XvC;K{+ z8i7@5E+GKFR3#JsZ6LwoT6#Ds(N8cza}l$txnGFx+EUL!Qd4@a7R7pKO20Y8D9@0w z*HKd8{hcMo_ACC>o`ox<^k0wVRE+;{$X(F;qQ! zBBEksO6o9o{JFOG^SJkK?ZVCfE9f|wIZ_=oLC63sod4D8?$(^Fd1yi2`42YKbZlP+ z42}VY^?!y5M@Jpmr-|1epSbZ5Y7=ZUDByixQ>TRyLY=-$ht69iWKe#}#|Mveket$b ze24vWZyzQv-d1DJLkX^milCUw&JX#rlh8HaCH&qrCQ!%~9nNik;oCQ;%!I-|UiSx{=G+CM7m|gfE9H)D0Z!FCb-9e z+Hxp0zMt3fk2kNP>Y(NlGG9f_sfpi558}Q3Mxb04NINqsXoRyWG?W$%NqqrBL}`t( zg)n4svc-k9Mc@_^>Y5Py&XkJ223h%QrW@F;VajL?;Ufy=fHc+zT{h_yCk7Z#A|Zc} zzoh0#j3Z4bNAcSzO=mrg6DU)PVJQ2B6SHF+I1R#19rY6V9LID{-6aV9P}TeJ7m=1p z0lU(lCk%f~7j+}DNSSZI*5t>99$!c$KhLHG=HHTw80#gb*(|$sWdBV~*o(Ade6j5t zW>Q38jjO({0a&{s!iUTd&@N_tt5i@Pu5xl-K8%=fn-r_BG^d8M0+hCYjFk@w(^sIA zfF5m}1u4)_rs@3-B|rX&jgFf}N^rqf{hW!$WRs>UK?jGZE2DhSb57siVh9iqv`uVJ z`s*~Uh|dTXBy0&eG!|3Aw{iEVU+~0IFg)0d1K5Pi01;2l39@kcBWA>6H_c&EG`?_W zlWD5jTT`;yt!Ieh=(g)3c_1DA)BLL?!2*Rc>?j>5a!soNk}#~tG@8fqH|@j%&9&B* z@%thn^TxI!4=!+ElrY(I?fTevC+IDi8gIihaRDr~CR6ntDE^ZvlwusWlUFj2L-eh> zEJe6q0J>l0`Vm<@*PQgvX#r)pIcny&8*fA@`kDe~$M-;SMW5`o2Noc>p!B%rUBWF7VNFAUT zUy!7Aj-7UzSrHg!a3FtY4oqoG%fIE##1Z6w0ScTTbRkzos_`@@6b@Je@X%;CtR*Qv z_eUAQ!59U;tFtivl|b9Q6L&>7`)GN!N&FX2L{iR#nRDEdf>6X69Td)mIOb@zFG0 zK!8jn1GQ9i0_)oEE#j*znUL};XC2*6YL|>Sg#o-b!6X6Tn`Awus93O!tJvU!(Q@#^ z<#=oF9wt7XvNXD?=vv770gdj#*Od^pbc+P~aDU&S$1D_{14x=HES&~=A_*xn2_ei( zwwtsnOQ?akCI!izIkoxa3zAq9K}F|!z^3GRWeL9(-R1Dnc_?BDl9Sp>@+0#?*V5)_o1ML>ocKl=VGAy)occPmv6_3f%(*5$xM z$7%%o;^jS8e5v8XzhU`(`140i8<>zZd);+MYjNBD$aS?K`%*pDUIOtrTSJmi80t7n z1noo|OeyL;R{QlW3}s>31Hhteij#|~_;kvprad@RG!kt#+MJvy-&G#9B8B5Fk4A%P znve32sXMT2Tr1PEOZed58;I($VHa$twdz>wAfHmly^sMKaUNr!o5y&R`^R4G4WNcT zn3a#Z&CN7%9L7Ozga#3_`9j?XZcVEjMr5 zyJT#VgyZNxaK~SJfPq=_nHHoqh@#A2`nj9dB?VXRe7mXG&B;-+z%p*8!A>oBRexMv z<4SUwe-A5OB?PtHZsMM!_OmZ6at~IE%PGC2s~r$RKHgV&dn_D6+eq8?8#^HySs7H% zONn31U3?j|aeksq2!YvN9S1Wv{T#QkL*cqywcPyxW5Hp%NbWe8ycXp|AUglSo!EtKfzDx6Z>tLokEIc8p1Q zmCGj`y+1@-o^;jCAlntdL9wnEGOY$W&vl35TNmjGogI=_tE#)FJZZG6tUPs#?QGS` zmU86DL!&)80cTL75R8$t@){6yd(mDXe**JRU+@Szn)IcSaFz^oGqf041jp!9^qePP zv?_cH;$jY9gSXBk;i-b39^xP%AM~qeuf88Zb zT`I_(dwePJkTrVGDM7^ao>D=2lvl8GoL#}nX;i+41BAFD09~bUkGjQ}_Q~#Q9xPig#FCf#Zad=HVtQC;+Kd0Vv3`4gCo` zeSF+s<~@LyRE41}DNS6JoC>j%N&4VX<4(}l6Xf%V1F`DEAU(;4#EcI;odvuRprPVj z{gY)V|CiCm!Sc^(BZDFXFfwxdm(!*`8FR>v)OAYp3ToJq$$*S?hD6xex5Iu%H`Z^Y z)ozT~nfmFQAs2~n@h^QD2aW+6O&UR)+R+hNG^FMa@`@NtvR{>2h*`?8bsHbsyORar z49n%m@+ahVM+?<}GcN+6h$GcR34I`704gI7!UPCl9b!XKu-@g=&bGt9-X=n)vJh~w z9*f!Hh${ePlmZ)_&K0~$G9}f@JK*8Rd+EM%(AC8t_Z-kNVeN*FD0xVyf?)}uDenPc z><}SJ5$3zuaEdYu)TX<0cCz|rD~r57+)9`qlLefNmDKf<^$!zqB@U7#a_20(p&$0? zAp$aCk{{HFk_n<;OR0}YZ@)0}tCLNY-@fhcI$u9AL^nJ?pX=MdFzOU=3RCw$sW}U@ z`chM#AzM(*326k=QDACt#& zcq0wHsm*nE_Hr|C{#AIpTGP_y-)=zGq<^lzMaf!@B;EWa?J~RjY_cUq@^F%@BWWwk z`K@=aJb}=s-suQ8Ov}w{k&U`Oopi4a)^M4pT;FLa56Q#d=O{6EjQxp>vyPh4wi>m% zX49@(?!dRE$-EAF?otVnJ5rQ#%85!}6>i$pgzcGlqqR#s8>rl-7(V*dE+c?}!)OBi z%zfP;2Znn$Y^|G6tB6@MXA;xbNtcZ{5+}wL2FX8WUG;j+wb0tY{k3cTzRqrKm+GO0 z7ao4_ma3(XGn2$d5lSVojURhw65WJjs?)kaBm=5f>~stsrDAs^lF~uK0`V9Wm+G12 zs{9YRsoa>K;X$QCgy4h(Gaul%H{{Z9ZMNa3;HAr~0TC_WU z$&1>*n15g#OFvao;Y^}Txd(lQ)>v!q4TKmWaH`&|<>H7~SLVZM?l(60?qpZl|L5Mu zn#z<0Oa@?L=J>A=*p+(sf9k_OC*Bj7iA7iu4R}!0ZxZ;N-T||yPHlm${h((2(v0I1 znMz9c#ulAW-P}assMOAvbMV?L^w%wcYYf+KceeNIV_ZbVSE3*M*x8rFJD|p`V zR-rTkNd~|ok7VjGNqC0&$~IiL3*jE4G1%$1N`x z2x8Mny|o^;pEwdgPLRP~299MdZ|nm?^vfl@N{x1QTqJ2*KE;##s9ycR15$R0IHDzR z!B*WsI-{e?m+-qeD;giLdPCYONi19WfX5+Q_d|oBXq`JEkV1xM^)cjMIz8ClU&pD{ z-v@c{HxrL?GR~XrmC88hC2Xd`fE8Du#SP3@5P7ycmLS|gHMozdYQ9K+Z9q1QzlweT zG$D&nk)&GuBYH4wqOd|EODA_B%}FJ>=ehePC5rE+2cb5A!Mq#L>nXdNFHC*lJ)ezO zY8+bWrzLMmN)lR9tHJWMU=4viHuNEKuP5>+Sbua zQ1`|lSobSQ{tO!3q2e-{ZNhV+KW4`X%)V=C``$Xj@DyYN9t4>jqW=*;1@0=~$25U6 zm1mlHbUCD`Ccp}?t&}2=c&N-Dqe7}U6Rjm5aPago*`yHi35>Zb->y(#Xhm%|p9Rf5 zDqeY^Xw6^Up2elva!b#GbC^v2350Eh{>Hr>{3u#FSbhC7^^`lN-R;mN99f$$q|-u0 zQVi5A*fE7dtq7`3B29}Q1BCXX}etaRd@Vl!ii3%`MA zQt#%dF)bnMv7w2oSBsDtELZ03+0AU-zGg;q{-HZ+S&CFoRkAqe%T1QWXnzn_s48fy z-;Ah&&BG3`ncWbue)r39OX_F@SLen%PdAYg|0RFss(n#-*b#RKswoNU(QP%S$Um_u zVn9|VY@8fF3ej$nNHRl-9kq}W2<@d8pcTwp3frP{Q^*&*z1z7Z=Ey*#(JYZCstsSB z2)5M}X}?8}ag3LRJ#{`MVA?#@v9xQq5f7v1B zp_h0K!++6k6Yibh46$EWN0NC$rZ8Fq7+vB%fkgW^fYqqlzvY;lY%m!2DL3($v__Db z$6svVy@nkrPaf8(Jr6YZkQ;5EEvy%yC{;r?2DV|srHS?i zh?Bv+a&HPT*|H^z=j*^t6D5Zn$FooLtIm4dXB^*wGZ8a5vspJadiHy$x`3@MfcsU? zkAz!a`YC?LYB{&RX~HG~7$`}{>V7Ncj9`vGpx1tney81!ITl*}pW(71uf0Yi9^HxYVoAne{0a;=rjoCqmH z5NLf}=%)rTifL-R71*F?uK(h8$<3;uC`@nf_ZHPTwtaAxjP;=rF($tPHl8-p)^Wx) zfOiNH;JuxMwB73}?OEE{8yQ4<`1)C_G{Sgg?EBsL(fr{p6`bz)bzkoBNizpg(p(Xq zE5HodLM%se1+od_oDiUK6^1?rQZvhJp9tw9FH13e-}y*=hcAl120jAb6+8>1;H>a; zOXHqS@C&6;L!Yg`zH9=?g#tmhv89X{pzt}~m5ZrpanD*Q_^D5=*fnStqHViY)Jiv&@$ zhXNF;BMYwRV90l9fU(pV7%qT?Y|3`1%v`n)r7kK0L*d@gtNTxta6_*yUO&tPfZ4zs zIFrqoL3J(xy7`EnS{{V5#^+fS`2^}TG3uRm%qsj+gvE2qgrO2XUO32N$`0IvJqLWq z#IbeJS+&0~whK#0PqmE6*gEp=4!^~Zijlj(Z@@a{!X#~u&xQv?MhSYP6DZq2+RN`x zES`GFfC>v!w@*sA*rPO8sHf@@V2X-Wa?K7!mx(CVawHK+Hp0tU1V+c1uv7wi^sjN~ z1C={x`GIf3U?H8gR<2lQ-HFX*Vk7voccw8@LWt?XmDZnuRaX5WctKsIor#u&SNyks zn;Nc`L$*dk>uhkv8OBMv`?rva zOh!@=JbxKuNSI>v@!>t`r0F9v)*7K!QtweE1F1kGGX2K0g5~sv+p)S2z2Ke;Bmho5 zpu))r4{Scu)`w8jJ(rEXmjLEEgCrjyNQyOVBL$Uu3cs{?@h2*m~L541{!rI>v zO}uLM$z#BGac1|ZKfH(uxPe<|nQWB*J??R@U50CQf6S-BMNe3GQ8rzkMq8@loiU@= zQZfQZ6uQyr08ypCmDEA}FL^u#8<6uvgB~JJ95>Ot%BDXaDQm|7Hzr*BWq7=|+QKhL zVOZS(Y(-NShX+jxiFMGm>e!!p=ClmwrZ#82nl-u8!J$cKVAt#k$V!}y!$Uf4C}D^w zr1)y?)1QskeqM!0N4Nk6(AC-BJH7wtDcvbw5ma+gY9b|4YW_V&!IqmWie=3)J@y%C z1p4qDaiT0kx@=szIre6nbp1V>W-%}7cw*jw^P1hVono;4^<}f7E7%q9Qyro zowMz=geyhku6a(2_XfRLWQmxaa;~^{XscJ=Zm8SuNkd84n1RjWrs3*_n^_Y# zv_~HN88VFnk3}l7h*p^IX1;2Eo_4^+0xAZ)SOK~5ZyQOHPlarvE%ukbZ5b106FRHm zovwWd3-&@Z#^%UA;}NJk@+L6k9JNJSKbk>EWjc%DZ_Q#bmX)o#1Vs&-dCoCP#<*iz z(NS$M#}rZC9ildEE_@X#?#G9n-w%}o^>Jp~$E(5bJeHXUU6m1}1UVJU&0_rFv@#X% z?q>4^0Nwr5%5Q<;Hl2Y@b15g^GNH|p^Fw9Gd3Ex$l5t;=mj_*mmzV1n@rL!k9kiz) z`{teID?S04&H#oD4Jpm_v*7FBr(wI&j_WS`ifzc9@Z_wj6RqpK3jAlX^{59J@9`;T z*%?tR($uc~VJ_b1iPv>|DU_?DG=zbUU`b}^>f`3-Ux?y6;u&zBz;h=*32gp~$GmK$ zrrX-ZiB5Kc=))ITzJgZP8(41N9cH3u87#o&bE<~lsPBXm4EaT6zUix z9jD7Rr2x#d_u>3UBeR`&K*56ZU=g9TA2|Yv+LLC%5O9Co$K&_lek^mIA><(Z z1fyR45O{q>G6Cp<*j=n+#O9!Bf|2^Hv#-SJ(=7E+vUk$dLWDsI7+3`Ou@zxBWlwqL zO#+#*Jz?~ElIHf>(2pnleC@;`V=OJ=iU;@$st@RG41nWN!H}al4Il?4dv9uVDvKQ8 z4+}b<(z`w+hk7DKv2}Y`+bl0~&1T<^$BTT0$Q*dYYy_c}Zko!W=~$b(p+X zMGQB{>5nWCKpuytAE)1uBzTY7gN6W{^1ep3y&KSd5_`hwTx84tVe6c_GmF-39owwf zwr$(C?Npq6so1t{Rcza~S+T8?y|2!0YyE&R+qjss%`x8I`_nIGfcRabEc$SzCB|G* zK5%aI0lRuwM;-{*jDuc4iIkxHg0K!OqP9Q_{+_*1c@p_mrT{{G;33~#6f-I$VB3PK zCLfSbEe22Y&$T$oep-6mc(EDz!0&KFsNiuh@yGzo-sf>}V-ylKL8|Kk)Lr_Jyl|zsG z;Ko4!IG30VxEuVg9vxd7m~MsHFzHg_q(`_a*`E(c^kT9l8OcTJ2u2gt3{yIfP>8!Z z0IX#}GGsESra`4-cRwCBp`!n6B)L43YGaw+C;_(eui5^F_5Dj^YE{&4gX+TPm5 zq2WO6r!kV2Dy=4uJhE zj$-SDYCE9J4>n?yRFgz(^`8wi#?FZR?86syF$)gEn8KTi0uEK;kZ$Dt0g2g-svxhj zGRLRvGJ_%`NuTBFS26(Knp`e($X*pZs*ioy^Y!P|fujsbSsYUp?<1u{Q zE@^x}TIm%CX?M&leAd(k3Vv&K06y*4RA(?E-OA)^W+1-2xO6(pyX`xy7Cz+)6kcP` z&QUkLls}8#{wjJ5#51nXL|i($Ta_#39w&&DCnww zFShK6>`1N9_`S2UuU1MSvH@JRaMJ1F)nB>q+?w(I?CdMysr8)NFeIim!?148uB-pp z15PQxnz-jM4a=MwE3_&}k`z?1pRBE!_?0bgosEv64bvSAHA^uq8qbG<{wLst3KtOS zofASG6cH+c4&hLIB)3Y&ZT>Y!MC!S)m?n|ZzqJy<}?Av{S8zTJa<|Syv3+uAeWh+GgaxQ)%Q)U zN16JYBdOvnBXhpX0!|$o3_MPhf;S5cR*!OEPIf_jpJ0I_S7Yj;>kPKRr?$guj$y-| z(^spw8|zP+3mgci+su;&!x5-{1bwc>YwMM|J76*L^ps=DdAqyA8e`z} z`4I$ka_W%;5ooYY-KAjW{Te6g^-{YsoS4)u^dz%&rN@c`N+Zzi! z;MkA9InPJ$2Edwt? zv=w&HUtC$jzE$(xLe%5SU5ccmbJUeJpYU7&yqrmA17<8>H#ys?QbiV$rIR0>#|G42 zTTaM=Djkr~lN!JarYfr@2nxgo_UiNgCZizy!egSUVps4_F>k*RbJ=Q|zz((6Mr2!a z6`3(7P~|k#9`3h>ABoaZ1T){p$6K^+4qDHk6ATk$v87t3r57ZrW2R-C-f7;-9Dz8Z z)CrqJ0wA1ZF^MX)&;8pLsAgNg_f&B|8nd+=cVK+$Qu=kgT5oGro~9?!dYbFcY;o^( zcl?7+&TK5Jbv(&UPpn;PiK`$sPSQk`BiqP9dWA$d8+4=Ftq@sClaL0 z!3l!ym^7Sl^VNOzzF^@i(4l!KxL+vpSDtgKoKSA5|CICBpTZZ#ME69`4$BgUO5b2$ z*r7Ih${0A7P5$ccT|veq28@aGy@y&y@si5S=9P;sRrczk)1OL$+KfL4>mhp2ibcCB z(g1Vv?A^nLWkwHu0vW9j?v-aT3hI46{Ez1I(eOuO?vo{gZr`V==N*1iLG;Erq`ARC z6H3+T)Hf%}A&Zp(GPQTFPHz|g$F6fS2yJ#;7tf^!KFPIf_+_p>DbK`&INH0h)8+U{ zf-YMIddc?KazC>KNAi_)s6x&2fk9i`6#(Jay8Kzgx#yNIuUIXTdP7Wq8c^c!EmLGB z|CPGm5BY<_qdHfulK<7`PIFN|1_yJ|6o)O0dS6) zCcr*U;ACi1$B_BjN!Q^u?+9VVJ%QSAR4-2HYk|akH1-DXnH3L*lN-mo^;!fL5ZXNP z1|#sg!b$O*SSDV#JxR*YXiU%9Z-~qLtb_OnMB8n}&14gD4@Xw;9C5}Rh@G^qP!KW+ zH#~q_=Z7UugomSu*|{~t8Ze!s1^{T2VmY%CBH}}Q@G4p`?1gA_UV=vD3}Tp!6LYL53c0j@KMCaCZKI!0sMR7 z^!tAQB(H&0=h@F&k-Ph(wBXSHd?~5c*L;ise>8e@~nL_lb8h&;F|3ldpGrR}kPeLf~Sf z+5FwjKWmJvRy(wPQ(E2qA(l>MR=>4R)N4!DNT~@qQek+e(C})7?{{&N*Hyw~bhN|F z=_AOf>U$d@D>UiX~ z>SG(o1aWA8CNHO;zA>-*n>EQ^zlQi|tnI$=1st_}c=st63}_K+%~bVK-19~IReE{o zh2Goa^|k+ynV7hMqjILqr!I6rRt9IS(<-K`d3Hb8iUfj^cl;0(~{Mo5#A8n8f`VN#gbT0UEeA%*5=11*$U%!=2 znoa(o-%GH;31FwEO#6G|T5)sk`Kh2;MPLzW^#~B)=kZjVhoz~GdxpQkN8jagrT`Ci zIxO&n$50^&$pj9T0$V&@%dq3LvP@g(Q6)Hu@XwE3XwF`QWyT9AXRCCR+gaQ?bnbe% zegC|}2$j^Kv5y2{DQ%q#7r#Is0lFt0@LASRK0#{q1<*F) zUdF8}1sDcKkMOHp^}O_vdvjutoj*S{^i8jWAM&2|D=? zrdKf*YO>|-|Fs`?o@NXcmHSmVoNe8x*Bl^v26X^iX0Hr*Uj~^E!3`!dwQ-zMjpOqV z{6xheLOKSul5IxPrVi|3a$w&Pr}ZK;x#S+E4IAR4pT_FbC(m9hJKoVht|Jpy_79VH z?ZKt^&#xrHsDst`nFG+Ou3*)B4TOK{a?g4Xc8ycO7hj5OyhZ)e;id{YuPSvo`!4PH zvGtZFw0@_2mRLLK*Jz&)h&BAfj|;J)1i%CXD{zqq+-~%t2MGnIewZOZix5S(B8BJ} zO4|PcCYaL{)xMI!O(=$mWUP~~T~$a=rVbp4QS=}c2|!7srLP#3M%pSP96(Y7`tl{f25t!mSN^n`U;Y;Lr^09jB0hVBa z-|IQgOV^~@EJH$EDkt29uYnHh$Iu#3D}1-37!;te2I|G!J&;5~?2cIUox*8oR@Ru^ zf!UuwE#X&UAKx}tM4bez5Ch$sOl)atQt1)Reoyx7bpi2<0 zqR0x}^B@;DjTwnri52`gG=Gl?0eme5@aQ@&dcy8 zM~9sqlsoeDHXjDk4Uk(BD=pANCm&T8R@TCW$vgu<*(NkR6K4NTj9LEM@qGUeuvcxklF171GOy`t`3T|S@ zNT*~`xV^NSGVf&DmB{k)vt#4sow9c(z$S+N@^k&}hUV(( z(wiT}faRW;CWY%fmqDV-%s7cP13OXPdX{GSjf!(l^?~ zoDBaaJ=mtr`90~76`a^woQ*~HfzPNE|`eW-GV_yq(EPV;* zV9EPm%h9o43y(%Fxi^P>Xdfwnqo*~2b%FP z(}xAs@XAh-%Ran#e>Z+#M@o$Y;85{%IC^p$g~a@a;rgOudU&%iW@1~bUL!HKGDTQ4 z2evdInJOtNJO8GPtBRld-r$0WpF8`}{1B#?3{?w(5e>Dl+;_D+HX#-IH|f~?UN2^L zGMp{X>@pXa0KQ90ElX-!h;ka)Q|BDfZ33n3e{yq$_EPij_{V7vpoP!pDlluz)jvG8 zwaa)n;nNp2``Ex%u3Y`WTdh0T);!Y@p z)#N|u(&y)hYE@y{>n@6rU`#nan<%397+3`g_`1DqJ@%3*&y+keUuSx@zb9=T*0)(d zNfc!<0zM9D7kv||e8njDmQs0%3xf_$bWkmm?>It(dA4bP1-<7VX@Q=hxEqJn@xB(y zehjh{7SC~k;W*xF>-mjqz*xOz+xTX2b;SDP1nxe&a;z>%_s52h3|x)8`WL%T+rRq5 zo-|_9;YijAIrFd^j%BM9ngy~sbJ#l49{MH00$!Tr8%#hZ=D*N}$HCbd?o@T?clj~r z2md^|m?AT^|pi-%ovDun5ql_ux%?I%-(@Wjv+5GYGrw^CxZAXB%BW zNZYUFENXV1uqC-#7)S6>?&*tjWR%&1lA($^OE?YjQEX}!aF?8o#n=!^S=y`m5{w#v zvc-Sr2_BxTHdXU<-#W)0#sD((HbO*fI@~C5-vG;ds-*u#9p+5^A$O1inAlnVf79KR z_C(A%JIdCK#y`l(y3qnjkPu8@XNEXEb1#lGv5gdS7A?}u55EZ0+hU0pTMqKR;M%Pu z)vA$l3bqgSUcyrXICXfphyK^SCmK4R(iwopjzBlOfDa3(PXE0FFM)pD_RLSNh0X;_+BU=vs=NV4~! zye^=VNxM!n$q(lGTs+M_hX!sR)aCC!g%?KAk^B@C2(k{_{dj*&f9&k%k3x)jfKLG~ zjEo{L5ADjBhnlyUM+Y3Xnile!_6Y}$=#@oQdlt>D`jL%GXvoDSSr~qRTdBmk7;L1d zoQI9*A}i+GDwT{Y)?OnPLq?Pr5lPDsDF)H||9gUK&2`ZO5^2}huA^Ro_A=j9Nra&Is z{pI%^*4d?^-Yp%ksXs(5LjpcaOa&bEHFFyX)cWyn{#-y}4_V3p!$tk{CACsp zBvhX`O#~>v72%*ry#GV!Xi@fzce_1(%Im(=F_AsmeGu+9!#fJ{R+U;i^2S5)qPS*)%2LT1ASK$8Vj)1fQ2!gYwt4V8uZ-@iICk4=k#GOa$ zQ}Xr`&~&i*@u~6E9b-L9pc{agFv!~3t%GBkA5o;aogI+x z+-X;u4=dY5Mux#OKk1aD@6Jz@ypR^=;mZN&*5Z66%ebE0IfknuVxK6R{Hqp!{>o=o z#LN79A2(5LW|qI=^~^h)m4Pgs=Y8`dACW)ZwmvJ%4uOQ$A~SgDN+Oi&JU<=bIH?Bj zQ2%6O@4CPzQdfXd@I3 zM0FUx4BVqd-$QS149QG3l)D;HEsl-~SWWzc<1G(D8WMMvtn^`vrAAyQKUNk}oET+` z{PQA%bm0YJ62Yy;$nV={60UfCU?`?Srh=QKGqY{k0d8pNB*c3?y(7)W=7ifSOMwUZ z76p_`kaSjg(Y1JoWjW|3F8c7bZtRO2yTpJ+YrGE98Te;g4rsw>TrDhe552SpzKwKt`TyV>#eU`EEHv!k`O>kbf10& z-xarL!8@g98CRqSnpzsn{lIPSIhq_Gw}IgJ(cunAms_?)7MUjNK?kw>lZXQ4J#hSR zBt`*~PMHsotwOy>zBcN?QbG5DAjJ=xko=2*E$kdqL-*m&l3 zJW6DwmOQN3e|?{1{Rwup*{)9~@3{1Q5nRcBOU{#-z`kJOd)9fB5VeuA+G&rv%mg~L zk)Z|9%?8`%{4lBlN>X-`AHkV}$d|9W#OOpLj9oh|4||{mlNLQALK+TK)R*z3qUM{> z3YUhRp1c<$c_fR}=o+8jD{yk9TYqZmkCZWI&3mRThquhIoL!X=&@Y8ldDGc=@3po6o(lMYmh#6+WeNvD1>xjO zjdy?|2XL|f9|qypk9BR69j^OX;{`E_`pgPAk_*ie8EiVrES&f?o`7lwVF%(D=~rN1WnTy3Fr#kwey>I6m%h)}9rwq_7y{uBEjDDu ziqromsR^6}R2s5!p39&dz#jnci6@kJOM;0pJjL%ZSV$YB!L|F~-ZR@*^g4`%ELKBf z#Y6n@goX_}V2cG4M=bY2J08Q=%8;Ck?nh>+LyRLj-6RlH;=o1;H_`?a)>(>Z4-4;K zFgp{O6>(Dx-Ity`J|`1H1G>K0f8l{i2IiQxjNwEUl95wEQm9_J?#%#LX8R2cG?2%0 zcOdcyEJFdX!upb(-`u}Wg7AK~e_OnmyxbvlHu=xNm1RH~nRXeqPc~`SfFkv^`Q@wD z5DNN5=V(J(jps-qJkgaP{)_{J$cdy2q1b=9ao2>LKdis^* z^^!!x^VS^$d1>Q10&W5Qz|$_h!&Xekd+Q@L?Sr>jmDw3$Vq9Aq0+VbvnP;JPkDq#v zR_k0RXUK4gfeGojrfkgS`b?^N9Bz9fjmhjo0!ckg?&$ZJH`Gf|tU+kv@grgQaB@T{+sFy}(ASqSakiM^HGUHE94^|-`rfnH$UFBI*LcE7rUD8L2wNCML9+t)!|*D}Sl}3hv>D=-y)yf1 zX1S1^1njw=mRx{-X~#>ahrY%V^w%(pmd=K_*KUPEgY)4@l`1!STUqk5Sr22b4m0?G z2UfRuw6Kv8Pmoexr))W@jjTQs6@8^UoCM>_Tp*LSCSwCHZ>Fl#ZH8`DyGK0x`M9C% zpC(GED9XRdtIogU-Hem$n)}xxQ z`N`~Nl3f5qaSpV0W%5mU6o_lc@Wc~l=Ix8gvEi-#2ihuZI7%!k`#0;10!vG(CL$7J zZC(1Z)9~JQK)p^x#^U8Ck@j-LbjGDr0-A33)hiLycEDvzVPZSw;;*7AFchXMY6vlf z718k?kWa%UkO;@ehpMbO?Mpd^FRzIN#&6|#}9D|PF6HZjaB-RLSw@?TnGm-pJ-%{(mLl3OEi@vSMEkUx`JUN&XdE8V2? z<|jfM4)vR@!h1qZcY(NGYz+0&O8O&JnT;b4${4zt3{4}aiT1S8nmUj9f_l!WZE72< zVKe~x@=%7)zugq{Dd4KpGfv{HTNTWb_NCoH@1TlHlQlaig2F0n?0`b4`gZkX2W9+~ATbIu-Igmk3fZ4*c)pc2$v(7sc_KPy-nafR1jufJqkP2ALGr^Y@0bIV~hc; z?JTtLQ`;tceHiWEQeQrCpBA9Gz-Vsd@@6z>P`wam?{;b1|Ck73Q`1@NhKhX(THJ4^ zvM0ML{K_R5Xj3IH@R71_I4_9`V9P!OvSBmC9^&q;6?ZRP`LT7_)zt9J9MglQ#C9^ z8D-M0p`8B}CGWs7^UAD{pQH-dhMku^l8bA;r1~Ud^t153cD%f#mvm zlnX$MANjzEO}SSYJTftqj<_B!*YHV%A<$wYt2Bn$@&l4YSi(B;LvZys*wmS_YP+q< z0imMl#w<$T&m4OgrB1F7)7+QvKdj>sCUFl$i)MFd8a9=uBx=DaEPB?mkK*p)xPy{U z0c_=^F19CZMjEWdt?tt-SQMt5hM${yY~Al0p$T1aF_~)b=RTl2$orUd*4(gR(!-b2YDK70V_20%CZmKETHSoz4Q4|ZnIl8c^c58kw%X_fl3@` zS>eX2fW$ge5znZgqK@-%G8&SlHp=PioE!rUYMGar=N^c{LLe(7tpK@gNnO7|w4>di z@oWJ7gI~zUu0YSVSJ=)sc2Gn!GOa6gA7&w(n_s>dn$lp zjj)PMij$KDPP`wu5o%Yd6Gr{T@a$&>!R%iFRvpyxCqGYeY&Qo=b!yIOx?7f0lq?Ar zU4ZeSmoq=7i%WerCyi{jY?>Oh|JQ=HnmWL|F8p8KyMRnC1Bxp<3@jz|R$h`Z4jR;~ z-^)9D)W)tb6A_RW0);o&08xcYTEA6ME7v(14=UJ(ni|HeWm$!Bt9a*TMMXV6AGWue zQcKl%{;Kcj{3a;Rbp5K)ZSnGlzG%0l-fu8`r=Z2FCosuFejEJsJjYMzlB^@08bg5D z^IL(6+ZNVWJXwjRv5g|11+upGNx3a0TpR+Kc?~%MUN6ld!Gt#YlN}eX zaS>YL!{=UU+6{B~pW&dIIopKxc4wKEMDc)V)Mwo^TWU?wN7>I_sy{A>LA7S>#@QLN zBrK=k`uQ5i9KXT7*&0T2=8x#!i4p*NPemtM2Y&b?pGX{Ppoi_Fo-JevSp=}Me!Yoi zs^VkX$h@@q7lkUEmAQhRtf;!R79Zd~NmOVn#96i@I${ct0f@tYBifeiBs2Y5Frs|U zC5yq#Yeq+%HAf<0rCrZYZpH`7p?R$Qul;Ax7o-opG6q}@5=Nk(HDJoMTZ zHrlaJ{dmFEQ*L$sbVKY6s)j)&)LMw>GVnzw8J(EDFIlJXdi1n%`HKIC|Pet?_i6G2l{HjKys|EhD z?ntV4Ksi3VHf0sErQ@D!!-H)j<5<|LVVNdR(#3X8pnNtBr87Xd+WVNb|3d=Zt$XN{ z7buY-wpW^WUR>KdziFFso-;_cx>bSiPHs$Vz{mIQp`W%Wpez|}J#!hkvk`!uz%76A zgUK0~hVj)llw}ls?ySvjTmata;x-L)A=ry|uB@p-!#sUDY@EAot&YLfzgU4c+&G|U zSgqB$WY!0>IRTgp-T8*=t|3Cznn@~`!pfx2g<0K-6Y{pOy!4(v}8z#jB z-IMgJXr8fuE7JaEZW&gN?eEs~I=s{WqEFQ@X6A-g=>UX}`D4ge%(U^wE4$5I;u#w^ zJfWyKEL#MWr?xSrnZJB}hm{kzCZ?H3^hn57P3jvnV_=$mJ{{FZDZ{jZZM&4DOX0{E zW@QZbFDs`~XC2Z-Wbhhy&qj8tQX;V9ey&YB;QJB;-NwXzEo;4lRcO2f`GTEEM8GX4 z&fKYsRRTJ^_yjI%^g<)$3I>{%3aAjg61RDE#nPQy^TN6MUn ztelZFc+jzxXAgSM?o_oC|Kv~R*p&K^4NGJqdIJ9CP0$uh1DE8ufhIqsbW4yeiy0+v z=!t0_h^op-i70ls5?-q#oyycE%m1dBsDt*V3E2*MjM&rdzMe8*h?$`Y(LWxJFbX;1 zRD)CE2KM(}mq3ID@OtoTD86)0S92jIp~L{tL7si*+Ai?M4Hur2hbLJlWc9mXf_GZ5 zDv##5r-zS}ZbfM9@E@l5G&uEFw#oS!I>rY;%SC+v*4dq=e zd%tka)T@tQPETJG0$-49h$2w`&Q6xc27N_xI;dhwcJ{y^=C%`r@6F0m3*m$v{D)qCNw`3V@(k^|%Ods6>r5p=SMC zxyC27r`A=WpCViL>mGq1(_v0w&vjPZLil+>D0%2L=1&h?oOHCRr+hYgRcGHxzhyS; zt9a-F&>PiG=VI<7JhVBnID3D(X38IY5n|8Z9WGRplAlshD>l6+E$P%~U-!4MLm8w= zjd@zCnVm#!cVT45i&$v@9)p{=^6@|c0B@sW*H;@u|)v8UKEW~dC5OeeK3=jAkv z6R4ov=uVq}eiOz7&GJb2@3`;kPkQUUVh9N0ps?7b%d4b<>0-frp4O1i3o6J^Wj27X zHV9TKt;%%E4HNtcrG20XEG>v#Ys66(TOu`9ylY0Q>dJd%vHd6sw^yt1I^(vw=)v!v zN0?(uR#tyB68C@@J6lhZNMEcfEytq*#hoD%>>@WnZErkY8AuZtAtBimo1TL&s+NB> z!n$#rkY2AIINKhX>7Pk0sw#W?>p4Pyta@T;Q_x95hMt{un1F?sv8DF~^npM6l~m{B zS^nb`14-{W5fxFGb1(EX85h5;l9zx=E@>~>F|7XT7HtLtMFnsge}KdVtiLdKu$zE) z7-PZ#;?ub_A*m+N5JwLsQy!Wg88c;cSU5@w7dQHG@o`e<)VG3C4dT|>KUv;ABvrS4 z=@vwk_1r*Zj15in@SzI&bo6G zNWy0hq54a`U$Z#Bku-hP{&9^zDN8C_C5ZR|Xy9nBI|dw0eQDtMWT+-fz?|282a$Dp z-0^0Q&JCHgVbc3;#xAsh##W42P(JNf1!4aMY~Zj%z?DRQN;l0cMZmNrd6Qk_EzJSZ zF>ez?8B^xfC)7N5Z8;;NCwRG+RUP>))xGxzzHH&(lXNVyI%t%iBtske`8|{x^d|rT z#7^gHu<1}(Yrtk6mKHMpV0xejI)d{KgM8IlaLx2~98AIP%UPO0X*@xj?lS)FFcDG8 zk9|^CX!?7g-DSOtRNAeI9KF&XbX_uKv5aG|`{a&B4uRaX&)Kr=<;@OUCPBI4b2jbW z?g=x;N@r%rCC8M+Z(@T(a}(PIJlaJHfM<#bHFS3qSqUPD7Ldji$u&Vcpjd8gdL71T zfX_rF5*_kt299?pMRNY^i!#kU1ze6+P{?3Ge{Ozc&69dlYJB?QrgX=FK;3oaI&>Ok9XF}5eHaDjNreUguqbAC zjdDcRGK2qU+tv?J6G<=dOPpB z$Cb)sheA_Ik2?!mtK`GLR7CkYY8`@vqrya?>x)=1bU2%Y?;vf%qHoayT8$-~S}5`m z-9-_(!D^D@GA^!V2RYOCIZFpoeF}VA&O_9MFP2#UmIEnuR;SooEY}NUldP`$Z_x(~ z+;iFpRy5gyKbd$7t$_QA^jVNf)Y9Jm3Pm1HSJ%reZl<&aDl;8xscwVDh@$K1DK)!_V*`dR=x3Qh&np6=b z_0ffRdK;N2_i*Df?z%Sb1zKQiiayTC_aO$5H_DZ-incpE=jk|IArI=o4tsrCJ5@bCPuQ}Zy5*g?FCu6Z3Qp`A-g?RaQznV+q_2hN{oaLer?=?}RMmV~X zr)@X2z2pvM$lngmnoJZ_S6XR-uK3Ma{oUD;LQpamc~gwl5P?}M_C~O>kSh^pZVu8n zKL6fENfRIPkN!dLgMNF$XpeO$oHs632<*anaBOpSm|7)xhhEf8?Wj9dyPO@QL~&rL z;G^`L{o9*w%EcRq;<#6F$+T0Gh+mT3mUB5?Z7J2c zR%wnHrK87NLN*i$OROf_N5MGRJqv@aN2#fae4GDq5L-mCO^vyE83|U~{~*RGN1ibJqU|(;H*TB$xQ!sR#esxowPp}Y zA<}!9@f0-WOvnXsB-)!^s|fPk7izz9y&Dy=A?Z2<5&gyFr-vs~FdVVDHMbb*XIABZ z$QsP@#msRt1K6)3?RAARpG_Wv#gbtBwtGP3DP5Hw$d)e(qRNJ2eZsGZV_DrFOTO7s zXE_GWlfL(pNXQtT93JCg$GX(72WKH-D;+6Ndh@_Q_(&Re`;qqi+Z}ZS4QD_cV<;c4!Iw z%FfpVK%&~R=|7*u$-$N?s0v8}%E-)^nEww4z{bV+f1;^NdOL|5>2bpA>95XqgznG^jmV(_yv#$ft){UrucTADO$ z*ad>Qtr8XeP70~6d(#}5AS4isr!W?HTNkh=a9$%Kc)-svJ$Gb&#e!_W!d@8=r$8b` z1&w_(=$5A8v>6Mk`3!Vn^{rYm*mOC8Ymf8u92xWnC#<$6rvQ!C3sT>}7_0HFVL0cS ze>AZvd0%qIz`Uy_G2km{we_t5IJ9*DvU!`g)lcp6EaaEa;$y(4C|ABf;v`*a?N=x#&A2go0Db9${1`%UCv}#z&o45?_?HV-BhN`FJ1n@WJ zI~jg~wZi;k!pN5irbukHR8RnB3+`*N%ttJ=q?Qbc8rJj;=ahHm?BCIMg5G)I75*3h4u0wG5t^<_U4MLCtKztyJdPx{(9wHM4 zbL#vFf>}iE5S(F7z~o3ZC0i3Lhlvae4w<+7Wr_*4ouIHx;RxqM6^i9yKoHT2)dqp` zQYfLJGl~$x#%2dm`AWCj2)78snK*+KJ+iq&e!&1jL;xlcWgKAzKzj3CikQ7g-NF4p zHYMb$5C9Eoz7|oHg&VGa)Tr(-2!E6ENcn(8;(2c|`NRW+pc#Ttt)tCzO_a%wGjsd_ zMU3UJj8R~TC{m2J#-pyFUWvTWV4@lYavYQo& zxsNnnD#XzsvZTomnANZ)3Woz^UO!DQgu9RlxB!Iasn1b*Bv%4SDFGU`QjB*gUSHp5~Xg-GywHHVZrJXS#1}hL^?g6X} z00s>&y$P8OR4#7|rbY<-$14y*F!3--1YA<1!j&QCJR!=F5?IT4t$;j7Cuam=Ic2tN zk*P#VxD@5LKN>7ZIXr?K;omeR2SxC-+@O`YfZ+5(a<4#r`JcTuc`Qd-u8XSb_S;f? z!Za)Mh9g2MgZs(LMgRCnK(q50i3WWEiZF_J;fk{`n&^67zv$xhi*f2iOE&Vn|4PEp z)(jDR)%iU8L``tWEg(#EELi9D_*Gk|dbNCP+yP*3r#L1A z7y!C{9Qxia-47G758pl4A$zOeC(dnG9c(rgeuf)QPM*BgZ%4krFH#lJVY_$%cpM-A zj{Gk~-mBDB{4WHvUR+A6WWx}0IY)8pIqQk2j}eZY4;}r+PbV$s?!k;3Y|53YpcsD? zV^*SK!$!eBZCILIKLiosW#nphIBtJgX7M|Ozoyb1wFpAU8GpQXBaU54^& znC!cPXGbgJ5bIdt%`c-6>nSE zlphxR3wPWu-{=tl2Hl@up+_Arewtq%P#Z5>uLm3VBe5JN%qFQuYvme6jI73Ly$;5v zdR|kzioGs%a9*D_1LIsIEUW7YQnWMT$&-es{lXJLm@T3m+HNk$^jKN|9}=rQTgG3% zI7+KsChWttnTKUOzR5li(7o!(x&2Q(!2J9ZV`r(VNZIbPo0E=3d%jKR!7q0R&I zrG}NgpWiU?(pAF&otMZ|&v5kTnBwi#AzM~M%a=y4mkJJF=dspIgN}C3Bdu4ddLG*N z!UBW#Z50Fj)NY%bGq*frl&TQ!@!^N<+)qPxD{{a3XM-R4-Kru01HLGAavl0tAtG|Z zB~2PGWiP59VrEjs>5T^KB$oI#`$3r9dE)!gJaKI>j~fdWHOoe2>m>$Xk0TxK7guyq zFx`qrXC?_0Shx~I@KEwX$vCn5rLFMiCr4Ww4{8AXgL1?Y6f+XROr~_ z{Z=k%J1je!D3{u5!_D(r_~N293GrS9DwiQ?p7h^J$`9A#l4KeaXRU1o zL7pQ)#o6J2gt?dqr4TA5%JR{*4lKz}N(wWYPzRqYU*^K=UD}Kfkw`k(iVMEjL@roPXEk| z`w3f+UeHqpCjn~vH+UL6G5B~SH(KG7L}1kXL-_5 ziJVx_FJhg-_Khi$@v#qXPYG&09sI0c6;v}?ZBzK{)rM!6YS_Nm-&edoFoKcpLljZE z$mK9jF=;lD)j^sl_B9?AkNx?l;8StQRqDm0>1Bi9Z+X=7rT6-bk&kBv?E}I4IIaN= z-BB~`3{Gy; zk*Cq1;~$c{ADQsZM=T(?;bVoI`Qi0$4c}K}c`KE=_Zd%d&m$*?QSvCoMck|dQIemi zahdRuUe@i*wHREV?2qX> z5F_Ecs+B&#a-AgeK+;6aC|i(Cq{thrRaRa_2X;oVS**nmqH{e*95s<73$D>grPleuLq$g&po z1Hsh~MW5{4t#7Kk+y<@Vg=H!^HnTN;qo$IH(-Hp~~A{tjW+gb3)kZw%W2K=BYTVRPx{=K|PO)Xk`_EE|A}h z;||OgY1$c&D;k6NMtC4rz`lGrY4oK*x$spQb1YI6C z_3Uh1gT$Vuwsp3EYK`?hdAhXgY=Yq@KG6*}bh#4M)LytG7oofp4qEvLP*{y-1(oy& zCYN@7VG*qEYi`)^+sH9qkfV5*uo7XFu>q?85tX9;H8QmSr+iK#$rg?9AbX49gsP%; zD(&5UJSCdeQj$U?+fg`9~KH2_RN zJ(WYDy)CfZp(yJ4MDFtN(7#^C+E7xigl1a{m(!;E>yk^)+U$x|d0DvAGJQWKL`ozy zHy$)OSdratA(7Nowd}j3wy}^s&0xCVFE(cClw|9XXjJ=~D_uWTT&tAci5$PlOrk({ zglDk|IoEcfcdO|hb_kHSHu_I#542_8aC9PY$nmt8o?e?wGV8_snD&k z(o&SpJ8hKXZPz_y>uS3!geyBjyPA;V+%W^gBSdOgot!E(kO zU$YLqFzsO{CSfEbc`WKo%G)gZj{mk$h(zmA%sPq(N^^qhE$}Y~%aEX|HiP~tkYlxl zitR9Re!%dhc-DsQ_t=h)g5>UcqI#6KPK8PwP(<8QbccN1>3cp5A z?l7=@I=W|DO(a;t`a#!Bu0=dKpKOEwwlO25mhdK54W#BB=>@{+Z9Una@o;2uP0BXA zC@09&E2t*Ak zS=?i$hFlw!3>gX;^~mgqAkh=`vd7#?8-Ux?{#9{xE~gKb@h z3YNn}GEF;5DDA1!7=Oc8WqQ}tbT zgKftBTu%jI=t)K9GH}L$3W>Vu;JoUs0XD9nmSO{iFNcj2S-Fxaz0lZYS6$IhW3>EH zRP(ycD7;6dNpTB07BNVZ3wmt;hAw|2<%ALiALY23^+b za-yT#fCF>r7R9|~Bu`|*+1&I^j=*7W8o8)6rx%ma%5uyxe5<*X)Lr|ll~64_-`9#b zLt5tq{bI^$KbNq|7kW#Py&A;J1 z5m@lgnFoX`s?th}MS5hun6FISa-?{|QdS^f=}L5E#A+YZrB8mTm5p_x`|o)M`ok0z zOdRO>pr{Z0{pKv(o>T{n;go!PrJ$-WUucCB9;+zhsxn81(rd$3NLX0C=SFVlsTXWh zxN2=_A}LMEA9Gb?9hGsEyoCq@z=BlmI`9%q)+xOM-Q+hy)ERGx3xmTSTbHk-$bajo z%Cee!%(Q6>VBEuB#4dQ2+n#sZIN48`N@~X!yNHJszXTdggrJmMGAdh1cZ+U{eiJjVI^p#Z)yR1`XP%oq#SwG%2s!;G zamHCoH4G--CQ)y$Ve1#&r|obC0R3kUp5D%wCXvX()Z;oNE`5<|pa5^P%8p?365YF= z@*zVV)q74^CPh6E@aOXm0A>5m1&jb{9zmxGrj_ALv(x0Abj);QDCKQy4BhiFUWqW5 zP=6|0P_6}_?*Bf>vT9B+=OH-j1D*cDt$I7IUmNDmvKpA@#Uit9we)%fPm(z11IO-i z_(n-%V(cgTo2(C>OrW{(tfspg#a*PAKQ|gsV7q?72A))+&EPE08avn)0bFS29~+4I zoso%7Sfy5eKJNJgG^FxRnH*$Keh54gwl(_XphzYw_B}D1Q74}g462vK6m$#=FM0~Y z9|T+H@PboWZVUF>c{h%nGiiAi3`kb)nW^TkNBJ3NAIA3P5z3xl>8XRw%;sEv=`Z)%nlRy~@rkF(AkhYFvd)coKCqQ!0Khu zjUK@%R!Et>PiEEJ&Lo_GJD&+?H_WNx)b$rw;L$sfb&CW z21CoA?+da}}$35s#Y-ZYy1e9OG5t1Q*Hi=^kLI4vLu?i7G?hzMXer+W!=O zi92)t@;;=ecTjHI4T!z2s((zXq5%4u{wzHb4ag9@bSB`@%vWfon~t`x)9Rim`TV%p z9jvWES~9)f&TRgO)#`reg|Af2;g4$Tx~_~^=jetQSWGdLusZrcNc2Ez5JcEeY09}M z{KMj5gpJ&~8PVweOKKp`#5Y}I1&39ce2Px|T4N$7K}LDj4d~caBhdJ!PkF~9Tz@xo zt}s(y3(t9WKi*v;oz=V6phQ(>o4bE@U(t;mi$`|1yvH>C-f_1MiOJpU^1#AdZ`*Yi zdP$b_{9%{KoRp^W1^g1*e(%()KD(roVHsq37-dZ%T6q#9w^ImfU-jWg&``wh>lW^` z@$Rg9ic)kf07m4^94#4gQQF6|W<`>-ZvcEgd_)+z8`Te?+*h`d6bho;)fPS^WEhub z7v6q2>nvR!H20sKN9*UtQkp8r`nE;wgsHGDHsn>cI(t>Jxoi#}DJb|_DpW;;$chh6 zJlHL;jfRR{WP()8FIW-fSdFHFQ%UlYDXUA@F)>(^&a=CZt(Ej2ad0sby&ww~mi zGM0Z4v3A&g{QnVmW@fguxe71}a1Jikw(ror93n@W5gdew+jXF;tKob6V{$S*PKFp2URaH7PN zgW>xf@*9D0QN%hFs%MtY#}sqafp0bBpkR28NLHKru!t7{c;aR6KyD#_=-b z)M2O|!qT$qNtpW($ZB?Lim6*a8>Q!9C6b}zKwqxnrR!j#G`bqddwMgBMdC6cB{rbu zL4rX>W-dn`JP)hjMGOx|KP93Wf-!e<5IR=Dte0s%n6j5?kv*4;Un`&X zaZnRSKn;#pGXUO9D_(y+1OuNRZP=|oa01H>SPzC^2Z#^(*&v@!&pZ~u^gtGY3u{8v z;=lss_pn@%PmZ&lVQ9e8)+CCW5 z2kO5ZKv^K-FNjRCD&44PgbZB*+8~?>l8i7Bw9ALIe!y>mNpFb6U`kao*A6R+Z9VA< zG-QAtff3}J_r3}w3tflBbZKJC+@*qsg{7VaKZ;c}`k{pjNEed45ns(`_D}WvNk%70 zhY-gWiw$u#&HsACsApvPNSGj$h^ayY{qslZi646?_Bt+T*x*B zrGOO|ux99#`D$8X=q!gYJ=8r$M87Klee#FL-?xG) z=jM{Naq}pKr7#@59di(x7Umx+u(@FgM)Lv*iP*$ODE{6Ko>aaoVv$bGu`*!#FcvyK zFuVFbh4lTSK-%NWe+p?ADAEKpDpIN4sEQP6{cQi4&o#%I zJl{VU$TXNA7{tEU$knmXZ+s>^2;4)7ssM9@E5XG0F-QNsa6*VLgK;VnN40b!3`T`R z0iKXYNPjk%<#6gG2jg_j2DA5=$qsvOSRxloPD<(|%#)pVb;vOThA<&TOny zYQk_q^M-UV`Ih=ZfGAi@X9;c9`t;O9bGig(B$d@&6cx?HVm4Ri^WCr$lq+eYTQ;!T zm?JKJ8MIPfnW1ELkO^!}6;LV@VLwQx1R{hlf40)KKv*)g253YDP}ZtFCv>JJ#C#gV zqd|0aQ@tw)->0q}JzuZQS6~&*PXzQ&QALG=`S7~_KhmnjT(;kvr}H{ z*MYh>1D9NwO#AsWI=VmHGsx1&{47OFJAMDY@{Uk0*6SwSR2HEIeghv(HBrgXoF7EM%oq!EUU$&E>&dQsQvZN0y_?$(aef0a??? zA4=7kR(8i|=XE1V|A5a~3R&jBuG22oR`FM=uRq96GxYjOb(2|zoxEimmI_vPQwd>t zTe*2r?{@<$y*_tPd(Z@Qjm1{YU+Bib zh7blMuRH!^qkLnvm(q7twj0#`>EIZoK%cC){)4#D*-d}m_yyF>Zn6yq;AYH$@$g!2 zG}?OjX6MRSWIlnTD_fv@aiOV0WSEFEIm-ulZB<_p#_9vg<>qTmlA{8XFYv-$4X!3S zX@4gx|7J~%X@mio4h5&{bn58{V7j)g?Oe8r(`Iug#vGZ-cg-t_L|%q_yZOO%?bnLE zICcilyD@8~Jpu2@jzNfRVUEx)Bo&;Ub(RG&zNQ+)_bj6lsI$YT={I|OtFjm$opxT` zJQp}NoR6$B5t|Vb&~c2A02@^{5=|u8be*oQ-_g59oOLSk3(NZyt9OL@Utg;=k!R8N z(H;`-@?%sGlyGp`n17=|506VX=s5kN`tPXlXRHp3L4eB8xkhc`I_waH=y6$ce_2QO zi2l92_sVISLlb7##5&DUaHur9Ofz7Oi2sVDpv^;$S*9Id73N6kn)<`2)pna@?7DLK zbXj{>=2Eofs;QchuZShd9b0-C?b4<7>Smxe?ey5bZjgp#;jMf{l})BGmV&3QB{KJ& zrPhtNt_9@3NbCm$ygm76JJ1Y`k8S==p&!}HZaQyjrFCYs?xY2f22|E{2x&vZ=md*akF@attv znx>jo#E6A}nlg5Vs46ht`qNgyw0itdKolVHNK=n<8Z=FIpOCqkR{<< ziCe|lzeE$i0x_35eGHzsd5d<0*@{@h;F3GcXuAOSG-6ZIGV%X!Zr>s4)+3#P`&{EErFIY%8=;j zONV2r^Nd*&Dkc-ty8=zl*M+s}{F)w^wj(A6I7->|dTxz1#!sF#k%PuKg8oEqB%tHw zreV!fjmB7$cZK8rE}}7YBXMGXZp33*>D6tZ3o`BzIQy5*Mzz4(S6Wry=bnN_-iIjg z@xHbFv5!dK4`1IeSD}We@(#RA{u!z4f~`FUdK}P;j6&RSMO0B|XmIBc$54HJwt z%b!CaA%03$<0aLTrPtZ3`R@DtP@<{yvALB}_Rc~7P!BAEUPs+)CJ`>lcx>G%bBi$& zL5B}h2J>ulhFgB^WjyQcuM*s-vbwXtedc8YIRE{`g(WqIfBRBy-cpe4ock-5xJH#S zXat&PK-Kr;3T!3|xrUC00oKx)z9dGmrkc}DBm7y-_P(~$S^gpg1e^t$;EfE?7bY3| z-Fg{pV!5t8TJ!?Av$(@9Jc@Ur$zBdP3 z;&d`0vI=>+#8orRyuwqgf=Z)DQ7)qkFW1N3+E0%n`Ea!qaMo=}fsjkM`2T3fSSQW9 z)5|B9^gLB4WU1V0)rla`QV~u=on@CXr+ZP~K31t^DA)lICdX+P3#0#TZg$2~ewkvY zH4_Q32q@1%vj}%-@t=qMQb~as(F}F*BfqCB=0LOiEutc0mN<=V`+VqzwXgl_PtRI- z#_Yq{%SCz*K2+$GEe9TDU8sXP;bSwEFYfg5ST$ zqO-R$^EO_E-iVGqKGUnyS7+dcvFx9J6;e;x&`eXzdbsYPFO35i?Q{RS_yK{nmY=Q- zxl>u{&1qnl=3`gR0ryjly^LLr6_od-9n&{8?Q8cob-uozHbA{&vWTg;it$Y*eB3{I zS@?DXm6EB&YZA|xN<-7^`@h$e-W#dk<1dskR<=y<*yK?Ge~z*0%6$@d0$1e-?tvM@ z$vJ|b&p&pE@=v;Gd@j#V7p-9T;BENaQEx2z?CpK|b2tHTy$!~GyW1*LPZ|d77Q{Nq z@Ky^)c$&=~y1;FWI7wMpLXslpfmEyE{rlq;KkL>!AMYJDTVU>JBrUX$iQ>EfBzOF> z*~BXMP@MM;rt}p;2dqyLPbpx*Iz+5;O}OZCD-z`0>1dL~Sn8H#AMfY#qnXySMa8R$ zJiTpEFw=e6;uB%UJSX5-BZYC@**%n1*+(xe$y7Ux73gVhk)4%wcJJq|;U}PwM3{hv z+6L+6cVfN2PQe|M1`(rl^fTQh@~EFvDyfz*FSW|tH@XkusFa&bhV_Vra`+?T8_=z8 z!__rc?nF1#etaG*&RZ=q+A<*X{>Du0n^~QqW48oZ3I9eUvbl8D+pW8{3uDAQ>)vGv zl+mXQ0odox%&RZh-20xM+n2OQcjakp-ArLG@yGazZ5;z36=~*fwv=;>9NXw9{7%UX zjI{r!`I=gnm{S(tT)=xo2xl4)daXZ0yBhlB`pz(}EWXaw2xTJQ++@1>3i`fk7F1p`Pj~|hL zPf3Wh)1&|V-YSpv=VV!8ldQM=1;J2sefexnEm?GaE?s=mQVR<@IM;0MYuP8WFL|T! z+RyVj%)I4e6$|~W@4e%BBl>XX^Yd)S!71Kv)ZtFFDBAT#pZwYx-4Z?fLBMCqc;{}_ z9rzK9yIxEg3zmisO=IY({8Oo)VoceQ&Y34wL^R={SSh~JOfjFLtJP$MPw;ZRut3_& ziAw4rP@7IE3Y5g$ zLjMTmz^qB#Rk4QQ1R5C#wSqs0G9M_I5HLcP3w_CUVIEzW4H+HKE3-Ey$ zgM0$OUbgpxR*|z;KMhH?PgmJN|Jl~F=lZi3!PTZ(C8cT>HRMW@i&@}+1sGt@7$uOH zA$bOiNn{++Ep}wQqw?^))ukrvw)y;brt2qjG;XN0B2FdChm@isc{i~3(@DpNP$@nL zql~wdCe5a8{UxivLT|(8X;?PhAL!vafgTtj@r-n6yE_dTpx|8y3Uy9yqnC(@=S6QX z^AODw^jLpTI64-mq2!}HkCtP9t5`id7(>5JLFt!$k@#i832r{O?oT|jw!qa}7($=# ztNQ9>5?Z%b%(4x2D^;Zk$=u(+;Ec)*)q}Dw)0Xg19F3m^m(^Q z99KDPAuFB?zWegVcG{_X{|@DZK$A`BoFy2FTS2(HbjQ##>G$nn94~$L!%#Fxn$dbZ zLcjKF3rcKx}z|fo9gXZLp^VHVw{?26Xoax#i8tpv=geh z6*eFtctthkp@#`Ntki5{16tsMhzpe2hSC;#r8DjVmo`(Y<~6pI@^6GtC3A^to`Fm3 z(gF@IT44~;j8$eJm5fyTaQzUZSeLLX#I&#qpWGfN_CH^QO=&uYkFxGky?(2YAR_uN zue);sdd`Xf%i!KuQKI8C&~xW8aVat-ckA^u)dO?B$>zE+*ks$Ai%Ck8FYso$Ha%W;iG z{5C@7`3I2F*nUp;|K^zWRQ(=OdEO+F#=4b}kNi}Z2tFgQdm52H`YbZ#e6g-MCn z2UU^AGuPWG%^;lTzPs~t#%L`S*8#q5?@l?hG1by!TPtR9Kp{T5zvoVxJa!ua{>^7> zI$nHSy1c;-GoxkmvPwGIVVH&P?q80tAySRB=Nm;+lr80q&K!fNT|B?W?z~y(ArS9k zC%1lHLXxZ#BYSgjT)s1A)WhBm##D#mY#Ndvs*`0i(6vymc30Iex`cUfu+bt4e3akX zIU|tBwJ7>~4DI zIPu+OgD#-pDY}O1u74<1j1mtbB3i)Qv)c-KIHG=Sw+Ulp46yPz7ig`tz1Od5EcIV^ zuI+d`m9W`0(2h+<;iW&So0S)M4<-BZsu#`FGdnoX0oB^)F!ngD7}L*P@ zo&v0ZB8`#`jq@0edPKei^2sqhR~>Cc@gO$o{&kdZ;u9E7j2cTz@~u3*ebErAlmdLg zVzHfd%l*jzvoi?EOyBCKXM-KzCkL?_*EbcE4}70wgRbo2JTWVMbgDZyv*fznU)0l9 z^;|P_upA;jkC^3M_cLXK30vXQLLOBp-*Wh5S{4eBhZBjAmK7m=ml&l0i@pz#e2U^C z3T55hYnv-m9e*ug^sJOalt-k@ZGdRTA-Of7{pkMZ@=sFhQtMxSoX-!eRg%0t$e;-e z58!~`ynNire)z={A2&R2HufkFm6RGhg-S)FXpR-e8mLIAJQVyN)e@Q?D;3HZK}D(+ zkppE^?-&wrq_Gh3bDKk2XE(gh2SYmhwfDKsm;}Fk;uB1;6b45L9}4PN7og(G^9tZa zzboZ?zz{AJ#EA19FfbEFCcnTHskq@{?`G1tNIVFC=0xyr|CVRfhi0y2g=0(DcO(jhKuib(`k_;*Kfx$BGHe_G4f+}108qQsw{yU4t)m4Gv5Qygr~K|I6)|{NWih(%10R+GB|NYJ_Xa(rt^3iBA#}Hsta}n@V zT8g_`i$l_uIu-?DEYvFvL|QGD2eKu3ltYK{9QJ(M!vC`kmm7++OCw`=*3Ezfwy253 zGpQD){xG&GFAqouveadW5V=FL{0R9LWpOV#sB|8YI)wv#gcDb=upbXR0ixhu{4ikx z(4LXap%E^yP&c#Gg#H2uXKeW^NggNAJ=`Js;9fZ|pbs{vE%5mYL)_pe)5Y2pB%X=ps|@&U9Uxty+GhOcj<{wYKiv-@56 z-nVmcN&WO=bps-PRw*zH^2zGPJfJ6Mcu0cpf?9{ZzAYkyzFr}S6Yhc_>w>3oDHqJt zh&0VcgAUobLR*LqVTTUg^-axW)r5+{maQIMb-TEyUm%@W9HV^`dQZas4*q13qVSkV0=?dNZzZzc7vhTk@@zp9epCW;D z;{`9s;ZC#T=OqWi?mGS}*)9*Kt<de}Lw7sY6csU7hq_#cTV*3%D&Aq~-ZH<>@Kjf2FTaUru@z{*WTgQczFxvPd z*}2Qm3*2I`msW+V9iP5UO!@~xq))qvz&G55@kNh6A5{>g%UC8gt<@Tb9-n@DPDk-T zL?Nyggo>q0gE}vW<0@|pn$QpFq}GwgL|b1k-wGD4igqH)$s>>J_xfmy(zG9&YVU-S z<$Hx;X98VeLTM)bFH6=eBaF2*#A+-(*Vf>isiwyWS6%U{$Uk;C4&yc0>-W1FsAH5U zV7QLk%r}lYtCj5^sw7QmuKY$5COe;jwwGbL$obrx2}D&*7E68diq@l)0cWX2<73`K z;Fy#vJwa||?&6f#axM~Jzb%~HA?><+y|1lk2+qWQgkCHdV?YpjKB)~Vy539d+^5LI z%4f&zb?+B>t2wrnF8HBH7 zo*G3s5}u3!vc^q@TZk4YOj_|OJ}VVzl3<`>8&6VNDxXgIa{>~y#%%({VOgk5uCch; zG`WRQ#vu0l25GtT$u(4~m82zfMli^VdNBM66v&NZCJt4hf2r1%v5cds$j-ATMju7e zIt33gGs+ssrc+vmo8#2DRTktcFjO%gXbTr5K1BquLrS42v7-ScAk$!xM=HaiMe@qk zvz}nWTSz%7KP(eaeg;aA8ZL?Ov4>)1LfcBei?ygjpjsU!rB7OpThd~a<6OdMC<;90 z`{K*&YmRk2^U%Di53=<3K^r3^MWL$MssMcL8NV?FajJRh)Ke63z;nc zp5Fz)O#Xxw2`m93$OcE-&idQ=cNIrWW-_cZ6`WT(q|1$(=`n;i@?^5mDz8vbkR|5v z8;YcE5d-9?j6E(KvR=Yx#q5KE8BWAtm9j7ZzfZ~FREGU7fa ziVjL#$ofE=qj2kIYt0P@D-)+N3nvD!HE<8d5deVw6;dQQAog;2G5f5$#!o>WPV@Ci@s~Cocf_Bj)@DsI5AvYNYEgEbnO%EpyJj;1>cX7!MRZKw+ z6oYty9uyyoE|n_Qy+N~7qQ(xI_rjJ&6U0?b`S({cObbGn>%Ny@!*DVj=#ZWvSCJVdQatYx4 zAu_yZ#UO)8lj8?YkgExkQ9UP&@`><069^j7b1!CGVg4i{8nd<@>s3o{% z!79y#bG+!QGiftJ)Z8_z-n|w}NQP@ktj*fyjm+A@ksr=6Q3CyZiBM!{0lJLH97b*F z$QKuwXo1UH#v+xjJ*0%HN!+9B;pH5SrbPT(fYE8h>d&8=iZi{`z|ZAa;z}Mn)7O5Ly9pYLaW39WPvjef%1xjPi!1ImoYk?4G z2}N1=AX#dSxIUs&TgOj_L!LE+6btdU#-A+uik;C^R-K2y(yoyx8Uh_leyThkrm*v+8JMev}A zvH*AbwyU1{^6BURt@m?X00@mJ%ZA>q;g%MgdJT0p*R_`ftqQKQjaaP~QBq--Yb5hV z@2WGKC+9B@YMvVg{_hL@hydB}&9#rM$})@|sYC zi=YtI5r_|Mq5mn>QhONdkUx^3DIo+HS$}XavD@^Us1+M^Y)3p(zk}ZSYz(rbUzog3 zM~kB8g=TACZ3IUxPJ3F>y%I29k^cE-1d|YAU)N@jxkAH+(x=(L9l0*r!X2C%ro|PC zx}^DA0ZT64Q6{R|rLNSKP}gmPX*|EJL_Wpy1oq3_tsLB^zV!v2}k z&(Wj)>QWt{eyXY(3}~=@0YdWH2L}vL<{ID}37E0AZH3To#!@P5JZ;ZmtfeBL6uQbN zwhZ?OU-RH(t&Xj{Ix(!vOgP|IvqvD9h7Rq|Y1Q>HXYqiFPTBAC#{X@kLH=#mQUdmO zpLnsCqH1$)b5m(a4$m0y*c9)tyj-Eas@qiKv${!ufU2EQ?IH%PBPRr?qQ?aO)bP3| z$hA+y!%UI5m<=zjSj@;By&l&EUDp#*V~wJ;v^M)s0p2~H$aB8}g;=%Ngn#{Nv&(zakA^VGIv zptI}TFSr)O-QGHoblLhqMRaZ%XDV1f>Ngqj&YoxQO$!fAqbSpV*}i+!+9fx77oj_g#fqa>w{k>T%AB->2bwLn#+{r!QFpZ|Xn9&S zX(@iI^pnKzd7R-(l(^JG|7SafO5J#!o=is0wxWN6%C-WeV?OH|8hXhTv5`ZhGKOtc za>lPj_Fmn% zL3Gkh%0jp^wc(2z;w*J8Q;w9ekT)>t3jwyR;en;C!1iw|IV`7a;0nk4Y=9$FO9CXi zP1~AvK#Mcc%o2gB+jYKi>~CsyE@a{;=yLO>5wO3b67S*FcJ?JgwG{Qg1zdza)|H6^ ztT}XOgeo6OH;RnrO=6jFZ`o3`7v3wJ4`PGdsGF7@d!Kj$U4!d%EI02?Tswqdj5b@( zgAiMR4gCy^az-`HSh(q=PMsk*!iIScLV*vXpX?gKyW3AA_z5O@aKMd5a`DUQRxFva zEi{T6yLXCbqaR1Z=5T4~OLA~9mcKR_by4Y`jh(K=4CQTF9i)GDPGd5_G`FlxKsw#F zo)FZQO)f;Inj5dqhp#AgHh<2O*Gv@r-7XpdX0JAitHw0>2g0>ABArB9QgTjy_qV}6 z(1Tsan~Xo#_A-HOI@MQ51D?GDp4|!>D@hUUYLw%?*!gO2jF}O1kUe2PtMHr+v z{+u9X+{)}hsFM2rd<}Q4Rf2bStrdbdcU`XF(@LoF0nOQmAuzcj={X~5y1eDm4pV6e z2PaA{tCT0AZ7T|fSJiPRqP#n|rVpJqYGWb`zva?6?16MTS z=Ia-rs%(TI=ZF2(Qw_!Jk==O|5OdZ_5hCTv2x|mm#_@VE@ZRlR0FBDNtwdbK_B-Xc zWoyI;r*lh`fW!s>%Cl}O4a%`@D-O!C{tOqHa`1kL5ij7Og2cLZUX*=u8$0Ao+<53{ zia5XGg+t>*j5{lVg9eXZvq161@N6AF&PK+`}DZ%iwivbd>pd~@918N5tPdqU6z&Y zgZr{pXTq&hD%knhv){{!N(U1!@_ zwTyqmcKk=4luFWd;T72#*qZLV&XgYTlQ+Fd`@)c+(D+z%Y7IBdQWjDu9e)Z3nF7ki zG9G_Q_>Y&2WMzq|>ZA@zhD*tQbukZbJ^9jF06qAL3v^a)$z*I}0dBa;45GCM#8y)f z?iJ$GMSm$)ahJ*2U2|I*N~V?RF`w6+QGF`yfX;xnzmc0FBW!38&?^A^p7?C!$FD6| zbv}&ik#D->t^I!e0vAWaI>k=>ef=6cTUza^vm>!zYFqf5$<^&Zj>cT`pho+OS;Ga7 zhF|O;lB!Ugn>pu812v*;6Yi36XB=aP9(_G&C}{^X9A5koy#`u6Em&RJmmoV!)=(bg z(2vM3+sibHtLwM~KnA;&el$g!xziO;ryu#wyn{J`FtU+&IzL!Vh^}2~eyAS*T9t}> zRL=ng*@`tRvP9*xtth3Gc2``;UL{z)L2q`4;;>wP-A*r@tQiovf__SsFnM_B@)%a8 zLVAjqEQ+m}jbmX|st@FJ1F=eX9Wy~=n8s23W&whAgR)`90Zt|7yXjIurNMJCphb!j z*R#emIVAu5t&G2}44{bQqny=pbu(0fL_FZr`d5sgAC-Y#h;{-)D-P8Hky8|;9r!2V zIyUD)*zQpWEL`|Av48W#nUruax8`qmh_`wb!6qvo5y58Dpd++TtCALn8i@8^5QBU? z?tZKj3B()7PT(Bz&B&R0n+t7aR#N)+Fz>3XaYD6Kb`tEHcfi{^;!G9yBidoe@M2`z z0n0>&P+9ujCDq{4JYqrJ}(+(g}iZ!z;~GmXjR&@a+cv9bv_?p}@&LsNZZ7&+W9j=;` zAm&`f=90UXlZv;Y#M+8|7~N*S1N_h66_8j z8$0+ziH6IMhq9aQLcf?2(HGYj;F(AEpQGmlo~7o1F4b^>S8kx#QEP9tR*Fuc2LM;v zOTtsK3lS=KdD!t%<3T$)D=C(aJaP$cwxvWL*=?=H?SrD&V`S>UIV}1o%g^EIZ^c)6izyc z*k~Vwwo>BWU0c)fRm`KRj97{}kL@X}@o58$-o2~Xg8cBP`RVGgxW}!0TN{mar&V=z z=f!=k%`-=eLN0QkT#9SK(qg=wQ0l4nQfmdxc_c%1^+|iVHO~Y?d1ky5uv-xERYZq0 z&OdkO??N4ye2fq4?TuMjuEahe0^vK={Vgw=PT=D~***PV7AiNwz=ejL`IdDn3sK8l zee{f~$=$^fG+|QZ(RGBk=x1Jg z4=91fu7-9U`qNS>f!0o1Ajhw{rCawB#cg>UuTD(&rqfq#UtJ?HSEHpNrzVE2xGo=~ zGv*mN{?rCN30vHA1i$f>H7a`x(&VUyPWkc3!1JVPs?FU*CtK?^^-`+9T3JP&(W6d? z5fhv5;^l~2knCAYuB-P!fqL{bzhdRt>Asel0+vE@aKo0r#R5F=_U`UG6p)1IyYlb; zS>yHb@clkb^3!rRtxO|>A!aP^cm~OU5ZHa5rMY7;k_<@7wB8ko^X_Wsnk{mRBEmQ) zQj{&8ttt2ntIm7YB;c)#NwQQOaxB8l6`Xhz@O^l^{I@-8P4ckUH`B*xqz6EEB*px@ zQn!=m=Pl58_HF}w@$DukW9+S9?-LOCysy$M3-x_}I>3qf$1nN^pUd1R((d%*i^}*5 zT`*=e&>@z%!^!D+leo6HgDcmY#B0AXY*uvR{B|tx)mnJ8#fqA~fRfRh#cQJVJ*xii08N@~C9nDBiJhFH8nuPp@a8ohB zsq9Z%&=3m*2QryQk~VKbg*64k{nQY!_&F%+GEi#i*ZS<3@?c|u@^!;x;E8Ppa|>(W z!Buk;61Kn+$HbT2`YeSDS6amncDcaf*FQl`PcL`lupXQDus7=xf@No=q%ENc7HDNf z98P*z67s*O`ljGKqlMizY22W((b%?a+iBF;)*Gj>jW4!sG`4Nq_UV82KWFy2S+nle z%({B!Aq@0^TR@0XXCPAaTWoN=_^_xuR63$9jV(ao9WmTM?X(ryE(EnP#C_zo*Xjk& z_m-4=RJ<+y4~dr0^bFgHFGG?8&BXdG;AaUVOn%1Ac{H+pvgB0KD9rU#t7Hd=(6_1r z0e4E8snF1)BVqy?>TF;s*tT|Bow$SvA#I~WL?(B0=U<+XR4d=W*H4jgkSt22tzg>~ zn|{|&5^PYYZ+w9&YV9lR#&HgXAL3{rWrNr-TU|;B7gYZmsqH(L^g(|mro9Yp+YG?5 zMg!lRIv~IMr0ZX$A7&ew|7_-KC3wVtb$YGAyl-Z-NpYhhBM zhgD6xzJw@p1t%5YD8V%n^1ZUkcG*EW*AD%0V=#zLd~`4Mel*y@{} z9w}H@Dbgt54z@IA;YqdHuO7Wj&=KTZrs3DoXn-cWm7!dQxx!g4Hpz*ZlHh>bqRMm! zf={{ihvc873S_^pdEMGN*k2B}8qgH~`937a|Ng%=j;nK#Zw} z!H{(tZW;6@b#s8QFte!0x0;1qkJ3Qly{SK4#kPi>M|~YIp(VJ(1{u(5xJ(T!N~*C4 zxMnpX&57(1a z89rT8vJ%$$mHZNkBK#^0T{k=ywp_m?N4No!5A(NLuLT(%ph6YHzeKA)nZ6&ul#ml=LXGR%=fy4|ptwoRrV9i~>8SwJYPMS{II^<_BOvgB&wPO}2oDdU6ixwh@ME2)H2L4$9 z5c0)RUMAEcA%=p)^E5enf-(5%`15CMH_}j|KqF&BjpAQLfuyetNsMe#!E$m?RObDL zqIemG5DY-1ks68Y54tJEzl*mDihp}h48L;XBHvdB|0*US7@|R9M*9J^^fQ)h^AE`v zs0lGLL6f7nAt7}=Hi;Z&N56}okz;WrUxAuF5>&1m1l+IpQJ$lruKd>?77>7x z`z=#Sj1Ez_#ThUG(lEanQ=I!IAm6q5v7_yB=oS@_3;84w{+}ydl+?o z+*hy-(0e3q`#7xnZ1AkOW$ih&xR3T3D2K?d!)imf8yMsNd}!)Qcw6u0M}J$_vg6)8 zSOnW#meGI<`^{`mTirpyc#oV%MFJEy_`VLwrtCxZThK1Wj2AZ$cE@#dG&8i82$aLf z8Ly3L5fY~R!D-$uM`%lT(5Jc4Utf;T?z6AEM1GpR4%i^I`pty5N2KoV%Se|9^Gon5 znF2q zM4d^3)ecMIF|{(&Q!uqUGPul(qf|I(7-5{UxI*dXT*+pF4kpA}r;0D3V6E&Er&p!xuN}lioD$nb!-uRo(Pidu4t0*B3AA ztn?0cNU<@Ei(JPt#Wn=wXuyQu>S~cFVp>KPL4f`8a{+?IyB$UOANNwt6V(j3F+ij}~ zu5qPw)8axygVl0*!A5WR@_tSr$wiD z!xi-rppCU&RlT3D#qe1hUsDiSet4I$7p8yOiMD6&_(wJ95W??vdFAZY-QGaW$N|f;`9H7vMS^>V!z&&@6;rV2_1f&I5xU7Zs&$c{@cg?HzE_j+$=lc||9G;zI_umN^zJm8XFw4<5 zkK1PbTCZu*G3z_7;A4|V&1HMNC9qwb9d&sCpBrM8u5I10l| zyK5(4_2o+5M1r2Zh>W_OvsS@%OkVBY93XC6Smnea85jL709bWi#Jtdc=K)1o|FZ2o zTfyxhyq`!HUcVfXeXAEJ-Z(^z-EU~|J^3>t1n%hx6)x%bFKg8{^TEQvn7+OZ0pt7* zo0;#@#rAK*dLy(G+r?)=uEl<=ZQ0uQ_|GxKU&;11}AApaY+JnpggP61?`8~a9H5nXF4whTtEyi$b%e3Q*F-J$|M%22ZngC7{ z($5R~aHh*6ipP;|a02XH@n9<+N#;Q>k{_kP6B?0y2@Vzr%28vnp-PJZPizQ%%98q3 zi|pTaJ2t|<22|cRS$gv|#!7yzW7 z=WB)VMSYRW#`|JTA z49|UD1pubTd&w7Y56e!uiIzdBaE_RLPUjT=@7@OoCX3dicX|YJwzgoKeaF4JgC6?V zuAOfQ=+&Z#Sq!6Mwhv9VlZ_RHjfong;Ih&urmQ~248^Z|Z=p6ZhfOV092_PyH}Zo1 zzuBO^#1*aEZw3$9`j8Jrc%RbfX0_fwkAYK14*`fUi(YbPc*autLw%0k?JSdPI3XQL zi3k&BUmowrrjcIfKJ8ccv|}#6b@A`^AOs2{wkX~Q_>l2-%6_6=7k0TmBGSM8tU%%4 zBz+}Sc$UDJ#+*(vklvQ6rf24^dwa3Bugk2`zap^s{ocV$3(<2DM(^PB! zUr`0HvkwLtTbDgM@>N?FCCZN@ za9O&Pj?Z4T+H-UaIjb~o{dAeIZq5t(#w;OzI@2COq%o>)RQpu(S;t%*IW1-%tDQh<^m9)#YdapBdOCtP!$Z0LeFcW_yFIPtjA0vdlKVSgYR8 zQoAl|;X;v^c|ENKzx#$v& znn2+u{Tl)+`pkDqnP;t}Xl)7}ngw+KnPz5nH&$+jkuqvKW-6F<3M7KtbYIcj0TE^$-- zPwPJ8GfNZqL)-mY_}FQQHTI@UGF(~ZXW>4SYVzjrSW5_dF8>4VvL|tL)?w27>L0GS z#$p6>0%|rW)T=acE2@oeGI#0-s@#s=N|mJnvS7&L5I>cG)jsS{qUNG z1+Q-l^)?@-If`h(RS056NO0Mh|K)&$ZbgQ;eP#88@6`OobYHu1tqOz=+2L(#Pjl1e zz0i(#xq${sBfmJlU|w*6KsspX4W>Kf|BZGuBQID#$yFDiH49#Lo&z+#k5s(Z>_-^p z&>SDmUYnCUyuxN;NEyQ2uadQ9j{kij=MdIh_w4dy?E0KBANcl+cOGGjyefY@tXV8N>to5; zLu>uX>4*f7Ls3kTiduL}h%{?o{N?`)N;~hmOFi-nx|{u)T@5q@5G@ACy_%T3qFlHj z`FwbLOTx`>PRR1x@ls9r96GjmZv*E6bAXj~!a_I{us~zqe8^s7kDIh)ov$ z^srAKI5X29y_kDkMNPU_#-GMZ`X|1tP{MU)Dpsvnu+FsoY&Ja|*rRF3`ODU4a>}zX zxRl)BN}zpNR0Dx(Guw>Mmo2Zljpu9XhRWN7H;?$h_{yRCh^DkkGkf~yG+V#W^?{Bv z%o)cp3CIw9&8|}D+Ep43OiHW|#ZqP}?pDGC1bKyeU z4%M#0ziOfjY4qoxc&?a1JW|xj`hk$i*~U9*;7exUOcY4-Z6$()y>|y;x82?0sE&v+*`>Ttr!n#>JA%rXJtj=$!r_NoF#TK#M9 zF4}?})=72Z2Aq`>qH466U+5DHEE}h32)+lRGrRD1a=21~oK;CbeFKR2I5;vKRt@m` z0QN7~gZDc+%sr7sFCnsu6jX@adXciySUxIp*nO@TpKT+Od2W}5!&NXk#5VFRP?-9W zwDNx1D2Hf+3ncF0h20jQc|G$?6KU=pJ;BLBVm^+fNLEdU#Qwn~M$@TZzt@=2la-Hi z-h0qq@(OV5m(lt;a~`*^TdWBl0&_Un0A7zqDw-8YR)2HwcREde`JnT_J6{jgL!~XvWvX*6 z;QZk8wo8Ts_TknVS!C@mrSW>*k9=tnx^;E z19A~<>66ysr3*!(X_PMK_!wQAravAbZBv0u-ccH?!dk##57!~f^c*pv)9`O*-97L? zv$shq+adtGW-FBjO}lX8472FzcmFiEqh}qe8{@`GcmA~t)YegCeylGuO`+qc#%Ax0 z#Wt$bX<(-jZ13TyS*t>yDt|J|Oy33;Yc#7aj2yc>LdcbB7^zjMjq4n_`5kaxwM(KipXcF-{y6L7L+{Yl)_W z6DJcviamF-#q?V^<-X&LUU?!49aniXO-N^DK~Oys70x2K^6=?3Vcz3hv%QzWvozs+ zUMPH6y4eN1DPrHiDjDhi&) zmWn9U_R+IFB>IA~6~P49a=%aapHMIh+vgyK{!XzZCg~&pvZ_Y}8AJJ1Wl4ZMd>)bq zT-7QM_c#{bcjd{35S6jvtD^9YmBAbm!x>=_VWFC4O>lq#EHOerd5&R2_Ebd;Zscn# z5JeSyFp(A!41Ld5{}j|wZiuPpKqTtxCWQ~-kBRzg2?E(JZYwZZ6mr8rb(*IZk(TQ! z*f%H83@!nEG_Uz8^M`FBi76w=(;U zGmCrj{9B4Kk~Mx7aaWckma+Nd-5U1uQ$LG8xmtMyxf%_UUr|rxo;BWGSTSb_+Q4mz zGBfgJVXyuf^JTg65Vko950WF;Rzrw`T1p$|MMLLeEtN3p)6fT!F|33fPWrFexEYJ;YW}B*uQZro*hJN zpwl5ip^mrmy6E)>ZNLK7db~G0)^mb*9Lko*)MZKMWK|3PechPt z!=l84H&#Nj!rW%Gt2ALG$Qdfob~`cc#ST~-=0XOP zb?~OEF3$$ndAIoIU7f$su3qy>j-9kr1&AsEAw^5N0KBZdjJ#%GDO;f7oiJsh}&*>#WV|PsIzP#^%&6=P~!E?&<-E z_Gt6pu7_lHan%FN^g9rxPwnb1V?p`q`YP}udDiAFa_I5F`)Niwy!mnMV1L^M&bK*l zw59Vm59e8>46bE4cw+L#i>fPWgrsYn2VS}Z;NPU)Qtkvz-aMMT<7X*ZmcDrFTIem2 zo@B05eXx8Y@H>?lzv$}eDrG$kuk#x@Y95t<(v!26FV(LiD}Wa7Bw(JIcfo-VSd9L~ zc%1&>7Qi)QyL=>RGW;oi>r;zZ!d0RD0MD0Z>UbNO*+JW}>YWZhg%_w8X{&8J@TW@!2&Lr~(9c|+ z4)%d)?bY4q$CqxB#_x0l_t$0Gv+*C+mBM9GCI>|uJ<>Mr_^%&nFOx0C1q)qd{2`qk z=9UY0|N7NE(>U2y)UHj)Rwvo+*4W(L>2>u}`WyHoP~$c6#rPtOpPh(r!OIfYlG?oz z?oaI+Q0*}n?eYFR=ysv&8g%Fhw9454u^Xn|S;km#5 zeswO}Gtu+bdfew4a6NnUgK5ZtdX8{!@kyp{2IPVWc22z`Hw!lv)3xMYj0!RCV*PV__kMpRQBJw$IK!|e$ftQX%4 z=q%723wC<7D=a}F3PX&2Pxk4Y=Ks#up9Jg00lF(Mx^HZ+T$_AsXZwJ9Zr77~z|jr* zjQ1OvxUw3nd$zVkRe70d<^|~wY1-g`k1#!*-#`Rx-UwOZ;PP|7R)Qd!pPD)pudCJOc z!s`te2MMUIt>a?vthRk@bI*QS^O(5NQgk+mzel+@^DBjvt-}9;8@B%k zZV3LZ3jTlCMpL?xrUX926Rid8`-|^Vuz2IE8bJ;w~BV9Zb+S z+JXgQf&x`;6$Hu#Jj@+Seh*#|ZT_%td?NjbYA%c)S6wd9A4p|LPBKm9A>YuOl&W#i z;Tn|(cUEcufm%t=Z*(usKCiv;s|%mH1o@N0hIes3%|R_x;gn-X{oful_Hs#yRTE zgs&P1+qicTzf@qq;Yv$gM>r$(lS?dBcXkt$*2gY1ClC;aAGp1%>;r`?#j2$U;eD`T zV)0btj2|k^`IwOwiNsn3Iy)?7RAd=04N^hHZmebsSfH7fuV5qt6!SlFMuN>ke@{fjA(ksYjGkL8TuLp+W-H{Y#xl^;WU zq&wK^#}yKiP)rR#8aZXt9l__yq2ky2alu`U2xR{DF`5W;jYwhsN}%y;f`#J;A(5PY zb0i7O(};*0-*dL^<(x1WAowD}u(7K&GNgc9hsEAv;c< z9~VudUu(BvnL8m4GO=?D8gkaOKX;^gkS#oME?vat$rTAuk6moUrOjX?78g0fvejy^ z2G-dmxKWKnJTQJ7IT67m!=V^*cZx}5^D}63$TS<9!I9{CS03sIBPV#Cm;?A-w{>3$ zwOICdqU{zIL)=)G@iDQHIE0`mXKNWrk)G7Jn4mz$Ac_OAw9}qteE#~qi9ph?Uz~)& zxVa^8RblG@=V}hqIU+CZKJv8E#{CnGPj!1dpzgnQ9tg5kS!eVXb>Jb|; z^M0^fOo^`F2bO4h<`nz&Jw*#0N~XB(VEXd;m=a*9Q0`wkfl zgsYSh+WaL|-R|QDLrsVV-rhlkB>+Onit1DdyGEk3EKwyOmcDn zXb!}wY~4UT!u&DSDI3u*f1=3mThGV!r_((xd`2$U%QQPPx{NVCVEFeRFGTsP0|%8G z2XBGeyrsR3(T^&3d0RV6nk{D8!;9KIJs@h%xEH=crX}R#kc~iMT$u-b-$G87U%AL! z@;p+OM5Hwf%9>uF85SKXqM#|x=NC4kw{2}!YdHHPf8PBd@a#2aoD)~xt#!xvo z+2^ar($DR(fU&RPTG(1M7le$$^s@dC*3R;&<6^fhgL5u`T9UQ0{O+^}f0zTv05+gs zLE&e{Tr0<~2X@w{(HYNwgYtLCDa$J_l_fRy&yDjNHB6_UCb@}s;fR;Pi~HGMALD8P zHH6Gnk)z}cZw{d1x0BqwxDY_{)|gQh-=5qlJ2C`E?3pTQwDCC&c&E=H-oHpu)jlF# z=CZ#|A!feM^gjQd*}Zv`KFliv{|o!PXlCS1o?NFB58v}^IzN8?#mgpSnD zu8t26xGCd3k}V!J;2%2@X#0K?n?7ia0rleaN~cCndiN3&78(!pB1slbnS-KF7q6wW zZ^CCpAfvj^2CWK=uR0<+Y&YZ#>ibItpr*j0@mC)`t(B+3-0{*6&XNqEyIM9L*9?5~ zbusALHs9GLRv}%N1p2*i-J`v+1$~iT_P{XH@Kw)c^^uaP?7^Q}%H2}GlO+}Lbr;q> zDc|t5zErDegZfvOF~s@N?u6+U+^Mtfl%gGk$HV0=p0PYPKAhz~Q~#kuzt2k7G5w^g zCGkeGV>l;$tj6P3Asu z803z$_0Eha!P34Y3?eDbt;O8#=$mDn|PA>8HfBXsYmc+IAq?DO@p_gR_$ z8lt6!#b_w#*j}=WaJ7J*b-2h>rHjXA$shMV!{ub3M}Mo6*M?P~YtxoS+T zr%dsuR=5ORZUpDDp}oy>E%c3FLo6m(MB8Fi)z48f<8w{JotF<8txPQL?qe759v9MJ z9{eNI#XuWu3%Sv!@9qH&_viZ#<62erBXa9}uj+W$(~~c7W}h_Stz+CP{mh*YcK;jz zKHgcF^i9sLout6Kmlu)878TN+6PC>(iH_V!@?X#u(N;CX-jZCh98AY>RKGx+NM_J?5d zS+9w()ot^BdT+;b!pa*#k*irwPUPfLYe8XE6}yK^{wD-f6O4uM|Kbw%|H36~|KFrr zqK0ZKe%4F#;}pamGZT{{V<@d{L6|j_ zwt0n3PPzo0_G3lLT*VeB#b}XRuGyvlD-B`*ZY+c4U z)=iJchBjobKm(bl1&wGl9U0<%8iT+IkI%k>qJ7Ch1K~IPlP3@y%Oyt$rzViXLy<)p>r;7j4cIRg(hj;Ygx1JOq~GsFhr`V= z?`L*gNJTca*4XO7iB!D2F5n5|@-NFqIH0wYO-YD#lIXFyw+{ejzGK0}*#~4_{Yw0S zKe8_Mje#~$fS`3$68X$v3ij+5pYiv~mxE9GcZX zyzqyLKVTQ;^07cYNwi7jgf{Zy?1%mCk2SL%nNbGXKWnkX&_UE6$!Lly8BcjLy@;O2tTLz&p_b^r?tiDf>Rcm>PLa*vEhHu!y_Jg z;v2-dM_D(*r05Kp?)*t5Lnx%52$Lw4D5S_`5x-wmwIfnATZT2J$34ddkv_)u_&?T^n1Div2C%VbdI%! zX`2xqM0Iqa-XTk}I#ns4)MwZ!9EjZsk<(udwra3Db5hn;DXhwKBXFuYy%b1j{s3Zf z-(WmQ3t&*)O{QVqD~u^cTyBHQ|Jt0fnI=|@;?z<(&2wu?350AU`Vc;BQ2)y(`U5-c z{b4loUp@>fcG!C@s!@e7^3-~^HTt{F2TKt%a^pKJ&`i+ERn2-ib8J&@67pAIu`~ZR z>4ya#oIifPT_5WI5%7oF+6)~1d<70KyFOo6>Dg8veeC$hl-@Vc=Z5WZM3RxRtGxX` zo1-gZvTr>Jet9X`UY)oRNJ&#c9Nz7Wo4+wCPA_*8MF9OE{3$)`_;KP-u+>ZUJo)6Pf2})6YV2PM{HB##g`m(lDguAr`mztfbQE!QzW>6{q*JV_z& z&O^PYn2|p&yc@DEw>5L5XYPfNg6^6i*5Y;|H(HknyvZh=3FMQ9Kf_-I)U7>lIr0YE z@;`zRi-PMuIrrTNF$NyJ`IBB@9U5*72oxUn2!f|nT-*l0y1G9)0FMao;deo=C>TBU zN8X0lQ$5y(7rS-m2|4{-s7uy|vnADsU3_n|1r#pM{S588LcPmA=fzRtNQhM~{c~!%LaeDEas;3rk?J7#?J8j(<0f&2^$OJqphZ9-1 zh6JVJ^uyOoe9}HKn@hJ%djtVqBQ8}0wjGq8P!6x3cX>PyZ;d852odPYZ(imIXBGPn zwXJDqfB70FZ&}={Zsf14Kyof_Px5twlW@FlE$L^ScSiNg!2G{%OIrG?jG@J(Gf*yj z{ASS8yaxog>^wD`r-8%rCU1!A^n9Bn`YQ+K#l_?A$HkKX(cv>6(9Jk~-7Bl>YhYBd zGZyY)&uwl?&u0lIZGd%8n*#os`uD<|l}Fcp|4O5e#aF88%U=vY z_oTYl;Yk!J(1{%~>~7r&``+g5T!NqyeRf6_{)T;P*05JKfUB>G&j#kT@3W~ZqJ7eu zycq{ni}UcbNA>n-Wu@SrDm$Wd*KGjk-NLRG7iAt8V{H2+&xhtfqW+m3;M|43)pW!j z5w#4$7vp-~H1Sg(i@$zhVj6Y4P1|)H&Z=Pu9)x}RS({q`wFs5B(P|ibc4p)1pmNfE7kYi|^nY^V_s@pgIPBeRz9WO5 zAsQRH;wSpEjx(ECUtS45m~jGr!U{Z1tEvYpdp88$gqsJ@0`FP zzvEP|3i9zEUY+PE=JuUFYJ2-zbC z|2nZZ42B^6J)RWb#UxBcQ7GeQ^KP{aBbh@ZC3-1BN4!VYuyWW4^Dn9Xr$QM`rLK2=+Fo3ae41^@M;5i?N0G1fg{buFjw?#4F?JoqZp~<|e^Byf*$F zVf|F_*Po0KllW+8JRL}spCbNXXT$-?yiWz#ypY69q0y))?HcHvl+n8f<{AE006UoC_~`23$L2}I0YhlQn%Q+v(lq7<@ML>o3~680 z!uq5H>l35|F{BH&!WzvFsN%mz#e7-al1x*`kyJj`I76=Z_S+z)A~zm&U@H+iOk-E< zeTUR$3)gb3SgpZg&%`1&=X7i=?k^fRX4*~}~q>Xgk&{$Hg^ryU9)S@~m0H5f~=y64hzz7Chk zD4zN2k57MbqKa3+{h2qWqyTK;rtaW!{3a6__$9JXgY1_JZ6s-nN=&=sCqw+xz&(3M z!@V4=V?b#)#p&Q`;uRK71&<)G?FV%?x{e(}m%Chz;SQ=V>r^I3a*?mE9lJq6x$Tv= zLa+?7dVwMIn_bLdH@(QnmwYhcVAmy9A_!Di)5M>@RH-10MM_Yo2(^HMFNZ1A5PM`~ zxjo+k1GG%gWzi9Zhrnj>FT3fXR{Ut-%5%G+)Pj<@_o!5eAOuigQ5Ir24zjU%^s4>$ z{~87gsKcfb#zMfJ_0%bml>Z#Xh%xF^!J=5qO%$pLO9VU2*NS>$DAU;_^*-$wp|R$c||Z+dr+9`gW$5eXmP0bW(zGOs}vHpqu zywS1agAf0!^E+VDBx$}g-}9Mh(qUJg$i_>i`n3L7{(2BWGslCh%WX(ZPWj9mgf;FD!+NWlEOdeSM7w~f4nPZchowEb1(05 z6@C(pN8nrO1|`~6@o&}rCB8gX{q^~8C~5gRGp{0FAN`MktnB!>s#-rY0+y4TmiE-; zqwP<4o~QN?a3@oZutCnwKFa|Zv~A0mmQX#*zD?3{YeWaA6ZgIC%SRaDE5_a@@VUcX8Zr zrx2Ryq^s}G(pK=+|)Fs_| zJ70BX{uVbAs@k2~gW7wK0) zv)$t$JAB12X(&7x0K^N(6V&z0Bh@>-+(_RFsS9$QBJWVBX*-sw$-#%2EIBf~fXSNO8gYdpWC%kD(5YK{_V(9TiVpA`>I5=JczVJ;&K}j^dcr+vksz5)TTDO&5 zO?p$y(6j8MvafAnE^@pXYQiGqxlSe+vtpzLVA)l($K4#|>(VH2eD4$He_yct%0F{) z%RbHtI>qp}y?xd5KC#V|oDf?D_QOeUq$l1F{kqa$^V8q{9t>=@P3{s|y3@SxLAX^` zlysrma2bvD4u6cNhY)0SwtH=3Tzg!dYj?gLzmJ9#u}{iRPEPQ09e(2v<=5yt9Bt*h zuf>?ojiWuhIxX4KZReqe|Ma*DWS!`*eS5t=?VN9~-Lvd~aeoYW{}uGJBTrRNY0iwXX!-xeX( zJZ~zM^LAE-cEl*R?mw2Y&ld~ogLU2EtxGx*C`~EjgZ?yVE3PKUu4~L}X|az;f>WQn znO)@n;Y~8l_t3#zG8wLn)B$&q4pZvMa+N?(=L+q z*;9a4wMnFR@n@3wdX+)9=;;$&(*qspf50vZI4c9&e{yZC|H-wnv9hxLH{xB_T`wi! zbm)9ko-44f<|YjiLZ$&980cg)t$Bp-m?!~b9Z9fBl$d~(Go!DTdBTiY=viA< ztMmi3BcG#?--x5r7~YuPL2}FQRai#Z5(9RAt9 za+hm9k1t{hN3e89LN8-_8B#`=j`jw#i9j0%NQ^n_O7R#YFk#`Cx!uiIrq;-8%LWvanZcB*+72 zxZ2*sX0nKYBF*oK!Sd*aP1q?}X`1Esr6wBgt6bBWwiX4~C}A+>AD+&5mZe z1AYI-Y&nXwDx0J8Mjk{+CbOgkkO1I(8(TJ@88f;iiK^(@N@wHvJ3ptNieh&tgiy zYGsuZ_zE^liy53GKgrl;ibU{Z#WqRjXVRsUost(6x$X0&S*Ap0NF(!fGXVAo<$Y_hv-gnWN^ zT$$IKu@MH|QIdhj@HtCL|Lhnc{~-e^q>Mz$mfICkQY>LX=#$?yl6j$nhoPH^>2#p; z5r-6Mqh%!cJ$5V-C1*;tf(=BR9B0T1Puc4JNkSYBo601D7wo!6a_@nTl}C!%nl1>R z^;fhIVse%!6oJZ{DZ1nThPPj;%R2_;hEGSU%Bonj*S7R$sWGtHAPZ_c9h=_Hxw7wI2@ zX)A#bX^tMTzLQV9jLhU}Zcs}aOk;wZ;>P;G7E3Z2T+hq)Xtv84DO4 zFHI|2IwTq7a8R)m{WK8HXGpM3avfP4`R{GwIwX2?mfy&o|L)R-@Gu;^aabfUt(a9Z zF9~9|!%KvriPtfFr1cTezO$tNJ}QhIslXU#*34KyrWsz)(8OQ%d+b+6q7T_*5d^G0 z4s0wWhd?4;_9;>kG_f?LC7n6#@6*b`#gY;$;8F#L$OYM7fZbk+a)A~S#XC$wf>gTU zinvh8WQk<15|m|Ri3MHp4#-R^7*3Ja@7K!W9`GcLirjyY2obYbLLu3PUqsTnMZAE= zHe29nx9ZdTeSPqL*JyRCHFkD|O?*XaN3d0V@eYvPm`(w8zN4&v>TiCWC-cAEoa=u) z&;#$BAFkfO>wR?B+wtY+v<>h$E5GUU`9Aq?u+Ae~t#K6ad3^^}eWHAt%yfP1zI1hM z2w}f0%JaX=vbK-+7UXQ&^zQiPJHa>cAGgI^MuU!5e}~>h!yJ2vaMg#N|JwH=LqGuA z;a!Xg4HGf^=;BO~`21*QRQTlc|8Xfj$<*|_f3xsksGfP3dFSx0>3RdN`22yK*OH;p za@!JRK6vaot`gKIqeK+%q6&-9PF)W#U#l%m= z59|Fose~a(6!Phs{>{}RM^mM6hm%Y~y0K7dq(Vx2tPx0in2(`9S+YHW2Ae;dhe{9k z$|{I~mK4dMnY3WKxaWl!vi|%vo+wru;+X(KU1te)tb)h4LDQU|h}sF}9yGem_^FAV zI%+iae{_W9+eCTTTH3rIukS9KD>tqOLp(w1ILPt=KZOW0_U^L4SkXuDD+WAcF@5ZE_TzPtV}2D+20*OKl)KMjx9=n zFY>jejX{(Vo?gv&U3<$JWp?)tT8cXRtp7Xjki%Z!npWqeCbGo~aRIEDLbmT;Ah$v3 zG1gHVHWiI3Hge*TsP6Ln!d(&gyl!i5sFTTQTcS^u|7wVt$NpCRQGcs2va;@= z$eR&IFFQBdw)(Mr#c(OU_cO2ia0wZh`0Y&x6@kg2q1uw}XCv0Y~Y# z8k3tDruCuK(4bBYXfWuDvfps3+{4sfWZ<3s0&42CLSpMMSlgLFeqsI02UkC7ho5EG z{<0Z@G|Fxj7Y|B=C`Dw^=4pMPLxPfW|!5nCg zD`=a@2OTnjPc}qwRNL^1Wy#E2Q)hT!b%*-A$Gc(henVFfnJ!Tj) zv&YQL%*-A$Gc)u0KWFdWbM>@((vzODl=Wpqc6TYWD!Q^NB0ihmN`pjk+$)Z_n7Emx zWX%J0$Mel);N*%yS|5%%(L^Bw?k}9ERi65C;_wj^hlUxSL)G5{srI9^#skvGC2iAP zwWKIyKPg* z?VdYGNfFt7bNA(<(8*G{lIE9fY$_ZUh3A@i3Fv-v05_yo41erU&qp;*8%|IG=~tdV0_dahB~ z2vFkPU8z<9`#c}?=V{hEl`(1DI4d(Dpt6IAwBBlfrYj1s4D4VbMli7Eo-Q5#h4d?_ z$H}Y0AIM4_z?en8QFPF;@_oYfkqZsoV)i#+T818KD6$&|hJ8G2eS>Ns9W1X!jeT3d zjuw8DMxqK0Vp2oWF2TGmlsKCl+A1#cqWJ9B)*#fqHp0bE~LROaox z0erIaH*&W*6l`VwR%t)to$EAtM4SRw*-}ySR`bZLd1b@zT*0`-uM|^IV(ZgPClYWO zo6HG?E@s~^@)%o^mBX4%T)4hGRzBZjd^QdFr_dhPq6Tui9Rx%NbcS}1Ws!I~t24wdn92U$ zQl7sX*;|v+dOm%O4iE4g2+tMWK`t5+z8BEsO?J$%cl-)--G+Jlcl}L8`h2Trq)JY zTpp~xwrT^?m2@$Zi>ehkP<~CKn#yW!orisNl&!tJ%-3qYzTq(Y{0^iib+DI@?X zk0rIDO&lzR;Lz_6@9sYV7h__45aB&VNTKC7R0P9apkaU#zZ>`t``)R_S(lK!83wG9 zs;1r%)i>ByL0>*WLSi1zVg%17h7BPJ-Gc}2_M|Tdq&@{`^)y^}KGx?ANI4a!7?R&M1xSEpi?^fH6It*sr;nDL z_(uh|t9$ZeJ_4Ih#00SeaSl+ZtNRW`dLs#r!>Q7~N%AtW#)LB05dlh%3LpV&L=y1D z`9=at1q%a$2AZ+v5hgjW4hCl@YMbTrMVqdHqDfJlLXSPBeRwqw-M z6Bm(jAos74DTW@s+M-IW6;Wn&3l}dlbA~*Fm;*eJBOiwWu}%s$O02(0o^_^+O4C^&!9!jUzi*U_?R-rEWr>ranVb(UjbX$9 z4}mVtO^2?&diLf%BI98Q&x)6ui28Nh2$7L*e~S9BS6%l~>VSb2>z|9d1h?bND}I}E=D zaaETR_92m3?Ol1xj?2L@Nj`*nqjE($O5eqddZK9tP)#riddQhPT-e0rrhY!wzmjqN+V7?i zZ_-62DyzWQ7@hZdIx*DJL0g4DIuBB)KlJq)f%FYM_^{vl%69KhG^K$UYsdhTlL7Us z#sR+Yn=ZfO8+3Q6{{}Pzvog9UQ#C8J)0`9=|zCAec~?0fY(r6#G{9f zLA%$?H88i~@Ezn21F^D* zAlmiqZ$|!|4nFwv$BB+{E?>WD8vGqI!;isI!?kcmTFe0O!L5NH=5`;ylk7l#*$baW zXyu?jG<`7;Q$3S;+TWom6LS_lrGNXCK=YP155)ZW?yAO>+Hp3N`gnHD zk>J;zWYwD0^~v3^-d5g#mv{F;ZDSJyYl9Mr2o%_0a0nb#E!$MSpVjzC<5s-Yi@Yx$ zc<}@ItVqlm#C&c%YU>E4mk)Dju9%b>s9ZzQ2xctdlY(l8A{4XdDQ|twvZ{8b{;oG< z=hhq(7`3O6&^Y6 zhUx6)&60V2rMoM0W6Wvxi*)MGkyQjXy5Q_kAq_B5q@kkfK~+b+fhC)bH^rJd1I&ts z9auYE2O$9lzCs7uuSghX@3v{fjP%HN+;#R9$Nj6>_RSc{Y$5{yV4-7z6tD21Ok45_ zxzl9Jk@0uoWEk(uc{zh_B7hvoM8fk6yFLJ5NZ>(x8BVGyB#rX+m1B3-tK%J z5vh6)b+<@=C%zuGES5c1OH5&!msZB62kL54B{8f{yNBtEgou)@JINUCl2G!0YDH8O zJC*vs59t{&fZ3Q&i*y_5qFtrfn7gYUoc!TDf#A^v`m%Ga9gr$I zttQ!q#S7^AfP@1XoyA9QZT!s~E(u`%TL)~6M?v@}Q8- z$rO&fhJ*%64U?T5;PJW9I79_GctJwA?eDi*%~q_(`CwJG1@V47(}S^bGaGlgjR_{} zRYqgErX}h)vK{ax^wjz6IlcT>GGJ8v&F^wO1I~A@3KKSLvF=bG2>FQaltU`H(OI`k zAbUL#HY9B5f&_<^vFD;OxXIXK8|c}zhu-M$%5DA_q!szROeZYXgDdeCryn_VC-T^Z4e}er<}7nZ7Fb zbOWX{+rA~`ejY>9cwbUZ2oF57dYv|wR$|r9W4)A%A^h@&TsbfZcFQx9du)~I0ncm-9^M#^ zVKa43-wt{sz0OtX9x_|75iI~H1c zSAvE_R+WYV^QvF#2dQ}IraIsIVTx2W$rldSHT05hOe?n2o3ld1o3=)7Y11qXn@SFh zJ0nym?e>8uou~E#`<-=7*&%2cO7mK(u;B$dO%?}%JqyybPt-MOA6+*!9TcxU8Usjk ziV^Dpn&U5gE@kG}W(2Yf+u||+`ZcTaWj;(EOw>jjmSV4NHYsA9TSS^PDg% zIF`DQ#kyH^JyGOTSO*8mbR)cdxm3fsIKlK$T#9KOAM~qmemQDm-3zE-N)zJ`1j7;*0 zFfvUrDUpW+K)Tj$5Mk`XngNX4y`AX!u_P|a)YDn3&xdpHF)|#1_Ag-F~DSLH_{N z#wcz@WQpV?PSKu@6R};QKtrTPp4YlMD3upvQcQ!pFsYX?dm|zVxp?)?x{kvnk-JO2 zkO3V=g!JUh%{S^0>)H|Eg%PQmz=LVIv8^;l@H$CcTK!4n?DQ=e5p3HLu`Q3QD9QNc z)SD`xk1k{hKetXUA_z2!ShZKvR(8aOE-nupo)s?_B591g!QeUn1YeymC(fuwm~vl0 z|6#;sfCHNdr_SR?$hgQ(up}7nZ=04YN-_T^GWtD`a<(>PmM$b|&3iz+ z{NQ1xbr~OGytZwq8GM<1Mq*XqgW>t~Ov$XIHJ{IA5M9jCJYIf$fVG6KL@u)=$Z!X6 zAmtDymaZ2&Q9IVp7pD3kKO^2Si(kua1sCutvcJx1N-*}`W{}!6PJ7z5Mvkp|oy6UE z*52|*h@dGq`h*Plka}|{8=DifN|rTGixVXLgt)9NbFIgzPQ-`B$sXmts9laF)TFKS zR5GgS%AVLvXL8x(?8NRwelp>33?&7FiLG&lREsag{r9Fj6u9DGY<$7t?+$>)G}{dGBy&ys7O^qlYnfJ@qNOFO8nbBi6`5#V@Gxsy zT)^2ikLl<#egzxUJoxqEt|?Dc^$Gi{A<_&Xe)3<>Rx!#wSYnScVx}jf3&&tWTu0C5 z(4>YQ9rvijF-0p$ncoqjNPShs|YChTBK7sweqNs_!Y;3mtH+S8k7=O8>wQRcm-kcqyDWa^>-Jn;lcpvTLg(w<6MuI}g)7?`V z?jiGgyNj;-oKm5$1s-qq3C2nCU-~urS^5?F1^Rd13*MH;y^VM;xi1hsRYzwjD z_kMbME+KEGpJd+vV$ZpPSnl$@?Z3;(*|jB*Ox+slc%LGaN7#MscC;`yTan6fh}?ec z*#@pDIEs(pk-8=P8x+i$pJsiz+TODK(c_XjrYOiuh*JDF0RD|qL+1{=VCns zO2#;QAaj*O$9L<=Aq22_c|vIeU;~E*0C0gz0s#2HBLM(H;FACVF%TdKKnlbZ1Rw`e z2txCK{}VV1F^Ehdy+!k@9&7>GTzZT4S2NfFavAOcVM=pAHcBsbZm^feb(a6B=?vh*&>FXh4l0A}nCW4-p=4?T3g6K>Br} zo;?T}gl0K}++Y+5T7hDoDR2s=Nj}Z>YXPcWmPM6k>t7(p<^Sl4YW$+mSTeEr3&sZJ zjt8F}?(c}o3zT)yQ&?25Y65@cl87V(hQ=W(AV;%+kO`7V0z*llVo8YNNJQcSCE}`w z$;)q`#=PTV)j$xuWw)F_vr(Qhx(~tl$genmO+k6fav`H_{R?b4&DNQGt#wmJ=1`X> zn3N#+70F-W+&kcPO|M?=Z?nZ_O{cDJ&(0m)xd}EV14uole<1J)Y`HnnrQJ9NNz6gV zGSL#=aRCFpC948dxahO*{gK-db7;UN>Of$aQCneWcJI|rL8>kkK1Dz@pu7K(-lh1$ z^Xx8&=YNzfY;a4`@C(8Ur5BcO zm4>u#3PT57QuO!f~MbrEHXjv<$;l(B;wEs*8lou#BpLjwGhRJ$BaXJ@pwm*T3x)p%b&^Q{`2VHqZhaxu+8< zqy?dOMQYy=T@%t?7j2*Y)&|f$BX;kIh~b?6-wFZk4bk=m1Jpx|({)b_BBvbSvZy;w zwF&AwQlmVYp>j}jmWrf%X5A*N<{?$sFy2O}4*;VhMf~d2j}hoPlGht69`^lf{2J)u zK~hn!S|#|cI^Y%PUV?G!sQ0egmqdm;4~`Q2#y%V`NQ$SSsGR+wGjoKZ4qn=cz-2 z{ptQDaByF$kxQGS*W*(~Da{+-xh%>~CI z9%NgboTx4YXM@HbC*!fCF%D{hppvNI2Zs-~6;8|mf?}x;3epYZsD=a75`E&jx(U7cLuHrq{-h6v!8|Inn;1Fp< zB2Wj|z=@`jFWXw#HHqli^6?@CiJLbn{XQRiB?^nous*e>ylA3AU1!d2t2t#Vv)Hmq zYuq8MC0d~RcD0hefcp|x=7B>1cMs&TVM9$k&GBGT=KC4RGGj7auU8(^&V-6A zB)Y9!qWgv6;n>14*c3@{z@yqX)rhb{20b!B4;{+W5w7*-G}adDVWBik+a?_NPoI?& zPGi){0(@qAmABf(=cHZa9d;_clOm|AI^3nW6Ara`4wYz^D}_&VG^c z9xV1AjHqlYE6gj)^2Eu4HD8R-Cp(m{)U>g|Wf_NNRAVWcrn(WC!biS%xf{$%TbWWV zDYSdedv^GwvxiQ{JeWG@sxt-r$tBGNo}r_=O0v9>qo>5Tv`4s!V*@m0xZ#srom}(6 z3B4GG;jpULK`FT$WfYU8kyVP)mqC$TdB&2-L}T+#Ig1NH;HrGeNwHny-^yu(j*uj}<`X=Rk`q zVRB4l5$vFI3Nj}Dwr;t@l(<=hrItFXyj zxWIp|nsG18p-#BA!Fw!6-Rp~cKbe2IBdm04Gg_sAyK6AQrDkuxiuFB42G4G>47W0Q zFaxOKA^UV9b0I6>2K4frvT!OIk~DH|fBF?TV-e5bF`E^0Yib@LoGx5ntXjdoq(S)v){J+YIJG{a*pVkCgtrPvCdT+Wl{MoQ?fDW|Gp33ilTA6J zv{@60^~+l14_nbmIjo;*P+rRx=zbW8&s>4)dEXoJ3SsPY(1XVKv_oWkC`Xr`oU*SU z`F0U}&&oNBlIRf(+2r`LWqmv8n&u-|Ll%R-!^Oa+Cw@Unzu)KmPttx&A7D9W$DL`y z_-K<%lQv_;_H@v0Ngfszlp6JKH1nU|n)S-zlD`Q8(2`^A0Hi=>cIN-|Z1jm+4G&;I z48HUU*S@Glb&|Id1hYa5Jpa|;15#$BR;-ZQakN^MD&e*o0cZXc2Q>X4G8$SYi=U7< z3pg3Y6;oudRb+5xR{`bhD~Ltk&9@wNAbU%;nbC4>r+v|x0j+5Yc|UY`j5Si%9Tucn zSO+#}W<*imN`N;Y5nS>j@;Nn*T=oHM$WEiceu;*@v+m=Ixscl_%x7-vWS^^mm&Rh; zxQ09NjM(`AgV6URiqV2oqOjad)Ow~dNQ;GZyP=Qjg^=^-plM^~$9UNl4qM;o5>#RA z6qT^&ou}`tz1-idItw- zc%HTRXFk4|j2V&*OhCz!e;-340Hq_orU7KDt&4also+VX0afJ45(fXFXGN&Wf~oZv zw(wu!&-b*{***wjZwIn?qcOsy`b15(vdQNe97=DzLc=+_JRqZ9@Z zMkgs$zt#UH2Fd$)kLD~`*L$4!T7U{+%fDuL1nVnmkhiN(y9U{U4bNeG+~~r~h+Gzd;i;m8$miEsBK`V^yyz zpM;EF6tIKJhSz@+88-Ozxo+RcpZFs|;(3;O&An@&I#9WGzfPmdU-+lwj0Rq3Q}%&J zyKpePgV)uEP_kZ!*=uL>Ksman^hq;%^CTXP`u2Dc1=Lb$|DC zV{J^O>E+jVyJ`;Zv5`2x>d{!F1H|k%MFG@kuC?Csbc8|9!+X8^_0C5g>Hq=fNqv$O*1-!|L#;JR>jXB{P|0T0Y^ENKzs^_N-pSq15hgA@9TyZ@ z)k6%BZ1G5eSmqO7F78Y-gneEnJ^2PD+eM3np!+!~Bj)mho^K;}mAho=OESIeNoUkB zg%sOe$}foaxv$0~J+gKBSkz>FOvZ}-SpwK4qB4{if`#72haoGf?{vTvb2G3cMxuxNj3^1mzYnWvv@ey|GT(@n_UXzYID zL?qCk79d!gtRRvkQZxZ1agxx8;S$h+M#>OEil{k9u>_DM+nhuG045j*IhVgma4*f&B#!6RMDF6=Tplj{34t!=U-~E zjKEsSO^dRaIXI$pVS!?fVUA-?V2)7?s7FwKp&e`Y*tA|)r)I<6t$c{`Tf&N zJl5F1MaVPrql7lGHFk1#O#WI{!hy0fCp&0UMJ=I%uURXt_2-&Hm zA9oy5qO-7pd%k6c2Pn*eNd)5=OMwEXw{Gk2JlXY&v`Upcoq7`=KR5e7fV1<*-@xGA zJex2Bt;^C&buxxZ6as>I$U*LK3%TtumO7xR|IRb96p14zf*w9a1Q#UzxMx@4ztS`P&RquoE0gqC+Su-?R11$E_I7#Y z%8N((uA!0;jgQW(UPI;j9sFBfq*Kp-S($5I@PGa||A&>)iCeV|V1Nz2^a$5>O)DMz zm6Z=2<`~0eamum+nWN8@&z2)V|MCFCcFGkabjSJe$q{C@O}BDfic%-1bV%u%TkdR7 zU13Ki?$GO0fG3|@d}B-aa=2LTV7l$K;BBmiT36+R8Dv*QIikp-a{RLicwdl$j{rp@ z@{81r-~tYs^@>jF(k5gvlg_GUnWOhb{kDHfyCi;M!Igxlp5-a$bJ?hdrSl6T8waXr-!e8*FFLQMS-+xN28xb zxOj@+HnXI%e!do+c%97{K2Ko2Zv74YEA?KchE341^7m&|?)7&LBhc}@|C$a5*ndt? zR>uFlkI{)=5AS6_47z+pZE@Df?~+8#-%oePmtwHn?YFUNpE=S3VYqD&_y^AgV**R^#$!Q6kqnV297vd_v4J(1fi&S35$d2TL=fS^ z{UiYBaLE8v^KFU)%u@@*Q%0L=Cm6$f@X&cd$t{W%zojwce%+KUQo)8@^rG&5T@Dy8 zgI+kYtGMn|L;qwz6UnxTwlf%gIFzp8o#0^eGe{txIaydnu^bhmWlVDq-~^eE^)L`4 zY=g>uM&^omTS=)W!qgD_Nm)MTsG^tFg6wD@1BLz1%+DZvN#mLFs7|X&1T>4k2XpS7g>~NQ-0%_U2JFFe{Vc({MjLML&ZF-iAcfaY>i;&#ymns(x$hPd z2k2mg`tzU_UF7Hm(%6bU$@P-0#kKc0Q6a+n!h&TX}Vp>BG1Ra*Bs!-dm}DqNJkd)1qv zl$hn}ZCxB-oQ^e$$#nWkOQk_H5geVYV+a*7}2k*94s*DPVHe-&!?tNh-%&&bi+f zJuKwNIJp*5Bq)XCg$Wk2tV7PvYNsn{d+yJ@C#+s-BGLYhW}ITxl52O=aabb@pF~t} zpPauBx$t}*I=g7oh$al0Ygcw$#w%R{BC_;W{W6aJJzz0*0JdcDdq}+GT{{43llwiS zIKwx#ScnCdXR>=>EwK{V&bCB|zXG4P(leCNdKMpX^`#q&%WYG!M2f6Jy%9gEK)prm>K7SN z5M{W2tn%o~BPZ`19E~41y}+p$l{rLRo7sy)s}}^f6sNP#p;UHjLcx9%ZeBLGRHrnl zGaX5bJeM3(40pCsa`UB-eY1cM#x*LCt1=?h9^8%e#4)=K*IzqFmajWhXQXq?J0;n9O?*dQ2rz|ca4Tu99)<J5)px7BzD4J*u-zc*(oNlxkpBKWi z`@Lo3vN#V}Df!2RVcaVb2&1q%BZz_u_-At`ba04vQdUIfZ3-cVvp*!5aG^Tz(ycp8 zbbQY*R_Is?0nah9C>-8Hgkk9XPF+` zFbrTT6po>w^JIYU)0#U_H;>?(`MXr|;khV6g6cmh!+uVW(A4%O>Kg{@YYfvTboWiF zHH8If2bSxD&4V~g`UeGUN$q(euMETT2@pcUL0KbNhywIf3|h2z5m^eR>+}QGP%}gf z`)TZ%T;#H3e6u#`_%<_u6JME$1HG?r_tuk7pZAL9qHm@q-cBkD5L+DEn_K(3&sm6m z>gzw;9cP2ocyFP*c_%?a$SvTI^Xq1eDUs+gC{!0QsyhGHf_ZIf+~9tlYYnwuphFr9 z4joYO8>uTR8(6m)17eyJBM{Af#30OZm5CW#-N}P&kb>N&gC;lt0j^%c47?&Cxm@;L zH@J{^5i4Xi=eqYa>{C)3=Cl^4_4g~mNYRJBMP8u`Dq}x)ehrO8dhk59^Ba4FHY~A> zKJw~7$c4<$q1#A<(seYWemM-Kx}p$T7uTZ@Umzeo)I&cf>S`no+t`cv)hhWlQ+Cf* z&z-$6u5dK5r{w(vuH>WHJS@_cxbjqHuG(z0Q_6o4BKuRe7xe2-JEVM*JY{pigH(i)gk$|xGdLC33LRQoBXYw&W=9WNF&MY=8@|vT& zlxm|bqh;=o+mr6W!Hd9_ls2TZ%+D1wWJNBERgbh46&y3QHF27AuW*mTnzAw7R<#Qm zj4;}-tZ!`t5|CV`F0D_0h#vQi8FJEUu0^1`vAPtw)Yf6EX@;GZ|2-zIs0%LwubNZb zDB0z9SqQ#oaf&W&t?^eON2o}qjbd?eIeC!X?U<84O(@9J{G-I}dg3Qbev0a-Br)U# zvt0WjKg=6{GRygbME2rf2 znhRijymGdNBJ)phe}VWTSk~pCdHksJaPFQ#bOpWWtjdw@4vhJ(;N6sp~)Y<5S@FU zXZ}u+=has0W!FS{wy;q-^B@2`>HS0EJI%DN(P7`HyEu>vwT79yTw}gYp~)V8vCsCq zn>)T?QwF|b3pTQPRA19M96d8vwCG5;;y<=Xm#V=uF7-K1D=xF2hvml^uZ%AadJihW zue2}cslekm{auytl9shy84YSED^i0BlJdmBhO;_VpM@YEt7|h_i1Goy2Fz;o?+b?A zny~5?J+?F!HLI!hZ(_5CO{w+0Oh%4ID`f6tmR`S_wAsLl`pzdhmW@@OTlOPqXIyQ8 z{;R08*5QrgBIT!tlYku$-8V414;+z@C_Ze@oyvu^n0V%!g-U@`%KRqk?h&5iso;50Avm zspI!wU5GSa_o3cfP@}BSD>=^OOOdHCmDEZm{w%dtG?`;h?_9o{D70hSvmRcKi6Fud zrVG}FZNYS8+%p^=_?N&`_^W(3{y(L@niNJ0So=@?|7TS&qX*A;_He*y^X`h7M6IFC zQbMygB9!&-3i#jf|Ayj-$c1HtGhml{lW43*{y$esF|@uTJIOTvQDqKP0Z)fqBQPJl zP{!}mUkBtLUNaqRTx!N;q|G2cbM&w~Y%ssJhS}7!HbftFp_K?mFSGi$iP=@tzg!=> z5`kTYN2g!BkEg~c(wh@Mbtk6iWxI6V_|OhTqJXaV6R+7Y)F0OqZ+Es1w|jkWeURnh zlhyEXq6z{yGw9`+)j6X;sLd9gvdz~8IVbNuU7qxI-Ldlxn%#%?2XLj%km5)8fuuvH zwya5rso_VbOgR&)T{-egx(m8PD!2acPO-kt5o(H?LwuAHR+{^7kUI(>6fd#WlcbHrv2J$Z`$!Zgvm z3jOeQWYhN0j&D;(SNoS6)6>me)AK%Ume>39+_0nXK4V#D5fluTOUucaGNzQX%PL`4fS|p~J3F28c)xNcYTt!bga}qW=;@W+0ck zB-~02??F*&>CTJqQCOgWQsvSOi&sig3!*D!wJ=2%w=n&bs6fNy96?r)*&j|QgXERU zTp{{1ir|Z6fTrMd^8Pf;nSi**65Smh+SwTqMx2zV0h>Dlggs5B)HmG#Pjx+T;!ixj zV}^lRG|C7Pn%h~UN#yy-I3-_qiwbsh7w`>!F2)a&Lbk*02#o!{xc+I}w76ApgJ&{h z2&|@b8FHK(F2j`Xr;bFO03t*y7&{DzAUk4Hi?;qZ2PMwuxV=zVbiA7v_WN9h&OU;h zjs89Xd|wGeAkUJPuW1~6Qe0RruCiddeD{w9HA&gc?xh{}Wxg@V^1T7}i4dfHdJtx4 z^nm zV{d+K-d7(U=zDbg)qEokNr5v(yY2RXia-n8hecw(bG!GT_@?4Nv*RJfOaePhN;c-m z0k;X06{ezcxi5n~MQj}4ZJyaUT@dv>phtS@#u4=mR!JGF9;#oauAhgtAiHN@Nk1oY z*7XJ0<7T@H&vr|qZL$7EE|h5B1L>1OG{#vsZ7Zq7A)ZQlh`Rk8cwdw8DnNO%7n<^W zj9QWYYzM$6YohLZnV@#$cpy@)qE$md%-VB&gRKM4HhM`w32lLMYSPRF+vEr*#u*(l z6r&~qOCIvx50wJ<7OTgIGMKxEXbsSVz~@NZVzsHhs7?oxr^r)QlgmW3&xldqeSrh1r$^mz}_Tq`J|d6?=@U5g8At zmBS`x5o$mq#Vn7h0Dn2&|3Vk4fCymiGT_xyf}Y34AW4YBUE53R{m#LqRauf{)WGTS z`rOo}8Kj#r?AEeHwwbjtc{;Dg-{J9manEjdiu`bXJYT{8;_Bd`OTe4DnYFI1ZFKxM z3U2}YEF!*1&-U^lTUXmh{qOwcP{b;*EuB6(E0f+gojO` znyCB!e*Z1L9MLObI{wj-#ObCJFIIWnEuyQP!^6dsw`K@}y3a*{Y|3^DObYs4BzS); z*3IGuUGaU^z$?Jt>;3(0XP5uJ((KEv>0{^ZB73W;%6xOw@>*hcE;cYCz5)#x5EG9< z@fX8vs*+E4vd#DA?dI->rAO~Q{*hias+T_~u%S7V|9C(86nH9qdCk5RASywSB_y0G zgbvLeNiCK!hTLwmb@F|Rp6>9z+PtdhhE&R)AU*1tKTbT5+ z5b-)jNF5GuWJHzR%R#I=N|EB+Sgt*U_fg$dGH0&|3KgDkn%C*9?@#;0pCy9HKZn5Q z`;f~{cFL_+gl&A}fvS|yt(C`f?FRzFSh?@W&m6MEYb?XUCIZA5o?3?Uxhz5?EAbNFIXhoZ>-2n|HtlrjFVKY! zb_smn7Vpy`k#$UtK~hK&Z5|k@0b>QS)^th2qw+jn!PO&amw0+QV80gXQnf@T9pbEw(=BsaUQNe z9Vmc2kyk?mx?{e+PTr1heV$afdJ2bCExGWOHAUXdPB>~TY0~)5Z+j&l z^aUaERDVhDD;*o>+Nocxt4hX*tWGkS&k}=X)k$GOivH~GUS@T8e@u+2RiUfFoOBr? zt?n3jeG=0+7SM)-Z&E|1Q*^IzC~^+Qr(s37wT>H%Jv}B7LjV+nDefwu$MbGk(`mhr1N+W-RkJs|&uT#8 z=grM>o5Ae0XwsAf*W~;@bJZ(@1i zr5XjWo+xnYoZL`C!|!OKNH|L{p&drz;AluN58;NQG)pkyLB@55XBU#SZRD@38FkA) z$CvM{CE1qG>@IzP_@5q`m(M&-hm+%(9tWwA;vs$8PY+r}dCLU2O7^u=QXvtZY{1E0 z4~`)Y+zLGS-KFKl%MD52F5v98Jr^#mPlLn9tlsOwmcg@khFqB-dFyl}{+%HRgdrlE z5nP1*H%X_Hg65Qb@Wy`CCG1swhQ1alfw&%z14p0v_aR(smBGC-xss9?PMvmTv;t4CN zhL+pK;)yuCYIk_M2yv~VuU>3@q1z#C|E+dKrQ2uO9>rb_VYfru9_e;Px6!BB9_{i3 zLa_70`}h45SoRLHcNG2AS9;gp#V3eO!|$DakAv4mx2`~(Wxab^f~z0Cy;Dnjw-Hr# z&X?5NN_t07UDGJOf5_j2{}i|`5gdB5WX#2RyEGqr5h;S1jv z{++5~9d8~dZ-maeoDU<}%xJZ-l20v3ZsZEvAjuvlVKn+-9)Cg7dC7%h6OT_aGpPMJ zNX9GKimCLdm0rAfKDmItBW0v}*;K(;|G;qI)n_xCo}bM4`P571BVqXa`4}nvj`Y}Q z{IY2|pFmP?mjyo^*dN!AZ5A=Xb}Yx_=jrDVEWYeb_^iKshGr2jNFw~3`QkJSo-B-g zGC^<27$E8IV5+)I5@np?Fu7qI?;f{3*kWAr6Int`5n;f90~f^s%rcb(H)w-2F^wd)3s+Ph@S5WrIrd>9!O}i?jd!cV z#s_4&am;V#$s)a}4w*Qp!DWtdvewt9gS$VJ`Ug=Ub+lvs!V3koIRK6E^LNH z2LJoZIj1+(7zgl`I(?it)ieWWVG^$$XT1we(==iom-^Sqo^G=5ImJx-ywfUq%IsNV z5Dm*Z9-O2FI5>ZL`an-IKuX(bV;SY8yFVUfi@1<5w#wEO*|&xvahW8>QjsNF*@l=jjs25Uh%r|bO17pl)*)+Z z>}GNasWD_LM$*SJ24fq`ck24y_w~K+U%vmsdA-l;oacFbKIc#xXy>YsL*0;=5zn`M zD(o{g-;^5^L?*fD$8!U-)Pbwk^A6JTIu#{nN20PX&j0w2M;_=t&|EcpvNP(2tex*8 z)WCtda{qv_EAGU`;VJd5L-frR)_qg>tAU1{)jZqYjG1E|Eh!OQ4Ld*BHy?MaSGPCB zt)cT}X#f2P=mgc4U3rh@Tn<8^)qTfa?jC@K@x9k>HvQ+a*W(!i`py z`ZK~#U&zMfF*ZJgWHT#Dw_Eqhh*pAQjaf**&E}b6jKXZH@iM%Q#Z^wh8XHnnM6B(k z)}DoiEG0evt0ARnq2D)Mm&#i2XsBPUD@O#v5ZglebitTp;-Y?2YyHqI#v;sMl5Z<1 ze-Y3%kY0P7yTd@IF~__~tlg{mg&I;AmVJ&)x(#`|pw#xMQWlndA;Z>PX^;S$F<9tJ zt{bpH)}nSjp4xJsx#q~nvBUOh@^+8sT>1%@rA*ZBoUuWm^(0#kFzZt(KeOOaPd1QB z4Z*U3zR$`dRa3EaX6Ep7m~}35UvnK`&6l1?{`6y3N6uQ_DNzbRWE+Sm13@MUfKP^2 zx<5H%g<&9|8fiTypr|Eg?0eA4S90$DSmhh$xq#5Ymkty)de`M^;#lao6e8}ftsWSG zG~w~Y;jAExRDYW?TfL6~&leJ6s}#r(gmsgLqhg{6*~#Hb2A7g8Ieh1pEx@Z&hmu0{ z$mR$gMLCF&k4Pml$;*{^51n}BG4e9BRmH-Zvq&$OWgu-O=4AqSUd@y8WW~)NxX8SeyYWW@ zWbiAL<*m)GG$jxPI9v8y+WD>TLVFRJIY3r2`) zPF#I^+ZnqyYWb!PS!U}TrGJ?s-e@1qIjr^&AKS-_ zzFjY}D&xCBRswg(?AiR0m^~W-U_6=qoi}GT?a#9?sYEYXGCmEor=n!ik_jZ4dB`3FcPNF_dQL@(Auku(y?p(Tiu_A`M0_Ty{)f}M1b$U^3!x~_oS3C zZ4GU%p59@_;tl`#ejWETwJ_yFUPmh0j=E!!VJ9luSq)rYt>Q95? zTbndhZ{3dABjWRW=EM<`RCuK<&WA_7{j5ov>Y`F!+i?@@FP)YnxHKn~|EoF!|CHxY z?$Zf#nl2Pg!tx@QX$O2=YL+Qr+UdV8>-p6t<}Q(WpsABLCXrDkYW5YrbqAElc`A%~ z5_(Yb&ym6A+@|3IagP}*ktppwd$sv$!FDZKWAA-d zKK`j~0du!Ks$_th6!{_XXm6oavgwcr+edws!e#Vf-@58c!a%icfqW{;XdhjhD{)dw zHZ9qR8}1{P)^6t z#Pg1^Jk6V~$c>CXv4n^2tp%bN*sK%bJRD+cz@|Mth5nzN5PoRrL5Qt;P6;gF%`7q4f!t$Q;|T+&)lt zysK#VD>}1(_(tqJNA*M+qDH>mZ7RAepKc?Y+NiNw1y|c3zn)@EDN}J>FqaOfO~4qA z?~LP6U3?kbf5{v)aX*6$%{-s)bapJ2_PPPf@_bR73N%8Hiw5KP3(XAgboTn6`g4cP zPLssfd;~H-y4sarO`AY1;e)+Jc{7?jF*O$pGIwu5+Zvx7FNR4aopAX69tC>QM)ROt z1GwA*yAILpJ7BHdhcBifhvDCI*RqV6^R=8UhPR8wc|ojQdcCt)S&D)iHDX9Iz*!&eUm&(kf4xdl?om{P&h6F%J1gmM$KJ2gg$2F zBT0>2HW+VxQw9i@JK3+LMN>f=^aYJmtc_ZL+Fi9LhT1 zGXBq^vcFR!8-A0-FUWEF+pg=hw>eQF8*1RT%YFFbv2tRu8gpOXX}NYoYU6E?2}r}O zkZ~yo2;&y9aY8qX);=^mdtgZ-Z7xTo&)39xsL%3IC;y z;P3lg(St~z5DV+5s??NW!#3vT?lz+3o=Nn*QeeDi35@TnN-b=fq$wvZC6bz!TGbA+@z>3Q{W65^uy`9T;K(6AwpeL~5Z;H98ZNiK`X8nhr6CU1uD<&N zw%;ib`_hggkR6WBwAna#7gHL0-!sRdmgKiOXZaiaCpu4{1A|Yhq zE~s4d4SFpX=!$mY^VUf-_jtWIprbA5@1^U?c4V|C5c+$yUD<_k%!~+L^tD;pfajcz zVL~JQ&|6R;%EbAlcq+%eB_}y5SRL@|nSa;K-1j<9Q{x%A5o&no6NI9z-hRETgjGdJe*1#wL(5nD z2k}vb4%GTZQ`0up8n8Yto`^a~v1}d=2$Bn7fr?tmw1elAt*v0q!Kw-tBypB{bruWv zQXe~YqN&|#sfwyll`KCVpAcwEK`99s3Bmuw71?oov&S&)1)96-xO>7ZO0ZnKxV{S5 za-@pGA?1Hpsd9)!X`WpL^NPko%XUOIt(f}Apkuy&TM-+R5XzJTP4au7 zxk_rq=(_iXG$Qd!6t`c0iSa|AA^;{M-(oQ}{02|pta25ENCZ56S!KS*0M1g{2<~!C zKX~qsZO+w{BN|5$@Lb)DF3E6=X-cCQ$-UdPx#F)q)UmV9FM5^7cy3^fZ-a=;!isOa zRF?(a*H#y~2ybxYjmG^q&g(if`^snbmx!`OO%fqyGfnt#i^1EH36&B+q$rx-YC=jD zF&hL1W~X#cHNL$0j6B3=bg?~ffP|>le$p zDlF*)qV3AlB^+fQO z9%>N!y+U1C>W`BltiXdM+V5ko_q=fb<}6%vVNC_riD^d@ke3t*Jp|+wPt!}57%O`9 z*de~k+HN3_bj~9QX%D+qad9lC;#u!VkgH~OZi>TT8yb`#C=%&m$ut@2;Ac%f(9WTK zxTZHJ0;h}*9MD9kSSrq&4&`qdu+BfdryC|*jv=f~#!=^9EO=syJ@HX&d0AyxO^(Q-VDz@F=+q2y7$EhA@X>STp+dNyMB*M zjnzES&*QYVEZzYF%YFRBqkj&gN!4GN2aa(KZXMtl9~F|J=6koP?4iOK+> zdIc6_FfISu@BZoopy1+eB!9ONsGCpcn%pMa#1O3a_4MA90ArE-%V>;qT z8bf99i;lBR>AA$EwRUeGM(ZrMYg(e%uyRE>0NnmsiB2j|NLhTME5 z3>lsDB=j+SoJ$;~U(R_fFk?rGquH}K%UCge@KagR^l9{Thxf62-bQXfseeUnSYYw6@7G9l@fQH*itDo|C`Rcl)(dSeKQ0GwiX8-Uu4r(|nB^W*l%? zPmonp5qlDj6k7GuGy&Fcv1TEICg)6Q^PsG(iyp?{8{tAfb+qY>)T(dDlL5wGI$-fi zHyAU6Yjm0o4M{lH(iyr1v+5yk(MT)ow||*Fn)S3bF7_<&`!VZK&3qC)DEr2bI2@g9oJsJEoAsi*&OL>uv`{}rCoeld0!~UjAL!bXd5zNGYp$O$) zD54ngZxo?a{R>4>{y~xBdF}t82%z%sNujsgIN3NtlHq+~9L|yvSv+FeR`iQOnp!vv zGT=n&a2~o9x_E*!DI^%48W4=__!-3j7VG@(R!5V5u_4vbK2&dpBxGm+CuND=39)B* z&KwXVNsFdNWtIssJOw0%(Qf>QdM!Ancfmk4{?4HUaZ( zWg%~TNd^~Xj9}0L6_&%GpvP-zPSZI}mvzUbI56J)z}87L>|;$2AE&wn&Q|gddI?;! zB4O$dU?y);WxU@ob-~;+9g|z%BKXy+xDn6Bqd(?cDqGcOOtU%fJT^MBr&@|HijYTX-(BjOPqk~fl zheYvOLdM=o=K8iGH^Xu?JASByeG3Pg8b3})87q!tZBg?>UA&gR8MS9o z*~?fi15K@Xi34?cf!st^Jz8{nJ-vPB8*zIm)FQc^xw~z-b@P9JD7fmKb-kZoLQq#% O+hD)4@*fDR{r>|buY*kh diff --git a/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_ru.pdf b/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_ru.pdf index b78345eae2eca95d0155699902875e38c32756fa..84719af940f56e96e63e17499cbe1b9781da2bbc 100644 GIT binary patch delta 170206 zcmZ5`V{|4=&}D4fw#_HW#7-u*Z5z+Twry)-+t$RkZSVW-{@LAseY)#(pT1q)b#GTa zhLdl-kp1P`24zp;-=;vHVwxz-3bl2{_DJc?yH8@9+j2~D-lhSzUe5v-2_28y!>;Yl z^?$LC+d&5gpl)qk8Pw_OGj)Rj6hkMKp7?Y{kO^jsqFTk;a#cNxfvC#CKfz&sHxEK1 zqS!@16Q&=0?Ee(H zvwX1vNaBZirCz|gVo?Q`>;*40tK0+1JU{kOVDDFv3fi~@B^tMi!pp7!{nEMA9@{=^ z@dKvuMsLs7kqYn6GV58+^|!{GDemY_uloc}Y0gyd&&F5dhZ%HhfRi0R0oucM3TdbQ zy$mSeK@L)}P2WP_|HR9Qi3fTJTp=?k#ucs?-ib7k>;V{_$hT-QmCS`nnXwQeg75Md zEn-0d%wFZEkn?kn{!Y^82F%rFfvzT_-dcEL5|Om(MwsgvtN^>@Hxz2ZeIck>q;xk; zRXbj-t{$@|mZw6LoY5@vu3sBmR7jXl&{>Gz^z6BQy5npp_3h=Nmwn#Hun%`L@2I(} zQLI#gyDLx|4=@tuvZ*aK!bbVn6`!byA&oFRoP0s8-IGypLH7r6q`$Wc=z zQT!xaviesyHAZYPhGb@+siv`+1Iz4-(nx1VNOj!1=0dZ3M%MMNjeH@K4wUbSzhVDc zCT+dQH7Ipz$HVK&fNVOwC2dS^m1jI!1(GWqysj|RV1KB{`Zg%!Y9mAL3t?~`v9F~n z-~=Q#(q^SLWUWRvdXfx~_eBWT4kVUHz>ve$(xT`wbmmG`E># z&YG;k^Yt5nvp5c?!!L**)Dj7AuTjW|s_8A^4ICw}FguAk{wop`u~c}bNBoht^2V_l z-_Fd=#+jc9Q~+YOxqZJGuxr6FxV#X0@E2GFs?L5AIeA^DrnCatv{$&JhXIw|>OFta zPSq27v(3g?+v3z}0j4iDo&))8M^7U`fY|DIm#Dde+26@rPialSh-Jd-_60qD9SZ9+ zulm@#8%t{smtDH=5xLC8fMXR;@tmG5|M;wRc^^^oJA2)HuFTat&C^(PVUPwb5*Mg4 zU@O>XHdVkWG&($$lm9@;+k`6#1KM>`HR;S@*JqUdmGee9C!v~ZvfBuMZF4BE5`eQk z`_M^jX-`0ulu(#Vm8Zc&^hb)l04CuKL=0maowE4YA;kri)?J5`aMs zlVi#^B!zCOP}-M$`Fijd&tq7-_7w1A(wsa~`Z`2n+|6pTZ#-t|xR~vNQC{qcS#T#R zUh2~U`=!ee_JccRnl4@8l_0()blFmci>aau15*Kc8yZ~SW)Dl{s~vL%)R9w+AC8HB zey>WYfkgJ0!pmmQwp20VD-i=7xw;h28YtImnngb4I=$WY2^Q$46J27qYzZt(eed@D zVIY1pA?3WFlPO^?sLF&LP8Jl(ugbPaUCCb!(FDatBiR^e1 zr$5g;pU*A=9ElvVJEKAYHr4@%frA(iBD$}ASFeUvBx+YPd(64tNq9pZ@L9yq?Qu?V zOhvA54IR}Phf1eXwHe%#5Wu*ZC3dp_i-HEx_i$rw$r0#KQp@1UQA#$UA8cI*@MMVD zc({DliA+5xjzP~6dbSuic@leStJ+H)1v=SdOKl7YV|(cmee_GBY~I@OR?S)VE!@>hV|KnEQzj)q2XIgWw^zcD>gipT zz&CH6{_0<>l-B7CVTFxQ3Qv0)cuY8>g;g7#)`@e&aK712cfefGvEk0y=KJ>Uq*Sd9 z`fI@n3X72lubknDwG9k<5w?b|xR7#E(-g50-1>ZfY%B{g$tscl61dhdp))@<@KetCy8S;1*fe+2W3=Uhk7{*t-?7uSc|GGBFB z!5%LfPZ@S&iG=TIa+tNdHq+x7I3qRSz@PUa4|)*#H*g8%l+8|UWP3DaWh!uEKy6Fn zm^scG$#OcS*sa*RJ?g?EqD5JA3E>sP>IN)7v=|z+nDig04&J||Vk)D`#3LpfPUq#p z!ZLP{kEKEeMjz%y^|$TZuRb(F{}QX@;nehqyQpxO^$q*(?iX=KOELxxcFEt?xV>jV zJc~1>Qb5^Lb_ttJ=Zo8fs{z+r?G8tR*api>M9S+hF|ACGyoDDRNiA)2y;4y%>2)x6 z3FSdUU2!d>WT{$Jfv}2|+Yq<=h z8y7gV4ocRu7t^G*RR{drmznI7VP-%ciErACB?m>f+{Z#cq!gK^H9k)!Ieo4@sx&`O zxN?*TE%1}#syAII{GPGae$7q}+I{~p%s(weS#ZD#$kZ4b}1uF{L3PjC&z=t`@P|CKln}WNe>Q2IBua2hXxbG&Vu++SP4D z!7Gpi05$1>a`em8Lo=~H!_x?f8UTWy$kYRb;5U@IHm?`j3ZYhwO*VQa{`MD@Nc=6l zzHQwXV@eiDw$MqY6$2yR`f@X#Ib_ylWSxy2W8GZf+u{$XpTMGJlG7b}BlT%BK9GY` zP!P_=)!EF*4$gCZNl&kipcT>YrY?Q71z9^HnFbaH;Sk&k9K#Z&(=vbrS>77MN@<78 z?a%Yh3&GV)HQ}}&0Up$4=lT}zG%liaLRfOkSZeD+>skvNmr_?omi7*X17oZFgt;1b zLJe~N%f=A3a%&=^LtxTGle{f`C6K4hp~Rg)pv4$+RNhtZV?=+{GHbsmItW7mbI{GP ze4nT0v|)UNX}!8luw#H2GCJVfH9sow!AZu-uL@Uhs$DHNQYfViX$wS^KVRLI72yUS zX;@x$u%NFW$Tp&WR|lplj*ZBJmr2M2QV?6JBbtW((wy1mS@l|Zz~igR3KWbXmS4jY z8jv@l(H>35?MQFSg%t#Y`Sq6#fjpcFYWP--vumH6;O|{B(%h$|p(kjG1%myo4l_?% zT8#~n&giMepON2>P@jZhyYOB8DtloqF}kITj zoOab(S*aB&HyCgn0EM)dQ@|E2czs&zHZNW0^`UW>EbtfphtS1aZ4zim@UVIsEtY7N z`QJo}s8%QlaOzyq2(>ErV}O*H8FEtWkiI+UnuS#n4e{Eqe6L!T%Y?ZWfg!8<)26oIuU>9z2roE=EErjLVWV;1k zJ6}N-;;}=WN0axQpSepkM<=#!8LGOxm9NIz@!Jz%8Hp^`^2>2Gvxz4DWq{oL_#q%V zrF|yoJ0&8ly@o%>ZA-{IFUA9Qm@Zy_8*y8n&X=@-m$w5)9yo5(R1njo-UXfBq3e~F zgH>I_AB;FTr@hUo9W;yJ9Z_#+kdx{nO;rn%aJUM}SZwG>G3TPi7VKf^N^&R6$#R zk48jEJcSQd9*Ai-fmIv8`-f2%JRW)!wq|^OxPA`y86*N4MEh<^T6jeY#?EW+bXTu= z1nbJ@WQn&(bpmAssYS3Z0_tbu9sVn&G=)*ONNw9_kHci(zp0?xMv@*NeEL?$*qXt< zFgs(YwI{499jz-zux7$48$xXQPMziE8e?YaMS)!SKp|0}K;4}fFkP1C+HP9H?c*?M zGELE8`yLV<;&|GD$zZ^<@os9p#jv6l}HFml^@94AN&VfJves7P{S!JzhX+prC)SK_ygDjxFpwIi6 z!++-QseZ>dOnKcy12-GE|zD9Iu}0JGd}Tx$MYl%>!#wQ^>Io!1cqg33upo5 zhO*NSbECiGtc`I%t5UVkK*`zsdC6|A7oF!z7aICOrEdFYMemVtx+gCQ&hU`b<#-aNYJ{fXV_f!Rb zLXr(wI!S_4*GW$$S?m9SFAh$)kCos%{)3 z&yqjNpc5 z?Qq~@`mqs(AqCeYXj@eWa(N8&EO&hk|H9Ob{wB_eOGlVW=?o4?O?-nduA~^d zCg~2rm|K;aqDS)5>ZW?;2g4UI_U8;e72+5tP9FW6nzgdj37 zZOHbqCc|-*CS$sGYq}21l%ykIN7uY1_$8yD2sx9TzPA3RG&y$zL*~aPS^kunzE9^U za9(IlO)@O^yf|(b6hJuOYEZxgp3}!LI#ru4OPCFZQ;dvJ%h`u(ECvsD0EnZ?hM4HT zYKoNJ@fMSrfOiZ{X32=^i>tV!iZ6uGqgw++A>ao1(?{rdVp9Oyd~$^2#?b=_mBHwt zzeW(OCJ7@&Q~*_WC}=}|>nF~+HV(IzWcTTUeww6h8CtKyc+ta7vrNLG2hw%{+3{M! zFk@`QiJJm6U%w+Qn#YqGYQg?e>5n_FOTrdBVw)dW!yM%G_Q5iFY zCT#5{5spw-_ZSY$Zk(m0GcW0%0#A`Kir9N_i~8#=m{q>M`$Z>9k`%8WHVR!u5HPG| z$oTto_+o6rwo<)I;+GRDeisc-Pj#J0I@vD?vq%D{M+&FPd5lX<$$?eGCa z%vmA}Dle_nka7rZ0qsgs?c&^V`{daEfl09jtOk`Cg&=I8o0lUVS4lw7(4*S0`ivRK zjb`>gxM+G=D~~}k$EWvj$E!;84YoZAw{oOODNQqIjXLSzga=+R>w0~9qQ%O#>_Z{4 zXk9mBooG&mDz2~0j2psjIS33zeGRO7mc-^_Sxawt;eCi!m|)SX(n%c7HWud=Chik* z5^WiY2XzKuJpv&!r-)BxlIH5Cn!UfuAy`&kjh`5WG&@ynHHI?B5sXERw~s^eI^!MNl=v0|lyo+#A`v4QvWs)z)$4Y0WTMzGo;- zs8h{8 z8^d9c?61@=n); zxC`i#@^v)irp0ibgR0gvTy}^@o_-Sj$9Kqz2q* z0^o+Tdk+R@A02et^0nt)syh zdydiT>QKh##!z-<+VCL2kPD_BIjY-5^hO_GJc~uz;r~RWVo!($uQQlKC}!ot00fIn z+nieRHuFM|&0+zlk*A7c&XyvEhh4@JsOBo%uE7uaj>O27Irl>Loo`};#%@(Wrg<>j zho1vrnrRwTd?)Ov`8k;fotZY?h%jbButR`8jD806&eFnG|M@9xt2B|XZW^`A4``d) zLpjzr4vpenduPtQF6PB%5M|^&5F@X1gH{oj`<*lL{(rY;k8IM1m2wN8|J--sO}fC& z^241_H(ob7En=W8Omryngre%k{IhU}Yg6~T9=U(4{15C|up7?27-WfA#&=)jNa_I6 zY6b)oOzsum^u&e8bWz{)*ko#1iel_#dGM@xt*AaWBBfl07F9#oA|RmTNHX~(W{@xC zwrkLlbAaKMU~^)egiZHo9`90T=-|$(wR`))u(;@4V7P26)?0CTlY9og>LrTCwJ_tH@DA=R$Ym8RN=E&xunZ8WnkzdXvufa{bJjTHolo zQG696&oM|SUPAm)56I}`P*M5&nt+w_BUq>8Z)`L6dgW(biLfU*LD}^i$Esf~;@&&7 zSQcC(GdWq;gBCZIhdI;M(X&937_49#4E{-@{mc1Gdu07UCI7I+7Se>v!cJ^4z;F2~ zA3)1o^BJr~f&Y-~Dy@4Mge0bXC!q!qZx3(50zJ zPYh3kO5U0`d+y~wW#YsfU1tMtg0+fS+s?Ow|BNC!J;oK5h$P%Acf21+_)(=(cq&!= z&adH)Dg-@VNXvl=DR=Sb!Bv9-$AjexPiHO25^j|f zg%qB+OlQ$ZEkTl zH?%{(6ey&63~t@pY)o<~yqf#)3xMYeO|6PwkKGBMR_9pv;$WM?(_0JvO2y`(r`=zy zAva*9Vk@EU$@-=I!GA+%E&p9Tf}UeoJczPjS=3b_-)&<8uzXo`a#LcL|E z|Kj1y*5ZBaFuIj48>M@lXUNtpxv{gkk+>_~l__CxNtk zrNMDaQciW%W&3DCj`b7hnzVDAkQus!`+w_q5X!Ed8P(-g!;<~aQMfm_)Rh5}E&zs) z7U#4+4Q9I}tQXkcZI_Jucdx-ZdzlsQ_5zf!HQ^xh)SHpZ93$^fG@h$1si3iVMn~`L zkSTw^ooiO@FR)vZg_cnQhNBp}{Elus`wxyCvK+xxhnhe&eMjt0`0F5UNBiAHwjD-U z$BX&eX|X*>j^nc3d~3ZsTKBLgulT(u);GBvB^3#u4P_OzuP5Xcidr63^O`$v&N5hS z{&~DSehS4iwppYF5P_nn1z>>k04HNF+Yq--=s&@0PKCSwgkpnIfi~b5dkABxG4W?j z8LPj2735;+sWEM|`n+%VgoN%{>m*X%r<29ec=UP{9=uZX(ev8?Tzc^R2jPGE4th0C zdb{0#U!B(w7P&t2-SS&eb8=1_u;alATN_6^b-FnU0xAWfsTMUCjG>{ z7l;C>AF>n#4-uoC4__04h1uW!eI}QXT_YV-x`IcOq7_7VXeG6yq6ZEcSs_Hm#LgwM ze#bce6)UO$b^bEzB)Fy9YLguk4b$(H_>;<(NvmiTK1H?|7r;>?wcqRPh7kX68o{dH zZCcJ9*x$`EHP5Qq5`a)wpkS2dOImBEH{Hn&e`(j^)=yO~!@=v110l{}lgiuAkK50= zzurm*j5hSIbPny&8P*%UbAaZc(Hy}HHoygd@h$j*h6#0o{>{AD{Q#?WSuIZkKn)j1Lu8q%Ov zWq=a<;19QI+uG>DE8aM+GYWI*$D5`7G5zcF_`Q#AK!KWN{h4MijjusA>KajB z#>-UDdT`@1#~rJ}m2NIu7aWBx#4;F*F@i)d=uGg>Ae>_|&`4Q!y;E_1*TU#@Ft3Hs zNDLYpg$jZ$X%d;$jJj(th@XH|%`VA6n+X>#@{-7 zI}}urU7!^ZNQ|A2<0y*niFL;d$O(5bA zj2p|J<|E*iY`7Ur1}mpx=xShja;VO4Ji!-Z#ajiaOfrwCux-L_c;*ZconyF!3I-L+ znzbXlvu-K391AR#d3VnuHb+sjUEN&w5mSg#99z9spdf~i@T-8{TQ{W#3srBYyM=O$ z2UAjg#7n*re%ObEB%fhy8R3lEswPw&3YE?Vo6Jp zOaY{vkzvs}Q;fHTJCR*{uMM!gO*e@Gc5?qf^l)cC#pw6W-Dp?!Ay>#Db#I0<98n7Fq!iod^f1 zwA{OCYS1W}0x%m<^o61JdvWW@;3|xQSsQOqppn&48UgF6#b(V z8{p<4r<~iiY^y9BJb7Ah-fiwUB%ivA1iWGovd#ihmRM{uhdn)L4iJu!f>n+wZIrPg zPE}5*8xVn-Mjk$7n~rd!Ob3tXdvDg;&TM5%aPWc?@iFE&Zv^?r$mRxYVlOrw!|WZ> zZW)USy0s>s7+2Qpw%ouJoX`(c^AAIEMwYlw4sI~j?#n(Ex`DlQa|p6; zrOmGM6v=quY?3XiId&K%tC6o6wHyFJ*JbW_i(U|fQ&644RPgQ`2MyTkQJWT7`-d_O z!885=!*B<8v=4AuU|#nF+m+Pv1eRFyL(rJvXmB#yoTeBYnuTPL5iOCu!LL=MXbqv{ zfX1Qf$j}arhf2t(v`EDa2QiLRTPZvlv);dO)~g;3E$nNyVTq7G z`oNruqAL6AX# zO!v>o)+inbc-={H)kIzXB#rC<*!a91!n-NHVCc>x1>V9Dsu6mNL(5KcxvYF6ejpY9 zN9oELf9cVGY+pLO;*AVa+LpvhdDp zO3tOO=K1hr@xM3;RX>dA$%2_&#iGW64nc04fo%Uao{vgd6`1#LD%aQku~*{# zc~27pIhgDO{10`(D6=I5{Rd=YXaBzwG0phx|8W`C7mZVBiODQ7mfwbkD}Ne8sM!e~ zN$vKrZ4Y<2$1BOAFqRet9r@4K;ul~qykC2@1aM?_3${CBsZ_FE234q)61n2B zD~rR-Per@LVBzpD)TdErzey%A>Su#)+DHFl;TAH?p$Pz**u*si#LvSFVBto>`dVx{%j^mh411J~POZZI8(;IX;qqTx7u6_{7RI|vl~=EWtPKXDUd zGM=er19o9orzA~GV*NPWdZl<>)e)Du7S0NlX@w0d{Ls7JH-_&3gFD(0{mz1Xoc zs_ra3H+MpFm4J5wpJPZ78d6h?)V7p(L5GB%UPdMdrg%nZ-Q$Vej{EDkXSg_v{oIIA z+)BLfnXHM4$$L#$;ufSZGYmA*O4ENKQ*Iy`e|OV$|Fm)NJFi=wEHdPwJqW_tqX<|vgvB0h20NxMCbh>Y@GA!5py(E+dI6_Bl)VJ9M9r+`o@d{rQ`JF|pU^M>n;7U=(R;Yl|+}Er)7eL&DE+8LeKild&?$D2H4^a|1EVE*riLT@KfX1yozj$~oYT ze;_6)Aqqnu!UW+GU<9A+P|bdDDJ0`@5#~emyJf{6wN1I9o|@evoKs~R(=Q0Lw^YPs zC2tS&GViAFG%fZ-i@;!LBVxq*CH8(SYCXb&Wr|25xEFl=qAx#(h#63%lPIF#*~_|d z$VP~xA6n%q{??PGvpLe#2~?GZxD20B(=CtwD)d40mc)16S2Lj->tJa`bhk#)tNx32 znOm-Z0OrdkB_EhR2r=`;9qe;~Q!4O0mNq0{zce#9o>88A-$DE8qpu3DVSt~+k=oA1 zl$xJwXOi#!5||*;!Y7vFzWez5UxU#5}G^ zw)SZNe%s@+z>VB2(h~sM0{VJd32LUj0+uw9gybtZdytG)iGtn)$V(GVr1Hy*NWwf3 zmk9qd3e3gT*syViU8K+8Ir4fRUFYhtdVb3j`D z-YUZ`2mQ(U>DR^E9FQ(yTjBS1G?vR@<08qPWeu0;8}w|7sJL&HlJ+r26#4xXj}Nt2 zJq%;ecI|Ng@8Ldyy-NxLa){FRcTKEd&?HVl+;m6Aw1zji-N*jgyR?!+F@Pv*sjH== z#*(DlHLNXp5+!EyhC0LV&#-R_j~wDT%bluV+VEsCwQy>@JRm~jf^%??px%Hx%^8{I zJ9~{b;_fXGGu{K$S1=2S2NMvj>D(WQb|m2n$%vb3teKsqZ!UxUv>V($dpVrXJ3Unkj>~OW-MVg_V>58ha^xSBl5(j9V$rk+a+_F z42<4I?DCyg1eoJ5w?3hj@jEPk_3jUwcBU6; z_vV5QM7Bt4@JVxG&x7LHM?8}mNO0*J}X7z*=y%PRvk5c4`Mb{xg_vWAMB* zr3cC^GUBhJ!Q`oW5;HsZnyT-B3Bx@a^N%csQJ~;GIf<67T$Va%-@oxeD)U+L{LVixkQC*1)eH6!adxG z9}u*Kjm^f6WHy7B6eXD@3@%I&k6|W>q$c0cYLSruJBHFmB)c$(K`qv-;&0`0i4os< z0k;TSK)$^Vt0SzHjH_!Wd)^p=--sY%@E`hAWNO79k5Z2B*ro(My5xT1Y2}; zPMtPQg`k$s5==0ejf({%B~wMFQt1ekP2dd#Qq&oOa+0O(Ma5x4U*U9$&zYOoKUXK_ zk8pKxoXW9u>UA0gH*ZA*doU@^O{q@MY~3xCWU&x05i^{F}K6O+wtHASyuO#)H;8BS7N(8m&xHGtW5 z1>@v6arnXt^6P5VnV53hP1+s%gZAx3zn^lCuNeKnb?x)V2bog3WcF|P>)XjMP9U$=V`msxiJ#J`N&)7-( zIs&$NN7@pVcu}9c;Rw8do>x3++&Pt#H!zjt-x?L{fNrfM8A&@;R?#SL|KP5_DMd`N z9V)z6MZO5wNzD=XI^o{QTy`5ZeWJc>X)MJEbtG>^vOFj@h&uc#1hi^!azJFUHX3{j zO@5hqu;ox}K5cy1Ko%~IXw^Tl6j-&*OLw9x$6muNLbnGnP%}T$@QRBPG2Gt>0df4M z>F%Bl>l@7qnX}5`f>zG2h`Cmn7I!5TqDVOtCY`$9g#0IDa$i?`Y<;iB8(fz==OPf6 z^bsAucXdyiL&i1@C})};Nq~-C4d1D|9V~6Gb`xlW>I^NH6-)-Yj_O3rw7)=n3e=yN z_(6KzrDlReWzPluR07f;oH`92utubz@x8824I11tjMegY6nh#o#{-sPW0;AIzXc60 z^442cJx@M7B1I~ks`hu04%0IGKktp7a6G22eBUwU4W1R(sn4Rqh=9TyZIEY>yi%9@ zRfe}rD=T~=eG`Ek5U6?+w((eCoHyE41rAJ9rS9Pav=?;h#~ zpJsO!6@@mWBYDF~%5MDL6Wx~w6qTnJD$YK>pS}=^)fC2Jxl^U`v>@Lir~`c`1_+HJ|TmdOMehn z&-9Odi~0S=rwcYxJFocMqBP(eg8sLv(VrHdvDtiZ)9}iPqt_QD9~A2S;lm|dI&o8F z0$TqkYjh)*Ba83f!}D}{?9tx8k3L-UPTxN`F8;2b^_t~dy zKLu^Yiu|W$XgFvnI3^OzfEQS+9gufnPm}#J(!fdp$}I?#t6ao9ihCX&qY@#@V=5k= z(VA@{2Qj}Vm-Q#3f2W2{pa8cMNfhHD@OxMN*Fs;D*+Ef6|7|V;1=r+)zyzVYC*Uuk z4wCffWB(TKr>hWHmzX+(@6Vnq=oB1?b^_>RIvXk2y=y~H| zn!VLX!{Yt6jc^0+W?j(O@*a~VmvWz2b8h1|?g<{)8*2@^4`7h@7+xxq*X-lcz|fND z)GN5p81IYo3baF#5PZ^CJg3YKggjfZd+Ny&PygkDGS5p9%SFos~N z;4k-_`t4EtG@pkM3Zr|f>%Zm8NVZzlsBkUFSd4^H=fZ9cyK3;$H5av}XHF!pIq{&< z+Oqsr|Gi8-QFP~x_!YksGNj{|q(?;vWK&?jj0uA8QLnQ0lHfiJtKl8sIl?d70C$HxKcx;a_xu+t@4 zQ&8L9YXs$t{kN-6AE;-45}yrr118gDo0$yVZtI3kb%VCUGsa+ zqzJ@&+^ISr-MSD)9}TfrTZ;pPM{Xv6=44vI^xpz#E+L3OB^PuNnO0K6VHm=vq1`_W zTS!vy97yT`*UR$d&4&P!em-#gxE(JFJRXnF1$=qw0O>aIa4F$CkB+qQ=VLAAM5haZV_bTP}fU=j*<~=Cr)8bB2 zbPLZ;)#i3~L)8j#i1+}UQUzyS!QhtxA_Y2Dbc08wU}XmZzAVR0^uY`-UR<42x~zeo4{`h$!yL-$y4hVv$AZM1r2 z6z^`j>J?B$B@npXibd3Q+f4c7BBzu*u3zO-9-xEmq3I7&18k`MjWMo!@)MxS$}nV2 zw{++IU%K7pi-4Jq8Uj8`W#L?g%U`z z!VqhN2dc=gJk(&a_qur2>2OiF3{hfV$)gvJO@eoCtzj0Q$;JP_E9hIm@87U35~3>mT73044Wdduv)4;be- z3hOxHgcZguX#@Mg+MqZ_u#X>W1S1659&L)!x0|Z=XwR_W?*Nmv?T#@yArXiH=QTZ? zaQBR3K_FAD6iLU17i|Ma3MsB6c+S09`83#)SV$TUbr~_Wn&@d2jb8!jqgQMUMdGDy zXLht_hrn$T&6;xiX!ijgMii}LB)xWDs-{U;7>f>r7I#YS>ns=?!rj!$1HtKqp{V0l zR=Z5Q^pL{QXpMrVQ+Ju-+2Cw7LWztjEC@lqE-;#ZN^j?(p{>dGLP6On8=8WQ5E?%l zWtZ8`JX2Xm^|?FSmC#nDRd;>+PV|vK=)Kx#(J32YwyCWN_pr?!ih~iibb2VB*|(#B zL5x5PfMlB?YO}Zmz^ESZY_K9^3O{9hTF;toI^X3`YOM^Qag{J0Dk`67?y# z2ZB5(K>7_lLkMb*HhDVE@gAutv)p7crV_gSU3(nzJN083%2iPEa5QeV`>nhGd$x^W zBagl>DAuS{yG}wNnf2r#lJudk*m|!1Nb2xuLNlD7G0j%tB(G1wx=#c<`f+jAAFh!T z4vo*@cvy$8SluJSF7t6}#+vmX)JW&RDX?K$q>>pae0#zuVOL(jI2JTPQ$Fnz8#L40 zZ>zQ30z{-mSsw+~%&>%tUR;$@QTlv+h}CZ{J=RXBK% zc5iR4c3Cia(if#RbBeaTL*;CxN@xfTDe{m&yHnAeY#xeAScm>&1H z0VSy6d(FHd2G74?!~TX+^gLE2=Nn5tqxg9)ZU}?|0Omn9X_t?e@YTc9KF=s5PB6R1 zRjB@qj@x-m__3Y+r4gXy_TuzwI)pPTkbTKadaY%04to}wNK6ihgi|!A0-k#QK|oxO z2CqSSAM`|(bJ~BL?#chX@ER>r!1M*raHZovjjFxJ8pwOXx;^@imuyzC|Ilfms7~q= zND4`D!BFIX5f2;^{I6yVVK1m<8OS3S(E9w#R?_IZzGTgQ{&F zA_Ptrsqc2an~9kI+5ho;5}1T7GMk<~IQeV1Hdh?Npzlw3QNN8i&q8>TzsT(R@NB7T_eU&L84z56=55) zgT#ozQ81fYI@s1DbE}`eU~X&xt)aR;ry9U3;|H9m>{XQHM=yB_1r}Z`n^~lae?O|b zf{Ra-mm!cU>9=1%zwsN^PSkk=_@T|5Aj`__>!M$G#e3=C8;vxH4k?V{wcFksuoY@M zl&h!-U8>@wM@ivUxeb2L;-l2lp~4{DtR@f&;Ht5_A!cz~YyNW4d~ws+a(*kfpL;~Q z*ZGJRVf7S};w{db1PXGG*I|S`VF^zK$eXlH-Wrsz`266F?UdvR@dO;A^7MwyqR$VQ zA{%CTDTyXONHsLgx4p+;MCS>7T!g>GN}$3#;yZZniAmDi|5ta)q!??PF5K(lxcaNI z-rXHly0jqJUW1f&wDrBT3zPE zHF#`z?*03x&(WCi51^kKpo=(kT(5@D|B&8d&(Gs5Av_NmGpkyIRQ!{Y>$xh7_*wEB zXG3Vf#-P2Uq=!ndXYc^pJr3OI@?uanY!)n3txAUNSD8hIOI+R|Be&vK%jQ*ly^iOK z^fN`|pSscv4dsLfytq&Q@UEFJq??|Ey*vY8Ck<}P?8M*pzd#r7qi=Qh8mWmJA5Ve% zj}eufUf-N^*qxs?h6R4VH^uoRJ9}f-B(YlX&GdkYQyp*{hW*vH|aKp2&Ri*KR)Ll|PL z<;pNvplic6N=uc+YH2FpD3pZ=Xxz_biY;>Zl2c&O^&J+6uMB! zQp!ncD0E?cwaaO`aVqqWV4;lVivx7NCF8}CC8#+RTTYf%A{j)SsX1vnM!!%i$!Wgi z^zrZ#56}S0&xWV2sVLdA-ieMf!~K8+wri)$l5Ik^>0^dgRofvI00A-*$q-|jx54eS z0hk%(%Jr=(Ui>@IfgC+W6De0ZWi$b?C#_G%fXWxLn?1DSIKGsVys`!6(J7NSQ06`8 z7cM*uiMtRleWK+M39A_vntnJGV~O41S5Kyz4y;&f9EzeTKG1^;?P}Mcmpia)`?2i4 z?TQV+^HJ?~#B)eubIzC6fqg9wo)bnxmfmq|fks;psQ3Uuh3v_=r>&MWN0+8MT~T?l zti{sGK}n4{Ugfm_mAE?JEdakkb1Q*yigoX8I7`_{tiUP}VTz)H$B{YeXJ|g@Dr5_| z0IF9ie+DhV)x%h!h}z-$sq2)JO90H4?2>m%Vz3cyT~^ype+P1FT2|1qh^NJMo7PJ@ zn(7}!F|)kR0f)>%b?S05<_E$r1V zWmL!-LwF-t&r(cINmb;sEMOi`+@Z^b0&6&!?&dW)aV`Q-dRKGsaD?IhEV-(5g&Enp zL2bcSgpF_zvdD=JLbB%M8>4_I z4Tvk;iQ&2@Yl_KS=L3$iNB;Xs*8OH()`}GsBfIkuyTuAP-yeS>7<@qbEzTI4ftxzy zWwe#WB}Ep6Z8z~;bGhnDY=qh_;bz0fu*8gDSbP!ew|G3ihe$n}3y5-yuAWqnqqojN zTml}M{!GcG{V%HCsk;(J(Y6gLM#Z+BRBYR}ZCf+8ZQHhO+qUi8ukH16?!OpneHb5k zSSc5IvKJ|iy)ycEnwy(ZS4Y&6PbR^#8@MiPeQJn>6LYKNTT(Ul$h{kk!u9rV2SLH0 z;ov$#gi0e?90R^WDBMSEpg~fKxdj*=cMvLBU!0&-bq7rbl7S*~_fxKHG?p^1d?i^Y zoU3Fqn;Hxxi8YLvrem-vzcKp$WY}7WWiuH2O_}DfN{1Rz9EPVyFyQgGaA-mcf>dMX zS!QM^Ol7r781Bl@s-)x52mC>Z{ztru7LI*ly>UX4VGGFjf3Ir_wxWSr>zimX2r-oK z0Efe#PiZp8!z$Em-AUa` z<%A0e&M=mX4{)L^xZmMf-%}l}%fo8s8|EZWUfY&%=az9?(Y^=pvL96N)2O)sUu^3O}G zL1eoQ%BMZbY9^(^XG794zclfJ>RCcg!zY|+SOtm0zXZ5?}2dnVG0DXzh$ZrjG^XJ*MLruuL+GG8-tXhZSdye7XR}zmI z3rx$-^lVQ`LF?ySF7G-oM~qGYqmbZo36WsL3g^G!cBrRXEJanrq4aj#?Tha=eL#~U zt^_=FRk|K%hjA5I)oUYEqKR1S=XA%2GB;->pMK1X<5oC*uf%azD84Y)Pq@f>xaV=t zu)*>}HB$tVYpzr;0L4RU4+HN*9f>84!jHidvhgdQQ6eE_QueRsJVilUD6wT|xg0Rl zEM{*VU~h?@*D-2Ez=aUJmekFoU7P!~GXT`rg@7Hyv>>lIq9({Qu;sRDaYSJ)bI8^t zo|Wg6jx2N3GPZPwrpmhf)df zfCl!$o7^4E7sm?GO+|Q`eXC3p{yvIkVCgqVj}|JDshArEQ}!?`{{e2kiGAS@nBZUu zKU^nkK7veTHT|z{B5F3kyF9WO1CG;V8&VSlyMkyUg+p=svRppsx;(f2ubAjZMI^Th zen;oc&aOh>hlIc)!xw=Ak~-cp_yfqz#k=&rI)c=m@SyQJPs44d8nq2FHL6g28p1E3>E(Xw^Csm?9pB*;+ELyA4kLOFsxQk2N zJAu}Y95N-OJ7$-Vi9CNqB%88vgEBJJY>xy%kBjfGFMx(o@Zkh`=!WDN?SvzBdbXzZ zbwUsh95z=7V!&9xy%^%M zN0tqnlT!Au#LfVW6T(c z$z$M-dRm8;?X8Z*h-k%i*^yMo|X8*$et9j`0Qu0vPa0~|pfw|b3Cv1<8q z&dd&nHku8gKVa^G77syIjeD;Y6|}(@_C=;-JnsBRG-_}%k3A?`SCY9gG0`}bqsJJRIB9B6FfbCJ=CTd(|7O&xPADRMb42`{{I1bmI&s0YQr!~tp2@p^ zHIN}BT5f&%g9&uPja2THmkE8|9}DQIzR#r?QW-`JB2tfIpAK%%KYZMNFJmX^dp{yo zg_ITae63R}UjkM33#RkLoZj!hR%O;deOx)WTNT!qr+N7|!5vbZ=>s^yivp*S7L*Q?<8Gp8FT=gwrlY9p0X-OI4Y;QT|js#j`AY>)2?a zmVc{S*0pK3d7^Mb49|A!&sSH3MmTKUcVTCox)*s^jow~k0oqwI2QaKqsU)XnxOPM= znB_gS=bCpvbMmitd;rP?jXV5qGDZb&Un7nhfy6t8|CVd&v@$|R)^UPDFXu$I%dPQiv;_OYJkeBWq3*M4&_=4 zRYJ`@Mrfs8Ga=8%XK5R{r|;TFKvgR61q!6mrep)n8qgFt$YZ}QAa~;kXA0S0X!z99 zRXggZrq*=-vj8NLY3wgCX|YBTs1Q^>&ME>!LZz^Z7%g|0L}If8!12lJUETYT3dk2J5xC&8Su&QxTIVbUxc5~9FZIO7Y*vnRhSq=ewI^|_~k*Fe*Wqd%p`}XNRbk+V~=V1 zXc_jfo6G@r8>BzBR<~obt zM7_NzAp1DNybj;vwBViRuTk}27qJComg63JB|vlp@74kbcp|WvT%JRC#mW7lb>;Zy zcc8m`+0WK&KDd3$&err$yhNbuA>RS68mYB9SX^r>BK*{LIIi0ihTe8~s9Q@Shx=kP zHBT9v$K9^SzgT9PO&@wTuYWvd+0bv{>nd`v(vY+wKA30yPDyp_8jOGY9fKCi6xAim z9{|R$W*1ZlWfPrmnxxwRg9=$f1&$T)vdHgvXKF2AaPt?T{hDbvc7DCM50J&nf0_g? zj>ec!M8c@=C0yi8wk)kN$(Bki3dI|wg^eFTT}D)81|fiA%^lq$Y`l~lWWfy@2dJV=uMt}lj)zjLdkm!r0QW&M|5%}1;rLs? zPru04Z;B;@JDcr~Q3f}!nG%&;-u;9Ewu-0X2bqY<(2>EAW^GM*?(Av2wpUl?I+>rH z6{_CgYM$RJIz!xT53LeK&{Ji*up>EqByV(z|5+7B6~&!_9#4yMJjP1;sc1s)4zO*8 z`eEDkgss>%ol{44W=31*-jM+^Mt;@!`at1%K1t&rDobc7QK2l6H@hN@2{>r$GW?Q! ziKoKQjQv`w$yeuYxE(80^o{JwfC-ilW!!mNh~f%!DJuuH!PM(dIB$zJD`gS#rIV9p zv>_5HBhAeP8AQi6GJ@jB;aZRk2MBs}J1-3;D({KAsfBtt3DBdHVg2Dn#i(jaEezgu zCT>PQA6S}y*{L1%4Qm0`t8qaO1u5z8&WkA{SHr-IN-f%2ixrJaDu>EgGiuc~r&7wU zdap=~$*8z`l~<^?w4#SBH)_nG3gB;u_B1F7o7B`1(Y`WoDHflgdJS;52ek8-L^zA@ zJrx~ry5SRpC-1^kg=PQ4O@}^+?7sCqm$keKttXlUT_h^AeHRE%>)m1e#4f)RZ@7D} z_$|xOSMTJr)UBQpROnT*91a7Z&k!42MoJ z(BRm=FIpM>gQ#G?4`YDb2(S#OE2S9Zmtw&qxsTWx+&6BqI4)SUX%(eT$hWO)oro## zC-VrY1!2y*S_W3?Qf=5o@kjMtNA8iR&4#(Btt1%X&W7+>8Y`#G107I=u&u%rBKG@e zXFz>^4HRjWb0|NJKPJ%bC?ETzSi01($Id+O3Af26W_*@6uxP$e15`E>t5Kxw8YXm(F7ln9eI`Oi@HIw@7L zLD#Ny2*?~oX}8T9SuXG}Y9!rKzUeJkx^FFR7kx7EmDZb@bda`J49~XjG4WkE%LS(@ z5`bmDUm8BLoT^XI0>-)VfHUUh$)-F98lL!kW_602OPrq4dlfT1%+(RRbW5IW2Od2B z#G0v)8$yWQYfH1S@ttDS&;~|#k;+Fvj!F+O;QHi_!L=E}%FG}gpra)QEsbsc+g>)) zK#5H;FBSc6tll|LLj8M5p*n<6VERh$4CKVpf}N@ z{cNp;dp$#*WWE`hUcygcTAw5$4J?TVRZ<*DDAt09V4 zS*(aNWKN~cqXn0&1QRkL>$Hgo=&?M7VWYwz>ei5TmnBrZuoN95>T>RUA34gYQXywW1*%CK7X# z1o$}a6$$2#_&DSk^A0T!_~O#jaK<{;we|Iq8wr-U0VZBZ`Ui<}fl&?2bc2qu8E0_r z{&}_b#6m+mk8f|t%!|{}jzl)id4%OFh9OEH;_Ju< zvgHUxl|z%_VIV*4gMHrOK#9BGt8<>l01GTgD@c(v^J5ls=Z6}s;0eMBrw|motNFd? zgE`rk0+PMbq0c1F<*!MPepl&*;pj#Tm=976*L|&H;Bc}gIre9)V;1DDl0usCWtW67 zT-Y)|`%&{1*xZm_Rt$Wpxv07laX%8e-|7U{m&@g$c)4-1J2m}W=l>?=u&rBhWEncL z1*(1HK#5Y%5HffwnuSv4tCXy-up)(S|3%WD0%Z2|1b0&IfW8hEmE=Tb6k+2aAKf#T z@D5V@rNZ32NL&=^)*y;6KWW;KM$wD*^5L{K&i7^dEif+Lbw~1U!6W>2fSdUboh17p zm+pP0%!iVzfEb?c>UNRX)wb!Er;$b4T&i5qRR0X&9kjRPv$B>omFL}3(9^mCCb>Zs z3P2JLH9OMdcvv#&$u>{UO0tlXziPYkGzt)P3y@PfR(6d6kdDS`U3uW6t*2w`F&OQK zYG+*#mo{eu;Qw1b`N+a4?%*;7{!H$Sbn}Xl8okeKkn{R5x4uYAs8X4C3sT_>ot_Kl z8)ZZc@FqX2n|Wk%#N1npEq(;56he0*0}7dYpkeS~Od`l(v_ z4(e=yHoG{yBi6T0N(5bR7vp-R7-P?7d>bw6YN_}}tKOwU_lWZoc zEZjEAR84v}-+6h4masEqw(us_}%ZcVY9V=YC`}4%!Im8(|Eg0szoxJj& zSt4pcW0YcdH>c2!n3d=}{vH<*+VFgwh{3d%p09itEixwmG=I=r2Ycyz3nUhuN*NW z0-*pf{r{^G&B>a_|640PfRGn<(h!Ul@R#zt1^#pvM6$P-Eow|v)ar$!hbLTT9f>*E z>x-=f6Hz`8mrv%R`zXB2=@qmO#nmWvaQ}|M0cL-DZ*u_O4)4cmfcc9I<%LxI&10$0 zN|pP9X%z^k_xi8Pk}JTWgBvGbYu?qxO;6WFr|NsV?40q$=ZR$MXKH^JOohiXEU*VbJ-=GN&)p4o-@|7_6oRU|7@D*GwmmUEkGm8$ro{^XaO*9^|+ z_vKJo_Ur4>vDxAw^;eZ+xN@TRx2+AK#<$_=lP?vZ>-)*SkzQsciHua86!=ZWbNrf@ zG~O^#Ft_RI)~-`abt@=Sgper|GTgaZgiwXU1y6mZpe&3^Xph?Sg1o#v1Vah)(ZO9`_vMSTw<%H2`^R72<7|c}uF9gFtzK7dFtJAzt$VY%wJlQ;Y zBTWtDqNN=V;mX)nMaEzgxan^?C(HzrdCWurtlA;6h0bv$p=UtaNF=MNbRA9V-iuf( zY`OGb5wFv!K$A(DhM}M~E>0ITQw!{vQ503fahq8{i&|2eQV3M#=9njB5GVKQ^39)w z)LFU7$T(+@d`YbvMPW_MvBWpx~rd=I`wj69A~3UPD~!9W|m|yWi@9aXv6;f>TMn(1c5=@dUF0 zje{vo3m0j&7jNb_Jd{@lzIEO;0>(BJM%E3WWoF#V&eE8mHi}AI?cURF1mpVq(0AmC z=Mhcj+5%b^VhQ1tERA5x4ZQ20>l^UMdAMb+^BCZbBapu!K42D?w}#oCLijrrSqi5$@3O~w5wPRuLGEfVI&LAm8+UpM;2YJDA z!qaVmc9$$-A%&aIg8I}tma%j5S1``+C7I&R=n=^w$H4z}@5%v3;I_0}@>FJk;?}NZ zZyMUEiD*)q3#NVt?5!k3XFNl5Db3^x@C`ujq^8@cnQEf&CuTN@Tsx;X6(iNJsY;K8i_q~&7LCyu7OA;1D&j<@Ph zYsl-`atEwa53JxhPB%0l;PsnC zyZGq~QP?tq8emFSE#QPy#{vM*q=?s{zA>&)y&eW*l_$laeB{^rtpkD$CC;5@E2X|u zOvKJW2|t47`LDdrHQL$orHC5i^|Iv>5ld#c3!a|4Cn8R|7SPf);j0XpPG{_8$nwLw zj1(_ScRWd&2g-_+HiJs?-o->(Cv%6CXq30hB`XD{si2V-vsh#Mqewtssf)h0@{~k{ zJ!mxP6DK;24=)-`wfsuP5`j7fcllrM{JhjW;%K>}Db2}F(V%x9I?h#%(Eha^XjBz= zR4Hu=5E?6M+b0}qS)zo@+mgH}x{k>jrBdfY^|=U0`cbg@r&Z^)<7Esqo8K0q}lD=qr;pJ3-;%T)vpGj1kPA^0$`ib@#IE;E}iD!{Ojf*=c|Uq)%DLwR1lywK*OlLd3(=y~J5C`7ItZur!UNgNXznKdUiPL@kj!CYp(3?Jw+^N@b@Th? zfRmCa&1yhRK6f$%g8_`5$F2n=adc$s$^EHfhvWI6qGo!*NvB2ggUyLv@~zbE{rROr zo|FkQ`Y~F(=%ll3?i{5DYag3-u_@UnBnCCl^;Vn?Hv$O*fOTSu=^Y1dg>ss-p7T0_ zEsgUj2?vGLqCb{FnM@I2Z@^&xr!<2%5eK$5VGyuS!;x_%?D+Jo?budL#If~ZMEr9W zdww+a-jujC>3OQqZ%aPX1CmP$fq6bVKw3Mn%o!o3y;cXL`hzaDzkn=MJnWL6KoMl{ zuSOd%mVH)w(t#s?l~cU=Adq!rQ&KrB;VM1)B!Wa|>oxXing$gU**#XIN z&;@XV62+FSB>pC>GOx*-aaF#847@+7f-$Z2Qjc2f0zsP#gb%Fw_=IB}5?~CMG(oX& zcvmjlWLvj}YI(Ka-(v;i#BxFb$KV~1|1{7ReOJQ)>4)nHH*9tGf!ULw=sye+qH^(? zsEP+t4UzN6?d&M+UPSpQ*OIfpeYeFpBaK|+hIie=^a`w#?;_M9yYjm287ytqy zUtW+U{5j=YL2AV7(TiQ?yUe!C$rf+Q6?p3+wP&Dl?@Q_0>SxvsH}L$K27PERRbmpu zcFsoxEX0+uK4ADmU+5>aBv}HANrbB99q;^DaC*hS_26aKrBo<+`c}BEfB42RN?%E7 z3yw^t#Efus*8_G1-lT=d3QAAD|E+ILT~LB#e)6!UFF$lgfmS6q z>vIOp3gD`A3fbp|v2++s+sn*ubThvRo}cQTce&zpK6SSxB;fi!4aC1=z+b#)SNw%k z!R_?Ims`L)^winA22U>nwxVGMVLF0iaDz`Ejy)?*KZ~BKo3M{}EOU3L00LNf=MU6i zU#MYxoJ?|FWXvMp8Kw> zG;~6*^gd^YD*@Mne11+TTn9Md9=2xglA1fjjbSOfv!ZR~7D@@df*H z=Qo&^b;N@xEXfwkG*BulfUX}svCo1oIQzgiKMiGuC;D9{!3^!|76jQ&*x7d89%`L_ zvk1GrN2uzNi@oy8(aqk{j{`&sYa}PV9-7bJD!$&nuIYb4ImC7^pi@Emfss-Z=s?I* z+o(bRrjF5p-~+4~Bge^l@e`i);|n&fbD-$Fk5k?$&@LS=;!^eKKMEH3e4tK{yt`)Z z8-5aWzmj-=Ik|tI4j)E)+agt0%L;nF*68s!bjVTZHnf}BQt@X2TT4&wTh+3&+m#lL zZmGTh3H|f->Eq<_UAN54Exsw^2l{r0F0n5It$i!oUO>sL>*|Z@$H&))f34a@4#dI| zTS=_cE*!koZOfQnb`JMxO0Nu?xo!vToK3D{>yxv{3sFQrpAXY5iAV^`&D|DUm6O*V z6D#A_gSYxS67=<3blm%7tEbr zfntN2IGeT!ut%D%=4JankEl)&IdcV~adyn6h&z+X zxsC|rwTxLBQ+SwqozWFVTx>mY-va&VE`VN6Rl$eGcf2%(BM?g#vsy%SoyQu-e@6-F zz8}nDTGkoOvD*O;Ead7hknwhsrgI!j>Y09lQ?Qz$mq*;zp>UKP^sz-DX(tU<39LtE z5j9pDgJz5)CcW5tI}Vj!mkFQ6rIfS}m%|Q$#vzkTJUq^BYZg#K9HW@hoAxYMTL3K7 zn}~*ut7!k`NX#2o*sP8AnfwX^p{A-BX4n_Gty9Jn+zxu|$(KLG%UQA=>|0Qpyk1P~ zqVCt+(RT8w;K z%4$cI0&-V4ddynyRHR zDrLhf|LXd<(@f64Y>iNVMoFZ|n$WG&7rF9+8w}%HDkTj@}<*> zfq_#_ZcG#U%?Z>HUe25#hyjX_pE(s=R|@J?NBSXM*>5&CxE98OK&B3i5isgD>_)Tw ztW?9jQ!&youu52K_o2Zk`*R%b!9L68r*|^W;b4(YA1mzRc}5E4Q-3-$ehmQxq$1)~ z1RhYPsvsX^_zon63Le9M(-~v?<@kw`z9Pl{gz{CePyD#S;Q))x8URdq60gHqEd1ZS zQ%$W8O**hDqb#dNlP^NTsph)TRu!a4kp?7o$N~rEKV!polT1P~UsHi4k&2?#bv z!J~0wLW1<;t+fZ=NuL@LS^JUf^2?SP%#sxHR??Rc>v}`vgaY;|j8N)6pq;R+K&o>oWXczl3%x(+&=P2f|3sE^AD7I0SoOlq1N9daA_-ST>2!)TH<_ zXVmeI3$&;7dIQ|@lc1@U>xPT4HGQOcBBz!rwZwGTZl+M{<~6(98V6eL%uEiryhDtZ z7UL;oa4}`D_OTiWl2{NFTb3e)lRl|InyV1l1rC8eR5kS5Iq96!3KEzV3GLf%)r3!u z`LIX4&qS>tsB|qdl%{puNd0(BRt^)B6a)!LzQFt24aOP}UrK+S)2+}oio|dCrjX71Y znZAh51!yLz@y7Y-FiQhN%#ApOq5Ad>h-*l*4a;iC3$>CEUN3C3gD0IO%iMXiCPC4$ zS+sw>HynwWR}V$OoVfZomAIRt%kMDQ{Gwwl1pxbZD*Mc^w2|OOZy5e^c{SgU?x{qw ztC;|uSo7Qf#->_z+WMQ>^1Tr(it|EYM-!__Ui|IWCJr8zSs`u`5-Zs*u|GTP4F|xV zzo!op`$Z$l`r0w2JxEe8)mnKoUsh6$Bi^PK%u9seesq^9bK*$g!enn=uJuqb5#$Qj zm;eoe<(G{?pw%V$33E+Dsv#HpszV`k=zIB*THN4ukxg{ErDO-t#Yr&L60n8TBv*rV ziKT(QqTWUFl37*XNdp!kViRkR+R1LpGwmokwu$gf8g^McC#pC;bS-x;k&+3sOV;N3 znO8OVFSd14I}@>wC=AuC)@VG#90z|rF91G>qInFT{-0c|<~&AGAMCeJ+-6 zmqzE0IHFX?JC&vO5B7LEc`qoT#}pSHK?2VN0Z`5ZGKkeq;?#>g=&R&!R5l&O>;Tz( zu}MuWrX{kw9}EaJ+F60QJZtyU7i^b@TSV!)0PU_6J89kpj~i8oj0;)tOys;JpNqD^ z(y7uaYPp&RsC)uA{DfUy# z>*KNr@tI8*F>!lUJCr8E$fgvPmDfBp08_#Ip#uz?Q|9AYs)#`dV$FWzR)JY0fX-*1 z#;!r5V8HsK<^*eIos@)@jyxb!ws3D-B<$bt#saH48X($z7BQ^(Oh`5wE8 z4R@BaM2`Y|R&fz2CTbs|#;v^&Mpbh5kX9Jy6xWl35yabNVcEUV<>n%=+dD`? z&n&VFTbq>a+kTY#5DL7!a^Ycxy%$Rl=Qfw`cOO7=)>Qw$>>HL7gdD)i_V53t4=rnr z$2_$l_MB2af$$Ax6EVyY`WX?hkvqXSo~cT;4?%n$to}_U(hyPTo<2gruz4ZlBq785K~79eY|NSV)daxN`~F8C!vF7hBJ1Z%jR|Uo`_=Gcs}z5LVR)N_1X)!! zw-w-P?*eG2(F{7ZZQpn@JW#8L#LL;t(j9;ES#=nD5Te2aga>{f?1$P+>m9zac(;h0 z#WJsstfISjr<^+wDx7@W{oC&hGI=gQhGRHaecd`>dyWq+wOHl0QFG9A&k*(^5*f%% zxvFFse~g-!Y#`<}FZ_*qEFkc9CmPabm`SrA`_$uP-mq1n6(xJGdTi61 znE*BIMvTm<8nX){Di27qWyn4%lZ%J}O)dP3Q*b357EUUZQY-wY2rk8fUQ48VA+nr( zf#NiYBY_mIBIs09>FT%p`XaPuPn~c>p)!G*1Sugh1K1EjWbG&|8KU0Y(u{=Jf31ue zmzt-xw}`&QP=(yBCg#C*4rdgYbkFPKyG^wf|AlpYA8GlR#m7q|fFB^LL6hy@!uaD3Ue16}=P z>Xl=s&N(5m$XOIn`Qj$56KE|mF$JIWo2}=_OpLG>{{_pVE{;p#;I&E9g6a@B2hzkn zAC{{8pj;DqPy!ATr<*|F^t-KrQ$UM2`uQfhP8G&o|5`-sUO#a)RnD?%%S50`;3zLm zlAHf<9ovDinNs|06wQ7JY|JVmizZLC5GwR>bm1j!T=4qG`{(S@>@KlB;uJgF)FY8g?9QNsSrR+&L9X4 z)so>M|LX(p;tx|K=mZ~?Pykq=*t|9S7#}0Edxw#Iph{UNnH1k?IsT3QthTvB^q;^n zw0jWpOg;uEj6vSyRfyGGog8XRd57;z8{VkCmPeFE7`C7IPZkmv+fW=gQNagAZnIe@fYqOF#6!eya>OGG>+gepDL_%bg#U zBw_r^RA*k`lunAOi(6U!D%rLh(86bmEn!(g6HDp)1szZVimEY;8o4ZVwd_Eb*gC55 zrWiGZjQJas)@WKbQx$~aC=j1O1nTehkUL-L6Mh<3td89b;teG6@!MK=uCddrz!7CA zb^!hZ`k#z;~njx*+@15ov4R(ip!;sSgW99lumP2S_A)|vF`7m?xb~R>e(QHyxUFwVJ(%R zLZ@=76MW0H`E6f9cV)Y$;HWyGwbB=+se#;hZUo3^4&}$!tFV=yQRsJkVj%rgGYIq zK(u_Hd3cN+lFB)LKG!_eAOdiNyAKQfK<(l}e~i0G5@fBpaYX_%`a)M{FlIuEPuT{i;pppC<#N-chU zuDKbSA2_2G+E^_U_nm{+KJ6L42fh32jzP)& zc3p#|l~kKnYAm_GF4%VT8FbX>z0s9J~xh++F{IYKPc@B4gx+nkfoqP5}l;Eoi%H`CU z*5`upm0cHy>cIzpD4Vl|KA(f2en4xn!Ytvx7nV2_Ezp7_P&+upjN3nq#clB$jR|6+ zx~50ED%3?+I>aLs_Y9)AoMaYAr-wP7bnJdR zCBPCM?8SJU>M)h^yHUm=OFXq`UTaj%ByognE7@)K8sYzRq7zmG@}5?Pz3={Of#?bb z8vx7vjC`hTd!WsBI1p@7hkvs4T&tPAr;TVU)HUhsUO(`TIzk5|*x{6Ida;}%NP*rJ z8OyE9-*pK`)4)j3#tw_U5t(IY*42RWs}pj-OAp|fi+nU_-x3}X& zDu*IYS>1OUwH4RRvuQ(oNS6y~(rGGl`yZlB!r>2ynM{h=4WOE?v6c>9{}y)z?>8At zToq_D6|={oN#U~+)`~leZ z{r1$@^NAMkPV*d^nNZWb6`h^JRs^M}&9UyrzD)c5wd%q~kG&l0-(O~9-nphp zhvW8cy|?W$(5~ol?)DKo?4EmZJp>q7+WK6 zbk>~#pEi{f{!g1SF|qx>+H_l! zD|U+&;pUP02_j}+i^yIck>Fn(-MEWDgpatz!GP_V$dRLdJ^I_25w|e(A3`o&9 zJ8fGD*(`Pb4451g1zF|%{rA%;y?LP_hP6;&#p?vMyTrtemzr&`UNOK3V2OVbkB|mz zTxg3(fa9sP)gZlT%bs6QVf}c%yUa~Q+9~U{NdO#8(QY`TXqBjBBY(B`JkcDkXX!gV z2QEwfDcREZcdJU{9e!U&1+*roiWYW%VF9qcHf{#20N-Ev?{|(X+O&Tewm&2&nM2|& zqg>CxT1*YrSl^zc>*i!}|2-Bqlxu&{N|{SfNDRPZjkAh6@9EzcVYUkQq^=iqG`RR_ zG6POEs%jZ#xHnOEH5sZ|j=8qa@2;s{<8=jG-5GPnC4k}&oR1GW0&4cLpsa*TaFIh8 zLRhn`ZHR~j$z=2sB7@ET!w}tXm{;jUipoj&VwhxYg_mlXp?EBeBy4fL!PvQx$|fcA ze}l*!4T!4k33_C73lpUMkwjAKz=5iWQUo06Qm059Cg?lv5e86Z*tH;?H=eL0eItpu z;%WAIH0~4z9X#lzR}jHAg;h~4 zL6%h!i`5?#7QAH=9dr&QQy?C3&=9`3(&SU=yWxEJ4)z@qmeN?6tltVQE(7SYCIQ2M zuhqsUd^ueL1>M6%?U><=xR|`(n5Oowpk@o)t9ul8)eZ`eNto1A;gDCE@&=P3?Uc5q zU}V{^l#avtu7DL>b;go`yVkp(yug;)%det?5fU;1MK1!f^P)qhdAouc6TsC+FKLC& zp#h1YiR|A+z}A*Zk8A)*heeXkIsj7+)(XFQYtM(^DYWZWJ0Q(cwyS{P^Ta$rXZXAA z;olH1x)XZ;QTMx4_SAD$4X+a|h)up#4Ur^^R#oo@YBDJ>ki9fCn{38+$+CX27=+0nos!^9@#Qn#0)W}<(45Hx zNc#!Vf(5G%kK;U~>Gm%w$tuBpQHyJAvz1*KS9B2K%xoj`tdAF3M}wJK`lEqn6sDmB zp=e2CVQ)MR{!9!we$2i-w_aiYDk7U>c?K0opc0?P;3FecinUrjFf)#fjRj-Cy>o%w;DP}Vvm+C3YWJk%`?!Jl4 z34!>}{*`CUFi_H)2EtkbUcU>d{7v|*VxvSmPTupFD5Y)e>;?l{1;FM;yjUmOtSKk0 z;is<2hi^XX9laW+U#ve!5oHFUz}ZaKNx{$x4?-XeE)-&@0<^$f9_AFm4hURMpJhJa z%LnnMvP&p8@StE51AU6)Q;*Q2y(K$q%y+Ff^549IxOf*HZq}l%sbYXfAf}V=1xfHo z`=>sg*@8>yXfpqkBH&_hmF1cJ<VNw2&zO)^5&=~}Q&9>J3R zGmEiWn^BSsjT)HnH9}Y5&{r{0$jMO|l2Ts=GxNX? zN^FWaJ2$M)lsLMV9q>{ZV%a=$?Z*f7!y;{Eb)>Wyj4hRCF3Dqsq4we<$-_crI^=Fw zT^b}eJab*F54abv4lUZ&x>9NS1`O{+3q==Fv^Z=>2P?jUl@Zn*C$z1Eq(OIEgDApd^+>HQH?#9PMhHnG$j%1!%C$bB3t=Oi^Z0O(|OvyCi_s zeMJ+r(eKVjQ1ntz_Zj+!IIusEJpA~U zN5sjN8`g6o2MMnLk`9b8AlwyRZn)%m^io%!HoPN~o!iqdxHXLkD{R}Ipug(yXH$Xr zC*yV-3}D-^G_?+46a8m3b$ur)H7Lq^&5`2yXNSN7(hlDIav(FJ2j5NcIs z#fzmMmo&56gASbz9F~#J+bUTZvRKD^!R_^6t{x@zZ(j^Fdv`IgBg6RBNTVf@sPxnd zJtZxsUz&gSVIw(*gzvuDfFf*4#OGa|6Iq}dVs+KIY!LkMX>Yt-Erg_V!0j2b{|;h zIG}vcJ0z9OTYnL$GibrkgQC<8W6mGN);*KZ!w0stZtQ4of2_$Ic=Q1kSwE5u4enb_ zk<;S=Z_laFZm4{!y06(^QSyVx*b|?^q$C{52bbnj}c8e7N6ecg&eC2qtD7y8&D4;oU*akay6tqtqI<=?|Yl1%4a ze`Q*tr<)LUNe@Q8!2Fje<@kEqvqaz|DrooRn`)CtqhmIq^sF4^Y@!%=91VdlI){vruC}{pXMF<0R1AMilyt4=F>^r*Jk+@JTI*J>@F)l5H9kL7l>vu=iq-*3RCvKi7N;5|Er{ywWec^+Ti|6`MyAo&-Bpd?g;rC_-!+%Xvgv^ ztWOhou5=$h@=5*!@~OByF9Buh?>VfeP(&1s#U^=vxFjU{0URGJALyo}(r$YDB6IgX zR?mM*?H2KW4aq4_2m-Qta2G{3G+_87Sfolz>^Av$0YN>wYQ+1#?D=ku8*fTAihVwM z3)H9pd@@!IddbQ+Qr7>Fe1AWAext5$?XN4D@ylx?Yir*=WVeY4CH@0&qWMyjSg9tu z_sMEuI>q)riP`3KY&*6JjoR9`hQAI)42Z2pRdP&v#EA9aQ_VW{9`G=8e?4yMkrxVh z>jv5@032PD_Y1|V?Wto zqmzZ5_QLiO%dYJXN-q&@^0pZ2IfnIZNyLBq=w#(tRd6k+59uSpck01AOzUpaU6J|d zYIO9xb(%k15SIvRk6xx)zrQ^MbV^jOF-C)2VQd# z9~X(Cz8dwO#cLXPbt8&}?69|#TTxn!E2Xo%`yg1BgnS7Hm&;@ldeQM~Qtn@zA5#Sf zd4Ca-#1KSdw$m$eu{plzSpbuy3$BdMhO&*c#B8S%HCl6p?^&Z0m*(|ZQxzgOxB%o_y`Oim6zTip(6kQlTveP-C~}C~7(O7b3rL5l?amJwbX)3kD! z_*{Td54o0F$Ol4bsja9L&f1^eB4a$8;yR6ReXWJHCuSsZ&w84&RjT8&{V$qko4o;8 zB_j^dVSBaqe1L^)E(|1T0E!nX&KANXKPVQ&p)FOyQgS|iO>txpo~Kg$#TvQPutuKQ zSV(B1pMGV2qk|B5I>sgX*fv4os38l=U~OTiC<3u&N<`^U0;+$FlkU5%T3H_zHj*rI zHS?!GJ*b>y8bxxup1(xd%iu8RZX#u8O0i1=SS47RFo39Wu9nS)tQbGj@zIPwi!`-Q z{35Wvp+1=N)s(VCwMd-|xrhgMXA^8Ge%&jDed6R-u>4qp<&8k@FZn_@@$6UP4Wr$O z=~)Q~_X}b1R++7X8soT}I84pjDB?JmTT zlh44n5g9p2 z1AnGSD;o$whn6{ALWMhoMKzEZqvM7JW|8$-gTo`wwsR8tB20B2qb>MrSk5URTWmzwC$|tA%;W1lX~*GBpr}pas~$VYt-H6> zJPwvaBRrud2!g=BP}DX~5Ts{EeH7xSj)PP`<|!F0 z@&FTsn{F(?to9FgwL*Js(NAaeQVA-oQlugidUY7pXfnx$xo&W1Ji6<|P=m$V9~?y! zK5E5J;KQCrY+}SKSWq=N>a^a}qheXM5CmvZTaC3%I1P?$Bqyc+bTFQ>DA0qLDv}W#erPBxkZE_5M1?QC2Pn^ZHbrY7H_+R zz209#pM^?Fm|~7=hKpf{ET5%hX1au*a}&-O9XfeX@s_Pq9i4FrSw$3e<{g`hUkSiH z>t37r6=k+;h=<6l-0>jUjv8i3Xhk46`00$%4qJ-(t#?!m+iH#a2lY)>#;d3MLU z{vx~pOQ$;K8E+VZ;M)aF*Ox@;Ag(zoD?GO59OAw70zEz-g{73Y%_z^1fWHiFD#fpU z*?md|aV#P?7u;QRwEU<1{4QeEZacU0tqk?|C`Pzoz3wVKFO9NnM`~f2nE*A|c)fM; zHl-~cuj*y8QdoD&PUMb zhXZw*E(df?9D(LdA3r}9e#)8ofF7X6FHM#}wrFEBI?w>?ELFscze?}MTO4#_=cS*U zhirHP1}~5*VgX)yzpfFe$yOrhqyKDwyLf>F3bYpV1Eh>8fzKu{0f5CD&A&mhArONZ z>vkBhP&#iJ@cbJ4NLi*lJXQrgsQYzeq0M!B7)sGN6F;}iQLvDw)1jyO$AM3LJr}l5 z_Lx`~r*PsL8N>9c(G9#&=meHtGQ)E&|DEW-qUP{|esq<~!}mF^RcPZ~*(6nq2a7IY zB`*7ne|?M1sG8^bAHe$rSxT?@ctEaLmZD`_)}-NDO_*93RMcgTVrwr&;p5fE|(Ub?yJA-&#KoBO4>v|JB7uKf3sU9p%62_wl{Kui05* zK@_4E+jopZ!-;u)H-s@W1HhY3c>$%?^)qR@9vp9?SwbaseRp}y==Jxh=*XAA+*AEU zl}XS=F~fJC!uLbX)YHeyHK9PJyyI~z>ek1+Ua(Q*OHRD3=33Vd0N{Oa?uFlUyE5d= zb}<*M!vu3(^MFJ+=Gb$3JMNJn9cs`&Vej%5<|*B>_caDMRyu82T@D>t`ShTk5|Joq zbp1B@?3&yu~16~^@m1(DEKI1ZY zSVG431N>`S7|*KF0BpCeIh&(h!&gEiMqXSBsI+g3+I|dtT=S+}5aO%YGj0J4bG?SY zUKnzkQ!|8)ZvI{SUHPp&_tW}(zoEXpTb$}Jny_Af{zAhQjcaF6I0f1;GhLhgc$Ti; zh8x3B9xp9+zT>D>%%h;d<(Y)4WMYM+XCq)ez*uv~vCE*>1mIg~vz{0(Lq@XHu+Qnh z7B>xholvA0Wi$kS5_;DV4l~g!GoF&)(W{M9^TL*6pXxP?8QY16Te;@(f6SLnK; zAI@?>lJa%x`t4-!=}NVtcJxqSHT}L_ok&JY!Q{>*@U(hZPp=9u7ID4N^a$wRoP&Z66nrOVF zV*nA2OM|Ew5W2=%%PJ}aXy@+s`7-X7S%oK%j3Tv?g{R^xo$<0|rkBHG6I$LG+TqJ{ z5$0ODlA$FQkF+%f>LwIB=FXGXwVd7X19(=Mpxa_iCSV9Rp|jP^uB&JeDhMrU6w4lz z+RR743P%%SW*E8P9;f1%E5q7}QXM)(cmS>{($&G{QHMM|93T8A(lbmt`K>1_N`zUo z+F*c|Ske~k4++f3FM$I=R{I+anFxLLeKDVD!Yf=HTYOgZY9A=EoWeh#i2JdClYiL) zq=vyp6;Q+cm&zuq<`8x*TIFc=g7J^O*PSLVY(qk^yQK1t0K~I$gHRj#mFtWb)pSr7 z`{WyDg&?bh)_Ho-Q*ZK9(9rgg{9^mvW;()QIwR$54{i1(5t)+-8kr&b!D&#Ed^jSS z9F1bK&Y~E84N8qoC(*U8A~RML>`n?{Y!tsZ5MVkiRNsa=_^+X^=~OApUdRW^Edb*6 zOK|8+wrNs>mp;SY9DbBm!PvmDdTDAdXZnv(#ihXL;>n53gr6~0P{a}#j26EzwLkGP z)XyiSjG*pr>)B>HOgqt;5Asa43N>Yr4i6UwD@#*SLH@>Jbr7atTCrM3uMCo-Tn4)9 z1bj_6he4KLnmE~SqS$JIDUODijxk70?kNuvv~|8KICIf|S*Q9*$pA=lUOxOC-2o2s z4*H<pn%*sF}30>ip%q$oe>8L+Y;)Gl^u8o_3o>w?Cssi+J zXCj@XdZe{(^?0tXTn?!%60m958VUS8fZ0)Vy1wKj+*%#YTT>_jf!C?Tz_EB=TIjTj z{)%Y5NT8?b%x2zzl{aefIy>Ftob7{cwhfR~_#Bb8MZTq6!#(`X>S_H1AFU**WT+RJ zkatyPn>9BP-9B%`$Pn6axCeRvlDMAls}yGmN_ExzLoI|)D(c2L$;I!zT{*uvfF5h* zWf)eG{7QIf{y#?NWPd^h25Q#xNXVx(<`y@x{iHQd;O6X{yy2$A9F0F8M0_(_H$;t} z8}ko{Bo?MNp7+zQZc+HI ziJ?#oa;A=C-Q*BMW5NVkUG&^A0Ns?l=I#_m0+m>QbxH-XIXFCOOta$)`t#g?V^{jj zQ0oiw9?h?Ny}TrD59g}~9!U+YRsfL0jfHhwAO zvYa+sccy(b4z5>0n-bU49jb`6Y}i>RsvB(=jAn)+GUaYYvTzxXGi}TFPz}w2*7}+~ z^mR^iNDYsW-9#(08C2M%k5KWe5V|L9Vfj4VwKpBu%53 z%?1per7i2JoGM5m80DpRc0E!6yAY7R{WHDuB0q$?^y_-l5V`f*tK4FnGVBgc0)HnG z(`muJp}n|&lS-v18dm>E>E<}`iX|nr9~W@J{wbCxGa9|ZP`||_plQpKmwD|sw6fYk zCZQsro2Os2!lpBxP&t{_7M11~G*Kn!mGgcTMf`pd_XY6M@U)W(%RzS{Y3?Icb(#76P%z9dv~mbz|YkJ-)J50LR{kSXo*n(^S2C>d=C z6*f|_AKUB^m7*L)4RNwi=e{F>{Tmmy4d8?;z$@5FFOfM! z{lamUT7glsP&rH%F_58JJ^-Pw+vw}=aV3~uKK7$Y9~uP59j!6Bu5+My<8)tRJyS$?Z8`%Ul2Gx&0%h<-U!__732 zVNY;;n>Dy6J`qeyv@mm$WbA%vNbQ~PGAI2>!2(2KM13{r~-*#jbx{2S1h@*7(1c+j-h}W5ND1) zMEG0XX&qliU1@LV^E9pqM-O|T6K$(VBM=@3fsP^G+1~%?z7ga9=ssr7|Ev3!wA*4?+u*0a(4Ii_mVJR@5a3o}Id#052ZS`- zQ&1ghvtFO%q>@F;RQZ-z{y{_uDd?eyDe>|rWcua24(`S&sLL+DuDzYz!FIkv`~6$f z`*+Xu_2%HUZ~Hv?aAuN4uRD{t77>+!%jC=Z&(-W6;MYTiurkHiR-T2>@;QvHtAS|{ z;n-6)d+3I&9L$hk*W>wF%Rg^t`OkmH>);&cBlGq>wuZ3Hn`rR20ipo>3&>b`RwS=s zi3Rp=c=!9v%n^H;^X9Qx_-gKZ0xjfM%Sq|`@v)~~-p%~>bD}Uhqbce2bLT8? zVaA)ffvN}axybvCVfmnCBNk!MnvLHQ?Bln9P^&@0!UOwNlwRc~g&`cyDR*|z@{2es zDyScUM%g90GC(0GCo_Zi-gi@0zq$b5N(;>d@c+A^>OShybN_WieNFfU1x0?tC%N!4 zjol~==i%ydbn*|hOB{38S=Dljn?8(2M#G$hXWz@Zrc)iz(BO2E!m}%xJWSY%V@y&% zw{YYn4`Vup>EaO1r76fZ*(JcxFDEn}Elb9U3V{>#`iOQ3k;a zfFco9DAiJn)>=y^j{;wmvN;1IY=oDY-^j36Do%w{_7pMCB}K3mn**w-xz#ik7BtI= zue*M0Z5O03eU>w$&;7w_2B_ydQV-R%8_BG2ekuhGPAs1iIvwCADQT;2|$k%I7h`zr482plc}{Ho>qwMo*DGq7dW~I$@Fb=}xlom)ux$V0?Izb3Cm%)a(X-o7HAL7opl|NJo^ZL@(w@+y? z3c0Fr@t^9BO?1)l8vq4dY)b(@a3B&(a?UYRobi;**kr+o1^*-Ra(6aCzmn~(0$MN1 z0c(v^d1-H2N#PEgTm+?ZvVd8wi+&ug%Z9u$6Lb>k3_j;iB_9^FKQc@Ks9QLtCvX&1 z!Lp*%Kq0!8HI79+QlS=(qRU!X9p#37Myy8wCq48xL4p9RKH!Y>6*sUYIGzgcG*vKG z)|a-Csa+Z+GKi$f`GmwEjL~!kMZH2J&RS?!&dBuQ8O|4NTpn#09XP=XZ-wDc_Po2c z9Ibf`u_f9(*Kp?_8meRMKKMt~x$*K=sYK-8Mm!E0t^&;@1r{P`SwCn#qZ)oUR! zwDUqhQhZyQw^WmM#)!DQYRkvW1kZ4EfbO-zrx3i-0U#yFs$cy*i?f=$S(N7QKiP-D zb;A)7s7%w+Y%1O?4&!0V(3p$U7K-A>Ic%84Zkt8InHqSN+}0fNYA$7``Y*+$oM$8B z4gMWjADr!rMb~}^V_U%wy)b#npPB6D5Ux@W^c)L4tLJDbX7PtephW^;FbeEN^}{MG zw^{T^F~HfJ>@tO%muicI405C?d0F^MUUOGr<_;bY0`u1f!^rd?qNzb~OtM#;Mytgu_$H>-7H`YqJ66ECBwQEaTcF)|4hvlc&fQ^SYFbD)k?C zhcU8{8lLOr+U0eTEHJb!EhLo zaHf2xA!qITyC*UI#u9Ui5;@sc*_s*cFGPV=Vk{mAio^xDXI-MqucP4h3P~>sdlmGZoVk5ITFoOtq391#jS5duPAA)!FuR9qq$bl&%7oR=eAN)j$@Ksvhfd1KutLF8re(mE^P0@HKNM&hi z*eIz_0RD3p4q}YG(j!5)|01<&&JABo4d@Q$h5|#X>M1L;u0Ly%gFf2O>C%w@ z_n6*>hf8i5`((FL@uDTeDyOL$U@uOqXgtj#y-O>2B-DhO7COF3r2i|b&*Y@KWh6Jz zsYb-wC+Oo!Q8921P2u$Rfg0*T58zmj}%D^I9(@{He_3ecKx zyaIO+X2AIK#I>raI}N2!S0F-SP+eIMq4$r(I1O_Iy>mnVg}Ml5z0EArrIJ&ET$m-%>n*I*Nf0NPdR1x3cY0 zbX+TQb2Wq}dbL++ta0spZN_GeMW0)7r?2-k6Y7@-`rU>kRR{A0Svp&H}&ZC4*lI*wQ#?N<31s63V79H&K@@6@)YjELjL-cL4sz7cTej|R0D>U*ofeffqTE5c zoD?T%e&IzSuD~X=^^zwqHLP|nXDRUk9-(KnN{N+CpD0-kleka@JH2+X4+FT66OijB z!nsS>%p(#^<9-=eo5yDfTBsx~pRc;M6(8>H3MS3lr7G9;TJb7k+_iqCAy|C zJYAd22YC7Tq}lmrU+ z2PMszv}BMg69X1pPyWh`}$<^hMGR*#$0q1VCqQdD2Ymd9pT*73>Q5v z`$#KkO-7GX-i^DD>k*eEZ_j@5jw0jBDicSOm?n3ka7~+(at8M57Zv-CBfwPWJ6FFEch-QgH+(HMx4gXn_g!z^7q(15=RaX?@q6>i6#W zoz;0~z4kd6K=<&%zf>3xA2^)36*PpGt0joEu0WH(AuHtwM7l$i$0)6!b1bT}QV)muCG&ju3>%{SLUYy%o- zkeJpm9mT;nk`0_A-gHePu#VVK_=`1=oT-nJ0jAYEfSUOzTsep6!bV3S;&9qH>x5Cz zTK$o>*P#npFrDAz2E$56iU<59q-JDhr#-KSY*C}1Yr^Oss}~bB!sn4Z;+M^6m=f@5 zipwv~xQ-=l3whZ|M4MZfLkuxp`}~UXSXo|eVm?^kmIedZKs<4Rtu}vOcU+Be7#sK< z&$gy;fY&dtrLVjbgYC(R>_!xv{bQ*ZU=Sm$&d{z>V3g9*%i9gsNtyg%`dI7m34+lW z2Ab5zj#>GDUbz-ZBlb0}Q1`|w z8l3tPpeL{4!F>Vw0*s8%s@_zlK2%AuRAXs$KtLBX0+I{)I94q7imgp6l_E9dSeN9LDtsPGG&3|e!R%}pxTDV}teQHkU` z05`lSyEuVqUXj(rY+l;E@4DN~cr;$SRhjXLADzfCmMNz41TS80c8qM#i3?&Z4<4iT z)-E1Q*W;NzGdrH;ovkgE!7()E7_8?jU!I(9a3i8%cC#^Sol!RYFH2Xv{Yq4(bhdAE z^Hfc{E6V7wCChjG+T8F~11gyCy88L@vhdw3vGa9rcBX}>Me z3%O+9Y(Ix1wMMrg$Q7PbJnF)C_1MAoDtYj7yJQ~Iw2icn3~cew02i!_76gE-fKWAB zOM)>jr1zng&FBKVYz5#`I#`8nE{p6wAgVu3iQ$)0->Uwd&rC{QVA3%Z$%m5|;Ksx< zEf1HRsttVwYVkrJ6WmL`^kIWwlOr)t0Crkn>7_KiGx>0+F8k7nY#4OYg43w}P;2Jz zu_8_k9n#Ly5v^d)Y{S}^AUnJ~+dCqu0_>#WR|NTJqymfj4(u~RzpRYNlQ?35u!3us z#s-3(fqOvpkk;s;Y_xC%XSAXkKuiPV@=@Aak%py0#ln>~C4*VLcQK5H1@x(UxuehT zTh>fnlO|;ibeo-~A-08~YEl!5sygFOCR|m^=*iGRl+Z0S+=q1rgWI+P;b^y~j#ib9 zYK8SULmuv-FrDd0!KUd&E5#X_=^Uy3((e7h+2~$@#<(qsa)4X%HbNN zu+&25dJ!x}7OQU!W?okT_)TpMELWlJH)rOGJEwoWal9xM$3}=$b1suM_F~`qHO&~; z?gn2W-m8+h`D(RAW`JqQymP0l?k<2sbW~Kc`8y&nE%{ye#HOQWyY^ATz5HH8;|e#< zuUiX)mqz2DdSR1k4%nk_9bznI&xJG(w^dQF2^A-^W+wIuc^uUt94Yq#4+ zZN8&AG*uE96({rnHmO<&eCB~@X^gJ0Iuvj!5o^2rb=MfBy+I{_vm5-~pJ7tHx)^#o zJZ?jRV}w>+5CsxS#W&tISJMi8hZ{!sbx3_HYEWskH$6vb5r@IIN3Uj}v{Qr8*T!yZ z5Kiqr$J`=l4YR%I;Yb#to+1|%gQOBGGaY82g#_k4z|A57`fZq1;!vVo(N^XM<)N(c zPwCUwmrje;gWy@K>qe%az4pE~aN%TeQw6rf$bTDISDglHv63V?P9LPtV#k6LgiEUH zFg0hAa5E*3!@`QJduO`}+}K2S&qQwWFS@&vw$1TsZ-kQf6z^K>4efbH?CjlG9@r|8 zs_-xaV}>556Z%DR4L?Q_WXg%F(doKS6)~ghm1Jr3D=d+|k}$Q>$=GMC9?Ph#akjWp zRU-n>bzdQ8K(kU_m}auRBq@<*+b7$MGl?%jJ6i!Q--Iz7jIGD-ef$Aorp%3H#!IQa z)-D^C8O@erGjx1V&n5zc*+iJAd>{EvM^NF2fF2+vT|7ym)4gxH<-wH)?k zrtbc)Y$=H_|I&}_?l5@dK^~(Ki?aY)Ac*RLY;EL0K%{mWnoy9vkCI7SjR$&5XJD%* zfD@c9K^8b`Ex3tG%uUg^%ySh-c%nO9+ zj!d*A=$7-dx-j&VEax@XHFgu0NcqDXrPfeW@AIbr7{`%}93VbAdy$gG`;HhJ8(Zu3 zNl)GRvxnLG?b`b9ZRBU6(HtckoM7+?$R`AA5$*u-H(* z_v=L=diV?#620^^uNc5XwM_w}v4)EsGrf~HAF{pZL{;se^F~a%zZ8yKn ze1QJ_{qp#7wxV#^ZrpzXEonmhD%-xAmQa4cNvv7hOgP#W{0|uWXw$h`H4!B3HwtMQ zLN%uDg-S2M@4DUxgtXyjZtgFX*0SswCx=#l`@j;uU7s4*qX58r!0$U=fc8zuOIuT# z>rmtccjtg+(L`ZCpPa6;(jk;;}V3fPu_+%%MviO7W34SP7rLNheFL?nh7 z>xmT06WJRprBvA?95%l7oaO<3DAx?F8y3m6cl1mt$9e#?&WBZwjwQ~2kk>V}BwBJ1`UA(HLhL_9JQr{BrP3D6P2^a%7pJ)XwbA_F#2xSG0U`xi{Ig0mBQ zMklrZW;jsy0}V5%<_oc!jVsnSRg89UNQ_JPl|rJ?GdvIi?ucY86DkJz@$Co- zjci`m^dbPkSfM^q)`D>HX~IN<-1O{3OYdkJCwL&JO(DuCm^N4loJsa|wY!0f6oY;5 z6+%tY4YGkyM0(Bf{w|rz%{->;rf30=S)%>y_K6D0^Stuy$C}*_q-z{~_znF7LEwl{ z;wsM+s0M;#p-_^>9T#M3bIOzl3)JAwoy?169gTnz{0P2%%DRXRAyKfg-pU>%vGxS& z$x+GDXf~$^a{pGI{&Wa1SbALUu|Y^jIQp>RGfpI$jP(@j}E zwL_Uva3Z%aTJb}ri1nxq*1dg*aARO zy{yZM;qmWlATzhSFN_%F=6KY!l4^Z}1#bjr2F8A3eTHH-WKSAFlM79Zrd5N8;?@Pw z?`|i`XV?(5A~wu=;9$b=X*`-LRf7*AvKlRc)6V z!N*|Us*@w#C=JbR(UPcJ+5?eDi_y(}SJsA{@qP*G`6lUKFApZ8Mq^ljNV5QD>Q{`e z!G3*YBC_5;Uqb2KJ5hi#E~}*nBA`G@8B1wt$>Z z`M4q#XZoo zK8H6&3=NRgswPq+Tm5yO+SdeFJ82AMEN7{5b!(+dv24}^SxP1cm8RQ~>08pIioZmj zs+SN!*Gn=D!w{D~Z0cCvpWvi^FqoAya7}@foV(-(S9HDIq9rRMW;U)@lPYqL%6u-R zM59&BsCxPkME}~mIW8#?_r(^gKT-5*qyeGB2*eO%rEYNbzEQ<+^hpHl3;87CJ(43q zV**h~`$W>WR_e*H>J`N_#z7^6Q7^a&sWGEGZVYE?Gi(BnQzKVXlh%n)sB3#yL~NX~ zV+Shf?3oN|`#QJlj2qKT?Ec|WZ?V}!#Dz8pDM%_u8tzSi(?bN#0%=rfBZi)Nk1YxN zd-CrxU~`_!+593U^7smHLU^Ys_tRVA)9_vxW;`L|(yoyEI$NJ(&_347?z1|Uw)&xg zRjUzqRh|SP#F3{#7`4OI{d!vO7%W?=eNsbIk6?7o6zc!&}rFQXSR40#J!ZK>qezH^VOtAx$A=%=!3{&TTHG7 zU%oZc{d&H0i=~j>jxi>Y=hOLOw#-f~UXE}K`w&zPN` zp?vQrcD*EvewGl4Ilr?(o|^LX1wWa@qIrZCts-V)dnZavMU)KfpKaZgaw?7T(2Ss5 z!kt5VVa0Q}B1xx-5}4}|2mJ~jestopilAWE02RCb(?$sxO*Uo4)zWM!kaHJySI+9Y z2g2@jH@*s15nYES#UP(DR@c}lh4nx%mu<44vkG}jNo z&}sygB)W#gu+#L9HCfcTJ8g-JkI!N@GiqY(>V!$ySZk|8ki`O_{bmqJ`wO8#!}9pM znS{Li8RZ5*5FTf>`SWL88K{YpDROp*JBAF+xT6q@!|Xx9#jUz*FTUT1T{0)bx(~(s zCt}obR>bv5rGq2<;$g4H>}tbHOT++Ss2bHm7sjxNK=85P$ojh!thQ<>q6{e=%}6;B zd#@tvH8QB8bo>34Dw?)*o6?-PtTpDm3S*Mn^{5{3eDmjBSX=1nX4Wn8oM-(zt@;iJ z4PoR7|G7B~QS;*{OoYlwa!f!?s(^5Xo`UKP8*4=5tD<1&Wac-ItpFyk3qz)l<8CY9 z^d#(I6+`+R(Pvy|iTaH>JLTmS$aj;CS3|^QU=MRCDL>L9B18dX3_FUB9Lad%({xs~k>5M?C=liS&S;uqzf28fW|Btj~W%++-LRCM~_Ti^b zIiqq4Ug=l@g~bn+j%{c!^v<3hM5oh68kT+kPOPP7no!XBC}0VtJYia=IiUf|_Qf?O zH7LO4$>xc9OeT9lcsJB@@U-#M;9PlJ=(!{v!V`^OSYgj8%xSt!Qf+XtesBNxLi_k5 zZJC(2IVc_nbZxzoF{$>y>JBxi`5egM+p?3@&(c^qbwR#wHTRfe3=W=JC4W!<*7Ncm zTA`6s2qv9^zpKB~BG&rNlmVIT!eGNcpTs|K%XucgOxXZkh#v-*C z>mnVShiHj)?i`@gmmEdk*q`aCXSZdwY7oye5LBx@%zfp?+1;5=(SkV_IUrP00(6vt zWKc}AX|N>c$D7T>#8G*%Gw8uX_g6p>vWa~sSC;GCx4spLz;4lsyGFIWq1`DAC}O?v zzwatVInLxo!P~Uf{3FNkDo>rk0EoQ_lQw0Y*oAfZwD%Ksz)K!3rI66kc!)c=Xzizk zK%!{xI9X$Cy|W+`J`+nqN3FlcOTm--n@v*HSLtDqkQ;RbOCQw*7TV%p=-T5IVD%j^ zNwC^^k;2sa{^rE4#+R7?V6!e3CCu%%Mw%tfhcQKZ$g*tN(JfOBb8+0N0Rgrq4nxLC z=?RZ@sKjF_q2?@TqizH+FN!G_3K@u)-Rao zSlXA104^&F8uW%1c)VNo@d#mM4Amh_0;yH*CNEv*)N(A1Wxa(Y+&P(3Aukl$YvL;5 z{Pk^&NK%+eb4*kbG1cO6fVc}J=xJB79Iq}SO+?!Xg2tsVOzv{+>Cn~To>IcZ{Aq+k zsWSJW)M%JweB#eICJF5Eo*})N@~$@8oOhf4C&5s_M6@q2+XcvjO5n&fG^lnhdE00B z`21!5_s+5H~J zj3*qsdbpE+m``UsKo-f^ECvRanD)u_;#JQmGu@*XT>)}pt>7G0g3 z?!i9qSgmoXetPselGk(+JHZAHYBwuQMM^`NsI~wetQQM+kPndwGHu3BNs2xq`k6nVW_tT038sB{cEr>P9l_#>C4QU8!iZ@{? z={eBm!E?6>=p|?28JNs1!OoxL4W8ON)sf=+O}&1&(^c^9+Z`>@q3RH;;YDOL|>vZrV)!`O$fTy3CQRn7%3Q&~3IZft87EIvg+)}Ne= zW#DYYwdP!I#B=F$*Zx`N2sK{ff@C)&9-5&%ah;N>=x)oOIX_=d14@vP8EUc5cMhF}GXb9pW ztj?YZQ2mcm#a=dtEO~Z+$+^w(+N|C-2})mKGgDCJB334?xY2R4Me4(ztdV)zg2A zqGV0+!tJQKjv&x1!(s*dkM2@2a9*dsa7yHRF=$_C#}SeNauDnZFML#}8pWKrKAzp`0Utu2u1 z^-&{+d2MxeL<9i@-A?z}p|> ze{uFqS7*MkfivWh;9ZDS4(q5cAiVf(b@G?%&$10lWC5^pT3NN9Pz%Ze4FdN=Ila=M zzG8D6u+^2#M+WA-vO2lqZEQ7w_Um{eh{x7%()#Nh2Qg=PNKzS9FG%(nZS$%}4#S3w zvKokfICFd1g!82IsYIbU)WjlJ0C?(}|9v+vB^}M3Q94RJs6@UW5?;t=j#lnun?|z_ z`e+AzmZkjpM?}YdaFgsXPzQg^gMb^(81$U&S}udbN2p>N({2XmvXrvCI`DiwuV6M)AI@4D95naC8*&0!_-ubVF^tcd& z{@r_)tjX1-&m(FL*+Y^I;owr%>DZM3GOs7u@hI4bbZw{CcRtY;;B90FYL)JPxsNH) zKT3_6>;H+o|I>gxWJj9%LVph^_EZ6bz{je^bZmY$4GpqyIvm8kB>(n(pjB5=RhR)L z)U+%ziZZQ>)krI@NlN#4r68xEu;9!3YV?5y&Fg;}x&9t_c>GfMu^>IKhaNlSD2&qg z?NJh;X-ZBu929i*=q=~~{k{#lRqwX@e>q_Zt}n7fO?|dqe2#n)rH2jnC%!Ky5HAu5 z4?bjCmm6jktg2%M(wI9J{{wwId3VgXrJbmMuSA76n}>haJxKBzulXBSHS0gn z$5a8jH4UT02kaJ~9aH`jFDiEh%h#{BlmCT2!k$cO0bVI~aTKZPZCX=(dLmh0MovVy zmOfS@s06ak7~+#mct5|)eoRP~iu;$mg_?zvFY3wurwNMtla|(I!(q$LS1C$%*s#`}QFz(#BHmK=mV`(v_ zxN4t506`6ow$Ao+>B~5I9nmh)X4^3L0PQY9S?}y0+Fv;NrrB;oW+fa2a#C%q6_3Ks zvekvwd4$(44r@;7p=lmjDYkI zGHRvbKMUxJHSxcY6d6*S;ey^cvuKj5(Erk)r8?=wPSObUFPT!ozUy%p8-K(;4ofKo z0A?ss^zSu(!S76UY?`SlN0*c8Z1XKd4ke~zD7cI4m&r~F(|V;NT0j{f>p{?1FO{e4b?c3pN(XqWy{r9X-)XiAk^ zR1tJ)YC2W!T8_EcuDzs_3$B&xbC5Al0f;dftd%~6&4v(Y8-gMh^lnVuihf*E5%f z^-_-5gU9dVn8@OS>y7HDcI*c2?0Wufzsl!3)?Oo8yzPd+qP||W2a-=cw^hPZQHhO z+v#ZX%|BH$-^rZs=VaGYwb#Day{=VgIg*K56FS#qz*ktT0}_W4%(pV@VKV;D?W47m zTZ(;|DdYMuje$b+y_RKHw(X7Xc7;N}YzBg}fvPF19qSgrdyE=oXG$ClATN{<7b@Jy z%ZFb;x>QPUCpLQP9Sz|CLrzf-^!6s$Sn=+qFA(nF6B$Oa(u3;_MPZQ>x*N_8a^sRq zTO@FP7?o{CUVI&dctkV}r@gmQ5Yp)pFKIIJUi!-pB#g@Je-o1)$m=#QpO{N9>oHq* z{bz;lukLobbQ5#Y1q2))07(DuQR3dN9II`fL5(RXzL`C~k^?(Tp{5*Jhdw>{Y?GV& zDJg3CPL+5$Q?y>$s4jv~`n-{~uzw-vrzKU!u6^Q*3=F@RwwhXcqQMxUbveC1TCw84&!h-L70Zz>jjqxfX zLQlkB0)e^QdHaDE6CyNyX|j8U?q!ie$Zzot)_1-n2miCRgJ4Gfg%G??P&Hega0vBL7(y4Rq77+^G*=A9(0{!#mlGZBABYRv%+~aCoCyP1 z>Rz6xTmFC%06AMYq-0Zv@J(#frrfJBhY*x7( zLeTvrp0<%Gy=a-LBPI&rrhf$ ziGO_s2<1F4*u1ith796{_D#t4Re04grGqZr8nvf1QO=7W=r1deDC})L>=oa^xXh?6 zW1;tiz^2;aBkz<}P#eRws-+JiJzp;8arJmm$l6GEsX zTiM67*d@u>S)qibUQ`uoF*@pI*`_9GGT1p&kN-u+Awo0RzUz<$BUuz2=#A~&-u^9u z@pMRHs=ZsIY;d|OymbBb*3kn@qn{(l70+|mE&Ba9m=sq?dJ zYfJ`+-({3xl@CjT@OqGpcCRP_2>}h+Q9h|Xy}jfdU+Y-_4_u#*Avk~LnJ!G-mOUc4 zKb!DEOa@1{?H_mjOB)+1upG94b;?)b?x#xWr&tTko6?FwWE4Ni?!LE@$1SOhN*_r*vplASk; zi1u=4k|wk13iTa>Oklu9pzVL;(L zEVDB9{g*Vv^Y(M`(3<;ykCxtx553tuw1WIEV@9t^j{jUBc>z#c8RrVh-fircz~B+8 zjdh6>3eNM1s$=(z92bX~0)ZTVDl#ZjXQwzyLN`^R{4CW77~-)|hXr4Mn1v0uzh;X| z^h?JiOjs77=cxu&B+LIuj>Fgqv{U5je9%fFLGK-CCqXxthlA~Ma9L>uY!qi4c9ggB z&Q0Z2KA%_3K?4N66gW${_yXXr6MJd3M4^<=!NJ>P+`@&qVO;&7Mo-%H(z1sDl2fSL+5Qa?5zyd8(Yatq`%8v|ViCD3dY*X`b9hEi_Dc2bg z?HfZnB&1^^HDhEn)M=)x@fTiho zh@&^9*W=_ni-HU?a^l@l$qelzLc;g;$L`;6wqm3} zyA5-Vum-Ha@oIIgj(_CW75?&=l0B!zd4h_%Vw!iLQHf{>(sundxjeYVbZATR#P0r! za_et)_`Kv%Y~ySsS3OPo6-2bRACQ(}w?m6s;ZMjyg!tZv7#QLMf%-nPKAEb-{;_VH z94rc%HqsGYJomD!i@%!ZhP&wt=CBuq3d03SxT;|{H+9W%1m-aB@(55@k?(b%^ zBAGc6D&)t_1fqQmbR)ag`j>WRyFgNf(Ksb_Xwi1M)k+HADQO*b(p#U^{a0}}suDaC z)BsX{%c%Tf(q`rGgDfv_QJ+Z0rfH$uSDz25U{#GyM1Um>j%3d7ak>(e=(X(RWC&wM zg4p)b*YyqceZ1zU1&c~%H=0~e+H7KxY3;Uonm-&~R*Vl~Rs~?es}T39a>A73f*DbZ z=fFYFnT3yNiqPvt)1&a|8xA9qOB>gFT7bJ?)O=R*fh6R;4Z@-1>%Y>gzc~l%T;33- za22H_%gcB6oKkF9j8(Ul zgbt|};-08RAwOdr{Nh@zU?T z<3vBDR2#XXIC3jFEM_KPrVq2GDqPd`wd(b3x9awko3dtDYy9eFXnXmp=AMoh3!4yX zEhf^onZ)vqb#aErRZ}f>F8~Ea9N(kCNnVm2$9iEGYWu zmYyXzSv&mT$;&VTRfVQY{A510>UI^@SPBf3j!PIDl_btt%rLSetx-aJbni8+nHu(#Wu(+Z0lB?+DxgRN~`@|!%!^5&+>BVN%gDMFoik=Zn!laGa+wd`iZ#Jco+-!{O^}^BzUUCWwDh z=arJRMc*<>o;ROE+yy0B&>wknzUCw`m4b%S{c39G!s6S+Z+j>BI^RuMkKPa!JDfKV=%Wmh2 z8gcE^4}m@zyd&OhtR*+^%?wXdS|)=$f+*P>UAW-->gX%D&yU&pyA$>=+`tDUn^*ru z%hqSd%iae5C6E#rmcE-_2z#xNG`}zM?&7V__Yu+46Bibs_x-$3chcy9Scc%PJF-l2 z=wxY-ZXsiy$|o#q0QGc$>11RTFl?FDt39udkx{eAld@+|^s{`Xi=KlfYe|-1lq>ks zevF*+NcyvUX5+qEe!$SVLE?!lI#+SAyrg|td60fnG44U9)*d1kthWQei4=Qqj~XVO zScC2_`l{Bt;oPx}9rpSDvdbC&oDn=_Sl_E@m;d<%_%>vihUT{L`1XEvfBit~ zs0NQT5ttK!GDOE+cBfwQ!SRKfegY*Om7H+HCl7T=P}+--WJ?4x@_StyK_@+%=<;DS z4-FKR!VTHE3%923#$Gpoc5&E?_bev`$aaC~mQMmm#nVB1decQU6d>S#_2?RYJ0Taf z8*?h%G>z|*Dos6hf`jP zrX9&MsM9SuDMvImv>wUr=vT857YSKPCpiKVSW%<&(e+SJC4&p26^@pH*ojH{k$+o0 z)`&ACXFcr-=p zU+mZ{jRZ!}|L_g?=QR5oL=phpczdeGGd92-UZK6lLtll*cm-odejsLUqt^M$$pjFE z@$Y!5xNve3inJl$1!Ky>gnkNld^e+{Pi~!&Z^zs>r&sU3Wo;j=bSIuH++#$PPa-5- zj3BZPtYyKhv41_5mB}V-VK0cBgcds`vw*|QE)89)1WG~!C22{*|0fe6@A_~jwlajq zr!F3Gkzol1vwZxB`e+RL;Af|%m+JPk@*5{n-G-UZLOFw@L6RaeMYKTJGU)3TmkJ|Bo8x%Z!=95v)_Rx3|D7tMF-bp z6qzQSPJ4c+4rql)a=tN8b)^49JzoZm-KKMJ%Q;mhNmj>}b(ZDmPuAQD?--y`0mQP5 z<6k_*k`SQ^xH}z=y*R}z)9nFsO8W6*@scJPeMjKHz6rMCg3AxwM}DTcmI|bjd8&(( zwqBV-Qh2Q}BZBgNdrX=Q(YdaJ?sZKLVkMM~^S;jzNC7Vp&l%Euz8!m8Cx~s6#_sSb z6bL%rWUvDZDxFE0QiI_jnGkSk17jn?lIbjpOp z^##lJ8(y|gI42!}QXW>_DZZ;}F23J3xzQ+ByGB5b!Y=tKSuwyq0CFh72!Dk`8{=l8 zNm7ZY+BBC1hUMB(C~@TdUBg}Ec&#mi{O1P5QTtwY{c~0~Nl{WbS^!{bUMPhDYXM(t zH34_uc7aNn2w#`qk}0#P(#nuj8}Hj?>&TBnt;k4#!r8oxm3UFj52vrHR0KGji%{Ad>V6M9ekbF|tYXgEtTb55u5 zpzBP|_yCi2zSy{D&H&I0y#8kSZf30VZwpo^7*gT~%TvL`(Ht3~nF-Yop`WO=iTcf@ zuK)#^nrVR#mS_Q0ZMkXOxiisa?ybufFz&u0GVwFeFuGvd^q@#*)in zO*gxLt7{+~;GoKu(A(|=mBW#^B~>|H%jz!uWH0fts#PsuO*dACBl|x4eBVlsgr+Q6 z69pSsMBPMthX!~-)%g2nL7x;)022`Yk_sD@q8VXp1@QMGX)y9@Fp}JiH>ysE>oSRA zXGj^|*{$e$4D6%aW=1iI8(Fhw((c`)uAX|0B{EoRZ39NZO+Id@lj7k}N%kREoVv2u zb(mD#y7metSMQ?^Pym$IeW;~qiDs$g9jqzBT3uW_hXL%~S7I}`=N?V!Uj#Y)6qZam zTb;(X^CVTy)5=N8-Lar&1IB!!tY#nxc%YX1Jbe;27bF9!n$hb}VOXg% zU-Cp#Sg(}Hvtyzr-3*jzv0t?r(xs7VG&B;&=M*e=$VDf-^_*64ElRrWey?$A)-J#k zNd;N8paP`TYF&Y2Pq;@+Nord2XsVx1v|djy`CvUPFx=iBDzVz@t}3P%Qj&*CusfVv z!D6nkVOvNbi|{-#-AOZ4#3EBGR-BgI_RunCOrp^GF1*V>Js6FP`qSFO^I34e@81LI z>%^d8&qL|&f{Jc~Q=t;pLI*_xCzX|@Fn?<)QUXwu%wxqecn;amC(}0EM7n=j))QMV zh~X=+>-EK|#{?^ctHoF6yBLaO3lM;HO!*o7$$5-}7EkTcI~)#CU)T(Es}Crx+Y_nR zuI5n*^qAaR2C`#lsC3|;YxJ+F3ROV${AwT#TSZBFpY1i`Fp&uz+5%navkf_8A2lUF z6PCu%#><9+iYckcq<#9${;b5xZ*hClak>BK&h=M{|7!!$u*wc^!n#H<5&{#=Zeio> z8Q^<=oP?U%XwN_;JM#@!w8;;6V7JW;(@Rn80znPAF9m72F9oe{1~72^7tifV$J%y7 ztoh3a5ajE%<_U~&@_F=Ekw7+Ki)MZ~YM}!>JV;=oaY_tXCC(-N^XbK1%*V98IU+PJ z!$*Q8e{7GF`NVsgbADa^P~?I`F*(OPpO`NyQ$46o5#{8yjGWKiD_xT1qcH*X^^8o4 zGQ~%;N`FFoF3P}|(MK)2c1|>I34O2OS z&Ya^>#5-AaFC&}5y!I<2fpDZP{mS}Kr$u%9{%nJS`tF0E_fqhnp?wwJD#y2CW$Y_G z3aH6;!VO|;4R{}1ZtLeoBB0p%CG^pOIP-v8F*1@3vbpEjF|!SYgi^mY#DIa`44^{- z;QC1<=t!11?MUI4In}#SFL3-5wbvyj(m{E{!sR)Yf{%OU@=3YWPeM}+evvUk*hr)g z1{yQ2b{5h=dc;>cZRSflWUh(B)l!m`O5VFI?n=WDVC@$d9#ZKeCLVra{mP3^4*VtH zHt*;N3MCgmE3=46T3He1MMOFYGMg9=@Ds_E=+wRqOhc2LCYj8KV;rEOybT18^0l$Y z7WX0ok%py6l*;9$hNsZ8Q~bii)@GfbgGv>o9rOClF3w9hImM(XZwpEM<}|Byubh;CF?3EZW@P+4yT;J17g zA;8-u3(5kfIaDQo&>Jg)*`Zxqj7z6kLn#b<>y3i>hpd9d!O+pxebM-3Y3lp#ED7BB>3WD*utVrnSyfA)zV z(|`6A$N&EAoVtUC`W*>)6)DtqMx9~O8{qDI*6{i(a_0}t;D0(CI-halw8)Z%EZCcP z=l4Q7?jiwp(<%DiH0g%+qJkgL}P1_)Gd{F(l{(qMRg+19pf%sED{r z#38kSC@NbiD-i|s+CFaGui|~BC)swp=KTK5VeR?o>r8OQ_J`+pv~hpo;;mi-NLHA< z*E?EyZ*}hZsQWk(@qSWyd$~7$yWF>xf5`b-?lzyW{hH6hb9$<@T|fGUN;m`@9Iw27 zIWh?Ok9EEX8LkQZWVsMUNCi~B|D9KSud~s307WDSnf&b|XB+pVR+2I7{R>%(Net4W zK?TeRw1id1XXp#qhs-S{7)_W}29d(bH3trBB2}*j3QO_jpy!cIA_*#3?Q>1X)zt)^ z>;4q=tM2Ne&=(|Z;LQ^uv0{Wa`(V_^nyqpa6j|3K45t{o)a(ua4VnzRCFBHiE?3Lg z)HCo4I|$M)f}9;g-65Q+m^qL3N8b{E#+4Toj8{>A}tUUWQqoj zj&JGn%f?u{15$rv*d+?Bl{IMxj>hvv5uk9Y{EJE!015ItplQiBunID3Hn~NPL$kCG zTAiA>DiXgk5Z8Oi+~}&sY#6M20kV!VESD0o85sv&K$a2-a(f?@ zC50P4$n_9_L%INx#R?gkbdDZ9oGv1Maf{f`5OP-lm&Af1VJKHpjD$IuVi{BsE=Cg! z^UV%ZWD>#QSFM}4W*RX306Pl09ABq|ukbCZq&JS;qyQ>5s2^wuu8>%-f$^+xFDSM_ z$z*Rb1B|jz3Ax8Aa^#M0=&-L5K`<*1$P5tl5d8o^6vkq+{6DX;rkGQhocTABcXSFg z%2TqeKBhv8tiD^(tfZe0pA+h*Sm^|#+d4vE4VxfIa6x16QN}5kFkz&D^E&X7MHQG~ zN_y5m-8Hl|46312I;Oyn%IxUuP`;DJJ+O}4dl;5DIg z=m9`1$twjXY<6(469)EUzRvRpPz|@tN4r-ZS@I7Yuf@jn-TB+G?PV(BUiMQNf!QGr#4!W_U7&_)FLEQ@M`5*efwd%d1_4{jX035V6$ zzS@%0&HoDiaFCY*3(+%qvo`bI`J6D-w$S^@d6L3K4vJa3-y@R$o#4;cbFQ_Ao2AaC zLm$1-z$B&N_9vAZJfFuZ!mAs&i2R|BCNnKn*5u@=d1&Bcc7e!(+?0XTw#c zWt_(8O8%(AHv3vuj}EYg`Ml8O?5#@waEo=5e*M5^KTm(05()Y3mLOy(I{l@<)3tA4 zfqb5jBk>{Em|e9|opH_X&AXLTl>t!Mp^3o{%nUx5D1|?$<1q@}c^`}6@FBO^@%p}c z%soFJIFo;WM-+nLMsrA15XyYG#Upx5z)${=tMvKzy!7~H>)oZR`f%n*u-F5DvZ3lD zH9bf3O5aUAC2$vLFy5?IaDTbhsncvZEZEoaR_Oi1rvn<2U&D>8XYaL+vkWj^QG{ISS+hL{9zLfy*WPAs-RI@&Q#`h$(4GhO5u^nw*vCZKK&m0BTXUFWN#*LRq< za3?no?o$vtR%i$p*HyZz5z;wH``6CA-0$Eg+&p#M+qT{4w(aGV+2}h>9hyK#|#=)y5}YH9lG*vKAL|h!Sx;awh!^j zYM8E|+#u84`uolGJpSomSY@ED!YA;jcXUN31`y_D4y#1}fB=V$3N{-pH-wc_)^cp5kKPc+HKCcK@>HVzxx^DveIDSw9#QM5D?rC$^FwyrL6TY2T zuPz#&%^ghk*t(;goz6AtZ(TLFKWZR{`x+bF*5~96AB;Lx7X`;Hc~Qfc1~c~r6DUoo zQEK#4(Sv-ol7L(68mD1h*s_0Lc#Md!(wUN2we7E4B&qv3;-W@J>KNoF+{{2|{d#q9 zy{nnI#Z5>KC4c2bqj|fk0lYz)+1@NsQ6RK|n9v_;y zIzUE#8bf6?lRegs|0JVlS^yJV6E)6V7AwA58VTA=puY;x!;TIa z2%ShqfsZ$uHR^Q3U8gooRPfobUxIfSSY@W4%{&H4uhS2Vmj+Vt7$S|?AdgBD{Z%^I z%8@ctxf5ikAGjjHSjKH-WK>_M>9rXSYPVNMT`Q(;2@<{&M7w+`bXIs950lm%#cKD! zqW~&w6%1i*_mtQb9v7S?F99Dg>i=Rd9qbS)qv+Ifx4@qHRBxBTPi+>4BTD!a<$Y)o z5`Qa?OSPZ%!t*g0=O+`7ikP`8R+*Adt&w5F?nu)bfMefMXK)PO_r2D_k+yhpiiZYH zS0f$hKPvPi#5L7uY&NWj07YId3E1Ob*#JTjD^%*rS0ai{BR|vax2j=57U1Jo%b>l| z!CHHiY*GDOVi2(K_ACKy>?!8g+)eDq-KPS7>!l}#wkb~etFCOUqZiuM)x32kGlq^& zTlh6vynn3k^7x35)wM$qloC;+lSG~V!rR+!RqGXuCkJ?PXF>AA+%d?Nm3#eyS-=XT zq!pAMc7pYwi_08A9gB0CTya8Zd_}(K^^#E)l#lo;yvciK`qJh!b+17tCR;xje?G#!*%hBcLH>j`qYO=vIXFX;jsXtjB@UD+-x0K z^mOkDZ5vXO zwH~IF%(9tc`CxFBUj#J2p%rVl9O>-uVqQN~*7wigk8bDM3&7YDt)uj@nZMGcCtOH@ zZEDWB%qj-X_yYOa9yQTGmPsv%54g}Fyw~ULW~Gy zEzoW25p^Ro1ZJNj*kjTMn$u@8EI2FpGk=w`Ij3As4_4c@u>h`o${b^+(wo&r8;&&^ ztVzJcjl^-`EeDT1I&X7>xnd}f4&$umgMc|ZD7jEuLd*KmRq5Z8q=``pHdX` zo`AS}G2We5?re8drFVtyo*1=y-$+OR@j?#93t-Vbu_oe;Cy=wP(j6Sx@@1RSI<hL;xdn8x1LKh4{pK6PL6cIN|&o3{ua_yppeE5U$7LS*FhB83ZfyRh88< zYS2&W52)XD-=D6NTv^@bJIfPiiXGWs1zZ)^n~=xa4=E%vk8P0|pJrXm2bF7|`vly? zK$ul16Yca*O*k&KB!G?Mayv8+&5=47HMOUD&PfKHWk8&Bn{GX}5fwz5ei}KR{Aejq zt+9BR4p8hir>Cjj(t@qf_DglijvVbchfb?Y?Cg!zJ5qp?eDYF$@OcJ4+T>OhVuVK5 zHM?=Ua~;Q3O!0W)%`mBRkA+}WTt|fh!y7pH*c;9#50{~Ua zgV)$@IqdDi01+ZT)Cw#5fsBNBi#DPXl@0@qsajJM= z`dSF4e`p9*l6jJPr053~&cIv5`?Qwpdrjb2B(*{3VjJ+i=aUtM$P_&mql0iMaTQYq zB3Te#L#QCW?2t;Ruz^Q2eM3Zl6DxOa!I$Hf zqpO@qrrUYG;nHOqu9Q#39e#se3vui8>FfjZN_l@zt$Av?h z6VaC}zy7xs%0|~i8|C2#ruG+d5~1!?{Kp90gzu4GQ}HQEkeQiG`gM3bC%INVQugO4 z?JG?`{uN(FS9V(zY2WD`8{ez%U?$`Nv1Z|ge+{}Yl&Sx*U55NWMyTJ95&G!y{V94r zabyJqn2AX6U^C62+k-=%aU6|NZr7FZIPy}`EYh2wxWjo1c@s-H`^3h3z?zi)S}q#F z@bRL~As1BWj&f7)RHa$Yl+6YOIModpDmxVr5%rduE64Yq3XGyi+dx z#^9n4U*^<%#R=j3xcm2D#8N(EsZ3`%olV#cP_9}^>o*=g5Idnhv;}x=HT~iIW`@QM z$oi^sxfk01+)1#PTg`p@syS;pOA)8+UpiQ!AGlf}!47OH#_$251$mY8a%V!Qy%8g? z3T(+U15Ij@2rHk0g|K_|s~Hbp=`)PCR%mh~MJqiFvZ^UcHMT3DnKJ{x3@m{%&q;~)TalWwtI+d9 zuOA-Xvt);6_o>PJ;7voEI&*%ja4Z)R;E1=0K$06h0zJV(86Yl`>o*-3LTBJM6t;uG zgI#7*J?SP~+a#1f1u<7Uc?gXmpRL~c7j54)vF7&5Sg$)?Rb=qTS*LlxAdeM0eWXrT zSR3VQVEla1+Hf!A#&bnyUhSfp|n;0IXcKHV8CIB1)K%Xc%Z}h8r z*4H5HTJB7^0J%yE_-~5L2Lkf=aDFC|)X0(mDRB-^e(gOlKX>s6x(n|aF@FUIQAILd zFEp3U7)OTAgPge_J3bMmCkK}dWqnTw+Mlap%}@nx!R$+D+5l_am~EVMVwk(WoGSmsn{ML zbHprfyAFz;#+G5+c7?7-bJMqYz4azo`taIOGqh z2}xDHxZ)+oyYEr>o4PDm9EV2Xb1o+2||-%tu7b9f}p z=9`$ur*bLu*xqSna_UScEf^0ff$S-3#m2k}YkZNI)`E2ljI?Vx1X5EAENK=mzf3AL ziVshm=V^efkHk-kYdQhNI3%2}TM6&r&DA#{z2RXUdwr&?H4)hU`m}m6XH7}AV@G-$9hr8YweP-v+l6?RGY6=1-`JO ze=w?g5qzg88NO&;ocW3!#YQE|nb`-=0yV=lz9QwVePtD^u@0q?bv>7BxV^?*pW>S2 zFd+>4@S7>Uq6sIC>3U%@zig{)l zz=udmoJKT?#=@gTJmCXVKiD+WF6ZtwEw$+P5}iDW?qD0)oWz1nlz0=-Kx5V1NQWxA zWGJO$ar{pSKU~^WGs6~l0@-}Az8c&9G1xkb_ugF9LY5?*H)4gqH(=Ac4DI#c*9O&8 z$JZW^jxhN8&?lB^7-%|Y$KR{7o*hP2Y8Y^PF83&!1%aIJ1&EbS^tV@XQu3HdWJ;Ht z>!Z2pA5z-%Pk8};!?~VSieMlF3J4?9{}C=M|HWB2`j2p7L)e;8dxexLfF#urC_o2} z2WpU>@93k^R(ZCHAL`2Z@SzA#BwZ<}(BWN!`)xDfp@51gDQN`11Ho+e!7SV;3?~_7 z&hhPs#((gzQ}Kd$Gr$kH516AmGYWn&=D@7Uj1H(92jlM4`}zbFZ?WL^?RrA5PuV@T znMI2oc;c0fAK!ztP2A~cP0_YFa*^4j&J?A-=iH^mKx~^?jV_`5bUV6{85vpij~K2o zX>fqt^#;&6PjjYhYMsdq$QiHh-!pi5?q{jjePFe_>r6Ok94Ku^&|YMc`;@idZuUuTYy%w39|v;KN=jLLz8M9e#$%#; z0Qf%GKJJn2SdofArTFmYqnT3XG?T)iP{0m|rd4|^cn$h{m$!GX-hHlvBWA6qn{ghx z4zPrfC(0hjNaUC9<#qc5MrebPOmh^)HoBuWnpfS{AtMh;G_n(k2P@X>!E|@+^4jSrXm+nE^fR@H zL5R#@d|*Jw!68_a*irp>I{}C8V5x-1ke`T;T1BOm^5yER;HxS9og2K>dXDzMFsYI3 zd_{laeOcP<%e7FWv9UhFezvMNQoMWjQo;1TflXVHs)mlU?4*2!9WMc#NHZte`NPG` z*2&AIQRF?IDm~}`AyyDNjSpF|=7MLsr&uH^oGJiLM8bT77q5x$A7^0G$4q@lSz#W+rLj~><&_w2Ei90)#3o90P ziw6jf(Gk7nDIm+Q4cM3|4Rf0Wb{sMz@oLJB{UfYTIAY~{h;A>;MBWl&8bVH;)lxj( z;PQi9Yk(u$zdH{$W2T3+QxydAXGox~qOi8MBX35^NgMYHk457_j>4~--yvPXmsXcp z6;t0p;Tz5Ft43$ck)cEh3p#HUrQC4JNdUC(M%kh1vnIV3pR;Yv5bcd`9~)? zao3E*sfR->-Bb;}oW03at1+}_bARHjfE!iuHYZ-SH1=Dv5nQa9gKk;y)%rc=ZH% z%r&JuAl42qH`l|b#I;!^ACby>+IV-M=Er|k3I%F!OGVrBKy`l>XR*H9DnQ(z4Pvly zLqdyJzC-F<+|z|{4_h+u4XyEE20iLxcCZ3~3aC^3)a6*GlOuq(kwyU;F93c));(}& z-BmPgCYVPPH3rh{N77xsp+myGBSe%(8*Pm>~1=mmUPe1yg;;3r;u>7lUzU*otR}#Pe?d$f|0yaIzy5L18+A*-9!p1>we*uVU4tThZQl!oq-inlVkCuD?HF+b-t3F`4MlO^06=!qIPI6aPN7eH z3%582I%l~%Qo+D?-J3>vKk3bSFfYCw07JBPd@BUWM-SqZ6OlN-@}ZLrWI|U#x*NS+ zAH<3xAzUd#=mwwrtqc&okN`z+nZ%TdhiV5tBXeF9q=H7{WyAOi3jkxr1)9)tBWmLg zCpHpTsqGJHpwOH-0w~YvlS*RQ%o(|CkT{|F-HSxp6Rgy$qEQ^waM+ha|XM>&xrmu(dH6QZa>#DE995QY6<$%0^K&>%Vxe^G{#DF7sm@|0j3RakZj_P2Ut{22Ie89 zyV8!!>CU3zrG}5X@1$bnZIMOM1{iO)ulVMQ$8!}kI4kMeWUBlta6daOTa1>I|J^*qo|G>sMH?mQS&d-z$1!h@B%`cmG$PpGK)>6K#7{cGxG3a}U zDUea0+N7{`0c(i2vGT2dToy4rI#>_1VFdryW+ro{=s0~lX8-@LF_^3JWzXVJGw_I_F+EXv$i7> zU9T~@{mV7XE~b8~rnX+zS)EA6YA9(`+t*CLC9|6z14wHQ32;`VvkA!aM{qe#y5zNI z8GvDT%`ac;#N*aw&M(EgfVb;7QAM9QTSxwewU#SZ9NZ4Rp%@~*^w`%6#NEtsN3-W| z_&mk1XWz%urM8S!b_xc$!ihdE{cg09)csDq{#B*gI(Yoz)O3C)e}4Em!T$wV3`qf=v>{y3UjN_2O9 z-LEe?Mk@AktIS*JA&|Ufl=bTGVpEUrB;>%~hlfjtI+?su%46YR z@Qdhi)Ay?z1$p;3-xL=F_ov3;PosPfAS2ST0Y2U5XE*uf@d9c5a{Q@AuRRAqvg**h zth@_x?SU}Q?1n!f(bGrF3IYY;YhfZrVnWgu+shtj9%JxKCo?}aE|!faQI&e-S1qy6 zKoc#Oh0FmA)tIY~nc{}*3aI=ovp;eo#_f!zRgpzlYK2tDt+kx&%$-Y606A{G1XfF^ zXbnXPiaRrY9LJbpou;S?GG9TSWOPA%O zmp^`yJmOo(j7n*1nzyJCuIzh)`GUGNlMBM<{`?EJry_uGny;BEwHht0Db?=@1d*Q6 zUWb&fns|jEkXKlV5kO7(S*btLz%s^C%0qk*Ztp!%F1J5u(jfaXfyX@6hwU7YN>^l28Ev@#B%2f)AC14h`LMTOJVb-y%NuCYa z1jTzQxrri3TCS3kwQ$j8%`}FAu_yi_?~CKQ+!PDQ)>r@`+=#MeV+FPdjIw=83KwHC z2e^Yh<6+;q%z3M7YLs*BW}KglSWhc2QQumb`WXD|Z5z!p%r2F(tl0OTP%_DvraqG{ z>qH0v;y)!_OaP8oePQqKeaF898|?$bN@s(?ZYS&hzvQHAZaZHuN1Zx}TB$##VQr3H zYN7VGtg9W~<6Q<)XO8X>m`&27%W21?;Zw*DHgrtnq^rS=1@Ji>&`PTqb+zLM(4M2H z;~-ykaO1%)fcn*ytdXYQ;R=H$w30^m4dU90p?B*!q5ukoOp98xNIxioRa22?S${YQ zIINx_h^37b3x!ncOV4S#KmV#g9~KUYn4Q}F0%R}peWRQ!oQGhN$pGfWrIFLGB#=6l z%unhF@AiNJ-plk+*0FwSn@$NLhBD3wP09J&);O-#Io&MR3Csp+;ylxHxS^K-ERs}4 zd2|dLae&cTlQ+aIDc9iPLA=;_G2kiavYdXrLg&tkshd4psL*v0+)afS=FFi%Bw|x_ zT>!nB7&vJg=PcJN9$1=R)4hvautW~^!PuGC)@l#YKaeO+Je;#O2|1r${^>9kY{kY}>YN zr{iRvIcH|AdFRXi0sG6YRlBM#$~Fs^Etac9H!Q#a%Men-G9}-ZJ6+<@*IL2?7^l~- z3|`4IW!gYsWb08fN19q=M0$d#7}lw`=4EfdY!OK@ca+mikAytaeT}8jy$gzqq|+6nn?3MTxR%|nKF)^5y$kr*CIK9gcw@pSe?(}4EiQP;4;E zpOS1E%K3QmYt(I<$P@V+EKpKm@7mnER`!!IBcj4m9Vg3O&I+bwq15r6Svj~Nfn)`? zQ#)iRJyYD;pUp#_6FAfp5I9e{cW#}Ix&y$OIqnlUQg3&~NRW~%_W}v>Y|WMa3`AbF zY5et2_M2P4#T%k;&3?@qZl*)VrMpU))3TmwZIR}4x`jxGA#+G9uz<-a!2od2q-Hpc zC5AC;oA94^HC&XPqC~U)9Fm+POmeP``coabbVq=SnY$b4so%QMC^l_P0>95!`x$HT7@SOGU)j zTJD6mU9gTZ_rQ`Ja09?IWdR?J7l$^m%!*b{_{naOQs)Tm7F{3kl{a_l@@%~Sa=l+v zrl9|Ya7-rpIMr_V5#d9%w*&-xf$7}RMwLtT!kh$Xw;-!qF)eVCe39Qopsav20cTT)6L32APs zyD#vZD4a61S;$${17?4M`3yzbK{0jr9E~waE@j(?PmpEW<2P(CTO3dkkAtJ$f8hF# zOnMKg=n^*`4@E``CIi^Z%VQ-9RJ{zy2X}Owyq9D8)M#5$ByiCjd}WzenwIQUZgyE2 z!40}8Os_2!G%#itX@1|_C%lylMGr%i(OPzCNn(mOFb1pq%29Q3Lkq`sUfo}dSJm6e!VUl=aFTnyns-V=3 zgMgTUSckJYPIOq= zfn4v>a_~glr9>R>(o}ipYxb*8Z$OFse0YB(?=3L;fJgP8=3RkerGKHwchNgKv0&v8)0*YAiKCapt$ zv>P^;+rmh5hiT2ef+&L~Ezty+?j>bVe`87K5o-?83SgD!(`=8TiTkDjoE!u=qD=9@-GDxV@A5ftFS}LBg3djbBP{nM5e5P&`>3*cIu%# zK$Q*wp76M!XY*=P^8R=sosa%err4L$pAnv+&|+w`OZD<$`tULEym0eV38_jB?DTxU9@0lLY5iaXWTy??-ZV-yXqFZb z^6>;}aaX?X-o*rdoz#}~m7XeoSNgz(1or?uZO-_9jUUfKih#i9M^JN6IZ27s&kJ)4 z|MOCZ2~wxQ>q0H|ir52G0lHb8UPq~&$b`jP(f;rg^;iyZ?q6KDd7Qgkg(2?J>^O^a zO+S<$XHiPhkM{3@hwi{dQ;A7;aya4tUgIIHRpl!!sx>(5(4Am@5bt7b zdxGz=ejl+zbr~p3!&>{WbH&1K2S$D-9^R zr@%6yl5RV}u$ZxWX(L+A#G~TTYnArc%tBZ#sk%7`Jj0-4>rQORi*XjSWjixlJn9pv zgL=9mZ6)(1NmkX;R}Br@Uoa9Oermn?%bI5^v z+b-Erlkk%+S!m*7$B-J0040*VY1q6hSNamnLYHwhQal+;aCmQYiQA+SoCY2}f->Zm z$shb!_^P!0JY3--web`Ok(C*)i!VuKf z2_=`{z9r4dk~Y4~jCo&82=@>&{NX~oYQHKA1MxUN>gr z{>#${ENR7jOF@Dc0m=3k%E)t8$EUQ5|4^CKXE$J$z>w<0f6^?-Bt?NX=~b3Fh-(=b zyI}nOdB$CAG?pZ(aWnxEzVb=bVu-v?Vp#+Y4mqn0 zgru`MSE~d%BZ9uQyf$`L6k$gk>fKFqd5r!2`!1-CtMI(`L|7t|&D?s(r6v%GgM*_# z*?W26KKT+##n#@JHT+*1ByjhGQxsY_d4E^U5(6@cfM@f>6JWO1g_!uRVHA4Bwt(Py19Re_-(S zbAiR!#r*A%CT{Y~%!3A&bUamdHI#?^=E<~PSY|foi9+Y~c+Mg0H|{-+_~8RrlbTf@ ze+Q?mdI?jB=^yn*gkLl(z1fS%NI z*0d=>&ca9IqqX1@$1x_KMlKwqOF7c-#8lPttd&0i1YOM^x*HE$huF=0CM;D~k)eZPk~-l-#ao;oO@=PkMirVCejUB5EBwmJlXX zx^h4fyhWPZ(5Ld^dUf>b8DP760LB#qzY*u_ZNIi3^af1PUKmR5>+F5w>qTUThDXL&iSRWe($&J{qbGILezdeS(9oRs~qa199?u7NV9} zc9?t?-Qz7WVXrn7Le-tdDxCH*s@C16gS34?n7(7s&&;~myE^f?*<>mq)#M&IIPWP6 z{Ry*8NvAcmjznsZcGw24&w@|J-L^UV)tCxt>oH6MVtKm{*{=ob^?K~r@Hx|;wJ@Ex zFKst8^=s;DeHO~L$?K8I(*G~Kq1>xJ6;hE{7O&Yaob zm8*XamZ7+Ao)rz;+st-op+54$5g=yrDmd8VoB!P;efj8bXSxQXoGC?fdO!5(nJtfC z9<-=i&x9HU&ILj{z`N4(7G-4nsyMmKeXeqkteKDOA6chO+t^|R zRZWePS5s?C3Tz4%*S?J_p299F-l31qm@JQS#yIg@!{?emg(2t)*oj@8OCA_&8~lpL z)4$D6s56SeT%>P2<&GX2?T>R!vek@MfN61LmruyhLG%hQ*mQ$N zi2K%Gzty$uwcl|R?(SeZLDpEQFUrt!v7kj)h>#r;?3chUd1G%A{>F=gTfaelz3`R+ zU8Zu=8HFw}NaUyEQ*xKHn37I(CBkQ*MZKrB6A1>3-=^%p>Hg@Kx^IauIq`qSRxA%m zrFIa8yl}zt0Di>oa0^X*TZHWj#EQY$#d5ijXcGaNks482!-DZ_(MA$mb8;?6UDdJ1 z{fi8|!=FGZ6WlGM;BP&->$~l^Ob6FB5y9Zy;)vZTX9!7VOMSl4c+&b~kB@W5*!8S? zW^>9c)BX|&D;pvva;&?97BXSWZY1!o16ke6Yc@r7ASNvUCvg3pv^Sxmz_?IzfU$P~ zsaO5*S^Dwz0-4YN++S^1P2bP-geS!CVTN&BS9k~cHn1-fm8}STN+i*&?b+HOzLEWq zdSGA(-v7@ARPBPwW}jTEwE*T_Bw7Ymj?>9lSn?=-DiI@1m3XxC2S}uo5ej8iCr&4eSFkCZ`HkDccjHIJ)!BJr)LrF z3JH6kIJNE&PZ-wn*m+i7(}zJQW;zM!!+Y1jogIKE_2-jz)Hub|8On#|oK6yeUW!r6vsL@U z`upv3R^j#QqPN)7=f&`EiaGxGm$}j~^A-8$=gwaKz)Xu?2F;34!1>n)!!1;4lTD_f zFe`MkalYgmEMdo-IGjZjT|g+@L)?FbRyh^e6H==@S2UuKVV)IbwsKSSKeXL?GStBhHRQ+H?kuI^0l zY(L8&J6&ngdkvN*5;(*kBPknAq)oOV_he~p2-1B`hTtmiy>)G%^L=iA_VTuW?>~2& zZadxSs^H=02(dGz(jn>>uR)``p-A5ti;3_qdlqS+3<|jfkD}7F!O1|j2Nr9+X9s2T zkAL#AvPoh`YotNtoi62TE|CR4%(8ftkga~2gwC+Sql2j+xg;^6RDtp6n=;N(kVxd? zSX$uIOH@$kPlV3_w6-u{J=O$aGjv&aBI;N*PntdP#hu(I_za_S{Nb=yW4zg9f@v@- z9nxSfAW72JH0F;id8o>iV-|kuyT9S}st7TX3!tuf@gX8q;XZp@xoer<%x9KQnF3<-eGGo=ufS3~3v%=H>xA)9MdTl3Evide_7HFW=h#XD2DEo@j!ZwWN^4w?h{{RL zZa>9;@suVC!kU=h!j3L;2~$GUtg&OW$rSIlgDVcf!i|SqFs0U~3#(nkB~G$Ej<%GU zDVyXHquq|tAuK#JvD95Rcn=d>Bu$R0(r2i8$(zBVJ%2L)+`2RQb&i6Ns-coaLm?r$ zvpks4I7x5`NMSp#B&7__#W}KPmo}s>)f9L9R(8cQRcDj7*@n);)^quE!@`tbgKV<0 z$xv3(w?`~10UKN_v*wY^{#UEXTA!KjUn_2H3y~dJ`wiH6% z;OV1zv0y>(#d{c?q*ottS@uWF;`^t#r~I?nYrV>Nr7LNlywk)Hk!Lj~!AJy6 zC<0R61q?HawU@Lu(W}wf4MM-@c=(~CEBotZ@W((jd#dXLS|ZM74N_#r=pWs~dNrZ+ z_Rt!MQ>v%O%@6(4nc}jmb*FiTxAmu?IR@MY;8;(^Q{H)AEZf%sHy;1=CY)MXLql{1 zI#=}X5ko^!;gR*BZ?b9H{LcIO8t=KCra?fiX$OR9uD_{%Rv2pge_cx-uzJ)Dr&G0O_ihn!L`0qbK*$oI?0N=!D zVJG_Eb=TCz<`afW9nV9Ff|iuCe+$n~lG}6><=4do&@#B5QB)gg-CI%X0JvGMAmLm*4q~p3wUwt{U{=WW_b4EQZP^B6)NgHe zM6TLj#1aS^3_l{WzSrWuYS5U0SZ3iSH6${(rb?{|sUf1v9~kvZX%o7(qrg$hR=`z* zqhDu=Ju*GaJ&T9oU%g2|j#;jfgA}xA;`2Z@+b|m{eB8NnX>|3R+p&2N5Oxqt=T7#Q zn=A%lsnx~|G-Mm# zAoFOSUyI#~5)nU;Vsk+B0&FI*1jZMYzN;F5(W)P%>Z?zAVXH%b%7u*4$SHUx2s~O| zR-~VI{vhbB&)yZQ!=C5_mWTp}K-g3Wf+(KX_Q~qZjAw#NQl1h(;iLR8>AMDrf+?zQ z*tK$umis3%!{C2B+kFp;ZXxtQd%eL5f+zIhgueZzAE3pAMlPB`2317)NABgLJ(G2e z9$9}%CDNGk!S(}#BM&mEFLh`s?)Al8dLQXK+@ZJqge zOmIXq@H^lq+7yDWBa=OZt()bmVd7|Twn1-=&mM*c5a>K zQ3TAi2L;4V`tj2ZUDU7PNRWV5E!at#WY)4?P8*?*!6y^Q8uayAy@}ZnWPQ)){O?Dg zd)W~C{}xW@psfF^o4EgvXx^2MZ0$ue%J#G73v$NMt^96p42X5$b#jjWT$sJ|7JH0Y zO3zN_ULxwzNYc@EY0R#urXV^IQIB_G&feY%I6nJVh!}eWcD>B2(qtc>mFh81-cc?e!uQ9=d!KeOlMcCN#sd{F zN)*==jy_E$xN_eO((?KBP>^%}z7kT;^Ez-Nub^!G@tz(6FY;=3bn{<0Pw>NQBL?p3 z^(^9gW~bayX}iPxM6!-nM9&Kw=G1>1Bbd2MgCDE~o<^q_iRxPEPOyB|nejg@l6 zhZgj;G=cB&UxvCcO>^FRVx&Jnwh%6-r@dX3(xckV-hx-EE*x6{;S{%BX~UV(%n2hw zW1!#+!*5~X9`I{-0*DK>$og$tC(^meQTohd^5Yr!w6FEDM}c!{fx<-4Xg{aaLJTLu zIz>&)pSUO5--G$!02|1k>anDCE4`YaCdEO1hArf(JUSc6@vtuzu6z!_HqWckRk=)M z+$}aN`6tj((p>-co-$_MzLY=rQwiVTt47hz&+*gsll%iL)}<#ELW} zb;|sd{`Efx9Bm})9?uY~RHQTbsdnKxuti4j(?7z0w*Oo!FzZ9O0Q`2i~?YR>Qm=me=l~lQ-D6e&U1d zwP}{V9;wkZN5c@-xlJ`0yfZdwL@pi_vwrLPyTzGymbZWsh#~e+sS`@*0Oei zD8|>dz{oxw4G_3HWXq<`Hx0!ki6XE|yMwjQgqJ%?G^^KC0w)<9;}eW*B-h#SOPnbMy7 zw}(+Nq=ES?tWFj%?XqnPdZH?*%FH2*-@#4qK=jbLP!H{lom?t>zf+Td3?1j;jbxN2 z9r`J6uEuDfDEWxzz`U*xeWg0+DJV|gPU%UEsq1mEgPY8?Ocp1^pkgZBV~I_e&C`oSJyOS8?`1P?_xCdEl2tJcby zx;R*@+iHlrvKe;rD4Y*ZjQPla^B10Lp(VVx90!@pQ#2(9_XC<<`S4@9P$K9t z_>wbO0T}^kMc9xFx{}o*7XWLS3$9|FqY|_^^o^@!Ps34Lt7)KONBtAGuqd%Xu9q%W~P^>aZKw9UezJmZdaXGL!$DbbNrZuS>1!iq*~T>PtgH~cs_b-tS*QIqbh z*QY&o(dc_=KWjtvc7+mEq2hRUP78s&9Df7}mL*|gj$yQeM5L@d+($g^;N#$hcyPFq zfj;nmHyzC01Y;unc?FMWmf#ekJz#$#@7e{>7d22gk6D(HA06wc#&{9a?1gcbWHl6$ zX}{W>zbeLLoFZgSv`ze(PfzFU2OA(v#-}ONO$;s0?9@jgIR67{EuT!D6CarES~hTQ z=ab%lM+bK@D+PPX)t}LS|I{OD4EbkgX16}7BlP6qV{`Bs$K>j@g512GlR=+Y#uE=pZy~KGX9lWVP9S=;mODfL#fc zw-WugDwX80)@`2)r1PPY{k>*cC39&d<=2%K1I|liFvg>?KGLyem)CiL7j5O$Rgm>z z5r@*n4I0;s&oN3-KJoN8+xH|}g{uIx4+7V2P`aqauWeAYyx4KSB@1JW+AU~XomE6_ zG|#7QBEL!N_91(*@wqM6-79RV>~@(Pt4p+%j@PWN2OS*Y!oo1f7JD)C75(k)4?zi4 zzg<#8GoB3<jHYD-O-+K6dnL! z?xJ#*M%=F@cY5}UO==x^5HvdT-}P^eNb%_x`v9MVeGzFCrg~9M%po%pX9sX8(x7hN z$|d?x2S_>+ylCsA#ExU+alJt5?=zC>e5#rn3(#~@T^cD;5ej! zG$Gt;x0J(tr;JDc4{n**URdm)|6Gp`r0SB+adhI1y(AG!D2UO%+wRd!#OnoATZL`) zUG`+S=b)uq_G*Av!VfAs99O4k6j59p`8-{QzXPgaHK%wJ4ixs;4STM=-LN9*`!cn zh{+niQu0*;?|T~%aka#to?d#92P`A5Q65eFk5VuW;lROiVQw%lgcuN5_+0@EiV7$R z4P{sV0&%rQJwxW==xvLyL26u9Y75YId}E7S9Le9-^@HFUm4`t9$dOvKHv|ERIU!_h z<85?w-IYbn2cOXNYSyQ={`&k2Wl05#Vo>C z42lH{rjmrb_^GgGVmvKMCsq&zyFC&cgPEroEw zq8MCbT%IONev#TwF@h={c%x9iU}(~11-=pOUW~*Je)v34)j&&O3wAa1Yj9*6YSvz8 z0ca7>o1~e7WGU5Z`qbuqn1|Pln<7%h-CvPw9BQBz&WmSItrEB0;j?>fiDaj*ei&@f zD)fM8Avv)4q?x~H$>Gu>-NL6i z)qJu0Xe*8!!6k<8I;1wl<3S{Gj`~o54^!avpNDcfQ&uU#cuLhm5YUy!aWh`K;h^IQ zq}0vb6CJHkwLTU9Hw9;1-2GPhA^TeC*Vg^d#QQ8l^W(WA##rkSpq{YiP!rRX-(Jei zSQ^N*>UeNjR~V1kb20F+M8jr%^__eY6Ttbxj0-I93xzDOlKO*w$avBOV)OlSUIlz} zW0x<~@Z!M*7&a~~IVtCOT*(`H4p}d)EEMX{zY(w_^ipj#IpNSz5etok4K*>U6+9xH zj>GXv?=pz^f*61!InUI!#I$G1i>o4=_moq8p2wKXb0P)~SZZR~&_g~C#r?B z!nCX0{<`(|u}Pe%9I8IO7*prMa{yw*SMsKg-3vzQxwAQzKAdOmQ5#q5XoBxyg@hrR zf1dZ3^%C zDiz!CRWt(%&bU!swPjP+ZS-6IFtSk8?rur9qecBy0e*g%Pj8hD6 z2G=@B@8lNTTbjiGZqwRQ)>Hc&s^(#;eD#KRXm9OYU_L}Y2TX~}Vl#WC8#|zKAjDp7 zD74{DEFc{m9H?Wyi!s|O6mKBh%HM<71$(mOFY1XZ7rgb?_sibgK1}{*%up^d+h*U5 zoqyeJ9DSC^4cTxD+IHM20`5-^AN3vj2v^>k42%v$(Oz&`ScCR;khde)+AshIP zVP1wJYpaFj##&{{&GK+(IUN5TH4;{?;r}a(Rl#ILkEz6iQ}=js2lfO5Lp(@X#$6N+ zTM_d#SpUJ$4=sb|{Z}&IP?ztq>M;IjZ~xQ5w{%C7Bw8#V5oXYNJ0Yb_Y_-a!!PVf& z=DhZ0%bBl( z#Qtp3oeZ;=ssudU03b3culso0<|&d2rvvVs6BI$ds`6kTsbs9sntM(@p13fBhL02G3`7 z&nC=!%eM(pT>heypJ?t=J zILy#r$=N8(Nqrv{snfHJa1?hZm+e`bm|N9Ai)=_!dUX>@GR|AsU9!-O_p#^gR@znvZ9;Yzk{!&z{`R9WRB{!-t59#NAuQ)$tF`C>=e zFw}W16yR=6cH98PrNCG@q~sZ%B{Wug@l@?8`~;ge4kT2Ei;d>;zN~A!hKT7*V=9F; zKwZo(4p{V^ALGkHD1@tzJagGUU$f+h{?HM1C&uRTu2rYTikHa$HZP$toW7`}Q?L-z z_XEH5th-I5aCi`Ijzq+k8br@GvQ{`*I@}WHFtg1x?m36Y7|-^Bd(F^jndpi6&YC)t z!(dnH1q$*O;cN8oOt6_noEv_`oUI}0q~Y*_V-Wp3MCy_4&wgafN#C&{{YU01*pkC| z*m|To;<*0$L0gr_MF3I!N?%n!j)+?{sB8|^Q~MV1QFvo{BJc4f#71THTeofCD=KHV z)^jR<`66>u;n-ePaR-=PVsWZ=l^;^|;(d>W2E^_vwe=7Wdiwn{7#-L38lLaB)ou^C z)HU^&!SyRS-hokPQMC+Dj|8fn7d*}SnWWEs0nGR2i%~0ew%mtv2O2$8y`@)m@Fx*boU)o22VJ61TeXi-`1+A zz^Q*YIMRNmgqC6G@4Y5Y;wdx<>f7>^N z0TRl3iJ0Vo4Q;gW1obUL}P$^N^Rs)X^eY6hTZ1=vtZXJ#=WOfcd zJC8Jszbec8x_;e^_pSaWe8|HG_}90y|7lA2+as0Ii$%gbtYi<=<{-g{>3!5<>q25| zIDdy8Sv>-Yu@)NnT8n5eJaGhHwP7YP@H_A6%#%N&o#tj~C)^M9NA%9nWsw$Puh?zb zFTUo(2?cLJE|{tgy=Bo`cpfgle@^s|HY~K_tZc-L`3G?k_!Ei=AMm3UxYO>#)U&ko zJzam*=qys7bO?f{kJ)>jO2mkdLD54+R;^dkclZ^IZ5z7Rh6EjO)TV=Zt2M$_Bzm>w z`ROf=u}-Q68Yze48%hfrZ!CHWW}A(q`jx~cK18eD7_{IGgR-aEUz{;vgD=Ryj}yuj zF=5+fQ~LCdMFj}7D zea9OFY_FQ8{_02(zW+;Pktd{8^A9KwdYop39)rgvK9hQ+LVlWScwoi(%Lj zJwB)=zs@{dBKC}xdd06bNpfk?ICiZxutv&!>(Mue}KmX}wZbTI7ysl7_hVq%6UOT*#lM`DjUjYAP zRWjWkE92Xz0H>%b`SiMrMI{S;RxE($K#QdDjJd*(_MWs(77;c|pnSbVNPr?yYZw5< z3OBJw5KA-TLX17jPhOLU!>S;?s>>NGLjC(@K06P|+mF{AczNo4!@68hY_QPzx>00O z*hY72gQGk2ckMvqfg)r!&qRGh7L`ozHJQg}*~LZYYzzCrUjFFWN5&j!AS5Q{p~7*< z1R+gVb9vrf(>^wIPJi;;@x+zK@kQGk&GwA9W&rcwqYplrg79GNtDPfKdanOhF<8Lj zRE%zFS$x(U7#IBfJ9~6DJ|E`7QeN-tRi`3Ou^JSb)Mz=AV)jE@td{|TU!dZl_cP5! z2fX`;&}b~He`_^i15-||!8Iw+NXxJ4pF@ohB<O(lUFowCZNyynb&~d?ZQ?m=8Ys z`uPH-fK6Lf^K_2UY#(o9dWwg$uMfP~*Yi%?cklPt=QEI}IrWP1a;A87CPd|lBL~Tp ztADPAZsgiWgs1DBHhiTYWnZu?*WtlAHR}GPy|pw|%=oRXuj#qUKrleW8mybGB5fs` z&mRfmIXLe?-n_kFRODYP?s5C;?o3jTmk3 zEP=Rs9=f!mr4jEfH{>*nF&%aujo_wYi^WikdYHB?*WppG7ZrN#`^=T<%z1~;x!{2+1B`>1%hJ0i;W%IqS zOkmfT;BaVbZ?A+oUPc z5JV7cRx{a=!{ied?Zv62HK>(M&p8c%S@vg@9Y|)b>o4S$;?I_~R-L+#v9!JL-n{&@ zDwQvW2K_NrbNb)0w9ytEzz+AKU5(=pE}F>v2>#cQBD;-gOWZPs{rS3b>w&WiF|&;A@Y zRid&b??%ozdUu42GY zdJcZe`hf5bO)ci2$#m8tn9e>SIaebX$WjQuS2#^qoF=dq_C8wiY-srH^W$-bkTNLK z2zK@oltlW!B2%@3v6$cAXVPE!(AF~5wS+tlK9s*y#a?e9Qfvm4gJn#BP=$*{C7n zAT0fT&hKax*T6D#!*>?=N4INUCTV`N80_e&bHE~_GLe)sH8G{`oOpX zL;VlB;MzeEZ34z^lbmg3y=gxDh>SYM)cxsNawY9w(Gx3gVQ*@Hw`&j7Cy$qq2$^~r zs+5mV$!-7Nwc+xm8&{+@hxReb?rz4sRTq37yDU?%0pt#NaUqN^)9|O?t=3a-cqPaL zz2U=8_cy)C4apc@x+EMnnV|8RYeLbHbUH`05kA#D{IQAPf0djgGXXJrLf!aj7 z=Tw~4*t!8-ERPWvNNsW#@O!{PBx;nMHO|F~`tNU-h%`*#PCuY;BRVZ@OBflhXgzF> z+`($Q?{xR(4P1ql=Io|qDvfFQ;qtNHRFX2n=$tv%U|Bf4_>wWvF3BI7?DBFUr&CLl zBwtf3*Koh-$>f)cn3~<~0oK7y4OH5{o(zqc&0z<>XUwuOaewWb-6D2h`|{0U(##J= z1!GgcY3w9m4b4!S`o%^B(g1mxh`t0i$d6n;2Q-X5Yml8qYGwtlsy9Gh(lSVM*TpiB zX?PMNi>3$jXKB#`Rz~ZXuO{6-F83*|=Z{s&Yqsr)H)f%&rB}w+GwYmh!%4*pC7UTF zMKqaDlkoLW4Z3h%YtS&T>Agr%HC z7Im_$bZpUojwHo=^0njiuWb(>Ihd~_JPGlXe8UtUcX&iB(XX4@VTd?M;c#w<7?#%s zUWSmyP-s_rAfdH&`6Qqc4{L?4Ai)XE2@RpdPt@k%pdNhq{>kVYdbVlh&;NuhLAldO zu)!$+79NiOUs|9e{(|$z)dR*GC>y?@xKRPAuuG5|*BYag@q|j&=6>ne&B-l|a&TV=|31_YDtz#p|}xz@20qMjS_cQ_WeA@h*IP5972@7pKryA>RI^v*gspD!vrk z*nj-$B$TO(*90uagb@W4V7h3}MJe}R`Xb7Rx79%6?Ml&of*UkRSkD2GN3JYaxS+w? zi7&pGK z_$(;AesmenH?_aEtd6n9@9f~3BP{%p>-lyFaO^fvF)qdL@vjK@IkER2{%%^}6*XgFF#akVotdBm2!h5dQ3m$_j~z=V+g7*&?oL0Rt^8kt%R+aE8D zGG`D@$+A!h&*Um$9mjVgVK`qqA#nes%IzuJ=dNJi8S-rf{vFUrI7Lc_ZHQAuuH$k= zWqnvyRg=@({?Z>E9~r!G-p_V(p%L0I6jf=>SA%;NjB*=h@tLcaN{5H9$w2;RV~qPU zj-aP|l2*OmE4P~(tm^Z{k5Y?T203Y+5okDs!S9%9ICBwoquep8(KJPh@4?M$Dbk`KKe$iyf#Z>oOq_e+6wl)p1?c0eq}9jxqe{~{n79n zmi#>L;~G&nEYV=IwXYG%$!}RsqoXkREefx?^upc1wuk;;HNdY_xxT?5 zwUymWRhoBY3t_IgT^&BMNA=X&-F{Rus+5|d!pCh=@>*b$Z4!sc36*A7&}Kq%Gp8a01^Aa=TKG3QJlpe{pUiPGGjLgJ;g!NY>c=HCCVr>c3wgs$&}t$%#+ z=Y0qF1&eT3zv;ggenN%rHB`Kda*F$#GE{&D8JmyMda}znFQ&l%p4kP^Zp}$1x!OqK z^}iSqGBY~%Jve(k&XZgSUXjaJ9 z$fBci`ixtw!BxUJEs^I)m-w8069V~%iaA#}VXub?MM9vL0ziZlP`Srq-G5=u&!+s? z(iE0vQ2ilP1$sb!#hFOBni9aKh$9ht4^$jV?&YGy4xGSy7At`(DYUpiKZ2vRQFsai zCnXkDV8qmz=E!>%2JbL>2S^n1@|VG%8V)NZV5kfGqQ4+(gR)?>=@VrOPn9xhjN?1+ zkTY2V^R*rY7@boNTjnH`Gax(`_w)MuYodIIwo1>2YzP>vr|$*{BRGUj?qPwY=&@yU zi}1wc5INA{JhVJq(&0iDaK-J2#!~@6xAk;QCW8DcCqmNsADcq z-4qp5ckrn9-*_P9ktTcFcG$ToOhKs*>qB&EM9njl=I>ZkxM2Vyd#m3ZrRfsrwYXb5 zOYaO-C6p-Xpq*2Uq*hW>G|pWO7Xt%vsCjd;wsPfLoH=xA{eCZ)c@$&d*H$r)WPgMr zP(H$6=$uOPD)te-4*VEJ|1s-H@^?sp1&cJ-6s?!)V;24QUB$A+9?xsPMyaf?WuM!m z1xuUanOvFZ(vAI4TAtA!7bhgZmA<&?RI!H9RulQ9=B`o>ZuHhM(wO+wwnK$Y z%)Z&pp)U8)mVC`=rsd+Tw)x=!IxS*+Buh|t)9vK7PPK1$lk<8~x0@#Dp0iM>2h@e! zD}Fyu(l+k$GRSfjdoUs*0K0R1ui&76XK=Mcl!y8!-J=21t_q>}(zvhpq>RpZ5R82{ zU_3;1d8*U#KGZ`DIqIF0a0cT2DT!tMT^0lEGJGBm2GG5|_P{O&cU$1uc+M7xDs1%UPcO-uYAAm2E0ML2o>o_K(Cz#944mLUd%26vWeg6;83crlfhdt3XK8*5)^ zon9lAvM<5>*5{nC#VMgHsJp0?pWN05FZ_qpN*&_M%}&RS|1EyHKnB>>`@CN7%Q76k zAtG?c%SO*mbPk|&4tOig@Nz3Am(U1I^u;Hc`0!-tF8MA9;}u>}!DJrugRR3s6j70f57Sv63dXK*VuAI%@h8(0jIwo}>*3$%;ME?l$GT>m5q+)iiK(sx2%G9| zG2_m28hZhM;J!)PUI_aSjIYWib&yjNrB-G-F8+tb2cRiq+B(a8_=FL8pLr?srg;%; z-!47v_*UnK?<&~o@n8tqmaOUlT=<{)d+U}UKE1t;Ow9;-*`0QIm^l>>F&Mr>iE3?^ z@icDju11@JM}6*^q=qrG>iIW?z#{)@t_sC9BR*;#Y)_l)2lD$(zk>Tcdo>bO&2>87P4kM% z{#YCmgMs%r-KGx9)2Ql_2V(n`w)7I*I09bqqm_zW?SK-8cPDx$;ke#%R_MwlflIJ> z5{ZQ-J3-zGZvRu06cH`$x^>n+N8x{R&&5@u2zbTkf8dg9RdYRwgK{0jn)eoK&iZ2k zhWB|M*!rH32v)(^2d2iW~7+kqbTE{`r__#LjYL- zlFF5mgL>&0DZBPyh}V2RVAv)ZD_4@e-X<&p<;%sGA(G-wt_Ku|+;0$q+L8j1zGfdt z!yOewccniw42_8@-!ri=LV3N5Y4EmC2t!LFlAADtUC#`x#5E%_`!v;@88jGz7|?Ei zh^(=A)_Wn3)~4}D`k^5K?h9Wd#9OSaUAClZ{7$+s2LG_z| znqZ@Vs>000TCD8)Ua z-ISO>n=B%Ibhy$`x*n)b?v>&@KAGoG6to@QzJ3H&>~lLpQUtnH2K?!$l=A#nqKr|g2)?+ol7buDU)Qr zdI>(9It<6mdeKTg#;;Il?nnILTv$@gKs=cqLqKEMBDcmpxXsh^ z6X*S|V{1I6db4*`4f_h(AC)*A!>{Dx59CII#~U+Pqbg>6sYebRj0tagqYBSftytk0PM)tq@8}=!&JtG zgc)G^+@ufbd)fa>e%heiZOPvfIYOQqgwJZ zv>4JHn|A3|(IYr^L=|!QJ*Wj%-}@%C)nDf`{F0?_E~c#M@JB(5O_<* zKiJS{AX`s1+L&mPKkjywfWJHWsOX>(zWRd)*2>(9G~i&flad3`)q6T~gUPPQcJxKu z*{OP40D%5@y_S@!l_ngctq9J)epZL3Sjmu1b1whh5O7a8@l*YGf{@DczWPk3R|vLV z&ue_=`duw;^7{IU$tDRzbdTB8dmeDRwjy9|^Uxdz>2C1;+Z&oPtDZIwy)P@y6Q(Qj z5-hiWeRo2#{frwJ?x!LxVp`wk{&M6(I=$tE0W4pu!tg!{@Le}l=i%rum(-)8BJ%m7 z9l?CO0jCMg1okxBi3=l$&5oXr5Xuc?vMqN%%;kAoGHM2p{>k3>#CElSs>!Ymql^-K zh;cp12tCg76+LZqDV;}NNvg@w{6zTq`A{D-1GzLQzW^GVE=J_GbK;|7$shBW_l=G` zKxafY=#5SHI4ArNs&%f>V{m_msPi+jee-m&)3R7V3D|Dz_8V(Sdn;NRd;UesG!-1W(hZFoM3*rmYm zHGIwdE-zVVY5h#E^eS4hv8A=zCSdWC8AcpO1M=EJEVYnggXxMQ) zeEw_D>~yZPtXqMBaQsO1iUHK<3b##Dpp>QhO#XL)E05v~-l0^_$#KO7vj=YTPdK7< zRh8@-^GGjPy&x3UL z*!65%!eSU*IR*hXTGSjufQ8&>d})_n?&!ZFL(8B zts6c_vnVE2_8xI74PEI>_HADf_?A z7!r%gx8p{&ip~pNRxHxgzIn=o*jQgw^bD?vNFtXVRT+d95XyMh9jf3U` zd*t<4N*pBbR3bzF)PazjNlen9E=s1f3knC8zS+K>jdLY0lA!_B^rj*K<;Enx%KcvK zPKO~W6^oqtloX@}v$d@vlaG)wtU%cuf!mT_-oC4NYte zSYow_bbzb!1w90#(xBAUd;OIyA5yy(t$9|>|NZy!eLiNL3y!Yzbe;RL(`~nS0|@s= zBzWRz{|^NLHd7sdpkY|+a>}6;nwlJW!mES{Z!k%WOnqU@8cr6)84B~BoLa6GWx}vv z{0C^{>8~~TVJ<~OzZIENu(?KrPPJ7=M^tlDrRGk=iy5Qg95%XKM^+;IIEcP51x<2j zR_iwJC`OHbzj5Hg_&(0m0NruSm`bch!*q@QBuP&#)u1~-aH%(oT~I5&yF}DaF?=S= zDs+By7hlnvu)P!UL{G<(F-=yxWwZ4~e!+Jpl*@0v zd$)&M)0K;f4tR zgT=s~pAmy%ON%?9`NHmkK8F6(lMWBrndT)zF-MKLPY@zo(VD1iY?uiWMU!>_9Tb=d{Xm5|%)Km)LbJ8d6aWDq=s6|=(8h3rwSKTspcZuVWAqSX0h`-tiJW; z#8Ec3TrpU)y8WqtCzA7G5}u6g_Kw8T&2{>bxxI$(Kw^>o#Q&@MI;ceOu6v9I7(G8N zT)r<>Zhy$GK-7iNOukbC(ABf^i1}b#?7lJIJhDFuOaR=jpSz0UvGD?_uF$?8%wqBU zgRM&1g!F&7uG4oYuS2dgaTVYAb!Q;QawdA#-OdkPaEc-M(J`J{zUp$zx^O>q`Qf)I zYW_2qYlQ)Ouhr@WrcRw7y1eqog4@m#{e;#q_l`x%QFg6w96sXr*W0_{{}$uu6XjL` zmTAfyb8g#D-r+4Tce-=eD>eayA+dc3-&Ow+g)pBI z#w;apBb$s);>K}E9He)o9%GbXlV_3@avhsDu;@g`StJlX-6pEMEY!0C8_`vJS)UhWP;_rYg$jfd>bXCuzzbkihE#)*JWFL zBsZ^V9)jfhkuqFQcPHkx*4k>+!liyB>!odS^2g!s^yQXYrI*nZBWTG8btfhZeqM%C zRV$k^h5mEx!xU64+E>WA1r~2DK};O~D4G?YrS`FKcfbFnA!ojL&Cx2(aexE-P6y8_ zg`jGP(50@D@Q7|+yLHHuWQ0j#BFB6Xi#iCkTcugfRK^-xeTK&%*J`LwL~~YwSwcpC z3q&24X!%BiX-r7$&aQ^%f3zu%{IF6bADZq?=VocQ39u{IpT1IkwR{>J*HY)~ zBstpg!DL}DlIyMs60F;*La_oAZSQAD7okG#qQ$@XCP0xZmM2n(j;4SgqvVy5dmPr) zPqH46#B)%zq>S5cpToAgwgpU6P0s4SQd3Vg#NBJ!#tbQD3H9dXsVWktk!d(9tPt1# zxmTT&zn|ix6Q@zID4>`lYpbJ|C!!WG2#!9R&*gW}3sS0tsROSAL(l?5H*hr=DX3PD z+O^9}eDF26)jOp1&zC791@2V_1hJtyO^)Gg zvJcYlsG)mMY@|wWVjRT5MJ2?vw+w2MH<>nqb<6Ee`{u8&jn-rR;(R7vRI72}y_4uu z-YB-Mr~2{?ELIMxLG&!vXo&zU7TOU42hd4mKy+A7c`q0L?pX)B-$O0?CfSc2UTOQ84fbUF&4)YPVkM&=t zmL?LwuKz8BJ|&$A55Od_*==UY2&HufJCv7>N#w_cq<yPkL(h#?~dSc{f6XsUE$^gj3p;uEj}_$RvS zg|z;6pw|VED)%H(wv%K4n>W(8d|>`oh0 z>c)Olt~*%C_cGs>oouCt%!IfPCQK78A5gR;mZ?%=okp|kRuUTtG*jUo0G%X=wZv4l z!z{a_oY0*#fINK_k%Pvy04p_5CLwnlA+>(@Y+X$w~VZMe?b;V#0wiFooS0t2!rW z2dzVpX9xc!U|Dvr|D{&bmCa*#FE+*@=foQjWTpuCpc5M;>cwYhbpu0A_OnuJv9xZL zlwBl;W9k_h5E{8Np`^CV6UY_9a7Q$R*$mUMimPKTq7DIDsZCEU9SKL!$Kzn4m_jw? zwiD{uJvjpE+q!Q9%8Ml^b^$KeqF#su7PSyP?+fYJQ;wa+yc9$;oR=F4bNAx0e@+4@ zUf)U36VkLXc5GOM6M4jv%F8}38T?w`@4&Imy1OnO*5Z1;7pxy@zWlxe@$}Y+STupT z^2%~n3gsj=>2PYhT>4{J=K+TaZ|h-nA)&PXTFJ79+Eqr%IRy>6eU&)%l~A?g*&?0o z!NrKPKE=Ip{lypOrVVSA7!DElRAc~1Gs3hyul)?gntF3vVF}+aW*|yFUT)2czh`Jiw}WgV_5xx-ueo;P-D>Wwj!K~g;hE! zve_OcO50|;G^WRScCo4N1~TDnp%$-}omHtK!Pxh?IN}avo8VE>>ZD$PU!#+@kFMNC z^tZjxfN;_*H>Q646)|}qb=wKBtRj8tvrTbCuL&p@=tW0>!@$v1rt$wx8{j^Y(omw! zw?yF9aW$vIf~!a;AdY*n%eC%}-L@{V3k3U`s|$? zhR?l3^!ix{CJ^{Qz@Q+3Jkb4*T_y02fRld;(dnQG6C&xtXp<|3G}#MKwjo}(;i0rV z=%qI}i<7PLn}&Kg>iCvpI=n0poKpOFfNO2MbD=W4UU}_P+13)dP|IavL8w1$y*5}N z&f}%C9_>%UW20g7mJzjs^O!KK;`;T5NCnOCuj7TYOfJ`atx#8);;0rOQNi6Zd#Ud+L zTEa5~Ie>-h|1B0{|BH$`hg_f2!I-@z=`{_wq&U-y553r1GyN$Re_TX~iBxN~=hwJk znBDGc-b%g%D(4e7n10H)iUx&kgYl)@dOse3sJy*5H;?a$k)s*F6J||mabmZxZ5rnl zW!1iTmNcZx>)-DOJ;0iqUUt|!MzY`Ep%ck2OYoPG=sG$7ZC(4uPHda|v`sGhNI^dP z$MlVzU2nSeE|Z;jgSwA5_4boM*R!nM`&(O2%~r1BK;Es3?6?opoeFOE4wcraV|&LJ zDc(fme-@|5&55Sk2NEw+vpj^fJ3lDX9)T}+CyZ50dZsk)698t;Hth;ciML;`ThY6k z$xfbt!qKnm9s`OjbHJ-&ifT66$Jf=qNcxBE>q`&g_ur3u-SfA?r$fBc@OU01&Js4% zJBH~f@V&n}gHP>M;TE7TO`Svc8;rvyxJTD8VyP-$N4t%Vp=QT%EAX|e5P`z%{(l|` zZkP%NJlyhmI{~2=srSEX+{nSZx3)&RU7GzL>{YB8=B35s=}ze$W5B)b+8L5rA?TCE ztY?ePOPk_8D$41%Z@l2d+bgq5_tO31Mt8F7GerWo31qC`(}2~5IZN<5H(>(T=!Es8 zU+#aatEgEAF4Xhyq5p2Xf9&o;<&ZptNS9WV_;-%JsS2o@#VY#Ulq*GDITj+NqC&&a z)X&c7F&BK3zd$A6`^TXZp_*fD(NoL z44l?RUGEZgxY-JmLusPj3XhaMqfo z>|rLPbLTGGM6$)>-+jL2Hlq?IaoBM-(M#rn+X_JRJCUF8NdxnWY;W~u!C7)YMDcR$ zFWq;UiBYpLwO`%2TE($HTCpgS<^YT2jmYFJYvrfdx>jZ9{?->3lEJ&Fbfpm{1Gh50 zkt`uiMdaM>so^RRkCX!@!;=djM$XS}N=oQ^pWMNyD!1Q%xt zQc`8*FR!wBhCHw;QmTH%=$=wHYDDU-u z(%4gX!;_BUe?e$MSYUR}szN7v!8Lo=K}-N=+I`@9pOl52?%pimQELBGGX^!9pFq0T zB!ZDRjWB*Q)5vghmdD-GsaHYCa-$bB;j_nH0vD%I?}Ag#obF9|v4_R&zjyQjA8RE5 z^X2|qu%xu{={6jkA(#g$o66BGQuc*Rd3sfVhL$R<21s?Y(8BnOH7ZG6q=LUpYU2Zh zkOZO5vCSJ;h05x6L@2gk?lsiuo-%bGVUg%4QGHIf)ExmJ9u!9|f`pU~NkY6X98et+ zi%3{I95(!u_bls5Z(ZD4fc%Cv3^iHqHP4vJaxH6W1dQ{|?!Is`xPTl!_8k~82WcDc zt5dH^2XowAz4c0J0d?ngxwcL`ku!jMiiwssTR}C`+HP1xw3W|YMfZKPxXHrmtPE6! zv}v*~M0%UMp=ANyd~_o5^KySkL{aHJr2Al}?aR=0LvGy=f zV8YefOib6&p4`iLCI3d`=Bm(DiYTeCKYjyx8fpy0Fc~!-NEzwup-JbXbvi@=q9ULt zC1ap6MVXI%oWaDHgd33X2+?W;Q%fWg)AU4>(TM)1Jb|)#7s)#Uf#q?thP~Y8Jf+~* zVjkWTcT$TWb*hHFF5!B*jM~BNf5v^(g@{bD>*Kip5u<7^ zoAFRn9ax_bBBOb*2fiM>`p8Y;kzsoXr+^tBYU~;PLqW35@HTqfjRIt$qn}JSXu~x3 zr_K_aXFl>sSSnGOaIq{boGfM-wlOo>E}c%RLq}<%J+re(KTK9agWZE}J!C5JBsazY*@jZm-i7WPT5syZdbz5yzTTHcR^0&~3M>-FtJ2-Ihbd9_t_M=- zv;bwKxf@nzljhT3FaWy4DX?g#){3{YcdDi9RG9nN?ClgTMfhMRm70qYn0^h@O?lPw ztX8S!&=Fs35%}C{(*9vq%M^#1T!x^L7$;2A<=JDtQaE2?o(qw$rjm$xqMLY#c+)Qx z4>+c&)H&+EQYuByMyN(VN>K4Ig*eAodbEYxDpjb7Af2LLb_IA=5lOp7x7H4-y7_{A z)D)A@H?nFl+(IcpdGhiUz(^2wv+k+<@Ti#>0-5vowPmQe>I#HmZA9uQgR)5!0Rh@A z-3aTKe@XtPF3LP2+_L|t#YMN6tzNNt0oE;42x50_C84Z*CcWL2!;wb*fynj7WO z$erMS!A$lP0s$CwOmdQ43l?rnrXqmGCFHCoSr@@U)fj8`7pTf$Qz0w*P>V0+vR%sq z2z5*S;g_8h9foncm%I#=ih(x?U@@;-NW8Y(x1ZE~UL9#GKz;uw%O8VtQF6L4u0JO~ z5MBl{m7X6Kb$d0}2Ma32D)fGRmlxY0MG8Y&>s&vE_TV9pLr6KJ`*NH#0H z2>k7P6b%qxqk2zxK-X%tn69c5Qt);+46w=#@*pqh=(>hNU+3uWgedWk@~Myn<{-$+L$bPE!Mqvrr3fUS+_dH<#}c* zocM^IvG!CW!k_5Ou4dmT4fkl;+!RHh_r@opzG;Bm2+vM^he>P(eSH>Cq_aWOPC?Nh zyqZ%*N}o$wj!H(WhE|;Zh}SR-4}NA4;=UE_kG%z{c^_cHq|Kf#)Lt1#pUa93V}}iW zzW&W;vFoM5J(KMa7Q}UN5H}F&V|n21jZuV2`pAK>ftVn8kF?$CF6Q5JWK+Q~P-WpP z^k)FWvkg97RT|1IL`-$nt2s(_yM0FZq%_u(Q%h;o^=J7(TEcB53WLaJiR!VLZ&A3_ z%htn;+u{zpKvJQ}%|Fc?D@*lWI)ja7q?0OcHqGs$^F%V!Pm-ABL3%i;o)iIY4<4cE z#0P3mrh{~R3`-pKkcJnaRjKjgV-J`ji7x;d%?aWZpvRCAG7p`B0q>y&v=A-V2FN}TM|Rud--!_7+k;r%v;Les-4&Ak>{^K3^~@(Oc2zO_wmar+OadD z?Bfi3wRX)dqjphHv<|z6KligvLREmW*~8q$Lf)A3dYlgJqp({w*jCmX^C`R|RitIPxWFNS9Okf_Yht^;85!3X~x8_%)YhQ;OOI2&;z5oK{D>ok1=)aIZeWY<#$$VbjqR?S%Ro_f=;a)#C#NRlgk;UB z>v}wSgWD(%FGU6Y$4$zTs*UeLa>C$?pyj>FUGIXLr!(T@M-)4}aekO~9cMU8+ z=i()IaNpgr19Y5Gctj{4p3uJRmaR8K*>o!Hsf2M<-TPAO|Ub)cZ z`Tsl7g7RW(s;I}!;%wULDlc8Udij~~zU~g{FpEfECGaC*lmB=CuqnzyP^#^VMdSC9ZPhcxgL|tuSi(yEoIxILn!SspcOPW(+8y`75U* z#!3mp31TGC66_<4%2L2mS|F0n&}LTHz|71*JU6Tcz~PMs*@tJ9$VsnZT43E)>!k3E zE$1iwVi^RVM3a<{^PJ*VVfw>BTFT|(&cxc~0!_#o2Mwj50J?x;)qA+$ax9cVx2N*& zvsPX|e|p*OwKF;J1pB&@=!5M>ymrp8DHxw#8MNtAE!VeYG(qR?iwszXZN$kvQs4B6 zx{<0IP@YN|!?Khp0vAfeVb~(9gb{>HRIuc-XvCSNudam`FcCx}&%q!PJ0v}7{N2dc zUx<~e#-^rL^KaP6Atii}-ROy35OW+2?hg{E>5DX8MxfbM)}M1-wfNBp@KG6gM@xvB z8}p*N%2ZyE1)cuX6lOjt`FTkB0QmM|{~r^? zr43;}FFfO?pnMidB1R+Ce|xT{3RW#7K6daViB2{Me2y;oX*ccL;C_I(M{bVOBUpMv zXjlH$8AV5&VKwOE&0h__4~Gjl^T%R(WK1h>&DLPtw(ytcNF_l^84>lu$8m0Uaf=~z z0G!m?tSnbA*oydjh;!F~6z}*9YE^O=8MXk;>cbk_g0s=rmHnDh@kPGfP8XC+k$_35 z^h-|SYtYMHnZDp2@hwna!U$zm^@TC(XYOBG`5CRnObXGu{uOx5ef*#C7b;-UXV9?7 zxKqV7%5>>dG$Hbsq9EG+=#J3Fahnvlfbt+nCT4~x+RRp6V;wQPhop`Kptd*F)iSdZ zSf8Tl^dMGz{GD}Vk-Ez{m}S8PO4f-u<>%!ldH9qnR-@pP5dALkR{BPH)Q`x;%7F0l z(9A=K1-z1vFAn8_Ic z>3Spr$TuH&b2lGp?68K9h-mWWyno4h6N`&r`08>hp@(N zc~u*$dJeOyV|#QOPOe+=L# zW}h6XH{tQ#n)zqxY8BL`RObuCgXET9=$tq?O%lM#%o~n4#rfdXi~p$n;is621UB7T z324`HrPD=;&+OpGjL=`Q0Tp-y`6CWI(zd1klOB}zlplJm*%E+S11_AcxQdjI7>AH_ zpumMjfh){;EVUGo^s^@c!yMyHow3+Km?6H;yR+9TJi2R~-l_ftk^2oC3PKY04*x~@NMm4DBpUt zm``%|zofCks@>_9JLjL?=f@=OU2Q-ul;euNem6=acG?b%Y9_WFodt}1OyC6l7t7~* z+D#gQNF-=X0}`Y};XN1A{PFTB7L|Nzs!Fo57LKHEQPxVqL*vc^O_~v?)RtIKjF+k; z5DpAMtiFp=pA#ZJ!1El$l}0KSeGHQTHGcUMOP?8X77n8-HRU+oOmjm((GvY@qY>!h zh1oc%_51B4H}p1W$|e`CULpztW_yL>5oH^ZVFQM$;0=~4YScC z;_i82MIxthX`!A=7l|f4h_=d=yIZ|=ASe_p?0Bg^n>Gai;AB}UUyR@XTmXJkytFD# zeukz%qg;f0@)@nvnLD9BK{!;8UFoZfJZ8kM^iMDMo6;{g-%wiKu#V zY9lBMNw%E^aJ(^(IJ3e6B||JNyL$WN_)xRf%b^cDuVyP{EL1fEX+dSa|FG@8E_=7U z!qb>WRu_OqR#>*0@S6k*R_<~MW5CF&q4s${dS2LAR^27y??l`b!HDv@503d0jK7+YcICw+8+RKeDx)=6G z?|Z_e7x*uuZ-fh;g8yw~?y$6^k3tPx$Jz|(S%p^!CeQv0T z*4W1)vhcBAr_uRz0)wAF^KF?q>8oMwDP|_s9ucMz!A6p72NG39VPl@A-N^1b?yqa5 z6p{rzV7Z+UEpm#lL~6P~*+s#9+QhXQjQ5C_G@^#~Q1V!y1{b)x0owVjk;psi5UE~} zYcd=LvdDb7mU|T${6cFy>(9PLO1_3PbeOM608X*P5n!b;{x+8YsLvf?e733C(r}h> zIsik;vB}s)F2ZfuXbc~A-6%U>+9Sf1eYHXm;Br|GjBZU`4$AWDGX05*&XeU&4>Ws6 zY$~Z~jX9*ubqCpP-$nh5pFbRv;7 zwD09N=_wBlGnDi|Fm6Vv0}Y2EOlu8#!KM`ULQV` z2v~uiu&3%!7&tH>a^pv{ze*EiD?}1hYjjQ?)HzmDUd5W(kG9UZzK<`k5>L6H;t|xs zC%92+c;-vDwjXEKT_T64Sz%_ktntB5ci-x3GC#7qUTBZ8TssXsm^(D`^k)0?4c<`$hY0BO@`<;d!#M9co|2-=y`hNLk+Wq!_`*UuUf&TGj=S(~) zp#ApweYUeu$7rc@!5zv3tmq<>;0XbJTB(qlfMSh6ms<(neUr?C-x(vBOr>7{A&t;5 zW?W(>lElW?rs&R1!uo23?N%krR)QW|^h-at_7R3Gs70~>@Fj!l02DXrLl>8DVE2nl zapHXkO&*p+7zi{h0GE*RewcQE`li1V&j z{v+x&(ktk3|C2HUgnK2b|F42+OUsY=_8599P~1ly(D57?ELq7X)&{kyb|{sR0eSYD z>e-t@zgtPCxgkZj1ttWH?j^b1Yyks88AWO3tIz% zBIal-1A8TJFBqq-SyoW=2B0BIcJ5Xm8$Y=0;i4_ zFlr%g^II`}5^_MCFCL`qoER0uegu!+-$D&7nEK=TdKj72TW93dkRYi+G9&C2n3g{x z{IvY9L2M#c$Ma+H#I_qD9QP$O6M_*R%cL_NKm*EA=y2m>tnYz@-vPt{)JqNd+XNL8W8cHVTmoC|rdy@ZC#A3sBJJNv*rvs8mt7M~O&Sl@9#Y|z#?<0OIeJ82>e8*-qK7GKBw^j zXbecEf>d%ta1dr-qi$G-t~&qu>&l!X^39j70Oz;pn;SA>hnbj+&TkT{Dw~PuDsE+u z$)9ZL*_fHKHySn8iJ~2&3dM*RHGwOIxqnH}^Xo(TK=qGu$Dl{NN^U(KbN-T@(r&#h z&ON{Qym|*$=1ycsokG|sjVQii>7up_;QmSF<<|3nKW##T2y#sh>)Br@x9|L4MJNdZ8TG6wETLy1<4qO~Z46Wv%E)K$zQIX6ce)B{68CqoZM|%};A^qWP zSQ5f)6Y}*rl;5q34@jx)79~|w0QA-ERK^1Er040T!|5JVzipvKKNVw?w^fZ`b}q*b z3=%7p)M@F;7CUBoYt>AHv{|_zEF2v}5xD}ETdEI)7$H1gyD#hT+1`Sadm%@5ksE7K zs0wUh%D*_06At7k+coNsAcbPUEt>+SR`jj<)7Z_%t-^#l;K-)`Zg>OV0a#kU@R~8_ z?jwn)=oF6cIL<%~>|W#BVZNr8VV{<7RKhX!5EfcP?R2|GemJ#k#(pXNoPwf-xTycw z@|)J`UcD~<8ZA+Pu!?6B4XdO74td?Q0t-l}NeT*Ll6(`GBF3xW=f&eLCtAk z&xctXq!#?y_~*ZZan^c!fOiFnSo`H^-^7HY$yQcp$8!NvAHujAo90&^p=OPOfAgt& zjPhiy{#UlWQg0oN667ekXey$A;hSu9C|~H6_H)*?lDE#T(^fx?O167K6U4>7yTw}4 zvSAzs0L%$dK4JBojl;xBFF7l^;>zB|w9alytyaP%xBa3M#nX~80N3`eZ6e0r>E9aB zKNiux%&X0j~jn#_~* zpC*9&!pxSn0Z2&g8A?w%)#DaGXc>^;eOgv>7&11$J!O164fp<%U+=GVjdb(yIW&?(nf4~W8W9imielB4XlI#e3DldB`G`{%Nhssj@&`Rp zpeeuI4RAHhG>U99Xt6B$))loL-Ef`PXPAc(4>za4a-As60A6Fu>tGveo%iKfZXNGI zCd>Y3U*9W?yqw=e$B)HVoj~PDJG*$gvwt`bzw86wPGB-_oP$~a9xnAi9VOpocVzFi z_F1H{mJ6ak-{RsB-qU)Pu)zD0pVcD4FbZAZj5BPxAwRVG`aepKA1H<)FuZcpJ(X}l z%z$Fe%^L6F0QM)vJ?M*pfR%HTKV=yr!dGa`>wXomh3=3KE*=Snak6;5;1>)7r{;eM zL@Y>*O}l#rH>>j66+&VyaA|kF^9cL42KM6#97j}CfgffC^P(X3!oMK#yY;%Q@auqM z+`6^OQNz7S z1Ylhx$Nm|siAZ=xu&*ywy2@>bcB)4EN1j18*_eRtn=)5=8WsFy$AXF?u&s~kX0NUL zYqrQE32;V*iqAir*_`=~&zR(;Aeo9}xqwPXn55KW&Y~oU|22tRO&BAuv zQR#&6M3s^M`9TU;feaJ?94`u7^8VX>SjoCt5a?$0-Gq#k^Z3TRKbUG9?K@o)6T}bF zHn$)?!{QZ9%(!IP0L!jkppX)Tej=b*vcyiW1i-$PajQ-@frvyTYXJqi9ZuqstB20^ z5q+)td2}^my=cz6C{f=?&-_MK1!im7O$v3V&g5d`|Cv0fJHK;tvN1F7qRWfYse+>F zi`j>OQUj}i@~HWVdAoUl0kI#bH_nz7g3aU=A-qiV738S`=;Y!9!J!rwK9us6a;Ex* z0W;v%bXZZ(2MEoDdMN9Nro&*6^0G1nzy(Vs4RcwVhLlt@JIy9ZJ$TFZO$UFdCa{Ee z8YJPGLJ3!!K|P;M$hjD+v3RDwDTh-?;7>c8bXaYiN&D~^326~A{fyOF6g6$Dq?PMHiHfCLKJp>lTX)sjS-{Kbi!3}tu$(#AFb;D*54L# zpJbW2omrd~qJDK*9-bm&kZf=)$$a&K3too{_!&3yoK6y2U{yWDPzte`NYUk21+bmG zzwPH?({d~Ih*X?<#no(|xC3RNghbXd&nCJ~#Hk^VGJs=sVOZvQ+_m|*m8N<@i_R1{ zDPz!HpX9aSdS>VmtZrl#)C3l%gWCu|O81>m#2SeOOT3q;LJ9) z>+2l6RFS}tF@aJlihbVak?|lJ%79jY+j8(3IS`$Kh%8o zq~Ol+x$)U%!1PbDr*19k5Z*seNh2gUZ;yw10b!h)0MM7XG+`-_UhO439oDOw-m3ui6ULl zy*&fLFZTr)z~BiQRIAkVrnskM1@Zp}pg>>0r{b}|>oZ?JMEdSue;l4uz5aG%DtL4I zAD)wA9RB_5O&&4CBkKu2eUp&7Sy26;avSvur@3 z5aU*!@p4Zefaqq=3B`!#JEga#BP%azc2>_x73Cr3N~~ zj5Cy4m9>Vyae061S?AoO<4w#ck%cT)6o-itgRo!)`G2zX@n*93Hz}9|Z}AqQ zl7Y)tOvB%l11AG6VY#iZ*|@VzgpFc!wiWO^blR(aFXDfwT2nvl&=9{P|2F}~!UOC> zGOa5oAme5%OOd^7CYXqwoho=0rRbuQf)*U2sdKY}Mt3p@I#j3PLB297Gk160OfEaU zwTK`dg8a&r3hMwe3}-4$r2{XB`{t0su@?bd34ka1bti=>rD0b2Sz)4QCBj^?u4E^1 zfAe))JSl%?#uQwL{D~Y|%H4D485|sZ7>Pm1=b2ETgfbK2Oer1HQvDHfR5~yo!mJ!s zbU<#<6p;da@oCQ@&!ucpqt+B}kgQP`>L1r(f z%7-9G+xL;bK?oUU){1JS#h4AP?m z%vodcJ0x5Du4DyB)|){lg+@KCX2X=R<3){PGWn|Of<`PgE9mB*s4|yeB@1F|+pRv{ zQ?JUWA{yqVRK8o{m|YaQE&61Ei^pkB3KpN-$8~`t=$aLH^VCG(37VTOFxGgGA!dK_ zn$=x&>b9PFh3clfX9_6R$W!9osJX5~cu&AqCgQ6XN+fi7ECL~PLevJ?i_Tt9M0*s^ zwYy~l;idfL+&H}ekh0mJvFH=)zxTIApn~Cg4Vc8LKxKLa_i~C&-}X4ChYgKlRH1)-Uo@FixY$Y@XVw#dIWv%yLcRccK!qV2MKrQ@ zj-)WTj)1aUKhR(AQ}AGQ-VYS2O*?>TKHQXKM)<0j4UpF0TTiOE8^tfx*%0>(N29lN z!+Sw`9Rl2;eo#HK%t!x0$Xvxj(#FLuU?Hg`17q)sdKuth!M0%_hrXL6>Lq_?dcFep zVCr1LibS$VY-&%g{%u z2Sr!B>9eTLztYzP>>d+ymf3;URX{W=^ya&$Zi%h}jj2r8n(fQg7<)9ym#3i-Ie?4< zsw*w5eDthUX`f?#85FZgH?Mz-93j!H$Pp54oybXNK&NmX-jBOO7jjoB^i7e!GP4J# zj(F*;Pv6OwP4*rjFy6Y!1_!{(9)l^knUvNMUoi>RectXF@D$K9bEY^yes zvfqjZHRnc&d{7ouOHiR8k%|4}^B^UR1T~chf^eRBJqltOdb4YLA03tLPM}j1T||}> zz19S~;LWI>_*Yq~r7>hEe~xmrZ_~h}P3E*Gtn+G`bb)D!nMDPywR9COVJ@XYY6VPV zuDCNVYr9fOqOCM_ER}y~f$a)iT)>L0=7P?z0G-(#wRSt%5jGusm(}>OQZ@?^W|?iB zeZp+aA~+WNh3V?ISylA5(>7&6N-4&@>}5m{Du+o3NY~Qr-a5s$oDAmPE zEQF0!hPBfGKNYDkk}JoVZq<}h<9pCD9QFjaL=Uo70Cs*@yzbmOCWL*V+w>S)aF9)A zpQpPbR`n9gbXgLkHkCyM-)Z$yuj_a^DXeS8H==#5ZKRB55{np}TGP%D4W%lNO~sHY z9_tsyQ8Y0^iGP1mJnPB8%~ zcVztW!A!++g(xW5z=(=iM`;}Bd=6!?aj(JB0q*_gnz~$aWK6k2M zTZZ-#zhy3#cnRUF^_bZMYA|Iype*`|T{mg?3nP$1TNZzm9oI%nC*V!xoHVpTX>-gc z@dv^`(_RcTt`=HmrP*8@*)b0_DQ%6A7TQA}6^2ewb5GOQYS3>rvQc!p!mBb#^>MPY zb2<6=BNQ0n)U3#xucsnkY6{+p1*%4l^DYqjEG>aI(amp+g%C#zme|Sdo2Dx|kFVQK zgdk+_9$|kutZ ztNRHzO-5U?HfHJ~C;v0LuMLwnbiTdUeUFr}p~OpBj6cu%G@j{ThSd@H#hLVR9{71r zJwa^dKe(`#jz@Pft#H~8@r0J8i}iXthss5aUZ;QNsP<$j@8G>W5W+Of@SsWD%)^ZM zNPya19zAY+dYmXKvGNB2olVssyr%5+(4h2in~*+1dYH^cek zF4IhvFAhFL_mG+lxuR%t!SF(VWw3Od0~|&e`o?YQdY$KT)*cynDy{^;UqjpETf@F) zH~Ia45BnO)LCLzXOy_;OX@XD(J<=|QqWoOis z6pvc3Y`QW-q{8bQx~PNs9jEGi63@p;yj^iP=Cq*V0L`~O&cy1prVqlEJ4@$oA04o} z&_AKtu(saOme^TV0$w|WgMA04oFDeRV<%FaOg*hbaM1%sTiPQAZRqU6b6ca0e20I5 ztj}Lf-2f$T_a!!q;EYww1vii2j0R^GT$iq9eBP#sQZ##BZtTo*ia2NBbg7e!G0AN6 z6JLz@$6Aoxu7!Aspu}>m%`G@@nLDjHul=mAvvLV%T8+$KEtkxS5`ogNeNP|A)5C<> z$97D4Q+As|DYN@PltTAW9`qy;xXpiEP$lA0Fmac!Qa@Ly> zpz-m!F|u4K=E%?{mqgf4Te_wdiAlTF9Fd02qon+|Z~{5dlgE_nBO< zqc$ORSjMAnPxJ-yfKy*`=tmnX*6I_2uC;LmIuJn}v(}gr-(u=u#LF=mpS9VQ*({#0 zQZi6Lbjc;vc^yyKI0El||15u~?#y4{6P^w8o4DQOqdq_IiaA2k9LKT;YUs&aX(l1D zsw?0)>>6?YrrFF`%|Z!CIzCSZtMj7#;N_2r+b(uOk`QG){!do7w{N%`6K7nQcZ zob={mE-v~XPr_RVzn?T*fBDnzz1o$lq~;C{g+__1b6rTQEgGhfrJ#l_q%Y~qu290zcgjMcg@y-QVD^F+${K2jLX}dX zAq&j~y`u^(fY9R)ty04j+Mov>SJw`Byl{o~=~rc8xTl6Mj5KB8C4VoBR=AE7g|QrW zm$EPp-Ju^Cuc@I6D}cpIQ&4Z!bvO9 z(1p{UJ~9wD#O9SNTVbzq1?My>#-Jqu!W#@GR~U8=!3l1tlaQ0( zj%0&=30~5*Er*71jHXA=pene6$L)lW=z+Jmo=~1X#q~tGipBMWOTWPNFl2NUTu-K9 zL@$IC_}e>ZnpBd|lJaSi3Wh^Kgw(=4q$4RnNJ4srp5YrprGH^{xQCLOKE*whA{j%x zLK#vX^i(JZ%^`IY&=tslECY&!`@$xK7IZggoX|?q_izubNz_m*p)K_de+ljA%CH)t zlQ_vYl6zN=l#N9+uO5_I5~f*cGqoujGKEpQnqpd`E)dMRA$8*EkzpKby3 zK+~t6;kpvzOwE#f9f=EOgQh0k=NJVEg{7atkfn5_g&e|=l3WFv=!N2>OI+g?P}=k} z^a5H-;(vpYOQ@})Chi8kO&7!6pt#f_3@LmoiHpM^r4~sfhCHrP^fSPdP+q#2A@^(5 z*`m>ONl>s^smZ^fiMzowrtjiz@Qu_r7``+*i4TI4#w1SwwUoxupmQh?yr@m@;%=4( z2Tk0~ili`>+`UQ)1G&KSlWlQ01!=8HKf~RuD}U1$a5sB~0~M5xla0{uONY6Gnz)27)KfwxC;dlrKUo&Onrkepk+x@p@IsIHoa@nME8r|{cic| z^D!>pHBCD#?@p_M{`#qE_RDYEZWFt|as&eWZ_97*@YTEJUzYz{h;P1G{$cs!^1Jb~ zcju3O`H}wr_uViY`~O@n*L}BUP1O%<+kZYTkEd0?yswV^60TyQm#5=K;O{2X|AEW> z64%3DWht2>ccm?(kweFrAmLcSB-elY=9_=Z3%5TmOU{>=8eSoVIkU5;C|ODN;w(!} zUn*8|pC9Sp7wibvOJ<-NQW|#l){YtT*1%r1;3C_r7JMSxAKGT17s%Y;_P;ED5PyZH z1}^iyYu9&i`0Mih_dhIujUR^PkB6|0-<@B+J-__;2Gz-N%M^Lni#jX6D5`GxmxUpqZUP z{i6R{{y>ot|L1UppVuqo2TUQbvEDFB^`td0)Ut4bGvv~@L+h5uK`cA-3a_#l8HBha zUIUy6=wIP|^E1}d(-Z6N*NeERhPGpEw_R4veY?baNQU%_KUI<;`6*0kn17?l7_*f_ zWNSHRPN`eDe_t-`*vk>E~MCZzwcJgsJw_gutj9Nd6+Z&93QprbVN0R4xh zsTDJPB2H5>ZQr6aFF>#2yb;hbIxSzjx2r@k0Vzll=_KMPiRs=kCDmI*%8@Xt7ofso z>i^mbx~+!YX~ovDpKg4dis>41icHG?0;Omm& zYP<>*a1Z)MRB^do_m&Wu=PmXl2?d=Ec|6 ziRQ5;MR-vQY9!UTgP5yOzdx<&Y8{5EZTjV(e!TmY-MvTh$QP^hCiC)1gama2^?vj`K(!q<=@A zLP;@~Co)>9Y+uBw0Dm5H%9{)61(hBDjc7COufEzy*k(PEqwifMPV zIJdNmSr{=QbqH|I)p|yYxxym=(&CnbFWelZIakZa!51z^wSW8{MyU)VX22DtL5yQ> zIqLdLqYizf<>Kq8ON0hW{A<)*Qtu^K%j&p!U2+`D7qCxSl)YKC<$_Uvf{}`0L|_;} zCjBYPo1-+JqO^`_#9r6R6*3Szs|0;bn|ui+<5RzgkFgp0)CN|mm%K~?<)Vvq41Meu z_f>~K)gswK^?xyL7RMHE{NE`w!|AYy&ANL&l0#qgLufXk+w?QNv2frNGi%Rih0|ir z)ZG1xb(S&%hh)q;gj?cT>$dO`*4kSoXPYkE4~zX%6^4EL)bFdsP(u>y%`Pqu^*$b! zu=SUMy@5+3?v@tkJbCN{MiSFTh7mioAFH|!34d%Be}B1y9d+@({XnZ?j4v-kg?q>T z1-H@$lSTncVnjL88egR{9wJ>YzV>=kAJ?a@8lItO?Y54qy4|KE|Eywu85YpE#W4)K z#eLf?_Rp)>EucbAam6Tio|y|rNa<~X43jt$Rw~49>Yt?(+Q1Lnm$A62&?jT@=4;)f zJcbWL(tpL5RU%CO78YWVL=jgITB!~GM%vx>|z-DU5rB?yDIjqeG2_Cb$asA z^4DF5KYshU-Nd?Tw!eKxpZ#`6AAYI;7Xc~nnIIk&lJ^o(ycQbs@z-`CFWBKs7Es{B zslg~N-yM%*W#qS4J(&S70hl;NTrq`iP_0B}g@1kQ+6Mqy^x<%rDW0f-d6Ai-3CrC;YKKsLJnh5FoTD&!#8SKf(@ruXMrQ~1 z(4XK^5M|BOOgffmlo(YaSt3Aj+~x!J>+aOxT6gV4(=b6N8a~omV&%%xP&ts;!!TKs z58Hm<@2a8dcYdO2hyV(bH4^KPn+HT@H z{J8=tIINOLv>ItTl`AAo5I*DLR%rH{I3a7OMAP%I1mXxwes*Y_I2####x``@>QvY5 z%%5G5DY8{1vm^T@ATXKCOrwfjU}@x)XM*np);z$x#+7d_l%8~T9sAJj+ufv&E`Q*4 z1Th&M)0*aE3J{3bhVaIh`Jf@=|HvmwiRP_Zu@O_icK?7kx_G< z5Q(#10f6a{j`Yr5ze2Wq;A~%$Us?!ThX;A-3-)RV}1(&R>CP?wOVN>#B8Mb=CGXSAVpN*tCN? zlQzHDh9?Td|LS6F z#BAmq(J6QjNrRai-QgiL+r_$Fg?e~VHG~_qmkfr$B*lK1IcaO2g$hcMF(zGOQ0ppo zUcatR8{+h*-Hu3Q73rU3rGLnoE0tGGj7&wN0$4`W27u%;6eZJ3)x6jA68?)4;Jv?{Y@o+jh}~Q}dY|=qxtC zVzk{czu3B`I81XhL5$0isIHng6lv$7p>;AuNf~h+S}5Bh9IL8p=YNhjt%TDS+>((Y zNXb0U={s6n=@^Et?dN82!AA98DjjAAheV~?z`J#O$ZtN!kN6Ci7~e8Kz9H)KfNL)#r@c?_|WX^$MS>*(wYVt*$)p>s}Khr>e~o0)GL zk;tzXPk3ZjzQ^I#GM8klq` z5)0nAjAiFtXn*?S?l^O7qtF!mFHNJ_h4ypkJ^;vUA{`}0t0i=FS9Xbg7rMIb-_><& zHgQIQM24Em3_|*}NT-aX(s;&Vcz5c1@1|P=BqJafU_`d3z%4tlJ~W3=E&lY=T-PLL zbhsCl0yULtlwn?G^lYmx4%L3{*DkoU@yHEieq6MO7Ju$5Obe&iPED4y{Y21#XvkmE z0eH;FjLCc$LLa+0r5X5?t4KN%giciA=e=i%OP_K1V9ojJ_O>}rv zc354t-C=HOH#038N0MewYi}@;{o`h}Xx8hQifQ5kr^CtsjFz2|jH-+t<6U*Hhh5ms z0<{qtRezjI+Mtme*|4wr&`*~2Mprf>Q`)5-RiX7E6(|36^-IWdj%(*Oett~bcfJY?c!L6 zNo+f21tU0$*R;L?xJ`Wgj87xcQLzK|N}fb2l7D2z@m#m{^KhEwp0p#5_VLkVKrAyl zUPkAvC4`}Wh{Gf{qjL%9NKBV@XcIM03p#z0&S&#ktEKS?ej|4CQtl`;MJu#)&Sqw* z{jqJD=ezZ;sfJH%kTJTmP~lXN;D3_%dJ%Nj&$ zIe!T#VZGmmA@)wqN^2uHiLf>urI{O?zzn)wiEcBegI=I1qZysZoE_Rw9Zp^QaetcZ zcd>99WUCi!hE5^8#hC6erjM~3+BwHv$TLLRNKGdIBWEso#@sj@k5xV4VO>>?asxUY z7j7+`eylTW`JI~R>9N{}&<#}+o4K}~(SIpqES8R!%#Cin3sdqMmAD0+hW&U_(X z@(HZhywEqu0ev^rq5nhLsyM63jf_D$%8t&%&dwQpf}Y-ou8UKK0b(bu$`>x^$j!^m z1;u27N#!9vhA$IA;TeUx0THz74^gxAc{-pyJF&4_P5C0DYrGOcxn;(h{IKX0s*pAS&b4i%T+)_jI*dO*fi@gs{}8$j z9QT(Ap&p)*PF>86?ogh(<})h}BY}{1XwcdA*$IT3e!Y7N-A6Cx`gW#W(i)eg-MhJI zm*1rg#qW;CyU&oPM!}^bKhfiI3xDp{YNfhrk~m(8dS|g|5*M)ubBk?N4NdI(C-~kk z5ksjIOv{$p8IGH9sA994)HY|-P@+vCFwG9_;Sj6gi&VXl8ftwa>t#pR_c7Lo&@^*; z(ghk#rSxEg?9fhq|Ik)5viq5)M-gdah-PN#g=W*i-9Aq0CzjEZC~nRP4Sz#@`cMte zU!sFj?5=J=2R#t~jS|M0LmNe=ORApSKxBW4RsD0=Y~ozWM$V`y(iD1DkKrmM27gqXBZ`?3wEt4)EaZF)O_3%yE&V8WLGN6k@F+#SD~3uc;PF^i|ND}m+1r)dfXG8f`4pfnbV!^#dA2! z&z%_MMPV5|B`UkXcA?)@^TSO>ZlHJRXvOT*z{hGmwB3ipoW3hdCh756lHymQ^C~8D zt~ej6^)A$1*o5`Rxih;`D&cmOyaA=MdyHM|cXLI%Ak(SDaRajF&tcz$yWjtL#&7eS zr3b6_`;PX}iiVutV%m!}io{Cu^spV-uFqlNHkzm_+2I9l0haaS>MVhgcuxC+dup zO2kJhJ>xhtd6A5u?c#P@eG;yXoVPPN^s$r2lmGe$L$PzHS$*dOIs_TwxhZ=t^bBwLQ@hx~D^2Y-S2};RVt@W|8(ZW#$DA z?diVSFGAIY<})5`H8EA0)Wc7J-P+I@JQ?2)IFW|g@@GjMl;%ly#dhq!)d zC+Tr|7#B-=w7sQG-G$HybT4P9+7#dZKlkB*os)6#69O?XmmwGfC4VzDHZ?vz3UhRF zWnpa!c-pO8%Z}@~5#8r2`~zlKd=qGR5g;=_c9Yy)kcGM}XOme>Hu?P&-$h!IeW}KU zuiUo8B8&An^`I|*T;Rg-A6%@sSmT-Vm#^RPgJ1FW@2Bfueq8?ii@pG7o_o0bcwDZa zndJ5Yf`Jj2ANPNLaDTZhHwAco7%o?J)8Q@Lfa7&_@gou5KUBEob`?^DZ^F&~=JOZp zS9%-n|H9XL1N9M~HR0nWfBaP*4+BAY*5ga#dy$7#Hx=iQAG%kXYj`I=((UoF&-B_J3K4%*~wBH}D^oYjviu ztoZs$*H4Jg{`JT1K9%bq7bd;am;cp$vW(;3zh9IwOgowX{?Fwfm*1X8VWz(R{%iN= zf5X_ov{rQRE1&>rNro?<3)qpXeI*i6$u1s;oPTd_zY0`A>3=yXM)E`UBSfx_DO4e z>ugUM9`%8r*$CjM;?_=Y1aQYdt6?Lg$lSM)3n=YjoqyckR9buHKiLDaP4$68_JgrZ zNq0yXUl7TuV{*Gh1d5qQ1K1InSm$g5CE=HV;bJ`VO~eU(1K z7Twk_(SDn>BR?ztBG@=kgZSe>q96Ee;@ealil@}yBI;6k#=W2302$_BN1FqXRw;Rr zToJZqO@C$paP3_6R>}V~ucbzccHlzdY2d9R?~7o6cC*?YSwS%Oa+|+bB@A;W8f%cY zEI2JEkr7p&vPU~qS;@FT{#nDoccW#&(Ah3N0$Z~kU9zww+ZgR-yg$nPJ}so-o$6>2 zu{p3~baKU9z`bxc8tns}$SO()2~&@j-RA)wd4Ic1H1b(nxhxxY^UW1ZE2S4qsk#hD z6!9_m9@&H@-t%~&klsY)=_nM=qL>vv#>s}2}SOj1&78ipUS0*P@oK4ml)tSgC!_|vR zo{iw=XR|F*ClzziR*`&y`W)yIfLMpa;o2X1njMDKN{mL9#g)uRV)Jp255p0suu;sO+177E0 zy5Y|zVrE&}pi|FUpY0q`?=_gi7|n|3g}01fjsaVOq?ji-VW@k7F2P+%N`D3cmjnvP zgJ4=%405FU9?7mSX_oyBCUxwmmi0a+Rtp+`O1!>CPeEL)6=jprxC!b>pHn_1gHiU^ z&*LYd0^@O;#B=w<$_0KO^S&z?4DQU zo&gK-O{vBafL63LLUagkN1ZjgU$eu49gvfCuGfZ=S$e8uED83-_eE+9&DhO>7l*`+ zn+Go<#0WS*-dIT!*4YW>gb2wp+JfodNO4LZ89ERm>OhF4fPj!G_kZk;?trO~0qI6R z4KOB|S^-AC*5(Ccii3K?_gEOCRrAb4*^OCY#n+ob1qUXD{~q2o1To3GiXaBwrM0D8 zT#=EDAa20dQ{~HMTdZeFSen3cJ49mc4wj=)onkuR?{3u7NMVxA&1&^*E;X|Vfo=)* z5;5(7S&AEPo+37NE`Lz$Ii7$v@vJQ~51;(V)L`UfVTaXM#W85KZYbVV!^TN8>`ADq zs*#=oED|4aLXwP6p;jquQ`@tq8ekZ;0u{%M8Z!a*Cj1AfhE}3!cbhKhQnZq#2-PyS zy2O9aNPQZ@42*d-&uk0SQKBeR)Ao6zwSLNybhV~xLaW<5wtp8mCc=Lt$T`!d;2@Hg5*`eBDUPfa(a@T6Pv(sy|-@3fB$Ysf~p<{wU|k`ENr^T5S(MX^~**9+-> zX{nypD$?!jfv|*mIvA*z-HgptW=J^MT!I`@JHBgL&;(Gb(orH`utEurU|Ebj7J6vT zS*sZ)1%LXjdZcBVkHeky=COZR!@M_FAehxa6Ic|>E)DqJYTrj~B78H?A%mp$gepAf zh&AL!Xzb@W1Pkpn-N0x4^ejKC_7D6d$-tueeFi6Gc?1S>{dF=@-!z zf_N(i(Y~y%1CMr2Zw9|L^;4g)T`mC@QEPR%$A9Xrz{5)n{=@tQI#!_N47ou|9XCZt zDVPJ_k9OA6&u&fi^n-lKEr>I;r`2t;IpuoqBc=B6J4{xgWhL~14hnrwmGmNbUwFtG2D!(ja`RvDA`Aj~M(^wy469fg|fPqO!fk zcyBH{X2dhAvQHDZhhq1+}SxloLD4;ljX`BsBBY*Gqw2lqr-;m5}Cw{nOjzeE~R$GPV*rifi zK)Yh}QIS%iH6F;E#Xz(CZx*!YzsTZF%Q4j_-MeaO7bvXr2DE2;&Nujt-twN-Zk5S| z^!Rr$xni_gCO3@MGZ`nQ@6Y9QPwSL@7Y}F}@te1>Jl7~9PsFQ-B~f5IoEE=7Kz~_= zg>Im3#Iq=CmbndOb+cI#daRXmxR*?2souZFELte$rEA-j@QE4&g8aE7CuJ~xjYnHi zzXDyH4$W6}hco8wlmZ667MjG<^!&!`5s0y*$QJ8jS@3^pI^OK5`Bp6pLUBp0m7iNnwu!><5i$@xHAx;VRiJq08tXIX(nKg*hC;D5u3Z2siv zI4L;vN2bq13+rOtk({`YHG$4Gv68JqTeWe00X1-Jg&gXMoQ4{c+fbp#&Nh(qmi54f ze?F_%r-$i@ZuK7Ku*^jT>P1#l(@ZCD05v=l#tb8!#u}5{tyrU9myE}C3Ks?B6(**Y zhU=yE$-UPprMOScHUkr(#(%8`O!4RhDCb80s{EJvA0hZ8cRt zfws_(ar3d1gogUS%n-W^|8wK-9}U(hFvFl>NmpU48IIILI~^MOm6O-@!*3XgocTP8tej)c>z#$qA`hd30G&8+Z14#Xn)ES_Ked5-OfqF#-Bz~d zmZyRplu{<0>Pyl7<9{g|zCmxtMWN}l!?>q^Wo44l6+HEfE^1rLmiN6{&Ge6zOisAM zjDEtx#jMcwuQ}Av?9`8YOis9Z?t#OSKvLiRu23z&bfI*L;!Y#eW-dChZV0*k&PO@| zR~xeqYPKOlg#(Fx`}e^@HARFfn#FB)s$|cWbV8XJu>GH`x))l(86s`^vr^@wogc0m zuD|{1|J$12ij#5i69X|gGMAC|1}1+oH$FZJb98cLVQmU{+O1s4j^wxzz56Tj2a0BJ zCs4?P0eb-7Z1>IZA+u8Q#d8>6{QC~>L8heAP>qIKRk;L%!B}1_s@rcjxN-akH!E(| zc;@`=>sNf?7rg%ccK_3l+aLd;Z@`)79&SI@+XrYSxxIm4V8rdm>z|)oJ|2H}1$bW# zmy5dV@FU!T<9%`QB@upJRrtvLLr4+c2_N=%pWj%%(vRWuUwAEdP@nO;CcON}FMpM< z2SQN3>+#a~v&dxCT}2-9mtJ+vCHy2m)5qi2p6P3=3}3^$j=V=!ME=!u>q^RU+T)t; zt4RA?9{KJ&9{%;?uQw%8d{%#=aI@s}9sFmNTICcT3tnI8{)G75KmXW0r*i-8#-w-p z_P=^gmT~<3*PAkiX(#jV|GE9+_P2K`%+%}ezjVL;H_!&AwW7p702N3}LcYAxFR-sh zAJQ@FRgwk=;9N+&6kaymqhPssmOEZNi->a_H6Xtt!}n#BCYMR!IG}$L#ZQ!MYT=ZZQbVaDV&InsMAvVh|Y#^uOm3*Iv_I;E`sYB5wmvn~NL4kaoW|tZULB z!vNo-8{vG(w7)V>E0NRTHbDXN!Vl*lT%`q%HCzW2EHGuEr%;&P{DzPyTF}FqbPrNz z83y^m{lf%-fzE<|#4~@8JROC|Vwb^y(#{X|D}zYwsCQv8;q#fjGC`j1Q4UMhIeS-} zO8WO}mejbk)q`fiSK_~L5wr{5*4ZZL9rH+NQ(c17VBSFYe>Cp##c1Lm0+>Jt@!^Af z(927v@I7hKub>xLZtFR-wy335JD+!9(iWptN{Ci-LOUIELiK;dgdPduU8diox%qro zMU4*4%)6f1NwERPa2V8TPHey(13m1Nr=6;-6;UIyP6}J~(G$xL#^HarJ_33=rv>sZ zm{Pv!V{)ZHWILEfR7{&=)sc%p#Z)k?FezyvG&9o8O1kJ~jW1muxD`NV$)r1Fe=Kf8hIz`6~{d?1g^aoLD3dIIil(%8CU^`tl}QI;h4 zq`|usRj?Yfs}=|D1wbO)&?H>NHH&^eqE03rjx@iRT~99fD@|Q;0~}d+OJ2uB-*YC+ z8a(CTRtLs=6OXcdP>2xe?*~$D*(i*2k+)|fJ7izbOF4hOCHs|jtblJvMDXM%V(hTl zXR)w5=nRNVANj=61#`)>40wSg>65R_gT_lEek?;!(4eOaWBHMHt4QNO?J23_g!d61T&x8;D*FinCH~_Ss8Wl2A`9$c;{~ z1V_yAq5yy3MdB8(pPmkwz2v`TD>5W1dgMo#+A;0b&pCz~F=vmVd5!KEWZA39cl2B` z0ci}8`TeCL2jNrbOeX-Hw+>o*C6vzYta++l!9-2%iV4f^JWGz!BE*IcVZxGPZXowe z<&coG%6LZs@mEsM`15)uj3_`h)tk-NBtfMFD5ZZaIiA?c-!@5Ym~nfm_JNrl^Z3c& zF+tjzr#Dd8{#srmG&$K);`c5 z@REN{rvOo^Cm1S%ky@Lo7T`W>DZy8_d1kZ1qhSWX-)|OjsU#|V*450yen3LY)B$zA zZv;a_GOxS#BpVE6q3>CgPGL?0Z!FfdClO1KEU`US9Ev(0Sr>XDx54`r%z}GEVsaj{ z2=18%IUGvTxO_k)PLX<5`rMM=gMunrSqy&@rq3GLrffO{D{DmsGp*dl8=E_9b!9lh z8ab_lT7X8O>Vbi)z-RWTD)8x#N! z3x3wUDXwhAU&=6)91D(I6N(f+@pE*sVx-vvs~BlGutzWKRClX~wPg3X5a(j25qB*; z3{qBGJmh**xLy(SAJiWV^TO>2`a=o9gwzA}3DtoLTYag#RiOB|TStH{U(Vq=CPJZ8 zC=*_5_%YFNDHaE!3J9=F#zIt99s7Sc&zUg8Dk+j8>PXu%J1G2oPXw31XCUw2Q6 zO4-l=V_r;Nes@A8jAURODa#$Nv{P*i4GA?+tEi4MP_TpQN{oS~$IUH8k>~~u#B$C- zAdHMU)}5`;4OT%;61UelKt_h~&GY=eGSf2?Y&q7-vl}dRuIxOcy7LTzVt#+|%I~eT zm@oxqWH3RlFMt`uaguA2xka_9uD?`7QleJ;e5=jm9%6)~OTI)r7m)KX1~ryxqnaTL zUrGVP1qb!LkdY0vt|F3Ic{fDT$-CtDHDnhv%^*y5&4Vj=W0vuTH#){cO)fVQiSsUn zy7m3dZ;V_sE&Zl+9?hpN9r=HfJRaZx$Gjb>Uc~{kf^5E{-y@B`f>d-`v9UH!Os!S4 z)~eJe%KZ}Eh3#wR#hkO1r=)qkV6i9%ul+`0epsaTR@M&Yr46m4u5Tn72IGMk7Oc&E z)Mx*(ww&6oJ?eNTXB{&bE_;HP z=-Mmyph9VR~s0! zhtT{$cL@Behy4|Fw+2%25qwJIA`JV18b!{(3Mv}c-CS`Oakv=He}aG;HkcG}^KiWp zKXZ&vHL98vOF@g+#hFYn0I ztXeV6)qq>vJ8toLNUtL9Qng7bS112d>9s@$Z9=VVIMiWMsf!&)39`gk6iPlFxl|)@ zJ|36K(}x}Og(rW+5vVg9`_KsTZ#uJ7qQ0lOA2%^S2tU3vdj&CshM;n89x*5>nRE87 zml}00&gJkno>ay>=Bm*(JkK&+4R~Za*UZ;$_EVGokRYJ;aTe)-l?eXfZ8_IZ`ibiI zJ`4)g*s*f$sGgKqVfauQY`w$QF2MH{5a5HyL|;Svtmtcq??o>J=@h=s z_J>3BH4Of}(JGB9Ivawfc2GD+0(w-4b2Eftv_UvIj=bm5fr=>5skc7(NjNZ&wk>2R zT9YhO$|rv^*q$P61|bS6>M%WxyLF!KaxtK(zOzg#K?VuKFm{@frRBi`Qo+S(JCLft z!ZSP6LjZCtCndbK>lC``0>ImDdfF5886&Qq??v@nk4~0O29){pVRUFUR zmf7I0QJ=(>xqgi*ZY=3g)o4=ia~b=Rn#>*>|G9tFVU5P^Y4_etVchnxj!?|YI$X2v zv6ce3-e;|ORADr=2L7cs_{tIGiBb3}J@xMM>(o$3 z%{=;383&&EIX@BFdQys?Bjt)jW~E#mb1&sO@3?lgDn)Z2at3^iFPB35>|SbUA2jCm zR{Vb?SeQI_Qb$nK>53mX%ooMZimG2x-eB-Xn4Ve~!>-eqz0vzdawj}WBs z8aj6pN^{T!S^3Ql!$4{nzthT~Y&EGhRGs%}qX$q0QIZX#nH`ZsaMO&xTequuFa1n% zy(a4^#eIYW97@LJEvOIXRIGo!rxNI7Lj5BO#Zk^6T( zuT~!>W!4Z%w=+7Q_8?=w`Kk4%pzVLt16N}NXU-TBy~+dVxr|nh;?a_MMH-;XygxB0 z0uZ$sr`xczFRTQQ@jNjoA07hN1I2P)#xp?q_faaIV}L zCPrZt@c8&PMH@$Hmf$))uicSL&opq@d8Pr%e8gcnC)jit();~Tqd!3ML_>coz3wiJ z=c?!r4f?I^ zps_MM^Ztk?Y2ebo^fFy?FjjxXPRmJl+9NLqjO_Y29<`RPRDA<*V8POEY-eL`YwI)no><4$15T529&eSX+}{Ptny4sRc@&@K0VxK$#wJlN z^GNA4)$b2f3QrU9`)@=ouXSM%OsDe#f@=C}FX$Qr?+(DTKU|0sfz z16&-;{|hTmd+LkA7oqzZ@347ZT$XVaPWj zsCxJAzew!FD(*a&1pflo#oG6_d-RjUR=PeJ{T@B1&*MJA!8cMq+>-%Bbg4dg+dZ>Q zlX(Vn+IXciyuQ>Eq~ED*!1Y2daq~{A;%< zW%0`mg4>e)RR6*K{p6`dN{2Q|xInIU9Kcv5OX`ZAD9zyA?~eN ziACL&IORbwJdcgYcni+h8XAN0p73&dO)pJ+99u3Wvz0DMb)QX+enJ9Sd^4EbD4CI7 z#HBqfX#Y4fNQIQ` z&rvm`n+CPWZ6aM-q{h!AZ#;;-%3_>Ggk@pAEsKNln0x*{lpxnx^e8;;{F?xJ%Y>{y zx#V8vO+{gGAfAJ)>sQr87$?fV`2$!$1}!+o3I!pm1&s87sC=l`5?6`c-zYV3phvW! zJ6@pyPh<)0c4`sOitU`V&s8V;%r>SuI0-)++!!uutUkt_mqjkC5pc%Rg+Sp}AvhtZ z?PuYX8d+eR5(~xmsBW6YjbG9FgujseS^t_!b5KGABvr_NZ^zw@M$5>dmcWU*{liin zOO7oOQuZ?#INxI)R2`$8qfCW42bk%Uc@2nQnMGQL?`^Hg%s4u12wAhG$5BQA1$$n3?J70tS+1D`pTYzi3sbP^Csf6u%!DtbMJbW-QdwpVe9BvYEz zw9tjwL7sFyhG4h6c%m>+M8#|~M-t;2B@0-i7TH<=Mvj$f?M%N!AiFT32T+BQk%U7W zRTVKvH=~UX6aA@!$-o_(Q=`DxH(T$|k@!@&{lpL z(!cg)^|)sKy3~N0hP81tS%HF8qgLJD8GpLQY=k*>Sm9LrPzE8#(8_9670qf`iT#d| zy?D!G@^k16#h^r%2+Ps>l6H51UD&}*{Y3ru7q@q56>X;qsw8dJ8tcuU1Q1afg;DGU{yr@~jDGOz%j`_;YvT&j|osRVwD2Hr0l!_hS-{*AQH#4pxZCA35m zmG03SkT4~2vN)$nkG}itK9`3mhN@`VP6R_;yGP2Gxgxh(y6?~COX8PRhh-TgK-Njh z;N9YA>!kHdcyW49!`?c38k1J<7yNw=q@S7vmhBz~3M%I$f{p(X<3ppmaEri#N?!Xb z5V)>dsNKYTmLa$Dhw<9(imRo7UJ4k<+0PokVV0$)lSXvhY~|B^+-bKdR+|sn2N9A| zB8c&Kb=cWReyZ|Xa+gey_LarpMD+QVD@70(k(beGNtpBo!9S99fuDj{(L50k1jYZ2 zH#~`0daAhpdz<64Zu5ghW^<^?sMU0UCGSG{PKfG?HiH-bV6~^L&iULcK&G+>;!Gi0ac~L6W+14(xbYU7@#R6GgnmSMeG;6IpsGg6T2tp zJ7$KBNF}8wYs60JDqgPq#DOJ0%|v-WHbJV<41MG4d|<&dXeAN%4Mc4(-NKG$f68tTrjDGkX-O2NljIpyJiDyW+h;rqOHpk!0af+1@t93MWL`&Z%+T^Yp5=Xbd6H!Z+@ic58>Q$N07 zV(k0AD}aLGdiUSemWi9|KUZ%_QwzADi2yDp&i{YOozk;&_$!|9;nx#L)Bv4k-s4V$ z2}&_$&XRh*Wo&Mb+)7MjncmEmA{mfyUJtx4s+dmDD=SlQ`6oiM*f(h}sws52s5KN} zh&gJ-hm!=!VrRoDeM?7!gd&+&Hza1IeWp+5K4Y5Iit8MnlgJ(%1?B}Zw#lU79AM)9 zKsg5P93N!sU5roQOwSV;d(V`$29z#D5@5(xEo&I~tUe$+yn1%<^_`Xo)ls`Za&O}+c>B>K$?q#ED6DE3U*fo50>sp zp;Ud(OR~c*Q=?{X*LUV(PEaY9ISG}L#o-hjEJ_wd3gWHCHKcqR$35_dW(dK@#ZKb9 zwWCMMYEX9@HQvd@%aX1^#|^sM^w*W+PW>0Sa@kW92K{3|6ChXwHu-BoJImSdH(48?vr%N7;f5WJCm|6QEqw+IaL6W4t3nYpumTw4e{8s2$#FsMnq zI(oQfwo=V{!x<}a^v`yE2>ssAuk>B)M_Z~G{fQicI!ef2$Kg?`bOH!!r@al0!HrRc zr7cA!$9#X1a{%^Z0v{o*5_yrnCHM$w94geM0)#?X6OAG>1gqrRssO>yG7v*i;zt)o zoxIIPQ&{k>CDY&7Jdd1p;Ekioo|2!IvC(9Y%#i6Qh*q2fxpDj3MLq-YVI=9aWMo8? z#o*Sk1FYRUv489-us_m%DZu9xZ&o!%;a`|HK|r?lumgt5zdwKM5F6Dmd55HIIY9=7 zkd08X2iiz=%V~el{O(S?C*S8rzOdgoWDiHgI$S4iY3WJNc8LFxj0?}pPq(`nQy3LQ z)omECvz;R++rMK){oJIPw=;(3;5il7ThJN6$hwuoPG-c^jRg}?BI&PHwhldvMS}oY zCR4^#7Y|66F-fLi|AvC3z)(cS1yuuGFeFX^Q|y!0LfsC403ZcHYzrLv-47zgm zYdG#p*v-M;u(SeI!(P~mVyTg6aRsT1>zVyYOn3c3q;XdAO5(`WdV;|rM+W`V;b!Yg zECDhp!E^D-Q3Ox;*j2wsf327TTtO@FzjL7QD{Lq{qd9eW+#HD9CAeVV-{JgZN=Oiq z7;xvnNO$X@pv#n)v@HYh!FV{(8k%FFpVLJCv4cd=f$Q|P%KB&H{Px8qsn~T)!IbJV z`1E?e@l?_4vC43Be>Vae1}Y6s4|iWXnt_h$b^~~6j)?7=o;N`m0o~81hfmYJb%$D@ z-Ov5q*XK&^bLq|f`6~0kzGd}er{m1@Q3p zzOy|Kpmhq`*rmg7oogQDJ2$g$w(qzwZZqh@=OPt*Dlf7rfa zyNp!^udsokh^R{@QJS zdZ@x(-wcCi=FELi-%!|G19Yf!)LvTI+LyD{g(T35nEgOXoYa;m&B>mJ%vg83xqe}< zpiU$eA$(3?*f$8M9`RD)Tu)FfPtMWSn!zjn;I7D9ZCiJFa9*`deG7eWKUa0E9Tw-; zQk3IxlpGUS&B@IjuzOJ?jmII%57M7L@H7fnFpkRlRWbg8{Z>P=4d^aUDVVV%+JZYL zB$$h+9iLBLWQLabTGu?TS9G+WtvxKZV0MF*M-TaK%w+ZEW8@%Fcj`anQbBJ3MPeVJ=I3g{jtJP`y?;bY~2x z069r5A%=qlS!@9_S|T(p_QNhdQca6TatZA?E8PNurC`b&0JDILt3-Kg(w=!jyVz3W z9looD#l_$C%GgC?ElLYa44_qjlVl(6X8ZWmVlLrX5ivO>yW+NgIz#Wg2FS(cMEk$|>gFpq&c&K6GKY8p!{b+p z=)2pepV6OP01-5&9bzz?pJQUEtcqa0({OJ+xqAC!+bIRJocDOhbN9BRaLuo&u3TpN zwdM)CHk(u_Mdvo9-QIMD2;NpE0Si6XZMOrHHW~v8H#fuS0gWCo+oW)f^-8>qGC^l! zha_p~k(tC%hj0NoW`!wF=(*%Gv$xi2j+rkEAK$P@;9QEfH6=Z}>yz%x^`Ti$gVABa zUMZCbjl!fauZcpWs7E;Q${e@UFO8Y@Q=_fDdV8ruSayo>_n|Fe;}@H;SBGtG!gFM% zt#PE2b06|BRks!#!?%kFCXa4@&-eowu>5E8`D||P$6~jtMMLe@-!nWRSo9XpS9vncPtrtd^@R}W>C zp3h%$lo#9_E8_Rg1@H6Po7Z8!)v(kqKdtRe1K;smS&I5e!rI!r8Y;GBNZLPn>*>jz zhc3KGC`Va}sq4P6rXV;>9Ddkos7;Mnca^ut9@zKf>}N=?bY6c?RD~~amZs);Z+b~| zq;ASrmBOz}@>ubY8Evco7bCp!cG`APax@5%$71+r8hPivz$Q1QCOL=?MBIo>0&C&i zAE=(VDA>HHkQz-EIs)xdcTuJ0F*uQg8H#d8uJrBNOnI0XL?p)a!<&O*&#ysX%73d^LSNxnS>dI z;cteFwGa-pdybNEkm&rLHn3FspjNTy0SrqFJLV6{#W}M!SG#rmUQK@1kvpX$+duAC zPwD)|XDz=cH05*tuI#p+t3MSzr>imwt|Oi>Gyc+6VP9$fR3U@&%p3~AY3Veg*SLIK zTGTl;rN!;A?5g5ROsSa-V+-!>frQ3>D_|NI!2=@vAQJeRU+OME;Y^A+yeQ5yI&nCu5R` zw}qUPhZt`?^@FKL+dDR(29*G^V0D#NLv3yoER>`6y+`ZRLCZtdRMZ)Z!n`{~JgQT~S(^zr+2DEa?BT6!}RlOwQq)(o=TZlR||pPw!Awg%fhSS)N6W=+uBOp z;?3R)?Y1;V?qOu|hQ0{=7q7f3*R>|EQviKPMgabt9li>ruk+Pb$TK9gtDS6M)kcrN zJv|;nr)M^hW4OK9%@srt(qpTihn1lBp4Eb^hPvsoyK=w8*q{Hvgk(8;S&yN<6hNtd zogZ*?%DIXv(FW-WWBC!8>GfxhOKQf^$N|}IWL!pfV`kfJ19*FNYq`p}KaPsG>y`Uk z8DRj*!Da{0#}Jx9-fJN7H3rh~Tv7|1=D&aHZ~ps2BiwvkcJQ;r(jampCx6@STvt2O z{RX^Tyb`tkklaRB);wpa>a$7hWMJB5W-i$3p(n9>m;TW$V)O-hDn@2Jl3N;liY&&V#6vJA!B==Yh5^Xfd4&vPYGHsU#DFO1gqU z#LdB?fJo=|@78p0yQ_6maek3u9y@Q_j(UwPpj}higkh4hRt?!Cc0wJmm7w!FOONjQ z{#*e#m^TN!pP6fua2stST%d^Y;-^8(Ng1hVR~-~PBBYmSkoKaKjyyS`we9j;r8}cRcu2gKv8h2+*NRij#(Cs8G2P(hXzpH{u z-nbhp8pQDr5(gQkB3wvD@Ho~KB8Wd36)ad)6w)y887#S+Y_y}ymhms~bkH_86Hqd! z%1b4S-)gD4>vOCKt)PN#M|;ds)JpRu@SMXITnDzea5^Dpy88w^!6l6Ui*8~{=`J~%;O!_W;uaCh5#i;$3>jy}F=ou!k?K%{DU|!Jl4XkmXQ+}T zAybv4|K(VFlrlaUaaT2=2eH(RV{}=e9l&e#XWaB<;6t>JlVx_x>Sli zKs=N8K=)lEpyQS;Zo+njW92Y-&qPOXM@y;mpl*GUJQ5s5wPSDo%qr&MAfbcEQYu?* z@y1Jo*YUr1l)-P=%vMD3EGSj_`mKFd9dg%@-mk^BLETe8Ld<4#orIjKEgbMd`jwE;Igk-s*JdsH`R??1Gae z#-R0V^Q?k&a`y;vjzd@0Bc0-wW(DeRQ7xb33w}G@#4DvmqERsV=;?x zH}ea#!jV?ymia?>>G{#xjVAQkmdtYS^o?oe!I;{ziNf&oIWu42VL}o0n>u0fU*KZe zvUfu8^sfz2#)X?5u!6JA3J5{el*Zh|DHMT7VZnP(s(n8Yd7`;j0uUse=C|N1h0l9DH>^#gSWWo;hLf%mP-F>+ zoTu>+pU)?`VAdgWZ=vdCAYyT&Qj=P-r!b&;wUWwGc)CSFN7z@7gyk8|zp{|1Mv&Le zksMnh{=orA1JUHpm`TbK8VN~B($B8VIEW1tAgT*MAFP}{Gxy$mb$PVql~sg>snDTm zv`@#_So57sxlYt3|KJv|s)NyR@)hMse6w8A-MWKGzK7ehMEoQQ!dI~nALbE!C=MOG z538D`Y?wEV<~H6hx~58OBv>c6Cbk=i%R`xa{H+I6knTQ6K?}7NU92!Domu_}5pBpa zk!5ox`0zhXtPmTqRsSmMmRXl91+SxL@^GOEVjawRR0557;BeF%X1wKeQU=)@XvL9k zCcH{LmYl=rO<`Y;h|W$p3eIF5d{#?k{Eb8-{HpkCvEPNvYu>TZOjp+oh6f2(AEX+@ zfiJiiY_y5<=9L#{LMr(?lwbM zZ|hF-G0_te&5U)Ul%fHt;Y;n70T@TYD7*^fJuN$Fh4wkhDh&q2{F-nKA>|qv8x1I0 z4*PO%82#nhbRq0Zy+FD@Mi7vRT^L@q7{;72`aK#upPJbnRaUDgVPa3!zZcgiBy-Ia zGeL$qCwN~u#^QUpYAUysf(Z43lss`U{&$jez8^XJtIWiK>5m5X2z*wgT>&_#Q`G#~ zoHr+(@xYG1oRu}!%px(#jb#@le8fJ^tW+S&v4>cZ@fIa%UnFeax5KbQYUB~zg2LfC z;U4K&i+p-lX3!)SS959wPr@aX?0Ooli@)unBtq;oQ5Jno{Jk&0W(&#Ie`DY5Y#jfM zegEf5?XDFxKETPu{J-eg4)msC$l88(zfqr3;gqS}a!Lx$!mnKSX$Xa0=2%-9PF2;j z(vCS?J(DD+ld-0$Evj_QT@se`Ql$5VF$Ug z1&s3lD2oT_2Ygqx8z;x)QB@FF%{wJ%bE=xsEIb!HCmVK6efxPi>p{2+h6?wuAs9^) z`_OYF8k{YI6Ek7XLQeM2lPoy0?mRfI%iQxuB0GqE|K#e*=3(89ksEzg0A2z}e(Y1y z`o8Q(-`|)zz$%bk-l5R4;PQK1_gg+6_wp6)h7Yj}iuwlHvfVUrOB?V9!}g+~!z`IL z{-bUk%O5J#f2Dg8vfJ3}PV>|=MiuVI1qr+vDVr$e65_bM9JDk}!ihk@)aE@6cG^+O zy%yd11EQzA&mVV$`9yA+fgKH`v6eC6vI*($AsaUc(hg`6D>+f#4o^y#?DT>D?VmA; zo-9lfB)_u^=^`^HmGj_`J4vF0AFcM0j+q@%Nr(-?j17t6pYWB%rN5jIH zRG|iCw*n}Pge8gLbW0@X1|ddG(ax>LJ-C=Lhq2QX`%{=x>L3n#A@y@Qfy?^3z=wz zUFRGK%MK}-}1bubsH-J*~>$eEG@FYdg({%t9f)cw5 z0H8wn1vhc{1E1hCn0{2QjE-&`l(vT+Ru^QeqKU$3WHb*!k!VXG%;+yI z9)yM7VvC$&hvf}wjBA+2E5%3w5oT4VhkoVD#vDM5qJuukUVwF~FpJJ9B^#H{R`)(h zl21K6ENyXxn9Ku&S#@HgI6%>MP?EA~qBDI5L;EF{0*jkL&nYB(Jrfa`0o`Qma z=wehiZJIBqliw(&vyxG2vQlex-^6zU%Y{zG3psWm^yPE^Up-eI%7{GS|vE# zU5fss;0G9^W7TnXY5BfJi`B-)%Mi;;l&=n+uRy=<4D|unVI(A71Ho0b>5r)AECHc5iIuE7 zzCeYIBO@e5!xb+W4`rGIM&6Fr@Y9M)Xj*wF87#m@2HP(6f;0tB8Og3xpRHO&jp3dgiz*j=CRt&P zUN^y40K0NP_y>aQmbrj>*~WY^@W0BrRqzZ@%S+Iy{(I)UHV&I)#GJmis1qx6FKSZRY7=OY`>=bQ@M3BcC9TQbSO6uZehiy4+78qnPlnBVlW61l*fhJD!f0^G*oyddOvIi9etg*!_9vjhtB@2o=dX zbO#>0Ko%bSd5m7M6$KWvJQnLbW5T=YOM2iaZ; z(aB2c88IQsy469nE~ngqm0wK1SJG%P4mN0i%U_YFTVhKEcGa~PrjoLT%JKPrrke)9q-i~ApN@5$(AZfOVaWoUY&E+wR@%@Uknxzm#%?c z0B`TsMFFTcm~$QiPrv@X^pPo0E@dE#+7~q7Mw!P5NLKN)p{DGJU&yx8Fns|0JJFijBEb5u+D(bA|QOZq^)XYQ@mH?L{0+CQtdi_>rl~#j{BS z45kQ&e!ta*BM6b?qsBLuY!XnM7c#9_*rq2ID*|ToCHpl)NnlMvsY=@8WHU%SL-Ie= zL8(cHkf8TN7M8(APpAm@;;dI1pnfO|o;rMs164MFku-o7!8AWHpE{~`D^jGhsL4Bg zVo4b$*lnP&lAd)b-i^#A#6nqJ`o^wzgCOGj;NO`1x(BL7OR$WDllJeq^TUpU{z;@j z#uvEppNy5hn2i$@pnfL=r^%aYT&Y(jI&()yOqMPnWD+d;BINlk-h?pRp}vPY(-Y9os%J9w7SqIJJOvN0r4_!ILjlQQN@}HS zIPh+rQPYpF9wae5 z&ML4UMR=V@Sqg)vZp_dBaX1zEI@>l{5* z-;i$QdA4wBLjxm_10*k%t?ARc)dXpk7`ew78whESaQ6KfVC%es?(0d_ zRf`zwE<@Tfc1bZdh5Q3$<;vqjVyPkY(SLO^UvfMJIdFB5sN}{BQKYPA)GI0sW61^OehD)6)67yR^_BZl}_3k~kd@gz;Tol4JaiI z9%Q*n1e~>Gc7os3yzCh_%zPNQkO zVuXef@{e)S%A~5OZ#(3)q>vtCm=7Tuh>w3Du0zWS?QCCu1Bl%sX{#(t90c9Evbp$fgMF=FEp1OqlpraG$&cghgxGf zNh~wck4YFi4NSg>9?PW)_DTFk6i4~q-maqwzm*RIz9Fwv(z%!eCzEl(5P@&9gE+hN zRN$E4N;oK6$NFbK)rwP{>iaua%ovjOyR}ca=VkcDdzj`;i|3q2;~JDtz8vU6b|a%r zM{5cqOi33X#Tov`Chwu*@7}-8zLS0Ci5KiXX&R`d1=~rToHOuUMxBPQ>iaf%XTJ{7 z^Cs1`2?e^UBXHNB8JLN+^=$*?`EF6#!9iVZXQp^=;(yBHWl}*&)>0#ff*EuYpHXd_ zC6=v%=ME9`S3A^QB&mNljDuXeEbBI&slZ`L@WW7xsYi%m1#^lykFx(JH4{whKBYFU zo%<7jVD5BNq{*usQS~j7cnDmBzFWZkrxgUUG7$fziTRoroJB}l<(TzQ-A}G94@FaA zM^1?;6LQ)Ni^h){0SbKAh3Ev6Y}{16q#~n2poH=Kp_RQ)#dW#jbj1Hv;0Pmm?{q=9 z6q^p<@;V}V2t0HmYThLf2UXEQEbS3;#IiAYBQWUwN*_V{AMtye(5~pC?}#3B_XA5EhL+k9y^5eXovG5 z!Wn>Zhm9)QVF*wvUjb`>Dud2F#+7?~(=FUI0qEOqGgPBuB5){la7n8&Cnn53*?kEPH+>T4L%dm` zG%IAY(uM!tiY(S)MZj9y66{C(~tas%1Q6SKSVl=hkxHLc}!>R)!5wFJSVq$M&vocnD3xFG2r8^7aYjSCsgGbpt>JOVt>77Bv!W9h zsy)eq6sZTZ!Q|2u2t7wR0IcnG-HG3Of|+&ds7q`oLh3n>$u5nKYundXZ^6kU1W}o| z)F@FiT>hgbz#(7)hsmx$2g{XTgoVwmke7V!6rwCfs2q6om`APZEf4rU78hX==%PQw zD#8PR=Xf}upUvMHFmAIuWL;70hH{wZo3ZftY<`CiX_q)0Tt5dYjg6SKHDnhs7_Vev zwJjOGol95#j&P02onnuS@lMfp^o{VIO!Lz`DJ6LKx4=uv>zM5oJ+?9gYyKXiF=;mR z+U-a1*Fr@Mkt9T06uzshXS6OVGx;A96FeeAi@gl;@yM4N#)Q6L5ayu;%L_xRr~Jpa zgOGyD0}bT;7H1%2qxQ56_-RPcpkmt_z+?OiX+a43xT<5|qBqq;0+B}%dhr+pzoIW* zP}0P4qXMZ#CG;0h%3Dn_^l6^9C?)L@iS%RIFiAUxa7%+FG>i&;0a;c#Dk@5exHw2+ zKccj=T3o?bWub8U?r|x@)y$3xiz#78GNhPq(k6_1O90=IyS2NbQw1tiZ<`xQ0?AQ5 z`b}lRyZjiT^fY_#{}WB<@uF0*PvHjNpE`W^^7nP|;`im-P~($rOX^WyTyuj63?*A8 zRq^6yj?2vuj?2VESX|)uyFeOq)GjkcKNxZxMXLPIkgcvMJaPa}Z zaa>j?Xsi+$8)*L6n+A3+P|Y-`tgsv?g0g|AKd_ZNd-4RMG|}ZJ(;m%Ic+N#s4c3#V9OEqkwv;N{%^sJlHi& z2BZ{1OVS0Bf_^4B%=ElyN8-N`hFdsn5oqXmIG{#};?ffIB;y$9?}#)LnH`+@RNkI4 z(tawARvTzM*4irJ*v)J{_2t+OZ4MVw9niKs*H<$Bct*aW@Zr4)jkSdI@#)Qd z)XlKxY5Dtg-xz~Ph$7uJ==x{hh|TxQDd{8Sk9$m@h*1j2Vfw)-O>e!R zeZPb;&CZz*G)1YYHF&3K7k4#_yZtquv~P!>WbKz4zhHG|v6jn;VJdKSs3IKk{E6W9 z@WXhif6sQu(~M&h=5?_mXX%8oP|wlw=EJk$*$RX6;?GTOWrJI)!);syLl4F`C|_p; z`^8yI``2hU{UMf2)w5T|YQ+jx9s%E%bu7B`jNtcEAjQ1k>m}!IS1Lb5EN5cP!r6Z} za|{s(%nmiXM|L1|(%9$mxlM*ceSgNI4RQC6=NcX#MmMa96F;(*LL5a@{Pa zi$3YpZnWj;3bs%s!1$d1Fl!}4P8;5&`Wtdy;8!+1Hm`8`l6>LLHOMV8TaWX*>*q-Q z$nClW0OmE^m6^R^Vg;A`QO`zi83IkFfUI(vaDI@mc2K<2axl9hf5T_D$fuZdjWm3k zSAVZbd!3g~B$L=x!hUtCw)dCqU|UED6@+)G+OQ>K#0w)W(X&b=fIa;>CIdNEg_lqN z#`yVOQFJJYu;U1p?CuAR6}P^u+{+H*Ca9J>Fz2?K+Ty&3v9xg8YU_<~w8UUw@AYjA zAt96TIA)LZ|7uj9VsbU^z-VvL9&4}crUa7NX+WVCDR zX>_BBj?a~;6mB%>E$8lBbu5pyttdPkSKS0LzHva_{OvB7dkp8as zO+fq*M~9Ej>-Fs%4?C*bqgAqjUPhqDp()g18+Tt025R%NeP@aT#;?H+6CfN zBUp0R!YTUMVPq7lCo$ML5k4>Do$Bnwy{yg~Nr|E)Doan`F%l%HN zA}ixD5PU=4@k|7%%dS) zeH^>{0P6vMNWe2lytUluJ^da@uopVUsht>mu3V|5aDF0uX|YB&mRZ!3J}nlet>a;@=S;K)4u-fno^6L;0W zzkM%N*arAN-*4{)av2S}vlw%Me=aY(u-k=PJ^$X7?Mm}WYwt>Cy=vbKihM18VoO># z*=L&iQ6n%cEA%z*Q8!+`y!-DJ-^OD^iCmPaYxfUwX6+?E-5LPv)-x^gf7|r5z2!c0 zsX-|*bkIK6D!3azc8j@!_`$59$_voMXAX2AAZwcsnmRtK?)1W87Ih|4mx%PC9JITK z6kBw^zi1sW+yl1d)NC;DHqs~buUk+`2(gk&m1}i30I2tNg`6F6Yl%A_%F|w zqDDI3D-1F{23UckqdWdqjZ%5-_SsxGK5DEIcc*FWxPsG6GLKX1bB<>Qw5%qc&vN?d z+nq4Zl9u0(T#o6H|4>M|dp1m7;2pQs{}OK5QortZZ38ORZ^m0H-oNgOf|3C<)hhBk z^~BfNZa#g_B_xen0v98zx20l6cZ;=sahtA8)a!ze=4gP0Kli3 zXW}5VN6+t>_GmctZ9f$ZE>lR=)&XRC!hk`+V8-CXsm%vck%&=}Kg^!;`sQwV0y+2P zW_yMhP!~53#(DL29 znWbRM4Pa`=0#Mk zNrH!pR6}`|SLs|LRQT7H-nBz><8+`Hq4TPFxCXtYqi~s>vbsXXyZd4EF~`3{H2!01 zJ=LMT3peyCGJ(NoMI&gS_VE*LaiCfH!v1nWl{(mAexpCOwzb0RpWaq-#pQX=SV;FS znbF%(l-Z*xa|8; zMte#{$b#p{#lf2HCuqWR%*JZxTSi{lQAM3FPv^u22waBs#)L)bMpRip6dy5RGqxK8v{nq6;S`7lI z-R)KvygGIw4rr{xGP}AEtB1O*u(V~Y#DBjafdNj7xCP-0j zKgYQWj)MyWWl!)J$$FYThJTFdqT(rQ_CXTVGdAtzWK+(0T@I^&Iwt5m-K*voGAPZe zh#sUDS!@3oBZC$5o`DQhP2!YQ28{&5WR>CNt^ME@0!0o{thnZA$pZ;r4|v!BBf{yA>D&gJ~Sr= zMA493^IG-P6QJ$U+GL0tL&yxpvLNTs${{($qfls~$odo`tuZT(z^XL8#utGqNQ#$o zcwtrDXjOKhP)W4#eN@_ASoiy+2`{nngq#U4+{k+nS+5%LKvER22a06#gloYfvpMio zayLmIx@(YDDbScoDJ){)3u%8v`ZyjCjyQ(<;R~9O7}IHNNKq2bk}?7sL+nxITNT5E zfbb$-5<7p?CrpT;G;-x&%rt;?YF2DaAsR#-gwtG;UNv26V3-2@q%Fh5jSgI#gw;yx z6lK_4>Q2-NlrtT+;cw$X=|&ByEjr3`d8lIa`a?!V8!_698wjr~Nbw*VH^L|GDz0l_sxkwKiXq{{e=Fwx8CVv#b$#WVzlp$6k{>IpyrBQZ+WjWNRO zXp6VuS45N4vl{5EDo32HDVseB`!7M5Lk;w2sm_hy$AnxKix4(67ZI`!^hYyMv^?^V zdM%uNJV^w4rn3}@s4Dndh=@f3Nd&iv3m(Gy1z9h`deib>77h{_<_Qv$#1yO+2GnCE zVWyF0Y-nS3l$3&Go|=H4b-L-wFXW0e7b29)l{8(4jwC7;Jh)~FN1yS z;oo*%ms}oT-_sk$&<%;l(BppnwN9io6rwI&sl>7G`{{uiU@!vIVEvlZ+!3{=K(t|n z8E>dXvWJAE4kas3H$|z_AxjYIWl^PCEv12?Z#x9huA$H?8zz&ApYWn^1+gPuy^$fL za4Px*V&>%97Y~&{Q2K>#fgXpo`#XxmdYO4FM^O7RjW1w-I2>Us+f_&;zRwfg3Symk z04CZvs~$s{%`^+pA`CW)x5OmU#_;-!s)L?}P;^w!+#2UgRi5eX%yW;K^IMYG@o<%a zEfUukrXfe?nt@4*U3x`veuY=1|PQr0Pp+V$;(|V@No+;iuM8D-j!PZ9rXglN}~Wi z7VHe$XB+&C+rKB~W~St&`t`^-ZB8d^ivNsmZyb2iNJN}*2 z0`Dr|V(BXl=_7wMk)`mY0)~JqsHnHii=*0HR>D#N_wwfpHYlxu;{zNx<}%gZG-ie) zj-*0RMX4T=?P9OJR$EoZtb--0&$vwN6y0we7?1!%1qX(jt_!S10n3?G-&0cz6E_OM zc8Xh;v;xJVVgDhGOfwc8v@bZRq@nUyt!$34xah9$-@*<5x9MWrxr^-_LjF(5Yg9Up z>6m-bYdTkodz{h!zg?LZqr&P{n?aycVl7(Hy9E|$i1-AVTfA)IEgPn+2=;AbrkdJL zi9O;>9WMQlPlIKDfL4gS)%)_P=j7+0A}A$t07R^YPAoe&@Op zwSEf0r)8IzHJKnlbo_|9L$|=6_l%hvilI4xYuT_vP%Zf!EINY;;|%wGgK{#^trN0? zeb+aXN>#A84)d5ne$QsvWrH%TNJW`xhR@!Ru^v!+?V1IeM}1dlTeI~Ts!kP9)Fp8c zuizP)m$YvQ?ka92kOEm;*NaRz-Fs?*7EF8jK6%(@n6Ap%ODd)>Ao7 zt)(tjcQXNSj02b>B<2$W+vZ!AKZOj^W%QW{xoKrcVY;LCW16Hp7iO{rDa_M3Qa_>m zKDqK#=iK0&cBZRxbaA?0v!Trw(9l*`QB-}Bc@C4!d^$5@Euw83){SAuT+m*G`A|OD zc1^;eO0avBkU+y8AHcUU0Tc=Kwl`TnJXADs^=Sa!a8ji@;`msO<)S%!o*Hpw8hX+S z*Ths>4druHT`BZT{Sl-<1(IvNsq@7!sRitw2Mda}GkxUvFqmmxB}}(i57xBaQ#3_& z%cTR){N>)GsjLJ+%7ZbPeoO?@+Az6|i@pgJxYUMvIlEu@)Z%#z);@G+MOzsSnIOz9 z(+*(ZQH#LJbf(HCvr8A{%gSE^yoIFcapcY}G2}}atNvb2GsOxfFQ<$HpEf?|Ayo!J z=4}6@w&%}GUVm3lZ4eS>o%Gw&ASNO&hT|m!9|!T-sU4AI56~P(%H5JrhEk}i4^QVv zj>GHAbSrMeg84%He>m5PuLv}sS)Q;L+uH)lf(uFNf^8GBvadKURw*-63qs#Irr@Ke zw4hWe9__2YqDXG-maQof?zL;6y88~?Y^q9bSF)qCDevRiQp(o_59-{UT@M>)r3@zt zEwqc==LFr^fn~oEfC&=mFBe{erv*9QwWuYJG22;)Ks@;_!pjm zV5uxQv4V|ZTQ?&lB)E3-&rxYvCx0Z}R^>WV;6U89z{*`VY(G>Yn`u7>Ip59w8$Tzw z%u6iS^to#1xGG#Jig+a^bxkU=upKZ$d$nD-EQs6nkDL!3lDASLG0(iyT3D}k>+=0-cB^+58c`^88dH3wp8~hM z3dOIlGQiXMGC_0=HQlXfx3lOVb??&!6m3B5@Wa{Jxs{_1Z;|ui!QD+g%^<*j&g`w~ zB@;Ssuqx^Bz`w{I?V9N~sCIH&t=(75NP5lo4qen-<}MN;vyHuM7b}vnxS@DZm`MV{ z+rsdaXTxYH<5%x6&CwaRv{3{HHFDiOyeNC~=nFT3dfxOOtjHStnc7$CG#(lt^bJU~ z^xnLt^B@5Sv@a%12vGfc=_zj>*~M|Rn@;=xLpFgZ|P5TK|FhU0cTdCHwrqXPJg+MykbuQ#k& zt(w8Qd?4;WxKJ8MXClKx%#)KjLWZCAd$PnjjP{OK#)!*NC?t8 zY+P@Zi++@9PZ5<@mn^$w^Q+Ffjm`H$(}oD@4LLo!I;ym%bsJE)k=9fJM4 zv?p{Pr8b-#2W*nMyjm08-*OP6K@@0byzBac57*-cqr78D3pZSSc%7*kn_(wVyiHHI z<(K%1oBbR(LXR;~of@8B5_UENUCadkw3E*!2;|t`k7lSE9|KF<=dVuNnkAOsv)l5$ z-2WtgtgM8zdi!1btF>|LXwqtnd=W3}wBn@8YkRCJZ~D>3{@L>ITK^H(-{Nt^eiQT8 zn3T5?eru=IVR{&f^`XNI{v%xsw@`v#oxhcVxucVU@pGd`>kK6t&Bku{WK$J-RFT3? zlYlSsWO@7*Qyq{kJ}g5l7t8fHw~4kqpgQ)7H>k;50ZJ!^8(-*4mY6i@N$A|~*{6@N zwW5Ehrqm!R#ai2z9?((mX!bnDrT zbL-oe*w3%Jy)nBiLMKL*nO{T&`+uz6tL;~6zo*A!!dL)Y3ebygJlvYND<^p5xltv> z%e^$f^zsmM7~KPGiSYc`v-3z$2ipGfZVRqIPUU`tprKOP90Sv)mf@mFv4UK)*ZcKq z7`cxm=iF@rvgQCMQrio-cimy~;gx~!w1Pn;>1uafkwxGDbIY#oGJ5{Y5SD#y0u^m9 zXA}kuECG=0;**khcFbs&C9ZDTRoPrsIQ8IxP4e|uaIlF3J0o@Mzl;9A)iSGy9}$X% z>Sg;UlW3t`JEb-mp~%*>A6x6rxvec`f57fUBj7ryiQrM^_97B@_Pi6q^=^`}e)$&G z){TX4f7EAFI1P>?|gV9 zx&46pWsvp<%HCzPq^f5OIK&;!hwqQBL&d_b&Um&wD^aKJn`HI6VqMUUqV-0pycs*g zw+3)7H#*ODMT(+K-iGhbEB)q24~wIRAO{i7F&IaWmm}*YTw)EBAHShD{g!fowzu2S zk9KCH!$2xXrIg)f){7xj!u`0KMs|{HR@vm$J&zNQ3_Po+hJYA&W=6Gf&M6T zE4|nI_HN(joSkuScg}r{zsn*1Bt{rmP|&w@Z3_em1rhygq6=yNG#ch#?Kt^C8F*67 zM1FElX;1zV10AWoOtPS@OC2t0m-hFaw0WXpoE`%A;DxUe;_%VTb9P$O=L$&C=y&4Q z)E6Woixa&5GTe}yg8f8$q3ORh9Upb@I%D8Y<%mAW<^1|~_sJ@BSVur`(89} z(Y!tAUZ?$Ur*sbqtO=JmxBq)C#990HrhyUfZr{uHMu=fVR!hq%eH^<_Q_X{Bp_R!G zTv$CP0&Azs4KBQnVvH6^XAjHKlS#uj-@fbm`5k@1@76-e%n#k58wj9Ri4IoevA=j$ARmqc72voaGkt=QXbd z<88v;0d1-FS6CdT4==%@?}l0&Xp`Y46!H{nhd0d!t8EWq9VyHcc=9iquX4Iv{#BM_ zmU|8kA=@fS)J^sUvp2wn{1B~nj=#7+)BDb=t(WlY0r2(^&E*3Xy5P)wx!;@eZ~;8e z##*cpFmLE~cBl?M`1zR|F)Mfr6R|OGRb$S6x$hy97y7G0Z#yb4 z1C6f)7x(rpt>_dRuN(K5tUgK0i*|m_5I#Bc;O@u*)!g1^(TCI)k0tA{_FzMQ<_7Rd zUuSY@9ZH*rHsDh!-ZZu6Q`LGuZa{q-a8@2$L9K~XHd3=a_b{+yP`Jgvj6%{*7X{*0 z4Eh5h?7E#|wl-5S2TK!WxWo7O{JfIjR8e2Wcy7Ku={8_JoH zr3d?FtIH!bi$~pySm&Zbgu{t}{d9Jr!EM_^B_9L!eMydJKt#x3#S4B?EaVi~7)8Bnj!_#Sdmd-=2K;2VUM zb%Kd?55VrE_@tG+xGfsBwg1$M{7wHmU|ZwgeCY-i9I3YlDEx!M;dw-N8 z(Ag<8ZgEdP|IfGZFuD(|gYz4M?~3D;cG;~evd`vSV*FaLup>3gklT(`Il`e+pfVy8 zGfi_W#X`v^e*v9)7r-V5k=N5I(^buj3hnCe$!-tso5%YS#h?%V@lVr0 z1y)GRsGuUpOpKUx@PL7ZOYQQECguymrZY;a0@C?ne1Yb`C<%ac}t8@WV4lc+ed7PzK}A zn^!h=0brrei5+vJ_mk(sN*OO#H9nkaa>DbL$-&H=i5FI{`ks(I9>13(@2)1x#3Qe( zYGc3q+3`KdZ9yliDxm<&z#$5WZ1Q`rDNd)`QBKWh`^o#uWdS_Nu<*Muo^hV%e^tCt z96TvM6JWmqy#EUYn4~S2%vge)>4Vh*h5v^3qc^|t#S_-=AN-I=biQp^;o8DYskHbL zyq{P=E=3#hU7XN1i=deqfBIDu@gv1BNqU>+)x{akshH@6buT)swt0VH&T6M3EhL zy=KbMB-na-H`Vr-xM6b20;mrKi6lU_ixVNKs*7;Xfe9~^VSkOwztmLkpiCE&taVyJ ztbMR8F!LAhY-oX}P)ZC3#@)4y@NxPIE6Dv;bVol1QXh9}C%7q#8*?|FbQvN14-uA`Gx z$FWhoIjT;lps2~ zWMf|5YSa`XTqsp|ForZ0s7(r$2}8MV1O6L*nkkW5I%dR90aw;4CR(_K0*jRwEc6Ew zh23UJ<*<|bMr%)wmhHJh77sAFgAW&FnTbjx-b>~{KDq3Larwr&h<6IVWKGdMOUpW4 zswx()yZ?(8(Sp-T8AB48S85|%t`*GZ@-0KPIQw~~=o7c#f|+7-d7b66;t@71Cw)IQyUk|*;wA~WBB8R;_S zB|{0l(f$=-;%vG>hXw06-*COTWyq4NL*raS?`V%6^s~11& zd5mL$b01m5{ z$Ng=M6n@Prhb)7VOkxHrY4}S$N~^W&^JD5fZt>5!s#+*=#4n>g@S!M4Q1Ds5BwjZu zPCWd{O^7(5+AzErNvWu)v;^t4Xl`$0BIU)Hp&9LE!b`hoNeQw ztAStw-`rmN5r;DlZ7@Hzmnyv;GkcY3J{@-C#&jOY{J?p`9~F4oA-m|X@@*tJqVbv# zpEnn(gWv|={CwaP=wN&fGkmi>m-F=aAn>>T5MahG6nYHnEsA z6z2XYUkdUETwx>(9$7#Gu==`Jn(xcpYr92$3(R95JaZ+s_*zYF}F_#M_lE% znw|`mm!tTUx7M908^V)K3nM|^gnuX}4`Xd_MW*H4U6?0y5vKJriN04c1lZITgKp%Foq+#;W6app4Ssh-fRqnFrb_sDBw@>*~= zm}ZSz!+Bf^((9U4ZoAfgCDMBl*sR4|Gm;QlzNLRXp>Ajx z7bXO<#wVVlpJz1BS0Z4EzLiA2+xkwsFi9OKG8w&7<@A51{y6eaIJqyegJf$&>cTPcyCP;mb?B*H0O_czFpaqNVJ1KCD^X=pq9aIxKr5vtbgF(&1s$S81-exjN_#pwDfvM z-?2JuJ_S<#@IOM(Ej0yyRM2;}xFCO=64;;8-%9;ptYgHf^>ZMwwZ0$c79DL-Ydjwe zWMt$uEUp}z!qM6D>A#yx{_O4B-3~O~w(1pothf$4Pa=UIN*YB>!P!X!sO9DPI3ML3 zQ+0j4E)Z2g)Yo>aLYr^esobmd=c@i0Svj6h7VrBlTNOns4=K13H(Nco8eR^QL>_(Z z>Xqi$woM9yhP5CGM)!yhSBn+wjhbNL#_ZAt9Z7yKr<0bxl-pPm??3Cl0MN#Iy7d`@ zxk{qP;{enakaM~IR>z0!88P>o@f@viMlYm0If$r!s|tK89O;t=?8`_i9Z@%iWs4((qal(x%xxdA%cb@@|Nn5BgO?>G;6Ksj|0Ea6667o& ztQx4ODcGe@sm7OEl;_*Amxm6ug&>?h@-mn-39{gKO|nv}6neuy%gl@^%@6da@nlYS zn?n9cBNEUJJJgPZ@=HgWwBA@{cXa1VzkQQJdx`kzviO}#M%8PLr*F|u_Sl@5ZrPxV z7Jz0XVTtM;JbucNJ%oE2cP}jBM*3Q3>PqFE5O0Z3GD}Cu4@N~c`)S_ldI5-|>fPb& zcQ%`!O7zDGBo60ws7v%a;AGy86~A1HJ1DjpIb)Z?2~rSn{yA>BYTqu0!$Ugg6Dg*E ziwa8-p-Cfz6bpD-$~UFw^>1#R61^orjt4?@6R~-DF}-DwVyCIF(h>5zbb&``LL^u+ z2)dwNG*4w7Qlb={Dn6=IdN z6L$g}pBw10io(423e&cT8?ks;d%4QdHVDZFqKM`Xu}Wo(;WlM<36@5dPR7KI;{eZ+ zo6c>dfAb*$8EAOM%DFi`lM-3}c^D0N4Mp*;sp8QlQBem~-}-rrx5o6z=cD-uc-mE% zj&qgKCP*&@qBfmk?VWM;LtQW{#c7UM($%HRHh-~QEBv-Fr&t?07=U0A9F=Ynu}S&u zGNNWSBl<}*Iv^}ENt+r$)y+&lbG{UNfrY+qV79|X4 zvw@t$P3~2|C)W-~Y(T2`nqRw?`YJ2B`B^G|4+}m@nXRhWuq+72-4$=fu@YE~3w7y; zLAOaU=UeT9WJZpOQ70nQk|8GKfd#P>EQ|w6D zJy;EepB!ZyY#7`*~({6(z# z&tAZ__<%V5mO;aB=FQ^zwa>sD7ekn|EuWcVhz$eO?*%EmuH`Phd?W~a%N1T4iS=CgVBMy-;KnqY;DGz zf70`?_@RG79Y|IzOb9O6ND%YbVrfAgAEK0tk~HXi(Yb&&fXvwN%l-WD>kpEw*&nOV zR*+n9E;PeK-@b>ik~)U743U1DjxZ#3<6yb15W`e=#taO*(!--cNcqJ7i4V)HTKe6{ zaC8y${&ey2ijz!<$#^OU6fc239u^IO_Z?KRoyhZo#d8@0S7zrOoW)>e-|0IEi8P7= z7`+7Le&MPM=l0I749hEbO|Y(*M(5*6n&C<`m`nvYl5)tpYs-j5Nr$j!_7}c(N%lIZ zdMxUAgyaOtNo71*>w)-Tv9gcz9boaInIV1rk2PNXn|{9S5ugC{-2UNe$Cm4BjCaGt z9`0s}b4TfI-YRk<%vW6-FL(1Qe(PWpcGOo3Rez8VHTlixsGu8rmFKl}_S%t15BJ0E zxM2D&D|_eI$?)yX-B|gG(xQ~glYE$H2{FQ=kAGQaMYXP6htk8^1!~yKE&F<1VfCad z{ZQpI?+euVSr{GjhKobAg7Vb+{g00_7_Ixzs_~rr^dk`gv9T$H}cdIG`Q0 zZrqX5uywH|zL;9wVXc`@m62xaae+<$dQkMxLGtwUt<9?n^8U2zV?p@|zfGd(X=chV zY<(kn_h8H?tfJjwk_q5C)%Ow*RpFoBBAlM=VV(S2k^%k>S#|zd#bf>QRdz)tt?j=w;g9nOi;ZI@AYI1O5=bKWty*@(0)y&!3~i<_cE1?Hp2K zO^I{vES;WxOO|+r6fSn$=UR6Mb#MlHA6yB~r z<){woF8bU>^Un4y^V>fhJN=v-L-7w1v}rPD&gQng-O=lKMe;vb+~eF_m=ISN1i3s6 z0*O1EtTnnI(JJmYe|SO64r4E*{f_5=&bsH54GlZ%mlv(A!*VC9(YWUJWOu%dLAD$F zDqiG1hxR)XE1fl+YUlykGbX>Ol;4WDFF+t!X;qv_{3MJE5 z4Rx!3a}V~RWYN6T*Smbtt$LN3TYEj9-&aeQnp+T{_d-z89rdBl`N}sjsZ8*?K11$n zt7u0Qa~}(@p6o!`nHTic2W7tlK>XEt7sFud04~$z?BC){waSewW4jE2@O(6R=aO}rzYyAQv6<9wXbIICcEa2s^^qWaWS zvz>Qd@5k?k!9q=^kPSPj!w>~-WvwQOZ%}eY4%V(hkwVTK9R$qR3HH?2iuk`-V z`|rHM`k%ZamQZ$u3M6Uk$DbD?`%TidLj}eK8xeTPvLzA8?=iki^4@lkEG?ZMm6i|- zA;MD-y*bG>`tRnaCPROO>k!VPTvbhnngR>eqAEX$|5STvqwntyL;T20zUs!Udeu;PVu{CXOZB16P9u27oa8(K3D zrUj0B3spT1VVr`S8Vmd_kbX^Dqzg*85IIInX4kRuhvTLtd^Trg9Dj-4cVF72KY6<$ z$H`f0m9CkP34k_HQ;*VQ&+H)$5#iFQo1;IX(REqT~6q3Ug}&9k#uGuh_dkUm}%V z9L)0fA%k%8_Fb{d6-l=LRxdh|fxf$t6p!wHox)5vB?10DQHI^;VM8j6>+VOSAIM@A zx5W2a{}@!Vnk-W%^Zc6fLPtcR44U%dfm5ODUbS-HMj~uBTiS$hKm$$iSV6GJPm25` zs6lOQC|-k&$tIvQm4iJO39%Q%_2??wmk;Y{P5+0%YClAaBPXFtV-3uqi&EoL3JJ4> zQ$E^30tSeBur|=k56@9jtn-f8Iy#~4bmhwNPTxHxgO^cCvRMUVu%f?TZL77A( zT5}3>+-bx*XAwNuC@&Zu*Ijc97ou>l^3*i?#^$5VE+Hz((;$J9K3Yu_3>*tc4-G-m4EQ>gZf23BmXZ<02~fXdx(&r|_{6%nFNPERbbqdj|ecU%1?o}L>X zVY6tF<`!0YpfP zxnxJm2&KBl_}}$v={TjHyAjeqx(_D?h2P&Nfj0s^s)5$|V2(@h$J^5Z@O~c#kY!HX zZYMh~ICvW#DtfyrU0yKr{qRb719^tQqWz zyEOvFV7kjdY0p0TH9Pm$&-+CZ0F9)?qw&XH|F%f*+trOBIYw2ZN_!@yW4fPYoJSR& z9h*FlElvOHb(0k3oq;w7I%*yUk_=R`U+sc&q~qOvI+*Y9?Rm$^pY5~#IhE8>!46w@ zpM{&jrXy8V*LX2F51|aN)ShcygApAgO^m){ZCjzUU?F>NF=CUE`C6{v^>5BDrFZ>fGNBPz;-kzD>slh`A`F{O z#!mkHs~ecjOJ__|z367~I} z(sN^D67(I+<#|6Rbh%&e#h6o*SoP*RY3seM_QL*R)Trfsg5e7~rF z@tnSwAJtigY{08-_7iI~(@{>W&C4mrm6NK_ccJ7LhkNzD9N^N<&(=^ac{ylOHRZAQ z2iq$Dq^{4tUsgrqRxZs-(YtSF&&L<$x}B2t4Oh@5z;HI6yiv$_Zyx^AFvU zw0Kx=+WK^5?64p3w71+5ddyXJ68-W!>#dNVrm#G}0nn>!``U3Ftn}lY)+?>!{`k|a z(nSiRk3stA_{+Q*?S_vl&zR}em_yNUqkX?2%gfky6NsUj_v)yl9qXczYw_i2WSTy^ zE(7ZA{iIF}1EwIMsk>`5Z`n||3|DeI4=Q;KTvt7MmWP@3ESlWLOrpCogy^trso5$Sn|D?|IeUZp4qxC7z((EfOPodc3JW zKQq(^fvO6<051HJ8UdwbtP*RXNU!$+pegI_nrUW3E(f?_Qf-7S~lar5!V!ZW|yUSJsr-f8RJ zYbv=?)!mdXG)==Rrbd9?(C1d@<`O6eNyLN__V@zb_BoG;p+c%zIA=$_yC~7JFWb8 zh++G$5Cd>={4bG3lD0zZ+CTB}f#zZAC%7;MY!F1RNSuT-e4s>a7)2zZzzK2JPh)6e zhq#=a2bzX&;pnSE^4z-pbPES%e+KsAsQFuPZ+6X{3;Sq~cb#c4l9{Nud506Mag-mk-^@*C%gG)4+gsn&P4ly%7 z`!J{~ZxM5c6i|pVBKol%PA`sIM+`g1$`4<|700zx(<;%zSXuWb%95pI)MCbuB$8t4 z@$HHEefvx1=8`E}oN+~ATF1C#^_hfNI14#Z;lvIl@h2)QWA&tI;nFrDCJ+dL5D*SE zDzYaFU9v=7;(S?DL7409CO~58)2h;}l*eDNDekxT^9r9HHv2O^!yMP6x8wlb0{deW zNk6NW${7t3%h_h9bX`{ANrCem52aB4sC8+4djEBrB^zAM7P;lVq!|p4Bzd4tq8NsL zs;&Rmzt}>U>69AuQeAZOzCbCgI?A^%Dqo-`gASJnyAiRK>#}CyCR3Gv6Q+G{T+5{0 z;1}AVThQz7Je~;7l+YvB%(XFkRv|U_R2kPOp)xXrn?oIt7E$ZBEGNsSbJaIf!}x(g zjDjL96IIHRk`NCKg*KPYV>J4U4(SsqdntmcGJ3Yk*EBrsajB?TLNkDt1wX!~3ezUS z=4OE%LR!PYn1HAGk6i?VD5GeixNk?0ooBMPU9t*PX=)>@r$KSL>7I=LnICtyTA|}$)QPdKx|Zov*9fgxfeWrt{BMd z#Cj=3pgTxKEBKP+z7SC1?aB!0JP;B?)7Ttm=#vko69dmOQ?hI+Uk@GOGjf+u?tTmY z;$JA?NbTD@8=NbSGYeGzBu3REh1ZwtES_@?$WZ$w@HvbgN}kSBu!eg3Ye=04rMuT3 zRPnL~4wC`vuXSC)L)iN&s*H1}5`Xf<&Z={dncR1`{LRnDs9%f_hWBiK}Pmgd6fI>D&~ zDyWx<2%vnjQ_iX)^u?x!_3YQEVAH72l)xzvW1b6XNrE;yFLb6Tx8kivEkkhGRnH@m zj?B$l5q+eF;)er}1K`RFV8~ehM5#9r;(pO8`vp}Wp<@b40R1f5+Uef!f+-4mdu5U9 zS2h}FFNc8I#k1|zVe8-Wg&M^3BkAjV&&`2u0cIF$kB1oI{GGt`TCYX->DXmYJPBdk zxt%QGf7S<$d;;Oi&0K&%vMLsp6@U6<*L4_QdmJ{HFjmTSExo-jApdD5J*Vwb>l@%k zQdA^<`*|OEElk7mI@xbaTItU~q_n4;y zG!oDev(y{b-q8)5U%|Mc6A{4SHEVdY1n9pv!(Eaj8ulzE=a4pE)RROnHZuyT5D$?I zf`Eg;%=w=H9P0K-+rEiiQ0JBCv+dywIah~^CUMcxe4e4`1^%t#*d_97LBjR-1alG1 z)msgC)HQIS@V<;`(?&@R{e{^a@*)3I`vY-X7$=iK(L<-t-Lu;JnZvZDzP!@cd8=A8A@=He<(pazEU~_xPLD0aRlCjTV z?8d@W0+FdLH$S1bp`+hbRo^v))*I`C0Gm%)l>f2$4;Oa#dlyoZ9K`?^cP5xH7yvIq z2p6e9oa$>Ymsa9!SEnMdIFaQYm{|?5q(Y2Ff#Vlrf|_nV*tGiW&UbagzqA!p)=#Ab zX16+E=jdAf;u2J5c5^XjbJj_>EWvv&=}4t0+R&Drh8VdUddWp}kM3Tx+gMsX|%i zv>Jtau=6V+_qnAMZpM^x9akP%bQt7@nfOKENuny3@CvT#4Bnqu9mN@XfPO-eNrdrR z-I80_9@XFBlb29Y#Lof65O>wLsAf-1$aw#ORpjE&1p#jy{jC>@_F(B?#4(%>>;_sp338$axRPG-}&Ln}t%m^O7aHO?9W)Hp?6IQ6X`v{WTQ+(GmOck6lIv=Rm z-%e7BwU15j9af8$8!pv555%Yg!=xmu4bgHjz+3`)M4M{9zNnOGe|&Cx%(O_-Eph!m>X2=t2@`m z*g5I}s-Qa`ZvhzVJv>0DYHscYwkt9d~B;NukPmyhgmYXlc zt5s;cgLn6W;KR6LQuncBvh+ky3d~HaqH11{ALGivPqZEqv+~$~p?Xte|Dsmmgi2k~ zT0UGgN$#`VAedr+ZO3NMTWC?F`$unaQ1wE}JNxkf6)-da*_&T2dQ@eMX20J)Xc}`zzGxxAe)JLwNN@L~V>(G`b=au0 zYVT1u*s(1m+&rqb|29z%8l1ZL0S`S{NJ)}oi#!|T@wV^Kv|G;PrGuRjmOcO5UNhTo znaxK+2x!XP=qOb(ZT;(JAAfotkVw#+|1p_@V9B9bIXF|k+rkn4 zJdhk9TAYkm&k-lqJ5@j5^xU znv#qS?efWo({0~eR!jya2tT~<&cm}-Tnvv49mYG``oxQW z`(F|-NNcL@(JbKa9|AsEg=^0B-k^RP~Iz=blqi^U-t#P%HNgvwnFpM9UzpSRnF}^aEp*M}= zq5b?PoqEDbj$8Cg0+}E@KC|eTYGS;+z(1CdE&1`IDV~~T(xzm~^^JH&5ba}QS7?`P zOTOIO=4?;eyY=7k0Fgd*0_Z1nDR#v#0nmaFX+6KZV5CS^}mw}m|wA@V{1@P!Jwd)M-d>!*NC1s)wO zH)zs%(W=Rv|(D#xBBdtlV^??+YpXTR1cyPi_vA*hZU{0wDZJo9 zWHap(2Yz@GCx^gP+XA}V&#w*3BL5I;+WrBDcBYcQgm!M9SqYH~gU``fGv#g>eq-GI z4i%X-)}xq)Aj{N@fooXFjA|eLYuu6H#vGJAk3aNP>>qOq^JYCU;4dlR+b$dU8j*B% z@e5rz9Lgu_DIst_P9V7t;w?yo3;tr;%GjJV?N4=WoEq!#9ptNrYaey)WS>YqZ2UBC z_=rd{6Ri@M@+PoVBrb0vL(QN!N9CO&mz0&Z^_5}8w@{_CZ1~i|>(VSh6DF6jCL)T- zU1prH3RdEI}$d(+y$ir6WRIm=Ql}ROpq^5js!{Eza1=h zlI=NiV1#e}lK&AxZZvHkW8&+jf>x00J`O&EvuMcCs9kkTxJ#!Z47`(SEq zJY`V(q+LZmO>0`pNI;w9lQtk(i7==zgDEW)sn9RB(OBb1C2s0--6+G!`kRKEeZ$2m z04W6Ash>-Udl4Mtf2I9tzg8-mTaqYeXR#F^6{sqU#CbVTQHZ#mAwR5MU3!H*Cucf5UNMfENI-7{oev=J`^|yy+v^$l<7yFP za0ptxYs&F|9~J&6i~hLXi3Ptu-jALE%%BR$NS*hCRT7}(ExHFS>*EgG^zmXBZF6ZT z{15X(gu9ZI2Sy`|1Pl?S;R4y|aq-581)ksHb0jF2zdJbr!l0L$cYEP$?gd-@Z1}yl ze{jYuri=B36F1+qPl_@WEYJlGpMQ-Cu^{hPeiqS$kVpO+N*YY^-3s;+bqWl?ifF(o zSj+&gx1&{fU8#_-RZWH-mA)^%lYqqG$7g(jpRALySB_I?uZ%l&Y<=!gK43>3po-1I z_VOkK#e*k@rJI$ieAB)w%yd%$)hMYo2_Ba>6A3{oNMpj~xu05;h5G9^_~0%PX{A6T zbF}t&kzb5(Rzk6bhZV(lx{yHcd8s#rgnFU={8x~TJQqpXr!$>CHM|d$;1zgTNipl> zn6fu7u{jbo2TPqhCTGn#pF&S{2cT%hh>%gFCtwv_-6@(KAx-5`CfV% zUDGvZk%F0xbr?W~BW`g!Cn;Z?16g#nwBVE`?H608K}|Q-GRjhYWzT&k=w(zgPcpnC zoyDClcCQNz1eIQ|cRq_2KUR67^DTGItr}_7uaYu8%KtbK#A*Xz)0#wlt*cddpQyg< zzNLKX@$S{i7&9-x1Kt%XqHN5LCY?F1Yk?b6u0?X z<9D$$6c&*1Oehe|tsnDihc!JTY+UbrzbK0gCAZNdu-04@cX~9c2z{LxBMW`uj3Yec zZ6P|m^K*hzQ)Nc#CRm6gx6H1w2YMWz)fJwRtK^nblHRmAl(zJW=kE=SG0xLKcD42m z_F*Y?zkoBlgEo!5=nzfXI#hEO-Gj#85XT-GDSJu=xoKeO(X5o|d^V2@&q<(z7m|e- zQfnL+5%P@YQ#+SNhj-X0hS2M$xdIC1ogmfZm^2U7WY}x!!DLZ%Rj!blHI{+}mL-1U z%15E!#D3Dz#(jy%@cnU@Nbp>!?BXW_bKTL~+o7+z$vQfWOP@lezQy#5*rP$G$+nkj zNys+6_M`#MiY*ryG6%9psThvr)XE(c)$>s=1=2xA$pDGgH6!o&6${h$57u;r)1MInGb|ZN(CYpnCUQ8=L&$PI#QAmZlJ2TVqsIU62}- zLpD&CiKee*EFswKpQRvL_uh!}4$I#C060%=FEF)j+O%5V3zDZs=4Fu9S zS=RtsAG;6q624wJ{@f@0NwR0$3VMTMHQe0^iZp-bzetqM!O?r`B6xiZi4`0h=1m^8 ze4BB;W#tZg6vAs8{zXNQ>4(dtTQb4xcUhFq1c*^&-pkAbSeIV$Xr z8dSk&%EOJ39YW)u__yT#HC~narT$_^U|<};)hD?Xz>mpgNW2@fdHHUT8;;T#E~Y@% zd38JH=mpa6NY_)F<&&)@Fcv!_h}9CbR3~C2$c%=z8}e?qA;)BtrpsGK|FI?d9p2$! z%?_>4cEFe`AZAvfbbzqkWyha(6LUCTn9LSmN;Rr4&XrJxGf8BN7D6~8OB}Kzy=VYP zvX8&t_$H(7Elfd-M_lcNGUDW!Kpm@5l~~h1a=ffgIv;R~(zC*yoaZ3^&~RU*y=M{0 zWw&5Zzc4_Qr_UL~*zv?78q5|p-J!^NZlkLq4V_gk_r(Eu%ZRLW9)`lKSv4GED3PPc zKW>{k5S#L=w$|S4r#Sl}Pq!%sVdp(y!ViO4wB9ClAgV9qrGU_`$RL=quOc4Jvdli0 z3XOUD&*Wb_JE1O4TX==@YcG2pa?<{VQV|_Xt4PX?iNpn2Ssz(`b#%M<@$WfxygT0# zxfn3^w5e;l?yu!z=$_E$yOZig?eqgx4X3wd&$89XuwTR&w6~M60g7 z*$)c0NnT(Vq}6YmYR9dz8b-9pM%F}^7{SGr+n;Dd+j-#^J&dA1F}R#V{6E^hIl7Z( zYj*jsW`PMn-epmn8RlT0|tld@p>s7t0 zdi}bd+8eENS<=A%d(W)~Jtqv)ekHLC(f(awzGQh>=h!T{jOK7TUOiYEmq}1XbsW8v zZ^qOC%AtqK-t45J275GQLY^kI!;i!@bt!^Ap(iQnB|v!y^x9t#F0X;1GEVNm5!ax` zSXFi2agT|s^E~9j$ai-Qg$p(l^!jI)4Dx_Ol_{Z32ghTIliiCKG6p`;f|vD2%y)K9 zB@z8!BJc^h&`v&BmRVlt#|88p3TQS(3d1o@eko2bR7IjvXl^LURKz`?ew!3gMW36@ z^4HkTYycgXcEjsd9M)u?Qn&1Aw6XEIYJKikr5mZVotn z>>Kch;+O3jNwIojntiW<^sI1bzCJqx4Gh)(W-bul7b=Ex1Anh^tDG>lVw#$vn4FCP zHyR>p+?SJ?QhfQS;8#(ruf1hp_(mg@Z1=ugw5-R~c2KhD-1R(L?4ZhxtbwFY2lIYC#SxGADReoPt*r=cbbH z+R9yGvo|;1kQC{Zgsu!WhDC#3^o8cR0!ADu*V@2Vxr902G2IzhB;GO zEUjl}s~f`jBb^Azfq?Q}f;$WS;k>U|{^s;{(j7_dz{fRgqM*r!Y$nm~qx4-v@ z{Y!g>u7)JIIT+$mtkXBfpCp$QMZj7Ce~DX_)JE*hhaT<;)mG-T^ww-^?SVA3MG3Lo^(SV@=SOtB&-uJYMZ6eZl6 z5@X3ezOR$B=){T4r)fjTeEE>UlPM_6?NlUe+#e(I^4gRik#wqeSvCHX$w%lXxOq0z zIWzQ-YHWsEg_mymI81_sE)MxT=r64Ocs=E`r3XxH9!m2vI7D)&E>An%EQf`&iHJ$ZgD~Hx2q=|nTSq(z%^ae?z_;j{F zzar{QbrRwlG~60h36&yBpaIB!I^~*V`)+PBY{`;FC&WflHAdjepNBgaMM&(yO0&AxEUWfQirGVZv9VUz1UI76w^@V0X0Hl!)af20rBS^RxON)qLHs__(LI`QnpD zE~e5L_ArFw@&QZG=9H;za5m|I-e@F4F67A{DG^)w{zexF=+yXVKQe)cCbVPm&?5u} z{?b3+gY^(~dcf`WhteS`1p6fi83W6Dz?ti*InzF!RVuGu(&N?V24dGFuYm<%Qr!hH zAC&EY=ajF&+M35qw^v2U{zwgvO-!_7lnP>^6gbg&tem@%!nq0aLV_8bq*-<{lgFsg z=wpq|JL|sG3!FaJ$8ZIPbg@0aL{m)j$7zP=WIZxBaF1PjYuwt++qt#V$Z}xBe|~@>^d`46z7OR4~I*1MKPfeS+%kZkzu)z$+$2m%1?uCj6Q6!pSnFqIV3Qw zJNLOOr%Uu9w7@k0MVXPb{JPk$0z9&9m;AJJiNtO%MAYR*<1_7}u40ly1wU_1;aW85 z&*)Y%P9Sz_iWlf{YJVKjkuKnUG~}~Sc;e?A+crWhI5LUtUc4pqsMY??gXyljb}BNx z8N{nRopfDm8>6;=IX14DM{G6g$#tb5l)+_`N)c_X1epjJpK7wXMj4CF^zjWm$iH_Z z!05;7o339@g!>vg=}gfE-q5)Tb~xGn1RNfgr(ASuCtxYPbOjN)0>##Xc${*ae>f16PZK9aW9-@;_m>CB8Ko=FTl`0-6PO z-;4KukQZwgsSDOgA*8PQW{7A}&G44)tIDGEE)buA_j;2Njj&J1!c ziFr^$O7!YVLIlP3x?~;5Y(ReqE7Ot$Fj2x#edr`VnW75b@1l+k?OW6btDKJQHW=uY z(}{WjtZNDsjx;*wQV-lDRiCI@>6kWwaMnNY3>kaghIX^D6ef!ggWM`r2&MWwg+(?= z16f$*K9+*uAyexndXOZe`%$^kU1*iL^SJ@IYiXSIJ~IMy=}{9cc}92Wr*St6I1N~_y) zc9A9rVZg9AXO*Q!L0%~Xd!Ec;mc2d(-Ck>waS98jj*As!0t3;0=%}44q~cbSk?FYD zO8X;}sEITRwoEOPC&(D}Yt8u@;88p!ocf`n%QK^*B!NP;8?_bZ3D(l2(46*e+vc0a zUv(n)#*Z33>`yG~b|&{;%VMehv+^go+JcAfwWd@VuTsSpqGo0k6scZp?RIf%e9pY< z!RCO*qX47aJXW#^UL&C`JkkMWx~nz*MF#JR9-2$&c$#MmNW2;0pwrs2-*?Jc z<+QqAI%jQ|S$|a=e3tsJPYb0hJVQ3hJ?94+V)$nZ-ttrW_Ii5_NYX}cz(WFx@L<5 zXuP>=k7~=(}Irwj?lv2rvF&NAV||%(8@a4p@1? zSe}(%HZ)nIN>KBObO8KwOkHk=oCRRBg5u9}S+W2xh{7rKMP{d#mUs?K#d`{(+wNLDNR<)1;DJ8izyv#keIf0i9z7 zIXi&Fw*BY?p7G9pAZ34X!r~W!DBl=yVWxQiH)k0Y{vDvnw%vAS!aD;=D{`IQdpHGB zV}o~c<63Qr`?*V8lZOP9QsmP6)&NdZp#B|788RL9AKE1jCYHanOJty&jEPKOkaz$W z^M7cV<}|e{@VKlzCn^dD$U4hKLuR2E85t#_c*)e@jSo({k?IfJm^!-=_uYJUHv;MK z9aT%Dop<|Ndpkvol#5AYwzCV7>?zi}`-}R+i>%TlIf_pFYx9xYq8g;!WtW16*Cp7e zkz2oW3{R~~)is+r0#gLr8&wu~KAr}0<3r}9+-7$%ujt2JKpu(C&YWa}Mm<)waE(>8 zgLtu~A@k->h_$}3c?H;3g({&sozi$ub=pVib+U&#RYyfPnz~^lk8xR9{MBHFb-i z3~M;OkGhn>dVaMtiMxG?(tG8yvqmg-7o(D0Hd#`-)|T#{B}mGYc8ytoRIoDRF$tZ@ z_8jlL%44Eda%S?JaNV4>;dxbkB@(+zp=Ffqgq*YD`7gnq1Y=i{T97qL(-gk0!gkoB zX4Fma6t=^%0HiMiz3`3Ch%V~yWkV`WM0#Jx*dBV{fU(w5Lq?gJs)p(xOYtFQW4S!y z3C+pdJgpkk?n41A=G6?cd1*39-N{?y3V?`$koe#Tk>O81IAj z*~u5b_M$cjnTii;>N)4cl*-Gh;@(Za%&cA&-9-c6Zww2vf<(VhJbYukI7hIa7=jg+2v%eUx`sZpHv*5 zL`rbjjm|Jn^N6~$9J4rk@LiH&9x1zQX_4wQfm4a9TikSGqEkf5TyT1x8F64ELOYb! z-PFRLOmiEVYZBU&>*7cf%J+Uw3HQAE1)W1T^(jMrd!tAm9lJG8!zQM_KXOcy>&z}p z?tt_$RWneG5lnuFxSS?S{qyPSwGn zL%rER+UC>QzOcF3da0f`-HI6Ci+3xTPVuuj!!$uz@dUR8S)~TUGOxaDO`=AAFx@y^ zXrxX^OWK>xy;@Tu?=E`im;KKl;rpIt_5lTzL(u~>eQR}I9kB{pem|puQe)cR*<-Q$ z_(KD-zFbg=o>#05)x$^myLUEFERmP@XIbnDYJV^)Si?CmJEguE!>Oozk9}x4U;kL| zSm+P{?hhYleiNOf?daAvbYz~&X{Za8Bq9-4cGT2gE*Kw9Sg=I%6= zaQ*%1<x~TjlNeL8&|D60?!RUygZkbW3}tvJG9>vs=J*ZC$vEGJbeM}we+6NasyfP>8;eY$hQio_O;Rbpfy{Tc>|7qDu% zJg`0e?Pgw7zr7aW1;rBkG{gIFN8Y-Bex>$z1M!1UV{^4fYx9EznOxLT zw2t+KfwSzI1|P4Khd{6pKA&G3V;O?)suq420kN6(>GEkUx&hOdx>6uJtz(GlDn-Ex zzu_f9Awv%ty7t}kK}GNV2M$x4aqkNh_*X9Q&JE%-tAZPM?=c;GP)+A|g2iE`$|1UP z;z{TGLf}`1+a!xV7Gl>XF#Yyg(k#gpF;F(kafx}f((9G$#aB4d#P)jmxHn?m;pO4A zgnS1)ZM?hH^S|AB;JZXTTwJS`xVW0xZ}5P*nCVoqjaZdIX-YLf)j>6gTOgStSw_wh zAo%0La>Oml>k9`XkhA|Mi4Gt^5XA{$MK`4arseapC4~RB;D)fHTT(5{JBYhFo6E?S z^v|~4J6pHEzdVjCB-UfvIySz&N)y(D$>UbMKkOYO{-%($_x9AP4X%)VneCPP8%}d) z!=h496j_AK#3T^N+2U5^?SzLA$T|L#P$T5C#!bsh2?Kw#gddCBwR|{Irc`y=vjK{@ zQlw||E>&y?g#G#ZhmC(u8)sP~q$fBt%woGfXSkqdgi!{NLT7}Sbfe|L=*oT~0Ezr1 z-buQNasllE-ukV3Txc??Qy3HlMutp2x>FPs8^(fcGP+Y7lo%$AOg^Sl5|kRIlx#8v zhanI^`A7m1Pn^~NX9sK7`XGSa(yR&c3pj+(cOpNCm~m1npTV!t2!4xSp%MN5e1%5x zd-w{C><29f%L|bKij;%0D3wL)T>;*WiY1*z=UoFnjjAS{^~JjZd>b`MI*Z=B1^fzi zQ96skyJHrb7g3k=>hM#7-Y4AKNU%kd8A>5=fXMHY5Ihk$h!8rF9|(TNo%3)Oj587a3 zgXP!1V{L$<$DjYX!caUVA~$LQ{*>8GlTR{nt%r1D#>llq8^EuX~f%chV8s zRkp%cIVIMqO-NOrq;nN>n(8Zm;Ll4tnC;;y>*;LD9Y>O1G7y8gpU_z1S`niOra)q0 z8isasesLqD+QO$A=|j>XsS+)Jclg+TOnk$}(wmI^Bn4|&R>AF<9$h!Eu?l8$hJxj@ zUi7(VR$4Qvz4)_m($_(NTSUt-#%&Ug1%T&8(LKr+%KdbR=hMwC;`uc&=!7(2h;wpQ z+8+w!r#__AG4fLo;$RTTkjSsYRSH}5&6G9qGag6}W<9Y4qe*sEdM``Klb>gQ3gKWzTK7G$x6<)NLJ=Dx# zX7^)mx4qPRa|R$2LX6s?P(P0@U>LOfVJqnC4oE5iro!&E>wfG-rNX8!yKrjzlsPEIm;W%Z@ucylHF5Y-yQjLz@xdX<8 z(4e&gqr}CKQwMFU$AgT{gbWtx4o1q&Ni=fo{-iJ;)bPs>_8F0!x3*{I)quV-_fp7DlBN`THKA9FUJFtua-rx$(-k@`P*@i8+ga zDE8cN(!m)mMg%k;q62}jtc(bv-;RUV$=@2wh2#1}U&=siiGsD2w_1}hS0O`YF_DWH zh!i(`TgE%(d<<3e1xO%@wyBHun;daST6=jEZ{aZS5WOa+L#oiS_r6876L1%qD;bP{ z=-Qr0OQ%hKD*#~)RLJsOxR2fQs$HD`5~9)JV)O+S=_Eq(WifM=zbE>4PTkDWBokCh z39xn)c*yxQiP_kZyK(X_xs2hR#F`>Xlw2|F{xi4Z2==c~gNdE5Lb=12` zXT18gRvS8?+CnTI=P_K&Yot7{&>OA%Xvh17(S+0jOFzg~q zF$kVhDqLEQ9?4C`EZt^x%}<>Uq&R0p#}nhqH?vge^dkm#Nx3ac>YN*{zEd5p49MFC zlsUBHO+HdP4CQ`B<4B@(c1HF<$P0ND-eaMlPIR2)q4*Mzi7QN;t$fDOyPJKXsJ8yI^$hsQE3L|U#J!jVl+X4xDk0&} z(qsQI)KojTk37O+EqC3F)hE=cLa4BFYReF7(%>^rQDXX>^Z?B~`$w_}VUWW^ftE!-7X$ zcJlqq6Z~3iLSDW_C(}AvW3)7ctZ9ns7fF<3EU04;YucvE+JXt9bYUzkqOW*{)Jlvj z)zPP~%QdQ&&nh&{{dBDbj?BK{>AJ0C`!Qw7TJik3sqcaDWKyVAxNJJ+RZ*PMv7-k zRKVJY5#94Z^=8V5sW#su2@92<^-|9Y8z&Q`JVFGP`eCz!aCKyr)f{v;EyLb@S?9zs z*2-ay<++Dd6q1iextVp6O;za=Pj}OFLR4vKh?md<{ZVV($?g~H23Lep{*(Hai5~NS zdb)*lmdI3Tu8s5gZUgc(iPo07&RstaQ^4uit&rnswsLP;fAkH{%(<ohPLEP#{Y6o*Py+M6*Xq;x2ba zNX2TH*#P!z+OuGg1d2wMvtpA##s)dru!|od`Q!+ih`yjLs`=!+>@|JQ*`KF?T^aSPSit_;9C)3LrrvGr&}k z3gvns&VG-Z%vWyI@((Jomw=Xa@4G3N`+Zo70%0IA1VIpwJCz0xJ!Lc$c#Jaf?0^q{ z#7$fLjOB0=T$OlUrll2*%?*c3@DWbiqC%?YHS=exlf%|Eg75Sm-Cqw0JrP9@i~?X` z{Ets2+Ed!*zKrOQo9=)pJ&)MsN;#3wTmsjkit$MK%ip(5*(B(SG>Mw-BM}VfWhSu6y=;$??wF zF^^T!gwu12RC^tt3fw+AT%b{8XFtuzg2A1Y4?nSgn^Y~vR!iXyYmzR-rL;FF(L%&@ zsj}Y?^Ev!JqH>VapX@gO1j|<#?D{QX>)c~G3yUl)1&&dxZZmJ4nK^+VA(|^|cg9&D zZ!sSQSf$%jsMa2C8$@C*k(Hp4Z^6QF%S%I#m72yim0Qk%6&eQ|qCu>h z&c)ca5r&oc5EO*Q;?pedRGmFHK-IRn){2ex(=GTR^g=GS9HH~Nl|or6J-mQbj>HfD z-I<^qO#g6srCBHxK-N05&VZ>USEMXDQe=!U1}zA^H1bCH|9*@UNQ?>OF3KQVQ2GalXc#+91G zILVu`Lq*?Ikm$|9t>yEz__$uv;c=UnD@Wk9^Hhh2m*H+GFnoe?VS5-B_1QZ1#SUlG zcI8B~N{2^?uD|k$^#=12UFCF~SFXOH9fvE`*X1e9zJB+h{Fz;R2EN;o9k+m#if&~% ztvQF)a|$o4#%aKWbbjf<0&nJfjlF;2TKfyl(-2S2)CxJn8sjj&S=n=CXMr6_Zrx5jmxJ_}**k4TOso=lKJUP`JsHF{5 z$rJqO7_RQ)$zw&K$T)MGSf-V~&ntiN_y5yFHJ|1GO~T6Nd#oPxmph>tG6?!4?ZI=4 ztQ3*G=p!_It`DeUg{DYnt`i}yOM<;i-4S}*?i(P{m?H1O!R|PF$v7_l6`g! zJhLV0L3>bSu4JsTrmmy-lFx+ut1VkU{Z8~8sc|z+DatB1vucrJb1qI}Y(xt%D0N z?1>Kf02CUWwXMx?nZj}SEo*cT;5F?cKt>Yw~+ejjLb6HSDm`Sm)nKyQ~PVJm@<)>*)4~u z^j(LJ5n_E*^WW>*tju10eL!{V4OqQ@G0*1#0)w~tfP3GjN=cd)F#hn>z-V@P{3XN8 z_}(~^GP%VZ9JNhym_Bb>IR{jCZ5Y;g?i@@gCvv*+Qz_o>S6h6}<-)JD2Py>MQPU_w z%rQ|YDgF*3Ulll%97d2g;;YOgx`s$vexT`h^ROTVtMB(-U}VSJkBTY^xf-G%eZouO zVQtZoYUngri&6}(bg`A}>OkGf7C}7w2z|}rU@^hD@T}IigtcOb!yj&a;*fjsAxZfb zNxv+RY*YsI&u;zLv+(h@17l_5NbFpK!UCMsL*Av1gcxg`z|>RfEi{}eBKU@IaF(dX zi8tEo*K-4LP#;Y5T;*6&8kc8r7vyNXZiQQ7CGp)BT)B`iH$s+2s+<*4ips4i6(6kS z#<2S4>ajCZV+$YdI~D>vZYO@9I@t)PtiDC>?B!lIoLe8y7Jfrqd~w1THQJSJYXLGS zxhz-pIWYY@ZOxfu`&k>3ptNP~`?iHdzg$mCUg|LkD~ z=}25CZq{EXWPQ!SG|t9ErBUmY1~CZ$XTUDb+cMID2WR-;Tu)i{-}ynZkrMKv(e7s; z{dj(UXY_3jkQ+(6$eGdvV@LpJz~M(|RYS$tocSu4+W@ItP4=DofUEG}JO5X0Iydu4 zrtq``oeNmHv){I)aE{XYsxcR{j|GY19q`8srS+KS2U9R;_yKmwnd?IflaW1*X|Nq~ zrv1NsCI4;&cw??P>RIy6)2R%tIyE5pq!iyNSM%a zf00CDEHLtaoJwH+$Eg}-=riWT#YrfH#AZKe#)fqx=xXr9+G!}t#0E3yFNrXVAME2| z$ceZgJ6%9Ixf;04p&hXQA{Bnn8>op-D<4f$6QLDBnEs0Ci;c*{%*-HWYG?02#KiRB zY+Gs|xBx3V8`r;2er1~4_A6r5o*O^B#ak40at>;q6GoJs9AY`udDa)3mff2?qP{Gb zXjcD;*)4n6I6oBRkP!4sxLSr`6V|mU_v&b*7K;kwQQ!pEkaE6{sNy(k{n_QcNU2^7dm`26c(K`TEDqGOKCFPs-?! zY?GDJq2xkK0sBIM^z^H)B9 zDu?e(c_E>aW1Yl8vN*gcl7}s@J;IrvU~xg~yhsogl#xVVU{DHwArYHG902+je4vaW z1l|6U*{C>1{(5|ITLCGXsWG_dQM9WnN>z}hrx3C7a2k@=I8Py-_L^ZyzOyOWpEo05 zt$RC9<&X4B8)Iy#s&s;hdsmH7@OypkR(GPBsS4i>_NJN0(-rE7wxq1aq40Caj^gl( zti62R6(g&PG|{Tu(0t_t5r93sW^~_iGjQ7CCz9L*CSoncM6=Y6QZ^78_;1Tlh~A<; z>L5v1g$o+x!&F+-g_AZx3O$|R8+LdX(ut1UU_BFDN+7Y5G@%+QpH$3Fz~4swQ-eX> zKI2o+jZ5K44$qb*boEd7fOa)03h|)Ft+*K}Aofhn8hDu-*5T@u!2mLpmCD+MVkE3z zZS%`;G9iUG(ZXSGGUqVDO$yoWzRR%I+<8~gkk08?!sSR>85o2Q@RwiEsEyFB=1neAcOC>(D-z>Lk*p(r1;T{%3T-ALJ&`cJ1q@$(JfVXaLZfP>F?jq{TR z5gJYY+vx&UxTJgFfgTXWUH4PiswNDkV7BKAEaJo_LsFPVoUzUPSO1ESe-|uMeTu#{ z=U%=iQSpK!bD0DJIxqF@%O33>4ei}idE%JX?H(EoI_Vyh0*S|=$AbAcqxY$y=6H>u zx)z^8e`8{%9@AQ8GvBYoQUV%gCkW}^X_ut1hxPl>Sqe_r3h)3cnPeO^Hx|e!(oT%> zhtf|x5>3Rfc22NyhWmR?Hf&mL=JM$*RFkt=)r2{Bfx?4`yZ!;gNKnBpz?9#^Euqz8Z&#MiE_DMS(~X zX5=&fiN*?j21mms4$eB_E7LA81tQeXN*ICcjW#T)YSmS(mPw^fM z6wa$i;u=G6gipCY;m}nfB9TSFq6E~3bc0LbRm5mxIX z3&SK>8Tk9mM>D~aqAPs-cXJtxYcMO+o{=USho^x1q zt%?E$ovpy?#q6)z^xfUc&vgkA%F@~;`Q>b>u!c(B7Jfqopb4HTBm5;snRC?>+=iJ- z%<(prQ^L#5(i97xX)FeGNF{w?)W$MQ1|ir=mNp3%v&{?`P5pD|< zoSb#zW#;GRv8P|W@cw~@pN#6O)zr%jX`vP>%NAswcT+xc{LYAICKuSHYn3NvY<=rG z-r59=V0F&VIS8h!?`%wNQunZ(?w4G1tX;iK?zz*~A{;)`r5iz{m;IT^9;;|HMSV$t zIYG4iPB8+*Ev?KQdOvP3D?F>xKTbLaTE`N7EF)JSHqOA^5GJGaIQpvkkhxmwb^LB9 zEXj_p#E`lFQOBx`YAGJ&Ab>cy3`XDFXEBASo+9YKs1p+9e?LAS=r7Y0l>G}(@4ld+9(9dF z&lr(h>oLbW???5mReL4@6kP%O_n`X2bOodT0@V92Xw1L?eUhD4xuxz#mp~9oU7IBIZ;(Hre^{mFMn^zJ zVayzq+@5;aCZq$S6RabtGo(YUQ>3F;!O6_^-;15i?&e?@5ba9}C5{+@hsVYFw`D3i zmvq3BLzpuSF`shzn{}YnQ%IET`0k~SLbj*O)ByTl5a%H?G!VC{In);aH{fw`+1c&x z4lYI4keY~(N2K9%@z^=-p8RdV6sM2S!fWERv)$bu?28U1{o8=w#BJxedjt&5MVFAO zikC-deOQ=z{(GtB{GSRGpX+4oKjHS-jt?(G_HKCh8?xo^B^~T@7TcIM(uQFOUoFPL z{|5m6vkn!vox|>*!Kr9Ii=mzb-v9pq{MV0|p1UjHMFgU~&8JQ&Hu&8~Q6jls{U5;A zF!FV?ijeotcfjjn5vhF>>c@pI!$TM5%jP96ub1zD^~D1ML5E(@Mv*nxp06kFiR5I2 z^<$;xz?yQcr8m%%f+}QSp*{dGB?3f>ivXcj>aigQ$;)TD-+j@p{@I zFmQjrm-|}M7kYcRG*mN2D1FK+{l;R5!1tQmchS+Im8oS-PuTIJ1Bl!`$DigKdqo`% zi-{&7u`Y$!FydTjzZY&Ry_~9VtQX-?4Xjs=e7;ptm3hsmt_uz*TL2ceJX{;>!@UIR z-bU-U9%B1aYmTpPb)8{T=6?x#+EC!tUC7{L#U|h zV^g^PU8m9FWk0d_WBdIfx5l!IAkmAl~=vBc{R<;tD)WF zV&G6UyBWD029?Zz`5@ z7o+m$<<%}J32&ZY>1VGt0&M03u?MWvTMpIl7YYaH2MX&upADBiP~F%-e) zcZ;m`2SV^16SQflpo}dSG)!km8<%opR|V~t#3eSXG9T)QsmRwclrw*+Sw`0-V1~jK z7YKuxf|06Va=VPxjrimpsWhUEaNz-SUiH*p4eEQYG=_QG$%1 z?1X-1!iP+py;sbVQ&L*S>BBz!Lcc2XY=+$^^j{45e2rmY-2Olcu4RY5$Z+t+={P?g zMXXJ(^BwAp7M80Z>RLRJNpA2Riv`2)%_=(I8m+B{8Yyg~9?$-{hFL>U&ry_V@H)Da zS^GR}X$CMqg}7e0c1e|_LV%5%ti6Ra^K*!RZ@0i-f3hQgK&6>G6q|J_Z7Aw*&U$Uo zQ(+9*PU~64^|SK!6dOV(NNt_LdJ) zq0Y-kUiJe$@ro}#`KFiJ-wOj5p9M~^EEJkpWC;Y8HFw}_U@z<%TZ1!PsP8Qrbi2oO zNik;QLj@p9$vBUfq)o@Ib%oAB9LTf=J5MSsc$@8r#mH^JnbUFIh!l8qG9}~^q?oj zDAv$rz^LP)$$v%_+|`R@CV$?Qe?t5*6r%>Fln&-|gCna8-mPmRKXq_#qbQb;WoS4n z7*m{@5-S>N^$jYu4sC7TZ}(F`=VHnV&pl9xlIv^XGut5k-i##btWX4|vGg4ROSk%r zZpyOo=|S4LBOxmF;z)1pphSaCme$eT`C65jTyg5l4rkz*kcC_aT!iT+CRySbhv*Ig zMG;c%7f>ao^fbpnN1PynxY4#VH3w$j#@XRjTI{KHnBls|Ph0t0P{Li)Dsd`bOI`qx z+~3MZrTeXAS888&=MJH6EIZlg?=#|?;07pGo7IPYk-EBh+v#$}nNBp79m=m~<6DZ$ z>HX3UhdDqR?8B@O=xDQ&zP%=WEvM|>UK*NfPUrKwz8bS0*l4qYc{`2`EqVB}wEt48 z?N;0F=InY06m0 z?H=EQ--C%06#`~YtE3a0-1E@tcu1+^2-jo#0|(*^-}t}0RHxTI7Ep)& zRy{|T%Jikbsq}J17glc#P=3!9X!)vgb@=;sDG*RA`ThQ4T1P=xXz+@&+uxlX_61%$E--j;3OxSu`@QLbbi**HL`VwPyr@-1c>lz3W9?2? z^1!g=D^n&X$0&3vR8ypWP>i_Zh$&hp90pdgiI8Mf|RU+g-cjP}2 z{D@ofZDZNX8=1lr5kEdc!C*Fk+Q0LU#SUhidEgRv&k`UBI6NXrppPH|!TKMPd)DPC z;&oyLiME)?8*!cdw%#VfP{l}A7#XRDRpTk`_O)rMjRJ)xsPMC+U1Wks#5`P)9I)V8 zgMmnaw_5=4x?CF>yA>OHd7bEZdH;=@`x=QoGrP%73572};6>%Qah)-Gq(E{BUR#qm5r=rRFIvKgwx*qt*>%>60{=bS-Q;QiESu4X6q{OxMHZ(m>d zmE(K%3NPO5v&17ysfi*IYPN>!NFuV&W&R+dcI{Zg7YZ*hP1G|UP0%uq@Ma`k0rexD zj6VXawi7gyY41*b;=>{yXR$mJ4mQ?nRkFq$FgqTvm>v;*go)YHP#B4kCD7PH`W#GL zEbQz|hI))F%p4qgT*i9(`keY)Y{tgSdaMS<{Jj6S8i_|G&_p1NiEyRR6aXXFe|)`S zTXmLKw)Pshd|rhtq+e0?!t-hS;m&Uc??KjAuVkI2uBhd7Y=e&WFD z%$2Z>`a5?CfDnhi)zAt*W}M)}E5k$Fp$djosp8sc@VS>Hb~yO+@(!|L?Wv<56(Laz5}y5OE~YPSa7UxM)W zia%hLT*C18nLOZ`UqH0?YIyiNszp{@BCv020v>_qmtbDKa{ZSZ5Ka{WH48_4?Yg91 zebyg3NdC$6Yp8_#sh!6^mmW7R{BFF2d>N4h6XKBvxdYe#lliUp!@NWDPjj00U$r|z z|54i@)$`w)AN(f=WdB8l~8#KL*UL;Yhj2{UW*OJr$>xIc! zwugn}N7~dIl0)OsYQp6_4oM^f*jDyK;pv$q`~i#U#JmQk=kw(}LP}46N7K1V?%rwr~)3Q9TSKE(kat@vf zPbtYbo@9|4MucsU2D8VGEy+C3NlCt9h(6@9lXlrjaY+{3-?Vvd5%V?1BCY9NFLsIy zt!Q9V4KHwq2_=>hn{rbG*wG@iT3`vjl_^M|?r$m^t}mG8p5q*$v1Il)OtB@<{25zB zHWPk*0+A|1nk<DpWG)^~a5HyTb=s)iD&u!()s>GHumS@Piw*?p? z+-i*WcxahuDZHM<9IGpqK{R$XiWx4>hu1zO%4t}}%93eRBhLj|bd{<3t=RCKF_ss} zo#HrE2guI0RANa3VYIpP^fjqQwflUHn9^17_gh}Px?0j_ixUL9HOnzQE`yC%*A~Yp z8g=o22Zbnui;YQpzXIcY)=NW0#&re&gl&)LH_zazeIS$_9y-=eJkR z)K!WposF)R{@c*^+Oqqfe3n`rZ~3xku|F#au@=sKEZ(ACN^M`yX;OJfrfglpbjOrB%N3!J&HxJ9z!&l2=T#a)Dj!n(~8k`T<9Uo&-^!-nF@=*tzJJKsxr59j1 z8BFhh>#XNvd3$k+6xQ3XI?ni zr-J^JT>5oXN;>z$bHDLbQr;r zu-SttE^#Iv2H3GhP%U_8oE8lkC0UNJ@br1HMeErTR9+Q7#-K}rPIXz&PXv|>$7c)X zw7j}Y3v=#Vv8Y|p4g9b0bNpBn~1vjwHt5lQo-=EPRAh5goN+OM=xyU#kmy5@otxopTSiL~>mo+E1< zbyJXG%G<8Zo+-LM;Nk_$P}E31VOP{FQ`k#9;aaEuOdTZ;W?j#aJ=o=qp*nI%i^NU} zhO;3y-Xa<8$I}XvwxOnHSx@@0Xg##2390bcs6tiUG6S?i%^3-=!<@fEwGgzu2j}ZV z{_7pVvo&y6qxrG)?}%d6XW5AFyh*|nHpD7zq3>>#xIbA&e(9y<Ejwth_VKt7o^OG91VvsjspPsn|9*ha%ze7U z@d&P{oOf|PShB9zS#czv-@*MZxBlz=;!FDg(gVsI7|_qK81&YXQF3^8G3N3fg;V$% zEQrY+-f-le+OiZAJWBvC#1Np%$le3&_q#W&d(}f^%H|{XCGIvZdf-m|^otlRdd?@_d{vlt{rroVudgzexoh=r7Ap=%AXvd*OgOnV$cX*K zSO%?xsY|zi&KP6e3NPQtruS`k?F$39Z16rZApGqb{Y;#n2ew>fddUEpewhAe`^eY+ zV2>T%Bgqdhknfm6pJiZ1n2{gQgEaeLyk#+~Gb&mpfX`yXZ@dkv6{MaN9?A%Xxr3?| zGQxzPKjpE~;~;G^@MtF_~d?LgQ0rFa zqkd)~S(C#;W_}tO?ft_$UicY*BmSG^PTsKSx}W8@tp8vsYrUQShf>(>|369*4Z;ui z6FNr@A0c;a7Qg}n&;#93`9uYTssXxf{S;8~47+!B!p|e&99Cg=>bgg~CU##<54?H* z4?R`xBwkC;DktUpul4n&Y;L@P(eF0lQKjV`lDJ}Jv`^T##II%pn}aKKUKvgiQjWRH{++@3-kdn2 z-rCtTV^+y%%&J~B01@BF^Qp0@z&L%Jnys%P7^2%Trlx-&-TUv3&mqkDah(ZsShd0xdU{kl7*K%FXG2)Nta0^aD#K zHbqH-4>kHR{jM7LI)$gkHSK3}^(5_}`atT7x<(t|DAnt;7UWQv_yfJsZUQQKBx|Bv zentUdH*+A}C(r@X;kMHR8szaRm>N8D9Ey#}cy3yQ;?_BC;p9KGkMMk=*Q;D@j&Bns z*Q^8s)>s7bG&Ibugx=~hmEWIdrh_4&(AbfHq`~h{?Y=EjFq-# zxS)eyoTCl!xI$A&s9cz`j!A%N#7w+yYd5CO$kJ3R+m<~cgfx74@OUvg z_S_+wb@-8>cNF-$j@A53mbPekl-aZ;$;{T-f;|a$jvjhLuL|`Inht zy`I2xe(XQBMRVos^ELiFDN!Fo+H-ly?i}ik>Ue@P%_<@dE;zzW2k<;DLU6?vuCj}4 z#@BOry*4#*%_faKrwdO8-w3hFO>5B0Grxz|A74&glUAu|cBSUN~zZXIEmIYeT<9 z;l;nG%l86 z#u`k+q3jZ6$*?eer1=i#0O({bU8DX!hdDYi%sx=3Ov1cujN?m}!|K zMIrTloYEI!eK1wRk<_N;v<|A;dnT_h>5)osa&0y@LQ+FfT)|^G@&Hc1nBeAOCrs?o zpTQuM19P*=Nhx^8!5bZ-Za9t5D}Aw*$}?*;muXY2SKsM}{bcO5!MKVzq}^Znj1~dN zN4jaCkey$tUl@sW$FdV?uq06DeFDdxT2-QK>l3jo2gV`90x5V$PdH4W=9QDH6<-ca zkIbYP!k~2lYN(|m2syO0LrDK|_@-qhe!khhYJMSWSROiNf#yz2f>(it`~BqIbWpx9 zsR2Fxy-&aZxqKL=9r-Ou1jic8d(uNUMbf>$0`>@ToFt=P5?F1NlA7AP>;MXE&wEPK z4e}^VY-xsZKRnOITez1m1)6|550XaID(Ym~vUR5jPCFCp)WQDpFGLa7_=m5dd!^V& zjc>^y1*p(c(_4#kSk zt8=kcr-~jmE$*cSQ{ksLVonik2EfE_bL>%|&z9N>n;M@*jW-kB2F6lGD1KTLoCPFA zxLDQ0i@2)o6a8S))I3=O!@f+@NFSo=m-c@+5A^9v!qb9ntJaFeXJ8Ru=br?Z?zWvc z2AmK~)?7w@mV0m01@4qt$d#-@I;dc0hfp=1IPBKs6lTjzLTy#9bN2waGVDbOM{CbP z{M7r=eM~8n1l_A_lklAblQ!42RTBuXK?aLRpSNO0DgKVBf0UqO9*L{XB+d^& z5o-|4DRSgr9507^bZSN>Iv3&IunFKsSL}6WQRH11rmEsB8Ir&qe^N4E=2D5XEFw0b zRuCH!Ab)l;hEx5W(BepLDiWAj#1K9aFZEz5&io|*JZMe5;Tp>z=|e!cBKz@JIb`%S z&LJ+#EzBgSZa*KxL~iVX8tnp!ybo8eAc)RPP0s2cX1IrP?Pr!~)?j*M&%i%H{Jvu#o!(s^Yl9sb5pPQ#uySJL><}&p0E?$-VBFeJyvP&8f6#mo| z2+evQl1>qSvk_aOvBLd_9`xuhnXU@2f5D4OHyyMgPp=BKW%GNDx4ZjjN>bR?0+;f) z`{qz3kIQ-=b?FTcQsXx6@E3dX%x;ZO$in9aP@67bsDs2FHCS|r6=aF`ul(+yRy(DL zo7e6}0eK-Zphc=}%X2$^?HPR7%Y9$+?x6XrE-V8vD597XbIXwDr?A2JM~4<#ryZpn zr7OdnW-H&?#b2=5NKofv*s&g?jj30TC+E%4YUgj`D=PL@|8i@4tz>TXOqgI+%45%k z^3;Q%>wAZ9YofzO4d=hVTZVb^ndLk@CisPq3()L&NP(GSc7|7UI)bO5hIa;S#}b{D z^KeuzPr}}Frw@57dtFDO3hE@BU;*Wvu8&zL@z!gFHg&wVq+thx#Lf|O22$V%+;O#hemcWv= zOZ@HvX)W$+8w5}KCp>)m^zuhjXKXj{8 zOzEy?y~eGs`C*Z0UvEL-s3)`TOHjIPtuH~r3Y_GCQbPTKEG$AYWm-%rl@cy|c;c#3 zqCZxNKxCbE=)6*xCX1DE?2&WmK8jGR@P#?D6a+l!Yt-M-f{+^07y06USf@QHKS?wE zKauzy>wdF@%QVa*J*s){zewD^yII!Q_u#c2ZPz>QSjB5B>irBu8RNRKGHa+&|#E&#OH>^1p>JVhQHOQjC-hn+$!Kn6;$B zV~PHjR`rFqzS8(DS3G&6xLl;a{260-C=6xXBsdtcj9 z<|gmiW>t}0?PW#Bo282IHtVf|a|YdpVKuuNPxgI$A3{h+g(OWNgJB*cFr_ej=*B{|AoTUylN|c9m|89u$4yt0>93H7x$ZFEFEn zG%O!IxefSsKb|_GlZQ5NN}fPv*!3X?CFS~*>V!=phi{eOr{G;ag+c)YA!x@_hjS25R=iA#np zYjk!sKRCgiCZ@FNj5E@0|9lv6OfB2)pV1iE8odq^OuTsny${~yS8i!ywV7o!9*~f3 q5XzK(v-P$|)Ge$Bp|m9>jvHb;JoidWWtWkjk%5G|x((7+;=cg5I2oz{ delta 172545 zcmYhhV{o8dur(Sxnb@{%Pi)(^?Pp@!6Wg|J+ty6XiIeX==iVRZXYW?ck;eV`Szz>f9$kX z_=3)mw-LZVNx1DfeEXc-yZpu2_h!|Lt6V!k_1X6#)bFMkd@3F!`;1N?{h;E%^v(Nb zLHf(eFSO6{FWSh1kHO60m3YO)h6jM z3$In@OJ{1*Z}u6$mx93M_fg7hveW}U)9Ymx%g6hc5HCfdp9ZNj+lkwcuNIY>ICMrb zLQ!5rlGe|Qwk|)~vprtQo~4~{+C2KBm-jUVoT29A*Jq#$@aVhT=VY$64;MAr?P4`s zlQp3EWtm&C54(0TJ$1v+Gz)q5%d217wLVedz>|bgOvMZ!R93Nki^*IpEhJa%RI)Nf z(jZmdlkPRMtaf;K0pU^4|$;DDZjV6sOXwOK>79CE91m|bMTocU@*8X{iYm`>% zz7o+aSdNaDHr1GD)rm5!yxM79gpy zt^ZfWH^pH->Ghql?o+lHXXzhm2Rt5CrgLS#go-oJzA6(^op9ooZ=IMG?_S7gmL&RUXKr=?QA=(sQfoE#gN71#33rgU4vF8F6;S4n zuA~C4$>iuxA?U-NNUFc6>m%bqm1S>-sFQ+dz-7 zyGS4A0#`;9RS@=wBHG5)j`r&`A4TvT%|axLC{qaJj%JeQ6>Ospd)^55_)=FaukZ~? zvuio*N0^!!_b?t!=;j(!p@o7sg|J+YvYZs}5j;dQYx?sYRrn&|sTsmab zW66tu!(V3{miAlI29#OZ4+SMcNt?t^Y=}ALjWFhE!HrbdL;1^;c}7xkk_*I;7GwY{ z6w{~RdZYL{53YLC+pxTbNupWKA;|r{y`A)uOHlZu8+)0CVD@6>JWzsN`@Iso>=+RT zpZtCAfv2MfEI2eW*7x3_N1zexXi>D}~=Vhi86)b`)#2^MnomI*yWlLUa)vV3#$ zZuvS+1Ye=8sZ8q+tG^;gUHbS6s(-@Y)D1PlI1JaG0J6bp;AZ9tAv?)Zt2OJLqM2aKs(&-usr zy5W>erLUOJkjINiy3BNIQvzOYwYfC#{P3v+i<0PFJgkDu2tUd61Q`=wU;Flb@bbyM z!qh-w3+UtQ7~3PhVUx%QhEBpA1ca^iK-3M<#)V>G{kw_RMrQXD!BT$ZW_d7pf3+`` zWR7_B%6p|K5|M51lxZi-#wzMNG413v;M|Qc|tgC9RbOzL`iOW5fi~5yX zTz^aFddw=QafoffSJ8Tr^WLuZ$XlvQmOnMyIVZ|K?WgRx{l>ywiK{kZ>ts`T`E1ep zk19qYz1rHr)5s^{v2)Was(7=H$vzn{BE2wbLU$zt)KGd%VeX@!y?7qDtVE-6Bfd?r zW>L4+sK`Mf@7xU9wt(7tC=5e0?=fAfWOImiUFELFugJIuh$T;ORnb!z%Db@T#>Y64 z3l%PWk+{_q^m=hct#Gya3#xMthkGI>EX#tZk+As_&r5bc>~d*bR##n9BM zx$U1KJsX4ez#E;~)JCHbVrJ$|1g|VQP8+GGSop~E=FX(YSEgs-hpOvBw<^S0PN;#C z^Cy}8Rw1#62SIPp_#rLroiV0y8oP;jcr9cXRElFbA|dIWqy*ssu9aB5sv?-E`=oX; zpLQdab%(Hn4PbHmJ@jH4NM`(f^}3pBFZb zf}p@j_EN#Wp=cl{zk$lq07Bi7faBqZwY`<-0?VRMq&{+5NkycGprA z9dadiQed)>jeVJ?`LS}@toLULT1UZa^wZ^3=ttO(e4vtK-h8t%rYD}RE)%jXw5l_9 z+K_MsfBrX}^o7)u3)b2Vs(nd)CC)9);x42xqBPS|fr%nw0n++nek~;jtZFK~r*>6h z6CtKR4(NIvrn&V-S8Suedmshxhs+XnGy@CT5f%zcbK8!O?@jdnyqH$4MO^+eYrqn; zb7_uzB9Jz38ME4cvU)(a75aC-#qEF_-+W;mPiFf^WFz~HV9Cu{Tx0Wer(AetQZuAQ zOmWyidsHJnb)sH{&)Z164HmiXlKqJ2s_!I6MPU{hLwNvkZ{j5f^@_}#TH^ele;T&XeUonYfdzA!(1$mFdKyc*wIPA( zs~wak0>0f(yUnu>`l^z@jK|OE3@gFbPys==`n^R936HDqvtS9J3f8K^^pdA zJ?p}t8sb!H)M?}7jV^`>vjqYAjbzlv7V%v-X6k_ncoRCBU9xM!{4b)}d2O!fFVvE^#rn@_E}J&~=tQN7L`BAqK;yPG3WR6~hG70crV1w3zMLM+1nC0u zT-Vz=#||D%7dV+cb@cW1N0N|e?h{nFc+M9t*N?0&kVmro|1^u9vz&7m6Et0rxU8f4 z1=!&y1~l_tki4jDJtTMo?CRNek{4l3YYP@b-gxQP9=DaYv7*l9hvXxvo5TK2m52OS z?Z*kh>DXOIU+w5$su2xN0{ZP@L(g}qoR@zv(%0Yre9(Sfe4H!h9Cu)~fA$BGR)5^CNwf={MI{6_NHSl;e2acxPHx!8*d z{N5Ug-2ovlRb8krH4&nxq;1t6L8sDdiqh}ZP|cEEx031Q?A;CNSc22d8!M#7DT}Lr28))5&`HMegnwe))P~WulW%b!!Q|1deLvIR% z?JFBXFJ=Y+DhTSW>|h2xN8B;+O^A{cfda*u|DgAbddrQv(qM))pSZDn>r6(buW8CW zsJ+ISg(KCPN!tcVOpFnf`jj5<^_G>5E+sDnc4bj-qaW*=&D8x|x$u}(F7)~S_U}9& zt7$Ws*9~1l9M=udc}a?Wv1D)pcD{GHN}R$GJ@CM^)KhL~bF)SYR%xw=V97!dB7nPI z&&!pEtWnJv_XC;M{edPnZAlqs2ZFpO&uE4jWb#aMiUlH8Y$}$?zOX__NT-%)UKVBT zhgE6BGl7q^7-k;P8aQ_k)jX~kUtBb{FILh4`#(krk$D`ug&;mSE`~a<_yfYt3LrrQ zL;+}Z`jHdOunk^sN#yFWeyJY=fgWWk3Xp)*c$^gH``K85+IgEQ?i2bWwOZ}PdLG6s zMv^=d*!e#RjtW4%#r8y`d9>a_tD6fs|IQr5yar|KTF=X-^5S$8qhulPKI(oVxCV8d z!Yret#`49i(eANaV9i@}GSATehgQq=ybrK^Xg~E1Ju#=($A`~JJiNTl84CJ7{}V7| z{%N%Pu`^}KylLlmKQToFJk0FvePreZd#f{eO|AhQ$%rLd>?01XH0$kLhqr#@KYPBzqLZfCMEa#=Y|mNUBM0X{6sO6xpb|qkrB$LKk6Z$+ z9MZq9M{Ld%wHoyVG2V(JW*q{B04uhhS{Ms9c4tE2aIx2dE$EneeZDMG#M=tW1S^~f zvcXc*js<;Hk;BMpAQ?m`+kc7OQax*3j>&uDioV77GYLd{+C0=5Rxg>95a7RLeH&p; z#4%E-k$V%WEE!S^R;Me{7KyJ0Zcy4oNA$aDn(drG;QVec$X|uA{f#{8T;QSkO7Y(U zu_?Wi z6NcW=n0%?sxP)l`%!pzv04`!cRUv-pgA}!@6#oSsj^Jd0hKWotfw@CIPh&xy*8dTv ziHKcbxq~ZMV%4vt&<62AE9YST!R})WQOwE0)Pipf7Qn+jWg75@+ZPTgmti825=09U z+4#~|2As-KYE~*1W*;ggp@X{wWe7jbG*q&FurU&Cv;ba4fP}zF4UiNuLhpuV2?_xf zD0PO~z{A~jmAi#OmXOj9bHy4V3(ytTh=U~r9as!RIWxg-RpAaK%PrKS*US>j&8_XMXV~BPq`%u`=EMGamY^ z``400%Z6_ZYVOy57*K9jB#QpeB6-gM;lRbN9ulHWA*R3OXaAucAOE2>59c}|jK!}* z(G_lX1(-p`q)AK(#Erx3oT2(i8X~bzPRC>~N1nJ2@z_cbICMC#4s%MWtdn(P_~bz_ zIgN*M2R5c=oPq917nPFZdq=&$bk=YF$%RCM$}mbbOEUANbU?OWH&IBT0e({*E{sl0 z73W+b&KCqWF zG4{!ng+VdCj1haK34AKEP+0T0C~JBDH%oqQkYfZWZ zq~W#dCgz?oZ=iUHB?}DR08MIw;Bs;ugTUA`z)j1JLU zXco)?Tn573eEh^6$uH$F&Xx?43q0(=FuDre7p&s;8sJQ;Yn9Z~Rv7jYpB>-z*e#q| z{`dHf!Y_!#yiJeij;&vc$%zv&6^%&y8m9+2Tw1d(j>*Nfk=r#ORL2^~5RLQU>}?bj z#J`6TATm`nG=!^THSf0tXuuc5NYmx=yx;cxmmFNw&70_=@Z3u0x--WlYMyY6K3r2x0KMQg; zQ0D9_J-RI-P#=&m>Z-E`hnpdilrveUb0lUxKnadJTB&ZdTH(gHirhpkkK^f3jH7C)Bzih5TJE#dS{|$u6TkrqEe&B8OV1Rx}pvc!S(!-Li zH$aT;UujA`*n9%nYCVv^Q40?xuWkyi;vyd!e;QvBiB4^)3!#hF<-|!qAX@{s+cLw5 z)-2m|d9b*(Ko!Fo*lnF<#T;#HDi0o&h$07Vmj^*gL+@e)mv=Hgw$UdXkQ64@rkv5u z3I#?+z5e2CvVoZxKlCg=t0&^w1>_t_iUqgcr9hjDH8HmtOa%v&Z88e)g>)oAVu6#* za-igNB&AIDfdo`dr_75Rh+}$dTgb3}6ZP~~H?Fp@%c>0UQ@ZjcR)j|?wm6pv%2<0iDX zul&14AZsK2$q(WBSK=|~3uh+Ux61;%Bf~$aOxce?y@)5wDwZshM27xMe7vjYwhq9o zoi_2lnJq7}rxQs>nYORdD=@3h>D0^8EElG_v!24r!(eRw+cns0jxZOOeM@)cZR1LK z)p0^|1q*+~f3(tkCYlDa#dija)2?;zGW$RxTO4c%t0+8iHZ%o07fzoj?`zJtWx;QX z)s(ZREr7DY4$<>oEUC5F#iUvojt-z&X|8{sLm~akQ=|I0US;Dg7AoSsX|}~&p>Y>1 z;njTl9YbHKYJzlK%nK>3eS5Olt`N!7o_wL!=xz45=|AIQS)n$$HLmJsQ~CcIm8$7{ z@>t0^dx;b({W4y5XHVmXu;{+=2!C3oK;hReekKOuK0%Jw^RSr)YKZ|3Cq6x=gu%9G zon^M8LFMf_H8nFsRBQ&?RK6`_R4hjlrK%lAV8e|gdXwF)$M+;teiH7xur2hBswR_H z18)HBR3EGMlK!F5|;=6eD~13gzlq?4*9*Vo1T zJr)G6wzwxWES{b!xs8Cq-!=OGAK6*UV2i&`G00QO5GY;y_jPwA?wfre~^q_Zvsm-fud0buxO~Y@EA^K$SN7l^SYXeRNtGUs2r5dYX{Y zNp>=U3fnL`X+6&QcgSL#bdFjPQ`bc?nSE0A5Uefv-VZpbXQbdKG8sO(%fS$w-UDUT zJ7a;m)SbK)!+dGkeVCQ9T=A8W>)N>x&~}gKW~$j$HQBtXeol$vt}`^eenqBOw61H( z|$!x48=cbc}#r4@dg(wjOQ zJW8qQ&W7$L2g&JU!mu3M8rB#+xz3!GoI}}kNdxz?;o_~HPPBSseK`&1vf=D4?d^%{ zyI9tyC_awU?dy>o#^4eRPn%TB7%DWUraAsmRnya}cj}vE-n=x=)q^_irySg52O;3? zO(Axo%h$iG-_YT=q=${%?#=}ti7F9W{N-{+Pgin|+_)><)qmwC)Hq`%xKZJpJi)gy zA^tpbKdzAa7EHp&L3u4m&Zo{0d%4^`cbs!6M!s@it`J+%#kVr?8Pb6mfVon^;_j)E zb3RcaR;k+ZgLEA`0fZnEeosD5DlRj;!cb4Nh zbI8kay7eC`TcWoG1Y$3iGaP+ScvH9V-!W~a|JPy8#pBg3d;EV0;K0|Ra3V3}*7hHl zV`WdT_0D3KyHfu8MWFcULimRE^%PR}j^J%~+j_S6**W7!vNL8Ty_S20?$ptlI^+`3 zl;QWj<6srN2xfKNOX9Mc{hb?EsBN#xG%Fi5cc9vs=#;5Slk_;(Qyf=F@|D;VivBOH zZe2{~W#LysI>}%Uy8*8lCf1v!S#(~G9T=z6_R8af4y z^{m;$tBJkgG(KAToyCHDIoIdJkHN~ZRwy`3jtE2)5QMWGw4a~sO6bvhUjL=(?Xf@1 z&F#EMmKU(@==xqXS}e`QZSsiM7of9<{W_@4{RWfP>i|tRZU#k5PeKRf20G%7Igw{R zG2Q|TyovgS13|ZbHHA{K;WsZQp*hwk0(&E>^zLo7IU60g;6DXWr4!W^M=Hk(e>)=D zQhzjz-i}&HR@=VSIURU%e|2zw-!FfBWZ7U-#PP23$IgJOiYYBID`cF`EWOrA(khf` zuyV)$j{4a;`EABf~vn;QC-P7n_ zySncoPq`D|!v#DnSKFEY5v_D%oWuWMy2FkRx6!ZWgfm2(rF|4|3oQdUd}_DIH6L3l%Uq+8WWb2v<%I16+CYy7J3er&1@Fmz@@T zbjmKYkGZ3sYluo0W;q!i_09N16~nz2iPOe;g*g>nr5ia_g7&1T=gyN;76Hpgcb!o` zSVPbLIsU1RX+}v30E0qJil3IkO>niimzZi~|7m{ggghbJ&mU!<@cf-uKko$nVurl< zC`ZW$fpwcPw(};LJxq78y%{A&36ga_OsbZ3Uf#QHu?y8u{W~D$?nbI1h^3%?DG`K*KuxOBA`nRb$o8P1fjwFt$8WS~Fv?(R1L>$v6GaMbG(8YQ-nV}McOW557 zVbf!WeWk7<&r@#W#p8}33R+o99a|S~TOTGR{heVjiA^L2bf{V;glzexS>)J$?4X*d z)pt840J*OWu8->sDeRAD`gKg<{j4`T=Rt1u`si2d!hr_r{Inb?(dw9RFv5+V5h)j* zuYx`EA_`Yd92}C)MbkgZNw?aod=+hQO1Ao+?q@PRXngRsW6#vUWo2*qvLVn@SOj)j znuhjerLMe&+!ISVz`Zazd;GXM-%P;dg$>CBoLzYxBw6WO4XXA_G*gxO!=T>472SY3 z<**>|3r3GpYgB@2RL|R|C*u^>WIUazc4XJxZxcv~M)3r(!=`&tBILw-jGCdmu#cs@ zj`qzrle!JBYgVbzB`?CQyZ8lny2U#hz-mdsLTcgt-shc8{h^05XjcHEue0<3BYTks z>_ryKo!$xys1lIgsXduY1Vpb#@P=O+@@)e?~k* zv^6TH^34BGItmsuG#d8kALliprd!gX(=Sw)=s{L6KYMP*H7TIb^&AeXVdEo)H_6P1 zJ!PAX;L8sdYk}sSAVF0_Nhjkdr=x)fe9Ut{<)aw1OlVYuY9y!AP$?)Jz8%zeCzo2m z5&qWgM>}%K2R+O$io-?d&VeW=BI-myzDKFLWYQovsnHA3Ez-=`PV@x*66yoXEYk4- z#iZ15Ffuu5y6e*}y(a00ku7fEl2iHJo@S>a5hDL*;JnAoXSAL@z?2(-xp zMmorrXTqPn=?{>Oi9s=r?F>y&Wl+iBbo~v$$FaxHXeMGDh<~HR3Ou)qZlrYaAQ`#% zaI5L@mXxNRv(S6{xa7qiC6PfSQ?)gr_+M|hLdPY{gT;;7U%EF4L)FSFEY#B2Mw|QK z?C*pnvy0gZ;H`~?EFonO8{-E7ksKj(Efc#DSgl-{&$ID|nk;f>a$-(Sb$59qR_$o8>5E zSg)SlF7EFt z#&Qd4G=&N-;*Ej~lL#yjSt)G2jYMHTajX^3LCpAhvc)%M^Cz+rrR5M)`NC7_&|w>K zE=x?OrU0Rt;i3-5iX_`vvXz;PNMFwZlh9&en;yDmR{Ur#PoFij#wWzHsRf3TymHHG zv-v3<#d7*i%`{Xc)-|eO?}2aBr#H4<^NqcPU@M#bKMvta=*I!lLzqZyeAZgdvhCxS znHO+RN-=lrY;{a}`C@x5?hx?V;|8sQ?kzpLokLxtO0a1=w z!$NRhB`)2N-iH~#bL>1GGgWqKk74qRN$B$jGFa#B|9)NC{0KlnmjM=bw*NbNY0>Sf zeP~Cyen1ZhJUYoCH7bWmKumB*T!N(WOKhFM)IE6;b+H&H5#MP17UE_mzeo_Zx&E;5 zdwU>PB>kF5)}*=_^oA>YC%PNhJ34!wd8*qhGYn{-*w8pCdxclNsFE`m8icd;^LqF`qsL3${O7}vdk>$ zIPPE+=si5*lUEEOpFzAcJ?ar@wBYpq!TncxRc|q;xBr&^3TjCsr*x!h#&=Fv`DKOU z!lu{UYYd~dD(G3S)(dfl@ayw4K6xS0-$3$|6ga!2A1ZOGxl}Vqf9V){qI}ry^S_yl ztOassdFB2+?vYXfn0N0)R7cwz3b=jWXODABj&mi9$;+{kHiN~4T%JhAK{I%Dp&j}U zU0GduCn>dmwUJLr3cW=7zh7i=ac&4=;Eo8Ij_GQ4%E4wl9;2xVN+;qQWdY(xIQxKA{pmnGs z^42Z(_QlcB-7egMZE?n;cQ9)2JM%Te*pHuL=&UscO^@5#b54l=J);Mllm@QKlWD(riUJQt>*A<b4KNW7d5pV1c{EQDP9uH{-6I$_Jyc!p*vpJ%~|o=+>7?hZL~1(sy;+iX`FqI2xu z4c&}<&WA>gGcL#gP9BhAI=!Hjk5nsbt&iWGa)fOMmCqIpnQ}wk;gryC!4hl)@rl9( zyhYmQ@KZisA%82-&vMGW08ChxcMwhE(?huT`lcOdn=iD|)&vM%G1H=dYTdTHQCQ%-5M0KMVbJ?3-6Wi1D4 zAg_rF1{JNTkX+rsja9I8w~Yv-I96KgfDB@hEV@Qe4^`(HH|Pz5OfvPUDcIT<-(rs^ z+>(QDitHioGp?o8*|eIc`wsdS0oO|5N*g74tbMHjmaNlUE38tLFPT(+F}U;7=d9wJl4>AKR)YOqewNjbx&#r=AQ zKpLc}aQ$c*2%5u5iQO(5xqrRQ$DA57%A8hA0#ePN%J=dKfkb<|Mq%YD`x&qqz-#!l z;sFh(#8t4wpOMo&uyQfmF z`g^8ilD*;JdMV)~z$BHgzB5Q&T6X6&YO#SW!GL3KB=WQ&peGPE@9t9$D-vHTMQRs- zHOOz)9IuuS;-zOk&QEL-(B>MpUiOj*Q(lGSqqqQY-0%$iz0)03`ivEZG}lM#u%e; zd6hWMTj%j$NlR#s2|*iD(-~X)Dn6;RN3&d!ox?G58z*=h@)X7RBdTLdZU%UEOU2X< z*_kT=1lrVC)*7fbsO(~Sr9l=EXX*_J8TuT62h%WI!SERw!kiY7ALK(O?#7=(EKKSF zPS?m8H?4AvN5|Jo@SqD^7+qAsYQe7*s_~%gu^9TcJJ`m2rZ7@JWB#Xtg^Tpr`B_wf zY}`ggVKV{v7-~g$xqn6#Gy*8|J2osd@se&3JIeDpv5iV1bcGMj#Il}e22PT{cETaR z)Lk&R-|$l!^nUZV@=}yanvvzuD`hAs$Il;hpd_colly!U;W%AGyrxo@pGC$SU}5{hXWNSnA7F zM&6o`JSuUy^eqhgR@?aoU>z(79*wpVDVt~o^>qJmQb!KFcxi1mDyOSM1Ca#i83Ko( zWh-x;*PlyG>x(!r-C!IJKdc6|T~lZR##KVK(qt-a9&k^~a!bk0u%ylf)2Y*e45%uW z4FN3^voLSdAK%0WlP5DsS(K>QJ!=8|uPgb7%dsPffL$5`h_dp)gbPlyK79=dGJl;c zm3V^?PbSnGaVL?_W78q+EsoDey-_{Dk$9Eva@e>%n*K;M=kQJdoSlkYO=)eg0fcfPi-BfSnF?A%}#v1b}O6=JVVHe94rNvAosiBU%eyDK^ zziPRH;saq??-avXKnG&U_^Uyu%|Fu~xEtZ+bz|cbOe{wy*)|5uez6u{1!Dbi>{j5I zvtRTul|j)9exe=xk2?>Xu4Jxz(bXf}X?m+*{o~7o^N7iih;A@)!Gs%a3g}QC2c38B zry9p#q)Xppmudn^^-5j&zPm2!-*+-&lW!B152d2bs?w;$yiu6|L5VOw%#Jso6xKRq zaMf%j%{aDwWFIx_i&$E~(n_T+9^^}h$7ZFRE_Fvx)T}+TKA*-n$_K);O+YTWj&^jckUlew+$WMEVZ){XL@YXA>1W z6yvgmmi`@o<(ydhbzs6W|5DF|x9aFmg4(Puw!>qz{~)3{Kcc#r{$MgE`$K^NI@&I> z7Ctz=Hb>KB-EpLpz~*EG*4Nq+6g2QM^=*OA3*>8yg+~ZqLgo4X45m2yD7P1p(fr@m zGPU{GN7B=9N;w!H?|(lSMTw`r<3!Kx}dsA{uoj1?zx%;vn#M}N=-lg^-E~ut@;jJwjsy764iR|m1JF2RqNau z0##5qIpP%Bj)+svDANHeHw)^IlkVhfX&Km!8q=y~pfQ8p(|6q&!#tE=&EF$G9Cy7P z#}jvla?-iYxB8U$8aaCh_h!+|^Y?*oqd9|sNEg=bp21bFo<=pNts4rj&muX~s||10 zw|kvjDl%j37sP{7hu+WF{dCPkdh+i~Bk#wL^dPs-E2eL7;cEi&^n%U*TBd?upp^eD ze6ex;U)@ooJ5~G8in9Am^8u#eRR)8tgKh=pmj3TDijiLTyi~h5t2bcc0D-5N`u#-_ zC0i@aJM;a7?0f14%NylR$oua6P(S0;$@>G-@B{Vx%l+l!VeO zuPm{^aG!nRDU_?ekN?=(kKehNN$gz1LU{kp<7_d(+4qYrH(X^E-_pW|nmH7=+<#*V zG0YE7v;|mB23j+c^pG@4)^VXExsR5p@aVI(zx|GRx%x}V1 z*Hq?bCc`qH!nr-BWTd8^kG4M(ilhPGS0>q6m(_RgeM~^#$D7UttMyKX6{XxoVmnO; z51M1Qp_*Et_n#N45bw#8$`&cd4^saRy_>s@K)1uLmrooa``m`oo4?v8&x&Z4RZc@( zt<~n|__$ryuRuq&t7YGguQfr9)~wI(RGZfY&#}iebS9~~4Vc2&qE#||*M?fL2fKyG zqOWAu6UwwIWut6c&a@9Qg>E5CNlG<(&a5aD(%8ibklgm>Z7z~www}m2KKphaojTWI zF`f=MgoG;O`wl8!T2)j}KDo%ztYP<55;>L7mwifea3G4j3o2^hB-AqyuX+U%*FXlM z9ru6)YF|Oy@0H@Ah!!H{d;0|`?>NIl4-vO$=ZCAasJcOfoCY-L1 z=!i@n z7bgX2=SAFJ)3W{^inko?Gf0Lo$x6tx?A>T3F$@?w`M`u-^`U-Mwvp76#3dwpVsm>V zAOoDZ2fU?lm^MX>q!~E4B*{Mx5?^&2U=lsW35~zXj3>=TmvRVNNy!W z{TT)B*%%$XEuGM9b2|=n`pc|h4+1cUpwJsTizgkAg1(5AO;VZFwmF$ygBv+1&aSo_ zE7dtdoqJyr%tkI%~`Uz%=D=UT_bo^>EpEo*n$q6zifE6X} zs>l&dSKA8^y|sd;*zL|puN-`(Lk>`qShiH#BwFK8-)r}drikkVzH7?5ph!nB&VSW; z>GjL35C5J*E;r97cVA`Swl}fkmN(K+vE8Kb8XeQ*PAC+Pw9i7#(yFpBen^LII$!xr zXRQ2nE-Bh;wGO5lVwe6B7E%@u1F}qh{IT#SFKGVKwM2{4wNu6UmHuMn4 z4?Q!@;a@VGyY{IOx#mH~cHDjZt6dB`0W&T{(=5NDY&LnIpZrIO))f;?DUj?_mE`i` z@pvSyEat)zI|R+XMphyz6!rd zNNFt@mV=|mK7n%F+j=ly83L;Q>j57PUA^)7oX}=}b%fxQNJ1z9eM0Z-8>PZTr(Gtm z)2D}5qpu?%p35H{3O-AA5rFz~recXL32%!PsmP#Vn4M>%5bbKIz|hL#3&!tX@Ia7^ z=2Uyv;ZnZ-MySGE077HTCG=Frv)}gl;QAy(sI2`TzWY8|yTo>zfivXM+jrrVDQ&d{8EE1vZDj0-e*I+=^B-)kuS# z9D)~~^;`|4RHmo%^@XXwvy+Bp%DL}w1;?T<8Z{JVwJHNolXETYANgw0Ic&>|2f=W6 znkA{)32YtVNt1dz6cdyOG26wV8(Y#I>sx`L)lMkbq|J0e!>YP zbl81DE2^aYKT@m6WAZ%c&uioc-K>_%^*y*S#kyo%iMTYykOi)~F*37e6Jm;BbMEac zXCPKYLff#Zpq;7oMgMeB4|Y5(NyqNs`%o)L3Kl;+dI{4d0*xJ{iN4_+)M=`OXBqe` z$hw~J<2>2mqiOEye`CMt3;I#(`~+^4=OS-i9ski@QG)VeFtly%-h-}uYM+@Ex>Hr~%)+Bq$3-K~!r!L1vdWh*z`biD>Hlc0(51J(xh>H5 zRJw^nFB^ZK#Xe{G)~isUk7%Rbi7~R9!0XIu*Tz#eBgBL$30lp^J9gTsJN=sMW*%|T`%)C zTyHSggok_eIyonzIWTfL6~C>PaZ_d!N7|V5Tsh@H1LWYpU_5#}6dyE8d&hAQj5eyJ*;XWf8F*Xz#O5 zMHBd~aB!}D?7~3h8m13cC`(c1&Om@m{*G};n*iUt`aTBnr)x6Q`EZb~40qsXsU6iT z(1w+Rfw2EK5_4Z+V7{hwzvgL4I&K!<53NiNl#r`!hvs>rbg1+ZefxOlaUsc;8eYF+ zEqmD0KanryTREkeUQMh$B-s{&04YHRv}n%}b+44t{a^ie)i?bvpO~1ztO| zw?|l5**S4N;SXZi+mMCP(_qg-{;1*+9%VZOdZ?j4F|}a4{_^NYQ)c5=1oVon^!wZPy zp;kzKdut;zZSikmenU@PJ`#mmUP4MdA$ifcS%;cY;C-RUuEI-N+vazM<8pjJgnURR}GZtOvDYfqx787eSp^-^n!#TfwF?S;1xUmL`q|rp>WMm4GBV6(R_wO+W-E)ue zdBj}aNkVaymlgI08Cn;eqr}{Bsf%sLm&aIy@2{^hap`qII%8Movqxa^v*l7JF=fx= zrLXL4)O4@UKkuAI=)0SKkJ-vHWpx9e>m1UG`FBntWLhcKDHxChhFAt`+~;w5;bU76L&YN~NG z=~d3G)p5ufWP*(@w*e{Dq6Hau(~_8*Y8{(~aU+0M8^#eb_S9D{E#;HcZh{a{lgmff z?OGc{;jCy&EmtROu0-b+SgA~eZ=(Fq&(tzh(H@uA?mo@_UQn`khETv3JIu&>YO}GN z06M?pYx+#FA?N(N{$L;6=f1U*7|sr6Z=Lfx^WR`=*EzIAKzcBx?Ns+Oc5JV`cXYx# zTgS8tT4C;P$G(%oRrHyaSBllGFR(L);OZBym0dp6JF695 z9huf6I=WeN@}p>s8j>W4D32X$1G$a67He>?MHfx*?F)D8o2MrZ?^@!jsfg5RnoryWbL9#l!c)>nlYNX6Y`TC$gk9ig zg=fippsJ_u?Py(3g)7TD7PrtQ&}r`^BHaaKD-@Om;4sWjE0wykMXRtoBSQjvLG{6e z99fu}MV>g1B?tUVaVm!sqZKeXo3TSFUp@~(6VyyV(~hS?!J$uBIZ zpkZ{=#m#+Y9d(d@BDCOR6|fvQ(p+~V}XkIUnr1$nfI`(WXX}^B#vCZ?3zzt}v=l+HLY0N$5njzX$FC@MBk6@#f z�N_xI7s^xXa;#0Qj`A1_(r-lo_MRZdRv^0xH+@3uw*B%d$O)CAf|Ouf}J4?ssEY3F=ue2+(zNAPsbM zdBTV7+X}Wv=LprDLQ|n+#E9JfltUZIrHl)|3Dyahs_Bd-8B-||O<@4DYz$8M0ag%b zhMnbTmeY_x`ZSMq8vKaD017f15f7w|avf^WFD+)mWj1DWM&)&KPha-t9wV=|Fk}OU z8L0M_uq6hvMK-c|n@G5+OxKC7kpuu-jSY?&MM{#{TpNvi>nhNMdJbTLTIiosEFsHoVX7_9m4kA@C0(^F-~|JpDTW;JelQ8t#ybeG zn)Aar&s(~AaK2P9qY~3)ezXpl%WDt6M^xJ=xrbtONg0++<$&mf!dq_EjjH&IGL0?{ zA);pu)NVfh=l4@8IAGqdg2Icb@Hz(8!P5)g3x<($(y~EV8yP^9DLM3pm6cAlIMpsM z+zwf|bfh8dawz9IwJFb_SvoCq3i*^?N`dWPmso?uejSugdnif!Eh_o}cD#*w>>&(G zNyu3mZi$wWy(pApJ%GI_u`VzSTPQCA5y&PvOCZQi+7i5Tgr$R_rSa6bF;ROMHYB?V z1NJ^9+W>0{Q3|-r8_CF?Q@(*j<`X@{@eafNAs!%q{R@|qUp7HZ?aWjCa?06slSnu6NT5m!rP$T`nFo7*$w@8y zLY&03Z01Q@_+B%)!8}~G#(8AW|Bhpa0m$^Q04-;m;sT&%87Bdx?kM5$=QHenooJ2d z5Ih{3S7c(yOv<4Jg12CzsT^mzn#&10`l z`|E1`DFQd*@9!gZ?>mDBVlJV!St6Mp9YTEE4VL}WU`<7O!cBGN@eoTKSvY#hk^?=c zL@Lty091W!ssMo2$?S@N&;%zV)WI5gebFmAyBPp;?UA@ykPl=0Anq4#vt3wC5aeHW z329u4%hy!Z$cLKWop@EZpsJurRjM;RuV+`tuF;wgh>5vmYa|GI zOk#O$VKJ1DKPSLbFC>R#I~=*ws5R|RCwG4T0bIKf28@Nr$8KS0D&8KJTnbBf!Kzij zt(ud3iPL9U2{0dVM&__YdlE$t2o`=)F58Z_;am!{Y0jhRwkL7KZ?{?IdU5< z9gbZM{6z*-Bucg6Zhf%d46OkcOSiFi+7mBmS2Rc$%?n8=ciZJ(Fr^xmyZ#&|@N>Z6 z+!lAbT_QgV7r!Ed;4&;Gwt9}?XYHr?95jCuImfO(_g10(nVLMC{<^pF^XvtDKd1fxM@Pcb{D;p$n3z)QLBPoX zj2vwLOX&ap>tin4;I>Yv&mkrXTWRtXB7xF@*5I7n1<_UMyxG!+tL{JIB_aw;Ix9Qv z9Te*}RszY(2Zg2nnGjKZmG4sec^xB(#Voo>g17#ihnttJr&@lx-p_M-Em=u2-?w_* znss@#e@ZM7{`mgjsTPpg5Ieec=Cc*hP}%w6RC%Lybip-9qI}J+p0Qawl5t3>hUMI=rDejFW%Wc*qlUjTGJU7ycjl^c??*9oGTN*RhS z-L!=&AAVZ$ltDd(vQX73kI-Bzs=jZf3Z^*aEZk$RZqF-P7^4zG?d_&^iYhJD!%R}# z#Zdv*6GNYiZva&{bdT2KUV^vOh(L6uNSkNxS(vw|CYp8alqP*hGaWyJ6aq<-66E0ZA}?E4Dva<-^^ zl!acvqH|j0M@?JbQl6&(-D(^Rs&pcFGV65`d9Y+9mF38H85n7;EQ0v6g4ULN;j&k-Z8WVdGdN{zn#yG| z@7%HX*Sb~iW7WEF{GBx`4|~1{1j~ud)(Cmeqg-Q){e7gzGVfJF>J~B!jbWxnNH@M zV^3W88?N98E6_yBeLR=6ykaA7$tP^?#z1|F8c~&~kznBK%d!QnGIdpsx#ww}fhBP_ z4cOcWi0z5~7{X|p5TskPM+~Vcm5oKvbr`Y)0t9M7R>{e3kGnzY4hbA{8evw0Vpa)+ zEj;iNLkTG5=|8HKOFZt1x&V8I{LWF-6yC%53mguefD9Ck!5Cj);okb4q&;OP<>fa^ zZ$pxCrl|_D0(U9~bTK?}I+Am9NK7k|32;0fma@uTAcEjyjy6D-lwH3Fd=-10T@1)t zPy<=mukwpXSp*V=V@cW|BAucfoD#n)hw0!jgZkIAwb8llby^_amb)jCSUpjVVtxEH zErkPL%J3v(l)yyFJq(+}=iwckAZp3^mDKwr`0|r#Kiv)H@`EOvqj~bwcdjJ*2oNnW z@tp??-3|*zl8Und{j^)~G+;ce9Ujy+V6-IAaH5fae`aNPvYUX~Vy{zi@%dHk5ZfLI zXGAG*;dP_khoTeig{nHs_ML>Va<`whBw0lor^@2!kM>8WJKSexj)8M>Fenx%tpgJi z5=D6Ih{@6#Q|IIt&-Dq-s&hL2qyd!Rp!y^< z>5^fPYn-?{LX}Nln`p%&*)A08h$8j5pHd2L4wa6+|Yn+$V!hXh5u@h12C^}MF~ml zLnA!DJT#7K&b%fmTUMti84o*A|HFZxqZHEUk#@BrjzClwA1?!MX|J1+6>`d97Q95H zV##OFGS|eU{iV@1sdwkP6!Yl}R-}el=bkHQEMKQ+(c#(i0W>GOZhm(WdBxIkK%&4w ze6@ZI&17s(1D$bjFLg$}1`xkCu;5+k^n)u#kNr~Uw7qIoQFo>$k{~{awjXT!RU#~m zr!naPENxci+XY^ku0So;V!GZ8A4u}%ghB1&2q)`u%s7*?#B-IqUQlk(*Dd>Q>rMk;ctKSwEG972B2sz_;0kSM%5#Z z*0Ga8YEXhJ=`pACNGO+SQe`?)GGrm?R^PHrQ*AlJ(iAmls9syXK%lQZL?>g*m8pEMR2b_8N67f$QZm7gLT#PJt9)^(351ca+yC@Z^ug%ex#RJ&V0KJ|zik`KZ1 z>ICuNLQ>K6;~Cn7HH_k86)h;uV1tv+=z(4?9ik!>ou5D3as@WYCFO)lUNOG>LL0@6 zB3QSKUgk{e7B(6gIOpzZvT!zdXqEmelHg!$H&+>It&n>rF`#aM{UgA>W#;WKSChsbXjtJD zNF8_Hj%K$mFn}u0Pmx8Q^vKO-)*+v-9I$Lr%)MLvkvqN01nnAk4pPYc9QpQBlhF4|p4?J)m6R*-{C?S@&31(Pb(z6n;U;7CQS+O+5~NL3vdgiftBalx-iG zOh-T%2S`mS~_9KYHFA_ctw{E|^EVL7`petz{Co_pGS>@aSo{;N0rk2)oS92ZU~P zKEvAw2Wo-Q42^S=k2(u%HR{j4=6QePkO=L!@jWO z0L5#b^;9l13@T=r^DcMu=Ie%OhEoBOJn_g;mjxj=LZE57JgG!2Bm`q2mTHnFXcmP@ zzi%0u%@AaM{d?!ij^7IMwzgYz*4d_ZX`|J~0H&!beL}cxv|Qk= zs_x_B;YYN)7Cb+rc;31hFdhdTDPo8+M&{VJshYncloTz@Zj?=-(gKDZ!ezM(Z3@HygJ)U z#xsAjC-Q96P2iD?OKj`Lo8GAkuB!t{8eo@Y5|pW50GyRqwH+! zRoWcAdTM})Y)(hrqcE<7Z)cf&0BkSJ@*@<|1v3_c)84?R_kY@&AI#@olWO)fK9^_U zPgV2FD@8%8VMqiE`S4|045!tQtmdqHB}s0Z#ZczpMKpaIESITmNQOh`w}azF3!A{&hAEuGg>U%aBG<AQU^e0S^y0V?0Kri4M;(drsBCFL=%+n`)6?{T|1dxS=VNsLfg;H=WmUz+l ztJ>PRZtFs&BkDdDGbi`(ul?7+wft08Hi}7gF1AeZK8VNBXF_=Q?{9v3Lm&L0=XGo5 z&nasqxLiShutcK=uYMNCF&q#hrM8&8Z9iTQ-*S$UvbTGqO^7&;&X_k(kAg$PnEVfL zjE9s*lLxW)`!`4LzV1I4v6J+@?~!WCYMT0fRjKq>zbp4eGbJIM-|jwFRo6bgj$PVo z1=ohRe0-PKt0#OVZzq;cmY2y}>5T!hUrIP9+9e2+zX+^9#M@Ic-PBKU&M&yT{TyDT zB%F72==5{o;$7Jxob%*n*^ZTRFVQlETd_K;TimGK5u8KIG2gL59ILaKY8;0@tQ@i@ zv#&kV273XY2m3aL`c1*@L!5xcxAnFavx*z(c6^WA|7H=+yRX?v6X$zC>JJ;|uw?QM zKt~5MQ9i}*=j48N(!RF1rgABp+KRYHkDUD|%i*5R>j?j@MA_31bXV|Aw?>6dovwJ( zhu&TJdiGsMB*od*)P6+R+DloB%Jlk3%4JKiYvOPKNtJ?HcZUj7^h{_y=)JjzdR3`b zEV4&KwCViIlNrftz$Y1?IXP@>c7Ar#T;3^)U4wY<-f8;XuIS^*PAPiHseufCqyzNc zs*!rXm5}vdE2&!9TDg$HZLbE3_tfzxU|H32Ikk8-Ikj0oX2xv7vN5aTRf{!{1Wq1@ znTWL})>@O_6<8Ru>E2AxhSu61bfs)u8&y^*WCfU{E^@b@N|g+-DQ&Q-$lV%))RWRq z_!g{H9TDwTBoU&OL?=t$NxZ>;m5Y!Dv`vmIJa$3Z;qn_^c7n^rpmd-IB1F^-HN+@X z(*agjJiFbmW*An<)|38Xe9CJ}vj-8yplB(Zkz-zzqjIxkffsAWiXK5@vf{BosapQf{n&hNDaP8IZmCYjcI$>zp|`w~rxZAWv8uVDq2i+Z zMElTcrF{O~=sJ?QDvJtnt`Zm$fX;eOIXPh+ zgp`FjD+dS4nl<2UC@(m5e>MJxj1A5zM5kKSaEJKT3XcPjh6wozXA&d`XHcND7_nst zxm2{uV;M~hF|YoSnb~7N;%pm_@dZY~tQnl9$%kxkQknk-DmW79K9y#mN!Nch57~iZ zxH&r<%x*N@2cacfi@5t@7Uh^3S<21f>HK#rUHHR29{? zUOIj<1xbboa_7>DR-PnH{i5G$l^#?TId7#=6HHW*d>g^(a=Y{auJbt0^ z8~U^y?^Ra4o>sHtIBX*X&u3bR0+rRt?7*IqQ00A+=u5sKW^vB}%eROFE*{}X8C%I6}HiF zNxUZ!)lm1q?2fj(97?E1Q2Dv04Dwy3rm`8W(@OQxJffAg{t~a!XHE5(Uj_y(HKQ35 zThE?a0DK^I2|IBBQYzFo1Rgu%CPJT!05&q94*Y6oxR3>+l;y%f{4Yyq^_{>N&IwR} zxNNkRJ(>(L0y`BvT>VSsz;gxiZbZrqYOD;_GR$v`;^W+3xZE8qYN3Cptz}(iOZVyc z9;n-Boh&noP4QU|i33TIfDrKx)yUJt(sKC%N}WdOh&x7z&4a}U^dtM)Dv5oE=)JuG zkaD>J(C3zHzzG)NeHQH7(N8WZ;Ol|pv<&y!Y8~Jj>{${;Kn(f9z&QTLCn=k24^4HY zZ5v}-G<6}l6E>*_*6^Gs9o4@=Q}heIjf$QFP~qsjCv(rm<$+8l&m85q^;2niGET|Kb{W(c&B^f zOVKo-vC41OF9+tH&E#-CicE@4e7fQ{mvNg38LJ>#=Ku2U8T0Y_H6ps4ZK7yaIfJZ~ z4U@u00FxqCW=z(MMB^fN9;iWaEIk+hZVqksHQgx}^yW*)#qJRr-RPT4jgQ)Bd#@Z5 z;yg^s)c$5hHNjD?$2|eXIY{jZ5Ui@^ZT*vVBgcBZUQidH)s_3xejk^3Jcb7`X=N9E zPF0qbqPu~tHH?y1)QoJ1)!sW09ITcsta|I2OGD@jt5lQ@TSqX^Q@L4<$0C^`@;p}X zYp*5bMOx=?e%>NOp16suISgs}YZKit!p3{aO{2=vJ`x^o8l|x&r7SfF*etKNeFmBEENc5+nhI7o4=T z6I?etG(kTUxakmB^lnnv*M^caA&yMI9i;9hez!ZD7rLC!&cGFXY1>V3X0Zoue>}>} z-6xToL3j-@VHrEKS;`d~@Zx&eUVw92BySWqY5WAo@ibX`m+<=rHfg;|l`Ma(E7&q8 z1RG9|Ms_=>Wm=N5yv!Y%lJ)wL68;Qtcig5X^WDF&Zyv-$dwbJF2bNQo@wL$Cj^|o- zZI0SZD2Ui_3gWG-Z=cQQyltR0hMHv*O)kPgEyW9hp;0m>pXmMxP(KgnUpEJZq-sP8 zdy7lD%oa>@jMk&M6PF5q<|ZtWpzXX0H9Xw-JkN6Du64JQ`W+UkT}g6#?EWp3GzYY3 zQ;LS&MwmMheGBDGIz@B3It$u;N{XwO5z)HLYg!(x9z;%HTP-;iVI+=NZ+avNm!7tC z1~;(XHi?9Wux?WXm>>8Ip2vr=K_6mE*Q4G(>)+d#i?r9asIlA9-cs^hC+G{H^*M4q zk;S&u>3R<1U+tz&<=>R9B-QH96sz1Z`(A$i#wFqN<&|==B$yU$7s)C-@+^@*ru1y_ zx95Jhr%%^Q;M8ZrbSXU&t>7?C1S`Mf-%z%ns+lrgH(0 zAuNAPKg{z^#C0zz-)pEibU1rSel6tB`K>;)DCb1a&a=bq#h67!l@J*5 zXnvM}U@1kb3r%hJXZgaCQrF9%;?YI8f|PB*fw>0%j4JxH^w_uEFTldj&*_vr)$@sG z+-{QbfE?-uVCP--Q6q_t_y`~DbOg;+w$%gKEz-dbB{nRHb$y0lD2f0Uy*_Uy{+GkP zro-ULD`;5a7_IIPx(RH@*$w+&MDB57D%(Pd*h#hgnjMu!vcKDd!GQ;;m=;rt*am-t z3~xdmv6l7gVMy7@Vh^xaTd}! zJJ6KAg_?#s!ru>yHP{B+!Zh=060s4&ck{>?Y^#sQ%&@haoQ0v?7=;DG)cvGu`|a=W z3?H7O@ADx^Ja6&h6B9L1obw8S+BNegyOjjFP|=R-_K+E6`*Ex`p?Tjdr8tVOL`qTXNO1p*gkAK*0<_3Fj0^Ia#KVGFZafP)zVf_2mE#^vU% zU+N*F-Bs$Wav6_u?C>oiLvn*2Ag6ObqMkD4rgbVN7Tif$JiGWYJ0yYh5Ngj#s#Y+! zPja0<@{A*AUn%I*ho&=Q(SGl+%_g9yNp9SFwzyZgMxB9==^dmQ@|7RP_3fR@%Ajnq z)|X7y8!t=g&{IOEvWw#$cFb>=DL>N{)Th$5t+0_u7)_ZQbvR8?E9Kwp4X; zz>Y1x(+@-9IAA>RfOnsu1+C}!&KmG;<8EtjS~FWq@ak23mL6Bq&giT2ZWmY8y)p1h z&g(uy`K_vE?H+{WYeB(_)YGHD2- zgj6RftMkIcxSX-{y}o!BdR8>G9q{c~@!RX$tzFL1E%m1^XF#=hr&q7)MIFE{|N5by z+Ny7!h(4S)TpUI-xlJW%(x@mS zq_yG5i@kDTVUJbTEhr7M`2IPPMY$71W|ceG;T zA&5i!6e}7R^E|WJA0kNSIID}ApZ)qajI6<*+-fXKd**9QHM8}0t%R9i15f#g@QZ)vF3I5Y_LRzDRWhdx8PH}OW8*V&=tsN75&?XcDPf(lhKG%t zV4X1>40YN0CVo<}AxW*9;-l)>>0x``Nv4TtJr03Ngc$dT>uVqK;WWqpN|i^VSk#+8 zCIUieFM`~fp|LMzi^{ZO&@^8Yk)0yq{B!iOClm zjhJ@m>W$*NyoWInGSaFzgaJZoIF$o|$~uLu2{}p0AZ`5>IX0cQ09SN1TRdD*J@fZY z<97s1g34_3fk8mhKByHhv8F^y;+a8bqF`h`q^7zfh&DCo)CU3jTtiHCF&A4;kdr~I zbY>IWU${5TFOqbHLm;a*SWVG|nn*Ag;@`l&`Wy~)md|`{FjAH}4Rzv>p!#(!Ga4J~ zDiM-Z)hH@2(A^^;s9UMx$igz#Ypjl$z|$E87a1xe+|1~@%+s`w_U}gCtTFyXNn(O*zav%YypoQ&L23g@&DQ4_{)cOK(ARyPJ zH79)qoCz@ zWqZkCX(0O3*ruVaQrh~AYgef7Ir%tNy<#Z$OZdAkjs({W;-;<^=L)wcoW9<~QEmsD z9!rL1KPXwC@(qI<6bdTSrOz|mOik!rcmoyi5^jsSekXi9W&DVe2FdwDj4F69jwH_c zQshI*rvvm+bX~T%M4ZR1Pyu9P~2g&pXgEeY=k0c}O0=|BoqP zl1w;9jV*aZXe~~Xmik+7_hqq%%QVmTRHbpMerq%f8q2oc><%YRFToU4%PkppqJV@M zMkb=T9pR&z zK7(w=$FjUu_9&YZOps_PET+E!!dE*W7-;&o39R$?!%H5D)L-XJ#auMZMI?rvz}a6p z;Yq{iJy!IM7(p){VF^91j9HppSAUy=q#y z#&EySVKp>wK0FEW(RvlKr;uXZtIjjMi0LtZ;64U5D^~Vg*3lT~GaW8F9m72Vc`916 zVqWTd0TE5byxs!)BC;B}mqP6=fp6DhlxS*Y275XRY%3eb%y_*KQ%jNB;<{+=$Iu)W z)q0znhT3nr*@}3DIWbF1OY!qXNHu$z#;x!0nJp}l8cFYH{#q%JS$Xk)dY1X>Hu2QC zHVYGcix&F#+Vu_7TYqf4j)mC)THFeEQVUsD*B#WrmzMUte3}%ZXo{ZonbrP}vM1VN z*l9~*H#^RIL`W|5Gtmy?c&#+>&F#XofuLc2^pNNjVO?zxg?u_8vsR9NJS{9k@lWE5 zr~3r}3&`B#ba?rbdwD^yS{991C4?wc1)PbBj>wMrm`R^3&gj^p&eU&+Ss@o=h!o!NrYu_Ns?ZIj0v)Wd z(Uec-$R1UH=DLHLrhzG?dm9(#0xb=V5H=f1;wyD_k@NOu<&qFSZyfXeN8KeWdb$>o zl*rLC3dDztbmsJax>+rN#RBkg&%$4}iW&XCKrKN!gV3q9Ag$qHmO31htw2dqHxu$d z)DJ~qor?ymB-5cas5 zcVS;Y&iS>EMKcL^PCT#423lcTLN`;rY^>H(<|Sf9@Pa@$R@JNkV_>rIU&O7iAJ0Z8 z7^w6G>&guR4OhdVNHvrNN%Kv^D&ZG7nxmt1s0aBm`knY@7S)5SQgu;6Ox+j;l*6IObv}!u7a0Eu#j=}oo1X=+d+!vM^<{lBM>m3NdpNI1% zIOTVAaXcVwzB4z3JK*W?p4`0+By#SV53~m0h2i&uoydmS46g_E6b&{WzyIAZCZzJKGVl2o1`fe!})5XtAT*hQOWh^nVvbaZop zs)}5s{j-E(Q-)j2s$@^U7~yNQ@PqOM*KTLPI5G}*E*SdZou0IM9ADz)Tw0-*_Tip+&glA5)TPEUoL$(|Tf?g#%F17Rpz(-v$rh6Vvatl%NSaQOfI8BZU1* zymCKpx-1Zj&+f-l{n>|)6Amy-M#0^gI9vN(gvN7H4x9ej)5df3XjV1edpLfUbQ<~= zQS14Q_I;e_c4KNgHfWCBvvPzLS7VLx>FL1^x{|Ha?~lHXkv~iL+>C3=a}Y2)yvupQ%$wM^*Gtd~I|K4o0Je{O^eI{TA_iyO4)#l0`*`@t2Z2Q;Bf!#!Rk zQ28CkpPbS4OBv?kdw`EH_Y~+BMh}pQhdShmQ}GRq@6JjSZ^|3{jac#NBbzSJubWC5 zj-+DZoA9)bIGJJ|Wr@Rdvq$|l4b~$D*T#8X%NnAU~w$Gr@37~@eH^TIg9*LI5f z_10Rj3{2FpP+>>1ctr6For^@bRZtj~6$D7mwbo9|sWxM6fmq2GxeQL>D)OWeCXp$m zHg1Nf>@~%Jat1CgzW_b)9`|IQHgi&|T!}x_E-uZNi+yX& z7;JSd0H_fZCS1zd8|8x+=)R7!4Nq*rhP#iSMX=aB5JNMO{CMRN&VQ`3}l z^LhUv7hvV^P7Q(|sx(YQq*P{3_5=@E7&EmYNu?RKuwS?$xMe6YnkKnZ_39*0v!F%byjq+=aLVlX_&_?a&#b_F9KCs3L+epO|ma zGF3hG6q)HUK@PN7a#(?L5fH5RZ+lYsAi@JJ63`YnT`$M1IMApvmx$NRaq{|^}hNPkI$`R5^B#9rXFrVcc7(bd%3}ke4!qp@TGKSXr z)X%Ghn8ddiiv?GjV6QaL&og9jKpw+S#>!?L)PJa}vdj>1GbJ>K!-~ODhLr&F?J*^P zFz0`K7~^CW16p$sX6o!5g9_E@2QF>x0&yO7if_*A=z&?Ltc`7k9MQNw z=g@CtC*hZ4@gA%+BcWR6f}NgRJ`Umy^h92UD2fo4d~nC_ddgHgLu#?1ZZ;Tint1MuK!_Ili&n|ny@wk_OEL7HifEU@0qToNu)iCZ^xQrD;2E*~b} zo<3yYj}=E0p+$y0+r1i_DEMRB{ezM~x~$KNDOGDOrAbL-527;bQ9;^}U8D_94}Fjb z>YrF7C)j5PUB#zDyq=X#c4$EuY9nKVo+H)_5Zx1pP_us_ z{IxdSpS$wIW_U)m`){=^5x>gm61CiScD4n&t+qHbK~S-gVrX}L@tHzr`+_Z<`?h*o z@WscI*!6 zzcfSq?FTWTs^(w4fD6t5uuV+bJOJ)Tb=EQ;gI+}`&3iHD$9yk`vS7(Ami*iiSMLU9 z+?Qi`22rxfeW^PteW)w$k?W{;MsS?7+wO)ceS#!bD}ANgFthh5bTY>&pt*`Yzm^c^ zGb80ybts*Bq5ZHw365ewX-RT3BGJQ&emx{%s6_vcO6E+nKHQiFXdHp3p(UJhmk2D8 zehNFJVR3Gax;Cs{pjO7!VC)H@=AO6e2gk72(UULN7GJiGTKXlX4jV^(_C3E1H= zph&;R7o*0J46NM=%L|4vldPUq>x?>ocp-E0{GiaBPG+U?wwuMs{_sLY&Mu}P<@&Le z5>?1mq2d~I-1XlDXe1M;^VlTg9)T}uL}gel9G!;Qsb|myd1u9IS|o#@bc*r85)dbX zZrd^%irc{5kg`3h)lZu);_M^x6FqqRJC7zI^4kpPaBj%qt7dX{(>3&6G+ey=dA5jA zu-U7=S!O2DhKq{q{!*CqZ^cJ?zkxNeax7#qkDdtPk)P@Utm{c=s@Y=NKM4~wpQR>= z5(8e6de!qvAY3Y`e}$fnPfRp*{DzF0X3KS7s^6Wn$JVr|qYmd~ulLWp)aOdrkC}6V z*hmQhRX&vK_=RGJ&7|K}8IV@P!{u)a9q^cT`cAmq(@u~T_=w`-*JxFACyl>K716xc zpj`ItmG4puZ~!UIueegrmRklD+DV)L`}ew5F^17nism)B(&H>A`akT~IK z%ljgT`BxRZ-8c$UkLTjZdv0?}Ue$wwNoqB@}aNJ}-Wy>;KKR zJc5Mo=@J`wC=$ZO=_WK%cif8pn{6S@?D7l6)eAu-n|!uR0Ox<4Oc~zL>3K67WBz0c z^B?4AjB>)PHcrH`;~xyX*?oUG|9+X>%LJqeIvls544yFgKn|i3KoF(ZIlXrMJPZMr zkDOLOt|O1ER?H9hBN}%da!YR|-e)79YqR)^6238h8n`=O2Ym)(zrS#F9yCvtEv&x| zqeRlHo50MnU>^Pf5I4~D2aBCy1~41|1fGl3wr0Vz;OS*Gg4+Y26= zY6;z=bYvI%P=sIinV>cLI@daz7%YVjy{W7OxtYf{xVGuoQkpk2)k>``dFHyaa4w0P z3>}jqO<9j7T{&%Op3lA1@3{cDZ?QTP&0VKcxiyqh3o`5uMNlv``y>DId{kH|+ERws zuDNRvISnIiHdf%gz0LkdI0Ljtc!J&gF-ZNfi~*LfJm$^rZfD#PG+f&3i8)K4-Z_HY zJ)veNg?Q6{Wyn1c1=Ri=eAzZ0DUn&S09*SrET*p$#(~VjF@o)aI$6NZK9uyJc@)lp zmh-fZ?yD^MpIc*2n=>m#;Yvg{r7#82EBunhTZ6K=ZW6rGFj?2x*56WV zV&U+iBfI!ELC*>It)zesZDie0aMEEEDC7>u=@7Qqi&XaNLKtk_H#tx~3=@W-2nq=_ zt-~+AbuLyh)kJ(visc5lzPsY$F{&D_`N~PnvUNnCP225jLc~2e7c}xUp>E2{t`;`K%9qLM%{;y32y`s{-qTMTZDN7BbGp%)|VL22ZB2dV>Lix0|4 zFSl%|#<_4VMbk&qt z7};NTz+MBN*THwc6!MJ&B*&b$`$+LzeaPOsk#2WlI8p#&-wc>X(U!%XPhoTIl|I>j zOq`TqW#CA3B|QALoVs7~=XUOUtaClMu|q$OPdVpkA4ky)!g$e~F}4r;KZ|3Iy`tU2 zbQ&dE=2+G130EW0VcabgHIdawaT5pNP)tr|mXMytZ*v-b$Ow6~(;Iv)(oo(#66mYV z3Rkr6ygUKFC*_r;HNR&zJ0$&BTYK^8!)62#i(A}xyPElfa>N=CXKKwY<$NR2I~pw1 zu^#OVhE#|HqN0rTGxtLYa29de7jN3wq;{xZj zozn>Tl|niD;^t0C1E^d|;SDy}_qE?u>X(X4ve>a0&C=&m%)h(l%bm=3S^MiA$>T*w zxo<4nEzdvi47?o3yhHuP<#P^LF6~YrZ~N2?k~s-5lFB}JEnP2_23E$cM;a?C;^;I@!+VPxHHDXV7G#bbnraKn%HNgbt!5hw56sBWuYffjqrXKeHf%#UOz zRV9MRcXauUP`~@+m3fR$V@4Q9C;ZI@~A+@g>hHOEDDm zbUu~I94l~NnxWhpNH$bh9s{?o;U2adiz;dYxZ`e01fe?hWCO7^e1F3v0CvIGZs23S z3B%Gpx3XwQr-0k*I3}DbDjZtJeh@*CLJlfita_tSw`bo}ZrnnLOC(htWU@34*}9di@K=kKJg4rnQC==Q<{7x6{KMDQZi&X`Oq`h{V4b+>0dtfh zCPl6O($Udt!-O96Z?2OvjYR-+b8NQn6kUeuhvCo=n;c92`11Pc>6XikY`JQ^TP&-K z)Q-5?x0{3f3{K#O;m-7^K9x@TOQ83uFG|oO0otbY2)5`(63^ra9m2+sIUcmfG0%Pr zubNa)W#iSAZ%qS|14V}K**3!?*HxT{5~hcxx>QVlN5%{{`Yz5vtPw!c3Lj!LDrLqR zOKm7?+$+U>z7cGYGzcT-xx!rOM*27X0GZJ+=*1uB3X;+Fdo+1Fpc>2c^T36YB?USC zI`&W{4u>QnE?)s{8xtlcjs``RLSw;}prQToAj2P>r_8F8Jo_NH^unsB}@&}FX^C1ivxR}j1L6B2mQc-EX03l ztx^tz0>I4lzp%EfJzaCz0{5Sdy@QDN=0E-zU<*K7#oe6+k#|vBvW*gKo?iM$LS4xj$Cmh=myV zA@&;%z|2&8;Bh1xoIc*44^)7qD>m!C53^vcC!1$}Lva5WSLoQo@0XGn`Qu0xCqN_M z(meN{v3@=I{=%zu1^0zBzWRPm!QZibm4mdX8lBwTVTxaFgy$&|jO97$_$jWrdtk5$ zA7pDr80>`Vf>1Mgx2*I;Gv};vjC_$Dajj`}c|k+?d4Fydq(;qErT}b`axw?@nw6W% z?X~Q?#=d|J{3YngJ`eu~YlZiTSbmdUPKA9t{0Qso^D3ua zS)xQ2=2fZ_E9lKt)+-9kO;C$w>1i>N(q{ih)jLIJ7Ova6Nh++^HY&Dl+qP|2{@Au{ z+eXEZnb-d4Vysyf^X3OBF*}zW|#!SkzAxyZ@7m_n=ZuTE* z)>Sm(xI0=dkt32Wg5hOjb8R%g^?G_*fyjPJM(9%*x0v)w|1u_Rz!_+HU-aAy$v+r? zZTHJaMi@vh1?sJg(*7aG7tw3|7OnlR5-Vi0OLAZou!CE?l%H2Iijch2+3K$HjF~%+ zzkDOPP$zF5W@Np=gUO!&hu*53}?^={>|2bf#VDe;km$elmWm&M4m7X$89KEyx z8DSGppce*OJ_-Xa;@?)yhc+0b9wJyErnnXWj`LJQVy^^>#;-+LRm@NWgOMh@f|BOI zoNe6O;MeN=vI_?S;>?c*9BnY!t#(?4bZawA8`KI#$fFBhLoQ1=OF#;jw7Ut@+sw1J zCjtPwvQq+Sd?w*qtnJ#8C75Npqj4=9QNeTYx8l2$8(*b)*YqCCQn^oF27ZvsQ)nLP zk6d5Y$^lKziqYSq)=UNpdUJGAW-jwVbjYCL6zy|xBflz7=02R&NOl)9{ncI4GsdMd zTg9p_7aClpwWM40bhwH@mb?>7im1wH?F=vwU#_$o53%lWsL!Bm9`B+u8dh}zU2X~I zE%o-86iM0qoB6r=Z=PHjUN1;FZghW%(^vdbyYOlLv}{+oB>gqRJe#95GC|8EGI{*&!Q zi901^tl%TgVqxZK@<1NzJ~`LxNEo1jnEaE1Fu?TIoW}h2RD{$xNT^hmei6^HN-1?j zijCsU6N?T^e$}JXm#H8S9D9W2P;+mX0XCvYu~f%j>8j{D>^GfqHdz+VoQ;GZlbHd3 zk@>V?PkAyq({qS62Zn;WC^LEB!ohI4NhPT;T_r`I<4U5*!Gbf-tp{ZRAPjJMcC!ms zQ+ozyBo$X}hZ!KGlR^@!V;3r_^i?OsO}5qw z=6SwSXwNa@@~RZEuE`pwh3HzGED0}Edzac}MV%L_vCQX0!xUe%+u*wuIUo+RB_lwO z68PC5Sz~-^kt>0TT%72n_X#myl4oIg8%#^jN#wzrIJ`{D5XknoPlPjc0RnF ze{p;F=7|-BaF9sG76@yf4%+U#H7sS7-o(DJJ~_CUA?$z&(_4HZDg3B$*I$`stER=G z*@d9*%*(u)1a?Ihl%TQBoNAI!oUS~NG5qCDq`yJz9Vx`h$ax;EN<|Y33f`xxs!%es zmAS$*Py27{aja^G&}AfakVoT*2FvtW0>Gzi(^v6b2>FIUIdp8Mn^cB?9)+c;Q**<| z3XBOYRF?qN`f1Bos*`Q~myg!xithH{gP;5N>PBiy&KseNW(EU&;Iy(Uv4jXTw5q|K z5XS#I$su5{}}?t8qQc_`PT>IJAy-Rk1eZ~rl*G1 ztXpm2Uai5V&H4Y{farSO86xM`8G^!p19U?F$&MJSv=@qP=fTffa#)h~Y=p44DeU?d zhnN=NrMqDvhBeW#5jk#kn`OwB(HxxtF+Wn@tuE$?dD&b4O2=c2NvO$b2ez!c9pNdC zHH-obDV&9`7!;gU-Bg~%RfJM!Wm^edJ<;@{jG2!$AYXKe{NZ8SeSYZV^KG&}FHW04 z?0hcguZ&Ol<*j>HonN;6D{{qUnal50y1;1JPae|fydhoI@BB;inG-*yr?^;fYqr;& z+Toe0%DT*IK%sJaFJJ5((WRL8tRNrfB^gfUyZsNzAwx-@;vbD>vp9l^qD8KqOCRC> zT)Jms)|VHB2tY_8LxBsVnQR~X>D;>dqesryI1o(qP$<&wRRCVr$Gh***L=0c?$zI0T`{{e}Wa@3S6um2RPt{6_o7Y6mpSPd(SvOzjy@?qUH#wcM#QR_GbOFuDX%cYuF4-HvL2k4 zC7XFa`NXYTQyWlijccL7e5_FgPd4?@Sm9yS*SO@obyLV>r`8tp0Bsx+ahs4SjHI}M zMw>jj&DL6@P%CP(#$YfqI1}8rM3zsKSqPPIV0gIdem&}L!@Q(M&1r?pVnl}LjE)lx+* zJS*;}u&f{iI$ACQx^CI`!x;;Lo%N<9 zh1rMGl5aR)0MU1+nkk2ha&=Os;6hQ0m?6imjvjTo3m?}(ND$5WANA<%WRIp?>3rg` z)UA0g9n4T9N{5(A(^R;gZfL}M2*pB%ubf-y{02-2&&-r={JOUB4Yq9TT`tM=^FDT1 zRRVI5{>^q07R4J&@DHulO;!0@Y{U*EaeLurozq&b zuPZh>N)~_j^9gg6`FXxUq!H!qAtiOtiTsk}CGifDEmMW;kkw>vDI3^|!DF zk_y0mQI9nzs{yeO%ui1SN9sU5aPLB~-#97u-({v1SWQwP69)4)n$l>+>690no>s}^ zBNB6MZORvznayma<{Auwunfj6VX0b$dkx8OWX0lEFu%pfpt(5L1Sjj3I_yv#e9?9$OgYUQ zzT8;Nf$R(cB2?K33`4nGiOzC96J;5-ZbTaTdNKZSF+_r{)WH@foo&>}=hmCGqcyWo zmp9}|u|c8@0A;$Mi*+K(5lo>{p>O43rP4g-x_ggHM z&%~9In7!^EWMl+CFI{NiPT)q0If`E5qY#+IdcXkoraD#r=>eTw1S?XWON1Gpfu(>j z3sD8x&>U6O+X+}haY2( zvhlfXB2P9NO_oT1=Y~Q{NYhv34its*khM#d)yfXCB4{Hb(8gLM_#pcc*};pCzad#D zWD~I;$2O`DXUtS)`+_lrjXE9F9Gv?B`z-cGZNB-vMq zPY1yAAIhIFT{`XFWq60_I0L8x&nR8m#e@&#W^ceGcF(>X&4aB+ii&0t%-* zugNGd#VR&{7}EzV#WD&dG&d`K<1S*G2l??6|K0PTEDY=RyUTKbXaeH6laj|~^KvO0 zw%`<=G0kbMW>u7Xa_0j7_;+%LsD!(fk5%o%O}OWV;Mn|z@=z8}yITQTL)LzfjK3`qh`<+SlCM?pa!g~8Sv?zi#hXujwU7t|K%5~7h~BSkRnwol|EU47H@RwpZ3J`@&XHQmEpnA*KT|+-@Pao4Mh6@;5Xv zE#~DIXZ9S&1pzF5Z3X^;+$k#aY^DBHPNM)h@EfGvIvKcJLzkcemm#Q{9+oz)k`V^< zYSw)RywvpYt!cW?cGoJFPX>$rgfDq&&VTH<%Hgpbbre5%d#^GM?mF&?;9vfdP|+^8 zU#VFr#!;&djY$mpP>jo|#;30>a48=H7VNQPtvv{S)c|Nu#qlO>=4=N@vjYc({q7Sl z&C^ALY#`$1idRxI%b=CQ?uHCA+bFZ&N~aa_30-kYx4T^;wIBFloSffp%I2{G?`mTqFsSgNazi8m%ebT!)J}p#_ew@2&T`0nRLn|y z2rrXVg8+CDp*=Sut(0e#`o91!$q>SwaYT0Xv60S^FNGdg%lFz;UGVCZUJ5^y3yxAq z)yv@P)3(3_A)=;pd>K7?mqK4pji*L$OD~6S zC(|;VI+z0&C!6NV{xY1`dZ5qQ>sL>JB1cS8GZgI^KIPFExG&YBw(pOUZ;-gB0HgoP zvm2xT$TK$P|1HlJHGkM1t^f5M6(XiVy3}b;z8UUSwL-!zua=1Y+yUk6cI1#C-KV=fw1@i1 zh^Jd_Ke@b*B4&;kmi`T^d3)1M8j0mM!rn00)75GHos|H$eke7Xx|PkkKQCLQVbfB! z23Jckmdh9auqin7+yB{26BV{CO_BrkTLVQP? zz>wkMgBt3zFMPi%#MieGP4#GCU8WmI zpIdaz)M`!9oz#Hz`|>4pWHb6p+bvD{DwZrZ-qlpMlMM(?`kQt?3D3A7lw}C?7_e$+ zU3`bj1p9zB7!Kc@y*;gio5`7xrOXZ%mW%pL5H=v$r8x& zS_}TY5nd@e@yV1pFigHv5!9I2@un3W$V?BIqI1{WtkQca7G{wFeUP~m&Au3deqvpr zM1}%IbsZ$7eM{;38oF0BxXS8qP}b!|3$$o~6GV3J z%SqES@NWQ**|`MyIw1Tg#%Y}ITg+Exv#C`w-G2g~(%o?CjbH>z0p8o; zbU9ENR0O$X4`c2UW<1CIolq`+mc@xu7wRr&j**U=~2kdZfc)GpOo9V8LQz;9C zq5E|Co|>~#AiWaGlXDMP1v4vPnd`>nJ>395e-BXp{NK^Zwj zy<*k@XTi-JJx8wG({O8!aRX=qtC&el$n~$K@^{r-l9QdkC-Iw%WW)EbN@1aGqtKb+ z{qX==jfm0`H$E3%P^}Z+Myd)U9D$b`TRJdyM>GCk#SpoxDmyb78|mQ1APBfsc~iQd zg@&>cOfxZcMMof7k6Rm8Lt`RO{N-&YwKM6}jKmYl}Aby`G&)VEy)=}QFEAjSAco@dt3+ObTCo>2fPs*{FKD!~VN z#p^EFz0pQ(cpCg#Hc!M3)V411P|B@o*_XM`V*tMuOqih?vv%!~TPJVw=@>GO}v zX#62Pycc8VodRaHUvYhz=)G#^{2dy*rAjMIY( zh(Q(ZZ(g#dB(QA+F*$y-@fy~m7+ebsZ6vRsejmK>twml*kurOP-Izc#gM1TO=3tMs z2;WPE97r*e=Gx7KI2q4vGf8OVV^S;x36Hhn5}^hhQSqU+ zLvQ^KE_Gg0O7^VXwe`jJDFs-7aDJVT=c0jVXE@1UItZ(9oI7}{QbP^w>M|wZ+@QYC zZyI>Y<=VF*LXLzV%}Eb7oKxYnXfywAVKpH59!k%(o(*XE!qH6*|DKIO+v`)I>maSOvfWo-xdq@}8Q< zthYlkwU{n)jV5HRZH#`Sn%f*3^9f{f<$?HR$<~l6LdE|*0WUF1RZm`S8yvscDz;^0 zi(Q9nl;xB*6)bLc=9v^2@KOL8ORp1U2G3oFA@Db5*3w{Pu&$*XPcZ)|CF&-hKCd39 zk~mHl^{uVIhAJ|mFQLN&K&D!)Vvl1>Qe7W`Y4*ivI&;y#oa`(mECH{Leh+m0*-vZC z%i!e2Qp}%TXo*6a7}wlx_5;gfYTz^IIvDc< z8ua1RRjCUE0gVsEv(s!!C+W5|x_*E*e}@@-9vAG2dKLrXgh2hv(?hp0!@~y?{3Z?W z?ozE54IpGK+cgfr;P3H-oDxXdM%57wsyDnX?IYwUyq&@W^zG7Y!dUU$u=~6C16R>G zPim3%ionmajB_N|E_0>S%rp^c=2^)ZuNPWnS#L*xn4G8l>-`9|PB`v=I4hLhiXQ9| zZo3?*3caOVQ~Wkxs>}eTSV}?YPJkQN{9{*{kS%k^TyWJ{)h>C~os};+n3wZTM#zJ+ z^QO~jdth@4V2X^Mi%=Y#Ak8LT+gwQPC{%96RlriU_h7g*N*e#v#qKlDB_FVtHA--H z#N3m}2uR=*a3Uld7Z0Fb8VKW(EA4_bbt%$A)N? zch3dl@BJ-v`Mi;q{Ndp>uP6Hj)!*QrahkbVhKGPJNj1w>J(65fMgm|S9E{(6lwdabpEp#B+4;BUVNj4-8q_g{$q^x0mDi9mh>_vX1}2c;#O}u6F)E_0Dx@Z)w z<7a^_UIhAUzJ1t5=eRbk+$0Dp=98o<;_C*)50abNxs zJ1ir<+w;1>o5`=a6~!bx%LvnY*DzsPruL{aIfhv7mpG zTsyd@vJP2PJk0M@|GEN3_2ZLisxBlK!&-LN6Df4UyuG5t`Fed^mX*-YN$S-;$n>#y z159g=r`|dESw%mGh5W3qITMxIztVg)RWMZM6{+O}Cn8ViiwaZ1$4+&-7oHfM{ag z_h@G_WQ5eZc?ToTBbzaLXWu@f0Dc7q1L%g|Jm<^Jti`SI@!}B=p~4GpTPQW_3PIWlG9XJHXJ4T~QrjLaQnMo06=FddZvGFl4ry?JUy$Z!;B2Ec%t zd*GKYI>D zd;^Dp7#H?XO@1Q{=2I#D7<(g2`Z3{6c$RhZ%v8FyCyu@H%gDhQ36sjcL9z8>OVi=i zLZl*rSK+g=jSeErbFZ}0|2M-ID8NT^KdUw)Ha5=PijM~@nLo-~S$?TjH5RTs(hz1D z^hAQ0p>ZT{*Y<@T4YP`~O3VW|A_+=jzLcFY%1Luyk>q#o3&=_N2}|)yA3}mUv^9#R zKR0h{X97D8#dZ_jYU(II8i8hgSdaq(IMa+`_Cgxi4}DDVK@dxOT!t4Y5P-pp7(Xch z6ny|~dhG$^2^7atUsuKQUfPK?j_hDh=rrX1&~`Y?Oh~PaY4a9)yYXEA+U8J&$P{g> zLN5T;;BHg}wLds{wL5&Zz)o~xeX84!c+%!ij>IbtX>==T%Lc!0Y%;r*v?1E?;)n|w z(-|PpTlF4U+FyubKq66+41kFupD62EluWn{_#@M2+)8bA2BIEl7J(X#{(`R_!O7PtS_U@EZ$@S90X2;dKTA| zMDYp{olv0OMaZg<-F`NHWYQHW4JdLgV7w@>Sfwuzv~+?}2W&Om1mLWYfNt@jx35r- znE9f`cc{^3x(6;lfzzY$LKE$6rz9iNaAQpRd_I4$b#QLSr@{xgANqCOq}u4&dfNxw z{ELF%uA)77#dNC}zp@5nWk$#V;S^O6RJ#xw-wD-tmL6%qIm2~66QSR98m27oC}g!B zL?&3Ls0(6@Y7Pw25>RSc@=;Ea<7wvp2=LwRhN%Dw)ddR7u!kwHn1Un-a+43`s&3y- zwzcs%E4LKo|7+%r2`>Jdy65%fLGa1Nurp>_@WEvP<-Cdovth)-!L ztgTn4LEK>J+ymxXp~b@WzN$ZC@EbCaEiIUGaWu1Enc<#34B!B9LSqk{Gf=oQz#yi= zA(v|**0kYcDee5Zuz8uBN23v#xd*Mpmp4@=;UDWs!|aF}Z0$vRD}g6@(m)WAz_6uN z=#U2qddPm4!?AMhVETu+_tCs8N0>K(#1cKdtW^6LNp?vSgZ1sPOPbY`NqLjO1s0{U zZ?wZp3DvP&6)?^pa8bcr1^a10p;TfsZ9@|*Masjbg@-i2-=*&#w0lF!te&d=$<>-| z-)GJ{uvz>%@zSEZy2p=ttyn~hv9N0pR~rk3+T<)F?lmv~wFp0Ff?i^62i9}7n|PI# zq;-vLZ^6@~C`1QK9lQgt{pg=?o}@j^5@yFY5#m!(0+`i&&44PZh+VNuNA(hi1Kl)Q zTuFD$daO?1neKj`D{n?FwR+dKc`7YdCXRNd2!(VfRA$A^$y_UWF6y7|ezIi68E+Z; z9KqrzN1=i%l0EUmwtkEKQBAI~)Q2&vwY3i?<+?!@;uDV!X`7%#x@;}-H;G4)a*hdi zzlnwo03tXYGn70jflAhNm3eY>Rr~F{@X#u*TJKL;8^?gd$)3fhT$$|fgaR^(RS!bZ z{dG5b!p=g8X$`xPm}p!CrKCd=UcgK}hd940YINh*_DB|1j=&mnP~0kCRT;WQp4;qX zBDL~GBSHQ7Xz{bfa^4!Qb*B|0nlj62F2Z3o06VwPkrQm?Fkylq#YA((=Y~U|a=cZU z$G2NMg~HU!=t7}ZuSY3`bV1R;)qmaAKy~*?2)bcjCrFf7Z&?-}ybs-W#dz|={@c}u z__bK)FsrIrhQVa*n$fTidn=B-rIh__X zjYPMLzL?e+)wqAg=sXL{_Kcv@bnB&Csg4+hqv{jPgWLQ)3$dGs5kG^DciJ$eOJ@<%t z>l%-xG+INxMY6nv^_fhEmHE-U?G+D0k?4jk!-j@QzdGR0Z0~)U{BLCdjZ>5rV82pigZs;H z%;*=Dlz5~<`sj*7q`|C5^3?=9)hipLv@-^$NOYI4ClDTrCXL8czFO@kUg>aytO4w1sOin^#jY76>_grCj2zSeITfPK8Jrv zT7}m4I#YS@k!KruEVgiQkNY(E0}odaW1cR)hCMldzrufmDF=lO{MRkab^mb-nK=F* zSy`m{f5-wKzb0YO$dO&x?k+haF8 zU1$%}LTDTR@qq?|W?NVCU&uBtlRSK@*fL`EK_hS(qdQj$t|&t{(=%08MI(j#0?z}n z+3#7`WeL06d|$lm&_@wyk>knt4YDnkO#sTW?rZxhXFcY*ugl^2zm(5>!L!Aq@ZS~h zKg;7D0KPV4K@RozPdRaVciHZu9ry779KlA~f@t=!F1yIHaNbjz@F7sLVzt~m$29A* zIMELu&Ze}{6#8J9AqHc}uKDdBVc1-UB5Q)3{bAiNAFeHfqEDQ;DAV+;t-VUn6aYo% z!XWof6t8$9u5qpAaf^qKaXUAa$?#YuvpX1+B2AV>fbP1Bn^}vOS7iw z{{2XJbp>^xUGBDtC;@E!>|~b9)r3VDae4PFh)4ddP0Pe>{TtqgN(kFRN}%NHD{&mA zVE96M{ZUKjNyK1^7uw=ubs6YB} zL5qo+{?7QA=&iyv$~1De$3RV@)R|SEM59;K(=YEG+%08ZRl@KOmuVGQcX{v&>r{37 zxG2*I9!qiht~0Li`_?O-@P<}B)P&wacdw|GT1uI=Y`z6(KH7Gs4`T%p7{J<}Ebk%8 zO$N13K9F7Pp}q2#)+icpDr$L<>yuQ7fnGIOE zKB?9&0z(2~r~r%rL)L6H!TO;1F^08QBMN^cD^f~l;&{HgWf|xkik~DVTa6o~BA59jLrUtwm ze1`cb3uZ;3I}%8jAbBMEU_kG%3~L{axR?_FtuNNApVsk)hGCu|%GQ<8#3`w*MxqMo zU_}8m*>8Ym<+FnUNKU>@sUD*%Y!nJ04lYLF&$tSpzmdwqj=6+$QKK`WSWY9$GYc?JZGA69;rwJs>u~3K#N!!9-C@l{Xht zX<`}cUg3C|MnMWTt7#ANP*J)N{61J5Q{5yCZ6DR=YLgsboL^Kb*WWp;_spIeO7UoP z_uCoPbU&v;5t=Ge100!gf^y+Yh{B4Le0<~gXv2J^bcw*PMbFCC4Nw;_8HIY6iDXYQqO2g0NnR7;v9}RRwL3*_n@9V znVd8=3F&erC76OuffRD+P2=+(f)O$!w*L;_C-=n_gxLL)BY#gKxxx2|6T<9iCV!YH znk3D!l0JEpDcfxE;45`_<2C3AXXcx^mWCAwe2ZWJ?03Iw@CAvSeTLru%)baC;aQDV z+9Gci?TAFD1Axj*V65|c7T2rNNVWe4u8|kk=lF}wWmpAX8`5|8-bU9i*%hSfNXfL> z`dh(#6~1Z@;{g;Nc*@Hp!vi4xGKaL<_N`c6yP{S8WT}`ptRflZR3a+1NlH!VAX@w; zEAh*gqu;07j~KT|2AV3q+;CF69h2Z1jzHc@D5-kJ0uV32!*7JUC^GAHLx~8lH3Xa? zmxcZ@&nqHQgm7ZAZKwvNVz*7HS3MjzgB*WXn3NS0uCJ<31V#kil9Jvgf)L#iFBwi+ z9#WoQ#o85Aop6GYUwWaXuGDj(CL0ALcm0x7*!W!bk}wi1KLqhuM05CbM`1u(VUi%o znBWt13#eXf@U_#CR*FG6-FqqEpea5j19`saWM{yC!!jWEcoeA5x56gpXmm(j!8Xhz zgB_4bEn-ydVxBt;V5Sz9FSqy(dk-bMCNnlr@*dX92j1`;)&b3vd7i>g_uz90U0XWZ z;X1(dj<0>hph2mZy&3$NbL)sHazczQ6BGx=1FS9WG%6R})!TK?U~;h$r+TI*oDe~3 zcuPPWu59EU<>O8*bpLklzj0z;06k8RUH>&qRTF0dEym17plO{n)$3_#8#qP8(&6XC zg>5Ui%8Cf`%Lpkt^Vk&V8cuP3K|_mhS6A2BB0pTl;}*nD94#)kwSu^u`=#rNMXF`4 z4WPI-0Hqisxl_|pYACN#9gsL4m6m=SD#JRux+zq-q*T!>zUcZv!Vc9{Nm(WUIAY!kEiS{h7zfji{}#FC;*wWVeFq4 zPm_*q0y?SXxo4(S)t9j+Xqn;pDE(}_*Lu_WaDZS9(X5D6DDVw+aK-lT>1{|l*`0&y zj}R&JZStPS7XEV;wC}eX`^;yf&{yp4#r=cUs>*Az?x_pBZ&l0q9aBozfMHUS0)CVj2lM|!VcpakojPcR?LMaX068?*^Tl_8 zjD?9^C;1EQSUQv~bwuwpdM*Y{p%77_z3KED%l5s6G@OXyj<`tEN9(1(pRZfJPJLhP zIAyqIcSvsc&7}4FaQ*JM=QOBck!d=`?%i?MGiicWyK*D+aQ$9SPa3dgt2Q+7mrdIC ztbCui#}Vx+L#jsDdrQUIu?v!7FJ)y#kH>oj@0Fn$5NOrm_?YyT{_+N1gTKOqw70Sx zA{Al=Y`myKikCaz5ZN~L=QSy##P)f^CZ$fR^?cCFP^34f7*kC#`5x!lds`&?*fpTT z&i&=NrH4)u{8j@q5E>9auXfcFzVN%`qdDk2?%FN;?dx$pFZ)J>7s1^_P54Y+XuIzhD_Vnt&#F_O8-H>I| zcs+t(p@n2lH!75dJRBsKW#J0OtlxB2mS!5^50MtOyh2?}H3DE*8TvRmxJ-X(x)oj{ zNx^C7J`d&k7|izl=j?Nw`Jc#*3g{vzRB#9Z3UR;m%ihFTK;K6^i~JtU@?t6xBWz#-Q$f*lE?{a2$yGrN7Q5;ts0oSF8ciSTO#-x}kHFa#!vW2RMH? zy%BoX#p-j)<<81dkXTs4{%^fR1wsN#C}CtO70mevGyxWr#buchdP3==%~Uj^AQgG0 z&ZSMJgp2f0OS7=(A`}wFYvof`&Vz?8hn-kg(#d&Ven4VWK8AoKh~EUx?qo_5s(T~p zR02e7@{xc5kGLc?nxN8PWVYFKtP}a(VXo6oHba}h0HP{r1(v&KV!aL_T}XWJ5b=KB z#fFmMvf2cC0psM)#P1oGqn*O9RD77 z6)0LHk-?=Fh7^1^a-Fzh_1ef%_r4h&HQKir>8}8_+z9zn*E150vNh1+4(gdm{k46e zZfAe*ogFrlNV9{A)KO0gAe{#wmnCM9?E<@7Y0(6s2Q+Rz>%sN!wwT2etJMjliT!=; z>*8GC+hj+RJ`^(lUe1;DMW`J?a*7YYMwh9bo2{J>K6*T;v7qpT!EijLsMOVXGtft{ z3ZVhk3SN#Phct;HEk*Fjy7a)FrNm{J-G*emV*pgKy5cRCMu>A(ZRxRcnZXa-wZ>^& zjvDVV`kuzH44=?j#i`x9mod&!!>O?cKEEDVg`T$HVi36N_;Imyiks^sB9o);F{z*f z{^IH1UK||L%KcjOI!0#R5Bm(0y2$;+-JJonnct-zzz!B%+I@2GRFlk*CCbNBtR{=_ zO3110hIE#yNoowzIpNK^4*SDRh)BE8!ROtO#7-2e8-W<82HeE_ag^l8W}i4Hl;nFQ z7WfK5#A=7)H!tY|C2HIX%Bt#&B>jU(MPoAwr8ilj8AjE8qn_)Ky+lvff4eips1ym% zDmH1I;MuB)JB;PRm|oy+INFuj zjC-)_h|d`BfkWb%^N+N$I1mkR#8<6QR1Yom zNWYZQR;hTSpPIM|=XURn>}3HBT-^#;s)PkiW0(uA=Dy*e_tr!Y0@dJ;94uKtX_05_ zB+^q-Ye#~i0Y`KyA?(FL8;h5)&UFwpRf7C$t>kQ(Xa6yh3cnfv_e`Tb9r?wWl~+RzQ-I*V48Es3!Ma^ojnJ$N-r8oAH(issCNc{VtSQnV#PnW7PI^{~uWwJ4_ zrl3BcX#%VaE4=1E7q2MF7*bhl`GN;v+oV#}oBb|`Fgjr2Miu}Gq^M)>j;X~^kZw2Y z*-@{N--R!UkSHk(qomRn4-ys}ZIa>)o!N)wKH@6G zxB>5bPvw{tEn)ysRy;@Lu=4Wr`yMst5Pv?P$%n$hpX^NTe;9+k6zq5CYe|Rxs$DG+$e;4X zFJbugf?aN7z2q{i;yjT!K7qF_bB9|vt-kV%IPNDgO8jP9{*dW%8yWl&`@CBhz_FL4 zvY^|l`wki=b-mGat9I>)OqH9w?lvk;d3zBoBruPiL$2r0u_O>&6BxGG3$Bh;jH;YW zSCUONN-hA3xo%HH?>wvC0<&_(KKAC&FFz2(xh6Ck&Aq?&UJla8(s~s>UTST~E5OF| zcrAk96+FAYXNcKlf;CIVL;BlumKKrSYT!b>t0Y8J&5-)88 zZ_=u4977Ed?s*9IP^eD-iXmv6D3jUp^YfSmns)=3D?cAU`wT3gE`^)SDk*SeX3<2c zufVvY!I@fsjr*_^YVVF!``3M{MEN`DA@>rC+xF3_lvEBk{`{-9oOokNcj>2=FM799 zdz6<4CAQ*IEQv$>P%<(N&n1iBKMoLiHUQ<3TllpFB@)F~l;&AI+cF7MZkBBr7HYc= z+YSIg=k>_zSrn!xC3l$YMyD;Xgqrt?|n?ojFr&H8EK-77-=i1i*m-Kk=+ z^~AzI9PjYH>SJ+6u>E7&%;dO>TJSi+zi|M*ao2qn{Un`J!;OO119n@h+qfX+I z^EC;n?k|7H{`@iH$@p~sChdG-(EeWA{JvxOe1%|wn&N&od|N3_pqF-FgBlG?njgN4 zVFIWvpNmA;Z&RyPbf>|1|I@WxSGGpGA{)&Xj=L!#-KV5>%-&DF&X~B@ zuCad>{!iDE*#b3rx~vw^TI+a3^wCzWnWU_}Y`=N`Nv62osEi=CxZ^w}D3W&4CHA zOJpm9y6Vp<&bw?13c+zYnMZkS$B|=AWmOfs$|of^TJ=Gy&d>vDg3HdAyEW=gX&7LY zsRacgGPn1jY5i;cOX4`T`~ATps+8_?pGkb^-j=M{H7loB!C=qC$Rd`=Xd?#VhU!do zP5yNR*SV!8ifmc#TmHel*OyI}*cS*8+mhEc{gx;|=Lv9DN!mFwxq|3c)np5iMiS*B zZ;mUv7?kKzIF<%Lr|_jG;D}tA^T=$jwu`n;*}%?DF^m=Q4%PEKBi_&;e<-cUy`b5a zenhR%qQS|Kx9R~+b6}c+6VOU~@z%{tWGtsoK@xg&{GsDV~k zVSU^RADQONPNC1V$n1sY(+&QtKJ14QP)#AxT!mui$=CpQ<(H~_R>?goXOzVnp;SQr zoYxyJ*C}lk^$(NBEl+i2m8DE$1Vmy|3Dlv)Zae+Q5$kh8ijl!Ro<%40tWQv;=Z`J; zqd7eyw8#?}QKJ_JV8|fz8XiJWHrLe2leCTKyQpkC)QV#yVRxs)lB00>e)%i`{#XYp zylmMl`)B~fw@<^-v31K@Fd4m64(NL_WOPGQSt;)OyYl@zpx^!(7z`SiM?_=>xbv>rK3XMJdMa}M0+{_#KmvjsXdB?YRKe8a!BQ<)7i z&7CuEdG^AGYm8>jf3#=he)zt^leh8J(!U6AV%GsfYSV+j*1HZ9RQ(B!r z6t0_}fF`eD+Y$WHkVSGCeub0vU#O!NYl6cn9?0535`*3ZVG*MZZlJ!8foKjUHoGbW zGQv*Um+Cu)D(_T_N3WvKY!HI9x)NrUN+pYv)j$YvLB%b&NXNO1L0u4OXDPpx?yCa$ ztM&m!nr4E&77xKmNFn?VuF#4xqzW;1!tt<8RaEig`a(m%mJx<1gr|bVlj=^YphvKY z%YuzaE`QL;t886l=VE9m7;gx_Hx2%B)sI=)OjEJO3u=?vfWik@SDU&Oay(s#MUa)( ztpb}YwSu_M<=e-$Pf588pg9Jjz68*J*n9;L45sF zHHVGTODM14pbS%?g3?(4y)WMc{vwku%sN8$BEnv!a2Fk*JXnj-(E{r?W28&JZ&D6O zE9K731P^D={D6Ze>i%9;{Do^FT*v-%?NBa{U>{iS|D)<00y6>Dr5)S0ZQHhO+x8cG zl1yydoY=N)+n(soJ@;SyXW7f{-c(oD`&2c#G6UY~zs*g5oC_4HExieV9E~P#X8vVP zCPmY>_fVE9*d3{(6mRcQL1IUHq=U8|R^8Qt95WaG<2&u88j{d;=%vUGgPE)3)sh9e z?AmywzilG9Z_Dl=hf_N63UFG!YU^o4^pEQbUaY?QMWk=TLAzV%cAcJd@Na>8lCx2Q z#BF}I2w!7aS{?rw|J7L(Y8tlUMl~x^IMyqO_@*ZAh52ra){tx&vKEVx?L?;uT@Q)R z1ntRe!X*mhP9~v)K!0uR4y}%!_9K2KiWLM#k&0GpMYeg%p=KfhNb>NHjm2H-Aqga= z)XJ_7lk`PC@XKbc5WYDXEh*oRm2VNuruj41WDI>A5N}~C{S&RG$%<2$-;fAsCX?GA z7f=olR=T{tAe8S`63mk;RU+mxkk#J<1*0%f!0dXcII++?xIqa{tGw4&q3E{Lw~M6; zk<8%QedNQeGGWn)G*iJ08hQsuM|+V zrR;QfW7P3R%M-&n$*D)heihl;*%oWu56F;aAqTYbf>he;;*-IVf)99WPDiPtS8Zu3 zT7iq+#;CzRNUwBi%k)UTc-_9>@();th>K{0ZM^KHnZ0y%|4LOzT30KQls1Ub-fJP0 z3&0#+0ut8*B*lRSu%lB0!B&h-zUi?1CioQW)kR-K=j83ORyFvAXhc>awzUqw>+QF7 zg7$3zGPCKl-=@6Z*y@zWNVz}Q5#|?jxyi2AuW(DFN4(Y!e$@-P**mHBIdN;xChG60 z$5_bL6Bh3P%a+<+bZ4xVnxWr_>wnrFvI)2AaR2QGDC_c#A)7e!P3^OOa^?6aXuM92rSDyEWHf9G545+9E(!R26T^gjku`NcRW z3VSC8IZnn?$IIvBN%SD1#i=f!Gm2jq5@~qwFOA_X`H&1bmg|{3sH9e?x`;lBgLlw8 zwMrlZ@MuKLc}?-Grf%BRse*)-BTZo+ugqIryqgiL@JwSBBeL;nWK#{ygPSgvflHPQ zH!Db)w*x4Z{!2#0-?=mg0oo3OQ8z}>mF)b<2$m6?yRS5W> zFnDikD&S&Wrtg9EPF7*g;-;^&)Se3Nc!M4S*j;6kDh8_@xg3q;$0pUrXJSn_V!vHH zEW%6%q6Bz1dk&j{r8E+oAPeD>SV=Z+>qfL5XpihdDO!as{?L}G?UHXgfZ-5vnl+VB=+C0U!Q|SL_WpV~?gG-oT?kI&?<@w# zzo46qGehiP3D?F{8ldjC(C^%kpzM03Z2#W`=J|Q+!^OS#jmyuw;tx1CupZq1slCk9 ze>@*{=KmIZ<8hB|$p8G=ClHM`Mj_D%U<%M94(Z)sJUZP8a@X|sqi59v9dTucb^Fi0 z{DM?@S+$1Lx*i&vH~&4*5J3SgX01cX(}+z+raM@?pY!(+d&1a5!+8a?;`a?m0kZPN9Yid*CT4&Y{DU`0(nx+<>|&q<2c0@fK`k`x8$ zTHl;Izad6hoS%_z*f;Ok;ddXdH^umNFZbu}w2Q5mi-Y0LOMSgh8vPRq?;o5t@f>xJ zJ#e$#6Zj)Z7Boe3X&c6zf7$ZYk<_}jmo`zde11IMh9u?-&k2?`L`I)7v5gng7?)p#glibU4Soew&Si*jI7Qu{VZ-7}kk5;}U= zm_eMsa%9-m9^lUd=%O16R~Rt_1{%jZ&nG-7XoFqg)kUam98o|`a_Kcgc4Q@K=muKW?XZwZMmdlw7hnZrv zFy4BK!g}7o7pXKrGDA3+Ih06)R6o4aSom&3WvN9{ z$;DWROjIs(LG{`LTo#lLXKHT4TAp`y!_nW-h-ztM|EgoAP{de6Hp|vti}nJ5^yaow z?#i7n;3|pc6p=H1*_o*wn zl1j?;b1pZ}7Kaf;Q!)GEkwcfX$s^g&KeGVg!@Vy77p^N~K3r4mTLIBn>pl@4^~ zD>f)BM5FS1HcG3iy1i+IRswhB5K0kNi6VH>>ib?AL7RxYCG`YHHx{9P@|9BY z`_R4u0@K={z$HtzsNnhN<##1VGrqJ)9*cmE>?0$f!Wp0AMoK2}lq_6#a%Jgx1QEtN zh`>!YaE-6ohU(eZ($e@_%(-xRCCqG{ljSHMKY zgiAOTd)XB~K5;cJ8BK-5L?iq`yV{ZuYqJptl*9_`uU>7IoXH!^uJQ@i$tFVeIH+H; z6Sg4z`eGSdSgq`LE4cFl+lUU;9r$b^-tD>HJ&1$A?IupV0OfVpVyWxttXZ>!Vgf&z zym$#u25)Dt6Up^N(F)u(1}|)T9gTVllPNHsl8Befd}XqzpocnVF+Gusm5F{#))rC$ zFp1!igMZ^sWSdVWzyEg9pOFjowS3XmdvUzN%xKcnb?cJ@_vNRK-O;qpDpj>m-8~1} zG(}4$oeB8;@Uos?$)%5p!|m0AP0bR{y#L1v)G{I-10g}Iy#9dePhUgMZPFgwx42G@ zZCmFq`!Ag%-(-~dNOBv_VzPe!ED}Umz{3Xh^T)}G$R-@+qoz&j5qa+5?m$q;nXCBv z$9`xnn*a=aC4MTL3MRHgXGivHeH~${>90Xk@SJC_a3t=UiIeZ9p>tFCC0u%3WUK>R zDjjV3lE@GZLh55snd_+HW^!ePjrKVy{@GEV(c+7a&Nt;A;uNcWvoIy>~M}qnZ!O`Tl=Vi8GC(M>MH0;f!PE}+qd=;7T&p3wq zmh=@_Tt*{^yG#PFI)~`6Uk@kXH3{`~g{3B!@R@5r`0O?_2Ne?hc|)$hH|TXF6_T`Q;tHcG_@8#&O;-$OI>}Tb@~Z zHLg@JW|KM{P8cVn`s14PtC^({q}9g1h$Z|@|HKn4YLi7@rza{_t8CYpuBu4p`<1{(CTJf(hb z)h$@vzN}Dp+LAEp+SyY`UP?%n{LS#n@l9?>H!Ix)^8yK}-c=h)r!7>-IwchA(Dk0O z{)185a~fZvsanmV$d$DB2LOJ*NTDux>#FG7QCo8AFmC8)R#N{(r$lop0i8mz^CTxq z>FJvSxx@+R**2Iax}*xx%#FxIyO(LP=Sp7J1^+Q=sUfbANr=+eWR+Ea{o-BrNWDI` z$%1-avH95S*8Ji!%$Q0Z%B49Ru2sB2x=58zm>s-4o9q!d%C_131pU(~ z`A(Kd(A-zC+74&yP&c%|W%nw0JFfA)r7_xCHJiO`P%E&R{NWYDHZvQK@`M<$UbX5% z5%=<~;aajpjp0-0&#wL07JW8yBZt$$xQx~=B}^^<4`-*yY*oC7?pHcR#CNogH4?6) zx!_acZUL*RwV;=32yVoxso9f$& zj!BL7{Y))thMq-yQ+~Zy!?z(AIDC)Oc5;sUcfi-=53tqt?BoAQp2WO=l82k~za`IP z?GXpU_N?X`q)bsOUH+bUUi9Oewp#m@U81-TYp)=hxODRML(RVqNZ~>Iv}#Ck zm58Hz{BNu!qWwIaV1nRyli0yeUN*m=%hm0#i1_`yACHhkl8N&0c=t9c%2>FN1rcw4 zKfZt-8CO83yhgwO^8%fR%ek_=%z!_3gLK*Haw)^2IBw2P@r-lylS#&->4o56i`;~P zbG70$r%mqU9ougjQ&K&ITy}X|${3cpd`W#*X~mPw&ck|Nfgg@BTz|Y{I6XetF(!&7T<$u=JHb&ctUoS1*M_qiG$G?Ce zgz>>y_>TrJIPw1LZOF4h+x*<^Zg^gJ-KmCVh{}M@9ioLhlEM&|#lAgONlte&BD81Q z4Xs{$P4%q**+F$eq6O={ax=AX>#~Vy1LAt9S|`SG;zbjyxqdLW5Dzu4EDL4&CTw<2 zsT5!(Z93?c;Iux(r+RU?S-q)_e714@MLUvexlmv=4B4i6kX#HnAcMVN<^9pwDErJ` zP>F^cJLBfCI5AMg=FQj{phCUz@2^-TCiUq=c~=V$q%eeJ!HKCx!CsmD;o&~h z_kz54*Z`S9|0I!g8rX3uQylnL;DwrxuPor}K33L$*2UL8;g z(~_oW#@u(AU>+Lx8TVxm^he``>8!PVbYLWHS2pKVm}ix3^`Q{2?!q95Aw<=Ysu$PV z#Lk$?lxu2*L=6V*oU$;+OnG9lzt^z=$ap-KxMhqWj_crK0b2B59r<4{sq?VY{1d>M z3$biWx9D(cWA5}m^k9n2V&a_Z1@lSU(1-#I@m#XOcnDCw+xlB0(%c0d!A;915u$6G z;j#!0z`~dbLpDcCDqf`WmY0BqHe)X++tG}O2pNk8NGL{H(meW8E@fsp{!wk&GcUKl z+0Tqh{T4ham6UHF#o)!uHtgjdKOS&OYN&B$7}`BPto-c7Rc;#6Xoo2JmayupEouN$ zHtNYXBq<}kDc=XPA<~;j8=)K6WVb^?<+H&6j5-l^^Dj?_#};5ao{S8vpphphjVSHL z4=>EaDx!ibthgfT;NII0UeAi#w&%8kU)q)KI-R-UuTqr*T5Mbi*8_=jRRX|Wd<=mI zl@7BF;N)#1dDe9*Y`$$CqZ~ic_OU8~npX)pOJl>=+aqqX({UNWLwUhE(r^aM=J)dbruY7KnQILBC(U{LSrg@{+fMP zXBNlxsEPIF2190AomGpR~D4o6I8YJ zREo7!qUgvr?qX(ZSxeBtJ?O=$_+qzzOqH1Uty{Gij7>7!*Sl?vsQqIZ3?1(H{xP>j zHp;QS`PDk6BG_mHQIZuy(|CQvUKN4Kr;q7%O#y35mV=kmZwkb;0b4hMuu%Ny+4ccr zZ$x)|z61(FL^fTKss<*HUD-^R?mUb1QV-6Ff-_TE7%4a~QO1?AcUspsj%vk%uv922 zEtdqMrz1p@8&bOBoCLVq?>7pg_XZH`ro)mb>Iv}6@~7}d6gnTOxr&Rgja+PRox?|y ziGt_G!O5DVZ@~yQ{|N+tZ>?N>mzVC@d=e4&B_l9uM^8UYbVRu=`&;RUj=&9)Gwe7X zi3e+gUT+5r&*R!UBx)xO)@0t5sJ@(H4{Zb8BDnd92V=-6#|zk)b&LX48Q`9j&Q~LW zGUY!EvQbq8zxH2?VeW&|fGCiBFp^)+j(TfM)Gn}TC8E*1EmdGDLSJB|u^YK)2!o!@ zSMKTX1m?Z{+IJ~LU4Xj1Gnk+kqCVa&}odkWdv{L#=NgCI{fi5zY*5NtbA!jfh zM~O#Hb9?NLoNW1`iFBdjg_t+!<`c!`j>be^WbjMVCIy`R(f3C|AhIgS!7F40P0D=a zz`(LLSklZldOb@x`MFP-CbQA!NWPtysh)6RcOSgqA`$f%e=eH@=SDBGim;eG>=9E_ z!tdtbP@>l_xQ?vzGSZVCuIki~38sRh*;b`sGq5G^ng4=)BCQ~Y%_bLhmW^&#(0Jjs ztq$tu_y#}(bl56lb`AMi4A9+k@hXJFru&w(VB@NgRp)`@F#T?7X3er00m^k`Eznhmit(6x4Bj9 z6v(i@4Bhn^bd%tS45!k_%#$ZEO30LZUc-rWCtY0k;{M6b6ABmkh<=+0rY!CZZ{WENlRL>2Y zD0KSmJK#dOw|E~?2F{{dTNh={&l$J5;QZaNUEPAX;SN)N&v#E@=G=?FHhJ`dM_+!0 z>jDx%RpR+$yOO4CXeCf}Ic!6qbh>k=Hj>Y?^b5ZN$dB~`qdHs)+3*2sg2b|Vq1$Ut zVyU4b%3!i=q0?$$3rNh1Xeo#qzbeZ=qh|1=4&`zaaotbk?D$L#B3ag%|5%-Z?ws(R zA=e2b&pfg$XwEsfjX{G{p8cV&-$ z>%PDQxvyz4;z4Zkf3%Bha49`u(O`p8t+RfSRgzqjeO$hJ$9>M2U2jQ5Z@q|;$WS0! zo=owvx^h{Tw=kL&xYH#cThh1V8(zBhoSU&0?5xZ%OE8pMoNS zSgF3vnmio|lQS?SzPdCrbrpD2GEv+KVUAEwGQ%9=Bib2@4EPI`NQXoA)U(_XVPLr3 z32+fr5Y6Zq9IG1h7Z-&v*bzYk`q4Q=82(Y)rFBrkLLyxY>9dETc)|y$;p&p;@ZMM2 z8dx_H?*_E7g}KCR`z!j9X2idPtGXZ|iH5kJR zLNmbCB881mz)v`loMiIYnV2lg5$SHxlfl-=rzpZLkyJ5*lhLf$&u5S@eAD-&-M!MlSNX? zEpf>xF`;^k571#T)g%uA)+wlI>P8)*Noi@)rLn}ZT~e7~?1Fhfy44NtBQ?dKHbuf^ zLa^|#@vO(TM3`ifNDRPj``$2KHI!)2Vh_-PN$Tq{!S$KB2DaT?*f^BT(S~H2RKp+b z*l%pDM3fZp!iIL?;Fnd6oe{I@fcPg8ePCPEQdMn?>tSGGeX$Gx$YYSz((6#tS~^up z?{&>8VL$ZKY*pnY-XiSG1jV&RKUlL5Fp4Ro{>hU|qJqh3>8`K{Xvs*Vx;UNWentw( zuYsVjIKV(%Ag45Eh%+HPDTOT49kHt+}fdnU#?0$ZCgB zMPe5fVf~e7Qm}RaE#Yk@nBwC64ZZ;{C9W|dBp)k<)Q#lo0V*Y?l=6zy4KRJs=RLI& zt2bOFX%q^&D?M5Gl$KB^Yc2vg16j!#<76G5{NLngQX;>8b#W*M)DzU8v4i}um8M9F z2{L+z-m8Uv=~@-8sNBN<Eyiil!55LH_G63P}dq6~h~+Md5Nwe4`~s zl~fBc09In6*u(vsWIV5x!5lpXkF9#qhG}-nRwtD|YhIq30Q?SWh3deOhomb03`m zmC!{Z@h#y6_*WFTHHcaXoX5p-1p3ol7RRIbbdrO|FTWy2#l$S|&?ROE36lVdAGr}X zhJO}~mm@+H$<33yXT-XMh!15dMhX8k=ntx&D2EqzS4WL`AzQ4^&9eZd61D#X{dPmr z4O;TC+N)8w!c z_t)jG%hmh5cK%-6?ae3qX*N!U}pduqwwx(*ye( zR1VgBk!R@tY?xI#9B<{UGFDCZHYDclC?0K%+dPC!KN8tzohkzavByJt)a0$Qry)^X zPGpq?xKjgBz%I519@;>n*9<+A70JfTEs#kZK=!!HF^)*n0NQ9JPX4_!02XFee2^Sj zOiw{vvkgH{+U?E&)d2`iCy@aO#31glpJQ3j6)MZW4aK%>?pFiOX%&jbIj8>&VWRPs z+-JYnhuOP2v1%8dNqH%yLMtFVA=UTr6j?L}SXm{+>XMA^P(TJ491Ve*F%Jqw6Ae)O zI)~s65K{;&WNL_3PM0G*&S&tC%X&|4Eb;G)^*y{iR zfOrQT!5&Hfy`le&DtXk0Pv%3FWIRVknz#;umW7N)T7&_7PJ#k~jK6qBr$D_DKhZc+x`+%=(R7pn{c~Z;11XVAI zS&Bk`>XKsarXE~pOUfQS5hVxz_xN~=#6YpgR`W*3?+uXU(EUWRD=Kc-tndgo04C~F zwJzLeU=1(aXQNLk%p_=RW9vof$Ml_R%jl!^`K<$Jwd*%e2|| zTSm&k`m3MT%F?P*f{iANjp@_vLd@-pw#=4Ai+N6e_q(2}OBiMy_bgjj^}R&*W^QpY zy9gnNQK@C9g5rIb8WeBiU9oa{K$;Q%La^H^oce5}u#5lLa8-==$9Y7EA(H@ukHG0c z+WXJcslUU=`pA~`!8hJxJP!pX6VmVxa>}sq|X zhe-NQo|eN!S5suyBT9a0vKqmO2ln0u+nsNF(v$0Yo5shk>m|?yBn*l`z~Ag6Nc_;~ zm!Qp2_th`l(Js7;rpC_#Wyjz{OVkMqvj$t4fMBi$LF>!{M-6(pE??c($?E&nZ?*2X zllz^c_k%QdJHd5bcFSoJLV!9rh4A;Q1%(6>R7kXIL1*D0#QKLO-_UOh&NZLL zi@yPly9m=}fDW59(N3;!0NDu}Dvd_1lYFW<67rsrXGptaz?*}M((Cm8QQ6m*;(-iA z{{To58Ik_!)DBK7uHHZIBW8TjQ?yBEscBr5iLL7gZ6^_hE>BnkRSSgVHvpnnSZ^!2 zxi<9i<$BYl{lY5qc=IG*?AyO1SZ$)vRVgxBGSNr}nLqw`|^&?t#^U z^SeApiq1dK*5X$>+PK{YNBrjg(UTC-buH1#2zKT^0hr%YfLN{^N%_!UPB9s>RTx4J zdy9x?CB!P9zoptyfIrxAjZBE0*5bAm8j`A2g??^5k*XJ)Vx&*V)pRlnT90hx5+kYFk#O?tu5gtt!p*=7;w}zZM&e zh)?V{pRUSNSAyPh%+WILXDtGPUu5~kM*W$r3RIzi2CCGD8lrc*1nd0C%$_4jIoke& zoD`tVHr_mPfN#V|r#6A}14qU@f$x*fGD3(jEFc&jL3Z;Ny9B*T1w=I{nN-8Pm+L~| z^p8Sbhq6{NrUL<@qo(lZ>38Xlc!f~L0bhR}w?`iL>PSZHO~Z2<`SA_#ZZvQC|FHjrSy5xaxpsDBYwTfLm-zw=&|usk=piA;;p&ncfj$ zsVdLkT#@zWQdQZJP(z#c{Q{tSQD@O!%UjpTDd&-L*{M!IOVhf}ahCYI4*-7?$fU~A zuzRDb$KGbEqE5)=z4&scdAi8@JDpB*TKU5Pub?4d%{3(9n6)MSP>#{l{2VkX6z_Jz z{K`ELu>9(2g0ku9|q%n-mSjb+;#89&z3K&?1qX(2|Fh&oKJW9k}}xf1zWv{_J6 z#=^+oZ5O~FrkTq($US|Ll*+26BBbY_4nuMqkYFIzeU5fgOz1=PRb7SXSo_OR2|fSJ zTbcuNi)O|4qn@|QMA2fqA6Vh<(69ic{HXy0ASKlE2ql&1P=ooM*k|T`;}bz(x1;Q( z%dg|-0*2*w0ZSHWVv~=YHlkfn!H!Q{@}`UL-ThDPo7Kf~p$L`#Ld}e(cx}o*t}JRR zERtv&aAM3F&n+UFas_=g+0vu~$0Y+)kDh|o51gA}4tv!F3Gjs7oZ4!T)$a`Cg zF6XsDacNY3Q-h9f_hUtVG9ezu5#gUW)L@b=2~@I-|>gWuXn% zUR6ZQ##OlTbVkM;`P+VDLGeMwr`3uD5Kxn8-U_lkk$IGe{Tr)AYKtTeNklRc52?p~ z11&4eYqQ5XZQ8g~!SM}Vl=SE-jzSX6d6$6k0=WNa%&7X+7B5BRXnS4Ro;a$#Y3ry9 zW>8A0=#yt?iP*8-so!q&>Cd!Z?>}z8*)xF6@g#6TowZNapq-z=%Q=a{DejsEAZOCz zH_>0Y1>xrYnJPN3 z*iFE+Q=O?Xs1=(9{OkM;gr8OoV8Xm9vlSF`y$*bJyONCgt2{O*x37$Z=*#>OmIvgT z0FTvgqxS1~OAn*tc4;g9qY-q-EH5>tUHJ}>sjuQ;?UKE6TuG4WvNE%(7!Z-9&I#9a zX-@9_kr1Vs%|&l=W85g3olLO4+ISh!s9l{=q=6_j5>Itcp7R5G|Yf3027gd z95+-N1=zvvXJ2oERQvD!7r|!Q%ETib3j8-% z4!uBtW~cbcv&G2y_mK2+P{xCu`zR#B?`|Gs%rN}|00hEUgz7&zH7@(+PaLT(-E)$kQ7ti{H?qw|J~%@b~t~1V@t2m zAGaQ=*SS#okk?fuNpTvyZ}r}aQ+W_8j*f!l7Q}(LyP@%;RfklJW6IO;Crgl{-CO7| zAO6PIcVD0$02$tJ`p@?IYclr1?q8ZV1U^bjd7P#FYcPn@C7zD+nnkR4PV;p36DV=v zbpO2u=+qD0``)5>BYIvt_IhbdeKMu-)9wxn6(t7RQg~kBSAU~`^jw+9(R8=Y3bZ}f zP+v{kgnm}KMEmLa8GNng$?3Y-VT&18Zq5Ac7O1+-hFsC}g{YW6)!(|3y3ARRo4RR5 zXk-QITjpu73YRggGLGlDeeKdRKEer{cb26E#QxJM%@G-;lm2G@JB;h`AOAc@-@TWE z@;^&g`vzbvyq2$5u-FE4-n+^BX|^~m^8!x1wHcA3`6VuBs8-rEL$`MI^RxnHd16Eje=cTFqH;ww=rDD+;+l#UsueB@`S0ZqgVZquWakd4>r$=WRrxb0WkPf!i`of$W8_?(Bs#14ic8;b%)SxfgQF7+T`ZQs!p)-%_!<}mqP;c;- zywkhaklV*s(i7*v`2JGjMk%WFSAvf&x5{oMTP{=d#;wM*)~z(}?Rn{XYMVoTyS~Nx z#+ru4u){%bTOnh$&AF4>;I!k2!^8FM@qKmN$}Mm8Z0m~KH~3Ah8=zqcGZ{S^w#i!D zBPh7LUA7RA6B^gA@U!IqAad}WHqJ$9H~0Sc_WbqyaX#AV`R!WO^Zl1yNc~Flh~*qf zpyN~;?-!6HRs~g`LX*b8rjlP!?MAWKXz8&8Z8gWT>V5Ve2)YypH^yu+h&a|%XG@Cw zxsVtJuw)Cz%?u)C3*eR-kx zYQw{UgD94{ChIZBm{8np?n{1UG|M_xJ4h)K%nqGLyvVhg=?yJ=ltXTJ#TvI2DSvyA zsL*-Q?zb37J!!G43eA>SP4QD=-FA#uM;t@VsU2s*V)TQq1jp<{&sdod7;jwRe#8}Je8Ft{NTG)BoXfVIeR%RGnY z_du`AkK&aUdn<=I{pIAbXvJX_xf z1xJHmMF}f|I;`$^bjjb7^~=R{VAot_%N$jq9+53Xbizw;ZsY6HTBqO$D%wO0VqfM@ z3PO4bI^ZE|+ku&Flp;qLZxpqO)x<&`@GlOwJ< zgPV_Dos$O-rGIg4Qh=esH%>k}!?Qk;16i6OAW%H^3CqSf849ihIhIu=4=9C&X#F+b zZSJ`M1IJsF2icyMd9!#$P3$DHsC#c+q~;$-&rW+FT9|(B+l=Kx>4OS#8UEUX+Zcfu z6ENi&rbpUmS#8=!z~YuGM&XwS{?>jkoOXG6)S2jv1e%XuJETYfbqo88oI6c+EL-b9 zi(5}dfEtHp)MRMw#WcCC+htvbJgdZ1fbqV@J8*=3*!2c0r~PVa06*fY1uk4a$A?~L z^@>F7y_O#5LR$T?1SN3bg6!`mND+|AHUNW$dr)Wpc}z8I(XC?PwGP_1X1R2x!%j_$ z`HfUY29Ga%+`-`oM#&nwTDXQ8yt=UPn)~2atU4`ok#knpHa0AiAt`p3UKBUo1-km8 z@>}9=g@f?;?+23KpvM}RT-PO+DYMjNm&c;ZYq}IWu6Qy%WNRH6llH6A)t}5uRe&}N zlrhg8q;5XAbRQgVX?_X6w-YnRUFL3HI4Hv~O9yCLy2nx?I0m$6s47gb;-8M0i#;Rc1)26GX)K8BL-=B3IJ0@ODS8@90at3F{29WP-Cv4gJr;hGl0rpJ&tW$ zCL`HZWfImFc;dqmBUcJZ1GSc9g>cWoTJ~gjU7C2B_(K*9xDokH!RZMQ=k-cYPHfVSCZHo?3FUTBeF3xih08pdp;XSBQ zyL!KjQ(Hntub}9%{P^Ul%lHxz=u(_Pgj&kyVJ7I|4H3|KWIBR$&1)seRB8pf4SA`P z^4D7D`U_;Hhoz9tZQ}lWyZt3>8lrYr%L0oXUwOp$Rpu7PKEIc$z?Ek zI2oD?GkytO?%hGgP;YTH1J9k!`xD;$MW)oH=pD$=Vf&rj+)D80j*(=WTQ;pf4+0gK zIn8(yk{rOo#KHdmr;)mKv}mxiY`#-t%2&jeN3&H zjw)<8NCVe2O5^$R1)TW)MF7AtNqs_wXoh$yhjQul?)6c21#E8jeqi-{^&=38CnJZ) zn{x%B>-+^y1}Y1W-(<9`7`-b^5i_gXsP^Tp=MEA@cc}0C1 z_nb&(0)}mS0=dgt;=&~fdQy+Ype8mV(}pdF&8COR2)yQNZnzhd1WwPb*OSxeGgJ4s zDRxk4qYd?2>m0OaEcG7zmEW@;$6nX&?=DBKJk#vv!KyAgR2v%WL~%a>(}+n0G_xS=hj7{blb$ZnWseh%;(C|XF5D6{#=xoZb+CwolDxWYj zQX3vjxJV=E7#0NWpsYeMO`^_K`)2cVpk@{&xpyim9qG3xsd+ic3m^s(GVzQn2gfjr zzSzNVQtq<&&{AQ%R2`)1$?;%GK;kZn<=V7pXSq02jhPNs^eFa%#(=A)<3z925*_W} zQBaVxP>~=@;_2C$LLo8p@FY(VI6`p}rinRbDabP-726X@8u0)jn!Hn>nXvYjolTW$ z&C1K9niR3DrP|F*y-8Dp7Br+mr)Zd(97RfXA&A-`u~cA_Tz&l5)+-ql(bl0Q*Kj(h zlKiw#g0BmZ@*;cJ{OB`YN^SOC8C^wSkq_u)O8q zlU=&%FSJMdZ4Yhr84lF9botPvcek^FKKoX>c}5BXZl3Duqx@lI5;o(J8s(z7zH*f} zV!yJ+s)Ybpng}I|aM&s<8!R1u6ABx$YT(%hTY8Xo4e=qTIsns_=f`hWIU1x)(F`0) zdt~{jbere;^Y?JHv29w9iu9N(u`=9+J25iANnab(bx5%-i=Mf44?>6D>E;e>ruMLf>u_%N@(P zULLB-c~Y02)~xW=>R3Y1K-KLrD5ziBwP;WY3uJjFP4gq^CpHga9UK6qM;I0Bihr3P z?NZ84U;`KYI^cU~F|#f~Vzy^F?s7Jx&)t~fjJhrMn*jVG-Q@K7S#}Jk^P7EPTD{72 znq7c$IaGL}7}QU^KB@6fx}Hb{*WL#I|+u}J_ zdR&A<)daBGmS<$_%#6C1NFIVRIMoVtRd6SAX=i0^5L-rpDnUdo8&(-^n0&frZg&oH zNmH^#Hf9WjO-<;r8({3t`x^2a2)&ca%dt8>k)vCj;5^FdFz-)A<*FNavwF67)IIYM zX&S8Z0FCSFlB87yk;l8BnfxHL@O8JAWLSWnb_2Ag$TKea-RBd#bc^5`S`kx4k~oHT zJXi{W)3T?3U4qN|Wg=T9SR@@8Lpb%C5z~nY{<5~v50)PuKNiY31>g~m|j8evd zV6;|C#co3$u5Oa0+kSOpWgD;|T?;8M97N+e%G2cAT6nA`r%HI>#mYRrY=L_PK>W!A zcmcwHZMQ62=Dj>LU2g)jb1~XZnx>(uC)zH-S0QR4eoAR;j!u0x!@SO+eNRFWI$+`*QTPHlI~DsIR64<(F7ot{J4*kVxHFWBHeOAvbB)aS0=vt z>in2U=k?dCl%Mekd0Q=J3&+E4|3rOzFafSz252;l|5|mSFW^oY$JT2RA21oU+@12# zF-A`q2bZ|#?W%+Txy&(y(aXsTJn`fiHP0nW5SpVU5fxNiY%pE07MV_*DNu`_O&G-r zGo6#tnUbOWrl~EWv!!z)dG7L9E9L7h-;FwVW*v4)6x9#s=6AKcllILwL9Gt}$N?%2 z63>r0Wy(}^LwLECW8Q+rbo2csc9o+MUFe!4CY=dZH?-V)K#si2#rtQ%zRo z`=&Z7;;{+S^_R}X(2y7{uaPZJBML>ZjbH))8}-C0>xQZfpXZ;wVo&Avj=iD%=THRL z((S6`MQJXu(oOnCzbw4RQ4a~9Rf;^#HQ*77*{NLr7+?pZYAN>=zzIkHEi%73F3CM2 z+eJN)^}|O!=qIfcv5VWv|6zO}1Qf%dA2>bWe8o@;E?@}q-uV3b=#}L1CI`VpY!!Y3A z?@LxrGMcgk`AT@pR;$r+}Z%=W?DJxZ19Y7%ye1?O+vMJHa5Cs1GsY}G? z*l$6iEaS-+2Q78Q#uk5fvoG@HNb zO}#>c7@+hzZ%=i7M(P38b(FZvOcIhf$)8{ zbeC7ZhJeCASrh89NbO~e(kA)ri(78}GCM-0yMfmEiYI2${c# zY#ZHX3U3naex2L>44{f%Vb_rTZLWF#uG$cHaqrQ}wF|4JWE~0Aeo!wm)lm*JbM=`t z8hOC06;-2&tv!IVGhwu&hBS@Uqytim-_mw{x)ka=_s0Os4nlt(HW8#^F%pkfcu*=@WQ@2ny}lB>?PR4%tMfkrbvfyZP9D3cMJ{y zix-$0@sSUvm9IVZ4rS4ARmio+S6pMM-Zr?=n=Q*7Z0d{Y3gvo-iyqDd02(RKy=0p^ zJtn&9$bBPEqT96E6-hm=K;FKzsU-y>Z zHAWgy{!KVGJln?U@GZX;GHU3+M$lW0xcW=#G6Z#I^N>xVJT@qIr2TVQiM#l5w6Bs! zP$X<>K3UPP^mf$92E`R}$x|x!TW&Xgf62^w==>$42S61g1t0-7*gp3yT?02*`jB_K zlQ!qD#yTS+89LN5cDgoGf7M8Q6Y547P+PJEU3e{Dm1V+5c?en4Al}Wl6-0T69|m?J z{U5I0fjzTm0oIId+eyc^(Xnlt9dwK@wr$(C?WAMdwlO*P+m->yL#tsF+l30y z_%;+PmdqWfwQw&NflN)b5gKxneQ({Qm&2d}({{p6BiniKJKf_~A`wH%(qYe2*=qvG zMsWt{oqHaOt4QhPdqX?Uz~bDe&RR9G_b#E+nk^Sdz zwd`y9`YI0p64R2SI19NX%H9M!>oln*B7KpF(=@Y;y1giMh}n*UEeN@pqAv(Mw-51_ zdt4m2%fh!iJnWJ{^3-uf>1$>(F|Wqi){@=$eSc;d_}T7xA=t%_9w23tTRkEi*9sk! z4G>%`W*ikGxS$SkUhj?{OY-!2EsHiW{2S|$*l?<4$+Jy^&-z@uA)Q6H?_9P;Eyft; zZrG$oyX#=;VDGt&Q;932BVC@6eO!%G$XD>uE)YA1iT5u#6{&66Nf8p}?U&YNx#_;6 zXIV}O7d>P*4FS6IStb&Fk<*+r8J1r#1HheovOr~2lc*;1PuRax9i_a9J+ZYFshm!7 z3K7%7a*=;?m>o#nBCDT~x^2tNCf2v?L3)P$+FxcOUbDLA>={>o_xwySODd{_s~Y6s z6QxPb=8x#ex>$k#OvT5wH0oYuU{>y2m2T~X>=@Rt6FT@h4(9bYD?7DWA9MuLIs&%K z)m2uQ%BO(C*RVQV zqUz+(?^~i-AzqCy;d*;R6}0gKT&=_aP8#&Dr#g^0_|n74W~I>LHzwC8*XT`+q(#p@P!N2Ky2WA_>;Ch@1XBllm zRJWt;^100kMXqRur;$u3v&Ar)Ak}iu^Itv3n;Hg<6}qph+nPE%WS3<&lN5pr@Q|yI z8Mt9qHkGFv7mGW#<+xhdUvvi^51p0`ie_O@1^y&L^}aH-8FQ1+wrFn=f@AW#(=laS z%7ZTFK|=a-JnMfy01`Y?!vBv#17T+Vj}Jl);QHUJSr=|w_5LW+v-%Ar!R9kCFC}Ab zhi^mEFBZJm#FIhX3yLpqbyw9#Q7QSk$SB|tv{ms<_2mqooCC6*oXpPj&IqT_`6t}Y zpB8!m{uSVr{qxnFN0Lb#`S8IuhrckZ=_Wy?;jh)3%jZbR?1Uo|3gD^(_05c)oo_q> z&Aun-L#pU_vyeCiu}JkT9%4kg5U~ZGaQ+3pdR;VqhIhGW8MbT7%|lD#ZUZVM$Xs+H zJz|V;w$OU@J~{j07sAZET4wV(EBqDvK(>(L!@TqR8HUNA!^nFz(#*Q>^Ge^%%pX8j zB*dLN{2=-GYD8qt&#Ef8QrpJP+D-R3?{mo?*Vn=4?GnuqgOYDF{#VW3>urkt4V!@C z?eFX_{?9j%*5<=||K@6nZTc6p%t}=e?dOva8cJSkm8z zi&f|i)R=Q1^P&Xl^h9{}a@E1Eqh2z!&!T>jE-C+ zNVO}&eF8NCRe)j%W|H;L*PxlNPIaLoMHdt4pK?>uReGDg!EA`ayfblM6X`bmA;U#&PB-U%ctk2j6Qt(@Zaa@nkud zDjSgpg4F=S!k*su|G>Hp%sVIs5~*}zqvOmgD3AZt4FEhOD$ld&9*QS7#bMjiNfK&e z7Q1I}H~EaUyfyFvwmlrzP1l_YMtOFfBUR>}ACnY}t5io+Rt~^}EfoH-W?*4S$C(4zdHE$3h@Cwj?C!XVfThr;&dJ4%0}K zE;$q3Qvp-e_mTO+`sfaZ8@VA5rM&J>G-Q?wSg!PO(jKU>pLK_3#$S{!!~qUaRW_Jf zc~!|mUh(uti}Du8o=Uu@ZQgfiB?|`9J+)(_drtjW#ESBPjf+IN0gA6QHb-}qE?l^L z&<Ax^%NYWfp2k23JXgrb8MJhOIN^Gp3xL0BvDNt8cXD2;8tOc z`(4{K=(1RQ-%kf`JZ4!gopJ)Mlx&sHgBl8A1V3d-X7{@rOWZWutgM0_T)c%^-~W#? zDH7BoUE0@u>^Y@eabSTB#)-ExiJB;a4JujnhmipNtTi^nm6$_0mB$IrKgAX5JHT=J zpy8a~Iolq(esXm%6V#KCGW5Vr_<)^}j>8JEjub-W#6-x`ail8SO4lzZIDO(X% zk*E_ZRzW4f){9Eqk=V$DdBwzuZckklRR|mHF(jAeY9A<5rt1yG;Okce7=5{q7?%^( z$kI5NScNezx2ZVa3TN<=N%LP~SpYW|V10<0vf-Lc3XW(@I_T{(uj0kjWy*x+&E4db zI(hJe$iT|vIJ(6!-$p4uwF`^u5xKZp9&><;_A)9hPJ^v=dFMz6dl^QUTsWbuk*REF zO1OUg6rQk!wXpdgRcmR=I%_zUjHx*Nyw+{1adNCcEeTmu?FS0FAVcZbam^RG zyD)}-pv`^CWl?ka*GrjgT6+n%S|8x}Iw!m)+FcjTJjeP)a2QWKhnt=S?!Np04G6AB zQD`~$`mWex6AzlQGxq_WFaYRy{fsz{{t7tWLvk5)0<3I!LCjEevQQn^m=)u(q(geI zZvjqfX*Tp}^wlH6p8EhQ0{L<9c{irBBm>SAl=)*s9h7pUU9kd}z|OeQ`7;mI<++7y zaOzc6247Y4dJP{r{2bc~!(q!mkz}I+n~MAzeCe!$ZUAK|D{+>~GP2ldb($NJ6)0gIegoVxSjl1cE`v&@$LXH_+Q4A6brISP#4c zbDjm>I(~GF=APiUU=q>J3&Axmld%%If&NW+K1zX~o5{_`n*ta?otca&-J)|@y7JBG z&cX+S;ejPAM#QI+h$@t7T|u5C$LueoM6iDeH8*`t9!(p6b!1zRtKBVosXulVeu2b= z6qs<(SBW9g$O||KU{@@c)_AjyHnRBm=ihQM<>+$0$satt_+oZpb*CDDzp)!36Vsbp z4lCORPe(e1wg}Mt(!o>_o}zg9ci<6Er`CX85E@F2e7^f=KX_}%xags29A%2IGmlu| zL-M-|1&wi?wXms62bj~Wgp=uT3Vd&?&Ba|%-GjcDl_FD8*{JNo+s;Oi;Fq(=;OuOe zX-ilEk7J3!o?3>znR<24=iKK9Y17W=s@4D>C-n*RtODR>rwx82_^teUkW1jRk1aDZ z3Fh;3CgPaLwNoYRqKKs-s?OyX9hs7+toHft?rUTr}4i=C}Ljt?3rIyYZnxk%bwiY9F+o^ks>F-TW6>gm7vT9fXGnE*^FB%s}Ea zb`!!iC^kA@272M<3idZshnH#Q=V$3DO_5P zWtSg3cHR4Q^r@*R7%btJ_=AVt6kArbQQWiu)oo?7;PyPCkYu2f0zrxBl_eW=|9hXM)% zYp*HrfeTYE&u8OZA!n_+{2Hqq-MXsi2;NQwl9&C)8K2gizWQ_$+oKC+Ih~qM6nKGm zH5)*86f1_foAakU)X;+MQVAO1Vdpt#bg$GAhHA$iE|ca!?l4M#pkfp%(CYaABs(ayN( z)|Cgx(Y>vZtSS{Po;s6~jdx66BiMfBKy- zCDMf(VW;et5c%#!(Z+Kjg!y^vofK-)*GfKW8<$ekj^Cc921*GxyC zGE!;hThGO8SJSlbjMn{27c%@Swg3eQk*3U_(34{uUH-mQJj$1~xA@niNLx{ro1mus z#`CwZ{qU{x`aq+l=CJ!l2Y7)N<>K?jq$HcOiKBP320K1CJi*7%*uN(ce*qfo62uzf zzpU}FrpumyLB|i{B*dCQT9fx@>cho-0nOd_8o(RFX=}FBe@$H0|JTH2`JcDgOD&$7 zb9T6`cbX5#{BRFgC|)!RhS|$za~f{W=*=QmiBiyflJb!? z3Ib58o3#*uZF|-ag|bdQ8!Pp>SV*-mWSP`0nXr%b8euxU$qE=Y$L_YxsO%PBAICT6H;>S^q{<}23aJPM$*K=tOM>}Sj-!`h+RG+QW>v=`HFFZHwf%Pi zqS27Hs>Mj|$fxX<#zPFMZmOuf3>YNfE-nK;dV?3}p(ZA_>{OX<{2GX-{lH_x5`YY@ z-Uc)68_p%D!aorzC^hwyQY`i=dpcHl&huYNYyZd`vMPS>g_R_{otWmd`6tAnzNI1Ccj*4k@1%)*;2CLo)rCPHH=?NS=57lfl> zx2S}sEh^F^4U5lt;Tfm0B!B@#?2i*@$P=Gl4>0HLVtHqi@7SgNH2Uji-vL;nuzqq| zZCR=4DhwTb{K8q5D=|0aZ2RQzMa&M+#?BG#)mK++%~?^%GgHD(m}>Gs0-~#@h>Flb zZGk1K$!rWAOM}kDiCyvG(3=S*B6>mAeuw5)%g=iLM+u=)WPQF#22_->cf7(%WU09S zhOJz0!DNmHo!aeT-y(L}Bh8?d=bg=E0`I<;8y!9cJG`53{foyb3>h(i5+1@I z%f9CU(bu)L52|MK-PywPal7qKNYqep87XGNVBWt_86CIBgNOX7DYE}`1tdF6v<*YU z)~KryEEcqIi|&*@@9bcV2$iv({i2{Bg|fV=@-Gtea8#w61tvw<3Bce!=j0mFG9>^c zk8xJGl?J)9#kR`kkCg;5W0_JBZq@ zr-FI1zSx@@x_aDI4UsOyl|1<4AvrqXBhViDZ{#RX-v^M*Pk=w46ImTjeJnO4Cd^_r z7>1>vl%Jr|AUlioE+E*Re4|V+dk6kKG_xfQgqiv7Be=-{n~08j^>e~+iv}jY>fa5Y-@~%;Go8$` zITB1W?$2wshb8^YHhYwk^LWx+1*f2lg*S4?q^KGV{{gTBVjx*Doz&(g%`F2)*rN$T zj(iaja@1_(SF-0DYVbDtsuo)l4znmzZ20;SL^qgks9YrqGAc39-K~^*idL$gJ4}@H z>1s3lk;yHV=wp(VCp&TJ6ukMX4?>$?4VEtzD_{pH4n&iDXgqTrc~g zVG%6Grjj{lK7oegZ+%wcs4*FZiwJ8dd0BcQp1t5SIt$=y7!K#m!RApbk8LsP!CbOb z0BqFpfAz9fNqw6clY*j8NuJPw-ao%Hhb zAxWn`A+A^*%yzpEtNQ*r9f$niR6%u0l%WHC)<}IoxFX&qDxUEvJ%^lbN&cf>$B1~& zCmuR&e|mhL8AMtI$^QEU$j0`6QD`nk#{VzjHKiq+aL)?&U&4zPFwDZk#RxiS5BfB0 zFR>m7i?{XMzb)Q;up+l^drlA6kRZFaQeP<^L-q^5`#+FZKwm{)2hlKN=2w3(;qA-* z-pA(q%_X7>5S2e1V`t3(aOLbAVlEgbTW1cyGr=Pp@C(#U??)b_*>na%lVztcv6Z=X zrLUNBQ&#OItZ>Qr5z_u@kNlK(qeV?^VO<(JO3RRUcS8enx9J_&Yci@cW0r&@_`7wa zvzO#kaAmm?7hJ`SFwh{|{!0~YyWLDrw?f8R=d_br>zMhTiucVCHGRgKm0o*V z4rz-WP+^qYMw@DxBBI-#@EaF6}0NNcek#9c=QM#5)H z=Ri${hse)8X%tDC4AZnr?TXZW%nK(;3(k+w>m&D0-zt`-QBOGSOhFUs94g;ncY-YXOe=@lR|u=uFB z>pJ06hQVlp<{%pId>tl>7@6bDZEc1~(=y#~`+)K#y1)gkWCVfVUpiqMl^}RAcozys z-2RO6emn$*WT}KM`(#`W_G$V@)1(6C_L=BFr_Vnve#~Z?-LA_}rANUizm!@L1Jbd9 ztfGQDF^D5zUG)1n+dLSa<0@qsTq=K|fZJAFp<6ids6UeuxeHQTt-m0JhN&eHOjY#| z@H7fIrO_=3KnnNVm6ZUE++f(Kx}0{*SF6DZlqHjylnCUjwIB8z?iQx7=TvUB zc=B+I!MMF9M>^iH*W zDR|Zjm1=r+a@Gq+btBh~_{wn+cl5Cim}p>rlUP zdhlwSzxl`#i~dKR}k6qhH^_yDO^?6UA=#qC@Z$caT}9a3>bU{d_2VoN`+LQ7`Gznll(K8m z<;qjo={1+_nt2OoXrbces;I5(Zm{Nu)v4Fgqz;XlhxU1guBjJ)1+p6b_LbkLIHOw6 z?(NzOb$%a=)w=<4q2~h+nNo?xp;mr1fyAAG~(7N-BxYTPv46EctcbHkstuu3&S!PJm|9fR;|L>KZgY|z#PA=8>V%8bqHs5I;ASc5YQoz9oU>YI+cCc&z z>ys>`@7lFH-DaQ~le-vn?Xv|B7mTA-Tp-;puz9Rhu>8t{DfEw-6?gX93xl-lseY69 ze7ucNE+sw-waQTqL5M_vfu2oR%kjBr#2)D*d0w?nxB%>!go0XKDeD(Y46lZd&BhUH zBJXn!HpfOgQ$C5?SqgU0cy`Ie*uHVvVv2KKMs485l(jVl&|$3=&wH80$E~W~*Iz2M zn3Aryx`KQ9319wWm}X0fwT^6iO0&wewDHz4cxn4CuiSkA9~iSua{?XS%>3!djSgF{ zdxE6(6aZXvxTn9FgHt@oeWtm?J)3jO#(^hic`bb=o}hl-3bek z-?RJP?qB?>*XzA$VpCmcpbBZW#{kCI{)kkl~21`>pxdP!1mk0kA%=Z~ZdL^TgqIUk4x z>@qn~7@7Xd4!4IcgVy|AIm6XP$g`~=^p4%`kUcT79mB_Y)1@o4oF_!c1xK4G&G~3X zxdT9KR?~+*(e0&kuVzh;O8{oR_1Q^=6#>x)5$J*qk1~MTMjYbG#ah;QncE+qXI(N; zqF-U12>NVanWVI|{Y|VUBc-{`JV4r_eE%~Wy1w;NwKtx(A;%#bPN2M4h(yC7)qW{^ zpSOm78cvZf;WmIq4l!>spW-vm+G1hJq6N^~(ivyNMq{6UO}?ijpdM65pemHXPH~_v z&Vu*iN{SZ|-2bD-gDGA; zHNowDXne8+U+fo4g$R+?atV{6r|h*}qpJrHclKko==?}bFJbR4R{Pu!>8T(~aQ*MM zz>#um{9{rxak2i7Laox8s9tAB`U&ejfSPf6p+a?1&O)5fUv8r7Y9uenHb}64ejB=SWC?d+P;!iO>67^7Dd5}m64g#+aqw#5 z^dp}?n4)@&acd0t|LLT(|Jm?nn4cF`I1;nL5TMap(t$VJkrdf;ET)&;z)Pbn1tg+Wx-$y6EPuCeg74c-eLP$Xow}^=L7B zd@+DOj9%yF?P_bpFslMv@@ko+NaJdu5wj06&`Itu($>Sz9OvP+=t?wtAXQF)#1|``^1{f|NYG64F@^n!ZY@f_6=z7;hC_RQKFHnX&DOtwz=qkq3=7dk(GMNL4Qz-xRjw{cxP{35} z@S<4eCqmv7GRoo}iuQ;59k za_iF(%)?;sCCExp2Hifm7v^E^|ND%q3jn%=QKfJY^l>w!n3vGTUSqp2oqCGSb`1;6 zLZUoCougKE0&gU#H)rjBQ-Lq7$AVHV2^YV+zA3|Dkf|sKjQ?ulzC;d3rAswq@PJcs z$fqmDXW*{=Rm6EH@>S7WrMHi@w%4Qfql~y}6Ew^mtVngj%*`D7zlszk|CkXFd9Ua< zD9z{Bi5J9=2+HF|p3CSAlNVX@B$Fw`3g#`AB^Tr>$~%jh@`^2C#byXeIuRDa6Xe{U z)twX68oCMqb{j^HV{wMPkTlB@FXR+?N(@+%x@g0U^ia44&vPXI(CuE zPCMmrR%6cX-@|(0t#TmwBcnyepdA064e&U^!!W9*|8^HUm?To-)k%Pt%0J>YM-IP> z=90`yK{^MUmMG@ZkZpsAnZ~mCHI$}u5ZWqp&}b76U|ZZBBmdKoh|}b*U?ensOpu|# z(^UawBU=e2I`%Z#DZzc9vU^?I=!9QHMndX2Num^BC`?``(c>BsIP(v0tQ7{;c20fo zi>;eCO?zDLD#~*SsIv#V0vo~5Ov^KLW+}l_mQ|-6qqHE3!F)K=I$xER_ zh4ab-;1({`Bhcn&*3D48<C(SIwvaPoLRIj7<=cm)Kv4-JrJB2rolj%>O zD$GlcKc;GH`K8qiMOspmrmmd9{v-rN%fqJ>c!gF6bfsXOEKL=2h?KPwRXx%*Be3d= zPD1|>WpH}yVoieTIBDC@?6&(tw{`|!a=zsQWNJg|ee8+-G8%m3*8)b&lFeKjiBpqA z|IDdJD$;NG8Jn>LV96TWte_Dboc9l$f(Z92KnM@;xqkYh_%AA1Y|MfIQ~$*QJv-S_ z7LL_(OB5d)t4_2|A``m37c=yNaiT=`JC%_M*)?VK2!?|(Mm|I^9>$_BjI{@M=gDXR z;AL(qn*ku`4D9lCGI#5j@I+xTNY(CpYtymv+n;sb$Z|<{f>Inw%Rrth-c`gNm{Y{h z;!NCGqCV6d5QkdF4>s72bS6fNIFib1cxagzn^nJGVAge5B^{iLJe{49W_cTXUx)?G zvF4F;(Mo@f%UDUH+^@&PyNS*Jg(|fKG~|N^6hn_pk>JQg5unLZ%UzlNPD#8=>)g^& z@r|S9d*zzkJ^k%aeP(mSvo@4A?h zf3-VD3xr88PXBf{r&A8T6)YqSgD0k^;$+LXFf^k#6Er`+>_qbxw;MC1y17OC9OL%t z|J<0Of8LAAfY__2sh{K?y4J7^SS!Q)v$&uxGB8h=&CaKT_?YkQKEfGFg46VJ>BrtS zh3lW?98rmyyTu<2sOm}~>??;|?+J??u-LacR=VHL_D2}>ya!rh=oNM$iOt#uAHuBC zyA}RgnzTpMO})(iu$E@8@EgBa<(&9~%0WLAgR8|ioo5OI2jf(EYTMn&^spH6E!C$% zg+|n(2l^(gk(p6#+M#!M8*(2ZUK7TwPoY#~eSCbsct0Wk4O$)_$@_m|_sL-pqW{13 zmP=htr~T15pKblVQ13cIh0=HXmHpX=$x5DP^A_WUC*BnVh~L5}n`pg2L}iEiJ=^NM ze`{wP?q@4)TNFXUgC@&6X=rxyvB%;f>>3?qvMxa(-ox< z)CH7KICP~*i~Irj?qy<99ihS4R1rRU`7yA-QJhL!G_12+R2+9wQH^siNz9~Gw;MD( zbHQ0jgqA#R!ON46I`XsnY5xnj5OK?0<@p{i-$QTecM$OAvAXB#pek>Z%9sEQH+k?v)geoN}6ZNgK8j8nGe&u+9fr+(X5%7Ic z<$wloV7|?)FE|(o#GackBprR%$S4BeKN59IT4SJ9N^^XG-)$!30Weyjjvlyu9SCeb z;SNC20Er*`A=i1U!9%43b_IG#*WU^PPDOBht!cG84rN8b7;Z!0Ra0n8tTJ9Zh&S&UGdK)rivb= zB7<*c%w|p#2ho~tAQV$8tcEHpQYCX$urU<0mrK@$`HM`|+6WxwUo~6bMkqE`Poori z+S}p>A@nz#E)pbf2t$ksry|Buc*0kUlu|n&{RZJCfSvz&fRe(0nnXiBARP$3R2QI~ z^$x6Ly@I$-Op{*UE3b~e1jkkjW3(r%QOMm zh(gJt6$ytNs1LNgXkRT?P1HY7#WC@@vPMr>A(H9y0$w&~}$3uk37F+@}@aG@)Cu4kc zA|jHNg=jUko0v#Gu>LGHC!rOok@H_>JZ#>A1g8(teE;1yf92jAKe`i~vQXTYQ3;U^ zdqNbv1)M$>F{SO__Th1f9LO8SCVG}Pk%}mI$bD2|ahN1aW4^DiiCU3bch7(xhV2cy zv%5mewLIP~e%zPk3eEfGkLJr_=Vx_je7bKvAJ6dWlEa*d9PzV^KjQ*P3=^2==06ce zfv$s|Z5@Px{BK=Nxr#iTcB{MQtHDZwY0-7v#CaDbJp}dpdY&A?xUp@c%AB*Yn`MjN zAoSA^d8HCnXoW1tO+Xlc?;}9QHz!uBfjFWK~97!<`A#Wf*M7+Id!#|kLEE(a&1mix6@^6b# zMsw`&z5`7aux!cxt-Ro?9t>nd`EdTlXg1^<^6wC@om!LO-Pt;>4ZDD9jlY+#HhP#I zv=R53%2V5j?XvzjxZI+#o`#U2xoWZBv+SS@D!sl3C3lcmfi?!Q%ep*VRUtjeH9hZn zUdlbV<0vj+9yfFc7XWdc{$+v&u#hb>8uNo^@l&=NQqZ^*uDT}1;LQ%qW*MxM1Hz{V{Y+8 zg(tL#ltW@HgqKtfbmDT12&$ z&K95PEm|%8&3Z1ZLCn7fq%TgWJK&!#M#!=|Dt<+1tiVRAzyP|WPDV98@#@QtFblI! zBKoxqM+a{RXnySna-HJ-L`@R`QGB`3T==qHPsW2&b?BtYZeZPcGkv-9y!5F&fD|Wj z5bRL?S+H=Dt~Wrr6>%pwOX8tE6Ls}ZKv7a8ABgPj4)~06Z_jCYv3}zwqmSz5;%3*$ z3z~G_d~qL01`SNlL!#)M-H68K^w#vC>if*9m!7H4(oO!qO(Y+v;oA)L673xvP|_fR zu-Ql{4Z%xSy7@OBIqMrQms_YKx)l{93_&-k22kjs))%q_SYJ2lLho)u)HmnlNgeNQQI}0(@ zjZsBkYcW7%7L?>AH@)Kaf|J|CCTX88$54(ucJ_&MtmSJ7#~-~EhVrpPPYbx>WP87L zTBKCC%W|^Je~^Y9yi?9~>4#O=(TZ5X226EIjw~S5%&GcOv)F5*d1POin<@z%`5BLY zT8<5D$*pYzO#*!c)b5T~Edaywx98*^t<9i7B|Cuk#IR=e4Cnr&ccqxgqpUQGmX`b~ zGgPgw{C0YERDHGO&so)b%|)9fkYzJw?aA}6efbn_BYx{y2S-i1;C7lsBeaB+C^5?! zSbLl8{s2ldc)ZPuN}}dsQHs9Qj{g+svD+HEd2X=pIWMCB)V0xfgFb0%xZT7rrnQ8^LrDyxJ=e0D-&@^1)#KDR zPuA)`2f-ZL@__?nDmo6ghX7MYti>?Ylz<%t`7`k4YEEnjIE4-RK_idupk&j)=ni!u zd(7buvQ9~TgU$~v&^kiw`?jIKeIs<++&-Jr$IF@zomag?Q|6XQsy4G&bvdEXU+2ZIK2_Ocnx19PiI0syS= zl&L)rtZ(q6fxoMk_mlkLp31#3`s%vQs)(#*O9$V?1JHVgTdRE8Zu>Plqx|A`5it@M z@71Jvs#AZbO9Z?DcbhTWe=c+TxlAY`{h$YRs9}#8!JP3N9}YZP3#m1TJDYaZ`8@Q1 z=JP4$hEzA7H72SCK|moBG}$T0i2?AGB971UgpkcOYZ0*3nwqHGHjuK z(*q8~w<#`4S-LY7SM$4``@9&STD@SqsR%ekd-0!15PdFq4E$TVxfc^`iKf;&DPELZk-tjg&{PEeu_@vbGM^tV8cbBgMWh zx|X0C)Zo(qMoTz}6d^>?eHNj9YSKy>Yn=7U!7YnQo*cB?_`J*d*`b^d^UU>e5LSY< zC>|4gvc|nZZDLz)i!VGOcz~4cgbz|Z6ShgIY3tkWj(z*iB}V3rf<(ibbzh>6aptTL zA$chT8umr7aGzs8b`t=`bR$7h?Dv66S_KPZ(J01@jukyD@ zE?WaUB8N@EPtU8PlW-GmkD>B&SlE(YR213>-@<9f>+*h<{a zsJwF=M0x;ZVVJN_?

-eLgBaimykLARGZ-M-P$WNSknoS$3O=^&Rfl&33^RV8p33 z<4*C*cJvo8@r&*xJIsuV8z(@k%^0@Zrs#Qu%nd}^K{^YPtm=jek8UA7&At|_>u)Rl zCnPq$86kc1J)|G*G61H1hXQw9WOrD{7X^Xu@zVZ{o*8jwe0AOV7$)n2*iZN9 ziWf+ghxoM3VAXwRi93NsJ935+Z=lmhI0c)UDR_cN=l-8KfvR$dqFDx5^iwBR>fnwD z+d+^vjWQYVDhWi{EeJLjb9q`aX4Y~SA?0amn~eYvQUKcDtp(i@KR-}+T2Fwb0b!uS znp|}X!RI+9!^n14cJv>ayq~b8OqMfF(vyD@+Eaq~47s)8B%9 z1n8b@z-vhl{dlL$BjYl`APReJR;uAIvPoL~J3s)VomWq@U4b4#)kPjrt-Q2%me_MH zdr>|fx$=IO7K`_C(QU^^nyU(U+YzzWL~ghFdc+nMqFl30!k3BmsywUWT;30+?L|+4 z?SLYxfxMJg(-48L;`Flt=2)L>sa(syTyR8*5JLrib_ z6<~>%6rO_aeN2@rhi&}cNS_4f@18H!oO$G**5NU71KDW{WRybW8G z@`8(&Y*$%)&Pn^7xmK3y@sS_D!$znH8|$!hGLLGlbU$;<>8xj2U)n=&hyJP*N;lJl zk~@sNT0M&b=sORI0v*P^N0wfWY_U~a6`&a*EBBueU!!`0i-W5Rr0iGAb|hfr`|Gj= zkf}a3#0GVSc)2P-@k}fOy=EH3(`rtOVQLvi3Cp5qjQ{avZ(Xd*lVNtz{?>VQW~P+# zU20eE`H)<^D~~cy)nN7YW*8Ot?e6|2mf4L_85?^b`Md(Ea#OBJJBxF} z?9Q#x7YnKKHa$=6PF?JGll|8gafY5jWD{-K+Z`6SrEBUZb!^2%GgDuu!hSqd-_)+N zAp2}$SvVn94GqT}l!=)UkB<#S1327k_zf*rc{{;hFObN$JrIfYpUU=uE2r?p* z9^rUbYa$i9TX929*V(JG05t6lQH|Jx(KC4&U0R}%Gp{Pl8&1g!IMYm2B2Zi5nIP% znw*_nlzBEB1R9Jr)Lyev=glAIb#0y$@trcRQ0*&`s$7G$q)6i?NF_7TB*1_%U-obB z(W|YT05ygH+1abq$@=4FFs|Z=B7?qxt;|Ar0B4aWNORL6TJ3w9V9;bpNczylrIJ^G zmhDzQ5$L5>3D;leU#4H~3|L}n>~J;ZacDsj(SDkGe0}YlHhm;uI)mV^>>iVhQj=Ix zmu;fR=q zMNMsv=yv1DA(1@~EZH-Q>=^$_xmMkED!prlIZo4%%h|iOaj~w9jtn{6W3SA%t3tLq z#vUaEcUID4C_WRp=_gLEWRjn!aln=17C_}~XeT|h!2D`VojK{vtq)#|Y>7l)kpb1*Fp`j=lfDw_ ztWU}g>Ky*j>WZYu{9^rp(=Yk0%-Fb%9%F5Yak{^TDr``h-f!f5FK-W95#!0*>;ysw zst4(X>em$^Lria=Nb6%xy4ozf0Cr278bPSsl|@OCKA>=i<7H{Se6;HJq&UglBv_wC zTed=WLri6ayNZ>rF*?Jt32EyLY5K+7-`YR+G#e)M59KAYlAjUqGNg(@DsR0tb*ZMW zGg5<9J)F69nT%!Q7RU@)azi*5|M1MZCihz(0lXWLun(pkJOLe4&+^5g`mgWLE~?=6 zwV#JveZX1y`d#^1NIT8U(c=0V@7A8~0Al&yrNcW+r8S+}fw6)lU|KlK!!9@jaGQMr zv_tMUh6*p3&ByEqoXyV*$!`$s_>-osb8|akPryONU7Rdif&b^I(Tzgl_Pmi7m{d)? zcWu$t9mW(zlpmqe{O*kcb-|(M-?nLNiu1OEI)FVP0&I~-42*jJ?Yy8hC9!QLmqA-< z;eod-t`9g7pcl;rIcDj;fQ#bBDNC&Pg%dB4n5qMw{3O=W4VThzU?Qud8hd>4Haxj0YL`s4|T_hUlKE<`+uku1XOvD-N zJb;9D@HTi%TQgYA7J(fmIPa^$Fw1HtXkFsgDw!jKDg7@DPmP##pbI=2rQ)HhYr||H9lwz^J74T?RDt!JtakUTgz zgF;dU>L&HGt7da`=Qz&djIE)rjBX!DtXhY?LCNSf`f}3f%bym%S73gM&1D2`Nx&@E zBGtsQA9zO|4A2jqC!n@C+*rhBdL5`vho^aD|g-PxxvXv-T; zn^Q}S)l-#u$PnNr_yk4sxrxuX2ZoTtisu`QRKUH*o&xdqJP3q|4i_Kjv_jN9;Ag&y zed%S5ztdyl6OJH4jl=Hi@QS{YRl(5Ly>fc%m@1-E(#Uu!Rj~iJXBIR+5VYI~JlPta1RHS&?Q6QQBagdoo`f&^+Rrc%wPNj}e zNb)SI!LrjiI%2`vAAvc4()A>t(ck{^R9EKTU;VACZ{81;F7S+kI)O$p3gAotQpij? zb;!%2tRztpp;tHBj|)>WhX*ma;046XYfyOR-{8zzBb6gx&r>4^S+ssInY{&9zDA@+ z3@euZf~GK&jru)J>kN^MIeXN{1jtNyo=HSskISOqOzgmaNU@0>Dx*W8n+QmSm~G1^($T+&LBo(9WY{T+W5Wj>HHyhBYU=Ps!n7WOFVBa()Y4qQtC-rvdaFg^EL6A4j;@~_;AipH zys)`T=U1*cowjYjqi1>QbkVC=bA-BP*LuOznCj4@0a>?dcdI0W5vASunSRU~%B88m zfzGHINxAHQ2RUg-_!)wP+!ML}E+-HF#AaQ5xWL23=ioz(E>ajn!eeJQN+&%gxX3l3 zl$@!DO3X{xmkCUJT2S_k{T17Q*~cuYroPwgK!r>BAm-FF@*X8T%&+{(h*~RhAf9`s&MSm;DfgC*%Y=KINQI5Oo&>* zI=Bg0R5upiI9okOoVn^&^C;*FGhYsYv&9u4PUwIzpURcCdJUNf#vJ{x48*qNyhmF( zR0dg4DhXkMq|IObqX!dDc+v67wjn^@W?d5&0(gwi{i8>GRKOpj1wFNO3cD7yN3Cmt zWMq-Y`(RS!D*C6uX!cVBGsW+z{^+9QpNpO8>&O5mR&v3u-U;@~vGJv0f3)Zg{Lkn@)p{V&tRAANgnx)Nnlt~u%i4W;Aav8sb+vTIT z5P*_N>h~HfJ(_APzIA%!b~RdSM;t0g04ZVH8STg8`IVmt$@Pk_A-NxjD!2^x1gCjVp;5+!_cKCo8Ccy1QU z#GA7|u!=j1|9z#bNdnTClY1(O^~4`Ri>Ev&$!fB7y?s4!S&<+&Cv8TF>CInF=u!@? zYaxaq1=XO4x|QMR<7KE_7*Dm~Y>9vU>PN6wIcf^o(iWz3;I{r-m_r+msEcmJd;(lX zQ!&T~2ha_a=blU*7EF7KumevMY#62-(-Ga0E}0}=&F-K(V?f6L@t!pI;*+mh$~ zG0b|7D3$MJCc~rGtPN%!)7QIo|rU&|;U(Gq-swmDaIcT^xs%8H3wk{mE)?!KkC`v7x z`d}*U{XBXw{r(4v`hG!dvz0`aLwEw7bSy9)18~A5V?#nfmXEJ$PsMeRsaokFtf`w< zAPoW2F3Krg7S>!IbvE>>xxat@6I7%Zjx;d!yCa;#?@3=z5ctelw&KbRXZpj=#M#Bk z)X)~r)Xv1-$O?{|DJ=j1@t-^v^Z#PP&S*`{d- zxBnE({<|(M9kM5|>iSbL*62-NS2l`c6$#>;nW*X8@4f<#XKBig-$z6v?fNccZ za15-)rMcuE1<9#hn~O0@-SSRYqiA30-}5;u*1%x6eU&Z6C0)eA2MU3WK??n(G@RE5 zc?;+k1L6144f~xfkJy2ZT&*%5>kq+S*t_5e#Wg`bDZGfPo(~I&6fi0cE{T4)2YfqF zp7)U%pSt)rpxj8&=@Nm-d60+sL;Ik`iUllLq==uMY_Lm`Yh21s_TMrW=#XMGD=~bc z?~q!PeL88<^vtTWi#MYbNxVsY7nb^K1b(sn*<*t0S^^yGY(l@sMVdBg`K z$Uztg`M$B^GwY8u?8goN1~L2W-V1%MVYAo?{^+|-o9<2eVSO$v9dMBlCqQ#CQ3dAGB1e5F)*)upFZ?Y52>E_}>gAy@|rLMl7@VBf{^dMElmZqf)1qio@=k z(Rg~Rj5}tV|LNB%yLQmq_Pb%M21ZP2F}M?=sfbbS=)**g*i)A;bpX4$G2|Op)H-_4 zd^5t8uUm%5xc-W>rP7zcd2$awP&hr*a40-#h^Scivjd#+3cBK>8iL&8!j3oTQ z;S6c(Pl)E3hd*+p&H={I5o-^YZ?xMthOlJitKDKX5+yfJJ6cVRGvoQEVs1-SRy8@# zk=Kzr8GV#C`VFr?WQ3OsvE+s4qg-0nhzsFRauHleL8M1sS%@{N%+vdhSS^Ce{Ncgl z5#3?0GEGnoS8k^(WUU!8y$bDkVm)<(JF;XDlNcXi@=~(Uo&p|)F9naGFz09fJ6lx- zzxL{}c0{=iPJXD2dAG4#UmP{&&fr*kI?UGq2#`BxT(I_N?3Y!o^%Ni{*~=D6$G+ju z);BY5ARgtGms_SbVI%vs?;MiUUvxN>IdbdhUJ{R(7?16nZtd*3FDZDc;7dvWkJv3nF?(>mYvdtgj)fE7J3JW8&V+wGSh3c1^Z{4bE*2dChyF7`}WrX7# z!1Sd}8EN+`P>QF(NOLGw$z%PLeaFgD?nf?s#qry<`Lm8+a{^ev@{!c5zUW%Mtl>wg zs0;o3$mgLV9Bfx|gDn4x9njPE;2{9_U7eKU%<5g>!KJ!m ziRGv}^APB6NFs;wE^-!Nvacd+%YznK@&} zNuxK14iB?xp#f6kN#dRP@C$FgZ*A#iPd<55x*)W^*Bu^*4A1TH9A(!FKb!%(1iR{P zg!JHHN<|mMqKTuBmOSZKo&-QpbF4X~PZmcN@_aEv*l89giRe_D%A*d+XDr(#UadNr z$%sa&ak;QJr-jNWB`Tv=D?BybNy7Q4g^!qE5z&+eO@W*0aWh86imNwFQ%*(6X}D$s zOz?B*BeoeMZjhKp2xuVQ|{shy{w!-+;!Y|h_hb0ZKI3>Hjaa=)`7%gH$dC^2$&)@M6x z8_vSZ#H7_CTSuny$9LlV6yqTm91qnRuBl&_7=S)4odD(f%_Nm#qi@oKn&u`xH~Gl1 zr)LTwiJvRnyAFwbwhwI|*X|7lb@CtI)&m#n=aIWw{8_1}71&Y4QDkLj!-?yAWdc^c zC4SA+NVD)hP!BNq&?Tza33M0G16Nxiqr{Pd@b{ajV1FUy>|rQuo+cBv7Zu61IN5ksQZDuGqAo|*bQ7%RiC?lNk0exVS%!K6OV|cB&C*=80Vr} zOt72YKnh?04VyR$gb|8vh8X}~Udd*7p*jtC=6DfavWufBJ(KjI@C5ObkjX*UYg3t^ zGl(7p=yZiwMW?#_N|d1QhE0@!fU{`ptzxim2V!X{3H?-tplbRAHNu$51^kUAT*8xDt|Q*!Ar?a`_v z%J#XD?JmY6iVBotbusDVvPwG)I{sv$xm$NeOoSLrd~9P0kPrspBT2-F5W>ycFzMG` zV@9WWRnd-m2fh(o6%beVa#0R1D*_3I@^|;J7`nMNNZsZea;rGje~D9fBMJ`Sbe6j& zmI&9>pL!9ySA2I$Tb#-VvV7#GJT%=JIGuWsG%Yh)Trq7Zb@72dmI9yot(d_rp>O&Q z(&;8YVzda#pVWxMLHu&9y7q82*I2933}gsm&w>#fG1T@yMXV;v2zsw zdeJ$yywRD;?XM)G4A6zxxVr!gl9=3% zu8)waRr3jzsFA~)S=aJ`3I$h<__@@XX;;-%|7ihBo1Cv3gk&>H|6f`g$aA5hz4*bE zsPfptZ8d_? zyk1OiFWSEXX#7?Dz#gkj_}mpP*c3-6=wcPE#7M^q;;#ef7Jx;Gp}t6j_%8gS^l=yw z|7zK4TKwJ7cYUtvo<)ctinb>YuVxKQ=bB`ii|QUH{sRBkW#ma`6c-RdmhQzaTYG>| z`5;yOr?ogS+b2XkUgXbXKO~p+Y}{|Zn~WV_MVb&z;0>fDko;xHU~^I05sf_c1)GSw zI`-C#Q);znA$MgIO}?C=4VN_4n^PiY8~G6CobzWff?`6xd7=*Ups!}`=SI+Xx1Q`^ z*V;u0T-+ZX`l?;v{_PpFM?+ak^An;-p8peFqQmds2@n?sE#m)}!K_R~X~t8~q(ByC zCbs`?)4oT$C-#T~<7hL>+*EdE!O<(1~5xBc8 zp`#R0T$Sji6QHHA_Db^D7ym9X6;t|7FD*4X>vLFYhq`BZC{$DV{inn<;gsq)`3x}S z9{agxJTyc|*ykca>Z4EE9-aN0n1I$QMTH9(UJ03B_@_n~7teLL1^%NzmH9n)&W!(enB zf`OZ$EUAhF!48gaYoib{qH8|Qg#p5ih0#rF^%h4CUhC_zP4B9Q_EAO{0&LhTc_%#t zviC(5ZTTid+ep=apz#ou4a>HUD?s1EQLj&@+@;4d#id83p5m2YlbOYZFAU_9o&LBT zv^co<7d#iad*|8jJ^lQ!ymnzufCHBhb(La%ZwVjv>`0Mn7RR@hivr-LCk3; ziGG|_Jm)Kh31|EObFIs|4#IZHbYQf0Hi{rm>`YAL>g?nW*^%mUOL1GUip@qrFVprS zsJ+LV6)QKysY>QCVFrCAVFrF2c7+e9lc!Kulk47&1TN=$D3kgMZP;c66|;O%xuCin zTiCOZrk7PEM`+FEWoT_)Oao#0%mzjs6PArpJCxPouiF_k&1kgw!6^*Ma33Nt);Qb- z)E8ER2c>F7KML*Q0Z}0-$0gFlcuEDt27IjvPlBP!Aw=Xmgw=?)8Ol|K<2qS1)bfAD zXA)==w5REcgRdI8dGOK{OqZ-8QkoDrw@FV3bud{N42ibX2ME_r)qoLnw9OkVunP%M z;xwqO*Xb|`Y&zJqWN}zrqZGSxC={xGdO!n3Oy?4wEcT><}7;9#Q%ifYUEYjDX^GA4HZ? z>V@BTn`DV;m4nuIYrtc?Mk-?tqoHi&>WL(xv;ap$9JW|r(TJ7QL%hoJM%mNSmJUN( z9`+wgrhjipel>urQT&DlVVF^1m=VKsZgl&Db9m~j_QadyIz=|ybPw$o6_C=oI;=?E z3@|$_ma7#<<#Iv1g)#lU&o$p-|0?vbG8pQl^~$lL7-}Do$^U>KEC$* z2|bwMR-pA^E!_G>4OO*Dg6VUDkK;Yf9HM)+q3lrW7>EJq&#O^}DH`WBl_61F*!Gy3 zz<#D9X64`n8w4CHAeM9F!3R#;QUx*7%bGBhScI(V=WhsXbr7(v)Vv+1q02gV-bEk^ zZrrQSvxyyK>w*0W{ma?2tXXc5keoCqqjpOwTj;&rJH35DR3Abe8Nqq@on{%r5jV=s zZ49M7qit#OX{2W*3Vd$T6ra#JVbO=MUNZva&{<^dD+O|+;WLz z-xkmV{jo4&<`iRRco0k{+$bB!ESa$hnTrU{eGRJk9xl)WGH*;4o^`i000(mr`H(Z| zGT6n%YFq;YGxZ>GN&ol!Ge&~PH2bEaCsVoUHA~hK;9NxAf_2SS;*Dd^xn6RIlX|YX zD%QhGhYhqb1g`~VjZ%}5BgWJPmyoRP)-Ojs5$IT1*fo`)cYYabR)YLNkfELZ1uqkl z(PKEF8L_G#l{wXtU=~GsOE8v!-eOshtlX~Cii!i!4m4uBz`9GUt0qTss2_OH;O#qq z-6id;_4r(USjJXG9;EU{UT#yx3Yj~c)WNQ~v;w~Rv~{|1YoJo|uBk_u@mh#`Ep((~ zyVaikCZaLaqZe|iTTB>;$C}bivMo08qy1TYq+6nyh5B zn9Q~5E`?^_^|0w(wg#_v_xaL%*uc5KS5@}?m?-+6_hHOEq%Q~=4ztmviJiuh6BXD( zwKPyf`G%hT5e^HK{n()HVm%D1McP*R)hUnyWT=fevN^FAL%e$Gm&SDsVYTqdKw0opoyJMeawq(yr_}Y|8TD zoY6OO#D`NHyMLU)v3f_r;5Iwt=Qc0jW|RPT8_L{@IH?!y!Vxq`dVgSN3mdUq$08uX z68nwR`2QS?AkATn2#jjG&k^*gjgl~}6N@I<+zoH|F_S8!-vWoX+Xh>8(&9os0wIrL zJel>_MJ&tB4Xn&$MPlasMU7js%}(zmQ!Lt+IZ9PhQoK^!GWoi0vWICTIpSe{ZNY5i z$Lxk?_IDJ?Jcwzr`%c%y15a{OZf|LbgRSkPB<1=>5LwHXiSKP<9dWq44h(J1`q4oJ zsH3WDtDV&S*|IS}OFf^0DachNn)h*P6!+ulfHtaj^dvLm-Xc4h#iYqCF8i z)Q|IRKx)9Mc9fX+dQB$MT#b*}AHl+g%5iz1%I1${i*#;IFXa^E2ffkD#lSnymUYuki=sP3w^)^9%qdcSqc3RPsp9LDQ7@Zb#|Kj6 zu?STH+ykfEYENxmt-=848PgfaylHmVGQ(#!8+I;)Kd}~+%4}bcJDsKE+`k>=p4G~H z88~~#Vnczzf4=ol>zD{kY20TN=yf61AW7hn)E9fwFr){hqI;R*M19*9@}<{ zxt$o=IGhHN8BK>Fo3v5NFaoTKM}eNKXo>FrVp7D5O+^%Eabd^`C&pQ3$*LuGEE5Hc zG0ug*{#4}}AVT;?3J5BaxP4g~rBq(j)}OpZiKu(iZMFh)u3G#SdIQ$J+pq&D2(sFk zrN`}vJXd?pGuz`>#Q832L(Q~{L0U&=c#g-zn9vQqW$^u@0z)t_7_KoW2K($u&bxB? zhr6spK8gZ&rxly0Y#)RbFvNd12_hbF9Ey|j+bPuA^gVlS9%v#KL0Xi*UPk0ks%(X9|o-BMufbKQ?5yM-X;N-3sas|9b-2iDJ3j<&jbeE`j za=5e36@HB%0d!-)9@4$1sBq4vw1wrRh}pe{sz(7$xAW(6kLnq0d6STAdhRuYEJ|F7 zqsLc0=;E8e!5Y`@%fiRtwF;%|WRV?hWX{qhqbIin^UxCNbTZINXUI{v>_^7e-T2A3 z;O*2CUD_&v(l{XdYjqtoZWwFZCp~&{UO&gv3~S1J3|Jl=uRc^v+F!o9QN9`>bj3j( z3@+1`Y)nRlNFzG5(>UcvG)bI1VEPT@OWRmVD-R4#GCW~-oz!N|bQI0aTvPZbX`boz z=n$u^S>mj_?`r!t?7W1BL$|{9z`xc5TNrB#(FW~7yzK7N4i)dX=XOBJ=V%m|n$JT| z*l`k;3tZP}FWM$fm8SDohs1hIpp-ApP+H$_V)0g7N%5hxs->taZF;Mbxfnn-@0{P- z!4D|cCaZF~@J#b5(D^mzL1fBT-dg7^xA^YUHfe=r-qyAAyfY$XnO4SE3Yznb*n{Fh z1#>1yzE)`8qHsJJEQfi;#wEQ7k{$c}V^1dT5s2k3%{w}CmEod`ld>Bix}87=aOK4F zW?kt$k2^jpyxj;R{C#nvn&Q5r>N-wM3cd`A#%pVgdQXjwi%V+%u{fG6U0Wa}(&iRY z3qc>_RUOeWe%vbQN>2^;O-E-2pT*Um3$$@*YtBi>GbItE&XL;KE&*HWx%W@i`m^ew3w~XDfiz@65fay>HIFj~9Pol`i-N7J#%YwWLM-n{=yczcI z{F~KvQsM2|lGU(oTL$}B`o7al2L`qx{yyfmIm5v4w)5T7i%E)VLMUglOq|N}NXa(L@o5tZ z4e;bdV6Ch;-8E(vFG;SLB*ik;puVjmHB_v-$IY67It^TJnIzDB7cI<02M9rf9vKy( zFve}WP(f|Oyg^Z!3Lnget}4Aj#~jAP>R$E&syqY8HXJ@&w>4R!hfGA|mNTTCO4e{` zJ}TvDHr88+GEmG41PeX+A)ny^fD^@PWZ8P?5T}P*^lFh>6|<>DX)<-5QeW)N)d3LJ zxGYPvuuH>R=9x^MXS((n1Fwx~JE0D}iAyH80c(n<^LyeecKb!#Z+v9gbJ11~YRh{n zC(bI1RF4JyX{5JP zARF~bk6-EFHt{gobt#Z>Vqs|xtTn$So409U2~kylQ_tjZMT!QYpFGA2#VAvbbalEC zWO;E<5^XlmEP6cw0V)Qef)w!^k6)0A8LE0Tk#n-A`6xI@W0m~id3@1(c5t~SE*3Qn`d|pA z*vDR=IIqWdfhgr%F>n{`@Ant2%*!oo@sdt@ZEUSV6|<4`2O0{v{&KF?|K4?Ztht8SEn)2_LPV+sZenL70B|8PX4dqGvo>YTWr zi|-t%IG1b00%OtAh2Qh65Vl4Itup$B95_Qis}L*?gwI$46gs$1E)ty|--{bu9Qs!H z@R1j(tHz9=rAJ=532VZ1joJ-Mh+;~>0K)OsxG|^n@M@E?1Ze_cRGJ-By3sWA%iW*&|d`mh;#A>!m_}0pr|ZnLQ0s znn5yF&88UE4C>O9JsBhD+_l$@CMpq7y8=u=}-& zXWslrDWl=jlX_uEtaTdt(r~AB&}hb-0hR4i#^3f>+-K;K>lS3$CBJmoHq&gbjP`kv z>B~;}y&n%f*Y0O;q4$Z34)p;)j*MJP^41bM#(~^j3uP2C>l7*!xW@J1~9x`Vb5>$NeF%ugj z&m_5G0ohY3M#s*MBcQHUMI->MVh9>IK_`jvcckpjo2fJmXFPA`_O!wrNPx>jRBFw< z0g#!mA)KE7zqVn9Ps(I2Ch})y~vaK8r@Oj58m2cN~rE4I)QO zp2b?`4<>2uASTRXy-=G&&51`(og9Aen$%b@?kcgd?YL3+Q41$=^%8|blS?bj%fL`P z2T{`3_q}%zG-^L?v6dcKtl+5SKdhK11JPN_i#^)=IT$_0r4L9~CYo?o06!Kvy0Tn} zLu;B>(KoQd&Gh(#hwK9;Z_?sbf37Y=SCk3c4AHF8Nnn=^QZEWfj9>b(mDB&w6l?i` zxmqCmTu6d%4QM_0z++a7ob)e*GC+v=QW0-qnORArh(f+8q1ae7p z{Z2>&d53n_qi|;*~shJk%mv?$sFBV|MShtp2lo z*@;T6upywcU;eN5Y)FWPkg47?-QO3p6Gi!>uZMxaMu{r6cYMBG^V^o1Sbqx2O5H1p$C1B?Po%Yx1 zR5sr%y{Ae*7T3B%%+wBfLNZ2Uy`porHTjiYXf`fsTsRBm5gV}_0b)Au1AzbVxd&CX zm|%yUs#8+Q&V)nD+hAEni32VS43G!tm?3*s1m=! zYV3x!L^W%|sW{#sc_t;lkTa6T(M}%8Ci;YH>w;T8&iguknuYSB#E?klecFSAyPT9Q z7wtvz#y~9W;`A#|A)0`RYi-5^G%1VG@^*yOTO7QtSemXH#%WG!WdN70%7d#5A z>|1ml`nTlaP?S}?>H=$;cq)7Yp_@5bQ|w!xt-crYB)Jyun0xQ~FFNLspFTFDE#crN z{VA(6#3aOCd3!(xFYsAEA#OTNM00R{(dzfTcmO~Hn91c&JDqHwO5a*dpyVFB=`<{L ziB^L3%@NZ`V5Z?_YJxz(r3gv*kT0{(&MCsOQRb%_a!8D*KIJmCdvZ{#KyVk_ukuHK zU~a0!?Q4jDHnr$YGij8mp*(AW>zWtab5;&pI*`X&*#eA*2(XZ8p#K#!|GKvmRdF$90*=L9s+QviDBtlTQFXg%vk?`n zm}!+nUD=t`6-#GVK?$eEE{G2dEkzbOh1#qUh$J=Ru zLVBkC@SVLBJ@Qwd4?X5j6X(ELF<^IT8FV>_qG=2n^CE5HI*erDgFNpuk&1D(=#R;{rg#^901|XuwB zY6W$Y@e{;G%QNU;42_|7Dh&|~6;2=~ae+>SM)Rm&X%_6S1*?Zf2NK2|w}HE7-5j-? z67Gd_TBm=XQ!lGkb!7Rfh4fuJm_9FOh>OOR@ax)g8!8JO4u4iWP6Q7*TZ~S$bl=7{ zI1tlmWKV6Q4t#x_R0)3<)W>L%^${(?Qz4vYJ8F&xfUZ9mPtLJk7k(TcG~@&J{G1<&OY;^5&%IPHP-0u z)vdOX2^eo+!Ht^E`W-p-USID+LjIl_X<8O-X{6LpD-u)hP|F^<$sE%whv-#Z0wnu| zyt6uR!g5LTCuj>2-|1D^Pg#HLCjH-QhQ>DC70n++s^l!6jUsG8g$EmfTZ1@uFf6UZYkG<}x{8@Ic zmY~|9WXc|b*Q|xJPTj#qtcB~WSzXlEllmaMcn)1nVM4N$}-b8c@=fA zUk_}7?`ZW}Eo(pJ6{h&FokgsNIrxV~D7t9Kd#sDp2nHKNKM=AF5e0Q$SAba-GxYI{ zDJUc`MvBamu_>YmcpfUkio(c~YzPyggIdauuUa7)J01NczZkI(f-Q!gSoS*kA{2{$ z&QCdqvx5mUl?feg`UVjSP${eDE|{`SeFtp)37010q-PA*lWY9RUB2y^A~XtmGLfCJ zbv=%P@5%}+3I=KZnNgb1wZJ7?a0^IX*PbSEkFsv+ZHvFQ+OO9)?j)|++*@G{6tFQ6~8iv~1Qa(3`={=8LPPd1s~h-}PGY zw(jVw=?@7j$SG1QOGfz`+nSH`dzHNvoe{k`SOn_H)9d^RSk*N&WS^tyL^P zFm9Ng;e(d_UFb#z!-CrC`(j)S0{RC6utCHxEd00XSDiwP02ke1ygHXWj-3b&;372F zHivx`2ECJK$`Br#mV~Y2v3g^cmgIxi=blM4dQ#%S{Ygu<8Lvw1q~6V4Q{3m*?A_Oe zk0&_=@hfnpK;!7EW(oLpU-kw1?sFphf2Xmj9J3ufYX;UtZtkYP^8g z9LS?G`M|`(#%~e%!aLQQ(xy!t%D?)xt0t(Sku&mJU@6PcHI8p$=6rHZB!vU-k5?wT zm}U-|KL`jv_&-0JIzFG?AE)a6l8vB=#h2YYJ(B+}4iN;f1Ipz0o`E?bz50w2z|pJA zV88Szxwd-}@os_B52=#(m2V;C_x9kG1QjOZj~Q38U3w?;!OyUm%~~xJS9j|neEaRH zTSozM?9!&M>dKCS`u}mAk?dSLW8n+hfm^TqsoA|5?JXfb&=*@%MLlU6XWda-dHvuR zVr{_n@%~OoS#)&giI0paKdWy7q*wH zmFbpyhmDjy)vq?Z_M5mw={QstJg&KVh-HSAaRijF zyopC-Wg+m`;kbos)Lxg~DH7q<;y=J$!&lDLbdOG*6=kD<+GQL(UF_lkfCzx!4c36@ zM2<7sDRY2CkaRX0{ir0aYn|o z>2IOdy7NcKaH|1-FmgZvT0Us-!H9*~fX;b9f~~OTW$mxAGMGEiCLj`55xL-rQSfT>z~CygG^BlcjJ}t#&`HrF}^Xki-MOudI-jiC_WM( zileS(PAnJdqbL`-*vIljb7hHFWq~rHXwFK7jEO&wfvRlcvXwgp>}dC+K$KPW+yq5> zo(@t#C!mt9qqzAE9hnGrdF4cnC({0=*qFJ=_U3vqxZoi2lDCN^TEEWK5n$|;!`}S+ z98NXxRwr_eP~jy2xIWwoQde+NJ1S@o67ncR%YLEt)F=(enC%bKztkOwt6*-xkJzN@ z*(k4-rp=}RR1~*DmRdJ%)ag7yNxh>N>pj8unnh(6fa4;;I1K3%5Ht)2PCZX26BUJ? zh*6W7sMc1pkZ>-R8a&wAKZsKNPGkOyU_^qjqHz(x)8>o-e3T_v3GFYRjv>f9H*==a zZS`uBuJ%IgcjY{^qMLC*(L=CMz4Qqw4#I1j1Fa$CEekBJlOkA`5z3SY;9-v}164F* zkfSyxhNxEEWPdh`)V&MMh&13ArWl6pNZ^%wX1FvnJLfAYc9){S9TFWKm8P~Ah>z{b zrEjt8?}(EFkNSq)pTqqTB9xZGvxZRb%olxQEv6g$ozd$S1bZko)Wy(fhiwDceH7(TgAtj4lMrf>w}l;lHlDPaKJf|@P2d6| z=gxijP>4xROjU~<35cT%rN7b|m|0{$v`I#ab3W*1AvSnQz=fNbY_&MX1dP)XGpT9T zy+v|3padl1%|&p!cdxSMZJ3%I;VbiuOeQTbh)*#s71g6@$k1w?1+vVZ`=_H=g(-P< z9Ri(!Caepw?0Yg9p#uXH+Yl&#aLG5dX-G~F4T72z>T}ov_v9UGkFG9Hm?^O~$Lw0L zZ7EH~8fhpzT6v>~Q#-u{+~?^ICkYvHb3h>+j1Y+z7NtdEn+J$NgrnK`5t?>z%$OcK zSFM>94b1in#`AS>iwS#J_!Q>yNaS=;rCJE^C08@RKb(9f@oXnWbiJR0x>=bMD`Rj0 zQO%Y)S!l{xhEDVcqTV@;Qkf>dp~02X8;OxRY@>k11@QoV$tX~^s6!2gK7IU1$qfeeno7hSCOyNwQB~8BYQTLBS#~aWFn!pi(Iml? zW*?mmy@%4nzy)z#bpooD-O)c#o>~Azc;_u#nx#9QQM&7KnpaW`WXMB~56GTV8`p~x z8GLx~$G%QwqO+m@f#oEP>lEvISvQ@G-P>-?_E~5LOV>dx+>mUFzs3dGx&p1S)0hjXYP@O8xihiscV>lzNH00At)~Wlz-;tc#|Q7dH#)`y?Wz+=c>D`!>^HJt z@Y9WXD3Ea~$1~C9hV+`Jg>-U_|4izX7h&T|liK;dy=|o^Hoz4@O+YaY;U4h`<`w_I zyP?y^vM&8!Kcyfb09NAYa%e!Acel^-`?6U~H#W(PX*{ueOjf*hlx_SCj zVsNbg5?n=ymM*(;dU?F;_}ER zEtxezvlQ8z2`%p_DR@-!BQqtP3O^BZ=mWn-rYz*ldB=%83CkcQEmkvF;1eIt3v3qF z0sXnIgm;`ym1^KweZ!}?=P9~VaZV1JGq(0@Q|tqh)>OuBFA;z5>W3asiko%om%<)k z#+i}HTn0r)IeDWjGDLeKp62%6w(>eOLy&AtiTq}+072Hxnw^`Esd%xJ(O9-5;kJ`1 zJ#;y7F!y#fHpbm1UCHeJFiA5*xcB5RtFTWcL~@f=WinqKKrD`<-O7MX4!Z(&I@VT< z!7#sKJ2`}TbfGGf^cDlGr@=KFd%4pZLk8JsusRvjaI$QVFx|WIDe0*wDK2Tr)2ghV zih|GpE zS09rDjx4AXf0JE`DY4Knd0EoP=Db$-;F;1_6T|ve z_^<7=jW2+|EMZpHMV~0wGcw^-Nv zCuEP5dS3|lzF!*%EDf_3)dnXLeCMS%@2d4)8lkMeSMI8*8&$rBjw zUR*1rIDXowO;Bl;8wDrhfwU90L{5rGxzBW_4z3#BAME^Qw($VI^Z^ zMGJ_L5ae?BwBtfg%xc?7t3TzT*XsEB005#Uc1d>aqycE7Yu41b794n=z54OlN`Uph z0CBT;dmR(=;Z>5Y`vWwS8uc#MatYMP9iI-@Gwc7y);YCj0=3CHwr$(C)3NQ2Z98vl zb!^*qI<{@wwx+*p?}M4y`v_@pf0Pe@vWn}F~C)4c7eMw(E-!c24bj1)Kv?w)wUmz zGu6V3U^Dx_riRdk)D@=;csC(#-9oo+aUEZkucQrozn(6X#Q4X?o%hq%3H`3`=hPoi zqq-OsU zU>e76!V=0#C$2jxhC}STZT|2SjEYA3zI}mU#{TRY4GrPUWcASX>|yroKILv*==zAn-y< zxAveET)4Wc_x7?$+++4xQhF(i%!?~Yq}54Yz-xW%h+vy}60iNcu(u=l?WcsY*N6h> zBR_mZ|1=k_wt#6xuO;u^CKmWuAq=}n(g*Y~on`<1tgT8k#S{E-QyONvBJ=&eIm%7d z2N*RgQ6G2HPRRAzczy$~1wvNw`o56LK*;L}B$5! z!E<503X9ot0U3@9A0VRCN@$97h1mf#Z@*IP_pNo28SGvs)NfEQ7(-G=WRg13;l~c* zzZA=a@uPuwqy(IjAC}FK%fUxEIX$61H2G5*ZKhT_uh;RU`LpWiw zt0-Z7w*tG2UnjxFuY$@PGbGTqX`0nFdA(0~=wShun;4+Boj*T!6N!vJL|eNc30h}1 zCy_!@W@NU$rtlh3$LHU@8k@0EgD)?Yy?Oc9oS$^__Aj^$f8)-Jd-LUPo3p~0?HuJ6 z8+LuUmW}r5mW(n_T5r7$!xR8~l$sNC;%k>Tg&Utjs0B#jxzc<}%x;RCg|EmqlS4>< zM2FM|LTm&70se_0i&2IgkRJ>(|GrZ=8R9Vn*>G7C5O@`hE?Lxt=u5(e-I%_zV+}un z8Y&*~UEc;tx*o0j)MRNq1i3*r>x&)~$q$;kt6c5rI zQX@{S=d<@%9YcBjJZvI37gzYWiPPdkDNa_(G~jo_v9P|@9w>kR)kRTRpWh4o-o{g_Z)KWF^ghF?rCt%JDMo6N%N^%`Gf6RZAjwwKt9#$(5}7HW}10 z_;@R@vY1%$AQnT|q*zU%7t$kvr1z9}`a@Vfw@rHcT(nqj7EF1>b2KYtG<&n3`WUp3 zVpk)WPEg>NQ<#X#bn*8I9n08slzo@MZJFSvmc!F$Gj{y~33w_aBP0g!D*9 zx!|~JG3u~BV#|paca1mwgA5^{b4F$~HsOOXgNq!!TDG#)m5#^SH zO*#-BlVO7>(1-!VMNt&U`0i)gX!*p@9RX~50bKlrS- zib6~Kb94Zi63&VPd7j_P%vnB_#1wQ|vcC`G=O9)On!6ACnhd5%Pe&Kh={9)HzKA_a z+h4O1OD>a9PMkSIsd4Uu{C3Swvf47_lc6%CUaQ%4kHIoFJ--RA-zU{Ae_TL}DkixY4M;hc#{MPhW@M!*xp7_!k3LJtgWnb2GU@%4fHP7^ z>=*}tE5p6ggJ6Sobd}*Bv}T_k-^*RPYOAC&`5~cVI~Fo54YW5D;=g2ug6a37G9`c& zAQEarQ}&rrMgw8%L|Y2D`2?G0bsYOhoygD3ONn6(XzJd}??eYmK(MC&@=F#Y27zPe z_QyFxBr-EA5~O*^b}N67P1RMl+cz8DbI}IC7`wB1UMOiYy!OA#YPwBzMq`NK!`x!I ziU_x(I*cP!lwP=u=kVo4|3bB!pam<$1)(-6?}FXFP6jEG%@DZKvzH){V3O ztYKiXnm-dlJ1R$+k&DtPDNN>=XIX~<92gm-bX=EZHTEwbxm>lYJ142VO7t+di!4+vsWjx`&saJ# z;5Od)B&7PPSkwJ0%tlO>iO$8N=ciLJwxW^-%5Id)wA!MK*ZQs+0gmBLRPxStwH0;( zFgWCx{h5QQ;G|J!%XYTL`(;#4DkXqB-C?P}#mH#P(Vq;K8Q{%r>%fcGT#xU20-38G zw9sgar|GBXsj@pdY#=?Dm@@(eR69}9R=w#l+9koC1bna$=|hc7xqgAn$TJf6aiPN} zlWDC2B#Av73jwCv%rEl!-1@b`vdtWLGx>HGp5UX`n{uK7@x;Oco_hVxSeUi z!zr2}aMr`yyDr<&15XOa5VGk`g$Zmfi~AQ{(5XuG3mD3*0Pg(IJ{B$prgP$O^WO_B z&;(mre4+MUh)(aB8SKjTFk57y+5@aeR;?4&<>J}AB27MaBWp>aq4Re0<(UQEH4v(v zBg%YCS6jelCuB;NV_it}FTMb_DMsqUkc08R49S}=%dZ#Oi$vnfIWU^;XF3&H?q9SO zdqO1h18-lOj6;Q%H=2m#_=hZ`CBfXozLAQSLS?<(!ez5~WNpfaUF-X0x~@6OnEqR8 zPxPD-kNYDtB@33@jHi;5u&}GrgvysUq%qU0U=XOxa1RV|8Dj1CWe9*H&EL)J`T@nS z8q$M7utgcZXOWd>hc46=BOK6UuOYTB?t4nl?OA=2I+13P#R)l^U z5mx-Pxsg`n?)XUCGK}Sr&^5$V!U(MkMd+=*x5PWZp2P-?@fv_FVFKvRYw0^`8nS+D zUvoE{m?2y9zX4gv2>*JH6=|fo&trzIaZ6sHP6z|cx)sIG!WfGSMDj9>9rDXkSz1#0 zT8?QCc=b+GAK=eLh^;yM6hjb3=>J{}T(Yb@bd};F7}+Ddcvamb3GuMm5i}nQIN4a7 zAx5%k%iCfXr?oclGTMxaCS%D``68kx)^meS7x284WfA;>L1F|b652XkjP*-})@=W! zE#hTFeW@KEYrDw8B}*ceC$pZ`kN>#95ul-;BIc?^d&|_F$gUbhe`ckNS)X{y9elwd zc>VP*>^sJUIbcnDtS4^5g(n(F*Qs zq+6B8r&GeRATJ2p#0uk`iZ<2%yIaFvZ&tOOa3DSV3?by#PQjy{WsiQ~FYtGP zNPqXG>Z?3KTGz3~gh%{5Ol>w;uY56Y2`4ANJZXvTIp%o)uGS^c$2DD^8{mq2=?}}4 zJhy^R@}aDQdmRs<^qEWDGXB0HNrm)6XnD1kSS}SSZ^WhJ(CQ3(ZYU0REP>4FMovY6 zKp1G5j`#Q`^_^)g5B$HrIHlt^MXpYc z@#-t&UkfxCC*R_{@^Ksy71R~Aj(e46Y(oP|NnFCuM}mJeaK?aRZw=?rvd7i#kl5_@ zTx4TeM6Z9WJ_cZ>k;b2Ibni80e%!o$zMd3*AY+KAfc}4L6W9MKm}BMqU$T?#L@aIl ze~fFNpz8nV2y9(Y@z_M2Qr8Tl{aXy?iCVH8Z(oY`N>6nqp5-n z4tuYN4C=a7cav`uD>tvhwH{yIu0IoT6S;sn%-u<6#8kqW33Rr^&EG;yO#Al-cQc3# zfSZ?0kS;;^)ToZLTNJzAyT5I(DNwb!G(Jae=*qzg{i$D5Cx|Jvk1Revu(d}J=cEGG z{TnZz&l;Y5NP+iNBQgipf5s{@BaKH9`DtdzyAlY`F7E1Q9#>UDM{a8lRu2?^eJ>#W zZ6I{YIAGn%C7E(=Kk1}2eqD*{(M$Su2hfV>pGsKZyd_k#axHSuzkQc}Q3#*;ej2&v zN&XEEhdv1Ft_L_g4ITTr@%?iu~0#1~J zTZZt{_P(8#G92-2_ZbKx1PlpIZ|*nAYWy9~sBAq14nT)lfSk`D$KT9Vfe*36W}$%? z^(k)(19?Ky0 z4Sz@~Czp3j(mGW=xn9V~#|}1u0i0BuxgPw_*kep&yfk?SQgFN8Dx)LG*)$rGI#1>6yn&&#ra7W%i>{>OBEA&Pir`SExtK6TLH*> zy-A?`hRTs57G{A@If+K>0P`>1b_JCRjN(MyFD9)Y`M+6d1vgerP+XvkWphq=V$1tJ z5-*htJ0HQ-L)H6!k>k=w*e`zSt4l?whK!b}DV7D2#dO!e`DlU-AmB^>znBVP#g>$0 zU{TQTx52Q~qqt1OA{gL~*OS%ZkG(0ec>acdV4k%QAGk6S&fg4w#nG9s}>GUzplhbBQ4jf5I zW@D8KLnOmSbDX570tWEnoiOyH@QEiyVCsaE4G2{IhdKWUrF2TgLvL}UnIJ*M%T#F5 z)1C7w!j}^{6UYPY`zo==YtVlZT-d6XrtgL}a7E#nY2>9dcYy4x>+vT0sqa-hNf3t& z$3yEQG#zaF9)GZCB8WJRf6Pc1y#E+B=^b{&Ik;}$yiD^Y1AK<=mX9MnFIIGo$x`Q` z^ero8e1#xHN$n4-)=h^ByYMwm01c{e^PW~ses3(vsd2)82&-z7QHesyE-3mD5+ zKP<9*l;uS)0kUUse+6V%F=1E;a7PcFSYQ%3iiz;$3W?qaf80w{3?ryUB_W~Fm_zD! znQ(SA6-R8?WLr0I>dZpZfdQGpTmO-Q|2}DCRAoSxAEpxps?xJroQLIYQD!k;$`PV# zgeenJe36S|3psaF53&L;pwI5>cJGy+8leml2eUGZ18gX%28M2YbfiGfX)n`o>^6q$ESr6og#5OHXv z-ybS<0TSgX(@A)c01hn{+HsiF(6dgvb5Gta-j&;QH7Esg$XX#Z2`@MpToeemxOY&nb@N5ag8S4eq0!fqP+_+yjiVweLIt`x?Qa#C zKK}iRVaJ4d=*xNbRd{|Q1gBGF%H%POvZ*>7M`;O7r5=QZpYUry-&*iYl>;ppPD!Oq zZ&LH-uOs9xnbku&&2gq&QT)b2dvphh&rS?}Y^HCCdagXmDAHb!7w{(WF+;sDbbBmIXzjmSzbdfPQLB z^ZZ{%6VKAU0#Yng=C0RgWuP*x+%AMIJ~fS$+Z#5$$3nthgJwVbrTQXFpJzn{K^EyZ| z5p+m$lC!|3B_XKsa3ZE9B~5a7u6(N9N!qrK5w*H(yydR&Rv-=ev&iA@sn|N-Gw#N# zhRYra-O=G?pu0BXsxHpD(j0B~C8?q;y)Aw7W@n6Rdq1P~r)3K@12ltb%CJ}h8HX9M z3z;I2xF!}?Qm^S}$1}x|MY+wp!aEMlQF1x%%yi(0-@_R3COb2 zOLq|copE;@?RMTNv#V7Q=ji4Ry4h<2O4k-D!eODi0LOhc24vA-ydo$C`7(~*y#M%< z`V-k}g#|iTu~oee%6(5yce6bB_}=5=?}$z~u24NEtt{xhzNc{edYoxQRQ9d>Xw6;{ zU?at}9k|j7mTKp1l!vLfGTLuC*&vLekjIpDQ3H_H9^@ZeF)}0L4GZOx@3>JvNdjrNfrzLQ0w-Um`8P zxD19Hn6KImZS-j)O#`oS9h}>_ zGgt4*{<6f2H=j@ZOmngqqR<{a7j$D1;dI;^ad=G&2_) zszqV?TNpOk^YpqL`NyNAlbi8;S8{`d8k!AS%C(;@p?S=++gbps{`-o7XEBJC>u+z> z1LVcsbKHGMK@QXiI-S)&EG19IL0_E$dxGwd{N_?Y;r{H8s;;l~$;y7{hdtn3kY}Uf z@;@!Je*FYUPcnt@} ziT+emVvq7Uq!6SOoGv8k1%(PE@mWp`_{}{T6)5vFN{vxvYBnEYaLy13PGyjSldkx6 zAk@^5e?W-25SPHe%ps3hu_rBxx(j+(iL!!kBGfn$RIsLO*C<_z@`|Dcn~R`U!aE|@BKlc;!;+l{T6)DHLSyPoE=OEMGy06 zErTJy*ZX0RdX0h9wXI(Jtvd9QLz*8G_d{GC6G5J2aLN7k1~IvaW>)6U48im{djlnVm!AXa6zUBJwY{*zMhQ%IFAWT3_i3K;I&hrKv+mv|N z!N(Y&!YJOEIi}z!qHyxdf0ECyhdqptcswdugP!mh^cMSFz&>AK>QQZmdc^EO=Habvp%_8@glaVN*^q&nny+WfF{X5!EKA<7u z6)ckht6l4FQi3c>3$+S%j%6h*#8^s^bK%+npM;(V}O9HY5M6i3t zvC3R$&;c~uz9{vJZ|#@!IRHc*`Bt)3L~xX)oCHdjINykz9Xvxw>2nWpLO&P5@vX*k z-O$rn7yj{Vq@rElZ_6!n^{Y9UQSsaM?FpWtTkG5OZ3q14yz=N}f-q$#x~H4>>v00{ z@kZZ$z~S`Ax829b$7Jiu3z>6i)~)KQWul_pHuY6LDES*+;f=f|4A3J|gk>pshK4GI zjeVS-Tl5l*`_@|f_dWF@4~$7b!jeqJ>K<;M2V%>aKR!W+9g>=j)r3GIslsHXh%74- zTJj`4r~p@3#F<%&&et^Ffq05_RGHbGMQk!5Mb0ksqKO3KNP@oC!43Xg> zHr)XBk-IJHEa5%(lk^d*ddhXBctdKFoJ@*j^s+SK#Yy z4;ImV%iVfe^{cn#YT({M_i5t0&c(DHOpwvOl47xuSZ6Y5@zBNr0v^UZot3KfQ_{Xt zv?utbQE}qHa6k|gvn2A*dZ?+P$&Fzx*5Y$!&;?zao?aO&B_O=dv75m4hnNt{GA&St z{XSq$==>`42oyN5gzI1sQrs%^b-(()Pjc%IVvYC~U=%VuISu2v9})+UtYV*x*uaAf!HALCK-A{YiXGn=uOS`3(&ynt8&Ba!ifxV`jfk#O^Y#( zlw_|w@`;~|ukF0w==@92p*qQd&h$3gsKO;gIh^*Z835<+9+eIxR4-Z9ja-J5;^Ie; z_d~}{{%Jk_q+bU8v+nT(F~&{O9nT6o56H;T2B~hFRY`EYv;V^{QAEmL8|vbsv?ZhG zo=?3Jt**~iMPT|v?jxu_&Ka)i;lcNbO(mPpuFo^lTphaQIJA7__x2Qb^ZgL##60L= z`4ZN44M^4V(7hHF9JFh%81PNHtZUC6XidPDX`?^jFg5G(F|tGrWpXj}CFE5f+T$2o zEzx6iANWhbtuj8rtvVQFiGN6Eo&@{wEHeT;B`OzvJBhI*`IqLJ?h&|O;Mfm7Rf z{P&mK_LjWWWxksp;!>#~<(Ja$h$mw0QTTa&0C;7#8+f<$d=T(m$`yC@AXu`b%hXt- z^z^dq9%B{00Bp0^_Oywgtu6$>)4zIm^EEx8iimb2nU>2?e_jZogU4XdAjzw0SC<|J z`WTl4i^60dVq%*iqbLUY*9`Oxi(P# z0EldMlQ=@^SD@T2nl&8;EYc^En2L`h<;#QOe=EYsAEWlcy^fX)DbHAtE7RVh{>)3) z*R~L?S@?w)Df+cy+I|z;arkOZ_oYB+GtzIeRAA2rp3HjXPD!Q@O^gx#p*cugM>SBd z6$2LUu32{`Z*@)@CzkD)>@F}BHQmPf$J;@Sg8>mwie#OsF`X3*bbzgX=e6aymH$w)kfho#73 zQL$p*=8J9)-dEKIP_e4FmL1hvH_(o9H76MdK=4|*f(={SY&(a(7HHgH>t>C0nPGCw z_esc9#4*F~RRVBIgrL8@v4iJl2aY{y81UG#BRP8tI1-FsnaJdQe((N?2K-A0h)Nc7 zqie7hm+Q(2onHMs-TEoOf?epriS|S}o*HWmb3PuFM!S?W9i=E~)i4Ee%P0e5UPnzlvbvoXfrA+WYB+Yt} z8@2BFWyZ)t^V7ffCtz~>0Rk>p_(1gUbvrX$t3(xws(w=Bu1(h`{9N2&fwjwe8?CLP z^NfmjBi|%;^=s;KU>|H7rak2+c{5SHx={=JrYT~(QpYWT^+(6>E$}qzg^nT+B$~Qo zwzH7?*?{SjAhjKlV}gof?wWXryWsp7{OHJ&kPsCSSL|@kV5hfuK(lMtO{LX>0N;j{ z$9aNL4(k-z8oxJq#g*vOod;o#TxwCCjJ`iL?QU)4XYchpDI1JWGj?X*6f?^ey?>NY zIY=<_?_<&Di|f^0EzYapB`^_9L>lbrG7(*_U>5Q&Us#OKeR6+Po0pfb8k`Eh6Ur)z z^nf$G`r@Ic`NNTC08+Tkp53(d3AWnd)!fb|s~4gk@8!B(0pBO}Ss7D(Qm{l*T)2=_ z10px(n22*vL?R55l!|&83I)*>D|Mo{N}#O&R2h3q{)YNUhusOzRkU0}TLQ>f%vCDT zj)_q=gRUDy37p!)$7kr&cXJ*Zi@^FwFgZA*kFg?o|V3*ZnzIe=H9{C(VM`@$Z zQnLh}LWKdQ048 zT=eRA~!k%y>tz}O+ zTX;&$G~^W}fE}*hS8&YCbGW((NQHc{C;ly9tINL9OwnlCq;!moG6u*jcQR~>Cis{< z3Yz9E`1^L(bNs?7_LQA8Y>44Hce(R<&9w;4d7a)voFY0nY_CC7$31_Y;azWoZ|akE z3^{n-@40a=slWeW`qa^VsiU^T$~&umO_IYjeq`oeKL7`7;z+QlQiHqxf zu3Df1#1_V!nd=s=O~zi->7a^MpzJvgo$8Fmi?3S@Agnu zxngG^Di-mJ4-B|gsIZFj_4NDVAybtSXE-cCw$?sX!Fai#Hs2XiXw8**0h3Xpc&UlL zn*)?;1w5OsJL3D))MvN?=`^b9P%7>Y()9p?%ZMB9`|bSp0!N1nTi{{RjePQ-f9Mpj z1~uH8PVSlPKS~(0^X;hZf37z2ePO;F=fcoQ=D82Dfu(5@N+PD<>tfYbCZqW^AW|X$ zn2}aGmW5om}r|u_?`JUv59mWYugWKtg}j@e94s#lXldsp|_&VJ43!z=AP-u zS`~)HS7K{_uGVYL+zl55yaW$87?rV8T~xI)V_n7+huM=CzGnvwSrx{z0;pfpIPmjX zz@Lv(4@&=N<6ih#bbirMHH1&jZ#&Ba%3anM?Xgk?O20O4Zq`>PlMch9Ke2dRsd*b_ ziO#oMNBoH2CQ+Nnq?4K zzISCpS)mB&@hK?E?k6xHD26Md=eL`->NfD!dE{ZF@e7UH=L7K0(e`OZ6d;`dhqC?G zA`66WVd5QnYM5c?ekDudy3(Zk3}XL=lqL*JJ6f!e1DWI!wwEJFVX5lkyZ5@!g1f5)FMDIq1iKP*9io(Q^s-9kDy!9ZOB&UP(iYtVc@~z2N zn=F}zoMBxh;GPSwEXjD@U7UABb3^B#n|4_toy%pWZKjtTPwVr0 zq6P+OAIh2ZjCmFU8e>ZkN4eC#52sp(CCXw}pK4Y8a>^*ivL24Yff^qXUOrFm=PjvGLV&@mD(Y5x!n5OZVvt z#ls}p7m#rtuLGKBwaucV3HvNt^Dp+Bmi=LJrIP0?dGFhQDFBC*49D zV(LFE-KfCHSbd38>}tGMypW%GZE{bk80Ys%$hyRMR@+WRt?D^aoW`ivl?Zf0 zg*okUr#5rqFJ29heHf<6JiEh`e8haGYf-MBQi@S^-p zeJxg`oY9n+>jcX;Wj$Tc<<`1gt`X^_(01wo=y)7%*lbfLey%?=X5Sc7aK(Eh;H=9o z=`lf&6^DMUtyRNX?jrvM<67&tJY5YgVeu3unutaDu9@ z;N)BWTC@VI?CN+OIOBS{8z_Kt@)*6x@YH$lGOO$6V7RjUVdd3TEWdrC*;9Ecr@whp zyK`mNX;skadM3o=Nt~7vsRanR-}1eT8+cx|p|mbzw07U~n;+R^Z{W0s>U*gNY|q3k zU`Hu|PZFTWQAK;PJIF{nSe z{UtRVEIwNlT-PtMWJI_ z^ErRtf8lPwvi|*ka{3yGo4ENYV(d*nAz%<({_hU2w>Ue*<KI86)Twt+B zOq#SS3xH;3(mbp;pf}$0_K84mz3^npXpwy|Y-(u8)0)IR{f@(7+K%>eK=;?}uYNJ4 zV+%>3{*={L6;Mq+YVf1@SZ1P%4(`o;a&y&pq&GB2jSIYmyi48#&cwWmO6M}ld!&-= z$Sr}A6;%6|@*22qlh3PgACSLC=HfxNHh26P`B%qP`abQF)r(?z3Ms1L{-VNTKs zK}|)wG{Tlq1Tzpxx;J@St8LVMNtqXL@E1&2=uk(j+ot1Af8D}o(n+?UIbdo*MWSm7 zA~WuhH&R#x7)Yyq11KYZA4_}nFjgrug~^_ZXC~2>^Bru@*hRq&&&0k{Hv<1|P#l{s z1i08lsWUSO=vwx@`!1;lp25F?bN%yV} zHyW{0*CfrUvp7)%U4m%UHc~Er7r~em0HP)AD5ZZP!WIN&hv9)rq-e~Vc+1>j)AJq= zuvQ)-1Sx_StMUiIz$Ec)IDBrPB{rfNYql3hCJYJ%%H%1O##C?T`8_XmCF0mdFOl9P zWZ=zV`^bxA+(+?GQzAA1~w$<_8-pV>V?{ZOwxM+g`oU}3{|Us05JE6 z6A#9|9^j-yjnu4Aij!>_c{wFD6#;r9s6~434QDwu=Z^9)Yu~vvpYi<@qSxB|aUPRH zMu2S;a1{JjBpcUY+sS3^U2(oVYbN z*J1)^AkcrQTj<{<`@5SK`XQ&47N81_A~8D7gg6jx{%48KnYQJ;yq$8;<0*gzHF+)( z>Dj__ih%pEjmu@LCRlC}3+V7;46p*lPLZhC+2188@0|wn7rIHwHfa~;Xnqmimw3ir zG4(Z|$<(LaKA$cFoO4on4nlwv;yTYhG*Z>S(fzdG`Eo`d>>KYK=e16K5FkbcMIAy0 zxf27iT4d~`AEFlRIAFU1BBxT~cCkUOFIK@yyY{)7HVq@{X{}k3UU6@JR znf~aXkWpoMKb>-C235dR)MG zdou}tKk>`$8I}gx5s*43@s3OIDaQ?U^_SDgn!2}}0)eB$K_5OtmA)sD&;teUo~~DL zGTJ#U9w|!*XPK3pP7H@zH~L2KZW6MQOVyiKR=GaZjA1c~x9KQyjihsVTz#mQehe-) z>DPtAy}|`_{Cqum!c)~c7Ak98;V29#!pYNgzxkgqG-3ZmKES;Yv(fruWYIMTveR{t z$ynZ5IYmfGmRb&sn+X0Kv=(e#QS_W?ALsFgqmsq@CDZj9-XvY2PI9}ki_(U6y3h5J zxtZZGU0=287BZdgB(#+L0j)BKZsk_`(`F->#tgrMCW_>_6o32Boi9~(LEFM;Q%2P9 zDqNB26$y&+Z-B3ACOk6DrQ{=fUPKy_Xdw`Ncwko+ifkE=5~;zYFuj*ix5hh{a z2NF88kd+l+TE04BcR*GTB&_UEcZnz-#$Lv-TjRWG5@0)dl?$k~5*UXLeKV&;)CEF7 zjWlks+d^NEn_dlvos?~1dL0tu40Rd@ znTe%K%&&iz1N@aOT$GGtkxN&6!laC#dgU>a=H8{uc{>Iy*R3z{(wd>ooRA)H*)OeN z6R>HW0eGcTBjz8J)lQx^(KjR|7O@`TXide(hF28P~coqHp^E zaWZgGtV>%G(&1f{!89Q;ddo{KB&<0q9tP2x2EaCT88(UMav4UKt1-2L?sazztPh8A zeE&^6N{N|#ouqv+F(JKzZKM8Zjei$gUr7?v9C!kK;iY??d&hQJQJa+}!41f=1TRjZ zkYcm&8B^I-unhXxKkn8a-Qv|axOsvo5P4zvMGxP1PHwa3?2C)uOA}LHT)>_dG`4%8 z37{?ad`9 ze{WsuH^rg4!`%r#W#zJ=hx0 zT*@wNqHE!FpyU%wROav$w`mKsmNfm87aLSLOq6hPPMj)Hi(1GS!Bj$GX0lbXf-F zf1nQ9j!|8{R)kcV_+a`JK0g&y^93q54rO;zgyR zjuqVvxRf&mIHySRa)&4A32PuHEw0ydQ%dYTFJy^Y#2f;DyhIh38hA*}QdfNGsNoK| z^k&z>3a`X3UX<`hAd0S^23f_cVCD3}MzDjBG{FM!j-5BS z1hX~hK&}B#5xus>`ZxBPyH(QMp0&~}8mV!Vk<`}ac-A)oSF`ETv(c}m_WgsdP?)8v z_xO4i=k7GX6rOWCxyr5;F$YhaP4Utpjc{KwH(w-L5{L^cx@tMcYE|*zqb$sVps28F&2ju%3>bIXj z-n{sr3MxIfJKuu*KC>$AB9pe5EAUZ2LIte=#4wCsNOguw4}C5+RPZ0A;f`*(QlW(m z|Hq7;X~$KJDbAM%U$YWQic_b_9CKF9d)+k;amSOVMbNVwO-mL-7{DYJ0Tg$D>FhTR zPODhHmL;R!$}C~E&&1>*j4@b|j9;<5YdocpEEhJJBo>vA6c`*M*XVV~_q}0NqlZbt z27Iid-GZHd{k(kcBc%c{R#FfT@Z#Y9p_8hY{firhF<_09Q zLXMwyRO6aLz;q_W6Hh6a(5C`EDVqz_5ZN7mP61@EEry7v zvkOYW8Ic}=)%px-kz_O zN}gHobI+wbl%Ocz@*WT%+sviA{J1xZX9cSTK)o+6` z+-l%`{S#E6Y2o94fF!Z7aQq)8y#Fs=9j*R9R1PvI?C>pLR1Sp!XFQ%?R1Uaj8--ZE z<^2Tb#bllT?Nb`?%~#B#4_?RTU+%~KKk@3@cflt}!tSc<&zs$w!|r2v$Ai|e@wjJa z$VswhEaY#|EpHz0r%~gt??5p~jz#}|p*>GWFrK4Nw(gr$@KQaTV5?pT`gZ1(32^%y zb)2Cex+!?gye{NBXe0mhlr89&Iu1@uwdCbv=|j(=?WUR#<}(|$nAJ!7oZ?5o=v_E& zj>FJz@!d17GW>0k?R4zde#0;~|1`S(I9J!_dw#Uh%IMpNU>czBr>ANZO7Qtqd1Mnq40v!CQ1V8_}fGhC@DjjQYE<1uA4Rb!xBtGk6)w);vK&My9+Q1!cb z{F8@yW z_2op$U!2Q3_kIi0&kKQ4oThrQDHIHQzfelb(k}a9Z4?J+ItrA_hzpoaQX*vs-ee+O zpR%j=Jsz;2$ZsaDkrf7;Z0|=d?EIO)v;2swUI4JapM3$1T&F9L8kmM;im!OBW-Df) zOU8XB$|{Y7Rv0C!^2Gomz{dJ&iBylKm>~La#Dr53`htg>|I!A8}BA>Zd%)gU27$; zi=KR?5@(l!-pB9S<^3RsLp+(FdXsNTzRCV4z%B6lPnf?RiKsi_JQ{CnW=gK0Vw<3? z&ka@Tv;G_GWg0>mg@vkAgHHJuJ86qKp2uQT7f^D+l{DrPHB)qhjq_GIV-|kdbZeeK zBq4)c)6z}ai#P|CjzOM7N+3SteOGm^1dV#DX#kfvxm4XZYLx07LG5sq|V~2o* zeOkTflu*u`ujC4Yr|>=u^ZvrTpFTOM19ji3oN7TR^>776rsXLs^#GEegwSBVjkFnLE7PGL2g0 zFr6vk3@|@cDLB+xci@*;NCdZ?wXOG%z^ho`JX#K;vV22^HC0zT zF4)?&G_`UeUu?^~-q*BDk9V?lx68TG1roDx!0L_&VD5Zc`dEZ%GMc$$k98bw)r8Ea z=T{f1Oc?g+ysm}CQQUFV=TQT3#jm;T>cmsiwxi26WW)7;#f^XsDe>qG&pHi^}J9J`O}0>81!=hZ5!G#!=~RVYqDiOF?KJZ4{4zlHZeDTPnhX zd)C3FosVc5W^szR)1s#ky{Wa?IQP7p!|8FgP7P?E z`d*F{uZ}Y%6k*4U7l5#d9*k{QrG>9?!^5;z=D*U@Uc>OkKCMwc01R!1CFY&I~hcJHIlJ1{|={Hlq^*7p*=Lt?$a?PABdGyP`9tC>GL@XV?&P`inj2_wOkDg z{cCJ5nebTt1JcxOojk*(3}Uz~EBn}yX9mt=bXaXdbN^N!O@(yv6u8IWy)L!V-z$k6 zGldgVfcf&6R#@}AhB6|rzN^O~uC6t`h}=7ydqg<>lnBZ|5PF(;vZ-Zy{1xOE*)O2n#C zWvQ$lpWwM#vs@fH1>m2QhAwNzGtm_97uNqnGiRCP*?zJ+I|Ep`A>}!HZUanVl9qNY!6jiI&x@<+V zV?15fIf4-ukdR-^M%>Nf?-W)|zxO_Xg`t_oESmory}brm1AcKP*GrD^r0Bn1hgj(q zCG$Ls4?ZhwiZfRRaZbFKyN*8f_(xt7(W*9+T-Yg$6{#&q)x>rx`qP#rXj9dS9%Tpl zXeEHD;12tjQ|5-xod?p({VKIDB0)fqTV>!Kug;riTX6RDfY9FVqsbbUVKeDwBhXiu zJXJ@C^Qrx?&sOS-=((J$YXn^R+m}ZO1_?EbK#0ZbmvIll;ShXB7 zn2bY)tr>V0TGbryA}i3g=4qSEw7nL`jW6ppu9qZg{X&CQ#m&*Sn2S)F2^TtG{r58q zUA458%K4bZdA9qv|ske z8jGaF8cJg$3l(&?xc!Mu2QT?w;G#~38EI}Fq9Vx=$_t;8X05bjqq0u01uAiWVFVm!4CGsGaELmTIC*xyYnw5_@-Tk@9 z5(?Lu$<4D}ekRP`T#_*cDbT$v&l(1VK1gO?RliZWETb-%(Q!NgwJkH*df+@+sGwBg z(I#{e+zk5PztS}HIU}(;{Y2!X!Lg?C3bXnCVt}-j?7MQ@*moM8N;8S56rGAYDPN`y zoEv>is6ih~{Hg{#=*oVaD8}1`J=n|gnes;sHyblX8`FJ)uhjxI4d_(io-!ge`A>YzWU%8awi6?q zbU^B9lEWfP+U@YK1NLtuH*uHn6W$qvy5cacRVtxxti>kVwju-zaO8Umv@8zva;VqQ z(!Y{0-cHn12+YzGoyQ&14^hM=p@&(yq5d=uKdFc3_68_QPPSk$dchm$K>cM!*%4>0 z=r!Pk-S_!HXv8=0*wa)mM_U(dsB%s1mIah_z0frDc5JSz!Xy-)m8xKjWFRYrJywru z<(seHCAY%on1e?ICGRM#4fc||$TK}JFc zJ&DQ3cs&FcqseIGt$a#tJRtIW7AkxqYk(3%z8z`UMoqmLQOimg zpq_uXS>Pq}QJ_+=x0%rxhxQz-1|hHfy$>|Cj9uQEQgMAkoTdIdvf<3_T4+zTOy2$Q zaY%z%Tg7mnX7kM2G_I30q;V+sx&IJCc^kXMz%?sm%n*9ynX{+_byCG*5)F{F!25R) zSK4jBG9Nizr)c>e)I3QPKKckWl!9YONxc4F+mSxD6!|&JoD%(8oyIcGy$~Uz%E#)oLHdQKuRQ4LhsRVQ7sUac%lwvzE)U^Ek4j%_7H z)(hR|9XIGNH`rPi-^`jB#20{P4WW`F$pt{mDYcQ`!MPR%gh|4V+7;W?5Xv2dQYfq+ zzQPd=vVE;xQbtLAFZ0;mR((_F$%<`lxIv>v(;hbe72+`$iV5cc+Xk#8VTkxRX8+TH zvXg8ys1SIVhPGr(7xr4%M4}?JdkYDS19C{vJ4n809TIw3{yChcS~{p{CX zm!comLvRTgI3^)u>4}y{a!jG2qlJr>%W^Kjh}qDL=lodKmgP)D$RM)>A<*h*84(S8 z7$*}QL5!_u2Dd3mScPht5seihXw5psR%pnu3zo*LZ~Df?Z-KLfKj)n7Wa5)E(t_5d zXr5o2o~D4J`(k4S+xIMx1iPO$Xh-p_Dp-dBO=G*1ibeaW5iV646`4L;nwW_2J@KzG z2Qe({@v9m|RhssZ9M5?TJCFfJGXE!IXC>~8g`7Kfj6`)Th(fzK+Mh1bVvHwRBtMz37+j&wF9^? z8)-8(CUa7!-;N)AncU<7pu%Tz+tV%?_4?gV9BLld2=6rMIXGzOeMt6FQzBm9!AC@1 zw~e4foV37&sIqQ47k`kOvu}XBq5Jv%U5&qwx`wM8rhbQQ>CxGgCA|?b#P>OvU<6Hf z-e!lqZn=r7b;VrT=mLlcnm2mz*dnL zYnEq;wW$Cc1P0G-@8dLd9U(OyGK~H^$Vm!zqOF@5J{{}`T$Pf^fkYNH@W=SV1nD{Z!Z(*!Bq)s?coQS6f=+IKF1khUb_XRFQ zHX%9KsyZQvv7VJTUZ^l4xH5-(Ifcqc5&a@nA?l70^rvsF{u>y$q=x@uJ*Bq9V@YG3 z@SVXZ4q_&ykAQjF6>0=eBU=TVFE1rdgF#m=cna>+vL1Hm%_hS{9u*l$6~J{OcH+m9 zz}>;=5=#*mDpSeE!$}ut)e#{iNThJ`Wf@YrE1{8UEt3sOS@TqiBQq2#pJ%!T#%Z8G z9zlpqW;Cw1#qh`I;i1TC`TlCK;v!S+80YBhF>8WFh^q60Z~zwII4+R5v2$>tXIG zU`pdVExkQumhKE(S;8-Nl0wI*M>Akf3^OQj>C(BP7oko8u~*8Xe;Zx-IpD=~R^APR zP=%xkfoaRvTncx!P?YCc&mxhUD;CQ;8SH!rB^8&;KDN3$BNZ?zD?<)cA!YR7Z+rZv zX@16SsTI3{{uwtzWb_JGh}7Q|;=7jeH2ZyzjICcfg+QsC;aj`|(D3>E^C8aLAi)y) z9xA!PlKQ$TAipVtQdRj_ZgC0EiUIGZ`z0lMfZKn7F7Nvb+g@>s-Sd_8(l!ld%QVwIeV+w!UN73ma~K45KagWPc?n*gKm|7|A7Ax8FVoU~-uwBsOlh7! z+*~L*aO@lX&|CA7#R4idUZ>keAi0^XXeIf6a&s{27*;2LoVQFoAX@xmMf0@V^Z z=+5>>2iuNc7G7#SvoEq#cvyat>G25`f3Q%3B`DOMo)lj!nxTdKA(0%Daiv;nFhV6H zt8kI(ahbH^8Ep!yUYmdAU|~+MAz2b;*@xUV%U?xcUOeQX|HLP((n6#P?DG7SAXBq!McF~0Odt7<;xkGQ35U#UR8TEpr&3>|a}h@>Lm2pjWVW?3S~OuQ71*Xf*?P@1xh>rk=Ny2EC{N_# zui_|%2R9{`*CrFptTj}G)s*B?Bx6y*3`O{N2k6G#SKGfNCR2xGW&R_=AJ}n>nBO^X zdnvPhx!>NdrRUwA7~L2FXyHvHP!bezOy;7N(~#I5`Jf@d0OQM``6TVcrZ%!t1IYAGqtnvaM6uGoo*_$h3{{lvXukCS9whI|Q5F)B`V zQ;P;G=^=@K=%c1{vWqnpZmnKNKf~;szcRy6P}>dnGYZ>cA+bnVR-?Wgo|m5>X3Bfl zdFgzwKCP+mNTv+}UgKL#1Z?a0H0g-X^;F&O-LUF7Ay=D8UHi&9sIwlwZQa!m^TdzJSpY?Y2Zp(d2s_OZ#m$tIxl674T9; zJNBhyuh}M50Fg0ogLV6gmyfzw6%}Wd&v}a;In0*pN2pxD*JC49u;~kV4d|VZ<9Ng0 zY)cfO&~*CbG(9~!;jX0@ujgLHmAmAB?UYfuEmRDA(0fJaw}NGk(T-hB@Yp)R;VuXs zx=MC!)_dIV(vuX9$)`Jsgc>zf-n)3h=C3lrvv3l9Log(z(7(r8 znpZZO$mj%|(h77%m)FwFr6SnaiD8e&&f9#?D%R)zA#9ig;}!1ydX}STb^TOcTs`q^ zugcy`TQ6s*A;A%C>)A`tl%a6piv+FZ+rDi8QZqAOd^;JJ*Pa3`B@Pjbl*`O2Ufo{F zBfFv#ICH;fcQC}k#r^2~^0d<8zrWYpuVns||F;Ho7&<5SV=K})bxS;v>0}0fytv$J zaSAS}vwGXIONG{2{FY_>SIuY3(4`cqp0?U$$MC{v_ZDna+bS$mW_v-K{J~!IjUpT( z>@~k>1mbgp!~0G6JO1QL0>g*oQgwCt`{6k7_VhTexUlrTA7KzMoBj>ed7=G(k|IBk&B)uC8fNXHo5*~CYnNNDtSQgB-?Wx11f6OWZuQ=AHQtgK4pffyK58cUV?6YB?WFy#=N*`8VFy2 z;#V#PDXZ+r+0U=%f!l>@#FCd>>ca z%Bn|TIc`TV2l|u5D8;?5AJm_pfyCU3&h{n*HluCLB z;jZ4)*>k#?n$Qg|aSc0L-6*0L6fy2qH}g*0RCyNZ{(76c<}6L4nEw^Guc{l&O8@J@ z?Z82aRnN{wsZp7UvIl+m#Q>ndp=R-YzN~4{TYsCsaKA;(QUagwMaWSw0AEY_u>z7k zPIU?~$W-#jijRFj^D=Q)La-gYRoK9N!OgQ?OR$P6r%yixzx@@Jll}Cd?&7pbyE5m1 zLsRTu;?kS{?3JO7<%8+ieKt?9UB~KD+)c*viHZA^A}( zJT$ko>}TDaQ+`or*ZvNy4MC7YygfDQg?MX6?&3(w++1t9nW=e;W+sIi=6U=YNnkXT zkHIzbpcOeA?~nlezlrNhbby+^cU2cKe(^EB=T)YnQg_S}d8(gxiL~C?t!h@ttGnMi z4*ed#cJosy9Fp}Ik+kcZ@aSw6JR>-H^<=~IM?;N!boJW9WoZQ5-Z~vws0t>i(p_nW z+p!Yin>@X`v>G`nAMCa=&FNBxqF}O+M{SCl*Sn7GIb7i9_#PQ+x7Gx4#3^K=S@Mu7 z$I1bpaDrLXdn{7@(!@m%SaIWy>Q@Yu`uh%Dw;uRS+xnrx;Zr@$d(G?b9x7Rb^#e-Z ztEkhhes{&XixU9SYVMj2FP=tsMEF=_$sR!@o9}bQCr>nEd?6EdPBem;R0~7xb}F(> z#RC^Jk|E`#-@}YT+AJ;Jy-^e4-52aDiWw|67Z4VPD|?c*?*@m_p9w81Up|bMdD2b` zVn(hbEB8n)PSj=3!*jQr+6kiKLiSsMe|jf7ySvS`4i7-sMNwKg#2Q&w{S#Deo|lc= z1J_vIlyhmJ*?>Ky{vTHj>DSMye=kKFi?1KIoPtdiQ5C+@uAiAmuhyCMJFA-vpJt|qWPlqQ$>Bc z<~(VAArt_vbOEV;>er3UPF9w@-zKAuXHprG>2OE$NOiDM$qUS!h$!~qRpsxuDPLQ= zjs;(rnr0z~)0)2H{eg)Q7aL%T{{@3!Xa)i8n1X`qFUt^^7pA;!s%BVDLIzS6=?|hp z0|q8kmgd+}b&05#QZu&RWslc(k@;PlF+&I9;|##Z9VcbYikhZ)`8Jah!|O9G8-*WR z@3b=FI&2bcgBb@!Z$t11VoJY5&{MfjI~I9>H(wo?n1YMTb7$E|*N!{P!ul^y*B1%_ zy=1yJ;N*^WIhrOybjTxm`@8R~rBXvg9jFgQ=upM*$RO;$(r<8ZNw9GRgKduq0|T;m zc>}=m{`EfB$2TTIH(QiAC>XmAF+#<&f2g2&7=Vzt-;nS+1=SLS8y+Xy8SPQ@$rkH& z9)dR%VuO*1qkpR2P-woAioP_qR8w2eXJ2d;4;d3MPEGTo7W_>YO9@7XCeCFL>SZH1)O z*kj-Jnl4khT54fH{XqO~e8G{@r^cW`Iwh zV6ktIaAu0ya!b8Lvhh!@0cK?=V?U}=M#wkAJ`*_**f^qqsb>-rla_RGcnEl654IO(r4=0nvUzl@tQ|MWj|twe4U zkLbuz$Jt=U%&V$G#u;a$^{r6+r@88Aclf2*9w8?&6lh3;qHAe+d7}Lc7k6U_q{n6Y z81vYyV%;B>NlQuvdTYCGK)kZzLTTPmI=*!&^Fb)Cwd?Fdb)G~sOgQ4qN!hkdDRXfM z?s&L%UMOywbRJ@;LovuK%E}rk{4C;ECXR0clH>WrrJ`RP+;ZqwddrJ?O6EjCf3ybr zA)PFU#JEOie)+<$fh9)Tw z#VhqV6T#h~WURJF;J^WMdH8J-?9~j+0{p=~vJ$6OQu^k zHzV|M4xIq}2Env;e=*$7Z>o-}xSFSo3I zBEvlnUpzKF!GqCf^S?Bk(=V0ogwS)1jf6C!MJf%uBnAHQJbg0bmjpkBFA_jiFjN82OK=G3$> zTD5SNJmR3DE-AJG<*A|Q+m3pd^m$csqTM9$XFj|Duk#9*8&;G3iz4oXJ89MhFcv|p zVjZC-fD+o?i-X}lQj;8|j%a6a(1hRII(4L_FoT5Tt+i&gi0d|v3z~;FY$#)e{D#J= zB%DYx(LE9dmDK7vXQqR%4g=??@|&y1FT<<{H@^LhCF%RWC-L6WyyEE3sST=P3D;7u zJo(ADVmb3s#FAcT#o;8w3HFgx#jdJC2@O(@08j48#ILV9=&~5sx#h4oi8gAoFX(-bA-a_4QfBPfl!BdIi zY4i`02`OkbW=Qn;uj_=~%W8J5rZkN72j)D!qQ<~5T8=?9vLAKS*@i2Tov|g{KiUD` z+2!70jLa46mPTV$DLS5#aDO`52OhGAiRCI^Y2;HZ!4QZ-jcaN$qCb&}#Gtb3S)Z^j zwI#Yb7`?gaFflXz2As^^2SOL(>B8w4IbbKeCH{e+v;tr+z&T3w-~VCuo1K-7h>6I- z*cy(Hk5MfRAp!~uf`yrhJt^TD58&Wn`hRGl&h_N$$(!xg4>i|{DAg71QMWWx#w*Se z$4Io>Iy_i!i)B)zWIV}M1qHc|%zvWATzKc)nVV8>tmR8_z~K9Dfwmt~ljX0v!bhyo zE2Ti)(x-+?v|ShSKM&F8D%+RUvZ=J}7smL|LdG2)FSiRnH_aj2t|G?zJ+L->bN9W2Yz$-)>OK*kNA2DT79Uruel|~XwwMda6larAMAUs|F|)EWHLwZ+04g+_+ins^f|U%q37&JfoH*l*ae&IN zp6CTmg!DR|5;HlaOG}I2i?knqR(EJq;td)fC zhQsv{G({w`K$68+$<*YKJqpV}lPM<_dzQNLm{r9_kF<-)-H%=uE)Hlty^@L?u;#Em6?i97Y0V06lpsQ~m1BAW5$DFx0OSk(;jz zB`jA`kvDRstKXU|rBn|sM}Zk}7iC-%JMla_mEzjVZ;L=P!i}w96aF2(pc>qz3_Rc= za@@fwIae|rh{!28cSxyHpclGWjRp5zi4UBpgTYP)_A{2NC{J~i38#aI8`Gx7hm$bl zIFsks7O2}~AScupY42&7qCB*3zCUbsyL<`@XPJ)I+Me%^BK-28m~w7&d! zS_OcQi@_32sul}HOVIU1VY-(%Lr{nv0iL(}=e}@nZzY7jo^1QiR^_rmfXm6v4fzZ4 zH?T+Gnk|8w zWLUyojhCK6xzT>f22ohJ`X0sI9B+k*>W37}kOe&Kv94dpsd@tWj;dB5CH;2rUo$IR zaG8E{3dU9=1rTsfT<|tq0F)eZ2Um&U%#bq}hYACpiqr}tiVD2l7{$y|uNq~axHc(s z9NQf;Qvk;uGb)0?idfoujGZh3N_?$FfvH|c3U#p(GckGAhFF@Z=!O@L(nRJ1}!1lTzE{S z^Nyi7l%=gR%n|O7Dg8$gvtzxX_s^~M`AN2A;Upy z@9l!+>Lq+1^btKYfj9L74y=txtd)?h*pm`^$wU3zuw57Bf zo8oIve#XGw0=W@C84MLh{uzV0|FY{9+WPfR<6As!=Ut@7)_Lya8Y#^^Te{b@TPHJ< zunfb5b;uxEFz2clC|Kbm?lc?2@eXWXX4D|sJjbe60P0O}71n>5n-Fbie?xH*i;ZEf z9kV@!94l`eB&%3lO8@qj5P1r9HLOcdfoy*Y2?hWYP5MM;K`8`CVSjinUE)gql2+bj zpBe{^)dG=G&b=RHn2O}(O}a$n<@dPLEL+EaB~`3f>9S>L>^g=1TdlI^f|nJZNVNYM z`+9Y>i>k0nNmjnvGR9s54~0u)#Xv?yq><@5kt$ycNSe-bRXL{O)R#=mt$wt1^FP@ zm=yC79a7$RY%s><29qwpraE*s^M#ET5-gvRt)AFIALpQE%a2dXhq!A7WA|T@t2J z{%4~3I5UfIl_<70kVE`tb&X)O6ibbP5zre7|4_ZfP#z^NTdOhBp@DXQ4&$qv#L;~k zmW@GCzdCi+NP4MWYbF)$+liKKSr4q^ii)sXdo{WTQn9Sz0{Rb%2^nlUA%k&UvMhSe z+NHC~)Oqt;D5#0Xix&-(Gw`kfgA{d z^#j`Ix$QgerHq79|GIYq|Kv>h)f0^!5~y9qzg?xbynb-@tLex4DpK z2`?oA7OY{b^tqG2q)E)?z9KRQSKz5ERV6Z%R?l?&Q)3`u$?bAE-&wpEp?g_6`&B5t5cb z27X=*=58}v26g4(#8TN7kz*^I<@9k}H1v z`2EgS(Tn5R_ZZ#C^BNo=?53o8qxOA1nNQuzZtsd=^RcGK`V+45A&tLrLwx|a&6Qg+UUbADcKO6NDuj33rt0@%$L zx6fL0Ygba9L9mMF2JvudXX4LS>9j-rW;ieYT0WSADqZeYHZajO$7#s@sD9A&s= z?*6%VnA7>>sJf@AS+BaG!mkwI=4MibpcsZ~TmdCmt5~PMrPA5m$$(S->T>7^ON9(c zuFGGl2Sx}u;XmD2y+e=GI9ryfZ(+{zxy=X?P7byt%2)N)Mo!$_k4%aI7+1&svdt`( zILEZVSu994!S2lyyrByh%MP6rHve1RbOh?Kbb0ga-bKe2sa8fx=vF18%jL(=pL;Svmo%l9MjRw0UFyuw}^i8PQl~Z{y$euEc!#wn0J|bD2 z6Pgn_#=TjA%==ITu=vT49s%%q>cT=4al4UF=Q*B;sfai=EAUAu{!14%+bH}rUoq^O$5cBrXx{Uk`XclK`td}c*_|Lg872=f)a+Y(=EYJmdUhwi&{9Yn~{Y z8-t_Nb7TOt%qI#x3gi2AW1ZShVI6O&CW6B8Os;ot$fdwjlAj)f9>#SO7!i^!nZKI0 z?Mw%c@66Vi=4Q##s)uPTsFq8ujJq7SIy?5*i6K{x_w`Q|My}cni@UjyL2b9_j+~X8b5{QH17Drm46KPSKX5doS&~yPJA5P zKbF4}acHgfW-;<`AJ`2=M{#9xUP7xLu84DxJ}BE_7xqRmdN*|oTSd@K@Pwqyzb|by z>Mq;?Bf}nnFE&3tEi~lAr}`ZR`PEo$0h{@5%6hh!*lp;y#8_$4-;^;BTmRf-RM2&E z$i%ln)AkC=o^>-SVcHl*XINVqMjcI^^%CfPM4-0KT|b7# z+l+ZDVftE=on?{URH5+jyl%?gFkU@CzG=|`UPi|tfo2Xy5P@zEc?1Y9;_kzu%=R0= z)OvG~w>Jarp`eso`4_Rkd$+jW@ZLXu4wQ{jZ(EWMWyV@>P-Dzf>MU)cKmo3MStG>v5zv{5_GKH@r0Rx48|G znO>$4XdemBTi|>n+h+LLAlZubyqNx$AB&}SM#ezC;`@-m(XTix}-fIvyd{yhW7sX!UW6**EYv* z?>G{Obl9T`Y(WyB_Xz}J!-V!q5Me{(1sHxq^00iBY<+<~FyDOOAr2-Gxd!lm&x@ab zs>l;2Qa&#G=Y+HjQ}p6p<7b|m%0izBXNjztByGj~S7F02g)lA8Fh$jd6tshX9OOz# zJcPrHA!&zjP|Ow7@6{HDbfoLb({p+VLHLGdCUD`6A29itTx*Y78&h$}?G@Ay5|`U9 zhlg%9dqLhTS-swtLTKQ?W!|VGlz~vak&B}Q6c?XAxWyF+Vpal_<5sjQ;#3>!ST9a| z_QMo3EP|DTQ2^`T4UyW}_$hii+Q5BBKXjt>2h6~p(1zw(klv1FWI2w#EC1=S)D!TZ z4kZ_#^WHbDpW{$Vy@HS)`=H-FOt#`6H%1PR<{7#OI`aNJEUS3{CWdhs8`#UF4Bte# zhl{J1=Yu$DI+PzihJWj0FPnsLLOq155b4$qw~=^&)PnT{2;_UffcsX0IOfK!pb%Uw zGu$3toc#U0Icm~E6t@=<`F^&wG17TG!>KQk`@z4uFF^e@LeV42Ia$;Ym_tkm;-Q`A z-?fBE-hZvSr#>zN4sVu(tipt>V3GqGI3Q$JU1CFpw7bT1_NAt|EBXXgUyf_!(ERe> znEZ|)>F=C+0D;|-9ZLS~M^(a&>;h@Y@{g{|TkccQr|0mTKZrg&%V90}QY;L0{WpKN zH2*3uK4S0E+&@3@4VS1VS2yDUH7eJvr`U@Lf9X{^tyoWiU2AJC`W%GxCbvZGL;=^{ zEDb%uYLFDS$m*m6mHcQL!E^akrAa%3C$?f~L+s-&0LKG#IW%`T3_^B*j8Jl*t=YZ^v6tM-7HT{*<=90amszYt`7qconP-r2{V7 zeBvRnDKw)BW3tyB;%xkyy0s}Lje=9sj1duy+rK)d#=px*!R~Odlo2@Sw~hB2;&4V7 zIv{1hAeD2a{Fphq!x^V~LF*k$=|45vHNQDUpGekR-}8g>BeVlH?G;Uft}wfpdOPh;*E=ovc0Fr&aYuj5bGHH(kG@>K zPi9)4k0g{;6U%@8_2=!3tdl3D1?)^^nd=|EJH~K|<~030IU`T2PVp7|M6&phvlxTQ zo4Ye5vt4z=6=3(&v-hkII=68g9Z1`n5L|^Hw&LYkoK<{)PvC->ZMwVX{kxZVVPJI` z!IMVjT~*_*j5XYB;12lWliC80Q%m^MMit`Oe>uk~F_HYh>ZR5=BFolFN?6gF-Zg(u z+_IlzoFR0sG)=sgEcsdO`s&wqRN{F~XTAQq?JMHj8wtTr26dWgZ7Z;!d0%B;cMQ_XP+RP?R#^+3)=)j z#=ytCg=)Lyvo+tH*X>!CN51!q9YMr93*tn^M@7NM@(+h~+iUDN6y^=^^Dcd#OTUJ; z_PLj<{-2xgSMPHM`q`hSuW8dcIr?3n$L(o?{JS}xe7;Zc7br|J&WkUQN>KwTU7w8b z3R6gF+a}QHU|g(e@j1|BV4NKPdzFZZgZ=*oO`P+OJFjsiK0ZhC=s^Do7~nNF_A}&s zs4e+@d?Z>{KCjWR`k?d2;^2}JjVzo}yE2Wu^;IQMitpw(EDNyVOSm_|zl55E6LbKPGRMj3njTNA2wr!glw ztKbY~i5m92!YoD-g$ZjK+{&J!qB;ZtNFs=k!4eq$0um0iP;iX8K*z}cMb%fwcHGT%fSxbhQKlrUI(up70k@3kuX=T7W_(6sHER*Kbbr zyAB~qX`nadvI-S<#8Ql8B2myd9u98hj`|!?0gKQU);k`hN^2g4!yj$W(bgg)5lLCc z2yr7!(E}v;T^hjE5qL*IkQ7p*`+d-Q7Kf@G0b{_TOVV}2?Wp~A@w z$|K4qEvfH;xqzH8rbBOWMnudh&0VC9oLIS!%9B}I#N-%sj9Kq0bY1~K8Inf|OCB9O1|2IYiAD*0Z-$b?V2IX8$=!7F&&tljjt(FyatJJz@+dng$q8?c z08wN~PtiC_cGNWt-ZT_?%QTT^k>u~wYT~%CGOv{m1whdsra51zbufkDDZY!D;2>4Q z0{Nf}aoJYlqHWohz#u}YNDOAE1%mW_R6=xL-q6ylnj$`js^zV+374{HE$`*;V<`GI zsx&?_N%I0;G?^Ld_^Ej4U6acix-fAGA?Yfp4rWm=(aT>2{PY5)r2#w{8TL-I@tRIB zF;J`tT|kLUo;UgiwF7z#+$;nZYVim`9%By06FC{1;|81DNo2uc9}gw1{{#XYHpy`c z9L)_3m53H+fn6Gzc-piYVPCu&Mucb2MoGXL8UNmIVxa*F584>-ehSq<#sWVH`EBWZ zq>LcH{1qdWg#J%&r8oJx-R2@<5D3t?g0gY=S^(8Azr0D9M>F+Bc$8mi=EIc7y@v7L zo1k~_UqJZn1Jb#@`Cv=_+VK-sRg;~W%JOZx?dJzK-ZFZ)vl6`e0pipIa>nVU9Pjtr zljv6%gP3NXN$ST!uTIam%dv3lFjxxHkAMwYuHYx`-y;5DAMq1H>V##qNhUACM2tP% zfDicI`Ge8>UjO=fsTU^KizpTM-fl!kPh&s{^<3H%=|}81Dy=}SE~_sgvIa9Ou1Lgn zchJ76a^wqs=;~GEV%vO3a;7X+EzkTBNY@t;k<|;%m!~osN8AOy-8Xk*%XMcTW=37K z)<^ccF#cgg8%5@QS1x-8#Xc8j`&V!Rv*|SG6xichmrh-{j5>L?PJ(XL zT-2JI;#V;v*VPR#?&=#9Lq!sD+luqc+ojdwQoEh(#jr{hgco;R4~)leRyNXDggE&J zpEUf?LlD!WV)MY`W|x_d-u7AE+4(gK%?}cvJ_s?>ujmBJR8b^HAMN<|*igUI!%?o6@B8D`VzFd+7eRx} z7rvnkpUII>x)1@)-}D6$FS2WZwMohuVZ%tUYmalv-Bvl(wivN5J_B5c*`P#Q@_zRA z`1z~h^O|6%Fqu;p8i)iP`;fP@D-h1w|GQdD_`ZT0LVt6A3VLWUEvpVGI$PQLX;A!`^GPuzmWvXHBmD`cdnv#gw_6`>^8Qg*E5E(4jy^bBi zgXU4^-X}G`SF(8=rca;wF$ky+v5N)ix+Z7d)u>`4 zsIVrO2qFW5Qbd=diqN8moj^*v^@w}z#Ef4_ugo|S`p~0uIH{WLPpeb0hec9kU&+Q- zJC?~GRN`2txddHEg51rAi*qPFTR%jDy2hiL6)WTXwv#t+c7uQ}vDIL8HHmu(LhpFA zm2k(AkdTm|+w%~JG`pF!ZRmA-mqW^Cy&6>exP4`8pMLXcJLcf}!N*UmY&Zkbfm)ec z*Y7xaAtw}AMegbMq_t@(?4MvpLa5T56HhbzR^PMG>UzriRbnFcX#)eL8Ob03f2piY zMB}NfETF9KAsT>)ov{tmrmr^$Q*K2FzJ&QhkdZJXy?DY$8*Xof6FqX?$6q?9euq*U zl;2W1U*d73O`Sj`V3Z_-)%b@YoXQB1_rpwt4tC872?H-k7rHVxt-QcbAwi28CdP_o zv?rc=tliB?#afp}rfA^~_n=M1dsHlB>bP(&RLZ@zk{OUD{N9|m^%n&Lib)&QzRrS( z^0SJB!54>P!#w>)`jFR~)VJ7Qq^o_w+-KPOu{5{=qBy;OA}%E&@HX@X@aW|_i8Z;! zAjL#SjjdcvD%ihIm^UMTnl#a5N1y$>A;CTH8ASVs&SK=6zFN?jq@&=uIu2Xtf%Wef zjS3m(?$2+4RoKJ(n^8Qmf;%l#f;kHKjhwWhGdb$(09)R ze1FN1&^@X`+sL}9sEQSyFT-oXGhpu%E89$Re-l^j5Om2G6kh7|9v_>W&Ff-&R@CCR zFrQSm$V@)EPXGSv}g#4J1JO}hB=78O-zm5X2G+rj@u(};t#8D{w;;e z^3bYG{-2LEMpa(gys7K8!tx=Mr3395zWSKm5k-?I;;plZB-%!0s3YX6BVgQR+a4QM^-V3%ULw(j$^yH+F~Wex&L7YPeGf=e;gOC(6;eqT1CJ z=eeNub6Lc6PHH=Rq9xZOf&4S_CobFJ;hgB=8qaZ(J*lzEzMii1hRfkaqZ~4V@d|&b;tH?QTE+Op_blVC7)M?qB3Og;MWs{62g~QXCm)&% zRzwcf+2}PhXbZ}}LW1XRkFEk$qQ9>Mi0Rct6w_|?(gGI(5|!er_8`MrZy>6fIE7@Z z1`$PhVafaG5e)l2F{ZWk!`-Nis{TsME(UnfQNm?y5c{PKyo-b z$1(ET6~a=d%{xOoFbPICqPYQkwG)`@quYK0%;GdP0NDHSv4yq|o`?S_&XEm~@TB}3 z(F_g+Nvz&Djn=Z7(Pq8s9ft>Bf}G65$o*Z>*W(P_UmR$69lja3l0e9AtHHM?Y5e1PA~aKRJI4@P>@&V5oTul8 z>@_3=9Y$t|)Uomu@>87zIWW^ewE^jRcKiw?qu;ht&&OezwGSj|iQ=K!Tn>KxlC`h9 zP&HxuZG6qBec8GRDzdkKdlfrNnND@6!&Iycv$v9Lxf*UXv3Wq1E>1WgDO6Y}V@)>} z0xrvEzIet!sk$C9x$2s(o0g`33$H<~&mt}k829=JTMd0#fa3vzC5&D+5CCJ5x~&z+ z!1#x$j~))S@f6d=z(wjFX*1eV48OQA76uxb}Jzno!R9TgF(z!QGiF2zk9ddtP z`eVUAm04Q4c2H&}CYOhfCw9upNQBSo={vh;#f>ZUIZhO69R@)+XpX92Bw0Q0d7y$< zSY}xu?F@r|lIE}rI?$n`$sEAlO>={(Z%ppC`>9t;T;aGudEGBrv{pL0th{I1(Bx>s z4{z+kG$(XBG`hCIlI_)MRJ~8UrF!N;w0G;~jJiXcg6L@b(5pRSjqjiCFbNVMfbgl@ z2^ML}j3gF3!Tk3*HS5olbL~f;`tNH~%U5DK@fLM-yfX`ZXVuMrRP+F)-&%X~6j!(E zXdW@lVi}80bXq~XM?`m~nmrsV;?`Ece9}Y@Jq3HwZB|fQ8-h!433R$Lkg(#1f5{`1 z;8X8vp=BD!R6&n2F>#34AzX`~thmw${R#U)lUpj0V@eXUP91UYX)nPYq^$lh9RX5TzaEps8T#~-Pzi8$YCafAL%`E7ayt-) z!;tDC(G*4c9dGQS7u_p_Iy!N)$VwV}O0b_-R8`qRQDOM|JUjH6b?U1pF3Pp)eA?7t-8^srLwZ1fB87$6)u2m=zo zExN*v8|P?JdEsgnjSZex;C+rKK{a$L=GJw%3LWRj`t=ADulj&*S9i(d(^H19j)cKv zR{`ba^DxJb6}ml0wsk4o$SO1MU_Hy<+SR0XjV-C10qWl#Xh(a5Q<2xFNKk)xs2y{C z-?@hH!BAI&(b12bxE3U?OcxqG1hHm|^Lf+$#2UL2w}&@Xf;swbosLucy_VK#FY>FT zr%7F=8Q~M4__sr21fmEO#xRwGhs|qLc~DnSpp)6-e$dU&9dNrl%p)@&1!vOy`m!|9 z78)GH%n8we{(O>hcJT22POg%J+$KRMolU>GsLB1%CHbBBV78Y1NoPz)~Lw3+R;58Swx&JfB@gb?SSldHN2> z4kSGmY1$R<>~B%1=98nGg-dC{RN_meiTAPjk;-SmAJoF`RDu5#tN4D(R`n5Kf0uiZ7 zGPp#hI!=;o0-x>VQ|u>_f9E1P9qzIrKlq)$LciCQqco)qB`xNbBFVhbzsaDkH)$S! zhnjvlo^j}i-0QH`7V)AU%QjKewI{X{fCp9p!&izUoh)gzMZt4n^M9A>cF zWZoZ&K0AJ}8H9OU7|9HGO)uN7mS}<)V=xK0?B6{d?R@dWf3p*^dqIw>{ zD2KQjyFtvggtI2kE|@OV>xYYKb{$7!4=XsoUgy>}Zy4SQnQ$CBC7-&rZM`nI*U*%x zl0z$KMa3ffvApHrHk(!P8Cps25L7wRNwhFvG=ZNI7Ii*xS@Eh-CW%qpYS@x`WD^13 zx9OaD-!V4+B5R$#@!Lt~hZ`fO-N2Kc9)_4O zEf$$1)(f5i;pAi16p_}9*c8a_bkb9J-Zz2^?C)pxosRC#(}~oWlzs@Zbakr{Co4Vl zg78HPo)3}NezMOADMd0Ah1Xlm!W){jXb<0c-wobj?ogMjF?9dg$YBOWsofMQ0NmaEZk+F2y&fXJ&e;C+ zc-J2adb_SCIgIb%arP=kx?lzp&w54C`8!C3VbYr5XE-?C^&K|agYN@YlrE$3kP9vd zZt-=3@B7LB?R6F;Skdepj9xLHM5kVm;&-KNcgF8~*-A_ec)$Byj+Ay*92OHOZ7piN zhn!@MJiVzTd2Q9c|MJy2+4y!gZ!f_g3>woPywa8wKJX;iH(v6Y+DZUA)sSBj@&5lV5j9%l}<{>hZ!|O~(>G``P_PAY2+-$;RsbP+#I!y_6*2oH1+TMD8Wd zGu#;VQ9BsQ%%`sIULC&do;4l25Q;TT{XFap%9h#hZ0TGtWj~D-|NuZr$4}Jd4#+ zUj;FA1|dra!}iFN@nF@u2Jwb)kBu9%s;yIE3O}jX7u|W!rq{_J=r0G4-O~uS)D(ya zFKXSh@Zj46+b&cH?O<=ssB4`9U)ftLTlh8MzvLmFr0YC~nFMeA^5mqUq)}w5^>|?g zu0N|%kGj+wGnK2rc2`Vd%L0|5yv<|jO$kw>DK4FE-{cSOy0sdz=e|2zt8=UQzue)Y zi7dT%7E8ZM8n3OfUBozblYah7F7!n&NuRk02rd%@pILfqO0M4uu?aSUB!}Q}e z`F*`x4u$z?Xc-={>&&~nGDdHaJLO9~ng3CfCd#epmv^24dJWz&*KC1eYYEX;y92(lN#;!$lXkNRe17t%tBN=ZZnRb z`W}gsDD&*B_YJsJs+de{Z$VzB;qzESeRB8qGN|t@{i*cma(GNndVe|QIXjqNh(v1( zgzGPN75G(btD=0FUl@1EVNN8mvpwa`W=mKCs}TW7(hSvOix-Ce7zYb>OZ*F);W^}d zoyF5`HeZ{JjxgKF^p3KK3 zpZ1kFX$84n-XTo~PIgiZ8z4VHbA93YZw!DU1;Z1b9N^*o&-s6nmTVIhJ=)p>{R<4I zMUeGvS;!(!$zppKka|_$7v8fD{G$M{Sg1JDU}mL=?<{_uDf6ZM5bS&Wfu?-fzAY`R zbFFD`VDZSlhd~e{JSh0MPZq0!ezde!F0!%~6^tzFU@`P>8xIbD4ab{JvV76*z87zSkkYg+ZUFWOh{n)xK6EU;u)yXMtC9W`0X6e40qCzKOvukakE?wQ@!_z+87M%Ztc zS4b34vKxSv{4x6^hLp~jq%s-X)GSwXZ2W~Eh4@51`#3^;V{i!G2AW1QP{Qg)sj$Q9 zq%39-g=(Z-0C|mN|P=+c-kw+2in$=7& zg%SBt)mP8<2o>94o1#Dz*bjIbyAZ7hVZlrDsz8MP__EI!)9^C^FO4Qrc8hCFh!UaF zGd=4M!TLYToO?uO8Q}Y#kRfgj8b~Rpr*)UncK1^5QbN(NPy*v{hl@Y53Nn`QE`3;XM3(sk&*M=?2xOj7X-7lGdi@(0R{olQ zTmo@1z66m7#`9K55h}+NISHh;?SamY8`D2HB|4;uXp+E2H4RLo)5)x~%1VZxql|#M zgi@X`y7#>8P7vxtUVQs;$lig$rL%(=lpRis-iy^(-1+t|3ibMr)K8d>R9efpZ zPQ0H5$R018kMzMFLaNWQ@44A8A_-8S&Err`<_{EA=#aOTEZ6qw<7cDzq%C~(cp;EI z|BTtaF~)nAFwwn(ygnpl*LVy6P6?9F0^7VvGh+jDbHdk)kHGR~e%R(Sp1pF~`YP$8 z5?HXaGzDD8dQAJ-U1LYzM;z?cu0%=_Tjv@6j>39r!e*C(PNg%e)_e;;jI$VeJMn#R z>;?bs_yzu%@b7M6cbe_~`@c74pRak(A~Cu0E~Nv;E@#fp%~;jP1`luJT{>k#snwD< z1t7o-Bs@b;GE;i-@;!2CM404h#$4!?Qm1V5By`yl(Jn%8)SUKh{2XW9vGNW1ZLK_i z;n%?v7!~|%{(>^k=y)xBk`1mP{g-0?bYB5l;aR6`zMkcsA!qI~oMQGdh3x*EVc$*X z@!i}v1gIF8N*^n}>pA~KWF%ju@}mFfbpR|K4Hx}#1g(}V@a#?5?F~tq^FO&A9-VAC zXn^U?9DojqWFeAAK3)M4q4bx;{?G@tg zCy(jH*I8lBx96g(Q{x{&$v@HO{RgwEFISfa_0_904_0~ZFJ3N=&ZeSGS%pz%$F}Ur z-<@q^K^ltvc)KiSJ9DNqDQg!dZ2&%A(~LtgVs|J@|2XJbP|uy#9S5{`pgwbgBskwZ zduK}bx3aVg-AAQ46;BgRxSF^V#Oc%ce8c=aOK^X4lx0e@xyO_FE_j)5eegGFBxTUm zf!1En?0Eexxei4SPqWMree_DmgCBTIUTVV!W;7Z6E^wY_n!@$%LB|h00R8YQcuOF% zZDZ*EhRr3zXBXAIYi|)p%k>T6w)1({V^h2B+I2fDs_^X2XA6eq_Zn&SZ^CQQu6~~b z5#KA_o)fDq=vQ;wmZ~Y#c5iEsw9T9J=W*@?f})s~t_$5uP={1U_xwEl5wSUWAe@VU6CQZ$}(~o>ryE13)Z1!#%enmcBMeZa~UW|R!VYL;1W9a<8ICiOV zFVpSLAds-woXP>AM>z=%uKu1vwBy#5d|Tq27m7{QuwEfPfu@&G}Z?lTf(&GwXqop6Z~u^Y9KICu&^!gzad0Xm6DcfNpcn6fq$*BCx)&igX5GnPvK_6j zfeO_Q;tH_aDf^uM^{1^IP5^uh13^`TBF^+itrGUTizh{)?q_`wT1AsK%n(qjulsiU zHbPU9m{MO(Cw`#Bi9BQ6pfVy)=!}nX#bdQP1M?sRjHYGrcfhJ2F`689hZ(&S!)_Sa zyH7~mOrmt+caX9GU&5y_O4YDW%p6n-N?)MJDfia;U|?NfIMgkD3hhQ))E{X+d>}8Q zp9y`+Z%byH;qbT(KktKb&Fccil8;@vOJq+07iI*iinlt`v zU6E2AGN2=IBp?`Vi>o66-!q=(NSyT(%^DU$W}9GO2`Vz2(*TnA?B!%exF$s+9%i;rXo@0dVIe-2_fjqQlD5VB{l~cJnayxe(<>HDXe}3`T zQepN$H)t0oN9tn?E-fx)^PUj2IgPMIes6Kz#1ipQGLM|eT5Zyj{1j-Hq%8EgUTy&b z!Mr{HHUKI1XAau^&Pdi}lYd)CB7sWid_-}4bIhBXkqGRwiF*t`d+verU{IE(#6*yX zbqTt=$mg2n+ZoiE$;2#1b_<$am`TF=2;SNu75JAgMewv_13npB?c9o6dQnv}!hIoV zT|}Khp4wI-Uv*4PI|&F==lS!9er9J1qOK6;W&n_;)~AC6w%Wx9(M`^{vPE`2&V(`! zwxXpt0)i2rCU}PEgnR!Ua@r5dLiZ$Z(}ztOG?Pg9!P0($Ao|#+)62X>L;MZbx3|$E&K>6>Wl?baH&VSg55xM z%D{`cJR;Ns8D+#MNe1OCGV)pJr+kk-gIEZsS`CCGgfQ_J%KYe z-u21e`0FFRGx}qnt~ZRe0dUwH=-weqVD+JtG@3kk^WZh~Fq!hP5m+gv{?+kvV=I5_ zRJMA#zT`a*H~eD!SsVoQ*Bc&v;kn#ZBxq=5qoTVt)a=%>Ygs)#{RUq&E7FEuz=SeM zwuQvF+4ASk$cfwjR>Yj$mHc|UA~5YG|60#_Z&JNv|qGKKf3TGRsbpR)2a z-6%y*a2MJo_%sdMsd@8&#eY3FRSWMRKQ{Ut*`5B_$NR}xy)dVd?9#K@1iYQSfUH4d zm!J&T!CoI9xUv4v&x;VKT`qX{KQe%tsL|$26 z<<~o%q#6q=(=Vq$+Yi3~fQ*TbqSC?bm*EUSumJ-Sjq% znY(|&Kgn3?bX5oLsdg@|^GqMY@7kMYdO}^OXHN&eXsX=Q&%tvJ%hsmC@dX(X!cgNr zvFJAz-Xq0k`?u=EMn27W!q!FjHg^RTrri6ooM^N;U%sMx32s8W1H!@+&@J_uchA3w zE>*ftq((PmH}11`kk8o^zj*^qcKeLIf^~I{-Z3(UtdyJ_3q_#9LU3!N<e` z2U%LrpLmz{zP?WbtFh7P;MzN(-qdygtW#VhToUSu+!!srNQx%DNWRzQ1F%NL?~j>nyv`oc+uv@BN_PsVM$# zX3t`3MM89aVA@KO*8e<|bs4O?a`iPo>8+AaI9)AUxX!Li4g5KawDm)=KHA#-d7)SE z^_G6LSjo^fd&4a?>S5nqp`qO*reW!A_7#wn`Kj=~B?;eulq9_W$9g(RTfT{j7A?aI zrxl9u_3>vvWxG!YH0hM*`)AQ79Q9wR`#kok>15;u$}*Q!o?oxY8~6IL-xocxg$rbb zJoz|NcqLZJaUXjrUP7}c3nkGs4hWf|0=RxJE?i3ETIB15>Ci3A`)UzI?AsHhoovSp z03=VB$@DDJVUEZs-WKQ5bGh2FzYIkiQJ!m}x1CDmf<5QP2e?S*10v5#rqKj{A7`pL za(+@w$~PqRyexz-zCGmSEIOXaR~wDlaA-nt7_nMHG5YmkM@QgT{v~}9<0vu65KF8w zF3wC>x*M_5Upr5~G=suVo@i*efZrEl?+00;$Ww1F4 z$K(#JR0+!c2kQ^zjVWTlCJ1$M06lPci~h3)fuJ2{#&)0*o7fAPzg;vWQ#Era3@yGG z7u{J@E``jjkBot=op?Z%G5$Q?4i?<8i-k+nmdNRkt3YE%T(ks!WvIZ!UiH)ROW>;^ zTnZg(^`BHo-yS^7FPBK92Fn=zws7N6n9g}<9m$$GH9?#DHIfiew0HrMlp!#f3VUWD z#Ze`*Wql>MK~QiQTn%MNy$ih8*Gj`ypO=DgY0z#(^R7w=Hs+r!~-D-#}VZI-x5)2nNi97|Hk4G6F21o5s&^JtmR0Tctg&2bnYuYF<`LdYkN|&Au zDz?OL00E<@{;MkVOdr2FVNW*vp$!>4IKc1kRdneX%#C0Fmy=LDEOlv!j=0=3BfTR9 zqpfAxajhYhsN4RoMh=(K>Uf}#ootI)iivG?C5(DSrIR6km{0R!G4QFX^@O zd4zawLqoLhOd;RK7exW*P}jgDLjEvPrh15$BJB}ZxrE-^`Vn3W&jirfoI-|wn2seU z9FJT6BuEOfNf*y&*e(VZNG-bq=0BfM* zjOhKmKpG2n zdnc1!yzz%pyh&DT^m;Fm)9FjeUSC{I*?l;3Hx+yyMh$7Z4gRe;Yn)2dmky z6m=yIe8syiLFJ!VZ9z5Vl5B5Qg2-Y(2dg|^|LxcVsQDD8z$$NQe=RrRNJ<%7j`{ek zL%c}urK{6)fL|A}Z>%I!+mbKWfxZyzI6h^lF0yZ*eOp3`zMGv@<2`D7rB49ERW;hH zuTWhaZ^O6A8LTl+Bj~PVZQ;jSqPbShw7ccA$~2xyejjy&J6eb)hrU zg@ssPrly2glmtDo~j{un*8J=f{pRhy9YEH=A= z)GfQf?)`WpEvXH=*ynwi@!5NBkkNZ7ScZP9!4;FLRS)ANeOmOlN%GyIbEJ+3zy|0bi#hxcaJ zm8Q7e94QMLX`@54(rDVN&4r%w51RJtZx?&Q3Hv+hDS?vaL_lD`X;oegC_>wDwJnxhiKe^cgS>9dghd9Q) z@C&jod&z?uzSq07Ep=C4b;}5c!}_i^su_tM_*O#es~ws;>S}d+DcPSy(VjR|{=5@v zgLGVQ1swP#g;(*On-)H-F9Kh8K6O%;s=cSol6YA*51l#=PYrqtcL%x(>+mYi9NE@~&-ON1s~KK~emh-BJ7i8FwZAW?u6Dj-UlXENGlXReV;9%Ip3%PM z$CE~qk`~f-^#+43YxS5^))u9Q&a7%W+-;SNr~&nbm$k*A4_=(!Mj6xG-4(^_#W`$A zMFN<07;=ukcMRBH`U;;g@q3+2LFPETpm)iqbe<3I+Z#-3+C(gzeR$-JO5>B3%0SEX(sU|Nw-)n z&{(Bn_f4~%P11Bx+ixd8A!aQfE3)Yz-s0A0`2k$@E;h{$=M9))c^BK7MJw4`7#L3Q zgnH{XPS|uri5C*8HV=EZ9x%%l-*!pjAT?J0tCNN8*CE!Vw&Tjl*xp|uss=A0O)%9p z=3IYia-pk64VfKA!fE5tUtSQUM}?DHxN6#k5p|chw@MTXMY!!_9v+Gl_>FD47^E#EH&`%?qF-UEYZO-B!QC z$8Nb4qPt{r{-|C`aK=NCkvE}j3hl>|Dj2d+p}%Icg)tNi*f_1QQ9zIN1|!6Y`h&hQ z^H{AA?W$yMldxm7DvY7(SXKo>kt7SyZ2?*@W9DDvEn4FhLia^tk86n8)dNkGW#o(G zhg$`9lXA(7Zrm5bnaT|Lr~A~tTyBJi8bS^0hO^`?A?ofZch0Coe1}F7Y^V3;MPUy! zS=-r{%MTn;sl0}%NBBaACi)Ey_K}Mye!G+%9F~4Re)uW;Gg%02u6uP9HD|D8FbQzM znrGI@!>LDBYtsX-X6vG?}QPQwI7Dwc=6|Gk2;K%lM}UCS1yY6E$W z>0XJl8V&tM;C)ilOa(ic)m*R#k`AyCeIOBB6vVy(4XcK8;ZN#>Gxd|>U)h&S84@T& z*QH?%e;MN{Bpfz5tlq+o!rW9_(5GaUXKxYFF;pjl@i0`^ zhRE2)ZJUgS)lvp$HhLurxqSwBw?>w24AQ-b*n9X)hW+5S|3ISL&g5wsccP7X{IF53 z$yQfYwoMTA|G^MsJ{{qsr~=}-Xjr4m$FmAn_3M+X>|tPMHgA(K!;(Ls*Yb&LjJNcV z-huItF^4TS5gabh<)d-1_J1$kEgN-W{il}1Hr<4UOm%ZPfvjVR~ zKNT$CzI%xgyuOSTD*^BGN|5t*7npr8Y^)EG7Z;3g;=Ubg9OPRS?z z7$$H>>iKijQF4>!{RuDvNfg)~+^$fLl)o)p9LfL1_MGevD;9X-+1z|cd(r5|dbqW> zOU!)H?0F?4B_W|QJZ{^3?tFrJ`YNz5H2nUQXON)KM0 z-9uW*$0vebi7z^9JYJdl*@7+*)>N|10A^x|85VOx*T`nH{KW%s`U-_*a>%;#ksU0@$? z;R54*8A*x_}eQfPwvG|zINd-kan8dq}p8! z{E=Z-kZ{q4Yl2Ydd1GP6q5A9Mb?7qFyst)PuJ39(V9azLJ|cLGzSe!obNeC_v+XKE){f@Z0sw^{A%rLlqu`s7CWGtX~o{!((Rz6Cq?R%nzkuN zic>F}p($OVQhHt=x@3A6wGtZ=%3F=Ll{vNg;#x^p`3Wf^bXQy^oeb7Oy499K*&UrQ7)2jahGoa~L zH}4Jgsf(ir&*f@)Yo-KB*EjX4AuB~GFY{(^Y_FUCQSj+k=d4m^XRj~XOx7x*=Vwh1 z;GPc0@JbD!;=t)=@(A2KMbhW=Cw^C+b3hM>yq_Dn7kPc2Rqjx7>Rh1qwD|eF<-WUN zezipCCAcPsK3^?=P%4Ygaf8r0rhB5r*g))gLCtSk=FQ`@iuqpX)N)sFHr@HW<|Cl_ z`4R{^*GXyBJSJIpIT9~T8yt19<`_{ks{VST=g4fldbaRT!^#>h?Z;Ai@Zup{DR=@b z(ewK_X*~rRubkXFRz|EH9{fm$1CNrdYk@;#R9kfzY`_KeWkX$ccF|l5g)QIyRo^1r zF2VACX;Nr?GP@`R-+nXLuigTkGPJQtJ{Xj>i!S!gE}Pwwv|O0c?}9W~y0w_a8%JIy zdeNpMS7;9&BAQ5D-v-WHnc6L%r5gdBYWauCwZ&i<;pUk+3$8PBveV1YbOv-=C(o{V%>PDvT<=0KCX532g3 zLDeX9KR_bBF}qf<8IK+*imjFvON3f{IxEX!=l<)no3Mb->pjlj;~U$TZRqUR$D3v) zr3+yppO@d?vK$vOP)*S|G^JRFrn))a2e~JcL0QkCZr#vl*_*F#W3ix(*UOXY?w6aB zzujH0FZ(xk3Ge^Vr7Qe@AzDQoaLquH!9{m6L4%`1@$xuVG z{f|(Vi;M3+i8AYgt1+j%wiizko(fP@(htaActzsKJP-pU>x8FWpy9MmAvo$qg@g;3 zmJ3GnH0E7A{e4PoQ^uOyX(d$}u2!<=M%+Iu@_Px$&=OIQ?0tH(=uj!f;K-^i#%9i9 zqpehUn#gKs+8@qrXmn4Vp#{!<4d%Pg_7Vxm(SAp|GX?Z)LQ&2K`*u90hO$?7zaVEvVM_>SdjL$7%dCS6Hb~cxIU#$*tC^(cRWnL@; zCU6V$3k|%tqjK?2=coD1It~O;gkoavC$20x&1Tfb4r6wG4 z1a`Ag7O@((*B?`XFQ|S2`y7&t%nbH6C;%5{1Ma~p{Tm;0J|6@LIwW#424q%A=FL8a zl+)wlV-#LN-vdg%#~B8@A1JV5yN5su`g#Y0Kq@elGFL>Oo$Rw<(zp(EOSdwUewNZz~!G>%R~V!wTW4OPc?%{p$`%0TKE|Cx*@d zl3Kr1YqF0N*mvebR)Q&{SMrB69{&O39NIqrF8IU zDiwAmm$@auN+O^lilvkq7#Mpez{>a-#y2cN=+4IK$*?GiPx2RHX7jlX;@L zBGS;gb)}^3%ibZLu|++Lr1CI!o<+8q4rB< zMTd5`xuS*q8Q#d2jBLP(K?j3HVw*|t4Dkbia>JPx_c8_)X)75?>FKZ4fVMv z*^eD397;&%0=bw&zotY@3Y3W4L008@g$+5~MD`njAS?-WpxBSD$8h^&87Qf$9*8EG zJtA0i#h%=Odd#2U(T6VE(>V$9`-Tv9QLVbj&_l$yt^CUckj%V6Gr#Wk5$$cn($RsB z;}9YFyC-=`y@ALDDJ-xrNCz>bNdRSU*(}xwW&;H+(hK&nr<7p}Fbq?p>lS{!J&P57 ze=A;9dRTppah2fPs&u-n<#|Nk+%Bjmy_CJYLej;0>1OR-_7r>pO%{XSJ9IC^T8EYy zy^RFj-rvqZ25aw6_oUq~S1ESy_rOE<>;B8?+4b{O_sbLMJKtOX!^P&?<<-gAR5$BP z6#wf(v+#@OGw9{tX!Cp9>*j?#C(LFS@ZOFFOH8t*Ez+fNdD&gwpN=$}>bE-GI=?A& z>>>xD!HD>M%HW%^7BZp>wVQ5NyI1hocibh|!D~!Ib}R+|-oyvP+2+w}Mj)4zxcz3( zH^@9#LsLhuJPcbU-oP0vD!dP&%bHY5`p~G=f~0>?vhi~LBFsu~@OfRkk5=XprQ|1Z zd<(x^yrN#KZp^dFY8e$WV%&9>`EFg)lm*4}MnDQ8!E08Nyj=k7#+fPHfvZ|UL1!-hC1-}2< zz^{k*+0Wfhbb{J9N*Z#SF)T0$w0o*9A8%tQZrx#0U68Gbrt{jQ@@n*M)9EalZx_%T z;8!6p=d=*}R}!}jPj203N3i_@SrYDtMW=AfBReCo%I2|BJGB0Iuw5-$f^x*tTukHYT=h8!MXFoM2+xwrx(F z2`9EQC%^AI_?LrgI}VR?got%Fg*fadV$oN%#&8*aLo?v+;Z z(Ep%AucXW+UPal1XOJ&#VI%vEFihisY2j`8g-LzP! zAJd&HhjRt<`FGFaX<|iLNMV4S3L2f`yW_(*QH?-`9M)?iSnY}D;XvAJNYv|L*<);I zevS%9d%ADnS*_wmI#8-gYjc~xrM#Hj9^~nipGlSEsM^aT z3WiJmh_ee!%VQH>RQ}8vX(rE7Z;(Z$A)~`1FaL4UbsiFN?!QgmJKbg{7a}c^$K*u3B}}0{NzQn)9-n;!h4q1qvn`_ zXtguSYsh^Bl(r(zR0Vx>V&%l2e-uKE1dI^_xu=AF7HhaDB!Q3XE0VoK%xb)D3IE0F zt{W;vH0~5YV5z8^Kz7=SK0I_{Ps@DHQyBzVd=MCK#F20vh^Pi2#g5X|v+W+ViCNM1J)iIS($;n{+#Pd9Hu-@qM|-;dxoYA|27kjX*69h~a4 z$ZPcwkr=bZ=(SVzYGgs{hc3u!O}U~I|2+^@*4`)|X31gH>@w~*kywr1ViHIW z^pC=_abmAJ51Xim7-|lF6t$6UxM&^WtYi6)#Bjdubg%)EWVa}Q7;=kb0*z##*O=j7 zjx@hU7!>%)R-(Y_UXFofH2*2vnaU}%I@?g}kntpIB#i7ct){_BoG9jCA7y;Nad#9KOk;K|Lfis9XSV4Ju+3?9xMg?fHxr0AHbos*$ zj2#&U4*+2B($TLJmdVqv*M&)-%dS6p%5E<%8FfKrJn9+>IM)*KQpB;u;EBfvDNdeWuCrGd~Vm& zE^f0kQYk}%?2{;Qrh7m*aZ9m@FwF3-jimeHrJP)+%F#y{3PGCRvo86g?+((m3rG zAviYGiGCsqfn_za(+FB69>|h`LmgcdEAda?he%5Xq|Q7-9?bL{A$)QO-biG-VGoWfbh2A|f7AuK@BJ z=Y=N75h@<5N*g5`RoIs(*6{ARGg%eHtp-r66Atn*VAwg4!|a2=^`-raG97h&P&4r; zNaMF$?f0mL@(3^>o2C6pJ5J^OMmXeGUG&5a(rKx0n-_c}HVFQtP(~cMCH^E5b3uoc zV&0z;ZtVuaB{NKSQM3ou`mcTB8(&^V5Tgv zNcHJL#ajEtDeeocn_j!u8B?d$LM-6o_aq5O=>rNRFt8Z)KZ#(VAHu$zFOoIOR2k`y zc%0sao`Dwgs!Og_!0!?fPXcF-?x;{<;7rZKUZ>3q7vQ*LIlocHPVQ)pGg1bph^Vk@ zCqd)RD3PKw-3Tv8DaPz+BK?{l?bQF8ImIOkPtdiFIl$WITYAQNURkrfV$8I*iF4pr z`qx5mr-O5Qq3vIBYktfVmC({p(v6NO$Nz38Dv9vC@V&*=9IVH8O#)u?rahLt(q*yW zwQGSH=6Xelr3=IR)>H;+CRek*Mqf1Hj9;+=>s00_Nr^}^a8CSzt>m@=a4=5H|+OuLeyVk4?*}UqW-ow@}(1bJ)PM|2=M4nR1*K23H*W!~4>V#>S~;^=Ak(`}W;^)q=vU6!I~Wo?y@$P5 z&=)72OoLOD3)B0Ui!nEyp2Vi?yi3IA71C(SUaefyMKHh!g}TxkcCj7{c76$4{#QdSn1XHe1e~#N1UI*40tg=VG{1I>!MWH` z*ehF=D}X$d(RX{@@Rz>eB!}8hKzaKeUW;v91r3DSqY`3l zVhaZH!7Bnw1tb7PTzgm{Ui%H`AOSansS#)!2Xx8uVLiG98@+am;{^zvb1)|9!~J>$_;k*2od$K5#Gb_Nt=YVOP7A zqY%(m7~a zw=Ra7pJ{CgM_q^>WEYq_8*34|gGh=@=3f_>5slw%mAZC^ z!r*_(SWMt`x}lDyV|rk8LZ*`u58yT5qmF7SJ92?+*f+Gk>v7piBC?vZc0j^0emg@p zn_dS(p~duC(Dx(~=d(4XK9zh2`_Dh|_Qm7*jVH$tUo`~m*t?P-`17|_Kv^0iE1%6& zI?d64%O$qMj)d{c0O4wPKM$Gz9u}snUsUGnZVo;^`_*Pk@>LvlJX90j6i+~?667p!=^C*;9-{6D2yU*{rJ=E zR&M3^p+_dL*v7ulX5$=@SLXvs@As0O+ZB3p@J|PEMTsH48VbK017oVGg7}fS75WQb z!O4lytFAC|gV#|9g*bXn; zLpuEPaeZcia_{qe;lD-Gi5~g?$Ql5TTlO6*3*(xFSLMDy`qKb`BCyUFIX#rE>5)WU zMO$*KJOAVM&L~my@Of(5rjXcv(U12=LL{5pjF2*+ggTg2>s6f$QAC|h@0WA5q8rmj zydw(AB=IX-M94bKpXDiRR^#;M@^F%0E7hbTzpQ>YKYp~Dw^5D=5`Bw@8q5MZW|F{e z$c(vf(?-#^*BIZD7>ZQz137n+!1x*}gylgA^))*$SBg)gsFs_88>bdw_b`oHPH@-l zAwQOB=7{QYiI1g2bY_|IY-mR|OiH?&3i7;kO&w0YvtwQu_|b<-;f)#A9Xb$q(qh%g zurR6cd1|kQ_DLD{gD|uo+nTQ6msMP5&MA=C7}O|emPCC- zOy@RNxSqxv!rDo~KN0{L>CIuEYGB5CSM#4eeAuRs>z8E!X{GK(=FCiG zMoF(fD3LM8**q$q(W!%;cm|U~xMbnT*dtnhQZXbS4rw&&T{;1xlPMNV9;xE{DYok= zEpAc`Ux>RZ!Z&U>yf<@I8u{~2WczESK`Zbg?y5#pV8VbbE2SdpoLS(q?}NMANNqE`VMWIBh>At_E#SJbu}ZOt`A&& z(ih7-yJ&Y$!v{fg@0te#5a)AQJ3Uh%6UUSoGqQ|+lb&i0xf`ReQ_FuJ;DeAi$dEdY ze9)Zfj*mluzT6TM^gLL6sUK(EW}|)Zs@1bHFixUao?!$`StCl$Y_;e!TfuPJYiiGqCVo6yerAob|>G!*tC@Po(!P({1G;A0i)BJsj6lz*vY# zPn|HA*41}A5_|1uv9<5)?&S2E@l!vvmT4Gj)tvzJhJi_uJ-!Ci8V`GY+GvBzjgXmd zyY2CE<6g7%XC`kln8f%SO*g->STd1P?l^Y3C(CM3@>NDh@YQ)QbyC4XH6Fy5If%*~ zd!Z15?%IzI4m_-U#`J9YaZkLqe>yO>PW02hbEr-d(8xdVi_!^vUzJ#YSnh^cGy{nS zjfMv(NkM$Q9P*%AlfEFrUEN8DOZ+a-)z9wo2?j5=)3f zZr?SLc;sEGqJb!)>`eN^;`~1M2*iMJlaUTSeOu#M2L!epSpYH2vCRMrgak;hY!iNqSiyV@iq;np^U1 z5@HuvkobOD93$D_o^)_Fpm9R9mBGtGAHU~ z6DJeQKVJU7ztt=WqH6-^^Cr@9;P2&}hWzp5tM?cety(cR!6FHE@7f9=+ z3u{w4rHO+NYsHUfl;@QSV?@@BOH=>EkVHWMl9%{Nnpa%*%%|7_C)b*1GBG6(>-MG9 zmK$j5kqFBC29m;OzW16{O}r;US>n9MMCl9p1)4u&d8pjm_0z1|Lt2vQxz|o}kNxUx z%fxOaO(&-JvKtWSh+f7_DbSYpU#!&@mC8zN`h)c}=To%?P_qb-Sqknl=%h(2@+Opk z7Jzg?vKoDIZdSzls1QWmYIr8r4&iUkE%g!9&dMN40d=$=?p5`;(Ufby~;Xt z*50kh&m1(`8w#YzY#u!2V^ZqZg+l-;+ueTW-giyOHvOa+BxQ&EXvZ@fE1bmA>tRxS zGm~WeC}RZj4gsa_n7HQbyk7X&6C%wz7#73i19W2uf7snA@u>?DXusjpIFCju3|HsY zEhyC`s$HObmk|)vU}OW+#uQUFvEw9Biq9>fjjd^6D=h43XqZR}O&(L2>|+9!RP*!8 zELfss=mFMgUU)v0MkRX7Dv_H);r()S^>_1tSZ8o$-cIs`Mp4N&ZBq;9^6oNe{ngO5 zP$eb010EKdhP)E(<~4+3?Ute3dX&Jm9oZ=f=5n4YVUCwDnPAgTE`%yfa9rzBt``uy*RgHRgtmi98^7bjcxOermg6rW&<`(bg}oh zsfDcN9c*Rh7gG&!arxiIhv@I0{tue41ODolKUNVkV!aAXs(Wb1&AFEnz%|P3GqV0% zQp{8yMv+I$iw_lMi{BOrR^;IQlqOyq{Si-pYr996+Fo9;2hXpOUhM(QG!0HF+;^#G z>N8H4#*c-XJ}zqh3AZc6jA%ibP*;ew@L#s_ltzGtdthBM z70x4=p8w}(ep$>|twIvu{jIV(AFH5YDvBAWcu79`Fce+1arR`!owPwG?4iTDP@aNg zoTJ`^BIc!Gi+`;WgC25Bx=SKBnM#%O-14VKgLN*#Qir9IOmTnR2cFzkgA)B3-Rl72 zrT^Q>Iw1Id^>+7G30g$05uv2C61Q-j^|4^!cv&g%po zd57L+JU*kgf3JA_eOXU45LgEk5x4zcUJeNVYQf$SZuJ0 zi@_`Ha?i)_lbLPpi9DbS_?y`$fo?#r_5PX81=(a(uZOgI#@BO@`KeD;zsip!XLv2~#ssD<2y+KspYA989nULIJ&i{lYy>H>)Nl|-j1)Tx{(4;Ja+ z?LlWefG>I`pXSz?Zz-4d@;3dk3+?&xqN{;pT(t%Cn5+`D#69FuX5&^Z;(II>s=cVfY!$-UE zAuCWQPm|*WWou$Dvlp7bU9y@N?!~lagA5bkhWvF7ZJ<1%pwmvRBr)-MNeS?QjFgpCq)?9IUvm|aut^C0Be&*9R0nAn z0n8VA1Mj*AKEo-rzmE~1<1+d?VCn@;54|*Iygy28=*vgi1^D%NdJW3fO*}^Cv^Gw> z9E50X&YPX6U;+C1&s-eNQc17gs|Q1+<@VRh@g#zA_SO z2MEyghBZ?*G)=|D{5k7sQt-8bU8<`3*0P*qSJkwwt=Q9~Z*Bv>z0A{9b&sTzY1G1j zYd6(ZMeb??x1|klPhX>R>i`Q+&W2`BHT69P7l!i_Y>@3O~jG0rYig2fIU@P-hOBzuFQXc?Pen zzJl@u;{(;FG_oMJl-eN<3M5XNn1-V1(ko1VJE)1>}N)Vdrj?;BY~b6G?#x!$KJgeft`O z_YFkL(YWDYPz8gR5OBbJA)l6F*Iyq0bj#!b2_aX}$esp3ezin_h&)BQ!62MP2H%SSS!ko5x9r{84C4@mM>V@L!mey$ z4~t-VAaDDiDA}>X_tn)HcC^4iXqe3lsT+j-hyk1VIeqLK|0`;@MH+fxJeH+hn*zxQ zo8)Pz-&&SL4D#I^ik0v%1z+;3DX7vi@r{n}v5xL;Cq5M4d89Fb1GgiMrMXP}L@$ub zh=}Lzo_~aJ-1gP`VwPtsL6hatISW>s(}zsGtycZTpI8+Y_9_6}^9v%VCDL9Qv(x4e zE}SHU8Q8e^dW5m4pS^A{?Io*RF}w02$giE-8l+SSQF$sI`(M&))Is&EUjD$qcwFx^ z8~$#LQZR~M4&jIZQi~(D_W6NjSo(jQwoWs?)CMz+UYbqG-PWQ!U z!$)*$RpA#bxLFV6cBRU8Sj?8AA=EP z1AAlG*&qpR*_JQkdEKI%BEsc!IL;zQ8`;>3UL%*ZYuE5#oij2Bs}tIo4G+-QZ29pp>wXNz77kO_>=KkL z$oKtabG)B37AmByHKNrr&Y8kUg0}jsubUGelWl^o7m7dU&{#S0v2o|3)gyE`IVHpo z2l1DX5UUK38H7U$i|)^ ziTc}e??hXvSn-D<(ZnZdcgq6srze?zYPXSn(q8j8Vw+vz>PqVkdtm6uZI%s!<|hQr zEX)3THnkk+!K;l06^OwW2})bfYWyoMd|S_Wyq@nmfx;h}q!$V2Zay)-MSCtA4Kg|L zAc+Jh(T>CuU60~RjGsab7x1PYa^lA|ALsJnhNQArmO8UL@Wt}46LJMWcy14$C$2)* zK_de8_CCF8>I^0iiAqGS63Nr&9(f;IU{DuJ6+S4YTi!zKctDYFfs*gc!dx14;NHed zuxjvyMc&k5`3`TV7M)QZbvC`b2Ml4%d;fUpHai9^Haon0#G zEZ<>wI;mNI<%ti{S{$f4 z1&Zo8kC=ZHq9&Kr+WO$}baQ=vW|)g-BhpVo){S0 zva^I35y<&?CnzmFU%X3siT|bPNR!uxf=}{&!AUD0gG2#rf|=0#9yRuzOwf|Bn!b}f z&BgXN$FBA3SLyTSNkly4{q^^*IbE&~80Y3bIwWiRbxpB$TyF8uVReJ%t*+kAG|O(0 z^p&@_Zay`>vh>DZ%LcGdS07%J(` zj>g{o5Kd{p`^3AHv)y*p*^1d5fNSd5(p?qRWP|j?YpbH}Rec#HcyNl8^R{0{UCi|v zt|IDn4w^rZ2hqzsFl6xqvl$CRu08O^3IuO&%}m?pNq*KamuUJ8XFdJy6(EJIo$I08 zCYZfVPB!itPDnmGVIpQMY#LHXq^ztLmpo6(LXrq1vk31)$q!4@ zVo!cT)!7_T&yHhZBw>`SNkeL*m=~QNQBnF38vb3xBdHn|4e))P?P{G(|>UE=*>+<1~VZ+UUeuYn4}dw z*|iV_EscAxUd%Tl#t+ZIFJk2rygXE}7KOo6z3shCjkJpEEo;k9zSjlsGu5e|4EJ+Q zs)Ke2mo)x{tWLONJE2_7DLjRs3Mq_NS!i6kRX+>wTOV@V{l;JK z-X_kP<hLi>|NxPngWGBy&DmiDeYhE{|W%Lugz|sdgyNbnCI1ihN zJDM}|pWb1Qqcjx$tvBW3W=Wg70Hpv}|EsoCFJaqyfCz2)(l63wjalZy7M4DwS4v%~ z#oWY-u=iN{&{8$J?Rb60@^}b=>Miz&S5mN`zS^3aPRu}}4uk$q#5p)A177sl5h;<3 z+Oh9U#@~W;iHt^3mD5!$y!`jcd4ZR0vKoDgikI)-rF93qLt21+ed0OZw6_j1@>ZU- zkak7QCzCF==?s0J8zekSPHuU_@OE4+3{m!C!I4b_p|&l#YNoMaSp!c=J6u}n$z8gY zLF-O*B{{8C*lVygb&_9bN@cm@&7v0EdP-) zLQi?Z{_{+KZb^aSauUrj6g3g45HR#I#+1Uat?;fwsXoon&mGBblh|BmT8V8wJi*|v zUJ1JdHwke5q;fKJD=6&i=EV-QjSG|T>P@#DWFq#CY@W}~=~8`ZvQBs&I=a=kb~Q+> z5?ff@^cNfO184uSp;^C^|D_<)P;Zwai)PQx@?u zMMnIBr_Iy&gP}-gr`cYrOiYu%wQ$EE!cm0;@-c<)FD_5BMb@cX<(_G@9SeNUFsFOF zlIOdiYl$T0Ibn%cRhp9>IO2oYcbJoX|9hy5sHAImx~u4if&Ta9xpNcXd)u=2St%L&ZNRP9WBs=kFes5|avnT< zTqmL-bx`jB*3FV{hw*)ybR}el7V0ioUNYN#tY3pSW^8J@(YM=@+SfHYYU?`?2GX*I zVrU}9Sqf!$t50;=;M_>N-6}QYS-zo< z2GqmV!Ks4HqaQ=p;f2tJ-UVrbXp=&Ws|>P1!GxLu!Vry6$*dCmu=xa5-+wX^l`{&d zLZVCO+Jfh&5fXV5_sIsXE9eA)M(F?et}j(;2*L=Sg^ki_TACP|X2p!uiG|X+e;hom z^b8gvpqVJ4u%U>Hbdjsn2lod@fZnA)O2PrYQxm1r@`>%rSXwne@hf=D7LMvz;3)@?%xuDUzRK-}U%Fj65|nbTSmR#) zJe1p_f_DSHG;bduc4DuB|3k!Z{v%?@(qa&ykkg_TA@S09}feLfpW$E%FWD?_Dvs(rzO=7su1O$nY-UW$kUACp}0U6OL#T=O2^Ixtqu7j+klxcuX?onev3MihKtZ+ zKR^~=S8CH-5X*;H0h`e*bMgA}wz1g9gP-?zG``dWnGIXj#qw>VHY<)n@TqQE*Qtn@ z5>Nj8^PjeYNC@3~<^njq+yK}UYOuD% zjz7}X$<@n|5Eno4+4f_#Ld7|qq5V{XNM^|_R6AXqtMXHepi{npyAZ2#{nmEHAEJ8^ zrj+@V5Mt!b#j{GGC~ZRCv9&O%O4lrgA>sY3DYm7T;h6l>`2QKr(|5=N%Rr&U<{cIGAp zr12(bc|AvIYwB@RF;Dac2_+iK>#5w3h#NZjB3RKs_`{_w9MqEPh>G*W5! z>X@-U^vTjicS`%w);tt%Gy5A+OmPnDq9}N3Fr%h6JXFHAJSnEMq0Cm^1g?6F6>`LI z7*OThWwFveOk=ai#r>~E3F7|HdNQrwSYIsC>tII7uC2baOAAF5FOr9TpchlvKVTpR zV77(x0<1&J@RkqV?$Ht85n>G_Spg1UyWAW;u)UcX!89Pl^MtPBMGiMXvP>k>Q*yWzar6UbZ_hG7VN?V zsi4++dOOv%btlG?49>x_dJwu3Sf3FIjg09Ve)|6HoWEl&#U(tdE;Xw*R%(~mG-M<$CG%O!WOEcD$c;f3Us07ir!%t50EL_I z4uypnMb~YN_A-IlTCXryA>m9qV%Lv##HY6CzosmeI%Ehk%UB|gvoBt0Qu^fX>k8nN z(J@knAj77b6C#;-`a-B2lu z-N2TtMX6)JPCjG$9hzzt{f>MdN?Y{A7A7H0*+Djx)vi`kF@XJ$(SVc zU8%p)@>8WJD$VBVt=EFPER8kZGy|ypS$YeF4e9-{3}3{bdu`TcNzCt9c7?Y%F6HiiD@X;Ewa z#*6$H;5tH}heJ*xWJSS;2h7r^D-gxR+SA}=lDUw%iW{zy!(awC$s|!L-c-oY+Gv~panEu-$061SS+!d9{LQ;J`BCMG&3Z(I|WtzhF7xt?cd9=MVF%UV$I>)cuYov zrBo1ELUo({uK^zFjKFo)?|R9;P`rja~uVkP=>E0cg~W}q?eEGUaX@-wKsyklzopVh~4(@YrZt z{I6@o7F0_oRhI=b^2MEB_$yUs=jbBHZ+G%9zx&!J=u5x~rU7 z*2<}BKuJ%DsHFXJ3ezhiw~QX(25xvj{n=;-t*!o|tC}saXFBDg1$>3DL9&3~s}#;+ z4{v~QS|*yt8Pp2q(nu-k%VPi00O7K1INi=~xJgiJkEq!KS$X|~ouFaZWZ82PCr;}( zGdKKbX}nseT98`4TB2ILTBO<^sL9cUOx`M_KGEDEpD*&9a9QpSmbsy8V&liC`>X zuUjp()fUP#)NQrvtcHrwGrMdb>enXB88b~e#xS@?Ng%cMiK6gK6N2ds%JDsRRH zan(&xoml(cf7V6Bv0qv6Y_=0dpTe-UXi@3P$t z9NPbI&5yXkT;6wAIye93(|S91c6k8~O#PmB;uij9`3byVoy1+_AR_V2#%u@@3Y?YP z*t$5m`gZv{-eII92<)S}}FveZ9W)lE%1l zWP#b6$=1#1-y_h|?^o0F8BEHfxkXCBfvZOxBqWv%VHsKE9|Fzq$py4kcb+nxx*AGE=-kxhOB3T6x#3q3Et; z|G+SPmDK*&PWor(FWGZEftJg!t(!k?P=2b{3*8l)ImK7V5}~zZX6}1>@ak^<9jwSF zo)7VdVrH;^N2wc(SiUi?PA4xX(n?t2x#19+-b#Jg6_x--G1r)@;`vel@^4!wi12u6 z%wg!p=y;g9R7gE=P%=+d>WMO*q2OwMJ5d>XhIp-=(OE?(snW$PCUA88vPxVOZ77C< zC!+%O;b45uwj*u_Se1B(qqDqYeU7U%m(QSw+~F1AU$fQ+6uod6C8d-P)W^Lf1L>bu zrYS}jM@8YeC8$eul5|Ia$jnH*A2oK?z4Z)*TSse3yxq}1;I@<1)55COB5GQ5AOmCt zki*Y;gBDx3e_H3PKTS=7iXmr>Eb8tDdxmQWNH%t;gCdC%=+{ zSQz6brqgkZjbKSD6fDrZw3><#<`Az}8SlPR+b&?)42ld<5hMBm$Wdvf9yhSFv>*<` z@d#@mt-TH@K?5PY$@;QHc}=1as4{XMG8JgQ>mjI_lLTs5Zc!>uVQ!m4;F6`s6@aJA zSNA|+qU5~ysi%&qjwb?_ocgT25{}0kDzz(})=I8#yg@W!X}>y6E=;=*zL!mQ8A=@L z#>$Nc;-@=!=`ctFg=FqET+3#!twP=1fqge2l#)Hh(-RQkRKnoX5oWNF^WBq<=bm+M z$}sR;&hz6#fSSo#A3+5%NkrR%j5TS% zIv+|-r$v0#Udx9uZJaSF#ji_|v~ygsf#TQG^*CEDJl?v00&gve&;(H#m&}p<#i_7ivvfT zEg~$<2Q$33W)=K|mP<+A)3HZmjrEXQZs+TvOvcNab>;UxsgG1x|Le0S>&@zqo0}8C zSpT;RdD*LNJOkbDk~17fCFjcp_e*03YZm({?`aeOeHY+#cX+yV|FRGjg_zmQ`Q+*D z=J$Nxx3DnvdOtA4m{xK+(GV4fsGmh*Akgvgf&}CH;oJQ|cG4i4?R2MrRqwe1Ko+oU z+xz=E-TisG?YCc-&2%WQ_w;rn$=^>u70Eb=lk7Vh!nM4AM99=OCC>r0bNt@Y9=u<2 z;x2({g_^(QlXmmj(lqZ{?5$1bH z6#b&kx z8TxGYFDI}&eqT;HKDo2n&7!%nXu`0JJrLo#-gnRAdNMJ7ydpZGh`p4*;DVFLop%5q z3mt#IiVZ_}6Gz|Z z8M;moxj33y)Z2fFFbB0#j4SBre%U=Zz0`N8<^(;w{QGj-Be-4r@K-`E3L@;s+3%;0 zkA*4GCPbxRIxk3^vy5ROQorUOyY+;C=dafx$#c8Jv<48>O@8B<7=ZJeO9d%B#kuUf zo|J_k&AD|MrN3xnwECRNn$AG{4|D0h{OI z1j`>Nn^5B9mtiES-^d8%A)i-QiE(>;6wq`O*wEuBHamj9aY0F-T?UkoAs_ZRSduaB zIX-^7yN#RCe}8!OU^M9ZrE5FtH$deYJ|N&tC@r&DW1(seo~Qf=fpN=cNcNDwRVoKx zo9*e|GGf)E8BCia=H?K7=vOv=y~4}^+NK!NaR(7b3AGt-~+`PI0Zly z3#eiL(H5fVGIJ9#5jhxJ!|?Gjs(Lw^F={HCnKMd@>F}9xv9hvqavPg-bFgxAadMiP za&mK;v#_$VF|n|lGjRy~UuUGn6hIMyu%uNNKv4k9?EgVV!M@?4s_N%Ia{Vm-^~|`2 zC^AwL8LbW$M!nWZQdp^QwIiSuDu~McOs{ek-A8hUVvRD>!ehZ*Wjft*wXO@8w3i&(ZWH#@mS_7as5wyfD{TWI}51$djS#>YB?i2;jHEMnw;yHu1AL1f;==oHon2>G6KT6%MMe4wf)D~IRi%a+Ab=IjQX{(p z0#c%&NQ)2&%@L5EqOc+wih^R0zAQbI2qdyJfk@~eK}x6*L+G6BcfPZy{5=2WnqPCh z*ZbaWX6`4U6(Votc^Kb@fP!dK&fr8Q>aeP}xLq4O6MGIS^M2~rtb_p^GstzcB!_b2 ze)BtTP*0l+RCaF4&4v~ZRX8h~f)uv!$}#gBrdNhyCPaU4zwuz}DqjzA*1IQeKdiOM8|Nnet<)?`p+5%fVda z(Hql;ia*9-ju)|Y>+t6Zb;C4+20UVG{)`N<2m;H~!i z7`glGV-szz7}?b+_u|$_jDo_{<)|kFwt#uNuQQ>SeYB~~X%jR#EkCQ zhf4O_Zg30su_BvCo3}Yzv`Q}iu>~vP#*5(fg|zC(;r5v zi*>dUX~OzG-N4A(Qyr&~4^NILr`=A1?AVRGHG*RyRtlq6lmdz&a|aWu(eP<(-E-gc zvuR#bSjQi5i?kE|?T3nWW-rT*;tGhKT}I92a3Bpq-Q`FUg@MyD0bLe3RUH@7DyUJp zx6>~wGqGEHHHI=ax)kW;N67Ru%5XY_I$YW_d$~gmK?C`={X(QYvp4LCvGUi&-cCWO z>Q{9Hr`@Bz)NfT~D-Ym8EUk#x({O{HqqwqPPQ&$jinR@8;JUXD?I;m090Zx;oZgCifFRjx8vMe@6 zl(Us-P+-4Hb^Y3d!a3$)x1`iyh!&*BV`kLp&KmF`in+_c5H(cJ>GVuiRd?v7RZ+j; z%i*dW5iAWiyteHi zlreU(QHmkMDCbr;#gRWUBa{L^cGpUBnnr_7S9D4XvzI{+|40yLUDEjI z4KQDw3Vbo#t{YicH4``%_m?$FAw$N=M}24H!L1_lVXmyxBPR3)Jj{Y~s93i&08$1Fd@v3~4X85U zJ&ufN5#~10X0#E`jYUPj@J@GCb}9^#Wt1^ScSW}hnA?*Ul^yPBvUD^?VO1vVTAust zq0TY=m1^7~aP7fpZR-dB?@2RS9AuRD*q+qrievpgno1p>k?DwL%A1a>asXulHuAf6 z!1t^f0gh1Ay|EBkt68Ve#X=9JY*gy%n%Sck!lr-)lJC*QgD>#|&1kA?_bm?NSoZv- z8dOl!-3IxIy*kt>?aJgAZ3hDCkG#@Pr#Vrhf5;M#q?6x?LRLa#{U@I6W}_JU*|x9J zqFx6kbmMluS_}sY)r-(ID}d*y=2yNAB@2%rD+#Oq;(xg~yV8%1dYk$Ojah6DY89F~ zzDFHsw5!U&cSlzugCxcyBd|LjdH($`l|R)2vVrMZ%4g{AINI*u?D!|5w0)&NF;wkd zAWSYVK-@BKS&$|#?FIYFSk^UjQT@ICl%;pjQd~4da7V_zd4Hp-40oN#}g^+sNq~j;%7QE5c=c(`;I|KR2 z=1~|9M#b#sSK9idwSmgi`&BEiO=FFIe6aON7dDzmq9PxNCT|S6WhE~Bn-Q#oA^&EC zJLEXu(J+^u25jD~nBiJ+Coj?2X}>NS3}E6cZZjNPBB%~!l&V@$2J_fh5)o^3FE)DF z=T^~bpip3YKrLSl(@x{#B@L>(vp2a=bJ--U(k^-@GFUrf+FYac!5Bf(Ihh}8WHw$} zl2Wzs$v7#od<3JnGJHq05{oA(VNMccg6x{yXQ7=o@62P=DvtF|pM&9i*A#Pr)^*IG zvS}4E)(IQth>tG2Pi6?S7M)X#)>J1xj$-&%z2zoacQ#uvLfXRy7Pq_a(Fto6>|8RLthCz`47J;OqQKUBbTQj;*Y`5R=U`ap zQ>$5av*G-eQ}umFa#jA4?k!;Ajy(G31Wz49iqFtVBGTI5i;NzAXjbCftH^Tj#|4yY zR<~|Ycm591VL9X z51plGU;jqs%qJ2kaaE+C9rYYk@;`AmGeHj})x(>BaB2Wy)fwgXSO_t>?@bST6=RKv zG?%C{%3un1SqAK!@1lIkObyQ@9Hs7b>NiXdmQVgU^AGvg%G6BV7)uyM@vpS~4S!=m zyh^Pscj}f#d$e=Hw^{}Da&a+FN%^+R&bUPO|3WrU@01HHagKfXR+}|Orfljrass15 zDrm}<9ACp0ooF{9Cvw?`%-gIsrE{koqkPEC#&?@35lt7PoBt2z^F3;_-;|ME6WX@A z287-8e1e^n!FT`xpOdvh^Z6U4pHQS@ZOhLYw$2V6cJ)^G$GsW)7a|bk%9S2|>=`=R z;BB;o_mak&=^T#q*2cC?4Ds)HpWJA@yF}m%J}vr@0zHBZK1=lmi?(9GfwA>Bh8jPd zD0^&j$ZGm57>5i7ll3Au5|&*=Liw;oz}?0g#>FAFkx8) zq2M!GAKPn>=mnqCYPIS5_^tMEB}%3ABiIdBmzlUl+N(asm^N`E$ObF@%`r!7UcH`w zw&A))xOWB+hq7V;$<3@Y7Jp8Df5?jAJ(R=btSAcuPTn4Tc%9HHP^^~0GtgY70!qt{y zO>%fcXlV$j6i40M&P;%}TCAGzSQ8Q7yy}~@et7Yj;rPg4g{^ZeLD*w{w$AtfeY

z$riW>^rhD!(No<&4iwWnZJeexBxg{X^L{06&v_l>hf_O60_MIdc3r^nohl5`5#!w4 zE7ksbhkU6inNyZ;Zu{u@&BeL|BZuabDqQwCbG2r>yjQAn$uo8*hSCli^+ zzZ2=mV3=wib;gz60exu@^mg#mL!yZS2hR$87s0X~ld<2e=!EbxW9%8EgYP>U9mEw!DRwS$NvM1LQhAnS z@p^lwhn0@VF+svDOw3g6~UD+sth(`W;lEk<) z)?>k>FFx?cXB-8JRpVY)o4V_kqCS5NQP%b))2fvF*PH|^J*%}S^m4gChh}kW;*4!L z@SHzR=Lm5iz)~({88P>lbA5Lq8ZS$LXWG;ptyX@C4;-_bNU1;0^_IEOA7JZ_yJe}y zAAYtfZE#4Sb-tQXtvrAd)lvAlX6%z2zG)xVsS zU9J}{z&f9YB@3Zd?n~S3oy;BhqU{7U7jrk0$+Bp^GFD7ux!CxMv}K-N&rje>@^+2K z|2}r_i>gYfhsoHmc@`r~OyR3_)a4pAR=V(=USTTq`!&`Pa4Hj$92mq>9E;m2&noT7 z*>MR0Gs{mA`4QF7`Pna<-x0+ZF3hphpgbtfGd+ofS8yk-|K2%5Zk3XZgZ%R$3FAA>d zEka0rs_83t!IyJ*&Mw{!utJ>gX%~cDapKC2Sg5Umb3gF8yT1&ju1Lq2WT<*7syMYc)IK@<7Y!g$DQqS9zK)DB!vStu>GiDf8Gn$tv?t6(S-d z>m7L`jP5}t(8}t4dkimFg44VmO-8xK#op8$fQFw(2Q3k{MF4zWk;i~|S6fx>%M}}z zHRfp9v}S!}u%U04vW;bQbA7=pe8}dnCMiAr+1AlQ3e!U7fc|(W>!Nh3Ng(ZWcH%l> z$BOG_l2@Ha4R%j|;VqLp79(GuT1fO1^0zJBsX{3aIP5r#5@W34v(ty@sG|INXbv@O zGp2N7&C1^s=$-L2AJ<@UY6Z|{1xhYTyMo^(oa5eqLUW@tzM&i6m`>gZMWg!;nN}L% z)5`M9lV7YI%GFE@6fITlgMw29X6oo8V#CgliSx6F)s{|@X=-FBn((@49uAeMN)!qf zDOF)ezFOJlrj_MSB<`?PS)b_U#jWo*Q=<4HUmF1%7u`cd3mQ(KMV_WqqO`Vr{Ki)m zE{sPj}g1%Z2v#cnUJ<_!*<(Hv-*V_b8-G%n1u^5*Y*9@kF}$BvX{ zlfrIkuD6i%?gZ7*g>Qr|TlEIj4U<{L?wQqv&|p-C|O^ zDMl>!^Oxt(t8eC($a^qdzv~qrDAKxq!cx3KIkL&LJ}BPJ_dtLYQs2{OGM7UWDt4JG z1kp}L7Z8I}v}ev}pW3`gyewy0n9DZ-FN5Q0%NqSr8Q zZkcV6!7iLeI32BD?{~NNpaW*V_nfQmjO@|nceyO+2P=HP6T|%?*?@m%9f~%3KZ(|4 z-D5>R7{9z=oR(w0e0BUxQ{DtYk`(!sLI2GeXEi+GS6{CbX{`%N{C>|MZ9c`@cr;Hf zBVyy7@8MPWkGG{}oj<0kau-+~*ax_NvBIi%3J69K$O%1Y-aEKZZwGKo>Q!@})DM)s z--*BC#6Y^lSsJ@@GhX*N)TiTS^`JJNS#ulLbjUa6QoAuS*)!uLjt!h~jn>y5nSEtE zj$Xd&TOVQhrl=}aLoYQ##a%4IWmb~arTY|?)a#b4j$lM8EwIkvN^O1w$Y0!(wCv5Y zn6lb^;xW$)u{6qfpL!vGuInkOPg_mmsap5(bBSJJOYzb3)faFFzmeX5i~IC11*SKg zayFw&S>UR>5o5o%Ej~5jUAn5AO z_Qs`(ee$2vFE7K*w!+~x5@og@cQo=%W7|Vb^Y>HwE|dcKcD)$%ixP-O7`K^2oh+D;_S52vd-A8sXEVsZsnMLHg8r>=abi8R3XrNy*r!J?u(VH)Iv~*}>sGFF^vzSE z%z1jT9t6Ay-T$(|Ds=?dec8o13QhS%?_KLnBCh5&J1^%AdT4U)aYp;(GvQ9O${g~- zgc@I!{5WTEshE9nwP?LyWs(DP==Bpv?6}#th=+f%5;xP7v6D-UxUv46Q{xTaV{v}B z1X^!isF7f~6*iw?-K)&;54(ahWRpB-$Fi^>K;6>wu-|Uq>YYCYM)qtyPnJZ1)|?S7 zAzK@PT%m)0=vu?hIeWdPuX^jNTYDgh&^`X@hj~Kd(y_OMKYA|3my`<_w)+f$T|KSo z4K-8;|G0n(xrgndLnlnVe3xQR42d)#r4x{1OUZjW;`!x98+&oPZhTu0Vn4N>*FaEnb?04NT`Hku&y1Y5GwMXDQwfOpGDxYLl31c6Ti-5 z=a%@|>$KfDLQ zOGUorJd9@^L1N4ku$1>~XiiHyj||qtb10P<(O%|Ja#Gbl-b3`iy~lfu*ea7RDv7WL zF{e0f3NNyan_6CMf-JuN6JlV01wqV_e11m;=6^iDxxToEWHcy@+yp|*+~zI2nV+#@ z-QPb);eMw3<9W+z;E}IceW|qPS0%6&M(=_G-4O$B)#zGD1Bu7w?>4}^mmF6i@o;ok!$yZ zCDRZg6hEG0W}5cbyf$`t^%8y5VDW?0qQiQLKJZH=(LjO)X}Zw;Bm!sh%jE0*?rOZE z+{;|J+q@3Np!tvWc+P4m(ObvQ4!19d7V=LmK^$DasfPme8?4sD2EU%hwoH)f3=t$3 zoxR}0qU{utv4(&&fr&UUcL}+!zj*tQDpJwzN;eozIY$~+cx926vW^J3px>z^$M8O; z)z(fj23bQSoV*NKyb5bity$u0g}tj&CUc{-LxA{ZGcJGO1xwr%a$w(ULNUv)0dx#+&=RFX<3{ZuOH zjFpqLWRv(cff|DWEX@4;u+D#+Obu;e-Pf0Nbt`RJ5qxfHS7U97yy?e@Sd#?#CGe=( z$!QpZc-ha2i;7=T9)GL@JI%c2W(lY8kEV1mo6e(bjjh!Tlau!emneMaBo7*2$O4PE zW&}Tv^Pf(eiD*YHt`zu6@OlI=Bi0eig%O8k8%FXEklA#AW<<-sh|8=Zh-fNX$A%FT z-9#a{75jXQ$^Nbiy?5Ly^W1v#Hu`Nu2{PW67YezaO%b%iF(b5I0vQDp9I+wNc#Hvl z%epZk+LRFX;HrZB>|0jDJ~7&Nrh~=j;7B3bi?K7>w^anPQynog(szdTZRk#U<&1HK z2bkHfNUiL^7)xGe$cY%5&+c9bp^uyeY%6{F95&-`zQP04MK*`>d_r~(+*)Vvpy#{* z7Lv^&hMsf(TC?DU+cC5Vp1cW5i`d~GduF2oO>m0GL(a3|dg*ODNVTWs?TA?H*G~?W zX!eNq3NaUZ1Y4s3n$PL$7zurciK2kQI4bpuA=Ctr`Kf{M^cJA|$6F(oBkzV{)alRi zf-wWMzjz{T02qQ$K4pd?$0rg^vFquN)_yh08^Qkhjke(8Nj~O0EBbueJvQm#+_XB8 zhkfTlu%vf8#HDfe6nu(Y`h2tMxz1bp;>Mt#Dp=AM!g#W%8R%Du6pJ;Nj*AfqoGEi5 zjONmS#h?iu=Q=aN#+0H}67(}eq6>= zG=WAI;d@yqym@CxM5ifJNm~pidxkcLGuqi)`DcLxZ<|D@kXV z-Lo2-WUjgl8<{eEH^Snleje`A8YbzEoAkrhZ?=olbWkwqh}pRyetCk>&!;c#hqPcD zVC5n}B4sPUK~lvd4N}j&<~7%>X0D5kMw^^5q+D(jZRkMDojx1;GtV_Ck0OnRf~sud znv;t9+ShsD`kGUt@cf$dF=$_yU*KH1Fj&xTNz7~Hq(TIJGi1S})*!Cp+FTpr`pagH z62#3qV9vV9e7}|BnKPsUOk8tch1s$dz;1@6KWZ#M$U9p`lxiaP+Z+9Hn!W^``!!m6!I~?)4ZGF<_ZDwoAY`>2=<%xPczEYUdxR@P%?;lC#vV+~WJ>DOPdOklYYhSO#|B2)-p2P}#A5W|2 z_IQ50{T(Ipetlf4{MR+S0=#WhzA!P}=<4ym?`OOD`tt~U-1O@4b$`4+Wwy%a`hFZ~ z_k4V<)c(7B+|IQBem~Eg)iejb_RqTI9nVVT0q^&}Bo=#a@yz}NNG*OL8?_w(^t zp#C@Bz4zDgQ*GoI?21o-TkebE4|pRrCNYP2)m0ef<~|5{)PoHs`-I0#^1o8Uf<)30 z7lcj0GyPSCG6MQ>I1uUGe@LOWk%|qPL562iMXZpEYa5`<1F8RDo6!Nx*AR;AVPGh< zCw|Lt^Ui;mZgEgWEPtaHo7%+DLPXCOO{Ew#vIbBKZGd!CDgFvYyn?Jb7%$ZL3?0PQ z(bem(yz8# zKM)GFV7RwQg&z`6HVwT1^4=cT7z~QER%EahM-~aCNn2%7YpDg`q~X*z(J|(b%EJA$ ziDUzrNBkK@lh{+WBFTaScFR z4BuDSxc2S##oYvWaq2o3!8}{T!tLSS(jpv>*KiRm6@EF%?MJ-PM$1hZaA9wP|M;6* z8BKSo=bc~|gtG+X)X~HC1j^yUjE5@XrXE-JZ%l*k63Sr1oi}jdZ!`wTg_<4_J0M}o zR1MN*Pr;=`>2%VS1mi;x_6IB(kY#1*?CNr@A-!jFEr`HjronhlFw?1e_QSGGfcBs$ zXxvJ{%J0drqpBMfKLt@dLDT*04-grrQl(4uW=)Z5aAF4BA>c5pB**gbx+e$zz`7#lA^6hEOrtsl&`U8e7$bH$#-hKnvV&q)Dw^5YzO=!e~+j!}=%8Uk1 zMKH|t7_I@upmXkASbwtN(jXe>=@0QKg>dnh!OOUo_t%d!i*p$`l!Kau_OuNE?#%CMpRNv%g=$l0Tm&U znY>44_&NE8L}St{MRcWT(V(%rXtln3mM~J52Lxfi}Zo=aZm_*wtg7R_@6&Ym}M9nF+v)k z;58^lVKn<4cr*{1g_AZMuR!jWoU@Q+OnztWnPw2RSQ*lLJ8x7{grjZ7ZCg^p%L--5 z+H+pu^ygt|9R6OG-lKb#>MxQQkx0OWZ-bLDVOB21(r$pcreG_NEr7H)*F&Ngg-f|c zo}C0vx!``sk5LInjT9AW`n#aZ=NCh){5IM|gjRQz169N1ahrfLky(&2N#wZCIqGP>bVkPV#L7_F;j=829FH(ymMn6H=)G#Y{Ih zMiSeCa~;nbMxQW-crll~7S=qz{@Id^>CpyY=cyj@U90r3|9e2oyA2;_&5+O>^?-V) zg(E{4YT$vOX}bodC+fkXGXWW)$%F;E*z|;@>FljN}Wpk;@~C zkvP97os(huD39by2jZLk@H2}=9-|qEf@sEW1ix3G8OI-G zXr|IG9(abe97pr>`HN2IMjvJnTZLR9`#pEtcadIwvOE7D^=b#B>P&N+0QSiPz zqU6-T-i`1|V$L)vf}B_kojPTU$eoGWHVyaQU}LI)7aXAD$^M@(m{xP8q#VO+Cw>~w z)L~ZbHa z)(!`oft_eb8o7RN5b&;#*EoZ6t*8EZ8S(g|B?r`*MM4}^#dd4N8O>md z+sA$sHj^g`Km7Wvov|&orYSvYnjl^myr<(dJDNZvEGFuTfCF`K1fVaLHoJLxgz_qEO@5^kn_cJItX-Z7GgNit1=(;yNtO#=RR1CuzFMAzNz zFY7bKaQ7c>I?m2Z^xK)~^6kB06Zk^xBr>=P@`-w*E*p&_>&duczJlM;Tqa2rkw2E& zvai#BsFoHoc(9j62mnRDYop%E*-w42v=3LGo4Q(8Zycj>J~!FNI_cw$@uCv9ySWB* zr~Oi}BMA;VT=&z*$&u6$!|C2qU zvB`!YWoPGDIQ~yO@H=QsK3cJx?#;4d_~kdf?2j5b&tzuV{H#y6!IGt9N&= zbN|37ahn3QX-v4X;3|e(63fc^3orV2Hz<E2DF_loFctSJA0xzZVq12xC(p!%8_*F%luk4EQWl66|4&|)=za^b z8<@jTsw5KWqCo#om)rssH#L=$n8u9%91j6i3#YfoS2BQxWTsu3+k|}Cf?$WgHEP{2 zF&1d#xfq2Q0ooRl3=Wfk2gTE-P6e)E1QL_ko_1H04HO}ai$&eUgMPDstbo+@AU$aD zm{z5u*Wz6NjS7JyYG>OpgMyU&`MjV#Ld!I=3%_fhdi5bw@>8(Z^T*6I7AvDqXlL7C z>)nt9Cm~`o$)x+3kEgk-FX;={7s*Sz+e?ke_1_EO>jxZX`6K=tCx|gsLbiVAhctW5 zqdM-HEdaqc^(a{O!{-ER(+N)fXwU4w5L1fwfL!8a=~8AiKY07!ff~X)bAx3NaIF;T zWsY+~d+JGY;*{b;zPp)EStDjO>DP`OpzQCFX0z{1L;!-8^S{>sF{(4k|03CKO4JPf zQd0_F_#`w#;a0Rp$j`eXlVV6Z>(_o1+Xl!7O0T6$We@piMGfe-&uYJ)lyCm$8IX3; zndz*LU3%`$kuMZFVXAqXakrQcew6DKPFtJ?h{hvKI#O8q^8NU5jn$QTK&-2DSYeyt z%z1EN?0}CU&)oXs^EfFw$pMpR>G9wv2Y#8k;U_{GTm5 zc2y^fKJVVR7nUrauBLn!rc`E_XO=9lt`vOjmZ<`&abliYo2qVPe6@$$JB56-^r#i^G!onoY9%!r|)cl>LeFoztLl~HSu>&6!$V<{K-IZTIw0{!hSBi zoYk z{3M&?Y$mbezf2H)EEc&r*$x058as7f;2{`(Qd8?oE~MCc;td+p*nXf}<&%$CMwqu( z=!a!Bd{SgRX9?iU1tdn+eqK?&x^A;7*!9F2o_)9(Lj3)6V6TtUNeg~tba^%6sh7Tc zQ=cQCS#kF*@_xEH{e_2NoaKFa{GX`~GG{!P!im}=Tbq>(&+ebl`vTu zWZ>vVAhGnufZViw^jq==a|eXx^5Cab&NjzmC;P!a5QtxEgJ7w=XrMd*+y7SyxzZVr zIrxd(eM0vLZlcvzVj9qd{+zk9c|oq(Yg^ef$LhTfLU$h~fQsaNokMmSoEr-bai>Py9pGw; z%MTu@O#Qqlcippp0-^n;8aV^Je?}#hDfi%Wg*pCPd9V*eMSLTT2e)+p%qkngj0?fB z8!kE7MC;1B`&IG)x-abO+cUo8^v%tDmQDCw{a+;}>fkB$H_l*F;@f-fUhLk>5mx}S zxYSgj)w{z1>XO#;Y|5XsqbR*IpJIeva^=$aC}=yPcrLuj{iAMcDUu$uLW@ID40r9gFn_GcqGPlWG{x_IgBDpCc3hE` z_`i52H~sK9#flfM5g+0+;v(|RLWJSB|mqV z*4k@5b3@V?4Sg??KaE&PE`j-lQ81?rZA+PH>PW)ZIw7}F+6u;th?F~*r3b)tCY~Z3 z@Xp@YR9cLV-|~hKDt82Kn7RqO54SzAE&J+Y;t^;eT~;_WzHXQ_GMrB~Umsg3^aMlG zS%R?6F(A~1(GCC=p$bRzXj%eAtS$p0f|_M8HnflBY;W%l-hyH^3fT;FKbJfpZG(Pe z*p@C;C_9d`m&q-06=y2RM$srDswYpU({>vSHCw27$PXD!0oka-RMP3u-3cd2O`I&! zM(l@Mc0~>JE^z1UQ4>s+O69+tG^RAZ;(v?6T!E^h7{US=q0J59p%ii$+rt`|RDW+i zjM0ix8GhZ>2crFHAOuThkDB!0+K!aG;9k1S7{4RypN}laDiIFkk6FpZd?#~L(_0GAkjLFoo-C}vWeImdrp|Dub?_NCjAfMLwRx5KZX8Wrr zD;L?8l#A|o9CK8uDOyjLn$zaUhGEr@aXi?2GbdhexAb<*7#K-XuL`xwVC>O=&QZaz zHMAB!!rXp{V&!i?WO3PpAGw_d>(nDd9D z&Siai(VoZ1H%GQ%Hx?b5Ch>JzWo28Wn;Vs{d?)ghY#rrfR_`=iMSe2LRA4A@5CB;Y zxHsPC>_#xQ<>)1HT@5Ne-Ku`|Glqlns|F5 z`UW@7DA8}_zz0R?12{SV-yTo1_IS);8%p=bf0<43UJpnxH+CA!?na*rn|Il{%=EC& zX(F&gPKFJyl%%BjH&Bd>E?Fm_e$?3Ft$s|j2ynWyx?`*%Vch8{h59G)@87D=_m|Jx z5of1Fy%@^TeGdcELXFm|XoV_wbJx!I7j4iVz+S6J-gaB%TZQ(EVWAXAeCzytHhVZw z`1V%RDz+zuKKtvJMkSS%Mm5aK^2I4M5hw5fpKZSScm*OmpQjz3NlnSx$Zit{vhK(Gb4M|q{rY-Tat@Pi{?t^lQsIQN}q1D$X zP+!IUqw_Pi?OZ*+2hfjlu0+7?{pa?!a{tjDWs(xlB3ULQ7T(4&q9E_T374DY^`;VS z&pP6ymlWg$=WcVTn-D(N5@Y^ge|Ble`%?ehrO`+US(ap}K~bG0dRt(!{WCF+ybSh) z?=+PCNxfLGr9e^v=JU_12UGyvUixVPpaF(G_l5Z|K=`;DpCCHo$3w+c+qCr-5e&H0 z;#D=M@|9X9%*?h3c}5h#{HijB=(NsK_~cRC#}k!ox=)eI3x+JDr?Y)A6pammW^XUy z=h;U88%LnO+T-LbDl4)8*-DG22-Pr2ydWWHzu?rW#(1N{!hk_p^D3`{S$vA`g?QHLG(9;0if!NU}yO?%gm{D#&|Dc%E?sD1-BC6hk`}r z+x2V2Z_K0kfqr%J;LTa?@vI6dW!e80$ZB(ROe!NkF-RoGYD0^hVss?{)c59%T1k?* ztj0hG-7|nEmazcB^UvJAA${806`mEqAL8sHKHpw1;w4{au4!t3$mYdluAliK)0sAi zeg`RZwR~kWw>gnm8i2%kBqd%NcoYti__u&NrDMgl^s%z-=ZU5bHQ9ut0QFb4Gb;Sl z!|t&=ghf0ww(4TRs*xU$_Y3kq`L- zcIhesMneqK`Sx^LRq}w%`LJav`naY_iDhKkd786>{^{=6QgY|M=yLIpfMSKAm&AXm zf-~g>G+qZ1j;i8EBXZBy#clb_)P8v7qzi1gcY0gJ#KBCPh64yd@>FneU!y7*6Ic@) zsHs5Iun^EcHZk z)9Gt{2qrr*yZm={B)-(GVMt-{uON)k3aI= zjs$D+3G!|$qtY&{7|8Ox7A;Z6hYeWGi1n^e zH|K9WRXmViv>C#-X^%BzsYy5Sp5fg`p3ci%{J2izO2%{(%#R1z~&JL-;+~kU>m3 z2>vj&gwqRn>zgoFE?uJJ1(?G(8az> zO{-m-XQE?V!(Lw9r2R=9^WHC#1cEYNw#EBsl7pA%HhMM#h^Uux%mdQ6El6qy^3r(1 z(;J5vYOV096wzT2wyp|XPhi6o7Un3u0w-X}6(E9!s8#b1hAlNrkYH3uCd?|7!YS%V+EvL&!$QUiTpH`7_^)u(d0`gGi z<}fYDDOYGLNi1>zZ7-ji9xxidW@B*hZgi6R_971LdKFW4VhmRCjBl5>yxuW?+F%vy zPGrU6VSnLOvxh;q#>u!L#?A|MoZt@DnRlrGLu#Aa9HdF?SFha)CRSrNc~-2mbp}vj zWVnnN%DboIp+GnM6S|HSmoBQm_h|7^k3}>iv=5ti5rbWr6_``ofYG<~Z?kfANXoXuN2AdB*Y>kGB`Ey-;Lv&tnN2ruvRuQZN{=>ZG}#wt z(FG3Pa;fUo1Dgiiny0WVMAEK>S&;ng8vhZbnFPn4DjBETqiu2JAx~RGY}PQgAX+Jzp1CAkEZ3DKaA*nwCFl@i{lcl8w~B5y3-RQXCHBr=ta|zEy12A zs;pN*ZMV2)iz{J>Ey7u|Rc~hH4ap({&4Bz3y;T(;BT+ z49zGRFPlpCzc_NI8q+{|N#*c4f7NaL=9RpkG=fdor+zr$0pu@OsoX~udnvr!@^6$x z&;ICEJe|3Ju|_IuDrlmMJy!c#sUa4CoU_DqqG!yt3t)BDwAFMOc1LUHRwZV6+Cx8P z?T$5+hzYf-pc&t1ZW+dwMqN}EYVMSKnAV96jzSIdP3y-D&)&zl>s%B5zSaC|k}H77 zbYdc(zZMio3J4@f6BSHwxe~}NXeQJWu5X@Y+>|*M=-0dU5E~UvDoC^2YQ2d9v%ZflN3lmRIK~BNSCXHT) zKaU+dk7sN^33SK-ODnb9+=av3DSu^|rOx$uvba6w+oXn;Y2{Ay^mAby9PfA1<7lMM zdtuRe2Qd8dA3P%IE!{b#KzKO*K^iNF!D=qnVe9UVH#N|HQ-=SyP^qZrICUeD?A$64 z%+X$N^v5_nMg6LK4c9l#IDHYk=R!x4Z0drz2e16s<1iMx0=y2#1Ez2T`YxupaeU3J zl<-b-O->JRIw!YqBT(7y>Kz;CjE%b6J`|e}55TM%=6H7_Ym4CtzLZgLMARr6yVo|a z_KmIF8p07YU%+ga-D8%+_?2hottIdN?aLwIqIo*b=jt8 z(wpSK4nOi`92B@}+x)(|$EqEoB?tPm2(x>Q^#p)_8~;Gj61RL{P3=tn@256XyHK7p z(Ek=#E6*7?js{@S{%>Ts_V#5b0L8=-TZp9mDG?nM{-hgY_q`W*m8%(7KgSiKnWViG+O+ItOc{M_~)CXe`8b_f!P|Y7Go&1 zbW%km-y0YB4MP&ZhlS0qXX=E$dV`p8&LFQJ;7pVF>36v z-28K*1D3r=3S!=HSM>1NI%lHGyK1nfeOvuba9Ip5CDgl4eXoAP7N3QnSi;p-4slT* zpyK1P{r=s-3C0ldA}v2y!|J3BJ0N2S{n7fUnY)>*NIUT*!@I*;aO;`7==;aS-r}CJ z5#;(3R{=EB&oEX@Z=upHZWM#-J?sed$DBT#`ue3^v{Z(+F~Vj@qH;bBN(hj`WF-^S z5h2u&jGA6Qx^AM0QxrHdEmZj1J%n%(ha_~`c0PY&@!cSag43q@b?9?Z){nU%&!TXY zUf3Ycu=l3CRwx1a*E%ZMDsg)FUj0K5*zfGnZa}0@R&EFBmswGGw0}>0ln3$Yi0N-} znfB0RRx))k&_szSisllipDegCO-K@AS{hWh&;=4h_oTb&5AI`uLh5r$a0pn zU;r^GW(kkR{x}V<{E0M6oN7_K+F$()NY$W;F#i+Y6qUf!E)28h$U!*Sa`*_n2T=*TESAr9vTO!yWem`9`?YTde(OD*Ee1Y-27nO^tWY6c67&MAPr# z#mbvia&MEUu%z#B}!sG}H7zp?!l=_i2;wgunWdQUDPhcF*shTF8K zg<5HDa28@fIqC@YUKoCXeDb3q@yk~1j=Z_5K9T%C&p(fv8ZX*Vari*1{?_%TG!4ocuNb(&|N0;xrr?XGF%ALtP$Vb6w z^ooA3=lg5tO>Rsb5;{NS4DqS)h-iQVZ7b*HL)mM2M_Gg?hdqlm7Z}Q3?o7Zidx!(s z;|7L%>9m6@KN|F^)Le@z5R&kKs>1)q3^pT#nwDxTvz@M@H;@%d0Pe1Xur#Oo(CR{! z;rVO4h}Z6f0;lUz?pRIq?Uc2I@e$f0`+g6%iFx1FE?#p_mKT{q_2I;7{~qG8D#cWO)c}gf_Kmk zv?ne>$p+W3u#EwDp^0mCSv`bNi(gr`s<0S{(Q@jEPreWg!~E0eQs{K<@I{YR#ON^6 zQ|G>=I)*?Fy0~~Pkb@z=Q;TJrsQQ+v&J>ZV8fr?HQya0O+s%EvvfJ^uMvIZlSFu`d z))~H@pC2b4q=kn1`1@D>?l%-dKZ0E?|0RL{7^B(0))QXrNFT$e(ll$FKDdhq!*?L= z@L*cB)%H2tYIYPPu=*iC-)Om9LjQBjT%TN_;q|%8UX4QsxWT%zWa}NZyaTnPPE<*+ z9oQ^^_IW05Q$G>ztje>G+>6@i@?mL8Ctkwb@jaaHTZXM>a(lTeWfKzp;vhC)a)$0| z91uI!65lIGchB9G#Fv2QL@oW$fv#PmoXUSVPUkrhUFd9yT!VfF@zyj&e|O=tmt(Z_ z<;-$2ZpBar?4YS$N4+{{eOmGC{$g!Vzk}7R+O=vS8a(g37WKO9UxR%FZV3t0Fr7n! zgV)>qo2SRbd(xQ7wN7fIQpKh)FbTdk?ip}Yp+30$+jDK;2hg?x_-ax?N)xmD^hXs5BX?blS!}rq z|EuBR8y2cQH$+=o+AuKRcJ-;ZdH3k#wv?OgjAl~IYSLw~4)NI7jkR*onbH!eb{q0q z*2s4PO~6t+X}~5a_&dT*gfA|LBi%+J`Mf>DDdjx{Sp4XQiMzhE0#GY}Z0sjk}n- ztHo~t)+77mv(hc_nz#GkgxriCAD?Hp>fH+=AkUniFrGbkS49*ehVFP0|81#WJ?pDy zisX>1Fr8@khf= z(d}sISY*V1p%31IV)~c6 z7&Oa=?a_EH_)wGnKzyj#SXOGk+*C%kWhFE-%(C8C7g@X^biLlsJ2~olRWWm3QQ3&6 zOKY7VZRV{+C2AtoD<#ypxcv)dq2^@`I8Sz8>9SpZa%>Fme#I&YAzR9kk(Ze3;nGzF z=N&>}qbq@HtOWTi9{cq2yN>#|kU|?hYB8p@i66IpR0!vkLCUFTTWk^6kc% zvGZcU&8ND!srGMHAz3M?L(L+wTK7;JE(QIt&}7QL?DX_=tK)dlGmCwPb$b5*BKTnJ zet%o<@0iE_)8T(_Pov?eK%1}opfMFgyyOGPz;3mkh9;x0u=8EkS;VVWo|R(Qd&MP7 z4nPb)GAAnv9M74=5Tjq3_=0{8m_LC<3b0DVvn0>=wu>Yt#iO8pg`_16xz(tSaM@zW z^e+|T)H!dVgO&lvenN8v^azCl%?6C;;KHNcwA>+H1U87y!7=7IQorc`WG#!TBe>LC zq-5H*?NwQa8v5@=kBPyxaJCN&Nj0K82oDt9hN&&v3ZOq#2>%+DZ8lmyj0(T%JGP9@`Kl+s<%R&2;qtE=5{kp)phHXuKUC5i;bzPmq z#CbtzxW?kJBu6QReW(j4;PW?&-DPDbZaWPvr?wu(LGH5O@Ze89uRi=V-cp#-#z3!3v(rC4d*jx9aqYdPBS;2J3_(yp84sAmkj=yVgF>@+LJZ z?7wg>TQ$}qy-;S2={#i`x#wULL1RbMi9YpcqM?L!@vv5qj`h`PmX^x`S+BQv(dep* zRq5%z;%YB$y}l%4c5L*e7)ycZqU{x-rF>hB3CTY2^(D*`5iOC1GY8&%>Z; z@R@NNdFl;(U_P`$<2Jr&kihd618KhR%98_+SCg*mor|1+&9dcCH@gb{^3Q(ESo^h5 zc^Y4XuxyPn6XKl9CMbZe1blqoOY?~@YUS<``WU3r6Nm^cN~^=5mI3ShN#`EU!({U= zVw1+Tg!tFG=$c`)u+D~Cx?V`~h{5(nyDSWFT5kDcTLPU^YJY#4vGH$;o}D(&>J z5Np+i=BgYJi*09rD5-6@KEso6^3cgu3FDO}e0e^4FF`e>*D|S!G;7y8w5>OC>B(Bs zt*_dhRD@%%H1bf|svx7uihAI=SZ9>}_@fZOxAmgD?zVv6x@0u3Qt9Di-ms5tng2CM#UiX>-jYpOh^aopPACdif z_F8;*tmI=pB1s;ni67hl(-!)TQFFue-wQXw6IMHJy-Gq1Q;~n-SgLxR+O8n(t3t$eMI+@>4B;M9%bEg2W= zqLiD`;MUe&u$esRBKa<6Ej#R5!Oz)eAguf{0u%||S+A-v`qpx~aw3oBO zdR2qwHdqZuu!Rcg-WUW}tN-BkY9YYf+1voMsD7Nablxh#_B2chCaj`lJ>6|L&`9Z{WluI&v@*@X#+cbVdUXUmfx>L_{hQPy$3-$x6$^gHR%EvW13bH zijVl=biO59aRFgWjeh<7@Zc|G1PDI8e1Wk^`fg((^W435vKDWm^3Wd1J7*li{vzxo@%EA7iO70FW z_@B}0;5z;l@QuT-q@o(Wsfi|mz77()N`;hhVZUB$)SiSow zB?bXju%58|;b|qaJG=c%w=cQVPo=SEwSaSC0_k{BNvx@-vK%%JWpVJm=X=_}C&psn z9*bQeMT)%ulT50?@4X6a;j?;s86u`Jw^6DtSvj&sN>@c%`Pic+t z@vHB}Y8V};EG2EjA*9)=$Zwg*zYsNNp5QXoJu3%RA)A@p{u#f+-j;Dz9>h>~!V`C!W80e216 ztua43eQ=_(iqR`bD~$_6VZ7Svrte@KsB`n0n|uA#*Y%n%UJ6ufQ@Ep}Ig^L_O2c zn?|p)i6A;2tMS#T4&%g&qeeH;8%l>-hGJI@p1x(*f>?!pc|V`Em7@ic8TC}hO_1kL zoclb3h@UJmvVz?iSSAezEiA9u6FCz%A?ZR#&byzJ!V8u7q6qPRjJ&U(A|3vn&)_>z zgs;o973zLNs;GDJm;la8#CeCxKj=nuj*9bnUMi)YO>31}`FP)zbUjnwT2ur>6&efS z`bpN;Rs3!bb4NJp7!za-ED`whife9ADshlUGRjCU<-P&+o{uaYRN z-|CgB$EY;epw@73&{amS5vtJ=$|_PA=#y2}cO(26JU@A(Apkl_Xg(K6=v~@Bv9B|2 z5%-25x@nCeeHb{2^^O=}<#-e?+H1XFzm8iU2pd_7UkKLzu=wb=!bWObt~ZyeHa1TD z`N2!OXBn#C!Q}n%G0L=cMU)0dy_a<~4q{P(x`2~{)FkdB1@1Tv+KN_D8+(b3lR zmR7F3ON{ExfCn7UYR@`lXZ|`HSew7w0rP z&a4=oqhBKBzXHxBM&D*krgL&H{s=M8$`|EI%$-@rlthl zAr}!BB(h>uUvkZv=^qRvY{s-bgPSBg5Ohzawd^-jmxABKt-f}Cq3DSw!&jLy_>a#e zC?$M3I?}6Vt1{bQ_}>%Qa4#pfgN$)zAhdWH2O6>~O2Up19Aa8I$##3?T2@Peo$cM& zzC#;J81;a6HH2u&6wOlDtRlpivZWhC(O4+Qv1AI2$Tc$^z9o(N;k8HfjCC6G&6SS`MPz^I4UGNl=h?;4QT9PDUjJl`T%jf%5o%h6e)LqWZ) z%L1}9P+#k`wH)gTUgmA%t)te>wzM5qhCwMVmZpHFQyW1x3>%{ToMln3{&{7Py$i?R zS1E5=wF2c^>@-WU7j4|;B_WQqHFRJLdSI~4&e+#_bb?A0)zifl?Y*^g8ZHY#Wdx4Q z*9PF)avj_fy0!9#U^zjBwb1P-L)#>xl$p|_G{O`6kX&r?e(NEg)4AG!Tn&$1{_@`y z=CvPH%gpZ6QE?08rFV}`VlmFqBlsQrhU{xoA;Z_j8>L6_Mq0O>u&Y&2%5G2wC7_Vc zT_w-v`MQ3DQyCruS&eqSn&1x=K86?`CjlfMIwIh96P~!NG_@5iE*2B#+BG@QvbyU; zK3ShKegBDGI(cjOZsFTdjdn-U=uMq=EEh(`~ef^(P=94OtXEu;`HvF`okarvwTKgtu^jVF8MtUnM}- zng5e)b&Xmgu9u{443CE(YQW}egp@{Jjb z%=FJ!5gtLmyCW4>2MR}IVx~P_*BQBVfSk$17&ZHaP}8mWGSyRVMOUD=Sv8@B9vTWo zUW{vH|6#rtz~IFWB!B_Yqogp@&IQ^q8Q^G%{qTcbtf~}ik_9=~Q&wml9LW=`*37kL zI~{vOQU-qkVAUbnq|SG!TREAdo*){MOjXfBnTkTx!61a&=|-73Hmu_D*6rdvKdPr* zT&zFRJURL1nI-KenH2iqxw5TY0JHd=dT>j}|v#F)KGuV*xCGcg<%E zODax-|BB*Lw~rD&=I1ufv)KIm`rI5uK!Wqt_I85B_tSzixYbF&O};%W!Xlv_QCQ@T zo%*;YDOc3qd6JZW1H^j7Et( zIYsm-1gta>8}i9F-Y_NIH7u`TI5(G`PCbq_RZ;9$=Q(w z<_pI%+bovkG)%!uz6>x?4B==`qH2kirBiV|_%kFD;@dsfk#SG(4; z9&JsfiDpm!<`yPPJw)AcKWf={>bIzNj?@BoUkgx8?E^XJGk@o|tGzwgOoy=m7@eKP z%^Vp;+{^NNVRxAVcSl>uZoD8H9v^e<=V`X?!+oRL?nxKRix)a|DAZT5YM1m)AlLR< zn_|m;&8>x@?p8qKSXU$Ow7s)AKKL9V<`~4R`7~rzXxoF9za#}|65%Y260>n9BBTsN zF=MAU%zEthporo1zPBlBxK?(f0MGXDlK@OQOA~WW}#xMGVp$=MY)0hV^*Q+ z{fREV%&e(2LX*JGWo!0qWUAA?^K|PhV;~+MiFDOO53p`|%LM!+`%M2fNk{W6UlPm; zSw07+OBt$R?F|cYm#2=dIK3>hjc2n%VBim{0|V5pw{}^4NIL!WerfoPIGs&6@jr4` z`Xm$tZ2G>~KP1Y;%J#pJ=(Y}T{1FG-%>(Txqy+L4MneXPkh4&iY#Xe~)ojetQB*et zKrlsWBFXaVX)~KPD0GcL8&N~FG1x>Xnj5n)vk4k>FEH=`InEL^UuPYDlVr2;!u`7zaQS# z1}g%b7pQ5M5;Y;{UoFp%PLeN>v38l2y6)1fUg z>mpF4=C+XWumtV_{6V6EvANRt`v7h}Q3Z=xm)vf9>l1QG+4&I@N5VHpAKO%$M2e+2_S z6)k*@ZhBo&^FpiF9P_*Kcaz+L8&>5`?88*S_W#a8+?d**%ll3U{el>f2v2U3iT({y z=4W?wQ?;umE})%dae`V;81_tt8KD7$qLo8=Mg!;?#=cTrVH1kyd#tp^2(6m}g1sfkXVFGOnejaY$ zVscPxcpmD$0GY@und%B#NW}_H&k}3MRl3swD}Of3ExPdYkk^+MpctfN9MgeK& z^>6h&=V!D1Q$CJ{Pcx%ZY;8}m5imA03A#X`qaZAH4Jee%&UY_ z{;;w)A8EZk^40^uX3Q?abJ@%dU|`m*&o*t$)0z&Fm+Z4AV119v3?EVrZg%MRqWV*7 zT`|f7Oy}RDensxCVlPQ|Mgfw7Puo-UB4Qbadw2AOSlGANjrhd6ARyMO3*Cv=XW*bK z27mf9nktvX9EeZz8Lq0>R{Xwmj;3LWeRTh>+l9(+5 z`R8#aP3evt@SCJpy;XOZd+&1gnR`y7*v&R)>Bt!Sl1tvFl8;xNAP=PrWj1hw);|38 z&2`N~vyj4>XPIi6tv1>ovePqFPi;Iq*+)rlr_=$M`Gz|pt3|4iR{-C@F(RF%YGp|jV!lw?F7CTBY&XPGhK0y|a#w`=WM9G}y!tna@L{dYgT{*^;>hc|76A?KpX3GZ39>Fg z7P&Kb(lj|UEskRX1iJ72mDGvNZ`)Fhj!Jwr_mK7ZgXhupP$>T!Y5&=`mJp}>rFj&SI>YJ_h)X7nS2+jS*vJr<^#Kl5w1J5Ma_Pa*1KG{DZ4Tkej`BuKP)-%7$L=lV# zwO4>2)x;OCw%a|{Ocjg>V^RIRNd%#UE;3Np$Ckim^2#rnDH}pFuJdzoXhT7A)@;Y! z@az2V%Kc~BnWA?!@_JcC##@aXefLF}*VeyLeK`02c^dTe&@_#``&i@m2 zY}K8bz3hPBd7-`saT1sQ7vo734|ET>DdX=hiq^Z@aK&KF?(-*4T%K`0ILbdD8tcc8 zB>BB1Im!Ly9+V9AvuAcZfg{Kb==#AS_(T)vx2prZIlVvZo}fldz#^6tUY^4}l!WjH z<_wH4#gFv^`a*zQlu7hb`^G&}Sw889Rt$)ChQCZP0y%2vRS~=N!N;HOZwUc{*5^Zg6%C+N zd0GimOrT2BTx@dsR^%NF`z~Xb@F-|O4zec$eYtQ3!j^L{VQYqFuQdP@6gHeT_U zAMUS*$A`2@v-?v*LH723$xWu2W`+^Bj;e`3^ZV6P%4-lG8AP;}oRYQeHn7wY`B)Jj zPVGYlBMNRG0(ZqOxvuj^obm{vUTgsk=VF%p3UT~^#;2hgW+g6Rn64pki?;fLUuO~Y zp%L@|n|y1xlcCr&n1e*-dAIFmpSCDW@9dyeoYom(sy<;A#%=MK==&L#k zt!e@oa|RUeelhgm_NAH=oAfB79iayRN0?wT(&hI{xU*-?R4=Ha{YU$nj|#2=??4bs$TQ8s!xRD} z$5^u9HR~yjvHhZe&di30Q?4Mfv4jceaP8Xk$?pzaA2oQfWxGP2zP(MLxOXxfEY=^R zV~`d$Lx^T&F6yClq0od)X4kZSYjCX-8^BOe%Bh8rFSg5~G3cGbL-;4$@X=G0Y=|4N zfvl#FZ?eWovn|3vWhw^*VC*#-%r*m-47p*;BdT#%k!dNW^UdT&&J`^*(F-Wf`c6bx zP7|s4q}n8XS(01Ee}o{8*32t*i|3?l^dro$`XYe-e$9?bl31P}HNqdwusR_mh*xk= z$#5X`p^ZRYP7)Q?NXUvO20MTzq;oOQRV`r1$fuk^{J|v9Pa$1FO7yYNl-UG4(aNtK zDNp|lIfK6ESZ4DZ;RA1&9Bb0)AqB$!js>-pkWb8|r>3#dlE|P8lffu1CYA+{h-aH1ScS;eX>O1-DvS zkyUbpKeSS$L~@lo?3_`iPpAyQZ`6xb^leV=Rpcm2s>Rrd(lf5Ekg99H*m(9YYuGzE zBdXv2OpL=NpTF z?b7&eg>k9qL30-A<%lR+B~0e!HO2MJdnLD*#l*D|+=+u99`LSh!i5Li@-pXbQA;)z z)6V@fY~6g0Oi;JjP*gW$ZR0r2wt3y?6eaD4OZK*13pRq&(YGGntFsL;u^bFTQ3UYK zQJwRHsm{ghBn_zEGU&j^sL{HtOI04H@vt%v*!2vE%cgL)rP*+zAQ)lnh%x@D_zO;n zyoM&=A`^>E>m}Mk9@h+TsLvi(JNgZ1g`yya(P)^Ek>DMNVStb}u}BCr=|c?t{;tsw8SA<_nLX(<7W1!?aro5nY ziiZmeIibKrc_`H}aTjSzp<71}n;#7CjkBew&nx+q^Ux;w?@1yvd( z--JN$AKBxF5%z$lEJ*i}`$wp7W^mpa&uq;PuCeAG8;Si;`&}7R4fkEmmjzH=p@mBOXu>oG$J`v zuZ+PtN$;e%OdTj72sr&lp^`S8Gx_hdK!ONSq!gX`s~KFf4q5U$huIvWj-6~%Ihya^ zuK}w8SY?3b)h3>JlaR$VgW?VZ<~mz^WY3kS<>ri%aUtm@+GN{0_38uUW*-#8hvdmg zF)U6)P+x__&soW0%wUH}Rs6L1w8)*RZIaJg65=NwPIT;=d{=3OY3$%1oMAocvXt0x zS|vwQi5e9gLTglKC2Ag6QCNe`mXXEu1_plb30lCiexi-cmdWtN_`1Sx3dA(tuWdxI z$ldaYkU-*RjucA7Ea6ju<5CPN5*6}_JYg1fPl0JrZ=?w|7_*%!xxd}ecB3ql?Apz< zYy4qE-N6ts-p>#*ZhBz??rNgMEF=9 zX{fd=i`)qHx_X>48|vmHR3;0?2avI4%01M0@8O(<-S11lFNRrWXv6nNFhq%#=4o7` zxFMGmqLfHB>O5PEzwvL$Av|KkQHbMgh>rkc)Q*3Ss+n2PUHz7>mGnwFVJ(^$I>(fC zT0|=arnw6zgpMHFdu$w#js}o&SvxE3VAD^_u}2P&I$yiYKhPv19^(Sj!j`Hhfr0lXdW+Mn~TqisY7#CG1iI2rhqNFl2yW(tdYelv)gCH~dY}K;usOnxdPllq$C%>8>C6=uN_6W#YN!gj|g1X8y z!oJ*155X;>IBTV(zIvn`;blK+Y*}{FQ*>bWK#(%2l;%WQngdaLn1>&&EIM&y@zK4y zdcFQbUilUGhBoz=x-ZP!l{>&4n^=cj)%?g-fNmYO$GZP&&mJmwE;_poJ)fvM5&0Ey z&%wU9{r%ThO<1*K8}wp zsYQHW{>cP#$TNk{ShE1N2XiGd2iHnsGAxBFM{`b!%1U;0<$7P40TqA+Te0YskNg^D z9<;;yJ#_+qPNLq{8^iExTOUj4pu6&V5`E}EZobQsdn^S{r%J%#3q*lq%dYOx6q-PD zql#vufP2z00s+@{TJm9b)bvh5o&r6Z;=<1=jDVuPxGMb9*#dRY%Lq8KaVODDmRyx8 zgYjY?Zc$z);~Q_U@en}JSC=K>$dn;JAtkN$F}y9xENC5kkgo47tVe;=Tb9>D(JU+I z9A#PIb%A?J#t%TAD0P=;J}VTzSWgVQ&52>EO@{<$bFeodD<-SVTHb?U81E&+dP=&v z-e4zhaPF9MgfwOpJ*M;j>(j64^KA2QN%&BT3Jx_mNRyERVZ*svX8Lp2Y0vYqWmuD2 zi>3;tvl730U!1#J>$aBv^C(Eh#j)}~jH3O2PL3uvFkI=v=fIQzX3qa3a9``l$3M3H zx4<1ka-lmA&5dRS@|foCD2~{C>BKNY-1&H$PV#i#XxX!Klw!2sD%nPUPy7~9#P`KB zNcIXGMkECm;VI{I^&UQ` z*LBFfL~?QjV{%obzZQ6gpQ2jM0WhE}JAch>2~re;926k~Ybfq$%lLw7%{)@|dC!p! zUdN3==I;jbynSpjR2_d_lDWdUzXJ@#S70Oi0huu_LlC)uACLF7$0bw7p_Rjbi4#G9 ztlvLsEoBzn-5r=7yB?+Nlam$@YvH=0h> z^N7uLFxIRAif=_k>AVFZmyL%tt4StxBTgbDPN0g8J!Z={zlFmrZ$O||r-9rre#u={ z#cno~&XqrV(byba(=cSY%AQF^4h?@3#Q#Xr!!Cr=?dO(^qIzYCRh!CfX2cq-sRJD1Y8y#FRAd67fVlwXvB#+)n%Yb zFAPhx-|J(bYFtxzZ~?MxQt6dOgrcxanWS+^D5Q)Bmm?wk(ueXUxR43J5KnSx|BA0%7EqLqOGP6V>4ul@=0H$WSdAt>c7Q zMcZJ&wvdk7`!kT#K-Q2$O*1h{6Qxz!bB{e+Lk(~Pq~niNulOQscC0|ra#`&AKqy#5 z^t$=AQSrYHMFXVDR$IM}$xA+=8Lblt9#J@yACk=K9PgZLWA3<`9HGTJrBV6R977gxm&hY2=$j{1*w$YZUh#XHY3z7*wRz^o zX>4@!%r0pC7qvI-xt$!p6b@u+$#gD?>EZ~>?*t5KQ~~bcVV3k>elx=p9Dj{HWS~pG zCRBo+hNov<(;^GrOuX(i(rR)(Q-ponu=v>)J9gbb`#K%{aSbwmsHMmgmxR;BX6utu z);l?VJL5lbkWu^Oxxt~n1W3PLu`T^N0NOQAU=Pdb%8bLTM0u1s$*DbdZ5*EwFX6>j zrpzd*oCEl)JuJuEtTsM2rPYSqCg8+@cBYS{VF1&vl3A?}Hx)P`shyg`*v!)Or|Y0e zvoaWGy%CmP(f@AK)_4hv0k|YCK>pH)LNvLp@{DBc$p4cO{`w6mC~h1ZMcqDPZb74Y zlDB_)x+|Ww94!8j<7ADW1zO5`fVy>oK|xmo+Ll*V;;u?b1F- zv^#(+puKi|xQAud#E0#VkCdP(x+ZRB7EGf`F^(UzhaNUz)rk$7LD(IyrVDnQQK%|t z(VzR@HVzGy40NjW{YH10&I}V4CCH2K@TyL=5pODC(}|1obt93RRzh{|xdSv@`?0)q zPEaD)y%-%D^oE%K9E(wP(IC8nvCY8og{AF9oGwol*Uj!^ePLP9>UEzh_MQ)JrK9D%6PF6qdD;=Y?aCH74a=!(e)u#X>YC(1Zi(`7k;N5XF0U&{RY{`v}S7f zu^1$b&=Zppb&u(iIs3)z?uLb=)x7|rM1`fq6_t=S@hby+dOVtnqsci;tm=xVoJIxl zZRwG$Cy9|f$__*7l>r>zZ&w&dm@@iP-3EVuXghrGM7FP>S~hzCvbwv%5+@HaLR<(Q ziCuB_x_EmXZ&}916S#5}SIT|Ye$aBQU%mwXbc>g_ui&zE%CH)@>wa>b5G3HFm~kg) zjy!us!*#Rm7{n6(?~4v$YNK!Cs(sr<8-JBrE#))s>!<$CNw=Hc);O~|#0UDPk{>YCz(XCM>s7Pe8bX^D^Zl=z zj-*<(BUtfEzl%A+k_DL#q#alYnku&u!5Iyt$zr~B2RB zl4h^H1Hp|JNSb{BcY2$Rt+Kg4^-l!_FnO|jVv0u$Z&~8K2ITiM)Cu+?2!5MDCXh@* z4PUb14ZzTU0m%fY4qv{-V^R;|w~kbENT$}w?0ZCN0zv?fxI1wi@Zq0N1ua8{EK+w| z#1tY#Lt<#C#Qrg0Q0G}xu0;*6mtw`IU1B|LAQ`@j@(+GT@T!c1{!XV}oCC3T<`Nd0#vpHR&x1p5tIX$qVZ`dH$Chi zhiaaN#Rv8JNUx8CksvkkB<^*=4UKfL-|Pni8h?g~yGF#P+R)DU>XO)}L81VC9SQA15}8Z=x5~a3wYy=& zD{vs?WT+EW0-d-@G#V+?kHY1*e3Z~#B!!%rl)4C^)IBO$(&TpQ!u$j}^)o1A$op8j zxt5;EkDMz%h_;q9ecT8~Je}vri7ojGo`SeyE~rS+TCNgDQad`{p!>e~$vCkF;ATbL zHmBBVptIDBD(XA&isp2{s6S+sGp?L{U%3e}=9gexYk*OhXv>h;WDisCb~z~0LT8>* zP|Y(~=k}5D_L1jsa_Y>7Rwh=J9_b>@l2%aaNx3nKB@V5QYJ|C(3-LHBkhOZ;KG|4g zqRNz0sy#N=8e!h_F*Z}g|a23fQdVB2}x-jat> zc_*$ch#Pd3;l0Qub;L}1pocwoh)uKlPb_*QTscqKwh}uZr;f{@z6RLA?}9w)6P%`+ zl#*xf6A#(+QZQv_xUF}KIOTh91fif{h_ISGmn!3dbWdAg!`IwOD~a zB-1XpWompW)%VyTrM}V|KurnvdFJKh5YI4?BCOlr<%+j5Ph<`5iC@Bp2x1edctXW$ zp!)b+$h)wQLf1_vow!>-8GpK(MO8s;mihARdr$>l`OnLW>9&AB$s(*ChUE27Zanw$ zRG8;mbGIskRCi|1FlWj6;OPxpTxzVTd!hSpN=vJy7VV#jyfkFE0m{9a)Rx=RxiT}G zyEUz9mT;18rUNdtgl;RWtSAM)LA9SG@(si;J|3T%bgG@~%Pc58JIXsXaoJv+7oM7j zrfwEnUdG?GA#{kJDB)2Ld|N^6Z{hAqFmr`99CXczf*&vM>aIYhA&cng96q=KKh&LgO0Xf};Esl^>{53iI;vdpbb#d*LZH7Yc}|4{k#U% z@Sj7FWwqhdWYhRTri!wNQg16WXtuF8_LJMxl^xRRmOt=FDBJDpb@I zVnoJWpYha6ezt}*48nut&if3C6W5;i2#H3k@?Q}ad+SfiYpPSd74~KPOjsA@W_;^>mAJ~RR zSUzYB!jR{`&<&pCB?vDAL%3#7Xj)q9y+-F|UmQlni7)@Y@+#fX@a7&2E{p2f+}UJg zTfXWG01S(6!~B4IzJuq1#w%M%eTeB=3_!Wg^{SlkfGILw8mwJ`AV>G1ios6g zgDSHh8X#fYhcat!vQ|j;+%WGw>JiG@x5uop`lB#m#dMU`2P_zzoe?k_zyO;u37$y% z$a)#D6FB0(fP{sT57?o%bsZu9Yw_9-zER)+I7#YqZ02ts7JlD_v>lmx+|SRXe92ku zOk`}LS~j5*rmBU!4@^DO%-r(qm@Gfe{|ntI9| z{c^i=YM!n@#oa%mW0+!>_c-yJ`X^2daEhk0_4XAxD@{4@hQHM=aPUmlPxCo@v^MoE z??FiSeyB|mY)1U{R!OHi^JNorF<~&h&ErL}y^X@$ zk}d3?u{l;JvN`YX&xEH7%g!e!@~BK9kox^PH`s7J^@&~PzXGbJ9^bz|d+6?jl=FQb zhT#tV-*ap6f}gNjpo3liAH>4;--rdk%KU$rmft#4aaSA&+jE+)kTRqf*1)kkU{WAv z>6tt57Ru^v&C(bX7XAP#l_YY(D*c;2&W?)9wi?LaW5m=|AI-rE2ZCok7d@~=h}(yV zcCXlg{@Ogj9*>{T33np#1mLch%I*Mkop*#3pz^MleL+W+AV9ZGq@sNtjX>&9Ke@mc z`T;Lr9S6tDi`eZP6{hyC-SxdEe--U7DojknEe-^HunRWE=IBW8b*jJys2L!f>_}gy1 znK?n;LQ%)=9{_rtH}T)E_*pJWyZWV%+wJ~t!?k88P5+{? zc{+j2e-<c`E^;_z>Z^ zPyrYYG8WQkh7MSzIk71+9^22-)s%$Je^{91B-#3qbKqkL5WBM$$!igwQ3oChy=bd| z!(?gPohG0r?FM1!^DiQ1xm*^pi}H!CZ}$`mZ&P zN*TLFC(B*QR%%?_X`~#8Gx``zDV$z-Ju(9K)BZ?b)v;O_v{ZZ?rcl zncPUW>}smkqbk}zoNUf!JqDWuqLHspn>^2m8#2zjoMioOmeVF~URKvFPCMJnMALsP zGTTUhJn9w0DHCzEre}>ywMqWh6u)s7HlAg+Z@ ztj-;qfXy;l)Rj_3dd@Hx$Xw6xYfhLN-&HD(!c+$6fg4!DitZ+zMdMNajO;q6@%bUb zf>IX*N0JO{{6^3ij-~*HJ7XOCS?)b1)??>iR?h zyPvuqRI$Wj#8=*Yg#o1^s#bs$XarNn3XDwT)C-F~BYh$n32`j$_!)IJ(?DU7i?+#U zLgCGjA?EF)x^NjZ&nT9RG2vz-?ZE8&)Io_)AtE_KE`NbboVmGTI>}GcGiKLkCw;=W zl+jn^ERr#j(xW-8CYKE$tn$$=EZT=lmQxc`Wrofy8*&n7t7xBmlBJMN!{Py=jd7($ zew@?d@*f#`qa%TsLm!R^{d|(u%7{$6wwOH%Halp;EOK-f( zBtP^8bs8){uc}V3u-*vpy62Ssk(Z*li+G#WE1q$pJMhkPPw(^K)XZpGKYA1F%Xgx-ybeRrU$!MWl%-@kf=1&X-_1r`IuFtN0#MK0H^1$YU)ns8S& z%{8!jNH31sqU9U?>PNl8QAqvp@UiMcHIEaB&hvU^mV)*5q=2Z5gQZ^}2s*oT=B)%n z5+p`+L9Zv@T+SD2#pD~S$1INtOHQ!2YU>Tg368+`qH9vfHMpAH@${Ivzz zZyD%x5nn8{T%q@&Pn61i+tZd;(GK){?$?(!lH<61m&h24n~zX8y4f4Q22izv$*5m> z?FtOu3gBBt{1FxB8Q!QBnaJRC^K9%Mp>{qtNZ|mdQ_!npCbY|z8=dEO*W8r&EQajN zCxcz+hNSySUws=+`k|9+@~dkaERKziE~df&)mi$LORKKV%&|KWnL5Tac0a!yDqC3G_v2iml;xqho%Z*^4d04ZHCn{4XLc=I z;|2miifU*lzd~1FI3-o$7jY3Dl>pRO4AvMNoxF9oPC;bu}(Ey!!bLVmAYlG5* zIHz4iM=Nb!#QR<3UqQ9Ctz|}j#7~tj(wHNSG44Nm+XzuTa}1Nx;Qay2!j1Z2v?kuA z`kIpS(roDA?}s(OC*hSNa_WDgnCWXm5E1~E|804{*0*;#;IZ z6Q=;)Sw+r{3H6-6&Y`Ghgk3HM9u-%a<2BmiAm#Upyf3m7e6rQ!2zq*sFa#PPO>`@6 zHzYDfK|Uu1RUONhbVf{CzaZe0CNx}1P+0;JZAgrJViGw)Z{*=`b;V!!i*u3v(@Dh^ zwO8(}d6-!4KdU%%PB?CMLgoQWv&Buq__xZ~9c~R3cFQAZHFnb@QXs7ECN2B);or@| zhm@m%FtY(9jeDGDeQ;;p;M;6~twy2*bI95(t=rdF;7C3u-RIrnCfVE(%5cOpEST58 zHjK~^pwtcNF&;7OSH!R(OdPlQkhQ3GCLoAM7praE`E_HUUiepP@5|t0#V0Z}Ea7lv zc$$W|Y_MU20)vK6iYjR-#W;5qzK=L!_(2e~Q96ogW`&|Ca3VA;d$uzG^Pj|CunK9o zsIz6V(Q!wn8}P_8?mO^7?>JxMMg4e`O5vMC@rE-*2u%!RuxFJ1Jw+uEerojhFk{KU zZS|-c@FcI_-lKQCtIb)vjRZdX=MLB&1KZ;%{P`9S1nBQk5WzreL% zqKBPlm24Ppe4f%c0{Em6Dr|Pxip?nb{Aba1f31z^tZPrCip{6KePR+?unbc8z+>iG zU+KvtlaZAct#*U=$--cE1D#QNLQjK8PLZSQO{J-KC6^hX#pV_ux)FOF;D1cQ8W7v8w zE6@UI$eyH>;g;h^3mpSt7Qxy?;H_cXg1RPyP?bccG(^JyAm1tMN|?aoDWxKCSf=L8 z|Nf3$C-ua~&iE8mgs@t`YD;BFj0@~sk|Rn8B9Vwc=EB?r0~fX%#E~HgvwA28vM&OC zEiAPzqjFrJ8Zb>gM*vZvM7#jguSv|0SzLR^$_Ls6o`mBco)!%020|t!{AZrP3iNBl zAm~sX%#RX)CyowZA+KIhRLT+}Mtw$41iqq9M$QFXA$1O&z@{(dOL2NmvVh%G3JV$+ z+$I)DBM>lEfW-s?i~=qIM`x@89KO#WArd@%2lp!~Es`@pPL}2jh&q^t7(@y?uRv>P z3C-&;9x%PT%~}+GuQ9Xt-S*HQZtHU_)Y})MOBr*89oqF-dES( z_aD_iXkPkIPU#Bvob2A#g&8mW5YKIiuPn1JsEO_{R$2GIlVrEatI9*_b<-qUhIZi8 zo%Ty+3+`>@2VpEYO(KmdfA%N^dK+Mo|NLFi{0WovTjKy_%sB$y3;*nvGSJ50-kVCw z!NLH{-)+_9=4lKozHK@7P3@`^hJ8M{d1?3R81xw!7}V@6%e79YF@bUpJu3W8n2Y7sbXIqx{WJBEVVpij9sBajq z%$RG;GU~>BuDJDMn;qBA?|I8Hf;?l-7zMt~3t<_-6NY>UTH5*Zb6(50aRfVict|S0 zXTqG+@c&uUo+GjS-tG+k7&A)mgHmU%g z?hEdgf*Qvk&6?X^CRU8y&Q5MWY9h?QP*`^;&N7&V5g^ZRTp6yg?)+a=x8jAv zg@JY2m2;LWN~Pm*%#`GpQew#=Kq7IsMu7ARP*mCSp|#r%Io- zFQI*$Vx(^wTJPm#nPJQJujjI!`Yy=Wzez-yd!gadP@)R+-EE;LzaF3eRCmAo(bsJO zRv)}F-;cXDn9o>bP+ZUTBlZ{&XsUFl}M`zw6h74`XsctHYiM?@Fu z+*C${YQUFk`6lU>Ed0EfuSAxW(U?Yz(_ne3NAG>y60DyiD2B#$e^B6&QhQ}koR;Wq zQ)aHNvTc|hZ|kcqxIX&q<_FdEzRbeWsR!>6_ETV|ewn_O%rzJ)e9~J6F-|0EJpfZc zw=6|l`}9_`8nLq!RGxi#umAkplR5yoAKc?=a>)TJ!b~;BG01l_FEMr++ZryfGuy=z z1vX9nc_+;n3~V8kKU3Wvjt`p0j~CdpYsizDpmj+i-t(G6`B9P!;E|K+Z6x;yfo@bx zM=|}{a=0+#wM_3+QsM526Ci|_Th8A3Zf-x{*gXhv15|~JMMioPl1c!rxM8sm+MB#y z{e!Vqe4w1H2Xa_>-0|#EL`$dCGqNM)DnDH-504`HOKN;5<((tiq0?h|LD%CRhU^)w zy-m5x-#r(CejeNt)0YtF<(kJP6J zCHS(&wh>X5&3cU1ik?Z#z+?mL-IxAWFQ817Mx~8p4G4S3yA1H~D?!7yR&UWexq!oVvgA!g2lNkBi3H>0^-x9zV){nzL} zhHM+AVg0t;+bOxyGnK%WT=BRf1!sO4rzbL<^Alp@nT8oXK2VVk?++= z`|G0mdbJE<)YGI|_4RIM9Z~QgH}I^-}BijR?*# zMC$O`b~%n}&YJyjgSeaL`|#DyyHx2;;@yFom~@>fMFc2XJycSp9wvSHq}T92$~i zcd{PHrk-=yv>E9Md$7{Mk(C5`VKSab-AfQy2BW`Q@gU{?e5)+&LO_JeqVT-f(|6EQ2e$v$F>-RosRorWPN z@QY|opTKY-94v|{)TF;%|uawH!UWOc9M<_@G z@elwJb-+j#+a;pGT%TiV+@RB``=jSJ?6>>f{e1(PIG^%RKue?OxWzolo$u9kzgp z0PMI7&Cjk(bwUM&ANO~zuqKcxJgb|Iko?k)+Bog`*%$?=X`t7HG%$hV}w+;%#Hj^pUog-u8Nv?_2476V-M>>}QrjSE9!%fGHG zS)WFP4O#>=2+&DYAF6IWuth;A{&-jC?Dc6lg)ma6 zqw7OBi_>#ViP=m0Nt2)*bkWwmY5D$C+1eX3@03`~33^1!gD}5=HI%Jx(;}rqc_>D; zd3*nPfE*2b1wKw5AFnhlX_DuTW2~l(p92)bW3;a_mV&Y2Kd)S^S##SkhxI3hsvO*> zuCwNzr06rpXh`8s0P?6SoqqvOXEW95yu~14pk)PrqrPG1e2{L48ryf9STT6Il!)zj zBiv0lt+Gyh6#r~5h8q5Rgw{mktmq+%mTd)C%^R1Xr4_Sl2 zAdZ090UYMC|1GNjI*9)+LDHk)G6D))QGXYrNw13&!(!sYVeH_^k* zdE8)X^>00M)N@oa8ucKV&Z5#61swi@gq)EaKmp; zy$YE5yigbyihIv2ay5MMUyOOJOe9bAJ4>zE{W zjJHt!;7`yt$ACIZ01S&--QDS`VllO)I^5*+Wag5&tEzhHjot*{;a(l@(4Fa;o zl1DK5flFXGovw%fS*IGZP7+z2VAF)J0X)}T_hB9#H6tD!G0oVJ0pr0YH!lya*SYhi z4PmKZ-k8C*zWn;&`;!1-d>7#H4Eg=?visv@z>&^rR3X@UDyT?kqPtm!6|8SR&#ctJ zXEw>wX#L{_hUf>dwb0j{Q@QQBD7vV!&^Z=NZ$B1&NrSjXtPDrQ4|uy~^Nj*Q)eRJ8 zHmb3jC-w^16LsM|t$Ah|YfL!lToPxmoqF54&i(#*dVkF2@}upT6U3n0Hf=|=s4376 z4BUg3peW;?VoNyKxrVu!uqyZ{)887-l^s@M|9@<~V|OON7OflGwr$(CZKq=!Z^yQ6 zvtv8y*tTt}lbe0d7tqdQ9Ol7$p!Pwh3KOPi$HJC`C?nc|2Q~ul%a9qZ?w$(fuN(G z7PC913OM;kHx-h$q~v7mg#Hx&J&FAg&5}&)ZO_~j|TJ}Y-^RS=ORezQldS- z;rL{VY8RqSJ!#K3gviRFInCUO?qk^V(VX7y+%JmFnG9iRbAc#!_GQs;D%(;G|0`qS z!8c{4*W4y~c=2L>!^J|=UR$<4G{Rlnr8ddN0gyNQi3%JWCYOOs@OA&^A+!*%Kgu!{ zPzF}YhI6vuC8aW!ENQy9jen!C$v8B7?C0X*#9TM8?Hrdp1!1^nOgR=2x@V^jWB^X_ zAj#fmsqe*X=EkXKwh(pA^1;+ia|h5k#ee1CA~wFZvIC2I9D*Zy?ycITb`yL&>SAP7 z2S{l<77e-tw@eQlXkTj=9Do)u6my#d7Oc5DEfe+UFz1+D2FJ>69?usM=BR0x+T3q0 zrKrv6-&y!FwWC-Q1m{Uswe5Q8xA*hj}DH4RPS$c_-FI$y01QVK@b5Sf>`8TGI z#qFh_crP+cEn%q|sY1HRbsb6OJCCsq0mQV&T;ije=-x`e!UfijqA2xKmHhcaG-OVZ z3EBwM#?wsrSXN&d*G`UNIdXXr5rQpFxZ%zooXa+_3Y;OE3h}!_bwPMXkLC09-NU z^)ETtj?@@S_0bhkG1N=VoKtcq=5E?At@jb8T>}$fmbowXZH5XLP1=JuTQMJoyWn;A zeuy?*jyA#Y#$BE@s1)mvU3x_==M%a~U+E>KFi&c>HJE(9TTHF7jFP*=Ja{ZxwmtEG z8>mDRGAx@XaTsdla*p~>nEca&0M5TB*9;ZZ;Y0T)u$I-#uY2!{N@!R?o7a@oMd=Fh z@YUVeZoLLU)!WaOGykZlm$@mom(nz9!*c5o%<{>I*m?er!X%E4hwRJpEf~#&Y%-p7 z+~HHYyKEC)JaWaBRSH>b*RX~pz&F5u8%YrfE}u6Z@xB>z%7c$Psd)&&2Izgv@>ME0 zQ3eviKP66`ax9vv=r&oi-7;-Z*>EnJQWPgb%4L7OPmKZms~QVvIFF7xSvu|+dKo?n z&hH<*-g@Tarn1@ncimA(DnLc094B6S6&`U5S7b4D!EQi`n{Fj!BqQK-%qKxeEkQsKV z6b=l0MDyg3jdg$gv@@gI)VE_nb2!_a^yz)aukbL3SE?xl8F^VbfPFzQdFiIGQY}ga z<3xeXP2;-vg>)^Q*=T2DQsa$1guNk{uHZn7dL^M;W4OvX96xqevk^6pbp2Zo?jxOtr5G6 zxa0(c>_ei_Iyq%0KNy!D7?(c0r0ldOS}IT zM2WH$=obX}^zHhzWSnaI|&3Z;f=-n|)WkSNk#vUjSwX#_QQQGOOES`UD(wXR$cFc1iXu(7K&?c6J8uA!ylT> zEjvEqb!;o27Pfnntx$WzUI0AZg3siyx1R&Vbh^-;_e?^{Jb`RX1 zYqp(&WGX3)E;sQaXMoUIja9-3K&7I z;QYU+E|bw$Y|>6EhcBYa4l}0Rx!rgejVB3u4hBEWggZ?cF27`xfpP zYOdrNgb@PfK*Q%?5eF|=@Py)2R)HPCf(9>snk0~nVpV3ybKKn!|=m@K{pXJ^S0KbPiDVw=i8Ox91a-uNsb zbN+w?DD5Dxt``9Y|4tkQlElj-R%;#;X$(&FY=OH5tSrMn&66J#^zH45LG$5hf=TA) z@z!Cl5+9uZn-xH1Dsg4z{pIuO_v#C8&UW_0tCBUq9j^>R!h)~|#S@kBiolp-7M|ynsV_^_2T>zQ>X#C! zfD_N&kKWVUpONr7&n(ejo@|YsB%zT_*d1^!C~Am!j{|@VMwWJm3=9tsVP%7xM=(4w zUK??i=Qt-?xO8a9vD%Ks#lZt#1B}2YXzGLS>_XFOkkgt zy%1Fe6Vg`(((PRzx(m=)Ns`zNOPI+a$e=Pc(a{m*Mf^MLNW-)QjO<5xSdCKwT1RpUc zd=iLA%|)5vAdVBC2y9*#9~(>m{&v3R3Zs*@d*nW>DgVl|v@6>=>H$W#7|d{mr+I3E z!0h?6*Rv3_LyRoPp+H`kbq@DOE<5ys|oS|%6!UqPm;);p_?jjx6rPI(!rjgh3C_N zrV|h8PM2LhPh>)pv+n2Y*T$7>pRY}Xfagpf55E1Z&7f(GR1fdL?-_+rX&ylGn$j;) znr<)2P+BY1SgMO{CLVe(F}LQt2plXJP(7w}(>Wsh4AuT!1>rq7@JNuHB zjXXm|wrky%GwxcgfSBLIi5e{@p1>_R7 zWHVgHCPSEJc_vcpJXs>u;dFpFQSSIX>_w5s#`xR$7LQ5b(``@V##1S?dW%{`qqBJl z`3#~mZ`7fy*EBCVNRrRGjFFpSchmA3#Nfitj|XF;Vr!1S9-RE~SDzoG?y1JM1uU(Z z;3NjYFWcTjR-6g*p$Yw%f4kxNa(%j2u~5QA5jj5_=dv;qVPa#A3AiYnc{@#$2u-DO93y5$f;so3CEQ+gjiDXYGJf>RI%5o6DyHx zUCzzN=siou@S9f7!J*UMX92$T-wHJ+lGqnp9-xJV}3-&7>o`QimEX-_ugb6+~r zR-86}JzVJb;7v`Lqgy~x1f(>JtBYFyx75Ap9=yY{c_Y|Jt>_hT_-2#Nj9Nv(QKAMk zi573xbzvB6?gXlg^Ol+CVnLd{YvCfU*AlG|ep;bF|@kTe39ewAYQp3T9 zX&u&&;{H~3w@wZ$M9Q_=-#D&P@|4_P_*#{FMm zejYT|`$h85`zZh==9y$_d`6q7dsQL~`BsSY{GP!99gVho3z z??|2_*PN>&Sg6*F?3c5o7@oyb6`g$I+Wg6hvA~6MHI=|!ZEi6_-=MdHR8l8;dlwW{ zwnAAX8`qkUo@n3D1h`_H6&0RVfz}5FL_x0JM)_4OCr`u9$(Y#&LM=|)#&3Po45d4} zz0%q<8nG-~Tk){#pK#6$BMrR-7)-H-ia}BSSc*m%*EPXBuU7P!KETnGvPGc)V|y-07?`Du*hfa^Y?{RAxuUk8UfM~4ux^1JkA$}{TOsqZI089GGOn9+-{bVK<-e@^KqgM>8J`f!i zUIf>mi^Ew49yt^t>qTS*15kDsAKl*$qLO!Gb@l=JSw%7)CASU{9)RFSxRWCJsems& zs+wErpM)px5F3)G5f0jdP}hGl6S)$nYyXQgGxE9;55pj z@8`o++SvceOjPG~Sx`HHnX#*C;&~sX?79wLWZ&EfC4IiSuT&m=*`e@2@cz@SIS&C0 zozx{cDXiwdz1^I>oUJ_34J=)>=3&Nt7q<&**}RV-=8FTxE$E(wu++BDVYVT@3)Ak| z88vo+f~LmgCTs9Ok?J>QPaJF3?n;eTq1z`!8#;n|8)M;X?aRteKSs``v_rN>PsS#s zf?zK|-DuYJJ=W4(RF;|cLHB2`L7D?3viy+UPWjS)i2vK}-Huj&uPe<@Dhqfr%cD4ps-y0Vw3g&<`8Bti2o*c=|9qsUP5fv&OP z2PN3xG}s%>6!JN9A_@i==`)#LekV^N=XpE-CAh!LV1J#==N6?0^dwO4^yCBbLBV+on!~g@vua z1lU#trL;A76~Tk7KgntMPSpc$x*z20eKU-OO>P&`Z@q%)gh6nf+^QK z2q24ER#we>wjgE<5;vOa0HI<^=rk|nfXlsRle@n|El~>Ri@a}UeJmCyy2IvaiU~5v z_k-0Y;=%PO^Y;8t4q&!GBDkI5t8G>;qY&kxp(OBO8qZe0z@5p6j#&^=Z>5|C@)o#+ zBeR%jC@)%Hy`w+SKKKE8uhU%_q}*+_ASbx7L_}C><3)d5CuRD5{RNPwFmiAuDBj|s zDpe-%wbZ8)ewn4Xa;$W*9Hw9Cy{B`WWt8(kO1RB9q<4lVM7#4~^vuJhq>}sX@y8oS zQXx6_y9Yrq`oj6Zt;g9K!<_}eoWP$6zIM7qq)CgPc)LuPS-|mK zvzu!)NK-R6zYTE@_iFXbGlty8rtx!@L`yh#go%lLVmzXV%W)ORC?@1!y|D?Yo>5GD z*l5Vuqo;r&d|Uuy`SZ9r_?Y|0G_ay>pd^!m^X=|Ro;_9hQKy$Q_sP=n7ES8YUGP9{ z#D7Cid`mnNO#d>hcP6|^(ejlWA0>8Qt>mmC9?Rzhu*~f$}e3syPx~Yjw_Lx6g&n@T(;MfA?X+R=HS6L(kv>4 zm--~i&aH0D(=AZRZl5d0x0lESn&ATXtsMl?PUkXML<67>ba zF=UhXR0I+HPcMw4RS$Go3Ix}gNfNahjR%ckKQwx=9gi7$jxk3q=ZlI_A3eIm6=`b@ z@6^W;gMmpO-4KBl-Z26n%4 zjIkXBq&^KqtzS^N_Gc(4c}b#7M;i4qwfY6bsTh_TUE5>V)>}D!ju6UeyRe7Scz!Ka>o`wZtZ(geB_2Sw47swQtXN63I!e2;Q;Jb zizUD=96{sQm|P?^h{Y0(k^QBqjd!YgD|a^fE^S%J^)BBMXgeBoQn51hkqB$F)f?E= zbH>>2`p0TCo;0UXHyCz@` zt?cpc0ZB(rF=j)t7=!6ULS?)(zeNy&mWoExO07hQX4`C^HP zCysc|pQafhI5x%q@ml`Xi-5lJ63nq;)D-CH8edCFO;zVk`WEk;*qGBDA;pCOLFQ`J zH}7vO`x@j{{$Gky_sh-|5liGIqi2ArWp#Mz^3!A?kAdKVOG(&l;e;;&Ifgf-oNNN2 z1kDUuDG~rJK#d-nW?)a z43{Y079tJ@APN>|P&&LC#`z5ke`rdXeTudPmg7j|9to-s`l_S69H|x^tcmP2{6vS2FR({lvYc;l%qdk!1~^GjPPHW#o1q|1kS6g}Vr|tYq8tRtSg-jPleLwzmU}`t zq3vO9!a~()M59Je+`U4eIl+fXve=UL)w7^9291|%<13BCUi4~VQ&EBbzEcWKZsZ~* z9IJnNR5mxW_?tXe&r=v(6D6oJqS;7ROseEqts2SKlot*zZ48p<0Z`)6Cm*A9jkPL} zxs<`a<}VREmvg^jmGy^xvmZ57y`E53bszIed0D5O0#v!|h*4U0J3Z5jNYIkldSM8= z|FM#E>rc%aK+WwBmg~ArO?p!YXO=W1$#a~+=2~raTXl%5MM^*y^_J1ogA@1tlT47hq-iG)krbBEv5_d*_zMAgXzo9GUwwoOJ& zJ)*M$-t?k?b}_M@CJk7UNLLHs5(FK^D$>sr#Uzx1(Ym0~!G)vbp6?sh7>ic$|?Q10>JVq`6*jPLJ%EUZK$Z zyL}^To05ZcEV5l`#)CeNR9^mFR(DKvkAbP`gey8nkGjihZ3kD?CNL<((uGI_i||=kQ`>a4QGJuPgQLe4F|Rpkr`N|_i*H|i zHWNRzuE3^K1%S3kFZ|u0#F(&{sI?0Io2F7!r#z9opA1zAze2O|rV)uo`NF^usb)W{r4bUL#$d0759?AVcyxqj-qx>vnW{M=;T z!Gjbu?@7w!zwAG@56&S!$Z?9tS(8^%#EbUE&}?|*2}o!eeJQoDjv+*zfLj*{*!)ZH zCEKVc(J>TW4cZ_l@Rt=>BV}r( z)?j-bazgfF& zT;2^<%eG!t^x#UwupVhfEV2@;3>8c=sxXCL}3ei8JH@Qxe}b4tB@~l3%>97_kJw#?-Je_$qCj5lnwj!S-C#<1^>>++$55 zn|zOaT166LCQ-3M(@^TAlmL$#6zLo6AqyDwiu|UHJrp6GR7U zfIC3WPuLd^RbAlw#YLa~{TC`884m%N9&i#T+Gl4&HV1W{CWY8k0>v21eX%zIqpFal z{=%|!fVqUV?%4Vo)mHKf0*P0*@hbf{DUn*h_nyWCrpY__%tm2l@}%CyExSic-}E@w z42S(iq4@7H!#r;u_hj(q<6G+;fRueA4}2Aekq3fFQaBP&h{uk0vfn9+M7Q4 z{5P#TuHZ=|4*r2PSI|=Uq|n&E{F~PrL&Xp>@?JayhwB5~PYp`Nw_mB|tJ1tyYOyKY z<0AIqF%z1ETvI-6Ems3U#v_m4EiWt#&l}?(ZBGZ4@8Wt5Jw7gN{0CLodjMriJ79mO zKfHuaI@IYY*Cov|q7PbF_G_M22{wVcEsrNBBEi5Ej$A9tIxOE~2c$I=G25aS4orgj zgF^crd~j@dH@MQz&mRj*rWPK3WkL>Z`ik*&FB#1VaM86sC0?gNH_C$l+_h-psJSDM zg)p>x@MO?0GLL;f11`siEXmQLs~pTGW|>?3-_8IPvfVoWf8D~({C`;cTx|a(RZ4#5 zC1maJ-5<33kSr3(Xga?|@ZmfmZtX66um#N2EnfGz#(yB*JtNHvGiNU@`2Ao^x>4)4 zuE9f7%n*AfV=U@AwX|b+0*z>lNT_jh320OI2&G*|7j}o2s{#zNIzD^N-D%p|g3ASq z*_JV3BH~pOy2?nepm+Tb{ZH<4_@2B6Y@l8ef4WKS?9Ec99vDc*9cn+5PpJ?%xHKk3Cn+E~1o=~(i*QMdO62sFSD6)P;EM5|e!*JW;<@gO@uUo5N zQkIBL*VBS5Q{#QXotoGD$9V+c_k3fZ=OGaqiJKEljke5+gow@HVYer2FjEzUZ-AHO zKQr}Tiz_65o?BAZ`4tPh2Z4GQvD)gZ$*)5#LpY00dDeg<2dg+HQzQYR#aTr`*WY~K zuS|8$b4)hTDVR(XwoVEOAOesFWqB`Fek#m7(?;aY)M@aP4~Un3GP0Y7H%GA1|FA@N zxWa`Z5j^!11=Bu<4Jlqm1>pp3OoL}!V5!>jMUGMzk8+POx^n#-Nn7L9WFg9`nY0VZ znBPF!m(RJqH{zqN@p1uW%M2J1dK?{dX!vydSe>V~pjHCM&T-GA zf->~O3cu}fS&#?eh2JUbxzsrM+D7CuL=Cci&XisrMIfFS_P~_^7d&3@g6x3 zW;2xD-_lkBT3RrS8*KUu`PLbuX2$o7EQ@NCo}@jwGBhP-6Oh=8bZf)7=fX4U3ci@KUd`JG}6-Q{q^5`t|!+FtecvVvszp800(*|6gMb5v_|b=zp8alF!y z;OBq*Oh!fPqKjOgCwom01A8cwc(QE*{O5y3V)}hS1V{ zyN!U>eXpL*3PJyH`QoCG0rUx_EQhF1NqrxX+KKyu9o8I^gP~E6T+kyqXCZ~Occ#UJ zVtGgqx2OPkqWm36S3Iv zE8PlL9|+K}%Tvd(_CP?#b}JCIrimMEJB&&+dTAwC1pTyR`YsW=fx{pz(fcqfvJ;x< zKI>1_kUU3mDW*?6rZ@+$&cjR-!eCHl(%1&bhl?7v4y7j@7SylG-Qmtfhc1)*!A4YE z{4<8i@h6MO?Dn6E5K{_>a?2{&G_5bry90e6cXV!V?%tR$6YACE;y_!4SLD2rrhi(% zIa&Sa_{Sv5&MAH}u5u^plR7nc>56qkMig+MzcZ7T?`IywIgo|X+R4sKQ?h!x5lsm| z!rVfI4P*q$ft?gsdfDnzgSQ0#^JJKnZ}tzlnWJej_Yzb*i2Ov#HuSFvQfirLSG-9Q z7?jQoy3BI7Uy8jf%JpTYKPrdf52UB#S_qz)b6iU+>$F~GSi1iYFamz9^U}!r5L6-- zW}4~@W>thTO$rS%#Z^+VvyBlC8Po)TS=Kn=nzK_TEX$zAY^Y>9AC4Okpn4Pr~Rl%jKyRqGCDkfXUr zzM*IE$~7U|HIv*Dn)*{tEcgs#9~X<1?aFNn*XSHlI9uSU)jKby<(fI(<32uU0r)pg zjVOD1cBV?uGyq%1=N+G(W{0eq$>IWo7l}Q2BmnN0Q!jp=Y`}``Ehw)Qc|3{9tugX8 zdj)WCubr^T2dP5Wsb#!scw_^RrF`92<&gwp=S=kn{+(YL`>N^T{wlu_o3yv$h+I+e zV;buq8DQ@092q_wcUlt3?v66m>%M;2uqZ%V?5`a+cqOW7x= zHn4LL`Wxq|gVSazn25LngC}HX(9RU(UgJRw+;d=f_u*$`+B}4{P$l`mh-Z8zZn1aT zAJnoeB8x@((unVD5H)12WVF%fa!=Kxm|98cME=H-WQ8jWgQNfKN`K)KBp?i#_~g$O$U2XO9Bb*(e08NeWJaF zo5YB$KvG{$x4QXQ*U%47x0#@3;9m$1&K90oJg*ja+{UoxO_M8JjBv9PXV&+f+-6EZ zFIeE&Mtl8@UkC%7lbtVY%%ytXH|i0I!h-Q&o*7VI>~lC=W9&E03xlDdS}249jb`&f z{VsqFl>ERQa9a4)k>=a5fwCg+VuCr|8Z!`BIvF(biLvUz)CN)frB<=eAD834p$gqd zT|vK5V58#5FR_?SbfuU=5L!6@TI;Uo;gZGIq7lUAD-opJC}p3$G`aMQ0yFI2ICU#G z#dWz-r40(==3s=7+UdQx(%~T)i=bF-=*uGjyk(`}43Y-SCL#d~uy6$$URrF_#Vhr5;*%xj7p#T-fR5SP=x|`oFmeSh0(vKb^Vo z=REOgH)l6xG;x;wU||IS$@5<(>K!^B%x~6m@4YfBM}-d#|NJr@u9UufIF^eIX{fr3 zF--`{os0<39{L_nl9!1MAE2@%C(l;UZ?-)n+FAqMk216`9@tt9bPMfYUDVgB(*XWo zSBG*^zJDS>>-pUvX%?X1Hzw;!3q16s4R6kFaBB@a4dic9X<%c_q(_~nZ)!>5QQ&l;u3 zo&`6fN!NGq4u2=sXmnqrL1a1Ur6y=VWs;tV1@%w|A2PYLd*q88#F-lwZ)4wRlDLRv zTz)!Q#1S;}(P3u*!8Qf&;9c8yUUZ`Iqs4pP+o}YMy#vq`H#(ZIZFV!d?p}3G)1GnH zDg5rflf_IoO&=C2ct4y6t@Jf+)jMT0bI`Vt7O9%IQ+M z>!V%5n!B7(NrU+ok!*S9#fVln0WcAMoAtTENIt%3Wp&&XzJ z5Nx0=3LBj$qb6{|d^8EAdK+bIr`TVx=Jb+GvQIEAkuy3fBUmxu4sW9fcg;O3p|@kp zdkuL5M4sT*P(-K&V_%1jSe_KnO88ACfPfGU2Xs_{;$)zW9G&h)Y9$dl7Kfn?(UZdk zPS%LDuPy)Ed)kI<=EEB)a77$`p%+XeA{{1qnJcxtrHH^JG&0e=>>NQPwol*YuTLZw zXih9xAw%>?i3P;N+LOw;1!HZPK3xy{C+Z{u(o0%JH0>j^0@2xRbAn9c|HMGLQ`7Tk zA#}p4>q=Hv8AvOucU&uinj%pTu3tXo45`i7%Y>}qeyPII>F9Vw9^-_Z!q7@ZE9qqZ zD?iAUz>iE5e>x!F(2jUrZ=q?_=j`=x66bpuwn9!;oer{jQAc{~mC+kBj663QBX*4e zXvO=oov$vd8E2lzk=W}nm1Qc-!WGcaO=J|kXNua>2QobT~K5aTDaFSQ!Zy*n!aWs1>ptFS~_I)umN>u%Q3|5V-cs& z47DI4VF&+q|Kh0M=Oc$y48iFdMJ}TT>^h0wY9v=1BT~!((Nu5Wp%I&M-0ad%jYdaF ze+3+rsZhYut4IH2Uj{)RoXcBGzuqb6X%q%R!P#4wL3gSW%@i*Fja6-|wVrX$Q=*@R z?n3dOHig_Z(@ka9DH+GOz*^nO!yLo+s2mfL^A(a*ZrYUnDioMJZY{7&H|FjK>>TLv zl}$bs$x@4ZQQ}!rPfLj|0>cL&BkJ3Ek)}znNuW&hC5jwq3k|U+1qdTP7#rwXFV}!C zIcDxp85|8njd7u{P7}R!KXm4=tkETD+jf+)j57&|@1@;SWT?6cuwnrC4N}!>n4WUqX;u}fxFHpL3 z;wKU#V>Eg&hJRFYtITi`waH`RyL-rA#r7L7fD(u3^9DKNj2 zvLloYhsEiF5aeD(8pbE)Py>);J;ik0_|$7<{>Y=@o|Bev%jl^7v20)ls8BdpRHQl! zFI&)tMXn0@Kkf@rF|1T&V-cyPT}$MXwZ_3@Rv~}P*8ef|*H;)L%ckyHG0qKyUZiE= zjALZ~U{A_}e@VikV@PiPN;umBV^=UK`JNB{=EhcZ;?4IGUAzJzEHoxI8eKkY!+Nt!i+cpbt{s~iWPajHLkew!15K>MU<`qxX} z(?(e;6B)12GAgEDvO3Z8mv2<=|hvRv>UM`GGb0w*s3K2{Z7eAZ+Yd-4Ulrf!; zyW5j3-Sqf#>*&(3JL$rQv+@d>*hJPqV%H=ifkMD87Qio`CsrN$hNY+#5??5!B%4M# zQxm2>MgYYfjY1J?>Iu1eX55Q4#|c+@-@UF;mvMA|OH|aev;cov&%jU)lEI>E?;BWnBC&V9l5 zWGzDv5yc_=z${CRjzR6fXxE{#wA3)HdDi!Xv+NaqyP3M{Kynov6^Htqc&okc>dlwl z16=%;27os`*S88iEpx9od1qYe?FU+K(sdV$rWTh%F{}MQW5OJPT(~hR(K#YTSZLIr zfI_Xd5xm9B>jB=3qrzt{ZC*0qG7jU0^Pr`@?Jm7S6vod(#r+T$knDcRd%}OX1t4-; z_-`ngw;MWkMt}Lo{_A&^w3(&4b67(&19Y?o43b2>PlK0V@u}%@u8;fI3|GD2d?KaF zoHy)R+JY2faoy1y02@x?+sRDxOqCeAQViAxpW^_7ek-eS3DU$r{;pAdH3GCfM=*6erLJd@KNf%iA1d(ErEB z;0Nb?7XnQF<52vs7{nCr*w5GCF1PL$QEPBtA%89mCu@U&ufvWyZPNHSaR+gX zCQ&@ndBPu2YSwWgb=2g~bI8v^Js>I^;OKO}Z>#0ow&@?m=^v2?xT*zwxxbxRx&Z$H zL*Bi&>(uL~lWBt;1+VV%?fgEFhXT~!$P87@->~SHMDK`qb$I*~+&3-+pf&M=O+`#Td8mD9XAbw{4KC_M{pgUO=+-EqUpyXlsGEjJAIe zDsXx&C8TDw(yl{Zs(_=K;^Y)a$MM_tKBeUJxmz$(coW(zwStY6dK97%_K20x^uA<_ ze(5s^?tP-TiN1)0J5yE)hXCr}?1tu+TG5e8RGWS(PSwQPXExE5<1b0%sl2f(>KuZb z$P}tw;jJv*WN=9B<|_Hk&jqB^St63g(d;&Q7N`5(Vs4={3JrdT&-i`lC`k9nFCy17 zj&kNv^>y*~zvcg;&3xSrzwMdnjWh+XPKa3dE(ACu1DXUP(lU~< zy$`S<*@s2_Q4qSHgF!bYn8y<7r3NGi@#jH)x&S6x7#Phaf+!-oeQo1hGoGQKs2S-6 zBR^N9XWtUNd(R=D;daytB-PZ3YBH(8tlS`cjks8tj@Y?lKV5SoK&DXK9=lg8)r-xL zV*H_n^Zk;_KAGM+*#NG(S<>p;NJb#zx07aC8G7t4K|w&AqV5U5DwMG#vm#ir=wT&C z16M+%sRX#?<4<(Ah89pd3e#s%_~A?Cwql!FGuiXxQRnil?8+*JEVnxUd_#6pO$EXv4%O1Zo3Ijt%;HQL(?3g5tB1?6oY8$LTaRJrqrO&gP>M=+ZUl^+43_7Er){DGQWhgxK2NL9#tJ zVjoLoAR76StOJlyxN$^hd`^&6V2$-HVR)fyne%Z!duVOSg(L42;Os!HuwYnUJ{aj! z{2J!nq9PnLvDuUfx~bls`R4FW~IuLx8)1jnZl1(qP2QX?g5FYY2@7_&k7Cx+p zDm6nZfdFXjm=ZahP-~8Uk3R?naSDAl%#K;)l=4|}Y3*mt4TTDwKO#rmYv{Chy|CbZ zm89J&pyw6>y1S|}z3|9{DbAzZX~257uv?XSX<}%QjltMBx39BJhC*vla*eYpC%C8y zbdKY}p~`FpWW#IfF;qx^mSzjL^m;iCHv;%fL;!LnTsQiRz@`blO-^c!%yuZ&BD0>m zguF?H7fGL!l-4b6EpL!CUsGu?DIwdlfOsvvvwA->*u!c~#^3|ejw&>8i5~Gha zZh(toWOND9>%3u&c^EZ)Sfb^QwO!6NhaDv~cMFnv7lFu2sahirO2cMUt6u@>WHA0e zh0Jv9$Z}T3T}xs|{I*nl@t|&6l_&A$z@;8D)hmBD5^>*hM_r3ZVW6(ds0r1UR1^EB z0Xird0Xhe=8mmw#C$iy$9T93oQ{B35DGzUy9hfEo$gbqRAz@WC^$e?pC zp3VtN>uzL1f%{hTzJy-!60jRclsBG~VasOc^jrvL&58&B>8(J3{bq9wWPmJu2w;4F zL}!jDT%X~p5vm(AgCu*fT)hTZ%+pdY9-?x1zEMmGFO@J$G`|2%ltQ3?eK@~REH$#) zY`a~2zeXR)FZu6tyG;sFpFrdU_Ohk+G1)UO4t=K0Z4cu>WgmvyvJ#)6z5@{@` zyzOr#d6tERGQuW#fqv4&G8&b-Cu*z@ey~GYK5XsGl+abnvPbT7eFuiMDm|@&JH|VP zf#pATMl`-tuO)@81F=L1zq9y?f3Jgh4KwzCxXrflvsGC3EJrmh@%jauX74K_v zv&wm&%9?FpZtRytijD5*fq=c@S<;OV|JOA+a}61uB{4p>hC?Qg?tCj#q25F66a?5d z&2jOqNonF0f8=c42XRLQBu~}?+5D_->xdfHb6!&K+%%WAce}r#c2}9UI#{P~VPl&L{>^gLFy8sUeTs_fVsa8dN zNbUAUexiL#8sAv$HOgC#nZ%tCVO@D6JE6H19!or`QLGi*(+nq!>FeZxu^ z4_0ufY8Xm)^JM3yd}#jiLpHLxpzaPQP~B;*22-4_Em6tU^I!VY{Y_ooxN&}|E-a^1 zil~xfSO>lH6XzCRN`QU5978Kt?rz>IOnL)uwv{QqZeDr2{p1t#397#;i$*fR#Zq=P zZ(GyB)my>dTxlXo_Onc6|5S!(I(|3V!P^tVS5@*8i)%10XKJ2KT1sSVTP77Xa}2nv zFv77&YaDEdV?t)l5jr01Se^`@@G~~dyr~wRMyv~w!BHG&SVta=1 zum>451FKJ?1^MO$v;6T&bj%j-yN?g{G-&gaOqc$KE!Ig~h-W$HN0_03rzrr7&@7it zf(fWXHSclTcPYI85Cz+kYGxcP{ruatRA)dIiJ0mJx|IQ`eE$zy=M-J%7k2xgF&ld) zY3ww%Z99!^d&jnIYsXHb#%ye(v8|K;IOpaY-?@FqShw$bo;BzEO#-o9V^&UELax6W zy~#P|W12po^m%!waUkx42Nr0B-eN$b`@8HTzm9&OA){Q)1B0KP=0!yXvFpC23P*H} zcK;Gl@{gH-63rNH)!|uJDV}*o_Z<{&>mqDG&K(`LrLfO#Hf`g^pdt)BS%*h$a@QDI z*VT^4c|0li46nEGx{UcG^=|leR&tc;png=Z@_C{!(qB-q3h;a?rffAQugT{hgRFMr zaY4qov&Y{obb>@ZbJ3w;4MPpyj!t4r7biSa6b zm@4Bn%>mkCC7xC)Yf0RJGvU!~W1R%}d1ffR(MyAb)ab0q{Sqal9Ea!Sah#wzB4A<-K{0X8L;X5%wn-2iddk^*|8>5E3Xg zD-K9x>h(#;XU@~9z5$`Dij&c$JBATg0%04S)#$4STXz#jyFy!qhHO~G;d4_>Dhizf zHl==EDiP(p&a%ZZ&;lgg5ZyOW&@NO%&`7$b5KJdX*EchZqXX#RQKbfvM(Is_`4Y@Y zPiM|;O^$AJO#^=_J?E@27l?-Le{VQk(U!>xj1w{qIeKnTaV)sR{C{Et~x(^Zy7# z>5ki3cOvCHeyI>jV%<>Ra4{?xXI5;dtN-;zoXdN`v?hJ{RnSMEH3Qt56dbqrmLtS0 zBS^6UHwTXhx?~?gQ5x7^jd#~K_xQiB5%@ovy*}pR#sQy3jKpHe-x&mm(m1{nQ9$so z&b#rrH38se$+yP>a(?UEg4sspr^Y|#pWw%AKEBI$Zkm2RD%v}=xMUu0LFxRk2SLXo z%)Y1qafsl%Z2p2dO1j@2sqXeKuW8-1p?w_8H;(GL>;lrcE zzunyI^G%}(fO}>fD_j>nl76{-e0&a$6f~iqZ{vV^s;9S?*agOQX`g77`jS5HYlB}z z_L+nG9!6l#TL+OCr`Ov#_QQ>Ur48z0rr#Au?|DlH{_o!dP-pfpS;+koDu&N*im}E$ zXIs9#0`_wa1)k2Ao;vFdt#GsvXxWPFhY355AXK|asNkgQ8?%~t&PQJC6xF?t$m&TU zH4NYoEAHCMEM4(c~fGb2g z^+#zXT7f0lnxz)mIjQa{#f+x{G58d6Y6#FrXS8WB!i$GWD^nVDW#imX-Sl|^2G>L& zY}Hd^IcgIA&;PxL;QV^>z`utY6@GF+N4C6BY_a^0!(XBr_*MVcgX`6T2YJB-8!Dc4 zLygJ%cgz}f@o$7r>Caawx8-9W{|ZN1Upn8J9jj3Z@SV|^1gn|Aegz1u+0~ zR8(PAFd)EH5}T5GoyFKrZo7$!?W-vA-x09R#Z~*$m(1z~(&2<@w}a#YtCBGp&ff{z zOoDOR9!p~v!04YaSpqhD>fs>rSJ6@gWcf+>YPX0>7$Ws7v^t;toS(ywSG24gXJ}3qcbjudv?z|@yqH`wL z#&01K(bQ}hDTC)lJ!FhoyzteYzKs>5y0<(JMfUF$BEB3I|BEMJTfJ;3e@(5k3TAoI zov-z$3UReVbr=B~X}IQ6tI82vWLH|pmiz{QkTMFW;2QIhgq74=@p;%}`xXwgQ7MzB zBL*Rq9#uIx)7YR9KbqIqXwM>KB_~HzdEmd5s6qmp&P6S$C@%iy5tGYk&b7;kv%n5Y zXO+fb!AN1U1xuIO$J{Jj)kfuyp;_Iz<=;`yF9%qpKKd(ULf=lnth9u4_Lc)Sn1B3t zTN`j6Q~=M8W#z?Kw!0Kv(SfM{+$?C+6wm1x`ePrk9RFsbc%^>j)Hh_uVcn{+D2Rt> zDw^*Ar8&QMS*dpW1iZ|&=K@7^&(F{ZGk2S0cf8k{%_!{q=L#uU4^{p3KTXPQ+YVI5lM+D zeCpuknMROdu=PFV6o6#=MiW*vO-CF{cpqj}W#fPfl7c!Y;nD(E)LUgcxO@EZleRtfQwAY;KYnIOEDi5b*Nk-X7EMsKh-bI5*#tY>dFEmr4 zz#3H2S1$h@LfigO(8r+!lSB(&Lh!rUz$eo2`A@PtxOZruvY zszE78cqtl25qS8c_NQXEX^M(|jL{PKPO}RXR zC4!rfTAft;X?>Ep$w4>uqQ92wdn4?s#s^Jc*dw19APySPrN<`y0w>zI7fDQiSefeg z?^L^XZAMA9B*iRntrCx^Q8o+*9K$fI#iEN=0o0e-(ma9^G_GscG{X~%Dm8hL-_cA!GTsSb%YVC{<08U|oA{+&GuJe9}v zR$*yR$^fZrDelLz5g4`HWk$#CKt^y6XlkZIc7Lcv)t6w z9w@pP^=Pc?7L{++kOWGzLbFKI52}?OSaS_ug;JeyUTKlCA~0kugRgt%F`uIF1-z|@ z9XVFs`!B~WYLE1;&!?!+tzh6)-h2I_K3#<<6# z7(BhdX}-;`*f>^pkGfDEa9*)#!;=q8U3B3ZI~&GeUNfPx&1Wc$Uv^|olQ!Z-SUIYt zNdmhSO0KC87xdvpxWdZvEi!Jp8v#mUS4rMV74s_rzpwz`#A zkymYg9{qjI6F+3Y`TxmI;;MuyXbgnax|6vc>7hf08Ed3;R4RkjBL$<7rhgBARUGzh z%1f$u+CX-RRDSKYs~J3JKTypS+w(%x&jBjSCH)P)*}BHH&9llb)|r~a(p2DXul^nx zPNuY!ITTrzo)*B`#?{wl@0t)F+oi{DUtPykj^VZg)POZjL34zsUpF429a|cv(P?#W1t0Y!8=z zYs;jP;P1W!)+!yhDOLQ%1-MOzcoe*to;RXQ$wkO@iKm@6HUtYWOTz9(8YF2VODOsp z7hPZujHY+4X=9b@yZpeMTr$v?o$AdSx7*~rgNtx~IVPUg;ukFmZioad z^eXBw>G#KCZVpZIIJl+ZBn(SFL)rK@?XQ4Rrqhs%hQ<`cCc>6E-hIT6k=BB$S?SLL zryGOz%o!(odQ=|HSc_Eeha%uqmuG z=df3~wtif~!KUCQ`%lADINMuaN+0RlpMB=eKO6By$xNGt>aB4X%rL`xX6WFCBGS28 zo|j!_a9!uP$YSWVRwr%(9)*q=W&MSQR#eC7GADcMF~=p-;>&Sn3B1pI`xTL`4lQ%F z9N!oBSp6TN(~zsCgA%%@3xX!JJZ-(*STu-Uf>#@}8P%(}98Q{=T-6EXj$2@N7^B_RmokyMz+cRUj)5$*zj{9vIvxTql$>CJCpL& zQ{!r=L8_T%SxB5;u9;@>J}TeF{Wx!B=iA^vLKzLA4oG-izHqPH_LF}JaS0#IIuKh) z-IMq6J0y3yLs}HfoiM=3@N2&EkgDPE&*dpM4C`%(Gy-ZsXDV!YtFz6&s4~r7INHL)A)rVp>GMYWyxQ zw(mZ)g*Ht&4f{&8sdDCKoD2=@B_ihwm!*|)-Z#Q0qifKA5bXUS16MD-N~NAH2SAex zReL$3-EMy_M4^DDGvN~M_a5ZuRIEaCgnOG~MKk<}v|F6?@W?NDL_tx^kP4lxv@kXA zXTeHZImwq3#I*N~&;%GM7Z&zL?Bn}00i+1Xx3W_u56!3@b!GDloL7{jeT;P`g}#%gd-gTm>9QdPF3kGbDPi4XEgsoZOT{4W?5 z48@9wlTA}~qTyeH#$Dq1mREKPmR#d ztsGN}j6*w`SJ~>)(C?|Y^7tj_d7h}C_+}XwU!t2@1_){FataY~D!!^%Ck5KeS(VL= zBcw2F*%-N9EokdJBT=gcZWRT=mMSMD_v(E~yKy45Jt?P?Wp@~Nzb3@&&wV(SuHH@o zA268W;ClbRO_PKD|B71dtpB6GqDFT#*1GjSzuO&Tp;k5=&KLF>e`IQO4N9wAN16S) ze{=s)W&c2NkVi7^vCpEaWT}!giY*(@gAu5^O?oZR=HYtH5Q)n8t7i|UXLlN?4g$V^ zsan|H;M9fD4$lu=x?k9Xcc`z*FNUp)&lfGAv;#nUw~8G=(@hi7Bja-qh~FGo3X=nb zy`8FAhFqG&Z(pMry^tm|mNE|BiM=tS5f?ArA?5rwyxyqs@v^7eC4ymk-kNXx-8Ogm2~*s(+IIq# zYd}EV;MhL>kEP<1kUx(-zy51k*W3JjyqO-ix2EZD&I7)UZGL1}e6_4A?rQYzwPePF z@(>Y4U3x$AM&kfx6dF*%J7}OG_?dEQX@sE9a6r&QngAe;vY-njuR$0bS9+2(I=po! zF>sShQ1e-LEJ>87_T?1i1*pAQ1MNos2;-zzNEl;rF*aX)fTf}IIIfle9F}ODUaoxD zeV>r~0!1Nj{j}?dgTSnZx>rqqTxou*(*3z;TI3ltZ4@LG_qCqQuckEgA2W5kl?ZXx z1rgXkI;pqr{+KsVEEN~v)(n%o*S%~ZK&BkRn2TE*75w%<{?X7 zHB9#5yHX>%<}SRV*-iwz17D7cwsf51uW6dU)G@IOD~%_NxkwMJV}wJc@EY>Rxd`xF zp(+gZ+Wcj@mS-xJx6qsn%nRaUFEPhR>bKSkGATG58(O1|_sujS;EE?IS6k5d?T10G z_}8!5wP#Pyxc}RZZ{}-Rz#^q#KI^fhPA~+bn^L>k>Z(=+e88kM(p7a3IeA4l5 zD(_W7!42ltHZlTfHEflZRqOTIUgUfAwWvZyxAYOOn?vApHm4TkngFVisSN zncEp%Q=wU^D%-j03(9~4k*nr=@hUd50@w_8CdMo>&K`=1+hO{~Zv;WPDA-EeBq^m< z9A4U!!??E9D(ER}rgybIF4CWXEC{rAO*Ck{)E7H+MZ6l+2@8lUs&l@JHJiY(>(8)q zZ%E8W^O-JI9!P&vU>>E{>Salrvv{lbI(b-4?vas!# z>|Ja)NSy1t_zZZd`LFQTO119q$?;(>qk9%Vx|E~!mEs~JR5D=)i#8+2FbtsVDZpR> zMof^ckN)3&8HhAu-i@90|0;r!r?AaGn0Hz+4nh5QXRTjz3LK?>Zm`j`oDy~(v4EvO zt@1(clXSnYI36x=6%Pw#X(+!DOL0w~pM{cnel8#YpteYX zlfUixe(*?2!C4N(ik22Ai;@e!u_2}O7U7FQ)c6&KM#=<`-lMt*wKaU3iZoCXgX7N# zk|lvX_gxZy05%C!Ypz(f4W+1#EL+m8TpFaWNh*R;q6`O7+S?SE*;c z5&3ntBNr#mJrE(CBx^~m#1MB7$9~U0EJ>#>+pJEu=PGIwq&7d*T?C6VULx11MZO`= z7alp+09ND83r0CX&V#9N^21R;LwtoO3+bAB>9=061R&~A3O(=68(3YEb{O>24KMq2{!yNqqHMMkyGV7ruR-ux#QV_Ob2s8fl* z<4G3&jYLLkSTpgiQs<>~g;z~!paV*5b_`<`fOKlpg+x?2P&AD&i~eH{29-q0sao!c z9+CzY=UuAy%-+MmdQf)Z@C>%$zIxQp91?0>j%d#s)4(N6Jn;{k2s8C2Bw?h&m>Rv6 zv)2S(qbd6Zuf1+O&6_@b&I)AsDNgIsnVQLc@5mZBvKg4;W?|hx;FU3JXJ3idHAmYY z;2@}9y|hS^L=hC(V4q)ZaFwS1Dt1(A!K#NHXeGBdx(cqs3BN>J%@WMPw8=WWw%L%*2-nzS}7$sZ9Fl;O2_w2rU%U;$S#XjOg)L~IPN0XI_RX<8BQZ<%RD|G$O{(fgh z3c_3jQK&v5lE+y2^U$KduNV)uz!yt%0Ok5 z)14tDiOS8fqA*@f63Ufv-wsd1vi7~|oQPP4UUdTLglQyU9pZAW^3o2I|qTNicbvJpTT_e z2%!0pT`hdNG`$Sxt>JD{UT6vie@q-6E!F`Ey^W3^`RS1WE-mo&Qz~buB5B< zt=5z(9-XJ;=vn8to6gwgt=K(Nw6!@qG{TMuCYEpq1QeoE&}d8j?QYV|3Yk>!bpx{P zSC-^URgTC^abKz+59z|p#&&52%v`=lBn!}FLtho7)t{y|V{mKzdr{nYYM$(#ct)yI+xnLK+W6oU>t zxpXSND|3ro8op?r%Gfk4AX~zDpqQj*!SAkrEMfiFf(X4H9TRB}om>t<4P$(h`|91o znaDQsYBDo)Dsv16$mY?T?z%7Tai+nVEP2ZkeRa&qM?G!#uA5u@PeU$m$vQPNw*Q+v z{j<|YfHR4Y6Z%F~om^dL+?gDJJ7Uo6^54^)+0B|g?z)F@BPU8*#bQ#GhRCKAufx`6 z$vsS7M^KY}0Y`eq9yM%D3M?v&QG#*dAiE_3ZtWQ-pcx+g2tvx`TE#_J%Rk} zB`Y+n4P9mIMI&|{`a|Bh*-(D1wdZoe2%V6CNi7UkAnoUcQ2U#jlKX0?CG+vrOCg<_ zN47)0>{-b!D#zg{7ieQMQ3mP;K(Ze?YZkH&!gnHpfqVFEmo2fHvVY5Mu(I)|b*8JS zoRs#EzCV#SUe8Wdf@wU0^>KhIS4^w1|GbrU#mWxB$A-_TZAshoe6A-z3xXkJb8sP1 z&(C@V==8xGZ~Zg9w~#KO88L#sHWaIRIV9SXBSkpZDqOlI6`MmHd))Nj&dWn+oV0U= z;kGdRv*W~RpI_S!H_Ey{`F-S4rGzw|1_<&cz zkX_0f9;E}vrOnn!xWlD(ZpH$k$zSfneY8+ZAZ+I^zvHxrSRNkvOWNQd%wE#aF&9mbVI$P6>OM7w+28se8oObUo97 z?>;FtQ%t<91$QEr*-3ZD5NDfrmL@w6*!gtbMg=-hdfL0>-cc=DdwWo`S3)?+sOC;s zK+6dt5fMC|VZmDM76d#;U%t4du;Y@8N1}JqZrD+O=#=JpwmB#Q;uxxAXULL9MPv02 zB&#dmV;_MsX(geR9nvOlE#Ff}$IBRr43`86P%PT$Qq#S^pRbGZOJmRrJL!Px)+WZq zf(P})&&Py8l_y4Lwn_dkZ*!dGZGCDnaP*l>*5#^_Z}UX%<+U}C9t}UdlwL38)~-zz z<(;3Z!?IoUoRfE`H@Pq(nsIoC8P?4425EuYllXSImG$Gc&`@=FYe@$jmmaQerdE?a z)7&Dj1(}GQzzNhQ;3!VS@C)VBu6PIayOtOrNBMT}W<7r?;n`vgadHzy7H_c*NLn0L z$lRo6u6(&aznCaI35-84u*#wMV{ry=so0YEzvtfsLTs$>7&7 zrQW-?G832TTFpT6*_!NX^r$iK+kWrJ9F@jJ+?NH8`6J9*Q8e!fP8X{^+1Z-SLir6( znb=w*uFI;88E%_PLnEJL%yu~tnvH391zA&rt`3OJY4!s$Ei0I*{Vgydpv_8=fS6~p zJd*)=#~uA=Pnzh$y@1mG;)29B%t8102@6>~8a@^*0Tj%O*;9B(9v0V+kx82rfg6@8 zCQD%XNycPP;sPQV<|Z7=DYHVn(;>|{vm#3wD}SQbVf3Hr>uIhx%;I6Y#TP83q zJ;kSXh|v;u9E%yEUx>uz9J!D(PPaVy-g=JP=KP$x@fZnck5KE)H(+rQ*0$FPL&92M zC~X$!Po{~bLlZ(t4Y`*lZEv2F*4IZ*%iF+PgR8I_5&i9Lq~A6UGR55d!%iAlK)itv z&S6Lu4lO!$B)!OePhFSh@){=X4S8Hvqxm44IdI_I4Uk~%ieu6gG zT0|O|y}mEbsW{uUP;_yPhbe60w~8l(2}3q@Zo%?mwm)H2GN)~%7)%bh*kI0@vwVtw z2rOd1A3DIZ!fA~laxyE9Wgk?EOcVoei=p>rJ2D%EW{N>n(3*x53JgKz0TU)->j8Jr zODO3|UXiN39eX;WU@tOx-@i%!Tm<}>P@>($7gbmc<;Ala<5DLU_ioP)_t~32Hg|vqe(dAH-8in62r=dYdET9I`jJ|@1 zBPwSzHNcwHOocyc`(_TPiPN_?X@F^~R4lUO6>+`J1j0WOf;fZa`-KIZc|%hX6ovdS zM}}wx15=6%6N{^NU8b#+3@0M$J7}EC$&{h6Cb0)>(n)?HHd2Q(ho#Gz>Jvxgd$aa{ zeT10pM5;gOSQ>NUljWpMUK#<}&u{B zb5iY%6k;;e_CmiwnEc9^aKbDGjJSRA~tH}-Gixu;S`hV z_o~zu>S}009SH7J|74oaKt{DWu+f+M2Y#T-&h!-EcvzWInxZtrWu(K-*&=uG5eu#YWlOnF-Vcs6FyS|mfs$I47`Od39oo* z`{oU5nfXeYs6R0Py@3c=!^Em;f!P!=RI^;I$9(4r{|{2{Z-b=1_|dPo3->5Mhuc0v zGfMOuV-&yuf$Qlo>q}MD*(kmSMYV2y);+Ox<6{e4>{0kWzTKSPj>iFC53_)Mn0~(8 z#e-Qb=R<>&j$AjOyvzr`YuhD|%I6aNQuRm6(*yLcZml=d>n$Kl1nx)MljHTqb0fzz z;Qi*u=liJ}0m?uRBUV+xuZR|0@%m#Ttgt;NO~f!L#OMAFG2J^a$F(NMNBg!_MoYF2 zOd6qiP0FgA{A0yU_=d7(Wx<>-iq(Tc4L|`@BW&#f6#b0IP8YZKC3g24Y*nf zVCTKMj=?WK^)>U)!}Yb&U2B!6Hiz+2RP7dB=0l6lHXoGfCn=aVoHh}CibGTVCY+a= zwx?k?L(f-rqM>GQQ2Ka8IrPpBW_E%Vp{T73N%1EYpCQoxTg_=kb_zPv=`Rv41;MYF zG{l$CT^fcnJIs}Up8Crtrpt54v-FU5hnJe?X$`Q)J2&^O?+KA8VrHeDMYscmR#7>~ zrdR~^cE^b5G8etJr(E6fzPpyU`8Irc?<0HtlL*<8jqc^CZF$&G_T8vG>QO3c;KdCd zu=^)}YXnG4w+BWp_Ff`)&mHS{ws*pRUnsR_n+kGm)wUUakNs(e>MWOU^rfOPVu2N8 zT|LO$ioVwU_|a7d1(U&MCwNG4u}PHHX@)smY8^J12kd%QTkpc$&Si`}QDZx3F7DyFIwW z>mj{CSYdXLWUi)1#6@C0`1~>GMx&AooNaOw+$(tE2ed4tX#6>~zi@P|6inYSGZR>5 z8*!mPyC~1O#-KLc! z`9Q{Tljy7FEG{Mm%zsh6!6!`4>JejphVdee;C)k}Vc$YlJG=i~yIXb>?HWa@Y4@Gg zSH>8KFCI&Od$uCg?tK2k$VJlJ7oPbH0S1M@`9!(dxuolLTt?iDRqLnar4wX7xde^& zW|5J^8{`sxRJo+yNI$7f=+zDKYJXS5io-}-iKr2_pGz(oJ{-;|LfP4|> zC_k_N8&CQcT-r9-|G3RRIGZ;7uXRupz@POBhy3mtw*=e*^F)}6T7XgC#EanYn520x zez>=CqOh`&k?V4fVUPsrcCBDz%T10>y@`J+ zJfGu8f65hFH#(u-M3v~}X+zrQt^$FX6{=+?2xlzEQN2X7C(9gr=ug#aXR}UAwoV?O z6NZN0j||$LNn+QYZI`Am^HMAFf`W+Vl$or4uZMuPZySoizhI`nbFkKp7Px*UefmsY zW-#q_GJ}o|#I5Pu*6bkWgTlCbtws&ZQwz#lK7;i?*asb#OIeXC>}QEPhB<)*H+;W* zo1R?P_TskuE*349nzFWj@0s^(Tn(V$?uY^=ksv6%zCSl$Nbu+w1noib>^mZhZvu4a zc6TRt9OP-=9{%RY`itzT(H#eDhM{H>(-=qf^WSX{f=!0CZ7Dp-%P^J`F!kmXu24fWnLt2%}A&M01a@tf(O82@ngMSx&D)JYDC(~cML+aS`>JuU6r)eGqrD9=7KEJ11Y zK&_qP4g5xU;+{j0In zTGc_<6>gFi6D(pQUD}d#TL?K}RT4~FEQ;lr4W$c(q*B`O!#tn)T3Fm<8Il90CQ7uJ zX-RQXW{5Eql6PZ|+_{G>UwaXzkNh3&V(g-R-BVVCA2~vYhCr61?8X|lyt9xbfT33w zGgzsEw=SzyZ!Q)nF4uO}mFe>4gEpa#gA^jUU0pZg=wNYqE)C{EdE86?bWG9GZ6wJ>uxdB}Ot zAj`H_Fq%xO(0r{lSV5$+zPe5QRaLjE1t38%(k|6oFJTAD^ER?Dl;pFFIEDngquCp; zz85G|q@X8xLYMJX1?xFFyml_z9ah=ly6+*RkuVv8ce7zaaOcodppa-nzH`H9vP zL}|?X!PCpB@dn|R1WK>DLldjjs_ToP8RGYu*{T11=lbC?y1)J#a(HsD!1Bee&^u<4 z%T6hL(X$qek-WP}EsU0MciDYF6+?ce4YPN`(9#ANu9V4!p$kMgk)waZ&8?U9Po1;7X6=ke2y7C*A8u%J$BrPvQ`GsuSr`Uod*0F$)o>!J5(< z)ExkP*=9D$4cyM4p}>JRlO8tfk$Y{*A~Ts9!EkP0?Sg2qU1}X*uk9R0EnPRW?n^r8 zI2_8JvMXgc?i<{hDRtzV9Li3>ovx%;BhuO`*b+!(EIs1DZ-)tP3kfEd2lq3GcSt{ftJm8s>{wjrX?rfZg1b`B(rQPTuWSCWG5_n&N$%3s?js^ z=URl_&_Ht&sIG7zooLo!JC(JoEe==S(DOF5DNtid<*F5^Xt)5^L$Sj-9R z`yKUOi@$m1R-soW^-hdnU{O{K@5v+Qsenb74t*InfcoYN&a0rL>tA1*9joJLAY$`a zpYi!zMqPzVX~KY484PEW2L{r>p0^(7kC}WIt;%u4#sB7ggE2ff+32y>OGQ9QQxiy2 zwc<+wSXP(*l7^B4IfqE@k2{Eo_Z5L5TD|MP2Q;2d{E=msu-7>?)fR5v5#l^wR(2qw zb_6eymGCsSY+9J)HoV5nre&noj@N1F4zB9-r`8s%l<5!1F(fXAAPo4imrnu%=CckL zqu1JUJS@!(bX6WcX^?EX>_a(qZIARKOXPc-u2+O;k!)~Y=c`)=e)^FPxIqKWg;U}j zlc8H}4~N~zDeEb#HkL<`%=GF>Vj5>G#Po)j8RM$F_0$#?E^zt8+`-GUUTA-Bh_dhxk{?pLB<6`X$qu~Fe=iGd)2BN$pJaB*=EM7ap8KagI9WTZZfX#!)Erco)u6p* z7wJ+{APO{vaQXOIADJJF=Stni>?l3(z){vbvBFwchfXUwlCqZPv2{bc*BiL0qfaN> zq6PrB%so=#7rO5i$p*mF>0Q^wW5&x$PPBN3U}ifE ze19yV{;_P7uNJp}6xn#rvPcMbo2_`#fczpX6ZqPCM5}ULol&Q)8}&WxrB@Z247;pv z5O%wBxMHaL(dgt+Dz68w%_AkNPr;Gr3CoA=tTgO)kARqY;yDOf`NXx%vP>x{{vKXxbY!lG(9mQuFX zfV;+u7^m2c?g!*aLH+rCf^dA7JovQDUb(Yt%v%3MSYgIOgWP9pcjn@u0#`tz!d-kg z@=>=!18;+=xM^*;B?k+TH!f_w$X$6e6FcCr#5RZbsB&&?p-(34Kdkk(r!84^ngTw)ieRJVVyR^bJd%DjYXOKdEusEj$Mr5V-ygetIbc+ zccQyLUIWxuankU?-x_Au$EO-hU+xw(HiZTFDiN%DZOGg6#kcqS%u5o!UJnlk zDtPrZG%TQW#V~Fi9S1oy_5kx<y$lWr$M#^vmPQcdXk) znxkVx@io)U*qsD9_n(?+#xPcppeOq~bt_I)65EuFsnp^RGd%V@_lnK=z+$~dH=GRj z11g;n-WWgA(@xJ*mIs`DTwHA_5#5J?rOO$sV>jEoEo(95*WrIIa_{O)h*KwL2}ntpDcD3)tDJgI7OE zOo>7b6e!*BTYVG9rGC0%GJPT-;%}Q^e%Din?cld%pM<$sE%ATE&3#BbHys-Q;>Rjn zMcJ6%Q$~8^)n7N!wpvFS8$*{`1LmBx`>UL_m~}F)rF_{^I}Eyr+#P{>*Umf5=yXE` zHlA7p%cVLGdxw>QOGh*|?0$*SQM6beNB&}CfwlYRwONerS;wBiEDYo3<;OQ)D72OW zzKb~@KI$E@HxuW2e3dJof8;DcCb1v)d$!I3adLpQ3T>VNVe1CdeTlV`MtAWdONsCc@;oQBr z?E5=t&!$(?wI?y@T14QJDXii0u}V`o_DXZ{Mu zG7wSK@Pp48uU93*p-3TO#e=fmTMuJ1|H=P&org8~uMmNmne9KuFnL=0FfVeeQ1M=5S^?U3y7FN6HO`3fsQb`8>*1m>TSDl&Ci6*jgukh=0Tk~dr4ZIK zebm-jjP+c;5!FOD7=`&))wA*5y;O1`Uga4QmaR9V-U$emd=l6yqAS(f(f7P8ldh1F8EQW@@2 zl?I|_zl375V~4N_<8c=I=Dby>|NKe7RQ+)_0tG0osIns_ivpQoQFs-(3xoQSVlP_E zyEuT4R1-WQNC_W)9tWv0{T_@&k2WTh=Lm(=N3AA+xhc%6b69kux0o3on+K({GidH0 zvN;LS`hRn!qi<-LD;m=zBn)8I*i6~I|@ zz+5)DEsiVvx!W5LE4-l4**0h?=sIudDr9~^;<~`zrenB5w!;)p8WG`-=MzBv$&(`I z+uH)U_lHBQmuauOY3@r_$i`BpE?TflS`9?6sWj7;dQa?8rj<`XX90EXzln(a1Z6#t z2_Tjfg0zz54ZR>}v8qvKNJ11&zUG zAR)~Irq7hrw&wsTy+Go^1`*6`_O_cnqPe;BQi{ut8Eq4Aq2_2OXxRz7n!pG@YpBY> z@P=e<-y0FKLf+e7V&v0X%4S5;Gd)-_Vs&e4`Wz^YyY+L#hO?{TgGz^nQ1Roux(iOnbUS}tAZ^Rep1sV9yZ+W|Le!{MwUhq}_ce0U0k z6J_yNeR=gQ%Yaun9T-;m>Pm#>`35ixDL9aFaalT%q<@j{!Vmah0+@cDXu7uub7(?w zNv-Sef#Ko~aZKNyj>%5T)*Wc_P21JYw>R8IpG?W%UoEWmds^)xrYFGTaxtU%yU>lU z7LKX5{;DJ~x%jcjA60XhYZP20;}5zN{0`!f-qIJB2Z610$Z-|tK^BI>ZvzlZ8xOhz#f zUMDgTiTVw9om=L{ygEbJpd+}rvo69bcUy)Gt}-w;GyGkxl4xX_EOs?mzr(yS>RqW- ziG1TWECOO_%y|_d3eYKgQ{xw57oYazspH&z7-`nEJSO0CspE)h5J=$z5HjoMp~N?SHKmPY;ugM7Y^5q>q{TP{89m z?6it=EQ!l(-qcKmFp!O! zb-%<6plSX!rvA^#Y;y8MJG?QcW$PRqcEVi#5&jQIJ}D}-QCRduU$!`|*zd^?%C~Os zHeQ%AC#lnG-N>W0E4$Z3#*-wZkfyl7@IX(A(!;-zmbK7lyNk<%N0!}@tui?jNY-JiXzzV2Livc1j@*iRlr=~t0fLjb z<6C=9V3++k#l<(O7JOT@`1Mi^oF5QAfI@u;(YAjL~F>;`VRCuUT_U!J; zQ7`3?teSj{HIgnpHS1a8=mdo2CvxOZ6cIZGuX)>v?BdKY<&ZeC&9Dk*w&71+qP}n zwtr*WHh1iq9oyQmZQHXq|95v0_u^heMMia2bY*0Abv3H;`+&I8l0mksF5v&T0|W}% zwl13~PFcit{r3Gc?JwrX|7ry=2lK<(J5=`+ui+09dkit-Y_>pKyBhZx&;;8DJeF9q zQoVM-c}vM1$Hx9!J+Bl$cy2auC}XtmB%6gIH|qwyY#G&t+4at^^p7fVYSD0VB&v3+ z%CF&^!dG(<-ckxRTEu=$U;j%Z0Z6eBU8t#d{`|DDjwv?B|Ei23nfc@sK*sh`j>;!F ziV`(1-NbdFIO5)WJ-1eiI_5uwd&M-64}D(iUYz5%oN`h7Ce_T?bW;wOU)(?!aLizc z%0*Y}EgEBy{8&V@{*(&l z>0TY?uSi4nytT#>F$6ibD+Oiw@)!$W>0Tw&Zzh2ks;G(KtXYT~!6tiF2!b*qKrK)6 z=9f)AcD8nqO4RH->q?5c4S-jU2NknJZ@0P6hLK=lAV+f+s@dIjFe@)yn2d%E&G-fzhw^S^2)FEcuxl+M=X6$ zSt_LDUrlgOvBy#qL{aEQ{NsCzhX{i(FT&X7zeo8z$|#dwd7Vvf4N%XBJ(J80MQB2) z@o(C}1i*_phq)5%zIjWS4@i^eYK>3Dm#8?qhBJsG4%WQW$j_=1njfhfP1JL7r@K=e z^t@p_hZo2#lGFu9=2rA74vKXW@cmktaN5+7u9L)Z<=WG#j&kca*0CE~`=uUq`KfYh$}Xgam>Bm zydEp{!Q#B!oCGpc-mkAfrR9M;@gs13gp|BCwFFo@zQaiw0tx9#6*^n7K@4g#NunJfwaV~!3ddpaQqFfkZ26Ek}{ zQ5!H0fSrr$zoqL;>)OR{a3+2G_YM%SKx)$UB!>?Jv2^;Zb!>I(kaqCwLVO6>HEl%M zjVBz+{{eh0iA1v7X-Uma39kW3Sw_*S^F0j^tFcekXdl9+=`dlA14*WIqOPWRT*trmnlp+UXBJx(1jy0eljXVLALG*_r`x)(I?k9F(C1X0QN;d}sg)>-}&*@|U)?Q8S1&X-`97BO~kq+8mO*5fN+4W{~Kh zHM4={I8mJ`Y?UFl>^&fqjktMe;4eY*;lPm*TO~&AXgu1H_vdM#O8pOa`G8d{8x*+( z)-j664Azt)m=l6)1$6egmm(uI6_5bZm|7nOu zKAEUFngLx#OipIz$Dnpt5KH0E6JQ3)XcvqujAOi0OYPVypiDragl_nFnEFAQ2~f#C zy`)h@yJ0_CKh&Cq<$y>DP;ZzzDz#>D;ZjJV5jGz&4m_x3(B)dgVXpa)d#Lk)lJ~wxMp& zD@8~FZX=BKvvhgIz&Lw>D-3Rq;xKCzR0z&1Nt2c%y$dF4!)Qm)P|#*(vJkk5@a9xt z93dnrmSF@Gn64ujpO7GOeV;y(V$Og`961D-3I;Zs>#k66&|cv$P}>4S#y%o^7-f7X z&}3B8WL-emD-9GeNJywYTmTT7Dx=_lT<9PWw9c=HFXaxy4Yb8lcP~a4YwV2fDW<-G zWYR&Pa*<^3@x@>Q#X6WcVycLw=ip3G7P0~pslCKxwaHz|MO9o-FiOjejFbXHPfO!~ z(Bnt}YwlIjeGayUNaU(!NFxg3e?|Jtjxl7TC)|KlEa(7o<9b$1!e9mzA6*(x6n>Qw zs2OXfzP=^WsfYot5pFm~N2_%WjLpLYO```EqC-j`Gfp^hU`i4sPV`KeVa~C#u_sD* z5bI$^!Vq-ushCiDG)5AieoaI3V8JNe_^f&imQaPLRq@AK>Hue+YX^4^rC=j+iwS|7(JIZ3gfHy#2#<%Ksl z-yhe2UzZ<071x)At($`;f_I4<|A8Hj>{_1Yf9@VHn(o;LeyzV>JOFh1p8!7J)y2_K zxfOqjhn+XIm!>hXGAYN#Qd$ZIq-9f5UchiV?d;o5@4s(@W23r?el_|Jk zUprBA$}q`fi#W!GW%K5*snNC3{mRcv8iSr!R2TMH+O<%1-UXs0(>Tq=byKuZbFiy% z4*#};{UJ=T+bQMhzrq%19!TfRQLIB$la!6qqw9WKDOa_g+O;EP%f;e(8AKF$cz_nS zH%)c3rv}W8^#E+K;u!YAHKC1kx#_AV7wTNAC`T}DaV4)k*|df2qDUQ>QWtN*mRgOC zS&AOZk4aKHyhNs`_%)8*i%Q-UHJt=zt5NLiwZ5D=_Je*hbMu?Ilv%MQ`?!sR9?K9G z3m=lYDJz=@+Q0b8doi3m(RK}VFM!eGOK5IH1i=q=jHDi2)Z#P*ecmS7>Cx5ryiXSc zbpZ7zWvkdRW#u>;p1Xy`wWeLwyGjdhYmXK`>yy8!&yYF>LMPWGE<#BM3GPu0&tUCk zlzVs847&x}RrYlV{*ixX>kd%&d;Hb!)mU2jf5T%ztJ5JGh>Tp{@iZ`U#WW)F`U&)UnTqI zvKZ$RR1uOqQnU9&4zX5;lauPLSGk7u)^HP-)wjfs#A0KHQWLE(9-3iWaf*eXo;2T% z+c%abmmbbN4gBScbn}=l0nk%sd#qKut2SpDiStY*{0JO9Uf;fwe>uQ6+9*y>O{FEk z*ack8MAkS@F8xz_#g##yIiNOGGvf}BW#%8Vyq`(@tA9BfEobIRPD=j!3~(KgJyty60J7fxn(>X*mw+P9~??v?a^zy*lB(=Nh>ZO_56qarjWI9mlAydzKU*jmw zATOOlyH0I~q3RH|b#XcFd@7^+oPJut93wdQRYeQK0LWPL+paF zcZJg@UfJ%D{<63y1bA5A4w+=Zq2C#|8{8ggO$i! z>-dN-+WcsH+V1V5%Tm+oQt*s90hjV3*C&%AXSp;uZ12dvlRgAQZT<1pap%IpF)*Dz zos!}ga4_qv6d;>VXUbE0F2uvLa4ePnNG((8DJ6M~2}o7z27DJ%|9+y2Rv|92)!iEq z55a+=vUpq(_$Y6DcR5oLVaYVSAHv?xbF=qfMi_Q#`xLdPZv5dLZLt+tdNML~O_Zy& z4O>b7S8aU9AjG#_h zdwVz1=s6I5e0^IVXiv_(un}YqvLhM;*5yBNo8Bn$_TBI_@Vos8cHl?bauSf{;KBn1 zZF>|z9A;?V_zgfI?@&#lYd}rGy}@nIBA6hcn&^I*1-P-S(-Qj&_ai-BzVg*(y)O)R zqbyK#S^5+d+{53l|GN5p%`E`axq6Mh{iPfh`Kv$7B5K;xsEH@dPA7%IL;w@>01e>N zn~~X6J}bkG7I!7n2)9HaJZGV*hLoT?jk${u-+5n3{Z;P##QaA#YI9zSMx=1!a?@>i zonRwf0Wchevg@v+PteJUhc6rmSK5aGF-q$dlKYg~t?-2X@-~Kfonncao!_wRp{L{q z{{2!sh;ed=@v}xE=N~1FR7i=J$>i`MGv5s0-oVLKP!p`Okl6$93uyRXRb5xhTn}U; zm{U;+$Aa2FC|&Q%nsa79yl!4kPV`bxtj3Dy089~YK=7haPR#2bhE+|riPxo4smy=Y1EVj#S zWly!TvN2|b=6S^7B19!jg+Dm(eKA(r8rO(KO)chV(-31JX;{`C7U7q4M(W)(c?;B8 zL`pcC$%h$~Jl(sOI~TtP0jqtMr5>y=00+5l@0-s2oA2jvK<~${fQN^`RkXyvkMCZB zkAMDI4Y<=cGNj%V9j7Uw#HPW2`68(`)0DgoN%00YW26=hoOJZQD*16o$T-7hzA6e& z3d0mo>#);@Tt;&E?C=@HoGrzIgqM+w24zH2_-EsAzW8v*BiD=WUWUC*Yms@x0Od@+ zc!utm{21-?v{mJebQkB`>?7VfBX(t!d)eLF&)XU=zr27cQ>)MhQL3vxY0paB3H5= zR)7UkI`0L?KWcAN>&j#*sDN1&0e72AeFR?(UXM$rU(KX?+DroW4pe&|RXa-u&dYgB zstVZ-1+)8J9dvoK-e|n0Y7Jv)R;2e2E35t$F9g01sw;9F^k!};Sm6$@b6Uv#>Cn3N zGnu};Z)K9w4kaY$_bzwMOMbu?n-%kCj$#ph*ejm!356q*5e`6F8>wbm06l~6kw$Iq z5NM<0y5Cp46Qu;_%XRKOmLq$zR_knc-IcO7zNHu(11uP**Zla18}|q8%HDl)lBQzb z{=3wT&2r9}3{(+VX7Vvo=h@^_=nYxNJSl zaQLR;@`g^?`qT4ccy^L+e&*Pn>U!8FGpnUQ57Zi~v0mk<`-6^c16F(tQit7D%efcv zn{dk$-(=#c?j0i4-<)_Za~787UHy$`W@h&bb(a?9?^!liFI3JN>Um*%>zF*wn0hEw z@Rzq5D*sNqK-nR4MAp&zgRUxewEXc*KXMe|T%2d-p5LoNPj_qXefoXNaMW|Tp1<>1 zs86@!0dDr;;D7$f4={Q2_!;*Kx_BkCmM_PeW|+aV#BVvpB1H#L-v2Vh*6(F`_zNSs z3y0>7k`MwBvRx%z+s9i}btiS}N_$Llp5Iu=V&hbQm@t^6))7j){N>h-i=-*JTuGgs zeC3CTQ5KCHXx(b!>sRw9-9B7iV-d3E{t1uHB{VQaMqol!0%*#hH9rUXBgrCXp|Jy^ z<$?+!e_uyYGnzr81f-A&0#T&_0T-;&;ZkyG;|s7nDe|-Wchs$P78TA0*;ZCW!4oyx zMw=VZwtaiORZ<~@H+u83u<+&HhXrg$POUG1J}W*CzD#!SV5q${GVG_+hy0VZQhJhX z=EXMabV!%+2HazTt%3LB_|9Yc%ZwR`dwhP@Tl==XOy_L9AU&izRmv%1r!z@!@7TCvwCX`+$=xF4Q|fu z60_T9nGjyBm@P1Lp2QLKsv1*iK20XS}8`NYqOd zm7CAO>_+lTB4pb0CeQ!yQcGW*1%LCCg4S9~n;dbt-V7ZLb`BPLn8Bc~a*SOhhSj8#w5jEay>tJzlzgPG;8M|}! z3;3WHL<&nG?+2!StMlhVL}P z@$aNfqa*ZQ>tATwDYWUnj4Ds_1()U-XT+Bg_3`^#>;vNorl-`xSEfBeQFYWxg{b$n ziiT+R`xe!L8lhVgQ=smJ#?O&rxvf=B8s8#%sXFP7=fgX*)QFq|G2+od!`<3%PC|(Al8wioWB|>SKPUY4DjK@*zxr%KM;Dvbe}rjlDYE z$m1R7eHFlVSX3kRY<`Kmm7I93Z6(A}yaCoG` z%wf&EH<6Hj`65X8JuS{8WMLSAsid}ikdb|*NxYVFj=Nj#Z+~n4K0_X<)iv`jg7U`3lWZzH0-DJqCg4}T3xHuaP9&R6QYOh3t2&S7;; z5Do_2mSfA?lb!6(D?j5Rc>(#}zi(5z<6QirUEah-*v1ryX6_teoC3pD0w6OVZDc>l zdxLk{Ps!|8uf%3d2D@NT+-$%f$V5T5RsMiz+e)iJAR3fY$=K$){Jy#mAV9p;V<{Q+ z`{OH}@-Biquy2MBh^9ximCi;$gtRM*{y49!;NB_!dcv@|8hlY7hy;kkt@!um84x=y zpu{zgCAvrau@0ksVV;OlndTsMzjN}Uk)1cXbNwZ$<-UOt@2`d18C&q?Jr`Z#^|D^$yScYAK;nNha{eiRd=gUaJ0p(^4#>70NP9rcUs6n*g{ zOa7J0f~OZw;@jEF@*EIPgy*l~@r3We`wPXj=W2q?ipSDrw*=eWm6-vK&*Ux3En@ha z9os-dYlP&M@Y9`>pC8Xa-uNJ#d5{Wg2adYaqDWyH&uHC%6T{UL-`?eYvuL*CIy&Hh zeq6j&v+E@;xjw}`g$NhfNnshj7*RRAb0H)AsbhkZ1bJ}ltPU_5Ct0x~-ndg#$X^75 zaX=A`+|qk^4QTS7lK85$MC8=SLDTf-a8++VyZY)CeXZcVL)MvmH(IlsIB!^)Z$ZwX zJ;wODby){qx^-;16Kk{O$gB9v)Ii!2-q0WXPO>2oKte9cPbEP25%OTYQO1ZnhQ+X5 zQd@mvqv6{_)S>!^pd{%HQRs~Yv6>0Ne2iZ$R$uaIRyG7VX!M0L*Bg63x0Y25C@Ghc|$*S#{6PSC4IQ?$zz~k0cJ#3-3?&K1P#8-Q_77{M zlFYU_F~>{C4uddbz)I5h;@_hx3y(@VxUr(4OUXfiVChNfU#JPk@(L;c2xu^7LS`%| zQ`O=w_2Lk0F&MH%N@dEz5!S*KfMRimsHnK@Qp=u9g%T+S%Ch{B@{f)c2_4=*545Df zJ`*zn#F!ab2DpJWUR6*ws*YMD_a?Ul6C@B#DVtb3B4~hJ?xr(q?_73Qo860eN z(n_%C>ddAB-8JRdA7-@*42iZBg_pHnBiZvbqPu5AAM}IuVxdo;%-9NGSclT^pBCe@ zh>V_Ab@(Ay;16ghk$OWTgJX^Qcq07{4!^V)$IQ?4C?As0Y8(^H~k27Sm(^~h3Lp- z>pEcOxkRZ(4N$<4E%7gi6096><1~QUuV-C(D!0YLNbT4!CsX9gt1UxeY;vmfwsPPnEj7Ye zXEHb;Ddpesdp8Rsewo4;Iq;DCZUYxl{*XLL7YVg&5Fp? zY<4ps?TB`KiIR9Z+ef7t@AvWF-{lbTKAQ|MCX3TU>{vnGLDBK!4d2d~Dk8N$^SQN)I8rM^gKn1H1^$g4d(5H^sMUd<%tK~XDvrS@lS2?0B7K9GB zUn@TvYrok{+B8CM5Pr2-aqxPMm2MbcY51?DT(Nhh<83mf&D}6Ij?!pFzrWH{9|m>y z-y4^vqA<;jfXKVCs0l2LX-P9FR9_pz%`0hq?z?NlYrTSlpR*b0FO=AnX*B*aiHPf@ zDMN?}f8;F;n6csf*hVe*hv-K&Tl+sO{;{!f{@wVA$r#ej1Eu}e7v9V6XS__HTb49ar?nEhR+P9e0AL5|?DcLO9qpEDvuc_MkEBs#W z?neqpjY&fwlWJSU_~P&ohlO(ylJU_2p|fH*iAnn#l4?-wTRa?=0Fx#yCSxy}QG8}N zAwKC_Z0v%j3~q~%n{)jc^&B;=)Y66{hdv8?5Gmd!%N|~o;9_N&szZ;30u&B2p9PYb zJw5qOD{@EvUVTbnM16H1;Ut2Lx> zwPmwueU)V_^+=1WO-G@Ilhx9(qM8o+SWy5QJ2s6ROo{TUnt)`1urtUEt(=}IaBm*K zo|?px8Y%s^@_6HB`#?{TNJd~c?fN8)W>QJFpOxiOHm#Tis+zVdoc386%pSCu$V3pu zqD%=?9$}A^U4}?tDnvZeu-MdlQG0|IL6ApNPeq3hbEWE+yrAymjy}fJG6tu+#7|87 zQ73v>QahvF$34>~Ydi|bfsC~kM zVCe`77f}j-`!NfEN=v*8Bh}JeB$`b6ftL_|HJ}&E!R?yL!6DJ6$EBuoA76T=!2zjh zWpk0Sx&fsQXJIPtmE$$h2nQYeDY0Z>&SC8n#vGPvsX!ir!Pm&FpyPwmujK$Hc*)x! zyb5iOt>vyJl&d3wyM@MTaiu{N@#agA(vrpvQeuz-fz^(>C17b}Mtbq zk#!kKEUi%Et!zb9DCiyk?tDLU{QG{M+=##F{kQb;v){n;<6;Hy)e=^i-}>)P0q{Bv z==!`rA3b%Z&T{@dNz)dp$(tx(SNwO|x$`B%Yq2vU#g)?(tN`%Xv{L#FK_DSlK&}wF z7`2>9Dzh$i@8FQ%`%fP<2l0gbOt}sSUI0WnOsuZGSt}H zTNdUKEnX_ncOSs?vm5FZ8o(%}PGB=Q>iLR^7$wU8EWiNp`f?L6m2mTGPuZ(1COT3b ziZp|-F)#2GQKgkIQV8`Dow3N7QW1Gj%_#Q~QI-7LO+-DlFs@>h=ij5dfd-=8?vBlR zzRi_Ae!^r$zSH5tzCAN8!&z>1nA=n-Zg-c#7=e#sRs~RfZ{L%PTS_mf%UcMCeOh8u zLda`4gjPVfTV$FTJs8JQjW2grJm<>e-J>c5Z3;ZRGu_SP%>yYKRUvfc9#tW4OLOEv zugLWMOa}QKE?VGwp8%yQb&@dFJo@YykFK&U0z&L1%AG=iC>2gEs_-fT*fDkrb9|{t zkuXs_-TYa)!(1g(t_9`34{#Thz@I}1Uf?S5gRNLb-^&Th1x-mw!^_K}2+ra~_dHhN zZNbkxj3A~Mq0Ha!5P8w%LuWo&2#IYaU){kEgnFjyr@2Nmjhf%DVso~&0A!;>Lr>e z-+GQL#$6eD(LtK5aq=@8@ZDJ5y3_td>@azH1nM_NvSQ`BFf-jUGDqf)wMz~9lXkeRs0 z#N-F2vArsA-nvC^b`yQeET+GBCMk$M*X-qZV zzyXeQ^3o<&x4Fm2z~(}vt`=-6S5oY*qEJFo`)eg0lOeqzBA(t)~5wyavk1~ zEmVA@OFu)3u>7!<*XaGv-JFuzZ3T5Z0wQ0XsxuwxEYe)m+yZaGm`8_~U}Cp34`j1^ zKv*R4k3B?6WgUC`dGr4aV1DL&67JG?E?&`L%%g)~!oL#c@saRP3A;$CZ@5WkAv7+Q z5G93E_$Yw?T#L}DvaWD2DYD7?5RqH+V!Odo&k!N}lm}~)2UABm7LqHV3QxhripIKM zeL|Hd5%QxIT)g7bY3uKu;V~wv&riawAuB7eYtGaDai^{^Sw5J2bUaTUh#0(n-3fFn zm*we99SRfS;n{1ADuAa1I-VMc!LZmms zkNLS5fVBl(Jomjy^Y*pUc&9N_@i2>hvrhDd%oNNNhgIZ$=7aK(qL9&wRq^2+-V{^S zct~ZryCslS>L=X9vyiHgmz$pxc!?#chgV=jW%=WwGJU_G9acAcCz(Ib^zF6`XgUEL zr;)ktlgS&ahM{3iW&JFEr#)_ywbFPLZe}F_uX>(oP}pf+k#x~#x*mBd$+F=c>wsWo zg@-<>H)^Bv$W0mFRON*Ds5)hsd!@TJY{P8Qau+W06IeuVCh<4Vm662SS88zFq#O+@ zGkq_kV=ddWH|A1I@*Y{L;m5}eLIObQ1NX32PuIS326l~^mU$q|s= zU4SsGfz@UzXShqJ7p`j+F0)JFD%L2;T6m=`O-WPF1(ReL9oL{WxXj;W9pti zmIb*GQ)lRb7{D=`>c6AYB<+S*(5GEpC|OZk0h<$c2b^Z@Qh5Er&*J$X&?)_+J_I})`36;olO8Jwjy*uh8^*axg zF}C4!WJ&5!1qQ3K;5tSxQ3UF5ZV>3w*S5TvW5ZMOYTwndudiCcbw?C@9NP4G&f$88 zS#+O}!Z^wOomAlo>U~Dh5o&;Qlo1Eqzn3e5y8NPb(6yS^3rHD40tcG4Cc$$hy6Vjo z6cdZDRYpLU@7E7@(5U-%3&Z%q?|#aBgMZI2Dc_&(SCbbjvkp71w>TpuSC~g-!OrhT zlam}aoBzJv&j{)acKCb!zaHNl0RJBHQ`G;(jA(qmF>}_8!AB+y-LL^_zVg2>j!yD# zHU)Yshyfo5$EBloU2vl`59sq}Tyr{t64v|^2poy-W2G!tAv$`hVIpyDiKbn#q$jD9 ze%XA+IwKGp;(aM@(2wn&Ys}L6hU?y?I93eUH-=2!2&c9c&Jy`DSnGQKZP%KzCEOyb+iMY%PjDSDgY15xE#n`x7g!PNVoUq zMj#kx!X?_SzFafVi**rr`vz!wecP~%JE?Z?k%SV98&EKA0bsd67D3S_fzF_4d1!nj zyb(AAw{L`82M8zI7TDIdaeP63_=c%DenpMDrm*8gXgvLTLf?kVStD$j3<$qNp8@!m zQ~&Y^#q)0Bi3AzUG8M>^X$@qza~uO`N3K<7w^K*j6>W!yRu>d-mC$i*G}vj?{Wlb- znN~jlv~Eb!44@elSzuiw6h6Kggpiz>|Ae=GdFj{nx;=S2ad#1`f23?P%Qc_4T<^Pa zATOEd4eQv(*Q*C|!%{Htgh(DVg=^dE)6%75~!8Es!fG zn`1?aY{q)7iR_D>=jShVGzJ?O3+CPgCrx<@G?l~vev7hrBng5_RG)psg|a$*kGlqG zF;$3{u2ghw%A*aHcKX=2LpOg0Z2wb}0lYxNw~!#y7M=z6>TIJddYXF4C>|yr5#;7S zR({Hd z4~8o!M-FeG&J5=C`sh);I9*}c6+&KEQ+Z%pkhT4`jn=_G9Et)_19;q}e!#ML5YoW5 zc*2k^*vE5m&&>~y64lKFg@e#n6sIpE@63R#ug_0un_oK*&WCARhMS=IKXbgy9B|DU z%xf2C+mwVCtT^=`?iARXC8Do9xeh$H;Sb0zKLx{v5`A>y>#!$d@;Jt>_|N#kTQ$w^ zI4nLuiBSzhn*tL#1mXyqWIop8SkF!$ILlLms7~_JGXUt- zRvWU<;)m8aa8|#=nG!@6_XpELuoVT!fKUfIfPs7i{kFq%?L5(T*mUCrwqsz3tgj|( z4%i;OaY<(LcX|z82-=TDV0-w+C7?ElwIFYJ7fT7h^%`w2k5%SPm+r(y2b=2HXVd+9 zBU=MFt%JLWIWOAC$si^Uf}mGQ055x!f?+#EPOvwFj`%!139HXh97?!trX(z!1(ulN z?GK4#P!NO8@f$bw3^l1}`#! zQAKfHD#m|@d+ZUMg7MLH4#pj*n6Sp#0g&l~}z4xjHch1%JY^BeRI;vMb&2JRa=__{M z&2w^-vwxBmRqM9k}qtOvcF;=J7GW+*L7RuW@%58+h<7yxT`Y7 zC-kuaANwOJ>ziG2vqDAFM;nWfw(Mrv*$N*MkbG7YXInB0@9cSg*XP@s41<>{8Y_|| zd?=Z5fszoSmRYu(A!$NgQfHuH<34tNNZAr9KSb^k8j-@qga8+Lv~{q4TBVM(CNKn5 zdEAN&P&@kbvJ+eNxQ_r_sZ9%Rf1o84%#PPVOO8Bcgh0BASLL#HM2K;wW>eltfs-T; zD~z1@pZpGy%tn}fmeao~qg3GK#j!3BQQHf9F`ZvgSJtpTTQ{C!$t#N_T20pmVr z~?Wvr?~N#LE#DP{%qLK*Frd;b#qO2mWitM67z zjvIpoPn^TjAzZo+3zrD55>eS8u^W#g!S<^r=3;tf7!CZA+Hayf&IviTp=7z4_u02B z=s&f6Pj-YKJ$v0uzn4`73{kfS2}gSdAw(=uRXr=i*a1REsq2uo#K(l5(HH;xz1|)V zo<8Ck>UOq!di=f~uj&kL+1CmUEB2IOuY#%RTjuz;^01$|vNghoTmQ~Dygp2p-w5<{ ze|mo1wB0xee4UR@67+U`dw&d=@*)v<;x@&9k5;)D2z2{?yd8abR$ZO6DL5GT`>T!L zu5Lk?-~-4+eP-9YdBN7ZNIy=Co4569(HwPb7E?hq^r9Ca2})Dqy;jW6m&`UC=hz3h z;^j!HEj18sy4L04Uyt71&!j60WGVY$-@wT6Kdnab$9sN`Tug;4gB!)5>q7}@bvg;m z3%5cj1s1%&+LR43)~qdmxQX`Ko=+hE;pu~c0%|>cXuzSKYofrwKGek)d#HTv7IY%m zf9Sl7lVi|~x&@kM3-P7@*~j)I;~$@*ax+Tg&joV5GjSt2-Xr)9ho#Z6ul88287HGs z>ewczFF41@`R6-Y#M-hf)3t$2s1NE2tyxDjXQiRS6F{YHg}@M&N{IoRDK`W+sv$F% z0zQGGyYnl{oF1hv!h7j-5B)?@yXqP3K%r0siw@Y7w~=>h5CU>1_V zO!>6>ebvCeKEn^cT!G46FP=LW$aek{;^(d=i1s!*c1q9+y9Oi8V!H+*KEW$Y9Dl<> z9)S7J@l`x;?z*~27~8k`9_)zfp)XZ`J;&fi=zjQ{^HH8aZ(-{}8I zFk$8T-w7tH?5ynn?|HxMYoIZz><5%{3O|FP`i0{l1S%f zPLhA`IX3~Yl#13H3vIt;_~mvlX#}OQ27YTxsb#9wzv8GX+kk}VThRb#q$aNt4@}(Q zS85b7YbG0!r67Y*d7I-RrD{PdNP+?8tr-IZm2Q7Oi|+6Q#b`^7R>$Zg8(gyZmzDsr zRH;jM0!8F;NoA+1(C9%UMuezf`{rs{*$IWR+YB~(YP-Q;Zr3$i*bCLf%oY54oUlB` z_?*xb^FEDI7pVYxOI1S;L9;fCZ47vvfast7oKV{>lOm)bb1c>2nyeC?2;Bt$Ri;{$ zwm8$&(c!4ob~Wu5Zc*2Nv3`L~tBzs!QvplX1%=m0;xxLDd9I;QrcjXB@S^AWlLeb< z@(x2t!JwQ1y+^TgdP*aMdt(D7$r9f}96^aBb&G*Snx^Q61~iZb>%}ClHee0 zEMc76{S66HilWMKQ56M)`VdC&1O+snNw7i^w7g4rIw+YpXxYP);QM|T>2^98;F>JoN4W?Pe+QRy% zO&LPdg@N5+ep8*azST%%XzG_H?c+)D&_ntfL^|m0T(9lSIVyAQ3JjK0LWJER;hG%r zr0JJ91by)S$wJK7?cjr!2}FGpD6VQ`Sku6!+-dpVtq@mgAYy+`bMN<@y6QmAYQJvDQ=LFzPzcXk1hopCfo2CqCI-bJ zyky1j@+3xn2h;<~v%nNZ6Gqhz>35LO5h6$Xt|L$OXhtHwL#cc_*Lm^I-a%svF#B5 zgiVRz^i2!WMV~G}7!@0$*nvY*1#iv}=Cwu$(O;{!B>n}A*R zDBk8s-Dbz72Dpik1(X91kYaS}xsVwqW7hJgv;m>RjuXo67j{*yl2$l}3Hv^^^?p6y zT-Ea70scAtCTNqxS{ww*3>WbKi1%J8v9TSnev03V^f$~VQSfz@Wwc=*C9}nJ{~Y=c_w8kG^lf%zN#`5!E8|2@uM2l3{zUX}_Ajwk5qzfNhp%N+ z`SVo^7uwUa8NgDZ(_4pNq`P*q z@9pr%PRI7y21*Gx>*QF`V_thWPjfNb*k#-PB2F|VBQxWckd;rV?LcmN@uSV%?^ADN z{G9;c)OsDb7pWPQ94JgoFGZ2JVcc!8iU87`Zbd;E$WkA6v;@Y^e^As#g^ft)=+`P zi8gaFy8PIYlna?Vcr>!V!QVd0E%@ZA^{WD)aMhE&*ejQ}q07)I4OUiSuK*fAh=l?`MG{YQi?j)Ea$pDm@2JtFnwL~M=ebmhduxA3pe^<>cq+9Z00sB2MGZ;=rlXjJ9Yba}vLLGDzG-|D9-W z4UH8k(@)tb^w!bju|{t`l-88QHnq?PsOB;<*^9{~`L;LSsCOrImLXYh#>Ea3rcLCY zsUC*hb7hgo6v>+j2gO4I&@<-YeYJ1(nu>oQD4{q-Q1Y;V4+{GFuNNF8DMg%2uBs?J zseQK-tzJ%%WeY9#aMHgGMj}6H3uveG7A(?Y)z&$iS6HdT_uUR{3FL2+(S)J?#s*?h zRchlU(M~BJvUd&YDM3vsy(4Y%+5gx1io!qvL1Gi(lRG~Xdtp8g=$$;sr}?h);>~$& zKTLqO^Vl22XloMfaw0L{`oY{6K62%EJ*eCZG|+^LZd_%%fDP)KyxU`g?O8WSkkyBO zM{D`|0ylQR1bGLeIAg-;Y7T!|0wz-0vq6)p?U^zZeFr%rohIs>f?h+IRX=2{US+&dUCWf{`6ZP zpvC6z)MdyA;LAfv-jZ38NanDbbW+IuO3^$|{viYxz%o7@rlLoHG@*=D8LRd@pMcX$ zSqOi>`d@UNQ*dC>m-RcgI<{@2W81cE`*zStI=1Z&JGO1xw(YNHs-|kD>i<36m-BS) zt#kL;Yp?Zt0Gd3lLreZB-mlZ2JyWJmoGo!cu2J9Yx%;W%w7F%4ygEKiE3n~)8zpuS zUZtupz3q{^A95u>R0h}CvDPgKsA1I#5e64yQrm~6bhQFN&9!~=-9$=?bj76skFT(p zzs$#2*|vr3>e9iqhLPT%e}@=d=aA=63(>4Tr-Kh-J>ga3a(&w}NOEW-1l{L$0cQ-s zId-*9%_7tZ!f3q_vo>=PBQaewRK~;Y;gNTcvk8)}%X4T20i%X{vvuC$xK#L(jKbgZ zL*LwVRu$j{F8?}(R!Q%6UB{0Ij$SQb=OPH7(HaAr&L|w@ZmFEEA#tpeY5o2&<2TRJ zl^F~d7j^qT=iWRGC)@X?HcfK6%lFx~Z801TIj6%Y0}A+)awr?^)3y!j4!^UhQI8^- z*U4+~1D{uvPCbqeLTJ3b0N}@2=v>mKv-gMR5HoNfYGxusdY%R=>uoyus3et z`&Voo)Pn9QEl@0@?<#*T7i|xl-S%dM-f-zNtGgaq}o#wl!V*vN$Z$79_ z5b9Iv!@-mBog&qBa1+h!OooZ`QC^M#?@h_jH-dF=If4&xh3^_j9E*L2q?@9$sFz@X z=se)?3IY0^yUms)LgVEFSH<`7C#Iw4Tr1wOfBSiA*G<9m9}84#>$vK_L_%+2k1iOR zCqXMJOj9e25VzMf$8#iip^0!Dw|i;H6krUO3WO67)rwVQ?>7XFDK%Typ_puul#~X# z6q|VClqP=Zm@ws#AFeE8Q*Q0qYi@*|dEG#k)(^Bx_6lZ*$#Xj71#XTti+>?@r;Rp? zH^j#e%&&4Czq^f9|4k-PaONBm`0Jj=?BlQkb;^!?d~AYilLo;XWTOTK!cjNAiVi6f z`k!P0`6+6(6|!4$Uy#RRI4H%>_6=_#FR#1hAMy)6W9jvJ^O7HtHZ8i+2;-4RzWWI;$|<7-LySiSZVc65_8I z;>ZcFmOBx@c$1X9@uS)(&4!^sHAoba-8G0PF@LY@Y^*{v?L^^2Bpj(#66KFP9yL8y zqw$~AFL%E0h+CRe>Pbp!q0cH1@Ym*CI>#@}S^Q{tD4hNM*y64HJS#W0ln2PDXleag zJ7?#&OE(@ftJ!mamSzvO8|Fjyu{$sW4E0g6R=FY5H#Gthd zzG(zkuI0$SI;fp+;%fIdog2V-aA^AJtLL31T0OIL#&dj&=w)U4hw^N2?OyBtckQgl zwUVa9L;H8F9d#)yR_~G4QvyE}=^qq1H(Ix+W%mUyddYtBYDLX@%avp|5|1pT)s@oo zoD_EiH45>xDh3Hp{gwnLRSR|3(QOk3xvXJUd@4vqF0R!hFB#TlaumRrUV+~%hszC` z*iiGiocdD-O-HkwK1~wZV`jUmhj&@LmDXh3FBF&?JcHOXBLENz*?jKpMX->lMAel?|YOnaxw+==!}be3}bVZ-`q zWj6X@GQ)X(;f7*5+jKX})|BI+WsppAqYzzfN}w;U^5At6{pro0mrYI=q#_fusETGY(+sBwTBke(=W$ z5W~x~wt5+qq>Eys>Fjsktf0y^IX;J1+)@I}w zQkYp%E?G$;dK|YsBP!LgJRn=i!3J z%r$kfi_kCw0@dfx0_BBsDZjJIT~%euN}rdoxI{@=+Fv?T?Uw=PG&& zp9eO$Pt-&6M_1^l_HKRQ3Mo;wl3tN|ltAEMeUEMF@~o8?3D>OE%TI}-K4)w_EWhl4 ziU2C@OWhggi^n7m9zEr(&U|L{*0jv_ekzpl~7+OEhzd>-wG@j5q_MFV87CS z9uq_)tt{ryZ-sDE-EkD-&OyMEqD9mec!LhM)$>%Mn{8q~w_o^o)x}yOg{bg8Aa*>s zk5jUd*)Ke)AiIb-blk*QFx;eWnwx50h{h940v6v09-?%b$f||7lLLQe6rJ9|u#SQk z;k5U41jM?4v^3UDdoy;b8~T)UCUCO&g(LOCkz1XE6xxfF66!JPw+avzr~wH<9*!O% zrL@Yw6Mot{&9M!+W8rK__#G!Z7-l+|`*(8-3kqVegDo; z%DRqb%m2@befV!f`L~1k4_flhdAozcQvCxGk5PxO>D9tUp9g{ce|Xut1TdKIvg%ez zw4i7@N^FBs*59-!pe8RA5ikr59PZ#Hv6JwY@q(^LFCn%RX|bTopqjvR5oK#b3xk4~GQH7*cD*=GWmE37={>K&YkFglrepwBhik*-`>TBGYAGFKbs{ zubj4YBd`t-A@9IZ7x3|LB=9LHD{xHJ8p!fq{1k=AOT+Y=4-3Pe1P~1J?j! zq;r1hCm)_y;TcT60LYvLqoOfBd{(6qjpr47gZtEX((qxaCW}_PlZRw}(Ycb-!@ti| zT@E`9t+~L^+6(48H^=8V3FC)$KWSH!!dKDbKxcAS?pKm;@GI+QZqD&?)2+DwFm~6C zuYdK_joa4fl6Vc&hvOPG2gAn`0;AUMK~87#RMCe?f`g2g#cP584_=(f* zyO&L9@&?fE;$M3pk>6?H%5Uu(jp=s-Y`tf+HUi~quHf%F&rOeu*9HRr zCR(%4o-W?UK5Jfd1A)U(4Un_s50J9yaj!3enN%^MWTZd9!Qx`tEbP z_4>BvdEN9%dub{25l#5|m^uaZx&8H4+!qtAKc3_`m!q{mm^?kUDE*eU~OLjC5gtA>oZ9srD| z@JV?u?;p6Y(P<06y<=h0-$OyS>h{xl_~dK+B4SMl7w#2qYdpJqXZIG-(GuwrNp;Ao z`|=wE--AEz*v!(6ht1T?(sjuBp3aXw59TamZ%4oUry_5LVi8v)o2MbT);=vg%v+me zC-ouqjzmT$1rJpRK=QJ};q)S93223v__5*0U0>3aB>4JR(iHdLY`S)^)K*n#Ve5eF z>!TG?cX69%^K!n82@ci57=yj3^0}B^UtMXE6634e{qLPXE})cr_}B=0-U+o!pFA~S z9?kry&Z|{ec=AzcW@z4c8n2>yhnm{fW+C9ME+&8dxPder4{c1bK2ywV11#*Q$89_H z;7oqM4>TyOy;6BQUFdAo%}s1Mo&`q#Im^49SKsbzT|8N9xW`Um)E{u97r<4p+@PUN z$+PcDzFRo=U7RHxeB?B3o}VIIyB(;*sfs$P6DhTeqQ}_Y-*U`;cr!ZQ*tbc_KU%)Y zmoCR^!ueTeu=QFUy|r$$B9-z-0`O!HzgR?dR9OCpNI&>|#moMONNeBQnOS%G!)3r; z!QV!xXA7qPNr07cr22WaytX49@!^(hDL7R1Ds#dtcu7qhA+P-zENNJ%=h> zm&XwLhh6La0v#HYdx*ti)UX`$H4bf66u>ZAw+=;@On>aFxWN|yD%|WJ`eb$z+?!#L z1{1{p#K$;gCwZ&lTMQ`KIL^c*dtumGU4x{b%{XRLMOxqIYw-uVbHW46-7+(jlZ#Oyd$*)eel7pQ9|x%{(J()J26!UwvDizJB{gdv z-sT|_Pqv1Kv8`tz|LRUHv3LxDG z)sVy)pBP0GN!lL`f-e`Y>Ba_KdLhVB)0Q?wdtHp&#*yd+98q4?<9tw_DWr3${cPCe zPBLg%<+o_^;S9u)VW1A_adIGxj2(N%uD?&ML$>p%%l?9yRl)9uWd1Xr(F5^k7}puz zFRF)`Ogc(9R5X57xbsrfcz!zOiltw<3XQG_L%^$h11;Kq>G=Y{DfL4p{M#;?9WafUJ1yC85dkyLJQZ5 z;}+OWIPC9#X+n-n&_zIBdH6V)BHTR@rv)3K0)m^r0a0MOf#`-xt#{ZcaJ+%8+x&{^ ze_47##bR8}p`P;+wgVp^k(DqC$z;=n(WPTG`{FnZDZ05di$AHDOq>E?h?%XE=!`4W zBn1g=&?Q6qOBY}nC-9w;2i2I~o?$@p6F4+_WpQ&L%x+-gnN0Iqn9I?H>IW;_t)qo9 z>bW(;05u{MJ4GVf%W<7O>?|+bqeq^#Dlz z6L=pY+zwy!?-M}oS>hkNZFQJI?R|0Cx_ldU4P+O1no+5KBYy&4>U>;Lsd^(iG(CFB z-CFDP7Ixk|$Rn)zqK@&@e=4^eE%9%8V^mX4^7uH;mfA~<@$s#deGCe?dYhf2^d%c? zd*RMo@Vj`6=bsjwt(8)UK(p{1JJpxT0L}wtR3f$-`7s>5UiY(0JMC!yqPNZ2jJB?D z%Dp-v;=A@B1};r*(=XRcDs#3tq|PxB?!a`X1RJlgX@{!~@iO-s1T1-cfB z94kvcqh;BpZm?dVE?S8+ii$gLpGy+@n)xaN~b>$JKU`U6I}tQ6R#(q^2D<6S&=lpAr4|KkZbDYj$6VIH?aySmBgiMNXRBo)r z@0QT0ZZx<4?N90NU~*SFrj?sU`&nTpMw_D?5A*R)NpWG>K;W|EJ=^nz+^iaaC@FSV7w@?9ACPo;{G~?Flwg$!Z_rB_SJClA zPF(ZkVLXt;BDIBvB#trT@g_YmT(>}o>LjKgF|~!W6!WoI?4{b_TjylyaHop$^gPd? z^3E7_BlKl0a2ZSerEUk0!`62Y7U=ot-AwvW`*m2mQdEL1tHfN|xMabzSaT%T42Ru^&-C zw!uwA58Zj&J>ti0r<`}HJ@44M;(>)#>|cKW#}%LM~R9f2c2*ngsVN{vMir-I=G zicdBrI`ndy(Pb~*e;M;*!=ILWM5=4dE^}kZ)`g#uJmZ$Yq{H66q8UTh7Yd z!n`)INzTPck3kRNao}$Kjs4B?^y*Nm$4!r5XqC}@GNHMl$kTSz|KXP|<3OFhx9r_| zyKNTz>N_{lqskf33ZzL-tg$r9HK^FEAXXxsPUX3M$PRX{a^}>~yfr#hoz4^o_+RL3 zO5aY{VWyp2&AtyO?(sQ61Uz|$CM~2sYJ6Dr}^Yp^R>z6P_g^Z)cO5tko%jWPf&K6*|Iq1c_0fotu8&WUhtr*qxsn~ynW}E z^BDQiTU_O-eLO+k^(J&qc!9eCov^uWSaN8k#DjUrVlNwWHEN9{i#hr-HuXCGb0_(7 zP2Xep3At+8GG_7V^D6xA^Lg|_yKhG3mES?qb*+$+tyUa&9bqxymwuch(di@%aU2;cDyuABz_5|J{h;{Qov$BK@Hoca+xr+JpGB zy}mkAj>fkkZb-@@wWNNP*{ABHwJnAD5BhKbbgS!~;shhn*p zD!#LEt9~ff{WEuK{gv=>R=}eGBO4$IE_BB-4Vp(xA!;MI1eP;hB1zYu ziwNW9yVqu{i}^YqJ`}F(27DCE%dnj+ zc*$Sr&gf0D0#u{QF9_f{_Q}4#gtPM71E#l8e`~iOVL;@EIOsCl&y5=Hhd8ndho(BzLdIp;~Jj0uW@CLK*@KvGPVT}sBU?xDa*jPQS=>Y z)jza(zlKZa6`0?vH_%Z$qeW;3ArcN6n;{;%NSEONbZ>>Ja(oXdXKC2~hW@(*d`U1ql|>PRDD6a)k}J{^GO)(j7_xTR+HIKH%wz>#@wif4xlnZ+;wXBsz1tq2T*11R+iebl$m3wV*tCc{$Hq@jsm`N}FL z5f4dH2o9j(emD!I1slNG9=+Y=!b2uW3~+Dand;_mj`@yWWBYM?u8cGTBHtM&H&p!t3DZwIM8c0RnPey{eKmpZ7&fSfnOc`n{ zCJV}>$y~<9lu8ELkDu31Rtr;}JM?QS)gihRv|*gnzb=(~!l8a*2lJ=ZE*eg^RxYT> zP6atEJBc}cUhxj9#&%fYByZD%cCSNJ5kLd7Xvxh@ItvSaIH#E@B%38#j6>`Y##;#(=)?2S*4Oh<*LDEt33omb5%BeL zWdMAZ1N7pv}Vf!0*OrL+5eu5;tF>H7SAxMWuTd3eG9#Nqn5^H)={ zgX_!kJZadf#a%2EIpMs^7z94C#*??0Ct-g%-AoG#;|KVZeP#$6-isTL^wYz=60ZOu z;Y!3n-;LWu6z+Av=Aeat;uMM3DKKFt`(r@<>Day#Jz?qmDhw+*R82>5L7_a(k z%62zj{`}@$L#wGcGVTxUyM1pu4$#1&!9CR5pvl$pgUtr!J7?Rg0v*QJ<>Q`s-Sbe> zspHJly;4`FTD6Dow0-XZUXL>$x%#>yo=i(iVh#M^#d$?)Gt`2R>>U*T+A$&X^0-0WyV zx;Kx4`jG4ryZTyj6O*v%vf^h5CSN_80a3XrnK_vBZJ_t9-2WG`cgmkWU)0u-_hgpy zs+_gidUvtk7TQF=VO6r%*r+;GTBC;P8X9^nd3GSgYyJVD=X297XN4X0IKnoqdq5Z6 zVV|I-bL?|x=6R9lX<1qHICZVemILu25aq7pf{8XX=f~LxLt*nlrw=uqmqRJA{wmF9 zkz)7P9lOXc+a?2O*Q0G*hu^;xITCBk4BA7)*G*d*>_l)EI$k+i?&Qo~W)O3dck^hj z98+zEK`$0=OS-(<0Bs)jAPdX#*8v>!U zAiwwYMj+l;7vl2Dd2q4ozAf zYjuss){F!>IjEa6H3mzJtbLvYUXRa`20MM2hY=sY;dV}P8fP9Vt?cgA3q;o`rWjv_ z6z}hP_#BolK3W|%laInm1zIfNkjhrMoi8rqvSk+b32~}cQfS{@Y-?O*LV8m^I6AKOzZ^-iwVR5mY&_5IqKMT$4QgXZx47dtyVM25RCpcO zJYE~jOxGV=A}ic~IB(=NZFWG?SBm6F4Eh=4kM-9XEO9f5efhQ$H(S_;@C8|1tz6c^ z>vAqf-8yQqKkh?akQ|t9Z3%N#r2)}+);+Jue+7WT9`2WU_pMk9^`>5nF`cR4u!m8R%=SwqclnjiV2N8UOu|a>8UO6YX$;Ac` zChnt3CBinI_8MXj{6Fp=n-5)Hl6$JP!w#HgN`oRgUQk2w2HvCYNGj0PN3`l&nGxy0 zCK$Ve{z&XUs0d&rsGVKlJ}4)5KXtwtr)g00LYM_+NBE!W7moiPV-AjY00TdDFz31oi}u8HHVntcvV-SsutKA%<>7rOcjMQwkH; zZm30`p7x{GpK(~tG5|$6>QeuRcNDvj9EWz5RKi@g^Z7oWm|pj258)gqUAsT3``>kGxQB)h~BqG5Hnhbl>2de9KWO71S<(ntLdCM zkeb>K7BL_($r2{z1TO*UInEWV1eG(jjhc)lvzGr)w8F!uM0Nq^s3MedAyL+YqE5b5 zcEsybDB>N&0))jDjPu9HoiI$aZz$0?nX-HWK&gf`cOAoaHu02rBG2HBLpqSHzt32E z73Os$NAQ8c^b4brVsqA!L^(y*>?2CJ;TL&ksr7|=yy%jo9<$@2ij_K6bHV;Hi2`p6 z;|yrTw#Ko{D0l>E6e2K0QFDiB6w7EZmX=(El`$T*0JiHBcO*@|-&nE_u@HgympkkC z*reytB!{h-l`=S3dV?D zg-$Vij63AnI6m&siopV#t%1NQ#BJD4K?OZnTS1n>`jnNzC>K3M7UW5tg@Rg)g`%cE zBvNW06o`(3=N&qRhFY*SRV76XthQ3xMl~9XT@jW2?#S^H31*oyH_&TY!scO^q4F2u ztec4q`HVzT!mP8G$FA-QEL&2K%f&f_`h=QX+WWJ2#OaZcnI>8(3Y4KN+I)tdMxh8&!x$nFs=2y zz8s9CmAsN80+mcoV!yEb*=h2ZVMYQ`S7OFjQyU%j zY9!!mNMNT&%Q-45U?fHWc)qSS_#g^1;k(Mp?)iDv-lJ9Wl6qJ_l@M{}Wyx7?qMvop z$IZ&ym2)+9OFr?qoP+a0Y;g7Vdp5!MAJiL1ezk|7bV3vEdZRdI-YWKc*lY_g{^v_B@6%$6DQLUeZnrYDq?lIudS& zA849^@W8nIePY`whgla+wOaGmgp|=_l|~UU@%>-_3ZB zZ-?XKzec|^C0^}mb&94XbS68fr2neQ_MRkkun-oJnPduu73xIyb4COdCe*s{B@6hO~;)snDVh6m@agOg?L=MIKGFy znJs2WWex7}{pQwhW8OrJcIc)o5b)~$A)J7RxEaysMcuQuUqz+&vuPs+(G_Tf;#`Kz z8Xfm1B1EwKRdvVfked>EW{G4B&EY;8xC~MW=ldi719ruh==3EKcJ9ZTT;@j4DnezR zQFaGjoQg4T-7$3X9AP@_n~GU--< zNRA0lqQkB9E-w{#`nqwo6b#@|q(xYWHHS;fU!^6ctxj(9P>F_+reH4XUCeBdwCpI? z7fMiKd0duWH%NhTd3Qo^!ar1xx2pfJ1H4ji+M&a?qDK?Sz zPgcP3#@9GrSO;-gK+sES=eyEcK!Y$~l31JZauSMyg zg$Qr$)Usx7c}LaGcYR>_2*)1t9c>?AJ&$pTNr{>2O#{9a zl)#Rm{07Yt+@USfk|ClFQvo4V^$1@O#$OF}@A{1SzZtCbm9%btGuOetE?O(cUZU3E z=?HsB^0#6cD62mZXIb11JQ!JuDYraqc4=*j8SG&v=vTm!BIacqq~ z2&e97=DH{uHi=7RnNJ?=7K6?EU83!kd)yb8AA=t+=qo#f*ju+h#DrW|96653sKM7d zEFPup6L<(Vnm48BPl_#xt_EDU0xB7mltFUb3HTgu5NXPaiz#BYn>!^zrUvYCJ!YIk z{kDAXt}ia`QllJUDC7SVIm**?> ztG;rv)90Db^z&jzA*b`}{`#U?;OqVQ!r5+=OwLZ9s!{6Ec2XTL(WBDs+F@;;S)K*oxj?C!JFc-1r7G8V`W3W$1llW_@ zV_a4UwY%{6a|xzujYq0qEB(iK_^UKsAue@|`ij5iUj1kt-|KfgO;d1J&}rIc*Un$R zjyD6I1A&s$b_5L{`C_+q%-eT9gW+LJ4JCHkQ7>VtY@b!8R)o>UJ$i+&y%+(%Pv^qT zoGpM~_v<=TK|rK#ODeB`niOsRS9IPqF*7QpK9k!aJ=*dha<}$h`DhgGhXX6_ zxUG6#U@Q6xZ;XAg)@UHR#Vt$cHsDLm=;qQy2#9;ywU(XAXRkVoa;lrs_f%x$$kX0k zqsmgpS22<)b^ETf?b`1)7)%J><%$|*~UqC~djdyEGnTL&0tiAFGic<^T}I9F=* zUtlFlwX~VDu=+&r5|6Q9&&10Y4<&-J^wH^GV)(shXMs50pEw%!`=3F6Jw2cOJyW<> z^l3CA>lHQxND7x*5^A6_Q4`MAhKof41|qB(#%0I1*^Fqb)WwJ2sJRVqtV^1M%RV9w zaRRZyYBADW6Ro{u{`l)JEyK0aW$9SRR{&*(t_~Xa_H0ES+ZYq!_yu3#dlOlEd&kc_ zvbX3%Yd1IgQPI_j2<*L=&YQ@*HM7;PD@2lIiZ_Y#TtSlm(#ijU3 zUx5mXrv|Q7eSuD{3VbE)uaEn(X_vJ8O|D30t#1??oQIWtI9=I)Yaii^4w&fqHi0a~ ztlP>maVb5K_jOl$ER(qPKfY}SU5uBb9#}&|*}}N)Wi(0mHogttO`UXxyEsAH@gW`> z@S{ot!v9$BC3tm&SC`*dI1*5pVmGPye5uxd+2bb^B(<~>BzJjDc0^*bI!i6QlyJI! zV$ayfJ2+rJGMxX(nS%sB{^$9x-2yx(&n|x|t`BE&_Ny}N#+jTch_64g%e?Bp_$i=k z#3|5>P_F!Y=uIcIHPRJU;_IO7TH9Ss-)&yD9D$C!3f_d=%Z}+l_8*R3QQLEz<6UDGvz4RAR*$QUdp zS82>~97*joe?XX_R2U5Z7JA5RK9E;CpH)MuYpL>#Yi@DYn90fp&5I%b|sJadkE`vV-+pUEo^_Cu?!O`h?|Mh4fKwiUl9*?HTm{ z%N)Arr}LQC#$euao|?ry_~{dBpN3MFsH~>90M&Qz>aJFdh7#T;95)Kih><4?Ev$vh z82QcYIz|lEfzN+8GB)C$-;};knMYrXn10w3LYN2QW)$WG@WZp{Il`1w*aoy2ZfNAT zuLXX`2xX2*zc2ps%$WyuxVy1N;SnH?npQ8OMP3#1?u8-s!x?}zx%Cvns@|>hWDUg6 zQB>Ymz?p(87YRhF{zmdI?TMZzws`P)v9l%YwN4Kyyby@RWTKXi0C7?8!tWF=9pj+-Y2}uBs$mgj z2z+WICl1{;E-YnjYlstlaJ@5RO7ZNtRf^$n7IO?jkT)T*$ift{;uQI$4}~)@ka*%a zlA_@Mek(*#KkIg!#XRvR&G$S!e>ZDY@AV@yifFrp)&=Pl--1}kAR_*XF-!1M~oVy;lGL~TQV(Ppy zim$mcJYZZ+X@A?I1oT^&31;q*Plm8X#S-t3eW&cj-9?B^MbwambRdBz2!QVy=n+Pf zrJp0`Z^J^hh-hXQKEC-5qUCGMrwR|7Mu`xT2#C?$sDx!Q%K2g`3K1bS-&22v*5(Wj zK+S(=|JMJt>(<^6l^7ieS<0kJ07X(>T91KjX29qaMO@Xgc=IEywnA>7KTObq{9Bx( zd5sl#=EN{GS#GQ1Fp?82HoBGitqMYTnsHv4A9F@k;O0ksh_{U*9^jV*FS7THRB`);s*0i zW|Y&#jj|^957!ozK~2LThhdyM1wkxuS|KszDEs_-Y>Vc)$n>*Sloopy+Ov8Tt3dW7 zl9*^(``2)q(o zZID7=!hCM{hm&qU`U?{ZECkF%ygVrpe5uJE+Hl~id3>{FQ~YRTZvY;)29g_;etPWX zzzPv7G;9_mAvsL!Fb+4vM93ab2G#FY@D_d=3BkohOZvTzQknV`D~?3>3pHcXeesKe zmtGmXrMCWRs-)G>`t{*e9hGyp$cQKRaIiu`I2 zCWV8);eOdm5g=;+`aH<#`n-P_6Zm{+66hKNQs$lvx;`J9fUEJX_ve3WIzRkhE_~eM zF>Xp2f%lKwEvb^iuFs2Gfvq~qU%znZD)t(^-uvA2y_2SixH^s^)0KZ6$u|9XE>Dsv3iH&6gxDmx0lI=8Cigw4((=G5jmorTin# zE8xDZ2`h4pRV3w@+%^=5%pMi<0+SI-xU{20x_2&40VZU7WehAC?NvM@iEpDF}2DqB?@o%2Qhsh|42rPQ+2(^e2n8!jvP^eiZq8$^#^d|(#lBKJd zfLk9yv&qOE4u}~)n&|aRkp?DJ645He) zkM_2i_65kT$NO6~4bt|g@(a3?%+5t%=Gn4PVcc6A>@1&(&phlXNZqs(dKW7_IVX_<; zYqN87W>p986$xUtUt2D5+UsQ0m}Mp^C`(m5iYy9{<~oplD+>0c1UaE+tvaMZK@AUm zXuPT!fS=~cIUC3H+;4=Opvd@1Lp6dn>!YB{+z+94@Tmr}JW(LWl9!1>jpRJW21&)9zZG4|j5{n4Y0Q}_I8u5xik zbMhU)T#gD~{9e{kO`9oZLUNhpyiy>3upL*9(;T6+0VzRLtyy6&irP|F(ck-$EJje- zwxCE!VRN2Db<3)8J};>BE31>Ud`$esjsYzRZYiqUwP4M|L7Tm29rpx^EQNez7E&jv zf^BL*H*c_vrlf&rhckt+X`i_Uh^&80h2KsS@7eeQnuc{5n z;uXW&;~hnwMLdEWZ;I_n(R=pI1BWU)YPsNm^ayoIfrSGpv2mcjnBDo0MoX7t5)xH_ zaiQ?0a&kCl;9#Al@KB!5BgJJ7t_75Ivo}m5^^izup-?Rm2V8V%f?QJBhuj`a3a&ek zMr|EN9WOY03`;}haG`xfDDC4M+yx4u1}nf*s&NI83pGZ@9^)W2DQQKdT)NU+autRQ z-GeGVV%hUcM|HE`7`}#hnh7)=n+^g%6+C+@#qY>cThM=|kbQ7(UP9x`Cl>Y(Ms@*7 z$`BkzmPj;z8j~(X_1H(9wvXUi4cnK_H?wfh-(4fNWk#t}xyJ6SJ3W05dWZik5{-SW5YsMmKu;P!M-^5m_ zBA^HXYNUo~ta%gQe_sR8k7);i-9-cxCQ|U!g4_#mP;)q;OyZRYe2(Ln_Jyen9uyTR z7BJHORMxzmB<+P~6e0;Wzdz6(4aMd#kQ4FMY1(Qw!U{Id3fgT`)9H(#PpHKrZ1?Zl*sc<*e9RbiES zhXVBzhq&*)kQsIO+X@~zpan7wKK(?`ty6xuh_3OAc08GmHbYTru)2hph4hz6YM!X62sdutk?r;Kuy1(XPO~cRp>1khol!dS1WNo0fRO2)rs)MgExXMM z3Zf6IJM%|(01u{3mZ*dyErKP}KY5}>Gt0A1g{FP_BgrDzs(rdqESeidU7o09aLxu*aVDzz4gsRL- zw;YL;c46!4D6^dzklI-5O~bb9^qV~=uQGjCaqK(^-)!!}Uf2pwg)D~4-#-?;OqHu4u20L}K(rP{JB*#MEKfh^qE zoZK2!6?d3%$R4WWpscJF{f$*yyO%olRO>QEIPYJZ-GRbPsKfv0V&gcBC_A5jgG$rO z`XCK4o&&PJX~uMHl~k+_A%~#!j{gLeC9=&9!?GpzgWZ!!9JDs@OlPoxSLU^cUjeBK zo_%?ebMoR=02-6$Yv`6^!~8`>%}aaakZ0oWHHNZI7eM&Uth!Bi>T&xkJ2#$`+_M=` zp=9PT&-)Y`qolwyBpUr6N9_pbR&v%)d?wpE{1NXid3{*NIm*U!12JH>vdrk${EHfc zkxKm$Ru=x<-^?sQ)HAtox@}$By`xuZI;~d?Z+6B?G?ullJo_}504rP=@ zLD1p6D_jR-Ni22}_&YM)R3i9w_q5!kP|hJZ@n08=tkK@3wy7oC25A&Z-lfpd#~;Le zi*~Ku<&gO0IQMjByFTu5N3`!Hg|g|h+*3kWMS!fY%GY=3mdy+m)}Xodsixm@0a+GR z2^Jw+88F}rJ=tqPVLE|$>neD;>7eb9Lgx1!S%QjBF2VbSvWT?SQ65CYD-tlwqTj_O zSxl~sK&4z1*{-SH{0jvI*?;*X#E&yyUnb!!F#OlY|CTtgRsREynHP?^Jwuw`fKodvNv1Fs33F8dO!aV+4rl0KhCfO5h4SUS{qxw(_4R0UZ*g9-E*Vz%e zknkJ!a<->pbz)ZWbp^wazF?O;pJ4b30PThbOdE!*pTgsrv3n|ZK$u` z?6i%|gxU1O1xRDD%{Q0ETYunQ{jgN4GGjLpQ+A5&NEK2w|U9D@1#cUXlWqrAQ$JdYJE|Rrr zxz|`8`_k^q9Hw`ljN2{ z=4`O)TTXp2Vl8YXhR0!be>LZe<03s6NIwejE!xXViJMK+PHD58bK~N5<0`A9K@81w z;nL(nxMjsdoESqHE2M>%01!jdc>_`X8cGrM`G%|`sM2)5xj8srfmWVoMr{!kaOtgn=6mfwUHGO^}9!V|^nkgFW z@6lx)sLUackOhyq=1PH|*5Pi{=3@~tMtNJ-VRrxqeVP8}5dNow8EA(R<;^35_r{-?SOyVWbP5?p8%|zKw{hxt&`U-h~67BsoOYgr;>*^9aJin~}5i}+$ zU24fIiQ#N^munNe_M(WRNvi}lOxJy`Cmk4{)7;gVsWd=y=T}IqaMjf@Ii=oQ=$Nm7 z%zzwSm4UFK)L4mQ(Bp-?@hq=xE^ImF_!VThpIQuv9vFF3WxZ7@nSOaY)1PeP?x#fzuFXma&K7ap1%~@kYx;m! zCP!f(sZT$t&!%JL5?1>~ieTYE+P+=Fk!r$~i!>}f(%0hexGFSTws+OL7noPy6&}yLM7oic4rCbf&Vb$SB z5F%G^Ez7J3UB)}uEXklMBGr3unJo5Y<*L7?*LFAwbz57eMwxag6fOiNH=9^~*>+gA z{^@cRw7upZ*7U={dv?U!g{-l3z;O6??$X~1c+JYy+Vp)L$Xp+r^l5Y0Ulfe_z_QR$ zjkXYHqiRJcMva)+jHQz)I2|OR=snaB+qr2iHF%+BN?5%F(^_;|CKMHj**Rpkkw{kE zpMQEH>o>Y;7Lf$sbnDc(V&GL>CbQs6PMO}uc=`Q%liJPq@8zhut=BE=mUrUwY}Rs%zIa{d##n0KTXn48Fh7<^jYUI_Wn0vILgLP>zusVGHV`99)IZ zZ)HSFY=bJtOdP&GL}?XUX}f`})*p{#4799aYLp%&Fs}zUdJBU%lRhn4L8%*Y|K&*X zH0dldr)|djz%9J`s)m6fI#PQvA^gYeL2Ikk@|ofA!2x&Cvj=Ud z>CB}su`P1)&sL7?XW@-eD~hMcUibDU6&mmd`rcsBdO6VXXm71_0V}dou~bD%n+6Ry z^V-PV3>`K&rY2^%P0AAFtB(RX=)e*8Ns;DBwAN`rQz?w&gyi4GSYE@)Q{K4g=q7f; znzG5WV5rVcr_MI7iPA>iyZN?I$6%SSauF*D+_X{Lv{N#*=J}sqzR;UACrO^)4w#mm z@pos(yiTBFm?I2F12}V69oNrSk8OonSh(LhskL zG?aubZcaP$sSivfefS{wM*X+ipU#su8NKuhkLFfF?>!5}41jF)a^Jb9ZQxtA`$npb zciGw|_D$ll3TJyDjHf~Uk70HhPdgjb)44n0gax9pz@ds(LZ|e#1y{;Wb`!OO_RYwq zz09pM>G8B8{~96xLdQ15{!EZk!m?u_j!-8N- z558NNtWfX_ z#`d({oE~m(rn|ElwnVtw9)G{REckQ&h_$0`!y) z8g(NFBq9QRWS1m3vC-inUh2ZT!f2#weWBWr3=W7*BLMphX|hy^wgHuced$PH8Ywni zm^K5o!%F7JT07~IX^6HUg#&xs$c+H0+V2qUaZ-nkppo=iQd^qvj%~(Em$s4g6;fNK z@Qi0{jnwcC;LByx8e>L^iK~f!iaYCJG9z$*(pXK<4zEC=R zrmPdEs9XD5*ZsAQldR4gdqpg4B8N1*Xv9O-n4Y9AAZ#L+w3!>D^=tTuTbMLwY$=(; z0bA^}LiqZ%=&q_dDQ6^FYoKC1L*do*W*c=E1JGKEs*`M?03@}JN5-^vBD^wOPn-2# zG}CwIJ~JrRVK9%E#Ko$OHl+?X0B#W+&D*Swu)VnSu zTiJw9W$5cAb@;b2(%8C?0y-9&aQQLP#JZ3|ItQA1eGaKFQWx_Bcq4RkPN-B9FMS5^ z9IcXy7}0N^7SA6m{%@Rj9Nhm3M)8T8jr|{9I|6`(o&7&M?J_kdt2UcZHx6j7p|H3C za+J^1ZO270ZLA&Cn)!c+7!1v3o6iuOodk8loNyb@G4rE&G615eghp_aZRl^Yb{h@L zm6Cb-#18Y?7LxRpE|aypO8HHPDXkyOOSijZ*%=F{ijjVAk}KJhcwYtx$bjH!=B;AK zLbsSEa=e^23g;dx0bZhuEjKAjfei&k$wBCyPj8^^hmtTkMjuZ(B;9!AA7NY1u>%xh zB*qR-YV-%-H_W_PHm7WqK6z=wV3OepQbc|XI|FJ;^X*8*4^q#tEtC<3P0y!-kC%l* zJ+^A_or>zQ>9rGQPk0GR(tuqB!5b1C@t|;mHyR|ygP>{nmN6NuvD9mRi+9LRvcwOO zW^}Ld-bw72b!3~fdJi8XGLv>wRCM&8M4KM zD;d+UEf@vOFl{Rq&!Ls5BJI0x zk?!vWMX4rCm*irQE{8qnp8kES0f}p#U3j84r+MEzPJ{kMY90~YaS@iKi=$Q;H+6e{ zK}+m%a@;D!Ouw2%__yHMPWMdX-y+Q2_c^#xPQQ;`jF-fbTSGW0?oirM#yqvw4(bCZ z`BcbvMhV0UMa!W5EP#n<4ccu@Ip)Zx<5R`>8dh%gZS^?w-(Yi8g+DYaHW&M&e-!V3 z6UiBT1m?)dckig}c-vapp&GZJ*yi>#CofjLh$X`ww7uu~_Uju)&qz$bE4`;=mLF}h z1WYFdvW!*9*AI~wM^LYvE5)AOLJ~SDDxq~GU-Nkvp~0uu^8ih1pW&-rZfEN%v^ZsL zv?hxC2W$a?QG3nRE1gWsZ_!WHxSt&hJmXGqJ`QfYn63L5|agj z#fvyqcK<~K3!t24e@yMlg1pL@-sWrQfrX9el-UBzZAtvo=35F@nZW}$ZddsYEd$%BD{9HtZizTNGR}aadu~p(_eiX=^AP0&L@15lHmqqxEq<<% zaKTk4F5?z(Pju9H*2=|d353afbENaJVhl87&7GlUyY(K7rJk|Wk87YWGT@Qlq_BAe zt-KL)(g#sE%w>=IklD0hvbYzNi06-=PF+1mC`3L-gw8qC56DdBdRXyxMK_{E4fiKx zjn!7Nvjcr2+z@i?NfniBt)O@{pD=_wh24N4L>i5?b#2bEc_LRK>dWu_Y`W`(C-q$_ zO&jkQrz_kX-DUPT^jvP68t@fF+d^9vWZBzDq&9s9O0$E^`XJ{^)r0;A_WZLO1RrD; zgq&Y-kJ2BSa|}1Qf3VZOW<9KbaL*Ckp!hxkSs&kd#IxUW?;Db~m!`M6USHP)1pxSc z6j#CLlkT^N=k03X?LEiG`egBst zHspHSXz`q3JH*J;CEWGV>x#+;*%y1x;1C&jxD(t6L|{!W8Y;HanUbdvPDD^)Q67CK zF#RQAC`nQRe1&^R{-D^wa5?St3?T50B*jkSK4kna0Q@)M!^pv=sJJS!jxsMcVc?%V zQeOXB+y{wUqGyQ*iu3#*+P%Mt?|=-+v?}q)M>h91?JS1mV$7Aa#w@OpaV7mPy2^ZI zOW#C!6)($n5WXjoL}}h1zG)6dwb_9KVR&edzxlFY`g(q}LSUw^cMYi%1ZF>~2(Ar; zh#L^W%_OJgCn0}%&n}VuR~|)Wc;6m7XUa&@^CP8cNgaX$@gN#Ui}vq$gnGy9I>-Dv z$6|lqPl@}p8Xk#5vyz^gfjQpXJSTbBO(%S%Xbsc(^|uf+pZgX`uKkcc(+WLt@zBWR zqjzh6PD$C;$CN^$5uDo&kp+I(&OXG>{j|(uV?Ve!R!Q)&=c@*J|Vdjxo zBA)Ja#OE5#&ODx;b2H1~b5&Pcq&a{Ms1hE@Q$Z0ARzZqe!Lu~_2v+`Z2uW=e@(Y4N zNZzBMzxO8OR&Cwi49$(w&kQZo5%uU#>gO!UKdDaV69T91nxTr#LNkDne6_tT)fQQd zGK6H|uY%j~(XKA_6KpNe+t~?Blq_GV0Za5jSI8K7mgo`*(IBfEKdj)`<<)@cLG0ud zYx+wIcqUPKjrY-QG5o5*{Jq0SXJMzk5bxVWZcD1EwfM1VRVCYsCaS^g*if9(`^!3tGzjx zg;$nH!03cCc%r1&T%)+zIFz$KpQFs#u8#reW3trqW8|xniwvpC6j=`Ln+k>(BAB2@z*KYt`2&UM*+kW)7Y*so_WA04{zmRpFa6lgg=3rw@iaZV5>KZ2$QzMTq>wzRg4Gl5ya2!~r+OU&~8vs)aF_2hDi& zXYtpOW&(;1eMAm0X+%2AhOBk;xy{Z3O3>KOvS@ZCW^}Rlsh%VedX*IE9_)=*^mY2? zGz`-*yXtwd%H%rhfeUdRYxYL8K#!b%hFBbTKm65e^OyC^t?7)B*joDRttoC9i`mh7 zGDK_XciUTtMiY50F`!jT`s&gUnyQOo2>CeZH+DFGneYLSj=-y@v-~jC=cbr>K$qF5 z7OOWk&@L!Ol_tc4d-jU+AFt&gS#}+)J{#Fac3xsXL|)JWWw%=wnK0%rTF5d2zA9|@ zsc)@hKMqs+{JboXKk0j!wORE?jS!;Nb@d*AnsM_5g!SkLsm zYn4252nEbh+PFSwb)ARI!N~Rhc$#?Mja`C3mS{p4mn}lOT);$MM;aqy+>+7weOeeu z&FaJ?Y(@zv#;?|_j_Z_0{_&M14}s-OW$RmEF+!Ug+-&&1zXc7Sk0+HQLuDhj1SN_y zVIJM%YbMhDz36)idG&pajYt2yYS$2d+ttro4X|D2=;xXrt1f3G+!S$*|d z?CblRdBPTtt??!au{k1TIk(`LE$>$Oa_V0fN{>`7 z7P(N}T-`$Ei+OJJF5!wU;jhWa?QGeqG}Y=kv*z;Vr#VqQG&gH9xDMYlS+{u$1ZI&Y z)XWw0-E4G$6G%70WX!Eg+Q-r`Tlaqu)QNct#azL(X=!j!C0t2m2#5?FbQ$XiUCU=4 zwv|c~7iL1Vj;@KiIg)%wT}TR4C=Cd?g3``uDIfLZzsi0tE7u9RgUruB^mn+`8ed7K z-qXPTzR5KdYHYh4{~}R*+*!1#SuGX>F6AY~($*2P9uQgh>5h6dO~+m>YSG!?hB2V+ zJaOl|Nn7Q;(jaMG(}q;*Vd`G|NxQh(wp@_53rgOLr6PocK0l~sN>H}M`+?3|xFhQ8 z3zFJMx2OOK54? z4#{v!!5;VgXnL(mfM95SiP=>!7P z3=-Bn^NxU@XObXuz;XQwsVF?1@tU`F`;}ocNG*R z;uM=rDf=2SW6rz2OkDKx!JIEs-YDd8##Yc#?XkwUk8yN^f?JR=T=9fA@RDV8aK+(*7y9eMm&k(y;yJIek121u-CYYeN`VH6^YP2i-V2?zx@Y{x*J?Cei%? zbY+Zq2jvL`gKuFHT60kiWP}o)bFs=faWNt{Xntr36uop_Z@k9?kc;6W0hXj+W=BON z^57t*(FPey*c;m~Pi#&vt8DL@N(WbOU~5~K3GSjggFN3Re`;g+00V|;6aQ>X2v&|{ z1@w>P06QDoe}2B#NmvWZ|ArED<{j3RVSsCxSp4~W581AvOOW&a#|W3YK9Rwc@Q#<& zo4X+tp}q1dN9Q}*4YQ}J%z3cm@sXk&c-dvLgz?3>qLJsX(i-fJ6HL2 zC!UX*S*7aJ-8G2yO(jgDboll!(ET!7d?d%-++xbm&leZ@Lca zS~o{2makNFN`quN2V{VmYOz~pj{51-0^P3PisXCFI6l`JuJI0;8?x)DEEP{;dO>B2 zMhlq@_09)o#Z80H#{?Vfaz~cxgi$wJ7Hq3N9G2}icqa&=u_Tw;xiZv%r3Q6EOa&x& zNslINf^C2U6vY?4k`bZUT_duqH@>6>jd_?Rfl&Iw@48>QV=CZr?5~v(S}g-sag0bw z^1g?_Cs0O>27|u;$p0Wiz4$#hL574)xPjakn{9-?z-m>WJ}l7id(!qZ>8}**(1i;u zSg(Os9khp-&*4ay;r-B~$qsJNaYRpuN_xZg0>=)>qwI#VUTcR>D(u(4YUA#RgI8D; z{-gKz;zLm;>$pQ>1Fx7oO%ZX?vvc2JFoL73DhQ?EJ9(Po+}WD!GlXAX(0H$z{1Bom z)X;22#`Bctgsx54t7nAB5^I)^dL07rv`Qu7{A1SXcl9=zg-IVrCsLhZW-lCo_TS0% zE^UTo#b?CbrdN?C=lU*=?OAbzFjoFMJa_?4+jS*Fn+9rSfS7O+s_)OZ(ajZ9Rq?OHkE&VzT2)lk=N4{_y43q`_m=U{8a<*2HlJcusbyOr~WJPA0SQRWJ*;;bATw`)WUBg^tY z_eHbbl4i{_bF3QH*LbcN*1N&Ye0-r7#Hhv`rET!WrUx#!>vaeO*aq?jqsj$s$l%yP z-WnSW=vj9~_yaEZFtyJ|6O8elp~)45QTP3h-PT74lad_-VPPp?o~Ud$F;-aI0-BYN z%}WUMxWsf#VdGRCc9T3!6i-$idd3hg*dm*x#SI@hZPa9 zhlII0-+``r;rp$#r>n3rW3g%&iLdbAV^~wsVWoq)u9K-WkOVxa?a=?{BSJZ zMMl*!2V)p^4TgPvkX6JEVEI!$Xk(iadMb^Esub6(%=?{JH2|07gjJymQ4BUe29>H{ zF~T%?(n$9_1KW6>XE(!N?v**P7zM+w?T296;}-Gp!IePPiesdZAvvb!obFL-<)~(9_CYlXPO_!EJ!r~XCBAw+HqV_!pfx2K6feG;1{`RDR$t`-H6OU-ab`YAmQ-k32;3M& zE~Oj{GeBD7i;gc=h_uj%c?ywzlHZREKgCd1ME@*b?Hze&&HA;wVRx-zuQT z;=Wlx8s0#ol(XW_pc$ivTCj4lN+Zjg8D>}X2&B$zAPBIwa7dq*&afh8gT}v|o2UF? z9gJWrV$p>OC{?G7%qY>xCk=dLvyhixl3z-x^s{U;@ox)a{p378z`Z^3rFh5+@zF4K zCOP3Omyzac4mwsmM@qJs?6@uh45sAl)%L~Nt>L`0$3xZo7YJ!=D3AZR@3YyTD3Z4TXnF`Xwq_(> z=tQQEY{|7Z(3Hu40BDrt)f#952sWv!gMyGyi9W+o+}EIIoK4y``5cUXtKCf7jkjUG@R`yT2b|jj?MUv=Q=v))1&p zhW7c1-`n=iO9K=^m{eAKDxoIs-7c4H6DhLOb<{r4CDrPfsw6Hjl5+;5r+w(@^))4y zC;LZo>DhPk)LtF(mF;$QkJQ690E5M)fMJl1w`4r`tnP@HJ0m*6{YK3q_Bma)uW>lANGhq1Jy2Hmghj$sJ6h|64HEVw1Od=Se6L?LLtM+2F7*{DHA>@A)xdViVd_!c`lvgQl-K8> zF=XM`s5u!KI9Mq1Q--1#W6EfvbnG{VqI5Wrslg})4-Oaw^nG8>M`|;0NyyX69M!Oc>Wd=9ZV*sEerd&IXwOkowgCaQMzM-PKvf&{NX%PKQ0*|-&}coVoZ4|V+v~z(ktWK_oUCR@mp2?PdSh+PBnfr70W@y9t3nomZLCn4k2^yCa$?7x_AnQlJ~?ngT9(&isGpk}*oC{z zmy0;dDj&Q9pm;#;EURcnCAeSEklA3;FG*v?6N()xYay*@6o(hTkWw*Z%uZ>!TQ4T? z4h#%mbyYhm+zN@cMC^GP^Ja!fOSWj{3Sm3Nc*BNvn;@#9p_4=8z8jsAR z>_=Y2i=jBSihQY637^6Xa2ys~QPq)CVrJI*VM0|5p0I`VS5+PJo64`WD}#qS89UsA zj$sEFaufw671*3@T-{GQ>y3kjYr|5WaaDA@;pVepiVb-fmDGbriX9C9fHtx4@3TOj zd;>KGJ)Gz}{Xa?A{HoA3op?@d^s3e(x*ej0l#(G4b}{ts5*TdE?L1O#<$&-oI|Wn* z+CB;zUB!+9H_3}Rb)TdGUPfA-ak(zxjz&xB*i*$(HVW*^+CO`Je}=x$Ly3k9%^J!# z;3TLbaAeN@=u2T;4+7K^RYg@Zwy}Pwhl!Q^RSd_=pHo(z3LkS<;AW&f5Z&u2$-qv$ z%5%_t7j8yjbmG(SE!tsD@iK;S;xjboL$oKhSLQ*sHuSCT65+9F%W59Ki3-Qa0UGJhPLfKYeDKtm1NlHo%YBceRo;VSTgI= zLsbm=HsaJ^eOff^(L``-z&XD){KGNeSB?3pS)Nao+bq%X{{R+=vKxoZPA)V&y;Ma_ zRgC`|0RN4DXHTp&c(oR%k{atxWXM&SjWAjN3ICG(^FvjB!v(VcEvWK!zL>rE1w^*c z!p+|qRdTwt>l_BRrcXA5)`~GKc7Kk{#^jUyLy&>MjqAX&Ydivs#>A6Q3CsRV!m(>LvJz8I zVkSIg&&GYZSXWin8Asq=U)6li;bB%^mZCCPL2IhQTpp&OV%0gAq+yjh_+jNg7lM(X zi6AR~p;a;cZya_U=NvE`AsiAMBOKHmOvX}Lbqy5%6@dT7|Nq8@8FgxT?=*egrm=Cc z^_k5C5%3La`$@o9RU<^GldYP>Gs(S@U?QA@6u>cEi zoEsAN7Z%#YXQfaKq=`0dmb=!jkyAEUnHzK#JgFCJC@*tO%9pEhWu5#Gb-Z(%Up69R zMid7nz<`69U^nj*5bdOp& zhMI4GBb;gGG1-quX6WrU{_Won20uucTKKW)2ot| z1EzXVR~~lG`;V{D4mzJN9~@SV&Q0sy&Pi52#AbK!Jx5eH<-#ruOeOPIT2>`!)iuqX zk8Uq)A3n#Aqr0#2b;>BXRH!g=m3|OU|J{W!G$y z)UEhnV&vULbfoGt9f8vK_j6p$AWkw|DPRpbKJKGjK#jb#=MAyzS`mG$^s*tPOXmB@ zB! zc;sHl0z16#a9l*t0gho`5x!;Zz}-Ii zO9_E0ll#6cM}2e2#XgFUqOqxGcf;(Ptj31YLB1)LunUdljzWbTPsS$N1WUo0S1x&3 z2b)LMo8-9|07K4*I%v-(f+|Y&p&k%JU%ISiCb_xf@a?ev(saO+MC^q2SRMjFOd%a& z_)QBP#e`8h#=EoQfs|S5=JBK7=y|<(M@TVK=MXX_Qi-b_e#TgVZUDaL5J!`Bz#S?! z)kQwh=}9g9ud^47eFPX7?eSm8>rH4tivRQ?pR&5!Rh^PTr4=hqHAzbD!<05+l> zQ)^7zFIfjriU!9yWVR{KqxTL5KITH%ntXj0CHYD0blocNZdRCN%&`sw)byQI4Qte_{Z(IBQIly>rHRxaS}1q9&=4c+ZTp1tx)Pqb=~V& z@m|;;RFT5qh z&__*Q6c=`B{R-vb5FZ7$&otT^yV^#v>be@cv{H75LrBKWHJ_5LjwJxp3Vo(8s$w77 zm_OGDnu>IIYL3Ou;%EsD=OTYV#;Z>~*6*!1|AN2F6#wSpoF36mF zcaUkZ^OMATPNYiG3ZI~LTi%9@K7gli-V!k{8ed#~vd9`=EQ&sI2vIU!d^|9|+y$B8 zz70{JDY4LFlZlR}p!g?1L}lCM)l%jRe(3T_{$z7`f9{|f-Q{)hn0$BE<*CFw#~Eyv z>~nVUeBF}OCfLr`#>Fj8Hm_S#_VV}Yg;S5Q+B7>m+dE^)^!E4Y-ooILXLQs7vFROE zHA9pcHkDcSDZilDFIR_~8vz6^LBUM#B%f;W*bN|BC1LdG7AgfW?8+4M>;mlE1Zsb) zK6W@OQARUFfBxa~CvC*$q3%E@t;0{{4QvPP7w7f9%C`I4mgi{pEPFGXK<@?0<0A2MO_`;DM6&+pP;-T(jpaz5%|tx>LL@Hk(B^cI7N}o7T+VqVVHBGVj$U*@6bL zSk+^l>Jl~(y>nPJsk#ZDV({?~ai=c7(skhY*0 zUTXaxgaeiB(rNo!u-u(&7OUdnSq{JD+oHN-K3OE?P2fpk0Vidl*35oU`Elip2{zne z|DrS8-kRm?5w;+o&z*7R7>H0|VoN^6-}0DdOE(1I;LT&F7&BK1RZoC%t(gLeeJ8Tr z$fba5q*$dC*V_dBV%TEynP`2;cAuN96sx!S4FFEdGsT}=C_1x=RlWrfuWmn?e0{K|XXgJ4K z#fTo>jBlW%eZVop*Pw~f{DN4Z_TZ#oWv82ctN?Lry~ugf!A}c4NE`-T`ur98lN@@& zKi5hC4(@*i6M^I7V^nsxGhtL$G%;nA6w%@{G2u2fW#TqvGBPwWGGsSk<6>hmWaBjA zWZ^PqHs&@J_}?F)!>DL$>jcOA{uPRhk~XHcUs(Q0Dw%tjd|~0@WMYI-(_;R@`h`X3 z-yuwxSpQ216ZSP%c@=M;;ftqsM0pgNybwd7-YCpL2o4l@Lvhgo|Gbit5KPQ=QY<=k z6nxczP5IidZLI0Wrd08nGW+gvlU5lklYG3R@w+Q48^-&iooCb0fbLc1^x3-OH2&oHJ3-Mt$fZ)LCv$sn}epZ;09git)FxmVzQ&eW>%W3NI-I*LOfow3@ zfEvD8MfYvx_NVdbKHLU8r#$$Lze0>q`d^?7;1^>e>m@Y}nS%7cA`C9#1a0H^#V$kT z*U&fh|Fnu`UjE2yNaxZwwG7#ANZ`_ciepRghGK9h3E>H1bw)l81v+auZ+p9zke7c3_TYdvhO2BR5-v>s~G0`CeUS`UA+ z6C~>Se7T+TP*+!qbdXn$q@GscAdYkW& zwm{IJd&`iQPU447aJ4{g)hXpX_uIk&rylT^D0Q;9%U;zh|L$q1>rw3NE^_k>-}33- zMCTSKaCT5n0c8Z!)F*EhX@C=jiW6$h1h;0$8!>c?^NTPd^ylVk)br3cBc6%NJ1`-4 zzc;{t?v*jlQafbaSu^fx_>eSYthQ3XD#L$&iOW}xfHBz}{;i~l@$pB^|Ao*PZc4q7Q-lvD%z44J=LU5Q+Bfe@@; zt$;W;P=vch{6})wA>22qbOiE4^NdgURxBX}$@Wn{nnv~Gy5@zMV1svxQik8_DC7ixB}dRetwQrQI=k=Y_&CG4#^<syV7oo?>7cjUhdYoEXza03r=Mgohu;ooycQxFM{Vjy`>sNgwy-xsG`^aUBcrlp z`R(Zc7y=+#^Dell%ThzIqZ?8Ag};5`!U~16I0JK47&=F*MBQvl+3N;nvP45LBmUA} zcjE)5!^w2Hx+S3P`f99IJquo&mSeSc$Sjy>*?dpliHLTxmhLv*()FBd-6?aV3wm7W zUM`3d@qCK1_g;GTJQ_t-*c$X4x_R1vJr}6l8@ef8;&A`wFwiooXLT7P^7Mu(z;POL z)N}(|nK(q4`7^$loGPMyO>kuwca#Q1G_yfDE$QThcMd>y4X7=LR9_%=4Z7YF3H}j( z4#=*B?ar~q*p|NA06Is{UW`HyF<-6EDT1uI#822xGblJ*W3xF={cYZpSIpzwJ??Q_ z#AxT;;<+9Yq(jH(F`vGuaKMt679#awEu;O4Y_D5n!0n4$ihO$RUMavFMFe%tj#K86 zH*=5{zeYJ>wn`J^!xLG*O2Hm>ug^CMvdU8!5P#1K zHcp8r%BFza*UR-eK7y*eTgQP~%7;0t6=)n~5>r9~jZW7|vV<~cId82QbA<+bkVo|> zr1+O|L5YLZ34%e)lWsqPmz|61Wved;tQtl?$9)5F^NvyClJf{s;Z2|5a%77TS@8jk z&CA9tk|7t*4goT3-MNk|==FBAvi*l#pUifwGEDfkDjSYc`#qcl%s|>1!B@=C*!m0% z1AN*6Qg+PyAVttaKi(7l_os-U7aPhA>v8NzZLyQPD5CmzR4EI zWu&wiYtKxrRg-Xh{^A!nM8iM$ z{HP*1Z?jMEWNV>xW{Yd#rvGRt%Xz-{c?jJByp9O4TJ;X5@|!ziHNI`1^HV41z3vS@ z=LJ?-a790_di32n!>0I+Gx9mAK=1H9Mm7Lq1)b;_cQ^Z;$>jL>F{xpJvQ>DQ zhW3gkzF_tFenZ=4=FPlmo&j66_xhyfo#pLwEMqtm%HWhg>~=u0Cg-lv#pwJ2$`GZg zCkZElWEoDlmOaRTOH7}lY~1u4FFh!SVYT+Ltu z7NlWRE;MlixT2k(1iy^z38IGIwJL0iAG$r7><~>#s1h@L@wQWjAFDmq)DU+{q@z92 z)G&dzZ)*$6l^rU>5Jd~d6=09cFbtvX_q7&9ZQDZomuL&t(zXZP5Td$2zCF4P$EMNI z@x^N2#oX)G|3{--(fj{qi-G@ajQS9|V;lSWCh`;m0PdrU zpR;ckpfdk{=k%Bf|A-SJv<#v3e>w|tJC1@~{^V)McpM3M*COBciyTLPvipMc&#`7l zjnr>U5JhH39@U2-Jvhq+HN3+GdbwBg)V^+JqR$RG*BE!u9_&^T25wDl2|HS>*V z9yQL`Y=cY_zzYmzxwz7vx|oYIRE)I4tJy5y{YObjgED!Sqf*NrKdEklKdE)hm1gPo z`T*bZ=Z0u`)IAay#i~D!N6NL%n6@i_VH7XyCw;#T`F2U=oO?^UoQ#1dpH~xl8L%w8 zLFlP3r)*o3+{T%GV+gN2-GqD>A7Fs5Tr=JBnB_>{+syKQCANQEwYxGkV*; zg8a=lTm6mo5`8|i7T!hprj4r9Q=jo&GlaDfQ|^56l07o7AWe;8l~+5$1zTlA!@m<6 zU{Rn2XW=a)-zV^?26b!BgQ#3`6C^(0=;ika|HOgbo_9*aKF?o+4BoVl_4t6)M?UZU z9)^|@H|n8Vnva}h5P|@$%pxb{`LiC43U=Vwkvs4en zYqfK%*zFy@Dk>1J={;f%-cIp1lE16q=>UXTP@S#8vdVImjguym^`&<+9?6<&s*ps( zw3=rM+5LDOVULA(7avFI7x{uM#f?&e=X;m&$mEwU$-p=fqLIu*O0NB%7rB!)@7AgA z6UgDs@=lAVOB~-P-?^uW)1_CnzUUTfX~KgI>oG!R*Sm(;V&XRNy`4~L#we=~5S97op_4)lo_dc8FBOOv;C<{KR&R0%JB%o8fP_WW)b(ubaZ zIRB9SN9s}?ymbHZ>|%{~ZZ%YM$bj*3YW{sHg1u2ZmEQ;t)@}Nn48n7$H2Y-XRl+;y ztl6%x^=^64wtlZ>T5_NQ(E4aab9m9PGF7vK zn%cn>ErE-hB}SdUroq%|@ppw?A!;>PwsU0)VW+u5%V@&pG6jp&orq!vo|;ejQ&oPu zM$Cj%v6fabfvon#M0w6kjYG~<7X%L|V0fH<0a($@eo3wbay(wZkl=v{>^9FDl9jbM zmnL0lhC=AgZ^oaaa(6d;Pk^tmv;jjPnTP60Y9aV@o(Bfn2o0&2J<#LxR*7f%V}mld zQ9a__P*j4=hGKqVupv3ySlSL7>CG$P{3uVF7%FT*TbeD?wIs6tEi?fsJU_8Bh4*f z`W&;et*X(O`G{cj4E*b5gj4<~)f)z>Kd~W69y@p6?#IXinfXvY*84-R=7N&7DdS`> z!942H@sE#Kbt*Y`ndk6*_vm4Q;`+}qr#)D!YF{N;L{Fbyf`la`5s5}* z8gR7st?Ga!vZQ=D>!GCnFOD;0*<#9!?zor~3faOj|Pv-I_)zd&t(T2)6pN)VW5t1l7qlr(uNo^?5eU zX{G7!{C-KfQ;Hjh4El%`0WO(0*+P5CB>>}WnOUlQM8OS9Jv7T>rB=?_cq?e2dMq5^I7+c25iK) z*p%oJ?yyYIa3;f8EEk$@P4(n?!2PQ%`3) zLyn<;&L8#U+CQ3axq`K*v6HUWhxiCJmlA+2QRC_-)Zy3`+oPU$G`rFn<515O8hz<* zH5oOc(3nbhVa=jw7HB@|UjKqR4;SN7)csLUH=1=(Z>HWrd*c>q3iZs=h?;dd zht;V01dSEd4~)PRRImG%dIDykj@>)zDX8&(&s5YsUE?mzy6CR0yNr4^Jr|eaPAtRS zw0@%AgX)>p1FMhK8K|CISK=+aOKTHq+^ad32lyDDp~D2U{2x2V@)8?SzjPw1*V3NR z)m@EF@&%|_WzD^7?%IXA8)`hMS^b6N9z2CZ_>^YTh29o0|5jo|tr=XcjAsZ_(3b4ohm@?=G$37=e*2sck!jy~%Y% zG#Vex_v-waiyDQ_=Ciuu#*^zBPhmZOnm5on{~p_6G-{@|j#{79UjuisPW7>)$kQ-} zT)pBQYRxv3)2hGJ=qPVu8}t;Txx|hbiz8XH#zjL(I-%|${i&0vHFK!rvKJqruI?_V zzbWWE*Hxguk?9D=k!zG#$!E0(^!H88`M09h_)x!Bvo4xB|Hv{Lndn-JNBz}*HJV&^ zz!-AjI$Exe6&cn9n8E^1!= zK0d&QtVd6RIxBQv&|N@RoMz57L#{qt-}@5P18c@xJ+0=k^;cBQMZCuk_z^$xy-w;T z)HBpqa=krjOhDRqwsv6)^k5KwdNBY4u^qO=Pz=TpY=x~c0>dyI+hQcP!6@vE(byhi zumg6)SnPy)-?IyL#W?JS-7y{qU=Qqxy|6d-!M@lJ6R|%I!+|&m2jdV-!l9Uo$v7NG z;7A;WDL4s7;}{%^dLwu|reQixzzm#-GjTFb!A#WKpjkK#r{fHqkF#)pHqOCpoQv}? z4|8w<=HfzJiHmSCF2SXkkIQg57T^lpfQ7gUSK}Hi!nL>#*JCkm#S+|zn{YF3!Cklw zOL05yz@1oz2XHs;!M(T-_v2AKh=;Ho4`T%$!74n4$FUMm;7L4%r||-w!LxV{&to;# z;5EF6m+&%P!K+w{4R{@YZ=iaxJ9rCkV;$bZdc2G3sqW(ge1ebgF+Rm-_#9v33w(*M zuo2(zA3l1EZ3wD|`H1gPJ(BvXCYI6r6u#bg@lpPxwcOv2`3yq6TcI~8^ge>#jA)G! zs5ck%-lE<_(7Tp;Us7*4>g`Cq&8N2p^cH~r!(VS2_Cvh`sQ00N^!{BkCgDg-Mg3B} z@0N}eQE$@eojbiBw+!|En%;)f`)>1bF6w=>9L&Xh)LUswa4YH!vH~o^LR^g-P;ZK@ z$1S)CUtTM~#>vR=w;vKw& zji|Sf9;4nr()&SwdXwlC=hzt3yE*UiEq=nU_?cy#Ca`i5g3YL zsQ(|1M!f^8|7woK_SgaAuoHH{9@q`zaWwYBUf2f*VImGdy&EzZlQ0$ahR6sUWde%o z{MXL9V}6Un{gyDo+4whpH`n^z@>{zHGBM2r_+Rn!Iosw_(=gox)c@em@21*(CQdK` zUsw3^uZ=d>dl?xf;D^rs{6GI<^LaSY1pJuk&wspP^94A`1cpTV^1!f4o9FrJ-`RSy j??{dFw!fN^nkHZ!t=@z_|_Q<^p9g!etw*pl2MHn64qLsF2UT`59NhC~li zaS)J-4l=|*qXYfJe`?yBv0l@c;L%~9@Ul5RwUzZoF%#i?WhxfuHO8ebXi8x1(S-2m zWXbP!9X7FFgI_tC9(o%WQrIe5Ia$yyol1BSmcCyJ_$!6$R*!+nEvNVwH;kGl@0)2! z5&hPwf@?$gd*o74{L(|b$#>sRisi1PM)Y*9NKKX6jZJ<1a~@5t)`?Ab!x0&*S>V{R z-Aw52q#Wd-;9Q;dCaWFYfJ3)(@!qgq{B+(EHn*iHLTPp0lUm>kK1~FHZ5iCzb*m8c zcRv*Zz>Vj-c(-L)$V)Kud}fkg<~W%cN$`)ne3X|#m_Jq){yCr8q1*m|v^k974!8iq zJ_A;dj_ROufMi2d1A*_38RthheE?uX@MWFPI?`W075N*h#mr%XuQG=vkg5KDk`AB4 z{G5*e9fvIDe$ayNBEsdED6z?%%E#RNSzx|ePK4sUioj!NlkKZ_B?s8sEDF}==T?AhnY=g zYbJ2kW>Bo5&2+P!JaCdX))aygUAnn*Z4?pY#I(voXTdEiaqDShJa`0%WrhHhe8e)> z55ZK=!ze=42(f6^t2~ghKr9tk(ocO8CGJ4xs>}lHGBF$e5zy=<$zW>hhaAw6-dhw# z?s2#jr56O8me?bHc0}Ui9L0qKb|!*?GGe-0p$mIZd)mw2wo&~(dGL>D{#|*Qb2dvB z2W>5_pI{|_eD!r-U0qCgS_^#<|=5{qeYZ+w1c&O_?X) zd;hU}d-t68^YC$+mKMjznD>3ZTt&D)!}#+!yQ)CgbKbS}Fmz$h| z^e?EouR7hIjowaFL*-3aY9i{yPzcK)=zP-A4t<@{3l52Jw5oOn%BA*DG;9bG&nzeJ zfzd=`XJ)g~-R>oZEv_k#h{)mq>h%(Cl63t&Zx z@P$AsndvnmH7J~&;^@@;rUPNL0(&6xRLl*?+Ma$_K2MCvuN$@-R2UK2x)kvAOPl1> z0!kcJ3?x0v^#W12DCxY&IMmVxh?wi1)bVBLOxPy$#AlWj86U{e?}B^WF)O(M;MU9*cDXe$WjUjakbzlI)~v-G)YJg^(#poqVn*qI1v4fD67 zjqySK1Zh&Tq&i=EYFtGZ#(v(=JF+(Yu zR{R4cFMAEpcqnH51=`q0N&7V869a~bICOW?fR+AEuqta-m!?!RZY;h)2-%|8xyJK) zd=7xN&ynFB6b_vPd4?owB4Kk_fmosmWL){62tV+_eoul1dkJU~sl2~Y#T;rogwP@T z`P^R~CTLSF$0G{WU^Wgz2t}7_@!eyscv|U+^q~;)p7|2pRX?erv+4lsZB6k(or%Ch z0P9_cR-iC{kT8ET)xh3yfA`R*M6wi7w|TvU1i2X9!kgJ34Yo}9SVl6d9B4FZjTbr` ze0-p(TT(VRH)tyF7XFA>dm&ZvgLv>*LyUUAvpdO9?6;5|WA%&fxFj^PI@RJ+h&7F!!e10uI)Pu|GSq zM)WT-1I1D!x`|ks7a-_PCl^n~vK+%bWRTZlg%A!d`iNXb;4{2KS;L=lD3pz*0Hh*j zdMnj@{9%=+g$b;Ry?da;i5VJyhlZxIQqhs(+=yzcuw16j+H^SxD<32JX(u^x(r1S` z)KYe;Lsg_Q*0U_IA)F3C_`ns(urfQ5dXv)B^_9ngH*(df*`|7*#|4aVy-(6rYifgL zrKEr-#tBD4UNAw@xqfPZ7qhJyp!N*mq*zyEuDH{ej7#4bIG~0*sC();K#P@gdE3-{ z422p{Wp?@ldP~<%MKKrWW&|3xe$t^r1|3;-2bTR_Ynsqw7rUuKkpMou z41GP9vk7%;Y8SfsCyIY7i8IikMia=gJN^PkH`VZ}WaLe!TcK}@5aIS5kSXyw8Y|J%!y>tS(k@l+zyMPxYgDL7?&r5Xg^>euck<3 z5&DV8@s+q=toYAvf`j*ocnYzUrdioz;VaxOCW;MXF%|tko+BUSCx%JbiWW?XWa`K* zkEGFvnHPW5l%FZ|GN-~tLZ`yjcOM2yFHExHpf)q!bJ4xj#Y79QYhCQaChKCt9!Jo< zzXGg}ZDv^0wB>dH&=*>FD`AafQ$iEv)cv@+{8soigJYDgBYPI}@7e@l7h0AfviA@2 zuSMVM>|J7PCd?q$n21c%PoL{){HZs)9y43BaJbDvzv@jNdyr@?i`$#I*8>*~j#Rve zo8u0K^fZ+UR%~CCb@shWw4SC01j!{<4v!@%INZl%h6Xdh81TCFIlD=iB-}K1y+Ow> zb}PdwG3bj8$bmK7v{uRZEPMhMj%XW{6~lNuxw0)P3)6rduru~T$X`x66N|*|cxj!E zZ8ORMcYB2#e08}Iwn$;_#{4ZRhdV4r9rgE2U>6p``TP+&mWf31AnPrG7rCH|;sSb4 zw(^m06HXk!(?oinOwbN^1m328>fbU8XZ?ST+?>b{46;XS*-i^x?2_$O*mEc*PFoQ& z9Kt!o0Q=gidSe#Thz70;sndIMxwum+xaJid_kfI6%*B48NW>Hj8Cdmvi}`P_!+;K1Nej~qP~{Y2@~=(y7|(+x?xeO&B8pV ziWE0ypavh5_=1||v6fsk4L|QPXw%ri)6B3YnJZ73VypBH>Y8D;b+lN`cwNbYrw!5d zUxFM}Dma~WpbLlcci5?2DPONaGZPy{*dd;4mnhv4mM=V)%0}!g+LGsJ)Be&tdt#E= z1GGal6pdP51K5X@A*db(SaWpk?r?I|7yc49KFI#aV4Augz>7Nh@m9!?7S^&!uGG$YLBm zNE9+ogq02*N>EK>pxDih^oQDBE*qE8RCfmd=73;#gq5`H-lII4RrW&k z#>LHEN9stROyEf1^=Bt#%y;G`{?lhi1ycSlTJS_ioxA#@<8uIT+bE_S z;|cE9hVH6H;E+lr3pYUh2y?MDboZwNFNQMPYz#$<{V6O#p7hHlk7tT^l1oc?6_z`# z=x$CJn|Ddfp|}+;J&KqMy&MveKKs(y14z|l>VIcWv~LcTPU$}D#navSO>ne)iBA)G z7i<;sS`b^=u()VNF?@%70XT9KGpZM4H;cw-Hxs@)3xW#A0=I!+W9S)MGaYd=g$*`a zgb6HsN_OM!AHI1|?pIk9`Psurcx{@@TulWnID`RPL+dI@(H4~XMuyD5`6$8OE;b4#Bg|NRF#-1bla`shEDvo^bF+{(AJX#8|N;r&2IJ$b}WFR@$OT_!-N25x8suvs2 zCA^VD`F%N(2JqEZeoWrKm#jXG379tKubGytrc@8{owLQcv||2pGvN=rc|2XzREXMd zqrKE(QivL8qdgy&@A@M`ANADSUUehkr9a-IB0bwhG|+u49hy|<+E<1LbmW3K z*i9(&$tAIOB!f&?(Sxm{vI{5=%N4BtN{B|wlwZlp`OU8d2I0PrV zcex>m7h<#_=>G59k^1maB=nf7rZ>%qoBh}aEUJNXU%#>yP-dBDK>SCW7WCNoD&}0* z<>NS|53mQmY2ON$oW*FWIrBZq6lm6Yy?cJ3XqK-V-LtJZON;sieEA+!f^(~I6o;_0 z)u+7g_b`y0%gIu_KBUd`t5yCNVU*_yN z%H2CYh*RMqBo;V2J=LmBeO!%&worR@IIaX3Z5aU0i&x~d66$`>f6n|2a!H|F$V&2- z%wzeSrnq$^3iyXR1^r=7?yJ>5uFg-L?)=0oc0~6w6%&5P;_iROHEX?-B3WlqHnLDQ z2qy?fy|*;;4FVuDdgc3wo}$`r6(tjmj!@P+)CSiMVpB_5@LSwtDGua(WY)Suyh1WZq z!NaSZ)37XYeK&y{{`hr7?Q{#IA=vf5uZzKDS*g=5V zL}PJFaya4kE09I){}hD&LLuleHWg?&IE#~Uqz4ZOruJ=FDdyrK!>XBA(%AsadNGT{ z;FkuN=G2r{B0P%zk{})UDD?uOLmCNOliws2DdVN#Hx)UpWgIph$Up{SR%`-`tqeWa z`CQypD^;g-novL7OFmLT;u?RDucRmCkUi#=VsBWTf~k^k@V;cpcmx6LUQcT#uIoKFE#jg3Lv~@swF^z%VB$I2L=Je~Sdl7u z&(?n*zWuKtB=g`*pPsJG6$tTI;!7QiV|nVvO#~24mz-impvZ*}3|r-0*>IRP$MUm) zQf14GmPjk6%cU+;qjwyaG10Bs90_mz@8GPS!n6L(3nHqSWW=5H6k2zB7@D1 zFmXODcaruQM;~hOCw3`7Q144SszFuD#q=DbdY@~gn9b6ctXM+&loBSy$z(NHR@;Sq@V!O_<#}W{)Jjnk|k8chG-q(WF{fUvQ#voLDl?IT^~IGR9TMB z83+Zps4jQ*rV4Yb_puGc%)*RrYz#USeHSbJ_tfTtF}wzc8xIw*CQnt7X`f{30mGkL zDH)Ht-coU0Qba+BV&zGeFiJ#!3T&NVMM_z;X7o-oM?&WdrM=_Nf~RdDY`)ohqTPz2 zJJiY~QR@&TctIs*VGJLx?d6Wt0}~Di04?XZ%DcX5(A5NROg zM#@uPQDKqlpLq!23@>O8s8#h^=zYx|D5EM;s6{^-dg!eYS2lBW`R^VWyF=t}YxSDiDSR_Bgq^UCdQKv2 zsgS*Dj!7r=^3WN|alP8QZutVNgl?2X#;X|J$k!^h(yu9TV}r&+cHm2B5}AbPjt^;u zS%scrnUSi!Rtn5Gf0)zYMI0QBj3xMTy?(HC9al5}S)Py1sq&6tq>(GbuZ^EW*lRrq zm5`T9nDUZX5qi2kJ@v5XthrWYx|RT65CyM?W&+!W%vp?N-DZ?_x|14QT51dVy;LNs zzIV??^gTp%Y;M3cOq>BJR#_%yzHT-AjOZem#xqrCb6@ELfa1$f#>o2i2OkYwD3b}yd zi(T1ZQ&?jh?rQ|0a>PUZGL#qs+`ktrmIr*mM^=F3nnpqxqG}Z_&`ETMUQO-Tiu1Bf zf)hplP<5e(MU;LQjgD?hUUvbJ1BJl`gJ4%Sns#WQ*o$e6IxKT6xO*J%!4dQ)LENli z-~x4?fy`rhQlhlR6hv7TeDtY#no%UPw|9+szp^9wdhn<bo1IF|wX&IfS00N(xvEMwD!vR1wAp04chChn_@Ig z+=iL*YZg;!^==1A{9A2QrNg-NtaN=pEM%nlUQ9D&7#OvRNW1MTg9Rx3{x-dTUA9d! z_RV0{l$ICv`sgqcdgWHbVA@e!Pakg{8UXTStN<-EzS{2W?~CbAZ8CZLm5=V<-#n+2 zvhR=oG?RKO#LwgH!{3Et5KqF4{g}SpWiH79CzQ5+#(#G0J)Q?-hkDSPY5Ou-esV1@ zTg)y33^Yony}n=D0J_;)iMqClK(-3}0h3R`p>`)ai$w~$(!06mzwU3{mm)_Fy8yQm znLL0l1#a5=gJ7z4y6VTz=dh>Xbky+eZ_n4`!{$BqxsSw5i72{7a(b4rt|cZ_&oM(u zn!DO@sR`ZZaMIl>cw0=PtVQ9K+-uY+q1CNy->vWUd-`@Vnm<>Q5V_Kf+qPxYzQvfO!#R%)7cmo<#{yV+-An?;(N}@Qif0-$_igsS2 zaROn@GY}2!Ik#Y`=dUsKQ5jWc;I!93y&xqtX&);vSY{~Pw5}ajt ze^T8=Q-VA*{Pvi5b(My}k{G$(T~Y?=g^(Ne6b|8>+U!D2@-E7}r7+Vt0B}?^rlH%b zP{7H39_k+r3D3yV9kjB9YlP}ZN+6O?S}nMj66(u`CIHpFevrF>(tn8WD?MsrdZEx> zkeP!7RQ){EC)rse#Z@i(^#=di7988KDa}q_7$+kd7&Y77< znIuAFg!pv3!Y=B?EuZAwl8kdRXT09+DRT$!LICV$(m zRF&1=u}b15bT0h3;pwSDKb_?-PiitfY$7iGbi?0Ti7&S|40%sFB556y;F-VZ`~6hk zu+|*7sSF`Pwb(Q@in`Eh?7#>tBuB(aKu)5=Q&^yLV`$s>I)A9?W+9SrB=b(VIb{FD zl0!pam^wbPfGkOY0Rm~Pm28<&ss04`lKa@HVW0B~P#5s_GJhsuEM*d*W^e*C8axwO z9)(nc^nS>*0GqlphxzYpC9?^@O4iZRv$>fKi4$_hvG1;nT)4r@u`KaX^Rj;rCE1MC zjS*=*(>w?mDpwjNfLYZ;?O!I@6JAVF<$92;QjtxV?Nv&R0AidX_JG2c2y*xwDnXp_ zp6u{!2OIZhaokE_rjyK4mu^a_nOxpZu(Fre2is;?MeO@uX$II}k`oO*2toqbE2ZGL zm&20(rLi`oXdL}S%@2cS%#bk)N^FqiV&M!tvU=+zRpkN zM(|N-gSUp*0I*oGam!PKeXq|KBZqZ^Fu6=&_qC0^CPprY(Wo~TRo9^HAYwUO5(0jr5*jM!J* zl}278CHPcp){7gsJ&i|{SM()L?p>B!a~`Z>NNc^~?D=VF@m=Bw-~@`GR1@a_^;oYGNTaD1uz*|7Q6Ay1f}7X`sAyyc~}L|gB!#O*kWOj zWlmo1A?`*fTO>&V=~EWf6oc|vvV14nhyRdF6x^;;L0~vX25R}L)4A=~wipctP&*Aa z0O)9{vHD@~0jqV{_i9E%->QAUZBzq@X8MxRm0?KokU3n;Ru(8i908+JEDVZ*+wN%SQk*gSxG5-iQoh{> z4WAC!m8oRKt*9F7Q9eM-S(G8i@u5=)Fhum=Nm*bpI+YUx)187MN{CLt-KYjLP{2O3 zwpKcI{VEQ>CX~QIlDJ$_=M9aVgpc0aJ&o*2{sH}wf6+kHfY)`^-HlBg;3{04cHH#n zKZhY+NuSwM)pImX9|ju13rj26_#7L#+~4G*8D%NJ5f0k4V#Y)j%0RW(V*?Xb?WL@Rd97R1IDik*w= zEIm~IiqZ7?dN$Id zk5lsz>wHZ!Oubk5vLFNhMetJ(P-3gDcQ>v!?KTC`)#W5^p3mtSW2k==E#qoCHC5$u z{{x}zEoglrXSo=twIduIE_co-W2n|}tN7Q&-yDzgbQX)MAqCtLnIyd2jH! zwQDrddwrk49l-pa$aM}ID$6Apa176Ga+2b~ zs{Vwf`#ocvkBx>*ROrXPAdI1*=VE&az3*xg*F^mNotZoe4^bJ1n3v^>bq>OrOLC6I z4mYFv=5$U0+}Uic3eppu9EC-FSRP94(8?r)dwhWc1l+REs*iZVs{VMqG&K_?jf9We z9&~mS+(ch$l#>TB=NeA$o$eaC#4zbaO6adjSc``O;%hdS-70gsjUiAbyTNP4PTftgNqp#9AS)nv<7 z(3^xq=J}&~W|l>bxO9PyP}0@KPPJN^4zW6p|nc?_3W{zA=>gB0q0tykd@VJp`Euf z16iX$wxfV11ldkFVcB`pG5j+WN!boI^YqI;jK`0p~gJ3vcw>j z7Z`KvwQ0_JW2(=N@~l!D?MVi{rMFZJjJr-46TF@(y64sQ4?NmL)hAnIsUx@qSbD_* z(h70Z^6H!npwz8rGH0jB+}W!#F8Q*lcg7`0b=DI|%Gq|C@rZ8-iBd6(pz`09 zvO4w-oyWj{L#`QAa8P>ySUIN+civ_alUGyEJ*BqlF#Z%>7JyzIXok0x%ZRvq(W4PGXw@G* zgu~$isJqtV8o>w19H1_7+%s>m9qw$JQk7$lE6x@D*Y=p_h4To{%eA9>{Tfd8cigps z{gk+81t#?G(MAf1B1)E@ZPoc;q@fuhe7ZU6Sso_Cv!XB0J zRCL})6Y0Q6$%@pnk%;m&o1C6pQ;33EHTnU5%TH#$qp*|*FB@iEwVFUqPKt znhG83%wO?UIJ# zShj;+yW2|ovQEb#-QS_q6{3nZ1XqtmDy9-fM!UwiZN=*Kj5e9(67+wrDe+`<7yem=! zElG<5j!$?-vfsQ5N@YFNHa9akH=d$z3U6QHkFbSL*Ve!8><|gU02z(Q6+9w{J z2?06YPU(0xy4SxWGR_<*MWO?WEw)y|v<)&E*AH!omadPbo}d?7JfttC6QhZxpK54Y zdD~VomyAOkIhh zW+hNae9<875M3+=?ht(O?f=VVYrt+``tnNvrFwHGcmbdQb3XUy_G4Qao8&u?nGisA zI%&-ztK68BNYsLXP$Xce5W+btbti%jpN!HDbNAqM=jyihTciupr zwXOjpB?n*?cdr{tRre^GO*KcakhE!J@1=&V_>Twk_a8{eO;Sm_RDmcZc73T5-(=cs zhufex_wDNw4%bkz3IF^bXgog(4<)%hp?k&;9mc+Tv+d9*5uN zli7d7w2IGXu&PwDTP_=Zaya!78RsKA4?yIBXOWD;_p-t;xT_Qvu#!}J{dum$y0lp2 zxmq1&{`W&`?3^f_#wZ#kc8vH#RhkgOdH4J6+g1Jf`TnU+QZg?jC6Oego_p;;I$y%W zc*@A|dG*#nF0YsH!d{KOR3TvQZr{aGWjr$98AEc1V3`G)@G916v+&_&yUTdH1%Ot3 zpvO;(1fApFUx0OyyQPtx%Q^aY9dX%KDXsNQmOo2CzYbYg6}zu!^0KUsb2Uu{T>%5W zp3!T|OT+mkg@R+54YBTx4ElRAsrwBSupyDH8I}Ii04Q z2^6PDpI(6b2AstyYk+?Zn4OIU6@Z&j_&5oXbdQcKz>|CAC`bC3e9Ci;*?)9d5nhiS zpyOUx5tbx3apI52r*YOj_Y$6#_H66e1{O;{@o3v1IMZXUvUFO;l0omVCP7cu!Xa9tr0Tk>Ex)O$URtlIc=EY$_GBS*5)Gq*H7X_tySd3ZlP7*O~z_R?mi= z{|YC@abj+_uDe(A6N19E&V+?VYL$`r-jn9}CJ2omY(DmCEj#uY0Gi9DzX-~PA=?Y& zl+Ai!T(U@>)`Rx+a}ci^1AFO1S?wQRhUd%!Rdswm6C^=(Xq$Vtwny`3pwORJ{r!8U zi0@`#a5HT1L!!(Nd;=++h?uvevTt07yVbLp!e+88Zn80@Z#NjsN!LK{%uwv?gpOuI%*egUg*zfk< za!fe5p~i2?CQaKVlOCEKJiBfOF0^ApgFZj4pN87I;$E<^;iOjI&84`LcazSWi=>lp zuJHOD*wlT?sCuP_86jv!L{rL3=+r8Gcpb=dGg#cOef>`}Kn@yRz}yo!Ya)X1T`g(R z-%a@Mu9GJ;*p|vLc~cFCpd8Q5=i$cl)9Z_3ZvI=2UNNTyx8Z8+6T2Y6%4H{J8|0Q9 z$qBnO=*) zr)R^sT4j~J8i^vGP1j`22))jQ>7zMb51u*_LxyGFdLWG9n-6G zM%&`sDH>U**pM>66hkzG+k+LFD{q$`HlcF$Ag!k`?2|M|>Jc}bYvJ+170C??glV^O66IM91+)mj~$rg%9pNXLm)^=9EG7XCbO zRfE4nlANkeXPBx5xl1E?yan!L{iuqSx|P4^oKk(kLEz0oax_T$3zkbe18&i*c zX}D0!zI8vesTMyJJd~3Jmws*M2nLmQT4D+jI%$wpTdVC`aj6PnACGf6QY(p-qV+W4 zE^bZp7zecsj5l;k5hK6uq zJ>TjO_4v2J=;0^Tq2d}NpxA{nPE@oX?fPA@nQ}P#lx6f;oVCyDx7?(qV`LELWVhqr z;2?EX6aj^?5+>zxwt6@I3iy*ez-3`c4fQ$*3lb zdgha7(tDA?#y;InNh&r6rWQlwTt4IHI^|7+-N0a6Vnl6>N|L$WtOj-(!2M%>DlvLQ zi;oB{Q^napvdJJ_RI4?`oJJq|uYtO>-S4pio4%E|Bht5Vje!H=0|?_X zMJHJXBQ#`JHT;0?Rd+1{kYWXYRSau3s9zCZZHW+M_L=m4KfH1(j5eH0v`W+@ONfiS z4f1~ZG^l|I3$+KI=-BTtL26#89+jrW$Ee~D@bG)m#_K`TaP6w%3xJH(V`gF2msmoGeUb^-gq_IS`E>JNYUTKhSw@ZKhpj$s{*eCNwZ)9(yIU4M#4& zJFB}7HwH3F($7^#9!vkNiY<0znYpdD>7u({6o!6r-BqyKm3G-uj}lj@IeE?*chfj_ z45IEar}Vz zWit1iwTlHg1RWeH1H5J5*lSvnPtd0~-?CXh)O2E!`(Ic^O*`ewz)7Elnp{JtRb_ac-3jwkSYr#|~AcHt#Rn*iqb zPI;}7Nl8DZwi(cRF5g%j@R!->&E?g)o2HM8gH6tV{A2TGP?q{_f(2CCSkiH2)O)fP zF2U%Ixc|dajoxOhVpw{hc>AM0eRaE@nyoJC_&p{VLe_I`b?hz#HC)Ky@WF!t(^8EQ1CP zE`Bhm>Tu7Yn`s|L)hwNU1e1F3p(~pV_bEv9A`yo@Kx}Bh{Vz_hV5pc{cwLW|Bkrj~ zcjpm|su-G28NN>R!*sFFeqibc(3BHaK;|w0d33|K#|jH4QEG*ctz7zpS?wK$+g`h( z8(xOCEzCCcQ&`Q5Of9o6eUi~8gv9aPx6ONusFP6D7ZQ}}j)GsR!*e}dX{iPf zCcH@Ndt;xyX=Ase@UCDE^O}|b4~7;NtpwHX$XsBZ&uW|_5MRjq2$c&}6Dz&&aRcUS)li0y?-SS;)1WCL zehnY29~dH$$`&oU@1X&Jx>&&;1;HO<%6O6qsKrmd>wXyeZ!j5umBr8ZSx)MK>z1J+ z4uH3~WXYZG!TfDN?S6BcD{t{)&H_xGY5d-Oh!ki5lw zCCdE-1Gy>*V z&ci*FRbt+5oplRdpPb03VHu!Gy(iw|8{o+@1C7gO@XPwm{QVLf)9i0ZfhIqM^*~@K z5Tjf(3LJi>D~Obmo;+i21U_ah*1{rOJ^N=}E^^v&Dk$j$VO?74J$|I{#-C05N?tqX zUgjZjq8=*LLQ~9gH{RzaDQ6OwqNbU4gjDH3O?nMAs=2eX)r}0ba~%AIHzzky5>S{% ze%n91zaWE-yI(xLIJVZ~x=!nCtLUBNGq=l$g1ahJPz@MpzZQaabI3;|WD&kS6W4b6 zqcDY=^}H6cjCE-do3J*_XV2D(?5bZd$mx`MRHwC&p(K7U#_}oBqO8tW3zKG^;qpRh z_t@mx2O%@OL|}{J^_zJ8)tj3)K%1(U3 zg;R{6W^ko9?!a!Lmx;$GA3AUSM+=iXmYLnf5~DsuNI`GKX&@jy$k%*24DdkU2;^ih z70FK8el_syiM3Pr=^t^qq-|6!84X!_(#r! zR0i=hBiVLy4a>2tyzH#YnZn@dO6R+T_+Bk0F-*!76MAO9!uGL7B{&fOK=Uw=S0xJa;)62cl8&!*Jx5vOAax}$S-9f4K6RU_l7iHrIB9mp zGD7-D<*BtEIE^P&5dfPITUaNm8K$%NeZT`5jqZ7ghquN^Fiw?7RTp9-ao?ubQ?Ua? zZS!2cps|{{#(uJk8g2yQ`Fw zM;4B@@HLambbd&{ED{5ygxtFF37Z8b8O&-U(REthh=D#1<4_8STu$}hLtAo}p^{4d zarK(23(#LsYCueWI8uf(jH6qR!4#bANs>H2lJ**1aWRH|0r)w&q)THycu0!5ro9yT zX~@mko$Sj zw#L65)?!f_cF0@j;m%991&o1MU$9n=i+xqAsEV-uZQ^fjBy^TcWyF6oI#QWIsWbGo zhkE8vuCB~+e=i`KvB(v1RdYP|ZGN`Pr5pl>V|<5+`up33x)|MOv_vep-Ty?DKj*() zPw%d!Ljr&eN3brqSFw5{ay4SjJ0B<-YRU2_{H{0*-GZk0#b(uyL8eT8x!Sx{D82jh zw6pnDi)!rwK<&8^Zgz$7%zi{0F;61nOcLHN8S|HJP;nq=*b%3F!iqDT(i4@)A@%Y zN5vPlr>K<7x^}g!vQ|cV8$3L#d*GfG&#-uqte2Ia}LqcGZ* z+<-fs@#=HJ2J3Z&woV-r!QyBrNI)SYdQoa zOr)kQEOE^`c(?9#&TJ8%wnYs%`u9S?I0jv@^CzJyq%`qG3*w6NV=X%KdcVh8Yl1s>S>>P*qF8{crGl&pu9vcx%pO`8BtAzVx2fZW)0dem+cu|GSK}lnEgQXauewA z`sCz)Ubz;$q#oV%dqZ@5ricGu?fn1!G~hoKy@Rne3@0}W5fjmWy|lCW|HIZfwr2t@ zZ8o-T+qOEkZQJ$}JL%ZA({VbsZQC|Fnw)Fq!+U1t>;3^%wQH|?ZBPOLGdDZe|76a( zv?ppeIFPnp{)5wV`JzH~Qq6*$GF)w;>y4%^$~8)Ie10N?<3%OsB_t6!nof{#yBtqu z5c`EQg2JJE_w6q2>Y))MoXmJ0kamClZTtGi(fMu&`JXvxV1otkKXVY!&m1(c@wnnc z-G|={7_8!uNU4?H^NG{|ggjzTOJvzYdiyA9?@?ltdHNES1}Z|7{$hq7OiKVF)?0we z5!d`+OYKn6BiYslhVv^+ee%i1P2Dc9@YN+NKYD%HxCvGQcAAS2a#xsMlg0yHn|h=| z$eEC4nttUuxq!Az+}XA-9A9A!o@HL$>xrraV4?^D2x46NA@l^kc|W*)+q1>m{{1^J zdAYO6#0_aK&G`V*2D_bl^er>kWjUpRDVubhmG;Dip~2&2SE)wwx#z{%lMO`>i6&P+#ruEl5GpMW5uk0c7`jD zQ=xY7W|+E{blEp56cUNOy&&!xhvdQR!6&uEeu644+ls@^i9%y7>gc@%06NLu{={{N zF6HO3cCQjrXqf2WEA2$*3nc~R6U6}dKr^etswT?7Ia|aH34>D}m@QIp z{AixGeV{Y#>vroK`I*@UK;}8PeBtOIHEdP&1iyO`s8L4MDl3u+`q^scpQqdpIo8rc zNz^I4Dz^xbVrL%oE~+j*jmjviANprhsOK33uqAHAJW6%f+~1qw z1RDO8iL^^t4^(G6z?PZZn)1vz>9I9}zs!_kg^=Z@j+KFjP8(rOYiR!nzBNXqfbfEaF_TX!2nb=Zo%TYrJ!$4_|aHA078McVm(>$$pdXmwZtn8 zs;tz&Yg?X4`?N`E!-gt7BH0Bq%)E3oL0iGP>V4~QY+vSv8M`VlV*Q3w%OnqzS%#s$ z#6G#go$8@xZ19P8f}ZgA)*3h~2L!I|#nn^=4U?B}EpW*Wbs3J>qhUych#)5j+w$kO znoQ+H7r8Sgz#@G^oR_#}ea3Fn9}4jajFLdj%Fe4QS!ep6SM)1G;Z3tQ{IPzOmZY6V zsUaJqS)V>YUE1}FZ#3xDn&M}xsiMNryxvZIb7jw|T(GCB*>+bwg3vm(%Uo|Ybn<>; zM2piESVta#D14Ch3BCWTIO)-NQo8;X^xn9v-o}y_U}CkP83puG;VAqj%s$YpKxNIw8UAtj@GMT8GJ;%_r&|dxNH}(a;UD=h7kSVMBh#>PPt8SLO&SO0 zn&gQGfC_u7HQuBA43qOK4xws%^pPO-h`o^iXh%T!GQ^%-6jCqpfc^;w0D_&}1TqQR zJUvVlq&p!Ykd~~adl7f!o$S#`Ovta;N=H0}Jun zn1X#AW{=wwewF#b;l#Ip9ZzEOqcJ{sq&=d2=S#l7HJ9~bf$hozJzoQ|M8`xRvUwA(Agr`|6!EN@+f*?|67T?p z8>=vBR@skdF@?HLv9?yw(~m6O^BX5SP4B|mM>k}mvK5Jpivfk*m2GF?&3E3{kCQ}G zA|Bvc?51j6R3y2H7sRMbwzp1~f*LY7LvKnA3#|pGrC#_!Wv{g=#h`_Mn**6cRDU6X zaRYi}s!BG=giO^h9O0UKn+O$1Td`s0genCMYrrL^oe8pRHy0O-2Yi+Z(SeAEmQp6Q z6|XT4nluiJ%u}P?DogA6HPo|R4iP(?e1ycYZ*tnkOY~EDJsCitZ4>CyPT>tp^c~Ct{e%U%8KAYDXC)hLLrl8 zi2{9-_SsvPX~rb0BvJFEDT_dmu#@BnraVDi(%mEex`i*6a^Q6Ickq5{chL zBI4>w;gR2X#%BA-ZIxne)PI;1LISMB4l#$UAKl`TkX8-cG7g>lnjEK&X}ae*HLVko zX)J{{1y3J<=FS+7EzohMn$MMOqa3u<+tO^*jh$wjqUdpFp^n_vCk{I9-^7cLK0KT! z$nyMt$wm;`%KjLv@9zjS|>{1|bUexXb ztg1bbi3K-Kj77eaO$F=kz6?;vVUD`#XlXX<@DRRGT8b@U$4%qHMw21fDJn>>Jizm4 zj@~*asfE}Gb7xe2t*IgLK?_=VcfM(=QzHHi?J7 zVw6kLd+@|i?U^VMp(H;w9sZI){cB2Jgjn1oAFt+>Sb)INY4s4&N@-^&!;JsZS919h zyf{qj7Z-y~$;qxStqs6!Sn(R4&@sMx9~7bz+7IWt6 zrFY^NS>uMt0rM^4L3dD(#ZD*Wm&YD5CCv`Ec_$>Yu=u8+I$#-bxI5AO`S}%^u&dv; zcrSWi>-dmQZ0BaJ_t$z9{A2N_6vvXNy>O9xTVTYl%7`f$>NFPE`L?u`}7re_yS zsLuSxq`*n;nF+DRQgUei4Ly2;V(q^mk%n|XEAE++VKoFbl{t{4sdOfI53t`uIE)68 zxGI%vpu{AUEn;~HFZ)Hb!cPBIT7Fxl$OB2r;EXJ_Pyh^aR^-fvuqbF1DhtHAGjyr5 zgqNE!%G1Ae_HYH-GV59Ayyk}$_kxi1odc`TH6SKK*2jH*DJw6U>rZir1yd1Ef{x6j zDQC(L!R4q~;+%%!QE>V*mrX#$B_Li<=ger$6h!T31%WTgTh340KAQLp3^~XCDbH-9 zL+Rf_Q32eMfDqIvv0YtcE+&j0ok^XNaj%<>SWng3s1wFU6c&>B(N;?A^OydyJhmj7 znfl0dV68|k1P7kQj(o|komY%<@G`;xzajhknICQ})zP@0q~R_Z=lrV(;6Vpi6h`16tXfQ;b&K@j_0bwdMJ!! z8<4KBp^a@7^{(sUT@p6v6&)0y)3fgX)o$&M_za%*_OHjj^6b1M=?HLW2xd{5cJDq{WO+Bd9MRd}_;UO^%;?NN zpDlo_8M+q&p&wWhX;k6v`aH902MtlA9KwA3l*Y$wDRi9t7~-D={>@$XwhYfVXcUCr znykMml{|qSjD<9?br>{SG7)r8?gKk>424Qjc6<*>m$RMp+H-78JH|t*#1{U@68~X-$a72 zedU4!b3E8zXsNZo$=%*oyz1v|vzR$IvbEPC_+h1SER)0&D4=`qL&+wE7sR+cP||X) zmXGDv`e;>GbZ-&w9OBd3p`_1?(}VL3_CXDs;ox=nB6K}MNeN4yIOepjXcQ*`O!a_v ziITFZDKNS7emz1@=hTWJe|k5_`9<$JOP)feDB3BdTP23HGy4?G(bnrr?7M^0XIuC+ zPTifcsBPPE2CRP^@RS9@5NCEpl47Hm|G;shMyQMil*RR)3<NB)QKq+1bxU_vP3RUO@pP_J^QstM7KES+S`T z561`yctg)M-n8oSEic+tDOjE6SP-m)v5?7u^sPOVJo-*>bkaN^S@Rq2^sbn|q4u-E zhl6-Ykb&(<1IHk5&^wk(YlqyqXTIB%bRzIctH>z?z4{-&m65VWw0>9j6-om_8kWA; z|2P-=SQM7p948 zqXkwq#d{avZ)xYr@XBSOxg(LnY+xNn`%0tp`2w49!VS}~KP80r%9osZER+t*R26G} zCGaxYJofW8c_o-j=a~+?C%6HEqv#P+Jy<#+vHG@^+~KG@3P7~tfu}OYT_zNxBvbNn z;Taa%PPW+c!I2f7qI5-vXuEv^usbE+t`}_;GM&2!ofD6}Twc0D3io_2kn$JX`s~c` zI7Af4$okGz!xqd6i~`5HYQDIPv&8dFF&4COk!>0YjL|f<6Y@4;yoFSy>BvemM3QGe zsDnJ8EjVl_^JCM=L(UG-78wXSO$S%ZjwF@=1uo9YlXs_j^x{9h8xW}UIxix%wd7wQiX^;Z`ZXe@m+Nf6hx=j$j2-?$pv zOtFTsi?l;Q$9U6=*HS2X+c~^1uh;S)haDJY%2)70wL;@>m58#Lo%!CGvzwKrlbxO% z|JSh`Avq;6E z_(~%O4}V3zp**UwK2#GEW0aTCzeX6M!e)}ho$#VW5EwpN1AD?U) z0Ibb3g@kjyipP(QF>k@YhNo{mWq=(2w;+2IC6$=Kas?FHdFgxA^*M{w0gHrft&4!p zHJOLtUwd>l*(7A@gi)yhpT)5zN_fZuQrJ*Pu#w4xZ3{6uRUI6URlcQbEcKGH zl&bO7ieKO}9rA=*MMk8Q7hK_^BJYQA~^Te1BZUIujQBkx1Pwgg8E(6Jq4vvg=>MAUWN~C zs!30xkq@Shg#!|F#;1v*M63s^%|?r8f^2x!IW?VvoSnQiwC-Ojz%fPUXK_}t90*Yf zsgb(Wos<(>pLVX2L7jM_J+4{E&c`l3eT?G{>X5L~Det~2aIQ4XmDovQi~Y;DXw%N_ zv1rjCYmGa`uQ<8HR=P6mqDHikY*3n}dh<^eHZy?XGwen$l$Ks$$8@L$qktN{4K3Bo zXM4V$TYX32!Bj^W;4|<3xR1|XTC+uJ!#2WhJ-l+&FsC9(kt{o=K+WkCC_mKDjt&GI z>H7Cu8C@ADANcjp;+w_0+}?dlGIPoCXE3nq`HTi7Cpv~j&^G^Hc}WWw%L<4ZwT1V{ zwWz;1L-;N2jv=CA>6!3kw1ZA6)I5L8Z&@qQW?G9b^!nVF096qVdxt5l1AGTZcnfgz z7KD9X#`GvIJt`5Jb~-lQ)#0qCOxQ=^y}&Q{FA;VtO`#lbY7>%Di^D}m12nA~^JBk7 zy!+Z^jh-qS^yxD6fOF^bQcL*ZkXjW3md%{1-J9hqw0C2!XGOxB>WgGYKv)_<>>>`j zK-8mguby)z0Nfr{4ZQZfYRZXs@_Iy?D7HpYLE=p{kQt$-QQ7b_vsfdNhS9|8oL;I_ zj`u&8^}LP|K^7#aB$w0#A$(aFFT+wK`rtr@#R3Av&0%1t-+22mq8wXV#anWw?h_=e zq`Oy#%DcvfXtHUg%2w*iBCznTR>m$#G3V|A7;!Lm0BMp7GxH?8=4(@N5zsImF~qI! ziLV1gZt_UKd1}YgrV@Eq)=w*}N#B15PTC0814Gn2VP@#dL$i)P*%W`wStvRc&{nyy zZ)ppe&gz^EV9U~efbxB}>vtFh@hKIyhj+e=LjvT@D9Tvu-czn$boQ#xxQmKd8wzVA zbwEi`fa`CvIt$q+$cvi@I;9fE?gtbc9u%!{_~1D!){{!4X3-JKKQ6U`B&x1fjy@x^ zE}MOpJig{ueb8`x%8r|v?7A!|a;?f1;|zohWwU%%OY!_V>J7E%L5QZCB4Rgd5IxWc zM@f$h@_5)n5s=hvzwN-1I*y$o$MSK!Uvl@l0hM{ug*UhrvV6LtdaL9KVHoq8;TM!= z!d;cbb9+I;j1z?l3E(89gVpSJl`m0nr#B9oi7EUod2Oq>v-+oqxlX&9?$KQ8!@_N-I;lBq_LPWS?^0KDhA_r=`f0}aM4>N7U6f*?O40h60;rKF%4Pw|ZVGOj?84y1o{``_HtDZBp^ z9^=Gd0qn^`-#Dv_qaO29@}nwKVmvVKQ-vJ(uK(T@D|lr1Nh&L zE3MZZu$@*!HKJPUGq2FLmu2KU-oeln-#s=A{NP8YX4c=ldqhzk=IcFP;^D+nr2Me* zJf?sEn;Jc^jB~N1vysrw6P$=*(zdc4uMOGWmro%kEO)dSA$6r0G?cElTN^V{nwzf%GRuz{~MsyKU zYwr)7Kz6$l%?p~-yrMuK>1|ka{+;vohOUC?a;e1Rd+}6L2SQikSFOJkTW>?7=04A3PYQSbCr&+THan%#N!XR{ldpjWpU{+Pmh0U5xY9*vUz ziFPa>!F8XbXzy6&(oj6MK_vY86Bi#8`)E){+!w(jRm*QHxBb~{!>g)>GhtiMj?vu} zkzH7-OfHd*foO1?no9lMfGY6`cdwEytH_5^H6Lr4;PDx zk7n0;(dha-%2RymSvHL(o_d72X0+uh94$>45$(QpLhc^YdOi^uv$jh9KZ7$%+TI)} zIe?jq^S@BHEA6ScO%Ay3{|wIVVp6GehD_lgb^+V-*EOd`9(FJDc!@FwJ;|>oZx-%+ zSxsd`>8s0{Xio_rlGZJ6n?feHgluyh%*FPSQx}wYuK{^I?kjn@nS_8dTqZph=*+Ue zRs}cNk?^YsL3X*rf((FRp*EgijgvYKgPI|q;1$o%54gG&0Yt>3mgedGBy2cQU*e<4 zUet%;WXk;!+yG*O2e>qg$JfWnq9TR_`x>BbUyG9?pJez4?TQ3K3sCp&ueV2=gR6ix zF42G%3yOIZ3m`kzo+uScedt`ukIwlg@TmB_Jo`eLl^MB{`B?zxH&tal>+46w9kJ`@ z?(5sl@yqdnzBK0J!$$bhK^h%yd-qH8Eru?qQ1#%%sCVFoxI@mBu^<#(>Mm13`wjSq zEsV`5kdYY>TeVXc7VSX!C~s2xZXyX{++ZP5dq2AOU6PaCh$>uS2~cIU4Bhj^n#Q07 zMDr{@9IvP&cmW`M+Q&d-l(dZalKB{dE68#8{p9lR>F-}3(1Pl0+cGU<9@A@(WD5Dr zmJc~I9(U)^Q^rUG5X|MCr?z<*^%x9rCJ4ZkzhuPI$2ytni!-{zaOXk74^=1EDE8wy z>I@CoJR3!0-aAL@zdPPAV$eMzYenS9;Gio1vam|0%p6T|4Yw1yg zYknHwS@UXcRyNOS!ChiN?2!LCe~}!8_I)t3K6cp#<8WhsYrJM_ka>HtvIYs_CEKj>FGGv)9@P%+2&%~`;(3&XF>QUAEIwMNGoGmX9xT@gt^ymZ}Pa`lo1Fh z4EA9+*AIjM)-8mSx&j_tA3Qf{H!cJQ0U`_Gm7 z0$bVDTThdlC}rd+C2tHC_FaeuyJQTnU(ve4Way&yg&F~=EPA~sm7WLFx-tvK+R?EV zHg$fV)^mhO3T{v2A|vF^fe^DSnuSJ1jg_Wdzj{;wmdZnr*O~lz=^%w6nuR^m3SkOWS8PBl{@DAl zpD`!`ZoE)F&C=E#R8Qw<7s-#ilL?wbk-S2OA7obb8uXoZ3?xTTimQ^l>qn)r-<<@S z1WYe{e(QPIeWFzSI`b>%F+8^$LM?exjGLp{t&Ygl- zS*P~j4f^B8S%_0xZw|{BcO}hhrL0t~I5H4#IKmwQp4SHjq`D=t1L?Qf~;DfB#|EDupt}?)xW~T7S#|yBo3`2v(z`xg;~1 z)U!maa4#;O%_FEbR)BE90^a7S?UAPH5-;?iJv~a_ib?lmXr$4f-^p>h|5rO&4dlQQ zJ#(%ym3t-=6k~U;MEN-Iqo0JaWyl+!M@n#zwIs`L z#_23x>^Cq8Uzf?-Gsj4dK2-5>ddSdEe!tFlcO7(@oahj@<5+QGMfNw7Uo$V*bh@!y zjU}z?jrXs%`?q<^k?g_Hj|yx=Td=ko)2O<)9n#Ii+D+L?uZoaTeQHD-AWttI;plKO zm%Hl4mNgF8{0Ks)DO|q6`YZ&ki>FPNhLY*d2%KJlFiX(0Q{?bqU}Yk@a4Tlr0C%~t zW9-=?xPp;?W|7F^K1^Mjj_@IVQVW6h07ZACS46i-z1`162~+%gJ}(@>g9|Hxyiy0( zeA8+jobpa&vlOS`Y$)&!$l|o=V5W1p4lzp0_2y>R`an~M4y*1E($Qd8NMyi@%7mPU zS@+_$oVBfn=*i%}R`*l}0*H9j!p2!2;Zk3G?I^u&yJ9FWh(m7emRK_Mgzlb{>_lyT z*9+m+oWU&u81qFqzf28XK3@lVa$pQr{;y69{)1g{vHmdUKb@GF>%Tj(mfY_j+^XwE z;}$VJ2iqSs5D|PHsH^1ZrxCBDdRrlkkpp@L7`2+{bxK>J@uEW0P{iU0PNr}pN$=G1 zfxblcB)M>l5%*t1c?IrnZmOQsf?wY>NRdnf0`{4r@Np`7p~)gs2lpONAc2~EzyX^y zU1h5%cg&6#&sZ~eZJhNRWdr!s`>eMCagZTg$P93jwDlxEAGH1Gj53XZ&)l zP%<7uIkj`1-P0{jw!d=5&!8j^zUl@Xgp(|KsGf!N3E;5FXL>s)xsuBej^tliZg0{z zG-SmE2r#;|H|m5dcVk}#yq2VP9{`NPI<&DGM<0ZD;jg}SV(Vuw?`6l2I!&?jSp1yb zBINw-8E@+g+lCpB_*&58s;wciI0Q+wi8hiYL!b)viLz88&@buPpUSVzX0P$Dax0~~ zQYI*zFp15*k|6S~`7}udO-o#+9CsoEoFdWU$@R+IJ`_vIK$U@qYnicZ1AzK@opmST z#JUaz)F;Hz1X;O(*gf`t-0Xi3g1oWmIKGpvCZ=7(@e9Zha&uVcu?=!YyUMd)IU=0! zkFrVG!X=%$rY}N~_=oSN3$g8DyaWV>UIlp#`Bl3^L4PO;*_zPth3XYd$pR)&Jh_N> zz0p$_ij1>n$htU|TQ*<{a)4Cml4mmscG|{%2?H6Aq}Xb-DM?1~0G3sIZri3yi2mtAI-X;w0je42|{T zq@ZRUO8Dg$Wa+?7+GLD7@sdX)Zj~wj!6igge?XDW;7);s`M03r)aE~qDWrI|+V3q` z&>qpMaOx8|HkEpJo6^2@8JRS9nn(SsrqNcbGSmsL@X)v|0IyuC$+ky;pFDHTk_GB| z!v({oy=wIGeAX8xGeB8CQ|hm^0#8d>R&G^CzkWShd6%&l1Py|0LZ)5XgFgFo{z?O= z`@%Kn?KLK3Ie9#r$$E7QX#swu8zrGfXY--*^K&y0Yq8%$=ipq)%6^x8SIhJU)rtVs zNjmEdz z@Zwy!Srjig6=;oTs|?~l^o_CM-Hjg1*5eGvZI@FRuhBn#d@Ix;g(EhUpCD3?H){oyOtJlz}N?n1(P- z&U)J}s5*ZI=n0$ff6Zi+&eeqsR^M#)(hbX}Z}JdbiE%$1^3@dGkzgaO?LZIZgZeG| zL#?<$%2E(urAux|zqkps*iHzA zWktT=vAwfQL#>gHK~5h4zQqj!&Gn7M<3{fb+hr;E{m4kAROS7Dm9+m)H4AZPgYm|5+hpKG)=w{j5B1eAkKNS;R8 zXbZx=Fi&Js-iD*h)*i@XQ7lgK%Em67x$Z^6Glr#laV&#o-UH z#+Zu+(c@b)O84gzdcYh=1zI=t14BMOyvvv7{jWme`rN-&YrKg8cb_sA*{B?r{@)$% zUGJSKB)We7?~9%OG7Y~pZBqMvW=R4JA{hCvAmd`UX(@|a#ORrE;q8lIlw;?cydq_? z6*=xz!7+)~1JIkXh;6ZOK@e(**VDz7{gJ5a|nlP^huG}vdtXm)Mrvt{FOSbL!?5I0#z zMxJ61J`6qy}+rJm`W#H#zKyLi-r!_$WWuvbhm_T?sm$9f{`9gN#4?2g-i zaU4RNYazPONcqpuD_PBChca@()qJg@&wA4kE)}TZ-qI0G+AcY!3+WkbOMbmGV?N`h zu4T``kS?uf-*P?LXyhvXyXCspDX6yqJ+i|vDM7|)Y@|@1)_adc2@C>*QOL1&HI40? zR&<8}U`C0JK{{(ou0_mfkq_d%+{0;zV|bM%udxQXEU`K}w2L@biuyzN1d`h9n2M9r zlC)x{iX53pJsIVgZW{%OY2)bR7)^IHnru&XAZJm^YOJStX;lVqyhZhnU6cDLPlJ*6 zB(h~R2ajoItZw7J=@{Ctx$SqR9}$k#fTlkKGCYowc{y>9KE(2A$wTF|h@B};(<%(E zC)|RMDb8aHK*Epr#kbncHK|(433Vy(+D3SfJ2H5df^v@tGOx)>!S1Qr4MjF2!b)Wj zmIiT4i~pX$F3>%pT^u_1#QpUZUaiBO+gOinF>|>xmHWuo3=o0PQO&jyNU7rw!TW~> zc&M%tP*gp~&?(AwZM2|jzc0k7^tOM{M+vJ4s_jzSZ_DS%K$y{g7^|PR`c)#_8WvK* z$ztWzGtpMF#u%DA5p&g*ivddgxFy$D?wV64Lq$7#bO|}q#nN{iCGYF;3sP4y;v`5u zU4!k2xb@aX%VPGG-I6<9uAOv5<4rXMz(hUSt|9N;f_BIh=rYG)eNwvw{vw-vddqT) z!-EP|K5G>tQsg6{xmVpU1U8=X_Z~;46^)vQXa!7R37&}tR(vM@*B*N9rqv{tcLTGLvTy% zK@R!)dmCX&_}HsagAelfynmNzBMTo~ORw}H5>`DwAbx|Sye%gME}(*Par~e5z{&bw z0fQ;6iQ1pt(@((Q1GFd#@TA_fU8cbk_ z5peBa%Kj-WB+piJ)$)BhIZ#}CES z%`Yb?1RY5BxOC?dA-}y{QB)rN^FreBWc|=lauc2he3k*%pby)0fBU@py|$H-*nWOK z7j%45&O;c%wG4XXheEEzGtzznx2AM2NOK*)(w&qiR(qX6!8{@>&SJY|^eH<6si?|m z4ssYs7NvN@qdAAuPF|w7?y6Tn?{-)GHC7vw9<)}3_?XG+T zJ`ExQ+%QQXMXVZ6(`GSq9u^a%v$7|8n(X^vHc(5u8M89V)S>I?qEp~?XtRQ$O=R5qUCjCb}mb4&z*h#RIJeJ??b|gp+j zr}UOLaYx}f_m-0hh#k)`IkQj+eivwI7*%)Htf31Y2IzWYG6qWiDQ4-HJNq;=Q$!lT zp&pGzMP{dSKi}Ou^@teU`m6htHn-uiA_^c=O2ynRaW7khv|LuzW%e=UH7NoF1&w1e zzCq4TtO+7V|Blo}kU}mEh^-m;)YCuI;EMl_xA7w35}^fGNT{GmM@PuiESyELU1+>A zLstn=!qiW(ZM=coI6+N!p&D*&;0y?m69eJUEnT7{K>j0~_*$+)Q;^2;&o&S$`cs=6 zni#7_a01##SIHWX=@lPc?s6E4m~%}C7h=R@xiH+*&e1fiVWtwyWu4k zehSV&y}UnpU23|Phb`h%Dc`;xu@WE4!xm~zc)#{1=~Lrybv6xs>V2P0iar}Kh*DPJ z02QDxXhoh7m3Ol|=(48&@E&bd7@#^osGc14@JQq*cXB4bear`I-jn^%nJf?UX#1p- zP-p)G4-mA*xEan3ptt%mf1|x|ecQHFCjv0mwJGvN6#$Ui*zgBVsY(doVYl>nCH!7R zMURvIDRc{YZ?$wTMy$ElnNI+g4c(UKi3{S;xP6%&_enFW_w@b%pp*8XR@~=u6Y3-z zZoNx#;FPSeg(b`tmr|~nhO6o=kfda|z^ogL@QG11HML1p?R4pzVNC=8sl?cE1@N7J}{1-_N z{wO$Qo~8m#86^dAy*RNQ(@2{u1L>dODfQmPd7(yoset8QMLUfAP1nwE6~{(ab~ClF zF6R9sXW7Z@>19IpasQS9`3*v{Zg9iK&4E}IZBFH>Chff%8X3C5Glg9s0;~!_9m7@g zO!0nkLQhwu8gYeKM;guo_$f%#P3``1BQjYo}sn7;infB)f1b zoT-+Rb(`kDCqfp)wA6lF(ew~2b*=A7A>3vXv86a-)K7CG6(m+>67C12`o)D!JKkr;CHYivCdwblNQj($uv}a-^G{ zgA4vP2QZ_Sw;89-KXrSH=+kCHjMUuIjBvk6%*8c)(+amD_?Lv7@w61kt6*2=9ma_M zJI}far~VNHXIR1t_U^+vnU~k}r&;8bPx9cV>|R5*la8Ya zmz(N0B|ui^cvUYC5#23@y6q~F&Sm!ZdRvEo?GqW%YF=QLV+m{OPA4RtIq!KT{11>b zr`fq5+Q_=TuDe`R)e}`~g2v}#>vp0qMhL$^jhmUml7N>`)B3m}!~tyobrsUHbJ=W5 z`10>DuDq7H4gvGM==7*f;e02Sl2c+$9`qEIPe?XBTG@Fp)MvYwe6DR| z71=34VI)QY6|i*WY{!M4h2W;9;7E^rB+%eg(%;9S7!He!rNaIA@meJhEy?*JJHaPe zJ`SR%h4Db30TM(u;yn6A#mgw<$0KRrt|eKOlreu4x6*s$^9spxz@bb^@(s>lWSDpU zA2imRzxeg2K6KwAQ(*)pP_+w~!$-6a_~nb@;LG70*S%CZ$`ANyKwA+oQerdHgHmEM zu%rx!n*AoHVIwE%({V$fr0DILX7nwT5qk z6uon@FXvZKd=X&5+2z7`qw!W* ziee%70Y9&tX+Z3ezmRh>2eG^$5A@?BazPD{s!v8SDfpkL5^xR)w7{aj3?0poe;G2~ z!G3{}FD5A$IAFP>t?HGGY7=E>R9nE^)aNdBj(A^&Y8WzN^BD%=_hJkN;V4s2`B;h> zwJCvA(a6jPHF%17!#vVRe}T~3D9_k5Rg+i10G1OnO~B`iOwl2MudJT?g7bRsKESyo zGC@c$`y}V7_Cd9w!-jq4RIKREJ#Q1)e0jx@N-S4dw#~`Ep7R;ohg$>di<>h^V^ith zZa zD$w*26DU|%*1&wbeQhiaaga-9F{iPRh*cn}df=%-6T5yxfg(~xrUh(#p5kMV0R2Y=sh0D;_b5X}VcJ*dK`>dwEwEaIQ^NGI z#t`-7p;d_6F6G0G037KAM3C|dS708O>|}MEr}Bp;h)SS!Dmy9%l(-#Xc63yj;)c+Zja&VyUP0hTNJU3m0MJW* zh(Gv82_3s!03J0JK#U*QPe-x^rNZkMI~=_1?0Knzvyu1XUooG148 zud#YUEE9A-bgW`I6)V0fEjkttu?r4YVg`*W`709$;y5P=4|ua&0mrb3JsC_Jm;nCQF@LynAuAb7 zB^X+fHY8?%h$MFn%;@Y5Ag`y(K>aPc)GGYr^4NFRpzh*W@5^mts_ME90DgSBfAh9t zQSP1ko&L?1VBnYXO$|ut+2r%7_kJ9p{d%8TVxoKBIr8eL&h%!;v>tsoW4~D8Y|z?Z zTe9tKu43V)AN=v}z0$9L0DFAnG)2TEV+<>OboM$5&A=8N?)3aS7rd>!SvTJeP2vOk zhzCg2&Q*~>`l=}TD8W+pI#p9x# zwJiMDJI>Dc1a#c5#Jb8^*y$Uh+o>@X62U7Cs94;TBG|Sx8S@u&$tN=*5KZ4o7GJ4q z1e5y1Eguw%I65lF3wkOm3+me2&&7N+o@M6T(>i|NbDHh!?5QmP8Vjy~Z2l!8mRa~_ zLfi|cUEr*#tr;v$nW-}{=)`<1x%J?imeUmUJ^lFy=1Mqa2zQrIh^j3*1E`M{smS@df2?f@Vj~!2M;SpzCt{Xz4Q?1*VzNuvcc3S}%kIMpp2^a2|j4 z=~7F6>mnXe*kw8fygl)QDA4P2R`0wc!}8o8DecOxyOTS-yE@Ge!G>_7M}L$trKV58`v%{yl}L7Ce@77l;x%p@DnOnfHVQ0qDbHV@w!fu z0P7r;k9*P{Z44vM9ls`z&LkJM>a9IawBVN3O}tn7%wpxCkfCO8giCwyr2G5fob&+>j|MO4Nc0r1~W*F{(gkRWz^L`yS zs;^YsU>G8kRDO>BA_!rA=^?BoLKs0vs^ikSbDc28j_=`=|6 zh(-t1>vt~?8kRFw&ARcrqL6*)9OW;brU_Y$*T!yoix(}8mz&()i(a4@Od5I^NQn^% zMa{SYfap82LYag5tCJlhP}%WEa%d_1AwBpBT`fvZ2%of@CG6F;e3Kb}5h(F^map7v zXXjaXt?r^(BR;HdmR6Up>gPyaEk%adR{s8Fr7nV6np8&01Ucgdbw$@Gk**)C1X&es zTkDEd*cxec*sACZI4u=0)}LW$iznn!<*BqTK)HRpyVic<%tQfMmi=(!dN>U=2QWw- zm`J%crm%#IbGcVn$a*C%oTv)?269!VOboInwmb0kPV-g=B~J;78LczCqNANsf6tOT zTlD6|%-n923h)wDS)Jgf~B!n!ody@%W|( zU=R15oOoZ_SpzJ=YMWr6ptu%fs>vYeJsV@q3c0tUO}q{H&jL5>VxdDv-l+yuO9Dt# zyk_*@)pA||CWI2z*xDsWI%N*)L;Dm~{hauN&2L&s*|7d*MnY9Ca(Dzyu?MGXFJ?Om z29JJzYh-}qB)!0m8FEK>yO}0v%<5YJWqpSEOQYC^>cfjqSYqR!qu@Q~tlc~Y7?VTH z%ea4+YK@)PrGUUYW&^c#0oLEfN7?xQi>-Iy4lDk)wbR&XoFvb>Vx_dK2wh?ugYIJ@V4^) z=I>oitR+hA&Lv^aY}h{=&|On^_o=67mkT*H_GRt6IDv4i{QXV4LA!^`h5ejj{K+ti z34cM;vUHG@lGYvaIO37fR>O@4Snas1U(XOxaz1qL%tfT8qdgfBfD>eK>4zucsg^ns zr_H+%6Qc&##H8}0P1LU<<2L<-aGgNA5n%D$3v^y*&kgcvn#-y&v|LeLG?+Ef<|uFR zVXmHswQ8c??K$FlM(4kLaB-7v@IM_G#>u`iNcQUyS|?Qw;(M0U)V!z#zAsqlf7$qy zqdVT;8SpqUCTa#jD7yl-byfRC1YvSGN{XfBI}@jAt@@f8#Wa@QNaV?c_?oRor2W+X z5!2xK;4M6yowM%vL@q9qvnT2c7{Cjx9w)O$sgt&I>+EqOh&OjT%%XSG@IL}Uv1Q`AnEx2X?6gNZg{_>=|LK# zVaL&Kj{I?_^Z({m;0!S?uE1wPIl6Jl&awA4_>}n5%hQbg2u{eFHOL@!<`j(1pWUZx zKv1q{5}fT1%E!(X*B6XRE$NW$JuDrP9285gL3K5Lo@Mk+ zMtP54VXZ8dzub8bI>-{*#4FsSX2zrCE;%!HA^`dm!z0FFlC0) zJ#xhC+9mr#m!2v=Q_9~?hPmhDCX&awNJ*I|-{)xYpc`&@flTmcR`R^g5y&I?%QJDy zzo(Nk)o{HVrKysE3F$!=Z=sHhjFk&pGv8nt8|sgy#OUhU<{7UtWtsIMVg)l3L3` zsyvT~EuBK>KrC5gZ4gUgT8=&uTS-4@l9-)(a=iyJ-@82PU0uc#zTN=8gP%MU6&jS9 zNM5HVDH-}%BG&Qcg~=gzxBIij%jD|ny^1Mig4|)G*|`3ruUtr^`bFw|zz>AC3oB!$ ztVYa!?a{tA8<+9Rbh!ud%G6;>V)!FK26eIZ@59LhFfQjR3IPu#EwGRNj+y;Lu%TdJ z+ihY>?c|gvxYmVyxzsSrJc*Ru(p~`9t&{jUP;slYIdS*-d^)(A5$U34BK+4ae&dO( zS8!t{#>Y-X&E1W|W1t0{qGEo^v87kzvL%6DNsxO3dmA~_UWL_&nO)xU@uIAYvVC>Y zLvHs8kRyo_y^N4()qwaulW@?y zHdd$K8G#i;Hbxm}19@Iw=C1t@%Tmtp9bWgPzR-ncH?d`#I8KBgldr4JU8NZrPtRxH z&JTpvH9zbFq@O6p0AHyZ8q6zeBgel0?KL2sw_;DKVoj1yiT^pa^DFb>`K58c}3LH zcEd9qVf8yDsdi^y=yJgt)DYOdZby*Z%CTUw(@i*HesY@@w`$vI_@ox9i=#fQ)}=2V z?oD1PKzzQRT~xAr61&L@Q0q9wysK16x!**yp1{QT-iX?{CSqLeRDrW4G0Sh&167y1 zF~$0&=@-S**LvyAuBT_- zVrO_j&l3-+6TFFtoEBvo9c39yKwp2vm~)8-B=m+^1i$157j-f5`%Yd4`Nb(VuGM#J znG_&(JzRXRD~QybWRP%4Ob|=e2N36wM7IOh?!hEmXZZSCadndioL8Zliv-d6kL^FMpwbV*P9Q}@DAkuse!L4H)u+KnUO zv78LNE5ciEv9V!dMo{7gK8cT8{Z-FtQnql@6X``qX{@ijW!~!VprQ+|xC)N2a+%dO zxi(cL{m4Q0z~`+moL}YO2FSkMq+z2*%WOV*x1Nkkqbp);6#XU1Yc;`elV#{1JV%%p z8|C(*<(a$SG_y?P{v94R#})(e6TwOcH_sfj0mYAYmBy|pyqYJWC{w;t62^m?@4{2!(nY_^!W^9kZzh3 zB-9afd2ToKsVJBlq-yCm1FiR{SIG)=gEN=0}`#<>PJLNio{j2r#TuL4M_EbIbJ6ds<$+I?`3#ew!5V>b-RQGp95A zgK#DNFR@dE^l#V@nTVclMgLaa*s2)khZM_>7`P7szYaYxz-P{&zbjfoFoZAX>FzJ1 zqv$ErW75P@WWk_iTJyl9AKn3qxiVI2As=RcB{oB5YxrRBb+eNjJ_Cykc; zvmG3W4~Pz}5M$osbk9nd37a2uI!AqLGxTP7cF-a3AwVLCsdJ zrZzGvcu2-b*<~NkMu)*w_rDrh)boBf)bA5h@pZ>`eQzWyzm;FouP|yiHG3EwyInci4pEZbn<`2Ed;aoH;bXT9pf)X;C#IAxWPq zjcCL9fJ|bqSPDc#;-$uJ8*KCicz#oM9)Q1Cru%rSoC+@6NLIy{JsWF(Yr6<38=uBJ zY?tKIDb?9G-58+Tpb0l>%k9m&c6^EWW@G<6XS!5IaKQs;+?nb|yZ;U&?4f z3A*7a_ivooN-8;Gn?lfiiP)3YyALEwU6XTx;x9cohkl$wB?a% zZ^vPOo?V7um9(0exjuMjBm#Hd?t8=9EDbh-H1moHFv(O)*2uvE&45DP%HM7vqnGo& zkpl$@gs?upyaVD%7Eh%f+bOz@z&<5_qd>?HIy<2z(JSo3=(yMJS1%sM|0VLn{-1k- zFLEx&{|GToYP42SwIWZxqrZdYt8c(S!@{qCvE#g&1cT9R%5wLz|GjP(SFty@ra9%E z-Vu;fwW4jz)L5ObMwR|T#vLpkd?Djxk9F;K$lu=1&tBzp=kY)Po1MGN_? zVa7EK0JheMl-^W9fYjR~lz8{9SB*LQ!GAp6H_`y`7*qp|uNz#NaC1VRuf)$OSLKX( z(4ejucIN`|-q#K8fvJW0w7spGXg=+|V_a@>KVSC;=MQvwT5MAJl?2B;6jgqGCYiw^ zrY!K`AAHBR-u@ku!SLR3dvr-Xw5Zt@gCEL%e5tzUJ0$ z`lmk&JHJvtFO#mhA|Tt=)5QDVp8n(Oy5Xo%9~Z{wyPqnck&*cM(<-KjsKFxYsW(zs zt{|=P{~$B>gA3aryPZ)P@nIX@DU}TF$XV63o%W<=d;IJC>BMayGq57t3{DHFUJ6ip z6FK=2;TzfTV;Op+&5ua_A>zdPm~O9zy8H3vn-WsH2*9A~F$(y?COn3ckr-wtTaPuE zy|-jayEQ--oxG+lCi-T5%bDbO8dw(%)HByI7GCd&ekl zNs3`8!6QV4UWWpcsunz|vcZ2*Fb!yQnyp0xU3?baqE6uG*Dql*K{hbf%EHXH7o?SI zGZeo~FfJ}Bdl6NPU07A^t@{Zd4rwwPoG<$jm<^e4&BDu9Kr@>dnDxh((kkr6;fp|r zH657zXYmq%%8QCLhRa*!A&*PDKMhjL_MsebwJR3l&s0u@2oQx?mm$K=y9cmM>L~P0 zjfBOFW^_v~sRO>Z25_wZqfMqy{`ZS8UcJTE8~L)YeR!!P1A<8H+D1LfXr+GSF)nUI z6FN1HFqi3}(S|F^cJ}&Eqnq4O?D|fsVUsO3!C+lwTjT&2%w3WM9#l(*IXc7X;aihw z*6d6E=E4aSAuK+}i#{bzZwK)GogZh{Yf{gzrUGe9>yTAsIikHt;Fn<>LS2C&Ye>5i z10hYx03%P>_2a^Y(kO@bcRLBupLWf#VKP36afJiwcsS&Gs-vv@&XBxS8b@ zA$o$Oeq8+`R%kx;kGckxxaeIKj4&)nMg0DALaE4w!opf4RkQ|`c4a@tnwGS8^w(ORP0F^=av_Bq*H}@TCZVAQMT-&#M=ddUBn^`pu%Zk8XF9d9e z=UtbxV(!G!k=bnawQd4av3lnkQy>QCbXZ5J@0&RT#b9pF~(W4omZMFgI5gF6R;Hj~NJ)%Gu z%rhip219`LqZ|LouIC?^xG7R}nmX@qZq zv~zd!HW+x9T~Ep5{>TieI_})}2v1rnV!QT(J5< z_(cHtrW$nzNpnI5Lmi1LMW)a38R(J&_n&%T%|Z z-Mr<}vYu5GtTfrTS>GEjvhqHx>0MiS;%?L$Zd)1Q z)HYln0;rc>Pi*<@6!7X7%shC8pq8C~D=3Eq+GHgm|IxC{>+ITN>~Im-$yFp)=Fs2P zu9K|f+#bQSeBPsDG1>DmBWlE0O3PFgOz)+ZNwj3!s9@+s! z;|1dbNuP(unM0;(LE)}TWl^Hb*R%`-(ZIJgMYs><1`bC@iZeaUalno6@WIuCS8^5R zNsHh?;)++dn75Lr(Koh=ArgIVIb-YYE(oO5yjdgdt+uH5R`yzFgs-pOb zu70JE>z0AG_vc&4=Qr22e)|7KFmcfTcSf3x{{IdJG=7EP_WwHsry$Y^0bfTkgE+I< z;Hv5rr?tN6gu(Qm5L|dXzWq;K(*MxeKpJ_L@HkG~|7%e8LpE)(A8 zMke5X?(;F}LLice+}2#n<%h2Ef|v+W($@S@EvM+uWf=yTT2E1CCG}Z`nF7I1NY|zr z>0sK~i7Ia7UxEqO02`W{9wFSE08bP&&`Flq30wc~RbQp|7i3rS8~l6m(5Y)C&QOs8 z&vrD*g4@UI<5tTi-QR*KmL|ix07I?Rg<2!V-c-`%*D+>EVJffR~v!{iW2Dv!0#StJeX zog|L@X4vXR$}!I-@Z(Q`d~dg#rW5BCUD>zRp7F!{gYVfB zhe2d#X}9#VRhD$IrXscD`eaZuMX6&!&G>-IsMy0~1sfK+@eMJ66=t z%&+><@~7?+m5IyukQp&e~M+(#^R>ora1ZJ6 zrb)%d2wG}#FU7~5DMpGA&*I^D#gjws9Yc~5BZnq(C`da1G~D*pcu!jQ#)ga#fU1jpw=Ct#w%p9_9;1~8WIz3=Ll}^~n;ffV z(hI3Hr^+aCygeKRQIDFqFzPdn$k_WY*2cD{Kuf&|+!P;5hjeL4s`jZv&5T8ZOGi@$7)mLPk9%NY-9%3TEHg%U60g{>9#tSR9o?rcg5K~WoaUcz}4&_^OC zDS=2<9&c2~5f{}KRfo-Ya3;y{g%^}~V$@@jZ_@}I9qg!IIZP$$g>6(klTw{IZv7+% zHSy9BM26iK(T@sGM5#p6IY)Z~t!Z(X;G{U(Hgn7ivlmh?kKynbESWIa2C{x!hl9pnhfjSK+wwdswv=p}xcY z&oleB?&w@;po9JzmI=?f1aATsyqG;9j|--V-1k#0q=f`$YChwkt0tTz(l=>KH#&pnp2gTi_Z=rS z@SBs`g&C#rZ~pWX5p86iPB1M*)@d9sjTSi3Q!T~LzjnWcO;ou}2E-pJ(_ruR1>PH)d3h#;89n`Y>yHwUs!R_}euosI9I=7lc zuiU6aC%atRfn$0?YU;3@O6;rn-)QLkWG5`JIT{?L=ur0jZqwhL6k%XRj0vadDitV0 zfaCXRKzk$D?t<&60`unrFL0gS_Q*fV`q04Ue0bl0xW~2SALogua>%HhCJ*pUJ-vyq zgzuxnrUH#J?n2=%z|X&u&K7JrC(ow)I)|G#M=}-ItCks_c)6Ybgs@ioPj?L}7zYD= z$}S!x8Nk5yf6tLljmfI>7KHyIV9kcU)Pw&tQpjcMxhUpo&yUF5FU^=TXgfVeB8{sf zA#aUFMZ;|6Z88pf6Zat^l>wybCElRsD~eYkcKh$&xp@CU0H0f0pD!Hm_w`x);RImP zIrf}ivt$aD;+w2Y&Nv@mAvoZ=gi^hhsoX~SwS9L?nTkK%csG4w^IXw<8PqP*unZ8hG6%|JuHF z=HG#0K)Rc!30WGX539k%kQhxiaHkw2@S4TkU)7UWK-^>WI?_cnCN^a(&qk58^p(!) zbCyW%o&KnZ#UN3?(@1<-1ulQzT-Z~glUte0Ihf;BASp`w*FzBwQkaNrOWk`fP!ThK zL-~biAdV&JCk5;)bINy?@Asr9FGaq{Dfn>Ymf&r7XEfz>Y-$AyF*S&{97sr!E+;d1 zUREBxx=LXfvJrehR7bV@1O;i{NFvsL30>hU!i{W`ATy-be;Z@@ZLXMD zvb^)Gj6%yp<6m?_r}3NcH-j)<(jJqE>o0(cO%WWytOXc{A3`M1yiuZaPu$RC?H0!2 z%CjO^FZNq~5~~2qW8~${X}G6$f^0r{6loK_RZ(`DbR(nmBhq}vN@EE@f7Hl4KYujC zO*?!wB2b%wsgR9J8Zf=H_`%ym8>i(*qS9zRxUi6tl0T#ZGUr>E1C>J=VB;OW-7qy1 zkw>GMwGKSKzYqoMXUlyNOqH!5Dr6j8Bj?|DB?dUvI!>{lABtqZQ<)?4bGn+bDQZ66 zsf~h^U5i=R6T8gg+$nG%@N~kYpae-)c542VS^WiVDU*?%%^v{0^GnFN z&3%FV4^liSy{NB?j7mB*`S(8x*16#uvzvgZII>_0na{qN+Qdi2=#00e+-AXqdA%6)ok^Yqn*4Z%(srrGcEn17l`iT#6WByj)sqrt=G4|s|qf{#S9%epB&Q7ZjC zOv?B>9Y0aqkoAl)vLXz~u@VJ+ay&=GZP4>e3L!xXF~}JQGz5Y#1<0BeozI%)w=G)| zJ~L@@6HFET3UoYu_ce(mK~!J&f`lQ!|Bkr6p6Vf>dpN0$_o;Qxw^u;bL+`J?uMmc= z`Dg}npT35o>@NPUH-=ndB8`)GSh9F!LBm4%1DUSH>&B@RPur)Qh5-oD+#JDkM1yeO z&*Gx*1JpEdcb(32d-gCLxZLwk7&rxX)&?Pmb4HbW%%hy{%6A!+!r)MzMBVtnbK}Ue z#gGn*7%wlRwEJT~S(312saS3oX}=x^N8%Ig*b(-DS95DLxT^9W@MWE-GJJT-P7Ez- zc!=dYAKzeDM;ZQm^)#(y(_Y_YQ{(Ij+evVD+~O*-k-Q432Zn(nYULEk!bH3m7u@}I z=hHeh?ERR6mtQO`@*Ov@khUd&9&VzgrG~5Dd5f3qc;BI8X_2x{az5?B>O2Z!1-des zr|@B-6jf!Z%d&S-^#LNr4`%Nu5qLL02mC2~ry4bjQ{`09MyXmiHdk>^B%!!h(B2wY zF~=aCp!L?il){`!{Tq7Klb4MYDtPg(5l7N%S^FE%X=NiMGGv@%x1eJ{Eww-*a8^Sc zJ^TJQFs*d`I!`~70dMX~-!D3tl1f-OHKA`pUymlb=zutMc;vjzPHr2AV&7sLF=a%@ z0QtuykpXg%8r8j#l5X-!i8Timt6~4wP%}=SaeXWGKoy)1qa5w1=B-u3<`3HPZfD0- zvPyl`RFZC&`fI9a%|8Nl}MI;%2UYza7lX9hL+&e+B`rqra z;LAr!3iLSV1>A;yU)@mtaocfaX2xoP2t)!(1dy2M@%Ne?K4JP{@ga!vviAnBr-?3z z4epMtD%0q;(fLzrwCxj^5_9sWLj9u7%$#3w zXW@G6QAZ2mYa;DWFu6+MtCVT6!8ur{*g=8llH!y z3y`%vjfG6Te)JMq?R{F<7V7d_g}yLJl#^Ps5!>CUlu^&7RX3rRz?j z*fPXgaQfp}-y99dSPfEZHmVQUXs+A{_)hw`Z3dKwKrf*<@gUJ>LdcVzbNV6uQp@Iq zUSL;2Zs&<%y6C;)bvLgN#t?u^WvMIumc5qj`9gW&{xCf;WZjr-u}2H z&zq*0`hS;L4o0^BzcB`un>$4^;TtZ%_CG{Ok;Zs5RV%{ge~R<8h$Sg`K>8y<(!SMY z6uJsvTs2W;Oc-2|b>mAGl1M7kwtL&pHd`g(dELd{-XDV}^a1qlJnops-%G0b>~`4R zUZ;m!ekuo^8fMAXOo%?i+{4St;Wq*N{6J)zs1JJG`Z zgJY5`*!V>kNGi)g_xUueo0^oOe|ztq=PTK6Zl9?7c;9cnI*(~!n;173KjLKfO6TyU zTQ7JV69;;_=I#(hr+r|kF|H+cOimZd$`u>P-1DaDy5tMge-svxbW=L0^}#Fe=(*+X zk!$JwI`Vt*cPvp@5Ly!wW5W;!b`S#V0n`Cl8xrh`+L{&X;23#h7RIz!{ zrl7*2UzNRJPrvjqY$=%-F14L2EOJ-!Lv zcHR;;kQ!yVke}b1krLK8G(GeMK|(?KMc#h0npWYND7j0*yZmzy{~%!xskJwZ*wiPa zsEaKaE*SU78xe1(T zOG=&C6$Hh&iBljW6IvK`frW0!wU?(f_UxKVE$xYKT0wV>jE2$4rk$Qek zVW?Z5}&98MSRTJnRDPk6of7>|u6XK=)1gDk|BJ>2jeJ`C=N>rqfJg{+aF^%_Bd-gaBB%O>EyG81Gb&7S!(S*&WHt6a&?DB(_cv#MjE z)fMf|;C2POJ|7K&uT?2dLvm_aMl!n1#Ka8ED$FR3GH=a)tgs3D&k>6qk2z^%*IL_- z^ELuer7Po-%N%<+PM(c<^F#?>eIzCDv(Z(C0u4Ggnk8u2u8??)-AD*f(E!4>XP{55 z_t?SxkQ^g_S%@$}*>++i z%Nt!vIsSf;S92uH8MoD@%8E{>V2{_2;!A&Kic-32J9y%z^)j|(3u4jsx*D1$fQ#-rb^~#Yk|7zi1<694z>|v9H>QlJ4_^6KO+=>t z8LERr(%C#5Vh|W*BV+^l#XqLL9(E%fEJh(X;a8RTq8J+YUa>-4U8MV5Vp14 zlN}7zVW=SEE-3=;igsu{dHu>&>S@xE@+kXz4rk9MG7Miwmdb$=%cOtKuu~CX`W+?| z?U%Nq(}3!_74hN+IXs~s4xg|kw2AJ4Z{aVx8?fmU<-M4#&32A7_WN^$gxiB8!-*9v zm@0W0c$!f#?VI;u6FrnMF+C_sqEOFd;zFGf>ANn*T77^$S)SapeZ%9P62dH;C5|mx z?bYAS&sHV|#1FGd2qsTdFU$~X&e#0ILxno&vIpdA8d~>k1CkwhRCE4&yNkgXnt=8C z_2~eUkVd#UZ3XQUdG3nsQ&P1UO^&-Qh{nl}mn=97sgu(~I1A3*D7Z5`k|RUXJxNUy zSwA6$fL36mGIte5tI+3^B_Z$WF0jaK$}7&$I8#n6C6ObPu4$PcA{kAiite)Ro|z=+ zu^Ks2!-ZD%n3(X$Dr?*@qU- zdAk|migK^4!Ke<+@QQ}ySU}oo4(;;YMOzY0H=hBO0+Ao;A`vVQ=G`6NPi{|%;;(B_ z$AcRceIjE|SD4}6cjs7H=mzG=8pWWIElT1xh)Rqs=d6rZOqE3ecvUb@xlN;Vt* z^8`@9Ez4B)qgwD9;tVr3k=DdNq3~xL!d-;v>Kt9EV(d`Xsv$V3*e2fmuwLn}(j{Ir zGRFf%?IgA))rmQuS%crUnWCd}e_+dXZX}Pl&K3S_$ynb#9h7B&km1sWSEW;|De+H# z2u}Kwz`mS76u811u}XTvN-xNB5^K%8P+I~dJoji+x0DcGXWhN6ySLHpZF;x{$3=rI zqa5wgX!=Kb)$V6!L{#MgO*ByROXP5*EhmjwZxH% zuQhC2`+}F|*M$^beXU^N_J;iPyLKpci1pqmZ;%JE;k0uKYq$XG=HHfn@tGBU5fm##|+Ehl4uJP>6Me>h@3{+=A`rG zyCAG3gAbk@t<_B|JNquxQSJ)~76csQrl}N=V1<`i8FYxG-@1P-^qrXN3>g3}kx(t# zy(o0j)a&}y6Z?B@?Yv0>3x=om<0BuO99njavM2JNJjf@AyEDq+dHW`j;|x z_OQVHtlo2M6?}o;Ugqe0eD20yJNYN!4k7jP`VA$g2rth(e1gfu-}$Jm zE%%6;X0VmFES>YGuTmz>{HuHWFKv9z2fSSxG{$%_#DTeSKk!rT!}k~#=h>eHxO@TX zKfL$v;BJY4=i2ebTi|VU8~97ru6FWfucrdw(?e+=gRe7$`dx1}2yk>0r^jb{zo z`3qm;^Yq*L_?vWZtIJ+Q9Vr>HXWs*H9b>0`nx9^n-(SZ!6M-sn0V<|_Cb(@30n#9G zVz4VDrmJDch?Bn%8_VU>Le8^fYc``mOLE@Y z8W4w$TYnWV1n2NDf)#3+mV?9%f+Mi<-OkinMWKD8@R%QTkt~Wxwnb3f5EGvje2pxI zc@_4qoUT_f2yLLcM-o9@+@>WIy&!IIXDp06I`ZcJmf2S{NTl(J@qPn4{}5m+NwVEs+ns1sXU5dA3}3&d@T zoqg`T?g?pRhTTavm1e!irw7N`YeyVInc5iZLQ}eWZbFx|3qroL(c0#yjiMk{8l5mj z0PPaZx|`dTqd(LCDQ*&oJj#1}HszEii%iU^0&&F4s}j4>zGBBSC&otmVaa=hFwq-S zP@BPJl{mp=s*1mps)qH|?uqo(GU|_vcUhibu#4T7Z2wK0m@LhEs4%V&1g4}ZfQOy7 zZN+dt(w`-|r6uucB@`WoA{8sAUv`;qESh|qRD~m=7|slN#Bdiy9i_7807l0GrX(#i z0eyk{xk6)2!$ITdwBIe}Gr1O=3Mx0s#`fAzs|T)%%cr>0-pP#D>{|{EGyzMssf{-S~AD0kVQ7h zqfz79krM1auJ5c3bDSJdF+tdf2dVqUK$j#`pMpSLu(#U3idBJM6$42h--64( zqoU3cw1z}?qcKVt)#^z9RGCdkb>~oCWpLF_z%a(te-nIJ!}2>vm#8a#_!unDSZy5T zm?d9?rs{kVDWQr~BT+B*DoR{zXo^MertZ~(w9^6-Z$dpv9jdkS!(Lj_*Mpn%fnZ|@ zVA}C7u}M{qw&bsHu3c6~a}{RcteNkbe-~ztkpGBFVxXu8yBy$j`x8~A!OME2Bi(H& z)?X1dDs@Od8dp2)4jN^K{xFSw?P{fJ%_-^Y)Ac$ro{I>ZcAr~AcPj(mj%ORqEW1l3 z^xW4E52y=)%5;%gqfTJlrE!y)03xA66H!>oBo1^ys9yTiQjMPSF^sTgG8o$$6#`i! z)(L`LzFn7uzmbbCD4mJ4)+l|4*ZPGd0wKY>^g^I;RqAMyF7#)0*F`%V zkT&raN*F4M;WGY5#)(?lRTrTKncDP8RCl|x1M7z+{F4$>$tp1;6R0D-Hr} za7z1IU8`-yM@&`pp7k)SF{kk>G(gS`U==0F=LUW1KFDOFe%sN;1iV3YSM*4#p)=hT z#_9~-zoITxaQ7sjS#eRY%O)=GvS9t;vTV8N0_-*Ug5rP2cK;}C3FWZcCsW4I@523x zw0B{A%(^X0Q|D~ez*TE3puUqSKZ1DksrFBIZH0IIMrozUFvC)r0N%_i?3s$*_$Q9% zdNj7y7vc02Cl+000&pdP8Fq6fsO+%ydyobpLJbO?qDNP9KhYUx!9a@oOB%o-1CEd% zNsbgyAp3h%YVl-t)htWkqg5Bq3%nA?aNig&LvPBb0`YcHU8>nVrK<2MC8N{FoEfCW zTFHR%_Ci9$Ofz(%vBnFQe2JRx7$nGT$k%nbjf*@_^&1Y{Ux06|YgaKn?Q|?CSWbbx z9Ys%R)BN$S;>~+`Hq!Qjl?F{qNQ=Foee5$cB7YJtMf1M1+oLb!d6X62`eowfbqUnw z6-|7lykibCgQUC84FdwjxpVFjB96y_pR^}x4JXrsyUAHXPcCvKWVZSsqq+!RO^T*t zQfhBqz=#TY7?6Dc)~1?VvNOF)@aHEEf?Zmv`qQKh61dh)NSU0fQbNFg20gc6M520d zOMX9|As?y&)kRN+BZ68dPCkCT1lwj#wI7#3nif!~@-dt5>(?)U461I(QC?&0WlIYL z9~REgK_l?o{rV+Aon|S{)4G0K)jd{kO+IwuEItN81NAgMq6CIvahyL{hY?XJkSpzZ zMA1|T3km2KHV!2$`)g=d0|-Ox1w-u7t_irXTq0qB0z1m##UYPLn)1U)VWcOIZa*!R zlHo>TXUR#?67 z{Esa?;J2A6cd7l)KqidiysdCIQmM0qMaXez>7Hk}_`NBLNpEow2{LSt^+6lKI{*F! zNDr}bj!E8QB$SjW<|vr{nZ&NYEt-PDYvsQ8heLtpwVlZZu2J8`y1)N0Q)){e)HbpQ zMGzLH*8G!i{E;2XTtPW=FW(=ZTL1w)+2VHt;;Q4)OuMCC(*AGiJd--h>^>kq!lSvBxyjzw@9|Ogt~_E1 zY~tC3g5nJQ*-W|Y?3*kYFJh~3(Vw7~ksSdW=YiV+TJLh=?P(KCtk0vVPogx4COT>C zpLX7faID^`yApY=e8E*sowwxrTOIA|z=#=d@TXmSy|G#B_m&Gd#?AE+{ZJ9_JJ3ZJ zys}DMT;uMQy-iO9pKxgrXZ4e20nj2Wx4$$-etbfl>nWLpRSk*X<;c=YXhm(=grHmYZ+sXO)%UF!F%T%~)PPxh!X__v>{>u|d^ld!#OjlMi(F;`pnss=B;1$z2+Da&`s z^d7&SbK^~|Ap?6*{qNu69sX?+?y)WKLRSdl=K8<9pfjiZjRGZ2>Cp!L4h()R2E?rh z|FsxsQ=NT*ppd@R!5uV>e(eQqmt~zsNbM;dJ|uDR6iH=mYfSv~H!a%96k*-?63>sr z2sT6?0T~Hwru}>Ummi*9H&R~jO`f0U&FgY}891S&p&-q+>z5D{`GM_zT0LXy&BNU~ zK_IWi!d|K`GR3aH_P2qrx>h#voZSzTIm4V!uQbGC=vm<*8C&iB{#ZCj0(5lnOr-(gg$E5<1h z?*G)aRyCk>RR47zenJ`%{&>8MEkAsZSQ#%oNI2Zq4*Co^|;`>Hs(OpfLp$Xflg!y&F<_Ljde)wjb={fqfo?>P|`4+9^_zvyVT!$ho6oSIZ}OlgZCV%Gxj z%WjCVu@%wPafKJS+r?4ESN?j9k}>UqWlRhtE*q&muR9mRGD|JY#x&EP%@#=OmCe!- zhBnx~Bz8-G5Fl(W)v0(`gwi7$zfM@GrRgB2c>Mr(!vY*Q2Bf0K*xQIRd)?GYKru*v zV~`d7+u;^SvwirkyEKEo7?^zGPLF=(V$?aPU~<)kiO2lazn65Nbs))24%+0lpCv}? zaUC8pX%*PyrgOhh4&~wza-UoFtSOGTSL=PXJwnIX%5Iu{6X9iW8?lPX5u!m7)j0r7 z@ORd2u>qh)yzr7iUY#g|ePTi`4*f^MC2suKcktpRi9(YrLraO+P?B_AEgPRBdT-U4 zq>LuQHH}4v&3Bh#RbmE`--e}l6O4D;Bjo{^k+nV(_9CFvo#W%uT!Td;G>3x_k=)b+ z{d~h*tVG+1HJTe-)_V&v(?e&8mdod!^MZO?LkeKeti&886Ps@NjfT02WyG3)AKHXE z^|Cj*pLLF|nb)JRI0`Pk9>cbnG4Mi((;$EoGCorH{8Qv0tkQM1(@JyuY+|DE_%-2a5*1A)Cr4L}4*GEna(E)yXzL-U|pH1eagAhIum7dcQ zwpTsz>aTNJ&E>Vu2#7Hkd>OLF90t~0^%kqmV~!5=Dtn)h5WOd)#hY?iWEuY!Z$lJc zocX=>f@;(XF*UX^XYkx(I}(Dk4re6xBMLvKbHnUtL9@pjKh0F5`&> z=$X`zcTW3Nn)q>xA^0SoOGwiEe`K9gaHdh0wqx5y$F^X; zo4@|5nVQpQS3L*&Z0&Vl*FC=g2n~NKVCGDCqr?fcj{RoBEctzw#$~S%8XZFP#;RR& z5==!EmT0&*tMHd{*kD?vC{inrNP|IK>Li42e<&ED=Im+2@`kilF@+zLE0aBR^Bq{%ccU6a%O^}V<^+V&D7y= zAy$SQ>Mtk)Ekw>Wut}__QoztlHUdwk8}KzmR3Qnf&GD-RAD>^Fw{Go-{tFh2}7C+ zfq{#9Pq8WPQ;L)vT`x-O33YYaa475_>BI2USQxkJ0WLQx7uw4el*KDJ@?EQ4X=z4q zLZrLcYHhWl4N?MOKj>H%^s-fQ7P#f?tk_lb>|4fH<5oV~T;0B|agOVe^Sah8>#%rV z>D&3pnh4>G6JPNTcpCy~oHJ|yH`&F_W{-xVq@XM>IrOvVS>`Uj7#=BvvaU~@8%vQ+ zgKYw#o{Oc8KVd%v7-c8h+*mEphb7LJF|UhM7Xs4+jb>X)Dm`X)*hc$dB< z?a9yaE#%y6eNO)Uu|GkU!gOBtqL(gZ5c^KLJ?!3*G^EW3@aAO`;Nj-JOw4-@hApqE z5BfE;sRkA5jb`2pdvvG4lA=X?p$vOJKcU>e{Tx^t1N^OOqMGo{H0#U9_z;owtM(f# zQ|A$yl>(+aWxix?MyI7&o%=b*BiH;SyVh?9+EAwp<50-EiA3^boBs}bm5J`4WOU}j zbBc7Ui%fJH5aRmG4Q(GW`-gd&K`#H<5WCQ5BoMq0)ym=Xi*%#c1>NKX!nwQSYR7B1 zTw!EwTPn#eVlsXI=$GkDZ56PyO5&`2)LqLem&!Opt;5cEkM=SPx*@-ke}AL{iu$gi zI7}uxWJ*Tpljoh9`>pQO4U3yl5Qo>@S7Yqz354tvprY+wShs^XNa%stS~&cTpLYnC z|1pgD?EF;vXliB2k}>LaPB-n!OrJle6vJ`yzR@7r7~9H$R2W5C$J(yVnaG->KwpRS zZDI#|a6v(>+72_mt)_#n*bu$tO1n5kS5Uy%aA&&Re0Aw~OB>girv?)OoP?n3GXoZD z?fYLGzJEf z{q?JsuvuF^d|rzfIShtwkK^H95G;P@0zZWILG#eMi{^+ZCOGLqNF-6W`(`&XZEmO5^rs>nQ zJ5@PVV2Kt_smXJ1k8#{TqcWUA#|B?#^YXfMaUo}ZhX4V5X_m{xQ%apGpQ4R~Xu2us=c#cHIWZ91Q}*8S4*q-UrkD=q%JTy=4JHesi&^sAQOJ21H5w& zh44n`W@7-Wthe&|_eqcOs0#q19~{5pg}#+h*BeY8g<4$y6AGlt3`_1^rk;6k&^G< z`TtS|2f|VPGMQ>>iRLCl52Ih41T{N@n_G|1VP-u?LbMBmiQdPMkB}Jg=)|DGx%@z& z$Ru(PG7L2hEsL6Ip%ZnT2VHRTJ4^F;qtAtzvd5>9wwP)mTc`J|Z%;*x09-6&TIJ7b z0jzl+-G+-wXU_C#OU=d0W9gf+P$h;qe$iR;w`p$ZMcd3B3}sVMVAx#VSlF5V zm(RaNSH_;E>nCHZ@rEdh{)~a-p_Jbv=-&1dF@~jhaarnW-+B6zh9i|+elLqRLxtdk zxAn8q@bU2(PupW~NO(h}*VpTg`ZYXtX8$(G@b*|YbCl<&`}Ymg86ESfLlV{Ri+!L)li7@mW5tTr5(4>l&5-ggoK#*Rl8Dts3kltG~(qSpEMIl_Cni z|Nc;vB^)Ls0T%X>&6~eK#mL*4taAT_{7UJswWlKEO}G{s!s5!HfC+8Y@%M4efI%EQ zIZ7P*$Lue0iXs5)nRTIXUlb<{ZHM^vJ{?C`PycX6*ac9oiR&}?Ay@SO$|(PUzK?tK zqg;kT^mG4w-+!L#Zm0(r=Jxyy75*iyLKxOuU;;pS?W(#?u4q7kk@4&Qt(}ZvYW%W? z2^PlK!`s(~s|@*R*IFjX`$ZBrwOG?#CvVRU6_>~GQM`7P<{ud5A|9K3s+0_zDuMp! zre-QSZwSy-?dU$QG@z~uS*#MT*-YNsGFaw84m^q)Z2UPDu_9XV>ds5W87Jz`Gz^*` zP!y9}a7N3dj*M{=197>CYh+y=li2Xw4If5z{2^;!-HA+r1aFkmIIKfN>AXUszDHz{ zw1Ew5l)I(14i?`PA~h_L5UweAB~&I?G%kJ#0km>IXPXkBBHgvnXI0bG{OtBHIuzm!GoWXCZ{$@1Z773hm&duQ!-q}d~ z0+5Cb$zjvkEV{bbBVDBu%t@+gWQ)x~-_R45)Xz4Y@VIh2*zyUi*izhEWeMLTM4%nr zV8#=w@w%{&@Jjl38bwB9QzJ!OGnUz~Q5(vRNhR!!LmvSj^P|qONqZS4*}W`R7Q^>a ztdyAhwnSS=;6z&Mcy%c?3RcmpPnJTX1K8&ZB7-Gt%j+T{2bvttXNBox#O}ACPwb zQlunM*`bB$)RG;6s?0c$zB#vWG|)z@$_fQMq-z5r!|msz_Z@o2whz?3l)qP-f$TOr=HF3D)4gl#h2TDnVAgQhbQ9z)?-PWd{#lt^<0+xoK$`(^>QnrJN zl;Xm^iv-h&+*z?g^-$PlC`%l1ER@*rttQliudbW zv>yK7qKN_21o=U)3q!}a2h|@uTnovPsu>8C7VLmg>Q*pLT7$Q%=rFppWiVgMW@FQ^ zLCQaO!wtluDR7rqu7G(+DekH=*-^@X!J7hkM0}i)V&QjJ3+4)sh7^I=X^LOYZbTJ= zJwQHahrnVfy(N#NA!DYZ$tU+mRf|kGdQjPdEf#T{bi+~VgTm!j8$g!u{mjohxfoD4=ijAh{A zcapBmpuH#3Z|nNMRgK`xiaRUUa<1M|XB#|3(A;$2XyG!^?VRg%+v9pQSF?Db-;1WE zNXXcn*C`6aU}_PSIS}eiR4mGS`CIq$TFFF-SMNm@CkrU(7Z zq}E?Vs%lMVLWI}KYdX@67*nRRr)Vb2TVhrO^c90z1UOX@EWxAEsBDTHgk26KSF71~ zdnSckla8%^YKxbX<5Ho|tF=bl8JEn2?V)>gW77J4HJ#0I~|`e>E;>OQvSbcI>=6;YV--i8 zH>`WH7=T!~{H{fA9sDc33VlgEmp|2tRq<*N4YOX6CR1T{dLU;4zlDpWmBflKn7#?x zc*X{YRF-+G)D5eNDlK014w47Xcf{td`;*;VNFQd&3i8NB>v%q%cb85BY;Ad$Kr0H3 zKjxZ=xvXKJxH^m2N$Yj7q|kaV_?&!bbteyN5ODB7U#wkb{jlrCkjNRJTgcf)XIW*W)px(`26A9{ z%C?D*l^{=S6z>Z$6e@Mksg}e;x1B`6P-S2hkqU5-tn3KRYTjOEYR%^d5>m%_?LvhGoqsef8mQ3|Ru?VQ zY%VG{fCh=Wn+*LOkR5R~P9i!R>Qp*sJ19wgI)~u@Kt5UxG);*|%>`CLJXwEJrMY6N z-{u+rOp;ztEjaVogU*ZWj=tN-oIbus0*GVBQMiE?ZrU{7VTzLsa3U|^k?UkeXCJWV zJT9!ml*~{N1`|Yo4T9~H&ZcUSlS%c)*lLJ(ehJFOV=NjI!iTaeI?F7jTg}_>H3Iv< zw9Bgb;#FV!%5(dLUZO;2qH%V3(BF+QPQ+YRS$A{Z{$tfR$!1)18^SdP9)7g?sdIAr zOuZ1+Ke~!VEep@^Ch|a`npX783mMX=K_1ws+=)(P-_gtGor-U0=Fb&TR#bLv)xD*? zK%(?=YNy_qb``iVTep!}9g`(++7u}I7J@#LJzMj>K@`o{lxkERKK}L?+!N)gmXBx9 zgTtW+`LotSB6;(b1$Oqf?}9l811S4OQ?PmGqCMN<(xqqo$jQv<3@Qm6+gpi6G6N1( zlS+{%f{SXWV3pWs4wN1;F%^yi=25QQi zBb_x0-#{heV9yq`)uJnU8pCcaq8<9s#XqrLI|Z6?jur8_M}tUD0SoXC0Bq6c?MQTW zUHsG75uu9-w`_MW?j(1Aw>mLrclA{zT}ZDe+akBgXj<@9Pe$8?ENRqh)du$P`ntCF zd#Z8p?5cDvrAB)tnBwEtp^jk3gi&x&Z_io6+h^>Vceh>hTXTdt+m7|DBTEVQ+{s`v z_+&l#2E@H<|IllCm`U%|0DBH;q^s;RB{js5<1n=f1Ai;buXP5GXOv%WtGu4fR+Ew9 zHBxSe2o?;OT4VDC@@MYVmq$|F`!l(M-FFb}f{L$tajX^ewr|hv50gdC?QIC_87vx1 z8RE1%a!2qjMZ;kD?$O>nal)UB*IyAWl$_~a+Mz(k5XmnVX>gnKfQ<~9#G(?Pu%PN? z1NdE{3Kz1^ifJ>Y?4e}5LjHh5A0+lmddnHCp00=wP3Mj#+Z-)<+|7e*{!3b8Y4$C! z5lrL16&S~@*2q>yiVeK0s~80BlfJ9jdw#2VMUfF`;&Ib?y;S^ElMrcdFQ9#u=Al$g zaW~ZurPu84D_%~70QjnU-(>52T9md1*jT8}4SO}8e7i@98rVr*>9M5{b=A`EAxpC4dtc!E89a>}sWzWq zEzy1Hj1N$vJN1k^jETZo4)eE`D*RR|s1bi?XM0rVgm#9F0Upkl;~c>Sj?zOaakY(3 z%NfASZ!XT!bQ&<+)U6XG2e9V3E!CQeUfK%*&!u~94Il#ZK{C_NrQ{SajB5ED&O!NnfHM?pagJf?qNxHXF?0_F&W;1E z<@V;Azz9yK1G|I^e`9Vhk!0&Y)t*!IAt~?E&tVFCejT3(TkuYMwjik=aOpDypQ$p! zYH=>dUKP))I`~VybsI>=lzkLxN>#td?rQFz;QwY1-oV5> zk%EgkE$ltO&UiqL$s3hrp?5 zCeo(@Nlg^PWC2h_ob*bf(5{lE7u?Il@W+>QRL;V`mBM5XhtPG=b9+VbrSn4w%m!1a z&o!0{nhU&@!Wva^S#xNZ$q*k8I`elah60QZ^qH~b#7`$eo9WAgxtobA$Y`7t*`C0p zgV!j64vUvel*IR;b7dzfrQGuoilp%G$700(c~EjqV*^U}l}Osa4@3~1Y06LH$-{aN z5Y~a(a4ydl`0e2NuvbIniA+N~9A(%%Em$EbJ3(DJg)}hdIVnjy3B{HV;e3?@ExER( zI)R=!nd#7!5-6}J4=L9Di+@!HMlZD;|AK;!^eCjDq%33)56m|4&cE`wbzKvaS0O2ULDz?PdOM}rGxQb7%2 zGei|7mm!{IS3@`RE5RVY;le9mG^_m^m7|C;fdRH;CP)yp!X;q^>|z+8G-9^WqzRM{ zO_AJX{ux8jF4TqWSj2q5FjUD)7uw6EQsE|Nl#Ap3zpR#+pOHTBZW<<#^Vxj^f=Z#@ z#6B?Cf3d!!qA6ujNmjswt6(LdLBtATiNPofs)4Br?1XMc(=CFR&%~n_g>TyY9Nq<= z04g{NWCo>$hz<}Ljf!`N;RiF9f$yLO6SKq1WDvWr=ITNTuQ=s1#pBR@< zpGshsPi-!N&dd85#oGp0ezPJ!F}6cQE7I%vZ+6T6McE-$#O51VL^4wzaX?h8S$;&y zzMG&)gc%e;zW{+VohS3caxo~(l7!wT0g#f$M}mm0)1i~agq!q$ZwJeMi`rp|DUl*Z z6DP^2-iHZP`+4$@taNqSeXQ(w?koWWlAjHqU6<^PKdl4q``)fDuXuF5+CHW(0T^FZ zb?N|Z-@XsCubZ8dvb?^sKETfFcg5%Hiq%pJu6ml@oZHONrHj6M)orsdss0jdBR^_z#XNxa1Yu7|$RaqNLx_lWmm{MJ{z- zcM&dq)|a{bzk_jB{&jyKz!!rM{K%}>-5dV7KL6eNquw`+_%>>@;(qp7xy)$zl`r_l zHz?)-UzAdJ=eMA#v6oQTN7m%)0Z^?`y=8zt4~Al4I?2Gub;tDyH$Nl9@+_tmq|3f2qv(e$Au3 zRbdvRynH!Qsc z!WhtsF5tC(=eNEYc#*&T;rnebLioXMgV11Vdi^IU#x`rlYLAenk)@>h6=Ox3e7sf2c*H|QCK9;Jsj+(yOWU+Uo zz(kZAf$Zl_1s;x-?>czF%~9iskuJQgclE;=@K`M6qyZ$h!e8a2MW)KJ@p(MY3h0MC z>E|-BQ|Q$wTy}E)JpKzTf_pnVhZs%c-_CK6Kpp+nkd@-rHH$W;wz?Vo>bi zO#_s;YXBzjlwt!e1@`M#m#{sx_}%z`3)dUy`qqz^O76$;7{lxR_|z+lM`R1U}r0pN=9dkbf=3X7MSE?LS6fBnFTw`IB`61Pl$s2g7W}&O&4_(v3?hzaTF%FVt7hXz2D6cf05~i5?TChlc z?z_PA65*t=jwo`*jWBKO5-E;G^V394v>%zcEP1-5gm);sKR=%2x9a4)@z|-cmKyOu z9N_tZ!M(nSeV2pKVk82+s-Q~I{aXJw&G;^q`-pFfFUGdscJ@{yAheXNi@LVTEDhy5 zD)wDXQ}`scZ2nK$t6Uc^Z=G>hFaqBQThY_|CY(t|AhVC1mQg8|i4~4K2;JHm+zlaR zDIWL|;9Mn4ANP`!HwxhQ*|0HMS?%8EE7JGvCL!Qg2^Hj1j4G7_9w>O|ByG=9{s`-ab&L|}!@G7q zywbH~nQicPqb6h4FQ=UoIwlbrVRjes_cXxQDhm=w+wH(3`$8{MNf99cPPawbACLt_ z%(bo4VVPCi@h2(BKZwU&gC^p+wwmOrY`3PL^T(k`e@knwfn}1 zaEpd9lamZ0U}=z zKn100W)*4@@#cnSSS+o=Fb|-5ApSH3)ZSNjnH5@rIP%`B67xy9$Y=iKbP5;4uRQr} z!bI8_J{z|_BPylL+Ix+XaAwm7Be&NHKqKgQr(JE&l}yP&Y;_z|7Obxx8FZT6$BDSf-Y!O$ zTq~YCk8~^8Nja;uGP83UCZB+mOd#Bv14f=R8OK#~2P=&>9>$qPutDvbC&>JE@kQ;0 zEH&a~+E`2l5sx<4nJ+dM2M9zQzZ>5}V~1M1hL8b;xe=IzJ)e=ccGYb;S6@km#b%oA z2Zf)|*O=qr+hiN7Ped=QAVJs-8E02)g~y%)=mlEOPMPm_dkB)?<-iwz;O&}-gJG6< zi?Rh_&+a%^0sO=g^X8IiB3bz@5ZWSmvC(z7;0@?TLbbiI)9-mOUW-=dg? z(J%}s4_+&zo&;u_mc*i(|g(I9Ak{l0B*X7JN&I-&^KFC~4eqj;UTd{l4|DR7ppcl2H!)#23N0^ES*)40&l>`I>4qw3x6Dr6Q|Rcgfs3!| z!BfoKn5Au(0Q*v9^KEh*O~J^xa=J^`hHeg$%9C_>y59a@r=VZq3YZ|7XAehLL&Vo2 z-ga&Uuyv4L+GNGi$uh@xPXbItESuED>UJG=XVe@(MOtDq&h;4q_*uQ42s@q|A#6?y z9h>lPq<9epb~Dj+k)}Fx5MCwmQjUe#Xrh@~ltp(L0LSG(cO5&Ut+a1X<{tJ$!uH=T zjKG+~VG?;TL)|m!U9TsOgmDd-a^unCD1@q&xI|kVwmUaNt)35lr8X$gc`NjEf!f+r z6dw#4*fY&MD-CiCO9bXz(aQ*(3KGrp(Va2{9n;tY3r_bU zs8<>G0NjLyLp*$-M0~CC1Tw-b=eA@Yj6Nxs66CK3sWL>aOmG)2;y#*BdJnTVQobb*nI$tc*@*O$5nSu{DCF(Tugg#SFr7dqiX?wsMGrr zB8wdAUGL@tD|GqdgmtWCf}_0q&S)?1boXYsjOE<9WZQMS#WU@88W!4YonEFQxo!0k zV7pXr8)SoOZh{5M_uL4#j21Kx1^qBUshB)oe<6_0_Ijct9?(V=`8oE zw0JMm;n;Fw7uQg+G5c(DE`!4t(;;Nw7Ps}>xNBo3t^T`P*4!T$b7Vg;_IW()O3$ZD`$PU}T#Y&6~FmIO8V5_;kZI^Rh!=?m?a&KvqOT zLxm)b#xfiyeUdE=<@<{CDP?lHL_k&xOMV_LA|Zn<8o7YAY`U7U_y*R8y!Fm{OUWjM z2Xy-wbu%ZYC$MMx;=1wLHP_yPoKL?maQ>CB4b;`>MLT3%J~?qHG;oe&JPQs%duceq znX?s+H;T>`QEBMB9>VXYK6|kzVN3au!YxkYu*VR)93F4F&wxvaHy7Z{Q7{e=)_s%IJ)}TSUfFKM8Bw2&1}>QO9ftcp5%Zb05Lq zQu5Tg`=WOWl;8uJv^o;#$1SmO@;0D@6ck%N=UW{ond1ozbG?ZJ5om+1MHQndurvq` zjo+AI(Pk5-aO(x9ZZ+NR(Mo6U*&vfo<(sGDZs>V=gKs`hx8=u-!PH&m9|WyskwHL~ zubW5R_)4O6rN%&^n;B&RM=U(l+_O~0bpCk@EdlmaF*0XLCug&v#@7VGT_H!`%(%-m zo7FjlI}15mA1pKoB%bj_3Kws8*T)04Z5sk1FGXk0uDG0O&Euxg({mkPx$8^mI;ISq4sh$<`aGN!O0L?pPYdm4SWmK#_!*xTJqMV1gcz2$FmhiUnZ1qD$#mPugF}0{0hFI-49-I6p%fW;uwJB> zxTfCDyZ1ya+(1cy-SH$nGl7xD4!s}O@^=uNnvONQ?BKe6Q$s@ z*gYT;WJZ;eNzM^jXN$meTogw9q1>`ztrp}edZ;;WfD+-MzBmcP;)7HsoBTQpd}G3UbLN~y%*8qpYsd)Vn4+)u zJ%2g*a!E=6;GEMPx!~B^ne7{QTx7irIi}i38!)EnON^ew`&7-Tb!>!H!f(~T zbC$L1L8shxKEVWE2T#5*wKixnpXLp$ty9-tw2H^a6#Qi@ObD#_O{MtTrp4;PYs-2Xsn$qYl%J=OQ}l zxMlq{RhIM|NJi3_Sg}Sa~OvO%nA!HRDv4W;(=>$$b^Akh4JMSf2MCN@ateH(PF9HegBc{|bxX3( zH#@e`2t=%juWkV;Xv;_Oy&t%qnGcI~&O6C_;d8 z!#y*9J@c2Hl@B^jzII%00!1k+8SDA|?lRi}ymUbaygtAn7jU8y6u1jD1H2w-W=79~ zTn*T!TwAi_9CRHmz3MWj5pCQ{hb-pC+P7!1>_G+MUznY}(roSge(z=fnHpkFwk7lWjx5X%M7_?^mM1Fk@ zc$=*B%qFPfZuGoBmw6(1pSn8n$b6mh0y6qy&%Wx7+}ZBX%Sg>^&D{34e4o!=OTtP+ zcyM}BzZ9~F)c3HkBWn446xqNVd^E}8#Sf=>M$ZiGJGy|s$|x8?bbOqbO*G*itGY`| z!s5bL3onj5?~WwTbpB{HKF58&5U+Yd{8a&4>&RyXa{Uj8wlwbKzr$D{KjvT|L=Z9n zEBpV#%4>8dYH8Y#e`HHfKV1vinP3FXP``1hBb5-J{lE9W zaZySHCxuENQ!mHHT4a8pskWnWhZ=+#sMCl(KJ;^h@!?-zz8ZkallQr(`GKvef0e2f z#P@#${u9UQnFaiNeW;tVx27Ik8501Q0{)^~2Gy@B9%}R-wPwaM{BeNz4D(yjmmNTB zcuPTAdKa5G_nI_J$Vn7)J1!=aQbxJ>5hrS%4?Ze^wYQ)k$%js@XcIf0Oi3rl(hQ7| zFbug;yY}e~m;=-V;Un#@8ySgY(>WnM_+R^g7Gdj4ljK!XoA2YgOXG?cqpTEMAG6R> zM)d-3C@UpY-;EeEGN*Xz&IH-58kxw7HqT0r4i+yyp_|kut-q_aaB)xyuj?1cwe-1d@d+vJ@2pt z3!OwmaCt(l?4Pij3s2G2SZ|f(Ifi`rT-9#kFEJ595baRJKS_Gu{D)`ooVVJ1R2%#q zQy#FA8v)Ad?d{u4R2qcC$$Bg6-NTD>C|QP`as`+82@zzygm(L>OK(ae8aQ%@vSn|Q zl8%G+EPJPiN=z-^C}eBoP}qazZ&fO#hme{t=>ZDR4dA)^vn2<+lwbA5EhEqJIdB*e z{22af22&Ut?*1@D+I-MFt*?06E7W1_>>j2i}5>>Vm4iKc@%MQqo`>;{;d5cq# zhD{RDcSwzpIZchU`b?gaIK|Wa9K6N*a$`4q^Zl5b3+FxKoE_I|k^xB(xaFGK^xm`% zz&SnxOPzSzfk~#|;v%KcFbl;M79*(MK5hdN95+&Vp1t)``}0;_7-GHU^#}vBdiBYK z9DoxK{di<^CY&$-ooNs#I~sWvacK8zdYrV#N5w3DA*xljACSgj=#a6$poje zRMRX?&y^5_%vouin`tf3)spuUh=b9JT7FGJ5t?Nwc>wz~3w>2^4K($etIp3@GYV1E zc*cK8ocZXkq-*TQwNgU+Ouwq68@Yha7yumQn5bBE2iJQ#3)`VRP7gr}b?LN(Q{+Y& zIk-+c%NvhJC_Vj{wqQcE_Y*O)*UBTA#Sx1SqveaP55pY(F$y#-pn-C;_8mfZW8z#S zdYCwcqJ%^GZ0n+A^-;Zz=8x1L&{!%;&;+*saU@^=z8~Bu3|CK{3gDva*Cg=W-vD5i zBwGS=(OJsp{b)Eq>=t!eHjm@(wq|Vm2X_hJFO#(-)?JkaYARN#`#>t) z3q6}}8oQm74(L_WehEAr7g_fpYY_!Cw|D!&NbjjUxP0MA=It?^cIJ$uqpu_YosML=JvQ z6Qk)n`p@eKljkbNa+FvL7^+~c3p#g038MMx0j}lI7bX`=* zd_-kyHZkc_Yu2v85~X{M_TiDbFZI+S%@c(>nEE=U&=MXNU?5Dm*chPQ46gT~eUo{HgN7Lm;3z z9Sh}Hu~|3KT9mKOwh*g6Xql%=LM%_v6^JA(@Nn7#a^cot)*ZVP$95fG^(Ld96ajq@1zwP?MFWb@ob47e*)GqD>TfTgaj zuWcP9${87e419`aoTH85eYPL1kbtNH2w03As z#CG~pht+R{Ms7;e4-h6ry+7b1x`Jy+^4Cmt?pKHsQ(G-Jrt?KU8I+68Zw7q%g8ph; zql$)C(aLeMULac(Eu8=Y{^NwIfoaP?d?kaJ?BGnFwdsmjxkMk%c-<9M3O+DR)>8u* zUaBuNyObgJHa>eRVD3uva*qR91K4ysY9ErGg-I8#9W$9$RzQP`rBq924c+@5P6eV! zx;$guYKCtBS0%>C?Pjk{bxRdD^c9yHruNWoL!V%#v^XGO6_Z-+iMJq^HKU)i@(#<; zMq3*c;c&xC_XtstKjSd#1P zk_9cP{ShC_bs%q`yMf^9)Pu=qGOHCDKn?!16)E=wr`(9U5UfBak$OipAyPNF+H&y0z@|r!XZz4CR>+1G74@$~(VS5E-aOK9#YeORzkhrri#u3QJJmrL5 z(1kC}l&=J3I!!#!vXs1>xDVSji|DPJLN5m4%hN8LAlKIXC<*&p}SxdW^MUp++!G4!u^osB8kae5%svz7&VPRu3 z6BU*G8LZxTF?J5Rs~J<)!NFq=F0fJxA;}RXuoh)=%)8&!cEghr#9iS55f)kAv_VX@ z$l&WNK)vPLmtSe-sStX4yql}hdUrgY0hp%!A;Yg`5zhw?Ej>F^3K3=?HdawCDj&sR z6^u3+Dj%f|lF9_Q*R~K+{0lVF?|L&66ioLx+OT2ET}qb52Q!^HFCs4yvfpmtiV74z zG2pYH0Hmzsv>IEnd%Q$J0n(0fM7f z&Hr4vdFA^`^N)b0?#TMU&d5YjHyY`a&`N=BtcbgUHD!k{2}U1kC9_d)M>f7$or3eP z&T?(blr*~hF)+r6@}L-val_V-af7Tio4W8-u$%o25j7~fyC~7yj;CE`N;M2<1e~RNqv46*W~#Zk2aneBDpyCkA@#7` ztKlYm@6l-N(kBcujVJ!#ukAqxUAy$~8+cjzz6|!rZVtMhzW5v$XubH2CBU~*_;Io{ z3(OG`m67hqEv&q0WKzx*HW5?jBn0U?wRM4z8%NU#^}N)_70C7FlcmMMp?}5e(`iU8 zxQpcvE04cv6%&W42y>eg)Q6d< zwlTHStkWN~968vjw#Ws;8W1hrW(eQPkW+huMnyf&qZ_OaQG3Qt@w!`_oM4FEdJzo8 zX3v*z;3r1rcb(rKGtY?8&Jp6xmV`#$Vu5*Y@^?y8u0P+|KE~kgerxK{ z;0K@i;_wBY<$e9ZXY_0HGmc+C0t1lK2LVws0Uh5UmRoR-a&T&9DaN5 z?wdn_I$;=}5q!uf!2S>>F@VWuB8=fs#1RNHcZkE}Ep$}l_3O5Y{@_&|2wecx`V-G` zXp`l6nn44>=m+;7+hdUCOpX$TF21=ZbBx&YZ=Sg;ds`u^1A7H0%)598P8c@;TuZm` z{&O^3s2-^<^Ovx^ZL*iz|L5MPUZ*BYextD z{xDk)^a#=UPvYSy%Q2w}h&+Cz3V1t8xFufpAZ+na#>AwfI{2ZNTd%|zqc0D?gwe|OUfFIw+IbEoxY_7Eo~3jWe93M5 zO%CnbH7MaJVRqq(qFDKz;raOzNOck=NHEdbcg(aU!JTY@S+19~DfD%1gE^DSw`T z#y{X;F$)5(IM6;^+)bmOp5p#2+S5(a-%+MY4C5`;TS`Wz^;}38 zwnF+3VTuZksVm}gDO7Hp-$`U6y3S#J$3_h2HGNOkyGh765)puED)*3`?3q>!BX077 zems6*;j;uBVTjM$Bk?RNi>D>THW;gWXPDV}2_fA0CT(U|$l*otgu{DrZs$Gf?Ho7Q zt+I}E@h42fZi6!V_0Vxn+-AG zDr;gcw)iLmG6sO?N&i9Y(6TQtDiFmT4c2&C&4Gko?LKjCzA2q-npbKf!2+*6zy-Dk zuD&L+r4Pp+YpYDn%guqrhfhjTvVGl@)<`;#rx}mCqYs@tMFI_!OB#ItvGzF7l=PKm zBNi$umhuHfj`JgF190h3vAhxJ~qlsDFJ+Mt~~el=Q)S5 z5a_i+-^P#DsaTbK3{}RO6_>QdaP+2P6Mc#A^qwINVH_e0;Iji28fv2dGwJ$aNsAdY zQRWOjf$3{jV=MkjCDNj2Knw{loRwG&$sM=7^Mh!D3K~}YSH={jNZ!qbC%xG2BSuSvr@WAE{0~)O=AS-pZ9Fo)0&w#<(Qyke!;#v2iKw9L(mV4Y>jw11yLLmkrL} zB%v0d08j-11cgr`s5xxzPsVx6Di~*Gc3%lwCxC;kFi&DLGIh1Ukbl&mmt&AjDqB5I zASQ%AOyee1n&>lE8AZ&tXbV*~W|2Ld2ZW~YdU2Ab;(K#repP!bZL633!3s?@9!Rhj zPB=99!qcn9vV7^M7RN!j-i75+JG?Zc+wi3y?pU`34C_T91|_dxAa<~#6U>FbBf=oH zlN`8#`Kk#s5vH3Fj5LW1a9U)-c6m`Ry<{sMGiz!jI@&YusospnO3S(T&XG)KJCvqmJf6}sHdqyL{)x8rbva8GrWkhk`vqS+<`cQ$wA##>o1~04$p3`EdC%R_B z5jN0!`ojMm=AC?ySrOp;!}2f9?jAVkR55gtPi(&q{j?g9z|U|s!}65l(8*rU@z0GDWszIh^UT0ywdfb^D4ehd9c)4r%vL0VXuqAml=s`(s+%M1>x9lI$ z$)IS!ZymYwXy%VP$;)D!D80CvZ@=G$bMKLc{p;Hjc88jVNV<-swm!5LBg!~QL!n?b z63x9mP5k-?7i40J><=Wa(9E-S&D}ls;|&_JOr6eNu?V4L&dlH% zOn$Wvq`xXeM4lV}fe4WYB2wD^ux@oNW%z=KReuf-KbuPHH@>k})LFjVIdynG4>lhlzPEF-SQ%ijind<38;GQ^=Bm&3!qaY)`|FJFo>%jYylJUcRxvn!f3xj&};%^7w!QI-P~fS)#_ zcGsK<^0$bD6soSfH`1j~S{7*6lxt=7HT>+k1|rz%LbK9MRYAIn(T5VE#m>+gY4;cg z%0Xt3RU%tNCk?XMA;pr+Pnj^6w+4I6`!!%P-hiQ`Y2>pS_9a3z?l}BL-ZYV10E)tu z&>rwN8)-IORN`GlbVvB3=)^hlGXqz$JfP>()gR z#R-eJj_-btZ0qBR$tkU1x)1?GD~I~dyiKf8JdaU2{M9-b8#mKVZL$!DpqDaR2HJ-X zM0XMS{m2Nw=25lK(R;m?Lj|){cbp|qO3U8A+PkV4sOCBStP~1c!y6s)*TC=Ax3!4D z3ney+B|J4u@#+9TIbF9CK-5#5RW~^KV5e5a7?Z+4!zKC%5yZu`z}}xm(Ex02OB8A6IdH94z%W9y9H{&H-dWR< zqS|(;FFqkUm=ybzkurAZTuC~=ZZnN1!zYx}p=5Vd#}efeKKrRUstL;YN;+<`)u`18 zWOIViPBz~kNgsc>oFIR3cjXy+<{h7)KNEl9n4KAC^%~X;Z0i(s!eKHEOv?Gg)5Uy4t+xa z)Ve6&9e3Jl_!}&nPSg8IdzyO8!M3uO*m~Y1^sJFu6)eVvmB>s_9g5HBK{W8I1Cf~ZD;3xxS$Jx zz~hdUCo7GM;TmWfy4Q96C*})iTrNc2e@hp8R&BmAQu`Mr*oaTPdj*JLf!}3!7t|`^ zb7}*G!Y{!$IeP}JUzNRomUb35K{!2n%*<;cd*hp2>C?kmfcJjU&mC~9Np9T-D=}-; zzu!x1MD{?SM|^=Pds-h$q=X#ne?I^aR2{YdvyEbAWJzUu0U-xrVQLMXhuDI|F~K_E z(U^3vl#h7>pLkZUb~%-y1anE+^e?$7G%3OLe){af>r?53rs3GhvpDKAAu?o~-)$#z#Ol(PT<- znuBGEeG*hMHt77rLr3I#ahN_|X_IU|QsY!!W_XW2%ZlwYEEf}^DMddQM`H?yZDk53 zB2ruR7z-%lNyVij9%4D0WGSFQlZYHE(f+Fjbd*4QB2%5=U0DLTTkvpA5g&dFOB0&wA%a5fW_33UN3pKXe*yE={OJZ)Fyd zsTIBQoSBwpoOQO-5N4F3OQ{Z8O6$K%p2JnZ(gr{uyc+wEu>ey?IZV*Cm0Bjq>?qSv zvFt3+l=IF`RTYi%nRX^D7xp(MPjKZd5JY(9aA{Kk%R2v7E}wc1PhLRja!?ML7D_)) zp6NOS%O+o)W2T{F7Felidgww*{B7<*eV5FR@*o*WKFOpJmOP$JFsc#atrtYfr!7e( zc>s`pDGqXk;WxVSZOhT+RJ@xE*TcVlk!Bow( zL(a@ukrvx8fYtD-+<-gr&7xJ0RD+m@h(lwdv01Y9ccF#w!|vIl{G%+omCK-E)nN@) zJp@fNvt(;flLhro=*QvPb}|Un;U}0z*P}~rWp(ma4&*?Iiw9j|gk=+iw^xQkIt1MK zk?k(SUDc8CTX3dc11z%clk^;*Yvi8T2$Is((GFFK|*v=0DosJse z(GdatQL_Y3!fMK6%QF@1>q{<|T7*mOkphkK|A(c{acF9RB6i@L(O*zy{`Y(nMic>J zOB0%pDJ|p?J1{ujr%qoycGaLMN)<514837igtXAfK~6lw3~$S9lo2HAV+cl#BbzFW z#RjhU?`OwqiQ69+B*HQZ^dqC>g*AY+rWVr%t;hvDoOUxZ#3<;6dVrbt$%>L0GGM?7 z4#tj2Oz}nKaM%+L%nr$OIBjzF)A>_?6jTROGe?upEYHi7pNA{|fm$b$hylQWFdJfn z@Nji*KqP0GWw;$8C1#(>${1qG!0a<*-!$Vt`4cEs8^jj|*A4Ub3rN}u%rijlPf<|% zF{Z(1k4S+c?tnPC0? ze15(ZEKM&W43O9?lmD*C`Y3=!Xhb{(WC@(Ha1M?f9l{~4T@jOT7xJ)bDal{d;-O;m zovy?(t(_5b7nH$`)oLIZ{8rQvNRL8N5C!s!oc2lLIzQnFh*>-hnN@rQiYJlF3!F5C z%ZrRSdFrzzVwV^=Y5oQS`hXdtL5f);!p1-2p~)zSl@f?0vhN{tXA{s3;BV`^KJPfa z-p0H3_IXp$y1w$WSdX>_%uue3eYrgk@?gJRUG-jnxhDgjx3*&41-3rfdEfm!9-b&Z zzO6Q%L$3s`uJ9-Qyt@=uroU>e1ze^@zUwWvtTR5AtKV~}jHTKU3u)O7{eQH05rw(g z(qA{+cRn|mySm!}DFCZ|=^NU={Im!<@#sY(6R<5`b4z?*AQw$j8=V4*NrK8xDJLJz zw#(N#-}hVkfalQ8=PMP!^J0&OOE2Eno8ilO=@Hmw)0UTal^!{k6e$b_4a|1=PAhW? zvFW00@nPpAliM}BX(!!TIMceeN)gr}U-|QIa^;`06b;HKEMR@;YZXInjU&GPPBp#; z)Ev!GMMS=d)7;j%EOT&5=MR0bG8M?neh073WCbrS?!33&HNBjiWsa52qD~PO7Yv@% zPd_Mzs)dpx{|{G`jFly1ei8XJm>Yi%OkT=3>*T7F&1buZbia4oievkG@m;uuvv*n^s*d5^V_ z*WGc6{m57=^)b}Q&YHw3$*wp_fC1sBI)tO1o262L2CyUxNMXheca^39-)EMgYSdo< zJ(FwP_T>g=qgN3MH!z5DntH&wc~r%p=%A5IPfDAewlRsJNo2l8fo*iRm^?1HY8l;f z)Nk56OYDx->0_92U49jL@eAplCpA?Po8Y_IIJB8aRX{PbSE)%e2|T zA3qA`5{Hz~(U6K5YU|2l@t8mtBxQdLY=7z80erVGknj{fHfG8BK;NlI;jHfaDA_gT zM>ROb=OZf+&r)pv5T9w~G}@iF412BM#a!k)u{e`R4C`e$OS|vYwdXGm1R}iExn0&* zWSD$*@o%T*nn9|hZ!GQ1OPxRemXac8f&JI5&8_FlEqa<6beRdwZRaRDmKs`PLxp2b z3+T-~vJYU(k4Ef_Y<&8XyW6gAHEpt-fBpGs8JLsz@8lm=UZ|*}W-}Z2=~``(TbyQB z$tQg!vkP{l2hY{2SPk@h>*u@BecdaMnkhOgYT}bi3x~7%fXMrNXkhSLX}c=@+I}3S z^@aWDzql!}aQxc7zTMfF+$FcLey(l71jyWGB+$k&cqCniCAWCGUDB376Dfytz{$QP z=@7Q8k=<{ZZJ_%$Mh9ld-@b7=kT=jauhY+Jo#SV=cu-gDo7$NNaQ(S?f;T8s-ECu$XA4uqWq-^#Oy{A}?&+uVD-2yqW{AaR#H`l4*)bpO^$0(d`{ ztaYYxh;`COx+BN#brDj|4pn-@N20y|;<7XQ)rIn!TdX*|5m1#7>oP(e>ASKd^;{pm!xSa{YZYywi1O)0!_=8o z7}qh4O$H~wGJN4c#@kbWj7z3nP#134e4U|<@W>ptq~AVLF0p&+lURd_dK?qa)<+1V zG>-N#A@gF?4;8QAc7h>y7X|Cya&zCII<`8ol*cFE;naYlhqQctWs7cl1@Nr)nu0uk zP$~m!tX`!4W>t}7pzY`clu75IdtXvU@FQ>f_j>DVcl}umusORRCq61TOZPdg2x(;5 zn*2>H%S@!A&&wn{elrs=ew6pNea+2h_=7kRmz3Q$%K8Hb1QQch>^F#PGutD%`lZ6}C|Vv6Yfqfa}vwpbd3 z5bXSp!eyJ;6z%jzt29=5!)?;9`&Cb^f41ODyTZ^oS=5J@-4w>t!|U!_?>KsOWL#eY z*0zzHI!Z4d3K>Z)Djfh1N6&GHY&P%yM89mkdJJmZrcxkh<2l0p^ZsI6zg{+`5wxS? zwJB8t;&b1moup330zEf!BU;{XP3&Fxlkuwq=)!x~?sVFtE8i38(;w}*okXONt#BPO zW3i1ZRi^LAVrRE{srO@iUmr+mPk$0%5L@Xn_E1$6Mxx6T0M~?rGyG==;&GLOGfg1 zf_w5b%|4zUPMuI%`6%7qoW){A!+zjyHh|X(ojG;W5KLJ70vGA|@-T=>^d;(|o6*u{ z9gV1b{j0PqJ9oNOVBuvsvu(fiocqP#WzU^~d3mx97=$1*1uSTAQD!r|EjN`ivEmRNNEf|04eZBt6HT494m<0Jv5;GlSO?;w z>O*rLTr_yS>DQaBU&@erCF;0L6cm1`erKxSOP}`dAN2x8Y+XN%ojIpu9E9N+@7a8; zUa@yuRu})>0+dBV)k!JeRN13bLtgAg_uJ;bLrJ)lG@7n@RyV71Q(UkIQ?oEeuS5cH zrW^dII~&UFmlaqNrKMjmYFoSAA3wG9`od6sqRpxEpNdI$@`BcTAu4n3%eL8rM*Xq% zbV(3(ahqc|8lJ%!)EsxVXbVQv3Q7zbIK9P=3Q&Gs0IZ#;!Dhhqtm*Y3Km2Qv74P)W zYup|$QLLna*i^e**lr-*Z3uLI8~uLA(ZlQGw{j%ie6FcYcV)R6!2Ml(!#Qd6karut zmx|4Lt)fO-`v(*LamUtjo%!j#!p|nRF)O1*XFBo%Q<&FC9LUf^N4%CWKALD9S@s~V zsZ7L!4p6{hL#v~Y#?D4q30fWXj9!7lvg*1?{yR)`{?()YbYAlM9j)_*Q%k()+L>R zGR(4^Vk9W}5O^m~zQfB;YI*u!l8<#;Ne*@K{SUz4MgDfbc;UUJc0-P>m66;>c+$dq z)LU)bHiN;!__M=dYmwfoH?ufMr4N>EftqFVz;&mZifLnpWG(Dh&zhOVyAF2kwf0JP zWbL(-eaPK;IeP{%L{C+(2l{0OZvyk0h?eVp!$~}s_!^eqq>1Cdx8sRs8$3MTc1bxm zY5@N~kIs?HyDZyN9rud@X0;^fff`{o*2^q$AJDOFHgAp8;fui^Aw}TnaPVS5ug%`ZUVJ+UI^N@8VzYrX6wq$(gLFMmvQJGYHME!y7htZZ8j#;KA z@J+Cuh8K7Pk)!3e3*D4q_&rUD%*Aj7eLyv5ZQ-YPEzGy-)nw26>)-1P*Si`9$_>Dy z%Jq|FPWRWwmcD~4lE9==oN#57@r{;PE{n^HzGqt=Kkp2vtz!XR&YUQYl2Pp~jhGUo zgap1TluKQv^>|%MkB*E{K^P^K%aDov}A^9Y7snnMp%NF1nI9Kqj*iYFhKps zgmUWJP2^|&ri;Kk0Y(Az;4DluJRke2oaj%_pdKTtu?2jQxdMg(Otfeg>HjAyW0GMxqOT2(r^lr^xHvcsO$M#w~Vwv zlaoTzM)LR!A4OP_f|x$L>zzZ@3c$ieD&c}1ks`*vR!G(}thAXu2LBLoko$;#ty5Pi zmEoOO_BOIZA&KX2tmtIElACvL$var!ew2Ym)BAwJ+bTw=h?am+6fe%bHTcwRqq7F# zWlqQ8e6!t3vTHkJ@j997yeDu)(TVRtK10I0v1`@o_tPU|SinlKl|h&Mon#L5b~R%EQ}WW>~%mP&3EKumK0Mr9DH<-mQ^^`ptX*N zpWqpNd|z%4^S0g6N5dO#Gp6mYY4$~gh{gqEBRAwtY8*++5Gnf@f5$|%MB$K%=M$@5 z68?4rgup}4EkBWS4T(e{5nz_AJ#0}-e~z(XHMC?a-;sXu7#bP!UsSh<2-ujx~uN~*}--* ze~xVgw-$i(z=KLMH|H2Qpg)X#I0b|P_#ulo<&sk6IA_9qr62v!KuEveIEKLeL*nI4 zV~M_-;0S_VyqjfAUU5N-rhp{g;i02jK{0uaj>9VJ!^Ki7Q`E^}^H5A1WB6Ly8YW za=T58=b3AvA+ctxB<84GkjY9(TgRKXQaVYHGuW`POV!IKHGn55?G)3oa~)KNL?VA8 zk@;K3V-7s`29#dAt}-d!sz*5zs2ef@hxt6SP0t%I@PMG7DWNHcT;wuX6uyo5j9g6a zR+fw?=rt813a;1|FvSDsA@_>mPhXo{5x9${clO2l-5f`(?XBX-dhRN#;R*R^WNFO) zq(S?72xP7yF<`Wo=}XxDD?!s3Oo>SEg!d=8UI*g$X*3M>e29caf(=Y-OeGMH4(eS` zJ2(mbR1&_==Kt1kD?qc4rU+ZDT1ne%9SUv~Y%I*^s*p<=It>^t>_xHGGp^3o4JGS% z%18ejvzVzhkA%{lES4{4l;XdXibtCVA~qD)6V|`m1ysaLE!pdv)zyTbcDnXr}-1I2?pCb>9_EYJ5_%t4!oM0IVCXt z&RoSY5*h+MA{@NmzK%1#T1P!bJyYs19zOa26u>oYHus^DN!RMbGa=*rZlo$0!$O=; z3P5ae1i;Xa79FNDr!z%EdyAr1jb}K%z*{%|VbZC}K5#ef9f39Hjs3C}MlkxLy}=Z? z>+XJ>bPC3Uo1}|&t$&%(VUOd~?_1w!_A!FH1ibBM3obBuxh0LzN7cd zVkR?RXic37FI&TuaY(!WIFXcvxT3X!Z{}fT2jF{jzN{`i#NwUpiLv)fc6`(t;W}y5 zu7u@1YR!@6MQ_ca=KbUzT4NhII(~Vo+XUI1bb+;JSfFboLZ0;N=JPIrOx@FRh~q_! zo^yW0x0jdI)$aE}z%ZDxJC!-uqjSaL{ouCMGCJ3sn@=LPQfW2LaJve-e>h>$(XQg7 z2HYnZD$&;DT3~TxL1*9%{M!ax4igN&cvyR|ANlV{JNWXDZ;0ISWmAOwp*4DoBfq~b zxYYS(EYTAkFt#NqxJL8VT8S#(IpUH|uo zhbQdQ*ZRn(ZH$;%_m-#~!|-&9SJy%L4Y2JxTqqM^-0SM9UlW=s+SNZwM@)rE3c2x) z&E&+tX|D$qR+~Y(_rS^AjH95gFq#^U_c2y1V6d;vXR1K)PQpf$;Mzt-d$P%;mjl=N z5ofXaORtA|0@k9`jvr$S_y_H)=Nb5_?I5}fXD^e{vv%+g_J?=)*_8NdY;_M*3UJ-A zt$!WjVlnmuyMrOPqEQ>;yao=Kt2gJiv&k*lf>xdu% z|0r!#;O+hTEp;FFu+iX$+r-cD4%iEN;2N=rY9phqKDEy*=`0xk%8}pBwTbvNekjN< zkKKyjU#TflK?LtOIM;x@J7S$}fJOTfI&|jWB#fQhZH(b3A;M57-^+HaLU$UwFqH^ zA>CXtG`!z%_wUdyW7*&)L}+;U7n~2oa5^R~glig$Lmq;22*Q$~UEv_P>rFa0=91yT z>OdX>&LmWT4J~mf_k}I;D_DM)&MZX=drBOr5RMEKk_{~(W8D*gh7|)(URJRges3^_ zkGQki2c2?Sm^h!l0TVqs1{3{H%tjss$5$ZchTFpF6gdq*7(6N4c;K2NddKZ%uAR|v&45UfpcK=m}sLv|qRjR;9 zT1uu_VUeH_TR{-O6U%#OJuC(=2(M-kq^xdTriX0G3`2fMJ}kx_FwZaAfj{rf#Jrq! z<{Y=Xz}|l0e2`DZ(BpH!7e8+6j_Y;$a&}T^2+8TIlR=sA$H7ZHNmGD~cu{14pzV6f zaC?`2&SjFgv-Cp&ZI(7Z!|X`$`{amr1lY7`F>P2-q7DEe$8rr|wg@PxA47=*MM!K1 z0fM|lN&lBJZ-lcNP0=_@1E!2=h6a4egQpq|7|GM}1;i@KS-J|(JPE}ri345~VlXuo zNUBU*9D+DNGfP&Q5aT!jB~0pG%=D#M92WXCAL=weu3z|2j@P75PtUF!<*pJF(V*5y z(7(F_9w51D@|SE0g16a=J2AKrly*TW$-zD0I0mM-a}<%ys+S$SG)4h@1`Oq&|XD>$W# zd0>XbKp|!%OkR-Vlan6(L$UG-1gNkSkj^6?b8m3_v`5pHUPZ^w5wurS=_%@`;)kH$c00vraJOD-S{+H`C4mzr8pz)L> zb@0Xrab$zP52X*_jWANWQ6nzp(A!p<^vT#oW#ti|7Fy=ckhw6`e{1NZt+5g!7epB= zEt<&oV9@`fRM|v?SON2k6*A4)Mg!>SSYCd2vIZr_xU>vt%el1lPmpudh%XXodGwd* zipCF1(ho!ulXk?_L5Xu~N0kUlstvoUGAu|BOPYiClNB{~@4-~0_87p=6J7+d1tpus z(?^IiV4HEH;1P+6p#Buu3u5V{mKDia|B=p%It`ijU-mARM7gMsQ)837I>kD5l~ z28rS=x`dSh>$_e7A(21?$c!#Qxso} z(v9LZPe8u9wTHZ=CH}X!y$^7u*RL22EN|w){7gh(pWF2HVu#jJT9hfghQW@(Cm5QnvbuOmO%%tn5Y{E z4zZ?+OiOFf7qVp7N@D!$& zN~nQgj#6>oTmXb6`JyjbNs=;4dQaMf&tGgfn*kuDnTqS&uZK|p;Opr1eM8^R!`J8i z>$xXeb_?5kOzQ00es%)ew!BVeDi*No+5UGVSjGir?&Q2_n{2fQtM%UK2(d@P7AYq#Wvs%enVY#C4D4BTFfea!hD=(wRS!IKdydfPu zyJEA!Mg7P>Xa!Fg`B{g~TlpK3VRPf$<&^#!MDYGPrSsx3!#8sF`oWfWWU)|cj zB_*W5R{%k9ilKPC%)s535|ro7@t5Syg5w+>93SyUpimIXPL)IsN%y^7Ff@CPV@$fj zPl!UT$rVYUSot>xkLBiuC>4^uWt<>q9V^9NeFTW{XOvqeOhi^*SP>#f+Mb=c*3^+F zS&R;->W>^aN2{XplTM3Dk~s3vKtu9#JM03!r!#y;l z*}bH3H|S65x@_M!)YTb$WMs#%t!%HNIpc+=uX_ekd|S0_YMc>ZRH01L>xHPCfn3x3EZd-n+T!@UeaDjq>-R!E9` zo2qutirbuhDOd$B(Uw0Fi=+F+gHH*(=q>s<(Fbf48>pey15ehl4M*Vfpb1fDL{cR# z?_CGA5mo(35+{eqvMcnbUX5>4ZK~wye9SX3?PtKvVA_0nEox_6c}-hrqDs?pfDqkB z|ALb0za$Y}4R7MWPAb)xI*GPq@>#-iQ!`h^gERk_0=#;Z{56YnLx?J=OpOz)>b zhNvHLXM6Ze2SvB0#R&{40hF27=y}7(u{!ky4PRAa2SJef|{R16ER(Firl zAMf>gts2BpqTBM3rB=j`-x$A^I-sY~upv3yy@P?xpBz9!ePWJXVv`2_@OaBjV<{@u zQ}}YqC^GH;`}UuB>W}VatK5{~-Y!ggAVOD6{nG{?`^f_GCIB7yfOd?55)(d(%tVih z!A4k*n!#e>HZnW`ozNsnR*moS<59G$!zgqovX(bNyB(Yd*tKVBKW`-5UW4R=E(A+J z1~2+pmOB>jR@4!$9U9u~v^!SRe*52SmR;fcOTW7ZACC?YBym1Pe=chh;aP9AoU0rs zk7qPq>QT@L>DF*aG%~A1XTixNuYvcX9|!n~NgZ;$dFqO9;sMopNzS6Bou#~TRjV-xFFz+&;#J!<}7#W^I@iFkYPsyDmf_zd0tXUJkgR6QF0IzJQK zTR&Yp68>VtFPNw-+ae%F+`dqQz7ZuiHRK+u2%dX_q@JRRX%RoErBQx_F#8-k3er$j zPXd_4mP=T`%sSxO5}203l-p8t@;95q&1&O^&fZV|m7yMW0~R|$#DM34;!SGi_m?0j$uI{Fe9#=^ptKI#<`xU1*zch&ro9bSyPB zAkQ%gVG7^Z_DM}pl8FT507FX`-?LGa4KASm#DQl4jVcG~`VA5rDKeE@0X_X}9`}cl zuMC%9gEMN_ooX%N%riBiRGB|C*}O&f-$qhYX3_pel1LxX|=YdI@-N%7h z8sC2pH;c$F;M{V9pVX-|_hli14MTvebbLQ0;!SSbvsI*V_>@sl-+AL7fYI6!*92al zEbXQxP$)EUfo1LhKRvkNyB2K0e6nCkQ$`T3H1mD-H)_f4t!2%g;tNCqG}}Kj&^*Ev z{6Ttjc=iQ_neQ1w`ntXs$i=6%v2F5nf8R(w)=)d}tel<5etUR-T7+q zOm#8uzfP^fuC-Id(#O{a^!^z@J=*KV@Ad1Rc)trf{fpBmEzQtMJcr{Lea3&*+*3tn zN}wyFkjvR*T&_G~$yXtBYAXrvd_ijN7)UXPR|<0hOuFv(bXzwRz7Xyr6ResILkdZ~ zOZUS6mVXK}2WlU$s~8Bq*uJeC&BvXEsA}A(_C!;EiqTh6pd9-SC<>o0OgxnY$K=5- zu>=|Usjgch^@Sufjz%w9UZh!BS1o4r^F$lqUaA~twjE!P5d@2}*9 zd*6;Elc2-sZV&(c zSkYW)G0gI)2eL#BV59`Lf|pJOYKAD5Y3C_hC)XL}ndFOI(t#-6gj@Mnol;1;K6M84 zVx|t+SJ-v_NPZ(MAM95Y2vm&?#Nglv?>{;{sRz2-dFqDx(z95Nf3hssN@&n|im_|f ztok7!L(ZPAmUm<^>B4E$#l@}*%nk06xoZHz-Rfh1qobw`7I~+g z)4Q8rLy$*b1;K%f=DRX6_x>3qyQ9W6QEFh(0olAvN&xbhv_k=kJ)Y6E16I&u;|`N% zo<8%#gN24x?9@ZfGkXl%6pi+2!cWFCag{|>Z1gIEEYsp!09~rWKYhK*+m~yLd5_aw zUU~8+Nb&=?b1_N%QxZ#JvM`o-(0)z#ffti-_znFRbW{ua@AIh^nI%YDayFIsV$2zq zLq%Vo{hB(=M@cXOoeTmw80ruC9)n96ZoZ0aE8%wY+Upv^2Y6p+!k&pVa5-*wCj)q~5UYyL^z-Otng zLzx|?P5lxP65GPUX-OqhhvGs5YzMX#=oW1&@T-T%OSYAb{yuDgci-uAhvkVV1xNke zn{^7Z6FG~T5h!Q+49J7M(jH_Mu-)cU1~OLxeB*Yt0`vl>0e*?S(XMX~JiB)8=F-*p z7uFTf73vB0h1^J)3ef7H#;gipqh*|KzUUhIf=_xn&V(o6$o&&z7hIQ2DKt2$ zt_%iGpe=>W>SIIJHyslD$%n$a2qg%iYo zkV)X<{8R2Y5v1O)qN9qM1^Xx&K^P>C7r4xn{Cl|DI2Vz(>Dt2~IfhkfBBOcg3S1A7 zrhv{L2|8y)9sY14nUu^?R~3u_RVd3As0p?l78-tFOMJxll0UncsyCH~NPlhQ>1B8! zZDk^k2^;6GVaGpi_5WNhCaeJI@31w^O6x%$ErL%3+!UwA?~nSAj!?g<)M^YRTzXfX zcmHFLxaB5IRp5*V(R|_D?W;}DK7rf7$plD*$&(i^2;|T6N2VNU5``wp7D48H8!0~FTt>5e<&#r_9)l4*0TC|AE@?2lPIrg_Ng$=jk;oMR(L78G_)A4--HX9qnI{;@?C%n`L8i&fUp39 zNmGiHaBi4fFn_=89%;V9+*9$3Hu@9s+V|((%gyKM<@@B~`F-oLJz{Nd&u(%P0pR89 zr8Tuwz()U$_o$Rrk8(J-_T}|x@ACcp;JNhM&(C|r=kflUq0iUb!{_tug?-!R{q5uC zh~qJj1mYz<#^RC%3SvrIH4GVVU2xxNpb$&l|l2)kk~U25mQl z6OJJb$!u&1Yp~oYHBs+m1rH07yY+Xwvf|V;G?}QhKtMVCYZGeiFc%%FG{{7dGNftb zk4{49`8*GMlQt3se>L5Kv{arA9ckiD%+Y=42c8~xXf30CF;!qv3%T+uV7_OjD_>Rd z1QmaM8KJPWaDH+A?Gp06;y(Y0VEcsUaxaE8AJn}F8n2B6ukaoL;kpl!-7*rMTCaeP z9nO9Z0|)n7baeG*G?2%hQC(-}j}Fxhge{$k$DbCA0vmGf`Ww9dE^Q>B1ruVR!*Nld zF>Ta*)I|#3r+FGB>>51*z>0zXaSy^vqeQ{4jCIa$@gqsgAPj=z*pHr_yP2aC$gtKE zGmo^^SJ3C+u-JPEzh{SSPtL(XPgn*kmI>6Z8;5OjBs9yU*k{QvL7!F$W}U27>OR!Nz6-|3PWy}p>p4dXU_$2oH21Jw$Ybu( zm4GS#vk>#Czw<24u=QFxfMfgP-QvHz^N1ho`fPX(7TMPe(aALom-OQ_3`2;qjq|X7 zBMxnfbfqfU0i%L4|9`9q3+I2ZBCMRujQ{%_yIFfO;h@cFYo~Uu;Rwnqj04H>;L9IR z&%@N)2%`$6G9pDZ`SGr-XWKIY3>qe>qoU+`CK(QFQ2I@=(pw%kmq4Q3J$u_p+659V;kBEASw5Ni|t1g)R(3V8$e)n z8q5g1h!*`jr__>FGRlfr?ptYcPQQ8Nw}=m2q%mQt=wyNcSu6_hFzCd1aKqH}yhUBw z@uqMp{$`hsg()GUWi>nvYT4|&f68x6s=ibRIAqaDhNuwQj41<~@_8rNgFd-M6YT*Y zY;vXDl3;C3fQqogZ*gMSrp*Cp3ErjzSV)j1W!Pih=Xnbtj_RX<)PUp`*jmq}u;6Em z%_to(=&h#u$UN2;lve|E52X9Pr$rNhk~F!-xp z6L~8X%e!9D#YFoe!{_)IR-r};vJ4D41-vk1>|Yq&00cRwTqq0|vT|Bd1{Glgkg)zm zlm(T=`elm-rKF=0;%=FRsEj!>MqN-kY1nZ%Vk$-^k*J~vO*4>8^v$ZEqqMYUC^JMO z_Bw+3b4uQDVL?=E>!ExH{P^Sk0e8J%yKRGXFmMIzL^wuOq*b~)f2fQ@*tjG=P%kM@ zEtqWx0F0c4&hIN%T84Qt8Xi_dV&G^~%K4$I_$H2^Br=8(9T@L7_`231yZ9m)Hj!P+ zhe9;Jd~~e%(K^9LniC1*$s`c^zc=Mcn{bM#S1ICdr1L{|G~gUss^oUy>}kNdFb)sG zlCaM6>_sK04zQMDazk3snNr8Qnviz*dBD2m0O-=t1aB(Iam*^h6EIPdV1`YQSs9Ov zFrh9%Y?**&Fd2~UJ~UDAM;O-p`T&NcJ~JfjeP~HrTn@`)6^3bL6m0AZSTgtl)XadJ z2<|B8KI;BS+KfYECvXm~3aqK7-L2^M)lSy_e5vA2 zFeXW53wAxLS4nv_>ZM4Z2S`D@^_)4e0imWDav&+#FXHOQy_+9lgqfhU1VMS-nIrlE&n67(5?yCq2n2F%30V`Pz7q9|A4Mu6VY z3VVgnwEa8l1KYV~pm)i697-*t;F`V<_pbrpmpd7{&fH&L2daFw=gBIQtIU%Ee(%p# z8l}c?B}e-LMzMO#apZhv<6}~M0Kmrq0bufUBfxL$WP?n^R(P5Y%P|qZ*JM}DYak*1 z318xz9QV6fivWAUh*|N>fFs$9Ymi1kf^jqi5Xal$MDUB(p^k``2 zrYUO`D<`Glyj>S{I z6GLZ(2VYk1O!!!Cu~>sk{zOnls)#Nx$F==qepyTHyNL6;+Qu2KqDm)EI&0K1Ml{| z{xE^r&2MSLcG@TxyP(~=O_!G~G?4cG&Zm6CR>kJY8cGTGEcH#XIlDQ6ufB|Z_+QtS zI$gMA5YIEBuu7~C=4`mv)^;CP;|4Ud9W>T+dPZcTBoT6I5h{aR{kHSL96Z6fjB|CX zN!w9uq-MAfMZ}N_pxc_i<*|m|ZMue=b(EaxdF50li_tK2a;(@c_xZfUH@j|7c4PLV zT$I(FKEtAz^z2*3K4#i=2jjw$JccOI>sFN@hLl2>!Yd0Cw=%UubLFJAWm>}3>glrV z%lA&_@v)&&)L?ySnrdP1z(7FimjYCaT)iE?9*%|QrO~S>z)?dVdFGu>J*;iNa{(2e z>;F*oRY7%x+tRoMcZcA?-GT;p4elYhyEABTw-DUjT{i^Rjk~+M>z{LP-Kz7yO-;?) zS~XvPy;gTym(?w59?TGVT%_M|$bV0`)ITU{Yr>uwboTZWA_Mnt{rtmL(~C`X?M1$^J~MLMD}_Q0!h7PZz49d%AJbq>XnG`c|mD;7?2WYYU!T z=KB!H>f}TGh4j~V7!s11&KN<-al-8Ti(F6PGefjFB#yrmGHfoyOnJM$%Q7}Xg@22$ zCq$6ZcP4*v?-g2Es(oIae?h@NE6M+A;0ce<&-hw_kD2^YVTBzHh)M1$WEG2LnMHnD ziu2}{nA5N?K349?&Tblat}U&md)T3x7wQe%MG8{=6A`|n8(U(5o1|XWG}_xg+I0p| zJ{s6WJfF6$OrliX7i1KaUm#?|hg*qHd29_FEp-#M?Gg;2A2xHV@gf;qREyUSdK8I?zc!_cpNs5 z{9GcQSivu$$I6z}M;=rvlVa#QU_F?*KQ^8aSFXp{w*d-({*V`9If;AUvMin?m#fXRXHiLtUDB{n4FT#^- z`t=$T2e-8Rmo*p5-t>SW!Dx$V9}E0Xwc^KBW=ujB3jABa?7L4sypxbypLUjdVpra* z%^EJysWD8%m%`~xb)1HpI8!SJ&qG(xx^{!$5KJt zcp~E&TV6@d7&9GF(TiB5*-B&y>Q}*p7tWWQONp7)7)+aVwM3aY)t0cPr2@mJS&tuE zUfWi1l-6P1?fF3@1LGM$ug}v##7B8HDyWoV9iqtQvR=0tT0t2F&yd8TtpKG!%2L(XDL5akRQHRxKX;pt%$G&t&XWuU`3_s0t0(mdqZ=Q3Hk>La0I?Byq}djL2nnhoiz7FqE}Kl^SNrj=tg(R?N9bMfI$-&%5X^euGWOlaqGl_{??)Jh24=HahK}lpW2dll{{Wxz55NKkfid@O zejCm?Z!L>IW=`9XSq*=VRcwRPy>1RIz~^l^Ccbg&x$;vI-p& zv1!*IP5;Jq(d*2puG=ado#_G^eqZzx+_xh~9&UHgWX%;WC<9E~H#Zcow>%1YK%IVi z4)S~$Ha4Zff>_-JgGB<}s{9{Z6R&evx_#pg0}dcHhoKRgvGdADog08F`SGL?yuG1W zITutNpaB zYU5}&2O9GL#Y~e<-=55^QmbXJHP=7`viyzNbc8WUQwR~(R!e}Z`PH#fD8YK{)wFOk z*t?|GhTj*VT`md4^^36gDQ9^iwc}L=N`j^Qr*@jq;9a$-Fi!Q7-LsO2%Lml0X>@_x zp8M1}(f&!#f_TXp>9=;kb&_k*IC+iN zGFml#{=Oy$Bm(7>54W)Nr{iS}&`;+vf~FUxx2O+u&Kgw+quU&Ln~_$pN$tsuSlt00orjTkwfyo3sHM*f`DW#-Yj z6-}3O`SdCtc#16FW4>M9vy*)r(tB^lF?o>tifr7(Zf@rB-ZIKIHEr-HnRxzz=i{ga zh2f?fcvV%tj5_t*CuvP^!~RI=Am0d$?-=hWpI%IA8f${H)ps@Yg};)#(aju|!igpw z&2D)e}u_W4QThd*0x->NwcE>a0Tt|T)t<}NS<1S?3514!Qm5ktwAWu`tEZHG(!F>DvnQye|a%*;|3hNj_ z_tR_4&06Q@^>_v}-KVZusiFzZ1>gpF7u4%CJt483d^hLX%3I$n9N0m8U7AS!YXuLW zMo&ogsHs49W8IK3O1kc^ybNoA>5-i)M+3_l^t)_POHwRS1af>548f^)V*=WM?HA2` zNM>DYtQ|gpsMRmwdT+H0{awgr!>kjz36V$go}-3IOto&e#+J_7if>!;={La5Jlu)+ zuM@_}r9a>;w^H7j&ZUnM%eqaUA$fpaBVlv}oc2Vy^H& z$EL3arm8xd2FjBcox~3ySsf*Co^~j)kSkniP;zyAx@}6Rw54-AM{KEJcYHx^TDaEG z%ur4}T6%ut865Yz-E*(uLh)rVfv5ZtrO@#upDTyRW(HTc$HB@fgIUw4?6 z?vlj|O8JchhXZDtu$LTJ7VIy%$HWg8QGoyW{#3j;l_w9&2~{DS;G(Aa6H}4VnMX;%0AtYh(UZsQ)UQpUZH*J9#PD zT9ne+A%Rr&G^%9~l^{%pJ{Ot{f?Xx)@}tv&7~tBqiWdD%l^CwmHjK1LG=Uf{((B~x z^0-C~`Tm=uGd^Lm-dWhE8TepW-kw6KmKze`AD4Ucu}QK@4wn<|+e5hyi1#rQsp;K2 zbOcIpCQvLo5=NJ*+dnz`JY`K7KgZIz@6{JwiUfh3BqJ~ar8Dp~Bz{_rX-%7UQMgJb zegib#gO_Q@UlH3I5-5AhMWI|vlu%zy8slZJL{X2qBAlGdGV;1le0>mI?F-lwq2qC~ z^3?dYSN_t#dr%&Q`ZMwK5hu))fz^pYnEi~xb5H&R3~6?Yy)e# z&O->g7v=Uii)U>W$5T2U&)n!}>ov$;8369{@Ov_*Mk;@#(IjADSi?H=vf3t{^MjUY zrOds|gf1gu($EfBJ%rTr>~^HO+o+*Oovx1ftjgMJKVc;Z4(D#7crkObn@!NsJMBZy z+B8JCW(o^j*dRL8h&`7KKZuZwEEht+A+wQ$&PIGkaAL-Rv_8cvmGAgWHjR!cAO?tW zxs{2e*C3(G2oWVxPWH=VGyWZ>g;!z}mHI9IJPYahSJkm0Y-|^i9=Ep22ae8a7Lt1^ z<0~9d8u3sd{&H(Q4J6qubTZ}oZ{-&Hs#9#8O-8y<-4f+PgaYI{Nz|I$7z>RQce3J=pis>G>+`c<~{@WCg|#fd`Yy=8t_WDm6Qo(x8oVK)I*2j+)a>4oq7 zNhU0&ou$|gKg(hTx}X=4kW^C+2f#rm#Ze;D{t!?z!}5qT+GhKPsT$RfM$h&YA+e_a zl7$k+V6o=`P7wwhH)vSg1|KHwk2aFuu)LGcY);j? z5vXEiVRG-pXx*-tf~PlG%bYh+GQw12M!r$25!LNQYr8(eRd-_~gUzZ%TR#rf7q{y* zNqo=iHKE6k>NPEs|Gk1)StD|Y}N7eF=W{dJHGy3D|Z zmIN*ZPaFNhogLEv!a?}xON;wg*}Bh|hPM{iB?i>huX9MxJN*~2uOxR~dt|U7Z)#lz zXHt%MzDt7$T{Dn0u(F^-I2h2Rv0=vj$v*IN7*CktIx{91y8>Rgccbaii(&2J?1UUv z`L@np?@W!!cl9Q;0Z`q^Lhbm%!u}8!`B=lgEXeOwbyzC&V%EiSbmWN=i^fF$u$Ajw z+tM7;Ty^doX!w^u?|bWlJ;Ftp_uHa^?99u3cOTud;@iS4L``JZG|QWg(3GhR_)yc& zT6OZH`QAhbSMZI3VcT2EnFlUAaW_W3axw&Q)u4)Ob(tC)dK0 z?oW#~5ug!yTGQ@Tk-mg<2ao@aIv>DqIo?AYBYc4epC2b|w zr$RP(q5I+2ZJu+*1&VnGh7WjhPrTygUZ3W+e`I@Gx>b`k$D4K(#n|#6AGlF*@zjAz zA8h$YOj~_|imUgyMm>_H?(H`fPIzvw#vhkQdTTN>?w>e-B0p$*-IsF46{)I~J(g&& zU0nlku;O+v^U>r3s)o0}ytRJKVOdEVy0`{4UQE6!yl2%e#+EO-@y!%=cG~SBJ@OA8 zgr1?FHQHRf+((>EzhzCF)e7pNZfx~7Uu~bE7`S`bRR*t(4!YXvD+y0Zg|{rQTng_5 zknJ!jy|_O@`edBUh2F_@%sN(Q?_62F%(nr0SwgFwQwHW9^3_Lk0k``>Uh;-dEge4k z(I-&r{4X848KbTC$F)B5J|bk_Tzw^*7p}KG4M~)%9~v)g^~c@L8vI&yY!<7o=J{Xx zR~@;oLeXfo-oVRCwP(J!XZcbBsdFuJ_UAN}enC}aRqrAnhYz@IW~FGj+>v|N)5`$Q zj>*Qm&#tNnnVk|_3e=P>e~q44OD`pf4H_95_NAj8DEqLr;UV-4`;z%!FtIXtY~k!K z==IpNL$+_Z>uo@Li@(+QYt~`i0sM(7!A`}btyc;2QLP!-Dt~G*+J+nQ;UA?9v-#1L zDo|+UsHqLftV=HNZ_Uf+D+uN4=H*{dEH`eO{e~O!=-GS^$6N91q7X_O<6iw}c4}&< zQu%7vX%yJabKx}h&6>93EPvQywbX~`O>jf0G|KzwZ~)f8)DT5k;JtfYcQ`ik zfT7`uwY6h(TD#o?(kWy8N|>YSK}R<)aiufG&~`7k!8>-Z{G!;~+K~1^NKg2ZmNZVn zp<4Gmn(VNRk=gr%9yivft?7PnLX(knT-ZHO?5G`ag)~bLs>w914)ECDTMzim`fv?Fa=U^p~q4VOELfusHLa zg~LxBPB^@vO+yB5^IzgU){nVruf{{aQay!G1LN1Tg|Kpzo&p!yAxWhEi|IIvB?`2hV!tV(w$;w{uYNnHR=Rnk&|=^Q zX|`-QKtDGqsDrPp*u^jCH5AVT8dd1o60olAFswG%A!kBgB>16`vLbs(@f`J6%LqWnH|^nS{!^ zoRez4)DhmC%TYP%*)%!jd#@2&8Wxc9`%t{k*pl(6;b8Tfn79Kj7V4!=@#7?21P#I# z;~8fdOOK+#q{Y>30dt2HE#_B=DLC=AUWz=C);q=DL|xIi!r~}9mVZ?+Cw}$gNPPk) zTd945s4mT*zAaG3i*Y&kcdYq!!kQpE(@(Xq3h6+#j~Y|*3j$4rya&M_ZX5=14Y|eP zkZz(QZGwUjcaQlR4lNc2ZpXlOe_~Jc7{tM3jQ3Aq`sRj+*$_00Df7mg&gl&&MfF3~ zAR(LtUncwe_peYE~QA8k|D|ji7_oXQNOjWiN=>8voy%L$VJM*oy02M&|S+# z_ubNv!iaxWvcH;8MRWJJ(hraTyn2N*qMwWCHv_00e-YLO_p65!2`bU5f2Em?+V6{> zOyPGhy!$HX&#bVD*_ET1(_n(#SE;6EfMjlDkIn;K%{j0NNhh=Vm1~@3wT2Sj9Rik` zsaxFV#N{irL?h*WcM$qF$^5f#ek8X%TF8{o=>bFS@)-x|mR0-#Qp0Xj7DqA7BD ze7_>l7W*bHxVv?8a5WddXXCQcSR9c1MOz4>6H7f_g&h9+h5|(QU~beb6oDXlIHsZA z12L3gOW95gGx`j&-&0;C0W4NzqN3g(QgNJdAu0z3St%}*Juw4zx5I7T-$y^ zu%8T&)Fj{id>w$b^Dx>hw$BWQws9(ap#$fL8O^iifgHm*Ap9|i3DyWK$bWIne={HK z`HA1f_6RLk;k;g{W-uGhG9RMQz$**KbS%%#`85wb#tIQTBlC~)jp=geWs>Pk`5g8@ zKwIidYZvC68cRSM5QS!5(fdsZzW_cioL=0^fs??R*!9=v{W3{=`A3cJg%;HC3I+S0 zvWZ90-AsK&ey?!#CM45D3adrf{RzT{HFwX0{}43_17Uw`%R~@BX?vOm7Hw8c+a2Y?<3w*{Q&3EC{zShagH_gEcx zd9Q-qeeryU0~O;8OFcQ0no1wBJpNu?--}IPd13A77`6utt_y+Bhd$Z%u1OwSM85f< zUh#N-O-pF5n|VN#`>V=0(`_XDv)omXPose-+KpYm-BTUdI$Yp%@Xg-G?LnOIi`R`5 z_nVmPkonVip#|vS;x$16z(&8gVIT2*Ybr-$@hu(9cz}xy6nYcMJ}vjYI6sNYZuaE% zf+P(O@&r^hA2xO=lW{;t8>iAAzQVG_A?x0cBDp%dsANy)Swqs)g8@Rn9~RzcyQUT* z_b7d0x6bqdDL39xsmCbrGf@1{eE8uY(-}r}Ao8C&X|WTcqOQ26TpuE;WRSt-P!JAw#XsIY-INupNy! zWU5=%(o>@bZmwOTakEQ9DI5`*%I+#QQuvgyQXKP`Ma4jOnu03}6KQx7ckRBHCf8b? zuVEFoQ%Zv=t@+GV%~C}}Kis#l?s)CJw|hItnm#Bl@(~%9&|XptI$JYo^X6sT7{`F$ z01p#kHW+mt`~AtIK~GNc!B#lPfbqbd3&XieD5>I-H>Cn`uwCssB@wfGqv*z2qICl` z`VzA~tM7&9#MZGem)zs3Yp&k#>>7IL7Aadr$;bGMG&y2+@)stGm+ z%_76MBc6Px0dMXGTcc-e=jFE4>AqH9K&Ko(Yr)MO_t+0SZ_BD^wpA?h5$?@Lp!5c0 z6=#{Ul|AIm5jnqVUF8QxC)(t&4bCib&NZ3*g*Iwe!?q`TiQZI4j#MvQlh=LV>8leH z;q_?-+Jn?LSCHgo#_3FVSD8z1@w+;4bj2R|>dhlQn74q3EbTH6L zuDNA2n>ycbK6{>IrHby%63{3RW-m{1v~G5cR6_Ae5YpI~ zi+(w595mmnoTKnV2YY=?j{cr+Om0|f@x-%5%M{Wn-J|aQd84O0vbDIJ8SK@WS;8c@ zyh7%L?>RWmv@t!>Jajo3{-DRd*0oSk`B=IpLQCrAHH3v5N_HoaeX^8FPbCw2vlBJuIp?))2KTI zgs?z9QUeEOd~Gb?;I9)BrW;w>I5+OQE4~lj{EgWxUyf4@E>|OU_IoMYvkU^9E0j?|M_soI#jfpS&CaMt)MTa0>MYe15d8%Kwos|Knu)KjaG;!1e#hYyV-E z|8OsB|G1X``6#ODEp;?7&*4Gl#l{Cmy%@5J>QAP!1akDxzhVQD=-ZMNW`A(3efL_M z=5Yj99?*>A^ht`YP$AK|CdO2&`>6E`Ti04r-Iv%dx3sG0K(;20iw@6mTPp^1wNlB{ zT`@@e-T)dyq`D#`aV|*3xa7LuOQsw(aBZ4I-*SE-;^HKDpXoAvho=ADYu2CjC)s;h z!y6v)U)q$6ueBwW@f7r_LQ~bEo}(ffajt69x+e@{T%L=+e=`i{^r044*{le9t|F^0 z)hAPbdRvF6kBskio_-&*vJYHktfv9vKR8RcNwooZqApK@j>XennihEhBF}FKkLuA` zh=0_LgJI58>9IL0uA>Sd`cN6@4TjS*V-Ws~d8A!kLP(VdRXX)gCRR@6{bH5ou?tXk zC0#20xd&wWTg-OFjX81{mpnfpF-eV@S%U8gR0o!N2Z@bPA|VQ2AGL z1@8l(e@ddi;IkLMg zRUh~#;N#<@`s4jXDeGD>b&LeKJ4~P0ciLX~E4<;d3;u?NnFH=qvdG*GJ(aFZeRa#z zd=04l7)mvN3cv^5KojtHyeNQqN5K&{XRdyHE1C-Ts%Tyrhs&-HLF=RNZ#zrEOR0}Z zows6sAD=;jBZgoAMh+O~tk?hy?I~KD6 zw1^dQQQ&u+b??y8{oLCz_u70|@rs}OATUWO=W1bp=uc1kkf!kLX?RN+c3pG9NS18# z(6RuoR6IoBYhQ>YIS1N}Qr-N6GPhm6TIGWlr;>4xd`I5Ko+GCqS7}ZS{gH0-o2p)a z+q-#Y#>#7T=-%V;>$Pgxw-0wd)45ioZPwJRWk0I_`|>j1wZRV@+v?El@rB90FxK{^ z&rn2IRxP#P*EiK|(wR@VXjkh0>d9CPxx!J9+j27b*H%x z&wL3hFQ(R=R!qyn4eQR=@Y^gbFKiJRk)i#&pgEx!(&N<18(HBORxidQm5s}Q@?o&< z$-gYyN_Sg@7Jksu0`vAv%&ps-=@Z-5KPeZZQpc#^pm56Tbn7Fy@=5BMTIWIS1ROYZ zo9n(^$1@iSG_QN&eDwQ$^HUm^d71WR^J*B~zo&dbekQvstU3$od?N&HxMV(hN&sI$ zEKiZ669Ow0cX)TeAHn0$$5N)N;m&(GA3sABA3~;$<(cGH(}ooBw`lJd2l6bbg}U9? z`!~q-yqnY7x*Y>g_xdNdYK1-9v#yBr=#E*iM#>UENBiC=Xa(J|(&<;k*SOK>W6?97 zyVi@eutKnI8vyF{_1egCG|3uSD9iT$Xwfzp8a%9c$R~Q!EW$9a}j%8pC$3xhFqV;UY1jbhEZs~!YdUhOgeG}XI4w|IMO^syL(^Pa z_+Lk5{yF(qbzzZND!^8k*|gd-?LGDVC|2{n@szeq%{KMvjnYRteN@e`sLB6*CQ`w( ziz_(AumOzO+?DF(R}~X+tU>mRaIkQK*}Sa$u$qI;jI>tnwqw$KK?xV{dLgZ$8F<@b zi^bAzc$q<|Wl~%48JKwfO^iRh{Vr;SaE9@G$3<`IXRG6@WI>#3NK2>~d{6JYcKTyG z+z;r==Ome5TJkoqEz{Gyu}jNxp6{~DlUf0J3_tufs9V?+Pxd90Ix*2VJdq8#VJFRk z3W(0Ps}Mu67n?EBewj>7t)*ObL-O7RaOOaeU}n3r|AQxd|1}%p;o$!7*-)j9TT|_W`4_q$B7!-c3w0m1&ykvONPjunzi}Dk1{RPu@TIfh3O`qdg zPu~L-#UGWfpVV9goc^dPeofod?)`2XLGAzh6KSZ0wmefv zHb$lyrzTVDXFNM&15wawPF~FyT6657l^oT0C_WBbEF;KA4C&oHNRI<84CGI5o338a zRzJ&95HxrN9LW?_X#V_V(LTZa;?Z&x>N}t($4b^6;{%Us-h@%Sq}xVLx|C)W0eE!d z!eMI%D03%mCaHdAg1~KU@)7fJqMk(h``dbyr-BL{>J{1yoyZ{=hW2*TF}&|*52R?$ z4#|k3O%vou0)8{pPq{qX;1VhgQ6tiFB$_Mc<{t>uTR9qpJ@L8}dADJ#8}tYzHc0`( z1%x4%#Kp@IBQ!-0=<)0o+6rVCNbWziv}Wp>^PPjf7{aY-#QB%jr0@KT;(#_5?rmc);()og9eD6DG%KNvHxpqF*ui24+ zSO#Bdg``B(wNqsCsc(R>z?{7}Fv0EpRfvobymoaT@ud5ZTQ~7kFRK?7_U=&t}P_p8{fkZY>b<+{Jmg-@nKd{=?!LDaD)rwtW zv%BviK|*5Rcnd!Ndh#zXdsNrv7pJuVojjMTt!JN|LGlB6HS7Qmf4(k!M|_OjRK{6L zxzYDb-@+4Ik47M?&O|8d=HDLn+=#(TyxA8b=2kLoI6uhCS*1S-kY9!QtKA)0fD{3D1g=T1l4r{Mo{kekt*yAhi`oQ#!@upWx zSn!Ztp8guyQoSXhO}Jv#ZF;)v;~G`pJbl!wzKre5LSnd|;Gy}|RN7Z;#f>i>JUSL_ zFfctjoy*`GnFaGU-^H+F3wNkfy}i>xFVVKU3S8N{;}8mO=h#)dstt7QwK{k8)p3mf zO3bA&?prRG^;Wlj{Og>}W65|-PHZTKP12m6@7??sXx(k$DLy=Q^@tStrLGDo-EWU% zBf>4a`TX%gXM|w`eL${mI}2k^tLw`&#f5>h-+W)qoV~wk;D<)rv8LPZ_>)do9ktyf z6W~V;y!>r?9-Oeh;y0c8!GjU~Zfxec-YIo{H%88fjkQI%@#j}jYDYWmxz9J`>C`h! zw?F$j+5^=Hfpvz{=R7T@#MN)=4ml=6Iw0dt&zsBfn*)|??TYmL^{&143%|$fotyO3 zgVa=X&d|*g1l%j{0efxlwvItcY3;+U$7{2tFLK>wmUw^rPL~52Z-__9_Cv5?KR70N)4O@}y~%v* zs)KO%N&MS}+U1H8_@nF9TCDm!{^M`I=C8(1BK6w-jHZK9-36@1AG|Yi=eKpfKxdYZ zV~?7%`uF39_v@;o1G%W9<9mS_+RUST_vgnhA&PM_wyp}H9MTKho&@G+CO_-1Ld;r8 zsP5BC4s#!toEi3^aLs>>lWr~p)*2kkW5)|1D9fH{l=8=1tChb3{?X6El+jqrw zpT^r`^}~Ibs_4$N8~R++NUHA(q0t5+6%JE8in>42rd%pAnf$5~_fU(?fkx)xG(UJ! zkOm6wGhW5p8b;NRqkzW6b_nZM2bS&;=$fic(1~uUJ%~TrKcFO)vxUYDY4atBX6fnk zMt;@0`lHogi`|!cg(9`^K~0z90g^@;P-qsLdAI)_f#kf0AKE#wU6i_}#ybcX(bF z2w4wZUq29g5vMv5rCf;WdfZ>b54gFx(NkbQZ|5i%G(`$A(c0oUtKx5m2p;)gK`G@Z zbU4sj&u|>?Mn&Uo72sAL$}-UwDi1Qas+s|v#Y&$9`WU=Q>yIkm3j!6uQ%FgX)oPrd z79WN76qiG8@!o$XMdz0}u!{hanhxv}Qk56C3MD|>V%@r4x1sjU!sI^6+4a`M7tl&Oca4I z=B^N!fN#Yh2~0V{-tOUCSmYSqiL8Ej4U~AQ+O#kTV+?M2n(hfZd8t? z^N%)nx~YU!Bhd{dDKz0Qv2Ni1f~wT-xC1MFjuiO#A*TiC)r8bzhXh=9b!`Do|S9xJQ&eYysVLML9-P+cFUV!+$5dVT)$g;HJ&s;K>n3%?N!%M%fcl|Ee#B19!1Lk7TT9H3qm3;c9; zojs*CVdCZQCsB_nA&Q?XSaQqm71Vs9PdLsW#)+O`p+tzqa&!>afVN|Wh8P{^ARZbf z{I3eIp+}~iiqcj}0CI-(JG0>Cp=$9Ig4`GsO=lFVhfHAjHfLn>5tvc`R~U@6)(-^k zY3N_fmK`357=2i#RAORU3Fp%mDs(&4(M6hj6x7_yR7|;uY~@CAU%05U9?gTP2N>!9 zwaKAvJltPQ(NHQ5!nNP(UvJ@m8BwFi>-}~$A{_MpJB0oQ2@KPW(@4HR9Wfh+2Q++* ztLgKXON#$Qcp1+Aqd(4A9&OTs;jcJ{$j3b6vef8CTxInS@~KpCy#MlEf6r(PbDtBnVGuN5$EGuUDxXA1~K4cTSzmNNLL<4dJADfY^7? zoq6XZD6T5GZQuNm#;}K*D~~(6)vS?-0O2JX zNdKMoy`cZ{K49z4$YX*N3gyn1Hml6}0M7)pQoFyiqP$MZ>rN0+^{ zyoBr8M8T?2`B&m#^_0{VxKxXtE>3$krWCRm>Djv=UUkr!NRf#tRhK3lB z=82+2n7MG9Y9g!de`KU!4JFdu@UDsBODe#lEE-J8?>JO3K-D947jo?EcRFyNHrrQ~s{1<7aNd62W3v2Kwjbr9#qqXDIEzGDXthjDbVNkd1YrUj7jjmz%rh;))Y) z(lq?jqxBqa_OBg2@hU}S%&+9Ec3w*l-REZwwv(*iDq*dAYEhiyY?Y|+gub{y-nu}I zZP|oxtzf^->Q;QlI=21iu^+Ei~+^C)PQvJ$>9j-;R9hd4dQ`O3ben3Co z4FPiuU;X{~a;V^y@K&!IiV5zk*&9wer}~)Mpb>>rP+DyX{urw{Ye-N<>L6dE+}@Xi zQWm4+EX#gzJh&*c?nW$)%I#vn{Mw#)cAJ3%xy4m^q~;G&yEvcrV)-g+@R?@`fx?@8MGxgfMqsx8y-3KobcvnAhtz8G2ja(jxn#ZGYS zfpKhsNHf&axBA6X*6)s{l&NJy>J$qLGG_P_u9TiAPi8C|g^nQU9cwQX^*r$X%td-ae%< z14_FKm?16BI_w9!BDQcc#@m4`+l&VtVVZnoxye`-)UWb0%a%av_@muOhw%kzTA|D` z>rr`|*|+lUrfwScQ{y2n1{WEKi;KgEeRP>mGfrI1dTJCfqTCwY_$Z7s$jP6D%3n)o z2YidgD#vKaPIeZ}-f9$^kh{Vu24C)|4ZopNEK^}esSr~N4g`y$2hL_WE_7WwAbfv%Io`=!R@ zg@(v>>qag@U!`CiL1wKxilJ_v|bIrJDTX$h6Z0a2KWqt0)Isg$TAj0i}u znU#OV#UOcm8IhFU08+l7x%BxD1^8J1Yb#mCjj?jUJa~UYQwTr&izZX9 z={Dgb)A1f~GsP;c6yWjH?qT0^YB;sU4h}EFpIYRxnL3{u9)WBujJ9Vp>BK8`2FL%+ zMD2}Q@Z-6)5Dsw!Y z@wOaR6lQ8)$WqGQJZL#`^%vcG%6mWOOi_sl&CthNVDEkrtO%b zjU2NFoSQ|KjhKGhEvy)7))pj3@I}w+7Br0k^ncV!RXEU8qdHfm!}>sW8aKm+mhFMQT*Q6CN(5oWUv2MVHPIdsD|RH zO}0FTrb$`NYZ?~>%~dX{$6!-@N1{R${zunI;iB|3n$rL|xwrDD;B9oOj{a_(5$_BW zNE!Ww2zgjGYw_T6pVYHQ!=^)6;+P>tob94R|Ngd~tCUV3pA~P29pOrkav7<4S z?y&^72i6>KWQ5)rt3b#&%Os|3BKDsB0G;WcuBH0P09g9J0;H=WaFM>3Oo57wu+BW_juo9 z?!a~JWHG_i6N|p`>O?a&jdU}|0Uw>_wo!YwY@m>2>+>Xq6ycm<&B;k=7J`BTUtek4(UQGNfj^z*W5`=eDvM1vRCEkXlP3aS^z*~`$`5vBNprQNxf@5(`$ zk#WMHlS2MRE|zagyu~z-&uw|=>bY}>QC|%2Te;KU2>je(MFn)|=Hnl7PSh8lDih8z zVM+2bSX&f9SZf0J2n56VNu~SO0YJL=^lgGw-oGDW2vlW8)~D#7dfQ{}IqK>Yhryjr zoi=TP@?Xx3BN8wUwuA;od$V$47wL2;*iTStf6wUe&)Ynuu70wfWg`ty9NZ)4=a@8+ z{5h7HZZvS4w#2>^xjIDFYtc=bt6KgBlgs+ORPxRuReFO`6`vh%J?y8Kwigf_wd?$# zYE3b(6ReLu8s27zSA;J2mB;T1u5Vg>tq_lU=pj%@U@^^hu5w%>6-3zMqVAWrG<#ks`)uPpI!NhFGF*Cz9#LUdh%*>9N8Fpf3W{#Pe znK@?IW@cu#$KN@3-o0n0rsn;6)hd-r-L-mEt6Qqo(vqgo0k;r8G9WI`7GxOihz*nRt=GTViUZp?Td9uAU@!?}yJ33`{p{Pv~BBgGX_yGvS!cPgI z6$>MZ`wG8khkbj*MdfHkmnX{5F6ce8&0RbFQuTbP2>#rxH=3I$mYe&I(@)9(H7BPu zCKI)1P9dIW?r6#uu5)l<{ZZ{5j?Lg)bLyXHrjDX<8~R5BeztbElf)#sSOhlY*7P<~ zagP+AGbK2CoLp!yeKWhZ&P}?rV(sabqsjn)Zq0Ml5iDfqYZoOb475#JD#adB{Ry1Z z7!Jr&{rQ{_U&`Ynk_*+q2Wy6a9B_kgfSohen{v2kf|_1X8G|HE?N8^W0(}_FGq@_R zmT5iIHByipW(&i%XDT2ia8f&bj|dlN{l(e@7XzOFwhB^M7YPYUziWQ;W!*0`Zcli4 zoF-O3k_Gmu0J#2<~8YMdZtOuI3@~ci8>nAOu z--lzsl9r$4Gn^lq@=}-E^3NT~ifMYQGgHGi4@#Obm#>ViKTaN%Dlco^+bp-1=%#+z zjIA)y{H4weh-h?;hZl5_=-Z{^dM$RUh?}p=)eh_Av~IxULxZq$HckN-(p**lCWvK! zMiFRGMo=_hpw4?~%LR;8p#?w(ybx@meCq>jHJ2?7oCRmF&9|NU#Jcm2?^7os_FP5@ zi9v;oEbvta1+PbHwi*C3AnRn{`ekjFVOTMIK)+Pk1LVvH#Wu<@;flWL^)scfyIgEc@2b-yPfacJunr6rds*T z?N&n?{{0)bC~g3_;VHoBxiG_OLxvZOO^?J}uf-PQBJs2UNYuw65&%xOW8a@^2n( z0W*xRCSqVqD$u}MDr?4f?q4$M)cPQEtfjBBheED~$Z;!OEDNW7SI3dsd3VU#qRIi8 zkgOy5m6mFeGTH|T_p6@X0t(IWQ?OXv%ym4UM!hT*ZE&Ttu6T7A!-18U`MTp% zE|(0sy`;bs3n)bHyU5(pgPILRVcXJPrs=ZpXE6R}Hm{H44^W~Q)zi0kygAB=*_w>> zxgWS%DQIE7XUQ}tN?3YS@h3)QdarfT#Z=N|DVTyy4e{gYp`|8HmseEHdG3oU1!m}5 zBod7rk{mLnwWhkA2yn;IW;;Kn9ad}>XlC`#gL{CsbtO`(R9|7lyE|El8bPEcV)q+h zgtE6#dPh1K-hy`Qd(V8T5c4zTsI(Az!BR|z{R%Lb14U4eO=KxN_$*H(aJ-)tK zu61N2zSJbXOHLK@7;V=nT?GeeC1K+t+9>^s3a7Txb;gV$b8OAybNw!oH{$u|HmE)H zL6Sl)E-ZLbgee5XswEntAq)w&sel0P22G%(ZrQ_|_1}mRsctHvKtm_Hwa^NwZUC_| zQ|U_8QM(I>=7uRZ5-W_&D0RhfjwUlpO`WZ}*15;~)G0N}%-4R(a)x@PRyASR1!Vox z^(Jy_#V@Q?%JF4tc=1%sQZrx(S~I?0slnK7cMU_R#jfn7J)oyHS`n|Bl@6$0 zY*`_K`U5R;qI&)iel&SUL&;~bzNTZ{M|xmH-YoK`K#VA9Qfp?B%6k zP7c;^$`u+Ca+&@SwPIM-O} z915tet{AixhlVPG{bhQDyh(AX&J29@0Xd(g&}48-gT5c&w3(JE_AgkS-hY%5V3uxE zd0?%aEY|#ZuK1zJp^RC*j@FnM^aZ*g8ZU?boQ`&Ybm7K3e9#eOP4h6}DO*g{LR0t(tn62fb;GioY(hWT zQhCl&czID=9xCCai$3z|Ot$*W{Md?Z-ngE}=&P@6wOAerg`yO#mX-l|D4$?2B})zOoLQf+rcJ&z^ew%_xAE1N{JBm>A>WO|qdzA5 zVDBKiX_B@oH{|P66$*@^a#2tQq4jWoV2J{=jxGh~#Vr63aO4pNfUK%EtXs zU(?W?v^>AnG+|^pfZ10 zD6AAxN>51_A}_#Drc5<#Xyq&Xy?~*c!4|IK#gqJZdsJ77jnY?L;~ImM<=$C{QCY0E3@27+CnLHU;M7?los6^m{&A1NIZcoE zfn}QZit@Y|0T@OfS=h?lx>g)?n52qQA5$B;ZB)aOsNagFwI5nKw$COKltw*dXlm0g zMvd9Lk{@*LpQJf*9P0*{gI)ha3>MNk0fINPQk?Oq_eLDcHj#AREFSwNoOtM8u&TWE zr)IUWklZWbz*6dA-@x?mf6G+Uz7JGd0N2;^X?JZlJ^> zme&_tdQ10F%7bk{Zi8F;tnB5goUP)C)G9Nd&%Uk+eEvq>L4hkB@OKi!m#zH0aQi`5 zfzbdr^$y@MdfLebLt^{ecw`_5gY&bBhl*~?c8-xE%?M+`GhnhO|GvF?!&NX4zoQ=F zsId;PVr}e^IR;XIUpk%tCds_sx`a|e>Y%}4+{)l%fBDp?wgs()i?d- z&Ulaxw4_DXp2;h|=c+NNR&=0l=}P;^kEEHPwGkm?WnHdj13m)AfOL*`e^TcNZ1N6C z(`^Y{Im_solZd^4`e{+svKYkvB$dbL$u_aQER5YFYLoEQP7}n5^Q?6wERrLNPT$?K zI2y&QIeZ$m!*!ym(H_iG(Jt3yA`17?Mwe9sY8U!dLH5wcnNzya#2aH^j=Wl?Bq4_K zE|#{%C=cDLM&Z|iW<*XMcBw09GYVV7CKV?w282^HOQ`rdQbIO-9xi8#sy@75&v$l) zqKUnykZz~n>(F~Kx^t59?tDI0s>E?u_Hr&x`Hd4Rj(e^(a8ICDjbC+LZ>a6DH7=fk z4fn6XYplIauJm04ykJ3H^qroM>n86nec4^Fw|iUBUB1tIYqL8qRoR{1?`IdOckESq zysww{2SbzkUIWODgoM72Pgfi7mG$oA$~cIvD)1pzvh-2>p0Z&#FF>qvweM^J--Kbb^5ewU2P%i`!aF@hcH7s z_&TJlr(ef!J%xOax*Sq`VuDtf*T|;I)|!A!w;8Aokz)}^xIiU7q1K2IpwNi zbDq8UR#Y#3AUB-bzZm&>Knd~KC=z^8t}tgb3rf2zT;)+sV=1qf^xzAA;QRGm$wh4C zZ}xru?@eci3lKh!V?~JaRc$)`m|Z_H_1hko2NvH`T(26!tJYwaBXj;iG2Bw;lr4F? zQE~r4WU6Z;E>;ZXCsw@`>E1yrZje% z96P0_EKjeevW5kepWd=^?4fbQ;6u4dfQ>j|kP zKE>s?fLtGy;{s7Z`V(L91V&37=Y;T5;2+|D_Tgjm56%uoUkyG!tsDt!NS2tN4`y?y z-PB}6-+9v<4pSmylaa)Wn8c-sDSp8-i3^cIi3LiMFiFaQLz54Z5E5%cWRpfyfxB-y zeG-p&JqIv+;+LF$lgQptn@$Oejb9MGqa5ppMKr6JOdVraX_#FuNnL9vH#4t`y1kM> zzlSc*-lOw=%}T%Xr0KfWjoG>qSP%O{dGzx__%f^KGSaJuV40(zfCD$&UwvUD60>3GCh=c}61?QyA;> z*g_VcXr#@WYNq@dwFvQ4r!o8;o_KBqBKk?7$r)V_{}oY1OWZt5l`Coj?T|(Ut|(90 z&2zqnv;5oFg=tN*uQOmI*}+rX&JvVlNe^YyDM%!5m)*9WQvHLuRJ)>PI2WRRU4sn~4p=Sp@fBl_Bx?C`HII3nTxI^0k z6PgqrmMpuCgI5d9gYNtGH3?mATl3eBC|`j)4#~7GR}Q!Hoj-BUN?tSzj$~duixyC_ zm>KnWJb;V&j>{>^OV2Eqg%+sogc8Y%YL=^=kT_Q|s6T4pO)KbWc1fk9hKZ`X!$21) zoJD%FhU{r;rTQZshmjtTklen<8M!YC8GGXa(;*J+Y^$VKT}3ndb<)CFala@|PB_6m z8DZ1nPv95n=bMa~(NXw29+4JtXqFPC5sDLtdd{Be>73y_;aKr-lB#PV44<^XP z5Og=Ohp~M+5%@5Vs^w5ZcUZG-ewks6`2w$Z!E6S@*D>i{30~Xpl5HsQs28w6n0Ghy z^Nmpp7_pqvr&tzcLHn$d#{9Q}3s(G&0W~{V#!bV&#@LW+;-$Uv>gBo-Q=kfJfC6ri z0xoLjW>ryeAXdH$FafDr#R%+Fw5rd4yrnZRdH_L2bQ%#vio&c$BHbx0k%~nRqGA5=$@O{?eA{3?_SA9!fhOrP|38 zCeX*-Obq|E=F7DX#=VV8wDT{>i!<>C-}S~q@xVsmLRZSL6WXp#Hcjx3VEz&z{Dq^Q zsmodS_j)@T`r$dSfa0NkE$}iTDvz*@qyIphE?BdbrmlX%R3f#mUa#|r0gimIN&0_5 zW$;Md{;bd(r^mj1aHhhY&}m)!7X2s~f96o=NR=~}_xStU9{y-_Eg?TYfY#-mAuXdWI0C*xsCcA^U zm;tao9!H_C7b4YoET%+`D$?(DQdF90@qU#7&Mm}6r62c>F;Me-tA}x=J0QO1<=b@# zQ<7H`_4rUl@@@&38(6^n>ZK9^p5drsKiq1rTNvp#tYe?xjrDS(^^9?S%ATqh2j51F zX1djUR}#-ugrylU**e_$TcK4PTBY9+$SZ9m5n_RVVA11%KWX$sP?x&c3X=MFP9^$W zgI}G^KcI~85B`GEADzRJ*f*oHU`{mpdA8bl7RP*LN3VWtITCo&QJsvuEi%9C@cf}! zE>=p$J>;?p%@2Zv$PSix=tqkBDi!Ir7tNIP=5P$w*a-v5t0myFUYjfjIysiJBXFP2 zAGUUJ3LhW6o5{ZHRBiTDc9k63Q9Y-Jy%z?NRgENJ%QRv^|DRBGq3$2dnXgz**9 zMadqvo>rP-Y-%a}7_}bIl>G!=p0bjYx-@qB7S1xw6HZ_LSse4zgs7*Au|Z2%Lkvn< zqU%r9G33NCkx!qkqXE2bi>j3D$gl;UmgbPtY%LFv4ylvkMk&a9%OL0bo>T~#7vRKd z2wUHTDa0@>)Yj0q4-tQh<=5vC5?^GWb@GcI)OwOf`m1hc$b~_R<9R9 zcZtgdQ>hnGMOY)Va+9r~NW^tJGPI5NCQ!Pl!9a|}pjm8ayN09b9?<;&k1(6+O`b-E zK}$BI0VfBtFf#qmKuz6vT`PYEw4jSO^p;hu0RWrj9~d^Ogc`*CMz6A>%qg+Z``i!T zeY`~*^jw~cCj@bQySfSs@%^slN;*T6mjxD#pmS?018$D`LDV=_8{Ub4i)WR)tg7tN z_ZF_NH!ex0+0lq(L5YdjeglQvY~jG@2cdxS-@Ke%`kn@k`!;HNLCA92br&GdGsgWc z*_PmGJ&^9QGk3Gwa=1-*<9_!!pL3{`$N39sMt4Mnm!#hjgp0b{cX%IF|BCUi?X1~Z z0Ttm#k~|E5BYh+l+kDyS;zeGfhc-#b716xxi12`Zj9mtW5eTm`n zSqfom(uO%aF*yEE4i`=-J06!!NmvN#2A${B#;TKPaft?^5j*92@W`@ECX$Gv;Tn*k zi=&Q|h~_6)Gm+;`?;T%Mgs;$Ot2?t&4Szc7+=OkvuRiNFHSuY4)1sbpRFJtn`DbZtnqn93I18}OG2oPR zORf1OLyZkZJWl{= z=)yOQZ=x2yW>g)FcoWqTlxg}G-ivj41P&G57~$#OYO%`=9$CeA{;u*|ui(Xcqaj}F z4dP_)Ge_6O%S<~+17U{cQm}be) zJ#e?{ec@omoVBx)5Drc?Po9Be6}kd+%}0H)D5-zHR-(RAkvC__W>q!ou1@bTOL)gl z>V=!WWbUR$e_`<>?wSog`#HBwvSq@S;v5Eh!6&auSoNglcw%{}^`=gF#mLt+>O8IJ zjL6<$!H7Iu&$)j?L9GK8RgC-@h;D@JTK#M-gF2w1N5<{=DnG1GczFM@dpHE2(T6n3Qw&5n!gY8bbaJB; zbUZ;7ZeeHSjyGtJAkL~k^Irn{${N45MvM<{5rTma7GPV5EckJI2$I^L1`RqOJUuv_&h$Yr@zm-`wlkKDX~BKFN>(fv{MHe( zx|wg*hs1>!5HSPaY;Z64Zb~|@D8pCGH;qi(SwDX#lqEk}8Z;W(-tlpK#*T0knP%fv zIm2sz>c8FoGvIW>Wr-$!pe6~};l~sG#fSnmp7ooxUd!>NMTHMel-TfBHd+hsg4Bl2 zt&kZZ6!bvCZXW9pklg|0_V0CM@LESU_JKyr6Z=r~@4Krn<2ZSBq7{7S_tq5+V_mXs6km3YL2Q3Xz0X!Z=JE{OWT>C!43i z^mDMS&l8J(14DaOzW1YASa}Q3x?YbV-?zj@dGCH02`yFc!%Q2J^|ywAmmgR$)bt$E zI~i6><0_Bdp!)NL&U+##8+iX@RYZ(J>#Eby7C|}Z*Cgt~DeJzPW{Z>_NfGeD8Jv)-UAPK8DfSqBaIRVPEdud#S`h`-^d1i%jT#T3Oe*4 zBS^bH=h?0FS@d39Pz@f?p*1C-Kp3bIMv@RZ37H5BiJ^l{WIUpS1NLOEe;lAEjwI+2 zD^!ic3J#ix0T{5`r>OlzlM{)W)6on>>wdfb&0&$3dPb^ED3m1L)^4{a+mJlYP=I@F z__=On)=P~V+>e$|t14N%8%0ExpGjd!;IBANY0!^Qf}SU8>T`m*`U3eQ5&^qyGo#C8 zYXSoDv~s2?_nf`W8&7X%DWf8@Pl&h>tF`|Ys)~~^c-m$99TMIJ2 zEdMDd1zD>;2KdiA=tB^r6dyvMAdE9?pf%0PaiiO3dAj65wnnGnuI!y40`h7B`HK-x zsnSB*gxi=`jlVxU4+~H*GP7vJ5A9>ZOgLdi-n0hB#myv?d>ChIk%>#9UN-Kpmo2M) zC|5o|wx^!8b%vik0iB0kiK>B9@^ym4i>)O`r#w-S$E;|OUnQapTW?&0{^}hf=wqC& zz||{#ujW)|A#rBfk0PZ){PAOqgU;)8s6oISOMGnZSH6UBf&!jU0z~5DqQ0u`WYsv7 ztKJ0|w|rgGu-=tu6NfL(etg5$gL~4Um8Kw-x8B6hy5j8@aELGpr_z5dNHPj1_~&x4 zGykXN6}0mI%ujmp9>&|4klWVU_5&tQHpI|sx@AK1k zcIF5N#R}@hND|)%pSnCnJnlu$)?4+B7>=nDr&yKTv$WVBuj~h&A=^gUh*fu~BJEXd z`Y(U`##~q0^vI)ugwCz+bMFoxno^`%TqKV-Y%vPs^PX;P5zdvXHJD?j01+PD6S};v z(6)m{{;9Xu^S@2I+-@jtFGiT_r761hBxM}SpUAL-;jw!@3(BGXK%SvoXh zMarIK~9X zCIm|QQ=tSW8EC-@WXcT$%e(8vcA@$`zagFct_8$s`D?tv_8-eY)q`n@ zs!^;>o&|16FRTw}1*jh?Vb>O;#hN0k1-KdNC3%c|xVE==@>l3Qq6C;`Jybf~KGa}6 z8+M}mb}>IeIsaSc@yIaD$sAtLgkWr}O`2ZNi44i2WH98(F+Q0brlGma)FWa5w3nLT5mLv9l)=JA;uWlU#j{;b2Hs zyn<08`W)*Ck=&C5Mv+YI1^qpF5E+ILjD!83XK*zUqrd=Azj7ph z^@Ac$wkCrS0Ow%%S2iIm1V%GskA9HuQKT4<@zO61s8O?lk`7@NW;HUpA{wG|Np~1BzIwh->MK6cWoL8|8D5NR> zB?A2Yxl$<|xs9qh(P~JeN@7FOpd*GmHUhOKkFV?t#8=8M0#f3?RnTT)>%)2T$G}wJ zl}O<2jn8ot3{+g61n?6zR+d#zpuWypo!+HIiO6q>L7~YR0{(2GiJZN#Q5*Ctihs#Z zXv3)y!#Xh5lKE4Hy{M$kEzk@=0v2s*nawE2=v2V3*n#O}_&sJc zf23ItGh>Kq;zE=aD-+}dasjLRi*yfUelUK5s>Xd2sg8X^EnoUzWnzqX6wVpJLIDoR z1#I5uQXBi`)sYO@p2faYxXjXB7}gT07G@ zoeKe9rlkQns1pgEF)f|LC|X`R1kXoVCFu`)S^BNcu`4h<4cT8|Ww{$p(gLnJM-VkE zODWL-9o0Dd4gd&OTrB01iY$jQ2ortNbLkH&Hca!JX+wV6ghhj803sM6kMejoKf1WI zyn8y-wu+>M3{!W}t$V-JYQ5e)=DlASx%jf~V|83R`}hW;CXa!wIT*R$9&V5$?b(O4 zgV(fdp)hxD2Q@oUG;r%@Wp2|kVDVQYEitYIk>H}qhT)s5ocYtAbjXR#2wd`iXw1o98(L z8#;-tJCF;S3g(-GMW$`6wi6vSg4t!Oj7FT{=f5AZ`$gZ@SLSM|D^`>hTZ`42Rn}sU zNST<%$NfDt5=(Ajo8aovB$cbHlv!zJgk~`u2tY;^Gvg(9d^A#y7UiNj?W-IDxoj-Y zYpnw(aBUjX&fglFR(KX}L*aNZ4mr`c0Ztxmoq2xdl?90>6Veqf{h8`IR<~UA?P_k^ zR?u8KrUyEXRGN3GaQNFjLczFla&ArB+8-wUgl7aYi3X(_rZu?Sc>?C;$KzX>p`g?| zF4W?kpYGF_+jx5%=LI?$&V_h(3bygnAWI;)wv9pAck71V6>RotWU|}-ffDQz%3Xc$ zJp;#0_f56^YDpaFR7)x&uFJR&^!5G8xFivW5 z!7QH!K$M&{&#E7B{=Ax_$qX-Ws&S_K@An0MzVQE>`^gO3(yXFiI0?UdHp14VAq_V* zsnOG?VGcJns~M+BN*!RT(=fvr8#l74(a@$@zzBzo(O^QAHZvNLp-ByG82IFeY=v%V z@}Z208$C(T5QgrN)_4PwqKlgX0=_;GJrX?={iBnBk2%l3d^U%7|D)AiaM)`h?2+!v zY3Hp1#o@)G<899V@HNZzxWH8^+h_Wnpy?ECF2LDVY%YY^RvZpb$L5iWi$_J_;d631 zI`1A1kHp54Qi#h%W#DmgIy&y|{)=HQJ`t6H&&loRx_dgj6kA7XE)JZC(!p!taCF$+ z9v+AdC&d(}`!~a7_jq_dwv1F=yfR7$zlF>3AI9nbqt*F*yL-V+mQmi`IMk^HwoZl9 zMKm*P_lA5U{Up+|7=}@yJbH=bv36noc?@GH;I9J&|C9L{((~WkSkm~<1}%PHO@^p_ z{eJ`j|20#=k~qyihJGJyco)akIGpig{-cBc`7oKj>}H69%Z9Vl%fr`| zl|`vtE4vcIj$XaXyW`o}6(QIlXT4Z<3gyJYx(DO>XXDYHFMd=ueu2m2rTxhB`qR^v!1iepoi}e}dBx@Tg z4Z{(Dm5gK=lA4TU5E7TH;VwZ8Bz_%@k?OtU>CTicXZYd~iXPPKqUne)@MDdR;n0lm z%R}bdR={Qy3Uq=o3|5V^lp$=9a0?53F|#B;Hv*i52TV+ryfFM20I7&Zxc7KU@WH!a zs=l8gRv?Jn5*0aqd4@RDs28`D8hK4DbguCg-DFv(;B0xyjvN^y(mu-;h@wb;^o{Jz zvxH^1wFF_vFClqa3f;u{jj43vv*t){`jE3*s-F1!Nb%>-$$!%|sP|)G3+%XWS+rfK zx}xqN)dZE3UDDH9VfADV3zSwelZTv$(tYj6e&##BK@6#YID7R0(jn`w(8$nenknDK z(3z-vBRV!yhKz&mwvuz+fq4Y`XAZl>_YSZQP#h42iNxgC(Z|3Lzb;}m1BQ_K#e%RH z7^Y$m1>^8ENWM861tACuwDJwalF`Z+Tu78YL5V)tcS)6Q;zvTJgDggNc64KFFBIr} zoEVWNj$YoHA-my?i5)#+JX6iY;2*S{$2ByD7TmK^>?n~0iJ zf^kUg+Xl0qmU0iV2jEoge&p&=5N~s}l`WX@U73Mcd?_ac@u~(|?=VSXdkrN^lEG0d zeu%9pbQ0c@B9jKOfq-qqm)l_o4PMB|=S{uf;1c}w;H~NMEPrvM`HFm(Te`*RXH(ct zc544#OXyd>CL541iK2CoDR;tOhNe1ji4$|UGm_Ky?+qJn7C>&%_dPUQtM6%q6zWq! zv_r;eEsf|n@`5`&%T#iIMtB3zRu~6(EY+5M`l^p&vhqB1+TWj7RLhj*2~Q?&j(n=fc0}_4z9JthyHSh6y@? zG1}evZEab{*-t*)9d3^w$9nBnj&3T$Yu&v)auuG{Z2lD84f$h@ZnNflE^fs_lRb@P ztD6&k*wztz?CiYM&6ahY++PLVi+FWGr^OT0%XU3ClL0rEw;`pTmPU4NqO;X>yWHQ8 z9!X1mdhQ4gH>NarMZVd0cIxn+-gQlVEI38O9HPEY72X~pv&@mzCxWbWShuBckFPi@ z)-GR9XQkL@lXxtSt2h-WZ$Fm3CMV<1W-+@uz1?IX?6*&fcEYg{5($U?09MGw?rYf>q9p! zCRs%aOJiBy-@I&VPLl+@;{_a{!PaUAiSbIA@u=Jmrs(D0U;efY(Ls8D5T8*fo&gO= z{H!*jxsN}-gc>aoD~{g)dh;`R`ndsc?h24kQ^1cvjb)18Z8em4KQ(&t1G>^_TK_iU z;zV9pR!$cWa!(yLiXv>qp5b@M<$Dsvy6(C^+&_J^dp*xio|HAjJskl%U%TiR>)-k! zES5IODTa97eP1cC*#|mDa9DD*XA}+(B=VftGGbfP-Ip=*q0hVorzUIq-`sYytUh#& z{{kz5oYM~Z!Ae#V_?Sx8f3r1JTpI+_1uIZq!UsN{w;Ya4*O`mkRVsUQl9s-LqbkCY zdhHHTvrNxG`I!& zYwUWdS4~TtXN6|HKRYF$DUB5-}4o>Hb$59EShA-ux^xsGz3rJ9Krx z^Szn~gsy-#;P<_pQbVvOh!QRYT@ei(xjKgg1L>6V-mk+zRJ7)yHvNq(H8XQ*3&W(yH@@^Fc3bWrFwNv5h~tZ|m_yKQju0pM%LE3plA2 zob367Zjfi36+s*~xR0Z8=y8qp@5N*kC!SnzUPBezgzfusQ=mZ7GiC*W7NGAsHgKeJiewy*Y zrxgEh_QZ6(1I-Z0Ms#$2Jag#HU^j}3GgLI)^UY9;M#PnUBs$Rp8h!mK=+wy*@RsVSne=i5Z^C56|B*ZPl@&QtJw3ACL zf+19Q6!|R+9)I)59Yozzy=>zum#WMm&-P!KS15Xe)b8k2TQ2Rt*=xSqZP~Q@yIm2i z4~cpILcBs|+cNg{`}>HNy#;jg{!M>{-Z{wrh_Qh^q_4H|<}>+TO7ZlI@Cwy;ke;vW z`B~Uah|S8U;NeB;;vsSUg1Tcv-LtFe)>r@Nt#jt(pN`{;H}A%NH4u(}&G#S!%Ekd# z5COM=_-R09%{SKp26*2K{DTPR5=OX2Z`%}jWHFr!Ni+mS4a zsmvQmx=8%(Hht2jr!kHmNbPRWC&J>~Aifje6Zw>46z>aoi+r*Ol6{Wv$GY(ekTsHk z!ns+wV#5|-8cyK{MmCNJ#AzH04qCh$-Sq4_3@+`jvf%;Nt5t_D*%2Fd#*P>O?hVDLio7zo67u;#8q2RZi$PhAIVGi&B{?0MuECYC1F z6K|&Awsu+R2)XCB4D*CPuv!vl1b&Cdb&kAF!VKpiwUbSfBGohlb7RGXO|sQt{nR9$ z6M#Lqq+t;cAJ;PYw3{KjA7_GdaN?Q%6ED#;BO7W35Dy6E`c~(_NA;Ou*&){9UAJ1- zjq!wzVL~6+SUZA(vcdFmO{*zY8^DE`Y)C-IJ^_4jHLWy|+O)Ge0_fZ7L@}k8 zlW0on{%U<##8MCEXdBl`QndQx(D1RaQ$eaPts8I>NnHzS#F%Z3YK4$?0JrUzZN?sp zuo9@$b^CULp=>u`qhYIaWpl=~qFLDA9Or8q4~GJ@ae_YY*KNk7c0g1!Y;Y)eo3Z^9 zM4O;^(bv&Th=`>=VcE7Tm^4?#6%ZUr{b6TqMO(2_61}Nd-e>HNCy%9m)YP^KusUMT z?wxgqn#55bXj<2h-_;##=$arukfe${dAzVzlF#MsFwnt#U*E?Zu_~tDGTmvt^S9{` zDzgL1r_WeBChq1qbVyZ?u*PW}pSbrm^LuoSqUUZ#Z*j%H| zxm{K|yzOfP-J=(j2k#CR*;?csmz)27fbwH^dG5fyf38+ktt^PwFW|Z*+sVh1$Au5B zop`15khhqu*7#Uo2kcV0F!K$VKjP_cN_ztXtFFFx4!AuM@NbI024qjOhuO>B^8!0| zfLnyp`GmJ0Q2IuX-xo_V2Q%Z%oiLwdcP646L(}tnnis3;LxXqe8Wx+I%$9h5y=FP6 zXVyy+jes8$S^uW3Npx7$Ymjaftot^ z97|p+L)Q@?-N=?z{?RZ(8E3FFBHbj(BN=jq_BKkMC+RGQY7bAot$`Pe`g!X5B~t=M z2J2k%*Y-^smwMbw^_NWGB*k|)IVZ?}0CbC$BM;1i{uaf#v1XZTTQfxhR)OxmaX;ga z09=dA4BySSX=H|$IG_)Vg08%~mTk=mR;JP8LN!w&Zy2F5H-&Tp!X04ux0S~GOb2gP zT<)uA4yq29wSPY~!>Jp6tsG=+UT}ZE={m)LTk@*}xo8BO)IfySps{a5tp=pmjJv-- zpDnNVvb`wU4LGg_t<-?IZ35+11KVm)$|Be=&0W*IKxXhRtP7iZJKsI5l9z^u1(KnPd|t_Rb2B=(_P%q@04Z!oC+jx&cg&} z>~?4FYO;c?*{hkOttM;iUBI$#m+m{gw$bqA`S)fEKC1zD?Uw^#w;8Cz_t{5u+k)^( zBiXxvGw*8zuWOQX|Fwq(`9PR2hCsYuj2uYNTLwF{a5X?tULcc8`IRlck<;D%k2zrn zEQBFs4is@io~S{_lwYA73+`o3r%6LKdnI#RrKt8KmcV$0E=wjk!M7}xIgG+B=ZxRX zjNi>aBTxr9Q+_)+5SSTZnC*Cv_dqrSkubN6bo`_l|E2hb&{LwR9ne2xB6a+&YLFHU zkt>IcXnK@ZfBk=0XO?y2wX>(vZSNz{d5>jzPe(K2!~ZR?ZDgJ>7kBvR9ax^wqDz*n zo;r7gNn>8U?r?Wl`W^K4u*FNRbzpZo=vUJv+j>u%JK}{gDPMQ+BTV`wBVUi1ci7}5 zXJ>cvBb@#YuJ?aQ;}MoWuZqGs`r#qqV{Q@{<=w!zZhm2Xw(DJ>*fteOaBK7h$_S~k zI|&4*ZOqWvg9Ja&2trsfhCU6+tY&uYsl*D}!uq{d%`Ikxcp9n*0)F!{X1VX_1R=f{ z!y|P6=D>p9LW&sRzzgfMhd>yL<$&99V2SF1km;}CKp5JA$OwsNfc>;!ay|c8Fplp< zxEIN!_tq1e)`iNGBAH8?#olZaJ@6UfHw>tC47dlz2z1?n%`lidC^}&+&G0w&oR!_) zI-zCNU(|PSbixCHgD*E9)h~M|8-C}{RfF9dFF^SzUatl;#b86X)8AYdCnYc2U*=M2 z3#0lBt(}M)-fdx%;^=z^ihWiEGQ&NZ!5YMIOQWJ;%5f~CN0)J4{n_4`AyS( zP5yZ%)%!NB*2DBN_B`V0pYy-hoHThaxoHi~Dk}=fdC$Q(tJ42hSLfml<@W#agd!8+ z2$NwIhx#Uz+(S}Bjl&EMncSV+#&OF;#E@HPNFDb~#NlxnOc7zmi5kZdl4oY*GA<+Z zOp)}MV`*Kaj zd4XsN)GX;e)n3QqpaLv{JTObk;&wbMYJZ&u&qXwcLo98!WvyvV;xK6Xz5bplTUTue z5JZG*?{k2%p$lWxG9WL~2rjQz;_EFaeK^2!Kr|De96hXl-@9UwxY2WNX11v*>cD<@ zeH>^0B;E@Mn!nn8P9g0CZsbJ+*eR<#cK}o(lH;|sD=0FYIvsxnM;mz4X2-&TIsj~7If?->VK$(jbX7@eStS^_^9q2!Jjj;q`jaD&x%tZLm%H~q#j%y zKKS`K0D}oQ5jB*JJh&zqE3)t!ZN{PMyf6V14@bbmx#; zjd?Ejw4Zk0+p^az3IUXq1MyVGCUC|IT;{6#l-ef|Q zB@_aaGUCO<0|)VsbJ^{n4sPVP`0n$33)h})G3z(+O3l2VK0AT!pY&qWR&oigN!l|` zrydGTHIS>9ax%;()}?4L&g0S zICV>@^=TD*U1-kLj&Mqp)9_WK)U=61jl|w26?Bu%FP+lc>W~k{3`^ zA>3F8?Lt0g`)So;sqO=PbrG|=xtmwM+7l$&DEjIMtyT22f{(A7Y;Btb`raKhxkfu* zP%+$Ba5TLC1*4f*i1(;gFe$rWZOJJF7RR)PGVhw~OIKf&UufVhFY zPG!^jbJH}f{e}jaX9{~hXZ@nje$;f7yxCkq$>_8=%^gohrWElU@tJdx_ogrRb&f7* z+9N;78qaIu?VPRAAM2VXBSkxuv36u`LVz`%hg8Lt-PND7&aNg z>1-{B#kYR1$wJHf-|Ihgz!h)wS9vy4dH;`2hmZB6I%FDxS)F)HKqUe+s`>b0E)t9y zLs^!aOS=0>hu4sZdth0x>y=g5BcgWAoUW_BK*2iNVQS$?-Ie>zmFk(tT8Aqs=^h=$ zp0R1%OS!YsjkQF*Va;bLNKrHiiatG2DO~agH-{dvFR$qtKWe%TkBne@f_{K5QS!{R zs&Emf2Nq<2*b1&jL!<^Z-j-9=yqCU^16=Vvj(DlpN`iuyRVz=jV!$<@OO}TW4GzIK zM=g@X4*JVe&3%w%@Avg2$6M_gEzKN^lH5F=lzNDDZPA5K)-LWuu$F@F#As;D21I*> zOq6na&TaAof?2nNjj~o|Tpe^cuuGOvoPz$F&O$2DzX$Ix6^d}PpWa_}616niDNDQ= z zU?NrC@l;lBL16Y@!P5?2xyYTK-uBi|Rq_{bFl4HseRg1B(q2?yj=jfP>-8sY;hlL6 zAHjn0+j6+r!a|%J`$fJ-b|>??b2Az>LUK;Z%U#gBXAVwoUp(W~KnX_5wc3!yEynO! zKWmka0cdiH0IOj~KPC}y1>aEDM^hd?++4}F=v4r_3WN{ofZ4;;xP78uz{p)opRty| zkBxmN20a6AoIt65d}#wAMchrxXWPc95C+QDl(x7bpVI!xtgZnkEP=rn>#^gJkGDc+LiPA66dN+aiB`=;n)|zhF5bLr zLrg6{DFM#l853dnC#+X<<3Di35?~vtw0NJt-FX1hqU!UyzBVs@Q0~L%QP&w_z7OLd zah1?SRHPOGgV-%2>32uKLchE?iV^m{RzyG3pXt^CM zXJHSH)$f2)J59%nFs$|IHMx@_GUz&nEcGN8HD&q)NF7%Sc zI`c>9tyJtzsBv1iVdxh?HH5tUWz|P0$ejec>clfFK&TDAtA0T9bc$_r=p2HbW4>vwEvl-!X_#N>p>As$zzi;M|o5 zj$DoA$JL9I*7sZk5Rebay2#~Wpx1Ur%0icY%md<1O~s;L^k%x4Zq?dF0)B55C3qrd z3lzGWd705vGHs)ZrEiCR5*UlGY@w3gtd8$aSoz{(!{2s{9a9Wr)&kFBhiDD$?sAP* zp6d(W5+J(`)P_vGNm3rFV8(`}Q%|Z)`bs^0 zsV9o3Fq4a_thQDDBqJo+J>9%ZocuRGlJT^;WJuR1*Q|J0%6f7PM(|EWV? zV^Np?hcXQ#^@jUM4zGGWALN;J>{6aT;&}%Xd911TYVr4GyU4qw`(n2znGks*ocRw+ zs$g1vFquV9rFFF++GpLSGTwEdjz^00337^Da5+7p1u4h#p32->+ok@(Hcm~{Rn=db zpUGJIBtd!M5{Dd__2|xCqN(f8Ug%CMTHD9%CB&gfqDQ;K{+Rsx!0N15ccy?QuTdc+ z+l{B?t*QQlAo^=&jI*$7^Cu%lfBWCE-zCL)xjM$OOdI2t0CvA&8TRqK$&y8s`~%X!300BoLtlqaHDifXbxX z10s^+nX08`0TIG4@JtdYh^hnh;VvM#}l+)#%PT4LRk02Vh zSVB9@+2?M+PV=pAUCY;1vJ+brA^!BRh+hqmnlv3KVNyaZIT1JWWZB|35kJ{geA`;^ zGu;ETvKYrpQWXv4VILGf;cixOny|*!C%t+;3@kz!MiojQ^;pp$vBK=vy4EauuJ(Nm zuiNPQl`-@A{>Ji&=emm6(GMfBtu33UUKxv#i@x6AY5dCAy;PRGdgSY7>8+H64@%8Qdk)1P~MSf(ZG-8{kFZZE1Y~9}{@h^6cgRiyd_D+g4V`gWk k@zFc`eOJSOxfTt = 2: m ≥ 19456 (19 MiB), p = 1
t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | -| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8
p = 2: N ≥ 2^16 (64 MiB), r = 8
p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | +| KDF | Reference | Required Parameters | Status | +| ---------- | --------- | ------------ |:-:| +| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1 | A | +| | | t = 2: m ≥ 19456 (19 MiB), p = 1 | A | +| | | t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | +| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8 | A | +| | | p = 2: N ≥ 2^16 (64 MiB), r = 8 | A | +| | | p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | | bcrypt | [A Future-Adaptable Password Scheme](https://www.researchgate.net/publication/2519476_A_Future-Adaptable_Password_Scheme) | cost ≥ 10 | A | | PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 210,000 | A | | PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 600,000 | A | @@ -196,7 +200,7 @@ Approved password-based key derivations functions can be used for password stora ### General Key Derivation Functions | KDF | Reference | Status | -| ---------------- | --------------------------------------------------------------------------------------------- | ------ | +| ---------------- | -------- |:-:| | HKDF | [RFC 5869](https://www.rfc-editor.org/info/rfc5869) | A | | TLS 1.2 PRF | [RFC 5248](https://www.rfc-editor.org/info/rfc5248) | L | | MD5-based KDFs | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | @@ -204,10 +208,13 @@ Approved password-based key derivations functions can be used for password stora ### Password-based Key Derivation Functions -| KDF | Reference | Required Parameters | Status | -| --- | --------- | ------------------- | ------ | -| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1
t = 2: m ≥ 19456 (19 MiB), p = 1
t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | -| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8
p = 2: N ≥ 2^16 (64 MiB), r = 8
p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | +| KDF | Reference | Required Parameters | Status | +| ---------- | --------- | ------------ |:-:| +| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1 | A | +| | | t = 2: m ≥ 19456 (19 MiB), p = 1 | A | +| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8 | A | +| | | p = 2: N ≥ 2^16 (64 MiB), r = 8 | A | +| | | p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | | PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 210,000 | A | | PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 600,000 | A | | PBKDF2-HMAC-SHA-1 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 1,300,000 | L | @@ -222,7 +229,7 @@ for V11.6 Public Key Cryptography. A security strength of 112 bits or above MUST be ensured for all Key Exchange schemes, and their implementation MUST follow the parameter choices in the following table. | Scheme | Domain Parameters | Forward Secrecy |Status | -|--|--|--|--| +|--|--|--|:-:| | Finite Field Diffie-Hellman (FFDH) | L >= 3072 & N >= 256 | Yes | A | | Elliptic Curve Diffie-Hellman (ECDH) | f >= 256-383 | Yes | A | | Encrypted key transport with RSA-PKCS#1 v1.5 | | No | D | @@ -240,7 +247,7 @@ Any new implementation MUST NOT use any scheme that is NOT compliant with [NIST The following groups are approved for implementations of Diffie-Hellman key exchange. Security strengths are documented in [NIST SP 800-56A](https://csrc.nist.gov/pubs/sp/800/56/a/r3/final), Appendix D, and [NIST SP 800-57 Part 1 Rev.5](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final). | Group | Status | -|------------------|--------| +|------------------|:------:| | P-224, secp224r1 | A | | P-256, secp256r1 | A | | P-384, secp384r1 | A | @@ -270,26 +277,26 @@ The following groups are approved for implementations of Diffie-Hellman key exch Message Authentication Codes (MACs) are cryptographic constructs used to verify the integrity and authenticity of a message. A MAC takes a message and a secret key as inputs and produces a fixed-size tag (the MAC value). MACs are widely used in secure communication protocols (e.g., TLS/SSL) to ensure that messages exchanged between parties are authentic and intact. -| MAC Algorithm | Reference | Status | Restrictions | -| --------------| ----------------------------------------------------------------------------------------- | -------| ------------ | -| HMAC-SHA-256 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | | -| HMAC-SHA-384 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | | -| HMAC-SHA-512 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | | -| KMAC128 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | | -| KMAC256 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | | -| BLAKE3 (keyed_hash mode) | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | | -| AES-CMAC | [RFC 4493](https://datatracker.ietf.org/doc/html/rfc4493) & [NIST SP 800-38B](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38b.pdf) | A | | -| AES-GMAC | [NIST SP 800-38D](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf) | A | | -| Poly1305-AES | [The Poly1305-AES message-authentication code](https://cr.yp.to/mac/poly1305-20050329.pdf) | A | | -| HMAC-SHA-1 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | L | | -| HMAC-MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | | +| MAC Algorithm | Reference | Status | +| ---------- | --------------- |:-:| +| HMAC-SHA-256 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| HMAC-SHA-384 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| HMAC-SHA-512 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| KMAC128 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | +| KMAC256 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | +| BLAKE3 (keyed_hash mode) | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | +| AES-CMAC | [RFC 4493](https://datatracker.ietf.org/doc/html/rfc4493) & [NIST SP 800-38B](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38b.pdf) | A | +| AES-GMAC | [NIST SP 800-38D](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf) | A | +| Poly1305-AES | [The Poly1305-AES message-authentication code](https://cr.yp.to/mac/poly1305-20050329.pdf) | A | +| HMAC-SHA-1 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | L | +| HMAC-MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | ## Digital Signatures Signature schemes MUST use approved key sizes and parameters per [NIST SP 800-57 Part 1](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final). | Signature Algorithm | Reference | Status | -| ------------------------------ | ---------------------------------------------------------- | ------ | +| ------------------------------ | --------------------------------------------- | :-: | | EdDSA (Ed25519, Ed448) | [RFC 8032](https://www.rfc-editor.org/info/rfc8032) | A | | XEdDSA (Curve25519, Curve448) | [XEdDSA](https://signal.org/docs/specifications/xeddsa/) | A | | ECDSA (P-256, P-384, P-521) | [FIPS 186-4](https://csrc.nist.gov/pubs/fips/186-5/final) | A | diff --git a/5.0/fr/0x92-Appendix-C_Cryptography.md b/5.0/fr/0x92-Appendix-C_Cryptography.md index aff573636d..88dc182bad 100644 --- a/5.0/fr/0x92-Appendix-C_Cryptography.md +++ b/5.0/fr/0x92-Appendix-C_Cryptography.md @@ -49,7 +49,7 @@ Cette section fournit des informations supplémentaires sur les valeurs aléatoires de la version 11.5. | Nom | Version/Référence | Notes | Statut | -|:-:|:-:|:-:|:-:| +|:---|:----|:----|:-:| | `/dev/random` | Linux 4.8+ [(oct. 2016)](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=818e607b57c94ade9824dad63a96c2ea6b21baf3), également présent dans iOS, Android et d'autres systèmes d'exploitation POSIX basés sur Linux. Basé sur [RFC7539](https://datatracker.ietf.org/doc/html/rfc7539) | Utilise le flux ChaCha20. Trouvé dans iOS [`SecRandomCopyBytes`](https://developer.apple.com/documentation/security/secrandomcopybytes(_:_:_:)?language=objc) et Android [`Secure Random`](https://developer.android.com/reference/java/security/SecureRandom) avec les paramètres corrects fournis pour chacun. | A | | `/dev/urandom` | Fichier spécial du noyau Linux pour fournir des données aléatoires | Fournit des sources d'entropie de haute qualité à partir du caractère aléatoire matériel | A | | `AES-CTR-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | Tel qu'utilisé dans les implémentations courantes, telles que [l'API Windows CNG `BCryptGenRandom`](https://learn.microsoft.com/en-us/windows/win32/api/bcrypt/nf-bcrypt-bcryptgenrandom) définie par [`BCRYPT_RNG_ALGORITHM`](https://learn.microsoft.com/en-us/windows/win32/seccng/cng-algorithm-identifiers). | A | @@ -67,7 +67,7 @@ sur les algorithmes de chiffrement V11.3. Les algorithmes de chiffrement approuvés sont classés par ordre de préférence. | Algorithmes à clé symétrique | Référence | Statut | -|--|--|--| +| ------ | ------ |:-:| | AES-256 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | A | | Salsa20 | [Salsa 20 specification](https://cr.yp.to/snuffle/spec.pdf) | A | | XChaCha20 | [XChaCha20 Draft](https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-xchacha-03) | A | @@ -117,7 +117,7 @@ Cependant, il est important de bien comprendre la nature (par exemple, l'identit Plus précisément, AES-256 doit être utilisé pour l'encapsulation des clés, conformément à la norme NIST SP 800-38F (https://csrc.nist.gov/pubs/sp/800/38/f/final) et en tenant compte des dispositions prospectives contre la menace quantique. Les modes de chiffrement utilisant AES sont les suivants, par ordre de préférence : | Enveloppement de clé | Référence | Statut | -|--|--|--| +|--|--|:-:| | KW | [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) | A | | KWP | [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) | A | @@ -132,7 +132,7 @@ L'application doit de préférence utiliser un schéma AEAD approuvé. Elle peut La méthode « MAC puis chiffrer » est toujours autorisée pour des raisons de compatibilité avec les applications existantes. Elle est utilisée dans TLS v1.2 avec les anciennes suites de chiffrement. | Mécanisme AEAD | Référence | Statut | -|--------------------------|---------|-----| +|---|---------|:-:| |AES-GCM | [SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | |AES-CCM | [SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | |ChaCha-Poly1305 | [RFC 7539](https://datatracker.ietf.org/doc/html/rfc7539) | A | @@ -156,7 +156,7 @@ Le tableau suivant répertorie les fonctions de hachage approuvées pour les cas * Les fonctions de hachage dont le résultat est inférieur à 254 bits présentent une résistance aux collisions insuffisante et ne doivent pas être utilisées pour la signature numérique ou d'autres applications nécessitant une résistance aux collisions. Pour d'autres utilisations, elles peuvent être utilisées à des fins de compatibilité et de vérification UNIQUEMENT avec les systèmes existants, mais ne doivent pas être utilisées dans les nouvelles conceptions. | Fonction de hachage | Référence | Statut | Restrictions | -| -------------- | ------------------------------------------------------------- |--|--| +| ------ | ----------- |:-:| ---------- | | SHA3-512 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | | SHA-512 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | | SHA3-384 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | @@ -181,9 +181,13 @@ Le tableau suivant répertorie les fonctions de hachage approuvées pour les cas Pour un hachage sécurisé des mots de passe, des fonctions de hachage dédiées doivent être utilisées. Ces algorithmes de hachage lent atténuent les attaques par force brute et par dictionnaire en augmentant la difficulté de calcul du craquage des mots de passe. | KDF | Référence | Paramètres requis | Statut | -| --- | --------- | ------------------- | ------ | -| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1
t = 2: m ≥ 19456 (19 MiB), p = 1
t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | -| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8
p = 2: N ≥ 2^16 (64 MiB), r = 8
p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | +| ---------- | --------- | ------------ |:-:| +| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1 | A | +| | | t = 2: m ≥ 19456 (19 MiB), p = 1 | A | +| | | t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | +| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8 | A | +| | | p = 2: N ≥ 2^16 (64 MiB), r = 8 | A | +| | | p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | | bcrypt | [A Future-Adaptable Password Scheme](https://www.researchgate.net/publication/2519476_A_Future-Adaptable_Password_Scheme) | coût ≥ 10 | A | | PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | itérations ≥ 210,000 | A | | PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | itérations ≥ 600,000 | A | @@ -196,7 +200,7 @@ Les fonctions de dérivation de clés basées sur des mots de passe approuvées ### Fonctions de dérivations de clés générales | KDF | Référence | Statut | -| ---------------- | --------------------------------------------------------------------------------------------- | ------ | +| ---------------- | -------- |:-:| | HKDF | [RFC 5869](https://www.rfc-editor.org/info/rfc5869) | A | | TLS 1.2 PRF | [RFC 5248](https://www.rfc-editor.org/info/rfc5248) | L | | KDFs à base de MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | @@ -205,9 +209,13 @@ Les fonctions de dérivation de clés basées sur des mots de passe approuvées ### Fonctions de dérivations de clés à base de mot de passe | KDF | Référence | Paramètres requis | Statut | -| --- | --------- | ------------------- | ------ | -| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1
t = 2: m ≥ 19456 (19 MiB), p = 1
t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | -| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8
p = 2: N ≥ 2^16 (64 MiB), r = 8
p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | +| ---------- | --------- | ------------ |:-:| +| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1 | A | +| | | t = 2: m ≥ 19456 (19 MiB), p = 1 | A | +| | | t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | +| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8 | A | +| | | p = 2: N ≥ 2^16 (64 MiB), r = 8 | A | +| | | p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | | PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | itérations ≥ 210,000 | A | | PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | itérations ≥ 600,000 | A | | PBKDF2-HMAC-SHA-1 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | itérations ≥ 1,300,000 | L | @@ -222,7 +230,7 @@ sur la cryptographie à clé publique V11.6. Une force de sécurité de 112 bits ou plus DOIT être garantie pour tous les méthodes d'échange de clés, et leur mise en œuvre DOIT suivre les choix de paramètres dans le tableau suivant. | Schéma | Paramètres du domaine | Confidentialité persistante | Statut | -|--|--|--|--| +|--|--|--|:-:| | Diffie-Hellman à corps finis (FFDH) | L >= 3072 et N >= 256 | Oui | A | | Courbe elliptique Diffie-Hellman (ECDH) | f >= 256-383 | Oui | A | | Transport de clés chiffrées avec RSA-PKCS#1 v1.5 | | Non | D | @@ -240,7 +248,7 @@ Toute nouvelle implémentation NE DOIT PAS utiliser de schéma non conforme aux Les groupes suivants sont approuvés pour la mise en œuvre de l'échange de clés Diffie-Hellman. Les niveaux de sécurité sont décrits dans la norme NIST SP 800-56A (https://csrc.nist.gov/pubs/sp/800/56/a/r3/final), l'annexe D et la norme NIST SP 800-57, partie 1, révision 5 (https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final). | Groupe | Statut | -|------------------|--------| +|------------------|:------:| | P-224, secp224r1 | A | | P-256, secp256r1 | A | | P-384, secp384r1 | A | @@ -270,26 +278,26 @@ Les groupes suivants sont approuvés pour la mise en œuvre de l'échange de cl Les codes d'authentification de message (MAC) sont des structures cryptographiques permettant de vérifier l'intégrité et l'authenticité d'un message. Un MAC prend en entrée un message et une clé secrète et génère une étiquette de taille fixe (la valeur MAC). Les MAC sont largement utilisés dans les protocoles de communication sécurisés (par exemple, TLS/SSL) pour garantir l'authenticité et l'intégrité des messages échangés entre les parties. -| Algorithme MAC | Référence | Statut | Restrictions | -| --------------| ----------------------------------------------------------------------------------------- | -------| ------------ | -| HMAC-SHA-256 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) et [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | | -| HMAC-SHA-384 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) et [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | | -| HMAC-SHA-512 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) et [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | | -| KMAC128 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | | -| KMAC256 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | | -| BLAKE3 (mode keyed_hash) | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | | -| AES-CMAC | [RFC 4493](https://datatracker.ietf.org/doc/html/rfc4493) et [NIST SP 800-38B](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38b.pdf) | A | | -| AES-GMAC | [NIST SP 800-38D](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf) | A | | -| Poly1305-AES | [The Poly1305-AES message-authentication code](https://cr.yp.to/mac/poly1305-20050329.pdf) | A | | -| HMAC-SHA-1 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) et [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | L | | -| HMAC-MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | | +| Algorithme MAC | Référence | Statut | +| ---------- | --------------- |:-:| +| HMAC-SHA-256 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) et [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| HMAC-SHA-384 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) et [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| HMAC-SHA-512 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) et [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| KMAC128 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | +| KMAC256 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | +| BLAKE3 (mode keyed_hash) | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | +| AES-CMAC | [RFC 4493](https://datatracker.ietf.org/doc/html/rfc4493) et [NIST SP 800-38B](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38b.pdf) | A | +| AES-GMAC | [NIST SP 800-38D](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf) | A | +| Poly1305-AES | [The Poly1305-AES message-authentication code](https://cr.yp.to/mac/poly1305-20050329.pdf) | A | +| HMAC-SHA-1 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) et [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | L | +| HMAC-MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | ## Signatures numériques Les schémas de signature DOIVENT utiliser des tailles de clés et des paramètres approuvés conformément à la norme [NIST SP 800-57 Partie 1](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final). | Algorithme de signature | Référence | Statut | -| ------------------------------ | ---------------------------------------------------------- | ------ | +| ------------------------------ | --------------------------------------------- | :-: | | EdDSA (Ed25519, Ed448) | [RFC 8032](https://www.rfc-editor.org/info/rfc8032) | A | | XEdDSA (Curve25519, Curve448) | [XEdDSA](https://signal.org/docs/specifications/xeddsa/) | A | | ECDSA (P-256, P-384, P-521) | [FIPS 186-4](https://csrc.nist.gov/pubs/fips/186-5/final) | A | diff --git a/5.0/ru/0x92-Appendix-C_Cryptography.md b/5.0/ru/0x92-Appendix-C_Cryptography.md index d639aa96a1..204928d870 100644 --- a/5.0/ru/0x92-Appendix-C_Cryptography.md +++ b/5.0/ru/0x92-Appendix-C_Cryptography.md @@ -49,7 +49,7 @@ для V11.5 «Случайные значения». | Имя | Версия/Ссылка | Примечания | Статус | -|:-:|:-:|:-:|:-:| +|:---|:----|:----|:-:| | `/dev/random` | Linux 4.8+ [(Окт 2016)](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=818e607b57c94ade9824dad63a96c2ea6b21baf3), также встречается в iOS, Android и других операционных системах POSIX на базе Linux. Основан на [RFC7539](https://datatracker.ietf.org/doc/html/rfc7539) | Использование ChaCha20. Найдено в iOS [`SecRandomCopyBytes`](https://developer.apple.com/documentation/security/secrandomcopybytes(_:_:_:)?language=objc) и Android [`Secure Random`](https://developer.android.com/reference/java/security/SecureRandom) с правильными настройками, предоставленными для каждого. | A | | `/dev/urandom` | Специальный файл ядра Linux для предоставления случайных данных | Обеспечивает высококачественный источник энтропии на основе аппаратной случайности. | A | | `AES-CTR-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | Используется в распространенных реализациях, таких как [Windows CNG API `BCryptGenRandom`](https://learn.microsoft.com/en-us/windows/win32/api/bcrypt/nf-bcrypt-bcryptgenrandom) при установке [`BCRYPT_RNG_ALGORITHM`](https://learn.microsoft.com/en-us/windows/win32/seccng/cng-algorithm-identifiers). | A | @@ -67,7 +67,7 @@ Допустимые алгоритмы шифрования перечислены в порядке предпочтения. | Симметричные алгоритмы | Ссылка | Статус | -|--|--|--| +| ------ | ------ |:-:| | AES-256 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | A | | Salsa20 | [Salsa 20 specification](https://cr.yp.to/snuffle/spec.pdf) | A | | XChaCha20 | [XChaCha20 Draft](https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-xchacha-03) | A | @@ -117,7 +117,7 @@ В частности, для шифрования ключей ОБЯЗАТЕЛЬНО должен использоваться алгоритм AES-256, соответствующий [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) и с учётом перспективных мер защиты от квантовых угроз. Режимы шифрования с использованием AES применяются в следующем порядке предпочтения: | Шифрование ключа | Ссылка | Статус | -|--|--|--| +|--|--|:-:| | KW | [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) | A | | KWP | [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) | A | @@ -132,7 +132,7 @@ AES-192 и AES-128 МОГУТ использоваться, если того т MAC-then-encrypt по-прежнему разрешен для совместимости со старыми приложениями. Он используется в TLS версии 1.2 со старыми наборами шифров. | Схема AEAD | Ссылка | Статус | -|--------------------------|---------|-----| +|---|---------|:-:| |AES-GCM | [SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | |AES-CCM | [SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | |ChaCha-Poly1305 | [RFC 7539](https://datatracker.ietf.org/doc/html/rfc7539) | A | @@ -156,7 +156,7 @@ MAC-then-encrypt по-прежнему разрешен для совмести * Хэш-функции с длиной выходного значения менее 254 бит обладают недостаточной устойчивостью к коллизиям и не должны использоваться для цифровой подписи или других приложений, требующих устойчивости к коллизиям. В других случаях они могут использоваться ТОЛЬКО для обеспечения совместимости и верификации с устаревшими системами, но не должны использоваться в новых разработках. | Хэш-функция | Ссылка | Статус | Ограничения | -| -------------- | ------------------------------------------------------------- |--|--| +| ------ | ----------- |:-:| ---------- | | SHA3-512 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | | SHA-512 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | | SHA3-384 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | @@ -181,9 +181,13 @@ MAC-then-encrypt по-прежнему разрешен для совмести Для безопасного хеширования паролей необходимо использовать специальные хеш-функции. Эти медленные алгоритмы хеширования снижают риск атак методом перебора и перебора по словарю, увеличивая вычислительную сложность взлома паролей. | KDF | Ссылка | Обязательные параметры | Статус | -| --- | --------- | ------------------- | ------ | -| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1
t = 2: m ≥ 19456 (19 MiB), p = 1
t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | -| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8
p = 2: N ≥ 2^16 (64 MiB), r = 8
p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | +| ---------- | --------- | ------------ |:-:| +| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1 | A | +| | | t = 2: m ≥ 19456 (19 MiB), p = 1 | A | +| | | t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | +| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8 | A | +| | | p = 2: N ≥ 2^16 (64 MiB), r = 8 | A | +| | | p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | | bcrypt | [A Future-Adaptable Password Scheme](https://www.researchgate.net/publication/2519476_A_Future-Adaptable_Password_Scheme) | cost ≥ 10 | A | | PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 210,000 | A | | PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 600,000 | A | @@ -196,7 +200,7 @@ MAC-then-encrypt по-прежнему разрешен для совмести ### Основные функции формирования ключа | KDF | Ссылка | Статус | -| ---------------- | --------------------------------------------------------------------------------------------- | ------ | +| ---------------- | -------- |:-:| | HKDF | [RFC 5869](https://www.rfc-editor.org/info/rfc5869) | A | | TLS 1.2 PRF | [RFC 5248](https://www.rfc-editor.org/info/rfc5248) | L | | MD5-based KDFs | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | @@ -205,9 +209,13 @@ MAC-then-encrypt по-прежнему разрешен для совмести ### Функции формирования ключа на основе пароля | KDF | Ссылка | Обязательные параметры | Статус | -| --- | --------- | ------------------- | ------ | -| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1
t = 2: m ≥ 19456 (19 MiB), p = 1
t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | -| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8
p = 2: N ≥ 2^16 (64 MiB), r = 8
p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | +| ---------- | --------- | ------------ |:-:| +| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1 | A | +| | | t = 2: m ≥ 19456 (19 MiB), p = 1 | A | +| | | t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | +| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8 | A | +| | | p = 2: N ≥ 2^16 (64 MiB), r = 8 | A | +| | | p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | | PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 210,000 | A | | PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 600,000 | A | | PBKDF2-HMAC-SHA-1 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 1,300,000 | L | @@ -222,7 +230,7 @@ MAC-then-encrypt по-прежнему разрешен для совмести Для всех схем обмена ключами ДОЛЖНА быть обеспечена стойкость в 112 бит или выше, а их реализация ДОЛЖНА соответствовать выбору параметров, представленному в следующей таблице. | Схема | Параметры | Прямая секретность | Статус | -|--|--|--|--| +|--|--|--|:-:| | Диффи-Хеллман на конечных полях (FFDH) | L >= 3072 & N >= 256 | Yes | A | | Диффи-Хеллман на эллиптических кривых (ECDH) | f >= 256-383 | Yes | A | | Передача зашифрованного ключа с помощью RSA-PKCS#1 v1.5 | | No | D | @@ -240,7 +248,7 @@ MAC-then-encrypt по-прежнему разрешен для совмести Следующие группы допустимы для реализации обмена ключами Диффи-Хеллмана. Уровни безопасности описаны в [NIST SP 800-56A](https://csrc.nist.gov/pubs/sp/800/56/a/r3/final), Приложение D, и [NIST SP 800-57 Часть 1, Ред. 5](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final). | Группа | Статус | -|------------------|--------| +|------------------|:------:| | P-224, secp224r1 | A | | P-256, secp256r1 | A | | P-384, secp384r1 | A | @@ -270,26 +278,26 @@ MAC-then-encrypt по-прежнему разрешен для совмести Коды аутентификации сообщений (MAC) — это криптографические конструкции, используемые для проверки целостности и подлинности сообщения. MAC принимает сообщение и секретный ключ в качестве входных данных и создаёт тег фиксированного размера (значение MAC). MAC широко используется в протоколах защищённой связи (например, TLS/SSL) для обеспечения подлинности и целостности сообщений, которыми обмениваются стороны. -| Алгоритм MAC | Ссылка | Статус | Ограничения | -| --------------| ----------------------------------------------------------------------------------------- | -------| ------------ | -| HMAC-SHA-256 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | | -| HMAC-SHA-384 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | | -| HMAC-SHA-512 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | | -| KMAC128 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | | -| KMAC256 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | | -| BLAKE3 (keyed_hash mode) | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | | -| AES-CMAC | [RFC 4493](https://datatracker.ietf.org/doc/html/rfc4493) & [NIST SP 800-38B](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38b.pdf) | A | | -| AES-GMAC | [NIST SP 800-38D](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf) | A | | -| Poly1305-AES | [The Poly1305-AES message-authentication code](https://cr.yp.to/mac/poly1305-20050329.pdf) | A | | -| HMAC-SHA-1 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | L | | -| HMAC-MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | | +| Алгоритм MAC | Ссылка | Статус | +| ---------- | --------------- |:-:| +| HMAC-SHA-256 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| HMAC-SHA-384 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| HMAC-SHA-512 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| KMAC128 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | +| KMAC256 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | +| BLAKE3 (keyed_hash mode) | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | +| AES-CMAC | [RFC 4493](https://datatracker.ietf.org/doc/html/rfc4493) & [NIST SP 800-38B](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38b.pdf) | A | +| AES-GMAC | [NIST SP 800-38D](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf) | A | +| Poly1305-AES | [The Poly1305-AES message-authentication code](https://cr.yp.to/mac/poly1305-20050329.pdf) | A | +| HMAC-SHA-1 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | L | +| HMAC-MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | ## Цифровые подписи Схемы подписи ДОЛЖНЫ использовать утвержденные размеры ключей и параметры согласно [NIST SP 800-57 Часть 1](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final). | Алгоритм подписи | Ссылка | Статус | -| ------------------------------ | ---------------------------------------------------------- | ------ | +| ------------------------------ | --------------------------------------------- | :-: | | EdDSA (Ed25519, Ed448) | [RFC 8032](https://www.rfc-editor.org/info/rfc8032) | A | | XEdDSA (Curve25519, Curve448) | [XEdDSA](https://signal.org/docs/specifications/xeddsa/) | A | | ECDSA (P-256, P-384, P-521) | [FIPS 186-4](https://csrc.nist.gov/pubs/fips/186-5/final) | A | diff --git a/5.0/templates/header-eisvogel.tex b/5.0/templates/header-eisvogel.tex index 7a5b6279ce..e372e1b18f 100644 --- a/5.0/templates/header-eisvogel.tex +++ b/5.0/templates/header-eisvogel.tex @@ -4,3 +4,4 @@ pdfborderstyle={/S/U/W 1}} \newcommand*{\escape}[1]{\texttt{\textbackslash#1}} +\renewcommand{\paragraph}[1]{\underline{#1}} diff --git a/5.0/tr/0x92-Appendix-C_Cryptography.md b/5.0/tr/0x92-Appendix-C_Cryptography.md index a557a175b3..4607b0d780 100644 --- a/5.0/tr/0x92-Appendix-C_Cryptography.md +++ b/5.0/tr/0x92-Appendix-C_Cryptography.md @@ -49,7 +49,7 @@ Bu bölümde V11.5 Rastgele Değerler için ek bilgi sağlanmaktadır. | İsim | Sürüm/Referans | Notlar | Durum | -|:-:|:-:|:-:|:-:| +|:---|:----|:----|:-:| | `/dev/random` | Linux 4.8+ [(Oct 2016)](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=818e607b57c94ade9824dad63a96c2ea6b21baf3), , iOS, Android ve diğer Linux tabanlı POSIX işletim sistemlerinde de bulunur. [RFC7539](https://datatracker.ietf.org/doc/html/rfc7539) temel alınmıştır. | ChaCha20 akışını kullanır. iOS [`SecRandomCopyBytes`](https://developer.apple.com/documentation/security/secrandomcopybytes(_:_:_:)?language=objc) ve Android [`Secure Random`](https://developer.android.com/reference/java/security/SecureRandom) içinde her biri için sağlanan doğru ayarlarla bulunur.| A | | `/dev/urandom` | Linux çekirdeğinin rastgele veri sağlamak için özel dosyası | Donanım rastgeleliğinden gelen yüksek kaliteli, entropi kaynakları sağlar | A | | `AES-CTR-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | [Windows CNG API `BCryptGenRandom`](https://learn.microsoft.com/en-us/windows/win32/api/bcrypt/nf-bcrypt-bcryptgenrandom) gibi yaygın uygulamalarda kullanıldığı gibi, [`BCRYPT_RNG_ALGORITHM`](https://learn.microsoft.com/en-us/windows/win32/seccng/cng-algorithm-identifiers) tarafından ayarlanır. | A | @@ -67,7 +67,7 @@ için ek bilgi sağlar. Onaylanan şifre algoritmaları tercih sırasına göre listelenmiştir. | Simetrik Anahtar Algoritmaları | Referans | Durum | -|--|--|--| +| ------ | ------ |:-:| | AES-256 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | A | | Salsa20 | [Salsa 20 specification](https://cr.yp.to/snuffle/spec.pdf) | A | | XChaCha20 | [XChaCha20 Draft](https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-xchacha-03) | A | @@ -132,7 +132,7 @@ Uygulama tercihen onaylı bir AEAD şeması kullanmalıdır. Alternatif olarak o MAC-then-encrypt'e eski uygulamalarla uyumluluk için hala izin verilmektedir. TLS v1.2'de eski şifre takımları ile kullanılır. | AEAD mekanizması | Referans | Durum | -|--------------------------|---------|-----| +|---|---------|:-:| |AES-GCM | [SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | |AES-CCM | [SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | |ChaCha-Poly1305 | [RFC 7539](https://datatracker.ietf.org/doc/html/rfc7539) | A | @@ -156,7 +156,7 @@ Aşağıdaki tabloda, dijital imzalar gibi genel kriptografik kullanım durumlar * 254 bitten daha az çıktıya sahip hash fonksiyonların çakışma direnci yetersizdir ve dijital imza veya çakışma direnci gerektiren diğer uygulamalar için kullanılmamalıdır. Diğer kullanımlar için, sadece eski sistemlerle uyumluluk ve doğrulama için kullanılabilirler, ancak yeni tasarımlarda kullanılmamalıdırlar. | Hash fonksiyonu | Referans | Durum | Kısıtlamalar | -| -------------- | ------------------------------------------------------------- |--|--| +| ------ | ----------- |:-:| ---------- | | SHA3-512 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | | SHA-512 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | | SHA3-384 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | @@ -181,9 +181,13 @@ Aşağıdaki tabloda, dijital imzalar gibi genel kriptografik kullanım durumlar Güvenli parola hashleme için özel hash fonksiyonları kullanılmalıdır. Bu yavaş hash algoritmaları, parola kırmanın hesaplama zorluğunu artırarak kaba kuvvet ve sözlük saldırılarını azaltır. | KDF | Referans | Gerekli Parametreler | Durum | -| --- | --------- | ------------------- | ------ | -| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1
t = 2: m ≥ 19456 (19 MiB), p = 1
t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | -| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8
p = 2: N ≥ 2^16 (64 MiB), r = 8
p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | +| ---------- | --------- | ------------ |:-:| +| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1 | A | +| | | t = 2: m ≥ 19456 (19 MiB), p = 1 | A | +| | | t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | +| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8 | A | +| | | p = 2: N ≥ 2^16 (64 MiB), r = 8 | A | +| | | p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | | bcrypt | [A Future-Adaptable Password Scheme](https://www.researchgate.net/publication/2519476_A_Future-Adaptable_Password_Scheme) | cost ≥ 10 | A | | PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 210,000 | A | | PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 600,000 | A | @@ -196,7 +200,7 @@ Parola depolama için onaylı parola tabanlı anahtar türetme işlevleri kullan ### Genel Anahtar Türetme Fonksiyonları | KDF | Referanslar | Durum | -| ---------------- | --------------------------------------------------------------------------------------------- | ------ | +| ---------------- | -------- |:-:| | HKDF | [RFC 5869](https://www.rfc-editor.org/info/rfc5869) | A | | TLS 1.2 PRF | [RFC 5248](https://www.rfc-editor.org/info/rfc5248) | L | | MD5-based KDFs | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | @@ -205,9 +209,13 @@ Parola depolama için onaylı parola tabanlı anahtar türetme işlevleri kullan ### Parola Tabanlı Anahtar Türetme İşlevleri | KDF | Referans | Gerekli Parametreler | Durum | -| --- | --------- | ------------------- | ------ | -| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1
t = 2: m ≥ 19456 (19 MiB), p = 1
t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | -| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8
p = 2: N ≥ 2^16 (64 MiB), r = 8
p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | +| ---------- | --------- | ------------ |:-:| +| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1 | A | +| | | t = 2: m ≥ 19456 (19 MiB), p = 1 | A | +| | | t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | +| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8 | A | +| | | p = 2: N ≥ 2^16 (64 MiB), r = 8 | A | +| | | p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | | PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 210,000 | A | | PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 600,000 | A | | PBKDF2-HMAC-SHA-1 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 1,300,000 | L | @@ -222,7 +230,7 @@ için ek bilgi sağlanmaktadır. Tüm anahtar değişimi şemaları için 112 bit veya üzeri bir güvenlik gücü sağlanmalıdır ve bunların uygulanması aşağıdaki tablodaki parametre seçeneklerini takip etmelidir. | Şema | Etki Alanı Parametreleri | İleriye Yönelik Gizlilik | Durum | -|--|--|--|--| +|--|--|--|:-:| | Finite Field Diffie-Hellman (FFDH) | L >= 3072 & N >= 256 | Evet | A | | Elliptic Curve Diffie-Hellman (ECDH) | f >= 256-383 | Evet | A | | Encrypted key transport with RSA-PKCS#1 v1.5 | | Hayır | D | @@ -240,7 +248,7 @@ Herhangi bir yeni uygulama [NIST SP 800-56A](https://csrc.nist.gov/pubs/sp/800/5 Aşağıdaki gruplar Diffie-Hellman anahtar değişimi uygulamaları için onaylanmıştır. Güvenlik güçleri [NIST SP 800-56A](https://csrc.nist.gov/pubs/sp/800/56/a/r3/final), Ek D ve [NIST SP 800-57 Bölüm 1 Rev.5](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final)'de belgelenmiştir. | Group | Status | -|------------------|--------| +|------------------|:------:| | P-224, secp224r1 | A | | P-256, secp256r1 | A | | P-384, secp384r1 | A | @@ -270,26 +278,26 @@ Aşağıdaki gruplar Diffie-Hellman anahtar değişimi uygulamaları için onayl Mesaj Kimlik Doğrulama Kodları (MAC), bir mesajın bütünlüğünü ve gerçekliğini doğrulamak için kullanılan kriptografik yapılardır. Bir MAC, girdi olarak bir mesaj ve gizli bir anahtar alır ve sabit boyutlu bir etiket (MAC değeri) üretir. MAC'ler güvenli iletişim protokollerinde (örneğin TLS/SSL) taraflar arasında değiş tokuş edilen mesajların gerçek ve bozulmamış olmasını sağlamak için yaygın olarak kullanılır. -| MAC Algoritması | Referans | Durum | Kısıtlamalar | -| --------------| ----------------------------------------------------------------------------------------- | -------| ------------ | -| HMAC-SHA-256 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | | -| HMAC-SHA-384 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | | -| HMAC-SHA-512 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | | -| KMAC128 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | | -| KMAC256 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | | -| BLAKE3 (keyed_hash mode) | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | | -| AES-CMAC | [RFC 4493](https://datatracker.ietf.org/doc/html/rfc4493) & [NIST SP 800-38B](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38b.pdf) | A | | -| AES-GMAC | [NIST SP 800-38D](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf) | A | | -| Poly1305-AES | [The Poly1305-AES message-authentication code](https://cr.yp.to/mac/poly1305-20050329.pdf) | A | | -| HMAC-SHA-1 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | L | | -| HMAC-MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | | +| MAC Algoritması | Referans | Durum | +| ---------- | --------------- |:-:| +| HMAC-SHA-256 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| HMAC-SHA-384 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| HMAC-SHA-512 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| KMAC128 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | +| KMAC256 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | +| BLAKE3 (keyed_hash mode) | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | +| AES-CMAC | [RFC 4493](https://datatracker.ietf.org/doc/html/rfc4493) & [NIST SP 800-38B](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38b.pdf) | A | +| AES-GMAC | [NIST SP 800-38D](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf) | A | +| Poly1305-AES | [The Poly1305-AES message-authentication code](https://cr.yp.to/mac/poly1305-20050329.pdf) | A | +| HMAC-SHA-1 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | L | +| HMAC-MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | ## Dijital İmzalar İmza şemaları [NIST SP 800-57 Bölüm 1](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final) uyarınca onaylanmış anahtar boyutlarını ve parametrelerini kullanmalıdır. | İmza Algoritması | Referans | Durum | -| ------------------------------ | ---------------------------------------------------------- | ------ | +| ------------------------------ | --------------------------------------------- | :-: | | EdDSA (Ed25519, Ed448) | [RFC 8032](https://www.rfc-editor.org/info/rfc8032) | A | | XEdDSA (Curve25519, Curve448) | [XEdDSA](https://signal.org/docs/specifications/xeddsa/) | A | | ECDSA (P-256, P-384, P-521) | [FIPS 186-4](https://csrc.nist.gov/pubs/fips/186-5/final) | A | From f6b7a63923cea2f81dcd3f9f919f90beda16ea7b Mon Sep 17 00:00:00 2001 From: Shreyas-Madake Date: Wed, 12 Nov 2025 23:41:25 +0530 Subject: [PATCH 64/93] Fix: Updated outdated threat modeling reference URL in ASVS 5.0 (#3289) * Fix: updated outdated threat modeling reference URL in ASVS 5.0 (Appendix D) * Revert translation changes for Appendix D --- 5.0/en/0x93-Appendix-D_Recommendations.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/5.0/en/0x93-Appendix-D_Recommendations.md b/5.0/en/0x93-Appendix-D_Recommendations.md index 496dd5ba61..fd387b5aaa 100644 --- a/5.0/en/0x93-Appendix-D_Recommendations.md +++ b/5.0/en/0x93-Appendix-D_Recommendations.md @@ -44,6 +44,6 @@ There are a number of security processes which were removed from ASVS 5.0 but ar References: * [OWASP Threat Modeling Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html) -* [OWASP Threat modeling](https://owasp.org/www-community/Application_Threat_Modeling) +* [OWASP Threat modeling](https://owasp.org/www-project-threat-model/) * [OWASP Software Assurance Maturity Model Project](https://owasp.org/www-project-samm/) * [Microsoft SDL](https://www.microsoft.com/en-us/securityengineering/sdl/) From 8d7dd9062d18823e2740e2878ddacf0fd331e304 Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Wed, 12 Nov 2025 21:14:36 +0200 Subject: [PATCH 65/93] Clean translations out of master branch (#3296) * Clean translations out of master branch * Fix links * Revert korean for now --- ...ecurity_Verification_Standard_5.0.0_fr.pdf | Bin 577938 -> 0 bytes ...ecurity_Verification_Standard_5.0.0_ru.pdf | Bin 572381 -> 0 bytes ...ecurity_Verification_Standard_5.0.0_tr.pdf | Bin 544438 -> 0 bytes ...ty_Verification_Standard_5.0.0_fr.cdx.json | 3057 ------- ...ecurity_Verification_Standard_5.0.0_fr.csv | 347 - ...curity_Verification_Standard_5.0.0_fr.docx | Bin 225553 -> 0 bytes ...y_Verification_Standard_5.0.0_fr.flat.json | 3109 ------- ...ication_Standard_5.0.0_fr.flat.legacy.json | 4489 ---------- ...curity_Verification_Standard_5.0.0_fr.json | 2774 ------- ..._Verification_Standard_5.0.0_fr.legacy.csv | 347 - ...Verification_Standard_5.0.0_fr.legacy.json | 7259 ----------------- ..._Verification_Standard_5.0.0_fr.legacy.xml | 1 - ...ecurity_Verification_Standard_5.0.0_fr.xml | 1 - 5.0/docs_fr/fr | 0 ...ty_Verification_Standard_5.0.0_ru.cdx.json | 3057 ------- ...ecurity_Verification_Standard_5.0.0_ru.csv | 347 - ...curity_Verification_Standard_5.0.0_ru.docx | Bin 243966 -> 0 bytes ...y_Verification_Standard_5.0.0_ru.flat.json | 3109 ------- ...ication_Standard_5.0.0_ru.flat.legacy.json | 4489 ---------- ...curity_Verification_Standard_5.0.0_ru.json | 2774 ------- ..._Verification_Standard_5.0.0_ru.legacy.csv | 347 - ...Verification_Standard_5.0.0_ru.legacy.json | 7259 ----------------- ..._Verification_Standard_5.0.0_ru.legacy.xml | 1 - ...ecurity_Verification_Standard_5.0.0_ru.xml | 1 - 5.0/docs_ru/ru | 0 ...ty_Verification_Standard_5.0.0_tr.cdx.json | 3029 ------- ...ecurity_Verification_Standard_5.0.0_tr.csv | 343 - ...curity_Verification_Standard_5.0.0_tr.docx | Bin 223892 -> 0 bytes ...y_Verification_Standard_5.0.0_tr.flat.json | 3073 ------- ...ication_Standard_5.0.0_tr.flat.legacy.json | 4437 ---------- ...curity_Verification_Standard_5.0.0_tr.json | 2750 ------- ..._Verification_Standard_5.0.0_tr.legacy.csv | 343 - ...Verification_Standard_5.0.0_tr.legacy.json | 7183 ---------------- ..._Verification_Standard_5.0.0_tr.legacy.xml | 1 - ...ecurity_Verification_Standard_5.0.0_tr.xml | 1 - 5.0/docs_tr/tr | 0 5.0/fr/0x00-Header.yaml | 16 - 5.0/fr/0x01-Frontispiece.md | 46 - 5.0/fr/0x02-Preface.md | 29 - 5.0/fr/0x03-What-is-the-ASVS.md | 195 - 5.0/fr/0x04-Assessment_and_Certification.md | 47 - 5.0/fr/0x05-For-Users-Of-4.0.md | 90 - 5.0/fr/0x10-V1-Encoding-and-Sanitization.md | 103 - .../0x11-V2-Validation-and-Business-Logic.md | 73 - 5.0/fr/0x12-V3-Web-Frontend-Security.md | 100 - 5.0/fr/0x13-V4-API-and-Web-Service.md | 64 - 5.0/fr/0x14-V5-File-Handling.md | 54 - 5.0/fr/0x15-V6-Authentication.md | 166 - 5.0/fr/0x16-V7-Session-Management.md | 91 - 5.0/fr/0x17-V8-Authorization.md | 56 - 5.0/fr/0x18-V9-Self-contained-Tokens.md | 36 - 5.0/fr/0x19-V10-OAuth-and-OIDC.md | 169 - 5.0/fr/0x20-V11-Cryptography.md | 107 - 5.0/fr/0x21-V12-Secure-Communication.md | 57 - 5.0/fr/0x22-V13-Configuration.md | 68 - 5.0/fr/0x23-V14-Data-Protection.md | 60 - ...0x24-V15-Secure-Coding-and-Architecture.md | 77 - ...V16-Security-Logging-and-Error-Handling.md | 84 - 5.0/fr/0x26-V17-WebRTC.md | 75 - 5.0/fr/0x90-Appendix-A_Glossary.md | 89 - 5.0/fr/0x91-Appendix-B_References.md | 43 - 5.0/fr/0x92-Appendix-C_Cryptography.md | 312 - 5.0/fr/0x93-Appendix-D_Recommendations.md | 49 - 5.0/fr/0x94-Appendix-E_Contributors.md | 71 - 5.0/ru/0x00-Header.yaml | 15 - 5.0/ru/0x01-Frontispiece.md | 46 - 5.0/ru/0x02-Preface.md | 29 - 5.0/ru/0x03-What-is-the-ASVS.md | 195 - 5.0/ru/0x04-Assessment_and_Certification.md | 47 - 5.0/ru/0x05-For-Users-Of-4.0.md | 90 - 5.0/ru/0x10-V1-Encoding-and-Sanitization.md | 103 - .../0x11-V2-Validation-and-Business-Logic.md | 73 - 5.0/ru/0x12-V3-Web-Frontend-Security.md | 100 - 5.0/ru/0x13-V4-API-and-Web-Service.md | 64 - 5.0/ru/0x14-V5-File-Handling.md | 54 - 5.0/ru/0x15-V6-Authentication.md | 166 - 5.0/ru/0x16-V7-Session-Management.md | 91 - 5.0/ru/0x17-V8-Authorization.md | 56 - 5.0/ru/0x18-V9-Self-contained-Tokens.md | 36 - 5.0/ru/0x19-V10-OAuth-and-OIDC.md | 169 - 5.0/ru/0x20-V11-Cryptography.md | 107 - 5.0/ru/0x21-V12-Secure-Communication.md | 57 - 5.0/ru/0x22-V13-Configuration.md | 68 - 5.0/ru/0x23-V14-Data-Protection.md | 60 - ...0x24-V15-Secure-Coding-and-Architecture.md | 77 - ...V16-Security-Logging-and-Error-Handling.md | 84 - 5.0/ru/0x26-V17-WebRTC.md | 75 - 5.0/ru/0x90-Appendix-A_Glossary.md | 89 - 5.0/ru/0x91-Appendix-B_References.md | 43 - 5.0/ru/0x92-Appendix-C_Cryptography.md | 312 - 5.0/ru/0x93-Appendix-D_Recommendations.md | 49 - 5.0/ru/0x94-Appendix-E_Contributors.md | 71 - 5.0/tr/0x00-Header.yaml | 16 - 5.0/tr/0x01-Frontispiece.md | 46 - 5.0/tr/0x02-Preface.md | 29 - 5.0/tr/0x03-What-is-the-ASVS.md | 195 - 5.0/tr/0x04-Assessment_and_Certification.md | 47 - 5.0/tr/0x05-For-Users-Of-4.0.md | 90 - 5.0/tr/0x10-V1-Encoding-and-Sanitization.md | 104 - .../0x11-V2-Validation-and-Business-Logic.md | 73 - 5.0/tr/0x12-V3-Web-Frontend-Security.md | 101 - 5.0/tr/0x13-V4-API-and-Web-Service.md | 64 - 5.0/tr/0x14-V5-File-Handling.md | 54 - 5.0/tr/0x15-V6-Authentication.md | 166 - 5.0/tr/0x16-V7-Session-Management.md | 91 - 5.0/tr/0x17-V8-Authorization.md | 56 - 5.0/tr/0x18-V9-Self-contained-Tokens.md | 36 - 5.0/tr/0x19-V10-OAuth-and-OIDC.md | 169 - 5.0/tr/0x20-V11-Cryptography.md | 107 - 5.0/tr/0x21-V12-Secure-Communication.md | 57 - 5.0/tr/0x22-V13-Configuration.md | 68 - 5.0/tr/0x23-V14-Data-Protection.md | 60 - ...0x24-V15-Secure-Coding-and-Architecture.md | 77 - ...V16-Security-Logging-and-Error-Handling.md | 84 - 5.0/tr/0x26-V17-WebRTC.md | 75 - 5.0/tr/0x90-Appendix-A_Glossary.md | 88 - 5.0/tr/0x91-Appendix-B_References.md | 43 - 5.0/tr/0x92-Appendix-C_Cryptography.md | 312 - 5.0/tr/0x93-Appendix-D_Recommendations.md | 49 - 5.0/tr/0x94-Appendix-E_Contributors.md | 71 - CONTRIBUTING.md | 10 +- README.md | 6 +- 122 files changed, 8 insertions(+), 71217 deletions(-) delete mode 100644 5.0/OWASP_Application_Security_Verification_Standard_5.0.0_fr.pdf delete mode 100644 5.0/OWASP_Application_Security_Verification_Standard_5.0.0_ru.pdf delete mode 100644 5.0/OWASP_Application_Security_Verification_Standard_5.0.0_tr.pdf delete mode 100644 5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.cdx.json delete mode 100644 5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.csv delete mode 100644 5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.docx delete mode 100644 5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.flat.json delete mode 100644 5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.flat.legacy.json delete mode 100644 5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.json delete mode 100644 5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.csv delete mode 100644 5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.json delete mode 100644 5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.xml delete mode 100644 5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.xml delete mode 100644 5.0/docs_fr/fr delete mode 100644 5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.cdx.json delete mode 100644 5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.csv delete mode 100644 5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.docx delete mode 100644 5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.flat.json delete mode 100644 5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.flat.legacy.json delete mode 100644 5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.json delete mode 100644 5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.csv delete mode 100644 5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.json delete mode 100644 5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.xml delete mode 100644 5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.xml delete mode 100644 5.0/docs_ru/ru delete mode 100644 5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.cdx.json delete mode 100644 5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.csv delete mode 100644 5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.docx delete mode 100644 5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.flat.json delete mode 100644 5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.flat.legacy.json delete mode 100644 5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.json delete mode 100644 5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.csv delete mode 100644 5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.json delete mode 100644 5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.xml delete mode 100644 5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.xml delete mode 100644 5.0/docs_tr/tr delete mode 100644 5.0/fr/0x00-Header.yaml delete mode 100644 5.0/fr/0x01-Frontispiece.md delete mode 100644 5.0/fr/0x02-Preface.md delete mode 100644 5.0/fr/0x03-What-is-the-ASVS.md delete mode 100644 5.0/fr/0x04-Assessment_and_Certification.md delete mode 100644 5.0/fr/0x05-For-Users-Of-4.0.md delete mode 100644 5.0/fr/0x10-V1-Encoding-and-Sanitization.md delete mode 100644 5.0/fr/0x11-V2-Validation-and-Business-Logic.md delete mode 100644 5.0/fr/0x12-V3-Web-Frontend-Security.md delete mode 100644 5.0/fr/0x13-V4-API-and-Web-Service.md delete mode 100644 5.0/fr/0x14-V5-File-Handling.md delete mode 100644 5.0/fr/0x15-V6-Authentication.md delete mode 100644 5.0/fr/0x16-V7-Session-Management.md delete mode 100644 5.0/fr/0x17-V8-Authorization.md delete mode 100644 5.0/fr/0x18-V9-Self-contained-Tokens.md delete mode 100644 5.0/fr/0x19-V10-OAuth-and-OIDC.md delete mode 100644 5.0/fr/0x20-V11-Cryptography.md delete mode 100644 5.0/fr/0x21-V12-Secure-Communication.md delete mode 100644 5.0/fr/0x22-V13-Configuration.md delete mode 100644 5.0/fr/0x23-V14-Data-Protection.md delete mode 100644 5.0/fr/0x24-V15-Secure-Coding-and-Architecture.md delete mode 100644 5.0/fr/0x25-V16-Security-Logging-and-Error-Handling.md delete mode 100644 5.0/fr/0x26-V17-WebRTC.md delete mode 100644 5.0/fr/0x90-Appendix-A_Glossary.md delete mode 100644 5.0/fr/0x91-Appendix-B_References.md delete mode 100644 5.0/fr/0x92-Appendix-C_Cryptography.md delete mode 100644 5.0/fr/0x93-Appendix-D_Recommendations.md delete mode 100644 5.0/fr/0x94-Appendix-E_Contributors.md delete mode 100644 5.0/ru/0x00-Header.yaml delete mode 100644 5.0/ru/0x01-Frontispiece.md delete mode 100644 5.0/ru/0x02-Preface.md delete mode 100644 5.0/ru/0x03-What-is-the-ASVS.md delete mode 100644 5.0/ru/0x04-Assessment_and_Certification.md delete mode 100644 5.0/ru/0x05-For-Users-Of-4.0.md delete mode 100644 5.0/ru/0x10-V1-Encoding-and-Sanitization.md delete mode 100644 5.0/ru/0x11-V2-Validation-and-Business-Logic.md delete mode 100644 5.0/ru/0x12-V3-Web-Frontend-Security.md delete mode 100644 5.0/ru/0x13-V4-API-and-Web-Service.md delete mode 100644 5.0/ru/0x14-V5-File-Handling.md delete mode 100644 5.0/ru/0x15-V6-Authentication.md delete mode 100644 5.0/ru/0x16-V7-Session-Management.md delete mode 100644 5.0/ru/0x17-V8-Authorization.md delete mode 100644 5.0/ru/0x18-V9-Self-contained-Tokens.md delete mode 100644 5.0/ru/0x19-V10-OAuth-and-OIDC.md delete mode 100644 5.0/ru/0x20-V11-Cryptography.md delete mode 100644 5.0/ru/0x21-V12-Secure-Communication.md delete mode 100644 5.0/ru/0x22-V13-Configuration.md delete mode 100644 5.0/ru/0x23-V14-Data-Protection.md delete mode 100644 5.0/ru/0x24-V15-Secure-Coding-and-Architecture.md delete mode 100644 5.0/ru/0x25-V16-Security-Logging-and-Error-Handling.md delete mode 100644 5.0/ru/0x26-V17-WebRTC.md delete mode 100644 5.0/ru/0x90-Appendix-A_Glossary.md delete mode 100644 5.0/ru/0x91-Appendix-B_References.md delete mode 100644 5.0/ru/0x92-Appendix-C_Cryptography.md delete mode 100644 5.0/ru/0x93-Appendix-D_Recommendations.md delete mode 100644 5.0/ru/0x94-Appendix-E_Contributors.md delete mode 100644 5.0/tr/0x00-Header.yaml delete mode 100644 5.0/tr/0x01-Frontispiece.md delete mode 100644 5.0/tr/0x02-Preface.md delete mode 100644 5.0/tr/0x03-What-is-the-ASVS.md delete mode 100644 5.0/tr/0x04-Assessment_and_Certification.md delete mode 100644 5.0/tr/0x05-For-Users-Of-4.0.md delete mode 100644 5.0/tr/0x10-V1-Encoding-and-Sanitization.md delete mode 100644 5.0/tr/0x11-V2-Validation-and-Business-Logic.md delete mode 100644 5.0/tr/0x12-V3-Web-Frontend-Security.md delete mode 100644 5.0/tr/0x13-V4-API-and-Web-Service.md delete mode 100644 5.0/tr/0x14-V5-File-Handling.md delete mode 100644 5.0/tr/0x15-V6-Authentication.md delete mode 100644 5.0/tr/0x16-V7-Session-Management.md delete mode 100644 5.0/tr/0x17-V8-Authorization.md delete mode 100644 5.0/tr/0x18-V9-Self-contained-Tokens.md delete mode 100644 5.0/tr/0x19-V10-OAuth-and-OIDC.md delete mode 100644 5.0/tr/0x20-V11-Cryptography.md delete mode 100644 5.0/tr/0x21-V12-Secure-Communication.md delete mode 100644 5.0/tr/0x22-V13-Configuration.md delete mode 100644 5.0/tr/0x23-V14-Data-Protection.md delete mode 100644 5.0/tr/0x24-V15-Secure-Coding-and-Architecture.md delete mode 100644 5.0/tr/0x25-V16-Security-Logging-and-Error-Handling.md delete mode 100644 5.0/tr/0x26-V17-WebRTC.md delete mode 100644 5.0/tr/0x90-Appendix-A_Glossary.md delete mode 100644 5.0/tr/0x91-Appendix-B_References.md delete mode 100644 5.0/tr/0x92-Appendix-C_Cryptography.md delete mode 100644 5.0/tr/0x93-Appendix-D_Recommendations.md delete mode 100644 5.0/tr/0x94-Appendix-E_Contributors.md diff --git a/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_fr.pdf b/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_fr.pdf deleted file mode 100644 index 6cd8cc4032acd17658a8b820b1c83aa3ffe2e41f..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 577938 zcmZ5|bzD?m(6@nrpo9o0jkKh~(ku;%ERB?;LayG^;W`6~8E1KC^xLD%xKIZ{} zz+gOQ7bi1gTRe~PKWX7QlRdvAx`;)E0@>w_h;KS!(L6DFe}nm!B9;W!Jz}1i8yH$5 zL%AK+5rXGWU-oOQ1GsbZ)zO5H0Ew+^405kv5emZ$UH9XZv>YwpN6t2g9@)~DN;!Q zqLFq&&Yu4(giBi+{}mqsT0)JH@R4bNJjSX?VLG<(LbHZ+8$+WLifBBBkzbbOSZ%?u z=db|Mi=bld7v_&gK%j%NdOHsR%(Q2E<|p5NN;lP48{o0nW7fUVtC3yL(2ThxB9#4V z`0$y&gWg5q(`ib8A~Bn=)SP$ES#NzkW``L=$TY?8AVL$K)5lmxN!0O)n5O4#uvPs!1(xWqj+zMxg%k*1D9)mC#DsZD2;N(RouJjyn>6f>9Y47)wm>c8y8cH=PRE zTLQxyH-t^`2dEB7^2@$r^to||S^7xP2BVEc$j!2pvag6&hqkwXA+9RbLh|0JikI-uLJReCV1sZoL-m}vAf+Y^Q+`f!be46mH|mmC1Y?>D-Y zVqOZ%V`khSf|z2!xiN%w{TCZSC_^%aQD!i}luo%qh=~$oA`xWp-7k6I;sgH@X?C~` z20+XA%!1Fl(ZU*7#|qvy?h($Pe1 zxlQM-*AicJmnqOl{Z=u<=s(XWBD6#wtn50xgK;Mvzu=bW18rFVynx@c4}0EQ#yq9L zDBaQC&E~oC>{*K15XP=2S+!3+a2+LO-GRaTpg;SJr{4Kwdk5CLWv*xYwBoD#Pi^$L zF0cIYzxJb7?UVQEfO)tXmdJN7a~A>V#!}0n`X7@Mf5S?Skq=vAgu2|oeJqF@IDGSC zQHb$t<=t10BZ_}scIQO8jL3sH9|5=9%zQ|dg;n$f{MW00os-JGzASs+EqE7$sYJP{ zmZOFs6xIMQm|A*6?zsz!eXG-y{<`WdX5F|)QZUVnyhBEH{JF_kx;9ToxhV{uxG{s$ zFk4@((deT*jReEUa^HArOu!LQNrv$ig_!ftz3KlY&>KKYE`sqn9cvpz)SfI+C&a_} zL`pzM&D_dAcFLW^_9k#->16H797&q%whqC@3gIpx4+>J zC|Z1TH%{?ny;O3;c=wpTWHECChTtT^l_d58y2{69p4t4~qM5I4Xv^7w)+5iZ% zFe0)6I2o}F!0vPG@}44LdAD7@-5`sSfB=Qaacm+Zn?gg@rGc)IbO)D=# zPj3T4c{-zUO04>q-!Jp`sMB8h^DT5^$oa_0T4h{lzY1)M`-l84L(DZwFGU%#G%ZL6 zn()ETgI`?3Ei}o3MGrIXHNUt&iiro}ilS#gX=n~vqyt7Do+0$QFcY5rH240lhw+c~ zn+&30%O6it7_%`8amJ_*5F_53#>-$3FK@S9_Y{-md;1YFMjT58P)?nlwsw+K<<$e` z8(oek3U5Cc0<6yD=8B~HrY@t7mB)gsx{oO}Pk12x!sH!GW2*R!~y0Y`YC8? z>BM8wn4DFw!@G?i0gWhm(b9w@d4mae9)v1y8oG7~C?i@e5w|c2V-#B1wz;`Pm|jh= zq#0ukDE<8d#F?Lo@&%!V9={`|jN%UPv5l1~x`7?hk#KTR8-TPLn$ylY!Fw)qrJvp~ z=G@yV2@nVG%ZI5}xNU{TtFw^cTrb%646&R)ui8K_PP+gDrtmN#MbBE}-NI7dxLi*N zX?MxYr&rgui@&?we!d#$5AF0K8MD_@BIaM$;P!VWSWuBIuulsD z+Atc!HYGcG3GQ!J$jkGlKLbdDfJFfhPS8zT2>nk@}UWPMP7gs+TR4Xs_>u@E{t5o z@O~exgR#P}lUL?)>fcZM(dPr@D!^)8#lM}`WcECmA7Hsbk(#=3VH4re6=*JWmdpil>d z?7g@@H886R2ru}dz+a$l^Ff+^ZRX2HJrt<>r3`PxsI*f%G@cfw&2!>0!+1zR1MCRj zGga90b!an5`67;@1NSiS1xc0k5r?IBMd_xY)+q^r)Hf20vQO~i`DFXV{*i9CB;P&2 zlDW*+%kP8fVAv2~b)#9+qq?2}+t_8%$yLg**G_{q5n&i(aJO7d1BcOkZ_w~Bo`7r# z`-HuymtuMEZ0za2WMTBak-O+D^MtxzS;LRR3R8U6)Tay2e~&#xnhICkCg8XO?89m2 z22Aarb@^+}ab8FRh4BSt?)iKrt>}2wAe)yA6sWrrELrjlzyN9D!_+wu}SvxLAMAi=J0-Ve6=88p^vU%GkA_qt7kl!GpcygG_9ydMQ2|C z%})T|kRTH-a=-7`eD}d2%;QZw8KCJ0W{QxyUF@03#7OaF9AWV{oglVDLV*6HcZVFF z42Kq$C=}H)%W4Ca;Folcn+SX@L$kR4BAb+Lm^D_m8&E1>QRR1jxE1#Ix1~u2CN+W9 zzZ?KP)TE7bnA?c3VksF8hYdmltt<3_8bJ4wwv~^>^qZdgSN{6{XiN|Jp(e1_#>pAN zt8DEuwN}s=CfPm^?NNfBAsmh!>(47svX3Yi_2UmQDidJnApt+P&`T|;7lUV{0&mwc ze!2n0B0z)H{u$y+@*Ag)1j)}nH_(;a%p(J%AFfQS1;$&M0(DvPAeNJoZ?OX^I07|w6EXf_H1LM-FJi+7Os zk~FoQy|T{qUZduhEDyD%fKYi)y7uUy-o`C+fJyZ3#m%*G9rSGjK!1tU7qle6!icBA zC4SfgPraVvgkb}U%52h@IMl!TU99$fKPUJXVjZ6Z=!^m$5gUM4K4cD_q;X%J7u(wX z%GK4mmQTF4cBhwbE-b(wUhqiiQj7Cnf~T$( z1(Ha713JJ;tjWYc@u-B%&)Ol6#f8p%D=H}>Ff~>t!15(TEiilD9qiQbfD=a1F_#C( zo@3Bei@$JIjk_|qT;og9;{(0FuJx@9$s`>g&EFI^4wRI?Os7~}PGtb5uMRvdXTnm2 z*Ltuzq5RxVMPzeUA7Zu&T&nI=I<>&Jspfrzlb0j&uem_)c`&H|ezA;I=a$GPRFJ9} zsaujEQuer9_`W*!^B_Q+l$;YNeth#e&2s;5tuPs1x65%x_PR<703bReM(035R+Ye+ zy2|HCofmt`gkLSY6}C(89b+iAw9zrvxXj3W+)VBwhe1LMO5K)piWlYRpRN(VW9_aKe4|pflbV81{sv9wTUV} zcrCQ^K=c%|zXk_R@@y~ECd=q_o)l|3>#3l>eq4s;d|C0KsO#W^V_INidM)c8?T^R1 zE1YDkZ=N?y%{KGJmbIMBpZEzZb{_>m^?*r|^kl<~>85S5R}l9W(uw;C4RB&)WS8Nh zc#7QCAl-T`U=~*Jn*+DR0mME3jnXzv!M*q;?y+XS=E&e73sat+fD5%cb4* z^h*0i;=p~)$|-C9$kCa&Z_wrV_O$IoWZ|g%`bA@p1o?fs_I*cEW>} z*sEr9rdy#u8kCvY>wTWP6FQ^2uEGx5Uk_yw7EYhz-@EfQleu>VURcL@eptI_n*}>r z`_eumTzhwADx5Pb&(NueYUyMZIJZ%s?JY@KSe;j{A~`m#ALPq99NimuclJw-lU(;i zxfwZHW9frlX%$f&=pe?2R`}Qz!*T{T4znj^Kvre= z4|Rl`_7sbT^!1Qej0a*0cRp%^1f#nbZa4@n?#<+*`nzzc?Aodo>e zeLqsj1^dGp8BpDpe&WeD)+R$){h8c_6tlTH@I$)PNoJa!$F{$jPCQ&Z zGYBRp`N;W@5+CcgLcFT;SHNZ`O}IN1u$~&bY}lKlPy>6a;l4k0lo472NzPLo#jl{` zu}J4~K`6=xnn07?VIqkr7ykLegY{SQT({VW@Om67V``U=^d2MpP$>%FofFE z{IM41fe)UK1Oynd#kd%cc5^e}`+NL_IIop-Pn9As_2+ay`sv9=$Mzx;?sN zQ8ye|_=?yO$vPd^bKrf9aw*ybG}P#Qv|b_1=TtWRt1CtPw?2!i-CO?qbme0LPbvL# zI0(8tIYx!A);jrBA*CY115rKvZ`XohC*Q~?6cs?U<7P|qk_vY|2s+o37d_o1M{>R` z+%=Yr#ozW#nNq!B6|dF_TEMe5kGI4|kZzujH}&QK$n~=Df;nHB*Cib-YB-M%%?p3zz7f#4uG;C_mlb0%vW>|{|evW{4US{MM! zn+=xd*&pltb#%hmRiil$%Q1V zD_YF&Ts#B)sJcol@ZXvN;PJ( z`Ljg71^YlGUwU2+4XYIo}7WM3YjuSr!G{awQpN?jvWtxO> zLu$Fjqj&mv(FH*k(NKcZdUVnAEN(c=Yd}tU{at@Q)xN}S708+tpWB^BhRf!LL_aPk zixnn)-bngWsU7v5KFJzuXAJ>OkfuZEp8+#klzdC9nj+^@y_IO zW4b2=A~$f?@La8`ky85bJ?~QWJ&k}q>=P;h?@s6}Obuixeczf{01D=#I3T&9f|xUK zchqD&>URaofW7he_aJ8Whq~JDnyGNar!0v6t9DW8=?&B5TT7rpt6=mcE1u3CAo!M?6IlT^M^pLb!; zx|!;%XjzMib~^Fd%Iw}q#l(|MxiU8D{AIc_Jxc)uQOoC>{cf5WE14S3d@x#_r|Bxc z?u5j+A*hoYSZX%CdR+Wt1UOA@Z zPOp=;&*d)@m5JCsqYyHb=&|eR$jF$$CtP<1vEDDJiS%A8*pA11MoIK>cak=9}; z>F*_u!~E)|viPg=?`vPo|y6O$pC6oIOUho4nEppW@pDMtYa=s}Tr6-J^ zw$qo0DzL21Ny!GST1sHrUoG)F}myR4u=~AA1M@T_wv$kHX2Ryk^8W4 z^WfROBw;YL-XrmO2DiK##lc9*8?@ELpA~`aJ*G?41>arjcu#_wW<8;@vK7R{-M)>0 zyg|?3&y6AN(n;@Gf<>INVeR!>HMNaU>|JVOK)S zuI?18CW^K^pL^vv6#39Yv{>?73Ltau%qG$rd;s4DMoqRp488vbM1*<=Uh= z)q_lGE>6eeBaYL(`xH5m&PyORZiX(r^1ZCFo|s>E+-f=3lYMxP7De^T6<>2?N)gF% zSxaeqVH(jl#gZeIFD!QGbJ1kV)n16V1=c|QS=xM(BOr;`5=B`VZorgNKr_avd6Ok6piHMV`y9}jYwY=@I6q@!IZC-Bh-ko9c^t^sFdnSvVNE zJRrqga+c+^%Xihil=EXxY|udy>GMg!v;kWZ!jRtRIJG>Uhk$MG`5T0w>r1Z+?K=wk z>krt`*gMVF^O&Z_I+&-WFhjod^yqZ9}5cWH|Xx%Y0VCQP8RA0 z$E7sE%1StThB`ysy}5d2C?XhiATVh!&nls=75Pm43fjA8&6e{6$9arh8ieCKCH1Vf zlYC(|zB|&yu;arBmrqFU)+@(R-!HGcllCBMH2DqCbkB3Ut8RHbJ<)qd?(dIrB_YVx zGd7X)9BXjHRfEDp*@lmco>UV4?P4o4-gY!XSt&y!qzFsp^rr)z&jtiFq*Qh_#&@-s^RCv#<=X1!B>Ou9WZFD65ahnk6#K{>|3WUcSa3r zpe~H_M(5n`!!dVm{79(NRA8EpNDF$W+jQaL>rxFDHE`N|)JbAH3GUB6x8vMy6H`$v zJUQniHN;QWS7kP=dlB_M6D~9$*+aD~>%TMkQ$lnR~I{AHEW3A;d{v$gH`$Nm|=&lmQRIUcM}_xry#IBc+3 z*iMY$n7G}U4=ch}@gpCE1bvA9IbswD69Xr&I8#h3SEg&O>u>dJ9PHTXdAOhhy@L6* zidL&(EDzoveST#6O{~5-)mzER%YUnBz>2L<=)*?!*uBMz`0gKFWI6Rp_~mLxC(0Sh ze3Z1~_iQS}RH_Pv9)#DqXW)i2-XR|T!$dXUZ8lAM-@}h(`|?a6PuSIK`FZC_&Clgz zD>sN6h(;49aVp`bt*7F>3PF8)H|n*KCFatJ*FMM6E3nXPxKP+N&Z-5QsJNN)IF=V6Y%MgxjTeh z^VdZ2iA^I8jd{(JPl4x5*asQY$&2Ugyh5AoDcL0I8qSYKr@Y-B_p_i6gFz&GFo|to zFHq=F!hRP&E#fKTo%vf6`P^Z)y2qWU>%8+Px^GWk>9F$3FtzEVaAuLyU03R=$gj`M zcX4i(I<6dELlSg~4Z8gR!akOenhccT+O2eI9oL7ySmHB|@afosL1);Ylu8}J0d#JD zcoz+;ALMR8oZ;`w=dgq-FC}W1CrH6z7Aw#5Vjq=U{EIcJU;+RFkgR`9CzSIJfE=AbZFCKf4D|&@<8wp#EnXDjokUe zpLZWs5H&0EMaLO3OjZL-csa|SUwqUJ&OL?H1U4m}*$k?^!1#mRP^O+B}0u z-J6ea*Yi+UmK-ol6>&-Vpx$TwL09)aF2SeXN{IXwyWD&jlNhcA+M>X2Gcpug(J`gO z>S9}XpM1u750Zshna1$! zJpcZFqz>5}Pc!9Me8XAa@J5h?MMLK&PeR7p>`xz{htb6Dp0J}^AW;!_HrdyvSBtN@ zT@=1WyyJ&_jvGk2d$w_3Xxn%3CI8H(j#uiRW!YVjw`ZyC)TNhj!t3SWvz^pUChwU* zZm_U2+J0*)bZStp-`Sb)!-RJzlwh{ro1@uN+iJ+;y@I}GEdGwyVu%kRV@>v_kI=*W zHd~h?vOhMah$EhGUv}$LF2n0|8t!>UqATS3tF{d+$>eEZ%iIe8DLAa1^?@l;cpO)gv(V4ToQw)ee% z_6}Ay)y?$iOD^o<(ESgAwL)>JUB>3a++pJs;c?HJH;$zfM$Pf$6FxdR{+Ba}CkfjI zIw(8+D4p}#`JPrzkN5O17)4KBSn^&j2MQp--nTlIne&%#lume981H~oqx9AJj(+*n zQ=Z-ixx0VmaWp9u>akNm`&+IkzR1pBUe;oESdU{*Y(CkZkL~HT_n(Ldk1fO2WL;lB zK6(JznkDcNOp#eQAc_Vx{lQhN>fOu5ukO3&FKX`y@DV}ve$at^Vs#zA=FrQ8Uylgo;}sGd?Zv~uZ5>Xcfomf=1$B1| zlP_HcII?`T0)_V6GE?v>U-t zS9CJ_glJ6XsBcu*1CeOLH%Sq^ed2_|afi{zGbxaFUjq5^%}+;d`ISzDlO@k0<48!` zOHgsCBDSZZxy-w4h315#lN2H!w8dvcO&GIb12cNw0)_j5sVBSRo7fPtZe}dng)A9r zmQfP7cI%igNroocW_nNegQ3j+Q=y!_?YAQ1&pxJ*rj$rjc|)iMkUZM#r~{S)*m7yz zfit;af>ZB3wfUdDJC?B1nR?V}Uq$=^$Mnj)nP`IL_ZY3g`!#8ss9nCB?Zb3ge&i^{ z%X$RGYpS9q!q1$&KRF#f%f5q?e-%}(41MxVUlf9Rlf?S#%u#_#p>C;R%e@E6SmlbA zpA>wX2;l~_)SlkOs~}{ha+p2q%is1mGaJ&I~@N!9*}&3pNxx; z=T$CPYaIGcJLHE2gw^VZnkEEUHGyDXeXy}I(be|N3UyZ<`%_-~L)|dNd zscc?e`7v8cmPs6i$)~QA2$mc?C`BoU!c>Z?R7=LAz<8P$mhw^+g;ua%Ezd4F%l(?I zs~*9uOR=)*tSK6ZR*q|<{=j`vi^Qzc>n?YuEH|H4XTptDB+ZGWLFz4b@%Ew>neZ_? zNLG4JKCavwNk}`*3%QGrfND(p(GTbVdFnjaYp^14S?N{Dsn!CA^1?@mA*C0i)4-e3 z%oHD&ulG~nNUh{x4h`Oe4gRlTzx#e##;LL5Sybf;!+KPGz37rtUTJ~uGYF-O=XH!P zY}Ix+=sU}z&ezydRlDIW9J22^=#pBc<9nmwUT5rzBg>{5K(b%dLn;DIdW=24vvwSJ z?@~rN5XPz!G9u9|#jsGFRZ1Tfql?B!qkB^zEyBVJ)LRk@KjH8t?2Ch)Tj7#iT7&U4 z{PO0K6v-z*3Ld+r{M7a_H+Av)tQc!lQSm?-f&hzsP{fC5gYHL?+Nij{J3uSN2hKBh zfoSusk+>Ed6>E+>4{`fNis$VrrfG*HCCi%Kf^3W*b4!3oFsL!Nh1`g*tLRH4A*qXI zXZu-&^D+4kyclNw$xy(?@T<5$#ezY_+_32SNMm&3FdFH2tZLkq%Qo}m!=uI0h=y)8 zDW97mOw1x!GF}E6yt^CxcZ+3eiHsgpxl)HjI@Mbb-tJa(Q-2MqEMGodVRIN%SmFGA zi~qwTTm7pw?f1Or48iO6V5HU?e$!Ay+UH`!@JV`%os?Cqqj`PxuNmTEdYUFeCvJz= z8vZJ@s!H5LwmE2TLeyh#!?8Lfid@cPN5TXlzNojT*q zhbYDK`uh(Cb9%)EsKRB*d?3w(kMbIrzv9H5z0w6CWE?k7XAP~rpFPI!rTiGguPV^u zR+4YQ66TqyHA90CGkiCfj1BE?FSq)=+fxhV6rh+5XH*%{=1)uY=%4$@*(2GwJSfjpsw+?Wl4?mg-Ea6uB47*+wjg4%zi%R9!HSZXl4RLg|kXejjVUskn zhCz5!dRQ(LWfcPQBGCVk{L$|1Rx&j9sVejdmPty<8RG9P+5#aidzS zuFHs8!lZR{x6C=VmEdOFQgMeS@`Wh4KLo3>)8`#`14V46bNB}Fo=81|f zQq?$XKMaynD*NRQpbGqpVDPz&ev!G4CdhZc0ysq+DxB-WeoBP9PSPtb#8ht8wsGg6 zB}=T{K~CZfiAxo(f7%Y$k^Z#mrHZI3o1jymv0&1TXHD&(cDn-S^x-{s64y|7ds?-e zBJg?4Cetv`#!*(tT^)9+r7v)6iNS15`@48~v#!(p@Y_O^Zz%a%xz$KbChSektOWUr zS6Mff#(bPG*)u|y8EV#w(vS5}SZd2Yz0{NP#otH4q!mG@;rb~!Zn8H+ruviybR$!I zw)evjajNwE;dg{JNKg-Ll)&|6TRC6#P*LBeVGG@M>xEVoN(aVnCbUmBX!TYU_xUCT zQZwNlo>+EXD1cY>yB^TAbZGL9C<^E8t!Uf$8hscEfc6lS(YAFMgf0KsH^ur&q9L&8 zy#COE_R)E-1P}{#j$FUc-xT+_uoA28CvLpu+}!YR``8GDnI1N_$eyXm*usnzpZ!rA(d9UKrrr=`NM2$pDybM$Ug-(dx&V z5xxIzzF0NW_LRqt7ViE$ozUnvU!fag+*vR*8y4r!JH>993A;IMvR7#36w%gz4K-Z< z={0~`u&PQj{wv}FuRh)pN>pey`0V9R+`@2Z>HBK1_L2PhYtUN|g9dV<79_kX5;=Z+ zdxfBd8#j7K*!7Img?uT-1oZ@f@SY(k=fb>RT}bqJ zf-(F_%TswGhMQ!q<%W{t4i4$wM;BMmir^CsG9YC0)=eK?C8Rd?hoM*~-dmO0(-J5} zN0O_4Pc^SS-0MpfAc7js1V}auaFj-?(n?2iU@!CGlDE^EPLvPx ztX|0mRG{xJlTjKUu8y#;ayd0OxGQ`ec`ON1g%}n-2DtL!HLc%mA?Mnf$V{@03HzOC zeg^q+Tzc2oCplucmC`jc{(mwpPj7@m0J~&Bs)(Bh5^F{9ZezF@sq1a@?e5Zz&zde* zsnl-jmt$4;(b#_mB;AQ#P=!L>W(3%W;xb|R%m9AbFiFutftk#UYW^|Fdcujc|Rk2`Mrl7v^x6td})oBO0Qc>C$Nv7a25zt`Z4 zZVtUK_`4V*G@p5Q9K~Fx#zU}tZypz@6gVuFI z&O~fv$m;?DySvDY?V2>zZIvlWr^M#7i@$Kq@!MP@dt$DFm<_$9 zp{@!l2@>~e2q{?IBE~Uel0K(O1>gFgDGB4Og>{lE#WheU4Vivw62nelB=2|EuV9`R zzLkHG_Tk0gN7__81U}3;Yy4fY7XDdz%D@=N%2V^dZUhzs-U6b?##cCPB=++&UCYgo z_`76(eA`aHXL=E09Q}8qRaRo5mHwJ;&hU_4MLd$Ymie-g?#xMkd`S(EfPoPRCB(ia zT71HA{fRH5c-pKVchy0~@dy5lY=5N|=U&=OeJqM=fz6Kr21Nr8CPP-9qNiXWu!{ z?C@R51dQ((a*>P5PZp& zKu88CRA-0n1Sk}x0V=7f6w)`pa7=Z3?uCrnO7wU6AiB{xcQYT}6w6L47V|gI?g60* zFNKXb(jIv6Y?mG}N{&rFZhaGWX%4ygb?c_>_$4a2YQXlR*_!#$niY0@dSl3AzOpx0&{_?}S zn-6zo<6g=XyUq;2xA2PRi~3i~4S)1>^M8Mb>VMa7`009Hp~HE3Wml)bHJ4OYu2eQ1 z(jLqWDxNsXlK^XD{8az=rz&LHAhpn{0dK>j$Xu~P2j##1nzyJ!IL8|2?w31b@|&)- zxBgp%xiGmFs!Kby;!|Y)uwv}ByJpFyo*%2dE<_SkB4E9~EC=Mmf0hDU-ocaN0of4= zv&!Tvmj%m1d7r#8*a#^ZaF+Fd!UWh_g?W~bcG_;3IUgeR(-WLb2J;?*y(fBL^&&F= zCWcFcE;x<%4zsl&6UBGsaWd`W5DPCQT=`Qr@RM}ZdU8SWDv%9@ql~s=Bf#nL8|HLJ z1+ek1{cPCXBDn4A!SnBDVqxmTO+qO`m(e39s5N(v5j`1=8sh6x^w&35fW}JIbOZ^& zR|h9Vvg$&`1#g-riAN}PHB$ut4+hmx-J%`?>L1a{G59Uyg9ct}m!Njo-PBig9o38p z>)1>Hv@)O*^LZ5nU$sUS46K0^W@k;6*QALRyF84n9O>OgDM}HVQ5bhen>DDU_57ds z0Ccd$b5pu1<#QydocA9xG9YzU|1hYR zDr7=|CreX&ry^!LeXW#lW#M8kM|yM=ZNAGrX3yC~K)3J;YXkBGcF_2bb=NZ%o7xml zo-_w$pn(?eopI+O+`RiRtW-J$&4BoZKKDqqKb=|cO`d$#9sS1nY3$#yS7a=F zX$;Y|Y*GDITXXK~hhJ-Ne6>-+9j;e%GHaN0IXVd^w?svmP?*6BzS1k63gaHv} zRT6aETrpU*o9)M0?%{TR-lud+H!YQ06&B4$quXBnsPY|w$=keyb{wlRv3D0PU%7K!>@{1SgN z7gpWyyR8?`DL(~mMG|NU{Y8TaJ6I}{|N5QvUo;qO4;j_?qwmCh2|0YEVcRuJR~a~> zl5i%=b;dxNlvEjyG)hmk^J-$SvCxPplKYq19!>J`zAoXZ8}Fd?nve~w{m(QS27kzN zhY67!xk5q%x4dlFu=s7!fe+>XgROCTVX^RRCXL$oW0lHVRMk`mnc-Sc_POqFa!-41 z?qL((PS3}`dDSObi6*sI8@**Qr8?gJ$A%cpL*k6-QyXJGTpCqH9mp`n@P_Q_cZWbq zZ}Rvk*{|`FSKHY>6dy0~3EdS!{yH~m#+z>_bWr`BDuPH8>1OOm@ilM}I33$2o=r7m z=VDFL^87$pBn&mV+^cL!EWHp4_@B}l?aepVr=%TE1}%kEuk>{onz9e{UXglgwOAKr zICpMyh=|=i5R#?&eQsTMrnx=K_%AHZrx)tFze{5ni(%Ca4$tLr7V$5&q9PCjITTZ% zZ+3h7j+$8K?+dLu3c}|43;v4??^tF}$sD&bNoK38E4Ir`!Y|ryt*uh*DGS83wsWYoRwv@}mw0ZgFu!@gY{1L(qM8cfIiZo$K0W@4Envc&xBl2Id`E6t2 z!<6IyB52nqw#7NVMJ!qr@(|@x0$WH?!I^D+*4$%K+gBMWSQ9*VhJ`u<^Rbz z24oOC03@utbZ?v}zT>>xLpjumK9w+;uxJwK0SX!HYKf^_$CS|XEVoqfz0t(5_{r6O zHFC609{FIRmYH+-MrG4?TD=L2@dRW{Jp(c_UftW%_cygFP0Z-|moe9Le?-Jo3q$Iy zm(^jU`FD2y!^b!FhbJY#ud&9x5rr4T(m?U*>gVCBlnlMA;Vy;OW5=~C>wX8$(~Jw~ zYlX96YdsMsWDI*i4bbQ8dah;SCX-Sjn`?7cAsCK#BLCPeM9rn)eo}RO)C<#D;|{I{3BB7zS8E6T`?_=3TYX#?Xqa^P#q9DR2TG z&d!SQxbbGw{{ng@XGm!ECxC1g)Gzzx*oUbEsQ4MvY-+T7D1S=t*y*bi9-c-{e~p@h z7FWub@^5uEUzCjhx6|I7d^;1!hhpkYsZv1~-9edXa!QCD8?Z>On zz{Pc6L^;L}NAoFAj<$D!7sCE~m;Y19++xMrVZBD32gSxRc_GjO=5H~@is;wqK{TOc zZT5NdoUOkVe@#g6gBBaIFy-_J+TXiE5FDPl!rScHDjXJN{#vxt-F50OB;!vjH^;5{{_ zO>Iu*+1i!cNm!)EXW@K^x)<=L+F?fz%r|!iX*qZ{$8=B*U+Q0sWJ`N+UCG&c75uo< zq*MgxY5%-~0>4O_$bo_@?+Cs@Qf;F2^?o1|=y%J_GY`oA)t$SGG@ts*^l&YZ8u`l- zn(@G!Z&o`emX;OizLOUHsjH%L^E0Sj!_&~~f`e(mnYq}jJF9Dk_}p(3E9vHcf%;9} z$E8+8^E;y>r;E%TTh{EsW<+K!hFrG%s_w-OUDA1oe}SK@vZd;G_aet(#D86QlSx%K zfAKt|0!E**jDwnNz2bnY$lgKn0!!O%gYIx>(0-pldE>H(T-)HHZKb%ewnJyOEq1xP6-&G`RTc}^vI zh0^k0L9gl`{yOK{3+l4L=VIN|`M1q5XL=7$me#2XA{Es0LYiAEPVoyLS6IRFm-pv) zXBzRWX%Jw$@q(g__YFZ3)_;SbTYzLxOt>&^?_KcvlOd_IOH@hVttp3kp54}{>U%Af zIk8EC;@S;mRcTkLgtJHqOb`ISbI32Q?Pb+wNwvLYwSL<&i#ZGuDzwiW8N?81fNox2 zOPo70bMbfeTA0t6DVOvyPO%-&xY8w9PA|i|PHPQhtC*K70_RCtBwqj-v|Pc`o0Siv ztDj}t27Xn`RRgz{C*MTHyrH3dts`$={C~Z~-3^+HhUMEs@PZte*wwo3A-4Oth9dmr zO>6$E1%J;^-00XaXo`4@z@gyonE7Wbhkx}M%Psa@?Q*=sC8Z8bxR9*?Mn(3p+zLEu zwmp2DMBGP6Ua$L(yJwrSYtx)Y6GnuIMw@)*iU%py;KO^wC|L>#e9#LgIZ)aheeSmJ zuaS|O3+N4xyVlLe7CKw@6b&gGI((IoS16yC>DlU17?5~vb?y#;v@WD6rD3Nxbn{!| zSl=a9{os>b_0t|~n7a@vKH=vQp5_*ql;LAvOC-IK5W{heE^rpw=-p=@VU(e?>Kdnl zNcTt0{fxBg*=fF$k!pX^ySd`3bP5g=V;5L6ccqqA^7?%LZ`d>^-`IZEz}D_3HwP~u z%nX^1QiUiwBVHpm?avNg3Jxsn7g48{DY{&kc!{)>O8FCGumOs5zPSbPi~KF_R9nky zXHJQXQJ@q@`NT&?XQr(h4eb00to;U2`cPN!>_=V#!lQRnp! zEgi;zjV$1ojuXyuNA1k)8oc_*a}T4V!=WPt?#{WExV>su_HSS~r?9YnF<}_6Q zdbfAeZ~ZiX><`0Exo~HwB=9%=BC89#iC1r?EO+5f0{oC0Xr1nn(#)3Ty6j2r=|0=> z$^d0{OvoqP2ZAYDPzdqF+XeW@^IKz+k(@ea#Eo&JPUsl?!FCGF;_R|xylJE*v%NXtLtxzxx0T{v z6mRhNDLeF51>Do^3Oo~RJrhrpIi=g!&=J|M$@{J@Sa^GeLlb@B$VU`qRjSi5oeLvJ z9&F}cCVsHiErcsY{#U7wy`!}F zuVj%i#paM{cl$e}_^aWt<@(I!t=1!7=An&<%mUMZ3&bs(-G5oz;T+q!D>yO;=N(gQ z3W3?6QfV_`FJa54(>^P+XLA`n{Vd#utEvymIy1qyuj2_|tV`TI(zZpaLOu=at-g9L zpJYF+20HrnlKf>4-zYZ79cO(2JxR_6EA~vp(Jm~#$p2AOd4RzdS`bo_QN*?q1ri7`F1p%$NqPbD&ir; z`J(j$HS9;;X3a;bcR)cH9;=A>_pFwB^!d}7nNNK|OGLT{K1fI05c7^9)5;FF$yM;u zdsAHd4e8xFcrJAP-u6ELWPD=HfdA(p$Ez0jKyjk-yXl3`P*x7?E^ImUU40O=l-nv{ zN;GzSm;Cqtn6lIjJgXXXRC=T5i$)3>LZH#{`!*upq7 zyyCtBC``iRLMnO15ItDqP%R&Ulan`9bj6>n_y?5_Z~L+}y&Y`lt2CI8e5SU!GIdE+ z_rIZ|#JV@1(RlB;m5m1S(WT5T;bGN2o`(7)pS{??B7fq-+Vev{JNFr_$x_TQA}b}} zSz$&)Tnpk=W~C;lp_fPNa*_zMRyz$|5OT6=s$$}IL$1wYZ?~js!}TE>P`L}&{A@V( ze8d|esZh;WwJlV1AdE2Utp+bg{8#wc#PO7i(1rH~tAkT|!2jyi%)0la7?P^XbpDSa zPazvt@dhGl_&u@QG%2yg7c}SDZr<^~YMn9-^!iJ&MSWR>-91`2mqdg;B+^h%AV?Od zw=n>3yTuI0JiGMtmT3H6mQV@0kT{n&yi*2ZXSRIu9=JwXu*)}w3-MzU=PjRV9@y`{ zgy*gsh)^3wH)&J6gJ78EUF=S~z+h7J=f=fgP`CN~IM4w}%W*3soFU(%;YK9np96s=i&Spfp- zUrxXKxUzI5`cO_SzbqMAW~VFUqqB~S+CRRvsMDm@kd@iXv-1c%bGh+A6OtCuavh`D zu&9oKoC0*)3%v)>HPnm)FaOz@JgRf^L#vyDVOm+uS6wJL|EI4+(Y}gRTu2Rq7=JfpK)w!AY<$09u;yAJXN$6+jp}$AbbbejlDhvoA{bL*0HVtl{PaA=bDuh1XLi%U7T@)p1 zL9;_9YoQ3|Kohw%qCyV|wf1p#8^z6=U2lk0_8;%Rb-zhBx@J3IGU9H5UCnb=Dp)z&5 zE^U+~s0m5XxbC;z;u#~wZHMCV^7vtY=@GrT zEbMap91hXmKzg70lq`>YIoe zA8fp&d0J2=!R1)3B=_aa(mz3=YJTj{m>+%0U(45$-WxgAC_qmMn6;uOv2H$(>_M-p z^myy`9C(t~=XW4=h%ygW&$@j!EpdtoA$r`goyLEY;$U9F0?n84HSd+iaKAwRndOt@ zg6DgZdJUv=EP3P7eE#=3x9BpgcGF9(Kkwswxq*5YKr7)D&i?F_d{philTzN8yU3tD zxXb)rD1DXvsdU2FFAu(`RqAl{mqqXg@qbrvq{xYGp9?KpmCN8K>#YGqUp_K5gbIrX zOo<6x&^&|*{vbQxE73(eD1n3m_}%o$nLFZqF3sGYPIg&c-n4`-{c!!fb5yM0%3m(< zN^<9hi2n`X!O~`U`bA)dyGp22o(o~&&rzlVIEB+xlN}A@EKGaENk<#8LW9;(TxUkT zZCCoZ+yVY+x^jf2umhnEL?rn`Eo|@w1Eo;s@6#>+=3K3Mji#@+4*LHc6GhDMhEbX) z%v6YJBIjXYqjk4W_;kki`Q@-*Vo90&Hc9HLBx{SYm;BE_lDY>xEGG{m%HXtL0-wZn z$kW;;IXB%%FaB1+v(Sq1Liiba2f3deMVP|#B78$W?C$w8jtjvCJ)bRM zx0+y~^$nc#XcN@`yp=dMrT`n{R-u}GQ^g6>mtjBW$*CURdEH=9l+^j3A@7WeS(`x< zPd{P82A$k$WXrq4UQPY*C_qN07=C#TIDFx-D{X@IXKW)sZ2NNGbli!gi~+++ ztorenfxpn$$cbLdGcv?X_GalFXEVQDR*Jea$w%Wt&WBNt!14>}uK*te9I4($ltrms z+=12K8`PRovC3Ryeyk_cQY*kWE;M_mLvh8lD!px|VSwmAd+uc+@czE-3ab~}y3BQ) z3d4bI_v=r~^F#Mf6yc<}bCji%lj!b7NvOj=EyLy(zfoQsWjj0Ns&U-zn3+nGY6pL5 zF`gxhB~gifw@q@vM&2%r%7-uK+g-^nX8B&^T09*k%SKN${sVE!Z}0E~=lPnjU=58rZQ zuy{?1`^8Yj?=tqE&Zs}{D?&uHOoj~)*^7(i`5#6Gq)a6Hv`b;saXkV%3N9UZ|J!*B zwT~cikcCVMbY+TMT-nX_z~7g8uap-SNA@2_t`>>Ds3CY*o^tKFP>O(kaLP$Yw--hZ ze|D}M_XaU2-fBH@{uunQe%O+^4=>CK??#7B$UjD+?6DCU&vd?DL>2ly^&S?cd1H6< zpnWoC>Eyk)Uft6|%70@NxTp}@*jc`%ylP{>t_}bnIXH??12?avd7Bq4I)5>AT$KN( z=Td9gi9ufeFSi4*2ybeL$;lVbuv|$F;)QKzJ>b3fcP|bY8fiOQhVOL;TPv?BXARHS zW+@uqJT0t(2f2q7PCA@H**b;FI+W(HJo^j_{=?1HFxn6EC`*0zMP_UAYTsnIPsnZj zAc>UK3NBSG-J$Q*ed6*T@O#*x;PZIPA1Sx)4D?4V@%?&D%9I=jP-_r(!%fkf8Co4vzF<@J+{&MIZRbKSR@>pS@yTllBkD>?J{)~epCQ!f)>gP5 z;waVr(k>_oKL^<6C~4&GInsYH$jAGCgY)H$zKPReL65(04;RkQGHhU(s{juc0GpVA zYrH;*FRXneryu14$kgM7JXd%7@Jt?)ed|#tN#~8Hu$R=NASio1hGR^)8 zaJDOs?9h%DGr&hCckI+y{{gg3E$)1V1>0wtjEV90dOh6dl*ckUv7Z=d_Tug94#&ny z9<2q|5c|*S6Tn?Tlqyk82xm;bFeVr_)+M~4WrF)jlT6#dVGS%>pay$V703^^yOVi> zy1>~E@bNFuM){+O`n}N#v2~)7@Hk7-kXNmjOaqJ+>UgE%42TVF$otI>a~Hlq57rutTqdAZt%>ya&XG7X9-9+VIr1kZ#n+irF7?{~{W1^kEODy;a%hK}{CcLd-)AyvJ<{ptR^6Z8t{4APPe!n za|iPdVR_R%Ny)8xWzsWH#oFW6=qW&_zIvF5j5>So_z!@Jtk;LN^Se|aQ)Zcz$@(3; ziGc=ZLvK}Xee|1k?hIV=$Q+n^OSremWAxDwbL`cQzxX`DT3;%#0J zyDUxExXh$hPN=UTks|B;=@&DwccbAHSEPO=R|c2+pGi;j>*Ews?}TpXs!DaJ{fNw6 z4XM(e(}d3WzdG>er=h$OcPc0?cEV{&?G<(qM=bIL0vF$VdbeOaY$CWwp~xvU zOKO_-{e)z0ppP$`wSdM#J}+veH9tC$A>STc9I`eVj6*en30o+rVq*Dudy!w?!jqOB z`Qz2eAcl}#b%r13pmttCf`;+@1#u`*k?1RhJMPr zVMSj*wS#~AT;9O%eY4s}1oi8>jEa&l&;F2ib16{|a^Z_G!O7*$I6+`rtRXAw$z`yo z?vtAg$~Xwj%B;W^0ccskjY%Cy!}qp0?g65O;iBZk#2u+X)xfkU`-rzcO-Hu+J@1tk z|B@;;nV)i_Rf0^J8}CcxS&SINT&6OqZl&5qi-a6eY+;Txoau(PK-*gku}Rp*4!w6b z6dnr~7~3#1+E0itVJm=9KP+Ln@CIY-Mmm`^tUv zh>WJ#fe(r>J~s$ta$>^-f=~)g6LPcOMae+3^60~fqH&WJ%tLB2 zuU)@jlW|1)b)DE49hfy~jg+gx?m~6qa7Zyirs#^o(y~_;@?J~0-dQxOCHDn$0o-h{ z;N3BaO$+rD(EZ8jk2ucT-^LfVi)s@j8cZFkxg41$#MgaGDa+9?t!bv)s=^K>s2A8C zT55P%;Argx$yy-8Zi@})p+O#$z}?=ktof-(B3c;ELinPxEJ|r79Em)kaRb~bn$zRrI_T)~H8QznFgzt_n`A2!QeDMPMW&35w zVWFFFk+Y^pP+|L)#@jyuy(;7FJ3uk%J zw=BY{)&043A~E!bPLgASs0bqcr+T8DH+xZtf^Tv0c)q6Y>xbAxd5>-)4@%+u&Qu}> zzeqFu^5GbyswE8RwSts@{DZdIrvMIvR z3=MtdL1g?q&WFrgDB>e~{pzhT3|Rf-pg(#&vbQwM_Dr9DE)BKq_~aksUJ$J|t-gs( z@KZR!#$KBHmL=OK*~B6S2!bmx{&yg+VH1aiKxuLBfTz?A`lq9$mAS=939G8-xdmjm z91Oc2b1Wb}nHlo~_us?F3X3b)U8HYY3Fc6Q^HU4Wl!FfeyWc?RWqHofN?;~MtwRyQ zw%F%KS0NN}i7U)G7tVr5sXOSSAs6r=$Rsl9rD>fz&9^7~e)x|`>5^JJs6JbF){rUh zv_~CKvFYIAzP#1&NBf3*RJ*`^;X$*3)^Kl!TY8 z^&|Mt-tMa&ug6+Xl1ymA>JDdg=@g&vZHN>}bNofMt~(M-=$N|kLKFH<>`=nI`aP#% z^4>{ame}od+;VG-!}6cyGGf#Nu|1=|w;lN4@71JS3u3=8Rp1`Y^pMH>e6qYSx{oAA zCU>e7?6NhIKP;#m?BqV+adQn$t}*jr4o&x4m5+Fk#5r~ZN|2qcvnYlu%)w=fAW1h`sKKK z_u`cCD%0rI(`tPo3?x|>O1P?;;?X9y31F?AS^IU0V*ggFk7hl*b@7VrDTR<9^6gix zCC(a$)m|;Or60!`Il?x{uU4cgW}2>k(@zRLXiiW+RDtyEj#k|KAT*h|K&?`OurS#c zUnTeamTN8HC4&`NZv8VHvOP6y3|%BpVkr(< zrhU#Zco!_>Kl-yuAd^5%iBc0U-?<&CSX8DUmmL>h(N#TsYf=4kb$*Ueq{Osv~;=6lfM;R)?stJa)D%+5v!I1erE zBUVjlxWCX2|9i%rSiQ#H5UbKv;h$gV`+U1!X=>JYwEyxu-a}CLjE)Sg)-$?MuWo8x zF}Y3&J(Z#~c`bMeZkHTo7~XjAakg6Uou7dRtBn+<{f%KT4WjT2YB64@96~#A*P&1J zyi$d|R7}F*d@-Wk{)5qbV^fL9aj5Gt@cFr?iir{VB4e`~9tP1uTCm-z8}vI~>x!}w zO#3^-pv{`xGdZbLos}INB+R?2lu%$}&ZeqBe80*HU~B)k1_qN~iQIy8WsS6L$VKUp zf5k2J>L|sUdvd)(fz8Ff{wed3G4}TJ7V*;k8nPXvC$T3bY*Rl9;629sIIQIr-N{A?D1hkV&+nXI1_D5fgs-Fwd=Lzu)~l zP~7|2Lc14}$q-n)zK8|W{=sl|C^x7@K3h+lb4-n7Q{T#m&(&7@(Hl?JIcbjDutA-W zul_WH&y4R34YRDD{k~c2|J~}X`1agO&eFiHSwvjO$qyZ#Gt8~BOr|cqpX!bB(!dU7 zywq7P5Z7Si6ZzT&d)sS9X+(>KfN7wqre_gkJBzgtFS{G=CV-%}P}sS;>`5HF%r6_C zJ|)QJ>D&yu7tl8Q6DCtLGoE18RFDf7Kb~$Qx@BcIj39dbP+bwy$B>XYQ!cJ62X*O+uvO%fHK02{TWX=URqu8zT{?jWRemX`>9md zn0sfc&pgEi`D*W1NusJ2l#xrTL-<|C=DjtUz!__4>9_ZJir#*lGhd&e5sUd=n_>GV zn?^WPJ=;c1Z09O2JZ32mZg^~)QZ+hMC1uS+^;~~fx}Nc^=1bhL(EPiVGiTGs!AHfC z9ww?+z54O^B%CRmETUg|V}4{i=?<0P^!;h``l4Na-%8N)uIdvaj;?f?Y6x;la6{Kr zBu?EWKpE1oGulXGzZ&FNe=gm)b&%PSO0h}ug52}tA#UZY&2Zs1XbAiD!RiD|o0;;f zx~v{J)9xEJGFxKd{^yIwru_OYFPp6Dj0C%qV#to8FL)xlrQbh4^xzSpW_ZrK{lRVH z7bc?2JO1dN{Pua3y^(ZT`?>R1JiOgO705HDnvfl{w9F@B9y+kzE_-F)!Vc9z9t}37 zo7R5i?1o>Fv+u&&Igjx3q+Ujg=^v5nu03nG03tzTwWn2am-t_-K7t|U4|^QhmQrf~dQ0lY0iUoKu*)9-M}EQLRr9)^60JNqk6{faxC z_wm$ogmOXGFmSyfpSb<;V9#TL__v7Xhu+5(oLv-wFW)0+w01Sx%AV_ZeT{U}3gBif zuI_P2DlOiWIuaf7lG--!oa21t6T|$Kx2VdiIxk#Y8C*pIHP?*iGi}bd%hq}Q%KjGX zO<(m$5(D|?_p-JZfXivj$3WvyACUmy>h|qRc0r94&bTkFjQt6ag0h92oc3YqO{< zr33M+Iurkt`>Q)1{?Wr_y?G+>T3cG^V#Q;y^zv9v>|T8}>yx|Vw$GEv4Ua44O(I?H zmnm;okA7bKsuIiCE-+m5X3C?6t&1{pkf-X;&hOV>O^)|oGgkd^5PltGbc>M`QRW-J zCsCW~RDJnu=BB}`oS0PuAUcWADbvXdLgf5~^i{;4Wf_o_Zlqp6>0f$T;iS76#sQ zd#dXR1YgDWA@E|1^iO6~>v?lKu-q<>Az?kOg!0aOsez_od-S&OU>nO|+Mn6#UaenG z-|zJ~y_IX$%xRES!?=oPAIsD%3w&w6xoGirpN3t5|Myf-VT_#Ct7O*R=c~2@nM4ea6e`9Gv6f}8gG4@Sg4TI=UtUU3NLFlGsnw*=g(SWqB7Rf z3{&&$-+uSP$xQeV8!HSPYiiY%Z&f@DOHEh_Vum1*X6(jG zNR!f4kIdG*SrhRT(>lqIIn4U4q;V|FOk`qHnbEJk#SPH>Qc~#K(8Qx7Gkr(Luw0KNkMGtr@v-;-fG<)?_SX84CO?e#D&?% z`4~x1I&5dVE&GKHs9459pX#FhAy6`@c?OHiSjtPuI*5sOp8 z%LlhRwxI?mKkU`P!$=(>4$^pGRm${rfgGr|{k^EWYl z>5i$|9EEN6y_;Ql^%a*b7XIo!pM!r5x?`IXnvAw%%9}yvnD{l9#tPG|3-ojiF zlOMlXdz$6Fr11Cc9)(1X=|A$?A1AgPcS;cjKAe!>t@ujcyqJ8`<PI|R%wLLA~t<)S?eqrzi=fM|u-P##Lo%}L^g(Y@BnKtq>TS`CP|82O-*4p96i_p91xP45O*LZ56bnwDAa!hDn{Tt4T8B29_ zA|3MfHwGY&N-mK=d38CwiSqrg3q8wK23>uRAH!}ro;(x1+K-_bcB7;B8#O%JO(G}_ zZOhvbaXatb>@&B|OFqN*|C~){J58oEE!-&uzKTjuV>*)kqNeF3;^OO{2(I7dt*BXb z*OLu-B4k25gdeQ{QF?)b^7U82R9# z0Qc#SpqQmM0G1pg7cDVe#nQ?SkqN|f$6QL zn&KvXUz*b$$a5ub7T|rgZp%e2a339OCSyq69tc=VVY~to|Agb#L@P=u{uC116wkuj zwHm(g#rblA8-lhN;`6-Jc-d3iU9aJ!q=T= z&tm!!5aoXfCy#38U6#s5bTp3V~qQk@$Hv?B84NDT+8moKM#IXBZG40wLf*0egDvpPClG zYqiR`*IV}^xV*4AlE6TeX)73;y^@s>jO5L|m8*tm}p!kZ~WE-qodg1W~3 z0ey_3CJ+9TGlGk40t*6gEy+SY$r`kR`_5t{R0mp?1*TyG&^{~d zfoD;#VCRLt3)O{|5tN}}+gT_kR|dcwWXGS%i>J9sCIF6q#l!TINI?r=n7526GWqU0 znid$;+XH{~(+x_XydMg7(R7Rfp`;Ejod03_;r)aPV#Tu5BlP@D8IVRm_CaJggsW-; zs}?h~$CJO7%s&JUh-?OKG^bvVb~IO|H)1Tdk4Bbqpwvlx%RGY}$Ah6*T+OA5yiE)Z z`wmROVS%@BQ!mL=XWv@#!SO19AR<~{KZ(r~M-`cUd*s7PoKMLCDnPv`K+Qn@*$Yi` zO&m193d+E7aCyJ(E}gMxM8y!NGFQ=vS02Y_C^?!V!IQ@+g7;PGV@kqDZr;LfOZ!nb=&p&+0!Ua$dQLKuSXs|v= z#Kpiagu5dfr|$u#oKVvtDR0UZ5hW*z;G%k5;s z#zkDGP+`MN`f=V|P zdE?UnIL=w?4drw=4we<79el$3rlNa@&>P3d0=qEwU=_;U>7^m+0mB`%| z2XimW1Q%p-#loX^KyL->Ck))qf8EBTtHc#pUTnF2q;(iO32;t~bNu=pJDDtbW=*jT zk_?Ks42A*Vw#3j$FhmuoT`dVSq-H~nw&ic_gqk40O&2wyoeB;Tjg*1DLrhF!k)M22WS!jes2lLHl@@{=fOe1e-^ht{*fgaJ_O5{M)l+y|07~i| z{?zh|Xk{AAmLkX<3IyHw0UcK`1e_-*(&Nc8TmC3GORgRAAX|y- z-Oo?jgj4+~J^iqS%5*~+I|gYk7G3a0A`r!K zcEbLJXl=e4%I7T4?@4Yle!H#iS^Vk4QviSOXz7Y{J}h6z_?EU^m6ApkkU{603-DlK zgN$$M8(dpg`R2xBBOstf%EP23AnSwdDW@G)c#G18rjfP=1QLA_uZnUlRM_HWas{Wk z-)277wl%NL#P`$SCIQoJu$*i4YZ}F&mz-@|+xN<>y|u?A0d;lDvy11{IdPJz&|$HB z9AfjNN5T+VOUu39z(ZWj><7Xu0`tuPvdSm$S3 zRIWMGn8!4ywn8$@$L~kgfoK-lq3SBEIe>?`O;B{-f@G9!rZeo4D_>a-HIzU!ESMP| z%pHg2({!N?VYymu9}fUfQ(Kw>b_&bj$XX|j%7Z)WebAv5pc>R`wEwL5us|$WGn%{B z=G%6>J)Yb{Dd0gwl%a8EI5vHah=#RvO$*lMx$GY0g{V#&&O^YwP1BQ`>}6WTOb1~n z^lG}U!&M*bpUGyh0J_M_*WI%fvIp`qRb$b7?o|$^$7vCj{VAzzV8mLaM84< zd54h!w9g4%;1@3fSUjK6#9gj9&SK8qVujFN*#6(FPrqBN{WX6FZ_jA{RxPan^m?~3 zm^U48b=@^BykyUtEjK^A8qj(>%EX-i+*5Y>orRu-bM-$5_9m|Tjo-+qgGWQ+_)zO7 z&1a~*U3cc{oZE^OCsQ_;TP&ARiPZ|(1VU;eormF@@NxXJ9KV9oWv&IlnSj*E;t33U zM&*tIDjrxd3c!pdKcZylPILe+UB0PhW4wDapz+}NyjZit6r~anT?_k<`EB1cnu&ng zGdH-^obPv__7_Fp_Yua@cva=b@5V=y=iQqxvo$=cQ@?Wp$d(|{AM>h-RV}ES9WI9o z8Ekx0EKmb2A=yD!g+OB_LZprE=zf0h=M!0!)F2;MXkF-v(fD#j?lMBN^AVb^WHY-B z&P?lSJ=;-}*kJ;DF)*q@Z;X<xXW1kqm>_EF!JtE}hU0=x0!%5jF)Yy2lJn<~k)*L6 zofLm!=dC;jHbD9l>p^B7@x#U6>jY!<7iw2+qnIG~A$Z^EU9LZb1dVFiK*PmNZ{g{J zQ)KME9FUJA;@umhu__!Sdt{)UHfUUycIZm96?Dvt1zM`)sm2M=Z#69cL$EBbD%n%^>E~;3>6#5l+s|ok@`aBfT(Olw zSzbCR9FTYAxsWnqLvO3_=qvw<@!E4*5}XiFuoTs$>qye!gSRKT2VGfd7LrY8;4@6n z8DG!0T#iS$7ayr?Uc3qI!juDb1AD+8BlwxZR~aY6TZwPlo3#Q#rY1cl_JthBm0kxn zKYsX9IS}(a_az-*ZEKz&N*VjNvK~x_^>4i-Wwv8n_^Iy)`N(kkYUoxHU-3XR5GKo7oe``Ok z6@F&@mSxSPmxyBcMsS``(~o`^;@voFrVcTO4^@roKqXV`)Zses_QIXFi)BNZd`A-N zZdjn(PCu0nN^VaqGJ4{EX0mCGCIL~s{}Z$RGFy1RKLdr!ZKWnMsMJm{Ez9mV9f%4_ z7_&ayXt(eB2oF+{u`-Y!N%_f!5cI0>5@x;6^ZSxm9Go&}kgWl&mOlM(Blu3zs8iDD zT%ot%#*amWSh@S%HKl`aOi)3qQK~_QMqAVZtAfABtflTJe5bh^!L>R~I@T`9%k0H! z$QrRqk9+z1vLIQ8Ju&)&rsf&vWg+$-o2PGwb}O@RFhF%`>P<`^r#4#$Y(&1ae&)A! z=5`K1f@Fm=HvCdIGK-wY`{+#WPjJj|!@DdGVunNrK$fiWZK0hk-b7+hmsFiVLn|X5 z?l@5J{0j1Dz3bF@yl9kTtC4HJ@RkAP=VW$JLO}(Ga98BQTJ7X``CUt?w3EKU6bcoP zY@9m~XZmgt^udB_6yg?At(090?tCZkBS^Nmn6LIk=WEfhao3ckPRgN+4(>R$OdHUz zSwH;AF51j%XD)$wt2P}385~wRk19yKfw9=~CInfeDi&+z~!Ouq{(+Ht#e*Uo)nEsjy48dPd*Nu3+fgM zpEJC(mr7B|3<8lNjc}Cu(;7TLrnAyR*-FDYZK}~g#zRB>Au=YF1?IaLAU@y2I^D4O z^%+7CUG$6qr@U^J^MNA{h)~Jb?u)hZq@EhUgu<=NDM6)vh4yHmH67J69cwubC}@dK zj8Q0Pq}}iy2FSG(7<#erVLf`VD{ z28)3@u;VSj-}bPFu!Fiy=!i*xsVi*IZfp@3B)V54R!t^1f(4o;n$p=(YPG)!1qB0f zT*=IumKOk>fZl|i47eRE*y(8jf1W1S`)Y<8uRnP?bOUr*nK2dp>#1EsqY^1-iPmv8 zprqNJ{03-AqN1QHJH-POoMSgctK=g!7z+XgDWzxQ==h`@8pE(a!6p{=`{Z;tF+e`_ z+L>L&E>K$xQ2SF4VeK%+EnRQaALz`$J)J*qCaPZF1%cYL!w+2QT?s)o_{erQg;SY^ zV+WvDrejwh&Ia7sbwsgWHj{Cw@?^m{6Lte+I`w&Vdb~Ib4^*R~(*BxZ_s2s}a7W3Y zINd_L^X@i~agR#T>nWpF*I-blV5}JMiY@QqM@B2s<}*d@1SDv48n+f*`8xISEd911 zs9ROu!;o=REN@3z`8z&{udY?Pl4y&v$eT190|V5r&;rfGao6PRiv=!i2cIun>%;&% z0zcI{1~bR!+h+Qp9M%{h%PPd9a<$6hQW;Px~|5kk1wr zN~9z}-G%$sUL>3Ci(FC>1D1{;5TQJI;|sx1f-Ekl$I%}!K}$?9 z7$Cal)@k-3_gt}|$q` z)TD)$V|3>|)`uWaC%HtfD_c8NKX)r_zeg|&KL-mjOJ*5qu%wT;kCUqtKm_dL9V&eP|@ZZ7=P;nv;6V$-W8vb&>tp81%g@8d>*R!z3k~hz`Pk}z*!Vv}d%%2Mt#}_> zdANAFTUY_$EdLqrz|8QA}GYquOuiZ%*UrBDyl4^B*rfwCkFY~R?XSN)6Chz z3Plvv*6x4W3jTk#6<2V#GV^qChq<^o{xcOdM@KKfyiwI)1#Mw4C)CWs&e_w&!FFDGY@Yowa)R+e@aC_CVXNK5l7+c|n#x$`PJnt57X zWBljS1o$8jf&cMpKC?d;9Gq!CHezckFUdM~Thx8Kb89U9_O#%rRySS5xB405c;mK7 z`Jk0ITm7((HkqBBE@^3LZxA%#Y|pEL=zMF~r32W-0}5Y!2RkU5iie)}P+e^Xcq0VL zSVAtQhAMT^lmqEEadb_$KI?k7SI?fG6Q==c#|PM5QVSu({cpPO-i95gfo!?92*8NuCdCxk$6(Q={M@y#o9z80kNr$ zn5jPY*tv~o_m{9Z01`2g<)xsMi+U#pwkQ&?=$A<{v;)9uzXtl9-cUiRg_~!m7?exON-h_p5!|*!B^xpDu&HNTsQxk(92bYmK>V%M6}48_WZS+4OREz=6FHD{$Z zq9*T6IQ}T$A4oJ-_P0+%@0eZxQ2v#vCJ`(9#iyYcUm$XE*PT?sE@z`!=dpBo3jWKm zE+7-tj95)TWx`*~8h{Ac@5E~SHvZM%tBpiG@+KrRP+qy_xLbk5bNO{PW?vfFU+S(O zW7xs$zr{4|oNC+AQh}OEVx+qK${$`}u9K(OG6GxZO> z=-i6`tDI?HBJl-Z4t`=w?lE8w2?ayr*_x<#;|3*L-!*YQK|FDKpwSY3^4~_Qta2q> zGh%!r=4{te1<&{piEl>^zxbxhjSr;o2FgRFkVp8BIZfBeAF`k;x>+UrvRhd-WZ^{v z3JYjq@&+2pXs#8uEzTogMu9v=~@70|k6f!>xpGhJ^2v{94`)x(YDa zY;()C?y#6QfB6ykP4?_FaSo=g3>v`H(|%;;fghGW_Os|~xxqIf>yFIQIHFZAQx(xL zRM}YBDV9ngy(wj2nT;yn_sE{TVQ0*bLB{tBn{U*q`jrBQHb8l`UL7A#RN3v`quNNz zY#=m|VOe@@6D6$c_t`WpTc|@61Tp>&<-Nq*`pB9Db$7X>n@PYXD^Ol1=I#fJCScyl z^$k-4j_-i7p*GT@@>7IEEay}B$u*S6>s*g)AD6q#Qi6nn*ZnsQKs`uLdjlG#>!rJH z$fGuLLeyfcyDUx$6f`a$)sUgCLeEdQYXjN?+UTk!E)vg6rqnNTG&ZZ|tH90^P|DRt z61xdBjv`tdnXlPbQXR43aHmbKA=satxb~&dNx8%7AB5>fX{=i_u9<+b$>k(#I)Rsk z2K?$7(5P$`LZn&bW{DMT^|9__&|Ld48lb6?BSlvCZ3m3WYi8F~L!|F$8R*LkR1oQ- z4yn*i_Vj+Q#SOd~6M!1I&etK12DqHkX_gs$q2WL=-> ze=AO6Yc}|}Ip!6$-ym`@& zkn$zhPrLsBT?H6lppQ8s)e>g5c%4hTI&II~bg)PxuneHY9 zPdRV`3Y3TPA=0c|FxtnQH6aF_=ql5@BnQ87bL^8OUla{IzU~3Q42YChVJY2s75@fB zdInY?Yksj`*h5pd`p#=@lN|6zrfnv2zX%^fB?boyo$3eB$iT9WMubVBspr^7X(W6AH^E&fBE1Jq1xM z;Db9gFCe7&s6AH@s3I3z>Xw$~olR{s#7WhipVH`B%~YBLVl1k;Ph;IA(QLr^4p4+& z=N@yM&8Ysu)K{-8x&{j?X@17OH>0|ONvDU2A98W+sZfxtRnzi@*ha?GLLtVeJzEe+ zcc1Lo8H>DJtsmr20lC(_y=Lg*OIsVrC}E9jWsT8v9vX7VfaHKMjC8C2eK7e}gmR4r zTD9HoZnl6ZL2`wCy^g%qt*^muPs8I zF@QjZk3$zD2UZOPXmiJA&3$X1Ut{DZIiTnz(nxf!C-ZggH0?VjXMrE z26bui<2r!D9iR-Uj%<;L-RBs@XswW>c^7wW6)GeL(P0E%@M?qOw&L0PJFjbTNDd5p zZ{vTe3I;nQD%Z53sRd(o+`92zp7|blBHB``?jyRAPYln`H$R+>RY!Ijsm3yWJy)iu zVs-H4^^joP?WVEny5=hQ^7PN2ky}NPqztdsZ|HiJUr&f(Mc5rwa$gieD7q0=yVs!o ztm{^h#0(^gH$tn7Q+Xx8XaV*Uaw)-*%^H_jtok2?LITmFE0|h!q=|%fp2HghID)vg zF{*H^K++fQ0x>wiGjMBzdJeRz6Ed-~@2)(QT|R`e%rh&ZZQIn7 zJuxV=%9*IiyT+K}rCV0k&(AQU5On(y6a2A_pP<$?-W9ccRJp?rWch6DrY>p z9>&TXa?j&bm+symF(v4YLmQ4P2FU>jE@l-8{SBYk@IbV04W?sVSC6{EqxK3kq^lHb zdW?2OrnV#pN?4#YEG5vSvOgzU>QAa81`3K;rr}19BGG=co0D}tzGe5hvMAOs*X*~j z*@tKbsS>d+Zah05?hgaqPe->*NWr>b_@wki+9>J|5@f&mRT_Ny-MYp zeRMT(0@eki^D-l@7pS7?$OMhAm`!fYWSI_B?(8pry*67;$h{iuILij(bk723z(5&K z%8ePmV(+<8gE1F_mS72(N#iq~KX3Z^tcNx?X;&tQ;p*aI+iP#KhH)ky-6&F);PhuN zxh!SL?~@-_c91to)z{rPvM_ zU-n=kAWk5@sFBv_RGce7lV0!lAF%<}8a0|K?AKP6n?_A~@M-r;%BRrP==$<_D5EamXBfs8cKy8zvqR-Z{2it!v*!}-4k z6n?_+?6Pg#SbGCv8wt*q9LfUvSm7VoK!5~dRh)yDPt-Y1d9mtQvy4 z9WPk+FNftJG_twjd-%A6Kk#VA*cxhOZuA;H{(BUr7x;>CJbKI%9uNkVbN^)Do=)t8 zeL+%GF?@_QaxW%upnU;j)J=qz1}FK8Oanl)oROljpZUeUZ2|VFR$Y#vkcs`CuvXE^ z>KkwlebHkphaBM;2X_cV0di~XhmgeEt;S#if`Sy8^-MY}suDm8JblW1t1}xK3fR0; z2r?xMr))+!s6S6hthR!xW7yuo_j0}J!2gPzl1R3Viq#CTZFMv>5sarhc)=l+A)(w!W9pP!k1 z7z$TN!Q&G5De|iIeBVzi;%+&Z>7k5i{9pzJ_^peahJMyxD}_72R0y+g;b<|+ssF?> znlE*S*LmT{>Q>&_Lu#pA%Y}z$s7}rJ8Ia-0Ixj0h{iU;ISg|x$3AR@k7%ykAj7vb< z8#kxcuFf)t0}wXvqNYR+`O=eGnDk&0b!SfgZ(%v--=CjD`YP-8m5eEXYMVq8Fkz@W zqzksUx85DAK-=IP{h9Lwoe%z?S6)MH)YzM79r`&j7_*@~O}pI6q$c%#S*V6Lh&d$U z7K1bRPtFG=kCm%BeS}zQs+fq}V+?F)Ur0AuEeQJVT_+s=ZV#dMe*89tnx1Xvi0unN zan{}~+!btN#vp}smxGg3fwX%mP2PXyr$Yjpzd^->*(gyGJrOoT;_(QLQSGH1(DEg; zP0Z`c(#mu50gqD;$u-6*qZR1H!)e`ZT|Xh^zm-{api56|{HZ`uDIbAHAN2<~uraq3 z0^x7ZA*p2+p>G$4^1(h+wZVDSQRqnb8BguE3-XbokLHj)_vK5A+SqFpa@r@|!=J<; zzPTM`eEQIF9GwU4OTf*$3YmALNLzd|;?Jr4{_7`3E`;>@E_DB$d)+tLyK0hpcR7X; zm~x)Crp>0x)tq5Oj)qSB)PNa5WTBOG?2@D9w~|C@l*0R@Ety~#fOsj8^4&RZv1orpu`?2>Ye@84 zGdsg6pcFebHrYO=OBFw1!9Cc*1Ncb$NmKj1J6Cdl9&<&I6`Ow)BL#cuM?-?mq5AI? zf5+!Hww&|vo1Nw>KX!-hdz+GsDI+Vle7$m1;@Td=@2IYxNx26zUOg?JMI+K12mF9z z4_|I3v?>EixzpBhiD~yyr<^nw3O??4Ib`6_RCFgj!fx+4pXjGvb?YWxem@BQ&qdjF z7~v~pxol5J-e&3t)cp(JHsmfbsYo{-zeZ~1@az0X$kgN$5S7x2k3YtIXEf1k4x|Q` z>9yR=++{*TnbKtGM7;at)nyn9aewrweooo|RZ{1p+%tvJ;m+qs&scI&T9$XId*5tsZ25Zwo`b zY~(_QT)yCwYo2;Fq@FgXBye&qt2lEp7xlC=je{B}_(Ugri?_!l*gh6^Jy2pll?jHC z+r4tTorL=?UbzksS{M%zT$WtbjbOj}A+A_LWaQeHP5U0RTSrIQIcXJ9WTq%KKr2uc0~2)%Tb3?{*hYAb-~PJmQOL|s<+ zqdzDCD#3i@T>ZRb-@SJvUb1A*7g8Y}kxFIg<1KJ^e*(td0F1 z%81Fpg%#Kr;7sA>V$^lcLLLnK+BW=ZM!$xCJ$3hWn?oP~OY7%`39$hl5ze;mc6SU@ zz(G|)&oRO`4z@zLV{adX7K|jZ*+=)k5H2tBX*<~aJ$emUnKC`ivPokPt^lE;Ckyc# zE&giLI`6yG>4^BSXK#rnLt+h12M*j}8~v6y;FA3Dubi}Tb^z%Vqcu=H7b(bHD)UM# zPCVViY?}`&@c607Tk5&HS{grUkzOrMVJ<8h=d)Imug$8S)GnKLZ=-T9r*;{7#mV^; z^93oX7gAfw?-F|M@$0$pIFd0O-fX~njP(tX#Vvh%AiAFc_ne8*VTHEiwDbntCK|*{cSd{~3nqr7Z>&$3OqG?cKWBKU*?90n zlj*>{QMjJeZUE{|Vz$z8kw$*@Oe!o6LoDjI&-UpB?)i>W5Alo6oqULmX0l(U0vRgu z^0Q(Ki3VOzyBa(A-J_pXe;{A%+r#zeV6ssN_ezQO}|Ty{3N$uIpNQot{) zil*o|GtLn_*4H#s?W}vyOOAeyVT@9LgyS_`3_8{Pm67#r{*FW8N4bFNmtsoy7B$Lc zT|_6{@zFhj_$l6hOW(h@h7>L?GrSo$r$J`@S%(tL72wNc6o@@TJkep;w`VDG{lkfb!>{o!<#}C!Q{mX1zzU zMmwbZtBhA}xU!Ku!r4n*xz4M>^RK&d1(cyZE#O}n|NQNIr%#*5ob5EfjO@!dz}=*R z5+uK;RoImGq?bhSo#RDLRY;T^$(A=>jcs4K1n7OO=I!C_Dd;u{W}Dp1*+pF~oOdUB z7D?ysUn4aRNNoNp+WHwiv=ijPZ>puyn!!8X)nYh;%={Q&tSmhSS}YJRkMMljE_X=2 zzjM9esdSGjLnt>Z)>)0=<&RX&bU{6fRSWbF+k$12`MmBA6LVL-bYN-dfZpq<>qofd zKGFGZ<{Z#dYZXSn2@lNIOf~&VcKa1 ztKZG*z@;+Eqc%8)I6Z0)TI!VYm2-97{KyASjx(+TJuBYmbMwo{PUFf840VcAf~i-( zUa}YhCnro3dYO2V-DwymFuyhH+>tHG=}Y%1>;%vDg?AUdU*xZu->@iLNS1XcMn-Zl z_8Ze=e~d`QY38~0`75e9kNLe>TB%ll$VUY{Qm18kqF>N0y>u>su)KP0I`En!_BHxg z+?MpUQyIw-2kG22EuWI^T&sbpw%=A!ITks_{lhd(rOT2U*a|P`w%-civcBGQTV}Fl zS+dM0%F7q_?Iznpsej5dKl+jVEwM{KP9hv0y#zpBa7=sf9y9YIU!KY~rc-73iB{b+ zZQ9e?8!y(MR3B~pQ6J`;UM$7ISvGP?0X%sgjrh=`|62FiW{#id?5WPzELhynj^IiW zF`oatIpBQfbVO`$i_F*gSW=nehDP7sjZd(gXAD&=8=r~Cf-0{70-r$c^Vo>K_*3Tf z&%%n_U-k6VY-*iVFGosT?kfYMJB3ct^)XxHzO@~t~YT7ynO@6&-rrD3V$IUJCTjITfV@Ooi?Gs z+KtPOA#FE$JM8XUOFdZbQ;s3gZZ8RpV(IZY zQL_ADFsm~xkc0LN78&9nb+Reqo=?-0^5Z|BTI^-tS~=e5j}R-5^pdQ{=ecjV!*8+! zJ)-lyB#@owsfe#Q=T)V4XoiF@`nV3J^+%}c?)#G;(lV@?+=xpff zz(7;gcry$)mH$f5=R_+wBBEz~#VcHWRkuz{9#lKu?xkf1cZ2@{^~?N2DW8xQKkmF+-R!xN{b z#(m4h1*%U8Lu=+bDCq(>SK~Sl`wXqjylsy>x_^NIKA$NtDC)`Im|gfSBUnC4fu8w~GPzIV>x zIJouVsaBPNeJ9JKq@g*|R4v@Oj0(t?1y2cQyLZ}AtGu)}v#CSO$_?UZ@sD*GzZFVa z1@)*vzTt+I%UZP}d0l{9pS-m~jwc}zp@my>gR_3hx%$k-%te#JbJGH_g6}X;Z=wbS zo_aeqKX{-#gtyU5Fm^IHrC-qyf;D*akE+!ESy&<$7{;|=qDU{zN{~;(L`_8bq*gHI zRe*S}2-|_NvIQ(O(J)fiIA5-xt5Xr)PT|4v`!3h1ul=}%JvH8I=xlohyg1{m6g#M; z^9Pqf^{_G4mX%t+Ma~~`@nkYsstIWb&ZnC@&;oCmLqo#{2S7D1!8Y(26Dvwr{CY$~Ufozgi@^-NXwEH&hDUj~3 zqUzQ-W1m->cB=Rf9tG%TeqZWw5C%jqfBZg7_&Gi|BW41+L>e<2CEbaQ7E^Si3X+yK zX&N79p5=hzk5QX^`KIftGr_;c1|4c^DAJ>Ur{h_{Dh%>I#gRX5jy0hvfpRLAR)|K4o$~vqjBP~#d zz=ab4;O5scOb5!Nv-cIX(%zmtsTW@@nf&?Fg{c$Fx1eh_Xa7g5h;JiddBG8(=YPZbX?l&60;OAe`gN_3VD9wps4?=UendPR<^LGyq(rN%S4U zr|HP35IW9V3jyi#m%z(oK_v`Ni`)wW9fV6q%~GcJ-l+HOkguU%x)e|2IzW*)`0V9F z0pO-61jc-L0Pa9@9s~Nrj#g$LdTeapTaCqwaZyzpJepm%huYOD+C)9rbbNaSi?jP! zqK8*y{sq}hY{kz$XcX59TnMDQg~h!*Zy`j%&TO51+e26nr~5%M2`a()3zLwEskj@* zL>Qc99b=(;F2;pTg!FPeHb)S4B<$b%?|Sj`DRtKtbmn8pBx&CrRshUD984Ga^aa|- zOD}Rd!P+k7pRJ*3c$Stt%1w) zhQz|Rb0mWJNifp{{4i2ddCn&WB=G8!(xr#*jd{`kDQw&m-PkDTeSfSydFv9I(Ek0CSxs36PU7z%MrwUbr+%>XCk* z{D*gtV&f2CLaJc-9P~8A0soJuCO(TM4Ee9GUVflL0stAd<;)Td^*JnBi2*6%S zTd2!kGUz+i{xAIznH|B&qgb&I1oX=X@Kmu!iG&VxF)E)r*`O@02V=03r$!5%Pk2A1Yk0! z%VypU-l@MR=!^a6^gmaAq?VZ}=s+2&K411+D=@z4*d|FkkeAY-$An4c{9_lsr{&lS z6&;`H2&|LMVMCOe$T(DJ1={3TelF=;qu2pKx-+Q^RoqJbD)g<`a?~CE_){_k`Nv|e zQL7UnCQ+jTO?Zkm5SV(>B#M_w3s@WdHTJ^G#PRiyg@0FqctXh|pITq}Xv5(P=m=?* zr@1^7z3K7wTftY2KdG8pLeyRq2cYnjIte@9zshvUR;U0p<19=U&1hQXYxBHtg^)j? zT&497B#&OPy2#>ryL;D5mVVmsHXpkp4efnvcCVzR5c<1{;NGTyW)Tg1TWa?!*uCr?QO;p3n=plIAv= zu5*$nQ*9N8!U(fsGmN<&GoUm5Nwey1YUB#+1}I>Z<8W~rv#JzamF4&Nm67F8``x$)lZs1L5Oo2RW@Gu~H1S+&HWsDfH zc^@fSSiLAjb`LvWYQBlWz}<<{HT!obwlFqV>kD?m;v~-qK|OJf2j__T5vUUz$5(D@ z2WZ$ie?@A{zYTg5HutX+@d~ z7jT}B$-|Wjg8-7%kPYGNviIfK!XrXIZ6x!{uDL8X{k6%=`tC?>RPRHJ`}P)rPPjH- zXFe(M(sWAx-1ani{D(*$>(FQ(AZ29*gW*lO6Icd5k=vx*7qt*2vgk=p@&s_Js3UP# zu)w#U;C-HceRoy(mT6|m*Lv8P`1HeJq>I2PUhz+sOkkagatE zf*O+~c{Rz2+;Yu7zb91#vhNfaN^UxkQ=?cqG1o}0BO{%CRcx>?XQNP90gZ?+8YfS@ zj;{Oh@*TwE&wRN584tp2wW3h9q8j|BlN94RH%~3&-wb&)j$_N!jt+A^>dS{vCoUCm zY{0=@Pf*q$sI-hm)e33w=g4A@8~<(!0&9HUjAxjjaZiOw7>4&F(|b=XYw9WB-e*)$ zS7+j>nG*U&6fV`4UW7mqtkpI>!Qif3%Q*OW0L|SG_HTGuDZYd_0iAckRtN(#CKdC$ zJN8!OS!29x-dz>AfZ)u5qaW)&$~UV(yy3r{U_|x?;C8Z#t4gfV&i1TWJh)~(M`>5e zBlI9cFH1H{6Wx6kvP%#XJoB5kFi2s@F(b8#6X^V>lhs?BL#(_Hu4;lwf@8D^T0j)3 zVxGHGFdnzi1kxCUotq7og3)Q_89QOL41?<_Qs<79{bqNHA!`mclM)|3!;GCm!Erg) zmCK{2L5G@4!foZsQs~%0Bm0HYE2uxet{a8vCiH!z=i`t{>qw3v<+PeWp=88Z7Ipkn z_2U;1w&%df;&#+-)*VGY`4~rX)i$NH$YlwqGa7$}gK zCmur6--;m#fiyl^3dxSDEh(f8I3)497G?`XZmsRZa_lAPr zx9J5+Oq09PY{jjOVEdJuH7eoF&$Sc{0Y!^V~M8PjRe}arBu@T(uW5M_j1l zbTA-B>b5P6S!{Wd`VNMkBA!65G(2rPX)KVJ?;)1FbU(qROZi@Y(Yy)lM261ZPCDhQ za<+64!waGSow%s%@O(YjyGpi|fj$e3URj%mnqr3FsL=BPL;&MB0&A z zUqmHafaMMQ;1^^f5DMP%7ILVKqut)wRcIk9S&ClvW?;uiWKolQKLk5$k%5vI(n9ni zl^PT5?>mGUaJrCTW@eVWOyxzpVWLof;@vV+j^5@V7?4Ram0prO5S-16eqp*IP^1G^ z8$bSP{K6)h0rK$$C5abu%#tu7;B@(COz6RD)}|?$Nq`3;Mhh3uV)6BVNp=;IF~{Ne z(IO`?n)^e1sOPQx24j#S@XY7!KPmpX;#PsXTv}0yyfNHZOxVO=$E?!r$>4`jOqSha zBUeFYe?*dpiYih?;7#e4(h9&-3x=LxbCY+}s9Jtf;sr1UvYT0`LUH~0>OnbfqzVwu zJFvd5+yF5cuKBH{I#WA|a2D*9K(#?P+mgdXiH&eRWi*5k(TR7nlAV7qsTF@Qp-)IW zA6~v_MZu;dvm)(m0?Jp^~u#Ga*#V?jfRBG<4{K)U7k%7(~6&MThL0louf$cALD|%J~y&F)Sg6ghDl`OwXe_o z7Kmv+nfH-IR&Je5WjD`&)H%(HH82J~5WP4`PHK~PgYy~33dckibVE<$4*xC95H`DS zxT&@#yS&4&2^)#?h&VRC`wjM{LwIdddSW!o#?c#?@1Tkg0DKu0Rrm{RmrUy{G@iiG ztgMQ(cV#u!EdQN`!VqyBY6sy+L6zG3Zq&~+!71r=8(gU4`vKiSPL*4u-8|}b^`cM} zUB|xv{1fmTQggM_D^6<1Kly#LzVDP4LcB_gxHQU29t|^RYn6r>-Lm=xK zR101M?C6--x;F&q6-d%&{yP}1#MgM>UU6&EML80cKNy2cE2_Z^Mk0^_`V0wH{L01} zNGyHcVh_Zf1AWlsZ@c10+|}mrT@|;m=Bvu!`B`F#<7=s1-(C3mdx$KD0OvQ6N&V_w z=+&N7I72@ecFLKtGX@Z$jY;rP`;69;A1&Bq59CbSkf+oALhb^bY^(a2z23U|FU{Rd z4xL@4=1znSgFba~-Low)P+LL)p5=c-C#g5+=(LhA;&x0~_J@-ZhQ*2fvu7U}xY57De9`x($ z@NsmAk>QwUS6RZwbB-WY2~s|Li= zj-|pHYsQrM0@6uQPR$n4C?8Ww0r75KF*W*FN)v4?jvXHe2ChIrInSm@je#~apSA^b zVjq)@-fXxexnfsb8xeAvU20eWN4-wDeGyoGTpI(!2WlRZR&)AgiOlSgx(H#C*L#t3V5%FaCoKPBIy{jn|H# z>e{j{(&m1k4Y5bM$)tB5c&aWQVgpbm{hUqAQR1hWF9n)p{xhb0(}SJa6(`B92GAUG^ty3p@AE^lNhN1VzzY=4-`y6NU#>b zbO)n@-9wX9Hw1k>48u?t!}ouk7lObsUe1zg12F-m9P}FipY9R{h41FQDl*Ux zo6u|C8H27M0O&9li$5QYx>~aLHW_p_x(9O`|J>r5`~wX_mG@`3437S0p*M!Cth0Z-)~ z5vzjE4GJ#;E*vIAhOl9dpeJErtK*Qh62NUrvSBqpAgPgBVlw~1lF^BmDpw~=LpyWX zex2abtO!wrAbcBv21$s@ntn=&@dg8gFVhQ>e458l1T_s0GUh-S_|GpxY3bWH68m1h z3!NUP*aZX>yl@(Wq!HA-*!Z zfXZ8VW^XWM6#Qb&pV8V*v_T2N(e0$e*(}}HLcG7hSrocWb>>$b#k64+?n~#)E=bxB zNqz8?QiK!m>cj5`n>wpIc~!MAP{abp@!q?cRqd*0!U|zlqdWF<7{v)II1XF4#YYY| zshtTVMt%olpU7j^f8a?WTmhvP2GuaS?d=r)7VYyA?xwGlk9!507T|(f2-KjO>h=s| zPx=(hK##+%ijov=mkzFeq`E~!-+4gcT9$M!th2(`-S}ftQ~nAQNl(|~9&(ebF0C6N z8t&p-?Pl>+tf0j9nNeoP=fgb30AkVh4BV8x!xwqV3h3aNG) z!R$dhAu#0#{=e`ZJoTDvNb_BDuCcS!Z>uI0PluIJ6FY$onQA?p`2#W1CF%kLOx1^8 z7*6!FH3~o2AqE-h>oPob!>I;Cm@qieqz<`@T z0sQ0FiJpY&{AFHee(&QAUOMV-5|>1#t}tU1sh?6CwAqYJznP~d>Gjq4D8>9?1sc;{ zPB|sK1n{jTtibSS9zOIVZ3vhlQf>M8rfJ>MW3n|77x(QGKJ=jd>9^i~Zgm?205^&d zLw7nADjfi%-;ZH<9w%RfBskMRqmrGZG)wqtkdMZar=0$+`aqJK$W@9*oG7i$(=* za$#}`slBqVr^BBb7GOUE&Yo2GmG5_`7r{IwFs%ouPZ2v<+_FqH@~Qp%(YF>x&|8ya zv@N+2wfZQzT!j(OqmEeaZ)5+>ci#7G->Wp*o6(pND(sp4Q^5G!Y<#04j{E8YP#x{6 zh&HWxdFT9^z)21S7hnhU$`b7-tLm4!)XYNxhk(>FI784HQ9;%Hv1;=Pb_`_U(7 zz5C6!{_ZCB;@cfV{cKJc>H5(^Ly$mqJi|UzBTk3NFFx?x`I9}z7G2|eHs%RRvLa~bj#OsHk0FJ zc2?3nBaUh00L3zV0B;&FD;~73gkirbPe~@n{cs328dPA}`|P@+;Kg-v-O_!f-xAOJ)*uB~(KTegau3b^neE;Ub0qBybUidZ! zLv37$TGd{a26s7-=M*-vpP8)w)z?m|FE--0nQEASj`GxqzO1)0P1w69c9TaR1Ck%| zum`z0u4e*y)T%Qj9*NTdNruOcl0hnfQb^?Ixqb2yQjs~n%|sP%eEc*7Qj;7<0|zyE2`Bc-^G)eqb{sPwx_2n^5t@Gv$0tDmDRO-X$qPN-SVZ=^`}+x~O{ z32T$hNqrxSt{`AzGBZbyW!09nO_x0^AO-{SdggruYB1H#A@0suCNhNxBI3ZwK*T;> z5*!n%BSJmqLi;!4uF?fiYz5dUIw<{md==4BGm}nlVF4QR85J0PKnF?caWZvlW`MDc zDDHqZV4N0H1RrA1krUOD8uqU!+b9N(RVR*ZTUa-phTJip%c;MHV zPJIdd815IcG!z%hg5w?}CehRjXubQy8FD#3%={84hP|Svtt(FqKM^C(P@EPhWP3&L z<7FFFxlcIv!Vl*+VbS_Yntn*jM;d8M?dYjx10!l$lmQ^Oto=%OS9*_{^uo{ULTohP zMaT`&D`1yrif4Cq(go!x=^ph%79L@Yk+@u%9kvX*LW@kX9f@|#>+v-D&M|&lNxIgs(;Ic+gZ@wJ*%DK$Nw?dqQ z2KR|QU)6l*8GJk~FFgx9b_I@63perDG^kaw&==@`9GiiF=1ZIj#D(_Y-w`-NR7N|) zXuz}1_4|xYXjF9U&l?#1UK9c0KU&RQp{LG%vF32e7c;@@mL|H-%@TmCm6*ezQ649LXVpNxE zQ6{`-8bG6;d;L=Hta&V9FL<;*_EA9=8?gGm`Z@J@u2%V@DJR+&@0Kwx;xbAD#*sq;UE>_+`P$C=b{Pv`*q@~?xisGYgaG=7Ey#oNpr zQ{USAm_E-pWs5$U$oaNW6L!k5`tfOuNNEgE-FHPBk(Z7i6~na}5Pcck8{>ON2D16G zU*1dDg8_}t$9V+=Ky3vWb3N-eT6D40Hjb~wSy|t%{lc}#JqvI?&Vh1g0AlAut_@}v z5?}*jc1P8atOPMI@Z|=D!KAafu(;N+e_OB4C!{uNk!!r#MuEjY?wLWE1n?*M!^b(H zseq|-x1T~9HI6%5l+;0lef!n4_kKAVYLa!C77a|%Qj?%xOwUb;DaF(U`v)seqj6}8 zBQZ)kTH_8K4Ct1|LH9%AAPm`{KLD6V*L6a@#5)-G45Gm2q(W$dMk$x%=Ps;R=0`Bo zKkSf;1HiCcCnDtHP`JO63TwNNZj2Sx;y0rtgMhD_^CG9y}b zM0R3=d^G{4&OU=T{fYKC%;o?vw%3WU_cC#&@Ix?e;`UKqV9Lny1#)x1hfa=!U@-;= zHH;LqnvYc*d|cZT;J>winb?4CbNJJ8q)rx7z&TzeDR2|&RxjojH8I`)ngt!y!>Ll= z0TnvS$dSNDf8LHme1P%u1u01aI*2tV-!xDflo91fXR$yvKeRRk+2)zsYQ;1^aWYuW z_Cr#b>6#JMmuYcd-+qL^07X6cc!36hPdYADofJOt0h*?BG8`F_sXqY%Th^!)fuJj8 zb8TQiGOL5k2NfLcx{K#QQ{$!&r$&gCmm@XLp@0C&RWrBSW~}wd4M1@>U3DuDec0+} zh6ysHD1HhA?K20#A%uW59FUIdWtkX+2!adE5FxWT;b0~Y8VY9!{-0fj{>a`t#V)Rt zlHjm*b$JVf&$)zD^*M<{W?Rmb)$-o7wFeop63UeWY=xE>8{)rXTsw%t_qJ;&WMXjg zHNz~!aN$>l*1kaCex|k|8@%687jkKLq97cA*85s!+Hfjd(|4Ie=x-$gqb63g-msvR zTp7_SPL!AqY3)5OEXWRDWGTSuK#5=gF533aZOAPEESn2zDaN6I!a({%(@_cgeXU~; zsXf8Lz#AC(1Ft%v7pPc)WfcD*A8|f0jhgrg18wa)R~ZXm??>%GM8(w@ktspx1$_Br zGd9Tfkea`PC_~xSfRME@F;v3@1TQZ}vCrWI>3i{^rKpXoj7_K4ETFCg@#Y!Fm>u{I z%fqFAo(66o7K~$g=IhUk5`5t@tG?b*5 zQ0XxG3?h#+!@KB-yDVr-N$R0xk6@7}O5*#(&|l2sLQ33wxns`-LG;OLmLu^I!4<(? zhYF_bm#XR+`gIkENitaVufw281pLx=(HpDqGsGko2gUz_oNf>!@eM~Lc;ZB2w)d*h z5JcQg4?gtjKe1`14Z#n?kt^*`f1fn?Uo*b3hy))zn_$BP#a1;YthL}B#S1tDs;|{R zc(cUA|4Q*qMzAhm*ub^0+b3IZ0Kh&I%!1VZWA<;aQ*%xQc&Yk4+Ia!m{h(oO&rGdb z^X@7p7$k{ps3fIBI^O9Q=ATXn^&GPQ6-AOw6~O<}3hpJABAlJ|hyEvpa{(F5{P{Yg zgOr0A#R`hCW!)H68`BiqiToBrYIux33IWwHB&(+X3U&~ff3=kCB=ZOGzekw&`gUoY z#CtgR-u5mEd^r!z#6TzNAg1&0u~IGbq0cN$u4k(*L)#Lg!n&~#LppZ#EMT@@df|o~ zWg6fU5}^ihc;U%gBZ6W_C|3S-aw>1yK~-V`UKpgA8#B}tFNfT_K!v-hVa4dv&w++F zib2R#7!sWXXzLBHz}q>sCr6M9+WVqV1&smGNrKGfq9`1D5XqKUY6!tL=%-k8us+wD~_J2?6Al#DW)`LpsHH@9@4 z#_pN;cgD^?b8C_G(s7mfUn!<$H!!Uq_hm}PD&HLQo5g|cB{M`kVhlW-ak|ComsnS& zYr-m8K$U{ya|2@h5kWPP*r?@z7*d5_pu@)rXp3SLSvT&&k!JVj;qoUNDf#;`B3k?= z1=X?k^uK=mJRPXseVfwM4tzEshTblBE#|FzJn2$qAw{P23X`l7j-JV|*0SW$-mt&e zs2I8o8e_pvK&wcXP<^+HKI6oh#L6RI$Dz_G@EM1DxtCSHa$L0*(%I%q3#V*x)7!i2 z-{VW9?>Wzl%y4y)K%IMKPxDdN$Sb$Ml&#o%U#rM;_9yF&qgS(hImbzF4gF*OanDAmZyP!d;bGbHj+nB2|ykVIk$y-S9k*O~6R-!wMMf+kJb(?Xz z&Fh!6vr83GavAdP06$MS`D$ih7tpeNn43eFC=%zC97&(m`fV#t!sn%&5?ug=qrRMr zx-IS7o?m*6P{HFywRC8hH;>off$$q^;3$>gF zOS2N(1SF1-lHBenTi#E(d*6+xYKg9JB_ z>q^Hg4emijxSOmSaACttx=c*x;5wzqk9C7r$LP1gJxs|UMRmo2wiJ^#-$eoUVnu)(@jEw|7(M9FU3st!QB{Bdff`zQhh;5tIloETUU@k}+^G*ESa_B3Q9v zy;w%>iPgQNt)Zm=y9pMtO}#qa^KzzohJrpbQYFoBGlX^RqP;C8^PdPBWyEH~!dUk& z>f2HzBY3tHo|}!ZXG2^%WqS(hXnqG?_gQS;!@a|#Q3 zHqZ3hYy3cE-M9w9!319?UTm2XO>c-k>;s+wh5n`Hn1;$SUrL{oU>{4ckFY!Cpa+FM z76rZx6{RRnK~)T?5`VXZ8kWxr{U+X@)LL-9eVvnTAo-AY2#hL%x%!CI70PS?epc*R zu*Xs;bOrzfaHV}_NrXHN3Uz&2*6?guVGOyS?P@8Tb&5}p)OL*%%{gHSjREkbgMp{K zXwCsW%I^mm_{>%bfUS&L^^o}qN5N1~nGBT28buEWq`>#GGI-HJWBimZ0qOY6TwZkj zDn-Nrjo@QhV7zu7?r@zL1+~iQlvQdSb|~#j42TlCsi@~iDGDsXmK95{qI>fpR{Sji zq7)F9iMP6c7c2g{fbtvM3|2+FX!=u^AqY4cVG?$Fa5X*fD`hi+`==Z&w3vS7?%{7S z@QEs+MV4TSE(7qMjWP|?8xZW0h4cYHsQ`R_?5Z$2)ggp}61a7z#qw!-(OpQX@k3f!Zmm(>c zKe2mr$p6PfiZbAvh~yVn!DkHr|IZQ1$twNtV}$ptK6$;DW^7)Q_(R1MFwj;Lb1U}@ zF~H@A=eNkB_sDZU58{z@AiO)0=; zsq-NJb>vogKFxN!M@$B%~h9{C{hUYWIV zcBt0+-1u5I-{~g_-Hv5wPgADEtGMO%&yQ_R>nE1~TvuVr+k>UPPMrBeYtNO%lUJzG!Xvp z#ZdU4XK(-iiy?+&h6T44PTxe3Nc!!oB**(=_ZvogT+>bdX6=i%FY_Di4m-1s5e{$v z{TT?`5$D0TSu%Vwo>YqzF8D#q32V>G`OV*#Mdcl-VTHdQRL*!Qy>)W+x3Yc7>NUGX z&8=0DKV?7fc@=TGHshPaqoz9#=mU%DPj)|g7`HzKtmYJk7QT3a(q6A9c*|(hym`!Q z{pN5A&E8q1b2R(!|H#FRcAWiFHF$53$l0A*JiYFaw%w=bE_I8e*xNhn6^xC`p$^5>L zWk=Gv|Na{-zn}aME{lhm$}6gfwW`zB47a)VG!}ce2(x#*i(g%;RKNBtg;kKZKG<`h zUUc0y-|MUSl^Dq(Uid(8vF_zp9vDYK<#j|%JCU7gXoM}(}$`!1y?_u z+%;;CT{!0kPx;qcBb%wE^3cLJineSMwC6vV+7&53ms`gjJN?b#t*$4>7s1OzJ`1Np z1T&t0yhPjAQbuAB@|byUJdtETh~?Vgz05RnW5Xr%_oawbM)e%+^6g)PFmg8 z2=Ug`@eb!!v}1H`mX4}^IksFhznPEEqnXCTZT{l`ZZS;eW00?I?p58Az_(s8ysYmn zo~bhZ;#uY!SoxCT%p3&Z88bX#MhgrO$M`WA1or+AR+gUw~92k`5Hb zeLnt$o6bttL3Nnf^Tu%tM^virL@qzihbkByPB%w+uldUO7-L`zPITxEcj~2vJD1|j z-Rf1{zu*5U#@n(T$1GGyau=a9zoPggFrpi_p_F~hDi?K3Ufp=#eUY%~M6}BF|;dO;w zsxbJSZ-HleXhXfnnG$}+{%59|cM1o86}!BrVoEq2A{bHNAT?Izh&kTynIWf6Ru>a= z;WSI{Z=&Jf?jJ^&FAb4blP?9ttf~tvs9h-2m3ZB%taz=eWbP5qaZkqkI9rG1ck{oC z-v<<}9SLtX;5d3s;rtyoq4T9ib$MQW#&4cHHeYOfAH=R3+kPP>3lGPbR*nZ6Ef}QF zZLYk(&DoXyg|@4gBi&H9-V|mzcU|kjFV*GWTLmfgU8(eAWxKfF0<6voX5Zcfs)+=2 zeP}S^3Q*cSQf4K(a4VF4UU2`Op^Egg!qgvkE31rUet0OiB)?uGU5Jiu@II*|sML}o z*wF#7taJ*z(TQx$4U{p;|Gi6S3++ZeSU4~7zW&tS@_O)d0Veew%%yh@y2umAuH1R? zO%v|42S-0v31%9H-nm&PFkIu1>WMTIw$Wt^JhzeUF2@FsO6X|x9I4o7hL*_`$}f`gBNU86XzoC>rxj^T)8uMZak$%QK7?p#QWN* z`mFcj$74?TxiHbQPdzu5P`zLx$-QKm)bnkiE>>*~e|<63_FGSOb6qu;)s23+)x8b9 ztmA@=S>S&;5|~f;Zey$`=uv6jD}}Ku28}f z$s+uF>4|xg2W+5#=e_5t=PIX{#~DJi%Ky?;otrjzDd#?AI+~vm+t8eMYSo%Ge{0?> z-*|?ey&(BMC&EtKO~LF`?B>RKPo(tv>3PzUoLtD;@axS-iVf(7V)pF&va%YSG4yY@ z!D^P-JEH{_joWW_n{&Kts$U=H4)eUB^GFn- zEvb2bKI5!tV$GwZ_aX~#uUG_jNWIXJ-qjP0{HlnU80MAkvYq=slzjzkBte#?-DYOD znX!#!cAJ@*nVFfHnVH#cGcz-Do0*xJ&a-#Y&F#*v=1K}FD z^6=C)drZz4YNMaLHViAU+I|5Bk?7KSY7?}Oeu<3^6te9mHsy$V_WKhCDwGMLoPnE; z{35SEPSHp#y?|9u5FZWarg$6*q)}+Sl6L(rD`*$2xO(4)8mL85q(MG-#d2eg{xI>j z@jIQKKSm=8$wbg1D=Vr$fF+&X`6RZFwOm?aECMQLo|SX!Ev>xiZhw_JQvhHg==&qz zGz$$-1u;l+LTMS)ujVi`K*`7lzd}gm1&~x$US)qCO3h!xR}IP=E;W`>Eh8P{+m zQ`i|p#dM>uf{fOliDWYl3@KUSm{FY-5azlua3A?jQ=BLWChqOkKW1Z+11FMv?*KtZ zP1VN^caX#wqP|u>f;lLXWUDG#+@wOEC8oNtxc1c4pEERP6&s9{-}&AegX5PK_Fxn2Vu@LMnDzJs!( z^z3M7!`uJKF_;=czs^=xZT}!{P9|NBpO8oCw^o~djic+=`@9dtkj(CX1xWz3~cS(>hML<-V*at|s=}cl`A^p4n~J zTjDo#$9hPYJq7tprc03$a{E*Z6F_x!-HL9Y^?vP^X%CCBB}HC+vh|J!o(Yb`gun^M zGD*0J4xUyuWm1)mF{VSjb7I=}VU_<5`Q`mGOb|pIDZXu~i`^Nr^G?HnJWR{Get;ES zJ+bxNoT3C(w1*FZH1%i4M~y#N_W9$Dppk4W{Q0fBpC@Fi>0pw~O#%vtavyF0>BzEB z^Niju7QVy`oQ&Q1k~RGbZm_;_!fi}VRLm&-IW`)$11*j7;NvKWFwq`?>p^SyYFITTvD z0U47kGQ0H%mijkcWLS_ScrTD0<6q(-lOO0UUF4rK@@cIdwR2-@AC(55Mx71&WvXvW zVZruVJ^j)6P<1$*?gajDi33UGI12lH z#8m0Dtf~*UHycQC(0^Ix#d1hamY*q=to1k2`42FOJBk=!W?jEyY;SFD)I`0ygoGym zyNUe{?mC#2o_o{p>mM!rp7$;CF;|D_^iVwvnHU9iUN$RTpg=R2kBa6%9i<#J&%e1z zOzrakW)R%m@(P4gPefz>(CGFo*~}DV%zdR{z9ZUu(kYiAd6E*>v#4ZGyel4r&~~jq zfBi<#zJBVXsCvfd!4VAY0};9kBAPg4iF6KRle8u3g^_WE_BS5) zC23in3?=cU8v0#*gtNJEJE{@t^1iY(7mY55l%T*Ss$hAth!X|8ghQQmQ3lC1MlS&+ zk`x>lbPO3c^PWVnkhy?M3@{553j=oV<@1?4&8`FlM%wwg(7RO8^+PT_%jNvIomMy2 zF_d$m-j7c&JH#y2{Yo9u4<3ahHu=K$;5e8 znb#EZ+*N1?cwzcRs}}K5pSm3jT`{`G=25#Gb+o934)lcK&j>B6fS5je`L}BHBd{(% z>=k$dqhK3R492@Z|8cW2e~^{{8G@zzken@j@wk#NGDCso#^OfGj~F~yL5*4E5Ew)G zV)k-WM$hp9vJ!vDvsZ?U@i6uMrE#ZjZ!WMAOgnkSb)V?LIbcpfPr7S1l!4MrT17?$ zM)C}(&1T-=EeFb~y2dJ)(>uRqwxA@IFt}OoK>5y|-t)Vj)+^`Q9yOxGGWMCn`k&p+ zva#k!z1;3rJJ8KM$rSM`nd9cg@GDdbr*&9?NN#G0;{Cc#$nh)nD3GUtN1nwM7f&Fz z;sOnS(E>g*x6ggC^o8jbNZ2OHN}x#Lk>zeNq0BHLtKA-22TC9X;DyK@iSj>Ow5i&WeSFcImSRSTm= zBE`XQ>=6TOUJc^~KsT5EC>=cKA7Sn3pyIp;>YrEjP6namliTu4fhQ+$#rs{^R3LSG zEsMq0)Q+|{oxK9Dn#{;$`vTk| z_Or)X)UmI7b7p+S6 z2lFEm=-d}xUkUp+2iC7Zzgn#^*7_M)#5aN-(rBop6 z_|lxr;c&s0yWQ%ab;mL}5F1;_e#VIEM4B!Vfi=OlNg0$U%7ce;2KRkoBaImKov^%O zG8~}4%;AsjDO2!~XSFA@SSca%Q!{^N*@U)5btx*|8xJeaCc>B)2@HhlsgWKwa~hC` zGTPWins^RdE(qU7RMzGumT3Caa-QnxUSnawxeZL81IjOt*60*L$ z_={P*^6SX7_X#Aih|I%S?n9u+=yD#URRvPwM7Z|Umrg&R{^r?5II%6suGzT~d(^KG zzT?`s0xAc!+H*!ltY|Nl%>+SIlm_#vV+P_T#T@Yj_{4JaENLs`VZF}Ek?`yH^C^hewEVHB|ijz`X&LOWLlBj!y6H!ot z6Z+zC%uKz&a_Kyh7&PP$!V=N#mGpG|GR{0cv(qI&9Ym%Y+KP>!U~(o zrbDb*I40@=bR+Z>(ecT}%5*SH;Ze-rT5z&fH5+g|MAR0krG>4|(U(T46=pZvnAb(D zYi+&Zwq_w$jw=xHz^Squae(tPlnZ;orjvYKxZ@?Q&x-SgCI7LzO~t?01jjK9DN>bP zCF_(h=$%>)q5Yg42i%L<>L=sEhM4Z)|wktG@!7|s?X;eTFL z5$Z}$rlH89zjW*L>xLMQO6KuhxAC7}t`?uRa*B1l=TU4ATSHDx7`S|m zQha#q;ctQ7<3L<)GGN$zqkZk(Tc{$l};+`e+ z6}ni^sso6((@fqo)0?7eUsk2pz?-i6dlg=6?4;p>g-NR6LWcSn_s8Xlch24SQ91et z9WGs8noeH5OY~vB++L3g3r%{^#96|kaughHkdrtdM9$Z561#E;wV%)CrQnjTc*w~* z=jXr5gQ@qPpYRhHg3ZY9w!ShxnLoI5O>{NapxOsIT!bdkJ%WhbTLU-I^lnMqlu$MH zUo@R^5?$03R1@X7kdun5GPJf83ePkWZ$nr`!7#^PdRjOC%(G>ukb2Xgk$8E?yyFMb*a{{bvz72s- z%urVb+t!csvgU?Q%Fkv5evz?+wB+#F)OQr*;6?{}hOt5R@l@~aHZ9hroADXl)z5KA zBe|`L#$gnXKpR(H%7H5N|2m}w1Cf)NWz2K)AC~eHJD#WOUKwSq3`EGfUUq;d6-A^Y z%MnN#i%e#Y4Sk|e4BO>c#J+#B;6CM0Euh#k`t%`(yagIAc3pH@U6 zd4DdmWtYF|1+_l?;vo5%^1SQdkvF0u+6oEr;XD4|dy`Z${n)7Ho`FPSAL)6b*X3(L z)^QF@My0!=D~LlIp?T$rYikm!SQup(!dh3%u0u7_$z1fNOD<9P_|i%3wZ07*Q)1T# zN`HQJ$PTJ+Z*4x1OT)J&epQE^;L&vjei3HiIDNQBUfoEP|WCo|0sSg43sGZ9bdfCF;#bG^i|F^&wip)%NHIIxPTW#4Xq&^THgUwAjNJhY|hnfOaLw~KG` zwqh(WE=CY9%bqT!x5u5g5|-ZIfqE>-al9P`Zd@GZ+I6_VgvK{;#u=FcG+M#J)p0m# z7T;W`nO6l$2;=)AaGm5ys$-jJR)qevCNGKmaaU-*HkQF4srt~1$=W(zwKE-Or%(ibS*79$ z!CR7`Bm2wn`8N?_+9+2%qfrh*7m4E zIoK9$&Y|f2kUZgm4m9S7kVArt0Aw5cl&rw%I9G)t;mdt0WE)8^%=Ac>8*l5SHVdej z%oP+P)?o95bL6*x_Nm!n6sx(MMAIA=@>OV51^!L3d@1*Oga8l8hO+S2fD;z0c*Z?J zY`RdF$%dUdN(gvY%mUU$kp42(+_gzY3y;#SP9SNL+Jvq&exfeXJggE~yP4`{4GRzP(~iX+vmsE|}=X>(m5hV@x6Nn}c!A{z0xXkF%U zPm(xke3BV>SVQB|Tku28na}x-aC0ZjI0xe|_f=a6g=*!S2(JS02RehDfwtt$Gov!+ z{-Xwhw8IuNiAxjyXLe8*ECQ5g!9TWSPQI0PQyy>4|E@J#x66^)u32uXA<$;&`Hmhu z!O)&LkBJ&t4mX*tPS)CEOAV%h*UFARi8z3G78W3N-9R(L=`{^MZfCH1XC0-G?ZcI~ zwd*Afxpq#5#+#LO6&%rc;?$!_-Li#}vzwb){+Qj_$pslc2Ws}Utb z?z_sx4Q)$`&V$HXgWIDCAEjdR%5~6%&!R8ZIiOi^tu>Z56xFGoo!QSwkscOBr$9bf z{JoJ!0;OQB(6cDQNMFHAJUzS|T>4$_2C~y}4Yyb&epW8mEw3k49!^ z)ZeqVTipLNWJ+YR_MKMl(n*vd@*g=${;6bZ{2-#DAK!lNK$~O07y66Yo?N?@pfJlw zJ63#RK7$G{9kB$a*$rZ0=@jZHJ-%1290IEXyWW|o7r%LKu!~pnr!;(b1WN~(fyj0p z9Ow3kq8|sRkxEVJ?bt(J$;`Z{4vow#^`=W?en=>reY3*Mex;=tp94%>fbpIOox^~h zZU%P{Y6Y;7@Ew(aO=qADBkCq2q=i=@ z0td=dXPrROVu{te)9`na`q1j;gdR;TmF{f3PVcYF05r4m!*}RS_tG!)&4Z^apEsBy z(j@qQfuGnI{v8IH0l@m5@eca`WcmCiEj2k}_E-=v@2Kt}CTzdmU!{<-prStw+X;d? zljli<{=9!&lZF$^dF*feHaUla>2Fdl4ratZl7jz&rI&qz2rv#%PR8Kq_`INfKiBrL z-t=+B?D`Ue=M5`D4^DZr{UOG-2txlO9FDGe>zlE}_sgb~McJebKr(#3%F-`bE4ZnLerJ@Z2NYp~vxoeN^u0}x8krcajSXXYH|5%09^(A!IpN*N(OAvyvyx;v{e)V@T+8L)R# zlY4hJX8|m%zvrAE`9sftudIzSnw)aS=VKuIs+H>6s+GKuL_7lRscJ&tdA?hk040(B zNgEh*-2SkD1~qb60LcF*Pc>x52ledLv+JOV# zDhfuSL8dzk@$2ki=7J@38j?;7GX~4 z3{rmX3g@Mh-{uZ9R|o z)#8&Z&(9Djj(-JVLzwp>O#$h;ym+?HuUl0HaxQ8IqADm6?=l%3snEaZj9iKANPVQV z4=TqWOhgG0h4+3hjKI+yyu_9Y+|e1lWc;bEdX-0P?1QGsZEEDGi&onc@F2d{Yn~~z zd)N!i?LL;*$SoWg6Qn+@B@jBT`Aksy%ix`I_<3oN%2BU_-2nHejk@C)qz|v#(UGML|Wr*2;>tQ13aj5jgmVTsK$wclDO_5K6I&!RW=h2_3 zvJVurg)5g4$lkNCHR^+OLdJIIoXMHPXV*5flJJGx;%){kPx(^jKZ2KLl%XzvUNkPG zp~re+n)9Lb<&o8*?=MSfiY?^**tWJ;~vKD`s+96TzuqlY?m`fAr2~Fj5|yqyp+A? zD-xa(T~3w1L(R!y3aX~=>BK%FOAWiEAup{W-C2e;_@LR^-@ZI*Ezu<4&fHHKN6Uq0 z&&?^iJ=?lsx|nHex} zVXh3}y|n~0IPnmbh8vZ&-U1XfhTB2YSV-HUbjqfVT#ogJ?HtD9C?{yHwHpMm=X=ub zi&D$vTi@B;&wc}%xC}ymzr0C1O|`ZW?+bz`W9<@G^J8K4?BoY1QsfmMjZ3Qn7qq+f z+Jqtua*))HR^qt#SPNfko6^st z+$)_rMuT4{Kz4j<4oLa+bysY&?5wMI>c2j$um=(y{8}{uryAz%11JdB=5#TlL!kh3 z1Z{~^_h0%cq;jG#!zlZxgXn~+gDacSACy;%LhX+(&7a*cW2OQcbi32dD}N)@5U&@t zvEn{!Knb6&l`I`c0j3SkL8#nib3wsKZA8Y~!3K4oG< z=%wYRFz~%s_Vf_npFq4)@4T? zbFy`ggXI`yn~v=q)e0C`<0rm6^*lTd$~#8{lgTk?@lm7L>eHd?hV#e%p{P0u-Z<-E zI<-ZVZ(GyccM-F52lP3Vqmzy5kKccV>kQ6+ zz@{1(3izGo)*zqdZ&(uXCJ9|+Rx>5;PM%$$J;~g;pK+l?P`Q)!i*FTV4nfXhv(Jx| zsTVV&y&rvU* z-WSn?{YllrAY4JZW!|N%{tHY&>-cmS0V}3|+Ru4UMEwiQ{6RioVt%3JhrVza$4eL4 zjmcRvzT-$Sp5x@fLi3L*G(t;5MbO_e=_o~m`&}d|k2Ua6k(4RiM+*5my40;TxY&EA zML8yCTXUkZu+}8b>#E?RGLOqTxTAAS48a(^^K9#{CpZ<77G{LF)FE;!vs0d=pe0wJ z1?jF42vW2v+a^midmY^Jy?erbPnvzT(42v)Jb{5^2J~v}gItM9uB;+wT zKD`I-4Nw#5%1ZfG(FfdH%DEK{!4Q~N5NXKCe5v4L@M(f`09T+Z0YPzA)G)fGotW;( z077~Cy;dl4#nD7seR8zw-c5gsQ3vtSW=jSdXf|#z@<(VGbijkLGpv#N*o<|Iy(^(j z5Qf8Wy85X_z^8dB(Sut>xOauQ1!&ckWRV9wO9E@GnK4vu?jPfMvRX4= zGp>!R)Z1*bcoX$Ng$D*Hvrb7Fllby_;N1}m43}6N5(nL_qs8+K0AHfhVGLh)9MhVj zo8V`ZR0HSEswv7NDvFYDHQWoBcCh^WB2zZeBRqQ0cLq5% zROMd2Hn<^g>d`pgLmFzS3|qwWOrj8LkM24XUe~`#1rNT1sX7)ZCUkv$u_0Xtw z+V%>t+HqC^OEmN1hrcuxhpp@WuwjH9XEDF9e`6qGT?Dr-iVB?GiE=yk6Iw|PiudPV~oSuQ`5 z{1HYZ>d-ZKl;oE7lx=K!VWV9(6M0l!**B$JAeS_YXR`zxaRj`gqd1&oB~*$|P;w!s z?E0laEq4*`tTd&si&irk3#*Z97r@d}$2g=vfoN_H=ZUw}{6j~S4_=2V{IaE~mO6>X zQwuueshGPARARMX95BUReRKh)2Az+oc$(WA`S>YdRCiRPG_drl0gDa#^(kSmdDfkMor| zWedq)6HV$X>uAHib0(O7_aS13_`SDVe)ACQi{2NUHz)U5&fg=|gN*QxJ9NS|$|2@D zK`r}rzFC*s@C@v#WQmywojX-68JmhD4H*@sOgC(WLtM@-=oFH|l4_oyr;{1`gd!9O zn>c2SzOm@&9BGK2M%i?N48``T=u65Ap<-)bj9Y3J=P&YJphzZDda6mivSgDKz>K!% zo#EnT2|zy`pH_3nM)I* zb;|OMpwDb)WM7-!rUA`aEDEiI^TsRPT7|ym$OcEo$~m8kq&bEAhkNk&YCqQ54P0>s zCDw#Qt`2F7V2POv8@@1Uh!W#E2$Q|CeeDw>xZ%Wd6nm|9kiYRm9ps-eb5UU4EqnJ+q`~_!3KF*2If5r(Ly7Hz;lvHdK9TbGQPp;zW`E%We z4%d{5bfxDpR967K4a@=u@~2ddlv(=S{SU^_Pxxpn$SB^_Kj~Zi!^3ATU~{pQj0>+8 zUWpiC`E6j0Ft-*r4~$uAJ!G&^aOr+3UN+h1d=h&obFsC^bIOVz6oX;Pds$`hr$+q? z!@0kgOEEn*=xQ`gS9b@|&bg!h`kBX3U71KtZF#*gF^n7MdVUyjH@<^Uyxu+Ge}Z6E z6ej&wKmlOk_aNGHjNhS+>a+Nk-H7d>KC~5 zlyNDbYM#kR;oT&7%G21nP`rm&y9)0S&V_4z+(U0uE_bVtv7JfyMFYvfqv1Y|RroS( zguxWhEk&LI*rX*wt7Sd+&yx)* zG(zw+)i3rx6t5ybt&g{U{>k4gE%kQ?QG&o4B!2zlx^<0&XT8nimszk!6S>sm0~f^) zs;H9+jY@c=Yc~p@`s~-0K?O^i9b}r=8_;m&eZNY@y$hsF1xWzh{1qfW*0<9<;!Mu% zY^Cp%xH+uFB14j*i$>VOLh}K9paewbsab6DDhSDaE4$TFz@n-E z-2#m-yj}eB&JyeQRVzq6Y6uk-hNOX^-`jy?Wh(vt$dw3=HS~0CQ)k301w`E?eCCTT z;fil-47H`wCkSd~o`B*ad#N}EnV&{hAKK%{iEXmwVXoZG?c!}j-K`INoPm-sl~H=E&o{(TJ1+U5OwDKP z6up&Si{}c?$t)g$#fM^*bO++tziZEgZdHvW72(`{VaJbum?RUxZON280|7Mty_m{V zJd{K>5GL!@$m+aqSq56P868!JDs;;-IHNH1Y%;aHZp1V$sGo@XsC$9&mq-F|sjA5{ z$cd4p_p@F;AYP6{NW?=)`Y|l8w&qRtANHOZ1|jhmMkGG2U!hI^CXNchh}8bvoV;bGpC! z+qZ7!tG`h0v~{*V7ZLEipC;R5wmRQWQ*=5#-!6T)clUhWVqCggK3;AgkIuHdZw9xv zGqygjd^$Z|Uf!PYxw|~?O0IZr7kNHDKk#+B-mm++yWe&=n$&#WZVy;XUnj@AJKoO- zk9WQsy-|yT7hKuOdEhPd~7#yUw&d?efwFEi?A{oqCzj z(k_SqpZ6bH@!lzhs%7-RU4@cZIV&*6Hi~ox+H}K^_OSOd1`OtT=6YhZS_kf8h2V0p zzlP9i-SQa0*U@!3_)y{Uncg?X{ZTVet&-Jg_!7|t<%j~BYEuT~%;be7d@EcLg+imm zKvY{m`z}#iqJL7=PUM&aD)jP1AklWAffH2K!KImao8Bna2J4kuY;}Qq-k{tofa`2S z$1F9GAYfrU9j?I6%>5~V>r~yvOCnC|sj0&{X_i|e^z!j^E^0Ao0S_sph=v=-Hy;V~ewN3tm-IGejHtc<-h~UYKC&p_O z5gKx^n9f%0a}5Mi^ZJgQ9w8sY!dNqaI~+4kQIL5VnI@P8NEEPfo#7EAV{pA+x_zBM zA&}bSP0mJRl5xdguxq=>x%Y;w$=Eo*pC^~7TwsEi!0GwphZ?BknP5N?8L5H0!F`IP zt=E*zBI?*}soCd1-_=0`trvKEwIAr&T$l5YM8ESZLWkN$c#4DIS6fU;K0xXMi;F&F z&grfwPuKQwsp@GBjIOs}dh!3>E`1F2lC#CDAqE#6QKGJjLyW3YiiWxb?pv1o8PB5H zlQhtu%B%d3n%-4kBGUnKdTjX&j0S6leh*yjX6VRYw4`wVn8 z#0-Ii*@LG8Fwx&PV3V5V+2vAe{-Urf;yqgW60Q{zp{RC5ZWM>$;6Vb4Qdheh1 zdFA6r84MA!ey*hs)u`l8#i;d~XU6k6Qw9uBd?Wa7yml)45&FX{xpkHFIlYNB(Q6Uq z{a7l_6X|{B=PI~-H@VRp5oKQM5O$q2;VM?w7~DtC2OJ+z3w6X{6U-sbX!zqz*UQED zLMV8#E5Xq=2Wpb`@1Vh%8SF#`-F%Ow30u9ZttVzXqT z!1CV4MJaUJx=q{Vjw4HGA);1JVB|VIO^`svX7q7L0ny0a-T^>cJI%Fih^4m~&^C%0 zQS-VV3iy^EezD6-pZqVeIYDbo4?L5h4CP3)H0x!oMG`xr_KF(jiOke>46Fg{!SyP5 z8gpB3D?l-O+I!uN#Oj*5FsJ60ZZam%np^=id1~fU9c;l*0rx}oRKrpUagU9H=r}_0 zn(n`uJDZgv++GfwQpUm5daS0`u1+NpdgUa%2%qA@82r=&`EVNYL--ibfLloDdqYuV z+j5xWWlHUY+K$d|?P7Sf!UR3p^vi)^`HvyTH6uW12mv8hCH<23Q4&lj{W+o_P9Oy1>?-gj>!bX>ok@Bc8eWxLserWZ>QidloAv6yhj{Ct zdaizMYYFzYz%}?tek##o2rXzB-ejjar;$#7N{vX$2ajv2i3n5Im8Virf>n2h)CHNOESu)+az12K- zXh$H0GaHVVq5LrthxWu(B}okYgSq#FWQe`l>AuH}w<4!Hg)`@>{(ddi2{v663O;F8 zp0Uq{P%{=UZ$iqM@sB5nhEBZ(A_iH=yZ-qVgBZovmVn6h@S@ItPbm6U#@#$v;RO#} zpSmhtpG9Tl&1oN_?FxFdU{Va!44dONbZ)ThoqagZoTd*x`@17G^5Pk~#;WEc=_nOL z(>UDIhqQvar1x|mfI62qV%oD{Q6>x2LaulyU&39dMq z1IR7;7K{bv)+*M^FmTekJ}Ge@K}-(8^YopfAvVpB1J;%1 z#cNj1%o4@%LB--1WEr z1x48_jCCzlU?igu-ci?h`<=#t0<&h5uBWPxQPul+=g;cvgkNb^^RdVn=>yx(jIrEG z2V=n*0I^ayk-ozn1-Y&+ab%>^p~;I@ccWYwxuG370H}UjRO*4nlowcm{T;Jea4?z4g1DM4Nl zNia0yM)xwY8Ch%~_Cu;7`NCQb2&sHBQFnH{=D*Lchh|!JaV@XcE05+q==7tS0c1hn z^eP*8b-PDpdXI-D_)+?EKJ(=?d)P-E_QDJAbH0#khsSExZeow;B5I9+=jWFhpu**d zN9&mL@FoZSYJ&4+`U2ua{QI}ykC#WgX*auW_a%cpn;)7T25XebB0lPo=U#ZP^N!p_ zJheAgj4>Y#7>jS3=Ou%P>!aQbI=b@7)Q|J}u$P8BXx12aFLTQ>5rCG2kHRwmJ@-;w zPRBBBUFXO(c7z^Opi%J}qQ~!_~J6K3uL#7tqas7DxtS#-$LC6&~ zY+?9*Uixl+G`qz|y@gbw``i->B(vJn9y!0H9WOu1_+k1y5b`Bs1hu2&l2g4y0l%vB z{N~P<%F!N%a#1VM^29w7h~4&pJ$XC)TEm5Ptt=OX)v8pa1Hhf zwc}!l&g$L^-Rb%JGapX-KAvFQJ>8+~)qUcvm;DoeRApTDzxqxXSpK~oUI5nrM8-(i z>YwSl>7Fg52xaMXI7;5{yMZ@F1ejMwc;)lCUQf^yUe#%0FD z?AR`No#pO*BK!`>nvGUl;_`YR_kJ4YG0ExXcFy50hi7wG=X-KJ#p4C^NSnrXG9P#-5WU@DK9s{^qcbTzD#=;X$Dg(eeA})npi@(!s7R(cgubbH^1mm zo}lGl*?soxa01#MJ0*#cVha63(Njz#_qmTGe@(T-CNh#X@Fem)E-|qZm;XSp?vz%x zqb+BR0Ma5xJ|)BqLoz6U>^Yge{I#AuzG z!QfJ&k2o6(A9d4W2!uCE`-LjZyqtpg6ONJo^`!m;M*&%DKa`_5PaTT;%oAw`J54!X z9r;>YFvZx9g*}DCINX*7XOs6?C)U7H~79b>Y>A19$Wi zrD2D9Z$nbVbsGbjBAWvi#H|ne^FBlv3;(wDwZTEQ=?(eCS8ZCy8TV zRWsaUvI=7F97cruJdmLLQ|~X~TAX6ROKja!90&OdmvYJ+QQxwa;aN`;{)CzoYnq>_ zEXz}DBg*lUd|lkPpDoQ}#T#Z3)9C664Jn{LWoZhpLjGS$ zPvG$H{p+G?_(1biIqf)&igC?7$^;2me?2DHLPTqv_VAHI73gVE#$4t1@fkR6;1USX z?!ulz-{3@SPUy-`ZTPYqCUmpz9xzT3^MNX}s&VOv`Jl;Kiw9V6-aF*dBOSmt%$#4j zwCsTjQX8qxsO<9(2|Snpu1_Q5fdfU$*xe=U5QbN2kb`FJqwckf;pS~$SMCOO_%*q@o2F@F#K%oM1O4|_}lZgM!$gwi?M26LZB?Mg}zOo%Am;;Q%9X)+k9X*xLTzjS-s7rv1=sEZsFK)sZ3XO@n``iQu+z-E!MQ!A3|?Cy(Ukk%~XnA(=^hQOs^fn5jFi z5Q%K#4L#GZI7KV#Fa+57%`4<+?giv61h-53(l|S{fQH=$Q2jzC-KcKbzpIzu9zIbO zb@Ne!;|eM+-Tt)sh1*=0?da+=@6st{_$YVRS`S$gG4t^}>^2NNk>BaGSc%*IP{bnc z-8vEKeu6}@LHX*yLV9UTkDIxwVR#|PVx$#EkTR%8!L$)82Uh}oo@#}ee5jzJYjLle zfap*Rvpia+PFjR)aR%ZE7(p4fMk^hZ#g!t*=ti^_vo)yI-)`0|B?C(8+VJat6iZ-e z!K4|P;rDxF!{d51M781A^1Gm0j?kjVpB+ea_MXC9EN;rfx|USpL)X{D<-t(p#-)7g zzBi{`{g4$n(lfpMBWKYjkPP1Q6VjVG%bfX9p-@3EmziKpPu6{rB39rA^~Ks0lt#ke zdc>_{><-1O$yxH%(Lg9U3qL(mQhM;TpN>R|v88=8MqF?UOI~MdPcCR{_lAVcSn?t` zxr~#_P_1d=V$2x27~lsT*3zyWPddF~U-b6q=UDTrBAQBw*6a@elzir z@{b~I%jv8&+~x5qpJW;XeYuH-Y%Xbsm8_?NkC0+FxGHJOFT-Qevah~B`+}ekCydSd zTG(&-L4HEmI@4oF9UEq8ks##h0dtxU7%8GbQu5Q&GP8iop|MvsUL9bO{9Nead3!eV z@l!`&L%jEOa&;iSS6@hR#&~-e;*FE0{ETv1^oDcG2r!qxdS^}O3FU?l(K8fF?Imbw zF5R_L1D!H*;zg4X>gz&>5dD+PiVTipY*0wYp9{00uGs1-1reoJ3?1kfwGfAqYD?Eu zv{rR7rGMIwpD@jw*S|IcR$H0}&RuVzz()fLG*dld=pFa4-R8;-?TM(z8HtTl zyt5@tqICPB0$1kze?F=Twl?!lVjS+hPZV$KElK?zz!j)OGY(jV5s0E_=7+Nxkzr1O zrEYjR$-6ONFM=X=Adb2tB#GCa5&r~3i{TZV!AS3u@Jvp}lf zG?0;jBb|bizT-bwAu%gG6C*kmGebwyZ#sy9PSnWE#MF_1g@sPQ#?r=K!B)?}h)&SR z+04L5#9q&hj^E7DLDtA#z{bkf#@fi*5t{A0)xgHkNLJ6@%HdnX=|6WMVEf-AIS>H; zao}WS{eAR3k*vLup_zfBjXePaH}`)}LP4{BH~&-A?iBF1=q2or+$XvVhhqZZR^i&F z|BnxzHjn58U-!SdP)z@qE)%nM{9YN|_c9HPY#p8SEdS|RXwV7hS;~v>f3H-<)XdRH z*2c`*QG=G9nVyM-06+ksrDtQOXVIb)(X+DB(_o-wfc`E7-$jc~O3%^W%vFPy3BbU} zPC&~5U|?Y)prr?}Gcpp;GBUF=vk}m;0+<1;1hfDEJK(zufQ_E%yON%j;UC|==U`^k z;^x+(Q;^bguz+S@`G;}k>HdS=`}ghoFAVfQTkzY&|8Xxk5HS8X76g1pR{!@VBmgil zvHrh%*Sw%?HJ03Hfi=&8YLN%Vytc%`7P{2x49Bai*y$vOt#;3|mW;EeEQ-D8?p}Xi zI4~qgucbBIWiH!UlGpB$G#OGRlWH_k%fUQ(k@x;D#?G-hmo|#hvF)7Lwr$(C`Nk)< z?VQ-QZQHi<#5N}LX=bXXrl$WucU5=awfEZB+6(QKy@`mRn9*Io4g*H*z`~W9C zKM!`x`TOB#_vPzHt52#}85HzOzSP;x4WZYWGb>u5M&Jt89w~0LlA5Nmu@PRJB_4wmbsYT{SgX!-dgINVO$#6Xc=t?~BrTXPgBS1Smcfe~`7J=(ab4hShfnXg z;5e>Gme%%av1;6T(W`_-J;l|L96AStB_b&aZM@jUWasZs%{~hC_yHp5?=)_wU>T z1NIgcl$oXMl8($ButWD@-(ZRdOqtC94UxYnI*b@x>_CR&qF%5|q!^fNm}Gd$!$Y9@jgPNA>;bNldP8y;BFW( z@;IZlS>Q6#>uT^lROSJ9Kg#_kE{G3EJ7@OX)mB`6@v-W21YuTE6zm*L;^&VOc!(fX zaGoEgm{5(nhKwa^lMc^%)cd6&qT(B2{U(;&yfZbfHm8 zM9GCaLs#HB{HY2`nj{JC{4kO>xW91Ed>gAt8!47Vppm&(Xe8*KvkCzJw|RO=A~Hy~ zsuS2xNM`(b@oqG@C=n)MB$7L;qpWQ_!$gxjL7UB)Hw*I1w5lm}Ffp<(aC_b{R!c|-_!i=)19x_KaG&t6jo1DM z6f#mK()q!OP3zAq#>H`Y=YN8{_|EcN+B(`2p%Nn!BcK65@t}xmnM+#Q)x0b!efn(# z>S9X)o?G;3)AlcIe3%Tnmw+?+N=lYvP3sFAx^@h2!l!&W4ov44BZ-gD7LZ>nlb40p zX_2eb4hP~xKvx9oz7tV779&j*)9W~qHmQ^hQ=9+nYlK305T z>i|H1KG7ce62C)ZV>QbjBG}0(jZMXoljnmTwB#Cj6Ivj4CpY(IO)K!<{&_>D#__DQ zG@W<@MP=PAJH|c%OHd?NcWzy0Q%fj1x6W<(Qdm1I{6B79T@JM2T6U=zFQ9*t#+L|2 z#L9B>sx5byhL+B5$C^)U>QG&E;HniVMJby9z~{wD^6(pwVhpNin*Bj!U=RT#hUtHg z51O~6J$Ulq)4ynA!;cZ-8ZA(IR3uO8$822^x!oT(^`789tlRv3G=xV)W2_@54@bwl z9X_v&j6ZVb&c6CR+SSB0a^EsSHaxh`A%+gNE=$Js(F(GA3KkZpw|jHKgh+4@uOLEF zTJ@sDVzoEqT7z_gAYhso%_{)`z>+ZkYVv-Gyo!ddu7ZNDu8xig+i|0RIEA2?0nMGA zo$%y`OG~O68XSKP9XPx74J;j{EasqtiQCu~=-rpdgY31m){}C-RE3m)=TM|>vbj>i zb(4WB_GqaN{nX;QWI5gBWOVlZ{)IqlxP{DPyNGO43-rilc zwTPY$#>U2OZWuoL`uZcA`)*i7+4_G!>m~mD!68+qT7q`)iuwfQLJK_=_&FRkO`Z`>HdRXdo z5u-u(J}xt$r(uvN4cQR{K37fc(}tw!e=OIAL4=Nkjvg^<>HG5kxjps!J`F=82(9%t zWdNd>PNV00*>dLV?&h!4Cj@HczuV2Bq^4>(I;j)wB?3q%?X=j~NmijP$evu&W`f{s znxE=>?we6|YO;z)5*EGo1M?hd(o*32eI|_Jv;2uk<}cqUKqykLG-?oSC@L?9-s@ME zebwmw9PY&2>D*ZWIq%PQH#2uSImXm~_WEjuZx$OCqq;s>q)rpm=50grzS)MwFNIW$ z!#rlD8Zm#l=4)Fhi)C^@eA?yvNXjLgo6qij%k1?y7=nI85C$$0OslM@==sXNY1_Kq z-#2oH>v)-Y`@46i+>X}%71oOT?|r3w_r>+OUu7RD_iO8P4;%9NMx#R2pGLX?nq5gY z3ddSO7p)j6K8(N{Y5w&(1eT7Dj-l%|aNFFb#~b{LixkD|qH&#+%JnB4!agoPJ0}AG zxQ4JH#vxg^6^D4OE$QeeDJiLGX{oQTCloLsPus0YmYE=Thx;clj!U(hVIo?biH~s=j(CZN#9usuAwl!Cig*GaY6F>aE2L*Va zF#UjC!O80RBYvPpO|iTsn<$YWRimBAByg zPAmA`ML{Cq`cqjlK}76(-E_Y+p633{{=C-$(y?D5d4Y0KVZ!#q@$m3O21Q^(aBK3^ zZO(v*kU{5jdHm>+G{Z$x_seg+n$_Wx+fQLY(hH5+6w&&469nBQFawr>zF`9lCzn&B zZuG$p7lzR1oiEqwXZ^k(MhQGb3+MOP5vo&tz0H88L}7wdLGFGR&S+QXDGvR0hc-c* znVmfZEyePT|sDrY8Wcb@q~GOxgA6dSY70Tx}qVZ$I!XU%KASFCIIvh7^ zvU&0aa@-G~kJcE$JK~PsmdaIXd+$cpTX!MiA3J~{UR&R26XO5rml?A%S`UIm z1bLZj=%h$PB*J@aar|(LhMz;hCZt21mYYR*Mod;qu1E1XeE7f}GZkdQLe-^0fdPgq zE-ps@otkQDY4Ts2yPLQ>iEJkAGKO| zyaPPUILA?@S}un%NiI8L>fn#7-)iAV6z-r(m7=D$%*dojy$!C7etB_mb$TBx(BRX7C#BBXJ%#=POye;;&-*tEJNV!kN8i_LE>;a zEtA0a)yOUtVP?qUU#Q(CeCh1e^mPAh7k=&Rg$gA)b+xC8HR+Vyus|H$Prd-Ei3t`< zU$-LR9L}TPN2{OL;~LZLZg;|DHZFL*vbOSl%zxgXsey?%7Z;#qv2bykPP8GzAUA|fJ^4TA4Cdfq=v<4JLRj)5h@$H&JIg+ff?PWS!-KpnuV@meF2 zE~qZwSGE(!OkE*@hUV6uF7C+?LPkpa^@S1yyq+%Aeh&PP9nGdLr<=D{XNd8D`cVQK zYujLZi(x&e@}aRg2dBcwl&WG-eA+2U;{?jG{H7{6lSbbaSP?N*Pzy1Os_yHh+D9Cs zZr2W5sB!-|2kf(Zj8^%Qa2SLz;WIlWqXb=Y6V0D+qG3EdzQ4~`zvSTk!2wG1h!Yl5 zgDi$>6*sXia60V0{uz;X+u}aw+ev0TFb#{HXabNYvlX73qZRUv#pM`gf@nxp>(SQDn@*8G)^4vmZW{uG2|W(S-5+_ zQ!$mx$-5-;ScH&kL9<1TnT5B#;Bsp@Shr zWe&_*Ldyap<`60IY@_)8e#I$kw0x;w|7{m<<~9OiP%|5#mgq(JgTV>SkD{pj+&&a35qN1XbQiSLq`=f`qJm6h^FEUTndY1*BmJta}FD<$s0g-bvAXHYavl$1M(FvwO|({C)! z)h1`fi%={c}t9Fl$6 zfgw`$|Lf`T+NGCEO=UpZ(y>aXbv$%BLposbu}!~jIg~3EUV$xNM$7gZ<)U>{PXr;= z8gDy6T}vqi5i>W>*rwcH=$RA4w?yaNi&7AXQ7TnK`sYbk3#@n6fUccD!scENHB@LQ z#?emn2i$011iUKE_TXS|6G<-e7~GP60?!iO-?18|Ux0WzJtxDdeTz_uI<2gv@G^*F zVAspjvxS2lg!j~z{V1?4Y3iz8CeP7=6(gz+mzSMgUt2rUGLJrRHbCVdqAi^^RG#$o z>l=P%wa#V=DP%~D(D7_&^c|5@<_{Q%^tq*eN3Tmcs4#)leYPc3MN&poZ-?$lYEfkC zJ9joJcnXCEEdLy;WL?5F$Umk9EF)~5FB$me1LAqhc&K@?b7B`@&`!bNO#1UZ?ed5q zaX{h`T}B}hm!<<19;zi|`jPJRo}-ZRql;^6OH;u1K5iYJX>xzw=uK4rFmxsQ2*}gt z=Wwounwp!7+tbSnsH>q_iZnEN;C)y*u6*hCb)ThP_kt}``o!b}Kool3?2nwjkdTd+ z7p`15MM#BE>*xF9wKJny!S^t8w`kaALw@LJXb5a8db5H)`eTFMl2H%9W3l64YlBAv)#8*gQ@js01BGe2Y>i+i?$Eh_zOX!di5T z`gXf@X-kPKzGk%d_j;?@YZjlB#DUylNZ{w8*YF<^G?DNwuZNShH4H5%CKWaHPO}Zi zP?d6VA_dBC8%@u^Fe)L`)ZnDnQlR9{o1hp>OK>010aYYI+L9%^eb|ERb_@nNp!MHG zYTS6h8kW32E?mq?4PD=&lv@)n0Q%INDd1%M*pvyNeJMpF0VMKQVfOKn^&j#+sfKxC zbuEW(d>8au?Fx|H@)^Pwnq;UF0~I|v?0;AgQ_9NP)W}i&Lbo}N7e_J-y;B%N(Lf;q z-vKtOHG18iDF@u9a&mI6CMu{KqQz6UP+Bc0#(H32$>md|EcTgA1X1lC)}g#{+0!w# z)v}GO-XxxT-~PZ`RC^ETFl11HCl^&z#o_GS3$L87Y-gz9(%|sA0R_m>1&e@N9(+*& zUOfpSV{j=#=KW!-wl@!~>h5kI zek4KIVPm7e8nZx|>?m9eNoE&MY-(!OF{w2PB$Edc5>(FlF}FBd&WmvKC+$#~)4$=b zu}9h$TgqaR4T(6tgfRQK8&$ODf<=-Ohg2GD?3Esa;f#F@X-_`NaGGQq8Kb3dzE@R{ z1vr-DT4rCS#O?Ltga@DA{8EjLO7UtA6)JIj~J;V7c0`%#!HM`G3 z&ZuWWexIX1e5|a&jwutSZ{Tm#DIoNTZ+bk(n)lWFw*oUX2}@#m&F zA+r+a9{>fv_m}^=UEABSQ#)^WyfkX{NB~T6u%<-X79Q9bBANXFg|B0Sh70cqz^y{* zE-$<#80jHZ>K1OdQmrZ#O8roYY$78EW`&9=A5q$dsI8dEt-}uV%SjK)Ls>|hW4G!e&|RYzNp)i?s{veCz)P&Z$89?w-LfSA+=9SVy-DHNU& zalH>K0!saYJzSEzJGee8J^Shc0NewNrMAS2TH5HSO|B-K?frD)(ZLt0dRAas+AAXOLo$R6H5HiTakDKc*Mo&`nKNzmb0xl?m{*i){yaSlq@w_(h@%b z7}pTYBh>+jbzWuX$3zN^cSE^a-m+zR)Eu|6sp~?Rca`SU?LYYI`Vvy8W$3hJvkP(x z@_yt+md2~AYAm7v!Em%o@rdY2v1?R|^`uLBo$L{vNgn^%?*QO%pw8{sRO4V)ZFnSo zN|XjVgScBN`mm{@vuTLmbK+Q6TQ?8@0RfSW^-bH5uS7}i$lbKlyWaO{y;o+gp9#W|DzGofW#ms5Q*Zdn)5m3#Z z++S}+Awh~^-O%86wGA2u&Pq>D*ZuYE5kn5^@HKQ8x416Bj6X}{ya7q%^0m>t>i5E9I>5rhVkzh$=HX%1K9g72VTJla zynRkAoTEsbI0ydWa_UHmf|vVGaK)Yx3t;#5_9hXFi;a)Z?{QCx1 zv%O=pU=Z1?q$I??U`mkzsDsh6E}v`OTvM9fU_t0GN&A@Snxd*DQ+5@od}7QdZfAoojPgNz}X|dx8=F&po;0PlEcJI2Mp!t9X3iI8EF?vBEyY7*a? zMGIPLW-gw~mj~^ttA9nQS6R{~3i+(E@@nv*0hja(QP!s!#?El`ayc)Z&Gz5W`9aZw z`!}{HHh7+v1*3UuxiP)=2p;DQP|S60%ZT|9O4;GU@rMch@RjK}3R1aL4SB_}5b_4U)xz&t`z zwEOAlCXX7nWL#NUeOQ>((o}=8%u3GzoLNfTGY{OuVlnFE+Ko3}ZuZV5+hD+mT{0&h zNsw!L124{L{>ONp@W-X)?*J{<<$62Ut)!lvoSvSKlos|QRoo0ly$Z2u2Q@B4XFqJ%%O1n zO1iwX2yCrvb|xpY5xAZt!HhixJ$?EFPfkwkQtZDGg{_ELq00l2f;&!G=m3zq^785c zmi;u=Xa+iZ&nPa^8+-9A7FIkvh&@vq)DZ#Rp8x}S&1x6K>UmDH z@o}X})p$bP=RM-Sj>Ri+doDh?~1Sl6a)%w~)8Jw5%@N2-%68c_)oGu4`a< zXU?sLNM;Vo(c{o8NKQJsgyQ%;fzCzffCgq~8S}WqeKY3V5P#9O0iN+UWw`YtU|=v` zAxRli6t^6Yi&h^{`1pHmC%WZkHs4x5H&2YQ-R*67H?VIR4FFJe0ABC+Q*WSSzNlSG zJL9^s2n-Kfv#W7EC7qd|CeZAx&$aV!>OCa?;kP9#F&fl9#+;>RArl|C!pU=i(%eJa zGR#@vA`*7(D)tnV;y3v<1Z1L+)+93vY-H2~%>;eVOMt7lv84mlJ*uC2=Bp5E=>)y&Wj z6-@#HMF_PmwIw{#&E1&Wqr=gIdRlsZ=VZ4eolI-aw#+S;#`eA9GzmlD=P?j6_6WLQ z4TgpeNC|(>0w6^zb^7gJfoZ4(oVMYw&a+dG<_zMGMSiz8Kh7n3sHY+b#u}|F z@kG1E7aIC0Kd#Gck+2T#(Z`_F8H;9eNx>v zRw03qXr#OpY0{NMm8&{&$`Y@>B(_FHoiAOC5i#ul*Bv5Wt(pjXwNaYY9lz@Tkw*kO&JbOAsqzae0co4hJ_Q+_b*NXdv6rPF=i zhkJWte*JCvSAR&i@Kw~&iDGqae3nu~^!NL`4HNLb8^&C>^Bb!G^GqVDB}DXO%vswg zj9Sxo5EWL^7pfVzB~G51ftgRCi>i|q zn;CAI)j5r{BKzs~N}9zhY;5InQj@2uFKHR z)ht+1a+c=jfyuzFs?{s=(XX43E=czA5G)$kXR`RWy^p003<&%qWq~5b`CBqJ&S~}7 zQFx2C4owd6OT#8U6ncjDe06b29k&4GR%88_RkjDj+u7Si8`I#ii80)yW~+skNsbII#Ch8%Hr1q;G6&ta0|+)WN}Fcc)uSY}hoc-K+Vry--qmG)w#fAlfS`=-Peh4w?r&<1 zPxn~<@MQ_cNh(sQk#yuSeVVJcaG~1jf3*^VIC3K$p&esRrrs{NuK|yEFS7FTi75p1 z8m?w)j*d)J|IVK-9RUL=#qU*nd0{O5G(nea96UU%yumgO4&gN!$S@(lR0+RMYjsUg z(~=?cP=QkGB%fI`0wVn4z%hmroY%AOL5shHO7vq-N;4NVPkmqEX@p&!5ugIISu;`Z zd9=p$c$-qCdc4L;<{EUr=6z@DjvVag+C@pEI{5u}m z_DGLTomgge7G>Mc5_EmNzGsm*7 zQd~@SCJH3pqQBeb-1*B^_yQ{_>#8s9ZtgB_Z>}z1yu1M_3TQNH4-lVPaHH03TLjM% z51Ftbx&x1bo&Em_a}a#WrP^2|reLS2rTi9YPn)eo^N|ge=n`R}v$=d6Y+P(NFT0tz zJ)KUH;w7ru%E|@v)=e9<0YK-Rk+HL~3UM)UlV;3a+S=+H+skY`GO@0L1{IZ+t{t>> zjEZyC*+nU>F|448yOyjcM@MK!r-Po83Adl#dEMDnNO_&Cd$pS_Y?iFrhF5)keV3QC ze7`S_X$DULqOT9B!?8o(@9Hm9^Fg9rl9F?>!czesRaWmKJS?gj6P4Mnx_vibf_v5Nj;0-V}1sD3@ zwflju{3Xi!{o?oYqN1|+;+=z~Ga!HGz7>Y=dA1*h&+T%C^lsm}sY=}}OWo~$ckuK6 z{bF~ST1Q*`th4)xp^HlS{gC^0Ih>}Sk(1tjdIiWlA-0KuDm$~j8B(NDqbdH|6Q4Ui zMngkGWG4icgu1ex&Xq^<0gp~2*zMa3U7a@vJCl%^tD&l@sjOtpnh}2%xUnxexgS2c zk41nD={yfErz62+Wvx-Jnm3%Y)AM)NqqM2%xA<)Bs5s9*9QFG=B-pfT33+?V$k0xj z51-%Y_4E7fcRzhxOievKGg41E@&eUkX&N+Xjq~GakrI52KvH-&*Nn){L>wlz26)wka-*blsB43FA{o&VUf0 zR~}>;KNZ1y@{vpM#Nl%}?ezutd_1$+ZeqZMT)9bT{C&yU?)+^OkcYzE;gtOh3@kKO zUx$Y56!KmQv{D3P{xP0rnY$g%O$}6lb)U4 z{U1?czd5U}d}!ddJ*7n}&%op^xAVy9i;#IX?;8Z~32g2Uud1o95O9-{pP!$Om)A&G zj-<0jimvsh1C)D#YPleXd+_%D>l-XX*L|e{Nby>V#KdT>cOo(r$OG`Rm%PjGS+MU= z*4la#Hz2m6J^{cMVc`4uwIC?#E9om~sVVDEU6+%>GKdN%kgXasVn@kH7erVF`W7#r z>q2&}2GAVAV)Kj0JDIz?_+V}uA31u3LWDthetdYo$BWNzx9ChW*wh+2AYc7lTJWnV zsoN7>n39dncX)c{W$Y6Z=yrGm7K*pMp69mde}^qw=`0rX20dLu6eatZG2#Y3$IDa~ zN59ON+trTG?Ogt`%PE&`d?-Pa4U`~LCqFQ?P7!M*krHz~FN z;Nfba2C5rzWKq9ii{l7m%6RzqPCxoB223CA@zumb+`! zs-RVx#~a_pi8r%pzqWfW(}zizp8Ky(zr%aIPhXKVCMHHNJ9}RdN`GNzM_)xJDhB}` zLEp+=+!`Wl*S$t&)*g5gEU5oF2mjLukzlTzEn~a$<@1E2mn~h^_325ud`Wa=8#>|Q z_~@jA4?k>iTyNXpOX7%_m5J!%@#}#RsjZL6rnb6vdVG356J9$f)EAQML(g1xBm=wb z_nXq{1+^tIdlY3AmnUpkzs$D7E5bN^S!C(qa7te4?hIE%QW#25$l-RKFlJsCeL(yNEmM4cMGkV1KW6YlSkyL<5znktOcf}e&dfC&Q3e1oc)H=OuUF0i7H^&d43 zleWj(Tgb4OB+~)y`n)pwTSLdOSwqdr@#AY3(X(!RjDf!yX-CTP@-G7E!oI}KB}Ijm zDvGbDs|v;du>G%h%X|IU3A8s3&uh$*H8nMb&DN&P>G+%gbH3^cT{|-54axLKhT8+~ zBZW2nS9JU)N*NCp)=ty?3gz0ujSJccf`zSP6STB)q{1(R3?1bt`(P)9TI*Ke{oU|O zHX3-AJb8>&AyxSlqe1~07JBAp#+aZRDl1G+1_|rHLFNF+AVgXhG{{x@J>;stR$6=E zO(MsDnFn4NbQ!VWP4zlO?@u!S>+!kHn!O-DNOM+b(g~ zum+?ge7=Z{T+xLD{CKJJJ(0SHlf*CRbcO|`-;orJ+n(I9@8DOLPW_x|u*O2LorhDc zp4p#+&C1CLBoql;C?PU@z_bNA4>T>`tMa#zK6o7L15c~{?ad#O)t|n@(#|d<0RwZ) zTm5G*Z`nGeao}%$p^&q5L$iwe?%2Qf)0=`q*Y_r6A{N-m$-T=s1VV(rBys|Rnl zkI!a{-C$psh>U#NMa=3hB_%DXFI8G=OEb87Ync#S_w$BLA8+q&uH;T!NTn#6$TwlA zW!opT{v%cijzM2f#l)&HXBwYmIR0~5j^yT0RI6t(#mHUqW4h;~ZlI2~u*G@n2B&BD zcYYYYvD@Vu@PBeQLqDip_UT%>x#UFwZWj&JI(59=o^PpC;mxgf&HhpK&}huGB|SYm zrw`Sx%L=+jsF?X@#q*ZG@ZG=v2_#V`s*mt%VZVE2{6MOmbNKz=tRtNN z%R2J^h=XKg`9DIltF^}MNjQ+YPifvEhl~HYIX;-?7PgIZ?D#0?F8^C0Qf zbUVz(oeakk*S3eX4Y~_TR-wrw{1|^J2Ap8TMF2Qv&;CX2@<-h4Vp{D3m@*i)p{ITc z-juKmM*xc9@}u|np_KHTSG)pBk;08~KmN%ho7?18Uj?S?exUbwQq4 zZ;*?#?)Y?IYRFKh z$8mCU!nr0|>EE>6U3F@y*N3;&@iRifKaaLL5eKXw;y7GEwFz@}*-9D#*3u7KotppdXBBT z=X)9VxlaAjVvUVBb?Je1isa!damk#eT7}rIU7edLtO<2VIZbRFIZcGgttz7pqwWuu zsIZFP53`P06&8!=6jzd2`MJ-E@)ZBn~?!=0pJ zFLhF)2)?vgLYnXoTD^=5DVko(uA^}Xn-6jlh3x*j-qKx6<&SjFDBEyzlZHc7+e2Ed zJ&Z9s^|E}QOBQs>(t4^+N0!>aOhy6?b-wGms2OS$#ykN!n@Ae}eT{8GrENm)bZSu; zckw;KmH`MKzrCsU4T)rFYLSh)VoOz(y;yx(lNGi#UXXt@wER;B|vJcN_SUK z(Pidou1&G?%fly25Hr=#k4u67&_9-s}Tfb z{nzENDTgO*zulBFa>k#jDgwfiB`oB;yiDg-*^*}o04wFT~n|l{y&V`uFH+-kq zgg!ltVSd3hz4ALo7AiBv=@LP82g-B0 zLmFE4+fK?ov;BvaN`diQ`3m{eB#f#qz9~xh=zHwiao~Yl7Ye53%uCWb*B{*k*&voE zSIu+`P<$p*Y%=`GMy2}ehmc9s3ULf1Pyut)iD*wOF?QS^>rE`8$1)nHg6Yu2h8L2p z;}&dts|ZXw(k=tSadXy8dYiFm5Pg`~3W*Q|Kax8m^fg~4msUFfou9ztqBM=`M` zdo3RPn(tUBZ?4m_*f@R7Jss&&@-5vd7>3xE-*l@Of=>-CBRi2;T$>Kh2~20{DNL$C z$Idb}I)0+xy5b8NI_Ce3za%Bk_EpqnFWNw+rCVCB{~8TzpJZ>&F38&Xc12=)y33T?g{dp+^PJPeYq(UE&As zX__nEpXge&ksfRh-cYBQ*_QE~EG~`AJ=0Mdmt4&_g9psvwtqqA~B$0x8EqO->TYmrj~!5Qdq#)A>DcG?=e(a;S*fmjEli5>fm zt<-S@*SEaUh$JYFWXY!8PE*QASbNDYVH)E&MZtcE6!|N~v}rr2HhWd!#LT^3wv7A{ z0OzPR)BVAY=vxdRq6z$N7naJ2wwCwh#mpXsQ?;W{O}PS{e?h<^g0kWQ>JiwK#lWQ* zvt7}H2o!Ba%|Q>YCcJgHQ=^kJ?wo#OVBpjDVWLXTRYIG9gNg#u4*saDwYE@l%|k{# z>9)b4RwUqQ#+6*)MNKT-XB1El1Ez4<*3PS{o7k}v7R&*%HVdHN=rFQh%6?97yvG{U z`(YA=9b%))p0qn)md00ZYr9vHTQVqKipgG#^;n!s6}FIEy0^NA#W zz7A_<*d&?ioS3X`A)dzwq^Q)}T7(pk?e-^N2vgJL2{Oy`-$3JR>TIkRTUs53`;;y8 zA8m~}IyE#feyeT6ewQBee=dSOr@FvR0?kv2G9?eS3Xmgy4=$PRsBg-OjcMZs*LcYR z4S)*o7Li9?g__D-tYSpJy_7bN-|56vTjHi^q%%lqi1gfxDkNydA6c8H6> zxx1+$Xy_LW`{kKmHc%k^-$AGd9~^Bjib0_{7j;Xyj6rNg9PJ@;6PvO-v~Av?Hq47i zwNPTL2kSoy#A2P~dWJ#~8=M$J>t(8I{s|_Gl%c(AT=K?J1DyS`)l#!VhB2Nnpy=)P zYBKGPJ02&GpYK7xTB|RP|4Y@t@&A|l$H~n2zx!XewRz%5+L33zep73fMqfaY(6Dat z_AW2S;UE{vTq79TWIkV}&G|G<8!f~;aj>Jbq_$1#HD_xhdA}SNDAc|IDy*eg_lfs_ zub2D1wELIM>xbI^N^^amDXLSe8u+{U6fCYVD-WbH#UPzMy*@7rl3O&Y>7^@G1ybfU zt}brwzXE1e-zGJBeSA^{TKNVv?mXF7Y=d)F8*74EDO$W6LsZR`U2}Q>%uaNEH-RhF zi5A?6;`zC)VKPc5xmnXu z>NS!WLnZ2j8l{}3^1Cq3t$$y;F1YXh`!DQI!K{FM)bx1n_vD|*DC%B6fp#Q}T-xvN zSwL>7!Ha5YpWn}G@yFY#xDLZkXG|NtPPo{Og`Vu_rtr@By)uvQ0z(}KVTs`)O5#8Y<~STJga_ zV&$9`^{XlUGc}$MwMjNjEalck)`GDsF+ftslih0>v1#{IjpC81?$oBsfBzhgq2|fN zxi(9vFFlKSpj2Op)5{nzz)mZB$H|%1On;dvd5IYbF@ykPQp!9~9$AW`h`UfZ*GQ8VOoarQ15 z^G3EAI_c85ntYHw&OeBIJ(CRW#^exliN(o8sV6c<0IelAWo@0*0InIUiYcl-!N+nS zj$wbOcSugH593IVZE}gL1o&lfDigX&Dnl9EfDObk^WY*0awD^jYeWH&-BN5Ye6Fiw}aAab5E*oqMeizr^KlSL?3hkAV`_$yRzMOhh;{wbrPCZcF<}C z_1OXsVA0lf)AG}jp}#X>;;A7UBqUs>!tvb8P#|2Bt^+`05Au0H z;J8c3EFP32`I%)*ft{Lc_Ui-i8e&g_lN9TOqNzIf}ri@LY5L#n+a#z#1oZid2HhL8)+lE82 zbG&u!Mj&NnNCjR64aGq<(2zK3#J*uTQJW?`-;hWv*8^P<6xcZn_NZ27Hw_g z9*}JP3h??T{WI(S{YZbYE**n#iVJ=8lkpGJN6qkK5nY{SfamFD2*z%Edie?(Gy4G7)?zg+GcGbnktHOs)*qw@@kT)mVEf|01^_uAI zk1Bn%p1_Q1H&;YWGz{PzeM-@gIxeagDlcdx6HnZ&TnN1wpYQ6GP5+txVVJf~K6DQG zj9RNZS2G;6)|x$Co|bzLIw^_qfKKns)U!z9ZmJ{OWFzMR_;lj{RP_rY3yjl>ry`AA z0#I^bC9vk#$%Y6Zk@b+kwZEEaZXKd22i58Mp@~>aI+N9M3E}oH(aTds_MB{{pUXp@ zk&4Kd{@huTt+SXtl3KG7DpKr#ox5`W+2C5X0*WXmnb*n0wCE`>!-h|DdnzKX=eA10 zVMEtj)kF29ZUi~Ft`^Jvt5?%(geYCT)WjSB<7uM<6PU#yT5EOGR5Ve7)$BD5VKrH)%HdE9_&6x0B3T;7HkE3ya8U$j}@RK+KXzum_76(x6w*;vJFn0?3n#l zgh6Fns(}@z&ShSKd+~{KI9csk$RD$aWjFt<3oXhHn19X*Q;cr0xZ>Zhayf~d!&zwc z-|^9wTBRJ;%N(k1_e=t}URA7==XX)!BFAx14vq#ACCN5~|04FD+aR;Z4vR(2@|06U zJ2bBTAu=jrUTEGrYl5GxY%vg-j9J%k!A)~u>6pIhSYkDax_|Xu%_lFABLBD2+k=!1 zq=k23KF;IIZzG<@d;L;BpkHA_&9OMGamxaua1+b{Ku8iJMK&;d0+Lq}6q7gMy=E?0 zt+pe*O>l>$bwZ|)jfPpkJFrkS06+MW$l22t3?Z8qx&_ncRyxbHo67XfJM$b&8lTux z9IPjYv(HAuqepdNl{Xwah_TJ$rMR#SN{;6Gmif2xU^E-!h$`0mKNvfw?o6O=%~ovN zso1t{+qUhbVmoIqoLg1YPhmHAX= zl;>Z#CvQ8iU4}e?r2A{aoo7s0zAxGU>SiT4;6S9Pm@k&+??E!ZrqrIMJfF=fU6(hb zR9fRy+C#((gWJ_QMh#XOg*8)p#S*6AP{=7uy=S}-#Oh!`(fHbGq#k}9Hc+qO7Ri7J zF{_eWCjFrz9el;HsLR6;GXOJmj0F0UqRNqH!p_OY=zHhg#|#B^^DEW(!`ifZ){C*- zy0^(^O7VP$2LJjXJe2Pj<0Y;Lvx$8q=khD+hJ#I_%p!}nnWwih-_~U5pL`p5vrV}a z_jrZrGbX(ftVhvX$KBj|Cc{@snf)1TSb`bPDxQr@jK*j*m9RgX?`H1nu<~{9&NFJn z8jJc!X?lx}mh=0^1JUxz*GzCN_~%DidwJ~~EPCRLohQ=vzDwL_+2esw<`=!y zaSw;JW}^N*+K~-3?W}tQ34#$t9VrCY<@=FrCi2ZkYgy}K{@?*i`g zuYYS+Xl>imd+x8Oa1D>^QgY{X;E7}CH0G6h=^V`QEo1Hc0H9AshxT#ve;%ED@RhdZ zVc0I5;a2MB)g*UCtc>R^cKiX^mC^M9MYq*fB{W*VzEKmxpih+u4N%E}Fb^kQeRVc%no0L59<&sB|IOQ#QhOW;ih@K+wJ$<*6;Sd! zfu)15-OMbw3-R!{b@0u(gem0DpYN|CRSki^6q=}+8VNc%1reMa;wLlepS}S+clNnq z*i^kg9JEv(&hPrm@!BGvpC6LiotU+MAO6Vw@O-@o=K!S`Tv6UP1@A@WL}`2}D?LJ+ zqAEaWs(2dU=FO6HR3~%v@?$E%UyAfhos{mZh zrpz0oX%ei|ly0kOM^$1k7kRcTajxcXrrrfUOru2b)rg8Lf@?PI&5NhC6e&{4uAQLC zl1#Y5TPaj+7ib(eufo$5D!#UROpzs+d_iubkeI#=F)W1=%+hl)Q$PJt{yeS4=O;gu zM@`&C$(V5{U(zJ7#vF;{=i|?e?W8ksOZ`Q<}0t%i>k`l+@dbJpHtW4?U|KlkpaW}y zAz3E*(Mey(a!DHG#F2FN>}ca+28=u84a|EU7)eH=5B7I8ei&n*ooTT*n0_@@P!TJt zzAXx??q|8)mTq~Q#!(}Z-u_A~5j^JTb8;U{dk8e_wK z{l}p)Riw}k&9m7~ZA((dp*OrPLkuqX*$URP%fWL9RHO)tPSs2nG zxYMu=p>XIDjA=?fw*BoAWkhs7w^>FG3{+jeV44ac^Yct*Yzl_Uozvv0PSLUO%UMs}oETSRm>y>=OFg`d zDL4lM@y^vRADeJJI+Y6ySk6Dg1Pb2?;4igCSo{x*=9(32+Xil)?~|_=BslC{m=M;wQ7FG*FtKIC){u(IY#u6Vgas$VxMaYTjl^zowYl4pCxQ(4HPMik+gUV7gUt^~rgA*>nh*r>6jPYGj<#`RaL05pze7jcKQHR!m7 zggtTPe-iwnBuUY5sCO(xqg(x#k_g6H2C2ZY*p2}+I5jJ3UJE;Ipxl{u=I6A;lWM{A zD4qiu{KFi0?FtVPW4MmeHkd1I)0K(fBNau+PPsVz1>%k13}|=yQKuFtLXM8GfPlfv zx@6)BChsOdY6g1iX3Ad&cpR6)xXSlETnuV_igNDjbX6G?QnLH#9GVT?6}sz*SuX6? z%ZLmS%EUf4%mxebrl4iRmAf-(=Oo+~YTw%wg@8s5Kee=ptK_D9t%gnV5?{$$-(I)z z3tdbV&TfT=idNM3dng^hrD`h5A|A*|xYXHCCKB_iW`r(Z44^KZu6bXO+B5Nn8I_m; zCB+`o@9U0QU3LIsR zd#LB7fjpli%igEZplP=YoTn>l(PN*2`6#H#$(zY6AB$+M#RyDu9>!T3URuSv5lDxs zt2WK$-T|x`?diT?NtxkiOyP{4xG3Q~w>(+(Fw!OvjkcMU+G`*Y9Z@T!=Pm^=fZJ3O zrfEWWsVhV&Ak0AgNh+&TQvS9K4KX28DtMiEJrP(B8DaIX%HQ=Vr6ZddEMJbj5Ib=& zA7hG}m3$f|`l;I!zn*piJud24IbnUPY>b62)vj&`=9II>4{NxYs>ASzpn_+u#58)( zCP6;`?t*Orc-SeQ68Jwlj7tU)Kb zVWswL-EQ`kOYSE2t*mgBa8-9DBXpb|9W;$MaZeE7>%Gg1=>0`1&wfvjvRu5O9Ofem z*N=kfnXEz(Ada-jE?=ou7A&oHV`pEX4zO0g+1oqqU}Y&qnM(iIFt~V);wR>Hg`UPJZkGCJ&MRjay_L;VgWXF2KdUJQRIN2 z@ukj#)V#*K?RA67GQyBcsEO9>DIV0Is(gfvBhH?vbH_+@q}l0s9d(-r8-~*VO>l8S zur{Dh`GjjCwMsuY*m0bj%^WS@7gKJw<^VoEhsj%axqmJm^Jb{g8U79V2zq7kzgtxi zmkv~9_C39-yY-9cbsgiYNbwe)3<`saL({U3+wfGoAy31m!rZ!ji;z3+=)yeCtZ(RU zGpXUM+ObepXx-eLjYmZ=nR+gFLE2xsN*wS1DqUwA1xMToTT?WZ9~L=jLM^q%Av?TO z2>jVUd5i{cH1@j9YaWbHphcZ}vEfjXa4^xHAI4{;ODeXF{k&J&Xb}M^>5G@n8H@WO6j8tEfPUwv&Sb+}f zWIlX8#pu29Zq*dq^RQ>eFq@LzuHp*XZR)-=O2c}u_!(g#qG_5`^K>}f1KJPbD z8-coW)tF3XY_N*2U9E1-e{)nx_e(*-N%=LqRDN72L`MyMuBHBEkSagTeFF~*;A7q@ z&Cmi;qNvSl(w(7N5~C&R@>+Ch)8pa|Mx~$yL^W$Ahf!{2AD=MmOny8V?&cu8*cZi; zf0SGMK`hZ-{>_TJecF3{#&w_?roHf*Ba^ABqL4@QbIXJnD9HLwnwg5)=C3U91!{8V zS84+)U0d<}q|vn6(9ML=dF5Wy{qUo+o8p^)>4fOWy?N2ZVJC$MmbJIk;lhn(m08v2 ztPToml{51j%@pk*SQ5B5))e&m1JU2&?nGBj;%$60#zKC?dxPkS9Yo)G^b}IW4OBa9 zTO|v*)qfZsQ3&*MHAGGC?B!P&c62{&Ql68{ev?ADz4sx83S+70CfZb+sTdF5fVv`c zOTUFw*#C0Awr#O0Oz73O6I7Y%Y=#-mN`Biw)0suK2^K5m?zEWZ9A6udHr|ZzmtyOs zj4}+2=_CDy#jReg_jBO%+7<1YPjEXbxAK~Av72elwwt^5{8~4)rOyAcl)cp8u9)i= z26N&@@Ak(@Q8-;z@18cn^zI$rpP%>C9}r;wpz8k=d)WUcy#r=OrvHneIjubz>s*es zb4vLMY}V!+PeV^+N@U6|byGmIb#-XN6s39m1frsdiW_VHldHC5wayn>P&TQKal0QE z#5ML<3NJ_y7-tj_R=c|x)LZiN$5!v>)A99K-CaRR1Z#Q!(2awNJQ^0FIOP8Q*70jp zQp$8jDyJw>+7qCa4WQ0l{GjGbI^)mL_4AhgVdEdD9e68?nF+Q#Eu;#1KuOw37okEf zXOh=d!EP`4p%=SQ8biU8Bc6|Y+gJb6suf^BVN8THH}XW_fD1pGe>|#WAbuie($fc- z%4Jri_=`3(p5 zd+~G^Va0nNJt+6b_w{4H72`204VjT{>`u7y-x5-?gx$>kw1rA&2BmMTW%v40X`+$iLloK6>()}v;v3s^qSB& zg3mQE1kgZ8jIkakYxfaD8oA6s)PHwBEn_?_AEwQ~G~Ld`_quuOW?EvB;Rs|@%%$}% z8MNaL-0uKjB?`1y?lPx8mGH5bNR`DRAPuD}4va}zmUbGnjN;hy50NYPR1-O}Y&d9fSReb3 zgodw@dM!AgQln*z6kFVJ{;7ZJwN4bpe~~B{-V4a5fd)la0VTCdJeGZwAkNKW7#cQU zp*y_uG1Uank1r&vE@V zNgo2sKpTM#5g&tbXL@DF!S9Z_3~oeIAwMA2 zCQqaYpaQEd$?VQsrZf^?25q$0A{NDzbfoO;XcGQSYYi=LNrrk#T6x?azqEz;3T#F{ zP?k4jExEHvxa6#UM||UE7T5O>PjE;GFX-d4%quaSqh;wY^hHBt*DgED*6(Y-8m|a!5Oqcit)<8wI9pIQdv*v5%mrHt0fFD ze=QCAtr6X{b0(Yr4H90bv<#E*5R^)kzJiVkes}MHRw|i)Lvnzgex(vk6i3(bfd@&h zV}x%v7aNQ|r;Ra1s`WBU@`BlomUC!gupo)-m5nRiUH*nuv(!f5jaRzD#7YI&l53_w zYO@k(cNestd@>T^r5%2hqIIz5(%;6#$m%l5RXzpTfd}?>N$<%e=c#Z~tASOh;pHp0 z7Lw~WBm=TZEf6&K_+x7fMfM1l->d5StPirqz?vT=LWFW@STmXzyeObq+DM!&L^vuz zSm6!1fb|Xg3^HoMW=#iw*_i(Rl{y`WRxOhE?k)_sytJ2^&CnSZFo7hoJG>8~f+3_? zQGGtypgP^)k6g@q8t6{wzlkDBfb`s^29xT-o8e~q^E#JeEk={N?`CUnAkks(QeENc z`{Az(D3+mP!IQW^+~@+8{+DKOQ#(iaR$I|d+b=@mg#8F*A=`Zu?HHU=@0US{**7^X zo(H@lBl52ofA~h)vg0^j(wSVfe@^j0Gd zhIf+_lr@AkOd?%Mk&#ubySK%%u7I=2_%R6##+?SC37f^`P{Z2u9FIHR4nb-3^D<56pysIf zq3-am#zx&QEvzW!Kf;mVtYPp%VH|;DAu~;}Vilf^5IqKb{=}IgznvF@yk+y2B*s~c z1)L8(Rk$gQZR;k$79$h3#|x{jpbZpv+XwoLm#!SOG>s2QH(?Bq3lXy{^sMF}-Nzgu~5b*G_#}vJEK->mJoZ)-=hO?jvenLXLRY3kM=IwBkB}~PZd+s=g$HldiHn={Eq9j2%sI&Mh?Zu z{B7?>QPw-0$csnK)m6c_`yb}L>&HwVd2Iv%4uKc_5J zlD*-WYejsfU93NF!}&Z9VuGx>9B>NV@$=UNf#v;FGWlg2qmgGe?Kx`|q%ZSf-;CN} zuMby>FS|{}Sl=Cz>6>bf%!D4&jH)-R_6zW*m*d-&i03?(S4BrAF>0ij*HMZkNQ>(E z4@(e-9dzu%_w{;E1`icbeqBK)EwV+5#lG)Q9MkpuG~v)BK8Gy7YZriBpEH%Y?9b5O$_-OLcE6glVH@4B+l%UoDAN*8xR?G!@Nd)l!4m*M= zYr4y?e4GrzInoa%zM;{;%=gMEpVIebfRrp1^q{HY)#l=CZtZYZbYA(`504|~6^CaK z*Wg8H*$dmSjToq7vuA#DfuKe1LQmh#%V@I+6P?(+YatNU%wYMW6tWqdlgoTE;o(xw z7J8+>93uud-+CM4mS#O#sMo{WeU9RTa@?6}xZY*PFtOf@B!fjLlP}q=sxm1`uCpD? zJe8o`4OpR_A=dh1X~f$~7ix;4eKmF!t54n5aIf^PpgZQDT4Z#q(;{xmj&6MIc6L~Tlap>fcIJj=7NBmc7c!IH;AKX~J)Z9K$4x!uSXcwX$ zH)mYx`s$S_|7(G&|J~9LgN1kXc{*^snY>f$a8cEekMQ-gQOA)iVo$L&5H546Oq1qQ z(oLXuZiD@){(E()8fP*Vr2HHfD8o047S6zxPm^YxDOb6x4DpFdSzo@FO5 zRt!ztrUL4d-`o8u7#-1P|L{aq_Sezp@kQM2-p&5g$Msh&L8`tVD+Xc`20k6Z<}tLH z(tw_T9K+<~=%IcTVxAo#I?zC|`|o{lGGF)~{=eyv^naM|c4@m@d_?ruH&v;yfNWc- zi-zwapnuALO<*Wk5^Vjh(iyyn>hB=G1%nSm+WUCDrT#;!4vHB-q4-PO;10eCE?{W+ zcwAjbY)oE=r&oK6UyMrd^`EGTPU{US7(Q9FAp)(xm^LFm$Xnq0JLD!ep6&bUFkblW zYj(1zi#hcN9e!Ohc=nIZBai$D<@;yuBtLyG?8pEVw6@EtcHyXOs8sCEc!$Y=d2 zySbZ@h6U{?)L&m^49Zs5ex4IVAxzt!3Z1C0m6Oj{(qo2~nVd zJyW;%gmtQ-9`VGRq=|*uK}s;Gq!Kc%?HjN-eL^dhAaFz;K@%ek9&sWWoPhu4UV*`v ziTTTlDzQZ|WS5O+V%T+wvO=eyV@gdhWMy@>-9SWx&DxHM}*ax;ySkeu!%(u!1*ns%L# z7hdFm8K=m~c_`fX>id2zOXTOVdHps{(O3k<8lzbS#h%X_U`qm}!oUrZ#FEnzF3-H56@fJqiEZ2`d}wBA*W2a%Sj* z5;cN2XE#x)JS0u{o-)EC8mowODZ%{&d*AA?#6?ix9MoBm_RIi zY46ZDGHkT-=#ZqDmg=LGT*K{A9Yz?DFR52vcXLRSI?{#MU*-Yx_=%f8evZHOrsbMP z`$e)I!8L9Jf^1-Jvkm9VAtKS7bV?HsU&3%2!Ts7oCe#5)F<-r9cnvLNV zddGPOYFaIXaBG)l%3f)%RQ3_mdd{aZiFWA`cCeD{)s6^5CwO0$4VhI62dC*-1^Pg; zIGP8=2H>o1t#6xXwlDUK*5VifNf=HArj<@Lu7IQHD>7n9JrS^~yguYemSjH%m$;lh z52F4Ut|NY78LuJbkd!1^1cL(ZMfs|hz+q;-ql-X<^?|3{ zKheM(cS!ITu#sg@SqE+BLqmo0u?`;djQD%5Vz^VZ^y0Bx+|Vw_na%2{RL=| zKLAEL)C+5o91RBn>w?sGG`7qDBxm7|va!p28YDcc*t$7(&}h$68j`c5uK>?tu1XR1 zSzMy+Il=$BlsBhidX#3;h^H0g%GNdA6bN=7VUB=rLGn5%Y>2FyJWQf zL(&1+qYYm^vv2;Sgi7QvGjR9!D`fp}Nna|so6 zNzqpJ?2V%OoT{U)`IrmX@`2o)3V-xL<5yz;(!ElDS;?S8c4FEIlk7%@mCA>eb*e27 zd_%lcV2pAlJ!2xhMaQqr`c@rjiD_mln&hkYB+z6V34Ia*^<$7{l)p-(x%OpcRo55T z;%-T=Z!ugxzt{pOOD+Z7W+%yv%#Q8#Z5sJ6G<;*hi`9L9^8rzorpGxh;b&iMXsXa0D0S1^xRUYmFBEZuYopt9u9e zUP-HsQ&w9f-R}nOGN;6cq5uxG{DWi4*GeI8+I8CqdYs0dm`-#aWYd2{Gab7v(mSmw zMN|$HnVVQDMZ>SElibR0Z+4c2<@Kt;p2WxRQVp$0W#}|ySSyDeS+NOr?X2deb%VHU z%>&Q=kp0%?e(D#H7U~Z~+7;wVmf{CJo%lVT*751)QXdF&a?Xp~3V{P!;2t`6s(2Dz zmWrTAN{HEk`DPRDVk_9mq>}l5RB<;h#fyI;@n(S-l%_Uxt@ScR%?FlnCrAC z#57W23d(ML`N%9AyA*GPjr6@BWgmJGizE4Lm;#SW57qv7NEqG2Qc74#$DMTvJMV`T zMIO{)jkjE^af_(vi=LxGsUP_Wl!iVC*tHd16uF31^q+7B2dg%TF02~0s+AI_lpYD! z218CUmn6*QDgJ?cTb2$EEHd$weXPWpl-R0^VGdr;MofO(Tc?(r0Y2_!zgj-M?G%4Q zVw#{CVcI*3u8|Rsp^cq~n!5U2JZmuqXhCOK{=f}AUhjS;`a=pFyUBHH`RV-q1-3DN zFVnUfPfeU!#(=Gm3+G7oSTo~fKUN$R^*NJYnYoRlAr!0?E#*DxB}?3cEESZ6#MjbZhc)Frk|k4igAA-;<;{y()HNcZ32ZUmktB=V#SteKjSM< zm_C9XruBg*F_$0S6cgD^)mjo~Km4UVQMh7ZkGO`%3imQjM676VTF*oJl3)NOLtcPh&}(QvJcr z_lRsf8mvDve|0RTjKZ?(U`K-n1Km%J&%STItU$=A%;x3I>jPumx`9{^9=Ft({d%8) zrA^WAsg~6o9GR^Q$;L0uS{FY3^}*YR3#;rE?m7jM-r^5;Tb7Vx&Y~zX#D@B4st*WK z;Wl$g9$k)`&%YEH*ffK1|0blaZ*T^kr1AzSaRjWs0IjYe1cx3%Penu}1keCoIco4% z#VCF{vr8`LdI6d#(=D6ezCQH}>%}2fc3ilZb)>xus4<-4T#fM49nLdEoZNKjbFc+s z!tmC*eS+HGOr^IM&9h0mR`6d_W1s{hMK1Yraq(IRT6+PE(332VI}sl;8IUh;Lq&Y} zWRqKNhN!hGPG{NHswO&u;u8pV;lA7JaaKf~UoG>K`*rgP7RzT59}*s&Sd_jBz=QR0 zdQXxa&bQuypk%E1j%mT7q8(5@&6?o+fc--=v(~QqTThpNwo`GwV)6^Eo;vRLs;Wd; z^H`n|rbXEIFRDJmc!Esp!Hen(W^M%u&Yb*3+rICE*0>K7rA!A^oakOv22R;=k}ZO} z<)F&e4 z-vdmy&SdOG8`8hR*e6K!ekPH@Bar}^fLqWb-Ppitig}Xe6jd)lPRmxt>eos4ta*3Um@D*n&Uj_>!=#r9O#J zB+Q=#t3)~79{isU=-*GJsOrCmv-m<1a~Dc3USEiJQSSb{HeKY-zV24F-m8B<2wOJG zJ$`=1Ti$w!kM_D`Q7x4(INy^Uj*))%7Pi}2zH=eu5YG^-WWL-tYZ(lc0L)%rR{80~!X%+lIALs1U}RG98PhpDqlUJxZ{LJV zAby^kJ%x@R{-v2g8~UGW@*{Gj+MhPeQ!?%gpRfO&X0ka>C6-VJvMBY|^Idnc1|VQE z<9O673272uHgHBnY<2j>|CaOxO$ruN;&8RLPXNZ9SQDXa6PLE<`g~A^sB$~lzB349 znpE~>axJ^X2sTP~Hc)vmL&#|LO?vP5d*rl2(TRMyZuR}1QW-Q02fWZXqQ4mEL_;4rXEc^&1Bk=au?zLhMAD( zF(vP2;eE-jfm!&&{&r{dj1Pvr_lCjX94PHyONPRI|A5}xcH!f3H8V#hqHZ3YgY7MOPh_hohBoX8p6bHdEfpk+9<7arI4m=N)R)AD}ZK}Q#$X<%B3 z=EbnFfi9@m=(ThV-cS&j5v^XT<5)me84YZ&#wb{5K{2A%dkW`01*8o3LZbSqJ=S zmp-8@x`eMXJby!&cV|WB}FZlSDOavrZfk#@on)=QI=s>O}!eWf`t- zA}4Rtr$$W$nZ%yipepmSkDu;=Pv3_b%dVc@qt|WnjxA+ro=EwRBvMIEIqkWv34YEv z*2fx|+Q1zVQmG5*J|GnT-I>$^-ZHu|KI-v-HuHyldbQm%7IFukFg!%yt?#OcNWHVw zVU#kR#9z;Wgg@~&M#7HdW8}S|Q!)av4zYmHCN%`lGc1?Yz7>j!(e*_%OyoHd9EX(D zAxW0oaakT_am_~JA59X)24QLaezk0maApNii#99Eqbi7s>qnF7KOoA874WYJwjC(O zh^VHomqppf9b3mUr$nr*I0D8&UDhP8J@2~*W`MQ&a|S=miExJUy&r;nnH>w`?dSsc zxP`->SuAQia7A((7*I7f#fi{g%BtzlL>5du78&i0q1-`PhX(HJgzOaIB3=6g9@lzK z;-sI|E%kquX9UM69U`RSCC00Rlgi5SiWC}}T7uc8c>#rl8C^{}7$;$gr_Pn>MeS-R zW!KapFON)_GR=ikzw6kQtdcItbI#Txdhd zwMR2}Yxtz3>!KJDdP=+39A8TRbv4+KjSCgb<=b1MXXhb$TEw1q-z2Tm~!mNbloiUZAPp(iL>63d9 z0iuL7yuCCJT3$9@YncjR+&-8zY37v#kER!RFIzm^ft0mFh z1U^b|O2%cT)Yl4Vr^?5sM1`nTq&->BUxtza7Bf4ZC#=;2$~0rkf4XpDD3SkAP9H)S z#~tHxWRr#USkXW&Utwu&Rv<~}3G!ibD3ee-*ENiFz1ImmH~avbr!35nJHZ zuA94HW#QGRZg2!=qA;1?7&>d7yJbo`qDbj2OAhk@pR5)jWH}NT5ax;IKTb}Exl5d-AXnCC#cT-R1_^%}-4iCXh)di@*)c++zE5MgYW?--02Lo(U<4-*K z{xL>o*#LLUCsCo+PE^%uBZ5ydWUw7qd~@nsIRP0^%%6!iEg9svT+E7h$A&#MW0o#a z9+;A3KyqEG=mryhxb2dD*pUC*rjzlVmOZQQ2SW>Z({IW4!J}ZAMSTB6pEWX4Q-ymgnw_O@!nTKJ2t5F9y^K2^@H4#W9v< z@WuM{c@jcGmSoJogmpO0S4&*ma0Nh|5AW1l`!Ro)_enTN-sSFnP@wd4{%Y$kvkvB# zBA7CA{@ZpNR5+=!33GX00d>v^H*Ep`#Uf7w85jG4JaDKH%;^5ijm{JUj--ZzD3uuf z;{QzBvfq)ubzKxsB4Y0HO4}-n(2HIQ;YOx~V!UIiOQV{s+#R)XnP(^)051}<1JbK#f=s=n_&m7&5nv6Sp_mpLx%X-=O|_;d2&Yd{wQ+7HQepR|<0V zE(TvUyzENNB|1yL4lrysgBa;E{>M1*&hJ;0B*5eGs~l;V0J#aLzds7+YM0B#Jy(f` znMDJRVfHg%wn|`=nQ3SD8n;M1?{D}hsPZBLrPtnebaQ1cRCtXrYB9&ts3eEegpiI7 z;||vVp~GqnZ4^@N^u+0^kN9kGv0B)kbRNaFTgTxjk~N-71A7L=;nc$pcK6YI{->pV zZUw?(ADLQdm#)b8n&i#z@t2S-B-0*^crappX`D}Cfzcp=oo?Akl3A=0{2CV2dg{tdr~d&XutZ~b-wF#YH*Pk-6#jeX<| zo;HflIZ3idwNOqiIS%PlzK7JL#PVpCQ{AeX`?rg-i9vR{d(|qm}rLcVjx88O*s6PH^cHo-q`Xj)xW<2j^mISi6Wjt6URz8a&OMzeGN0> zKs$?FlN}*4{g4kryl)OB?pWgq69v0ql%f0!;?T;rT-Ub9?rqj>551Gn36Em_=ZLqo z`f#kv%NMxO19ux<#Q_hEGs76>)##})eN3bN?ShJ0%Rj^r-VTy6?= zx~L5;tPsrX(P+Pe6F*;))@(F)*r>ZWWW{}~dDh-ZQm9sp<;Q3`nn>iT1Mj6}_>NbY zbR{0#dQGep8u9I04E(3<5H65`^Ve1VHxGPn%@0%-LhTR< z$v0Y-m-VMG$LB+9?}2cbeF`OnPv&9e|k|lNz5grQhbsQ4*FJ^{)tvUiYIR{{0#RAdNmyDN91Sp zd;Y*6eB*!nUGe?AyS|;7`|jJ^Pd!YoUN{|lB~IzJrL`fY*1qYpkF<3;yBTM-zm9|U zI^*?*{mkA*hw%Sdz4)WQFJB$ENABGVO{peO`vDjozCgkHCI_L=7Z~>a>>r#U{q!Z) zh=c6u>t_J=>E-*J;g2E((g~1I`&HYw!rj*bYND%~<0Ed8<^g>0wpj9ITtpQ7=g-$+ zK~XM;azI0bjg92q0Xo>&ow&gDT{d4XkKO0yDp}b5=}oGnS1J7uEp7t}% z5}%*hSbd2#a2?FYfrD!GX-d{SL_!taGw2He1Wn$R7W#y^%^bNXta%K z$5VO!&8XZaMGy?$$~?OOs^m5Y*Q)^a<(`M2?niQ46;=(V-_f-#Z8)}JCnq{)I^!bKbktz zg^SZD#d8+s`9LptSUoHuX8athXzwiprrqNp5~5^)N!t}Cg_mj`tW5GmE#*VD5>A0y zmGNcYv!J&FX)EV0`PHGMZJ!j29^3%!v)9g(zEDvn&`);fUQHnffJUgIzW+)~p!4ZGYWK1lB(m{c#szj>=Ps}CG26DybT z78ZwQ_IIrEnh-6>$Cc)V^5IU|M>_8Mphp7{Gk>-zL`#@ABPXdGHi5_nGq$|N?Sv6S z+xn@ZL4E7QxP`s;S{QFFz1JjiChxkS=K8+lDi4B z$jz|KNgt<9GQZhe&3h5(O32Yut2*4EGlPPLhTJq68rUU*3Ac`Ujv)@`^%oEa1S0*B z)!GNwS*I9HkG6 z3oveoPWU+w3ylzJ2>D}$pO3OeR*V?*@h+*8<+9P__05n+9HwMl4vx*D+HR*y2I`b; zDDZBIvk5quVMk#Szf5TYbzb^qIV8dTanV|O`sPj%S5p%b7{?@sir6H|oO&@clc5qU zvy+PePSI~)cr8u47Gpqwi=wxUY$IV1w76Ac@qyrj3gnW!1xJy2z&i!qxL}4IDIo#g zKLdjFYcwuGZ1uu(mjlj@;56}Vfxf<#0al)q8ICq4J0hplDITE1WzR|M!0ORVYHYN@ zDuo4Z_&2{mgef7A)cW`YJFv9It~&T>!t`}8#Ve2z=0KAW=(POdJE@4 zt*VlgGjbO7bZ4hwX4wFXK|{);7)%BPduGHnjhP2A+wasN$HEA4 z?%0-?LVT%mhJywkr#>yz!aAT$-R?FkTe_6^4p}q)B`|6PcQP z7{bwBuFh*-{O?GbIu!R?jfmPnUD3->3+mTUO5z1rsbUi-umYjwUQU8Q+`fj>*(zeD z1H+PQ5C4GxluPV*&Q8S<6w0gNC#7E%aQp?AEFD;AZKoS4dwm8obaQH12mWd}O+`?Q z4sHskzgFdtKwbM^-K06g2&56&fY-tTsz^yku&MVFGTZGK)Lti_bby@(d3{ZD8q{@k zaAT$9u_&h@n9BQZ63}8Ssx>I>S*jKkbT%HP6b?P#~Z{sit=L5O1Glm-GRY)^+~3Jz$8)}|=|hs60B^9<*_`a7e;I^{9;DwM z($uS;cG#0qf}m-5KbUN$)lYgp(_SlR+_i638-uMVM?dc2ufNh?6is40Xn1cZSp_jw zjNgIe1_TQ8*MY}YMibepS{9tYJ2B)jrF+t|xZQ#8&Y+lT@=bPAn66ndL}0Yh%~Ms) z5ScE)?74AUQ<<=9I5%v^-BDf$^zlXX<(!gVnuRUCmPzn4{RvN&OhO5kqNdB_@@W() zjza2K2LRf~bx|Ox(%P@XHfREm9JsX$QfLEVcAD72h95ivNS*l|I%0;)CouQ(+h`F2 z74F#y*gvpI!U9$0m#9)A&LL&Dfs)*&PKY>2gcZdSZWx)O>jw>jnJf@ay2@oS4B3=O z_y+q5v=HRtrk|vnNUfS~CsUvp4m&Du%*Q7j>;+82$V?PSG6-{+pqAZ7PzWK;nB9uo zP90_mkJpFa8Txzv$|m*Jmj&LudO_3S37 zdfI^biPN++?VQfF=%t&aODtHWWC2n%XHCvz6KIQtQG0Wf2s--@iDM(<-%rLwpJOT; zDWrjli2ZJ2g2C92dPf2ZW?ao2WfJt;Qa-Zz@=eP_ZlQgbM}TiaH3|*9j0cr4oY-v( z^9K4Co87*hQ^s_bl!_0-IpRiDAviPRQAss^Ln)qBR*fJ@?^fQ^MN~cqYuXESsO{5j zKd$uL+U)o0F5lKKK6kM6Wt%dpTYEG6rmU>*|HarjZ3z~x$+ptAZQHi(th8-b+O}=m zwr$(Ct&`n%dz`-5Pq9|~U&NeBqPDw>8W0{E!5j)N@MOgu^QXdWTS2dC8-Ga}|JWA@ zc1M=9iy~;bEWVr9k8^l@@U@+1dhm8s7a;mX?WW9$b*zZico;E05oC zO2`P#q4x@Il&-&Xk@;Kb8?|rps^{y<++jH?U9u+z$zxJ51H)&vv{1`N-x*albrO(p zh*@*zsbpE9!#>FWxSQPy#`sZb2H7_TMdr`q_CSA2NB_Z~$KrWIA;KPC6$k3UuP#_i zkg@)^Y<@%0zrZ^JA4tT_x!3?&a(+X^F5H!OZY!3Hcdi0?(>V~+B|x3NLDcI$UW&_B zEuHo3R=+`MJ#2&TvndGKi;BnoNEBzV2=8w}fkm6Btms6?v!pYygBi}XF=*eFbUCh( z9&g?B?>7JCUr>*bkFOLH_w%?8c)3dR(1}cdgazvzUritJ6Q@hHSVCiw$jr>+1Djah zYFvumKaGRS+Y6YtT8;dGEvE9=n;!JOF;8xn&#tSdf;g7#e>ZE#Pz>5X2-O3^TI;r>FyeR z`O8T|)3JXf;Nxl*{g=t_mx2dwt)jjr&j=E$!D7zp-#Z!ePCtl^H=BCl#gEeQ@Mxru z{Uan8dOl!5##5<9BfE1#?lXybt(?uo41qb|C+1 z$PJfIEJ@-*lS!iv|K-KSY5i6?sz9+a!0xHi!oBLL&E)fWoA~)N*HeQ}&=JZLUG7}SpS3@2G>k3yA?3|k|5MWI^fn61Cs)62_VCx6 zEv3}VC;#>?WM05SlKy2PjE#-0(SOi;ed6MMvV4DC+`gUQEztF(LkwaI`<{)k^7Kwh zwn7|2tIF~v`*cD8oZ}2;{MlP5iM@p-{fgc}^CaEZb!Gclq4_@hLg;q5fh#+dHS_S{ z$L!=&xXTDH1dNk>*oCk^#Qfn!uQDZ+b7GGY=evaC8@FsT@#jJy3B8rI+5wWC5Ptq0 z2N5w4{W7TOa%gApn38_SK_fe)RsGO{Vq+$CVJrz!O3aL4GozaiL_Xd4GM^JMN-#+? ze8uV@w#7fO!JE|kH#=n3S5}?X5z{?fOU~+2>qG;^ktFNe+O3FouD3B9^HlV#=^^Uz8 zVP#*^%G3z4O{>OPGL}yoggZzj)=3gbo+1qsk$imPZ!Bo}b`6<9EBakYH*JU+U+nA2 zH5$t`XO7j4ZiV8@35rQMx+K7N(X@7YBprhzSMoMRYD0E#XG^Iz)IV1Ru1wDO3k{w_ zu2Czy%V>&wY>t>ltg=&WUc^eihPNH|k0zh>-9k^4;8L%EpGSR~r> zO=XU@%K=I|VPgSv!!z@Sx%0P?3i+P5N@V64l7>W`QZ+g)!_Npz1}S zV#?Mdzv8kNaftQRw1Qf-NBWV>0hy1x8Zgnv@fqkVFZ_2I0Ta)ZHsE zIgT*EKscL*iMNpQjuv;-aThl1nWPW!mkJK%fnF1&vVPXz7ew`xHqzSBV35X7=r@L+ zx<{+Gwcz5SIadLfuhpjmQN?~3!-%k{f)kIzcEC4AH(`fd!XxycAOplHYt0+B0@<_? z-0LS|&Eus2!xMV#BCuLdo+7N1Cn;hYt#5Y9F?tmxjeZIjsgQf-Ez>$-K8ZSOSo-aL zRes4pXQ2j{2%vveo+kZ;c3Wbwb7@F^dHCr@n>hd@m0iWG5k{ywN@)Z3q#T&)oQXIK zx7?CdUnO=~+YJP~l!EE0LA2cIf*n>lyjY@4PHZANSNFfdc`$&M7j%?Q^_E~8f4!?< zZb7c61H=sInLv!{IiR$FUVVs&PJ^pC`q}>KTQ&$47-%Ml@rVCj!%%}4Xg+$Q(y{53660*8f_4P^RwSnqR zI{z#WH}Bdq1FSlwbJk0TdivJ!8K?UerzMAl9vM*>8z?ijB-mf&AV>Bp(|m))J46-s zFPSyZOo-{8lu!mBf;8q!}lgXs3-e*gu2?Yd!&1}Y5e5mNK zQdTyh*k-w(cC_kj!*`_Yz}rx4h8+qiphiJBxXfx_%6gk0HXqU$FV|VL^pLizFjJzOR9x2-$>>pN zECbgoVw9l`4b1FFrS4k;xRiVl=EDD^-m+z_&$NflrZ3hq+eDyjOCCJ6I5 z1x(-X@-x&ktW;igLv@@3P*CN$A(H?Isi;2a&{;9zt=lCmXv;x!gh&na%yzA8QG7L) zRg_cFX*{D&XbORzeOC*U)kO(^>va-3>;lV)?3A0ft=Z2S6c#j=>}vYGTXP{=^LgTd z+Me86?wR#%`RQuOf%7a=I&fO$w}^C$P0mgBKptPp`Ez*mO41%MF|usq(fTdsNcHMU zXQeszv2EisvnG+T-My(VCunFsE%%p-X9qa%@b#)|SQYV(*yiS#Lj02PkFC!qDwmG9 zp)4&A1U(FU|IthjSEZJ``l-`;fzm*(mH4W26k66UeG!*er3cYuNyN5##NDL+seo28 zb22SsDT?~t5Z*BblT#vWWMdNaWhQ2I#w9vW2KB=b1+K6Owmr(|PA}MB_h9PYEg zRb9;8@ldQ>2+4<(^wakO6yMa?xDG{Ga<$nWJjHzx)H~8!wnE`jULa=Jk(jP@!QCLb z4KZz~kOpKYbzHoaZe(=P9||(}crrC3Q@DS43k>N# z24`W$-svrt+glS2b1KtLse^;A=zZF5c}v6}(|j~yXT_5eXq~f2EQGG=AlB`LSWXDE zK)exF39JpO9Zh&6A)Xi!$mw?>y0e~B?Rc7@nbdp|l+~-bFGx9~Ba^;1?nCPMQEJ;D zG7J?%#2-|D8tDT#%s$S_oXmp5e!Z=kR%5bo z9ni;D{|(Bcu#cV2(Wkz@JWp2O{&(ho_^1gcqv>_>2h;;*e+E#^90uFQs~KLQfyg!l zWn}EvbDQJ@e>-JW_4xz*8J^n=xU;x>irW?iFuaESEdul+>Z18!Vc@i6;@R`>Dh!9- z^ri>Jz@u|+gtA2JwgGTq>k!~HI@V8;oLR6>$i=ZA|3U<8Zb-P$5MAjiqp1sgq?)A9 zWUXlEtL-#;{kC3MD7FdGt)M|Qo`&FGg5V=g^tyuQyi5hQTRMW_fGL~*xSow4a&0rg z7+L~aM_=E2Y&t^+^JH^9P78Ag2&E;i3k@;_wl<-4cA_3>^>bTc?uBlD7O|?nN5za# zkA+fFp9~AtCklBi+AK8=;nKHkKJc3EmJyGp#y7VII+tcyk5_93M^F*XIp3-Zya2b8 zXrK~b`?q)3sBr$l)NKf(e)2TTwX^>8$YDHXTBZ?<<+jb|Wyj`(9xB2+X!5~r?sgD- zmrSYyo>4_+uR3s}DDA9jkOEA@(mdCFxu<45(6cb*@w zAxp|1IaA&5&3m7}w0l){yqK2ZxmTWxPkRnS$30f4NovYCC3Kv8ZWBK}L6uS{GY*B3 z)O<-1J5C#${CWrmC{VQhFB5~=`d+93`b}ti{KJOeT zT#mfSE2JH@*^|ygWbJ8dox6)pX+dZ8AgwE~WcvYaC4w4O-enWp_-Gef`N%Y^6O3__ z&yZ3JY@2UU)S;D`$i1ZOw2U;{Y3=??)XPI>j2oF&tQZe^X#@M$9+wQqB4_;m)vxvV zWR0)S)vP(Pnd+*xA#a)1>W0|~3WXo1vb%74q^4KpJ&~@yw7NN>f%HqB%<0fPQP))k zG_>_7E95qc)vnlzyY@hyE9rkHD-x|%O`~6Ru#1>vEa4&XbP}jMTQz<*34HV=q zZO3b?%_fN^70g2M2)gf2E=ub$sNh4EHT2H&K2{@phykq9p81uX0*BO z^|%LQ4Ra?2O%--BpQ6ukDye1@DleBhOxlxm$x-{D4#O{j3Ft%9vmh~;OW+s^1`(RB z0L{d6rDff3dr+8yNMyx8HBenL$*-ypqWp!_43(Zt*ulhDqNask zfih##tKuR3DLw()RYg>}FstVG>wsbHB8fVIEJgspxzv<%l})#*={H3&ytk8RvY*2h z9@lbTS`4J93oHoYu(O7-B};3h^fUz|bB%@C0G_129=2`7S)rmbDr-H>88u>Sz}fpbz7WKqCb>PhnNMzOcX zMhxvmik+m5bF-QsKc1i4n1Q1SjBpaA-feK0&!Bd%vPi3QeQN6=S1-xoP!DnO#!jz& zpec}O@eR;|oMuz&teWW<9=pvN2ptG9T8Q=<3Tk?Jy^V$i#O43hprLR#Bd#AlbWZw5qG4=3F<#TzK$QG*U^15-;&5AiG ztN5xHH$59nwnd3QVb2s^pJwMA+TB5k9(oI4W(Pri(=ql);vI9EC1*1RyOj3~_hTuI zj>PL?K+j6RpG98Omt-tGAl_*bZEFt$DOAF1uTq##Ol0R^%_odD=3WZv5QT%GKckpT z+wLC}es(e~NjtmtW^wK=Cj%Z{O(5`Uub{$)H)@Y)ZMSYD{UF2p3Fa59_ART2XsL*C z-kkO}10{4~DUspI!FiiLI2vDdID<8FSc>VF02}`|HgW(xMnQ}Dkm3H}%`1CBQf0|k zTYvq6e3KF%C`a4eGADNuz3m2gAJe`C?ONLBmi`M}HwwbHm>a^B0>n@rEjgl$f;8+gZt zP}*FX&dn3s;cD*D6lz>}Hfz!0$x6#;pxPypk>8e0_UO)>EnQBwqs-_fyii)oLbBW2 zrghu_n`I}qgVVjIbt%tYZ@;yeyd&?;abx;ghP>WJ+dzY_H{a%PL(iyb8>9dSeJO+z zy{(CnhmJjpl`ey_>*~%v@QmE`<=Y5A5uKZ4(Fr+Jhs?o9g9(TCW)*o)@UoD(SRQFN za-&+aXLP@h3wHro+-q{qq~jpKZk{zNAVSNGt1t=d$sBG;( z@Pk(jUAiMy{DHPVaxEg5KJmyEK_8P@m}kv46H_{|0{zX)D&cxtoqxSPG_ClKx{So$ z(H7cj$->d0D#%s!FJ?IC-_gEZWEW-za=Fk$5022@? zVTCIUlCI=jqg6y#igleW(FV~#9Uexsv86R5rcMw;hVg2j2<-UyD+{Q?tebKU_( zomra3g*I@Dvw^}tu$PQJnDtpP`S>gO!fauf7qK{#Lb#0GDXpFobhn2zo3<=(KUwiP z0X)Ts-!HyDTfRPjKCy|>5(wVRJ`EMoE#wl|-%#M+12FI?q_hUL; zDNU6odVdp4_e58Y+lMUECb`!g5h^_sk_yXZ7m>H!*7f}{$+|bnH7iis7-LmCad-H* zHZOJ`cFv|aYf1qml4Y4@4b?88C!={t2$+2j)h7DejaYP{@3T^M{*@GCLw}j94+7Fj zXZ=Qdn7>@fFakx0o^glgQF2mcF-P*7F!l`Nk)+O8noIAbebG+xUKdfw+)^5&0*MDp=IZ~%}dqZ!I?)JnV{ck)pR&|UD-8u`JGz+)y+z=!99l1 zA*NB1!<*oLpu!92E`@hV%n7);WVZ@ zo!l5F=W4h8D?9)#zoHG+MqwC2iksP6((cbw!>G}M_4oIL;8p}7A93dN6x*ofmSmf% zh+}6No}Cu2^zTl=$3PNqsZGAe3A-lvNLiGw!?b{(Du|PAAdee{L?u8%MqZ52BLi_T z5yM?$=Qt$DV3pQcii>0M*D0zy$$~+a;jUlG9N3YSWOJx!WqSoaP9cv>;4?F)x=$)r z>TRL9aB7ofzC6S@oZ02b-_w#Rf!94Jq*=*T?CCJp>AgL{P>*~n^ohfVZC*l$Qg#qD z@2ZW~b)D&}NMx2=2h>#y#M4a|kw^4;r8zy)yv|NqHEbAOx+AM0D$;{$yAfQz_Mjy= zTkF_nmu_W;_=;iqv@dZf;;YgnJ%ZP!&yxzsfMRh zPA!c{$(}&Ag(ByTr{~WT_B}WFcl(ATcz=u84U@M#aY+B zNony+Az<(UuY^YEVIPT=rZqf=v>{@Ba~s16a(rKv za=mFMxUx4d3mD7^o7w#I^!tzAA0t>N_;kHH>~<;HTD>4n@7UkndtA8RZxPWx+XH+k zx_f`09Z(eq{jO7(3Wx8apnb;Z6KjNuyzPQ!9Uy*q$JADsJ#j*!5r$vxj!fS)sNH(m zLl2#I+0{0I{!Ii7E19~ejj-y2pzp`gh|{yp7A9KCEwk?jYwb&H2!WqcS?G4ym@+0YRQkgs3KX> z(pWF!y2sgYjSW!#(E;fyO4-X~##T|?bjyCWTE((Y_+kl{Jx19IXbTgTc7?7&C}UxW zSx3^v6Z0+Y7+C(zaJ^lac|J^2?H9WTFZ!(;t5Mj1VmS*VPnxN(Wr^EQT>J_e zXF8!`2G5A+9E_8)QRq=3AdOle$9gihTDr_cDUANj_Egyp^bwaV^rwF@w(Om2$1x=yNSrxOGrC3jK<( zkVP)@n+F^8CL&vVTLCeS>tjk6nI)1r3NYX-EMhsNSX>Dyrq!e886l0fCm5fl&hfE` zWkZdy?&RN45*j!$ryk)a79m)32et3?*f~pkiEzad>SYsn_XveI(r=#OAwXL`%p~LI zL&#YqL74fIx>uwR0`>dmy66?y(PBL)`%G`KaAnRA*ABv;xPK=RV| z;t^H%%`vND{dhjBU?P%r;J4HSA&5%PXRc7@8ou)}DJM=XoKqcJsQrvb(*{j&6i+F* zvI?mkVZO+7QfL%%PHTx#mJRzokX~@Ull7Ia95jjUJ66e>!>pavD%zi}46q^$$6`J? zni24fC)4_YEdxB21F|2p>8mX;Ys(S!1z4xlQy$|Wf05UCPVc3A2Vi=nmJk-_MfsN# zC%g^PCYn13mzF#?reg_}Cc)(`vT(*c^L80R57GoQGeRU9#8&QqTLD|Q_mSV!f4Wm_ zZ{86JCX(mR$nmDtW5fAN!R2Wb&%fU~iT*qcL-TO-7#G6n5HK$RaT2N-BhUG2bv}WK zIFZV(gR$FO@T<)1fFd#LQOD56rX1G#tx%OsuyQ{sxjNa(xE*%Q+{NxnUliQtW&3v4 zGt=1|V1{XZw#g|k67`*!^jDhK` zg+cn;{-UpVDqX)0AQQ=Yb?W96qwiTe>Y5a0#&;|ZjYV}f3b}`ur(}jlNFIH z7QmK6@G1iY=FVYd{=uR+0wdlLfhW_2+2samy2k+ROQ;=R8-@8BVa8+y(ZD{$Sr9@uW@!(cVb(1F|K%8L2Ddd;;p`N5KR$m0Bh{~5Isl?c=wyoiZARzS26 z)5!Q=E7WGYORTwy;(aA@VNr{hEnP`-YrSYJV<=6=*J-A0(b2!cxWZ;>NwHoRV{jjW zjs@qUu!-|;)DUB7NEkc30X*VzSE{Jv5NR;Dl?|Z~X$Qd<&L5@DB#mNf+8ybt5(jd2 zv+dEoE*6#Hx7=vPU-WUCz2>Fd2HcRnmQ%5#WB0y#uQk=9HJjp^XHi+(YCdRK*o3d% z=eg020u41wUQ>SmJSs?X%byWooyu|*ddV7@nlk>17H8=mlq6^*o6#D``wlR+P#tf) zMYupF0j7NoKH0`()F4;NmQCIU^Bs_*ntcmFhKh7HBe&-f8qyAfc`DF=kK5`O3K7w^^2pbxaRWEms7-Q2Qkf}Bd3>++0{4eNtRpuXm8_F%rKPtc zD1mc=ejAPhQM|+LNglWjHsYPG!xJ!RQke2SN%lfai=d_YV07{DFTaA)*PG&A+m33{ zR8>4R9^b-OLWKN*spU&**}8NA(as)b$&^leVUaI{RHOJM4@ekPuO# zhyIzsw6x$E6u*ahYeJX6O09mlWvSPP=K2$`@5I+FnhYVuP{7(z6K6c&3!gnRZtWh* zq5LI@1aud@|5?;=82bQXgBXIAe6Rj$8>+RZjO^%`zF2mz)T9(4Sj3Wls;Dm&2|q|N zMI>jbU@v#!gc#0!}VzLfAX#;lRT?+gX5Qx@6L z!42(G$3;Ola~Ce)LRdu>DJ%=V5F1<{`i*uZ&XbOjn1PJh(E>!t#^c6&fiu~B-HtLR znQ3q94tb7vkawm_mX^7&cY_k?eUcTs$E2joX!l|YCE{fxoImYNyKO9r6$2D`KLTz2 zS=W$Bkg>1CVzdvyL!MEZq_OLQ}mV^pzhXv5cdgg$j0IxeCZ*a&UxHd{52Iv`^$);GvL1I zYi?d;qv_VBPcEq&>b@$4ko2FInP`(gT$autb+b#+%__)NIjoW;H6R`(OYUQTk{q6R@< z>G;I$g9AA-H-!D{FvI;wtPlo{V1+y~5j(I(=Z${A~HuN)wmkG7@^$KIv z%rPlD#d8N#;{q!_=;*}N@;&vM;SdiJ6*6;b+sNVia?Mk=56?1-KyLAo6fBUkjkZVP z3z>^R-Bb?MYWGX)5g6}_1MU}j-vcFik@LGqOhXdpM!mw+; z8V3WJFFNeQu-@Nf$f%-3h{Y_XhYSty%hA-UReqc=;E}l@p5<`6Ip5RL5@hrG$iaPQ ze}6N1em{+z{UXsM!b!r(<@j(*8X6-|zloO!vpBz6e=dZ;%jgt6!6^j4ktKBsr*;;8 zZf>OudtB=_eDKa@tbUgc>MHNLk+{NTuSr_q=XN=11w@ycm_1pmKKX zk-&U5aC~>BO{l(D@HF7JpjI6~R#g1WOOJ<4L_~`)@FQ}%&ogo3@ZVntcw_|!gh3LC zG)73404Xi#{IWVo4l6VFZV7G&JKmQL;C#Qv9Zpb>cRc%1Izq3XFQZINtJ&MHo)VvI zZ?4{xz(qtu{>U0M5=isVH4G29LP(whBnd>Rf;H4?ej1nzUbgcBr$QBd%_Q@GGtf$q zvLDp5g!0ZIPmIddM_(GKcL~A=)=0RG3>DbQfm9O!`gIPiZ;zTo7vYyD`%&Olv4w4= zlj?A6^uVv8VnfH7_hN(09gv&9ypq*(N+&5oku#8tf>*fVUL z@boc?r(TVg@r&>FHl1takE^3hJp1bMKkQQMW48|Zp5W6~i)EqQWzVq}Drt!-mzja4O9w^EEP;mVD7vR`Qjex-9qU zjQ(Y}NfkmQP!@$hiXN5%;G(VDQ8lU0!tQG{bs{2rQuESO{1r@=(sR2{JXDvOI6oXQ z+d-+FPLvTHp&33?%{_b)(9y`1THzwN`0)xiN{&k`3HX4Xm-4@s7i ze~xwS#GthbUvc}o%sG-6A4-MC`k_`LE^ZPIV^+B^j?`K{2rjK7I5Xp&l735ueWxYDMmv;3N|`F#*m1W1c7W#|U)Fx#b*^68u6I z$_>(su8p zm~F+UXUUb^paJC(W~V6^q5|)%V9u~#ocD%@&@S@;gWec1@yASD&BE450SEOHEHGvOc1*ERlj`#x# zG!TX5$OQ+P(q2VH04`e!i5|=#z23&A5d9V+dT;OdH9vhRoHO2nDX@2_Q@_^M=t;R& z=FpG^Hakr>{o!)i9}9ITq?D@Z-RCJ75k3tJK$T+lwQ;Ue&HC~bbvBKd4%kDIF3T^q z9wM3-$_xAlUPKW%toj8Kf(J^@F&Qd-Wd5phGlqeQ9D*-K5kOw?yMg?}L)08F|nDB1D9;AUWM%HjB8cLV#(DZw+9%JXqpr*sX7*R9w ztF5~=?#&7;LonKNVpN<-xc}b_@O+)+O;H}=T$(bd(%+gqs`vLHEB&6<;ZffmShQtM z^k%9`0B(qLS>A8jsLVEUNzT55W zHoMa>4^E_{T67?OyK4zxV9;xH)FH^44gCDIR^Vgj{g;rs3}jM5V{afwpE7%UqfwyD zlIfUk!k|ywZYM)no9Hh4S}TRi_C1P0$ZZYWX(7_GFT?$52f#Ph#SZ7S+-%W_1T7Qv zlbn)|b>LOx08nV;@BnHJceC{B8Gvm(&SC?9~1a5S|?j8u$;0xREW| z!$2WSP=RvW_58IM)bRLE)NRb(s{;%8;|I$Y9vP03r{@lJxd{=yL`{;<1X5$030=H% zgyz*qmMZGoW&RlZ!Q)xYX}y)X$k_y)gsCeB5IRAu%9;8iN8yftVK)X+D6(%;@~F+y zSM_ef14?gi`=R3mycDsBH(mDxMCwb1bIt7ohpB3hQPzc35?1O1qzu<;2=-3A($lGC z+!gaWPoX|e z(FAyp6x2g;YxuM7R8Lk0`t>4h8)@bxX%*TxtO__4;U2#=VtOFSAT;U$meu6IyIm_V zZ4$7VYs^-Zm^^Bf#pn3K8?tKl63*d)F`3{D8gyM?eo}Na#QG=JGz1Tc1d;kF7iEZ< z7cd&;FbS1Qkg9&yMFtB2z>~#+y6sLyad0oo8hQa5M z5Vz08*Xv*CCNKZ-X&*!SV^p-eiv^|QIHO6V?l5wG<^_}=-+!ilvA0BMPcXIzx}Hf4 zr^9Ibt|rph&i~Y0(av8-2lOm?`fps{82I3;u5d9z*;^wZpz(sIkU^xj|E7+jm1KNi ztGc=2+uc=ePO_f8Qf+xCI({ox72@y^^bx2_4nX;Y2A<=ddc#*qfsi~}+?FlY$ zNMp8GL)pU-fqhgi&XC=SR>Gq&OpRzl3 zTuf!o0(5Rg)~;Z`j7X@R28e}SpE~J{pV!oiZ!uqjfwh={PB(gBE~y;45hIFTNJ@{q z82o_&F<>f<{%loF1{4sgyckv;d0lNNKJitgVCKVQm5Aq66bFD+iDUt<%qX2Z)-;>$Mp*SxVZpNeiz+n(0$ei)99pYI`A?NhcHKqU)C`+O#zPmWvi1U+u`K zHll4QQcPjNaH)1}paV&R6~Krw!g2&i45~b1@Q?FxOi3mM8urndJ)>G9kHGfh5|n(| z-f6UxSn>2#yQQf|)Bo*t0EUp7d@1=N%lx`4#XB0;|tD!vU&#?@yo;=;1< zLiQd8F2w5XB+zT*W9nbVO)M@^q&yIKxt8!Y?5ciowX2}{isrtTPV=d)ZS58jR1j4okt&8I?T57yXuzA-D zq=3bo#NmnEc34BV{&ux}Ka_&qlcGcJd>$-Jpwsq@s2ZVY$#j$;_p*YG-jlaIr)Y+w+%MF^ljq&StBfut0TAdOH_<#lc|pf z`T0(r<0-GlsuOLo+<(Vekc-vVa95xD-Fv-zTu-=rXlI)_>h#r4R758>shX}edYuFc zq@ah5TMfE&$@tdDSj;?5|45uih^dLgAB%GA(<{;eBzfMjSm+(Z8mzysIt~H}pw0oF ztyI@ZygA(xPoBN96WaXqL_@?sx(G#e755E&r}XqqDKF@%TCBOPxt2~_nXi>(D4K|2 zaq}^uoA#|po$IuS=_)%b3k@^FjL?4M3ZL-uvneggXV+& z9pw>=EHr=CH6o*q+5a&yrt531{W%ZO_6!YyVSBbRzpmJoG^AD8=>w2`2!*(U?c!9? z*DIl5W;(mO0_+&Hi zW4sVD%wX+)KGqv{MhygDppC)|Y@G&+(&jvwgukV95nTN^Jcr94sZ9ar@)TpY+X|Uk2`QHwnrjaJ zgA}{ufVmdiLURO-m_Lr9C20Ailf7MRW8uA-3n(iWEPhzWeubdK3^|iRGXc(368f9z zm{${PZ#yO?D&`sTmiT+Uc^N+^Hv7Gb%f9teGx3?FLRStgnbI}KjCItpvbjuqd!WsT zd+OiP9$K62#oP?o(iDq`e@k-nr1zlg_=+sTL;cgG$r1Bw zJe~fcdWVZtT~r6e#6iEM-L<+Jg9h_bw%vzW4*TgQ`CsEH9XA%-gGsvvn26%xNCB)5 z_AdSbAG@pbEo~?Xc6HAPSkGY24r|ZPr`K!ak!cz%cgyQa|D`;e)Bpf(DdMl!nvn079^sjAn;#; z_H+(X(%;vU7hO0}Fo1dCX~K=e@QEXe;Lrd^;%m>L9kfxTpZhMVy!(%sfLZ;zkRN3T zH-dv-_s=kgKAKFcIrJ9~^y%-~+~ zvXek*UpN41fj{ZdR0b*8mrx4q=eNZP-j9ibC=;7Fz1q*`?8sbNpao&-j1k}-V3880 zmaf`wFBZf&mi6d`x*%zopNvKO#p>V~-XF-{LO8?4hI+(8m9ZOqIhL3YX?o<-k46#@ zny|A6h09)6EV9o;pd>mfZt-m`M;k|t5(jH6%=_6@PoWL$tjIY-vfs56DRk@vEvny( zbM`Yo4q>RWC_p(*J4K;0|n;f{(z1sj(u(3Uv1L^D|?O9;ZSIE8aeDufK>w)7RB^X z%I@6jVD|$G%hXg5L;@~Zu6i=KQ{m7|T~=4$k`Is#Pkd(CbFisF#2-HJ&O}*sUk^JO zdTO_>!8V8(%8>AMzZ(T#k~Ta@9yt>^)-D`&1m=uCZ7qIQg$cNH8X}c?q-uWGsTI+M zBsV!=hMmMg}kSmQ;E-{A?UmiN*?e5d4WFELb2H1E%!AjoG)sBj*s{0cJoHF4| zyqATk0ahiTeLm6I0pL99NG&xJ;fv=kv~_6Fiu@+f<)$xqA0aGD#9Vox2l#S~mo<0_ z;3Zr@h@6%)Aag(8JV9RXFM#;dba7GRu@+XQ%rUV4P3tpZCDgzc4J%&qY0Yjnv#~n* zD$zkAt(uNBOASPXhc~kp>~%A>7PirLENlRxHkI&}nKo{QiUmd;g?Ee3Gh=RcgPNM6 zU@SD~4K5OewB@PnO23{j0Xr(0$VYxSqaaC9&N^Ue+OrAj-(8&5C8i|~XK6QWZxFQU z-Jr_?rF{i|($ctujlu#iu!m*i{??d1*b1)Axa`!gUI63zB~*=IuD(ubCShs%$e$B} z(k>^v@^d8GoJ0mX&7>Ym@3tIc@|PP`mwJi;@=Qn~(W;Fu3;xEET0`!S?=Ny;2Mt~W zm0&a)*EvB>KEj}|Mrqf+aCp*c!nN(1t9T^uVZ$^*4;-}unFU6S%>fl|UVx4Wgorl= z-1Jgff|R68U7UYHBdr`ak-b9^Y(NM5X8K!bDo_lu<4F}6+|A5DE{A^h|Muck$>VvL z0<{hS+>j%rrlj&kVotjLbVPEluB{z%AK6jf*7}i*sb$+zFsbzP(6hh{z2yKdEO0OB zi!=DCe_@2d1Is4LKx1oeRY-!K-u1&&G0myK&sDXjA)ZIt)6J{mfZ=#RCh@n1s`Je{ zLQ}9KItOm=S#epa%YJd9J3qY#UxVK`=ndL;g^+493brXE(N3W*Q~5!xQu#GG@(^yO zNz7rPEh$!03|Kadc%<^{sI#&uWY7iU?5kI4xF^f2u2Ff^vONrRNSJm()oa5GWWe#W z&gl81x_Z-Ls>nj1NRT`^a|cGAFEiJ}fz=4tQs0>iyBm{ldceSe^HPk>>}!QvO>9AJ zj*Q|z5}$402tt|p5h}W2IKZD^U#MEv!&1E8k{@5ii!1U%dtuTR#lamMVdiwAGF8AE z8%_R@nW!$~h9s6abJJLC)tznQTiz=d11Xu!o{y&>Bqq`Mf^=dh*&!Kh@luBA@QJ$L zw0+$L+b_9^*`mX;6`ZTRNG@uDZj|)aV!4^nZ(O_ACo28m%Z>>rSJ;s9A88%r(-m}r z4_^weYpjb=AnWN#O0CE^<%lsLy_uPRmsD&3sP4hSd@R`t;>CKaAHC4FL)XD=A2F$H3u}i11-J?p-x4`MXqVou;L!>@a5;`T&@wa8*lmVf}@;gD^Yszvyw?#)Lr;;PLS2?{0i+8)T zl4E0u2i4LY(Iw?=l;UBXV8SSi;qk0w>%q#aV=Hb_px<1DE{&_2wmTPWl<#@;G-sl) z!rY{|I*sngqFB13R;Mc5BRqIwR4Pdvs1|Bde5SRgDHK%NlBqZRckKXlrpBgPSdr|a zG>Cg*WInFI1pc#ES zs71g|41o^{YjIK`aU8jaAYK%2BDapNNHg-;k!cn~PRf5NtEUW=`3N zdP9cVSzVR&ZeZ}>71{F=RhqcW+b!aNLg7g8ypNr^5UH!iK$K~@EQBOqv`XP{Vs4PKp& zD!xx!KRzGE_qRJR|19>N_PIWdqfkl17;-i^>cQouQ7DxaFGgq>KvbHbb%6z!61Ic) z1I?qoOxMV?+u?j0pCbMkv-0qhd2CMAJE@OJ+&2@)KX9%T6jx^9W2b}G!7cf_$=CQH7%@^6H?^z+ z&KHSSVT}@GeRK8#;3){j_{`OFJ;?oK>t1nOT&^pn-FP$Z4{v%W>557tXP!aFFgAgj zu`VQ5{ zVB6{Po_}{}w6RFW#eK-mYNhqjkBhSDR;b^CJjv_hGp|mq?Wr(mg%DNXPwN)1!xr!P zb$ghmrYHh1psQCMcWTEF+voSQ+{w1{oK$Nkk)l?_pVKYXGlVN1#%43(B;$nr{o5_1UsY>Xn$7|Zx4vr z8~Ur~E)yKrmvPf)^?rVX^lNN~uQ*{-@bU`yaC#F7^;gM&Qch~*Y#;7mmef1fy2eX8 zclE$3_~pm-A;T|KO4D9T1X9yo%lZfqUn-y5g5;K#i^`lQEM?O!Q!V{*jazpe{UJeXzo zUw(A|0y4+LY+!|?H##NlJk4+Hk;*gbMyf}49$>@6n`%58c8%6le z;-xx*Z?diDZsqr{sN2@-?8OwXZ(h8VZi(VWVE;31Sd7L!$9iAiZm&L?jaf*o*1(_?U3w_LSCsg^B!*wQLK?J zhnO=Mvl9>C zN5F+t+V=IVSzue4C09R6K^mJlf8iFGDJmcNUQ;VR(jG|gfvhH{ZhzPo1u!fr#wZLw z`Ik)Z9+K0R&DsF93ICshfN6#)f(bpL^@I!(!rM_i&>xUpiU5SJHg8P=Clns92=9?C zbkbib32bn3Z65^)CCceOfJp94A90$^jIqnu=!cBT{JUB<6M6G1Q%!6PTV&LGyXWx$ zD-J7Zop0^V0IIRWuw3c3eFp--Xl$+O)7LZ*pg zE2+n!4+9!twD7zh;A%DbjXFvmE4A%keJ*i->1*f*Rvt5;w)71hZg@8!m7ZLbiWYZN zv$|p&YWa838_HJ5h^U3L{szuqbi7x^FKg0(TMAdP1QBctPdrIA7}^%35#R=pDy$Vm zyH;(y$^eyNTX#m22AJZf+4$4;K^Jmhz2aRkL)I?cqSxq>9+&=>- z%SmJeKuV|Ug0mdd@4C+zMf%Y=#dgHt({>nx^QV{*P~H08G+5vnht^u83~`fpHkzr; zHYUEgXVAh932)OGVZv={<+VzsXde=gB3FnR75>P@s~el@$$Dq17pJ&uxxG<^qS$u( zBlvp^7vcxEqWtQi?kTJ&EC*Uzd&k+0;g5>{;!K;E`P8l z+;&0~<)yNTn2tsj&>qv);;>L?SqBx@yJCAkwoVxvS(t~B5i_xg|REZ z<_t-PxJ>Vh^xNndzcCBy5^a%IP4P~ZLB~%kLw~c# z$Y*`J^ku7KBC!>x(wnm3_PqckPFduyI`=WlGwLv%mY92=*~&|8+@J}@VTV>oa(?bf z`3*l%)wluGk6Hvi;cr`!yDuz8B?uJ(h>dtbCN-FK zxt#yi2wUK+osEbL@tZ<@UiWxK!Rlm78|vyy26A{VHuS&JIy#I;2r1C8cyr*{zt!v1St+7^mY*tVBbt(wfr-Jw{lXTuO`qy#9lz zxM~|*)-rvp`ypFdU3`hzK{r$#m{#$r*tzYZC%GxH z^|Vu^IMENJXH|;hXPk6i!X`N{c66pnZB@MUSfrLHtQ5`JJlHLn8n#^$J=YVfmN5SG@(OHR3s5*V)ZN3R)2HciW9 zWlloO$#q*i(iS!mB91{X=Cm1un8Z0hzaNIsb`(0y$blocojvQP z<#1aU6_~8DYRj39=7`t4H(WG$d3o)xCgZi_20gt}3PsHMx|L?3IsvO%=%nZUb8Q_) zgX)^&!DjGr&_=~tJ;m0`vb{w8w((LMbID*yzGZ7-^Z4vO#`GCz0@|_);*AbU+YK{K zxPXO!gDMR0f)^s%3#B@ufxIz2EI1-|AXv(_$oiKfPaDz{HZBO2pm0b$%8qqkd#}{i z${Bc$_kGtvAW{+=O1!iiFvX57HA4>lHAcRg30l9}GSJYQJIke4F@^WI- zs=VY~NVGQ|CUK(p*7es2i{!m*DLRV*9OIf%{wqmha)`6mec@ zt5i<0LV@DVsoqxmO!Zvl8GH6`yU~i{C4Dw;5awk()AFJ8f>#D%+(DQP zW3mCT#ebU0`u19#2RN49 z!d9y+kbu<$ct%W?EvUtYxm9`G5J)y^krt*)t5mu;bE+8`lxv~z8A>VHCPOGw*5mo;W!O zs>ttdDmrXb*~K*lamIuM>6bH7nhK&XS{5d3g=uQlP3Lb2#71=BN6IU1O>FujT1yZx z?VX1FnS;3CW~!bP-PYQeRNO4c_zZtI?Nl_^OJ+vGe4WOIuhT-c%CtYYjrDm9k17YI zh2(P;uU4d3ryl?GG2${wdpEGMd9l5vQu&IIN5n;~y%tg|B(pM4czn@H;Z?FzPVPYa0eN}_ zJ*baecdF^Zxs<-T*ItbY+qEe%t7obuYnDOZ+*e6T!I8z-1ZkZ(3{!b8qf%Z_m6q&? z1x(Wjbw1>rf_a_{j%%!&z^@?(XI|=exXYH{lpI`F%WWQ?gM91`;Oy7)uDRWbzj3Cp z5ms*NLbX7VrS1I*_Nq@0vq-zrtNE>0lm>d=T5-1c4s`i?OZ#V*jyhO5{-0>)e`RN5 zW@GyAw4*H*_s>Mpd#3gd->!NGuK!FZz$RcDHBCD{VB6(5f%BT&ho2&%P%PP~)59D! zkiTW}Pt_Lr{a()Z&DMt*mQba?UP<$3@1{FlEg&+o_e^F+-n(J+E&a;fdb zIn{MxFt1p%SgFkJ%}*yd{!=(IDxT;#PiO+(;_2-93pY37ncsK)W{vfSeT(>g(l0wj z6}#Z&h~{bkCPKFFLWGK_f=5o*1nWcmFF$0B6dpk~WAR0BkJMb76{gwmKc> zNC>JYn*ehmlq70%i^>khXNU{CBC=_DN)E6w2aYampa?$`;J%L%5Q9oZN5o}-Q+wc z)WR}*uOVJURwH7l4nsTl2e>ztL2VaXe=PWvd$D@oX)WS8sFY67U==l}^wu1~X&N3) z98seNYE-i{c0wz-v>@3YJ-R3I1X?J~1G(j^HN?ZIM`cTxeMB%#aFrjRS|f`fwoXS{ zu$I>Cc=!jZ(nrFN*x-;`ncd^{K|k0Cf}mv1v7rzc;Bvqc+EOoz%PB>NvA zo0Bxjt(K=zSp!717quY=QF*)R_8|;j$L-btft7n*p~MB)V?E%@`{;cTB!#BP!o}wu zk;Fblt3c9IV4`f{q5kb{idmuC!Jrh>oYxqM zW?6M0A3?@l!3m?Ut#xc0?3+gYJ||^b1c$6a8BmIW59){czhOg;m)nrz39&RPNl~q( zc8R--L`eO)-ptvuY5RNG!#;3XPQP>Gk}18lOx9SE4$+dtfXf=e(LAeQS>~yfm?sd9 zL?7b?gU7SKJ1;kQb-Fu|*k20q8{pBPNC?(*on{Je3HL9R-69YrFxtAMcrSv=aGgfv z+JQi9=RexEWITj#7-@VV$X9B?Bd3K(kdBCVSr@lX+qcD-}B+ zyXi2vCenjHd>j}Vmnd(VW=h=*PDt8mX9zMu$S~DCue9*1d!z8`3 zp@J1?z!4Hz8C>k%H8plBT<(yPnvP-lMcCl@cFf2$QQggUOj7s_;mcLk4!_grqr^lv z3(Nek>=xsl0M3v|HUtYLB7NYWz>CB1$mA@@lg7=1z{c*Qh;F(3#xYQD7_D%3Og)v& z9pEaqU@cP)=i4s5bA)J=!OkkAQZftUO zZ$vtdM&r0}r{-SG*0?!JxwVRW+_I+b*t{)=YR4*&34FO)8lGita=iQQ@G`n!>)sHO z@tdIRqyYXVt7XKNf&1e(78G=)Mnjm%&=9a#r6NgXQdtI1`17fJgFs0Rnv z?Uj4wl)He#7f~oD}QlYUz#%E$L-^{Zmy=B!-i&o7#pXDox9e< z=<3?Jjvpcunhg{RnG+H6GdT_GFblXUrGP99{v7mXkOxerZIy`3TI`E=B1754P-mE~ zEYA}2ydUtx2Ep2Hzh01~R*c*j@MuCNuB*R%pyz)^*g}6Ib{YQy*sc7_F2f!~rj5>c zR#GzFHQkw@N(F-dd}%}tOMWklewg@m|471asqKM&dVI3vE?>IL*J{j4wfI&YsGiU@ zZkPz+rii6ctrm*8fsk2=!h~E~ws(hB!PRO6EV}XBbZ)wI3czqVc1!>T(;77vN7!L( zv0Y!ivb`bjOE)64x!#I`K#CKx7{}ybKv8SDWU{-=Bd@Z=jzVxpP_|~Rwr%w66&hA+ z1^+nEQVpTa3GP9re^|0mR^p2L?5Y@Mi`TMc_vRJ5MkP1$dTyv0dOzYXOh*D*&KoF5 znn*}Lde#Y#o;(XG&^{}G-{>1CJdwS^y6vvjsNkZ1lF(*TvDr}6a8a?j7~U+g(77)U z7#wZ{*jUyKU+bgVWKiPNfaTp~Ra3=v*F{dK)}o~*Q#;?qeMYDd^sBOAuawb}cao5S z{)zYr(IM6RT%8m=A(cQS&=cAGODJ6K(Xg(a8H~1=u-NYg&-NHlq2av10)_dF)WREk$eS3eYz=_ag;SuX z%(0mQ9hyqa*xS@w7;DCJE~h$S^g-`@$DH#{;v=LEVCFIx9UmjPx>K&hK3i|63HEi; z347NokYj6e4u!nbLD@&;!tYNOQC3Nm1jzrnDw>9L*R77zW2#gz)~=u{6Bi)xE;!go zw`B-wD}UUJqlSH7p~gSu+)Q`VGUV{4!{=e%{!)D)7T0umjBUN45(>H)pWMp^z&{gO z5o*InX5*D4+iD>O-O3U%K(2^AvKif|!^loU}_$uI|-hR3kg9r{1;u4!2qn+xg7%a*rJdjD-Tu`POL#%$xJ*dY>pwD0r0{ z>k07ge04NIgrFK{BaAqPPn6{`;++DXqOp7B5ofWXmdv2tShHkR*0`0 zWnnc3P!#`e^XZ$x7`6Nu_e{GXK~E|m0Y*n!gD@5#X8C%UmnsZpmxh2@3j19d=&*Ih zs%|0^h0A~BS-kXYvh4PweEMNofJ9^dnV`<|FD4^9sXx(EC86Wn^g7Cr735%r$SJ7exYegRjM%_iULx7}4r$7?K<|?F z@)*n}u!zHXWikSaXFcf#1k=>CRu4hAaQj(Wjx{|tcePjN%51_EhFYD$r}*0pHcRIj zs%&$`Wd(|B(A8cdN3pnr3rBP1uoz1zEX_GHCjFsdvy%6H7`PbE#}+Tv z%^oHxYpFzzmS1`9u8W>v<;zOTkc@l{g9Wz4+5ppqyegRxFs}b0%J=9BKs`<{WW!h; z5%xQ>li%k%Y1~NA4DPEuA-Yx6W3T6#P}0g;>OV&#)Sd%~_xj1U*1l2r&vdT#%HXpF z41=xXYLxdw325XyYs3E8D2FczbfEE!$UWoPY#Gm7v)f1ifH9Nwc#Qqzx_8?ToGxqt zJ?WR%POaB%nM-}uP-=;Yj`(xEGPWumrV9{v5VpqG+5Gb5$1 zLGSZ?{OUJxbe$q@pZm)Q@6Gb-h4(YJ_xtEKKO`ygKQJfb|H^*I#KHRCn6u{Jnh|w{ zL*BnNqxLX0b^;Auk;&-f9TGQm69as=IkKj7>&Gv^N{UK=Jfpo1uEz!$VTI+d06D+x zXNeMipU2bVw)SB6&v#zf??l}`*t`Gm=Ed1d@d}d4a+%%OMfKVUmEWT2LKdfw*Y{On za;sVmon)2#ZpwmMPwL&p6Y!X_=g3tiKiBJ zJWDXHQ?!Og)l^a`IG55+M@xY?e;CDIE!itvfd>G)&|1MRWr?^d*#y|eXLzPwls~2L z3dF_on^eeFFT@qylgDt>6PS>z1PloNCR+f}#EB(i^GIi5tl&mHCF?H^cpg@Tw!XJI ziT1nnGE!6tmf)J%8_ec75D`@yv&7XvBuFMU(wfFl5PEnX^Z=kxr)8b`8oGQ`E{Lf1 zNOOfm!VRNm-Q>2OEF$QphQ^l&qFYd`I?W9)hY&Q_(-6T|)q{Cg#L68!CS#OSAx{HV zq_8y(7ZapogE|Rjzy$=Wpt^BaOE(|;G7y)fq!m`2YOA_;XSj6_NlqO2}ID4dE%!)JCi+B5Lr$eUaJyAs;NLjn8#ecD~R=Tk`;7k@f1FUw-TAx zk}xI|B%}q6i9+o!k~y|+R?v&W-3tIKi_~`G_w!wa^F&_M@eC37K}7r+^1vS^VurW3 z^4v*RG~r4uGNKUMN}0h>{KI^lz-dYp`$16(I|2y?-AIX5G4A+L;$mL$3_OULK3Q0v zVT@+gnE2l86sF+J6smtDeI!*jx6P$uWrFGsp^bxuNWKe4eiJBu1Gq66P-MF$>AMvnY>cp zBORQ3mxorDR+&_<1P93$>6?kY051lJW&jX;IW^fv)ZYfqn{?(+nSIP5V(O8FsY(`f*F?sge{qZji2CdKy#d5LatO!K5PBxs~ zguluRwc))ss(&L62Qrt_t@o#h7lmd5Xf^O$Ym(q$QO3a~1mo@eCle~+qG%f}RR#sb zfDh`k<&iBD${5L?rup181b53y#!9@1-VxEQHXEWR_+txCBp^VlEh_|}3X;t-bj1lI zzPO5GwsR2CHg;7Bm?Gb6V%N;GfVf?-so{>{bEZ{NsXyd97Mpg3qs3MO1$u2+5fAHXQtWa}(1ab09RQl@ zk>;%(*XVd43cbD5Rf&7tHNJx4LL9)LxYjsV9I(o)36_7Z1V>SXNpnG=TBX##iW%lO zLN$q=mN#X3Q76&arAHZ$LSmDb--E+$uRmfr;IuHitl*id34gl^4~_;m!&eh4SZ8>! z-msB9w@z1T5Jsoqh>O5!@3B7ZQtZ{wGekjy)jUgcNX%94mYbV-XlY<`m>+5qNkdYNJR zD<*?U?t}3qS4{t9DKgnY_kBch65o=Re9` zSB-gPDl0mVkuyv(6>bapTEkK_xu}HJ|0+by-;;a4kkT;zJYC#@)924{E!O|^iLXUq zOXJ^76#k>RRKHn${8CJ>eLDPc>;*EQb<2bw9Yf+WazyTm)HO96=3$ z#r=pWbZ!?yfs%jtItq<5qSvq!mHCkw+P@U%{4Mh-z)(v-nxGb0C{yu3ArUCzx-bbN z%Clt;fx1P_n5F_E?T&`zeW;=%y$z9qZHWuLv+ELa%XF{Ue_>*WtEf-zsD5S9gzc(Z zd{uO48AILUQ?z@B%PM`zzKdcOBbpm}amLmxSX>&d_mvtv_KOgb(+$ev80D|qAyo_e zmYC@a6Zz)2Mq<(0wIWUj+3RFvH_Ne=16Agbbd*k+VmangD~o1hcBb1wd$Rr35|{zr zYNCf?wCgg2+(@#%p$0q_y{10luqBYsu4xu?*n#8Gsj2F|mJ1IW4J@J)yUL$XM0bI>W=m}6pGVn*@{)@eg5HM~Vz;oNI#07Sg-GlQ z(s^a~7fK4`qyaSvph->Tblo}~n7yu;6E^oXIldC{ff$qk{`=g!XTP#h&n9-|-s>B-jwsCMrFm+?2De5R0CQhdI zV#U#?NzwJ$=sd~clBw=Vb}F97SxqQox8{jPLce7%qp(4X=tMEGy}9&|n?2fFEx?+z zBf})@Ln*07t&iicWYexRc8l^QS{gJJVklbeZWSEs5c}1JYBXp&J&{TFiW{!CA3X#X zXir(Y4)NcbfdzJw@3I1E7npg)J!QwBgQZ4obk%6o#3G4@my47=OOOQOq{N}MK28U# zUdba_GrJe0%M;i4g5e@?_FsgLLOBvB6iPk-F3|0~}( z3)6qoB-Chk)KYgK&itT$25b!-E|LHW1^~tZngRDs+Y{)tkUfAPf4t4qM2?h@w&Xq# zoL6Q^B~+g*54wFmfsiBq4oplY>HHjiUwp;g@82Cfeck`8;g{+8vXUc2q2tN^6D80y zL?OL`I0mTX`fmSqK?7O_9oF!-zt9qI_m}7!+IxGH{#R*Be?KGkcJ@}*-Iz*KW`cWe z_ZGCo$t%B4gA(?@qIwCU4o=m2_ik#awQ$D@i~En+?|{8GRSS;+t`Gzk2RzD(V&{>d zftB||b{N8gI{2t<=I2bL1o8iP5^BDIgu-%Ww#Zs}v@Z*x9qeI;b^4y(U=_#ue%5&j zzki>aDek5(`kaMa5f9$*$$M&}94fzm=PvTf_Hy&sho4rt7$CUs1hx-*gePMFsvZNE zgxU-S^!9oAAqgi(jrd6?HI`2G`g4!IO7Bu|lZ4q0YcAqDb2iU*=!?(^&1s=J8tmg; z5-RUR3jUZ*!_)ps9^1GKT-+_)5YxaV-R!64W+1-_sUcDt+AV++8xh|MlPrq~3 zU8PdU-6Ry&XuQ)h`e6}{GaHwJT0qq$MJt81$6H~(5Q(N5Yhaa(#=E7zLYORPfAF=- z`Yr_(qC8UB-eIi^#3H3SVb|P2|6zb)aORT{X0kHej7GFCpaWS zJ=Pa)Pkw1`vTT#4txzQ1lv5#TB(`@=BdBuC60C_<88K5NgD8l_YVUuD=}GjI-YplX zr76g@WzyLRCqtvacofW#sh-6oFpGCN+2n*Fgi$`jo=$a$mK5k`&n|8%WnNPNXB3Zk*lLX!ca zUrwt!#Vw(IC)m(Q$~R@dssEKYs@zN0VH_bz_I(iLVC@+S8J4Vpq7RZz)~bS29T{ny z5403$LM|AMPKl~NMISkC&J0c+75$VIW)z!+$7!Or5c4s8W%~t6LIgAhUCl^#@i(#v zw)9_UHDI4tYb{%ra45=@@Um4#ewNNQ4v;&)S2kz-$y}IRBHZ2Jd&gx>QhPB+knx+v zaryUp9NZBiA>sDtFfy?G&uz!cjQdAcMi}*0XwAa31^4Z+pCTO-Mh#GrG1w_)a28lF zd20%UtCyfHC^{y!^A&q*Y^FH1c@!--6uhFXmv|kxxLn|Q(^TSV*J{&dz~lN7GY&bG zrQzT~$D!uO}U8Wdq&CTGB-X>$>jq+)`FIv2N`9%$0=d<7 zJaGra5(NeS*0D589zC>x+4`Pp$&9l@6cjS^j?D1vzlja+k#bMid}-k47(eL2J6!qv z(fJGl8zd7gIr#d8_;O|}NBm;a*BJn;UZ)l02t3emnD|=VTm;8$>S)Uf!cbow9GT>0B5|>R^Tu8 zQ85c$mjiLzyv8>}t~>u(9Q_Jg0@zYBg2HSbEi8*O)gb-zO82hjX~dl6*cP2S{32#! z?pk~9Bs_BspLt8bvLVJgTgF-uiT#J4PNR78zFM8R`phUa&=p`eVc?)jPh$fa zDnz`^DR+uPtRv}-SP0$+fSXQroge=64?oj{SkUcwbkAcQb*X`2b4t$uob-!q&l0-v z@HX%qMdc5j_wth+AuT3Sjh_!JebE6kIQ;<|r_ByXMV0T!bsbDlHREGMIrK=ev4ZY$ zBuNtea3Ywb3+mim5Lj|I^lEhxj$=5dX(9@%eN89tqqgS>q&1AYNZ3;Fnis?Ud*_rl zGr)(l0Gp$Zw6ZS*6DF6eba%u*h!UeF;k6#sOh!c-#>8%y0omM1$jO54py8z_nS3-B z+p%()dfQPb%kKc7hFkW=heS+7AZAew8Vex-Vs;Yjn#lS(&CFl6s@!%E^Tr=~iKVysh(1Ntert zkp8C!g-VL5OWb1|`&aU&$nNQ*!mhINP#b@wf{o)NmlF42W*f|G{q^gLM;}l=}NamNQ=c{ilIFO7N2lpV{0FBw#3R2L|dmpEp_NOz8F(dEl~L5 z47|AXgj;tg#2M8{*eGJ|F;K6p)bzppl3$~oE`i^do>BJc&^YkA(38sOHaM9+K2Q!p zifLD@qKTucF#hO9-@W4(k{fi{OM2L2$NxEWaeR<$E{!SmC*?1bsxo3$i^GXd4P);FSm zSKO2*4tZ|TDo*3|gU7V^2v8X{e$&rbDDcEJr1ZEe#Hn@OZ*e*UcxkKybIH=Fg=PL} zY6p-SP-`fqQ9us+PIOIB4Y~7wInhL3cERR}hlf>jnwUtjl7NW+%GI2NjE>krtXcK$ z*>U^F2@Y{-xW7FyXqp$(oy}Dl*N|Y3_X<2KQ4+da@Rb|v1$Zr21#Q)**vtn361yzd zN^V|8o5IoDa~ZXr&?#f>ZB59GcGv7n4sN5J$UD$c^I-^lD`eIw>|}x!WPI{MgmYFV zt!2SN3_N1Ej3RVr#?iYlU~i0t=cEVykx2#*V7`jBV* z{X8;qgtjnV{9F}g3KhK4JxZYm-#~(udIf~#fa!n#P;nNj>@}1h3l7ebb}*vq64ELi zynv2<{Z0c7yM+R9h2#+25vxWGXweBJ=>eD{ERYCcY4s0jHw)L1al32#oG46VpGgsn zU5RG2fOCF@;Rj7~uZvc>HAJo6G_-hD2OE4iFM-6Zg6Nw|s{vw6H6jC));3D0Hy#P{ ze&rK_{#}t~2bm#@C%!|QGx)^n5{unkz;U%@rIfS%`fkN-y)5inU$#ZD5|y5Pv!O0h z9K~@8|F|GtNAJt>^HStZB?ER)@FoA%Mk8Oh=6*P17$J^Hx>8n@YB(&s?r_3&9_kV? z=_-*S8O_@e>#m0P_!kkiPij@A>w3bfK6X3(u9yxn3My0)7f`D4C~F+}o3wX6tKqqq zf--5uO|-(J#>xR9qqWy>7=>olbU7)0t{CiS+$E){NFPlN(ix_V3FPF4pmwpS0xG8! zpDlo*HdIbeFF#c+UamowA4sS0zzF2Er}F1PL_6a|z+kq}OFtc=J<}C->D>y^xhs!?A@5ojRjiv?ulEg42qa3%(Ag|^D68>B_H($tEnb{Ck zk@zEJ_n^7df-_XZFGr(Y#%r~B*pNE`L8H;$q=Sm4#8%$(&g7d4))pgVrKeP?W>ejy zUx^e@InY43ZwuZYrS#hfExIE=5i}xeAR=n1U7+t{CZGBKCRFH~t<1B>^ zaFNgj@Y7l2*g)xx56<(D7SZkYkn_|9T; zIqke4?E2P*O4{bDh=L!{)9SQfIOlROBy*&zV1arY^U=SaS8k|o=-#@kcuqyG?L~&n zjor&3d~k6`y3|8-)EoCJ8ZngwiKjp3X~Vl?*Ozrc$eieQ9Q9YulE3^IO;F95oz{YE zzveKW3~_elIgU2AR?(#;M8RVnWlW_Q!E&J!3Mj!UhTi}`)RMGexz9)jUAvPD;rr8D z9Rbw3uZ=mcn5|IF0tqfNS7jJSw1e2X`{wP!!BHqxX9?ts?tEVGtLIL;W=p*^^gapExO9%tn&f_!bSnR zJu~H^;OmS!4Vm!hqL^aBGzk}-l|7IqknrnfS7(W~y@l>~Z}sd`24<1}U~`Kw;v@7j z6R_Nbl_Fd-lZBl|GS9Q_HhL~=H*|wWXOBK!!8W;oqs~QszGbVut@_4%sIBW3KIK^E zul@ZiDD7O+K(sRYRfeS#;cVeYQHW1};-^802KcSZ$Ls0Kir?q=^=~Wn6dfa2jk%=P2(|CjO54liE+bp9*jy?s4@{2x$jA*XDmDCGHBm&0GQ)qGD<&T_td zKKiX|LQvEz=76RY`uLC0j`lxBJ9nA?80|j#ygr#fkbaNp@g=Kh%=^5@nK<+oF8sJ6 zB4w02{%;r0kDcgBbC{h|Su7F%X+-NsgI7Qwtxyy>JLH6Q--duB&Q{IVgh|NfaQLb$ z>}xHF3hBR$c4Q$EnV>BZ;NjG57}?p~r4u@K_aBr~F@9eT<^`W0XBJD0>q~xFA>U++ zZ~U^O9W!7tdw-oi&o0{7ud~ToMldd;?@ajmzAxn*n#4wUSR&9X=_LQ1>*9|fa%;j~QrQCl)l9O>6q@r-cc)3bT zxLN$oG9zpgR}@*65yf)O7JD0rhXR@fvceB#q#Ja2MRg%m2{hk(o~^me!OJJLs~@Xb zMs0F^rB#oq3&VCND`M?Uzh?jyXNv(deIEQMJ#@Rz{m}11;9VHl>7&p^!YXiWm)i_; zat@f(X`fpdxvZ>$$5&H2ba*1kHMc(`OuQM1_J;kWwe>sW<*X(z@qBh2f4Fn{P-%9b4Mc{9d4u-tk9}sy} z$HSAl@lXskq$^R`RI8ae0KJTnH!Xc6KY#buz(D3k9($h}X`u8=J^W(e{m*_J?eQL2 zn}}|Rej!!rqTZU+6YtXJ?=wEy3iRf?ZSg6KY_x>HCr;FTv`X!TKyho`EJi%iil zaM4Eb&uC##FWWki3w|gD9FHrQZf4kMZe$W}@^-UMu#?rc9PHWZ`r05T9M3xHeHDZJ za_}|6M^(fYs!l*8u~09jeja30$;sngYb6Lbke^kyGI(%W_J-Q44h9G&jC4!MXbh@VzuJ%9&T|F@BwnR*pgToS$RS% z2}>qx!46WftIQ>>!9`fX+pQ9*W3iTlZ&F0lcKiJ7b*!|RRVjXQD_M6`I zj8cCIm(lMdtuR^r)|S+<;c^$+|3m0Jk}(bk^ox40VcSpPoXl(C{D1<#KJLno1N2Q z%&6dmVP#B#)1BltX(15+j1*oaLvrvfv0B7J#yRPWH_8&{G~-}6qe!itGKwoE!F8-$;xex<)#$eNKsCnq~U63v)aVmoZdB7jwNO z&aq`p7tgCj_U96!ml0hcqD+ly;PE#cOgk83cr_+mU(D}XvYrOnbc(;d6Y+b#vw!hO zfz>aWzO9asGu`e4Yt-UI-wza5Omvn5RnN!ZF|02eKQv-mA$6|YhqvXXZyPm5XF7#% z8#Wu%EM3@LSF3V18G=_AcX~=$el91p2toKwBs3xGT!idFsTE00x3yZQzT!O?p+Q+c zT&qhgcy#56qdmAX|ZqP)$%bJ6U94yo|C)h~w)>h6h@D;79S9tJpzk?CFs?D3i7~)UMgyq zg+2IeC8@2ND!!Qzla{OhHkzRWDT)QLef_5P<3VM%nwKc;_8_&=(nGql-LQ0tUh;!B zgknGHi&ueWU(}ZSeBtgon#ojNsapL<93=^s#YQwv9#?{!vM`Syog^zt_PwC!moMcP z*iNiJs#!bL)6`KVgcW~$78~Z=o_~P7o?Mwe`&Nej$Gx{YlwaAQ+XIB=LVTh3C)y~F zw38GnZJ=+Lmmp|p39>!L7OtI%0>jpPXxf+pLq3UAwsc6oTR?7MoR2^hX1wBaXloFQ z4rgA+h0ci3`3@G&hMngV`AVCX5K|sWC(H{mA*BKttAI8%4`ct|ko+(S&)eiP{N9#$ zXlUQ+^88 zW4CguC3I}Hn%|L?08!ozjpQ9QZ3xFdtjt(A$1Dqkvv59cuhY!dJL<>;Im0!ZD5V?Qmm4{}`Sq2TVnF#ZT*ud= zxn`@h5}KH~x7(>?w+Kj1VIP37+kuH*ocmo7whqjT*!t?Y&Bat)J9T5V2<$EQ%eAEe za)qaEm0xDyWwop&?PV}AUtq#Z2Tf5^@6wC)UWuVQC{;O^{r~|!H-m!S{k4>>qAw)o z3k5WJFBmd0Q}C;4TpmePe1+g84G0ce$nBF-lkHEf_9&bptn7zqZ;rMz#2&UTrYcvN z1%hsM#2WH}8toB~_z)oPol&e07{$Wq4WO__@zJzbcLEa_1W;&M4 zg%P~&{;MtSg)ZTqfjCqBZL;z7j)nba)mvznWVS(Qm1+(NH262*seB+shM$T_`BC6+9%Usv#X5uL>qi|&ojDjd%ST=ffJcWm$@$9MBmCXznwPr!dL)KsmM`G z2wiZlmR|j2wXZDPMZ5cB{t7A^t(^@WEFSpzBPT(mUE92~$`cO()oc&)!g~b1;I+Gt zgD_(M7CtMTFY%HVRs9Q}-E|){kxmb=Y2{`nYsn8L4Go6W!IjqziM7Y)WjARhu(0M& zv*dXT!pMJmVZ4%uQ&j&Y{Q&-_UKk^Q<^Nc5tFXtSsakHcYi8j~r@Vkbae)WH?HvFu ze;~{j??`yqQa-%Jlu^|T8(S~!hK;0k+?&Fk zW~uS{Wcz$*;1;hFLOeX(cjJ)kFx{1vr|11AyC&*yZSXsA@|SsKBBJ}Uzf{-{(BpW%y#doSET$hH|F0I-ebh4f!SVwO z*mn`I4r4$#a_t+;`gIYHM3;}eY82T!8Tld0JEEXjDaSCtsE;Ut47oV4n|}2-Ym}HO zjn6)|JZ4hjl=%i7PT~U8-UPFa)tMafZtqcS$g7PsW8a~ zbYf$poK9}r7|&{zrRmnQevGgYWQS3iovmVBQv{D6zm>a99Pf28B(vwk1k73=m1x4OWtWx2`gViocMnJOQBGD6Y$Ke!O($pm^gP zBGSGX`v&_W^x|=y9vm||@D3S_fyZru4)s84!d-66M9f(BjKsb0kZ2zPHoaI%Qq45X z8tJCmxfGoevtG7)0)`~Qb3Ni*nW@}O3(e{SZ%XFEFe=r6PAVnG3HmpmTzXQZwDxar zf0#6w;xa00FlLG)`uA7LDhpK3^$6UZS-$pwH=u*oB@L85FZyQmJ3pokIVdiD>|obo z`90*KuQoYg&DlX#=nxDV5gU579VYe3QJP|O++Ff7^K1u_h4xMGWorR=WdW!e!IpL> zqh|qoB-uU^)}*_IDuXhtp6efQ+m3h8pHhbZiOuXPZ7T4QokZ?wi#X0w? zI&eboDF)P^I0lWzF>UhzoNHiNdvpFF99SB!V--Y@7c_7R|Ake z=%`{Q=!bBiVCKJ}Qrn=&D>tlN{0$+lL5 zttq>r!&9#JGF;iZZ<)IxQ_lSFog^0tvUKtl12D{(O2*G5O~THqxV+Tl>ambxI;Nim z``58Fw=rnO*Q6FY#&hPu7C+(c3cK{P%RF5oWtE+>%iPF)Z^LDMeO7B;vkN-ww7N~< zN3st``>|IV>Rm_D@%ILhPpNcn^z`}YEnJekzKY#dpOJo5WPx4VdZ_yVqSq`w;WtlmtnotEiLc>Ms6`J{^voBP#ZH zg=({C*!S+V7!D_+P!GKv1-bAH*>fgxVepnz%Zm}6)$8-Jt{}#j5mQ#+ z%&&8+F5MBxiaxgzt^Od#_E3~vn35CY3hgD8=VEl-TtxjNVnP$4_=w0BZAn4Q{vF0I z@+7rvaL!K(FxG8NAJ{Hb!KN3(Lc5Cm2p3X}G$ULJ9&KW9K*+*QTqDYi-;hy9zOckb zSO^BHvqK%0qF=X9@Ru(uw5RC`Uav zs4+>UTTDXPph4QbW~11rjwW*Jg?@n~k%0soff9K@$x4463!m!ul8>ToevKh~K<*eu z!FMtQw`ixJeld?*skXS7+F_xcZKljEPry74RVK%fqv=E<-)TlC^_HPWpetyF>WfIU zxBHv^-GTcd4#E9zb%_VtMb-aIK5Y4sc}`o9rt7MD#hi~l-k zr$|qso@kcN&S)w_=Vb6fMJptG+W%eqjg4Af0GFv0|9KO}e(Z*ST9HnNj{N5UirnF9 zGvSLemPDa&=~C4VG8h1*NZZ$_&e6tJ9CM4a><&v_#upW{y|l#7OpzBc@iEqW%( zkC^Jt$s|?I)77u2r534x(!|rsX{iBxJ$&@~)W6Q0VY-t9D}5usH+T3{SmWJUmDrU?58*nlht;Mp{Lrb7 zdY~_h+pCvc39zUNbcK{Uvqpg|+CmY~z*g)Ya+|BHNZR?Y&abTsP8k|)zwn)uTKLqu zrFA_#QYKm(xf!>LuzK)O%L;PI@blACY>bkp9gIm_Ns*FLQ23-Cb8H+>l) z!a7j_zI#!-o8-f093J(ZZt_sH*9DB`J2`-|u->OUp~px-v&I2n@lT*!m_wwUR*(Ad zBjHS`7`>3>)fw~jNn>!djR&k<{<``(C^;#ZyPWo{vVQaHIEy90Yu2Ct!(uBW^IE8O115CJR z0v5_86ehUkRbdn*7q@1ZlwLl%FR`FrJRix5Oo4DdAOoWhAn;L_xj6<#JFYF;@ zPzKcMP+r>8W{t66suPII7JL<*2r1+*{g~*nnpT-*mG}zr`!@UInm;g0zUpA=x zp_+4JG5Y7pm50xK86VtGGSJ@-@=?844f0|0A}CTVlVjxZ6a-J&=v+evr;+u)fXSYB z>~Si2`vQlri~4I$_?0)~wZrYxKTerPjMp}z*SPi8?RIzV#XnJK$6fzRPA7c7wbw#i zm9jwbMZ$`~Gcs9|N<9sQOzGBTW-f;f zAoDs?Ps}DeuySP9c13NV-7qM)1IUekPnsUFpyK$1JsZj6rr?F>`-rxLGl)ZBY zB3*tX(R?e}Yf1tknAg(}mV2Ek4)YAMnPCCJ<{s4(<02U_jLlishlGCjN^wn!Uguab{6l|*FK@=|bbj8)x54zM zH5LC3k(HFfSfr0pA%}x*rPfaZlG-4_7#r5Q#bN~EL zQ4d!4ob|s&p#QO`_kSbMkme6hy9M!wr+oxZJ+vpSOYa9H>C3oE$A~j|<;YnFOmVx- zYNH%?!R}l{_Pb*B(o7jW!pYO=f%DVd9~u6;Z!A24Ih)<*?S(}1h2rDGd{-a=|SV+-Ub616QcNn^kTg_9AW2v4H!^4GR zeJVyFml4xUD<{5$MH57utaQ7woe^#f{uCD{lJqRflD#n~)E?gog4cr}CVV0-_e!o{ zXCjXm-b$~K#3{)@?xGln@7+i?(}={Ao$a4%rmZZE%&K5bXhNMjcbSb2n%F(zoG{u= z0W?X0oH$IM=k*As!Mpw7QItB(K{aV5i{d)Vs5`%y6x$sok@%#O{RplNpATx&ZJZKR zj1nXe$5vQEqSorkdtnH13L0NAE|RIJV=D({hTYOxI-}httx0?z3Xyp=x1i1V9o1tG z^%b2E zLS3PSrwyymXyKoArVuw$lBL9FneKc_*o=8 zF@CM!a6pvVL)JJ>8k5*qqDoqU=Yy4RNp#v4+t< z$Byx!Q0DNE_5M-fVq?EP!U*`27RUvR3Lg46$*myu5h(1+WWsy6FLxNq711s~CIaIA zTt-corwGY7d7}3TA7=E%T`FREIYyaC){8*JK_<1MKZM2g*;SSmDvckt3TDb75Fw<4`LSdSlsa$CuM1#5Xl){ z_@j=~U8k8a(rYwVK!q>jsrnkhpCc|L5eQ1KOy%z8-C#tfeF&>37od*N(F?yoP~%K5 z3QbP{fHebIo}mni!`IxtrL!mBfE~^lkaXca0xiZ}roc+59}$p|4bvj>MEZ9R1_GL% z9PYsC*u)J*2-gmCNv^0UHfG{^bX&=6U;@-@&jVgxrLl1j5Po#kK`P@c(&=t&S6A5) zhP0XzTm;36zlwmPw)vqp1P;vR#FBr2taP8zfcTrYfQtzUijC7;jSqNEto00IFN>@7 zL@rP5ei??BZ!VHZ({CDc1FBxon(z{Za^%%^_NyiF_ggTDg!Lph@V2x~`u)_MDcS}O zdGauVX^7CrzvMYz?UlyVy8;F4!WVwa0-Q?JJr)#{t-A4GGV+Mou*4UrFj~(eM#{gz zYJF&nZliL;Fn#cN%QA`*d=oGTxh3gGufeL1sW8b-I7Z(21~Qo(O``px(fnupVL^B7 zWWzygTV6=vu%>Mq*eYaNk3>0rNc?}=HxsC%@tl|ZOS)9Q{S8ES9j^T#GQi8PW8qBxY7JYY``&_ynEh+D9@r>qq zTI3P4Q?JWiQrW+~?0m>*lx$7T`Ht!pPq8@BNCFBJN}WyK_Uf0p+43o^+)y>}^Q{yc zKlqZV*bPOa9gj?HdbXE7@TePRbeaU0&5M&LGmB#c&Eu?58#zt*Y%N!X-~er&5o9?I zh7BvBE-$hc3RX>}mLJHkru6PN@ zywn4JqpEW!}sYf0aC6Ww3$oq1OsQa=f zPxVue!I<;xL`&iH0t_C=5)n}UD%SX#Bxk@K^_;kb09UYfK96Il`yUL!A1?V_#{Nl9 zc308f2z{~P-lh#Krd0RRG=M3})XlC)l|!nvG00+DMgucJ+EBFZ?_;~usDE~m-@AUi ziS}LR0bFrc|4tUJ%ZKH7A|^_d_=WKFnNMzpBqp(GT4W?r|8jnfCU$_r%h*2S-R3)f z@!S2G=y`i%agZd5HrLL}GP{!at+qS79@KbkhS!_W=L^lFxwlcd)eO60zKmh+z4;Q! zYIC}Gh2De+j3fZ6jPR{j<3RZBfkagJJlxJ>i#74Y)IF(`ZK{Ig&v#OP-q1C+jGlwogh4hJ_$;uGXH6hXm5 z4?_0T?PbpZ0&RW_WJZx&^@mm!fMbwe@@`ms};_%IsV_b({brxYjM6(~)vgmHmtS z=rE|=^SKNoFiR56-h1k*K`+xtV!ibdvrjw`F|L1(&En-wt_MxA;c|C#%w!NGkN za{s6%=+HsYw-kltyQOMv0>+`hIO~QNSQ5aJ6>UUN09J{^6Ht+Fdaq=iuLDHJ}+Hn4+{6dw*VyDr$ww!bF4lz!B6p2wgJ`aUnPG_UG7dPlWq6 z78d3;kEgrPLln(P6JK<3_3{GVyHuw_s~%1WgoBc%SM30?2@HF#SBA}ecRP{MSP2Xt zrs9*}n@G;;O|K>!2fRpV)f$N50CqZrJLcQBBkIyG{2!A1OT;44)oC6yWPH#B=m%-g1{gCiqq46)FN2181dP|iJU8D{)FkE#yuIa49c2|}8*D5}_OWaH_Kj^RDb?8K z1h};|F)HuP=T1KKcJrV=0@_UXnTR@m579N_CI8UP+sqx%s3vEDZup~0mbI#K?SEq` z!?^qY1*tnCmDkzno{mt0&}7#SZdosDO#2xUAT6EIX|5dY4lU5iV5M*gFa`k-k2*j9 zQ@FsQ<4{)^n3Tqe-ypGi<$+8jiU3O$X^Ga}=mA|EuEFT8B_6uoC@LQ2>KAiBV>e3Q z2n_CWU31)69EY(t z=_5fRyh+PreEmG_C!V!S(2yjlsX7E4rMR$8Wn{so7W@-)(5xIifJozQNqS&M7avbp zJvl!OP^kN}3{V}v*dWB95~N*o_f8Q7zJnGD9Pl_7)kG8nlNe3UJhyHC|p0TV-<0gsob!|TwVrB6K$Aok$oe&CI( zpDCGau|hgNfED-wQFjp(Pu^wLGFPsRbt!4E zF9%#U#8+kHb)aAcO4S!bz$-qDYr~J4_GO#KH07UB-tGNy&j)^KSUlZ-i*juL%gq&l zoq>gi2gE-^sSzAFD1!PK6| zm*7o14}!jeNUuRhlX(&a^+cjiq!J7|Uy15VgLn1Ht+Up90l?vb47+^oh<>H3KsO)o=!Lw4yyh^~il>{f}LcYw)2_MP80mdSv9;`b$BlM4IMAacDIO6KpTQ z`!{*^-Z`Psf9QKoL3i)h$cWSBr@Tf%FnKqhE#l_ViKwUVJtaM|Jx>J)TG~GEMQ?8* z_!)>r#CRY5pmmeEyZ3Q#;9Wpw`mmaGYz*Tf!nV@`O#IwmE%|s!kNC{kDrIw?T_1WV z6~C9nCLB7YL@f5^F!m3%@BPtmuTA}Y;V4POL<$pCAy35$jP{r+zTgX5AO^T;GZEp= zLC*r=a|x#OSS;()>4}PY@fJ49Q|iX~*)jaHX`vF$)E0p{HYqx0=8F5@z0&UOR*6Z5 zPlTEDjAkE#EtlpcVJ&Da=ExaU2EgI2RJ2R?>g@6~`@r!&*Jk!Ya;6S+ty-aP_4-o3kk); zt-X6VB0H}!oN6Z*Wf2}QFYz=Zfa>LA*5H|H{8A(R!6aS-Gn3k_e_LBYLI6rDlIK8( zI`hM{TXzRBW9YCVrw>UwhF-(1R@+*%?`ecgszb9>NcmN`L=T4Yhy?AZ3VG5&$k>CVh)hqBSlXl)oNY(9I?j=s-8W3-i>* zx89LhY&vvMQw4XTkRiJJkQze>yrfuR;oYdAc-o0KmChyoiSMIN_uvtCEoTDp4DM$n z2}Jiv)9t!Y(vXAno`oyh=;7B+JYC7E*EsFCnF1uJ;yPg-u!A`rh|Y#m5Z#T~X)0Fn zW2u0PIU{sIcPX)dn`)L4PGS(kAP~Jub?P?A9395STg)UuxcigM(ZM;3CB1JLJUW6;FS+=g8FCO0;RZx zkJyS=+Cs<01!GJ{-(!^NiKKP5Yej1KHCkZS|-RC%B^SvzA3@~6Q89miPh?}}s zdh0{Bb?FSGn=63hz}xj4oYJE|yfyNpbZ3!5!ykQKIYK#MipGe#MMW}hO6BWe zeUBTPd@qy;L2FUBgv-NE5+UJ;;*y%Z|!j$6!FR5VDmlDuTRTn}oQlQO)<W#g) z%xc=lq+owwdkPs*lv2KH7{thGxLxJIGh*jQA-D<}-x=c&2nk&AxQX!jXN$@Ac_>{W zJ$q<5wCMzUHiC|f^}+rvhS_|L5iT@sL|QN0_FTApeulkua<&283n#Of1J44n_N-rb z*VI6obe&0m|ILvqdZ{h%w8jg2F@KA}97BH{q|2=}V#MBwF;ReGjj3;eB$w;dEwWYZ zeRCc?>#t=7h)QI@k3?s(wD?((*~sk24D4`za=6_GC*-DYt;xsyNXXVN4CGzL@ziui z?l@5SHIQjSwi6uq@Iw$#+K5X^?)r5bKE?wuRbDxrZcD$Fo_eM!?4&68@l0%srRK;u z#Ko1aRI=q09rq+qv{rwm>Zq4%o^FesS|-i!8ks4vsW68*YjF{dW?FM8(@yf~&%Zg{ zC2}kFInXv|4nI1_A3TR|B7aziJsY)j%j+NWT9nC0uGx86OX490?`L_h!y*!k=JY?% zc3@+brz;wL!*+@yfmf6nb`U9(`0Q8qtO9;-Gn_PO;CMN=;vbZ6g>fIShjQcrf$A$u z+?EQtq*M^MQX7kZPh#ET<)d$5)`zg1!zr9?5mk~#N08k`mb;NO;I}ksMA7g@B8aBT zkr;IvQX##SfsY^j3LG1RFu}c3 z!^%Z+n=dAfy~j?i+{2Z@20GA^+B8YOQgzFF0_W--`y3i5Iu=q=wk%i>7((t2`|Joq zDKa>h?=QTt(@XZc)n&m018KCFo1KfBsM~9~pP(HsV390w0_`CZW)mXeIG5g5{K4URG{T;pgoG?o71MFOQwGgtv#QcN6|(@8IHt+E*V;0 z)w5ZBR^%e39PGnF1^TPduO-MyM~;fqtorI9x??};*{N*}qm`ZPr~=GEtOPirUX_B1Zn_`hJ5Eod+^gP_{dpC^dIKri=pC8wruF$*tnXA<_p4YK zF9rtYlpuXp*g~KPtNHcn_E11?ji;;{&L@^}FRx|dVJ5}erl6}rMWSyPIKx?C`3Z;Q zjPgp7ZYI9zVl=D@_i29~NiAT~Afzhjb_t7kOjg$-Zi)3TBD`|eps^};MKhz@dP`Fy z?REh(IJS~X03om|+W{yYhZet5UR#!;|W6KbR$_m6K}9 zzy9{i<>%EBd!7>;LtRU<^E7=`<~NEeYBs*GR6GF?X)r56o{#*bnI$tF@Uj#Vsg51+ zndIV;Od1*_EnVbwb$RZ^IIhLwB^Ap(!wVk8e{>9>1i9FRuwQ6Zol&p^f*6h*$QzZ> zO2Z~l)FJ65ocskW!23q3f~X#$0;cngz`F?6WBCo{x;=osYQwApzIbn@Ekbw2B_et7`Ygt4@6Q5&~z;S9P@YrdS+*;g(cPcpQs&`ck!gSVfjLCt!qe{Ft z;^jU5%8BDN`YqeGpa(kBrhu!3=i&3FM;|X=dw>7~gOQdbiKa}sZQA-pC!z^c0xAIb z3IKnd9p8>J-SYXI@B#W#xdi$zqdFtQ|1zpG0{$-^VN*jq=As$#2ZDV94>RBe1nxz@ zgE2Za)&a);Fe%nH2=N}@gHJo8AD6FQQshJ5o z8FF}^;<{V%@*J~y48NVs`!z=G-_RSN+HEzFK`&+3@_Q^WX`-d3r^|tMQToP(wsj^) zGdzR-)#KwCU334IZbRzr8137!9hA3iJwp+IxMpobxSd&D`a*{)4n~}`9M%!)Qhj@! zFxzf&Cl)dv`XJc;qUMuqL690s9vz5W*9f7i99r0MJ8oheJOQuU>D^xMJ*`-L^K9dz z-3TRRi%X(0IJ_)COE=e>*(!Q;m2-G6co4+v&AIrqcX86AbZz*6WL-bS+Oi=0b*$@n`7EjqeP^$GF>ZkXm`*A+jBsRK$-G`SwR zC*G6iDwX6DXE`_j=T-YNEu1y-2enZ}y)cw+$S_>bC9Z9kcpHYIn#fNEN|X989SW#g zD)5icu}GYM*mFj!5gk;?-q+C3vNBT+Z%;gl;T1SR`iWPkxI}9PGBTO?yaIStwTGxC3CfB9VwjsGd$%YL&1!-8faKr9g%~qh%d?4j` zm4O<{!jxo!wb$@0jD{8KSb4$J#+Kq1!*{yr5+rHS3vN?7t9{LE_#IFc+OXfnpYq5t z_{3y!A$UFm3~PVY`V_yLOg9Jd-v|^t43yBq&i%ixitzJs;sl|n!VWKz@`8Jef6ucO zXKt$r1eFOe%zjD_*7N8Mgwo<8Ez7-I^;Ga6;E5>2S=MPDU<~C;0ld9VBK2CEvFz*o z9_e+jmC#)V0^1F{F~1d=^*kRkZmt&z-$Q163(b`B4B%A%I6Cpauy^p9s*ISX7!WU6 zI~3oQg;LdU8+MTcD$uLyrdwU`^sX zB5J|sw}L+$xka>q9nbv?ED!O3(t*DfQ6>kQlkr*8zmRZZ=SDA0$%R)0sgVixJ(Z=9 ztZY~YYQRML^LD^`#&C8fr4N7Y5mu~A%UagWggX2pk4DNNy>$+oJes(37ZMoJ zCt^#4R)GU8!qOAjU#Dlh#&8V>bji!DYh$jP3~Q`8;S;iw<(R6-J7E=C3OeNET1p8| zBh$@-nuP_WsC;q_1gok? z{rwEq&+79POI1JUeJ^FoCl~JGU&77Lj8{*D$dtfv{MBXdHyI|zFC$R1&r zc?ituwDR4%c_f+^Ol~e!0F^ZVh~$!Bpf<*tAIHI~oG(4LQ&Qz6Dj}1R0Q0rfn47q1 zR%aZmb%}hqg{I5i7ooHHqn(|&l>4)!Xd|21q$DEzWD995auy>tU?&IF)%i% zdhfii;R4aBG}QBaah~Aksud+$d=xYdH{yt<6WQ>F0dZ5Q8ssb+{L#`7C;k0g!LMDi z`=z=L;xug36ppBQuEJ;i5ALXo%DK2!>p^pYf)Ph(erJat*j?4`O;u@7IOfzn8GxXh^4{ zd7Cw`qof=qGh`awG(w!!R#1g%a&6GrClwY#akT6d1$=bp!e^~E!#v*0yhOZvRkVX+ zgXQYRAQ{wEcZvEXEL&yv*pnfZd~BBcvwO4i){9;co___IgeO=?BrFs7S+CRa>F)iK zRK>eDZn1wW!PBS8J$Kuz={Hh`pLM}*#b#k!hk3w1o64#^M_(&q)`=Bu^lEi6syD^T5AY8dRY~ zp`YT)TBN?3RgqFTa$dV<&N(4twa3dJX;q`ujEJ>Dg$;jWB9|d>#x}3w_I1)S_-l0n zAMZ(_V|qYz^ADmH;!&A%aJJFvX(#pJ_F#F`7~+8QGO2>`BjF$YdCd}-I~QFq=_qa- z$TeSSZxoCu+$PYm?E^ojJaPLYGDxFu=LY!l_=x+wOM;y3>DVj170x}&M-6;v(dN$q z0T3;0fGf4?+$Zk>KHX8tAa&ZuWnJy8Pb_2oz zn^*JFX+!hnaoR#Ay9u@pB@YqgJCH-xTa(fBiC@b#mhHMb->QrLlLM3IKbTa3)5p`=|zD zH*L!mz-i1oE}hv8KOrP0iw*`E50SOg1#-dBTh~V<|G+Gs>^NL=bAOHq5BXSf)zZkD zEj9C;%KiQkO@5gYMd#g66+Q|8X148^YRHQK$ZFaZzdTYhZh)k~6*O3x66iy;iP~O3 zZ02is*=&5`nRbA{Yvkk+GF6EWRB4r73uxRO8s7zyP)vd?BA(JaV;YoE^8&7yG|OeK z6d#7b#E3dYr`Iw+QZmi0#&wYAiaC`#>?`x?EeoLYa-3gdG+Nk)`V6>foVJvOAf5c4 z(saC3Gw54A+)_Y)M3i2m0^eSW!z;G6xbzrM*3X_%>oChJ(H-P84tlYXxzG}by+<5K zowjpWGgF@9DqJM0Z}J=8lFo6pD{@K?A(!_pk%jx{tP!uzeU*C!Aq(x}inI!qw@@){ z81S_!N&nm>t$ZtA(y8b-iW?^g|7XTBcjuudn@z-xxwYP_Z{g~cF4hvS0#^*dQ73Y{ zOv7mK%8`k{75xUezwt#v%EP1q_c@AZ@;y8LGJ2d$*-7>&u5OaY0l-3mU4~ z7jmU`3^bxsEIJ-uX{^K@@2qK7%hyu}JNp3#)xQ%x@YAEX+XIf~k5aM^_g$9_Yp${N zH+qlx(ucFKv;P7}0l5peNxItm z8Z8#y%T|9{d~!HQkurw_vRNF?ivn88LuPWmZ*0~e*Sr5)zG3=b@(qCX|4M!i|D!Z* zM*LBlK7dF!gck|{2WW$e!5EsDIP;@%Z^pAe^=}QGB39>qxV%3TW$!;3RF8kQt;9H%?8z=X`UB(U9l8Vg)NvAB==8?} z(h_^%t#xZMFOOwRH@RM=Lgs59qBz}TdG~RCa}fHQ^hc*^2zJsS*r^;dy3D|g#EiOf z$n1XcC}j8dY=1L|>0#KKkzfxFAM;Ib6B0StHcW0_?Y;ng4fk}}n3LoB;HT27!+wup zrDL>g`(Pii0g8k_zRquEc1xI1S&n9Ac$Ia&Z5#b4NGNWhe;4Z!9xSB20a<`xrDb1y z0w z7)k;$U3m%0K-Xd-P~Y*W*>VdU+HqPn!5tK9csO_q{}vJ)USN}`Uq#G>Nh%NvPX5t8 zY<-YPusoFuhRgkiO{?OafdME+NS1bLao51+$76LD$NZXknwD*n)7SX5gCSh=s7ykt z&;1f@`K?N}0>}6hICzvb{vo2|SCBy%jnsn^Wt*wPmd$O>yAu;TXx>u<{Rq5Gja(yN z{UItSEy)Z3Mbfk3aIzB{tjH!@CK<1O?bybUn7R@@!vZ9=fv?lCNrPN|EK}D#`jL(k zrq)^Va`{5>K1v8q7z^g4>`#5SKl<_fgAs+x$X)LNe{;_^8_QdxJ@ax+%9_?Ua*hpc zBOnQ{;hb8b*J}!tXzA(!3+G5}h@uSqlIZ6NM|@q9rAb#;w0*Y8Knt6s*S3yyz*1ulEF)u13wwLOB)*w~)LXOOet@R-!Ta zP{Nf^{CpG>$&4xv;>22+Kx5We8{rHogJb!y#_vA%t8~vAn@Q^}&IF011bXXoiMRz8 zVG{;%tKvo0z7DnpymXbVAu5H+NVlFGpnV4xZiV~%)%e_Lgh9Nn@=V2H*kMi9p|OA# z&Of*hZPm5>2aU0C%-Ztiq-#@miT$7QAwR1(fOpLfu30NFFd=NSUL3g{$wh|(l-wYA7}M$gC(1i_+m?5e=Zas zTiT1Z_x5O#5|5NNx_Q7Gs!WVpnc|X1H9aAJVYJkBNC(}X36Z$_Zmr<1^dn}MXp|)Q z)W&@k5;dWICDSR%%1-qJB1u*?O7v5OrYz1`YCOKfZPIjt_A5|Vb0{-+jw^SQ9A0X* z(peZ3YGSWrlqgu48!)l$lt%5I+T?@3ayK%_JXSdDc_TECm_5w0!XtsAbX3=$I0QYG zjq7qY;5#d}5CYTa9Az1y_dRNmJve{a2@AUe8FHV7lb~8VO~ME(B8Eg(^8X9Pmx}X} z9(HFQ&REpFyrAZih$$=l8O`lBJia{Xl!DkHB#EvTS=Lu7VwJ!?31i@fD7%zEK)}pI zdr zd)G=0GkaL6uM6{%MYnn>(AY5R2{2@Tb5AO2&i&oUzF9U0HOtG(CNcG?uEd?=k$LN5sJePBWR*9L&$ccGm7H4v_?#;y7?L+BzB#6J^|&ph5J;4m*3?sZlQ1_KD?ZXEBCJ7{RML<6LNBDd9DqxsjnVJsJ{OMG59es z$uvvXHcF$iyxY&PN9)hQN_fTYJ90xAr!m-Ef)g$Ee;r(xX~AEfj)3)PaEog{DnCE* zwtFO7cZ%}Fs6SV$n9lN9cRjru2bQaIiXj)NC&P*qI4>;ef6?%aB?-d+PGO-I~*w?bYae04M#%DcjSA? zWQhl{@pVqDrl2g>m`7h}X$ifh>vJ^SvYhN{^v)NdnE)mHDmL==vzzYVIY?T1tSC!? zWN%Q5t51~4GB_>i`9S~l;p6{r^DgWEGVe0dv-}^y$dX3K4@T=hxZ_Wd0i#=K-P~SZ z7a$W0S!1@7v@7R5SZCz#?pMnCQDck3vqlYczh$jl5l{r;!bvKzQq{orfP2d-UjycyN)Y79}?XRbZNjt5zMd|vErjmxZu-+K?JpIZQ2^f8mzCTw{iWgSd(Q-K ziq7>mEA=m_vOkyy-5@^{z7TZlw&Y-od%P`><-T{v>>J^o65GQQO0AxmmYOLDnMhA0 zz_wVswbBbpO{9an-)qgM@@wN}AXUzQt?{>A06n-e%wF?;upUJYnKG1hf44EfuI2%j zJg6hsKoh^D`r@3~!sPxysD$o%5B#Z#dT?aD^Ir{m6~^(XO*f*PVsobKxIiKw-m#Sn z$Eu;*jD59rZn%6J^^7=vnEKNUZd9I{*ci3vZ!(v&{5@Qyrf^U%AtbCUrp>HPWcu;nn6t6gFGFDDiB(+R-?OLLMR_$ul)L z*G7|`z`OlOnjj`*Zy^N0^5daFi)%rGI0(fbavwo((0DvkCLEMeT{#nS5z-r?d3-Zd zuN^5KlsadERTZL>MHqNZ>q@qet9N zZdQIvl#Um{RS8|w(uvKpbPfIPt82#e|1tKC&6S4jwsvf@W83ba zW7|&0wr$&BR z;tpe&#iLVynY>VflP#pAYm%}#Qm@l=4%p;fa_%CA7|e-sZJE*{O>3hSM*%UBa>a$n zf%{(P4vE-^TD-U}aFswy&nb;S9wmWs!eIC+QJO>vB>9IU3>7*()-!^Ygfb+=%h9d! zZ-&$m#9Sbw7^6@!W)dzD=eHQBmHi)OOVC+gL!TWN^^;#U|B2nlX@jbdQk$JQyz2FD z2JmTWKMUId4KtP({GTzS=9kj6(cY*I6x0Qjwll7^44%6!*}DAeIEtoZ?tfK0>eEN} zDtHUCVKdiq?*guW4)ep~CT~#avP)b<@5|BL9aE?O4lXTAe7wEzZ!E`H-eTZ7j~#=R zixOhj)s|ED@z{k+^0O62%S;-X2v&sp-ykuXS`eekEeS5;(ICb^0Plnl0^vH{t;z^Z zh)X#khRX(6)UqV^#^a~WvVfvaP9!e<@eH7oET^BqBaXn}mPkJfcRv0z1`&7eMk3}* z#v=BZAK-&#F~$XTy+aM)M94Z*5lUC3n>x_2MHa$M+%sBsK{1C1&Nh2umv?n>Fxg=Q z%gkcqWC0aGllL{LI}`dcOoJ;Cv;3VzOoJfMo>9V+PEg z&GoY}FAwi~Cpxg4e(U^Ohk!-4Re;X2Q#7|rm4Jr46`Hxf5iRu#Nrp&WXkUw3)HB?& zY_wDtpMr$+ev&vz9=(uP1r9g8tj70a?(wDPO}cS0n_BMw~bo;jz`vk=7!u zf$8oTIEg={9f4Q3@IN>@#g$HRORd|uXxn|~v;}pR$wpk%$SimnxLW2n;cGz@RDL-( zFOKC$+IM*x`eb{AIBIg7WuW}UNVCvnCbm9 zt3hOiKDmCgxQap`gqec2GZg-$El>YVqW0@P6?`mVuWoi=Zy}@Iz60=ht)T)$}~`gb-I=X&CAPKYnDS*___&pfVA# zTKE#qD=~1j2`hRl*a%ZczHq|QZ<6ckcpV{*l_H8-3Cg2F+nqw%1`zyV@*gPt4h)b+ zha<0Awga6}tE2G^V)BgjL^;jRaq)`q5uGqoSlcTVy*(VXG59&2kH+>xE)_oSJ{A6E z)@COE6I2@U^Zk~6OnOeBEA!u=I%NaRaBMQQAS+}PaJ!fnKvv1El2S&On`R*~0q$F) zK)upHI4gICavdUE@Prm3{$y%#Blq`P<{8Bgop+$>>KhL~&bIyMs@QwG!(S0xkKS}H zkz0zN(nvp}`iFKu9r7_Klq}e2X_aP?uWMhQ$ofQoljz6nb#C;Y@5gSuv!Uc%9D$ae zeSvrcEl8O{ixm$}Gb+>YC+ff=lvw( z4|?JiaMFR#xxF+Bpg8wE6Us9ncAHJQJ6-1v5b9egy8*nO=*sb~8miT!CaQUR?m2QP zqI5i{9F5um;v&M*1JhFm=%jFve4yOq^io5^)+->|ZO*J2>BI{ir6VN0H|b-&v)xeE zgNps;@r_7EeP!p!)JX%WJ0x5Rx>rW(#*QU!k(zr;@%KgK;M3uGbKR+dAC=SH%$^C6 z^gS2TK}KoyUvx~dE~V{L2-sOpXc5`%zCA=GxS)z7n^P9@++9brs!_-SBwXj46PlWn zPv&_2FUdp<>Vt{!NICZ*T~hp?znZETEAIF*_=P;{m>MA}wGio4>RP`eHF^qY7iE#xz-koY9uT1MlXT9)r4R~K;62;vAPc} z>y{&wx*tjlOY?wQ5kzDQ6Gh#=>Syw-TWTr#i>#Fj{iiRF-xp;rve&$SzuXbg#YRCZwr_VXT9 zC`#Y@$lkhmJ|6yBq2`az1}GIq($O!1rA@FK?^dGdM0Yy$xa>9#Yu93YqeO#DeVZ_uMQzhJJTF%iEpT3GyZx7XGYrnt217qdB== zxz1Oa2PALv%zl2`R>!=Z!cmYJ>w$QrsMBx__{Yrn5dCH?CUky_L$B}To=f{LMJE#L zJHOTC3Mgh(Yn?CTey8;%+$@xg1W{t%x*7aSsDNoz(RN4|9v#)&QWkmW@DzOy~vr##m z#+au}LT<%mbaKc)uI04zwCr@Gaf;BYqBRAT<_~2$KvLgTea8T;mwlqOqEk7J23@Dx z_|n~lB3p3*A96@>7jd0t(wM72!WJ*QuVD|rzA=v&`Ob{~%6UTqY_YbwCYWCaUx1QBr z5QWhnG3?@g8aY8WH(gvrFge3FWv=(8iha8m=96f-Wf36K@_!jQ?5VR39*Zfa`{d~D zy&#g)kX!ON`m}wAVEXhfce7vnzOjGaGI)SY@jNqnYZb$qk+){?Gcp>yJ-rM=9uwB| z@cp*K+-~)wIeEeQ_BpV`)%_~(&w=eyZb|B{Uyh6;M$)Xt4C4r;LHSM)A5&Ab$J+q9 z2HZMRG}^>_6$zOWdK1uZjV~L>f`KBB((LlnUJx-z3HNP2j{RZoA2c=T=vZ&`nNTjg znYQ)K`cH%q93`*2<&2M%QZ_-b8QHkZ-r^&o|G59B1E2i7O+nr{Kkr)}Lc9O+`cDF@ zzcKOk{=dL|n=(cv-5+rO_2thDL~&F800Ut9iCaC}$;`1reolrke3Vk|>Vd{PGYI!* zxFDdJmUw>W^wWI%aRihSJ5M_|T7mP^&yKV7q*55iSQNJN=-%J)4x7iO8%dI$ zw3vY=#t6dt>5;w7@S=dN&NB)JZT3|&)<1>fSNsM>$!7VqLsv#sE_WwXeUOIeODsg* zOlr4`B#9UkW~~_yS&SZ*!XFC{#E+47e&I3?<^9}+l8V-s<|A#&(t+;bj`rjFWOmy5 z%X8{ibl8B6S-Iru3TSgR4v}dl-D-CBje}|*e%PbO@%D$%Olf=4jU>T%hBxkJ%XRhn zjp8K?UL*p4PxrCJXs#hPp4Af(iz(dd6WS7cmJNU$oapTMhxfmD3=Y!4*Vz0ydQv|0 zsrNk2!h~}X(Z8>Ts0ka`Q{{Qch^|^{Wj0HpLp4RQGG;h>6?-TW1X&7z<}UHm6si{T zmdCOa_ZHiE^}<54wRND_cnV*Wya|$4QA?870I=sQyDfWFd74Auqng69zGv8UZjQSK*at6NrvcaD~N)6`;Z}@w7U`@i@f+GASt9!~?m}pN0 zOFd_ynXyJftU_q}Qw2x(fQ%S_H%40G=uS7bvE2P17=5y=}uHo0QVBJ z!n(YGkWVM9{g#?r+B`yGMhK~35;Ru&w44AJ^`n}+dHj=V6V6&j!*u31(+0+`bSsKd zMr$ak$%>$R9HDFWIlxNl*>jQZTB^Ib?v9WtaX@ef@~agICfvSsIRg79D-QOqKz~ms zgl8`)nb1xDunL%8T_q=gVj!=f^*)Lv#0YbgVVFkdXu_+NY|`Zn3FxGk0q?(3Bo^DBj7fT! zZ3hvE;|E-FPw4{Y%^=EpCv9c& zc^jeV{a9&_SnkPNi*D5y>xSBzVoIRVm1Rq#HISg3BIc)iEeR49Q0_f?Z55! zBa*giFlq&vC_XiNsmCk*Fk#e#!4s1+?>soU9am+ugKneFO&*l#qeHdIPQ_zY^x@&~?=qqKeD;w98Rdm}$cBvo|q@XDaapCpT&0e@^5h^A&LZl>7W-=A_(!(z= zB5Xg7Vl6Dinka<8bk+z?JJn98F>>VF;f}G##lm)WS2W;Lj4#A|aMI3dp!S!RmCPiL z-Q)Elh~UPYqU%F1d_2rE zznsLq;zP=fT}G^p;Y!#YCo6xePn;>w7!2-1=3q1{hV6WC&lS_ig#xB6%h|6-r$AI0 zC-V}GS{v=>V4aefZN0PqFaQOn0zAcloQ&a$yTXh7$ESWSbfrni$Mu0lZxYI26-zMt zo62`2G;zz#Wu2vzB?MHuzsE^mL!8` z&4Z?d!ut&fDGC#Y+lM%IG7B_O|FgB zUpoGc_Df#4A-*)(^vS)sEWfDxjnb)q`ft^wEO&_y*9t7k(*vnR9d8Q*;x#YT7!|Lx z=V$bnNVco>9wO1BoE9xD@c!!bz|$lTbfj^3l3ik#J)U1K5GNa{hM%ZSDH}B}`3(E7 z6#Zx_tpqbKktME)rH7^Q3ewX{ug+EwyT+9t*4s3IGHeOY7F(NcMF|TstWZ~Zw}v|& z7zznMtV$a}^I`0ufu<+<1-IQl4XhlgyC}|+@C2XNDX5PWX7jBN*=4}O&h*>E^8x6RSqu}9Ys)sa(p6g9y*+g?FdWD+)&C}q>1dq{{A9@k>0 zz9iDm$FA_Ie*C4kn3`WLPC-ZzFfO#Yj&#RGZ#-%;vSF-Fn&o zw~0!f)BV#ZT9Lwc4vi)F`Mix$#-^ZpaQ&_G)%4-8*8#4tN}tWP2axe{SBze7HdsJ8S9^mz&8WSxR|Z^V5ovQ9Wu&P~pD}WY$d^8dOx7xOA(7ui zE!IoG#UPluBTSrE=~$r$&?^TD+};tVbb7 zi=RoRby+h)r8&yROlGF@Q<;rIZB>Oj=`s^_uj^qJhwf=LtwL6jRv1Kc9}>}v(-5Je zh2kzJV$yMg^>XaapiurQ{5MHu!+;YTSR01eW#=}4^}HeD$W#|dN8u@w-8}cJl>Sh> zyR~+J%15$0(S=;CRbV(es_Alth`>{-8@A&p#Z_6GvY`436SiXwa%RhNFSpGM)7U|^ zF6r4Sd7{G^Klv5 zh3m5J!lLNAvK_l9vspU4rY6A4JdPsbNw-D69O?Qe5l+|U$W(}uFxb{K^d5B@k7FX)VOlppoa&c?(O9S{l z2^lSxmCcUDS1XyO0z-~c=#zt)>`WPt9-1Ge=`T+fMp?s_;V3taf{Z<-dQB}-raO8^ z9S9l?dNYSbwsa55-^{}F+HL5}?Fy)hIpl`CLTqz@XW3ew&dJEg`oVPDy)Bbz_bv4y ztNR6K%TdhV>8hHhz>Ioc=M5g8amu{MD2)sOT!QJBPBOK$g_Uvu3LS0`Nb)|#1V$fC zRRtkQKl;I}O>p2N_eL!JkY&Zp%?u7)WmzdbpTUP==$S%~_Jh#?K*J@oMLs|u+$Sli z0g1P;5dlOT(^E4!0;SR9^gEQGEuK zRys^?3d|~ryHKpOXpT(>8KF!2k8DNvPH4wM_2EQcel|`@Qd?tj4O=k5C7>zF;(y$0gzuuJ1eOFscfIB#na_;nuKo-vnbyv09AFo8Ll5O^ma~%wE zN{X^ezo#}x{M)8h7m*VkL%vCi|MUo!0+JUKI?&=6=4oaY;`HxGorSbG4QdCW|P}(AOe)=b@zG|1Ou>Apa zKAnG$h|}l$@$|_#0kE;DFcq}^6RcVnX#$dYO)BFGFPE!KB{W);9Iutjo-l)kJ8DF34NPB7U7thkhT}v$?p;y!>CU`j z$QQxsGv>Zh$03qUvfNkHG71Ap&Vu51!Qz0}!eOlQss}Vn$Q}hn-)S5V^Rx+j(~6e6 z+hP~*nCbe{`9yHz*2z$2Ei=r!AE(oYB5Hxru-1q>2ri>jM?Qh_--1^-t-X%>Zh$Wl z(+(xUfx&W@_v^9up|0U}aGCkcHskUt3)xf-SpTSr97Ml*HluYI9wAP1=k{F&VKwya z>S?&c+GD5PvSU}7dwbrv)nEAhL@weoy%>cCei&?U@8fF!{H&n`6A^zQ*sLJr-QsK3 zr4+^QSpyrY?}l0}T!=@bZSx8yWUwnm825GraLmpl1P;>%UWvB0sVFIN15!Rq?RWtM z2mKJ{%m<#Zizl{o&3{o>oD(6x`&a+Q6Rium-H~{}b$-sg|D$h}BB$_@IZ*a(26}GR znREXmzkpt*M+0%1wzV8$bE>Z=Wl`0+3MXJ)!?_}%EylN-4prW0ZpU9AB_*xZZ0!Sr zrFO^80BcktGB?BxR4H$*2y~g7t3v#OP*Bj98OPR{d*wB7GtcYV^ftnV*G9(KJWt@3 z$mq-y&-EX9oz6AxM_&IchgV2E#c*+-A(o<%3icm;{mVX{cY8cwDSe=bM4Aoqo|YTA z;lc<%ZYzYYn1uKKV!+IP$-j$f4>WCUQr0eYUAFn1RsMS58Q`N%oPISQi{7&_O?`tp zkBp|Kc8z)YUE;MrQYsKj&NbfO=N(WdyJ=|Q)Uvj1x?AX;}7r7(Mq~*QDebt;2KlgjjYbb79oUG%v z0@b)MDT*=g8TaHVnYsQ(b!-ImsMwfv@6s~nO+#$YZ2}I`cmqMgc!lv}p7Y+6-}2bE z*~j4FaSfh3!RO5hfcyCu$tF`6FLSbHaOl-Y5{A%W?>r6gRO@<74i122awaSuMQU0a zR=RC+kvUg-OVvi1VQA+#cEd15lSF=V`r21aab~)sk8olyNo}g{)?Lgr_m1LOF8QS?!!lUR zO0txdBeVuQgXBh0r+9P*HjS(k`ZOt0%O4==N1^giD?$pfKgP=&oFNv_r*Eo34N+-- zLRc4VdP1sduI+G*zltnAk)z6l3$7JpzkZ|$cA0mZ_s0(+>emBObga3~WLV0cR0-ci zBU~-j?@^q&l-Ct?N#7PLx_JTUxoo^Mi^^#5FnT_I2+7&1`mG3PU=FSYpUGj4(<#J( zCd@=6=9Mz!`2;%-wD)-`MuMe<*VzV%y-*f4xXvcxx{FdcLn39|!qOITerU>i$zLRE za(^EG0O~xWEM4~3q#)>vCfs=}L^Cg!8`)s0greoe$aF(1gBV<*UwMxo;ka?g)nXJ9 zHDt4o?h4gJH)#wLdAuA?UltM73$@3|nS*8n3H#S2JvZy^;nW{&38h2Ca%8!Gnk(|m zciK|DwS~gGuX;ImL5|YAgGtB$FXFG;Of4a_QV9Kn{$T4yL{E~}3J@RGN{=a8pwSyQ z*`nO&RPVcMfv#M0yrx$XG_sVwrU~6pGAUonFOni`{NZAo4qS1-FtBTRD8`NwgodfG zWTWSHgw^l@)-!c7uzFPF(e%}%v--+~<9`$Rr1x*qEyDktvU*cNu=hk|HcM!BTe&LI zZ{V_{hD4;nTvrbf4YW)OV{j!usQ*G;w^GWK5{%Sv^C?v}x??$;$6zX^FnqgmUts)< zb7^(;?a1crI~=u#$U2S&M+?hh)*g&!wGYf^kS@NL&Kh#7 zov?(QOsJ{JH>=8-VpA4NR?!K}x8Yw98{mTv4>U2LftqhZH!xXA|HlDREODsM-K?j0 z{>6A4+1Uq84((e4jTm_sZ3xT=V0A^{j*@ZMH+sBR`&V=aX?ozm)Td_ow~9qE=s3$| zo1pubY`7XU6l}88ux)(mwC>jvUw1yF$p7?0|G%SrnAuqVdwSW_8jWH3_hao+J%Hr5 zGWaou0yX<@06u>9A|{<&>2G_xULO0iRJ1iCeSe%{)&xx>HjQ&Nm5Xs(OqaZ`SRJ_T zUzcIdsWrNvKk?;!yZ>FcTgT@`LgyD*442ERi*~g%vcP1peIIML*ZP-xK~gxPsBMx0 z&Nh`Pf%M?@*L})Qd~qP4_Tu@F3XyuHxVJwHfD{}aP9E&tjkw7PqBx{3`yIQPPSE;Gq0hI_BRknG8PNpEvp% zTiV>6@DxcrwMuOENwgR8rzAM(U*q9~r-pDQ>C^$9UFZ_D*lY2atv=T@?mG-h z_@0GQ%j8{+2db^2&!@CnK4Gk&TM@_RhEsdbK7kK2rdZMey;TmZXep|Qve&#jk^u^Z z<|30hFajMw77KM*c=xT-U@+E4e*y%y3?>6DN&ywp`68Svf?X~zY%k*~K03*o1%w&# zjwdnAG`b<#v^~5Mid-OS;ja?w?id+)?R!eo&p#yHgvQ!)I9E1)e*l=B&xYEo_QTb` z<2KLw%KwNIom)=`gn~5EZ&}DExIN}26t-HD?FPZ#ha@P^QRGX2=331sn+BtcdFm&3 zF5yHPG`o}1e8~AgA?$M#Qj;isPUM@6ZmLYm)JrBsMvNfo#f3~f0YHV-BfKX|7)@t5 zJf{{|J6dviaH&(JuXq!6ptChZFSG*0*5NGMhnvDHTPDQ7*ln)85#u>NR33>pk6`Vq z&1KQ(OUli*6qYm_k2w)S3D4Hp_x^NN-9{nzG@pGnpxBy!tDwdficd%qLyDXsiDZtq zP*2FxO6hl75f=o2G8cmQu@1Xzl@f>cP{j8?AzV04gZ;uyKMI$9!;-q_$-&!sf|`Ju zpx7Zh<}WXsf`h6fd52X43jNiK@&G4cCo|s{9nim#pk2ywdjP_ci%iHL`e?bs7a4L8 z36yA_;$26bPw93Bw0G)WF#F{+`_y$I^=c4edUZB_Xc-Q zr!0oP7>+YRY=o0N?cNyKJY1iBgi)|5Jid?~UX9tD4c^+~CaSaeNDgvhbcb)vV%+zNqMhC6|VcZeG!B&c06J1L;Z{NZm1L>W`EOkCOTLc125wuGz! zN_||W4=k{8%cydDkaF0BoC_pPmvy)?6d6i1V~2x22jZwR*3vB{koFZZ?g;v5a&SWd z-cdY-wGWmZ83#Z51C6gH_`g!AI+=+5HlQ=39+x#`lAF=lEuyK|4YrKN(lCD|B zcI6jxb3?h@MVJ2aNhesioICHRwb2AX~9|#@Ef!|<`7KvQn=W1oiAJqVqPy0oyVzeT!qyYpyUMUl-dj#_v)~QdO!GZpWU$3%zfg zVd=)}FfkE9AC&Hz-2PKCJ)v1SecG4K%VL@GMyo!gntr9$e-FhP1pnG@ku(8kHEOAW z0oU;_zY6F@Sz5NEs&JDQPbCQJNt2y=J*J;Rt>9a%SCvw~2?EA}y=MwV#ZyRvLQG_S zx;zlPRDdchsP%r$VzD6YG-RobvgNN3mfV``zMalLV`uc(WvE>)@%ez7sJ6J-)!9S; z9)e5g4%35MX{d+7@Z}8-LBb5Io&qdow2L2p>r=9WSW-pMK#tfSmAl?Meao1?zN(LS z3rd3pyX5Keh3hZV@KQE)C~4z&MxYAMQ0SLPmube70Qxqqj%PL_xuFKqHlqu(^axzh9oxlX6+my-_!Q`wJkx&Tf%PM(ojZWecOswEkvUe8+9R8z- zW?{|zo7FwpvL6Vrew0aVfLu!e+5xEt<+o4>-1=FgfQx zOr}|-t47O6xg4ro)oJxI9yIMd?CJ?>Gd~8;#R{KM42N}&%myw;XLphV=JL%~eX1ph zYHs?C7N@3s?x)m~4gqo5|Uv+D6P4|+q2_%x4<2_D{n_ z&32VwzRE>A?1_H`_u~Z%?{LO?H{Xa5?d(b}wY_d~_1BzRSBAe-CX9WF1Ho8ML-xFC zKoy0dJYDX4AT3YEo`*lCSBM>#70+Ol3Roch1Lbtr%n5v;sF~};EdSOS=p3F;!%_`8 zK?yFS)z8k!V%)70ZT-Eh@MPBO2nMm?t_YG5w)VS5x+ZHvI22g&&ThB__nxYqEy|l$ zO(=`ZXtan6T1|1TmA>vyjkc#0PxFExUtL&49sh47=hyzz6dE;Bd0MR@$!LJN3npSXr_3a| zDcNFabgy`jwz2s;aOY>PMaPC0(4KIDyXbhxS$b7elo4b4SjH!dT3iCb1Ns+McL&Jj zGU@3!) zS03bhD))__13H4|X)-WjJRFkyUB$};On_J@Vuw8X^Dt)*75y(hyB!|-sUN|1Jux-9 z*jTRi&2l$UN*VZpLpAL@%&S@3DN6!6J0-t9s>-={dO zqUAsRV#|{TC1Fk%?MFK_B{{7(iYZQgZ&$4Pu4saKOG1$6R#rr^W8Q`;4ZwemrzC}7 z@JtyD+YLVsXLDoB;FWRC_8C`T#nE6-WVVYTX90v$^~F&voL|6ikb@yF;rZ~4DQ?@{dwl0@#Vh~EUzs*HoH0EUa! z7AfLJXO}-^?)r6nhPxmDF1y9D+ zbKcsQQY}KaNo{|BncCz%dH{bLy9TYxZO|LvDSmOa_>z;tey-Pi`%7WQ*@FYm|HG!lT=3Us>NQpG!3& zN1x9_%!lLdjWzy4w8uTn9pS+86gjaQcn`>oaMdS|sjvht$^fP#g8A~{tnssWiEn|1 zUdiaAy4O!?O%yIQ&Aw-F_ zlG7V?RNw%eND!HdGh<}?74PJL{z<}sRV$dFt(CZ%3@OQk;Q-E8kaU4gwrfn_RA(S? zKnA2AU}nP{040JJxDP~J>5Oh$cZp0;(knp3y4%p1uKU-9XqQIYRu#G> z*duan!B1_b%D~nb{x<&OiID{tEQ*~y956{#gCykH0us5Sd}PjODFU}lVaVA7?=*Uv zeyn=1+|S#<#2sj6Pf%W20?~TL-Laa>OfBPj>~fEcx6f@P3n`NWjKa9fLQovh$DUb4dFgApX}&axS8l)DBqi@k{Da{ zHdxOJQN&w8m28O!-$p)V4adPa4aLJ{^q6c|Yd23WNUWnDDi;(@8KDMyE%684hY206 zPnjz#*pbHNr%ah;Y1pfG+sR^AbwmW_o$7geFTHCiZU&8IEA_bF7wLts(t0j_^bv zH087gS^}i>?u`z6;3%q6bj=NuQ@H*dX0QA~znuf}j2gm2hOmI9RNe)d)n-4@+ zu#iumfAgNzK$z{9=I0vG^245tyM|{#^B8~5)(9!El!wDZWFQO!=@3=A(a}9um|3=u zd_aj?ov_v3wZ6sd^)f#M)?KlkxFGW3LDf;J4@Vzz3<+z0fc3F=7DoAI+6PD*52NYbsUDd^_%ZuzBl!cbf6;jGVk zi(r>SX7>CeByDu>H@mpk^Z}OujP%hh+9r#Ce`|6Ro*_}udB#UuIaNiK%iXgtp(`SR zXiflNMfp}}BzuDcBZ+5)XWj86#MjqN4I26%5q0!8w~xOnaes$vB~#yvAhW&a<1M+z z&1!wDWVGpN(M8+sIY|XZyRq+Y?uS)7u1~n}tQzZ?>82K)w~F)VYwzEo+_a4anXH6e zmfn!C0dmjs4-B%Kx%JQ`IG46Z=>x_M0L&}HL`sM*%4a&QT@X;Ocuklt{~RFz&X&5@ zWN|2S*~-|_frCPjp?d>XBXCFG-qf<@@4)`fTo2%m_6|#6JslgwNJC5e0c><2|ENB` zjIYbZ z(j3;k`&`t)Rl7C*U~?&Dx7N(nB`F- zNKIGY;M(9?L;1~(4`o@*CXZe)t{16vP;>klc{`xrl!bx@L)P`L)M8oRb1%EHJlmB! zQ^&Cu`DsyR2nd5$bYVkzdps4Pom}z80(}!DCF}C5Vs4<$=D}Z=k3jL zE`wpb`2N*%9Y#XcpYVL@O(rT_5~J0aYuDoJ1aWiZs|(@P*C+c#mwT|8s&pxdi>{AC z*+0*8>Mp)I9Dc@B)*`l+Y=i!0@g=o4R+mSyck~eog21mzT#dK$9Y>$bd>@cwJz*vP z(=GbHE4pW9`G1P;7d2aBa5<3v%eED&b3;{^*6Tspk$y4>3Czl}p-?3x`|`%r=*V=e zIsk{$UtqDSSI5-F+c-Q2fgSd(Rj*UuPrn~O$HaXJ%IS8Q&dEtdBzOb?xL@hJZ>50# zK=L~Of#ltJzi$UPM@Vic5Hgqtuo^%?Yzc`u<@m_iJbNp|-a9u~s24n&LVF$r>gcwHR<6+`yI--9` zShN8s`>*EapMWy)-RWapOtL?q)$$F6>|H3WEy83+JK*V_?nTGYdwsgu44RaD-SpBP zC8@p+JMK!ISYoh$P0Sc3T}VP&+BK+U zFXqpdhm-Gs1~?@paX6HrGj1!QNV*6-WpMmCzQMz2Gu$K~@~S~3{hNvR#8>gg$sDLVFWJ%xSg${|oaICHy%1rs#U1J~dS~!T6q}VmzA>7k=Y*=NoW!`pq3Y%$ce~_5eH+OcQ!% zgst^K-*5h*$tV<_D9&G?aA}v{-QF2+K2m^QkOYlWt4zLq)Kzq>(_RNUrhBmKaP(RS zxO^%$QK^-Zo306jJT`#x6sm>E@pN^Vl(s-$lJWdpklM)=$K3=iG-DCqn#?}qG=Lmw zlt?2B)xU7=f^FuG4rcqe+)B(TEo4XaDDtcIIA%4N&n&s)pvr9lM5pm7aDPby6mDQ5uFyDegYEw5m!dFF89~T#5AYQ6ID`ZrZKP*rBZh zrnW(dh+_~M#yvd+cjfUK;KrO8+d+nlw(Gi_#25(C#U(K+n$l^cuinGS)N(?24{n7zf|dE`kxm&avrXm9-0ya_!aD~M-H2LQ@8HfO zl*&GXx{XmU`;NUVA{c}^U#ip1&;*4r)u3DfxUO296?tVpZ^p9--7m(SARIn5yNT{X|)0#{NLq2>nkhzPz28}1tkH<2Vafpk7? zn`a1_#$MKJ>>8)YTsY@+IVQi|vQ9wWuU&dkIJBTvR6wdY3-_Kc=f1vlXbDcPa^b=(%^OS6}vFp+X6`*B%KS3n}lk= z0F^|((9 zFG$o^t?+MEAL}jj#AgytJ=s1oW-G$UI8uu#YuiuT;>p)zZ4mA1$D$)H$L(xm9o-iH z*)jUth#l^Y#TY}yXn5vvpCTxYa!F2FvNGpVU#;auaca05#$N9Jc38d8D4y;C-en*g z;rbBaX=o||klL{7C{q=m?Gdyn26=gaINI!zY0D@uBPR(7fNg$Mhu;!6y{>l(d T zj=^h~!I!K;F7I19cT|ebrA9q2Un{;WP`ZXY^wV*Ovr0U-+UP^y9BZ#eQC<+3XaEA?htPj}A9**FlA4~1_lZ?kV^rdgqzf{9}7Y@M)CLger;@%OW^1@oCKS#io}D2^qoG$y+(%S?1)Z61t8xDae^?Kk-QM z+KQSs3efAFHe`G_jL8$~(}^5DtUjGGcEu^T@7J1TAPj20#`>^|C&rBR&LkvBH3T`| z+7+*i9@N44Y^VA6^&?Up`ywd}AC1{9)I4yFC971so>fz))T`87az?DMY+XdbR~=w^ z_y6Hk?^4UipR#OwGV7N+wlB9Oo}xFKamn?WQJE`zE6mchK$hCd=Aq_ZS@Gi1g?|C+ zdFlVGIk>cJ>(Y7$nn^K2JU9^4Kijobtp1O!JTjVWvNh&Cc=H5;oCtMPOKVPDz{C1I z9z&x;MF$63WTHc*)ut%ZKa2sI(m`RdI;PEhG{HETJnnE2-d7kICooPOd> z0DO?xe3kb@K0J0EaWB@nmeQZlC0>rg8$(J;`m?5f-Fo-%>NxlSo}c|`dg4Y|5LDcRNI2e=miyrMfgwR4dY|1NrY-Su@H$Kd8)gyQH7`yu!Ydem} zHwI2wx6pUjO!uFsxc|f0J2i;{waJ=g+qP}(GI!awZQJH9+qP}nwr#tnzBwH;rz85J zZ`Uu#m6`98T>!+ntM|{Z8%YYg?76B?i$SjAyI@RSt~vN;7|!&b3Ev0DI{m*hKW7`k z_Q&Y!Hs}!KAHsy(m5YqXV9Ui10jFsK}m&n zTOZ748lK=e;iTpE=>y$&n`QWq5vNC1NQ|2jt~~n*U-9yvl^+-gM~8MlqjlWwZ(5B7PRq9veF|WTy|JtvfeH8XTwMd)NOp{g^_UNM6)U?>&>vk zvtAD)5>$7sJ7n)0Dd?|_NMNzdRIS=w>)f=U1>&Q|QrM=RNAwbKhGS8O%R68YKr07w#xGhaqxdIf&PW z*P_D-LA@W=P!~P2)LIKE4BCP-$RzI9B8LK4x;34Hw3p*`zNc1TG9#)>1?eZsv1m`b z-A~jB;oJ>Lb(|)fzfM*hgI2q=cuTb-SO}B(J>lK(JjH>_hq2?f`{t;w+p8~^Z#DlW zi9iLhD1$rC4qAJq{`mupDn*ov(W<37zdaoBY^+&b#JJ2GT_;46&T-EBaY3bZcy4ubCPxcW6{%zRwDqohk{nPG(?*Q{ zg4fswu;*acnqa58;BTrzuC)ZbW96j8ElC>Kq8cs!xW;!xbV;6_;(hBq2++DJEg3uB za0kD)%n38;{TI>g9+;yu44pw7As0cotS^1XkW=&tAJ*&`wj*X0IFsjGW4bFnp;q6c{gD9@mK=h*0ZoBlu|w z&!cwwm4*gTz3cd-;$4R)M%k}vS7@@O)kxPlCRyavJ2`@Su`q#ySa(CCi;9Jg7N3)F z-5-587Xd*=38pI)X@T5EPCG=F?25*z7*}fI8_WwU6ow8deT7pmONGfD%`wc!-IFMuc(k`2Uf}?w`p982k%ru)^vYGgm^Fpzw7BDK zOHEDcp%e9jtFd%Odf4f{_^e4;`kbvFNmt_=*1l@x99YKb4}d?Z41PeL%Y@-|J*3Gi zbW_{m0vDqQci@~Qd9}H)^j;jRGS)Q0Iu$wfiCoIl+!qBDT1~yQqH#H5)z~%K+vC^p zA*x|0yBy{Simd$`&RuI$kiWK;*_=iT;HeP{%`QhulwCrdeE~!(f-4S|DV?UX=USxA zhHCAdutvym&MceAF!p>mny@J=sw<3MNkz^BPt9d>rezC;!?sTRDTYh^CAEqA9Au(m zMpnCH>6RH~CGxo7infzO%M3@jx(wsy$&JVfS(;b4IAVMw*`w(njy3g$_e9nLeuW1F zoHpw9pxe2;Wm~_qFYV%c$GBC$ODj~BBI%SO{tCM->oFPQQNxRNx_^zI#J!H5dU(T~ z9rC{8J5c!JKIrn+Un;JxV8%a+Hv5@)lq7JRdTht6h!CGu*0 z+do3SblbZzBsB;`?-*4;mQ$RFvP1oL!m?a1{8A+MtTBUkd#f8}9EF|cGTl^&=FC%LO#zm1V>^LyTas_fIaI+FIPDEN0gY3Df z{>4m!D;V52`{9=`puyv5w|f}{J$c^7Ft@~YEUvqpEjoZ}v(ch^p`rD@w1h7dNJf`Zr#*W{ z{9VqiA>0gPB(O#cVm)u|z4`-~A2Qi1c{_Vph)*{evWnx(U@t1H#-e+4=U8!M_G$JI zU=EYxT?dL-IFyEZCV^~5JM<(;+`N&$IZ9d1DJ(+^blG%h!#d(tuo{xkh6OY3;?yKR zj8}3y0Z7i((>h!p_3f;h*tYHQS`)Q}@*?*LffhB{z`!LrFFNaxgP4)9wZx0#EVR=z zF1}<%n)@IhwsG(=ot_}`zf?Hf%n6iba+u2>F9t=0lopD>w>Wt30kh)7Zb=1EW>VK> zk{KzJfCg16&sX!0n7K(Q&EcGE1ooWC!A9?{aOSLpHORwE?H5t1Cz*#>YHwa)HX$nM z@?LZ1eH9al;cUAO^;IKi@gOx6MHrU#Eme(#HdJn(g=x5uBP0ZE3ut({Ik+QnC-8c_ zJ&`i$>rj|{e--jqknrjrLpNcPGTwq1P8pov}s&Wx`y(bx?LP6ZQ_rj{4mO~0bRaGCt<4BX z-=3|Etr;!a^KgwMng|{^VToB-*%zQ{>ST48PWMpoWT9S%q+~FDr|^UzbL}A+4lTVI zv{C2bAzotbjmk=So=kr%!@K4j-A(s`I#^%)vjMr0Q#RD1v&o6>kRmt7j>iLKJ_DnB zg|pZR9nm_*b;}qA_)M52jP@9KKxjA+-sgw!K7F)~eqkW(hg=Y?U z#VpACqXMo&Ak-EYA$iL^Kc&Q*%^+9ZeMlNmqnpkk2Nrfjv*OmhY*(~#hb1d6$zkew zHkcv`!(`ny>?yd}IBaR=nbjPmpUi8m58OB&Z6|D3rmvcwsU{)_^DdAyb7?r$}Ra; zeW*@%=&`h_3|4f5n`VjQG4}2b!|mG%+>tj>(uYe#G?r6YObr)rL=ow269{r`OF(!`qAMD<6{-r_Xm+~cZ0lpj_mv&` z2Lttg`fmKM?lze?IsO})6Z2VjLi09 z9>JB`Svdnr7q=ltfQd@&-ubzUc8pWq-Ql?9>~sWFo!$H6(_QilC%G>F8bQ?^*Ol=7 z51gc5wo!*3!RA@@H}~X7qE-yHzXfzV38;}}S`ka_o)kLieaq^3P5Yrq=E%ztzGte- znXDm%jZAp$m`Iu-fI)8|ar0@h|5Phw7~t#qaaNdT+=XJrUK&o}(8kD*x4ZT4_x2io z!4C5G{qF7%diy#F7iYit9TpA!bzi?qe)%MiGz%}jvc5S!o74SL?q64-#~1WIHhLP= zTyLNx8GZ3*4@u8}n!rp}%^bggk|!Kg!XStV;iuOg)Th(RpVGBf$*kjzEBJ=VbbF!3 z&S8BjjfAjaj8M-hNgbz8erOoySqcF_MG1M*LTX@A02Uh(yN*exxz{K8xRV^`ga z4_b+3O1V75vwE&tRcPR!+lYjA3@@z`>guFUg0!t!aU-XFvn;kLjLcv+%fuNOIA`Ka zba;?l2Q4(Y%_%d)08H8mA`;t7SMiTGL{K(T4WquT-M01G_A_u<)T6Ss=0Oc7JIRSE zyq?2RC^1(9nHnP7t-9Qn%Q9-%K?m$G@bkYfp`Uftsz*C1?Mulq zzGj$lpmI){j;nOrIXA5q6k%JJU(N?Y)%b8#t zuI4Y*DV#IMQ_R?gPO9qj!{y=AUm+irm_+`>Yoyi-J|>w7$}`?byfC0>Q%$c1CZ%gUly8}Ac_`dwl7{@!?65>;_T?cqTME}u1 ztK+Qb!``GY29x;pqB=t4{_)$rS2}R}$))pvx+kT~2DiMTaa7p|=IGHM;gkh;z=u#t6$C@|~%p=f3s$3)di%xCKa|C%yZjg(=e zgkx2TSMxcic(=7HSF`Y-(cc!vhIMIdH2k31I)tQ`8n!FQ{e>}lH$Z2QG&6I z+F)N}S}Oy)`(WDtA>xoMH8cB4nST@UmSE}FgU6>PSOVinnt?=lS`pR67>shIACYUH z0TO3%FCR|#^A@qo9rS}%n#aTH9tG(kuyi}|MCQ>*1NTqc40^#&{vAVR(AfhHx(ceZxW^a33Tg$#mrXKt%^R`+`JU^NR)*o zRRfPq_JV&Lwy&W?3W5Zh1H{yp zC_jaDazile-hYetU~j1x-K>wfGH41BU>3-w(cb18ykS8Jm%e=2*$M^2r3*sbiX_u& z%o_ri~4Nz=8;|nhqGeFkhBOH{v}T?Gn5c-&7Cz z*IzL5;s%j!Fy!XKW4tRIj}w{^CDF-+cOc!&l-fQJ4`YD9%9J;DSs3WSu zqyu{4Jfg=)`lQ_34YBP~&szU%jm1w5ND2+gXI!n$3)8d>glr1zIDtRj6Sl>>PM6uC z6*=~5p7^~0k2uCMQ662q@-(8F@vBqLC53NmBEM1gM<%y&7st(T&BU~ys7oOQ8YN#q$z4%LgV9hu5tcK|h;|5x9w_ zLqn^%V@_2(>tinM$c}6Czy%t$LzRhag+v^EG|>#|dJPi5KJPKBC;7Xd1hi$w7O9)G zNjnz?_LH@s_V06;B9~2mmU<}DdZp_;DTcZ4szWj$+1+>1#2t*7jW7>%jxDSrkcj(WJ11drjo5xM=w!V>_Owf1k4LkXXU?W>%*JIpEU|$OCglx&$3ouI!rLU zxL!NhHz;b>hklhAiU2c#_uen3+J-l^&x*TwBi*qPd#2O&wA#R5yTYhSWfFBON@hcw z6nx&~yY@I28^DEu$hnPMWLbtln=HTqyjua?s<8~1mY6GC57q=F;DWI4t)s1UN2=))7{MXUb9Asi=?uKS@1Ref874IzERC*+#i9|0#b)qw z;_cLM8sD-;nJ0B3!UWE?5Hll&3)gL{ZtCDHJ9fz?Dvu!QK9FP|& z*ZG?c9Wf6Ih{TLnYncx$x_!U(W=209rq>rqaB&r6f10BkoIO)J^+C?<_qy!5JQ1Re zmbv1T)bYQ1pH5q6>PZorSr_t{Rv5B@ z5A!~Be`nk_o_9x7K3!1Xv6~v8NtBUaaO zq)4-7AO0vne6{gkwV78v*1n_s3Eft(ks%zY<@jTKFgB0am&14~$R79^aLCK?xQYjG)@9O45dQ~BmYCbe zJH2=;8bD)w){vffhI3Mj34hF7!6l`lLy-L)tFYdEm1)gpa|NSzR#3gc=g5;Qly-`7 zkniQ%b-Y95=nitPY9Ib}Y{xEkXDi54Oo$}KtBmm8X($DoNSm{r``!Ohk19(;LIo%T zwaUsiKgZ^y<2>>=U-%~`J8~%br>FXQ+xK(87f_FK2L69i{Qt{aM|Ot)J7Cz-`v3dB zzluMMWcJp;@4qBJbO)(%g8Jld-}6e z&_t*)t=p#$m~Zbwck2T_XCdc@h&*>t4tU{&O`9J{W(g#!cd~fq2><`9`+EMT?z`ps z*%@SrqI*nrH3F;Kj|at9b`flE0={02Zb!aBjKgP-GhUdt>1+qg?Krfe%D6lQn=?!~ z(t8)p^NQ+gQh`4U*Kdxs3TLu{K=%;1+OY7Co*i@iT7Ume`|V;R!GZYm;h`pBHv|Bc zLYEBhNEpG#kVK0<91|b3pe7XM)$anG} zalvPo(H9+Sd`-(vbUtaGBjM4ME?FlVV@=ez1GT$MLKOaA|J>gV9|!`$Fa?OcQGN)3 zBuvK5YWMcPTJ>OjimiF?w6E<8uh%Ba5OTRlV~t#Ls-VChwE+iAl%2XI;>APxmp0eA z%mETx>Pi>m0JEvm<|i)-BO4Qxc%Yd9DJ(W*{7i+c)@h{xgi*#=onb-_SXG;`NX30w z=Ix42LU3!L^gwNrrPQYdL1&jC<~m;dSQ z))r;_ePB?vF>aY!iA3c@?Sh~RYcz#&E$W2okfIA1EW_@LJ~Wox3YZ#!aF>&yaJdFG z?x(kWwMr5Jv+oainZs9k+J9RNY`nw3q9HR6y$$5=Jo-D*>Ax3Aj>?27#u+4;#y%00 z#j@|Py6X(SD*beYCwglpc~LdWMaQH^UZh<=4ZkQN*MH)89w3Qg-lXouy}zO%UZ$}$ z%297}Yt=*69-WsENSiCzx(&PGE_rhb1d%u@XOY1dy$|q+wtb>-P8yLIZ`FBCe0v*0 z!jZ?oo^e9rBzd}vE}FHx+dhwL1_Iq}`UcS|I$c7W^H5lpHbpaXyI!5+sebploMy~s@;8Rgjd!-U6V}2`#2h(8o&-s zm4t=eV4tDOKvGCY81I(L^N__1?}r&}ACmxI&Ed$p(0tzMlAFYZ9@=Gon~~Y5b@AgG ztcBtJ%RR#!G42Oa93hjjtkI;>o|AvTI!4O~mH0a%`vOT?HNc~0Pz1{j)&W64Q53%& z@Vmi4#baz_FDz6LgH|wtPLtf*95iNkL4H$kCMXqqa4SNEW(g1oqkdA{%WQYK4Ym`* z%Jw(@d4xwS=r_FBE-%rlNq&&bSjkgcsf`X#% z$>e6IG)u6ztn%z?zr%R%@hT41N?Qg%nrbJaGB^c|B0*sDgB*)red*%nL1wvp**;X0UX*mz2{(H(~G48Lh}{%DDzpf|`kW4^XxR!L->VNBg^3_kwPk$ET16c6eNbT z&6Z={!|g)`0Sd1`WO<m@H@*~0yjZw#xWc+#qe&%$Vyis^fgi1*Y@`d8s3 z>UA^%0TSxSIWaa)^rBkwNGkG~Up%MF-8pHt2gv9ZTP$gO$XNybY{Zr53R~LLiC)({ zBng+uJ~o0cX$$Bp{K5}HZ>>F3^P$RynRGR>yzohO9P9hmG%DTDSW2^Z7W9J8{T(>f z`w^2AQYQRkk#U(#$FYMuT1IW#C8X&Z3#&6g4!b6J#vh4&B!_q6PGwIui}6<+dfxu2 zRHXf_*6l52TGBN)*Ik>gr*b7Ub<);ULj1Jx$K8pTPBq;;^bAlCwQtklkr6XjEypY@ zh=Ga~c>&2TuZ96LE1GE*ZM=j_u7^EZ)w?O$R+{V6_Z+WJ(Z&~?$OSxUx(=7m+T0jq zFm;YJDq{0SPc3(`#B#$vkgGZ%2BCOE}&s!yRlJTJP&S3@Hk5sK&%0TWz$4yS2Eq^Ow()8+t=a!+s!0&BU^SCWunt=@Pg^g@tu`i^pE1NT z0BAYOykeIw(xeM{Sf}XR0x!1&N%L>I%C3;qJ&}RSav#$)+NmAXR}|kV(wAo`NPf=t z@+6Y|W47h{$DSq8PVeS&sLIw)Gx%H2hRa};2!AIOZ7f-nXs^r_@U+%7&p1cKV{3qj zdB)w}-|_&bPC8Rsk8!>5Tz{+TDqE82NpUgJj{@cvlJR$FZZOtUSad22%lh6Zzlj#B z&Y8sZ6CyScJIX&5$EZWLn#SZP0tF&_#Cvi#>05_ls;h4KW19$rSR!YfJSdegCA{1x zFOvrYMKC#FU?-wGy9rtgzM|Q`J#0%fIFORXxRYo}<#**hMoozk4 zGtVVEI$$`sRG<@ri*}wqrs?TafV^APyG8L%KBK*|Oz6Dh^6@3zEEkTVMT7Ibeb2BT zzXc+Bl2j-z8OZTKg$<5-;+~KInoawSLD|xRtP|I@E84}O8F2rsGt;J}q?~E!6#0Ou zg3S4~jprju;ioVe1&7k^DN%u&#Rp?@BroBL31K}E{!9DT!XS=aEJlKKMQPgAt0xZ$ zt3`cO33cYzJ`RVb}(5 z2KY%tgSSE%LoGGM+jfjEau>AyNfTd`M8OXnrAuz^c8Ie-1X9+>nkvX(i>WrBqluZs`;( z;;uqv#Mf!U6;p-i8h`|6UV8$^D|Kuw|0@!b6jooh2!2xMfG};g#eDf z;K8L81_(Lc2d?;Jz$6Ao9HoLjaB3&L^Gy2|0GhO~;OI|c(M(@bh8;ku=A_6(*%ISfeZ{zIP zt)em;Roy_8f)ISjkog@_k7bz(gG+Y%bEHCIYRWkwoRoG>(Fa&`HK^)F}) z^dX8oxo^ZMC$p0qJ(e53pR=BBTh!72;WNbXzdL^9VE=E0^R3_bV#3jh z%+LuD2Xabx)kEEW%bDD6jy6_YqpK65Dqnwiz#@Q{`PxDwKhWmIyc5Op#nmUg<;!5s zX8v2aS~&TC3s*O~6*D(I(mP)izn>um=!F*Jc0ZELb4U!pp<>%uUoA>dA7GCne(Bdj z7#o5C*Owb`yn^eQ?ZTgv{qG>Yp#N%IY5Z5?>MOFN$V!Jw3*6Ptbo%qG=gS#s6Dhaf zoUJ^1+P=*$oPTfkI;g{Ucm^H<{rlE>LGbKhCEU*P@G-}VP`dQvdx9j9Xx{Gg`{wLs zVTSzjGKgpyE3tKfjYG4qelv*u8|RT$CE`JB^$YDu#S5r9qunBTY{z7g72XBH=TO!( z$un(wDuOf+tLH;rHu-N~isB&3f=;Kyu*(X#IMblqCeAN&iax6XEO`Hv@v$0rw+q|qIZBWq;1*c4A8#@fY6It zBUU5k1BN46>mBjym?(?CKlt~s?*gSWHXl2VDm*ccWKE4^guWP83q@8Cn&bf1n?#GE zX3RuC7AOl>)#^I0p?aSu!ggq8X19ej=>A>Yuyqi5Fv_%zL(<<*a2+Ter~ZIR1DtP4 z#uU&Vge5AACR`DrOX1)jt&P=8tM%$|lKIWRi^WQ%+8TX7Wh2wB&n@`7y&+Qsw#&6+ zx*#k-adfLwiV9kfAe;2-@cPz47VG#(IxR8pF4mq*&Yb$}&R1S#`N>Bq4>jHxn&47J z;_84njNvKKfQ#Ya;gHl_DM|9s#EF4zrz~2W^Qm$aHf$@4rVaf>9-7v&FP(*%r73}^ zEDCNllEnDmyiEV4odW}Q+)>?2!f=m^S#0RrL&eP79)8$)NiKFZP;GeIuW+#xi9cr} ziUDE?Tz~qoGsHiVKGF?wj!rzD~rRI`*3 zCJNc=w`QHN6&7|~>SFmo$6Uy&I;~1>*ut^Kfz)kTcU)HD!5GRT1%dMJRYY1O>Rk9K7ryJdXdE>Ob2;QzA zvDD501ns5*5#|vdXd%MMmk)u>c zGu9$C4|&P@HEB&mq93S@_CYv219@@i!5g=l*YKn9Kh2hdWcB@2F{=v7O_<4UX=Zi= zbHfPc;7_|an#~pr5oSf$th;&DbNrP7$3OaC-+HYR!GQXrGU#-E6mkg$Hhc{JP9tSm zJ{cuND-8S#oq9ogRMs2Dkq?R0CDP1cFM@?4-q@` zr*4l9?8U2z=`UOmQ}wmn0%*F?Apb$Y*3n}oTdF{w4hrpnO1CYW)ZCH>q%YIqj@Anr8WcYjIObsH*sETU_)>XuSAIXJpdI&QvzAC$60o#E_{W`V~F$t>ZQzq46WmP0n zpx?syqH*e+)SB&t!*Kx(A{A!F+^!Y3}dOHY*&4I zG-$wHGpt~ius-%dln~ebfLi5)-|n2E79qqA+#tm%5Eh9W-cupjkH+cZCov;twG?P% z_))VEqjruD`voPyZ@!24!_ z9I=@lTQAE)W6it1+LX6;MT-v#cShn_xWn}d`4PB0wkAuVN=yQ#*Dr$D% zzUC3cY7BR3R*Pk~UZG*teYD8*m?;qw65=U5iJ9FWi-1Mgu6{eUriW=^sHrpAkhmB|0W9xJU}M*-%@4 z1$T8T{CPK!Z}WYyBkFN~p!nB9H?=L6Xh%#Zbs4I#{gWuZ$&J~j)6}2<5C&%=$IhXR z;s*zNr}WY$Xso-f*pz3S{>P>B6Nbk|;@WVwP;AAGQ4)t{bCAFD+;q5q3{Uo9y}Muq zj?1Wp-~?#h{h*(UnjJ}!wf({oHSju#Cf=+KG<)U@TYcA{Kf9-D$vZ|FEp~-pF})^| zd9acTM`Zu#(dU+kcX>xP>hnOnKD<7B6tt8(5#M6c%bdFBul?Vo(B@DRD-x*capf-Y zq!oEB-F=1$z5#LWZavOEKN^E?$ko9k)-HG8CBh7!jmy=TYn^4=z zudI~jMcuZ6o-;IdEvH4^2yQRDi6hT4n;4Icp4u-+WKph6`6WQe=6bAMJPV5^*4isO zqeW%63GG;~66g_k`v4t|EHaRi>f*&NpkIN_&%xDW#IR08%p7YzeCnSX3yg>GV^6wajxh@e)Au zq0+CLNp*u*f^7Hor!it*?AooTxaJK<@{>#ZXIU6_o{F38%T=g@fiKt&&e8G^+Ja4% zbHgYoLrO?Bm+lHPSLWq&*72Gb)C{mA>TriA;n7!A?(1{@?*QKNam`kbW^*s$qQ7cb)D`yA1` z`~ZhHAPYoYlyOf<*~h&pYL1tB9(5O(j!!fkHis1hy}}Cf47U_w;tjnq{5;uRblhs= z`tkEIH)bV1#JT$h`1!gvU&(hO%o1AKa(qCUaM3%g*L=R;6TX0jVi{HclLTk}U-3uS z+5TG|@qhD2OkRs2FmzxTFbO)uJ9^bIFUO|1n7rMS58NZ%vEesOXEY==>@gv1yxh4jg3{xes zCq31PO!kJ45|~+E)JK=Yi9gsrzQdL%K9|yMx~i}Lt`)o{HtDqN$j!R6Q+w955pOd9 zCW^=en}<-g%i zp9ITB&%|H_7qOfEViVxG?yAH~dcO2p2TwvGAy$y6401Eh1sN`9*w>@u(MGXyH_iLj11a5H8X=To6AwJR)IMvgvuV!D6jnD!bt2AYXm zQFi$#ErP9KHJfS?;WE&6BHfu3|3HU=-&DBkVZD9G@&TCAK}e&unSLC9Wi)h z^}~Qa@pjSBc199*h8``>UIW|1&!-_BBIG}y%~=CJPDL?8j0eHX`&Hl042&~ZCP==j zQBboi(hHWP>rpO+FIB$ptWaEu=$2`55aX2d0Jw|O93&jeA=g1ZSLX%28Kx~8K0zj= z%h}aN0|j?AaEOO9wpU8`R#30HpsAwsV@ZguRbEjC&l1F+a76(^TKTuIxhK`?CJ1#- zS^?246#B6^ztae$t^c05VT@wy;-3%(d6XIG+Cz=XN-oC1KJz&m z3{`yT28A$1)GwR?_2!Pb)>viQHWn-?2%M^08Vgr48>S2_kWo=oSERvEvpo+KC7V_9 zjz1((wr^vUXN*^Q!6CLedg$iynlqG#Ef=%y{vAu_ID9pMjpUaJswk^dm;8r5_exVL z(3~AiTS^9NWb1;nSV*)S24|nrdIpwVlo>vIYcKx|#`}Q3&i~w<5cyqvF>toMTuz@E znZS=PP}m?|3+`t@ldxy&F0I|sY#tT` zL?Amw|L>pw#2Fgqo*@U%)@HSiR*d_4eK8h6Ff=xZWxr_Wzsm%NgmPy$BqBAE5NXE`Xswe z04B3L7s!#|yUGJF;jo%SJ9F!sWV@yH?v@~GZ^ys!fg$~9XszdKM)xzR3K=@}Hub_A zMtc%Q%*_r1g1V0S%3ukqQsvfe_U3bDV(g^*ju5;DG0nH{@SDv~+L!EXgH;yIX^?~C zD0E~C+?w8)94atYgC>W=G)=Y8FrHngpaUGZ1B2f%0t7E%gTB zPmKoj?9{=2H<)Vr-|6XuI?9I(0TF)9X9iWYdhkp4$ThaIV~7{Jx4CBm!dW1+KF;&a zkZ8w*Z*47(3E*BGkft(;oy0eOPbmlR=_7SOV@Os9Dbf>ACGUfPkKxkvEwr98FAW|W z`K1Dcjj^skgt6|I^as;j!P|>7y5*4N(UAo2y=@4khyobA2V-!OxLmfQKezlJ%%D|} zwnEay$nmvk7B)atv z1NOH>H)h=X6MtJoXX#dTcn|qKL^RyJ?F4DT7(v^c+_KbdBn9p~fT(oQ;8Q@dpwtAj0P5UwZvP~ZER?S;N|BhA-vMh7k|s3qzNoO1 z990bA=BBKcE*Gy5hCaY`q15CeW@2=ppgWq#`Kc<+L})CzSUWX>E?fJP;>7b#sRo9* z?JExIce6d5%)BEyIn-Px0w_EYwUjnxcRFwQQ3b47dN!XaC=%+jPdsO*T!gZFqRHQ~ z#3SMEt+7JfM8lNCw;#NpfA?2Nune%Y-Wb~SmlRKi4(GZV81VC@&B>YP$e$0Bwt%&v z_R4WKl48*}lfQnXaLzjBS^AQ=gtSIjeQ(o@W45lc2=6s9%qV6}z@`O6B%{K>N;Z|C zY%v;|u6ab=_c9~~AZ4YyhV&_oRK$SMvRNekaY>kMXgYy$cZsa9UWoecn+}d zH;N-x-$-@|6tNy*Y?he2GS687rA8Gty9@U36k>ZNyOAw2G%^{86GolM;J&iU6ou~J z(I?WC(p44;lgyF$5dZLy`Rs>nM0C0C5tX05KiU%-FW3Rv;IT2+VuZ&Vl|Y8dyU|FI zFAY?KQdzz5qqv7QTA%j#=>disD(QpvQ_ z_8y_uUVo+9ny8TztPpJcbHQL!ExB*&%cCTT`M7h@fguBFtQ?y{hpRbXDdj=xqYY^ddcAn!S`7NwmWVO z+%v?Z%S}6U0qE-u+dFuRr9L6B?XAIi#prJH!#=&m{_!cc#NoRx{>owYN$g3qS=$i# zyGNdGiw*(*@t?8K|I^2}1NU<1pCM1Xz$>PInB}zdIidGC-Y|$jeitX9NB$W5#G0?= z2={H*dV}e=yZak(Vv9Xe1C46(dNQI5PKx^<7K*&JSHwavAr&OJE6VjZW)D6B*!Pj) zg5cZ7ioZDf`5xbpV6y$^*FsVntBuHDXsduR1I;}l86k(@R627wyK zclv&mB=iozj^9g!RD*ARl;a!@(){0R3|v+JLy(Xm{m)0)|39caoUY(b$YMG1Syq7NSz*>A^gLGrJq@d3RmuV5^a{jJ2+kIU>I1-Ce6GCj)`dP>A2mn% zHbb5^Q(G$b$k>=!6m)4DJ>>rTW1wn8>z&N!;Ab6+YUcLG5YOi6_J@s%lw*>92h^Gd zYxiJBWXJs5K{Q)Qb1UFX+b?A3=%FPiJ*Vf*3qs0L1bN?hang^Jl2O+@VV@}g7MnI^ zWHZ{a7yzwRlpgZf$+zLqN!uFv@-fPPrB?)dRv#@f2pb5t;tnfx1cIj=EJVVr5r7~~ z4h3_(2o5KedG?cU^0(k_+XkTrv!5;pbV)v7Z~Y^O9~O3sJ(+u&lIpSQ=388e}F1XIC`BBhCpxiDdUN-WMr7~_t|o|h4^I2< zxCRT0=J`@#6{n$kyiBn=rH0!WNciiSWjN94b-?%3T$O6Qod+u&1$WI^5ge)|nzsTj zEA^pz&HZ{cGA)Wu961VR?!+MG;ry(#Lt>Z{VSiT$67r}CrGvHcBPA6Ql?F(B^w<-T zJ3lByJ$SEovAMGI4wDu9aVOqxW0%M=enc;xwxWuVi@PA?F>KBwd@u(ET834@y%C6* zyINgkBIqIxsVZ`vVU(Br=7@HSa2@oC`{r;eazL{~l<`rkG|vO)o`1w^Z-OJ>psmjf z(=ocEBmrMKHz%b#M2W+ifvbT)pu^rJ*>UDATY$uOMz?rjeKA9$9PBeON9*$vC$fmo z+&`tfp(RcX)LepEI(i&vX;HYwJgi1tKX-q5()r^ z;MrL(NHb*Hf)h1~iy138L3_%qzef%`z7p`7H2N9qCCSn{xzzmW^O`|fqn`Br98P0+ z0$OF(mWF0+I8G9?$BPzT?bOQWo3GM2m`2d&T|7$gQbj%w-Q~c}J2rmCtEnX!cF>E+ z$^usreNb#v?lxm>3YpaVk9KaA#pH+7GXGxts%P{UnNBX(R*^rwF5lz=IPLi$130%5 zdQe3*qnWSupR+g|`CJ+btBq12E}D@>xZYVvn4HZB7?#tNu1UbKk7d$xgSw`(4yp?y z7%@)#)<76FQ#!J#&+?lsnMwgwiicB-1I#frqc|bmieQqk?m)_Xsf7HYiwimAL!qFh z99x3*A5_n0X|$?^UJ5m7g|YX#!IG;7hdI|XGK*Ne?_Q5k&qC3 z@ez!GbR}I18uQ25MA5VqMFwMw)glu!D?FL8C-G`x-bvB0X*JYAWS$h8St)p^`PuyO zmTuC5&Nkk$C1pf5C%0tiLelmvN8Lud6@Ghm<4_ z=`f|93vI8{u4wS`kmPN2HNWv#qU|yyEZ#_=r-rSxXTcq5ZaOK5Wvo&s0Y^h!qe``l zbJpkJcaHI}9WWKoN|zf(pe1YH#bf2ELN&RiQB7={w{30qYq`F|4zfDp69@ zXNqW_k`u&C2Ou7VESTpkbZq4_rjB+p=9#G2q-Oc~m+zO^Y{>m6W+8wR z;}a;$q(2&Zgg^>ILT>#JAvNe63HBLYV3PHhD+aq>PsH9sD!#*uw~ zsu9%ap-4SUt;g#`jsgJd@BCweMpL#V3E0j}rfC=VSJIMIGSBxe3K;#HKovHSmH-`w zce~Bk8Ul*7AUaR1^)~TQ;X6TF6o2GU%X}>G9$SsAfnoe`kFY8jG^&JZ(>DNShVm=EhB8n! zQ&=pcXU{CA!$m9)2~T{fQz>QIcG_!#n5z>r#1tY^TZpCc8yDur0z(O<#9k$SDWm#Fx zAbVpHq}$^H6E!a;SK>mdxohNQw5)MY%^H|Sz?^-PfkbtXkC?U7p@HeMmNm~G{D4%s zXxr5QVs|}yGryJ%xYNRq@~;@UxA)vG%0q_X{OYR5C4QR+k7sYaQ_nZsIyzOmkZN&E z?e4~J`uh8q8Q*vMRe9`||7j{_{ohQ*%nZyd{}o!V(vph(iK%v<{AVhjAfk*1!TJL- zN*A|5<_PUz*HWZiADS)obn&#Lc6l@diWdH@UuRL5i9St_ z@4FkkbNlpD{#>(@qUWQ79@j4gKha{;)=Smc2u<-jQ?q;P`-zP7lzNmMa(>9QY!}M% zGbZ=uEn_gXr+V+epB|a+DEIOyzYz)!K@v@+##g{7+iuu>v|0G)n70q}{q_7ZWJb@A zwYk=4?I5=>q$Q08XG5`hMcmaR)OlySBg-m$<4Y&#*+TbCja4tW|H6mXU~TBk<@-W`-%9<6PIZG=G(siyi3M5QF28##X?fGD_KS)f&UZrJ@`wSOZ zwxBy3riQk7e6*8~@LS-O&*hr1G5ukiuMQ3rAVMCYiUSG>)`c9N2zXj>|JWSTb_}KB z?dXbIGnI#NiARWSUC*Z}61_sfeukgZ-$atE@>&aTkw!4wdTD5K&N9hsm-U>O#t?}# zjb!Yid_@rhIq3G?N#$C9Rnm22Lpu;c0IF3q$Ogt9OCVq%k zDE-%;3OTeRZGNe}*(&;4$fo!D1LwMNQjPO~vCJe%56Z|a45fChiq6r_g;Q&m8(KPk zaCSQ|zAM6%4%(sn@PB5sQO@-1aw!#V%CHl6>48-{^@Ocw`#gHsIG&r~2}WK|i1nF= z9ZCn|A3}F$fz_igg{yW7#nve!DhE*%G_XMU4!^pu8%+mXny=U25UauEL+v;JmG>jX z99RgFb)&BpQvU3T0my#w)eR}Uw5-!=ISNcf6T76o-Knc+pqmrjX^r%=a4j^2E5@2l zDcTxM$F9eo?y~8qaZH^RdB0Qj>xV|PT#H-(fe`QngYTC+s!CqV<2LB<`6@bvmCOzx zOxT4Io-vup8JehIc(Dt@w@y*5Nz2IhjjO>BA%Myvo6HnNrhpPMM6*q3+tKIyH(r4i zo6B}$2eCX~Y*&p$dxgCuu$zOejOU|3qYz6Mim-4uG~9XeZ8H=|?W}{J2f17JhC#ke zCTT%pSvy_yAUEQ%&XxcT8j^?qbw04l+1laW|jaitV{2+IbV zPIIJ4DM7&`R#J9Q1_m9&)0+9+(+_X*AQMisa)rCo5^$}6RAI`w2bETS*TOJgCvv6; zog{uQ`A_gApLL_<@$zr{tIx^xts!CFBo?9CG*)p4#-eMMc2lS7Qs2?XEnt+eLIqlj2CdHry; zEN#T|`ik}sG+3&kfur-TY0kV%xBH?DzSy9uZaiq2UJrOT=wLgRY^!!s6Hq50OR8;g zp01$9rhkng5dIhMN4a1Fe7zaIFHPl~W`U))8p|e~Z*w=cseMHpHgT?E48di7#*}!- z?V;#jk;7DwjGnu^SHXuA@|gqlI#tJl%Wi z#rTB&&hRS@ddA+aX_VJ8Q6*^I!p%N$DS2tXJPBr2RPRt(V=>IDU4sv@T(o5~P+J%a zsr$y-AMN!<8lTzT%>TUPgH=59S8hwT;Hb}`lTY>k?a`Z&4YeGW(q3M?E-%V>CrTTh zVlCP2>9e~1&IAsM6Mn$#B^zC@Wm0FqfH2XCVJ(s#JX#GD^LvSuBNp$80s@Og(2W*M zQc#m~#SN~QrRdZ~!Mac^$s}LgvhtZR2dUXAIv}v#AAHI?5KWw3LK$77_Rq&1{}k zOF@}7nv+yp%4$FD%m#dt6I?#=0qJnfXl=MfZb^F^8^_U*OxepJq{uDcE5f4%?Ld{N zq^`W?rdtJCv2Kp5rAaYNWWEr4s&H%bO5je7q79=15cm4sz3fCQ{C$wdpj4L(*iO4J zE;d)yXG$FdEhghD!{Z9~SdbwVy&$lN*RoPquhu%UXN}XOwmRa>cU$lIr_k(YM6u-% zUc!H*x7(|J&#9L~g$n^3r#Fxnd^Y9?{&Bj$q&QT7DUs4N#* zx29=`AvmKqw8Up|i~6W8EM6E|iY++7#;V>DkWyCL{2@jdaZ92BH`cNZzA zvz)F;jM`vATG#Zg%gDWs=K0n-s)N-NzqL0Tj+k!Ajo*OXz^oNiv|fpiOg;NHsB6E| zn|MC`6tYx_^qydPq|kYG7ELd27{)xqgy#ozGubE3lNkg~5i=-zn{~};j3kcmf}MEp zl+xH$;5b*40;P`6&?p%xk++BW7;!sf{yJk>+I}7Y_}YoLn5K9%@><`%oVgp1SWJL% z?4b>)f-TE|0R3C+n}&wXeBE(``HkxkqKO#HMC$)CYP1Eu`-md&YTkpitdf?CT8#Y` z;V~jR8rCSyc{+Dm!|A3mfYHyF>n6ozyu)(VzZ|?nG=~XS`|DuXV5pGN(*dW1B^?TO z()^AHtuH6mm@5kWnfcY4*eoeSnBB#I5@d+8U1I)32>{DeBqZZaxJmAuzf&EXRY6-_3@4-juq8*$E*b-@S zx1ERjWcp!YAi){yo(;t2YauLE^eK1+Uf{1k{rU%#ivvT}Iz`gm@bosaOm)a+Usm;k z5M5EK!^FyY9-w^fm8T`;>Z;-^hBx3Y3mu1?+~MSEjq&Q(VtX@#OhL+K5w0n(_`d3@ z0FRgYQ5uGCX5nPiD`f!#CGGtgy(^V)o&1o~{IrQ%#c7c0SWC>P)j#?mm<~+Jk~Vnp zpp0+XT!_r%W{T*x1uKa8^L5zzbtCsKHjhqK!XIsVrf{}M?u&$~=ld)58+Zr!-~U9B zaQ^R_!#UXhTW#k5wKgYA==Deco$#|a@A~h1bGb9|W?R4f*4w2z61dQZPZRO~BeD4e zPc%%-fSogW|Ae*u49N9$UilfP`95j>-%x9d^M5$*a!3sSbeSEz@7KR5uc)WspygZ1 zOsxS1@2~VZnw1s#ScLO!LBL$ErIo)MC;CfO|)9d1y7zmwCI)B_^SU$ zUqgBaZI>^AdU%lS5wPuNl8+j55=BwgMSx*slTLy6K@%<}`sO+2LHiSEUAieXlQ`8D zcYhiPY9Tw0o`Y{mIAIxkg{DME5+DWnEexRmMYw5RC_M?Y^c~~jxiDpKz>jf$21F3X zXp(_h4Mygq0&MvH!yBk}{z?vHVhQ@myrL9?(F3<0DB_!KwuJVexi|-~3xq2=nnYXf zk#r4c6?rfgOp8omfjX-&*x8l5iQTK$P$U`xN7|@yma?Ln!cB7PI*HyK8o1%?ilTgNAZxRWz*1@!>|IMC>9@E!B0dgYTw6^wF<7g;6nTvPyMn zG1ZQ)vF+iyh6o|a>9k6(}NXcf05^vl^ukRyhbYOshIwR+949F4jNXBShkBn+ABk{nGf2-k-pph z&T;=yqykC7kpiR}S%{YU^LexBm|q+JMhxzcC|(>hd2yY#zz#D${*9BCE>i~SZ|!aL zGLC~*;Sjv}c#h^|7;*=8UZS90M`ZGlu?r;{9Kk>wHNm(Rt1CjO_HB&gGOhT{Q9pvCTW&o4lV9d$Z0zF#uVE`{ zJ*g@K5hF2{okAHm^#M8Qg%__bY)WGY~e%RyIA2)OJgjng>gdORLVNyk<% zT{pgo!vj(uf!O2X=fzgd8}I5ZN6Dd@$QS_{;7|SD#D)J=lS-A4s$PFcPC<866r&j_ z_^&j-{n4>mqCO!`ZLlCj!BV0YQSi4`!wqUk%EHJ#*pvi9I7kwKKJi5+4A(jfq=+DP z@vfNC*Nzkm<1V9LvcHkI=p!dMiUD35?vkRd0RujQ^q`rXfkj zcf7C@nYz{Lx!4czc7zuZ0{-$lK*~hWvZqqQg;d20VG%sTC5_8Drg@XRX3Be^F$Qyw zv7?wSbu60s6~ndd^RF4B|1l%$N1hNXIM+v|T@A^}sQ&(-1l$CNpfP~7ZgMtt9#vCn zi!+y>$B-_6kAE?z_|{x6>Y^dPbbM=+0!NO&NML(@Kak|M4f1o(UYC^F6ChqT7Q(=t zC&BJiDKSH^B`J8+*t|oO-RSbsv{aZ!-O=zH%I={JESaZ0{X27&m(s)acw#EL z)v}Hbu_SEkh*vRZ6)6(k!{QwUhNt{hFF8z#A2S1~PZ`;vzH?PH9%JnAz6`jc;LC7Y zTSUKkw00d#YSU0g$At~sY4xej@-Y?Irs0;?EwZK{Vn(yC!BZQJxVIh6w)N#6yhKBb>K@v1;-ceol_g15|pNEe${eoG{ZM!oZ@hUK6U zF23WxtS!AuxLdG?f5D{htfoVMio-8(!@DTP%lsN?X-zIH5LSI#jo6_YrC0e& zkF6O<8&1FRqmOS~yg>@Oxyl=FGIJzDl^I&DI|sR=(6p!N9Hy4)9)if8?IfXqsVWG5e#6}1T=<96-(P4m6qYH4vo ze5oHHZml(k!;iT<<~(Gr&e83pJx3^`Cf_4Awi#$p^cSigxIA2dyqj-%4ysqEGOnh| z6H+4yvnLQYy4Rzr$2DWt(JoT+p3Djdzrvco)5>i`wRyVQWwMhk_OF6Tj{gKt7;M9!1 zi`x2en1|HK!-CZkW$)Z(0P++i4e)=UHqScUiM^hwwuUptbLhZ+X$)iF-tFxDe}0 zXnaVcYlyZ~vAsN6^238Kk7e6blsn7xP~-f*S^YPUO&<5(R84qtwqm|p_vgC36gNfq z**H>ZmMfbw+-`(8%tR(^>opZGCoyDQ>qi}dMJLZfzY)s1J@ND2mL~sNpopAVv+bMc zVYq?=MP}bk4cH63_5Y(_Mx!hXAFOZ==ddDDJ{!PqETLkd zVt73rhG<^hHJ)yrVr$~QBC-!+lReMY74+9;n9;%i^7{sHGGKkxZ9}zI? zy~4zO(24);3(w@nST@~?^ZVw$gQ)@t6~nfc##lJudSZ8g&q@?n%q$={zur$VsV56Y zXE8wg+j1k)FiF3aCRTSy3%jSyy1M78xdc`**8ijG9>$&*Eyd>d1O-Q$OaBRn9e} z;iEU$f8c9q?_kfyfS)q6vmdOtKjZ6?>-$gL=Y5SPprJQV{ZI1|35?Pvtss-Z(Y^im zO1fhnT|jQz?jK(VO1l2To4Xg!uHgf@*0je9G+(E7W!tt13959mbvp8Rd|5T+Pnn@I z!Az=HWHrQG?SmQejEjsC+lO7w{ZB%j&!7zlTI6C06kFtyv3b1nS|$mPcAdA$$h~`2 zbhzB=s9bugncJJ#9(qksveuXcTEhd&bUOGsXZw9Dbk~10x$N=aUsnh6Lbq=p{mQo{ zZ+Z)HMm#>>)^p2D2P*%*c8+o)Z0D zxTB9yk7eD7ASjM^PEq7I)r61ueMTBbrhttpJ)LND8f+3#+5*z(mPsNRQ}!h8BiJ#0 z2|>{S{6T*~7c`9s7pVi2G-?ArGfna7k6p70^_kAkNO(-O(}%`evFjj;G#DoEf9xLn zr~w?MQ6c)NiQ)Z^`J?=s`>Houb!Cs?m*>Gv=F?dX-sa;MG-u$J#N{h&=h_QJ_Iq@) z(l|Wky6MMtA_{q@bY~2jAPy(zd`lY(+dn^tme4{v#py*i2f-58yzd=~hNQ8AyY;xLteZ4Gp1J2+(!T*V=DP*5-j}7ZOm3UH9bjy^ zzt>^AM+EE=V;N`)R02C9OUFQs453aYQ+iLtueYcYAjl7`=h|K&>HJi(HA)RWry75f zeP`sA(tY5etatxPgMe{<=jWXzPilo)6_C;rg92PxpfgzV%tjt<)Zb<1=v<_)<+0kQ z>AIVFeosaol7vc{SRuh`R{j?c19Dz7F|sqS>|SW8(#VOXcpk_E(>+(JvG=(M^meR( zq=fO4f}<_uO>xH=G-1)#2q5#cPe@=m~eqOC1g)PPg(i^99_Ryd<_7t z>>jC}`NPoK9rQv-O0pMo;D$Oy*+9^$xtMhdI@Xc)SC$aCO}@k{a$TES$e19NBTrr> z#R?4b6p)H{J(Z5I^9 z*Y1%%s+}XOJTAYJyb?4JB-0?*jm5y>_qJX!S*9QUnX zjs!vcLMzIz5_IK;FeAD#3?Vl#C7OL6>b=takuhtjv$lWxMecMp0FHkOfQ;b;#s}w* zSRoW~7VnvQC%dYG8q=IC%tbFSc;x-Z9J1oP#f*fu1*;;vyE}BV4Zz;vi)g*1af3en z!)kuKsf2bG?Ery#dXN%35d?Cw8CU`}Kn5z6m;Q7HCW4wC%&O)a-7v6vo}bSa=_)oH zt_E=NhH7?g)Xg7trC?naljLdGzsH*htteylCtPrK5iqu=ud+DizxG_mxysVj@>ZPJ z8Oetp0NHGHt%^cp?pryu737BjsrF<-tHB=T(|So?&%Ym($th72`&%p$u~A#= zT3*kHCqqd_#+4+%4Ng_F*&tv4C^C!`s!z5YOc(-`)4^j8lv(q!`-9RTNon@SQUW<$ z+lez}yXU>wlvjK0RRk=soxopSr+j|e8SGU?YxLoeQh6RJis;$xC392f7!bCZg6_KC zxd+$j2;6IX$T0ji{m>eoIjZC%^c;toT!zdTR9|>U#^GyXIvqwx5Kq%g=(s5cG=A*t zTm}eKdIZyrhxiYbhSYmJhP<81l?~FG0{QObZ=tKt1TxF)^)OhZsxJeAZyYu55uv=5 z*Qb{FZ|K3pYI_t#IJ$`S$aK6DE)GLk9}NrHlH$d*d)#~T@B}=`EsVLa{BG;Lf|EA6 z5ThHW!k7mo3*V9Lam|MtRl)Pi@m{*kO`4&i99YJ_Tw8;&qj#{-Dxj=x4Ww<%o zt8_T}Hh3B`Q_kX{pJv9Q1a@ zV&A~}zBlrhzUsQ@n@JbALe;XT95`#~i`igT^^$tXEe{sHZ0QqpN?H_U<#l^XX*Q5oz*nia*?T?ar;+r-Oej~2@nIxCD8_XEuf=Ha9? z`>lo}Uc)D+9wzi10&>&HK3AE#pe5nSWlcYVWDq(6=w&F=LvN(HeyFHkXo}cRm__Yb zQegJWo>-Q z#Vl-_uU6DZ&jX8JoC9wZ~ADcRhmh6HR$Ou|Ud)Gr`!)o^Fa-YS0sigiVZsNp~iG{Ct(?;2~ zp)S1Mhf=_#|u1zcpm^)Mnu(i&W@b5n& zcDS-rc|b+^oa&~0p1`cv9?q zFOT&RJ5k(dO<`mEN|-ZA*6htEPGMIl{(Vh+v8hy*hL9SRr~l`-9sQIMjzMmDBigo^ z;NIE8}WcGe*c7F@{hR;Sxkfq|3%5Z}$G0}TJu?9BPUVOyA( z|F79u^S@QFBe&iX@iXzeBtFuO_IIZ=jL{VT49_SU#_>rMd^W}45Lh;PQigRoC3uTJ z&Zo#h-&(h(pPX^n#0kCI9{J~|<;%Yk+X?({L-aVJafpeQ4+kLX#>XGDMV5BQ=KD1c z=@IiV6a@3WMcEE4)AwMf#X)ADJjeR|AqGE@E?Mi#OHq?l@Z|yWe&8%(xQ8VnLYk^3 z5PCO}+UL&?%^{t0_Q(?FBaO~?Vcmq(CoC*QmK8>dInG3skaJ9(n~qsl9enqG^&j=6 z^j_}HS33qSsCZxoY13Hp=n-i#130?z^}WQ7+9>q*=hdv>)5nU)DaPeJesdf;lJ9pt z#z_!t`{&oo{man_FY4aw55pXiyMt_vu$+Px`d?*u<6`w*rWjV&>lMm|8g^{Gsk749N znnaCE`U}ROa8}!fQv-$bmpzo4@u`dL4!T2TG!QITJm9Q1msfh9m{L~D#Vvt3;Zy>& zRKEKx^2_G2_uT?zsJ<%SIn|Ktfr5!N1eidt(5I2%mzWyIM;`|$XRq?U>FDlmIpPA@ zWHe=+$@+3StQ^XLt_d2g!ZeC=3cZo?C_)NOl>xHG06ikFz>qOacBR28&iSzk8TZnN z>~2tf-D(U0B4h^;Z(S{&DK}@Hvl;fP;9VxBkDr6zXX_@ z-y*1d!+ecK7bU{n%K4DR(Tt(Wu+uI2=Z+Xb<@t zpm@o%d^GExp9MMTbl|EUL+PBlh1EJz&-s=AK5;YkhvT6F}LJ^|X zk0bKrYj^60Bw}^$JHK+~;jxg|F(8Lf{l>`UPS-CL!ZuL;OA-zE?C&F0zm?B84C?8$ z2c5(D=0~A;YzigYczH}*8@)gdfbeXcLDpSAwHxk!6zbds?U%z+`)^C5fFG!b`tiif zJDIQe827xpW&cVH`^%TwGxm3%^nfjze5}+79iHXK^m<`Jk;9~o#LOAtWoxH_bUvZL z#u$tFIumSiuGrQmGOAo=O#UI^mjk%+-QTmOa{{aUTS6Xy_37GfLDJBW%%TE(@!uD+ zrexloYe#vRp*p33Wg+M(bJEH>XK#8;_@fpN3+SSpjex<+J1;Fy7MXD>d2?PWp9JQ5 zsPGBNOsF8$5ibXO2g#{lR#lix%bl3n9S)dvGoE~usXN&n6aYjhAwI{_)Z+r&@=SE` zz;J{Q#BGTpFv5P5uoG5ujPsc*7<%Zc{*k!C4#cIq+1tW=RBh-Ljmh9JTdZ7a(1078 zYIrUC$TgULt*?n*c1nJ@W4BC;EZ!T%oJyd@F>&l$-rq{Ebe){vbFdfK85!_pR zx%9#hVwV^r$)krFQVtHI7P46an00gdWEI@zJ4f6aSh97T5QmL!2^sM!8Bjr{s-hEm z!ioNhOx4|m5Ldz(9zFty|HjWhVB1A=NxUzq#$*y8;X^RZYYV5TIMa>sQzLS)>P6V8 zXP*t|foXNL?|aK3deE`r)iBDM6;IBFqHisS8B-pcS|r_yNkhfks`0Ea5jrMiXM}*= zTh*m##Q#l8O6b+eNNMh*CY}I0V0pSWIi_x4`-HGoFdb9-EZ2B(?mm<5X(5Ipo)-sO zOo~=qqg%8L17v~n5~tzry1Dt*o&Y-BgHB~V`4>J%--*?F1$RxN1}S-@%g{creCYTa zkvm#Xe}h;0;M+EL@&9rryO}?cHdWVg!5aWpCR`xMj$B>|0Yi;ULkdm5NMN4vl_Yd) zTwvJZw}))l;98cy?hyHpP|9hv{gG$XfnH;)Nm?B@ZrkqL`Y%x9??#j1QTJ>T`@tr7 z%C>7JUJi2Hne3a<=i6dEde=#Tn9HiN)1znS->vC~WCZj&QZ*@+{Lc`#T=+7WU33I? zcH!Y=iq8hGoS-mkH&br1eZ1}n(xAj<62v{0!^-ehCK**ry6ldoXR*$qThTs_ep-u(SXO)>zL&p&a`5sOOWX*Ej`qUC zrAK&dS;5T%w+B(XG)g>~t?z(hR_{h-+!|B};bXV_+E>lHuhtuf<1a_;rOs4OmYoB_ zbP+9^rk&Wx3nJu>Cw;zTygHFSrc}Lw{8Gu=4hIo}qqNAcEeB-8%CMBY`8MwVY3lvK zJPw3MH0Ad3&IzdmMXbb{FK)b!*oj#vu^u_|xNW*Ld*fiyV3Jm}tm|J7pJ|_VB-XgP z5o3g-_y;EOF7V#4N(Q1PhA`h~2AAE!4}qJ}XZ#4&_Yw+~_xP|fc1Z+kVHYayuZy}Z z-Lkaf26w*ZpZu9tvenN3J=#-jf?x90LMG4vdsdojV{bY_bwPe?lqV6h_0;Pexn4D5 z(4D!YKHSzI^70koTbEBEY4(;U3p3A+;r$-4IK95LfwFap(Ye)Q`|GO~Y*zR5wL|3> z!sTw|(tNl`3nzBqhgZS|iE*uU4a-uQ#xme0DWM5rqfU*lrbumWUEd!)iM?pNTiGiP z+)B5MYKr4>`-o#SeK4l7N1HR0=Dx|Do%i+n!Y}ykBaJHxW&Tn(%FLA1C95*xH0T>!SbmF8B`ufDOv^p*Fq?HSgPelj;_=&gYnXeP!|;#EsH3 zzXE+QN!zGHzboe=*6KZSrAS79R1=83%B=SB;=kPfcJ#pI2HVkX56(BgVg(D`F2XSd z-7&PuJUG!$bbaY{H~=lQ#tW6B>)h%?lccxjd-I(E!VXeen*nQ4V5vT>N0e`8*U-Q9 zr~d-?GnlXY=33t4pApgKq{BP)O&r;x&zConBqHa->s!ki-va$VD&eCZ-*0X2&xI;j zVM%}Vo?qn5W{qB4iaUSV2}De+YfhrfIKf32hChuopIUF~J&fmlXRTI?L?51>KU7R4 zN(D8y`vFAi$k4+WbgmgEEEli-XkkkNMgIW-{F4!4Sv1K+1)h5Jx_D1-en5bXptrDUX_X@9ujbPeg#V zSDMc9*q{nFJ&KNt{FLZ`ZVQao)(ua(hMABmCQRJb(T1*>?KsmJOm|_HRG~$?>zm!- zogEToiWW=6KH9-8&KEdp1`v_a2(}62PeLc{1_XSC`&SaoOjY=30jb{{mqKtPjvta+ zc!*>&%5`d_v61s2lDOj0vk!%*vKq%#-H9U3u3<_jkoO{A3(fFL<|D#h;yQ#MIH)Oy z5xEr&`i|v}uE#_-(^&XkaJ{=P@a9~ZD_KQ%_LRdV{=&pf;DO~gWDi@lY?9Iuvmjb^ zT&~Zw<+FNekI^neQjh-0S@fZ=VfMLQ4Ay>3;sFQU_`WnQ7l;%W(Z!o*+Dg?e!&umJK=`i-%ttd5FTS2j6*yxmX?V~ zKal|DbD2o11Abe)8UR9IF)?O| z7o<&V6)$ZkWE=q)Kw#%WZ{VFyB12+5*o`;-LbHn=@6N4PHp25X1m8t8+dM9Np6< zN=z&XBDEgFX!XA|H1Yf;Y z2YzW0NUvb4n;|_a@(mcFh@5yp#pFz4cu809F2MyL6104hf_k2-ggG#>h=l@o z_SKRiOIjH+$+z7>r3$O?zVF%8F=!-dRypqvL?2~w39Nu0LYtIe66QjAEG6(k(8C)I zK>yL}tO_c^^Z+4K$E-3!`)syBh3?$&oUdzg$R9DUoJ)=C5j2>t8ivxDZtSXg0vSLD zE%L0ccB0vnKaDCP1*isI3sI?-Y($^X?n2jSAD&`A+A^UDrc-?_M7fitw)m|tRDwE) zPgyLrJgr>OjL2dyfRUIhjwPR*ylDp0_Ioz9BB`gGrzF8q8pu?H!^j&c3|%Y!7-&Wm6C74$AN`>pB7l+B3kz6D zRsFzm@BnVodRz1|+6w7x8Qs&YJBCdV1E}6=kT?xM%wjMS9IU7a=y0{%pe8q*3uoY#yY;il4hol1z6)Wdo0Ju@hrUC< zf#L^M=oD#yb&czgT*Vt**G_}_YEcbpeT+qVDKLhwTV5b?X}2g@*mCROC|=gycrD6t z;|VbwEjXS%%Td)D(UsrESyw|@Ar^|I&{a+VH|Fkxd6X_hEAiAS`B35>I$~tSR@HuS zY@MMdtA8~(VZ@(W3a_6{2w?_u$FX^UAzqjrZ*8pW<1zG3by`2uHKuTWC5I@ADaQ@s z$P@SXiSx8gUb&i2byi+_6J`*hD&M$!s;K%IVLI$D3ypcUYh@TptbXjU|~6Tf=VCzOL4=%>J)nr zB(Ef+ovkxxqw|~U&Zv#Wn2?JJize7N&7lvO3XSs$fvVC4_oZ`2=u?^-u1>%9v}S0$ z&g?}!M^4##D|tHIpIX-(Kctmhu%4$tYxyO0=OG&MLeD&n-SfZo~G5sXV{fz1!-{ zV21B~B}+}5o4uJHW|B1~nrLD7bLple>Adaj$kTUpDW}NR{%B=Z8GoFtnBD7(w zHEvFSYVJi|=*l9RX!hdFG_r(0a8x|YmTSw>Yf+dOJX#hF^i_GlouKt>&F|vw$b>nR zHPUW54X_Tltft1Y<4H#yhYLrFHMXboT+i;ivdA9{B;ZmV;XmQvSrX(q^ieOl=>gPmw=@K#QY<5Ki2)Ra!l7u07r zGM*kLX_R@)gLNwS9O}fYIO4#>;4JuRWqWEvP*b!NRYdCF_DW!QACjC5QpzG3$#DC) z#V?mDLl@1+@Hb!OQ&C&~yNASkevCRhJBvGjVl221&J$oO&&*9Du9_!jPK&5EVOs8P zQdV>l#btBS;g2#Z7^Q|wSZ@kSw=$%PG+p=b${?}%81$iPh;!Hn~+ zhWmH9X<1oWu#=%boTuAf>gz-9)Jg2k0z6-)gdLh2!omlWPLM%FhlDs;W!Co1x5t5Y zX~nLswq5R@HWW33`JJERdE0-E=NV5cq+h2`ifu>L=w*joa}Hf$kGCEoLp#b@REuTv z9QMd}W1L@J`E54l?_BUX#MAi8k-2tS)9(GwNJAHc7seM@ZYI9xfciyfu;ZR&>4c~>!2L$iYHu4jkrjy{kXT8U=~Iit5jGL)OEa|62Xw#%Ye;E z%J-X7-2U~KC6Uz^MdLWc2IPV%DA=oj$bs1_Xw>m-!}YW?av0Qo!VZ)orbPN8N}V7* z=Ftu@MFLqr*ij>0?lEpz@YKL&Hfx3auGDU6_m1blVw2;64W(1eW>pd+{JIk7Zv)z3 z`8_rTJ^W}$sIhcJlprCKxhMH;Bjy5XWnNkh@M#%x?|dp72jBagS$R9COVHeQ)%!{I zet3d_a&!_+N_!X&tHx7E(MdF{MQcs1!4|s|tl3YW3p8*s;^NQ{lO5e2@vy{`jJH?A zj4OhG|JZFb_=@3`uYZO`p zH=77+cqQO9%}+6nNto&e52FX+KQWgM>ULGXiPle1D6~_%y=zo=jwWix1bk+0l2u^~RHWJ`Cduz*olI;n?sJ5~3ig_L8 zNzNg(_4(W*%BGd=BZUf=JBaFtV1Y2bJAm4akju&m@!~Rp^b`*BpQ?GG4M2wy&=_f7 zCHW5b&gLvV)&{0kSsMp-=mKrW$26E?O&--A>oRcf`$zOUWfn}>qy{n3)g9B9Fzq(C z8UC6_+DnaaA{BwTCS~qd;^B-ZhGh~#udx?V9C9$viaIVdL9(Pe0;b~{JfyhJS3wPI zRbaQd6#I-iCKenoeo|@2fet^MYUxKtJCjcF?2G~OzSHhCLrCC6BHC+Ist#_aVBMil z(Js`jnh_8!cfAe4M&S*2uWiwGwQs~5np+dxHJ1)Nle|~G-D~0ASR3ZVK%Oml;hNruF_CkLf(OG*O4IR4`B5sK2sR6&}5!0 zrU7CM&E0L=sGEDEGWDgQc%V1}>yfv6*Z?m~c@aARv&gP{u=|vhY5e0qxX&ES{R7J-y3?C9+(3zumtPv2)l$s^JayU2OnfKEaO_;fG=kf03cJMklXJha7Ao zXD+?{GDD{yO!!rW=* zBl^02T=-hk&jUk4jU75r1j%b?69He^vvQ%9C92=j-i>M)|5NFk@?HopttIGfcV?BI zI)y3;+02FW#vPbyFS!$(#$dF-s+}Nnm+$tsX4Yx9oma=UdY`Mb5 zfV2OHv3F_`CD4|2+csz0w(Z%rZQC|y+qP}nwr$(y?R_I|+_O)thxJl_prR^9j*t5wRCjWMF_D?&@}FEw8!PgQdt4< zGu2db^5(uF)V+O#%}?pRfL8#9>*4UY7#eOcS<3xlD~l47{G|57!163p?U4o(sE3oK ze)HuUg8m#u7_anYOwO(6_1JAafDe&1Z_;&;gQ5Cxbtlg`1p@1&>2wTbd)vwM!lSvg ztKV5gn3>XS(_=GKUh+&~(i8^B>0X!Uln6qA`R?(BO^CZ;lkKw2 zO*Ou~Nl^!XPw2<5<53!H|6Q`_7^Mk5U$ensJ6VdS-Puru_r5$t&^r&Ivv+Uw)`+gc zNw@3RP)ai47`U)Q(`6m+>~`o4NsiJ?kb*P+_1?d6=y=gPBA-xrFO{#k7W27o-o-aI za}SiW+O02;JF)$!dx4FsrlXdBEWqN0tT%9&Lu%Val`C?@5-Tz3qm^q&C6bB5)#Hgg z8lk`+moK4!wXB~jc~x_qIIjn+Rd**P(*Mn3rACwv>}QgxJFFHVl!Q5&wE7B5%-fB7@JnM`!!Y%sB0qkuu)f>gEUmA$`h%Rvo0Ztx`F-5B z&f1VY-L@j+4KC=~Xsy_4OF?8JF(j7nWbZ#oF{j&nM0G?YWD3jlJ%XmVbi1y2f4{f< z0Pi39fc%GiMD6h2`g1`IQVJc~0I)Y-5o-sS!29pT6&rbPMpw$K zBbX28-z}9Vhd9ZB;KmWi*&cg-KNo89y>S^cd^JM0*1!&#=0$ok-Nh|S|2r?7&-{wR z6!frgB02QP&_0Hph7K{Wwg@jWgWz_ookx@VcWP;4e-Ga`ulbQF0;e5ogLI{P8?!Kx zy&deJHs8Yq?EGMlH?~Bm&QGezQC8ZwCb5wzBJU6HnQ>Z_;_DmV|4h>_6_b*0A0u>A zBewR|sZn!YcgUq{{>BpvVjX=t{>f`=^txkfm?;gZ{0-P5Pni5nP?&*B~=P;mM7`mx<+=>-NVn~tS=7>xHq9OyM(og1B2$v9?;D)fJdS{v4~YV>$!A7DR5(U(AT&sJ@a5jfZ%-aIWZ#^| z8k5Vke^VVe?cV^6qgJ1g4y!c#K~^Jz{q04|s1z$%pvTa)V%LffFn-^O4DYD$d!Z&} zrcV6fk$0adri2l`8tRqXOko&Ql0Pk<08?|wv?Za|l7DOHU#(VBuS?nG0U7s27QI0R zI0i&>)u0*}A5}1)BuXtMHuy~>&HS#QwU}3$FUE>p0bHif!T>Z&)FAi?>L}6alBuwY z~a@yd)zUY=!n)J(6jokLW^ldfhZtflsy*pwY%;eE0ILIlxtF^u5(0z0agFzR0nze&}jBtH<-Ms-agbEr%1heus!H+B#b5-rl7BXAr1+jn0qRWkh z$lk^Jx_gf+7nQA?v-)?e#QVO_9Xz9ek(IOvo^GpJCd%T za%^+pR&7-#*Q#ph;I(Bt6Vu`B6DktCd3N^a_+^zoo>75fTkRWccm(Cfc?EBaFk|ZS zz=d}N3_BL&BYsWRa*AzYrTn_+jw#YlN;n_g%nX6K+{&Lp()B@L9I#*niZI)kyB=-T zy$Kx#+CP?et37PrlN56>SOZVZ(nk*u2ROrb?0-N8YDu)fl(HYk?}9J>ax=X#tjb-j zd=bD4Xda^C#KkZI5rriXeHhIB=45^p|KJ>M?JXBMI~jD z6NeMrIoO&C?<$4je#Y6ZcazZ&u5U|6Vy^p?!g~$%7!w6>O;lH$m5T_ZzBQKvMUx%B z1;#V!J$qd>A|9HAs-;PSt86xBn26cMo%>}(;AsrWfQ0r z>KhmZT{8dh;$;Zk zp_61|TEw0b^Tv$Bb8phvFqFYI5wlaj6T5+ZN))Wpcp8k2R0C|E>fJz< z-aDB(2UlY{&&X?)1s(17UMp4>FT&E@a`t8~zT@aTqzziGEvs;;`6?L*Z{HB~f+adv zA{~Y#1+R@3?-AM`NQD*>+Ro_+-|>gVV_ZA`IW&ol1o+7WfP~TAFvt+X6$Yd3ob!)k zWdwJLN9e;_J^ne=dhfGc;woLEG{ve^*)H0K7S8D})eJrC6wM?b(on_;EHud)4m6fA z5StV6Z{m5#O?m3|G%qqy%uL}wAXgV#fdL}y8l)fuPeC`If!S+`$MLBi^6I|ceMAb& z_Y>I^#R*#rRmDOgvU%t}8~85Kcx-E)$`4&M_+{RfXb%0OifKn2m<6m5WsojF~$o7>M8sv7Y0hj;v7N=gB+83WwOv`BD$R7$*w7@4A znO;UwX}!YX=sDU%LONFy%oSeQcv~=jN2nM@S>q6HZQd~|pLQ_bkWvd5!k0A1vCk1Y z%bm(5Mq6>s>A3kNkU}+>`(tDu0@vfy`bwygPa9m=bkgk=3nFd4+7Kd4yvl>aFu*!g z`=~e)u~RCo*>vQ`f@7cJ#<8f;Osq|vnYE}M-~wS54Y&h|wUziogmEpID;;Thz>-o7 zwsG!A92%ougO5B>Zas5Z9bSX71v{F=rLrg{o*#yakZ>8^q|6FZ-EEL5)JgC!ouMe* z-#Uq;59Ty9d*d@hYH=u4rp`p!VZc`N&gsWAOwzXS9-JHVqspplwj)64?NFi&lx$U~ z2vfS9)_I+>xX7AIaSGm2UWSKC0wS{=i;zYSMF5m;=$d(&kciEsRySt?TWQ2V+KEfJ zttTc45CSz7%JhF7l=|QO*AOP?@;=sg6Mh>K! z7Y~1|-!1XivpbeG*UIz@Sb4CTd=zSFc`!6J|4AhmghyZJS0KB|bnfJcGdFNzm@iF; zop6Z|=Tvi#;3-u`?xyb+nZRTgH|@Q%RxZxNH9=E)@|prz(ATwnu90n`=7=b3M?$o= z^}d%@J!LXTdmmXw?!C}Lu$Lv1x}guDcbu;?^s`cwUQ`nmq9hl99E?dUIO-->M=7&h z!n3bJFFz|fvhatmBMjBD0ZF0MI~J-EE=TO$yMrSizNPxmo-h&QBmHJx_hvS3ZD zY2dzWz+eyX&nVhU>QJgV7D(={-LSuT(SQpfAPiA3VYz~G;Y&q2^qw^7!2lP>` zz8OFhrl0#H;A{eW8(6^?vxu1B?-i39(QE<8u_0!NHG1)7jYMDFbFjc-UoL!&y(`Wc zNRIAX1{lG`1d=YrlSM&ueEm$tV9eWY1|Z>gRD-4)N+x~Pmx-W&pr zV(JeZNDWkGP1fGrrzFT6N~LEUvy1GB<>=NJwuchrpF>} zF;8xuy>n)<;9I6~mS`!w7%q`f81BcMWt;p?ZY~*v%f8Y{BFl7C=SZ`0kHW8@qo_a* z20?;A?bBFnKJTPDtmLTbzcn4#ZjSD1ZCwV=h9Bd@=!|F4Z;`=;pe>xOJ+-Q)Qm?A) zi>t%%eP7ep$nb#F;9Q~S(*C(iY~`i+htB7)#l+%P$1Zr*y94`!(?c&}?-X z_@4yBf3<{XVr2YZ`L+L7FpT_s^rqK?yp?v@fx%my`c;8}PIEU@DWQ|2 zRbtODU_e9q&dNqcmv@Zk_aDK!YOgW6m91(AY$tR%J;BgDK{G!gH$6SNKJV(f>>Jz< zpZ7jmI<4Ep4d}G2HiJiB&pE2YtzHM0N%qI{Y{;Kc7mr+@A7CqLudi%4Kkh*>;VHYa z&sV}?h>$q8blh9mHKVt57-DaNlsqFf+?#FxX2|lKr4ONTB#35T?)J&P)i2ZZhzZpR zu)~IUdJWUWIytksi-fOM#F!#^L@0D0bknZ=ed?zY#}Cw5>O zzqkc%HuuGN`%um^l=(!jpPe|_itz(Jf+;sz-Jv+$K3;G67X>`$th2kYpq|wUo zSuooxGIH`X46S{{j|fr3D0kpX2`;qit;bfRq;wx%lHz_?&+5R( z4cpJl84`g=jSre;ehjsSFfSJ}@794X_M#Am5uAJ!VOn&$O7bQpHNZK8k5%>Qi*S};^QD~3RKx}Dx*kqOh_JsLhtLh@=is(usR$k!g zKecEsa6Xg{R#6LKbXq1q25rrs(oe}S!9_cz|1ji{n$72Wk1tU<5e@e&gJ7VwE%y3; zl6-iG30=6AwiNbHpZ#i^Vic}TcPI0uW5{dWy!l{}i(0yc6SCvT9OQ zHYr{b-#F813B#W@WwFG7PMOCxK~`!mG1R{5zOYJ-7*%63O@YAW!NJC9_iaV^C4p-J zz1KQLjdJ-XngeRdx&^8nqz>h))jngt_@+xDvl8ct6BF$cC3$q7s`m6d^H@Uk%mSD# zB^+Bx*;pwqpK-wB9rO2n0 zUF=<&rio$C$_6g{lcFy;t;R1pQg{(ZNveF2?g|h^Nkz#_6p5q?2-+66@0wa1T2g*wvsEZKkQA*%Dwie+D0k|_S zMF)PAOJ)^^-An0fUc zNbPW>{hGq&E@vD6j&_!R=6*3pTcLdk+V-G3FUv(EH~51(uOkZ8itLs;?0oWUkWCzC zmU}2rdQ`8-&I$7wE%i0$x#3t6{6(9j(rWPNYAF66)H`LfS{Laz*=1A1C>2A)Nj{VV z&E8&$7?)=LhA8b={(nWv;>}gm7;cJO?=YKr_ds0Fyh71%U(h7TY1=X{>_%(>tCiv5`8wZqwL-jI% z$aw{v+?ktR5IFcw_neTR!=2p~I1>EHFpjYQoNQW)aGxYkl`&>!$&pkG+>c7n4^J#;YYmGiI=ss(= zb4QNN9`Rtu*Ns^|fJ*DkWG|7U3r590Mgq}gMJ`X5pf`p_?Kye$C9ehMf>4PIaMP^hmY1!?mn#;6Gcvk5ZLJ(Az8ZugpawuLq)u@sX;mXq-8P|k zw=-+Da%ULN{1FpLdk8r$n2ho(eyCj(&RCFwVIF<)9-_(XHIrW7oXe*N-i4mglM~-` zu!uYo`I?ekQ;y0h1?4E94bUKtwmu0aRj}l#1@c}&T zH%`x#b}aU;Iw5#As`cWr$rx$Mxe6obc`m0yE@BiuGjn}voT;)9`Uqc8atH1{*8lG9 zG~gSQKPik6EETT2LNTOUR}S7NPALl(1BO%y$O>*Q;D9aj8pl*<|0AOwfvhd7OPRaS zTn>p&;V9w#QfsPS#P{hk#B}26Xg?tet~)cKk9NX2_;Q+-T@mmwn8=+oRjgNPTfS-o z!xd9gCx`B^)g@Y&?wUBcllJ?d@xWzq*DOw>n&x3pz;7ebb+6upl_N@_T`LA%8>+6_W_=Y zVtTG6#bB!gexV8>ZJFMA^WRWbP1D(6D+IH=DKo7&X}T*Z_7jpLNAF66?i?jButo+S z4n9iI*mm|Isyy8mX}lC*DFmI*$STWs>WT|326R8H0-I0)iDV8@5EP9;qmyZ>$9QV{uS%Be2FJ^=kjpOZ*0BXS9q`?Fc!@GDZ8)VQ7W>=w`%+6 znc?#_0oxBr2o?tK!462AT^X1jhzN_<=Ev*T9nUq(2Boy&I=+ij_!a59^T`lS_duJ% zXX+Jp6#FC5mGj4RLh#`O@-ilc2>WNhH8D(b?O_+@bpld%#j2`7o3}cl#{VMYXqUxn zinL|79-_p4&$#Xg_tV@a?r7z1bO}mmZ3r57JBh1@CQ*CuB}Nyl4;GM8u0h7y$zftm zF$f)Qntb!^e49>B_VYt@MR4zH#^0{s=r+fUK$zU;+YsSEtnm2zq3543Ob>1?6O?e| zoWQV~a8^qgTT5rk zQ+yg{CUNE@x-Hnz%u>?GFpH8q^fq9tGn~kPau7Nvr*G|n#sW4=w_iUj z&VyIQc1aYAs5wtnBd$nFQi!d10mVCH#Z|R;Zs=wxuR)aNJYMcKfbf8y-3stpPj+k~ zgo=3h3;I`f=S`9d1(dgE9kic;87&ad^g|;uvxL9NVLlNnu8&$3-ox?8B zgerrLv7Ob8&~gc-7`gUxbv{X+A=-BXmo$5-;kJC{cy(LaHHCjJ6co;G78c7f=dEb@ zEtyHszHf(z_pHvrpdUR*EHb^oACs84y{%q+4vf2fU+DoYOY~fRln@9OII_h6fNNN9 z{l2t7#}dzNx{TbvdsD)5t!OF>SoKLV>_{ZS6quk-)wyx*zchqU@M$?xQX01jIpV&< z`q4L@{>{c|CF*~96aae99V9F?WwTKFou1N1WpH;k;s_Pfc)kjO0%Yo+9=Lx{LH;_K zx?p|9KxNS@;ly-X1oE{uLaj{K0!p-pr=db;xs^N z1ton9l8ew{`Vvc}>v20r)>g`r@+%8Vkz)D0I-~F%LZ+8sC->Jcmg)b!lq07? zO$;ZECg4lm0I3$>gW*Ffaw!Ai-b{&(D|TAU=jSEVryX*xn_(Jrb7vmug;VTd|JK#dtpe!O zwKIgMFUai$XA&7VNk@#58Z%|8wu)cRnbIo+0c<(}d{8`_oIsmj3$dGWQW<^DELj3o ziiR&1p8vYDJPxgEHHcEk-JJtOi}fKHJ!iNd4}4}aI1r+OKdFcHb>djP zD&HFGxE2N1$?bP-wr?+5 z%@4$*Ck?%kwkthdrLUNP>dxE$p7Z4~;)$#+;?vLXT3=s!`&QMC2~M}d%O6HD$5jn$En#*AU*&@oM`7Yfx1GTTAUZXk}RiGRlAm ztI=3OZun4bA-@fZ$wx?kf5)Pg?I_J$zV7&jNQ5#7NISzUy1!*9ZQS(=-s%-gWA_HT zm#)#y#Uy*c>Q)HS2R_g>E5prSJ z!#Sf)6Ko?k**%kgt)8RjBKa>*4bL)clnhp=KzW340&!}R>C)a(%;yu#o$^$#Uwe1? z25fs?ITcg?R{3=G&J^BdL`Ay_L)?H0{0Z<40!F2AaTU-Wg~bxp{l>vYs6pIw!-a7d zw`umT8K>OPWs`U{a6s}k((@WslHwy78yfdwUzgE>!&Ykl3Sv5C z9qHGR6UIPv4v)M=vOeb9To+XiyMiFoI3`-kxP_BH5TJ`B@J!fWRiVnze3e_Csvwu6 zUSj!vY)hL^FRCbDXcfpM^Y(5=w+(`LZJQ+KiYa8rCR3rmPaT+n=7i*)q$$>e#@eCy zAyh>=ilGojSC@Nn0eYEEnt`8bgo9&Gr|bj?7oM=ldes`pWw3?ip&{zs(Ap|U7lZCq z8b3O@=~lLfvqbhs4Qq=s4Lq#a>)_ag_6B)%JHs=}gSoq{R@%RaVf^+aeqC_*q@-Uw zZd8}H_<3%RN>9CRM&)_DsabJEg{UaFdnX?UJ3@{W0~Vy!Avprq`kRN})#jN%P3djQ z(|5A9cDOI&8>DrY2k)v0w#_Mi%D(YZK}N>H;PxCC_f~bs528LK z?HSV;xIVc&^bySA<d`W*B4qK~(^>@f7lv8zw zu~gGby-13a=HYu1mh|j=5h8ptB>2aH*|(#3t40FB+N#gHMMWZkZqW~eV6U31$TEwO zb&Gzqh-eSlZgfA~%c(|ipKGvR>{Jw?*^`=%Lr;D}0wL{%*OaS>;GPSdwEZVCQ<*61 zPS$SgNt+-MR(SM!*N9Y(jhnzQo^S-c>=S)QD;M(3baIWX!yp1$OmowCZI>j{)w=`L zXh{uz*v}5y2W<0@Nr>L395P8Ji385MEX#$duxE@j?3s+sqGjaG8bSt5ChK|K0hU44 zAJ)&b(F$-folS&|4Va6XwmQ*5FQYw%SBY%edTggyeQfV-S8SHyzfZLlT#G)dU*7{a zf)b3BQdi-?b7H+blymv03*PtNg|(f5@K?xZD|p|~sQ`-N|6$l={;yzkOe{?Q z%TeE@_5Z=>9)X1#UP>t`c1wg;g-6L#Ro_6tT$B)8Jr&_gQa*)ph? z4;BNLULH>%Ww<}V$*5$O-Ht!c4r1)~R&L+CpT1sfOLBbX$aW_k;Y(~^7O>1n+j#u- z^ajs1u69hP1$6v!IP6k>OBA6`f0y~*6Dw}7uMyF{+XJFQl5fdfosbm!e_tlB3j6ND zVSLBvlWG);PIjU650QBBjH)fuyQhUtARa#4?g}>1pk@A$#dXSHlSO!r#_SQ>|Jv!} zLihH0kafCgc=^aEr*3m>f7mI`Fzis-BdiXfWm0hE)7V?V_N(z;zu?aLa(b*KO1*yE z4StvT@488`#@wIZ2ZfRP>tmlEJte+bKAzOJ?11z|0VW9U;QOgB)exHwG&^mqdqltk zy(QitYib;Z7od|I+YvE{N531Noo#ox?qMGk>}&Csx%bY? zh4pAG%v({FS`}{Cao4-3OKT_$4eToDUzO=r4J;CAc!*=%nD(+#t`AoHsQo= zLSTPg{-zC$U8pPoFr5l{gM`hY%gM%e@S2rN(b;BilVDW_T4$7fI^bvkwJ15>=Nf#x zA;zp1a9)|OlgL-?p^?usM(?-8h06N5WfM$d%(fNWau!rH40if!HnA}4X>}+bYsT~8 zf#6LM(uV=zE6c>fWPU+yEh=tlS?Z7ulc<-tTg7DE<%R2ZS~2oLypVAA-qxXGk?rpj zCcN*^QTm7??jtD$g-6JS*G@yOwD-#(?(dE>E}>D|MQtD(CyH*-{KfMNC`$>89xOvd zNJpK+5A(BiF0q%@e?JxTUK+w|R3=x2HJiIQ9;G&{<7G2}s$Y4PWG#lw`J?WP8AcIs z>z=9USy{iSF#_sVtnt|>IW{-9x6HM|z^Sa2Jc{T=hw(^n9TBF&vLw>JXRuo;uikL4 zMYsWYN}ng5Q~EP+`X!oAufV@qn%%f56@hxtt_q}lchm(wO`58YlOzGr*V-JY;Vh$6 zvfDD9%I$#G4c@J_dev4~o)W0FPfsuYGcudArWobK+4g4S?{Y>(Ddf{QqX zcP0LTI;d)&t z06Ltmm3ai3y)%ZAu{qpTeezN@Bf`&)qq?>_gi7hX%AIiBtsnW?$7D^H~O zjt5Q>L!BuTAPSBI;XSd_-F`*<(|M}#jb?H+f#VV{O&?xL%?nXWh^p;zeSvNvT)p^+{_X9^XMS({g8AoR1t zY`b<9g*ae1h5rnii6F(}Y6*MAG7=q;|ZRm0n zxLFj5_L_uH^Op+r50-8^_BBu0i%r7CpwC8Ydaj9lo`aO88%LuVaWiKa80jD-4W>fB z%n0f54a^da>9i05wf34Oi)3{PNsE$Xi7$?HUEO^a~eEiM`3EkDzQs-W-e; z41wJ=N(ao--)6Mbbu5aSQI~7uZ#H8Ijk9&k#|(b?_E0k0d~_2ZZ-b5VA#Gwu&X6i2 z7tZ%uSFuUA?#xj>vO)Z&pnOVCcavi-q6$ncbr_t2)p5#Fs*Tmi)n^v4-3CTU8Vw^= zY762fl|BOh$}kEZ!6{shH$rOkcDp=qTd&HG@`wfoh&eTda2+63vv@;Sb$+ zwT}{7V@|F6ZRHgb8Fs1e%*#7BAlqg0grKIdd-pt4Xx@@mDGwOp1STwfzMoIUB-ADZ zljBaFD;$;16B#3s24q@nwNIPc3L$+%dfrjVn9+gPl3JS#55&s{3_*Lp#f*l5H$Up9 zKoJ8_pp#%1xEm6Uxt!A^o7 zGv5RjT6yNQB}&@~0}KR&rjG7_AMK%?n2+3Ir}5G#79$@0gc4I(_dj3kFVdVA8R zs7$UyUTw&xrUImn-KXNIB~Vgi1=_au?TW^AzWaca&S=!8%5ddc|?1L)$Y^wT4tpfK+eSJQxT%YLH34^9C zhd-Bsl}k_3$|gLlNw1vuTIDeJ2wI|i{21tw*PWH?bWd;r=9&M{Ri z@oPdRs%{yuh>0ZRiRu6-a=(MRqFD+V9hXv| zI3{Cs@Nxc?MUk>uXKu&i z0iJ%_eCd2JwkZyr{Yt}gj%Cf*f2Kt84~6m~O%$h?ZafN}@D>6cNR5YMR5nD}Za5)r zJmApGt$g~DDiDiFD5T890AdGistnv8k?syAU>r{gc3_a~&QNi&YU#eXp8m@0CF8j+G zcjTb0q{_gndryH{lb$1ML!)B8LQ4>C#<#;`O_5RZl!uw>0 z%;2IRX1;#G!C!pdwEucB2BcH8tBttvRAz^SOj@o1ZBEN;G)Q~Q|2#pCIXB`Xu7o(t zZ5$9Sd_?y2Asg~%(}%@$zRDw})Kc9neDnQ|0Yp;-B*U=*8h&N3+5vteAbr5w3|QqE`ZLB7l&eEPn^=_Yq)Bhny8%_SN6Dl^s5y`gGIHXPecp4a`N z`~i^hZ*!eGOZPKG^}j>aKodhmD2G`X0&aN%@hv-7+zLo30dAiQlo&pcRMk4ELSj1S-dC>sGnTWZ~*s?A*MDQX^ z*4t$fBz~)TdWg0KqN%-ks*bw#^}K8p$L#-48 zsuo*9k`Y6}uGAq^utyQO<|P3i)s|zk5PDxpmjcD4!CUXY-LazwJmRW^E(&0e;Abvd zRror`BL0RC4y-C$m(>tyIuw$aFcg;0s*h_4E9j3!%99 zS^rPU@V{#bV*9@lK~vQit+3lK6rVuy!e44gcCo_#E`Ha=JRSKFhlAI}4XJC7Pm*8h z@x~)E(^`6VaT&-X`6S_=Vm?YCy5N7d{u6I->|5B3m;I|wWN0cY#wBJ=V_RByrW9?fHv>wZA*xnD5|2kJr?i_oK+ ztRaAn5d7Ra8dpt)L4RSs`?T4A{Vog$^7Z}pmYZkTg<`>48ZIHHg^@RRup1cL>fZmr z>F@3FvALG>`Ek~pSLgYxx%^e?d_Rn(_D1XDk8eE#eE)J*6js%AeqPJoUo%o*e=FmI zb@>^gLqca%&%rBU&5V|J-6&G$SSbY|5R=2s?{-k1PAh*(*IFf`jxVm@6)H`{SR<4gtIg;*N>v86lp#w8VP`s4XIW8z;3S92-?2b4jmiUETDy> zd#6AH6O@vfP+JB3*dq4;Psd&XJuv3NX{hOM^ZGuqz(9+gqW+MZ*xtP_H&NQphu z-GkLbIXCN@uY0xR1Y@9364Z$*s0zb@md-DRsjCT^)k1waJ4$GBXyIloBYYyH$%shY z26L-NhrQd%gQisqFRt&J(}` z0D?>r4fw9RUYFa}si@rJ1T%2#*j~aTmH`!m^_0QO^uChI4AXvvi>h5v5PSrr)t?el z+t^-*P4LOrZtvN^?l1y?6afaYK?FhV zAkNqV31?tnZF1W6CS&ZyUsHFBHxd5pgfJHa7bUq4 z#YGUoAZ)aU90=EZ-~h45v%IN@=WE!EenHYnzF;=gU@9K&Qz+VPKMF!0s&BX9CgXyQ znq2=Up+iltOV-djI~d%U6zkfk6UXyadev@t)SujGs{zQw(c{Hxx1^yO(~w=WEMAs6 zgyQ33`ZPvHl&M`^K(*tzR2ePFXfe|`?OmfH&0K8^6A)}sm!dSL`Y_IxPJQVhg>goX z{e}3~s6RzM{NZmjeL}sW>2M2%*=GQl97T1#JpK4yvMH46k?)*8mP0m1K zH#+!Mck{UiqT5XIc`YBDJn$zBNxF6b#=&EdP>3Dt$=JW&vDeo<{&Q1m_e)C|V1GZ6 zUgI4vPjd!qoZIYV>wP$Ov*Wt7A;D5-i|;HV_#M1gA97{26DM6q#l7QpmO_{_C&U$l z6h%`|OnE@-s2#koQu?9wpbUNjp3XQ%I$bMi(^%PVx4)YIjC_qTBMabu^Bep*qoeh8 zQrXBB5#;M;zsYm?`i__jOicKP1gJBj%S9Zm#66tG`b<%un25 ztAQYBw#uh)gGwrza~la;F(9$~Nt9Wpt8_t?lIT<`HdoTQdc8D66yTadK85c2gL|D3 zj#sVxvi$Zlp`FUOK-iVm1lI~tH}N_=dyh&qm+9wpS;Z8mL@Kr|Ip-m_mEE4>oy5Lv zgZ~iVSYH%z;RTP+a7~c3a@JMqQ|`Ko*)G3pcTkN} z1ev6D;^nt$37i%EI4KN9_{_7R>v&8F*9@Z`h?2Bv?qeWrbc!X0d10Fp!U98)?CDG{ zb$?E^l~E=Rb&b4nb}dfOJ)Ww1ga`-Jm7+zO)g{a^U}d~p!G%6iy)tcGCzFzs_CzTp z>2}KGX?}+|1(%ZD$9^Fo6a#%q;2Ry#+M>~-H%{}WLjEC=C}giBG#XXHr+qWE>~lfB z)Gx+Uf#xk*X7MyA8kF-tG=%Tm3P}^nlYLr4Ppp73H>^(cPoYxQkk}z11eAT^)AiCk zK|bYuHeWn)0Tk7{5K)=nq3J8vq!h}1?F-75OlPA`Wv-kCJkgqZ$5fB*4!M*|I#yM4 z3I#GA&j;^~sDmqUd?c=x+BXb_dHv!JVSpXOyhtBy88a5?k}HX?pde^K!|zUhkmj6m zK$~t}yt~YGC+tp=apJepgk!Io50#?Z-{COPF)`^StFramrs4+4`Wmo_5QKqMVG1Ut z#okRQ;D7R0^3>Qi8VfTe|J5_0Fd5K1 z9}}&+8-bZ=miBLswoZEq9yjqwVVYc8q_&(%#Sw2n4OcW8Z8o)iYAt70%!aORsy3G? z1__@X6L*RRm3>HID2;dH*&6N4vlsi3?wpO!skAgmS-cj!w72zH6raDINJ{_adWd8= zl+ez}S@thSYgyUnLLbm7A}!Qp;L+!vcg_Zn+Kyy4rw`k+S}kmLCW>9|HxfXd*5@C_#dw?3 zG{WmrZq?6)lP#`zqj8~dlYp6UjJAv!<`|Mp4g^`@3#_a9=h4{!OJOpNF0|HU%1snc zBVbhk4~vG%ls@Fr4VXpg?Df*!RnacWwJ7#>I%6xUM^(1jY#PrQY4hi1C#=E?wtzNx zgkGJ_p>mpmCZKe9go~#+T46LP**j(0_nSIA!fI1j98RJ3bbxcE_zzI>YQzgJ*iG*H z28wO&Y_3zTsF#SxTr!RB0v;cKl8hv}8@|DKGEgHmPcc@SH#(xonH@|3n_rLHINgia zD{GCaa>>?r%I5Rt?{oD@e?IdPk{a#!)fps+=L5*{RMy-?kH3!nZS?&xF1m?YvAN;? zunm(JFP0-T35a{t(IR6i$G0T5NA^(j`GyR_!qApGGYUUQ$?GqGd z|777QAj~cZg#W=1ZGfsj$|e0zgHM|eu{>~*!qe>~h)Bmzbv$`EA)k!LL=80c@5Lkn zHG(CZqi53>65arH=d^X@-Ydcf$c_ins+D0!)NjH^w)U1Kb_Z=eSq< z{TPTgcj4ytM$~6`VC4T{>>OeR3)6OcY}>YN+qP|^j&0klW81cE+qQA5XZKHf(8(Tu zvz@$p*3x(RIz{87;+v?wIwmO!4{n)+T-bXP3H2Knm{3=;#M2>+))_pNv(QC;mkL{e zc=GXfr>`B31R+Kor{0&KxgnGnCUSJ~agv{MaGZ=zvyXZ_l_7=t{rb2pC^GL;ji-r> zsgza5ALD7g8BnJVNp%e{?&x27i`_CXq#K${* zg#*%nD0>l7fbsU*NMsF`reB4(?6}o+UF;sn1&k_?DE+u7hygbrW{-@6C(vov{m0Jp z8PGnG*;>|EmMewiJGk}cECtfM#&d<^Us5_EU^FSMLyHD4xps{pa@`dyQ>DLff@Il! z$+AxF+6fLLu1g8;kEktVa^g$0R`MG~R~z8P2P&7DuJB)f8b$s^E2_uav*761`z7DE zc{;wcf;+`BB%a0+tr+)op0coOrYn$8$m@SW4om=IXD6@)d;e+*5tVIC9&XJ#rrC^l zK%lXZvJ3q^i~aJoNyoA$Y}QhAm67v53XbqD^?md@vLmT9Uat>N7e5o4T)`<#;zRCy z5**zXA4x;;j=7%&g@sz|=g)dpUiIn>Z`}1g$n`lC@ZkoLdwLXc24a(ur5U^^G@Lpd zen$zfQyMeD{&DVvW=U7t%ZJpRzM~_#8|n&vWTah9^feihdv9Uu>fStSf)T@*7)xg1GqpQl?!+HrEiR&nf4Y>5N|2MfutnbfFbt1JH4h637-C$1)%#3Z zLJns?O^2yd%=#yv$TR-E7A z-X}zUjHAJ$Iut^Q%H6B&+z|eW<8&#HSvx)CV39YE?aZB$gV`AQV(x3_c=~s9M1=H- zS%XjLMwG{zbTA}M11*K-{thu&p;#V7+roUW$hcx>{%N!r5PP*3$%V`nzU|$rP1j32) zm$hIr{;|*lF1CFOh%v||cSTE1h-0L?CO5#^<8UK5t_$q&{$8Z5y)5})qRZS7P&_f+ zfM@`*G`jJC0{f2@X~)sicN>Hkna1WUMFPYrswYwm*1U#b;Wtw)m^xo>PGq~^(&HZ4 zG6*?0XK>Pe?vQt5dL#~4vXP70L1p-ijEM3PSA70U;5j>%)w-57TyCx6+5 z3+}L491^f8$>YJG3n=sKw23}iLjR4!og3*P-MDS-qG(=T0YRL`U@(iQI({d`Pf~&C zshdU37Ot$@nJxe%br&1+cwf1O0?3Jo8BWXRWdxvM7vrD|TqFj;vGb+yl9GyrBe-ne z#-onH3}JccI%Z1cQRkcWq&1OUTZK*DbxUhA39*m0OZXT2@Nu0RIr)Q86<#2H2%sApOu7yKbCOV!J@;2 zI9L+-hKFYS!tGjvu-ImAcfu5tB#Gof-+YYd@Omy(l`Mw`RlZ9BqiYh@42dM=yWMyg zx#;2ur0YOiiGA5E*sI$$JEN=`uk(W{>YYj`FQucdB>i=ttfXZb!(wd@h~S)~gBC94 zw#`Zr0EaN-Zenuy;QP9xJ22($>~( z;L!vJsSs^X0Uaqk+L5=-sq!0LAs!KXqU2RY)E-sS=-3A3#pdb?#<{L0hJ+7~2RYwCm)?$xL_xe<=B z(6iY;&0odya`rG&;_XoQLel{N zNA+IS(=`SJ#!d~`Q^cHB=@!J_h1*?;?FGIQd#{Db z%!jP-7c#ctZ%KJ5^aql+QF74FZJa3XPi{NSdtIMXF6+PetQa-zxu?>LvV7Nns;BKL zkuVn4wNIOGjD0Fxt(>BZLGIKFjJGwe3h1q-tiKhfvUZBnS3A%d?XevY9uG1b)6rK; z8EcErGFu%{9!FZ`jdoB#Y_&<56|IP3Wf7I6#Ul9Kyutju#u-h}hdn1KDOEv}2N7*fSW zS;GXU3|CO1xNpYPt!I+odpj<4eu!(h8edZ@=|UkI95IAb{rx|3CNQ3}sw!)^73R_Q}xLxFcL=tua7u9a9wpiHZQyD*mMmlBX3J{tV%>xy`yuQGFXXNc`Tn> zeb)#iF|Y9z)(&N0Qe~i??%=jr>>EAN$1<4jRZ_PE8-4niI?08` zP?eSqKrQ*~t3e%ioRvy_b+CcT{$2_$Qq(rSq@>@NMiopKJ@OtpXF{a^`%3FKX*@GP zoO}|I3@&l18mbW*R96jo9wE?4%N)e*gG9)G*(x_zrrW|^gg@s9DF zs1m#S{G0xL9tIA=-OQC*P(D9hoZMV&Hdd(`eP_F|1AKYFbWIw_U1lrz=*nL?kh`G3 zDp1Fa7A0w?4jXw}zZxCW++0E$36wD`oHYKpEZ?Minc&TkL>9+7IRGUd#C0aa zE(FL!55(Rh?YSiO<0m%LaiC*Bi1Iymk6fk^LB_A@#YI-;`B@$%pQMhb`FZc_tW2Yh znJvm!(w_7k3I!w^iiU@2tuoYti+SX=zsqbD5QucwSGE8f=;_z06M#T;;wP4b*l(%U zYU3;^27SaLt4xY|Iv9W7h%X8J{--Bs@|QLBAW z{0Y^E+^M0pfsvfM51aw-#`7p<58nL=VkB|Nxke0QN{hhcl0W}X$_nfWd z;d;}q-2X@1|3)u4Cz}2*Jpg6)5prK7h0q^6&M$M>lc1^&W;@c_TE z{U;drw?JDn)-BE)e(t;f6b>o7)%YzNb)FdFMumeb38;y1LH z{vPX}Ia&Q?7MO2AH?sBVGXnaCi)%-IivOwx;!RpWoz3mvD>3~^+}?Z&`dPPpuR)*w zKh>RY33iXXE@xbbEN)j^&eq}6LgY8+-p7OTp%2d4?jI|EzulF3!u)(cFNs1(qov|) z5U{s}-FhOTlZ>%t>^>oO%}=m@jyF|=&p%&7Agq@j@~Q}BDZYMe6E3Ba5$|7n(|YN9 zU%KO2{eE7gpC92@*@>kjx85Tljnc)oOR1j$x&f<)EG+0b<|jY|9cI3n1bJ@s(Bh;X z;1glBtVr}LcVCTA{!%ACAZCsm$nszqTilS)TcqB@QX<3)l7ftfCnG@<>RA@aTuoH` z`rKZN@{dF?4+zSWTZgAkP8ibKCK^z)wcZ?C()5I_p?3AypS7cLe1^^Ks$ z+R#=JO%Y{To4WN!EKS~De@M?VwdjSZ`kHUhFv_TPp`i)`a9fca3ABb@~5}?L5{F7^TwhvVEFVC{_jrXU> zNFXoy8Ic`mg1uo`5`~T~Z|q2p=nIG+n2%0Gdw->3yR-qOzr6<3XBTnqmcpAm zg*y`X=!nH=$qlfDF_^|(o7&-VFI5$ein$#O&e+b%2(N&VX7bY2xgD@~CuyU5O$Gqr zR{jkwsE&jiT#$uTT>j^NbVuFcI(;VKQM=YZmf;P4&JqSmizm5a+3J9ZP(eo>LYz|( z(@nr$|Zis0os)|3|f?mLtl3K zk#kO(%L!FwHj4i9F(xbwf*e{TSIZcNwr!6g-2F<=nSe4xjPWp>^2f6X zbzg@<62qDWqCjntG*iT-fTory{S*{*?P-yTYg}e$7K+>^N+`4hi$i}{;R zGUvCNx{Dd~%YZLi8gNL+C)Bu$85S=a`%IU4k*gIJu{X^5uyCz4-xThd#7S#}A5RHH zn0MHC*c_uNr1#m4bdK-dXA=1AvMil#GC~=Su9o|LtWS5&U z>05Rzt4-D3S`ZTDIH)%s!W(oA#{3UrHia12O`jwMj7T(gL*+0ORITd zmX%!|%sIqJlwhg}z(e*Yu6cq_S!I0O+K0?7M8&yO)t6LR59;7h*B(qpw*^sKA5#^k zDV%dEHmdVhbrJqq+heS<#5zc$bJ+4w<4HA}KBf%iQq z%u;UL>C|(|OIQ$==1(hcN$$9aOI4J+gjg51a%uZ2PhQ4V7L&VBoWeLQjXNw%!r}bm z!6;VJ8V7NZ?I}{ZJKSp$g!KJbOobm0D*R#npQY;2uq(QE@&E2WS~%h+T}I~A$I%!X z;={EF4m>N>NokQPvunaZ8L-RPm7c5`MV~EpMXcOXn0gv))&OVjkDKvs)9a7$p*1Sd zKc)o}&#u%gW3=MdqSWRbtDkcEO+74hN=q-+uJ0=ua@)VECI1;?-GD2;C{z+s4pB}D z>6{>`X#<8*pdU6z3AMAWLOD@-)Zwa=&^Q9I5o+ zzq6XzE9j<$`RYyIQ=-y~kOtKyp!q_J{~)4a1yjCHB$e5!9;BtUXf%sj!n_h{ePOoSwqzAi_F0(#7_=Z~?_q%2R-2 z^|DCwTlWp&RbcmBb6gEW)gylq@9^wX7M7Gw(5~m3JY7L{hR=$ zze<6MZLw@#P(8HguHgaLVOzvS<;U^|_H8*l6QmU2Z`!0Jv{>{MJ#}N`t(?9+zoi@` zNMrh1iF8uhR@T3u@RPp5EA`!fE9w8YH2~}Xy^!hF8Ly#k{f~{{16-t$gGEwcj!3|U zfScSN-Q=%VCwG>+q5an<-Ha%kw$df6`&`n}fyQGw(e2YG2=b^O114j}I^$)@?CxDZ z{oBXx&G)T-NuKWtvcpMR(D@{rt^o7+G)Q1SO$q&^UrlyU7htc`9$S|)Ap6`tx3As; zb1c2v;?H3y{V{%V-qiKK;}~GuR_Nf7pNJuOq%bGbvN`x0e_C~KpTznb!#5^4T;Nf+ zpMCQm%_>I${_rDH1OD_~;R`hI`|8Q0**Xk5zJ-Cu&WP{PC@A8u*GYbIQe5Dg_=W@< z@0h_5Ix1SYo3^%3bMIgOxqEzlIL_oe|Uu54y9CnC3b-NnN$}VqhXmu5Xj$cDK6=`ifXXRhoJ40z*CVr$m z5fT&{j!=}`AaBUv_j7Y*&XN=d-|2h~WGVBHNK?6(%p6EIYfbk#8Cr3p50R~bj|31w z1OZXWMGmQL`q@tQW=Q=(@eLE(OrH_S@8HBRI#u0;Nwmdq!I9g1I>I{BDz@RCm2_8b4*1`*%m4d6Y7iK-0INA_faQS8ZfqFeo){B z5-<}wS2Nk>!dg=h9~s7eMZ)4M$`?h-W|ImLv(w>xgZ3&zrQ=;xNmrn^lVIks5Matfs!E)EX1lh zDa7_pME%GiAz)T#gRNGY4^)rzmE(CPMnp=SRT3tAA7DJ}V@e;A&GfAP#Z!sZ%DKI7 zNe@FTmy=nd{N+rhD=c(2)_W!l1U$@a7-@Stt=A=ApIYcl3uuO@!p+>pbdHmzDb*_# ze^*jjs~kHG+m%4`&T58|p{d;Ftx;Mjv8mj=1wz65tKkzdA1^mgNa$7=irpTNNSG5C zpuH5=>cY>Yt6+ObhQT(DtIhCLS}tNyO z$f6UcGjcg1=wKp$bvR~|cH6&y_ou@VvyyHwVm~fx`x=#3dajGDLxrWqj%oI#ZIyCV zG(TyF(_ZP&?-DVJauMDUCxeSGE5Rg~Y-Q z)|8wyqvJBHQHitbxR`OEKTH?Mx{S>d>Fx&FG|K17cmayrmtx}i3QaF@sX!$yA)Tc& zCAy)B%BcKcRsx|`OgnWGDlp;%reSDk&AtVdF`zkC7E$6@B<1vBG3tjR+tn;Xyvt=& z6^&%c6w!$r-C_mD#Jx%+q1ZPqqM~(7raOqOCipBx0S_3Ln4)JiN@H=%mWgGhj%JI@ zTY%%^3R3smPj(@0p7A7jiIr{x2yFPZ3B52%7q$I2reX1-r9_r{-;SQe=41$$eyCu@=iX5rX$(<%wS)|UwH!=5 z*oQHa5a!Ax7)geTPcEjdG$UaPlbE5+YpKW|!T?w|4ZGOsN{oe<&ms-f-rOeB)z-9X z#w55@_^jxy62f~meatMIb@U{djVffBu6lb3HTD3#7||kgaVC%=zK8AJ;R%1DZaoI* zR?ob=lBR{f6U}}m5f#awgWo)pVGYdj+8|F|3f{GSW0P~76cwQcU%)gs(ZjK53{lX@ zadbR|#kEqq_`0mSYGO|lQkvLb5o92rWm_V*Yy?WB5GR6$P_Tmh9a9H=&pBONlx&|s!$N$ze_EB349$c$w6v3_?(7q9JN?RQMI)TiByWzjpxhmQ1HNmq4j zqK0s>km_dUT0)7LS5cnme1`{xDH>$ug`-4P}(XUMUC^rtJkmO|xd(vv@pLQq&VOiy!#ISNK7iony#KMSpKB>2^!B zHvDt}s*|Uu(SL;M5Wvi)PJ@N%H#TfC9jTjOl_YuSD;Ci2djNJy|- zMr9aT2$7FztEAM*lSV3-D9%Q{)s}jm@_zq(^h{Y_S1osR{IeC-3_c2>RZtL-2$5E# z`e+J}5J#daB@0)Qs$`A?9Gy~rt#M=t5KSCaUqLOzGK!_pTXPwbIA;^+E7yc4Mac=r zJmT{u!z+i;6L(S60%ch?tk(|?ck^8*Gs^YkMQ6W;MP&yEY?4I8h3Xs1dDC1j33Vru58?e|Pi#-F8?U`q z=#w-H*n>6(FcX^1l2nVTuhwjJ2$m6suH|(BDyIzm&g+32m}svZDABZajcnwJz_9V> z92Surbc(_vf01TvKA~W84~#njG~u$h50F0R@r0aSWZxsZph)XBdMtYc7KO__!s=AF ziUi@fmfoYYSIP&52(@k3&}TLRQMHOZC>25X=Wi%^(@2qvJfbLHOS36rO7*5-MB_fd zq`HWqctP*(uXC-=V)}OroJ&*ga-uPaECf0U>(AZ1SOPbD3tH_H90y{g<~bFYVkjnH zZ4h$wdrqxy^VoS0nc}TM>VSY&s7)!pemik~b1Vz!x7D-~4~PI?yT=4HU^yR~Y4fUo z+!D-DYaj0g%8f^<+}heNFYe0VTtS?+bJqk(oqhYRd7@9o`$ zFc_a;bt>fB{S-Fc$c)UTbK+9=Bg)V_Tm7Q(QY-XFXIqWSm>ef~N+fd+y&jGjYxOS5 za#A}O8$t`b&GY448Dkqf@}aDz&8d@kleJXNtnF9;bQq4IjTa@Bz=)y&GMW*SV+75T zKsmkF=+Ix`dT}rN49fE7&yQGm%5`?wzB#(ntE^OtGV=!e35ce&f+2 z@F;Av-OT13XFf01)gOus-&+eqU~r#Mh?=-KbiO(^9Niwz-~8FQCv6sOefSt9W`*ZQ zKnEWvST-cZg4qT;b$biA1bo7(YNBQr)56(h#0Hu}7b$GV)@4eg6!3F@L%xatZORrs zY)XxSHZ(XjZYrz14Mv`A0 z06D4$LpH3h9^XYX5}qALL;0nc?m6aOWy z)=~h<82&#Y_+OuUg?#)jbevm#psOX%dK^S`)L~cB&0+I90eEv;>ew)wXV`li!-GK= z9BD8o=8W&8?3Xh*eo+r-v~L&-5F4AaEX-hDd~nPv8%^d7`YgK+1Ky>{JHp6zv*~v; z{Jn|QL`u@Q&*lpd;(?)p$-#6p*-(icm6U|b!m~5bPBaQY1M=O{R@eSx<#z_^Hj?a8 zJ+J5CI%t{_^(CB$N_^r`floKo(Ykx}v%)-FXFbApnxvtWZ&$6Le(UzFG7@X7wBbid zX=G?5DJMbL*z^RAwH%%W-;{2fIK1O=cw0uIy&w?qRn|46GeQjD$2|@ETD}gvhtj?u z+R&7iP-0*S^oa8S=|dx;$Nw}`$G9XF*~SwvGIot*5&84HfMnIpGOW+ZoE58ZXMkUA zWiFVLOPv}-l0sLi^d^v5t#9-CLsVjEI^4bvhsd-LnL-)F^C5T>LC#?;Mqz(howF_Z ze&?j~9T|7`eYFdsCQ=Kx0_90#`$OIr#;?j;-DAjGCr}68$~C6ZEcTT;k(YzsLAuKg zta_;boRsLHFU+q2^o~0@a>H(XY3+DvAng`&r z-9J&nU#zrHIPX*Yvtx)?z-f(H%J+{-i<=v~_1!69x+aBy;^_V;K@>eV1}EZu7f7XN z)rq!)9PB++Du~2v!!OEzEeQ^VPpmqsUJBy-=i(g&dY(t&M6Vh|6QBQHVB$>b2h%`kGrh% z!d4L;3r4MgxF8$^g=hKM`0gPFfo1i4Tlu*W2}31;u`z{vI!x;?GafoI2ax+m8qY+b zBgRti??-DdKx&pa{C{a3*;xn}2<(llpm=!b#Vl=HOr7Y(Yz$pYMNEzDO-$)!Ozq5F zEC`sHSsDNT3$kWy>00W47i6#MZ}1w3&lr;a`=SA40&bSKHD?2Scy5a{iL$@G&qWe3 zBcskYuz|?>)?z54O8EE%^1XR`B!_+uP8Ub11l}AzUufXI5q`hx|A3U6=l|k^kVOzo zedn8xE@0G6F60V8Xs#bGZ>yqGbL#QvkPD~s<$F+UesRCPON^Mm1Is0Te200G!p{kv zxhZN9bB~^(Urt!__xfCkP!d$LLD)m=t8cG@7TZi7MZ%UMAB3>JO`}${AjpWc2@XW5 zFAAloMCZ0R?_*OEuC>vv^6DqE851Z!-`BU~g+Tz81tw8zM_OaYlqF2ytz%o)h2A@a z@?V>+y0Fc&yYfQd_VT~Nu$+X4ue)+)n!(QVXF5b?~-Jk}rP!o%ipM@|jv{d7Ydxnn6hm2UQ zd?%T!ETq;!ngNM!zs^2E^xz5Y+^x-z3b`es8~xE7Z+lT|8EC$`-w|D9h__C?;l}>6 z-)^k$k&F^PRbW9iX^OPgj4(5b!?uwUq=jf}+vY$k!b~Aebi4Hj3LTG}0H%LE3r!u1Wn68fnQi1xc#&gcDy@JEgB< znDcn~Z0H-!aueBoALIaoF)30d*#somTZKfaKtriJ!P-QAVa9Kgj;452{v^bP8~@EPE+_)@ z8m8U0Q&YmgGKzJDY*}V3EXg-055ix~^pI8_OKu;9g!Y-Na&V-eNvD4y#1C(!mh^q? zWdn}r_!2lkmuv!hV}vkltaGM84;TIIbDJ4S*Etmv%xPJVHnk?_7-}Ps6(#Wf`;@8 zL`GCdm#&42baaa$u3p}GO2r5vf(t#X)Z*)aFCjraru825Pesc8)|@qaqTco?$-RIk ztt)a)|I1WG1BQ9B475o@xunw%+7lJ+18t6@3gd+~*-IChQ=)Z?D>8^y6-8YnXY4S$gj!c{BATv!FcYSVdp+BGot}rBSst6c}d)Y-# zWq$|0&+6@?S&@UC;EKzF5y~_4P8%iNfF^StS-&o>43r+`Ck@fyo1vb*bG!+|^Z051RO%P@>X7DgNVw;BI2~ z)eyF;_4Z!6@)+Ecn%j$#AkH~Fj;m?#D&TB~;{c`mZy7dq;36^1cIGo&x@k1JXGEpy z2X}t+%oJA#YaK89n;wfGY#8IudPJjCem21#n1v%gj4lxUOp*2 zb;l-@8{z8Po{DwrXilKvtoWHS$$bx=0>$ka`3q(l3a*jt09+H9b>Q_0W_#FdJog|c+uBhXz%uBd1BdP)A z2=+XydM8i>-b=?vLNkn(Ec?Stu!GZ~8JKl{DvA)KAiGx#A_`V!&Mh2W6K0?0^+IpD zh2yxQxNwTsbOek2k}2C{XppRO>T4LvnN!J^cJfh5_*+{$S}oZQ(Gdsw8_8b>&V7l0 z_Fnyi-^-WbRuxGhBI@eW=gXKTHU(?irEVVq0pHhvmt>%f zSyIT}1*IF|lFaFFS5Ymdl-w=rcdJh+?arhDc(cX@iV^&PRVJb$SH$WAv$gaupxt0x z_88gH8NhZFRW>UoA7(~NM{Yxc{v`derX=2GU#pzyqHxhPe;Pscs3rV!R1J;_LyOC!b@S7UnWFt*|jsqoA=R9$~gH!ZCM)-D^7a+KT%J9zX#TN+9- z(z>TuyJ=eAp4PY@SJsl2%2=5;kKaw2wq%W}TT&@_l^_5XcFH6-y1}5K{qqJD53iOq zCa9PDhiA+>`US!kE!fbKeywl{u`t)t)j|0W`N~4R2D8*3(SU=AaLIKIkIvMA+{_jJ zzhI@U39AZ6v@91tmh4D#FKPALP#w=@0y8$xahu2w0(Pgg$YdvaFYfnXie+d*;4AFB zW&&C=<&*xXZpUTb&!6?q8NPiw(wibsyw%vU;X4CH{pTr*6MJPS*UU*gwZvs?k)l|7 zt@BFo3{I7-va7pxdepT-`@T<~9h)xaom0wAzd9K*AEyhG#Vucg7Xh*09;O?8fTTt} zbIUq!*`?rg;csVNO3vI7s-=P1IdIq@INH1;SD@e)W+{(54PYDNJ}a}8E*OxD2K(_0vW7iLzxRyFx!fg4grtuQv#3Oj!7s%?qCL`4VQ!!JzJ zmzL&(CCH&H^emaQ)n(

7HlPpaO`u+!4r~77(Fq9>!4IJBE4vT!=7JR!6P5I7?!4 zjZVI`eq$kN-fA*?5a}h?#Z;!G8^ebK<}q^Dq8k;_f}Q(69yTSg4+B}9coO9~VCW-@ z3S$06(V-SOHh;UNvv7Ia@28>f)v+~UG*)70b{?!3Axbx&F$1wlVB2l({tQ!2j=k7b zFd|`*(oUP6?G9^8N;#qvpb=Ls=!1nz{a8Q^frbb*@Elba;$3I73yiaIV11KVc^y<3 zk2zoVcKYLt4F;`|?JTp#g4L{QLYyYwjrx#S{~V@ZJLTbSD`!^>$`K1vLgL#(602WU zxvvYez9?7jbl!}XwC{KPqS`Q-ku$9Cx~~H--1@_l#uo9K6uXT~uUDY2&aA63dWgf? z+H;^(2Q&vk^2Y66i)L#q6IH2<&R$dkWOG?}cD*KLypaiOT=u-;jnR3{lf7Z|r{nt} zs=RC)-m(y-e+3!dw2uSVu&vd(``B;w{6-BVe z0%2c=jcV5WwEa`?dXU=p%KjYMv`E z4xT=T$S!`3llGJ5V>Q@)eoyGX4t{?cKfW$cpB87WjFLGn)}GpB&`ZMe&5W`crb}l( zd-*6#5B|YPO_xUGC)QKS-?o20b88iUPiv^YobUaZbSC&SE<>R4AZS;iqu9f!2Y#j9 zm1+_rFV|w;xy^rHVJ)_a-lf17?w)kp-gJFWoQW{PA+#XDjSS&EG>MRIYSep(nUnoY zMkrs}iIZ(efvdNp+3T4!ZpQ)YL`iLzA} ze=9;^{{H;i%`Ih8P(Qr>%Kc{h>M9d<{CppxKRw3@WFZ!lkoXz~YM24MJAv{W*a~E7 z9IiskMK?$yWIwja(&yf3qsCD^$S2BbU68~ri+Rx|k$ zfF79o2NPf>Cs<6c`3ZS*0tyPvL!uo9n$e^SRBYSL;0@0;|<}HYeiUb z&bE6UpHqYJs~hV>*}scx*~K`T&IF5kTSO<2+B_ifVQ-5p7U6@?Zq6bV8rtB?FD=QVVe`9JV1qNvzbQl39UE?~H3nAI-{HLR&NC)Zy6C15p|^jW1|tLW`lqk6CN%A-cv=d*DIOE4J3 zB;ID0tAd%|{y@OpKaiXL)Q-TSCL@j0E1t{ZAsa%LJw(gCs7P*U9I!j)k-EKg1 zxP5b52@_&GW5zJ8>FahorH#eR&)^MJR6q!icioo6gTib9X~Z4I1^+fP0o=1Hm60d{`Dtb{;4J4|QgfK7v9D!F4$GLGQ+8SO zu$*!hIkTDlx{O+;^xtJw41(Xyg_@`J{U~EXaE~;0XWPqq{rPVshOhIic3+BQHbtelI zuHP3)jro(&Cbijyv8?neAksM}+S(mq^UVbrGJ+kz#h;fw1RSa~rEIIF%wms*cg%8ob*0hd2{YFg1Kh*`e5958g;^^Ae+h2;7s&mk;9CJCoc_d*yArwgxRothj7NpqrpoYbnemMQwk`$H(&0i!Sr~Khn!WRj3|*m zmYTscd5<%0qZQa)pTM)fu619RHy>k7uH17{?L}I(QqrMfb-slsy2UwXUjWC1c`SN! zcwEdTC{XG-;yGS4YWfh|0})S6dl&^kO9-6XyBvsZG>F@yHz&s?DwCHsr1a zqoz=ZuY4YBTmnmuGkN%5I|mcQXDC-cdJa?d-#d#}DvE46iU1|D?pne5ws;&jr0lR9 z^G~~oI4l57KHBjG!&`1Mq0^hGUpj$Z`U9y5p$l)AI#TION58BB=i3@b;Y&sH2Z!+p zlx;v_o~x@k8mU8Y0j;U|Hv`-7&O610H-~Cq#jBDyjGg>AsK~vZL4K*80i?^FWltWY zG4%X)-^WXWG#%AYk3v0je#e(E+I+F0Q5vM2gP|-l4Rc#zM!N{ZkC3DR$8&&zecBAtPl_?y zLY-+Cd-Zlq)Jq0Nb}RMmzN_MEVrUFzOF$sZ?=2y)tr6H2M)(af-WoIK-E@hjtHVca zIpf81`D+RI#mQ*wD-s*Or200t2Z(R( z15lW=(bw$dV6&PqZCU}B&a8ZXmv8WWg8!D|^FYnx+O1#gd#~4Z*7n@GySht|vqktw zp-aijSP_9>yF|>w5lEYcui(J$o=6{Jo-Wb7sDdRdaB)ofCd?q5s<2Pni8x89^}GyT zDTZtv2mw!7*~`!BC&QoMVW*M5gaG5+V8eRfgp!a(n7%|Tj`Brkk9W2ISbM-Xp)C$& z1xa|Id`t#r@S+tHOod7sk^T$+5&QD%ox%2noC7u`E<|q#Uk^OQb1Ls$P5A&ApmcgT zO6>m9a=E_S!HQmZ(v|ipMuYG!VA&e9T5at>xtg31OE4V|T!g~;C!(OmWf&#o{Sndn zjQ-l2cpak`DGY$|h|TGQd{k@@Y4jD%F7DQg<_pTyX=7&yZZPz+Erg2&Q3*Na5?}Gr zAXh^qo@V9>px(7wOfCtk$cIH-y&wFXPyRG0&0B-l!u)`)pB>YFFP0EoWL9`6RLhI{%YoQ)#JFaB;lP(sv4t1P%^IUcj6ymRR7YL}qK=oEXfsOCd?Wlr+7igONargLCo`FmA_CBbslw!P;Z4wO@vt>o2BmNq?=&X}xG^S%&%7=;`5T zft4;(E3B|}Uvzw8IwIaOMEv#&({eE7dUymBMjm4cWq42o`fBvZL z^YafZh%DKDX`fH2z2@VI^z?onDCL)PP`by@&gN?;mEp_o@r{G`ji~jr-}(LU_&7g( z2eE>p>N|gQ{P6c+n#d85uRB{j{mwHl?$Z&-L8ZvsO$mjbdiVPBrk_>u4w=m6<2#rv z5kHo{dH5S62hB@|9}iwiPUg$xSS}!a?BNi?;S^I#-?G9=FaOUAe(*ua`&Hq$LQR*B z#u$kv7gfxhY}qD(B`e><#3;23wg0@m|HY{25#s0bjrju&~?dT9Q zq}zM<4d!vM%jZU_vir*+OZN8u#Ge?SrSkRjIZijp;-%d4d-@c&X#ZI$%fNmAyX%L^ z^JPB|!x4~?eIIKr#xsHvSX;5bWJ7dFSd?T&NhF<+(EXHrfti;l5|BcE+-!P-jHjw) z*uZwdUF!O>Xq3Nz<>p@m#e4&1jc8wtbipan8^7~hu$`g!G-j2z^kPlB@z;~+RrYdF zyugN3Y8#VTXJ>@{ItI&f)>K{F{qPe~r25gaYGy^?>PnO$vtiN~%aNM+CfeU(io~Sp zN9Hn!?Oo`RxrFz)yu{_ruKTQZnoLNzj?HkO$#Z-S}9l0)Dx?uvQxUIMY8G+KA$ zgDx3w7}0702`Khq5vlBig-V)>Y?+INDk5}9`XB97XX7@#ulTrkO)&k~QCD;=Fj1w{ zae=IU55biaURXqFo(P&|RmcKb67@PW%qdk}VO40YDg}&tU3Dh|TWvA=~BfL>rsvICrAsRl^ zK?nk98sf)A$>MbLFGws40?m9QcJ`w((W;NUdtnm3l$+tX8W8h3-K0$M>ei^Kr-}UK zDq5oeW0YOLXNiezxB5DxQ9UxfLcU{?a^p}@Ge}GY+s$gUKbbN{fvmPrnZ9Z`urO@K zLgnU0-w$m2ELT2{{}v0F7C?`(LTic4ZfW(-4&Bsn;!fQ+@9E6XnwNf~}!1q?Plm+4%y7!sO=e*~b<& zD!VOvQqVeBXcH*0rlxD!X$?Gq7n5mCWWViIEfx*h?6UKLum@Z#%CrINx@;h1^!vZs_7Jm zXFS5xGb~vjyeeW*wGoCK{~G16%`4y@`qMRF?&b9(L~Vzcg*^vt?f9ai$8ltJM_sSx3l*!9G|B(6QE5e^@%fex~ zEezBrc92{#9%JjW@-p3?Z5WDfb*`S>}CvAgYm3O!X2K^Rk2FLu{{1xF*x!DUe z3s4r2js`9vz{S_3ELc`fWu8Q<<5I%Ph#XjO zhy;EtKbfN;{uVV8# z$nwv-o{lzm%6dj03jT0jXlv5khrD9+3`K5f1W9BbX-(ZuG*N`pgAOpQ>gvwptSb}S z(weOB_yrdcl|AgKt$RmrSnhKy;Audcrb@;(#JNnph|P^6B`vTlO${wF-%00ML@x#N z%Q)?eVp54F+KUwZ0y}v0Z8dUuvJl~`o>F)e^g+y3%!h^Rp8F}8eL z8s(r}Rgdbb7|NU!^=QkVLI-EchS-ADyS*fA0w~GyX?g4Nl$~8hU4@iq*>~H3%mLSVUq1OVK9HxOE&>63c5P#yrDgwmmtYBU0lFO?X9T%USKRBunbgm3|wyqOS=Ec8M2(hJJA?Y&h2t+a`Qj-Tdvb<jRi}ES*j-Exe-^+DDG=C>(U?26vJgu7w8RV zfXa$f>nW}XU%Tz|u#iw;60%r`W8T%*qtSI`R?;W|qhL8S#Cd2Jd4K=#@2U_bhP8+A=gP% zcZX|N!r)6EYCaC}eEqZd_MAtCv9aJmmHwguIgfMKdlMIx4xiBvCKS;*Jr{1P)x#o@ zw{b{&+DgNK6V@3g=`>XxV1#cUjC%?fKJ`2x`)+%uJJBP%sfPLAKgH((w$9VoxY|!q zh+;c%HZOkS8iZX19GP7h1JvH!5V)VI$uV&;@I@@h1K7s>1L3awbER=|`{VLXd-J30 zQvF-`x{ghY!SfaY46ezl{~9)6V=BSgZavOGhmzNso+PqiCyF=Fbdd$BR`bEgp@c<> z?T@;t^Tk0sQx?(AYz&X%x2&i3RV8&;E0#T2hkLuI+fuXg9f9+vN^t>=F?;Mis<1BA zAkN*eTkF1+>6IQwM-8nj>UCL-Bws?i+EP&6yY5poSThi@*_sDY*8mD`WL3hP$aA$zZbFZe|74Qa{>dSD*5u>~ z1LL;^3ac?x9oFmbmFIlzjg@0sPn!G2mho6S@$`Vr4QS|=I<7l|9O&$=qF`LSO%Rus zqy5Cs2-tk#zxnj{%#ks1SRj40GpW8gG^lfpw@FWB#zpNg>e3Xb?vvoj$?VL$anBJ2 zlv^x)?u^61zXBt}VA*V$R8A6(4-GB4 zzW*3NgZf!Dcr|DuUZ%zG?GL8EeZM*W8f`ra{coUdzgT~C)$`v#J>z$v&Z4_*^TVe& zF%&$uA-8;eudrK(D1x2Y&eD9f80PL&Qu)DHVB2t zy?$>HHIq$5JbtYl=}xXxqZCYDDU=0 zMMvyrg&GHVeA~W3Z~X6ZW;3HY73*26MX_*73kI8`ZO1*o zkFxCv8;yO!*lL%oQ~UL}pwr{Td2Vm=8Eh1)6}atHiM|fQ7?78Pl=%pPGaB^8fUnffFlBZ+2V9B_|A$(uMWZHPv`YNNuXzA zcu9;A#*n$FSmV>%At%y216R7)qBOtOD!L(kYY}u102X0v+fOW*DP!-A!!n|+?4H!C z*ti?lgA^1u>nVXl4x!vw_y^eV*s7xl9`af=dc8Ka3vE)Mop+GORsduwt*|!gRXG7H$L9zvC#;wx)JSK zNYq-e9rFl-YY&X7RQtOlDezh=hatGGaq~#|`b`8mv#Wz#4hE2iD$3+OD9eSg-oErz zO$0GF4t_O*tSU!ba$U}i7g2UtlvoHey{im+b-w^1JVl~ZV&ic%E=Qx6W{v{M>(Lns zB&;|+w%wB({TJ?-gkh-~iih6`Yy6JkSX*bRvaUIFaG zdP{Bu(FirLwxj@r8cG>Ayja&v3DSz-Cs;GvJl-`g;2ZGyvV7A`=y-(_*mahftTidY zFg_;O*H%Cq*boN}YA0T9nCtFV#|;3=S=w^VmvDQ>VoEPWX7`&f*-?*(oCT~M%$S;GcKauhFA2-p~<{8#_%tHcpVeYVd85GBH@RLrk zDaYX{y)Q$x;f=PFxgcRXkhn~58#=IM5&C5RX1 z*1d1i`XW5pl?@=^jE-Pgqp{0KKWHC_s^!8hQ=%P7b33MwD3OH!b=7B;?$VBsD5i^H zUd&D^0G#yhd9Jg|3@;EF=YZo(5UKIddUM1nUM{>b6`9)ehy5=QoqCF*xW1sts}~eyaBx%0EWwKH z+>{jaB;?`DVhAKj&Kh~7&&Ht$bQ%o*Dvw*Sh^{v`8kDk=1r9Ela|)vK#$WH)Y?DlTfwg5T!5W}v>0+!yss}t()j=%ln4nlC-0RE5DI0d%BRHIsr>17QS#)qpNpL1e zS&NRN38i)IXetFdJn?i~nLi*r;5{&B=5cW=-U$n2KhjCh<}Xu8Eq`KyP#zk5k@)-5 zZ*-o2@CE$TX-(N9H(!Q&4r8Diva?{w{<3x*hgL;=UAgg#Et;fWAENv!aEYrMC0J!Z zJIckKl-t#*^)r=v)fl;wCK{cCIMuSQKO-ODs z47l}bIu;IP;G~{ejyJ8J22HjAS!{UdAq75=Cm<5W{9!u^@2KB2x8Ci%xzJxM6Qe-t zaVUlejU(icpK9@Yu{hENq(myo>YtC{AdAiFzn8ayD$S+(JSjKcZeeb{!=zzp{+sWz zFwPwj-53Z8Zht+8m=XT-C}v!O;2cScjKy6e16(JuihBKbi>%o2odt1_&oys!wRR?aq8MbK4J~nVq?aRE z9J_8iwW*DQ(=ShQ9CAT?*H4!1^6_!L?U#DeS^qj93ii9O)H_KKTuLji$i0K_SszLE9rK$` zXgRJWQBz!}SQeBV-?flWA{kBroON02RSRK!Zg8Q>JA9U)3Ui%bMWb@W^Q9!d!;o%$=bli z$?ES&Wzg~G-0k<_B0GJHZd?)ZKku&OgpNL1!^?N4AHglg7~y(-vzwZy+>(8NEZ;XC zC)<05NkA5`XaY~M(MAPtMfPH_pZcS{Lv0b#AU62g{IRLRfnSE)=Pz1f@qM5&Y0VE> z%cD)%f{0)_H+V|idjqWZ(##lL8Y8Y~Z`8*gWZtWAemYvin%J5kbWqTy3BNQV3LZ-N zwj_R5@pYn1ve4gde_M6`Hn_c5Io%w)Q0^;J+&Vo0&~g45w|wmC->toL4YkiOI)&QM zdG~DHw=fxi-QArBS0kssp@q)A@o284lXFi!9L3v^6Eq;d)xRCV?zj=4)SGCn)@&cx zJs!&)I@g`@ER^WNNj6Dm$VFXB^NkO=_S|(_Zt6FlvuGI=qXx?xLyLV4%J^f_ z7M?+yr^z|o5JUq?nnVkNuPqZX?N>ZPwG%$TR4Q*imZT@WQ*KzK=GLCG0H;MB0y~BW zY9bor$n>(G^es(M>@=gB$#H^@%`Ph}jtw-( zv<%R54AA&|zdJrWyuc2EGK(rA_(J-d1MQ!=LhpOZHB524sX)vop{;opMOFG?G;IxG z7**7Z+0RHs%eZN}rj>Q+ZzjmK#5CpN{r$eHg6R8{A@-Mf^g~yII8s2LQmZR?^Udn* z#n=I=Fkw1huq-Lcs0#WD8>g@%Xa4Guwxri5#M(?nNTcDYgtF-j$*lW}wo<06c^q}U43__PJme=~y{-yYF0ZT-DGCOGpLUGO5WyC> zN!KGrszLxY#l|CZH?W7o9CuI1sLsA2WZv;5PF&L4bp$wbId5mMwkXf=jDzj8V_XS z)y@baI07Ch+d-ProADoEXhgs`S^<<3?exB@^f%&$K%`8joUpQFGuk@=OuQ11t`A;F z!Z$!^plkQHh1t9GZ9Bjp1?F18VFK8@zY!;d5L5IVO9uzulsLVhih3W?>TcROKL9eR z@!DqM71GU-KbT3>5UrDD?)jxlToA6fT)NPSKno`Za(tPk6?f-;O{R?iQO8=7m?0|C@LkkEW`hs#7HWY!E6nT>I z^et#Sy>0tR=3)kx@`3*at-@vslaMe8vaP>VtinSZ?RrdFNRc`KnpW2zfhM~wV+b6E z*O6vf43JiY!}M?jtDzP_0EI@0LHVN)Zw!10F>v<<+jSdimLPfvBaaFl;duYgc`*MV65-CT?wDH7!_&Fh6;q5fk#Ri&cCL;+-pzPB;sm&5^ zukx=qKm;p5PUIZYQMFYgOy^j;z4i~)SwGw2k;4eUj5G8}TCpW4GUZZYiDJ6}$1*n* zezsVZ6ci^W?r;fZ&aS?8WGHFn@E84JC&HidODuO(N9QK37{$c6molw%v7t17!|}wM zPA4jQ)JS0_z!6?YteMc6(b1VybR39?MCX!A>stX(;5pSNj`B2fh2>0aeKU;}-iq_$ zoFP_Aw)3$JT7qrgp|sfPr7=fGnM#rH+BP3SemQc-xdk>!c!2(~9_h>wc^_)adEpbC zio?^1+i$G=O0u62m10YvZq-h=t)5r4Ft`-4It6RUqw z1+t?L6$;3_OL|V2dX%FSkHyHm#vSrISm_XI%}LT!8>4E|=21%llDd&%W%8p70{P(( zV|I%1)fazy=50zXxvD#jMtN@^S~S<9 zhA>&j>C5@2l%1TATRWeHGP4U?8A&?JxHhkab|jCr=}>OarFeld-HlZqI{hc3KE|WQbNdylis_%5>n|P|vh1 zoV3n(uH0U|J$&SGu^d<# zmoP=9Sx$Jq8x8U-Xc>B|(2BVHYaD+x>)$-Eb^*u(7oO`yvV~+x3+@5me(E|{R-RGO zc)`0;xGOnl6Tm7>ds>l1jhw{T11L_~&=)@GD7x2{#91O5Mu_iOMqSZio~5nMO_uum zJOZmaW&Y#4jm<8|RGk3~bTrR?8m+mTJa1^Lh0!)M7<}9&j{`#0;W86)plchGI-Gp` zx^^D2b!TF~@-FHfi|&an&Yf$av*>kIX6Uf4Z_e~p<0Fe4jwIm-Rq^cgMgdxkHw|y5 zSc6M@P$8u_hwt#E{SYkbf6<0iYm1`upqddGRoNEz55k5FjG5OzhTeHI@ohmrRH9YF z`3Tsc*qhuv$t)=o9yvIBX^0%h+;xgIfVHbAhuF?7rf-4oQ9|+hpUZAwfHD}V5G!! zY4fp%Uj+?S8~6tDva=mC&$~)9<)QrX!OEoYiRqijC2kvJ zLc~87vzChwfLnkO3xcbHD(AECDr4Rz40f6F42^xrxs()nbFeW5a^20Lzk2tJJf_4* zTNY$)$XQM82j8*6Kd&KJoD6VG+HoctEm*ch$m;Opw z?;Mai@pV`3@qJt91&k_2o%#Q#W>yA<|6OY4VEI4G%m0BwAKLyaFFyjAsBJ>Byd&r_ z3D_h)(vJ0Sr8tb^n9x1EQ`*xiB+*W012Vnt=~}B7L^OLfTf7?wgdgyyRi#zkO}(96 znDX2a`+RqEejgdWKj=PzWVv7KzpIr%|LT~t1sE6%-rK$&q8;OI`gS<%&||dvxKD3! ze|m}?arnQrYklcn$z;b`w-ksB{wU5-MopFKfppnp1AwKUi#tQ7w#rVCz`rY5uD zK@7=0x#i#`BEZR$F4MvUJ285u7}@37U|jfk24?%rjTeK!ZEdc5r1E?Pv}{ym>~PiY|_r?zdX5)a_% zA3*hwL_l47pfmw|XTVaqr(q)yB2MWUhB}9L=bRM7GN{wYrbW-Xjx0i1dz0$&CJCMz zn`1b8S}SZPw~E3mcz_*M5;axe!b9gjE2bT(dW@S~QCJ{)A{XI>x5~zur9P!Me)JC3 zKC%DzKX_*Q^;+_s=@&4w`Un`FAN$f#G80D9ifLLZ9A9kn>cOg zPFm0C_t|mXsj7NhH*2uC%;lQMWMn9s#PSK0;D50o<-s^7Os*f?Nx^t=xQamD-6mYF zwX7M~Zvxg8c=Jx4VUT$is=YTgn5h_=>(gc>W%LC;&ykvFy46pLIj>X2e1l7OjtJ1)mP?_2 z{R&IvRKI?O13qQ*#N-?t_VkE@Is)E?Yo61hde$I^K#OIGVIbq`|9+5xiYETgjT{8 z`R;0VObh>BtdSz=AgBzC3o?{|pl3>!vVH(abg$4*Xc;68+jPa|eHpKmiwsWIi6RTA^nvBADPAf4$tm<5djo_wyz81sOTglZN^GW>=-2D)JPoWJ<{SS(N zF!z_;`|1t&fL0Dj21ArjUlZjDD)P75vBkd z%r0v=(`XZK+Ct~tm>=E6kuY;AHSu=J(c5zd7;g7{)$r4*EZcV~(3U`2z0(SYG&+il zLpuuqmffo^`F#XaP_Yp40^AYsk1&!xEITV>N6WQnp>AN;i;Qq=Qna4_;207F@Bb5%X$=7$vlTdMy;)~wylgXfDqiHdit(2fU)hG!{ zF^A!RGkX<@yO32@T|%(<>~A0cke6wm1#UTO(4s~t@RWS;r}UHhk`*p3=xFq0iO-i;PWC=R!P z_eOinuFtut0vs2@&CZ>TE5clo4M3EGoTu(;xN*SBc|*mjUHiMfVrD+-V^FM{$iUE^ zr)CEMARgJ?-^Kw?#l*$=c~OTCi~x>NNTee4uWWwWQDW{%a3O0YhcYX-?A zl)6eX7$@s9{Oi0^6c?KDD7^x-=Fo(n8A~qcZ<4Dd>D zXgN!2xyv8PJScHO+KcPpu`J^Aq9-SuKN2m7rsr5}Du86v-~Jq#ZmfG6Yw?{-4o*<+ zU{;txE0b(CcRoE20>`7c-CqiFJAAHR2Gpn7Li&2R^ovhM-FY%R%#YcZTwPuY3T+s2 zAUgn<3T}@__Ys3*(s=^_pBtYjlGt;IAXTuV<@e}MNnFkhB{Yq}vg8Q6pnL>vj%IUM zSIr%@>$fa)i9cYW;O2t!y=dqxR8BYkW#3+tkrY4PAgvsy*Xt!XCTk-52cm{sWYz)ds+<7PU_p~2A8BbUaq z%xum}J9ebVZL7fN6{u1j7;c$nK$<6?n));JzHZ7-Qtw^;V6d{1Q#>DV{#^h#=@fqUQ|6=kxsBmK&GJ?~84zB6(%>bOHX8OB+$MK8O zHuSa2l*hkO{rm|X?I@NX7JK)jK+vPUb!zo$2k8%!U#?!a(BEGzZ=VX^D7X);5 zD)LbOUigqLQtG{PIR|`=A93!hE4iii!M!tX2UyL`;Gm~FZH{?=UD%=XUY#0;P)-UO zWZ^}kCrL=8CRvx)I*YHYlGfhN&UX*R8KzxumW7L8%oR&7biH{%peHxZEv+0pJyP0<@ z2J#|*caf9M^&C`9Oqo`0S_PyzS*$Ua3woJ>XpB4DM;jW_t;}tEBqfK;3G;k&Mu&E@ zH9Jy^8UK8ZtRV?b8+QdCk{QpWnhM@B!%<=jY-x6<4=~X>vsBpZi!VKyNI`(Y0NKj-uy;)su(LC{Pt^ItieFU5@Q(UjTu%w+; z0uZV@K}|M=89-gyK_=kf&zsUaT!&5Ve25%|v*McmHgMrxYu}Bf-emuX4zvDNo&8`1 zl(hN7`2ul`yws#HFL6+MJbp#Fp~2m{0OE`%gbGQTnvG~@>M*jL$Ox)PQ$m$F5`5)W zO$nyhf&GzHZ%45acorIL*G7((4uA!f2#8#g8;ZYP$5uY5yf!SN;s@t;-CF- zxq*|XxtK3L`~T!=g)&^I>D~fbKN&#_ug%8D2~s0+v#0ahz(R7n_2R_yBKjj0lFNndlwqr zjQBW0{qF!Oj9opt5%jfrII}#!N5Y$Zm9XWxg$|Lj5ge_jQSlTH>z@EzFO(9&diF5= z*-F%b(CFHH7u5p#5Qdg^5<^4g$8)1L-Vn+FH7o{V$GWNJp5bWC=gyReYr>y{h5qoYwv6N!P^1=iRfJVI2p& z4W*?f8lSc61*;>So(=5s7wO(tXhmcxWDIc2wKP{GtYFWQa9BS~gEnR7`5cmryzRTh zts)Z2CCUhZg{Ij`!w{pHg=hu`q4GM6hvH}Qc6i7vNXkbj@gY>UWdkMowp3PFS|rKK z_f4B|YRuG)EaW_(vDz};XTEb$Z`>h7VJ}~j@d;SU{nIfW+rBAT$Z*OB+DqWk?iuf! zxLxJ9B!i$Q=}#8%0p@nyA72X3)HF3g<_O~-6NT>OPkBRBfaERG;wkqg^Iil?Gc_f6 zS0ZhWr2#j}f}{hb^KvdU8C$`pv;~rVdgGIZTT2iryL@odh1*M3`KSplR2M?Ksn}rC zrOCh~m&iqjHnG`kJbSFvq`;vPRV-{o&I)Bu-yTF%e(WY`;lesbkAkPA3b4{~SZc6= zx6M}(=*p6L8vPz-)^_TH7XQ!}l+#rQJmiHKQdi906m}ucDdV!A_gbIWHJIFIGpNJB zZUT-OlWiwQ^x;T1RgHv9duTKHv+3)%Gc)jVggcFYpI_4JV^*~iZIUQh>lfcgmxIBZ zX>AFU;>PR;xdFyn8f!>i$xgD%Osz*yn&yM^lG5oM^ywPlo$@Fn$uz18J><5cU*zs0 zME-M?#RY)~6uSKQ6YCLF{NUHxQRvN^>Jce&O_Ri%;WCv$#*ctU^WFtoi17f}9JTiF zHD8y7zh2IADahL%%8)#66+B&H^l{SKC1dIMH#h5utYXEA3} zo2-gN^S+XxC!$^!^wF~#PrO`Np*9U8X}uT1Y*K?7V2={T0FSm*GrC)Wz6VrHBT=S8 zQ&j1r8`^pr&0wWIY6AOkaGtUDtRz+9r*X&`;j;K-PniD41a!8#VvD$MRSOT6MUfIo z_JIl*l?GMK1qYJgYd)(c_?8B>;2c!L^f`@qGuf2*kz$w{QX{<+WL&4Zw&TtC2QX^R z1%7WZ0~xt?c3Co*L%A2keZsSjsdW;h9IS*YZ77=$+;COTEGhq)QG_F=9F@+7Z043U zg}eecY+Ac&(F0#N4D0a)+9i5Htc{6csVa5n^Ur3o7b7T0Qo*G@RTyS>1RutSChgkRPsPr9L9|8R5zhb8PsKLe``Xo; zW1Ljs7;v(9Tj$X^kcd@gFX9!q4|H@aDtnf}-zcvV0)UYlIXViJn9jb2R=&kMoa4qY z4$_{VdP*hI?HG~A-#lYHGIH!>?R63scs81`S#>%I*EC~FIlZE|oJ>;fl`=ZG*|gy; z6##0GZNFqH#PVMnNiOAAuoD=5Ju|2P!%61loQ~!{WPOvJ_2Z#Y|B!T6XNg|;2CVS> zR%EnvBURSq=j-O0Gb4(x?cIL0*!W1)F7y~XhU(VXq?}^;u92*X6GwL9ScfG`89hpT z)!gYbjd&gR6F0?&R88dF+88lDz)Z5%T00kL=yTdIWi>C#)g?FL7SmB8|5}mK6y?^_ z3p)LqJagZEolZEX$;a=fuPTmjpHK8Zz#+gK5&u&J{a^9lnb?{CuS@OK@1^!|;GyAO>o%K}1Anw~SvGxP}9w z0XvNS>)wWvqC}fJx1La=3|>|R)4gi!qz(BgMpb|q z-06kUk|be)_Wf~vJ-K}db_UCjW8@OQBwNZQN!Pmy+IP|Mv5r>lUWi-bEtFMVz*s?6 z*~oU1+Fi`0Q}Fr1a9(COB47CH*^Q4qI;l@kS%UAQ6!<4V(a=-?L?kM%%$jT5PM-B| zM3J7k$Ys|ikp{55&sm@_*#<@-i`E5+?m#+CF>?U{cg)Lb?^qTMUxi2)dk8MvaJ51u zNd!u$2@OvYShAbM70&%|+bZJTav-eSSkI%WLYQGQ)bT)kJdTgJaB%pug7tUT{)I${ zx2Hp3d^tx>iy1~gA%x=uWlKYL>Yd;IQ+Ony&Gf`OtX{iA)l7$m|er4ZplX!muLN`cQTS0) zkz$Z(1Y=Uc5n@=;0PVzcUv>}Af4m3LNWy@|I}oGd3{2usjf8=E0L%uj)_5r@-F|YU zmp~?%kS~S-MNr?#o9)^*eW8>-Cla~naKZ|bCTnTOvP;|p%9gXF3IXg5`URpQTyX2^ z)#7M6gDxDa@5V@ZEd2?xb%TNJmv5gn$h%>N&TEiX03Uou5C{jQwhe!&IVB{>3#gUg zdRqaiOPChQ2I1W3YO1Vh>7e;o{+ziL zI=D>YeLS5^dm1_`x_NQ%;H!H*+c-XV2ZvIxPEIUn`*Bain~)vgs*1}y;9a)~h}NS; z0zcRIWjaQu1&s#ZvB!B{TNA?B`;Td!{uSm8En`*Viz!Q%;Dam0HI@)=as%|4heCY= zepR%{(!bq9t>Hb4_a#8 zr`xMoBYf+n?uwzzdBB7~?_{>Z*})6v_N1nGhr3nlK2SMw>^zdan#6H_BVfpMrdOCk z)b5%EPc#144sW#C;B&_jmt1e10rF5z-6ntR@dCLATK zgG9UzT_1~H+>Ac^csMFo1bb0GCv(4)kYS{+*tNc44>!}j6@sI*vd;EtIx7coeMX9P zIjnns4r086Re<)OwfCsyd06KX|08E(j1(9Ikv=Xib}ZH=AEAipKkS#sFjS6(gC>{r zU{7@fVsF^8I&&|bg=HLRe;#AE#nGH_+t;7maNnl#@G zIVc?Mc0!^v7y~(cGK|Gl+Mg;oDlb)3J1EAxy9v8;mzJsU0O?Atirr%c2L>qg1(t9}U$woy0$EY}?|R-6b#5KXoGwjpRRDF% zHo?bJS;$6xogElk3rhFy!Lo3ZBIH20^!5B8l}a@mKP)Na+z7?lvHDe~YXw5$<=t3d z_321^gWDBOY|#)*(V=eIsXJFAI;O$cWj0wDW20*0%7#PS8uYKgU)&Q03d zpjP()&3|7t$W?aZ9GBvjga7&jT_7cE7Jlyj@YZVMy*R|1h&xsJQHcQxzZuH>Q(x6o{+X2>pg z!*is;WXg=HL{{OVW7R7_+rgDi0T%EBobgRNdZBfTxnKf1NDHCdR5qz_$)c{8$z{|9 zSl9*7h?bR}&UFHu`MOQyc}wylE_YiZ`3^&phi=g{FDtf3Gqq}QkY|inse_UqiUHeT zjZU6xvf0!tK*{>%1{e!VRh&{Dg7IZ}>s1gGZNi^dz17++xSx%N-KZR zYoLJ{(5#7oM`1y|HtX8=bU#E2X9C4RlX=3osOJRvOThEE(ym1JFz<)BMd22 z!@IGnE`xSta5En6$tlL)t@olVe&0l)7a0 zgKugF4zPpzQS+&;3G&KN9=}|~7z`mATedL?jgq#l&x72XP-7T#p~{d|yHg{vDul&k zo1azM`T-RmOV(Fndb9B4v7?)S-uB(R>(!2&)D92Wkz2LaX}4He#*TMYZu~ zqw;#inAXSL%#sj#{i}Nci7l+*%6G|9hU9iH_t2Tj=Mi#lu@hwmW%T9C!S0KN=jMuP zzM?EX_lnFgqra&hdN$#B&$>0ML=uwT<|(b?s97!uwP)W^n%swBe{U|+h->su>OPpG zdI1%5x4+)V-L!yXySyh3^Hg6=lbfuN;8Qn7P6Du90S$l^T5>jMfe2Ox8TEtJ~226&tlnuk(cF>0Am!V08dl=*w)^tkLCO23Lu(XXdnR2L9P65R*y5 z+wRHmpFMtZefXZdxP2gJ1R%|@z|dLQ0|{WD0v7-xhO2$ZrB4Fl2KLSuNcJp+Fh#hw zeQ<{}Tc*))J|XHNesv=FJt|)jlZK6%;t?dUo;xf28ty@zmD(&P&ew6x=Kv+ z!)w}|L^YGT?^;Rm=QPdU{b`|Xh3s+Sv{ZA3Im68>5PIk~PY(!ufO9q-L6nLPnOE?x zSF;<>$ukQ90*f;nfMZSro*2tQkD;W(AAToQzj_T?4ub+q1S2$&VM=M&9RS^s_2Jxk zqPrG*`Xx77k?5!mH=6RA!~4i8`1H-pXlAldKF$;p7q~USlt{e_JxR6)uv=S`%IBK| z+}bE`{S2M?(J+Z`#?Y;V12RFru81%;-I)til=^vQ`jva^yGm=@Ba5hx%04d7&g|mE z=&XOUW{&YZv!tHW#B<(C50b|KyL`gkd$LDdwod0S>!eyl#cf+k0Wt-4OwtE!IZ_8?L_%1C^eygD~ zhgBA|n0;Emip@ExMao8Suaa0gv@^}?UKpGtGpJM=@?bY>c}PJ`2mvY3%^ZT4oKOz? zIiI8hl9;1-({@MFE2)r^VuH{8X3PPk$kn~5-M}H?T*ma~*(Dz$x-fLGbN%xkex7Ml z67cKb+!~*|30h9gMf%3eTm5Nh*8juUIW>tAZELn{+qP}&vTfV8ZQHKeW$vZtn6p)r{NW zQ_w5>0L(N}rZg9_uDU~fe8foo;T*tw{1eH>`?|#JCE%t7#W`BkFy;-)$ltJm(;K^a zOuEA%4EH?{d@iDO*Z2hCr@t-@tGasNghO>L`YdFD)C#hse88z^VUk-c|)RW`>H!?AwLQEvEDTy)u;=}ba) zS5_Bx_~;&Y)j}~)0Z+`rDus}KFU7Se$;ni~s8lj?Yd~D`vNQ;zm8D)Pzg$QVKiE!O5~ zcZkRbZZ&9zCcR2NE5JUR%9k6rQJu1RU@Z%)Qjga)m*J{nbo=b~GeYrKM$Uj~3+MZ@dShD@69%CrdQ;PsoiEK! zAr46q!_&)%iAs?#e8S^z+I*arZ3B>~BCSue{?Rl$x^^(J=DQe(qVhgB73kwyZKmq+R zdoczSIfCkcrS#Ms@S{HAYVJ%G2#Vqd+=^R3`bLxvwj9Az8MFrxL1DQ|6cM2y9IQS9`N?CS7(qRa$`I57pVtcnkM=QDu(USUP>p*X`46R3IDhFem)`Ukb;jQHFYGkwiR3twMaYnXc^pczPCa(*&M;p zKT)8^3tG)K*JQoQ~qALAsY2_p<{4mBHwinS5$5s`_pLH41t!?xUI zg!}3tdQ$D>Wk8{w5qWkPiZ|bcuDQuDUTACiqhm2fW^@H=Ec5!&2&kxk$awf@RqqxM z+cawGrCTW+a;7@ScVE?=6WKu%ua}@sb@>Jd8>RaL>hC{xQ~U5eh`|hj&V@eUO8>EG zjmEph-8Q$~$hBwXhn-)Wf2Zr#a0<}c@34I*PBjpDbv@!&fGZzbS(9}EVcmG7?5d={ z_ir4b0{01vhe_mv(?zzrJuSD;es>Wf_c}w(o^Ayu$gpP!y&^vGe^wV^h5nM?( zdr&n;-KXeUl9wLOHi1-7!cQP{8k?0~YYtQUB~`KD@f#KfgOjm#gt#zn{9AAZi{T|X zrQViUTAfYPd5&q5Kzw2^r$U5)GsCzFe;89nb|>!mN@sO+xY}W`HuMqCK6I)$xka!8 zbMgaan=x5_0G^+XRJj9S1T{^mG#;tMx@h`4)W4~^zr!!LKZKEOj1~;I(7pX9w(Dqp zM>?D27peNQCXBWIb|n1teN_4b@Mgi4@SkS6|E{3L%<{i>=u4Utu@}M!TMww;fb2S7 zwv^*QkTrwX{g(()lY^$f(5tr}%02kD_zCBxwuqZzT<%ypI-; zYPP=5+8J{Hla`1IoL%|)8EspyZ|C)Eq9$zqBM*6RdGze&@>fRh`(uP8iD=>e3;B9{ zcyyr-Df@gs`&FvZlVgV`7ozb2lY=>v^6C6$OkoK`qK7{?i8V9zA%@fS$TCO1XtTt~ zKENly=v`9nwr+|sB+4qPIzu;v!^zMB88@$KW-OZTkf{+G1&lxdg&`EM33bn^q^kmt z{ph=TPV*R<31Gfhg7$^2SSdp*10Z`5LeM^~GM2Zy0c1j%qCr@vkg6>RFaUKKZLTr4 zT3EZ%MDW#QjAc-aKafs>Q2!b)?bxJ=AnUUs#8Ss>B0hO}5DP>oxmU+)G zgIK{%=TCF{N_Q90?Dy@KDF^|V_-2i7@2PID9n{i5wL%PVR}&0Q0nxz&wZ%lZNFQbORcR}`Tuu(2@xb2)Gh4W!{=@@$^fs2(wxxP%mveJkC z$^%?{rlq=E3Ye8q${uzbPSe{2C(XBX&a!}#L?%3BIFcIOB%4myOY)5PCQ!Y}9R;Uf=>KnhibE<}x$O^GeOK!jWs?5H{j0#j~> zlqyt5Pd_ohV6n1QL?v?3UHTG{$up9wS>LqP9YUdrM4p3Rw(FM1c>Ci~4#!kq^NP76 zUFDE|43&hE6qdEO03SJF7;-y%#)ME(prZrqr<%Kn zb%4Frq87Xhg;=`%8$fbB>Sn5}7w-KY;|^mNF7g)}@z~ zOqnf-b)J!vXrS%&jK^v-nCfd9`4H`93dVOp#Wq@XIzF>J^}>Q8i-%jESAd9l4nu|w ziHDf!yl_3gK6W;Ws?Ij7II}(|cDTXOWKhQB<~O>)9Gi?MUc(X1FF$mnTB7bYstR%` z*yZW!tJ$5q1&($sq1UMoQ-sU}pROS0Wk_?7Lm*k&e|iS9j+OawMu_c~*G%)gz#-6n zh)pozke8oeZFtjVV@y2YaXiywR$SHgfidpT}B3}H(u^iC=nirTt;R%34P zv67=9k6_Fe;wRPi(im7w%h@)KmMZ0ThJJw7;rQV@?nto3yQ!dsY(quY79|DJerJ^1 zd{z^B%-x@)46mYV1CrC#0MHqH;B}ftZvM(D$GMEB>|)!F~0yZqW5Qlq5S$B zCwidRzzCZoj?Ku0aZEq~L!MFzH-HA7c^hi2B0=Y!s7=+R#452fyhhIg)7@kj@GMS7 z-WgkdV`;znvbx%6apkyqC)Z}l39!)qhvJ6}xMPGYDi4YF|e5arBUrZG#GySjn11jE_&ls75SD}T4*BMNBzXNkh4DmzHH8l$}IhDP)x(RjoM_IhEb z4MzN7G0!@dqDUsk4Ps`zi#NKd`73|wRu7u=6Q$1AhGp_y*K%W=(7Ceh_2#a*i!FOu zv{Zd6-A0}|{R{nnC%ehCE)Jmqo7*m=U=wj7KBOz8To_c%clhG7|2VtJp$RF@8At9= z#0`F#osRyRt=_HFQTZ5I^#keYp7m(8c2btGn)V}P0lPsZYZE74r`^#&O6oxM@vA@g zqKZ&}(|NGxVl2%FB~OeB#Ul}x53l*O*s;W54TZ(>?z(0l^RcD#AY^4rN`t%em=R#8 z*wz{ynA=6LAHG0F(EBx@17b27M?cTuz1%anFz4E1>&D@pqDwhS7&Z`uLJ21&XSi{8 zl4^YWv(ux3dL*2Pi_bM28ZP-8(b!iA1i&B;rZTc;;TQRe(Q1fq-wgy$$CvBN)4cpX z>vsvEc84gaS(1ygFCzv-5$@}cGdOQ__Dz(B2}jPZGSy@CYhtZ7`B4wXJvfJ7(~ESq z<)yH&JaJe{PSRIvY(DP*_B{6McMG&Ch^kXIsn9XsMqv)YJJCniG>sgr3 zv`6E>u_>kVl(I#oL&)_@m*S@TY51e&l!B;B2KWZbz*lKdp_=QeYKvkh9-TYp@nF3@ ze6rBp%&}asU`oEjNG;!vGB|f02U-^mLxl}1R`qkKQg+N`!hfT(CJ~0kphHiwx9p`h zCg-$XYPK$^SM>9QEQnUk7@Of`3VJb!UXA@3sQC@F1kEF8ATt|G@8-{JAkX;B=Ww?d zdEC+FSH3SzS0l@sA!6kY9T;^1Fy1)%wJML>> zL;}?Tm}m(Ia4KV6&qpZWp?TOzN4__3vllRkS@N^8S`NlludJm!*{#U>v;n&fF;KH52F^-f7j~at`6+A|gRn zrQ5;#X?LVsl)0rw-#oFS8VN+@d3bmsL~# zln_w>6gfH>3=1b-d3__P=c{*57BUfjBh>k2E?NloHy^h&q&$3 zhl^aXQ_IbxP9gpL*w{g@213>z$)VjCULm66FBIUsLrnR2rP*;y!2dPA2|+LYCKXEp z*(ZKx1!M1CKkTBKQ!#6IUw-I*w0(I~hl3rqetup}9PhZ@L)CwCQ66Hv#B@O+yOmZP zw#u7-5a%V|csEFI_FR#_*RK#^BwZzC<7tt_IJu~Nyc#E>rphIuN?e?sEB@Y1QYoZF z&kNrJDv?B?UTR)Z$hVxU^K8W(7?*CPe(}CtoIu(3iIK(`o$nVZwo?t^n^5gtHnpne zko~}PsPozn1ZertSbl(U(437 z#71Yi+=hBdlFw}r1wJ&C@EMw|8jWM#lxTFS&{g2bx+%@uLQ0=w8VFAfghZrDoCpgM z(9xFqt>HKFOX7KO={!v;ZAb9d(@DIFi0Qj9+PwHCgS&B}S%<9@c4RUfGf!|w1wvhH zTXQ6ednWKZ^~)L*0+Aa4C1&zZ{E=R|3(_^oMk`D%Q%>2|L*K$USPf$ z?BD-lkM^)Qm<4x`i-dCc@;n5yflT7qxth4(NE zNA8H4aSuB17AL${56OhehdFSGUk@?saP(i#kDw-wcUR5dBt654TgN6r3%5omBw~ee z9ZYFtJSRg`^FDqI(nB{%PVS(th=wImD6@5UaBq)_=L3r?j03>&f7GFIG0MBolAU0@ z&!suFAI~=VnsP{NA1spGHz5w5UL?JtoLLA*DYYUTCTc5>=&|F#tvxR*=UO|wK!Drx zRQHd@5jLL{K?`}y>>_@Hf=Nr1IEqh@4dg^a*Up7MlJJ+AXwx^xf_RQV9N%)ggmZ*w z2{B_QS^jsOEVNd^F;)iHh0HLlG8YOY2bvuVJR%Ho=MS`?4ax=0_4;aWZk$cQV=Gyv ze=p$py$&|zn9D8=?G@X_W3b6&zF*}+O^%F>nIn>yqh?8fxOq5;RtfAp7ZuBtf?i}4 z#Ys!6&4gvuTgUk8fEk5JYxI&|JASwhxbSYaKgs-a-({_g#J(J>i1;^^f=||XwKJxcQYk+uITb@u(w0e!%-hP!gI!@ zjesbWzcW`j+Uces1(HJ*&2aU%7X>-!U#_nr=@ZB`LlJ9ZulzaH)>4hr-GH?nx}AMH zu({e|0V#80E=izNX@$_x+t0&vG$DSs5>mi4e<%51uN|VKjN&Hu$SOAU7W!V-r@7d$ z{D@VpsJ??R*-CLm+=={t_wT%J<<)l9Tg|!LC{a&UIL%Hr7lGel<8tOqpwi;ikTE9& zQo!aTTzwEJ6+f>S1(S^+SYcso-Z|#&YfVnilU`{%9Ns=?83H4)#yLgJhdwoEGm*D) zScYz5i^<@3Y03s#a6V1NE2Rga`CTZ}i6SU!XbU76UaP zkJ5U!O(-G8B3DVsqdO8Ys6;WfE53Pc`7l7k>zEk&)ymCTyfA|i3omIK1#L!rCQkBh z@pqLmzG|vR8i{&eE9h$c+(RNA)nS(VqLJqO z?V)$EB35Do;KM#}ZX54F?U8qpVR{gM7*o$`aZXG!bekNJ-S~jQlE(6UDR8teg}XSA z2qN=+4{`Ajd?t{Vn^R;#NERM`iIQ%H_mFPs)v2dDKP50R0vNsS>u@m~b|MPHfZ5cB zLzcotk+0{~5lgk#fvjPT6azVcsO7PWIYbezlVT@4!+PEBVz@7U6D<25lfwoY!Dq*@ z`zJ)z8fM_r-e8NqH*f}PQpO9eygU?|)sjE8Kd0kg^K0vUlzPri>VSSIv z5&8>NMMD|0do1@ZWnb>gKv(CzUOwC<`HKR1NW}Gx2raxc@402s?iT$j*k~`HapKpQW+MlJAI{mN%6BiT0OBXPH!@Qg? z3ykwud1t;IB4;&NWwr7!b|4gdGIDwl03%UlaNHOjh*?^#-5fMQ)Ac5j*RmT*15(KQ zb+`#(be5t(3h=hN;hD|NB`RyN!dEt|%NnKC>_)!B!jrr={w@_Os( zEY4^)rkhJ_!fjdtg-WO&N4`%ptlw@$wJ&^AuQqb-8oQ5;uo|!ASsQgXWWb=C;S|4w?^MR%$2Mc>XY?bcQ5B1xO&K?kdt3pZq0Q&fG)?9*?A*XVgY&m+;=C1Zv2e;)y0XdwM&>5;^5{Q$4mpjU z>Ee0&2#ggeRu9vO>b6+#p;T?aiy1cxJ_~I3I|Jcf`yjy8#V5L&zfaT%BD>B5;%ZcX zpe8hk)gPG((%3%A1U;HL+`$Ws|6!8`I7K1E~iQS`?B2G1S}D||{2o;H4R zO*A3RWV5nCMUbuGWCII2GJe8^i7Q8e+`T7i53+*VP>??=5SiKnGKLp~CExuxjB?v6 zX6KHjLfd=SYp32w)6E;Y98Y`+v>D8C$3fvlN|zF4!OwM!`%I(<^Fl5@H?a)=iUbHd zKy-h@_%9ohSD~=P#+ngxB}>#}cs5#J3c8=ZbCnSdX?0Ze*bwRayBfpM4Zo`&Xw#2X zX;f0SNLeA)lGIK4xoOf-@dZ5H41*)R&CvRpJW+r!zxQ!RI~G!I6Xl4wki;xwN0+s*9@^>)$i zKlr0>?LFeH>Q`}oTW$N5x%XDaoz*SG+cf_g>+A8J5kAaD?cIlv_xH!&MW8+YY>x|j z&%9B0Fq{r~;Bl;unJw&H(`p|kf7;b2zFcfI9!GL-HgwlNQ~@$lELo(29=y_csc zvf=P#eN6Ek22R6j38)q2h>(gmNVQqK23uSddJi9loTcl*Y)w+!4({8$Jyc&fh zFX!kuhvUvn8sC{lMUv3jlaj^_Xe{l9>Cuq~)uR#v_1%UWsF342GX7vE&rx}~Y7xm4$AI4iB4tEfTdyeI~fHov$x=_#<{JI3mm zyv2kp%oAqET#&&ez!0{_Q!(-AXtRf#d77qw(yx++%>GuDE zjqfTW5e~YHz_X!tMi|v5emI3MRBM+RgBK{MHjl#*bB8II;f8i3AA#N{2o|5BhAkVM z@(ABmsP&W6tP?srLLwQbk)$J+8AD)J>Gh!%2U1kIM;YTu?`MrM2pkKh+bH3h$_cKb zFcvcU7;X%2nKn+>+JH5jZz1VQaR{DbbH#D=^DPC91qnNjF|WIoF0#;2uj}J6n7RU3 z^1$||+GW9cBO_(V;^kDQFto?VBa5z6y+;gxRheNU6ac>`t7f5G2mx6WZDJ;qhnWx_ zG*jq=Ut1Q<46ZrIwx%mBKlQ&k_8SovqTX^fXs#b(eb-aK3@K9uulYlXY?}lF<_D85 zgr(8_4a_#6M{su(5GHCoxt0{DQVwZS(l}l|l=nyn#YQfTf%H&f;kcmEE{vF3s$eOh z*AFu|>Su?~;Ya+ldq_H$M=)UC0;g)NkUdd0md*e3TKxVVMvVMR5oXNtr#_SqBos`r zTgon!n)bS^ji?M802}->gq7XD2tXjU!ta?oN z!+U~H4gzRjW66mDiDyB@Ij9BOLgZ??^wa(GT!MczjJel4ZL4izNMJsRvphgXaGE-H z7H6WV1<9;>M*#N-pNJw$n6HjHFs8(r15R~TTU&qmkd%~c&YRW-sa}KpJbg&@G?8IW zn$-qa?%qn`oURC+!doy7?mehWQFxcY9wp69wcV382Q{|@DQnVLD8(|Mj>IS$L7r=* z7c#Uv`p|o$^j0Jag@R!%1jv{wTzOq6imxA!U{n*afJZNJcD6u!0t^aGy(v7JzIPsP z7do`uzAn64tF9*SK=TJ-q2pg0%+z0MFcSj0h=sCn=YI&S%EBhBI1}R_RZxIFInN@Dbz1Cbh)ECVxfWI-# znhiWLAUJILKS1425-|**yQO4U%ue=ns0^FTjpU+Pb@CJE5f}&TyZ!#5mZu_WB&IT? z1buQN8mH^yKHSb$ErJ~YyUH8GtQTS6hJogPoi?yuMCwHouRoh-QSbrPP@^yvxE?EY z^kXuasev<*yED_9T)Bl#fc~S=`Bw-B%>HU90SZtn79e1!ifwBidpG`0cIDsgkslkg*F8^{EJ0RcYSy>`jW<8_JEB z5kwE+P!R4sxJPj?aMoWpYX{Nr>3Ee=?ZbMq2)Fg}FXxKMnzT`-NPwHK&6myej#B_% zBa$%t-wUk>3zK)1Llwi?WrqiH)UTz@rkVZ1&U~ZWO1^e!Qi6l=+0?gq&07x6XAb^fr{b${>jd* z|8jB0o_!Zp3U~4=APaYjD_mYjjh)ge#$)s!{*sqf2$OqTin^Pw9FepPjQ&Hte~}f5 zVGEHjFBS|mE1xRr7gf60l_};-?c7aEq zAxk7`JWd*tlcRuF#!MDNWv9G%6>rZ;#{u;jq{`Jy4a}sXl3X{r zvRcx6mUtU8uV9ChyS5R?3~j2Gv=QRn=*%k1;@y2_31(Py3W&&=; z_r7j%_?$`(;_&(m*0sS9-IgK;2_IsclfGno$-?vb@-j4>0+nO3#rmlPB zr*sFMh#3`DUKcv0@laWwLptNSz~uS4NBM27>S8thdhI2Z=Ek)&P3ss6cCqMtT#Dd! zL!r`ySL{q{v4rj5yM>57j$OR9F*2kLqCj*L{|jnXqN{B7RtM;Xruq=~TqbT|F$WJR z{N>w$1!Z%d*NoYGv_g~&)=8-#o|wsE=W9M2x3AhL+e{@O*RVatt@WQ6h4%0FmLK4W zh2_rwG$#L7Ap~Yt*8gQ5*wW^Vqi#c-{-S;aA3X8_=m!DogyzutFbM^oDmxm)u0sCt zY0waM*Uya8144Y=fUsQ z_%RU&G*9?M+{qCYjMAn~uyOzRMBE6!Z8r21*=r2+^#XU=zD)Wf=l55y8BceAR>qI_ z@GseQPwo1ODkU4-vs*{Rl80a6jvh4(%A{;jZd1gXb7%z|^CCBt{$Q4I|JA_vHK8XJ z8HNMC&>hnq&srDQHAvui`DjdxD0IS&gr|r5l%I?$=5_|(uge@YeV5A-ZFQI&gU)46 zJiAqF{~G`Hn@(}0=Tm*F;5T~^^2>=m>M;q!IkwV1mC&XT>YtlKGryixrjcjm*lrkb|t3c!2 zaAFr(8lT%zTR>ZhSrzYHgDiWjyEG)|KCMrCz3W$!mDU@bDiNBDXst@4toc^ATDGP< zR;3{F5Bshg*;@mU)|fG0j^YDj=ZHrhY-KPx19Kk{omfbaO9A~yJXt4YPGQ{#g=OL| zr1(N7tRx}5*}8ZCDcXSjt3|3uma~E?oNNJ9NaNWU%%*B53M&_uwKtwXw&)^{AEIO$ ztfZCEI7>cpMim#QZ2Xh}*eAG6fxp9DL@+2>3?c(_4>7F*s{`rcw#;jL5sed39P&T9 z=21s9aa|j|;?IQiEa#|sHC4=b0X|5e8xjJ`Ud2vYWQA6ZPuDPSJ*$qwLGu#MHDdPo z=k{QE5}LJr5+Qw^(#Yz4iTq;5o3Z?XdZ9ZMlD^7mcm8<#%uAbRsMO1NZAN-oMvy9w zadi1cIAD#eB)bRyn6`0aOzTe}rt-@YlkkV|zkdyawE{SOV45iu4@PfVYbf~(vL3VL z-z7KTRPUk?i-KaV!};SXD$F}-N1khn6l#}17ARH$Q4mbBABdAi6LVQ3&|!snARz6d4Iz)gCgGLQctx@q~vdP*vysnsx)LGS{k#LVR>c7+kn z7L8)?!4ehtS2`!t=ga29nzstEUDTXs?E~MA=&}wDsDk4RtW0A@ivCl~24QB;Jd{xG?EHa7BRo$j7(Vo?QbC(;LvQx0JtB+lmLOr+&$ zRz6HM`U4dZ5)}SORUxfd{8YX0FI9Q#o~zNfGEu8n*R}9aOT4DI4`qn>Oq<4MS=3BO zb_9l}`wF7T1;gPubz)m|(GA??%mpT>;@@Q8Q8c`;CkcA;%Rn5re4fW;AxhdjI2j99 zGF{dO_>|R{)|lZbH!Nrt81muK{IX?l2PfCRmSO?h57fEkDJaXTEc=rDQDLS41D72= z2poH7qzw-YRN}l0)?o&GWzo{Ot60H0eVdgAcL$)l0~KQ~cBU-6gfk~{i`{?B)x;uV zuz!~0jRM#e?-Yy)`90`jAn2iS_cC^4MGibxt*b>YN8OSB5u3yOyrOK#*Y&N8ehp_d5_zD^fIYh)-A%0mYoSPQuca+R;!E?~O0imdva$`$=F}J=@U;Ftta@`bY-eV|w1G z;G*OUHtCXB{O;5`y{KguC>qd5GVpUoFIjmn-m129KoT>#a20=b*Lw`L^Eq5*S;3NK zRD>&Ge@ydoPpulLm#tiykevy;!gKdy3ZQ-KOkVM1SUUW$Lue8nhZ9kgKKd2h= z$eKsuOto!hvd<==#r=jV21IoaF_8jgF&fDm{_y|$!OP7H^x!g?)CNw&iChy4)Vzk= z%D;}O#&-uAw9V3$kM+r3MVbot2VAlR1TmnhB)Aae;F4e-Ick&JVlFHIk#mf;JNOjs z+y1W4LJSyne#lDxv#KQg7UtIoMQ*#`IS-(UUL8nGl8inLU?jNWHL}bskScSqtk2xb zI?v(e94fe8#H&fTuQ&F=BL-Y#%M7=l-6zi&waTvno$dJ$4z&JL19tq(17q~%FPBFB z{tlRU=DiFeRW4JAIGKysxWat?xWSF9v@PRC?0OQ|9W30g~zk-JZa#y(9q5lRo_CG z)23KTk{9}9bBOgv_Hj>R8xdtHBz`w(rG9KbxwWnp7MUk0do{L~j-j4a+(C3AN|z0{8O`F%kL_UV^{NtkRSRrhUtYX;v0T_Qsa&%*sx zA455f)yP#rr=@I1?6ixOC%8yt**gmrseoucY(c0WAA#U@duX^$|FK$*xs5Sb%PQA) zuc=ShWcfh*=~Btzx=N-q-p7xU0y~WhDEQ$Y)*Q&#H3C_T*AlaRiniJf6~(t^RYQj} zwOH8`aYA>_XEYWMGRu4ECsuUvky%mfp++@5O{R8T5&~CUuOQS}XRJMi^5nAOJDHX} zrfOsD4gSa1YECH6f1n1jECc8s5;AY2DpGyPPDNCS-HG~pVn^7QZ#b}Tj zFiX2oDLO~}uO)HgCYQ63TAoRTla^>{Mifa|CB!sZJ^y+XMHs)*ANGZ#ko#<|Dso-7pNYR>%?3x zbjC|msF4mgbqvvKQJNg=rEtpmB;jj9LYr8I5NVui5`unUfR$w8@)p-9#x2m#<1%9o zID^BZxDyKJy`gL_7e#neFepgH z0SU}| zq&tv$8ld$PI6eO#E;2qMRUDhI7{rd>*TN4#KD`9Ve>f*H|5wFBW+qm)|35+1r8O0M z_$#2fQ96Vs5dvT%NV%_@pOo~%w%Jkj8m(x2sdq|W=>7%(6!8ByQIm_;q_}p(f)ESA z*Zq2T^@6=={0h!qY3usj|F$t=x7W|#f6|k6)8p6i^*G@SOxgKp|IxgC%>YSz1)J=z zvDMx6{Y6H43O>pXIbUp7z6+@I&i(n5Qag5g7f1Q+28)kOf0TE5P}3NRTph>#H|qcu z_q%jJIk!aeU>9<4n$(+bReOeocWU4S;^D*nuIRH0Et^5MkW>bTJZdIBY>(v5w*5XK zIN_WZTDO}v79Tpr^mV4iZ#()K=r3fZNYfZ-sg#g38eFbG>j}7Tj}X@DLyHb{%FT|Q zpcnhrw;Wo%VCe6|XLz6`Exg_QY<;_YJO$)rKgMy)M%%9!{Ls0EclDmp0W0)QbZ2u)lC$N0(@p{AzhXL`@sOy~xh= zOw6quf40b8hI(cfhdkXOo3g)n?7rd1vD54=7D!y?JCW3&>HKSM1KJ6^MToHyUo}i3 zG{3~DaNTEcc!XwFI!hgpdQM1AXi@OSAIzwfI?$5lijO7A>_c7Xnn-~6I=f|`44a{p zEam-Ta|-L5z~DG*IM`^7z~4hP!0)C=eFnfsw&wag-T#$Si!m~E5$|TMf94@3B5+isIT5Y^R^w|Lb z+S}zM@SeagmBBOcq6Jen+MWvSQ$rL+q7l(4R+*hjZqH=O%6_T3akK=_aGl`2t{3op z18_r|?q+H>P!@hFe4YxlUVu5_HDbAod7hwx|j&#A(H)E|dO>dXL3O$76dbn3fkv3-11Bs}PJP}9B z(?Vawr!G9J|AsT6E@A+RWk)NpLBc&jleP0Q&hNvGkC3y`)olo2qXU}is% ztTC7&DRulBS)>c12|-R>FX|%*mSOAadg^^xT5u1#8gDGl+_=_nMpc(_pUR70Hl76@ z-IQ{TNnYw;2Rpfju4`x&8~`{NE?@8jkFEX3(8_Eny!qKSKf1?aDQ?eP%F z98wX9_JT#6vyI^s?z>J9D7Sb7|9(P1tJ$i4OYX6R3_$Y^`n%+}UeeHLQaH<-P{TC^ znh6xYwp z-h~a}QiKBDZqH|iW$?-Do#GYpVk8rRcknEI2w^(0A(Ypc3V6Kivu~Yikm^095s^@x zri(RHE?Ef#C@T!~Mt>4$Kn)B9v!zrHv@==ZTCU5M5l1PRI`7 z;kBTVpZr7!OGU5~PIl}>S8r%5!`C^33X8PKmcKEfi@8t`*QH1>dAGrB*NAl|#YOBQ zpF=wO?a77jmbMq*(#;_;d>Y{Q8NtPbrum=vtEK)ap1~b*E}?v@P*a4rbjfNPB~r2E z6>bjcmnNDYG1v%=CWd^-20nzr>|Eak0T-MAbX0W6dIqKq$r-3om=Bi#GzqU4w$f#| zJpc_fRDRbVTplj&YnWh@S=sktEXC}8NmCn#OrJ7+Yp)#{Xhf$YrKXpfYM?yI#ub;P zs3p{E*?LvW#6QtFcTpdI^0|ZM*aK>_8ydNUpD!RK@AKi^sgwaGBQ#hFaI^CHqi!I} znQTrP{fg`)fey}@<^3YTG*8D!MA9%btN7^!P41i=G+_e34*-&Wl`sgUIpzt2b+gH{ ztN<{Y8YM`Rif3@1K%tmxOn0O$imGB)N+Q|TPf0ZkWT7$sOT5=hLVnFBd4SM5RR`iq zo!2{dlCFdVo%Qhrz$$qt`~sS{<%Fy2m&ssh2mmY#z$2wRfR{N3EXEDVG9ZVrDd{0# zBU`c`4-3rso1V`;1CkRXi~qzbLgP{ZV_kF}s0i9tA|1`5>g<`GFU@qqU!OZ~lOkiZ zHglu)^$cv#lqT1Qf1hh+>`0C%!Z66}mL7peT3|X|?Z{=f->ipiY$Ifm;~O6XGrNLz z^khsZqq*vwo5s*@Q=drFLqYi?d(Y5lQ1CKu|EEDKIK>Wp3Ghg$%HUUa&I4c~w(Mke z7!x%n*Z)9sm1H4{cMP*f;i19g%V|;Ny^7lnkMHUj!ilo>M+k01y->q-v^6H>QMVrY zFWS1FSoQ82&lSctP7c;*?;2XBC1id0r{P?C>1ui&N4F~GTTW-A@+>Z8q;bIatur-Hvt5RcjFW>H?9=hOn?C(KSoQ2Fb{M0*r$kiY9zdefCsWSxnUZ@ehEZvJ9Q{ z>hDR(6QRykrQ_E3b(R#R0_*^_WO-AqxJ!wN(>1s?VMCKPOGd4iAcUr2l^0YECpa`k zBT_Lj858t%%S4aDXR)b=16+)6VLq7WGiAnrLJgYap17bGH2hPb@+Rb@cWE-Uen!G_<8Uk2)?-;31^2_6uY7wHh>0)=ya=_x@2DRTzb}OBTvnCeD)<{ zMRMp+=eD)^-K0LWapfW|?19E+V6d7scc%-;_ z;hr%Mfbz3XX{8rDPxVVJ>}7Se^^;|bieVHGN6#W+IV+#cIrRMQCI$}|;bmERMe|lS z)!w;u2>f;4i_x|w`JizK`bqPi2ujwxhs@qajq+GOd~|jHxNlZ|wbaErdX3OaVti@j z84}zvsMkyRpMn5$!&*l-b0gD-SOK?&6Bl-<*;w41Lg)RF2pY=hMf%` z2Q4eEkX$>^Ae#g^dKt7S`K;97yI!#g=3afyVPh7^Tc{M`7k9ig16&ThcMg>ev(VlD^!fRjcG>eA-r_%f7tPD(@d`Ki;!@mAaz4`+-XJ>YYAxtwKO~ z#pEyAw?5hl#$4cB-ETN@-7HphWs_SRGUfX zVtE^h+Q^a~RwSXhp8U0QG~QX#tG+`CJ+Vrg5j-p$=Gf`%<*Y=AXrD(0Rh9LG%af3O z@cQJp2?G#UjdLW93!mF-aWwOund#o!QiwSF7`m_-8gmS5nu&R_acVNd<+JMQh@VsD zc}@0N8OiQ9dN1**9|{7o(Dhwj>*cEJSTTE7+I~?jalKPYCO%Pwg;)RRb+!SemFKb* zefHX#_~=SstzE3!t|~y}qNXNk?WtK>O`(ZO^I2e=u%!QJ=4d&%-E#4iP#92f9z#HjY*SX05^E`9F-EV|%6T+GS(gwry8zyJFjR1r@tu+o;%1R&3k0 z&Cavm?xTD6u|MoTvDUcfIj=bgV|Z}ph5j@J2TX09am=9+FoLzIhd%cw>H*x*`7 zewDr3CBez}Y|)m;?EM^jyVC!9gp`_unfp(lKkWaN7KWSc-#&l-*}1t(AA!^cTcpWcw|+^)}^FZfkqvzMnuh$*(|9P#uxpV>&?@&%@0EU*adF0oj1oIAa9}U93lf}~V z8!l&K%ehT_V@$8;%h{E2hq0*o{-KZSE@<%#yl>(Y#@)|RViZGphr1=9-Py4kQS=OB z7?US8q`>}TAoiVIn?y(<=vxzndS@;fD@O8p>2yG96H@2B>fyWeZRaiq3HIyyaz$B3 z$?bFGsEcNZ)A0~3oamjfy?jL8xuM*5@5C2SHNQ)6duw4jeuFZRZBj23PL4c;Yh`l|jYs#eyAjIltLL ze;gkF8eX9)in;sy42n()trj+B?ISB{Yovs|x0ijFi9sN+4dTdWkxJwbMa+acn-nwF zPh;_kIR6%D7!3>BmzjyjyFnNu645%>V}b@eQ6i9Rd9eaJja9mq;ldjilLkS8xXmGv zmA>@s?o)ll-z^{%zF2M-i;LXytEOB0U6{Ky(#;#~UJcMQ+Jcs0=}dvqOP{2DgpsOKZS z`6rxa^zy{{n*7FbpCe^7`j`g5Aj(ZJVaMcSg>YIVm$jdWnmLi_{uaPpU(~YaaS8|= zU*H0;kT3x(ziUvv_HaaaM0EVd4DIzIrmA6Re<_RN)?{e+wR2Gkblg5V1ojXG&PI5& zO&4kL3NkGQ>v;|8r8(KHM#AC`vcHGyHRJ8g+kq(uBYJ0Nx#nu7s&x*`cX_t=l;MoR zg|erEsgLIVo`~^K*0vp^7?q9kGk%}mo60E^%@3WX9$)ccHk;L9VarJJavKdpnR74K zjwpXy;Vz zNtF%A>!Jj3WBBnpIK0d2X@7E|FKb;r$VTRPE34TeZ1--cJXsV}Rkj&&NoR-`Z85Jp zUp1qc14Y2vsjv76-PfNd_QmVV$C538--tt5|Zhg|^PS^-l zgV;ZA@v`-_N$yEQy>~`8%)G(Nb7}X#f3Z`;X5BH-$CZ+|G*q6oftOmvk-=2Y&S4rzJs^(QB{C0$sSlXU2aph~8 zLC};ni4JsKAK>(mNaR{${QO}G_k+d7n2J^#c3d-hGRGZI^TM31XIH-c#_376(vG?~ z?FIZLfu^A5ON+}X%qE+T%UOf@Y6(q<%3a<75P2E#9-h-T=+Wu4({0M^=_|6`MCTjz zaIAQ0xU)=Kf8klT+L@!-0H6;jYAr?1@;|5{YUfD5UAwGSNe>XX(d~L@s{8uk$our< zp~EJB&sq&kRWA#UHJSbu#v9_+M$HO}y;aI&`{3<-G1`7G+M7w}x{-6*CQ^&57Ib^m zu~SrQDRgdHmeo(~SwQ3|ry)0RmS7-a?V`m-57fC|&axe+@}%QBt4&v4YAXx7$QC*Z zn={LYKa+DM;n=8hy!kRb=``7Gl>g&;$fswIz_Du_8krO8+n?_#sd?kDM314i!CSSM?Du!3gnTT*p8(2JLLb-$7q=v{>) z#2Ju(6|{5-9Ng;vV|Crd*sxXB?r^T4fhDlBF>o{Y{-RBJf}eX}x}?*ZpB?L;>k40%#Z3u@EMCj@Z7%u2ZE zr{{Mt&i7BZ*?&1DGFmVon}-;NClw#Jq(Sgd`~^v?=mjR8Nl)VsT?CulE!AZ>DN69O z83kS+JB&>+&?xd2hoX33NRQ0}i>dCUV_s)F?IN7HGHR^kwDku~wmAi46aaNm>Lf5S zn_x4XB*Kd-qnYOW)oYnI8}i~dh@{wuE>yqqhI8pMmpnXRsu=k_|Z6S*r#cS>GqI)!nxVKnuzZ@YveQVM{VaiJHcHGzddDCF-= zND!YP=*l)dw!3Vshr3fZcm91)K*?H6Te_QSkO<|}8Z2TL{?RIJMBDcThicVUl+R$#q%es#A2UK^JkpQ#r_)gVPY=cIn#@JxIYVGK zra$P|$-LL4C@u8z?tNg1TXg2d^^irzXh`Ll)sF4DU4^uH8s1hOu+ihcF0R#apQ;eGNx=biI2X@VxqKDyyf_FDC^fNXhvAJFgR)m`z|Q}RfD54hILIV zZf0N{(p~BX{y6A0{EF8%YRtzWKy;h$fg zo$87iHAXcDt1)FXzp7v2@oClOdL&4&%*u4KMd}rV#d)$+vuNw17nVHXk-Q zY)pSrrq{oN)Kh`|)xs7TzED<3cEV_Ewu>%n>!Er&EI@29b5Yk05&0XJ%Li#8l3x|U z$f+(bIJ`4I<(qB&25+L8NN>X5-*|l?V6PCj1J;(t6g`j(KT8y^9K_41F@)gV$ENFb z-u;Wwe<=d>9JEY*NEag?#LS$#cpp)Umk98xkC(c7UH=%QK;CU+E?-Jjr?L0GIW@TU zVs*eTfhSfsZ!W_tZ|*{A9;2I+@6dBU(%~>i3iS8p4@%)5Y_b2Miei;747ehGHm>4x zjuP(~hfcO1oNA^P7Rbye%WDM$o2$rwovspt=D%;Z|ML*s@oREj=5fDC0KCgW92)%H zdfUnJ2(owMt=jK}(Ow~J@IQe(*M9}_TrB_AcU$;>pM}(Op|%_c1Fs3X$zL)I=R;Cw zco^E>zU_>Yh?N!b5-}6JKG-%&qFeL14rlx38023P%BIU{X&Rm1{~wO``ZtbG`F}V* z=gXr2?HT3k*VF+Vo4>s~=LE-<(L3pLYM?WyJF#na33hK>p+Scc$?oxI%Ufi7 znN1o^R3L5(ulbW#ZmXT)D+^*aVB#C(B|g(99EAm-OH7Rf()2}eFeq=_Q)pv};7p&$ zzCqscU89r+Ir@M>)1E@s)@TF*XQh zBH)li5eY+82Duc?vDCt(e*w-v2Ck$20r@P3MI?HPfpsl|_)My&V}V1c7Byr@H1rPidrWH?}>xST}dvb>QR|H&%j6s>9fOutZQeF zq14VOHtjJStV%}Udr@9W_>)S3gDg6q~Be5_hqHD%~VqA8J$vH&amN!5C3&a`C z7Bd2A<=ATQsLsn~`w-lGK`yV(#-O;ELKIe^^$Gxk#M4Bv#1KT{KZ4VU&uWQV!hd zhmZp?ZPrcHZa1SX>4P170oCAxM)NMfKZz=xcQfBgUA&TYl*=wJH=ae2eB@P0&n%2L z(zrIlkWq{5NmF1JB>_e&&f$HzxiTsPWQW!H4a+;RwxS-u7mI_~<(sv{Guz8sW!zfL$ zV{;7PBlQ(JD%oN!T``wk0%O9e%Sd9Hj9e zy{-#aOF~0FxA!dL1q$o+ViiXJrARtrw+ic+-LNK({YtM$JLNhCIiBTQ&{s_fjA-2; zYb04KB#k*DHiJXc9xu4Q0SOR{*!v_)e4|-IBu|>Y-_m?zbu>WZvvPNhA%}_hxq?Xd ze>KVZ(Mb<=rW`ax(_R%NgFSK~9Lfgg#lLuQKq{Fsf-PCXHm-S%y&$M#&@-fLcyS9` z%MmjsDjVRFQs)`KJA^-kSxA!baz7b_^s!X9fLS)GIeq-<^d(7M-^SO;jB})7p*K(B z!bNg{)3&owM?7c>f{#*2u#UKbuy^BA%(fw!M6w`^A&T9Pr%|kA5tierq;&o?^ITl; z4t@H>@&u5l(#el1_Dn(@J=w^twX8Of^w+p~V#lWur4>Bx%1ug}oEKXYqqr|VfA01d z1Ac6DS`R)KVcX6c0~8l7ZA7WaB^c!KXxQh1UJjF_cF&XH!2+c>{PSh;TufAn*H!+8 zpt~wr`zjNP6nHbiilHZ+br%dX+0%N%Jx9qVNldmo;IzQfA+A9vR!FOmWj-*sA$s)y zk34wTcp2rnu= zoA>_N9h0@Cxo+ldf^&qwK(ay?m^=pLOUn*6g6*|h+^225d`>r3C>V3!kh3Y@oq8fCs#7yAG-)b1GGAFLB75= z85I6x(PA^7QSG(dOJ8lc0Lfd$R_I@IQa$AuhwoZ-h6*yV*a)P3$yIF14^=TOkVTLsIK!*ALMm{!!#qRcV%C$mN1b z17ur5mx&Ca6YG@+jlYwD?7(2iP0eNp`{|DrM+Y1@GZ9*=lK23cvGp8>)p}&!#sx_X zbA2STE_9w+Yn9OUi7EqF$81v(iA?@sH4e=q@Wa=hY%7Kq%byPpofGZl_(Z7*dOY_; zI_29{ew~Fc?%M#q*-F&eU{m(DoYtxwL)qpj%*vJ7e)=!~c&6qNC`?y#T=;4}xKula z2r6_1e#gA$WnJk-cxC{NyxG)c)X0upfZ>Fr9Lmvdy+x^}vcdPa$(k|T8q;4Kk#(c4 zxzU-bDs3g}Di5LcKk~?9)1IlxchbX@neIrul#JbdyU^k(6JhL#9K(dAvxfwD+29u= z6-*wamF>K?V@WWgOAp-0WS~uy69Zm%*NdV$F|nI;Qx!EDX)=GaWeZG=4aNEJteXf> zgY*cG#e(=&J-1Yz3}2%zgg&UWQc%|tG~pX6spxCTY!lcEHpCY^CM zR}Hzls!9pBT8*8Itm>uzA}0}4nBZ3w2QxRHjFy&%Q}aG}Re_YK_itU>N^tOTLxX+B z!4UO3Z5FX`bBz<&L1l{Sm7&dVpUx}*$d+j%T^#xlFwxOf>EVzH=xglq&}%_LFoN8` z*d)BnCqs=W0Jh^@{!r*;t%pu@%KWsPXcZnq{@k8L*=~zGfe*=zXzB~h=orggvz+Y8 z|Aidzlrgw?)F)-lU$+{&gJpv0g_zY zW`L8^vW0UflXxP{8-lJ-&`4%-p4FLK=NoTUv zmVh0%s#@x3kY1Yff+Yg~`>y~&VB3#y5b*l_1?A^y4a6(GhBW{mAlCM+b}yR_;lSjC zhwIm8Z_~#QSyR%TaEnz)5VkBTeSD-Ae3}h9t85a)vc?JzT3>&TPz3}w!<_vA7B;z# zWk(Y&U%P3eqn8DRCkPcOsYJK*>Givnml9a_OG6KVjaN)R%n2$-Q_L%}LmAxex3f*Z zk1;=B{F2)6|3K4htp6QNbN>5;<@c`ASqt*_uF^fInTAgo+4MDuAj|&@D+RAN)s4`Z zalCw><%UUMR>hqyCr!}0hGc2}R^45jc|e;q|I z9()Jm<1b`|*FlSS(BHv$M1MC~yi>5M1|;lu7N<`qs+J6q{;?vCnlRPoJ1G67U2=`+8b>$%;eI3Ji6ia zTY@b{B#h68p{kJEw`$ac$ z)WrxCfdCT>IO3e@dBkIQ3$w*-FY4484j5r5erL;)=w(%7dy#hNY zJaMT-R?He@25ZlW(Q_m+O5hKO2)3%QVo##7D%8oSAQVs%E-`rYll6LC@Gv#qQt1nA z`cB>8lgxe#$Wi%U1isDXNYWSiEq9bV@cYTuSNs80(2gmZbhPOUwPXB#Vj59vdPf zz~W3yBN{-Fh>zOn3bSt%F$I-xK7A?(Lo-sHq>On^t>nhf2i9NX3xRm->)YWe7~@qlASgDgO3j?0JRm5v)*4sR zv86WT0Uy@wm|2q13}>6Q*ONo1em)w3P^$6)nP#sWafGSQtXM{&7L1cksi6k03?Arl zfTys?)R9C_E0;lmGSsDQcVmN)Nm~q;9_0?$ufa-!!>PzX&`>8*UQcRP^uArxAnrm4 zyuE{$!YFDe=3~pB8iR;h!QLzM2Jae#>%>sESa$j|XKq5fN10S-+%ifkPV@SBMNF4E z&Yj!C%@Y9sklLMoQSpqqL1pHHUDv?{n_DYU%q#psxH9`gdj_Vx}s{z1tT(4nbh@n()9!qVCZ@ZF5 zt~r>+u!DgEU&Z}M1)uRamiObD9vbO!J*<03l!gMn5l+g~^t&H81k;^?gjP~wCE8ewE zqSx3TBa#%;;I=%nb$mRzch>$5>p)e>Ao`AmLd2eyXF*|;peiOZ+8+X2)+cD|w46VD zIpqhBsl;j&liW2%x8Ql=DL0V4EP2$nRYP)FN+K(~ub;omNU{pf2471Z-=s{dokqA|{4RS+L9S?l1 z>1^51N-f7~v5#*9iRMd{#JQcr)>$GMPOLSCwV9C%4%*x*)Qgf;$d3N(ZKVeGjDx5!B>XI))H_+|)jYu`bEZ@z*?XD@c( zJ$^El9^iQ-6Jl!Tp7?7E*RZk)$Wc_^db9-16``3!+2Z|JDJejMk#=|KAXDZIO}R^h z_39HFZ1bylfD~ocf|_CZNt__j>o3|Z&LvzU*yeOU4SoY>@f?`bCV8>8vaq7kH7}TN zjw1>~21@N5C@B*a{~7=h#})z2YK8RTMX7QBkOZN0$jBLX$;4%Yr1t(H51+q-4X&PZ zXpKDJHlFLOn}BGy(NH35zd;ZVR*gt>YP_%!Evk&-?npEb9jf>6$3%yYF*P}PKKfCOs9~IDV)Ji`u>Wn zU@h+DH)WluJ3^`i+WyfILacM+N65NRTpjEH@kw<`Ua{ft@erRLd%?WLsOQ}eRcElW z1z7~%Xyf|KH>7y)xg^o1k?LZl8C;O*-DtE1nnd~%Wk5yw&18kKp5Ch1$@MHDLQ#!I zU}6?2KFa|)2h*xWFZUsn8>`8&KZ*R>uYxp;RV=3VIR?3fg{K(zBcUdKJBC@E+Qw4F z7$2uBG^=)HsVGGFSydoa{Ixd3T4xKe!inrv^P8w1f}?jPlQr7hvYzZ~(EuXc!dDCh z*&Ve6Hap~cZPxNFce&T>oqovWi~X(64QJe^eLi^g{V@LRg}_24SeLhaCs1qW^}(m( zMt=EI`GGQr7hmTCvP39jX1~by)PmSjX~*E3!c3*MpFNkJ0jaAn^t+%M#7d-V&J3AH1Xa z$VII$C*r{nQMP!OhJc48aWSK-6@IaS&7%iuf&fFjNK)%AP<6LC8{30f@cRqCN_-e{ zbHvuM^{A&C>&dyN6!;1%Xz-)K81SJ{(TBh)B{ZiD5UP=OoUY><9TZe4`BwZafL20f z{7Le()!3hc{FQjZ-|DVsM+0eJq6zvUPwVY(7PpfXfp{ZJDxTD$*8x5wWJgUSTb6;I zuNOtLT;NgWw0j)com$w08696iqtE=~S8bTy(KJFcA(5>^N0-$>O1_7ilb5){`<-e< z{c)L=#Nr;@IWtWy1D8-v%d~*~4~_P#+JL^!ExaFKoTuT9f61jOtfjjv(^(~PyVGb+ zu0;-0;$?vRedJ2YV7Y1A_TYt_>rHhct5&92o*L+eU08ujjVM%xt8gtIK_zO2chi)U z@u^n-oC6LxOgS97bw(;#4}UpfMA#Es=_`ETKiUk?KWOEZ2|`X~fd ziM+E}&Lw4)DT9Z+44C-G$#nQjcbujZGM47}p@%1{Oh7lYnpXV^Q861zsv37usK`@{ z&KF=P0Xfq#xBC}eikt7}a>v(u$rmW@=EZ-if%KwIMvH{3{ z;2XujE$w832-a15ltPm%Vz`mlC|` zDk~5^T(O`1ESvRdeV328gicCJru56WUhMB+eqH-}$SudSIRheuk0y;I7=+Y{(w8PZ z)-Or*={|dwaEXlx5wydj+auW*bxa0W5rq7aT~hpJeO|294HO)@yX}Q19lJWeodg7! zz+Hf+e-8}Vv(cf1prTTep4{8h;&QczuVDfrc03T{=7%{g&)qq6`|!+pUt~;?g6hq` zo9N<)C}<^)pT-vKD7+Q}!R7tB@>9<0EixU9K>+#yJHo6C-7sk>O$8-IQNyDj*H&U0 zBo0iljdI%3VLYS})Jdx2XDZgT<+y z^{inio^NnkxOE!D_sGI-y+b5G_5UL%Ye~o5gGE)D`=d%Hvr~>&hRPYn%j=`BxuKgS zMXTSR^O;o8L5m^G$&fr13`h7(ejB(RL!ljE_R#&?)rD_ly>3F;%%uV}Z zF)-l-^~optu^A`T&|ALiVD>6zrhgEfF}JU#)(Qkx-cOR*#0oIx+>KqH>$Ynm#VXX& zvy9bm^{DT1b#dkPksFMsU^E3ukQ`2r_4}L*mmRG(~()O~^XJTYe3ATGDujVlB-c#Y?+wk0X@E=8~S{Tho*6D|>*mVyRrF+aHs6lpc zt!o<^brAB!Dno1%iX&=L?5rBb zKNpU<=ZjDUBjm+VTm42YJV86k(I1k;e#E`oq1?;u6?h=KOHqvN|>N=QlZ>2Je zpC_GV?QQ16w>`4@2L9M?$l6eq1=@3@;9CjxFSSf!?*94A1 zxIBHM4UuxS%xTQ{c8BpJ&>P1gX5b;w5XH8j4{$*js6 zuuyScahr_JF{}=k?CTL;Xc!+t_ZBKf)=Cqx*;vzVC_1(V#B`75tJIm|svP%@9z&f4 zV;zmi49m(`l&K!y)-qdAz)8aa+H0zP%+vm8nLyaofI*S6-yaqdF5Vf!{T`_)4&0#k zI0!>LgYV08RLu$z9mKO@Xw7I<4z4R&Tw=F>%E-yeGI9FqMqZ+w>4|iMYm*IqQ*m%4 z(ZdVG_er25cHpoqi6Lc2f0Ph($Z2Fs$6o>c1!+q z-RBH5h>l!zYwfY>1rAxbQ3F)A%QE86GtFtY$qS>1>@%KWXin6X9ab~R437PRdd~{w z$eW(Wum?8TkilH`p1hz06#Lce4znvdJ6q{v(2E6>vrNaR-ZF5h6!dElkwrKE#z_3U zDWNBZBW=-W@!fTtu>J_qoA%5GSqY|~lVH6&h~@E@M%t&`#_b^s$~p>JOj`p-I^C^G znPyVDg&^2FlvPSgYHIYsXzq;#by2c*xISkDTkSN zT-%S#bFtGVX^Ej9mmGWsq~7TI{Tuv^J0QQI9?SVLR|86xNy4hu+#1)&cSoGwhJJGe zYYU#`QMJ{dS4N=wC~2;BGLft}WNJ3}whL8nX0eq#pHb5fwTW)kAB4_0OKYeWPAS0}U0wp;_qlt~V_f}$v1&_s%1pZNwu+61Pnp1NZ$yh%%=gkiwU}VEo zXI;2^Oc#gH@H~61$}sjutjn^lu%-5O&_C7k?T9NkwLNb=*pNR^Qqwrg*6WNv;@9BJ z#gy@#R0dhonRj=~{^Kc}?Z()ok~3$`3-hCcH5=97RIHQu8IGt4pB5hAa?SVFw6?yn zJlvqrU+KdC6N<9?luKt}Y<0<;0PNV4#AJPi&Kr)wbHVNU$NFz$&q9Z=S|&7vP!YpQ z+;WXhEzY2iI-yT5lc%HfqQDPbWIw$Vhhfn}E5}EaW?~O3=0DLn^NlD?fue^2W^bey zN6#|d6!flWS#@FTmN zB5yh9TNW7BH^ir{^P_!%ja9S{HEf3DyvKE~RJF*br$2jK7{8c-Hzp~sYEM7pvO|6Q zPV)mBy1Of}AJn~@PB~$sA40t3<;ayZ9=-eb*pnzSwK6$V`3-LB13Q`}PRqFlz0b;x zqPBoO?S5_-efWYtF#2%bB@IHc-Y7520XPq{e;HJXYx*l zVODn}(h|-73T*DD|4Qu@W0t1c_nRWh(t1gNShz{K`b6vs$w>K6A@P4FYG-Hux5~xD zKjZsN{}U3+)juOi8B9k4H346pkAHVA2>;I#r^yX{c{{uN;b6;g#rK(O*ejdIM8Qv% z$?+XB0XZQJzuvCxBL-ez?`SLIY-_88(03Nq;jks}Jb}x~j~rUxMEi*5e?`Qg-`dKc&|i_?5i!EStzsUb4p5HH zwR6Q_ThPuO*8>(;*Ijh8i#8owE}`fxUk%}SHL+WP(ED8L0R{zNfL)$X7yf}zfhOv@ z`bnRH93Qkwv5t(RYuX_%G9n=mR{qkd;0#@Oh;YlDJ+aD9R+gut zIRFU=hqI3BcZNJpicNqSObV~%XN;N0feXB?34az*qki%D7??8$lLH!~P+9%K+;9Am zo-q*e412v!B7od&gp0`SzD_S}^5QA(lpP;aT6e+p_G)w5phOB6QWskk0e;Tm);L5U zSU5lyL5(CcB?KvCWrf@^?2Ruz&7i(Y)Gbn^q_vponyZQLn0z?-T57TZ$%2{{b#>q= z4r_0&FboCfB8G^wS4P>P2s=H%-#|^X{K+{!Pg1LW@mmKR_&`AEP$puICCxeW2P{uZ zj(5ouvZ#9*Xb5j>i!&RB2rp5zKRbPc}&JC-?#hs=&TkP*QR0Lu2 z_m}E-wUu5u2!)|kxhQ(%Sc_%2OJv)VGq23P`|fGo_HZv>Wd6|oic|==aAp{(zYXId zYB7z1OttjKUUSU`Yrhg2zVf7KCZp2E@QT!c5q_ka6u4xj&y;8Eg-#D}O%*swqIVXV zMAx2qId*Ti<{SJFio2`vROd!b=0_f-Kt6P7T(qXK!`)3opzqmw{Cy>_Q#lr^VS_e~ zQ)f-Oprb`(7C$~h;JA-6sE*uRZR1uD)TBYM`sIFHS^Prfv&io^Zwe+ZauP8`1&H!r z(iOKnj9Pzojkm-EOH{X5DlO;w+@o?h&awt|I;JT`}|-M}!c zuq~UNe<4xJwpIZMz^MPmJ)FOJ1ubm>w~JtusU#>2A~-CjGPJJCciSCMjT&-`uvkFp z&%+kCz?X_m?OA&NRJy1Yb!T`My~RqDx%p9Si88KB!z=5D`2m@kfY;S`=L%lig&`^+ zaR;FUv~0iNvxw(uKTo#;I#{APDT38RE!nZx))(bsqPa(DtWg#6fG`?tjB>XCSxV=O zn=K!hWRe;I=`7^LRB-Gs1Q4hZKPmGz07rew6rUdRI6lqA+a^awR9$8E+ z7H)yS6Lg6;;M8o2G=tXyO$0|T){$;J*s#f5i^{&gks@3L{Rqtg(d4|1MF)p!ru`e| zRCJ?Cy+S!xPoOa4Rn0$C+lOW@Wya+Z>QS zI7q-OzG=4d=vG&=x6n^nyjG=ZWlI#f|M%0k^F%Lyyg2+U^KA~|8 zpGy-#W#_bG{CJG6T5xtNz{Z|z;5&t*k6ssnF)TkNqM~EAAt_!@D4fL>r*nyZ5s>`e zELRdHp{9si6WMjA!gGjt(VZZj^(-%&_rXT7hgUjTUw1qa{sp7OiW{t~}%au4(P zGRQpPtfdK8_s-fEOr<*LARiEyA|QOeO`MTj7jG{|THd~&W_pFbu|2}rACA)FCV7a* z2F=Piam#5>Qle?0q?$#2a;k=k^hobvK9nYR$)UwOMVXacX6G@t8&i;C%Wd6YOIgX| zxVLD0Y*XwwjDmcU=bEsL#-FPEv#5*@tr-dqdF8&lru*(|&+l{fe15QE2(skh7)~vt zqx&@+=1)rNUgp<+)W99ej5gcM8me7V8#YNxqAd`sU`QTP$-2Z3t2sFh+Gm``M!U%Y zg0$&`cyp@P59%>QcZ{j7HghLaVgNNqAt1>?g`!FlgLGxREG>GckQnA}<}cDNNN>{s zZ?oQ$`RiwlYPmVkLhiJ@1eB{GD`%-&qM}(4?+{!4FYIx9xiZO;s>4S?5(sW9iRw6# zm#^VtIFSXsB!_5VW=rBr^*2b;7y@Xu_`S?rZUpR%!4mm!udJS&w1z5vT_0usHS45W z+$E>M*h8Y++nhv>kQX5DABLWZbSwvSLVZvhUUAXIK$Pg zGbCa=bGxe~oPx1p)a7~+W@NN?cx9q5cY<0Ws6^L`+oaMKI*lb1@g(B1VwLzQpF2UX zk1j0@+)dTMy_2%(2z#O=3UJY_TV?-r;{M`N$m4S)BgV^Z81_p{TSO95cSW2Qwy$vC zq?68#;2iqAi`&pCTkQJ$5RpYZICiJooKA&YH0Isp;5fGqAB4uqL*_gR-#-q8L!9C0 zbg`d{zbwv5YKektI|CJ6XbrLQmOE6o?9Qx@!QXiNDfer&ZlAen#f2tJJfxp^!vCP2awTI3N)F;P z9goTsi|K~!x^Z#8Qm@te(BlMq%1WE(0%jj<>f?bRMzvThtL@lQ` zoWO6Yt{{)7JSqdsUcUi>4*4-*F=Jh%x&nsmJ$5nQ-_4!h&(5yrruKj`xi1YobVG2X zWSv<34RQyrc|Oj9o&UIRGvc+tOE7FB7(d7ODV*R9#kR+OPJs)I=12>qy~#=LKx$ob zLSeqKqI|`3CDMunziq=`k75fDnp8G3`Cx~}1nlwp-I9LM9di9chAjUg!wn3`o1ZDH zgoZ3S9VOvM1>sLml<4BmPiI?@|AU4~Ha;{rbXY7t{3-$l z)`IDpflo5M;}!)(K}d#aR0Lnz$Wy5Ygygu5^O9ZaepmxBQPv~}B}pc7PB3y06E^drflKOqx3R^;)DV8ZXuu<*tHcU3q)Hb6G5we<;sp!h1jutbM;8++SlH;f* zI~Ak#=W78#2HiqKV$;sQ(dXGeR|XIvjV77JlQI;B+34v+i{kU^ zR!S|*dY_ET+qj1kZRU^7^|TcaRxeN@_~@a%=YI`UfpFLJQ|c%h$kt1V)K&h}RoRzl z;z=Vaw(7K&9#gNdw^a>{m&G}{vHCpB6IU8t5A;N<;3)rN1JVY`TB*1ww> zot81&@&!#DB|`H=y{7Q{Ha=-g&dy@apt(Dp52;AhMqU^oPqTqjrU=zleNZ0iQSF4Nd6Y&f`fb9PMG6Q~ z9(QPk7b@%T1nqxNTQQ6%aW7w}26Bd~6h62WE&fS4gBM`1tG5i&jDj>xW^MR%UXwr> ziT8re?e<6Tw-*yKSguXbAE6{54Rrgu@L|L1LCef^Ip&HY4hm%iAotdN3tK;FVOlZf zj%euX+aRrE4*W{9cHAwY@+tE=m|`VH{v(|jbq?YRiNus1Yw$0&J=$v1eXZvw#ol_@e&8k{-BG7Gv404hD)@ z;Rwl?Qeb0U5;1>Ru)bXoS`r|Yat?_RN6!$95!CU9;TgF04oUXjEBU_uBk9WSEomH* zAS)U6FxzQ85u=8!B<~6pS;i|TXKaYE@@HR+Y%7CLY5}Csp>^9DpXtAVwam&(&(n%+ zr+wBT7a>2T_>sseM(!di$sIO)5XvC3QCtAyW4nYLMtsg;epx3ZJuESow8hm`xqj0+RIhSF~0s zPBU{}7`z_}-N-ctFA5Z0$5PmdKI*c^648lEUPWn+tvO1J6M+TtEZs@}?)mgE^mde@ zuZ=OvS)!?AaY_6kNPfBNIxrc1i+cF(Fx0jQ!jWjzU}QJ2ME58tMdMcLK^@EPQNsD^ zbf`v|LS~bo?B!NziLK|`ROTN+Yh0EQnm{Yrsgzwrr0On7@{FTzK#q)W;lQo_O?+}g z1&ef)&Gu4BPdnw70KT?Fp%xhvCCQRVP7|}Lxgy1(7BC>B>An-dk8LnKRFi4X_Lx=6 z2WV0heRR=BcTjg7P9>p|JaMg#D;kM}LWC{*@98*}HwIj(u7mx#NM2Yl8(PU)5oT@g zpb>j_W#HpmA-lM2vwaiGUj6wdj8Uqk|B_}`y^=DUShM1Np=Gv2kq-uT!o>XR^{{N? zFC?-3Nc&n=62Ucd3A{NuZl*DaH4ybO)T8w)3eVB!-8pA=4uKHTBpo%UDgXp5Wl9c)ZKH zB=ATo;x;38uFG1##Uy}~C&zFq+w27Jq?ZNAuarVMX_CnG7>WDPVv;y*sQTS;%DYO{ zindIg8YP00`I0Ozv=I|arg=(dY)UF4ZGket3yTJck0z_eQN?GYcY>$L#U^B#Du(;L z!wz<|Q=_LRY=XQj&48`BvT&{8F`MsUHYi~ccQ=*aR|kE}N~$6N2a*>h5cYL^_%bPc zoxwUzLN4KE+sU(Vj>3q4`d^om%#KfpXRJ0HB;seB9cs;+j{;>Nk0&43QLmeqL}=e0AW{87zgu2ml;*1-~*KfL`B1Sh4oVEXN4k-WeN`%aUR;LDk^^{ zn_)!4Ug|FTEL_pw+JVQ7*U~#m21gB?W#TuWvy&UDWizCE)AgQa5N?2-$?Lr$ofKkm zQk_l{yb?3uXJxcD6q&u{-#dQC@&JC13?Ut(01=JxLO*)<5|t{_LX6_Exnabu=wZ&0 z@^3zGW>=qNAfdynu5x+EB(~}(m7+>Zj#XG8F55UK>F!lqB0d~IxiX14poDMM>hD$X z#5#rlkt&!&7p90#$1&qyqwW4>EQmc8Rj=0U!?WN=O{}iYWnP@i?ANnE^yNlWs#@Re)7dP)ZmU{@Uxw{S!w59HG9)S+TBw`NRnLNtE2u) z%(hpeBh%>E<&r_0z<`gTKFPa34_Pp)#<7z%Ob^d(828C zS)_TnF7xpXyt6m+c&IQ%LUJM20P4ORVU6!c_ zTQj9?jJF6yZ0?@m{j|b5nWs0AdLzt+n5kKlL*#v1*OVMavH+M6=(4dj8F!@q=CQ{x zeHU3CxnPipOXT1DUg*H{f%CY81=K-s_K%H?dX>-^PEy@;Ae~!x0b>}a+8XyYL8t7w zMNpHC^_?Bpcp!6{5_O(Hpum=jI35%qP>}h!?qZ=U8&-}h*oN}sfttoiILx7~@B#Z? zR9TiS%bS`z>O$^7YVB_;c6K(ADaBmG9TMo=8C+*>fOBH%4<@+aIKc;6q#1Q0$b-QV zcUi-Hjr!9`kLytj$cwz$MkT<6qyY!$|6=T&qD76O<;-o{#@V)Q+qP|+XWO=I+qP}n zHgb|qcW(OLjFGp0tk?fx%{8mODs=Z$lh|08R-eTuQxG$pv&oXHF2*FZ`$x zhW-C)BL2S$V`pSx|4(*Ws`me0Q+fejh4_r7@BaVPls?gp4cMxgBx+1qKYZrz#40vd zUcHC}LhH3olB5X7hlUn$fAjVW-~WGj+B>%H8>rr|X7}&A(Z~7!jG5p~IS2WFVFwA7<9617d*LC*a(8Uy3 zBOea;pxjTRYG)-^mLq2!EiuV=J0f$>tysYWWFbm5>X1)X5JEu-Z*IJg7v(}4w6fei zR}H@06?F&r_8r>Pw*{&zSH_#d2xGmAOD z03t#^^2MmYbJJOcm;Qv$jO|*!=-v6P8xbE=Avr09K^n+XuODU5w#Z$oF$&+rFApA# z1cE>)Tpi^8KjF0Qr=J49k#InRHaRi?fvV<2!#1q6ITf0)^H>i}&u1WJxCp02cI5C0 zW&~$|Rj;~oF08lc;MdFUDzD!!5E9KwMjqRs)fe65pD^Uf%Yn?;&_lpi-2u(V^a#eaW{N23YIbX$?% zs=%0)*;Vbn#Izsgc7Gk?Z@)-qx9S)Z+vJ+A1*{l%pLHMnb`>T2XcoN*BIdx!-5waB zK|H#_%#BoU5HbeVw)Q_Xt*Jo7*k&5>?gmnoi=y)MqjUZuZnPNmq7jS0ELd-=xQSoOiD! zxaBi`ia2By*em-4y+4^|`k+(8tsbYKzrQ=eXI1n2p{djXg6R@gy<8MM>SGGoxk{Gi1(v%uMdF`ka zkh_LNo5($C7B?hMBC^606jU+lUT9*wc2K3-U>{(4HOx?GHJ-cJuDj9MXqNH`yomjx zkm?R5b$G7$X^lfGTNnxAan0M_XkM>xfEHI!khpw}8D7EEt;6CAT)MjWk@cQXeGhN$ z(NI(nQ|gqH`W{a)82+Ui0E+VdrAW0UT8puEiEG4;%8y`?@akfwg${ah1WH}P(n|G{ zjlvYHo&t=Othpm8S7!4b?FPE!NFEo3a?P$A?aXrV@RaNBo<%R2<l^H9odE9t8aF#iNZlOR|ge}B+ruD}?uzfPr(x|gn*UQO*y=gXaBTi|g#pA) zHi37T#}a(0h1u@Z2L@U>;Jrq|<+kzB@ylNcCsO8LB&bDuU!8bS$n3uuho#0$ptGUV zh0Y88`&+Z)WCnzS#WN(eE8mN*jNAv#tJQmo1n$T~DROs9zE}Frqt$13@*0gAtCP=z ziUH;u-A*$6+)dYX>e0B=4J|%LV#UL2eVXw}WRpmH6<{HXIUmJ02ll~4B={n5!mfXM zVV6x4`YBd?0aQ`~(5-WtQD`H2nW)*7*zuk1*0MLcQ(+<;vN4?c^>@OYs*#OiyjB6Nt|?O0Qj8 z<*R}fhr8j`bNExro`@7r(;X(DLyl{M#+^}X3z`?=cZlAdYTB>9JuYysaXOe*{Pu!2 ztXA+N_Ka3rio||L@Wc*o0_oZ0D)wPn4DmP_!FvrFqbAPjksgHVFQq3hkd`?%SOJA6 zpCu6u)%UcE%i`{;Gk=RGgiJ+xp>qBu!#eI#4W`XUEaBkaN=d31FAYO!F3*_fNT+3> zGcKC(f}uP>-YerMn!*T2m)oD8Z=Rr%wYLk~Bk~n8C88Sw#pcHC0n)1ZYoKnLMu`^= zQs2XsZRq1@ncvU~r0k1pr`-5jS&pNhDKwy@lAj70^GeCZedLH%n59y6w%3ttO1B;e z`bC+LHt>2k=G%%8g$rhQ2wAHVD>FQtBI(b1<+{90E>Q=NM75El%tHuxGR?m`=H$P? z_%5L#{&oxj;6FJ73o-6QI(E-x5r0r{I9IUDNiTxs9rAcJT)x2SdT*9i$?6XX4_OkD zkR5!`>$q}RYGa@9LNYo4Qazo)Af&eIO2l4;kHw*amHkU65Lbh=T#k;&8nkTR)R>(- ziXD?qQYppsr0u<*8gq87tX=hgBMzCrgTZDamvTx6D{){Oz;S~!%IJSX zufh6aWx)$3c-0-I!YAp`=W7r$T5$vdQ_v$gDOntQ{CH2lAgTqx!R z7f^Ig&fmOYMyed^d>Yn%+6OTnPv7BrPm&ExJsRB(>zp8f>*)U7h>xEMy(K_j+7sKW zT-|T=3r*>l7F>!f^PXpx6%2vop}Z<@66*&{T0|^ah{OVJD9ovSxiSkBb~bUO6SX#QHW4;4vNJZJlQyw6b2cYnVPyZ`HnG<_T6WlC4ZeK6h5)@+ z9DPqu-;Q+_i+pdcC`=C@%M7R9sey$}_y;)^KK? z6&012E6d9pV}fWKXM!5O8G@lfa$4%B_vcWj)Vx0X$b3SGuzW`GKsPMq@{;)hp~b&O6b0W$y zsnFRtx)FRt$k;9Pn69T#M%=j%!43)0@))zaI@Ho()!E#&ji=A@&4gk*}+rtDvpUs(XAp>&PQELN1h#CnS6YP`&X!k)H zoi&pIYVX6+(_@g>g|l_s#Vi3y^1AExPeVGhVr1u$*p8fmRIb~L+~x4S1HJ8EW2D6) z=|W+N4CgR#&Id^!{^6Vrp*37`=L#Vp?X$W&AZE}7bC!kr=emLV8lY+sPe}vXLh&ya zKz9fB98o7Pe;~O_Swi$VjF!YQjNS+6y&J}WC(-F+(Na~OfN)OU)0-8Q_q(B&z(^rd2iM6%AIXKF1%xdj=|0%@6v3n?q0FontrQUtvx%Bih0* z7VNi2br;hBc4*xX1iKa-t#rV`jXf5R22%v2 zF%+n$+y_D~?h;H0m8EJfvIlBRfI)oMs*l$vafTZV%FvWHLFqa8Ip-AB4l15_REsB1 z5_}IxI5!dJIe|{)0Xs`NDslBL3=*nw2SiT!$SeviR~XDe$6_H;4hA=f{I-}-FbKwr z2taberAg6Bpp|r>9$45%e3dQ;S7Z$R4JZQz_Ed^=4B3W^jpWIYum#dlFsz3RTJ$d@k{&?pAR{qph*Yo8x@5>TK~DHCClRF*>CdP^ z7C~;m4sE1$pL`r}-_Sc&F&hS8wRkuVc>{S1(Md`nb0dXbA;id9o`{8{&prVOL9|ec zP0~P;ng*WN-ff>j+#m+D8F@Srh~Nqgt${V}8Gu4oEug2}T~;CG-H}-8Fdqs1aq3G> zTnBYyI3i0-Y|JYlS{-ps01>nAkWUT}_oS>`x-1r#9PH^kYi=>8X>1`}SP>HmCWyCw zWI>K#Jj#5$v!gO~ywTAZNBl!D5`?3klDrZPg{1d`e8E@XT}j0snQ<8k1U-4B(xCU( zQ$DrY9lFemd&7Cy<^A>fK0CUN;mwOnTbHdW-xAvtzuF$&q3Y1(%L}{UkBiES%?pob zge>o^&{y);D}W+}GW*!dL+ekQUdp`j`&YP6EO*z~J=9kVOpA zw&-aC{%8+sJS^|Qk$U|>5W4pKc`IVy}9CN^loSfn5h`JHw<1Du8n845Up3rAcQmEr)357l>LQq z?WE_p4zr?AJ0k;C&yg@W?JLcWGnr~x2*)`BfI+jZTR{TGbOoFYvq9xXl5u5GpeHWc zr|B&oBj6K!EXkDeteY}+`9jv?hZLKJ&EWz7&G~Jj!-7Y}i zzK~(DDxEH{`?xssSzkq!ZoWYB^Sqfq*3Z|!8x%Yg25Y9*$co981<+Q6dC*2UEX9xU z75H^Od(T?Ez9n2hJLA21zyivgu^_Z5f9xjhAH>L|gE%(La~qOt8_Fy23XAGIZ8VIe z{vu)6)$6{mL40&oXVEayt^jW{ogZilcAeu$fM6L1l{W{s+5Wbl<(b*J#JbrXK4_?= zo9JqN^3=KTmLTlF1-YrCdNFFq8W_8f%QQX9RN3sC@Kk%9a^iT{;DNN!3avi)Bay^5AP~A zEwDQouB;qfNcJ?;u?_Y?4krMh+%Eh8G7fMIK4w9tfl5rVt(PM9nov*m<;B)%$);)h zgm8~78L9`@X3lg?_xD)Z0>I)Q1oJhHJ=>Za_WmFYB20T{uRl3hKiab!eoMK`F3n)a z>F+05V;+d4P|Y?xj!Q44+Yd#bG)&|3RbEQp3xAicf&P?fu~vSRWjp-j(e&_M;N5JAHrfS4buwL%GrR7qK(~|C zZ+<@f@OC7GL~e;Zo`p@OtV`w^C-UKR-Ai|EqSLt8QzYY^Io)a!`RwM_%Vv4Ibs;zJ z!RQa1YBqTEOTZJe%4Xy1_5O6vw#(D4;tv8XH(Qkor-G>M&tr*44w*#V%X_&g0{r+a z@>-JZ%kPhPvk^Yjw1DyG=~t&nY;+6y`C)x_@;rx=I!GbZ<-_5ePW+5I@}2CH*M!bk zJU|AV2!OP~R z%?oLw&%GbEOA!?uH|YG6izGe}9H;#@Sd)RsLOAI|msw~fT*kwbfsshQJ#G}n#Yn_( zq#J%fqfsosh%q!lm$f%X09!6+KgaZ0;~o;Uch!CoT;b3a>J6IHR!c7TMF_qm*X8+s zI_({dQbts6ilGV-o+$AuI-#%HnM{@D z`zS`NtO={nCQoPJYR8?u&HLnp8O(+$knX-2$y}lC&VJiWLR}qRUU%Q)?}~>4j(2Ft z_rpj;bjoOl;~Mcqru%fEEbFgA(Dri>JMsWpxXyE}sWpW?Ru9CeabKd>K*s2Gy&HxP zzhgsg`uWeQY?j1TDNT}GYIhlg911-y#I8~f`dyj~>T%WS1}#8q6B){;4#MEim+1mLeYaQqWTHDKLual8qDdTnT>#c10rrNQ;LWCB(E-a~7uGb`Sgo+G_>wcPV47tBi?n$8GM3#jE+QbRo~$ z48VwY$wktP-+jhB%l%jfu}fRQid?XFlDes%Bn3U7%cc{s7Ct~m8M^%Q2jgdYzvxvbb zy!8;BhL^neWU^Y7D(%*)kFNS@-x;{u)sjF?Bo~hhb)7>a7V1(4vvCZ$5mO=CxJV9a+h}hOZS?a5=t*rDn0M($^D#bHSP+YjD)2HKR;QOL2m8*;u!C2ka8T?~ zjb1#IlJ8wny=sGsp6nWvHTV;z^?`JprL_)AC#W}-!Q@d8+@Vs!++7x`#O(oNX2E1i{AN$b-Wpb@={+(z(lvAw=HOqI)gxRBeRF-J5i6d`S+Z#a)w$ zd5T9ARNi4;U=<)y?KASEm&G8R0xQ`xiQBDV4hRg5HC|ddG?ULu?IpqOE))&?8VFVF z!|8(&%#`#J+gGq)C08>c4O|ql7sC!7TUo7(mn}iCe^!Gx^Z{X~43$2Eg8p`@zaU&T zmT;GsE_H6#Q4VA9S=}<;G{z5H|QM-K7Ky=zz^EGE{=5y5^LnES6>-QC!J)JY%~hYmvCQZ za_?{2?!Z*KdIkdm(=lJsDnMLlU`YNY?qT%jn-Sm>t6BKeNts;{+41 zLYi~Z%U8N4`M+RhOee9WW=fW<&gWW89Iww;Wv6_1x~AnY+Ek~rOfK5aCqqF z^*p%hG)n87gU%uW_W$&7Z-ZM|zmP2+J}PvrP}x?9r`~JYsap(Qn{~MYUy6DBfVt_z@XqL0_@^6`0-z`+lNxVIj!HWox5fn^kdR3@H8Gi$}> z{BXJBZ1>3Yog$G@YY{uGFLX^g*=kRgB0ve$2hnYDp}rDBU*+9+l^q<86E*>ZJ>DGAu~&wx=6mw*VOlZa(wlLNs@Kk%j?GZvs5Rhn z^lXWA^i|wlyOig|ENvYhNNN*Km!cVViMFqI5xOekxw%-cszzTtSuvg~vuHcTwVnqY zAuv>g=OR2d8aXvLfE<%V^NY1#(V)}oSDnA_$v=b&G9$582LN02Gy3F&MMWK?rP{LQ z>bBsrqVS_{*;Zd!%uG-g>usqrFrct;zYw4efS3lXk%eCiygxQreEqua^aL!Bzw>pb z@{aHzL%vizO881+R=6D}4b+-z>jVi#%K@aBAl64e1N-eEezdU@*zno9>c0v4hB4JaEA)~7a+clHE`w=w*M1A`SbOB z7kZnn%Hy%zZG)DWXv^|$<)iBtNO!PD@?cGryt?+UBEL#pmS4p_2|2AwfUgFK(PSR<3C3VsdB*w;J{{r z@SCXW=T@JFQRLNBb_&}xb5&$~;O3+)o4H)K1G1C!*toCRkr013zg%J{gL^UVG6x>9%+3c4$ zUdU$nBYOp3P!L8e%4zncf5Ww5QJ!pLRJ`4($Yk1N{$o;)GcwLY)B z*X@w@oB^0!Y{eLoDt#8y2{89nFMvUZug?y+g3yi>FROFMZn&cGWyeLO!KiuS2`a_& zcr~jKS2*morcyDEsQQ9fJ@NEXGaY`-o*JX#R!t4J_98L==$Uad|9HN_YZNNH{e~9( zeI(Nod0p+4$W>c(67u@cH{YQ~N~J=9M`2P4*myc1~Nk{!;DUxLlyLG#V*frKsqUXBquxDyz%;acs&e%hd&QfEn^32IY z?W{@3pMTV{_RqBCQEnq13;TawgR-#w-zn^@Y|Q_$#%}pP1XfKO+!H474@Lqq0voeQ z+y+u_wPeYdGBl3ghQ?Ahkk8vn^{}Py4XD|Ki^M;3tBA<;%FvI$!IPGfvVrdpI={2* zym9#cw737fF?`=8X7fi7088Vyp2JqnEy(17Oj&-k{e0_4&XL94A{EW5mG6PD`o;R` z-RDH*+BclfYJH_SL*utEW-d_5ICFIi;AP#My`{z|1#_yD{AC)7m-^CP(>~?)$qt=G zJcU0$3C61|mQEv`Z;;I*mGa_mV3fepxz&C!EczGq)vKGalgc+e${z`KPPH?a2PtAUO(--1f?v<^(@u_5NCYY(7oG zag2(DBXC1v$x_P0W_gdH%+1UjvT16pA2qBFefNuk8bM>TO z6Zmm0e1Gu0)6wYT`#LHis8S%j*QG+(^M4Z7F~eDs5D#Cs#8T4rAbPf%;^!h?c$-?7 zxRuGUSnrsy9K)M}gu&XKN?)H+bL=7IWafXIA*(uINawJp;__HjsO(}?m^96|=D(gO zOkw#L;D&O)Lbk79vIB6gC` z(-%jg6JC+b>B&#(XpVX6RgP)aqu}g5#3}o6iVNC$N!!PGf>6;Kid$l`DC^-98JP#h z7C6>kOA&gJhof=uX7$LrjQkjfi-dO%;UYH9U|-)NFYR6vp`V-3r?wltq3TZ<0LQVq zzuFW21xeCh25MW%F66Ca`D2#f{^|P!QiD3DbzDf5uH$a5zL^-usTq?)$)8L8Tz!Lu zyMq@0JNZ!08F#mQY7dYT3uTcgo$gD8?F$PBaEE%-Gl49pbLNW2^GPW}%O zxKHNRY*Yc zQ$J#(D{}n%r{smTXLvX~1dg#ObN!h=a&2GnQgTXBEEi5ipLEycmMLS)VrD-Ou zZcW9{scV6eWp!UM{;b9P3viXP`Rnc%VlJ}Aan##4`P}>L73!_oo8}$=B)mCx_ zI@lCjh}zST`1FE2#zP@0&BEdpzT4TC7MDRwVvgN0j2gj0Y`_@5k|3P;uE%mDmX|Ae z0GA!VzaNi#C%0`3Y5dTo$bx377=KIbX&@aJE;xMtaKZ(=;V+MN8-1TY7SXc?k`XC* zL_L5g@XpVs?Kg;Zi;GvWj)eL;Y(U}TD3P?a@T!Vr8K?3`)-+3ML?DtK@1z%Oi)ZgO zY#H4EkD8cbr%ECS>w@o?p{Z8*%$!O~@a^jNawK!;v6Y(YT2RbVLd^DPF4N|n2N)Ng z+0UE*Ec}t1n#jPgZ#Ys&(r}Yw3NLWo+0c_P9TC>o%yoozVEfl<^ugprea9bAiTR?I zeCMb~ukONVRql*IHJRbq+sVu%#09NjRZ)YyRE-S8Rp;+`glWmp`Bm(q+>FRHbs2L} z-6$ThUI8pH&8S7RwdP41z$Ubih_e?#TmjDd?{*ib;>U;X>JwTuiE}<(wX8rq4mQX8 z;Rd@Yk-H9yI9V=E{+a@7NmW%;OMK46=|!##ct%Xa zHjGsoqRz3rtyy?Mg4Ba5q7Cr!pwfcV#!X0Ip!*l-oby>Y8s{-OpO{T1RP{1|H$KOn zp9FoGX!2yyIpL+vtX_q%f`$m+*zx!p>^YuSi-w^TQ@3%Z0h}dp8IRV)wHi|Qx_=mki#s?n(fL>s60*;H zJli%^y{`3ksaE5n@bre=gmb&lIFv_CEJULEXl4^~D+j#yhmV3~t*~=rr*ZoT;fQ#C zv)1N7pkVi*znEFC)r8O~THWcAY&H)-_!k}*ao2AAtS7H~SZ!g_iotvvP&MyXbXGfL zU0`*Di8+|YL|+VK1Mc|Bv#6nvF*@E)1?V^8)(~b-JIB(rH5GW9=;E`(bVY3CN56Eg z!%pAHaDrEJ?#TefpMP!_lp_k(Y3j@ZIG(R!DJ8bLid)s!K1nuQ2yL*_9@g~s^UyPr zC5w*-r}?C1*9$s;7wo<(_?+oWawV4*;f(F+4>r&kuc(LXNQ5|W7u({ke6=R7!6L61 zUFncpwT6nwcUlE9uQWy}rsfGw=jtKx(Izp5nmBk1E18)>E(ghB^fZq!u-TXkigoD1 zZr4870un!GOn2{HSABys|?FkR*&#!aK8#l?QpBfvAbDd`>@$7)TeE$i#C3{&nL>#ECIhml{;9!6IMRo$8x`bVMx5#|Ha_S z{vY)F|FcBT#K`o&6_9mnjmHqT!*+jC9e_&`SwaT;3*y1JgWcI&^c2QIx@NXW&E)3pB!10~aCza+ec-aTv9bxghv97Sd${pS@47~B`cBO7wP6Lk! zG!+FL>N~)`Y2p#{%BbB)V3gaEyT7}>f7i=f1o`=Wei}ES6UfY2t7d9H+MlET9r%|% z=+=FDi(Q2N`*Lj`I`Mj&IOkix_-h`T6}SJoOUg7mK#S$~d;2tdzKZ_B0YTEGHz6ve zyf(tdD$bi(5K>U*eLRwM*%&w=>C-L(UuvU>zG0yk4K6R_pj&;uPdt1-b*F#vYSiBF zH62pyk=9>>jtc7)ZRISHkX*~2K9-ERAQ+NUvM#=*KXN|70xzq28hN}Q=dm7vDXOut z@Gg(p!LZoHx#XISLZ;OKIf`oI)Ig2N>WMbtxwRK?++#sBiHn&UaWOCb(Y-OD)!MZl zL&LSR#4DAP+KGzacg)!(D!~rbt4{R& z43zRM226)rmB-Y(>>icGRBBcjmaLd*5ZbgdqH=FRtWkraDUcI0inLJ>l#LW(oi?w7 zhF8mEK~P?Q2Udv<0#<|K#+m#%`r19@`UoXfKhSAFDZTa~8;(wFf47NoAVhsJ9dlnG zr=mWV-g?fXw>NK`@Ie@=xP$dAyZA_R?BiX3?`fpjg*40Yc*mc;7m*v$a9;UoKoO)r zU!TbZ*N4EsT@oRF8UIgS!Z&rDMonU1v_}pG{UkvoDI;CY2a!=6G?y-R>6Rlx07mDJt!(=eO)wn9_> zHnTD`1y)FAM?pjQbN;2tI2I*(Pt-X}Wp^CxJAAnAF?9O0KnwhqrRM10eDuh(V9-O# zE3aqc5o;pw7K)Z!#VghPR;-Ky8ah}+yOke6j~Ab|aTr{mbcf|3N&_H-5$Ya;WCX+Q zf|G`CSxuhPS?|bQ0e<|_`OugJb|3_oOvs0m2D-aVZhG_QBvdpol~=<8;0|zP1%hQLkc2@`zU=?tMesax*>Mr zwiq7(H!Nd(tZ7Kt7n4tZ0D6{Hm4Gz*jmEY;kdhLUt0e-l6ti>3=p(11P3C1A04bym z2=c1BPvofL3lp!nl|&2wHAr{pYs5y2bX3D8V@rr$(8Ma@NHelRE={nbnP3blKJpA7 zR7gS849MyBs5uSAvyWb0$Mo&I`gUP=V3JgN3WZa4`w5=Jkg~aoE)O&iQ<3gThCLo@p>Oh9ZeL z4qx>-Hy0;o9|3gA!EU!wiwT@HQt!kN^=uHzqA$OzD(BAfh|P!S5&F28)+{KQj=?#8 zUDfQ*KaefPwMy?!K317N2Awm^WWcttWtq5dhhKQtpsOu;e0jVt$C)H`Ex z&?V8r%qoFwR3IU@XDaMg0X9)r@&{tkZKb0OFp&stGbpbir|Y4FpEk^`18q(nA622p zi64d2%)-268Qb4|Ww)H>f|j^PtxNX@tWGJ7Sy6t)8A&RZ;e$De@s9fY1qJ<9vSZXP zjO-j^`RvsTis}o8IYi~VS%5UMD4wWcNk=%Q1asuOfwunT78~i z!FPHThx4B&28su0>hGgaRZ56TjJ`}ldC(rwS z&fjY1zv%PY0?2!ie9UgWS%29Us$h6GE8uwhDyT^C-G~*HJxcCkcF0kKj&Md*HVQg zQnAJ8-PDy=8~r_glu>xeD-NyyPH3*oA^yyWN%vbZa6Lo*%l>u2G}|TLnE-Y5QO^3D zqQB;69jXqW0nKtc*3kkSaTaao)HN8Sq+skny=)9KH9+TLmQvH@7z|7wc>6mCE}8wU zdr~h`6NP2K@}@a~DIfgBIZB1|#}Yt}sD4L-s_0nY6F46l6c{YKsi*nE?MT>jr2vnF z&nz#2^N zRFk^y*s$e$;lK}hbAG1jJ^5(Jwot0oi@jD#jQBwK3FQjbr6 zaNIX4G73KZgVBhiGSC5GOeFfpJvi5s8NLPFGAW4ZBHOq37AmVFXR+zeGAHmIQ;Ju1 zH=sS%1!|!=JbqKkwg5(iU`OQ>1aU0brG;zHWTJWeb5vbicL}{X)=k3OJ{Z%?LlbI> zqfAYgo~df4N?HRxv$?s8x1f5t>I_s%i?${io+)cQP6iHGae)}L4mN(RH|9>!ykpzy zEst5X5O;=iO!c&hC4m@A240L}0NqDHmQy@%y!a zS8)6K8NWHrLm~x!^u=g4MO(Ga*+l)0mcdg4aL~+5u1#tj%evucqG8EDD%!&Ln}~HG zpl;<(wu8-xpM5a%{7i9Eu9a^nbNJu@!U@AyU{MV)zJNMlWhirL(uhioD(Gzv_)?=o zwO8I5+>DFM3x`x)H=moJPiOCAb@&GFwF* z9)zSqAIkE>D7!^>7+_k!0%2BE1C0zVToia!?1!86M`!h?D~NPXi%kvi*)U;bme@L~ zZ)!ke5mFt%esx1~Zq@^F8g3FayZasHOhr3=C zDC~e=7q0bkg;?YYo1OuO!E-VMc0wb?D{T=i#3` zX?8V`PsF%)RBrdex2P(F$GZ{vZ)-#Wd+Tm_=4B#Szl4SAqdXhCs*bkRB8#wnol(JF z(;)a2NCLN$Lewc*KiHGjkOKXn1)$r11gm8h?XtwJ7Z3`N#xnE_`|obwvRihV_5_DD zClbNuKT^PLb)JT`oSq0`ztN3Iuvy|-UL|vOLGev;G~9WX*rkMR0zYC^42!eGT#w&E zf0L14DDWX+AAv001NAkky0e|_Q&n~qTa5zES0PX~2}B-ff%Dn}evVIO|9uy(7_ofb zI)}AVzOn@2%VUbhyxwS&EBCJ-sV23$VhE3+mA3kIvC(wR@suv6@9=&BsgX=Nruior z#H?K`aps4*a?qsVtOH}v1rqwfH}XO^XbDl&$Q*aqn(_eRb<#h00=l*O#c3M~2Osx% zx$oYsx+?tAYrY$g+hP=i>VWw|o}KE_ptvN5mulK+)ar0Z8RdU%#2=u~EIN|M6X*+r zjCiOo()pqt|ARKy*a8v)U_x{|cU);Qjm8Rv+FDLwv))m3x=`Vo%+z5mg7$M!+;dpZ z42TZzo_?n|kMl3Feo{qCeVG2jZbYPJw?5^zfL?Cv%`FZ6s)yrB>V3+*s2jfV$9s>; ze&)4L4K5X#JX5dm2A7T%HoXc4xD_yrVPajpHYo;u9`%c}f;e(ErCF#P{0IGNbTHrSq5 zwKw=7RFd@se{>G&I-R^$n^V=NxTtI0j?itXUtbah{32>E#&MXr1CbqR>&OD~hy7IU zFWx?aFFuSYoT)3(%aGUIuVB5eQ@zgH+?^1n}8<8v5bgpIZ_g@Y zg}2>aSkIi%@rtL<-ND^Zy;tRtcJH4T=+AetJlI2K3&}4a%O-t@ckf`iI<-8Hrjb}R zN9IHk0da~$#%}k4?msycllUZ&olD|5c78>Mr3zER6WDNzWim*~h@s%)R0_sl0Vtw$ zz@#9sg)13QggO>Q+#Q%}zww@43^NY#^pd@D=w@Ptp&B2}ee~rHFG|1la9UK_0H!%P zjpL6D9txWLkbO4&vkmdL)ioauH%%DP=}b-&7v$&2H)|`G>$mMEQ;_s(z_`HhT(u>J z^=%3@`hTZPM`4sVEZ26_2UEm87t2Hz7685S{Hx(oTiG*nnJuN4vmh+c>oh(u&RDi1 zW-rT%X!%f|l>T4={RubrtU^j{n+Zxotwo|PNEtP;c{c^Avj!`nMgxuLBkG!%Da_JN zXzv<*CM>iNuppJOr<)yO3+C=ZWH7OiKX+vnHxnK@9VZpJ&$gLS3sXaoOY|OiD)eVI z>a5EOs%4gKCFL_{;2kdKb~6!jRy!+GHjsCYX@gw9&kBbjxx%OWLGi`;NC%#0VCb{4 z{A#fIX3~&7ltPu2kpOGO_)Xy&M%7SS&RNJvOSSl23``KzBqj!CrJfB)UMf_fElg%D zjK5=7Keuo;1uq^OhjV=fDNMk_B=Yb9>T-)GuUjX@mkq!8nBk9K+oi49Pw50l8oSEu z_pl??N!#>PcV(QVNo^m^dzw@X<|A=zQi=Yc)QL=F*&0L$wbU^J>;ilz{CfuDXrFy#7rVUC_Inohw#*MPbIq_Yr%h$Vn;H$DJgc`^D427mVfd zzdybZzfkiLV0gO`C8j}hLXw#ESgJcnKYS) zmR7rHwy$E(t-zqQ!XZc;hLyY+f?bqFM5bo028CH5l`L*HT=5HZF+$(pH_NM8Sj4z~ zoH6@CR?K*18$A!PKGJ=8TDb*DS6W86u*oKZ`Fz4_zZ9g1P4!S9yU984Jw-f7VHaal z%Fy{Z@;u0FfhaA+?4VJ4gIlj7!XPO&^)D(d?nxHb^%d{1Rs>)m$kEcg(!q_}ZF%f0T<|bTx)!T|G)eNg+2SvALq3td}E7kBe$UTp5Iih6FL4 z`#nf;uS!@kT6`oCmJyTzSN|UI2ZpP{Le$395~Sjeo{&b-Ch0Dr9imKBkQ&^deQ&nE z?Fg8CN(6dK*-2i4<^Y==yL4)JD#UGcBG7+`k?1PYOdzN$!s42X1Zkwzw1`hGbbb*T z?BfXTGtvr6Lv0GBvm%Hh`5(o(tLGJ#oom$1$;vsx-htm_<{yR}Gu-w{k|@JaWGpB+ zb_O$|0aILE?*fT!@Arow*vJ9S9j=`0wY%mvAj?x3brKf{2CKl9D0H#RFLXP`l{qae za37b8m4Ty`#uL1WCnCV`9BvxwL`Z?h!Hjz}pljSur0jPsRLxmse1%IJI!>T2sc5RFb{l1AMt0HN znwdpr5Bxvp2gR}hlLz9+5DT%#B+i$I)@~t>3@tmVhcWAX@1;d&) zP(@mb=X6%%jywi26Z}nn^-+I(=2o9}xbb2|BV)103$?K9egnerrK%l0M zlSR0huHVw)u96ehCAJ)%#0hRZ77*u^6OncrB1T;n9rqVjOKl;8;K1r`$c*IlRS{rJ zQ?R@7v=d456h>;7@M`6Q&poWLXzJ%3K$a0vV%TLE)eXOHLRpEL-rl#axN)0eR)y}k zeH&I@X3rIEA6FI2t=#O_{?EO8unR~4k=Q!VeUsg45#;+0POlOFQUhLYpd~5D%b7>m z!B?3%@0_J6^FutjCl%*G8BnJz&+%In+?j_ml>5!cxNrvwmYI?0zS5?$c~d@fF|UGo z)-dzTNKWwxU3T{D*RkLstIQuj4z~? zt4HI6zj5op#RSy*%+l|9=wc|7DPd;r|QLT($pSRK*u? zNw}w$KoL5y4A_`$;tr_h($EZ9Q~LVRt1vHxa_g1nvnT?LW#we6c_b1%yyW)&Db5a_^0|(`bBT`V{S-$KvM5z>`_z;;=*17(WXX)XH)exEX(W zxwj4`%~O)ziG3yo-*EIgXKh(c1C&A&RGg4u&SXPP3GYt54lsi{TCqDB9$gFl`fUNZXuMG?(r(-)!ek|j zO!Hj#y3EnU?)A7&? z{YV&hIrJoQ7B9W|9oz1Fo?5!7prO&55%M@0=0fpT-{9)1*)k4t~QOn$Z zAaZ0U^9>*}$P(k-2qS47>%=aztY3UR*Af z9>_`9rrrqX1l?_Tzyh(5vvY%*dby;ks;tZX0Hm1}v&OUdq51+@TtmaHZ8wXLwrYPN z1Yun8U~_0kb&5TW3}5tR38^q&09jcz1X}_)**} z0wHoH7neJ@itA>y9V=Te>F*E}tAI{>U)d}1|FR(YQeQRzhI=J|amtue+WlzX9C+T3 zA{ji;CFByTkw=Dz^_Orw{jFQ-h+bwXQ*aJ}XB+KRL)^H~gQAUyqX*Uko?R^joWGHp z%D$^xHOR}e9{QUiU-5M!j2$Gb=t;LoVy>c^ts`qUF%z%91#sB3Rv3-pqR~I>zK_Zi zOFI&|*S5#bKcUWDjaw99iAk+{K@NtQ2p-<-3c~})BiKI{?3_a&uXX(}s(XjsgDj*I z-%d21eu2yrCx!yRx>@P4Uwq`Hq$ZU#FOhRPB6~TfAn0Er{Rw#`Nx9@l@_ig*5znDo zO7zZKd9~?Pc^XjcDR)x}CbMs?o^8A}Xzb%BDx!_qA0YV>X$-bRT1J^ARd4E;NulW zkmOs3bR^c-289OB<1UPf^#^$P)yKn|5HDaA{u%N1s6Nx_vErovq-Y%YP{p|dJ+(7P zcNHeeOD^S3DveVMXoCmq#6#5CO7oH9J_jRXUi3Brc?6F5*rBC}-sHJsEupRo7GppO zc#rM$@0Cqg&4bHWL`%1?rREek*&o@B*JDEC)@5osfza!@i&Bi{lXvLT8_gau>&5hH z!!f%BNylOJ^CK)ODQn&R$OeLDp;`I|cz=_R0n&*GQezw1a%Ex9L>pE}iA%lD`bG=j z`ZO9$dni6q2*xD^X(p7+e`|>XJD%9Y)#F+_&!P#W3#8CbFD6r|)J0hsGtX}CIW|+0 zA#j2O+Bk2QdN6FPSXe>E3ajR4fe;3{5upPRMX@heUvdm2&lDJVXRGj`GCj93At|R| zsone+ggJr3z8!~+B2i8yW}1N;w0_kk&yl!Ypan6?cx^ykjEvS?Av}{@ZbUxFh1`fu z8~Xt_W)1#ZYJ*R`vo@XxF>#?OE)Uw2COmc=3ZGSd=o4f?abWb5AForLNtGLVl~k*H z&n%G>s#c=6Yfcub^@XZ$_-jq*K5#W1Qs233Q*t`yC+o?Jc(hJS<}CM_{a(}`wAtYZ z9rlG`fE|v7WCk*B6pBc7@Pm`^w;Q%e`Sk$&GS4?qU9E=`?~#q7siA6pAKP|{F;MTt zel?;dXj4_7m_tx3+lRQcidJ){E0jR$n+OO`c$tob7a$FV`JUB34CfVl4eDQ-Wf-rE zQHS+&Ck0)wlUha()z==~xlm=b1H3J{w61K(j6JbKDoLCxqm%}jse%LHws@^^*J(l5i+jCnPbxyS|0yNr2WI>mO4P+_?+fsEEPrcR(UNqF#EY zUO8ZI-aLZn>WV!~10Z=?!$qM5hmR-_JEUII`-%T<*8;$aebZu+`gZeaA-6i?W1~-& zWqcZH-g|8_+`QIcFQzwI6yLspGf*-u_vV<3GGxiCW=lc4Bf#^>BV@sM(B}vW;Ha#; zo^=&k;R2*t+4DME$yFBE-)#wDr$=v13vs+FBXK$8JnhEnBF+CzBW>;6JY()0sS7a^ zofg||63HU?D}daw@d>VBiv4DOj3?*EP=Kt!-8rNCV0)G;Sf>+a@;LrD*?{w$iEh+A z((pvgwXI);i~TCo?{Dw9I1gcm7t^uJ(5hVUbEp1B%Yt=KNs4QUZ--DBJ8D$4)Aluw z110c-l-0Pz={2H_>irq3kev7iZ{WwXh1UE>l!dxiGbFDk4tthO!aiHXkRCdjOWF~u zYl<}gSeb2H!MGLirfu)az6Vk+ctYStKR7XKNmKl;ijp=LuU1HomG4r!<9z8{FirYh zO*x-~8%2>WzuoVx^dA`sAeNx+K|<_XQfuy>2oBjXY?pVO!RP%$T?b; zx$>-AvD=4~=>sObNy4>l(?m4JzKsCcDVt|Cc5bX6J?mZuufpmU#(S{e{k_YTa6$M; z<+9=fnXi@5e#mz0vAH>u>GJ5vmf9Io#j5k{mzXrjMUz`Cm{5x*Xg8AUQezOI|QD z=l{%Z|J#wMeQZVCd8K>;GId9$1OnFrkpOZ|d%23FvzERn{Wo{k>+6wG5Q@IO(g896 z|J!I1g){S<6~{Al8-&sROAba2ZiSPzW&b<9`!?M7v#8_ejqm&BfdgU|%gxwrHzXP@ z9u9-J`r`B29`6Osw)cNi#tKT(oCjKTl;3cYpsb9}Fvq4Z z^5xK8^u>J~=IBxWmfa5ZJGtC8!xtw!dUx1m{}`)3$qI`BrpN=20|ss7Ke|A$ zzxqDI3pI2M3o=?IJNp_EN&NNseH)|}3t8J^nzZqj85$L5jv%MgW54Rvxg+9zSN19l zz5o0gK*=66^xGIhbNKUU7sM7ClN31ni~Ga*KlKJSJyRBxCxRqdBx;Wx_rWEvorzEzd6vLD2)z+Ce@^9dOR`Q9~WsN zX)2Zii(nJi3WPlYJSwGJWE4QK!}+{vd)j`m^73t_nkinL50mmm-J6ENtm!0<2mR`% zx{e~YcXzL;zLw9r&#HOc3SRB*bvA}xK!d#E6~-VF3%A&hmDd|QpB%ft&#*NFkO&7y z)_YwQhrB)X;mWRcIQzG8*rUTue7v}kgOF>2H71eeP+5Vq03e@8B>@;&7e+w5vT$CJ)x5Q-PDI{gp4n^ni9QCynGVC|BCZ`|Oq_#y2#eMeWpGxnlIvsXvCyQeMDH3?+9X9;zKcbXA+96PKqoq z&F6|EQJc3XMzje8C59@HWw4z}0T3rKl;6?&%Pfb~D11RrjDtF&DULV$27Dn50+N|6#IyFy7Lxy0Q5w=cD*#8^E&9Wu$GmphYCsY9DaoQI}jUh zoC_&Fx+`l@@Zk{xOeg!~4t}HMCuY4B+u+ve9CSuWbc()k$-Q+jSmfqBX88xnyJ?`R z_~-d0MdNg|Y*Bx@olFyUQX~LjnMK|&s3?K+F5I-vv z+@C-u4@E0kb4qx#16{So@C#S=Sq)BGQ^=RCO%)6xpsXrX@1GrJj0PH zl;Ix0UE4FU{&=pPLMUQiL9wMY?UUVTxmcZAjGZ~dbs?WJxU6}J%>;VgGP5FEv0l8T z$I%ituGFo^{ydg_jp8cNj0!bZWFYmyg*%!SXVAYPya<&h25rqlehGTSa{F!D!5fuurE1Dhood>I8> zQ;28XHgaQS&D;o|^1aH(Sly#riIq;-`r~=yg%qL9`z0xWw$)*UaN2saS~@wAS_%2# zMbW~)!<0asaTi$b5t9zR5|4mKin$n4UQL1bhE}}g$I=fw%>cq?08_a@4l~9EUfhbTEX<@R%Cz`5j%RafbClY1xB#gT- zA#rdZTCn6VP7BN1U4wL4FpqxemfMs0K2Y{FgIk?5N(Wt?ktFnte@%H0A*l|mtChuF zm|i#F9|nfFo58@;za<|O@fSv7r}j-(5&X_MS)H`cJxH)rr_!DFK}`WH!tE`-Ae5$1 z64Y^k(V|ci_TyhQ$T;y2>GPLoh;N&GLx2VTV}QJg_0mA7K)#G)UyJ6st67;pt&6J+ zz+cpy0jGgVd|Z{4t2eA&Q#rblyg6jCk+z!8t~2^;fU_AV(e;DSj&du_5h2C={e60b ziKN?k{hf?@oJPly45e-M3EP;13VE@MBeC6AwjYLxBjFk!{I z<5A}c>T0C#4p5j#ztHAL^!4=*GCx?`4j{N_WjfQo>RQKVgdqRD^pB-==v0fyXY>qX z+9@F>8O4{0Z}BO}XC|nsCz^%0PS&8rDEni{^jb}d_qL(G#2*#2I^3nhPXQpwt6YeL zIL8AEkf^_j;I*OHjy}8QY;3)oRsb5E>i#C9_TAR56xR%%5JsY9cK!sBk_5dOq<4N$@6<$DcR_NbMXFALgA6Dsq(?xi&4m`gEOniICBc)28 zf;8~+V+(8eq&=SUOEA~XuQ;tWvk3~qO86$0PDCIgEPU>}&&sNE;ifVo#zRv_uA9{q zwCwWV*70;mdHlwM!z0M9N=mHw#Ld-GdYWF}AmKgN9BNP5?mO!(YXb9T9#@IiJok^P z>wqtuImRK6I!dTy*_}=Jb4lw&UdxxM_$q(2}p^ z5a0vzl|SJ}t@lzSI?2ex&hGfZf{6lskC$lYM)3E|$iP-ciw9gCiczu(*7XHvv1 z^|Qb7an`d8Q40G?h3lw%Jmp^y{zNpCot2QG?ZKBvHA1-7UC4&V(tp)E*or_zIp&sw zZ$9FnxI7drs-3G z*Yy1or5RD`N$D7Iag0%M9;Na|I?P15uz$6*5c)pgWv0CM-T_+RjdDHIzzgIfT2LWlr@03Ufbt^Iv z0`EbiFz&jaTEghY_+#RxACwUV2X0(_adnt{FC}mFw7qe|;{D@nzcYcCBi+#WHRLZt zQ%+^4F@b_p-$|L?hRem#NZ5U{Ug^5T#v8p%|53|J(q7Hyg9jhhbsW9@q!aRTx$U%; zGImmiU555BNhqy>Ysq`%U-|gDUDPc52pG2vK)>j?*H&0;$Q;@b20o?t(Zb1IUF;PlP=<=9kVaP!w zM4l@CAw?yVyq1WkBY2g(&_(u$8drvR?$zP0>5C>!h5<>j8!7hh0iJ;t8B$&?ab5%_ zon61XN1Mk_dWFdTF1}x0^Mi~%E=kt#NSX|t?0kQAJJ?BW-upM%!rwlht6T+-Uza}< z+|1u~x$!1E-oGXbk5kdgci(-B{AGDu%=RjMb zSeVU*yh$@y>7a$AGFmbJBKuVxFpBnNkei&C3I510eGW8_NJ5bfae_L8!V3yD!E_-eWo6V`e%NHJ z=yeMr0K;}?^hZDrIulI_=-j@$=oiTy|04rme|r3|n61pj@E$uSz5x0iy*=a1=qkUo z*P~N|iQ&oXXIQqp*Ly$1H&XPo!d6;VHLj5~>=;KV$`>B*CYe2$eZ|x4u2|kdmuE6KE=w?k&E3QgqM{++HYQxnL9}4DnyVL&Fa}#(_`fej91hi2-s1ftSb-N#mbA1>% zDUORIHk}+KuebEb+s7=_O`H~djXE~#+Yk>zFlt>YfmeG)au}BGSN!Zk(ZF?wWaC!6 zP~auzCm$ERi+6JCd;rr*Mgtg4ojyRx&^mQfbspa`?U^6H{9w+cyr&c7w4MHgbUZtv zQg|~0)r_Bnj*>JCMVK^d6rw=@(miTH{dI$+{m15sGhLGPhNO*pthQRO`eEmfFDzn@ zW=W4u7N_dCi68c1TdgtH-+uo;#ZfDav`^9#5J=0Xmcg2Pt4Oredy!!%TffJ}?um<; zadmthe5Wq#GpbYmCMVV4Us%BIK0C;=FX6S;h295Gav$!dATo5csN8PfaO17*l$CUQQ1=$LlL?|^6IOHU3}1%;T^HDNB+6DurM);WiUhJ zhy#6(9I|lsd@?Y$MZF-+6tJ8B0KPY0iJ(gdHO`_ob`&#?`6SNK zoZ09;(3!TXm=Vkel;nr?975`S5suT}SHC36g+@}5E@4+%8@GY5-3rq62xn@=nKpDW zK=<9$nX$@OisUrQIt1X+eN$^(Y+!mPT|(a**^^4>Sp5?SAX8QeI>Njpj~h5rn!GM_Fz?z?H1o z5$TOcW*PUakm%p<=-?~yL%d-Ko7~B~-oZHbrn5qcf3rjoZD*6vBE?(1Xq$||s)pr5 z>&;07G3C2hU7g1clfZJ|9>(WE7{phM(T2n6(#JL%?yb6C=$ln^ne_v|>0 z)wh6!aWKPc8YTr&;fke02(J@o&m4U2gEmtAujJeFd3!SKV_05t6&aRfm`}xgz)#7@ z^)q%cs(@P4C~e=9jnAo8n{%&R*nR*a1eX6^Y@r=la{V=3g5zQWz%203b}gDGrO`m7)qSIsVgl!XjR zTuhx$Tu^n8AveMixodaN-PEim;WR$wUxaD6c(b4r0Ap~6P{HbQ?9p#i=PblU1DptS z(wR#J9gb9~#M40y8V<~u9rL(IbYhXTEooQnnW|t=G{?+>j9Iu~p^a)nvt=t2*A)0h zoDiPpF2p!YX8*GMFkds15xdPO9X#&+D?;e5QCe)x7BegzFhSzYW*dXDl9V2@yv*Rq z{LN;N(JtMOB(ebreaAHmJlVZ{cy&wINrPJtb4&l&QAIW1Y|c5+CN`fnJH`3w8RInh zAjel5j}))OFd$QeH5kj-lhaRmxX#0!-JeomwyC_*knzdy;V0Fh!JHR?V{nGerLsX? zda_Y~q{CEm1Wijd4cla?(Ve(EUql6yinojyHbjPMcvmkGYDqstv>x~X(Nz;ON9N?> z!^)-uNj5$+^-XyE(KE6ZdW~>tg$?!11>;vk!%O#w>qfdG{`+I z(bi#hCnuQ%<+%o(G{8-1qh}qe%Rober0pb?UPAua?4F;qSzUdk!kOU~0C@W`aY}xZ zn7;|feewVoUtshmn1y$EgC?lp8Q*J%0wEr= zAqfCV;@h??Bc@u{n$hoH{I8?;zFH0Bjid5n~bnJoQ2gJF22{5hRRN z9GlvAzQt6r3(Y9`tC~;r4X2RsLzzG5Hb~LT0G2PLIn$nj?;ok`5uL7I^B4*4vZD?p z)O{5|g){9Pmo!el!Zq1~xb4BaaA=LH<_y;Qk|go$aA{^)LhqFWj!xq`;n$vT7Yp@4 zI$WkgGGi6FU(e%JQ#x+qXqW-7x|?n zk#b+G?VtHdZ@BByQ;y~mYGy*?q}S)Jw*Ca_7=)XNcamF299A@f)r03~HTT+i4OBkL z^^aG?|M5(Qa$)%4RAxFERApgjEI3lHxk<}cog;b&IP_;eh&m(tEx|LR;@yLn3*yLk zr4E;S8e#>BbKcw%oMj<|J$g_2@r!6C=muUXV8f9TU7jj$jDVpO}3l;H7 zdzoKxh*c-J<47BRH8L2-`C$@iPt^N~i0j8t$eyTS&H|h-4T7xS?l!MHUH|OaKUI{^ zZQnE(ms#%x-Sz?2{z~_*-C zlS-G;8qNbo{JuZtAiz|tkee-aCy&06s~biMuTGLIW;@8Ln+*peaPf!GXing$xJ^K0 z)WWXyPp{#!8VnuB+B7hTPw8HXP_1e6ZIC)*W=x%2SN2zM0aqLpGA$^VYKF$8FZ;0O?HXGwv>+0bd3csSr#oFKI6;|syl<V^>bX!3CFddcndbLp3pP3r3-*@_7@Y^F(t^Z%hvoZX47Bq^RtJ0 zfcXmg7gfuF<_L=2y?^A5bMSs|g2QL`u3$+1HJ&9W6h&yxkw?IXBSzwvL^+mJ$p%O7 zCs+60#?nlq$USOiQs{*bYI`tiAPW!-KO*6Pfc6?&OpL!{iPY|nR0)AsBW%6^-j6^2iF?L#B$S)BA67fyBf`Z+C( zHryEh`i?tpJ5FQ&ik4!$)pdAUv7Ruii;rluh@vk%Z@UZIQ_?6x1__-IcP)yY7u=~~ zvOevx$}~@^G3mqcl+j%P#)j2vg0u1kUEOL*Cem{LDdqsR)qZzqIhejOVSHuUVs}Ji ze)@Pmy}4}LqcYH{T2UvDhNVzlVqz zENuuWF}EV%?!Zb_$~UGVv%tG`E$KG}|3TTu9Mg}@)fc6Vu zvZ_g9epJ|P+Ic(J#|yALraJv9{Nd4$lb7eGIA*}b^XgnZLaZ8ok+nHCuQW42Q6q3T zpL(dKY@5EXD|(OKU>mkJ&)#Tgltz~Po@N;L*N)W*5yM8lQDa)=xZfqLski_^r95W* zsoB18GP!m~$&yo|TZK{v_KWIPO_+{P=75=zbj0Z(1c!+BfE5fo^#l8y#ltqPcs`hT zOg?U4k&B?cQlR)L7xFF&MJDKy@KQP(PshNmm9*L9Ob|764nl_V^pgrEf~L?^-&Q+= z2yJ4uVIy`2{iZ0YrZnAK<>kDdV0f3NQhU%@r(l3>{0?godgIL_FfI53L^A$eT+;KV z{v>usmlDU3x_~sXJW!m;%z}xZ+)f+|k1Vz_@ItkFBj{bAT2*&Xpb+?6C|9SiMy0$sLvhQ=; zpmZP(>H<6P?}KUu!Ro%S?AqUO0Z z_}Rk48Z`w@#y?lrgmJ5zey302MSgTsS)l`m%XXJ+0tiSKn$kRs-b3fktY-@RUEbjf z!8LhS8GsF?0=gLXo0>ujk@=X%fzXgY6Q@BD{Grtq=Cy^Sg2eYul)CmoYX!c$3U4LU zb0_Q3Y`fWtY5Wv>+|CL{T7_i@AlG(x-hX>&NtBZI4XUkUxU36JKjSL%02%WW(x}8@ zsTj_kj)|%d*%pP+k^4>SR52&D9p~xtqcl3=JIFF*vYK?=%m(|PD?Eukxmp?fGE@QF zX?3IXN+$g>{6+3!L-!s^!RqH;Q5B55H20pcz*7OTfUNo4XsrHzq*bx7U+--ou@Jmf zua&7rJ;pO=()?6JlnRzTj_a=X7JiI z(NLF)EqwovhuC>}gmcJaPc{(D0xEOcg?6Du%-=N@=Z3C|t$3T_?T5G?pk9M)MGbea zeoOsY8?{!+Vw1)%`ZX&0xn+X+0W}wp@fx<0rWpqpF||QopKEKn$C`u%FRk~jM#692 zz%qPt?eH0#J-?8_91!W}sr>oMrlR&)zf4+UXy?U7K{JxlR#r0NU0DawC zHf#%RBHs$A#CZ1r4a!^NQjZMpgZybBA#G5aKjuZaJyY$xcDh9*Q9>slg#YM_=aGX@ z0vS>fxT@dfDg4R4&L6=!Q{;o6ZtC_qM?2lU2&Qyd!zp3hdmDI81opa;{A@|8V1wnl&(!<-56kk%BLR^OIPrbKBfAnI;!H zz+Bn45Po6$)7QUK4!M?fUk_Q-hkOOA_(yJ+Y|aiP!Jla!XTAt$$4XgG7ra&eq6)H& z!Ls@`dWU}{?Vx+HvWHFv&C^wPtp;VDPcpNhM=4U$Ft7cyxY=OiEJ0{@qjmqw4Pfp; zS--90_gG!tLiHx${T!D9%}XX&TCyMmq4S(H-b5=jl?&9Sx+DSZ4-~4Z*{+`aaM&~> zY)C?AWUB_JPRCn?f5-N&fV@hM|8;MFZGIMdo&)M7X85a|hpltzO_^*q2iw&GlZr~~ zDwJ&LR-?_%#T+yC5>59Cc?wZI^h@&8F z;7C&*HZ?4?vv)hJT%3-ToscSut@6`GTVrn@{q|-smgEqrty$H%yl}F?L^wOMY>9qu zZKh})r24u}fR-_=5HotH#QC>my^DF-TghBXl1e7vnI=t-rMPeMTi$P}vc+_?D3w9N z1(#~)b^~M&HP$OX1+V4+X4ngR2@6Z#9L}!a`{*yg0AU6Hf0AJWl&r*O`_oXnm1VV3bZpAyrw?}u1f1RB0_w7pZo~{Qu9)nvqK?jF^;N1Ki#3#^{ z3~{{uy&PTgDdxSCG7Ta`Tk1ubb_gBV_{X~T` z6<)vFL@7jz_s>85(){T9@Gh~@0EmK{V2bTVaT->PL#(Je9P!;$-G18^v!1OArW=z0 zM3)@qs?o_{g^bweYK;B80WnWA$#v%8s$T!1^{~8N ze-eQfu+*_vM}mEzC(*7s5ns2|E;=!<8F>$CHr%bonKOi#X}`J3U+kO>t_iqMDSoN6 zE0>cxi6|K_kjNcwnc!?-zbCx!tZmvGE&*=(9%g2ZRkg~uNs(c)f|FUsdVoJtI2JbM z&5f^|NVe*U967_JomP32YoB-7M{shEhq+f|g1 z^UQ)LF-Ma|@`HignzPrON?0TC5U8=7X`_-2s?gG!D%hGJxuW<&5=dqRC4&N17$@Nx zRoXC)@oYSiQ6OSrES!*m9~w%i4V?(L5Xn}LhRHUv@(#0Bh(wPB0X~1b&Yeljol!h+ zXVDCvusd&?9AyFbx7(UM<${yCTn5D3(CaL|M}C78F>tOUdG$*>9m*q$brwmY)s1M8 zh6h@bN5h*fYf0qLTyAZ}T75neFC+uQv=9a;#UEhP;qsVeZL5 zGp3G%nGsrB)GzI3g0LWzv6*<8nM$XsJ}hVv7B$z_u5jg5@?8x`Y`6NBjQ00&tgBLo zHoNp7S`+WQ5gJOm%0CVQFK`U%(>~vh2R_zm2C^2U1V^pc#U(BWtBg0g+3tpi0Q#1v zW?*C%>HE5Y01ybG7QSbp^Y+UNNfplS@*VIpg_Q?sH8*;c6!+L72PyaMhSm zwBOj(&ZkEhD5++(6nkte`mUe{Z+yZgF~;riIMI0ws{`2$hMb3TOiAK;aF|i zv`w-4k+K+RP+kkcZ&{Q#(&HPb8>cFJqq_<(V#Q5x0PzOq#O3VdD8IW069%u)QP`Aa z_40-_KHX*lnxm?Kwo4Ic}kXNz~-MRRigB zjF9>8O=g}!KEiTsasUa&!xudwVB~e-vNY+rojI-TIgdT$6hrDgdR5pD+E_Cn!80R`9R2TNIg~hUAV6P_N)!efJS)6pPZe2GMXyLUh<$Nc6s>$>wtA$mOn;;&)De?J(%)3EY2|zvfjF*od_sEsTR)&tE$5=;UlZnp z_{dHd6NRn5s*sB~HuZ1dFW|Yv{2D171#QKRNK0^ct6jrr&*o_wlsK`W2&2UZ)W_^+ zM|2m~PhV))Q*Z0|rRCtpD;J`O&BI0(vo&;<^KppJ_uRVRnYNQtG6My9N_ImxnLTt* zhr8rYd5$kxo2P>B0pdo>yr=z_p8Z9CnT*w|*k|`!h2we$(Z5bUl#FF;vi-A`MHQ8w zy-ST3Ho_OQ8B|zU=wb>$S#TygJ7^+q9;+jd#n|4P{YyNz)fh9Sel}5fzBPl`-=onc ztu=)WKCHO!~oW!N+qJr}PPg9Dch zp~}dyP5Q8Gh@YY(gkf;~eb4Rnol$!kx_YwF4QBA9v6F0gItxqJ2Y-a-I8j5uUd!_ z8wpnzu@|Thgbrd9T8D;CAVD91np1F)E8zP?j>c7+i8EMjPA3zVw_Q+H9294e$MP~urs_s;Hd+FMB*doo<-0YO)Qd&OD?Pb(EY zW1wLQ(}wZGWKRo>bcX^8eQ2YVMeK?*m=f%=^a3vMnUa22jE<_%4)&EPn!-&B+W7V? zq*-$vtR7RZ78a;>$%R%9eiRg47t!D)4Mj!O(z99fLMJa{h&OmRr-(OnL@(*J*PyBH zBEO@w=w!YP<2wsV#R+$qx@Hl&EI{O1R^B{W&60$eizXk-@Q+P+Xq zxBM*5;MiOJ4*&3W z*^Ik#+28UGwi%76ryH8CnOSw#=sNE+HE_-sjjpaMEtIpJ7 zp*>7uxZ#&_@ULuuy^BH1vJHI~Vhe(X+J zkWB8C;?(yWo9gYmz}^gvCP40jo)x@xy3507NZ^x5ZcyCDG>TKp<<@Re+q7oa=bg2< zqSyvL6J9Uv;-l)s#GbpD<+BIOOZ@7#@Ui=Kx8~1l@A-OHB(jncQb`W>Jf3RQQZ%I7 zeE#>gIu3oN;z2cB*Nyk(o9L+b_p{wExWu2eqW>hyIsU7l1S{+RLPv1MU5y~ld{e)H zw{D|<0-zy7#Dj1o^96_AJ^VXHk3^ zC7mRxrDAaV_yi&I51#gI-*?5G=kZS=7yVV5ERD1AG-5_nk&i|$eS2#7`jVqWMi<+q zEE>V5G(%_m+`aROIHmBuGI7;sf0J;d(pyMlr)wu}*4;_(ThBqflLes6l6-f$n%J8` z<q%l$m)(O};!5n=fqNf_D8Qi|1M&(b?eSaIO3Y@=ehz2t~K8UR(kfHkeWR)nH zuo3-!xxURlD$0aZe!f0OFHUb`*@z!$81LE1!VR$!pK6p`?kt^eq+v;V&tPTb+h8)Q~1e>DmBm(?ls0by*ijy@U z?xzGGqE&4{P)ytXLe<%5>?i(Jp+6e;i%x414`6o0ql(je&Drdc$axvfs^ICZn*8pK zJ5v(49X^?%--w=ts8_bPF3zILLyp8-dnUa!7L=cozYx3<^kQ00)#Sq78$?fiFz%#r zIKfhd32!i7bx+j4pKfo~45hEz6``hseIUW3grEJ}l?Y3EIarduX+I z@RA6}p(kLTPgEWrT8KvKr~AUwgOUt6bl4{ag*JV$aomgV-oGwFv?Akbc57(g7efIw+@-v>wOPy~wayH{?LlK^~z+)<5~ zq-~gZ;_Q?&IoZ4hDriuG{+<|)nm8WHzttL}8=mo{V0d4iVbP07ddw6w%43z4(Y%Sz zTpOoJSRg{cKWgkY+eoE)!+plo;hpelTQGtJv=#deRW_|23`5DL12YK+>c_hMquc%MSs4sB?S z0l3vrk$UMyg34Ug{!hDk3zZkS$mm)@uQ6(f!#VOyvfJpetg6$gI7{ywZCvxAk(bWfZJ z#c(>{F^**%lkciT2fCJnWOO~KwxleJnVSGLCvuh7U7D6FtWq*FaUgIiG`xYh#y$P* zhlwJ&|6=pys?idO&}biuEE1-!HcL#duX7KG6D_*CshR1Z?=6=j&vTZUF%l1s>DG-d5{8#4s$mB;@;(A7d~^eCmL+g#%HCi zV;o&Ncftt&=HJ3%40Ok@2ca6&WN+^u%+XR?F>a!*ik36pLsVBDJ^7hO?9=Gtg@gF|fOskXuTi_bubu!oH|kzg#e8(!<(olo+CnCq6C zGTO|`WA_sHyik~BX2}QzAgJ)=qH`mPn1 z*5(0r4rf`)y0M)$oUZ?{*6)~5&a==lQhcn)R7+M;e53;c9b--m zgb_Kn6z`_C5ehF94UJ|}y?^!bg07i4Xx^!Qep-E$+1b4A%q6{aqre;cIa&BEXSDr! zR`@tBy4HVVY@DGf>P5$_wdn(UK`1ACA~ddx6g^z4yBgb$DVAgIWlz%JibBp3HY;pu zZS!ip#Y5aJGT2cYAUg=HLorS%@R-DyI=>qXmyK>-R(k&o(baN)WfDG3I0euiizXj3 z_hBqe2PujhuvqMKO@$ea=8H&vzujOlZXo-RRGv`I(fS>pKwUj*PzyL=te{qDDwsox-N(+ zab)Mt-n7cj#14IZP0qFfxo%xgnm*}aOffRC=N*JEP^a3OVVVaQH3l2SI9OMc+2$AH zGw2f04n*J$7GeL{qPV7TFZId1C}bJr(?%a z>~q7bWT(YoWP+XHH?dtTO`-&BmhCCqwr$(CPuaF@+qP}n_9@%8ty^zTOvKDYf9SY>B6H_{R_-;d zF&;z2hS)u;dI%S0Vn>F5s@G?uXTwvI$pB`}k$M*R!Pv{U833J-PAS2z#n09 z^y-D^1YfQ%7Q0RA=GPqT^p4BBGr@wZ^Idc>%F?CWrR>vC8W=|?+mr(vXA`4p^h!La z+#{Pj(vLBa{c_up&^}}S&Iy-IG<9<@O!ZBD?LNRBe(1c^H+e@R1xA9x(mMGss8{FVyKWxK*wlZQN-(HyAlqDwGjaH27 zb9}(M{EM*H!2>6YH{m&1Yh0?}p&Re(pSc?4x+{PEm+R9UX{r(4R7Kwo6q*9hrgVKK zj4)-UUY!hm{$Q|FkIu#!v%%tl%<&2=sp!SAlRpO7;0m=5(?UK4;~xlgecMh-0#uq3 z_(bhys{>rMGCK-#;c58pFEErC)e#K8FEOq_E3dxS&nZ%~w5T>m7LSVc3E*&9L}E0Z zbSpp;Qs(OHZO`0Wj9?E~9&yH%7&xKID##wwXTFb;UYA$lVy$FU8*glr-)Q3+pWz&Xv)o7euMYa|7E(KsLcFx9DWVdu&FkDq;Hr-2Cr{qABHiQjl9BuyWI zjNIxDS~J$3)<@7z=mepIKoKZ?yMz&`FywCh25kDicU=%ER4>o^B#Ca?iPNgaT9u z1YknbKZcA1RJl&9A%H~!hv(E|^z#!i9f46C5b@4BORHV z(p^!7A=q&g;aXgR@@P^dpkULBtlHt$9C>}Rwk*m6O`EyRV&A8v8QF?c;-L<=3TW#? z9USc@Q}fV090cXA(B|JI!CUAU=_DYXcHUb&_Zuq@@;=KduRPNqHHPleT~Y`Q5Rb7=qB<|hsp@-J4Y#Ciat;UV01 z*3{Sb2662PRA!sVu}yNVdh-D32HjbuO`E{%jxUZ}GVl3d5z13V57xigtl%X2inn#( z5CMKdtO8O8#@zO0UcR5CB(&9)B$@`qiD>#}V>V_u+8&WGQKigrCOZ4U(x| z%Ci@6c{VF>6X)FuZ-Esj=pPG{xzARkE7@tAxe;@M&oq|WYgo+5EW!C`AUT69x>_45 zFXFy3R?!;BS5o#WCy$$3ozh3GS;LB(r#zn`*y1)hjYc%Jf7TPHnimFx$yb$v;)p9r zcOdvNB5b+dXEf9ecXWs0+hJ5>)~@^DDIA)$NES+INlj(kM-MZrABFv|nG}3Q)grKO zjqr*2VBF91RIK>ygvOn+JrYx!v2@IrrFMyu`g8kLzhQe)I1|Av)zWrJrSM70%XP;d zrxsPu37Ttn4swv`t5LR+ILVFE?h`JhmZZLx7qe7h99d`dn3WV!T%kh38pLybs<jHY=i!{BK;RsvO^g-b)cj92pve>o+-XTA6qD29sc3; z=8|!=HwEPvAOJ2fa36za%tNTdJ0pF=Q1&Al?X8YkZf(b9InNLt9yyLHQT%i12hCn> zt={g@zd6^_!5InaH@MxWxQskkalPb; ze0AK%O(~Syo%aQKd@nOCr|vQqzUu|fI-ku>&e@f+8g1U4UFc{7~~&=qU4@HU!L z1*57hv1#VoG~MS{XAG_zE^l33!D1O#F!h^8&uz5Sl{b479ld4wRQ5^>>ov}{UPx6J zuh3T-b|2KI%k)CpkX*%%gkt=7MaF4tJZEpl$aTfZ2wM@nrpOLtqTG71DsaLVaBOWw z7KCh;G1FsA3<_oF@=C_M(5P7U`>}=Gn>H+O>xll^!8oS*Z(Vk;6Hkdx3PW68iNc_& zM!VFAx>PmzY>0YAI+@G_H&ueX|5dFr_sOg{jNrUG8J)H?=c~*hF7-rX_1lCR$B|bW z&Jqdr&qv%NXj&S2XT3MNm7VmMUTSeP;lQU_!a3kp?y6Wn9=~tzGxU16=?RK$Fw;Ay z-)X6qt9G`nva8;u%p@qRJe6k$buU|UtuT{>FReCyA?PaNS63_78$LzB{zplWJ$$uC$?6ozVS^>rS#=*xy}iBv zo%inVEZc4!Uq3xvKQB^`LUSJhv)r%s-x_Gp{z*G@`swKn-5-6=vdswe0QnyDX>&RN z+~h61*!j?{xV^r*;>fk$D%>f)jrZsVA;>?aYhc5CWO3n$S3gTM1edBMc z3HK@tGzWg?)%h&ri)2BH5+=3{BC2l-xmP1ays=T`MP$<2ggkgMdw6gxK@9fwe%mN0 zGVN1|vqHtvWomy6qnzqz`E3iwMzM;(d_Nu9gq~hE28vug-U_e&>z^uTg%SEIqqpze zBfLpEPs*vL*&Sa}UEkOyfAebkJ1FtvKEnGaNbi0fe`rTmZaR?0bz=c=f_cV3w|!d~ z?v4pQDb|~LeD{v8@Ly~ai};9!ucU!ByejJLj@*4bGYU`K9|QxQfLu?Kf;z~-IF9iF zbnGYm-HoC9fY2|zP7aMgE3Q;63cS)EB+KaU>d}kyn&=xKJQU2-SziR~yi;88pB2wn z;Hw_nH*TEPp4$@)s90g%Mzw{#SWzVfWfF5(B=wA>dS0x+5N#vZrUTj5e5*_9Qu53bz%Ai*rSVfUy%^N-g)ZQ zhMeg3)m?L<%G{gNhC1ma6K>>Y&=fXH(k{iskDV-CHU6UJ^0@CzmLz|*>q~@p2y-qi zamABj3;j*TR(yOyF_-mzBzMF03HZYgVGtk$C~nebeM8CUVoN&a$bZ0Ofm|Xge*QO8 zS^P+q4Pv!hK`(1#ZK-;a;6OXZq6H&;Q05ffsT5%Y19yr3>SD@kbE9XV9L9)h?oH*7 z?N=pLN;gmIeoU!Ztvoa;8hgKYO(&1uusE~r}cr- zkoN4$Vv~JULfE~6cgXZq zAQH^1giNc8&Nv7J{=>yOG@Fm#F2^@0RP5%r3sLm`{6xVYNBk`H!FFcPFT=pA63%jMD&K`vW z4by(8MWX^E+B%oW(sI_NEAzu!NMHnHHxS>_2^Q@Q_%N*^Q&p?E%w8bcBUnZF#OKWt%_#;?NYmlok)ro@)BC9Moy<3YMK)AMge3i}^U=%$?eZW)cjCWQcwVhGZVB%bBLF$bNa_ll$mi8x6lBksO=Rulp}%O@ z5}YQ_B^Ct)*b>?4QsGF{0hl*O^@}q@O#@>8#n;?IqcJ4Q>ee2??3T95N$rI>9bFY6 z>!58SCc7iD3!o16ouOr8pX2OySP0V#_1Wb%$2<`thJt?1S8I76+wEs+6;C-P>n-9S zifU>JwiSlW82EUrR-_0nV+v{KWfyoGnwdZs1;~q6wd73S@#0rE-r^YaoOfy~IBKBS zO%qobURO$ICOFCurZXETx3U!eX6G}_^LI{LTPTIjLAy=)?|5pO zxM#zlwOmp7ytrlnOJd}% zu<;~5#Zi|wv%DlUM@YG*Lv0$l>!P&rBRdnHl9}rC*c-BqgxR;~VZhf7^ zYcW3kyo7K>NAR)!y7ijDf_D_(cD_aCgLlteJC`(-yB*s_#9@1`(_{9|qHyzhm6=+? zEKOwBolRIthb+}>2ujg1nv#(JJ~}soX|Sgqs;*!>8z+G~7dJO-<^gKn381BtlCfX5 zLu}X~>xV=mV{4D&COAlgiHU5E<`V;bGBin}-V^2C&+PVD^f(r!cJ!8K#nEKntMJ%O z0^oJio)YI4R@H}Hs*^WrF`g@-Tl9O8U{3~p()w#Fp>H_5FUW3<=G)N&mdSSBjGmvo zNHm7_JL`7}i8TgT2N!9p+g9v4iqJq$yf~ysGMU-ufqci#fR}x8_Lc>CG)}D)$#g>9 z=oogGl}o&`Hn1<};o<*bo_meeB6rrUdIA_j9#B;WXPJ`AQ7QdNQYB02A!VUR@Gb9h z)YBI`$}U_UQc%R!>4OLFlzP+SayPzuRiDQtntmG?u7vTS=ZX+K_TyPx-lor#ELQ^(rTZ{zJs)z{ z3BnYj1}zGzMss6H>Z4?lA`5r2;0g?UOSLeja%W$gCD{?)fd3p|J2@6$&nnMF)3U#u zoABkhf>JxVN_$yFSUVL3!75Ji1GN|i^VlC+KNf;vkLzyR=UeiX&u^Gtm?tsqEg{JB zKvUSbOKFsIU7YSAzxdx;Dj=X44?`!zm7ek$Cn`Oie&E&QyZ87v4=#%eP1du90VQ=$ zw+u%rGCA%TB^8R!J0~5S@pnW!{FC?fegrc>Qq*8F6q2_gp)WmG8>6AVClz)0=%wmZ z>&F0_SFK8g{qC@0|GrQC0c5I^hWl?aGvohALdVF=^nYdM?q7TIB{Tfi1In8}D=nXa zCgu|$MBJ)&8jiu-LUx@$h}En2r^{Qs6Qkn|I15kqP_hG$T=IqNk2Jl)2cC3*02ZLK z+Bj(a97)`Rl&}%3O-lO)k5{k1?(4xtNyz*QAJU%afCg z2^|j#9-pDN#vbJH)s_nVgO3Iqu5&m_MBw*5>BlC@_s6coV(=tn+TtKBxcsd3W} z@rbdS7R7u1_Ldfqh51Pn4)1^qavfh(K zEFdhX(y?M*x$TS~jqjcjmXm?`5#2z07}(ym`l^FtlDkl6`rsNBlNve?MwU>J8dyodGW2HkRk|KBof#~sUkG68G>BHx2g%+o~3=h|6 zDb{JU9Gx8=*K%8N7jNG}olF-}b`f5UpJhCFy&PW!D$=Zm0JKmPH@?tU8$WK1?TvT0UNycHI)zDG{y5lW~{ z&^ckUEKc+fB%TXhO|}Ye-CWe!^Ccl;VGs{G@ix(>R1sBz<)YYZXB(7xZ@N|$`sch4 zswAT|WTb9TbJD(VUpE~0)7V`|FXu>DT)s$cQhjzh(S_*(k7^6P5Wch`jylm@0>-FGyqxc#Jv~m^S1d34j z*XPl&mk_s#{>MZ_sA*QyE7&ImITQgtOE8KT4FJTTYG6Uk{?0lm6uurYVIxZ%GE*cTAIB31YNEaK87pefm*02wUVPuCUSHNXMqDUK9WoOj@ z9SQYqe6|st4APCG&=%|EOBAnJ-ayc}ar7(t8kPDFG#`RxQzL2 z9eR)5x!XATi3a|Ry4Yi%sU)Nl+F6p_`$zhEE^CI>3LC^=6c9+fj!mhaU7e0wto257FuBwg`$r^@MJcEa%7W98 zARViju~Ut+WrUzX9ce*rf$Dh-y9xnkm5tRj89BX-bQA$_9UvwQ%4XDEKKSjCuy44R z=fs^lW)mk};M_|Aw=Eo@VHN=7V2{ChonxO~kp;<^+;#$(G?tvhA$r3IA7SFCQ)p|o z-OO~t=B4QAtebc+Li<5|OP1K6hmzeDqhwxn0QMo8XaG@AHr7BL)c(GB(cxQ*qFHw_ z=kq6Qz#JHkLd#{cT2~&bJ)W~$Zk~%HDD8{kz_LrZ686TPEK)tDX?D~8R67di6x#+Z z!)QbTp3GzIU+b%Gp>r)xVm$>h z!LJkbUO>w#fKSiFAFoatgNpA8wUD)+N<%D zbh;k;pXpujw|`J5vJzzSKe$C&%BmgE_m|KQQ!bG}Kq#N^wQO8B@5<_r%1(gI?HHcG z?{P0)gkk&ZUQ#t7DTYN}1q~w5HY1&be^zDgj^B(}K0}aAw;B*hX(C>s1-mqU8XY_Y z?%AE4hZQr{oMT(5!Pnrirv^7e#6#pzx9^%~&QjPd(x~R49=On`rikhaFIi&=t?Gl0 zxw-w65zMZhx-jO2Z*9ONQ&L;0Pm6P8#mf4BXz3TguMs@KmM%9+M#WYbKTVdw_qJDdaoO8fyx)QSwd zJcz+$Pl56sSFqN{z*IJa*RZqL|Aru3 zM8h12rdTR_VlYbbckvkCMmkYE&wrdJUdi{R@LIabFR=Idy1T>DbZ`wXVh9*bR=uh3`$$zm z3+D_u!=N*pkpqX+8(Qy1p&P7POqi<`6%W`_IW{f*?D_H#6cINfE{NFUYZUe0uwD4s zc9E>aKI$Sj>ixM@_U&n6Sl#jReY^HeUO1@!@3P$g$g;)syE68F_Mc0?Lg9zD-~RJ= zP4&30EsXfzsgU2)pLUt~R(!BdlA{EUDXshWy&1}ggw$&z#LwHC7UKC~jb07zFV6m< zFTS*>w5iK9=Y#v!%W(|^g|QCem&HM(fii_-F{ko zod9kNjL!ZVwse2TRJWaf4O?_5v`3o9UxY>ASk^aaVQ{}?!Vk&U-x?c~m41}Z#7bZ9 zg6l?ae{D+5tMhzSN{-QA^ZhWEyPK>} ze7@x_=$7Wbbk?=^eBUFzy=tyvr7c6+`T&emqc?fC3-;>O@-sD#)TRbtSR)Yy!QZ9j z@a*Xr$I^bvWyvU>v&#+Rxz=agVc5G%O)Afm#wRh*z-6U&-M_-3rJVri2LP5N4M>lv za?&!f0lo2EZ|g?w*dz1>r7nO_n`)h#qkc2f`zueKowYizdprZe13fjF%Y{ErHO0C8 zSsCu_a-hTV&|PoGE0wc1nc5sn{3~LU`%i4B)`ZSgWc=XQ_X{1xEv|cR(JZ6J_i09Y zGEAVgs^qDA*vtf_MeXPl;#IHLXey-;VfIw>OAH`2T(pat?sj1nifSLD$1?5RO&EEbm1_=yC5{)k-~dTO$E867mchr7!YP$`bV0I1+=TAld9?l zE2!tF7RBlppw%Cp1aQGbn0K%UD98<7D8v=!R$o7}9iAYju};KpQ>+d+Im$F%|3 zgy-DI;+#%tFtiS%2T&iV)g%j>&Q~Ql2Wmw$Af|e?%-7Ty{41v3G4T&0e&hqr? z^L#fD{uEH3!alKKy|ac^eXX*C>S$C9wXon#8?DWOQ8ie5bmr7qll!wUK(&imMVT5! zlsG~trQnOXa5#m1z_2uM5!QOF+O3e}+oNK@p{rQ6JnYmr26caIT{U<=&Gh z+c$oOY;q+C+}q9v4y*H0E9A%n@$Vz|lEx<6($3}w3+7`{{=fpnW~o0hx^vjA*gq5W zwz|lUYqt1YOn3LA1u=NEiV0x2RMcJLP)WW%caZR~t~7QPYNg(*kqyjFwUjdQ5h5-L zJH%3G&tNn+r4d3>x>c`6%U*MyS5s2 zo7*Wb#ZN}HT7~4{&|she30j4oL_9x{fA?bPx`Ka+ywZ9#oaqGJ#P9S=D?RR8B7ac1 z=gRX&+R@x8gQ)ky*+5*DTFdmhcquR0IK#v$JSm2{)*zr@}e zOPxxPAj^qSGBnd6OcN^>fkVrXuHjk`roH7}F1}fJflClik4CR99^1Y|tN;=7JKfaU z+DDH6E9J7*V5t`l;FN=*+QD|CN%eh-K3G8{HHw5{Cma{gqQyB1+y-%@vUntMRjY!L zo61pX zY{Qtlkbl3re_Mo4M?dHq$q7>~0z>uV+E6`q50|3lWM2lV_sE1i+}1Mjtj5$1oui)% zsdV^8{j~y>p8-tfyEig%&OhLnG;+m#M6X=@^x3#J2`e9Kx4ob~xFmnOa*d+aRN1wA zYgNvy$VT|SYKv=xQbfT><-Pv6L`<|Ofr2a`xn{g`vBmz$V}W)d zuM3<^Vr4AjDHk_x8k4t^LV;JBYGdXptShzIa9SFB!`A^ zWQzp!vo*8;5`uBPs<9F(*5hspbJt%Z&8}0AkI@BGv@`BWqx4q%WP$4$9DXXWSbiss zU!H^{K*~7i#J+wt#rZkpUyFO*^4OJtF~jvd7j#4&Bm}a~1Gi}W%=Lss2)mlYS$D7Z z2&zz;Bm3QEoX}y*19>!BG91a6$v9LI!f4jv6*?IV^tIWW#yz+!5qi?5W`+N@<$ex@ zZS$KN+#zF(^kKjg%SPXPe-=V~8+!dpA$1#w`&&=oz?MLmlvD*NnaF_sIIL4uV+3Sn zovibS-;NF!;Q8UA`67}yj`U=+Yi{JGXY*|fv=rJIk1U%T zSp6i2$+|BjhXiher9b;$<53Do#NMTYdRBUlu_tCbON(W0lUO;o5@A)%Onp5QI|n=i z$6zv0F_*f3T7LXX!zFh)-%zQ*9@QQ&*w_6oyfb%);9P1fMZ7Czc^ZG9m1wVFNcMN- zJr*RL!#E}2_Co|V7-^1816i+t)i)7q3HzVP-E1ks3sU|hW^mWAfyW3D9_x*Dh8R$!EKZ=j$S{iI08XvtE(t!?z$X+WIpZ9Q&GY$vd0naTzFF%u3?B286hG%e*wlRxA zp6d?Lip5kGQhg(nBNEvx1~vykFu5}Ll3Y+oFe3vFz9iNUFKvz_5868F<+tam)xxEk zgK%^H*+muG+}unR{K}YTRaFqYt{H6%PLs46|HXl~&*3=_EGN9(fo1lGFc*-6#uIaU zR8z7@XT22WVUvqkB7gWkSR)`M%Uo<^bg~%iWVHGIobqP}Y^=FO8k|u;ht_)#{EgZl z15ZuI`mY63qdV?&9GL3+6UM#ZPUW<^VA1G3g6?CNjkq?V_MYxOr(B>r23 z)>xpGD69Q9WbvE~C#u!@FZ+A8K1;!cI5yh@UW{VsbXcN!oy~}Rg-=%$ei2CfZsE`Y zFTDiKMDZdi$Z;3?ETEl?i0c8%dEn|-AgDebYYJ|9Fw($a;eGnc% zJm=ZTKjN9;YkSq)O)a@FWZI9{uG(?Mo?8+rE~ti>te8*Oa=<(0n@}fTaZW!ls_`Y# zgL;!b5xB7%n49G@te2F8-!UoL_S>~Bm+!mx;*+vD!3DPIKu9j|MDrq5VFU537QUs$ z{xKeRY6TtpkapGJY!67sc|OFK2W#q;DO57X!4Ik)_N#PI zv};yF#2^cLzZwy^AA^ljY#$;zs#?;iihX-q%C7gTXFj4H^xww!Q)=JiYtojU zmCY%sfcC%pO8EapN&IJdmbmplny+&(4b&&pf2SgUHuzm+P0)I;)x!Y-Viar?4eSDtf@>z7D@HUnM zBN!$<_2J}ibMGX)(?t|{Bc!YfWZKQ9@~IJC<_M#6D1%PAX^mX@Y*s7mlL5k^vDW1EwzHg|MGl&y8GANj?#6K zCHa20(4S@Ne3O$IVT|thY9}#BbEW(I%-+Wyr7A!&9X-6{X6pLx7y&J4DC~j7P5G1T zKO{c`6arx!Q`e*hs9zNj1i|ZPn&n(|8sKJM;n85pl{b2MehT~tk}x>()G8@p3qOsr ze=~6(kBrV$^UsIDB>E2|VG-n1-1rMgWc+}geGT761^ywu&4QJsKhk3WWCMz9a_cG^ z>DctV0A#)kuP|2@E~K${rw7QgeHGa0**h6Hn0@HB`EY(hHeJpr$abP!efRg6-lGaE ztn7k@8=%6%x#SLT1bl0o=c)5GWr7fpfzFBz5G6k@qEjfO zZUoeU!z@m36_TzUzv_5Z#Y{s+FA(VR@%w|u>!=kSo~;W1U9p=b92;M@AYN>}8Y`rNohda&;TFp$Clo+zfar>|7$B`i`5_ey`K4Ev2udp z)$a+uPOe{OqN%_Rn}%FF9fy70#8T;16 z13p15`Eo4H5hMbC2oDDi={<+RU6qH5y$;M5=G)w%yR1@)jI@O}4Dv|kW)l|p0LuQ? zP20#9Q!CQQHo$^F(yyhC7l}k#22^7GLfBmDM2FWvGAPKmFDbzzor33|?L-phQx9Ua zCUQ{HvlN1Ip?opY7ERr5&&WSm09V;a?T0R@i`!Q3Dt=^`2K;wezEn+>!kDq*3_3*C z*MN_1ec%@e>vh<;7yG_Ka%lQ~3I?TGfjJFVR{H6LN=ozbG6+jU(w#}^kiWC+ds&L2 zE3dd(R4T_iakesWM~e4DttPq@h)5qE9PmsZ=YIPbUy}EDeG#uedAhkQJh%=7iv!D$ zU)hiqFpJG#S**e(=}3v43eVl9zDe|AgzJBVDTG|#RfF?KuH_}l?>t1Bf!w4~L?0Kg zd6n%!Dh%m@H0t{npr33MLZhicqh+r1jb5?mxt0zGMTI18%#4l~N6)m$^}h9q4hefn zyUCt-Wp1K9c38V>iGNI7w9b6ADMX$p^1m38@PrnloDou_2>4;vDih%J6hQ+)sV1+Zlg;FswCF~ltKYKuM7=5{MGs9&ZydYP}K z<+ZN{<7%?hp>!ms=lO@H@R@-zK`H8zu~?BHt^0|T{)bS{ zO2i#jI-k2eUJ0{+b3&?qKc>D>S7q#|S?(>_fQaiO*}&P>)4QI52ZlVb*T{1~3)KhLfj* zIYO&Rp7zEA>8j@Cd;W4x)JwN{BE6?`Xhb$fJjFZWp|;mfK?3wR5ZELxexC+$y>bFI z2hhc^C8^990FUn~8O`@eGF@O`dwWL=pe#!=I21pr;eVERC$mpdf~LM~QWup^L14|w zF&4Mk{*J6j|5R>B5&kgfL<322H``N&OMJw+Q#E|kY)i+h_A`Y2Wt8OKGW`Q2|A^*W zTOXqm=F}42JK>dJtuF|_V1Gny2EfJuo}+m?e%<*I=37z(F$f`KfrV}`w$ z*Gqj&b^acD4INK!Tt=+th!S-&Q_ZlZj=K8lLpT8?IIH!JHdhpe2&VXSWz`Z>)E+OC zkCsgT4}`TS?{UOxg6KkgD=%N*tJENoJ$9m5uYf)KQjEb?l2``r zb7c=Z3I0ww-9W~idNbX=aY|X(uJl-^Tbxg8Fp|C@1JcWZ4P5*2kXAa!+0v#QGAkZ% z2$#oak?lh)O^+8y+lqlsqhlE~5uY70DGb&>0eG^bou+>Bt??g4`qSLj8vV$wcu_nW zT{G=Yn|>S#30^c0-QP>2iWyR7dt@YvI2u>lR5S5D^NFr@Bx%cc##SlQQTxb$f!{k3 z7Ki{JSFim$CtMe-=35&CIl*gDP93>743FhX1@1rQA-Ml28iAn7pi2cfl?2+2{(z`3JO2uD}ui zA4STijsTP(?z8VF`7QL)zW6JsN^w`=v-k>})CT(RP_k5!R+f>tEg6?5;vG zyqnL6#2u4GnM$3d75WoXi89{dlub>#K<>FHug<^Vf@c6RO30E6i(cqPeoyzhEELu0 z^%fjz5L4ycz8!k3ou@jRucfSDRP2KWezKYO#o2sqXFmT$N%Z3sLi{(GndyHt0Fq+z{}Y_+1hoX~za$G$#I+8h7wlf;ygJ`;xcULZeh{ zz$1rpLHqyif@!}FcYiZ={XA{lFU&dsNK!Y~d2OUXi4TU;D7@CDf? z`QKfp5G-Z>wv{AMy)-CS!2PV9O}}@`W3*}uTSlB0nzVMEV5MD@^@<0h46~R2qu$T! zd%Yt1L`~VYl_nV=UBjr7pi|n9)&Xj_Be|I9*t%;dK>Fzs(kjAFLIo(tg2P@l3ZvvU zt)BI-Ue&VftJu=Buh1ju@CgB9VQrx}sFiaADpO zATnl2WMuh@82DUP?7x@#M!7Kwr#KvN--#XQ9*Ol&MHh$&kO3jelU;~lPmmbg6Ci{i zw67s40YG9}!}+AUj7SbTB@s}qNhkZTBSet)gzGE~!;tvZ#!HbFBD~0ASP~>Ri7{oW zFB$h6rDk1uSU+cGB;tW-;c-YxS1)ZvkP!k^jIWkjV_fdRqbOU-Y3N1K*EkGNm(an< z=%$oDqlQ_de3Z8pxJ3dtonUvm^Da=Plrg4r&1)Uvk+r*lh-~wNj^_J$w3sW$mgf)B z$Hy8l1*3II5qCN7e;bS>rUrkIMyRqIU|KfO>sFC5Xtsun&}r&9-)&wEZ?4=e2RDX< zrjsmIJD^6TtITn0z)3(Ujzl#@PH!oQE7&tVMs!nSHpjwg344NXe4Lqfs}X`gi9B(oBx6z z)@5wwP{f{{g91ru4i`qkR{FON5=AO_uHJ*|XpQG0)o`>tN=sQWc8M~a_J^2p+8bH< z4iETZ5Wm=(zD{Fh8hAD$>eRm(*9AN2BLSpgaif9 z&Prr%(;&jeQ);i$VN(nMT2l8+${XZ*_-a|tWy*WoqhCnP8l>IyF%0+gjWSs^;H-yF zP}%+0TX%ec*TVrKEa~5=geFRYu$Tv`(!TgyHj)xaDC!9*4NsfELvPxhgJv@rTRco^ zsY)RJf>5uw&~0fbkY_-g59xf~VtRC08DM88*W$37#qMi+7)R^e&1rzb`~&v>`#qfW zpB*zTuQmd$GZBVXyq#4hVGe@tdRk371HY2$qwB;RGzj6-#na%Az=6y56w<5x-;Ho>*ExK_w+!=^eB>WVZ?80*x{p-1 zO$9@Crw4?}13UW77X&W2b}J#0pCb6Z8JOsnQporh&I5#6M~kq-s@R*vzk-_@3q^9^ z#)za!MVu-6Ah_Z&mOKQf*V+mJr?c3S*R(Py--<+5WNcaf!w?!lD)k0ux9)oiMn-Ek znG2+stspA7?y=Q5$yy73J@Z2uO&FP*U>l3E8r9b5#HlP4D<{g_{R{=R(#4z6brxpI zBBKEpvXxFadLzr2Bda4HQMl})*<=kmL|El25YopPh)Si{>NOv){a$Ib4rc=Wz^=O? zX3A5BW(Imk`#C_?Nk*BsNt#a4)^gdhyKTT5#I$csW@+3z_!P8~-q-h#schM|Qr|}m zYMYffm*2aLL(C(|laj}kDiSczvz}_Ji18mh>!?kxp^K6Ix22JS(fB=b!SqskEmz=A z+&AA&RQ)-KW>?&54 zm(?KG_qac*xdd}u5FK;jI}#3oF`bKp_F4uM^21H+0HYx#s&Mb_Glq8jE%*M~9|t4j z+6C3Dqyv%=@mnT426-T?dV)OR=4~}1+*z|fkeF(Bx(Ax(b-JW5ai$&b$t}M2h?TcI zK(X6I`6GJhF!pWnN$ICjhZ<^k5c|?)E<4~^4GG+_20~( zvs89a&%I@!Bw&Z;!S-xhAmb9Lu>mD#F9w}50+q6>rCGunfk-R_4+{olz0(CA8_8>olA zO3qo>I&+Xz8t?(_+M~c{@?3=Z<3a$vbIVISw7Cq~-UaaHS6<9q$`VVssG;!cit!=h z2C#*tP7`5Dec=3KQf}+s{uSu>E*P8^@J-*7_uYy@0nXA@j+H)8XQ9x%`hMohYbQ&P zSM`OjeBSOGfhMUVQwTuBY_KcJbD$hehfu^gw~**-(}DsdHejdJUL&U6%1+XzzxUJ7 zD4qM-!s;&VR!tqD${XddYd?4Uopep7jJ6B8~y$E}=eS2)|?G=UC3AAKl?d;3h)JcV2w-C?*| zc-SI)RBURaew0U@)<;FV-6kH@bqsISCXa25@wfEUUI{)0)d!D8GaJ@sw0;`eqq)dd zew(bMVV@zCvj#lK1SeS_SHgmgN0P|Oc-^3~eitChMcB149c`F=Rx{b2Hs_5;W`Pig z2r!8Q*jbMsbIJLQXi(p=5G^WTK6{!cjHOiWvQ8&K6ho)j{!v{>$|%pnSHrFOa0=?d zR0^y9xZzIue z1k04#-xiRPyxc;}V)t_J91)GpRpRX7AZ3O(mM^&a+*jO9OR$>wcLKZQi2xCRhh{i5@-KjAsaGPyoBAS{w z10jlHw!q5Tf`?mCgOA#4_13a^20??cu}(=xvCgXKe*n5pStjq?vcB^<>M85Gd3c2W z>D01%>%op*;lIP&#mrCWryeRRaf0KM8kWwQH|j9br2s%<{%GQyg}}{*iO0}tgx_CN z0lKrV4>1|iP47(V^arT*0Kuc^V&d7KrxQD+!vJZEdWP+82A92fS|9C|1u_4}q?vXD zz%&vcY8=5dbcT*_T$nT}cDGpfOIVgk89nWZkvZQ^ah`1}gqD)lt8Nrs&aM0A&9Z$S zNo4QB+hBqX(@IySwmVpLGFCoaro3re`5c*qMAgasL@1vzb|@}qKet(B`uUo)jO#6P zfk6-*M77sm2gX>Rb-e*JUF#W5RTf6F{(`_q<@(0O*!b9?s&6>+P@MY0A_O?~am}QD zo4dA8YBP`4n@BPvI7O(!T$~V(Ir1~LJx00Wu*at<(FXQ=2-Kh4qYlr(0u0>x;NjiU-OEJq%e|S{ck~J zWXzTDnZdK_PUt95mKZ_H?rmv|eW=@vpJhQl+*?hpTP5bh>m^$ij4q3sa#U|M4OzsDT<) z25_(3xTcV|Xp#$QX7n>-Db2MADUs^E5hMr>3#**v^3&-P&3z@AO{{-n@iY_;9Ix>l zwtNL`!KKp5-IzM*o-D0WhEtm!P?r`C;Qph?vE%VQEXo&EopzdrpCXj1t!2^lYWW> z%Nq&%Bx`}LRQBx_>-R#Yq?wYoC;cO3>u%~`Jls?X!UU#MaIZ{qFN5ftEwnz_YCfvd zknh2AKnaj+2c5_0av`>_w5L61py^{y6(F4yQCn8#(MpfIam2P_l-iJma{Byjh>*?q zPwLCoKL{0}B$i56JjLe`Fz`Gx{kF7|HpFyC>_JJ*=Sa2vn(>>zE&E(f{E4NECC8ze z2&8zREDI)OGie0B3iKqmyd?ROTu&Wa?vl08qfvx_$b5|PIl$1;Qh#YnE>G3CD&~*S zOpn_&YGkddjCu){bYgZZH9SiA_KISx*jYq|47C?(&$CTXj+QohGE=1gY7ZFU+Rc{o zKTOg?cycccvQ0U$ry{(hUB%@c*q-J}5-q!lSU@&S2vRN-K@5~pcgF5zG!00`!aMIz z2y`!xMx>At1Nj;1QUe+0y$8d?=O3~%$_UW5#m1LSg`?xYQcix+D_@O->_sIot|V>i z0#)IxKRIlai{i;VzW)AO!)TPAZpjbMgv|5jLS1iU_XG3MG4)tio@qW@6uyiG4&L#z zDC{s-Y@llnVb}KrmcR{@=#wJl=fDpN!@TNSuqSWy@XHymUa1Q9LJ3O5QR=ZqIUSir zQAJEVtFUDk@^0%Z9;y790hVOPs&ro{W=!l8R508`ZT1ei4w~nsDB8`H>j$ZOpE{|ule$&Rw$86%~H9fJA4xVlE>zk_R+OV zxEWLOI}}yi8BHYcU7~ZB=py4hNu&H&3dVEHKXSy^{D1VO^fuPXs+#&v`PP>C3%b8< z)?k;Ot7u`$lQD}dMHY**)O?C(v@LWckgbyG6Np^JTt?yRY4p^~c(&YBz!BQU-t4E1 zni(8WMyju{4-;2j${i6+tHgFE5KE zt`!UKezT^)gqQT$1KKTZKfxSo%e-M?&3v#|jW;JxS4b_EtEv-o ziMq2YtEOFGz~Ks`QFS!p7D2cAZI`cl*uMsWC4{9fiVjVSnVXh0H{Qe{@0&Dvb+6)e zPvypnyqqL^UKDLL5|QIPI_u9Ft_%iy6H%#t5%Grvi6LtiSPvPu3sp~|vYSS=QSjrLURdXRerB}4fuEj-ErTcS`#`Do?+ zovd;Owuk8YHu#)eRir|VCD-<&lFa^(o#j6$}7JiQOaW@7FRJ3CAisGk>;rXQu>hTC}?fl)iYa>s%Fae|Hx zHJ)<{51-A%vOK2~o*Rk7h5HKVH8_GBa1tNrr3}fS;v*+bb&g><)3j_AhPbOt@9SeT zT%Vh`AW}0fGHfN7g|n`)%+f*l`#!c!_B~H6CVYr zDcfgffy*NQrNKsj|37K4|Kh$o30Lr_K&mkOp{uyzrrVt+PLn^O_j|n@+@6w!zR_kO zHt(ecKXi)h4;ThtAUbW+k~JgEg8yvLG zn{!NhW%pqVbCgFlO$-#i>54-w?<`!|SkEED1@z@`kmz`)I;`cS<55SIV`36(?m8$8 zpC-CqBe9WS&PTg~M?z3J3CH+ZTteAFa(S>jkyteG3_9!bX2&4|X1h*up*ki^LNvj5 zw5?5*xpEPD>*iLBc5s*>{xJziGU>*-Cy_s~2nNUb4wkBhdkNq|ApSM~}(1OPt zFC5!p6@l-|3i;OLCPdgji5>Fi;lV>+o($96lRod zeG743(-iG@vRh*q$~PI`KnXZ0>(f)hPDkAi$O!NcnUdJag*J6TD)w462m zWf#vuo9_xOVlkEqmQPWpqbL=cda*3gvsxL6Yd*6iO%hsBi>!xtk9VuK?5Xzjr&=^G zpE%S$RIbp6xEUS@hcBl>~-SvA>%HK2K4oZ2E* zPg2>4h5YF-`RMPB`O!ZwZ?f6)kW^e$Cn%K?v@lm+1OJkIeA4>k4({16En@X&5s@6+ zoC}CpVdeQl;lI72J-TQWTST^-T}(LxEw1Y83m-IH*R)*Iji8R|mwh8BKK9PyGpQbR zqnj)^q&hXTlD}NeS~i7d35LASbuc>1>d=t_Ao{nBf&SA%lmJbz(C+eqDrI|j3M)6Z zKnj$wF;OQvAHE?%O*fh|($~K_cHOJWnNC`gr5JSS7S(zFsK1XFc{D5H;@cc(xRMp$3C5T$t7q=B{=kNpe1Nxd0P zT}iDcAu8|Spi#AWbevTMFxxqAm1X>Y4@75JKFuJ)7NKm?;tu3T> zk~g|&r8e0%LMl&IlYTzu3AVI~sYo73QtBHZca}X&n|2ZGmy>2oxoxQ5?w}bvUfcTl74TeN31iJ{Vp=q+qP^z4E(D zPRWfJR~Y_ZJx~U6+L6O>#~wR)l}pAl(yGi6W$64^GTDQ(->0>>vQOCL6M-91_nH3}oFRAF(-?8uqND6(=>U=)%ZJ;#jF>1lQi?FW35GO?lsikScn89}hFuw}>N^^KQ|Ud!7tGdbSIuFzb@r4ky*am|yXp8lEFcCX$cCC#7rPgY?;UQX$Tp zK1o8hudP#c1NHY*$D*iB-Ch2}@qMuJy62R*q>BTO#OlXE9Lc&BL&|!1bIJy9C21*g zR>!~TV~q8W`QWaOd}kDI>2y9%Tcz^D#eC=M-gF%dqJ&g^e4dvLR$w5VlR^T?$7q>6 z_CFBgVXTf=O}KA^v2S_PzhxYQpg1a%!TWlbCQQyZlZ1k)`Frt@3U7N(q^;%iQ&%m~7qU(#0Wxx5xIZ}OTGdsnaP zR}V_;(=hhgZGNWfK)twpCW{}-W#DB^EM{->bJUQ^=-SslL66L3vt~0C-<{gkmdhQX)w`6{)2z-tA$nKWj^z zjUr-PRVMtYPY_r+5P3P-<9kxnu>2^cb^Iu+IMNx?p32QYj=^g20PisITwWH)%l9nhd~(8iD`YgH2m#3*UttX-`A%m;Ffr& z1q92oqk;Zv+kxL3-@poEn??V_nVOyHe{-g0Wn%k3QV`ugemBx~_#eO95}{SiHe%tP zXwW4{yFJT)&l~mAWS{GO$9ED4QpGCOJTiPem~Pwj85*dPNdyJD06kIRqk$&QF3ucG zgy{)8`{9QB7lNHHy#cxb?`w1+O?{zSJ@%71OmfbxP~%}~ldT`U+uWGvB(J=fn%tj|-w}hO%D9+SXIHeJYe(_EAx$z&oSFe;Ey;HK$Un$p z_vu4id^yqu#It?LPo3IuBa&h-(%h(0{=P;LvaPLJKQoKAF5rWwt+XfCKP=&afgc~m z>P8_KRBI$0Js2+D(GbT&>@1$2R5zSSm|s^LMG@y8H?XSxIY)u=qVadHZ>{3Gld+n& zZ@rU(8HS3d+$_T)w`r#EF6`2>CgE3AbU4~#3u4h~1sZ=HZ!-SOxjSNh8bl5`f@LPE z2pL-Br7w%$e;#+~J&%St{3@QZaSx^y=Ee}n?YY# ztrY31sOAHNdyu!fkM9xHVAhkRdrEUaZ#mg{4W0Mm3hU^wQPB7()GhOLom1lDN=qz4 z*06=Hz@BRo;iobNholff3oac$V}&HN*pD46yQeve*Rb1*KMw;SckCFRQF|EO7$kX_ za9N0BQkg}gvbNsRJaBhiTNN?+M&j#snA$K!k8gI!c*`#hhJl+BNG0O*XCH6)vIA|Ab?wh4;9qmBjF<_ z6HE`1imTEgzB??wauMA(>mH9BJ|1Hna1G|mmZ4gbzEqH)J?FHz6w50Bo>*3(H0ewENe=PMmz zcEc=f3N3f?Jk?k<*J~5*!6MjWe)DMNse2?cUO@qd)!^SY!&E@c2%vn6ozt|V_Nq%A zYQig)3KF}T)ICj%x~ZQ_2{Hgtg)c(#vyqSonPa#LnzfCzq@uL_i!Rx67;(^AYzYze z0J7%*K~h4bm3S^m1i;}{nXV{Lg*6{;u`)!f37Fe*>1I}sLEsHlg+-`_u5`f zeBrin_fbs{HXH=LqbM{hl!`h<%}z2}W+^(aCgA3%H66Ufw*aD`4Rm)U{p5dtj0*o0 z4WkZ%BxtgjruWMy3*otm^e|`7TG6D53wzgs1AzAbWkLzFX zH1I82#x?!o+{WHVxXXJ?Tr+`y3piWr)gou*xVWA$}2} z-3N<76Xos)lG3s09X{wV-q{g~f>ouGQg0wg0z|E;NbEXm9Sd)!SRW1|3pp^Mc} zE1&?)S9x7|*J7x$P1G^xb!$r(Wx~Ga>gzXXeuw!EqOV47(VXkW04i}AJ4u5=Iz&~o ze~%pmeWn7bCyS{-)3cS`)!DrM>f@R*(UGD*Q)I)g*(x}mB@@ic!KbMAP0zLHkJQwY zbyP7(lDN5A<4oS=v(r(`VS#sBl3-oW^|^6S|Me$1b$rFQ^}J+~Q?l7btPAsO1uXQS zGuV{JzIOlpE=NQEP!Z>h$kNrS}$ta-hNihYH+ zuDr8?h>-x`w`UhpKP2-S9bBuI_g0ii|4yWUOMJ?GVKe>3XU^!j7&XT=+%0Tx7~T{{ zHhKs&e9rxATD`8u`tL#2dMF(OdA>}EXB;LNOd7@st!+INUg1Ik_AZrYUKM@%Nn)4! zWP@#oBT)q?$FQe;0;nsMv%vmyReL~L=i+TGfp&l2(4txS)#y^>QjMOh$)g$205OuN zm8J%7JoQx-Eiw1+jAm}u&V(!9us8uBvp zvs;y;XQgvL53ma~AdC(irog?JVR?+Iw3REA@UNyP3^scXHm_(;>+Q-e$HfO0T>TFij7a;l=mxTsM}N(C{{$QB zDsMVx{N?ddR>kwfQ-m;mnhz9k?|(S)DAVKoL3)TP$`_ew_ip`ft|6lJ{m2ile?y@( z);CJSO-%$G?0Dk4+neb(*oB->g6f0=`wo^<5E%U$;7uuUL_<2nS!(y;nwK<`FyotE zullJV6bAA)oLxh2c1n_-3fm$gXfy5W0s$fdUr7`U;H(k{Nt2v4;I24|`Yp0uO3{V?}|e*_Jt6r;ImQv`HW`IhOVTD7oWNYkabpt=DK3>#F&#AABm zhcjdvE^A;@%6d1}GaP5#0R8Qc6~WoUrS*~fUgH1rUbr^geAE!s4enMmUt)}j8GJ@N>B z3w!BWI;=@y*q41Au{v84!l1C*8(?|cu0#L=M87nh2wYIEj??yE>oJ`Iso3WbVxCFe zQ)*!*6r3#|E2{lcm&aW=s3S4Xjj6sOL!o;QLK;EO41BFireEUhx7Q_<=z31u72Ox_ zxqwRb`cFv8yhL2Nl@(du)0VzQlW=aao25bg2TtZ4OAPH)1@9?e*MEY$c@^R_vklpFP`5I`>&zRBj z8y9zC^W9&Y4Z+g=l0Y2@414`y{arWg70I@0$+nR%Vw^DFGUj;n8|v>w#}!EX(1T-I#6t(b{Err(7R6 z82)JO1S?um52ldUcNBIVJv7@shv=zOewuMkz`iFIhJ;Zo!~b_PPIjj)hVaa?1w14k zsw}IX^!OPm1Dxdg+V5zPRdkJ=C4XC8OVDCM_4VcBr{fF{OjB(Zx_XK+_C`*^0*N`f zc|_V}*v|;q_;?Ik_^5;ZK~#5jbza2b# zA{7`p0N4+r66M#SB3P(dm}X`E&s8FINf;@XxmTW+;6)cBLGB(g8NTdCY$p()C@w3a zNp{3fhbo+-r8H8%DV@JacfhMcqydqJ1cpQmh9T0mAeEJgUir=c^jsV`5)EwpoU2es zU8KiA+te8h-bN(B&}%=r{R^{@MQJkUZ>|)r9K0}uQ#-eQvD3z&<#$hpzu-(kp;$$8 z{b=*;g1~MaPe8-ED<-=y+EPwPa8l>u35%{h7hTF-aGc$S?iKi2%gici@c>^iu7Zdl zpd7<=HXpkcSc_blR`Gn;!M3Ynor1J#>ZL0R*EJtWSg2bz>~7XD77G)$Wi=2 z(uoF;k-L!54lNntN%SPg(Y@WIfOnWFR>_vT%6=};_YfW#E9_JA?$EJ2__+*l^Sv2T z3Pd%CqNwRkJrQ#0wYiK~d>iE=VQ#L#BSU+Z0C^F-nP!cbp8-Zp*!H&lEB3kz@sUjI zv!wG4z7nX~izdKv;<>*f%fz75 z+0L$f+#Fok*lnPm)QsyV$`pB9B68d-uQ$M~7H7VdDZWfDOZlv z#z^zJl`Cm}OEKDf_noT?5}X#YDTJ8OwZ!Vk)Y5Tv*z4qmaw~_D-AdlBrrCtO4!iPH zNnXig0rNqKk%P=;9ou$EU-ZsUkd62W6g~uv zpfb*Hy(}wi~|6>4#S{i zxAQi~z?+HDX@sdx=4&02FB=lphv`zHOIUaUvaw=w)wkEruoK2@IeGE}$XM*fO3jV` zH4q8c(>I3ktj{+2N4U!E_oplQRrV+i6e98{?N_hh-eKq9_$qRU zL$Hx8$}uPwj!eu3Zckac-z}WX5+qMVT%EM1sYnP7FNY@m>#q)2K5vYhy&u|bMFk|YS%XUWMG|GRu@1-Q}aU_a|kLMSOK)}ItSM;oGdl=VDX6*939i zm(2XWg4T)acU!)CX#&k@B8aBQg(VuA)rG!wgPg#2;6Of!o{@Wa^G1;s@X$j%E!pxJ zS&K|`>yAwN~5f`Z=7ihK9QU+lxb zf$iq`Oh(EXrYIv#8ZBwIrG)eBr3>lU=em{N#3B_HDP#bE}ukhyeN*$F5MIuoZ zm1pit*X;@L17d@l_T+yoGxYe}kVO;>l0qKKDj>XWj{d5i=owe3b7=HQ=S$U0jwf05uUV#wI zi3oKWdB5Pa;XDLcHYZ_0Y@i%8AXqEj3U#g{0yGlOzynx^g+*SE6nepW$8xlUg+!6M zX(@Sh!Z5s*!|i=Nqi_-h%js?`IiU@@Cr%08b6hB6)OyAD9%NlE&CxjCnSa^KUdAgf zM|hpQieJm=wq6T`M>ypjR*ZfF_{MHW!d0+%f*a=YQ+s6r9OJRY_`{RZ0Navlwi>lk zH6}hszPIPqDB%nXft&Z!0eP~t<5jC(*1CjPiK%4*a^L&Dy^O9GiMq<7w^HHArY9S%Y{bpP+!X z9`B6%7a%yo?(H~VAeTW^!V=(kU?`%e$V_l$zFM}+DdJchxahy3kcjeo-is}X!r_6;2L5Sl?e-{c$ZyMH;BQMRC#;?r+o0xtP{QKEQyMboG;3aT{vPB3Ogh`}UbDDCuc`YZ6i^~% z9`x>oS<+Yt98u+SrzCYS;ksgz=fm@2`BPtF2^~@mXeL7;)lGebSl`F-sZFzK$6>`{ zkH8txHP$)*)19BgYt*7WX;y}#_(M^Xz)j}X!!NGE^adJUX^iB7>3>QV)bH}AZGb^BC(Etq?)!$jF`ZQt*8r zSV#v2^gk`VIsP}NSymRN{{tl1`a!Nq+mX9Jex4rgGqs^2og4MB205C(Oy3IAn7{A; zIQ;-0$0%f>vNjb2xb^c&RV-;_p$$DzM)?8!{n3$uPL2C!KfaCvfk0@^0GNV6xt&0O z$NQe7KgbN*|oF4-MM$OjuP45#fj<+IKILC z9US=XK~;4Bc@Zsr^LS>cE|Pxd^f@VwJ@_}p>vML|P*HHUiAhy3@U5Z~KtBU7XDd!A z7;1(z#$-9@MV-0Kz$yZj)PlW=8d!BXAO4-yq%8w_;(J%7oolg)#Bk%C zIk8UG$a1`w^pLDcAh-tt%XgYt7(`u4g?c*^0u7Xh9ggkhWe`cvJC-`|L_j{X*JF7$ zdZYWt!KfHvWfZrpFF;EROZqT>Nx5O+&x3`3b6sVJ`gq9|xrU@i#}upc;KlFFwV-Hx zNB2KA%j2huELWpmu8gw3CF{FwQupMRDUD44p5TZEQUHe zo&qJ;o+@ZMfh3KWPo!ryQQqAaqDDYpDHB=OiuFMXJquY&Yez>rST!w+ZlQ2nkN7$T z$KO9}5w=mV0aV1#grAPz3o+a_8N;a z7B#*s7upctM&xko=z~fqg?*(Q04Eg56Y^461<~GSGP1 z|BGSGQhz!q;!M^rU$8yRMTooemmykoV6dmUb3NM1+i8X9LJ3AcD#jC$p@5kB`S`^r zo9^wMA@A9Nh(t08`3$s<1ip;)U zStKvoK&Zf5W2vlB>%lQSgREN_X|ri%_WwNO>C@?^75Wb_88kP_sY*>tPq@R?T!=EL|(qC=ue zJJ>qBSKUh;#9-CsekC@sEAwsnIH8w+mM5B{RA#bV&T3qQA;ek?=Mr<;MY51_wTe`J zM2Z4=XHoH`e{Nep^m(OLzM9Z5107H%vBF5V2t*OrB(mr`hBfp zI1lU%dS4Z3;>X*3P2O#$K{Xd$#B4$%8_YmHtNcSBi0`vsoR1}@UYyF3&S(jsSYrqM9~A{n1?1-1Al?%P z<@sOOQJ4N&>B2mwS^7kC?MX($(s0Y5?zg+n`7JEl*{MtsC*1au{hNZjD*qlX48T}i z75t~BQ>U*KS6-k~ONJJ@($mTxIg$k6$=s+kCA}lm*f<5_1xgyJx4nTqd{d_Zbiz}f z7;z?qS^=D{d!b@GLk}`7M}1-~&Hvk|flDXmJl)oM;AEn?J=_sfZSq483!GN4Uh3!< z5}nM81PX(spShZ)0gRP#SI6JqwE}7=ofWr!n=o9m1g9S14z(H@=qnuW3q~t&w-cyV z?WadBhatoWxa=K>s<|O*W*@rV7(68VevS20FW^mwmDiwuZKYT%9APvxQdNM6ecd>Q z(MQU%C#xQ9K&FSFv>{k^9nBk#Gz=P;hEz*@dJCpggYu+FV$gYek@VRwEv_(M2<8-u z=hGz+uSUqChKMKLx?s=m7w2@~OQT92&e2oL!Y^9xPsuTu7|J{Sdo5a~;4uKxzO`Xw z0bFuRE{t@)f#lWFoGprbPYFT7O1}=@KHI*GdF`rf45{f;S|_}-TGP8=ct2D9qCuw> zlpySGYmejRVARIQUy(IP*XIbY%`RLU8I$DEsgGJny^fU*w69R=~yG}XbUtV>a>FZK~5b0`5QQhe*Kzqa2h7^;Eq!C2a8O6P2B zo3UD@kRJ*&p)#IyY@{bTmRp>YJgaMCt+kQ2vD7btO^1ThL+!BsR?!}9{q;{e4GSf5 zbaK=-H0~E@*>-~R$v1~;tRk6XmTdG#iic_h`ohC=@qm8W+@y8wOt+HOBejKk29m#_ zS`qIAEz_Vv*hD?~M1hlhczEh7ZXdttSnkAm^7)(!={|Q!wYzrSf!1n#2=DBv^nB zGzref%spu5|L4*9#GWM~-}>S(=X{A)N5d*Cwv1sA^KvRYmlJ!X1v;yUW!K;fPouBGRpODPZz1 zZ9DZ0TGTfd$*6ywnuM;!E`NE*duFV1>o1(Wez=p{NE|uaBlFsG_?kKv0tj3gPaDQ( z;RiV2)I(wI(%g4ytCAkX5wdWCd&Tij^S*Ul3OfTqyC+v8jBVO5a>?CgKQAauSq0~+ z_&LP&u18nzj^qM?%&w+h#Bu9=Cwg6t(&Qp0+*vne%Z&WJb`&73>^)7H@pmcl17Elp z8hN~gA8c~_xUQ%VlQUj>lBlipQ`$O{&CxTcchUI0bP!G#XnnnUG@`Li2fs5KeNc13 zd%mE8sML<;oGMVu-NuN7wcz&#a@}COea&Us@uRm~+4W)U+??y7+nP@z z%u@Jo>MJ+9*0M%O4QKMGm1r z0?Ov@4vO^hO|#7=HkRy7*OcPaDWmU7^=ZNZ`q^KAz1BQq6 z1s9%R^n~0`@!w`-KrJ9yQO>6vpxSBU(vz7`0atB>%t?+kK7W^vy+oSN&om8AL&!B{ zJi~-(z`_UQh{--@;3|WrN;D(gE;``_`C|yOLBk{Lr*U0;S83G|zeD7$GACQU;+w_k z3g0#E0{Hjio-r-6pkukb)-l!Kl-!b`B#h&;IGC#&VP|~7(%(&>t#^!+bc4D>3Uwwo zQ}tp*aLT7iFxSN+KDcK#5dX4L@|ftw6DO!-r+Gb(b=TCK)r`632hnyX=L)Ls+4q99vFN8e3Eqpof7K6!XNW+6i}I-4t(|J7?-g}z1W>k3-bG*F74E)N24ts*30&k zI`9apI*9>5Jb|orkOlcP0=+7P2-?I4+8sF(@jd~)3JJ!5*yr*1Nr)Hpv{e*q z8Ew%T{3BlM;AD{cN97&VM3?|(G+sW5r}0|FVa|K_uK+gioP`iCNq-n(u+RUf8N!8* z&U?vM0IWiClfO6hwfc3wkX)#sH&K&RiJEIG025Jn5LZ&({535?ZoEF%rS2qqspxnw zD&cacMO(cMqMy>cLwx-Sq=nF@==U@%zNe8cQ-?{);P%aPhsFZvS@VT9AkdJFGD{To z^jXfplukRBG=E4c$MO2U?b}%o9;jz#Rq8m{@t_BIB(V3ufShF4xh?}#g!_tJqT2Fi ziQ&&eHa2cZOd1l)#r?pse4W93p5ZXR?vH-(ox`Eq{Z{1q_Va=83tsre+30_oXSn}Y z^9&O^%m05nfAkZaIq3L*R4N);eow~b_R`)Ai!Fn}diaDQmA4B=ojuNRy%>#l$xk=dG4t^higiQ(QnY;N(>L<{L2smin z!k76W`J3t`Kj?8Qf~qqN4S4zf6ifwcRxOs4WD}*{zmJJUl)7QcFzR5$kLZFkx3m zLz==3<{g7i@&puxW4kL+3lGqh{+5Z-gpdI$--IHk>N4C*h7Zdc_&oE-?MI!y?HQgm z;)z2+_aUUs2Jv5HazZKNFKS$l9A3XPa2jzPr8mV(A~<^hshWAt{?eG|GjE- zH7WjH1l3LK((P+bJ z??!Ow)6OUc;>gKDbBCv@LQw9kQu%W3YVp@fcpy@`k)z;69>SKAkV6Dr#@G+;%c8 z7AcRD@{@ocVZU3ch@~--pSf;Q&0p%n3D>iTb+?RdP`;6(k&vvpf~~-8aEgWOY7R;$ zr_5hK8_)PGd1YZVQlJ-N>Imig!3nK>;WeYv+5quskjabpNd?D*rxdtn4`?LX+ms)tV8KPYc2c2-7EM7DQ|@Q z4yFG@M^eYMvL>ja5DSA6PLwd<_GgoiRwAcwv$)+PqbIfSW&m4S1>vFV)15UiwerFM z9G8tf+hK*4?gIP*T1u}=zP{xUCwmG!NjI4Fq~VAWGLOI(cXbL0b4EB;^tN1@QH{?Z zb0!Sj$8=t6b#prXOJfw|e48%y@*F|+- z$PDw^b>yUU@{liLsi(1{I8pNQ#EHzbYLBe_#l?0-@{(U7bhEUxQqF>o{S_8Kd4+YT*iBso z4b90Z9a@8fDa=1>N$aio>$!uJ>O-<_8IKKQkw@6~d_f_JgiB;Yy|knACy zMlfGMg-o-LAz=EswL-|twrj;~Vi5ZpTxx=9NNbZ^2fil0QY3T$A)1v_d%BC01h0l) zBcq`qzSwcK@Q$lgi!g@YG;EMj-ad%T;g%Jywf?DAYJwidT#c2xsN=|_=}=`BzWjHS zX}jxRd~{_wu>~Quk4?$hC)~wUeZ3yWmbLjW>oPP5zB<-1a#eD5oXNsg`5x~6bpjK& z=R{*@YmY>2w#7;!yR|<>8gj9I$L!n*(h~U|*SVWlf%*=N&?PF1%z<(1zmA#5&=1Hk z^ph^MPtzHxmLPjo{3HQ?iqs_5lUNsbP~DX+&pk#rvZo?wp=)bchob@?P258 zu}_EWd7ts-Pd_$WfJRN%N_gOV2JFk;$Q?e6LPQ-pvv4v)`%G;xC!8_(YaN?44cEsE4nI8mrLZ2*0y&i6r_ce4MyuEHYUuohmg-wCnQmV6uD1E`?VCr+Go8KsVq zynekR%Wpe?Fz?!r?*@ooXMP7QD(UOh(5LV_=phff@HYM~Bu!F+XpWcHsso6?vj!Ye9E0#uh1(=L)@Q6C%*)LSzxfVH&#`3YR(RlZ@3le%`k7 zBGGF3ySjgwD0bm94csuE+U%5vrO5dLANj}Xt~LE3m-;Y~`0aODZ^0r`Y7B-!Gya7y zOzTo94f0Y_egixrJ21cQn+0{AR)Z9QIQ>v&$kB<(rP#}Rm3SPR9S0VafbNo1t;O_| zG7z#Mwao(H=UeUJ^7B61$<jQcIT(P7e+Pg~IiDRRdjSlpQD#K`Fj6lUD>z+>|83cw#(2 zz5GiU$yXS#^+LqKYjh8K7Nv0YzfAkJI9D1)&k=Y1)8!b%@K#dgtft?6TSHWx2aIa> z?%V(qO+V*y&~VtkYugy_6)tG?(=%rvnu54h(n~iJQt8003`;Tb!+LUt^!9PHmF3M% zxd`b#&?B=e7l|Q8F9>P|n5J1n(&+SD79(W5Up-5SL&>l=mq%$FL_o)_XAKY*&oW=` z9y}EJxy*q--7?%;qq}T40~xii@t?L^Uhn!l2i(V%L zwG_Zujcic=YHup!&YGqG&@_i@j>%Qejzue}sM+d>l7hSv+Xr zox*8v(kG1WZV423K>iFu@R8TYIinW1*QFGY*y!Ux+>mfnwQVyAkmPFHcoZE;Y$@vV z>>6)A#e8~%!b=Im%}vTP=EJ#r@G_HAx>X5UOlz_JzWNPo^l8-zhim&8(*?dPR8$Qm z8<=LkZHVs{xb!qa>ceLQIq@{Lz-nTQh(ueGG1|xj4$#%*S=&v?^LfX!E=LW-+70r)FG0WGR|yT`8x)iS`u~`k<(pUAo_GiqIe650U{HH?mk8f}z(} z_cS_%S0;9Ie%c#SFH)xzJ{^oxAAs>o;9XO{kPf*G8Iy5k1Kf??O|Fh*lt~wa`BaY^ zTwC9B2LAhL>sXXG2~Ikc_t6jRxjN2>?hb7aa05y&(%$=y*!^MQ5Uj7)$7Kn7DSznF z)iQSO;nP0Egy5hKl&i1kYXnG;@4IG;{Ex49KpUImn_PW7`GU{44YDMXh5Osr_38C| z?YTxcb#3?OocHI^F*tE?&mTR16cB8g+}b7tb)I-)(T>|JBsv*oP$OE}`SRg!)diBq zuR_zpWbVnE0tz=ynM}I|)OvBnDky_qaLh@pIXvF~J{Uz2M`P^SDZBa0w66f8Hgs9M6?!*(7?> zZo|nAniSCVlIQd1fW-z^lNEas_f$P}aVEF}McG6%W3$fPzK zH0NUrq0NcYq&hC@>in79N?{#G^)K`Edo;aOX(Q#v@>6@VD7!yP`*=XC-6?UByeI?q zT2}vN04$ukdm*H%wS*&yih>Yo!BS{hTmYmJGcSJ=d@`g{Y$Q#geS{F?gq@LLr~FfzeimwahT+DEXx$BZ4li$&Gy|&g z8fDHXe3dmb+C^ygg#uG=(ovkUhay@XXP+$kP)?xNenjLc$gdOf#48WD5Mcjv+wLzw zDAQ@I!K-J9y(l-%5IP0=!sv>mtaH(bz8JbjxtBx$!fMR4l~jxCJa^Nlcpq^MiwYk) zRokj_j!V4YYjpBylp#dDXT(4kASek!u*(0Qi$SV#dzTJBgXy_48rtFR#f|!=xQEd{ zQm3f@IdDiZ3j?^VA5zqiFubXNLvbV`y$+Jjc%VAXMbl)HZvLT$cP4kddg4Usj3>VJ zIWh@kEV3R%&R8d5Y-q(oSZXL7a^YNL7yc`IxVE@?id%pBv{aQ`HF3O>wQ3#iPFy2N zoJ8(fxm?Scuza6oNp2^RkzAk$b~c8~4IZFzJY+`_?P~rVmNC%_HYBj9VXH!0^L$04 zY&}^;E_pM`S!Qh#e9 z`>7V`#xHO+uBB1y#G>B{iH5TXirbSAe6vDOY&lYD_kEod)j=MK*L#V8V~huIgQs72 z7vlyj>(ma_`yOAmTBN21?9GCv6JDv zhk9T9#4A=a<(qkBK=W_IuVpNHanuJr) zDS=kq;R@VwT?nkqdd>Y6*H&qxBrkAFbU_CKYuFr@pk#Xa99FdZ)h@!v%eOUJF?dRrU)T5Y0PO@#2sMv5L#wgFa(iLv5aqDFCb>76)ntSAH&-Qb(P^efK%BL%DY z?k5|^k)jFh%uYRLb=&usJrVO~K*>D{ONqswzOCChw|^xL<6MKNE%=%~tJbzO(dl~L zge5Z|oHm8t^+MnMu-7W5mUXuff6EAkP0Q+ew-Fv_I~6y@<+AQ~w&=~k*}O&x@t&QY zs4hI3M3!%gN$3up_(%i6foURm;OSqB@Di z%M`*X2IaAy;whEkZc3i1!%l?X#J917c9%r+NEx3kz4Eg6K4m)lsgpNMG~Xj+Z%6u} z`Zk=M5*wBb6_%H>t?x}oT-3J~;)Uyp!c0NZB1M!Mcm5oOh|zkR$Fk3-rrTipMf8pT zW9?ewvX*ZZG9%ae9q>7?Q; zhGIA*_K)ybz24FS3_wy+BnF><)G>pp-fnY(Y#*LuULUKj!8GLsFmLp^8Dl#~m9;C3 z`z*mPhL;<_T^6@%W5WR+oeN`?4yjA)5F3-xCb=wM(v8^VtpkkUq9?bICJ|{z@*!ur zgnGGTC$aj((a>!@L<(~HYj*%y-*YNCNgf)Q=mcCs-g4@1oK81fbjB z?HJdkTHomlB0Q`Y&~#Tu_r);+DQ8=LpFd<7*K3g2|27T(Zv*uIXu&rBECjI(|FmGK z-oO@We1JglfCs?68(DrzuoeqeZ!Mi_$>_9;_D5OzYcxNu|bfVf55r zhB0W+tv=2^?q0>(Zj{_V+5dfi8olm{b=tRh9=+b(s>^EECa#7=CF9h4Z+yF$Mvudo znGK~&T}$7`S$fg=s7Ss^Xn{5z z_CX42!)Yru5UdiFLRCRkNVHwZ0?RH!OAN)o{WG{Y{@iktW+T@-Tv1?LGCKsCaiXeW z$FAt6I|8}Fq!|x^T+{fJLTq9y>OwuuW%Tryj^cQAZ?k4Kl*U_iRE0ufeB@$4Lvyf) zAiX@|SOhJnNnHh!mcmvw-)9zYll}f!h`?lgVisqUD`JHLY9Fl6r2U3G^#(PPv2h+n zCU_4782?L}_XRoqP6nQH$UMb$Z(sIG=s0muzW?eqvkF_A={jnd!KI7Hq9lH=O&l2l zQ^6BeBTQV&hlI~U;XNe3Q|1n0x7&;mqQ;t2TgJq>+a3GPj&*|!y-=iX3VlWk3=yvo zM2(31rnTU=;i_IRK~}o8#KE~zA!383$x9JYSowWyD$UOo)G$_V_LsL%xQe*e+;?^vlgKeDO!&-|ixj2C&quP*reZ&~^V*t; z?*lmVT4bh4ES$v~y(N#M# z0NcFnK2KJ?-Sovfe+Z27uPAAD)?H%&Ub#PUroxD;+_wgrsY#ewb0>D}WY48bX$oOYl4OSmtpzoB2*S;QSG+FwH&2aW>(H$w*e_mVk2`2o z3dE9BB;7)jDDV33_MQ=$7hDr#D4D%vzfXIcM$1xr0rwRaW9ca{o~-9z<53mI7Y9dbHF-pXm!AH zRWY?udF4C8`v>hI>J6gF3uDop11ayUeP4$v{D^+&Q}Hd${uN)-FgbBh6-J<%Im}k^$k>|cFR>+8a3);NxpDGCpiG2OP zMF>gU?B2WHDr2uLMkFt1$_dFPni)6kOg6T+*XGz%aiyC${1JVwyEWL z3dO>WpmW;f%+e9lbGsqyn`oBR@c!9aTvFH(qA#}8<=I;)v5C~&CYFh0`+Z{q^Rk=#S)o}5^yUB$ihHtEUp*6?K*8q(N zowTMKq1`*!=Zl$K5$F!)TU|YW7lkz!Hc)6=Kd+h{DiH!lxkG zH}VeA3mGe>SNE)I8)Z4zRlJ7HCHpySZs)Aa873s?duLnUh-5pZYS5QGlBLl+b)w8Mf#I)3BlNN^qp+kvwmg6rH#a> zP)p!f_Ab{7un~Mml7MzuR-eEUskT4kjz$~oN$c95Db?c=NLL?p-8Hsv0 zmBI}^vHUB6`h0-`QO2O);As*%p@c8@uE_vR42rioA_UzbDKbpuUY=Q2wRLm!4e0Jp zQ{@T)&}He$My@AAU|}IW^<$VV#Sf=+w;aw&rQMS!fL%Eoi<~ZUrw!enXWwRqdrtcu zKesiFU!8O!qoC58Sk5Nx>)4el;;EyK^NS=>oGN`DO5ez z(R;JS+DRg3F|Wet5v}AiUs-_Qk-(d)!>dq9F>OJ6+`*O{a>W=hMuF6we%O z?U)Pf+_o$m^jyb^o>;u&8-6OP>HKR%X9${F31!kpO7mLt#%W1B=X;*jZSmB{XUhXD z&~$G4clF=M5baJkDC}#YRZ{s75Q^MJ#ZU@S^1BlO+ZV)Dggw1Qj8=!{Y@Ct;i`t$< zXc~x(Y!v=)C@*@+-UJEQp7IdU!c=o|m?9=J>PV96_cySBqQ1#?CYh+nAI&CCt&*Q> zZ*I)X7g2B%Ag9ehf(;ttEJ(>loo2(K)MeMWN6izmr8eu|FMmqx5iYpW71hgQP$!J+ zr+?;ndDGL=`>YOot7Vmg)pq*m`KlB?V06^nNPc*YpjCU9kQFVpLFQyDV`-&3_1fH= zu`G61l>NYGs9u|RQJdN8y4zra(^8$OD{~_{$yw=h@1KcuohewgZrVu*7gn<5d84E; zR!0)?Hbc%SLu^kP9OR0X>9=bt`9pC1HP)DCbGkDJ{ zaM_dgJyc452Ikfo_)!kESphU|a6--0`kWQ=o`j89Cy18v8UIu+VSu*N&^5qU+}u~< z*^HDn2CVO@A?fe_B%E;8HE$Z^C6U8Jw4n!)4I+UhvZ|*~{hfzpPKWQ9#x`E7URrtf zM?8q_|0AyANLKImWZYq36IZnYu%DrZA(H*aBq9=3bMr^lVV(uJ$e+^HW!r8LwP#Hk zHFAs1bb0p$ictsIph(PJ7W zaKL90(DZ~T3(grYdk-UxYR=rfN77fGJUB;NGtK~&6A`iyB+-myDRGX@XXNHz(&~0g zxFv8I-$fl+{0|(-?wWAVhw*qO5vKu{qoGqGmfg!rvgnc0Y<-u+G-@xOw2gKr-DY;* zruAkY-o_zYoH|1LFyAzOP{=lb#BAtJSY*Jp7lziUwiw7nsoLby;+@(xx2 zkRLlB_~zMjUcskM)8W4_^oevzwd-p|6yitCxc({rA>DqWt1KudUr=lU5vyeGtHgW# z+;1zCa4jvxPJ0Le37s^ETW)w_QAdqTU51e#wS)_EpHM2+dAuAAMj|cVzy^WEUezc^{oSjsYdvuq2StAM z)mt=JgfSkSU9-IrlDl~>u=y^~T|(fS@x!8YgqdGv&(=3hJcj}e5|P$x-RA%44?ukc zfpF|*!@LA@dAs^;&#_(UJ~=)4*P4|3KLAJ>g87)b!CwKEV8;7yE$o1Ro@IWnlhh{V?O z5yO6J11x5*VxyvTY>B032+9)^FM&n>22H3n|AY@=rh1J^=^A^BK~IeOLka;YNg5Cp z(ZnRB>-c{Vl(k~?v&aIc*?V$p^fzUo?>+&~)2{B}e;#w&RNDiEdvQ;h4i8@dEC?lk zO>vk>1oqoRsiJM!xh%&ym2%E|j!sAv1{NW-kyNNf&HpW!aG1%(28X|5V>sTcS5Rot z|9x}Eh7};qk7_4ruaqLXqp+%Ji&Y6p1&z6NH??a4hHvdD+FPOTitdoV@13BsSm_#p&obob2W48k-sv7ZJn^E}nS57GSUbZ7SEUtsjh$bQD zzU1zZW25dv61y{K%Xg0-Lci8K>|riRu9ey1talngf4v4Tk-C^1V0(!1zr*4}CMj@W zdos)@=NDEYyzwdSif;)bKGuWsiYf-TN(|!7DJSroPfF239#M+dn8U)<@9D-9D6@Ge zgvdk`h*7~yvdx({@-}7w!&$ZRH%GiBHk3=r^Cb?PUBjJ8?W~=JZG$uQlQrY!L}I=t z%0%!wMrYJ3$A{Mf!)kbjj1>>Ie1wb?D{G$uzzBW^D;R5NVF`oDm4*rdX*JdrUfj_O zN~w^vZ0C!1q2iq!Sc>G*KI;~ZweNA*lbB+?;)5u@X9B&_x$r?^yOD&DpXv&+&d5*~>%;l73}ng&Lb+UoGl#8&DK+2-T_V_mzXCf6=WMbm3U0Q93S0#cIrGy zKRQ#nV+iHAZ3mpvo)y&~k8y}aj*v}K=1Nvzq@kd8c$EkaSRsok_AU_$o`6&@DRjOX zVR&C1;)DIO&66;|t+mjHbm)X(7FL#`dhomzFB1!~mNb!Q3kdUWmPt7^W-J73Hs^%R zfT>aAZ%RZ>QWB)oAuhy}KcKjVO6!V*L<*LCp&7;BugWhjfoZ(#sq67wceD-JAf0N5 zBp;q{Px`)(*_H}z6SOe+8L!V;QCC_>k?<7ZEa~<@$>_K5-qvE4b%gE9eX_K21uKQp zy9!Wk$!-%>!}~R@Y9^z3D4C~Tq-M0Av0YPrmpfR(vr(^PXBFOb!$!OOD&7Pu7_r{< zPFVSM7Up=l88i9>T|G{<<@~dY^jXrb|JaM$WCf+@vf1}0p~@NK#&&bVVtR4@`{Q5? z?lj~uu*-Nz2>bP2iu}>wKm?uRNA@JkdrCfGY{{4M zRGgmRyvf7+_mw|As$i}c?zGxMQ2#w*v(O_+->S8kB2!Tfb!jvU)@$IoHJ-P7>+0kb zlwL4hBvx~Q^SI(|$g@F*_@Qg5p_IfRqUAn#xa_$!tUsD%(&iM`t(9)gBSwg?&?@`p zv9l0dAdxYYzCmGyqD)dN0gs0@V-_yRVyZI_eWubxUDiqw>&ad9&v_mBwI%@{#B45j z!q8#h11X@3mERt@u@~yY0m|sMx8RSX$6=L=M9T{;#&i3PhXaEJ?~&IigA~3Lrhsco zVL71g30J2#!?kX}16%av@RM;5#hGvuzi(9l9j#(%)%fafg-b?xqucQfXIboBq`TOe z@A?8B)hBK@#HMI0fOYBRmS5p>dCpf{QMT;oEk{xqFUOu|`jT7eiS zOFqPmS0IEqDSiY2LQdiWOC~%+k+!m;*I6v0b8gAwtkZOcYI|wHahde~cq$|0hN=ph zB)bUt4-Tl#UiYJp9V5U}l&x`J@Dj}ib2U03gXWwv6+26LlosAp$fES54cvjj5#tuu ziL-+Ih3^7;53i158*U%rAb!P}@Qn&?lw+Z@krv`oDG`ZG3rEV9Lo3E| zM5(N=DV+RYZXNs>61U!2qTWH(B&QN2`5mkYhI`1On?J`^Kv)YU{=uU<@aWVE{T zEUp9uQ=ffqgzrLlBi;iR#XFE{5-Qwt2^=F(=wY33(2a-IMr)-Xfrnc_SE$v~?rKUW zQwirBQBd;eC{cjv1n3n!SL)%7n?gr>zgJ|G@9YIFZ_gOQ8Thx#Ri~3b>!ylRrStCN z1~qbzDAJ2JQHGJEN2{A-rJ{rs69*>taw=X^HJ)cCCj7eQSR2=J zbyST`CHM8e<>tA|P?YR}9MM5bHAYz454qblL5&R4td9 zw4Sx~D7hr>{5IaQ7Qctdrwr4YrM8{=g96^iPPE^7xzEVY$e-33-&wkj;Ym89 zCLvhHZH_M>yGu$zPJe>uCd|L3;&XzYF456gw>0r<#X&p#9ah#BO7U1B>BcOfN7 z>WI;4^t^PSSzMvP_?ZwYkl<@GrP#1uT}96Z-xqI1aF+lFmLS@7pndliM*9Uy_j~2v z_pQ^*t{5AmB(96~i*_iE5I}Kja_Z5CIHespCF5%q;Y-cEsJ2WA~L`DW`8+;G0)`7qSqU6lXy6Sa3>! zn8e8%^k_)T{oC-XSHR~gN8a<>g|JV9?Sm#ao(Pryn_0X%qJh}=>-c7Q_m~c?;QpLJ zK!w0h%YvmKX<)!k8gU$!IJag2#u`l=#cIc+H$s6OGSKO&6>3kTdwfqp;!CJuHwk-m zdHA|qU8GD@QMb>C*&GF73=?0EjKMtR7KI8iUWg2IG&~6zhDg_6fW!Kil8ZEa_hkQEWNQ7GU;qbL7A0bdi4eGTmS8HU2@2&)+rV@A z#XGNGBC?UQft>nju}_bl%ZFnB-|-B-v5C#P*o4|r2IZDDdv*GEh#XY?2aHZKHTLm8 zHma()cE@^yLiKSv{d74N$x8?V8NC7c_N}&|y){_-5{o~0RGGyTu339R3A~`O!D7Hu zR0HKb)OSk;;2$#ngx<`^3+f>#13uM6!dg<63;Kj5N}WD2anbhB52-j>*F^!PMteM$wlcM-OQ;z;ARihBczEmZFeSeTSg}KFScWX-APf zYJdrdX!n}Zm-0`Gg0}+#K2_pan`BcZp#_N$f8k-PJTiVO&Il~yEaBPFO<-F8Y338| z)8vS<|KBmOp~7M?1TS)ZR?IKIKG4Kj0(0D`VHS)_7<&TOT#>}|1h8?X=pGR9TI5(! zpv-M-kvab#8aatHDTsuVauRq~ks-id5K~SU7ieWei481(icV+%smY%+cYUC>t*+}760-8wnI3yK z63-T&md7+2{~!)Z_l}S|uhKcywv2o?eU!li<`UYY2B;cpw2XLPh|Oo|`DjPvi6U($ z=`!Vbfm*?21^~67frg*Yx{{iAVh~I6JF8pEE8xW|VSTPxgsvJjgBL~mQBz4&3I;g#E~OyfGENJ&JqRTCv+A~v9~ zpkmIOA^jCIp0KFFYR=MLN)~2wU@RYFn|Q%~BUC)~Z8HZkAKv;>MLn#; zlY8yiEBk#z!8RONf9TP;zR-n zHR-6nO9Kgj9yei48>65c^^oS0-@k7#+oPMZoP4ecEkTmvz~Ptms@R8NbRT?O+5wPT zQ}fNui1vn_D9ZuBhE9PXjB6IU&yh5|jicql!GgL;QcemNa){*8{a%pxG)2T6F*weU zC#>%d4&`tGIC)0g{ecGV5a|MG4UR}5_>idOJS-JK`NLVpgT8G9i>^@`e5oSisvQ$jrB< zqnW3Lj>{3-mfA_?*^pwD{8*eB-+xW+6W3OK&O%iD$K+h!(4%nIy?kxS*q~l8N4)4k zgxx}CUbm9wD3BN^g||b;mw`;IUY&Nx>jKGpSowKuOGf!ZVEEG+xusnITx^1CSGbf> z7=1hV7r)T4Hrpn)y$OT}UK~Ltw*T%bKC>qeuH@cTv>$KBut&#V=eSyl%y^k$bM}<@ zyO-Zpl#3*qO1t&OC!tpbPXUzd`MJAhB+Q=bQW0UZsm86+c8=$T6L7Ql*->=vkumpZ z(3#<*s_rvuvT|qCzm;&tR%s5)XdJPleBO6;$6ab3#V@Fs5p0mjyf_JLMM@PG$qS#8 zCpSc8vrU@SHgyDj^6Xs)Bvi%M_Hz_$t7Dl*9DP5DbVk#mK+pv? z0S8GULH7>*99ly32{|0W9IFbt2aR6dIf1(4*Jt`PyPi`3;*&Ari8I`>h1G?5JBL6g zk9R-;cM?q1DBAl9%#myS@}c4s`69z#x>C8J&yUHiu%w3jE#7UR@?nm*sg!saVZ!s$=Pwe;|hFWIhHYTZAnw&Y1o!-5pdc(gm__ zaeJFx)dxtu6;bQPEU4^jj>CbP!#aS95(tM+D>^1F zZRnF%gaxQ38y4EV$EPs4ccp!gaF(e}3J%ja7CzPyewX+S^McprSU28)=Ho>$Csi=) zMIiR}OsOa{DWnxzFNFxgln$%R@&z7>Bd6SbZA+|7rn&iUz`4ClZ!*@Sa~JX)8p+CY z5<%r`)beM#m1awulKkmAJ^B@_+mK9j^7nfz))Od6ExZ^jP>OpX7y=x98Cl__Gsd)`8u68Xsa zSWvo6k;eHIG#Wl?K90`g^BIca+q>M|{w(14qX6QS>q$REFPZjf@0lRw_)!39O6Q&n z{KT#vU|+of3}4wWZG9I4``cFkhHg!28{eIVQyo+H)Q&un6gh?8AA!G2-9+~EkR?{7 z$7+LccCvB0x*)4FDRNKcvBkIBqx4R#>VF`F;RpW#AslDvALRRi5X$^t2;uRu9>xEp zuJR2+*4{7&AINCwK{(8A@6gw7H!$CK9%cCtU+)7&I!C7h8oxswK0elqnoRGB_mBPL z{BnJLs_fE!r74B(j!{4pBpHrNU$oSxvN@J`3~7by17+(y2d1wIx%FFnm>;UoXg z@Hr3xFfQoA=$#yYZazRqNW{cLk-ULCqq^GY7qloUC`J|^G#g1&w_*Rj+a6qsa6BP8 zPFl2QL>~<_8hp$$9}nF8>tm~4MVue!$uIWlNW)>1^mOpwGbB3Yw}sEbljuR`NJsIe z&cXqv=bS<>PI{&*>!zMklL0# zE{7HRaMz1?D$fVW_-|^i=BeOFYEDaWE@US-o&cxKNjXXzIbXy zQ7!M^6~5P3TT#lPSWt8?DfT(D3aXG;hzvFdp7p42RdQgL!}1HQ4}%)w(j2x&nOFwy zieG^J6f@4D_6Fxd^he=?tytthLvjgUgJEN%&J;54>4F0kHoZBUX7bHO{pw;^95kAX zAhU`PiTgx@kR~bWRVf^D=KXsMu6hcEeQ1P*cdUJc&@D2hlC0Xr1*bcDyN-SsF{?7PXwi$m?j7 z>rgR0Nj@PGd~mpuU=sh4sxyRaEZu?gSCcKJ?U9xG))tL~W`gM7iY4FHA;87t{}zY- zL-inn?{MDC%$#X)LAsN4c3Yh1fEl;m!#-e3kA=OhbRimrq=PDJ|4Ylcyjqr(cL#pM zTj~`&!kj7o`6O|C^LJBHDRn=*@DEDi6F{= zv9vej7}fH*0w54{oWRMt1Ch zjDzl@`g}ed7%b$zh5kBR)bIckq>@K~G>^-iPGDC*<=f>LsYrqw%^&WOY-;I)pm_IV zfp*4My$4{C>~r|YzzYwn(r+L!%-(8W4Ba(w4Wr}a*}fXcIh~484Q!dk&7M6``}nzI zv0i>PUG+znu%J3>(m%{p57`WPph`23;3}IpXBAOGS!W5YbYtyh>-l4^`s%X{s4K?v zxKsX1F}hhsN3TDOOe~S|mBhCcb{?#-hC%(DkI3>EVh56Gc*yI+6y`x01*>}NS)I%} zHDOEnIc9I0_T}FR2pqNnf4hC-<5UoTPK&b*37pcDm>M)Hf)yGabv2hvG%9b6T?of~c5gt0&9yWCU>XSM8G)BnxSLqm0%k6l9M5I8ynm}{Yw7p z%SOS{k|C-oCsxJ8P={c7AZ}>Ym`y@xZAPN)jC=55*vs%x=KvXmd4$s{++Ez$cIE8# z&r+kky6;L`V**t##6mxU1J4y0c=r`mwLdwj$V-!TrTIt>;wb}P zNctIAt3U%vIlYu5DKLYDfWZ&%g*Vd~+i?KvL8i92Oe@kkzBI3U1~4dz5VZ&RJOpsh zSgk2kuqZWqf5$tT;jTva=MbO)g67&XYlcb&5pwI;=Z8Ryd51bVJdgTcR$}p|@tr(5 zYopppASe!6r&v4)$zq0&hr7-GGV=U(+Swi<1c(!?-+$r%8n{z{6P3f?Uy8D-7=&mM zJGQKBSA#dF4QW2Mg4o_VF=K5(^czQX$h9Vv)g7$`n%MX4mU_&UoWsMFrxc@o z*n|p*#nNK5kZXz?;$4q$+_vP|8cdG_@q|@81!}*ZL^yMp|PN~oFo=jHLsJBksp3%j! zHMC7z@Z^2Y_e+YK&1pNR9TUo0;Q_b%`*nFO@xpJFR{9N$ zg-+e|U!q;k|5dch!pQy~AdqUD@fwQSMC`x5*;r}3%UT^OQ>FphFS6+92aeh8D z@<}j(Asw6!?>ncs&h=#%WgJw=3S52vgCu%XiHwTxJGRR|P+9xn`SKYyBlhiEED<2M zHJT&wKCCe-Rsnu!%Q3;v$~k#Sjm-lN7`s1^8A_1)@MckOh0WQq$3*fKN9Z26YW~#& z3V;F5@-ODwVf~dTI{)W7I$B;Y-2K&+(Jxv#^rn`eJ0}|c4=TAL`UpAtuhddZfb15r zW2@cESE9$>wy(8gnfJFthV#wSgTP*VCg9`qeRSg9xN~Uxo9lD`VV%86LUZ}!`&kbh z;X5jkNKR2s)@zuI#MTJ97vpDT@{G%u_|{~k<55u61ESaAG`*8Lm(o!8vbBna!l>Zl z&ZRonly1DeEwG_&EwGBZDj`@d0WD!`*n!#rP~~NeBuo6#NmwcpchHiNwND2i`mtf44&6wn%^h$l-JS_n>+9X=Zsis15?4SvD9ij2K?lPg>YHkCbTE-- zI5fhdF9bFJm(tVrp$%yE=7qe#p!Xc!Ebb-V&v6u{NXA%Ax3X-phm38%?^=(MkzrEY9_C^V**tgxwmSy zsTY6=3JhKJ0!wBYl>GCQgH36VDKOTgi*QKXG_?|fqz^_D%X!qmg;_gB0daFsvngKd zb(ET+rX&VY5W2EYtb_SH?)EkN`t?n6P`CcHvUXJ9>_n01;JHA1J+aZr-MCC*tRSvv zY4{uoke9whtS6;Hv^s|X^j$9h!Sx;Iww)=!=48f(Mrt}Z!#QFEQxJ`{V8|@?ZiN-$ zd@sQMlrxiTDD$M34LaJ7j1d)~Jn;7NjG>3NPVg|BCO`{^feAW1r4&Zya|k08OxI#{ zNzfkdGBO^hY%))j97b6B?IFlq74dw^GJ z0aPibr7=7n{f$gXYLs4t6>Iw3mS*D%ekhHo=AI57CB|Qpq$t*8r-igK?ydZo9 z&(jOcve3V|bivi5b4Wu^J z=-~aWzX$X|54on-=eV6Wff^*3uQE&)lP04(fT?_h@=8T$Y!vsAGsUuumK-o*AK0XG zN&^UvUv0Q`ZZsV7f4&27+G3o_Q`*7egGiY&u_CzL#)ZGfnk4&0jQCO?^?S#HGjV>kqs8m8phrDQ(OR%CwtHI-eRX&k$Qo$j&wt2jFyWFl%s z4h__xX0g7fgb`t6beu%mpr~1Hf`4|cU6<{QxV8|!r+I}pOB3eQA0&)SegU?GRl5mD zl`W!&Q>Fiz2aVUBaXBb(bV@zo-uEzH15$x`nSDS=?jPECLxW-V)Lw)lXHN!*l?^VX z4(luXa$91isF*p{BBV{udun_j*^!akEb58t`yr%JMht`RtHT5XN2Ajf(e@(M_DK2m zF2O3`#(V1zF7PtyU8ss2$GI6;#w9a6z@*m2`0P?mbdEql+fEJCgJni{e$BOli}-6s z&{W`Gc{0yS)uk$>Qh@kSCJvn(CH76gdfQ8B*A7({Trwnal2kYB)jC#KJX zs_V}7rlH!d2tY3)cNND=rNsUw*>J`U4XXZ|kvh$H^HmeQ#?=%T_ccB?k zplDKiIR`~qT3}B>d{atIzptB!S{fB~Yde!QsbJ2vQZq!vx%(rxFJA-QocgP|kIViK zW9QVE3BY9ObZk2v+qP{xdDF3N+qP}9W81cE+t{AD+S#3p?_X5aIrTigmAQ>TSb4?e z^kJ%f z$ifWLk&iw~g09%SQa)nEbtWAIovbyGonTKaUS`^|TlIOoibU{No+=$&5M0<)j$Als zPa#wqu{U3e4$Kek{Vlamjm*PlT6(f~UCrt_s5`l)^!TXW6ZSQxG~WbLZp?~_k?Zs@ zVzOLRLpTk+ram+<+@2z~CN1?RxF$i-6DJyU$T^6H%pA&!a z&!eum6;Q4ZxYJy>TjN1gJcymth=n791sUippM4zMw9}3a3i9*EYy^9Z519cB%h)k? zya!NBw4SHBJVXjg)%)jd**Jkvoxy(Dm1+E4XY986Amqq3)eqXtd0^bS_k@RFCRxjx z3vb%poxH3E$b^$$!?f@x+4WWqCQA23Yiq6FKr9hZIUY_!M@9+Q38i)Z9(#wkB?YK6 z7NStqSQcTQ+Ou$7wgBB9lT)0vbE~XuXPk=DmOmP7FQF0S=^Us|4kYuP4}`x-mS4(! zBsxJhmoM&p4rf9B_*N37H0o>M?u*Ko@>{nUK@PY`^Bq@~jRyV+LRV$2hF`K#Qn%$+ zA9$0s&$spuDdE%&U%AYns_-MX>;U?#ogP|YjW{SbX%R5z5}b~bPJ%67>T4vlppPOY zcbWoAxw_9YE(ISNAE^MmX*q-&`lLXw#=aM^{#|lROrNG6;Y}RaR~XMcZ#&T$p*f-5 z!_oX{m~n2@5g?r`Y^|i>g(v1#K3mA0&!n%cW^@gZml`vtU9pxmD*Rav=c%oGi~a-mo%}S*TGQ}r*t@b^Vc`k#pQRonyd86j+iuuCds5=L8`6j?Q_%m);-;?WRSuc>QGYfdCA%<~=$lrX?@?fnIgr>unoDVOcvv3(> zh}Ee>^Vu5h*l2AAH5sXpg*9`|H-`ZReCg1MLf+9Qu(`j=1`%BS*J1O87%L)oA1ytf zP!Q_q#Q)p!!115-LYP@uIR5Wm$QEEC=AYwd>xB9pLgeqOS%P1lDA0z0i`+Hcs1Wn{ zG})h3oFAW86ST4AvJ*Kyg4Q(Z@+B{{3;XjrtqEHgn$4fUp|GK<7|oW>pL6=p%b#!F z&hMv<`vG~6U(>%`>%2BnVa&+dGzAzmhVHNKW~fgHY#9}|uD7l>-#55V&aqo7K6d!sz8G}f zskK8XT(H>^f4JeZgINzv$`kEeyYBJG2ZpqB+}v5qzr2*{Lw&tJHVTRidy`YGka2dD zTO6Vt;#`@jU zJFgqLyuX&;Df%Y@Mf)C8ka6~Kw^qumH*LSigIwGf$}ub9(%l{q_|u0NtAk*)Kw>Cs zSv32G45wZYmyoTN8a7c#0%fV7~G@24KK3BZel!WaaIqh0t(!}XxN6A-(OyG z$3}JngMTe(>7#U*O{v+$$0t)SPKrHfrL%T-DgJTNobI<&NegpD-s?Cgane@G@>r~x z{+X?g?$VfgjqsYv$tXWm7Tun#nimwRmFk<(Kq1r^3mVKR0i1ckIa0^{7~XshafGPL zk#)A*8&*xW8l(9z*1ftN3DEY~PHanK__@*Zv(_47?Dnc94xn!0Zx@c&9h`Z4SYP;f z`$RAsE_3mktD-(9zQu2;cPFcDJ#wUF`b(CL)hug6T zd^ud0a9eHA5rRJx>j6jW-rH{;*0lUFcEq`9o5K5$Fgx(~o?e7V(ciZ=htSgCbWl{r zXtOB!V;5JTWdn;a_UexVEj~Y3G^ox8O)4p|tqi0RY>z3xs+*yLWS)3|gmvb`96C!$ z*+6{lF%i=vI#qGk6~tbZLO9K84SC;Dm10ldKxacb$D-QQg37^YaX<-aHI?+9Y>2OE zglnsUYL*msW9DYgJCLKEb}8pzgu@A3n2E2*zYtAoN6LI@4MrFrmi24|1m!kl+bLO; zf=lz-TWRFFcbbMKET5zuU?f#z3MBAEC7zc-CA@BX#-8!97;N*}Dqeb(-zx29x!sso z^J?Cyr~qkC6b3m|<-{66F%adq5*Ri=na((x?0rU5FyC8r%Siq5LqcNnS9XDK&vN#9 z22$+@qrNP%)(~j8kIJxZdN^q2u!zIhQ1z}7kDOd<>Xj(i&{7027;G~o|LZ=4_cjQ^ zzMM8QcaVRqD41Rr36G-o=Q<0B`mD>j4ld@D0ipa>h>$!a{nsA|*A<&dBl&`Pq_ZZ` zb=0fQheV5%V&~rzJhmBD5ea;j@h2)3;N*(c&AVmogkwbKCXfkY7nZhkXrZgWf$+UW z3Oc9%K?bGwja{G_6kKw{^ALFCOI$f@DB$xOf>QXTZt%CLx}2Hdn%!1zBxr*Xiu>am zD*zt-dv3W1GL#n-p@m=H5mNh@HAm+^+iib#J}aU29pmHfb;l!A`pKLh7nlo1O}#5w zNOuMSv4PMd4IyDBDK*SJP7km;X~}&S(*cpCQCog2@ogM@5Z~8O*RHb%ah+M1Vin|T z%tT4Sy(%FTmQCEF~v`KUF zIFnotHs1~#C%44nV)OlFp{(><=eUu_G(t+TVPe6+PI00%-;V;YE}6;YJrkT*)XP68 zCFn5(2L#v3#bMQsfnx1aC#js(8e zXt5IJ8fMI+#__f7Uh;Z%aPN zyKinAqh6Tc(`?^1;y&Fm1m&mCk=XXoeotF2?j|mwDW*w$yj+)z?mEK?O9$LG6QmgA zA&=al3=42KdOOL*kS}!>=R9X=kzcbvBJ;aSxD_@E>5GpyL>6~AOv?%k`+@z778Oz99!5Nj8R2w{h?~+jLSJXkAQ#w>$qAv-DE>lF8*p!;%}E>=q&=z z{LuD$QOs+d_dr>r$54m?|5_Tm%_O(AU9qFrpv`&|rXs}Lf5mSk9qWZx*#=8owoab;c_sY`(CIIYCFEzSg6H3{;pK~~ilsp&G)qZRfX zd*t@5AqG>a?`nou3&e%^!Q(_?QbK3!R+PAq&Ld*zNkRg3iJB|b+1u>TWad7@)<>t#coT6@Sl2r1FF@+ja1t~x;U(4h#1UYObO2OVyrSdOcH zj6^fcm($p@%(SYJh!ieYlS06q9gVdAxjy6I6;bh!cw9A+41&4z5w#Ldlo-_;PB)9X zkZ#0z5h~M)pt7Mzyk#!yVSUbxK{sVvs|sib;hAEjz-}bR3r%>}Y^1ldHaRfLP3V+z1&6?++r)I+7pgcK6 z>Sk};@k|WOdDzTdQ5^`1PU-XH;DRhV6oNw;Rm|`|)+#W(y&4e`)i`qzn@fS-fTC26 zJB;14vcj}W_{N0_DmWork7kxYm`HUvdY!htNDrQ&{ZB*a_+V8Qp#tZghll z%A00qCYQ6mU%7nz9j>XQnHh;9x74E{*Qr9kFvmxgfWm03zYyk--neFJ8|>^E!3MeM zJz>571yU6L=cGNI%z*(4Hbkp$z4SjS@0uN5nn0KR}?`PEzm#Y@3A zPJDs5ED9YmE;=B-i@CVB7!Ru$1ob4(yHky|YpdSSx@EMEmw&X+4L%Y+P2vsN;QxX#K5~IhiASn+@JPzk`A3k#zjOfmE zHu#ME#bbXMrU{(!LiJ~;60&i{9Vb#D*Avrygv1-1bWz_!)@++iCmW-Cn7lQC)~0Km zZ~{6zvZ+ z6YYDdgtJ&cCvS(QSk=foalU8clGC|u-iXlQ0&T_V;rkx7T-4uBKp>hRGvK^(w&4jez5NwgkaLKjGs2081P@{ z*+Ap^kNk&Fogu*Ca==Z6Cw&mh4CVq zKHGbR?(k_cXtgvAF7N*fGmq!%gU$EP0_*kS+6MHG8>z9~as>2`8;S9c8>zib|Km}J z`igXl17`6_Zfpm7_A|Uge}_GU@0oPH0_Pjlf!Z@a0&*}Z+lY(sUlv%7?_qnY%+mXV zT~N1^2!8w}06D*RPH7IvNz3)V_Th0pH{qmEFXAn zQ}7A#?fEf8+CW$B=M;yhmRNARzH>OXMg#*Hasf`Y2KJIsJc9T|EQBdlx23CqQ62s-3>o?^g1 zHDp;bVy%-FnVR53Pi|MwX|BDV0Os{VA9le|0cH&t`dE0s_)jyPb}hhfm{*Z0+(AO6 z*gx+Vht6yQNALuC)wu7U@rs*NIfa5IseXIn&XQV*6{{|V){_FXm;gSDG>+B{ce=kL zA<+$3IIEMj`cvPSUmO7u9nlL8+ALKt1<|x>i@&7Xx7PIUExc0jdx7f&-8vzf?s?pe zzDuq{fI#QG3dgvhCbc~>1~5IwKY|7}>U81hfIfel!K@jCOSc%M++I0i#raATV+ z{Md{nt(EcFG%=CwPdxyN^`!3LaYB%DL1Z>D`K9~=+Lvd=6tmCN`{g9>QN*Dh5pf#L zHefcEO$5HYy0{Kq3UwP|hd8BnQ*^d48lTDzvACt;Q?2}_6Dpty3^*M!@EEBQh6$kv z1j^bC&{>34#w0?TiQC7`Q7rr(TXy@e6VXIJETOPFVt zFFypwLTzfR>sT@63+j7!=7N|CbP`=^L4mGYq@@K{s-$_D%nqaRazvJnW)bTer_+V62v5W2Cv<27;51hd$f;Q zgnaDfvQ3(Jhn?oDXK>z8r_XvJ<$Ad!CR9_JQ+Dn7!c`ahVV>sG>^iW85A<8l9EOZ}0N9h#&0}#&3ZoeR5!`pRsDohISP8^P;H1BUQjZNVC z+`8tJPFR`E@Mfhf&%Rd|MO})0SZNYZN>MusRw1=(O$yZT7}={P)^>Mqz9NBsI-ibd zc^>SMisO;SpDwuGoAtaaGzw|!<(9-Y7i*GfHm9|R*<5VSru=5pK~h>h6Xs<+;6A z&zwBU!1Gq(=7t)!O>h)7Ubl|F;d=|?8Td<_cH>r}CI^h|z>2*g%>lzZJtS!<_fckd zd(IiJM-)W4AR1VS8hc3s85Be85pLw7LAI!Omib|nc|4vLb6}lUIm$3Tv^)_zi9~#} zt&=_1!^Y@MptkCnsW0-MwYiR|=mqt>Hr?+b6VupDv)4ght#E_9y+*q>tt_SNgh17Q z7~VMgYCCeyql6nz2p%U`$#0&od*(^d5o9&+4^| zX7RnEVORj$lvW;IuEoGZ9YKUGri_)UxjhM#avqjH0M?TO6%E47eCV79#nt$I`Zi&( zlj?FSG=G*KKN0nU%N6 zV-Hjk>Yi8!NHTOL|A*bQ!OVzKKg{oYUw!HX6P%`@P zpD`5jwV#--cbU3S&ZMBVF0uWtefOD=$Z-s)5m|xhb{PzRKAVqrbtmrxOFgg%frz#< z6ZsM<^%Q;Ok>TtH_nK{mGjn65DwXD@2XW2i|2*nJ14L;4|C1&=!++FdV&Y)>AAIsF zZRuL-7P##f^-26XqI25b+X4ZUypBdwb*DW?p6e3LL!0-PN(fR#>}cL+IAByty5sd6 zEJakwyE{eGH)sFgP~SR@`hOy-hlv&XyzRIx)DP+~+0>izK=01)^Ik^POQX?25; zNO_}9uXP@uX_bQ8nb;mWDGzV}*qBNE9c!YrFe($oO7G?qwXcs5_G@aa4qWn#E(Y0u zAsH(|Xb$#X=p&gz%*pRwdQyAn`FrwCdQl&?2}gjLTI};RyMf8?#r$o zxx1Y0HM=AyER`jeJ(Y&F&RiSB()*)Fvy_Pf=lSp6XyfR-jEqfz?JVgDFxVtNLh-Nm z)7ARL1tA$=Nl=T!Gy77x?4e8=X>N=Rhm2i6D>^%!hRV0<=&8t88ePV4ES;<+dDeDS zkz{kg7n37OG2mE_#)b4t*;g7*Y+f1{6M;sml=mX_gw`9*_K4h$S*Iu>X`J^ZQ8%Wg zVJ?5YadHH($eq@lb?GLaHZl%tH&TwXbJ;#V`!Im$Y|&6S*ADj5p{<^(kg zTALVhNW5e}Fjbzl4Gx~e>^>)X)fiR4cII_r>3btAx9YQHI<P` zPI%ma2LjwGAS7zK>`%aj)&TDHCh5sLR~`*v+9y_t4t6Ujj$W-7C~XZoT&{Kdh-;dJ z;s=vL@={bGcw02gPwyM@TQjzEW55eqiu9fhDV)V&xwNhx@*PigA)GkFo+!^Lf+xtB zkx@Y$NV!WK`5S*^$?PUvhRLsyS_BIASq?&iGCwAH=CDjoycD4OIM3xEds&qU3kj4c zT0;B=I{mMIM0`8bO`v>2!x0y@fPo`b*>Bjezjwww=TpdV-9d= zF#v1{YsSkSZ@*%4TbdsaV5z37SflyRRFGdmz`0=*1fR6vKJDu;U=pLqwfq*BF8}s_ zrnkTGNvUAq6BF3Bsgx{=b`v^vA2>XWA}e0As5CX2BO||Mg=&T=FKtNjxlM`a%eo)# z9y4@cd&it+k1Z~>@reu@KW-lgKHqs0U1mSY?E=QQ8k!&*lvqV5CxaqShU5N)FOuhl zs1FYMdw2eaCyUz`1FwIh?CSQ6NZh~JC;5{^bCH*n9Tka&6IS}%GyKFMd=q%&2303$ ztQq4t*yFMkmv58V3Ti9Ns_q@z6f1KCM>HhkNb)8VR1&`!$_W~vw@Q?-S#`snnZPp) z+D#xFg#)Mc?$nJ|QwKHX$|amut&npABeoH!LMqs)BuC)a=ERblp$Ce}s;t-{ zgS(_8HHx4=JG1dZT6iUr=DGc+Hq{a29rtz0LZ)W25GKrGKiF0SFVymI6ZlPqrM%a8 z{WsYX&~RkRvE`5KjUQ!+ROuEIx;p;gBu-tD4GH|#~ z^BOG2JWTi(UAw?0992zaUcAwQa*)xYsG9dEPjA$86AVvm{+(>zsXrNKy}nFy(Tj|q zE`VaX>)J851qcyms{hC=f$HjkfezkiVNp$}2=LPEHCJgY<|H)QY@nC-xx>HGMO$k7{B>R~dD``w~wKt6)8)c=?2Pm zP~2I-*fZ^F-$XiO*|Oxzj|qt^rA?tOKdmX&!~gj5PO89;18dD|)dIvLx5lX5rwHof z?sI!Qgf3D590Y93;$ysu#M0yQFRTm1qSK8l!`ZH_fxKM6IQPMwdv9!j?R2F@f_zd* zJt*}%c48|jgq8`m6_Ie;6p_+KCDx4vMRSP&JlkkxL=1jN-K!d43eEFQ5;xZN2Uaay z(vT(r0k{(1_OBC00l+SQbBMf)FhFXOirDT9Rj8|slhws!9ZxW;yj_V3l4P9=0w4?a zq?WQ+hs{V|$+V8Vn-9V% z1vajKf-5INr+phIj_fu zOy)w1YMUD}r1|;1!I;G8OyG!zXcMPo~kY+!7KpbU1C4SNzbe2 z8Chmn<3%3L!+4*Ofu0bU@Z#1-@xvOf8NxQJKGrC)5Z-K|L$Qay#HdZG-Kdpj^C_L_ zZ1ApGfRZ3F)WesM>E_kGbgjUo0o0|A0Jx{dshEPX*7*bs<;gV^G(sEtr$6fRN9VF( z$p56LcuJUoL!}m?8)lpR%!o~#*$;hyBb+MyaZQGS*e4Pk4oj`G6u`$r~0Mg z>zDgCn-RGKz9k5UgHhen`R6C#W6w&?JmabJmv$E()m&E$#{?thHwlJ?l z`0igOKab1r`~8n{9@Vh-zkpxZ8UCY!4+|61|M(8*0<^_^bRyk6p!)n`?nKbrBN9L+ z(24WKD7vjFW_gRK9lr=YgdHOkT}yF6qCsyaz00~_hj4!TBBJB@4v$R4Fa>$oyMNN| zyj^+yxtTi2_0jo$#c)K*0>c|TTJdOu9zb=)AWW~jzrVPfL6{D1hx+aVdwENgwnriR ziP^z-iyry0V?MjU{&8*(YT3M^N|wQ`ZmAqaD5a+IQLe94=or5m)EOjCef<%AZ$G)V zxDuX1~QzavFB;`aHqA*wwQrT+TC zpXv+v_VL?}fU2dpx1a$MApMM>uYPLhZH`?D8$3s4GOP-&V zO>CCHp78{Ws;JB4)(12|ByZ){7T4cqh=PGvA^cNBJG!2MhbdWqIWOSPx)rhh5Ky}x zF6kE6$=r`JoGpL?T+P86CeDh8rkru{KQ<7#d2_TP+7(4}z^v2~UKHB*IJTPLEykf! z*44<`g=)RFsVz{X@MWL9rkoIYbbiJ=)=>|YI%Ip6zXa#K7Mj(@wG`yvInyfvsUP)SWU?t!`PhLzhgX9^wa+#W!9iMaw$GNvl8|GC+Wpi4$FmC>+I;J?LtSCNNf$ zalAW{b!FVyY)*7i(K|4qz*qK)Zoa@4+F@^NYJ&`*aj8B0{xOTPJmbER`G_)|^(p;@ z1<9WvZ{i#buoPkm-b7yEvacdO8nc;x*v>+=c>&?ZVk3{D0G$C1cCmn+Bj*hT$Yfxj z@o#2Mg<{Ncn9%Vs7hqbs4g=N2~#7q2jQ>tuKyW0}AP#IZ?gH>Ye z2E}pP!6iPjPi!dENzFPznU9c~_hQ{?XF#xL-_MZ6qg+K^2jg0+3v8)IFApXK;rgn`MUK@`BQTo07g zGAC=|z=$w}*-!^S?=Cc-AsGi@bl9JDMvPa!R+testZpCq;Xn(DA9+<+Yd;jnqmKBL zCzCQ35MS;gT*e0U!bcZpJ9(;!h)0q=30}RGu&pbK_I3R$%PzG{#;E^dO*z?=j)Hnc zZcHLe;%A8WRvWg7DdQ^w_q)2k_=~m0Jr|51C9)xp;gzYdwF^rpfH$kB{N=tBqj@4m z+DExx*ty2=66ucgFDBki@PX**0*25mT5W+^rlV#mr)cUmW*x6zjX%H|^dRj-#N{^F zeRg?_YwQ7I1vp6cQ&fTkI!=2sOlH}?mQ1V$s>8(oYr@4NYRmM>&3nhiC z8Mt~HktCysf}gq+4})yg*uobU2Gds{wltn{MTDeq?fo(o+QiqyTPk5{^@n?;BjFQE zq@=#$p8h-aB3Gax9qpq^T-EqWA-@d_#neZnVAC*$%*8-2&SzntXAxvMD2!D{H(MXT z8Hq5TcNzY;v1AP8OoG@N#rv|CHm|zjb#YO{)91*i5iUuG;9GBGLR9gql4>}!{ zWVl;fCD)AU#XKDpz&ATPY#F{Pvb(V8=^66e8I3-RH3)ITngxO3lGe*WELQ<{u&s>4 zkn4Z=wof+}jl=w#RHF;oS)ZpY@|4}U0lR=ef`E%3BU89w+{hmZpps&jlpsA3F_}OO zyhf-+tp7v<{|N+A?W7D&Ey<=@%rNM`NLC|isAZYYFotzd$ZR-}j`rPX#I7L=Sh<86 zgKwp)(Le9EV!;ITqr4MTB#ALl%ZnOxl<=eWD)qts!WG9V*q3G>O8rZb!YBhOTfhVL zd)PN@W&ZcM>V#iBZgx5H%@gJ^$MAfdCbfWUDRn^E{qYG>K0vx-|4}c~z}XpvUG`po zR;!%pOU@fkp;EupaxEV#B6CdgZ>sp}q$OD+&yY#unS4E#2qYh2+-tC3Z0bGCHwZ}C z%kS(zvZK9OIfoyLi_Xhc_nOl?Ql68F4LV3dEKdPOl`66zE2jc5^c4nu>LQS|3%VSa z>HCK%ZGqv@7H|)ZF-GX^#>UOD-*5+ld=qpbjHUpk)U_it15k6)QxBpY9W9KO#80hp zG(jb1hy0J7Sb3LYzF(ob-qAyoPrEa&MB+um*=a&KVc-Rbz5|usk8Q^{R`v^S<75M* z^k% z+5H%f$)xW&xYIM=LsC&B!&|L#(Y3}Fgmx;N_QMfQ;rr4koMl>-Nh5R?I;SmK0OckV z(kN%CIMnPo%d|BvPhysoTiQb*6R4!pBTj{%4S`7D!bErkwC8{K5!eiA}ji3=ls=smTs4W+ps^SmnQn)~?(KoP;MT=Dpt#Kh6 zJQPfc!(|5EN*N&CF`6g-R6tSguH+?| zMU(T%(J!x)C)^Z&+pI9e39-r@a4pHb6rwdzcb-}L*q2N!I@ns$s^Gu-FYAmjLorTr zIcwxD+|n)|xx^ea)1cJL-O5OIgcr+}m=wk^??4)r+2-viMYdG-3hB~#FaD_X)$2`C z4#{R7w_g}=l7HuY5l|{5CQH##NU1(6*#DTDyrCoMY#Kh9JcHAzuk)P17n?Bu$(V$> zQK$u}S&X1FbGIUx^r4a?8jj5d%5oHL42tSWOdS!F*yD3Tet+d~S9!tGRFV!5QgN>P zM>cvu4pbK`=#P(fRR+R#Fb=hM@)Llk<->zDRF3R29>jVBW*QN~SE~DM28gFh-2y^n z3CIE}5$Sf&0<|d8!)K#Wi^@5b5Q|J|Z@9;5pbMj5UY~awFm192Lqa5`ezrjB$C1?D z%;80lbe}mauj8X!S4gq%ffLJ<93n!bTtwnZ2LF5B(R@L&S{3RLJTG{R2gJ58*%X!7 z!mnFE)qWrSbr)?Yw0`jMW1`l6NLOTcGer*EaytEcBgRv`WTk)LFOeqWE_~5F7r<@r zAeoefzDYftz>$|de*TG13E1Xu^stLE{OpIB?Rt!GvyS$dP`krsv#V@h^Uj`=dj8+p zY%v6tTh+!<8|f3DG7d>Pv+OOynU>P(b~ZCOQCnpF$+!Jwz#w{ejJl9zl~mqgIR0oItDwInVa zW|#e5R^{EdHq9Twsm9PKAeoshO6?Zs<-(jm;D(ti52}msU5)9@&%1w^hJ#+03lGcs?Sj+UF6}w*N+1r;;BQ&4W&|gy>;9>4aGx$wqtgqgQxq0Ut+fX zy;Jnjm%ld$HEZUjE!w&+(O&dEwcBpHgp-Pmmzel+dDK;fi&UB(_a*yx5`|E8V!;dw zDUr{Ph7Rapr)U&=mLXP@!VUl+CUcI#ucUnqOnLC3yoW>cn}rs6&zL}s z&3-Fs{N}Rgd$k+v-QrbIwbT9G2+C$b=S@Yn#A=;Fkas|JQ6t@D3IblXjIY$a7JHZF zfIK_M#r!kF{KVxkRBbKz^M!RYqMf}JSDEJC{(8lN4=ozN1N+E{aViWsI${$W44-6ToPU^ z(4^HiUxRWbBVGyLsZ6S?;bd%!&7u;X~7GKjbO{6+`YD zB56en|EO?fReTed(LS!}a3&%1Y?sfcPt(<%(q_lS5e9YSRE#xii6~_=vNw`KAi~40iSmV9@$&ef>)1M8J?yT+1 zeD3$&A{~xLH<&&GpRx}!tzwcEek0ZW4&_1%yvRt2`bBvuce6c9iky8m)zLB;&d7Yw zJ_!qYY1v^KXS+7wIX>_A&9|MH)2Vh~!fqP4obXWbQ5$-gxAPRulNh?TKRKbbP7@&# z638IQ1LiI5h}l5XU%s#x6n85x59vP9$zgsjB70?~m9{u7{R@XuspZ$p`~!wy%1qDCo-e1gJ@5Y#3^M*l6*LxB z*8k^-F&0DIhSc>z{RonL+zk`}56%Pbh0|&qf0N4cK>)_|DND7 z*PmOYRis>s|I(8i9QRK2kA8$SE}wrWx_sL>FcTMrfGQt({6aK>hPPZDhQyTYNfpZr3gk{-O zUgD>-rvr5&(s_s6Z(k2H{#=!_J$(Le4<;@;r8E&uf=rG4j`_jGu`$bx%_ngF9%J*@ z6Z{VDApRdmEhpIL$DL+jAEdJz-`pt2NVxXzuiAwjxt{L&86~>8Hsy>3WWzF)<%U}3 zc=aP*U6k~usSPa(EdN`r6KhmxNP2&n{fs|lkT`MS=F`!9<-uk2&{H?zNFqBw_lV8s z$p4<%zNn^}V1qtZAUIc7>PaWv%lK||%AUda{Pk~ZY1NZWMU~2KG2>7Pk^r0+jCU6J z#(cjelyy? zDx|b`gto@VO{(nkn_tr&%ad}$L~*rX43NEY#hB4_@b`>}>&=$C{;thlcQ}x1UPMGzjU#ij zjhd(iv2KJD4OjLju=Nq=!DYi)P^0AB3S$fgzi( zLqp|FM4?nB>WoN&uZh^O%$m$}tITIYCKXJIbxs%Iz!spRVzvW$Mqg9kLeFg3s-jj* zcoS$x1mBnuAgMR4zKYaMH4Fis0lSLHXhqY~U{)wlK{aFjtMT+fSnw~Xd>{Al-Lp5W z_6v~8R_dY)lnH7p)Ohu0J{oX!d+AFITIHs9>~l1XJVSXH$2am_nSpoWn_k+(u4`1W+^Y< zpmMvskY;2_!znUOB(l#(m6YtVc-QJzR4&>TApdMp+HM3@3#@U9y%qW6FS2VPgN)+< zzRDvd2%KFjkJtPlQ#?T?@0?Rl*%sm&_vz&?Xapk@#b^}9JO%dC}lagMxkOg!S*taPIbmxAW;+) zCAJFhHn={*Gk7mX#)8;>G^5VEMMS?({+#ZD;elqCOit<(62df0S|*n(kmQRN<%D9` zyRa;(l#CE*dBv@Ica`K*-Iq(_{Gv!G*^8iu5oFqegc2;t9($C1f<5RSgG#A01$w?D zl)ywbG%ApskaDf{`vR}#$mBWQT-lb~xa~|f80_8QzU+jcEW`>_ox>{zV`GtZWgsyZ zGi7C>&&P4G-9ryBG{|aC%ep1V)3@FrokeL*cicT zf|uJWU>_w6^u(;(FRX9ULDjRMvEuoj&iB1MY1;M-G=ZyoStb{Cvh%<+KQlsDSZpMR z-YQ>(ZW$3&NzfK)myfqfs&W%w;riE&9}4_|aKR`TJF5cbe90))>j8z{U+5EAQQ&Lz zDgrICpnjO0puUbb&-Z%I)tF@{(|&?Hn;*_FIlAd|{=|GorGv`Qd|sdQmpZDC;iwnO zKC$79a9#SauRR5USz!swZyUpt0Jx)4M%4OOOoYOIWD-sB*9hS$W@vrJJKP?x0U=n> z?MNH5Imp6(BIJ9_svMLwULEog(Dy;AV z%-Xb+;Jgv5Kb&NTvD4H!9X&(+xF}-Ik%@PRFAP65?sT4an;?_%=#{Zozj~?mc{BSo ze9~IC=jcYPB9kMP@rPnHl`Gu-dYfmcb761CPb2K%x+M_M1vG#Q2>-<^Gq==L0nwpX z)e?XZK5X-{c$rLhvY1osHk>)^m2<-O0@2&;4o4|QMp5pJxe1%a8hNK8$s_y&M2$5l z2c51_-A%t{OG7CFg-3FC17YTeKe=D6RlIX>Lj_+)7nK&rkkCmiyY4`<3U=kdrznr; zF;n78sc(+i;OG6TjNqa(CAcnimT0+u-pl04+C++IEX;ww8Ywvc|1kDWO`=2#*6prc zwr$(CciFaW+qP}nwr$(Ct*=hM+}jc7p(Fo5M&v_g&Nb&4;ku6;dMwDJa4}5ivp_$THllhjo{t0l}V;E9lW|Jk(GIUU>%oT~yB;R$na$-#h8(ul}t?(5C9 zYY@+eRuXwma4}sE1@A~v0Pzv|o-P@oAT-@1cc=n3V7_g|g)c(RMt+Be<}+A5ofJ3< zAp%;)!T(1`v0y=RQ{>mkO&+*`Lc!wlBr*J_UyY!;ouf77*kcP^pDgEivsqO_S6AR0 z4P^syof{ozg3I}DP1yBzr*kZ)^YroLfa0 znG1bbWJKJE12)2a8(e=;u&_Q_?Hu{N;$cMRMXI(XO1{&W_!x#ZOBE2Hz=#~p_(oW& z6cjVjj#;eKh1K#zY*IZophWY6RoL-z;EOuzO2R%9(jx|xO;Q(C`gX4P#2(QaqG}ic z2p$Itq-nBTzMUmR2o!ZjX5zUd{a>?&v2nknJWqBs^W=WahO+Z2{Q!gT=|SQ5+qmKa zse}rCNZ@;IeMyxxZdT-a5++}0J^Qr;*S5_7;0n<4Wv0O*2)}E-#xR zH6`}+kQC-xNJ*q@a``MxwIB63bp*3Qr9jiAM6c|QJhXVE6lWAA=Rz|#hFK<_g0gkR zRjY&dM%U5-?INRlUe@4FCAxp<`BmZhqTg9avj5DFvRo^qDY}#VMFKaG{~?(ck$XF5 z+~2KIl#?_(WCZd*w2%UivG8o^`MynC2cIPg2pL?@SH)qtw2m~MfhI5oMr}}xNtK5$ zyUF`zt&Pz0-E4CZ?Jed(R|YiJ|0!t})c^cmqDMgR3YI2i@>UtI*u56HlUzos>p@}C7K1btoA%sKJ8Q-Cfudh4D>!44+l)9gB7?eJOvFggn_Lr_ zD0J39tdEb}kWHXOSr|Co4OYbyY0B0CaiBY61y0jo14X>xBnl1(yc_fwWc(TpAN3K_ z9^9fnIS@vj;?W5s-TKHe49^>7<_EX=DrJrnETONNT=!OZLH52bMSEV8rF~>d8h)=s zs)MgkgS=`LnQ3A#hv^%(%oaE;0VFVDo8$4a#(8f;eOB|5@_2r#(t0V_sj2H0T55qX^i!_r^ zr-3Ko`^q=trp4I|&3;1axTWwae6&iH%T%tOoVXq?N7fkuIMSjFqh#wXl0L`LlzzgN zK#H?hyZ%b;Yn*~G0NXRiAfyVzWGT^52XLaj^t-*CM%W{UrCk|iU6V1ap}Yjxx!hK- z4J~+gbcu4G5ZXHghGs2+ajZD%9#v*u0tcWR5CTK#oP<+ajDR+;^a1*u33sg@B2>fo z@R-%xiNSHzh;7}f@w)ngQALh*X(C$k{ZXBA;&jfFG)5 zE8zi)C^$KoET_@DDbx9`J}qbA->U7hr`|k3mfF=lrcl()CJqC8cgrFPr2>*+4#xy$0SAfV4FX+n*HHCM=5^7U>!jwmAD(i!)~pS zX+xn#c3HP_dFHuGdYar-e6zIx{KgwW0F5ZQ_q3 zsr~EA$s<`!IxLbx_9T40kHru}@O? zW)QUX7J+i0j&P7TxUN;D&-ssE83LZbh#n#&NpX^^GT#w)m+T&oYuNVHKye{#;oI)x zX0iHcCo=VLnolh1%SY_eDDmh{E077;A51+`cJs|YS4U~3Ol(3gkLF}th({IDmT2v< zj~tnq_vSs)a#+<0pU~%Bk*8QLVS>%x+Vcu2;?v1)l}?sj3LKjs@J5jhOLAX<-buz< zBUU`;9!2le1eFAh-f(MGf86Etp%fPjr|_(3ZMF$oNcitqhI5OkoCwwYPDgLxQnSN{ zFr8iblxAS=dmKPh4M_19N{G9qOyu_dv@M-z9o;B0?CurV;#;gI`h*l5?n0N9H8CBL z+}($AdD-`@2l@Y)nO#?AAQSMTS=Q`qYWT5k>AIGgzJlWFmq9#2bVBYmj(F}4R#>wQ zuLZ}hm`(BV{2`o*z4A>cbMu(cYrte5xY?s=9+?J5rPS6DB|vi0N-u1|dPus%CClcs zSYM-`9Xa+cSK|i{FPk=k@g^*`8#U0KGlZUET{|_Iy(_?ekOg#kPa~C|xqB8=e&Uc--Ci-Nlxb6-FvHsYK@jT>MLfvD&xns35ykBS=Da#aDk3*`Dy$!BIKHB7 zP{J!38EIEgEPVE>Sc;&3XZ*^2l%zxZBkxXw)(SCIh z(`u31w>Z-2SrsJ|{klR*$<3iNcI6H%Y}4_sl2TzEmoZk7V8rF+mi0*yuu7eCH|^5w zeNi`Y)m5pZ9Y)NrVb5&g!PJxG^!avy`wfb+#gg>j;vlB~%Oa79j{Sc@Ynn7CrY~B5 zd*bBxfA3Dc0sN^T93dQ8PuGyO4u29H7t|)pYjng4$;6WrRv7~V0zT`g(-6jDRE{1u z#Il9nNoBONIwK@POKx-)f_h4Re$>3apGM9~a<0U}iNnccc(Y3y8Y57?iIxbmIKEnc zE(ih_Rmgw2G_pKF@hWB$FOM(SHUCM2tiB)8zB4?*ZQd@_%#ujmwP)(NGHXsBQ=}Dy z)5{|hSktmS3x9Sjt2NTHkM|r3-we86wQMRtB~wY~{7I%0j+l4pQi*t_RJtMQ1-$V0 zo)!jP+2xFaeSTg?#!g#B_2z$TEn%RND#2(((%T4jzue2uc%$9_;a+-wJO57@^vk`} z5qkf=7-MT$&At2Zk@?~Jx(CQ9(#&@#5&F%7`1}|CB|p{wJ|&F}>t2%HZ9{0)2d?HsK7_7Nsq0o<(X=>S^=!_x`kTr=Xm= zPH`i#Zr+h79h*39L%Na%_=tL(>hC8@RuB=6hj=k`jrFXArj5yH22dloAq1>b0W8NknOqGbAk=3T zN%&(@zVd?q-m{2iCN%1Bx_!~@u6Gn}TDV@#xZ~ehp-r^7XAD_`3qfmwo>4=*bIdf8 z&{7x6lCdVd+)@KvAX74UJ{90<2Fqzfn}k=NznbBxRFqe4M((@~RWo*8tYxJ*!u*H?EX8Rhwz`t+w{A>HrTeWFl^P) zR{4+4kRJ`)kMiDszs(`JF2%E}zZsCr!pIB{5CIv%Z1Rj2BZ$=>mMKJw+LZpBy-iY$ zlJPP@-X6j?_}-+NCrV)$9o+D{aPqg@51ae+HF!E}Sf!e0I)O!CFO5f9T=q$FTA#1B zlzYR+VHF`|L4v`bTkY-vZ4?$}L%G4xlO7|IgUPm};OKAuay_m5(KV`#^h)!$H zPHlVwDl572=oYkT;&d~U z;`?!Hc4#r_UB7B>t0B~&#kf9lr8^RCw7pXJk+U`%K~QN77CfGg)&b1e&{;*u*`~)> z719-g1lFU-rEy%l^)q+^qw*h=R4Ge3PUujCF>=NbgkSyo99FK_Cvtyj-Vwx64%`hH zFEY#LHAiYK?}bKa!&t@BsOetDtz{UI5I%RA)3plS4~1}{zefHEI{_S}&>PmwNvReW z+)`0_srKger)D3gCyt9U#7ri0SsQk8Xdv6krC(#{e@@}_qGD%WiIM} z;Ina=51!M0F~&K?5yTU{XjF*aC{BeeQjXw^HOk-wClP?|7fg@ zV03mtgED7Q?WW*;G3G6oyc?p6pKKOzcHK}bY+h+F9ZwZ*3z$bQ%Kc0BUS8r>H&#Rf08%|I1s~~SBa&ULV zCg%TCy|H%=D~}KcQpM5Y`C5Yc9umr4B5?Z5P1n-^zukUltZOT75WSY%4IT>Ix7$h! z5xbWqHpaq;2$H&~R3UNG?VOX%=t0rBE&XgA-cGx@log>xTMEowPgP=a9;Fn*?t8bj z5d`srm(-=BwKHLveGJy(2H}NtWM~$9E+%ngQP`I?&&Q+?GF+2_`m}fxrkus~jzN}& zHd`LFf_}=6r56bOM z`~f9K)N1RJ*&IqzR!WEtWO1of$nQ4AO@Be9uh|9dh@b|%FdS?Eo=Qwz`^6oC`xZoo zJVwG&+iUFZMeo5CebiV_0vTtcWGN;N6}(4Pm;*N#_&Wi?n7}C7DHYZ#EQLof*vVE^ zP=r_Y?vu!>+y&{?%U@A66zDPFqLCaCr-1yPY{?=nCKuAe#uuWafV?H!(gnP_j(N%G z*iqZ~1ylEmwJ3Z)uH!5FMNlc*UzOr)ptSCyS&gBe1@tF3V3Zh7v>JJM?n%IMN z1KVo=#$U^YAFiT#kyXt>1JkvH<;y$LmaRdU6z8pEl_zE2stBfOcTB`eg;4#gg7Pi* zn}PIcnZr%1DbpZD`NgSG=)L^;>dND2OEz~&BURIi*U-6Kg(4FtZ)xC^gxaiw$*q4k~O?w8mc9W7vzgjx#{kX#6^@aui_p8HQiCSx~cX3RJGR zYZ6s6KDz$iZosp{a!uSWS-O^^g~MAU@VPws!vVK+Q^^;?8TeeQd!;OF59Dk2zl#YCe61Ten!mVX&Mlj&OV( zr)3`SJ_eDjYQ=hWR{LoPaahaX7^-m(d#oBgD3zKfi*lT!^Zl)%Fi-+}2Hqp-bbKA{ zg+*<=(dk|`MVgiALn_^EYqAS)Wm=n?L%+zed@S-zK4hK6AXYSf@@oJd!LuJDUe7we zn1!yt{}@MHb5b%bYz*U~iM#<#G*@o>*9HE%6FRKfncHbQHXK|2MN304%zfYOwE8@6$kmds(mjwaX$>p$iV$3ood1%XK$c6I zXJe8isKUlbFc2U1gdFY~&>W#<>M2@81u4~eXXo#Y{38}Dacg^Ck@mFk{_>%z%b@j$DMVJi_qkF31vtam)+otaq(^>9(y7KI>i#KkmXnd_?4L|^ zqchkg>3Khqj!6!#Nq#R9p+MD(nO7tEA!nlXMKI2+`w>U0bA5$LGV}RF2a8c!Y217r zBmdI&)OyiF8O78hT?^GJGx5Hlcw_Wv zGJJGaj*MB>z|h1la;dULjY~yNq1$+7%9LYOW(s~6Wz{>yUvkQb-~M1&QRh??@sK)6 z&RcI(tr{)_b@;pKu37}yfCZA>S0#sicSzH8r>clGOy%@PB_fc-c?iYLYO5}7!#$i! zCkvo2Qx)B}>M$^hky=pD=kUwkS4c+(;F6WJJdg{}Qb(SMtX5jmjh{9q3)GBrsGix{g8Na-!3p4 z`G|W(?jL5WSNQORq4HtgCoDTfcGo+7b2X==qyp@}OJr;YYA)mzj=zn_VePkjbz4@L z6$0T)i`$=DaSyy)>6p5OL3K!9)_%jCrG#Jk1>Xy*%w|!g=A4-rx#&$`2cY}AIj zk|`}ibMK3^UyFcfZXquZRj8J*WQh&ru4=X`)It=VMRVpdrcA1U=^9e%MMLlaqy zjo5S~`LSbvpSv~MmiVV&N1AQN)`o?WykKI10->w7K?0dg^gv^w8_A}ydM!JNj^v9y zTD&qC^?Y2uDzV!Of6#?B+*(yK+MMd{PuWtS&pq{#XNRU#?8x;c#EaxI#ymefYsxDxEXP-GT81&Kc_@GTCdd{cJ!?9Bd>@leFPECj3ni3tWqJ9B=$h}{Ifv*- ze=r;*Ug(H$dJv=FzrhyH6}{OMM&=!r>9g@y*{e!%4I!GryLh&h6pJFzK|0=AL< zDdRk3f$#ZopI^2fuDJi&De1}acGJrNXx6h3sP;VH;J=PWw!H;b=HXSRH8T zxt78#7eh<89K7Y+AiXcDq`W!-6Z#}WF@`bj@2x2ffTBEWX$X-8`!s1SRf@>7wyxI>sZb`zKfvO49B(B8gXgd+wgx?oigC4w&KvAuo#6x2A|B=8Fbcqutmd7kg zR;7I^ZJi8=rQ1!D%n?k`ZCV{`5ZETb?BlYCE0SRim^GkFvPjyW7w)8?)=bZoiYpK; zz0R`O)X@O$C&@mQN(-Z$Ww1n_S$M2MkDO4xW^zXR)jKzv%}?|L@Bu`9lA|V_8XqU; zo^oFl@fY zW+)jckph*xL6~*0NG0Vo^;HuZYg_6Rn!pXu*DkO!BTh_&B5!l*~J5d=Y75fsZhR zJz;qQYZTSeG@J5N;gnclDXEOsRyV8?Ai<9Oy>G6QDj0^rTYlJEbVT|gJ*W&v0#)S- zvt&^9>E%UPP|>=yT#>RPx>9sNIKRA6aC=#_CDygsz)+4x`T^9bW-@)CJ)k*%&*`;f zxKz<(rHrJSS2`tP%6KASo0lVgU4XHWiQ8oB`#i8MURvB_H_6$o5g5xhabaw`kEQ3B za3P4@iJCD$R;id&u=NTKY61v{L@@msW3u}#-u>wIr~MUW z*7=^zq}WZ$2m;a%oqAR6c`>np^6n-UtI(2mLxYhX4d7-mdjU1aWa$Y}fvU_zS&ADe zvUNa;pWBUOkSNilM&t&VM6zV0BX|JQ?7@^oyu^L-M!U*6`QQr8ngc4J%qpp^(){Pj zB#wyN6^%p3v5;5yf@WezdM%c^f=h^vh8)OXx~RzXGq}moK0th|CqumE1ax?|;df!H!lcm&(Q)*C1lH{hv&?6wm@Os^FRmrWB;C=}EO`?^B)C-NsP z?n=%EZbf<-7}OP)vg_Vm2u0=78E7AM2zhppEk)Q zb*7U*q}$)-rv}j91gIb^y(6R(_cvM#MpxnCK_9_>kSntc^-&FMyjip>(EL>))&3J; zonoq`>Hcg6((zTnk|Flsleujj3i&^YoBO$w)%afvfBx3-44o3b~v5U{v4&K z4=;TKp)x{9SQ#|s2;I2hzxZQNJ4?iwicGxxJAv>AKSq}{C7$PuyTg;YOgZXM_kq?r zO9>1+xi!mbQYzY3uVftG>vW%Tu*V9P0MD@h*4wfJQyEArdB`@RVJIHT4!G#nGX7H_ zsOM0Me29+$tb}AVn(w2f$guUw7blO$lQMCNGxtX_Lc zWfqncy#)jMAU;Ojt5G&$eLA44?eJ65ND+raa9sYQL za-N(@$;6)hJYeGync%HvoHk`BGXG~)W^={fwE{u7{ODgYDcQqhrE#ss>|Sl1{|AR1 zr&|2YkQTvi_<~1yZWAao}*u<84bolc)iQ>tOYF4c%r3DHrGJYhMkwi zrK;s@YBmz|-fb!{nx*%$B;g1Q71a){LA?5=4?;q1ehZqtcM%V-;a^R`l@6Xo@e_p| zY7T~u;NYYmDsD6jY_fqKo<@(@kTRq1^U8VKjK$Ezw}J=fsJR6K&%wb znU?mR&v8o4*Q(^*94CmCZ*q6hQ&XN)s5~{*0YzvI!IxCQvtVx|N-pRwQ0w`8z)D*> zYWPj`jCQD7Z>zt-UP!n0SxTY8Qo?^~HX&4BuA2)@B*aItAn?f~2UMohO>eF}1Vx9D z6_PViUfJnR!hrZq?oE@^dHyk^Y!y2Ebgmk~425WmfyBc)2~*aYm28_w91G(134>|9 zajas$fuZ9zg}yq5_VSJdRYeGaWpssYzNE~wCjWkLASgvFv&Ysb67bgy@W%=gfqH3J z0zi7`s^IE;Z6{$`bjd2lnrw&7omiU-VwqM?i_UA~GIl=DfJ9k4lIJMCgl||0^ayp< zUcl)&gGBmFuB`v4=^{G=rq&)Z!uQDwlF*?+2!ga&;OzsJ!)4scf|hmjib0>`aWX}z zT(rB&bb?!0KY|o>uq#rK7B@QLat+F=eP26h47#*7??`^^A2NON^uC_aXMslE%`)s`Y;s z9gffe|4}*D5r2AHzYo*p3;k%sUAO60@~4|pYhaBCpqyhCtIBDI1fUL-ekI%>r5Y~5 z7AhciYy;Dw$Z80u`M}_nYA^3l{)tyD+Qevjv^@x8x2Vh^d=W~;P* z<2fv%2fU5ntsdgG0e&t*aC<;IS+O{e_DtZn{bv!TW)h)J?t8mzK%s1i@hXQUrNar- zcde66Rc_E^U@I9c?uDCxn(OU_nbVqSqFeNYW7*lR?%GSZc&hLimuM?^GO&t+&Te{zXC*O|As^Y_ye<0LH10Tqmi7s`pk#;z*72oT59AqGLl zlkMOsADU0&NBbgM2Bz2SF7=ghU(ebqF{Faqk#6|J^6M47KS^>I#6;wB#-ojszO&$2 zAR6|@B2ry4!egbArpQB{PqEWy{s_q)pa@^S!}7Ck$cYnML)!gT{e^kr%%9kJgP&qe zXCmPnT$eFyPFNL(3z_$vu*?up3Y!N;E%6O61=i}Xrgb9jRE>>(^q0U9RgU0VcD>@R zQ%+jYPGPfB9VB6&=5LID+nb!nPE^~{(*R(+)ZU$i1JnO9-rJQK_OkxjI?Ou zjWC?;GGk{3T9-!yp2&i{Xx6M(dLb{ovv`uF_ONpmfO!sau$uQkvk=6cH}UVKb6!E0(EPuwco9#iBQ&lyh3lC z2hX4Ja~%6iB%!J$UA~|C#t*L)E0#%<#%Agc&6c}JPm1$Md6kOjfM+wg#*Q}XZSs?D z^HgYpU&=rSK4@YFCxktoI=|-%oxf`)ga=tp-$bynI4!%yH$o1#?u)UduP&(BAL zGVTsKT76}h^NfpmDE>i}^34u{II{IlF}N(>tu(O8u}Q2DEmIIhK^EiH^*(#&La=yN z?*zz=s4{XrY7&``aS9i}>7;vm)b)!IFWNPcG4Hk)$N{A{qWALIH=iGr;IrZ?gtt|;&GGJcpl+nnqcE83jWUFw z6|13n0^g&U;ab3L?MXV=^fIU=^OS_L;HGYPlH^o@fX1K)IZSo_H2c1nMC*w$&5-(F>)OF~hW;l8 zj4$vfpapLnKAtKjNwvlAyG?-@7LAs08SdTW^_r3{NPhX;NMBpl{r+EHm(%h;ONOi? zM+lahvn!%9-DGXWSEFI_7h1wkTLuuX-W?HD+9@3|Ht+BIke|OSN7%;yCAeVtzYSs- z=~@1Fa4}I$*!CYL^Cw`-zeNq-Jz-x--%F4)t=OQOCd!OSedV_=Q37H)ili(17bc8g zn~fq=Vfm1dL>ZsVU7~$nHg-3A7Al_1Ztob}PwwvT2DhJ!mId0Lbi`2N&_5+M7iWNz z`GK5%n!V!-EgL=40>16OY>;p~J&@q2bZhQn@55aX&mab zxUsm>Ii;^D;aWlKO4gt%p)%VC7ZFcRQ@`FGSKPXvSe{P`oe56oR1Ud(=S&U>i(KPX zG52=w`y^7rLsF^EPEO0;J zl}pI@2X2Y*e}an&&O;RVpPvsgjSjS$)1M#iuZPDC$PcJmAPX5gX$i3I%ZIGx!-wzT zr)9#`VCIC=~*6G?gsP%x127_BZdEN*{vfT#32hha>wCib>h8nWZFQbgWN zBO?qKm2ZkktPBSa)mv_iF21B=)frb#1Nj1e`I!L(`V^d zwCWa0!9?r5AwBcScAW|zQyA!^$vyHM9+9@j)WkY)XWn)c;qKGF*N%C9<1>8cSWW?n zTN{vphm`+QG+{(z1%}Aq+?T}#@g2hH0H?0gM{iUpSLD82TA|!rU0E?Ds$zo1s`)_{ zG1h1cDZBRSELH_#{#M{aFjEcKT>v=aIQ}j`u=ZjRH~`fxH<&Lh_*l$#9jcobX`Rl$ zAd-X8?Vy0W@sxh2#Shvc_hS(!Jj^<8KRDT>G?^39&Z~s1TiH5o1KdWv`0U1c*CyHP z$b>3etWznX_fx{+0S?-n1J);a%*((6;4G2yPYE8dRKsNDEJJQB#!kTRn@qS*nIv>LxaQT4OT-7xVZ3g`$mz7LiP=U z(2If&8ilJ|oRO-Wfckz)=(ucZgR%E7-Q*RB&21w!2-@Lbe_HA?FGYC`uccJGJu@wj zAYO^czLWDcY=r-INxB3o1#M3F@n8dnIGfHqeyZIBa`^6bNWmq>Mu|TU*5+!)1Hfc zY|e;V#89vp_HSM4r9G1J4pX<5`-t6^>Q+YOC!!&K@uo>Zb~Dp?5r18-)^xUDX$xKD zE+9X17>OsAiTjRBe6ttFxVWnccHWBQ%LK@7#7aXTKkkaNd5hU=sJVz~Gv)UrCHQI; zK>DAwF(gpJ>e@1gMKv8L5huVo3DBM0U3U=Pi)ZlQDHAne4lyEzq+Pq$ikzqoMv0!i zkVJl&7w)H3yU&rqnNRGWpoaCg20GT8pkug2P@uM4RgErcvD`4~&o zTVf=O^8rOE4=$_}9O0}hUO7TJ+Kt%po$uHWr~H@B1kfHY5trQ;4*@#PIC;=cGihWo z$$ieE@j%F^0Ob!;bgxSrH6HT3fPq|Xv-ZM#bVM^+5symXC(V{97472VF4DyE z+$coeSCG8vjO@G=v{A>G&3*@+2w*mU##lqv=R#zdJ7&pH3!P0!&{%!N6Q@ zizH_a+kQOEB4VZ3RJqeG4S%cJ6Q`u9p(+D7wZ>nz4-XNH37~&v%KkS6#_hSR!cQqX zXJeg4xm56^xmD^tj5IxVol;<>r8TxdJ*~Z(Xu;T2rnIa!0gGhW0jNU5&TeUY2AQUKTCzHR3s%+m+7V22d_+7 zjwnR{Da0&Rd-`Rrx#gJq)!<9IBoAEI=nEo+VQgT>OPFM*T6c8Uu&zIh!ScB};Q4O@ zAr9xW!ZLD`Ymv(c9*KlbZ0mek>`y#;GqNC(zwZHkMX9-EYqT#xpf{MNr(6hfVBbgv zYKahy4Oo~^;^dn|A~iD}e*iE-KoW~|EhafTiM>uTTaTjRjp^ztLNT(4B86e59mh4K z0w(pSJ&)i6JDwccOFOhC?eKI!qjm2b2{jzXjd&QE@02uJn$@}ng$J&yuH=3zyG+S7OG-kl29g7j{;2R^Eem~K=LE3A z&v8)tu6-oi*~cGD`uR0G}AVSJ)l;bzY88C_Bk@tb%_^19}^;dD5Nkk{jPhD8hIhKzBIkPXGu)5D*J*Ex-eLuN8NA^_*h^$2XSD$IBpiAU9@M9k?3IT|`qPb+N}=gm22lcT7;mIUANR?u z1DLe27X$Z=6}lQLd;t&=CY-} zi#96s+2km?(lu=DyJ)r$;>KVh&N7S0r!>yPSu05Ni+S3jtiKu_K_L?Zy`s%AO``

y2)E>D-q^j z8DYGyC=XgFBO+IE>9F|t0lo!2fZk@Bn$4bbhR#ZwVA4i)Hu;5)C}@KyWvZmKqTZ8% zD6_po#-!7-at*U_TWaGKQ7%rGNMlX1sye%uXe%x9r)o*BDKQ0a!;$tiWZ$S78gkd7 zaVb*oEnD|4TlcZhZpyOM_}H#ENJZ4iHq3dbtR{XrK4r(g#0jXUWIhM%nBXl{@rksMWQW@sIZ69ix|GNQ5X0%MQgasQ~{_9!mrJyPKwFBrTvO z`Q@%2i*({hSiC49RX>uOVjldz6eqf1d=t;G)4g^2XXrIWM+DdssL|vLg!7D;XHNLe zoKbZzistX4pU z_6l>yC(Zr#Rz_p?@|6*&5HHwDZsSpHJOiTVd&xtG!MPh{DZP6Z#8nQ0N6KNo0UE466Y<@iW8(vn#w996dGB6OG0pXdd(U!l@-Uu< zG$?ei^z7*k#GU&sKg?pQ_!X4IvDt@kqz9FfDv=K z>_ZB}Q!bb4MK@cc2RSd;8E%l36ip_`Cpj!#)}ky_MnySpNvr~?I5amWjS(AIkm+(| z`h4aA;5BgKkNG888x+0no923X1(Kgpc=?ntjI=KL(_sIGT0^!QO#si`89V2FWk86c zk9cH^S35l!g6j+7EkYQIQsLE>akh@)F~JUYc9szWey3!7auv%G-aikyuT>Q#&<8fX zK(6w^*;$A<+LaahCY)+FDHIRRU?OSycDEzqOG}cqh+6Vh(tG2IL$FjgmBng)n78r$ z*64M1H*-Q-4ge8nEt-SVHYl<|vh2$v{XyM09xIq=m`c}VAIsxqYAAJ-LDoEdiT=+b zn^+9tm5qAGa;nI?u2uK&k{q8Aq8jU#HEf-<`6@dJpXO>a%Et-=egSRLlvDbj8q954 z3!fW`(PtD}a$*rc_n+bu;R^NuSrscj?ib3IW(^bOb)=@KhVh1kirAljxd#lmcXEc8 zJ|^?mc2RI215BIa(Gx!Cyu-dPa})G}L|j1n&axW>ZkNB#0Z}zLziKkfuauKzInHdv zDku3KRXLZhbI4e=@l~X+`0=45wi8o)qI=|r$<}egpynWY1}Z+_^gETDg@iguC^MWz zg126{4q`CkRTveuyPmvPXhcAV7EfD$Tv(%!vu2y*q+}Iy$4; z$Ow`OdHAwqFI+@(*%f|;4I^4N^2+<@Mnp(EF{mKHa0jkZT66C7aXlOBesanVT@1+P=4*HW=6 znGbeHYhren&pes**mb7CuCYbwMU}S`&qrf$ueK9@p6>uVlEr*~pVyRW4U>E<_%1J+XFtJ|=zugtpCe z{#!)ye;kRh{V$ool;;1(3=w8*MTEQ8?Pb~B==EaslueR%xWhU=++iKtMKEL_Hc~dw zWr8p-Y8`pj*VFdy>HQT6*w*dqN106PbbCX>e&c+5Z+U(njU3JRETHaAI>4sj#!P_z zdX2k$b#(`iM!s}Zruk|9<2C+|O5iVt7wk{Zi3!)|oAAgFPk&B$%)N~B8=U;0AI=15 z;qYA;)K7vQnNEoK*Dgrj5yp4-sA>z7Cw53Q{P4@&p30kAC7Ujm&^?DO7S%Pr%K*Rr z#rq*8b#TN?=k2{&-H)f7S>S&rBEn)bz7@9hu9ludd-AABsGu#itsAJ`-U8>ZE4Up< z6gfRQsgKe+-x}nG=&(CJ9b^Wn&I~?3GeB;YYk;wpVe)G;+!p1+^fv21(e+YJNzTvp}#0e0-J}UrP>X*DuEC*j9 z5st-?gx7Q#QjB}&npl$rZunlhyhBEB&J!o6j%dR^ZwR|O3c9pKq_fn(NALT zdKI4mS(X5Wh6H5K?VyYs0lNPtnnT(oD_#saU~tJyQ=tufe8Dr19(v7Wb2LiC!tud2 zYY6!BX1OX1K8N!Bt>-h=<=y&0V~jO^?N}kzU={LSevC6{fBe~zq_}z6x#zOB$>2>1 znn`l0Ix9sBb?$#12`Q><^j^#!-D>h=4#vo&o4G+7FlVLB^g3LQc@Y@J(7mkWc4Wjw z7rlrs;$jNSH1>e1y3!ebm<&Xv991IAbu{3|e;bHug9oUFC znG!*~{)U3QA^Pb-buRY$onZ#H6Pop|vf5%d3q+yzv{^8pnI@GB(6|>hG93UEcJK5C zxJeqmwbwT_`8}0wEv_I{(*&~u+uZcp}+NiHxp@Ds&R2~MtIr!NK$N>C2YnFQE=pdTCDS;t%# zLc19k9gteukJ;yhq$~0vd(}^AiF6`}q;g9vV+t#`O}$2qEcb~aBdtorBpT}8^Ul~b>3d~u(T|GXDFKr8{muQ zOdu}u0_tEP83Rj&&kN&a6KaI*WUB7K9u6MUC*H|WXi=!6kJd-s;5k5-BW1Q(b_Ro( zm*`M#Hp+i@e%NJU70_nznOGz2VLuyDWotf#H*f(oo(#)n3ij742d+N$Q%nLLsOS;{Es#&(FH*i(YNMV>0_Nr}lO7WHcY z3c_CQ{NeP=^+GemE>PFEie;kgu@8)g{Z}Tnh$N8F25fW)(0=(w&vrSf9Or$ZcM3%_ zJg`Y_R;*RBADK!+rL9ov>rtxPddtiKzXwLlt-S^Od&XEJDVKnqD(&I?{}_9xCQYDi zX}4_KuC6ZQE!(zj+qP}nUAAr8wz_QN>mBFf>>aT#)}NS>BWGqlm9MS=4hzC8xM;n4w#bb`T2* zEqr1kZ_F-=lZVJ47`EyQ^@-W!yKw(x;;aL_c!~3Psd|yIPP8K661k zkn?qLP1~Cxzwr8AD8}a+I8qzMYhl>uCS-4dyYpfFD~}?11v_mS*is5L1W(DK3?y&0 zSd`d~neKv%LJAQ6{+d}|W9Ndi0Pcngw~O$flXEn-`SeikvpCrPZwN9GT|4Yd7Y1#7 zyB*d+uK?1Uf=<1y>OtAP{Kt|*DWZ8#5?0XC(lZkOmXr$>riVGq|25j5E8;tPTgI7E zXY;_Fo7;Jm=uqD4bS=XnHH^1AR5prbQ(MMY%%(BQ99DWn80ZnOzJI6$=3jWqPqKqn zVibqK(znuG1Ci75(d+=&Frr(y1uzewKYDFAipt97Ltc#1y7VzuSBm15?m?DqUPuvU zJU}fT3bjqJWtM@R4A)3+-s-XA5c2$K(26bakOYfSS-vIfmr)6z;1J3@yRMV3+mHi| zmSds?L3{X)@4!V{Bu++s<-|f|4|43NQA$oC-t%E(b{Va|CL7c-w9D5|LLMi=fcU*1 zX&Au}L6VBcH26?+cUKMo|HUpO8J!QY9-t;hB^^3r8^Tn>&${m+)p7&jp!o4j`{a>g zgvY^#$e2Rd50c4gus*3t1WB-I1A77TE>}^^e`a;tOR8`q@U#7T#bTfNq0+Pn&xtYs!)JIAuerx1c%BhN+vXk zcnXWec!2q$+GYAzWKKo}GO(`}pe!@_W|TY9@*LdSWkr!zE?zZ34m{2=WUbk!kM z#Iy}-vIc_p9FFb0kjGRbw?kCT^Rab~(UN?B)RxXLuACxESn-H?=~4NT_^JyD3oW9! zG0^WA&9CvTUQ5&54i8UV{KZ5neJ=CfyTKlF42N+Soy1T$6-;)i!-vttz)4pnzRR zL@OEVaeQ2tShy`ONc!5dI9jZ4 zIE0x$;UW949>x0X?2i2zTq=yxofuR8>SQ!<4AIF+8h@*3r>#^%IF&>M^ei$ZCz73_ z_E&w}1H%%!2$_9c>(TQoYCLbXj;l@LT?F45l{8i?weIeS@5lDKH9aD^o2;lLRaYZm ze4J5WQ%!sGqi_Pu74V7U)Qy%rzu2kaSLj#-6=boTJn~9_43U=-F&1xAua2ahTN*I} z&FDRu*+bIYkI8)@&QoK#T&dMk?{gkWzJZ4H@XUX`rwYqJ^;QSvqRXYg7j{pLHc|dI z7nZ)9s*j{1=ok;Jk5FE*nFh@ne&+$TlO2s=J%8Tm^xf{xR#gvQ4GU-Tgs(TdZh(EC z@tM>=m{9F>P;i6)g?LIHhc(6bnhP^~B1X7q^^1M`E6Fl&syU!&+ebef!Q zO~PW$N-dP{AxD4-noL?vMoy9g!&vgwk}Zva9*{TMoOfv}hIRs-^_>`ic7s-CM=$@@ zA16E+(QxiH=DGH+LD)1;`HPqbHLlFUFlecbrb6r+b(uU+%AtFXhn8 zP2zReVQ=47FYVd{UyUrxty{%zY1<5g&<*&LjCkcK`j)@B(Db-eIX)hv%GsrkqdSRS zwdwg+fTg_eaFjWzWjTbz1V=`1N=n_^O)AHj&h@6()hz$5rUWICvKDbif>zYa3scgD z!y&0VyZTCH{m%|<0c61d!q!{izmIY?t)>BjnhapZcJ~&grH7Uw^(2xDGqO-u9&*Nt zsERTL!(zW)QSEn`_n@E8%4`z6AI49-V}#g=oPZ+7);LlkT`8{F5{Mp^aX8ez9Flz0 zzAu64w&YNazrWIoTI{`}#ic7R(E!ROJq`$5P(C**G)eatuLCGfXt73h*Jk|=gFH!s z*$Fo_7uatQZl4Wf$w52-yRAG3AA;~8H!qN4o;~z$>zc zgD;%a0aD1|-6k;JdYyZhTGQ~skKOO20lUlrZld!&aL`KM5t*p3`vPb?oYE#_2dOVu~d@C5dge6{!+FGpPJXmCM2FLU0$4j$n~1<002649$-j+zQeQ z6eLX_&=JXII$gHOm0G9U9&bADKgm4mS+r4uHYdWJ3cXQzBe117qTPV!Ivk@5hPct zyL7Kz3B$H}SZ@bmW&*Vn*dSNL9?~FV|8+zD`h^K2v;7DEfcd|QSTHd%0seQyVq0@E z_L3QC`vLtefR!%oFl^}@9EGSJ)HF=}(HVtxYuIG)=1?rfi0f~LGeD5kIVFo=lrF7O zmM3Zd0w@UXN59UpZUpu;Y%`7F)~M}!ZL8M{yXVUQj~|Af2abNyK2RaQ3G_FxC_Me5 zof#!CJ<%*mv6Nf+9*EI9*JrM|bm*ks$g2}{TCC9Hn65003R#o3Z2YfLWVl|2`1=rL z&3_z1z^VN76_GU+4=1H+t8W;Wv7a0Xs2+yCOoWW4AA9 z0=T52VUI6)gSCURkdJUgU5r9|67DzQ1`8&tp;a@s8e7Ff?o`^4CxwL5=X&#XGg1|| zF(-k~i;2|G&U94S3%?>$gLzQd(p{;ObRWpH2!5eoP}lb)N3;%w@vWY!%Y`fx56H&m z$H!M-?Oaeo4Z?v;cCGFy)+XRVQ{jiXsbKb+aW3*|*^L=!vhE=>Y@Gb)`EFrC+8PU9o{h# z9@k6e!qn0BY~imOxk0Jh)7R12`~4C z%TnSDl_5eJ$8@D+LVvLgs18I&p87vFZ7W+-HHJ3;qEDRdCjlUV;YHKlGNYZud_l~|Cc|f!u4J^h#!#Q7IszR8 zC@QRZ1UQ^$Mqy$-5N&5e;{l}-0JwQwCW8vEEUzZT!oO}#t>x=F%snUzmi%7B&6w!*+eNY zF3gCluozApf9pp^LiI9@v5r@z+wrG(IdIlHCH3K{I6?uQs{5bmFj>ox&gR5?EodnZ zN#)%07YUt9a)wj=)_0d_K)Nz*a2m~}56I$j(DvHliRTG*ojdgga$h>JuIsGD`_Tgjn(O#m`e5J0Y+< zfy;xuYL^r-7m?|Za~*@b;CF4^O-@f~hhI4(>1Q}a76F*ZQ_LJ?F=@gI8yX7E;X^zr z>g9mAWqouy2nJ(gj7W_j35I05--$1o`&+2%ODKFCvwKu*(kx`GZahmUnCP;&)V3pd z!))0yB(B6!q8cz4vSf{WoBGn1vw}*7b6^4%VI;1awA)UJ+D8=Hb)c;(qY;yZs%diS zDj=eGK+RCs9{#l!AeM)Z`>90B6~LAV$_%$aRi<#eA(ss7Vzm`fgWB^PYOm}GyP!ad z|CXs<420Lt>B8olwmh1Yy?}pj zmFzc6Go6^KtZFEg)WuyLGB%s;T*}Uh=#S$(uDCEyEQ z<>j7t9se+i(ID97yP#*v+V8*?Y_<%6TiYf9Z0?&GmUWg!KP)*h)LyNPsx^F=@wFS> zt|yqq+On9RQ~C<7H@!6S(NIReiSmeGw^Zz8Onjxd<5Ivj%nkBvrk11luzd0$M zXs}ua-JJOh?Fm}A`YF`DY}H(8NIc|k5Q3M!$72;6-~CUL=ysR89K@{o<~>`vvdpjC z%*v4qW{-U+<@kp3l{sKNE@Ax#M<*{eY;_4gj{?l~ynkG+dITYwY>)Iw=zqZ0 zrXzR*IL<4oyAzao7@;eF^XvhxO~aRSz~PhT=#W674vN>2#!IxP3g z7V=0t#bV1>8~^?zKL#+aV2&6@c*5QjOuo~Lyv~oj9(cb`3!J{_aWbr)>OoxTB7gx9 z*MN1H-AivTF6cGL$+mxlI~xWa!~X8u+suu0&w>e6oK=sv$8g@j@ieCvP<0wxU;lB; zq#Rw4Bs$tm5cN@lR1Ys&6?I^(J##c1UrHL`{W=|39gssQ2wfixJa>$L^8C{@B#F^w z404)R{@bWHaj>8F$K;+4PXFtahGCWl6rSu|G@drVaTT#+7l`8fZL>W1=zEi)1MSZ~ zpNgOX^V>g(!Z&+}hX3+?2D5n3PICJFs)V(`?h!TBs)Thq9x<@?F%^Up zs>u_&wh}IqS_bkUMnfa1F3Rr4xdZSa#4Q^43|}GN?CxgQ*Ei=~osnM|{Y39P?!^#g zYUCJK52A5zY#i5QHnYhT<04-nVQ!(ub*?HRyePt_HRiX#@iB~pSoKO>et$c%rnI>J zg?k&!X8b|toc=MwU66){?8!2(6~?K;u9=*i-LHt>=X;e*+1jJE$r-9zgWKK#9%+2b zv~rGa(k@8z@DZ6kSYOvrm-K3-8eI0R`-&3M@vt=!B=nw_3S*2A1}#i8X=P|(YUY@wZ}r2>&g9ASvTb(L>%~dYLcZMc4q2a?oPV^Y;Y}D_L>T8NkBG zzcCz0a?R4Gv+~6dz?`mZ{`p8MtdIOmiJE;rn5KFiO;&{BKc5@js1f+JTjt4s1_7 zKw%%S43R*CFyW%Quk)=}TXQF8l6ryl*C&Ke#pdZTb2w4^&Hd7%@eJY_8IDWo(m+ zeAmB~0n23~n#i+oL2f{*-R9D0x-us3KX7u?Ir4As7xjJ6+GlYI0CJ1yP3-jIYOnj8 zGx9M>Cv^hpt6PR~q5dVO6W|=}_eT;`L`UsEm0s2cB07RUEoP65(Z?WQJiCmCLikhh*VXg3Y9*cjf}+71mz-JG}x+tS6dO--dhx~f%Ebve}#GWF{+xr;p1rx zVEZar5<}hg+*7C<->MK8_69rLQ$l4U`r0SuE2zoc6NL+KdaGgzBxc=es;qVNm zWd8YiIt@zu*^!*Ig{vv9t3bMx_JvNWpe;h7n4pWo;c}~Yl6j908)lYfO|F|jujQh)M@ z6)gqqEQ{v}4;fw6o2#hiL zl^S6%fPrs*Js4?+4H+zDiw+&kQ)0mMZwH?a!Oo1){4Gj7>A_Aqj_c!fv#ZIc!JjaL zavDAUWPkZepr$Tsy&6uV)gA#+!5~f&Y7eE5`sR4q_x6VKj%Lq_ky0hUdIR|qnQ6Tf zhrO3S!vWRv;Vcs#m}KuJCTNT?X$_k-)XTo)?+qqa{WvQtXbAXHPYS^fy;9VuZarWE zS6-KgkP>K3R_=sgypvCz@2Y9vL5oQzeRz z-ZZDAnBn*lc#%HdwOonZ^Cvn{Nt*GjC1uj(x%%$LlGBvYhfrFx^1&zJB9=IRTkO&} z;Jt6G4JL3AjPxE`bn4pv(snt2@bQr^;N7af1&;?8b9478euy7*{(T%B(c4YIKMy8E zK|#!x+O6l5e0N~lv_Axf72;S*#>$;X6FrbuGH0x&Wc&h>>BsAhaYoO;?(OLUx%2`PVYfRR#F20m{t*T&4 zb;~s7irWZAfeWAoZF3VIlMuEby z5sS7@N1p|@)SD^Av^7}G?Kfo}tdTQk&E8Jnnm5d-rsrfcZeeU@F)x`-c#ZW-E)Sl zX$&6G`E3V}xz0YkKYdcXDVwK4VW@Pc>#Apa-t{(Nhxo)a)blRhiKuT{yFfqQ^}KwU)MH zTgN^&qb;OzLSJLkl!nHcE3}!%8AHzXh<=IJ)NCRyPd5(Rvv962K|vDP=Bx5fp;=mJ zxcPM8vY8&yTbI-PpQ&a`o#sk9<4658_|8T~^wH(-Xbtg04*fTy`sMV*M9I(AJ13=O zA){6KZorlAWIa!rbIll^j5UufN~)c9bYP#B9jgfPi5k7jmFR^JlA3m6-v3)f-RJ35 z%)s&I81Vq#d!6={%;D)SX zHvtS+t%+Za>FY-?LJg5}3N4yBQF{ZcHW^gQ56bnCxxRV&2j7I!s?sa$tet-!*!=b} zf8JM5zGev*<@he3*`2ofAM0f?=cFCE0{&&49`8O!Q=H=2_S6u(V{f$k;GI7&e|#5M zuJx`<2lFcZ%Izb18d{^`Nsu({FvFt;(f|G=<|a=TANbfq_B!6x&PJ~AB+fcp;^g+g zV)8An8VUpkgdb(t6JZ$VZ^nzO=hS+Onzp$k9sb=u_%bRb3Gws&bWvPj+?%k%SRTP7 z!?aTv!rS6;dXe+?Krt`)1xa!7GbJtT#&{EcNl}XzIR0Z#_-06y3Fu`}Y?YN8!TNP9Swl%VGifnhl zZdQ6Ch$sXSo~E*6sJ{N1adDKUgy)iH8_k@d!5>(dD->DuM`Lgp%1>n3hr<~H(U9(v z_P8q+obeZ&J?aJsCTJ};v6Ti*0MFZ=1>AvF{az7qq=#`&10D=^mB?>)kOeZ9U_M)5 zxA@}_%w<>c0f312JH6Fj^zvqXnWs*VFOA*tZ;uahBVH!zD&N3Or1!XYS^=#fv*1aX zsEeXb3s}xEh>QXiOxlWL}ExWTg>)8i``Efa|SGK_C_oM9qxvap8J) z*=^NRKb83S1NGZ~A0_DS&Q+~VG&Ea$t~Mkeay#oWbZUwe;x+wfp`d@^6`pf#IE-nv zPq=%m>q~!%{AiqxP^%O+k&Gs ze{w~+eOdDCwMy#4Bm;bIjoF?aMZI8VXXw>+)r7Li-+yeG33ZCHwEi`zM zHBRS9FTRieO`?$C0vTZk`pZp9*tg*vxvZQ!DvPWloCTSv;-J0oBnG!2W{&B@C&KtQ z!@6aFy96cFkj&8B@0wZaJg+7Ti>;mwi*pNffpBTlN?VPEwLttvFz@I)q=k&HpTG~?og?=>iIq&vmUYfW5HfzrJEIxnli&0~PM9AzwI{dcU8g9`528fPhPzsZf#fCX3mU7g*s1s;JX8IL36nA#r^3 zV01^ZN!Xwxy^Xj%J@NYmnAiYTC*^nLdnA;xh_3f%cTxB^qK-x-8xh4CSR+T$yH&=2 zFKp9*;YvwW7@x{cjO%mKtk}Sm>{Bhuxfms~WNw-<9;V~%NxgSrmSpf#BKti)w z%~DgR%uWp^6VH)!kiN}z^OuH_b!AP_!Nshj%=J@5MEP(pUbsMMC0Au7`tlCg82K4Jz z^Cig`8i69idHgH)QSI{S@?D zG9klL!MI9xFB;PLQ!%h{y>gGnmr`CDR%_FI+%ZSEI*FV7kc|dhN~nSJ_riAT+SHj# z;%u}oei7-Z*0`GS;|JRe=C*)0Y`1J=@_Z$_#o2eY_^v>0(v<1rdHOaq=MojijHJdJ zlqY3*24e+GOc*bO-gHhUfwlsdzmdSM02~#SZaWI}8^kDQV3-4q56~}!O!w*KW!TlpnL2O8;TdQZ z`6?94T9Aw2cZ}E^qt-q3>1(2+NYyVDr=Fnv=;!wUPl^;e{0pLBKp?j{5l3{yRSy%p z7mM-6?uq5J>DMs;(hRZI*C)R?qP;7QqE$6D}&YiSCR_7Q?^vd^x={ z+VbEwH1q6JGi9enqe-8d5X^=5(jkSaKlx<_m8$yYQ-KQIzBG08s>t_uS#v@@b%w#+~Xx{cQI?>DjTGzl^-i}^~Q@;kj(Tdbv(p#D`NYn zi2AQ8IKb~;!M1)9@o^U=rr!4W_v@4Y;Gl5*2N2V;qpIi_l*%*Si$d>FOrn=`p$ya_iBqzZzkn?6@nwgfh1 zj;7U2%2=&19@B?Pie3rs*K));YC@9|94*IRwyCCO;Ypqk!#0dLo z66a3bFPw+ro*o=OdGhl%vwoO+;g_Xho&WfEw(Rvev52w+`_){hZU<>7ez!^|y%osp zIh!23>8uNwo>cqQVQ}T0cT5^t2$_E<8R&qhAKH~2%W*k}eO?Dc4i|Nexb-x9-ufZc zzaeaa5E<}Z`ytcY9|$^Lh7ftvhW4U9SL{z%JO%z(Xa2d4Cyg6jyio*UeJ`(7A= zo8g`3*&j>Q`VFV-_4;dwIg2deKbp3-@#9ySp09>Zqk9SY z_$_`udA{!&a(x+x2&FGR9Ra3^S3R%1LrUXcrh4t-WH5hlrsu zLc%h&dJkQJ4g~pm@h!`5d^0lst;+q*Vll=VJ=~>WnU&U(82!ok=J@g~9ys~@7^R=y z&&y?Hs8*5rghuY$a?x7+B(CkSKz@;fw zq|#@csf=wyPwet{^5AaTp!Gpw_8=OKN2WAJfKsQ+^7vXUZkodcvCHL*F6;Ow^UO4v zBB6YU@eY58V46p)aJp4_BH4A#HZ53TH5~9&T!x*E9Q%Mvwj8IDCObPlqdF3q+V?;? z^cXR?(J%>}3_bYOtwt2A;4Ri#JCBSf`}GU}s~gcmFeE#gr_lZf zByu0g+gw{y2RYwCDLGT_m!-k-cU{x-z9$Wwj0Ru#qPr63%3 zS;((FIBf|r@l1X9CLqEqk+9R%_`6k-RgA9rw#z$G3VFIthN)D%9D!bC1(up$YpI*X z-oFY~F3Bs2M#GWZQcKZiCY^(^6d>dW?aIRh?AI+%AkX7Q84|g7R_#BJFt?66(03}0 z1|LTOH5*GhMAW$++HF+oss>~8ky+K$ZvQM-_SZeN#tBFZj~;diz5a* zK31Z8(lydVG5l2;@`5Vk|ICe?i;Dp@j7L&|)@P_r^b`^@u%fAaI1qOmO(Nwl*`GSF z#*RjCX+a8HEuzb9*0Q0DWL`e9cSfA%oiD*5)#4cmIf{vDhbGOW>9+pN_xE7|;stU)`AUw{=Nnv=H(B`X#(tn z12HWZkxI?ndNe!Y@}ud9em%4jTb;|jHZ|HBj!9Kh=b7rB>%Ssdl980hGD1VlhPT>w z%&lA7nlaRfAx)#HA{1S;1?dn)kP6)j8Hj{MuTmwnu^2I>=G&lILV7z|oK&uj^uoS- z)CVv2!Qy7#T^3{7L?TXs#rdb@q;5TMUyutxyTB4)J zA7Gz6BZ4bj{X*fDl`HUT--h%t-Hn5}(m@yCPiZZp@wHp7RL=p$OS&h?M?^34cb&(P zk+LG_M3&%koQQ-`APcDyiTUx8kaXUb#C#oSB%}CpIMvsk5G2k$REurXe3FRE!9UEw ztk~13Fj?gLs*}ONx+JOoc@?)8D1E=42F^G7Uupw;*N8bef(-;5{KbH-fjxlsrGlvl zQlkYvLoUhQVFrq`!1AKoI3q(RY3{m^5-d%%pQ9dN8E{&eAi6R@ za^AyXpGJAvsZitYR^0IqzEEl_k1I$Vq=_o5^?r1!Boj`fS;`@Zbke~;_Id=HrA<*&uvFlpg86$E8mxte)`}&S&>1y5?cCPYD9CB zF3-ki?{~|z4o1LZ`Fd38oMt#xk`anQu^lxbJX8!B* zz}IqX?$>F`a@?$Xx=SUPRuMAjM1882q8L;=BU)9m>aE#Z=}`37G8`Cv$4hy^d{fo~ zfxAk$cH(|AQJa|g^N77LFSJ)a{0|JfI(n#x6P{YOizSXR&BO)kYONi><5o7Hcu?gp;G8!+|~cu&BQcQi~ttw(S^5{KO6hblIja% z)0!##M~NQsgQbv(To`?Ka20EWWxCh$?#m2+e`YJD!A7s`8g;R!Y=dni)={yKTKlZR zX^Dee?uMtf*veOy>v8{Ui{hBpTu?L9@QV0p)WRX%USgqix2Ind@gpb(d zV#Ry{j#WB9JC^^tTKC~jD@{#Q^3N5k<(H~Qh3#>P{oc;|NTD7_Hrx`#RdC0e}4_u_oQ$-$JO}zv`BX~V7?ycc^mbU7>+JnWI(@+0a zfAEA#3>8TuWI_q__gtK=Rcjs)q(U$d)qz1y&B6T_ECc%gu6kZv2U*1|Ap!@f{60h|9yHMg)Qlu<=6Wy ze>j`mk6qk5dZC3^Ey z)B;h?Hx1f2!y9{(6E;Sm8{0a@nX%jB`#gTC30ZjCjj*>mdem!)|Alt*lM$>aj6-nq z^UvY!sVPTFiQDaAZr#PRAySMK)ZWWL1?5awWsPe>-2z2Y+>181NTgC{MKw|=Pa9!K zE+|PampPE;xUkOVz$L|D%*=G$?}fwCq^eLe`(~hgiiDts&d-0e(1$z}V~VCU%%C(D zPB*5!y{*$~aM_*b6S!hK$K(%2YJNWyH`6mjXa3=N@|~M?Fyv1U_#2FdZKQx{IAE~n z`OYdgX%w1*r4ld8RE3#C^#|OUGQ~dzlKOye=9l?U#=)R62YUSY(*<4gG%8q-V%7_+NCISM`Dw-cg%@-{5)Jpw_b{)R>j z|MiMb;^h+Co3w;BJH40d~LiDHx> z4hON&)N6q{P1!Q`I$q!+s2b!KmlI6N11xz+Y}ylZ>@Q@g}jPYWT8$*{WlHq z!F?$=_(?}7i@0$%uyE;j4gTM5+g5ZNcgdHVA+?i;z(Jx_nV{pb7R6-J%_7kn2!Ihr z0PoOxIyUNG1pq6PT^8dN?{7peV0=}U><}LysSl@bo~jAppi<6wboP8x^)&RkwrJmI z2SOwJv9^rIdl=;x^#&BoGCG5c0a2Wd8f}mIz6kPQQ|@*f(T4-WYH zcp>|&(7`c$`K${2@_USR1oHZ}@<{Y$<#PCe^$G~BSzwLFHcBC%9Dy#S0J?W3EA!y- zHS!b|CUW=k3GB2n6CNSub9nHRrD7dtD1xQx5a=XU9NwExZN~Q%6vy*DJdSz8EHORI z7g2`$+^d0B&h2sSs^@b7@)f7jmqwwpOxq%S{A4Ynlt^AF5eAiBsq*HWG1@f2LQGyO z_W*lJGNulYj}`;J8FI1&dvsl|sL+guv2G?m_zM2yUy_b2#KuAtIW_@aiybUtFxUEe z^Dp%`EQiP@CWQ28TS0Yx2k7>+v4oVJ$L4DpUSnYMj(kRxNRP>dj zE*OJs>eV9*4}hhc4;OdMVIeg!eWp|?LwIU7c=Jr2AoeXA(O&T`lg?o;6!^dhKA)8& zaz%yhVRAtIvkF+HIru8ll_SOwF{n$PE+!Stxq}v z=a@~0wwkQ|g@p5DI)nRoXi$liu2%JK>*G6srz^QHEUg|TpikjpnTZviXNxeU?P0`5 zYn8f&Bf0EQ;xZEhHPk(SxX&&*JtMv~}K;`+|3Hfk^-J|oU@&W6> zfoK)01m3%UZn^UBWPh^F2Ogzi@tt!0_{kV-&bUiXhgSM%98*{}*`79SCvZw5L<|uf zW3)lM0EdETmq^Wu$g=Q#;S+u&{xivvlF}PLb%z*}o#8lmRRVhlafZf!FIIn=x)oPM zsN|vcq3OaJB0n*X?tMp$l0co?COW}$)e6ctQRmf^cGKpJchysV-&65$oi94Nu!ZhL z+9<|4GCiR&wTH(jIt~Serq|di0N3TX6%lrw&>UqF!9-$6ktke#0U zpZo7xSg+)tUskXGFdBn$eDsj<15$`#gfD~07zHIf{wQ@7gK?XDvWkJcLEIAYbUu>c zX6g$ruf9c$*x#QX5qdZKvqQx1Wv%pg95khO1S&BXoU!jppRC{b4Vqw(ThozdE;07W0eiH~9#Dh006 zlVD6_2p+2Q$;Be|;yP)coK`C^hbwX%PMYb>X3{&e`Lc(+T{CEFeba`zhv)bM6Lf+Q zfrNBw?YG+>zTJ})R!gd|xP~KcE&~Da{TfKr^JuBYRDdEvHi$0tDBW|~$x2rMClh^0 zVk|B~OxMYn^{a9ekd@iEB--3AM#K2No+2Dr z5ThP^e85=X<9gV^R>PEA4g>@MER@+L8^|`Gq93U%+aW|7#Z9&+IvwX`nE*;c5ng}f z4;+cy0d7ncK#kpVQ&>AH}vm45@&dDn^rN zGqR)FS?YpxsG|(0vBr7?*1_O;B~pt$!yUfI@QHq^YH~`GRk;?t3mw0c*&g0)BZ0eG zN}dE5{HlS!`ZSzDXZR0^LroF#*0^Za8>YoKD!f?4n1<{z+`!<_!o<`!* z%wLql6CxRu#nrHuNS)UmR( z%iSPF8F9kwxw#wGxv_^Hc=luwQ}}ERLzCM_UPbLLbmMtzsU__oVkWKd?Npxzh3rrB z%!`UWCejy7L#N4xeMttVcp#E^A(OPWK43o?yF9%?R$5ez6Rb6`aP3T6@vMlM@3D}A zaQiXA={*vEHBJ=>U8jDbjy zE+YMw4%iCEf$0qZI8i}!eBIiH2Uvsy?;5+SU`XF)pNq!YoVMT4dA2k*lPSWGttaJo zKG{5aphr;|h3H*EsyBHwtg)z=TPyYb4N$_l3P9x@3yDB4ZU>cN@h`K=s!DQoDU^$n zLw_OG!7#)l2_-&KVP*)7Z($xewAS8Zo;m2UYx^Hanf~t&uj4Iawhr_fR^8(X7UYIT z=^t7b%^3MQ-$L2X@uQl#Bk}kIlg%ZF>K&n}U;c_0JCHT>e;`Q-B{F0jY5UovUJJ_# zwQDn8Z>vRez>$mf#GtCw*@vJjA=%ZUC;uN~=hU8Q)FA8FPCB-2+qP|+9h)87w)Mug z&5mu`$?k6-&0I4FbGDve@YJeRcNKJhg*!ax0h8UA@?M?tk)MmrKXyr=qK7<6=Jwwz zGvztKF`*kBKy3l76Ue!2012?4Cj)tdv#97m`;sjR8&K8hn?l2x_0@@yw`kYKDtI9)L8PZs#%` z-}p%gBkmL+LJFakV=QKOLWIZy%0t!p*U0k$Bm{WxQHNT-T%F?6qyZPL7M8rEy+Ax` zgAmw&tt!D4HItpT7`K^epl$ow6XZ(1nY5V6&Lm*L0(PRL$|K24KdpAc51G^ak3vQO zi5R<SORH{0(LSm&%^<>j1bSJOb4U*NAjPSjryT{*$i`5rU3iUeMA(Blc9N zVfpsfF{6irM2a6xq>1Z_`CgR9`QR`O+pJPkP#R5EXL)itORq4Af{fJ1=W*6THZA0A zrWj;}?Kw9c4NcLKj)y_4OnA*h@-D+NhUzT>zKq$fr)ZUxU`6xkLt;7SZ|r}?zl|p= zJE%w{h@Bab>T>u)Y!S8dm{plc5LeNfy8J9^7g}6R;g&(%=)gYAa{n%J>@4qM{#^Q1 zCqxZXR)kY$lSLejG zk27eB*`<=7nv~7MxPuOKTf6PPYv*F|3;l49Z_t{t+_*ploqeOKrbc$2QYNceb@((L zTTfFm*$oTcZqn}Cedug;iKt$S!pIV&p+EI8m{Ad<#u@-uzskvlBOUQIxNIpjE-#V+Fa?A*cu z+|V@yv5$7MgzO^_3swE%QLQ&lTBF!QZ)3S~*h)toP_n3t?4~J&OM5Ru=LL2$!X>{8 zyo8CbYNd^HY9_qudeP?81p< zP`aT(XSy=apY$hvX|}6CP+&j^*nUzm^t`cE!o)AcLG4m|H|tbu1s@TTq#Er<)&TbV zHLsTq`6G{tDqLzH0aSRS-_*7rihncKgvM5VmaB*B={D~Uv4_r|EbtvAd-ZQ1>*V;W zsAF%Ya@3t`Ug+B%I*ydyLcO7FL-+JSI{9VYJ>1XEV|*7>xK*#^7Ue4>6T^pR@|5k( zQ6FQLUeK#!B(%rMZq_S2H{zu;76R5!$5$0~=r9X5k1723I+qkGvCU;_O1O;>*Z%a4GfVy zxfRayOs10!&qOTys5=-_>~AsgoS}k5dQO2XtI0-4;PWSm84h?kSkJ3{ynqt~2dzHy zq%?8dKg1JIavK`CF?-a>tH&xd4d=cW{MFAw48l?Wpwq!N4EoD@s_vP5$cNPWsf*+H zIGBW<%{&>-v7)begl8Dx;uRs*?o%xX9^fvmV3TKo!s^4IUq8P7SXN!?4BmCDZ`Ok` z=Q#_hmx8a}6WfS`_#Q`)clev^Lpz`03L4|t9R56JgQ|Y;@8aX7q~C<(RT5n^tHptJ zs>E*jcY!9XFX`^Kdb$UWj}} z(WnGE?5Xi6-oaERwOCIIdp8GTK$Z(u@lfB33T{uqhhx{=yGUt}Am1jn(7UVv^;D;0 zymvAnI%)HE=o{lZ#WE$Ve)(y2VLfbEV+TcSsgZv8Q-S&OGOdgBC^LRn9oL zs-G_A)*z13Cv7)RP5?j3;;FMU4;BI1z{1VGRI+Ma*Yxwkif$k}Br)fG>I|WKu0W~q zmk`_;L$hv-swf;g+@wg&TQu;O#;Hy;XgZT<6)?Edj&fsYpHRZacmUBh&PWz`iH)}6 zXYTLeMPEIL1Rs=%a>Ed>Uqk^;xFD}uLFuC0Qs1w@hV4-zEC;zw_?cU+Wk}*E{ifV>5=mYscZiAoBc-2%>7~ z`!V^vG*6%WLb#sQ>#mx+(|jIiz- z6XuPQ>~CLGjg^$jshf@OGt~WJ2CZwx4Y_6bOSd0D!6W~$JC+cpiuAC!9mhS1&$p+& zhdhTtcY#;nCTZ^eTXuMg+lh0=042uEy{qRNz=|P5{w%gDZQgnxxX)W`?~aGufkMaY z=S7GBJ;U8U>dv%!Jfw6IdScLXc;5kCszkc-GMHvJ$^G-q(ozrhO}eZk@KHtoGhQHz z2YE`gx;BKRffm$(g!t{O<6bF!{x}CKZC3DOHG>-M`{B8+f2~-MXNk5#Zs(8g+I~7$ z8?nnO;=50HiUC``)Z|K|ZVBkDcQ|xlhyQSMMOhphBGLlBU1kcf-fK zL@E4)_bQ4&pc-;eyng_ayT$01{ka~*7GFTl#!jaCDfh6Y(3 z5BfSqx5Y`FhO?-UeHs6B#3~IVsU+cdsqs{KBAx|xt%uGt@LlM>i3-~h#e{nKx%?_Z zvP`Ad+{_09Xc$pz+O?)8*bQ>;8%AN)v(vDRYs^ifUkV z>_l6=4q?;=$+ZrYDGUt-PBTbSBo*+MgH;eQI?I=+7IN}P{nroW#UI(Pc5???UJ#`P zm|q)UkPMd)#EkkvmYP(~7NQ`dL0gK9dB|8|3gU)@!E%jF6g9R~K-Z?Q=P~%y`GrQL z$-#m+PeUE@@kA6(DDB9pmIcC+18bpxSW`e^8H~vB40LEZyl|jnyi)}~e2DDM7gAWr z-(ddGb0&PeAyrkD)&zp{WXq*fJFy=4d{LFKGssba(ve+Qy%~41g zze-EK?gkaj?YA=2zhb0D`N|`h47xOu15cUaY$sOi1Y*e9RusA1V02<5Ttd=(0Q$9# z4eW^>o=b{wsLDF?NyAf?obq+DF^v>Bpu(|l^Qy~R?x5DuP&uuk6Q!>5U8$O{iFQNVUpwtoD{u!wR96I= zD+C9mHa^aN91St%RVyXSq4wP|OHirGVQj0^A#kQ9Mo3jE$j*ts+(`T6M=>de_)NCd z+e?Ki+<4H+Vcp&;yMN3u?nKJ~92PgN!yDE_7VS8ERbQlt>%EP$rkl$`@%N)QV5pA0>3HG=OK6XWZPcjoEYxGoebrMsA4rgxjw%L> zp7^N!S(3riyd+IttEv6A8^tKDbu>N~=Ii9remfx5U3NpR0rskZy<=9h)%vPHq`55l z)Qmlkr!F#_(Z9Ca|81qT8y&gu(CfzmZNCEHb+3&pE`dmZDW+eC+{&qeExJ0P;7|3o zFQM~If1yNR4^r4Ru#aUG3gxty@HB)O%8AhQ^%fAtrY_TJLwDzsYzyl7;50fKnBTJH z#}|N*%=ykdy(NcJtX4DqTthbvac3v84su^vHSNQK{sKiq@hyiu<>BglU4RL zV1T}#H!pqt@nT|U`3vWEOx_eOERQxCP5AFnM9*>uxsADOg>ALAfHoNw^)1m#`)Ap> zdnOmqjp?+b(@LH#FI=t8kmsb&#d9UlD0}OYdMUa z>rBQbBg#1|^~u@;D+4Qj?8+H5krZ-luZfyO3(3(MbaR-e?01Ldox+-R=FeR(SvG{c+xnMO2`x_THZBJEi$;DbB_tg{@1ik{yGNUbh(eQ)h$1N_K(@s+W_fFF``E~&U>kks$4JIm5Kh0T$ zprHAh({@#x8SEpFTRg$nDHwaJ06R9Wh`&qgtILNiRvJcL`&YL=5s;ls293CGyFL_I z!rHP20d-2~JAiU6=u*0y`ov@|@|Z6QWf>QD@1a?#>VGgp6nM+#M7`v47(2^&%SWL% z0rS8mQaAE%@74e|JkA_xed$)l%R z>|AVoC${8b2^%VAmMnmc(&59J|F?y~Aj)AN2nLBULTorrdrK5B><3 zeb?3n$-~vAhH$bcKWDc${RGy|hJ zs@e@4fn%nx(EFUg46TbQxmaDeI)P%CsON1yx`jJgU%BpN#DB}Kk`=1~QZZx!%u-b)~l zdys6IJ1fLC!ta+Ho$u-IF6R5sbOEpyw<7RQ)iLzere)Hxdyx3 zW-27w;0NZ|&UyVLGd*c$jt^6*4-lHH8&RWUGut}eXecve-Bw11AD)mGJ%Z;ye##B@IUwuxU~O%aB@31 zYYjAm>(1!I9|lWF-i8H)Wr@pQ=I`T(U<~%%AGqOh1VvK*y4IVwz;|t6uex_N*lXIB z(!+cJ4h|s{cL#E}=P2>&J`m+Bri%LykyhCLx~NKUi`kFLRu4fn}<<-0P5i{f5PTYU9w*2f+RvHix_~Dk^!*o2OlQBPVN5KdmE5_CBc3x%Z z*d|2yJbS1JzkhlOgtl0|&D$p$Z2S4#AZ#|DhMeN$UU=Q08O;W0 zxv&I%mBWU3GY>iMVK~-4LB-8NJ4@WUF=G2ZYvA^i{w#8KC9pcHU^!r~4)N#*8&8-o zSoRS3{SG#fE`+54p-X2a_XeiO!9QQ2>nh9lpq|NHP0fyRhk<%%h#n~Bsey=&SjoR& zEtHFds1Tmw`^0s@Aj3KthD2SH%9q6k%U~4a`R7I{;8J8*ei;yJ!Hy;Vb;^-sQC3y6@5T5%+`!m!kt7)N zo^OIB7)$S@LpG0FYYLWaVsIEAOKk*GWtx7-(z-Mk!;G`?yZz{`aTnnx;aqEQVs9TU ziJnZt!>5}7vM+n(s}JmU%EJ3rM8V>-xB=%bX(V?@A@kvUG5tJ8@eN$pDQME=;*FXo zvmz?PI%124I06hcj_iR|hB`WnJaWgtW|Qr&wzldqIPd$OlN2Tu2s3D@lYP%25~NR9 zyLydk7j7N%$|Ql3MgMo!s+%HhSLx_+J!I1q#q^ia4#J^sttlpT0=B=UC5i6CWgM2&g#~zSTk8cf*(f1Mr)r*|1UQg# zbx8O^BI{ypwLm6Q-+-5!Nu8~wgj~*0Y)W>jP%e7}@b$7oCr{NsiWd3MZGY)a8U2w{ zNmQxPGc@c3*H{#7n3Dbz%1Cp!YRS@^?w~@1Ozd8;0ka@(^v5LgJ@})h9PsD zzu6BtP-#{b=EhjOD5K#RimipDGZCl)WlIyqP(%5kHn9VXC#s|rlRnQYEJ~gYUT)b4 zJWDK3_O_|ChyFk=VCc?0X{1Dct+%q4Zg3~+b0aapq7wx`7&pNEn@Ffrlec1t!zYS) zciV9$%NVT0x<*Vrtcsqm;xoObGJ2ee?nwer{#xGf1*;Up$PjXr-Z6CSstp=6%{(V^yfGN4+dr(t`7h;i`cXrdM_i<`cz1&$0=nofF1 zOZ=}25{f{l_UW(9EgJD-rlirQKg(B$zUdf@XEVnWol;Irl0;NWT4jhVSa#f&_15*Iw|lX0=c}mf1jcYbxfjTx6ZO7U z?0xYR$1Jo|i}!sa%ugT50BPZgz#OW8y4W z^@3G(BPP$hM zIjUVKIt1SiABcuxzju!Coz7Lgp3Xr!TcgqnWhoE`jg8voNbVVSY^aB|sBdZP2Pz?p z!%}b!33k!_aYILCb=SqCc_<$PGyRdU32$K()K-SAD=?xH{Cz-OsQF5}nn7I9{Xk}& zfk$!D>j;Vdv0S3YKJRDyr*)rSkO)Mz;e5|7+cB7CvYGBFhavQ8{ai<%h~fAIKDbQT z#S5^E@*Ab5SBydsS=J4sW*14{E>1nI@7DlH&X5Ces$YO%9-;Yb!|HJ zh@3e~-9yh49^Jbx0ZN;UXL{+tBtGtkkN5{#XRA89G?tTOxCYgjbr(m^prw>qKmfJ1 z{Y1Wwu)M%m{GisXIkP;QONH9fd7)k|7YBAr*`GsO9LW1x8F#3sr$=7eYu$=#j9>|* zY&$8aZR>IDkZ!73qPAByA`f>Y>Ybc|ffymEMeoP!#MfR_Y6f0zojWP*2K{u_Q7bX3 z(I!@%%O6fLDy{k8v7UM`1>7kX#$v5{vi9?Utp%<4PS8rGmQByu~ceU ziqJc!6?g?@DRFD}JfD0udIXUYnhlhBnod>sTw~r_y*3t!Y83Bll^#N~vJYoyUuZ1k z|Gr{?P}#`b?Rz?j(o8}9P22(xyB9ck<3A6stDHOPVFp_C6l zr?=5b(@{@Xk!7A>`~HE)FLrJ;>1+>z7U)8!jf+2X;Amca?E;Bc=0AsZ`5%RL{rm@l zf8pe2cqebWgTP-2&+)h|_}cDLK0kf86x1}o!TaLpvyUr+0fD$2l8d;8(*=NQbccO^d<;q>?#=V51Z3BcRAr+U8?~P6)q^f6hO(&Ct`m9 zEu*hLv`^3e?&jCPP~HwZUGk6Lb-JUv+YdS{*2vkr3dMiqnd_Iri^R)@GR)%9!^i0H zeN-B}ER`0lK%gPIEE#`X6Ra)I95ma3u$fvq04_`c`ysQ-M!ODOet=cvC=m%wDNWET z)Hz2sWDR~$b+<2o{JxBj(@4gc)-H39R2)L#VGKY3_H%D$5Q^^ z@{&>dzWsHu2+E&vEo+W)JS)nJHh_DyW3XLBtchm5bGlmVzh$-08;d=MqXh@ns1wrQ zsx|}Vjt71IFBl^MBXH-heQSA<2Y<)5H$%rxR1lH6f5Z_fh`>aEiEf3^)>HN@2iY-43UI?cpbenu4-;ZUHdV_AMzFMKq+~Gv z5{g4}59ix(RO=HnYbQ(bF=?%z_>qgm!y(Beo*?7J^iAo4s}|OF=QF!Cr?Zz=DLno{ z*hzaO9*hZTz@S~QhaY~{4L&CupsbXMzU$%(t?Z`RK*hJK&;F1jIP zuy`S{xti4<9V8silAKDPAu*em?^S(h!GbpCq1cCd`9cfaS5=j1q8LH{##+tiKG`jA z>MYwAaNm4i^*B*9edcy(YFA4OD?><9XUOn48JEfZKj=j8?01+?XG>)erA#m6SB=LB1E|*;@*@!An zFu{babTMeugz+(=I6vgzNIq#dT7^k%sP7Qo_tNE1#(*px>lfQEF}C!}UszQ1qFCmD zIdho{K@)1L=tOPHWPAy8t5Lu>k6t!uPS!+b^`nJzcYvJpWPIaD(~DHU&rCCYv26nU z2njSb5@(fOC|8CDgQehLH7o2~l~t(&NQmmgF%IZxqW6G}S*QjNdG6Ttul{Aua2-iF zht-8|l6=r?D%i+&aqQ8J^qX7LT^(98nT&rW(6YV8<_Nh{qM^2iaFw`bI>-CX)rv-( zg`{VAO6tWQSi|Dp`i`}4*-)C5aKlU=3#slyp+=ex&RaSvK;eH|& zK`gG*KhpGPMwY3q0Qr^P>8ysVEA1R_X9Dh7dukxv6QxXYa=C1^mz{AJzMu+L#K9cJ z-vp1qk3y*%A4oy}7q-i>f8gKF5Z^e>*MbLT6w8E|8org=(nZ|J=j+Pi2~D!-nNw^& z9J7{w!oJB^ye}h5;xfo zE>8c%b9g+8rfbCljNW;;nCL7haNh#5_rC8ar-;T#6UP^-H7YJMtcr3b4ecj(=;R(*(KaRgA zZC)NA7X#7sy-xK+()-IF$PlGp-F99~gn?)D-zeb$I z(El{z?9QSj%yl;D60@MpPI>fnK7KK)Bn%kT^}1<$0xP37LbH3y9qv(I#7y?*6g$6YVtJj%*K-+WBnDGDuEs9mH< zEdlihy>51%mV`g5pRvtDzqc^ByLO5mXsgCshBoMmx*1YeU;c5BB=4)NYs+|nHpnTw z5>>yB2s~j{>@YoZH(^K-$X?JJCz&ASoJixUI-Ie-QtqVX53va*y#&Y*>Af1D!(OAg(3L$)Lb^uYS3#BPxEndp**e!wZW7y6 zyJ;;COqQsTIYzY(*3MPo4NN>qCuJY`)Vyg*S}5Ve(O)!j1G6JQ9r!x%!hdP9)4T1R9a#3;Th^Z*1Cs-!tQy|5HElM)Xd7CrrIFw&ZbI-?!|*SIc( zxrG#DBF|6d-896s7-U36GB4tEpN-3dJdYut7f1vNjSgKM2D`XFD9hYR)B|?A zQ-X^Ss#w%DKp(bF7dUu5P`_8d(}`rN7Gq=s4qy<%J<*-R(?m(yF0+Twgu1e8em(ar zY%Oqtpn6D2DVZwk57AMc%SEDRj@X&WyH=3%iR4eIyFsh>^4@8!=PJsrra0AawT}9 zwMN#*`WEC0f4cc-Y9_$|X%=(ponz!LQz*NsWMt!7n@1CoC1rXa6EC%}KG{Z*1;m8W z*f+#N<4Ln9s8zmt9d>pUV95!pFYLIPQbiR3&Q9T1gW(|QZyBK%-|pL21R|hAw7N-$(u*4%*sFb=xF>EE}Mn7nxFcf*JUR#dFF}&Ll(@E-oB;a z|CVPKz!v*#sj;jh(hb88h-z)mDV3#vzg!HXxUd!89t%yWsch=e2vg8;h@uYIBq+tg zYWF0{##i0yz-xHz6dwH}aCyIc9a`B{f2d#4?Q^L7L0e~vUpkssgx}eG4R(re$U{b( z@!se=wy)-+XYJ!^?>ytdX5)@)utaZ0^m{(9b z0tQpL3wtsKNnvs6>M(T|D}^#2%6?}O72jCUz*tan9cApdK~2tds;yHgax5gmliDkw zo)}JuD`Z{)B}3JEiaaK!NktlM#vLn1)#I(lc6BrbK3;b98l`Gz$p0bJe~RXx3l|N% z3e#dX=5yjX%GT?z5zGtPP(Li&U4de;b6#~>;o)g%)z_x}if;u-%cqqUs-VXgEvf^T zoi171=sPfWJ6xDsRrTa9*1QG@k?F1(eC77cMR!eOm{0X&F;r{X@*J|DXT2)U35ahhRe}v@2PP~y2({Nd%h3~-%M6y zHxV;zr2J5h&Jy@+7UyGeE4e4i7SN&{7`7`61`&VyTn`qZn5o4?`iP6!uUlwx8v(kG ztl*(*CXEBk3&s*B*d=fmj!{LO&%m@!jWPk|PoBjvZEbD^7AKLfI@4e057r_e@3~tn zH8icypGTg*_p5ukHq#Lvr`b`-)hmlEHkt7ht4H7jCf_Qd9)hNGLD|ER)wuM=mj)or zu*>=AG{O{yKovYk%d?R>i(M@4OUR*OO&A>B!$rNl@6Ydu1{qnz2%XI|tC=%{xUG?^nW&kGgQ*#VteL%qt0f^D2Mhau1xT*+bX+#XQ~h=f z0xNwpJOztx(ke1!spK0Ev@KSDagB?ZOM@rG4>5_=14%X>uim_{F?1-#{%d3&SgQ~< z2SBs-@cX`RzPk>FYK{$v>4^p-YEY`SVZ!3w@>L9Y_$V~qDjzKFHU=mdkPhB7C^Bml z3!j-frO+lPA%Lq<5@?#h{PGp<$DsCHDHfIq$1Z`X!L?4NXC*jHp=tuafa_T1X&%7h z@!2?PIQQIYV~BGvS!!UKX`#XtxyVsRi!?)W9>TsHA9l%&X;UoT@X@CHO5yHTS(tRu!O4FTS3)~tJ z&~KzD-^(*^=4fL9f}q+5#eRH6vHMmBGrOH5jLL^+G@%Weuf7wj&tz+Wl5ZgYMTBIO z4E`RzQAAw`VZ|rTsvSQqVIZ33FHKo*0DUm+@8c{6m%!E{sl1OJTXRg}s5jASf|)2{ z0vwzbbf8xuDFuKiqBS#?Dk{b^bm}Xa?$!Rs?FO1KfJ)*pzDkQ1s&|22{lX;(&HE*7 zNLeBY1edFftqOzbP(oXakh#kB=b3Sz64<3Lp61u9?zDFxX7NC`_TD+rK9wEm#av{I z?JN)h_DHuOLP?Qn4%rU`FNUjzIM>P^R+uWHA&OZaB;}q}SO~l!HX|Y?@PQH~%^E&L zoS+k4o2Zt21Q5H@iuQKkb9LJ1udB6q&JfRzdI@wo9{6vHKqe|xe8XhUJCIlXc0uXF zG8ob$w>HqtP?R>v7p9!2{89jopwa?bb*YcALy&|w@R9^oBbYi=dJ(ne zBX__J8uqXoCMp!zGt^~u;ZQl4tTi|U$xcDqytRHB1(yy4O(mw?vGkPtpA7WAY7Y=| zvA#Bw2u+YqVQj<0d0uIvhLEz7p`JjMCRJ1K+uBrY%JC9y?P$a^LEr%tF=&5iBqeR~ zQIwKM;-3NyLr@>YUBwz&30RZD6v*(~KiGQ0G?-eCkRBwQx;AHADUJ;G{b(TmmQ%t} zDA&vA!py=0R#!~aT?Q9W*O8c7^_homeHN;@@qHF>bw$-Iv8zfWSkJu5V;Ox`kq+xf zzQtVtQG#FVpok3!S6UaIkn4bCU1SnqN=q7JKf_B60RDo?k->c9;%07a1PhWo(rz(sJ-(j=4?B;wT?f zf(E-1DXNO(dNnYT2qXic7k;z|0lN-4H)8K35oaHX@czNBT#wI9-Wb{G5t# zahGOAiOg~uB{!88*>FZs&XJZW-0eQy2>BC2yZ&TXJcqf4kvtyul1!U;Pco&j9Ihg;u;5{}(Hzhw=^Yy&y+-+4pHft~K{E1^n%^}lWvL4Y;A?c0?GH%#(bkF8cWq5~{!jIEZ@V7*^1Sgp!t&knS)W6lc~tB2 zsvU=2hXLt&@=tjW|47N`a@_K4=m6@sdUv(Htsjr}*W;kf_t%~=X6jd7rM2_?l8FC2 ztH_QkpcLauZi_)|BWLHQ!b|Vv3m)IinYRhgFsExbj$-svO&2ch;YYW&j*{X0+qi|3 z;o{A6V>&Eq@;ffzUW5h9&q?3#Tc`@sh)UEBC30WK+DPu5?+FcCL=b491qrxuFoUvD ztdLj|Ng(Xt#%cDU-t-C2Y%D$f!9K*^-hRSt^&7Q`&LMNL(Sclp@Xd~k^{bDGvo}*N ztCHY+(NksZ{^a=a(6T*ymi&p)27_Ys;zD7&y0*@gdUZGn(8BZ9Ua^zgb!wj`;=R2* z8MSdGDNceiR2U;AN@;G%Ed+dB{0r&wV0X>C&m!rC`C2|L2>FpGKPx17sx^TZ`(>-7 zCo5vOnqbJ&TaT_z{^Q)X<&s9TxJ1ZF=?2722ou|O1P1dQs5W%|tUb^^y`rvkT5tsE3fjAP>o|ORNz{>{jDfYsx*1dL+HU;hWQPO>H^GVv81gu9&s_@v~A4o3?+jH|l*g0&=GK{2WXNgEm#53T! zEi4cCWO5~F4>)gecDvdv&raJ8NZ~fEWC47Q#or4WhKuJ84%=O|`b$YsWgb)g0m+JZ z=(i?<9NG2WtF8(PowCQJx+bIT7}-G5`j`7x5#oVOo)zb~Y-XDwiLIor$AL>5z|Q=Xj1 z<7#dlW~F6odqOo7XV7oi8345Yvgq)^lg80C$&7uL5mH9Yo)C?!i)IX&RkeC6ujQpr zib--D2WywYp}?hPwACv?^JaK^>7L$><;%9v4Qx7wgy_@tcn#)Gu}mN|BA`XzrB~bh z%T%N7;InYox76meiLONn-TpcIPsb9L{^q35L;#(uIF8_O^Ez2+|Kd}MCW9dojoWZ|{E*buCW+qA>ZUM-6> zG3|z`_-J8ER6TNV;f*YQ!<1jGct1Sw0U~2fKIh{XzxjJ7g6`bH*E(M*bISHQoVTVh zeVpB-LK?ujdh0&E56f>XPNFU)ed=jepv(4RL|$3S1ih!GJ&#yqhuEDX+v0rwG5QAqa zGc%usEGS}O!^~cYKu7u4J^9WDM!p6>_Fi#28+WJAyj>vf;QKy&wZ>s7g42@d~t^C&o4U)&G%g2%wQXS?Y^Mk(cwI|ciFz%$au5k5>A|@rq%ifRgtt3da+O(B>l8ulEa~3~eUlr2S~(BXKc1#|(^q zw#fp9qbv0cnQvWmon8x$;8xs|uz;h+FdE-FROX}M_vu?sk~4PxgIiaNBor|Gb^1vf zpQAh{`D+NJ7(?+4DSgXfO~;UdzuuRv_~*c?J{zvaD{vNAWL+2m8u?US${@CMe*|TM6mKnM=+Z= zVid)Z0i*R3fqTkMx9|CcUkH+#DG0~Kf!+tQGb4xlLqbAfTbd*i9LIeXPpRYOx~U!z z@c^%eNTwB?xPKvFd(CacBK~*!Z9Y86T~p(Z`Uw!3K}^~Cm`Sv^8k=DP*q=$OpN9pD zx++$khj00Wq}Hw(8o#)CQ9YssqJcyUaR{-`biDz5$< z4tlE7f_bqid{`oj43x2MHg(4EZLYReZ-YPYSM}`yz_4|W_^IUvYs<{s@jF6a1m?v+1_|4*Iw>MT16Jm(Hy4bG3x$WTiYd?iXG@ zn`u=~s5*l*3Z8s+Wp`-Vzu=#=CTgcp14m}O8wYIejmx6lEEDzDGFx6xQhRu>(J6V} zgoa9Vk23%>L9rl$S={bV|_p5qv`lNMh%u(r{!?UnD8!d`?JJ=cs>!r5}O;H~Uhw-pLGvvA_1rPN*EcS#)S0NdZ z3m+f_Y4&V3zmUhKK7N#XbE<_pedl!BaOx&p?9b2!Sg$_HZOPHE=n(Yo$T>LOHZ|`z zP%64aLgrY$>N~-uQ(!$}))kVX@>faqv!z+D1MOOq)hkO2?2$N^sKeqMyvwh!HtszPrp*kTE)1XO;Nm|iN)MYOuk z9k+j^*Qp7#S04k0mpiSWK^Hrz31cQ8t|s(h%_$X~Fy%#My^pFndhnAGwhkwIN}E-1}FaX(H_vub+nK2wb^wzR=a znV95Hd4B#HTHIE_yhi!BIC9>$ZQKWlsnwycu{WTjaZ^Stqf}o}x3`t9G1CsKx-OY*#zP zI;uEf0A=0#IRu2McalI%?fFqP_cXgiGbfEk$D@FVwC59#KP7z8GluWfGRaFWZ&~ER4WR(zqP#$aFO^0JL>~2E?fm1DjnXq| zoSrjnh;{>q)cShsh**jW7N-Ck>tc{iIR@S1M*~ycIGbon_o!`rKU|C#6=26cS#X4O1%*J}~BvrWUK~-`)rgp-vh;P)! zwviM#S(`gU9k|vSFXc!bq*-V zb{o{<;<}ibbWe)H{z+T79C$%`RytCF@aU*Q+`L52%j&v$_u5`9NtKq8U!|b3Yv1r} z{s@}{j*SvJ570_{?m1}zhJK#1NFuMNLqs?{UK%~028@*)rqUj)D2 zY0$~07fPjYs~;=;v+N34IW1n3Dt_CiE;2j!5TIK+cp)O3qpC4k;f1LGYfqy%`GFV& z5kmnuHi?IH``uTu8zt6aFsLcgf*Fz_I}&m|mDMZ7OJWW%3hbEv&dvuDcK7jMxx547 zR%FfKH#>{!a51UjJYGX^B<8E4Rw{8^K|>BmG-%?8X+=s)9g4N3(1GY=ArCOG{dE z*b*C&Vew3{MJKt$S9!vA_nZ{2l}!rsG98KcuklUb+K!+aR%lNV)dOWV0gYTc%+#u~ zttEAHJatTLDX%(%Rc}e-NNW+QS*s3IW@qqOiL4c$I{ zj;i{gyQ07{5&kC^89vxF=Np}Re*D}LIg^|66T`*77P7J4ZjU=Vna-Byb{S4XJ?H0H z=Z)9lrB(7LPa7k=tWGPpzv7-IuS3k_`F2K09=8F>`~-gR6fC{RaQL`85yLE++07;? zWfLNT34b*1RqsM1d9Y*1UY~k8?o*Z1uHvAi{@8ZLJ^cKaN!CqmE zZpKM_QBcC{0iBdYp=j?ReA2`MF+`GtN`efb=2V*Dg?ciq_nSPGZm~!nRk|(UX z)&Mfn2QxEHO37x}g=&
JnRMciA)@Zw_sHn&U(Imf$@RQs6`d9G2`HPD&t_~b32 z3e;A~9TBQ_%v)N@)jzW*PjeAsESvrr(j|E2inkOJ6gztGo5qf;HEC~~?Ma;)Omg&@ zljf}wibp=~_;GC~m0`#7|BtbA2o?lbmvkT7wr$(CZQHhO+qP}n_UU8WoPIMg5pQDN z;_hoxo2nm~U%LMOdx*3&9?pAI|B0t&J;7s#XbAOXc@e}&6;q^r=Ro8bXTXw&_TUbk zMA*!Q#=|g=a01D*R=Biv8j#3ra)Cs z$RAQ+uz7>9Xt1g)x(tGX6kdnC|D@61tKY!jp_@jHE<6BKNAz#E!r+zTdy5wx2eG)c zdEfbW-agBYIv3A*T_L0Sbh^cdAupB=ibRLfKy!=sN~|*-qXJT#mqhSW;tpxY=L zD)L@LX-MqKep(%G%e?gyCvp;j{xZV3mB(Zs|A7BE2+EZCr_|<}5uM_`Sg>Thj=8&# zZ90b!c`RD_XJWO5*%A7$+w}9G4(#0nX!}};Uf!9XxZSy2Ve#&7i3Q=%;QhPvanS!c zg=A9Hc?d*Wm`<-Ll?Dc3;WGxt-M})u@Gy|ssm1HgzY`Ze4$lsefa;+vf0_# z{v-P;Gb7u7A6M`ETY(dG!1SJ~E#uXzE;j))dxO_^@!MuS(To?^s2wMATuTVT(L)Ai?ArZ$FJWF`JY|9MES0g^gUa2$eUlnt<~hH-Uq;4F2|Xxr=S8z* z%zN?z$jlO<_Gu8OP*P}u;rTP6dDr69z!B=5KQYJqP6n+#G-;&k|J%=zWJj1_7-Jw! zG+mCT{IjkSMyJh?*1};8+}|mc?q?)Ii2C>^dxYkENVl?4r+)6Vkq`| zhGKZcmD4e?wFpc;SR~7VY5&Xk*?z4{a+AF5)MMA$Bx}&AX+1E#ky)m;O_iB9MdqvD z&V!3ljGNVw=uOY+;c>#M*F9`|tA!@iq&{Iv@@PNBkU>mOG#lqxA=%1R)Pm1qj zh!I^zj{6%FEGYEa$)zizkQOVTsp_jfhL_r@U@eLaV8#*b5n)pDN+z7#lo;XnK_V;R zVW!wxA+!g6iCWeOAsU$*=g*YdM8}V7mThmDA$@t24*daf zuqT0--vzTsDPgXn2ML9)SjBB$Y-72hQy*$i3a!kGP5RqzT4l%N_zm=6vLWP~+xpoj zVGcgl8_U)ThKO?c^tKPS&hIE5e9}wJuy6p~J+lWAUP@W`m7K^(n>$uY7@(gbY0MJ8 zy4Pf+&Gdlt5&VxN7<73M-QW(;SM>o6SJ$rRJEdu!lwt+JBQ0C!F@lPJl+%T!|Aog7|t=zIC>hComcCYN`rN-Xhs`9Ktx<37C;`WYG82 zJSjtEaOA}=*~gZ^=CLt9hPMEV{w$!{vo+C)v9U?UDw)qzfTK7+^&!X&Ft0oYXw91r znE*kj5MIMaPByATIti}Vq~c;Jx^=}J(6E^{n!5hTd!|8hYIG<;v?C)al{!}vcU?Qi z-_uJ?DcuqF+vL(1fj!+l%v zYtBhKt{Lg&tb(Iv}w$oD8YHwBd=s|@F&bml!= z7X;}MDOQx12DBZft3J|W?W_?GPmM}@(!5F6(r1!mBeo_-n`2sXOo`|M<0srv`tF0n zqZ>Ws6j%qZ$JoNRxwOyuaLDqS<);xYRkhY7STysDD$v_K%l_~zR5+3@oNLTFIyds( zus_xbi6P|#ntNTzhvovrIajoBQrMT`n1|o+X8K_kl;OyFW6IdAhEHho#9$y&-@WbH zqD;erG|O(lOVxMt>Za4+44Rg(8nma;9PU_a&1!J9W3{oxgSF%{v@a|0J|Gj=yZD{D zmjlMh8V^!Yo~bb=LOiO1a4$*>0KF>n_o<>_)9qH^53BZ%>jJkm%(hH)^JJxn^x!t- zwPFv;ZOG*{;lXX>Nx62wko7l9&j)X-h~C@~W<=IUS%Ks_o-z(mumBl0)DR9Wr>ci+ z5#1AQHv}9LPpV}*j?&Hc93+2Ff|}%VrWrv{n`wWuuG+yuA%)G-Cv)Hq1Woquc53@l zfX}MX7}Beep0LN=_u>i$Gbr@g@LO%{vQ^R#Tq8=~^;)8#>nHl&I_Z}jQ12S#TvnZb_}sck?-2b z5)wR7@nN(;1>WAh0?0o=!nbB;JD~ryDlsNE#m?3dR^zl*v-pgdA1{~H+ZhuJ4(PHO zZfcD@0MbGsfj1~a&dU4L3Y<7LXxm`U8%a9u$p=NQax=@sm#aCB>e}Vt(TQP$8kz}r zl=u3_@h>rpZ0>3j&SWp&nc~@hi+6!3D+u3)plo?T4CoXcTQ}=WgOA1Hq*X_85yA4Q zx)Eycx#HyT&SS;Xi6Wr8cPh4`my6q83~H-Id{0@8lN!fh#$FEb>)p?gWhzqjOf`8} zi?`Ql5*Z|Eu*3B4S*4`%K{cm{kiaW0UIeb$K#IHw6$MJ)6?@n^jR8Gz$59;%dWl}q zeSa!zHdAj-2pe*i>9(z6$?sFFO*k9)ZrO^*w?|G2*kTPqms6GjeD6V$Im7O0NqyIa6S$S^(GdI28Niz(;}9G(q02_e#_IB*f{B zqa;zV3OZnX_6&>nHjD-kH%>fL5pKW_pi6_RN`&R+q&zTFgD~y#E8+>z>96v+N~@nv zhv5i~#G$#PYbox*Kf<3hO8VtrRw6KQ&)S4i%IrID!B9$KNzLEm_FR~nIwqtb^@5-v zC))MqSX8u0zuz(m{MiU|-zwO09;3h5Vl-SjZNKE)a>DsU;OJ15E+G<`cc$N1#{2}M@WIkQOW-G?BOtro*BX@vVdvoEmI zZv~xTerGN)11q_3uWC4(dh{~~Be!54LSOh9HN^S!j)#*vxA*hFH=?9Bg3 z1;_BO();ffT#M#Z;}$FQ|M6dd-|;w&Ma?p2oYP+KxOCo0?J!3fFYVEZ$N!gxvF1`* zv|)rwke&UHxIb<$9KHAlSkTbG2EI4C?4J2Pl+LfV&(8<1_lGrTJmL7Cp-=X!esGeV zKji%fcfLQDGLrIM@pg#Ca(RdbaHKm+uTHp0&LKS!dSac<*pq&apE#7!furBBi$e~= z3v42Vf+#5`0{~|eP&#Fzs{|2sj+z+6e8U4u?@YSt`pAXGDA*w)&>omj5prt@N{XTf z3{<+jICFZcloD^B->(8y`23cQ)LAmR>e`uwO^){X$FO8S+=7{JTc0walc%o&<@+;t zdM4u#60dupHZ}CR$De*-d|`EKiorE&czT^%cnYlGM$X8vtKc%Z^*|)t?1*u@;HNG) z=X&`7f)!`5%KF8a)l2sztkiq~Ob8Q$Pz^ zY!!|Z!W1wdDd0d>EaDbC#Inw#XSqb#EVvoo)t|D@d}fpo538AYAj*sAv-Lrsc77qY zz2h^8LZIQ{Z-WV)%#aAd_FhV19dqzdBh~0QHS+r-AK-NI%&HdE_AVUu* z=C6zN!Q1~ZjSZUa1PB|*pu1{p0xIT9iR`E)$jbGk3-sex56&P1QU(-!lxBW0ejFX8 zU4-hLlo_^uk^6y6iUOL6qhd5ev46fPy&l|VZwMLb_2&W&8niZv=|!(FDX%S*-H7Z# ztxw6fHm(tA#PPXMy)5^vdr^3SYx+ZFZ3vwQtGToshD5dDe(I#Za3IJQQt5mMF{9+L zEix;4@Qkkl+^dGxjqfiI8;GP{?KNZ&8HKQJJrZG3{L$acHrRZe;32bXQgh$}oIjdb zvI?J!v?Hlp^Ww?9DZpf^L>EcR8&td-{QJTk&aB|^ji1ZPhkI{C{jb<-T)zA!NR3TD zBqxc?8%SJa#%w+1Dq*fT#2YD+(k<6*ODQRQ6HPVstRvxJPv<#PB&(!YnrR%Y%D8WS zb=Ydkc2orhu|ltP>NjO=Y}DE?chQN<5Fv(I_%&o@Uep!cnz1$q2ehDS3H-~s+SaI$ zyfZFZb{V>^9{#|>ntLs7E|V=Uvw(W*Vcv0`5I^{*VeqxU#`gM5*IldNL{)YRJ`lcL z59Rs$i9{FRhMIbDD32E>iFvZdWl`9oa(L#iYJK4>81}(6$vr%JJ4d+()P<{(z1g@(cU9E(du4!YN2{?#s|iy_ z0Q*vUwK23rkd@NQjRbD-O}b+pnG??*Z#N@eTTVSQtJJA&xAG;$+)0qbRb+}#k<4%F zD!ThbW{wgTb@vKlnRP>1s->OQrnl3hblHuuMO?`%;T-S_{uO3AW!B&2r=3dYYMu6N zN*YiMkE%Hsc2O11ZYHHtWrJ>dbSVR>_`qC9>8GG6?2yAWYTaA_|Oq_^HVpR=M@{&|k-)0s%i&)o> z-5Kl_D^_F_9aWB#KVdVU4?2@Y(Zok%b26Laa4nK02)@2of{e_KRyT4;%31YqH6;YK zj|;(8xiSMK$`rGQe=-myc2*i`bCU;o6PJLd;<)J0mr?#3r{)D{#xjG2`x z2Tkd4S=7g7V^SifF-$x;3&~A*t7LRM*HER8m>jQv*7zG-PmbQ#3yZaMFESqsI2W3O zHMXduAj0L|s+7)BMkpgXJGi7F57?rKw& zr#k5FD43P$i0iavobt5V&cG>j@r?9DZ&bf*K|HPzzQjFX+Tph8}yq>*-oHQ{KK!G!!`+rS+kTy4cir-^T_L7!(27~oj|#OI5q z3C0Bx9@MVw?aTwtmNKg-?~<>O5_3^cpBkP8LoE#;(^q?$)}=i(1nph|%PDF@eGtp3 z={OgcP?E4#K7>FGPLAseRMkCO&q}Yz^+MVt7x?V-aC_De!@xMnJSJnMAa;2iN>8ib znD9=Yv0YVVU9;Zp`*ZuPY$A{xp-L1i8*tajN-}rc??L1&{-eK{iJsyA0a(;%P1OG1++9;ATz@D!z+$ZN+N3t9#=Bzc z#i$#ZUthEdLXBc$jZ`|^FY77gij%+bZXZ5~NMU}4j*gD3^mwIPcJ_bK+`sMae_sD9 zbT>=F9@QOwDb9lvVhGtSDPCHgzmzxca;QTFiVW@k0u13BZ$3w>uTzlo%;` z1i3DRn4tn_Hw{um)n$s7VdxYUqwcOwuU}4u@ZUbZ9}WwY^nFa`td&u`4DC)4BBuku zX&u}5Z_34(-?#f^!Q=1Oh>HE0C$pA#BkbN^Rtu|)d&s_DzmM0a%S6bg=jS@T&N@Hg z%|MJID2IOm=2RykR7V3ylPNy{m$1p?y} zBi?f%v?!TknuG;ihzU2{MA^a0`kDghs&(kLHjoOJ%@%-<@ z8mo+6a~5#MydepnX5@#99lqq8L@JzuZbgwpI z$C@6!yED6K*P%{QjipJzK6c8#Fu$r!3ivTmq<|q#W!H+F{*pK3d%}^WE|9e%PBF#Z z&vBbhRik>Z`zj^Ub~1YrHu~L#Az&aMe%Rwtb<22)?$K)eD-ve2{UzHNjp)b|Z&38s zkDA0qG-Aap>0&4-nqW%-kH9cQTK0T}h8O`pPx@WXFD`9oMSXU~#?oANy86ERe~MWMQVu1v zZ+l8X2y*pUXeje{+s3w5v7jLP!j%Q)9=eE8ApE|$$5UV7hEo}!ZMRZB@a_{MNeD3{ zIa=T>Noq$(2*WV`i4f1GmmMTxH9;Spkk^3iAWCwC9=`5LmylAS8H>H4?U~s?6 zN@p%8w%D8AG&m`-K!LwAoNy{n%9cHlvjTR6gURXFP-2^!W)&=Crml)yaF6 zCY~E7_$J?_*g-c9TL0#&>jF(-gX&7L(+(qz#o>HN*xjlvd#ueSUxlw=VtW8=q=T;9 z+v~A2i*+)u&4_a4M8G)ZSd>S*c_HCL?>ZK~sLuq4%8jjr+1RWQIjkJmlRKIW&(3*t zJ&UcDII5__K%_st<||`51aUqjPQ}TNZ50HoEu_CnMxG-gYj_uTP}}HB{{T9xMl_d* zEoiNIvg63}3Nw?CLf*$l@_(He z8;T7*jW)YH;aeKC2~MLd;-q^bo)S$+=b`&tlJ#0s6$eB}h%|xpF#gQH?Zr#=ITGUr zlPw+!Ym8ZyKZ4~S5|BP`2vP?xi^8070C=6oy?J6cSRACz!HzGm5W}yn=N#zPHi7n4 zNq(-|isF*FWd*NopKFQkeI!5V97$&&ieYql9XAyswL=o$8C%`xgZE0r`9B238r z8m?R~#rY={KhSoldFE#vJ>v)$IDOwZ4wXx}dq8325=4~VP?^dBhB5jX5l6!5{fr#kup;2#FFdUQVpA&fgIxgK#y8r~1gZ)yVA7K2mKO zf=fPD986kx0Rj1~fSDJpzcEmJRvZ3S1%A8j++p@1Ih`<4kB1Hy;?tA4Tj4NbcKS@S z0xBNA#5-mWZT3mAu``#v6Ukhp%!AJew}5T-EuVW3+zF&ZMY~ zTnjRdm~S6J3qx3B)4#VD{Ku`+L-}Hjch!+7i4A5HCJ5!q z$HCFN$4%8ee+ODQ&)|1&IenkC03Y3HtAD~)q+^a|x+XZ#KJ{)nPwjL|h(DOj(9F9L zFx39mlbTQFi1u0l>ZFIr#^mZL+0EIn82{oZIOpNVf)HvVZ_i1MyZ^5Ioh6@%!mbZB z?i#GHakQAmHb5LqH$@(6@|;h%62%sUx$@?dS~eUdj_mp{1oNlkIT?I_a{LCj-7;pYk@_aK?Ud@a!YPzT<#P1kb%gmCeKawfe;Hu=|GJ?p27KjSgB)Z9UPLw&_!sjpfpLB!yF! zT|s7M;?u=KqsNu@aL*##QQU@QNcw$s1XiP@*x{K21TU)&^O#{?8*8$LxpIf6A0vc{ zQDl z1`I_5`M*TFJR^$#O-uPW&S63}k+MbjV(+twU?L22dN*b7{PIOW!~KbfNlhu%>pOpQf$^i%rEI&p77C1xUfl{44?08v-@~teh*2p-azhZM{dS^cD?t_k7B46INq%=ys2G61@~BdGELP z>+oTUmyNWUT5ZNe2;3 zpEl64-!{`ml&27@?zyrs7^&&z%{T$l2&ZEW=Z&~+MJZz*bC_n#<<(>H7F1~$(Pne|5 zQya8PM<88m(ef{y^(^T;%C2>no{F~);oH<2aTGXB>q_eh%{ptc2xP)qHrVLCOxUfj zjGe{(ft~#cs)jGwYHyd__XD+Fd2~Rri@~b$u1K;%@;hl|)(sn@u|(rQ6Zj5+zuiX) z1~C_$iz^X3OH3b|O&=>!jpSX^Q=(axdJzQ}`o?QVIjp_p7&$#Xtb6LORcDsFwoFUO z#vq_}3-oC6Hbqunl7-i})i%nwm61$1%6~N9l-8MmhHK^5+&<1yw>hC1glbkgIjJ2N*lbC%7gdv( zMfN35hBX412Vy0=H(O%om~zgran9tKBatZ{uJ;Mx-5|=xbS-Vj0GBf#UTmL)kdMfbQWVeuhr8#zhIBH4Wa4;kqOwU z#@vVu)~NW)3EVS&i(Xk_{Rp$drfdHR7>0tg56g#BCAXy`m+B!FM>#i#R9!(|m*5vf zq!zeO*;;{^-ep3Wb2nVN)6G+L&{}Yf|DWn{`ScW6AWP-6RmD4!mJ3vG$H5npu4 zmFBc`(q$Q%a+YLW)ze{LlbrU}BnfV)R zEQBz}KVw>q(Lz3UUqZ&ML$q{TO9e<8PL^;xT-o{SvW(Nwbp>A8g;Wlo95iheoxq`Q zhX0bSr~3tUN;dpE_D-@TtF`bXk|0tAiueX?LNlIHcA?$$T|QdlJjhi$$KkQJxUd%2 z@rTj5;Q*X1^0OJE zRyS?TL4NnSFkroM|-(HG_)HgxH+YtHx<=<^;2^*Vh*wzwnlG6ro;M9E9gvLI@L6aMBHuKS&a5TuFut zRCz9kItn|h;ez+4%6|EB{W?!${=5ioVi`*4Y%x*+m9#sI3p3EW)(KUlQYlB z`sIN#Dtl$2Hegm-<5z-Aoi-9wkTayY{fFkM(a=&Y-k2_c z*jKiu`qM0*vb4#PdNfXQHo9<@tU0VX2niQlqnnF_$|-ax0%6AoGpP^%W4SJI>O4`j@Em=v}IZh!P}Dffp6zg~rPO zTKD@AL1hUc=p!}GckkQM8IPGeRF#*!b|k4-SP4~jk@Jt-Q>n}(UiRl7`>p8+Zq4Bd ziL@kOEOMpCgWd=nvQE$+zy*aW>S86AKkCaJIAN648AtQYa{}S(vMM!MY8}ah$&qIL z^VQfPHRK+uuZ~kw;j>&n7&#{BKO%^-WzDW}%S#-=bx>oaEF{I5XKu^9$m~sX23}Rs zcV1e@*)unovv%4yG5QRrE@G)oh&R`nu^Y~Ls&#FvwfY1>r{&PF%|s)U&J3WPg+wx? ztw1%B4K|1J05xQXp-KELYWKo1f)kyB;M^MBN?vs6yOg{D7ehHbT$P4*tYI@B+#)V8 zV%xRLykMr23PenBW|0^TbMe18)pZiyxm-vk`l-PYX89Uy@whPDA*>%70+XuviF*-O86N z#QoQ3z}Tzd!*)6nq&eSXxyF){LfadH2nV4$+&QGf*&rb-wiF8DC@2ryHj2THY zc;-c_vzp*8qi$$@bA}6ryM6k)vHkQi`_qmJZTYK@Ty?m>NqgmLQc#@OtBl}GtODiHJFpUg z3v*43w7Eay1zlMwpI}tSM)d5OJX;k*Za1hq1srW|h2){d7(rP>r~I6__Cbey&-t}Zz?7-eKG z;tt&v9Jav3%rsRUUNVsgZPZu>gOyS2nI!#EX;3u34*GNn@$7uD^N!3ZhFHi6J;#4W z0;Z%LRmM~b$DyH-J^SdfC3w4YRCAuztXL9mt>Ha%VG%~jD_T@m64?6Vz4ChbGB*uB znw^Kd&{K9_2e>W);ph%x=c~M;i=e?)7Pzz9PA5>fGF}B3UuX|dQ{q8?(Aq4j0JT+N za|q1JFv@VfCt(Uf5&`nZ&Kxsd2f$wlh7r`7CFgbKMR$4wjv6t|1i<{^ z`HJ6U5H$`uP0oxxQf|K@ooQCfWE9U{5GyfEvT*TkDvO4 z2DtYb&A#jTNL2svV_M%A+7E2P|B$E6!N~X@H8pHZ4F8V;0lO!bsiS62=?#RN>_V@9 zP{d!`-#N@0t@y5%$HH+$#pBzYSdx$==KB5>2Ni0|D58-3C+Xol4k=ssD<~<6%xvgj z==}5bZU6TEmv87&k58`e%Tg9U6(2C0cWnt{x-gh4K)Zi(>GWC;Ptd>9{|z4B+Y<$m zR)6vI?I(0j_zMoLsYmCqZx{Ek+KpqXq^yx8vHFI#|% z%sv%1B+($;*3j)kOShRn7CZ^%KFoS6SaxcFb5L2`pd1{b$z!bj@^R z$)MI|nP$SW8@S{OX5Iunw{LwpV6%=ErQ7OHy)yO(Km(~kgFwu}g; z7&=a%~DVW%ygkrIJjr&aM9iJkfytX`6nTZx(t#A>lNRd<5ye>wm=OK47(|0qR4# zRnC=!qhew5`vduz@`s9w1c#W(=-{o3>Xw}CbcNfbjx+iOLz=U>yBM&N?ewf?nktzW zc&sj1KeN+jK&eOjby;CpIVCn&g3v`PuL?++h_sTh-mV;hQz5+jE>vf1kn1XQMAt%( zc~q>lJCQU`_IO7ykso&24D)CpgisO}d7Y8x`aMl=hk{yks@_HsvWJ`~N++HzDhQq8 z$S|g|l_=tz=R3&$J^B$bLJsODd*&aztw^9nP(yr?AHKjgLTFtfM`FTw(AXxLlG7D#l4`FqwWSyGu@3V|k#UVG!nLnH^Z7AkpBc!S)8cN{l7BtI}_5%d*c8qLIA znW#ON+Ey+{8Ti1OAYoJcDql#oGx*}jd6*T?K$rY!=^5&D0@-b2Me;?O#<8r^4n?e% z&fa9%Ec{8zk+}hzDYd2(4yV&jxud|t3`wGq)3f9z9A5<_QGCq?r$>bCE#P%>CxXX0 zr?AyX^ZFRO(;&9rBEBxIF!3c#P?5ZF%h`#D(&J$}(i?Xm8!q2|>5GcwtoGG^&g4Zk zuG|aWG(n)J;C4frz;+x;5J#z#-C&Z^QX$_@{qz8mt(b*!pnQQZ{ZTV_{t-n4&(;v* zLN@(U6Gc>~(sJcP-@hY7?;PdXh*14D5Ok0w^Q^g5ULnOQplaS=K*c*WwYt72))inr zS)GURDIsDq0MW_DX&?4pryfR?5nxrg*1iX%eeLi~X>hHk_VK!gzlrFW>J$x_{6N)HM3@~+PJHb0Emkqr3Sd%e=wmud*E{For z^_LMGzC%Aw23WJ6b+jMHYxB4bpEAFs10E#at{c!mPI!cDcj8W(dbN_yO2Yi6Dopsn z`Jlmz5z`cOjzb(FQ5dw$h+D~6S}&8+8U@|{sjtyVP}!vIT^W27jjabh11D}xioLq` z(k77-!J#>Llyj$9_BZ~e0yA)y#nL8NrZAUKe3SzS5$3Z_(s^3%qlOhcrnxY>SU!Lo z<%|>ptQ>$gelGu4?i>wd-;MDh)JCJmN{a(a)bqUWT8;z-+5%$myaXn|&SU)IeAmu0 z-Kn#DW@rWbvjirvm;xLip6Tr2(2dN8)oNV-(~LE$wkbmH1m_ueknJZ(4)>(HE&BaM z;5nLgbt+Q`MSIIn(fVp3_yum~x*1Lopbnd=BW3_8uwae?4=v^;@oOKu#nPjcq|oy6 zf`+Dga$}DKTKi793Q|P^D2MchHqbdE3Zf_Bn4SVpu{NbImwKy5I8~dzQ)MM0vMK0e zC7bQd1Di~ll9r^QgtkQ(U9xsIQ`lRe`!DsMf`9nNxSn)xyE>miNmdbL`{|)z6hR3` zAhj*VLmnA&cSJ8UTm{pGMYzzewM3;EdBKz>L;w_d7`>?<*P_}oT!@$+bzYam_4Rvm zQzxkpk4{+A?yfJ7AJ}7I&{`_X(XQYu>fKMm4>yy7Yk1His~^j4G#d+JEB7*OeluGw z2YQzisLx29G=AF6;Jiy=rijgz=TRDg-Ui2@P6vj{cA76RObvjh&qNd2i=?pvZyc5d zu>L{zOcR)CCF0(>mZ}h+Yp;Gq=C4oG;@27%k* z_$(~DGg8$|Z_g&*^z2n?ORBObAHF>$XlKP#BY;Mg9?OEqGVIxc=Ge$ZN*{Nj?v3fP z0~pm?udgV!fAW*tZpRwm^&j^|%pI8X5&g(hsW2jpC5F7uEuTT^zNkH3#BHA#z~UV=Wn zqo7?KfE&qX6h%S0svAaX(;hR8AJ>$G4K{;Zh8Jeao zHeb7!&ot1;Er;52MiawBUk>S)&JXkg8vf-{C@0nhK14%57@3?_?K$Y!AOb-?vFuRz zo@gfOaCA$REKC7Pl2soQvlD~28=F%n+f zV;8Nn78YC$CU8kDW0y94OMd+jd|G7u2{N{Wmb*h!Y>CD5UPP_T#TZRQ7jDiuL|neD zGIq|XU?`}1>6Qc@3uh(bA1TURF5kG)d zz67!;)JJrI*JbVHlm#K!qwlpoc^sC$VJ3EPvMOEP=ICo(g=>ewHBg;2ZF7Mn7LM>9 zs#FbV&{XUCQCYcuO3oljH;T?}c5-kgmaCMP z+e|mGs$-A9FgmNWwv-Cks>rHipg{)3^Tz3}vn;eDjvMB=yNu_`U`Vc)vj6Z2wd`1- zl7py@`^YlwX#X0ytSDl05)guML#*qD=Yg(0TiBJi**4r$lrcU~nkmlSn4vfafps-t zj4&u+S;RhdZApt@J)qI8`gCuQykMrfT_MfhELuwe$|?0Y{+#xh2Dj#r6&6XIf<_w} zgp?Mz%ff4mR9-8%V7|_9aa}wMy5ynlG~u_2+~IO5!54+8Q-_y;c9|j67X|JKI>WnI z;PXCD6-TD7`)sAMqfFA#l=Ko;P3ur0^KvB$OmT`r_EJ(Ao!`fVxu0LoY<9CBqWp3u zztfC%&5+RNWQE8HMWdA&Xi_(3kszS>7YS;yctORrSJcm6OW_SS7hAg*W5Fbfxkj2{f+{bP zq*jc!fs)JVga1_+_|Z_z_JU29PIK9@O_q(A-dJ#)2~5GZXYp@+M^z_;GoEsw$2smQ ze`DqBmK*bW@kBb7L5UVd4lo$B4MDz)=?-R-Gi>PVBCYPE?)0tE0uFY~CMjwLD_EIB z^Emr8iuUEW-I4EI6R4W|uC?GBYs@@PeJJoTS?nLuwt|bH8*r8`$b^!`>$5Q6;1VDv z{DV9sk_l!tqTI78Oc2}rWP*hZ=xW-ZqZ3Rkk`M_aFqUXK-FPbc7eoYwS8CWRt@i+J z&v-spf|if>b?WsoAE%+O{A_qroRVut)v&h#gJ#*P~`*HOvF!tML<>Cnl?yK5Gs z#J-==XBN&!j~C%CiM@tapS4ogy4_9+B%DQQ#2Nm-UzZ<}Byn~KHMLpGNm#s*}oegYed>WhXYUeiuk zSkj)7Ax);#5eb@O>Znw<3kMoxcak<%yGrG-3fQ28rqz1rFJ332=5U23uJW-5SCSb9 zpec%q9eWy4by=LqRoG{jjGgKDdnsrVU;HI81s^DiHsceiwFu9OV_^xZer@0Thh-EF}{CG zn})NVmLj{gh41+6PcrpjiRAJ)Uu}qM%C6kt{3Fmif_8v*T9h%@>haLa^G-5*oQhLc zqOhwLhLIjmZ2;#3xZ2M$~^VK)sZe-134_n%xQ17P2{OdWiN1ezse%}@` zOIsP-?)UI0{Je0eM^0JS_kH{e!mEk?KdkHiGj}8t6D!Am?`&(dCt``l5PCkT-hgr@ zeE=}I(d&WVNWE-B;jT!h&@S5^lpgtcyMRbV2l+yC) z2FMWpWdX3Y-$8Nzw0Zt~woS?Lbwwo-P88GbrA}oz4vyO^Xp+~_?cMx(q$y@pCEhAd zsOOfbsvS>yx%=3y5pyrD9H&8XTlX&WLawpdIP02s^j16^dyn)}0ZEZ)S8kWtLiWD< zkCACys-}*)oMG1cPNMOBj(sSgO-G?eK%I^}U~JmBBz)O)KWKy}d=w$<<_Y!qWtBG$ z`t^N38pG1?O48NS7`2)C5!JqVg+=lCB2vM%RwG8`lZxJ zD?^r??gJ?)ll8!{RAh@_j85*6UI-7%tJn6GHss7m7U-}$uzDUYnN?X9*y7(lBrJ@m zHrk?W@jIQn9l7uuOchaDnThofsPquA$+u{#V$#Os^hvz2V-;6sUn`r0xUNu7mQF2c zyXJ>X=It}~Adusxj)r?ex4Md=O_o#{CcLJQK!6Mu{r+C2#YFirZ!U{qAV@rG0U(+Gakx&)ipX+il=+`}V5N*6yQ#AG4?`8unV^lC0WIEl<17 zL#6C@w}t}9rThXX{OXN!jC_iv&OBpC4*V$))U18+G37Ow*etoke!$(hs`m6u6G!K8 ztwzv?Og+?Z^g)V6c?yPAZG|;~qZd;6vZfauqyaY?RuhluV%l_reh_alF zim-3XB@*CzmcB*I#OQx{p7ByWjbrH(`=;zOg8olzFd7eB4lh}DswHltb<>jQkVTF7Qz=L343j?I% zwTbi3vZoXnkg%<|zJ~0?7(ozSDy9u(cR1A_SbM{<2p$)Q$S}6W#|W!3$RQO#9?bqH zU=*G@GL4iS5<#!wcM9}zq;V!oRS+m2r0y&j29*(!h}t_-g&Tk-Zb~qfH#`henhi8M z3@-;jCNfks7l4+s&Dse?N)7tp`bKM4jRw83OARCfHt%nsxV8Moi?`m2X9A{_HbTn2-CE6|g^SN^ zU|jT?QWiNzWh=7oh*OM8nDQvcM~D>ROFGw^t|Hr0th+rGF0d>=t4(g_X*fRpWjCuv zR(?R@PDGxaju%p`TW8GVdo6npM0>WaW^Jk z9@KLm^kJ1LOiI1>c@3u&aVW~?#vumx8v5<8M)6Zz7VknLj&2v)~K#ixy#6w zQapWMzClArEyz{%M!L;9+V11Hidv|zt^!^AKX-P-6_WW1hghoa)s#bi8948YK&$&K zzECi}s5LbZ;A3+%Y_ zq)QLl*f(lf(bXK^d{%r{V)RU9Q$?q=OX;)Kr^IWyyP;*9NS-o}CoZGgjya z07$;7$J~ztlz7AVS&wxqFaMO_E3*tC@Mh;u4O!1o+4T>UfS2c5F|um9$yCFjv2N)S zNc2DcY91iqxX9&p!tgKc^x*}de?$C3&>$orMTi;H$IQa4&tpzWwWn9F4Q9Af z)!8o%Q55jRsU~b)l?pwGLPOH!VypEgeF34-X`sMkrUEr}ew6a!7uk*R!;kCA@3PxW z9_9JJ7<;E?%K|mqHkWPNwr$(CZQHhO+qP}n&Sf*t+VxZwb?%MxGUhKBGop{Lx7H9?78L+%o(_628waAUh6EKZ_!lfD;tw%)CP0Thdc+2> z!`BO~Cb|EO+(6avyl0dZp{osgr`D(Y{{I7pVKN z`ZgIL=kIJuw2{EJiQ1-FTHigw-*fCo=BfE&H0PXHKCt9a(%5?YK($D^4uwd@TtJ$d z8oNQh^M|zP(YdHfu0h0<9u+~4TcTSQbG{Q} z%2AEyI7`n^!gm7i?&Q-%?6`99!dCMioZNv22L_jL0cXCgny?4Bc8YmC>)u#x-`{J~ z3Sy2+!x<(J=f38xc>#1JPV9TdG*8MM_>ipPKv z!u0R_;92S|J{x^g?P}|v?+y2A|Fb+1ewaI8fX^*kBNE zW=zRW)!*a7K&&K?qw%ejQeoSn_~}Gtu`v?YdvB23vz*DCc~=h%a1ID7yY@gF$%!7| zc6HmFFxi*iynXye&TsTcogaPlp9EZ8K_wg6X2~y#9P&8DwKuZw*5u7p7NF}U2?D0; zr@V4XKvw7veAF~yu2XOhCJkQn)I3$ec1fKIFJe!V@?eSAD3N=rtDRHUpW$_(!n`=X zP((hn*(rvyPG>0ln=fq}OnY+)R*$)`qM-_hH-gf+#*MtnyI6@R!c)bKvO@2c!`{7% zqZGF?E@;xxi9=eW|1uKx^(U3+57*SgK^?{vl)hUvvR;uONcN>bHt0h8$vB&{S&CO2 zDwQP9<;)}&_+r=Dk65UNT(ZL3gF2<)ACb-d&DM-1#u!()kcX|lplDrbAc79ey%d#ZTpH~)y(}Pcj@38`YmCouY0qn%Mz7xF+r+x%N zpQbcwVX#6xa|Gu~L*nfQjrsgn=r!>OWS+M?-qSuVxm-80YVWt7{G zo#u-Yo^wjuxdF)uui0EQ1~=o2VdmfFcFE+-y^6{3(%SUFu5*_(wcVPEom0{u27dHTvU~@um1;oIdAZ zVUx6&db2Ar*f)?=ST)<0IGu3=(w16}Kf`y+sIu2EycCD5cTIxeR67yQpSW7qRdC9(v=jB5ikEdv*V6gF5)H+#_&&Z9rmh?s~(IXuS9CPsX=>RbIC!u$J z3AHJf%8Hg>Si+iAEs;^x6T-veXp(zZWB()tU~UU)F!O>^4)61eo|WF(=?@fZ@jL$v zMZMDlceu;CNBuXvgf7xq>o9L9)5qtKQO;ti+DFRwA zrf8Es0l_8CY_A4NNc5w!<7a~>*0K8cehOUp3+7M+cnHF_7hT{8!kFq&*F7b+E9hF* z&2hCLYEV(sYm%4veu`h=k#p9TeY}*aotXqgl~?%KMI*7O)oj#C9U)H9#a$VWymt81arQ#&ooPqcKEmyl3Jz7P2NGPWY1%)`Mkw*hPouBq_$Pk}{!^5GqKCd>f zUl>;3;MHE$m7cHe&sS6j_$(mY;lrax2jnj@g+`E3|M2j5KZlnM%54*A{$HBSq}ly74XS`3@F{5-u1Q!#@N5UKSi{rqSa1r z|7rg?yxYixY`lDY)*a9N6a5c2#c*HsXMq7Sq0TK7K)pWjD{nlGZ3$nEB0ZQwx5mH4 z9G+o>*}EM33j#@lR!-PMkGXD=39OHj3eUSfAx`qb_uMr074P4;w40g|8D zr!c8Cc*s6g0_lPNuwyxAGc#R3HEe1HeKbJC!w^5%MKNHSVnQmRZpFEicH!L`)|%RB za=~Gw>3g3li-?`P+i58a$a5rk;c8~!qnNo7?X}Y50mLh$m71I@UiPb#%yX@}Ibn@* z1AXD;BNjRR7LK4pe-nyxn3$}Dd76@MMxug0GZ-UvN~ncoV;FR}=cS;!6?V(mo$djy zk8({hU=V_5vIWyjz@|j9m*A&IZk9ELkmDmb5cW(Qh_uB%GvZFwy zhLFlr0vgkEE-vS6q4qBZA!;Pqj}25eUQM(B=zZ{~P~TADPpzOw9<sKz#Z7ubw9j2FJ$OqJ3P8UifO>3W;`Xn+d>(KY13k_*OPPy&vVS2K1vUZ^?->SXfYx}f7-)u=K{2+u z0bf3OD+`toAU1gg;e-(Cw+O9kxam*68|+|t5{{&@;&;X5MB&0~B9JMd{390Bx)@g@ zjX&v-(ckLyf4ASYb+Sesm|*vJB7?`~w>rU&RA6GKE07@H{TuN3M~U6cwG`)UK7)26 zfLqZXqu`M%Aw4nzud8(B4pAWDq|%X)^2SFpaT9UQcXds{H<+nrbRthCe!8&{h@{gy zE>#z)d7RAK*vA^xjcSZFMA39@K><=jOpqc740WzXL(ROp@}P}|CuzGd5r#~53kl+F zKCl|)>UBGNOQ0Q0mXgq3uv7p6g^>RhByt@_jtZ8C=5^+t z+>26qTU}oC#3OkWAOg)5Uk#Ci5!t}@upL&*yMyVYct$#Q-1no3J;2s{t(coRQ+Ze8 zebu=&3|fCfczweXDV_DICKbD=++IngSAG&eU^cYHp5K2Goh%>7Wcg?Lqj)%twB^^e zqbW(@=FS>JW~~p}+>v>Vc-b9CR;(he9#?qK+*|om2tGkJ_(e+V_FjH6=(dayXiD_O zuGwTXz8w!|VS!U5cIM^clo&Kc} zWCZ3UX{sk@Eq_k2IXeX;yb;|}E-B9qn;vYC{+6a&thZ9bx1a1}&dFV9xW6$dEh89-pvTtMrm%Vv#t0Fbkt&<|%C?#_=Uf}&i7%=8u z%|njFHi+mc!b(XVE0L>sa^9k&2$cyiAfY7-+NQ&U)6Eci4CyfG9R23ddmUm4n#CD+4o`FWI_=pK`$5C_gUePp z`2eDAXe9s)Do?f?_AqEY9lX1X=Ld!@KyLR1D`q;7fT|FF4B-xpRT8vqb#M7r)Ut-G zuGMup`05gQx&F^sI8F4vpiK;tZa;3(UucE@p86}p#H9@@cm>dfH08I^A(=RH-$Kik zgf)H>r!;Qp3b13Sps_$9k6eJ+XB~Y=XxLuu_)oVtcIK$XOoaMzG%8XmBj)(btZ506 zFk{BhUbhr;HGL;BmbF|u1zEHzJ0)?h%G$dLRFmSgXNXrKO`Zgws(qW9F2nLZXg|v1 zBrIOUJgV!QRZJA!*TcX*K!j?tra^vyhe^31uZ^A^KW0-FuXw_^lFC5+SZ#DG#zA)<8kmIcjHr5V~b&;2+GAn3}3>;4Ss9R{>JDGYISrvDM%$ekaN^m4QfR(X9yQYi5r< z!)xG)I+c+*;%_3r^J@a?%LCqQ<+1Ah|d2C4d&BeJ-6HrZr z00FOJupL|ONRGq8tl-;XSk0bUF6 z!i#X}CFFN)#mWKr8)gEJ3{h4>GmSM2{($2YFfp4*lW7@&if1rkpqe*xTAiQ8w+^K=M;4#c^@Bp{sl(K2@g^}NVhp}PM1 zaTL92GAX`OiK*b0A&w@Y&0^ypa4svKQ{iK@aV?z?M6BQcOeT(tRq)&eL}Z*sa)hd?~c39>(12NBq#; zs6DT|e4;XO#A|UKaOQBbGejj|y1LmRs`{c*Y_TQ8p|6k)?jPwlu zzvEsUEG+*$p6=*KB^|XV^xoF(JG|n9+reYSMx1BduOH^UFKwCXT(}jdKSB#)r!g1GL_MBgm(qcCN(Cr+gkl3Su zGW#)Cj;E2cq4RLeg@>`fhBFH2T2=_Hb@pJNN6C}uZcP6%TH?o2>><7VvHuV4sW}JJZN|> z-I+c#AN3T{7$3Mryo)PDVPQDVYfK{(@Xv(N4Be1bKB*VVB(>e76Dm9aIl>=1GiERA zNoSfAMQ$>1qnH!}m>1fn6KXtP+EvzmKTKS*6a93cPTV$JMR9_efmugTb*U>|1|!8c zbOSj9Re)5bl92-MSmILH9yTW}Ga4f_U4}|PiT}2M=^~ck@egSPC%j_C#9)%7k+>?P z(6niL5f%SbF~JOiv1qY^Nhi7~lV};0KC6+BCt6bm;|6p(z&VKoh{m67E(^*qLy0Ox zpnfOlDPsY99V_P#+FGb4i6((NlJMN!5tp5l-TaR`PUAo9wd6U7!Z_r7)PxlHVJ|`5 z5#FiXky7psTZ;)E!|+Wh+z2SB{Hgf(FbrB1hzbK(8kmjB*rI<5MHt5kHW3rEL(^v- ziRtTs=viWm;h2-@7boBo!Ip|Ah7}>Al6&{Z>)xN3rcdceQG`|D-7yD+$-_}}09XYB zjDi6~1p_plLAD`-gUjg5p`{qLu>&g-k)b-NNXEy%ZrrBaKW@t^ zIjH+=x@7+Tj2?Wy@1^bS9#pwa_0j&TgWvOR`h{%APTY>n>}c`6ABeuc&wSBkzy0Xa zu6nhaN-x1$t?*LI9xL@;%1E$}7uQYHT`fCmGUflF)xJn+!}&3#CODJRq@Nr!r-yJ; zcH2~ce6sC*jjaWzIDr}gIL9jN16r7cmfsLlm3YfESDBFM<%9HTKqxUKqW&anTVdvR6d}~Uwpy*ZIlOH>T)*;B z?~S|;J&YNxkKEGI?dj_Jehs?)dwU!2y!J$3TbXyQzIL6e+-Q~R2J0)ddxcS&CC1=B zzyRr+WlRHvgK=#CqTW<3^M#1(bf3UiXBJgG4@`O+p7=H!c%MUDN{iNBjY$_|DC_0b z)HT>O=LmVnDwKsi*b_R(X^Rf*N>Gr61pW8)>|hDZ*?76)uS-KNc#+0mM=T;7tX4d* z4b%YaI14}E7b9L{n#O(_xXd{RpXqB*+-13*r)Ir_o3{7!bn53@hbjc!=HM53<+~9w zcEa!^^f$GN6T8r`Y{oTKPfGN?E>wgWyf49!VXm)P+IkQ^l(rhK!AJ$WRbqnm+Oq>M zmW3iyw3T%X(nCbrONqJa{8>s$gi#5MMgYf8lb&}U-y&;Y`HDcn*h%U=D`*|--4!>LB&vN z+^owk+3ogj9who z{EMVY3sTk?G>canMC+-DOPwzAU41ZVr`<^{@;T+`mb}yjD?7GS%VuFo z3L8kz7ZRLnNV>~_aF&u7`J>f=D*6FGbUu;hACO*S@E=%U?3%$(&lxe}85CEiv(kyi z5Bdi-muG>HRLnVTqv3suc!$r-mod~!_8gl;{-Ekq8=V{Vt*hevs6-LBu7tH~WNUWc z|2vz9K06|0y}G#&ZgpFLE7%COU7BMDbd!QQ3xz6O`iU{hzVd6zS_u#TZAWSZ3vchJ zDv4CUdzY_G7PIQC!$u7mp@a&3uH#jX$Oj=`&G6F3J`>=k%|CC+kki2vNNkD+4-z3d z$UARpErdcSnCfpde9N!6h`$*%yRU1>;xlxq$MPTfMh8o{KL=OEn+;WW?TB3A?0$(uF zW|(v)J3eb;>1{63>ui>OU(or2s=;W

O-`9szSA@&TU*GRo-p}V)-Y<37+G7fV z)I?WUlA=TuI{}h=jmv1^j)e=Wf>|bp{Cz0$(fe(F@>Dz7G6$Q3HMC+635c+K^~F*; zF<%Y#;Niil>UudHFF5`vUhFs~4p+p8Od(8Yq>^S(ZR0V@urMywtJ>?W>v(8b=+llq z3mt1$6(oZA8QTrJOAgB$1n;-wyo#4GiQ>H3W38sYd8|IzhHgNn96?}|(avaBG4@EY z$lYgp+o5v$D_Z9FLMzg%2-H*vB^WRlQdi)a1OT1YzTweP-8MLIJ}NewVPNN=HhD5^xjC}Qk5ZZ;#z1;8q_=k1;D<4X)c6Z{kE$@RDe()GEpKYUn}zjx(?VFXaS zXToJL%7NP68+d>Twc7J0HpdmNk&7@3{$lg=ufl$|W}(BmUn{1Bh-&hi&|ns5XFxJ0 z+-*dE3KeizA3706zE^CE54}(&Tq-9?ETyJO>WDTqK<(6WuDNhASrD;`d{i3yTK549 zlOer2BQ;UcA5x^Wn}D^(`kcdF`!+gL>yzbYX+mrglypus_vf=95|BIy2%UZf$PGh# z6fdx;CrXFWJq~>+VRh}a?QpQp1Q)PLAZ03eG!^a;7}BrYwnwAdKyR=f5X_ETN6Hd$ z&^;P?S<+eEd`tbS$Tmug6fs41w57{%#gN(baoHX?`+H-f#S)atM9{^URLES}F+DpSHbWU~N@^%x zEKHeTX0i#z5N#ISc58$dCwJxZiOnTxA6v#*2E}M`Fm3_H%+&0HR=HES*EX|6&0mD= zPnjk*R*{{59p}B@X}P1O)50}3@>h}-M!ckXV}g}?lAg^NTafNT9dyqlPRC!XR zS_mhLK5AA}UlCI@Ouv!nlf+u6`rrJ>dU(bf_5y|QR-$_b*3LaIbJs|xPKc*_D)Vuc zvQO-A_5uXrLuT`5ezKwNRWv4K>8i@#Zr=_9LMebO0@?_&>mmX%dd?zLY+Ss6>y1(c zLa{0Da5@y|J72bzWO|_?hFFNdnqaXxXG6F?))sXj2;`E6v)-GFMZ_64JK( zM4lxQoYVPney7l#F4u(+r^g6qlVU7;22PTcJlh>3?9vG26`d@_r44-1ve)1eKo58Y zLhmW@79*$ttzab;m+R>_$x4%=CMxj_2@K+7wUcH%np$T_p|uw$m3BiVeVUpV6R7qEG|n^Q4wP+GwUM!sGG>_J}VGgq{ayTv^sq!7S)TCzsPkG?1AQ|eWajmjAM z9qCh1<7Vh{b0!Y9MkB6fxdJ}Ak9t8-PNZ&x{6Lxp=WqtLeoj>#Ca0G{C($si7Jx9N z0?6t5xpqPzpf>d}+w#yyo__QQ|fo9SNVVCW3W9oCOCZfj1;Vp}G z{?>c0GJSAaFAJX?%?qPalq|x<8L}`$R`VD*!sl`_*sPB%83-A!%6%k{L|2>YuR>cm zW*gD3%G8;b;OF+$@R=4lP7aMcxVKyD)6rWf=+~tsLUSDfA)pfv4Lq+o=vh;eoBNSjmaAI5AhJPYXMn6@!#{jFWP_bVCI)EISF6$n4+% zfpgX4M?U*mQVvHX+BHnJGvi6~#sZFzT1%7?4r#-6jq4?(Y(}EOW9i?0)_VinrDzoB zj_QEUM1lYqR??z|>ouEi=Il=oobu47VpYA0$0&t6b=I>@Vf2qrc4*3me!UX3b=8@W^cN-NiWvv#uH>;nen4vpm(VHlF2lTj# zrekYr&q64;f;uv-MC?p~s#PdOtQr<7(t*x_mtBmtntNf-256z{Tr66ZSOXFv?LsN< z0}$->a>&8D`4mML?k2wGLN45H*I`5N9wACv=rD^bRIEe>+qywzUUyFfu0mW? zPHPsAqNORE*9mR@ORA^aq3k)8o{DQORjX7Wj~Cu$#-ug{ONM5%@ULI;ID+S)l@T-2 z+oJB13QG_r6=~Am(HB7!y(z}3R5G0+jpT|&i|#u0?eweG*f33r$#C2P7*d7 zDw;%-;1O7E&AT{gy8qdd+i^yKU=Yf|9rNTlVq)e_w;UAm*K3c1GtkBIB*DgD1Bl*$ zPWfzyK)U7;cz)(dN)vDD~+E8nJtNt^-pcClk-slr(!fcaTLWLTi*+_1)Acb+wJmS z(q*z#&&1ho;C7oKbA>*~kCer+qA5b{5ay|2%8Zlg+vN+r2|{DCD4Nt0!!b=MDI%}1 zk`zt!Nt?y&D4CIIQDI?jxWzMY zGixNpH(DO%Z*PvOKu$qBmEIp}h@7!(Wb~*)?GYrZll;zT66)d`wS3cl-VLX1Nd1|M zsl7F-jw`S@b-jj+*(P^Un}xmJetorJsq#&$m7cOemMh(*5BHOq{eF-Ev-+gh_*WmT z$yr9qqD2oDlVdDK8D11^XSyJodEs3C55@fD zOnrqfY=(4pL>h{;0)ds0Gr6hhq+3Uw-8z+2S%rE&z;Y zieEtsBh887RLFdAnMVN%(er!=Jcg31yw1nfJj)1LMsKpC+##j4N$J&IG7-cjXu`v^ zbf@msQ}@Vgq=ZKIA^@Pnp+@kp(bAZuYonfed?c1KrPFrN)@)+mEg8 zfmev=g9x}2(Un?3M)I>|F6t2oiaH^hDt{X8$v%#g;xV%s*gbOW;|l^&4>>DU&754l z&-v?0w-^KpbjjHXy{B?azB|zw#9f#rPxH>_QFoylR_XYq)FxGFq%P-ro|8+F=B?09 zh>W^lI@*(Nxu{%vz8JR&*;c7nxX#~KCx)&+OBKQ6XJ9W*?92x@uYMURu|f716;jJp zW4dW}Dzny2T;Ab2R2|7q8eM@&@f@DhvbOeoDhF>qU4=(U`yiM z`j?{gMa)h=D3R`Q4SaB2PEA>V3uh_a5zygVw?i7;tjq`SjC``))-b3PNd~DeAu@Xi zQ=0Ry4{g~k6i-wPr}yn^5AtaY?sfXJfxCXeVUAlO0ru$qO0c89t1gb3*y^g z$1HZ{WL9hI$qPz~(l!FFH&xjFlBRTn$3!HoN$Scz|9gk>XmjaOU+LPQoB*G~XP2ks ztKG@i+|G@2Xn40KsLOZxdO(>p*?Mf{q!wHWA@%LeR1@0I_72J1Sf;MnusIw$gYu+E zXrbh5?{ekh4yD~yk$J=-=~)(%yHeY?QE7u)0^7P=$jqjm;-r@Ddo1Kv#^R?Zi zJ*ilncRVKl@Y$1nu(m`T?deLHg_NOreE84H$^c#S^VW{S<8;zd`r25Qf}^pw^QyLWkHyjh z&yv<-`~p`+X2hp8UUkrV&T!hHVAJW_!?%WaYNKQ0S&Issw=lGI(Ev1SYID|H(dlE( zt2ZbWllo4zT!^cbvpVnF8>prv5jPuGZ6zn;^&u>@21VCWqAqlNc4DEovT}j!&{H;1 zdqZxyS>{9SX;01rkVPqwGPCL2p_&ACtU#aek)R71RiY}*mC#rJc6LYbWAbUcm+SUf zkcW1sdtZ_G(cUMxi4rzdey?e=eEw6eO{Fw|D>09_A);+*?~Z<VI}2728b?LXhF-=^3e-;eKq zHO0hPqhk1&I-Zbp(vjTsZ+=qp_(cBG6#JVi@AGpssC;+&(B~=`>+tsZ8r7PLQ8&5w zujA|S;VKid>H0oSZ#?f`Ofv|RsL`PsK&25fq23+_s{R1vgC8MZZw6|I7_USW0YDq(O$WfS;rEu&yey`&3TNno?|ZO*M^@ zjC6n{tQA_4V536myyz$%_EcOdD`BW3f{u6~V;xhOq1bMW%|AzO!qq7tBx=7ADYI}% zR$vfYz5&s<#&zbUUx7ot&r)F({h01B)z|~aD116H6U8FUl}TG#E7`_>75K2QlFFKL zT8*;1;66+cMUWpmKFum#`YH{(TieSE;i?Jvo>1jfb-?UL&_>zLtJX^hnv!WWshEkV zk(|Hf2f3t=3a(4`g?GC>>xsBY%E?utp%&0_v8m5cB~U5d3cUh#N5+HT~4U5EMkdtkrR$C{g1G zg4tV*;~U*AN)T!s(b>ds{j|m~6V<;{4zTyB!oQ_(c-uVlv9D|G;%aKzaxybs& z{L(6!^67yV+DodMXI0+SY=soW!m+34^p}SJT}N@4TM@yZxsB14_D2A zNyYB5zkKT*t*8RQf(ET3_X;?eOT2W-ybl8C$BO`e+8L`2Vlo9V6s14|z=om|$xGL6 zflq@}xYK*EP%XrV=<%}bfi2!ITjwikIIVlmggGR3@lbM8J;DV?64yPMt)y8p=8B>r zp%=iKn(i%*4+H|L^Tco$DM|hLHp+el!7v)OX9gxj>XZ^Q&)axE$e2W z6yJB%?Z|`!uAG2&npV;@1laC`L3CzRshN#5-AqaiMu~@DOyxsMcOK+zgE%w+4UbwFY z4;yUNumw+4x?@cub36ny)~W6rR~){0V<)n|ZU2@KUpJqMqmEpk;N>ONirTnY#ui&2 zNyVO_QhYPBP^v;)sb`zwIm@*qnXrEUG!X`3Pr>;2(F(38j-65C$im%{*!c++#FT*35Xz-|UZ!&{RQ>p_X^chrLQ5O_-Ag-L9v9RIHJO z?WfjL7AlC!07T12+J`p;N2>>R`TS~haBBlUeHCfc0=R^u+TWzbw6O{p3u!#f3IhiZoM_opY0mPlL zk$32(VPYAT(9U0lPGI#Q1p|Oy9@|nJEpLx3UPQ_I@r^r=M2{@`w?(kM5qd@+I z!h*~LIzc4Q&1nLN5=19i-YMS|C;CmO8j7=OPsBxik)G!{LDRU-;tIWD9;0v8XV+*L zWs1hsDXl5p@4^DFB$a?^hpvYGMDwA@o4Kv>ps3WVHjSjnIOnqXaOA3>kc#by-!vsJ z5R}O{acz$Vq*mu%JZm{sYMP%uO`eVwisisq;q2NgC;tk=c~rUtH^&6AJHipz_?jLzxO_G9ln>Ou8=vazeBP$dWI2dDijOIb??T6yUzK zcEAdxDU-B~n%2BFiwcok7Th%##?JINBH<#ZHL>}DMv`HM96J~QtX8GDz``|k0^|{5 zmOC8C%Zv|hb~1&sBaRV1mu6Nc#)|JSbvh5?I$1L_!nxM40_Njqu1o&Z_DVV!iSf+O(R%odN5&2n#&&n3fMy?HCn#X z`H;*9kD5wk@XkV`n%$<)SEoE*EV0K%&ShG~Q(zlHWv}u%_0z){V(INM-=uL>fOwzE z4e3o=i7FpXB&-#atS25G`wXT9LOuVG9=0_1u6j)20XS$UY zM3||h2$A-v(vuim`WOh^{HB)P&&|Fi9lU08>8UMaNn*8;!jXILotzttiYI`q&@I^O z9XxsC7r&eI^cSEQP!pyny9f{|?YM8K(73Oa3UM!pvInr5qS?9yFy@xJ zM|Nr;U8X*U&_r$16%3R(UvHH1g1@E~7)f}bY>Pcn!KNV_KVdt^YN*a{ir3k-vskqU z^>@i%vG_GM7YaKH)*Mc&Jva;+?>TufSScTe2m$rLxTa0RPoA6Ix^Vp};K@tX^4|zxEDq zNo2Cq%Bg9!BW64|$>EFHX+j$svo<2o{L_Bc(09iG7#CBZZSSB82Q0U@W1tvIv9;ZkV)gfRl{qJ6$6n)9QEjo(^DdS5ev9;zU<{@V>_PjmN=s;QfEgsvPwHPg#}We~xU|Xi3CT{nyC$8=N{q3zYe< zzz_q!O=6d3e89HrG?7D^_WiSf)v}^wr!p+ew{?m(^6(?UQ0J$;Kjet7UEQH!lC@9ws3<(F#G{`q3_0hr}}wf|36&CfV~0SpX4NW+`+^Rb700R0LAa=TA~Y7dCb zyZ@z&j^57fIJ_rZ_B8s^aB3}n^?$YSKKCR7nh&&3H z7WqGTwZEwKqSOe{!^LHTfg0+=ytN1sePz^miI}vx8IMj@N7*jOv*Yx?er&Ey&o~m#^|H7J-T1zd(L#;Kd1Mz zlQk9;)AL)rK4-jtSmr=Wnk~b1{-s4GLcQ9*Idzx+)sL7@H#$ligg$^;7iM1I;iVOjtf7iSB+1=&FSzJ}qq+6!IIU~vm6iqG{*ai!N& zy$&ZNacJiNGUhvWFsT(fvKS(**B}+0-`tcDqBF_wz=Ddxp9}CZZ?qn%6MO|mB;VAJ z@%qM;wkLiSPajsgf(S&7#t%%@kO)(-(ofgT?H+welvd*5dK&y~n+INx_!EE<_+L*K z1CD{XtTGo`-n6|j#&Sg?1 z;T>ZYB_wZ8U?UK3d7mn-YW)%C4f-l1` zOf)6|GR!&-^3wsVtXGR7us0Kf?>Y;rrxGy&^`{MO{uA}t z;wd54BPeJC+yYwixYK>a3{#?Q*mBppt*JHjwAx z4M42q{=l523j-e4Cbk(I$c`+*Zu-DdXqy5>sjPGN!)qHH($`p=RA#YLvJ7{5TaU#N z_xkoU#T%+puvA7%DtOxy$`Q2SLx~@Hlm?SaEqhQ!1_}WqeAj5PM}8-Ss}^`gVr=zB zrIJkZUs8Lgr~c**~@?;E(-=pCxw zrc}OQd$sPjbQlhn-0!t_2lw{rU4Q_OY*A(QpiZ^V?lcp@dDWb+%A9nR@}O-bAE2j8 zuse~SR#K0u4qm?>&zQt9?4Y&Ar$e^XbDyWtPNveKtO@YwGDX6+SN@&rE0*${cvxB{6-iW zc+o8*h!E0Zu*FRTuO|Kju`Eh}LsC)7%GruaZMYJNx&n-m_6if_V|hMZ5P2D%0}7F3 zNEknFX9JctV8uMHsF0X6@37l(8q`0JblJzY5fKgUJ3Ve2eY9Y?g(623E#U$`h`zk= z`-uqQdxK;~v*`aY_RTS(z|OjB+xG5R+qP}nws+6kHqP3%ZQHhO@4o%rzwXULUeYwp zv}u~@q-i@d--mqEXP4ZhikL3~)V(Jw8Wlk|kO*F?;P^Rgt7f##hG7ciK)KvNRUcrk6~MiH{+^ zF*@ED9p=kVfIqU8Da%=dx(sPgdY2+EZVbFc4E|P01WK~E@%VHuiunxPY`O&Lkb?NDEGgX!Xu1s}>2anu{DV@QG_I3bLpt8{v4gC~_eKUb@V zHZ+vj{_PU3Op+plD?#29^UV6aLRK?QlAr$TzR4Uc!-3w$qeE^s)b^O4?pOujN>OMD z0iaw+@`%!Iy>xN1bPrmaM^?}+QBkHX3m&Z0GP32!oJa1NjE@U6(QtjBmdt=Gvgs;L zW1==xM$FN}wh=ektHQc21(QZK!Ul=NrTSM~@IyUj7PN?KL8W^UW8f)tK_+w5UjcszA2XzJr6qP?G#3MJCpS~iG zr;+Z8Q^ceAq5yoD`lj-owlwEo`S9@=;OhT*<;C#Xxd`XTTs|3(Stk>0o(XY4WYrQEx=n)o&*nSsu#h*r^#y{n3~q1Xz0x_moX?Yt zao|yFPYJ?-IEQ=@XB-ou{sCbCQ9cs$Msvxe&nq*YI8GsoTfdErB_y-YIohZ26DbTP zI=3b0t}5)io?HSMQ(d+{q0qyOGyCw_U6k!}&@r;4V&3^rR_7J2=e=Z=)I*q9p5FX# z#t#kUX6DB1pJGT0r^sSVF(At*7gIfaeawX?%f{K4KQcI7>oX)5x_xEpH>u~TyaeGy zE)2@n6z-gSUSt0fQCc0LZ?WIjG=7sr36#oC?+5s|KEKNc-loIQ%xEVUULuRuicI^| zvbEn0x#v8{ro^wTUHGU*p@=;Nx>dotu0dEraf={tIaA&Kuqiy)_CWe1cKg`&!x8@( zVHkusevL4vhEfAraFTc<3<`vVtVAyQ;V7>e`>SZl^7dkSbs)}5h$`TuY_|t6v6w-| zlB74VD8kqPjG#aJuo=@^Et&T;@)rDj2(UTTKTjU^=p3dc3#q-}t!UEx&fl(1ROXNI%V@1sfzrX-f9ZI7`;Qb5M#fq?FT%IMW=;oF zoYW@E(j4u(UYQ-^nV$>dAtn%iH$;k;&{~z0j7v8vJ^B0GBfjcC6C1h? zoJ$aZC*!|12< z5!cvNB6i#%+JZ(VMn=Y0Vq^7aRAEn_Xta*zy{y09OMZZ@@sKnB56=&J_WwpY^?yxi zVPO0XNwu(cHgTjAwKi}z5jHWhGd7`!vNqDWo+dZtV{jHF%PZYbi(9*^o&(`Xv?-l&U;W z{X`nB>XuVPI<UWRJO(B@;o%VmEl(blQ_=k&8Yu7hQJ4LZ?!>7NTaPFk3==5<#HTCX5n~!aIGO3 zL7~T}M}>g4q5K6z12Y89Jw}MD#OP;)xlMC0S2pQQ+|`V;+$j#)$_ko|lhFe7J)S31@ijPG zJVlQf%G#hT;3cm*9Aq~Sa8FdjlOIP>>K_dP9b=1o3wbqEs1PK}x2(39;*VY5 zU@!H9zj9wb<8@{s0;BPjP@rA_kB%cxcKi$N_ibo}Tr8K{lab2O*3!tAOQ_sms`8GC zoO9Ew3_V3j)_J`e-*<5#KHaaEr61Z=cs}hf@2Btc*uAybuLAgAeh9YA>W!u!2NxGD z=gcpc`tlaFoQIG7K9%a%^X>Tw{LS)@q2h4TJkl1(7uP??mD7q5LDp|8_`a_#9_|x2 zItSwkk-%msNk~%Jn>X;Ht9QbYT(&zWULfoD8D4`ov~ZahX%m>&@ntx=rBSNwVY@n(~cOqeV=Kg(w^p*`$Z+ z4-QWpHOo)u*L%Ha!HL3(i&(GwWK!M0S}#M@rR)EcCC0`^$HBJEqs41OW~R5QDexZ3 zw=Qp z4oBHqM4p_kMg3{$#iXqB&CS@koIcL0%X^e3d@eGMWR&biQcA{fNnE|C$H-ZbQc$=L z^5xNVwyP)3&Fxi@h1LMML;%${Zv1q>zqAxZ!bC4qg)7DRvn88`XXP}w9YT|=Mc1qLl+ODS_l1NiP72SM z+pAeH*J{6=~FEkhE;usV9Z{Ba`uGRRk-W zoYf33+b*NsR_ucODggO!b+3iYt(KIG$9$CR``VVZ&fQx#`@N`Em#}~ruxX>2-24sT z`bW*ir(BcOj@wH0gjl%NZmjEEcpqW!=BLm4{$G62_~_R$#lILS#_WfLG8>o!v~}}~ zvDKJj%(8#KB;xMJ*q`B}rqa)sGg)uWWl-kDgV`G~*%K`!xw@=WS-poqU-HfXlu#_{Ey4J7-Y)8;o5^pdxpZvr3$kjJ`2WLGT*yhxYjMB1-12K zt&U$98X8`5JnCF-&Z|D&Y3)=+z8MS|tm}Q zhKqldRSu?4c~5>VZJ{seL8EJ7741laO(VQf+lrqYTc_Sk9HFlpqP{g(RhWDfRl6A# zT(l*PlYOgR>m^O}fz|cxwYq0-fa!=N+4iuO{0WXq%Gzu9TV~1&Rn{M#JQV7#UZ^3i z$*t<@Q;ig8o6MoM7&z88>2ba=hnA^BV?zg4XFTGK&BU%;>UKDHcco*I#i<9@if|5V z5Bp>NRaDLS**63u^Wd-hEv8h%+kTx|@%QtLPAz9s$nD8DbElo}`LFN!PiKx?CH}-d z@SpsTP^Amz*67kRp3QH8=O{-tXk}P ze8<$1_*&eC&bnoww{CXG1DlQQH4zIOr>UUEbq%{hmx5}7Ja&gh=pe{@o=+oEhJn&(3OS+CURufb%v1YK!Sn7EDG@q|RH?Vc7Jaa;JN7!%E8GvvV~Dx!&op^5&_n$*x~wP6yhM ziQ6&5G0hZt-fbS)&IxO)Xc}JAa?C2Q*Fh3mBy2kzX{n~er?JA}5HN2ean{Vr9%I1H zOhOQkv6gPvH!g;jycTkcCO3-!L{?sF0 zHqQ&n62~f)ROeKT|580xu#OFdiWLQGve2lR7iZ}@Ywp!T)Y~0psKF0Isw?UZKDb^@ z9$~4R!MC_L&ngMQ^jE^>M4rM&sl`^My%RH(>0i7fiUOjU<_D99soCR{%$r9~2NiGZ zL?QTL(4dWfHhz1AwGDFCuvEY>xs$%MX@vJKSCT|(tX^t`r_W>$toH&AR1xL`lJ|uD zv*el0g344o4mz@_MgU#@98j#6%6OEyf5yYDNpi>YH*NcF5sCuNtzdZLuv*K>@I||h zf^9QqYQ?j=gyF(|B!SbxlhMI??A;p|#q@smpCnPM2-Da0<4Kc7Do62g6E~5y7%K?y z?bh6{#I&Bl7B6a@0kyelCGquHT&q~na()Fxb|xe2^_8oQQb|;kgHk*gmbrA&qiOin z5zmWqq8@COGPvXs>Y=99&)^Z1r<*Xz>c=!ieXW z<%Q3xRWzNCiA=twilY(Q66K$%k7*m^l<3*Z6 z5?Y<5M3R`CL~ZQ6Vupy2=e1_VoJ*lOmo-D}Uqe6FAYHRR=Yz9xc?{uU7!YO1#gOWs zs{Q_?;WLO>evvW(dEn)1kShA)L?i$dk$wP*)IdP|bx!PuM>bn=k-2eRS1A=T4o(ZL zG}qQUhbl*SoA;h;m-yPQfj`XEnr+Xclff$#7Pq&cjBoeNl?r0>?A%6o4NOY22);2p z-@!}uSMvHBl^aLp9-A&tHi=4)ZztKhK8ZK3CUxUn|BUc7eEKqB^v1$pHR-U$;*BEF z`KMw}4N5q)n`rS;Y}*R0JI^!rJ$KrC4n|Jtk9)ygGN79ul8&|!?xe`N*6OUy?Gdre zk|Bvm#2cs|p1XD0E!(WZ$Xw=NK4RwEODbtw-ppq15sRQnFwg@Ns!a=2ng-f`Me_IxJUnU_%VqP;KzH>|OX6 z-@CzOw=MtOW&_@G=~_2(^|qHQ%qo_!4)cH5GE&;K<%A)40RnR8R2S~rNiJ-|t9$Au z_}b}699uv|iYF~3eFA0!wSzXV#M2DV!A-5{R-2)Ud(bGfJg?46{-eQOGX?Gp}~ zCA^%C<7S>-yR0bIP`nn9&S$rjknU&KR7;YQE1aOXyQlMjc`yyu3P&{wx0QY^-Ctqk zcYFl<3X1oZX}GlHyNmJe>Dey#{2Tg{@?=v-slA5x=N6V+tjH*!M~5-rZJH;*uG_~+ zNv(o5tm8WRf|u{H@>BWh9_=sX4?CSv3A=oLx+i=qg>87MaqTRL{WnX@n7;3|sf~U4f#5%z$SI^AS$aX5NM&P){5CmUQA!Lnz~LR{3iE+BqS7Bb zOCMl>mlOy>tICApluXRdr*p^m!~4`cXwN9zht7Lk{rFE)7q8bPbgN)#o0?=gB!Ji0!?y~xnW)yg= zKcBRs+so2jqI2Hg0h&Y*k`_ObhQMVVB=MRC^T}=(qziwvb1Hdy#qbRwE<7ABh0Fk21~2XQL|&CxmYHYOE8W3oQr zdP6X~2m2$Gp7!@t!1@$^R}enN?foJDq;!FuXKZT#^9;O#Pp4V@`?S_CNk#APu)(}tri%{I4w3MdO7YA?n!o2?&F!9`8KQTX7TjrTc;)od8FM{@6-2SF z6$mu%Akdn#*vbz*aXck_@><|3@>85_hPj-L5WF+Gkgyg;&*xm#K7eK z{6XZ_T<1Fwx>NPiGfbN_hVFV!Zlip@TNobsv@nyPSt7K#3TfHMQ8LQnts&!|Aau-xl!nAV@Bi@dve96MoDzFnT6?b+SF?&<7)Sd>No zW$`Os(A;816Rwiuo}iJzf!UYx@c->?w1@M52#EA1}2_vp)H+8&6Ne? zm%;AN&x{-iHYUv~k^!GI#+j`c()8%Hw8vCfAFsUKZ%vZSMo*Qa7M5c*TLqcHOvt~= z%uIGiFo277o@7-zCF<_Z)r5$*Eq%p|#~H^PysqVhMhtY>fPtu=GZY5!VT}||5Ul@4 zNgyn5KKBRavO$~@@REs3g56x@-@cGsnsh-a83-p)S&*<83F=%gpW0m|?WcC2YD4aT zJSai^UaoBMf<4G-Fwc=@U@!(kU8p1)HHb3<=6lvVs$UBa#$w9lO*bzjVZj@}3#iq!5e&e?+b%;-rvle;)ATJG0X-V2G%_IX@jSJ9BPo zqWvjwVu`p_Df#p>^Q}Aso}ccJJAfxkcqrU#rqU@(ZY(m790$?_fG29W2|!l{$^^*Z zWLX^+K{0V148lUZI#}3{$3H+MP3{U@CzuySu&QzdFy+&^L{HYf%c(L(nA#Nv0)Fuk zKL9TtSn=NNY(qQ0u5bWALgYOIf1iJy8v1r*ceQ}jFGJ|td_$pxdR&rHwlgtA&2Nc>G7yLjj8x~~ZK%ZHG2LHy~ zj{0?F4H83dWL=`1!*JFk;$ha#5OFi=3kciRe~sO5iFHNI!t7ubW&v zoBUnutid^_U#B-wYWyD62wt>TN^;R!$oUq%kbesz1diAVF)CK{olE-l=mg4y767M* z&tiBgdpg*B4115(5}nW1GTsu>?S%a`Qgyd?LcE?OUGYzDNLSMXZxr6sY)!bfOT5+z z&tbkLdv1ga`z7_YRCzSxk_p_v*=T*8mnU`TeWh_i=o!F5oN~EVJ(jNuQoB4&mUuRQ zT#KrsI6pwW8({nwpPlKecFl#8{+@}4^>J7aM4ne&uY;y?k}>`?q>{U$NB(jiqyKKo zbbyceOBOOVv+*TW3%x-!+oig68FmjR0(*M16rY~=hjMBmGf>Zvg8U<61lX|) zQJY|9ajpMxcsAkh%Irf2< z6nnbq+Vy*TZRcgvfxJ#+O@|)D^Z=g6Cn+fDH0IbD`yyV{M?T2UB($(*R@S1PN`--y zPYfjwGo4{X&Vi)Peng-M}V8y3cEa}b{m{n_5k^Dm|)U9-#f z1b0D{Pk6S=-}rN-eE$Cj-yI9<{|_7;13lCK!*|ER#>V#F;pnQgClZd>ZMQzCt{vAA zIf#M0{Sc8KfL-19t_G>gE9$uzH=pcHRlGi5hWk+MA`l8QISyn{kqh~EcjJJ_b&3?< z>a`Wi9M2?v?7Z`eatYC=D`EGf(3~Z@7Z+#AQ=4~*&d>>?&fezR3J6mhnQ@iTlS`(} zkE9HBXXm&7JCAJyMnu^L47{uPLkFHcKpH(x$XV>uO%_go2F3 zq+Q=YS6@0yNL8M*O#K(3JJ(2ztZx$`x=g0IuC?ncwGIv5q(axG($%b>SnEP$Ggm~N zR-n+8)W{#nsRYr@qKb)bK1Mmg8k(a5<6@iP&s`cyxI7Svo{95L3IirM9L9Z^~mp!+1sw51r10PKpZRYW7a zS|&>@s}}_nm|1_l5(8keF&q$g+Es^5A{Eti0TyHeuYp1~yrB&;x7FCnP_GoL!+6Cp za2zgdmHTp4`aWTgjDDh!3zBA4-I+oI8Mr<~uq@BgQDNC!>1rmIZ|!|7pJ7P`1lZH! z!dDTkZ#m#fKnTzz%xDkHBnmJ%4+i7Byq*k9ANLFl(n2p6PS@$Je zwK5!VRhrx%rJfvhG^K==RRDR?#66y$*kGwZ24;3jBy%-4`4v}2T)^E1OQ(UQW^mA2 zRJxv`R?3ac%8*~RU!HMWg+D6_5_bBJ{<2q}b?x82Vd2$8W_MgqhpT?j1`TVdIAuG3 zRe#1lfVw)xNt;tt?YK!@c@d4sZd+Xqy&KbPUDHOzOsI@FRqf)eG_kW%nGV-JfT5_U zA!GmLG*#vroglJm(p58kgaJUHf9?OI{Q!#uq39td^fKd`Eq&r5^bL0faSaFwdZBG+ zKoso*GFO3}`vRVWXpg}tAO_ovB0>Pwc5>sRNkOhJfGWa6_MIOS z5;nZ!AX92d2?~vFKE@$zqWp@@@8WvlJm9fkll5H?Dq#bf2od3weLvn0-u7DH;d{J& zzCQua@pwPoUqNVpzF#+1>~`?@_=_G6q14jO=3{))B|Mp|J$l#w3_3ue~iLj>i)0vrJyscw(78 zFYywspR*p=tpg_kLQT~QR!g?LCR6^fo>r&Dpsvh!;9j{+s#jF`bo>C=pW znu7c;QRjDlXb;oCU_Od!wC8!kun#zd9}sEgYD-Bs_zVmAwh;)Tply2Xk|;4PUv0J7F%_ zwsEoC#`grjtOrgaaB|=GOwQgf107;Ef;Sz+SR&Ttx}DsT@;B4yL}5);;V=rm?Df*s9$swMZrPjg6?H5U@ZP(CsOEaCVh0?Az3m^H&;Fn}{1 z?*3Xn2y-U_Nmy0cP42ImoDEb?dSoo#NNDi82`C~!8a@g@u#`L{LKhJt?g&$^^fq2{s}doh7LR6oWH#vpE7BCEXGgzSP4Z#w;C8 z1hS-&T9rE+6uZWqo2KFs6j(!bZRU!GCRb?7*oF~eX@quFO@fP#tyC7eG?<V%~}0#IPes>(Bjc3in75!BZT;iuH=; zp8K>#DomCb*1F=u_>>HMcv>bN5=6~WKQ{1=owntKzHI(nsa4?g-X-!so=xt!HP-vz z&|RCuJ>l&2Q=I8;9b}y2aEt;^?(8joNB0a|I2rRLs7n-CUGsY4by9lKr?{0Ej`S{+ z?hiviPlv_7wqvZdICx{fDs~8~Z94;$Ap2cNnYD)p7p}V#{jxd2xu%s)j*c$&8?M`0 z)ifnHYv){U-_C<#pi;JTNZ!KlPKE+YI6n-5{qAJ;3C;eTHmM8U|PW4x_;}6?;N=c43sUi9uq=e1K`b-^DEHS8YVL*PO{Th&*)Q-v7f(E z?nWi<}qmZ}F0#x{m$gK<$J%zvFYynYEsICEz>$)v(4ZB^8G3jYem_Yp;as3th_ z840nn(+q!A8b)-KJVb0M2v1%wqcIJbHLbwGEjE-!^1TO4%$IyfD9}vNt?#FsoGrwd z<#k49M?Mn87UT_J)%U zeLzOnT|72cxFyvG@&f^4sgf~$wMx77+w*G#1~s_4@8w{>!#!Wdl=gE5nE#_sJ#b?@ z59!g%hcp6@<4CB~8NQQSNkSL{(I5TIp ztWIHn92v*(w%y2NY1}pVX z?X#`Ju=(gXX3Y^BuDrB_em$|v-RH_+av5N5TzZHw73~;2M;~gH3n5uFzj}gbG%qUQ zOr!|2q`|f|zLsE#7Y(Tq4P827sE*1K{;SWUhZn`7{`LT?*S{l$NYJ+^fp;&)X%%@T z0!I5G2ZpSDU8%^xJk~ciP3zOerW zg~|b{kTT_LP+vx@91e^~(eV0`MNRbt8d{WdV#g)3W|royd3~0nt$u#CI*oQRp zu=4Nyd9YT@D=tQ!6b?*E#3$Jxy_AlT8u9A>c=TlojwF!dpokcg4tLDMhj9n5h4P`5 zV!5ttY<$62H(Oov^XqNE&DgPrmxtHe)BE-LH*+VOSMwbmu!QieK-J^@DN^_S^Y#Ar zXvECx&(m4YU+!-G!S;i!(_yKpc$=M^zurNLQ9oA$6E}30`>{D}HN>`V17G?o9isN_ z5cg=KOq?XArKb=Fb+{>`8e$voOVQFkiyRB6aY_U&aNTBrCT4(i;AjZmxHZ}`xVJ2z zrF$6lB>=2o*%H@^R%R>7wLU0ZzlG;$t~HXwYqI2I&(`=HMSt2a0BAPe%B3B;eT4f2 z7}`1;z!8VX6^dZS)DgggRmE|o{#=?Ww3zU`Ks=q(4-mX`kHh%{faTw_OLwH^UGoxg zIa&ivZ&jKNpslL_fEMU1_06&JR;^2C#k|E<9Tz<0j)~QlMK!qWfrQ%(;5F*)F~AE{ z&4bQn1v~P39;6=|cq`lQ1YPMifVWfD9njtn&0}+5>-t*1cle~@Q~g#YhBN}9YubTu4Q*RZQ*{Z7y!Ej0_%lw$RQk?Z z0dN>wK&zLgbJzPRI67zKM+6%vT7KBN(APA*Q_|4-9j=XTP7$ouxO}sx2Sru9y6fjx zI_ZOj$)Z5grW!FI z3Jug^nzII?I~zoTlN3&a!oa4d!(K&X~-wyK}~-zN)wKreiGw_KbeQq-I3&66U>Y^=W) zgW;Fb(Q0C+#amA^(2TU3VxR?SKT%6l`kzH6xh+smP#HYrp1iY<@ha4@o_jHcMw@=z z54RJ>(qxQev}(~fI(!hP27VzDs~8}(0p$i-#?lm(o>fEoVpqP6f(+(?#Wy4ok-xNN z*pQwAK%Q@9<-f-@7kte*CSlQUJ0|6B8c9*C>kPBue-upm)1X=a9?%q-1KOr2f*j## zozISUtTo8sp0DO#fCQQipVHKqgmcSvNj1#Fq&k5Y!n2ptj5V71fAFmdSJSJ&tN&H0pcWm` zUgEtt>I3M@Nda(OM_NGYkN7Zvf@=A{;+=N4o7ZU!k?kxru5Ws^Vhz5?T7615@Trrm zf+^kR$^fX`=E5#XLP<8--hb-Wr)j966+hWj=Lf3$vYe_{oIe17o*| z!E!-)8zH$qG;f{|W=J2xND(%Ko{aoZ(ML$yavO6YCRzY9%@PB7(WWefp^w6$+(0^G z?JXp&u`A1QGRxF8gbfwNtt`Yn!li4kmE%MO+-Pmlp~vE&+Ere~SSb@4cRRH*;h3kD%lAF}81@XX3Ke*qZVFAw@^mh-x0 zeIgME$-XcMJym)l0c_tJtr3Yrj3W_jzkgebJd}F}n05?#I@0zq{1;CBD)R*C-YDW^ z_*^6-yxZc#T&e>(jZX+3phZ=o{|MGR!;Eu~c4AkL5s0E2v^9G?jdwb_SQUK_qJ3+c zqBcCSH|F29gg@-B2?=V#E(4~)#?W+8=o`_ZTPle_GJT43wDq?h~*&rrjW=EIGq-lZr z8Q&lvCJu@HC_Y1SyS@{)y7hcu-S9HS@e&-R{W8njBV*UPhrq%)lWAB{=g3D^7qytr zX|YDH%53Y(!bG>-`4;{{3D@}`A1{k7Hm@=Z z7ueJZa0p&uV1Fi<*j&}xg=uBh3NRZ3f!oV?ki?iv#PnITn2*w8!Op4UH&+@FthR@p z=r9+>2bho6MLGt`y9N!nF^nyX00t>xg)okXKf=euU$Ud1bKZO#`ti4ubDaxBq*_3e*4V*PEG%jrD*0dTWl^5_4p9zbKum z z6kJkzd|#+)j)`iXjpEvCaV^UF69Ozwz;)n|5mmWAZa%f3ue!>ny_PJ|Pu!ZUl942&sc{vCNSFmI_1g_5 zgf}K{IG%brZV}Hhl*|ODY;B@CEd*Lwn~LMyI9}N~7eUo=Kdq`gl>DM!ST$@h9~8(a z0IaT6pwppQqa+&f;WxOCljt~rsd)dzA2=8xo` zJdiU+CW-$@$x&dw3PpthLlvwN0E|;8iT5*rSL&WiQJ&n{8m$bZEMErHvKt0Ss1)XJ z-y8kt0-8d>c`JU1NNf%IQ>hprff5y*{G{IJOaXeX>aVQQ7Xh%SJ#UNJIFNu1NmMSW z(#WDfWx{O`Uc760L>VT3COM0t48aJ5pz1YI1VB>9v{(+arKb=oSy>c#si=TUMSVt1 zJ+|5mC}_y4s5?|tP|vBTd*YXebmWq6TL`23h&t9uUMW5qI!ZbRBnYh_*9ag+r4;V~ zkxxb{gn*C&Fo!@BZwsT`Aeq3G0T3i3O_pVR1{y6`EX*#ZeO&F95N-Kdx5nN^$4ITt8bbpM%#a|%&tmO~8g@Jmy8#QJ{sJ>fz%?;9-hqHv36a3v6mqHzs1k4{ z(Ls3F4-+*a%*jM}8^eMrp3Q<%PLH5hgM*oZq&>C0zhf~CtrrP1LPw){?RxM8Nx@(0 zt`6yCVT4nWiiVfV||Kd zvxg|38;|QVDHvIV+#=7I3KAXQjz%YgZ8>9DA));-3Zw5%l$d^n8vctogdQ!F6fw0m ziloYb5DyjwK1akjhsp!?7M`;1u9{Ds>TkXX27h8OzDoHId95XZo$q+6*0u-?NM+c3pk?8!`L}G)BbmEsS5&_{DAdd7S-C(~!E*w~# z&C;S~Gg@|$$l6%Rct)OVE;xi*21&vka3FW6I`MjZ(|D^fIe9fc8++{(BU+WBPIRcK zQ5cOOO<)$HqJli-U|#YR>G#Ex;9x;{7fh{Ck&MDW(G0^pP}E3_hHaI;$_U-txtO+D z6+Ha+>!Rjop_4WB!LCQUS?~FY>@3vR1mE}P>2FJoi!a%`O2yBG+hibl($y-s0vK1% z&z0R@in9)XU+U8ia0S|eV|?LY>p$FKuWPc0F&c*$U$7%TwsmP_!kfFvz;p&7is}Pn7`*q@p}7*eb?5M*jeH`nM?1oIHv%lnO7`J} z;E5>IK&^QX_Vis@%v zM-KLGK@$#szy4Tn#nWd~myV9a!y3=6ZOXTtI>V&2AxP*@|6y~yc8l$V6#z_N1~}%% zzC1jQ9qMb&Ol6VU-D$XHcY3SapGqrg+0S-0bF~Cug*v=T-qfdB?&j%9II&Ou zunSC{#cv%EC3Hl|E*4N3KDVXce0lt4?3tr$eZD_EpN6EJj;4Kw!L`rY_Y33-Zt6{% zG{){J&w~WHX*=uNy8|ajZlfi&xSM60I>D6fG#U2dcE zBFxEG?jq1)pH=MFr{+QWgOXWazwamz{(rH~zzc9DnwvdbOXy>+TBF1w z#uMAl7Gi}G8C&G-{OWiao~W1aXA$u>U#mFTF(oV0@ulq}Uv*U-@b`_g{Tp2W0GGkf z+(uz9-_jZxiQvpVq_0XuLRg(1Ixk#}J!@V@TG%LdDi=O7!=G3W?5y7?C~_llsSQ$+ zb#JQma;!6DuE_5QS~k&^rX;=9^gS9+YyW0r9>N+;v%ra_M}003^<__iLX90f*IMZu zuKcYXjdHr6*2QaoIvWg0_B!lH6G~>r7)@%9i!OP$x6KB?E(cs@ToAwn-mT8IfX##d zx>=Fgj_Ij;{R#u^Ai8`{xRB{Nb?g7yc$71!(dI*bfnH$?q~|03D9XQ&rzT?Pq?t|` zL^aDXBWQSi_jR4koe_*B$m-omf%_$vea$pp^!{IromEg>QL}Dw2<{RfKyY_=3GVKY z;BLWXLvVL@cX!*ky99T4Htw67w|h?2f6uw^^I=uZT2)`q?jGYRn_F2WM{nz-n+LV) z$aR^5Vsck=)lA*)7pL?It{C^@4aw4HO-~k6m+p`s4-?P6EpP^2@pAFDepSqTN~YP9 z$dLPS#G*Y05rOGfseUM-{?zeM4!>mTk>~HeKp*S4fmi|vx0Yuon64p4IQT(XnbNvG5b zF4~6-Z9_~MH}CSp-5&)GtwXK{t~EW-dv(4JIgoxo{MRbZXxnk`?J`l0+J=NDpf|AP z9<;Y>i0kgVV4)!(Bz zhw5(bL=<`3XnS@{=o7lOcz*y|4-?5~%<2~K2H{`0R(AbVMf0XZ=q+qKZJ+T-4mMQj z4pGj_`+BvvkrQ}v9A&%XQmnIL+q! zcs@uG6&|gH=ZlM_oYS0wOSPctuJcDVQmfNxnb@O3z>~+2va=`~f3n1AwM~p=pZ$2k zjY(l=W~&`>v-DZdnVIYW%T2gPF!k`Kv7@sYnAW~shD#%*52=?^^wTptXq&bUM4@Y20(Z{tIV(R5nRq>#wr$KQe7di0v?h*3 z{gP)fKC+y9@9#=b6D76d(glJB8g}(61_;bFfenXl9~|tX#NN>+7~7YPM-Ps7HP0&o zm?fPv+MARjX{m~SzyEpCW$EqKl_Z4q=Y(t~TNZWy;%RQCu01B|y=68L^ogar;CWdCR}syWUYWWIK4QAW-Eu)hbJH^ebK{(5Uk!LDc6hFCAJ@P4i@i8Kg*SAns6 zV^$&gf;75H6McDpTjNI`UlNPZ(^dLF@(^tDtq*l%IrGaqdl6~ODJ(ZPUw$ztvRB*S zi;cH-r+{b9nV{x1Phza}TluR&(_|T`uw+)f!rn72J1~Wm<8zu*KIKZdHE> z1LdNnkSYZ3k?gl);j&e5;fw?-QCY4b1foGFo9S!8f?t&_;B<{?W2UE;S-Nlg$xY3? zhs9ST>*L4;=(h{F3|s`*vG_A%EnoJIY|lT$hW9-T-i=5=YSnaySE*khHM04Z+Y7^D zytiJ3iu8a#w?FHhEsv~ly0(np1@xcZwm)w(9faNgxkxn#Pgb*2pP6=Az75~8@IJ{n zD1Ym8*%TTuKbBmNUY>ZKZb$CvOgK26vwNoj@XKt?N|h2GESL8x*$2K2dMW zo$Hg8^M+V%lXAnUD)naOW8u(cl(pb(@*D0la{%w&rCm1Pd;F8$bD7 zzQ*GcD!k#a=xpy*$?X+pXb~}gQV|{NexjF}TJs0^Fv{c$PqNBBP7-;7_MW_946rEO z-4}=m?GVouenXfz9?tu1ac>g8*-K)hM^k|&+cVYBQ&$_A4#=k0#nVkhnYe$@*6q-f zcf;Qwt~6V(uXQzg^%IWzbo4jcL#7{!Ex!x+H&A&=eJ2{C1<@XMZsq^(bd%ovA=1mzo)p z^62>Ke-#N->+^9+_Yv714f#_5BD8V783z(5^G=l+#_RM&8}xWTbdl9I?%e0o2$a1g z>)Efvg(nZEk0b|^MPK+L|1f}jaiXI+TN>p1v7P~AG51jYsIy5k)JmiSe`63ZQ~o{E z3-OxfJ#otPhqF^rw9aWAdmnpDlwxt`E4A2+C&cFxI{u(tp z-?FmxL4k)Ai$CbX1`Z5EAHU<0} z1E;IFF8lUJt0+bjkLl6ci_MmU!0BNsywcNM6sA|dbfJ+P{$dTv<~ft)DDxvRto~c| zfB2`8g!XbeQ-f{nBQ-Aj{_b*=vzI8pRh_#Fx@!*GXeLHHDU18;cm)&F@QF!IDNWzw zes;`O_B+XOB9juo=C;Y8!wNH%ria@f@mlS3jE5|hh0`HJ4aIf)u>)NTYLB{=3bPYG zM$!bVC&ESdnb>fP+pB)8oE&z>1n7-aD4Q369 zw1^`;&CrE13W_vdio6!$EJjloN_xiH8}hf?%YCtYBWmYurE&+Dvt0OINUmSZMjokp5ROp*njai@VeFDhWkM`QD)o#jXvDk1 z6PlCx|Kah4gOmIJ(hC1yk1wpeT>sPK3mYr&T^0P$O@=VS7R$zd|m9#vcW? zjdR?AJ>(}jvUFob7F>2zq5xWoE zd60O#Q4Gg0+Ewbrd*tbeDnJz^oQaL+Dy{;IH~UnR9&tqRDy;#hgkwAu6u#80bfdAMiU#+Z#AD^vQt%67Ev zCvlxPmblVggf?wqSs73a+F69DGnI`=*|w5W)-j8YAIOg^rDo?C4ft z3~t9qeC#|*njK=E&?xD^2^y-D#vu_kk7c_3lEpkfQWT|V%Q=MHD#?)bjC!FcYDrFn zR$qS})>ttzYuvI=6wC@JOs2m5+t*jvx{HGgGJ8GenU`7!qX$hLS7d^SV-|U zpo@~R(ts3S;{qJ$qJ;K#zgFquU&>CPJe+f};p(=tn#33KG-Jg2wWX@u2)xXqITJI{ z;so51LSV09NLnGV2}nr?j&x(H4|z6-LRz`@{_JZ_kuuHGP?HT@h5$oHkyfLvml-XK zM!Ng1z>SIoqjAt%%8|5~W&PeziL+9`pDuS^6qxJ!@O%o0NH;g$7G8ze2)@AR( z2!%<52AQkJON+*VB|%doBt4%m%iDFVDsyo#o#2n_wCkgR8a+WxBaOO(e*vf>xcx2x7R|Y5ABzL_pVTGrl--f zAc^;%pL@c29^=d}7niATMCCp2Ccq7EIdH-C;W&v$g0AP1QUz73#RtUM*g3mk9>?m0 zkd>TIb+N~3?Tc3|8U5jHm9Tkj(1l-8?5%V~Dfq)W_bABiQJUlj^^2|Q^%KY=;jxM& zWBqr}Fq+G5QO^@4Ku__5vL~O_;3~4HV-9V>na<+fY%F#wvBl!W((eoCnOw-L8BNf0 z9PQLB9H7vheXsRd=vqqG`EG;d7jy(`#PI-T*tW?%b4W%L$pr0QeS6r=^gd|Kee$aY z?ARuxero#I`j4c(%-QPY=++#G=9^xoe+#^!0Hy$gYw5f_-YdGG3x|h3)=EHHs{_=f z!E#;)TrZ_-hCL@QCGRu06^2hBVl!H!-WeH^hvSEy_T>wtcT#ZaGo{byRb$8I^3{^k z?b^Dg*MymaZ?|r2x4pGu_2^cIYU;_V`i3T+qph8F4Vj!%UaQ?dh1MW#TZ=JCe{z+; zf(fC##d*c@{1616=rJNAzIVc-0;oc1_B&FOER2xefYYZK$&D$mfjuA(#MYyC#7+tTAYJpeGD6GGU!rZH(zXmPk+GYxTFW}uMXNFreDY>tea@$)ofFW>JQlif>7>_@>swsxMrCC9>NTXV z;vn}_$OX!6tnHq{ai872{juK`A`D^6$mN3czCiW)!N&3PDxx9t+-Hq`YtLl_Fcic6 zS@lS89O1RT42bz0nDyvfJTNk?`3i9V|m=WS#)51CSNaYJd`&rr%N@AFrZ8N#iuX|muZfj2av9qt5A2h-pWNNll`n}s7U_A27W&r_}m8s4ao7)%s zE3E~BcX)~A)LXkTN^g@L4zQ2W4FlEsszOel<#IpNcr(8O0=rh2%k;J{yf?J=bb#c~ zzxctd@b2x)npCgJJ%fZy7VA{Y(VyKjV7&w_@AS33DWQP)lMM^amp!g%(~f&Vi}!PO z`+#3pdVY9-n<)|f*(aX`t=%4WfY!_2iq<*P=ka^TD*POt??4ZSf^&h~OF{kSyRpB; z*^J3tv6J6!ZwvM)|3`#5w$J#RvWX4?WHZtzraGR}diP}CeUg>wzreMg~ z9ei-tr|4yf(2V$J2dl;k0BU7?o8|f76h4p=QZ6^;PqN`lpxMP$yrioOvscVi14GmG zZmU`TQ%>pj`EP^t+Y2GEQp}VjKBYr-vCYnjqv_bqqtHZRxd zSq}Gy{j*%UAF5&HvP$=5`i4zrgg1`Ty|7kGvxi2@g@Rng2LT}>-jYk{S&M$})?haOztU;9nJKhP|R?brTe&iVhqqW!NqhyB0j9BsJ<`f`lyCpv3b{9Ab2 zLa7%1uE3a_2e2=y7Or$&!uHM?W-`SK|4Tr@FD;<#%%y6(Y?Dv0L9r~*OaDi+(T}gV zS9vkn&+{Wo&R^OhmwduqT>i@Gl8-rl<#H+Phznv?Xa`Lo&RA<}AEtWgT}l=T+%RZ~PzQu)soQe-ls{u3Rw35VJXGv%=+~_EQL+@vP?sA;YpM?v z>=MCt%Rz?Y@~>2yKpyr6&$Pn??|O6T4p+C|z>HL2^NE4f@|Yh*we$N+Ru~rBZsqd{ z#XV?#4|8`gqWx5)-Y-oMhn~0PY35dS@|P)gTCt5$qjP1gSlX@Jqkzf25~%1e*{i-? zufzLk6&#`FZ5NB4dcqN~)+#TmDgAfk2E`sKpn@!+n0BUc6gMak?k5Y6$jQBD;j|ze z{Pa1f0zW2IU}I}HizpCUXvWvES0R{bZaVEP?x%Ki9lDyB1wAQ+7&YG>UH>RYKxR@4 zZxbGIi%Q5m*CDNV8?7Sie*T7qurgF1d{u68uaO>JQ{t)DQEcNHZ_& zmM_!~B=Vw-4oD72W=)CM_$7o5{XGtDa@!b=O*tr57M;{F%^EJ0Y@=e*Jv382{pP5M z?U?Y^Kq16Ll=CPOvc+27JMfFNRX z`j8*Mny*S%=4+TpvQkC|qrQQnlTkSd*|g7;lSPP|nd0DRQsr4J&sMb$0xO5Ta0=N1 z#p6;9ZFdNo39z&N^zZk>m^edyy}*n+QVsQ6fyXx?={lE{hihpY9u@F08SS0ZxgQfH zkd%jmX@7`kUpcmwzzOZoOkYv1dL3oEh*bH5{w+2@##$JWJlc(mV~}x0X@$YkjCd$I zqb0XZ^xyX0xj#gNrCC(nSH@V_A^vmI;PNf0?4U34;W8{HKjbl?;?o~PSR{XDn?j-_ zd0y?e#yj--vVeGMjZVlWl`SKfSnDvf>kq!h5i_6x5VEpsw?A)Y03U>I)L~_tSP*y1 z+W_!O?lxG2Gwq&q(?$Vw5~%pxJ+Gk)wGaq)2IrCcV(C8?J?Xuac^KVSULU*5UDD=u ze=7Xjwzqz~^ZESVvpN5x*|m_^XSQ$8Mw|IF~SgMnz4MnS*ZgY z1-Kgx^&BOBZuwdwIJ}>Hp*?5;1YGmcJgYXs?JEAH;?pO)-) zL?>i%bNiMlRyS{?N8#f?E)*UxWlF5bLPskALPQ$E$!W(u-dnPnIW}NFftyqJl1R$T znoGScvg@hR=clgLxckMJzb^`JB0J;94f$ak@-})-A7S!x*11C_h>A?PhbGR7&09B5 z-W`j-3x&?4Bg%o@@FUbm?&gzHW2NV=cf@gld|q_r!gYb?kpRhRb%hh}nT&?J<-`b!ciF9Lf@~N8<$SOOXmAhg z@~3|P@QDheJxC*<{%EN}Id7y|+TwbUyQOaNB=JyF8pqs9HFviSd1_3t3*Y`t+urcE ztCt4XDQY^_D{L##HxqlSf$ty%Xfk5ewRwR0?9$2mSK6qI?#nZi2L$|^Y-1(@L*K+tOXJ0LS`!Y~bsPiFKkoi+%-*F07Sj)B$+H<~MFxu1XF_ zZ_*f^?LF5=sdW#&#&Uv(KgNa5nY(_@cuqW8IlFF~=a}GUpR5#q@}WwudQo|eb2te1 zpl{sye6TUux0`7s4A(OVGmQberifxa;1UsUBzYUH$ zd7Y7Lp$>q%5HIcIek?or09L%Sc^-h&B+nWt&)4tcPsLWbcCq+n-xfak{cPE;`@3uU zR*@Wb`0~7n5WX?vcL2{{z#hesx37nDE7hC8%ga}}sixZ=o8(^kZBEWCqL4R2*rJ60H=4m6fwbS4o0QtAfs`)?Wm;a9;ng2Dv zaI^f^A(>=tnG^_X7>_Mu+XPYJ>+ozX~=QEMw z@HPe1A3AFjWY*W!6GVngP2KLUz?)q-7UIV3CtHUR#golci3?Y#2< z6llhNon6oOxFkMX^5F;$o4>Rq(;u7zK^Hmy4hYk|JlT@|bLwk5T+47TJCu7dY!IX2 zqT1Jn{G|R)tBkB(qubXyDLjDB%pBP})JD)!DP}bF+h&M_Q`XYTCfFKmt=@`{3dfng02)W8lZae8U?<1b>%VM>ycL}>#; z5DVG3eK1av&3CpS{C%>%vabb{ePxg9Ni05NPKYg8Dp%Ve32^Luk zb$TNDY!$nvLU@HA44mv0B{=kw&AbgX?1a1gRgyyA4Vsac`}XlQ@pDSzPkU zfeDzyG>w>*el!cJO=N`Wsb*Pbzi?DmT1P?X+jZz=3NUpT+Ewuwha1mmQ2{}gi&V?<^@sIb? z7X4KT-C-f2>?*MFD71rM*5v!Q)&I4*_5^t=N)gyZ)D#n=n}Ft!zhwn+xVI5eKZizt=LwpstB`*Gt*)|yi+K4-`s?oI ztq1&(``JH?T{wTY{rUNNH}m=N7@9ZXJ8yIKB?@>FbamRLJOAXlIkQiq{#k%^^VpaiO~99yiDQ1$95kt%)chn6Q}NTyNpF_sn7yyB{_?wB_lKV+|8W< zr$T*>C6N#ss7>BITmbS+ZqO{Mb5~<^bCs*X;ef0Mq*J+f?FXgTzX=CZB+1vS!e#?# zhe}V+yaJTejB4-c-=@@ZKnWIi-RrRLjaw6F^rx4;n*CUO0|`B=TD($9a(WH>e{uqV z1l=@x_b%fOFZFX8HVyDECy0@r{N4D|%d`L&CDOO+A(LOy;76hJ{V{Jr>Qrw&xX7V* zdT`Dfw6}3B@YEKk^hBf^43}!R!hNT{y|=lRLa03RZPCSGv1b+y--k`OiMe^?apOAW zmlL2<#OM<3-KFYe{lt*7*=xp#GGX%WLw@8U(K;L4S_v8ve62eFqllVD{Zdjc45EI2 ztx^E48c_sq?32@3Uw=43K3kl+3zLi}rx*Ow`2H=vH|lL1SLJhM++=>)5pFye6PnB& z>s;nS{$Ads^ZEu?EA85XyBz^-bH3=XKLcVM5rOCxN}*>jT~#y7PdoE^7@+vwOc~EU?ls}IW`B-#J`ldO^xJ4jk&*@w$=Od#*lOW4rANsR+y<#&P8MO zUCktWDnqcOR-Z%oxpkYHWG$_)4R%0ig-%%*#JVX$;|uIKPO zYFMrFLo;;D5%;N^4<`y0Emd>irgU$pPxZXpV`K+EHE>{AKWBNVneVuv#l9ZPdp>9O z%$b+lXG%jl`^j@=dy+Hr8pmZj(Vb$Qjr(#dUON~0QEu1b%sAp@H+#8~Id%MF{&*>s z8uIfaxKg!>M}A>9Z(MhWRkmM$eHc>k;ro(P%`7|LF|4E2GaoeG|Mh;+U3c~aG&t!aS)99h+HdlIs?K(t`P%F>`^_8V zd>FNIlhJno3GAxLJ?wlf75c}Vk9z!`4q8!;K-)wpk88EnQ|;i+vD079Z)rqs5Ak(! zuUAL8d=8Bce4k4h${QA*9X!lvcKnW3H-0*L0Gakb<(tr`weGk*G272`%yOCUJ<%S;Vp+njLQKZ1RK?i z`$t3kw8MvKN-~~_u{m71drUd)ce*a76ILTU+w0vv;xoR&upcN)wD$G?Dc*4X7irf2 zyA8$7@;{I-*jd^C8~LJJXCmTo6yqQHqNxc*(@gRJD+6x7ZwsG&rLj)XV@}N%2`#=e)66 zOW;E~J!laA7%L~q+ZFx##TZToL#+?lx?TG+FDDWj?#p>pNuLhGQXKqooi=u0nr942 zSMvttzaoAmSd@YK99^E50NS>f*At z;ACPpK?CR@3=(BADO4VM0sx0ACf+vME764&Woa@A3Ji{K39D;Tg<)#sSV)%AbL-6( z6Hn|j%r6dqtzcxUld!U3(=O%Ej2y4S?GUX|dkyJxtiwBJxfKwx3=19d2;KM1i<)#7 z@LyWZ+vw{Kh*TR+fWR8;wIv)<`PvjQ#1-nwnyiNJ1UCzT$JK}boFG+FXDg}NQ$=-ubd}WDBj1U^d*Y! z5e1V#BbBE>+B{4`_X;ycHi|AbRbql&ASNmAFl(x02V&$H>Q`8j`~+pNC<-HYSbGMh z22pWH3O$2rV4ks*m^tfAR9_Veax9LyUO43zMv!(Y>#q>LK2P*XV(n0?E9I!J{n4K= zyZEBe7FfiQ#M6m5#z5RVlwUy-B|kurEh*Y!^dymJEQlq~{^Z5_)+BN2Vw@bf+B`8y z?_wX{*>I0Vp{cO$xegG-gj`_OgAM|MOn1ge+gFb2xc8MO{J-l(l=wMHjvB8VA=|m6 z7pm_Rk`k|(8{?jojymEOH$Zz2r4SS0oQQIYl#TXESGNbw(vn@XN!45az%`NWn8aX^ zl7(Z_yWuhQDCvgB;Z>RtJe}V6sLL7(`?v9eX3S-I7@tbYw#$EkLVNE!prw|j6V?rcO6H5G@w{-ZT z2_MF_4>vLPVR0T0DS-jK7O5l`S)|b$pBJUAXUQY?RCBi3vtpO3`8C zXZPp8lU+*C_+zmbCn_dG#K&c74x3JXutK3^e=xGbjEf)@v<80wmO5@vU#n5Z-(LU zZm(MvRc9--b@3NTMbh6l$GwE!F!4I$T48NQPZ;WU;-8<*uao4#EUFUB^*;@03d9Sg5pi^t@8vD-1 z=i-}?BE$?QSmz--uR6ab*OY7oA^xpb}V39<*% zyr=fR_}$YMuHAjm$P^k)qqVO(xBv{_%OZVsVnBMk{2|@%alqI06>uid|m5)sKx7yXlof^yyz_44 zW^OS>2@&mGTLOT+p+QLlqC!e+Lviu-%!qGWF+-ey=5=5)8=B05zDkPDf&$-{xbNT<2yu ztDzCv6SiC2Izb$-yYrgG*L^-Mg{RLJHb(1fyIkCBE^d9*9c;B`%s<>}Rxjljc=PVc zR+Oe--?+}QZH1(>HF+X7@%PA@m1ZT(Qe6%QkE3s2bzf-gD&G~X(p0H6?TluHIGf%m zjnlJc^ppqI-0Y@>3#d|!ta5iW?H}rzJ!1<89}vLibLrU)js7aZdlTv-Xwmxef}P=<=zz|rxU{mQtI1i{7~_s1moXhQwmWZMdUb65>*cO1Y!7t6^Z*%p5P)&PD4l`3ufdOaU4&lvf6 z00sTPHw!a8#2*e@J%H!O0p`|R;q4yMg^->N@ZAd-_ElM>w9?rLSN^95#=L=t%97Up zh*flr?A8eJ;a#`N)nQAQY`}jkvk$^z@M1YY40R7mkVW z&}#0Ji)IVa|4p$XsIoMJ~ij$Wi67L0inBYK>xlFs$D%LFhs5lr%U zC#a`ClhRgC`9$_+?Msiq{PMu_aW)6cAcDA%4%L?tOw)^TqoB#}uZK`R?*P zo&_19nPSXbs}IKN8~u|pMJLq1Ue%0kGxSf!RV5bjL^>QpUS~<>Z})>h0tcsY-}ZIq zqWw)cRxT|8)&<-Albo8G((~Y_V?_0aj!5xLYf?p_G=Co7+id?b6!c??)y2}cZC1rF zo9~YboAu28ricGbX3hf_H$ki2ib8YAII=KA+eQdU@hoDDk!~&%r6iWEA1T})#81yag$lvqo%@{rQ*E)&hNNa z2Nc&z`=a!8RcI3xJOAbEPO3b^_HxPxo>XNoVzd7ADhbn83v!_OWq!kmJ@4t7J63(= zj2GDx0y>+$c6L+SZD`lDciXkAaeL8j-}3|XAowcO9xTN7vukqWu&v)^PW!a#B0fY- zjzDw#^{oMJF8BRbpUJG0PKi7}9BF|t@~uek2?K2=sQbCY3SR2P5Qds?cSX7Wx!@#2QnPJ>V&eT(=1LxTx|6MLDt+;x@^2p&8ug%7oif2FaS;g+ycoX3@G0|d9 ziA|x7!l`64`c-2y%;>8YTzjtl08VP(9NUSVUYy+om0$dHM_xHWf1c9gk{T6QKm zlipMDIJHPTRUuogZ1r}(StgU?15hyjpkMz&6nFO-S8cn_OHx?(EB_-`rT?b5^PS&G zW1&is$*_aATG&XP=DOn3oGh&W`>-4vD+k;EP^ED3aQwF> z@}_}7ECaV1@L1~^Gj6BJz-=|9K)P1M5mKzy&>8P=&(t0FhuD{KUQy6BEx@%?pkh?Af;y>1*YdERnp9c5jYZ7-S2o9yrw*#TtqUz>R4{b*=uq7(XrzyF0%?DPb;SuUde}jW3fbbTWponzttZo+PP8ha!rmme=1K zA{ptkKp8Em8)byV{al7U|0ig$Ie$(XdRMJz4x(@pIUbd(0>z30H0K; zIw`37v7~qBW$|)F3RidVf6El=AO(;$cw2qo3K!22=?EI|eVq!3&V_qho|89dYhp8; zx13&Ofzc_s&x|!HoD-1f=KVUAS;oDm;e|(e8fJJ+eiu-pAQ_0f)B+ha_vfUQ)U2Z@ z)PZZwgJo$d-Gh1aM+=5SUQZ(i%z6@E3@!p0d01}8PKgRd4p1aEPwH1MOfeLkaU8e7 zkkV;r|A}6JmYGcVJ#BP}&n!Az8H9|GTP z7YWX0QQA-8-;ps6RE)l`sx+Z!VC4Y%Pa55^`ifTp%=IUXkWOKf<-tn9cQ0fJ(vZD*Ce1n>Qr>@f9LDNB+)3|zOg9R@#8r$ z$Ltr3{on?zy&8S*bP3*jVIv_W?N3dTAD@%y2}~ z&E60$A6ZgJQ}Y{D%$jkCivxJbUxi$!@NwKQk1N;FLrWi?m$P%(J^j@Aw zGQp6tFS1flgc;d?+({u3@`5dK2IDrNsL08X(LwNA2qFjrP+?@eLSs}ysrp1&$Xfw0 zq&uX#*x_MEG6c+42o0$oGSK`ao8d)2fao88>R@~ZF)7-h9Og^!^`ZWNXj$-FeB zc86mgaLkRg+!@Fg@@Km#8@t|j>8F%vq*%53frjv`pp~+5mgykm`?Rq9+2wQR=ILEH zhBSI*g-PDJhJ7PS)s8`G-`C2(8q&vXIPai$#hAPBbfXHC`jiLy$;`}>N#tM0vCm#R z2!DhRgP)W>-zVJv5g0~#z_;tMMoi2`fY-z0o)7QAo|ngUrO*3?S|cEwDJ%BJ`{6>5 zpCaJpd0F`Vc74WZXgggA0DeC|JpN}oL;SosHe&u%0AP%U^nfpKg^kn>Bmll|mqyJS zaA&Re4#%=o_RtTSQ#_-e7N|A*jo7KZKkO%`d2fit8y>{0zHGT*CMJJ8_`yM+|9o2 zMF0l!FMJs$d*G?;=?|siL(i9eYOSLX_&5e`s(cyJKWo%mFW40S!X=q?%6XZJ45>#V zbrGvt(w3nA>U_4{D#big*2Rj<(w+(%s@GwGlHR~eg^S5e&#|J|+scMqHX+sV)QyJDMddsWQn`awHyTN~%dvg78y*%x>qxsg7q$HT#aGPu{Ezbv;wr*^W8+)s@#Ya~ z2UKN2Jd|b&9DSQ}M!)d=3*aVvq^v3R;;2xkE+jPbr+Ltzy~!k`iQ@8PIT@x)stdHn zn|QMdrNbC5`9z(uO=rH9y``;l%6cHG5z( zwrYC5cMN2Ggd#4CAg6NP00?H&i+e@?E6=YhTC9+R4Td4V)A4th*SoJM3uGQ zwnPm@E+=ZXMNzED1sfgOn%FY|{gb7$((0VVxXBgB6m$4UTdxr^I;`-4Wi1TCi=1^y z*Go@pm`;Y6S0h%MvENUSzkylih^_QOJBea63txWg3?6KXutwG#kan=e(R8WDwD3k+mV%BJaw3v9XRw(g2 z`u;V8X(##?gYlE-_;)I z)jXbsRXFhwY%)j(@%Ul70pwv!JM&27-m@Kz`L%_txW8Jc49&B;n(BaHaFXw)Nsk9B z%g;2}pQd*l8qaNSTV|||v_e}8A6K|)C62?`ndmr7EU;4gul_}wQ8c)!be$sVT)~3j zPhLT3o#Ea3wOnqe83A}>(E1SvCgb7?ngY$M8F2pQ_Zp%qO(DzV!NkHde-z?}<=g6} zf+FSH>_ywmC=*I^8mhL{=$-A5tkY2aDN7ckXeZKc_g`8jvs3x13=Hb!(x3*@8Csh( z+rF&ZKQ;^uX=|$1R~7xrbaUeotnbBYiOtFJFNCWb5-baU#>ve=c5eL9oyIOSrdfRn z)NFrjz;0Rg&gL|{n2EAy$BN(b`ab>&lX3>Fjh@yaZk$b_<514w&RK09Ro4r14@I7i z-ZH+JqeZg8U{Rr5bwTie$Lq}YaP;hszlv$k`zE<^`e1FSz6Rl6SeEi+# zM--h3>a8<8hb7zLRMd|^lK+z@c)WBa*rl-q@nJXjH8O@ciFSeAagl*^-aNocueeZ> z5aS;nixMHtj`nCio|#D>2o61_V^1D<;|y41 zKWzV-hcYk-V$vCAjsaq!5kj7O;*d~7)#29)U#Wwx>%sM!NvON0(yOuB(+UIb2ozl- zBg;o`LTf0b1rGKm{(dv$I^7TTt2rhdm_fk0x(E*zI#OAbKDshl?`?K!oH`2S?5mk< zR3^Gf8azR>NEDEZ7J9^sOwtnL#X_RpP7)i52U!4#H#-Bvi7HYxI=%GSt-a$aK|H7l znT%6h8d^?H9SFzqT8Pm=>%(Om!_l~je)mpkeF>W2WXid2C+5#mV{Oa9k2tK~#5chU zQbkuMffat(S_U5St@K%RWV3Ou`nFq*tzsK;LmBf^4KpI-A(~a$_m)jPGPCoWiA>?| z7#`!{&-$V?$O>xw71*jCqE++y_p_}ydE?S~XZ`!E2>}J6nP@Z;bDYNzjg|eDplJaS ziI={Us*DCR(>s=FT=28d$ws9~B%PJZuhyIw9&L3&+(w}|##0fGn zh9f~07)LFd+IqEJ=i_1IayOmrv6){|V3{oOU~FQl&bq1qQ}edR($<~VnyHChxwA3# zvh5UahFVtaq7!yhmbj$(dgvTn4}5Z=S6eD94kPU9NIMgqr`F}^aumI z@lGTdXaD$xeecCJoqc8t^Q0_ACfZCUgL4txd z+-fKByIVF}by9PvJkz`$4Sh<_VY@I#Zlsx6gAI{;)+f$Cx%Avtv{dt0M;|YsILAe> zLv+C4Kb9~?7MF*fif2?GIn8tbWjK{)F&FoMG-*+_dEE4rc7MY&pmQ{`Fm3{?=Ko72 z%3JfRY~SMP%z>xW*E233KA&VeOl?iq3+=Dt(MMJ}$4(?UA=a|i#MBNcA}e zC}uqTi#)DvHs3U3ZnBj|U9{SqLlXs7EAheftUo?A9`+q19G|VZH7pC#V|DujF~lT_ z^E5)GQbHr*7-%GyE(#AN7I)>sysSv;#6K)bgH3dT9hTF}mjJHzbvOkaf~_hl0hZnRrbBZ z?>F2Gt(_yLc{*5z)mWv-3RyxE0E-hVteSOmiK4&wgq`GX6}~U zTI;XQ4u6C7jgJ-36kBlYv6sR(+tU4!vEmG{m6M^ugVxW@GvnKq6R##}#`iVF^x=gK z2Upobqj+0KvxKZK<>m&r_)QlZAU!c{SJGvOAJp*x**=%eqndi0U>ruZ-LiB?2CNt( z?3h!cq_QK^mQ9eV+0BFNU1GbDw;*}W&&Cbh@R5p;GpbK(Of^TAR`)D!jl{mgUtfe_ znQ^0}+eeFhqhv0!D5_^ZTg)fUvNDW6!Fc%c!CcTBOYc~RjZoiK%zGP)Dm#C3AbaQ& zgOWU%;RT!-cYeybCy@|?AegDAU@i}`VFeVP@HQh`8wqlfAM1h5+}{#V|K7hI7OC-p ze$Dk;*HhsRO6!|;P2D$VD=0lGyr?vuX%KF1#9z}n&)^JV zm0`2!(=sm^<+ZL&JbUW@F!qf>mNiSeJu}_Ywr#t2Thq2}+cu_c+qR}{o4ak>w&wQv z?vHy;#CyLuv9$ME6>IOv%B-ra$|oP=YaQ%Oa$A$Mri;|NBad@qZ3;AcipG&jkDO1U z{wKS2Goac7HBE`GtYsR%HK13F3_}eChFis5A-T)*Z#!i$1&bjcl;4lOfi5%_1y13PJ(Y8U|%*E zKaoRrMuPM70$p*CA)N{-E^mc!DPsu8+B=86n!%Il{L7fG z5Q!NkHA}PMkV8-xl0Lyu#wvG{1+4J;`$EWnN$nk2&CZ#Q!oTCn9C%+Q4$w4h>4MLc zg=)zPspnM2P+BxnFeopmZ;r2bl79zj#uTKv$}>ad4bHX@(a8--rr_@&PG4|($^&?w8^U3F-o zsK*Ezb#l&FMF^D_TZ_b%WFq+k1eOPE_lXFd-JL#cBwzS~eq6^-1lE{4Mbae8+6nUuMvC`{Mgaw1h-b582G+wUFQ?x+WK4P(3 zWpn85R9b>~?#xS^4Lo*uE~FH7s9V00RSysDdF)d1_N%P)7pIfI(v>P~j`7?*GMr+cN+H-Xs*I$m}E07dzJ}*NK{_FZ%xz|P`vS0u{tNh&aFp$Wa(%Q)4e+ztHc4$yQ|TVANpV#!3K?lIP%~L~@m}KYNDek#bnvx+$~^}9 z7kk0MCJO4e1=U_#elkw-Ibdvh6Pam)mx88V4{r7zBA`gBw1P%WH@-UY&GJLZ}H1*MN= zVeOUI9s2eC=xw%!Q+-hzsB-xC&k5T>NF^ht#`B(pWZc^^{@scGL=MnJmHEs%xUyNj zDZ-I$mz`6h^Jr+Z$>YF{t5#%IFxDw}zr&MA<8q|Hd{d>J=WscoNqI(qC+f;PZOKcm z&IhpniFAi7kpU$-{ykovdfZb(thuI6EN^q4<(eK^7@$$xGf>wvuu6Jo_QwQ`(Z%r6 z)e6FU7`rTAwDa)!V?IN#Nx-6VKIWrvvY}ZSj_XH?;R3e>Dqx9zLPfF?o+SE}?^IHe z@Kc7mm`BXNpyXvr?T+cVXs)!4vdJp7lU(zMbkooBN>Swm)RlRlMn3)ug$nX0mIU#Y zB8L^lhEd0cdYh=K`LD?>@a6{8LU&>bqm3N9`OsTduYErd$u`$nipm6CN3Ej8GY%Kl zhs;Vuyt?4T<0)2Aj|}|7Y>9|(NUZdqbbE=ESAp_8hKWU5!LSr(@Ah*=3!nBFgO~-c za3C{FUwqH~XTu@Ha?_QtM4WI?CPk#02|sWf?dIz!FWPb57L5aBOuK$0Kds(hG*y?c z_>^t(-+iAB4!|0&qhPL6TUsDR94prR>+o_rZrk0Z)fMVB@ZSFSqXs(a20x`A!t2{& zPWLRhZkMd-o^LL=SB{K(xRZrKp@U=G)J3S%yHuf|77?yF(urK0Sctn&ISI-M%5Skj z459^+aHVW&1^o&!<2)i%lW?U{idm6bu_SyVW$!R0dQyd?II%`fBIWT=B~+r>rYf^QB*idHU(1vz`S+X>-H4!4~j`yCRG*>*dz_cbgpXd9M9N*7_ zvlKf)9>Sz6UrLJ#EkKp{=RwI5{T4aZocLmCiV-#u=5MhuKwSJcqJvE#3DodJPh|5T zVug7A!gGHy`zkR>vbaSFqCqzzurVUx5u!nPB4G@o$pNCYLNPc>B#H1qLZX)@EsX`IGC>m z&2kpSLyOmLnw$9|Kc9?u?7ORTbWNAYc?hAA`89u^@psLGtrvHuU$TcsqwgKNrh_we zC8OsSOmFEEQ)KncqvtkEZy6JCTtyQ)l=Yfp=P68F z#S__-36@O~(-!KGqh*$)$7>ru0BmK}YTv72V3>#lCZ-7htRpaROa%cG*8~9G5f}s} z;=l<6LV(B!3=&g8AoGhm*)RCJJ1FZFLt_{9G;bA?lB5+&V;9Y|4;7Q)q!mYF7wt4} zRg)P zT&zrW?mas;m|sy$y@2R5mNs)+sdaGL+92 zCA2)ZG@dY5Ul)Z9##CIwTN{$<9M{9*z_M+M;(<+Fs8Bd}kU{e$&26aF8{oSE)i)V2 zLf#&hnlq={ozJ;T&y#sl9+B_8D!83oN>8rJDP>OB$JNphg1lvyJ~=q`Xt>9pb`XM$ zWx->E{9-?Nl%VxXTi(|N?{}Ys)3+S-g*Df2->CX!@@(xZWBb34)2gibp{l@ES`cci zgg(X^5)5c+GeU7lIP!~o=Lar?$G~;$+7=xGM&y?-zEUoTo9)cDj07%KU<0*x?k24z zcmvX(*Vg6cLw?}Kda$p)6K<;S+2co=uCImUly8-zG{@ZsXHU%swuOD`3?bQ``8X^k`8yK=%O0% z7=`P^Z3#QE`CVPSd_^QNcb)LvCqzxms(x&-7Tpk|D5BFAf#2N}4;daOn4N zWs^JW3r(|71PD5td%e7!)0RfXPGzY?l`z3`)#aF&*jxzX2CR2V>H++NLtq5_?n1S1 z4e{>{{H)+S?E@LSp54)9_vgjVx&Hj!?=DZS>kgG8cINHyG(=&nz#6}U>kWLACxt7t z8oWXKCy-nAh#3g|DE*zApEZe|u)PJT7tTT=D6?5wA~!TQGjhW_9WAG!GWcQRm7ec7 z2^RaBE6T%rI+RbLp0qcQ3@OQ}?qcRTMo$QemhU(YB0M*8C820{X}oYpt%~04yEBcn zI?cO;QSy2U>jgjNSg7;?MSQz?o+xhc;Ieq(rqK+Rewg;fIKaRK9(6A#A&rP(;`#Zn zH2kiAOk?SZJS$P+NO_&$%RQUtnQ)F+sT-r0>ryq=AaYwIFX?32@N3_61oNm!Corj{ zP|@Z49h5m}mb44x4_GQ01lCO3GP~4X_V$GFOnAd{-t0^&<+@gdx-J>9Fi#m3DHQmJ zOW}y!tx#nrpLw#Mpsv!;=vpzVBS0Pva>$K0IR5@3$#AzOM_mULRU#2>ZidD^w?69n}XGUbU%H)D_p?XO`6A+{XdI+}> z>>$`dael(}55RDb9L_{jUt_qzaR0>nA^V%W2YDOv8r1DO_qS}2udg3d!Ws(b52M0u zzD{wty&RF1F3_7xy=yQ!pDlj_u;8^Dvp>5%+qAQ7Qc6%)G*QhxhfW0b2y~Ph(o4-m z!@sWad?TEozLGT_?sYo%Or^$&5Yr0Z+|YV12{qJ%&E7OQ3Cd}2`r~ezzfTkulbWzw zykZ4*6$lC{;YN&BfQUYCK;_nhgkf^h3f{ja!X}MHuAzX_TadWO! z&U!n|>ZlN!=|;=69|swCk}3N?a&x}XfRG|I!R6T=^W~y7Y>AR5F>~IG3;!N~2}&lE z@RkfA<}6DT0+9xzs0V=uJhyCA+9*9a|KY8&3Gwii{KI0lCBKInEId9Bd zY!)t;^XF>|e%13YZGnDbzZTy_Z`{Q`u@vKnl(MLENhBTH{<;NCFBD-0y)ZC036gwZ zCWl`u2IdgGqd3~S0unDx&P%;j<&QQd0nA61>n;b3Ij~)y6UoI_8ht@+09k;?l7UVw)mp zos5`u-)Hixc60D;r(l+)PK~42R?1BES!_kbFNi^X)%$}|^4^uZ%q(@sZrykHnhJ!D z6jvv{tC$>3cu|9OWG&Ps$4gw|gUtLn-Uv>B0+lP?er8=aAD!Z3#bYEcAvsE-T&3_LZ8nPV!bTF!u1_J?a&>lJePU{BLpNOMC(e~yw~Y{~8K*ySoY`(Vj4O!mAvOzf zloXQ$3L25oLOSnuT)jfoj-CBF{%xDTe&yb|udSIjt4%jA&PM@?BJtS%C$=N&6^b_` zD3Ogjn7*xUs|FbF$W~U*$K#i497?YGMq@@e(%WDnnA8MkQJ>c(9Cf@Y=g(TSjog@M z`>5)n;xq*;ckvNzyc47XmE|HybP_v%U$#CfG2-fm6%0^Kndc5J=_7bR>VK%dluUB| z(|S3+dgPQ)LCu#lXcuoR@AUYF~Ipse?GDP;Px6@@eWCUTd0L#uj)4nFSvMV#lRRWp_ZlUM& z?xRr%t{9=7SNLzbxa8)_D%r{seWGTV0xIeivkO!dskcT|->c~yH0SQRs>Wz$wdNky zo4nD~WKsNrO$u^5sdA&fL(%3=f1RLuQH_5dp$z;6N24(V3I7KCZQ4Ax(&q4(ziyE9 zuIGCmBNPu}M#(YXn%hVMlTj&n&BX{BO*^^*VcshLM$=OSnzuvI3@bW{9ZjE04=cL1 zb&c{`aJzFq;PEl-*tp~?-64l(omiQ2u92dh zY8S}d^@A>&9vq5jui1KM71};#gbA&gQ=U0^z zm_xmmJs;M5?Z=T+oCRa96)g^$XyHf79kh7WFM6a-aY>i$h*T#s)zT%*%1DCHHGkZY=BXn0V79}~sL4|UUrA&G46vd;%3H~IX?xX8oyWH{c zC_fAJa}KGZ11pw>J5OsaAeT=@@&OOHyId6VsEk$n)ra|JfQ@yNjx2#0W}nIvjcO;# zfOrC6#^Pjk^)TN|cC*l>j|h>^vT@_KSY({u9AJAI@qYK!oY*sS2v^ZAv;l?bIRw4% zLUjGjuH4`@T&%<3+^IW&M)&T)%fr71{X7Tphqi%y?@&O0#64Sh*7vj?7d#D4c#J)- zn|=H7uoD`bDNh}urvJ|CR@bZ%E{P)Uc^e@$ymtP(ALP9Udq_U)X9thz{d3Nu8ep5T6h2hLhzM$ zxR#50I7ewCfq$b!5KnCryq@zp6pKUyy7wCk^2wz~?KfE6Tj0bmqjUB((>lzskGwXf zkhuA%N)(t4=_I}>JM+Rp_Of(`Ovt~+n)k`L-Dn@0Gv90X1RdNsxQ{TB(H#)Zv|Xzf zOAN=j75J?OhCSf}fteR~Zwvw%qiw|edWZ(TGOZ!<8>3X^Z2<0*dRJvXi~XQV8T)AR zm#V9pX@4BZ#y*5O#=YuuDvZ~BP~{P5wQpG}V*XAVd0=%K>yF6I)#Eh+=8e~6EJcj4 zEbahnMi&(x10M;y#9CS#xPCP>Vn}edm`O^hShacM=r~ffltD;^Qvy;cWXC~UbgL78 z>uIpHiM01GXqYfRUeQoWh_(!Qb#p&*HU`t9yOo)3dRVL!DU||=F95LwX3d4zaoAh1 zZ~9U9tlF+|0=3wh|F7CoO>xNuqt$_Q*~x`HiGBG!2s09%;+kt`bl(*=@6IgOKUE#z z-|%MtOV$0S7pgro`LC)2*>0DOGfXLZR;2|)Y|}u8f9o&y{>_ZJ!52k%nrGW>Qhfi% z4?;I{lqBts#o6L#{p-Y&@>>ibnt`@Y2FJHh9qfIs|d-Vkq;KlSvL zS+3si#~7oa0Yz*0$0-?hYvZk9j>WkJ&vzT&CGl)5eR51NH0GizDZUT&u}I6-x7Sa~ zN2$8qSnA67%@vzwNDkTu(JyZ5fdJ|$C?wbEihqpB_ZkI(l1st!BUTj{3D-w6ffRgx z#3)L%yWFa>!~Ck+k#DGwtZ|DOb5IBxGgLx~W15Y2BES_RpN*T3wV3B6l<)LDO)A2q ziV{=ekrr!^41cJ5hixo=v*ek&qCfV$vx?Hn)Xagz4u!q8ErR9tv=Tk5xBL8tE|o<6 zk7EC~0NVe**jfHFMAkb|Iws>^7V{2;-(0SuKd~edPK5cV2;f-bD1SH`vm1bCqI^E4y)|j@HPM?sHnqF_aA8E>?`%=YzO1+eP9nUL3{XSBis5{1jDio2M)hJ zpy82eF)Hiy(U zBW5zcIHbon^FlPnA}vsf7r8M5wQ7Ef*inA5H9JJJNue|Y1<<6E+dkFN;qc}#JnGQA z-8YG!MO5y~g=*q|HCjdK?Fo@qP7wl2u{4M>%kzi@;IPOgjLztpn52GsLM8u{aFCS= zf`RlY){939JSF3Ws@BS196Hnb+x(3}h*5A$;#zqfBvDWd<#P@M#n%i(TuiABMqG@H zl8+)^i2$d73878KUcX3)at~qO(4k@kCt0$DgUV|HC$O^=^ksAK1PltrJeE2vkupEA zh2|-X2Wr1do6Ysou%uOHj_I2l`;C>oVeZ+5w@+06amVuqZ2kn>(?9AO)Bg+B{{QP5 z6YGD3V{6AsTlO=+1Ydoka=Jvu$IQ$MKv+Q*t*AA#(4L7duesZ23IAMsBzjn0(!ir?s;R*kv*gblNGeEa^4S9aZ5^M*KZ8I-oZRT47p^ z<&|oQAN&>a5wOr$>Rp7_*rgvcD`Z2FpYo{zvH`jQwgJ8YS_yO&oa!Ulc(cQn_3RQAJIY?wQ?&DIzFuH= z!>Q`N^7aKhC+s)bKgtyFU&)mDKgf8r<^D&eoo}kg%Zw7da6$YKm5@Je8?YrkS0-zd zCJJh!_Hb^mOxyE9AZe!OJnORSf*Yl%;a5rk`GW8Pv$H!^XygbUI7wu}kP499%9Igd zn(-{;Hb5_dk>isLg-0*eO(!kjPei<9jdFH17k6I>lcS${ou02@MjXj5@l~U0Y z_-|Loe@eB>4q*Ooga=?_{P*F4cD${vKLf(h)*a>RtTE$#cs^Mm=u1M2aU0AB2t)|+ zi~v>F^&0$Ts$*>8p=;;SNh1%}x)8Q@W8WvUbG8BXm<0OInup1KifFg;1~3T}dL^EYkrxa?Ju7U9v7c2M5l6OJw6S zMz4X%&E85{F~D7KYafq@EJ&2u7UmZ2lO2X4nd(fW^S&+^~Y95c&*4D_@UWG(yn5C*SaP&}?vM(%V(Lo4rtNKayq^mu)nNiYS=Sxq|oc%f4y>v3ZX0wz=cWtUWzdluz zh5NY17nUxw+|m6+B5=q}eYxaE*UI5+(0Ch|8Z*3lrgyb#uI(!7k-f-kCEdgl<;GbU zq)BPx?OP0;#{aAn-{SObU0GXtsjG4%xtP%QAV!x+W$i|io9Usu<=+0>t=vbF%Nky1 z_@WCRJgi_o?t2iS0U?D8iQ+U?EkqzqxOspY%qr2(@b3d85K!Ub0VrlW6uTH_<_Kqu z#>=hWYG1z(oaQdOqL>go)`8ZdlevY-U$hKTGSs3^_35PA1u%9D*cGR4lMc{|yJ4c^ z_C^@^r$BheBHC<%=fS6o6Oo@LKm}rv*f0dP1q#8%}-F{*~p>{Y&lUIpiNzf%U&p1pvc;8gZPiWdH-p;MNDqQ>`J2^kEyC zkeM|!(__er3y`(dr7x1O82;mN&Qm)N*6exEajNq$SiNgX`hxJ?sfub^P#OE;k0nrs z5a&iIgHLR_@s@Z-lcfl@@4Twv$~XW4Po-vSWv7-v)33UE*Zi{NZ9`>(&v0;cV~}Vh z?#|i%gqyXsOhYUlgy8+Ofa{8mLH+bG6uy5YWX?O2qt_@0)kz_<>SOR{R0xHbVmR`8 zrUi>jlhUz-V;@1-Ymz|Sg(_C=jO&)^Ij72LiBn;6Cug`p91?Bnp_F7XSllwwqyZ5o zBM)Fu3c8%5c>J%%(jv+5IBEskxi&Hn%UEldnuVntW@&Etz z(-;W=048R}{{_0m$i&3)9~OS$4e6z&>VC!Xw5iUVVZ!`IbP`={(h&8ypiwzvGa64L zslyzND|t(F#n{wAQcFk*-AjV78_Ve@kWMCNCLqdcE`{ZvXXQ?h;sd)@bH!5F5TkJX zV-8)TN$kpZs?(J@{s4jEUUl+NMKO4%>nAds05sO0u|k+zBZ zmXOjdA+|;sX}cN{oLQqj>E`?WYVZvXnB`-oI3;@hNh;vA2DedX+4fgzZ3~G>2Zk&d zPBw?vB7JPoi!1uOE-#a}Tg)DC6JE!Kn=f?M`+hmQVC%hSMHI4i&vJX1Pbg2yEgPc; z$ngy)_Te;PQ|ikb_H`|tM3TjenY|rHFKN1?itG+V~Ns1q9tZhXk?djr*GHtJ|&`tw)&u@!}f+{ zNAaF&mGzI#j__u;-}x|$%+R3E4&WZ;Mb)0#!-h~b{@@`c%y93u z!QNoasEsg_PFngR322=y1zme0n;w>SzFIU9STMsZUL+nf>lr6E3s}%jD-LVmZfs_v zB}ptrs*;L;bblh9*(2THF?WsOW?A5&ck^gFGBl9YI9_qmkXb_k;hAfnn_WJM@F(~! z#o0!VWL$-gtFww5_l;@;ePcd~msEO)?5U9MwX}yk5y`xk=;9*H=&s0{hX+eQZIia7 zCbFpLxhbM(esiw5g5LT(BeHl<&EmaSoFD`!J$6#d$V}>&Wuq@ANks~*Sl%v0kzUQn ztk(Zvfw>!7E`+hp%t)R~uKfxDAE^ZP<&ynmkq#k?#mu zDuKpO`s4FjmvC-?kpgQ(mbA)~B{3JSB#}TsdKJtq;abjQEjF^v7cMPGrU+a%S}k-c znUr9o`Aw*pWKOKg#!PsX%{J*YUYQVvt+Hb3JIA5u-98(9OTp>6?|92G!J=yz$}fmb zUNY1-w^t@kiYh&NvOhrb+9ySiMV(}>NR&0FXdeero;K;G+=ki`G0T&MX7X5kLdOu# znxtCnh{UwF_^pVSp9?ep_9%n^`s__lYgWxrB z-Bl*dMC4$MOy4B70q17|X9`0V(?*4ie)rV16QfAnb-dY101hPGG--QOsCO!9rI6x* z-R}B82f=-jtL&3XaTa9mm;-0CX(%EH2y{`_xiyZhj14_H1V^ia(Xk%7iA=jk@xG&? z!zx&#a`7F~8JqN!WV@&0p!pl#fs^rSmRh&H!$;sMMs)thh^DMg08>UT|nb4O4feUItvaiVrIYqO`_Bf>DrX ze7-XWL+#vY`G#+T=JC1YpI60?}k|@RL1|rp>6F4;5q!S^P68gCpw8na-3PAP= zcd^SDWc*ZBOLZo~DW|7)yf)&*rh3>tDxR|zZYIa|420}6=xtTe?E>meNA`;8D4#V#Yzo*HgHJd?os%z z#N~Fm{+sDH4pUeVygE9y0(6lMJo9?^`hnz|9~oiR5c_IJlv7C+531*sGG*Pm4;=Ga za>1xFRcC|z$ztunJ<2%cXjDQ9$qGRTy|}#~#lj?06_~i@4sqgVSwpR+@{Qw6UHsvxGl-BxEJfTdlnv>IyEn+N-Y_W7y7u0DJ=g`i8vl2QvY{9 zW_2D^cw`ucp}>GHZ35jSn5fy3Ghx93!je;7gP=5ST6IIv(-ZX%D+QCmMod&DeI@CV z(c)36R$OS#JsrzLOx<+K*&&S0pY@jL3!xS6?IyHAtzM>R-KGvSku1tKvdWW7a`3xNmg-k-ZdU5HPvwSNWR)~H84*msN& z&e}>C4OH3zh~8R8hdK7jcXJfeZOSug0aOq|!lLc5-Fz@8MV36g zidtAs;~Q4Y%nKg-Ta((UsIV~0DqqL$#7?(ktJOZE(`Bl3*i@l$p^#`gyIJ)8J)r=6Ws4+DTd5% zAQ>2NKUe`cKdtoHVV2Wd0=1TZm?0q?$Whscm0PcYlv%Sea*yR+z{Ci0Vc><>n7HAr zjvk)>U>H0!>S4}E_y(|&`FU=@eg<-G^7Vp#JB&XmI}CcscMH&F_(u`^ZydTXoINiF z)BIED0dV$R7*45ogSo_+^glPg<2IYZxFvQMC4g+@`)h;5Fc#f4+jQU#f5jI}lo9lE z^xBsOJ0b;eF)7L3u<`CTK-D2OmlFtf!#Xhst|`Y7X3Fyi+o82s0`51*w%A|Slw$L? z^88^w;29JI-P)m;0=d2lt%I#k!F0C2V2gH(f?>XL{i{$!99G}Io@FZX2VYkY2vgTs z%?(`(izB@KF&Ds+a#k&z^qe)gSvL2stsb~^hiM?|D%dpF!4?-S?6EOwAF?wI((XY`v;ou(kKtf9=HM265KSVjA22!~X42f)V z^e43yY6E0GLcX5W7q|(Fv(-AVmV=g1&6d0%@wrn*G&(HMd|B^F86$l6W+=Fr?D~jp za8Dv`=J?^cN2`8Itc3h>t>NYKW@=+*Mz1~|qjH%SGc>N-!9b&-BDWqh1$*`KiFymBME6@yrFO2-u)>6dw3I| zjA@=$TApqe2J!UJb#y!f4la{qgO4jcsD$6=buXF7NMel(+3v?cGB3(BDC?=@4)XdYf8zf9p3*HuH^n(@zREUg3 zoFV9dp?qj6sU&**hVJv4b@h7}KifTP&amk;s0vElw=QI5?58f2ocvfwYoWeSDG65L z3aSa<)FdKMkUu9RqdFEXU4`#%Go5h=ScFV;y ze8gs*(J$TWAirMJ2MeTo0u^ZCb8pDDkMI4~8dOlE-(hAzbj-Y);T@9wzu>Y>7v zxr;ZtHmHzF9nlGU2Xcgy=uThen+WzS7W_E6xC)FSgd88#BZvGaS^k%3$Fo02La$1_O6 z{FK%dk)I~ox^h1FzP58~7zJZe6=&sVf~AN)5{G|}dv;;vbv#;+9iqv_sj(AKJ38ac z^$y+r+zWrKWGyY7`Bw5>x0cWKz={?|fhHiHPdJ(R4_bIWL)3&lHV{YBQlEd|iUnJo zgLY|AU>`1r(_UOW$xhnk;Y~S0LH22-O`cR)URhnYmSYvqc5Q3TrNv9>GHi%?Dbd#A z%96*RqCAT#672x}@Q5-x{qwYVG&npy>(frZFtEKC7b(+ps>3H~oEKt+?V1y;mQsNgXEr`9G8e9W zFcN7>SUWwJn}_Z|ob$EG6VJlh#>V$4s|g&xz!QDbd2V}K`hK9VAcjZmco*1X$aB1g z8DrNfbxdyz;Hm{*up%=lBDiSDuzr3;4J<#> z1oWZ(Udy0I_mDI|lc*tn&Zv&}u9kdJ?ZajCw2}FJM)cQ>P|D<0Y$dNH_y!-B%@Yd> z8tb!-uA9%!?MB|KzyIs>#`Mcv9~Ki~$Hd}}``)EaCE)~{!n)rMS)x^;5UevISr%Ko zjw)h=Ejx`Cvx+imKW!zYYNCS+K%3sjy*A4Wm!${SAYYm)zW*Fi#5$@g;ATo zYcf<~Ww<bC;ff&hO-U@9j(+5Rylmr<+|r8 z(db99-a5~!j@jBOM-z)`^jnAG%b;j9{d>)8sKffvrV-`j(_8C=b|`<&7p@&CXrEq* z(SdfJ;7}BFl)wVXw0WA;{f-bgibx`!y$Xy@ZIPQVh3w?50-a8Qu$8VcgGp!HEi2S*mhgY8rf{NTkqB9qsq)2JNg}#b@F`8mE43vE7 z6uwAUxZon+lh#Bs&Q{P=vO(c}n75 z*IEH+@`e0V^>Tq(kWFYX%o4rR%Pi`NujEo&LZ@;-9&h`(rI^d&VsZnTO`UTlMo#M4 z2>iN{GmI;#Xg-^8F0Vpg*IH22x)?cqX}PQBj_e;O*k^rIC8T&zt|}|knYLLKtfO+5 z!Lwxx@eXC{B3EetmOBj`6Y3i9M&A))&jYQHjo@4-#b%DZ87*?s%AT?3y6Rlt4Ijz1 zso=Wg+#7Bjj(K`eiQ9ElyrQzz$7)TsY&C317~lJc?A2I@Rph`TkDou^TJQm$A3W#A zf%s1(35XUwaKa1(l6-8-4--s>PWS+fKy&29-)lkg^0#7m&s(O4!vzPS72U~Uq%Iq{*Go--tFN~`m)Sxb^L4mYtRS7(NOEu zR6yrtY9kAwE%d=%V}H;u$G!*>zTyNl>_smU6nP94>)4u_S5pxfFLmQLpyKqO8Mi)& zj}Uc^D3li8q)jCzbYxJmo`Y!Ab}bXnz%ODe>h)Ob2d%ZA;1R(9!hkVdb@EwF(UUH4BANFf)9!#miu$%eE*EFp-8_>@sR)h@7kv zZ_ufdd!A<^=SGSmfjXYyY#toY= z`4Z$VY;3qz;t7N~NJ-q^qpOfi9ykq<*KFB4kdw^sRH{os3qH$K(6JSM3szX;r$n*D zq-olJU3a(UdBCnXjyNzbdQMED&!mTY&C17s5V>6d(E44o5F|Mf^dqC#&%@#)v*Z{_ z4vr#v<2$m}M?e>l&yDoim24(R)ZMNMa)-C8ZS9($U{a?>MA$euXR!${E?MJn=g^Bv z{1_Q1(;Mu?g{Ge|Q#7CMX6SAaTONCN?Hd=!TtFgzjYZTqaR;+|fEQ=Zd7O4Xjl)yjL{Myw)pVXk;9$`~$8q_tq_Mmez^ULQn0iSb~ z(92@ySoheX&~v+bFlU;3B1bYfyH?SPxS^FNQ2Ez)eXhI&;{0ss`i!{f2M-Wp zN40}?C+^rXFZJ7(S-Um&6k#UJJ1fSsCjGqQ2V1aP3LYbd6HbIX#CrKU9`pLp<*3nb z-@-9e41pzR_#J9IEC#HYLONB!34}h`qaF_o6HdkP=QIF`dMNBEhSIR zo3m@4lBP#-o14U0Ny^Ge%1KEYsMCyWj6V5$^I~S*v#cbWIro%gaKl#=Iz7aYaxEHHEvp9EE8sekAV|#^cq5#LD$3ZqxQ?Sy3|f ze|$)$@4e9I>^`-nl+zUVzxT#lzpc8mj$RP<|D0DtJ;Yxy8cDXia_H4V!iiTPcFtu!V6!FMAl%P|^D|ELLfK59#+4(5cxUZ>*7> z-K{hTdSmm3-=87|Zw$wV=CoJe+3#amEF#pgM@~1NR9bhp@~u=?T{919tRYMeSEv${ z)^#U=f1I05!K=2w&3*NDW50}2BXX$$%gezJ8TlY?6KHrwnA727WTppN|3o}bgHwWYG_X>Bhe};l{pRG*x0P8 z&tcetZi$l?EQcOfb_bF5YqoG<4pt?X2Hu(|;_PGQj&8vmHa;vpT}qu%9j<8mItOIq zN8yOq2Y#6L755U9AJtToAnuS|LtX%yzM$SoOy1fRvBYh8yy zlCZIECtJUwA1`I1_`oGQnUb*_ylz5OpxRvllbi&L>YefnJn4##y<2WxReeSEK4@YE z)*IGK+f&5h)Wej7RDC`5UGkiruHz^GG6G1Hb~ho6j_0-?z{1)sJ$AF7D7O=0xCur7 ziK+R1)57*`gspnYR#Qt-clcfZ@dN(5)~{*3(?uC(k`JN&tNzE)T;Hok6v@fSahM$h znYa8_Ld$AO6$?i1*Sv3*cy0~{4O@Q`yN&xzqlN^DXs6(3e4jn!eWftvy1MkV+gou= zYEX0tGzY3cvttZECpIP>PQ9`HN$V7@mRT)KG8|tCl-sLO1{ds%gKs+M8 z*S~v0=N&(?BvsustE2`b13lkA4&kAzfSkYlYb_ZbBQPvyfn_jqTyH99DBItu zAbkQyJ9J8Vy8=FTvz|8Ho$4Df6SFt!z#1w3PVJLx;fwH=rlHkhDf7r8`9wZK*xKgd zZB9LvcW5uJT30mHw90s%DYWbDUL0t&$M^z*To~awxI`@YGfF*+wWwKUAd-Ygb+=16 z&*n%aCx@f}mZPIK;zdf|p&ljkjnGUTk7tu7El{5MlSv(;dqPzhmG&f*&gGq@l4t5f zNHy=jExQ;u{kAoscr*3+vrN1YmM-h_uMMs%FRz;&ld$-- ztEABww`jg;ZCofiNE+?$%qEib?xaS4`xFuu-o5{$F$U|~)le_D}jq)Y#hZtNtK>J%%MgRs!#q3TOv}4_7DMm z5m*AF!6JiPa04?({0qKy^NTa?(kec(_`{BJltAK5bua*Idm%QDN#0Lk1~;Nzi!P({ z57Ah+y7tAre&Zg*>$NBl9&U)-W1mcQ8SNG{g0~z`Ht>S*!p&eu#^dqNjB0n;lm(|1 zg9xf`D84EV6Gp=x)P4bm!2x(5SE#dl7H@NhjHxcS`$p3rp2}=tOJ|QmoHn7qBDx>? zelh7!**xtj8@&qM-OLyiu%Hsw_@3`K5Q%)GGsPT%s(&SWp@OraIU4lb)SytS&COO_ik_3<@k8bMB6Y!__RktXu82 zSnQ4j^4gk6ST<&*Ym2pqBfV%dcEK+#@Q=@|Zj{7=qkaTQUw{3F@V4-;VYX}APL`!nQ`3FPZnc+R#34zW@1L`$$s=-G z$wuZKrLB4tjB}ihmX6+cd`tYA+9%Os_Tu)16U{Z8cu}Z7^G>;!|;r*2t(6 zCF=xFs=H6sy$X`m?VYlCh_qrJL z7Nev0`XJa{c)&1Szw?C{_Z^yfKwcg`FAl7z0=0N48(yX-j zG|fx(FW|xoYR$((EM?>d!37Rf9 z%*lqCX_Gk2yxAlhW@ct)rVTT*!_3Ug%*@QpoLs(>PWtce*XcB_QcqX8r|lkFc2~Vu zD3Qu4n2vZSxI8m+Egic3D|mA1=!_gG{NB}0l#vIR6*>xQiYlGgiIpxJ_NTqNMmvVu z9F0z*%FdT3n=9FiZZPjJbe0B`BPQeTB08l4nq+rQCCYjR3r0s8!w7Zi64Yi&W7f&R z$r~1dho%PeXFsKoa18`4FhBkHnhLwfWVo(lMc6Y|79CC-p`5Q9vKH{R_G)zg;D{R3 zR<2s~vPBwq*6XG+oN0vD%8QHRj^ZQ~&k2yQ#5w8LI7X!6%k7T(OEkLHZd8{zxLBAN zl^5!HtSy2$&6FCBWr~Wa*?GIQ(JCvI)gmO^^U+t$}v zmxpyW)KVy`;n9czJUjBy5clla50h2ywx(i9hVQj5QH}E1R|d|Jx`@u-A~lo5ROREh zd&g}a;CmYj|89^cm~wn?Dn^WR_lWx!muQ`d3>G z?ON=M?3)e${8PHriJ)}1HoKJbSx$bubZXSm>(N_c#^h-l~sYa8sI7c{5i`%4u^y z^e1$O=nWshT1z>SN_o$8A;qqIZ1<9X&4@x`SIci!(+A1cnATI!XM6GoP<5_?I*b1b z>X5FkTOGIW>?|JJ6_Dfp`g!hcm@1m`0nUgQ-OniYOL-K20Z)gfQZo!McPoK>E$^?6 zn45Pwk^Ig|@pyeN03!4@W*)t&%;5B`sJ3!&6jmn(?-o9B0UfDnU~yiN9rG)Tyh2`H zKs#SfJ^YwT^dHPGN1A9^KPwnE!;fV+rNXA&E$#ItnTCPZ0c3S*Ph2_kc0;oI%HFEM z$SkOUuY$?W&dG}jC#Q*IW1W_>N)_Y1xh)>o?Q~{OON2qLh8knO#(-qJaZKU`uQiR+ zQ}ssw-h$_Gb|k#_Lr37;wn0x!MvbuZVdGaoO8*t(^TLCL^xe^5k3&_K+B5K_`kCLC z=9V{YlwR(OSLqJoo^m{xv!FbBC!<%GDTr4*dAjD=K@SQW`Be=4b}2+QVlC*c!qo>D zF)hAch1yh&Y4vxVf9M1HvS_+X%;U0$SpaQa;2r@sbRa7h zWm=&1cq|`l3T2wQFg;Y_I+i2{;ez12085*38+4Yuuv>%s5;kgUU~t+c?}|P&xf5Ye zU9?S?oNY!DwD=M44@7mk9A@DJ5VgGYl$OHn;fwRiKlS^wwpb#?ZKGIZy12!G(B?_%&`NGpij zuMN*-<|)|Cx3?kz_GN_W2b=BcJv!YYx>=?w|PaB!1S6xq@ zgHjWtlX!HO?FMXjOO$n1?u7g#I0&?_dgtGc#^0W0L&@}2DI0c=@$b^J_H^nY1I93_ z6tvOm-qsfln+6{_7rqx^8zx)UU8X(*a+e(2qTHY9d$>_$Em7-2m(N$ntuKQQ9v=A5 z_}Y{XTbXZ{TYYCU><*mK>&>5K+LhgrXM;|At#%vDnroWTt=bc3lO9A@MVILtm^}YX zp03VYmmFs9I6rO|J5DU_*;^6arjS215c^Q~LG(%6#1N5X)wYB$Mc$I}*?K?YO#L@8}^k##{B$vn~q+_0!@2CBpiLSeC_B2d2!c z!xO^caDXDaag))w*Ts+?qOmMRJ=*&5_br}eWW1F<-rZ9cw!R4xThrS_*zCuxu;0Ps zNrx0PY)3BSS!-FNaX;-V=Jvv#gn$Sa)9T;jgCeY|WE+D+-?JPT^qJQMOJzxAT^2Q* zOMpxt?xVv@_LzpB6sVnbMmN&7U(QW&cj$~Tx&!Re2!f<|B-Oc4S_9&Yt0#fEl#k}#iBZNe%aBJ*{n9%!WOZl&f>lA(q)BkUYF*? z#q_(~hR-F%jqRX0qYHI1V{W+p`>hG-*~Hj&{UX-s9HoChfoB+f~p*fHM5S zj_`<5G?&xE*A0PlPKj)i2ni*c=^*OwZ#Z6Zhe6^rS;WF22@7nkB*`Bxc{TspI^lqB z%0OH-`ybWFN|V4VOA~F*mgOm3#NAVnhA+J!s}*-z!v-1Uc|C2`FiIF#GAdU zoYjTnyjV0-7wi3?$FU^U-~stw8G}qxoO2?nOchqF)`!>cg+bYbL~xG9xk`W}Eo?_J zWzZje!^Al!7HR)d@b4g-V$bj4vmbBL^8d&md0N83BLeBl?-8gSAe`C$dGj1?#^89? zCE`y?w&U}!$M~}8v&x*|eetUlvd`w@`x4%`)n*LuY_i!s*K6I#2tiwr1arF2RvheUMU z?H={Zgk|-9;8_sQ*(`Iv1$6}5CJ$x~ZRyEVbbhI?Vm-7!!+&b;cx7R90lXon^LClL zU-5K4LgDLv9y{(mn4TFp;;e8F!lv0s)X%u9m1!2?hFh5Q&<#w-FSyQOtZ zUOJuDQ<&L3Qw|q3d>s#Nh+aW`$w?=I4Ims)6DGfp)Y^H$(s?FICI$JYN>N0mnl&$*6Sb5OFIPp6UG}gr+{Rlk8nwvF;CkEY~JR+W`}yUHQS;}3AaptX zXVANWj(SzLaH+%|SV)G1seMif^>OB!MbAnQ7bhG_hM3uX$26oc5gfvgU_OM|cJ~BB zUJ=0ltqs!?s6*uYQA0E|#5(N#AF033V014?Joa@Tajz+ST>=;`7UQk&@jx@&$JGRJ zdaQ6=FNEJ9f3NJ_%RS^XF^dmu_&#;ArwC4N+w1@dgIOX>+*ZoprrCxL_&`?-<-_3m={dW3DlSA zPw|}gG}n(YQdoJTP5YRrnuVMZMoe^O+dnfUNky7P7|o<@Kb4}K+$e{MO5w1T`9|&P zsF3LMx_O)m0-b0^)qu2FE+Yh#c2^=-EQZ|u9!c-sX;W*$Z1%2*II$|GM;xY18wA3* zbC-6~WnpXj7$3L{-mVaoUFsrjFA5E-@b`IZT8U9B>B1VAdgy~hslUq^ZLW6J)3SDP=` z>@%Zc<6rLZ(EDU*-E@{y9JTTdHsrlduvoSSJ2VA5UUIYU-AGyjIdzzbjv8h|frjvY4sS81q;v*^Nb2_0Br*Zq9o1TA}7CFU&z#YCn`? z?t(;LNDF3O|5#;xr*;^>U3g|_8epujI^bEVSXaq$@l=Da$gekFK%^c&S}3;*iC&$$ zi%J9WczG>5I$LXAv{qBjk-FA&0(#6p*d+~JeN$xKiM}dzjNJu|=iN?!IlS!in?jYy zii=wm(3NPE#zk`OuXhNR((2i0CUZ6f* z*7J^!GcYOw979PQTPm1^ zTW6ODG;uv{N?&sz%Bx^sB)?1Kx|H#HUL&%Kft=Z@w76ac(zW<5LE4n=;KE1X>!4i<=NX6%-}Xxs|IJ@7OpyPiOq zbYwRY)C|;fm#Y<`qH+JO(+Hn^M90o&++!Bgb^4Kh)7yMGePXzSTNRJ1e*aEu<>$1C zw`jkDD(TV<5xjmCzoe>LV9lfUI-*VMq-9oCSXgJ_aBvmgP?a3*!_F9kZ$XRK^w@M{ z!|n|JUmsoR_#niFA4azYHzRK1TN&aC4?ZjIj+rT~@rzHfb-^x{=N4p~`M@UE$3Dr4= zLvHBAxTnk2e3xpOS%<6}I=#u}HI7jG`VCd15ID}L+cC$R%X-JJ_TTRG*v`0OHdkK| zngKokEk=&z{|h7cf1wouzR?P&5#{~=En4BfAjkd}THzb3z{dLjKr67Z|L-Wg3r!DM z%_X<5O9K}-Ky+XrgtGu99T7nrwBK)4p89h-A{dyTqN9~oVr@JD`_Q38fUzW$r&-A_QEvR`wMobIh%|}}oLBCn%s>b~ z0OgJ3+IdHdhtHAc*30Hm+mpDxC`qnlYdV@a9^T5lW3t5;nXz^+IzBgV*~LfD6Eew& zf7#9O{r>!M;kZZ0{)W)X;n%i;UkaJbcsxjvj^TN~{A%%%|6Mw(T}gk~{v5n*(wCyg+*e*5ej~ ze$E?63_F6vEF}~^af=$BT%ZHc)?Tld)My8EQFVm3@J3K~O`Ld`a!(qYD_bY{5b+X; zHFwc&2!1t``(`$f@-&^I=0aayu+BihNsBp!roBA|U=9+zAQhC^P>EXBVSz6lRvc?`GTUq-o$CT;Q=gZ+lMxNwd z-rD<d|`;B#(~WNeplNq^Zgr6vS`< z)ig6Gt3j4KAZ4wp=ugEs8}awAjUg~Os23-f5pymgBF7eu87I$(VSZHBVje$Ih{RfG ztQu+v9tRP3ekx^*(fJA22tM&)i0*I}Yp>b#yTXql4+dlYtEiCc&zZrUXo8Su_;3|} z2y-QPzLkH1dVPgZ5iGpE@Va92CaP}D$S_ts*0>0!5yR_F>4$YXq`a%l#;T{I0`TSz zt9XtBxU@#ZH36>(gVkpOiaDou* z+hb%w9Dm}Vib<1v4_0F8Bx0s|h5TkIC?YV)*M)b#=IA4GzG>2MJY62|The6uwP&=450{EhpN zBg`G-CTxi;`ADbMy6Ev#h6H29NiF{H?=jzYe0cPIkRIl@;oZG>Zk|LcXxsX5WF}*> zcTRU~1m{kj5ZV?a zJiqEYA2qCq@8yu|jB;mv-)TKUxlz$eF?&Yi+U7u(PF zgaro$fJ#s2tFEUi+wjO<-7yg8n6h=-Lutb#-aOYnkNn2+?naiKUp@}fo?qS! zR-AutSFSC0jN{4}JRxkla#C5L1&g?5tZKcLtR zl9_8W*`F>wph{~oXc>7^ys035u`DZrd@XAQ`+9^YF>FojXI*h_2U#}Z$3B%ZO{XtCOR zSaQwzsfp-xVs%3+4|3Ole&Y*fu@*gnVsVG9(ScBjm^JgLSN`jqv05h>O-?UyG5et= z$#?n^n0_|*HZ9oedYyB&8#+%R1|covitDbDvjdtQ=Bz%jvg-_smD=+f+5)LH$8|_l z=S7~rs5{DB?oQNGfi1VF@b1xfq%@J+GF7&a6esHIv;(H1riK*sNVS&Atok{4wWkdaW#y#q(8$zMpCQk zPFw#)KPav`ZAtTSx>(pg^}w0QeHTpTPz$BD;iO4%Z;v?g9--FUa|n}$u~4+P8Gam9 zG!Fz72A=&vW~H+bmVR7v%15gw*wbncQwY}T!_~41X!l5~2NeaZTbzprhw8`$ETDQa zI*b(qPEBrb+xThSYJ?{|y(!3?lX5m!qYRjHCRNuG?o@XjMa@2GlH=A@X;`XEd9>59 zsgl@(JOQ%vV-AQ-nT(JT)ZdGTgVvDnYhx;KZsdQU4r_Z>;M_c2J*ES6TMd(*{QY8+ zo(446)>U@+)*j!}{Apc*iL@zH57}Ox9m(tKzv-5%?MwV4)URXHEp!SV>^c>Ba1N?E z`i7x8>xRMB_lDsb=F089mq->%bobXTFMX=R5?HDOI|E;64lXvK2-LR(V|`2NB!Ta* zxsl%yCx*HS-x6_i{sYT|2VRna05a-ZC|b0Lv-8&Jf}-r&uv$ac2Bs-nwBYfNoEcdL zF7%JVo5FMAL+pm+L5p67ufe=W12%k_0mq(b-N$H|4gX9Q10s%$CrM#4=Tz5Q$R05G zc4;P4Vk(*!0wO-xhLPb-q=vDq*@+FB!P>PXZZG#qC%uzlu-`T)49~L$#e1%?QJI1~ zB!{ssA+8?D-Lek8?OES;!jzbrt?0ymI}Q|v@c$7c*CXba^a?$vsj}Kx|7eQ(9?|Sg z(R7A{(H!Q`;07d}DP&Kj#%&Gt9LLcd9_nmmALdfNsaT7;k+6DPY-K}v3b7=z7gVyb zSv_=79J0~L+G5pW4uG?EzZMOiE7 zb(NpSRjUN-78U<%&yCfSv~;KUagqiGf%{WOAjOHuRn3$;&fwM3O=6jBP1n!oB;IM7 z4FCcIceeP5erXzhU*BvS9Qk`RD8^Qt%Z&2NT7nqv-r`Nn78oa)u&fzcyqrUATphsikY39nwp#)Rnwk({{f<>gH1N1kC$Di zk{oo6?6q0`u!|tW#AQwKb4-VtagtRwf^d|6Fl$)=cCwD@vAMO?M%vc-G`_|U$Mjqp z+y|zXZo7|~HD);Gg>lcf3lS*AvU0Yp3!b%dYGq+>*PWBF%hJ+I*pq9hx!Iaoe6Io- zI$-?YOu)sOTXdlx_il`YBnB99ubc@t1sW3SgAlxmZp3VM08PYBbs#E!8%G zQ!$v*#{6q-`qA)BmHU%2(wkvoK>lvmh>GsxpLlWD>+|tC7?_=aew3E@2l*x zPC)i3qhb%fM|oVSykyO=kcrukt+v!`kEE0QU+i!c;R)L#U8NCa^g~09UEO<0!&(O= z)PUi!3CSXqlKvoIt1DlVbxGwSO?hKv1y2K_SDtl)wWaySY8)*l2b|6Yp7(QT`)gXO zR)PA!a^tYfz_r&nYuLfC6~bJATV%(Vb!QX9NTDVVU_Q=^y<@a=`plX(4e;c z8vm?Ex}&aH5;vh!>2zzh$s(s{Z+?1Pa_K^(F6_MT4H&if2WhsYS(JGF@W5tlq20Qi zEUTcOAl@64A9&wlb40_mc3|v$r^hv*%DYjkxIt1w*NG{RtUo-1KeGS+pj_D&V#EZ; zLdp5?KHA@?7ifMsQ4@GH!x#a70w(408q^V~bfGlc*6~`n+!IJB+K^LuS{hgs6A!t+ z@AVufXnp%~7UxL(h^8zB z^caf0Sc`VF+^RG2SnBreFfcZCEzC18b~P;|W#O#7I-c<&jVH+r*7f(_WZE;Gnvg{k zPI4}isFwhrMg*kZ-C83zBzn@Q{UlXTC14a8pDsml4vZTPT_IGHVAIkrJglm-?jQ#c zJICPd7neJ#)`lhD?bIsKQ|6h9XqC{=GxM7WR;#+RuTQ7Vl>L&@g0s18y(PkYB0_Aa zALwckmEYG#Kas8G-;P~gD5nh17gao^b1YOVQ7&yrNq5~-)_xlnd>DjWv7G7sVK@*7 z87B0hG?o))UNN+^T+Hf54b~7Vu;p9S>T2O8_`#;*B;$3F-BH?J)4#VSt9dy(JgZ^8 z3dN3QHR`bFHcDe(N8RMk4r#vZ{n)#?bim2Ot~t`c+*a#cdyaCzeO?Jjeu1x{d%$(* zqF9=!%2QC7=~GY$Ui*{N*qBN1)>4$|eVAI5#f8~?)&n(_>2=-HrV1>*zQeh1HLL6D z$%N4gj2pL~%r#Z_)ujp+wr4n_aFJU0o0*(Mx1yMA>JSowP~4JD;jUvN^8M{RC+i?+ zvM)N7>KE6zD1(+<3XDO+hFTvtu3Z;;Su^O*C?i ztw+A!f^IanBYhb?xw=W6TsA&-w6%`1C%VJsUwoa|vL;wZ);mY7YK&>{cJ}D%CNpo5 zvOak&Woi*#o`kY8`m|!w&k3gq@JUR&_s?yW*B=b|*q>hhT71|g(P}!ol-HtnItw)^ zk7FI)-T_8^5vBKTN**75ENx6(dALk^T|f736=W!O4sD4U-nc-QKizc|iM}x%ugyxQ z$($YZ%@XqmJXPq_de=NJioBe`yilHd?F+gl&>ZFK$lZnAyzOiBTuXdLs8Wd(>9s`Q zBrUH0?weg27Azrk%8#0l<&qaU6~+I*Pqx|wUtMm)Jd|cN89!bPR5l_lpdx4e&w%_| zUgC=dcZ_zQ=^S4)cB67HW#@{eiQEb%r;-^Z%ua=q^Ql}4M^`s5B$E)%r6PQf4pGlt zl+}1c8s!-jR2hctCz}#TdY|9y5&B=}amRCuJnQ7F2<1jXpc36ipks<6_@Ff1BH+qq zDFhhHe>(1?K{ZY&O8)BNt`yKi1OJlG#)H=RIJ(Gf!?$X@TKF+jks-lZ7Lnc>fSSxa z-1@))rP>m}K#ybtZxgy(=5yMqtNl+CApGu%)uoo>k$8xz{NRQwDIC$|LtmBr zw7ThGG=-c_xj`}Ks>zYdP+-+i*xE{Z<6`!55W`OlxOQK&4{Ezn5>>A-R0}Q7_CRUs z`(7iusa-cQm;dN#1a&KyHb%l)<_%ds!2$nbn;C%?DaffucBjrK9Aa`v%*+~tPZrXq z8f(wSKCO?lgD3fJA*)iz9JYbdB$y;aD4PvmqAmZCdbIPaa9saP>1Hz@7r!o&vrvxj zKABH&Qv80U>=MsW?N7#VZ?R7|=KDpuiJ$u)ErujS5tTf#Guv79u3 z+aenn!Qg*4Ft#WdP8&J&z)l;g`=36W z|FpjT=+0MAs(h=WzyDEE-^wJoyI5nY`CG~KvdvcW}()R+uiTGve2C5JpLpx z9|wyR$Giy6J4D zJ3tV+b|T>YD>2^LKSP6;rGt#b3{{QCME`s84omB|^rT&hUH_5W99RST5}PKN1cncY znj60Qq(6OZ)hg>lSMC0sM2we!=sFPX$YDG6=>3M(kf-g>U>dS=x-IM8>OTvbN;b`< zoz*BB-!jZ4L``lx#tNvVd3%D*u7TXzT*#%xZ^A#uRcKr52kRqf#L!M^0O^<-ss(sJgW@rNYo zIb?iGXMT`LG9suWN9sNr+eXd=C+Ko@>uKx(v&~@MjAjvpKkPzlY6G)+E{C z^?bl5uY;S@95u7ys;oLitOcY6j$;#iz*L$*rm@%(s3kTTtm`L1v8_fUkAUrSB%l{0>5 zR7N9T&H)yg2$M-|@mw%sQQK=%*x4Q4q{2}@qo$?XjZBBHS&pQV+C2inm21lGfWrkz zhAZM7V=o+$XIN9qzq~1x=Y1m1E(*VS^#%qoqrWl=>bh+_hQ*|o)<8kaFmQLWy@pb>Qd?B_}m@{YF5vY=EjCpL8$A8iF+eTd+1k( zJd4acT*e#yF?%r98{kdDRB}g6=x7JsJpQ#BxK|vr9(mhpJ(M<76q$CZy zFGFpl;dZnSb`z-WYXiDhQTJ42ObM0*7=r-5r0`oKQQ;#S~>d4vLCsS_pSXMDG9?>Jl(FU)RX zNBV!qD;Dc6ao=%nr7M;N%g8HU9ucX^4<{<^fK^1bZ z3sl;2XLsf6UEHWPYo3%|SWZS;)6bPWpI?<(?@4a5?8V*<5*Nx~=6PHp=WN=Hb5S0@ ztrWN!noy@P;;eW!d z?G(07yXPtzd;n*2s`_U|%H(O#48HaB7u*)4I5t6T(t8)!aFu=;+95z4<&IoM8j`oM z30#(i!K;9oic4QB#x$2OS{lltfZ$J{lsW&J-nO9}wB40D2j$cCDp%vF9L>TyO*sQ; zTk4nr@&;t2x2z;h(mPYzQsgvHXGk=p2hQ$awtM}@p=u!tuZPnMU&OshLUt%Bvo z{j}!_!%21n#$ANupUR`-0!XK`q5^4jNNSCG!~Q7r&E*8sB#Vvo=(G4Hjs0u7lZB|& z-okoRos|-=)tf2{-Bo`BdF4u%5@zo7_|s!8ZAUc#-0Wjn1JK$gY}_cQPiY9*Pj{iZ zAfTRPK8RE)ZOg2YvXBA8DfYhTr)05lVP!^e$tjafY@Fgv()hw245Z($xOvJ zA~Pmb-mjq0e?F@H;zPc6_OKUif<$)Jz&6?T;-X?xLjP|bQ{Xh5=s`HE3)`90BJKh)tFBe!{4g*9_jt0rIbZ8mle$&Wmg-9Wu|U$Nl@Ntl000^L zt^$mB27OcE%W*Am{MxME>Ea(B+{e12#k@Ffq~=y5d!06VrBoYoM0CoFs^t5iMC2pB`qQj z_v=qo6T}lG8aNwGhFVFMD@lf8jS=*g4p7wySi!gk(BKS!pZ1o}{lvtSZ4#j1o!c=0 zz|S~xn4frp9H?FhDJ z+#Sm5LU6DA$5o?u=T;~BtVdhF_50WE3I{Xig@>mKcuq0wt2}Ow;H&-&L9UF6j`gL>@-XZuO1CtX53wqMu* zVcr3*lHfYQ;LwaJ40#N>;cdGOzk({J$1rcfJwf`e@k3gG0s+RC$!6B)f(XNm{8PzB zT~R-Eg5L0;w*)eGFjED=aU(FYy?x~&pLocGghhiApa&MD8Ci4hZ`I=S zQLl;~k{=0}B6|w+DjBWcq(dH2ZCN-az%E0FvkMshz;7|8 zickyH4Cd6wHsSIp%p;hf%nF}Inzu*AS5x=d`+i5+NlQ*|D>;T=ZAaE_Kf~=}s)q%M zedl02#e8#r{XAYgRg3zWsqt&xPReE$n>4_FA9ll+GEtNQ6^7qApRqDSwavL6Vz2+y zFZ29kxxr54ZTnvJ_B`~Qa1a}k{XuJSdUbgp-iH46=hH!#8y2WIXAf-&wMk=zg^#Rb=xvqkwIRbX z*Poo*T7K)$W*As5sDo|+2M6n)1bdxYS)4v&zXticKSRO5%B(X+I|W=V&zHBJTRv2_ zQd-JkX#RDuTd#N;$jGkRss$(82T@gucOQUDicwYz7Nkd=WeYQa@rS$qdDfCE_;iY} zkrg7j^~ahzqY)nB{~EakUR`9pfosu5SF+~S{M#K5k$$^63k#|t`T)xs0zOQG zQ9ItN;OF}rF89--n1A5tj-vz3F-6Rh6m{Z~lr-y&Dh~MZ6J-XMY_v2K^(wE|-SseS zol`t{c8-wNSkkM6i}E1DW{7ZuE>n6!8Pdc!p85n1;(2xBWqR`?TLo!5mnIrCbl=`g z%u4Lu*{^Hib7rI#U&14%&D-USe!ghkIgX$$*GHE<$ww%xDhdQ+ymaO7e5M_&dvHm% z^O2w4xO5g5n;MjA`*>XB2p;A*^yR{w*n4c*fdx#TShPUP3C@HndlIdGx^g;qHWNC& z!9SA9ekRF6tL!3&*s8H5iZ3!C4-yV&|Da~WiCD0<&?K|1Cg@Vv7P^*&|MB>mn4VVQ zTsNsdqjr##D9BY-WPcHz|5oa`?Fz86-<@D~vT+wt|(R-1BVU zWJ{>GP6x5RhQ*`Q;KY)t+R{*JJ~k?ZR~cGatW9_!PS!fA+E^}uP0(RzsC!jfd%djP zTp2aE+h?Mv3}i%!jt0ufxeeO#T&>OiZbNemRiV69I~@zWJm3R)vtY2++~7|6FadNu z?}ov#kzu^|I@?+r8C2kZe;_aN&@E`>aTNl?D0m?4c|hH-m@-v&X<=6|;wl1~?J#)y z=b0c0%Lv0+uFS{6v+vfG3+tp$*hM3yE)UARRU6pIaa+9E=%Y{k^JW_f{D$*L{2*id z-rvRp9epJB_pfVcCnk@Z(T||Q_$d;`p$BVD^bc8kG24kIW2 z4V-`i@&3y7K)1V0Ok-~%?a;27p)H@QJ&0<|Ife9@YCT;ETJ{xGExQY%@hDU9E6G`v z5^wt~tvjfFEv?O$GfF?M#DUg;PX?A$l!wfpCUiPkE%YI03&8y`hk8lT^D4aa7_^T* z#4sC(5Ya5?3Iyb@oKKlxA7b!&?_KX~ASAQUHBa((uaT#2glKSIF>LKGQZ+f(D-L#& z6L2-9QZ78tG^s3FS(|OCkHPET0S0>}pRb`GKv(D|v^3T19@8d>*shssUwKnIcOH6Z zlXtlOiNILgW3&c4d@>o6TI4=c)29=afB%CVXpH;DlxNbOa3CY?H~H;Jts;RW(& zWuKu};L%o}&!9+8P??$Hc9A(nV|tJeS(-hJFv)S=TdKB*KX~h9M?Hi=H})?q&!Qqp zta7-5w}=bcMOcYn6s%<|usWf?8J9MeDwIaT2Ud4y&t*vH3RX-E`YfA;D5&h9Kp&hI zg%oL&!)fu2;Q19W$}LYdp33_G@y8YC-dz&or#2{51F%i$(-uIV=ozLeUu{rFD8CQ% zcDFS2lV4sy6L2;moNSE@o#;lo2q+j7#*Z!DCyteAWTKGxWWK#90p#J1G~FV@NCfkYXdgYb-&@jt`%?w^{ zT#~*9^D;xv-b;B(b54G7&vBI$c1+eZ$9Rb}1ID8@GtGfNfN@TC8NxyTJ`#_TikSoH z(CWTiJF{{9K&+&9^fyNB13BCw5`3t~aKCuhUq+a# zdTl_uU=>5vyQ3{0UIf9_;LMT<9dV+EZk-{RL>+vFb)c_jx1ozg-`82p!AzQzkq|}X zO~mTsy4}2+Y94?+o2B@qxQhX^QqEPB%{fg??~(`ZC7yylYSaXgg}ZeJM; z3J?WLOA71xH{%@hrB zWm_7?oenSqTuR|{f3LgOgBj=yuO0U_59D1(aypdlZ2h}QRIt#@;|mO?i`z*GnDA5o!sy5tZ_CBZB_1BRen|rh3%^xpE&u2--tTpi@%g=V{j47KOTbU{@1El2cY9faO>(3l_ry&55soD)H6Dtldn&yjD z>y}y9f%P1SfMxW9K(im(y_AOsj>iwuLL6&B1U|zH+ZxguK17YW>j@!ALLkUM`ggeL zY%;muJ)xK%gjY55SOs*j8S>y+^KE+Lz&eT{K8F4D)C^_1I~?uCSq#TuNqsB zcdE$Ujd<~?m1$NTye5lk?OuN90tLY>{!WHE%(%)@(w6x=r71tBNhk>nPqg!>mQ66m zr$@vzf05xzkDiL9>-MdHcu2YDu5Rp_EBB0EPEGcOPOLgxny;Vs+Cyp7GQF8@EFxZi zviXGX-=4Gj`4J6k!Z=1jdBS;gXZ#L+BWo<1umJ^1imy88$KbqyT4ookTPX}%f^e22 zpBCLx^R*SKm0iY+<-Z2a(j67coaDI0JY6TU9Oi8H`?T7-Y{xk~Y+fc%}ZB zmIY^FVLTg2GbtI%O(*ELsO~GdV_Z}S<>KKmE=AVv+%i^NV-3n~&lTTm=tPdYT+15g zJ8_`dFC;t4A~L?--6Dbu6lq5}^4+VcrywK^`Rz@=(5SDyhJYeKG`%`%(Wc#N(J7Cj zN~=@zStTC*r}k)5lF45W%sbSx)jLV(++7WulP3;B6fdx|>|Ue9 zMPzC#i17aHU`62FH$d|Xed*|k>8f}Az|P&1_&!jo?KNi}ZpB-wo*tO zsU&2_TVA@AzYuc5_M`XOwySN>nwuecay8s~k40;(Jg=OXp*8&3-E?$v_{Uds5gs(b zF$$(z_N{N8{~Mg>HV4XI=41vD74z?F;(jd;lTC3in1{g3`M~JtwcNc!os!`R-0&Hu zW{76Q`@ydb1S#jsySs1T(mFP)|B|dvf8ddF0)~-~=4}nr3MLd+rz6rQp0e$(z0K_W zkHc_#MRi!XnKsj8-x$gWPVCgtR3Npx^4C4;+)5D~>ev$+_vr;jhcP!Oz zt1$-|db6Yz=mU7ZVGrWN-|@ ztUrRcZt6L9_JJxzULB9=GqvSH_$%@$e$W2(YucS}8kTKrOgNs*8G=$?3q>jA0M=g< zii{b-s>0H)Mp=JeJ?;?5m%mL|PZ?^OB*aJ=rv2kdO_H@W&MozNlyr0MVynfWNUzZ$ z$<57L+T)t2ri$bJ#pRIb_9qX^rWS{d+>?yLQA_jR{dpzuRy?hW)cXG7Y0+`6L^VJ; zPNY;+tB8AjqVsz4%~SL1qvApXb2~;=o@%P4UF8`pg7x`)VL2Fh7L?~?^beg}hA{PI z)%6iqOKcE0lD+pW8hi)XhOvI}ee>}8y1KR^!1TJ34($xhzP`Vh5z1(h#$Wcv`3Fa3 z$+7fSAf3*?se2Y9E(0rs6P%#Xl?!SquaD8i`4DYRd8joNx*(tr)K_K;;v#eT4}sa# zemho}`wlx+M3b$-p3;_<^Sdc(B+8qnIN^R_P3d zgd>6H(F(+tXjXAF@v`n1RGI`AIol2w2gV;c`=QdxB zt#zv&iLhA&Sf$Bt=X)(d_nm}o^$5-rGtv5LADua16ze>tWrK1AJ#drtap5lTtxA@? zT=XeHG18~nU~hDD5u-vNcdXN`@AAZlPhrP)tG$GdQCW>YmaN^6aA*r;Q%D!r`&^RC zsojBG71)8f^;sA|g&#urMg0JB@Ow$dmoAPHaJ2bve?oLmou>q#l+Q22Zwbvlz}1&2 zRA28scdB(k`+#1vBea#K>R@7G{;pwlVo1S^Mr+{uiI~;Khh;5^?_-$Fzi@RMK@peX z7i;_^+s!?Tbw>LkUt7V7VScTF%aQT-cTs=i0SmYEQ;y=lyl^PzL^_@UlsLL8u_X~( zh1T{7;*~Cu*khR}a(UDTh3`KG{W4BX;6h9@FKh16{8w;SYqA9R6%`uk&4)lI9iFV= z(IEYlU_wfZ$hD{Cr7ZVR+c~Kks5qn)!e+wvXCBx+lJ#ECP~;rx=B?i!f>-Yr%~35G z?NVqjj2`~@U*py+Oij2W&oBIY7@nx?eB6>36JdSNUOW8owh$^$H$XkIL zuGrV%`xg^K2Ers4ftb2m4=mvR2m~@-M6y>@jp%*+4T5=g+il`QYutkp5<}dpLlPN> z-)RPPbuDEb6>GpL7?porD%nigx+Nm08Mg&!7$T#N7%k#eb*pFiHkt3}3pKaZ(iL)} zQq&C+yxz4>Nu-ZM<2hbYkI?J73^uGW z@ILnXR|MY_LkD@C{d=@kkxfv^o(9^H?lpdWnBD6Me9Z)YhLL|n)84Dl-M5KpL%&)9 z@v4pW-s{jh{r!F7K1<0zL@-}z>_7US#Z7&jqB3zY2fqRzlL1jsFTqDT!46|tM4R?8 zKv)d){DF74PhTkm+OnLef6t)&GSNEW>KosQfljNvlT7jW(kvMbvFBZ--Y2Ct=3TWV zf=^l2@A?g1POLyv_#jw?1}_c-5umKm<4567FS;W+;l?8R2;6d+spR1Bg{zhpX zf{V$bI$k`ZJ*b7L6|E?*Qn#9=hf!@i03EyX!Bjx2{qtkr@?R!G zO0qy9GW8tJy~e7{o<(V0E%2M2`hUI?N%#DX(>keVMKuJ0@%xU^+FCqUOg1Q-w1?fN zDX53t7+|r1$N3C2Y-GQjacF5sBMnk)X3fvTec6v(aVR_#YS1qUkHtcRAD??e?~QU(xi@;;?v7^jK%N4*y#StGa$!44M{Z6Yp(amW zxU_U~iqScyF`a7z$oDd)C*dE+4Snl0Q{MIbz~76yVF3(9suvi9yG<7192TMJS&hMb zJFa_n56*9&OIE8sA2^k=ZXv(#OIv=C!@bIQFfqLnR}w~eFDQ(&VdLYOnd8QeIyToG zMYQM6WHv9!iy4V#wrzXN;Mmykz9)g$O#2T}uDLD_9`D0u*BxciA6Vf%ckt;}(2fNK z!`bGi%NTl|!89FK++cdG=(7?*664M5dLErVVDQhaM_%xPg$T<(DLbd;Xa$^%?d<&7 zA5hsm!DT-}j<-Rla)Mj5!my+57^gg6Ah>z&$nE52Ev4s=qHOTD4j)|+GvsC&VrM>& zTERa(@2_*UbGqTPP9Au4b?xJ5FdKg-q^epHk+PaW=3k|J&On_B-*p2>85{iWtz}3w z3u&Y#bO=kOOq8J9i*58?8zTHyuIk@Rs8YmmwG=?#D0#n_N5b@oKB3>EKFzD<(k_3W z4f)RM@JD{5+u_fcX^Z1WLsChgMLBEPKfO&GSFPCAQ58ef=u|e2eUrxJs2+8)79EF2 zW_?``QPE0cqJFUj=&UHW<`mnos>4HlIoi&h1$Jm{4!6ba0cvVxI2zjX?)o&&|&L9()j{Oys)k6Kd zhN}a7baXN}POw9YfckcsVwdGe%gF1yo-zu?LmOobDqdda+aAyQK6}KO1)T-8#h8PO ztK8@CC>hDRL(f=^2(FJW3jXp%ba9&_`C+^+jUX})ByGGBoC)7RcloP-utgaPGY5Si zzD0tZq3o$@fhHxx)Gkg2hrz?B7E+*2givScF@Q#g6wbO=9~FEM&qKFb=N-_bu6rKs z0RvdC9PWl@P)uVBA9n3fo=8c>R8b@lq(u{d7XlWdNVu1!Y|R0%RJM%eQCyj=g842O zqG*Be0NAi8Po#on;rj*l#jxhU9LP)nwwoGdjJEsQ@D!9DLNDOM(K>r!q+NCSm_%>( zaB2?=(lxZ_Loz_RSWmH_Fd*JU)h(n+lMH29(4ow|b5I_xaRppCh%2ByRPp3mE-Ft_ zCT^~DZ?8p=V4t47?b}MOG+*FUsf{L+*gl)lWQhW21#zedJ|2fTkV1Nl+1xXsw|gqB z-VD{r8XZImRx4LaT@5LswG`Sks&hD9ZOAYN3=)*WQ+GzMnYW)@&~uxT}p zE+EzYKHBv?+Dks=L&?wkG;|8Dv$N^-J~!9X)8iwQ6t+^u!NTG3naSE(TZR=gJh~8D zltP)J8GU{eOI5Bz3VWY8a#Kl0R&#dMWoUR%anpB~Ppf5%i`C&WnJP5MPBv0mxk^%e z5dpVu@Avzcf30OkaJ9+IH}n)>ms)6>zdqIQRGjXuE`Vg2pyd$qd=(l;Zc9z}Uj61O z;nz|{uIF}OAI)b8Rdqu-Huevj*n*%}Bi|Z|H6G3VMq#F8!tl8zRI|<;*WLPa`OsQT zXnk~-GZ~A|tnp&ITUADPPis;6<2YpZHT>|z)0AC-tzBD7vEicqmbtu%-z9A7ENpF0 zTf4((z)t`)7?5k0Zs);FBl*p@^yS#;O6x2u*BLv!zQ--In!l>JEn%+fL8=TRB|9IGQFH6yV>E|smc?XgIgtWP`(qh zDcgtd_b>SLtOS1!=#X?Lc@%Gpa1GdI$O|?3or5CJ{Who5ALLWVQO=+gKo zL?U=*uy4|_NSDV~M%xXx2f83Lt9(xbZ)`_q1B_phqk%95l-9pQXUqq^K;-xWDgbx` zFL4Pecfj7)A)a7M4rOsjYxX?Qe!&NCvtvQKfZF&41al~1WrIMgj-t^-YmwIaW(Lm7 z-t_HE!wj)oeiQf!gdd}~yL%rWJb(>?kQ#y~=zigl1jQ6dj0*{<`x83rk`MOZg0FL)Hq#QBG zeP6_HmwW}XW%=5y{Lccg{4xJd%4dH4@L}@!OZGpKpV`KIGd#V>tiG1%wf#HKSWNqo z$e+U6v62`pzl3UL7Ea513VtJtdjU%@?0Cyc*3J~!0>zB_H3ujq*EYH*pI{~z_~H( z6P>ZIQofLW%)h2Ta&My`U;>r;oqJUM)PiaD!tV0!!X(HxXg(@Wd4^%`{9Qs{-U;Pp z&1V$_rKExqoyMI5dpB9!l3=sYOs$zv8N6>%x5$NrAjyXtJ;+Y{@hDm|48 zbkwnO6oeG06(_%w3x0u)wVDOG#k~Ij{U1qzcawWDtRB&lc}p6sII4H=?5G9PBHdMH8Jzyce)#Ff_{~Eh1%GKkP5^$V)=Ze z9n`BMWm-?%7L(F*dW0`W|5`;NN8ibOL3;r$S(j9OF)IY&e53V5KPTRrzeIgOpNjS) zg7ju?gB=_`SO#kY5%Wx4!92MD!Ezv9i&px|sC*Oi_E!7NZ^qLSfQRKVsl*`7L!8_g zQNmQgWD0G}p{D2PW!MUIh)$m@hAmSL6IhNkzzYlb|co00oZ7B{wY_%Kw0#>_cz8Ia`9)q^~Uo^6V>Z$V}M z;WtIpoZMSS^LGZDA|*E6_oOT40FzU49y(uWNIvEGI|TR*=id=D;TdYU0oaDa;OLr> zdO|TRd~sxpaT5;rCj(y4Dsjhwp;gch#q{QHd>cnmcdlYxieYwPAu;G5O-fuX%Ac04 z@HBn8`2#el{ikbVbWZq@X@9k~^h4))IxtGNPJOz4R|T}JeM#fS6it-@=2H6)yhKuhGKVgRwuS4j*3poH?GE^8*<7W7)^oA&M{9N zvYZ@%q%nK0Cq$0hqBHr> zE4aFEn3N5Ilrc$jSOJf6jH=aDIrM zIDL7Vs8g?|WlFa)_;{nP#-B?!65bc&{8=aDa+5>qz7Z!4_Do9VQBH0Sl`6tu3pFY$h2ROootrp~cQ5n_v2-1@nNMTcW8pOo*XC zqQTNg4OfSw;^BU-aA7Hi zTR7S=_*j>Yjw>|;rO-9~ap{=ppsEZ0KrrFpCVM=4U^e;?(h3gByvW3SmOBczEt72Rrjx$=fk;SI#sx2sb=8bE{s|OXUBw@;=D&kR%A#9z+%F)T#hK0+!wk=sX z2{dRTwR*}#8^aJwzFO_pF(doxES#CAMDwxqQBH60gc{iegII*@4JJv*wHuV1B%SK* zO+*FX_6kjeFNov-0G{DJa&dEoPw8ND07F1jc)j2-9=I<+)aHP#6ak4qb(?(8r&-%u z%B{OgIcuz_{$0I~_xBmHU?wv72f%|AW)G4cj%uN$j5CjN z_eW?16uylM_E{YP(wW$jz;V*8r83gqd-NpKlPE&0%d3?NiV0JCyly4mkxv>bAK;}I zpY-0(hs()@t44Y}6scYDnp>9VOnWH5U?!Nw7+$P?g>G;2HCErfr7!s1j$;>`rZsKy zKJ)e+KgtotJ6Z`y_+#1>wP(L(;KwmXlc)7Vv83cdiTE`oe+EhPjF2-3kt2Ur5_wTh zHx0U`--BO4-g(x@_r^Yu`8gQ^)%q^?XzekU{5khP_57{&$lAbtf#WFnX~lrFqk8rE z@MDLZo=Q_fa%jyG(uEN7UNy*GNDWSW z-!T0RFg1m+vxYE>VK?;Jon^;d;c;I$(xZPo{`s%L_J3tbXJq+Lj?zm1FRDEk004a% z;D2@Gvi^rI`TsdA8Cd_vvqF?@td&$ScuVnHJ#RJEZ&qlgYPzEt4QlYUUcw^yFru!6 zOd)4EwqCbReRkqbee7mJ_)CEi1}08XR6KOy;I1!jFd^1AQv9>p^GM?m zoj^3iX-Uvv>n$Zx=(fX~DsQWD*`Ng)`^#Ec0DHB7-j1mDoOkj zN~9?_Siijiu6XZ6!a0L|_LM~Cbsww6xmN}5#Wigr4l@!KqNv>L&U#=JiEih;COR=Zb=neR?zcJhaR z_ouO+p60Od))ltRvkN-;Eloq|d`1QyZAQ9~WW|j3^(> z6FxvV1}@5232jBOuog{12hG;7PK6|^ac*EwH(?3Ak1)Y{T#z{kKfH(#+6v=Knj{V# z#E(3&8Z^ZZeZ0k+ZZx8Z5t^Mzojj4eA^uycja+0w8R08Y-1>cD>yoJ6jPSGD-iXKn zrA{w$C_`=dn@DiqyN|tr&;( zoMuP|0po`m>zapQ_V);sLw7Xkr#WPn?vP0;q|S59!K(VhDS}0osSC zfpw`Q2u7#8pG}mAcst^@tdrIIHi5p540sC%U(b_(gT}8ahEHn2Cym)D2M1odpPy@5m`He801@4r#u3ZhNqLZUCv1(PuS zMtakemd5L8eSqjWnUPOg#t5z z@#+OEpx+-9=g2Fhh*(x!!b-i`RSQxiN}sZD-1y+2e0hem0YdDN)S7@DTdt82Wo$Qy z*0^c+=`5xwrIFae&33g9i2i?Ku?Xb~;)u$^%6j+9z(2~X$MwyuXld5xWfEdl1{w## z6Up2eMN9%MTXN#5-suaf#)Uu<2vmqc+s93t{uI@^@XjJcfaSu0c55EDFRABBI`gX!2a-q(!oJPHEwyKM-Kf^YyvMkD~KgTi`E!bwJvMrQHr8g^CWnUDxuYk8y z#^6m>(VLWq1+2Ny8Oui2xOusFpt`e%AD1^+8SeT4pKcQdG(J=wpXXV#B(fz8aIiT! z>#sZgbu_+2HZoiB0J#)37<+-GWX7PX>CVJ}xJ?wM`lh&Xs7?!2FND#jkw*0g9MOEW z(~|T(VD4l8riisIRV{G7W_6G5-p{pw!}mo&1qk*mK(U#Vhx#oEqx_KogQX0-02q>J z47o=?B?w>eWE*iU6N8|8pxs^QPYdy@Qh%~nr2-6z2n5rpjh6#lojK>`?z>;DF@5yQ zJ>s;u^{HxU;q{OqZDP(Q8FnJGf-t~OS+e-*7~F2#`t4^eGFTiOU!Ts4)~+$#(8C57 zMkMrt)`K6uzM=0ZxNpSD6k(l^1|KNfD6kmQ#3KCj;nJZayj4TF}2EYL)J=)FnTQMw(%|AQHJs6to zSs}xC2h2F0IzqcUOw)m=@0shnv6V_8*kc&u2Jh*Q0)JzqDP!ZTcj*6n7gSX>si*aQ z>=jVz3-95dZ^W^?SFk#}E2OQ$aW1NDJ5OFX(0Ux>1gbpH@vVgS?Slcqjs2xIvjG~D%Y$3yl#2 z%b~{b^D9jXX~X~E3?7K%lpdsvs%8CVAR~UI=p_eJUXS32@xr$?1#XvJt4}kO^@{?j z$M8iJ8x?MSPi|!y9ptLjWhCl2-Wz;L*_M&Oh)a?rGO&k<5tz#3w}E@}3mJ(fOiR6; z8I!Tlb$l6M@vme9-ip)6fdy%$9Yz#a_wOA!5+Sf-9RmJqe3Lfc(vp>n&f7U~h}&&4 zf#x>)W;YSD#lmQ_An{W2M3+Lk;jO30W9jg!9wT=y-XH_8JvQX*TN_Q6WK=32($ zV6@YIynzgtbuq%t**=heG}fAoE%OTV3rbS@`HJpUJQ5jmfaC*X7#EDy5d53J24LG$ z=-*0z!=s$MkvHX(n_)+8GhHkj)6+1jGIsnPLVHoqtmHv?)!|b`lSz{(Iyr&y+n$#c zrfv%b{RNI85bYDXEo~VN_kcJjVl-z5L982AzldMGXKH_%kG#_VlA0`1ab8=ugrV5o z;8@;Sk9H`qBSwxiTG)a%Y2aXPIG1UwDtXD&1KePrknC<)38;4=FYTJ)9{%PoP6}+1 zClNH<+ssXO+=$j_S<={A5Vn;c|ofjXVj%x5k_S_^uozC;D*zvmkDqW;t9W zmrSeocZPYy$2&US1NLX;FfLCvTY5Eca;$t3NA6D|xl$>nHuBxG8^EgIH)ytEb#ecg z27+=k3ap7rOz->RRmNeKDsvIIn~8&*n-`yx=gs=(4GeB}rX9})S%~drLQ6o(b!VzQ z%HCuj{_fxd9Xx(^cEGav-QjQB`K8jXO@Br`pBH*N8v<3&8zmDVBq+)jOAq$Fm&k5# zH|nL=YAZB+;^)d7SI6XpQ&)JKHaBuT_K-ue|*CSl27TV zgz^nxTrD*oXWwE3VnHl1;FA*ZmDa!(16)#RO?E_dmG}ikn$6E}Ns_%yY1` zlA6?2gSSh>>)+;Fl!(DHBvo~G2D&Y4X;>{$u-aG49XG6NqzhV_HPnhI8k*S+CK&~cHBQc6NB{A`Dt?9}~ z$Py|*#h61FWPQ7(vvDG%gEvYvMZYerSX&yf!b(X4eI_>QvAz^CIu$%Nugg=5ukQMd ztzi7Rs)D`N|L`)lXRLo*zNy5=*$BxLvWvf^8zKwp@s44Ft0rEDeGVE4IB3irAxaHJ z5*anQ7A>zRS}QM<;O`OH^yLK_M#=w0WQ~Ev zLci4$i6Eu&VQf39Y7c$5*nWN_Q1cMY-+l7?yxBhCrDM#gb6u{yl=lyNV9tW++6-~5>dCTXA_sI zVzPj!)7ojJRs8So@4EKQ*2c9$qxK)JvFS;MHq-Y&B}?c)P80D7cueA{ugeeajOn#m z9SB3Am=&u&UcGu^tss13GKbz(#vYU9Ocx4o-eO{_3>#O~v)PqsfxK5Pf4RPQsJdUY&Rx4!cJ|LmD>19g3u4puN}cx`H-<5i74t@R zwhfyY6tSBi4p>iM`z3ieixw0rtvaMrPBvD(4@;=I^2|aem5K=kO(LoR1V`~NkLI#9 z^>eK4*}BhfK8JNqnG#8fh=P~Yt8EXeHuOzVO)4GHgi3!n-5DbSvqw>m%2lE6ZPMk7 z{F5rn{&Bn12>dfIpUWfMawjP`9I*V@OwfGC(;M1*cgcpW%Hp29jcOsbVmbdf9ss?Z zS5QFS$q5yODSbnndsMDZTn~A({-tx*wOYVJUKrm^pK>yoB_tR%25?Wh-i8>45T9~w zL;SldW;U3%Pc8@l!%PPi86n^$5Z+km1E|U#0ikIy7R*XJW2UQeyY#0{vKG9$=oPAS z1f|XllK$HC%xDwsc>i5w#B97U6_5#q)9hQ3D6Sh z`dPMiOVA^4?`n{(VwNCun{a2Oh)M#Ky^4Ti;ZI4oSxGTRkAHqz06*B`^Pq2F>hhz9 zxxRj7`_-RI*Xs`3U%Cr?&v3@=e_w!hq=yA8HPDO*`fj!&a```G5oSvV&Z% zkK*d$`Joy{GwUIlQu)y+YZWqNdfGBh;=65{B@Qbjf(1ruiybDdhzm(2x5`2zgTP*c zB#dM#4^(g9P65)3YM0u_6T%-ohi8FrHh{X(s8T~b(2hNPRK?8OA)!((KX6ybAZwV} z*GN6XVBiH{u&OOsS60l+Md6DV;KC-alg<@iVl$^*S#QBj$Mo`myq{S#wQVeXY)9kG z8#}i0UA%05>}fb!M;A{MZC5U=TRf%e%DEhhmb|PrsaP{$*;Fz*_%_;wN^|hjGAf!` zO{li@oz0;umjPb6HHyr1fTM(I^7|#w8`3nXji+v#Uk{z_^h2j+GM`jNByHp@Je5=m z&&yTcuUp;h`I@wzQD?w*O8e-!^C z9upD_pk!ujMlf$AzQUId6OQF&;e^oX7+VQ;svvoX+^7Y`(FZ=B#xbe;rjW|JCm9E?*7jId!6Hf6r{^VpWRRq3u9#=kfae2;# zSNEw0&;#(uArQTEtImUp1XbDm2qYv|{|I`k_u( zUh7&;T7O>x{Fw0*v9khPj9)&-0ep?In>i+|^^bOv<)V49_nK~j+ih#Hroo+BaJQYx zA$N2nUPDxOQ5eG-0A!^l5LxiY(rVK)+6=JS)ZMw)IOeMD$3J|b??TS&fu&C8n{$Hi z;fGsvH&Jhm@J7fVpD(Vzs8YaZNt5>PPxv)RkwFQoo>-BeYr#ed%NoQh#iOX&O1smKpXL{^w zq)-XW=Fz;&Z3CWLkZphu2ycH2%ie%`t;1Y5;Cf5!UWrd}FHeup{vK47m_3kY2H0kp zUyC^#^*k%Pjvr6YQUpqgv{p_n7d%{DE)_hpve~wDde>vy<+^;Ze!F}|!mX{a^K>a~ z;2F=YXjWaIuBKndB2FDw;B~k*+W7;#g86aYKu)J)X5FZ~n~j6XCyyPkezn+|Y`@EF z<~vybZ)I?g)M8ycvk$S4t2!)zGO3{^r)%fiWS$sg|`?Oj8=3>eds#4x#= zcW&Q`!qP44U2cUzG}SM?2uB54Vek1tMkeWhitWz*Ih)tq*+6 zqLtKD7m--q+pK3_^C`RYe!CbIEM-=Y`W2~mxo8s&G(kRIHm};W`_p8I6U!sa#ZW?L3KS?kY;QRxHHzYc21^2L5G@C znw1;cu02bLa1MB#E@~B4(xEn~l5w(H`-&OEvo@vqF`p^`16vx=K~|&fgq_Vb^*d)x zomG-rA+H+^-eX240&%6wU#w!ijp-kLw09q9Yhsk&B8N=RTO)4O#S!h!o^%Q6lg1}V zsIo!*8VdVMmpR2bW@@UluCBQ{IvksrPk20a?n{?E4NdOBp=wLedb`A>kI$Uh;6>iu zvY0nKp>8_z5%(3d<~FSdx*jwYZAo6sne~`H1e;`QQs0t+M8OjsfM?xf9||1TmxR6% zV==;kn!X~RE`Oncey9W(+3bR!akO?n(5}NUxjA=B{`$lr#F0|u9=b^EvM=}sR$wx%IS;pg9`!hn*OymFk!f%fZL%hdPp%x`Ba{0kYyf_bYy%X+`9OC%5PyTR z009=kMfEhhR5JXC?!T$M-|uXJ?8yEEeCtXah9~n0V=Es;rOuSu-S72_=rt_{J_oVq zomJ(zpQmc+W|rM@J23y^`2w*+dRaVU><_|{B=-7jc0X*%dPjR_EEx3x(u_`E-h6!* zWa#Zqk9q|U^}&0)Cb#5>5zWI}d=BSrf13QfpUTPq|V7xz9+ z2r>Kudq4&$-vzum{~Ix8Ws$=Zac~4x83V45?e;T6yMb@P3;q%{9AxeDCUJpV;TIkj zD3xVRON)aY}fr@iwEV2m~sat8-q`! zoX~|kw?h}fQHJx5?w=}fga}oQLEBdk!8mII)}n5pjsee#DoR~e{I0{N5PmG4%H{2@ z`m(Svf6*@zoccV$M@);LyUE)Q%&yCHAE+F$P17%}cd z57>L{{S?ljzWi+&IQ65xq8Tg7?2+gk_)=JcZbjU6R@pmx`dyI+yB5t8q(6k}g2W$; z6LL|LYDpwM@_hh$Zyux1MCKtPJBW4{@UDG>y!S&K8u4bh!1OjpQO;jVrwZje4#yHVpU@a|Dp&8Ebo z|B=6c^(2a{RMV1}z4eIsY1QHSEvpfu^ZKrgEJLYqR7sgAv6O#TVN^Ns z+spK~dR5VjsyM{1=~T(Qu@JF&vZehd< z!LwOZcY^1nZraxl=@!f)z}z8e5-9_YgRo(AJa~n?CSnQ5L)bw26J;LKg3=uq9MS?a z19=+Ug0s>^(3CPJw}Y}lN)%NlU|uONPqYV`xk*AE%qDu6II7W!G}2jQB8Xj>v*57u z((kVRQ8qVHruSjAL01!aUq(aK#E6wl8(BG|-~e@_+SWNFLlH`2*xMEn!y0jjpjOC$ z6o47krqKnt0=j0ci4%m{J9)zrZ3~29P5yMg4OVG*5dVilw$IY{#Aqz=s|=F0ke~@G zBo`m_ZwlBq9)IT?p80CNk2z|MNZ&=!B|~SIxus1Ex{Qz&-pNG*xGRomW1TO4lc>Hc z=#7apM338`IC_<~zXmiG2*e{wP%)5+!4pAMrl=Q93P9~&cTpKo;=2 zz`7d98U#yFPcD6L2+a_#)mPAf-Y;I?XM`s%KWeSN8rbZhLp!t72-?J&$06`$6mUYIiS9_67ET&NYA%&^=n__gjNMsen!tS+WrdoSK6lWZ#+#r(-i9Z7-s91c7U;TqN6~AyR=pA zh%buMGt3Zbc3hQb6jhtR35I!n=N;9?m~NGIX^x$AQ5^1y>og41h2FTv*>_E+9J2+w zOYpOVV15R`M?bI#WzV`5*IlBtpvg8voi!Ok_Ok<5D0gh5rYk-Mk^3@*1}pz?KJN%; zRRFS-eWGXuj#>tF-IA1U20oC_Px}0$Ym=rd9*^&9p!XwM|I=8@I8S}77cG8SjXOTe zcMGy+nxru_^Oyp>K0YwH4Y?q*xV~3{C$9{Ah4a`xH!g1Q{$9^@7@J2Yohdf(c@pkV z{m`2Hx>tyYeO6H);{=7?0rS&q2ed1rgz;>}8&qzW+1p|R=&`dtuuF9Vuab=0`4qI0 zUeNeA0rwl!D#HYYKeNUetuZdM`?Q9+_ku2+yuIj}VQV{}Cvjc|S7m$4OPU^;?z=kO zP}QD(^jQ|**^}0xty>t2_X20vCiZ3?T>iHlrufMl-p*}Xy1bg#RBNMB1^}9i(o*0U zy=uXl@$)s=iy!(V5RXDMtvsWjfwR?DS{Yv zNNwcRl{|Wdst06@GDbx<%;|bHchKdJt-}%suowh9%i4kSKnO{|NhqvUp;ZAEiShkp4aT(->u&W|GE}3 z5TJm%@5b$yZy z&;62kgpv9gYT-1Zs5O$h2L~4&S0WLO75jHQE2$sp6R7JosYct0*TDEqQ_L%a4XkpG2ogk}@)Btk^Dz zdfDP$FNu3nARkH#cRV^oAB%;J(!2JwMKnvB^^NxK-reT=*z!zQL6X9voSz&zrYx|p za8LJpz7g?a8p6a$5xJ+wa+}IAq-_XTA8${HhCGWT6@D6?5{zA+>7J`D)y3b2j5ow- z2)r-ij+_O7KajR2*d^U1XieIJ=sV#ZacvLb!rsU8;fdbt=+6dMjYF05*E;3a zIdZ9=5;z4nvmiGtH;(#XE!fSyumHGqJG@p^Tehu(%gz21l5%pPDJx6v2rDFbLsN)? zvosa;q~TqYLbrUS;iFS}bawU>i-a?mR-7*xw&waxt}t7)#k&dw^;jx-ut9{ivNQE& z-{eJ@Y$U7q#;k;~VB)X#cqjaS>KINllH|R<$v!KnAJEIz)jmdy8M} z>5X5a4tlkmP4#uv8T~&xB19%k-av*`OTh0XfBm zt1xpG1!gX1+8Vz1fZh-_3n4MO>>{}ifGz6oqf;@iX4;yDiOtlfGXmh=BMdGdom)0OZphP*p zyUCH!i3SD=xR@s`zY`$JVFeWnjF29K}G75>8mQ!u4CfUx3`9*ui=<4Jvk0T<%KyF!*B4q+b~5-BVg`oOXNNY;~vvC1>)6%xnDz85o8F?j~AJ zc2@bM$UFG@7fZ2>*-%f34hx!*6;1z+JMx{HJBYPy+?K)HTAvtLzYOtEoVr6k0fO5| z9Y=Y_djw~4YEsi`kna7#bM35iAcXmMr8OEcz4cPdLiNW-O_p38;F=G#uQO%K?}>yx z(8<~BGnt%|W|00G1Z>yy_+1G`Ds333JKI1%a!-{>rdYG36m+0O`ZKDy0mtDxMD7Pv z?hLpgVQIHq;2lwJj7>V@KeiblzaMg=e|Yf>l8za-jHM=UR1v3A1W=oDJ;~`0PIaU3 z6>C@URU|~srkqj#fEmNEyomcq4rs3)_s;xsMA@`K)eA<4#7c9<-XYLzM0t-5AoXfb z)A7jI_vLDh9#7{qd`5gB8~@+_b1vd3rXJHRtD>KARG3IH;TUVDwrm-3;oLUJB?c*! zsgf65lPv7{?t8EDeu&vX{zRLkoxQ$XDFIGJJqg#~j*G8vh}Nz4 zyty;--)sA&9t2>gi*6fpQVe3z*yCBOY4qBqyBLZy)eMb>V*s&WfNvPRp9_(X2RkTw z8q*~;x}A2I8;p9!Y-KU*XXM;0vxYQHiOt;OUI*&1%_`Q>^ zg+ZuY&A4d%&vy|-Rl zppc)XC-N7bUc%0j`!0*E}kN~R3B9*k?*=czU|;bKtvA* z+;uq*`G?(>jKmGL*eF*vHTBIfNsgPDbI8hTnqu`@k%e%~L%0uo-is>ViBfnF z0|^NIG+hp5#sKb1NI%Z{k-+}wLh{((n64jMk7`Z zvREc~pd12JuY#K5zl^Ut2iwJ;JF3#%8dYMn38+5T`ygkaCc0;}Jg{XT%GhfX&{z)v zC#g$DTQV}1^XTKT&wRl9ItSk2uVPXHx0-o3a4>ME3f^Z+$U)vCIdWO$j4ABu+@9=Vv>>FMKFae>Y^+=OQ&}ZAm#ih z*pw9yuO}J3$0hmE+DcQ;?iskibou{6P)|zhTS!z$PESyeEf8@>!$UMWO4l8LfR!=->2`7W9hRdTDEtbs+>d;ZA+JjaUySs8=C&$7CesLP zN$3Y}cF>p-#fisDMNL9x?)0DH?nbG2kh0NaPN_=WF%5+kauGRS*JY_d6(OrrfKf4I z!iA075BGGlzG)LwIPR%jtNl~0twKvZziynSdR}pMk@=A6SW@-`O;OEhr}PI)Ec1ln zHfI8-h2J5Z?=5>q4}@#c>!ff=qh`a}1tU;e8d3K2;=KAhVB~&#u`DvOe{<;o^`pzy{J01WG28#br{(9bUdW? zPA3E;`n&O@56j52?Xot!&~juMKLUHXt7vJifgZ=SHctb%ypta+}yu8!KA zteYAtEQ7X1)|tU$s*J0Cfv$(4x}JU0zw=uc>&^6GEDq7M+a8}5lt7-|GiuE&p& z^)nH+e(qg#Mo9^rsOXBn_?jM)pSqA3ZnOlwK8t&%{Y~CWO*6x{4in}q@`o0uE~(PJ zGh12;$!gJ=S7b*8Tt25g!q3C$Hh%0e#}~O3 z1|O<=sd}_Z&1o*XG?=S#c9{7wc|0%$Lwjcrz_l#ZI=KU}=^rnc=|D<7-SDzwjnY>K zmpA+SUY9$ot2Nv1zZI>O99n-c`Un*O+P@yNMjyMW)#Nf~wu`c#p0r7{>Y0ftcgdOw z2=xdR*p61%;8NkTg$r$Kh@@=kTjWPZ0X$Bwa%Sbq54MJ1xo`9l2P%3KwFp{_=gjZ+ zQF+$3x}4(B3%Opr=!D~hc5aWpk#o7;jC3sghf5y&VY-t<@OUvff011Jjpz0vs&uhHc732xdQS$PcP{hN{9HoQB9a%6rA~K$_7*x! z#sInBw%u*eS1%%yDiLz;-+9wvR}%5T{Q<{U%W4{`+Ef*DH&M`oUX9GO1FmIxHe0c) zx%{lOsJC?&lxOl7e;G9U?Y=O9T|aNe^u*ZR+VrAJQ#c~lGbME-@PMi7|Dw^qrcS{R z!<6VGkTG+q5s%Z!SYHNy@4=vY_w^|Nc=gXi@!}!9inWSOBr7Q7Z##4Y+wkz14+!9= zU#6k$92BnE(UkmbWgVqc$tL92tnIy2v$XgosvWzJutV!lc$I!=J;B62p=-ziDyXPOo6KM%9gJByqbT06sBCwqR!*DG9kk9(Fd3X zqpFSH9_2T3_+t#IDPIypsVo0NMZ(K&wl!~Acoa21c|eGg$4K>mwe}T2ZFb$d{i+{O zN(C*}qNTVK2+%^2;O-vWg9WFBwpf4?90Ih3LUDI1mJqzq1cF1*V8tCS{m;F3{&Vhs z&pC7F&U$BMXV05GdEeQx*0c6r4-E>XRdmjvRoB8_p}-btnq*V@GftbpkX+*!RR>3&q7ojt-#Essj><-vS`&fbjuxlpzN-Nf^pXc)A@XS~8*^n9 zbE@~(dzfjzRLR0=01=Xbl6rHIjC2K*^cnqpd&e;{9QinlYqA|Q^@FhV=nfG_Po0HR zUX)p1>rdn>%3_2La|shX%0@4PX`O92*m!W4Tg`?dL|5_P%e)70?Jr#xWQXD%fF@``>4HS&og=~BTB>+s7`IxO=8qo z@j+4xt$nlgk&k+^lN$Y8+{KS8V93s2Ap~YM(b6)qPrhti_a0|GW?<%i>O1w`wl-`h z^{7L=k1IIYY;5(W_)4vG+-ou- z&)U`$+OfT-dtI%?;WDqlNpYGl zZB(PP@LZFEf+bYrc@kkdE5PpYQ=)1FJ<19f_7$pWBc0n-J~Tk6a#YKf;I4ktlCjkthrhpBSY>P7b!(y^awxNq76 zsGhKTsRutY#e=N^H~3LU+4stuKRAtTj2HMVF!S7)q)1FzLE5tC)o--i@Zo)XQuf1> zXZIns#-Z_){ieW1uG{$Qt@m_93#ArwciMkILhnzBihWM4DH>^W`1|jknskdIvzrf{ ztrhR?k}t)#d8%tUy>NLuso8heWY6NZ;P{WfJ`264wVJ;@`}w7otcsQ!yPM87GkRMR z`o-(ZX`ceae3l6S9+1+5=?U15AJf`y4tx2$-EWR!i}=@HV$pIn209)Lb;?3dyWb09 z?RPL^%2~@Z(>pz*lvSVGgMq z>kRb5y3zuhdu`$sLy5u9v#KG`5|eVagyfW9usWQNNTcqWaP}2FA!=TRG@8kcJdMXL zbzxYsD_NuS0T1l9A^)Q)2e-PhpihO2nuTpk&J3J9QbOBn6@J|JXryI(_0S#Mb+tx? zWe5p7*{a+@t>Dixe|@rAGQmX^C$*lPJ?tc&kcy!$XFxpt=#-3c7@$iRd!-87_nmIU zI`s}_-g*#PLnbD8M2XD(`*R~usq}l{j<0f8M6hDK?{jmV7$l`qqAx4^7lpzu+UfLM z9n>@h>Fv{`V&=t9%9o0h3RSBv&@I(8r_T2}@^54CoTU%Z@ zM-`ek`Be{pi(@>Z$@!u;<(0v*7I9C@#ktv@_@&-V>vf)3*xZ-gevm%36CqgtoZv0; zUN+_2A$%4S-zX}rJq*4gwkiyN_%*6aU)Bu8>cK_!_dEHerTsyj^;+2vCHLUQ+x9UB zwE;=ker^s-7Tv^fTeEasNUq23E2%UFy1waJ8&r@)c&!D(X$V6=+x%jD>r*J*u0$Q+ zi3xIyf@+D@+!w41q1c_Ijk%}FxiE89FgvsF9B^NG3;VO`%e-?w=g)_;8*Z-go3Xp^ z>X}1@t1?c3ZC}0~azg28RO0QT8$tjZF7b=jt%99Wy3|*kiwgHiUZe*t7j_Y{nR4Dy zHt`RuPfBJDex0SS`Sf;(!K2GRy_kApz{q+C#aVKA*SyD)WD~u@AIqj1!i?OdCJa?7 zvZZ>$7tvqzSG7WsdXusNk#B&Z@4D-i7>vwj*JkV=PKm@#S}e&upWSqb<3N|-VkY~6{245T$#-hITVEbmJPP?SSsXg;NOt7b>0_V?%U-%ZvAjN*_IUpah4hyb1W`1 zTP}5nAY#O39+}2;lcLyhN_|V8a*k$y?73;59`vc34$sV9*p^hBhOQZ225qP^Fm5t= z5k_!M{!dPLnXX)pJvX7{{v1<=;vo>9%TI&t>aF!x*g|XgVA9ogH}07tLyq|fCfZ8| zg<2$E{c-*V@LdvR&CqcmBn035H1Gdh+3eOm!U^GY*F^I$(b8l30_=NY>o)S{kZ>eB zwxtgsfpX5+HOzW4?%G_Q>mQ}82B!v>MbKm+uZUtR+-4`D?XCi|4f2VE;;Yp>Etn;|(!&LCMWZ*X;}yIoZsaV=Ws1lMu3#J zQpgmMeSa3MX8b(-D!{%vGv!1ivox$(vo1O{Am(UY=v@nPg=Vw!;;#y`d?GqZVP~2t z-l(==hnr1ZP!5+pd~iyEaz4@h^yNEk!>oxrYwdQgdSpa1VI@gk}z;Llr-lN5>j94u!-;U=r`Tdmk5q@$_U$;BK^=aLUo3VVV)E^gCnfQ4 zSn8SOll#wW4)+N-;Hlz}BV6`H(~|aP&pOwpO|x7sN3dV!lEaj-6@RL%v<=KYUD9xI z;Oj@QZ?clg!Wns0qO5B?C{P@GaBMr=3Olu4d{lK5)<_Ce);0BUeS(U3P@qs3+ z!)HuDP+pm>wpo~S%QU7R(PekH0lYd1K^ks;;J2;2S;y}mdHCD=r{SASp^tm@3i#$8 zuWyEWd7q@;uRu-17puTti7hqf^zFwcB{v2n(j_O}Q2^CBgQ?Hdku%@Rzmrx)Y{)v2 zIm@0gALp$T`y9HS({~;CU=@TKn|7drt@kS0Y6TyB6P~$IH1PV|Snp$I&ldrmqxTGq z+~8{IWtvmDkETT^n&LP=O3x@@36#)9)mskZ7q2K4r^KZ}uuvT>+mnpW2wr@EQdyMW zNB89JT}PKj6$G%9(@Rsv0NWhz?Z)e+42xqK6E zpENn((F`l%$b-rk-8!r>9{Fi@As#qlxT)-IJpkY)u6rgtSm_md5+GaR#5NIQH=#C# zW)6uM=o)EEGmvTAZ>Z66zngr3>k*oAmoh60(G38t$~HPpH_x1>jh^E3R}ouh#T?uQ z(sE-izW;V`I{r$av&gLrx-CpP$*L=GLe-%`ha`A=yGz$1*DYjY^bK;|B`<4?O#P zk5-ha6t5iYG`__$FGuKj>l0)`TM&@o*p{shJqHU%y8;(BL{Y7$OP|)03~pgds?XnW zWNvpI?#a$}GaL$1Qp>tDDbf>%&lOWEkL=Ck6Mxj=>{y!kz+jiiUAku3XA-wp(*|Ywq8lQ*j}A zSCGoo$!{1FNuh!^P+@=crPG{)5E+>$R$lnTHU^lC5sk=Iks*Ig@=eE+TSTc$kFEVW z6FDS@25KPs2xDucBmG0^P1+Au(^8Le+isUG@>Iq-J>tKxw|_^>y%Z*YlRr%P+`pdk z;3gfd0l9Hmq~u_kxH9bbewAGgV_scVoT%NXajy2O(+j@SozVlY{fo7LixpdcZ&B-9 z1^~iz+7h){Z)LlY3Jkeqf7Q=h-%Z1K5c-W%yJ>el+SBAi@ejt-@8*sExVO!tZyQ}- zP5jks-qKQAXkA!`B??K9nPC)=bo3S| z=IQ!|G5mFN(tf3DM!u4N+@2u{jdTWA{QUiOUanKwxFyxcPm?0h8|^R<{jwp93RQT~ z$zrP_0EW{f^ru=Qt&L4;yO+ub>P-$scvige9ZX#TDE4~XPV4IKf+J6Kk!0Konr~%b zYVP?04iP^<(~Z#Vr|D)gtKWt571y$ZRrH();HMj-(msr;PTrNvtx7W{F!4AmTS_2n$!otwaLYM!Sd~8V zj7fF6`?Q$%=WUP4$7A2Ldru$xWtjO;2G=i>jVTkZ9N;2wZfT zX~SuonTHk`X7gW0TueiYdES*2b2kfY*vlK@ECj$ku;+pw`>6%MDiMA!xar9#zTz#S zNj_5D=cUdfx}9Oa_iSQ4I_hF3`suG=Kh1r2k&MT6u}}u~A}Z&D&=Rw93`wnjyB_a2 z;f`_3oOLPaW9EHcnk(aC9yH#=*g(iK_AVt52yClw1v{o+(NO^F6buiPb5seJrH@8)=J z_Pw=P_nX^ZGKQWV8iL808Y}TNjqQ4(sRMr}T-AU8+mdS+sx7eKeoy*WS5I1`(B z_99wm@30cratvwhpL@p%ca5hloEQyY&RDr};YUDwv8`l(S~SuET+NS5b>R}xqs7U0 zGXFzzTuLb?HVMLzCq_{3RLr!2A2g&x!_=_=iKYeUCWggp|tD!=Ct;Ul(YRT8J zT>uwg()ESTd7ZS#NPvJo<9UVZ-!+mkC zr#=2pMQkh`JwV*UYjL&bXM7H`!oO7jJUkW`d(iO-%T_~ZIY)u1J2Q18mFuoQM@Efz z{K$mrf~c%aQuXdCoZQmRl4j4Gjg-$`G*c{Y=Zo?K9(NvSxO{QFvflUi4~Cq29G)4_ zr?Xzs#4f%GvE@JS%vf8S-dM&ptu;Ycbq0qs>~r9JwlG-mT~#&iW8;tD&F$cE9_{me z6BFaF^hKQwx<_XRwI!*i&|V)kA?KFX2dF;Wi16uA!+>2a=~;GMaC3bVB7K^MN(Iv@ z023as(UvgRt57x?*GehlhlwD+opd=PT+Oz9gp2KcRvUM3YV&(t?bcwkOU6#+9vTnbwcK6pFjzr@yKi8)B(Lc@iKVd~* z7(O^3%9ovLYsxZf5gQ#v%7%FcLPQDkLD1`WFv?YJ`ROrDb2B^pn#=vv*wZPl z6mcTp;0s-G)t8;$`5sZon-i7~gN>#Co)htYMY-l#eZSzt-p9S2=u_bvjvCeU%y>b9{c+3VDR{J z2L$oMCrc36U$h)B=0e8c1foLMkvfNjhy1Ty`!=2|)3b9V7$75lu>3TTHtFF|dHkw8 zP4Q!c%;P&m_|OR*jVTf@t=Vscv(5Vy+!5iePa@nk-q1yflU-t0cuy(SX4`CgT4V3X z3FoYEtY+_%W+PSI97yPlz9MZSEK4_&T99{E)}ybU=gGBYKD=1|TFcArWt@FP?qyEH z3M?9Zl$bkf`^^5dMSk+$%<9=!I;9Nhn&bRP@tW{;#}96EfajhR=RZl1_FxA2+hn$? zGMeUxnHOxY7pU`8tlm7FFH3!cigilu>IbKW-eCSr$DaogB$_NJ1E=0RDxxQd)ay=% z%~1$Flo0~yCgZ2Avc$gp{#)Ke-R5TdTT?>igj_N65fD2>Sa~UcE+;*-yf0$K z?IO*0yBYSijHG=?X!$$%FaEyVh*fPAk&M*cyU1d&o%A_(=jDxTIjz$B8F!j0DFsz& zoI6P)M1ngxY+!TLRm1QXg2cpjx>a&HclC8*jO1UwGljRKDz>oq-kloNhguLyL<$w+ z3+}ug)9*YziIJjyVF;2aZw*@g@>gfU2)rVC&P=|Nz)q&wCgt$@hx1&V6cyKaimvQ% zxzq6D+9z=O*PBK^epm*P-Q96!iodI7`PZ%Rxi}4>_JXC>-P@!0fgFAj5`oVAuIN(m zmazO=%<+%yM_wqmi05O=!u?+tkrQ9lJ_#pzzuG!`NBMd(@x*p8S~bg!a(Cc>k!k9! z6P=sn%O)N~c85!P&3@zP*2dk0&Gs>u~%jU$~t8`lr(~s?rFPmW-OMql@m% z>4AK9-a)%Iwd~l|CP4O#iAhU{hevGk?}e>VZEE+RAi%|EdaJm{{`-{COFt*)GnhNi zA%__B&-Kyuc=Os{G^ObR{*Zt?jZ+iH+@^!LFzVh_(&E#GPVRfeTL(pJ-PfsE40(eC zt_~N@x6Ds}>c|EZOfS6a9etOlJUmJN*K-B-7r&_NcuQx@)tZ960{u?SoB**$udd$f zZO{;(V>WzFi^r~HuAJhsD6f={zYwjBdKPQs56fHTdtxHBU6#UW+kM)1x|f7jsnjke zOn)dn^j5!`%{f}a;5O(qQ=9hYl1>Qcig`><{ zPCUAAyD#9E)&|(ZKQ>Jbb$(%~f%Hg0PKxOk8Z%^A`p9KOy*@L-?zBi#vTW!PCuMG+ zk1Fiy>{f0oK@wiAJ-zdwze!BmaWJF`NE?#~p%~PIG`MVm*cW=`$WH=?d>w>x3ZmEp|JGHKu4?5%XeZCe0 z0s!BN91VDszex#tVI3E!&q2zN2+?cG4j_7e z79MtZ`eJp`@!@x1vXHh7Y(x<4Zj;7eAIR{F2}*6x|dzyW0g7Ct(WW2*;1wX z!&vcDdEoc4WQ+>u8H1ehFpf2H?>r&)pN&t>Svgy2z3&>hbtnR0{(hLs0 zm%@#cPd$%dI9(cZBMUM6wuzojwhuub0uDMQ4Nj!%hWNRn)vR5zpNl`QJ~Y(xdrw$Z zncxOAOn=y1{ahE|^EzW-xdHgyZzi^F>_T77cpQJQCtdNEV*J0r8pK5YDMiyium%Gy z8(Ut`8)Klgt);NFC7*zZt&pXVm?$6EN&w7n3$PKk0a%Jy3t3D3*LRrmYPq?25&y{m zs>KU(wRL;;XBWH{ueO7~%`<`PHhJ}p`JV|s6EOWx;(Q`}0s{XWrWBrn7SrnoGyWDW ztBh)aRzNEvT8@|wX9B32SPrj0>LzF9W6mn#qROX5Rd<~#DWz>)u$HD+Wr52) zz0-?dM+428q873uR$viJZ4t0%a0jI`TF-ev9rw`%7rTjjM~{ol#C+zvTwQaTjfQAWl#ii|25wkOQ|vqIIl!B3ri7 zQ}(nfwtNsRNYLB3798MXq2Oa>=VPhw13qH$Tsx^AVmR%e&8e9j$<5Ezg*Q~`r|-k7 z)db>vloMv)$M=KAQ!d7{Z^8Sk+SKY8?azEb%a}IBgdrAscz?L*i1nvjF#KdWL5PNH z4PkvLw<1KtvCg7%N@>YXc~}@HUVv{0SDD9rHV3Yd4|P}E&x;>kElF3Qru}$*bTu-`I3QO z!Yc^8ClvY~a&X}yP~*}|VG>|$}+Oc%m&rG1_0D47~` z0byg?*ODci0jeztP4MCz#?q~6BmCJ^XUi1o0{9~g*wqPyTbuf3AMV8jFMn@a`pL4c zms5R^iuD6wM|&MSOyD7JW`gU#sw+yVS6=Q~r6Ur%9s#;XfeF?ZE7Hn!Cxar&@Zyl; z@-{nG<%HtdBb5YC_!42S`IGfUKxFm7S1bj{=a3+DVpgdX#DV5%;2YrW8)L!gO2I1h zSs)vwyGHQo--Z*XVOUa-Pe#6jhiN50daHs})m2fX$Zb~-F1cDZik&p7W5MA+=A!A* zhb#feE70}R(1Q-Yk_C9FR~iRplfgH1Yeul)M)()f|6%YAh@MAE?{UxWq_CWgFNYot z^h;BMw!&Jr%9{iZ*>P0j-~5;WpR8v~v)R(%vY^9J^L$Y9VuW}&4s_U5>flt0bxYW2 zbIfM*gX0O;e4k8Q>DE`Kwv9IY##t(rSMx)ox%G=W@Qd&@hu!!^32&lgYmQ{K%BxxE zTC$C^p9mT~oxx_qx{`pMA<|9 z$}?Rj*+gI8QdbY`jkQq4E})7B#6fCTN)B%P>-A}iFq2fa>q63^iX{9`Az_j0`1eJZ z3f>i7RcVucU1)85L|a9a!3Hq4{br2ppNGJ!Lj2N&Qh*>2H8Yij>jO)w9z3e5e+v3_ z)||D=`Jlnfmut!VoW5y`!1Yu%7uGU3!n{N!!3Qo18gx_30|lUm2(cSK)HeEgHjt$o zgA5yJGtl7dN^TIccrJxy1&SYG!7>WK5z>0<39aycmby2iLXk;P#VmD5eTNZqcoD;= z#o!U(0GOVc7riM3RFz8T0!T;5ilxc|V4Z-_95Hwf;3F6ii%*!c3?G4}&6!3O{I7Xl zJRibl=ex)`x@C(py z!$88?&{hC2tm8su@crFojRe%c>{Ie<@voa?5KrHE>aDtcTU zc%_RbhJ1DH@^yJ4V$)m*0QdcOSL_p-dl0^G_ZQ(1F$H%P1&9#JoeKp4vb!^}v-$xz zN8CIr-2_@=I1s%Kh(Q_z+7K}SK=k<`hVGmrNE#xd8{R87!1_+^v@PnJv?rN#V@x`0 zOi%|?KVr_)GwRcf>yswyGbQR1n(8wG>Qm0@v+wzS3inM_I3|tTHDWn(v_z}C&HMr4Hx`Eu< zXwTZ{p4sSZ-9TN^{dji{3%ec|*OreMg86!2h^2$YlJR0$PsHLA#L~3Il19Zc1>w!D zL!)jIAu61KU+0`T5Zb?qNU~MpHn_ZXucr;S3S%9Td@rYcE*k` zFv-j^hE52gXFTT)L7!`N-nU&hAv>g$q5oVk|93%X6=z6>TMf@56IwoaYme&_Z*uif z;dUTd=Khn}-;e!>CaV+7Kk;H@JG6}Szw0}iBA4KoX1Yf7D<@Q^{mHW{>cG4MW#ibS zVm(xF_oI_uC+Ya}h0$Pe#y2B-^lYzwt3I`8P91lPzq%+ng8BV{rH-GAEQ>+k- zPAJTlok}3FC3t_yGRuH$Zuz&Q{T9%HyBo%b_F0%&ru!QOU0n2=_Dx|~}C4#c40ZW!U3c;Jpn z?!iMcWlGPqEWDZLo86dPzG(g};rJ8_5Ylw{yZ=jR8wsQs-Pi^{$PU@s^*z93IywmO ziN7>UV`xqZSs_(0^P{Zc1EfoRre|oZiM0^!HUdlt09=xj&Ydv+RRbPFM9625gqR;lp@~4G5wDi{}AMHKFXS5Yc zwF@@?P&O(nC|mP;=foXd(I)*px|~{B(3X76Pgd()63t$C27%yjmb=wazcQnBWNVIm z)K0ZVeOXpJ89~B#aONb zIkROlf2l&@3_yR6lsKeTA+3MZC`_1D?l_*?yw3?_R8BEj zo`V(Bn#N5Q&3sRBDk-_V_G99WYmhr7oVc|bHw@Y0!LOm?stTrXxf-lK)Pm{|E~-Jc z@IvjEY%=zvGs{)_q~9xsHs)CV!J&95%$QNe_d0jZI?p<69^sZ5#vmxHuIAc7L!O^7 zF#fIpE}QZb^lV76*a@`Tc8QZRN>i=5&I9xV@S~4c^~{Kb;50QCTq0Yoa~-&5o=M z-Z&ck3asf++;wC^y(Ke%+D?Q>U#*}wr3#Rfsky3Dm1PTmbRh8L15}quV*l(b2oCrBTI29u-Rus zo;7M(r~`(hdYj#28!Ed?e^=WnPW&K6o5t2&WJ^z?`lzuX$hg)HS~7~cMLl~c@A^|* zwk2hDH6MN&gH40!rqmsZT0TE<_6F60*^wvG3X*S0X!Z~d1PYjWQw7@-yw=o#73Lc$ z{s_EJqd#SdbSo00<#mWzU%i)ID^OICjHUKmFnh@CiO|n>GVMBk55aIP2q66!oVeVhDC#dV36{Q$5nH8duyG&2=|IyLhf;6-{Mz6j48 zMX+Frtw==%XAFp7MQh@2d#%_Ufv7ty8O6^!un4 zfZxNs3uR$rNFYF}lOvd2I;ZusuM~< zioGw*X-7+5kZ0T2TbjWkz>3_35VA#t>`NNyzV@iv2R+KugwtRbF_@$du3jy!9N|HQZZA=_tLx->UR=V8CV5^8Ehxy z8Q5&!KoZ6*76qOW(IQLTYu}cz@4ab?9WdlXtuApY5GI5iogTEn*|%V@nbj= zWTA4unLpoFdBx1gAF$?DO{*T+h-YzjSCDlkR+M018dtMLEe&;u!Ho^Ugp(zw`ovDR ze^u1dI0-;cG}d_usKDNpe#PC|3++b2<7~dut8QUYm^ zuhGtL}g^=K*-Sh}q*Bj6MdE2(5a56lLgySgGKR zF@#^Uu2F-;C)kiP#}fK9ps64$DasIG3BTfSA|k#d`mGP4GQRZRyuU z-M79AmgB^dfz>FWn+7$}NtolJ*CtLo7h~4NEzOm@R0oVs85IOAb^4IF2;JBWxPf=% zQIr#KFr242r*4nSsgJtgYu)jr&94L8ThfGPFbQ#Kt0yyYvtHhhrVw}5tX3_t0gR% z_ZVJwJaKkywsPEa(6~uAr>yhgGR4=ViW>CBxKi!}r%{6k`SXH5%3T z4>YRipOC=y%Kwc7dSbyqnu)ihxQH0sdsQ6F<(SC0ob?~`r(La$M6KODA8X*=WSr@E z()4(yp=!UKV7Qi*Y@=t!m zw}0 zxWIoHLV<)?dhh+R0X(je+R|+2&a42kDBC%qAUJ=JG2!Y^?le~(2zoSRzQ~tl{-W1c z;43*E6z*HgpJnpBg8<8ahWA4skDcvUzXozV9HK_H?ZxGjv{{KFtAcmjcJZ@&P%C|; zpz98~8T8Nws5=(7V{HPI6%AtsAa=MWUm&a85~$Uyy9MnNXoiY|(7vtCY<7ZK9LD`0 zV0K-}JCEuh!ulSPW4lhSHo!gaM2UvDruy)EG(%?ew!kLxA+2t0{d}6CSDBW;9rB^S zOqW=ZRf;>mw19s5Z;ud~^uHh<&wHo>kz;{<+0Ivw5^{%=>ef7Kc6hT%_`|ztt_A^@ zM`3Y>A6X5eC=8Ny4dasxqcH|yn>1I1dJ()io2cb25i1fA8_!y>a;42b;_#P}0y`F)~xn8vUP<1WzwZ4=-O28(U&wQGOAC NC^0LmoVq;m{{T*z*l+*< diff --git a/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_ru.pdf b/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_ru.pdf deleted file mode 100644 index 84719af940f56e96e63e17499cbe1b9781da2bbc..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 572381 zcmZ5|bzD?m(6@nrpo9o0jkKh~(ku;%ERB?;LayG^;W`6~8E1KC^xLD%xKIZ{} zz+gOQ7bi1gTRe~PKWX7QlRdvAx`;)E0@>w_h;KS!(L6DFe}nm!B9;W!Jz}1i8yH$5 zL%AK+5rXGWU-oOQ1GsbZ)zO5H0Ew+^405kv5emZ$UH9XZv>YwpN6t2g9@)~DN;!Q zqLFq&&Yu4(giBi+{}mqsT0)JH@R4bNJjSX?VLG<(LbHZ+8$+WLifBBBkzbbOSZ%?u z=db|Mi=bld7v_&gK%j%NdOHsR%(Q2E<|p5NN;lP48{o0nW7fUVtC3yL(2ThxB9#4V z`0$y&gWg5q(`ib8A~Bn=)SP$ES#NzkW``L=$TY?8AVL$K)5lmxN!0O)n5O4#uvPs!1(xWqj+zMxg%k*1D9)mC#DsZD2;N(RouJjyn>6f>9Y47)wm>c8y8cH=PRE zTLQxyH-t^`2dEB7^2@$r^to||S^7xP2BVEc$j!2pvag6&hqkwXA+9RbLh|0JikI-uLJReCV1sZoL-m}vAf+Y^Q+`f!be46mH|mmC1Y?>D-Y zVqOZ%V`khSf|z2!xiN%w{TCZSC_^%aQD!i}luo%qh=~$oA`xWp-7k6I;sgH@X?C~` z20+XA%!1Fl(ZU*7#|qvy?h($Pe1 zxlQM-*AicJmnqOl{Z=u<=s(XWBD6#wtn50xgK;Mvzu=bW18rFVynx@c4}0EQ#yq9L zDBaQC&E~oC>{*K15XP=2S+!3+a2+LO-GRaTpg;SJr{4Kwdk5CLWv*xYwBoD#Pi^$L zF0cIYzxJb7?UVQEfO)tXmdJN7a~A>V#!}0n`X7@Mf5S?Skq=vAgu2|oeJqF@IDGSC zQHb$t<=t10BZ_}scIQO8jL3sH9|5=9%zQ|dg;n$f{MW00os-JGzASs+EqE7$sYJP{ zmZOFs6xIMQm|A*6?zsz!eXG-y{<`WdX5F|)QZUVnyhBEH{JF_kx;9ToxhV{uxG{s$ zFk4@((deT*jReEUa^HArOu!LQNrv$ig_!ftz3KlY&>KKYE`sqn9cvpz)SfI+C&a_} zL`pzM&D_dAcFLW^_9k#->16H797&q%whqC@3gIpx4+>J zC|Z1TH%{?ny;O3;c=wpTWHECChTtT^l_d58y2{69p4t4~qM5I4Xv^7w)+5iZ% zFe0)6I2o}F!0vPG@}44LdAD7@-5`sSfB=Qaacm+Zn?gg@rGc)IbO)D=# zPj3T4c{-zUO04>q-!Jp`sMB8h^DT5^$oa_0T4h{lzY1)M`-l84L(DZwFGU%#G%ZL6 zn()ETgI`?3Ei}o3MGrIXHNUt&iiro}ilS#gX=n~vqyt7Do+0$QFcY5rH240lhw+c~ zn+&30%O6it7_%`8amJ_*5F_53#>-$3FK@S9_Y{-md;1YFMjT58P)?nlwsw+K<<$e` z8(oek3U5Cc0<6yD=8B~HrY@t7mB)gsx{oO}Pk12x!sH!GW2*R!~y0Y`YC8? z>BM8wn4DFw!@G?i0gWhm(b9w@d4mae9)v1y8oG7~C?i@e5w|c2V-#B1wz;`Pm|jh= zq#0ukDE<8d#F?Lo@&%!V9={`|jN%UPv5l1~x`7?hk#KTR8-TPLn$ylY!Fw)qrJvp~ z=G@yV2@nVG%ZI5}xNU{TtFw^cTrb%646&R)ui8K_PP+gDrtmN#MbBE}-NI7dxLi*N zX?MxYr&rgui@&?we!d#$5AF0K8MD_@BIaM$;P!VWSWuBIuulsD z+Atc!HYGcG3GQ!J$jkGlKLbdDfJFfhPS8zT2>nk@}UWPMP7gs+TR4Xs_>u@E{t5o z@O~exgR#P}lUL?)>fcZM(dPr@D!^)8#lM}`WcECmA7Hsbk(#=3VH4re6=*JWmdpil>d z?7g@@H886R2ru}dz+a$l^Ff+^ZRX2HJrt<>r3`PxsI*f%G@cfw&2!>0!+1zR1MCRj zGga90b!an5`67;@1NSiS1xc0k5r?IBMd_xY)+q^r)Hf20vQO~i`DFXV{*i9CB;P&2 zlDW*+%kP8fVAv2~b)#9+qq?2}+t_8%$yLg**G_{q5n&i(aJO7d1BcOkZ_w~Bo`7r# z`-HuymtuMEZ0za2WMTBak-O+D^MtxzS;LRR3R8U6)Tay2e~&#xnhICkCg8XO?89m2 z22Aarb@^+}ab8FRh4BSt?)iKrt>}2wAe)yA6sWrrELrjlzyN9D!_+wu}SvxLAMAi=J0-Ve6=88p^vU%GkA_qt7kl!GpcygG_9ydMQ2|C z%})T|kRTH-a=-7`eD}d2%;QZw8KCJ0W{QxyUF@03#7OaF9AWV{oglVDLV*6HcZVFF z42Kq$C=}H)%W4Ca;Folcn+SX@L$kR4BAb+Lm^D_m8&E1>QRR1jxE1#Ix1~u2CN+W9 zzZ?KP)TE7bnA?c3VksF8hYdmltt<3_8bJ4wwv~^>^qZdgSN{6{XiN|Jp(e1_#>pAN zt8DEuwN}s=CfPm^?NNfBAsmh!>(47svX3Yi_2UmQDidJnApt+P&`T|;7lUV{0&mwc ze!2n0B0z)H{u$y+@*Ag)1j)}nH_(;a%p(J%AFfQS1;$&M0(DvPAeNJoZ?OX^I07|w6EXf_H1LM-FJi+7Os zk~FoQy|T{qUZduhEDyD%fKYi)y7uUy-o`C+fJyZ3#m%*G9rSGjK!1tU7qle6!icBA zC4SfgPraVvgkb}U%52h@IMl!TU99$fKPUJXVjZ6Z=!^m$5gUM4K4cD_q;X%J7u(wX z%GK4mmQTF4cBhwbE-b(wUhqiiQj7Cnf~T$( z1(Ha713JJ;tjWYc@u-B%&)Ol6#f8p%D=H}>Ff~>t!15(TEiilD9qiQbfD=a1F_#C( zo@3Bei@$JIjk_|qT;og9;{(0FuJx@9$s`>g&EFI^4wRI?Os7~}PGtb5uMRvdXTnm2 z*Ltuzq5RxVMPzeUA7Zu&T&nI=I<>&Jspfrzlb0j&uem_)c`&H|ezA;I=a$GPRFJ9} zsaujEQuer9_`W*!^B_Q+l$;YNeth#e&2s;5tuPs1x65%x_PR<703bReM(035R+Ye+ zy2|HCofmt`gkLSY6}C(89b+iAw9zrvxXj3W+)VBwhe1LMO5K)piWlYRpRN(VW9_aKe4|pflbV81{sv9wTUV} zcrCQ^K=c%|zXk_R@@y~ECd=q_o)l|3>#3l>eq4s;d|C0KsO#W^V_INidM)c8?T^R1 zE1YDkZ=N?y%{KGJmbIMBpZEzZb{_>m^?*r|^kl<~>85S5R}l9W(uw;C4RB&)WS8Nh zc#7QCAl-T`U=~*Jn*+DR0mME3jnXzv!M*q;?y+XS=E&e73sat+fD5%cb4* z^h*0i;=p~)$|-C9$kCa&Z_wrV_O$IoWZ|g%`bA@p1o?fs_I*cEW>} z*sEr9rdy#u8kCvY>wTWP6FQ^2uEGx5Uk_yw7EYhz-@EfQleu>VURcL@eptI_n*}>r z`_eumTzhwADx5Pb&(NueYUyMZIJZ%s?JY@KSe;j{A~`m#ALPq99NimuclJw-lU(;i zxfwZHW9frlX%$f&=pe?2R`}Qz!*T{T4znj^Kvre= z4|Rl`_7sbT^!1Qej0a*0cRp%^1f#nbZa4@n?#<+*`nzzc?Aodo>e zeLqsj1^dGp8BpDpe&WeD)+R$){h8c_6tlTH@I$)PNoJa!$F{$jPCQ&Z zGYBRp`N;W@5+CcgLcFT;SHNZ`O}IN1u$~&bY}lKlPy>6a;l4k0lo472NzPLo#jl{` zu}J4~K`6=xnn07?VIqkr7ykLegY{SQT({VW@Om67V``U=^d2MpP$>%FofFE z{IM41fe)UK1Oynd#kd%cc5^e}`+NL_IIop-Pn9As_2+ay`sv9=$Mzx;?sN zQ8ye|_=?yO$vPd^bKrf9aw*ybG}P#Qv|b_1=TtWRt1CtPw?2!i-CO?qbme0LPbvL# zI0(8tIYx!A);jrBA*CY115rKvZ`XohC*Q~?6cs?U<7P|qk_vY|2s+o37d_o1M{>R` z+%=Yr#ozW#nNq!B6|dF_TEMe5kGI4|kZzujH}&QK$n~=Df;nHB*Cib-YB-M%%?p3zz7f#4uG;C_mlb0%vW>|{|evW{4US{MM! zn+=xd*&pltb#%hmRiil$%Q1V zD_YF&Ts#B)sJcol@ZXvN;PJ( z`Ljg71^YlGUwU2+4XYIo}7WM3YjuSr!G{awQpN?jvWtxO> zLu$Fjqj&mv(FH*k(NKcZdUVnAEN(c=Yd}tU{at@Q)xN}S708+tpWB^BhRf!LL_aPk zixnn)-bngWsU7v5KFJzuXAJ>OkfuZEp8+#klzdC9nj+^@y_IO zW4b2=A~$f?@La8`ky85bJ?~QWJ&k}q>=P;h?@s6}Obuixeczf{01D=#I3T&9f|xUK zchqD&>URaofW7he_aJ8Whq~JDnyGNar!0v6t9DW8=?&B5TT7rpt6=mcE1u3CAo!M?6IlT^M^pLb!; zx|!;%XjzMib~^Fd%Iw}q#l(|MxiU8D{AIc_Jxc)uQOoC>{cf5WE14S3d@x#_r|Bxc z?u5j+A*hoYSZX%CdR+Wt1UOA@Z zPOp=;&*d)@m5JCsqYyHb=&|eR$jF$$CtP<1vEDDJiS%A8*pA11MoIK>cak=9}; z>F*_u!~E)|viPg=?`vPo|y6O$pC6oIOUho4nEppW@pDMtYa=s}Tr6-J^ zw$qo0DzL21Ny!GST1sHrUoG)F}myR4u=~AA1M@T_wv$kHX2Ryk^8W4 z^WfROBw;YL-XrmO2DiK##lc9*8?@ELpA~`aJ*G?41>arjcu#_wW<8;@vK7R{-M)>0 zyg|?3&y6AN(n;@Gf<>INVeR!>HMNaU>|JVOK)S zuI?18CW^K^pL^vv6#39Yv{>?73Ltau%qG$rd;s4DMoqRp488vbM1*<=Uh= z)q_lGE>6eeBaYL(`xH5m&PyORZiX(r^1ZCFo|s>E+-f=3lYMxP7De^T6<>2?N)gF% zSxaeqVH(jl#gZeIFD!QGbJ1kV)n16V1=c|QS=xM(BOr;`5=B`VZorgNKr_avd6Ok6piHMV`y9}jYwY=@I6q@!IZC-Bh-ko9c^t^sFdnSvVNE zJRrqga+c+^%Xihil=EXxY|udy>GMg!v;kWZ!jRtRIJG>Uhk$MG`5T0w>r1Z+?K=wk z>krt`*gMVF^O&Z_I+&-WFhjod^yqZ9}5cWH|Xx%Y0VCQP8RA0 z$E7sE%1StThB`ysy}5d2C?XhiATVh!&nls=75Pm43fjA8&6e{6$9arh8ieCKCH1Vf zlYC(|zB|&yu;arBmrqFU)+@(R-!HGcllCBMH2DqCbkB3Ut8RHbJ<)qd?(dIrB_YVx zGd7X)9BXjHRfEDp*@lmco>UV4?P4o4-gY!XSt&y!qzFsp^rr)z&jtiFq*Qh_#&@-s^RCv#<=X1!B>Ou9WZFD65ahnk6#K{>|3WUcSa3r zpe~H_M(5n`!!dVm{79(NRA8EpNDF$W+jQaL>rxFDHE`N|)JbAH3GUB6x8vMy6H`$v zJUQniHN;QWS7kP=dlB_M6D~9$*+aD~>%TMkQ$lnR~I{AHEW3A;d{v$gH`$Nm|=&lmQRIUcM}_xry#IBc+3 z*iMY$n7G}U4=ch}@gpCE1bvA9IbswD69Xr&I8#h3SEg&O>u>dJ9PHTXdAOhhy@L6* zidL&(EDzoveST#6O{~5-)mzER%YUnBz>2L<=)*?!*uBMz`0gKFWI6Rp_~mLxC(0Sh ze3Z1~_iQS}RH_Pv9)#DqXW)i2-XR|T!$dXUZ8lAM-@}h(`|?a6PuSIK`FZC_&Clgz zD>sN6h(;49aVp`bt*7F>3PF8)H|n*KCFatJ*FMM6E3nXPxKP+N&Z-5QsJNN)IF=V6Y%MgxjTeh z^VdZ2iA^I8jd{(JPl4x5*asQY$&2Ugyh5AoDcL0I8qSYKr@Y-B_p_i6gFz&GFo|to zFHq=F!hRP&E#fKTo%vf6`P^Z)y2qWU>%8+Px^GWk>9F$3FtzEVaAuLyU03R=$gj`M zcX4i(I<6dELlSg~4Z8gR!akOenhccT+O2eI9oL7ySmHB|@afosL1);Ylu8}J0d#JD zcoz+;ALMR8oZ;`w=dgq-FC}W1CrH6z7Aw#5Vjq=U{EIcJU;+RFkgR`9CzSIJfE=AbZFCKf4D|&@<8wp#EnXDjokUe zpLZWs5H&0EMaLO3OjZL-csa|SUwqUJ&OL?H1U4m}*$k?^!1#mRP^O+B}0u z-J6ea*Yi+UmK-ol6>&-Vpx$TwL09)aF2SeXN{IXwyWD&jlNhcA+M>X2Gcpug(J`gO z>S9}XpM1u750Zshna1$! zJpcZFqz>5}Pc!9Me8XAa@J5h?MMLK&PeR7p>`xz{htb6Dp0J}^AW;!_HrdyvSBtN@ zT@=1WyyJ&_jvGk2d$w_3Xxn%3CI8H(j#uiRW!YVjw`ZyC)TNhj!t3SWvz^pUChwU* zZm_U2+J0*)bZStp-`Sb)!-RJzlwh{ro1@uN+iJ+;y@I}GEdGwyVu%kRV@>v_kI=*W zHd~h?vOhMah$EhGUv}$LF2n0|8t!>UqATS3tF{d+$>eEZ%iIe8DLAa1^?@l;cpO)gv(V4ToQw)ee% z_6}Ay)y?$iOD^o<(ESgAwL)>JUB>3a++pJs;c?HJH;$zfM$Pf$6FxdR{+Ba}CkfjI zIw(8+D4p}#`JPrzkN5O17)4KBSn^&j2MQp--nTlIne&%#lume981H~oqx9AJj(+*n zQ=Z-ixx0VmaWp9u>akNm`&+IkzR1pBUe;oESdU{*Y(CkZkL~HT_n(Ldk1fO2WL;lB zK6(JznkDcNOp#eQAc_Vx{lQhN>fOu5ukO3&FKX`y@DV}ve$at^Vs#zA=FrQ8Uylgo;}sGd?Zv~uZ5>Xcfomf=1$B1| zlP_HcII?`T0)_V6GE?v>U-t zS9CJ_glJ6XsBcu*1CeOLH%Sq^ed2_|afi{zGbxaFUjq5^%}+;d`ISzDlO@k0<48!` zOHgsCBDSZZxy-w4h315#lN2H!w8dvcO&GIb12cNw0)_j5sVBSRo7fPtZe}dng)A9r zmQfP7cI%igNroocW_nNegQ3j+Q=y!_?YAQ1&pxJ*rj$rjc|)iMkUZM#r~{S)*m7yz zfit;af>ZB3wfUdDJC?B1nR?V}Uq$=^$Mnj)nP`IL_ZY3g`!#8ss9nCB?Zb3ge&i^{ z%X$RGYpS9q!q1$&KRF#f%f5q?e-%}(41MxVUlf9Rlf?S#%u#_#p>C;R%e@E6SmlbA zpA>wX2;l~_)SlkOs~}{ha+p2q%is1mGaJ&I~@N!9*}&3pNxx; z=T$CPYaIGcJLHE2gw^VZnkEEUHGyDXeXy}I(be|N3UyZ<`%_-~L)|dNd zscc?e`7v8cmPs6i$)~QA2$mc?C`BoU!c>Z?R7=LAz<8P$mhw^+g;ua%Ezd4F%l(?I zs~*9uOR=)*tSK6ZR*q|<{=j`vi^Qzc>n?YuEH|H4XTptDB+ZGWLFz4b@%Ew>neZ_? zNLG4JKCavwNk}`*3%QGrfND(p(GTbVdFnjaYp^14S?N{Dsn!CA^1?@mA*C0i)4-e3 z%oHD&ulG~nNUh{x4h`Oe4gRlTzx#e##;LL5Sybf;!+KPGz37rtUTJ~uGYF-O=XH!P zY}Ix+=sU}z&ezydRlDIW9J22^=#pBc<9nmwUT5rzBg>{5K(b%dLn;DIdW=24vvwSJ z?@~rN5XPz!G9u9|#jsGFRZ1Tfql?B!qkB^zEyBVJ)LRk@KjH8t?2Ch)Tj7#iT7&U4 z{PO0K6v-z*3Ld+r{M7a_H+Av)tQc!lQSm?-f&hzsP{fC5gYHL?+Nij{J3uSN2hKBh zfoSusk+>Ed6>E+>4{`fNis$VrrfG*HCCi%Kf^3W*b4!3oFsL!Nh1`g*tLRH4A*qXI zXZu-&^D+4kyclNw$xy(?@T<5$#ezY_+_32SNMm&3FdFH2tZLkq%Qo}m!=uI0h=y)8 zDW97mOw1x!GF}E6yt^CxcZ+3eiHsgpxl)HjI@Mbb-tJa(Q-2MqEMGodVRIN%SmFGA zi~qwTTm7pw?f1Or48iO6V5HU?e$!Ay+UH`!@JV`%os?Cqqj`PxuNmTEdYUFeCvJz= z8vZJ@s!H5LwmE2TLeyh#!?8Lfid@cPN5TXlzNojT*q zhbYDK`uh(Cb9%)EsKRB*d?3w(kMbIrzv9H5z0w6CWE?k7XAP~rpFPI!rTiGguPV^u zR+4YQ66TqyHA90CGkiCfj1BE?FSq)=+fxhV6rh+5XH*%{=1)uY=%4$@*(2GwJSfjpsw+?Wl4?mg-Ea6uB47*+wjg4%zi%R9!HSZXl4RLg|kXejjVUskn zhCz5!dRQ(LWfcPQBGCVk{L$|1Rx&j9sVejdmPty<8RG9P+5#aidzS zuFHs8!lZR{x6C=VmEdOFQgMeS@`Wh4KLo3>)8`#`14V46bNB}Fo=81|f zQq?$XKMaynD*NRQpbGqpVDPz&ev!G4CdhZc0ysq+DxB-WeoBP9PSPtb#8ht8wsGg6 zB}=T{K~CZfiAxo(f7%Y$k^Z#mrHZI3o1jymv0&1TXHD&(cDn-S^x-{s64y|7ds?-e zBJg?4Cetv`#!*(tT^)9+r7v)6iNS15`@48~v#!(p@Y_O^Zz%a%xz$KbChSektOWUr zS6Mff#(bPG*)u|y8EV#w(vS5}SZd2Yz0{NP#otH4q!mG@;rb~!Zn8H+ruviybR$!I zw)evjajNwE;dg{JNKg-Ll)&|6TRC6#P*LBeVGG@M>xEVoN(aVnCbUmBX!TYU_xUCT zQZwNlo>+EXD1cY>yB^TAbZGL9C<^E8t!Uf$8hscEfc6lS(YAFMgf0KsH^ur&q9L&8 zy#COE_R)E-1P}{#j$FUc-xT+_uoA28CvLpu+}!YR``8GDnI1N_$eyXm*usnzpZ!rA(d9UKrrr=`NM2$pDybM$Ug-(dx&V z5xxIzzF0NW_LRqt7ViE$ozUnvU!fag+*vR*8y4r!JH>993A;IMvR7#36w%gz4K-Z< z={0~`u&PQj{wv}FuRh)pN>pey`0V9R+`@2Z>HBK1_L2PhYtUN|g9dV<79_kX5;=Z+ zdxfBd8#j7K*!7Img?uT-1oZ@f@SY(k=fb>RT}bqJ zf-(F_%TswGhMQ!q<%W{t4i4$wM;BMmir^CsG9YC0)=eK?C8Rd?hoM*~-dmO0(-J5} zN0O_4Pc^SS-0MpfAc7js1V}auaFj-?(n?2iU@!CGlDE^EPLvPx ztX|0mRG{xJlTjKUu8y#;ayd0OxGQ`ec`ON1g%}n-2DtL!HLc%mA?Mnf$V{@03HzOC zeg^q+Tzc2oCplucmC`jc{(mwpPj7@m0J~&Bs)(Bh5^F{9ZezF@sq1a@?e5Zz&zde* zsnl-jmt$4;(b#_mB;AQ#P=!L>W(3%W;xb|R%m9AbFiFutftk#UYW^|Fdcujc|Rk2`Mrl7v^x6td})oBO0Qc>C$Nv7a25zt`Z4 zZVtUK_`4V*G@p5Q9K~Fx#zU}tZypz@6gVuFI z&O~fv$m;?DySvDY?V2>zZIvlWr^M#7i@$Kq@!MP@dt$DFm<_$9 zp{@!l2@>~e2q{?IBE~Uel0K(O1>gFgDGB4Og>{lE#WheU4Vivw62nelB=2|EuV9`R zzLkHG_Tk0gN7__81U}3;Yy4fY7XDdz%D@=N%2V^dZUhzs-U6b?##cCPB=++&UCYgo z_`76(eA`aHXL=E09Q}8qRaRo5mHwJ;&hU_4MLd$Ymie-g?#xMkd`S(EfPoPRCB(ia zT71HA{fRH5c-pKVchy0~@dy5lY=5N|=U&=OeJqM=fz6Kr21Nr8CPP-9qNiXWu!{ z?C@R51dQ((a*>P5PZp& zKu88CRA-0n1Sk}x0V=7f6w)`pa7=Z3?uCrnO7wU6AiB{xcQYT}6w6L47V|gI?g60* zFNKXb(jIv6Y?mG}N{&rFZhaGWX%4ygb?c_>_$4a2YQXlR*_!#$niY0@dSl3AzOpx0&{_?}S zn-6zo<6g=XyUq;2xA2PRi~3i~4S)1>^M8Mb>VMa7`009Hp~HE3Wml)bHJ4OYu2eQ1 z(jLqWDxNsXlK^XD{8az=rz&LHAhpn{0dK>j$Xu~P2j##1nzyJ!IL8|2?w31b@|&)- zxBgp%xiGmFs!Kby;!|Y)uwv}ByJpFyo*%2dE<_SkB4E9~EC=Mmf0hDU-ocaN0of4= zv&!Tvmj%m1d7r#8*a#^ZaF+Fd!UWh_g?W~bcG_;3IUgeR(-WLb2J;?*y(fBL^&&F= zCWcFcE;x<%4zsl&6UBGsaWd`W5DPCQT=`Qr@RM}ZdU8SWDv%9@ql~s=Bf#nL8|HLJ z1+ek1{cPCXBDn4A!SnBDVqxmTO+qO`m(e39s5N(v5j`1=8sh6x^w&35fW}JIbOZ^& zR|h9Vvg$&`1#g-riAN}PHB$ut4+hmx-J%`?>L1a{G59Uyg9ct}m!Njo-PBig9o38p z>)1>Hv@)O*^LZ5nU$sUS46K0^W@k;6*QALRyF84n9O>OgDM}HVQ5bhen>DDU_57ds z0Ccd$b5pu1<#QydocA9xG9YzU|1hYR zDr7=|CreX&ry^!LeXW#lW#M8kM|yM=ZNAGrX3yC~K)3J;YXkBGcF_2bb=NZ%o7xml zo-_w$pn(?eopI+O+`RiRtW-J$&4BoZKKDqqKb=|cO`d$#9sS1nY3$#yS7a=F zX$;Y|Y*GDITXXK~hhJ-Ne6>-+9j;e%GHaN0IXVd^w?svmP?*6BzS1k63gaHv} zRT6aETrpU*o9)M0?%{TR-lud+H!YQ06&B4$quXBnsPY|w$=keyb{wlRv3D0PU%7K!>@{1SgN z7gpWyyR8?`DL(~mMG|NU{Y8TaJ6I}{|N5QvUo;qO4;j_?qwmCh2|0YEVcRuJR~a~> zl5i%=b;dxNlvEjyG)hmk^J-$SvCxPplKYq19!>J`zAoXZ8}Fd?nve~w{m(QS27kzN zhY67!xk5q%x4dlFu=s7!fe+>XgROCTVX^RRCXL$oW0lHVRMk`mnc-Sc_POqFa!-41 z?qL((PS3}`dDSObi6*sI8@**Qr8?gJ$A%cpL*k6-QyXJGTpCqH9mp`n@P_Q_cZWbq zZ}Rvk*{|`FSKHY>6dy0~3EdS!{yH~m#+z>_bWr`BDuPH8>1OOm@ilM}I33$2o=r7m z=VDFL^87$pBn&mV+^cL!EWHp4_@B}l?aepVr=%TE1}%kEuk>{onz9e{UXglgwOAKr zICpMyh=|=i5R#?&eQsTMrnx=K_%AHZrx)tFze{5ni(%Ca4$tLr7V$5&q9PCjITTZ% zZ+3h7j+$8K?+dLu3c}|43;v4??^tF}$sD&bNoK38E4Ir`!Y|ryt*uh*DGS83wsWYoRwv@}mw0ZgFu!@gY{1L(qM8cfIiZo$K0W@4Envc&xBl2Id`E6t2 z!<6IyB52nqw#7NVMJ!qr@(|@x0$WH?!I^D+*4$%K+gBMWSQ9*VhJ`u<^Rbz z24oOC03@utbZ?v}zT>>xLpjumK9w+;uxJwK0SX!HYKf^_$CS|XEVoqfz0t(5_{r6O zHFC609{FIRmYH+-MrG4?TD=L2@dRW{Jp(c_UftW%_cygFP0Z-|moe9Le?-Jo3q$Iy zm(^jU`FD2y!^b!FhbJY#ud&9x5rr4T(m?U*>gVCBlnlMA;Vy;OW5=~C>wX8$(~Jw~ zYlX96YdsMsWDI*i4bbQ8dah;SCX-Sjn`?7cAsCK#BLCPeM9rn)eo}RO)C<#D;|{I{3BB7zS8E6T`?_=3TYX#?Xqa^P#q9DR2TG z&d!SQxbbGw{{ng@XGm!ECxC1g)Gzzx*oUbEsQ4MvY-+T7D1S=t*y*bi9-c-{e~p@h z7FWub@^5uEUzCjhx6|I7d^;1!hhpkYsZv1~-9edXa!QCD8?Z>On zz{Pc6L^;L}NAoFAj<$D!7sCE~m;Y19++xMrVZBD32gSxRc_GjO=5H~@is;wqK{TOc zZT5NdoUOkVe@#g6gBBaIFy-_J+TXiE5FDPl!rScHDjXJN{#vxt-F50OB;!vjH^;5{{_ zO>Iu*+1i!cNm!)EXW@K^x)<=L+F?fz%r|!iX*qZ{$8=B*U+Q0sWJ`N+UCG&c75uo< zq*MgxY5%-~0>4O_$bo_@?+Cs@Qf;F2^?o1|=y%J_GY`oA)t$SGG@ts*^l&YZ8u`l- zn(@G!Z&o`emX;OizLOUHsjH%L^E0Sj!_&~~f`e(mnYq}jJF9Dk_}p(3E9vHcf%;9} z$E8+8^E;y>r;E%TTh{EsW<+K!hFrG%s_w-OUDA1oe}SK@vZd;G_aet(#D86QlSx%K zfAKt|0!E**jDwnNz2bnY$lgKn0!!O%gYIx>(0-pldE>H(T-)HHZKb%ewnJyOEq1xP6-&G`RTc}^vI zh0^k0L9gl`{yOK{3+l4L=VIN|`M1q5XL=7$me#2XA{Es0LYiAEPVoyLS6IRFm-pv) zXBzRWX%Jw$@q(g__YFZ3)_;SbTYzLxOt>&^?_KcvlOd_IOH@hVttp3kp54}{>U%Af zIk8EC;@S;mRcTkLgtJHqOb`ISbI32Q?Pb+wNwvLYwSL<&i#ZGuDzwiW8N?81fNox2 zOPo70bMbfeTA0t6DVOvyPO%-&xY8w9PA|i|PHPQhtC*K70_RCtBwqj-v|Pc`o0Siv ztDj}t27Xn`RRgz{C*MTHyrH3dts`$={C~Z~-3^+HhUMEs@PZte*wwo3A-4Oth9dmr zO>6$E1%J;^-00XaXo`4@z@gyonE7Wbhkx}M%Psa@?Q*=sC8Z8bxR9*?Mn(3p+zLEu zwmp2DMBGP6Ua$L(yJwrSYtx)Y6GnuIMw@)*iU%py;KO^wC|L>#e9#LgIZ)aheeSmJ zuaS|O3+N4xyVlLe7CKw@6b&gGI((IoS16yC>DlU17?5~vb?y#;v@WD6rD3Nxbn{!| zSl=a9{os>b_0t|~n7a@vKH=vQp5_*ql;LAvOC-IK5W{heE^rpw=-p=@VU(e?>Kdnl zNcTt0{fxBg*=fF$k!pX^ySd`3bP5g=V;5L6ccqqA^7?%LZ`d>^-`IZEz}D_3HwP~u z%nX^1QiUiwBVHpm?avNg3Jxsn7g48{DY{&kc!{)>O8FCGumOs5zPSbPi~KF_R9nky zXHJQXQJ@q@`NT&?XQr(h4eb00to;U2`cPN!>_=V#!lQRnp! zEgi;zjV$1ojuXyuNA1k)8oc_*a}T4V!=WPt?#{WExV>su_HSS~r?9YnF<}_6Q zdbfAeZ~ZiX><`0Exo~HwB=9%=BC89#iC1r?EO+5f0{oC0Xr1nn(#)3Ty6j2r=|0=> z$^d0{OvoqP2ZAYDPzdqF+XeW@^IKz+k(@ea#Eo&JPUsl?!FCGF;_R|xylJE*v%NXtLtxzxx0T{v z6mRhNDLeF51>Do^3Oo~RJrhrpIi=g!&=J|M$@{J@Sa^GeLlb@B$VU`qRjSi5oeLvJ z9&F}cCVsHiErcsY{#U7wy`!}F zuVj%i#paM{cl$e}_^aWt<@(I!t=1!7=An&<%mUMZ3&bs(-G5oz;T+q!D>yO;=N(gQ z3W3?6QfV_`FJa54(>^P+XLA`n{Vd#utEvymIy1qyuj2_|tV`TI(zZpaLOu=at-g9L zpJYF+20HrnlKf>4-zYZ79cO(2JxR_6EA~vp(Jm~#$p2AOd4RzdS`bo_QN*?q1ri7`F1p%$NqPbD&ir; z`J(j$HS9;;X3a;bcR)cH9;=A>_pFwB^!d}7nNNK|OGLT{K1fI05c7^9)5;FF$yM;u zdsAHd4e8xFcrJAP-u6ELWPD=HfdA(p$Ez0jKyjk-yXl3`P*x7?E^ImUU40O=l-nv{ zN;GzSm;Cqtn6lIjJgXXXRC=T5i$)3>LZH#{`!*upq7 zyyCtBC``iRLMnO15ItDqP%R&Ulan`9bj6>n_y?5_Z~L+}y&Y`lt2CI8e5SU!GIdE+ z_rIZ|#JV@1(RlB;m5m1S(WT5T;bGN2o`(7)pS{??B7fq-+Vev{JNFr_$x_TQA}b}} zSz$&)Tnpk=W~C;lp_fPNa*_zMRyz$|5OT6=s$$}IL$1wYZ?~js!}TE>P`L}&{A@V( ze8d|esZh;WwJlV1AdE2Utp+bg{8#wc#PO7i(1rH~tAkT|!2jyi%)0la7?P^XbpDSa zPazvt@dhGl_&u@QG%2yg7c}SDZr<^~YMn9-^!iJ&MSWR>-91`2mqdg;B+^h%AV?Od zw=n>3yTuI0JiGMtmT3H6mQV@0kT{n&yi*2ZXSRIu9=JwXu*)}w3-MzU=PjRV9@y`{ zgy*gsh)^3wH)&J6gJ78EUF=S~z+h7J=f=fgP`CN~IM4w}%W*3soFU(%;YK9np96s=i&Spfp- zUrxXKxUzI5`cO_SzbqMAW~VFUqqB~S+CRRvsMDm@kd@iXv-1c%bGh+A6OtCuavh`D zu&9oKoC0*)3%v)>HPnm)FaOz@JgRf^L#vyDVOm+uS6wJL|EI4+(Y}gRTu2Rq7=JfpK)w!AY<$09u;yAJXN$6+jp}$AbbbejlDhvoA{bL*0HVtl{PaA=bDuh1XLi%U7T@)p1 zL9;_9YoQ3|Kohw%qCyV|wf1p#8^z6=U2lk0_8;%Rb-zhBx@J3IGU9H5UCnb=Dp)z&5 zE^U+~s0m5XxbC;z;u#~wZHMCV^7vtY=@GrT zEbMap91hXmKzg70lq`>YIoe zA8fp&d0J2=!R1)3B=_aa(mz3=YJTj{m>+%0U(45$-WxgAC_qmMn6;uOv2H$(>_M-p z^myy`9C(t~=XW4=h%ygW&$@j!EpdtoA$r`goyLEY;$U9F0?n84HSd+iaKAwRndOt@ zg6DgZdJUv=EP3P7eE#=3x9BpgcGF9(Kkwswxq*5YKr7)D&i?F_d{philTzN8yU3tD zxXb)rD1DXvsdU2FFAu(`RqAl{mqqXg@qbrvq{xYGp9?KpmCN8K>#YGqUp_K5gbIrX zOo<6x&^&|*{vbQxE73(eD1n3m_}%o$nLFZqF3sGYPIg&c-n4`-{c!!fb5yM0%3m(< zN^<9hi2n`X!O~`U`bA)dyGp22o(o~&&rzlVIEB+xlN}A@EKGaENk<#8LW9;(TxUkT zZCCoZ+yVY+x^jf2umhnEL?rn`Eo|@w1Eo;s@6#>+=3K3Mji#@+4*LHc6GhDMhEbX) z%v6YJBIjXYqjk4W_;kki`Q@-*Vo90&Hc9HLBx{SYm;BE_lDY>xEGG{m%HXtL0-wZn z$kW;;IXB%%FaB1+v(Sq1Liiba2f3deMVP|#B78$W?C$w8jtjvCJ)bRM zx0+y~^$nc#XcN@`yp=dMrT`n{R-u}GQ^g6>mtjBW$*CURdEH=9l+^j3A@7WeS(`x< zPd{P82A$k$WXrq4UQPY*C_qN07=C#TIDFx-D{X@IXKW)sZ2NNGbli!gi~+++ ztorenfxpn$$cbLdGcv?X_GalFXEVQDR*Jea$w%Wt&WBNt!14>}uK*te9I4($ltrms z+=12K8`PRovC3Ryeyk_cQY*kWE;M_mLvh8lD!px|VSwmAd+uc+@czE-3ab~}y3BQ) z3d4bI_v=r~^F#Mf6yc<}bCji%lj!b7NvOj=EyLy(zfoQsWjj0Ns&U-zn3+nGY6pL5 zF`gxhB~gifw@q@vM&2%r%7-uK+g-^nX8B&^T09*k%SKN${sVE!Z}0E~=lPnjU=58rZQ zuy{?1`^8Yj?=tqE&Zs}{D?&uHOoj~)*^7(i`5#6Gq)a6Hv`b;saXkV%3N9UZ|J!*B zwT~cikcCVMbY+TMT-nX_z~7g8uap-SNA@2_t`>>Ds3CY*o^tKFP>O(kaLP$Yw--hZ ze|D}M_XaU2-fBH@{uunQe%O+^4=>CK??#7B$UjD+?6DCU&vd?DL>2ly^&S?cd1H6< zpnWoC>Eyk)Uft6|%70@NxTp}@*jc`%ylP{>t_}bnIXH??12?avd7Bq4I)5>AT$KN( z=Td9gi9ufeFSi4*2ybeL$;lVbuv|$F;)QKzJ>b3fcP|bY8fiOQhVOL;TPv?BXARHS zW+@uqJT0t(2f2q7PCA@H**b;FI+W(HJo^j_{=?1HFxn6EC`*0zMP_UAYTsnIPsnZj zAc>UK3NBSG-J$Q*ed6*T@O#*x;PZIPA1Sx)4D?4V@%?&D%9I=jP-_r(!%fkf8Co4vzF<@J+{&MIZRbKSR@>pS@yTllBkD>?J{)~epCQ!f)>gP5 z;waVr(k>_oKL^<6C~4&GInsYH$jAGCgY)H$zKPReL65(04;RkQGHhU(s{juc0GpVA zYrH;*FRXneryu14$kgM7JXd%7@Jt?)ed|#tN#~8Hu$R=NASio1hGR^)8 zaJDOs?9h%DGr&hCckI+y{{gg3E$)1V1>0wtjEV90dOh6dl*ckUv7Z=d_Tug94#&ny z9<2q|5c|*S6Tn?Tlqyk82xm;bFeVr_)+M~4WrF)jlT6#dVGS%>pay$V703^^yOVi> zy1>~E@bNFuM){+O`n}N#v2~)7@Hk7-kXNmjOaqJ+>UgE%42TVF$otI>a~Hlq57rutTqdAZt%>ya&XG7X9-9+VIr1kZ#n+irF7?{~{W1^kEODy;a%hK}{CcLd-)AyvJ<{ptR^6Z8t{4APPe!n za|iPdVR_R%Ny)8xWzsWH#oFW6=qW&_zIvF5j5>So_z!@Jtk;LN^Se|aQ)Zcz$@(3; ziGc=ZLvK}Xee|1k?hIV=$Q+n^OSremWAxDwbL`cQzxX`DT3;%#0J zyDUxExXh$hPN=UTks|B;=@&DwccbAHSEPO=R|c2+pGi;j>*Ews?}TpXs!DaJ{fNw6 z4XM(e(}d3WzdG>er=h$OcPc0?cEV{&?G<(qM=bIL0vF$VdbeOaY$CWwp~xvU zOKO_-{e)z0ppP$`wSdM#J}+veH9tC$A>STc9I`eVj6*en30o+rVq*Dudy!w?!jqOB z`Qz2eAcl}#b%r13pmttCf`;+@1#u`*k?1RhJMPr zVMSj*wS#~AT;9O%eY4s}1oi8>jEa&l&;F2ib16{|a^Z_G!O7*$I6+`rtRXAw$z`yo z?vtAg$~Xwj%B;W^0ccskjY%Cy!}qp0?g65O;iBZk#2u+X)xfkU`-rzcO-Hu+J@1tk z|B@;;nV)i_Rf0^J8}CcxS&SINT&6OqZl&5qi-a6eY+;Txoau(PK-*gku}Rp*4!w6b z6dnr~7~3#1+E0itVJm=9KP+Ln@CIY-Mmm`^tUv zh>WJ#fe(r>J~s$ta$>^-f=~)g6LPcOMae+3^60~fqH&WJ%tLB2 zuU)@jlW|1)b)DE49hfy~jg+gx?m~6qa7Zyirs#^o(y~_;@?J~0-dQxOCHDn$0o-h{ z;N3BaO$+rD(EZ8jk2ucT-^LfVi)s@j8cZFkxg41$#MgaGDa+9?t!bv)s=^K>s2A8C zT55P%;Argx$yy-8Zi@})p+O#$z}?=ktof-(B3c;ELinPxEJ|r79Em)kaRb~bn$zRrI_T)~H8QznFgzt_n`A2!QeDMPMW&35w zVWFFFk+Y^pP+|L)#@jyuy(;7FJ3uk%J zw=BY{)&043A~E!bPLgASs0bqcr+T8DH+xZtf^Tv0c)q6Y>xbAxd5>-)4@%+u&Qu}> zzeqFu^5GbyswE8RwSts@{DZdIrvMIvR z3=MtdL1g?q&WFrgDB>e~{pzhT3|Rf-pg(#&vbQwM_Dr9DE)BKq_~aksUJ$J|t-gs( z@KZR!#$KBHmL=OK*~B6S2!bmx{&yg+VH1aiKxuLBfTz?A`lq9$mAS=939G8-xdmjm z91Oc2b1Wb}nHlo~_us?F3X3b)U8HYY3Fc6Q^HU4Wl!FfeyWc?RWqHofN?;~MtwRyQ zw%F%KS0NN}i7U)G7tVr5sXOSSAs6r=$Rsl9rD>fz&9^7~e)x|`>5^JJs6JbF){rUh zv_~CKvFYIAzP#1&NBf3*RJ*`^;X$*3)^Kl!TY8 z^&|Mt-tMa&ug6+Xl1ymA>JDdg=@g&vZHN>}bNofMt~(M-=$N|kLKFH<>`=nI`aP#% z^4>{ame}od+;VG-!}6cyGGf#Nu|1=|w;lN4@71JS3u3=8Rp1`Y^pMH>e6qYSx{oAA zCU>e7?6NhIKP;#m?BqV+adQn$t}*jr4o&x4m5+Fk#5r~ZN|2qcvnYlu%)w=fAW1h`sKKK z_u`cCD%0rI(`tPo3?x|>O1P?;;?X9y31F?AS^IU0V*ggFk7hl*b@7VrDTR<9^6gix zCC(a$)m|;Or60!`Il?x{uU4cgW}2>k(@zRLXiiW+RDtyEj#k|KAT*h|K&?`OurS#c zUnTeamTN8HC4&`NZv8VHvOP6y3|%BpVkr(< zrhU#Zco!_>Kl-yuAd^5%iBc0U-?<&CSX8DUmmL>h(N#TsYf=4kb$*Ueq{Osv~;=6lfM;R)?stJa)D%+5v!I1erE zBUVjlxWCX2|9i%rSiQ#H5UbKv;h$gV`+U1!X=>JYwEyxu-a}CLjE)Sg)-$?MuWo8x zF}Y3&J(Z#~c`bMeZkHTo7~XjAakg6Uou7dRtBn+<{f%KT4WjT2YB64@96~#A*P&1J zyi$d|R7}F*d@-Wk{)5qbV^fL9aj5Gt@cFr?iir{VB4e`~9tP1uTCm-z8}vI~>x!}w zO#3^-pv{`xGdZbLos}INB+R?2lu%$}&ZeqBe80*HU~B)k1_qN~iQIy8WsS6L$VKUp zf5k2J>L|sUdvd)(fz8Ff{wed3G4}TJ7V*;k8nPXvC$T3bY*Rl9;629sIIQIr-N{A?D1hkV&+nXI1_D5fgs-Fwd=Lzu)~l zP~7|2Lc14}$q-n)zK8|W{=sl|C^x7@K3h+lb4-n7Q{T#m&(&7@(Hl?JIcbjDutA-W zul_WH&y4R34YRDD{k~c2|J~}X`1agO&eFiHSwvjO$qyZ#Gt8~BOr|cqpX!bB(!dU7 zywq7P5Z7Si6ZzT&d)sS9X+(>KfN7wqre_gkJBzgtFS{G=CV-%}P}sS;>`5HF%r6_C zJ|)QJ>D&yu7tl8Q6DCtLGoE18RFDf7Kb~$Qx@BcIj39dbP+bwy$B>XYQ!cJ62X*O+uvO%fHK02{TWX=URqu8zT{?jWRemX`>9md zn0sfc&pgEi`D*W1NusJ2l#xrTL-<|C=DjtUz!__4>9_ZJir#*lGhd&e5sUd=n_>GV zn?^WPJ=;c1Z09O2JZ32mZg^~)QZ+hMC1uS+^;~~fx}Nc^=1bhL(EPiVGiTGs!AHfC z9ww?+z54O^B%CRmETUg|V}4{i=?<0P^!;h``l4Na-%8N)uIdvaj;?f?Y6x;la6{Kr zBu?EWKpE1oGulXGzZ&FNe=gm)b&%PSO0h}ug52}tA#UZY&2Zs1XbAiD!RiD|o0;;f zx~v{J)9xEJGFxKd{^yIwru_OYFPp6Dj0C%qV#to8FL)xlrQbh4^xzSpW_ZrK{lRVH z7bc?2JO1dN{Pua3y^(ZT`?>R1JiOgO705HDnvfl{w9F@B9y+kzE_-F)!Vc9z9t}37 zo7R5i?1o>Fv+u&&Igjx3q+Ujg=^v5nu03nG03tzTwWn2am-t_-K7t|U4|^QhmQrf~dQ0lY0iUoKu*)9-M}EQLRr9)^60JNqk6{faxC z_wm$ogmOXGFmSyfpSb<;V9#TL__v7Xhu+5(oLv-wFW)0+w01Sx%AV_ZeT{U}3gBif zuI_P2DlOiWIuaf7lG--!oa21t6T|$Kx2VdiIxk#Y8C*pIHP?*iGi}bd%hq}Q%KjGX zO<(m$5(D|?_p-JZfXivj$3WvyACUmy>h|qRc0r94&bTkFjQt6ag0h92oc3YqO{< zr33M+Iurkt`>Q)1{?Wr_y?G+>T3cG^V#Q;y^zv9v>|T8}>yx|Vw$GEv4Ua44O(I?H zmnm;okA7bKsuIiCE-+m5X3C?6t&1{pkf-X;&hOV>O^)|oGgkd^5PltGbc>M`QRW-J zCsCW~RDJnu=BB}`oS0PuAUcWADbvXdLgf5~^i{;4Wf_o_Zlqp6>0f$T;iS76#sQ zd#dXR1YgDWA@E|1^iO6~>v?lKu-q<>Az?kOg!0aOsez_od-S&OU>nO|+Mn6#UaenG z-|zJ~y_IX$%xRES!?=oPAIsD%3w&w6xoGirpN3t5|Myf-VT_#Ct7O*R=c~2@nM4ea6e`9Gv6f}8gG4@Sg4TI=UtUU3NLFlGsnw*=g(SWqB7Rf z3{&&$-+uSP$xQeV8!HSPYiiY%Z&f@DOHEh_Vum1*X6(jG zNR!f4kIdG*SrhRT(>lqIIn4U4q;V|FOk`qHnbEJk#SPH>Qc~#K(8Qx7Gkr(Luw0KNkMGtr@v-;-fG<)?_SX84CO?e#D&?% z`4~x1I&5dVE&GKHs9459pX#FhAy6`@c?OHiSjtPuI*5sOp8 z%LlhRwxI?mKkU`P!$=(>4$^pGRm${rfgGr|{k^EWYl z>5i$|9EEN6y_;Ql^%a*b7XIo!pM!r5x?`IXnvAw%%9}yvnD{l9#tPG|3-ojiF zlOMlXdz$6Fr11Cc9)(1X=|A$?A1AgPcS;cjKAe!>t@ujcyqJ8`<PI|R%wLLA~t<)S?eqrzi=fM|u-P##Lo%}L^g(Y@BnKtq>TS`CP|82O-*4p96i_p91xP45O*LZ56bnwDAa!hDn{Tt4T8B29_ zA|3MfHwGY&N-mK=d38CwiSqrg3q8wK23>uRAH!}ro;(x1+K-_bcB7;B8#O%JO(G}_ zZOhvbaXatb>@&B|OFqN*|C~){J58oEE!-&uzKTjuV>*)kqNeF3;^OO{2(I7dt*BXb z*OLu-B4k25gdeQ{QF?)b^7U82R9# z0Qc#SpqQmM0G1pg7cDVe#nQ?SkqN|f$6QL zn&KvXUz*b$$a5ub7T|rgZp%e2a339OCSyq69tc=VVY~to|Agb#L@P=u{uC116wkuj zwHm(g#rblA8-lhN;`6-Jc-d3iU9aJ!q=T= z&tm!!5aoXfCy#38U6#s5bTp3V~qQk@$Hv?B84NDT+8moKM#IXBZG40wLf*0egDvpPClG zYqiR`*IV}^xV*4AlE6TeX)73;y^@s>jO5L|m8*tm}p!kZ~WE-qodg1W~3 z0ey_3CJ+9TGlGk40t*6gEy+SY$r`kR`_5t{R0mp?1*TyG&^{~d zfoD;#VCRLt3)O{|5tN}}+gT_kR|dcwWXGS%i>J9sCIF6q#l!TINI?r=n7526GWqU0 znid$;+XH{~(+x_XydMg7(R7Rfp`;Ejod03_;r)aPV#Tu5BlP@D8IVRm_CaJggsW-; zs}?h~$CJO7%s&JUh-?OKG^bvVb~IO|H)1Tdk4Bbqpwvlx%RGY}$Ah6*T+OA5yiE)Z z`wmROVS%@BQ!mL=XWv@#!SO19AR<~{KZ(r~M-`cUd*s7PoKMLCDnPv`K+Qn@*$Yi` zO&m193d+E7aCyJ(E}gMxM8y!NGFQ=vS02Y_C^?!V!IQ@+g7;PGV@kqDZr;LfOZ!nb=&p&+0!Ua$dQLKuSXs|v= z#Kpiagu5dfr|$u#oKVvtDR0UZ5hW*z;G%k5;s z#zkDGP+`MN`f=V|P zdE?UnIL=w?4drw=4we<79el$3rlNa@&>P3d0=qEwU=_;U>7^m+0mB`%| z2XimW1Q%p-#loX^KyL->Ck))qf8EBTtHc#pUTnF2q;(iO32;t~bNu=pJDDtbW=*jT zk_?Ks42A*Vw#3j$FhmuoT`dVSq-H~nw&ic_gqk40O&2wyoeB;Tjg*1DLrhF!k)M22WS!jes2lLHl@@{=fOe1e-^ht{*fgaJ_O5{M)l+y|07~i| z{?zh|Xk{AAmLkX<3IyHw0UcK`1e_-*(&Nc8TmC3GORgRAAX|y- z-Oo?jgj4+~J^iqS%5*~+I|gYk7G3a0A`r!K zcEbLJXl=e4%I7T4?@4Yle!H#iS^Vk4QviSOXz7Y{J}h6z_?EU^m6ApkkU{603-DlK zgN$$M8(dpg`R2xBBOstf%EP23AnSwdDW@G)c#G18rjfP=1QLA_uZnUlRM_HWas{Wk z-)277wl%NL#P`$SCIQoJu$*i4YZ}F&mz-@|+xN<>y|u?A0d;lDvy11{IdPJz&|$HB z9AfjNN5T+VOUu39z(ZWj><7Xu0`tuPvdSm$S3 zRIWMGn8!4ywn8$@$L~kgfoK-lq3SBEIe>?`O;B{-f@G9!rZeo4D_>a-HIzU!ESMP| z%pHg2({!N?VYymu9}fUfQ(Kw>b_&bj$XX|j%7Z)WebAv5pc>R`wEwL5us|$WGn%{B z=G%6>J)Yb{Dd0gwl%a8EI5vHah=#RvO$*lMx$GY0g{V#&&O^YwP1BQ`>}6WTOb1~n z^lG}U!&M*bpUGyh0J_M_*WI%fvIp`qRb$b7?o|$^$7vCj{VAzzV8mLaM84< zd54h!w9g4%;1@3fSUjK6#9gj9&SK8qVujFN*#6(FPrqBN{WX6FZ_jA{RxPan^m?~3 zm^U48b=@^BykyUtEjK^A8qj(>%EX-i+*5Y>orRu-bM-$5_9m|Tjo-+qgGWQ+_)zO7 z&1a~*U3cc{oZE^OCsQ_;TP&ARiPZ|(1VU;eormF@@NxXJ9KV9oWv&IlnSj*E;t33U zM&*tIDjrxd3c!pdKcZylPILe+UB0PhW4wDapz+}NyjZit6r~anT?_k<`EB1cnu&ng zGdH-^obPv__7_Fp_Yua@cva=b@5V=y=iQqxvo$=cQ@?Wp$d(|{AM>h-RV}ES9WI9o z8Ekx0EKmb2A=yD!g+OB_LZprE=zf0h=M!0!)F2;MXkF-v(fD#j?lMBN^AVb^WHY-B z&P?lSJ=;-}*kJ;DF)*q@Z;X<xXW1kqm>_EF!JtE}hU0=x0!%5jF)Yy2lJn<~k)*L6 zofLm!=dC;jHbD9l>p^B7@x#U6>jY!<7iw2+qnIG~A$Z^EU9LZb1dVFiK*PmNZ{g{J zQ)KME9FUJA;@umhu__!Sdt{)UHfUUycIZm96?Dvt1zM`)sm2M=Z#69cL$EBbD%n%^>E~;3>6#5l+s|ok@`aBfT(Olw zSzbCR9FTYAxsWnqLvO3_=qvw<@!E4*5}XiFuoTs$>qye!gSRKT2VGfd7LrY8;4@6n z8DG!0T#iS$7ayr?Uc3qI!juDb1AD+8BlwxZR~aY6TZwPlo3#Q#rY1cl_JthBm0kxn zKYsX9IS}(a_az-*ZEKz&N*VjNvK~x_^>4i-Wwv8n_^Iy)`N(kkYUoxHU-3XR5GKo7oe``Ok z6@F&@mSxSPmxyBcMsS``(~o`^;@voFrVcTO4^@roKqXV`)Zses_QIXFi)BNZd`A-N zZdjn(PCu0nN^VaqGJ4{EX0mCGCIL~s{}Z$RGFy1RKLdr!ZKWnMsMJm{Ez9mV9f%4_ z7_&ayXt(eB2oF+{u`-Y!N%_f!5cI0>5@x;6^ZSxm9Go&}kgWl&mOlM(Blu3zs8iDD zT%ot%#*amWSh@S%HKl`aOi)3qQK~_QMqAVZtAfABtflTJe5bh^!L>R~I@T`9%k0H! z$QrRqk9+z1vLIQ8Ju&)&rsf&vWg+$-o2PGwb}O@RFhF%`>P<`^r#4#$Y(&1ae&)A! z=5`K1f@Fm=HvCdIGK-wY`{+#WPjJj|!@DdGVunNrK$fiWZK0hk-b7+hmsFiVLn|X5 z?l@5J{0j1Dz3bF@yl9kTtC4HJ@RkAP=VW$JLO}(Ga98BQTJ7X``CUt?w3EKU6bcoP zY@9m~XZmgt^udB_6yg?At(090?tCZkBS^Nmn6LIk=WEfhao3ckPRgN+4(>R$OdHUz zSwH;AF51j%XD)$wt2P}385~wRk19yKfw9=~CInfeDi&+z~!Ouq{(+Ht#e*Uo)nEsjy48dPd*Nu3+fgM zpEJC(mr7B|3<8lNjc}Cu(;7TLrnAyR*-FDYZK}~g#zRB>Au=YF1?IaLAU@y2I^D4O z^%+7CUG$6qr@U^J^MNA{h)~Jb?u)hZq@EhUgu<=NDM6)vh4yHmH67J69cwubC}@dK zj8Q0Pq}}iy2FSG(7<#erVLf`VD{ z28)3@u;VSj-}bPFu!Fiy=!i*xsVi*IZfp@3B)V54R!t^1f(4o;n$p=(YPG)!1qB0f zT*=IumKOk>fZl|i47eRE*y(8jf1W1S`)Y<8uRnP?bOUr*nK2dp>#1EsqY^1-iPmv8 zprqNJ{03-AqN1QHJH-POoMSgctK=g!7z+XgDWzxQ==h`@8pE(a!6p{=`{Z;tF+e`_ z+L>L&E>K$xQ2SF4VeK%+EnRQaALz`$J)J*qCaPZF1%cYL!w+2QT?s)o_{erQg;SY^ zV+WvDrejwh&Ia7sbwsgWHj{Cw@?^m{6Lte+I`w&Vdb~Ib4^*R~(*BxZ_s2s}a7W3Y zINd_L^X@i~agR#T>nWpF*I-blV5}JMiY@QqM@B2s<}*d@1SDv48n+f*`8xISEd911 zs9ROu!;o=REN@3z`8z&{udY?Pl4y&v$eT190|V5r&;rfGao6PRiv=!i2cIun>%;&% z0zcI{1~bR!+h+Qp9M%{h%PPd9a<$6hQW;Px~|5kk1wr zN~9z}-G%$sUL>3Ci(FC>1D1{;5TQJI;|sx1f-Ekl$I%}!K}$?9 z7$Cal)@k-3_gt}|$q` z)TD)$V|3>|)`uWaC%HtfD_c8NKX)r_zeg|&KL-mjOJ*5qu%wT;kCUqtKm_dL9V&eP|@ZZ7=P;nv;6V$-W8vb&>tp81%g@8d>*R!z3k~hz`Pk}z*!Vv}d%%2Mt#}_> zdANAFTUY_$EdLqrz|8QA}GYquOuiZ%*UrBDyl4^B*rfwCkFY~R?XSN)6Chz z3Plvv*6x4W3jTk#6<2V#GV^qChq<^o{xcOdM@KKfyiwI)1#Mw4C)CWs&e_w&!FFDGY@Yowa)R+e@aC_CVXNK5l7+c|n#x$`PJnt57X zWBljS1o$8jf&cMpKC?d;9Gq!CHezckFUdM~Thx8Kb89U9_O#%rRySS5xB405c;mK7 z`Jk0ITm7((HkqBBE@^3LZxA%#Y|pEL=zMF~r32W-0}5Y!2RkU5iie)}P+e^Xcq0VL zSVAtQhAMT^lmqEEadb_$KI?k7SI?fG6Q==c#|PM5QVSu({cpPO-i95gfo!?92*8NuCdCxk$6(Q={M@y#o9z80kNr$ zn5jPY*tv~o_m{9Z01`2g<)xsMi+U#pwkQ&?=$A<{v;)9uzXtl9-cUiRg_~!m7?exON-h_p5!|*!B^xpDu&HNTsQxk(92bYmK>V%M6}48_WZS+4OREz=6FHD{$Z zq9*T6IQ}T$A4oJ-_P0+%@0eZxQ2v#vCJ`(9#iyYcUm$XE*PT?sE@z`!=dpBo3jWKm zE+7-tj95)TWx`*~8h{Ac@5E~SHvZM%tBpiG@+KrRP+qy_xLbk5bNO{PW?vfFU+S(O zW7xs$zr{4|oNC+AQh}OEVx+qK${$`}u9K(OG6GxZO> z=-i6`tDI?HBJl-Z4t`=w?lE8w2?ayr*_x<#;|3*L-!*YQK|FDKpwSY3^4~_Qta2q> zGh%!r=4{te1<&{piEl>^zxbxhjSr;o2FgRFkVp8BIZfBeAF`k;x>+UrvRhd-WZ^{v z3JYjq@&+2pXs#8uEzTogMu9v=~@70|k6f!>xpGhJ^2v{94`)x(YDa zY;()C?y#6QfB6ykP4?_FaSo=g3>v`H(|%;;fghGW_Os|~xxqIf>yFIQIHFZAQx(xL zRM}YBDV9ngy(wj2nT;yn_sE{TVQ0*bLB{tBn{U*q`jrBQHb8l`UL7A#RN3v`quNNz zY#=m|VOe@@6D6$c_t`WpTc|@61Tp>&<-Nq*`pB9Db$7X>n@PYXD^Ol1=I#fJCScyl z^$k-4j_-i7p*GT@@>7IEEay}B$u*S6>s*g)AD6q#Qi6nn*ZnsQKs`uLdjlG#>!rJH z$fGuLLeyfcyDUx$6f`a$)sUgCLeEdQYXjN?+UTk!E)vg6rqnNTG&ZZ|tH90^P|DRt z61xdBjv`tdnXlPbQXR43aHmbKA=satxb~&dNx8%7AB5>fX{=i_u9<+b$>k(#I)Rsk z2K?$7(5P$`LZn&bW{DMT^|9__&|Ld48lb6?BSlvCZ3m3WYi8F~L!|F$8R*LkR1oQ- z4yn*i_Vj+Q#SOd~6M!1I&etK12DqHkX_gs$q2WL=-> ze=AO6Yc}|}Ip!6$-ym`@& zkn$zhPrLsBT?H6lppQ8s)e>g5c%4hTI&II~bg)PxuneHY9 zPdRV`3Y3TPA=0c|FxtnQH6aF_=ql5@BnQ87bL^8OUla{IzU~3Q42YChVJY2s75@fB zdInY?Yksj`*h5pd`p#=@lN|6zrfnv2zX%^fB?boyo$3eB$iT9WMubVBspr^7X(W6AH^E&fBE1Jq1xM z;Db9gFCe7&s6AH@s3I3z>Xw$~olR{s#7WhipVH`B%~YBLVl1k;Ph;IA(QLr^4p4+& z=N@yM&8Ysu)K{-8x&{j?X@17OH>0|ONvDU2A98W+sZfxtRnzi@*ha?GLLtVeJzEe+ zcc1Lo8H>DJtsmr20lC(_y=Lg*OIsVrC}E9jWsT8v9vX7VfaHKMjC8C2eK7e}gmR4r zTD9HoZnl6ZL2`wCy^g%qt*^muPs8I zF@QjZk3$zD2UZOPXmiJA&3$X1Ut{DZIiTnz(nxf!C-ZggH0?VjXMrE z26bui<2r!D9iR-Uj%<;L-RBs@XswW>c^7wW6)GeL(P0E%@M?qOw&L0PJFjbTNDd5p zZ{vTe3I;nQD%Z53sRd(o+`92zp7|blBHB``?jyRAPYln`H$R+>RY!Ijsm3yWJy)iu zVs-H4^^joP?WVEny5=hQ^7PN2ky}NPqztdsZ|HiJUr&f(Mc5rwa$gieD7q0=yVs!o ztm{^h#0(^gH$tn7Q+Xx8XaV*Uaw)-*%^H_jtok2?LITmFE0|h!q=|%fp2HghID)vg zF{*H^K++fQ0x>wiGjMBzdJeRz6Ed-~@2)(QT|R`e%rh&ZZQIn7 zJuxV=%9*IiyT+K}rCV0k&(AQU5On(y6a2A_pP<$?-W9ccRJp?rWch6DrY>p z9>&TXa?j&bm+symF(v4YLmQ4P2FU>jE@l-8{SBYk@IbV04W?sVSC6{EqxK3kq^lHb zdW?2OrnV#pN?4#YEG5vSvOgzU>QAa81`3K;rr}19BGG=co0D}tzGe5hvMAOs*X*~j z*@tKbsS>d+Zah05?hgaqPe->*NWr>b_@wki+9>J|5@f&mRT_Ny-MYp zeRMT(0@eki^D-l@7pS7?$OMhAm`!fYWSI_B?(8pry*67;$h{iuILij(bk723z(5&K z%8ePmV(+<8gE1F_mS72(N#iq~KX3Z^tcNx?X;&tQ;p*aI+iP#KhH)ky-6&F);PhuN zxh!SL?~@-_c91to)z{rPvM_ zU-n=kAWk5@sFBv_RGce7lV0!lAF%<}8a0|K?AKP6n?_A~@M-r;%BRrP82j$1rh?|t8wec&Qly3=9hHuB2)#;IkglL$LrUl^^d?0> zK#D{`5euN8bPQ5OgaA^Mj+7uxl#b%>=7#S(zjNMu=e(Q0?%v(m+1c6I*(n<-4XVz^ z^pmn)htPt>rd(o1Zz`iqYkTl2eCUp^@dizX&8e3JZHm& zzlJ1!LUHf2Y+c`|2eFL;M@tN40e!6Sk1QZS96tMz!|WPqQP*TEgP4=k>vA^uPxV2( zhzgvFd6>G#W2n#BFnpAKjN|h`5rW^;Ww5ReIG)c?*O(SxBKa_;Ai({#U(m2?X2sWy zK;4c9Ec=(s^cd>d!sr8h(#aoqI%i@7)v_>t2cP^s4$}{OOFtPiaT^{G29W7WdkW?{jtPRaUY~WzW63Vy-4^0h5@)wZ?fJhlVNn=0vi*?r$Y*VGW8cQM*>wO`u z;vN850LZwDrq&^UFn9104$MomSk`*!nZF09w2`yM5{0S2eXyCx!8U` zbH^|Qrig@xJ=YoHto43BOfTkYJ(}w!^=a~O4gvUW3ZI2u>#ml zahGt>E@J0BdpXh;Fb)XXD1%>jL2L&s8v>3U(%_dB&h;qMQq)ILl`kf?dP{XD*7 z33!x!;ETC}Zp<7ak?wMEvMP{%KehSJU-{XPz?N@NF>XFugg}dj%@Me7g~qD(kv3@g z63S-AO=W52g~fnpX~*Q6V3yGebm8W(>9MJslJeilsyx!8#W(&`AgPp3!L5({BOKUT zSP6mfcVv^)GLJNH2t#_uB{gNYPt!*pch9{jv`FDv6wq$@j6R zQB>bNPtw15>^zCght?(Fd8d*l|3tBl*mUHdGX(?JBt|cW^!Y6H{9Sn0Ki#)(ns#qB zmL8aKU9_RhAzW}|2t63WTYqZ+EYBUHH>x(PFb<~ZT^SO-l26Z62DGwSrF#|;nj(yHUhi7v(>kfBx!`ghvXfZU>HDE&7b<+HGaAHa8$7?ibl@} z@3&!oj)Pw*Zf0V-V?vKCVak$gsFfS=miCh-_j`Z7f z?mzmDEof{#@9j4~%Ui~Nm*soAl8hNWGnagwa&*$h0p0KD?%rv+hjU)NtzSeUGa3i| z0QSe#+lg(;fKuM9O?*=N1H>5@&85Omhuuz@7$h0>>04nDd#(}#t5_)twZ@r z_W_lBi4x>%xQmR+XEPDWVQ;&I9~@Om{|gB$H%?|)q0f7*vBq9s-ZE{7)+lGLQpnq^;&gNQ= z+Z%Ensl$67wOm`jUM@0C9FDJC72lyBSjAHithZV5D_;=ishnLAfcLq!a(e5BIp5pE zsHz(|X+kbv^v<(La}TMb%qw1x_?jPeHi3^Wj9ou&7HTOL^+QDH9%&ewr#ktAF zvoHk&1QyR6O1`gOr}7l{8GOmyT-o05E4s4pAc%LpyKjFMP$~fDUp##uL9gCAjAeIA zjgRVfl(S4qyBWGAK0sNpNeS#2-<3zh<2fzdqXYLtT}1ZPZ?Y8YAl}#^6Oc^ogEJqf zfLr(KcyQTWLFCt_J`ZEbZBCT+hG(KLC8n)NZV5{M1aN)S6?CS-^lEE>$X7Z>L z4-m!-hHlKjAwNed7bm@*Yc|c%;ICbyujaHH*mpDc-nBag0uLgUgW8o)pfWeU&31#9gG7&I74p(R4qgaaFxou z6^$3mxMjY}i{^j!Lb!>1;hvVpj~W`UR+lh0CXEZ(>nT^~RZr_YnZ40Y=2}MXHvE=@ z;{|GrMpDbg+zfDHH9aM$wo=e7`0CcLS3;9C^x^Q%v%oneY0tO39IsJ-XpUs(64F3{ z&oE(J$K9Th*#{r-zp|FOxh1^3W8etH4A5a-G0;1$QFfk{-h$i4An31W16ItM7Ke(6 zclS#hTeL?pGV~ZQM9%drrM{GfcXTc|J_e1OEeH!&s?QU__>hdP&DoNfC#9RO=&Cgv zkA7$}9NlOXsv~q5g1VEaopgMZv7aM@3X{_?lX`@9zkc9>&m{RUpUA@L$LJUa$8|E0 zp`tFod<5`!du=oS`Atz;gZM`G(C@SkBGWgpF};D<8J>SD-@mto6fLjP)lZu9*@~tGMyy(!&qnNdG`K&0DDdwkTd+z3?0OvnA5Z z_X##gr__HH3Cayuw(>?f`p7Fbc{I5H^;E2ZGPJi9{5|1Yj3{vVyv^?FpgA^rDBl40 zlnP3e{GMKJTh^OV63Kg>hi0Z+yyQfVyvcf8$C^E$|Fw#zm#4R|$26E_dOLR?;a;?O z1An_%I`8l*p>a@r`&aSK&zRx8pj&)qS{iMcJd@q6Mx!)Yp8`yjr6)j(1y%J4?$5hr zPAL!et~I=n?p37== zt$FyUpw}oFCgxJwN#4KU=9#m2@qN+;b8lFJM{ZBp^$qJGkdZR1TeHE0gtepzpU#i7 zE^}yu9v&x7m2qyhp#`e5sMz3uR5dO zA=%@1q_3XIOo=?o;G$^#oP77{YnWERUuBDbM{Fpc!b5TlsOC%IRq}0P=!!`oj;Xxi* zlzI2Fs66ji9W6PFT32QDXo=ecWng@-k*;kpG>?hBUw31k@b>$U?~IC7FV4MLeC3nu zo2vWf1=*SN40TR)AXk`OmDh;O2LZ_S^8byGha$H03b zTQB%-eH5+#?LqJ6t)e0Bw%)zg%o)&B56Cb0uu%$);n^i}unwyinR3#n z6qtK3IkAM@#yd{?dsowrR{ND>2^6_;Lwx>wuDtUtj~UMUu^Vp9NuC9P0aS9isjfYZ zwB)x4+Y|dCg{29u=cPeqt*%`d5M9jd<6nD_3`Vi^ zdP|h7ejLi~3JYYTJcp(U@sB>;9C_cn`FYu?pD!#Aa(vfL_4`wamPL6<)?xE+Y~6t0 zWCeOf7W)VwJ1>&q-*POfO81ay%<)KNVMQG#jn}%~_>C|ye!RJBCjP6}?=&jk^0KjZ z==$JbbLC_U3^P;kR^MBq4eXJscXQ1vTzy@yR!bgKJDU#DbAo%oe?T2ud~6M*QH7^s zyBb{vmf1m7XK1oFU{Rj3H&BkOcT-Y`@XkG6;8Nts&L4;0(UT(-Y<&r!K3vfObT>SA zX>L5UT3#aioH)E;p^K0%^z<;Pz2!Ix!&EWRB7oP^Ap4$l2p{Yz50KlxEqQh|Hu;PPj zCfkwkn-^M@hK^lKPm_li2s1Ts*C%8^fh@R7xH`PoiC*WSw4F~IW>jtvLyCQ>&HSxU z(k7r!2J#ITtW4IrjfTe!$n(zMC}Mja5*b>wvoJL8r<`ZN_=vH1T4-UGA6EDs2I@`Z z0RM|SE-eoqDi33AH4{x-49^&pH-w-K>;I9JI=&1`;snFEmP{3CrI~T^>8R+bXz#Rg z`uuVb?=>L@FjlsZi6RC@=$_=w^Yd^i#yTiGJoUis8u`^9zUVWPeMYW!SHOca##*tH zT)JRr6;ux!=As0^;ot2uPhQMNmg%c%E&lnmSJ~Rlbd5L$D;wdG|^mpkG zf5LjdKCr!&3Z&MXKn53d8D+D=J^C}OrDjg*4R7-)WhruKPvD3qX{9@EHh@n5)_n!S zgLOph21nehDzh#X|Dlrr_1tg!UMC?yzR_}qdR#%$ z$~Il&|f)>l~p5<&pLSMXmIv)2HP7X z19S*?71iR47HuGBb+lB_4!a(0>M~F4!Vq_!H}7`Od$sK{zdzq%rgC!+Afy4{5=D~F zFg9IRMg`Y-!A20sShNQZkA)R5EG5lB5a=LWIcc6cb5O6|zehZVj&&=Z#dLxqap-0B zV}9VK2n5DrWDxE|aRCMT!%kM@9D8i+K3GpAh;ouu89trgbcE{FDB4Cp+;(odg2p&} zD$&QPGX8?>CU#=l4;#g_0+#}*ebJce3zmW;?94Y=cW(*lWAr{MCPO6{e<1=*QX1wu zyD*)rtaBW6&PBPg2otI&<8lRHC&K=1{;m_dkXn0nNp~@hNRp2I5e2~Fs~RGf47J>>@F$pB0>XboIl zG{P4(Ef8>Gr@>4U@IgsQ<-1A@ieuHMC!>l+=b%FRIj!h*uR9u$_yH*Av`7XCc{x3X z2GxyRkeJYelAo-0GWRLYKlU#IGltP=pd%PX=bQ$aDwvAlMeoJ+srY53+#&j4Q~wtI zb4fE6-<`-+jU|9`^$Y7y@25O@Qgq?xvMWiJIbd^50p>AJ;3pf&@25R z%s({@;Ab(-Cw97AOLGA zWsx3h$&k-X$G?oHM0NxRk6=bWWY~lwKk3J1Cv73RPCWUt_o6X6!txZ zSO@bLnI$XXX58(Lz{!K1g%^U5ff!{s%7RWeyego4pmyw=0G2^h3q|)p^^Q0M0x(_B zW3lJ~&(vcI2BJT@{Lh!2s9|IXI#Px{UwHCLD=?v%eVd>Y$U|z-Ys#Q<;h7uni!$`Z z^3E^RIOge=uwl|jWSq*i0&R1xzLa!rknDgU-5FGd%YD~jhU`DdaY z(d$zorqSd4%~+B(5SV%1EP|Cu57-$0HSxyF)cM_yrGHm~xI>9OpV?gdWXt9Q=n86; zrMo>Axq0jBx5BR)f6_Fy1j)Tf4nUz9bpm>EV4cC1SKXndJQ-Q3-TAZ-Pm5LIlX(?P64~FW&%C$UfZVXkP>zIevlx*G8 zB5nw{dsOx0Og%@pa=HHQzW&sA{hPcKeXwzu#zha#W~dnobp!u#@l1|M;d5Gk55mG$ z^ED3QV5+R+5hx*MbfyXCGdg6JKVe?oQ;qlmy#>lwczPKHCR&KldzFB4!UySxJuK&A zxC4I0d=%HA;-{ujv2LVayAuEALx(^^Qfl~(!rw39)As^zLVfb*+kl$^{#Kwu+e+rB zG0UA3#Y^j#1c~lpSNoQm2o(GVe)jd@y{R3Pt$SVJURb>3IYFo;#`)+x-XIbov2|+g zrcQu{gG<3B;)mO@A(r`|Nwxv>Mxw&zek-dwLC!2w!)87p+z1~?bIk5<#&;}shjj=)A_=X(U~wTmL^iE!m+byN0V9CnC~#p7zDa>QlEdl6 znoAckx1SNaD-{9(q^Qv}gtN*%kYfpt4E?;7!Y8}ow%YvHHY@wPGqF;gHznp<6BRP? z>SC?Mw0O1IjQsiCSz`Z>X}E1dW4M9TwKWuqC;4vR6Yz@MW}W`%rD);h+r%VK0JDxb z5q|{@eESKW=V>?h*M)q|vPz~UUZ!(CG5Jgc^5K_mAn*+gauP`Fuk5i&=lvO&oxAii zcwrR^MUnn^;T_nX3#{-rsegl8-N5Bn#4e@q@-JT^cpgyD*?<=HTI&y3_a)o$`98P) zq1v$>7i%k`ysr9&VhqhHA-724LSwl%_h~;n^EvNG*;~c8%-vznA@YIgdfslzAWRIT z(UyS5G(lcXaw@M(^Uv>T)qtG4g+`LwPQ=tGrY_V~g2(7+SAQi7Y)m^Ef#%nU9Md>0 z@h+zJNA-J%$6tDL{WBSY*=a>1YD6^n%%(}kbuR82`oEd-NDSMKhXXb0LiE_jP!~=W zuy4T0QC~pTAE>a3LDUFp@a4*)PnrB~4g$Y;*H31eA~7$72q?M_qq7GutX|iVzIc~fAX8vC6=f;*iMUo`~ov^2?hJ* z*iYgcC+>*&GS$31P>iEQjI*OaBAaW*hOv)t=c)AKyZnv_jZ_*@3p=E z!Xfb(8vaf!K@gpZ1vZvGTuY8Z`BJ0GTT!DTwVxHkKd%irq? z`rl@kNHI+}l;+EQw}KtlZoXE@NP;7S()J3k^=K?R84-B}rJg(>8aQ%D<_|h;(K9r2 zev*??Ixc(syTXws>O`N));MAplFS}&X3^pP{XYC-I z@lnw(T}JVMD8M+~O-^SnenZws|68|tNSw169l5D$$Joj9%5Nf`{z;X%GJTjMX* z1wWfS`)cyWHii!J@dYJ|6|v0|P{QDF`Q}V%!DH688IehVhr-57m$cE?y1xX6a>>|J z@CQiY($4E;K4^YN&HwDPlVKF%*;K z@XXjlfYF~S`Id?*jS7E#>5kF~$S+wnDPzq3%rAinIp$SK<9bc@Q_Es7dOx$Po{zG$ ztDcB_Rr~csN%@8BgoZZk&^ZK+O0P+nnMs0Y*vFd#kW*HUB?fld@!FG6Len6o*G%}Pg1-9%20MY8&M=?kWe)w$3>$8 zg!2q;9x69L42EfGvQlU0AmFsYR*7U=)bp*m45Ziy*E7b$RKmImp4PI9A0)LBE+zI0 ziWR`imaR$Hlw_5sYbPRnMBK*uMYIyc!Os~m&0B@4_)!yUoMQT3_2J zbhfzMm4qDRu4v<7L5q0AiKmz6(?zus=G&LF5+iaIN&aI@aQBx+rpG$dG#p{#Iar-* zbHDjxTTbVHA`q2ZS2Nk|b0BrjGNTPmfRA`Dwvy92#MR(>&bizmCDqeUfFsfAw|XC`)r5@xyfLmT}}zPi(X1tCPp zNHA2O_8){k$(AW+m9>zY+-#Q3}yn|*Wkln`|^5&ELu#dpwqqwjN}m@2R~)C zFBO0P%ueAgax>VG$br-=LFPJ_RWhzAfcrDC8Bk@ECI;FbZxw2_oxNn+OfcanBHQB6 zz6yN>j{y$U3@klc{Im)L>2v?>3{&D`GI;+{Tk<720+~M;gG(u*!3aho5CM7*3zYxL zK^uy%eA!_Q#GD6x(8OoA{71ZdOZdKuXIP87GPr-1SYdcuYc}_ne*PXN$|1nDJ}P-Y zy&JjSn+B&F0K-l>GWR9`JhU)z-fCZv`tsw2+pK{c>09#DdSk>U!0GnNpE;Xt>;KYk zn9Ct^D%Eb_VI!bVo%rqL4j8B{t^m*WzoN0-fuvEP*N26`Nz}rm#uD&F%0a^#TJJj} zN2sz-X{3Wb24XV{-FYS_GChRsugTwc(m?b4Px$8kz%HNWTj+pOb}y96aDH4c`n7JnqUkmOvE09GJZ()lFsi63l{Fw}g)4 zapN-FuR?+ujiEXw5Kv11dR&rJm_;K76JN}^A1YP=tPsKJ1)ma>}cPA6#87vv@XQm z5P#OWR7hjPgfw12Iyu^<#WDurZAL1<->ZE@j$}`5ri{a|Vgtdz6$mJYcB<3_XhZXE zUqUAJGuZ0Shf5Ma?2GA8g`8!T8sW!~Z<0=5IHn(0C&2K5*Ut!RddIymxvU*{oBJf7 z+LxLWi5EK%)zM!}S2vhqzh0zNAmCQpmoO$;VDaJ?b#}BRJqqWf!=R%32xz7|28;4O z`yLJIj=KPZzNp5=F~0#!Un@1=b8A-Xf^OMzt?$1vF7JN+Wh8chWlldx_-KofOu_78 zbt1{ScWjDvxE|_2?2%zQeWxGXRhN&k0mzbn&L`z6@lh<60?ji2=~KS>;nxTw29+%# zjXPjq3=u5AWL$G)LyhL3R?6kVAbFrrVt@Do84m+AC|~N(z%9LLl+++T$EKJY3Z}p% z+VG=#f|0>DLX%au1bl88g&{75AO5-^2!W%&oGsN3VggDz=p6vB?h*p!HyR5xKQP^_ zzYO6E&|fC(O0AklGNfx$$XXI_%m5#JC%$}NT!DbkH=aB9pZ43ONxl80#`yQ)`}uE+ z4Ryk%^jr2Opd$zXI*dgVF2o?*OAeY+KxgBPU@nuNJDk&hpiap0|BO6=BfnYdPoR33 zMvt4kvmUOFg(JIl804W&+l3mhvP$Ix-z@YU9Y+2O*>h2oCM3EtLMTXBLYzkHru8w7 zxB$@kFe{waAHGZ6_rZA)29pCs;jfIhm3zfotv#A{Xo$u9{4^@kRTG>0-qX!LuM&^e zN262Ci#@k_E(6WyYBJ#6`OHCa(KSzjO*2;RQI7P*kF#jS6`wxyf3GDkIi3II<^uu& zcjaDT>%y)r5-$R7Y^Hd+uo1SP=V4*%laRF%z-&vhpfx|zkke?1%KQgQdKVtDJl!x2 zovc;IO`KbcB193KPy`hcBq1Vu_5~@%8w?P>Oe;X}Zka&f)HH4pF$coHKfes6r0v*B z>aTtuIy*_S3-Bw*5u_h7`JCBQ_U;QMo__$K*H2Jux2+JxH2pq&doutk19D_y5HXyB zyiXhgDtxhwcfgcU@QJ-}PHQ*G79jvfb`Xw7v+_WT>ce%8;?P~PbHCzArVZr}oJQV6pi-*a3*DNb3#G3eSI zUShaO&0HWp>N^nI<)?Y%omTm`;f%7Oc|VLSB0r_72ifDv2)rc^j`ho$&^d+zw5P1+L}U>)2;WDx2868NO~ zBl41NFqak66u9+}7@M@U*&%=lH~s1*q-v}DQ=|VS3`qkNaRRH`z|Fm6Rq11ZJGU{|oQMl5fa{wA{1coX{q3s+>|h8}@`8-vw;RROw?Z9*Pp|$qNlp zl^^?H7?GwS@{5JUNM*cM2`5^yK{{u^50l!Ip0|Rk_l$k`GQ7$ch99T+ZqCx zaVk+{mrIe-5kUC;42I=)@u89gM;d5cvX`801wRY&(L~DZDtWyje)e9xU)vi$zgMVM=rw0xbC+4yeP=~VmVi1{ia-X}f$OY*YjH;~RlZyd zB5<1%m0Lvam2)iv{=%pb{RMEnO@>|jewTb1%u@o>dVsoA(WB)Zt2ATpn!lfXYG641 z4M}>tlIzjyPgBZN=&{`DRI3B+tiO3L_-OaPO{csWgBm46pF2DQOg80U8x=8J?n^*b zjE5r9>~;0s3mg2W*{C=H2cSJpqx6-X<5ehg3q&!a9>!<@}eIt31HO{O_4q6>2f&gfG(z8Dum1^o?q`vJp7~mpqs(0~`6>`6$JR zxu|__$$O?wrE}LwXyu${Z-cMHjQ#uATtnzqo=sJt9+kQrQs@B*a<}^K7 zx>Ga3?DPZ}6Y)L(0>-njjpmp=a3SM*4kM`qCdEJbj!cAI`jzugb3_8X<{_?{vdV6k z6a6>ePk|DDbqVNV4%}AD%VhSTRm@cKJi0-}fNReC6iQoohA{x68RkQcrEgWvIMC?P z!kP*sKX=-`bq;uV)G8@kQgkBE#_43^aG6auEhbc^@vOqTAYpizYz$%<6k>`tUNwo1 zf z`ZfVWY+a0A*IAbaS2>XH5;k?1m7@OD$3d$>Xu_u=md$rcXWt zBtPb(kMeRo&INL-S3Tt1Dh{AdeN!+)PK=hVb#UbKuv}UGreJbj<*G_joaXh9O*YaO zAFEi3=F4GB-pr1BHK>1ZzEeU4CQ9h&zVXBEpA}PUslT9>V>kRQfT^n2L+V+4L81x_ zV{y2O`xF5(u-b+Qp~Fif^-(ReAGmZ78TVGGP}~o~!_@fPzeHP^5&A)#5c3@02vMvN z{?z=58`CYx{hx}jP{Af-=1#I_*Oau+K6zY-4+iA*E&6ffV5*%{{9SDZB870mV!-J@ zszd5zI4V?En0&&G@^9unrHi203UE+#Qu_7GovQWqTn4SBC1}j2SD^O>9VBU|h}3;O z2TW{5a|N^mla#1p_%NNWoQRgxh|k?ea`%ag@gVw#|3sn%M-NRL4D0aN3s&(!E5RQW z4}2Q4Y1P1wkpV#~BQeozIObteGDRJ~*89&KA(s=vEbKus>=iR>Qz0?(T$DIMF-o9_ znkX&O6n=i6GgFubPa69D9vjbDlHOYf5t-uQW4 zjEe!haCss6g{<-n39KG2dY~L7JjQB71%e5cYG0Lc=cmltnq?$dsB&hOob<}YfGsN< z5nMOiN%T}51rY||oj^ZIQ7&>en7PP@?a5=ndom>&4$9J_L`&s&Sw-aN@e7mj^%p3c zKlnWTQGd}=f);qi=1+~@xf*1fslqbU1Vgtf1G+690scKv3rqYjHD_{~6rMcBKY=;s zJ^BMoxl{h78CPS>Q>F53ENv2(UwwKKF-7^(TYKsyaEgb+j-RLXW zmfJ|72Gm+oc6^0CB{QrP$=)<3B7Uo6Y%a>HvmZOUVtp>ijJ}8*qk1FA!u3XPNZF5I z8zNq#AH}4xjB- zPq`Qy1?DqrfvUyuOZa4ZenvL9?eepe3pI1wHmFrF(H0tfnwW!t7Kon<#Dw-@-{Uw! zRK~l)D8RkWA_qzJNgjbS1A7~bmCcpRWOpORCx_<4RIy&<-1H}!^=-+gKIm_zK)7~ z>T6{N)M>Z%A%ujr$^^eEpGfvTtfU8+e&$T+6lRvOz4Uousw^%F+$taY3R@H*2y4!J z(W^_fD&yWX4J|B9o>tk@lx1gd@2y&0oGvLm z<3a0umixuHJ-5I6mrQ#yoL>HIB>$Ub;xN*LRjKUWo2XC+NxE9LtFcR0Jw9{$v{(0Q zD??fupw@KxG1L05br~GqcNdx zbTEfEr}}>40Sst-HOa%z4{9sGgon20c=4rDyLjGKS7if-j*C~L4lKd(xCY9d1Mpps zIkysNfNe0ZEk9YxT)EKTD5ke;(_U%{m!H3lts7m%_N+d8tNlt*?7+#s-Qy-BR9v-c| zh`}I9j>Kr`7>&EsFrY^o1Dy}?Lok{KgF(O|rnU=eCDuuQU>FTvClx{wG)_7szj9+n zGd_ix{b7Y%8~}>x8lFln9)bBQsj#sR>BeXgEk1KnG6;CP*}!F*2AC9vh0j-%{TLaW ztCZoi;NZu;L%r}939_KwoBi zUiX34?%6<~ij?t#dmYvheqxinDvq(f?FuEyHloBXrnO7W4LshYgiJQTt2`|i18Uf< z%k)UqQQ4^};?V?{(S8YU{u6WSIGY1N*asiaADmfhi-a7m3vYZ)!OL z6_W{odreO=t9e_u!zXoa1AM+qsHrXJG>1JaN9bZQ16&hSk^{G)W_6;T(NnVn@0gH5 zy&Niaolv2xj2r>H^rvYO;scbQ4@gM@(20M2y1s!_;R#-jpp6Eq_@KGL$+pZzs6C?i ziIG8bbR3hyT+bY@zDkMt+Vlwm0~GgS6ZjhdUg`KWbwc>mM`)O?DR7#QEQ2W!*s4Z_ zFa%vGhjR-Bl35*OKB(Yi_dP5(k{mO8JTzRKyd0rr0RaS%j+%Krwi9h9t^4Mg?b zedOjrDhUqjP?xu)@;;xKroJG4%xtS!vRZex?HoadtblUm06W1I`i6w>D34Bj@crG_ zBr?&t_?V+sVVH1t!HqEp+|RUjnua^|Ce_Or!*< z6)^VMc4CO-F*#o+UWT-+0YMuRe5i&g2wq;4WS_$b(Dq?NOA%Y{^v!2CETN`2v6eaK z*gg0j)8mzYw}Tv@b%QawAwrx#OrOjBtn67)-85O>TWDE6do-D5(cO45!kdpOH{5d!aLx`9XBZiJ+R>ODtJ2%>j(iyVO$ z56%es8dNajxKde1H=w70PnJQee;ol$BH)w0kK9^^pTj3JIVt`Zi{^P4u?eR4FEW1fmx6`f6V_KbZIWA0M)9mVqBM?)ejoh z4$RehH1DmWfq5kQ1k}uE;`!ns5f z%=qORy_1xaImrr&vSZ#FSDVlj-HZAbOK5n8JP85SFe0j^{|fi0Q2%O3*+~`;;eSss z9`x^1xQO*~95nSU^N(GCMq;QNeH7dEm%UWWV)zSFvxj!&WoTKVRG7DxVhQZ-+JO0C z>BZ}Eq+x(pNQ4^3V}+)DM+HPrkgWU}#8lq&qspX2tPn^uPe!OJR*vT2A{pkUhBdwS z02>nCC<-B0ZiIK?r>rx&0`K6^nI5H4&^Z)=K2R9qT?FatjJ)6-)C1cnRZ^)sSY3p< z&Im&+_16p)hUzjH;dhznC*}n^QEe?t{7@O_aNH^aqj$Truy-xp2*O=oo8{b7ptvfm z5Y0gZb988_u|@oy`W4@E22cxo@am1YWm7So#E8jhp4iZ1+pRm89h~xPMn;*%;$_+O zn>)Ht&N%{M+ z!diT$g;jBmw7-7*JR7Lq6G5u#0A3pqOY4xg5!-Ylfnc9iM3O0eLImr?ljkyRw5+&w zwj3`tDu%9t##r#-*DBV-Ro&~R&6GHoRB__#Bvd*BUgK~-@3QJwHg_9A-Cf@FaMBVt zi`d`%o=_rv-*r)VjfCDwnoqk&-+KNfEycbETE%AbKbfzebkFwTm?YF62Z({E zE*D+1-xAjuu%b7+p-!suIJflL87njIz_LP8cCP$8-gbJiQo`@PY6X#lE>vl#=F7{J z;o_F<2yH2p=xfr}gX6k}XXNkxYLG+jS#M8TFs4^2{{mN%!vBQGRF&LOqCSpA8#9ZJ zpr38``X%k^R*9Efh5S3fPYD+v%}n$XQkEBWbJ(6Fan8sQ447@2+A!kY)pAPI0VIwZ zJ0Be(?bA_EdKFjB?Mb~O2q6`eRauw7za3n>N>yV~LjoF<1y`q~!82*|% zeA2ZsGO_(iIxn`@`NzVc)~;Yzv)!@!C+MOyk~ARuIv^zjW^Agtv2t=}JC5eOTcd<( zE`p`miJtu8CkV-&ccG%HIJml`&w$z|@fxql6k2Ec+5eu(A#E1`Tc2IF)R7km&RuysEh zVX=;CDJ5Q}PYl>#-Z~X~A%W>q6!_ouq#|%xtH5my?m0!BETte7F)(l4h_$22bbGXf zT_d&wP&b&jqT%)lS=S#8WBW-(`pjGTLJlXoYw^x_C@Kr!XQv6d8ePHf?nDsv6o+bM zM8lhv9@&cdO4Xd$A}R2RrqRyDTc^1=Iqa$Ip(O{j3u$d=bDYdjqi-f#gODc%>?xk& zpffoae}p-LKmjKV@u4R&DMTf7%u(i05r*6dubTPb3BR%q3m$%aiHn_S^i=krGbhBk zE;e6)^nc)`fYyddVNRL_!|6#VY6bwFW?}7k zhnEcONRkoUTZ+!lM>?`l*`KjH12wd`3om*#AAM_7K&s|c6-i0O^3teO-sAe!!W#A1 zs?4aIG^QmXLX+v6Zp)p8dlEUi3y@PD;4z8rGqWqTlmt|S zmc&4%K(G-$IOQev%ooPDBuu*3Q*>|z8Z3f*{#5z3T2L)4AV;_>fFeVaJV*Shas+xe z4y5PU7W5foEJUCeF`&wqCmmq0ye>W-$^VXyG-+5Y-o96cT;G7jeRxq4crC^2hfiOT zSnzhsT%V)H4@CC$s}LMi@HPCU))|qEhM40v;2u!qUuuDBsCeQ-YI7QFV+FPmx^f0&8QY7+-oo{*~^Ge7Pm7z!$riMX{v(!&8M@V=}}9%Rr2AE`+|1~w~? z2U)jH5^+Eycv%)0ubq!Mo+o+%tukt5l^Ul#QvDJ`ytrN(;?+r#0*kX_M$@Y3-F%D| zYr;X40^+l<)(`HX#oiT?-oeFSUCe`|J#!g?fT0i~pl65HGXlSo79+TR%8-J~8CUKd zzl(xbR0%FK1(S3cfJZypEKq+?pj#Hw2LPo)@cJ=#A!M3U2ni){>CTGk4_^MNO(I+( zXqi^zFiI#tO%iCt&@Q!8#tBg?B!=KuqEWd8z6YKp5gtX$j1Ec_L%x$DorW-u;KgY} z9{ONJPl_IC3>je9;FK>fr}5Bh5|;y3pchP9{!^ugSV`4#4NYJBuypeoe+U3x)qIh zNn&jP)C&bp#w?#XP1k zNj zA8_Uo57R2GS4xNu&w;D*EByLDKJR>Z1GUg|i3jaTUA$d!avb-vkLonax!PIs#~xAhWQ)XiUa>g!ve?DT z-#|cxwNT9dtWwA&2dy-Q;pX&_CDqi+W*0MMN?BSjWyqy>PB z(nW(KbvCL--N9^4QZxdQ?EG+T`aY^ zTU0&I{-!jKZHfH3tahjq`j_+FYtcW1_4_+p;)NPrFc=-E(OtsTG!0>C%CBgVGmhj z`WVzjL$0Kik6M|0ydJx@x=Ze}d-SJD#mwhlvrez)z~6#SBLVvN@BJN(h2-hp|67mP zXsO7JPqgUx_dfiR(!Tjj3_4bzqo!vc(}n8v{Fle!cXyfQ969$^PP`v$|NGZ})u%#x z?6~y{$yP!ja0SJ*J!0*-ukn_W*_{1X@53a5SynA zM0h!i-ltBJ7rtr|c#$u(rs&z@_uPr6>`t{ko*}a;e3PF&+HYx;COZ@!qJNrNGBU#6 z@^J<5ovyu_;dLKVoXE%Lw~H}_w&j7UmpeRbm?#6tV1n|e7GFu<>80SO4D6%L5lhV0 zD@zx%ANpKyXXT4$6}r6q`FMHoWC%AwBK{SH)HPh;(8n!f$_VMPn4e^S70%lpFwws) z#JN`r7fihv@VC@s&2;t4eYIzEu>Q*A)fHFDmZH-F8Dw38WA?e8E^*Djv~RR_e(Sc8 zuNkyN`&F7s${oHKv}{T%xiW*iczc>N?AqhxzGjgdF;XV-diF_#UgM2kgy@*5uQMY+ zq3O0UkLYXl-(;$*XnlS5IrHk^>Q`nrrpszAR64XPy`8SK(WQZx?^}50M2%!WS&xm# zP%Pp2LV3w#Ek!0&pjVlNNA$O}FB^Iv{i#x&>MGxdq&{@v#Z#Gm)_rbi?)*CsZo96x zWS_NfuHI@obH7M6aqWyubSbvJ=}o~8PG!mpySpDg+s$ja;b%_uoLdTaBnwrX&lfJP zdcISXRJ-Pv9pnFbjPkr$9A&MX#IFJU$4;x<+3y&h<1Q2g`ab)Kfi$4uy+9zhW*?I-UE+O&%g&pa1z|*o&9epYL@x zg{-HaG%)dGWn9K{D0U6zjTjbWj|8k=P@mAk%`bb&-;!Z={m?WF=HjV~sNg7=O)q{P zf6{59Pu5crXm@^G7|}&`0{p+4!>~c{zLJ36--Crr63 z{oF?DZA7^QCH}G=R~0io=kxKZ{By2gvD-G{wFG4q=jpf;0}|%xKc}-WPjszwN_zf2 zxtStfUDwL@~s~TGQtfT`k{+EiFZ6S?Vd)_J~D^TLp=) zI+gZ5HAfx9d~DAS+~#GYPvjiaBj2H4t<93RK$yze>Iw?(pR#>$hUV#g^N*4(LOwJx zX7A#p3O*noTNT#|oybb0wO6?I@A=yOAPLIWOhi+eNe@mMiCnb;AYyyqwP%;BOgL8gD)N}cg-{yl+R&~luS-%LGO}@`? z#lJ5xW?uhrsdLitV1~xfQt9M5#y3GZ{i!zO8hT~QVRqyiRssqJ3g(xC65LPyUimt1 z_)$A-9BIBC`;CX^4!dH0d{-}bLrQ_i2{pZ3FJaL-AMM{f`C;FLe!qAgXXCZ+|38$y z1B@_1v@STdZQHhO+qUib$F^Gw`hDW!v%C-kv1dv=KNAJ2%9+LbyvjdreM#CGTWJIGgcrb6`oJ5JXKDVvM~4ejjB%~ zT3K80`)z_G9ksn7*L!4u;ya?kTa>}D6!q$ss2xaszReCw9ADR<6AZp=1y&e;GBNs& z;try&8S#Acj!S9V=i*|HAVv=ajLC$KCNd+sUF_v_lwm8`lCVQG@`8O}*_+KjP1~1( z(65ARFL0H-aki&z&ax9yQ8G$w%z8$iyhf{;0yBuJa~g;MGh`AFzREs*S5tWywhx1p%mAsue`_;bU+!Vb^hzC zIp=xB_1DMsxMx{ZuTH^J0fkuRUX*IFg8M=x^lJtG8(3Qw(c!;C9!|FZEy%;l$o!wt z=ar6hTy+QH_KEr}_=w}1t>qAr5)x%+)fC-CVOFS(6S{j!Z{B?p)7+NBbvCo}Nj_qr z+28sqzLgD^Ue`It&!Cye8LZjtn^66`k)6BO+4Ik|*6UgSMO=sD_ONT)b3Fm(aa-`f z0K~10EB)W%9(3J6Jo2HFicefRLhv}VMNzFHZMiBQ#r}v&!9T%azBdp2BZRu4C*V9I zc>kQPl##~GNs-u<T1vKTN?}0~~F+agZLiQwTft?xg^E9%Mk} z+w{!!{7yU_={UfLfaNlSVqBnlp&bbmi5|iexfac*lG#v6GZsRGu$})RMJ&hx*(v`N zvVP7{--&zQ0J&H%P}OAATM2GV!V*^92(mo`6`+?WfFUN_7Xq3_N_JCJwPV%l=+b+j zdB{b{7|zn~`nEwug@kzrorU;L&z|e0JIscX-(D_y+U0!=d$Tulj+(g`#!4i(xoBbW zjD$IFYDtVRkv?|CCu*Qb!VC{5AL0=8&|vI(*04XeGyNhp)ZXD&8TYEW(CD6#cDZXKUdW^Z`y4WlM}4Y*r&O385(imW|p}$yOc__b?eMR?Fzj+?1|-t3c?b z56qDe$w%fiz4h*^EU;k0%56mp4G_}tob5^kRcCYl&TN;BVP&yhmhuF){9s|~*~uFI zkmvAe3btx9Wh#$8)~pSlxKV!NS7SPSz88v(3a>+v3=2 z4x}eCo&)-9OHCn$1Ka9wm#DFW+TTfEPiloji)PH}`UO6I9SZ3^ukzTt8%t>im0h~; z9=Xg$gJBs@@|>P6`}nMRc^^@tkiBj;SLWiC=3ykfFi3$EiK#qb!`EjzRlv$WIy{w= z|3J#wg!xNtcb!yCINH_x!LD@zoEk3qSaYm$c(`I5xn74f)!doOdQ)Jy_nequqp_(d`^kH7U z9u(ks3~Se#`j|8$&Xl|k5gT{4oa`HqnK~|Jx}cR6d7|griHeu_v`2sGGJyPGPno7l zmwUyDZwXztP-dg6=t4o2gWm=R*0bJ2Q~qj4T>*4p72$@Wqn_WZQfwfQJ|^+B-m@u{ zkN8SNL58m`g|hOO={3nBo^qMqZuSL7n7`yN`T;9;ZIfJfF`l;yDsJWOhOX zyjF4Z6qqlQmhvWMx~n^^Z4S-T0~{2#fGT`JV=}f z_;!c=qUI8!6)&x}&Y==7hbeo`afnzmG4*Qnbu@~fKkYKoCqsI?z1lJXvxukS0kiYd zzfk6{Vmz|IczU2Ec^^xLNWhgS!yL!no6wxlsjzzEyKNhw3?iRQkYIv6J~`=SEL1l_ zA?O;oH>o2;TEpe4%2r&1!ULZE$F079@tlE@KEhU-UZe4@71(fu;?`17tA*s%!c-bg zuG7P1K{LHqNkYrn8a=V~ZMJu_=(Rb@bj*AawC$)D_}D7&Rnc;fl2{&PW7{}jbbEh2r6+yS z#Wc;LH4*l$g>C?fv5as+l9{HcR|8dQO5yx&Q#+-CDoxZUT)YowhUP5c4&p##gTGo& zwAC{i^MG!0=KmqE7fN1>CneY@^DNyDtsU}EVdAOd14x09XCZ#74zj(}b1nn=W@v^afxGr;5mlf=BB5{sMl#Je-;yaTgU1vA$u~-Tfl!U_nHq&MdBAh1q)+#IZP2Dj|K!EM~pwba9(-HQ;iq z)!~2>+hB1COL`q9qM7NQxA5XDuBm0FTPmz7xemlErZi}vBdQ6PEK#e%`?W9L44qhW z*0N7{!F!acGC!SwroxY~Bk_!tY*k`jDPiIAu`g88_#@SE3gCr>gd-Z)I0aoFl8dDf zfgPXg=of*Kncc*Dn$DUF{DZ)^>L065g9ByxHK6ZOV;f)HI*YoXRy+%QZxo1_v|l z3ER0^#B7sTgng5-eNq{S{qGz&%L>-W7`ba#rx5|GK%B>4gW6w)dYOD^Cf0j+8YWSl z2j?d;^#CUL4WX{h^M$g4zg2yciJFeP{Y5zvdkd>?Tj#}yltG*+bdqjG-_WPN+>~Pu zo^e@wW5-A**Z*zt2hf*y(c-_uLPlox|1Dg|%*6IzaAEdjY&8dxz{>;br-0|Dp9Coy zt!pbwXH~_P1)6}6eFwVxQt!?l_=sR;SNv0LloUkbfPpy9K&(UhvG*Vrlz%m27vnnO zMdlto#~rtgzs{Avr`7jYmK6qREY~uR>@={lh{7U+T>A0!;*o!xii<8a<|Vo8FopIJ zyyhgur8u^nqd$+NzvM?B=*!O?dgpS9f3z^q;|l!W7}}(`g6ik8P8YBAs1NM=_Ua(n zen$D$lo}XUi4eNCj3R!dxVw9W>bPODy{LY@kdCm*+ehW1lgNgN`WWR+d7c*M%Z2R% zuFsz{{umSjK4O73NvBHFYes3>m1I|98{y3tn&hu1OJ(_oZ*Sq?#>zMDi*W>~-XE*t zWf9E;zn`_w*0&bnjc5f^ta2pBnGq^wv)|ZIQ}opi8cp|cCT#Il>{Sb-IBf?C$OtM> z&RWsQ#*S-MB@^n+Kf^yXphRvoz?O?8X)bahSY!eEQNh}hG$|Ss1kulel+UH&pW6-8 z>9rdaDMahl8>cDTQTS`;yNo-uSH)Ny-$_H3~KG*#=POiD6J7&aq*$rL8F+#jC=6(C5z{=lJjZd-`8C04ru5DIHDEM+*P*gQDzgG-NJgX^uB0?a_edt9>G?C? zgikyJ@vkT}L8H^QM3;%xn#r2iLJ!rgf;#l}5|y{Z{Mk_q5dk!Hd<7qC?-=h$9OLgh z&8SDB)^V))gmJEH1+^Rt&K~zy^w$V_8BE2B^73L$xM~~hLu50N7lLfYU<1*jWNuXyIQhYL( zM{Oiezu?~w3D{oK6LAHg^U6EsFiXnjxr9** zYE$9US&EwjdkT5XN5=(yci{*$n&9NBlbo*&anJRH_7bIlfR-<3ARViLnCiJy;MU}| zWsn97B0Dnqk#Ig>sWwYbUWA8zFidb4k7TZ!N|K?tHb3>A@ z2_<~(u$&l8LdJ8xFih_$vSfATRPAFpPSjv|XpNX_(2|V(S^IVYDj;DT_{X4~m@|@! z4hc%J;l_-;J6di_Jiwa1=XxY3vdyg%w6w>07W$Qs$#LWY+C=nF5hW(gQ!8%9IqfxW z;U&2X;$h|2f~I=^n6eGYTpV1Kt_fVJLchyi#GOOq!`h2k#jfDiK4_mRgETIB#{SaC zUM)MB{1Re&o05@p65jrka~!U_`LeiA5AVz4o&f%7qJrqKZMYcrWkN|YpV}K$6rJnq z_Kd%wJTg()%e#>*iLoQ81_%1OL35*73R(qCbsTYUL23v^5BX7_6}|4!G0v_jR0u^A z^P#yAc#9=DiR0vM-Xqw>fXU&R6P}0WXd6dGnr>F0h%4XuTpINUsvrMof`cffDuGqi zStpc}mx~^Kt5F4o{=@59X?~^EUICdX&_epnN9V)s59&Vx`AJu~JvLf7#6g>o)Zunl z<$AcXu^@SC$g&C@_H0*1Fz;W6pvZ|Z!_Q3M$WMW_MAs5AX2vgZOq`SrRPVsvnaOlVs6TlVvPh#aHc3_{NmY*Rw z(#9wQ2e=wc;RLwBGdUNf9VB`O7z{n~kyH_p8a{+Z-Lj#m%n+`=Fo&!?N3j|M&m$gP z;-ET~68V(@zy5Q(lvG|L{xh0A#qoY)b-#>t;a$y4)9 zDULkA3gEf?Qc#P-facp|3{va4Lru{Wtv4Uu0+wx~p`?{$y)~AbYTBa1X~@97?Wa){ zHPid-fNrhBkd@ZhXFsHe6}3`E8rr)a($8DU(LFGmjs!T0Y`Dd74f49))ove+eDj~n zLZ(oKXCzIVQ#o^%?@3=Jz>1Zu^b5{B+<6aKQbRP;dRWe=8fe`toMQbFR3=Abw@k@3 zOG+mE!aLoB`IhRdKx6Eg>AN@X`!xmBl+&BYMeFOEPddZ*`+0Mg3*%9i_}T&KW`2pf z5U|N8AcK9|`!$&FW6ks2ssxxeMEaHQLwWG>H%4xzjbcKr3)Lw9=Mqj04Dq!9y$woj zWALz}Bd^zIB4|)*l1;dO+PPS|%O5Ou^aF@Umb(`I2zu7w#CpmH7LWrkHN{8Zu!GpM ziPPh6@dce(c1TQ@V-muwT#%mb)FJ;A%dCIO#7fM9--i3d7>pjG51-I!YJ0uj3_Nsn zT6|ua@+$p5oVtIW>-+&c{29mp7vPHhKZ@f0e=@$mG~<8e8Fj{E57-d8PpBV(rycYG z2Eza(|7?PtX~zedXttZcIZxb_NhF|1M`fKmmg2^l5h&0~tJI&@v!N~dSZWCG@ms^# zN4pJm9N%NoeL{`uM?IIV9FOX&3{p7$t3P(N&`T!@%nWrLV6oTx;FnWry3%B_0GAzB z%}wDqH5V)BUU!K2co2Noo}t%q_=)OW%hCPZ^TL$>`atdGbZg_V*3`;v{p?OP$7oHKhKosi7za*KC&lFmbCTvLu(m9eB^gU~|Y?D-Rz zry69p3ccdx%fL{M6TnbSGPL<97M!Ik0K?4r?~1(bCOJ^5DYPlE`zwf0i34@c$OtvE zeMt0=Tl;{g%cKbBAb){IAs3}L%E&fOJ~l!zVKym4F>hrUs>0y+`{Z6R3036S}!G3XvTBQ7{4fdC7kI z=5icW@7ekyR|ch|_oKB3ml*b-`un#;ge&qjBC3L$aQ^(oh%9u_D2_693F>oWwkZ*D zYD89UU((^QN- zR#10WR0=Qgo_6@XkF@NcB+R$|v+>uY|9 zE=e!|gDO131w{TioFCcwS>Hh8TZTrLUwcb;*WfIQ404t3nYk5*$|DwK5#M)7a!}ZD z79d=L&cqD1qST=6Z5?ciXfhSYGfg!CR&rbL%Z)2V2tu&q2O%7(*UO#)UyE==NHd>f ziy|2=VoPCCJiqudVji*jT30JHtl&ZMuj zHh+k)T~GQ5bx&E!kP_#?c%xa{9RaXa?Nj;uT+~19@(dnvMA=UjV%CaMs0=&q@PF?> zqnM;&rCvj?AW;+qH9ZUp8enPv&=x|O#3-Y}70)b}l^ZCwq^-#{^-;Zy`SDOs;bzPp z@#N0g=ZwSm@N~H+x&%THN{_%gB281VT)M6I4y|1bbil=eI8=6X_CnIJcUAQb2r@_# zqi8+qyUm=^xRYc_3ita)h1Ix-5kZre>JB9ZBU*f*O?`feUGG!J&haKm^WTDBG*g`j zOv=|xKsz(rgcESauZ&>qL~=)R!^@Es6C`~$%#JC)ck%9Z+ zAa10=NN1xfqTv<#D%e8FyywRDimBYi^@-)ei9Wi@*R8V=v-T41&TFGXPlWOD9x1K- z8P|rS+ty({cTVTgGa08z4 z^x6-z9)*9s2&sKL4sfc`z0o+Qh^BgJ5-h`h3Z#1^H83~B7onUvt`kXThCh0*QKU@r zccrw%DkqV7wgW0+1S4L#7grTpw#nID;%{MYEXqYA=e9=I1x1xaLm;wPHQNJ8)p%C- zWt;4ze+P-pbs}RyQkfBUI=@X0E(k&{wOBu?vC?J%o`)GF<(W4L*Z{3ElA^gi2+Zb2juChPa zo3G$FKe{VEuW9lB@J-DXD5#u zwKnEE0yJ#<^t^t=%G;enbyk$@0D4d(lrOyQ-d&m4RbjSO$qO?;(K1+!f+&)HVEJ8sxpM1$7e4d}!66v9Yl$p`?XwX&~0WUZV<|yQVMjVWyC*UNL50cd^>~XJW6+sJwsa58MMcyRIe#W)D<7I`` zVG)$QXH?5W-n5EA?Ax9E^s|ZOB8_sA=NvRNnsHX)Ec@{K8VI}r!NUd>*I*r10mRp| zIr<)gwkPHKUD<#9S3|kagYY4vv0nru5Mw`x*D_h61KfohvE|K?F?AUbs}3` z#N@?i`PLfGdZq*Yn90y=e?S&5Aj_WaEQ3-&(?Ok_R)75uBL3O5r^`!!?}m2KcpKyD zbi#%zG)|>NwMNVhQObVoC(cqp%hIqIqc=@4?k8(U9|>K#6F@=U(-anyhTZ^LO>Gxg zynXa35JSPRn1X7iS1^R{mrh$;H0F5-y6Iu1=lF$rl9!3M|0#e~>FBd-(KbR|@bcp7*l=*_KM3b|3p%`0- zQ>SUbtSa4hUurVgc`bUdA67swATbFHK(R$f3{K%x8 z$@XB%>QtN+(%7oeG2PLO&S$c8`nI%O2zTNSSQ(9w@R&86#O(r%pr zS~`3oZ^aGt01vzMsFY^jv}eUq7(+E0wC`9yuq$2gk%>}gn9&reO>&yo0VKmWqd9$F zM@~Qzl2iZ^x8K@we+Un~1twfpwh9R^q$qH3f<cdq6dpmaD6Lu6_Af8m>_zC6u;e+&nQ50bN7^ZBR;|O zG$Z8oqJM)Ji^#z$cId6MK;&y94S{y$n-jRV?6G&iMv1oobm<=9suPvWMBmuHR0%%z zJ!hB4;*|LWQ_dNW5SOOrm@pf>+1D}m#Y|RsIsfpREuEZL1^i+vrY;beae?MyzUS#2LK645Fn8Y zj>H^t(FtAxxo{GEDr7_AYbL`FDdffoqHb;{F}_w$y`bNhLg6o<5>2QRZFZQU2xNSJ z$*a(64S$OH|B142DNq0Rd>-YfF-9tJ0~Qh!;?%wxUk5uRa{)_j93O6sq%P@KaIC4V<)`Q4J8S|iZ2L>G3z}(At%o=e;e)( z`E%ija7l&e8zZ^Cjl)~?NVrlD#Uv+{l`Ypv^k281c}XKThUfh32=V|>kk+{YO3KMH zvv>t!vg~!*MdE<)dr%8;bGEsXA8>ufPIegcgW8hPVm@eAK%(Aw4feA&s$Tk3gkmUN zJg5=*J6mK(1$_NB%fKCAbnqia^@fm97XXCUSXEnzox1Oj9}< zxfp9B7AN6!9XvI}M1U}q#KBhYsv$~H0CO9_8CtYn-1b3$N|eHW9*4_IT7^frA&@g2 zeiAv(=Z8P=gQ<&yqpAIH)I$+#hQTj^3o_|=d^pXaE7*yzcsY?KG>t&D?LeL!^MaYA zDa-iwpyB43kb7F^oqiBesN^rx@x6&7 zL5G55IJ)vw0qTGlHLne-t|>`cKAW{ehc&+0?|gSC)N8wLphM*@*b$h0*Jy;F87_R3|NL-t+_4WF7Rd*W&~$K||MA4VJs$f{n440~Ju zLnqJgCwhMX1ZY;c|BjRxng54LNX65^lwRJ*O4-GhUXFl?f#EkSz{%N#fRTfl?f)f0 zfQ5sy%9n6Q!wVaY9HsjUmGYb{J{id`95T0126w5_reW~%H7HSql} z8$;wut%hHt`6n<95ts6 z<0EwI)opwo1NflP0pBk9QGpMRQkK3|n7UK#s=1N;DP?e504m)1YA%d0H`s8)vMPfG zef|DSBWibbKq{i>upC&KxEuflv8CF=X~-|lnQb0buayTJJ}QiSG5E4;So{OBh7?+( z>6jhqZMl$qKoA0dnP7;+$-sthRav|CiE;kkCBw~qS{Qf$mYBoX&1%zgw58Qp<7tnc zs{a{Lcm(^z4cmq8>Q~+iYl+dhU2jzcXo$0Q@B#2tfteZGu=xCIQ-to9@2LQUbC<&q%KeT>xWsb~d z4=eH{{NYyL)4GjI3)v~EN*JB#21!b}vYL7iOEn@xy&9z;qy_8dzLGbG!ZC&mT~7zt zYD{n5n>tB-ptICxwh;>yYITk&7S07ySaof{UqYHx>XaBXY5->XQ1`x8<`otNBG08| zE{}DaHMk+2wZ$RTl@I>eGHK-q<9Txp=$H=2Hr)J7YfVdwAI+)BW(&A>zJe&keTO`c zBJVjra~E%pN@U$4RAqT9UzM{%!Gp&l5?-W5z+pABi6Z`GfY|K#As{-XeJ1ETB_gc7 zhC9b~i{C3R#vO8)Dqe3Jc3YOphp>T@vjanR+`6eCrb(^qH$9DxXIc(gbq)7#_31gS zZC0(ISs1T~dISBORA))DT8Mc9DHlP9$@c$yoUamR;D<9RN%>sOhE-E(Ik-Nk!b2{b?q0T6%jFLW-g(T#&M; zwi9Tz0i1tmb%5i+MJ+JN8}6|f5Bxp~ylo`u0mQp+b&RPQ=nJ(ohFojHveLn- zas+KAtg<1*y6@CUX09=2re4^e4Vz!spSSK##6Mk{RUe#rLVROkF;W-tP;4_wDX%+CJ$UY}7Z%eTPkY&Txu> zm=adfa-6}SZ4tzg8**fJ2VY`6pxAms!FGz;Qem&Tq&{Br{J@7`3-FAVwP*w~6pZ*S zuCHnRepbA&H&B49dCh1}C9Kp4tr*+_BWa4G-B~SK&=?NZhCisqN|Gz+CDG}I(I6B! ziID_`?Y0jEP#QH{5tGoO64^*3D;+pkMB*HRjGCu&8E8t^HB_D3B-lieGQu%JZcJh7 zFUOl|`sUPY#nKQ2#2xK%2~yC=I6eN15hj&OHZdr89ejk~0f+`D(SU`cI52sgTt1*x_vq7XoqG{+t4XOJfar!ZkZR7$)35lbU`VbOWD`{o37%jR$ z(8DE(kNlw=tGs8hlC=|e+QPJ`M;W2YSsd`v$!BG9B@8V5~F zItZ#TF%m#|H?Ge0BhZb2xs&&oD2eT^6BuaPaPt^lFtWAnkfsApc&UWMg+5Y~Q4J^? z{zHH@$Hxhkm3bpLzj4bMvW{?^>Rc&@5eyI#)C>0UCA38|4(rT90UI(&MqLv0XywH0 z-~4;2LfMF*Ui&DP>1UzzxW(-RXjRvQ)N}?#j(>wKswf}3Chi78n_HEdqD%17>Z)jyh80_8%K#~g-3~66{#`(ou2Zg-t6nzU%{%IC2mN9^xZh_s{ z21>~RU4Gv4@6N^D^(g8V~&(~eo1S2#sZNT)gCdG1;CS|gAYqFjx zPKCpatZ|DYASEXcI+LBgw*IC#Id=m=HpRhur2n+=6g43ARF+J|W*0u6M)6GxT}GSPq46e+pmB_cHe?GT#GkP+1v zS8+!cUkIT~wZ;<#gBjpQ9ii=kPSWO`BN#W19Ehs~L=FBm0%JLe8!4pBQ)P>QG~~N} z;*@J`e``T>pU&s2LD-g|`8tdhJ?uD3Cn$U%X&aCouPF#I#)O}^$xHF25NX~#p43na z^p{L;+-W8MQ56dv5L$%E?D%%n*{Gm8)1dOkLe$cy{9~DV14C z{}gbFlwri)gKN}ZFTSku_1!NjX@aD9y|7X6Dx82}O#@nm)8UJ;37bl_E-?W|MC>jK zj-Ki|p>!evG1Eu}_w&TvaLL`Lfz9cZ4&!;M&F%03SkzfOb23lO)R1xzEnclkLapN5 zal7Q${((u62DAp{8Mz>IS5F5lwvvFLp-0tWwHZ@@8;$ILP|?)VmhOW@4o~ml4p)`P z8%%p*uH|r(5*nu9>UEOA2@jkiR`q(+c#D;7*@yf@(K@b1+R>~uRcv3G88^7wG9W1O zdg^HP42jLf(iUFOg8Lw?5W&J%rIQ$}Z46E=bnGX@1X@yJ4{9{^Fu3%rLf)B48mphG zc7Do-Kv{V;z9J+RcNL>Kpr#_s46V77fjwcv5q{`qQeZkTJdU;DBWhv)ZXS3+IK6`&Tu0Wf`qG7s)@PWd_-a@C}{&Ouad8ZJA;B2K@M zY8Nr7&gRn1+8H0+YRVWg$G5IWD<$g6!+fSayz`KI74yDc#}W6Ay^DVi4$ z1Gl_#AvaWOrikIo1CztwpJJ{(_cW~fbQ1nTF8FoU$n#_x_==eXbx|>tB}zWu*+B+ zm0Y>oHRvIqkrx?CrLre-zEARx{BwclSc0R1K8&JP>%MEK_P$F-kEc+gL<(UL>hUIlGnLG zDUZqi&ia4%XOFDYhZS=Rpa0xPYkT+g8IxeChElhOCbA%%5#QZaNgKAUr zy&k!Lto+sVEYJ;WUJSh0EbY4wd?a}QVKohmF)I6tPkQ1)WV*1=d2BMdG)Xb~vMg}c zyk=A%6P{u&O^b>FWD!rvk$Cb+%ph0FZP%a!>j2Fw&gR580h7+rJl3W5(7~N$Yxnkp zL2=PJ?{L{xte5=qCh-h()k`uP-jcVJSho5s{Y#g9$?jQ`cFl>Zm3+-(SCNB|_Jz*I zGs=~+IMh~ET~3$Vxq1GO?EVQGrFy#XWk?cNWL@(?2|^j zm-CtS$ohdw?qTySxC!Tlo!DX?-{q@(9!mO}Up?|&xT(17wcjcKDiX%rAtZQg9b>+Y z0j+VL$35Z&canK2nc;i$+=(7HIKUFk@X%*DW~pTJQBhn|k=fUOny_$R)8LG9mXvV> z7lvA0OB91M&t;>E+mu$v&T%PcKgmwqm3%1Fl~HjxXW!Y*+mSpBd>vVRlalYm4aJ=f zhPS#+`PgH~g9*@lX&*!WDWer$al1kjFV+3HMX%_bdx?CD@BLlwX}q(jM|qdt`QY?- zP5Itmm*0StPE1!7jmbT&bp~CU2=&BpG$`k-c`@f+{!_wF%+Ybu_rh7Ln6>GAEBKuh z(dj-ew}dC=R=MN#K){VCnZi-2?0bHl&()sAz}_EM$n})b&2Fz!R(q&IuvEe4{z6zT zmvR?>9$YoZdpuY!_jJ|*FXmb~L0pL(Fu4xS5`C_cXUCn|G6=X&r)sEE_U^JV<4Uw# zsFK%H`vqspQ+?gFP+PX_w#_c;>WXy8l>!D=kHW4~n~h2=fmL%Ke!=6hLQ$*i+hcpe zrP(>wy*St=_w?3+y;8Ax=wbU8ZOFA!z7<#JWc^b1;CJM#<##LFG0V7fM_#D(nq2R4 z)fI17$eiGYKG-5glN|Km>Mn!*o`5r3i}$g^$d)=xq;7Q{AzQP=Ms{|y$;vIwFPP{> z)w*ov$MP&72KAremxqy^IFfFa`p3V?Q>&{k+eZ^}teybZB%R{;O_6^UCEtN7y>@0; zmsbr*^dH~Bt--mjj3?=W$KcWYoYK3&beDkf0^O_al6L>@HCTHuv*O*3mlU!l9AKV& zGjf?_%EtXxscqe@)StjL zr-I#oLeT-q02{E2-38H9>A16|jMUz~3UbkORp~Zbz2CQcLPGbfv=d41(~06J+U47C zcp-j+(5euLxp zEAX(8N@_=i59~9tLhy|6ol2yAk1_lzR#bS@xXY}Ppq6f{jdzUIO}j8NctTzHqBLI8T06a{PIkCUyB4>8 zs&Z)#UVrRyF$SBI-+q2vf6o1MS2`fHzy;D-v_@wbZ*(Wig0P3VLp6lN(lN2%NMvZU&rjyObv2OVgfN`OTqRy$FRO z6x@qvyZV&OR*Hb8G1UdcOHwFDi7V>HB%ytHryMyciOLl8McYQ-3uZhioTQ%6keJTo zXm~|2?b5_HUNo@|crA4{Ao|S_Vkb5B{*Lw5^RUykd=GIw8=Pe!N-O9aFzPkKcRi z1Qe)R)SqeOQuyd+Bd+1~WxPxUtp_(Qv)nPtUFqa9bwQEXfGh(s7{Q430?q{g3_>|1 z8!Ab!cgoN2nj4-D=C$A&ihzS7kbzJoO~Nypl6UO|apMrG+9v61(P2VGUg9|yG=>D} zsM$3dn~=y0Kld;c4e$mslVW1rA#!Aq^F1mL(vmj3Nuvi9<;v;{EC92h9*A*$HreGF zZ#qvvBd2xI$TW#C`6bH}fozwzC&4IKa(W=267tAZ)s;lj}BO0#b@$qua`d;w|{f ztNYeX>drvc+v#Sm6yr{pR3Gt@Z-^cCAtugcP@WMY(o-EL2!^@SJ|<$v_MF&hQH*Ri zLq^GAWlOQ1MY&kgQY2LXDr0C+bWRuJW$uQi8)vWh?PB*{=|mcn#m3E(agXv0(CCT7zpf)mct8TP%9W7vYC z(gMvAF9u3p0PP5SiL~6iX>!0QiUJ^OVdRCO_IpvQ$>1uKf>~=XKts>1d+Y?2F&xYa zb2}rDU&5Sl%M0tTyBI9uHQ~SfOaLhzAG8fd$E$lWZ7@iDlWS~x?BzZQ`CNfFj$)gDxI~pu zxbUX5AS!AT9 zHfL0zL;N!U^AWIG5ujnA%J(6Z3Q;Q64Al3W)7I171AltEfI^D2yaCn7)GQs1QljpD z$|W`f(3v)c|0u==xVph^0rtZRBF$Y;?`IDBIZ_+dkLY=A*4xZ%Ws9+J0^@Pf<~VHx`Nc@* z25h1)HXTFk9a3%?iSWN%wgZccSfGmk9R$+sV&fL=EUl(ZJv08}jxT4B!Dz-$;rE;ymzU)3)R&Iw-ZJ~_C-M5{0R zl>Y|u*3~}9u9Y&o&O<2Ug|$h#sOH#ykf=tsX4GN;09l8=<1KoD4@ypD3RTXla~v>W zuSa!SXzd@uGziD|2L#O>)X_eV^8)?4FVL>IrbmetHwc9(hB_;~^=XR!p=n445#AEf z8}wR5isleP4qzOjwiM;ic&M0^a*IUFa1iZC#nt|AW-qhs@O0wTQe8>>e8&41)_Rqr zp@n^oHZ&pPM{kI8GvfT7ZbSzA&#I)OBdZhL`)DN{wh>d7BPFGkAPt(N1rrZ>B`;Jd z5fxOa4fV5r4mR#(W$18g|F`d%dNi*}OA&sDs5WSB3QP9f(34IPt*QcIfvCM`{)Ui@ z*VA*a#@n{=V>C_+Te?i2pUcEGn`UC4%o)L*y3wmYwEu zY1u~XKr-%+(v>sr(xczs0?F`-HzH6;C$hZ!Hs+xi%Q`7YvLmHT{!n0nP9G4#Q06N8 zD}p#9ROcqapxu{OHwam=x@29Rbsy|=;<2|q&t`5x7WLJP2OUUVqHua^hcNiH(`7sZBtM3JoNVB}F;L1CPJ)xdXh5%<9~EqZS8)0zb{g7GBvR@cCmLNVB+KZe`c7V z*nfxrM+&N|8NlE4n=nB6FZ5T=rv!lQV)ZTmKQ25yeu*i;-v5=N{u37_Y3K4Q8U3%A z#=q8gS3{fsqzi3&VM7}waiL#H)h#StOcm@c?Oe3!I9VB3*a#R280i=|I2qV<>BS9g zZ4I@V=$N2>8^LeWrI$5yakBK#rek4bV&){EV`5}tVDRx%3e^G^@OCJ%!xc2N4Gj&5;$(NH6*Z6dk8}{&5MTknNu?+gTaM9L zKO*#R-17?>`g1wG9~*K^*VfiH^xSC3ie{~p@p~k16;|0WM3+S@X_Ap@tD=eIq0Ea2 z{;dx`sdE|>;qt~z8petiAcX~Sc|D$QiM-KqVHJ!@;yKj#w9g974K@+910`r4hR+Ch zGzl}NcDGJoJ{YC6vZN_S6#^Shq^xMQ;)Jp%M|T`s7bHp-SC-Q(3V>jFAbcH7Kx7EHK}(97V|eoKKhd+>0lYn*IF z;&3_%kvxj#b#xt=YHkPzy)J)7tcd#iwh39T*x{%l;|L4VpawODJ{a82*;*W!HXR12 z{YddR0Vy;JB3kYlb%xl_9q|-0ncl%0t}wT)F#TLN$q9#Fqb6XnD0yC*np(OkvJCT9 z?3K;rE3}_sVwk^);OOEdJ$1J}w?5N>>4Q6aMoc)-VnS{Aga(m<FMd3+*yPe zwrpwi#TIOlob{&{*)E1q{pQ!R*Rg{kgVm4nVUxQz?tuY2b92fpQnrZ)X7;$DyYMe? zMSUhLroj40=_pJ%F@%`D42OB$VCP6NS_F&+Fbm*WwN9`|FA7v-gGkndBpnnMYT$ms zzH6p2364K{AzEcrVR)3}0NVW|nwGNlf?!(m%uep{#$t*2hJJd-93=0r9}&UAyXj@= zUDlZ0>~`MZ*IsN<5G26Ey(#3%zsb^S;Gp58z^;lwCo4OgZ?OUW;*Aa~GN`rQ4f zb{n~%-k@!rIC7So@%6+F5g(WTa z>k@$>wh`ws>uDMsjnA%m`s|^N&$oMLcgu1e^P4VGERjefbEm*i&^>z@2${Bid`>3PPrs}k*h@@d^nUhg*gr23CSfR& zGp((xWi-W1n>0q3#St%Aby7qhPJXoC1^N#$805$Fi0}#TkEUs^N_Fe?CUs{}f&gw- z)Tc>R6PjRBRA126+(R5dNC@Nx^1D5ER(Noauz{VO-4{4?q)epKog=&Ek7um2!?N~2 zg1m%I@?2WlS`wiWLlQ&a0U&YU$ZDAjnp#!7tSUWvEkx>K3jv-R45^cLPc3}dj5_DQ z6NU;Z*2CXcXV&zsSl+}Bd2*cCPEUpsZ=nD%*b5FXbFbq<7soA5AdQ4%e3DH-M#|LNxlh44gv#wG5liEfba?i9%)EHvhMqn(M!VgM+I;U~eAD4&?&BeM3VP>kcx+ z(J`%c`GKS7oi4283S}ckAZ|N1_j+|Rs9W!>0dvFXztmLiIDJKBoqx7WJpvZsC@${Y zI!-1QF!ZkNoAM>_wm5`8T)jH%>B2Q_Q?Q=Ee34Z2Ezi8!O4fuTPHEukzdU2Qnk02m~oy?`vGptOecPg9o49SqnR1v=G;D zzS6xSWnwRO^Mc6r?x>0P825hd`uC?H-6I>}e5+I(9B#JwyfQL=$eB6$>UC*Vkygun z$_QEW;6H{K*xNWS7}fn%klj%*H$T4KnGq&NL4bM&6Oz)b6D1X^xuVqUrxyf+_b%G60dO{Nb~Rn|7xW

^dGEEe-7gO|mRa&@~oJa4j7QTA-=7cSlVPvZuX~k&&w_mXDsE-q8B4 zD-KDPp4)q!#E&0%<73hl6&2mDi!}t?&QyFf zIBx&|#|Yg40yHxIf~mRjGf;qJ9|sTbZ5P?s{_@?!Lc4<$1Gf8qkr6W$i%e<2mMHMC za$=V*BvtQiu_g>EbSQNAfJIZ!m;cB0vES!$7&1|4jkgIS$j`}C2EL~aC%(>3{#rd^ zkY@gy?QAL<>iUDDTG4J2pmgFEz}i-_5@SyG=#nlI3~$}+SkH6Ul&bwVn|LH~;d3u2 z&%tlHpM-wz@xz3yKcbWP%hvLd3e_tN>qYAe%gSJPdX;6LHM-vi+p)LWx8}f3d$Zh4 z%^Z&ovGpFkKAI4l#0JHvFOTMFQU$emTTr~OHsJ|NpcP}W4_T;(%$_d!TINb)nBDgu zw)x%?bBJeVv$|h0yFK;>VDFKHL5l@bE6U5eKC-S_HZFH}4c!sio~B;hc5akgF8MJRD$MBXT~&zB+a z^z`(M9oK=IX4YNakQZF!Xr^ZktK`%!U*S-8v3Xh989?AAlrf`T*4*0*@_tDq2Fm2m1BC(?fg$ zn=&@qw3C-fC2e6v6eWh@RM2lMiafYq`y2ocjfa;hEiKKYb?@L#AbnWXycOt2EWXS6 z@$upHbg5>R5Tzbu&$<k1=UETQPG%(>%}@C zPy4F-X=~)0U5EY);~6&L;8YOxQku^Vq+jFa=h&K`4f4)P!e||k<<7c9@d71`dz(e+ z7!TC;@!|WMkdt%e%q>_k5-W*Ilb(j(94TgxN|J@RqN>|BD9At`g3>;pI1eHmI_wWe zv5M)h6yBPQ|+2|B{Hy8;10Z%&-ZLx1_w? zWe_qy3?h8HyAQv&yNQPfNejp>X|iP8$Sy$CNChmg|CqHmWH6xX^Gu^!PF@zQ+{&ul z@4kSDK)@Ftt0!nKPCoK%_xhniBZ~pM1)O80&Um=1(`#2;Io*cdb~oBxDJSdWvDL|) zEN%SiE>$h1Jc)*|Uw5CBHY7#S!g7rJWnIHBj2Fp_Ept-A??8`5#$p-z+ikaCF)8KVt;M`bJpp6rEc2q^KO{P zL$qLahXbi9#n;;uWI_}!NEPfRIG|3eDpzs9%^lVlV`_SOADkQVT`m_-U8SAxGG+;> z1*U$WB-<12`RTeJIbeC73+4uSNlu9EgwhilQSY~+{lN&TD3}Gtdp(C?9)(BZXrVey zn1uLuo1s%)TdPDLPVkp7S}Y7YEDT!0v#rfxy*i60PaxZU5B6Y%39>Er;ANpq zrKbC4XtjA8DlYDp?aft`dP2BCIMa3t2&TnF{C9_AKk6xJ(OT*P5Xk@UbnfmshsmLS*_W*}C*T0A} zXt>1m=#z5ONRP-#YDslyKKplX_#-BQ%sA*e)M#*^2t`Fj7+-U)5UX;3W2Yx38Uc;| z3w#XAU}Y{to^P*lewK||&iHvbp|alfqNL0x56JlZ-j^F(9R$AqH{h8&=_qQPY@pDH z;p<07*U;TNA(3Na+$pwY)4TE(^-qj?=NA_b4PY=Fvu38fBVeJRkv+fW=jX4HVaRw( zYI9N8qJ!gQ?Iep(*!cK5E$A~4r63j=lO-{^gG-Tj%}m}p-PX66#+cl#83&s0W} z1VF||B4M(9AAScb|fJMeL0&OwxspoF(T2bpF#OI6F{u*NB6hfM7K z@%5U`9Z16MRjHHJ)E1eT6=^mhwJ^`m&Mr<*Uq7_XNvcz^%7mr+8gixLGc@V25NJLv z>6gY>S@8hhPGfZT9viOE4CeL@@w<0}Hl6N8;XNdG&p5pALMed`A!}8orT(EZ@Wjtp zbLcyuTBUL0pt`1}rr|^@xW;}LYfUml-u}pGV)hdIlc||RzR!lXDM(WT=4qj}>xd=O z6O)s@(;b90(`PDFm^4+MDpuqZwu1t(^j~=b=*Gr4tUaBI#4~vJes9fwUiT}^*V~=( z<5~ESb;?@Gx6yyR!BYYguFlTDOJfjXe>>8J42CGD-|t&xJ+vYm>~7GhnxlXtNJyOY zD=j^Ob%W5nLPM?da643e;a?-|;jHmqkXmxZ`>Obb?+C$Ksx@(rN8wzjrAsG?-I*as2%&wbdr-Xzo~4Lcb#<{}~@lJ$bG zSGwL`3!{m#d=7!d!iR^4Pz6HF;*Pie0w8Um%W;}RlFsPPpBFY`hs+%zf(B+*p3d$` zP(p@EyLAN;M7*BPRes;r)@@BD&d2N5mM6$@z`9`~Yb%>zJM%$Zn6iP98GFZq$mGf* za6-BXXrp+l(!9n>1mgzZC3q1rRd91L^UBW4g_?Ujl1`U48<m zFyRwhCBt|fO5@*O;Ut3u1bl9f7y2FVw|jeNO+$`2%=NNZs+HWNI-u$Bw|XZe-YxUH zzg~_q<3MRyZAIfjJXtIWTpcV?ugsUv?Ew&C7PP%qC~_d)@0fhU&lej_XIPz~{{Af@ z!>MHPn6{A7(L!<3%i|acob`(^ZQ(y$p;@St#_;5J@0^_O{Hw{x$lTd};iYl0bE#?T z567(YG2HLf()uw)j>nrGEV?sHOm5^U`~LhXDRa*Af$k5n%56t{rx@`(nG9PmNrx6K zxFqP<%Svo*KpslJ{4ML^L!fo!e6=9&p^2vSxci5{6Fd=Jv6!??Hj6_Hy%IECm_vpY zZv|R)M!pBzk>2lkK2(?8O5l`8fnkpn8#UpQx6XFuFWN~>Cz;X>F%!f%4GqRNNQ#+d z!x93IUP!ytg3b)ud+5x411}zBW-T3(?{B!{3UqPD=`f0OHZ{FVrVYnz8M$9@PPnig zg2Do?SILDvaq`9hLjn}Lgsi^~cUFaq7@&adnGEa=AS-iX*AQFe8?uB*iDwzc_4X=G zSYhNz!IXD&@MdlzAqO>~{-pJIKFx+;37`luNGxi#%+@7_c0Q<+DvIm8hJQPBdqZ|pyy&6BuCNg>nYuQiH1;^f|sx( zm>blG87sOUkZX(ze_;|2*?-+~51T2%-0X%*rE<__T(IBC*C~jav3#-F&dJD$eJNEz zT+1GOcQ-BY^nN$()yePbvo-bub)~eS;_N=1RWPf@`(+%NNMLJueSLQJ<}2F=Yn1%5 z@D8a^hK%fFv5a&3{jB@*N|F-q2VnLVAj`ms8*QKD%K-|NqW7n(%WIoKE+vH#WkcIC zoz7w3@dRa$)yF3N60k2PsZ+E2QyG$Aja8B@&nRvR|K*$)n;#RXB|Z@ z@(|L3VT`~6(chs8u2+C`GCe!Pv2}x3i6*tQxZpg9vv1qW(-XkS0mgf5!*LMUk~ncu zCzI=7&W06Li_go!p{J!4X_3niI31v}7txYV7b;JF{PBr6wOngGff6zxM(l7hF#L*4 zF7pEdO#0M9udUm;3|yE<>Nd*)raUnts=H0+D5Ws6`IS2h9Wwc+20Z@^x@2wqC0H8s z9F8F_&xZ_R(;n%pMI6km*eR(qD0sVIa3;g)j#gPjkT@{mfIg#ugzL9GH37N>boznL zujUT>NS`F)?XI>M#UMgJRW6b z4KYF`+iBpTDbFDSf zL+J5+O`sNZu&3U`qg6rR!`a8jN5vRjx!&n`DvQg<)877iAW`9RyPNU*PpH})Fp5`> zmpYb-V1SatybY=r7Q{DFtpz=Pj|maaqTpSy3L$obfoO9nAC1AI;Yf=-U4v0xgu7FhCn6QFw$$ZTG_T+&;p#5A~d$bYxI}vjdL3+eDM{-9k6Aiv~5SSLiz1;p{+$v3mk*;4er>z-NHx<6OIBV z@aU|P`rD0!d+zzyGy4g8xHKf9PC!2D-~4&tH4mYv0I#kDi4mj}G0X0v5SVQuCJkQc z!~7z>qAL?VVK6huTEMd`<$Rc`$yKqQ@ZC#S7ykf4Be_YwRs{(y#;)uryWq6lol1E! zTyo&E4-2dh2M-VYxa5j5c_IGFh7m_%S<8zDPE}{84?l_^{GgGco5nOqCI=c9W1{KV z1G}1`^OB=Hzz_ZOnnz*@m*1WPJi&H!<8U{#qs7 zsbHbx*gmxeJ4b~_e>hVQW9oyCGQw{Pjf~-v7vGCY=zKhjQBBhi6VleYQR2OKZ+@wU zhDJ@eBBLz4lb8|BqTAG7O@vgzVB>{$X+3M{_At&^cAiwwFFFrQ5V29)}lNZPr znq)AB1WFbyiXK`>v5=X~D*CGD_wiJQ-d`>*E^((O*&)*sr*A+7zt^Wfoi44dxGC+| zTV5J9x@17+Sa=f>EprcCERoD!pu)$Ye*Kwu1n^p+WSbY!0)l*>I%NaDQ>jLk8m(@i zST=!)6T4i+gpVY3*ghROXShU&$fN`dH3_Kl(?FsF1|gR-Zje!uT~i8En0r_&+Vw9T zU&Nq+x`~}Ccs1QCsp-tfo-);Dr(8Hx{WwHY4OJCYP@X~#H=-d7JtQoGhY4H8iC%E5 zSDr*F|MSj7`aF)jiFw?v7=;*AV!+QGvMaek73BHlLqdg(Q)VHxBTAW#!cE_D4 z{nrHPqI{{168;Zd89O@LGc`knbnB3JSYjXz&hZqWp zKK1F5zI;jY+FC)+k;@)RnKc}K-}UfV@&p4m(KN2?aNXCPxjrK%7DJzlMGYaipYpr` zqEJDN032!UgsGp)DGPHcz_SaVr%ktQ?l%rv8&+8?r~XG!=aN`@q#J?cuXcOcPHaV)aUPRH_bsJ+M> zrAJ3co}Qk*H{<$y*!EPGJuy)3$o=*t?#<;4^~#0dQ1*5PbbXL!Xq8KEqURjs^+!~M z!`C8lNQlVulXWfM11u*SZ~VC|44eU@>nK?oio^weA_%SlxO?h7Fss~(_P4QQTJQQY zwcJIEvZxtuWfPaVFz?FW6W3{omvzPDFpIFMi>7CkKPh`r=UE#rE~;=y0tCY`&c!4C zj*DHQo3AFGGiYZGX^->xPk#o0hJ&i_YVBR#J9rC}< zrcT}G`JBtOPCVbBn9k4FGZZ7H^yRb9@o9l*8>FRw!OX=azISUiJnQSHcmR?yPfsr` zE$z(A8W2N&Ee{V5Esl@^?bjWv;0~5w27FEG^e6#U97(-(mOmxPv8?LrT`xAl!ywrh z80b4c9zCKd;q5;L_G9N)C0OuCQ^|5s`f>6?rwIeMc?l<4jE|>y zT!Po2Nt{2{nwI^Zcue|OSy?RvJ;XdbOuti#3fe5upGY@PNrkf&NfTxu-<*#f$k7OL z(gc_6m~eo$FE1|=G5ENIg!~@24VuD zF75ESsS z5>WS!+cDa2YV}4`r%btzIE;uNp^O9-KJn%tY@#~hrAag&P(5|_Shm=2TUGTrM=$jbPUojnt%Jk{=kmN12{Z73}o1!9XPU6 zGhUKc%EU7eIsgBDCnOUrk2m#L!druuZg;l3QYSKo757qEJPY)^x(93n_l_^pWASLp6SL(n9 zkdA|}aCm&7HZUwCnAkSU!yAfWwRregY)ss<*+AGAj9y5Wl@vm(lul1&XEuP=k;R*G zBx9ye9udgNiJgo68B*AYm=-$U6Uo2%B?}t>R$Eq96~MZi%J!F$p22g&4h73M%qkQQ zc+c%kC)dJJG>wB3#{p)?+yZkzMDQa(U;cNMGji4JFVoRcr3%$JVx7kw(w?^Y3voLx zKK9M+ZS$;uqWENSC`~URFFUFKI`AW8$FgS~HD0(bLFJu(ZPZ7ya8eB)hW>;8MNc1J z6t^SLJ`WpE&*CIw7Q4S|%90b}FWS<_Gy0;8uzCOr3gIgxDPw}>n(cAc>;sM%cdO+{ zzu3g?TjS^Ii8Zplxryis@hPJL1gQ!j=>B}@4s^&9wFR^?ts05I@vt|!7}ZhHn+pC0 znV$B!bQ+E&g67}u!p%t_fwDDV|lJkVgUX|pciT`M91f@fWC1!83Cs_ zEIPthAx(My%_F;i0};DRf`m-S2LTx^5!B?P$EfqT)?}T^s4uP&U@sitKV6LUO-rzx zO*1qTODw@aXs&7sp52z;cD#3FwY%=lC!A*w|D|t9Ti-E=3>PKFA*V^o=)d%DBqYFX z^#&@dtEU9h%a=f7!onwD8|ZT5$tuuo)(?SkE-fxr$q_7Lbpu0^pwr1eXV$a;B<-b@ zzmjF`UNu1*1#zOpCp}UGy!MpVD=#)yoowlCVM(z@?EW0w0Xx+;7RzkfGC^;-7&))% z6!@S3hqoA^%W!`6r)PpcC`if&S}P|C~;0ysanaf%74v{tY)vGS*Xr&RF{&7uBj%BK>8o6aOU zB>1O$`2w+?3mZnOj2PMi7vZ&|&$~#AA|>2Z88Z(M>m)bZ~!0T*eYAs1_g2v zN*Z9I66fSGfVVBw(A9^y$RT(1em=r-vPUWSv4(q8)iP2pfs|mVybx*Jkw~4RI(Ez& zr@kPzLQRt=U4#`e=qf7=GyG)%i=fxkZ$g)sI48v z=F;#erHJhB_kJBF;C(ZQy=v<>QV!vnNK!+L?8%h9vQ`kaqGvBEtfVJYJ!(UmG&Kb` zI}Zwk_!SywDqe3H@*Xn2dcRVHGJXu7B>h?4*$zZAT|;_2U<%c9)}HZ<+0w#Bg@J@2 zD-->3D8Xg3haxk;RfZ6P7FfM=(m%}b&o9-Efq)SAL*VOP!S9i(HEyGX9SHRSPILS{ z*YX4wrT&xunROMaF5q|%lK_bj>W?ajx0&knD`MTe@@UC=id$xRMkBS*ZnCw4cK!kv zSGkPb_@Q#~p8P$-GNFn?1gc$Ly>`Nr+yOOgGA3ToD1q2(I(!8x!;<|6Xuk#xCZ-x@ zL4Ut|7`zm=yTf0;Wsp|V7L?X!zAIqSRiNx2OG}TdzK|$v#)N288+r(Lc>0vgRB%2F z1#%w-gR?6AQA= zTr@0^;Zd^kvYvc;ar!J`uDal=f6WR|ltHK~Wn&Z>7^w5q%-PVg7iMQcDIhJY)GP8Z zFB?(L$aV>k%o|px{_$^mA4==%6ZuEVf<%n+12Wc5>2x{Jcndf7jrR#l!p7bdx(0WA zb@0g@Hh^W8BfaO9HhZL-S(}AxlaMh9(cI*w%T^y@$JS?7#1f6TYyHDW;AR{0oD1l` zXC_ks#0DaHMSNb5s_N>Sj-Ll%^U|J_K6ZAO>E_v79;d1XE_g@`x`1jxwd?d}Cqh3w z0|cMl^p(OVp}=aDCAIv}PX@=FYWrW6^T2OnBqGXRh)P&7W>C<`280F$G(8=zNIGJn zxvLH|u=_#_Pcay*XJllgVfxd=-rjzDt5ZyD&@54kG&z$0w3MM^_UcYfUJi^yOMBh- zW6j!~P3-~aJ+fTde#d&wS(B%h^sFeOkM6q&?clV%A=Sbe*c`?>e3QCEgbmSpJ zs*AU9f!gw)8VNx>xuLeuwh>1YZ)g1HfO~=`S$X+{WFiI)7gIF{2WIND(}!~hU|(|4 zYvoRE7;7(W&^bFN4-Xq}u(iE?cy$IUT*$YogkQV4s=Bao!GL8TU#WSV&$I~%8F9Yv z5K9Tc>(O@);4h)__r5E+iHnA(uBYHQ!nW2BSdQKFJ3;qxxZ34#lS-v(wAxbU5`4G# zDV_G*g$PWPgs8t();7P(hGcHtT;6bpHf0{5S(YsuV zwRu7^Zn9ePca!$8-b^wZSzm!E5f(a~!^g?a#eVg)or&Mo?kFiDrCH;#@f^&*ekWqEluu+rjB*UEV<*NTX-5in@Z{Mg1djFsROSTGNKja>vo z&7qT2p{cN{cqCkbe~vddBlRSkE!{rLOwZSbi7w;o>rGml8EqhU%if1mu|qRmM+6@RoAu*Z~(1EXym~ zvy6w}^1x1v-G6EX@_NXo*X-u#Xk}u8apIC1X8I?|F1)IBMvdq@bx!~5K|hv|%WhLc{GTd$axfpny6M?v9}Br>}3WvHUzRV5^Y({EJE$AHx_~Sr0C3 zI!EAZDg^!-xzIh9_ZB9a3MNUH$IVKW<{k4?scLbIg*Bcd5b>)=v|&li0`dMe`HWR% zULuyLqO=+#isIgcDNj;WT}??{&G&rP7?94@y)3}V6E@P%IBP*JGzCe57AKKHJPHcr z?u_|&oLaPqhbT-U6q77?V2?IBuraa0^CyQ0_eXkGdgmXKgkCc?9r@6}O*<;{W}d$B zZEmNb<0m1rEZ!F=-Xr*&FJ4s>Um?&&B|kquZ7;8(uxv>ujbt6Gb$b~1eAO~RPWRx= z-RBp0#*W(xeXydHWQnoi9Pb2F7_d9gM=yEj?^>{HU)tP!727Aaq&^136=CH2N}!ll z)>G0`(o|E{o470^hi4QOj;B~QV#1A*k2=pylJk^12Uk;!>fXC$*k#{t6clN>F zG&*qb3WW-T@_c*qe2o*I-2`Y)GFsOd*rQ&2otyKkD5=|#oS9IJ%(i)Y=4R}Y66v&g z1Lul1y&h*a8NP=t8|kd(4EkLiLO+Xlv7^QHeGV6?&knvdW3CrlKG!pOhmr$VPrB|; zn|@!hUm!hfcH2l4UN;|4sP4Omhu=D#wl(gRhuCqkIUo-gfCkJ)av+~MXZz~G{jV9> zZz$*f>{S|a8qpz!Zao2+soiUf>XE6mJ}=?jL$RD~%Vq`5l3d=nj$Z^*>vk*Kr!qa* z#OXO{wR&ydt37&(;GfiZFU}TU&Z6+ELj^h)8;tcH&l0|F+$$Wv1;w$034x zFS7~X4Uvgv%GfhD+n?T#IJ?=?WnCT~l*<-Gmo{PJ&khfc+V}{==0|lm^*b~XEPDCvO|5LDc*F=WQQ_vOTYJ&W;eJEiRry4o47o2{pxv^ zEkPmH@zXqO7pG&=LT7upB8tL5yh1j&%a{?%yvhYKA@B3!Y6DUjnMJc(1N>wF>2pz4 z6{6+OEV~T@mciQNKFou|fSN4%W1g!H5stH^g>wrl?wf-|5M&r)7;_ftym_esqf*{? zux{qK*TP_i$aZ9a5kD3a+H8_+sE9#76BH%^xXbvpfLJkyj7YaGN+V55_*^p8=~cMD zN6z-yLuiUH3V<*bTL2pjl;sNjckW=qTbaO;9?l;cJZ3GAmzR)1F-hh$4q%+3?HaE1zSo=GP{j+i{s%b5%z551EyAF$P0?efeg0?!do(1`ZwwLNs>GoEUcBP^AXCm zfgc;R76cDp%PweP=|D|b03ABaS^CC74ztp!!0XCWNHH9Ek~DsZQ!Z8U5UuhPIxO_W z)s!h-CsbCLfdU%do|D2Jm_dxPDyW~M^j+ktK9-uh5sf29Kw0{p7&uHjG@Cy|n}w}yNIVwyh`0LJPVS;rNJF1nUV)I4bbXVG z`}Rm$>+w~7fy-;7G6^gE`1sCwED|x28yRNEq$nzqIX}v;Z=qf9E=km&YzYA`AtMCz zW|?6B=7mEJuM3=(i9xOa2Hd<$0G=P48o5Tbo{I->r;pD%z_!09OhiUL^(=aMn~I8# z+?P7F8PEi&-drk#(D}G#-NW0xog=vw8&V;PA@WHaYSHozt9Or6jHlnzRX(rN-Y8wi z)b0U~ZSQ|92S}t{lQ$A3=*RLbiBl`{H)Zq$)DG*J*?8tzD^S64+TRzyp!vLU4Q8I9 zMc70TG>dpQ`1gB$@_u&ld_D7eKc7I)(3~Ok-*M~o&{ph&hzl|G-@P9v0+!ECK&Gu{ zTpbEZWN?J`J*0R|PCQ-MOgnI_PhjPyj8mY;t90hx@d(FZE+dwqesqmpS26q)Qd~CU z<<-MOJrf_sF`30_(2T3gj9;JQ@`x}y;<>)95jxH~&>t^i@TFG#yF=>N zpYBGQ%74ih+mAeahj}T}tRe|H3mmTc_j9L7K)`Qa;o;p>k>jVp`|>+R^3dCK5WLWf z$>C?tZtQOJ9~qUM{mZYb9C@g2Y408ob+Jq%BBIjJF)mDY-G7bk9=vpfP_d<(Z2Me0 zyQdG7(Tq;SvnvlU`|DEn zQY}?MPo|&{ei@JyNtg3IL~|g4iIaq~0rmdMAj0nYa3k5<$zVkMLnO3U2wpQr!tVC$ zBoj6!b5lD~n(GNemMEQaP5H#aB7t`7Le)Qoe#iZ)>K=9uzA(yC8_jzoq1ta~`NDLH z^gw#N|7<^x07Jp4j0&H~bf1M@8yuyes?49~sVuJLGs{rbSmRw~#h0_5lc4LxFruj(Gso?G^VEBB zO%Qt5Vd_%}NDi(?kLt^-s?WJ;ysyvxqi??>__HLmd~Js#yHqX*#+q6#CID4F%=Lu` z2X_axy3sx=O>;~&C7ll)MIr#W*0_at!M~vE?x$Mp4Y2yZ2O6=k0xsGgeTOIcWO8yO z1<9b$QR(IW?G%Uj$~OLf?ydSed5NggL%h!%jc{PO9WzqD=ohjpCkRDNhm0s z4JUCZtdlWYFmOE{mtVg%Fv7MS2!~p>3IeMt-sQ_Y@}kQj`YP~#iyNBrc@a)*ojTn# zE{==x$09mg@b{Vl&5y={K@!&3q>nWe-&zPv-7XsxOm2s#9L+$CKDCFF1kjD$U9 zBkNMR$*I`dQ6~*8V^zsK8X0N5)#Nn{jy(G4$wiRc3FTs|hR6y8**z)er6YZA$^)jf zJPGrZ)gQdD=rSp&d>OLGY+zR*(`-q7m7pdfj#0+sfhn5_4ns7oe;^bT^Or&T^yvCJpUw(jd&_-i|!ltRL zb`U}#;upmhrO{3O1A?YM86=~Q1YqI7W#%wTL+r#KPyy!6@^G_1db#WG<`YK}pZ)6z zc=ipv8||IQJn-!(g3WN}AYnb$MKynTI%DW0R)-Yk8Qv6B2sZkUc7R6=Wx=P4!G&&c zUq!v6nlmeT_p*u?*~~J7qO(gOR_3`dOX0%S{N7HUvuI~7^Y72zLf2r4 zNR*+_bz`gV1+=vce|(oi)|*Ci17e#7O8#I-V+2xcA05TNdm z63@<9Du;c$6c)bI7Y%If0~)j=4XXs3N+x(mn#i3RtUulzR#qC4!B-5-OJrk^`#Iv0 zYWZrkuD z6Co>C(Z_)5AgJxQ%UAG+fL3)|47Jx$v&ZJ4yy0LLN>_*95>o=;UH9pe1$EV#{~o$t`^K6BzXqGFQzeSEw4`|cnJpvUWl@ay}@B>BT|s$s}hJd z`=AsT#qCL~(RN2;6*ShGTN)g-r~8w|5lwKchc|78yntxu8fm3o(g!#nv@5pskaPOv zDO-wz%@7p*Nky{dH}UQ=G_9N#e?qpovX#t!E4yS$BDmBQCI^D-;;8PN1O$O>f5Ywp+Oz9ppg!-u@&W9gB zwfZgq_m!)G0^na1Ta4C9J~j;|17E&)?xp8X)tIdHw>6i)FTj}TKj?US&8qk6T7g0e zFQ4XF9QR|4JllV1^C|szog<#Bvrf$s(#}7yL-!SAQ^T46LRN>Vgb@bats{Sd`{PCZ z{cqX;PUio6)%Jg}ooC}<`mb$3mDXg;0RZ*84Y&uRzsn(Inj!JGCFcC;1n+23MxnnK z^t88(tXWBeMd30%VOP5&O&>q_S`%A@`-y*_dn>>v$~q7?M2&bx^wL}N9e&vM`Qh^n z#1^n%r%b-T?n36gkf_+poh%K)-6Hz(ReAKy$(mZ`qiSzmP1WYJPOe#ph?Q;K)=g*G z{>y$Sm;Uc4m=VylmGWXuxL&!5SBZFdLqJs1*nu+F$Z@!P*C|wQ=h_3#;CY>`-P-WS zg_}2TW*fgyNS0n6{p?Roin-MZpT=xnz2 zoT%?Ky_LDBjO8j{!w%6SjknTKrt%3n`RZzwmpbZbi8_{D;Krb~!zgt4mxsqeUFw5D$1?1QOLr>Wd^6{#Y+Unplb1h&i4N{jy4tPAo=s z%0t7R{v_BPO_xbFYyC^?Vj;NqK<}Y42jz^zC_@C`{9Jneb{f)L8PBgK7Hw3pVM;Mp zxPzwjKPswqpl6)Qmxzz%j@lHd51_aFW>pmo;rZ5Mp1FOhYH2Ql=`gf;etCMG8uhtr zJc(H}X8@Lp=02PG8;va17kqAY?w|avNJH2{Y2PUoL8lIe)bZ-1W7DYnw&_f@4Efh; z5L@*^TL+t`@bTWd*IGw47hN;%rN#&RjCh<`cX1T+M|}b5*sMT#Derw}+C=-&RaW6C9`KlbokziHt|LQxdGkC=XMCcZ zIkHQdQxYn6H455La0>gegKJ6}YY&4s^YSI@`BSXJ!us9n8PNgoPSJ#G((6e3Uczf# zp)f;>z76whj1VeW_-mNh!EegV|8DPmG*B$zBS1dEWNpQh3cC1;G?jxI zUf~9dT1>7d%-LdR9Lfi(ZU?5~-%Mph+&wN`wRC6U*btAgv0u+ni{&#L13-v`0nqDB z#4yCyjfag6IzOD$k0M1C3*D3-(I#jR%Xax~3w!VLC*u#l$fY9IddXuYaLB(qGmwzD z+gwoTLzf5jRuGD-T+Kk}cwy4RK1JYq12fm()eFVYFFiiPpT&wf8k3@0$|~rQs^Jl@UC$UeI$8Xl2s|e+i0< z!N7C=*_4f>==_Bo6Dy&0QG(_%IryhyfK*=EY%@2&N%cn z>J)h-hmFXCA#jQQkW+*9r;e1>i@Zyn$sHKb`v-ZL)kZFl{4<{6#1I(j%pqo?SO+WLXpJOd!J5G$}o-;J4JHZmzAu z0)o*)=BPw}$xq@viz?dfR<75F2%MN_c((i=^~T*ME0~iBhF?r&AJ-`YXCBq3$WZ4q zNZA6X4hAK~j&Ezf3a>8Ak5J}O-_8#WmGD%NJ0MQOadS028sdIJC^Q;%eQYrQ{@WILQ~;arJ@T$HOi~ZT<6+Pj5oVyq8zCcn_|#tJw(7s)O|pN zJD3^e@w@H-v}uwAmHFO(*tqEw`F0=LmLc_qliRNu)5S$Yf)j(vk9x#V&x)=h{l-;4 zY!(To-8tvEIrtdy7h|*2tFHdwZ=9qbn+C~wD|V=IZC_o?$Y+tHqBO*Hr2ZPn7h18? zt!8u;reyOB!9EG#coAOFu-ZmFr;^{+agbp0TTRdo=@1{I@gkL2mvvsj!il)*q{_^E z*HXW#JYjK>i*I1$y8v;yl=BJbqF#9lTIUouPz+M?CFUeN1m--XVBLG{@bSldk{Chd9Zz-Bx_6mfY_vHR#F)S6pwNKZ0-Lr zc1}&AK+BSD+qP}nwryLxZQHhO+qP}ncJH1&F)#Nkq7mtgNpxU5H{lyQJD^ zCzfY=myd`o-M-UJT9R?0*dfB(QPF1JM zJQ6#XtMcy@TMKUyp1nH59bs=}vRemF8oJPj!D2m-zRP5I*vV?%x*XzO!Z2Y=F+9XL z%x4GDzlFwnqz6sbZgyxHpTGCuh&V;H7a9lc5J$bLbC*0En~oceeu*0T!eMm7IB(;d zZKA%H!A$4I!at7`@Q7lq9{VKvS9M60+9#B;k1LX>5WsTcr8>E#GG9ZJd z+iyJwa|a+Wu=pljZNIM@E|LkA+{8sCTYoL<)V;HT2+SzI+u>o|zC1(WlnAf&ZkH5L zB&loaW#pPx3tb0$=pG%NwmXfp6ir6ePKM7mu3=z`$7Tj{I00k+Verz!>$Y6ZB@TMBvHj=8uLU;MHryI=ltO{!itV>-vo5T z-{X;rsI0-6u&GyV?}xSbuNQ}(rL~hdzXo(lJ3$bSkIjGKE%sXNQ7Y`56;o?R_-+Mh zrff`lZ<6O_8Md7%O(+ka&-YR#UpvKQPpXzFy~U%3aPJ2lCtJ(DQGI7LGq|5}7cYTz zZHv6HB+`2ber&tcIIGiO7X5PYnNJzF&%EqmcGkD8SIe||wDWMq6yDjH9<1b?b${m8 zbWdFP(7QuJL;ZYzZj79_`O1z?4`(+tL%DCT{#_54f7^a^N}Ye5)hY9(T-~K*!R_k( zmGyRHN6ho-89}0-DXR9WhVRN=vP<$0BaoE!{Tq*;lVZH!Ne-v+W~2 zEA(tRB?CdKS&KMsc2HqhEkcp|K!r#N{(2X|l|k#F=*jTtWxAJaoaE|f;Ew*@&Z>Z& zZEEyFIqpF|-kd-q+|?xkA+etc3fqS5gtnr;5{Kr>$FkfZt{_UvC2@gQ)xNKq%xWxb z534r)n#E@KOpv6L!sajV6%hYO-eZ>ED`rotf^KVHp60^Lc(U!IXg18;jP=|wqrNq@ zk55m*q*Pjd#FP#)@jBUpA0-YfUdFLge161m7-G)#qJrzPCumYmJ1=c=)uy z3vkl51ZZBD6PtyxOT{I5qln`4L9-bhwI=s$K{VIe{xXOytrB!$qSH0VA}L)IWun= z)=&1$7+p694jxtY%7K8HBHv|$W7p4d&d7dO9A^m{Z@LuO1~!*%-J15qnw@M5%NOjw zVT2vczc|FPbFE+GiqknRqn3-8=!TEzTshPuH{4R%<529L$u3cc_ujtxj`Jxup5l@} zz@grtGRf!Q3J$1Pp9EJ)HX|1nvnw74GvT9Om{D65ynG`D{L{%1CeMxdHVm=Z&ya~a z3?ivSvV9U${aJ)ra9&!r%C<5A%7O@w8&D|RhIZNTmCHt5-`q%<}j zf7NCDM;c6Q|7!d?1I(;qqAkE&Jg@0@O&P<7^L&fR67LfIz9=C)J8wja)8#DA$lF4s z6C}Ylml?%OEr(*3Ar$4~{Z0-2A80Gs?tvS@1AUUWDcD956+ zTe}{yg`q5RnfCj!w)Zwina+tKdo{B!ST1rxm$$daoQ-JVYI~u2x4%4#oJ?)8=)=0AA;dzF9fHF7!4r^3c zgY*7$bD_%?85$<`++M7PJcX7LAoK6TOhhIQGmLaN0tPt#4{!iC0Y;6H#rzYO+#n%6 zE9T`nfk4EjnzQRb%W~j6-ls|6&X3LOs+^2)EKgxg0#4mOvIJqoZ6B04E3DGNhY!m3A8Kf}^*UjeylXPRLljwWV zjaf;>9tf)0KkH>H+o;b>LaiP`F;E7BXINCMaAC#82xEw-T3F7t+ z@#PiCU^9Psh8f6XX+7vLEp5qs<3?nI{Q#&+-Uks;)V_*87+e2B`tbxyP37J;VxV>T z_2YY#aeX||sH#dStz2a~>7S06Gos8cXGrL;e5KsN@Csa1Z;5>Q$`r7e9W%Dd)}{o^ zs^2Q>!~f-s+7qPO49img3ocP|QIXbv2rE?4PBtdmZZMt61{~BlbD*j-Z?;$5LP{0b z)izv-Kj;i$mi=H+U=UC}qa7m%1#arGm7m?{N0ZJyr3*(* zJe3PMZ3+7&DFnY%JMhNy4r9s6HlM}U0vt;?+alx%Q3#aQ0Fe4=A#6=aJ%GsEQETv! zDw3Jjl+25j(#v^4+n$AewYGxKSwA{}eKeAx_6)ltH+5DcTA*bm(W+#?48g=)AOAUf zM?#yLND-2fh&FW!6L~p z?pTg2v3Y7bE>_7#I4FyXmc|d)X}tg(7qCoVRdDXt_Zh34B;$`#=TNMeR(c01JXg+a1!307o&Y#5L9Nn|;N{dMJ=JkliT%8^jH=1F#_}2z-SDqC%1$dB zQTwe(O~e6yLy_(~99JI)ED#Kb6P9C370Cleqbfo}iSBEhKtKu4HxV?dGc?bw5&_y+ zRL%15tBoQnM2Y8@=CxlrQyZuP7%*g6F2hQXqRc=HRYS}utT7%mkbG6Afkg>Xx{)S2 zUL3rW#dO|4DevYvV9&{lMlPTIBtCrr*i@*xCW9*$#rP<^OEjgW;{Z$Saiq){hS)?f z-s!1oPpv2{wUEcDOwiH&@wU_}=wFilR*2J$1=ibPPhiwe76dRR3y`q~zguTliu6Hx-E)&GS_>0|#E@7+cEx!IBCu z-h?!GeWJK`&g2@40K6gflsr3p|^ z8lJT$zxp9S2|FUId4L;E&1Br=#}l%NAcqO#d1GXNV8#{)7Y%BX&!W=Fw>356@r$c0 zB3(y=&mLj2+KIphj12^+NfSLTMky+RFeChQNTwo;{i=NQ{iH2XG(G(IrDRC%7C)v{ zEj^yb3@2ZCzSHL&@pI_rAh8pE{BkT*t^J;=)b@QJ{M&2_w*RN$;lB%==HU2W{&0!b zMC?=h|MQ1y4&)FSydmN-3ECw8{%c@Ix1`G$I!^rO4?}AvQ*PY|3e##5MTx4ds6%u9 zFkVQW@bii?kHnvn%C_x2Md?4jYz_U?@t5ZLz9y+TDM`xnw_ZqpZB%ktGG7^#;=lRj zB=_jd%AI|oCF|~Nq>1~iQtka4*)txyI~I?>O{*#OrH-8Co(+2rj4l19);w2lL41Tg zdp7jfjM`>W?LKb*uR%ONHy`uQAm$i@ zy~`T#s73EAiw*Ppeg8VP(d)H%I$WImXp$@Iv`SI-(R^|l`cf6%>-*tIM&A2PH_Jlf z|EZg#oTd8x>*Gi`?c4DD#lOT~rXN=^^Uodm<@d$x{-(bO%Wcjn(k)z$+S5$k(-9$yu7AUMhGqK&g+7v0L%Q%f7E^ zog2hrTylp^AH>+ykdR8K8&zqp;waVh4+;h-6%%02E~zgN+1Z>-BKnj=_9nFP{2BJW zl3F#W-)jlLO&=NUlLkj%k6KOC@Cu>3m%@=mp;99X?qlz>GT(sy%$AAGG_NT{H4TBq3PQG&bE2Y|T?sR+h zBXBehyWhV9a5^A=?F~z8qG*0o)#d6^F8&*jem(%hzWOCFl}v&?vKqdfPT2TU$+x_I z7o8Zh&;kMCk(z1a=3fuUq&ANEwMn@B&VEFZ&ZJ!hvC9#;+~mZGe^Dq=Vt&LCN%O}D z;PSSV!LIw^u6$e9$;3mJG;(?kiWZ5rJ(U`Gk~fMLTciaVQ3uWg8$5Z`Y?lW-8PTS{ zyaCpv*QoB*vixQFeq1kNT3k_0nDS6`y+KZT#Uk*)M~6y+@ba9MzD*MJj2_zIQ#Oov zxt)Q8NH&@Y_Ry?r%$w6;SIYb&3)U}7y0*&_Pns*jFRJteF%q{nN%dyXIA1Mlf!GXocjZ*H z?;8wD$I+(cMxHEFBKKo_&k?A7j(=SL&hYj26KI_>6m$hh+_$46{|`fSk zjA3RIfkW%5UAb$_^tG{4Jm|s^b@jFG( z7RCq`s&dea!isa{W|*KRB zbJTs0SSU^ME*PFG_KKanmx%%XsFWah`hI9_0C{?AELv}}PEw9Rq^dnl(5(hu8lJ`e z+|v0|>KXUsZTcXJ2DPbln;IcRm&A|LOp5`0Lr_DDfm(Sad?}k@;eij)sl?S5r=PD% z*%@{;+8EcG-o!p{6W<0UW=YFT2GL~SOhVy<=OxyE~Jln$XPzh2(o`XC8 zE(vD_OnsTWkrt=}x!%J45a|j3nLo3Fh9%-T%VqCDTv#Zgam-FB%ug1b*K4K@u&Yj1 zxsuyFW^1IZVYb=Sb{EMa-)8q)FOM-GTPFx~99V}Iz=ue!-bsXyDjdF!I*QI@Q~4jLr>tdI1>(c}&Nba-g@Sx#er zt|jp8VEKb2NVg3m`p~YR9!Lp=Xld$~%{R0NQWJgn!mFd!oJeapoyCUXgo)=GfPRf> zJ%fLLUcrVs6eblQ`-WQznmsZ0Jif$n+72MbY#HQPa#O+^HLPOfJN3yu5leIt2NW6P zb}}G+E{`timH*bTJx*&5#kUw=D5t4FP%x3EpA}GdsM{@St+`W_QqN!w0cta&vQvPp zXYY&8ki+Go0ji{tx}6;U@TF)EQm7>Cm$Bz9STwM zn0WxmJs;Ezx3-S*-s0HJQPFx?M#>ao?sS~y?NqPq<4EO<0%xnAwaG^Uk&C7_kHz;_ zM{|q-#{iMr?P*1VXUE_9At6GKOG2eX0)5~Vv6u6{`Dm_+mAgGB-S4xT+6BHeC zu2d2*U5Ku(uk8smfY%1Q)HPILRkkC45hBXzcQD3wzc28yPGyM6Y82p}3P>5%tRGNG zhQ(w%KaWK0;JHnySKAlV!MsbsOdRuxvy=3x&2k|x|Fov*04>Vh{%UekZ`Mz>_pp@j ztgc3;Wm|P%C&5dal5%w6+k7+RBFn8WUXq4Yp*-g{bvhl51*`t2Ye=pDOsLWY zemhZbsnYu#Kvp}btsrCccHTMMFcUt4NBLo4TPVo)^QDuGh#EqnScqze60lSoT1nfD zgfP6F@0x0XHi}0o9~Plg2T^d7k6iMvdxD#JLFbTb;}aduQ_v0Hh!d4VW&Lw4%AI}N z$}xsp6(N`AlR~U4uj%LF%DINCH(M`W1hi3<(*~ikF!J*@S&Wok(9Kfk08!=4&=G(F zs)r+qLj`!Fe}zjs^3(DDr}4|22Y=XkDN@f|R1vSGPeFfU>!#NoK8xNm}ot^Q2Vj3k{(s4uWu)S~U@9@J_Z8QY;1^spb zyJ$Ju3&Pp!JB>&>4pV9{i!p9OQBIn|gL;1lu!{5ol>%i^?IYJKpihDoA zy?@-@e%d5dwo|ov8?f|m8`LQ`;=Wo#20rE`r3G_Nvuwj zJ^3f$na;5CUQol#Eup2iUa-*mZcTfci5~RTYN|V>8pdIJ+e5u}?B4%7hx$Id$_rXh z^wtwUC_KKV8ETQJaiFrd{@y zP&IZK#*25`YavhcF*{L^4MBkzF-M=|`IJfD&4$oCjxiIIA0?GfI;S_a+C5fExtf=# zGB$<2mrCMlWrtBo#w2jmnpWXMwx`}oMUaBPbP^?@AqnUH%{v@3CJtm@3!bKUvuc+q zTgkTum?SF4G`2*JKT@RrbuLdxfx%B2?Wvu6jO%&jiVZCsnFE4H5D-P>UnpdTtkM?& zGYKACR1;#WOtwgDeAzztoLWW_U-8Z;sh=2&g;w(*i0gS$(~NvlP;+9g8GH1ZVJ+4c zk6O7=A)QUPB4~Hz20r)KLB$sPSF*<>F+Nlh`w-e} z=Nu}4WYqKmrWUj7@hA7{i4vk(4kF1P1}qU)f_dEW58W~jVkIR8;bbQiOOMJ;O>7P8 z%^+mWjYJIwv+0U!ehHv{3FV`4Ggd~hKPIAQYlK}-y3%H8Hpyikntyp;K0K*&IaU_1t?MIBOBygIt0po1 zI@Ssn6`O4iS~L`~yN>q6f;QCx+O``Eh2x`7rYK%28_Qrn5r{5IPO-XkYXE_XL(Ab@ zp{|$JZRZsCL`Fg$q%y6QJ*l)gnWB|Ua}$iAr!O+f2&#(ufJ1K<(An<67k9(nb!^qq05L6Ws#EoBqzXol06(c0L=YNxbu5}S z_DNowS0fbv5GJE*v>M1DCZNM8uTd0f=!KX69ViVT!x+#V-YIZ&K?zO>9dEU%>%pfO zjp?iT4fchcmaw5w5fn7c#O4qi#`G|s#t|}Dp9dwCR0(+LRXv*&LZxtYy+K&p+Ah0B zvB+v3Ni?qHDy)JA6iJV|=OmN-<18=xH2pXr)GM9kfdLVWLxWfC{#m z=CxIr`3iiQ21a59wnOZ$X$2F1sny_%F#aMPD;A<4Hvi0~DNb%0a9+fOdqmgEb6-wM z2qXTx0>cps4~;NrH<~S=pCXmB+P`xb1~YD$7Ficf3k|h4Dy#HJYH74qp{MTWXV-I3 zE2?h*+1v76oSQ6bpT0=4ydm*c@saMk`oLVNG)iF#-OKIn5cQkY zFS}Ll2*X~33f%I(BS*vf_RRvJL|YpF82WBmR&A>X3vNM0u^t+NBEHE!7C^5}9>mGb zLpoDwwrv!pOf$igpMPBP)9P4RnysKk;&mDNcr>EE_DSYoOa?X@?SOO}}nL=fzrQ-imxIJ{R?+?~Kl9Me}j=SbkkvZMgc z>n0;*B%9#&=Iax*iee!lbiL@gVOrnT@3LGM1d>6&W?riMWqn-<+0$h`ik6lelM6yY z>Lw+P3~h2QwGw2w))dtC#M7 z6(Sx+xMO`LO`L3=kX}$>oRre=n)K9>-=k`feAR$H@sSgba6Int^B+Q5RWd7jR3P_TlE zR%;v8XFKJ0kBz~mNgpuv1n)gGEy!5j&k*~bW1=J*2hULN+=k@%828ZsRzS|u8oGq^ zE7QwIw#zue*l|5<1COZ}x_oQYgs!d)B~+EgyIfw*cVFo2$l9~;bl!@TE@vlQ-DNW` zq*{F5aN-e#j~;h&S&he@lXxN5os9-VLhOC z3|Lh&F1762U+KhdeDIPdML(jDVV>nROOZ&g$r@K*;0z#bBi@Ht2kPEdsOOcnAT}$Y zhAVFY2RP!+IoD4*&MT3n>7mm;^kgoY8N`@>h-AGwS;y(cc>;6vUBKd;)|Ob;4U4ylL4w-7I4%-`ECs4=!@;!^vbxKpE zSgGe#Sixo4EHgG3H#^!I`mt=`Q?+7Q)wU?uqm^J9GVp^#cdb9+tzKn%hA~gopv~Mh z`mQgza77O;bcDkbMgA+0mo<22XM=VuL zJWo_WvP_UJ6UqlcQP$xV2mggT{3`)tw7ICiR;9~Ha_E38f0sR=nBQ|7oeDbRdVpF( zwT@LTG{o1%rqNB2BT-Y#F}uhJ*}^+OPuj6J}qkab~=t}RGP7Saa4lC+~b55 zTJ-8e&DX=7@zQ0LkaW4I+94+;fWO!6b-VZ+Y~<~pTSNY(R&QeudQ^S3@jeoB*8`7j zEq*rR@Sqi|Oq15Qcyg1#$J_BE`VggV6fF?GgGyf)TNm}V*Y|rv--wp=`Ja^W|ER$E z{{zg-OdM?gQyJH2PsB2J!2Sc6zkyyQsAx(1?+N>5{I|hA>;>WIwo;@|8Oplf$=QO&`BjP6^YBGGu%c z!N;V7!Q-@jvc~one~$`pI;LMfuBg3zhAun^W1NgX-7b0pOm9ZeunZP+UcHaqmO9|* zmr}WGa~_+YFQINiP=N7!*4++C)|hKwTv%VSPHie2RayeRQ2OzOLfRya(6#;maszZ}0sMl{qS&KjMO3{vMw~^8Mc3*A3m_J8&bq zME(IQdDY0uux$nABYPa)ecJffdv`H9<`H;=Okiv7Qq~VWDB2pRr)6h%p zqYs^?+G*p{m=rP<>$cg|8_L47Y*|$~=1_n$v|=33B2}B*AjQ9Ya<2PM)Z<9l&3{-a z{4*-;D8XPUMYOqJnj5~t`vqByiS}>pka9ag zj2VZS4zG^bAyUh3grF{mu?(ZNBCkS11{vAfalrN>HUim|qBa&m((~wzDkhFBOpqUr zd+(R($z?Q!MJGoLuK4;v$fFbqHBu686TkzmS(2e$Uf@C4*E~jkl9Olo?b7k?zH4jL zBE47c3{_&w*d!GuWbrpUceAG~aSaf;Zsqe&X&NlQTYgFs7lq{?L;PFSDa8p%laq3B z`ZG~4CFeG|Svf&&zgw9Mx;#jae3MkuC5(z*;Q^ugRrFcFY_eP=-W%8I-@ zP@HHdyelj(Dl&`F$PHDypd=7n&nB48|!ct_H@8rgv^GPwe8|59w;ypbKoFW4;xds>NGkS++4Cw|%3N7lk@ZdKjs z_$=5Uu0gz0nc09Xl|P&SM8Vu>#h~-$#hOS$GHDrGhk9BNPAU(31WHWEAR0^?rbFoq z@ESOwB+#czm`|EnLO`(}&QS1V&=`B4q*c-dRh2NJ%G|da|GJ7eBl` zTo`Hm-0rD=@2KKrp-0lqyMPX^uD!HL>m1};sWX~+CQn=LmkzJmPt@GT<)`5ATqpKE zq&0gHn0f9ojxRa#vPEyloc9q}2Gqo3yw06WNl!=I2+J zLcV@3r{?4fC>ua=@t>#iY;mzoZa+Fvq9)Xctkz43zKF)MraNBz4FhoOl+jtpTqFa{ z*^c6{c5R3{LlD3mq>~L>J81N(x6d^YC$z>#Kj@!^TOaZrlu7p)+K}<+dQTR_-JA@U z-)=snV+cu9JLxiXW@3!%=C=?2GpKllM55a>jy|CZTIMlWc)vO#k?<}mPzSLQP)s%Z zE(gq*K4xD2=;BHQlZ0d-W!+u6jAtMOhPY-%h;^bzFek{!q&QG41+w5G5GyC^ZdxXHoJu-jE~5IP*Dpw%S83ijtM+DzwVy_up(b`foG4YR*?-5>H*G`Jetr?!N7yD zQfCaHsE3~&+Jc!~8P^Vt^&~0uDU?nZ9c=A~peW2}tyY&?VFeN-KkYdX?m01o88;G} zQIE||M{lT{D3f!%fJB^(eQas=#cDLDuQB1dUi`rPk45H(v z<7AFiEo;#W2wGsoWj1iv?87FXw0je%1*Giq9e|DfI2I&Q!et+0(;nJYx!pM%U|+Fwr?jTr}}%ZXputS>HL(O)k6>kcx<@ z*ortAb`U5wZm?g(Ugl9k534N;h=YO9Ok1pK7(B8QenW%&aFWmtR`&Dnt|9RIzO#$2t#IoRspnf37x!+ymG6m zg7XH(SQEZU0LFjCLjj4>{msIrB5S=gEyae7b48VX>BA| zZ+RrQ%0=Uu)fFH}1k0XBhF#7u`vst}&BR0)D&2rql4N)QUA<-FS@uNK8)AyhM?2zQ z^RweXAHe*ZAUyDu3W}H;71pfPJ6M!ksvK^1^c?K$m9f=nEAzL!#wZ>)AE`Td9>uef zmmMuWk=TCt7gK-Z4`0=6%ohZop!v&kURqagMK`)R&7YAv{~?|{Ar>B)a#KPEu==!p zZ0(=j0HIXH;FN?>K44qT7>xsmURX9wXHaAw?{e43vr=9YmnWr;zT!}79!=Fx-gQ(s z1I+_9j0^{$Ug5dbMt^Z_mw}}&MFJ2^z$#ek%$0{_YlUUPwla<2%~XKLtdgUxl8EWE z?mFt^GCk+>^`>gO1A$GmHvM4f9`+zW>T5-@jTnG4A8$kt1)OuUIKyJQLC6-F3^%$7 zkegjjc(u}ig}tDpFBFg}EPnfE0}!4GWefgk<$aZngMq5UkQ~}i+$-qFbZl~T?)(Tz zbA}7j${gvN6E4N~owO#+D1puKMjVL-+V^~UAp1iPgbWH=oa*xn1d~|-^`6@RGPzFz zXei`n6m0--fw131`1~x7v?5<|s#S75QD{XF=oz-B%W3e5Z@~KOoe3HHKPAk;)E>7; zyk9a>q4y@+qD?jr z%foeq*r+QPqY@jzs8rI==`MuVTDH+xtd$j(Sz1x_ldGnKWD*r9cW_GerAAV+rgl3R z|GGt3J-ph@O@l=Pk8#aPx$sXzxtNbm+gX`cT>XwkEX%Zo>zvN|ml--oeY0x|r*Ou@ zPF(VR6Kqjmbe^i3P16*Ue4uX}-BgaCY#TQj`e-{vR$umoF(k&zQ(WiWT5`H?@?^iz z{)SEZ?W}(a0y0cLHQmQ3GdmIMO@X}MOe^1cF5#bDF!;20g^<~*S|V_?odytv)FOKp zKr~a0qwMA_fF-VAlb)wHQT>a-^L}d8-h$kTLGuo%+f2pnt%QFC9p+L0JTTM-c2zgj z1@&Pb;3*d!#N{AEx}==-nkK0k$&~fo-AU@OwX1AuyZKQ;f*)}-aBV+U{^=G^v3hKd zg`K9of0z0TMHmC8y|*&U4l{L*b6_nBxNhdeH?$C4p1v9|=NY&c(p(yP<`W|q2!{Og zH#1S@Q~*o6PlilTt}=1ZOTfDFAf!@tlC4tBwDj|_3Vn*caHr&3YS<0coV>~))h}3N+4`?uhe54j9Vp#D&>y=`IN}`Uc+JM(PnYPWvtYb&v zHfS?bZPUA`35J8NaNB9QlH=n_X%VlR#=dHvkjdJXrlo?I>2Uz!tOt{U#7b{$)B!aM z*;iY&3W=A!|5fXkE#*J@>?e*jmGOJ)jfu6;%PTXb=y6`zR$~yzs6pRhjM2b5jQ2`J3xr zT_KDMxR0I|$L8YsQ%I-)a{j{0Oq_HZ?$c^V68x(JOcLLWn)>L~74NTJi@x1g*0M3f zWiiXICY2BCUsJ2!&#%3|KvlgXM*nFzV*Bsb2Auzk-f8)V{!@4SzsmTVg)cysZislu z_#FZ_bQ8n0s>TT#vy{C!5+#%pCDkn-WE~b8^$WoS@ngagua6@ldZM2s^g6oT5$o`@ zleg#nx{Evgt~vhS_V3549*I9OM3Yl-H;;rjs?dH3msB~O-|l~pl+V9@%uGJFv*)Wi zHojGNizV``DdJTA_GWA!zZNu4+B+V(N4*>A?pxdS75BZ6&6r+m ze>Poo4I0kOpkUT7C7tR#vHw8MNVkDIZ#mzl^4TWzgcshIU7fDzm}ne<6%Z|z~Vo6fnS$}HpKM_jr^?h?REB|~SIj%6SPx+0@{iRyG z+oK=tsDj1v`~7^jOzf4=S5EaE(5^2R4SIF`%K&b>;AA~?Qg^T^9G}NpU092(0{2qxw1W%y)W0mUjZX**YF26c}ra$6?@B(!+(r_2he;htrv22%1QV!bK5|7`mD-X@PT(zjE z&qBFnMd=(@Nye$cr(Fpa)jg9FqqxswV0M=qURl*L$IZ6^BBP$ym{1o6=A4eGKeFD7 zv_D}A1fXh#5X^zGIn<*Lt>IzFrvCPJfL%}{yE+m=-&E41W%gR$Q3OG;Erj#gDIJlI z)AC7N<@ctLHmxOBl4;`M;hm3uZ+E7hx2_NRvqe;;9=~vA;p(>?ZD44!BN@OAM>9N_ zE6_wCz7@pD7((FX$_9QRmOL9|-#|JZ@64_0(cf#Wcm$wfrjGOGo0P}RRKGQ`lDF^G zdyR#h%0+e)Hc7K-r(b0mA^2Vj#k~*OY^EeK)jH5Z<)XT|=5Uu(30Q}UvLgm*GqJA| z=~9edgN#AO+x%JrTeyh^;^4k4I^1C6v;>Zfd7HORf~pc!Hv(6DM)(RuCh)zuvquAa zk+9+7l-cSAxEie-IQR#(#aQg$`XRRV-IFClmeJ*?v1WIj;mKj!9{M&+KnvLS&v1pM zS5^Aa!h4WeZZIgIwtg|;5rWju^4qfb8{fJa9h6c{teOiw^@WhA3-Jan>Fq`m%HpWD zP=9DuQjsWLu#r>vVaFd7=&>4)Uzu48zeW`^yULHlXKT1=o)0)#Yr?@!P|l@>q{-x! z3p>eBfGI0Pj(l8Z(eyChY_AGr%uD^f6b)AnrIMvjSqr2TXW3BUrRr=8<@TGSPv<}T zap*F@#xvJg1JxX~4wvazWo1ECt}CixS!m32lTAWm+O0XoD0DmWwzgRPNVk(DHeGUw zW>ZP0=D5VxQ(g1K81Hs@lqy#T%QV~$upJyq{%LsVy>et=ujf>@w*UV6*(SO*6pzhd zGgfrlSqb=s!X7=nu64&6GKWAaDjBNwr@^7$) zyd|uddW>wHZFa(s;1=J3RDPnA!Ui(GLw&e=?Z^*kO+p)quCXDwnM&|q8w)fiioR2v2RG<`$AX;Nd{guoiHqrSpO9r)RU)!Z z@&VZXclf~+FmO_YWRmkN=XIgM9c1CT?@>twAGwL~(rYm?&-s=}ZCKzK0j65YS)6QKbyYp-5eg%iR`4jkR;iR_ zcwJ<=>)|D0pnA8(SS(;Lvk9F-q%gJ}9-FJz;uMtUicD45!a&ok+2`vXjPjfGgeG8nZmc4V39;GXQ)HONdaOpKKyuv^{yG?xp& zwnbXwLEDuXDjXTyhPTl7Wr2c~5OAlZWeYlREQW-rbJUuWF0jJwiRzJ}?IhOehD-t0c1w7$k`3Piu!{~>A-V@zfA<92HIZzf z(M}U*xJdH6CnzSzT}~g`QIX$%+!We>xcAfGY4P2P{#?AtdRj#FJ^U!AmklJ`ySL%o zh;eM>Nb>T#vQbIW{=C&-vAmMK( z-n)Lco8f)-GS}u98DN|qg>%JN5uH@rcoBalUbq^1?iBzaW`coOT)i0aUy`9&Yvl2c zf+c#t-@)=lJxSC5A=Rr<93hmfshth=1Qg>%WxK=?XxBP9Pn03WI0i|>y#P>x3`@_5 zqEtIN)-iPfJ`19A@;+j4vJFQ|z;XNLW-r`Wpwc50K-R(=_;hk>77l60T2M-YHGbPH_Wv28()11iX#fM4SS%r4&cU zsu!Jtpj^=Yk^+b876;SjvasilE z-s;+Y^523zLex185#kByJ~AZmTD)bU+j+Wqw~?M3st#Ss1$=ULl2C|h3*>qE#G_oe zo!KH|*xLFF^W;I;dyG~+4ca&nIx2N(t~&eoa@}y|PnQ1Pe#v_3&Zdw5pmW7S^a0iI z+DKLA&(R7I$7vSzp08Y;%Y40VW%~={-{(}twBy@u`z|)&4?BAqwSSy{;j=k|la!0+ zHsKtl8n=(4xf=szdk&iV5%5(%oiCG{rl8Lqe8d=44|KG1W6*sa70$7J|8ZRzAIFh` zMW~{QKCB>E*we7vso>g~&k||Z>q=5&DOjZ!A{`MKXe+9f>xq+^Lhjx>;AlX{6y#Aq zns_v@NQjsd9@K`fWU}}9j%*rf_B&-V;1fADQJ?5eso%?~1+>M#Ah`Ux2UOobJGeXZmDu-_%{~+0GdN^sW(7X&e`jg~=PTe&i->zJhsqlj_hvG6mIDz?tN(Q=<03g zOTVv7-?t?RC5<33yZ7xvdNT^mH}R4vC$snNw-c(THY(x4$4!WT+Gt6q*hIBt@43@9-q3zw1W>M!!C(T#y;Y>Rt7cJ4$E}R~lpIT>?hHS|{ z>9+Zd*k@54Be%?!!FJ73%eyV(RVH$jj3am9M$28k1S{> z21yv(+bRBqBDV8XWb=7t@YFW!$w|V;=e3`8d7a9PLU1ztv3)2`Dd!-l z5&7{JJ)rjPC~UaTKq00M3%8!9S)q~?Fiqb$QVp>= zdVYd*Yc=95m9mpf7LAnFS$K1?8A+faTd#Jmq!Pp_-j~FpJMd2&P1Gl&0}iuefsc`3 z?Gj{|wCc&zkZ&6Q!pb$N7R^MtEk_;~fp-NKqFFZa+G5^&+^=b5k@lGj3KPn#V!&HL zc7RVfA!C>|+09>9;*bS`5ci>Im>X2eC|3yb#D5x6g#80J@&4H#l73|&Y$NV`nsjg> zTnv~-5zuDw9`G|xQ$i=zg#_q*cS>>g&Sd4Qto!F!Q1`0@Mw)>pquPe$LXD+df)?(|vG7=#^l^9xtDrg2b`?+TLJQO~E3_4#37du}0`g^0&=ULsDv*jyYO zrADbtgoqpb{dq~|2JF>J__6V-+u`wOkxny$#uc=cW&M6XTiI+0{9A|#BFe|>W{sI} zM42Tsh1^cnAr*)t>$<9mVJ>@w4-Gz-cZ(5AC%P|D$2$!(;EwtaW^WA^XH~j{xfnUK ziDPeR<%a<5;@yVEzW3E`=;Kd0`;jP81aqisP9A!j>`*Gb)WUPQ(YZv$*eK`1bpyGJlNo**$COws)>T$xY7Zw!Q`VmUE4)9)&?lfEi^sF|)q4vpKNp zM(;$C!3YzC4-{U<_c*6kMH0#jG%5eXMD$iY=E)H0?O@P3X*^Ue5+ojR)Iy91s9b5| zNBNKp3^^xRnka2x8`XrDHlv8(%fMpMVK6P;l)K&^dz!jwu?`GHRvpMxTkE4qw71kT zSvIQlUXabY@&M5iPO%SfE)3p8FdE~l2GN=Ct7-30lbu(E-}6 zlg<%FVl<>Nk*u%61k|^b3ZCxRbPeyFB);gNIB2ai7gl(0hO=s z8KeJFp216DRXR(SCabPQ(WvtN;;@<@p>`p=N?|5I^&nDFbL!u3nq&|Woe;^vYG1&0 z+Zoe1>=XiqKhFqlVWjZPcS27pwjC54_gV@!!6%&6pJb<`(PE}~AAkB2S|;CP|A%R; z%tr1sUa1^|v_{-fe8h${Npiv*0tPQIe0pi1Ew=)NvqJH#s{GK$@~Fs_V7=Io_?EU# z2J(Too?#x2Tj2y^UX*FS*K-jfUZ2u6G7b?E2+@xdlLy8spLRmeT`OgP0qi7m$V!oD z8cSTRA&t76G{iHJ?>gBJNj*i+)+~pYjyTeDqpgNf90AEsaaHp)K4_L0Yi9Sa%b<~t zE~kTbCk6%VoT{!l+}Cq!^;o*eT_9{M zih`~RefbqlK@oI0mPlQ#fGl(M^s!AhaUiU>H9NnmO_V9wf4Kd0)4&ifdVZr-=F&>@ zivN`Jl*^t_CYM${!BH?Lzc7*F3kMrDT>0l%!-W5$X3ps|JY==hV+tnwvyDla0BdV) zUHdxQ6X##=^28L2Yf1&eBp@sXcHRP+)7ft(ys`UXb?D!O}hMP$Uoyj8n z9a5lWTe23O8<&xG<{g*uR@-?`DsD)T7ye|04($dU*`owx(|a#(`J>TN^IYc(nt%f0 zTr3pSTXKB-!0`=;m#OoV3s40jubd3)CG{T0U##$*!D<8lCzV#sLSbhq?TXVJ(=*X4AgD+&Ss(6J?$D*zo@AKv&J zovKOJ2Y`>KOC4_qXD*XUA>xxkAx+IPKmCk3`cQe9FZl|4YFMmW{f%RIyQ(FIoU_YL zSI1U|CtcoxI}`mb;?eL5vJ5oM6#E%iT}r_2XyXls6EtW0JAwCJCc}lLpoFIK z8RT4^`wG~$ijaok2>hznyKbN5ME6vjf6x9@+^We!=uUMC%d&7pi{)bJ*Vx`Np#dQX zcNQ@StR?(DRwpiE(vqzW%lHoElI1y87A-$QXxMcYFD}b4H>QqM3{QkG8o$*sg4~Mr z3fp)Q>$Js5EApeqA1wDV^163Y`1z#en{$sVv5>Bq;sIswaYt{-!XAA^6<_u?2sj5- z0pg|-NA%z~mTZ<|xNIISwWb4}yRy)$jt^5b4R8PNvp~;B!;9XvsN5~hBO$5A^mGZ} zE~gob2z$Qr4N_jEd)`=%{h4)Iv6I}P&<0XTu5ai=$8ONm>^C{BYW#2}6^$wk7H+Zi;dVpCxcyTacZU86h4hRG+=aZox_3E9?HgIoX15sKn4%e|3!*(G5<$W zoP*_mgnEj#C;nWtB5j?}Jc3s3WfB`&A{mkkx`%A)#fOsVteK)WjNc$=sgXvbnt8m4 z6%wr-7mj*os~kR_kW&00YYvwV_0rQAuL1@c{vmyT`*{ER8hM;>a8ERbCmuZ;Ve*sY zvDu^eYks!)cyM=dx-1VqQ!@ZNe+>YhBv&&-bA<`R5o#r)Ygaof~g=js@Dr0Gy6O?k2S+_`I$ zI{iuW$nYJVt0eZ05z$e% zUq8wZxTow7deF@u?!NJNQWz1imQeQRE1$a_SJa=3o-T#iD;zC+ydg9B$^GT&ZaKBqHI!4mN~%>tZR>kSP=- zrQ_`S&%_x$;bg~Vp7-3&F{=R4*Hi?^H%`F}V(ZDN@i5!rKhJ}e1ncB7-8U5z)RgvE zk|07=1#YD+r@Qx_!*t$xT?7z*8|O^?QgCA7GD{4${8zQj4%=olQhD3QUiGH_-_oiMFUOUw^D z9|d%_dGpAvpkIv|I=Ppf_GQY=zf4^TK>tKR8O3Oo>hAMYOK2y_`laY%nmC&FeJvFLpj1hYQG88W5HhqRc#!w}T#~ zz&N59Ns9K#a~xO=2N0V?WsHeWR>ONjJrww7CaE+VB?duul1Ca@-v$tE(&?`EvwU*` ziAh&((9JLof5?7XaJZgFS`ExohFA#nx{voh?3?pt?o4!!Ce|B#wj7{GBg?e0=?2+%9I~ zuP-3%UPxMqB6lhyARQlxr-EO|F8@g|mp zzD5hr0ga7?>NiD0CwZXnPkYde-FF3^siq!hhb~cu_}6#g*AQ(vh1*&?O>K}5L{`+M z30NWb6px$s9e3v#FflH*q8?3MCjp6$-b6`O9wWg(Q)i5iGG6ZBpc4x+eI%iSErErX zF_l#Q$T!BP@c5cvtUj$l9>(~n7Fg2TP+^|BkIfcdZ#F`R?@FL10kl7b39omNn)X^j z)}`4xL&kd8Jl_?kpxGZ1{*eZRo^^m+71a+Z|_n?Hh9zHW7MlqyUbiAa?vOny#h%$hp zE%WeZhA^l}%-d&%rgdxkCvj#Vpr)z5rI2+;$F3t*NwhsihGD%z!+}UQr zDxNH{YGb%)k*cvT(LaH`7TD(B%(q>?3ku4z7dWj8ndUW^NG5O)nUc_G(xR`@MhTu( zj8oxku=Xyll3kVlyz0c{>aZGlko>BvT<_({hiG7+>jtt-5Jd~*-NzU50j|WH z9YI$|z*_<97J_X4;N3@eY+S`4m&_wOPW6MBz4t0B2+1V*HM-|y;CDlJ*lmdBujQ$2 zG<^X6TCyJe&|R|nc@{&jDOVyA#bsZ-J0CHxe%+hSt@MXAzhh}pY5$>1bgM*GbYF|T z#e9;7V;n1IQYno8y%yk)$Bbd~c8ZBolYSRHf96PUR=cmkF^nK`w{})W)BPperGTOk zD%8JB4xv*KMOtoCFOcjRn2xoBK@8J9rN?leW&UgeWu0qCn0u5JwDfn;Zqn_qPg!TN z7?True3I;<@QG$zW`1$rl`Jt!73N(misjrIIv|o>z-&bSpNTp3K+cxNz zu6R=s?a+Aklv5tvp-PWfr1PKu3^goOpuLKi8r;7Kg#FW7Bw9k&nuv+?aUxIv@ z=4A;hFDdm|LR-QahQ2f12nf-bfqdwBiYXO4f@Tk1v(_k8(shpzSQPRqqcYCpk)}$q z5Ql6YV%xH#oO3$Oh|#<~eWF$8<|}VV+*hUy{CWb$sA!UCl%gTxe{4-ob{Rn$ZmUqz zBe+nPY!+E1rzZ8{%5ur6mfe?r@x~U>&7P^l#|vxlmr=Z?(br;94gkO z`gk^aFB$tyeSR#1Sd)nm}I75OE=)ksY8HsA?TxnyM{og)RUqx%8^W99gh@r$-D;i%}i@# zekPnexnRtuFWFesLS)fKi%e4-MJ^x0)SOJK<0t`Q`haF`CVkVs&{A}N==uRut5!(| z0pEYN6NDHqar(7R6oZ#$ZPch4EhOBy;d&9?7|z!$XyNbDS=oc6l(3ARLa3i!&{wX> zGV^u?u;opsLQQp@F;-Z`V=o@iz%IpJ&xa5^1EoRwsK)w81F&1wSUE?v4I%3ejC8WV z*WoXEJbwi3(O>HGXjMq==hI&8g>QY9XLPA$+Bs!D2 zg%R8r^t5vPC~S5lqsY5n*(R)#zB|1@ex#)ImB^;b5Gt0MZjw3({S>4YmffS(KSU1- zxRrxVtdv=Xwv9k68|kLptT<@IKA}aAoyjIuGq@>+S&~(LJpIeKmUr3;K01}rfkt~T z>>xBU2wbinW3P@3!8FpV1m4;Em=NG$SC6OmX14+cAr1XR9EUFfJ-u){n~?maVkTFY zof-U{sSn1aab>0bk8i|x;Tp#1i92NU23_6qS-Jm}WuKa$V*B4@FWY}2ds&z`IRC#{ z_Wy>he1a@Hrv2yQT+=;1r_;n>_K@p9^u@M)TV0!C)e8g!dFdN<=8 zc21us7aoKGC&Q0-XC3)wTT8%jtY=EwZHEre!2?F?c%@bB3Nji9ji6Lv{$a;m>WMKv zx_9l^nhuBmnw5Mk<~ga|gjoQJJB=fLIKn6y4(-bk9~} z8V9pWB+N6Jz4GQgmy_Gkh{?5qIg?T($h5-xUPqZ#Q-UVwzN_yuGi;tPL3P9x?;2DR z-h695vM&HfxR-Yvv#N@S#ROL0NmDSxVwboIxIK|QLBxpix7teA#juskg=~Yg8%k31 zK%|&MV{mFsSpeqTB{mhnnmzI(>HWgWAg4*kit4-3x+`9TCv0NIGc1GBy1t#hxDRqJ zNs~%tW#pjVT0%}gg=z{#)I?WN`h72>1SE9a3@K=(>T!dJ;ldSl=eOw8jh-!83F75Wo%W2iJ()EBo_yqF>{NGM_`>=Qb_DDXowTpPq`; za!C|TjOZx6`1Nw@-BUc1%#Uz{PrsIp`S7!jl2F9n@hHVSjWUmZbGF(a%#N@|W(WRal|0}_TXS0671UG_&RJTVfC5>u*0*Polsu-{@3a##2ZvJurS6~fcVhVdRzb+wp?_MorwcFmO}4bf-Mhk{ zMU%}2D~;iQ37VPJj@jzCcL^!d*=!BFCHr9TkKZk~L|qRbrfR9MZCzTuXN0@;BMgl; zo?_E%nNs5xdbNZEAMQq$8ntUyf3WN-y2rQH$vh=bpJ;xXo;erbSv6jejjjtR&@&m< zpJD#ue!TefE?5?U&Ckr(a#v;2==xH3b}d`zlfr(}Hd-jVe5#os65Zzpis(;cEWD+; z|6TmKe9=DgVTD_n!*A@*-6KK=4z8X~IvoG}i z(Q+x!^HuHx`g8=<*zXS`=kAwE+mJIH)$C&Pmgdz1J?B1V;oj`Sg#<3Wp-#L`Jtd*t z)wjCz#86yS<8wXdY+gM*&PIm}Y<--PM=8XW;b~gjh}#1ZaP-b(vs2;~VaLiQF;x7O zS;4`mojX^qO;-QJ$IHw6-aZch%{wWP3kJ1do6b3TR)|{a!ZL{rQ%U+xS|2xl5Y%`> zH?)GqX)lFskhT!MS|g;ah-X2CP`8{OJTB&koV-W9pg3?UnAT-RVHnVYn|2%yQ2C?U za}-<-d+bZo?!beo$=_^4uji$h_$3~Uym7>^JFRuEj~}miQ+Z7Rpgkf(Hy>zvGcV5U z{4p~mJOrykVWr)}k@iF|ECZ28L0q#YB1{)H+Pi-=j*Ooik3w%I+Z z)I{*)kFw3WrbzQ+k^LMFC>%>erAPe1x~@;qcwkM;c-;>?**Ctl^3#wc!-2S)jYB3E zn+gLahU+hR^MpQ{|eS|crvP0*?%wb6gc=7lv?<;7j5SV5@qN(;7Z+qGbMi7$PK z=;lnt1TToE-q|Z@Ua%?`{`s!0Sk!h0U0~GydquC*v4bcrW$5*0c@VoMrEt%8HvC8j zYdH+uz#9ID329fXM{uUy3A@Klio0gf;1%-ntvCRgbB{A+%qbdKFCEn)D8Vc^xG8OW*@FQP7eZhzlp@$GZ^xdwkY60i2a zcx^}(=1oVHE2|D|<(oa9UdE-PHx0;1F6NkDl3`Sv)oW>C?{i%=NK?T2Fi)l7^i9PO z=t+6a$r4naQA=eR(K2nyDczaX%wlLnW#D48;9Ulx(mYthipbeWG{$6V@EO60*9T!x zJDgZ@_39kZ$>a_IN=u+n8D`DVau}5ED|VB9vd$|`qKsL3kPf=OYvuj!)}-DIs4vUn zw%e<+FgeA@Ppl1ERV5GFl96-eZaag_)rMprv-BzRgbkOno?%w5C2!G=_um1^yLLkh z=mr3(ktW%4Ee($`4xmjnTEf^+!GuccZV28oY!?--G1OLi@T4P&$CR+5lH)t0L>*#D z#A_ylY`!8~0FgQiQh=oUKb3rqvke zu~~AxIT$bWqcO4OT|Cx=tV*@ZS@v}Ws%ujk8GV7q$(VKs* z5`vwB8sU(gS_O5pFN=(KA9@V|NSe`nH4cN}1Wy{unZTr@_63n5t+4YZ9Pt%8AQ(=W zm4y7FoWyW3IQrMxOtLL*SiRLOfeY<|94Lrp-?|nGENob^gj;_1Fq<1C7}8+^AFXTfdGC#+JqznKn&ujt?&Fs6cjm(bz;7>qOp? z@ho;P3TH5tOMqP)c5jn3E0ck6K+&-kDBux%yo3K1q;YbWwtGP)0W<<^IUsE55Ej0M zgD+v-9)W_VUA^f~b=gk2On5;tO5o?3_D5h;T|{IHQlMy#T@rtZu(n3vvTKt}>{Fy2 z7tqkmU$yYb1gIdmAXqNr>nvA=7i7U!-aiU;aUWAno^G06bg{uf>W4X7#Q_4pCYuH@ zG{#`(G4A@iaGRj?{s3-HEm~L8H%s}(GHtRD`J ziqRbdL@bme1NA&r1bc}ymA?CrpGumW;>bEg1n;Kf@eJcM)B3tEwp~yKHrCD=M%HQq zSS@cQO?l>8ZkXOOkzCEpN2z)1POzu+fzmhMaav0Z!SP`Ke$@O8NC9J`r2FQn*j)dHsQUMR^W_DK+IIi{ zgN23hKf=CBS!T^;T}h$^Cf z-~hZ^@`${zQX0oa*z&RbU(U)D8Q*_ZW=nUIBF7i?ObC}x%e@`kca{7UZ~L(<=ew@B(s&+1e-4)4 z3+O5(M?ZVO14^u4XB~cU0?ge9!7E}1KGPcQCD*XuuXiU&Y#F|Nru)c8n_|T^;!W<# zZrKkfVJlL7n*#qh4^_JUIU|#cdAxfZs30PA1hE+j99$?QY{^`K^6GNJnXmNACLKA}HX(??5TjND>x3S;-2!B}fV$U+pnny~su9QIL729!|Z&F=PCk zTv=`Q+=Z=zNudh0Z*W+pGy%i0*e3vQZcWpuvkGO&&#PKPyv$PJF*}J{WQK+h0Iy+mZf!dxe-l$Xw^{R~ueBVK?575TF z4}zvmN6GC;9YLsC;;&eKg@L}JasoIRirE~&wdD?}8!5`EKwd;D9919b3dNdU3`ZtjXJ9=N{4jgtJfj}5Xm0>mHiquVM!hu` z0&1dR(ox1J(32L!X}t;`XBkK zKO%tCEoOoo9*isMlU**6NuG5k_%|5*inG0)e6Am8#lVA&wX&ENBUGpcU>)Z{FctM_ zqX{?9FCDZpZ+>J(qOJi%`Z~#w_4dnFefA%M<`iB35N>E4)Jhr?yOS)f5Pb7AH( zVVcEw-F!rUyJTANt(*`ijRea`RoA0|NXPWA{4|Ws<=M(xqpuAO6)ms+cR1EY_;(>z z2(ONRz=_QEEL5&g3gVqQN^Mb?lS6FaOEP>UW`=y)<50gEYMa7*9ZktEAXaA1W^XW# zYrMvx^FIJ%?}ZpQHk&1CW?RYZByky6Xc~xjWe9zlZ589NuAC?J7W{e8>~OZ4sVu0r zP?oLH5s=&M`})P?^gTjyURUt0AVL>RK1w#H_+t&u5(z{Wj9h4v|x6v`=uGKqF z`RN+L$(@cA;?ss;KfXm)+1jQ-fvoM7cHm7n+unb%!cEBU!-z&lK?tqS=-F_dGJvxrS^^_>g$oAHGXsn&_cIm>v z%VOjV3Lu8!oCk^pi4!2jxJ2AF3gfd=jh{%j4_XW2J`dvrXpYyr85ni0uzy~%;vOIB z5W`C`y~~qc@jDI}Rmu?qU~w!rk`jTaYK7RLMoe5Na#Wcbes^3-U;F8aPcX9tebPwX z^cL!1D#DO9e-Fo@EU3@(Q5OuO2o^bp4if;Ti+ z=aY14o%7Z-Ayng47j|TXF<$>tDKw^K#%$&yngzQ--)a?t@18l=kI`86DBdpUSr_la3n$&bX&TPn3u8&4@8bl;i=69D_!Q_fyK zSgkRkyPtHMp$LTlHOo0Wsy7x>XLN{3xO$tI=@kgD4L?^+7EBTzO~ClnQrRT2?P;++ z1m~k#(J-2t*|1F9^(NcZB*WBe2viF@p;~5#@;pBE;Ztv>bMni z2XaZ(FWj0{4my_C$aPOY)npm?>0K}UBCX~sG@k%tK3SUJyG2(t*uz<&F|SR-tH$x= z*+uvZ&G%e}^|b91-}Jx9wCsMf3r%kFCkcPJ%SwTED98SV*flMoJT z&6$6D?fu?CH`UyO4bB6v^ERmCaW=aWVk)h1<+Pn4aBXl4u2(Sb9Yn5|uIkkq*4_G2 z=4LB?cBI?W5wVYp|E#2G!GjKDxvr4)$Ax2QDehjtDm;^7@1e= zrzGe<_Ta6a5!(-(&bcMfQp5qKdze$OC9DPsSkbxlpfJ=y+0~{myhrI;2B+LFt82-Y zsoR0{a(AG4~sJAaO3q0~S??G;4IrrvO@@ZJRRFYoHez}FUCF{$YHre9Zm(qbj&ncc?je{5;MD!05L zXy;ugE#zls+3i62Vnns(la#^q@0aK3HR|GMpL+zwEQ%0Jdum(a&IOn+`hM+7eNV*IUIW~uJ#vJmTf8?WSkzn9VqT+{Ea#h z{#Cm4L-=q*6pA)R)mIOl%bIs={tF*F$t#YJ`etwA^ZtA|^!}Q-`3G8gJpnIj zl>FI(HQs_axg8P07ky8HsDa-eGKmP^xH%izS$N8w`eN7#7xh z>?bJVmM(?g`Jw&)?$(_aFZnqCtv|VTEa8<(yp^V?|M#;KzJ-Eh!l@BzLm7`>$#3IyiY7G_FalWg%?U2GRc+YGdt)z-uLB>PJ zk)e$8^Q_&CO##Bf};J~iSr!uaxWl7;UDEsQ5a#kt?<8!!Y{Wo0}c+3JVb6WOoa0>9PO7MQLYg& zhP_)1Rdh-ltkx$rN7pb*%ut8K^OhRBS^$Yb`mEE)>_8gi+9ep0`*a>eA2iTFR!wMf zS{nIkT$onL3{A5U#Po@)%ZLlK04QT6aZ>)Ju3$n28b9{82SBba(g*jgHkq4~9Do_j z358Ov3zOI%S`{eJ8LU23D5`{fHltB1P;|ePhZ-j#E|N2r+V*LQMR_B|eNeB|$9No0~Dsk9j!nK+eSC+~z}{fhZtB9dZQ%&cTUn`ta-i=^Vie8g?MlKEkk zG_bCb*1_g1&FcP0MQjL{P30K|00K!|lmlvMXgO*oYv8qhs+$e*Umy7qmb3m2iUG*2 zqzB@Xnt`TWomI^tbYag%(oBYWqEl~z*xc40nk!CTapkbpQ|TT($NupC!bY9JN| z+SzU?E8z^u#21Z0m^)1_R_z5;5Yc!^09Je`B?&$+$a;1-xlI0LKIYPEFKZL!jRv#P zyDFL}JJHr44XJ}nvGlp5p!>&egJ{7Z9xj^99^F~5*9KS$M_jb- z@TaJdHpI#peJr<-6qZYng#2vA$ls%1a1@30HmW(oV)O5_1>?vyzY8)lgf!km=c4yO zo_Z1YNe3oBEp?SxCfR!_;7r#`1|ZhOKVJVf_w93$A=Q+SVxEJs$jNXQ8`srbJtY2Z zbMAnO!b3)d3-kV~aKmGi{^}K+2xOY?;NF>W*%y0ut~N?7w`@;zd8*0iN}dLB5sc^= z1Qq7b)<@}LW2mr4vqq<4(^=u9aVVr+V}Eh^}ft z<^YY~+$H^-A*v_Kf90dM4jABK9p{u3o1L(p-{F zQaMZ{@TD3B_1dY5^GbSCMy{^em8xP+(Prs}5QdgMd~bg&=8kPXEk>2hG=h zl3G}#mvS4X@mx9@vD$vW6z`=S(0GU;TE1`5hvtjTWU4`Q zlbFBjd#!iboaB)mda`>KJ5H&Ws%%qyEmY?n`jSEYv82h6gF{UWhSsmMvs*8PS_&v_ zc5<_eETCwH#%7C!@YmsJ{}Y6g4B=e7lVNcc>aW1LCsxQ#I?#x{F-+IfRLZY<8qJ~i zsLF#3rbk243(I7LjsBijV?Y2?h_} zj6sK@BlLl1My;-;g@56a4@e=W@REe*MnhYLLB~*MsfgTeMwV=79{_s2hmiUN`qvp=lD6X(-p=t+KatYVd4L>k{FxX1(Ugr?PNRHN`4;Z*^ zI34)K4c;r5hp(ltwA~y$mufu1UF*UN8P)Kdz=iPq_*=#ev8}1e${XY8?zpF7>N_q8 zxUoyLFqe~Va=wES69%>;fsuhr^*xycs!DlJ(`|n$CU)VfD{GtEk9GU%7I*{7Gcv#R(MhchUYO- zV2Kqv%TE;Z_a9cC4XV|bw0Iq$axVp@*#h?VSrH5bNKfcbpW9_{rju5;4TN|l1YwhL1 zI5V9j$b6aRNO<-6a`u)#b*TexC`rXlKLclC@6WFMySVBol~(^MNt$h6Ue_g~|Lu7)sWjaImRa&xi$E zyZx23Dy>;~B9Xek;zXm$TLcGI@9l0|Ki1G(6~s4mLo7#Z(+>)DZ^Fh4RvaY!=!pK% z&E+`YgMbwZ$_X{`8%55K?OOnF_irQj9|A)E(cJ$g-v2Y)4;R<}5byubSl1^=6%iFZ zvEeHsAxrNj`G2ucQ|XQpxn$|RzKCpyDjHk2@K_h?N$H1-=?v8F?nj37W#1ao4(X|m zjmFbPZjOc+j^1Cc|E&8*o4{EcYSIy5U|4*N?}}p<7^#`{PYM}wr@BbCj4T} zbwBAAbDz!S+89teou6LLZIU*^arC~FaZYqf5GFtamY?IC={PQGW;vEuJiNbluiXeI z{9M|E->xh*10DoH-MpK*(%x-4ja^RJOM3r ze_#71xc#j24*~Q)=%VM)EqYNnE(KB6$}yG+t1Eo;J0uZvq0wx=R;D8x(F`DT`UolmAVfN~zTR{y5%ns`?j61IMPU&8N7wb8f6HIzVf-;op7)-Fe2y*6n)TCUj2Zky) zKE@eg{(Yj990zUP2+qQ3w&t%VR2mrt3vn&RALn}arHQ3bI+7|A9Rh>dVcDHV-6W0s z1+$5jzhlEaHjo8Vj(N{#h5@roIy$)<9(cR(r)jtPO9RBYzC z4L-711;5xfGI2B-s(U>ZI<#_$mvs2^1UpOK=(@DB`c@Ys2!JKl&);D`0(&!tnws%s z&RkVSkyOgpX;NX+lS5mV#OwTYqXXx^=X2T=sz3qk#`P--6`}l@;@$bM5c;K$W!<5}~DCC0jEz zp8TK9m?uA@96Fl5?j|@pFq>Q92HN?B-k9(X&E=EQMZ6q}mHoL_9dv1dzDu=LKfQo1 zV4hr>xcG+JQkw@J8DeM)GmCZo--i54`ez~u$sDZemD8KyZZQ>AJu^k$8Dv9A=O0wqof7A1oL@wuZEmCg}^RGCS?6=R|Q@4{h zbTXTKMaCMvxuJZtb}$0Nl#g3B`H&KU;e4N&8deRF8nT9@&QTsSqpa1&L}6d19}7On8)8*==ejd z@wJqooMBe6{S~jA!tn){99Jhj@&jH+meRU`0cmW-&#k<3q10G2%%mY1XV4K{7btN~ zVTcaV3=Hiv=? z+Y-Xupt}Gxy!cMFOJ+Aiv#&@-6%L)$eG%h6-DWynD8WHv@%Qn~x6upsfhP@0m=J7+HUcz5de76>YJ8Zdl0E zDcB?)nsx&;&FUf+E)EO#=5%*6lP54I0D{frSVs7HlNCZV!$4rB^lf1; zI8E{m62q2>(Bd9H4HGr?j}Da=39|IovLI<@og7oT)(4UEfS}p!b~WE|i`ANTlUmo@ z9>cV`z(Kuzf=G}=wsquh8+Ty%?-SP0iT^U!q9))kj_nxGqOwA+9+3h%w{hpxQ`9E2 zE}<9(qqotW1(j9!TPtn~bA#{~p6BoHSWRuvuBQ|OR8e_uQa>=xl!={(b+Za8H!W_b z^qkY^#r0~+B{6O&5;?HgjA_CsGb>sXndE3A41XsUzq%I+awwRAigzVVEJ~6Mr~1I^ zEq%Yn?9xjtM2}{v&gzxj*jA^QELHxLNj=-q3F*wxr0kJ_!vn$?)A3DxGLm$#Q)o{4;3_?AG#2OMX8Py&wtzg83?=z z<-C2kW`UxRJEWIn^bs1vm2S|PiQjQC0;ZW%`07+x&%_}u=o zdJ^iz`{i$2_Gl1s7FCKH(@+!A&ZqBgHR|=ruIp}OiWbATA$}^Bm8fGAFtOFkRv8He zo8MyVyRItFtPF6UMO08(`$_XBl+qaL*Cj1HF006garm!cR5HeGi4o< zk;o{&PWU)TOsBeprocU6E^vi2fB z4h^f&xtIZ|UoAQvs{u`=IPoezrrd^GxeWBiUE+Dx-%Tj(wy@bUXsKW^YNRs}-7dLW z>e{ugk;7?IaC=^91pMSBBH#lrmgp8yIi%0MyzACA#*H`i;pH}C5GPK$>fLG}ReIwi z7x|D@>IvJ!Po!f>OIqf$u42wPlDQsjvWHSY9j=7D;weIKlf}y~-|MH`bqTc`w!!fZ zN;eZ>#gP3=hnIZWk*jH|7mm$i3!zarlh`84OU{ zPXsff8xPiguRT$If?aE#qP-3H^tHp+R$j5mnl)4?5b8-9d&-~1m*CHhZ&BATI$k`#RDB(*8X`?1g(etC_ent9}o39 znKhada1L>GO!rnR9T^M7JW`KA)D6@mP7RVoh?IZ6_{QuKEJKuBL|--B_Ol3PRZ=BT z9gD0=+-VO_vihZ+32%8eb8yM$2fm$u?ulUfh~FWI;Die%?h<v@kli zZQHhO+qP}Hd$(=dwr$(CZF9G+vy;@VN^a#t{==$w&1Yf^%D_M=S-@l*q;Pk&+KEE8r4pNhTp(xo+Wb=S4po%Jv(_GDnlyk4n7aHB5HC@;27 z^2i6%J}nGjHA;aEuLCMiAzcCOpO(FASfh74o8w6+)N7|^wg#SfUaJ|Z9^sdS)S}f3 z1;8Y}Sg+>#pW(8Es;MO#V1f};?~?S*jLqC4gkWeSu0fBX`aAet4Gzlk=PwdCf_kKL z=Qxc(syp1{P+M-3e1+R&OR5;x!;rkGTsG zsyY(m?krbCgMXXGpOm)qJ`?Aq87x=HdC@z}QYzEHXXK#)wuaZz7rm5-U|do?^*S$xRB5&RE-*h4LZc*WGB>!RUGvB6F&9t=+<1E=#19 z%3RyU#a*`)E^%K=Vd~)x!zc9l7A?Xil;N;1O`X=^+W1+16S6U*Q_fDes*Z{tw?6;) zy(7~ttsebvh5!EzUBt%vKMqG)v^rv++7V~JQ9J`IA4?%vP%!FYIkeyAV8Cfz{sUdK z(EF2EP1Pu&=rav(JU`FKbNO|dU%K}{&_yrW-uH8FpU?LHs_2Wl-}?VT7x`W0a-k(Tp(zEZdphi*GTfckqtKHpH?^Zs~BvY?GN1 z3SYOW?vw;Lj$6kK)SJ)F9Tpb$_xrwX;+%r7uE<`|(KX>ft5}U9rA_?H)?U{%_w(PC zi)Z20?UHENhMXS??|W4ET%YV{M^p~$e_TtyK23pd#){|)r3Y9LjueV^&PK^ZLl+zd zO$Z?{QSwoV@rfLdXp=FK%4BDqWSCOV(|BW92>6S(=4K#8+Sk;za~@Yr%pN);oaQA1lWWqsMlbj1tWS< z5R0jpS|#R$m$SJkvgOB&D4KM&I&iYs?C+nuxn8>!%XlNErKcN`=sd)q12V(Ns;v3# zJtAm8yifk%_3wz|#0*8SBoK4@(finY)_#ad2#5>mW?ZVE7A%SEWn$MlAGTy#^1si? zO@L;Q)}-4MlE5(WQ!ijLj1mBezrhsm$i<&#=GSq5y!{cP<~q z>GJJzS&%Uif+jE`M4`)GGMGi!+ew~46}|^W)M2gzewA&P=oJq*otixUZgX)Et%Xb! zvOtZ~X1th+9I*hwoNj(nFMYw5hO^w5CLevw$e5p<1_y?*qn>Kj(X#*$t=rZzFj{@e z#e@TBNHJTJ!JtyA*Acy&S0frmAUzu}MWd$XyZW-@ z4R^K(%iMUQ%njfU`+7Nbk^n_XU=2GIxl~>$@vCH#=>slT=}oD?547411@g;7A+8w< z3_*`+cG7Ec`!qh43W5%6MHxvUFj#G*l~rzuPF?}&r+dFr-bQ4xo`%dJu553au{fvz zXa*m@UDj=!6tB0}Oo9Lj!pQ?)9{25Q4%m zw-heS&@TZ-Yzxcz>9Htx^>neYxr&RqA=9q*)flq?OYY!Xt)L#vhTNNmU~BODJijWiiZ>C6pR9HSjc@~(vcLP2E(Uc9GsIVO=%gSkm|r+6=v-(d`TPC z){0?B#=Mr4Xuz-s`5fL?+z4AsH6=@t*MRx+-9G}_Pn~RWagT<%i>_RerrrvDWfBwM zWH#FS`tPHU!#S5cTXC6aJ!=gCmP=XM&fcpYTNTjVWqrP5tSC@Gj% z^pChS2|cFeQTouJl9#|F%WU-01~v|_Y)oVxY>5i$^fyl>RWbB_)Vpj#l2N*8HE_G~I00KaL(I#h7&hnn%x34v8Sxl{ zkZ6sV6yCpeydCE1)6vNOrBL_nWkb5P38lG53IT5rXdyR^0XxZ~0p;*WwK8_tWqz^} z87E)POIAJ$Os{)(Cl1I{O)G~(SKUTJu@Y8>FWc@)l;Z!8^T3I3ZzYumeM zaZoeU3;$~VL^AqCnB8{@M`+(=k2CNv>QD2yAciiJ^2r;VM68P`W-KAXIl-LNsPU+L z&;?!8$tVtZJgb8F%v^_ic0*7@ORIRo zUW+Y!5?BB_SB6LwEty??-vW;1eqc8WwMfscu5hkYc&qQI)pBHQNCdqcMe8m;WvdZi z3C5aN7m$smEEtg~91eTT!N^n1=&OaV!u=aoPC_2~d32VqE6bYEokEWF)tq4uFHuodb7ht3VYn$HbRA-X4qPquG}PxGI(*ziMi}F zFgS*jcH~Y0_()u)hg6KM>b`@FxGajTADlYQ@9*NDXaiavm!e^wyLiA`F%HMCloK57 zHF_f)kj*lXq?*sdpcD*`=k0l*z{yv74BhK0kV`$Z`<~(iLcu8Z!2^Bu1bZBMb1=>( zY9yZEYxSM4xIPa9@SjJw2T#_o!Qm9+lT}i&v3FVCMf`+q>k3pUq`MsXO~i`M zq~X(Zv*kNc=)#X9(ug!H*MO=-7aT%*;dG;(|c*qhO1tkAr)rdX+|yXv}XsxWeK zx3ilXrhASEXKr=ofc3$-6&CB~6;ZticQtxGNnt23-JlK)AP)ub`Yi&WnIa{;C8mTq zg+U)maPJTD*%P7=g`WDq7@|j>0O4AWDEAon7?K)7VO$PWZRuUa=%r2+jbPvOW$&2Z zyH+n6H77X&z5#`}OZr3pwNnaNFVZ<`~#+|su(_CuTFWW`;cs)1Qfhaoaxlhku{D3Ct_t9P;D);l#vUICBx9Gn%bs>PD|lNt&EO`~7q0 zk>YVvhhOGgILBY688#yKOYQv76u$RgSRbsuU$_6j`WRPEiMSXOWieEa4b2eJ*t;LK zFsw=Uc6Gd~(p@mefExZKN+bvQ8tE&`xZhZ~e*4Dbr>&LPTWSit@4EQoJsa^yZEhEd zI+S}sL+r*D0tF1)&K_ zYI{mN-=BouK3cjzbn&#{I;WGloezKCU!da54|5~NFe|ZsX0s+Ir@k`o{l=G(5=iXS z*a#?z!a>ri0@#}HUWO1sbpAwBkp%OJCwhfNJlkZwQ^l>#pi z3{q@68HE#SP$t(Iqlyze;diQOKz68Vp@xZP0gAWVWbWK?HiO|z9^q=NHUi9wTj9b? zQILcyO_oEZT>vub_tSO!+gZ3BH!aSVXz~#9@M6>J2Bo@Ox7TS_YwE9YC3);YZi2m$;gAw5b^^U+AI%XVB4$6W4*xhtWilE)jq{Zk zn<&z#Qp1iwi)M=S*k@ctM8Z_3mboZp$74dE6eMxF9xWEaw;?7Y?5<;q!>)y?Qe0St zW5Iy&-MI08rsqJY-*?p3ty5}Wp<^!6&&b{8wmn;1hqG{r5-8K-xmtGHY{3b4l8M_5 z1aZ+w>)_f$x!ZUH*sq0AE&LbB7y^!RdGLl*Z)R+mBSIhHMB(1RL(DvO#ejkW0*;bQ28Rym8l_oiuYk2ZIyNP}F5&#LN_ zM}HT3!Fq~gJ0GeVQ;l~rw86SsA?Q}uBVFf~>m31kGfBt>rVoM4ezOOAU15~+zKo|0 z^V+S<&QD~N=RR~&zIo}XK&$IxC$XeWoAVO$7-~Ww zEBHv;`$93pE(%LlV?w-<^O&5k=o*xieXz{1%|U*4d=|KRpQlRLl~dS_MsqrDS|T{G zsQE{c2A@k27WJ-D)H-E}B7V5x@FEv!fS?W9tsNOq80qIdxF*3N1}Xjc&_D|YOk(B3 zOt+^^YkZg4e;TO0Pb)bV;Spvmb+!;!UlDit3u!}~M2gz7rADLh74}2omV-ZUu~!vL z8J;Yn8cvRt2h+6Z7#zf>JLpPrL8S4)T%!fMe}_kp^+@&|%s}8q=ZDmM=?h0Wns5VW z$WFHQ7@FK%DUPx6#DZ^Ra~e~yl9&KSrjql0HCDvZ0%fJAvT$Z-LL{AYs7xNnWOy4h zo-h}y@T27>?#G)EdFIst7NqgxlsQ8LMC~MU{lO`e<14c{shOb=mcM@Q&!m;3N*cWSe4v?c1*dmnGNEiJOv)F~oAWQ1`9 z2>ghhF8#vA%`*+yt(FfAulHA*<&SGiK_@Iz7qsLNmMj)6=hb`LQFr!rNe3xXiBpSO z!kKXU1)mr)g=N;QcPa8}CAqz`mP^bpnP8B(0ZD;3R_rff+(Dzv!nKwvyKPl$A5$*+ zu${A!*?Z=63AG~jdaq*SnR(VBgZ&JEDz3{ni21&7e@Ep zl3**!jiQC}cQhrjo?9)) znhIB}DrSqVfI!NvuwQ_5nt~T3N!<|U;9&($hLWcn2uy8VYpQ+%CJhcK%s#Vd#`qqH z2{dhF(tP$??^i=P8Q#l%H9R1AQB=wH&WS3Z=CO{A)xH1*R|&Xrs35>;c#6vS5*i8y zD`}=#Ry8vXt7hegHI*zed@AW?S?5gT9Tt%r7r=~FZ0mwgaM6p!JV@)gSD_2Vlxh@OXg_r{J?W`H?AuXkxox7Ox#$kL$`DlavsZ-&}Z8D_| zUNp6V#?+H&%jjt7o{ST0kdaxn+co5ZTDwY6fuy#s77Z0m)7Rw z<5Gnzw=LQ`*$J?7uLEO?|vj1}$ zRSec9ipN-y*F?WBt~%Ym@o0H8txwITl8ad22VJ3wtxAF%-kp5xf^kb0Ap5 zYI7^&P^v=7z>Bm~V4G`jODzDchN5$6VM7Kou&GC@_{Wl<)wZnM3$LAejI{FK9YKK2 z{z^j2FNwvl|G)&qahs&Ox;Jiawa8`8DT(q~I=;c?TB4fYmsAMDHOewpApG? z-*7SYzZq?@UGH5Afml#SbSmuYoVA3EZ|jrJHa`*Ado=!}?sqb@JKIho4XM$zURTiR z>)5N|(NhWlconEU({Tgzxk}6i2}@t{`6vgZKRR^jKcbCFf@6E!oa;BbW*DjF@5%Qz zWljXF#KzF$8U66-U*&DKuDhRoxBfh8ClxU4efA` zU2e>pQrUt3&gk`ehasWq@lRFZdsA*Oa;KrXK&_*611kPb4QMPDa-Mo^xunr)IC(VRv8uS&93^-82REMFVC5 zc4R+qBk2xF{+2eS+kJebP$(6eaHcVj2*%=yqel|)C+2<0_sKgV-REU@XLdtBB9(6a zxgVgvf2Q;+QdT(Yetf((@2t(e!?Ok{r+{8M-rmC_Y!`W8$xH0Ru~Dy( zq0AM3nDq<2Q}1GKpNW}*t<NVqO;c9k1pySIdRl_!o)-TeZO3o zxGQHaDs)!=qK;1FYGm=lM|hrguN~6I&&j8A-ucHT%T@jQMW1Qj7tP`89@){h4SLMp zFYmX{$8*q5tkA!RL%~8p!ZMj)>UV{<-U)gi_B=HpCFxhmgK!4`<}4GjfZ&>kMXQL* z@RW*$Ww>FJ$b!%9&Sv#R>)WNS9mvb>KoCWH{Ijnnu-M;hdQ=oKaF+{1!Zx+YJBjP+ z&Qp)84JSGFG;ocfmU{ajaSmvC>W?>+GO&t8KGEm(Z?%O~<)@`cfTILIF-euy}HNg#iYok%;5eW1F#Y1`OFY|>$q3WbCW$+%NlVO8LYPg$o7FyhL0Jf6a6wO1IgtuFw@j&pi$ zK~Xbt+)5f5`tRJ73yz;4a;eZ~aOCdW<^`!4DX+nA+vk$4E(WdDphEknLGrqJX|1sH z6-xLro&mhxMc1my=$+J?n)y1Ij!jG%QfWE_@Md}OOa2t6d&J}pfa01lbi{MoY^Ig{l@z+7Aa-byy`A|lPC#^W%UF9X|U z6dO=N;2co$LFeo8)$PXs;{h&FYnV0WWh@B|8h(av-u6QN@T7F)Zfs)ZK!8p*6uXxk zZM3Ls)|v<(1qTLfTEim!#C=3%dQ>h!N59}%Fz-M0T$hrPqJq{~-c=1RyPeu7xadhv zc}!|Sz51t%qCY&f!dKWGERb;xR!%I-7vM6NaTCbwUt27FpD;ukj5kStumu;PY82bHqA($_C$y$HxNq7D*N zi!TnpZ)ciYhLy6;*@pPghBlPC15yvhT#(cLtB0csj+6;LL0&VB<_7-@#Bs8;Sh zooM`=zH#WO$U&g9lov0h7?v@XG~C@aDUzcz1`iwQEG*L4ngV@@^PK~3q!2* zAIT!W^ALlHKI-BbXTpV{GKBHH#ZO*YwrOhq{QPdw2Zj9#TFJ^O&FRtimaJx{!-~2e z87=P?BJLQ`cIY0dHeBhZdr=(cO zstT&Ni+cS)U6YVbXkwJMNJF}&*%p$9)C^|%M$=+!wdS8eeo(C9s3w28@62B2(QfKH zl2L35l%kT!Uy$|U3*2gWNdcDJ+a}jRr*6zQ9`hFV32}ve9ES}LYR1%A7FJzx#N=>A zvLgRWnWnKDYlJwZ-^M0A40l=Ly7?8W8eE>2Gzk3~IQTe9;!tuv5;*sWa)}|gi6M$x zVbq#7co?h&h+zo%^tpjEij(cuE-!hvtzw7t0vZ0nW4y83IWEI51TyHjp^FjjnsLfU zS1Uo#x#dCG$dW>cDGr?TU|K!{v?3CchCyD2Pp&F_UPa+kK=|Yl8$*(Kt<#kq?cT|I zmqf9l)G^j`goP4CDIZC#)t{q$pdGT zA#A<0!h`Wjp%PKW17M+5k$P&!jdom40kPQ!Yd#dcjOA7_fpj^cG%f5^@Br{A2kJBU z0>Y;?*6eOS&v~M(#BiHMn~LjFzwtEebMC`1oGYj3W^dGDtDtkJFxQT=l}Ftl6l++j zRVT)q%y@PbN%+`bY&G9-B60jYsS(ain`R?-me((5)h~n|{j@aa3)RF5g~avebVQr0 zSj{cMHuGtE){1c%Y_x0eym3aTk{&L6chWFnUzXP>7BE3WHth=?Fw@Lur>)!^K&Vwo z4*}BDpoENCRE1PSnqG?o13TXVEj;@$;hyS_N)k_)Tv>QFr#DqaFnEaa;9$OXl`nb9 z8=*FHnzEx)`C_e#e;5fa@)$>}OWurV0gOyZ+~|v?wbzB#hm&eD3n^2kF}j3%H+$vb znj;EYUQF#7;qOx{n0)74#$^MVRw%&ZNC_}j(P#V}%Vtah9(aLpsMnZ2gJ*#O;!|TD zIiLriIZnFSm@VndmY1NVbsC_evmAs9{V~m+ucH`vR3d{3AA{x6#wwrMY=46O;_Zn| zLY}PM^ZMT}jDi+}?7ikJWZq1MKhMw@DwS zi+T!PQg#nkpXOsI(*o(&%%rzkI>)dV{>jATfJi8L{i<_!e;C-!Xy6*Sk0EzN8HdBC zncjSb#kXjo0=jQ#nj3B38APoE#z4+9#@(?GtYp)Q!^bXtc{M_>KtfQGE1DwTt9ZX* zz9|e=n1i6!RX+}yfVLL_8*#(OQ$9`g7V3*F;?spIu;&&6b+YyakPs+oxc<9^9y)yL z7vHDLsU&ovx%BLzDS?sNTu~7He*f^I0c%l?#qcCwp}EbGxdE+W^Y7G(^(+Y-rn`ZQ zcG|r#;H~Qf+g6G5&TS+Jy{Yh>F-$+1zzB+T^%w&=u>l=Km|f6L0z(>mzHD;IU>mp0 zodN2C`SC%d#_EQgY93B0AHT`UK6!C&syN9pLa23i zeT6w}ga#@^2)Ntz1YBNBRfc!iEOsjm0Vj=D7wsL#_j0@WC%6ag&uAe=cYX=Z;=Cz7 z_K7-_uxB*E=>S>d_NhDl@-?qttns~)JbsRVV?>U=usP&~K@)g`EDuHD*H|$`h$rkno(Cf0)OLf)hII0=HtB+WPWI~pl?|@0h?0H($y;@lylaCG z`!`tH3jL=VpdtBv41KWpLWlc)UgQ6Ur@&AX{NE-L9RDZgDg*2PuTt-b1@8Dy>lfhj z10O&EFt8r*EL!fgeST_Zj(bqd*XOCCC|X=9i?K0*gw;JoW9@5X_7pz4ui-(Qes#OX z5&9W@+}==7U+7w2=qtaUuJ605K8H5X-J52gSPvcCX;R@|3wc=zl# z+-+~dL7u)}7X@bP++=-6y_4t3kD6zyzBEm60PLKM8T z)E*n|>d<;jv!M*Hs(arNebz*uP28PIXjV}>jB;?121VDVRKaT~1h$L)Wi{+n!Amgn!2En}DTQ*UeDh!q@)A@#>40v#Z zOYrr9=Pe^H?jL$Q{2oCAKL@I5!;Q{-ydrID%Rz13+!MmQN8H+VTItw1*sgTfD$BUg zP)t$tcql=RQl?E~htUI?S(teqqZBzRmSD*IB`YassiEM74b@KP=|-vGzkG#K7O#K6 z^DStvRxAL`z?gEfG!uzH;!Mm4(@_Ta+X&9{#b-`ORyg#*e5^U@nv0U%8yu)eGhB}d zAiMXvEtn>yn?GkMRkZ%3@_+!0M$*KX(I9e#>}L<}*-xzGB(LoNxphe;4wiWi`GgCOfMPDjOP*=|iG?e0*gmN~L*|F!73>y8b;@>1!s$NH1REN{jUjb1K+|&8UC0!0rBVlmrd>`f#$&o- zo4i*NgAQxswBCNM5Xi1!Q9;Qdnikh%(jabcqIVQU&lHa_PydW@TH8Q}tJWN6OJQh zx+b!Yd@31+!_akc`%_aqf|y6Oz>2D=SN`2_47P7zCm0eM4F}f|JWK}B^5iR&!hO^h z3MjRNN08xh7om#n#R*DHZ^(2o1t2Q#Aobc-b2;xzSLHSkst!CKj9W z8>1g2)6P;nhrz^u+ANn%Cd`=PC?X@00Z*WnQwvH6s0K6NDl1cQI=fBMXit__H3N@6 z5CkEHk$4R)0{hfv^OPjht{~vOzB$C226DZBvehuuNYVog7JDJJ*#Zx%NUv=-Z9hq1 z1dQzTa#vLwAos3`d zZLB^YtA&4ri{SYT1eYs0BT{h<l8^8d4t%=31bDDEq_PX5e#z+M; z&!CmT)Bm^y!kgRFTVrkb`qUGPcr++d#U;+@zAe7Y5ZCwsu9AVifP z8sJN8R$+U%M}|1&dM52i*ieGk()tCo z8w;Nf28|72K*w-xh-=R1N%Bl=`RzI!F&L{{vUSO4m3if3OWnrM39LWLqZaSZ2e{&H zVmvd)IaBvJed?h)?aG3vtMsXWb*E!TK4S)zyXm#&5GhqqOHK7ih^vB>a6VF9F1whck@ z^6;*_ua6;gCOv4pF4A#ZsK)Gq&5SFRo`&;_ggcJd&lU7Et4J_Tn(YIjFpxBr=g1jB z4L22T!$dOA4YmH}$P^n?sYS z^s#4}l=#tJBv+w7pC2{9EbEooRz@<_i8Htij!RoV?>C$c;{{_LC zV~AoqNND5lr;(K(-NCX}0c;`N2!feV!c4nBp{L{L%`-wKMW=n%wizs`S|3LI^@DVN z^nv(`8Uoeubo{Ry7PvT!h^3)q_7IbH0roQgX!O@byv3v=zrcfa4(skLp6!zmx%dfU zP+JLxklfci0*&PNOM8NU~zIkHzP2-L5^+Ln`6CNEHr+B^>YhnBLty4yuC_@UMO4NwY~DMw<@Qr;|=}y zT@ZBjg;b((+dHmcIYLU1Sq?qDt*zL~48vYsli?UucaC0x6*XbR(?IC7N3~S3zs^O5 z#f1DD0F2fKaDG=y^3P!K5^(j>HMa?7Ecn!k#Dx5xTW|Nj$~mV)NhL|p>?mu9OD`<= zi_m;Os}ATZ<zkTIyF11epjRSoc z-h))Oo|5sb&r7TH_MemKF1w`a!XcH*+!8MDi7VnARGZrC4@QRMHER~`f%75h@!NP% zN#BUO$LRQ6q4ylR(;r|7@_96BWlPj5o^xk+Id#x%2?ORIXz>u_)Oq&HP=OnLVP0fQ zC*m)T#iEC%@;QQY^rTptl9EiqID4(rNN(QXV52(28U$t@2TVu<5$&HR z65tYWjp_a;D5I6`k)-!b*@M?a2A6ET^%)2u(2X!wy;oTw^m%_Qq^J76kY-3@7&VMc zJBfQbyuJAFar?cBo1*Xgh*A?)QPlUfNvnDZQavb~$rpEezyDg3-T3rz<=Sae+*q06 z>!+RG4AyC zWLvJz!i^4~;w_nD<=?^^anWtd|jUC_BUoKD(%Yq8|?s(f)jXOV>(2?jz)b0tpN4l?0_hG-Du{r} zhNY+OS_e#COXUp~hD6Fo&$2yT0N>gg*|JgRtx8(;f)z6v_CZvgh+swO-J24DwbJi6 zg;wCOi5L6hSh0YmR@lWL?&x10NsNeOS$D=Zfl@K1juiJd*}jL-Widy}#6X0K-E{3H z!9J%Nq_S=uS(d*;xzR?IRCkXRUTx4y%=htG-ht}vzwr@NlMZ@;1ZuJ^-9)o#4jSUM z-w>4l>j-NGF;Ham)Y@G)=C7{aeE+iuAevGC>tEG;bA0qj!q9Oom!l>g4{=wtDjOPp4I};%{fZ5Yn;z$Ik3XqExW^p}+yQ2C1zkL_&KzGUCi`B)-QC zn%-_?xJO$um*;XTEnfwj*Zog#K#A-Oy8+Z({=h`+ijn`~*LBoTl@V!WLJ051owC~a z4XD7*I|ePJ8LCTm0H}capWq@$+n55gWW7dcRESb4Fs#6rB>~4fGaEs}zwihhH_Ur+ z3mYZ9l>>}kYekbJ?~*!Y3ekc&h#oNvI5+nGESRHk236 zo+j)2_2sTp1v%Ma8jY?N1#M!p#69*kBrt);4zr3&WP zq_KgA?cGLSQZETq7+P^(%e4g>JdL;GMM}O=-I>rK3SmsUZ;StIpf2SVz_ytB1Bn;y zapq;L!oGC!GEBBaqUEG{c|b$x*v7_?oVnbKQV~KPJ&crR~7lX?SFS~VPzTvHa`n4|TVL+t=J^8Wav3Z7$^Q;5 z){WbAEU1)os^2S}H@!>6=#MRl$%T1zA*sa^x! z?K=cYBb_DopNbE;-0+FPQud&$!*dvMGoTKmdTxC$k#_yGXbD`$F-!9OMVqmCdc;-$w_jcRk6!UoGLZycuUPDDeORdCssmN6$g zL_|FuBcM_ZH8~INi&w`$5EbnYpbe3mtOD!HD24>2S@B5jBX@@mOj<2Z3YTo##HbSs z?CRSlV=D&8JVNV$ShBBI0F}Gd8n;jaP<=O$dnM~~pzmp`2u68wz`d5oD`@k92bI9> zsxgI${XaSwP@i9eMBC&YD$Wv42y{9t#y=^RuQctkvo3lgY;%a2o)ru&TQ1eBT8Pyt zQc10FtX4-??2IvY8n%XIXc7g4mv)Ljnfc2a%uG8;J1R%!I`*0Q zFP-H>(v%25bKb9v9$C*cCTS;l@BlLx6v(DM2OFRGedcsaT1uUsGWwLVJS;R2y!1++ z>;@k^K;q0*$&J9p?sa6?+4;{fYH5RFx=9rxA;x3|8E}2_#$nryU}R^J4$;w)f|tj) z8FyC9HBsVHEy~2cn`(9sl~LiZD0D`}_S~hyQ-qUkqQz-iH*D?B+5XN%1#w|%!%Wu} zA#IdBa?J&K2ABFTdHQwhQv~;qhp2f_Nq5mqD|9WgErYRdzC0Fubg21a?TMRZ=WE$Zyu>a#wDW1~VN>eZ6T&IUA3Mrx zP?C2fEJEMg)M81qNPJjsV#yu_zA$f{au|jv{Q=5KZ09I&v~4zp26>H)={8-zeLNm5 z;5r6zD(c*m?MPA-Z!F=FPy@XTdkJqoqVykZ_&kDH7W>X%tzJCxvKF|Y-FBI?rXd|6 z5_gmG^KslS7AhF^amY2{8(tao#igg=igT=Q@9!fw7Akd{d?6VaBFY0qH8j@?KEY<1 z#kphjYU_=If^xv1wd7*Gadi=XaF9J(9YRGb!YP8{N6AO!zJ;ix2YZJRDf1MoKf-ko$ zjN!tb2|R#Wpvdlq^s;K`OU+HyorL?5*z;B|w6Rj50LjOLlhdW;@45h=l*_(h&6#cF z$R4ErjRPr0Jxj>osbn5TS)f|FvC4)NwgZo3FrC%g8`4F&3;a4%T$&q|S&WT?e0&(!W{51%-x@%!v1IiC+p+l!2(8kI$l5Eahw*@Z}f zac1NoU&^zFxknaf?7fZn(npYL5mXm)5lb%=G(NOxBssLsP(m|}G~WC1lYHLLMVzrh z*&eI&hFreorqH)b_R?54Tg*7VLXF#o!21s)j!r_j9yI@oV(-maH#mRgQ;7=Nz!vA2 zxrSSO%mTTPYsp2T;{hC1OFyRJEc9tZ5(8`%p@Rpxm=JJ^)&X_0rwB! zKHP(E^uV(UZq4+;xdwO~hJcdxQ%MmvOwMxvP5v2LerX@J1ZYrk;6=)}kOqJ3(tgo_ zz(=sMgIzZ+4mxi}l2e@~3P+~1NSeS%Bwc|WS%HjPkQwd_LYXgL*(XF!SF-J7jXZ

4Xvo)_Mu_h z@$XjB54KNDIRNwV+ApB~+kw*m7LNW;7$Rl{ z=KncT(VD7#{Lkg52O#pIE*gUILV+>?x1gV{!YGbb^Civc$~yfB^oYcp>|=2Udjs*+ z5F*M4;)BvtHwD}HQD#u-i}b~+xYa!pXR6M`zf%QQEn}Tj8u~x^i9Qk@|vGK(KuN+ zzvb%Ip<73FDC(zRBMP>sV4M}4lSB7#b2n;X)E4#7yn^5S+~+e8R?dl3!< z`1xTbFe78cD@U>>+tKZW(PjItzhD%?T)`NMVW`l{W2xO`Q6%gmNGg$H5wn@D4s_Yt zfroHyVy7x=xCPh@pTPw^iDVHw83?0(glwsMQbp()m_8cCW+qclleYgN-Ud@4125`z zHXUR-MbkJO+|JGAf@Wrk9Xp1iW;9_t*Q%bJt{e(kwKeVu5zNK2w(=JwF>OwMDk|RD zqd-dguabxs=6KXsHyxder2N!#q$5Sq^R$BNHkdY}^*-Brlqt3?XttHl!pEgf>%aI= zX0MtM-5!-8{V3c~R#rCi+i_EoqOIc5=VvO`URHPu22-Dv_RvL9(z!sfW|o2cTw7!@ ztR*h9-W8oq{Om3eSCoUZMQ;0`Mkd=W&1^4Im1|1iedAM>zr2_Y@J<*9><3UmuPGt@jvCpaGhltmv=9_L$)zk&WXi4Fbc)%C#>t$njf*tb zhd28h5yqzr*S6pq32he!E$60fZqmoW+LWk1hDu!H-rHde?fU!Bf9#3p5kuzM3S1v* z1@4q0gJ8!4xEGM;8~Dg|v~8jL80d{7Sgf2$N zFs%NehGi05lp``%k)UX}BDdn&B$qRV!epI~Yq&zxo-?OJDBRo2Lz zKW(u9M%3D{pwh)@Z%7CV5C{iq4U(RRL6UXmN#IXc3=g^ak`-a z4!6H`>qriz2XEeSFWfi{%&BzE9Hru#8_HQ7;P*bGLy$?rDlLPAGZ+(@dTzX=;)B-G z1q5eI5erB&?g4zYV|*K5*#loHEjsj}v7%raP^XvyU}Y>Fzl)c#5RD}xsPRvQ)B;98 zc`N{&9QiubH^vpF*F$ft@}xLafb@F5b%4L2#JSUKrPOzdfzTNw;g8=u|MiaxO*32m z?*i0#{qJ(Ah$S=Z1y9f26Co#U3vk(*@KvTvr!&?vMEPM|W~vv4JFX=414Tt@n?WU6 z?_v^-let4`4D#FMlGQ(eYw$>mS)8%`QB+@#IOGUp=oxkw1QQPBFQmn~q!9+)^DkvJz)&}VnPpGMxKQyj0GwVW!;74qu9 z35)fnYCxl(DOLZ(70F-|W7@<=sH+We6z>giXm&nMiUnz~H93c#sIBU2W(iZ_m$5>? z{f@9#CT({7qQ$uaF=H7cXpr)^mg;r5&4mTWM9?OJq`mlc(_DxRh{#cSXyh;ILLt!s zUWn3-{F&`;iLjfVus-HfT!?;fo$lSqz0Pu=IZy-2C>~sfL}VhLs5DUGvUl`&h$Sny zs#Ds-Reb=Pb|Hl=_rGy0#G@3(U~@SDSKVapbkMT2%cFp*Wc=453z3y^gFS%v#G;K{ zJ&;hJRRkcF!)#V8D2%vTe2zj)bEUlZ0<_QLYTbon`apC_GsE*tAPb zNk1Xbsd%op;&r&;iRt}VC#IO*v0+yzrb+5KuOr#gIiHfTkx4B2Gm6K5dhv@y~Fej;Byyd z$bTAWi@vL21NFo9L>RU@`#|qWkoO-33sJgwO;jZSsD{dU1PMM)yZl^;cw-SM4=P{IG7&?_ z)&yU+;f`-6bVNz&WC<)G7OIwa zyz^(l?iB;mgOgpCQla4KTj9F?;TuOUdnKVMJTjRY%kll_DKG{(OLpbb#a4l<-xYY1 z79uSyJNaf<->T44xIhQRx)2&kJYiFq*cPnce7SeiJ-D z)jjWW#qNCSZc9wW@qHRdct?l3c+aW$1EGS`>4hh^fP3hvvv&=aQ4DBB%?!kJ1WWG* zmq-+MR+4cRGgUWXpWyh{-Jt@&%DZ5o1|3sqs9IXLT^IZBdcsmoq|fDPJAH&+yxD$e>)O@6qaNQXBsG!6@b@|p4exB7o2_I znxBTUB9i>Clc9(9bqj-SC+uuHZx6LjzgdLc-Xm4@$i!axBjv;ifSY$y&js+ z-zvV|zOLzhfjPu>FaFbn@Za%@*f{?08Mx+T?EmMDyN*Z3Bh+_Cz{kMvl(?ZC8%Qj% zW{esq?Zr!c)=wzhxXy*7^*&C0Cr7<>xQI{Fqx&da;PZhzLG$kP^G$hczoWO!y}$e0 z^Y#7kh}D@B+%dvlG}p9K*el;;Y5$FN6052?yz0q`tOO$| zTPVql7JhMzi4EOCE-JgL6xM~k1SLT@AVIqRjN!HnZ>W=yPqb;AEFdw<%%EXY3GKlj z=NW@*^3_^Bwgjqrv*e}jGyyyXunO$2;cgY<7AANn6w-3Z9{fOwK~20(+XUz%byst< zgD_U^@muHNJ>DFzD%UJdx|B+^>uEVU^dbiK~# ziXsk{p15zJ{&bgKZdKuj#&?1=xg!8eHnUn}Or6IXM?MlqhVKWnn3i>BbKG{|0}Gk@ z3q*pQr0E<7lX{ka&=ibj*yRzobr>u~2VGooX!=QmRU+$=S!9jX#-JJFh)FM&-i|}% z*Ja{oNf`yr!{x9;ka6fF6AzEG+nNQW5XUHn^rk(_)fOhoO=QEyRZKv06vmA!O!h|m zOhJW#P*YVbGt7(J)+u8uP6r*<MVa<*&-`xc}ouNM=$sQWc{%pLqrgUaN{3wWG> zI4S76rFz-3%I7xMuwnl50Pml62Xvt5wIN%iw@!a*MUHi|QVuxgI2r=pX@A@s?0C`} zQ(4%(%aZg4D&1p!PQ7$c$8ZP<-w`&lW6d#7Thp<$FT*Y3kYkoV^} z+(Uep%}?)SoFhP^oIY0A$McO8$fiI#Gk*>J@JU3(tMEM_O;v$DNbwwqixfPD|70-6 z^~>=SCVxeVgM{%_uuuHB!D0i7%^H~SBwa_aSOmO#r>9 z#)9c4o`hh&rUXqU5ko}{MplXODT0wGxmlK04jUp#>(aoJjKY5$YRzcNWFLg^#xCy% z#3~=DYn$N1w-9jZ=dWEW4KIq`jotxH(hRTzMUL*>SR0P4qGYY(}TJ~bq?_9x!u zm;GxnOI*ZTNmojw>kXb8wpU@a>Y_s0s22PR=K*@#nf_y#g95|nk)B)X$Raoq4$1Rn zdTy2$2%_2p4#i}R*(!urCc{$jHT%# z%@Z}XRH-GV!*(-;Qa7*J-PSnJa%X08z~vokw6vH&E`x(1gSn5{fS=3)uh_B_C7k?8 z1=L&x&n|EX@S&=q-_A+voL-p7tVm$rcB>|Qa?FP{;(aD+1x~4Jk*PGT<3{4oW3qCX zl%m)|NJ*#K$P(YP-)&MHAZzpVLlfp?!T)-&1W~r-Fn)9rwRhT{05E?G+7AS(fI8O8 z3HLxJD|Auzb3bOjl&Bp{LS^++K;WHe#>t&C$p;GBwV=-<$wRNmZ$ln+L3<&}Rr64P zN}NW~C9V${;gl-ZHaA#I2rEa!FE)T$0Uak1B!PeO)cMssaTp6Y&p$zF9+y;$^DwDX zPM@DQ3P(*5!JI>*RF(V*PO>J>({hxjF{cVT(-+yf0L3IV-Z(!UZfRhMu@SE@RNuY< zehp!^VOb4vp;j8o>xE@@@T9Y3nKzHxBq%yIi^|Y@!;yq>^-vtbiKBm0iL)uX{0@!9 zFFM9jX#Y-WpB0`y64K}m&0j9B=KIk-l|*_q6Q~nso)^g2RI5%?e=}RYH-briUL@>j zVl~N&x82&r!J{%O#7#_WCEFzivcukR0QmWP`XI4iJff_x9b49eCN{z`B1B|j?NK|~O>w3j zP0KbBu}RG?i|a%g&xfYv?j=$>VRp&dJU{cQ2KU9bZfa*D_7RP)n%x?MYnba0py!2$ zF0h^R#Jq)(Yk;EqN?@PIoo)@xq6?A;-d8I3j&rbyKVM*d`sy;YZtK(mI-pOl;Onjs z=$k+$i1i~b;f0WyHjhBy@`DQE)aPR9c4>6}h%HKayi-|b|6q@+lmCJoc1(WZ5iIbG z9|-9@AcIitBu=%+gSJZcMrqSg!Y*4NHmRw_v_yLMgAT4nGb=EcZ|#2ig5~mXiy&PW zsNI!nC(XOyaii*xc_9myg_OVKbI~?fHdR(dC0FwRS)ehp;IXcw7@2oO91?tN0juOD ze)6nH&05d*v?{BFd z0gA;b^YJWIOfLk!X1{T(z$_9->$6X7*Pu~2V0}?@f;qEJLQF$T7MLYlw6`r1&M>^O zz^abw7vnw)6XkSIf(PsAXrFSA)x?G~%UP;N4mPW}h!`8a4_;$iVrTY&axSAPIeSPW zjD3pZ$-xNZ?Xs}!UgUCf5!CG+ETLx>)rF-^!uD-HN_7YcR$jUAu)^MpsfT@=$M?JM zM}5{*{~z))(|?6cVq|4w_}}Nm%Ua{HPb~;NrxZ^>e1kcJ^m7FMM)+)GPSB2Ls#5Jk z;GYMpf6@pwL=?KGkKoa5p8vKZTYXnV{yuFIlj8m$B_$;_=1%)+`oYrq{=+8W<@&v6 z|9q)2LC$c$8h&h*;SJCaZxa(EsmkWH`uWJQ*IS)kEOsZf5I_zxk{> zj6DcZV)#V_eIM+H*-YylzOi_>h@8bSua2yuxp$|YI}j+GeB3eYcLtk07b3yZpR2xZ z9k4wogq2yWa@(jmXu4+#dl8BZil<~eotEh1t5JioU}RQBXF&dFf|7D{xW?VeH?>Y zfET8}GQofQyY)d&asQj#;nQ-8sOeURXHFBDWE>6p9tJ;#q_BEH1FUEtDlEWpcPARs zXP8NH9{beeW!|tHns3CPQjLP zSU9OrNUiXn!n>3RdM%Och01dF1&LE9jRcXqil9+aW~krp>x+5QrKg5un?Asty2DC9sIIybCFy;Q^PzTMs`Sh6PJc9`p6-p`b?LiilCG|fd) zTC^NcLab=laQ2qDk}yoozCv|#06ztzOXy09j%*Ms39$gnQgM3mq3-*sqv1me%gIPz zp{SfB?VN%+&|XlcUw-2BfZfZiR+2UqH;k4WiX(m$9}f3|K1It&3td3&0Vg~&cpQ6y z4U}GDao-1Du%QLRlWjZD)nBGsIdMFy5HX~H~#(jpa8@X5H@dXCCM4}S?* zusrJGxD*aqn=~z~4uy3fN!s&asVWH0Gm!_z=OA{v2?ETx+Zs4+5l1`UMANB4zw2L% zjN9ucs;10cR&ALGQVAO6rA~GW7_MVGFg8<4n2o014~2KU(cif(!8LG)QWWNm8CEItmwEMJzj9eZ}*@7q~+X6O}n6{PN^vinGHMIH6{GqV zQB1go#!1v|2=pB}oii9*L$!2xDB${lyX3OBxy79Tw%`XF!0D)?%iPA(OOyu){v4R3T`%Oi3lG}}+Y zCkwF)PCw@n+<_AQs3l}%3}%RtG=_>OzbDoiRqt8$sNjPlx7nPO7Sl+u!aZ2WU^4zvIAXW>nO&XVpQNV=5LT%qv<(JRp5rB0DJ`!9&lf zW@nVU*}cq<79s3V54z!Rij5lYs1MCXvXN+nJ*-n)E`3B=g{7mknzPaxcnrq6zaZVo z>&{fO!2dc26PEbwX=pFHBPdc`d)3`gWxHY_SPj~g#wIBVoUlq5uHQ?w=Q|nz;E-XM|a*ngdSFmwkdZrjqtbU zRPL50OF|w=!3`ee=>jqGedZCdc8DtHcm-VZl!Neqk?uY$bOW`E3;nU~BFPYmqs6{m zqRGFoME#ePw;9O3P&d;dO{s5vtqZm&Upv@c6cap?m0Z_>d#xh&1C3FiDX zRgqXc9tt9sB@ILIwvzG*dUI#?Mv$LG70aT=uz*98DdNa4yotNKyUiexUb9J-WwWTf zx_9TJL2nw3SyomY_aEJP%br&i!WW_B!xv9BqoGuN7XI$xpY{>ag~K*JvCGz3s)5?)gSF0XL_#rKyi!)=fXp;S5mq6g<9j z&whyFe|15+oEp>kTrj?}>ta(r_}~rYaJJADaNySuXf0NlC9-10BWnQ{CIj2SB4plz zFqX6>Y&0f{iRzjj>8el_U+EBykl)jb;&75$Adc_C9^INKtOMw{S?n?MoOelAdx3>0 z%%2|SdeXA{@00>cc(9k?cB(^H%I`)Shc5BdqI#`SHWSAau&v~@*=s~F=)@$h2;@Jl z413@GTPo2O4mK?FGxC|X?EyF2VS}?t9fJJ(JYLQ0J#9o&p{_}5_xgc*)Dboy!49iz z(~IdGNdoY$$XIS&{;o?fnhr{gI(As%jle8Bv#thEP@R|yR(1f(T;YQ|5@6zp?2s;gXa7Wh;L&T(;rJd#D`yhFJt0 zn*!Z(dplmFawzhY)qST?TXEeyhbGjAWVwhsgSs-W{~^XC0`7o_$)tqc0J7;CbLr6a zPf1tEev`q(RiQRh341)M6do%<9eBl-Q!{m#C-o5}yr{g8ov+C7Y|Vtf)h$HJ0%~TB zZ1u_qh;8p5E8Mld#49_W81e3O&!L$KHO*Vm*(oeVVDj2r>u#*e^xt2rE-bXT%d!6b zWww7>F6sN9QfDkm{%?cUhw9$%Z=~uT%=9x{3C9W zkaaIu`bqZ@mqfw+^XuGoBp$WUIum zf0)GiC@}{|t60_#J$riq^R0tUE;Z1Y?yarQ6)eNs5_Ql)6%6CVNfH_;{fC`bW;Ve^ z;1dh%d}`837qqRJ_n=44?UbSIBo{I%;x%g z6Dc?Bud^R~7tFG4mpJ-&k5k-TgPTn_2yL~!NK1b%zmF9|nnP55uksj1kFHF0(LdaC zfJ;eMJe@VP1AUI4+Z2vp8 zZfkPIZLz}NJW@S@$L?zp+RG#0GsM%5y9h-3h+7;C*gm`pIkF$c7dm@&qHWSgH@`Fy za@@X~iVl_uz-;{@4U&h=bF#MYKg{pG?eY29)$n!0@ckHq^=BN)!q8pb5yL2XV+R`# zOzabV_etXoz7h6k72*LGCUwapR`t7_3(eF#541yog6i z`)yoki%5Xss$XWanxfutNYN-!%0~Ta?|Gs+T+h;V zdJbHc1yHbM?C(~UB{=-PjtXc^P8Bcg{=)dd^xC)?u=@G_%74FeT+yU6WZM1^BWDeX zw~TT<18OlfSYv*BlB}DP#)l*`HkAK!Y)P3*Pe=^FVUDwkI`8S<7h|*v_oS^Cb~L#7 zYcii|RMpbYaBrgQYSLG;9CK}--(6F_Cg=*dx-;gEO8_JsI3FK$1lH_hLRtxz;vj|6 zhq7i{+Yk~8lFH~OMunLD!!6x!m{;jUiONa%qMKxIMU-ioA$u&0ByMrNLEE{J$R?-o ze*?)K4T!4k33_C93*)DQNFu6rU_(|!D<0@lrAizo>O1Zc1X5($wIH51p0Ff;BZ|1< zYW8_F?keG&IpcK086WVS38lP+)kAP-E;_A?(?Ig4PC%<3tD`0#Jm_Uq5W+NtS5YoO z{H-Dqt3N0ze9Iy{=p0HRM>yi3CU|kBE}+zR!~XCc>^meVqqZ_xzZG0u_M^?79QONK zZG6I$)5TZNJzUg|9nOr8&Hs&UYVQhew!pc%M|M~3AorMrPCFG2eU&M1Fd5QLZCeUK zlKo2UIIQmqT)|OiEFHLOz5B@zYN@^aDn1w?CKXWh!Y4g1K4hA=E1WU$yZY!Qsn9tz zAQm){{j=z|wWZP{8%W$?k*u?hAqQiH*SxjogZ~uPb*mkiZYkSUi2r$F9;h??-S)sR z#Ea&H)_>IfE|oL&oL$4~L<3|~U{ymX$)Z)&`+<@|0tjF)4aFuMC}HLpOFh1!q42Ni zclBZ-y&*e)y>lPc6DwWTFA)PbylY#9@D>$siWUh93(tLfo-_OH!aAMw6HYdneVZIr83Sw)YUH;0TxL! zn@$}04Ar;G9UQmgK$&X zC6pI*P`HVXHpTI&N8r)kl9N5=yVe`UFs~pk-i3>ky{K!d80Zm%;pBTk95T}WsZVRR z;8Hf4!vCarF}TX|%>Dv0`Ygcn@zA_b8`Qb4rsI3vFMqR)Fqw@M4#~E>DdX}t#ZcT~ zNYopHWcX1B5^eIOa3Cw{pNpWy!l5kTF4LB3{DHVvUYR-tzUp)>#3mnq$^MzeSgp+{ zS%z8-RQMXcD`;|DIf61iI?c~RdIPyB&B&=6e(_-am~xchSj{&u@*uONT~!3{g2+nD zW$Jo_d%hH>YDwaiv~YaM;Jox85y}b8tw7~|eW9;nqKK2DGBmaRFZ9dVGmDQ2bVhEO0zPTii6}sAsk0cKZrRk8nU3FQo-0;kG ziT=HKby)GX)|E=rx8Lwij8IGwd5gn#Oo-wu=wE`mWVcW1Y zwGL$yWw4sMz7v%i6y?3PR=(eYkzdp($|M^5|G7YoJST>|JxKYlgRXh|q4J+(qdy-ccRRaE5G zI9$@SCJBNA7$*Dqi8_Nfb9>fJ(Yt%qmA;!b)_{Hb+Vm}pzMx0do7TZH-eTdMx=tHs z2QbCiazDjAaD@9oGO*0@`cqda4QwlEe#?pb(kTnhpW6g}gDEr4@S=`1qa$^MwHRk8 z!V(u`Br1j0bj4vfWBhLzIa?1jSRg}>J-i5U{=PeodP69;1KREb?Hn&3^bSp9^VVNP z>2H1@|xZ0t=)`oH53h3b>PNDU#zcMY=(@l)Nqyr^e zVE#jxdVD?YSt@W69lZPUO}R;^(J`A?c2EG(D9ib>f9Xxe*?d5))dWHL51~cBF~lX!$$$}KiHs( z%kvUImj0f@dMbHj@mO54=Z8yTlE0thgXIJ5lvMgnZ(mg2-pA_sPnq2!-mf7U#R-03 zb`Q>?$c6?qp9G6kS*hJ7A8&Avt{Tz4FMEO8KfQ}mjbfjV-U1bhA08>I2AyQ(8wu+_ z+~A*2p5N%}Tl?!uX1wy+sM^}M57})Z0*QYNQdD0mVk^}o_dZ!I45zr>Co$XHj%~+Q zp;24=)`-`k$N{m{=t_=Bk65uDJjz+8-UA+H?ytv9J+dMJZ{48(*8r5VUnE{_Pg%>Q z{p#I2zVte~i+d4q(<|Eu7nSp)^mJqfINK{d(!NfMnfE`m!FOpB*W-^(x#>f@gqG}T zmh3l?3y*}{gfg~k05c}X$Af}i)y7t-)DT5V8KtnNYVolmNBK1cqT!KrIKi8)bPaaW z-Omegong)f&1iU$syu1$Pz$z4R!7#6JCDPx{w|?LZ-4)g6I9anv8m!NTR~f~6_*Y> zh1ZC7S!-0)9Q}s&B!Z%T8fjT(B`h<_BicyN-3HK3o&-x)7RB=N2(IUYg!dDp6l7 z6FUE#epS|EiKqvZ!BF-ZZ4K-poO^*als;M|(Zq4f02uOzp7Rl(mx-Z1Y7HKx>uT8b zqw>Y9(0An9Q5y8Cf9JRlfY8nHcoGh;R!GEjqT|;k+`idArwb4Bir|t&;Dlp#(kpW@ z*uH6*rid3^=wI}uo2Us`&L(R$=8HeF#wM>!8?vS=h0@ydX-)~Emg0gsPurC3D$wt6 z{Fd!H3O1?h65wgFS`87Mx8N127=uGZ~Nd8|8FDO}90Bs9UnYJ1;CdC1?s; zC$EGj&=Y8GEPSW3D`~?n)ANNG7rk^Ch|{H)%}8gZE{}vWMHF4&qLWCJ52KJMXe1=J z@CVmMa4<7SyhNLID(xukDf{z%&QSE7r{@M`e`EtI5jQE*;;8BRmlym}BtG{um<7x# zC86rp)q~}FVzEj@PpA7bC5#Q<1Ol>+?Z&kkfd0-K3i0K9kHs>NYbuUO2oQ`)@qt3D zQWl$YaTRFJS5C(QRc7YU{1w=?12%MhiK3KYeWk!~wCBkX*^oRzvE2f;J-Y3S;TGLG z!$7|C8WW8f0|AiOAGJ4{*%E(`mkk7_g)x`#4_on#D7yfpZ>RW68X~7@GXIdYNphyJ zed~*7f3Qv6{GJ$JV&L9{()9LFJl8mZq+H3HVmR^Ao<*+I8s3w8P;#V97>9O#U1fZV zMb4aJ{EyN%Scfcl4JGT5+(U$t3n_(K*eXW5ZGhd*FryeIIv-%rORAv~@(CCE*IL*D zb3MPW#1Px6v|cS-S7UMgnGs&pqk*b?jpF3|;G3$&YJU(~!GH~T#8#!Fz)U(93Y<6q z(Gv-C8*Yjh7#-}$nj&F2xd5lOG%^U=Lm~chom65(Eze{;Bs9@ix2mAYP5?9=^$KNt z2e)`kp9yiOuDDAWjzB#n;_q+*l7Fp(_J_4fc|QdPyfi`$(>xf$u7ip%0D-e>Q@9|ICnqDJ0Kp*9vE+)fQsnuJO>FtZu} z5qkSgGqe)R^GcgEYacNrh(Bltz^EPJNu;Wi12WpxBaid>fVog^2G!*oIa13JE?Pz} z1nzrY{XD#rmzZg&^E?44#H~uXlU8>mnhlB0k-Ch4I*q}ko)&=VP7dJ-C1|Q#2HUVV z(CpIy));@FpIt+&&`xglCGAJH0HU@Cu6u3lx9{Im^Vpb<46p^7!EghMASkUI#Jry} zETbl?;ENVWCqL^8AOliZ>alJtz2)MkPlA*`7s%<%@+OP7T$uowZ6ELJ1oqpbpU-I} z5|o%Fh=nF~>QQTurIPh?U15;9v^NMKhDtR**-9q8RZ5>hM?8*ML6}sl6!2 zM6#^GaFOq)l{U?b`JuTKz8Q|!qg*@CVlF9NE*SP&T@=O8O;mC``zgjv%>pA26AKFx zk;|3-^jl|IT=~w(WNuN+@#m4jRq2xqzE;O1ZjK!zF-*Qf<8HzQ*!~1-)V#4*m1F?VR03!A5gv{mn}({>O}raL=rs1tKACaNuCn40?RyS z=n0QQi_z4s&+0CEF|_XaSkPBxVplNW_y5O$+Ftt50qdBm^;)n&U!)N2H!2JySye!264<& zSYWfXuiX&D{O0d)~uNRSesSNhGiumPqJ_y9>eHY za@+;f>T;hO2BxR{`f*<%rgF5sR6+M#$RhM}t$*d6{ac!l`zx3>ubmrqXI8@`Dbb^G zw9|uIlFbV)n5#^LVs64xfM`Jrf(s=ea^eF&04c;1%Cz*VxkP!Ze_%S8A{qYS~k$zEw~EuNWa;$2z~g z&FY*SaPRZxY&0cruP-jZ%_Od0p1xr!2BGi+_gr0`w@Uw;pGUkOXn*gUy8jTEnHl~Y z<{u*qJ;(npCXfFG=0jG*|5>M>Jm?Y5%@Ob;;f4<(}@ny=|pR^%u ze=g_*8$`b5#7nEMcklXn9bS0iG~cZbJF;BP2Wv4v-PAt9F0Wme81A=w4`PT9N+%l_+I<2zYI`&|GXo;f0&(V z(Hk+}d=VmJ3CDHN$(;dgni#LoeZELG?7)npDo*?@b-ZV*lg}d~!{VBPsA6CSr)9xq zK15x2!?ekuRmZXTS5E4$fJZXbvd(Kkmo|@ho|2^)WHbhT;d#~KjWEzE(w~=&XwB`q z7pb4KAZ+Vr+(Dnrwrg2NaUP^E$aP=Sj%3-vOZYf+J2~imxlpXC96uIX%zW(BB$5za z63vepTV0xID9wLOA(KtbFy?d6HX095J1{ui^=LitVs%%$Kl5wz`l70%7PxH*J?Q-g z?E&D42VaG=_6sBjCj9{PKqVs!$BWws;8Qs_3X1@ssI9lIA%OvR?d@EwU~QXJdH_ht zQ!1Ew$iLATu9#3_%1TCyk-o0#llJ>sDi`gUya06h2^9o^WJXI*_YEh6oPAR7bkl zSv_fyribHz{@WDlC!IR!NDJemm8>=DAt#o#2m6Bq(({U8f|1lYfgs?ctbHsMFid)e zi(-h*311%oBvz352b6F=6|(cLm;u$&St-{t7ExGb)gD2wM=KrAUDD_4dfuyJK{qCp zx``|9@`1f5HVU+(T)WJAQp^N(vrfIERq`{7X7T>rPGto z^-^bF;gdKRA(QB%9G(Rw$%g+ymZ6eQ)>;z5sYR@{>cYR#mS;qdg5FKRi;dzH1(*p7 z)wQAwF4EUFp8m_UAM%NK=Lh!o%|CoD-8`knO`G9n3OhzEXQ*divphYYGm~#ndBr!j zbb2Z^>1#+46tN5frNJvm=})i%@$Ws!BPe^?dv_R)(oVG&f;>_!LXGJp!@~tZ%F`5- z5PmS3?F7jfRxLJAs)A(5R{-w2z9${Sz{}8#9Bj7`tu;X8$3l$9=_IE16^C%!yFTO` zIcUEvQ+*|*{D^X1KmG09{OlI&bb)En!oemuNJB2U?_P3E5S)D(6#*(A1!KxUw8#c=jbj$6`o#iwA_ z>#5$GLve9E&%_2#MElc1XOwhTg&TwdJ&b3!@&+xukV-dLX`be-AFZ>k04&1i@iol~ z%w-xMU~kvX8YX$D#fim3JxK(-sx#XyIq_)@xFbe~kw?PaNe7lib$s3=*vk-Wsuv#X zz`RqDHZO=So%Z)+eB*SOtFFS(OJrBW{}%kxJ0|<%$R{T{Tg5ES1JSW<>~ z6=J#2Vv+#FCTSO#F?Wr^aY+n?pp!ASC+Q&t8y*+L&FZG*gwjsQYw1a$$5o2;S0$Gd znTNrqL^C2Oo@$_l-^A7tLc-=4iJGyf(W1J;x`YDy8D*X)qdbVIidbD$#nSLr zSqvNtCEQS0Zi7N-=aoPx&uO=IV>m!&<9Oq@Dsws8rHEM1hMsevxYcwCc&p?StIR4}F*IuLIoZNwk= z#v2)3H2&yznq9_2}x<*u(n@1c}C?d;Hta)o2xz6RQzV+zrC9{X%`#Cz4w|> z#s1f2Thu}^fm(GqnXN)*H>-rYwn~_#8PJ3pvBGc>oee?I!8#y7+V>fkf_L0z!FG^@ zTa83vkK2R`vrNHYQ=qtsg7w5|AOA1nanvw76J_oPJjm~apf$UEr_VLI{1Z9)$=%C- z`5&G)oB$1zQMr4j`cdnDdaAxQ%9|&CuZ|#}iM; zY((*69&nWYik&+i?lgOQ@!$?#!#_v<8ws~bFz_i~)+iw71qBu&^+svm=0B<{zB9YB zbUy5e!rzW$K1_iW7?W&2CXH^1&$u&Ut&HqM8GGMq68jf>j7j+^=paiT?=x4I-$7^> zhha1iloDKW463IObg@3kJ=i%<@BGpIC?PJxKo82=LG+Rxk*_TZNtOK$Q5`Ema0)J|(lb!uUj z!cVNy9=2}v6ZF;F35UCUNc~anB!PHitI>PHJ-_`BJDjqd*C>9vPJ)L|p`)XW5n*CK zDxAVQ?4@&@r+PElc^sUHEorJ{&BckXZ7xb_d-L{EjZbi9ID(#s@7eG+@;0U7t4pzy z+8?NLNC9!CD8qP8sty}CQmP93!(V4{C73!GgI&nmC2E1Nm~b?7@kaSKEq+EW=Oku3 z2XD6l6Gb__O%*l0-miKXLL~eDDHAgPcbSm!|0vX#|0&d&+hPAH)SrQLR(t?r;9%CE z*|oeF2L;sJQvNB_v)-O%B$9>8m3fw#e!-#ynr|H`(vfx_3 zMliJ1(DWkgd&}pJToDw5=?dz5J-+IA7i`Rb{dYYNFEBqd?>=H{@!Gxchn)2O@WH+U zjaOtva_g6wVK~9MJ!EE%+DcutjL*T=a6aH_AiSApI*^!fOgl)e$`pIlxOIJmhWYt@ z`6wa|nUO%Ck(AkO=|wF;m3{RL+$PjO$NBtzIJC*We_S$4-9A0_Hpse~-hE9LM`tuA zy?yPT=Pk~9Q8rTa`h6{N|Dc*bYFLRx=(T0zv<7?oF2dER5ixN=f0v|JyGo!6hO^6@ zAGQ(_L`4M+z)>kWM^^>N<>X{$5Ip#7N$b`W;#g=P8~y(ks;alDr zuu0C`4CA+QBY9ZbY+byA9bzY(^%ixUqQ;M7kBH*4zG09S6QDWU~iGSP8B$zLQ|AR-Or_?8~EFhznuJw**vEa;m7y zEvi=#+;lr>>=dRie^oG|%;%%Gs212$4%c=VNUgGeDFh8ouAJdH9O5J?XsSFo1kUE* z{#hEjnV^aO&5l+a2<#e8?g1D@ zQMe*6F<6YEVTozh0AH+uDet@@K!8AR0VcuJ%fMsGZes9LEOXDP5JV_%QpAr<1RtP7SZyvXfmvT~7|snN652QzwQh0vmRS{aNnWvVF%R1X%-&7$R!jit zxEPQW|Nk)dj!mKj>au3rwr$(CZQHhO+gRPJZQH%twr$&*-goYYIT1T1&M&Ah6;WAl zWI^6R2}7|0xKoc#s-wIiU8Q%~8YEB0~N5N9N(*y1@uB zM3zZe4kb@EyV0;kSnS1VD|yM|946FakM$z{Of9T(UR$nM4X2W0!<@+bn97 z=-HgbCk;)9nQEaSOJ`Wv;qN4P3sgYDqL7d!{-os~GNAK}x2Wd~(oIhjV*&yZp~FI~ zpr0$7bP>m;>LNb9EJqbBlK>jX z;|7;)?Si~f+BN|G@RZUz-A_|pj(-I+-%PeqT{25*Gl}t2RI6EiYG$?C?_r5)h;+EEmX4#_i`)d(sECSU+O#y6Wr5oG_&&G%g;}i5&FzGkoyh&2X7f4Qj7@Bydbf+$B z&7t-G^Z-s)<9x{mQ-EzVGeNw3@OxN4*fC7rt%`OpZo zfv;@H$_Anff`(1D2s*~LQz=`M)c-1LXhi+&!dCTqR=f7`sUdH=6QHy(F=&#|!vp;- zw*whruJnr2?!QQ`nsLFFQ1ygxL4Y7s_m-DiHJmleLLO~scdN^Na*!^bdrWV`!lbm0 zeX?09d(n_$R8UtBvX!J)Hl1dZ+@%*j;%h)m3m)Gj(ft+CV{}y6GL)U@QYGMUTKq>m zSFM$fnQpYa*?jy^LW|y35*vb@xR=Gu435kTyOMHpD~GRn@{HS-ra9qo1!^zcwtV|+ z+zmj-Tgu4LtranCEhEbV)+|9o5>-#Q0y1nqm$ojxWTwg)QO_5C8(dvS!FeCWB^eiI zW*|UX-i)dodFYzE-ID!*kdO!GU<+A`={f1^^q2RAhnzv#>mIM&$R$KGT$Ui>ZQ#m?wNNDL>K-kNPkfNcmrCAvX(Ey1Fwsm z=2lL%Jb=TQ)h<6AKWVQ%v_wg)$CM{dJ`%D>$;r5U`<Mh87f-S?g3h(8a6F z!9MM3ShE$V;LPL>os^D)9u66su5N~O@B5bF@YjHPflS zN@0v^6=*TEs4x25iaCD0e}b?@M1I_wbUJfo*Mfh%JNwh`I+1OZO955@?sF`{^?x=}$lFNa9=A0dFXE$j1{XN)sqaU3Of5$C*> zG=08P$h)W-GHYX=SG35AUW1ZFPaYzy*mm3+>pxB-hSl6Qj)s=GANy--bq}T4k0c*3 z8+P%h)bkIf6w~M8sK*}QLHXPdVIf8jz2)dQ!wGQRX;NCj%N}INN^+1C6kQZy^KU|0 zEqU@#L2Ko4lo1}_;Csd>ms(o)i;&hbiV0@2(P@?V(1Qv(0=RC%ox6n3JR(3f?U!@5 zdwiCngh|lw`l@MJ@?zhvpi{qHs&HPfm8`Xv);5j{e&h z98-{~j8r*Q6$}OgwmAhU7-sn1DADTGRUtUU-wMJDf-i~@u2p|`n4ROhmFwq~@AFok zor1D3#>yi&awEn5W4Jl%7q%HsX3(-qbn^M&KUbGdEiOz33w?sn(JA9gw5H3)Do>2OnXsFkXD zyu3rkVe{5UHS@XjMVB}Ap*EPo(Pi*PRbEiy^=rbQ8{LlO@#AN(H~a>FmW_eb2q*H) z1C-7b?K@R+>PAAYLXs@#Rt?-_Ox^@F%Ys#saY`Hs^n-$WOiCiym609;Cb*(rRHu`f z_RuNo?0tPQWkXeuVq-2Qdg@5j&W)>|^AVdkf6s35 zjy&_rG7C$CkUDRoXibZRVg~w(h!XZR%VXg^@L3RAk|#=b#gN)P2>c|uel5~2H|O@4 zhY6E3xg-*uicBqVw9uGp@YA58kuliww4r-W<$HJh&hosgLF*hu=kOw+Ob7=TFoLNK zIFyI8HJGHnP=neuk9ccCC7C>v~O#pK6DU{7~WQUfUi5Y`Z$y|?2c!9bA%U>*V0%1iT?IvWlj?k*8Z_% zEFh2}MpsyO86Z+w+2!p9%cOL{FkPHg#01`GEEr@GZ21K58OM-2kN&mo%7|y9Qphg0 zHHG;{M62B1@5JC$5c{lLV4rL&g(2G-XPA4_6*X2vDZrE0@V|Y2xk9weudAOd2!h%}q+zDeesBQSp>JE?5yZF+7v}V#|ry{PcU@b+?=G7@Q8v za-$PJTH#|16Lh5s9-O?KSef1v7x*}C90skeT^y+H$1^)7HXMsP8yiafV@UKdXwO&P zd|924CU}9I79*B=!yH&53s;=|DrCkC)^9VjG!5G;ikR>vi+9|*yofe^N~nnX`wPLx zqxrDRf0dY~ml><0WW??fK?EW3O+?dvTOt>-DZV*=_D8BsZbRTJ+^0BHMek~H|2nGW zKr3uhxJ}YG(mygW#XbXFFfLl*{AKtBYfxGfjj+MJ4>hev7uaMf{XeBblxgR(N$&%r z2jUg!i4^-+_3nITQuBk7k0FRZ97S)8EzFT=&)(mNmF3Q9RRdU2AsEVosT|P=# zDNr+4Dx15~q-HXy^(}@|GXp=>EO++%eao1tX;7!G0dKQWH^#NnS5Im{P}XGr$%3hF z9X%OZh!(tsg!!<_q<7o4#~)$@(8n+XO+_E&JVODDz06m_WbpND-TWY0sy$BH{jnlINF{`h1rm_N*t<>_HGj+wD z)4Sd{UX+Yy#Yd<;mrfshv1|L9W{B@_gRK4^wcH}rN4H?wxl>Ye=f@&ADz4ph zj?7O_c^5jd?yTLedsKI?xEEHx!jAXr(M02+)_RW^gfT1rm*(%%ux|NOH*cKlgobk9 z;p(Zg%#uPkzQ%q7e^d>xC*-Sma3?stvVZPoDfqneroz$rtYk^-x*eY}lWhWR;7Rsa zGnbNr(J&Y6=|71#6^8v>Y;-1{##x(P9eDogD_HH(RXe4(WvE<9z@=fjw7~RYX3OT} z`nc&e4P=SH^Q7SSGgdwz-;K=<#d2?w@%m+L}xnN<~q+@%oa4c)Cr$ObgZ|t~kwXC8S(4 z+HeS_E}!@D2bif67ltVhh1Ob!On6odYpV6o@j(NtFcf+-ev;CC)H^L+r2`ylprlmE zB(bIgUF_B*$SWzAwL!6Us*`O80dM)0AntxQ%5d9=YlL>|xzmH?mM5j@T_NRZPY2E% zw(d80Y^SODelvVe`qy&!m#LcjPx(?Ze!-<5>D^(-$b%eO69z{iB!4jF1L@kx1HW+H zG$g(NTR#P(mMS;omiFLQZy*OKZRllh7;S6I2H3>Ii~lEJ@z%b}e-WZ=|2q$xotfqT z>tSzcjm2HH!ET*Ue*zaT^8lc`BNA*0xaIyXPz*h#$a>9nkKKePQT#$ysnk`~`n~Bs z#<3)#1__VOUL<93z9YxR#@70LGSYVb?4h@PySDwjjr@*Ynjz(Y;{AIx&fos^uRA3r z$f|Pus(w5ip1gRQ13v!K2w(Uoeusi{oh>iR#COBx=Gh}jdXT-!$phT8n)ZqDLGNHI zUx05}6+1<5qc?ubkw{?-tOJ%uDp#4$H5U-P+;NPSzewyZKX}Yzqwa{YDO<>!NOV_v zwXB+QIC+qF(>dv5N8c457v}%{dQpTLF++(!CpFC@>Y-AuDm7#sY(4g(Syb=;=GZQO z^!@Qq<<{(7ev5pBLao;(&utqpk&i zv_0ep5c6o$sYWFUDBT%}Bpt2>UFSl%56`*2?*T4-_?e6A3#qLV#- zL>@dyhr&_ujA;sqw2#{SxO^echT>H*muxQ zG3z=lNWsyJ4eE_8Uc$M$S(St+2`;63=REEyO38v*9@D}|7@rC%W3`(lveChIvZe9UWupu`Wv2 z!zz2{62}ktb!{DS#&V*^KwLr&W;v7ax?N_dM29y4x3u`_cgk@hWMl{(99?j)r_r_W zpmj91hEDnZ1*43>?8KhoN!`y3JMw;zK_=yV5k`wq<@%(@2i$PkP$pJ*!qn1tU5;6E-pHiD&h6!jAvAmrvyB_wof z3^}dSHS2+JPomW)B6Ta?w+$wqMyf2*_R)UWb|)zXmon=IhPf1Zy%oy;!v?Zw{S?-mzlx1(JVewi z+MO)ZBlW&Lu+Ev8X z!OZ1s`i;4BG2WCHP}!Fo^alyKexRQV&sU|+1{J=>^k7Jc#JorK%qCKGam88y`Kgmy zSw$YFS7(RxVYS6QC&j8Ib0&wMF;Dwmr+`#fz)X_aZ5$Wb6)2fnTyv3Y$8;)-eV9W7 z;nJ3HgiMarXxDK{N;)=`gTN~Kutc2iyAV6^PI{EEqqO~z6;I>35K^m5aWxMuiN=!D zu-94xH*9eQS&&dG@3y3W{QDZj#O3Y_B}%b59zCt7($Hwm6UmW@wx86HsgMKSn~vA) zLLIAN*(j{AbphbqBgzV;dff5Hse`e{5^k-if5=sYm}t-BeP4V=NSU_FfaWh1CvoY8 zhE`&8;3^4d9Jjp(z)AjuRmG@S>GBK*=@8+|Ta%7=o!zKkgjjC-u3do6yz8* zb08_^nT8d^YY?K3EO?gt=Sv9Pdq;9$hGo@^AUGs&Nh3*3O=%rM$T;7f2l{^wzTsw4 z5DcYDTc1TWI6kfjC0Rbqu~CC*)a=Wo>MXJp9gdsVR&*D|(wy`H6eoT9r!|EGvAKJ8 z)~2RmV?VG zw7e@LH_q5FgA}#*jQ?r*I(2A|8&OZ}{^3+>wcdlrhSU!&Os+r}?n{Kxg$K+AYEo_| zgq(SgD-Hj9@^cxuInU{2c99x&e073ItepQG10*3Id+ zJeIQj<(Ji{5_VUe1jEIXrGpuEz|<2xu&i1S({k$S87$v(u#TB16L%Xl$&W0q!s)N4R?MT}{a2jok202Hm7+Xyz|*+F`w8F(@tpiifgy-tuvWF3SeK#(e@xypZRJ~A>H+Z4fca& zvo5C8fG*z}>U=%lxy6x7ZO0lB%kgS|F zX3oyfP`nQix?YmTJc|p*p5Iv`PEC3Gf}TubP(MP7R1>nYz7r&+!Apb<%(iVxI+jIy zXhc#hVb7twu;AEV5ob_G^Uw8)0e^)IKRR++Mv}9s1B+h&X{Q)XF=4^h)Mzb~br*71 z%I?1h!0d82x(ZPiS%*<{zlRs^aO3Z5x0!AW=}=!i-_ui9Iz@VUO0(OVrG_HqL)0iT z(+fq@Yyy@bxCTeF)d+|)UevxjZH-Sz$YwG%Y-Z{1f=b+2Yp;is!2qK9rWa2C3#LxZ z{OH_5OxE*^bb}WWZ@KyVt6deOfs`eDc8EQO2+6P`ABV-{LC(pgvTP@|--KB@C(W`C z!Sg3_)L~ZG^+~ytJ>ueFuh;Zy!%I_GA8x1y*<1(8pcqf!vGB<1y9}hRdML6SAp^xw zDG770GW#_uxUy{f{gpC?rfi$SjIg{d_PiQxlFRj|;rZszyO5UP)6J|~)H(P1cY4ho z77Es3D}e7NE04Oc%itdRQgT6*M`Wlx&=_VkEg6E*)GP0J zV4^nA`mABv_y=9D`jzCRA95iodmzG9OF9LDt&5>PJ+EeM#<{e7@!1!A=T5;q1_4}7 zrZS>Ll#uC-4t+0^zjG2Z-D&u7^BJCG@Ap|RqPFMye-pj`JCmM;`G0Vbs((fA!*6hN zM)?%9%AphjgAXJF)4)#foh>7nR=b@fJm>zMP*c?;v9Rlr-vUBu!lYhfLLHj*i*ro! zA3vujt0(#~smulb-B9nr)5dSIbmeiO_mX4?Mam%Xesn zT2?-UWD54K;ZBoK)0r_7JjaFJnr}XtZ}67q3T%Nbw`8bus>@sr<@+MbmDL>cxvk$< zxo&0z^`>BN&tLy1GbV2TfeQ+q)SR9v=RY3({d>d;)JyiH^Us@W8F|MK=M)!>+k55d z*bLG4&xlD*_Eq8C&rYd+seYcduAI{Ju*ipjR{Z1?Ax&Rbf}RF0y}R^FSsX&Ekq*MK zS*WIH*UkYdUFlKGjoq29T26a*n>yh+&wlqWS`w`w3gXB@dS}aL5=O_#JGNj?*Fl5tMhV z>@n89Ss-$si6z0KHlpz|(3F7|<21EZI%ovMCT)STM>YP1_JkMOjs$sVJ$rOwj1C@z zaMk|5xpAurrDnfqu!}`;Guy3^774Rqbm3moY#TOIi`2tBEVr6K8)N$+qvVXl$9iPK zvD7d#W|UDkJg5q7ahhbra-=(hd=zBh6;DGtNRKl7tm6!|#(xd#-J@17=%^T4my7@@( z{h9@nEhd>5t-lk=DCt8|!EMQq)0XJurpRm-^=k94P6g?lSaT9aO78bqrrZ&jHN#ze z!@Sz#fieh2rm;|%r3w{NQ&QY1R&ApHSPYA-$l_4kChtKqXU+RcZBW(7XdmqIk5!wN z8m33Dqj*dvF%zv}Aa=9Ul_k}c2E1C5f9FO;tuB&If{|h#FoRmkMN<&@k1dR-5DHwA=Yx6_zReiDUUK7 zkOAiV#D8`SwRBa-j!NT>b$GBxD(Rdx{OgZ!`DQLMR?*D^SiGTi&`aCX)16>7YOz9= zOrk*dqozQROUsZc*|sgwvVhslC^j1gUzbJ>?I@v!N2MB<6b)7;s?9$$D)5#_2a_o4 zQ&y64Si!)$g1ifzn}#Gi0!a85?>uDh@?la!RSOpLWL0G{Bc+-knQQ=Fu z7Dh&}i`WpnyvUqQVa^TXZO5=9LZ(PyEF;yyRB`mm7hcW*Hvl%lnXr)X9BlXCzT500 zW9A;5%qzt#nB)nW+B?;jJeFzX!&{*`Sfe8Af|I2rlVUrzH4BoEDlZd2M#?;RHsV@)E<18k zQO=wzUnG|2G{ibm4RG4_yZU!jT_7sKgsCQ?d{13%DI}YH^G;RsRkQ-8wP1V(ewR&p zZOivIS`lJu)S)~?QSD7Dwwc7`5>a9}i^|j1+=H>o@ZzlmEN%VLY?VxrVaWgB`Lhe_ zBUtRQRP+UZxE=t67R)=(QPT#k`LxVMzK5Xj2@>ALR4a&yc{Bue5ngY{So1@nY$uaT znlih;6ch-7#Du$O5RN+d6xfY>s#+pPeyH32@}#C86G$L1)+zqjliTd11lTLz5v0u!+=AU$32aGd|r3U2TAK~ z742?fu*vf09v8fN=~@SzP};Cs1FiCmA*Xu->&^qifgUGj915@vOS;AbPz9o%_d*c@ z(+bcdCCR%RNIsPVf^qX4o?Ndriab7D&kz zhtq7UMFoZJoA~HG98jmG#Sq2q+)m)o>lh3Fx~^oKlDj~%t_zk#JraEgZuJ1Nk;*n8 z?I~i7tW})Q!+b@$>&f@X8fkZUcsHI1-d{2~1zrGk!6lwuOKy=wOxpUfb z_Ywj|MkwEVt1<}stH^5@+DO6;@$2tmDA@~=ri-96g10}2Kk;^qS7*M^K{I4gpxyA* z_Up(lKs>nZ^>UZ%&oYgQq=C?~n%Q-q5DQBDjr{jRxqVV$zM^yN&^1*pNBU-cGTM1! z?X0!_9oGp2V2^FzBn{WO_M%R5;3U#2Uf^u8T4vRc>;{dQ<+We~FlKf#iRZ}~Q%Qnz z$VtVnplNFX_dPrmwA6Qo8AuJl;st&PIH8-lnt7A$>McH~qn&iw7INnwk)8V?%`(FP zoqVwm{BBrdkaIR`dGz)lVG8Mtm)P($iEFI8nH}))ry5`byyvITb;mfTv^P#hdNH4I z?su77n^+fHzJN}&^;ab6Hd$!i-)#INi|y1mw?iMtX=i@K^Osz%P6c@pI;WjcU4eb? zaoeF^>8gmvjuo__4ZU*HcF4Eay3p?@FERPf7PYN1;O<0-m_(luP%Kak!wjGlCA$O zWuJ~+@gwqhk{*wOd`Q)Gd3_fUZ27;9>_Dv2{x_N>8~gt%YRSa;KRopRL@f{55T?FR z-vdiLl|jI8G3wAATAoe9g6*0Q|6yN}efvJps41$*&j8|USQHyZo7Bgtr+er|UrxYZB;g-?NVhFF&dOWX#15u2buIn} zWqI=Mkab=2>@{Bde^8dnj#_Qm|3O)%@zbuU8zwzqw)*Ut@SS*3 zy31RE$)x5h`7V|M6`gfknon;O%ge}#Fz3?8N+czJ_8EObvN6x+m+9~6 zlDYE!C4ZrI;pB^Ia^Pu#{Qji1t;Jy2qU%+Xf(<%6t(Mp&xEo88t&>4t@^~`GldxE3 zM1}7Q497{7BXmuX=#Q}k7@vF|>jB!GJLd)!-E15U+7xHqQ)qCbgN>6NZN@TIerJqJ zjOjMiy}wpBzKnOyFUK%~Y}0hNF{=uO95J~r&XQYxXW8;X^E}dYoWPqqS7vvI=Kd}D zeUr_lx0#t=F8g?rb3B~R8x69$fg1l%{enMr7}k*1sR?nD;$#SCeSO))o`InF9Ux&MAk&O5QNop zK|oaRQL7w?ATs$ch^KJ6o+diVLqtfB2tlVXV+cg}@w=$8O znT@hTwGL!wBUvapvJI65Y_y@hB@K|#&Ahc5k`?CFcwHJAj#axBV=gvpFBxP4YZZFz zq)bzU==4^KpMtU{gk1zNIEJ8pgf{$#1pk1#t$@E`Vc82|6WL&wQGp5d_Hhk@hLKTC zf57@D&ZE2x_Rv8qt%7MfCMjb60WM;Mzk@a~m4)|FjM#xD>|+_rV1w$8YO8ea2Jh^8 z{%vAM;fgxXLTU!6HI&X0t2=E0cbm2!TT#ng1>dVs8l3s2$ZNvrY=sS+_3bqnwy7YB zQs8mnghkn-e_})vvFYu{hiDRX5n2TyfO9m0_Yy{rK6pZUr9}B1Dn_;zTtA;!P8$wj zyNUOnDJ~qFfJnIM++N$f*{b2(2&JUcbNqup?Y!TAA=UO7$wOmN=Nx`tS7rfE|mh zM{-bVBj%b7`HD((ffA9!_*Q1U%*Nk6KHIvurP!C5vab&_87M?Q>R5JV+u!JJS11h1 zXTUfcshV>;FmL^Nk5OVB%!$LuizLK_iZ%)gVHXfDm9jdBP2T!O!#O~Z(ltVSeF-*J zeEaDC3U~5}3?tj&hq&F%rX5YixN@X{54j&TcGo z>jz(|Q_$JkL6|HqR_g$gDxqhTZtg9Tl~0}vMvkeauhTCSbFX2=A%BK^5BNZ+XXxn( zspd~vG?aRTTMgi6`k&8enW0)9yT5qnLyo@4uJ^26F5RhPO!O#vG4o7~(ouiW^U&L- zkG5#HKiKvhKiEhd_E0Lg=>1^@kg-iER;JgiIJDD|2|@b>)$-&Chfp4c!SoO-+YzTo z|A;{u2dy{#;Y34y2XbSZ*_wV%G-CkC*eekAC>%6F$`cMR-P9#~6Wg?_@M#L=9?_HV zNjJt%&ve(z;|ijV6C%P58$jaC0%NfDh zY^m68FW=#0x9&ZfPp9GLYZn69&;q)4m}2$;4`t-$mmrClfD-|wbzz`P`dx|U8kj|2 z0TZ8*@;jM>X|eYP)9>5#-+XSY_x@N`#r>H7Pvvloy?qhRL09KqNb{&(_; z>3_^?{{P6QxugGAJ)z%FNu8hN*%FI=mtWCkHp?#rkFR_Vtl- ze6Q#Fd*S+h4#5O5&vawxweAtYC~v|FF&Q4+c6{CqENyJ4LUY)sRjTUCwxOu^?{&pF zN`zg=hKtvrmz%U9<2|eA+gCYvz|71zRH+x}?{~7n^d9ZCcj1vC9qGb{2U=&AE~(>M zj?(`wYqIK;r$2i5*h73b<_vIl*`H@^Wt zz(S|Y09n!rnVt0J*MQ840Q6ae=JnAIuTC!`kE0ZPa%;mt*r7oBnDa`5oz~`LPrD(P zbw19qO(7+`&@MtWwT9MOPGOmqaU8g$A)a@fOM=weH#%DSC^__H^U@9tx{M#aDm_-d zK=eUrW1Rb2{$c011Of|JW2#4_@b|oss3u|0#CdU;DFndzcQ%AFV|I$8G-6W?BG6i$ zfFTJJWmxd_m&Vw5i!fVKYEU*NVaBouIZyRZRkA`^avaJ*po8L%?kBAzBIMqIPAX(e zMHI*`2bYa@@J31YVP{1f@7z>D)$@7v9HgL+0%sW)UogydN*}GZD1^#6C}_KkN0cx( zlzSk=2=XD+#`3;7OAV>~&;t{kENMeT!$88mPlrC_pigTi+>n_CNQiYt9as}p#gTCW z5i548eMTX!v(hF!!m zfRT-g9x`*V6HR51OoL8wwC1b^oI+Popnr^91?!mzjm&nboam8=J-{@9D$Y$(4{Hgq zDpM+AD-BwQRWtX~4n<0=g_vkb>R>_aoLB-0LD1Btu!N#mPd>7c;?pwm(Z^`fS3 z<<&d^X;8VHNuJm}5h%Be@}lM?j}n?@W4Ibdo)r)@H9wNl|e#C%a zpK#RoISpx4rH+sFv8(6pIojeR_rLUMMu zUei!S+(>3X+maggh;AAV%S3paJ!*~^?X1#Cjo&Z-1(s8(TQaV!mxorJ!ez$l&>`7L zymW*bhcw@T^!%`x70JnuRwX}fArS3npc~n>HMn#*+Xav+io+?bM~!pPt5H(;Nzd%8 zm)`oS8MsQkQIp`Ape7Bnjx8)9ZBdCj$n^mg^^0L_o))@&_4||xQ`78%_qT?^k<7;$ zrz=H{TgyvJ12bhLNa!egUEk2y$7^|7u&QGAp!wrXn@21%tt1J!{ilH0+LI3dre!fIQp?h@J-0Q3$j=OgqBP13>G_vn*J7D&RQ=Y5 z+vbZlYO4%(D0aN*XCPE0@01~opZwWN;fLMx8{MEN=ftH35&?hz zJXj14khODv0?mlx{GC)@o-lO~so`VnsfC68)V@2lRqE1fjbfUem6mjI;3n^QW!P(0 z32P`#GLcS?kg4!Nz1cF~RynLlgd)Q3=)<*0QERg*A_lX0l7;E<*(%FSHT4ZuReu+1?c8+>4Jc8V~B&YZP|;Q7M4k%?T#aWbj+< z?8VJS<7Gd4$0>nI8Fq5TiR3nNn9NLoOrI9b)wt&CYc=b69yJ~5H{~tRw)izIkdE@z zExnyDR(9dk+DxSFGbt4t>*5TLtLEAoJ`@y*e2<1F1*r}k>qXrt9S8F_`dgtcZ4;Vq zX%1)d>q!aP`qrRi9kBmSUWVbQDz)5_CJU+6wyQD6(xD)9-6GkjByrB-hmo9VO_Gyp zLYK%4_rXhCr#sQ_uje|iKotv*6~)i(gz9c&!JiABW0e+v?2ZAQmhxKkLFCF671_b)*^L21>WC@-LsMp-)*x%FGmyI(qh!qEFw-`nz_l&!r~4ai1Nc?*&PC zEd%o}+hV*4mxm2|zuHZ7-#%KndOF`}6t4!C%<-Mtfq4<W8q%JN~F3G zuP`r8Lx(ftETC~w!MiBam<%TjotTX)VFz*`V~?o|Y`L@N61QHDOK+12a&NMCq)jQj z#>y~aL5=u&cI88HM$2icu3;lxbnZyv^%XHra!GvWBH1iHNhbk#HRRjh ze*|ATj*;>oNq_ThcAl#h2Mk>sB;H7(bCnm%OFD;D2U$0j<6d;?9pQ3e`aAwOF=7v% zvBRVjYmfuQTGdieE1Ls)JuLi0T9zqz@(#+6CU{F5pKy!d(o0?DF7ycuWKV{q-PV| zevFn8A)->a;X8Lxw$we?>xPhSPJ2n-6{P;M-9UO3lceHVz`cE0qM8a|un4_+#y>7d z#T}-cN;l2p`{elQftcF9nc*aPYZaa)Oy})3`0J_9gAxT*{)YUoeLqWnr-yXyBLl*u$uP2gL6!N4j`MnK>J6HP35h%9{S77m_o=!LOE$6dB*XK#=qd1 zA=;tuVs#$=g=|I9JJZP7C|(sb`m=S)(E^S$Xjr#5=HPP$w(~nMPtvYd{SzD}?99Hv zxb0B_0WyuU>v&o&u5pw$@zm)jl#}xFG2hcb$G1L)ifw2jT5*dMH7@V%5rWxFeU2NS zT}$V0@iuID4<;Wc*z;8bnwu~(o6(EhW_Sr|m05a>GHgoHa%@4=>QuQ@9nM9fl%pxy zpc3a6X+#i$frlUecbD1MP?BK4rrT3>p0Pphs7jqR9{OrL#w#cb@&hqTJM}IE7qeLO z_v5LOqRB}J(#AqJ^eHPd`YGJ;-R#nSxphXq9m|0HKK=XFwSCmGog}g-uMtr`iSQ^f zf|!1g)&+~Ef%ODdCcDUmy-;!zTI}?kzZ@10nP}Rj5E7cmsY?<;zYPs}_lG;Nl_69< z4e{uUY-N<`M^oU3KnHcj6b9Inek`d><>O8f6Vi}o*atOX_ZeV;bK%C-BpP+e z`4@QR3z%&}V0MqS62_2c)qS)XsTQ3-?O{<0sOKUD80mbQnQ9mVPBf9Yx??N4xMrhB zG+A^y^F#FjD@2m>O(AL{11B1VGN|l!UH`URGh|X_b?sSaS&o!*=T>;fsuX~%%Q@bY zD3*i>RY5)Ja2&-cW|?jenA5Y4A4`_B$mlym2KUXd6&Kuo!9?;iEp=2tRm@Y}oU{!p z9FoFoMcL7m_uFIAZ1Ar2opi5ja$qYFY@GM~#sCU?UdYAx0Kv(o84$us9(dO#A28Jj?Nfj9{@O&qDQ^LppJ1f(WI&- zQEghv0zz}`D3m($V%2gNJ74R_ASvGfIqTfZu7Azyr7B7a#|fBQ7D=H)Tfx@ZOu*c? zU!YK?z}6SG=E!WSwlSpEB?WZbJM*K|=uuu-)anyS17ZZjmQrpv4f8++Frqe>lT$yN zuSU*|U{)c`Bas%DB`py8R=GsiF4IPgPj!|fJz9kPR`N5Ik5&gljAtok&gm2$^jygq zAE0v27n}Ah8T3Q0e^`E67^{QY!xa7wDe;38sAAw~jSSJuL>PqAPt@7PVsRNLK!9iD zSmA@DSV7cSZ<==POmtiN>ahind#;E~{N6)MF4#6X_Nv!L!#b4#0>N$Ej)4thCgWsF zzto6tDzqYMSoSRa8%Ai3q-_Y{=kWIguhe~#t67kw!joEDM!eHIVo2qAhIJaIR*dLc zpEWU#4BTM;c6)lpu{q(;labNtq-&F}+G_bCATZd7%EH~H_e)NBMax)oIj!mC4QzD} zX8Aj*u_gC)xIpA{q-;r5P1mt{NbtDqT9x)VV6Aa#)h)mhNrl?9qDZUP zxdSGgaF3Xi)V3AS)I6PNzn)(5L3>%Ddwe`pVRqDCRZcIYrwx^2ce=KL#9v`Uw~~Mt z<9TCvl4h%l#bi{jxGa0@q2|n(#iI6K_*Q&*F`5<+WOhUqvf%#Qe}vH2i$Ox4N6_De z7T<Ac*3^yD&<;{V=&H?DTTo3O1Fi~++yby(Oqd-e~wKTbu-XmVtr zlAZa1DcZkA;d)Y(=We^F_33Too zxHTFZN?An`S)X6T;mp4y8r|Ev?BSv6E&oOw@OHXb{%7QAg?~Rb|KOx`@M)y=EZl!x zGKw>TptRMOOOo4qkG$OMZ1K_UV@C7zXif*&bk|XmDO8vxAMBCW;xBUQoM2F@gcRaAe3|*_F8|}Ibb?v6#$mwLhWsLmd$sv z$8eQYdc`Fhtq$D;ObO-RVWvMNIc>iA;Hv(Xv%#$=EIjDHqT?T$v$}Pe=u?y&WN>#i_Y%bS2pW?`qT(1aLwGzH z8y#YLSC$gnqTEdCF$kfw`8i&3;tKs^NI`VWl&9TN|IwgwN3bXeRe{-t~6tJy(-Q9^4N&YZgfd$ zo!5AZsu5cq6{kyzX~)AR5vEKHmB={PNXQA<6)$g+u4V$e=VX=ZNHFhO{?6%Q$q?kO zy)eliass-ue(seL77`}+gK*=^IAjuegsE(uRw6?Aw?xqry%0ax3LMV~Iq*nF$JUk7 zC^IUct(%V6eQ%^-VrDU`PXMO-2*iKbz!cf%gnGze<+P2x$>JdR+)WY6K_eDE+J?My z@cBjJQ<50;a*SzA_L4Jr~ZDjv$n1LU6Dsvpy2bWA{?s^@Qj1B1BpGY_3=T=@9QWO_h3ec7k7 z_16FYF!qj3qCid7W!biE-m-1mwr$_CZQHhO-?DAnntGyV-k6^05B(=jtdp60FWjhB zHX)TYp@WJ)R7x+!^Dfje&+(GBWeJ}kc&$Cn^8WX?W3*ZW0SsIc+-l19%1nwJ{FFMb zafK}V0PNX<^9A{}iexOSYKg|48==y$LtRoTp;+c9{1;I;vZY#4L`AE7iW^n@(jgt; zYph+B_xGu29ombu?K#f6GDtm0Iy~AYc6881H{dLUd_MnJC(E?qSb?VYSV6Qx1Hb-K zMcqcXu^kGTF;%D>7F@D~kxJnVu7SHwsk%d2LSUv>H0a56LhlKH@8zs7`23T}XXaL$ z_s`)Kogd)Hm8%)Y*28L7l{te6k*+g8BHvp@b9sZJ$#geg>W9{xW6EO<6YDLfwkSs& zG&q=IpmpRY>9j7itPmfnczJ~k2ST8O;2?=ukc;D62!&9(`=Ire#;bwdPXdN7;FsHO zBv;^#4fF`n=#jsR={n{~oFOmn=oeP!M+aI!UOflnjVJ>UJeUcWl+ZC1E#+_riuc3}|ej;#X1K2TE9Zbmjro=Ke})l3WCA#$gqPe_A^f z_)j&dDg4N+?zkKY{KyR9@sy5fqEQ?#B%^71vs7pQ{bV<{`QX}>tU*f3Q4Ia0TuU*f zq%&`)lf;W6`1tOl|5q$9P*k)g+cQDGCeO6?ev-BcF-~NIPm(BrrP&tOquC zJGeA^k%#ekDCZopC3Y!J?VR~gbl7|@l-e~|peqb{RmPo3o~2@3=(uGGvzf^I+2Iwo zb*zEpI1wN`8;nc_vvT9a3hTa-D=3?AG0rl9W4~SIVA+z=ZGnp~Spi^~(+E%cD6jqR zo^y5!~ zAYcbfF66&TyQ8Y32;p&0OmDUPkYk;Hd2@mB*Wr^DIH%YnGNu@JCQ5r zR4x#W2?m-4^iVBN+PTh!#k^?|c2eqPylrh7q9?D;9`aH=S}v`;ZGNS^;zbHRw}3W- z_xeH`QWt@GlIUXYZ^N71xj)|6;YqPo)OgM?t3_Qp&=f)TnE9xtJ1N;BZr9EWE>K zAp5G^d#C0$hxSLxlWq#mRTiGM4>(WJ&$)@&xE1}%sSct4Y#8W7p+v> zdp1PMRghavWz0i%(wL>(YFl2SWhnY!ov}+_(#Abi2ja3-dA`+I!1u-d?v3e`o{Yul zivOguPo%>Gcvdd;d!xjrJ6kBV&nRc~6}r^mXzLeWQVOWIm#G|y#9tkJLpChpO8YJ1 zaZ~Q>nwU@gfMU{zCIOM#a?6_G)zW2Wt5jE&XZ#cBI4$3DES<&^6CY9gULGa*GT(0R z`t%+LhiVYjK5{-%K zOXd|kye(_d&Esjr!Z5RP-9&H6y;Su$rh!8>O&P0$>px`~yBI~fg0_R1p_GC;vcW8g zobH6Ar&25$u*}`j+2o+V>|q3xgz%i}m|z3AB>1JQIU#+VR5Z z0lpg5^-HGlcaH^?s)y1ZaVNw1O=YkcxA(R&hGVCF{~*0VU1$5_V8>9b!RLPM)5sy} z@%im*4j#RSr+U~?`;6X%-?4>;MDP^Bt{<62&%!Vvre{B?liAyC9Ux2$N=(BgQFMkG?;9RhMXEsbOU<0wr&>oGCZeRZ z_NjN+Z{51oVk9aa`jC|a`*4kZv!^HE(Mj4VGKm*=-J$TZKJ5WAz@022md=kh!IkYW zMU1>BQ&}Z3p{AYS5<6PTt6HNt9+I>xp@TE5en&$)!DO_gtqO!CRF9cVVoXt~=zph75Y9kgE3mcp$Lf|fVk6a8eH)sek!{@YE3I|I8}cLBCrPOO#K=h_ zXdvF$`{vYgwlx# z{uZolw43$X=<|gVB{APy8d-PP%~*c)I)3!mqz&r{@qq-wE#rB1PgfCX<{fUT2-(83 z={VP2=i#o)9Lqut)6|s##*`v1nr^~l2c&VNs5mW>I@ogwquzF|OF>_X$=`g4REjBb zC&DuG4|(1$+>=h82e1dl1+WbsT{@nAwcxo1rd=9fT4km%%4nl9VYd96VPsq`U?bIs zA!seI>CP7aw@g@OVjoHV)<<8sP##~ek)19awI(BrdC1;%d%uWiCM=t4?9T3jv#3ef z{HLYqbJcC?F%~w*jrDe^>|NNtGf)O1P6@1iI1h8U5ktFGnk%M*W*IV9){F(}ZF%NW z^8my0P&4gsON6{!F$1({HwsIAh6=IQ9C%%-MkQyJG#;}PT4<4a0@PYvMaqOzRmMP2 z#ASNS<8v32TeW`V=l-vXB>sA}4clxkc!8eOix<`~P({zw4Z;FwpwG7pxp^gNZrZo= z8~yszWY>%k(5}b|Q-xSqr9R{u<@Evb+-cA~WtEwM{287y!pi9{&I_?ybd`Rpk>||t zYs;k;TM(ZAK^822Jld;cTH7UtqR=FWVpp|xarV+DU^qsDi)H}$Ei!@|+*3PL2Q**z z2kVHp-0Rs>IQxm?s|AYzo|tTCt~OTz2VVffv+QfS#N^%y@_NXgnb3xtpo&&I&Jm7I zvJFS9v>s&y+yo9wtr!1g%9JFtEDPzZjpF8rY1P_3JDm?I8mqu6dS83wid08y-e#lw z{4Rq~yPN9wzDzu)hRryh9aXU_I-uOO+fXv70p(~^^wHh&ob_a;!B|}NUnI8S25eRt zq`hS79Dn_J%eaPqe$!&W*7*op-^SvA;|y$ zQ?KEW!Yq9}Q4x-@i-7OM?|_52bAJCFs_gD~20|RVq}2jU{Sm7L9#74MPi;AJ<1+R% z0fb6yIjC|P_a>j=`l8pkdqxz?6m7*Wx}To(9+NT2vki-(i8C$uQnL@LkC2480QEC_ zGg3aRm#V*1to8qV>*3re=mGzx%P1?DdIwmP&o}mZeKVb4Qa(u*zqC8Hu*LNeeTp3T zuzufLvhm%Y4tJKm`5IAqgGuxq28RlKYtADilTUFlEsazLQ^gm*QL0 zl=($WwbnMA8$#+c3bvK(C049dhYu~uh1MWG5Z~#U-;{K7140C9|D{8YQLNrB6oY5B z*Rsg0BT{zuSszk{YD~XJ4{Y-~?EssmSS^k8R(+I^6PI)nnTo7oCsXg#l`re*a<1_h zo@L^z@vVTB-v(OPtgKmPFN>6NMs!#w8Vy@ zP*UQBo11mHE;SjpGVwFm(*4A4lKBAjrVvV}H!hKk7Bo4JbeDFT#+{o;WeIuEFexEq z2+)3Zke$VxnBp`~-URD3AJVczO#byeAaWYst{v++WFFoO8@FpLbbR6m{s%S`WsxPh zdU;g=x|k-c6Ns_&JtbGqipXI4pUdP8#0|2Ho9BrZ_^?6@yogPgg>B_*dnWocj0T*J zzujbA(0$04M5T`Tj-*%lF17|AKpoO3oB`#x#0w(e<48B7;yb^|Hvad+=;pSR=VN_E+*01&(B~{_s1ge8t3COk6 z5$Q@{aV`%l;7aTMRC=WBTLxeLaZ(7*lCfC){@r|pACe2-ULI_O7z^b3elxWh!g-kl zhb9TJMnesp;wVj&9ZIbyCu?%mWCy17?uN`46J2rN4GYb2f5l+=z+(q41zil_Wfafz z)mRw(*t>W!O92OwR}!vQ3ONhh@jI)YTCCv6Ggw?`x=cQvuDfv} z?L^p{iKde(@+aj+I(%{5WV^S?LR~|G;|xBuSYEPDPf+bzTPf_ghm4-k?Oang8){74 zd%;VYX+F>C(A5rN9tR!mi&hEvOg!2C$5~-gnQtE60(GWVx0zaFe4y(SzrN5a8vBLV zLusQ}puKcKmm0P{6ZEv3!P@-$3R%NWq2{zApCJEFXd>TcaeOCdKNLaUj1(+tzeI&c z<&@i|X*Aa>-HQdo()EA4e$IN84*`n)Cu05Io#(SM{kJ{q)-SO>w)_{d(mItwz&Jx7V2@3YZwBCa#yf_? zKa@ZQB0~``sn_eOWnu zJ)GPQ#(M5rJ5Sy1IpNZ2$0n@#N5*3_c=LYW^&dWQQeW3r8aOI6!r8q|rT5Yydy@`) zs03>rN5&C-BH6k&M)J|Pd1GJqeylJ$JpmfYyuM@g_LS}!5ao<;{>*=Ohb>fS^kePk ziTNHQZI8ou;f8G4uTl;E@ms2MRgVb6mwD2bNR9H+zUzS6JaLRxQ>)&~&Go}gdfacE zhh~$Mo!#^?E)K|I`kFkc$(eszF-WqVAM|U;xg7gE(E~G?DkI0_`|*1H zxP5RbPvQqQ~gdfKXUrFEx3De{8bYXQQ=Iav8)@cb<0 zJ|c3f;J)-)dFz-Gi0Di1y*m;!AwBr}YP1l!B%49idNFA?rS1$l{CsvWe&5z&4_>&? zdhzzM4vSjJXkbZd;MP zHGzZhE%)Bh&#)7KNX1x(-4Cv^5CXQfh1s(AJK85rY-hzmC`>iU$8Gvfm!$0;r_`I* zZ(uhHpjAOn7;Mi>Q8Wp0)Dr+YJkg_9<%BQwVtk#tox4@tTG3OH4bH;2MvGdXJzQL!57h@0Fk)~2MNeWy(_I&?w-K~L@Sq{eVw-wCB_wy7}zU! z7rOT#NVOH_Ewfb1h{k)y-*H#Oa3i)P(%o5pK@AAvV;`Cq1nde&iCV0O2k4O=)y2^KiJxu?nk?|y zb|;(lJx$d*L`X&2ejdueuX6CSifC`^;Sq~%(0GWosJ2ADTG0X}20Vs5aMxoa!*&gc zkfb9@4DDgY?3^ZYr|B&Om-H+3pFQpF2cEMUyiaQr0SAT1rB4VR)iv?|EypxKJBmB( zFW^ysjh4hvf$)+=a$R$WAR8p9l$;~hDeYB{PjChg9Mwtk-brCoV+5~!xnK+gr`fJr^ zn;M5NdZ%KRCh-@z5ezy&14EQMtp&v2{bD=G@;y(rz6=Kwwz)YnqW|AjpeYOxX7zJn zUyl7;j^zVVcw1!D<6Ik3+GZr-!>eY0+C$C&mgV7O-U4_n`t+tP>td>0yci%95xt7n zbVo4?X2Q7i#U7gK$qKSC(3=uSVjp;s*Hq2W5j{COhb7?Le$UTP0_Qtx1=74u9UI>PBA4*tYQa)9RttK#F8y_Isb`h?Zn0B z&Ux}6tZaSJ?_6?a1n~AuRMCmI{c{qjD^iU{Bm!8Bv&7=Qxj&~Ju|&A=&HUTi8KUuF zo$flf0KHKi&qzC7#69OoiHK!`Beo$G(!Q4^nl{BGK?1_$369y*EJ#H*kVd)Eb0bkU0Z=i4qcTRV{04m=Ob=;P|!fua*X+$s4 zS}UNLz><*MHF#3Ap}_d+}2?=zjEmM@Z)((JDdm4U;CJX}--JOndn2Qy~*g zA(@UFfJEig;a}7X^j*_HvbGM|Bg*`zG1#E4IcOeTjAd-~jMv)-5i`g(li|Q~MGs`| zoI{1){RyMj_hvq+X=9pNHuu@pwOfZ3Xs@{>-nBg5$PU*rHhwG0Xoqcu#MM$cda@)= zAXr$QP9iL?$s#k=>y?1>>cr133aOO;K^QQ(nriEv<2m7+n|rh`GC6bQP0EB%#G8w* zr`{h{EVq|yH)}KO*rSMUu*zUz4RV(^EBK`OrZ%%oO4`LJKI{&4(%P3Ez@_l_NXVn8qQMH2eue5iKaU{Sr5klQ_le|sRo!Z_$HR5J3l0$>$Bv!&dT+mF47yr#XN7_Ht(Y`SifRLs+Aj-{y3un~8=1oXwhiicd) zX7QI;EFkl{rNhclyZqWS!@jt~N(ej`RrlbN>rmlyFL*`W7ZCUhEyk_GM1+j7mX*!s z8pD3RyUU1|Yp#OAyPDS=oVbL~N;(+nlYZ3sCYB!AXQMoWu9Y-Pf!E5j3pF6|ZG3B9 zhs}Haedu_vKBF|;@$CC(e&q^NW8zj2IHV9M9yE~HQbf+W&PVFaM9VHv3320rpw&h! z7SCsuOIkke%UmS0>e5+5lc9U%fR|Sz@oHD&ql@Rnp(aWdcx55Ytpib-IuO;MLFJ4b zxfLt)!d@maJGa%(-FL=1$NW3ef5#Ptgk{KjEz@v(M##7^w8)_ok~g2HHABtIQP+ z#$CL^vdkRn6*XoNe08CIyd>v@=CPxPL~ps+F{eqs*lVw=0Xy2oD@fY6I3qPB zrNRT;YJ;Ozdil9~$Zoc?r{46QPoLc#A_yU4!@qpAP3nr{+V-UjZyA+^KHR9rWZLCi z<~%^BK&sPacQLl*L8GhU%yAfb^k{X`(@rbfeu#Dvwl@Qp6gp;Y&H|V&RMGOr^Es6y zyS(X{$=$3jAvW>%GRXelMR&IC2RH>f_39}m^_Nljwk|sV713wwlTc?7A}h(|2Hp3tES^VtSj4{8R4M7yZpb?vLrO*qEXqYrFMK=KqL|Uq*ZB1b1xJ zh!=dE1Z$5i9}2r93OPPaUK>SF2gj{aHC$Ve{-x zI>U^kaWd+#_EZH~)`s2XPsIDpJMf)B!-ZP7Wwo4f({9o3!j)0HpLMvfh+$f6-u6%y zId#wRxUzqKeBC6@h5P7|A0wSys*Fe-X$~uIFFVt^_e!OGth^|3B!AQ{R2kJR{8VIp z()^ymk{xVX2bS#oWPfvfb%io^dVU?0UZ2=u{%8A*^P0Kn6qn;qZ}$%RYMQzH9b}m$Z;W4Mi?wyd}4#_kXXk}zzsMImWIh8B?VE{In9~&4;m_w4VmJY zity)DcLQtVx zn+bocYzU~F(hx}E-!^e%*uWcq1tQ3i=?T$&89cZFT?5?iaG>5dQb!eIn~exl2!4t7 z$2wh5#ckjN4k!3GMfZla_d|#RTiX&qKsHfX!pjt?o?-sY)xHe*;dGId28YxwWe_3l!>T~u0AuuwK0v1;zWleP66=^E-8V%;}oWPLkGc20_tvZFIw}V zX%NhG5RK~kIqjv+`jGlk$2~3B&bWDe%)as&uVBxkhYUKx;0YIf!5)kVp5hAO|=oT5lv{ZO(~=4M`zaj()x(3XkW#KRMUKbs0+R5%&{I7 zWIg3MQ+@-NeNuB-e|$dS9@z5;YbH-U@VJyGK*FhY>2R=n@XaOoFjk`E2wxRIdM`kKcn~Pxo6ti2zXAf01QS%bL0U$5k=r58@)MB#~ zG!=9_SOL?p&>+SP z8KhkL6URE3^!%dfqb8UCN3u5JxU&16wQ`&lj{DQp#!DT08=er=uQKqxD@py#?87%V zDz!$_hiMwmnH)Q3ve7pmuHnE!z@9KBLN$AA`>Ker{goEMS}(Qe1Sfl4JX;J;*@Ag% zu?EI*m^lsu#aGfum<`MqC2OiMPe+#bIX(S4Ts|qKZuGY~-uC z_S@5%`HzU}uk4_}t}GKNmWu0oTZ%>L7&aP0*M3P=1{=j4J~{=|0oYo%t^Jq`vOW9l zx!$xqpafFSLX^0q#nLC*@g>oEc9pz1or7)~j;Cd9Np*dEAw>F%N+4UdllG6L^ZWWy z{=TmY8Z~FxtuxS(WU)Ab{a%k=ehZXqxg0ih4A+a2J&TYMs2-qz7NJH~KJ@9PWp+8v z^pG-;CI+1;*y!jgS~a^(aHUAhFidCHOvAEZ>yu#+Zq(gsrrmRq)PQw)G09##VtQ5= zT*V@7Le;Y>g<$p;$1=f==cdUx@{9ESym1X z@_QW-29@~n_naTrjd|grT`IksPKkR<3$f?mqrAONx_EK+%C8A;9P~LZ6cGt4{X%nr z^n3=<><8g2?{&bFsN;VhEgkuP6^nm$y%#oRt057An!*CZpjS=g#5VbnrfDOism1)r4lfVq{%^0KZ?6emA6! zs{OL#5}_KDd>qN<@rlm9taQ@7)eFz-x?Ob=>aLqnsqVczSZlS!WD)O*bTRX4^kp;Ri8F_@ps5 zFBalBR-r9^F69za>)O%x@a!Z*qVkkWS>A%8L-e`&$m9U&Kqa3 z;GG}9A44cJaL%>#vj<9b3{}fkuBEu#OZ0ZvmvO6@ma+~`$w!dcyZjvb?wMc@4Q+k$ zj+EU*i#&qXalzZ_;ihC$TRmTeW3idZLk)Y}E#X;nciRA?j7MQ7){V$EZM>Qnh%cGp zcd+(c0NuuGKg1!EpX;mXYTwAMjnA$DkSbTCO6Tl>PZI}QE@De-+{4!>kK+TqmgBh+ zUN6qvM*k7^wC~+ggk&kXhO9f`kblwK>5Bo}S7Y@S_FNs@O78M)GP~&<@ra<9J z&$$ur#bM$WBx>;(i__i1>_*N8KLe!9?O_i5C+6y)O-+$3r;M?s*|;SL zPqnHVo-8?I8pk9ApQ)2i?u}CPB}Dnz^dX+IcVq6&+M{R+$JzQR{;pB&9{DJ~-s#a( zt&1loJBbg#Cch8D{oXccq^a&&v9~EV(9U(jfacllyBS5e=H>8VM8?k z6B9H2uOh(A|6O1_{o8{#)PmT3Lj4F#>y!$?>T%CLW}(E z!Am*A#2Dc(v~6x%x<6Nm-@3uQN&7h1BIxK}^=;aEV0+mWbNgy&|M@EX*vsuWsA`?M zzc#wE)qY8U#YN{~EBJ8#I+;1-mW$~8uuRilEcz1TbvVABgoq9L>7x3Xa7I>q)%%=u zZFn8Lhr$2)kaMF&R&z7A`aHnI=QDEJL5#Jj?ri#?sncSiOao^1EM`Fek=P!*_;-nz zQ9aM*5i=VF>s0^{Q4{guFwLZLi?yx&NF~lwvw@ zGOROe?`LoR5gV(+GyHL*Lw{A)`9sPB%j2};cag-Z$CKryuv_OaF!h1j#;7K#GqtcoFHNpY%SRax2r zjMbS+!Zd4TXBeq-l)cYpmuVSu$9C;{o+s?1(*;zNnj0N~oO0 z1haB^Pl!A#gg`@1XEhoh3Yg;pNhU1h=(%EEpx0{P8mSW&T~$ejMi%i!H;6%62FF9N zTkZVv%8-0oCP{Deh=hHFcZJt)0@3!QmWf@4J0bNe$>AUe2?o5*Vyi?wP3&2#NFMN7 z4*R1;_0l_&n24yTH=tq)vh{sWV+I7jsQRVpln4`nK!jv#)QF2_4JFI>F$28EEzBih1f8XM4N1~T1i$K2q) zPM2QNS;%_+{SRGd!{?h<3&y>F0)JjB2Gy>e3%V5Sc_`Uf6MKe%bq94Jp;8GysQ-0^ zZ!%mi2GC<`3!e@`$dpp-ESvN@vjP|Zg;Jz2zTY{bR1ajer_jh-CrG>&(+N-U$Y${% z=x;z@n-kkxU`p&$H>y~<-{G@ceIcY>$lU6(5BMd{`^Yyi4cr-RJ6!cJZhX}{Uyu$= zRG*8ri>a@;9ha!{!H~((+Pk^1wX52 z?tH@49O!d{wYa^?T6#-b!FhDVI*4rYf0V$m2&XtEmmg6ZrShP%Oan;owQpaPfjMo* zes+d1g(4>ut&ihw$ph@qz}oO{&3PG}uXh7<7;Q?k_dbdWC4IX9TOlRx?YWqP2{wt{ zPN#*4kEJ=RP)D8fd4;!e6-!cSs75=lh>$&>#nSerkbvrMC!5ci&zCKNjIxsElt+kz z*l7rE=ug5Wa&pidq0}81`|ztgfAgdqp1@Tg>r2oK*;z^;KH>JZwDGbYH12LiRhyff zuPTpFYKhf}38LXsIv=%5syfj`2(-|epl;!(AQ4gt;nAxb$T#OBwC&}fENqw328E)j znnM8M2B0G9(iv?jkUFeu7fpq%?cdpKdkEswC;T%-YMkZDwgH(xm7XjlF%r^`;3rZ0 z@!rSt3<}x-B|z`I5#=s=)36YND%i9Qq#*n`St>4MxoTuFM1T-M8NJtb4M@j#+wjnk zu_y|k3$h5%iXTWTn0K#@M~gD?#Cb>yl$9ixxZ&r2{#Y+ObbWo=U$>3?b63KWB?)Y~A#h@6VHJF2NAbHaz zHlt(}Wg;fI|IoxHN&5=oj1efHg~X;O71c%@5f&qP=aM~dOq)bwg1nwj%NG)vCYhJV zLYlIfl39>wyHSA`ADNuy863@NMr#AD4WId;L=ba$-npKJ--J8s>M%=mD*G|fRBAzH z%i`2~V=a^YlpJBxEM!v*;}K7_dpoAu!l~DIFJ+=`WX}36#ac#qsX}Jj*4bg^9OEQ~ zKKXKy{gF}SvgtB1VG8QEURD?;x4Hgr)$bvnB8k6PKT~&koa#;l;uD!AlyTRxR*pEuXA}XM5C-R?1F7;AyBVMPFtG93zKu9H;p_%YhR*X2W ziQk)h4*y%+%uE#22qFBT!ECrtev1uokW4o!6kD39 zb`pg&*{6{+vUd)1c1^_A{+w784duQ6dgL(F*TYrr=b9OAymO@;@%_-i)#q;EpZ zw3yR+ND6$2KX9^~mIISLi1IroN{AV8vO1zA;-yrJ+*}abr{gaAVBn5{hhJqx3{K_X z({gUJu{&V>o+D?7_mAc$C>}09XLdi}`i4$5{}ZqM@2qhQEFAxz=<@Fj^S@*rSEsbl z6z+%wm;{{?p6JF3z9xwpQ`Yw%`4o}`#+`O5MhFCLx6M*16bbtWao2k*0&qazTIu3Jj(4&4 zne1sGYA|6R`lH#H%<}M_iDkr0rZiptbHLoBy^pE-9b#tqu$Xa-yBB@rCuDsjUjNn> z|7VvT1@`0tJ3%_VrV%1Gr@5!h>(;jHtVdGwyZgW5IQpm^EE_Zq{Yi4VFZ{dH3p3I_ zC!68>U#s-=iPMRv*4&KTUXgXjre*tme8t$r$0%<+3pV!5cx-a`i)O6u>;$?bMT!!* z*BbM&g}u0jgK!jVBQu2g{qd*)hOe5&$x)RmV%$i?g0d&@fLH=o;@0>=hLA}aVsyvQ z5g!zsIBZ@T2#)cgB5yoFTQP344s7EprF6)`Ch0osL1QaqB?Yv3QNrL&5r%D2%vvF% zX<38$JTq$2!ld#9GcvUzh6Q#VUX-pF$3GrUN~@BYCT?6~lt=Zc7y&)KY$sYi>Xyfh zTvSqhzm-&L{OquP_VnvuV$5Ki*E^6FQF+-UCDTl}(0tOM2fh#pj`!}Dnn1PJ=9TX z!zSn7OePARiq65vEiuqPDB_YUZuS?WowPl@=yf99DwA0snF^0VWMhlvHf^{&Q=g~+ z&Y_v!bh0R6<-JYWsVsH{6^I&YSvO_N$hEn2#i@nY=UQ3Y_PIq~;y&dH%*Vg>8_b9b zMMx5JgQK5D*ywCtOe|GJL{MdP^AP$ zg<(#}sVWCJ4wwUcl0zrxs`EfzptT7-0ye-Ka2Jt4vgB*z3{>fxR)$Ot7cy3cN@a(z zrlZp{1FqOU;@rrwr(?`bTb|Jd`MXH=`X}AT3cKFuCtdhRk`s~c{_Cq0X`%@C zZ%iaa26o?oq>b-`-Dyq9*~hRUydhEo<*Jy>O$a{HY*}42ADeSN=o}6oZtXeZjk^;A zBqemp<$iQTgsrLi`q4wJUSjqv#-6h%i^MUqZ+OE$dkJit3{5D^piw?VYl6V$1Z^0y zXNrbS>8L(jr-LoVoBu#9v@bz?#D3(VLTud3V+$9?RX}jPOnr z?`DlVD(tot!hQeT5Q3xHc6UBFKz5 z237%#1{yKe5K1~;d`~MG(MGWQb$gHJ*_&od zrnH>j$6@m7juBS(-FgQRKxFJzKN;u7GRgfP^V&-0w+v@X<~QHGVB4IyQOC8$N>4d^ z*)gf9mJQ-Fw-A*rQ`fwqk6%s4nbZW^R3nk8C?@88GFi zOx@NzW)JO5*j5}<&CWdcH0Le-C$?V+!$FZyuq{AeSArb@o6+d*6Qrtdul*lYV3!T= zpo09?3tQx=vPYAx?&JBj;cvZ)I5V1%e0JRuWnTJO?#R>$bviC>1esx)`X(@L)d)AL z9yTS_%r>gjeFvMY)+*sy5-jzM+{#ZAY8BtsGpIQWPZGhl`e7QVo9(hA+O)rnIZO9c ztC5;`VtN%v8|l9-k2&yi9WwELfnNbBm-Wx>( z+&7$@N5I+!7u9hF2+8GD<6K#T-;8-6jY?weABGn7p?{X>3lj#Ye*PI;vHc|E(R?;c zk7=&Rwn$V9k4`@O*y1>PT#5(|_TN8IptK>eqv_esTx1UD9oJTbTSk+sXsgkOJBQy* zmx6fI(Dzo^6?SO&y1&I5Ml}~c$ftVIj*cJRyhoZ7eO~RDd%v#s$IDR63bFZ>&u#gA z5BdS(iMYi7|EY!f56k~<%Ea{FqASyylmCZWj((}d{QpHQ@LZWwhNg)-@FEIGq#H}u z=Oe?z!L>TJJQN9>hxy!}yki1=d>rm9?&u?wFfTj1!}RuFW==noAGasHYXT7rVFaNs zE^XpmmV4mkqGyY@->)l~|5h%3u|Qk9FF-7AN%2S`-MAcC*h!`fiXkC=b@D9lRBnt zQuG^qtA{kNn47bf04;Rx84CC$N>8S)sEmPYvt?hei0RyW%tc{zyQwr389zujjjWFN zC(BS{sgv0WuG1hlI<)-yn~)q4O9N7le?eLmqG+UmYP)+Z+i$RO7GPotQ=x?) zw>qETX}yx-0uv3yEgU!PoH#=l^Ij|*HFvrW%8xO94ao;fE9q+<>j^fHCL*a*w!>CxeGz++YG4 z%4aPC^biMH|86aj4v)n4S%lcQ#ZOaMoR!P5Eig@sfnz3cvfNMz-Lh@}A%@5034Rj; z1z7@e9ELdq!OEK4_#T}w;Q%TE$QxgIn*8AK(bd;1uF@r52U(l0sktJZ}7g(

HLI65thiko@&2;IUu{sM@)YPLP)OxoONNi4KW``BviN;f{t^x^sSynA>Sd~Ln zu1E`Oom_ojPaVwvd{-Y$-MyKVjAzSVNx+~5I2@%4rN+v#9=(NQue{!n?flN+m6t90 zy+SPI>4BsSeq7IS2+8j-V>hz%tDJ_~V@tK!CeCS;)w7?s)Ay7kQs#R!z!=hGH%_%cc9D|1E8I|t`cmU7qU6HoB}$nQrnbDH5Sf%-lC-7 zuMFr(>_4Y3D3$R7lZt!c7M+UuvFC++=dG8Z)iu(Z#>KTQ&47KWeo~v<^N|hy&6)BJ znboTE4M25ot2A~1ikK@wPRTWA=~%~#fV7<%>kX1D2tohYeXO*zV;t-}_EcJSD~BDB zX}w?_loa~Ol(^Kd3)Q|FxWRT)NE1GGTIm3nZbV4(fGFrWAuj-(uNJ;}RU`a?h zBLP`RuRPBjVGBAzu7eu%rtVv{l3?4S_v2#I!DjR zZWppG3n56_a~ucWY#~rfAQS0?&r{jKLSs!bIUDl@=%>mgc6MpW7p&G^6_NYZ_hJ%5mrT z&g-|WF0tf;!j2>Da8EC3E)IcREqZ3@5_4TDV;2G(I;Un zAS<``g0;Py`Jx#e+`LFse18QAL$rwv;lyrb(C4*hH&Y`qNEoOhEze+b-UT|ht=$#q zr>-wUSze!$u|{u<;M_B=)HueHQ4`tDrK&>CrP28Om3wNj)B-tCw?X&biUiV;E~0^Rr*l5p{L5Tl>FtG&`_ESRLBb1y+$BD0bd z#330Y3`qyy^;f!h9h3wwF231A z*UJ^F__o$O_JzB$yIQruDG3OOGRP98oK<0V22>@?oSow&!hcNG`~oI-E|Bdn_5a1# zJ9UTFrro-+ZO+Wtb~0nzwr$(CZQHhHY}>Y-th}}Mx7Vt@>!AL@Xyf2%y>(po6)M+F zcFrAvy2lnfG$BdTQ<6%#n4Ilq!IkL{flbF-5lGT#wIpqLlXoHR){Aa|VBP&9|C2Qm z_3JnM%@lx~_^L`}zsFI$OqKXzRS~wpNo84)xyANk_R`E?!17FeJ}P@xq)(P=M3D+* zbFygmXl&iESrhy2Uo!^U(yCLpwKR!7+9dNJRjlnB;%L#iU*^66`n;rG)n|Aov3Nd0 zR+YF};94HI0is_UAbVQe___mDJZD|5ps$Gs+mFdA;5kpu&pO`^KBda}TmMPR{de#@ zR=R(?xlpCv@uTGs|8;XA?zI>K28F6tyLWXh0TWK$d^C)8CFA8;izvbnmDuTdLKB8b zUcwV4;*rg%aCiD21L|OBaYqZIgs#%3H)?z5WqS8xeE4Shf0SH|murIaLO;BG)Lhx_ z{#T7lo=wZDDBHF4$>ao!_Lv$Jn~g$y(cYuAe!{Di8EVepUp=@NU5$Gq%bxza$+^yw zZkny`-ODD&7~s)4)?U3`_1#)y7BR33#~KIgTk)Rbqq6n*j!O>bfCj00QaO|_M@wxf zp(%@vdp8xgtaaFFztNlPm>ziHpZW>dVgAtt)quyMdXnN63)_;Xw&B_P`S2lk(tXbV zwxAZh{;{BZ{$)X7`Fy*)9N)Y@nie!>e|`_!kh1#ZdX4a%&7O}cy!#qO;!C=v@w@9e z`NBfis^X(;#MyTDnS+{+Q9auq@~jcggsfRZnPjnQ0?KKq3>)GgFmtPP_OwuwGQHdt(FB| zIXGY^5)a-{ z>PteUhy)J9np1FV9=F6g>6F&KHE3&`AbRKMgN9aj!KsBFnb5Rj?wTOx8WF+h=9x3> z*EEKtKdwp;LQMicA!Q?7N_Bw)es3iqHc;gZODgQZQm~=d5z$0kR^UffSU^#5-CX^I ztxjm{Ru=$$^*fSK2umr{YYD+R9xyF;ZyvyfmF>#4L?sK7!8x;+;EHW09bAFUZ_XBe zkmcG8BdM`&8Z3MCT{{>SS{pOA_*FY&X<9weEo?M+?)Npb`FQ@D)KeQ1j=SZ&VzWa^ zIw`h<#b_4luj*BtW}?|pcPMp!TtOr=+o#UoOgV)dS&w2Z;0_@0RC&fe63DOe`chIS zC1yBreM%J5>sp9@mDF^mN|p8KVdi%&rcjT35p-Im+JDAV8Y;sIjrnse8MZ!g1 zVu;!7-R0gbNO&OlTF%PDgp2|Lk~f9mwDGy)IO-e0am5Vr`W2<=8x{pOh3kFl^r?o6fi$<$YQ^zT zNjX?RG#WElxtP+s3n?bXNySxc@Vr!v(@0WNJkV!lZ9WK^Fo;yKH`a6-8JVF*r3oGs zB=;=lo6LK;jo9MY^X9s0%poIxuB^(ZM*RmaUplvHlQ6NZ&#N~C3XF}` zpVJ0vEq-(?{UT0e_FdQ*%q(V2XQH>gtyB!phZCq4dFKu-JcBz5%z|lF08G=-!{Q9+ zIF{8gV|O320My$AG6`Y!yJgw+YVbFb4DAI}K!3QbB~T^Yn?mh3M=0SGJm63Qv8#oc zx~_-G8Vgz;gJi}Z)cGLY>9nuy#;P>XZu$FjiG*dl>M222L%Hc9UVQlu8*&Rv0v|(W z!!4PVk2~fj$i6LV>&C)Pc3i?Iox~hdr$pM|l^}2z0YPx^Fw?z}yLT_uN8Q?d1*8j# z(1;tkR)aU>YbiZ-KeGB)S+_Nh&!D(=G#U!8xLfFm`@-J@^X{!Z(9c=rO*S_SJ_%n` zWcPe|iqU)lcQS|-(RGPJ9?-S6dqd$}h`hR~t5kW!%TSeN?*6gWxhDT6SAi65YbVXW z7@3CO^Dm#1Oye2xxv-p_m@|psO>CeRaRUd!r;j%V*iYJJexLx%XFI$|Gr4i9)8oXu zZ1^_M_SO~NS}edw|3LEGSz-(gu&p;vs!k09Hp#0u5TL>1FgQSlMsQgyd)e6qn4Ylx zbFySr`FV+nt(@UoMKj@VQv~YdHYk$=To0pn>pfZR=$0Pr=nR)3qdG>~7m+Ql1EVZxC$ zfFvS>J+n91nzYq0>IEQ)Q4|ufcS)BleMI$2VJGXAmNFOl58tP5Qxwk5$4#!Zh&F!|I1 zvz&D6NY@4d&wWVz$Qh+M8exq8pa9-If*4a3x@?-LOcZ;O1g9G;z!^&nR8%N->X~pW zU=$Gp9F-J}m=L{)$);pAQIkG$<8}mxRgpGVhuVtKIkI?Une26ry;lAq)4U~MlBsu< zHt@0k0E>|jG(imf4X8P3z@UoA5Lskw81!mPUrahg{$+lLT=9+>4F+&Z3r#9mN){JjSg`Go zl}>_rl@tZDZ-bQSBy3wpX#CE(^b*-!#Sgy4oWNu-$%+d7gu3IH>XLcDGqRnzLwe|D zvB5-EvwBsErafLfi+deu5S z+L4932#<91~|1CWrkO%vF8ZF#DL%y^x@%di2L41RVow{fU(H{g*~D{YS+Se zG`G)RxD=J4Pf8S#qfZKDwOpiEZ;)%Beigrf&KxMh4y(|6VsmW@hWv2feh5@1qHj=@ zdl#GNtVAgK8-z8q+ObXF)@B_|rM(R_Zxk`OM96crr7vIJ(VXp(QNdjfm2j5RkWqK1 zasfT1<>q)y(K*Q;UZZmY!&R3MZtHe;aEO1Hk$?lK?O&WE^r?}5xbov4k|d=`kW(J~ zatD}sDb|U%L;_vO;d>l8owd~a5Za_$Q`}>`otV+OcLYHdG%g_m*%V(14Za_mR?}3E zCMfMFGutE|Fz4|z;$tsh+fw7j52v|HkE#D4Z0Y|y zKqB+M3)>$m^#5y8{u8a5F6jG?0<22Sb^MO7U!5XpNL~Hu!ig0MuG%{}Dap|F{kW9o zTx8*YIDS5ZE7C%mwzcKD-hzmX_IBzk!&TRt$)w|CTNf5dGw4Vq5f zi}0j@Nc9ZymbB05M)UfeQv)B_+cz;ecriw${JxB7;Y&JtN=7RFYP{pB>-cN$eK zn=zc1srKD!G_oOr-fBK`E;D0UqkhEe63_cQR_6!7Sn?0xr}yk743d-*x?HA@N!!EF zoICj*g0!3P$JbE1*Tf#Xn?swHfdx(A2n&_ROJ)8Y#a z;&sRncYsPTEg-5em_}nX>m<{|?}uMO+@e6xb*MDJsv0J*T3x^$v{uhm>F{Vgshpb2 z+EE#Z%38;2j29e>v;4;_LT^y7ZdA1($>XQPXCV80**HR1u#XU$(lo5p+Qg`?1*|o@ zlLAXm8z~+PcrznDDB!k9!3|29@r^8g35~4WMb1v)>#CY==BNxW4M;Es`1JOB@@AdG z5*|Mhgs5dLn=jE*n1xXIS__rBps9^i1KJO+8M-0ik~6Qi$*z1fYL>w#(#tUR4uWS8 zZA06C3C!;C5lvlTtnzRH{wiN6J=CmC#;MvgI!J(84BiECPBCMfpU*|!rhonCT!vv`OwWuW7iQDy}-a zRkHa`cwku}B{onHuZFf`?#_V^?6yp(xv?)u@Pl5N=CM6hkfczZBM%Ko>@IbJGLg)p zI?NI0yH>dTkzegt_%b2I^&e`W~Q`ccBcx zq|uYj_=efy7hzG92PCW7-9a&IcKUVdbL!^NOH9{alv?#D&#);cLC0Odl3D*y+CLVCtws7D%tA$f#mivh^xQp&M)8vo6R*M5 z>g)}F9F9(sVlA+-q+_ibjk|-9HqHVfmTCo7ax~wv5m*sTvKz8V%dZGcH5W0o3#cYz zwF6}>d^tawV$P|iIR=eFwpQ0}^du$ha{75{O!^pV)93m~rXc_qbc1k0@Cj6-kQ%Rm z$$eqaa#?dl_ZUSxacPL|%PlE;Vwe%w5kGiupSa|uJpBA3y>V|l*K}aNqC*J@f27Er zl#$56Ygg63>`cX7=((cI&D|X-U2<&%6A#Y;7(QTtusyYee zCx>hYfM*$wXY}8%zQVQ_SmPvk>G9ML@jO9Qv%GJqC6k3{0swtPXH~x^h_52Xq5p_h zm@Ob+G5!)1iXp-Dn;?JwPBC0S6D5|#;C7%|qwh7D14ctR#Ge^{@NJZ(>EC|^yqqlM zE7tPXE&9_(`3e{xbqD+$cuoR=wcE|i=PTz8H~Fv?1_~dvf-kBYx|{BJrceUOZ0yB! zzr5*WwF>i8!h+HEOJFBR+60R%p4x(GWoG|ZCIxGGmU%$XC9E}ir8QL}?YgUnd1J`L z<)cG->2#{ypG|nCX&btPy}HI?B7ro2o+A@$%$3zYS_GI3f8uRkgQ**234bbg3S{L1 z1L>X4DlYy?kcX}{`1Xv}6vg!DED7;M5X1orr`$%)$D9Xh3RZTYw5Bj5Bw{NE!^6swXgMf(LI(5Ohr&7kfV3FtmLk&nVz z$QqGZBA=3SvLou}?J=2F7h51S$S~TLTI3T?v)h6;f2{_c75-}Pmd;$&X(YltyLBJW z3JQEtcri@vzd^piq_&_T!Q||aMqkvMr`26Hp_85T>`DpzF1&Q!X6BX{;W;FuRZ}3W zp~N@s7|y)-{<9>n^m@~)#3O!Ceoc>5024HeuWG);g*tb>`{l0 zH_MSWI~4JOZ3kR%6LyJ6jx75m#Bt$CA0%~vsjw2`U^1rHGV#^EXB5Z+MF*x&ht7Dk z@-2o_`(;zZ;5cwWYed+cqTbalMgQG2eFYYBU&wOrTQ8a9HV<3r^+nd%b3{_gezZ%f zLW`AC8oqyCBMqq{F^H`_CUmw3%m_8R!A~i~1*c$B<|xB_F1L;6XSfvyl9s)YgD6qm z5eAVYMm6spW^}g>4?s@;@twR5KNUV(R${}mqANmqfmv=|RR8IH@;Y=b zS)!`o8SofgLRGzAP>p<#*M8t%ud43Iaz}g923|lbeDX{3uYR{Nx&@E>(vn}UfMezP zP&lQAPp4#uQ$oivx^^fLv!Z3r)K52Ne!t_>ZB6fHAD{d$Fbm?xHZ#+^fZxUItTwAX zv*Kr50C)0w8}djBPZ4p+xkuK1FH^<2$*>=7gDTLd39Wu3z!bpyZpPK$wOO}bjhcNW zAa6An<@c*-^qTEXBtp}alIyaQgSW@4&- zWa4B#?jMA_+wAty?%vmIK2GBe$nazU4xR*s{OCa%U18!40DBP1keFefYW_{@hG5&x zO4*8Rsm>rw!PaU8ccT5z;(f|{Aqq^NFxvOkdH8c&oBj9a8#R-e<%Olc!>sO}(?4=B zcKz*!epg$*#eK;PZsA1kujYPM``&rks{bSlYDQ3nn1hT$+`}TvJ_Wat=6>+9)E>t& zww4!Th>!P&(+oxEblGps_{_9Eorr}o$=&AQY1|sPDawGNPyVDi|e33DHJ&~v%ImmId;yPDQE7|?LYV3r1&f8>)AFj%y_JZ+~T5AlH zHXWT8lY*Z=MZJ&Y{^rz_R6PJ;6H^WJ9S&}fUIryy3X^1mnsKItDD#9_rs(XMH5p;ux69KG?Pl5J!K_~vo zdRpxXgo(Py!{fhkEVz$Ah!kf&L))VtK&hb#cpXihi_&g47X4(yox8!WNGFZoOu|$? zAq5?-yIkhnNV>33r@uUKLlz6k2U=AMa6AU-Be!HWs5hv;)rz^* z6?*a;MgJ{?d`6Qfl40;T0>hOBT9k*QW_l0W)5uyq@Nkub z8K&uNbz|+tNT70gbHm#Z=N-kk2YJVTzP8Yg7~J@o98=3ltb$~?ecKe-^WZiYfga* zWDwnp^%hNsYr)LLF~Icbp3k6LW#1|ZB*mwA1fYCJr1_o-xw0r^zc82*`()?A;!My| zky0Mks7K}1&BGja+4|&YJ-b@Wc1hr*P$`dSGTIsWxSp_RMnAFtt{dliD0~&#uT1G_ zLJL$UYEcTczUI#npp6Rz@?Srglzxkqi_dFVNS=lIjZr5$60a!v8)(f~=|~#dJqihB z;$qha#Ci~Vu>~G4ceW%^4BM`MjQ|a$4?Rf%XWG*lI}gpd-R&&<%f5t(oB>CG`e(=Q z7iC_}^bk~c29Tb%qqQvH@)Dff!!a)(r8#K%99y2T54$ZWpQ^8jd2QN%; zK)%??HXAHILn#*z%Hi3^X2SJkD2sDRk1cn~cg%{pa#bxDKS)2a(@ytn8#NWi<&}iZ zbH2{f+a()=mPyVh95bB?xwA{Bk)iGc%4uVC1X_q<^oa~0E0q5!EHD?O!QkdCKC9aQ znqps#fI>~1XBX73i9PG(1S1VQMpxLWH6;u5>r-6MFC!BL6oAA&c@aaoK|e2s;b1Xect1i*;53k*0Z{o*giT*)2j34 zZ!PF>&SDQnyWkq{S7=}!rafv!WF&Fflxhy`C9DPc)Uv>p-%)4Cv#Rt@vqX2Zi_|cW zZXgSzC+x0G6N8fG?We~e`#UdjYfVv?&mdLG21UbW*@(hckxw9rl;`a02ToMmYl|_^ z?To1S$xm1$SN|m2_zA-pwzzg$x5c!MfAVO2E-Z*B8TKH1xp7TC`mv|NN)$bBWAA-i zcHh$aNux+XDohU;GWKz@NbNfs!$0=j!v%0Ckc-r<#=&)#Kd1un`?6n36$Fu&Wl(sg z2AP*5l?Ft~31miidDsOa_fL}~09V>NKH$Q{We5_l4nC$i)xNhXLYEX~*|jrSn!~qB zDN?zUMmy1=w|k3C8|iTl(88H9s28lB>*x{!#kw0g2x;Tn=R0!E5R#(?-g|O!eK&Cj z&#w8(OZ!tZP1Ke>PEP}WE#HDb8BItbFEyt&shukQBbWVpVmc^O5^5)+lDUP#ET4i) zD;nH;{zufyZRR7Dk`+twiP>T94_I?1XtzUT`ZT zgr%}UY1?75OMF9H>2I~p6cHS(?IRkp*~?i+OQM3eY_y2?u|OMS3U;hi^_ma)D=R|) zu=N>~*V%QZpgJ1gDSWA2Mkzq#whh9etOM)OPbztIHvuJU8(B1x;)&SdEMss_3l?ls zOxV*%HhnCy#98mRRaowWleu~2=7>^pr6GY|ealQ(YRw&LRctyWvuSqJwHZ+C4t{NX zI^+u72Tev!K4Mmi&e%+uMJ67=wF{xB3bHuF?CnJu-u)kUQeALKxkMp|t#=cvY0=qF zV`-)ki>IP8<95{Vx32xm%DJ^8S_|r7-zr*6`?O5;0bW;>}V{ z+ooDTYSP8)n1Pm!tOJSS3aL_(Q1)w}zxk?V95Z1B@v@Ytho=Tq(_?bBf>cCC7LXw4 zN1K+{nkx1d;K(P~gT##=h?<)fz=={@Jy;Z?HD5okE3Y3TFni^J*$?yoKr`bbAL_jh zMXlwPIdRkQI;8^h^f2hN&~@LFe5wHUt?7+g*eJVfwWnTWL>Hu^(H_n2Ha+fUAWsa< zCNTF}YFUMFEb8Ob4eT5Cx%w_E4@fzFG57B0j26o(6cN$AgEe{iDx_&7ds&abS^9Tn zpR{E^_1YwLLaUtsYgq8gkG>XjkgPdBtlM1-s?eZ8!+ z)!ME(rOw--R;}#Ca;uaH8shx8LcIT8ydQfnMuFKg*td&wGSFVQ%;xQ9!Ug>q>|k}# zE&Ci_G8`nBjlDyELu01qwIm8G)t=0?{8GF%XPe1VVwMp;pUW)D8BcIpa`~i0J$m}{ z2D7G3wP}~a;==ZHf76+PUN}IdN@OycAZ|e|Lly1S_cs(eqp>}&KMSxQK23*}?M(i2 z0LB2v`HF2Oj-A!d#ox<4(!5mkYBlcX2kedVIHRpT zPvSI2?puEGuwg~O9#lAXBsh9b@xl{T!hl#3kI7c6myS#;G?m$CBD6_2y>oDI6Wfcc z4RyLIClBj0OpI}V)XneKx0NuD%tBoxL5I6|Gg=bL-QW81a70jsmGdkNOpeavb{nGr z&$=wx+7p=(=gRBjP1!GYV@xJftNg0^b=@Lrq~=z9f7?r74&tR^C5Kp%rWhFHgf%Pw zV1at4C0wdCGM{O3IagyxD$kGu`;7~ebO*7a)cQmFIMW45L~{Zvlm>Yn5L-K;*=070 zqDBUQzo6BT#9rm0f!3=7RRB5b0b~h6<7e>QoW$u55R#zS!I{~YN3 zQ*E|Z3$U|>4M_fJN~`WsOmz`dkwF-tW@g_br`ykjabHO@&ZX7uMB`LeC4fTNDlL77>aV$1K_LtsKyP0s*fValVG!Uf1zjj}IjGg8d3*-0 zWkJ~0uHS)%8YQT?8zv}jF7R{*%VX1oJ1KFIuDR!-Z>=3}iHEoDinJ~W*{u4GHO5fP zRtp1s9)6S!Zi=*_S&#+`Zefjt`C@6B-jQkHNl2bJLLql!N_;NNo#<-{Ff9|vM%TX5 z1?4A(NOE&6{9+k;PMIqEk$>aY7W-jEB2yZ?kaEShLE>>ARjHM|n{ zL_A9bI|*csIFzWWwH>wSfnw&k_NdOUY*CS~I7D`<*1(QS&_%ik7&%5%K7FFwv}GC6 z!5zD;R-rCJWH+7}1!(YflPgj4Dw=^jJEQD*X-4TpEU$Dkq7}&yUjrVH&wGGCmqpkC;CFjGyw)VVKI06r9LnydVO19fruwXbv;^>RQPIHRG z$Iv;4Exc=PzKQ=e(NaggW`?)%U`>M4f2Yn`nNEx)H6D04cs_^J0o=-_wZymq8_>W@ zzg;mDEXR7#9n+3nRYIibY~Am&M%}P3hlhYZe4;qIruVzN%oTqCcaOyv?s!9bxX#ga=Dy~@Hj}M&ps5=yyq&f$*(S=Xm;GD-AgWTQG?$y!>Bsti3@Es3_6kE zzq24-r@^ZWV5mSBWbm2)D{5M~yp0=U#!u17qK zH!&0Tj?elQdI>@DH8(-nAAPr6>Vm+;ksdxvUVO$bv%ArZtSYVBh3*4^Fw=Ofr$59v zzdev7l_}7eU47LWkjnyWbPi4|vzlgKl#}f_PUFWGu=KE=vzggQO}{?}V0Y|aPY|nZ z{w?6sn5e(KDnj#cC95EZO>lLXJvwm9oFs zd(4QrkPEs@+DHn3RDKiw*2sv*Qm`I-K+Xx&(SZN%%j_j}h@7ZUpw=2(oDU~r3J8N# zbFwMY!98X%NuB#lS-dv+!E^go$E;mxH>|(uIts$>d;TSo!{hv=l+~;+Ed;*ls%F)@ zUa|KZhxH7oPcn3o`gkgi-90$g9!#aXw4w3FLoCVmWSTGq1N-(wB?U#Lh@G;{+f`>U z``w42eP)YZk68%axrq9=phM$k{SF#01QGyXYZwThb@zxU)1P2(U^$gfK`MO^%PYqx zJa$8`=FXYpb@etJiUgCk=%7SJsD-iOc+pk`#5}(IBWtO8DZC7R<1sRG$oMg`FdEK{ zS9!6Hv~#i=Rdts;z7qxGbYrJJo`vi8*|O!v_DeqS+9=SrUXi8)a1qchD?;`2 z2}N_Wl&wp>?(X)8kYT;*LUyk-T?0Pcap*vU|mfFWRTBrtg zwZ4F?Go7{4^ zDd8H%t!)O9wmca$Z&q4GAkD(an{ipik0jfn$?!PXMRT^ATuD}oQIx?>u&+8Qv?%d^ z2pLNHMMPvXwk;@B+>uAG^=qcQlXiEuGIq96o8E9;<6STvo=wL~YM&g(XRr%5r9ml2 z$B0*2&DA5;kYnmzB}+EIO_2b$zq{#+*kSiT69a*}BdH5$Zf?tvNP8YAT6W>$u23PK z$-oz1-MBM-LFtl3!)UkDb=>A-z+?H(<+v7uU?ob1G@ z%a=*}p2)~sUwuoXVpG4DY$S}^&UdDpgP(?Lz5vNjxFi3QO#1I8E6mLQHd$HJ_&;fI z(TUYh8ce{;!0VjwKr@nmQQt61Wz6#WDGM*2NTt$Ieh!AL`Lbs8b9_2JBqY)O#R&m8 z#77_FkWPJ=gq5nNH!5f6W%=skUsGH9fSn0D(%@;UR)_%W|i+sTgC)qu1ZG8$ega&h|@Ev{RJ zILGc1CMu&h)6+e0>U|GUP$aCAnQc(daVFFf6xNhD5`U%%8h`e-dD%A~=e>y;6E``P zC2@8ypX0ezM#l1|&;R&;Jl7t2EOevI?Zcdp;6MJ~Digm4 z@v3Pt8@l`$o#bJE!yf?ydFgb^nm9`XL2w$DY^MF>iEI0&(rQawIqLNLKUF#~nSHet zb{2h&OO6|-(u{QzYI2`=?lv~THkv=8Nznn(-4LvJMjRu|S1du2lKrC@PJ^?k`c4wE zy=7pi_d|*x8c#AL;vLM`ao7R#-ffl1WZyKx)Gql^V3oqj0@{74$ubw)ap2$wT+MJc z>dIwTcX#3A@W6xp0sHALex|j10UI2Wl3y$qGiptc>MM32ZFIS!NYJ^(4;+WP-i#Ll z=TB>6;NKC6tNoj;*|HpSU`_!wo5XajI8xUa9JU_>`DuQ4afFXJS!{nU5)FVLnqEj3 zn&G)<2IMW-f3TgOjzI$vCZM!4v^`mFKXkyQCAV*8vRRJq?=={Na8Qw*`Cy-w6o6TQ zvw#aj7jp<)r{U&m?!G*zf!qud6@p}Tk{kr>t}+aMcdb$aC@=(|2x(VtS+dQbai6tN z{jOH4#xcXZ!3Ud6RDS_8698V1wxX+jMoqfUjGT^Rq*Om@=f>pf3wKT<`%?E_7SloW zB-0dUdK^{Gh$7a(?Y^VS2J|OB z7uJNdZF~?#U~|+=;a?_x9EveL)QY7jM6$KwL1`@U+kHld=x7kdmwkgCRnPk>dyNa0 z^3@>bY*F%m5KEf$;7-h>2&~W5@)z_%gBgu1!c(mu#Y_>P1fM*i;*o#4=7GS!kc{^9 z4}>>c>liadL_u**_}7!pF(>rE4Adr^0yUstwm^&15IAduSJYYbb!?m-Js_Wj2W|j`&~wYc^^EY6>4-gl`Uq| zB@9GhahQIBnkF-;enjDm38VXrDKO+4E7Fh{2&9v^TU>*gOelZnS$Eiz7sWyzml zTJA7#1IM>&D6f%8CEUlZj1@nH6j%HJzCW7Ik3y?30BPn7@c<30x3#4u#$uW~=}3s= zGKUM3T?l^_w%{k6Y|^K>7M5n0uN&PWP4Z!X=QsNKZS*nc7i6aZ%eCn)FjW(&9}GS5 zx|+l6$@1*c0-t2PpVWXF-L`uAMaL^?FK+nNG*5zPW z9{)D{3p2A#Zx)l@6k41g@>SKiSM*oDDCXO}=t9z%s?dtI6O*R{ zK6&CFdAF>|3s*-a@5=$Qu|^pr35GS=)WSBpRbRtVpfypkct0CPN5_i685s{$q=&V` zgou_K02r)P7Efx&nwT3ssi<>Wb`luAMZAL+lW}a*MV%vA8MNprG*AMkAt1b6VeNP%oijnLvk@et=5EwK`CqY7E&h9W>_R1GM7#c36pqz8 z`!nzofo@J$_yZ&fZIn>i6&$QWlkv_*s8Z_vQ;rn-~j;7u3-r%ka?B zCNH80r7clogX)DIN+3g9*8<_?ZNYCdn?aR%{!EjJ9(b|L^c3-^1J|a`I`N2t6&L`E zu8@zTkqsyMIN>~c5rC<&Ezilz=Gx>eE1)F(jkgFl0a!ix;iJy!Y8^7P5>Q^UJaw*` z0WSKaaWHv@|1QS;}9vZS>zXciAp2~ z%e?GTTI$J33$+(jkJS(j?*e&&2K(G5g4%x;etJYl@W_aidFGM)XC4!LL77eTR~jO6 z`{5Hci$RqhS|(Q==6Nde+nqiA{cw(3-**K@F-?0Xj z9-`nOQcbbUHnsDU)djipUd~A>LSlwnWd&M_HD?xv$O6D(n}uc4z~q79lPnPIOB$FE zV7ksNPa;mr2h!{SojTHQg8jsk_nr;NF48B>>gzBcZ?wC;t(WnA*L2{IQ z69{6{0`A~x!K2U=97IN#8{yjEex&g`e7(YdgTCp5+W#jF`QJ@t z7+Bf*VK)Tg`U4NzBoTyuY*=SKaWF>o}On~bpM{T-zUggqE(;$kek3) zD&mY90-nSfOpFtQ5*cU|USDV=MrMyvT-MEHcvHmZ6yKUPVfwtV=9C2pTfn{jPKhSBb zYQaP_vwng$RX61=(4=KyBQK$Xh6M%E_`g~P=axKtQxrQZZ3~)kK4TgTjRC!r=b?C2i*E27o86a;)-9tZp-QrvcgI zG--|8X6c<7aV+A-QIbxrnmhitC}aK-nye`_`)U3il-l~(Fcu&Q`B;m;qSB+VEkWs% z7^yE6uNzver`Mi-Ef|v}l}2S`N6Il`wWSII_^vK<-w_q+Etw<5+isLnvO4?OgIyo; zDX#f>Z_D~U0)crX$ZD5$hHU@l|FyN{S=Ll(JH0D^v;KIsyJ95(sQ?5XcvQQR?>@_v z#i>%RHG9*7>YGc4ilBlZJ9zbIVh@)hB}G=w+5v?k@5?)gO*KH#2``>%6n9-_bK&elW_S@{m? zG)&Y!s^cI$Yap8qR(W}rmPo}i#8Whc6*0EI`8r35pT-0?*;(5=d;#ezp{=lS=f@L7q2kWf#s*c^FDLC_H_G(yy6-PNoI|2K zaNTE8_UQ>WE;UFC!~{qN=K1UMMlK;~Vp%D0%?5)K?4;-Vv*Tkh={0tZ;$Zuwn4_h7 z9q2g!tD~nRsux5s7l3fEO-9}R{2fk;1jZFy7OCF~0Ef!n@VsZHxpeCj0X$GzT%GWU zRDQLU2jzJE{DZCPBmSP^Kv{FB{PSJSTx%pssxI0(pjH*+U+nGaMZZ-wXS+y_N7;$~ z)}eJlcvoKVJypA%aV`49Pz(~ANnb@IGoV=$3U9)Ikg2P56u|Ml-A|wm-)52)#iM+Hu!s78lm918K`axZ$ChWNt z&IG%axML8moZ-W>aVj8OX6iq`LEJC(&=J%y5nb)YU)G7)Z~isZMW0UY!p*Sj$NMUJ z^)pFJui&T;Sph+#aBCXO&cu!0&UXM$_7=T&=4z_Hrf}Nj@-N2n6Q?f}@oWNl>aIcu zG{B{0zS2$*oZTPMt7eQ5`M4_FL+<&DVElUsUG#+}>OqO$?8F%@^a$ezgtMA-LIv6% z66j5~n65y&QWVAl*94giMvjO*l21(@r>BlUCy!R&0bPgfan@xiu4MGKyXRgOY;NT< zLJ`hMNgyRf%%Y`!7A4ldP^nxSA2}lSR^+72oPNe~k0In>52YDm{!BV} zxs^9Juueu?jiB5clj34uv{YShF|~V%BOcQ9(&SC4=()cik!9FAbDK27#IabdS$xNB zJirUwT3-eJp36DO=aHlChMR$K?vT~g@jUA=EXv0dh~S6xyNl_b@t#grp<#Z z&=Sb5F>Sz|`i`!#=a;XWXufI%ltyEqK-;Z$jIiLCL?F-Xmz2~o^30S-)^;%>r-|wt znV*Z}@TmC~y2jLrySv8)|5;vA*4ribJ3J*gF=&e8E^ogn3vVU&rgB|Q&7coXODAm+{m#wmoU_mpzV8g2cK`u zBp?LsN}FAJ2ES(BxNWWg9*@iv{BwE$7&HeS<#(_49wbgS>Bb38pVBe3j!(5N+r$K3 z7Nu#`7Q4!fy7!)@pE{RMwJ&V@hXu1UR52VJep#`#s7-`loBTP4>5glv>n(AlERL59 zi?{h__i}Fd0kdqs3=R=MrK=tHA4%1FOzU1<^X`R4S#AR36lB~WW2Dq6&&SxXG8y_h zuGL6ek!&NW*X*-~xOYBT~^o5ob8CJBVInP)=neN{i)_opkISr>vjPTv}W_y;ICS$A7Y~T{ETp8KL$)WcF zZLnbuj4eHzti%>jJuOJ((}e9S2a&%>Jh}P#hr7J>tc`|yID>UcwqoFsdjdzEW(O0j ze;b{$>yQ-&MG!jPU*-?CL8gZ!Aw0v|GXRg;>(yCBW&o}f9F;vW4#W?lNWBTL=7n9w zI}y9=(j_V!_p9o^ahVX|#abkBBJu3At3t`(nKco2%}IXMt=>tuGt1{rAU zqjfk)KVffDKYbM@eq#DEF0YIK3ZT_E9E+Xl8rwuJM|APQT0nBKK}@lKhVRbCaYXHj zpT*B3TB$sTf2?ll?)Vf*Athzs&;Pn&;Nf_AsHgP#xcc@6WSIO9Vu|s;Gu&9&|E+CT z^?%JT4o^M-u$my~{vq34{TObVM$EY909J9*(C-8%m!i$;6jX2Atn_->6}>auv8Srqmr ztH8M?p67G`%=hb4%&3~IPGhd-($B!@W2te8XfX!0nsgIA%FE}?xlQKr>z!#m^W#Be zy@ZYOr)+n?pXycr@!2!qQ>+tRFp;PA{o(fV))iT0a-D_qQGA){h%&I8Z0BEq8N@Dh zVl#>3MWBUYV4KFWZzClT#~PBP5|td3?~`c4)Zi#>NfCLMF)yA0e3@82G95*3_pp`&pO&Greg0V?m3iY?W$74T-ua z^j0rgq_P<4g1--ITKOp3E1S`emp;_KMA)yGThcYSnN_}5A4t|3%) zl@&hrck^7CuG}Bk&0!)x3sUQ0w?H}zUTTV!COYgKF*|Xinb4kXUC-75&@qu9YOg%G z%tO06pp;x{7u30a)-aTpm%p<1VK8)4bn?1^@?eI{kRYD@xKFc!2#y`=f2!-t$1+#^ z_B{gCU~D|oFOIs{)^*(b}+r#S?1(TX{BUQ1I%8Sd;2X0JH zI4Df$T$~X#-Vt%ZENETeoq%ZQc=@1L>2o*I8Y4P#SI8HepBxmN_34$pd9&L{OnKbt z-ot`LoWkduZjUPSss@;t*t8(5!KORwIW>!FsBH&RGffKa59V+HGt4S5ixGGnW(Ir& zXT1pZPbW`SeWCq@ir8H_L4iZ7NNsjAa=L5gpU6QLNv7#LC?Phx2{IIFJ7)@vVO{Uk;R0$!C8=2--E7UUDqy8=#-;IzhjIE! zLOtz_XO)}=@}{yH7*N+Ns(1T;F*-imPIz|=kDHi=f&KAkb!|r6Xk!I>Keq^(ZDn8G zkSU08V0ya`nSEs!=@5YmQ|FO%A#5b)ywS4eFj*i=%67yLK`;w@fz*{9xC0V9)R(`4 z#Qp^O2K(Bg#@4Liy6k})wg!VRwf~bjiHlQsx{SLGJlMCs`(#|qV*?=-5Y#oLDT)NX zj@VRjELh*rq$3x2QmW{i)dkxYkLlyW2HTscJF=ZcHu3rXeK$kPYm^% z_Hwp_85U%;j57Fr8A;nlPJHV$dvBPnZ)NKDjUZ>o0+7MIcnST{ zMO4K!nGj8zq@+Jax?D??TqsegisIH^lJ;zfo%zZrgx@|?zO#)< z_ijD;7IbAl_q<2n{R~x~d^RLg_om2rmP>YcgqzGh_DFd^Qix6;r(X6!c+?S?qDOjL2oFfX{V{J~&(^yMXfC%IR4&+xS%%YL9|2DA6#1V47!%hWwZDez|GiLeU|=*vY!SIh5pxDO>vilX;` zudv!8Ii)>XTxQ9iXbFzz3pSUL{ob8$%L0BOp?H?PeT#+ z*#&=rNQ~J!|B|@O0+vhaBl~PI3&B?(3ZECEm3cIdOKT9rWSHnfBEqDXJK7eu^Nzxe zPUvYJod_Q-nqwiWq&W{r<>QkWsc(p>VUR918c1$>ZSmDAmtkOSj#3L3LkQ0cL{h8* ze6qs;>eF-Ezj#tx(HcuK;biL(d&XYa5{w_$<<7sk9>K&!fdrbns08h1-tG$y#sW35 zM8Fx-jT{m*-W7o?roe&qj_rR}Q_)?mC>Ob2TpJ2q!{=!5t87>fE}#x(%5&ki$Zewy z-^F!b@S8w3kzj)OU&0u(w)O#aE#}Xz+Dp&@;7vUXsBaQkV3k78?p!jSGzRC4q?yC3 zGOf06uo>`5rqK5`a!VHE& z!wk{~j!+#3DN3w}1d7onYpxY&5AS^+sb;klpODEtgu_b+h^!1ay9HUqq6e!<>K)go z2*hx!a)C1_d?FA=p~y7T0f!H4^#4RG(N>q>-OxQap3{WHUX+UQ9nv6p4taaFQJAAF zGYYD)XTwbfY;HFLDL^3#gWBDGr~KK;;?QUG9dZY}Xg}@cJlV}o0}t%|(tk!JbC|#j zSb0;Y;e?9P@)Suh6&90pqBFd~?0=1fzSe%VMI=0|)zBK1oTDAxj;asJ?rCILosSeQ z-xDKloqNfixKEptz@aMJ^A*Pps8M3fqr+t&x|}> zdYUc~|CH^}6$(D4PNH<*tCYFin54bhr|aHJ0`DDAZTvM>czo4Q(MIb~sVt|R%CO;M zn_X*ovh`=fDhkP){s3#$vO1N4CB;>N+tTZ5ug<`aO17fyVGu+hZrCG|w*-+L)Vv$J zRRxrz3Z`&F1;Q;dS5o_r*%!zxM(@k_mPa8C+8l1mO>qW4Wq0}h*@Olb=I*``9;(o> zCzE=vW%Vi%rItVz$bu(~+C8@H3}|%FcD-mI23lU`p*eHjfzl!+aMkZ``GIFYB`d7z!pXWAn#cj@=y%H_(DS!Dm+OZvv>lk>Q zn|s>U2r`YI|9CUqQ{XsR@;f1V1y{tMCpd(#nJyRE?X8cJrv0HTOANUbt_o{Eu>3*I z{pTb>KANgGP@O-GA51|2a^%{8u|g=s^Yn{gII0 z8lQ`-5xT*=yu|t-r2F4(r#R|3p@>DtEewnXCW{2hrAI}i+q(}UQrOSX(a}+rS!3SH ze=REB+W&lvJ}%ChB4&Hs3_sS(+5O)rA70!~my=8HZj=9qZTrUKbg-BM686m|w%+(% z*CqYYGieG;Z*c$j$-gignK*+_s8v^_cb=K%{U;o~S`SZk@uPNJTHsm4v}HCNi$00C z`)L~P@)u@qS*?X8oe&FqwuEQ#$RR$P2OSX!S+A`{pEQfSO`O}Fg8g2+pX?@}XAaOQ zk(rFFyWd)Wh@!*pp5~$tg2N3Tuk3O1ZLgg4+q$$LDhJ2N{_QTQ4GmM{K<^LVm)HA~ z=7k|*patx^Kr!49!|kasH(D%Kv%S&2q5w8-OW`$;96nPwWeu8s4D>9MHqdv^pw7TC zVbr7Ho=3n(&}CTY^uwL&vVrS2Rcyv#cAKgW(X^IN2b~1WbmnA{*><~RFUB9`n8c-AB(_7ZWKjIvGK{pMtNS=cM8SaF61N5#RAi&%jhyZ-MmZyy7Ojef__?1dar%NSXB^f+NX}AnJB% z;)o8=2$+9oLJcwds|Ky>&w=?I;){$H+>#EHSop40GQ@7OyK6{li<5Xvw&>Htz|4JI z+vc+BD|6dclwMnXfx7~fLFkYvs883jTZ*p=IktcFTacaG<}ab=h^zHDt1)2a(0_iOh_25$lL_8&!%n zJ}46XC=UWd;-2N*t2!b5y$Bxm(VPZzGDhORkpib!SLHRmJcTtTwIkN;-%nBxr+5U| z5T?<8|Lw`x_j@BDPE@i|V&jyUG(uB}yOY=;W+#u|CCBllww=%ypG;@O_In6f+{5Iq zCYH7BSerWi3yx?Nz{uU=3d(8KO3T$K$gDoBq{U~n6M6V)^ZjA;J(htY4e-FX9;D`0 zhx7_K8z)(ml=ZV-+;LiF+ZPj@YT=K}#aK0mH%t(i`tyVLrrY|(?U2cIYF$FZps9zr z8m_H%5`7a6{ALUwlEa{Iel!`_8Quea9rm6Z2?R~}vCsaDqAz;Y)W`3vbpl}OfYVT_ zUlqC6YJ(jTjslQDBXg!&)H_Z)N%*rA_gWcxiXx=1Kkn+*0XPtY{yW4h$3`F(t-75? zOL!!6EwUk{!|EiAG=)>`J0x9im*AkyYbywX+%dp(rF|mfbiN1lcLL*YnK`eX)-)CL`>yLPV;83k`p$UP+AOEY-t>Wl5#|UL9+2IINVhceP z|6<#igQZK6%XO=3{w0r)HC3y`1_UUpl7Zx*hHpu3ci@24Kaybvy)>BR=|4ZMBJP2Z668}_ar6tlquulFB!lZrVn zOlKy0(dCuo1N9R<}+N z)cr@^z7%Y!F8w>jBh)N7aI>y6Ufh0tIAz8;65P|O6KRG;XrJx^`U*3N$(SU3=@zpm z-4dD1BH+kj@fJd^s8dmi_G)7^X_@9_QbQ+eMO|i!uj7~_Dbor19|>*BjE={k#l4JX zM=MNpj}MUTim4jnzH$ds-zmY|NvTNp&>Nv|?n0ZbBTRB#Uulb%L1vs6BOWo?%6vRF z*z*^41c0@1@J~KSYMVQ;#ZS);%td?Wmrr+@$Rq=j#q=2pkq4ts%lBg_efb*NpQLu| z8Lnc6yd)>Z^b4qDFSCOfG#hD|xrI{M{&B#?t4ekxMP+vNeq!ns5!yKLGV&L6y z)BScfIWQ^pQ$#dR5;oR*otnA^3hMUmWYBm9qT810Ze|f9Y^XG?e zR$`%$aRSn%rYh^A%y4d)Ac4fNDP}@M*yBw5-*DJd1p&}Vf5;09oCp{ZqDFkbFqNtx z(Ebp9J~n1?Giizzh})*ubi=*H7kRswdeUwq*IzpHD=%~>$d7ZG#itumzCJRONX@DG zXD#m^2{cWy7cHSarz^fGuEDN^hFox>awzmBL9a=8pPr*Vxz&XNsqj2`5-IDlQCdF= zGM&#G{};lrc&=R5aIe1NJr|w78}XWkLSv(&*Ra)2E5C? z>soYisU=1T<#fBu!oC-JwUBT+KTUVB1t7YVh-|AbX{hzY7?u#uCELT|5!0NTpxT3) zo*NO1zytRa$7M{50HUPPEh`Z1NDwd(4O16$)yTlVRjCWralY^~g+^JWlx<_vQ{I(Y ze589%6mcI5wp&l|)PMpGhlOa&J2=zxt@<;1lE=imD;CT`F0@J@dICv_`vewB6v7kk zkHZDB_z+&5PpU=nm+CY|ov4biDVx1yz@ZKz0;^VwV}2Xk-FyfT2I9nrCQF|*X>8xV zB@aD8LMjG4>$okhVJid_6ywKH@O7!ImKH=J4J8!SK=RTx(Jz{&BGX{f>T!^VeAs^u zK<4J{ok3f@Iy}N8kj>%}Y<*hrP=0qMKQHb%4`nrRYDs%@wh;&&bs6B0#&E~9jk+eq zV%@)x>WG*6tiW;2BeC`?R(onvj+<6_&LfRL&bwA){IyZPgY7)|Ops)rFKPdKa;MS$ z`%@yXpmseM{fob?!l(fjAC0@KTuqJ0M&=kfxi%P32cj4V5^~3IvgVkpta3}(P2|sK6d@Kx3F#_(9{K}o=dmzDW?G?^}+KwHS>X~e{hcoqYH>B-EUS=_+rgbun z5H43ZSAazv=eyymu5W*FH;xp>YSuk!tu_+~2?!Z`oceZ0YZ^efNRB#>_i6c_IVh5% zEZt|+X$~E4l_JuG_M(FlFc9d?xJL}iOClt6Lt1?~mQRvV`jZjB8mduR%2o=J<)TYT zf9hLCfi2hF%Q22ICs|4Mw*0jI;{Eev=LZN z-U3*CxoS3209E)=nA*HtqXhU6N$LF|d*h5ITaMcF&Uv|^92at8aWqm>Q;VXr9?q8xdADw5n38y&8s@_W0*U^61TQ+aaOWq)ZoS@%Oy=%93@Z>4C zcaHc`Jufz?cPf2#u5&UVn9c;#=~L3Xcn$|wi+sWWc``}5{(tFTC{IJd9te zk7IP$Z7=Na$z2q5*AM5L?XxW>WZm)ek>~Awl=JuGZqEHCK+Xyk_IFn847lYtuz5D% z{@ZaeTKGRF_urZEplLvpS}sLvnCk$!AhGE-k#`9V^8Fu6axZ7dD<)UKSsEzss*{PCDAW9(sR1# zIBImViBXe@(d4Pq7SJ;rDtY8dlyr#y_8xDE^t z2VSK|Uaaq$hw4R{`_JIQB;%xtr;k?9w3pGh&!cRm?vDY3hI#%Xmq#Zoz11$;+Q;ER?eS}9a z?xGO?=|Ul(wse4)r?!r%a2$L9O%x(RiF(Bm6@J87ltg2eU+n{E1@(&A0}tYyl#W`X zb&5-onif5d%CPzsCUIKrtW)6nrEm~%tM3&nL`tmOR5P|U9+xmd=Rw>^VEdcBeQ|Yc zcZi&3Y&ZvIX)(IZthh3SlN|>P_vKB49=0y4c#}O;w;9O1mF8q;DD0?!>+SMh|J1`1 z&gnlVQ0Zy`98qoP2$9xzEF_n^86?wPUzQuV{hQsPHt%@U46LE0<_#&Ujm<DbjXIGn1E#GGhA{AjVY?`XF zMi0iIO#PxwsGR>=SXSfr?T2h6nnecu_vC47=;9BL=GfB;V$I>mdVyVAZKiuRdf1#y zx>wv4s(+B;4x4yv?<3S?+eTX0&8Cf}2WSTp#8wQ4WKF4I4NibNo?M6`pS$n9R;m6C-XW2 zk=PQ-1QhGK*(yiusNSgms54kdWgx*qGRgY3B~>k)G#~43Dy*O8K^m&-#hp~z547Z% zFPGh}4Tl2Zoa}8s=rsvLq=w$1-PYq(CwBnhn=fy{%mMC{1BViFMpQVy2Q$D6 zg21Ke(#k|hyJ{H=y|LX1PADK{T+hPUOb7p&&$&Xw?+R~Wrro-l&icT=g><3+tWUiz zMV7$zDE);x54#<-FJk{Qaj2sX=?1B(;#rZL2!;d~;jflD5=I>&3(10@k&oTgaROCG zECM#$jx2A8#Zq2UBO+=PY{!2~Ks-fzE|*F3wMBxC z(U;ud>P~7#@#TKupA{!<`(XTi&iSh=l?hT1;Kw5tPzq3Kg4DZiO0K4Q=4T3&h~UmM zu3lTA%uz67N7S!~-X8(+#y~5I#8nX@?!^w8^J6zqZrZg=~J1Dp-kTm40@P8l*Q_VN+HH zz^1bWoR+$c2yph=#1`&qZQ;PBDcbg2rFfB?*aXx{bVoz((Al<;L)ojA8e$NItcbbS z8ZkH$V(@8g0LFB~*T9_Aj;4O$<{V{9xMl%k`?DARZ?77kE6_*+Ee98PiUthAW#2; zj$-*=?cOla)Bm^XOSjf|>`@y+_s8$b>&rBW zI2eVbijEGGd0EQ%5n^-<9ijSSEt2%sPtbVeIOeD+n@#U)Xx`^T-r@({?q9wi8M(fU zL%6?oqmKa7#H~mWV4~8yx<8(W_ix(BuP+8|Tg!!mV(R`MFTA6q2)uZd&KkIak#|yO zSEylpS6c7r?{?qoX!3RrRglwi);sri^aw}wGkhC_OSVu~QXEYlr{iP_KY#V-U4yf0)uIzofJy7%lgNw??zFYA>co;o+osd6_w(V=>mV1;vhf?Tm$yFb(GF|4Om(*> zg8882KKzM14<>eVp-pBVJ!xc^6-gK=O+zmud(8r_8hWjjSpr*s(J)JhG3k%e56Y%4 z&tWa>K>^Akwg%C52e)y2)j>Qnxh2x*N--~GxgIk@n5TcmQSV3Y0~X~hrk?{Frz^Gx zKXYJyORb@@1#1}Ud(ZGIoXOj7{wH{NFB3cB4o|1vQU=yJrh6_NNW{b=g|vmeyfPOQ zO(JhrSBOnFXmF;8x*aXuK#&VL`Swj-Q~9*Sevy&^gYhRhRM%E4^GiJnqGJXqj4z@# z{bO6qv=s0o+mzj$NQaRI=`Fpyo;-rQOfAE$8qpV_CW9TTtLui{C}^Wc6vTVu z@EB5-`Q-cyj@=KGjtv>EqTyEi89(w2hZe*9SeRz$o}TpvQw|xYb#5UlsDbwOZ<1v5 z0P|`;7RfFRrB{lneD{EIKpsj7RsE3qcZg@qV}Jd}b?_+dKG&&X0(TQ$6x1#LL6aky z;nog3jwM;W&e$gB*gfyv<~qT;wc~3RsZkW-4D6Lv=X8;zy#o^^!z45R>d7z=?-E`TFfNHIl|gN8DYT1V z&UM7-Kh+5-L7S&`Gra~%VqhunW zx?E%s<-s4c0a3 ztp8JTOC&8Bg^U_}ge4Txh1gxv3hIG^;j0cSOE{(QTv}C>oyoW!D2H+YZy+>ig|PPy z_k&@Cy;Co7^dl*yJ*m4>A`z26fUDKWmq8^Klf!tfM{KsiJ5n;ao0?6mQ|aUjKVQ~VzJpE6YCu7Hw;ZKaRZ7IbJP`KaUaYo&kr!nt#@u6 z7kNHXOJtV8x<0cJh7~C1H}85belNmQRp2hx0+0b*l7~=Z=gbBfUu_lZkM{RH(#=CH z*(ETvykn>c2-GK#YGz6vhzd{h&l0SMIt&PGV7LXMmx2a0OPoE@QOkbSwI1Al3P|@2 zc3*P>(1ubCiD3G9-5#J+Y%`#IotA*saos)j?r(#S-4F{uBcMZ5(v1qH-!=qNTst+AnT_R#cKP}vIJ=s#@bk~d zXg?JL7iNp&Z%nyYJ2pTfMcsBd|DO$0jZb$!hhrI)vRe%ur;%fBU7gV7g3b4s(sYij z6pSj}pn}QznTL;5xCFN!UL5=`I(DSM8p0*`bc$I%U(23v)CtzUCefKQY-kAkU~o3G`Bd!#xcKTk&hl%9Q@)N?U+xmf%LGlOKmH#ydauF3iu) z+kyW%9WbYzi}}T!hM{wl{s7I~cjuCNc?TNS4K4Ri44@{iW0(>>)>-O~sG+Bvwnf^C zo0O4eL*$d;08jxhOPJb*7;jS9vi=J#9p;Xgr49yZ97-CfTdFk@m+)-55f{9fz4Zb31{z-CKqLD)xY>oIP{% za7!g{ID*fJJdOWNfC~fWN-?hJeTDRFS6jUA8vF?tgmyNPbwK-j0 zMtuthMzG}$iA9=joY$eF+G+j@wQ})%jO^SWsQ2pEs*ww z5hrnX_(gfj3Gwu8&;r_9`SFR^5kQJ@S zwtLk@$_{NE2gQ8u7KFAodz3z_Dg%ZmM6_I@7h++&PV=L{Lkw`<`I zYY-I`ZhUHEMSokD5VlazRZt!ZUui8dig;>e*KfFj)$5)xK9RJTN|S0;lfhW%lVOx& z?-@4!W{m8T#ArdY;Y{g?S<4*bE_xKR>PwvMxU6D=b@J(Syy?3n+8;{AOY~SH(?L(P zI;@9SJK7NeW?Wk4sE0k_Yh4Oxiw*9}3pHVFxw~=TKa@_Alach@vziDvl~TX`-clBd zQN=5{edarg&Xp%coEUb!nmbpd>Xwu*NmOFw!k+K48Gwf=aSgB=o+kKjLRF&@4&ST1 zI;#;LbBlSTEvjUwr4~6IC8}Fz)^$iN6Jvk$jWgy+MN{#>vN#&76YL@3=m@2g8g(& zkQI{+-AG1q{%8-U1fniJz+Ul2EN#D9LGS;Yy0o%;`PWyPR3e-(^QUEB+KHm6JH!<# zrbHj}WCgSAz1|J{0ez$@&YfyPI?kGw73v@=-NCrPD2IJ5FD_`Jy z{}y(fpgZ^q&OJ%|D3)y{^upuDH}O~(PwvFS4Yp&Vt18F25KqQ)$(DBamv`Zg-9~m% z73Hsh72$OPa>h^7Q72SV_H)}`*A$DqNuJi+xx3q0KN!tl-3oMKI+G#s8aL4_S>8r> z$F0Z}#r|TK7v@NLeG9DQ%RJ~;k&S(L_hJ{+lA57#-1}>#a(p)Fg{;5-;u_x`;_6y{ zt<_2x5FT6)&m{Vn4?&H9>FUAJ3{^r;?HV?Pd0Elj?Lq@YRon0xqL07_NC zIpGFP(*6UV^)ObG3UV+?foIqDOnp5H#n(|9j{md;qE?m&WjgpXPo_9J6;jiyX2ppH zR#1zpC@kW3mh)AihVU?n>l_Sx>MF{3ggrs)YvhwKBsM>cDIxXgx<-4CyZwL_V zD_|sbIqcbK2xikEj6klHz+F4#*iz19)2L>*F_&_W`fj>9o9rU}KN@=3C?lEq|E5tfy3kG^Y&fe57W~nlfn&7#%n;&RDX0rQqou63%(r zF_^Ky8WVf9U62*py{6ievtXs{9u&AvN&NF=Ukdd=7Z-ZsnO_ifsTTW7?M+=n8+Xt# zm2@8V>jw)I)Izo8|J+5>-vH7`$J^dkm3J5nUyN9U>DZAPMHZx|{p zN0}-C(gOJK&!g;N4pZk}wgT3mqww4K8AD!p{jnve#@|BP=zvI@d-j8IaEr|%o?d2A zeyWzFb$un4J`)U1SQ7*n@XesXU$-6(0ofY^hyO|(pOaVxP!sUOrfoq+8Gqq6?j7by z#JXi~Q=~(2LjojE6C4R&|M$3y!x9y9T=v!yky0jc{iCurHHpU#{bd$9P2E8GpPW7hTDf%b-iumeoq)@9FSt1x&BLrX#y`9!Oli3`e-#$cpJHs-EKgvCTiT?nAa zM}wI&29xUwtY(g5wcl2)vU>q*gaBN?WOiYhj$Dk677W3%sAzN)oUH_Ak(5kfJgf!{M4C25Oh~l2=>v zV;}l@bHashw&mT=o6<=Mb&b+FLT7fB1AMJR8?YFdgi^nKuNnEgzy8mPJs@1I$a zZ)$(?g6+CPK z2y3>BplOHiDWl~-DM@854jr-V0$>e=!sc_ftVRh+J`>zd;$Sh$+0pR>|$?}%-6qQ6We%RXw z&;`aP4;}I|B@b0a;sq&BxPE_6S?~z++O6C+eQ+5saEOVl>+19s?C*m`D_SSF(=b}N z2M4X*%}nAig+VuW=7op|NaUGCLM$=A>85|-bNpwtANr-#!tSY>h!FVkXJ3tM05{4Z zCA_>!`QRoM0-8#JHwVbBq)Ay#JJ-@$znt>Aw*_RDw7kbZ2hU!BOEektO`>=YI#Rug z_Lvl#_U0is9*A7!QB|es_pJZNHA#L;N0)||L?P9?K*Ty6};G%{_zr}pyCM&I)}&E9(g zI!Oht!m(~A8%2C@vMxe2(xVk|q$89bR#iI3qQ-AHDs^QUO~o&-v2?`TdOGnpU zHCc1r0-N(f^$Dzn@YLiV#6unraz=fffr4`twk^RVPWtwxh)AN)(2e)91x5}u`myFI zkKEoS{wCWiLoe|OPg+ZQ8<;-m{DFe^8NJ%e_R{Ms%lBza7Ed?^uz1Ru(+5TK1tRIM zw0QcJho`7VYXO3K`R}CpETTZg_m6R3kl%FnD>l24NvdvU-d89QQ#cwuHjW{zV5_25oYOJ_f-3U?kgdy)OK~tX1N|~$0m^{qVP;^ zb-J>B%p=CCr`aFu4aHvawl)uT=B z_vF9(Yt|pxoE=M*D zimJ`L8f|?hZkMe1(G1?(kH+#<5O5torSqd<7O_b{1@>052BaFu5`*2yh^jj$h z{zv3Yo4XA{tT*w&BC4~Urn64tixWah3d9|^4T+sPT+H~wl;n4FFaI>7$S!vFl@6s+ z;A<&ENkAB3+3a_KSk)3~Th!Mn?-JxHBR&Y{d$Q$O<5L^dVK||?s>(2?S&;f02vt?# zmvpJX`2$&()IIXWtK>u1HWN7&z*gAxwkx$(996YlMi{$_-|k^fjO=wcKr-G}cyU0? zU=@t<(~Te8tU`c>Q0&D@4j|ei%>IITb3A%sg;}G86-xOeaZwPN;zaUc&~*i_ZjY-Y z(EC2d`f4N+6Op1bL0{WfFn4h9hg25Nd=X$-W$46pmlw&3w>6*zVZWR``{76p8M#% zm_eHWM!PkoFBe-j89ufI`YMFPiNjR2A%}E=o>@`WkP7pNH=m6DtC7)Y6_iqVVb4@f zbM6N<#Os<%U84m6?krT) z2p?%2g3tZOCJo3zKa&4Lx0VL$#nog~L}#L+{_b9>t(7n~v` z$H6nt&UFd9$^oX#7yYz^da~?M;mS3UD3Itm)h!dN=5;)9JAf7+X=e>@uS=X4x}?TH zQ{h=%utvdI&is+Gw`yiZ*5Q0vE?>Tx1!t)6X{C;!;BDw#s`wLIXv%2I1AQw z&nybltBf$S_cGVbwQHtfo6uqomjOhB~1YE|v%L0<#x-6T$iSwYPc)$zX(9V?D zbPoB-nsd@|TVEW{;{>``&fX3jMl~3k{l3gXi;(9M{)S7}bk6p|3#K(0n5e_(0uy*K zJktdnn$N@{dls~88>+?G)^mjJuLD+;jmWd3?puPZ5Y6=#@v=aa1u9({s<`LNct|ya zKy}3|;9AbSrj`NmtdhjNl4Ugu9NqUo3t@g2j5zVI786_Oom=;PENREP>FGn1UEMO! z#FR?8^RV`VhpY*no4=23HO+KKFXgk|v02H!yYU4n-)oxf%(ECL_d5-~QV9&xtf#5p zL{iC`Z`A!X@mCr8C(ml0u6UFEqbBc3u4Q$I+Ub)DfZH1rBV*^M*?0=3u{6^4=BY-l zFcr#OAC?F)TIplm1e#?+nIqwqqb@_GT>R)xRcE7ZUqyJg|C%-RD%KrS@o~Yf$nz%) zu+l&-!7O=A--(N>s6KnkjG7bq?}O?m3W&@LZ=}1}@Wnifo9G^eT7@uFmC8T|kH9{ZQmSqp>lpsM2o@^HT((&&#YEs`56W%7frY(B(7$n>`tlqSC@5=an=AKTL; z`syjU2Oi-(VFzvY8kjcs&~h=#;!L%U&3Ikd<3LFp!8PdZY*%;ICrIP@x{9*LItg_{ zDYnZ4Q6N+6dPus9>A?jzzH2=WdljNP*eR96gnJ%!hrPP_LbhtFK-bTWd{S3V!D8%_ zdcs?1_5zx0?<$(bN%2z9DNiXUqe%Mn2R0h<)*aya-Yfk<)giHT8tD>Wo)X!1Ys}J6 zUzP=kh@yO}v-eM^5w1`!htAGm3!;V`$wqs}syi339~1#>n#N5-bqYk_&Lxfkjj03pqyTzTcJFl=)iz~L zhf=$??#)GbiUOHu6TT3qu=^xkFC!0~|G`kCtO_rF-5Fd~%)KicPHyEc7{0(whgit_ zXy{4Nm}%F8MmO%hCE+(MDH*4#@sL3$9t#feIB|2TDg6zd~Z442d|G6cAsIiWc0W_ zSo%*qA07s$0Mca6AwL6l4{n10;RX##i=A;#Bz+LNoIj*$yD?v8`*$lHL|S?|r;h&B z2~e7XE(GzGao5;`w9#JG5m!pJCUS8(tGsBlZmd`+a%_Y+^Cq!Gik>))mhn1uaPuw! zn#}jMyr|%}dHFZ&0gbvu3>EW^V_E7oRdba%9dD<*HP11tMt-G}fa`5A(}f)68dvig z_nZ}{dG7lxXsO1I3#_btGiCWlo#ZB$;U<6Oq{nHS;PcG{{F^7nKqCbk?m_0G?2e&& z>n*WrY&}0&>~(G#Ij(ZYJ9)71wAn|a>*4Ed1bZRCKX^JV?`;~`;tU_oTf@<|mUXw{ zAyV<{j?$&F{O`eSpR-a?${Ly6lWc05suaD1Tx<%9+(6*LE6s5a=IA z*FpW^QTPt_{V%SE+R-435Tib=2diq(nY;JTr^`!l&pBPl!)YzYR}FtyyD`Ao<8X#` zOLsB2q9%DPl$-H-WDi^z)8_Q;ozFAxrV~alyVAe0UgOQ-YX_ut);( zrP&cEu{GcOaURQZJ%!X)Z;O7MD_}rkTe_)kkk880w4dSFdet^_E#07WnXgem`Cb}> zL7N}I@o_2&d1YU3EnJ*Wro{d4Nxg4q1P^n)|4GFE??x2Zng09Y)c;coqxr8=n7_?$ zDeOO{t)kTW5VTj)u3Q2&YE<&lBGY1zsC@xd%#c`pZfWGze(Qhm?Bo5F{hjo(2I{^c zXnccDx7%N}yPFhQjpDm9@#)bTQ3%7|(J4HG_34iPpJ2KD`q$_RJ=^+Q zuIPns5gUy}479La+LAd5J3BCBOu#FiJiZ=IYj$pKtwi#g7PSq$d-3A9D!9u|A>jVY zwU){^m+_auh=Y)-VU4S>628G6UvEJH+>VSStdx-+92ISyoDg4$znRr|-EM64Rw9pE zqt$gFR*?Nivp69*vlh*rEU6a%7;?Q6mQ+t$6x(09z9Wk} zrlK;~B3XI;A2JVZ5Ekp6Xb`o8IZ)GV%tYvv0D+Be(NMD_bXv5P%mZb8R$3c*4Xi@z z@7P}DQS9~nMw0fJOW~*rd8fJBQIS&Z)xKn{q?Uz>X8t9(;RISz4&xNa`v=9gifOhp z{xOU1qa<%_=SVEzmW!2YD@($HRzAaG8O~ISXsa2kI%g|Vh=S%xv#tq_P8%g1u+k5$ z?(YS;YilI2;|~UEQ9VL~sLm*ifD`yEFvo@c-&7U|cEUE!t`(xo@hy_r)cj7A#Nz@R z(qm-fqgURDvPgny&a{+a7Sn67>X!&Dd@4bT%kH)~;&em5`8)3;L!>53RtjypHHdko zO9|E0xUAx&l>ohQ?nqYM{Ps{j^c1We+3)n<* z8M{pn*_DNC>U;wU!Tx325BpV2g2SIA&6ySNQ_S%|5I3blkYGzMf~Y1&uJXg`;U{Ph z#67(TY#yt@iKpg_)m4|A4@Sdw&6bf}Y=uA>JTA`2C%(_4Fo1le5Ol2KuzV8b2)K)y zSi&)8O%(;F$XCirCsPc`(EE&w30;&&A_X)Kz_@^$9Xjp|Y*n=}gc3LdWkwhz zebdOMvkSiPKM-zI(DDN9KwSiEa0}ez4@a9~>JFqrC;ArwKtM;yUX^iFv1DKmXG`}qE#)~R z|2DhKDGJX>2HmH)uio*_k_(ISB3!3~skMNG10;|{q${8jbtViv(|V3-#M);_jR8@p zurGnlQfe87X_y7hP&!@Xm$vzFq)_eracVEkF&IDAl>5?U3>(DjbP4X?rO5Cq=-d`+ z$1rQ69TTln(XMFZGyOpe`Z1&io+Q^q3F>|n} zapplgU>wY1wOT?{mHKE_Qr7rx`RybAPet-1lZ(1y+5Gqslez*hSkeX>wb|2og*Q&5 zd7%hs&;6k3NUhGCpjv+(ya~r}KD0$mwL?{`{-uQ0hPSCtv-AtVvHHys@_a za1+fX1Z43@hV<(F;GX_H)&A<&W?H>!c$)vlPiR~eDwI@nr;9M>eO}^MPteYBb9L;x+|ZYzNQ&o)e9G z)?i^P^QebAs%?UW!XLqdqktBOnoNy`Z($PJ?D$MW07nQbW%WegMaBsPzcfWrK-50@ z-4bwPe-CL?+-lay-78zOeaO=4AJFpOET*RwRn?H^RyoiRtKI?C`IDt1Nr|FrnxyUj ze~i6jcOU?pZCObwwr$(CZQHhO+qP}nR>ih$Yx1rh++Nck`d^#}XYV`e4Q-zJN=##S^|q zXJ4iWhODrTSt!i~oJXG>Gu3snnbI=gv+{fd2eZf^;U`(jWM=;h16xLf+Rv4$Jm{CA zWW~Xt5>jjpf9uX2VB?(Ac3Jhl*@U>Cz0^bp08BbUKTjdeCLFP2n@ zz2Lvy4V@&q2k2`(WJtAPg4>+fypo$ZbOB7gWVpL%DPM8STt@?QlSsm?Jq?G~e>o7kR_aJwuh=1j)x zORpK>kFzx{YE`+Wmo>+UTO*ASoYu!hYmMhuB7hCfNrh4V<1ZT>jvj3cE}nndcLqA& ziMt4xuARLJGe<=YNvwBQ)6B-@uu2!Q0@~FE>|88=v6$!Ym6Fo|DMwEJ61GNT3g#y@ zt87xvmv{p2dw0}+{+~*nYNW&;oYeZq?a>SFjk8+?!VV>x5 zbgME}O~uPImZ?_+Q++6C%PseS15gNbQX(nkBQX_X!LB5W)UfM5YE)Y=e7mIJOrtr` zLrE=Z_2f3RO4>1|KScTyicORer>kKc8tI7Rmv%I&aZK~V`OHjb?x&^tL{qvIUk~eQ zRN>o`n|S`GoD(!j1_Nh`=dFXR_Jwzs0+X&hZr9L+qGjq7lk?u-j*x}1$ma6TX*Ed7 zW=fP_Fwn8kb2+5+0LzWg0-J;Kaw0v|@Y8$rY%OkSWv8^@&QFoQ{4fkw^J{4I?F?-< z4AbPV4wO-=>py<@R^A5kuAFba%Y9^`zX?AgQ99Y5QdONl_o+VsVKque|3kQD`(JIy z8R^(q{!g6iv}Wh8ARd1D3;EqY{>|r4APm$hB%9`kNl2iIq{BY63*t}DTNyzlQt??% zI&)NH&v}YagW9a(aK_n6xGdG@K_YS@vyY39$0vf#Clb#Oht|)d;roH^F@tI%gp1HuQ0mw8 zVBl4J@5l@8UgK7qhpeG=mv`s}EEW#wKHG9=EX)qDRHY5Y+@HYZhGUf8@t02zjFvHtGyU)YYry6Jnc3b*CD_O0fm&0hPTK>)`wg#-6zsGH>iYv4ZA z;l&PUB9-aB2Bp6d47~K=k;o&*P7rKeW@T(6K`L%=HShLFjUQ|eFi~o`cIC*Pty%?H zmR6zk`a?tz?NxxTc_A87)eoJzx1CA1o%1F6%3BU18S;57;li~}L;%8GScM}1VHi(9 zE)g0(Noj;NtyZjxH%YR9cAiyN1Ll5X=lz_^}LypUP)hYU9aZ0$}C(W5Gi^$EeC*>du> zm4BYkzlVJq&|5dq2{MlE3X;##l-eWQ_7T~TtDM3B_j`Ei8*`h{%JtTlU)yw!?p_`oylWVpkhPMf18trm=0qZ0?XsWM1r%h zXCAN=bn%S(=@|KGvm+v47dI~e*a}1?lhC)}f=gCMCI^pPd5y>NqeRLrN$Xa1(yaDqJqFmH74Y2TGNJ%b|YIAk%vZ50{S?}d2L3TG%3U@ zGOn&X^tq%Umso(FpO~moLjYox#>5D9CpzUYQ>TAgaP(LhxUPtl|(6kMDTDMqz6NrFqv_LcAth_4!m)3YXCy)befjiGNTv#>| zJAgh(0#SODjmx9}B11?x1_8^0ztO~Mw;(=qH-=3pCJ*F>ZRq}GB3wc_Hze?%bK`n) zgogV;lJ~sE*)`yByf}3@K2lDqCKiE3VoQhT?66mvFM0*jLDm5G2!Ja=GrvL@8vOo& zTe_mSib-stnLd#DDt7nyERwJdKt0K`Ya9`hwh=Lm8uJ#xg;xX2p?1~55G=Tz>h+f&`o_(BE3?~ip!EL2JmVH;?K{!FXo>F5e*?we6J z_CcYylQ~--ST5UE+^hFf!9|**n%dGv&mpWorEedZ=E-O{!I0pINdA!;(jr0Kx8aVg znSHH0E#^1v=a`|CCTG%Fqrm$9#>H8jBx7#fway!}h^PvtmeR%4j2hbiL4BmJh1gTu z^Yf?)VwzIP#g)@*!5FY@dX;kkxs=;{PpC&=K>Y&!g;;zEWX%3)BNNF7+i0a>Jt}C`_WN1$j zeu;{ip@e@44S zJ}i3^W~bt1;TQEz(uwyt;W%{hC*-uhyPmk`sW@Z$E*w9;pJo{~P2Cud)4dBAt|i^~ z>lT_!&N-DCw|7Tv#3h!tlIWw$EEyn%xE`JA;wnO;{%5Qx9q)D%1!lg&{fpNVioc){ zMw(4|j#PFsc!Tq{zgcLOu9$_n1Pj^t6 z$PhLj6Pom_%(mbVq7YPsgoBr+#lgxdBd9G?uLaUDfW(by{}&QhbaRWdC@sfmLTp7` z7{n+&F0;?G7I$t8g^4MS!#$#Dt1mIO@H`!Mcb;`xG)vRh4*Sw?i&}uN9D$nw zDdNj3h~6x9xBqG*%~W`)j43fECpgDoK{u|^qBg0-g6Set;iA9bXdN7pZCK(?F0>e6 zB3}lIXw1-oSV`z?I9EqyOO9vjX>-G$*VPV4ayUu+}JUaY0( zOE1%C2B1)%Oko>}tA3wu?EA3FJ-!Lx}Y?f`QQT1V|Vm7PP}X9Of? zP>bX&aqkj(_E@*yu>Yqgy`E|of%3>8{lmlF4f(X&@$Q9VPD*qA&MxQ*IQ_8W&ln}b|&aJC^6)UWq2tn}6%x{qQQdEDNI4b30zNeh9y-o|dKphSyG zYihEOQSMl)Krd)G)2;nIEqC_4=2GCAsOYdZ5U%e@)-J3EzY8o^(LWf%Tt~bw+L5M0 zOR3wx)hR!UjHEdL)of@E4|D=x&pX&OQdL$x$P9VT&$_6_^@PU`MOyoP<_D2(t*nWb z%4Ogrr-(7qHf>fwyaYMnd*N>Nb1FL^v9z0wyh>8EpA!g`*>BD)#!MyKL!v`lRI2jQ z_+yXF2{X(ViI;Zi^u(-ttND9btV>DwtaUDxV%lIu&R(aV7!1K%Prljc+3NitnP%r& zanEbeO)o@wN5=8(PB$U~FIEe>de3NE=Mu^$EpPNJ+>y@znXT66bvbPXHvYl_Wqj;) z($#x#V&^IKqdlzL0m+?!;PSY3V~YXOKqaWnH*fNnm7I=hO*#hSV4b<1dLOBaN3eem z{q)?Sxs^P9H7+LAr@n&Ha=o-{UQ1ADajJJ&#O2}((` zB(on9r&{lF*PpUU>8itbHg~;vwz|*zOTG0`eIHrMjLo<)D@#}@-!7HdOAhW}Gv3c) zd?{Z{fHTo;qawr@^ctP01UURX!FuEWQ zkV39rUiVYozFazfp1fbrOgY8qLEsN>eV|~?MX5jWmdLU(wsU_x5IxjQ2oJvO1a3@P z&g5qlhCXRAbYkYUYO#jyal_g zyj0k#(xp=XIJwUP zU*9kNr@vn}g%0wLE-8D_O(F>s#<43PFUrR~zMj3!itRu2Q5;e(ue599u>{{=A9`7s zS4DR>KTtndK3_r2g>r^qh!EMy3dbDAlmnm8)4i)OmpIbJfyX23`s?b$fX!$!I) zr11Bb!xdytNnX9yG z@X2M1Wlf^QA>8H#cz*kZ|Ky8So|3ipas8Tyb-eW%};R74W#t>#X48Tqq~{Whp*Y0wKc?-L2}lDFT8v z%?CTK9PXALW~oP%XL7gWBQEt=42|SE65Z_Wmve=WzFho)W1+0 z0RKi`g85CLrUXzd9(USV$nM;}K@YLD5t&;Q!pfkP0c-VHR(2^vUVTQM?i)=@8m_^R zw=?oleLpth4wywlm?ty1B+Vx=D{~{an5Q(DH%-iSWMWA-I=hn6-G7d{z{eYnAi^b& zO;6j4Lq%cO2?362w5)}*9%GdR*9Fo-S0~8N!y1%`QQ=V}s1^*Z_=&Hs1C|&h(wy#{ zfaXV+D_OP=PlqlQGJ@sQ+~zpD?B#URrvhtc&U zf3IkG!2H{_MW5UBqzx?m9wqYNmNl<)TS(Rr*U9)bFAx<^Kk^#qqXhDnns6vpDP<8u zbqD^Ue6aHY8i>KHLEg!~QAXmyGP#crOj+tOP^6B}01a;dFEF4cuP{(5)|cVI8==6ntRZpGV3&ac9OFS#HfnZ)eD~m}MuRGklMOQ6bbfd7Ky{{uV4)*trlJzd#Tbg@9ps?kAO^ zh_ea`CF$fu#Xa}6wd1Qr()WFh0q5e^cmnZ2CMki4i>(s+0>dp)iK%k9`E$RXOtdC?C^(Jzf~a zD^gdPbT%4eUH*T3O5H<5e6uu_7Q(LoD&;;7vC2%y zqDo1I8G*Tojw1WH$pVDA@xurmWB&{>k|}R)pD_Zs1eGBcEx2NUtJ2nu?~w=BNj*@Pc%zoatRjeG)#5Ew!bXfa#5qKzp=S^@EXOyI8@&s7=s!_Z zMW)8&;0b2c+S_m2`_pY8)xL5KpE!rlQhZ_O=HB7_LR6v#tLV8}kaf7F(aj|3Nro_8 z!Yfx$_DmM;5bCq1&Y3SjZd76q$gntm+wW@SrPi7?o?U<~f77CGBxAWmUXxBQVzRFa z=%OW%_(po2b$@>H6lw{tUX+ToNXA|;V?;fn@3s0tHSnvA0eHN5!zEmrNovK+Wz^5u zYPtM^YSU|=u+}TM0=qPD$Nl)mS;RI~pK2kkD{7jnvO~OZgZF@gWca7SFqNSpY>3W- z3qR`s7u3wPR03`2%*6kRmUA4PU>QPI6p6jlfBnPbRyT^fjNk&x@?VfSrS9|&3h>Jo zd-6UTyWliV*4eni05M^6P z)qY+qx|YIk6~f`CkD7O)DcZhmVy(n&W~B^u}P8{E2} zXBAUYF~h8Ve4TP8CO(gqGiyi=8GvQ@I^IuC>ZG?OQZ{`HW)RC$VSP#y7oJgW2ow_zuE+} zjkK4^oo)(``w}pz9s+Xa5Lh$T^iuw3V{c9Xd4Q8Sd?w@+3drGyVK+=@53)~o;i%*z zd}pPB9|>P1PrkxPi7v>j@+M~qxdd0EMvX-!8NEYb1S#xPv1#i{^r-204QhV*Blij= zI_2CF3~5mmhvlk_?`$ovq=S*>BApYj5I~(QUQQY#f>*`MwAX-V%K}|b>zfa_{ImpP zr#@*~>q<&Dlh{3}tFjqDjStAk45>hKNpqo2H>ce5PP?V!seUB&==(6PoRmikIxr>K zkiFi^%)+AKa`z8Qf^oCld5ysUn^UP8f5wGuKOLyEDyXN7@+xPRCHi`^MiM1h&!JM_Jj7w^Vop>@j!W|Fosbcts#Yfk?f(g}x@ zwkpYcK9Z)#QquxoUI{EpDcLZ5Q=cMqQM5sUFBIavlJ+4`sS|2uQD0zfO;fbrg^xK`6EDn{DQEz8kK+UQL9N-6As~ zxdum$aWm0PNsNp6cr?F-Zgbc4c3zxId^dA3yL0_~O;=2)QD9d4WTj1NRn4wXC9whP3vwm5Q*{J_RQn5_g4XCZXV7H~uecP+T44B0%X+#UaE zY)5z6Qe94+xO47?PC1%rPi2eJ_1ymbWx`dYz`eDa1*)@rTW_c3^XE%lSDnK9b(}X1 zQxnr@nbC;{b}=M-K}&WSk(4hvblMGASDvKrTZt$EmQIMHrKcJJ-=8PiA0TZ0>eTSTt;z|2JVe_jE)HU7UVK>k|^7!(p( z9jaZ+vr!0;v*h{^<|WCuH|jWndeJI(2lv5na7_s@&$;_K{_m5#!TznRl#I-b2g}FV zHzn6Ac#W>iORtxd?|0^ZIo-Um7BcCi>{-FbgOV3UpKD!fmYwGSuS1V4RwBWDBZTeR zZvNwR+X;mcOkpiIazh097(R&n%K3&mxUsv6{C8tt10AdCS1 z7Y~xvl+68do9ZDuc+jMo;ZjBieN8ftBOd>{!16&M;jn)v_995a^Md>z?D7t-Z*CLd z9Xs%V@OZlL>kC1%K)IT0+x3|bqW!flFU~pnj&Ek#ePjB!=Hnq+=+1vh-GY067{46f z-?|_gkKRXRr)PHt*8|WC&-QHv>ebmAynN{tjVO+X)#jb^6AQ4}V|O78EpJixB7p&6%1ipFa#^@CE*h~F3oEI_y?xqRqX>AfBulzb?UYskb zbV;QhkF%itQJShW=lK}dz~|IW3J$7>5u1jFXChy=5?c( zv05cHPcJLsk^kvV9tQmp6GWFo;Uv($q9cmuj$ron)oBo z1sV@gAbJl4^NSY&h$Z-ovO%6aDrGXPg9*)ZuS$IeG-o0Z7D8&l`}>vQ3#7_y+5}hq@RQClmc|9`l+5U z5vVhdA#p$APSa_iVzP=$Rgh(5>=i;?e2-(Q)2OXBU3m_J_;7vxJ%+H4= zpQMs=BfeaKHYU6JJwx~=#fVySLtVamC#+X_ASytvSFuUlH z4AU81?)4i`=N89m_P&51W|#cm2e$qhJ6s@S4+3EEFTa-=#Nro|w<4IwGBw!8!d2^8 zR2+M#F)O9M`rC`d9lqyk-x_1o7khv3=2t2Dn;ru5*ona!j$Z|C=bea)cz{@H%5+&( zglAUWIy7}9Uc^fr^`hY%b;{VDbT1C0L0Ko>K;3!TgJs3#y zEX2^jzy44pAeP@KR;h6=4(N=yPtB9Dj*g8 zJpb=Gn(V!Aw6E7n+S?Z@bi#%GZ6R!798xHMFK=Adl(e}VAzXNIMp%a2XF`Py@a_^$ z+NI3VqBduj`Y5)9(OP_mz)O*D6SP@2v;I{;@X65E;Q+@0qd8wJ7KT|NBY+?wJ#vK1 ztX{Y&?t`n|4oiY$w3Q@%de?o_X*-Ai+z6gMA}E1qJ>$@=cWQ%uRRI5K&AkD3nK z6!)xk)jnmI^Ap9|{2{rE!jtM)ITf4bM439nD@ASZ-te^jj+d!kLQr(>G+E{#knP3X z{BTS_Ix+=h`=hLM9W{Sw!kUJiFaoOjOU7cmwp2PW>xVx-fI76MAgOv06LnI+vcCf9 z7`f^=11jS1Jb1AhKx4h#rG1bt=%}ZUS3=M|Z44$eI~xDKWr!BQuf*Ze07-*R66|>|E$rXb`9Cv+RO}*`@J$aL5%} zzDbCnF3HqpG6{TeTBHs2=dxfZRHvg-xV(F_6O-AucOK3{f}lrCm;;vHxsn;&7IL=5 z&{KZsAZbq}g7++xd|oW_9!lOY2`@WotT-H3yiH3oER|f}Z_<#?DbZ9!GS<8So*iXE zI%fZ93M$AED-d01O4zHgH_rRCZY4`6;+oh+wZDY8$b7T~Ek-v6v6Votn7t!YA9gNg_` zoUn<#XYQMGoKNigSv$JLzlp%>meyB-p!u$S6rE6vAlJ(Xept)GP%9Ni4ze3i0yX~% z__jLtUuN9pdqy_Pjd*>9Y{`78hXOm^qzoU7q6Aci1g}RHpCr&!^Ul)U-0P4471%J* z!05}`!UMVOI!1|OrDSLN1*hH&$R4IaL=S*uYc;RR-D}%q=5yVqm3)B@ zd;F94CT}j-``xk&BRg*$XiG^Cn(r*N#bwg)u0~H}@I6;fSbM08I>p8ckhLmS^M*AY zYn2oHO7~Offoi zn&~bP2Z%SVbEJH-;cFs~w(_8Zs@?CN*xo<9n)e7dWD^-jon|G+bJ zX@}tS>?eHS;yV}PH!s(UWzR$r86?GtpBkoVzPGh1k`jR}s(?Fkt!i5YxxexgCJb7h zCJ-3vu~F7#&om~JMX@W#ELF%~_@$)>GmZymT*R3}A4bXnci~xcFct@86$M}@Ms+6= zX=p+N5}|$6z>=LyhEM9th;`$gT_hfC1m0+j&|UETl>uk5^vH4L4&U=S|Cr`4fu@gF zQFxmRY~0!UI^q3--5VgL`Ts{oW;*)+Rb*sg{BL05W{lRD%Q5;D)mzYzmF+)6e*v99 z$vDr90|Mxa5VY+i9zQCsD=b7~Hn{csi9@Xvx1S$Bh)4l^9qujeX=d!7d^&k#MYPFE`e-r3!adQ5WTz|WQ#}7* zG9ULKZl2sz)PIL{Hs~=p%JdDg;*nx9?x^kIoxj4GlY^4L#X4ZTr#{zkY{dY@bf)vH zwUDS|=a%C#Y@R8zuxrD3iH;=9tKC{_!!Lrx+GPuIr$y@&iw*VjdABldhL^j-r&W-} zJ=um-fh=}p9DEV-QaR=LbAN!J`}%9NyFj~q+!-L{g?#>veG|@0kB~N$b0_FWET+d59ajJz|mf- z-v{tD#P!SLRHMyx)uw>%9{Zsy+j)*k!r2>gF`5B8CQ!qUfYsn-lTcW+CU}V(k9)w4 z%Oq!365QFeiwaAB9{jpy!1latydH+WdzEzQA5Tp6;DQNRDi1x)co_rA-SrvL6YuwZ z&ov@{2W2iy`yc>g9CCpar%7G=C!!}N3DjgU%~IpYCR_Iac!=bN+}rewe>3Lrqjl_F zne^KcKBm=c^Q`@v$FwU2U*S@9O1;K-)x8UzDz>U)32r2Q^foFi2!emoebR#(%0>e9 z1PDV-s_~)0q^54SUd=IY7kd0j5pUd72%D*FxA^!oy^5$%!-qocT;G?zX=Xt{ zyZR93iqC1aBhr~TxzWGB7RQm%h>$*!(Iu);i>F%Uh@XB1&A?SyH)fiZh-phoSr(Oi zX8iY5;N~Goir=^&1rokLK)p_oAe{kH)ddbAX|^cdRZhUz%Oxn80X8kMwjkcz;5DWr z30O#3&X-5H1uO>CYep62q{^TvvZ`&B&}3fVi5tE|zqe`;O)XaQ@=89S+t^00`EQO{ z6HAEE=fvL{kSLKqu21u$1XhHq0fWr~a_I7gel%3$4NA{=OM6>Ju(IpSia#6~`^T+( z;`b!|=(Mx@iJw{RwUzL;XqOWSYd&~xxt?HOF`;5vZ)c{w!)qA9IL<5_&k<$U5g;z# zv{NeXFdJbcvkH%NG1P=&6W z_3#5muYjxdsrJ3B?%Y(>h0;%3_wElxVFr<(lcOI`ptW!{m<(2e6_ZZY5?W>2 z;8Aw=1K~Br>x{;;iH@x6<2grr&Zrun=#>#G_G;L-Ip45BqZux8ys(`w)IosIB_sfm zKp|RJ9`wANYI4)Gzx{hT&dAi=D(w;=G3<}$EcK8@A25d*q&k&4TRfVQn&!;vdBWx7 zm!nXuts`JEQKk`uFZHbd$s|dVnKTWO6+zW&xy%7r0zjCg zcJS_?BHloq`=_jkBRh&pHHi%&#UgF(aR}m#Dn+Z0RQySeUfdwC#H(E1qh#2a@gi%I z`B+|R$Y{3LC{cz76zZ130{djzI1i|a!T0_v8X_0k-^G_!nF)aym=|#nz^bo5C?7?7 z{SSQ)=kZ;@0ZIGH8WL)i0g?W5rTT-k)X-J`D?f?FxeRsfj355I^3BY0SMt6cg-~ZN zY*gGqeNQb)?D554vl;#}ekMgMWf1bn^oV)$sw#>4D2^Y*`$jn0KKC_(2>?hpV|^$a zt!_6!xTl3jC8mo{Tr~5w5_Ugfys$p)Z(PUqlF}KQpa^6dC}dA?RwNud62d+p2rRXj zj8HVaq)#G`07FFPSY>_&zLsBX7lqq47%o1Zy)qth!U80#-Z7f_HX4a#<}Gy*)4 zD~{AmFcTbpH?@zJ4PUU33p%E0i25cv=aXvS=nPy$9G*xmXKgVeV%B7HXp7fyIZk8U}IL*X80o<5WnjEpzb!0No ztUlfCa{tIU}lQ>XXcB1*R(aRbq2{ zdNK84ZFm%#s1r+}IRbueKhnEsu;5o!Tplf#>Xa|;Y@|@hesw`DF}~(G>73+hK|M5h za*1B01rwdSQY_+?>6GAIDpVj|Q+8LB|Jo8Axo8!OxU0R^M9zyN78qrMqR@>GZ4(Fb)y_18En*+~Z$_Pmk3x8bcGYXMjS=rh z;=N{ttg3Th%l_q`_TIRB=QRXfamhBd+{WzyHJ8(D`Oh^25&L1lHC4^)w8(U=@wOlYOD6!{Q@Qf1in0)rPy*+jLY8OL zm%0=YIo5J&Y%J5DXz?>Z#6F?-y{4cm%N+L7e*To)Wf~crcX?3xB6s;%k&i_`1V8GIYbZf7vx-VasLHDcBt$@IUVaZ;bCyVgN5hO!uj(99k2m%L&Zk!aXg+F7JC?; zWJl)uNP>Mv6@7M!R^mn>UG3;Db7AGRe?$VqK)M_6&ducWs89mXEtwv2u~2r!aJ%-T zq`)amr$4g=fr)&!r1+QVPou?Ww%OPQCO9TG(Q~#z<&|}7-PH+cLgdF4Hd_s}PYg&W zdOW8_Z_D7y$V1TWuEe~P@o1Zc77N`z)E6wky#^3d-$oi-EmqErs3*{NolZk|s?v+= zi%NBP35K4*ANut}CyGE)F*SuRT^wl=5zpCMT%-`}>SCsq6YRlL(zGc$5}>$*)$EsS z%?9csYgOIWH)Miq*n{XmADWtS>U zp`<+vg_e-nW>cML;z?}>f}Ti6D_Hh0WdcJ@V`0VI!uAZ4Zc}1Dq&W&mDdO~xn;VA+ z@Nd_1wee$09$b&q2la6t{|0C{Ss!Fxt0hk{*N~a%G862o)ozXi>?pbnZr9D(Y&V_k zI+ytu@YYt&ax+|b4pcdHKA5hazzqzqF1Zd*bSBwv^F^stZW?mG{Ff6|0q-}Sr7Yc_ z_SGo2e7_cc{s7ZXJpWIL^nZnTW?*9cZ*aGz|HzhEV76veUqL12G*RSk3HT87T++|B z^iYgbxii}%jS_cYpGd6RJ1RO8@!HBREK+fhgmG{bFnrL5`u1|svaqtAtR4sNp>;n0 z=Kf&k?DRtKe3|{1E5mlf4*vgfWw>?zoJ=fTv6utQPCGQ8j|bHnAYkQOpy`g^dN1UU zJH<=<@@5Tr-#!OBifZ$}0CSxY-Z4JbZ{JgNX^TD4#FBb&ctCn4xvG9m8ThUpE9@(` z(%Om-tJX4GEXW=G3qos!WDGy%<6RJuS<7w3CnO6TE1EtY1cSai-|S|<=Z+9bnarjn zd$r1z$_nf}og9!&EzkD) z5cqy$jG#=RMT7Q&4U6pkyFG%=-Zc|RiH3Qn9M3{eq$x_WPoEgwsR+^9&Z@esBU~E! zhx5AlAG}-9j&Z|(U>`-+b6Kj*J&krClOz|*0p`_r9S@n=2I;K$v5<_$vBz<~5+M(99^0HWp1IrtG27KOyVw0$i`};lq$Xk<*)Nk%{Or|qy zBoz9M=Ys+u#2 z>VdNRWG#rcKByjE&h6=2D05OHvpR)jfU&N*vzk#hDi!GQYiY#Cv4XEag^&OUzLUca zzybwb?dN$wX1u67^Y;LH{==SB*K?@Zjz8L#QZ~=VsJ569h;rX&u8bBPCW__vRD2dk zoTBDww>Fw&ptD6VUoo}Dj~?_=k5sOp7qs3OT|%yYVpdF|EbkNlXJw{5CqGZ8v{l@- z-qO)P;nNhJKF1$s+7oI}svF-OD0XGCJ@d1-9HYvP^mTNYYi8#4a!aUB$AAaA!FkTA< z{tvKC3Pm*4)IZ;;1ks%YDxz37WOa5QYHdDyR*xWr_p?T` zFvJ&Z0@JPK=`nq~UM$g;t{~q1dTPEz>rs%u)o`CpWFB+j7LdN&(Mg#F>%}1sdU0x? zki~z=7b{B0khpS<;hCIQH3=JfS}6Wj6oZnLwjnOp4?K@;05`r~nYK^W*?5Jfn|j2z`(l5;u60|5@L+2+GSw*N&A{2E^nhh>!G~ z&4M?!Uj%cUH;)wM#V7`X$``F~9^Dq5D?Qvy=NK#Lov+cyEdY)VITc}N3qkxF8;Xrq)CMlH+!pyp=ps6e zI?Wg;VZ-=tx<^N8bdZF#mCUq!%VyHQ(lv3hODm0(dO=kqlIoX&c9H}Xfl{_eEMy}pF%gw0N|@bd zSuiH&AmZg8qYyoP(Hhe*B}TM=fOWi`k1yPI)G+HSjlr|jO<~5%s}^(ROMt!9484u| zj8A|-o5JWgIufqZKtVSL%+47%x9Ts$Qx60W!shVG*#|e95$@SYNd4lE5QUH6nhXu2VPAxm@;!QZU2!MAm!;o+NaEFXCj1V7xE;k ztJu1wh;62wQ;(ivF^McTYw)`nRcwK^czaQ-f-aAiCN7SV;IEIRlw?*viU=z1-uHm> z1{FSQfKLW>Rhop`((w+I4Dh2DBk!+>dk6UHxF^sC=W&ksD_D|?(G1+ZR7zspSr3c~ zQ_~ZKo(nCZ2I!?V4Q&FAd=6?3k`|{Cua3xyE>oJ)?1qYZ4oz_e`E}Wl zHv?7nDPC(8;wi<zGJC*F})oIym&otN- z><*<8>2eWh^4V`s-LORPLu|^8+$CGy{w@}KTmgb*|9*kGI|Af9q)fq@$lR7rO-)yh zuhAt*M~6oD(Ieb6iCetNB#bG7ezhkZ|FPvko^))|*<-lzDic#CB=>#rHGQ|!AY1|6 z5_{YdmwCRIb|>;a&Tu(ZX@lR8IzaZ+M9xT-$8-4IEw=)Ss4D3$`$KPB(igqyc6QM2 z_yp%ZLbG1C1_G_-mSAq^=L=+y?+#t*gwO5|P3Px44A~pcD)_WgNH+P3cZ-B?PYKqE2|>4+~#h-aHZOIM~KynHRJo0=JVQ_!l3WaiBal+;xYb;a6F$gm=oW5>g~x1ry)Q5^ z3G=b76hEHWhMz7#o3!{c+GmvN%xK+jREU_tykUyS&fZ)4(SLk4c^whIRrfQOu}QDa zi1Ks46`x$|EA`ze>0Tk1wnf2cJ2>M^-w1 za?1$1MKCnd${>M=_oA_OH}`ja7>OwG6t9HLW6WWzL*ju27S^T=G{uVTUvLG3v_OH~ zW&fI42cO}!JX-=n*Zi$MZVqj5iQEH$c7(LCDdp=!e);1i9_mt_{aOGKbq`td)O=s* zz^O$L-PzH*pv`dx-+d~uZ$#9k1oO+7$T}woHCRC$*C`rhzZ9nzFEAB0b*M8P7J-xl z3wAf-cTiy6+#k$vCpREL2DYzYH+I~Ps~Yh4GbBN6F9HC$^2vNX)r#B{vu+?g!CMZ3 z(;tAE4!yX!eb`WK^G!mn_SU(I3q9Ztjh9pXR3{shP3b>KD6g8qB(io@FzrotvEvci z`_(+Y&~T%q*X3x7%taai4#NQC(n%5alTBUp)-`q^VTUkGWm6-I$eRxqdu?>iffpOt zwZdb==NR80igf?NI?|O_8F>I!B-=t|t*Om%Q58u69_{5x@QEma0iYF^8in^TB|7k_ z`f4en`Vok*D3K3B)y@$}-C*>$J0)k9Hn5|NE*z(W?-m4T&)tShUL&YEE?W>`E;-5nYB8`d3ta|D+^yl%-N^HReVEgMek4Rrk*LSmX=FfUjgEazJHjG@r~#n?MG zXBuwn+8x`rZQC8&wr!(h+qT)UZQHh;^b==i?YHW!J*(!2^%w3Bca7^D$2iUqubJPH z@VWH1G{m(w<=F5%l#<*md+lt^B}c9$Y(9nls+H93tXqx%wpJ6G_p1;h6s3p>GQ#W1 zonp$ZmK%sLyG@ci`sIIfA~&P#d!1dCH=_Ips$b5<`P0CV3sN&!7c?0d9(m?`w^-t7GpH?_C{DH5b!Sn)C=!wUc0SQ6lMW_@y4 zG$4u^eG)=Wk^3Q`azEc{^F?QIKV0|r-+9o4k*|+qgj8B?^$C-g*3B~g4CfGPXAhH{ zRzqr;jw|q1mZvH8#_&s9u`?XY_H((ryLg|lp)4LOH8B#3$BVIfJfi1*J6HOm{i7)vfKXrKB2(%iwX6L>Nm&QP_8coi#`(wPkutWR1IUPSotfyt|^r z@gh|^p5MfllLLLJv`d98o$9J0y&{x`_!3C%jMn?K<*ur-!qz?BZA4s0wVQL{IA6!5 zdeup8>(Nw!@oonBHT%s*&eg7btpDP4a(#dN*aXBz;j)%= z+z~5c&m+wP#Ky~Kycic@zton0I}v=2%K#YsWJs_4dhG*=q`8;38Inbc>&ShPj+^hZ zYJ1r1|6i{V@X9##M|haR!*4fbw;O)<%K*Gzb597i?(+W$;JQEG29}?>t$>cL+O?i6 z4yrK0!kq3aq(%U$qvVI8)L6YkBZjaqh8d66HUfi<(ZapOJ?v`w^2AjDUl3wIWWbr{qAIqr|a>Xs6&K(djF$<#HpS6G6ARp`a@;)o1JsGY3 z0{Ag>4a&bOrqj*N=5+{sM;gPJMce&P_}1kxeW$W0|5rdP)f3|Lhar5ahM_XmDuq7( zX{jBY7BU^hqcX2v4~pmUo^G>!;)zRbsmhM+`oAr;9OyF!>)Rba-3pg(+Zv6Ev@mKe zKc?N*6wBBsRGEPloi3A&sD3GpaLnW&JTRtI!)RHmu7A@^H<85j1cVY7I(t|9#Qa)zKxHb)s`fjStT-g>e_8MnE zin;WlGLl~9Gr2Jt;zW)pP;qngOw>AqU01QYcz6nD6 zlSPmXVR8s1$aKL5(@g9X2}6X$Q~tAdy!WCKgS40?i4icPF`4c4D9P$~2|&rU*8|U> z|5!&Kz)Ph4ATG*>tHmt!7BH$aPL2$prxw*Q^!a$XIa(^1cp0x;LPkq{rKS&e8>f_I zr85R%nPU@s20G^`=9zktZ9vE4|u2TaBr8vC_w#^G79YiH53yg}2wb6j%!WE?NH{Gp&_nX_OM64@S96Y*kC~;v;N$r2)|c;-={sOKpVXK$^ic|o zit>L@%ghd<2J&8S1fRE@Y8Hg2{W&2^A)z=CAI_3}@TA^mlw532If&9S(%{($Td!81 zXKXJI%gx_5FYorgd#soJOtL0qXw}hHSNt7m(048~wftVo(%DQI&^`UQQ0s-@gBa$9IUAR zFkc00obb_ukbN>q3Tz1b>{kt*%FRB)5UNl^Ni8r-u>D0kKPYq zfUe-|-;#wr+DR3)`G+QmN`SA0tXNW0m|ETDptF$%7Vzc63nQ0fsa;d;TyEyI0oW^HwjO@y18$9sQx~+2Hh0>)4i7@bgMkf_c{Yv}#L>}tG zzGh9RUuH59wnF&sSWKl~$vu}6`wx>5z|fb4RgJky0s3$|9}sv_7C_FZR9EHW1R}4E z{JkPMWQG2_hT@oy2I2#INo#u$30IwF@F5h#^S|2vnuF8s zZHLP_1;kG2@{?Y2@kuuJhS-LXW|uDcy3@WjzM+5eN9lEpwIf-cD_m>N2*3De9~*iQ z&MXM2!>Hp{PH$jq~!5bgv8jjXXbIjp6ccq*Jx05dol1CqJ zLI)3Yq3+8v{kg`pS6Jmr;Wj#Ttq`bfz11na!O59da27F5^R0WEBg{6pZnNiE<6!qN zuqUU|6W7J9`b3$*&azcNkQC@sM#3rkNTiLCj7uzLbOM=%ZTFd-e#cCL@J5P^q&lvd ztWl0d%W}>_nZJYsX@plw9TsD4-aBM-YNOvm6NuVryzM%~vU>7#jExYK%#|sq`Mu4F z^SdHsMJ?dkA7rfOp@A%odT>%J0YT?y+%>@v;*2Gq<6?vcDkSI#qoOnUF1$QKc)-B2t-lcmSE_ zegePAlMTRT$biunrV$_pkxJyt0$+M99JkW_wBJolV)i38;B6mLU2 z*KiF>*rHfF4o{$Ev{@amA1rt0(-8)qigWn8NoO-35t#99=G9yi?}^z0YNd>4 zr>pHzjHCS*74#XB$LE?;*>zB z4BfG}sT^+><20h`m$6#}*^^Ffj5$bFsA&vSo@FHnk$O9_HBc3~vJh^BUb;JP5&QiT z=NOp&p76MJtH)weBLvyDVVmE~_XnirUA?A7l{~%jTgd{xj|e+1K>uxt$;AG@!s?ir znErEuny$TUgWCa6eE>U(ergHsi3Yg&-<0xo7Df%#cb?Op*uA}#kSZ18o}L!x4DSu7 z$I>d2iu#e3uzYa$<=+v&3L*55Iz|pYz_@(`&-UJI2>8PN`G~?1j8PQD>}lBtwPU4* z%@@D(dg=H)te!e%*6wqAoTzqlJ4Z89SgTdOSvdD?v>fwU5G!M_bjT+0)ku5D9AS8= zW?6I2y;KH-bYSG>LITakym0!g{$813e-uozbDd`E&Tz)cEz_NBnl83n>zML36J3G+|EH|r`lqa*9->|*_o}>W?v~kmr`8J3RJ&S9 zwT1zdK=De>4yLGCZ9=1i%euPUPY_f2<^TQw=rBOgR5=9WPx^49NVC0cWg}NAjZI`ZtltJ9s}qbQ zGU%#EAV06{?VZ$B6vsb>fX)nP6)`HXMc4?@5WUJiGbprQ5sCa^OGRkD?aK`8@{*7N z>=CzZo!rl4%Nh+XVD#dZyh?S)*7#`mhPVn=#Mm!jEd$UOpeYbWCA@!1UekUDsViEq zlmwDpOOV5x_AU~a$bynv8Dq7mYUVn>-t1V&pwPY`{433R{kQXR;w9NrAiMJ^T&kQo zopa2?x2Y?YCM)-qS75RGT2v5$6_g=-`V~G})R54OlFVWeisTfXI-3@;7OaeYi`n63i*Rh!qyiXQp7R%*Lu!FysEA0t zw;hmu0#N&qul{PT$#uUWb6G!cuxBJQc`Yi0tLaecT;_05waw&sylU*CKdEbCPokS? zeRfX`YRhUSd&5#BdO(eboKY=9U=K#6Gp5FJ(w6X*zW_Z%JVl-E_{-h2xvmm5yEVEhbg%D88&_Nk)@gun*uFoDvE!SQ8wMGVNR*E43>Y! z2BadiAcPwih~dIB8-p)GdWIpEN{HLTkGGUjYdSys=;Ze@=hZhs{WySU3!91yl30{` z^{RR<#K`M$7KgvB+V^E%+BRn1XmP8RPpLRFV|pGW-boi9mFk{6dl-!f?Ip-aSuRf2 zEESJFg-rgLcnsmb$D;G#g)kHVMiXg8gi21-2b>XnM+A7Wk;cSx)myG{+Ee;r$Hm`; zK5oobK-rvIktbYJX}9j$@(l&Yz4r%qCeC$ASX`Wn?x^O{v>0S^sp^(HjjJpol_4g> zwAdiX?1*nkAwZ4S5v<1b zXLx0G=wGCLZlbshDUo?wMWWbhyB=r3l-I6#Te2TL`*iJi`MX}}M-B9L!9nu9O|3Fp zSPvw{2jo1AHVWb^tztWCGUcOo$tr%{N=J%HA+a(hR+a@zi&xdk%3Uk{*4kk zwaZpoJ4@C_2BthH?3|q3MlGtvC6P~N%%Wc2m45rk+YO)Bh~{5H7%44#Sn!u!K^D0z zuZ(1pwbLZ=MzV*VU#8%Lo|t%+5Vmd{8np)8zAv%}b|B7HdE&)WPE0U3R-f~lJA>CA z90@XnxB{J;G$=Gu+Z23s>&H+i8F-+>W<7jd3rBAUvA^Ra_YM_V8)cuSrkgbl`Cy(! zdl`Xn#)hJneN)sSl5;KwO&C#l{w++r$?PW6DB=mao_ z$mtU}%f8Bf{@m-FBv`xS`|{hw{eIl>ea|@;eA4qc+ey0tEma?ICG`H=;NAQ6K)&?K zYt?sX6q5ODF+defc*luQFB$qM8YVuHq{6%fh44PV81tGaH~5J0F->yTy0#j6!osHS z1Ykrw>cRg5K1&8yC60G0m{WV4=qNcV zO3ro4g6GQ;roa2=tV#HpD`bLfIs@rLdtNJpD%<=+cfm1m4bXcVc9|Ua$F2Jz==@84 zW&9bq?)$8%xf=^r_j~7a>$457r1coE2$(+BH?%p6nfJLvDfjy|8ahjN4bx&~^4@Rw zhs@hNwD>16LREhCsIwTGKZtJ_j6}sTw%$`d6#@(}f9i>4rB!K&YoXKqR=mXP_eSkZ z&=#p{K5jNR&SB#3}9=}ZzLf{;iGmV{}eZ(C94o^dpyNwM4wG7L1uA=k!9k8Fr1 zhomw0-yWc8d&fVL4>7&>jj)%v=jEemaUMpKTUj0!n%Z(_PFGL`{>VUxgpp zmTsXR8J;|q_TfRrX!P!pgg0%^8ac_=3Xrz+w&b;BiM-9sU3XM8{p(~#?!BTr0QI|= z(t=$xXP(@xTD_J{VgM)EzDRNWp6ozXDBP6%tX#qpdT9Jw`f@>CG4eJT;J{Nss5L4b z)r1zd!a{6!Sw8=kYN~&13OiokBFu0<7*j$AkXf)S_Rn}?Rd;+=1GWh|fWn=yEH`PL zmUeNh?C?j53S5k(01JpApL`YOvr2l!E0nq&Nt$gja%UU+2uEm7zd}bkXbZGO`jami zGi(s_D((%Kipg6}_&Eg&4b4Bahq|?eMNF4%z6+3=P?NsKxnw)eAr)Nt3A#+BgAcu- zdKN`)<2{hcQNYEW?$9&86Np!05-8=6y&^umfRBg}8XA$$A-Q3jc+YO?+O_cuA>w=7 z^$6|sj@L47NSC z*kxdoHeH`#^7NtP3YJ-Rk_wx@(bVI$Gt#!KT42FMSGtUT=^z@;eBRX}n(KJ?Nv@$9 zVcb!z^wR~=bySd~uGdoDa~|y|Y|=xus~Lx+)S*cqHc>?fw2qml$T4TzoMOoGmterp zl6Ci8iOR_zBTsoWN2w0uE>>jH^yjlVH~Dvw~_za;ldlDQ!S zi})f<;=Y2B4?EIA=DPl)ZY3wRV1qjz0SzId$l03x|)VXpunOcZ|Zu!}NS^gXbI_ zf-$W31}La9;`S$dzyx^Lo+W3Yt(ri|haXxLYmtydYvTR_Z)DO^>l$1WO00?uwZ|BG z;dw#k7Vjk?v_b}H+Hy<5iXqy~}3G!w8#QwH3Yofvf4!PA?nsP_Mv0?tP@M~1ZEkYKYTNh0|MH)h0w#} z9R00Q8b=|0+hL_amwR4jkY`%+Bk#(DP&94O^v7$W&u}U^E^@Zu8v7bhk(s}&bsxlr zn0<=lLbA+pPskkob{lR8Boj0t49NV@9z;lz83HZN2P91p5s$S}rFp+nRKe;1t2g!1 z)1FykYOVUl7o2-i@^wgJ%-K@YL4>+g!Uh-Wz^PKPQ~l731CTTi#z9vY=l6WX8M9#Y{@oA`t zzhsIr54fAchVl|&0z$LGDzfb(-qlua7!Cwmi&QT2W=^n&PAy9|qgNy2mnO_*(gcc> z6Jl~9g<-b57?D~Kq+vX?sPlIaJ8z~OsoxQLF1Uu*-gD)F5Q50sePo^pq)bVtQ%7XV zcbE^1I&CaNkEeWL5R|f>U%3o5(yF8NkdM6h$}bqgkxEwULnwer(dyP6zk|m)KLuR4 zplI0;GHD3SUD@qVHwD0!8ijif@(N$R$YhI&)k4qA@S>n2idgy)5bzM?;0$cJ$QB0F z<~(@bFH8+Hg;)Glw%y>tR}l9zZ@ex zTJhrk1NNIJ#BcFQ(-}o!_KgZuXvLgO1^7+*g5RhGn&$(`Q2##Dgg@0;(qQxI>>OL?W_rrKUaXyMW$f{Y>y_sa zI(!&u2JQK_{vDnsB^6@Kp{6)3_EXGN9mef`5EzzW?ERP7hne|*HT$qK{b!|()_Ck= z8&c0H)f4cvgZ?j(uwO|)PFcnFLhz}y$BA51Iw#M{TT!T{lb;;Gpm41=k~)2{5tnCRQph}>Ki<#c zpaI@#v2@&Jhsn*4dmAzo+w9o44!+*$KWQEzFt!Bl89LWXAU3gk-vH__HY`c4b87FK z02lA+XLR@XblyPPt+W7DHm^sp8CaZf$MGU@!kSyCl#B3vhB4Ynj=Jov5{G=~Yj^dCY1^NQ;1PZmn|97dz5^ zb>R?77oiG(^$+u?_-hq`w zwmRTnAWD(V64)tkIF*iv8mq~|0jcRb8Wnr!O5gB^8ggZV->T;6G4%>kny8Z2(wndY zun~uov{-Sn#*K?PVXO64*dXxvxkx~K>ab*ksM5c+L#_8qWQvsv8SVj8WZF%K2DT`b zxj z?WB_p|Efo9IN#i>PnWd7gISr@+ztm!rdr)ccmFUyO(#No{B_&S*u{OYJLr*g&2om?9x> z@P%>YaPvYGZxQT0BS3*ce80|qdpOUhYlWw^Srj!SnfCwU!v~!!)Kgt~MeG zvbTAF%rt#=;`M0a)GSlYBV+fNJ96yl_wKVGW^oE;;ov%q&>%(td{ReY&2bnoWL}2$ zmS`J?VnV`YrBm?4bLIQ&1u4twqy{sKq!*tNd4!e31^VF9mFlvaM_;iE(xJ^V&o#lL6^k%&4}KOS*Ss2LB9=Q; z(-Q?vh*qCl2Zoh%K{HHH^Y=&n65N{Q$}S%6#Vz=?785^9d=~F z^1YH(_IGc>4)b5CMY?5VE?q*N zgy+CYePKB}qFGhWdivJd(jHVNeF?DdTPOYf`CTVkubyQvxLnQep0KV|#N%Cpq|l zD^IJv>>knq>02oi%W(CDb;6!&!5%BtMWSVtEfUZ%liJM_l(=x?O3fb^-DKVe*0U#{ z+ZPMVrBHB@Z0s__`!qKePf6oxOkiV@%!?jD^!@T;LosT0}`FO zp^aOApqtl8=P|^tIUH(t{8|fFM5R5W4!AWelV@+-=AX`%SN`X$Qj_V)gAn0dnF4wG zTAZot3V2ME!E>KXZ(ib3xx-2}?is#kSo*Qu-c|d%7mw-ASLxsKcQj>psG&FjwbjUo zh7+hz>Z`d6cbm-41kw=Rrrzp@0&6|5OzG__C`@dOxz?h+X(HyBUJk1APbm?Y&%{>O zvwJIfV0+ zXd;%c+c6Ox69&7#^OQg#IA+d9+JTDb@bo*=2_+&_NOYk7&hxSKA>bM_9q9AhawU_;eTvve{6+9<9r1lvnyVi67Gy-P?82r;!SRMgwtp}1&$jRq9iw9Mm8af(bAN>DO)?;K&?B4GH04T9?9-{i^E zT&ocZ^v6x4*WxWcDUaee4)^@qp5BA%FhZ0rjB9tUo`b7r9g3Z`mha6rOQEuw-=VPL zT!W$44PhO*Iz%@77B{24uQMa}4<5!*>eh%u$BorD0rD)kA8oQ=2#$6BdYvVnP7Ng2 z?zy;ti;2I(AwtWmEr&_~?%S>t5O34X7`%UD$V-p+LOmL%<=%6iwA&GC>xd&~rH<=x zrF4UAWto41eD`#R7_WX=`>;{7mz`Ug4O0gsxTNE@F4J^rsfy6!3wQRQcvjmv>L^E9 zMHrWQ?Y*zl6O1|Yia&mKPM_U9b1kvIc)ikgs6<+TL=+-LYiPzUI=zJVbRN#1Aq-L# zR09qATpszmxPKnYe}lb=^343V!R>#?rgQu!n_h!G9(&btpIbMF&@|u+gv|}=0DE*| zVkZPoS8*)ubJzI-P^Lv6Coai72jIf8Dn&_O)3AN=k4yIDWp`zEMLCBr{=?~d!K&4l z2lV>N{Q2z6DNZj6cY5P2&1z~y_e-=&m6IiS@4Xckz>i9B5XhdBZ(Mt##Gu;yf_;%H zIUOvfnv}In5nDKF`;F~k_sTTAyXQr}u;o}IT}SZbMKif5)=(Yepy{F3RHF%dAQ<%z z`Y|K-iBEpi)LPH&tO@o8-BDZx_0t7UXIgQF75~+*T;}vq2(Y$)mlyX(MhxV=3;YE6 z^osbf+o{Hgnn1p-#Ydm4_VfI(Bzxi$V7bDyb{ zsB=UVRpt=+y?kZHN9I>kN&$P@E{%O%ge>aklFc+2vdywO(+A#TP4QGp`cz-mmgMaJmKkTyb_G&!^TQoUWTQbq)_WCvSNQ7 zjce|&+`Vz`MgEyNFm!8;sMw)z#}cIP3~7GU60M2@AtMt!+^V)A?IA;^N!P$DKJKBn z{b`w>;T8iv%fwZcY;?LH)EbQ^O<}3%K#L-fWpziu((N4p{A$fUFB*Fgu{T z%y8bp#qet{t@T4;k$v zK^)@V+F6wVL;n<6sh+}hp*^wrxJvQa&5X$*39j3j{gM2PpCv{^HM;$RcIT+eR?^%8 ziEM0|iu(Tk7`ARcK>;|7x9QVfwIMvPoa?3 zIpa>zx)`gCw*4H#C3|k&UOj7Fnd9)yb2Ds%wVwv7lvGMXK(yZBBkUv{)5K2|jVXd9 z@R#x}qh*!)$yRB*ZG{xpoe81Qahu5RKPZ7s$G5AZP4%E1jt}$ITQ{VcTNyWRmWz1_!R1p4%BFROX-;-{bVb`l^Y!k*fz(s}3-~u8C8#HqU|nq#EG)HC zB9(sVK~hRGN67$f;j{)8LGZeuUZ+2g4vmD__NdgEYlxRJ`;^k08}|*F>*YgKp(&YU z#ma^%#;~FI#OF=17#)To8~Nj-;TY`i$IH{el><;SWN{i(Wf^9!c~Tl62-04&&|Fjh zD{U}7YuN+-mb%pdk3#29VWQze(T*@ta!@dnFk$Rsgy;ZB$wB^Z#Xzxt+(r(P4>^bk zdsrq_3!OvhR$2>2)1fTOEO7_bkm^k0M8MZTBoAZdzr_7rk(oq zZEji7cTXwO6X5Q}F(=e}Cg%x?ORL$Ngh@+^BVCGm|FbK{HB_08Eh5j&|moM%VYvCFC!CnY4y zxk-tq8^}W|17cdrn8W>=ca~$%`KAjpDLU(P+|VX|eq)gV4H87Lf$X-cWK>5A#<3qq zI+iUKTnHzTc4Ib>q~Ee_df<9mddQ$FQf=$Sa1UeYrn{p23Z89@x*B#C!LwE+C%Lat zZkk&b(gG>C6W|- zHIwt1+HX$nTlkg;S*ZR(TGn*0e!g;4q}I2TjO#LCbl zOFWeg7LE0n#MGQwn-+o3p2(NoY{mlBu6mU1hMsQ26`1!eL+>zt%tH(?4YQliX<*nJ zK@UWp^BxVKYZ?40iF@<5BPU9ym*u*|m%wghQRa3;meyvP|KhY@n~%pBHkW`_JDkz9 zQNB(}q2trsGTCM=0lwtw-U0V;ahxrv8n38qjl**sd*w~Oj!(|>X@l+(ap?PSi+w}5 zOfNe2op$EuB1f(%huwryd}HH-?Oqn}7`fHv&-ufK5nZg~3~?v0)Z(>=KDHEYE|tpX zx@%sRh6T5Rs~tTnvBattjSD?4$6HE9Ro#u~_19bS*MemB;I9fbV>FHQ&70BFo-4Ri zIn6qJ^SMC|)@9kx-d0^kmpeZywj?rx)t!Rz!IF%(TpY8r31=8uYs{!-t+iyU8ZH)& zbYDY%3<#i3+A@n`R4D{0=8mIZgR>#UL{4Pkmd0BH2Z`tvgl^Cm7#Wn#5rkAkQ*2UN zy^FlTp&2ttziz22dgF#Az>%agi382}@`^h_pLHGoDi9n{%+w)0$(dYvvo+aWYDw|} z22V98zQVN{EnX~pDY7U8EP?65Tb_~k)4Y8b1`j^Q;TP!h%sxTQNifTcN+8H>F7iYAr(!3s{Q3l|t~ekG#6>k^iS z^0Q!dvF~kID!lLhl+vOLmO{OJGB>IXxhGtYbD^F_+8q*#_%;fpFF+Sb zHv!miAz?RHoU;D_4YWJfw%Gc394z2znRzXkxO$XH8Z8sT+G5Q0lDj+<{d~*Lvln~a zB(4(@{CIphwCOF+w67&T0o2*KL1^v$J{`Q@8wX3TA_-3XLytV}R^L%-sa@XX{70H( z+mu#--iA6*VhJF94=z4M4u0=`O_vtge8pA5_DoE(nDX=^SB zWdUGm*&XHY*N=j|X&NRGzCQVfi7Jdd7ET*Z{y{HLftK42G%gv{?( zv$6d+Az0k62*cz-3%sl?hi^P^zrf4g&i7q`P=YVRACtzR94x{AHEHm}3o{!Y-`&5Q zrc`a(t^nU;9a}9o-p3iC}PYT1kRoU(`yP9Q;z$?F>CJ z^F4TUU?J_16FloN>G5&a=18_-22Y_Dvtx>6T||K{&4X1VSI}9jtp@~Y#)0M)$qRRj zi4NI@h9??N>E<78?wXF~=a;+n4iU(ng3a-#O*R`cj$Q)L>kA<|K2CNPqt5phu)~!d zBz4A6svdqLoefB!2&WCk*#xt~(xJ6GPGy;CO@ih){^gr2cBB-_kGYe`B@nU_)X>`# zGqNt_cSgO5OEuMeYIy9%g>qbWB?-!|a~Ri@T@?gZC4kE2zuQr`t(~`5_??R;5pUaa zHz2nn9DEFNeewp(!lo^nL}hm9q6fu(Qsd|rZ`BvZe=MNXDA|4_=w(ubdip7jb3$mi zlpB+~1rAh0QA+DWU0oYD&=;9>iNHlJ6Opx8{o;HGFcaZr55M?6uc7*8z;fv;gXd-4 zsCr9I0#sKy#k0KxyZ3XpH1)&L*}>FGfeQNc6x@`gd7mNUI>N#; zvaIjxno)q%kC6GoI?eN$81WmCEghkEF%5S29F0b?BWks2^dA~Y(Q7IVEU<&5>y|f?E)^u0QlXJ7jtwXoJ-Fr3 zoL+PsQ1wKZN7}|znX$82CTF4e1!RoqqHNR^iKJRg-YfEtc^yZH>qs5iPs)MI#=p~w z{!WG?y1~W!qL;cOxtE#iEu60y3AuoUnFlYBlyXZmvXQ)Zv@E_!f?^*JlSW>YQhoGDCzm#;#@xNwsJiXmX0?L^C&gp|)6zc92r4IVW_!ggaCbAk zqq4K3iVq3I#4?uhQc>j{e&JGQwMAGutQjF6hVw?^n>rejBQgur+`NOb-^n$rO*HA! zi@Jx10?!7H^V2BH3ygcgEb#2Fo!}w|%O6oFtHPG+fwFNPu1q!sW~5uG4wNoU;ni=F z@~^>0=k~AKRIgn5tzD^|hqOwkLvzs6>~x(z&@Dv|T322=n5;CRG$$2(u^p}3K3s9Z zuH^m)rXu!s`nSE$G!&d_2OUwU&gLtld8+OP__O_P?#UhEkmkxxVeW2+;4Yut(E? zF{O#tySOpz4655)qACV@5A3qml9EC--leld@^bK*_!b)5UAxMKo}JqI%*DVmP$ibL zCApfE#iuUUPS2&%O}o+7=6B?WzR+FIy##JQHrhhW>up=?5^@ctxz9+}rClg!6`*N9 zWn(9o-P=Mj2!u85Bcmg+nyodk8$ykJ!9=fMf6uTqbcj{BT%o8*;8l=ZurD_dHi!7e zp14NLI!@?}9X-d?;7-fdp4e7WhD;Dks3kSJsg`{kld}EjAeTRJzr1=FP8@`LJrgIu zNJLHBIWJM(<6gM7bozRa?4UbT-ey#6!xo-G7zj<6mH5sZYu6??==b~LG3}2g87^z+ zr@Atu*W10VfPn`~h=Va&#H% zXZg}}@MJuqFz~sw5ffbg;Bs!1TRiQO@8EG;P=TJrC6G#zYv5^h#E2`Q?{)bT;H#ptp_QDB^-t~o zk(52DB*ZEXwcVRcV6l$lw0+a}u{%NMr~kTQb$K974qyhl$hc7~hXL{YbIysXyZ6VL zcmlIrE5EA%xv#*U6U8*dNJ%b_AC2w8fxgg^v2NFqmOA0zd5~gq%k34zDg@dr+xFY$ zt@j%3CitWE%f}I>cp1@&#S`6){=rMeBaduxu9vr<{2T$C*uzq(U0*nniR6TBd@*n9 z>IFtzW{M=@wHP_^ye}2WY$~%-7q#gDj^`jpjczlyvAjzORZSo>M^vTIyVdYa)%I1f zWCsv)&V`#-(KO$9uoVlSB^aU#=W;z z;0>r|L;NwF)_(2bf<4rma_udvV(*%$^#1eW=t-rauo;Qux#{_mV?Y@GjL0q*{R_%7R!ejvUl z5VMz3NY*aMc-Z)D(x0Zczos-+JMLk_F6?L-xuk3osveV^K`qe0Q?rzDPL$-ye(?kO0Z?M`^)pZ2iOXbIy%rs_R z+2V;c$h07H*~N`2QEZF3qS{v(`4bZNQ9}T)4VxwA7T!W^vBleYrz;!<*RA6;K=ss@ z-~Pu24EO!@@oob5mjTm&-f>1(^`l&;D!FnKrIu{>7JBsS`B6dc`0J8XCVTs-m%5CQ z^yAC4VF!i-=k0U%Ja2J!Q!}`3Rlx7U&rjN!W5!&W$VS(YVDhb2MufrJh z{^<-1E$gk)h?iO?%6NzHbxC5?(R5fNd|quLzQbFm=l?Gjtxo=lMQwEYS~`8T$*P-u zc9$9&Z`U&7z=2-R4-AqTCw~7(?JnxgG*5Yu+5b+772s}a%o{E=XVjP5ER@JfJtwPr z-fDXCQCnNObQ8VBuKTd6f0k}k{gh`hXG|G4b#&>poUdIO{rUO$#Qg(JrI76)@g_Y5 zS3}7$44k@5k6@ZqLN0n17!lqy0bqK$6(Q#2w>;O>$(7M4;W*UB+Edx8LDL`{p`Z19 zO#RDpnF>=2$gxNg)r0&9^jvGcW*1YZ41y}8D!(F~uR<&q-tr?myE;8Hv!mz!^3^wk zYo-4+9Bo^Q4CGs?p>|EAzLiPurC)6uUXRUDMQV_i5GK36Etfl>#o6e<*8J>e(P4PO zjU-1mZ>Sw^g8plhY@=;A*qGG{ooQp7hbV^PTj&cI zPxGnrJ?_TF=69Lfyp%;a7`+yCL11PV_$pK@Wnsf&>uFQ2lj(#PQ4ZIG=_O#!tOT;3 zW1&I2wa((ww0KVzdkpD5c7q@$zs)TFk(v{C?$)=8{XL1a0H-&;0-+Fce`qvYs zqOgbi2CO#fYJqG$w1eqvhT2%5D8s&xz#AIq;f5+{v%nW#F#FXwr+;x5!CnhjS z4E@OIv=~!uW!Y2Kek0ZuB!Ufm>25*O*4R(pz2GS3%1%Bc;*PIUUaEy}jIN@`su36< zC2KaVVX%j*`Igumss8;ezPD`ULM>v`!LaL|9?NXs^3EqhaK#^pvi3k2W_nVMBzgrB z{QH?ypuDlc)5rA8^VEI%SU;h?O-1w9zuc;%3_o?TkSp#y39UJ+c&Fu8)VkBUJ8#-M zM(+UcK{uI#{s|}VlR<>r3Nm^i!<0+&0lu+-;bk&|Eg8e(W>K8fLfS>FNeczCHpxlY zZv)Em$9?q}hC@pl>6}iF)AqOyHkI_utS;YFPzA)qiA)fX|@NyQI`-&G@m@lSzr4Qii>E%y)eA}DEhyr3?ZvSdweo9N! zeuI%W;3WOGLjEQaiqa!R+3Pm)ertIg6MXJEx`8Owjw9GlzvMNm$J77A*gOAr7VzEL zwK=shb*Hwcwr$&XJ9Yc5ZQHhO+qUiY?R}E>g!}BlfWGCyh_qx`ll5tzC&z5FT3Xrt!)TLhhhZ&@Tw5Y$hd659RMRS6~BnVdOX57wvnT@4~RQ3-9 zc-QEFTnGb&m|ITEy#LQ7NZLb;UC23te;40SK;%AXad;xV_Nvj?#1rF8tH^g}i>ItO zan;xD?{>&5FHNJy28{cikc0BP+3<&?FlIm3bz%-hgKDAvq%0!Li zYDj;tyyt!~Abc>k5flDSk|fmK5K>QwjGA8kzVye9J*YpDqm3PbwL}Ic%DNUoQDitH0m$X{CvmDwGvmkG+ug*suA+ogFc{6ml!tFg z_s6f2r1?Frqoh_fcoNEsN(2`fb>-s;42KIly(n)&H{cT@ZamTWRk$fjdvj13o1>RG zn_)G3T(5p41p&G5(QZtvK9>LVh3FkmXt+J}BdNx)2m>DNTF-?CQx;j`;;_Ym%ukH_ z;u2U5n-#RA>%PuT9>D)`UqD6Ophy|CzTotFV@56Y~}63*m1nU z7jR$T*d25K!I!F6N{2_y$7u2$@RZ{lT%ZL9S?Qxv#G0>R$uz)J(RH|F?s7V5L{-Xb zkxT+^CZs^b?hA8>3U15Rhu9&zvdQykw*J)SBCnVuhq-y2Xel2?w%(A~OCFXcZM6wd z-JV;=CPMrf&#;%yerbjZ*%r*Hw6GPDD$FLD;R_W8aWrvZE5*u8{oYcnx#+8KdcBDD zt-4uS)s-u3IM>eJzugx{iV+T#Sro9sjgue*(*l zzGKe%t;W1QmujKKy2gVvx{K_*DP(4gJ8vB6Kzo4!V-7wI&A9j!v%Mhjs_`|bZ>VZj z(KaZPv*_n>!$~hy*f>MBfLNp!Ngcm)v9UZ>+S@pt9yi6Yei#~y<$;KDSkX-)&AusV zma;b`~<82+EY>mt2694(=6UaF+`3p7E zk%2s;z`*Ner*OyNuiObYjsv~zw=$BSCcn5T)wV>)I0o7}C?~xticer`6Hvct(ZDTx zk+5ToOu`O%(sb#XsG68uU2Dd<0_(bi4)cHB^@k9ALUsC1e2-wpB?f{En0|{xq(#M3 zqt_$W=IQP?JChwvUffAoTnm=2N>PNsVSAkA?9q%jMgGu5?|)Y8e~*~g-@FYa6j+4; zm(69#IfXF*-ztrCgf2C_E57g3@2bIQ)Bh=7{;&SGGchpySH2w7Y>i@SMV|UZ^#Fdn zGeNPtYjl3U4xc9Leu|e9l@`eI9nGu1_m;WMnauQN_;7#S7G6Ah*mHJI z^RJF-d%c#>X&gSA2Z|PXWoctMaNt;uu^HR7k-QnS?GH14W$Dffx6`HIjO|nNblpGH z#T>O#c6)tUnW?+l{{@xySm60N6@7N?Qe67Y>uKii+9B8cPzAq(ZFH%{hnS{bcyYLo zoeG~9W^bkme7QK%S23(jej=u>(_7h3#5_As&~^3dHcxp^CTMrqd*+h~kk04(EFPmo zp!)uP9}S{^nVtLo=KcJ9SjU;05`w3U6k^U8&9zG9CtUCQg0#arw7wD2Ik!=9kDD%O zXj}1eD`echgEAf;=IE}NiyzAuk@jE=XgHJDMXNmqcEF-+7P`X{w?Tm$VmZ1?J>_}nYz=a6y=_J1@cYDdEc*R&) zl()<-keMf^nu8CCrWLsn544C_0@$Yf!S9iRO+SPnbY%fu0;+T%0C3hm6spfLUb!;{c4CJm7zN6}sI=qGK`1&WdBg?@UF8DY9a6bD9kNnLCl6?$jKD6v{I6DR zHpGQ-K^rmE^4yQ~*j&V+!V>V171jJgwLP;v; zT8Pv#*<4pyf@75_yMV;;a|_eWtDg*B%^p+obF5KQ#%5zI_e|q~LM;Dc!bi?wN7x~q z@KWf?|Fev>kK%Cp@~vWgu0Te391=>)AkQ623*CM~0c2GW(Meih>iTu45!pJ&zz(5+ zF=FWQORt)cXhWG&D5x<&cMD%;DuyejgD=|s+kvwi2(-5&r9X43PHCvu-@PFq#+GsZ zN8V45sWmr0(&A>x2)h_dyOgt%W|;Lz7!5Mi?+syN6F~>{#!tv^1~T@LLs>>8NSeL} z^g#93govh=4@%P5TBRly|3%p2Z^ppB4H4MzTCTtBaHN0!W*xjk%=n(KvS7k-%Oi3P z36sz}E)1;C3y)i_E8H+6W1Ek+%utQ}>1BVSyo%N1ScmRJXAM_y6L7-$#H+_Jl zP7lkaHU>v4C#G8L#W)Il`5Mnn@Q++Pp@RdV%J*XFC;~uwi<>YF96!8;zj~%foFk^q zjSEvP5eLwWSze+@3kvQ|A-aDZQ-G5IP+; z9py1d#T@!YEqf}YQpz}*+pW<8-VB z^Y2?Ul?u!rR8~0u>s-$?R`)E4SeM+Q`N(XqTThl!k#qu}&RAqepFKmCGaeXdimK{GGA(`$6J~|gD15_IVF&V`&?PI z)F#g4Z05?u$8nQoY0gcxa=TxU!j+|@I6z_$ELS9qFFzH+#!Sr{kzxt-g5Xg?ehF^LyyBFtKTo&P~INr;$ z%jYFOweEedj+0u3&tHJ4T$zB+=p~NUzi8>D+`aPr-NHHkLPMurOlWrc48zixaLf|0IY@HgavhlC*=a;}R*Z^%zovx7 zVlgv%Jt##G)KplBgRs`d8NbW>GFM&b>*6^=Vw1=ZJ|Z zZiRUi_OBt=H+ z4QN_{Lr01=)5P`*j2K?Uo2{L?vJ-VCWl9-LtCW4Ha$an@ARDN#QSh1@n-kyoN6Cqo zf9`mO#9hm)hhe8BtTJcMDoi}BE_gj)>6fJy6o4*G)poif;>t*@adoJ;vcpzct)U!c zX^eb`QNz-jMBpRH|>f4qQg<%p)8}WEa|IRnEdCj^8tIl0qs(4 zIzLOKp7rCCcA(fF| zpX=yOHtSlgW(N^1U+ZGzwSXNYQJK2+qLZ^+ramsTq`CO@wkFZ?juqS^DPb@MeA@bE z=`*4o6Q$B*yJ(kS3ZT4z42+k`j(;a!qyAyLLjtsTZ(Po{%wwSXkqa4_>GYKvHOH%9t-;#9Uc9wfd1rBN3*Uof`Mi)1{*&=K!n5__LY1pT8Wus8TNZKbKDR)VFO@-Y3ei#qIA9sFpMnfykcg~)M zBbs=z*{;=anoF(Yu>0E5zURGJLr9OBi9vWq_#NiB-uV+&QH;hQcC7Jf@;D1@?c1rh zF-TxN%1E5c4mB_7Ht$vd7_ARAh(m>UFxSm7Xr0T`6^I;qd=G$gRt~q(V%06?W?2p9 z6T!SVhOOD#Knvc1@zTI6Rt{1{tNN#bwV~WsM4%TUDwkJUDKhHn#FTKBk%rr)y(5(W z)+T0Nj$ut$({0m6^k0-scqJUGc<@eZ&Fc<6zut@iBG%tn7v} zEeFNH|2^h8g{{{6ds+I+Qj@9W!zz6lL#7}LUnV$!IC!vR@gi-uwT#5$eWQbPB?)s5 zYq-q(MIqL0K3%Nn9p-VP;d)ald%^W%96)+5!b z9^U(hSTRS9&_4KC@P5u1A?!1Go|}&2vQJt?`*oJ;Pc`mX5%@nPU${@KHt$NI)|nTI z{eD!==ER|e-T&MgnHk_u!mtyhQ?KDN$779vQXRIJ%`vydmZxdHtg*0R-Qv}vLD}z8 z2SB}lw{NNzRK4z>&(G`A>-lK{F`Sq*MGdG^C-6V@P8oASJR>g=?IKirgXmq%eSn%D zX8eeu{$6%h=m5;$aiF10RtD?sV0U%yYs6g(m5v;@p4nD8bs$QBOU)1;K!!%S8%?5) z-p0QnG$t~KP*GZd@6JnqV4&}(kOP~OHFhMLGrjUhQlxm|*|@9L{R@UKT8ZM2%G=L< z42(MzF(@~Y{8BrY_dFcrHfZ%l$bg!#&R_Xolf9nxo0ncd*D9f%KMBNHYblH@Jyq-% z9SB=4Wa4PtEgVyS`OvxA?Q@y=&MGEfCT;{TI=0{B3EIEIez!t~aG(jx`IqL|BAi6^ z@e*5hL@~S_)R(s@-(tq;hkHyN*6ojv1Q>c+yIxSVKRx?soKpx=x8H)US=+PmW=;di zqWRk+*N_kCtld7%9w`LSQ=B{F+t+ws6XWrXCOQe%EV!n4^0{np??KEx>!rf7w|gGa(V}_BTk^!iVn} z=oz7R@mtfqDt(o!f~Vm~8vj5Fb#Z6HDC@OY5wt)7XCkDBOx0d@Cze!M7e5F}Kvc); z+-V9Qfx{_1PeW(cjYX?C(gn3n8FhXMv8S@cB`&|7s9ooPj%rywO46jr;)7nevZO4T zu#3T~xo%#2>#{KwsaUrlRfYblwbL&Fu!d*^B?kkw9@`t61 z5NaIT-8cfL$a#~?>|^3U|Fq}#-C^190{H{9Vpu@?ZP7B%O2n61UCORJed~X(W(*Te zNbjD?fc9EI>=*cJ@oe3s78+JY03vcC(|e`cbtP&&JER*9WC0osaPW+i z9KyzbWd=JuGJT)A_*v9l$_%z3ZC$C+H~EuXWt}kOgL^W zO*LKBjU@@IAZo2wu|$Q@begl*VA5FBkSq{-iw!M6sCe}6jA{nZ)8L#ASVLn6oR8wWQZ3VH>5 z<1$srZ3sv_2TAq6}^AHq1mU7xnek4zrDxruSVRhAzT~qc}dPNy$dK zCiE`u$%iZTR(0SHT~!dJtdpec{}^@E*st5cexowp!3?euwDA7#SKHKtAKv)+Rk6Llw7GMmE z1(b_0ct2O=BZZk+86&FA=Fnc%&sH0FFUBt~dNSRGhWdpBz zgvsuxa-xGH4QtHG3xn|$>cfMa#9@K<)4$7Jg??fliC1bLDT@Eo7%=0e?}wq&gpKaI zV4>F6UKu>-Ye(|5174!4vEhq3_0Q$4V|{iJ--V%=WJADA+sI{HoT}bNTpRqw$1vQ= z+kN$*$~zA9p*(V#?E-0DlX3vE+2Ms*x~Nf`YM6L_`YraEX!^5l)DjV}yoTVpRBViv zCHVPyS$s9UeK$zJ<9U5BnH?W)p`wqR?0Z)J^)iqr!QWwFkoajHrguvQoE%G z&|L~5mfG1H1P0mrnuotX&!sAoDey>s!lJkqm$gTrbSjuH-#tS?g=%{z*o~&MPmZ5u zGCOd(L&pC=g^S56jyWpWd{}4Y5y>i=ng_DMN4m{vU30*y-x}wse$VGlu0{Uh^^lol z2nJ~HHoU`h${f&6%(esb#2{whHqiE*NYRsCM1;1XT^ai}Q%>uet&z4Nw0Kk+Ya zApApAgdsg|z6}l}Op_hr93}$BD|nT~O*SWm?9C;CnEP3ktWeBW4m&X3*&aS z5tLioX23;3fCR7=>}S;GerBL9A?vTAvJx$Hs?v~*J)begLQyKL!q^}8W)@lp0k~l% zi#sf&ckF-uIm@04HS*@72YB)XyK-^!)*PEI!y~RO(WP10x=%35F{=ZwRej9$9Vm<}A`r2X;qE4tjgYFDS0n7$#?4#;n~$7^=)faYs= z4>hra*8jNlB(+p@oeF@-dB(VsZ=^HlZ`d!BiYlq30?NZ0L={NB{xi-*%5iBgy{ug1 zO{?1R798B|`{6zZvvQ0|kHKL|+m{Wy3{&{C=6#%1^@E*$z0^_{dwn_^j7^)osm8_| z;`)3unp>u(qJ4cGKP;afUs6pZP3!tt_E3wsCxl*c0 z98F|8Vibm~sR**s5I9f~7`em>PB3HrWaCXITSz}Tb*<1ug7$u$Y)OKg|v?A;9_X(YM;7>)SS=JymXVP;y5 zA}zWO^Gg!*iby0)67oY!ivFIwj(N$ua z<5YAWkgi2zm6{ywAzA%MNNObeFx-QtL3s)Bjpy!Pr1qJjH=x1?xQMwAgG4Dx6Wz$C z^fB3t^TO5;GkN@qX6l-NJOxbe3@d zpl%-@Rjr&@lONRpsGzF)hR?&%1?n(Y?~1BC(ph>n^EyKi-M2B@$){UR6b{uzT9!pw ze;4+|5Ct#+v#e>$rvxFEQ_2u|(-A4pZW=-7B5YuTPWW2X|XMR$d)Vmfs#(x2Kqa5#Z`2O4;=Z(!PsEy$*Q#l|Vxqub(k>r@1c$*2*YJ zKJg6pLhPG;xC?Xd7xw)E{EHyE4$e^HZA{m;1 z2u;8QC={UI^}=77MNA$Z9JGerV~TG_SB>>W+_FW}qgRHm$xoIvk;XzXYSkVFieYrd zx<6&qqNVgt5M$I(kvM8}3+nhOlYbDSg|YLF88;yQi?s2v{>>ZmH(}iDH-PDiXH^X8 z>DWJtFf5S64mCa0aE}g59E&`wKn3nb=h_9_j|CMKNh&z2_Jsyck41cEwkY1Wovq0l zpcw^f?$jq`-f8@H4>Eo6KuXu*JPr*^H209|&SAwJ`OdKf5mm-|1lYv8aHCBd;eo8; z<%iqWt6efi@RwEp^kvaQ&z`OKtW9vGVK4PJvlj@Tlkc${4G945DC6cI;0UDpar(tT zfQLIXlJktuURcJs^a1iFyYDLPO>j^ckh%Sq>WiJ>R#Hr{@1!F@qHv6N4O?p2T0l61 z3W)~Vkud#yu`|lMcy=6vt{KsZ9yWtQxLXHLph>~sz2CZYRXD_94Huxs}B70St8H(S_O>t75W=M@V)hfzvW|c9=1GR@EaPN%sre;$$oTodAv1ha* z7JddQY=YMQOGB^l?nvVV#6X-h<~Hf}86U_tg^*M3=Kp7IC-rQNgBSbE#1V_;g7$Pe zUuDPcYAJshQeGw7mWJN1J>^OtMEi&f_q*qnGAN3|v2a|@$DfA;X&*_i4T_3|@0x4H z^EjM`(`NH9W^_%7^l=2misIjp+USg*($e1eEc~;hN)kEhZMu_AB~EXu}P8AD0Du!>2Q0B zKaFcW$PaG0z=*zX;D#EV1lxm#X{K{58(Qs8^a-hjm1Ur_y~6#vrUud;{@T^Etxu#2-FY!B zqhawer(@VK$T~q7=~-zvQ0V=p4sjGzJ%`F}KtzG_Ln24Fcxe2!(AV3}d6ggGUa&BB zF9kUfO8r?CKF4y722X!6BSmT97D9}V=Pc5q#Bs?>Lfp#uA)HYvPcof?>J zVyw29Cy;kqR%=ImaWnLEm8tcY+y&djMy;mPWYCjU=sKKSpYJ9lxlhb}v{>eIC9Z@T zVw&1ED2MLd;F!ns=z8;rJ10LeBl?RVj@PLV!V2@fpMSC74e=g_hyL`pENnNqySatq>K_} zv`%qdmrIwuYS355=}idy+`E(AyYqcNnU?AKplZ6@FKANyN#Pz4g?tDs@LQNFVyNiEUI$-sViHJ4I|;OQj}0c@wk7v(hV! zmT`W#%KbCD-#uSL4N;4(Fppwv9) zESD=6TT*TvrQPL~a!%;6=9FgcY%s65-eePKs|hu&)bKAG{TGkoP&I{qz!3?;SzADK zMsYW;wJ0$12e~iHoJB;_IE9ns%@ZU@MZqy)+t4+pAy^^0Cf!0>Q5kuw!F+Uj7q`-w zVpCla*CR#*fJ`Jh;H?98;X{dv_Zi;ry>>Vid4Nx&)C$yJ84BZQ{^ZcJUY2EJr^59>j_0$J+}mKDsW3~M;|vY@N^&k!+fmA1l{m_9~F>06OM@e&F(G#Oybso!9afp z+fH|Dw{~obfV*YEC&yzuzd-%A`L%mr(HC<|TmaP_*z5D~8gd%T8+?n%U4*>A zGR3lcN2BYLaH>y4;mCuJ%@^KLfvucCBoDyt`XB?du`mxCT z{G%{z80N?{jeX+Syjx{s{P^ayKYD=r(r8p64O$Nz{+)S^bo}*Ty)1M1 z@!nJ5>hYr57;lW*{mn{YnBv0d`+a<~yt`~z-VfB1An;A7BD$OMObb2T>p%mKpJwSe zTrU{!wh>hqRsJ4X9x_xOc#cvAH902{G_ z4Qk3fKl#9KHbm*JmwnXKG-V&;v`HQbn_Rr8p}->PPTeA1uu?>5VFi(Iy_cy{sG+1L zO?_q%c~J3yKav=4zAuRZAgCa|30y|9204e$(QWTGC2aSNdv7C`LRF$>KnIi3S9*1l zC1?Si$*rD&xK?pklO1jc*fny3?hkxgMe}b;zQL!nFQS1>!i{CQeqzqP>#aSKYzt!} zIkHv|(n29~yIhU)Q|uqKEb^M_qUY0@?pJ#nYCvHitoxoMNp3xK+!%{f5Jo^5e07`E zzsJRQlR8D}#p`pY>K?M|6h=fQ8fu{+?0;DY=uZre^i{a zh5psSkjPFmK5jjp7za^SUs{LT34S}P5K`ySR474L2va!XKyrVR2)maT85bs(M@hzj z1qQDg9YES0BkWJnGK|Z+C@t(nv!%2-c;xew+ArL>k6jz8`UO>0eIgdaEtMnKrjgA? ziXMm!C8|0-^^%e)C!;|w1r@z%o;=aRp^vRr{@F$JL+T5XOYjL#gKnAmT?5p8q$zpP z-F>y&S!e_XZ=|UvSPv|r>i$OjoQw36C=yW~5nahzLFDBCD%-nSLfxsi$m+qe#TMx~ zAq_YQVsJo#SQKp`%O;>D+R`@BwXsc_E-y}QfAF6>@&SYs!X0-KMT6OPC6FG3nTcVF zQx3sISCuHtd)L)0vO+6ZVZSWfyk4)X!8%BX2#oo1^;shDdz((CxY^|;4uR;hlmkw& z;%s#oXs7J^iHl--0e6svJJQ6wzS`~=Dx!!NZRB4K9^;K0Y29)U&37e!Dd|4T1oWra z4u!=a*99ELMegejdgZn@u-l=*bHq68a^ z#fRZFQhNQ4$Z62IlIxDL@P@0~O3Dts2eNtwDB|)_2kgIaDOrX;btml2SHaCi^$h_D zxKoR-uQ~>uw8z+iICS``OxMk54KgT<`eswk%p}KUp~*x1Y>aFQsTt800@Z&(AR)xf zamjc__G8c+_7<6)`1S126$bGBJ<>5cVj~Z8Dx9TpD=;}}+bJTRl3|#g$A=t>53?{J z0&LXS-sJfwa42z{K3WLT;l1?vy!ICOGuZHS?n`owe#9QP2OQfZZ8yFP<>o%)w(ZT zF4cw|DKKkJC#%50_KBH&MW0vG4Yg~5(eFOk#fmV5STKM*g9I?a(Z_xb`kN( zvEz~4#!<$51KUgwkn@;wPrrU>x%lYt4yHDmAk&>{;EgV0YGau+YK(@UQ(b=gcWWqV zF}lpdG>-6(Fa?g{Sicj^>722`*P!FZ*hEE0^r+%9&%8bb?Oz1an7rhK+H5SR+n_8; z%{?d06zpJ#9ZHW%K4GTGxjG=OsPxZa(w0b7na$$6WI!7-wv)Q+svVp72NS2pyKR+%us< zPh`1IMT;S>#?e%|W`e8xkGT$QE0kX3xuHOzv`z1+8j`0zjseDbVa`ATj>XuZ zAR*0orp)%k1}<5Ta@aJyywMEil`_2vSo7GH7#1;DmAC}@(?!Jn6yzI~PbgkwC>Xb= z@DQ(RH&mgus{GV^S!`JV+U8SIqg!-InJQB%(_ZJ>(@BM6EMr8-Quh``Z_xfI%Smbl zjdPP1e^|3xy`E3h7{)`&u?k}CtRUynj=y`&^;&=kBkFe&T}lBrId`aRPByn03m7wb zcM!hFhU^5jOHo*B{(x3_v>{O&U8(K;?Zg zUvrri4(vIh#}C;T#gtZAPQSfGtcn+JIN zA#T@xdKGf669anWJ|=q2?}z$Wkp18TGMKI-Z8}|U#|0Mw&KM$)p6D=%$Z0UKF z5u$GJFH)MBvc#g>F^1&U%cuPCB$Q&=ZPSp|>wo)ff#p+wZVY{d)2od0wf)u^yDR>D zhhfb)-97{!YPk>i%DjDp8TZZq@-?>Y_L;I2pSIXKQ_cqhoKLl<%8s!JYN{Q%SAT2u z_`7RIy;lQ*0?JZ5!t^wlYfFSL(0MyiJ5NO(8rioKAvf?3?Rw-cIEjqA&9>eRk26ea2(4R zQ8)x+=r9Ii%2&n$$!>OinE*0#$f;`RJ9U#qw{va!MG=tCS@cjs1>Q*2>2meZ71s z$SuAz0>kRlzf=!V0|U2xrItK*O#-@ov%i==>vV-*-ag)sua0%itw}TLy>8#OlCWiF_-YLwKP z-8J^W>sL?Ki8V`i-iFh`wZtBapV_M0E=RT*4ZpC3Kyd>x^Z?5>C@hmY6mluuN#>gl z%r3#u1ssF}!0#r?P1Ur|dBV?VYmE(3>AZil5{bdKOQ<87L=T)nn(;}jJ@5W<8iktC zGsQEBkCBRtH;!2NEgSgpYT`P#;Y-7`BqUnl8J(w@z?Yz*u|Z+C1Tpn7;=a^5ec@2; zb^?j&H2dM?rH+q3p41${D<7zT#0p62wL(UT8mSZG$W`o_e?4r}knvG-Ba6qLCAB6K zz!NN$Ri-Y+rKD}VkqM=pf)9LMA%s|N_VWN5~ECLdMb{gYYz9O@04z&vpm zZVSsWVdL739b@9UsD#ecs&X1b^T`L!~j!XA?I+lUpB`QwZSNFp+E_h`a61FmP+kJsH^~H z4hu0leo8kNoVOgRqftNU$s_g&;_C_f1h0UQAMb+YIm`Lqv*w6~jV*-e_HJt;Lo@YP z*M6J0YIvE8MO&CD!77iui?u|}7FIleo(KW!59VJoDW9MS}}hKD*5z=?>udMpK0l2kX0 z47!AnZuKQt&!)+9S6yoS(?zq&1cuszrs1~5puij|>95JI)Idvda3FvK#sT}i!+xA5 zojKJ_&d<3$tI&_7t*x$yLAI`rBuq@-8DH7u;P11IBo}!PRQk5V@9x4NSC$a|hyoz8 zTuQ<%yx16e#orO+-3>?G?FF#vhywV@?~E3-;CqhUr26D8g}dfzk3cx#m(OuK3Y6PV zd)+O`(oa&vx0r<1#4(AYdVdnT(6&v8d$flxMLkvz(Yok_xFc8(SVLK5`{B%dFgg>} zw2k>}JgM=6&Y%&IFrWXG5Y;C^XmMC615wPmq$b663aiAM)!LVl9B|ulyok*ROt#y$ zSl~R>G{pPzX>FVkIx(j&7D`A2+qV|q+R23Oj(-`9Y!A?l2-2SsB3_|eOh0R^` ztnDJJEt|xmmkg3|!B<_SPXgqy;B~(62%QLzqLqZE!s>-8zj{oKBO)0(e#CDM%B>=Q z`A%I3PaG|Q1Ni_iiG%0u>uJ4zP8_N&T~Dc)nVn$|s;?W5q$}`h)tx-4uyLt+fq$U$ z=UvlPOg43!>_JT3$KHo!d|IZOooOrCF^!><#$0d0b-m09@TRe+GQ$^RCY8+lJ3#rO zc?b`)+}#RtzYiC#Y`m2RuHo$rWP6CLuM+L|Cp!m02$#f?o2i->HdQahIjJiHOcsvp zqa(70B)sIWC`6%h5kr6R-bsJ?Ntw0jrA&dSvQ?3p4hnyhV(@4S7n_pX_Z5@HjM6f8(1mz^p z-UM7wEAKs>!PacI8NJh)0#-6Eu4D;#s$5(ucvAK}KP#1rCI(q1bKOgu)FwcJ!BvGx zK}U6uG>Fj<5Ja;rZ!B6#LORj}=jVvh*0vRWrR?sI(AC#GlaQM_(mc3E?7V6c zJh%s@F|XX29xFhpnGT{+R^FtKgm)B=>^Zh69!?M5dEFn}+U;L z(%@{xAJA=nH5MmsVN(avOg-n}DH&RX)xcaV?@{DdG;B-z(6XX{hp=+zaziwSC@PtD z1;*6Jq7zonUDL;bUR9b2WQHK7l1?;DBWHuMMRi1;rRD8^x%~~EO~)>MiR126oVoX5 z!mcXL#q%}zD9xUnTZnwOAHkj)x(L(IQ1sls*pL+5+aQbfZdu8EFw@m{*YMNb-l)8A zy;N5@Mz5bRWoO+nRlM0YzV+oK1h97EX4$GZ<%s zO+>|Ee>gPow*jGFD%_;=_t21{+>S*vT!g?)u+vQ~)7r^o3G2 zNIRVWDcJq57&}Hb*8dVQ4Ql?#2v~o0O)H*&r|otD!4p8FfQ`_kcEKO*2#=9+kR-c* z?kbS{*a#$DTp{^B#w&xUmhOIJ1RigW1}Kl;D@HFy4ZoM9m-#-zvOkWS7jLr(<`MbI z!sPc#4CjX#I~jz*SWxx@&3U~yzV2lPU%lcc2r#4v|Hx8#8Iy~A+Be;zB5q?~*>H5) z_x@zxdM=I@dfoYDyYEHcBb4~-TXj5{?A-?zK70s+SM_7QG2dhQ3hq$~P;Mvc>x_Q3 z+bo;tXze+}aH#0ld_bM3Jo`s!`ZLTQhqV2;C|KG1jA=WkNVxCM7x%cn@@c4Qt(go? zhG(4y6%ym)Ro|*pH~rgHUvH~5N`mi|NJmqz`dfDL0a>kE}?P>q>rklnZCsf|+4jP?DFiRibQu>c-Ez z`eItXz`00FVALp@L{EMdkEQYn$LX^5jPc^bWzUBVi-2~~*T-}0B-`Oz`lPS=t=-p% z#5Yck!=eEqN_w!5Yj_Wnu4<#9*g@6GAtt7rL2mrVVr-fL?{m9Sqxa4b$}FPM1PwPL zr7;zMxfcQ)nlVhQo+jSCB$*0%27b&Ma{@850ySz@fNVOI(swMqH~1Q>W+g5dA=(mf z<#1X>h;&~azw1U_?aYR&3A*^sAYk)%4UA#`bu5;#E3pQwlCokH&H-p~(V9d+bms6C z2f2uXFH<$rm>SMD*sdR^8rf+`4|b%K9}CvOYn?RVLcq-`@Kxs^SWZQEJ^Z(3Xx4_{ z0OTg_b^}5VsGjo4B}2XK@7lgs4<_IBz)|6cU^5J8c87RL`JXku9q$q_Kel7`Pi{M0 z3^>sIa2Q&7bH}WO`=RNbB#tYIO$h4h+q*{U_N>&=-2B6X2yV}c^c}!7y&P>AT9ty_ z&xXAfA7~cz4uzk3gBVwjQ`t>a(kLm~|^=c$rr!SN_OAwUDV8a13tUDhX~MQPuoro_?aiNv9hF;X z&ZEC82xpM=)bl+BaTM$Sl3Bdt0(Ueo{xSS*jqoyksp*@k>X8H@7fucCCcgne>fYE^ ztE_>)%tq}o;TEZRW_EUgmyljaG`*=zpny4vL-p@FQ9?|eDQuxPaLOC3U63~`1E`)2 zwA-*7AvHlSRaO+Sd1~XNS_AFEx0lWb%~7!z2_DK^>auWug%C_0gvM=v=NL{QQA!R6 zZ7)C}aLkr%%)3|cZOAxWg8AY1hg5aw(}c2=;i|uPkeApRvCFtgC$=vP(1jJH zcCFyS5txBCijsx4-Z=u*4Z<7;0@-Fz6B}|>>KmVP1`(LC;2K!31cZGl2I+1DBE_YrQBY1+8PEripnRZzSvs%ST6erq>Tma;b~3n3n}`YMI5ABQ3yM z2LzVuCI|mcAlw0*5PWh{67~OM>>Q#*37{lfwtiW^Y}>YN+qP}nwr%^DZQHhMs(WTJ zJ=2Tc80qZ*hwDyWso8f;UCZx{~Y2ETe9iwoC2uW9|oNU_}{{J}le z_u4|ID`vk5D*InUpuiWuWs9ZJQ_id_S>r-wPo>W=WKlTDA)&P5b^OiEnSj$3<2aKN zM*aZDibTHi0ycu2Fe~#WsOY!cO?qOcS`yJyf53g9$ZLOz%mnCAMP#S?VTR8zFv64# zV*n~@Zi1y6tZBK&6RA@r3LMi=nr5pJ?p=Mop^LT7}$9<6;mu}M-N%dq;hn}5)7p!!zh#c9_7DcyBND;lKyam zXU7VNGX-TB^omFXd1hY^kN*Ybay*oHnz&E+>%A) zCLdHK8!m&E?Jd((CPCiYD&vOmo|Wj?ZLW`rw{VWf_b1vf{%C(3EtYKm20Y@D^9n-S zXJ|dHuY1Ybve`G=b=5n1?S2?$#_~Y8Oj${cGZy@hQK#Z@^4mq%nLb$tN*o1C3Ol4D za#sZS&)UsaTsRROKul+n+p1T8b51_~14m*90Jb6MsUMU&vs4~7^VygwX&y}0*g-l%{aRU<+(;SSm7D#qWc^m7ZHDYdvu6 zh|DiOYHx%?ufACOCknS11`7!jnu-F;NFw<7y)}{bw-_ z<5yFTx|1fDP3Y7QupYZfbBT83d;=jW$f>fA7>$@vs24R^CC;tL6##0|O6`@0}MT>qbVje}A?}|6JV_sMmr-TAwK||;&;HtrAnxwEiC4N34nN_gCGMm0>G3vj- z{>*q;$h=5ZF&(=6vGE$Qun$;x+^$wS8)uIvL>2* zg#kAfrKTl)sP7A9hc`dJO&a194IItEvw)MYnhIHSoiGvT32x_l{V@)u$F%w4oM9a# zzgr*b6`w3+@wr<2>-+Za2XO5jckRE?#Vr3b2rdiLe_>B7X^hnzwft|kS?VzrqT4J1 zpA{Y_=`Y)?Eig&C%Z}yk3pr95n`ry2yJasgKLv+2)F8SvBFiWHKi8cm+*3Re2&EUa zv$sfGKO9{@pVsetqO9cP1yL67Ez+b%LGceoO>#Q2J2pSBamQXdRRJ%@#p+l4^Q9U| zK`)qf;-xoJB{UP_SlK?mXfwpK(5DPu#UDzpi-Jq=n5XhLsVP;Q91;aCmVtv^&4nhH zdNE+wj%4PQM`IobS8SKDL6*dj{tf&qv4|30@75Y~@oCS^d(Q>;+>7+>`og{3oo^0x z;LA){x>U9kR1{vQ-vI1+*MQ^HP2@nm@0*LN%;&c=A_*AlSL>)bD&qHlqRr4?{?9Gg zKlLEmnH`_=?@!qb&0iar^GzJ%&*G-k4D}a~DDyqRB;B?deP^6|e)EWRMp!Qj+!PVE zflGqeT)hYwJv^L>*v{=shuePyV5v|kjrA`QqoG$_T5T(Xnp?J5n=jER3skp$*gksx ztgx9AGld-^H`Vb=>kNu48kxkA#nsDfkgpB?&n(qX#RPPbMGwZbNe9sfoY zolj~N&5F}Zbs;9JT4KpAg>1M-*PoFCyjGFNj06bHQ<5bc5-gI3!D!dOxYw~ao~2aA zMrIn7V&kRhGdUb~Lvc^Y1Du?tkSXN2A^9aXZWIXdb+GtmB4VjWc{)HIV(}h^$Co_yW)6jiO$^-)(27ng zSRA%8(benNbC*l6+pV+NoECjj0d;`THbqY6P)4ttfz(Ot>;nE)F83bTruZBT=cCc2 zr_8cJQb!Wa<|Stzfl*6PBcAAf@R=i5o37{3LiwhEH5>Y5L;3XeNL=Ttn2q)SUF{&yIuadW3 zHfJnRQxd@rlP?sWD?Ht7_BK_+mVatf^OeIZX|F30Q2eRx_!DKwV91~o0eigKqEgYv z;DU)k`q#>f))0tWJxEllL_E^1*1b*kyErTZA3Yv;8mtuCu4zj+HcL$3D725}un7}X zkVthAuc$flK-@OzQcDf0Ml@ho;JsxjGA?Xj-*|!YSjW76Up}W%MItmJm8iBcfYgYr|X##I@SiiA=O-Lmc7?bJ?QeeHlUdFzJ1^Tx$jwNvw-l>xHG@E8~$ zy5kM`j?+4*i1}?9zvqa&L;w=&yE9%gP)5WIcKth4oB<++ICp_PM6m{DFJ%&xqU7hC~eA381cO+=e&}v2Z_hs1bKHsldE)n8 zFd8W6i|COng@PQ`afO#f#)}Iqh_FDM&}_<5T0GsY38|#BvXIk;MfyY%rSyXt*Vh`t z${2d`JrYG9o#pnCetjI*!*^@ZOA0Q>2U>UO@?ix1RO7=z8m~_CFR3V2xzF{X@I;*n z9+X1emjZR|EX|#eoZa52WQ%Mc0T9(nW{#t&EJDzFPP5ii(b~mArq{I3MWb47&zRjH zlWh0ZbZ|16)$7hg_nV-|8f$d#iy3IlE~0W|M*q^Bx=9E!-&(5EDKEC;VkyT$nokv6 z8I@EO(gJe-aGD}V9lm{~WG14I*e6SR){g?Cqf@>IVh^zvto5t6!1X@R*DLCPZFN5S zR{oP7ZKAYsm|U{^AmBpJQ+(<;+HLOhom-kF{XkT+6WAY81gBQTB4njsMpX z{_GTb@XsQ>c^`t8=Jl8qH((ZmUy%zysexmK$Qoe4_(W_o%@Sdhw=9n=xeWH-Igu+p zBoW1IXRPvVDn5=IhP9!HCcbH)CK|GQOJN_+r^#D4H4CmuQbA9PQR#yRH4sC9rTIC7 zu&c8V$VGTe6jIGbC%R-{qVrGC?USP-0;}Qaav^Z9#y%C#_I}3@+i1~~=M1hWp(QZ+ z2}c@yiB4YY9$)BPBiPwJ^zz^g{AY{)jD?uU2v0zTkRi(EmLtO6Aq z=rq$oT8ZC@WuVDWl+~Pi>hD5sQF7>YqKmSGa&H`jN5>Eo6v8Z&m^uS2|S##G6 zPMQQUg|f0}#BC*$r=doz;2Z7_tYKnY8D1yYHiE0#tR)K$tg->^hAj(V?P!Vf?O)YA z&l(d?n7e?+Q_?_PwrE&@6tf@%@RrbWA^C2d2v#TQ&kR8$5!#$YmZ1j=OmsdT^`;>` zqJU?(%UMvV8fH{gh}&EaYKRFt+?WFHA_qifW#pa_nNf!NT1<2Rbpz?}sYO+dpH>`< z{_UxyayuIEabeh#a}OxGloM{MRkS>U<6wya;Q!Y@=>> zQgco!=S_*{d+TBu)*e(~KEFxOk|Ol->(7uPoUVsVrKNZbGD_mduC63n1MlAVU=G^l z+~&7fE9YJNUmFspQi2(!uP5Lh{*KG8TU+gMLBl*~gtz5MJ&oVcb(F2no13 zUKRf1njrNzi-1qMdvVsv4YC6NYUpG4qwd7K?y->@<-+v)JSzEygc7tT zb?$01?0nMk#v90Z}5FsXMz7toBq!z1?>Otf!5gc!T%|cH5uI}_(SLQAK={$q95wf z{>UWBV>-vNi_$h^^`g_}PI^d8i?t@P`iN#P-T0r!iz1TnpGBrYCQe#ZUTxq0klfq% zmFw@)+Ot^S`ox3*$=Z@yYYsBXrYurW0rs>Wn;$j_Z=T$!fsf-NovE>q*z+Qy?G<7c z{@1Sb+tD)s%mLaxec$`HUwO(Ca#HJ7O==udUkg2TvguWPt&b<{&8>sVD~Pk4C6y(3 z{kyW&8YK0Wiv4Gkx@f(SkF{-`<(UO_SX<*>d#otKU~|^PpWw)S(rJ5qJ5$>$BU1Qo z59DfYSJ2NUheHg8zOV)@lJlSdLiEkCy(q9# z?)D80gAvGBhL*dEC&LhDX+E{2q7%whgw&Do4P{T^yFkM>hb$84hHabe#(1r^o8aJe zuWiEkXvrky)2&U*t<+V{9l0xP?K0M=-7*YYT4QmI{nS#jMCGsv63ycV{i#O%G#XZS zQF{M|VH0D_isq3TnrSXoM`eokJ5E=xZtBObE_D5-u%Ed+zsK4z}BY)XzZ>ahHyEVp7Zf;?G7)AH&B@q+Mb?1~HAQ$Zbg zaHdm89+o9xk;S3L_Nt?sHM3rh5AUCfxkLzR93Hc~F1yn+Z0+~6K*day!kFRy8#{*B zzy~>OK3-vz5H0#lMN9+7Ji1Ib9sLxFN!a_C}oPT8KR&D0-FSkdIpv7_pNt?|%U_;I)&?q&Yw# zIPDWLRZOwwg&=_LS4Zs!kpRNW_{ui2p5@d9a75Y|_Iq;@Ghr!>uw8!qlScABl12rW z2cj3l?WZI#W#QmQE-oE8XzTHAo!yeE5ClYPVvBPWc9r;s5l+y-(VfIFRrto-V}X5a zwJ>$#Dkki{`Fb0UVG416&R-yA7vS!OSqRXzt7SZNUX(eB-wf=H3e&6_~A zA&Kk1GQqYeW&^=4Mhoi|rK&!bdT6#k2i`E0<~V!T-{{l7NVraL*!=Xk-!5p!OEmj& zRRN{Ao6hn6Qa%}+|c=GyW$MyBbrG zxQm$TX>6`Vhs)ziQ|J(Kzzd6lR%&2#Oj-SU?g4G z#f1Q7Q^Z~BZ`TR|O!f|8PO{tsF_cEC-*@|#!h@U?uz=^6&}85;I!Mx0zq+%KP0Ld0 zRE(M#f(rFcs2W~w3<3`lbTO>L^GY}<8!dKUVP8p4u-fcnm>O5wPMjLk!$;0tBlT8G z5(A0)){^}{r;Yo0hhcWHZRW@nd?zu*f@5lTojSFMj6W@Hk4EMzd+kR3Ji2S@{uMxD zn|I6rq&VS%^PyMGM)W~cDPzthVQmNUC3ET(Wvu{@MUV9(?jb3Z4275|_#zZu2*+)O zmtgiCTEHEb5#K>k=!|=kxXk>?sFfiiOBw)y8iEbSP*Fi6ekls8=5=cFf!0?u_HM&4 zP5VP2+s8JQ!6?$+gwCLSO2tOa#0$s!M7j?=so=}Xoe3LVU3twke~>oCdpSzdnfD)! zhEISF0`Ejm`$F(dH69ZCzX=Ism!-Mzz86uX+TEMc!;q1jt=tI=gvk5ClIt~5|M>!_ zdqT`}44_8)oYtYm)a4fKPFu3bqHv?CO!aK9EbWHd)m~0{nhairjQ(?`wO=E*DnqU1 z?FxyC&~-T-4WtWu-k~sFna!9={-*+|8tNLkW1n&6|EC24W}sX1K8D!bx=YRmIW50@ z;o23iCYyLUsbS;Sc5#z8a934^#Iao3_4Sk`-3^jIr&eoUlYcc?s#1v95H?4(aYx}} zCJ_uY6jP#jcnqk3hIwc#K1}& z!H^m}P-tplU7T66@~@7HhHF2k0PB%_xQPg3XF;}3GgB%C?WdReK|HeKom=+cO&bxz z$Tk8tZF5MRxPWWL!MAy4Ab-utmOz#newI2P8%+2_1|V)4XWqfxh~|(={tY+at?Gsi z8_`Nw5ebG)e~gHLjI16+_3*a201Sing{CaWJz1DlcmrKS5y8TNgm*$?*L|Udw-bGx z=yCIGpN*~t1vCc82z~$~)q#^Rh0b%e7_X8=BZ+$+QQP+?6LKwgvr*6;AVW|C5wl9V z-R8wVn+Gm6*DOD74BbLB3uHckfocyeGAP@Q>bsP!eBEhnYnl-0nu>lE(GW;$YyJ*? zYkU@;&~*Vuwx-jbB&tEdCE`G%nTe)+*;TbM!pXlW;ev>;k;Jojy;=fg%jGEabuB}E z^A9VFr26m#9>%Zu^kecQW9lS!xyG#jpswm&LrMhfj>zM)&m*;N#{DuqF8J_W^P832 zaE2>}Qsjv%Y|0QdjZf?$lFtwFm=X-ngCiI?LEa&ln@nQx+Q+_cNVF=O<)CkaB&BI_ zJ{$E@K^}j0#&|D^)RYL_EzaUbNS(D!@4Cy9;NhcI*P!WalvaYh^bVh?owYNzOTk4l z-oElWt|j|QO42#=NOIls76?EJ8%Z^Ayj_pvSNzgp2BEk--B(KEB4WBgHOo6AX|EHQ zE9A75@=-r!W`G9YYSZi61r88rFxZK^_zAXrT+hf7a4RiUi zX7QcHL?YT`kBqA~o%g%?jx%y^a$PF;3EhbKlLXE-K3C`7+rY!X5_>vy`l3Q;zSE0H zuaCOk<*MVQc{a)@c*P2I%+FXi*rljvv6zulIU$B`IR~;s(JL{{2=wIt(7V>4hC( z*B6!E@%`(A;j?~2pw;d3UH|qjx``Fk9AfJOL@jb_^}(>fqgN{;6NR&4N!<09kv2); zERCaRha!{Zy7YzA?0Sm$YC+{wfFs9pxCXf4L`b(TgL^d zlg)g3+|9oID^z%P0TRTT7pjYofCd%!uIcbL*bOR;Y@@F92!h0c=qTBvB9c?SnHj{rlwUrshgXJ>-NFDn-Y1eZ+O%lnj)1(Re zqg%OX035!3AkaOP!g_E&$(*9C&TTva1t3i?xX-c>qQ8CW6J(UI102LjhV2iy+0F+t z#Zb4m@dw>u{Pl?kyNQ4g)H}c@$&y$D8wD&>4R*YkAYNue`|a3TZV6?d0A(Wn(eXts z8SdIWgKX~-2^&G`Xk6Vk%y(eLprhgCEk=o2q5Xr5wj9_EsM*}48`|dbNoCWqS7O^f zFiq-Ay0bBAi6zW9ugGHu&dVFE&fLucjU$)j{pFzd79MJ^bbRp6<3d|;_%lc z#7$-EOp49}s5uoy5@mf;2)9G=o=Ub^Qy4^|c!@iNs*~|2@D-=f7WgoBROCCfz=IyX zokbrZG#X1-Ek~S~9WR{)4Jth~So1d@zT*>^ve#@{2(_yWa8*v$I}T!jF!83l(iLbh zS7M}_GV1apqE^FbfDI<@S*g2Cxlm1mG>6!HN-Ym8FTKZ0`uLILPKGByU&+cUVd0kr z0iXJ5`f*|4J}QdCC>##jw9qGpk=awX>x=G(@tquWAgfjeq=!ma9J6FTYJPb-{CCEv z;C7>O&rmzX_>P&5McT!T_1?qi{hbrnxIVuSH`th`@K0j7Vk7BsxyWXt={@;nlY_bD zg0pmVABGF+b|=j~dRX^PTnD$UCOCxUz%zL;&6QZgdtJN~YtW16t+2>GwM1cyUbxz! zt7C4tU16=6ghUv6eCR<>Vq+ue;m+)hyS>xg>Lg5~ckqqJQQMtBkk63tkp4!ucu~pb zj7Db@Po+zqqnu;P{R27YDgsBBKAUCJXW)T?P~@-5ie=X=RE(#Nq44d;tlW5}H99?N z&`6n=#0GCPp|6g2(q2g+XuKfgEbIHfn+TCuFK^(J_xdyOqZO9yf+n6s_`khPx*$>< zT_dVcT`-WQ^49%~Rq&dd2gQ~BvDEN}JPRIpa6QW2MC5YgmX#rA%`S^a*U^7U*w7T7 zmTVmEy0++96DUG0{W@aG6YAy9FuB!WvkzAekrqfG*Ph2_uO0+XYZ{N}Yt5mjixAHh z7~7ZqUDVMmCgiLaF51bPY=NguDR$GD8&KJxci@PVtNL3fhrS1X|M@@}2Cf?^o5_N% zhkTHZ9H{rlMLxyp@gL0137bd7`gQY(>l@m8Phx7i&auiP|C(3TA0)Kl@^*f)>!iZQ zQfcLj>ez%nlfts+A%_8`RwZOFy^<~(a{M|V)=F_Wy9>bb9SV!KWPJW5B6qjE)V<(uq*1bg>H7zO3wokxQ#98UC z_A?TUOGiW}kM0vy2;!l5$U*q8YObfq6+2>8)eQzi*x87dAc}Ag?}OpZ7}*eozF=V~ zwM5IoT?uNu`L&s9tdC!`b}O82Vm=hW>&PmJ(_=0#7L1%iJD9X{D~q7)hr8xmk458R zA5=Fd2pI2->u!}!2e2u{8z#YoQ=f1}nw4vw7`)dRKk2j007bP$;=^%d(i~Qz#M0~N z?`R!{D$xVMC30#dJX?Po(_+PyKdW#ZSD*q-t_`T`1E0dDlZC-4nY&*K2eY5JAK_ka zu=y0@D8gvu&^dak?)f*yb(5=92haxx?8d8eO( zS}t7Jk*`ZDW5>y>nZKkyKMO>qt!34+%_2NcAkYZ*NCb~@S{SGfHjrvuWua_y&07FJ z+bOd6$DcAqS9*hsI+tlWGKzka?DehEO3Zi+NcXsVbr1S!8W$jndV!6Bv2Q#Ml#4F-`HJ3XB(cYQ7W%uR$NS9VL?2cvnUFC3~fy-@#rbra>dKzr5MV$Y7qk zA#V4OG}0=|iEruddlGNV&+-tktZrQC@k}@r$yQ+I-+bN^&&e#-tFXnoTr=w}Qrr-V zh`BdzTs_~U*5oh^3NzcylY!RswO&aZL6RLPl4ZU7}kQT zokM+j>*EKog8EUP%;Cx#0v5T~mXU$cEz8b8M`D{rI!HRgMmqQl?qVP?;0aJH9sO5qvow)Rl)yf-pa`*hfPM0mtlmR1@gu5Hc@5Ap(FGkWc{t)b$`wd7S=8M46r+u(%57Ev!fyF;d3xbs67&ea=jR zM-{k|yt)I4N%+V;=5Az6ogca~OxjLB67p#@;Usv#ASOrz&aWV2CccjS{Yc6&Wibh8 zc_^S=IU-~QFS%&Q5!I`v80<YdPS4~G!bg~~;LqROzwHYQ{_I7RPX^bxHAxt(o)*zN^`wWE* zz2?8c1bOEO$Ve^?cPK!+Gi2Qv?cm6NL<1S)= zXk_E$;(v)<^Bf4MPx)e;mALx#d;eZ9;Uh>=@BjqAfK?Esvq2B@1{V`{3pu0}5=7@H z{2oFAU)#s8`&WLf^rqNu*Ph>>IjlV&eV_5q*w$toZQNhDc&pX=rpQg+>mIFqv^n>F z)_~>qkEjiHE)i$1AVjj&uS6V_h!- zhHHGg1aj~~#C*y>@8^|2>nv0r0Fj9TCIGd#Xs~!1;)-~`W$i^-;`XVraQvkOFoS@ES>gb!>237buVgbkf zZ1Qn~_WS3ct=$2r zJ<{zGgw;u#bO6TS_#yF;IaL`TlLUeTVForY`2|&jXV0dz%CKpa^+T#r5>`jyRz-nk zlf859Qf2hgL?Azk?ZS+%TFiz+yB8vAD?xK85So#&;RI$Y5FvK-Q&^I@;R0O`vq=_$ zGg%=*63@}1M$kkiEN&6{8-nlh{Ux#>OB~J<7a?K{AzKEPhl$kyL4UJD7n+1~K&W#Q z)kp_~9b`p9mEq|U^Ao&97Wc-so8&{r0`>BLI;!e zEAH>Z zRg4rBfzFmlbKC~W!Vm>G;b(=Cg_w;JKQ`SQGFT+A$+ET%xF%2mIT%OuO2!VI6B6Qt zhV@vW{rm|~%PIBQ;gwI40zBE!YGeB0{NvdEG8K6*{iUhfqowrksd4JxN@i?oE_xxZ zZtr1lZ`R{i#m7!VR`o@N?ew{Nr&`m5Ow+}I!}jF4v8wA)|3^Wk#H!hmbrrQ3|8bwA z%OCx|zPJr~Ic6y`bEd#{0`O;PWE-TYV9mJe_56EKX_TM^ zTvm}@J-^!Zp`I!$Jx$u=x3jkj?ZYj`O~&;Di~T(9acUI!k6WUEq44y#99Q?gz6IiWVy@VyOjAzvMos25 zt2g&nZgr;e4pry7Kh+55jW*irpo92dFk=Z*1KCr<>AZ`Z?V@G!iJ)s*z_F5D`Pk96wjTn(Ri~) z&i&x)}FVa z%DPV%7SAm@ktNr$_Zm1YjR{5CHL)ft!f%IM>k6lUvm*D%;prR!7^Gao4E#4?ZWV7Q z7Tcel9cU*5Ax1G-E;4kwA@VB|5VwX3ZQ#()do%@V>cY)NsCT0bF!UNgK?u*VDf$~ObxUQg3B?(KydwNGxe4-C#Uhc3;@D6a;Bxkcx;XQyk8@<&J2 zO;Hu-a9@3+$NHSK@snP=`l9f-H9vafQh(+iZvv?~E&8|UH)e>ZPW%?D)@eisy8Qhc zhaMhUGD{qzuH$u!C~ZGiRM_Z94UP1KlMw)AK(`*IZ#65gr1_6Sse!C;40m^pFL$s; zPEQ~A)4M+)ENFNp$q0D7C2kR#{RMtmV$BWT<3kHa7lw6j6szB?qZCW&28D^`jRZ)z zeZA?!^DY1@H`RJ6Hd(f_DFx(B7%?0Fh`jN=;bPX{?k8N1%~qm^4)2byBQe8G0lFk$ zQY07gLx}oc(!-WFfa!Y)KR(?lEpZD ziD(3gGLPXNKO@1PdrQ_7M9065BjtdDVT57nj~Tx$M<*JkKl$^< znx@^Q9zEHR<0chE;@Cg}6;Gok{RqZcA(xxi+~mbsETsmftK>$KUi^Ai%(?n-In`vZ zwd1>Z%uMS9$3(4jx5bK|rh1|l1294%YWUG19ljIMDB$r%i+a6IgzMCXi83w=)=S6^ z9kbN*vzf;b@pZ<5@zP)#4qcQn3;0o4Qh;(7OU0k8G|oin=?9J|5T|Q=5g6$Wq=USs!Y+Buu4oiH@^ASROj#f)v70Av1URYE#mw zH4-f79Z70^P^??ZOtzu>{?|Gf;#N;~(XgQDnm-46k8%TW@y)gBn~f_%08y7qeD=6k zHev9U%Jmg1ktL>4Um5mWHPAo{u)k|GNUsc#wq6BWWPg`fI1HRUOW$_ZRP$@jX4d1L zQ$B+R$%)}@vQysbD;w*Wg$^}UZ|%v<;p5X*UiDUQ-rk&wgvij7JQemT$B<+Es z+uI%$>lL&o2Ut>Pe$vCdG4Pd@d%eQh6?$me7HIlOu%=X9Bp#IS_Q0^#c= zqiP5r(N|cLkFJcR&1uR${Va5r0S@p_0l7=WU0_Ewj6Jg}b$E1E=1jS?*jugR9+5Kic40*}suL?hOvzQDI?_ijV-J~v|5Lj4;+{!J1 zk+a{L%bQG2JNty@wbZsDqE&N?R=a$4r~973GrC@L5hvEeEHL5hgMJyU$=4eA3_k}TJwm6d8a9q`e7QR@)8@NagX&46wHrfML zCBEVeQtSN~4)0vs?A%+yEqAtHV&6)%&%ktB^rT`uaM9m)rheECedn~PHNYFoSw1(9 zOZz&q3r;gO*@w=tz2c!}cu#2A5EHHSGNfje&y>i9fGQ*4QDH*L*KIk{*x$vzek!l; zpTQp8&UF-muqIhY>tQi|r%O(_5ChuOo^zO04xaG@@v=Nzf98r^hqd>lw-2|cSzV;t zzHpNb2e;(v5IB=E_$a29cTej-X%VzAw%e0hOF9}tg}S{P;%Fo8!Am6!KzhpRmD=YB@)AHbUHX|cg*!uG0Y1$s!cfpRH)_9z@0nS zm+9%mb7vaYvsKs>b)(6Qtc4okOIx7YHo)sdW%A8FN3zCd47OywWwfY{HXf@tS`&eY8j1dewH!M3=(^1d;fN(aI*hlP4+doKB(LwvvjO|iK*d7n z^;*@<^UiqS=;@vF&O3Hx4|G2Z{)|s`fhrPDVvkh4;G!8=iv*vx3O%n0Y>VV}$UH24 zo{s{O;!vsL#}ZT^4h4=9il9Fh_}5^{@Gm>WV#+L_F$_Oo(WVxo%Z8+`fgWF~*ED>_ z{()PI33o37+6{zCU0bjfe=C$v#53$X-~Q5M8Lm`J#UK6vUkh@~{QpZtX14z!7nFtR z|K@@&X-daFmi_5DQGJDP61>yr!+b+9Z&a|!oTMJ_ziM$D!*QW~`v9!)8*rIv<8G{s z)_HS=m*&4)Bn932n&&4S;61InyxjFX>3lnxy)|_E?)LmS>i&4pl?E?(84!HwabczF zMr;9I8^r5;`Nz8xlu;rt=vEsj7l|YN2|*ZktD|L+aQ9GQn0iN&9JMnv?eq9J%y95; z)faAtA;3qnNzf{%%zgUM9&faXhl|83g{cb1dEY+_$9S69N5OWLJANzPN;#gYOM0KX zp5SaIKV8*6#Xg#{M>YIHi^St2B-FS2r+R^+&r}&8HI9++wKYIv54nVxi?Qb>&dk@% zm!kCZyZ9p6wdBJ#KJiNU_2WbaUeGqHp!a9ttMKCtw7e20>l(@gMC<$SJWHe}2-<^Srf@`m`6CVHs9pC7b95h_Y4?Q`S3Gf)t{ZDAT<>fHHXVsrJ zDMC4-DqFXbTdsjZLC-W$lXsZ~SDpuiHmSvXdV#Dz$7IC#+6I)=d~+adWG;z=C!+`j z8jtg<&|wY(Ct(63`#(7HfY4E_!IDG5ZX!Q?8szgQ4ZHTY=0xu+G=p8lK{sB{_wbu(!i- z#qxw@bqKUY(D9_jk;ll^e07HKSw&EGwe0mb=J;xBnwB&W{z%usd2$E~m^;REetafN znWz3h$5MJG!^>}(v*1q3cbmGbeWr^ceC2jTYNOanOI|x>mdCKcTBe^$h64_D$zsLC zfYh*_ixQ|w%XK|O_$MEI%b<|<1BQ_NOz~zEy7Wl;1Xe}6MHkmh$i^nZBB;TFU#J;f zZatl1`4X1`YjOBYs{*jPy~w3-xL3GPKnR5LuA&r0k!;N z6tD9cK{5}ae%)Z))256fmV%5@tm<9<+vX&|WnvkGf8zEi%gsV-+H!u7qv~O{Al)Q} z$mk6uaV1n<{MTmzIu2WUPP8?L6~9CGg1^VTm&AY*uB#*ZNm10!De;=}wKL2*z@s|S z(uoPw6Rs`l4InAy3UORxPuSs}n<3X^k<`MN|W~}D#@nnvA;*RmWc%Rg5MvnY0Bq91uv#- z?!!Y~$?UiqOrp7gepBf_)b(_8jDe9%7S6o%(nbF=`tiWLQrpCuEPh8X6k=7y_dAm` ze@dJpp#+sGKMhb&kGN4LpfTvH86!w3^ve)wLvr@n2z-24kI}(A1$Q?dT$S?)I#V4t zh~*W_zjM$3CaFH_F1pIRkJV~~bE#?(zS8Q`Dc7_8r)eQO##C#{xIQe8uY(hn2wBD# zL+q=Lj_{O+w{&fp?^9#!mI@Z+5P)}%KlrVL7h_O?S17Y=#A*{8#9k%(b`BVEF>v0? zCr@jqVH$YqNnUG(h&2wsnrgaQ%PlcRTX}PEw3QiM-<2L(BNe#mx*R4Fwl2QzInr}p#~^m=C5OUqUq!HnrCL37YZ8M15RuBz~q=kf=41` z1!-avmai@X7Qgq{%4Tp3%vxA{oz3{B6&W+6VTo%y4)P}y1jw7e#oc&5K1-UO)IHh@ z2bHs02<&bYzSBXsaE+?w*8$Du;PfEk!Z#vy!wN;qX~&ibp=Ycv%dyjonWpC%gA9HN zoJO}kPfryG&nBVH=Vl|yO@k*!^U2ZpqM2^ctIm-jSkuE$liV?Pso)SLgd$`M4~>!U zA%L(yEyf?-D{Z^$QaT7HF~aMMyrL(w@8HM6?y$Wyb2S|Ry9@GA8ZQX)LB#jMP+bz# z;4nOj_ZQBVNDR8Of{Z5uPohX`YZBl=n|Gj!lI%l?0c(jU#o`|a!MO0&;C) zDuJDQ0)Ik|AKjUFlq)GG7nrk71a?*q^T&rY%MdaeL8Tc{z4Z}DSYlWrhxV`dXXZV; zZr7x$5QKp6K{uZqs4Ig(XJDd?+BjESO`T?d&+##7wlC#Vyn;g7xScNj&k_~7xm2FH z9LY6MaGB&$Mh`Ss165bk+G2}}v?)HhxGRN-z347+rbt-P5}WhQAUm5n+Iw9jf|i@1 zIe@a98MxXbgzF$@6ryE@yL<)Z{2# zUqdF#94iB7W&9i|hG-$L_cR@#|Cx zClW712GwYbmbU?aTL_}WCdr|L>3WdmcC6d?BpiJ8(O{+8=57vniNPwcx`#)KqK#n!RzEGC#y>vSJhwNq1h!jy0X_6balX9pFwE2j^q{^Yy z=K{Qu4Ha7)t*66fk8~`N7fmQ;XO!gmyNO7*Z-HHwnD+n0*gH077N~8TaXPkbCmq}9 z*y-?2(y?vZwr$(CZQHgp*>BBM%`@|S*gs*ds%^fpn>S4E?`Szn9!aLHq;w7n zpIjwuE6MummS{Jcl;#hWR8uA;+|a!1^<#qec}c5wtWRhF^qw98P zM`Bw!ZDkdG>6=vf(~x+<85@H^VR)bUBQdBWey4x-asu;eUb=v9PBVfApY}W*moI(E`$24;&ssUe<3n)~)u! z80?~AHgf-l72G;V$+T~gSeGjA(|mRu=GjWXbxGmjYH+dgmpmH7gjXu_WGY8-gY+gu z&?a1!uYZx-_E63;yOY^7iORkRU2x+6I$cOAvYWJ~y(?3sYW8K5q#q5w*1ac z^zB8J`t@`Er)h+U%+T|{$W>0J|0==A!Orpjma9J#$x#Pv$er&r51>@`#lKMRe)p{S zSU)XT?g&d#O&WUCFxLUumXRq7DIxX}eC`Qhe?%sc0Bjj2)m&e}P+Y416nayY4 zQHy?P6@N$;cC*K)X)#EaKS=$2pTOQ~7%$9?I(zlng|8!?05{M6Wf(^}P>C~~J^lS{ z=wMdW_#cz?ndvy~YmQ)s$2mQBy-2C~#kBrH9W_t~z+8Pq+>g!vvVmG*-??jSV({{L zpWJ&=!dIPdr(pj?-T!A+BUX89>4o-&bA01DJG`3R#+&Hu{z&>_ChvBuk4*KR&6EH$u=N)1~&rXdqBW3vRWFCN598GkO6dTLVkG(8PLEzV?}M6L}W@hb!AuQ9xPi}H{#1fnE4 zbduX8WGm4VSp-^tFEzy+hHq|h+W7d?i8P@bf@-a!e_xoYVupmi6! z#*OdsNJdJ!Lyx?k^>L!F8Qm_2&tsVv(Mb2|%>BY~0S?!;FbER{poJsM2w_Y9#tURx z#t?EyH@(#TbR2y4Js81eM#H~@WyV}ISMB6r-*S!?G7ai9SMam`hwtsYfnSiUmre3+ zonWvO1~`~8z<3}5-KRA`aiRK!MhQ6lDJbDA?0Qh6z~AUq3GWCgP-2GD#HkzbL}17xU{VQDzB02rfJY>Ce8VaC}oBqCavw!GIX3(Z$NsKw2w zFT^dtjSQs?GnO(PNqMvNR{2h*L^mNv-{m#Bcz19cD`9LP#*GGdG7(Ea})tolhE461tNAgZAG~!0$#yFoTkI+`oRn z{KDg=8h|D(GRRu^cLV(fh8MWj*Dc1vN|v-Vu&n`J78{n)_K#i@CbAFFQ{e8(6B*c= zDR!zRo4T^yM|e`^l7w)h(Kr74<~EK89(P#1&f!Jh_$;JZyJZ6JJ7LU91*|d$%)~rE zNE?mC+`u_Yn)qw2Oh8W`G0E!;Z(6&g+wqp5o72olMt!4Vi5RwqVpuo>lY~YVl^jG7 z&jo4tGD>PMZnJ8LqEmvGn;=QHPxexw@Qu_TUHqde+_2ReWo2vTdg=%Rkr|?n0pWK-KPgANXt~*E--_A zH5DXGiknJf`?kh5qoQD+8|@+zVXp){#U?`o`d>A3To21L?yBP5*hl8DOC%uV<|BD* z>uB;R-!pq!Sk)@I4NvKjD)x|3LvhWPrGI=YPc0Z!ZU8b6E)j1aqbv2k!|AWhVYs$` z;!9cz7K=+ptl?#_9uuAqqfl@Z`MWaK_JT^&Cp(7H5KDzeM#F!4FLh1x>`ta8U%R9Y zEU$-dxEDr9bY@P3*M)HNl@hAcAoR}8k>>``$>v$P3k16i-Kqy#4^oj9!WKlH^x(7l zH0q|PWCCmTWnC$Mxllb|-`1OwIlkKqm4PtC^=R4seaZ|b(FMkpL$QUJDU)v-cdiTb zIitwRaCq)fl+0L?&W1QsNp!=~a$#PC?L!SSG!k@8?Nx_zGv#xPD%S@aSqJe5AcK{C z-!CfTcqb$(%;WV9L37AFt!1J{AzM7H~s zTdkj1=mwnWNNfqj;04HX!O=Ul34@KnX_zfMxd91e;pd=d*y8Qv!YMxe-DML1JRj+qSuaBKOl+esMW+i@SX zz`~+s1D4@b+{Y~=zi94%32pA7beC7o=n<)CsodR?<;KVpNhE3UJOIL4@3?m!8h%B7^)1 z^=6x^{?^kF-|V(AhaFL}nMayH5_H zSErn>Q>JE#KmnRhWapgnvkcsbNP;A8Dnf)3ZFIMyfo3xut=!dIsIE^*Y(i6V z-E)sPoEqjYpXuSZM#{4FG#rO2?l8vQx<^B!#YlemB=db44#NN_1aqQ1<+0EZD@8Gdx|S_rz+0Crm(VX-^aJ_$*xJ^artQ% zHn!Ae3Z=cJElCdW+>!KAAIn@8oqvVxVX+G9B~Z!4Ds6Cxtesu1aK0;~ya56vV%LB~ zgak``=#`YsmRZetC`?O{M0D*{YnW^-P!Z7e3_sKegJ*KWdqVMFPN(~ieTAna*_R^D zwPVl$E2oj;=vcd5s*Vp2UZFcazQsO=6~)us%CM0CS*j`D={rQ|5P5EF4~|SOiOW+XI=SG2tm;Z~mEtX|4E+aOhhKUs%N`3t zd|GOp{NcF#0rCRaJ-SR{kYulTfOA7O9ZjI-9FU73=!~q<$4-&*aP|`9{{4E6@C|89H*xmAiE!5c zN`x~p{{DZ9@I{UBs0%ju&1uyaNR3%d^qG=DAZB2rWa(>&ddluP3G`7TFK^P=JgU_y z&CeEKKNy{MfSWw3tBbhni>JK5^!Ebd1EL42KJL->TsXn}meT903#+HAuV37%Htz+>o+3}}PSy8oo{Yj_S4?v`mp=@&b6ro_1e+%h ztWK}OE<{lye_|ur{h~pvRyNx#KN@_WmyPM;`BKN9Rl>8E^f2#eLuOEQ4qKw^%Dl~} zMXv1Ob9nubZ}I)w|F^9}|F=oDU(D(CHpF?SO@42;H{KWThXbytOWS{{MEB7=O~_N~ zd@tclddj|VI@=8>xRWE{j0Im};X7h8flF<)^8rAv3NGLT*Ld zuSe%jv5q}WYE%-H+iET1<5o-mXMNvsKRw=Yc*t`Oh@REiG&UcEXwlQxe09Z>uFuiz zXJ&zPeo_k#3(m^Gt&GOewNSA#j@AVP=4ntb+6eF{ank07YrQ@Ny z)(roV8eQ*4u`nc&<2gjD(6fC3k8Da7hD&$;Z}3?c_6I?Su_mg#d}JfOUKWwDVb2;X zkmk_%+@$58Wf$AWqBL{glq-uSC|c}NbrI`amEy$iCmM!pVWTBpKWWXG34UXmzC_9apPi23pWC| z1+=Af_0+^L_;5|K=S8XEdu2qh0{l?hXFT}GS}^l143U~@A<&m!cN3ZsL5w7 z{JIjYWS~OJO^lc&0n)T2k{`vXkMi1|JyzPuw*fOtiY?W+M&nM713F$3OI#k3LE>Ti zqS9!a!3w-yN-?7h-i)Adxw-a+38fl*^Nv0!gAGRz0e2*nsNLnqR8=AynV0-TyC(M{H52}N zk#F0aEQAiWB@Tgo4|g9FHz#jOp;iWjkyj#&Oen(baHh4eSrI=h9Fdtb*MwTx0UMEC zIFw;@#!98WlK@kW4^{)&yXi@uTKIw)_ezIjQ=@4u{>0y&>Q8Ra^5*OJ@ue0jS?frL z#IBpEt{L#OWadw4(e@WsOm%AYJM)oMq6s8o1S@aA-&r~5iP?BOb-!dTTS86k6#Tj( zqhXM2Pig#(DIrd(({H%0B)t1I*DX>FwYQfA;479{ao^gYrJyK^#}i$$izo0-`S!CM zpBmRktz5JAMlei^5zugrL!6k=kmmk)G@;^=gilbQAxn*Vs))2S=p}JwYRVv0{52MP zNH}!R0Y!Isp+&LK`!n5%GWWuU&7-i-gYF#p&_|v&S(fp*==#|*K*?I71&v3-Pv^pz ziV{tks4U2}zk8?DcAPj^pnR?blyY?{>CTnzK*pSktT!!x*<2sgom?SIb&r$mj_N5m zo^UM<6CwYVwR61zdX&O;(b)51-%@%5eJ`W`by=j0N4IAprQ_GlhwaKpM8~EV!D=gb z(&EEf{G3M&mKqB_5UIfdv6_5altDe!KF-_vM-2O35(3qG~wEdLI9U*A~Zxm0zjAA6U zX3{W)kNC39XjJLN0Yk4eV7){(%$aD71TZK|Fx`m&TJr%7k>-ZJ2|uxq1RLa*-_VTy zw{~nm$};za09tYLltwrv_D}bSi*ZNoPzsyjA38I zT6k6suflTSeW_>Came3m)mRceqiUeJciBiL*UAJ#n8FT<^Z=%CXRqM7zv)}!rzi{Ud!y5=8MuMXXVuT0K}v#{ zo3tHWXNsxOxOy$Rfy)GZgEm8{cb>8+WhMb-JK9xq^Q-Ie9O>-p%s6HDp5HuPwgm;7)DBW* zE6qe0kUW%0r8XnthuA}s%D4BN!+jZuW1Py#B3$P4N^{fw699>$_eF-zb4Kd^u$k}@9(>Ohv(HON?vU9 z*M`}+`!~-F@l8po>V@6k{6AatuKdvTg`eleN7LJVD}Gq{r#l$AE3~*+eA}k{HL4`z zMv$M022&H1FjR(GMR&LAu`yEV@d0>FKkWHc(CEznu;=eObu724^6*;d((Z|u5YVS| zS0~#Vbv4Y}t{jYOthQ4SV0CvKLBlh^WfeE@SMYJJ*tPc$xN84{o;UbG&u5@ok=u>Y zu>LF5s^~De@x!*rA2J%BDGAYRQt2k3ULln$!q|2kg?DHwTaEzTx~i0l1D~|@&}I-iZe!&@6We_Of*e+94eJJnY5wg9k{ex@-9b!5 zFtPBnFEX~2Y(4ZZiMaOBH+;1z$4rH}oFK=nQz5qRmm!P=KS5rD>9~z`$iOo)-DW?@ zpGv)Ul;H;lSY>@CxhYkXyRxGj&0z|Xf1;0@W5MI>CAWsF`_AJB9(QaI+TsojO99J1_{x zZlaUg9!{Q%l4w)Vm4}PT(6!l1<<05{-3Fkswb3|ehS?2L1_xT`;ss#aC^qkGM#scl z^_!~v@l$IqE#tWqByY(fmgKb~4QzNBNj z0TUAN=g!r1fXwk5>weTN(*T{wmDRVI<)fA|UC4moUwy@YKaHJViA*QL8XiX5DG9@l zA2X5+NxoQBwsU5#=vCfXY08@2`N|tTJNt`Vmu4%FLY4psA)=-Xa_D!EO^C)?Oxe$X zb>>#BR}BCg9&;xL2ZLE-DwH&-S;8FDoc$mmN&GU3P^DM=4fStJ^evUsl$?f$8hPF# z)o16v*>O!)leKf(TSsbj8?#0$k4hw?Bncx2EY0hE*1N!NN&^hmj z%?wU?oP6Q^QcV(C0v>bDq77KGuP8@CfoY}*m` z^@6}LHVnMe&3_oqMGZ(SoGV#jfq^wPRwUSh<=ETIBtihlt1f9Htf3>h)0y2iY@-^b zPV&@cn(bm{kH|FC`YuTw+fNcX-YCeU&E#L@_(p;ja=W(lT*+@Xv8wK7Wo0eKAKUGN<54m2yLhTqob8PaMPI4x^k?D}h` z_@Dd4H6l-_)tiwX))j|LW5Z#P-EjfNH(?LTjST(rZ}eo{oI40OSh0YH_zjRZik~ye zuHtYp-)E^y8`>6g_C_3}V2H80z??JLoOvt)i6S!0p=A+PFI%pM9uRit86Ux%2nh42 zNNySY5+~R*Zqfl<7i-l&pGz|9RymFe$kvJ^85Sr|zM4dUbT05z#`v##PpX0$Gb0E; ze^f=a>5iFWVQ5yGqD0pqr#%`X(JXCvs;miXOvRtcr+Gi>?ZfRJI-FVtWRIXRaJq4% zL3z1sr3fUWIKQ6xz7d<))Y0?|nZnYLCS=jrO7gkA0I5vZU_w@Zk$R|23@9|7FLB8L zT-D6EwKnD9U+=7k0Cgwx-096Owpm%&tP&-&hlYenN#x75B2OtXW7E2@_XE08&%k!1 z3}#rRr0tu@G;2Ibi4J@iII=_jqPzYBR~2&UgN;Px#=XW2ig=R zbmPImeKB^__#~LJ7X62Rla}lQroKhBrW-DEKRngp3GR(x-6$^4m2qct}%0b($e|2Px1D_ zV5D-TP;eL?f_!rxGvCh78abcr*AG z;o#%cAy2LnbnB-UkL5Q=7<+e#_QT^dYz3#Wk~Ja!M7Ez#d%uEOL;kw`|7$e1-~XK> z%*y#c9O1?PfX!Rrww|dzKx`eG!9Paw1h@s9=d%E_q8BTh4(QD3U0zhN2~;}B6yCp0 zYa=WA^^2`woxP3s?%0%Ya$AgpM+*mg2>>Ya851y4+%RcVVsLd1t)8 zPJ^ZUX6Wv#EN}1MNTGG-n@(2CWA}qVMskMvp^pli5|UlS9~fj<6cm=oM~ibMv|sl= zYfVd-Q;u4OVqm2l`c_|Exg+-`*YQEy=~P&)C2ZRpe{@$@>TwI^CN?6R4I;e{Rd0`^ z!+h{x|Gp14*88;lS|(}2Nl+sEm1T3SuCC47mT8-;*ACiu9#`2$00#P5%9^V751Kt7Vuy{JhX+B(DDmSYopW4XUX}c&JtB69p1d4Ff4Xz8XAkjC!!;|4 zGEOkK(@{G?=?e>n?A(v=*J9x7h0TL(NzK+jguzzHp<=_fa_QqmeDF>a2zqnvKu)?P z-wg%gs54|@G{%kjuq<;^-tTL|^yoVnha`aksRW8_`P&(!XH5fZO|ENg11z z^2_-~DcMiDU@NWl^%fV0<;Kj}W4yL|%L_JOL^rhc{oyl*P?)QbHpN&Do89k9V1izv7jjFNG zaeWi=AeZB~T*ew3(GvOR^)8Wdva^QB?|JyqLFl0^G+b|J`4O!~IA@NrWvF=3g@GJZ zhW$yOG;&2gVvNoV2Ve%f$Gn?r9Fi9K^_rHecR|Tiv#bXh2jXQiK7fq9BsjwxpkXs` zu|&`2tr%AjXgelMA9!XTW2R{qY$rBe2`CC zXB@WzHeqnXQU2^_gz3Jq&scEA z=rfBQ0gL~NCT97MEc-r)mY?CO-emk2FQs^1f_FA=+VVOg| zQfOgx9keTBt#u-?jD*Y3y3ZfX9oW1%q?BW>88mq=_KgIbYnvc_uyAZTEl>{3xyIi2 zemId_Ww-Y!Rs9a9(}j6+UBi8W>TTD!kAY-4-4n*0O(q#Ew}244q?~rmy4&Xq{#H#OPe*GXVltuzNT5?3ovEwC!&A~N>n2F0>r zG64#igq3*OQxBdBVd~J6ozw2JmPMoxM_@ z|C+QJ?>*9j!5wFM+2wu{x^-DzLpQ~K6iF*T>xm0|RQ7r2GIy@45R`X>QD7xhvL-~c zWg`QRSVa@FfYSx9Ck7h94v&Y#BgYf+*2N! zaV;(7mYux|b}gDT$>=NnxViio7KAQxSmYVvrbs`c7mz%9{QkGxVQ*Qp=mgyL=-btb zQ03T@#QuInzxLPBs#uSOvJ7{#TZvKc?q_^i^}(|N6uC@;BJDY@Aj4{ojzhOw9T_S_ z-sG@rJ>OtgiS>)mz2V@dI|}CZtK+_^Mz|DgTjauKt~4A7T^q2VRP#W$(;J#;!gpz? zJ}lkNdzH%sRPBs{Yn;~Dg>RJh&@lE~WxFWBovtSdqBC{n^!9hL2@-gadT4V&`_2z+ zTNMuFzH17z(UQI5MG#Xrb9W~W9>xhH>hF>D)J*`XUhte5ZI-f8 zz`sWmIG7d>Ma+@#kn>8JVY-eRvuO`spC-0R;wQx#VcUZ*_-AN|X___zjGIb3$VBvT z$m2~Y-)5WZniK6eiePRSe2nRdIu$@$zTO{V>FZ&4Gq8IxY>FB>JI6-%s96sXe!T$I zvO#1;C@gxq><;RGS&LSkN?GR2nXdAu$?Hm~xq9C8zFl2u*CFYBQs~b$_xCgAzK#T*zix&Lz@~)v2V+mXC^R`6dTK}mL&GgLSJs3<7b6Bnifw<1N4gu zXMi9CFT`3&ZKvRZa_b`=iP z8(3X#$x9g)-A{th4d*6*BZm-=RfIUq34dOFvt!)y<=OUq==pN5^O>`Vsj|@j&ZpHt zP?-i{DTX(3BXWUnvRfw zT-2Ed`e**5AT>@M#J{J1ZIF_*E_2!T+rp@8zU}`t*@NzMlZ=aghsoTOF(S)`C2|mh z>*DcrxfJ`%!w(TE!NJP2{;cOhmSbxpAqYD}8B{zlr-f3~0jp%bg$-_mF1AlX1zp&6 zmnWNl@cxOJCB1ky>b`a;oYP1QVyUu7OdNDUkIM~EvAm_IwHIAcqI}+zkLsrF4o5|n zQm*{hB0Uc`nPATGaBMz(6uY#(NM~t=#eW{R)D`FTEc>(~KV(Lk0aZfq1bJDw$zRRf z=zENGIZ8E8I`mp2@FzZZHXkIZ0v6Rvl4N0vgH}Qj2S8FF6#}et=e<9)Dh3Z^g-wyK z^Xz>*%#oQlpG3w9!F2rd#~4WCX>&&&Ll*^QiFXAemn?`Tz%=TLdzBO1gPAQ-6T9Vr z%5*W(&@|Y;#v0zwNx^>PF-X^dl-n9bI;j=5Zom%n<%~nc@_6)Hc9?}prj2}H7_d2@ z72+eqhQ#8L`a>bKsR3>e7v$fa#ZZ&a-)SwG8iN6@odvFt8WW@dZs-{P^W@9CTYW0(!5HOE<8SXgk^0n*eKRngXNC%#_^S} zqK|ovQ~ZPQDWdFmo!YND^5vi#VR>O8fdOFn7rMx!HnOH^;j2$1pG6LHj^iI3d7!K{ zY>TxnRq~DGvl7TPY);?ldq>FR1jcnykC-6(x&>%I{arBFDR$XNais#onZM?eS973kQ(j9MvI$=)7Zu^`6Ao>;h@fIen?(=AVC_CM+0>hq-$H_+HY z@E;E!!C!5>M)pZ&OeQ~Ht`UJF1Q^k%jw%sS6)6w_`mVuI48{_hGhpY>Ge{pLSJ5In zNo7K^Z{WS;PRml+c}*ENLuiue7JGAVVp+!M^_O zhkl|u@S8SZ4F0{YAG~SzVw6P>15-)SVWVb=YW1k3Ib?=KD#qkJqccR6n@mErvO^b0 zHeonNW@d2xB4;r`3EF-ayf&>-4=a}B3tuXAr6~4M9{WI@6qhg2O-oWK&UPNh7QgK; zwX6Wllo*Fy4n3^L0Z%|~bRS`Z8JJxHW0{k|^Yjor-t*-te3&B`V- zM+mUJh>dO(AK@TXg|Am~UUwBu1!_g4s7_hr5vHZFAjuR41?a{MB5nTyKP3&k1#9;9 z?W##MmM1>iHs2D^2+Ps;h`>E>avDE*RHhye6m9Ls8jv!ZtiMU(Wy14q3lb+%(g(TL zCtavf@)^k=z|NIQ^4JlSgdA8+Tj2$#)OwvOyinV<3I$IY^ty!P%58iaD7#%1P@S}I zKcpk4*48>&uJndR#Dj*+Q2m+|27z~TkiM~-*w^-q@k{fN;wD6RiumghOckh>r2HB-48e**6k;&%8fH?%zXslge;YZ5tHU?Gf2}7>E(V6$cap9BAZ@HI z1M0bMq?O2?rE>Ai%#QlC&xmF;IBN}O5l!vEgzCqI?S=LXU9gY&B5X%Zg`&Z4-HmZPs8gVMec)H zIfj~Bk|2hZf5|cw`$a$#%+GP)UYd-QOpT17EnTc){k5lEpNWs2T1Frk%h<0L)Vpb% zR}Da|wdvLnLfG|(l(LSMon0jjt1k@wZbcsjK0!AplZcJu_Y#_Q#3tU#3e`byH>s`j z`dfz{gKKb|UeOWUs_kG16S4B>CoKv~l{B-Rb#ns)01mkY12R4AuN81BVR`Xy({Z#T zyfkwR0;I*n;s@1#E+!FpGi-?4zvNYLy6lufyRHyBULTP(@Fonl9Tj-I`Pl~%TWOw& zmF;;rZ@(}%Oa0!3rOm>3@^sxfsZ zoS$jrQo!o|811}F$T;AT8pJoJCS@Vo$5eP3Q}d%}KyBx8XY zXSp+aRP>8t7Pa6681#+p?%&=gmakjRfn1dzn$5;Td51~Zv@qy$X|-fEIhL9 z#ir%Z^E+0=*Rg1+-fKnxQFU2&t$EKx)9i7&ZO{IGZ~iY{6YxEI=zw%GWAfc-Ei!tW(ml<4837T}%^|zswTJxZ|F!zK4zeW;Y>TKYjx>e|kF>P8$w_Pv4&hyx*tVqQz z6@Rc&FQYqDYJLgupMFo|eUXMarKD2`Tx>dC+W|f8dqOUjJqfCZU zdiV)Yo*OquE^ADb3x$*bA>QWL;LuGRI=A^@-OxZ225izt?h+f~VacH$uvp2H)Ax`_ zar}!4I}oIj#?Cg>KxEW6;->NiY;e%hAtuijT5*p|v{;P%MLL!rd!|&KG(2LWltu&D zS5{Ue;7Yhxl0Bk+l@=wBy0X1!rQQ2t2Ez!WJm#$RYS}SkI$jOga3F#iK6xmKt)lE+ z(MSjvzh#giHHt}bqo$AxEqf-VSTd;BqPMwqfcgysbrz3LF91=42p15N4BT4fx=2XS zS1JoE_p+4KEqQt>Aq#irGH~bOZJ}RZp<4%o$6SkvdP@bXkj|!WVzrb>teF{kuD20qYv4-WoP9QYP;xJ4})udDDblGOA6>dH<9Q z1G;JeuEhe*Bz7bg>};xi4<}v57FmpHznBv06#Ox(hTep|Wr$lnXu(3cs|ah2kz$ad z4%RZoxt)d5(mS2elq4mNs5JCo+K!xbhSn(O*B+_LXPZG$c=qhRbOVW8e+XZ6%&M5? z$$L}E7f<-yhC_V`{Tp2)--nVC^*3!{pLnPptF>#bH_M@gk-ESjHgN@rredm3!Qp;g z-g5%akCBIh*H9RfuV0{oOr7yem zm=pF2|6=F+)An0l;`@|}IE+{uWf+g*Ob zxS2R$#$Z9X2%=dm?V~z7Pv}uWDaRtz-DY*q**LY@rkmCCpqM32mo4COLmOZ^8wFdW zq0ipH&;%(6mp>iGwa=3fQwR}O%w~;_UI*E^L+TZoGM$E4zWFF{eT7fQkXpGvkrwacf z*BC+jieKk{&2WTfi2nebGfgAho?6^jSM}FFJztyOS~(WvnrqTSU}l>eUICUU zJ(F?Ii13o*{u7LsI8}vRQ7W-@B~X-L-IWp5j0flCkf&}$-`YEFT7Oo$pdDCy{76;? z@Z9G-6ukcg7rzQ>fbzX4v9>b1%#{kbe9U;Fy25By!Eqr*s-h#AYIpt218J5dA&HNck_+(hKJ#`d3`j7)-C&+j3#nWHBYb20zxOo4d4`uW|{f}$@Jp~d>2(h&HfgFjS z3F2nU?^+&70(sg~%TFH=(_6;*nO77Td_#~v6o&a2;-=cx4sdPwSIGDHri$|Ul^4lC z0;JVB=;oKuKQ7rVDfxndM7Ax;5!Xf(X@vKg z?BnGx1Nj@vbgU}f6|v{_)2!U9NsJR*h!sj8I}p>A*Ic-Q)}xo*cO4v~SZWxeJRS}= zmB&Y4`}|)(WXHyz|C`kM@9vIl%>QGhr%_|P>b?o-$K-whG2-Y5^Vt>kB^7Ws{RYei z(rK=;gny)Wcm*@}r<1;C>=$s%#M0g}Wt_7M%XZ8CHvRCYN}~!YIAWpe-VM*beRFjF zes4Yv&i(+?Aj{N!Ym%k789U?fRY070xcs`VZ~Ec30B~cRugiBG`Ks*XK;gb$pQ1(gUc66Yog`r9l@*PcP;sRC;Amtt26A63kK#-Wz0dqZ`1+=ju;wR!CDtImh#f4R!i z?C;|oJmNKKbKl|e`(v~ou!}ID3T|fnl04}I)^?)!4bCC>{hiHE(D6a9+z0kolzVvV zK(>DRXiQmXVGE*zI89I}PAjFc9dN7Bph>F@pUsOEstKY^{=IaSrCw>Pa@C|A!7pVV zW1f`c{06@O?@q_=72L@`Ggt>CKV@jw4(>BMhBGc@v)e1YJ$HyY&LWj{6eB=t7V6^q zS{WVUdR2216|b4PQG_EK#|s-4Et8S)CkuN7d4I6Zl6~JGcyM#2#MaRNEA045NEn|e4bZh`J3X7J}vcEF0-PR37r=1e=*bv1QWM`)!?m#R z*5cr<#3i^7ZowZ5^$(6-q&Z3RPq}D$y|(P6X1iW;$2VRSHMKzD-Zbsct4wV8=nucf z=Es_hP#6kAKG^Rq$kni!Ee=xPvP3zF$IOlRJ;L{_#6-)pGe0}8_V9l(_DU`L>5TP~Fj3L*9vT4Q!f|t54<*liuzJP^J8Nc3EwXwcW#oQs~=mOhg5bmSQ_e&gLQ zjVt)u<17gkc{i6v4T1Dy-UPT$qzNC2%3AH8yTH+gGh<(FAZqF+hfqV#P*dHWYEe=i zM`XU&Tl>SWbWy0xf7*%zEP|dsXd;#v#-SM3|e8IMe zR4s19OYXY(B3&XQmhj)SwS9e*GBsG_3QM3O6)+|nWCzI%-C@g6y-r$8ompN^JP+!j zRMJqqPxDm|&Nh{Q3_y-{v>p@acu21WKN$l`sM)XMV1;v*5lIHWHY4VeAU{n4pdz>; zN!8|-3!CyAm*sV_Bs`L0Kg{&lqr2JXkHo5UrmCA%UdJbB)0X|(k!bfZcS~5BSE|B+ zpxxUOq3eK6E!FG=*i?aI_|6A6YgJ0mzcN|AVjXp+^|IALt>>Eo`TJv^uu3($GV0D zAHX)>E`kq%3n}lxYJwB4vK2$MD)o=gTlDn|Nwqlq1Fdq;cn3Xmo9imu&_mMfw8wU1 z#8~3MUPtPKKtwI6?aHvbAcT}2Xlk$_qA6y=(QV^sA_`Vk76uyfy)JvT=U zm_6g*NC-ewmtm~uBrvUv2%*q~XbllzrE*Y|%qTh!3>`u8HQ3haHOF#$N18)63qoX)T{6qRK99nEv}lJ__L2VlU@j*pl( z{#Al!R2#*K-rV7);uGIggc<}6se*}eZob_KTGdyBf-*9 zjjYapOIMLb?8#h&EsXXG4hAQ0&OB|iOru$ouM^XfEqIX2Ai!#G8+Rl%DLDiNHz?Gb zV85d-I_0!?0cM4zN=%q1sDVxX@Z42A@N&!1;)Mro@EMRttC`nIHB#QK^0oC$=j!h2 znvAl4NR1*+mjpuWpZ3fJPLnOB~Sj~D}IjdD{5 zg)lnqioTpo9?tE-We(@m*n+ymQ$sd?z?t^7KD3oME1@)*BBjBUR9R+yY%33YG_Qbq zDzN^3e(>Zi1RVEV!J8i?LFDwGoi<-oJ5Y%BK1N%_et;OGBp0KO+JlA2JT1I_$rW$65km2oU{8{YogMA`}de9Fg1XX{BGeWDN+nD;EU<|kzm4sArB@t zib4zefDA(mN@}apyVk>3;ykgyY`h?zITM6lT?JT9a*{~##y;(RWZK;l?3=?~suGp2 zIFjX3JBlTo<7&{k5f^%2Zq|5JY|BbFW_{)ZEnQ&@)c#(mVa-K=L)C9D0CjOgFI*)-W)izt7cRA6MUD_N-wAY8LIE%oCbf&??V`YtN3| zf{jDf{&xDz{B~A|o28jUjRId|z@4djdjG{3DrmD+W3>&~7csldwQ5w-0;a_Y7x>d@ z@X{2}#28siW-NJn<)VFb8ii+gXyQi}_2YY4#1J@4e-9dKn3Z8&K|3UZ0_(M1$X=_+ zee0IXdCBtUs0#|AOR4d6NC$%wFL47eawAubTcikJXlEqw{`{$Y$l>S6_6K-~g*NoR z3DWyXI%(kU-Uz!$GV|(r<6HNa}iV ziLbOazm?Y6WKBYfdfd`;WR`*2Kx~lD#6Yz`SA(p6yAM#CPmqxwmlHnkKfa%lI7R4z z5Du@KA(4%Rs6KHPNwToHFTP$7-d)q8{qDa*JSNR|iqnd{?%B5~5i6PDGRKkgl)T~5 z1K9V0PbsuUA6VEI)KlQk&Ueo&JKYK|>~TfifPbJ@DB&zk0v$)QuaB}VJLmDrIb5_9 zTVzIT?3&qKvm(a%bRKl4O0$+*iyunnIae%sLrwnte12Z&Gl$Js!rP=|W&eF8SEOP} zUO|b`;-o|T_}Ee9Svo02?Mu@7}~|GZWC+8Y+_cs7z{d`HQZxk z9OBT?vR?NQxlc>&WQW@k%)cebq;hX!digxiI!HLO?8Kr}kDJajudl2KQU>Qj+ z3-&)35nU4G#(5xrV9kNLBUGyAIQp9K6PEN4fanf|wYVeLZoQJ;zq;28$f>g6)%mC( zRN^T1W5kEzcJf#n^U5fS{_@E2LV%6@7qjha@Ihe#q!BCSb+(u#u6Y$UIv2^Gl7XER@kC~B`|_}Js@Tq3%JMwbaJAgXz9Tx`}hS}XEVWjG|-#a+ya zq4NIhE~vYOH`8;o2?&?hyQKZ{Jq5}v?_bEFVU-#bNL$z)I-~dFuxcW)ct+}@tXo-a zzEYB+Lp+TuR>GO1kJb8B{0DH5{q#v*0lp);Hkt}_=!JZIE3^gs3n}#y;Q>pS$8cw> zt`*RZN?9G_Hko%}>x8V3k23pH@qmQoPz)axd82fxp!CjbVhlH#HIK@o5$e-4tUMJK zKoD~|$I$SY#&V#{;2qvSCl_HFAZ=4jv!W*@ayH|R6k=Az)=1^NhTM^7l-aJCQBol_ znS7kLhk;&|J1@{xc%)=5`Z2B@K{QJ-k(u=(OKj8v)SRG|92W1TP!%o_x+fA~*gjG?9p6>8Zm;vBb2kHII5` zwa66t>m1)M0*GMgxN2Ym6Vk352xaWqgNYVFw)3r{EbSqc9GXelal01& z7ZZQH+7#(}3NK3H|Ax+Hq2o5K38`jR|AuF-=8H78A~L1`Xxc@-s|mFltHghIsQ+~8 zm;BZIXG1DUih|FAiDzGXL+#jf@U*LPK?-@1J3|lYhF^F)!^Vd%VcomjuujPhr|ACF zkR3Ed%a(#5pXzB5-6N*~o*r2gQS(xofGhOgC{Rvxyed=Zx_i1PBdQN&ntckD$r8&Q zicojbK^c6yT>}?Xn6$T;wy=g_Ak>=OSP^tC^a!IU&ab2^4!0_$&qJmd1L@r!Xh@l< zLDV}#ChgI1M&qFadhf3MR^6xJ7}@(dxGOaf5W1ub8hSh`@ec~x|7|_g4g}O0-Fj{o zw97}@505Jdt$U3P`l?s3?!b*N`^qnEb%cwFa|< zn>>$JyB)@gWN8FpKKkizqw}}G z^Rtlh-vOI1;3sP+^|E?vs>4O63n` zr4JN&v*zLMgz|@UQ29xue>XAV`o-LMLRc$3n7OW;aATHe+Ah=qfQ>{-)E{mml}c8KF`XoRlbg9Zx9XANeBnIB74uzdL^RcT(tnOLo?W>T2~0$~ zd4$(-__xxERg&XCd`wLlTmN=DsnqRobKkW8))$LzD`Fk0ZaQ)7r+hl7J(ihmAdkb# z6&f}Yi`>CN)EVeBA#awz{5#uY(UJ<-NByNkZ{n1+hZPXEf#nRP%&ZJx+Sp5d^(kk$ znAOWZ@d_7ga-1=ZY(v&Mb(YPUtKDEbp@ApndvQGx5>J+|Oz?}BtA#FZRDJ}1L@QqT zLv)ywCfVTJ4DDAP;vY2cBfn064D|*Fs*r@m>#ASv`ZZ|nbAUNT6%kN?#Uf`AIqVBH zSUJL+AD8UKy`}BS-(JSd6sG(Fz(;Jdu=3se6io8qAWshR9VADl_$&0 z{A($>r(X@78WZiVSUPMu*PWU+#b`R%xC4x_l1gmh`1;lY`yOY9D8{Lz0Y2h^;Z?|( zSg4nRO=f;8+3T=6`i9kK-j1R@JyweFx)`z*mj)QGoch@jBUUBfy-c9XwsB_Iqaq$! z2TnpX_*;(@=8wv{8O*D$5x|ADaJ`A=&V&0&?g zMZUX>{a>VxK`H4A3lauKBwmU*eo@bj+TQ+1%6neH^6?q;)l^U~^7GO;q`jyQ8O z*;D7o3KBdtu&gYL0{f0fW;%yBSJ9&Bq!r=&ArYtpzq=onbo#fjLo!9Ol(2c*UT8#k zLArE;c7eLv%+%-*|ADJUnuf8$3dYznBUS3yij#Qvx%ve2g)lg@z+)M2nurHeJf{`T zJul+v0fnlAeZSK96fZ>E-3)qq;r%(p) z9_}k)DZcgS0IzcQHFWsX1?zxbu7SXPbKzA+DchcA<(VIP&wt87r(T8~Zu|_AD7=%kk$9 zv6jTzv;hX5f&3ULz1mPq)w6apwmm$h&McLZs<9IG`%7DpKLOQEg%5Gko-`w4v!;E_MY1_5`U&d}&8UIJ?m7eYYuXLxh#$uRTV7pH! z&Ot?&YY^$ng!~5iZCs8~4`+2E>7M(#51$Hy6UvG!Q_XvaW4|jqBo!5q$8Ly<(|vMR zg}3-vF?cbo$E-@9*jx|9Ufzm3zP~Kr_i`-^lhiHN9-XD}q!9$B2H6cVl8Vl)YDi!?-WW~an(1$ zXY=v>sDFJ9Y(No7N?1|j^&^&>7}K7~TGMysn=xXo=uJ(3TQMU|yTcDg@8AXX;w)j-SMq_d=;&D7fgCzIW5taP`$LB*WGx@L|MtTI{pF?f77aT@_Q z4dPP!&=-Y2RxWGHgmjcV5QgIYs*@9|RMdLQN&MB6CL+k8;uEx5Fp!x{a}$6o)sr9g zZ^R_Sr-ZtTjoit#nhxdR3iT;7)pAhP`b$ijXN{_q>YNUB2N_w&?$MEqtZ%`+dG`FL zyjCt$I6e%KU*^wWae=A5bupU=Al*A(;{3pLn}BtU`%enFoGh08C~l&6Unl$^7khpD zhO_vX%5(mwWb(=zpOVuaxu}mg{6QMNw$aE1qp9!mOceZ(pst(Mm0i-y28_bwphU7!N zzUgSRKnc`{FaUr)Y5Ob`a>!7WSRXtVXZx7o=B$qRlBW(iexL^~Gkj4b&Pl^lnJhwgf85_hfV%6;`PLF1MdAKSF zU&7^x39cEzyYsGRZ#;^l982Ivc{0YZi5ea5Cwb+%&>7&~yk^JtW-`|~y&kk<)K-9= z=3#r6kX5M>>I?DlJP-@_sO9Jgn@Z5=-$Cs~2o)_9salGI=sUv{n4fu<|M=+jBo74C!5~!&yx%> zH+JvDy8Dl0_plV+Bs*Fh-X%A%ZgtXBPJkQ8?BL=iUCz{afFqsh^kCCfRGvdthzy>7 z_X&Q-HBBUhvUY%cOhySwg{-}e1WuY2f@u<61>RLe7PsUssAmeI!vmk%G%H8uvY|AyTV;TyKkz`Tfawu=$W=EPy_7 zazF-lL<6b58q5^|x6uH+(M1^uH=}H8Av0f$)I$n?hL!1Xe(OVIYdYjghhJwOlmPN#1(QcL<&% zNqfA0G-2%T{l8W-NYG9uBII6O5fQj#&Wvmvx-oEeQ_m%@DPL))X09iW_)T6ZfA zbUNU@!S*gD_$#N0K>6rdPc{UTj>B1kgAf{+wLY>y#=t}vNl(;kyd#mD;N>oLDBNrC ztql1({dxB1nguI$XCjzU+p19Cej$2gq#_O2*SY4Hd$QbL%QiTvqhu3um>W7A=oLHG zVJ9lYG$&a;G$tPl`o;0C_ouye=8{hrm^SXCPRgjcUy7LdY3BJ>@MhoI{%vTo0&ba< zv}TqW9KKEeuglrKkpDz1Tg|?y+wkONV_9;=LRhjG2SV({d@&~s>j(SFg7Ac28?OBa zF(Mw`;}z>Fq?hC~Eyj>>F`ZGq5*}Miie$|L&&YW*YTv=ied} z8aQEToI&za$4%CgtarHNV77MMX3L+xK7~SH!hu`mdc$N1Xy4q_@D-}@tK+=Fh@EkH zTy82wYr%aT8jkIxM<%(apely&mnAz;!psZ*7P?BEm)~j{QD-vcAS-zqz7lu!+pggA z6ir(R4DJ-lbD-MoxTq#_N_zE~f+cdH6(P);4g5rk@;y2(x7E-EN)4$l;By%{*DhcK z;jR1Seb3sTE@o{k7$J&7`hwYkn=o5YC{4 z)fxvt+q}yQTg9euhCUswsi)rSAl_+PrRTbdzFr5N+56Y|O|QEe?amIu3uBicaShcm zW|ULf5nvtF^OMRoe-7DFTif9YYNt1Av^--T4+l%@ZP>?p$1hp;W6kt-SUs1o1k$w` zxj)@!oa7lZ$61BTOJwD2OV8$b$zz;R#LVF0IZgk*Bojbn>Ts5J4V*P@k9hPHYT;En zFC;Qzj)Nz0yhfAJyKzttsDpv)u=1nj=mXW~#i0x2AR+)epy5Ry&p`aCW7`sh!@3I; z%L=Cflrru-09G4~W*rTV31SC=!qX0#H9-I|J%%9YfhQCo_j9pZ+zk#1MwZd~vn zhd0E%1Qm*5yFL8}D;Sx|?zDixDSL$Tr+U9n7p+3L7}4xpHiq54kx!gW^qYX^*O~1P`1lnA(|_?- z8UHtbmHt1MhpIK(es|8{|6hN##9avl6AES(nqAA2aX_F_YxDo}R}-rUHHsETCNY7d zX>pyqITsgNB&4~&!^g(PG-gcrbb5xtbNBE5x_%#7zrV3DK~8hO7HX^OV_`LxN->lX;a6SICW8k%f?Njs)CoS$X>zWB;jY9WVIqCtrmBUovujE$Hj&YPx3=c zI0awk*-i!7h+F3mr@3W%I?DDB(-((#cMm4gu=CH)tJCc**LrALkfH2U%(|FypgSLM zrZ&4xQuGLR@-flCy2wWu_C;kxXjJHlN7sM4Hzh6Xr3VmUjrD0z~uN z+cacG)adnPtPxC=7p+H0I~>ePk6?BL^`j%w>52>|@%nuP(X@@r2xGoLRz?TPvU;7n zzGDRAy3jU4ko>ds>FGK5%yBKStd!?CM68wxV$K?*(R3Dw!tDTR1?R=56D_XssP@o* zDJasFQB&_NHz!EA4uFz1R~;WXsATR4ML~eoQA(c115%ThI35(oqV@r{^$h{VEf}-l zcd&9WW}A0(Tq-T#ZA&=*z)_8|26X~EgbZutGegro{9!H!^Cci0LM79LzJ|%L*m(DEy0=FD}R@qX5>{sv)+YjpgLuOI4QlgNa-lfQ!z-}O1XeXou1l@yM zQOHy_w?bX^G8^hjdlK>DVdw@HRYX{MrDHBc1}J1Puezxkz0`77?pbsxj32=l%@Ww{ z)v!e=s+G?f+pU1Ksc=vM+m|ErLeb+7JC`Yisk}8GSd+AP1F+{~*$)L+F{^=3@-h3? zygy2=67v#MBuxX#tn(?T(wr2fmM4xt4!yi2TpP%PNd^W}%C5H;b_t~BKGrn$ysR#> z9@44>2FAo+YjX!=q{y(%5Y8^EUtr&mCV5p)X>*xTBjxhfs1X5GDK%{vLQSy(;?G5K z5mR~vLsvhE%h*gLicODA0g*K9hzvhJtjeF|fhyMRS&S zu?fH+b+2~KtWn~EsgSjct1%BtSil5^noNHHiV{}^uVftV9kUKBc@XsZ18oqi1z*w@ zkBg?3`LtGi?*gcCE)tfT4MZ6JE*@KWB*+ zFv3RQ5ot`Ew7^dA0txz)@HaD`chd_A1d28>+Y9c^ViiV95r?A=_0pw@M97rhQMSmm=W?{^@LPvz>j`g|0+)(@kO!0D0wo-ULZ1r(YS9sBr&9 zHwuW=_<<_CIY_LtvYt$w%JbQuxgCW^-?aI>VJ#o*mNoO;B9@!m;ab|D^;C&FPEN~#&W+Gm8YHF=%-`K5MlfLQZ-FWbXr~U0F%U9=Z(kUo(1@xy zp?BzN&{b2_m&l0eMBPiRg^2K$ET7dkF@VD4#32hjR;gUkL~r19{uBG^h0Ry}sbP{* zaZ)Uw6g3$qYX`JwDi0L_qm}lFR;{(AW>SP&txVK1uP}9*_--`UxK7@9c&-*wJWwG6 z0cHs*&26tK-wZr3)6SDSp(okooAARdvC zb@FRXIHLt+L86a?o%X}-16|zhw-EeK@-W7OQ!F4wH!(U`_SXkE7;zOpj|5}wmw7yk zrf%Do2+fm~ZnmiaFl}v#?}H4_W;h-3)8xge4%>@SR`G(!!i2?(Mh&(!LH0ipuJS#S zr}^nTHf>$dH#0|xt?DxGeFLqV-{7!h zWbU#I;&0lxJZ~DnIeb5lc!7lm<^M%@Ffsg3)6Og${}D92`sJ%UHvi%Pe}jfZzkC&# zclch0-OQ^tP>#k$McTW*?$;-!&4?k9Egl|6NchiLy66l_RLeIDf>J(GUWV5ZGAdHb z&CXWy4;Z}j~%`eyzhLnX_FD`T;7lKf%g+l-kFKK`9)g@6 zXFGE@)bOhIvRJ?YhEcGR=4L{`RlE;bjq|Eh2(qqsMAhr^n~pRqzfb6z3#RPxnW5v zDHxuRTB-dOOLCO-h}gh0IxiXlr}g!&z{DiXt0i*mT<{{yLLn+&9go^8_(2O1Z|H}@@)x&n#ME*|ziv`v`-EPx!(aZDietFPL>-2IZ2Ll7QMXvnps5J)lbkZ>jD*+CfeWJOE>Y5Acu&Z0C_)&PWPV(`lmc#_#F z`3Ufcnt9tlh_GV*f7jF}5UAO~u%xKTz=eD+CFVL;NmLF|tJoXjx4{JmXBW z(Hw{mNmK1dOinQluaNl*oo=T*4@Qi=~|@huL2%off%!gFun> z^8w`^*A1b@(cJ+{s0AY?u@0#=i$=wdGX@Dbq2d-iuSx{BGUbrdhlca*04gOqPiC;2 z7tbY9p8*}1vl-Gu#{JH2-)>6%-n~^l01@uM)h%GMbWfq*!lBhPT4+p?K?;T=y#859 z3=szeTdno+#>q#A!63m;?=v!McoUj@@-M(-le|r!TN+p?WuH6>6|SUNa+drE0TKa8 zgm--SdLKGk6t;Ph!esYZ6!<`g$qSjnwiZQ0a4OQNcw7-Rg6cb*Q0i=Ltp+M;vJtd! z-YW&jqFsD@vm8S$gP8-Edun;xDzy;8w+5n0&kv)mq3< z&_Z?{O2d>ozW_W+?N~?kcrpubUDPeGB{c0}A>z~_bvV6cIIRd@v&7B0`g(0KesSQ~ zqk2HbVMiz9WZaQHi;QE)!h18m zn{Ahb8Lm&;`F_H;gg);!@n^y~%n2suEGX^6xpV}BQs=s&O;!j3*eKqldh(Zg+;Z*Eb^Sh=S5*wf$0%?9D z0rf=^noI6J31~6^mERB&AhGJW_5@$0l@zad;k*eu{=gXJu0kwH7NC3pfQiO+CDt)T zn*#4}Zf9f;ViSKv0_ba@7O8_dKS_?eQHP{0w*G!#9Y2 zq@bgLHqh}Y5hGLymk z{EU_*hYnPkCVME$q|I`kZdy7>m8nfal1=1gq;JaCZ--3DQ$p~}Dzp!4ql)+5fgEYE z4N-|zSS|dMk?I*Zm83ya)*EB!y60*t(vDBuf$p^(vMtTcW>O9h;oPW&4>Wvy+oogv zW9e+s&=phlJR&*k&f)d&OrtakE>tvL@_)QecHJhS=lwNIb4$34^51W-bot6VwwZ zhRe9D3KwyDxa16Qtu39FJT!ci>?)IjYW~titqw{#`r>}|h8N%+1W3yM9>f5nF&*U)gDvM_E9rI!BWMT>MW24d$~DOQ z^tRl&_{*O!t6a~y8PQV8)QQ-x_`)qbDs2bAF8BI%g5}VvwoN=64^%!hA9B}QJGh&J+0zTh}Z8$4q6r#so-Z83Z zeFxpTIu&PDJ@*pSZq&TDePKQ)?i_gA9+jfyW8}=C&7BHZmi36KW9C%?E?8x2gPmh- zDBpW3F`~$6(&7-4HJ6qc?)^N(dYb$p*5+V__Cq_uqsj^Zz6?85#dWXm#KxRIH)jE^5V?NAOgaIbP#0D+qLuUQMm7wLlXE3_ii4`+ld!o{~P+La+9*apLrmQR*p3J>zUg-g+EfmGyU* zK&Cy}mG)b*b7;?CokUhEI2X(m#SO0N_ECxL1|{vNb(keb4R@t2YhjIr`}6DjgBUby z1_ItDAuA)@lS+{)tNsCKge8ZLdh+YZTTSlm)0wbegXK%@(HJ6lM~}3eMM1S_=SS98 zHn&ANjCKSsHzRk4+gda!A?-CB(lA}%@FDvdREueT5HpRAonc&5!)|(jF&KI#B1l?M z7O{CnypEv=7>!IzqD=I@YnrpNQe8|rvZyiaX}TZs|6+s2!jj=D+1D`3SC}t=Ku{r6 z>P3I!C0x4u>J(kH3cC+D=vTsJ{8to+Gc8#UjqOm!C~B48k`njB5qV_Rd+rkRo>KUs38L;pHUl4n)KRbTaIY z68?>U@E*6(V?xuR&+eP{|IX~WL(T#MPvkWLh$m}g2oW7Q)3{`ki2wu%s25Za779vk z71#gzu@!V>{c^f7uFX&P|qX7oczV|9$A2Pc)vM?@*_2km${DuT!|x>vIp;7Lu8Y!S!GTP65%> zlE>h(KkZARD-ZsqqA@Oc;bD?!ewfv_A_a~a8AYbX-kX&9Jp(xnFBAiHEL6SW?RNEG z@c+Jtd+=CtFot19Uh~+3keNyNn6p0{jMZ=gT!|U-t?a$ePZ;0-cOxFxg>k+Q>mhXk z&=MVs>AAra#16;>`)A!9&Y&oY2-XEol0-9H_jALsw3=;2>!1;dEtOO!7-S;JmHomKj}7rHYrf0Y}wCaz0QQ{ za7ug(aX=&}2N z+g>*;y&*-1E$r|LY^mL;L=6F>Kf4b54+ceDDY&OeDvTxw?=r5EE4l((#1{0cS~7;V zrjm7QPraXG(Nd6VI!7-yS4gRLP_`Y)*9ZbqNK+m9R3*`&8E0iE#}jov#-F+NS7kp% z&sR%)083Z2Y=O+P9h6nd43@RXsQZj9+OctI{NwZ0trK%rBKH1mLy=gXeH_lFXu%_5 zsLQfi2v4j-B0KJ34#qOP68Gmt)`WjoY}70^0K{M1ZXoon;CjQ-dRJJ%7cNQL*uFW=}~mf0mAidRGGsn_~H#L-0d>x z$mD13(yJ@mI@D`!O&AO_k<|Izs|Vg8!3B`iCz@{oN2hbG>WLQA&kaSvkG_=xmPW#H zNk>L+Q!MYD?0i+f8N~>yVk|>IA8%j-mn0(lIc)}N(h@;o=%DkF8eK68cT+YP9Qy)xCzm zbHCp_FLA?pfYT%s`m}DGB!(&A8S0d1V;Qs*EKAeqgx2E%S{7;U2xIM>sxM}i+1gA2 zYj3K&II6^IlCqLV&)&NSHvE1%{pcd43nfV|OxeknZ4>SKC3I_u^nkUxyl2ZTJ1;-l zuf$(4DNn+TokHn-XIj>rW&57txN4A~cDq&yWi93oNZpD4DzoPm!W8;2r5AWh{#5uh zIi=<0q470&n-pwX7mHe^ou0eq3sm=GJ}#l4uO;;e32^m+%RYAgq_hQoiHZ^^Q+^_f zwaCDlIfg*u4o`9r;iqu8I%zuqU=tp2E9V%QxkQi65tfgC)m*?1Ai6x1-oAoHb;ta3 zCXVpD-gzTQ!P|YK_GY{xPh>7&9(=2INZRNB0)ml~78l3b#+zGR-MH#2*bV)UkfWz3 zoBEeQQb-~gen@RCHRQ_su_wQI$*p13$q-qjmm^B;%vNYjpi`fvTZ{LmN@)>7Rya1_ zAL1)A->Vakj1j4Uqk{FKhD+o}^Wm{K9u)m&Q%{Nk9t?fwZ=yJV>;vX5dWHI#h=<^%3>!LOS-Gw7Ee{3qZlI~nO9A55-VJ=QqA(Umc9j0$_$LL*AoS+H^)KpcWA;Je zke(>278l-_i|Jh7cf51gmBjxhd)WRb*~3QvAF^jjOD6WW$lLw9nF6PN)FP~(FXYF} zZ)^Ud`l!FANH;~$_IQ(u$8-oI;(oOy1%e`3!Yk9IyrQ#w$&(8d}yX4yp|fRSml$X`w|U~&#L8isUcO3Gj=TG5t1J1YFA#*gL*Uw-2 z>1dbb+pnGhzR=v?Pg0Hc&uh5%7tJ({m?doXC*c$OM7VUU+$)e6i^BnT@SSFKVm1?9 zlA?L$dg(7=nH2sHJ(uJ!Q6%1fCh&J;Q0&!H3p=9HObj&=q2S+BV05g(hSiQ}%rJVp zt=l}k%cE@l&%))^K;!UlbR2Xpr~}GtIZ(-f%puMOGdeSLr`f<(<2?N@*n0oJNZ8NJ zzuP^X+XGF|?mJ^&x-Vbc-l9+>yAM_FxgyiK|$xprd`>iGC(d@u8S*RL5V!SrSEx5m+DG_#? zpeozrH+A}6w!VXnL*+K`t;ErWRZ_t;VCS+R0s{AXNpE{-ou|_}N=HP9@_A`mqZ^4w zjN?4XFy^rH=&A@2wCH(+U^llM_S^XRIX@7jEevqh)$VaGy^9=+%{4ZHB&i1IoXbX_rFr2cb7fJZ^WraC@H#T!d&aY|@bUWj*3HWdvhUlw}f5D*3NG>e0 zlscaC2^JQ;>>$h?nr7OA1{z=NGMkEX6p`TV-ug5|sOAWi=NY4^QJROn`wix0s?=f= zp8aJCNm$Odr`BZ$P?KV~6r@y8Bw7wom7u{*B0WP6cK$hC+-M(0FfLnp41uF5`>#aF zIBF;N9!pjb5+bwwnz@$GoBDxkIK=6oG{)OS@M`cTOM%k&87w5N;gPa(VW#ZE$zAV~ z#3{ElX8#_|*3^(eCulh>!pg%Y07JkNtKZQI?f_&W$kHoUHB0~zaCXj_Qrg~27r-SC ztSLHbSVeenHBYsLRz>lLr>Qp>)#BKPK@M+ll%L+P!weCC#*naAL^2W0t{!4D;(^|| zfC>zf_y@@l#AJwmzx%pa5X|sa$O14Gx9OZ1Kit~pL|>))f@~3fE#Gn1s!dY#r0;w* zs;D(x5Y2EL&OkW*;6DZlSO^<{3Y{5MA}Tk?S=pV3L;2Nwng(;MmzLiP2^c@B`~CnXsND3j5}s#*lBb_@Ma1CkFEdS73|Yat zyOV9M5tb2ymV`)P%*dfkh#ltGp@jhEFWYSm{8b#H(f@qK5DTUPx6R6LlD_&XE5dW4 zXXbDea-Xx1f)oZ1oMlqwH(?vskB~#-U!)%S7cHjR>RSv1v}gc$28ZL*zSK)5 z^j2p$8utnd4zKK9$#o$;NXSix?+wrJ#3n2qS4HgqC3Ty}UP2}bb)1~gPhsedA@Zfb z9g{_4b3J$}30V-UNIvDi)`T87-P&lB8XU>t?RB#RK8J)_@wM=v5NzojLg@y&bX)>O?#%$`fv}X#jmpk)3LDmT-{S&jc!b3%hiMA$#`4>{t3_t( z!Q^8Ig#2bMMzX8juBdCI(PvoRwxNrnr$spd1BTp|VtUW{{W81Q-XfH*`;_aJ*O zSd4_r?Ld7Yw2kZ*r8yT!z$QaG_Ibg)Y}gs#9A(85xf_YAGkZDr z%+P66R_98=#@hW zCSYbiTjEGPnGLy&pc(>o$HVW3|6A1`jSHSwBH*QmJ9Cj##6j0irt89? zS-h!5UHjx|gI_v=|2r7QD76iw0~|LuP*xFafBK zIHt6t{sQbDQ}Ws9T`eh}0gv>_1`|?2`CJ_mnoRsaGKmD1Ii-*eaIM9;3h{(k&%C>t z!%O}7^6RzF{0c02(Ku1{7qt<-_Bf;y&@rXo6Zec&teUtbIhDO5Jgbr2Q?>~zwJ9Wd z8r*s+zu<(tG`)e2_hl@=eJEPRtiR3@lj}#~U{NLpFU_lMh5lXChODi&qc;bG`PtqG z3V{yxfyEgK1)>OHNM5om4qdFZ1;^PQc&P&A&~^tr5~7p4#Doq{|{sD z)FcR?C1Do3Y}>YN+g6utySi-Kwr$(CZJS$nV>eSs;Xeg8T9%?YfI=bBK?EVCn0AC{s@cReNnP#S6F%gm8u0mlaV8bNi@yAYB5p3N zRQL=M6VK0t3dry;x0?}IT`{58>flsc=!!O&Rc_fGqOAo%uLiypzIwX51xDsdxC@kA z_>ur;7QOagPt#2RHQoo@PCwvLao zDaju1$b8|$gMnkpLk25n&sf$1$6mynDxTvHmiB|jni9r^;{#}hEi<=Vp_!HcL|?LbNkOgjmOW1 z5lk%|`d?ay=`0mamTDHsCF9_WUoxc1@b{ySo2=81H6p19+t=JQ1vo^HZ&u|?zevD; z0%OB>W3GtXtM`wYftj6$O-Xjsw?o_U&{Cj`Y|UZNW`jc!X!>n4gkNyotY(UJy7D#) zEGRd&kqd7eso^EGA`W&{Z1&xY%d?ZV4Ci^BIt7+ij+J(AbBMPVNoAAQ&T4(b4Ra}+ z^lom)?+%4Zm~sl2c7(EPYjyoLog;zG5G$A_8HTM5@hG`n++CQ<`MqpWx^cp;Wzt_g z;$%#TDET>5h!w$gMdiL6nWX1(3gbF=d6=k)>7taRc3P(*qH;0S5}I>#sgU^&RMa}2hpsD%S^E;fqGQ4OmC}utx;f7%jtz^ZEI7f?ub9-t)6-$#=&mB|T z@gNU!w5PGzMd+8BR>@NxuFvGGhJiSpy9}1masSe|Kvi=fVSCDWgDIVX1hs*m{F95} z{3}~c2pD___2VE$n|n-p5gAf|Rv^O3h5Ptus$M~`0X*`zdyMx=WP(>&-68Ie&~8BC zO0d}`s`qXrDR3iwPL)Zg0c(@%3gpLyD@pm7oUkJE<5o{lv$hnITLD@CyFXxtqIsQr zfkd3K)K6WlCgz9;+DC3`k2p-Pakjyk06>btX!?JVtcEjH&#l_H1c=5-F;*@#;9Xo~ z8Wisu=-Y;_fQCZ9b*+sr~hpnSALi_pR28 zyaxl~Nk~QXwrSjkx#-}&D{FuljpxHWGm(2ysX7=$tF$Ee9@qYv5dCR|xGHUMGx-jK zLj6K@KSjLU;Iu*QF}q+-=(f0MgcTH#Yo5l~>pSw^S{?#lN5(aedk?Q7x*uKU$+g{C zwtw$lS{A97cH6(tt1AmxdlI2J%qrUsb1&TVuSAYlGEv=)4y{2<7=T^op|l>BQ`O@k zk_d{1iXCP))uU_UkSBs_V^$Nui_~}!#)4Ma2wFuJ1H)q}lJmKwX7*jv59ddOf)>FW zZ;$GUJwx2Tdi%Im@b zo^3P9Wrnng&gV0vUu_k+kvtv-bp??{cDuNN=+sdmOAmXgKIgnVjvJm^2b5ckyk+gB%nM*5P!eKOl zVN~6QXSY#ky!AYqG^`y|s1k zVek6=x{&2M9UpS}Vxa>m52>z|KROS14ZWU?P~!8SeUFgQ=RYebPTwASE8@|XYPPC> z@I&dDSeVg))>f5$YL_RLSEl@BOWiC8^w)O}#ERU+rBMtWeVDilYt`rLmz)VM%1xd! zG5%-^(BrYD{H4x%aq#4YpC)tf!Gw73QU)sovi*|)cRR3bmVZp<3i=qM@2v(i$e<}cOqmvkTdR+J_Qc^86SPM=d)ZyeoO!5zCQ zlzD5lvq-PtE?GktRY^)~GU*Dr+@eV6JXUPkG{H1X+i(OWcI$9MUKliPo{A5a7lEiXE3D zNIP^a5R`aaIkIg7Za1Pqb5LB|H>}C-xi8+nkML*{-HF`PGrZO$G!0_HCjCKA`q%)o zvU;(?J_PdbQ zf>i6JY>}hP{_Q;2gu)ZCVze*sRhuzG5$@@-fvS5=^kDD3w4$eSt>u1)A7SJw5}rv!FasD|xRg<9-XRg?etko|5T#%|vfv%~ffT<9AVWP~`cu_;2$Wk**L;N=unR zP*3rAF$Um`IOGJ9HsD;NI+?UlVh7F%b+dU~u@u)fh=U9xY^%x_ z;>E`(5GS=>v>SiI1*ShH$T3Wpc}-xvPt}b~cZ>N-)4{3HIWBqqf{%+fzhr!gwlb=0uEg?nkV*=_*C;^CKpArG0X%^W~>Dg|^=F(RR-xr#a?y%c`F;SWSZ`m;``~Rxs4r%@(|5#zS zXOvz+_s?me!0XX-Y3Ms-e{>ikR_jcebQ*t=f6fFXlF3Lv94UPQve-ZE^2ASfL`8cs z|KKKn4gydDSZp#kYd^2`J}>!xw!D8H3}5%ic`2O4YX7kz0QpE{2}RjuY4Q_ojSvEU8!uMrs%2pZYaD-8|mir!Cr^x`9T*w zBjx!_x-t?w_Wj`{Hx%WOc>U_xTiHvIQ{RAM;bi+atHFT1lC{`vt?@Os9ZWH7pjA_~ zAz~4xs_=#etP?O^e2RSLF6EKJdA{|ohnh()&3*u17A06f`*+c3&O&?Np)qV%j7R;`l)M2-fk#_ z?(|D6z%o(}bQ6IYbRBu~i!A8^>`gi`vsUOWdHv2yMs$1VG|+1id=D#B@N5!rAkElV zGI0ZuPgs2nX6B~J{vQ^buiFHi&C(=0K-AYlQ8MQIR5x%l<$oj07W$0yRir{Ub$G;= z5kB;4F0Lerr--om8UIX@A=hFAa{Zj=g>bCG=XubXbFuc~;4)(*WvczfOhruyFyFhT z8=1ckQdu3{p5w;f7?SQ%hq?wzMHpE;1+3h%KSMrtTz_aj$uv}_ws}(4eECv6$gvF+ z@>=w$4D+Udu9g>RA7KoqU9IqTf)#Yqo#*JWFuZ-7Qr2TYv|pQKu@6!rNfo92RKuY3 z#lb@jUX?klvDo`SlQBc2)gxOx8TXSfvw}5G_PgPLVC<*o8}9F3*9bX_6+YeQ?J>DN zAO#rE%|(1^+}tMBHPJxhawH5Pn&3tBSXSR?1r~U)?;4<#jiV=!6wZ{Nok^7-Ri|NN zX@i7+D5*zzD9aU-<>g%sST$Bu1d0Nmr{e#b2!@_e zQ4)m61?M}{;2TEVn1Lb!SREpbCfr(g2{EpKp286WJ;vMi>mzOuSpMnNmNmqZ%O3A2$LY`XVogCZ%9DXk<(BjblB9%&p&=ml_yTd$y{UjQ!#OEgQw&74Ow%GYs!S)@pWY1{riBUNn9f zZ=`E!^R4QS)*^_BZ_R8F>$#0Mg-m?5rVT8iWLyYtBLOEdUy2ZN*3WxY93PhH=p-Y; zn4gK?*vpPbf6d;0@@F(;L1`q0(y>e!07_$2NIu35if=-6pMr!NvK@Y-_%>xNkp}ew zQj;zAkM1AVp*}}-3aA>SC|OnI!SFSlt=5_YEw%vq!LSSJQE9n5sM7hsPYxEo-YUNV z{TKBTf*ikNaQOBP7FW-XaRxh=N(jGROVXt4P^I?GrQW~Ql1ArtISmGx0>-{0!N?X$ z0{9ij6izNOi~;F1;?nz&SGs$u2i^18c6wN8Yu=KD0QgYtE(vqowQMQA^K!+1m;Rn` zWHrX-==SagP2wzv-ZLLd3(zg8D}t$Na6X?n`?ui0AEz1kl9j8uk-*A`%3ScQY6c2g zPJK`V1alYw!jHz&C}&rMYkwD6l+qGtXeQmDN|O*{Sj~ zOzmb}N-vc|f?rLKNprBX_o!-hhM_wj3cZ?I=c#4lmnDYdk-E3Z3jpwSO^TO92bP~B z6pZEg{%C)FG9~)Gl{V$G>_*r*G=?kxyOYrY+cy0&$*jDgYeR=Q{uC^PA<_9XtTxgj z&zb|WY+*;^lCv-hUhGTBu&-)h7Z+PyON#N?TIw&_Enr5{;pn!I+$~`0eCLba>5gpB z{scFe9}uD7z&!aw^rpQJ2?EVK9SJVf$KM1z9C zMt0fGF%21$J7+por;~!h-R{R?b4@i(%tBT1&~9(QfkjpP*f|?~8#SCEot^cdGFnl+ zU)b6|t?f!WDkv*PRJJD3O_a@NBf-#)5?kZ%yLX7T3($rK(_vRl5dJc0b%a-M z=}0gd^#h(^OtN|phnM7%9_Uu5u#oswC6^P{#YAf^Ai#2vW=4oSctr;JF}}rgYp^f+ z<#_<2)gDO8T+g~n9OY7a?YewvtNMw3l{EO<%4~Hj%(V!0%-lFiYJN18VAH0Hrz{96 zEm4TWFjHa5d6#K)6Ehac$Vpt0y++9&5bF@Ik4LNC%H3iWiJ87YTLl?TrdLs1VHDhY zL5}$LuPkp1l%f)u22%Kn;67DB{?LsN;k10#TWpnBjM^RmwS7B6!rwxBQ2rw?k3z=r zfIbf$l5a*>Akodz!b^$jSZ6@dp(tGsknhebdsgq=2uL?Y138U~v7yAPxCFWFL2oCZ z?^v;a6Rz@f1srBpIcN1J?V$= z?d4V_^ESOVjbt}k8I3$AjME_>C5~KMnJZo#ifs{0u}#xZua=i{6{b}ol7zPH-1^Xn z2&Y6@o?`pa_;<@{-N!DR*WSC+w4iahRh^X!o63_f8vT^DsT9c(*k6_K~tLsFBOr-3NSSBkj7IPe?8=mxGHSMMk)t zxVf-m3g}dmqm9^>GYQ2Z#-XB*DLBBX2ig!)v2W7A_$L>a6ClcLoYm-0b_|!28+ppg zD9#TC1atTUB`1V#R?Z%wF22LO0SBBkF*{h~sk)sWxTKxj^^&WiSe2OJl3iWAmE5(f z`$_uuH|O^dBrBt=?cs@sB zkJX1OS+t8Eh}fm~52DyPDIv{Bo~G0Gj(V ztZ%GOV@8y3vpW!sFZd#6>8s;qZv$@IqFyV$PYdsc?E*3i#Fx!0xY~?-&b%px07aPhBc}TCB}3A zI;Gq~pm`XHbe5EGVc#QjOyw_{VEATKBCTwaEvIM5issp}m#duOt?X&}hHb*^(M`=UAfvGJ<~D*AW&pN z=^dS|92B0&$kG~lsauTa-DcmIQ6HweRL~I1EBi^LLP+wr(+*{;Rd8&HztgHYWYZ%) zw68MPJihLU-rijs9e&%5tCMn~OjIV+#!Gg}YdBM( zbgyL+)Cx>C3FUgStO29X>2a6C@v_`*351S$f|Hnj*J!e-wKLtRMt>GR?)5Pbh(Qwo ziTlxmqr9*yp_vebLQ!>3_ioHnQ!t-EnElO2!3o{qu_7h3uK`Egv=1W9&wOkbcxkhb zCpk6>C&HIK_v1iUlG}3e2zAx75D{x_CwEai_d^j`iofkFa^{wseE|lMaYWg7> zi9ly7E5ug*`Qij}I#U3sV%pmT6Up!+*t36yr|lE5@b8r-AWvDsn-EWvJLIp!#T9BD zh$o6{N)1*Hj^KW!zrkwu^kyzFep7FF*pj5_?U-1gvt8xdC*vBpTfm|T4 zM5Hm+uLik7`0t_N62rrJ?lCx4?a&@x1eF{jdgS$Ub`n zx;W|P6Nr@c->pdTMYYUSaX&D<-!QI%pCvK#@5UrGc}!pr*{-|=E9K6uJlAm{J8Z~0 z{mrr+OlBlu2djS>yt3Tv2W+z(kD{sIa<78$7x$ufShDTz2_l;*z+~C2F8wqYdOMl< z6!Kw|rH^HCZj9YwlAhY_r#QBRlLK9FEZQZ(=MC!+c^^VP!C6D2nLD5|TNmfQK;Q9- z2A(A7f5-W|Ss>;M>DyA%5}%s0;CXp@z=x!CY@2$OzH=uP8br&myV1T>=4xMkBnl!p z1`M{D1&ijnbJPMy-5e&)%ncLze?%sZMXs$dk9z06;&zHg#hL=p;n@@VhMRV=R$#;; zgiC-b@3STLz3fl-eePvFGIyQ_X^pJ|YEY7=@X+tol!lE`dkRa@k-kQdAQGZy>3l{{Ih5MQ7 z>%w3c0lZ9Nd8kc_7@mqz6I04juaYza2z9llLh8YZTS}845BA|8qq5e=8jj*;lqqiK z1b39Qh1a@yFaTQh1N1*U912wPr@`Aa#?p}D`|P0P40{Q)%D|v%w3ChY4ont|$XkpD z5G&zPWgFc3B;lZecqQS`!F#;p^K{?WNX3-Y8PP^4X8*K9BXthkB-$(NicT-pY}1|! z;UU_HTOOo;(S-GLE-720#!yi!JASlBQ zxR1RR=9$%_jk6UPQq0&6-|esAUI{ywE7>#=EiX4(g-o_&Gk6&omvqc1plqo?r(#7% za6kxTtuAds>+W76{RPLK!_Cyn2SNH&pPW0Gf@^BPX(;Emu^M@#^g>5j z(IO=&!Vu!zpE@aI78SnNtN0O&oD8OSW-pl&te-3I!YAjAUqF77lx-mU%T`7J1Tbx z7*M(07%75#B-wiu_2Kny{q_0S5>6cU?M79NWKTj61)hO;wkbSby*T;DImuUvkK7Y@ z^WgS0ygwli0@UeVdV8*nt{Dc)8Dj>K1aI^*e#kO>ycOJ43lFbv%tfP;>%AL+%pavs zR~)D3E-BSjFp-YVT_Dx$E(*Wa%-oqXHv12HD@7wD63{Rij0Rt8W zD0X+CIvzxPe`)-~j^pFjYoWqJMN=HULv!%C-jv`2Q)1)+g`U|$37Da-nlhu*IsV0Y zYM9TVLWRyJ2_-?^e7JZ3m1GncavCU_zx0H>8*%JH5{Q{A-=saCz&T$%2e_my9h?c6 zCJ$&j5ChTF?&=~mx3|vx;{$P^u$$R&WcZK6(N$%={=H1K8dZ!q8B7$1^KBLqze9^K zu!N@}Z6|F9u!Lxt^a8yQTtTMH@%T?Yc@J!M&KE*}`)HW<~v=ZAsmG9U4r+)8wfteCIS z&}u2G2Nw`*hoOx9LhJNY8n9w`rZVO2Qo9_$Oe z^sC-xr78`BWgszCij6yIddB|kaawz~CMseLDaLvXJ!cB!-G>5Z`2*nE5@R(9T z@N`4H8cCvZREpVAiP6odM)66*VMH~T+CktUpo39~!JVp~I3#d@L@Yhcxg$)n!&>|$ ziZ$zp#2aGb(vq0lZ&^3JOEif@8#*BN2R{!8AK8Wgrgyd<7+LfJ~=M_ zjmFcDkL4Q>GD(k#^u-6K{6S&u$H9cws3OPCKY+-nuwO5C?qG8l} z60fJ6XRf@ii#rx|ZLj~M0(6WC7l-9e+W}+T*H4Y=gWoy~9v{8t9?|!JAQB$#j1GhT zi1;nO1viccFkkJ8h&zI3?Qz5Uiter6=o*3xP*~vK{{(?LeGJy0{)@aznSLg zcDzyPnr{2yLb4ttY&Rn@wuuNPWZz<*6&44jIuGrx>%n1!oUTVaD^5NN9XcgTC2p!; zylLM|1@^M!8Gf|N?z;F|X3N`?u!=;(z;6b^A)#Yv76#iH(NP-d&>qF3(H~_|pmDUh zPF8+Cryk$OhD|0Ac;B7k*A{#U16?)28{2eMSOI$yXmPKSy*?8PA(k5uyQyEKyu_DU z4G0t;r43=%PaYA2HoR?zUCVjrW@T-fXG>nm5Q!9x4j%GCkG7pFM_$eya6o>*1c6;c zE=u6W+S%v3mfIn1rTmJHI}owb_yt2_h-`nckrXzfjy+m+9)93)BV!QEWyV``-_k3A zPna9+#GMg<(zXR}7-3tVdwU!k72Sh#PM#Q1mRMlaFf)usu_{*H8(-;1iCR%Glhium zoNA5KyhTl5lTFQs+d&CSRZF&}{yZ=aQ>=p~o~ZL|pYJZEA?Trxo6f`vpz+WQ)k-Rs z4D?d}Jc($}C<>EFjC{E(eNDWebKAKn|X(R(D)*wV%QZE;4%Ln8bSK{thB8 zUh*z~t%4s{j9Y0@l%gKI;j60=5q~i>yK9*K?%%HpwE}E28bkxWW=VoqV};@t3G73M zrRA2%tF%t~t!VB!ylZ2qkE|l1 z*M?O1RfktZS;86^5B5q5Q@YfdXheA`x0=y4%lQra`4&Sj+Z*xInK+mB;#9BWXXtt3HV%{v*e>pp#e5|(T>W%htQNgoR1(B zKrtBJO&P~XoejCLS{eDw6;>E&MN$nHC*BWU>5NWpXVxNIMcI)?+Bkek)d*Ssu{~&b zVfnXCh^;rp;uvvW8)_^yrE^M(;Z>+_dqK7L0fBYhXfA&SNCln(VCn-(?U-a#n|`Zq z*X8zA!t)rwV!GSnRV*%f+2!%Ga{E%mGS5`j>vIO5(X>#GYaWqiT3OVneY0JKlStFy zf=5rW{w|d|nCGXsOEt!F+(>)ag+K;r1uxh)8k*3-f@M(F$Mle}cY!1Ada-304?Y69+eOi4#CjD7(Tl>t3n%=FF}MdT>_sk@3VbSY^JUh8E6b zn-TD=K52g&k`9o8{CjV`58ltR8ol*TG%uoh<)&HXHqz3)z&j z#l1uA>vl;>Ea>Q$;{J(LMMbGWI*)!y$#dy!nrf#^qFPPGmyyk2Z98T&wqQW8bBG?D za-8}#TH4DRsS>BFC~|fgpE%OJiB6B7!{aMjO2TtUu4tKJO?6F*3lZfqm)4!FLO178 zRscuP5g$GKKcRQb<88sr2<-GT3)BWgi3Bwit$LCK-1_f=UoP365 z&yyB)B?;0VIV){MC11)wRtd>eHK83Fzikos#}n~Yu_RCUc^j;QhI91S3BK&wfM04$ zvxG)*brGDq7#l4qT>Sv2lH$Q7(j*VT?iEj?x5mXkUB|+K`eX z&#HvV*io)c7GgAQir?aP_T+?iuz|Y#j*F>ea6b8+SiWDUegMOBB{u(y3}gMj$uM?~ z|0Tn^v?O9KT7S1@)L!8lgSkX{ZwdHK{5DD5Tkyf8k{!mdNmD+*Vw++`XslZnAaEZW z>%xcD)%C`_-@fwcD1R1G%xD=3^`%qZT0VDEygm(GzYk(2Ee zUODh4WICv3gYREuV@yfuBAFM8y9E{IDQu|G+9(hmfuM6nsCcun*BT; zEXsO)e=)8yzfbg3WbNnPf7zm;_3w&Fz5H~3KHXoSRoZ~@v`e8{i<=A2J#pF=tuL7K z6vBH57A;McJK);3pUO}q*kYf`o6BI5t7$NebKl45nLLqaWKkxnIr1iZ-JJi`53wco>RB%*2e0u_YHk?5+&7Yruc;uTLNGJYTEMo~~E~Ft0Tu zWyqtH3%5a`C(mpsPpuHDPBv1~n=hDwEgQh{NDOoz&X_a43Qug@XJnDWve)pS1te8{ z&i)n`3v&{EW<<&&G7A@aRe+Ub$3)5jZDOekSeYARc!K6wj5d8_RBhFJqPHsJqqU(no`*9tHWCOmC4Uy%HcTiM8tcy!m z=r-q{Swg=N4Q>`!KW1tyBtPaMoWB4%ujjh+q4Qt z=KI2?GryfKWVF5)8dXzfPa6?8mN|cy@wBU(<8r}3S^`` z{zw|R_gV;eOT0^4er0SHza?j8OG$ga5Ow$)KA0}l}T!Yf(pxu z!qzBkLvkPiq$vjqymPAIr;*F5m$7*`G^vy?%@YN1P{6OGmbZ(;KXx2V0fPrzS*krb z1@EogWa1K{<{DKSRfv|q3Hz%-r95|{B~ORn-T~Pr9aK^dA}&f1W<@C9TEgO?T`=HIXfJIbk+*gQF!d39EKoHV zqa40&oxpB^>^BX~;5_KW`8U)O=6F!Gdwsm4oc!M@62Xgtw$dbJ%yD9|7D^d?{bb=? zKXO)X7e>Z-FO|AgpKJk1!!8GuO|gZKol)76_%b!#WmCg#m^AgcPYF^(1Vp|!2 z$cc6o9g9xqQG-%CT-BHU3t?RG&EcZ4&sV=<`ZT23xS&bN>@0`aeGAGAL4z4ws-C-= zbws!RrwS_eNwEj78 zar(I{T?>uF-`$9BaJ_)q_^gYi#aCW(f86}|)m_N+n;z+=jJ;aMQ3M)+)59`c%Uv`NW=OMj``cdR8R6h?$Wa?X29$%=BrA1C_XSNC zIml*8^q!Y&JI#NVYMe6xAP4BfUFJ=O84tQuSB&7)(%LK!ofITVkp%jM9s65h`6Tx0 zPlO5hYQ5xfuYlSfV6y(z89i(ty}b9v=#rMpAGa6g{@!JWzN4c?H!}{D6$Vk>eQ>MD7`Iu zb?6Xbk(c?6x}D8j$?4C$s0}FYMJVVa-Knx4|N6PGiKwM|BxrmPH>J zn*%)b#$gA*g4+6nvjYYn-L^J1fu)u{CAfLJZ}XC1!C@Aa;o+Uwr8DP5j_`epiKCc(>Gik;Uuz{UX{-%kgf%c}7wFHhKSB6onD(bAMGd zBR{)z=cM@@zKvx&Y=n& zr-F;4@%yFG;4;uD0)wLPAh5hUtu*WP%UK+?caO#crY8;kV+#`M`&EMdJdAD1sXDCc zR#!1hnVf@Zjn)}*6^i$?=^xr21LlXG;q!+jZ}h9JA<4l88!O%jTzC&Hdhv=F}CmJlUWiNX*5;l`N~ zHBhG&g*^s9RJ@Y>p5D^UH!cU6bZP?5zLY>{GDg^nK86S_-GM4W3SugXigaocm_F(C zj0no!5)*>`5fH+>!sxYN@Zw!x*Wr_v&mu_CjWtC9HqI|J9gOU@X51kF)IU9`-0Leu!nnS{=0ZgJ#P2X_wHkeO`Ud`U4v9U_C)^YSfYOALDGYh}Fgs3U3$P*qAf9UQo#c z*?!1jEIq|KOHQv1$fz(0JEi&Jof&d(6A};{)_i7cIFmU(s(a2d%F0heAI(SI%Q2tM zj(Qes5uW}hIX@Uas{fMLdw%EJ>J6`s@bdn4#1`ni@bZJKihI=sa=k-8e%8=rz6gaL zsjVD=DatC1(Z6|J`sg+NB*Z{_EaoZuYKJb0+KGgWW!Wm3xEBrTM&ia4yM_Jha zS4n;A7kTpkk3bIC{f<50CH+dPugP;J3=HkDn=bWPyzThHY&AWgiV_l3BGE{uNc`D2)gB(7 z`O5?9kZ&hgOr z&^o>+L15|-n+s4h+I29-3Wh0S>poCsb8S1=x^%8m(%9{lwcK>N zqqa(O{j;<4XY_{vM?#XS{ODty$W9!om6i@V$_F>&SA`farZ%tnGmuGQBX=1H9AdpR zCS1G*j?=%l24c;C%TUlNm#~XE5=@o&Oi+*4WlS$aR3Wp8g0b)@ROL!H7I%_-qwz&yR zs(&IQLcW(ri0T!9JODnSo;)-Nn-?y(#V}1@;D-@bn^vOc;!FgVss6@Px7bi(vAnz{ zC;i{;@Z%q5&z;m|w*>z&05bikUhEq%ssY(S_|I@Ok5_Aq)RKkDzbJF9P^`vWbhpr*^cc(WtC) zpm+Z6R?=j7>67HmoQ>^OfJQXy?Lr`9DWA&xgqgeU0NQHUn?h>&`yB*Su+TJEo#pKH zQ0nHiQMn{+x_E*}Tfu9MpNr zsIVs(Q;FiRD;fp$A&cHBfsst%Mp*vss3ipt+36%nX^l$0AcY9_Bwd6QLjtt_nefyYH%6Qx2DrKUt7O$k$UFXs%W@<6pE!#eFd`o3hfW{G+P zZ+N+BxbPK-qXlygX-(uYp_S~mKQ(ZO0b2DTv9yNLf|q>bTreEeHl%(PIII1uzfZg!mpSHPYCL&PO#xr>YdsZgwgp6d8kE^ zZ!IZ}&DJX7CjLt`3J%5d@TzXqbh_vqjvXrA2G2{8Z-%rL9k3 zV3{PPzwiGr?nx@rd%++)QH_6gkAmk1@y~(i0O8Y75FbcW>bk}hL=np5&F#;{1r>%s zUX2lmDads(2+Tj<%f#I^Xg}dq40J?>b_hPTe_0N;k70Jbnb(~ zP*mg1qcOY6OH{iwEc5$ACV8je@T6N-CGymLRwg{c;DZEl@QB3Zn7^2ylV^K zZ3&^I{e;F^tTO9dipDp<8{CE$iU);RVhw5ER+Y;**cwSVR*8#c9Y%o|W5miSH8|dl zZNUp%8DZ%~{r({yCX!=Na;yX#DvqD^zaDiaDjoB|zMFn~t~h+N`QQCvi5VZC%3H7; z%GwTNISQb?*aY-m2%a8o!M=ZKVg!7OTp3U2Lcv&4E=F?LggXZZ%hqreaZ_{(V>zi! ze!j^N){-y*!5n&5%&!`WWuTI7j51hGy>M@aeXDf2pFA9-a(5x9Ib0)qyeeLU@%|}E z&PuYqUx8b>b(7S8oj2miL4nS3CK{Z*y5<-dK6F()otaoReg07%e*mj}s%hUepx~LMq5b`y;t9_LK)t0$%)dnsFf{8Vz{An-~l=5>>zFcrZM@hcQvg ztIJm>0CwH?A*^TDW6#6a&tw!!`VDflGN9gj8IFRsq7$g;t?xSt_M8 zaL#Qm^mhua$*5B@gu#@7UVY-%L;wSJ^4tKxe7?^V&I9ENOoENcinv>vB`lTbN)v9- zTU#`>inc$MFe|3;ZMczPck;Q3LA>K3yG4_onIXdR<)|efVQ$E|Wm%c#->`6!z`tZ>A8lhu@jU8s9*J^fFHR{$v$#4uBZjc82rO`1U_M(n!T zU?N{?Cr()`18A3_O-F=)MlF_9CWvzrLydIOV2GG*{t>;WV6l^k=HC)x)4*hRB-AyN zQ0I$Wh^GFmn@9h7|XF^k$4=_x~h+u8%>wcX)ftw?-GAn%o z47W3QV~j7zsV+MrCG?c1!^v-bXAcQ+VxH$z+jw^_T%Ak>}fs zUa;ezJAK3fqfN7|+V6e5&qKZ+PVJvZ!`B17$KJKm)PsQ-?^b&rNmdx`$j#8bkq10i zQoI-qd*3aXgp73O)*~j<@AkD<@xTwAAhqL+-~JAwu1iAzUNg&9@Qd2dno0F_T@^$O z-mTlzl#m#A%YXViU4Ax8mHEG~j~c_9{aKwQD~1guEE~pV$2FYexFQI*OR@GOs2o%F zaw|H8?ly3(oP+~>zMszW^A)!7x^1}}JdUn(npE-kBgcG}?X=v@Uk@=#Tt^o*1LRpt z1HKVi#c^*pJ<#K+3R)05KRln_uWzdpX5%Ned~r2D5Z(_8mO)%S_8gkLdDjm}oV{~V zlV)T)y5aWotY?DY2qhFcpH*gNKnH&H0V3fs1X!($tL1SRg*(oyYuZCx@fyg6B2{?O zUXKf;52{|ul6&q038HlcOqri}p0;?y3^x8T{Tat5L#5Psk+(>D0hyg5UFaLNEs)N{ zv|UE)6M0?FUKi}1-)?_S^gr9k#KKohvz{*IDOhC_DEdiQDyYsv+mh~FRFyexGq8i< zX;C#eHYC8f7`p2aeWk+rkPfc0a;c*exWd4J?#vG8%D|F5d+$}S1*@LPt^F_n4GUW4 z#TonH>A(l_U-7AcWYumC(7Bd@&IlyrH@(OZ`Z`zA70kdiYrfFd+#*XCbNms67OT`V z(1C%?{?tNihAT7)K%o|yiO@+Zf#f@akIeWq4od^M65&$=+)^oy$huZ`fOmGg$9d4a zhct;2Emc7Fm+%CEzbih1vuK`4zLuJ2g81@yB;sy4L0^+gMgU7bC_v(s*SUHJfnYiD z|5@^bB z1h1KHbQz!vktRfam^%8KfOiXIUz|5 zGh>P+y?ES&=?{}-`#18;Kbays`8X|2oq;7e192%7s9*z1IBf@T>~lm;1X^`{GOKnz zKg<&HAK|rZBJdCaiJNVu1^))U3;Oo7(cQRi8QRRAh9pMe*dMYiOkkIQ`fOB5bi?Kv zUjuxe>_6_#MvM=4V_^s9PR9dNO!h88E+3qeq!KA*GeNFe=K(_>QKd4C$i2J9aLMY1 z&*Hv}6uHC*)a`;yLh;SenZRr!F!(Pt)EvO|fYMqcv|Y<`YjKdso~3@NVu6(U_y&J! zuTUl-n$bQpINRZSAjbpj84Zp6ZkKjr#SOo9I&)kZzeb^5aA1{z*e0mW=c%5mlKxOZsX>C7-JjNTa}{36K5|1>|h88Arlp`fk#-oSC7^O4$l z0~tt5doZka=h>VkNx4OM`~C^{ zLPZV)XRh8rPE%vft6PBgojcya+qhyBj+fq^Ypi%;Mj{al@f;cU$ zK`oPhQjm?2((|R@xp0zFbAj@bs&hn^UJ)hu?Q*tZ-$OuKcTPK|U5swPCDEo<@)+Et z-!wJ`sf-rTBO_^BGjunhMTXY%i1_yA*x2Z!5G@ z^OzfzK^cs}kvlNzHd*s7R>X{w37fAqTkgcu6O*p_7rqc=>JjgSAV>z@R)*~ZXVXRz z@>+MvY!jZ+e$FkYdKq#bEuNR3mpvzHLh%?ukv}oS&Vf8v&+XGI*auS`czP+M)t{Sg zdj&#kyUJ;21*zvG9m%79#2xo{zcl|)k|g}b4X?Hn+f^?&BEPnaCa-D&Py99`b|)qe zHUwQqO%uGpe1%1+FC(3KtPCpx4p8>TCEky+ou6TGGj>R%JX2lLIZtb@%|RKW?bn#=KjSyOKTwyt10}^)6JE$PPgfH zxO}e+`eiJ=4p}DWC~P}zmo+Z?BRidu?!+X)dc7l^iT%k|0&asP1EVi!-%u2uMuATx zAALQAwSe;+sfull#v+iNI^~~;uddyS4XuCSAfdZ!^_~vtB%G&B8lGSG7{Fpq+)NxOM`o3!2LGKzk0fk+q* z?c~a{<2)dbo`URp_Pz;XV z7U=K@fGdcu1CMGe&mTC)c}! z%f1JA{=*dUYtGrB_mgm#%{@_H&jn5BkGTHIBAhKGF6wOc(h8`G!AATdOho~niQp)m z24R{>J?KtNyx!hO6EBo+rv&ZW>Tb6KI>2Yq7-lmE0jq8N;$X5?j~QA<$Pn}@B(B<< zEaUe7>$Yk?oX!abjeLOMzVJ3zsyTXBO+Nx}K6qBF7t|NXO>+X0VJ7Yl z*cI1?jEKV0Dgf>npfiUk+6-Ly%yLr-iXE)UWlNBRo^r@gvSVgF)m?cpYzxnkGIdcr zllSeh%0LYOoVDAvf>MZe=jz!nRlxB&v?Jp*?wCFV{j)*zW{UhBk^X9;X0dT}CsSjc zpj%*4+)9^%oAn8x?C|vl`vWALE(Y;mV4juXe+BcbO!WUZ%wMv={KEVvP}ST9%IvMa zubA&8!$Joi$`OSJOM=iZ&5OW_6Bw;MiPQK)>U3x&OU5nYyAi?u=T`ikgC@)#xm-5} zy`u9Oh5LEev-OsvGr-%;8n8QQM;csX^$HhE&I7~Gpm%iZ^l?L~k}^>l#A}mWp)^CH z8LnpQqg~=E5qu#PB618{X820Xb!iOBTe;$hp560qkQMYDX=T;=>&IT%jk*EoSa zs3CT&Fu^wR6>hnoX4Wj5d33dGE;P=7nEG53Tq__$_-;Jxf{4f*ZY_EsSzud%%*2k{ zJE_41t?GOiK1za2XKb*|5wZ}Hw^RGFlR6O^Z2o!YXjI_&`8^hsFn(%ZGBI5Ld>hR! zGcc0Be*6sh1m|SeHlv2K|90_5S>#TU%lfBq$H59qDifkSqK)r|)VU#16 zHFwolKw3VHr;O^OTjGDRA~sljR53q?s`jiCdwbZ^Yr5MomOEsbHqnlrVhl;eRJ!O# z=NIG!)vcEPowjOjPEy~jD_%Xj zoQVIf4AFDs*e${vfLi^cjYeNqXXCyWRx-%SKXO;}R739q?wyhQ7dnsGW|>FwTUq9y z($#tYlA^9BT1v>Z!QuAU(7lg0&L}y2CZ&>cXL52K61iAr7~Oc{?gn=>rw2F@eiAK8 z@7GmhSx*RAg`-cEA-uC~$71&fjXYt30@a67HO(o;L_M12ufP6*7^5}(ytYXO z>F+Mo-`PF^Tr9SS0g?mfXtR>L);(#Ux=A&@@0hL@)&owSLf!d*#}G8+gLP=-_qfnL z5ew4C+YJuODq(B@E86rse=vH6lE1IRM<{?|boD*kyPg#X-kLm9Yi#Qj+VhP(2{Edg z8Y~!FqbFAh0ro?A;RU*sh<$YaSb_&eG`EC15Od7lOOJ<4fcUO~fkaYlA#$7oYDv^U zfREPtiwS}(qJAvdMm*`adWHE`7`knEnl`QI${ie>{Y8Zdq4?}U6!$g2Em~554haRK zIr&ZDHf^f$z)5muO>=rLt%2xxH;H;4i9kiA~I~ahj7SLJ2%?i^I zb4v=mkjm)>!HjN1(%!N`bo(H48MJPxGZx1GpE4+I z((;BVLajTKDjR%t3MI_fhXjilOx8x0bIHpouQC43Vl9YYf<{#~R>Raf48$Hz&uxfL zWHgmv5io7nIh*bL{JzYYmLYGv8;<*LN_8oc^!oucAD$c_vvC%#DTgs5N&p_kF(Gkt z5kmIF80ORYj0GFSeG2FIt#iseE)Dk;?U&OmZOV26ygUWkVd!Qs?kzF2Y|K@!eSc$g zqxvYH`B@)<9X7P{#HvG;vbAcxN&K^!bEq$+V5#hy6fLt?eu0@N;>wYvGZR8Ic#$oe zdr3Rj^cUBzQpfQ(C;@}mqMt*~T{?fclts7`n{wjKnPhH0tTYJo z5Z;zuG!pp|)3ak00hxnm6o7lC3zhBe`s`aHO4!R&uV^1SzUnh8{? zB`sFK;pPNG5rmlso_6oV(R>}EqjG4YE|6BbB^wmuEH*h6@Nq?Xu)J&f+*7EY<4sf9 z6&j-FLPU{pJOt%nAcj8Jdt8Gc<=@%l-!hZVWU85vI1P2T4dBifOE&EE_?t{;X@KK> zU(h;k;X>w>ZXE(eBZ7#V1*^N~VNht9p7Ut96q}H|6@>w^T(4;xVr9deJ6$ z23U3NGvF?}2u8sLbA%Eb?lxGfl5BQoUmli})>02lT&lqGUyIys?TQt0=Hr7;J3EXz z33P|%3b;(f6kj!EWZZ!HYp=Ji?{XUvgSs1tZgw}|#UqUKYDF`koVF15 zyplEk_zdjDmDV6mANW^tO)-waDVlUjTSu@WL^ z1eZ;0dP>_;5L5`WKct|Gm)NX3b(pbEj2-4h3BXMOZ@F;$E4?t}QDu_HI=H=84JLUC ztS*#rTT7t~Hvfn?eLIJt*-%x^$g_b0eoj|biVq?A@|}*6?F}O*=cEC$e78ucTuX>8 zYZ3$QcOD#$Nb8Sw+^|iOZ0`xEf3|m<=vGAHy}g&D|5DNz|5@CKa56z9rHK)$Wp~tM zp;z|LG!?If4pTRs+IAaH#e!8uu}6q~Z!WsA!9B=QGwe0=%*TzRLj2jI1%p>aJQ3PC z*#|Ls69G#rTzix`D0BWa9s_t1V_^W^xtVYkf85jgWTs+M!ST;n->QW+(mbdc%Sr8P zqL&y=(b`@&zH~((i71Ky3zYQMZEak5wD2Pf?2gmMM&eUS^}mfd(r+A4?aeCFp+RAu ztiBL;Qk9wgu6B*M(U+Hvs?}<|11eJyaS47|p03%6wi&WOvB7{IFeh^{4#7-9yRs$J zSOO{ZhcFaHf$-1>xX`{b0h7?F>M0Iw?_kAJ*nq;)G@9V~*8 zkrNx$rNl~w-MI@%jB^_ygoJf#1!MLZg;mL5`q~4%memUMOKtsjf$TUc6HMD>Mww1< zhsp~Yi*0B3w~;S4^#kZOL5|H6uR!~cT0D$f6|4?!0fOax>TcMMZirTC3#LaVZV~;^ zjOSl9H;hpkvpl?$=lTK~yc~VX=M&;~)cNIC>mYv)*aV=leIgE!h0JlVwCTP5zq_X$ zA3EK^zq_YU{){78Xx+_w1W*c|SpP9~?_J!@P^!FqNI|y#hkSP;eUMoD_PV9>#NJP& zK4h#>%L;uCc%4~8XqSn3-fvJ_mosKpW>?;iIaz4SI&eh`yJ2X6W)MP_Sg}oerDM2G z&T|%-y>Z&7>Nbi!Sz9yydEg1{%V{5!R6BGXY$-8)UR>A&DED^D0XW1t z9FuG^J5Vc7TvKXFbj}bwew|&&N}qji^d@FZ-ijnIjIw=xJN*y$etzZb;SSKA$fE|p zNm|Up5;);Sv$G2Ax1qJkp;U9SItOI|(TYnLJH@?)f zv5#~}gg2-W1{_JYqYpnb69>$;rnu-+hTp(InLIim30zT?1;>k)z&RY_Gffsdi0A)MacRZk z3Q#1n#`SQuneYX8EcGde(%bOY^LDv@Ys19TykISFcbado%fcpJ;J3$C{ zlGt=1hsjq}r-nd5a(5Ao|C>cgq@C~By`eWx2~8g|B5JNMv)&g}23?NRrv(E9C&lKn zsuL()b6MPkea=O}0D&doSMKV0CyWas4qyb-+7%Z>CvNT>fEk0gXcerRa7V!psmlG^ z`h8bcujhOF3?-v5V3UCojd)0-faGAys$EXej@{l!W>*M^g4BZ)p~C%RC#$n7vK#T! z>dfQz)e2RkEo#2^51&db2+huu7Qw_H{hZ9;a8ktjFKBAKBli#@*G6?p664+^_Dy$` z2npE@9H2|0uukW`N@B?v?f~m}W<6y^1Oq_doj#PouA3s@MTs-@pg@Eej}^hYbyo?W zyTNXJ6deQsQ82TTbuF4jF4efTWC2TX2GFBoo&??YX5S*u8VejD`<0-@{5v~haSbQp z{lujxL#-8d*wKs~O4SqTzu*W^N9VkTj4!(35Cyr)>5&dL*I>FZTNO^yo5l-TM&Z4` zU~B4=ax`-#^A%2$b)>tmS)K@}!PLf{x*VOa8HA+@9X!%k9~yF01+PP6;fc#1`W zL)={U@Q1Chf_%~9t8=h*i}R6(g=Wh7>dV+Ww{B&Cy<-QV91PY*6R~&~E!MM`k2yWh|(t#>1%<(%Hx$J4R+50m4Wd(}K zthR;1`Sl-BnD~h|q`~2Y-$kPce0>W^fv-YnM5;k9xi|uXDr@wKzzJg#b)H?}y+j@h z+a63N6^o7s0w!qswaKh%j427pcWo#ACIH1eS&?_kLDeNV=0f_h%~VX0-7phZ@b5o7 zv5B(x@JjC3t2s~#d6ZQ-LM8WTM?8BYx%_C8ARRy}_lcPFE9d@Ge`z39C>KXE7NBs&BUpjFh0Lk^)Xr|z* z&XSDlGaH_k$IQePudy>LN=f1vY|0duzz(BSiI_7IDf>iYEED&iR12XU4tP|B_1AmL zqjbgjPY3p72rj~b6dV2{-;O>0;NPxr%2h!EI4Y8sx0cl}6iuQl(t%VEL)M&c=-w|u z#|;F`m~TI*Ukrnf7sRWv_|-#c@FBZ9Y7;pT#r_$@2HK;Lm9~&??k|t)^CF^M0EsXU z2Q&yWpDpi|tl*kEUUC8I5klMm%>?sa;<0nz$MUMRC8r7CbPA7?=*(~NDZ zNDM+=GJ`}80hw(VR0qa0P6FIguWyn!E2jkdN<`;nz1o%|_8km1coE|wo?;&A(_V7W z@OHSgA^Rlw?Xs+^K(?M9Xk2eo%il6ACbcELVvLBB$GP^NYzw(`P0%Y=kClmzwy)m# z5D|+d%>Y7^ky$sxadclJ)pSqe=nI;DJp4eh+;PQMwRe!~NmcvZMcR=!+SF-X)Cs2X z&d_E8b&BTRYg|?nV`d1sHY!w_Hh?ddhn*Eh=YV;MhCO-02Nc&cvR6g?%W>?~3E)M& ziCAjU^rBK(DA#dLgDCF|M&+cs;;ZiRM+ZjI=mX41rA-WAu5EqFks8~XLTc(<{N$|P z1;^0DbL{H|!KlIn&QlellnM2ac1a0|Iu&Y8~>w16+C(#dVG-2sAGC zlv}LC+vVDFmWhT?v@35BCuZeu7gY>u6ESP_L!8(I*nnX`^+@<2`Wx8rhQYSB$k)6n3HR`iw7xVKRIUe>5%OGQEUH+<( zG2DZpfS&Jvx6jA)+7-+TSRo44izew>VDhe(jrnpF{?*lIu2ykJ1>zinJdip^e>;7= z8(e#!DBc|y59$oj zVe*gqoUksp{J=`& z{18X5aJ|+~l>W_V!~6KP(tg|a84f4f_t)D?pDA9>%0JEg%q+vtQpJkc@eha<{};96CZCVaLxr{< z_DBv8&d-|ru^2$_A9}Q3B^%S%_s#9h-V3d*Rt!Tbz&}g_D6sa;WNyU~C;8~PHt)Px z{dt0|0V2e$K-t>?LktM=FhG7Z{Km0Ec!WZLRO-Z#3m6s22-~3AgfU73t+KtUytQn$ z=nKO)V&!!=zd7mvyhWguqq;_CYED2$v-)(qe9Z?zx0F{+R(jyhl|uY@40?)-9zOZ* zTdnwhiyUEyv%>=XRl0>pBydVyKzOP3F(ZybbjkttIsv77&~?H%1Tjh#Up^C*?iNrw ziZWjL27YpVZ6ASMD?aLgWYs!Jw<(|?VDI%u##z0j31qV{hTLmWnD~^>$|1_+a5=!Q zw;!KRXNK2+R5H*qk(z)LPpP<+M{pw3a_Q zjqVvXG&RHEAy9kySFKvWyp2xWc>}7m+uE(yT?(l|j8 zG6l&W60n6M2&NVx}yAP``k>gxXdu;Lx&%VHsv&Lb?%%$$MBpwQH-5o zijad8JF6@IaH>R-77rD?sm!6>oW(4~H0ZvL{TMl%(dm1eNmg}`z?qFayUD&USwHhs zEzq+7WF@US-~Y@{zIJK`;4wmI=lU!(9;;0+XF5@r@A+p+bNGPfElo+Dh|zzECI6HV zi&0HN+~(f$P>%mOMdu4n#6r9{_W-`A2p!O++)B~vlXG?0aXeERj}=@7czVAfowa5-X?`hSo+dIi?avfLp=92h z`aJhahwY?|6a8~tuiMdt_&QEF`9F?*Jc)a$Cd7DL*iOsH+Ag3%%WW14jpL@j6#V4O zneDUc@~a)QG$u%~Two~()0WPmIhu6)YpPfk~QV1Xpj*%EL_eOJPmwZtcJzlcmp3}ASL|Xje0CB(=O3OH-KXv z^q_S9qbl#&V%{gBZQ!?p92*_i2uZPTDrI z&f?M^-;MFO2u$nTSo*CB(%dt4(l5%&yv$o;XGYa#IaH5YH?1V9r@F{7keAWSn>V@RWn9&huo7w~ZK z9453}c4-uf*EKX{5gK$<5RSltM0ANy_l9ZxQ4?Cbv}Z=4Aozh zn6*(WqQmD0ivWKRDdwFi*i_<`q0D6Jm1}$r^Usl@$aOPWkj{b~@YtMO)zHhQq$k&r zCb&how|lpy%viI$&my2*xL%S`Jhn-~kZra~d6Bq+nqxBsW9A~0BYf^vU{6(*wd6$o zpLCJoiyUOde2RJfU^wkE7vrERc2*tQ2VIk(g*|-Bq6D{6xPeB_$qIUzdAbawLO$$L zNsp`$Geh)rGR662y4N&t=4Ep>9JX<*3!>@qkHH!bZFWYOJ@xrWZJ!*3M69A4%~FZE z{DxyFLfQQwYjwt#VXy1~zfzZb6hea@Z7u_=S|qVB+O^3h7Atj@l6fW2TI_xQ<4704 zIi*soYNnx|nMmXT&=6Iqif6K~dpDudq4{-Rg}J#3TLO}DhW|tgdt|Te@+1teMl#?uF%V_S|9Qk{#g~n$hrUDR^{i0H{ zt8w0vwLF4(iw#t__rw6M=~w>|Ib$demK1}}(q-70%E! z6Xr7k?94?1$!N9Zs6WT{&;k1X87p(+)`lN#^O{$g&n?xyQTX~F*GFRT z^f%qFe8|CT+fi(bTh4~Xc0n$g@wckX)UEb5^Xq!&FCpmYINP043&}wnxFBw`_?}bn z1N2J3bxm!=)nfjtbV^s|mJ=|}7tW>7hWfpWo3<$68lt`~x2QIQiPd|NlMw0{+~l23 zgo4=5jeCyA&xd>apD)@UPz|IonEwX)%>Sz-2n*}~odl_VY=+)``Mri8oYFwD-RA$p z#Or7@QE{Ztu4^zu87r>Q(IN{=G>Vxi;=3K_IdP>5%O8!wC7-(8_@7vJUw9t|tF*Q2 z=Q-}@X^oEaOHVf}@23`QW>hpgPp8d5)P)=ar!BobVerdI&vt6(j>*uM7o%jg`SKoN z4*SE4Q+SNvYiHT*xF@1~piTdTwe#)JyD09!2dqyOql(RcV%;~luW=b6(XQ4PpG99L z09)m1zgmX5hRC*HnS1IkoDAx+H4*_vpB1@hvT$EsXml0*xCN{h#~s1+6Zen~LWa+e zuM$478Xn3ndp-yE=cLZ;j=#=*ge2i`+=` zC!)QZAE+NJ@9$o7k38WM61ep$QF<6J7N=>quP*8Szi;Em8-)c%hd~f8)Z~ojscuQr ztdwgf$s^;YFp%zZgLhx7fWuD+?>F)-qoSQ?bl1fX7kz&w=-e0()gQs7STs!N!lz*S z?0dfTRk>_K80g%>?oLot(%ptKr}K2;@%L?{)o#j6G7<)YF3IaAN zld)3qWm4q{PsXICQhx)yw4Zwcwsoi5QYu2mO2Wm+V8y6fsFdLti)5g3N?Ii=fK>fW z){!|=)&r3^3fO$}1{2O841|B8*gRt@bu~S?T6iO>TB>Q&gEXLC+NX(1YJ$PtcPo7%v#5hc0_%k2utpUNA8OA{iK?b2>83ud-vPQ%xC&-{W1U9? z^K()!NfGZ8MDXwQN#za1H7%fiOqpAiQx1fgC{M@zy&V&r;WA~|LP=HgaUv<5GZ}_K z{Rkk36;Idaud|tuyzRvSa`o(KZT}vtJLJ=F>VeHmVSbfCa_CQDbe;g%EJKjWu=3dDRHG;I zCW$Zwt(Qm}XIhG8qG1w;&=CfP){CO{P>JONdnY63V+tWHgh!DwGX%(wj#z3|3?ByL z=WAwuoSH}%|Mo<=m-os}M5LbCI0nXk>VBT}u#QMx$vnT^5EE|4vwxTPHD7f%Pg^m( zbwa9?$_d{}QKdn}0mT9fxXv);H!bFxe)8@>D zh8`{w9tg1F;s0=grCmA+-WB6&{Q(oTH_T-<56+)qs@J@UaA<$$8 zqMECl&KvzSbI{)QLs@UjfuUuxXBB;!s zxy9T8!1PQb*1Pn-zSyZCa1zQJD=nA3b)1xbONwzUi&DZ@aG@!x#b#HRcyCv_coewF zff-5z2UEL6&n?^-py9}V78c%8da#N$>nR`-j@)EE@Z7PbPXK=q%`*!tz=|(TfqP(d z#bc(g|2Rk0H>y@P#su~c5I=hR54Qm^r2bCglRnR3|4uc3E&{3+vgxfDBIux!yn-h1}QX0$RPPmIW zaa6*^ADU!DYf%)>Y+n7@-bYJC?}VtM78n&$%7n+=$iyo;j*qGNvf_TPeMfcNA#8G* z&iuD091AT1e5!mqxxzquECt;PE?RptHt!7v2Yj|k){5!rOp#ga_YpvpPh=)8U2sSB zC!UE~Lv29~ky)Sw9FYBc-3 zz)!}!-E{5 zaY^}1iNXmyoR~o0!dxe~;?I@l^#nWrGwvunO^3`hJjRcA9MQj*5#8EaUN*5+bS~n8 zE$(W2=fbT6b8H_@`|xT2r|^uam$887y@Yyh@gtLO)ZLhRT%%xL_vTm;J zTfQQ<&T=nje-dF;Byx5g{}L%5sR$FJ$kGaB-Wm005y4g;Wj&wTa-Z6Lb#iTNk0H=l zvIIDC;i-}veEjvYIq_^UFcW=6c})}i^tHG)h21?JJ$$w9N&e}-m-BE0yE)Opnv-E< z&|~Ca#b;zk<%?VK&`c{e;IU|1PNPA_e`1aW`{?_AYMXv|olPl^I9KspJo5cuOPCTt zX%!MKofN3}l&9y{1~5`6)RTn)YmawZ)4#`Z9de2L?^NH9*_%R`#J$Shci3SZ>eF@% zHl>DNh%7&n;Bjs`Q%PtqYh#`TcZea))T#wfvdp6|)+AxVn8>f@c2GkErq31Xd5B00 z?(4!=Jb2SYYSuE--3!^td7de#O-^WNK6YL%sjOOe156XysPa?gD|f4_$bcx{rTbO- z{wS^Fy4u6UtW*}T=V3NA&k~{)F#s+vu!q~pHW|JqswrJdg!LFK5Gw$PmR2+RWy&#Y z8hw5C0bgB~l197SJQO4}>}VVFP%yLGKW~U?yttsXNJ<>k1eqPsvb)LJX^)M&2DpRy zP)kzF_^|tI4K%3M$;0Aa<@7Z?mg!pOqH>je-K&O~^fP5b| zw$p3t<3F688Fiac^5?~?*g!mLXarGY!|Uc|Zf8zNT|Lz0KBSu(4t6}u&GtPp@~!jp zr1D~~Kx|$JFwuR!U5mJ%A$H*6?Ok{s!G7rzWbt>bku80x`JnEnGcvrCGqa;NPNQ!h zET}Zd(C!tKU4g61$JG2u(1=gSBPSReyC#(P^4d73fuccrFy`L^+LC4726yjoUOuV7 zjd$!7Ye-!P!ljE$*e8pF=#f!V-8lMYC1a&r9cBAQ7k66}DR};V(D?>sc1Vc$Z`8{6 zzoORvUw(P4`mz=JfAY&mrpdra=J0rCcpcK$G^6<-oEeY#9tk@!AmIc@dBGp^U^t(e zNA*PE2lzvrpB$rngFg1R=C?GF3TW3ogP^=a7djOmIlmc>?;#lZNWQ=9p40vE91 zqRiqY!8Iei)BHL$sDuYzcKkEP`U@g%aRk5F5nlPT2mN`?T@bzF*i=G>7vVZ_}VPq%5+t2sgnP*b>Z+{ICJ#Gb*UUo%>fXQ1_hrwST@BI2Brxy|p+d<09K0l68`T@o2D4-Q zwfITbwHa>X)g;g#*;4OMWB_(?-9-PgRL8xi@Q9QVz3t1Opr8RFm7H3F8AU?daC)Jn zG&%`XJ9%1n+cV=DBmMTD1d!`WG^6UN#5O>LIBP`~MT=4miNWpI2`SD;76V+fs>e6` zdA@AFGK8+(;NZ1m@P$@Ellg>%oOxOmTfK)QRRPfkpUal?X*dL6x~4nP5CVn#zByJy zM#i<`NVp}eck&eQr5p~V<`3W$I>`>v*nfa6hKW|h-IcP^80@+Ku!}fdlqKJ!I@2wK zrvM|Mq<+$MpblFsVNoIF3zn-a*lu$li(kkb$6M8Svod1H<QmUKkMEi*GJ^8e z`V+ucf-LN7yq_NVbFSneF04*7Vj?J{NGi41W{S`_HCh5L7y>qHY5r+~ZWet7itU%X zQH0{WVLDTj=d_DTiCFPGjd)lUtW@kWAQr?ZcV(uLV|8TD1A~G~ApMJ~x&_cAecm$O zo_jh6O3Zs)c<5KgHToVr91=<*24hxcLx7CZX#zZlrhY*Y@{Y=a2SeqTDd131+HcGv z`iK|et2bjm`vF1`S+dR2(HcBp)%TMHTIQQSJu=Mnnqu`C6^AR1wdu)!T`+KA!~09r z#G5oCnD`I?*Ktp=xXfc?G@=C*vr^T z=PqYFZ-TsmyrO{GW_=8*mPnw50z6h34`N2t zUaf$ynzI zoOksXl)uyDK58y7yq12T?#B`R{U9c0WRfCl%;nZHgHE_}r))BchSo90YfyamCF-J# zN9muG#&$UJ)zr{4<7+G4c){6SL3os=`Jncj+9$8bwm1T%N;PG{eE^^mIE$|a7;%Xo zQisd`U9pXA#EQz$T51r#Ynl@Xr>j8KUzemr>YCK12(3jbr6$EY4g9%M9%!gSQHht= z5;)i72$UP6W8;LlYMt;}_#upCEwe8!mhtO!_C~rN&7Kkw;0+Y1ht-O<7zjbxOZ-J1Bfn8N1q#yvg+Og zcv%paV3CIGW#Nz%fv!terVUMjP=yY~y^n)%u_IF1yYo45eQ3_OSaT9J4Ub9^kj&`L z0#%gxFvIBu>Z3I4m3ulN@!nzD{Ta*Q6>1H}SCaP^7UvYL&q%(0f8b2(m*BaX*&tEX zZ73aCWNslx8zh$E@48{33@uwSJ!%A?->K@sfmt^>#5*#bL{j~bEHush zRAj#hTB6Zr)zj*9+^mMOiy5Bk-^}0JS@?p#`6eiFa8KSI&9QzfT;D8lEn-EEgu9!+ zYq;?Uf@ycJ3^PQxq*l9Mdn`UXCVWKzFogsTi%I@)3MmPZb(BK)I_1muFVG;S#Mo!6 zAjo29bdf4#*m#H8m1M1`ieC#2Y9GFc+mSX|e$~5ATVke&F_q;d)Cun6^uCv{OJf9P~ooZ&FeD>ine+ZV*qx4-*riRAU8wu zPS@|E9W&hhFlw1u`oVazE<-EkPsr$<73E}_8AlDQt_nxr4A)d*1}2F*bU?_?c@*Kp zVuJ*m{}HsCme))ZUly4K5HO<2l`|pBklBp5wHiPu{&e@DPTRF9DKz4wlEBxzZU|Oz zG8tMsdd#vW$Amw3FWnndPbBJKzG#W>0BWc%9XsRYY-SSdMCrPam<&{HDQRA}8i&F@ zSeMZ{bqP7`?81i-^CzsK_u{PjI`H_rOblW8jL8~v5E*+J^9i#^Wr9bSk_~E&=tlwK z4hNpSF;EmxS>-`ID{qofo+#*z3pPf>0WzpPLZc1j;t`jv{_*8~hMIwI=$V=lH>Tl& zzp`poS9(_QZ0l4wyxnCRtK#x~GKP9llLk2R-3URKq4uRs5bF|+>RQz`RZ{W_h7)|I zh@i+gQEYb=%!rNPcqe>fv0>2r)?$}C#^L%ixC|aRge7=Bz9->biN$+r%Z6=s@kgg? z9jHlryq7Mr2iTp$Y5-CNQo(6wWtWxmyTHr@$FhWi1M9OGj>?yPT``w)1t>u+AbMt@ zUJbd1W4>34@fRo(rWz-di>QMUGH?;Ciix&J7J9bjiZcvmxwul~qMP=&1EPV@^trV5 zL~8l0yVv_g=#!3c{d=+bI*X?Rm`> zC>`5Z;f0hSqA6%wwbx2pH3yb3kW5EfkLd~0uVh@Ag=#nT#R;a?4M7hAp*@wA%L?|f zw@CV(g7K3~T31+T=$`H$CN${F2aME+%mx$mZHN_!qI-q`r-_#eNrxVvog~DqA1q;P z63$Pp!$T2(ogcJFhk`67?;o$%o!bZZq`9Pv6x@s&A8LzauOywr#um)W0K6#9rsDi~lO`@+LDPXFl(I#u)88pX*!pof5u$ z!@_R()lVB|;O~(*8Je2PeHw#&kH1HM|K(T{3drFg5xc>gOG&qm39|~a!4+R?9P~FH zg`86-CpSt+&?zE4q>XseX?SWgwti+hv_(s6QrYDDX|B%{j7>QR|(^d<0z6H9yUP$V)IdpqVv_e zE?YfE$Ke0A*na;GSJMb#`UvE#Ul`|r$>-6=XhoeTM8y>bYo*oJ&>=;pyf7DQfV zocO}ms~0pGmVjUqI`~s__`qg>scb?tCKi0=CeKf}j>cJe9Ftb8!Pt5!* z>-^BiO7K(hI2Ii?N0Hr#6cMMV)|3NJY`T!(e0%T85acciN9&Ce!;QE)E{6*DPW=?7BU1TCI#rIoM$YaF51}>Z7{#ps7z3VQB|4Qxba8h zHHYLAXYnq@c=rUyOhtNIH^7x8HjzzSaIHkN97hUbE!Jr0A30K3S%xbocon1By0W+8 zUp(oSf=l`F_7Ud|;~rRM72_5>0^Zg{?6UW$8KadTd6o+EuSmHR$ROGd1C@5k5)+wr znOMAyT^qyb=BOhCv$xRMNDTk(`Qe-Yapvdw?%>NWR1xY_Y4os3X!Y zvQ3L9I?nq5Dknueapt3JnL@=i|%Psv(tt=AyS=5WlvV^Yyv~$YEAn%GvaqVmP2}43+0$Cf}#)Z zPr^fGi7F`Xcb`x|)I7Zu6_ld%0Z>?57zD?^+Eedmqa4X~e>4vJ-OsbC9>c)*e~R-^ zR^W*ij=VOLcot2P$9l6>?;NEjm-dN`Gkwj9_au6|0%r6ar2>xYXu!2ZE*+ zH36cSZail!5b{Kh4&mF{IXPAj9#*%Q{&Re zh&w4y6`dDQaa`4afwmgIjY=DlqD;+t4O_Ly=Bmq$+ov9oCfmnFtA-r@RWuLwQM(tn z8d^4LEC{HG(t+-@t5SYsK_U6ptP8@|cy$UVRcpQ(-q(uAT;j5hRZ-emNhGf76?~p( zFS^3Ls=OqD*0oOYJSs_EzEe4i?A4M_5^&H)vb*XHG*o6yvDw>BN!mCSaz{mbb6;Z~ zZ&QcIwL2CfOsalNj-ijcNkRHkF{phs8|qH0(v}TM(hAax@-fwl2`q zmMY{Tmrm31QX(AOL-1YdQ6bQD?P=FDb|us?QBlv)_fHhVDk^2@l@lvF>K_HOX_{3< zYio@v$~hf|-lKAnn-GM-sBdl!%(2m&cA2g;_DQ%zNAhNePU=ooH9v%IUZlJVrST-zL?$Xh^)GhxUN7wOOcwMCkdEq*w z8QblSH9u5?#3SuecN$<=o(XI%+@E!zbNr0+85SM~nFOJ{Z^3hQG`X4@%z?qoQrn_k zFe%TtM%Sr$#JFx>NFzvSrZx`iZRW|t=ZNj}|CV@mjGwATWO;c-++Bq5h&2D@;eMFK z_!c!*t%pRx+)|DrohjQY`!i{O7)G^QxAou{=W1b!qhG%niYMO8cF% zXV2UsXIf@4(~s;?CPxKdQ?W+oIC%x59Xu%thDAIGI#HJ)jug5#Dr!nCC>^M0tpUnr zdcZM!E!V|njrB4iGoAq)v8b=8=1YoD2b(godoB|@t?2R7CUI%h(ibNp7GRe>c&r&` z%Zt$R4ea>~d+>jY zP5<4cK8;bFTo5UQ{&jlqGC0L7}mGWTo( z2-as*ha@sJAeg`0KQ9U{uUuWQuf615oz!xD&nr~zchJ3!?{Bt_h*l7cWB`c}rB($P z8=8RQI~wf`l@6Hskk41KST*vQA8Q49E6*p};Ia5VLlTsGi=hw!eP}-N_+08%Me^~%t$8_PY?>niN6N2=XoG!P7 zx6tN?fmI|ZQib$2vh{jCDM~R0k?AGHXqLj(aMu5x6i3f%Sn!g$@1Bh|1b1+PQv%(N{P;jBw z`K*l~zY*n*vP|F-s81w}Ta0UqW`TF$5rG>eFKT@%?$D zvjsXQW!xjpk5yhY;c`qCMyTigDUwh~f;?N6+*~jgxYfN!GM}=Z_4N``U{0Z3Xk#wt7p{g9eE81IqLDYM-+aiXe4DI}hxx30`=(?;ePDMV<2y@cduwvu5txwUaAnG6f!43)=U9L@>UG!D#-V;4t( zcC_v1bM?Cyqq}<=83eDEJ4MhoSH83SJ%n~9)-k4%Xdg0_`UB}VeD1z~RNDT?rYQO7 zx>qT|X-pwJ^vPt;Dd9qSO+}hwp@LkMA0fh7dbCT;BLYwDw1SD^;u>E!%qb|sij63( z1QHWWhDz{K2uibzUm_4+-tdw2rJ8;Tw=N;A|h zk41KP3CAM8(*7F=Apw(mOI(lQdHfD1j(O`Nx)@3Ox(gzC5&T=R8_}ewEE`#OyL$#~ zCv2c;TB##k@%j-~JUw)NdC#d35deqRH*2Lb>f9D^K6oj(9xtXWY803V`PM(3?BDe_nqy zxD>(LSzX(e{q|Mjg9-=%ga8bx(~~B+h`YKE0&b*(0e(%1MyE!pOUtwefUdPnk3t_g zOm!!fEG0&p4?H#;2T97L8M=0V#X&wr(<&J&=xM1YF5BNOeEM1tY5$%Tw2M0k>D=62 zSxP%PHJDU?7{Ar?Gdskiy>9uoF8{H@BNbuRIbqg2>KgeCLkK`!0fI$uC;Zgm7^}R5 zbkSOlra@fvraBzS5zh8{xU%=ZfRRB9+G1ByB|d~J0Ug0Az~ z2eR?%A`w;(VKKp_<2+Jb6knB(iJC6)q4$(nJ*xwr8v6eBEqs3ZoufahzCWyUZ`%sh z+fR%Y=v{v*tKbvlsII36@APjU!wtBMh7Y7CPfh~fS)D{owTFn>dKoA9KUQaxk!p+7 zQpt~2AAY67&~}tnH-*`Vz6IVx0^bCZht2J|Dp0 z!;xedsu_Vt5=I-;*+G8jX=qIMb%lniPjAZAEMDQ-@^IsKIo^({=3B2F2HwYbKKgA# zAS4}BdxT9$tYYi4Cd!)^t4@{u=mVYz@|WO9dQetn^8}4w{y}F5si8k%l8K?R9V&ya z=<{z!8#-C?1wR_(hbib-yIxj7jClwC#2h=b+HS(VROsOrzWet>;d6-^>7O7Qn!joQ;=WkE zH(Te{fA6LLKsR#iHU9rOm7U?g8t*YPF#nJ7-j&wW^u-UFYewl6tl(S^9nqb!w^6|D z%DbbFc7O1?M5i&+<13z0vcQpdrqKuqxJ48Pp$sgvi|%q|aauy^{*OcfHwZ@k;5+0!Xh z=CC{hr2%M7VNB|6sRNN*w6fc|J-I{(ZeW z%u@fIDa+Gd%t{aHL9a^AiP%7n@#2~RS^vJcu+O=Fd-12@&)D-d$-zC?d$9{_PDxkT zyU`2vMd0sZzDSTT7?5DR8Ci5YT{pVwXttsK_0VipY3q=qW{AT!8PviLV?+{H}W+xRmd#blfPehs)BcjsxK7t{i-VffG^6(RgLYX)|DeDf-J9gE?rIr&l>kHYHsP=9HpQ+I=M zEIQ}$oQej$o+Uo(2cheg!(`S3B{eJtzC9rDW)MlcXhAxP7&FUc{&n%C5_Wp3XczZ$ zB;#}pM!U@_BmL6S2v6j$-y8}1rh~-=7jNgpW2LN(X8unr(lAERAwoWQLhjz~&DfKd z@YvR&VOD|8ujC^CFbMNF7*;Bz8E}Zd15qdV(TSztZN`0^Ji9*8c!#Xg&2`|P)b6*K zpwm^WZdeGv?<^cdu+U9|T9g#{?RrVq#e=s-6%cJ`y^P(__v10T7)_1NDahNb7W^{I zlHm2i6{g*;)eC?`Ojg7KklzJaghVq&?s-}8FeSU$2)Q`f9vCAq+xB$ z3VcGK?JzNzgoobom1l?Z_M>AL`%1!+H|a70Igw`Eh#Pl9&hDgxTv>%CxM*VJb1Ck~ zz|5_bue(NV=YO3NGC^)3j4|}GgDM|MT=?v;30Q)&M=9-9Kc&;=+ZE%7S-C1c(!%1; z4Ft#lGePDXplf~56P>D%0*52zY%L#EHI(8uJ3|iPf`yx6P8^~{o!Ggh%>%sXaZ}}G z-}gtnk-)6^ZlF_?vyF9uKn9VJX$Rw(ZkvTX?AWF z{D;rOPW6jNgCs63F9p?p75@#Fcc=q&B0E9uada^i`nouQ+67X1_>u(@dk-ujN(7(S zHcNxGZ=8?I%&R3lI}3$5B#rW*M5kkKi{GPaZI#y;8a^<}klQz`g1~Tg33&-z0|TYS zSqN9N4U)?#TzS^9Y|qGsg!j^KX7h$u{TllW9R#bLD0%CQdExm6vzpij2|hJp#2ArsFe%1_mbW+j>cM zNvXGe3GFoe23Y2PsYmb=*YXk@POSK8>(Qn|7WdvLQHwGs!8KE4K`KaC*M8yROe;~- zIhlSMOIl2f7NW`gRo&KiJj!%k;p4Q4hu|}b+ZrfG_DnSJj`Y+!&MNNFae+ATww>i7 z^MTs=%lfMAuatQo^zScMyd=}jWRt2t^M>4UMzb=zZyMZ+5)Pxr6L~NOv!0Jnem1jvvGJSfp+nYJUAk~W}-aCc8WB~v0?2;?V>npp?I$x0SRt^ zdZ3&ha&k~W(J-?Xw0w3l6E5;)97KvP8rRk9NK|RkAAb5_&WsNdaS6pwY6DlW@-Tx| zDH3m*Rz@%?#q{MLJN$jJJsE;j&+B@J3DvCA6XrIPbGp!i#`{tc1J8>FZql(&xt_tu zS79+?0!b~mlR zBBhK_?KT=fV?O`BkA5lrBTnxMXehowiR$-QeM0kH7$={P>f=P3fE-|ZmkOqCK@ z4`OkxAF=uRR<(O|iClU|P}8GrvBIOd4q8L=-M}cc-o=IQ@p{9i4l<>aCTJnVHi5RR z(5AgO@cL3+w6KFFz4TfY4>Lrfh&R zg4c)?mzS}u2zcq!>Dl?aXmpOl?+43_1F<#x&9*wH&X{uWrwsem(b|4QHCr)=wz}>O z3Gmb92RdyC_e`B`K83!S?AdaX40BdJ~Uw#Xg|KkXc$X z1UFjrQ`%;h))9;9okEphLJff#VDlA;hd~4DaehJ|3+)LZx-DDZfRv1|-i>v$Ontn2 zs2*WuW-Zc*=Z|D=?Sm)jUFmRAEtk5|&bpg9 zY`u9SPpTeziQ(nzl{H6DNO1A{ghVQKwz+P+Tl}b9GX%^Fr{)OxT5gw`Hn9xE9v!%G zb|}_DeW`axipYK+moJ5*$EWa5u_-zGS^aO4SWM0h?8hXx=p`1}yiamG^sjf==xv*p zc~}D28m$^xJrbKbqZ*E!-)rCB%F$iqM5xxC^uI$F$zZnVy*!ZPY^pGlE85^+1(oWp z8$UXmPwMp#js<&k|Fsg!Mqb|VOg*i@?uD4KolC3*1p zkqkf;jFvKQ&M#aAU7}?!S!+v{>$uAN8{+Lt=5_pspYn%UyV9O^wxVyG0hci<1*$ZJ zKgHn64KI$g7*`g}wM^H5Z;wgE*xa3uAs&@o?3;A^NC5{T#7^H>#j1K$xO)=9!@cdL6r^ zkVUGr2A%C81+lv)&3UxTV(nZ^T{*Gi1XjTm^^V&M8-MA&n`(u;;tcIQW04ZUy#aNh zzRfEI0>!&Vpr`{k9enXmk44RI)&Ky!isVI82*XUW>hozqjq@Dd=((Y;K`-)pLZ_Oh zx^3a}vaO8-YbrU6{B4LY3wIs+hIIM$G-)nQu+nx*%cB@zA>#4Dq{_ajP{)~z5QiuV zjAwTWc7fWg$~NwcB>JX=A?`2qYC& zCmi6ViAKBq;!9~d46-26Y~ijP$|}XNp1yh_C-R1iTKbYo-eL5iDX~T2-66n87jFKz46H0@u!-tFS(tPp9ZX)=9GpB zua8zK!j)OYe$iBAV0t(2w}XPKMzw6}2X>NAdqqv`d$~#*KT0RllZQ*w*wcWzl5bh` z1M3393^(8M^NS;I&ALvW-48zA)92(mIqtZ-O}m>1hxnoz-aSt?mhHHKZw-bm)Rz6S zd40WVllKNre0Jk2=bH-vRJrh4@N%nN3Y&K^ zu%Bebc@+Q1bdxTsy<3yLXsLg23G}86kZv#ITPcpg_tq1>-QVu0>*F8IbZiL*^l{?5$g0*}>CLZ7;`c~MI`vG;gy!jJFn zu4M44K$a9oHEAU5)RrSAkrk&uGbC8`(M_KPz3y=7Sn)N-S>By_+4sz&@NS`r}<+k!PZ{ZRN@w=%k^R<=yPzq_nG>V~B;pJA$iFy&j?R zhT4_vnp~+^#{+(zzjA`+yHR3f=mTCxqf}(Kse)lSZkc6jp~gi)=;Cr~N~LxOl$^l2 zs<}f0^Taw137JfjI>F%IA6k~ZTUEH1Q_JE!CrCz5o)>|q5l1tJ+R&?ap;ciHJ;=r2 zPD1VvYHZEBXwyV!K33ICl@@&D^aaW28}OC3R9wdOl3|HKo~Kn`Lju3|`X9UH%Lkqmusk=BV% zUcOkx1CZ@53rws&m_eGBM(l`^uUe(sNBoK`c!wcm%QI!5F+$3|LC2HvrN$|w7=U7(h!voQBL z9;X5eel{grKq^S=PZJg#s~WF@mQFwSJ?P6$$Xd`ZdHbIrYFnWWgn)_E=8tzoq(s2E zgJZ=*{qP3nHq!lHz?{QsWq={q>me0vSGScZtO;g^Ix z5L_&w`4IH^Xmz^Z_Aezt)7gBiGw}I`JZ@_&1Z(e+&{+tWe`Dt1&JUOrGuBbd!jM)| zQx#ZE!B@iyp&f{}0;T7=MJbra5)2|Cx?-mM2T#YR&CZ38y#Yft-MnCXJfh9>)+v7I zSnc);aI(sZs-F0f%nhuER<~cY1I@@4&8-BOHP1{;?(+yUq03)7;2}0XsYBYH$~Rz< z>mTFibYVjwN>#?hq9idpTY4#{^H5`?D2lLRbk$&pNcgTyhq>{IPBNG=l=V3_;jF$@zQS{hU)XCAl!YdRag zU$oNT@uafeAxr5DNSL?*L8o9v_LM$M1;TTAgXJr8eiTnn1L>=mEp5~q9PVf%;w**4 zlNXr28==$`k77jQYeAgB(?MTEh+9zD73;)~5qo*?1=7g7Z6=UFc{Jw`XRS$|EnABe zIyWe+pwiZ|JZ^afZf%2dEBb-nEY9B|%NFpP%jBMiQT9Cb@$BlM*M`h!76bmi<meu{Aeb-4ggIf?>ku{@0YWz$ zuEc++@uh`ZgtBq<42PBtk`!K%YWL87ZTN?ErQ0-(Aw>s?7xb4hiWQ}x%^||AIh4)o ziA5X)1-IhJTkn;Jn(uWSJ1p*9nFwyu{g%U!#@=43VNM&)^U=Eu*C$!vq1(P$QcL(0Nq-rWN-At3Qn@^F?1A)> zc(P!thMpq+%IUeXil6+Z5oN$BqakTNd=gQyfqKv9tHl@fkd>OXm#>o_`>}>;^d-ypXEylu&)U1dcwk|8MS{>4oV|$r_Y1Kud|I^;_z!?x?T|8h zt{^F{xO7kT8ItgMe`^&mk``8E0Y#<;j^&n9q%bj$5qM+@WrsS5+1)Nd3_To0krp;8 z@jQ$l;%Nl|Mfqt6raSlK7a=1Pj`;LDPIYg`r(>Smr^S8w57Qa%$9Uc#7YtUUMcP^G zt#|>X&CO+HQZto~`olb1AGZ%#l9 z(>BYwSI`*1)#(#1FzYd&Koc0x7&3TFMs77^ zZmPs|vlFA{+v(sl#H#A~zJi5;30xaNXT_nC2D-$u#r(pJxRV1TFkbOz%9B-|hLWcO zV((Ow20~V~2j>Hka-|xB!%OCO}QNz0+of0hKZ%XTG@( z>|4at93t7na~VZZf&I^jpog*o6&y$J%i_T`u* z7Qd2bpp|j$9y3RP7e45e&F~EE7x{5+8P(znhExaM%?t(;o(3yB6s@=&J@FF`qvL?! zFGn{M$)nzxvcv32mJ}f++G43<(?wv0?2B)1M>9w_^e2)&YccJD5g3YbGJhg$s3*D z`^~shVm{8YN3XQQk~wx3vaO!Nu+!dIqE>t!u1?PPm+&59!HMrB7ZNNH`%A^9dloiz zfGMj0_?o7#I9*x}V>o>82vZAhcXC*g`?Z#%I^KZ~3Iw5}JKoEC&~MD?d8qf;Djr$& zf*kxz;g0WTrI!=Cr=aYglll9wtxyOQp?D2o)pXm2lO_=~M*$c{rO}u-W&bR(BHHYSm>AwN>cJdWM!hRn{ znXez0oUEyjwGN>Pt~IL{%Gdq4T{x>W?*@>x`FFMPH^AHhpm{8B45Q3a&c8?@s-H8{0=rfBecysMRGbYmRQ^&a2x% zz^6%fb}Q8po=9#zGzb|;HgNj^*9w11AOSE8U6*oy6D~D$Jt`G(Ie)Tf+CUxs`=xm` zFigP{=HOJ{)`p02V*dDnKlsKu(iJ*z%kL?C@?QjywGn(^hx{#PL10%0OE!Zc;QO~SfFHB@TC1?*HDJF8{nPij zTZ-nzlr!IB>n6J`j{emggVptTEjRHr2EWQj^gD7V0e0hnrE=39#nOdh`&OE(bMEyE zH1ZDtd05X94hZtj$Zc~F|0n+6DjJ1$jzGFU6jkt~uKMCxx%Pp42L7ywqI;WjcUVu{ zbpLK?AY`sa4sK|kLuWt-}E$@rU15MX~0K+G)veAU&R6GRQl=-vhqDcg9Er|J#qre+O4) z;o$tgTQ*le5^B;Gq^=K|dkE^G-Hcz@E)4oGvofwbumt7xOfGfs^Fuv$OqisBlf@Ms zCKli%u#WW+Lu8l}k-?XHsleb!-+jA>yOjhK{FD5lAvXgL3&&q8D|;P1nZSdm!J&ID zc=Y;WWSc;azi2{NMtXFE+PA8)`@Nck=-w^&|Fi}`-k9{0WAWE;xwh#RCETU1uIcf9 z)lQxnUGj&TwFLnB>e$$J{(4Lg9Eik?yx*qXYRosjm&b!+KT=xJ-z9oVY&op*!fC1C zqHlv+{81$JY5K8HCuTjjmb_3e{8*^Fek{~IdcK&A(3eis45=Ju)w_ECDJa`(^)r{g z;Mrg9=pq~??exGF-X~&xYaJenA$9-bF}M1|O!fYqyO%ok)%mkXreg`Rlj z*0VuZn~NburxP)_z`-FHXwLMp!faah-dUVybbUn6_~-E4jkMA#j%k7@v#bA#m}Y3Q z3I&^pM?^VUGg14D`xI>eJ}*r;`0H6Ft{I`_&n!OKZXLNy|BGhJ7mtT#)byI9j$tDo zNexnKv*3I?*>7>@aE@=+pdh7S+CnI%+4gQc08Ysqdk4^dB*a8Q@3*upYrH({myZ5aY?VRjAiEh5 zMl(2FD=fswI_uit^)7vadEsI%Dy{W>Z-zLPR(mH&MXkgGZiuPj7<+5v5_@)oi+?~n zt#f99y)TLr_0{A3 zL_pdy8={2?g(|-x{BVz?2rd^Ih$-BW!GV`<=|$c<%0}PzFUl$+Y#W-6V8MoHqE*4z z7rBU_r4&*2(@@_}m>R!^ph)xa;Rc3&7YaZ>`l9SZAo5~lXe#-ZU8Pd!VFC69A(dYw zU~)oufBQ=SA|WenCJvGd^}+1HdC8w|$9`#d`him04bm$aoY_dxgJa()&!*54VZaKw zom^Igq*8ARMzg*B;y_q+dR-`nr(j441b0AHxjxdtYV9tU|Hdm*o$pkH*Q#K5$Yz`l zcbRm$EVFPS_m98pKLN3~3m!88H61 zkr(5hq>?n9Ig~TwZ@QKFL-5N=!-*H?Ic?x8XUL7 z*w|O=S=0YMtg*DH62B24V5#mbaM%T0)H%DAq;X9PN4eZf@^--0-=1hyyGG64BAOOW z>1uTo%@Uzh7iEwwj}y*deiy35yZtdS2-l&r0OsRg4%=HQ2#k7c5nlN7AiKo6&V^+Z&*j z+zwgTA91n@`$c%|rI)+rw!iKjLy})Utme(X8hXmOR^oi&R7o3@CwxDM!aaFy&Im3%KA91Ue#3mrOd zt9@me0Gy{~yw*GqG{CBU5++Ai*ksyg7-%>l3@!g*Ejs6biZ9Gu5<*F)I~ z^vD0Q9bDi(sEXCcD*nYCo^(v%2*bv0B+ z#>0&~-o0YH`?xCRu4^{Y7zt}ri%&mV8mG@G4BxJCKD=A6jfdZ@h@G2#hj*ayw-^fZWzp3 z1~s4WpbPDd5kAKOCie`j=Dz+E3Wka>l2EOD^P>?5MqXC6za7z8#JJdJ&WA;$?3Aip4vux z!s|ODFoaJE{~fwVh z(eyVk0S}Dr#HCA9(OMRK)u+oe)<;P7x(@q2FvPGoBGap3njFzOkvkh^8x~&PWYwgz zTL12mz}K9FA)$iGA&J^6t;-+f7hE?Oou&REJ-#0g#&EU2G4<&kr>Cg1aaOR4&mBXp%3dm{ef~XO zi*uJYJDj^~R{xNCX1V@7V{&RZ2czgh$?rl7!=7!|<9MvV;Pyf6c<6(b6 zaB{YzP%f87BQf)O=7?L>J@T9ACs@k7t#F}#w$ofw#1|OJ1C_b|&=i?{>X^#yTdpe% z85Ubx`_$P3Pv9@xB-bwAyBuV~8HwIozV<|Q`)C|8vPU(x328h>a@t=xO*jJ3lynXW43|DCpa zi!;9Z1=daikvE8sjQvaGxf5NSkYk~>z0#Kj2wuy)4sQY);o2TS)EIg7CfF5f?N6(c zJ*~AmM5p@N`pTdK2B6Fte>B))?*-1Q#2+dn-hE>a`{Ya)|CotunRD zO%6sLd!e6QOgCp8_tjP?WD7vTDb0+u&~S^Mzvoll*=P_Gm0@@S*{q1Q&Vev!wf=P0 zxXamFU>aN*QlhZ)V*3c9%){V%R1S#>^8qW{h_aNCl*195Kk?;hQYfwhe|OE+Kfx_i z8L;%aVQuj|z_au+qz9VIG39>xZhn8ae({U$GoEjCE^^!R7SrGO4=84c~$4wwb;~F6=fXhoNJ}nGrDx*G|1?Jpk_v`QtmzxMsP}WcRP5zI_3cH|H(Det9^%poR|h9b99h z#;fG2GKim_#}ZABeaCRv^}6D|i9be^pWD7rubVx7t;|(Ci#X`{QHX`H$f^?t#iSQU>O8j-=~2`aN{idWpjPU1YWD1v*sJ$X&;{ z%?965iv19FWk&6GfDounz*z@JAK_t#%j45w?uuwr& z5fak0Au)?t+8Gl(TVTN5sf)*-5S%VKn3e{`LQ^6x4-Y=LQ)EZUgCG3C(I;sI0@)_r z+-nC>)wA1pTsUal9W(!#?0^#>5>&a*wulopgcA%WO`rey%b}#ax@9kSN%tkZ$>F%R zwa*uMDhb*=q2=|>U6F}v|fb0P3E^ng1tLx3o!r!);}r~*a5cI_JS07;hZ#EI8cgjE;2 zg>g#Fcj$dbtPvGxbBZEt*b4-T!A5^qNebVJ-evJZXwJ`aqe7@v#9pyHPdt47Laj`T zoBe{(izStiY^k>J_Amn2VS8(kd1#@yC8NyABD`0tpby5@_f*H6D7GK*s~?oeM z^dP@-)KdG;guzpGlGu5T2(_^Crtj6kdwrwZkU0?|aNwIjl<~x+C3_Rn z2W-)z&i=4KXKA`*EYF##umhh-+pMc)Q^u5jNb9pB?&+C|ls%3py|51s-RIunT0Gr+ zr&V$i3zfs@A06Rx*Gsc?S&2;JEIp*#b@LU#JOIvq5n!Up62E?37mjw2N3ISKj7V+gWh!m5l4xH6f1~TGu{iDUN=R3!vJT? zApR=7h2r*@aa*;3UwupdvM}lM0-2RbSD9i~VQIp2CWR_o;6p@HF); zKAP53;r0TGvRmcXB5<=n;0o|YwGoW9R)9Y0zx9<+w9)%sZjcuHg)$I_?nr-9hHR4F z*%&#IUYuc~3Cp8rcJ=eU1?h45a-FJXCyToFhnhCCierk6Ki>Vz8`VUKD|d2<_B_!> zW8L$r5z0K>bj&Bpe98LK75lJ#SpljR%Ss}FROwTVbtcd3K0^%aA`H|vS<)`Mu<$R1 z*f`y%ZZN`Q7)`hxKN8{hm60u`yUvNOvCi-jm*O9i21VK@-eEWhQA4!sSzV=M4hUnP ziSrO1y{+mGnQ*n#L_osHPNVVDCC~ji@2KA)sC&=OMH%wI z5J4F5$|xp6X_G+_`j%LG4Vm-jAh0xF#Kzs!H zvPhlmCoV;Ls>MUR0Fr(MyQLt%AZHSUJ&&fzo-bJeSulKE7A`5C$;Ehv#2CGsuv1&@ z9-MHLdf%TnKNSy6SBz9azn@uihB2{6hMi}e^>>+gqOOpMXji;Y?x_+%wV(Ycb#HcG zq5`N+VwF7Dz1u=7+jL10XVaa<(CHUORKWTu=}nx%$GbW2j)5bEG#AOA z&_q}_-J(<*Z~%vq)^VX2gJDfAzr^G93{1z=TNW|y!EgiaMLnig42=V< zc8K!%mfZ}&4Gn&9D#H2fm-m$BQl%PIbq+xhBacQq2Hx_RyQu?DO>im7B*t{?Tz ztCJS4UaDE}h*2$`ta8_V%Qo=)Fv2F?jXKG&Zat()EL$qEJ`*-Ibiu*#Y+ZaNO-~RCL#UJNMKGU1;t^ z{iU`l|5=Y7%ZPz)DIS8CDHpVLJ0;M2?6l`4XXzp6az6QTfdRHvNIL<`xqaNUdVtoN zL*5^>z~RJi2*|HNq`-zfSZw}#!r00^7Z&L1^2IE9!2YUeo+35)C{ zsWQ1}@K&ly%YNCmF4JD$MLl^QXU}k3_*`yMH_eq@w4!^t)tPD!WCQpFx8L%$Gaq0( zMlB&d|K4j7=gwX`WkVw=%+#=Y&dZjP$0vBZs&BvPq;~lKd3wq{e#b5p7}b{gE_>Za ziu?X^V49|5GynYfS(Ws8--yv#iG)2)N@*U%)IYm-z*AFs7u}W{C*xXiLlr9iXS7`- zAN$B;LECcvX@-oQzVrLcMXPuw7p*(;eoKSg;s0UmoVEl3v?QChot3t2+qP}nwr$(C zZQHhORZiWRm!7rmLw`n`vttLsX0=(72qvJX?*2?lQrKuiwcUCI%0&~iGvK2`7&L96 z)7e|9sr_GQ;$V==RoWhB&tuV8;}He)M8w1}|GIELzDI3(V~#50hqS@nQ7_gh8{|{Ta;W0DnTk4<+j+M z7%ynEG{1pRI;_xzj;gfOyqmru z>hfBa+!?KLo>&306A+uVGI=hyTCw%fhhPfxLlG$46*{%cAvks-Wv$`QH%%H2{hn+- zW1i4EudacLxjo{6p{aZH5IB`IK)H0XFl?@GJmv7|asC@Ms0JDbcOQaN%Mg{`mr$#9 zvR=VQktje?=O}QySV;(y9|IwP~#susu_FG&YwUd7pki;ZI7A@nEUJ#t<03ah5&j> zLqH>-X$=OPrm*+iA-YWvn4IT6Mxj>>g*dWK#U|=sL|orMPBBu|q}?OhG}J8;qg4|$ z)zMAxLI4noWHp#4V)PfPz!;1^f;g0%L_Pfe=j2e*S|~RI@h74E*oZ+k>e8Fz{sYnj z{=Nr;u;jz!i;Likjc^;2tp};z#$~|Z3(6|9q0ckHE~QCXGgLD=r&bUOt>mF!@Z{QT z-?_4rh~FzQ_#kUp44_}>1$5xzR?RWBi}3(x^xBEm*ruKN6Sj*CCL@zVP!1G}7K%mQ zTT0(OtVlWq(Hp*yU{4MgI?^C|_bul{@9P4Or39U%%%NdBo&2YyL&u6H-bx!YWr=&~N}b?cdX zc3u2>lpX3-aQVJ#Ph|CWFJtxa5M;%ALAAv=?0-diGfhnCvNZx1r*-pBVU){tw^v=P z-J&+(p0|CjStauu-@YlZov;kT{lYpVg~(c@bltbyP%^GWN^Hy;4OW(}{|QA1<`aF9$r5A#lBtmq{&; z;?Bvh-hokJy_A`;l@&5c4C<(Gt|;efId1MfNNX>K(Xozr<5Ing2(v^HM$`(@Qp*X` zE=zqKu7c?O*cpf~w~{w&&2Uv8k z1pLEPO90DSa#GIHb|2_m5u&324H9EscaD-h8ESJKsvag|+uEYG0SP6`Nz#eP7hkC9 z4aI+(psxNP7%{Z@w6eFCEO6a#WB65hvL&UoseXj;k!~9{{{k?in|NW`A55{ASrHZu z0OQMSVLpVFn!AldwW5_bKn?Cs!>r;X(;ny!1NAiP8n1i%Qwq`wT$TZ`3y<}d1)z~0 zS+hPEMfJ!vIxTN)2n86eI>ldm!{RpvNHBV5)#$T&%>J^nRwlkA+Aae+c1(!P{q=VH z#&GsQf^U*egeoSXEH+vv8k=(-BWsiKIc&{{xg~Gag&1Efq`n+6cDbP$7bB0eM5j*^hV1KF!RTXqlscqp(HL5`GZ3q)MqbLI;Mt%tZhl-1rm zO_)7ocL`vz+_e``X8lV{soMb#>xe3;h~GrXfFaFYKU!#FjP;brfQ_5C7sfU~y@>sg(Ul7X>utDy&ZZ4*P7YjA+T=unpDA7!hOMmIKA-7ZaI8F< z!v&n7zNoo`P$7%LVXeI@o5?AdRI19@#vDz|q_E4VdM=-wXc+V{&JqxzDG1zN#3GZAX z^i9k&e8*$v<*!(SYE6>(DgglPf}C-~of-@Lm)?hXo{g*$-s@;Vqt8;pScDC)7dzCd z6h0Lgl1(CE3Y{N>H{+1I`O^vsxB!Y;5KqoM-81-U|7dd%vQkw0B`jcgCj%!(`-uDq zu>aE2^e8MELhrl-%Zvamkh{EJ@qh>JARPZvHb&&bq{f+Q8O1xG4_+eaEehFjxT#qd zWLcgx(78E(ol|N%K`D(Q9M$$nCsE`z2SBxp;aKd?w!P3*>6gXi-` zBgoLIM|m|FVr%;W_j-yQ=W7Ox<4+G`-5fmDJ-c@tuM9`43AYwr$S9ZRC38Pu;r`fU z$j>^RFY@`GqbbMni8i+~AAdAqhJrM=n)9KADTG#f2DegZ)8Z*1vCm|D8Q=(76f4Fq zXc!O)1wL`?KvKli_RWReqr1t(^18lVJSv- zgMuAjBqxRi8p#Y`(dLV>s7s0~jQiLhEhg^Uotm)-l6MK*D4oGD696Zn6YYvxFSD{@ zyW;Fi*bcL4io)~jB@Muu5<`(ts**y*^fF(pAE?l9QOem;ql5qnX_@?eh$X_d2dl&K zPKz)rHuSl^*PE!D6ivFpcbQBd2#d$hDhV4v;QZ-d&BqTSzkJjY+&W7P;74Iks}(9w zIPSMwi_8w>zpAW9^6ylxO?pP#hcAe3Jy(#Co>nJ?j|}kMdQoD0$xJDmi`z<5fAGeb z(OaZ*N71tm8eM1bT(U6{R}CUoWy0;#Ql{^maMXMkG;b@U57QW%WX#`5h^l9>hUguT z=X%d8*{Dz@G}#4Y+`&r&2UQ(;B~ZC(W&uE7O&b(qps;hnA7D@}k3F# zVQ5}N3I*2%Li#isdATS|RRO*oqH%j%Qhn>9eA2w_BNKxUV3+s*gh^IO!Q-%#IT5{* z;F=R*$N^<8Zc?S^Q-E6UwLZoy1N z66;Jmq&x<7E3ty;!$!g4E{o##OaRJ}3z5S%`%413guT}N_}L&`yO87wj%r?tj)#%h zX)P}`((!l&dX9c}fbSyP>K=SCf~qRCyR@m2W1j_MFT1?U4ymWMSz5e8XF&n zSZ7AzLN$>QqUPcrs57JkEYK2Ou8}~RDP5B9qM{j3_ovpX%1kUihFhwRWrCeJ3<4t1 zvP`K2RMdd%gnxbygpO?Hj>LA^1ekw=MrFXD1hbzio)}K%e$4AAuDt+X$urHhEH#yr zuI`C6$aYfKz4WqapMAx1I3g1)XGsle1+k0ndaPV;hmAl*AVD&Qq+ITJrU zVbh`AWoa%O>#Z)UCiho<_B0fQhD?r(fc_F6sHOWD(TV zdC^1&$Y*MDq#=iuypH@tAIrZ);NgZBe4S%p`BCeupAiQ)%ZRi@eGi8Ue5ks?ERC79 zE?eOSCUTEV&$mJwwTU@avS~3LE;Y9LY?xrZ5N7iNNp_P3An`1y=Yuwlwls=7L__m# zg##2u4M0C$*wkPD?u$Iv0M36Wn+b*3v(9<9lLvg?|o+uL-zYe~*mhP5C( zk#SiD5Vj-D;RZWP!F)}MM&wuxM%-$&sA`W34L2M#q#mgI5}eLVuCZVONC?o8M*pQ; z@x6!c_ddD}chi;hc{EUK?y{8Qf)}?){}et{e@&RLFOV$WI9bE8Unh~0sc7iP@m2IVOR_SZn7DCD+QJTVNc0GN0c3v_|EYn$!n_aaK&D}v6L;Yy3biJ8PzpN- z_7vR|BA9Auh5>hLt|fw6g%j(RLGJq)<7s`jsa8*pE^AuD3?~sBKMAe-Vn2S}1D$Ab z6ItKlgH`+o8`TBPf9?G}(i=ahZ2E7Z^?#-GVPgOPpG`g5Q?XB-|Jkm21afdm0|n7Q zF^6_md)`CUIW}}#YGSYI^(E0Io>XO&FqMY^B5S=ZEH6;=yjotBwS>A;p`^vkyX@q3WWqo_6l;SB|4dvD2n^i^ebS7WgH^aU9mEtp4 zOfuo0T2?=8i$KqiL@24xN2Zgy?Rl8Ng2&jfiTB{FNL?uaw^IbK+4PdC&CaV9Rnr28BBWZjDS}&EZM9w6Ie9O->VOZIfuXRJ~S;h7q@Ua z=KxqfpkVq0ra-; z?x|iBSz?q*ZoI-8#fp|t6tCxo)za%!;6FXOX2tM;@m?Iq3~vhI&LL$Mokbua3!3B$ zz}MJQ6LTd8oslm9bTw#H(N@HAiK$gNw8d-&~*dY!Tza zM|DdaL@k0FXly#%5s1tMbr{+jAPtOSCV@Al2hJg`gy&-{Lv302MGX*;x*ZEvu3g-a zyna_8JVW?x76UUI(YWchFH~D_@U0~l%3`j2V)_#lOjJ2uuKNM%6ieH7(k*=#j4QI3 zmq|GDeJACO1)wi*4wD>`Yjb44%??Djf+vllO|74|rHnp08#7dI=vvQlHBy}a*6H2u zA7%nd_T+O$<-@DsOs^dI*M5Ag^p>nOFC@L40*|b&c#Ab@T=f=g)W0&#h~D%SZ?t#B z`)x42927S+?8}J}QLLg`3)6z9MOhC~bAK6*We>PVD09t0i&}Jmrr1!NE96-GQP)2} zizzK>zaOT~GC`~4$)aRgh0@Tj@g9409AnC!;E&;C?stqhSeV2@<6E!a2f`I@g(ITP zLXGknIAjL&#Rv-x%Opb{f(`|rjfRP5^sB0f<`3ynNaUHBhlvdnjbL+u5iuYIJ6FyT zp!?~h(tK7x6_Zy#Q7K_YCbAP!`qmQ14-a(Bo#_G~VZ|n4h3D*E2FxneXh&~SGSqKA z=a7~SiD{*NRXrOmuOpBZr2S(`m5y+Jz&x^sZS-ieXmQp*gbX&)_+Zg|*Qo>?0xw_p z2uMfxR#jeuSW^d<@P)G+YuQNZ6S&!EiiR)98Q=(}FpH%=?4D~gqDo#s_ea(;`Bp7x z>>%MK39gB~(O4ujhHE;ilT6i{NR?mLJDkj*SGg#kt&HCu?XQe2(+1neH9C`dG~njg zg!wNn1c<1=>-CxyaA?etg4sT?Ttj1c3eeMASvaj|FoWOR$UAGDGIyez@isZr46QHz zk&aBfgFcHQ@hq;%%de-`;Y6+u#p_Xt`WP2Q738u>H z>|IJ8cz?s-#HX{4PqwC8?iNz(ORKhZB9|9o&NDj+Ac&Xu>ywo6PLscf*El)QO7~g? zx9|t5El_d9j1p4b3$~oosWVt;h-(X#F}{|#YEOJJ%)odEwyM8kZeraQ*AJBrH{vYc zt}~Fz2IwB9of?3fxuU`6vDxZZ=T&$}G_KmAE8`*Z8?%Tc42~5G3zkq_w-{U*<(zyc z-Bq(c=|8=YU=CN;sxNrLL`=0|_^$4bi_MV7+k_=}n#}qt+Ov%{$ZjTT5_|Op?4^3U z!WwmD`rBmWR93zrjl-sYqgfEiN=jH7ggAatPS(r&P1bhdiMZ)B3F927*|m=5j!<+V{GDyVu!wZyhd+)nesRGkx~r+Ml|3}!McoBi_(p~* zxo|*WEz3t?2(t&J2NB1KnpW!VThHsk4e`6P64|(5klvsE_%mV%LX3R6TRsqBj7?e= zZ@QrzPlODGeqGc61*88yO<9?V2H_YiKL3$5d4QFj0SgKWFNDTrT&J*5R# z4HeDXydHsxzj}#KYu}V`8v7tiU=8qrl6vbEpfr~VT?Y47W??w!CZtF%F$@6KY>tD# zyP6-NkJ1WT-XuL%0AHJ4(`peM+91)-*0;4ID3VHweIgqtx1tR33K|#xt{U}GTEz#a z$wQsR7!OP9(Il@%D{RV`)(LnBk$fNsKTS9t;|VX7+)eSJ_(E(ZmZJUwhF$2iA#*Aj z7xR}#&shLp1SiY$blW((pzgqvo6_vTK~qKQC%^~A}|F$Ed3+rhsmKhJ-Of)h}}q25jj{PKyBi2 z#ogZhK)VS)E2M_ZqSSgN6Gev8^FXr>Le%S)?VymXd^!})_IB@3nmSQ-S`ZoH!7Z~W zsT6G&D)_3bg5Gp4t-W~vmntm)RtxV1xpLJu+h1pqj153?+NJcv@#axloB`p?;L-R+ zb>vodX`3QH6@2vrlkkq2UGk-60QyRe6ScF{XZ2cC0vy6^;>AM*OB1~!I8)Fv=q4aq zU5tq^d0{gp=joO>f`A4z+*I{Q&kze43?aXtl_N^bB78ivpL;Lpw}In}JtLU4ZiamD#!XC+AHtQpb9K|!)zt6M(T z>Lpwg#o@S$Ynf8>TOq$VX_O|5p^8!oL1+f?vD}L}WS`4J8vBDvPUoHUC&KCR=pQ#nx@MjF!mL8 zf;t}rxFB_+M?%pA^6FD;Yh({P@k65mYvEYdc(lz0%ADrLAA|6KQ#8&Rd>uowm6s!h zWSTG|FKL?2G}i&1**4UR@k1JniaU1adIQh$#H4F7F9Vhhb*IJ$`kwT#`YAI-_+`(! zw&7_j0Cy>!n{$T965FSMQzw)RA9q(Gd(vs1ndicgqBpW+_dplak?%XZudv;YiD|r^ z8GI|>So76VwttJq-ofU|9D4v$8g@$}5l2K^x!Yt)*cyy-^Id;PP1BJ;VuXx~qhXwp z@58(T6MP$2dreIBXyMN@49QFCm}Uy*&D-5`vl^Z)Py0^Z^YgZ`U&AKLMFWW-7scar zw!L~H*lu>k38~Q#MP~i*Gbu;ey_5EHl+cHmtK|Qbkx_AuBHVE)Z zdi{Q8xy4%*^g`)wHZ{Q;G~qyG_u*D_GA#p2oTQuvn6Up4(bR zY1%4`<0-YE2)2cT6L~Oi=l5wtj-qn8S--}U*mT&NNG|8~?FBNKSW_f!*Q3d6Vv_`W$mWMxE?kWOkxk zN!}Ovme%$gs{|M`N|u~RjDE!W+g71cQk;+^+Lf#YI0F#HI0W}9nsF0R<$Om&+q_U+ z+LY-mKVj>ui+w5FlF&~t2)z$~3ANpZHxlWBiu>v3Hr zU;}Lxt%YceT_vEu+P#IG*~*fX5qL`2@Bfsi<%%HbfM4=P-U$#ZtS;J%*%P%n$bT`+ zEz`{S2Y6&>%p)t+ApQm+5YFHXdqca`vTX14oU-n+EKV(=bwS-_0QoOZN7YR`+YRV= z5hPH4y)q|R(3RVV?gmVslV0&bj=Hg6GPc-BoCdp%6?318k1FfU8zRT-Rrt{eD9TVu zWX0@uVE5!MiKJ|Cr9Gp|Xv@F<}k|VE$ z(IpjUWI%qiHe!$<&qoK){aqW;&CFK&_l=Y>(rFWH&te+6nX)3g4658wY}=c{(a|7#FXeJ_Q;&;>~c8Mlq^ zf^Mugq4;MIQ2qEJ&=@gHDBN!SA~nZIwMi@-uT(0-y=aMEHE;%EH)dCwso4ZPS^o zMsfJXc~+;~xhrky$n$R`kFLU@9qijcXP>b}@6f78(rLm+=kqgEkFLb)k9cY?L9cbU zDtmQDCO7!?bG}#Yg`{4-$E|CaZI^ z9iAT_CQjPiReO88<16J*h-!=}rJa>G&Ao40#~mFX+*?KWuWzPv`prdOvz#x|!;>A^ z(YCQ!Ox{0UbL?Ub-BoLng553BDN``rVb%c=m6w*gmEx|wn9A2x1qN;v35`=SfU;3g z3u9AYiSu*~O)p?d{+k$B@5f`^(RR3y72&brWvWXLf@fkQdsb9>(o-G0gJ#IrpxM8> z2;r^j`9UZ19m!)=(0Z+DM$NHzRzWZXY5h{5Z@tRxB5jL>&3;~GWS8=|!?_90HM4|z zkhG0uhiiu*29?ileIjqrI0ouNVg`j6vfOigq2E?(>JC0TcCOKTl~<0(V2sB% zQvwSnAB{F+7<}4kjMpub3$9c%T@bYj0UD>tpFBr|j&BP|4-0DjsB*DMB!dAc_rbat zm^~gOEp`ZqT4Rto9bN0a8K;0cbo-`lXHSqRS=(ZmQUZ8CU*V|vkQKIc;g)ZQ^(Obc z&8F{JL{q@JnpSYxM)EI7U5z*KiA+@Hnp#$s>rQ5;bq>F%eR>8Tibi^)%f`BEp-~Ox z=^V;bIJ5}z3%iDG$khHxX$>UJoP&x6`(f^QFmL(0gu1e}3F?5zfZa}z35M<>`zffx zsKp_ell9ulW2uW~+Jf(ihpDr+gDzzO@hlTm3s^xaP=V_6V9hogE8)a9H?o6(bp5&x1^V3le9{)k#S(nc6~ zR!p)WcONrT#QgNRGRNeXg)TyiZb6~rSo9>-1LW}oo)CU3Xm(%-f~b?87Ys*NAaBtAit7{O zTn@$84Y`FElp2jN7G|$Khco-hNkN@bl$1KfIR+F72DyREND)i+o(W350dsoy#6Nae zU%H2|{;C%Wsgq6FD&={#2mE#yW+Fw5*yNvXW9z z)&?K;=Wwm8yoM3hCQ^-BS!ze}Lh17`pt@uC#uG@I*)FyoPB8P5_0X#0Nj@su1(fx| z%hi@9U2Wi+9Saz39LR7!Pbq;+K;iA(i>}N5x_6k3=ZA{lf7(07CbXJ6M~EO@$|ia4 zNa$74P+RYC>{S@072DzaTP`*Ns1V3;+)~1KfC)v6zL}qjbAG`58L==xhtwBr(*)-% z;PVY~v;9E%bVlaNux;=t5mee@AmsqqEia-l0FSQoJA;EQrJ+;}ORDS+oiS?-?Shjh zMr*Djws5;Nn4Pf#5ke+C2_bPX`PD>tfzDascn#-SVDvIPu(rKQy-jMKe$X__`+@xR zoi5M4@!piaVNmo|9jVC5rpYvCy-aD|NV2<3bCV+$5^>l|#K-0~Dc%9&`Te7y0=lk~ zHJ&vCLJsI(sGN5W*&98>kLhud7%Wzdy{}eF(mF2ztZ(rPt;tN5z3Anim*b!Gl%Ph+ z#C8=JMPs=1u~y*$6Z5@5;;ogN(oCEWH0%tY3M+%)PCa}B1_uZ#8*;@ivo&`+mgI|F z;N46FS;H?EQ6^iTc(t*5Btn;F0fC3`pS`5Q8mLnpr+m!Y%(ib@VqZbjEC%NvRmie0 zN~)-#!7m0snc%Ndf5dLe$gsK=g;+;)UTpIEJ#&`>s|@ZFT~q9BxRt+HCMVHM%FAYS9jeaCItbITLx=r&??1~X!Qdlj*%A=BZf4E=lXkz3^R(QA5C_Z zYi`a|4*Ky*!ph8urM;nYkPQ0-=YLJUY5VNNBl4)zGw9Ra7Y*D_UW0`Zv9{H!0h)q2~*F+>N;I3=3qG_%S zU7s!!)GA)09h=aufzXp<1d&x4aG+&#Ou`V0cta56yPKSd+T=XG4X#}#5)T3_JTrX; zNPc;U3Wc?H!~5ALBbrqYwA8i50Qde{n)V_$?GY|1-f{-JMr(6)#}ltj%Z5j>=^CAhexP<(7M$I64#Zo&S0HEPL-5$Q4-=;46^4`D`5Q~cZ4qnJk z9J|TPM{ov_#gS&guC*#s{+;VuX&vA?QphPDAs{S=b$PpBR#y;LlACw;(tgFS4XUN{W|I9eU)~i+RsYD{05KU3;I& zNj0>UXd}#lCE|yk(05Y1WAzIia7JDP1_rZ}aqt1UL&!Ld>Mb(F2Q{MSW*AcTx+s*y zYi3Cq1xm7@5J1r}TT9Arv2*OU5|2c_csqyAB&ZruN;ww`ul@m6ub)fY;!262CSMhqViC-^$X4B6&_yBxz~ z$mGQ$GT)-$vjSl`F6xbD#d8_|EY&N>Dfqng_F8$afHxB?5S~|B+hLz}h_s$xqkF;J z@Ir!;#-GZ0RM}1hnEb_2%?3+!a)Tid;hiqZ>oEge75Lki=V|^pg~Aig$Zz)N^;zH} z9(sJ1RIm?~#52(d1grNp<8{=a5k5tCWBrI~hcIjNIfMMM$2afB<<^ZG7N=0@Mw%_g z4I)0J;_)(RU1*6Z%jJo2JZf&Bt*gPrdB?hw+^4Vyd(%RqbX?^gBfZj1eh{gw|ah(-UlKapmgS*!#g+O-`f zHQy$TTtk=pS6)(;k|7&siuZlsxFWH!h6{F)JMcP*YFnp{;T8lJ#PsrK84e{^VWwm= znPTCRA*CFhQxmYP^0lFw9jwV2Q)0V!`^`K-jYNpMR&@0k)zs2U5v6}EHpMgK98brj zoXE8?6+=399{Cm^OVZqD-P>gD(37<`UU6)A`B_`!eP-utjcVoKW^a5INF%ctp0l2h z!(DftrgkzBw)>~GoBsrRV!xMCcIGpNulJvTc^3#vyY#TZsO5SAL0yk5j{{E^=4!=a zKN;ClS!aZ>DXhy+!%O}%z_DHVgkZMZM9C-VFa;Q`YX_h;`b;HO(y8~A>qTRhoK+81 z;mqD-9mO-ZDLb3_B>OyJ@yy%>^?%c_3u273NQ!S>QFLb+sNZGJwvqYF3?s1V{%9V{ ze`@d3Jbh2w@1-pnB<{vkeFB&OI4Vi4DVmbIf*6Nov2?6_d?puDFYyj^AKs-75p4am z-TQcRP3>i{R5&L0SEF%;{1BXTb4+rlR10GtM;=xEX{t!g&ISsGR#u9jJHo84HV&bB zo2^@nVLhXzpa0!PJynDVUXC}QQyvPV&1h?)K0FV<%H^kZ-`{0I=8UcpK^-kc`<=3w z1Ww3sFD(#Vw-qhGS%pGVh1XL#QQ9-6XS`l|9jO)=~Vx7kJK(!ZyK#_h% zcDBizg_mHlgVmpq;t(R+?YVZI3i3!`E7`0 zei+0)c7s3ky&(x$Fq}%)*dmNb9pos(+cF{?cA&Ee0jvG(0Jme1edA!bczf?Px~Mxe zfJ?e_fiy6@qwQAnZM!!iL6I{8$8Dv?9q3&K9Noe*d_Uatxn|i`XQ058HLE*e&QgR; z|NAER_ZPYl&+#`;@X&Y|WhCdP3E|W7`&aPuP4D*^{OvyP^1q!4{&!qB8$12~^m)wu z3rpRCw5x-9=bm=~`XZ8{ZH6_XFK4{(qqGFubb+@|(gCKJgauGB`fl zUv@~Jj_ereyDH>Q+gVn>WHXAzFP?rmNtVB{Pws%qGA;rmkXb@)|9;??+cZ5|`8eVV&nqrZ zma>es4kK?W2mczKo^d#^zuymSK?@dN-LhFyTxN5OxtFynk|!s*x@z9PiSuuBe7Lzv z9=|{J=NQ)qdoS7Fgo|%`aHAa~U^08ZF7IClX>77u|L|`&ab_9@u)>a8$eibr8xZRZ zY*}s}J&UkKkF&iKoo1uzv5+v}F=v{w=15NzdqbD85JW>JRy?M~(bckXt&l+%)W_D? zug)F7o^gFRF(Nb*9$SCyx+PzSR;TWw_)lsdPqoA9r!}k3^EqDli^VaPp2bFGe>5>< z5nJQA%@f|XCdLva={hcI>GHZK#9Y06SYKTyy9}+VrombE2T)SkIauGI(??&|>w>VA zm~4HaPiyF-$rre(1^S4P2u2RZoY4i#ps?^G=P$$SLmkW$zj}fUyM2ja8uhlUqbupX z77xjC5vmvcr}%4Wj4fg85xhggn8^MJ2Z!F+0$WSgrGFWO9V_X(YuG(O7)>672t3iB75n#L;z=9Qan^R{> z{b(SoA$z72KGY05-E@+#OdVtONC`Tqra~jWqwokO2R0PutZsfhVA%u~0_#z~G;vI> zOQ*Y9+0v>vgN#0>i?tkTwb&&xj)iUB8(o6@%UeWn|Bfka7* z)cYiW0RAH}M1HE65$tXGS^mELP{WV3wNYbfpwT-&x4}h=Eexzid*{6&D~>dCSuCJQ z3MFLT**KxdAPkN!zm$4)B{3_*!d#iny@3sPOPP!!M&GgtzEV;(wDszU6zi11?talM|*$uV6FmmCF7;{Z) z+szJ2!AExwrulp%EkEnf3>16q8kRGwSWuSI2hh!xmq-0U?GpnUkAU+w*g@t^Yr#m{ z&MNRY?a;o_mr(qN)Glvi3%%PEA_&ugbV?`CK|OeYtGaZ7Nu+c z_0hr^`NrBTKLy^QL)L{eaHM&b4fWI->iUJ4j7vxmlc=yFX3NOkhm*+H@JcQ@HDUL( z%$=9{vZa*4$wt*PG;kPI+i62JvAg(ZK5~ze&}N-rk<%mA%L5XVmtbz;1Ymy9y3I7g zgUXVmqwFr)%)-LuBp8n> zf2j5EYsa-4oC(QH9*5RqGmX`e=TpjKD5ek{v>UA9d{df=cIjQm)VXq>ug*`zYz!g-eKP;avbEvXe z1_Sr99I2>mikqw)30c6(d5>|S$&F4CU`#m@1@m!=$q=yQJ`bbQE+dL?@P1$tYvG_k zjzat%G>CURZs!tRx70;4uqYRIrDzi01w;(Ji}<}9?xn><)MS`Y^Wl!JkkNDPhl8`k z>jMtjZzV9Pl!1Z$RiXk;pOWN`=>XLQf7@0h4`P#sHb2e(It?8r^D)IqbdnH-GutZ+~w#CDPeNEcC8~+uhmzhtz0&Ew&yUR#6ViP^&Cl)q&!NW3ICMs1F1HZExd z%Iy86x}%WVVJh#pFljx;$39?;{fQXXo#f%{M)KBc`}UXkGHq?BnG%a4(D7Y88_=rN z>n@-ir$SP{DIe!UtYGG!q7oS7(SbSy=ruAh5e$U4vwX;DN$WOZpLx^)S3-R>s2r5Y z2j2t#KMhcU1aB0o6nWXGLq@%b<{{&|nD%LV(0&Yfedbyds;!jdH^% zZloEfWoSw5dmLDjxm`9m#F*#D<8G$7pn7=vYJmV|+qnQvpkVhucOkosEZmre*=~(X z^##?c*9v66RGMs$t(6iCBsQVnXZ|*$}GKmsr<<37kmysUAg!{(z(uQq7$J>gj9n)IdH0qe}y^IO}|^e z-R+~4T?uC!=UQGW977DYJu0`URa=!me$T*q)8xuBdaatCT4`*h7x?QnrP+RFP`V_l zt*nD6II^~BD+gSW8TgODfKCHe%4c$qzx4ghg{qKZQWoo4Q>WK&Kk6+tpzW^pjk>S! z8G-3suOMmm2@p*`18K~MUCFp*kdTdmT(SDfYaY}SjYiD6WpIv)Rv%2v^Dkj(%3hUd z*bDE!<5>(|4A=p%BwHAn7%RED{q*A$&!$>KE2h9@Bl_DTLB)>x68h_+yyHIw^rF^l zrB2B3ejJC^avQ1sf#!S@CvH4v`x5%?g+Ud_J(~ep^0Ol2ah8~Q%RuTK>H2P+89s$kW2JZ0`4vQF!t02PxRufy zx|Ooe-~Bi`ppSo@Z*Y&Nc%}ZD@I5}{-Vx>rOsghe^sNb!F}`($nd@&3o%S75)e$7g=Xh^LS-$`C|pJu)WjPrvYnSzg!P*yj+_tCYEuCy z01h>;qtqKnNMUWA4bDUXxnI+>CxJb^>(qPYE)?9xrd*ZR9wQFS5yuIKs-oq~ z$|lS>YMPuU4H_mX_S14#`X|-UIn>ERNA%yK4dxC*5B0!bVqHI@fmJQAKxlZn&jo=uZm`s5^*7UazDpDd^pj~uL$se!#CO)wj=UrQR zPA%YgaZPJJ-GUv_X8uHybLnEbcSL+x`D0DBz4cyWr9({c#Co5j_L`i@M-OY!`BQp;Yrwh@`b!Kx z|KhEdP9X87t86uT#{tovqU)OGpW`J1=z~VqKf6b{$VRssFT^KYoTsc9Ob->Z z5B5V|zVd5Bn<#&`l9+^5j$X9Q#1?)wM_q@21Zo?f%1*wz7QexpJ$bJ;dY)q1H*%9TC5R0E1ilkm?b9v?-@3$Q( z+86Sqd|KA8OsLA|ksh2;%8{`BTrho)+YDX%H>>}U_*q)q$`t&DbUhx4=K@^su1)d@EfjTj!i*6r}3Cy&Gn9y9i)d) zXz@&K;(;)lTxq~3OI~Nj!{qiedOcIAo%?MHA{ZpkiLaZd97Vah6j_R^F_MKP!-ne& z1_KmVkbZGksZXlZL`pIR3u~$&F>f{E>$b!J$7_ud7Q?R66;AFH^5u^Lnk_>z`h6FR z4j+}QmN1?zb@c8Vw?Sc2Q8}HSSrNU^mYBET88Q9IK=G}BEkKNu&n5h9oCd2e&+!m@ zNfSYb%meWFohQ<9niZh`X$PV4~8Tq!Y@aoG8YO&bm2cwGvn-Dj5`^R$|qNo^m;%1)>>PUn{EWM3~h z3+xr;+v$j0p?!N~IA7?KD9hIdx7*sDR`;uyY>eLbUIGm@1{E5~(ZRWkp|uhc2FY93 zj~eNgpN8YJB(+57h96A@-^{PW#QWbVyuZLOpu^_>EeiiHX>$&i{~3i_v^#34J78yi zP=A2is(k=yDgRZZ?OE@qV8DA;h;#J`e|t$1lF3sl+dM|SVs2|!B^9;dD!e{_h~)@> zlE~_0cSlHumtNYQ_wO!Vu5N$m_+AnNmEpDd`9S;d z)`^zB%|QCFRn6d?P>Oi=g*}R&%wPw`w+hC%R|En z;`wQNoS-B0`MojD*0P>||KTh1%k}jL*ixij=upyJLNe-Sv1@2(a?DZ!cJ1DQ5;?Jv z@`~(O8DTM;L{QL&TDlbnD_(CsLBq}9@1~pvcqAJDOw^0-R(Xt;C&wnBcSW=stQX%9 zPI=gZ5CHBs1fI|z4zcaxl^dmyLwSX>1}}wzh4d~shea13ZndD7QSRuH6wuf*!9GDU&zSuOp^Gjt5%CWXOewDCzcJmLJ-Gz6T99q3U4x^Q zj06KVBJ|ig|1g@OgkCsUMhSzV2R_Y8-zpnGT4j{BSlMd9={0KvjfO`H$2yUaT~-WP zTq(oPlC|QuTH9k>)prOWu1GD7vDIR(8`vDma82hK(nUmw-MH^G;-B0)RrE0>>Q0d> z-ru+rx-qeDg)DG0UF*WDA|b6oPmIb5W5gjag`5cAiB29bOJA8)8D|6sVl!cic8y{N zr?BnZ4MKn!o%hS#_<(D#}-(qS=NaeGzScvbNjDWMuC7HrL$`cm9I zQgo8pp8bQpkm9F3GSDm*xA~py1Ukkl3+u0(fEoEL=?~3TiGIPRpl+GE21M`qWw&Ki zzuW0Hl+hx(Dib$^&4dPmWYH*saS~&rj74BA6M%&hK}Ic?AYrsT^)p%Mc?5v;<7p1f zyF8p_kfg>?;9+O6ILBhChtUM4BvfLTIT(o+wOe9$xkRjjallZ$$8x6DP!yW>iwOLC zP#jsI+m&3A8KEIxIiWkL?=;RQD5T|Di*hKla3WsXQZ zE+;_&#S+84+;vW)NT6!moq1yB@T#DSFQu$UWJ&H={nm)Gbu8Kj!4HGLy>663&Xi6F=d8~Q0fI?-FmYsg=Nt$PYQWwpy-%m z##z4$R|M2b@&+~vx5k{q#&8oA7>@OVL~bXUZ0?-^!lv(9J`=Co-EsmMh?T5T!C{nB zHcGwVYDTj!1y?1Pvu*OfqSmfpdLf5@b;Q5*ypab4<`~hltQZ$=Bnq_5%#^*N9G>BB zhv2iucao66^IX=U$fxVRDqTmH8J(que^+5IyIlJ;TiVJ0$-B#U%Q!a}Q@lly5kp)| zc?qm-M@0o+9P;kIbZbp&FcM5L4>e=f;@0%N&!{TE^HQGlF9Pgy{Ug3osC&V2=XrDnF)Igf12~m6({4w-tGRyn`U1{!E7cJGplGNoVEIEO5-2r zt8so->@k{wZegLytEe)ZIO)L72Wh8Q%GOC)6;`$kw{gCkar238mQzuLVNFQ}KzNDk zCp9LR=VFF>wv-a0)oSw`1tK(uyUyYbo{;Jo)yhrXmsJ?jn1@8g*&<3V<6tm=E>L}u z*r4|`0wz|)m|_7`)65i&?KPjT`)BysscnUw+#j)>%9v{Ok;b9(PQcoAOX%r(d3N(3-tC0I{nLI0*d8yoNUboxlEqw3b9enK7GI8hWu%|yR1pHVb<(_eNu z8^C&weL4jBNfLFBBDGyTNsA|SKGP%f_PPExi>(`O3h)mZyETbuOAWCw-Pa&a9V(@C zonW>^@C4E^ayn?Uxw@AKbHsEHseHy*wAEAs{1>yOgEOG|!owH<$K>UE$9+LuKjDBa z%;3XGt>MICb4-sZpFN@amg!#Cm+{W6$}=KVE6+MP=R28ohlKZ1g^C$%q0jEvdj%tb zMV7%HH``9_k9s@v&?XJh*{SKRZwyk4TKVR-J5QLm%Ax^~PupIW>&bQANGVC;#S`Aup6{lP?)zTqYFYf;HmidYjFB;pP6JS6Yn9#brGd%wO%(G^isNAAn7BkAZ;uEcW*gdz z^$-`(M#SJUCM=fT{1tc(Th2g-v+W^E1oqJ|_Zvj8hQWe*e-w}YDTTq@&p^kV-vhg0 zID}RHHz0|}e5kuoD63NhkH4BzbHcn)SPisMh>NiULkZ;xdXNO@!;iJ|aW0({h)@Jb zB4E%CjL*}(;0~w>ZBb1E2Rh5khl&mGK6Z2qhQ>O8AE?oEqDJr3igz#yGnV4v#LZyH zMF%_X2YJ11_#Crig-~4}7?b#C)9x(q*#MO1(qWcSUzQn%YJ@&z0PDnDpe`5XN2Xe| za%Xgs`R|$&#;iKE7OZa?rRg_m(?gl|CCls|FiGWRDe68$z1l2P7SB{qbzNF05=z28 za8!w*u@zFkH~s)bIVW&a0AjOZ@)Ov(2$XgGOYe5lca)Alfl@BKg8wikC8V1hpj;a8R9t8}Uh~vYhlDYNDoRnIVEgDcVc1&Grk;L>HSuF-{A zgN+1K8CVWE(z`4=O~Kb0=K=6330r)`Bpq@U-q6L=qV1&h*Qj>nTB!h#O_sBJ<#Xv> z(?39^+n+}&3lt;J+hf9+Ho%%5<0LdTS&c8c445(+DYau-vBH2yuI4ZGs}m)n-N*3# zn<`-RhOv^ed9MRa|JzF7r>3z1jKYZhR~c3xHZ;b_h(AO+Og{65yb|Ew&ESSrnw(xupuk8A^V8q>sI8Ya?)j!H3)WcBcMwh8v5w03Kuv zSK4oyiT7b8iXtv;6|g24VzzOS*(|#I)oVjj6e0WltYX7j(j|qhv6&;^Y>BZTN06uR zCj3qdx0^HnONyD76E&2Ob6IigcPQ?Y)mb9!DQxL1QT`8@X-hNbOo|}f!fhMuwCdS-PhO$!oo+*66$V?QbjNkuZ~*WC=Y4~2@PjVyj{t@Uj4Xp#paIEz10APd4<$ZD1dh1G zqNuv!^T%_JJoOX|NNCX9IhSYB?1_Wi`z|?xF+X>-#zfunk0RFdTSM*XZIh6GKTFNc4V0;%=Pr16>9YS8VCZdYDn^#4O5yc%pI&@kZ!TJHP_$B>3aUMa z-g>yKt^)4SfC5jZ2Ib4C2>S-XH{JKhf=1B2Ed}YfGGWmQGu`hb<=l*UxIbBCfP$7f z9ClvzXgTgXTt88?ZmF~!4|sC(ozrR=FOGGTS4CJMD)obB;)B-!;ohFZ&|xtxMA%%$ z5Gu3;9it1AKj_dLJXr0%R!mU6%fE_NPg^Y)>wDo8~dJ|XW07ftz#2;LAKTC zyzSt;zvp@z_Ahc#=Hqb;g=*Ue#s$qhGa6~)EsQh#?UUZ%H+`qjmwM8s8Jxl$zJb+7 zVTEn}K*rM74kn`YeM5=+viu0+9DLCK`DKO+#+&??^v&`=(_(WnF#q4_dr7Bl`l222 z`T@lckb098C^YhS5$z%V*z8IVQAs&H+|QhJ>C2VPL}okivDNbDxB(kA@0a!*{{xu$CCNfK#m{pr<20F zYg(@Kg_PpMrEv!TsY=!BkKFC(;Y`$o=y78`*`Fln5zcw^8E(JHqu(%})!ZSl6_2lf zc9&gw63Vg?b9S^~E=d z-Axa6^42-;Z8Q9zt~xhoW~zOYrK9E1XVpP*l@?}sH{ZfV?6309_2<*rJ@@tNWx?R! zQ2vMZg9VQ2>u2NFdG|Ut|MSE7b@2EC@3sZ!CWb>xGv+yudHS)Mt_PBL;zX1Bp+?JOE>l+a=yopfN#q{qnf^Qi)bQG_A!u6!06FNo%fQ z!Hr&NE4=o9w|)$gCU1idxeOQHyqw0o-<^MxGFzYlttSp%if1#eql#-6Y?#7zM%Ie! zd)bt^vG(A+I``=InKdBkj?{ywp-(NqN?1%$*;9J7m6$6cCy^XG$k;gwS2|GL=H}Q> z!;uMsJJEwXQ3+5DCRsh5Rte-{0hDNtpbpTtvz{n|S6##!ZpErZxFkkNRgt}AslGJY z4VHl0=3ov^djL2!5e4M1HCmz}P7sW~U8YWx^}78P0E&ow0&Bg^4U`5furDK;k%O`Y zuqmRp!|iGPDiz}*n14vtJkSO?`Ks4n1+kUmD$n44t$bA@su3~qzj|}aKB7DS!0@99 zFB~lz$rQ50Q3_SMS(u!zE)~8#QWFJ3E>VY7@%&2FAvmm!-~+8Zdk!nHjy}1A^D5Lx zWztN-0nIPwCcu+JG7A$M?1ES!%zQn0Qa}+be*&Y)D5yY+Qwf)Q7@p(yQPZ38mR@F6 zDYP;|E@sA1$hzlEYeg)L4*IhERGRPxU4m`2=IuCw)(x-p`6%;4QYT(vL7XgG!8>w@ zNP-&a%ZVLuj=~tcPIi3&S>?vtI2a;<{M0olD<8vf3cG$vuq^8?w35js*DJ2c1RJsxK){09jh}(Y+I;o1U zIF(cNY?4O$R~++Gv=8#RjiW3+X6wQd2mSHAU*5qyI&i(YEdC@X)}MqXvlZa5x=L=( z+b%0D4$8why(P+kK_?v2GJ7T60ly0xSDrBM*8aA5>hrXZ;q&73Cmee0J%9W2WR@TE z4K0~P5=ZOS$3kdnR|jem+5$-CP}7w{uaLf?%BGjVEZ~ZrVAM=#jy9o5%OHh`Za!&= z(n1aW3fZP)@L+8TY?f5PP7MuCRu87sR5qU1?V7nr7Pbn}F-Hy{P@K6Ap5D%aVqMk; z6eKTn-r(jXRbK3vghOiiSwU7LAaDoQOAqdYBabr>>;#}BQB3LwO;dUa1g?#=Ms2ia z3ZVvYyco!S+wF`cIupBmAOlA6rs$~Ud6UG8s(iGDtb}jVaN1+k8aZ9^een8%S?E5F z&F*IiE4H?0ld2~WTxsRv5XIyHuH0GB!bygl!%tvHlEuSdzt3m z149WYRQ3(y4X)L?k#44gxsf=r9p}BlVJe4l_G2;pNP~vz`8m~0lpfvslL|}9B6ME@ z9;7{NLsKlPFDb;5rB9WsxG$j43)-iJ`WkeVVcByc)TOm_4NT}Pw0pL*RpE(YMa_0| zWSc3tg%4m5oGBirJB#J~8m#nZn2RQbt66=kn3zz~Af`}hd!@tO$nH{pulJTnZdT6| zd0hLy@qMt;C4BB6{FDWaQEy|c$>D=mSwN&YLJT*qqW8;6*#k?uQ@t)eDN~y0pK%DnH^KGoq?SF`t!S$mI?CD z-7mu^tSwB0+;*fk73lfe<-xnm&QD+E}@j5i+r57nZC8#R-Gi+u^uon)<{TSvAlpi&VjH*1mW3Q9tDcYRWMX zr1@51^faRPakmXk63g-nl_Jeud5n!!G4x;FJ`9EptI%Spd30IVunL+Y+PYN@CFuFJ zeemO3Z@cdcTg+79u7VFTtL&GX8bpVtLM&Jm`9;k?8LTrVEm7fY9GIvhqi&YFcxZQ^_`^3FT4!gR5rS1dwaezbGHXaZXyH;5h2C7Zzgo?{|zEWl1PB z*76BtcIJybdR)udYDeaGlr*M-Lxz;vnl-%jpJ>VFUv^oty|_to^)gMT({h5u4_n->n>!%if!Hrp?cwq**j*~3{Qv)55v zaS66YN`Pa+v`7;d;RdmG+fslPQ(=Be8EB7i6&WcYOgL-7_J|8|dPfJ{9-Css<*LO) zRdB4+G_qXnuIGqCTz}B{6`#w!L!Pw^_Jci4D6n>94Y)5t14B>)3BvCzsG~rw0R|m) z=ZH)s7Lmso39!0Lm$1^UaIId)?s{azPpnH&()z%CdT%4DGqaci&8-oxp0ECuJ$xB2 zBB=SR+gGyMq`_gLvg-%FF;=sAmwpga$WT-BB)Ac#_K|He0b9+=a@szuAwjV&@?%KH zz?B6w957B?H|Ii;pGyn#Zs~x!x6Q0s5!MbgSoLLku~!tt1o}a=&g&!3;Ab|)TaQ<`1N>S zRJn12^b&&dFTBHOAnFj``ei(>ASHD}Di!VOJ*buV%=&ofX=+G*CiaR|Yk=(YW``wW z(^@{KIAh6cW9jG}nIz#SV2pQj;33aJ#((sIJlF|eb0O*5+F{TAp)3HX`dJd1* zt6Fz;L(HA9)|KGTf-itE(i>D)StNCt-jM1l^DWCWkbPKrE$UOSa;KQNxM4;F=(24? za@i)9{wC2`w4z6@HbaR44t{?*r9`-oO#yq@>OL$pXNp*WpGSB$_T*y>a8WrVQt@f4 z8OgsSlF!Rci&{ZN!YtlU-Bc^wszuTGC^8af|7Fb$<28iE{$67tFPFzS%zHil^^k({qiaGwVV?j3m;k7 z`q>kf=KSczq#Yd=Dsx}&!elG}vxs0xe9`>LY283S1Sp`OEQ5k*Qh;6Y=OeF>l0~@XNr8S1Hhyr}8^=ch1OMPI^0@(P#f|5hwVO z+#*YYMK+v+>pCq@WAyX(u&%<{X9tfAK5hac+e3wGzHTIxX#CGdSt4;|<|I>SmyZCu zoCs)cUk>DV;yB{q(Td z#5L5dF-W?&)?KAC))iehp>g`fPv@55US5&_Hm>pC;~gM2h)K)rmNd^HM2HaqV%1Zx zqT2}9IzVxioo`-@9;mh3tLM4)_HTsXk@4!Tdy(>z8hbMYM!Qd9j*8I@7AT>r&5{(` z9c))es^SUwtAl}jGxzX*SSryw1pZZPf&h=TE4c~+!Z@=6w_iR1W-zDWVLm;Nrgs@wT6A#nrhX$o$N;+!=9YvMmuTS5(fPp|LD5fC zndT49c(izBVj+j00%|jL+1tKw(;qAr<4uG=lVv}rl~t%|91+PZ=(0#BN9L&*b@Cu3TH|p``4Cakb23hkR< zi71=vv-RhK$AiUUK20yc#8f!TVb~1o#>weSv2|FEfrL*P9rRK2mRx_8fr{=;*=t^bqFO}i$ zHf#JTZr~RW9`>{3{EG+w`SD};4<7verzh+Wo}c$YQ?X8ga~Ml0>9BzF_F&Rc%fS@) zzdb!p!{9RPQ^zq^Ywv(^bBWBz%vD~+?SBu71KBj5`?_O=Nv$nOK_9Xf@187zr1^+S z(1bpENeCrbi%Ugu-5vpLGCE?InDCwuINIg zw$se2*6%jvuNh?23!##QyFFF%Le{GopN_mI*Pgak(zz~b=ZSpvPXRwFdhY9PHjez# z9u!S7xe6O=$UNNiW+>#?Xt@aD$)vTO&*f=Bahp=~f5M|!sgC8SXyiiY#kZDh4&#Hj z)T*gQbVyyi9S@62$;Qg%Dq9>@*hJ%4;38G53?O=2stJL-HB$OQ0WAMEEu482)f&lR zfMoaw6_M}J)HX$ONfR^SY+cYikl~m%MWs>sI!Y4!`V^gQtgTYzICgm;eH@9p+~m`g zzv+Q};vz=~jMii{pYvocwCa6aFCl23?F1HqT`k;ozh<7V=3jh>E?u0YIb+QXfD=32 z)dG5TU_N3Wtek@p@2x-~#>qz!_KBL_fG|Bq+!F*p;;~DGLp$))2o7Uz3AWNi7j85c zq~YsxQiAlSM|@7als_g!9`FRmGZOC9;y7V>h4vhi&%p77jqN` z3)W>0Z`zVWUra^%ePkgh}_&ZG5K8KhhQAz^E?HS=&^jKeqTEIL;RaxPS zKHJDyBYBYaigv>k<8CXV?C=2lWS5YP}r| zQ~;P70IzCE?G_+bd9k&Q)JiywXD+QiZn2SuR9 z>@9jtS3L(YF+DQx#sDXu>B8;K27EH$>G|%p;SDhB?L=c5ti2X(QY{1Wf*ae_`|aRj zP_pkE4(5=*69J}0S}1(xSPhg%lqA5E-lE}!e7k~F3;-uIP{-Qgvyl5tzS_aWVunIL zViNpZ{j_v)!z0_KNgRvONG%?ja!e?;U3+6Itj$7s2ZG02mtH0H#*P+?|AHyv|nE z_4F-Rb$%p3&^GY;8bgp?I+uZh^nfVjBT&$lH^jvpmas?yF+U>L0w{DU9sv+ht51J% zNWO>xX($hcqFCrt;ZzyUk<{aF=V)ms6{oP;JqNN;(m)=1@ZD&Mrs>4>xGn-#;WYh$ zn5d*<713WqdMDQ^-}sI;@RYwRW0+>+yuywTqohx6^?hA?iOXy<=kegAy_#96Nf6@Z zV3@ST(Y5uMiONgXB({W@bPr6=ivZKi(MZw8W$EQ6#PJh=do=aIJ>#H8nK~!&ROQ;S7Njanh|`Maz_B7?p?;^CusnPkqkUT z-`Np^f~9?}%X4K0%D8L*a4$Ypzc{Y(A@Vq91mhh~`EbyU#?e<}LQ*IugULz;R^#^f zH?->@M)Wn0?`cJ&&3<3g@gxjdOW>Z_f|`>&(Gvi~SUL~D{YnLX0Z<=kl#3?2gQ$QQ z9c=qN3M~bh;-(MDgX<)R^O14U6_Y(tCm$I=%}OuPjkc^JFdC6w*$y0Tc1XYZgO!8; z80$DBlZezY_2X}g=pcb7y{^~9$s|(6<4Dty7q%;i0H+sfb-k$~m~-#$S$ZOC3SVnR zjHxLT^G%)ni+x94r38g5PiJF;E8$*i>(ozGET@y7!x?c5(?pl| zTUfEX9HDn-2Gsa%Kq%w1UD%Nbthv*mH+<>B#PcfBmV}vtSo^bD6~hFrKgohreq;^; zbq!`W$lfS6FvNF{fJ2c|z~SpivgDk!bJ70KmzGEsYvTGW<@1Yuq;@(bq0O^i+~elp z&8xnTPg6c_&E~fi5pKDB5FA3S}^t79ZMo^lxkk33XsV2ruPvd`K&2~knkET zpprsOZVfDj9jl8;u!91-;$B#X`}^#M0X611v}cqFRuG$!u>rui0$2%{qR(!f14Yrn z-6bf=$=wAg#UQ(nB@8bb4-7e_Roajf(E=RJ6r3vg!HwuF)&Y%VC2)~&%!QtlDXV1H zR{TzF9Woff-(Mh8mH*U$dx&jGm3LJmn%^@Vos)OE+!B{V7Vpwq+>(~Gi@Af;p^V5> zP=#^`dO;$ksAvxP8rL@0;;P())0$GdO5@nY8=Gs_=Bg`7+>nB;d=&*N$uGK|*|5aC zJ8-nwW8T{KIOm9VH@44yAP2`E@*tWV9~SvTd^T`OI`;)DqKcZ}H{1Zy-2cFI%ZWq7 z?{B4{Nt&bj`Q_4{RXmwV=vq-`yeHO;BS#ruYO9jwHlt}&Mxa`|zfTu(_)IQpxO2#Q zdhl^-@G4LtAYKU3M@VZ`nJ-r2?>$C z?%0bj#%v2d#UH}f*QzNfJHNQXc-x|j5{rw5_bFmO5sSq8TkxmAC&GO2Ro12CBE5xz zR+Blx(R>7+4nDwF_oz2mQD_Re z>y)oN4|!7gm5^Ho{~sEl_8BYchq4wCaXSjx>SKaQB;nxR#gr==Z%i1B&@l6V7-5yZ zS0?#O5irBk}OTD zqhqK4Y+79&WKKX4RC&BaZX$nnrwj zO|W|60Zw>n#AIU!_9bmb{RLGD)-Y+x1yOPu5;&1Zw8W+Ae2!HXu{g8N--fnhlbvFn z!4F2YY6_MVP{~R9GO8chZ!K}JYRXGC%2Px)ytDF2@rR~8)iWS8{&s?;pT8!KIif7? z+;$6boY_W>(iJD-{EK(sFx4nsrB#7PM4dh4flB}AE}XD6%!$ne;q|FSZ0Z;u-LDNZ zs%5qxlhA|e1Ly#2cglDmGdNx9n=#1>ZxyOW6_marwp^6AIreUfC0y7y$-Ob?H2P>X z*{a%U_keCD5@|5U^QVBL!kg7x{|t^;G0$n${h=&gJF@=UON(<%-;%MA@zhCXh46}7 zyuESD`etLYSz%M#iYmc8sYr+epYn4sWOZoK$gS^>C z59lveTe=*ppm7H6n{*CKT<>16db2f~Dhtmt$B*mH}0aLZ>^*oLHl%7oI*ivxPx!E)H6D`8mV-j!Pwpg28Z7$&I6?-mhY641!M=iQOl-e(+k(s4v;cNY7Ik{Yo z;6r=u73~M~nvo0pKkxjjJph6KB`LD~kM^}p49sl*_rCT>Ya;fN4eo#Q#fk}^n*2l2 z0h!SMZpnI~n<&D2vn7c(jNQPCN;MpMwN@-d4Z{G9oHI#A91_ajd%YU>0-o~Y1mXq8 zSw#=LxxepW>;81N|Ge^j9^~2yC?FES-Ap(Ll)?l9HVf5;y-d{F8^n%`5pAKvo3$iK zOJ^aR^2Pmrk1mGD63_Bt>ew8B8{9IN1$-D%C2lD!JbDFPQ~kl=TrCs0l;KHg zOZvFyl()9|AVYs0j;vmUwwUagJLarOMDne2#nTw@6K699812)uL}%szY@~N-R*Y~} zhquK)W|_w2&>ymlfLB>oDzU8(L1CF&0dNFb1F?XMoejzi>d&bTp3@8z?l(wplAaMN zpxX^G1n|Q9*0Owb5t1f{5tIubf!;N3D>oRCZ5Qh~VjFQ}a$tvR=yEsCi*Fkv zXYx%Ze^+Td7Hv2_kH7|BEQBJok%L&DZ9cpZS;-nCVYnB~RFsn%;e2Qm5q^%}VQrH% z=W5g&bv)c|=#?gOt5S>XYf48bhRKU+Ql4moXpY4}?>MfVe#mRO8}fXJnzn9B(uU!2 znfQwj?goBHPU#B%T&k;g@b!3+~}$tY{&IyOU3#H%u? z1YtfERt9>7R?d`hf@thS^d7)@tRE80)Nq{MW4kU&U|))E)!|H9^VBVhYPKbDB5)3| zE@5-DJW*FufOB=z%1WElH7ez`p;&Y24CEeiPYPH2Wt^_&By@V&!L+IvwXc0BCMGfK z@CG=xOyGkrw^U-2=&*T~a1g{?`jmz~RBqx+Std313C9hwIu2vz~m zWHWxwE-Qk|rhJfqPlPxSAAdpFV3wjzRP53R*GAXz5)Cu+piNSWAe5NnsuMY;d$P@| zsq8sdvilX2eBuUZ5&kO{${UtkSB1d(W}kR)wJY9n%!X^% zvs#ST#;cQTZl&wY(tD7Uu9oK5l@ARh%Q@}HXW(R&8?QUrI*-jjW@QC=o(^h6Q8*>2 z4-Ko^3LUM&F(tPzU9+(}<3X2D$5xy<`MlrU-iq$B8BFVhj{9HF+5T)>+-HOAgV%0p zy=Arrg`KmY2j#UUTTKm@U6`pPVmoics|aS}9psa4q;|qzSmr{sMZ|@}MRT9p80f3!`j6_v%)!hdR!79YksfbDdX6cDdQ=~Zy{0%w z75ybBf5^&(YgVO}SxY2C18(}&^@xbo31`erkejeZzM?m$(gTU2!w5IXlfAdovAg=I-~~-5Fa)N(5blHfI`XQs0Y!<#&s3zFKu{)4WwUosS(} zxM@6y2EN8MFUZ!>5{xT8x7Y!8p|V=)CQh?#2GJJ)%q=2bH=U57wUv$5l%U|MCT~9AZY!K1_?!}PV#pUusmThI5e+)cpI2CpUx~RUYFj>mee=DMR+92S>juRykjgr z@avfLX&|eo|2wF2oYf(~qy9@9G1OXcE&hOk_!yb#aH4wAmk)|4!k5 zK3l)f=FDFl)xR(MJzpUME?HU`|GS}Di1}IOUTHPpanE{S1sO4)cc-K^(Y!7+kxD6R ztlTb^0quF2u}wTs)W)^@^4xuo`s!=A+Ws++{by{R2)+{RN+@CEJ%fj&PANUHiQD09 zeB(Lgr{y}c<`ZWv79~0@kI5W$9l&vrS)B@;itba%H2gH4wg?2GlabpYeS~S50ZwaZ zORXEp$*g^@l?h5s8dQ7mb?^q_rBgwtp~=NO-=-E)6o?wYs3!voxOg99=#lYiSS^3` zvd{scX01Mt!+@HoAU{Ok+gf;;m}5V#>J=^JHJ^nb1bNo+Us!FC;ku|!?oi}K;TBsG zrJ07T6XnKx4oMK6kOR$_W*3(_#i4|4Y>Wr~=CeN1Y!eT*jq5##XI`VcK;$|4W<~^R`ccnA+4X^O_e9(gC zS+;tm@?o+R6UvGJ^lo(9(ezYT9E01T zmD3sSad(gH8i6)Jab*~2J?1L7_C}i9nlhF3h2+IBl4|;0J6Ph7DiFh51)=^*pb}Ri zEyVVEQT{^D@x>C$8HjlIz(G4fw(8h|(wE(C)9g+o`)roiz%549AKngN*dXWke`X#w zIwM?V8GWcJ5)^-xw#wSGJ#s%=NU&Z5hhv+EH;!%k8Gulnm+3PagRhnGz~gL1WjyB9 zAPP!0{YA}$S}o19MP%Q0(j66o=IZ~} zd(K6ZHUYUZMve;$U>=0hnis_{G6b_#%++vo1|HRBIiAQKB{2SRM#rBK8j-I5JCsMg zT)&3OB*;sp^=U8(`=x2!Oi89}J5skkKPm;UX?v$!L+en)hoA^yYJZD?#~6ukkT0Kp z!_$CPRxS|Z6v0yfg@+5Zn8J^#&bPE=+^0+td>7iU!DrjyYg&Jur}AZ@S(nO;i;_&G zBGi}js-u72Nn(Yk=^=~c6;>G`gqo;6w%D#n%&y3mahK-|Xbz6-wG$YVYn)O(RS&3h z`u#H@4<7VmgdKqVm+&v+Xo+P_J$UsR>-ug=7nkV?=~mL6zN}XcJ(p%rcIjiy*+!P~ zM)+mZ>Z1#vb)*vJhzH{s4|KW9U`y^M3Iq584d`f zu!&TvclPK<_C9>JER6$y@8AU~5Sy&_N|II!{&Zee6;qO6Zm+JIO}kRql5-OKExR`N z@EK)ad-Txnu8Ou^)T(ZI`*QWYMYGXC_7X@P3WK>hUeyju`6rFP<-67fLA}ByKhG_t zt^P{H{`b8+L7Hb}GF)A-14-*>q8ekH|PRQJ{3422kE@rj=5BVpHI2Yux>J z6*3rey}mjP>gE41r9C>?3lVQv_Le(>b7L7-$}(>}oHw}ba*YA^ z)KUkBc`z{kUr3hUa2o;x++&Mr5pmia>Q&ro*@qt%1-s6*C}*7lkU|)4@hZbTMSrZ&hN( z3ZkC!k4WltDjn6_Dp01=jJPK6JH3#-G8~ZdK~~itR)~Fly=o95xyu7+JhW-Yl;v-m6>Bb$szgj01ayl~rDQ zg|e6-Uu1<-9saIY<+3{0XG#UZmb^W?ZSh1le6El~AzDTd!ECoO?66jddz2SERoxlJ zlYJ?F;z5%vK3&X-Mr@Ir{=*GI;&}CPCuI|$9?z-(X~CFx&h6g8>)JipgJ}Hn<17W! zps5rdc?+PVN$KCk1E@B*bQPCzN)xa@4GSgDNcT-;h&P%weZb*;g2wXD_$%c!NB`~S+nw?AClYd_l!fi*0*LPUQM4Zl z(iV=;w-^ ze)i!?7Uz9s>_i?XElOW>d?AJUw`LV*cKIChIdT4OjetURq=)A9K)4uJz!~rvZ!vB9 zx49!H@*+?-&ZRgo`Rp+TbEcKlTF*hcJ%zGLL!9p@5I0hHZr~x`y2wF4v@9JDLloU? za=PoTSDmpNQ&QYW*K~8pe&Tun8l6eneBmo^*|Ev5?O#xr2QC<{OnZl*^>=l0dRLiF zqcKjV*VB5*nqcffLeOTL`e0y=4Yd$4y7;U(?y6c;Mc7l#W4>!~i<#?aU{v>eL-$~0 zNFJWlWO6;Uh}O8H!1eKyig}!X`g2r6d-(-&gqpJ8n!cLu#*lMtgP}l-sBQTd@(exd zAYE%8_fIJQHG#M9OPFY_iKM5SsQpG8;7V2Xq(~Gh-V)x|^yd^9Yj)wq$r|dybzj#2 z9pu{O93(mIj1FAJUbZ;5h1Pk8VmIIi`47;polICKq4mgWwx(wi7$=K%&t1Bf#fj6F zCw6YZl)7K;nQ#43vR%!ItMegpON{)+y(ISU870w)haQ5t*FDWGc=ir2$G-=@JA>pH zQ3dfBQGef!n5+XjU6a=v)(y;&1G0umqmP=R^Nnk@p?~csA>lQLEsqincldqDA2U54@ByZV`Tu2R z=lGw^?EjxXz8Y&R_OkUVr}h@UiP#E#woKUH#DA0QOgmn<&E_PLb5iI2BcH?G z*P8%-oXrScoIg2<*}sWNP8{XUU0}@E4HkRT)4FhcOw$L zm*3b^r5%eHVck+sf7QwHf&Zlge!qU?p+?S7qR>fC^AL2Rm!nGUwe3Dhy+B%A>+{P! zCExVG7eZ~r{7`#27547*z^<>)c?|XZaDO_#K7lvIh{Ob{)SwZ`&()IPc4p0A7$mznWbRP5_DSlnJ4qa~2ivXi&SIPT*P$Qr zQYFGkmGpV~kLM(hTG&mME>vjw(#z09k>)I@Y#(_K^ujxMrpYAd)b~fov_od|v{Vtb z_LuJ1b-T>6ndD&{_g(^MB=Ur=C}a&p%__C2OpM0S)QQR|4yZp4lTj}-rLKbsRKOYk z%og>CRByJyF%sWuX{&(zAyo{uV!|ZiP3Zee7g(1|*80If1kE?dS{ug>J(oL>HOah& zaiF2u!kL#heXj0NBNKoY|CC@Ec?b6gaA5Nd;=v#;y-G!_heJsdQUX?ZB;(}fl6c;9 zO)~9_#%+2}Ne7g4XCh7QqFTLqp8It({*e2vG>!jy!n4JvRyx8mi!AIoTx_wfhq$(Q zKNg(mT3CKyXIv3`>no;RBy zdi*0%u*?imH*@-wh2u3#O#{Tn}_GqrONGKy>RPPKJ zR>2S%!l8!XeBJy^9_p~G&SBr{WtZxuZ=_56RecuMll{rkKcmx-6IG!FPb#LeXh53O zTSfxOrNzLMpkPHB}_ja00GD-xARg@9ye%PT9$fWrn?W+mZPDa@K-3U{87 zi%=0{^tod@B2as;*tL_CMLIe|H)Y%&^vO=O|q!o6;h7xIs1*1B91te<#xA|>!lTo-C7RlpB<~Si_2i7H7#OQrn42XP7OT z

8=4UVV~tSC(-HaZ8DF1(vT^xY^gycXgL1s|Uvn{h!^+nO`D4y8w>9zvEd!6=%S ztm!0c#z!tEg;BhSy?^etU@8y}#GDn*0VFE4Oy`JU+xC4Y{qhi}u^%vpp=-^9So&O8 z7eB#6x2W!0d@^}Q1Vb&RE5#!}q^X`XiI+}d`Io∋tDel7Fi|acw5X`jHN;6pWwi zBFygnAsx9-mdyvtf^M%>1bd}uAsmH+YcJv zsZn!tWx-8PYr)y%*~Yr@y`*6wv{;Q~q?yjOqGXKh4n^yKG4>8Yq6BP{ZreC*+qO^J zwr$(CZQHhO+qP|Y-!pULMtl?V$Bl1OyV}&IGV;yLXT^JutDMzt_{58<#VW$C1EJx9MzUhz<34Nk z1Spgdmd3u?hj@uOcS+Bv0L#i^bIV7tP<+7j2-{BWY#p>bwFDPqKjg4! z$Pl#;!Z0fUooGE!x6Pb_(XS3NbcT`#SA=_PrmW^;mhGEDxWTI#rN~@@lNIPLVWUXB zr_&1g3X(@cV0^)9g1)zb-!O5?t#E^<)w0-1y>m*K_1cFDbEl|Xv3w^r0w;0 zK#+iF>)yt-l8=qbh6W-e-?MB&0NC7 z1-{}U;FdE17dI5RYtYurSGmB+0!b>Op;TwZG z8dfT3ImFkEJFECZ6vg;~BorqvsjGDvlUF>Ba1WUc%lSP5eg1iEJWSS<+TvH?gJ+ z1t&}6rqKjtF>2{Erb-#DB_W+NZ&C%+^E>wDn?#iNk(EF^)b@ipe{Yoi-EM`SogM45 zk|R%*YF_=LN0G^GH=7>IPd^{FtXRsku|9j4o&zL5UxY^yB}ChrOpGliXFk9&tI`6a zRhA38yda#>@ZR<=g5UZ|U1bjf&trlUz1SoToySlZi~~;{ zQe<@klDz(idrMCqzu&?algCy7vyq7&tfrZ?`!I;Jj$^S(9Xe7T$6g8=#kvcV_t@{D z?;@$^-&nYh7*mozE5)N|K3-J0Wc+eH(Qay8D%2}k(mBAsPPK+J=Muehm+y^K-YsWO z7&+ECo;eW*nru;(pA?IjXq_aBc&%oVeiO0->LCqy- zK0q`;Z!%u)jBs_gB4pJ;t@&oa$<1Qn71PjQc5nW*6A`QZh6&bk&2A(pWkK`BaxQ9i2vXdJ@0GX^!5JZ4t zNDCYkD46n86x~IhU%CUZu%4y6)O*j(=7;azV}$roraxrj8)dWOLNI3{VbSlWOm-jdgnxRD^~u z zSk&#(1t_R{0OaK=8AWyB zJ}2U>WGAdl!R>?Ov>9j5)P9sP=V!wsr0`_tl%iR<}=BudpiB9JRF4&pn;!W zT4Q4AajD#y7DB0$hK z&lh(njV_>mMfcW%}AStiJ1@Pm_cK;TjtuREojE~6rycbfHBE#|aQ z_M)=?U~cVfF|FQZXwq<1H3P&GxMOBvZ&ZT$GDBA)hm@WuLKn2AV^~60@YNDaB z3`pweSd!H*DW6CAO5mxZ%gW@;nO2fN0ay&tQ`(A^X${)=GAX?k;|>sE>C8Y3MP`G2 zD89ODREiBmpSp_Xh-=rw%0&exJJOQ7|AyrtquHnVtcl+Cz6z2bn<%tB9%#W^0PFA^ zSGRcAe`ocrvmJZ>iyS${`|vKe*q$T-I@*&pA$_!3?p&I1^x)iCgTb7{+z!vyRUY9I z2idHLgYt&fjb-n&AzdDq%DrqICO7cqR@_8H9Koq{7FmP#{3i3XmQ#J;E3n-L!y@hM zH>*2GV?4B=TY(E) z@NRIs?NbRU*s6+QDFxNJgnKa<`DyO#kuIhHC@R6V_ z1JjUfQc`i4cSq9}x<#p=Jl5qfRIq7z%W6vPEk`H1NO@q*5MPrfbj3Bkl@DF|AHnsL zOUReCyIz!Ur>Gjd!}v+u){A`GA2R5n)OveH_)qv?{uFKNB?YhbD}t{2qmnZ%o;GFJ zqRxS#=$a+a-QpD3;tf%zYc?bs)8}hS=%5kQz7b4dQP1U75UBKJ)q^&Ue7S>%JgaEsl#Zd z*%=;q5~6g%F%;&%nnaU6Pz^)PvmG+-UNaI){;x49Q>YHMQ7y^LScFNpk&V<=Elsq@ z!pnvd+7>4t3V0EcrW%>HIFpFxOAR$x_D>iZIo+eF7x{937r|D$P~YFkNXTNR5Gh=4 zZ;t0@@KUN~dc9up8ZUIM{s&FN@L%yh85x)v{!`QZe|fxF)i-d7LU0mwzCu*M1b{}# zh0cCzE#()hgyHVYFCX%VB$Cy_N^S0S7)+Z<4>@Fbad9KqT`(rIFDAhzK^XC9bM{|< z6yC$f-O5+^+d*F6hroHtbEA+~V|Mh~teC+12@tL>-JkE0ZDySQJx|DuX}hO(vlx*> zPu%i}lLw&o$$P!*X_|INPEwn++2XX%-23!cupKk2v1KIHTw^y%8IIH~&2yPS8RNBs2YN5hgKV|>FN_X%?MVmqLxr74n#(LQpVFAn->zRvfY5_T zxZufzN72NciY3ZYlZ<V0P1M!o&3yZblqe%GNVEMtYp100j?B4@bqY~wd54DF~W@g45SPWR3mL@0%|UO^2_)$()r_lb?avf_hF?C z`$Gmu{n0FQB>8sQ<96ydowi{k4+<30Q?W-YmYksscdd%LnP^BhuWHnD)yN^RtPwoG z&ch>+W|8BDi4J^rouM)@k70iyAJxh#E2XQoIsP|Ox_dWRtBqW(!4VQ8>4nOHq=)kK zxz`(kCSzkgxPu%OZ-fN*p5?-s1AUwJVik35XXz=~N;__R7@-ypl#9p9+3nNUE2F3f zTopRtK?00mRB9j65{*UA3{R0LWEd4NVoENFz#5Z#Mw342Qp%prJzo$nomz1nj4U-a z#l!%}?c&Yohd+@vc2fBm3)jBFq6m{pPAOl|1;0g3C=)G6H4Ne$rW)rG%OmlX$WpJl zXSP)4DS<2#F<|0=pgQ0)a7$y!5AL&>PJTT3PyUCfwd8(~Nf z?k_^jnCQUmRQLe`=o6``$*ryJ$XXC`(p4 z*Pt@wN>Lz%2VXP^Q*1irCUzXeAaqL_sx0FMIuv^IH;Yy?PlOH!#3Va$)sDuiMSv~e zRu8?NzsuC9(zj}HePgeJ8dY<*Bwe>Q4Op_`U#^=2Z(H!x`9Brls6`(cu&_HB%+w>E zwllfQn^9|05fs4kKkUEvu=5O6uC8 zc&2OTU#GFutON3GZ9;aVaWegdF}?jwSW)$PHUAcAVr%C4yXN5jnQ>y8gqsCq>v9tb zzcRPzEw4_rvVj&u!3wbBH#*8#SP0csQpSa$y?=)B%@sqDd^$^2>AFg-t746lee3On zTF=UJ%h;6}Qi0{}$HKyy(AibMIKv+7+WJj-=)@;=DdI8B+!<|5nmXT{;Q(JZveME3 zn;PG4m2ylX?P=rPiCmEIQza0jwIdN@{}-a?yCj?C(^d}b7G(&Hl?xnFwCWRF`|^P{ zlxxJ2o@aQS2R-;n2fdTU7ohMT?OjcVWhNyOUXU1giwIA)>jzO1OK9|jFv!^ zRh?*Leck4c)UD>-3?z^$ouh7mTm6xk5abVyh)(Kf12Q+MbV=_K78d{)%=gF2Xn3ys zGf1DOec6xZC0BzW@Yas+ML-3p!5lI|Vi(sww9-M0sLBZUV|N=v7}3N8tL1P#p!1kY zzQUJcz;G^8=u!y~9f0Sg&P)81kSN@&Xg}eBAWS#_liF^C?OYK=MtrMv1Hp~t8neer z^LixW7&h~U?Lc#sCO{$z(xs!&X!71oJ-W#ddSzO^rO z7(t|k_<34n_TITe-Js`$2F=t5lgd!aYB_Dji6k7#l88Ruxm!dFSzHtu^5Q!$bxd*v z6>*yUel!4gEf3OJ@0U$+Vm&1Ze3~VBXr~Hv~mu~t=Mv@C||xZ z%pV{V9Gf}F#TVyFhJ16(W9C;ayJT>SV(Y0tR`d~{YG`!5MC6Fb&+QUeI_vOvak6cS zu8Y~YBl9oilTKWY<_a-uZ?ul(xszHA^cQ1ekSc2?BUCR`Hw7)8OnLq0T`*2%lFMjD ze84*i-SMD4A5a(%Bpk%;VEbU&k5nEzj_y(N{pc?bEFFl1H|vaUA9;p3B~vE+IQ3Zz%Ly)^ z9okNmG3U*^mT^i>AwbvI zF(+leO;+MMziBsrs#V&CPF|gwFYaY8j=m>(e}GWr)sO!tjl%k0`7Z2?jQ^=osAzE70Ee_q@Go8!6kzuQ6?Bgo1OIQ#7c3icCL! z5|aV`9vv+oX=e#$+4T1J(b;|9+WmfxJ}u6=BpAdHPMjNN?i6J=-z6$FI$3vPW$KWXQFW9O_{0Vohv-z9E zAe&AOfVd9Ue#2cAL{)oQ6fjLkD);JB(XPFRPRm|{bg8jjE5>V7L_u!NrfMrWQ8d;L zTd-4&YR4#C=&#S0BO~V8DGPlnyD1%G4_Xb1)Uk8$Wyq`WN%QZU8#!6eFV8e57}vM@ z(UB=&uWx3QV(eE|#MQ)et!_uIFY%f~%Zkz-*o_C=0+Sowq*!l15epCm zn4g7-2(bxqdt4t|ym_qt3$4_`^n^$bu2^;2wSSG+0X=n$Og17rAVgE19(t-9qH7hV z)WPVf2$wU8W@R=(nH542m*z@}GglsdA^3##GDsbPyfp*`FwX46NjyWQb-KI?&_X3y zve6~c4NXzLFcLzx8uA5n{4D;R%z?^OMJjvrm6An_jLWa-*=K*(Xl6nql!M2kNz6RG zJ3VD{?vGmOHHWf;zDt#)0D4f{DwNQNJQ4WC~l;{3Z1WCBIYj zSLE&4JRlzTmp{CHc%A<;i~KgyarZnYjh7#V*{M(sP#Xo|;vEY$JY3U;oqy z@Bz$iux-%LXzeOrry^O-0aps7sxQttmN(0?BAOt1Pp34K2TRISQLq#(xvZPU(lhiX zT;~6<-&B}l0N5Jy!9^HRv~I3K7lTlAY)jyvP2~c1vSmIVIF~zbS5J>|tlv)Xk`n1^ z<|pY{D^Z<*p1<#)SccoBQIwbXeF&rw|7hqj>aa|P;=_L^=%8bJH5Bz>9yl7{Z*~lh zD4Y+4xSehU{E?BYz3Y0r8guF*Y@_;`fwnn*t%Eq&wytsbOmG=Yn>~JjV=~Ezsh}B` zgiR$o+|)Lak*onV=EGxmKq;$c(9ud5M0ts(iU)tw#z_FV1Q<|Lutu2qgeeN1)Jz^b z(2s8~f!u3gkCrQ9T+*CFu;kxZGZlJ~4uBDZ!RQ?ZTi#5ykV~_^@|>Yn{HO+gTs$IV za_aC8l)fzRi*~Mb9)?OG^))9di<)^O2G_1)dRBw`wD%q4zRDP586Tjs=@KKPFXxEV z5MQ`!i|1^c*U5IBL~o=b$~V1$8Ga4KAWmbDMMbj_H9Bwh2D>BS96CBo5Sb|PeGa~= zpqr@FzPDoRVapLHa$N#-Q|5*`cW4xf+)~-#L#-hKOy0ph&+|$El;qWL?zk!>`}ofd5#&iZ=xYSL_<%;B#O;4Ut=c5LZeFBPIq z3oSQQ#>jA%GJ|McEV2Ehmk(%+C0K>*QV$$XO&2!zW^$2c^*z$!=DtXLuy30QzXzsg zd5C36y4w>ZfJ>;@_ruAtG?uF#47+Yusdth0nqS1k8m4Z`e9stZp@PSxx{jS!GoNm2 z73Z?M14)G-vWd$#fygRG@x?qBn`PA(89}XW#(v#XagetQ7s#kSBDjE=VqG8e{)aX0 z2?Z21cGl5SzLOG+9>AF^y$JRw0eym9^nJZUZj^jiJ|Cc(8M}i6MQ}e2MC{zze9iD! zYa2~ARbDXX!xli7sLRscIp1Q$N?D&Q>2ueioyClmw`kGHq0g})A$zJd_7X*C?x5QLwKM`#xKMcx+tFHvQ@V*;G+|+LajUAQbyyq@SXsw-&9a&M-r2U8% z1o*VVC|55y2i_INO_fufT`uT+G?GWxYE9G+f$>h=#u=ml(5LwqJgFWe8;g4xETCr% z2JkH>qFdBPi`3RCN>%%Iql900z4e}N#{umGbss3f2Ga*PUD8A4&88hFy}XSTda8%N z#6DELRnr4_^~0IGEE8+3tLTT!5HN3~#$d9)Gegj$+))+`yKd407DzC}(ua!q&BU3E zVQY@9@|cjM1=$X@1#V6>>s)UHRlP>_@k%j8kUg7-6O=gHKw-#l2qw-DjM)9>sWErK zJvKt!55IYhs-c4_V=cE~TE(5G41+}*_gyn*ZiVhu8>JhCJSA(m+cpWdc+dTJb_uK> zRaJ~7S6Eak4aa|5Os+FF#Yu7R4Vo2!Re~}DKBH>Ts5*d4SAZE1Rde4~AC=%rvSZ{F zUZNvr)AFj-1`+loApG+WrswFC`>=v0e$&ZtSOiZ3`pU|9u?$%s4gBFf6)We}xHdV` zwip3a1PfPb`n9SlbET72Mp{6lW+L5tYdHmk(PfI)FZ(HH#bV*(FlmIERZ9Fg23n{w zQ`h~0K4xh~t)#Q`Ik_#$yL0tn-3^~xw8wC2b0q>yfp?u!0e#k$OXMKjw>%uI&xLQ# z-)*c5t;H$)$^BRp=eV2Qy27Q(NUrNjRL@wG>BWRq}h+hzLlLerMBCFciTNxY=wpd?TIvs4la$ zBN%BXIM|OY@U%ksElQi*2q$zlr^V5hPQ#i5837tqO1w!R%_~y>fu`cFW5z7FRkJvc z7Hb4m%nudc(?cJdRJWfr0@nPlCRhvL#!VaQ-U*DqhZj+(- zmSQc&&~!;1-r)*D^`s+dU$RsX;Mk`{EsJ-H;?Ji`@m%DuQrZ5jfwYh`nO0rBJ+iki z!^f||e~_f;bV%_|2>&ZRw{WwcY@V@^3L`)g?8Puzrg@6``3$V@=>ItO8V~p&c;pC)m{vk zu49$y^vk4o-bu@)*f?@}a_>Ceg?RWb*U+^lnHVV+nj1~fYX*r|@n4gs_xJsXI*d;3 z&%bD%uG5D~u?ofVB1|q8cP-}X&;6$$ck*d%X@AL?>~Dn!RA4}_FGssQwpY{FE3d3C z_xG27i+>qGv6#@Mv5EIZiOnRT-Ox>e8gqHnAtE=`oJOCm*lt+t(w)FS$fd!csRcQpHNj4>;Bh`c<75&{t<%?w!YRd4;kNdsw(om4^988%}Ear=dc; zS_p?E_J35)w9uj4)+l302*ydgGYPbp21vyU;~1 zCm4)Ytc)zN$WO%%8>kA^<&2j_85K+3Ra7jKAw&Ybl=`$+0I`It(|Clhs91m~u>lOX z8X4h+?ii|KjdQ$u(+8r{Cx!m)cG9jEa z?L8+d9zN&y@BB|qogTa-w+Y6 zO%W<)^oJzJ2(0v=IgI#pfxy$b$INeshb^V0@Xj=X;zBwvfr3f<+}*x33-V9VsEK!z z9WLmww;2kLx<(MO2>TsjMuxclReI#-T5O05ukIfQ$~EgX$?P^qN`}@fPxQ-EI$mer zpA;q=Zns;b3GbB|7>1N0u4R9oOP>VmOL_Qtvy(H*r58jx<+)9WWgxhQ5Fv_1iTH59 zX03`+8(}paeFv00p?gOC4&?;u#tAg?qz~6)c0XiK1~3-4&h#Ws*ij3%(KD z&<;X6;6TcY-?*+EyJpTc>{nKi(tZ%4siLT^YuhN-JS={gh8;x0J=g~Iu^W8ojx1}+ z=ThlIogbk^27L$Pk0XlcsdFP23P{3!xJxJFiRAt?Aaffk z_)A)1uNgCjI9ZEdO;6@L&nzdXTq@a6v<_u(d2vaKWf`m0oxHLFS}6J)P0xA}D+%PK zTKW!0Cc>$6YswF3631j4ajhFI2*yHcmK8+>J(kKVKypqub5PDL0;hdK#V8udV0dlg zCn9{fa@RHpJa=&Oo7!YT7!m2Z#2aZF|REiw!%Mf zCbtMZw>(v#1BT@`WWwJxSkkrtged2Xb=ICS4g8YBBctPtc-X3;sY)Tz5mOpUe_C4` zsVU_%U=i}Sk{syBo}2Bm)z5Y^5a_g3xd>fvT=pVNSH;I{LT-!M(9R-CDt*jiqNVpu z1WYrmP`ONcCR!td-z~~{tGe_RSgj=#&3g=oDEs|UJ;%Xc={3>!G-9$di4+2>h+VQU zJ`-gIV&|IU&uS=b@svQV&~+SNd7kxqEVB-(P-Rj!BI&pVbM_uH-}5&bw3u(8vu3_) zA-e9~+HWZu)|J=$P2?>THbi|)N)tO&96Vo_7*SU78YDSTd2!qOf5ZvA6NR0f9g{N8 z;jp4u6gS0a;5=7a!$og5gEohyc|y!w#qx>8ni-UXfs$aI2Ot!V^nsis-2-9kCaeA$ zE{7s)RHQ03N!#EZI-RdxkrsT!Y;gZ|NM#=Vx96c^U(*TG*?flT9xv)&;1SAJJDnvp z7IjAJKJs-qXShT<{1sq<%kf@<$#Y<+D>tAQZh?m&E;4O>03JcLW8rwI^tq|lR)H~Z zRKI%tVq+SF>Ev48$i72wg%so=%@+z_B&~pfKC$)hJ5ra8<=Im;>SayK8dG~A&&+PS z1aKgQ-?_%t$gnQrTDgx9EgL2fCOC~x2mc7b)FO=TTo)yjI?q?^6SZ&=y%2R-w2v=^ zlGW7Mxiz=7CPF5nu^m`AV#(|wVjX#Cj7xIJr%m9`H-4{sljs7j0-ajbIphE_wnMMF zJilyxgPoHMWyAgI1OY~JV`Kx`jW$4Nu5|WNsDE9k60N1R(JhVcaq;Tf2wYg%+57>@D-5<`xO6tq?hwHj7<+p0`;xdB*C3Ei)H}y4RZ@$?$4d^s9@NMf* zrOP*;lW5`tgnipSCv@8j%4tMYzYQJ$l<^8Q;~?oN;iWV#>dzH!#xu1fWV6&&o~S&$ zNkH3F`;i%7ZtDg7YDwMP??k8DIIi>a1nd=s?oHc+h|-&CbB)CiHk`P8UD!r#WIWIt zlV%tW6oZ&q;L#DI-5<6R@tO9(0e2rtYF^zi$tp*t_+a>Ld=mD>mgnmis1DNh4Z`&) zAH9k{-Ce@t>HvEy?I~${8J=ORiWPH6J&!r%Gzrz0{I0#E%=rMACV6Z z4nuoaZ-Uh>Ds1&jwV89H-iINjp=H^fjt3`R%0b$ zz+*j_4bY4H(u!wky( zU}R!o`%fFVTVuTDstxx4osJ310M&9sz&FS5l)0fD8#pG&d@Arv+=VBRPqeg4zH~n9 zpY5ScED*zmO9<5kM`!;D?2qWjoXx^J(Y4zn>-uqY{GELLS0_0KWPjWmyz7QVo0D?j z^3&5By6gVBjGQ#bMA`FZ(yFmo+D8!CbJNwvM%;H-+)utIEQ06_O8q`N4|SG_-T%g@ zbq0AxF_%WqF>{+a@<%Yzh)o?a<+oZcD}WJdO5#|(BkopS<@LGv`J%Z4D`~b!*X3gbZ_&>c z{eZ;noEL^NX{PcCf_nV79sf=I9i42~U z0j-o0=N6png&w(Z+RK3-&G#DNkw_U38fmFizBa}I>L_7UY}eD(v8OrPH#fjA#7tEZ z|5<~k3I_~QttV!o3b(~H?3^I34nlaKN)u4&zQ3W~^*MhqcXc7)M;|oR!IUUS&L1S!i?Idma^CB%N883Le zPUv6OL`b9}FnfysZDCCF-D62;X zf)jq*sThS1l1+SxjA{2X;gz(_KCt30_me(kO$#%Ynp=t{$qFizd`=oJSGy zS`DFBrPYEad6J(Fy1C;Y$IhLPuIQ1#NvS(FLAWPvoi(>OBA)gm&zce(=@n?q_2l&Q zoe#zTeAHuAR?cr_iFRzhGaO+!1ESXM_ygj9m3ml?wa8dKek9&dP-zDs)NsZ=!rC~u zCVM9k?ZT6h$IkA|pSPhugAvS0j*m!j7+W=PVQFL4nnw*vyr~^QH6mwZ&re%l+Gn#x zrPmvF3p5`a&%^UHn2je|3a--j3xb)RHkdKkXSX5b@+v9*MEw%er2)}CKzeH!`YYR4LTQ7!{~_B zhRq%Qb1Hxwb5($66?7Pjrvfu0ii^b%V9O2YoM~v{#eUjCMHw-}hb%k%z+!UN=694X z-jqJHR|6)G)D`2bD4mpBKs&?INT)d})ML*)jOFvy3$J7(UE>=Zw-4zv0_s@#@|Cdc z3kL8%ICz&)PIAjY=|0je4&}qXJ@;9uDEc)NdvgpHYQkj&aFiyFyq+E;l^+_1;+=w7 zQ=^44D`>p$HWLa-ycGTx;}=-T_-=>TZ)&_OcBeXRE?1?GdgdS=E`w@HT||bD#@oE< zN2b1g4n7eC*ObZj6WRKa21)4qWHCt~pmGkwig6II4qA|Xokv8Gaf}4-vxhf7ZU}j+ z`E0}6HqD*%<-s~@n^7;Ho|msO^y|GA=hs>CM~s`(o|@;9*N|) zCZ4}6zCMfYP)(NIfLpkJQOhMeeGz#P;r&Uz@ogQgZ{GIpgxAb*wuZmB;oIsruMB8) zZAM6pf?l^iTAZ8YdY5po!hR|bATTGpCSxhZ{`nyYwNopESjBPZyC(pbz;q2K+f3=% z4&MMa%I3kHkHLV=)-X47)$+>-y!jpT(D`v^>qp>MdeIX&rTExv)pE31Q@sjb`ezFZ75LI z*%HHX?q8j&R&?m5hj8SsJWgqk`;+FYtjF6=0g75@mY;rn@K=r5jT9E!k7R35;1X!o zuNcA;k-EFe7ecLJjI6&Q@r|ht`8gXjQY9<@702&*Wkr^H!Tt-UuOV|!unv8)YZ=dP z7=TFu$DibN{eY;>NPjkEw80f zWPM2bS}0AahnT8;`X9o>GKd7KE-kCzK{Ollt%Xv%Npu;_jKE;A{kb8g?&YrWPd5J@ zjYBfW_dR{ujt%R*qD7c(@4kNs)1t|sJyjO<>^jxsP>2~95|G{0ljqy;_>c6=wj*B1$3?st=rr9B^PExyehX_VNzo4y~1csv?^yi*dnC!orMjEC3j z9+$PhzY2`a{1Yh19E#o`@ox7G3hmQ(s>^nJ%LDKGoyqH`qHfCWB@;^IX6*dePyWx; zzT?|yXv^v2IABj{-u0PGj?VxjbI<6IaEOm=Ohs1A2~5K@+)k(Qsc0P~zm}7(avD|u5`n!&4 zWWWl8Vf@6A{HRxy63!@I;aIn7?KzDl+q;?kAJe{pj`aUOInx2PS*-SlpUuAEz4TB{Tp#g5Nj~GH6hQE8@n+w zV3bBvPm>tL1!XfTi?c3L5o&YVP(^VNSy6m!UeqiKtICp(xm4@paDK8#i7FCnBekR7 zjc>|XN8GUoa~@2_1_A(AB;Y6@D8#5plRWZ|TUtvvlc;gsH`q%lHy=^IBXrh06}$=4 zOa*amUzNb$!$k2RWxo*Z+LjJ4fRq|D`SLF{@EdU)&y#wZx?ojf&If$B>P%itR#$7Q zO1USc+xS(-dPzFy!PXB?1ArLcw_OFP2(sWIyG z6XKIu=#-z0(kJc+&WoRR3Xe$_1~dfU|%MH>Z^~NpR=T(;a;CKufg1 zCpjh84(=#lGO4SEyOo2VS&@9c+wI7QXYug2?x_-okvqczLp14~{DCj#KebnizxgHZ zO)Hd!{?Tw&ZI+ZxRXsOB(K8dEozniB;YNXv+Rk64kKd#-t9yVu1Si`wt8IP}alINV zp{`k0!0n6UHS`<7IUOzzZL7Vtb6@AXx$m!P<_;i5*qSCNnP+1@-1kRJndG^KL8t`bI94h5kk;wY zQpa&d4XSd$1ViIoJYh}58k=5mQ~I6o4Vb=0jXWj2&GnXfL#I}t%HA@u=l-)8L$`Mw zZz=VvZNqD=0W9pBY1goUKQxB6OX2msw6cMX^yk5Kl7`)u?f%bX`IYHexG}q!shzMc z8kfpJT~SlZ1)ujyBA`JN9Gqda;)KIO(#A@(Ic2xXkxaIz!rw4~S)$3e11RG0$q5cyh`e+fb9?W*%@QrWg8`#bG_H&OJ5 zy{*^0Qf+{89OW&eNHd{TcD} zw~w{nw4FYy`5sl(v1}3)stLt<{3wa1pnuR@bA1vnh0VK-5s{HIyN@uNy|mwC=kqT* zZKcE^LOx4)m84jJ9V=HUmq7-T)jLA!GUM|A8%Tcp93;Xk=6Fv=#Adu46*1}7K+zJU zK!nQWOXa8T*WsD{{Um{scvpiq<(Y#@|69j-JEFTIn1BKq%d34#An4V^6F`6@0UdoL ztraLNX~oe2>{%xl3n$2<&9wyhq4%fZQ05j89j?$dG?r1UU7-4)^{KRDH+5kniT$`~ zDe>{iKj^F*KE-}8YjH+n0g?K<#l^d9WZD@_`egfL^+IYY>j2OoZUQz%fo5D#QF@m) z0?tJ>q`7ngaaN39reo>gg_TF@z&#bz>6{qk8QVbGz{7K|fIevT?(AMecxTY*E zD~7@KdpW^PWBSIkOy)ft*TlKXUL$)c4Up}=ndq#>-syd8GX{Zq?er6|a;81cK4W9d zshnKc<2udvl;Q*)jk`DRkD7N4yo&i}@N9GAu6G8pwZaW24GiyNlt%~AF~TVb3xFrp ze(+YSn0s6D!>~6}e{j$O=e7>7}~6C-HaX$pYH5*7uTK>y*}j z*sxx};eSo-x0Boju6-l%o?D-MDiHn3U6-&^H~+gER^63gcA#xT&(E=%wOZGYa?{Wi zqDXB^HFsj{nRiVs(UU@Sk3Enp`2L(T7Y~X|+$krM*d%#++g47O8hi2G%F$fk2Jgy? zRNr;L{Gd!ycsc|=M$f{;FB&M%S)H1`@DnL@;D}j1d}<{lqMX}^_(Og-3ceZPkA%); zcrgvHG1`kPzIq<8cXhFt*aJuvzVx#Lh?EmG z;k9g{k5ao0ZmF>btB&OQ+=J&eW!^DtEjTg1?YMW1E|%FLk!5y;wA%Te(fz1_!Bp7Xnce|0n2k|Df1?z3df4U8M7+3LL#u}oirn)` zbX5#yAbSG_%-4bj4{~h1&OO!^HVLVdi;?0UKv4YKWTL{x-g)1y`lK!2AOL+gnY}pd zK`pV}t6Nlj+vp>Y-nsXlcUx$p$AI7$@I2%je-j_sn|xdrk)ANKFD6L}*xg5&NIwD& zwQ-mihzbL7045R`0vj23M8c4i3o?q_z1pzZI~BDtaSBhcd{ovS%Z#E!;Aisq8NftR z>vw5v5;-sAx`1(uP(b!U&8@(81&|$n^E;6rZd7IQYXDSKZEb7S=>Gof&eqkqwly0qNC%sbF)G>Y?pG=)&uHfY9h5Ktt~U@FH3svFSKB zLtzTV^-+LUg;~yDpeK&Fao~1w|Ktq*Fce|fCqQg~-yLNhc6qMR|yacpWjd!A3Km6Oe6p#^d2_~NjaE^ioBzDzOYi0 zmM(o!#E!|&5IH6zxd~tgw!X<7hG?F7!w_&<#gV@+z_C(U_hU)U0m+Q9PWf;T}%`hqpl@c)OgckI$E+PW0LBk^Gj!fGI6RN+vO=@YvpXAF_uPxe~X07WO+5$&3+QK}=Tk zQ~(ecLxt3d5kP<+@DuB=t?kcWK(s(enFHLtvV6-oSyUb5EpkgLkiRGl-58yt&X`-M zA|i}e$q8c+>>UU}v@FLxqS=cU*TDmm1FYtU`4^y3&9H^2z(Pilb;}= zTt$=Aybt;CmUdG}B)^*+zQ(EoZ05Ll2Hq-m+Z{T)*A_>7`sR(s4536LRKS9sv}1TI zVT#&!hb;jM;MbMIdNW?TVW$P~ORSr_CpcOmZ+$BI z{QGHH)cs!ZDg9RA-PZkV}bY%6$F8m@TKSp z5*`I6^H^v~O!R!!eml;*8E<*|$oF>D%wC~SCD5nm*YmL|xaY2rZ^Knm_su_JSN0K% z^ZUyB*bg2P)rI>K)kTss$&kIMC#YEP&|TjzeRugZ`kOXGw!~nac{g_ceYbJ+RV*`P#ldIY zaVPKkWcOL$p$mKEp-xL@NASlTS_5Oywhrue1XB~z4;Qu#?8)X{u*N%FUZr2;ooQG2 zRb&jtc*!|wy*o49Y#Cv{vx^Qxy>xcBK~$f}gi0n|^;vikDH!r~D7>~xKxV8}s>~z@ zdzRJy`KS@UVh#7XG)f7b4mGj@2U^wb$#sv%S zLshoNqQmgBy}i1Fd+ClcUZ_YmEJUyKc0xjv&|;NYjlBWD?6~%A&6cZ9P_` z@W=7<`DqNkbvWEqgovd98C~JS=c2JYcL9edGkYh<1A+|=bbmJfPKv=@Sqz4HKyXr4 z`|-97AeaQL1>%?$5QgWZC+Q!`FC1bwHjd!}mYe2V)}xiPI&3Yn%sDK?Q7~^5-z{&ZQbG+|%3dbW`f9 zB}R(7!`7rY$XIAn$dtILB2S+Nh3k?z>sFO@3h!Zt7($~5CnsbgF~s+Mnk7xo(m|8n zom{qOY@%;f`L##~HKkTHAthkFm)<4t&xn5@sgKyF+#WRG0db)1l(F_uJVZsT=s~;t4bv7$T^=OgRcCWjJ8dZ|V=qjsicT?OW zCg&e3xp=Aq2s}ZhjK@}m3Xf)Uy{@ah1qo|Sqbr0ofM3im4w&_wALIVxyo9Qbys+E8 zTr*|~A!-S^5@ND@)T&Zo#E9kom==@jPhV6}%b5x5dV^d7>Tcsm?H&Z0!{IO`22pbj zEags?4!1;EO{~)md(L6d#xp&k-_q1tCVC=&GN#UC&{!0D^K%wqYIN_6Fc}0L8xSMU z*5I{Lu(&|b2t*Fyd!+j_ADOdKcdUq>iJkdcvgi(5kCaF3*WW&=Ds$NJK#SgJD(lDL zunPwjO~HF=-+ey|Zp=?)-M;ym$u07<+XlWPvUY0$Q@P6*>6>!Lw#xE5ezQxA4pq*w zL(1-4A5jp(cNLmCa0fm8K52CJ>pBfD_uDGB2kffqy2~KC6|5hAqmDu=v7<7s5&USNqq z$nA8fzUz%AuuNoz1V*asjxj9&8V2^4%t@Z5GV;7XGYR15(b3?eotOV)-Dg}Y4XAod zhzhQuPbml!lLr?A+0T}I>1?UAlp(&$Z&VX@8N$^CO)%LpxRkBM zh-9f()2ryYMN>Tvf*eLYHQ`3hwJJoAzwH|We!t1;#UjhTfEl&>d=zI+Z0A%HGdiRf zG`H1h(b4)hoYddA3^n*5Q$t1lWjryla-opbunbML9#+jrbD~Dt8zh10u-56Qbw9`a zhTF2K1P%6s*)=g5smc2nT407ZD)B7QpNQyCT6tIZJwx zB$ky~vw{SqW#G72m!ZPHo%*q!9&yJz$pfMkJMaki-0t%NnkMS;L0XiloD~Sagb7_q zxR2lU72*V})o}1pN9#aLcJJ%!)}ir(X6IlsbBIECDl<&4>(@=V-s^8dhul1$`*!xf zjPdi_lE~Z{#Y{tr_kgVqVh!j&M$NV^#KwkmcW4k)!{F&^ArP)L2=+qbMsSrIX5##R za-PlrJYnsWH%mLA-pGi5c7`qsHSl|dZ%dQ8n-3@CJp5z=$?H&C7Ci*!p>zA^gsL^6 zAmnGI!)8oB2@643X)CaiGzXnC-L*~2ERyR1r{J}}7rc-wNDwSufMq0{068CAlk zs=;d8U0imxut58opbXACdeJHb%Ll?2O})k&c&)FRrv7S4;D0>FF>y4pk@Ov`k%{Cd z@{-g|tY_0IG@EF}f>(P% zU*SRdh+iiT3mL^zyk5e`LlUdi_XTHyp4h{SqMUIe#GK_JsmZ}&l9OE3W{VP}$h(=( z%z^jt<}!VK>U_tzT##=t)B3)Vr4)V=>1A@(gNu|!Z#Sp=-*n6-9VR7X>gABH_-5|e739M2cvr2 zFU+$#mE|&*R`96r$IYlXbF3hG#fZQQP06FW{ks?jrV7$1E*LT~fX*qc0EY;@%}X3j zvCX)dVP5pR$dtd0=A_~H+^4Ox*K0igs;2U-QC|<~6B-+8k?Myh^P93l!wXAJH;qJF z_5!sjTTR)%;*h+(=CfR_bSZu9PZ|;>H$L8|M|M0o9Lh%)?L``VS1NXvq;_*Gd0bkF zn~p&sm8uB{m-jn4_iqJS^aoE}-CW)htG3GK=`4fUKCZ^pL^nq-PZ;6vm!0UJ-kba3?zsl4fpZ@LjN&#<3w;_WZ! zgmqQcc{+l_9egJ9!`4-c)bz;UjjrdUPAOa(@z`=fNHH7JV&PN^Y$`Ha3`VPmY};}k z9(8|JqS3rhU#SY3sefson;C+X4JFyA&ca(tf5yHN27K@TEO9 zKm_h(4>oT~lDh`pBXEpC(`M(3To$9`3D;%46lkpfmN`Z&Kj|iQT~`NZX8U1oY47(dpsS&6yc-ZUHYHV+LJiuPO)H zny;>8U1b-sg@L*%>Cu*)gWNJbz;HHnKF;8i1*985&0Yfkmi*V6s**Dl_Wt`ql$;A;DOFXA&uQmLmaHuNb_1Gd zHJ}(MWpq5fNv$Aw*mbhuo8qe!?w+WZf9=zc-`%JxSS}JaOvl|l6x`(x~d|7N+PVlF~ zShM7~5^R;sNu;>!^$%8h<}ChrW>kG$tW^qYYk0{U9Xy-q2@Dfa(5ZvBN|W9#7_@bT zRqgA3Kw)u3==6bMIhtxUD&N{cAyq8eZPP#DdA)Hi%!rgK+SL8&T0#ZYU!fBV4*?Gf zuC6^`&m1m%0tAX>@Dgr(1(*HjYyIU*7xr*XR?TCi-QBc#i!PWP7HRrGJ+K{+q5?=S z`r$9{TaBmQ&w37wJ-#n+V6!be?-@c7M zDJfe52+)P=A#)^l7TbNNyEpG3N=%ezH^oya^urIAkNw8tWMKy94B2|i0-;5hba6KE zJ`lv0mkU{)8tT7u)rGV5_nV%Kl9hy2Y;F%Q4sL3|Q=WU$)FL;B?Yv*mOUFcgG;ekb zS-fn^HiwDQKk4KQjlHKaV-T4PCPNS-*r8Q@y2IYobnY2xHyF-+8O_#o z?%3D6qxeLRJR{^&rFdPX<2_vrQ}2 z|L2=F2M6naQ{iXiWc}av3_4;i*buKC(B6TWars0I@`(hT0$kYF=p+m$lrlE=OU7=R&IC0D0wiO2M#G}!oS!0@N&Uy@YVPbmdrun-zcY+^raYIA!>;7J+fO^t|IwG4oi`kT()7ndl0g2(u zkw-oL{`6dsd;9D%oNsD>Ygrv*irLx0HiccNmg)Ji^R@5RQ!*^U?eQu1{XVcnS#NUlbB~c zvJ8P+59rOU58)L4M2LtPjv3I#!J|7S4h@h{naSf%qrlM3|BE_e=roKg(`_~T#I!qj zzeF=BE{qPj%?ucXOu8Ni&iQ%w#KI9LIFSqd8tXz;cL?XZMuubCk2}40*LaA5e-pgiD5Oh?0h{ zW3xwOe41BQkyD0(3|=_yXSz61^6wW2DYfRRK)>)sxC}FT&ecn#!obv|Av{|d zV!w{V>S&*&RIT^Q>?Q>&dw%mE)gqUIOkpyv*r)5yTtwU`cFZbxRgyIoVoEk> zUI+NtXdSpSD>g5T+C@;OTG!~C~!3H*%l6{oBoG5iDGX2hg zR$bOr)5uU=4KJJrZC6TxdB-l*1ePBv_2_rODv&*7Ou-+=RDnoSH*OC`WYWW}P`bWB zBeE4sieS&op;DN4W)5Pgxm_JTvPA}H>~23Q7*t41k>g@FDY!4tOE-x^W(7;K$f-Ap zg2~-+0g2G;wKXRm?`$Q3 z)BkFK&p>D2_dtUX#=SsQtUu3C5!(tI)b%jFU=YNTFOWbiGRIhyYcl%$Y$D>8 zx_~6DG9rH^@BzscTO9ssqA#;NmRRt;U-_ZW%$GVn{yZl(Aa^1{AQGFWXu2BaoUoOHpdLOP{kOy?a! zI-`HC#v?DCW8z`UoS0%7sN3RxPJe$*gxAnk$=Q$<919ulJBfAamQzFchYH9FWGQ+_>mV*_d~ZZ zKN#menw7*LYr@UbU97Y1Z3Q0ta#kO$Xbl}%Ou0}Z4y`{Q`7@8gv^<*sBwQ?y;CPBh zxC@vW-!C$v&Lh!%%5R9q}?$FdI4 zgCL@~ir~_Yi$ zIFGhut4}j57H_r84iC_%5#l140=pY;C$F`uyt^Bn))Tv3H9+>91VR9i7cy^n{alIL zILphwmMd9<5D>6B$M^CN`gaCbJA}C?|8Yw@h5E~&?_o@{IO#h$0`!z{^ExyxCA#|A zRyv;r6mhAkg89JUlp$Dx@a~O8GxbdCvc8%Kx7Y zjsHjP`yZI#I8u2SY2Kcwzoh>f>DiV6I-NRarb)cb@k>|{g{E6u`<5$nUr4QPJ%yq- z{`}V0oS^wBfeVP6u!N7y)+aaIr^HGv!pqH0$BpkTUK(FI=+?))Ztu%7ES>=ZaL3C= z&rVc!$sF)js=?(}bPjn!8p3tH%7=B3n=>V?03yX3UvM~xS* zD}Sd4Ko`6%UfJV!;d|!msZ)&b^!_$7HN)>=d)fssbu1d9Gx&fM*4!@Ts^8jOjWPj? z{Mt2631wu~^=%Bzh2Ui2*bpYJm2|B~owJt_rKmcCdrdY$v`y@;Z?0rD`w-S0o=Yj9 z)zV@~P>Y5^QfaCT!7=@P)HK+hI@u58^M`f?=V$h6B(jR*biAAD4TbfwC^#A&_i?&S z4Th^;**W)@&3Ee3OHlm?SibnXW5j9)q$r#l;Rg}h^_G)dR}K+uy!n$*3>3);(pFG= zLv>hThQHx zNv`3W(Hle!IJB_z`+{_t*7`6EHip*CfR#-AmO zm!+xw9Z3Q+l$}L^xn(t8$I{BVB`gQ;Hc`nuLE_FzfTD>Wl`thLK_2ra3RSA8e1nda zI53Iv;tK}WzskrSWr6lQtaXp3ahTAs3+u|Xy%rQzl1;idLCV&*4p)FWHrk)k6dkpZ zcQ#CrjX|NvSM2#U)|LH-m#i7MnuI;v>2x*P zM>nYI9AC3c<$b2Y-O=P9M?(7-TPs@OlL#Tw*=U~v zfjLz+r-I@ty5B=e+p3o@3RT5{-R#_{)%a8v%`$78gWFs^|Ek45wJi0g6z_H}%AwzZ z`=er~V|W!Dya82N;VB8&d0VR-j%)Gc4(jfL%!Bqk1 z750{`b_sUt?0j{7#A;-?m*5k+(6F;gd^^(Bsi$A}&=oPkq52qJ_g@Ty*^5{zCn)>g zg%?^Ezp5c>*h;bRvL7R;yOgAD&WenQN6(V)M=>kxyZf4FgZZ3}>Uc?IjE&Z$LtOkq zn5Cmg216SJd?Bt`%-O^WypsG<7DB4ZV_6;wF21h#1e5#VALwH#*n{TD>O8?TADGow z!AINr2!@*K8$c~x>Jkmsxg;5ZBfG-psfFE*nwLHs3+pVFx^a(Ui93MiZxEHTjr5of zu}Qk_c>h63%qw0{G^gGO&pOYd!+iRstLRhTcqb8_OM|qBF0d-nV@+@{1`jO3X;{wZd2BTHE-$ZF{a(J~2@0RbUwBRo zDX9xu0lDQ&?nZsqYf8a>W?Lq@;^5lmN5R# zihIKBkC`_>9KZ3!Y!?|tDxN~49A2L0-Bu{INh##yP=V}tR%}FT7}696bN6Vw>a~dF z=-`k*?k&}g67CaO>6pKN&oIy$pEuux2Cs`X2SwpSi6XGtg@HrVwKd$3>lbpQ7}tpk z&2#0(8#HO*=K!MIX}eWFRl{mumXEfL@!LavI;tTpMU5uTwr-bf5k7)tMNkrz-Gf|U z_P%dKT~#@s84r-ndi}EmzE4K#-e<+06cvu2jPEHP_h3z>j$}1iZ*8nW`ncOw4EEvZ zrKF8Y@a78^P$P9K^cNe8m6#NWrq11o6I6Odx}z`r&Q{se9H_zLt++(BB>ot6g@69- zt12YfQi^z*efiG@pIiKikMipYdNAaQ0qA-ix6z%;PnD$c+uIuki#QPBJw{{i zx&Q6j3ZI$vLsKk-oBqciPbl)tI_g}szRXy6=&p!M(47AD-3jsbGfrUGe^IrNVSStP z+kpe|^p+cX`C1v8`;m|5`fpV(wl-sN9SRBpk2mTO^yfQps=!P@Pm`^vAiT)z==lhN z%s>Xqa`(eruBQdPhCgvb*2Wi>i#cRzLS%Sn33ai+KMX}xpFJkm;Hb+*PA z{J)ooy672*rAgTZkdQPHLf4%WFC`1!=*Qe2G^7DTl0i=_n#Vc8hY-zk^&b8EI|S{2 z>)$s|7dy?1`Q(1v^&LNtu|L4o;{LY(XQtx(@1zrq%$&^s>%w1?=2*-D8)DZ9^&`lX z3K}3U|Nm2{1z}L8P8uF3?8u{G*fyIYTnPrr(vqmg)@~D%0`$2r{eS8n7CkUj!?(_0 z^j`;$awFeUW3NwkY{K%0L@xP;ui>iacezPIV%lRL^l$PI!nO%l3PE_&w#R=zL+T*> z)+OS^k7haBkx1N(AO0JAH0&@QHvc_ndOFux+AT*%Fn*+bMF(Pdh0~_NSHe_vCi^Gf zg-d=0_fVqe!H^#RVZT2{z576)?I^dFH}Tf9mAiG~ zv#hAW9=c%C#|2Sp1k34ukmeS%o@GN&1g#@OXKvtTlq4q3X9PWUH`!uD=WP>o)Aabv z6M6O>a3e@LdXi$D;2HVtrq-=l2-KgH!pxp!sq*0XXdp1kOV1I-^T21Ch2h3L#z!tj zRmd{y8lJ?I-Z7W@nBx>;UB){f_ZyBq>QhHIY%C(vKFx)heB5z)mg&ryfGPsMO<$IQ znb(pcHXqi25t9bu&q?zBpYu3TQ_yk4(CZF9q>0T%g$^ z1|VB3xtdYg!HT6qN-bGt3eO{<&1|W%1va7&3ZbD_H6WxWBI8uZi{dG*{DOg{AC~WDqa5*z zB&aG{6CwXHBO;YDpBLNHVF+^hLMI*tIf=n6Ez5|cBP4W75EcjEwj`#+n95KA^RWhx z9DH$MG79_ss9}zwiH!jZ%r>D8FlC;=haeOx3YVhg?HO{AO3Lz;;5hvUV7;yTNzmX^}jF`hn zBH2TrKax_)G$W1a7K|EzMxI)&zz%cB{`OmvI0l)ihig|^rgua(HCAZsguj^58_Z#$ z$#i5Uz>WXX6C|Tb3dwBQ<{m|_*6TM4SQy{Oo*JMzjviBrQU5z#tv5;3Q$sQ6#=q2? z$;z)8*Ig{^BOf-CX&Eve@1bw<;a|c_W(Gb1k->#tl{+^cKi4@lfAwuKN{vIVj^&wvD||YZgkike zEuEz&qypC&UnaZx;n^N$MN=jsI)Gp}_J9w)?lU_|Zh?V6*zh<)%sZk4)tOxEx+(vc zgx*zBe2l^uR2m(Gpz$L+x%Mj*f5^CkUPg0eTLEQ$2*p<|r}t@q?wyTM`tF zY>$kvtb&+oEWBeQZ@#wA-H||j3pKoBs#2f*+S{WyH57t*9QBBM?2W(xHOOn<<1TO7 z>zU-cm?`|FvZ?qm7Z373AkjCmsQ<&c&Gg?vYgt)2{?~K6OM7Daq7`oY`3@s7nq`1yYS zF!+C6L3)HamCID64%xTuCm(PYmpk1#>*bq%1i>+V@IRIRaRuG%fFESl2|nEX!2jU- z`q;W+0tGXk5=1Y>b0Qg!PU6I}i5;YMq#UCcW07W%6mT4y{bk)fqTgM(q2{Z6#K{%! z9P#d%N?rdNmNowE1i&~-=ke*^^U(@dyovDIs7z3jb1xTBk_wXbtZq5^_O2I`!1|;4 zC<;Iqt<5t3Oln%wIQ*64Lrix)-JOuzQe&fD1Do=hq?@|Q&Krxf)0b0bnN~_w1g|M2 z(4COP|8*HgQKe|Y5c2BMhrzF0xG$G|3oP1FjF2$?SvV^?OX+3q=63%@Map>bmaSQo zZ4dh=4J@++oZ@e|4rQenAgXEY);?F99y*bM6yrf8@*u=^m1;Rd5p!(y84jIP^KV@O zs*@7*5)#^b0Lr*n^A9R?eSAW9RuvrYqjgclr=>FK&~$eiCsVt%zeQ27tu{X1^p*0P z#na%prW$)E(b0|<1{0m3Om}r4f9+N!vSs1+e!65K3dAmI+>3WSB&mE^0-5k=GT1S4 zZYe3?u(ocJ`G6>njjTC&+-Cb6rp2Yrf0|-)R_~3Ha_VpFy@pNnkbI^@4AM21|#seSXLN{NAc75xHP zP#h=6us2x;X?Il70Aw2}lAGuUv9OWx(e2HH8l;UT^`PA{yVKrz>uaNRm@4egzZX@j zow@JC`V=>cZ0ab!-2;l$M(r7iXPvPXZ&u0ISg}eZQ0k=*dtVUKt;%z>j@0eg_!7|c zCQ2O`vK*lR^rV|}kP}gzvhAArI&{r%R41cgzRVE)A#VAaw@Y!=976_6UM2(T-$Ey` zoFycuNf~0To?i#4*Czz!$e@PRl*M__@HguQ9u`upr;GE87{Rd$>S0yT#~Nm#M&&9Qkn@R6+H6Wv2jXU^!?oGg>f}{F=t^6riYB@L~RXf9##IQjX1I6n7oS|I5}vp*D+DCw*x+y+_9$^GmUY{k7_V4GZgCP!DaWHD1Ut? zMoU1|M&Gev8Ab?*A(oYXT+&xr-|xV-$-KKR8rI}^zUQwSYP$Tn`{nMb9=>P{edUqq zq!7aX+qlEA?Q*HXpcVj&0cQg+ybx1Zf2&~HL+L6dW}kur*}h7c`i`&Mac`E)0&vh{ zuTODqTz~V#x@y5#CWL{dETD!9lXw+Rg^H^8MfNtZ|VRa8p_Dh$R!{S$-=|R1F`U!zCK8AC`Gb_1ZWJm{f2IE$U7 z^oNRaIP&6Id=U_4=Sf8`R@;~ABjTd^WUcn{cnWqMv;X7Aw)9&SFl!QCXW9- zME=vK{|9+>4zWI`jXrxz)NA5@Np_|i7jm(;X7VpY{&O=WBv7o?oL}RBVsyK$c`A70 zE1gf=VE8EB%Ig=j4aSvl>i)AIMCR_jyZ*I_A(MxE91MZV^`maWqqHz$w3>z&tvzPwz0G8NweN% zyc4Hi`}wZceiGnvmbrU>YvZob!ci2!y>*cl`)RUM&gs^n)G~E!=kOxIonZ88etO)L zV4`&(_A)igML@mt57pYk_wDA0zKTK1kji<2k-bg5LRIYP)9YIJp=!L7%O`iFa^0g( zmTBhqCZDXFh5Gq@wJ((RY4i5dL;utId9QQ+Uhs5?dm0wUg~(paf^tVU9SOGAsy+DB zUKwT%^3vEjbiYAAY>abs4K0$Q^nJ8j?+{{o9J>NnvkD#{$m-khh=0S7KLBve0uv4<4o0k-gqdBE{j0W?xZKq3O2B%FDv6?MBFKLYZEH9(o zzVUz+ZLi2I*-P_@9o@;Q%Mc3K#+R~$O9fUFWG}|;+=LETqY>1Ve7XOlrle{Wuu#Xl zhxVuK{;|6Yg-!erJWWzn?DZUNQ@M5)v+z%2js#`JSg?eW5*1xzKP$b52MATtbR}GW zRP%$PY?|4{hv3rz6qdojSctuXqYu-mjbokNEX~XU{FuBQ+fKevE<%NER-hvY^R>1b zQRYx$%|vEox4Zg^2<#uAo?Tz_nG7ju6%@AxZ8ee1o;*M<#&Yj7av3cj#l{;kOU4$tZwY8e=CCYGYHAEi1*RnA#Rar~Z}~CZfT+sWgQV27T93-H}WI4SA@rr+ivu*fo6F z59f|>I?8Dk)UvVxLu-ayXWQBp!;T-JAh=~;?&-o2P_4@cEaBy=HCH*0P3}IJL3*ygN@7jj4Np3Vw*I0DW`f>1 zs|=aw1=HwV|7Cop)d!~gMPAV9=E(#Wsrss%KB(UG^s9SKEC`X^5d9A$l@up?S?oQH zS|y}3Ct48$9&5}ca8WAdE*SaD>E4tFYiR8LM@Jvh7wuahk`2ftqcvLk1H0&@FA0d8kD$PTeZM9dvFYu?Fwrgeq)E>2Cq zyuWMcs?wZm?$H%xnpTwX=;xc=ePJZ9{@FaNJJ2HblGdJArydpdW;naL>lKuIYEJDk zZJoG6XKu;Hnp!ORRSavpq2W=MUU%i)_f4Y43#+qIkm-^pNjl(ZZEgk@`MC2@3BRA0 z`-8&^OZFk$20I=0w1sbk-N$o;KbfHAQ8D~5C%)qR&bl(G8d-fu^cK4SR%z8{-zaGU zFF!keeC}`Jm2esYZqAq1AY8K3=SsMcN%6*RH5|-6bYvK?HP#c;wbUo~QXWZv5I8x? zbriyj>*|i*fu4ry1JI2}jRulOI(w+nc&Hr@k%1`iX^BbbC`^#&V;*NP&?jLB!~nsX z^`NQ=gd!U5s8Z@tuZk1Mn|Bf1BjA{Tn>DQEHm4~$pJubLp4gL$lotBU=q4mRlUMIK zxv64{5%iy@0^O0-8?>uMM9pRhXoNX<12XUBq6$*(KBdU$=7CG1_z8mIDLt>Bxq;yr zg?{u=%u`jYbupLIWt0w1-!smmE(9c^T`!0I&uC>k>GX%{s(`xqU@47*J+Sql)kjV; zK)TH#tQ?5LKcJIMx~JjeZe%7J+R5}^E$F8Hl-b{A8IN3I777%`983!fCyVI@ zZH)9bOQ+LnP>~v_&#Wwx50e#8p!XnK51HV^3C*NeYW@%4a(%TON%he{HX-EHcOm-* zR-1Y-9xlqvZ}%k;m3P30e2WBe$~1TFp$e3}>j4zn%|Pj?ZU$9Z#CfzAblqWOnAB5i zMcY|BRg$$zjD0M2wsMz3JTQ|AO-1kwD#J8W9yMI6mCD&Pzc04%y>2zA8yHnHM4=~_ z!KuW?2~u^q_870^&X*YHf@P~H#G;>QCLY4y^-4tjkEtrOkNU3^O3jE- z=XeT_Hn3YIa@FC)Q?$!2?v;d+E>SHtgUYVnpr6%6M6~tH>U6h|a**!aT=~#q1l`Pg zO8*$!40HjEdHY&YlpMABf-u%Xwd8?WMDl+ATFu??>z56uEj!eiqs1X0yA;AMx81_U zRV&0cL6H~fvyX?%$Os0YmX*>L##7-y z<6<(Flgx`?Agc7$`wJAMFewn_eJDkjGFdKV{scNDzHrNq^7g|x-Af+&3Pr%1_%ImP z%|sqsZre|4UT+T6<-hEZYC2aepelDB=njk}nDb1}g0A`l6RC1YW`kRG%R8>d6DCHF zs&+O_UGO>7ZS8nLXpz%ck1FGyaVcz(t9oGTgX@I_*XRRnEO+*;xS%Q}`ZYCZ&xZ%9 z6@kEsgn>f24%Tu=YoCEG%N~Prkh8ncufHZg;a>(a6rLXzb$T_{2lFdL%5_zK%8INJ zBLpF=w6DU0f=~`$yX>p@7_&lB`I@gTl1vLO0{(a(MTxFae8fMXY1W%hSJn#1dAb?+ zTjm4;Nb@_ot|8$WLKq%V@04t8ijhS?Pf@&lJ*v50UzCGakLrGnZ@#yd1yL)_!?8Y6 zwpz9+(7AATjR+Opv(Q(}mJ21>tpBzF}m)p~us|`7Cn1G`MHH9n6HVF8a&$7v-@m@b<SfDe`fX8%Z2+;rjNMp?e~G|lgS_r58V=59fZLJNM%ag_}Bx6P{NCp z#>DSrpvT}55`gx=falNxYA^>MS+)LCtkXhoY)Fw=XMTH?PqjqW)B0}&eP96#$ok7A zGN^!MLwlnh7Do-2vT{_vg@1}k@~>j5yA^Lc8D*z4Za($r!5|ej(KDWzhtq=~#(2jx z*@ur9)>y_Lv`p~DrghZ{WPlTOXRgrHtp5P?dva^# z&fE0J^LGHc4D)ElFO-pw@ykl;u`|M~<8(XKc8x8=c3}|I4%>%@`&mbU%F@}xoW%m} z=<_=44y~imTUD4A<{Psq+-lP&Yy^risgF&;93L`TGJ9b@H0&`mi8ITL1KDr7CcEIs zjIXW(VA8<{-yLiBv6{b&P0fzxj>kb~w90hl`s~*uX@M%8!=Se4c@?Y&G89u9k)S(M_^3kBc&9N78#r0`fUS^?(%Pf|WpGyDJ zFK~zj_MD0(h`64)pxf0CBt@$>01aENw2Wp)yRCi>CvdMG{%l;Bu0i9`6!{QjNN!Am zVv=RGy7NF`R>)-#Zn^oP?A~WdxUyPk&j3`mNX4|%H z+qP|-wr$(CZQHhO+jjS9d(KQU$$Yspll!}pN+ngP?04_ySqo$wOrmZ4CJ-f+rep$5 z>*RH442F|fvGoKS1Og6Z0*Mo6_H)4L{hNrM=x1W8oURBu2tMt-?d_2M;p6P~rwl)h z|HqJC2}TgavK)inopo zwnHyP?Lrz0=N6EU#>qqG=**qg&BE5BR=N)V-gEQPswgK-;;cIADzBY9`gs{}ejbkM(2I!Q#c(5_lbhTy zZBr~!mEZpyvZj5KJZ|&eN1>RekeNhVA3zmE-@^iV`2FR>%PE_sx);K52&_7Cu-O7>XSWy=&o| zhA7Oz2#j+ABUn=PrNrJ5DI|^Z8h}a6_tX>CsR@*>j7}#7$|k6bxYaNp~T?HfXlzA+~K4&=D~!ig-8# zH3I%gMqBI5S3+O%BxxTwGur;^uY64b?N5NhwyX-Psy?65f|Veqne^(sLWk{N!7u?B zDA~H&3TF>UJ8(qz9P@`dt+>{vYXMad6eHXas?-WKW_Q^aV8p%^(4omgQUg(^%3qlU zuH9HZA|0_ZlM$uC5Egygt5A4DN=$G0fhud8$c_&==Ynk0i;p@S8UuL=tsHReP$gYb`X4s5)O=vCBVw%?R!Z=1CKT(NzS;wf~{sOjZBN!A`VeZA6j zv~_rzB!0yrarRlY&PZ-eX9MIPs%4})2%gHIa8I-p23-f%l+!FP0Isa+@Qa+;*J|Ej zL3;lZs&*MI5oU5Ib|3?>)*vrIWTpb9(gLA$x(<`V21Z6Y!i7;)EbeHaLs(|9ob(!o zCFWh#ZZh}Sa$e#ereV-&6mi)&_Zdzlh9)}VQVu6q2Id|oNPOlvNC-JO;3XuB{^KR5 zQ-KVc1Esg`T3Oxv*;SkO?&N?o%-c$WFP1ye+6DdQAY58S;O1-9T<_NL1g(c35;_ zDOr1Su$nv5qPogdZlEQt!PFE+9tp%tD5%Piz6I4+IDMPKfP7kWb9qyV{>#hY@*&XO z<-sN+_?0a|9}gVE=fHd>aRPb+<+lUpb2*DvA}DTOpx4_r^QUgJKqC3Fe_~DAmYD*KAFPthG`5A4+406%hz7;qv1H9kyS4tq! z7m(11*fYg7iZtmnRKc?7!a$mXsP>SCaoc3r<$>S~jC4`dnQhvJS|T`)NnHs59Usc; zWhN!iUPZI%fy}tLdz*+tb=M0}tNaP%%u{iSFRRV6uqjo{20>@Rx;>(8w2iXJUlGfd z{$b@Ina5yDI3-^b*k+O#HHD>T1TcaIPHNXq(}6D150N%cB$9*%NSY30v%{T0GuF)5 zI^0Voycjr%v%L)*DN*>C3;W;)&+KB!vofGKGTwEYUD%LMrIp<^7_Kr@H#d+Gx66i5 z{^$pmg7A*0q*{`ca|VlUlMEv*qg3`QYTo=$9j=mkceiyOKR6 z^|SQ|c;Fviu%<3vl9-_lU*XZDEqQOrI#bKbAh>EWN+CO=5YC{9#4cdd+1$f?S(SdL zqlV+i7Eq*%kYVFZsX)P@$4*;N$v19XWZ^`hm$zD?o`E_W_o^fn)qXQWrSU+Ak19(M zi^^6O^=u|pr?#k6>>T%^#~SknWC-W$HGyiRbS!i%>1-9Cnb`hviw663$n1D9y+qFj zj9xhsAA*zpHH$Bj)k?_Csg76hN6D=!sO(rd&0>Jbj9d0t#rdGs%Wo9EurmxreA_N< zc+?xYlIg;P7dEgH2B@#u6*xorV|HAU)}_AFZsfM)Upma$Vt%!H99TPX6)9gacERZY z0ZWa1H|UEPswqP07teh9IfmO>6S2ckBRt;^X%9$XRw{IvmKET3v@aMd$^!&q3jBXq zSNV)p#gxW3H#t4vd4*~Iu|Z|4nO)iDljG0j)mVEhOTcbc)U+t6kzq&gYnMZKHlszn zl6&8hCJL+eXImc}{~e8fO=CaQ`qx6(uj%UcB1K@P?LjGLV%pG{LCMAhOws-@eQ&1S zrNIeB0LL^SfQuFWBiNi-ZB6f0vdX<)R#q*%+JBRRJIs*@TCCsu6Si#l=K2c zj!Llz`^4d~JUS&w=C9`L;<04{dUpy4K?92optS~@8UJ^_QXeIWT?&?$yreOSl}P`$ zMqjWGGi8#C*rRf`4CajEaB4!@PjZMQ?4wt8E~viYIV{SP;>rSv4!g^?m^Loc(4 z!lyy4M#u9hG+y4!k5$H`pN5U+n7LG2c&JJ^D{+!NaAYO9twpL%1Do5pcIQe71T)yx zPI{Dx8J-e}*#bo;IoDYu=V}n{6K>-08tP;5Q@$E(!0HA_$BRY+&#YsFdVY@SFevaM z)74tebwtoBjmfO0L$j28bxFujZzF%KV!IQ+wZ{1STs(jQSGdXf<`#4PdHPv@Gzt4= zLnoPVmsNuaTPmFx6p4jOl+ranm4uGmy!;~Gi$}ypG&7C?=m1)2ItUSs9$kC%!dEAw#^SyX7DmW2s zUGy3Kcv2VmK5ht6Q9T2&XE2^B-$bsjT2*h1KXntBHQeo;*3}rvFlkriC;PB$S@?7AB~)Xx-q*jx=Uh~b z5R$)?<-MNYeuD15&+xy1X6jHR|ChBr8{>bcG0M!u{GZb2|06&1aBd6vzwqw#x9|d$B!j^7NBRWsaj-u zc69KZxY4Zdl6cv25qQ<=-P1>P_SNJ!u_m_TZFA0_lS|BmGfv1jc(t$zF68R&`I2p& zrk`u2V}IiU}=Xdu!^ z&g8jptCp$CKDq}TMjl1eI)2|?6y&{sd@^k!eLtEmEizEQery~Gr};ELzJD+Fmg?xu zwXQfr7y#v+q!Qf0AkQo1QWKCY;b?LzVSDeAxp2E<#FHs>3&14d8YT=&OoWnH=sV6J5k zm?^c&A>nFyxsy9cv6eR&qZwB&o@}tcFLwXlR2OBz;dP6FXSV6|<&NPIlW#tz0K-}Q zxvqv_L~Z$J#Dei6)boHdjAcz4StlZl1s!ON2{4VG%?_=U(jH#hpN1A$WuLEQ*MpAK zFoM$=L3BcQkPT?BZbLJTa_X4ZI8rCfB6}x+3BonT9u9jCWPj+F{fc^z@CbZ5{3g!; z;#`XwY?m``ZT+VPK82hK5cN{)dI<;;ujCQwfY??&mdMBezlfxG@g&pjRnTf_NYQSE z3I?HhP3|;VLV#}7B3plr$oSE!|_g0Ye9s*bNn#cCL??)F7S_`VL6V8y?r#xrnYd0b1}$YzxNC%rj&|r~ zW-5lMde^H|=#^4f2bT7B7P@VA-(%AZRg=brur9Mk@O_9URbACLES|lwvDNmp?BRX| zK>6p*>haOW>I#wZ-{be6>tT>M)uk-QfCYRbQttdo61=2xQy&sf1*+r(W5dtDMBcIt zS$Aw|cV^5H`sGQNgYjAR&J7;3K~GFZ}ChM$(K? zhMZ{+`8xNg`-;I-U)ir6gJ! z(Pn~HqEb^kPkDW-q|m}M;2of%q1QS9J^j2mVB9pDxhTqSy);}~v z6P67d%N|XmC9sDL|7=_+bA;FQn0AgDQSHfA2~0@0zh?T>>3ysJEDRow|vekx>)>1iBFKu2X z5Ccm~Ur45a>7L>XE=B;y+vdkIY`(wX?5}`5tI(aLFhm8WAbC5M_>>(f(r%5~6HuWD zVCy!Yu?20L?kr}DVVfYn7AT_e+Z}hnCx(U!P7C_N-v|N<8oAR4whLfAoA>xmsGpft z=;zftr7(0IxTUrb8|~h)e*|6@L!XpEc7EYPY~(kV{N|0icaN)fgB3C$X3=bdQ8m=a z;P-6{5dValq`*K1@ejTkLYxY=!5%QY>4_vQo=tg;Cl_qT z%{j(V_~Y#vkX#3H6OW12O^~gP?!V<2E?u92MytLTKfi1A-0Z&ur%%N<-2mlDd;2)r z^G)o>KehoMXHXe;jzP@r$18)+C&>@lUD*e117>N=<@~5G_t;qYf2rL|m|(q0FKQ8> z=moB@Ch2xu5FgvTeV-&JkK{w)=-xSLo=Z5u=72F4<_!<94yQ%kXo~>=6?2onrRl=M z)~HSER0>!^_DF}9PxwRGnLJ)`3q}D`^S}7Qm&7J!UEPCPl(}sR!7-LNGLAbUlDj+`d!v|wLsDCVF6!exRxd~-TZw|>N*gP7s7~|EARFM zTINA?O{JO#65iQ;_*@h@eU8XgZl<%CP1#a!7-~Z5Zh52NwEr@Ys6L;nsgXYOBl_xg}jtU}L15m8EyPq-Y8x*uS#*k}kDG zfS%J*%93ME}5aGuS)HF3CyujcVPRzJw+5*Y0ULup=hkVAPS~15= zuY~?6<5Zq)1`-NS)&K}_IiAKQRSTIPAoyALaqDTsc>S~Jq(FHmITwkj49L>FpA_Os znaM%V`!AAEclqGrU}a+3Lz5S!RRuvY5OW9yp$bv~;a2mnc<$l`0>FBt);M2Q2r`#f z1ot{MP>`qWMAqrJDOclpkqsHaQx^ATIu7K+_)7<^s@~i;myVL6E3<;fhgMCTny9Z3rCXD~T ztdjd|lE4zP@-do1u+>zGHm@?v+2_Y$9ws%XLZ48@xkp^h?wKn<22yZDE#rKm^HiKF z;y4{BMh}{Kp4&r*mrH4?2c+;^frBC%_3c?+2ex~L4&M4!RzXcbaXP3KAGqYe8Ck4> zaPziyIg)ivBKq~#F$bo2<$1(*1`)4DpYVWdlICuI-{;l>%kYSWGl|CI+j!rIn6YJT5s+oYPg{_uf^aSUOVMt&BWnoX zI;%3nB%m>L;f;i(k-v%`HW1~=UXsC~#=I;{`1D@@fB{t1?~Ik^2`rCRYXuE48Y{_BHw@WNVwqjrGP6yt=YNATzUr@ zPSoZl{{GY*!$m1F3jk`!KGuBqrC`tX{oK$4^qO(~*D;5YftmTgHRrG~{0GpzMSCKa zx$S@YxSxQA?DhNu-~bJQJ2>C%1mQ9j-RK?$I*y-pwj*g?n6O%bg>Aoik*fYwpH!8& zeBO}R;`|`9liSULoeteRs<%HdcmMQs{G5#4%<*Sr?bF;7*z&J#WiiM&xFIJ(Qrq$8 z{(7HXKD1i_uB|w>oOeaojp*37)A8*jK73amiQn2OO}wSO9oWO4z)zX^V)Oq()}7Ej zd41HzwBet;n0j``M^ISlP2iybedw z{5A*IUTVyGX+OH8c;rnLX#*b|=<)x!E_3`xuTjrJiq2m@c&}3p-p4#(EpGL z1Vmq^*11sx7_oXP=XT^bv2d(qOSg}QI6YvJ4w|GuoaITXX!9jDcc|Pus_I@TnKYA@ zqB0M{G!Hk5ONYC+TzrX1g`X1a8da zzKNqMZfrGK3lt(8spUR6%Htnr7<-=3izMRAjxkvX?Myk2LS`5H_h1ZhWb-&GiEuay zxsSiTWUQBfaScT?Cu^p(g!VajTxpzb7az$^QzV4YsG)>KkR(wQE}v+^WwDzefYLG~R`a`DtTgkB?+Hg}C{__Ik$=d4)ECki-gTDJUK0TN= zzOqxMgV;Tw6($Busml!QB?FTK(;0Ns)NQmk$ppt3I=7Cw^xR8fXmKdnLYZw%o zkq&A%)*6#L_&vI4@lcwLqG*SIMc`;o?l_%c;^25=L%X-0K#(5lDE%amh03W%W=X-`%inCr5Td5LS-=(%x- zlR7I1-I9WO}c>3KXMZr9S_s@?%QVCxte& z+^XT*Rj!*XBf>f@Rq53_OxHo_r2Q}sh#IqygF?&O9&-sGKF>sTe_R&Xhs?~PV_0>M zCp7(=xuWBI*_!JSa#`AK21T(tu6(#t-cc*;F5j<4c36cjMdIv114QU7v<$WpHLI&2 z;)OET(q#gCQ1W%M&Cvr8-?)+A3~5TzAlhzlKB#BLVcbzpwl5ZhS;dYa)BvDQ0kJ#- zxN;bP9{?ZUEH;A?eT)UO_rg&Y1{-6jQsAw}lA+SRE`?*ZitNwH9G@)I3*adbLWnKO z(&!pn%+L|*->A($uXm?>ukW%8k5Vbi?Qg-ioop=jR+$bPzq+p_U)hd5Lcg+s@CqYd z)aE?oCFqF@v|ZqBSV0PGbQkG~xo7~N5w>Pa@CkEsc~ zEY|&^`j}^HC6amK`)8xu!p522|3a3->=RT2>Cu1Y3MW&JO#%}t&urmFsi&nrdmB>Y^MOnx{58a zaW4{#^-L_nTj5_$P@#YzA>#Y^k$^NBgf#^`&_36L7s?RRv&qT}A2;PjE?*f%M&>h zww;;Ys!K_-u!hBjCdEA921-Y}KeFaDaJCL0X9Kszm3sq`4c9wu<*h-94I05T!zRaP z(0ZDP1MM^9;<8Oc^{I7<%|uX&assS?S1Yo(bm#q)i0AQ4PS=_fPljHWyj2Pr=p`hL(N2tZ80Z z7m?aC(v-6XQW0B)MvmsvECOr^Rh;ZdJSE;0 z`iLS6qfmsO63^8{|IDAu%gjH8f}rdwm@A;f#o!CirX5{V+8h#(?lrTEi}lDsAa2HA z4+AnIF0_RN&mrx2hX+?_Sc^r(Z|9wsI-e;jf~P(~r?DR5V8xoUas4N|qI_sqT;mRnO@gz?KXqJoz*qkvi-aZ_vc?LRx6axNBn42AB^%l}8;tO*lr}N(Xq&?LsG)KSPV!6Zmh*P3jf&2lgH=qD&kl`^PMq&= z#3&dC%hlsqb!9|)mQcHqpp{~=k8}thG_(Qi3o~}nAqe8osp}IrS*6rmadlgA!34(l zcm`7a_CcV&NN9R365)`NeO^LRYfxf3l>(M7d=Vs~6YHNVj&_nBag51Ut@%=P1Zy0+N32`YjA*a&ap<`2Ut+)$smRP0b6u+yrbP=CjNCFVUbp7hkx!Q zSV=wJJ96i&uP>|r6cQN4!KcQX(22iFDjGWDCr>(SScM!sd~EO^EU*u~AJHwzq|n3h ziM+;V!gLgxI}Y3n`I*!^X9MGiVSJ3*Tzcl5Ij-Vix>MDH^y>+49cvBsnzFxt`@w%= zO$bhO*2|pvbXf!{fb-5xdJ$lYqmT3gn#Z^q?dhAlR63AApX_TQo0u&pqr_>}S$8rC z7Y|AgN*_>YwI%yTfc!vd4&*{nT0Fc_f zlCnkZN2^YQvd8U5gPEaer`4Kz@0La=v3Tj)UQatla+vKqS0qIqWnfX~yr= zhPX%M4?EV(&~n&iaMy6weOK2tIYOFg#!TzcrcFm81uWM4$m5SM4FzwExypDbyJiVd zHhl^t3%x4hJ&_=`&*&&n%**;r9RjFg^I7`LQ_lr(mB#E)vb%NX9D5-Y69JJ=5uhkO zWHi2^KwdmPC8%YKY2IdyjgeD2+PL5ugTOkdK27*#anx=i=iNiDv-}wLk2B&g(Ka&h z=?wq#XcZqUm3kkS;vwxy#(PyH0(V**dT`9iC7et&J-1Ywb=u4&L@o}Ul9}4)jKgrf#u2u2Nkgqy8Ia}vXy@V z{TIg3b37Nvre3{74y+QFwjd*HsBEwy8qbmc^8Z97 z0F&CctT0n+hX@G0$;_l`xnN;}3TwGn((VoAGVKsw7BtBqIBE2lWCrXc_ux2$8csLC zA{@=1dqeS-(p1sYMSnN5>#fEXJdZu)!XtyD+Hujsn7YN2b^Wu;ozMX2(4v zNye4J*uFd7WNo+kG{uu9NJGzGSH=9VRO!KcXr_Cg%Ey1tfgfjBEXK zUn|r)Xm*qAN_*j}YwTeF6GW#`N+Nn!Zr|PfO(VBeb-Rgl5TX%n01ixY?fZ3z>V|zt zFZgapMVLUg|r5Q*?lE+$%QJaSh9Od$TL)($w4)()Eso(z2=9|K7V%r{$wH_V#xex zK>?Hjs!uVrqGLoTZLnK=Bt7)RlAAXnY41@7Me!*dY=~Gym6MJ{6)je2d`W&NZ881D zRIS3`yxXKuK}aaLw*E^X`XrWRxKN5x0U`7ZXipIot^fQHe2vl&%4R+|p86V`d$)ba z%Z0j$L3>#!eKd>70V#d7T6-)?NCS>rS|bD8P60kfT}1&jwf~5;@*hY}&kLw3R#tBV z*q?_;^i+|H1sg3aPjS@PBXr$~K}qU``H-btJ|+bA;nNgq?Tass^X&!hUWz4J7Ln*# z^x*vETr3QZpoAv`y@37!c>t*5DdohV_CPzW!$hV`o%t`BDQB`e2l|EpGEnmBjhPzZQv5p~3>e%Y(ed#FPRO zLY^VH2iQU-1}^PkiJ5#OyvanE!relcN_bBy6yP(2F39t!NY49dfjBTMIYkvq zwDy=3`6S&Ko|M{`*w$)LdA5L$0!w9i2c1YqGBb(Z|I(PIL8W9nXBeQ6AtiYO@g>g1 zAvlBaiQ1r<=OKs1(%MI83Y-55z(AVPhd~L_79Ux}E8SuU0D?g$vG-3iTQl6Mgv+T?5RecZat3G0W^2y)0Z2@PSFA zB=P_)$)gMTP80~;<+A^-rheW9^epKsvmEg{Lhi3~~0elYG0d^xQierL&l3GWh_y zQKv|$_wVehU)W+`PdjApj-*R-7!!yx3f6k_k^F{*Bu6&&tGl2HJ>(9*%f%}Ek3%qGS$BBy4Y`| zTEl|0vLmtmJF?~9fT?e!wIMwd$_!$+6565!;jwgrgFgc#Ykr@nS$%EG}3Zzu>SOkD^m=*wzTUuACLE?v zJl3MPI4Ln`UTP|np0g9kF`p+4iW$7RRYR~!xT%(BioF(qjnWJ@D%8zmOkQ}p7-R(G zgcsBGNjeF(v4bjejFOuO*G*9(F;$s_4;XY2Q+AMUEH`@C8W)?UjO7BKQxySRtOmH+ zu1!xzc$r@!QSvi#1iuS^wSEK=5P#3?L-N+BkHKXK>l=0%q@Ige8I~LE1DTH(+k~%D z#{_A(AED|RF))MMiFJXqA)xsmzI#PZr7sPD?(e1Y}$0xW_-Gay(B`PqWD!4 z3EwGYEYgd{F`80@jjcG%=d)j@{3p=0lvdZDo~ldiR6@-Z1xIS=mqKyyAkIZxoGve+Nwkt0VySrE=Ue3A})3r zNmsN)CKDJc(enolFMl_oI%`6AEJjvu4Bl_#?|wdCEg6UHZC=OPZ_{+#HSvV_hiyA5 zhxn*mx3}l^uM!U}yP+^r2dm23Kd6WHf(c=C{@fXjRdQ^TLvJ--o!D|L8=Gi)v4%mJ zltkW{n`}~^j;yUloHme&x+_9klB~1`rB^BR@z-2h;)Yh*e4OO@cK^#o^oai*N3YcO zq52zz82hczYP=Yp^?Fp+4tsTWvh(?*=6AdDP@;a;Yt2{3S1%3HDPgl;g4#)D@%MAn zbhF`%7+bUa)zicJ$}E7zijb3CTk_W3Ys@3dCWB_rgK-$h8 z4>KY5Q39{nPdryhk}-{(Nwd;gZ@2;g&uKCX`T{hCsr>p@N~}sBsZ&#FV%MnAm0e{K z>GX+6r6z-V=`T=|iZi*zqGh0vKUpu^WbdYs@ez+8QAk>6U*`_IL(|2OBN!UjGz{%R za^`|zHcF(0TN6iHbCd=KBasV){p^aTSX9R#F~H(sY7qT4P6?;_)Yt$zop{R^zE}ke zv1vbQiD0ym9p~kTbP=3S@yX#;xpXj?)R)z=j?x{e`qX8+hmIr86nee9W^#{4%Sqrr zFi1kAfrvhaAlWzNR8|p7USV^r#jx($Bq|dEcNK__Y?e19>5+0@cw7VK$1<2&MOwEE z;7MVW3yjY-`m1Uf{|eED&@-bg+8CPM*B&Ly&_#XtOs5xLqOjhRusPemshYW`!G0fw z*=o)_WXW)LdHXxcC6x&{%y^nBSnE*ps`VaebyJJfEQ@X%KI&T;HPq*G`L1e2K^W<3 zhK>&InGY|u{y8nMCqSC`HWlrR$Kx7A3~5O$6p_0bzp4`s($5;ruOkT8<)Qampvo|s zo?bY_YwQQKZ4oR<3{cuogmV!~uY?JYNQb`n#Zwu7t*jO+x4`_SHMXjArv9YM1K_D5{<(E5E21LWEeGT zo6*Jd@50|ToiKji&yJnpPRrIlAMw0zS8;sbN&s{~%DW5#Jk-QjB*ktttjC8nS3>&r z0~s`h{h^8h3c5YqI3tteHg(<%KzhJ*4pD8!5L<;B5z`Q#>rHR~&8GwVbjsYudnBB? zNJrS?sS^Fs)A2+2l}@YA7hj23z}fd@y%`d=t;&e`Jkzdg_GcW{LPnw-DB`8Xl0ww3 zy4)Zcs@m_z(m3Jk+I|{&>2M$ck-~9@)9~VPkhFLGl~;z&vC52OK^o$h#{T-tX0Cz^ zqRzZF8I1&Z4XrUBJ=Lt22a{CM@S5;&kA#du$f+Fx%P<8Wo|~bm>>>vDVWn<>B{?P{ zF*ER&`MiB41e2L%8Lm|GWDHdz4I%-D?Ni{FtJ~#$O}877B?duqEWSle!;{HH1O_fVEDNp_Y7$ulzN14m^Or0RLaTC-rN?@ZLkMYKSMzKRY)qd~Hs`HN zm9?AcJe_#TMpe=#;!jcnhKy;MqDUQmi{litz&nstp8oF96g#@)TxS>D&-t6Jo#I%! zeHRc$%zrqKQzIyZ@U_tU(X{t`!lU1Da;d0{p>t{)$b+TSi0k^F^-vk{G&cu_h@ENyafyTKNSfnNkf2Y%DFbBS>!w6gN$W>{J9cJ|cEN(MWsrc)= zUTs!jG-sQwab%%Ba12APi{9HcLguHFWpX$pcM1HKLs)?z6~rPZgs%?|JbJA33>B%^ zmef)aGn*qZIa;pQS9Qu;qkPxc=9=Q?h=fI6c;!Y{xuo144X!F(^jub6Sk#-N)|-R4 zli2#!L&-5sXJLTH&F?Upb6s!$Xl65E-Z-LODU6X#ANC+(B>a+E=-3+f1%D!3{azYc z4_lw&EKs_`O9o|N?;H@aY>jm4gm}6uvIb)}r@@5wlZ^PLb6QyChCoRrFp}vQDO^#x z>h{&jVIMw~?Zir$pkCw|myBo7@$mv~MJX38D|ArTI-E|&UKQ+(+}5}IZ4yvqUS*+9 z3vDs5FX+uO88Lab$W~W;pvK)yA7E*63x-!k8#Gre^*2b|Ig0IWxh{k#KW5;Z)3Eg$ zHt#U@t#_7j$T%?zMo%S{*Jg5{Sez9UxG;%GVmjbzQfv|7R8?A?#j@7~FQIKGCJ;(Y z@XTFsYieI$gx21inc5GCJ?l~7nu3Rklx+5Qxp41x8T%TCxtiw*`)NKIghV@+x)Te4 zsv9!aZvd_~TxM>F)JacC1qxpgx5^AVr#1CM{x@DmHb?xQeJRs7R&|HLNkO z3ScsV;#UdN;TiT+OT$c%teist=HqVE*<$^sv)&}XJKHQ(36!*os3j33;+i`b74ow_ ztj|a@7Sqp6t+Ehd2EN+-^D4ZBYw7{hkYo{u({Ocu4Q)uyUEn0A6*eS{ot0sSov^To zLn~%1j)p}t8TPVFpPU|Irzs&8mWN=s>6xFD>QUwxn#%9&-Q|;eu}Q&xgYYL4JKCIo zcx)ZtLJ>=GTjoFpGA$vtz|h$d&LmLE*qKmv3$|;fp+;|71*$M{^HCoO6f51C5(#>@ zJ=)|<$Nb~ymcz-qXddN@Ubbi>iqzRz-8I4oy|eRXZ^gx$%|R?c zBs6mpM(CqiqAa?2(S6j=-R;uru2c({gqQ$bU!=9HpO(9xk0nfj_UCCydyT}*xg9+P zh&9DB*+AFy$-0UTZpHU@jjp}g6IE8$*a&~s4qwl$4%kFd4eFo81xSW^oE^R9IPOWBkW=r}> z-o-WnSNH-m<#{!iJnLt+67xsDLuQ;^;mPZ_k4oR_L8J1jiAz8;XC9^-*(7JKf3+EemMJU|D^5rXgPy%m z!WX$2DJx=*h41xjO@)Y!D?7~39b<-b@d?Vvf~UZE+o-h_I8A*r zeb|=^euXzHIjSaNq6N7oV`qnEXED74b9cjPqm)Ad4asXJ(do{|XQpOAM~nj{PYC%! z>5&BwFhe>45t}dJRq^8tE;03%1SpGGsrXyF?(Y%U?zWWKbE2iWlAb~wB%M9D@_D%% z8nk5JiHfYckpw$TMl-+a&rvGl*#Kr+Y>KrPQ_Z-d`S}Cba14JDI$?2M(;y4*aueiq zrekguayw6%so{tN;$6+>H(oX%gR^{lyr6c(=}$jgOLZ2p(n@x^IxN!mN?=FsV#m7X z;>*MaN{ILujvS$H*DOmqEfYC(BRtI-ERfI}Ae^FXRAFVWKgr*A=@Er1P-Lc3H!x$f z?8^JQqQ+WJ{j(gRkf1 ze17NEm>WMcO2rW^48u)LFG5V026p)5F3D3Dk|=CvAz_7mJ``Z*^a_KNu4`=tz4VF>Dn5g!&bJlbnGQDD0$s-4ziFOezRSY`-H=fNI>;-r2{d$brJ!Y4H4-%R*HcPM9E1gtZ z6XbtmbfxB=urIYjb5vZ6>n7lD%d2vD@70=@k%YR;I&~?aTUZ5lgKj($+E)7VcB6!_ z1p0dZY>V290U@NlgRa2|XUQ$UlSmYS(<}xsWagHcvM`%aiCE@1#VMa7aPw_6vN*YP z=_ftC0TcfXg6?YNQ&~!)gazeQuPr;p;>?+wd%nKyvOKhdr6*)?K}}c0vgn$muNS_S zA9`7~CbudpGD80Mt)MQUrHdSw;C7IaJ0PmvhyB4nCBKYLmKqkP;yvPE_DG1%zd3Z( z@kg&UU6na^lY;*+aANS$J+Q9k^2x!g z;9~sXnDQd&?z@{vaNba3GTQ`y^m?!i<8pmgdn47r(mZhthB6iQ(wqs>?wqJD8RUkT zDb`PY16%Cs=UKk#PQ_oa#l4=m`hdL(`1l@O-N zj(Qf4->IHy1{2p zPbXRAMI&N*CVPqf9zVs(rL?~K?L%r!K78)ydF+-i zJLC6f?gT$=FIU{4wD;%7>h;WTXuZE#&H0`>AHYH~ls*pzB%OW!8$S%6KU$;~D7~Lj z7j|D01uD}RsxKMscQ~Rt4II-$PoQp*F=|en I(tghdPj;9x;*L|Cnj>Z?%J>@3V z>&J3n4J%{LL4PRt#X`Wn+C;v!6kyukufuYNgNayPaJc655Ye0r=pGdk#NuGP%<2tB z;e&A7YSAokOj2iH1n@=D%KOS%9ux05Aa4U=zx;4j&JM(WOrXkuxOjZKEdiS1#vo^V zS4Gq7lz#)bQT91N_$8=8M$%0JLl0r1!pN~p1SB#;9C#fuOa>zsH^(>jpSyoJtBDQaLVl=L`_fqf3V6uZC6! z4Yup!45|!u3A#*0CyY4C1LGUsMljj#qkBR8uE@y+1+Xmx~9&l>Y1LYu9-f4&iAvOF8S}4|J4o>4GeSC?*4!hQ58~*M9J@F znw17jl`R(hkX{r1xLjtczQ{IEb|NjMI?@_NAxNxr4i#o7N}5e6M4?%3yjPG<8HnVB zb4z!TVdmP5%~w^lRxQJ?r&f@-A`$aN`>Jei=mM;=2G5kjHg00(Tpv+M z6T*-Q3p*G`13;;gEw_TZoH0f{xEw8$8@v10qLE&i3JMU_&oQPtjNPcC3_3!h!ks~C z3PKlO%^?C_y7Zm5bB=XimEGN3Kr-n)*1ESg501^0Y@HefQ}xv|S7- z7W~&Ga}p?2ZO(Jx=rr<-1e-g7Mbl8HpIc;rjEi=R%m=PhrxBv%npT0Zr}FHV>!2^7 z7&tJ`iOyy=mld`EDY15Z(x(Jm#2{IB$q?B$#y2RWa>yX0R*MMiFolW$r9t;W0YQLp z!Dh!uCSe}?4Tvz>`uJ07HKLJ16Lrpym@merPtg+*#;+RsoQ7}bT!w?m^)16%=i7Na3pI!YG{H6o<&^9*DlCpBv3=+AIC?Bv*h_U*fXg-6@H3frKi=|1IhxhgTT44IQG~}_6mC*tZ+Xu#3GHD{-5qp5sBy? z^yTCGs-N0NfmO^~?E&>{&z>>MjX(Agg%-)VXjvCFh%mOA|2kPbQk`H8fiV82r5c$^ zrL)m(8295l(&v+liUeNdY8>T)!r#hOjGzXnH?a!4z&J?cuyq(T4h9h>B)itGh9zlv zRhrVlJ`F#MStCrZO$TC!55;CdGm;L$a0+f~N};c;!ybpgj5BWpeUlV^N)zL9qmZ5n zMwA2uBv3zJ#9akcB!HfZ3m`H9GPFU(dsmJjO`?Lm2A?%?iq!6>MAl=qjD}aUgdm{- zq5p`s*&u-9olzuE+a=8?EwhU~IFoE{4PiVl)0Ieu|hg?#2R|drkuG|3j+iH3i+%uEtVc}+4o$ro_29cUsIL-;Y10{+elXQr5s zNPSple*_mlh0ySxM6ex-TVDL-gn++f-RiUWe4rDkdP4pnAMY!C^M(4Z=7E56Bpsf* zg)Gy3xgf1nJH?*I4Dz6bn(wKu1&?==cYx|;dsNA**JA+1QnGPvA3dw-8K*2=*DLk6>vkTekbnb>wwTR`PViBdcCuM)44c z1m~-e`oR1`OHzWse|gmNMzl^hjY}nBL_}G7km$7eTk}H~L^ICFe{t8|g^J31JTgZ; zddeu~+SyJtrA!56?;&LWZ5cx!ZAS{aZAx4^v}r{03W~C-rDkn`#HXrZDM>sY=R>un zd>}E9?3|_WclWS|0|Srw5KGk|Qm`UwiRz{uMUsVgt);>{Oq&V&rMwf03G|0a6^|d0 z=W~~gwG->?u0I+=?CPjen6P!+qT#KWD0DH}?^Hq$r} z0}pkb(7$UX$~uCb#t%w~$^~phW7)%kjUNtJO@DjG_T?vm%amK4)>hb5)%Q?M7Tz-) zFR|NqxhwXm;~@_(?o92*OuE9<0ov#fOiP3p4>Il@+C`O1PX#`+VWM7e9n^ zp`9tmQfRCbW3TzL%5n#Rz%D3$UYavf78J$9-KuF&_P_O;pp-RhM&U?=*$3n4bq&<5 zGP}!$m8^)Zg-01rTY=ckF7h*`y@RI-3Xnt!$$Beqd zVM88b0!mZE&PyK0yH}}8+7zbQ!O;swYM>APE+}+el61$;F%`FRWO%EknFQdRu?F(7 zVaeICsR;zO%*Fq_Z%7FV`%V%@>4g91d~i*SxI)D=m~SMdVN{J9wj|yHUw}={?AZ$D3BXyc8@pMvVQDLpY~yrPiIS=WTDO|4#J9 zob1A!MWmk&Mg7e=wMkR0Ov!%bjjGNznK{o1oh3ys3I@sHbhN#JMag^s#tAeBddo7K z>1?UD9H*595vC{ua?WJtzYeJJdxRWD#R^Uv2iwa0&CHVKF?kbREXE|%iGzinPufrCkc$~&L6iu8Rh1ujwh@??wV4BQR&Fzuf+ z65L=K_>D-`EkA@q!6W_NpZkT`#6oB?hwa=dO=r_wgfnpJKl7?PwEJ;M?cN%dkBV}L zYw>D(KTrQ{X6{D)Pm4y*|1V8477ifC|H=KR`L5?VY(wpSr@e!YGIyj@918~Z2HCNF zp1%3fsC+lX$+4iVh1sZUqA>A=zU^8=cL)_%p~_~Y_i!)Fh> z>+93)-(vhG@xMZczKp*_|0(Bzwgj|y2O1g~ShxkGvwApVN(IKLtL6L{eJ z^OgeDPhah2>{CP%bsLuW$vtmJvu7cG@7~~Bl}s`3wiD3xF~;bhS_dtx*mHin@X|PD zx~wNgboWdDTbJyETwrnZU^VyDrV7DeursbpLS6K0+2ve%!fE3m^QubnU6<(fiihay z@t}@_Ldi$H(6RCGf$+m3Rr?5o2wvad^eg0LOW@xcUzyXt%aLODx2Ik&`Lv%OpQ~BS zVOEsi2$26&^R&9tOf8*X_qz0cam+!LHWv;FfM80>2={a?FxJM!c;CYtAxI)E!=MdSA;xb?DE+boa_g6tIG@A-^3^)f5a zCNA!=3xVDbApa%NErE<@(}l*MV=^l!Q%v9b2uq;So*T?`K~}cFg?jD(9E1oAoC)$D zVoBg73>`E6)gQ1hgZxArEO}Y(ZUo%B&*)|r%DqxTl3C{R*2tEAd$vhiYHL~!Ht*Ni z?{!3Ng5O?Q2b>VzOIoVv1uYtG3qJd^Ufm8`?h}Kh3qs%S1^diR%9P&lS}4mZ{-K`;x2={V@Ox-IW=)A5j5pV7gv?d zGFeWH793V(s%E0L`oYSwFfHBjMnq%f0a=Ik^lP|_eAPG_n(7RTj|1W`k?(Z~s`xI( zTc9)Wtgi!c%!ed?>gRd{qZinf{UYT8GQ5r98$JHFk75MM z={2;n{W?{Qb7HFn8IP&KoD5eF#e1q-b%29}=*=Oe@kRZ*MMFK$2||P{@$1k6r1N+q zf=3|vX>#3E@Q93llvDovMM!$QGYMv+FvfJhs33+zm-?p4D`v9U>3*clzEWeVEU4;` z7|uw(q$igy0)M<5TI*m9euO?^RHL%})4GgSlA;3LSgd>e2; zVXql2GdYddp+x!y@N#*UD+~{45ntdLdxc}VUN!Fipvw$ug^>9ASwafEr*a}o36j%_ zr0qqKGILe!S*hPIDt8$LJ9)(`6SqJ*6ozCpkYsF6@+^ClkkB~cApv@;p*;I??*)jV z5@cV_nqDOrDuJLXq2tP3o7iEOvP=KzUHKH4L3sZ%z6%uE$SmVfTsxADxAp><$<6Q3 zg@|p3pUK3{asll2s11n?G)k+8)-oidjq_EX;_9rL?)c~ZO2rCiS`1yGKqZIzew0B+ z>!T6~f$%k$@)mNU{|YjzVVIi;<_m&Kk~#=K8d%|{wAe`(W^2w*Un+2aNX7pPF7>)X5l=N+lBpbOz(>SafSRn-aK zIcGDN25G31NY5m9o6hZ*e1N+tUQJ1=_y+C@QPS&kASU{<`hM=h6fvfT1k{s+bxkUE z2#Bz3idE%tEQeEh(k^@LL@OU+$%XXbBO9f@@TEAoPy$Ex6}6@ zJ^)siM@d2)y@jCUSB zvzcPEOq0mEP6yL^n55l?ad3}_$T4uBMcy-nc07K5mv`v0(0`V?5KWgc5WXhy677PF zb`e(S4}&%a+4dCekj3@}sk&%4G_Whk)~GeDR4!3Ye4=fIUfLWFXE&yn6?=9YHc&y= zeTp0TX%;`JuOJMKLI4_f#$JEhfJKISNtoXYk4vRDc}l)1V~-~PzKbuYol@IwYoTr3^zE>$Ic zk33}TIqI4wKw*jkX=`&6^JH#iX z-KbA(UhNuWu2YY>aNY|X+RCoPL1PVkoW}6E4?%aBkE-xbOqW(DF&yt5yHN$4V-(mbGcja@qSuD=TKXE6F1UTns@%}| zNg<_%h}mkh1<|*ej%-i^laF}_olv=`y>f6!PNak@l*A(vE~-4IewOF6W@WaX|4s#@ zE%D^FctZwhA?on*8&`7;8RydlD>7b>Emdm+r%jUMV+AQEO2CQ#oxG zg|-u}vE^JcQm%+5lz{y`q=_NTPuQ+X_LHCJ*TiBt;X^3p5NbIK!TTJ{odb8HYGF@V zJ23}P07jsP#TybB5|-~|PXwf*&TxLJ`Gx1oFmrUno~t^-dt5os#yiWbhv;F-y*jmO z|D=-ql|YjJ^b_keAQk3o&yH(V;Vts)nI8ded9A_evOG6M)96JJ&$fGTg`w{m6J<9| z+$QcVqKzru8Wqms_%FoW`axx2*DvBW0@x>GX`6$c&VV{e2+!&8XL)ujq!35t@cSo? zE!f*^sp2;kQ3H{W>JyuYYcWQMQ;eROr*M&bHiWP4d74-nZv3E9H$_efFfY{zXO$|l|c|)n~ez7$6bf=2TmdZEIxbI1sQ$+ax z+Lw)DM=q_Nw`Gm~Jk`f3PEB&_HeNNPfwgU0ROV4z>Rzf5=)%}+ooUb_HA<-EDEg}! zu{J|}m9W1|pdLjkz0mMIUfrKBDN0Q9zNz3s=e}|Ypl*06N9BITJfU`NS~(5`MqXx3(l^J$_XGAlFRibyt>9Tsn;+=A6PFo{6e7P&$k(_O*s% z^CMsBcrkk5N7y#|`OugV)Ekdde2d5JjwbCq2dVWsjWj4|jnlh0k#EaZ!KRw?Y*hrU z2&t5WSd>ASDB`#n)2q{3<;nOd>vSm9J>9b;=mwXIFbT_?b@;8XA^m8=<`S%})o{J6 zFG#Tg^YE=S6ZpisvleHKOpIacwxk3zZ1y7@b0SeQWW}pIC?qf;YFRpN=NR58>PeR+ zChhN(1oPe&)f1=5Qd(g6j9RsWVHNX_UX*t)c1Sh^w_iSO?Gb?U?bvlSHS?_J2eClZt1*NVro{L4jf4HF298633k z3GkEl81=aQ`6N#70U#9^N;7WRW_=@LHAMU^FOZ6u2y7L6*hzncMey}mO;kms z;DmU4>?jmL|8!RscQVzn_75&V+z8|5<%L}gU&1PFmz%F{D^X^a)p5`%S{Zp|>K=4jfgtq&NA@*7Qy+XfjUbj-yYCsA`+ ztp~1-ERh5x_TW$3CSyHsq87l7qy3ta8RMMJ2+t?#!-53BU^I9d?qhcT28s_Lrrj_~ zvS6_~JbvJB(%RX-8=_X!lELl9d>z2^7*@hBw#i3F<%xY_J?Jzg=kZ>J%JoB_yqOBn z#;y3g=r2Xr)GW$r9xZ*Y`s0yG;dwIg@SV8ztv&*R>1ZuKp4=$(!lc(TKZM=!wGkuGE&naA4M-pz z16e%h&gp}p*n*(y+kg0m?1@$0d#(r`SeIx&*zVI$kyz>aWDa=rp1n-?2#4NE`EX4I z64U+i!QbhfYo5wCSkT5Vo8|STo+SH0Wdp7kc9l4OrbUVCG2eWryPxAVURP%3;JIG8 z&x|LR#1|R#vFPTbM(ebFkU5HZ&;N@hz94yTcGZBgM$%V4(MikMJnTlfS)C&EUU-!v z-XUS->!ZV_jM*BZ68fy0&5;6&`OuIrr#!4KPibk zu?0+SjNC{s>dGD#bYOxhCk8bsWJWk27m|b~O*|*0e@qtipT5Ub(3KOj5>JN(#Cawb zjxz1A3K{GC-x^3a4Qi3QWV-Zdjh`vr_z?S5CAduptHONS7Dp9v5B&WoA+B@iG5A~s zw}JGQN!jyx6kg`d#SsZ0o(i1DQdFEZE131R-h!jPzm(px#PdCH8)! z)WU)Or48Tp3J-iHPwKE!i-K0{;Glh}K0O55nC9Xp{cLn&xU9AMns8nfxvD|H9nTN~ zggCzw-<|+nM*B! z8+SL)ToX@$BN0~qGxTB~IHWpGyFmF1=E5IHr_5_W3=0%#9eJ>|CO2d6v>}AC>MVhF zg-n`TYcJ{mJB7sIJBhl?^&z(xUsW{grVe^xU$H4<@Y6{`DEmG8#;EA^6xKzZKi5&s zDUwQQR@+J!VF!8I{S=1N`s#_o0Emg(0Y;PH8KnwXqZZp*7&%s@cQ6HuKz3t6526aC zA_<2%sw!fVZN(ZLCkIf6l7l<8{E7i%+iH8bK;r+!434o^W>v&#yqdY*M9$)g}oXiQVp%1y8xsD8h!Few8 zWG4)P_oJM=`tITtnl~JC$wQ(ccrl#(s&>Jzu?gP4hm=R{(~DL{UEHUZdtI}FuQZ@$U~L>t)}Ub3s8tVlC!TMxnqW>G);QF@ltCykwX)k(MY9{% z;(uV~EZ=dP{2V?oxMIHvt|lI1?Q>o9oh^kB;a~;Z@7@EB4H|p-==~0%fWPX%}snK>o@U>H&zKR zl|-d`^7fZ7C3Uj6pvj26|JQRN4^aYD*}RhshPv^9R3LLrVYTuwki(b4FRKpAJVc1B zlak51&EDQc>zDNE^qG#cef~Tytv(?5`y%7aEU0|%BuG#>HyLbVUW^Zo>e4L=8!C0< zKp<#SwMe@ec%CV@HqUrtcg@*aNH66-n0uH#aSN2Crjtf=+-l>~ecJ7?DN$PtIRp`s zQX-5CaCO-Illolkwc;+BB<(AU$${vDktanM6qTRZW=WLt4#7W~eMyjpSlKd}7?OC9 zXm}d6@?80FaF^?|X~V-Tvo+jo)Mh%!oPVi&FGR(o?A?+lP&uY8ju55Gj?~R}M{Vb~ z_{ONPcQr4k`iGF+$b1+PXN5tT-%CFjEA$tBVFmRc6j_S^T;eN3JS#;U%rD|ajT?c= zX1K3lop4avkZ@Ax|DG2JUn&@|H7YpRQ4woBgJirciwz0-?b zGs7mN(z4SH5~mCmFIRq&pwgdaqP$;QAT?-)zKQidFgMc~$>x|_;H1`x4}#THgMoAS z5nD@Gd|_$K#&k@wm9qEw!e3KedGS;3|?OI@Xw!*PA^FHGm2i5K{5#+42_mnNalolYb+mBqsk{SJ=df zAQH2^x^w=<3P!(mJLJRSTr$mzVK1%5L*?(!RL3p<2NI~b%sZErqeL7WMb_5 zxhH^v>3aV^e2kg6{tp=7|FxVK$jtu#EazqVZ(-+YJv)a3@uV-m-XP*e=yda5cVaA1 zz_>Z{uZwMCb9>}A5@O4Y7S1%uz@&=?|IcL=(@A<|WdLVDG97u$J2@CBDeJa;E)0|d9*T{lI&d}JRK;{m)G@JuW!aS67 z(1~WhbJH4^k9xT*#JDqea_Fe~fT=RgSIBfR9PeLdE7o`)fL)(Gsp$f~;tzIJ&_ZE2 z<3D&Yrll!|T&dKT{hdo0ziA9jnU8qmZA*io4i?Ptk`~7-w3$(uO|^rik^p2tK`m5( z{64z0`G&WjhFPg$Zt6@7On#xPc}ke=g!u>)Uel1~AXy$RvLpo16zskl9xTHXpj7j~ zOS;P@Q>$if*MII}PFN+DH3gNH&F&N$DoP$h2I8&8Ijnq^z%}@eW(dK@$wunDy{kvY zVo-k#|66AeBjD{uO1ApT>cz`N&ghsELaRS6}+ULU{ya8Ii8>KJ5`H` zu0&1CvD#S%aG1foO$9d$ZzMl(pCE}5g=v23S^z$~a6W)%3xQ9=yXX!EHHBYK57)w4 zrrBUPYbB2UuR|X~zwh67+Az+OEmfTUWG-PnC1mhPWQ;1E0D{_CUt?2fQ%q4=Yq7}* z-+XE=+XPjI(5v++uu^EC@>Rol9;J)*8rWk@t^JWOhwq7cNJIDwPb-D&K@2!KOigESD)~s!xZ}5kLY|rASXYd=p0d^>4-$w@4?`Cv!$`q5rc{6 zqykx@!XAL*VbJ@mAvyyPKT`~AhAIm8S~Hi(sd=Rk8u|trng_t3tLDBR#zQHaIruxa zR*-7MD{FB)H4-hJAazLtFo4u_F91XucP+m(fn2RO6dZDNC?ErFuA$VDTuSglylM== z6Fz?3FFHUgt`JYq3jAOJ6n>2rg?lWw9-oUHk*gFB4EzV2pG+w!A`%1M0vOp|0~B<* z5|g%NAORRRJ6dB)JoHPt$Ojup6dkxuUz=<|4(@MXJkrWN$22UdeuIBrpSPYWdc9Ve zZtkB({*8lG24}~6Z=EfjH5~@<((F+?wY~3xG6K5)o*)02?r%EO`FHrafBO1d%l%t< zcYnFgICXz7y;S3s_%uu%I$3J3Ux!IwUHXR7$=5>-! zG#lf3vt;Ie>6w8)KQ^)LzMfF)wn2wi;ewva1x_eC&CZ*dk94>#Hf2>rB4#cf=0qv< zt0oJyOe6UlMm5d8pA(<<)vw+0p}twHGVrT*8r1!J9gJTkuA1#UcR#=DdF%P+sQ&xA zx614dv5aU{lt zL@cqV9Ez)VdVM7GXy8u#>+;L5eN+B|{jQA4cCnq6$J@+VXD78PJn~4~cVRC_MVY;q zUm!L9@o#0t*{{|6kU|t?or&2yFfHnJJWOR(kjySBbKdib(aI`y+KMEQim~|$b5|Po zp`;LfYOW$%fieWMk-06mM>jQoeR@C(mQj%p2P4%^Het)=TaW$Ou?km13k<%QGuKf= zV^K?Or#gGxm6ff11#5j+60L|C4^r}!wnSNO&LU*yrrYh!D_bRXGMNa`OA^DOL14|O zmkP&bl4?b2uC~@Je#sYCW&V2mrpu%Ay6vy`@XwA5RmZv!aeggDId(_Mae?*Ryu3lX z*Y6K9E^$GK{>+i5QKW)#Om=YP#4FBwE$NQ#>a>Cx8=@_^b5fGIh}y};)MZw9sjqeI z(`IF7$N9$N(p}0}#l~cLd2wUj&0^Zj2d)C-gzV(yL;IrvXxEd& zrdT^3e)i9l*t4V~b!p3Z8Ar6vNm1f|012r_K9`rWwRC}+5Ki!X z#NNbTPoK5&Q&aN|)Q5qLa`sVKx9hKkLnmnq<7%lmc!Zj5SW#WL`{T2->uy@~lf#2< zjo0i|*2eZ7V{8m~m`5Flbt7|D0CQRDYb>=^gPM)1;d^6$7606n)-b~%!fe*SSuGKo zR{IebAF1Z$zj8?(xNAKEf@NUJ>_7n*SBZ+YlzsE04zZP{djeMri_3$}s`zDNElLY4 zO#e0k4$?!o=NvNL{{5JTbo z9FxOkRRkNHM*12k)H|Nq&j3I%cNbq%`YiM=XRyNz6^#a z-Zmxy3q98zwGbK%}@=IQiNf zugotUNc&Hty`yGlrBhgTn(_CsEm6}qpV_O^HZSQVI?L8L+R3>ed4#G*3yuNfGK$IM z@}sW9%3+7q%-MV3M3rhx;`Sm=7t57|2x{u&w}3{x>%FrcTQamExJ87Ihb146MV3=< zhgTs@6~pRgOZx_Y^XXz#{|OXB^DP&*-dC}%IKF6Xuzb+EUA=Y0!lw*J4}CFdYNhX= z9mR-JG7-<5*@*4;yB2!=Qh6hcRc7T~*o@t1uA1TOvWvwl_KL#W6Gei)h0sG@d-Hm% z_gdz<)#r`jg>nxq#gfw8|W#VhcCTIDaV*gsOvFU(hwXbkH73R z)TT$RyDK{4kL-JM4>P6Lx^8|XtHKvLOH*@yHoqo2Qa2Z-@c*`l2IuMn`^lGN7K;g~4Ynzb`cHbMdL{wwb3t9lM~b zG6t?Ao-{l0+Fog2W&T_#gZlyuhv2Yu8r5rBJt-^hnx59;a#(d$@gGq8lk47+Gr`Z$5ws84S1m+bO?IF1fPL=Txw^i(de*xGnRARqQ(|#R+OI;q zFIs7ywYdv2YtQ6`im55`aUGxDVrh-LV&8JU*JhQe)NDIiQLzeOhrV|7Wel3k$!>78 zIvW=8)u0S77f&-nj-dvN%0m8oTur1s;ug05Bm7Buk@cmz&(LU3bZ)oBZt-4PGK*N^-T1t|tvWreq)rlv zuGiH9kg*SXfvZ{kfUtd}OJd)|!6UQwu#Tm3aa+nwdyMneQ$L!1vb|@mMJ0qRTwkZv zP+Qmn3umwU>=iyp{7#SQb$|H+Il8L)ZC!cnbIw}gALqjBjeb*Ry|bk;{n}$CxA9=@ zx4W&}^ZabREYG6_Ju}CC*%Kr_`L`*YE3VBmVNuWSOtUt~CoU zIb|6NoSt1CZ;8uV;j#z4&Kj($%8SyyDF~YW8#6VU;c5y$Ook8(TMAv@ z4F{q#g+)hpk}_5#Y90X>#Ptp4_Q_S#x0yC@6KDJd2-sTt&!q6V~r93A~&1PE|;b1wtEGetvEC zE%4IQX^ZM=VemVa_b24p__Z8*&7TR|+sWI!Ioshqmd41vj7;9pmq8zi%Ik978}d4Z z(8uJ2;4e9m-}95Nu2P;MsYC7b4|ZMbDBSbY33NtQBL$}0yWK)z6cIg+`b9)3df#~+ z$a=V&9-AxIYn=TB4;Ccz`RisJ^_2ih&D-Ljqf_p6OsO_VZv-<>be7lr0;klhqmcu$ z-ROjj?w{Emw?F>xZ*HyEnGYv1iFSQ*2USr9pzN%6^l?OHkPjM2d`&?#+*i~BX9b`C z^tV2~wGX$RRvr8-u{DU@C@9`{x;E9$bus*3FW-pUcqDhwl{GJztNU$!bulpQ0fB|v zz4WAZpVB-%B1Ye$x>B+crou+T0CYU`vkQH|)zOGIuFo8K3LQYXfdKGFYr&6%J{o8h zj~o`FoDZ8i2HBuWng(Gkox5gTjl6yF_s#8{_FoUGZ~i~mBBR~#K5b3;uz1p4~ceNfWj&FMBiSv%_nAi9c z+6|>m1Qr=f^{`EH7u3l{DLSvS^w^&7&oy@7)}Z$bur39!$u`ObiUdD#2E?38O)_K}66eCcoBV4P zTk@v8SrankjRbT%Nz1{i@7v!~L8WNgix&-H|A53rhN+Ack`X+KH-!k{Pela_RTYIa z40-`etso!kEVpGmAejl-;bJNsQst$RC1|r$-Sat7gjP^Nx1&8_FK(mxZVE(z7=J~= zxlh#PT&nUn9YbhO)iEXdw5N(2f=}kAJg*g@%co66;^Rw8i-3vJV+h$C1o&3rK)Yj> zW;}BiOr)%6)s_I*TgXb-I&CD8p}tvAq~Lzj8BgTT83*)PgEhOO+}K`AbRqBiGuaOn+2bG*%iH`loo#as&4buR5fzY6S%1 zOO7%u-i6y4FCMBVn|N-wN{I)EXX-xap=%U$!m7n>#GY`x947C%=qTP;8FfC?oiCC{ zlB1}0{O$alVjeCMI*2T#vehK6tdIN{a1!Da*dcP6a+NLPo zx5s5R0N-1k4jq-n#Dq<7s?->?fpw8ZkWTIaA;EF@+IqB0+|sO2{XM4jAH|a2ZV$;? zS+Qu$Ee(=vQ_lUV(cyU9GTiOr(wuO#mAPfX@O?%>tag(Ly|yJ#4xYX#-8>XaTQ*r3 zo<4UL_EIRSVM`|>@mrEiTlQWEp8l;7%D8B&6IO7pMFAm%n$nnyBn=RR6cM`rtlH0m z$Q{d-7sZu#H_tosH=aTGdZf7m{NYF7An02{-yVoBCwzExXe2(_Wqx780O*NG6f}r5 zI%nYzm+v==UGQvja!ObbO^(D=AWCOoNQxRQ38R;dIVmypv8H)S_-06&rjaf=bccr? zsVORAsq|6n=7V-Mn6IW6!5P8w*O{M~ek49s=o*GzS&#srEC`api7Yw9AJg#Mr%xVm za}E&?af@K&0;|7PX-zIJY7PSmf^sKGS)m1_%MODX zTisy=Xy$e4sX|>ZSE)spi{dVCl%;;wiRT?;){kDxFWKE+`(&{i69znI=>0};wr171 zxuAAQVmq^JJjCGD7IC>q=O(#WOmV@gN95W@)yqW0=0c?=vtmnQK=o=PlLdIX#Xv{d z*NjHw8!o;vld48h)Gd&nSR&5jk_Dm3odZeBlbVRgNHflF%-Bf`6d-B}K_9K0{$=fd z_UUqK%PXr0jZmRO(`cWKv$7O8nR1@0P0iyKvZ#a6aPSr9N?=&7=x*P`q&~pyTO$4= z4k1vn5FgjpZ^vEWV*iZX(>IuqLq^O~^-Cc>1kZNw)VW1ufKG ze7VM;bZ*HLCfb;7BFpMb_!V%LTq!nctNwj#T4rA{7ru?1%fp2yiFE?=sRWwv!QrU? znDJK7Ng3q)K`V)NGvQV0wd5EFwbct&Aa8>U!EGQix>L*+P&ACaoRxTF+BsF$SVNlFNQkY@1lDdD3Iap$Chm`^;!ijB7^$@-&V^D&Mi zj;WDH@d}GZ>VG%*(a&HR0@{#&i2 z+y6sMoQ;+Je{WF#-(%uT|F4)h2NUqWA>@wqrsK%lfA+jnpHbnKtKD%(3eLf=-Sle+ zgHmG%KL`Xd;FZbi(O({~50xHC|u#&P1q z__V%8V?CT0oX9ehf92vR{4in8K-WS@E|02$z+&DdL7Q9MoNnQ{rVr}2@q*zZ{WrR2A-g~OJ?Wl$#;C#rcpyQyqvexjoI>n(S3{P@DY#Jx zSlYa2p-#I>c{ifF^B{W4hx`eDv7RX`GjU?mS<0F4ScUZWk&PP#X$Lh)l$Bpco8t2N+Q&n}#)vJ5EOJoDgUpoR z=aROBVM@cQP(!lYfdC_6NfJ2SQptrOh%r;N3#$naP9W9@PP*bi8ZfOMVrguJTu$~z zkXA&>p*{~Fn+-;T>hYE_)I3A?dM(4%zNA~n;JwAlBM~rqa(w9 zx^W*w1Yvz0E~nyHh`!8z_|4jd3yw9BSR-TRt#o za}VGK?G4Y#X$$wHXgPsIF%??fMc9w@fzc1@jE-&`lD>}~Q6FNfqKU#`WV8qYNVX*u zW(<%P55Y!nwM9;|!}bO>#xqRkm0|=yL|E19pp!PR3#dm%q%E!yQ@JCox^Pe&plCZO$yhbfnSOww1{Zh2HnNGKF7$a1O$gQltK>-MHPg=dLFYCm)N%UpEeCQ8TQxNiF2F zz&Q^I-SV;?j(m>iZo|yj`v`P&x9pG6QDlR!F)R6@;2XYD)`10>W6ciL#Ru_JhQL-r z7ZBE$+EwsK6r|OMS}hhE8!tm_FHydFc)mjY`g7FBT}C3Z4G=t4n}MhXj#3b6lX%Jc zlS@?C1acxWG(7RbiEyR`a5NIH3s6{6FJ#F>`OK^Our^#xDk!Yzz~KdvQ7EjeOLVmu zvfW~$85qura27Cm?l2a1$4VY{F!{5+n1Ez2&i^>&W#vX4mC1M@V^M=HDma*eQYs`u z`dql(G?qBOOGwy4pVw5v(<{QsVg32YVLPN=k*47(quG=ia#X9SG2K(+QRQOKB`dAb z>nHgNVb_j`<{`-MfQ8hnHs;Gg|7BcQ2hRkxyaJsbcmU?Nv)iO1=JvP8oLZrKc?&v; zJ3vQ>?EE0GuUtL@OqT=0PhA`xlLGb6yuX#(o} zp>zoJtxQ!cGfjrh=uczda8ymb%w!c4PkBk4Vl9yf^I2l!Vk*hVT)gaXEC(Mpn25UD zuS4T5T&ASRI@LlsP_{R6xkFm{$gy-cP2ihj_121OBBvNPwuNgXzc+b9dx_9XC%gY^ zq>XHQAyzGfIx%Bd@UEi~8ykdNTiLswj#rCL2#I>g<>|>hP)lq9-1J7yERRHrM zPu(C(j{)39Z#aqq%h?{w^`3E&J~VViN=UfS^d{W+vT6 z)LhlQP`49H^ccRU2$G5z-v*H1oZKBE_XA_bas_MhbStdCxbKY~3v3Z{i}xd!*p=fc z(Uv9oawS#C2oEwcVbZ^&Jj$Dre1(#BWRDS~-#v7Lbo}v-v9vDM2$itM`%bIB3caZa zhsZF$IEVb1bBdGrha{xAdj?2~8J$^G^Xg|} z^#|R`CbJe|O%YEO;iYZOvAs4-4Sr$_^iCdkPTat{PdN@AamRGUZ-MoYqVWnIk&(;A zz{+F1;9Yu9rqWZ_>ZKx%dK)JdJuT@?8(b;vO&J`b?Rk#3`{#7h27f<6DZ1AgXg43Z zBuxb)yWlVHMM7(Ac`OwgGsx86K>!21(SQx{W_9@Tbd#}%08%B2MY1T-)G1)$v{Hoz zy4aKv_xGTQ#~&i#$oTT*)A=EmI8KY)wfW;2WJBsnYZmEgzEg1!rBm7XZa_sED|9E%Xw2M~^NF z^&epFW6;_6ubMtG0Od*svbbYO18xjBPDr{=kOMVsNAgO(lYzx7brualp2WHeQ*>n9 zti41MM>3y!At^TQPDO%V(!&`sK)Y3Ytf>`8>$V?tG?hB-^Xf;gDwoJA5%|AY`^uQi zf~Y-Yad(GZ+}&LkSe(V(-Q8t@#ogWA-Q`6VcXwXg-Swq>ZTh3_m$pfpOipso+_`5m z$t2G`@|=GuqM<)-wcv?DehJVJ8vSY(Qk)ktsaOCqd>1d8$^X@_5lRYY97KT#`QUj+U8$^cL4_R1-7&)OP-i@J9QoIwHO^k!Ox`fH0dxI$E`|zhJ`E?gula6Q^887YqxeH`V z$?zmrAme-UXChYmVkS;lh~|SBk~VL$X{BC;0pXzeP!^=irtQ+vuZ>yOJW-CAj650GO;Fz z@!g!`p~xC>tcg9NT5C*=f+=%uhrP$R*N6R}SI3 z|CJmXW0PZrKW(#>lMoSrpm4@|Sm~t3Zvd-{g7E&dV>rPT?c6Pa9x^EtzXk^raN+d3<&lvt(pfH=v?VWIVHGN z3<8f8eTR0jYnI<#LPD|wy`k~#VmpH;F28&Z8D7xPdJt^sdFt2@VT{y}{mv@Tf6Y6_ zzG~E~Z^*XtJX^WcBma`UNa2Ca>jfa?lfG28rBCTp6QxyR@?`dbg26aQ@*gEi%jFREqfv549wb^}Fnmb=SjjloKsD z6)gc&xpD-&)vxRXzsY&oGalIaFi1m@Rq6y@aVQR{?1Dfo)ROtl7P2k|?J^y(VkhvV zF(}0dbwd=sF|x{}swm8D3OX_K+RFhB#3EgdFSTd z#)UhHLZTo9K#_`vS^{}-e`5kU1r(Q*+nnk~8H%JOW(>KMk~F^~fpoArg{L&Ujg*JH zyLNJ2%ZfG4r_$GGmz6%L=zg?JpDfg+wM+}I@BD^ zNn)LreoVsJZe;dF@>niauuBp&q&&*^_I4dfXiz!~z(iT8q<1kpnTQMi7WgLn4{wKo z8WJ1wHy-NNvEG@ZYH_MleSg=ADPyu;kJbs#yo|sYfO+1ec+Pnwu2JdaYrPIs4+{EJ zw1zO^q;&C7oWXz0$$KdOaqnN}*v>xlBnWn&FbUMugzKV7&KdY2qed%G^#e%J)vrzR zyh(j+Oo^f5aMzz1n2EE6xq^T|77b-^Sx*Qb9@9QWK|wDNK@pVQsqw zj*WunHVMnuHq=~x(KIxUfnB>S>olDy!{bN_!qSMVMTp}BbBQ~Ta5Rva3a9m)(iqjw z%?2QvIo%X#@GC`BVMcx*gj8qf5ps95{Dz_w|D}lex)5AN$eQKY_0T;}uB{J6lj28C zi7Df9T8xWEkLm#m0@sBYL=)^h)V*Y4BO>6$@q(e1y-&q;xf1l>|EmH|6xn;b`wZA937!I`<&z#z;#t#}8^{ZdH&N$0SXn&HD(XT#H{4QUC=y)oF$#+J&2mQ)~z7Z#6y+BHC(=K25S4`n-db99S%I}cPZ8l}; zuNDMPOZVi^u#=20_xPq$xM|GLew(2Z6%&C+sf|xol{r3c`pMx-bhzo0I3ME82CY#c z(;h<^n@+&Z3NLy1hm3~0L0KK^NM&=D!x#)eyWR2NL9chTbdi2By}7pfoYUA+^juN3 zJEk`*p9oJ^J1EALr&Ys2Ff9;`Czn@gH0Bo?+9gOHTOMb`K^$q%Hk!UXxbMtz-JX); zk85DLkrfyfmby&lL?8X~(*%?sP&wgUI7_05Bgsm`AJXEf4rH8W&+6=%P2sCdTUz znd9Mnel~xn&jjSK&$^=A3FS1&H)ZAZ+5CYJ(jj^HZ~eT|$dE-#U3LMB=}IP6%YqT} zT)MI$!Zj*)k|Q$4J4MUEH^O@&%}?W`l<4D+IYClh=S=U_x6LHD-1ktUEH)nnXLCVa?` z5=&2U^!|6zj1m8nI`%1C|Ho6O?{5CS4nh3Bd^=ivvQ0@n+KX%MUm}BFtrIE)@zclU zrijO7;y+nUOB{kiS_*AnII1*Ti&>cyX`)%U4OJyST>s;2tNTP4%}ekJ{l@UwpkZ)I zWUOHXV{aNcxWP5jptHhqpoz)`qGsVLd3WWBMrfnUyMO)Rm1QWT*N6-&np&w3a|~v_ zr00bY)s76~pIOoR2McS#%)^V5IprIBeY5|8i zUips?6Xi8l1i76Ghgj)+o%W8E%U>TPWGD5#q3s!XI{!${ zgxL26aQYy{$l@6%F4=Hi)G5qpm(@$nNc>lkC{AfX7F91*$vG!a0Jo;Wh@3)fLAF3z z(9bM~ot_u%@O>}BU<;2u0v&?@58N$ zN=rE$w}suOz8u%S-Tp#qEY^+@MzXz#usn|Nh}d(p)6-lCZ)uLa4sS`+^)}v+fn8qk zcIa$Mi?ym)%7Cq^c=SsIpYD?lXjz=={WbzUqg+w?@ZW^ST0r^u^yWV5WZ3bx?tRrN zW08nZrn~;VcI+Fr{&6`eeWV1s$M!F|llCD-*-W@BMtw9qPz{;ySQ+n-Ujc_H)JMO0 zaO`Ac+OQ!MtadTy)EmEk+~{ANcydk$f^#)eK-OvqwVr*7<_%4|(Y7=T(jK=#AL3zX zQ@@y_aa5D}WqYiG*{>J~`!^!5V!;7-h0Yw+7Nuy0y#Ir0v4gQWBAuHJW)U z&l$I}jz_Dzx+gu}5z3yE$K;OhFm`4#xAKQ6aOnY@lmKQvE@=j<1+DuftSJtz{N^ZC z)kg0$t>W$$3Aa6?3A+x23ATQzu?seLRx7!j80G?3`zqpLPe(+z2R@^v{#~1GPgBkb z*w@91oTU?{LR|-o8<1z?vn3YS#q3ROWusfF{cT(XBLE8%+SeJ;ZgB?N?lsy?Z;&-p zc2Phv=NftFG_U?%gYG&nokS+FyM*KF zRCRZc{QxNP8x4$qsoJ15W7rETEzz?|Ie;VmIwk`pR+(Qw@5bo)Uh(H(5^?7d9Qhp| zttF41tlY~s(Ji}O3KUSR+j-x4I-vC+IZ8s5=MO)S;f$tz$zCj?a~;6m2r@E$8W4 zbtsRusVF=gUeH`zeN^rQSvynq5aCYn+e*re=lHE5H%?!$h`WyI5UTyRdL%Y0fcQsxBS*l^J zBx8M3%?vsJxMheNBoVhpiW-C9wf3@AAovJ<6r9LePv#=HtKLw1fQs#H+4EmCc9k`f zWVsR)b6G1G6HI6E!4vecRI8b?8^GUr9ogzg@=t-Uc0F`ZCX$@a2zOmp(_ZF;Kf?lW zSHJYG@$wn%|9)%ke66lwvpuV^?~Y3(5OcR<4ZEPs<84$YkvgJGQ{mj?Ia#p_{((Ud zyymO}=zDB3YN)Zi4#bdf)6HKgikXqy2h)JIBj`rut}^ ztgo99=y7NQeb~;^mxG1YvTWCtVviN{uM=g-HT+1yva##caH}sH4>>qqYD>R9$h1@*mUFY@! znB5oZ*TY{1ZoJZHa)ggf>RYZjp&m)P2c%|3=FyU^K91gjAOQY+k_e2FZ>=}FPYuHf zb|S~voUP+){M6ko4rh0|MZl;(&4w;NJbusNR(282nLlhgj^Dk!0lscB5V$2iZ*SQb z`iQhi`~CT`c{Wvh^Kqrm4f;j{4A*L%`hoJhny;IEy-M@xy1p!3pOs+EFRt&g+KJnj zID3cc4#Gg7!e_1t(}WH8n&1VV%tHgP@pV_iRqy`xqf`OtFZlU!doPsBq~DXpl3A9tp{Z|me3c9=i zU1It``x{hk%RzJJXVslRxtoQ@(e-@1#xxJp_Z9=RRTBi~WUcmNy5F9;4m zwLRi38=BYsZlJ$%^_$U_vUkv3(cff$Q&n0B_S|S%i%eSRsCU^6- zeF^LCOtk9)P)jtcVD3i=lMZO#T@k>;h?c6eJ$?`h(Di$!I~odo+fRjn&lFLyu?L$P z*Jo7FpVkLCwfjIRk}&-e46~!UzPVc-N6CFTx%!&04HoXm7A_|CyY8r5Mu8CY z{d~Wv#i4w>-9sS(fO69$4(N;;Kep}%m+$6HEreTdOl(;pby`^Skb~`;19FQO?SQmu z_E($$zDTauoLoX88z6)q41vKd$WimG6Za&+Ls_b^Jj<(eE)hEX>zCcNQ)AJS z%LSES`}vLj*xI%VuXo+8mgmDNM>aa8ZFgMW_!9QmJRu3hLPR4xe_%KKa$K1tOs=^Z zgo5L0NHI)BhMhPXzkpuMZikU-Fx9)A>I5!nQk>t15}Nx{$0!g^PAhzHc^U4CjwujnCXaYL7&A`G`Nl#ETh8ezNfz`HUAUh%PANS@M z&CMtyVMr|^jz&t+8bG=KO#x|)5Bx+&cFk+kRZD=eLvNQMX$m1X5YK{|LobKol88d3 zjUw+;jI_e8ID)9s@ETjJf}(sWM-WxfiB{nd3H^m0zK=$?1LuC9H0~unmXI^~j1!JeNP0omqDnx^+fpM8> zFsP(U4Gd92p0sBeyU{~Rkg{27o}vz!N!|T)0_RGHYusx(DBY+bv%x@pE)P|VUVq4_ zX#b8r?FPm#i<(dwe;Z~JMst{om|0PejTykIk|;~6J|MhiAodS$G^sK^Bkbp8bg@_& z(qbAS<6xsvIL){MR$`Q_8&ibW(H4JWP(-uTvnu$E3TK>+3A-IBN02b=p*qI1RM$rE zV?r*gc?dhYix_z)#-r&^^gN1?dQH52f?tRX%x5W*QB?@H-y#-?ej&PzU+@ywFUWck z*PE0FncGWdm?cO~e5YhH*QXgR2{VZ_Wk(;aqoNWf_tfySN;g>vLMck8&mH~pEs}p_ z8ft_i);$H>+c12C7iS+BaTu0{StiV3J=a8t@L?msTW5J$|E_Nq%8;Amgp*;&^zE)P zKHa35da}+vhky+|aNY<#NPpjIsKM6jlG_8~M|$HZhQaqyjJTjZt3)aT5t`DKN<6zh zM-Q|B{oxv%pb3rbpH`Ge)@-n2jkU;jP*60XdOP#pW9Kyd`tESJ%E%sx?+e?QqkYZDEJZp?8us_22wQ|4kw?xivl1;)%PGki z7F~)ozcfM$9nKTd4qStL>Q33<2zDX}dVDr&7eOlHEyH6iVeu|fZ{Jwr$0{kEE_daiaPxlVb*YEf5{++o1)ECgnz|LJ~uHW<9g%AqR zNO7Nw+|>SaB&aiT({P(-;lc5*N2&xj(#emMbm`@SUP(KW(?>2?CI=#1Mhz5n)J}3W z-N^5V;@KOErd|b%@tyA{wf-N@aiJF7tWHGb1TNW!q+UUC|hqju17!hq#Z)fog^ zXvyjCOR`JS_#+6Ho>OkpY6K6~Z4>i=Zic_;5wkE7Lwy9>zGVxqTn_bDWDXPB3HJ9E z#dM%+4|q4*zE23HvcNzi<|)1Gfz_(>7DZ^Ok|N_Aubn4;Qpr~<=UrZtnxFN$^0OqgBgxg} zw02Xq2!`yM)n$8Sd}M7kt2cC*;u?OHRpMNhQ5KR6b{ae=(riPkZc zqIyU=N~dWJRAs8JMmUB6OcCOXiGiJq?W^B{hiNna840>-WJ+SXp$uXgWjGaQu?ER4 z(mGJRAjhBGc&Ku0am+f=);c&lK5kgi6!NQS%B{&Ozev4?N@u-Xn6Q-6bdGAruwgD~ zE<=ARp6$9M<4`8rK8uT^Vowg?TN(Mw6YA`4vwXTMspINW^MwCUXe3UEWnV2_z~`

3Q*QSFkHMx&;9sjMxDo~1j67$`?_%R6(q94fhl-T!1p-g%*mln@F%%cFql8tcxI zK5&jIuWG(>c-1!Q{=vlIUZUvt>@2K0A4mK5eHJTtU@H~vqM&*DgeT3>TR^^&mI|!u*V_%+6X-U@2KupmR!E`W?sFB6V(NN$_X) z3|#b#281&Cvt8YHWQm>q$_)j=gDy1`H=m)qZDonw8a8xR#X~%63facL!&-M2x1)yH zsiVn)OI^Z`xj_%MK!tUzRI*C8p%Roj!b7uy8F2PQMHjimzwK-Zhc+rdjJ z{1q_KTv1|b4I9I{aZXTBVB_wq9j1As?8&drT9>&Zd*a?D7Ou)syODC~EV~8p#Xhch z{M^5lo}ziiueE!pwc!d;#A`8W849r6!2!_mJimeTj z<5txo`~Is5@Nl|L6xl$@a4p^MDLqO%_;v+B6VNdFba8QM;h@D+>U4bcaMwgV%y!A- zrR*scGO4#NVgJOp%ogpE~ro!-cb3Y7Ja}K=8-wIP< z4qNi1V9yPsrtBN+k=debs|~3CtB+%R**c8rTGOLj@gZPimSeNR-CXC`VE7^1=J*^^ zI6oSFMD@ncFLuztb9nbwhmYjEZ^4a~I%RaEy2MZ3_!pMT;p`=EL4}g9v~_nN z#i9+U%?scvz=cplybvB8VVa)K71aNB*q<%hZE$e9HmMnEYPv{8m?d`(0^MK=k`SbK zTe;jTmfBQk&Jb1Am9M(y@F~x`PAm>U(gX|Wj5t2KI4E_kjVDs7N48&|M1A|_m5v(_ z37ssgWg~^v0-T6&ZN?PRf<}m3Ax3ux3isu`bF)@@PVzPKXpQ^h+USO7RJ&~zR(wR# zoYA^hSaGl)u}Wz3XiW9}%teR>kfUDkZ0ZU;-A?L_^GqZ!-EscI>q*Pp4n2e5X??-1 zy2h8^9%RQ6e2$6gQS(4c+}jRxHW4W3BAZX-&$W9T&r~)%UD>^ScidGkH~*c}S?K9j zko38>7Tn?Gd+Vpt$-bvfqbZCgR@r00L7U(CTwB#@)5!*9etfI@jO%CiJZ86z88#v5 zrGVejV{x1jifnmoKZpNJ8^a}-=-cRLp=avgC};TE;@&Ywfl9r#A3oh$iyl=fx7W(= zgEU>0aKqS`BQ`2UEECK5ys(YBI;1@DjyJ5%Qw_)NFPAje5Ac-;V2tQ*#(0ps!H5K+m|Xp}%ZYCMVP83A$YmCG(cx zSh#OSQXk?#?0f?bY}!vhz0>oaSJNvc-|TP7GxHx|?$|b7M=zp{VA(Y!Qql}?L}5U~ z5TrPJr{-UrGMHqGsT%jzwAB{RJh@|&d=LBk*T|lYfhzW^(m!4$tCsi~zI3EXdT=_K z2GXTRa+?8ybVKvGqw$i<(rn%aW-l5Z*Iq>!k1B5ffw-q1LuP0E7yGqkf03*YYK zpH;mdyf(nMgLa%88^cygx2M@NUUy|=Byu#47cZoRE{dPZYtm4mYLf-o%^cE2<;5~g zt@^R5Q zS68Pe1hl#_vM3@B*->Z?_h-TB(0*sP*?X{F)(Ee}xQ8oik!lLWT7U57mf-SjS_No+ zA|G5wODKE90E69Ny?G0??W>pewI*|9S%`YHKP2ilMa2xX`(G zt5fBr^0$2c+~~GFyPKUn1=$O8Oh7xhznxgN;u5PN+r&d|`>y2rcYfTDe|9k;9tTo_ zJI17QZw+-U)i+)6tB#~GslP-VnG|bt`Cl_;k?8zOAtBN1f9X$_ru$Q-=SQiyXONRE zoE1qO_0xy73pH3vL~r!v{RXr=z}D<_Aa`Pf0H=4xjv(>UNL7aQ}+NP)H1J90iXB{drvhAQ86+M zzWHW;OS5+T+@X@SMJp@4s~Yg#@oZh_>|z>pV&w(CAa>+-;TtWZi3CHwX9dvI;INpY zo-8$z-MrK#P(yhr&W<)iCO|GXa!s7LM#a>TfnSZ&%Z~ti$YROF5TfFz-wbH-x0fujM&?=Lq5_ShwPy91nutsgUa2T z1oq`V*84dh<4+Pl~{^I!3ayM+!T#w;0Gs z%~g^mO>L@h3ET7%(2usM>Pb2<+@m+%8nEMM6OZ{>b?=*0wLwQNbzK1>(l~)zw9)32 zRO}a;D|Nq}*@UR0_c=Y!i*3x98wd1ZPN(;ehi?`kqgwn5b1QQny)YB4ZuD-fB6H`b zo1EtgO$N>bW}U{58oBqx!M6qXs_H*$Xpx2KNFf|t@cFOgI})qOj@h^BOrE^PS350r z=~E{>!z=a$Wv7P#f11aPG6;q;)3+%3!#)jz~w%EsSh%VRRe`EFG`6IPtp6 zFxn-Y+|9?&ru9F3{@pe$?&%8rwiHZZdg=q*fek3o!U#VP4k)5L)R&oMv~kOVL~x_H z5MH`Bx*UCfdJLW>)iBj_o2zGf{vFwqDZ_X0A)1jf-(iB<@LV$7B^(&il0TPY!ZMr`_7TdRW7s12A+<67KrtsoxorQ!HgxWbpPSuMH2$h~ zQ7pZe%gHbO!aerWpxqaWTxjH$E&E-TLLWFbJij2%_!LV{VyOHn?eZSpEqC?c!VDnH z?GreB6fY&YdODu-F609_UM=5W8PrZV`R0Lwr>}I^1wZzb-iBJ<39cUP+B?w6x8AoN zuUWj4SC?&loxr?v7lD0|Map>tuOd%r?d~gy#9C(# zylXoiC-tcA11_p!tEtp+D#z+~7oLXp^on=*R*^}%XrlmJ@<9b)LN2?hCL43r3oz7C z`g^?3udi!~j@3=I440<6)2>67Bc3MLeDi$+8U4>qm%U87J325Q*4o^X^LSJP2#wB4 zL_WzId(v-X@y^QWfSMkrY@wB!p88;)ho(Bc9x9NN1KxsroBnSAi<5n$$7aXXa<+ZN zAj0N#l!|xbMmM%wZRE@Xhr;nJ-2<8mo>u4UuY6ae_v0tz)Jo;(a~_!f#u^9PyIK*o ze&=9^x2I!Qme;MjmY8m5-zDsp`8VRRR)mv>9;hmMpCGL4Gfb>Un7vf*^vXBaWrNPH zKRS`|bnyYZYLDkjCyS3qx&BO{!!y&TXkLGOQ*~qi1bB68`Z0|@P&X6ewSCwS$h%#G zX|L%$5mVRB`9ZypUHK-&N}lTkmFY-^+Og))>jR@}Q)(~CNP;OxmJWDdq#`!F+I_`6 z*~nikfbDkp`YE}g4>N46Osqob>%&w0)VE@XpZkv|x%@pnf|F*CbcPg zF?es-&uLa&Ya{^};X~5|AEFra;R3&OHIy|H6H1843E6P@PZLnwYpyyi z-5vRJuhyZ#lMx}2#NJgwP|0!LIqN6<*zxZZcXq$!y+|YboTbNfx? zrrw()U1-rfz)4jnxi;|AA^VP}uV30pt5c%}6A&*f}b9Yv!s@QT7eaS2Q4xyp#ALPH>l5 zz{G?v0%%!u%`&r~!%WLjtaEFUdY?Y)>Nvio7cL@}BKTSw=v&JGhd zR7Q~><*6u%B*)p2@Q1RqQ2&t;4}|_;z4I5`YO+_PjY-isuO`+!+U1`s!Mhk);x3jH z#esHnsU&=!y}=4{yBFEhjRDuio!R@_nnpsToz`Dg(XSBm+W;fTTxDu?uhhCJMaR`9E^&7jX^fDn@5FuImjb|d>%+4i_9t(?3HJscY- z4Sj~t7Bs3!S?yfF;>rfj&_>WtX3GpjE-u%YBQRsjavVrFAF(p6>M&@H5h|7}KAJ$B z3Do=nkp)e$X$35aKF<lo`z+%LRmCi`!I|K!HmN~5kmrr zM{+A%rUS_9{4-OzEa!Eu^c($1`XX|;UOGcrzgC8Xh6_0+bYJ1`Wb|iFo6B+gzbH2a zK|MT5Up1IJScRNVM7U@*0S*~6T-af7KFT7Za$y=U^s=R2`4BW{+R@2!K*DBQ31C-& zV5#Neb2Xc`1Gq4`#daXicJwb%guyyw^xts9`>-W&2y=mO9GA1S6lKLC6tfjuLcQP= zh&1Y)ecl+#MuYmui7XfidCl`32w74;15(p1=&@cy9#Z6xJI$~NBPZi6Ld;`CxTPEI z%ubG|p`>0|1VgqY-gZeBr;W6>;Z{W><3C_Qo&)$%uM_M`9EV71Mn7foAwnvQw(9;R zdWzLClTspy2g))hEG&O{#p-G?64{seSVogx4B&pa;l^7chTpQtAW0#okeI+o=!dCB zX>{~LJ*O?=mi>vVZGa#{KpXFe3qekXfXfaOf8QoQbN3@NBI1BdAie2@Vn(GS#`@Ed zt{ME--!!?1WFO}b9e2R0+s~0I--#i0wI2i%r%gR9l~aj@Ke)g1kF#_VE@_8G|=yJ z8L(q)7@-5t|9wM5yq_|8 zR;s@ocjv|Q97);WeBh7szwD7-bzAtfkepC^PKhm=3O0gq0q_1iaqxFDyoTz3SYOI` zxPKD(S$^^}VHXQNhYplRfmZ$08GhtmKrZ5d?G+1geO9dm`ME%g>pe3AhG2BHZ`47n zTpRnPzDrCKpWF|vl^=65G0GtP+?e~9qZ7`mdvy=`n(J|VihIkR)GeXu)}^r^FTw(f z>El@Id*N9bH)p0PEg8l;85g4ruDI-FQ1?*?h}x?3-6IJmT5nUCjziwlyXsQKzoqtc z(Z7;H?}Tl2Ci;{^;Nhqc)cWkB9*gaLqEH!oYr|iAY){2gBG8$dB2)$_krc6(24J|x#xE>dM>%?&9cO8;5@Gc>GaMkcHU~f6Y0G1Z#Q5r z>%DzXuwG8j=Veh1n%a#@-;uHb0gm}Kq=J=iEposKEUmhIc$#} z$1B~3tAiIcVvEjNkfc6u>LzFgtH=JiZC#)9S&}h(KKhF+q3=fd*6wiFk9jBcSxnzx zyuEAPi~-x~ObC_h3Pa(JYhk9Io}@!nER-8BQPVShQ76iz;_^= zs3%URoMUNiwg2k))%ugawhQYRqqWO*(er}tRa!u8Pkw`Vq0qMSML61CmjY;8bJRd@ zJK7^;cQH70^x?S4aEkJ_XTtv01z351pzB^AHJt${e)^rjYgZTpKdb3_+MSU;&k5|# z>FyRa!2G0~r{2^vh}{W^l9)yayi^QlPwi`np=~J9Nt2 z*IY)OrV)WpcX?X?QG^*Zg( z{>5i~hJ(ZAo+MiGx4?_m)*Rq#o98s{k@dX9);Yr3fU)uEnBMv-`uAy!9$W7yA3*)( ztFDA6cL(NH?tX)N7yPNvtZU=PTd=GDSyPYOx%ZqZylHmC0?P#?0U7VF}rgS->e(bWj#=lmBK z-TK03w7MSC(vnpVOfj|{ZMmpko#X7{xOeYbeSq0o4|nd4y3?;*9wQtNmdIu5{DfJp zu+#d_Fb@y&{|C&&{l8!yigKiEZ>)NVs2P}*5XqLed*s*qiMOY2m8Bq@e`J-=>Efh+ zLF%Lx7O8al1*=R9sclbm=Lw{a58Hx%$z$S>&3jZ1gt99q>NH+hl@GL+EAc+bAp=Bw zwAp-4<>RUihO_tRX9ui~jQ6aNrAuvyLgICMczhIN2k?*7Zk|}gEp!b|R5glw!CvCu zq*hLlo(xK@4%59DKw_z@oQ_D5xFNoN(j+T!sg+@ z^pZl1ou$OefG_OT_J4*XM1&y)qYWBB^-$zCW_~AmR-L#p=XM1-(i~vxXbp}8bX%!} z*_E;L@_G;yYFfB7_JNC3i`LLgJ@B(bHPd00hI$5iK5L zRY)1aZcFVGtc>_?;tOR7D;u$LD<@QgDXZz)2G~+dwCb*=DMH@v$ z9o7CE*8n#w;-Yt6kVCHQsql#bi$8n|gFWXk@Y`6}+;miEeNSZ^M*9DC^la-Fb8s z+q1Ofl4{+_NC$i_ZDS2{yvx@c&PlNf=-?LDE!gjfxP4vs!^K;HC`7;ge~GBQzsce=ls?y z)2|G|adW|&bEsL53vup_LAOdZ>IbvvT@ryl$K==&VXl{B z_~eei=#B9$#4N0xh8zVM`B;3Ae;|$|s+Xn&maN2yxvjA@AWn~wt3*hewa~P#AoajA zw|w)Up27+crA-Pfpe(>SVV$W*M}GbeX8GX|&OGwt=WK-j4_9{P`)W~4RVU2A&>I~* zYWUP|eBXGnOzM7t4D`pB0ic(w&v%>@3QUG`nX(nY=hL#jKWGm{bT9IIT;n>tWiRITUvEM0#s8c3?-ezv|wRQp`o{S3|lkde%Mw$uUe!C>W_7TUw$MKghW`<<%2`?dc0I3Pf# z%8B8Zz5Ob)s_V36x)q)_ zu24eX?%6gQi|eLc=tgQ@dEOu{FG9z-BFSMs{?URTvjG4`)07?`rebRjuP9 z(^Ln}^h3r|o#T=Y>ufgsBfy7Lymr0Iv?KgTC;PEa^uyi0xF$Ie+o4fj`<=CX?LUhb zc?oB^d^VO_uG0%w-NcmPe_q?b1LH$EL2b2Y2CjD`PQYli7U$DjpiIp{6(GkL*s?*l zsI2=uy>kHT-v!t->`raox!Mt1POIy-R4=5=Ot*Hw!lrvaDt+oEd3pKS=~)Z@c;5TD zr1*m0DPH&Y*o#5cP`I6K|XGF?)h3H%LSdkLlF zzIpvFy(SdNM8sh2#(y>((=`#8#lnJ6uqXB6Bd~QBY5kFv+W83Io4ai!D+xU-A{dccIjEb1w`k={&)`Lz7cZ4qEz6I zQI5S`hdht;FJbeHByl3C!?}SS*Z=5YYHJ=~JltDYKk_`*1yK2c4cJ(}$rKK;%3r=l zhb|PYbJ^Ob#u^jnKA1bc`joHm2+CdUxh-_;4{K|`W(H>zP)Me99KD7jK{Tg zrMU5C4zu3b)$$j&uFF@P3)t!^LN zy~zH6oNs6D+{5B7`U0_qD*aQhCYN9)DM>zTZoZr)K`14lRUujrhgI`WuA*g|DFSbC z=ie_;$XPxrC_97O2QW|N%cd1RURBGkb?a1Inwy1uJ{sCoTmt@dp709V##kV@=I&|ZvJJHFPqDSZSCN1e-D$sWL-bYvm;;I4|l-gFYPZ}7edgmeG0Nb3-fHA z{DfQ^u+jNXkq*oMJJMlg`Ja%EZo*|5lJ7Ka7erv(UjqV9Y1U*S*#m~RX`cITl9iRq zlZtX;K?FE*q7O%z7Qg+%v=qqCa4o_`E1)=v&m=A7Af!(tg z)PkJjzt>haelRG@3M?Q#%)U|W@zzu7zXgE7G zlBn`A+8mVq*l!?fP%;n@&GxP<6G>uJ{+9 z7o>VVbUQ594vK0V{3JOS6&CPkAl-(ha4&>VF;a}E)V@QFjl;G%Tn1Zz7fQiW=pfHw!xfBkz6To%vtvr+s?eEC=V)yDgMvWsQp-pEA%%zP|;Z+C@ zHHTF^*+U#6>c`qbuR6X&PPNQGVU?|to}oUV$rsJ5RJxl|u9cC+J`QN@AIyExc9mTJjG z3UBaLLz{S;-Y$O8wL)}VHM3xA{FJaVRCU6DI26@W28(*sA2z% zwuzLg?_gC0YJzQru0z9An5s#j)M(?CgrV@zjzO1GYyGQH16v zrY~bFGDK@7fa0H(zF4>7xmTgsv{Jr; z0OWA6; z`5+9E=~!aUcnH(Bvl-Xwv*9Oi;~CfUEnEgXEByFudEP9R^uGG=vb?(7+|;)^y{!_IKmlFVcx-J= z1AYTJJsuYXuMe9%8FK5BYCn9Yt-W?t-q_v@S~R@QFnj>V-2N$7%3fWI_A)@&>2$xV zDVX>B7oR8rsjKxMKuK;&aVuAJ=k1c+_*=GL<_FTFW=3cA%fG6Qq+tv{0NtniWbVH= zo4Ra$)_3ik7nW$oliXOVw{!LzM`gj^f+=tIkE;K2{jY6(t@Tw>R)eOMQ=bQHSl9Wc zwY?90v#VQn@~GEJK|VeGpJ+^td*xkQE`V!)`isewtzw2p+YGL^QFLIZU&xMx+0$n0 z&bJ#w`@?{jgVpYkQ_jk>=(qUnk77RR;;O=CoyN}Z-KT#QY%Xa$)4Lx}zuhZbr80Qy zWsFb0Et=45dAo2=7~f3TmyWjB4eB$$P3*P;=<9fHPP)6Wu39*k-(JRM>2ew~AwC{& z8+L^CyBXvGl${+Op9|hVauVvshZfWJExGG(1&7O^^5?)!<&#%g=y{LQneNW)q)cD$nncR;hKN4De}o+yP#emuq^w z-#SbBV_{>fYZAZhy2M%McGuS&Pu7*GeR~VOolBPzdeBNWm+&@clr?=>>9m8da=A-& z2if~}>E}el@^n=lT!`)~EGVs@F&!S9?Zl>|=fXBc=Sn$)jgu=5lJ48;_LnZt9}TT% zH92R}#>a}4)|ne-ciVje@t*Cx>r-s&!(#*3ce>{4tJzeW>#LTToY_Pt`)w^~{D-CW zt79VN60{thA`qNZ0<|k zK7RvXT)X(ZychCj;RvKnUTHS1Vak=$%EFQ3crvbb^v5F;$C4q6iz7#JG21M-|<~!6mk?`<`#p=l7wkl4Je5d z$pk3coX3Jb!li^RPT7*bv+jwF8fn(dLGf_;a$u8XE^XkF{o%oB>Sm2f)()Ui0s)`` zB7i3Ok0pW2*T~8p@5-vN^F3X-@yxtB6x-wqxQh3Le2)F^F{!|FK{2V9SYJIwM<`dA zUZe4b8PpZ8$zkZP_j<$|b4o6Y9hcZic#9@2DiSk?A2Q4sA@cT#%uYm&!PrHK0yUEb zk#*9oeDOOH{_c|cO-3-%gc zTCAmU_XjDe2jAg6mnd@dWrg&d@(LoT?oCq`i(C^DXjGbfBu$7Y>2?rzk zmWbGsc@HiI=L?}N`qla4!fO*i>WKFIUUCe`QV!<^4Wj~*rgZ12Cp*9oY2+ty^(cfF zs%&O99I?P}>`HzBP!EsOeuoJc^e#J#EnQaqgdT^&^b0&vz z;GCsUz*TLRXmOw7A=__aoP?$W6S}b{9ugzfH~03h0XjJp4fBHvJZUo8$CXjr_m-;H zA7{$9?^gF`9i>$(_0Tux;t$X6dn5habYK>4FR{2qhk=<59;>eNaqI3FB7EpehdF$I zg)UT!u=wuw^8KhqYvbSvbiqe zX?+~H?!SBE_fT}?;Dw#OJQwg_<<%_ClGr=|UmIHIT~^?|Ppal(hJGrH)A??LxWh}<8(2-vBWSyA!i!mLqv2J=9m5;#Jsr(n z_V&=a`De3G5IgZ(T{dQeC*;aA&yQiX)y z+AZNbkuYlADX*uxHC}=}<9h3Q!R-uVq17#W>GAsWU?gaVcXxGI}?0H8!aA@rO};$mZrqD*~~zxTa|?Eikvk4mD59 zJe-wBp3cR|gwatm)2tlhy}Ub}xNJv5a+a;F11oCw=%vlJxqmz7qosZ|C$^dF0Z#yV zw;E^0%_2(I?-WRtMaj$0La?3LrnWcnCXTPOsqfRy_JiU%t!AsOHmw$JoyB|-=*7mT zoXG2mgs%-n!g*SLV%2Vx4QwVH%N;?D@P9ho1XLDa_CYVH*``8mfrg^x zO){As^8=iAhZ3jJYBn=TN%3*4o}h7> zW9MtVXV%W$p6t{QZM3FWZSUSpW6J0{bpOJX$`=>-NnUpAja>(F#jM)fz05P@XRRmC zisaL@IRcCCskzG-AIy-h{hN{MlYsua6owyIkM4ZeO2a8G=>Z=VzL{uc!UX z(ao&1&B-Vgw?@=I`Dd@_>(ruvpWUN*Ggi%$k9W`KaeH5*i+a32PjBa8yFK6UpPnDb zmtnJczIFq*J3T({_uFZkWwno$UKdZTn?F4>wcoSwCjt!+y)@tgkUwyK8Q?RKZ)q7P zXnoufJz|L%o}(DerQ&2p~v7RWL#P_S`^cy#bicXJ%w zV*MCY&uYDv&sJRWi0#r*C@Ps07sWbLbKz`<#BRI}-zq)U+kPllJHV5bcT|nn&JuYY zH1nkCqS`Rpa+H{sX%%X(jw;=XdFH;J!t3ew+M3+2y47Y)=6*lDshK~9t(}!{%}#`v znMAm&Q<5_8U=_q%RTw1n=9Z$Bb!T15-?rnSzIyNmWOlhz(q5)@*zGi$cMYiM9$Hmm z@157#3ePn4j?Ud$Ljup1kl^K6!7c{5eVy2~9#zqLXrg9?|0OY(m6d_%pZc)dJUW$E?2fl@zkH>E z#+S_`0uAu3#dQVM6Tg7VKAr*sOu$V|(>_0y#}lg+wM<;{dd&0fQcbT>t`;?O9mSx>m?UjGnM10v}Rk(7Ir(P(PKsEN{O1{HYa^76-FG@9d`Yk~1$ z!hBh76&g+T9>7x`d)1*=K03Wpr1{qz7zVmHr=V6!_fb`%TKN=Hb*~{%>tqa_2uJL{cdYU6s-{5S=4TK(4() zA~>dM9!jrwwv@;mJL=X;oR+?;BhE9pH;|w*if5+)EzBgFF_&T!KujX!fyAT}K&->X zCQ8Uz~CQJ!2*6m5@V7@ z3;^Z<$QTHZXQhCK5Ui*M!(@+NViywv!JZZ*e*b$V6$yr6&s@~dMNqlELw1jFEXSz_ zrE_3z?Fs!^q&2Z5q{Jji--}_#oRIH{Dk3;Mqn(I&7Dn%iDtc4Vj@QHl4a65RSoROv zBN?deH?<|jhFu9jB!%riGDCC*3D}ci*Hm`_CRi4zt=$LiFaN}hMfFB?O{T#yOeHn$ ziVY=)BwyxC{Ec;x9vh$z0VO6C*#`THk&`{WTOx(z{r4#){BD55c*m|js0NCe!EoZH z$u4gipArc-m~*du$>5kWRtwT%^!W<(W9$60gn?t#pVT_0&7g{Su)<9ITn6&3k2>Cf zdJn5h)SHxBPn->Ld=QMl+ z&TNcC!+8&%-WjlAOM-8Z7_z0Fs1uO?B!u!W8fX*G0}y7b#X>Z1WJh<6ml||uxzGjW zE@O`23#ta8JZ>ikloDWn9Wm}cKocykB2q>`z=2rI@$L?z1rm8dKlSpnLf#&j8<-Ge z6xKDwD>GdD0sM4x9wN)19pY~SPn<`OnBY&PrI6btc?|5}k1v?XQq~>JQ~V~*Ct#rH z_@v(OE>Y~M9KSO4xHAq=1IwqWkBp|(T>xIc1FYbK5)DPOiC7K???$~}0DDKD2wPt7 z1JVSG>hbp%7S%%O^+wAR!HfUffb|~2V|!-gh&_MN0m3WFMdWS&aioxzAx&ryj144b zI1OfdXDgwkMy6BF{l zN1sboZ<>8Gf~cL91T|Ns-k^S`-9U=MlnxebZvKt^2L1Y13e{MlPl_?YJ))?;V%uD5 zt|Mt0+#Bkc%MT{QENI#=xMc{e!O~pVek0>4Jq#0*b9H;1tprdUa~ zow~!EIGgZfuVh53No^9I&--IhuJ`Nhd2salP>6#W9u9}i5%9R}5I$)R8ySaOqrG*ys7Xc7EvkDS;p_R zlxD@N1i986QpWg!3*LZ~6cw~cjjjCh5M07jwlmZGL+hxv0a6SZ7oOiR%ThjGdT-3v~FVl47}F7=B*lB7u&Z! z;f^~L4^hD>x+gvAZx~r}(V!51&=lb9=~XmbJCv7abSPOtgG4foi74@U{EMKd?8<;; zo7Utk#ENhR!DGm-xfWG(^WhdM$Nz2)S9?)sFez z)<+8od9k6&_aQ^1N>Yh8366=L-#tz?pDWZ@H6EXTyjD%EH`!x~%nonNTPRfSQ?h=l z3LUWGGZlQGrrHzB>EhjNG3ipZw>H)~>zJ^b7toq-}Nr)EioV*ifX}WzuEX z419x)pY@}$(rT!ySNpkIeXvcd1oiR99nC#()V_Gne!`cS_XipF&Ug8X;{mjSVXCe z+CnKR?%7Kp!3@yeMsn*k9#PLK$cDKcnd~&kZ3V{2Gq!=+awuO^OGE4j$i-|)sHNuD zUX3egZx#z!F&wzNIRNQ#0oA9`p#iVSLAqE~yFJ4uk$FEsmWqkx4}+9aV>8^8Qo$d{ zMpFfllvqRRx9E#k=-0RmYF>F0aDBvM42F_nA&2AdU?5rHnS?G!mil834njY*QZ+Sc z)<8nVgky*KZ4rPoB)clqMI>842QnOG+i#I2P9@LNk?o1dEof4{=7HDrT(~L zUt}m}$Rsw@>zCCPrw65wfU{QrHXaTTNr%gwf^_>dY+#KodEr0y8O`+>y^-wwCY1*^ z;BMggrBE{`AdaZIFlYeL-LO~{sa@FX>E|Lr9!~qK^=N|U6YCB)_|Gl>&&X*3b?@9G z|BF3LTgvXFQ$Z=_{r29Z+ePE*!|mq#t^O=X2a^-^hW$CQ<|5Z-qoz(Q#nKTr(=EU{ z?CtUFC=|_?=)J>8Ai0A@z53753zdksN1iX+C0B~%HJgm~=u|yhf08VD;WDB~#S#RS zrxuila7Y}_)Hp}#r0pvnlnYW)Ee%>`yFOMenps2Fv^7uU#E=biR(FRpw&fG$s32@@ zu3CF0m@P8AD$69FFMLonrx80Fa&8E@Z*pn*^Jk(G*+ftn3(In=#KWOCl5+ zams>qBi**%(<$x==fep6Q z0z09X=I1hvW78;Bn-$%rl@Xi*9hO*{?l*dYV8*cdZdsNaOD$D#;G8NcL_64heZq=m zFk<62r3mD)Wacv8_ye*)R1$m*_2Wg5c-t~}mpN)a$Kx3vWIBN+%k+`xp^%SaY@0IO zV3MKgLmQX3oIJ{BuTnVSa>TTLQ@;gt%0O*8W-lAW346-h}iNiG#6 zo5X2_yhe^g;bc~7A8cUy=lwT_6I!e47g2-*Cei|rAOFku~9m}{r6 zDOWXYe{eRP2XkL!o>Dw^onSVF_mnR>Bvth(VD&9RfKWT# z03i2mNEkUO5B|}lWrt)qsUwiaKY9LLB2iP_H@!q6tu;}D-2$A=VHRH7kW4EXlskWl zc#_Lk}D`00!A3kQGI*X}RPJuADCu%W*& zOllE?YaqH!zAwsUDJ`1|X;ppJrr7z!#i2%kVQ=^7r8vwVX3WmBjJ&TjR>>cHw8H<3xL zYj8|3ed8b?DMIKk`j&xpM{^Ww<~MA#tZdm{{89~pEttSUK%)RL2xN%R?T%fN68OaJ zYVzmxoivTF(_tNEbLuuoI%r#dW^OZXch*dw2(zsivMe}MKJ~!tzQAl|D92Z9YHy49 z#gqy#)FWYvF$bM^B@u3yo;Ofx!*#gD;$u0N9x5eR=>bA$&B6@+=l=YSoGRS30g{kV zTDtTTz6ybkW*naug(+fJ&?1}zYW@gUAcxJWp%oT!C{_sjOivvV{X!6!r0+9Qe}`?t z3XQaEry(P$C84MiLsmLUNb-}tBEOX3C{fHOm>11IDyh?(7FoH983n(fry@m6hYRyE zEAHPEf@_-$b@q*nzbPd%9Dg>-Hw-wsPb=5l`ahN`oYgonGla! z?jp%mmfoE3p0s?sl(*8eUUE0-=`S+x0S5vfb7Kf1p9})wx%sV{cE3o&$I9)fqg!iS zb@pzhdW8jP*%BqP0fX+3!smc| zG8%4bKbw3p1WlLw1JCbw%;eCUNeIu6lQ-e5yTHLn+h2II@$krFt^4I2YDcq23UTqt zLTbAHYeb_V)Ux<$Wc$_4?Ki_1Dp4)4*_9CIwnR%R16Oxe_eEQIybxIw(dSj+Kv1m2uf4WfdXB3PPo_&Td-ICS1- zJdK8pxxa6s!75=LFZSBg&^<*##@)?PHO|yZ^rKUf-;-A=uHHBpsuEeFVJ~Y&ZGbv5 z=MO+wq(+Al;Eg#D=JYaS_e(-d?qE?UaFF%#V%w1~#iA}?>3FNolp_q_bO%8kPsVdV zYXwFm#^}SU2SFHHDA=U;<|sE@E#-gJY7R3e72gcp8-y*~8vgPa z*T?V%7Rj_InW3CmmhsNp#kzDKYV_=}>fzMMCN6{&Ge>=I6cyFK0$C{4fZ^0pOo~Sf zh(($U1-#ZRQR@0#gZC883eLIg>ey+OW6z)TVe`Z#uyO5|Vk5FDnKoT$Wm{~ubq)Wa z>5HZlB)gif$3(`p+mIU_>5(h*&f7B-uO)^U7euGE_2wJ@=S3OKSlF=-k)xuRLC^ev z*g?ASZ(6Lh*G?ACj~hfdzbK^m$*OcF$O7v~QT2~{Etw>Fo&Yg9BqD1;vn3LuTkM#( z^F4~9s9>awdUdYwgk0oYax^#@z?dg}AWIU!fX@`0_%FM@6VAGYN<&a>5KTqt$?THm zBz`_FneKaDD(W->&rf`c8k3pDo+%GeiSbhNKNirPTC_LRo4Hq@hm94hw3tnL7t}!TFtyEgv5AS9`62S0sk`R5|Gh56AbcPW7RBNR{8FJmL^<9keZOa5fCWaB07{e! zN@UB3Zh+|jF`+;7;MmXj3O1oZZ%Ar(V<|Uh3yHkjED`jvvzNCPlj_zur`WWXv+_XL z7wMZqjB4G+E&=1zRc&hZv5mC9(N>ZHl->V5)C0f0?^}`~={E`e<{4NAFjOKDxOQ77 zQ7MT40fE;%#O8%Es+e(*V2{-APM{}8k9s9u{ff)v-{oF|=Nw8G*YfQlZZ0;mKxs;i z!<6czGt+UNxTp-FrY(JrGt5~^!Og$=IUaH^RPu6tfrv>ypYet?5mCynyS>w69XqDgwWGH|HtWTQImMjvw#N(c8v&OBL;3UV49zIp%D8>4(y0MFRBLJYTimI3+%62#Pcb-M$< zZSxLMTm7E7OK>oV2nGYQ0FuV0hT@58vLofyWYz$u0wWMe0dLrn^D-(ndqz5!F?%BT zgFu*_-svt4%mkEMFgB87LE|dr(z2-ZJ8$l?Lx4kRog|hxa z?}{zS$q2!b9H$(_xFWQ*NVOIMx(|4kaJF1Y0&wD|&PUR!2i!;kw)2^q&Nk078mzgf zzZ$Dlu9&cVZ|Ro7PUtx9?V@Gygl$8)A`MVwfWK0sR!RC zHIU%TMR^aALiu40hP@~he%(}E_N|c9|D(Uam?18gqEt$Lo&5@W1 zj7rtVHWLy}eHBaLRDs)oKEuASyyOzj5F`HX65d=WMCM~NrnAZPOQbIcfZZw@ylBLI zR40E}Kmb#@w~sV)oAe^CCP0IIjgIBm*Y(Rt0NW}b{I6s|~WyLcme!G5L>fo}jfQr&qT#El~KfJqgY?w2^X<<%)IK<9X2R=fh4X?e|yUODJAfgG-{ZS#O9)2Icq=rO~eqcr=Xr; z>JaYD+++ikIC{-?%;Yy}(ZscS%1p);QrG8K=VRR~AS3^e;I$n3W7~V4T+Kr-EO$rB z#zPg802XTq%cH#>kcUy%6YPk?0$9VfPNJ(y^7mbwkLIHNl6=r(cUOzRQ+2wcK2MBa zzPS3QakPrtL_gq|kzpRc5H&pNONYuNSp$(R4+P{cVD=%1ZNGf&oLt^ILDc%}({=UIhvvR9Mi zJo{;}9CY89aW8^V2|wlxozDX{+GAfmc{JEy^^0k75dx73-v|6Lg4W_|`2kk}%R%}N zks~$+rvDf8H#`0RC33{X!T4{er)4djT5JwmpV`{qqr`nRB9Tkr^z`)N@!Z7fFs7&1 z1Mn@Uo(z2ha3`LDN4sIvI4)|HQf@~hT|<2$)9SGtI~TN>6|x7DA?ITq_~1qRt#sN?J$S` zG2(++_!F@%Ih>i+K+!26%^X7;s3B>zQ_|o@=;c(Y^i#LtrkRA%Pp{-yK%AbVy{~_^ z4n~&Qqq!7<1YB)8Ev{SFQy5TOcZuIc!bnmWqhGi^v7%M$V#7DPuY^b|O$k5sl{Os)k-8|0ESNE;M7-8E%Q zFWp$*+Mu_d5@|VI#3h#6k#WG)rAgs69?E3ZKqph2EuEGQLwIZS+pxqMp;Vdn0IvAC zA+&3FN)Un{~;wXvbQ6 zEt+}9jg%@wX9z}?AUrM*F%YOeYlhrl_@Y=s)zI z*N~S60BGol_V*$}&cYU?{B#-LRRbuj9BC!~y7dk@-h4Q6jq>mhLuBwIJI$xab zvQ(#D2CJ%LOFD!qqs!7<_?F6bvzny66sAM9d5-zrY>CT}Oiav(v0XWr*>qS$Vobu# z{ajISrAY~oWHOIOp?gUrIq=uUuqZn(%bGmUc5vxp9x!MA*Yo(fJ@a#?zyMNys@E^NgS81v@mPhSVDXJcgD@VL4e0qP> zID<}W+bFx*SopcYQW#ao_0n+k@=}ZBV6uK~q908_7qM=|hZWrdZgs^hr!{e%Cfx?N zp-f|%W=RC~40TkTZe(Znx9*F2dm8rR&>`59t#H)pLy91AFI85elO>5i)Hv%*@yZ~t-X2Ia+(@~m1*z#F&$rjNciXxz z(VTuGU+sQWrp8zVSq+#sB|5i@yMIyRCtgX{wRYcMlX7}HpO<_+pU?ZpZ-=XTJ>K7^ zd{WXsPtVs`csoDupKn%DTm#RCS$Mua-*$4OV}9K}AMinzPmtRlFL-m+us%yxt*Wkw zZW_`hI$I`5U3`0foay+5yv!*tFDA;hm!|bQE+4IWzCP;6KH^uiUZPVhy zXt#e6`uc6zY>XZ($Ud!z81^*5ej?gnT;~RyAIjT}tZX)wwGzAvwskakcXhm)aK|-V zRAfQrWt4Z8@1WDru~$D*;$T;C;R^hQDdE-mwE@cW&;&C93)eyQe*eCm(25pBQO8%1 z-8)YHkf~sc)A|{!kZXVd(e&fG=k^2G(>LjNkjieyExA>WX9 z7V~hkl9s6)S?Ydqv+Mc!e4AWNYe92xY5V??!fOGR$Ey8#Jw8nCHsFnF# z8j}0h<+^AoIzAIokx9@}R2-IsC3#EUQD_{NgzeuA3fL0nkL*rES#2!a!Dv801(orGK@(?)$OFgtAz*{o_#xne z&-fwWgJ1a}5P~5DptwPEf#3@f*Cg|)0%}19kkF;_sRJ587Le4X@@WEEK@O18rSfS5 zIzb+g)}-?30(zGqxZ(7P9?k($4FItI!~w6FEs_a>;0FT;!r+4d3Zmc#15)}_1UQC+ z1k3Y>g9hvKhl2&%^Z#=HpQCwJ$LC?-3RIOzeOjL-Xc^`o#-DWr_kSzfQs;pIVzaG< z0cy3kM-Lu3v@=39;4MMzb;EVY+xXbpA$#HNd^zuyyMiE&<{y9{#`cN?zy?7Q#W#?? zi^j-h7-ljyyvyh}1IyF!oB`ziUlYUI^dCku8AIPp>+N+PGN1AM9(>BCO;T%ME#2r!6JZj?7#s|VITgm@GGLwarU_- zsSt2Lb3-u6ON94uxUq1;abf@SEm8-Rz07T~8!j+!Mg!4QlQ~v398zfw?aW{mOOON7er%?3Jk&_%zah@X-6A2=qFXyl(53mieb z`2stc;eQpTD)>iW1g8-M<1PU1P$cP7FHT8ZkoUQKP)LRin_@FwhEH)4HpY%s5iwr= z_A$D(ek8TjMHL;r#=4He^#V88VD!2ozIP7)N>FB^74~V^0N@~YT5~AEw2(f63Mgs1`RU8A}N)) zn_R>e4Ow3Ff`CkC2b#_Dmt`uXmg8#2q};)gSIS`ZmR zCoEn}6d`NOp2Ja5@3AHj&kUy@i}v?B0u|d${0G=;?boPopb?!!*}##D!9x!Hga39@ z)Tmk~fmpKlLaV`$J zM2=~-iLomVe6*z5b5dxdNi~=*=qf#}6?AR8AFr$)du@tmPh5=w=IDgG2_S_qV z^LP9+nV6fyxcr&{4silIIcyj|i1dhMKO+ z-tR`9Y+uuutp_AFI?OG2iR>8!7xf+Ut{XpdZYee93(mFlnx)}3C3s9KT8uMeE%nov zxC?aV8jrmsLpbUv#PizeD;q|op4<1nFAn#|5KA;!bu;c{w0BgDhN4G_kH0a79B}+#FYDCNw8IFaHoCb zr))w7m8;#a&eq6nEfK?V@tR+&8ovm%9CBnFfCUiyf32>eZ2CktiBGOK)8_2RwW-xC zDYP$}do=l7SjuASdu|p4Gvv$Ia-BW33_=F;9th=!u1I96pW-r=%7keZQe@kRmLRD0 zEABZ2%d!7b)r~!rWDAdgL1avzhHf|HN3({im?~NdE`?=ggJlKm5D1v;KpZPt?NN*~F1f)Y`z=MA+o7;UCEn@iNW9GV2DTWOd5AT!!cY{id%bvD zlUvMIKu6iRPF@?jSH?-U&dW?6gUljeJX|Ur%yTSiN&s8~?F*^#RaKF`g0Hj}UCmcV zGS&fGw zHXM7R7l3wnXQmx-=0?_TMO%(yEMcZB!`RELe+I)N`6LE=NeJXie;cBr4_A8MQ9_R z6PzEGllu`O6C0r^NJepd5)}L-&y}dOX@`WDI*CKbcnv?*$d#Q}A%Yr-kAvc-V9jU4 zK+Kzrhg~AhemLX6TyRoVe4smDMbxL=R%>g=U~ocX;d;4R*Gdk4<(X%>I`2Qi1}z*@ z|EIBK`v?Efe;->W`hVMb(V5q=3Zh2=+w<}hq2&_2->kt8Tu$X!Q#GBeSv)!m#uQqL z`u@mplBC0wcR%o$9(9PSs8VKQcrgc47#zx!l>k1Z#{#?pvMIyn({Dgt)OkhaS&h~5 zcKjOl(!cq*XZvCAT|uvG#~l0v-}IQ0_2E3JB6Eltpjmew9jj;tW}_h_eS7$L#d->-ob$!t-76xg8I1$~-9Fi~$$4hIi*HEgdY#VU`X*C`P* z@=Fr2q|2c}W>GwUC6~-q5aRz%{LLw{Olg$7PaSLq)|?=cqT^z7^J<$d*+}yhO}VM11yai2tM<%1^a~0IapvHv)3*WA@a=WH}5?3&)D<Lg5B4$>otyu3$h zlqTvI1&^!w!5`)sF>x|u6=VuBZCtM)oAQXOmKYrMIb5m4eQjR{{Jy)*kt;wlb zuB1KEj{6&-p`2!kilfz3p0H|STdq@#IRPPXWT02K_g|z`qT-!wb?%!7Um3ViVC7km zR@buUHz6by-d!i!iA>KZ`%Ci2%OMhzQ6(_?>FVH{*O1jHr~U98@f_dr)$h z1mpsDgKU6I0NDWB0Hp-91W@uho%71&Rd;fYk{WGcb@lG#yb%ZH*`G#w}e!1p^oAjeXoSR z1hv;mP<8_I#%zTpu*&1C8|S4AC7V^ttrcRb?~yi`OE6g=4?I7zWSj) zypFzUjL92gcja7k_w9Ek8%Mjrmtj&3{vXGJ`TxWo{`*)kv;6xUmn3I(NRKdl`;Efs zsuB4kc_B#OH9~h zGf4u+bJc?b9&I;rW3t{&A+x;3j!f~@PHq}~c)0~5FDvQy>r3xySnr?NvTIj+q0FuC zgu~;a`_@~#%cbA4aBH8gI3gxTGToiIWE?hI2J)3E#md}xm$ON|6PWx# z7WoB=TESErh?OZ$Iewoi^XpK1TFo)UWT)!hK~dk7IS@g+NExan-YvbArit~!T&`BN zpxvI%Ln7mZI%eeUjIYkc4Yp-N^~za{eDMB9e_;E6@rQp;Q>y&od+GxR=<{#v{*P6% z|DP)VcRkF2&&0;W@qgp0W?<%E`L|T4Yad8=Y_SY;6*swA^P7)cg*Z(oam<+5dGUss zd7JHqW1&N(2a;V^>vcysvQTV)2XVs;1RxMrEL&irECggELv{WAZhP-OAUi#XeN%(o zgKacdG;z_}+KZcc@l+xGeXqC|kCE!{&WqZLpPJqZPo!W(K~86|`rn?;T@}yLKSK`W z9$+=&Ib>$RE;ALa_`zTHDz_Y*KIUR6H@3m)1i{ho=RvJEkUbB}w?xLd{J%ZSZ*R(V z_Itlp*bp$ifi_leLjnu!E}8E>fw~5LPZ;q67{P?`J&98Y%1>) zy}5!m#owb?rrXWmYtG@m3VJ<#3evsr2rBjPx%Kq^0H~ke@->jt8qdE+zFH8>conylRL=jdo?rO|V&bIh)Fa-I%atEHZ6x=D^*hyZkyx|+1tE2W`_ z2G}+fY=0wAbQ?SG$@T)|uX&7z+Q^fc&aVyKOp%b8p80EYPpTT@=pY++RW(*hiQYkW z245}LQ=_drQ-s3m@NjuGc+U!xPyP+(vB~{^jD2HpFHaO@UXmBvwr$(CZQHi}i<1}I zw)0}!da-S9{vWn#w{~l5tEa1R``+oQ`7kv-_nZUNaD5SyfQubmz+zyI4Y`;;262zX zrhpPm^eQ>}Ba3Pk4v8_C_+j?J9O%yd-+4`_<+U(H>b z7*_pisNj%g8JW1(l4UcpK^Y2SlZAa`g=1nTfMoe(#r|4BO_X#5V6iGtyj~g98IilR zVKRq>nOfFaY8b<2o@Wb+7U2$&b!cpi>3DyH?5$_m>DX1~S=x^53M4vk73_jB*9g zgnl^;PV3W5lxaCAP3VYfChJ)EAIQY9o2$80W7yVS`FIsAUz?ecgAUb0Xx^sS#O1B0 z$)y%QqkXfR>8*qgI(TV&k!4;(Msy*bvnbC@)jINmiY7>S7gn~RmumGSOY&W zM41}pbf59d;n5(Qvc|?Fi9R@253B8(^3k5=zv{qyPQdYTQR7wAeDPyjuyD9OIc(cBAABk41x2yNwCG2sh+Fx}<&h?a@Cq4cPwx5A17{ z7x)9+IhF|WqBe4ucyon{Du?}!cW|$P_3)nR;v^#=Pohl*E#g>=!_|>clu};M z9!YNI(Ku+MMgp2rd|H0qv%OQ+CaZP;?yoiPCjic0jS`T-@8TrA{c||7c#zxZaM&q(QQ@muPj1mmL__hBZAxjimhHe zS7S#_)RsAN0YOt%DBqv70!Ya6UK)Bgs#PJk#KGi;%*ctXJS3mA_K5L6rz8M1XhH2F z+QIEHnw{oNU2@5$Bs0<)Yp1ky)&3%=C7qRI_U(O!1DxO(cO8*h+-$C%&9HW zaloI|3=tGVDtJK<6vDs3N;_)QPXGvrWFmDp>TyNU#({)Q6b%S@DyRTc!j^z^t$S5X z+Ujf6_t89&Xj@N2Br_68^SO@5kXc}4u6#W@6bRi0ssE0#w=6OAvzm(ZUeut7ZEX@{#H^^Kt6G{3(AvMWGx*FvXwaEkX$e;DH z^VNp7i&@@@XS(d;^=lcnR$C(aH2gwTK;!X4edX#P`z> z&VC!f0LcWf-b$yZR{ai0jX}=h16oGJ0j?tF09_SufT&~i!!$BP7eEFwgfiVrt5<1( zBq+CG?jHbM7rLQnO8KW~f!$v?>&9dT50qpg11tkzgscmWkqpQNHD?9tgn;|yhKvJz zLC67`UgF{k(v&tYn&+EL2YgxTf_MT{94!D&sSC;_a!NF7DD{)*8xW&?2gM_m+h7S~ z59osfibu>}D3$Zzf^)8pVI~d)Jq8`>XPTC@*v!0kP34(z_I*TBN^wX+QD>w7C`FiDX6J5y4 zV@3_ttAJ*f=%@rpO#sMJX_CRCTC`@hnT8D8FAcEzg^2$2wFnF_`(vQLg%FsqRB%`g zXsFi}5?Vs34oq06OR!^MU~@xkBK4xY!y3-l{zO{CDJhPJe~E`$ZFl0rTN%;yc-uTZ zM&kT;wl}l9FBasFuSQ04OD4P)fBE;qR_dU6&dUXuha2kn0LLS68Bi<>gh^>}9o;l% zH6`f1;C`G2Jvt(qn4+Fyz=x%jdeiqY4^Y7^XOX8PR;yXhY0;p?hq8N6+nkxOAVo&; z%&aG}AxeB_yjGJ1&-9)0_Imq$y}FNl@r8kFX<5OMpTiwqnND|e-PgGPLLFexgN`v5 z)KdvkD?X2|iwZ=<1l=zyL7XVKWcZk5*yHHRRzIOf1m>&VunToNO3>OXTt0PK^=uB_ z_5jE(FPEMX6+o~)@O=bd1)q9o3Tr>t_gwNmvNpSR@3*!z#W5cPcVDs&kWJ67EHf*{ z?WoX+g=`Lrh+>$eYj|WxGQ<<$TS=^(3aI1p4lwD#guo*HmJ5`z!zMG4bNpA;T8J2< z1J_tD5$m&B%EUpfLJE+msOiBwaV{rDtPeTHbt6Yu`L}nw_|ooreyzXJL(Q^hiLn2P zstra|Jss%!mfwoc^)k)cY&3i*XLr8p+O*p2h#e6%ZVhoz{QEqrL>l^lSUZUXKYS_= zByLV>LdBh)ccC4!^of~(i;B5+K~f8T?Mar?x4+Lhno;pDYvZ8a4DkkM!$#DM?C z8eYh+aKRZi?}si4JQl4k6QHJAf?R^wQeV&<6}P=XBz6nIkqn3M55FaD-|2lJVq-kM zYI}bQzt*^TM_*hXp9h@3s~N^|_XF&r6%bETR@aPb2VQjBzdz>U^G4h^Z>cWhPb#oo zRAamrbVby?>PXqm+JVZVv4PeoOpiZ_F7_wm<+; zP5)!Yu$!UINaG#Ut(Ph(jueKn%gysV0FCZ9n)Uv9t)Jb0wAtK6GbcS;x_8dZe)G7? zx#!h1^>-v))gtQ^E#Ek2XDRzhm>u06}<^uy58>0fQ%{vXpLM1E_L` z9kg5%KVJz|PJ=f6uOvHY zX-aUaUA=aTaN*I>LOTZO6e>Ozd`dXkFmj2}oa8RK4-6Nz(5Mw>6~a}nlv-1N#{lFv zg0ls}k`-csbAlsBSng_NGm4|A*<}v-b`jlP+hQv0pClahK@f0yu*~22oB`5$*{?rZ znuQLxt-ak6SH08s!oF*vQVWFCGgTCn=uW>#8;U4M4Uz^?G?482t8oY7{bq^MIZ|%@ zfP~26*#FMXgoY87bN}&!W1IhF@OfI2oAe^*dmwj%h%C}H?!xI2Z~;w~pvo7fImr_B zO2g*>hRk*=ogFxwScalkF8>b}`56vwo15_S5)1P*NV@ka`yIZ^*X3dN^L?lNsU`!L z8xDWF-dHToaA{HO!X)k&twB0&DPigXul~`t9V=!;wTMtxkt%6iWSozRzvW}(_I5@N zYo&a#c1MQu9BrX6cSTS9%9U)YvLAT*^RHem6v6CMH^x4PG8ASU<|1HdaJP2mK0fZ> zL2a=j%wT)J1~$iIFdi^MqjZ0CRS^JL0U{v|gbSpA6C^-cwv)#3Etn?QD)(nz+jA31 zX5ofzp=n&*oV6{VhY>yE$To62x;s24zn@y-!WRBx3aF=@Kj0T-J)Rl42`I5dNo90^ zO`RrO19)797*z@lZH}plygMfiSs$C04g1i+o8$Ty+QgD2Uu`F0gN;L1d}p?q&;@Y zE)oCp?@zk$F!94Sot*aqSQRP;2bN5On&=X`v?4{DYaU&0A~Pzal(DGC{8Wkio~t9_ zLt-Iy3Z?c6A6;qr1w-Egvjz?oBnmhUQDawo)lU&!QJ2mM^$U0~TGA_5-bZaL$Su5t zKd=WSV)-r!gQ{KGW^_1eMwM9Qgbh-1q$NUdb9W!6ADt61uW{UZ-C~~C;M?MsdcZwn zM)NprqTF{eSg=~KMK)+Q08ClI$^1r;-yS?pE57KNSXf%yZmnM*?>9M{+U(EI_QT{( z@jcf(gWEg6v63e{0v4c26P;g1EX)MK;!$Qcf)GZzUz?raF?Pu2F4!wPAEpkE_KVjw z;r?w}apwlVB2e?}11IVE8d1(MFodC;q7XnyGiA^}RyNfv>8l;tF5&AuD5%ZoVn<34d_A$k zINRwrM-a`!@?5&Wr`2gGc^katYT?UpEG zG}>Af6WS0HazVC0>bSlzz;mEx5v9twnCWYBre4w4C_nm0HMYuZ84k~+S9^kt>lQ6p zDTsGLI5#W05D0cQaYpfI6D~@EWkn!~BpMVN|T_wFKy-Zq~ zRxN#SupHf8flc1(@^<&UJzxK3;$E<`VT_RFdis=^X`y_}<$E64yw6)9;Zv5c4( zXZ-^FHlKoX<~QydL6MIdQnxJl6R1|d9lFKu2FN%NURrw7e3$kblX2412KLz{B5&$5 zsd6(6xA#X55p_83gLl2oe+V*S!FXge*e#ZKXtJhAq>^gesi?m`H&ThGHqOVfct3D3 z8d}pF#j9JOIyLl*{m-kd<(gi%gz^2FD~G9b8oULRb$vg17vmy({2<=;`r|t1E&0{@ zD?$_*g-O1{Q>Ix6mx>Z2vLGZNY9Bb=8I%- zov5gqK(U(EBW%zDr2KzHauQ zS}|K9!~7Goi>B4Fs<(jgLwk zZ!8S>ce}Zjz?n*;!eo_TjcO$Z@`KEZ1`FHw_AHSQrCP9n9Oh}2mu*O+Y+xu5 zqRSK#6>Wt-uNMn0X%e{7U7U~LTt40)Xy)2Ecx-|bJnty3M%6ZL30^g`UuDxxvIj#| zs1WSbZ}de>cOs*0X<1Y;Ufh~vn&kpIv#qhDi%*5ni{ChGDx}geO}N0i2uWvzT%{bc z&@myTHC-fCJo}zsk28n9)A^IdCWKLlH``QQKXZh3ro&R*j@Xmy*=z99m6~r<=bpFy{){%=J z>2YwT52540rIak0tdb3PLv)LhX$EHAdyU1Ql>0aOR z<~@fB{(YO%Jv4OLuZ~x~ds;G~iH7}M_y2Rxjj0vL#DI+4d@*?e?rtoo5FFh@CQ?d!QGg!%nbOmlMygj_n zKhe2<*K=w|YnyYu?^;(wGmirjW;^8?9YF;c1SR^3G0P%uQ)w8;rK5(`}o z8AH5DcLGvHNjk%d$;rh{Nju5=qD|@6Mh#)nec)7NcNRfd)em z))SYlH8pM_?Z7}8NnTr&rR*$(c(|(+D>X6^-{Tir+2swqA0GaC0$pAKv<1~4a9b>?nQG$aK9>J zJ!_Y}?`O%Ln|?R@zuGD-))sYqO5A5o9k%!tlZfi52OES>>r1oJp;NXsuZ@ltsaNR1 zJmSee0O;a{YMui+HwjKcPW8FP^a~IHOi7q>!aUqpT!YHBycJ8!14qNOE|4rK!La#+ zBJb%}h>*F|xhuj6+r~zs19Gia+Z4O+Fnatwe9wcIwDAEP_Ubw5+qT~aPq{BxZU6Kn zT@w@-SAhY5zz_{TAahj~=@LjD>TA}6G;_N42oCEv4#g?p4-+%AoI`>>vhd~Hf^`$-^V zH*QE;R2ZSVzrYYii&o!KloE!Pa?iuz`>{P|%ks9mxZ|C!v8`_|&a()~=?&g4foPA% z4OJo`g0@HdJb^XUN%)by6W?4EH({c6WQ3o*${?_oC<`FB;*LtfRB90Db?XK%ol%_z zuF18?TA!91C}1~fZK{P2sTD!02prXdVY4t*35SrXVlM!F3z2LfDX$tpaQb^?uAItk z*+OJS{cha0ncHKJ!MqvT70#$7 z0Pnt1*5=Kb=HY!Myb5?nZ7+*`H}G4Y>s}9Z$whajg0HF(t#fhelbO^NmFFgKNb+@C zLILe5LaBj_b{$`?9x_>!-e|R&YPi%^lp#$i*Iv8OI_IyNJNSAk0rv=#f>NNOfmo6s%H|E-DG<%Yd7I5 z(3Pj_(XnjlIsT|G8UHk49X>i2C1&_CR1zrO{G6paG@iVmPp3Aw`UK1PyFq(1@WJ&9wQ%)j$^Rf}k?phoQKBF@?l2`56B`4YOMm zPW!LY!>2nutHW3hv_7QWO64na6_v#R|Jz09&gWW|nE{A~J!#CRYn>ysQ=w54d$qF> z9ykuno}`luo9<_Xc=}9&u7CoB*!yTAloL-%g_LL#KUigYEHy!S3kXsnRsL+zXY;cm?Na!VW`ULbZm6-fz#C;vT%#E!VFPUH5EG|1X&<_sWe8_5Iez*4F29 zau)aL>Ft{BIziv}i;L_`$gZAF`OwdbnyV{2x@Tlnd_Zj%Io#c&gd63E4sS-~Xcc^z zJky0_S#?34Rbp1_O2vV(%4tk`B4z_gajo!F-sa8b%F!^)43Ds!z!=_LD!K(9@P3Nm zw;LC_QNtu*IYeYB1NC*17zz2c>cau98XVgk-5r*_D1~UFp3}?8=rP*M<+O*zi^PI3 zY;|Dz>E8*OwAEHezn)4w7-5xZ;=bWkJg;qBxiocro6EUpkk@B8z3wJczHb$ou|0kNIyT-rE0_Qk{qB=Ey|d!J z;@h?0TW=|!-sy2)h&;`SS;vtHp=agSFI_O)0&#+f(a(sBlm#bTW`j0SVX`Sl+Z*L_jnVEZ-*v7CX zt(w=X-Lz@pDpjT8Y?Pdms8W^_s1$gXLBIH(udJqUiZKc35Ia_`rriQ&g$LskIT#dcZPs^|w| z<%jKxm_+4@t48SdS=fRYfTP}_Q+g_{!Q`@|nRghy#ukWF*D*bR(fzH;@y~9_(k0a* zR_~ae`*>U1o=#6{vCCiF?_{o~3rD3n>zgX&e#qAFP4s#6{o+xGehCu`b!M@EtkK_$ zL0Ms;dd%cfw9&|X@mp4GSfey(1NFs@z-nJ4q(s<2K7v&WFz=!3m#VV;P3%8MFqfC7 z@T_21<1LGe_S&d)(j?q&=eot(xGj0DR_;WG4R-flLAIr&XvGOAs87BSsb*it)a3^14T z#@=h5<%DBAteizRVU`ULGo5QGTKece!fJkHTd8_Wn2@?4+7VVdbZdoXt&S-(E1DrIfb-7%R=x2Nj~tmgUwR6V zvZneQeq6Ey7VB3n=MHZsTp!pTn1z{Z$1z{WRygX5V?jrFP4im4(%Yy)dwDMzrVu36 zh1MD>vt$w-UZaXCoIoq6C7!gB%Eh-{(OkxvWV$4Nt!AkqcfP=Cqw(9HQ?2^%3g3l2 zM3vQx!?aJDz0IUP6G_)G?_Y;eezv2|%09YUZ~tm7FaPQ&T|=?7ZGGv$<)dwG_Gdkx z%e%v@*ERFQ7ttp)LcbL1CoxyiogIa^@ycRj7p_W*k;BZP{X4ji$<2WSRy7|kclLTy z%UXoDDgmh&pHx2ZQ;fR5Lpv(NqrJpRvg}h8tB1xC*AY5A@wJn?3nODOf^W&ssChG7 zZ>hQ{!yl0MG?VcMELO^1gmRDJ^@03okM>Ve| z%lX>V*X2>FxaYsE6KV>mt_3t{o63NvXGx_GWmKYVizm z*Sid$42@tBm?ic}dtXa-`NTWdiMfagOnvJ2q1>@8c6UF!L62La^uet`60+Q+JptB_ zSIVt;ZOZR0de}#)>gOFVy;p-Ebp9&2@^ z9oGHi+z{!hwWW!Yt;%=djwsP4#l|MlmJgm-0B>G1=J(R_QsCHXk{%XM?k~33Fqkiv zCOPpGjLghGFqQ8v(ZnXYaa$~!x^s@r9t;WTLbSO^?^>?)QN0=YSWc)I@2f~#8o00o z{5ig99_sg}>SdXk^>|E_0rAXLEFs|Um90pIadFi60vm9fWNkvS)5f+E6SIOENpg{Y z`bjWY03GWXf#Zz5WL@E%xW{Z|?!AKC`!{}`^VcNoTZRYOs&4tMLaQ17HNj0av~+X% zNMCu$yNKCW;~Ku2ea-6Zc`^A<%)XxC(rx4;^AyGR_OyI}9PUBUNOAQg0ugpBkMEE+ zt0>yx(g2p%%@``9OZ&cb+M%NaEkQ+Tf>t(Bsxm1tx}E7;?L~3t>L&TV?m?(Ts*lJRcF&tvaDYb7RDP>Kh`HF>mEILCmamIrnIl`)5 zkPl5-Yt=-GhOpFdpj`L5mt1F|&337kUtg6K&HLlF^69FhrN=0J`DH=2zfMFL!{(p* zFGVQ)SMy2Qw|%i+t}QmZ9VO*jgX2EiU1x-z!3%!IMt}N9t_pzJCPMI+LPJ{C(O)00 zu$-m@5M4VZKR|Al5>q;%{oby3+M+~hGD+6PVe5xw4Ui?YBVfC+(X~<6migaZ?fu(nkYKT6r3Nn&{wSY^&b)^9^A= z_bhg$)dT#4jl>8MDQth>OI!(VD;o*+8yDP(wXybR@tl%>hO@mY2@0GSyC~JqXZr&e z=e>jWy~po*N^FL^+`Jj0^t)rW;fcCg)`QqT!z)e@u0y}sA3zD`htDm=fK}5-NWmf-#=Wx@9*_y9Uii?+Se1f zekSZa%0a#s>yP%(J+amR2$E1A%hX+wbxn z3Ppy_#v^{dx*nD6I@-#*)=jDVaolFIhuEFo?n{W8X}|ctWj@)%z!oYEO~*Uxqo~Qq zlMgOa35$q&JCz8>r;`85eq}T4trt1RH4IF{>u97t5eD$q^$Zj}tC@{5El=QUlJU_;@;$`?2^)`6?J%hH# zK^VO3dYqvL9LiATs@@c7cF2BGje^eDR~-qaNSBh zihZ{hj&#|#^KYtRQP?hkS5Ipi#Q7rg^_O?^zYPsk!)PSy(9Pp{{k4`P9jT^n2mZ(%7l$4u-j&^5ti8JGZ!~5ZY`(3cL`X^&kzcBt6 zydK2kU2R0skLCt5k$OMMg98a9rZ`i%yr^-x3QeZa-F4e~-quJ0YWuv~NlEV0Z&mVH z2}^d6$#wz=F=?s6pq{XxSlI)2Tq9rKq87V}WAO{z-6#zb#@YHOlqyLI+ZX+evNNF9 zPnx4KT+}IIpWp80%BWHLJ-M$C2la?e^wq2Za6bo5AW2VwlIQ~uQhvVu*@|QsZ_$Wu zQ6^2TN$d>3(HM!v*VI+v6#LJBT)H=+F9?`D*pY|=EF#;ByYkV|j>X?yyyM)3hk*{W z`iA<%R~Ep{p!)_*7(&3o{l@*m(Qs2)7DvVV@y+Oil zU|r$5VS#Srfn^&s%p`7E>vMg>NNHe_jg1+AXYLH#TpmMFdS7yO@=xSjN8ag4sn*H}u; zPm#JM-mbMR@dDr4ju0-({}p;cJ441Aa-SJ!q5F;4hz`imO9^~nnMv)=54e)^@W+KY zl5)0cykInfk9)NFfv<4yc0fFyAH3VOjQ}9hz|Y=r^Y4m>*K5uwqAR6Wke5 zSthC?xb#h&z-RpK^sld0K=2X}4v~2QJO8)(qrI46o7XN>|6#}kSQ>Nc;s(X5 z^*;27BDD^rQ*X`HdD+Db-!?);AF{vF!qUMMk=ITjo@no2vj@K)sJ`ii3^sFr7hsG@ z-+1dn>k0UMrwyYu?H%};IYoJ?+DqXPRyD5nh`*pleJ7vM%FQx|u0!L2o3{3Hu}AU! zw{H1W9bKjSz;oRfG+4FayaQa%40bhp@Bd!>0kta}hFL6EtbXG!l*)fj9T(hXb{N_F zTNii?^sKi{whg!K`OK!Zx>AuQv?e$wN|S3<@6o?AtHZ0+tLfLZY_?kHH;kVo-v!@S za2Q8o_P655arB*hrfzXZ{J8-4c*mT_?7CX&+2=9mmMhd(TF<^${`ZTYOaAg+e21Px zom1X(=FeM4??wD4{P*bZe7oP7-=v4w7@k`@pZ@dDQ-SaVZ*<{jkPig&g}P-Bj0u`M z!B^pTwOEf4AEon%ULf|Q{Fw)%-u(yaxJWU-;Kmt(#}%Vt8iB3>hH%xPIiwn)UUTs# z>EiE>GCy4P@iP;3V4kmD4jJ1@em2SEDQMqFa)1>9@mgNIK)dcMDLp!t;0@n z-T@fGYgH@T@*m$^Rx)3mHR1C`o0ykX^{WuDN=>#nC5Deh4n5kLZ7iis!Vm{^PX#!I4 zQ_@Mb9|LTvQ}bYqQR-DD7=nXRVVNe0T1~~mIGcu?{m=BC z0293RmXr411pR*jYyS(-OYn2UFRTBel>Rr_EBfR631#~;`SWN;mup9%F4zoA@QrF4 zat(9Efj_d%d;9z{ebH)4B_T7trq)kas(2yPX+B^+aD_}SI%}@6wRi{kApL9SJC0X> zoIp+#pCtROfKSwb{C>|?0(C*Xa3tH45;t5M9xIZ5 zd;(t{8#6rNJh&nbdx2SjK3yt!WjqXg;o^Q?ulAbr)2(!iU-=U3Z0yXZ$_vsLZSmYl za`4L2z2 zHRKn23(29Y=AZ&Rr(iGpK$5(OQt>L4Ci4mB&nUj!A$dx00gdO+kmu)?{yUYN9UHNz zy(h>mC4p=6YRmkGHKy!?*K{X}ame(K@{LN{@nh!D(+lj)PwA?@L|_^pBug5_-!GJp zj_%Z06wOIe6D)#eH$b>e*aqR>zFC6FhDuUArv-yH(>weaU+Jt7P>3fNz@ zZ++jyw@31EZ2pSXh42GAS^?IGFVJTJ&3_S_KrYEx^13a+dc+lxD}t_RKFI{UpyYrr zK~E4CQ}Q{Q(na5a{OJX(^Pf0$MrI{nI-#Y!e%&)HLRo-%afpZ^Y+B$*$pbCRHEG|V z@cr86_=hVd(jmDB$qJsIOA@0Qt0Z8{Ji88iSO|pLqO3)#Xxft!!VNXUTgw=hFtQ^+ z$q%=QkQqu^coo`!IsR<;Pga0cL0$O#Phcgb3(z`J46g&f=tx=Ux>wX~_=%3x2A>rA zD%FEqjFc}s?k+|QA<$8d>D#)vCFvcx{P}LAg>d2*hk){fw#vYOz8aT9qtY@oXm z6x;&hv*LwFKZfz_9ccDcXTDAVYH`T>+ocKE7L-Tl9G3<0ZL0ra8yE=@4YKV0S#rRoA_eh0uiU$og0774Cq)y!me?46>KvU{T2l+i zLE(w+Ufjta4{dNFOfh~eaDC$CZNXwTInoBiJlDKA#kwrlhxXvF+%E1u{S`r7cw25L zQsA?ocZgL1{%XQHl@)1PCs2T=J%SYk+^Kgf4ZfuDAbp(DS-kQ(DfK4!lVkFDmO@Tm z*HsD5*DV&BfS7oy#)#v(8M(n_emd~dj$y(JWSjhinq#t(N5r^NeXOWIfMyTjF!aQ& z-VZA;sp-=2EObG^t@2`GP>VE^BtF{{S4;Lol8rehZP!lfe*XB>bVl0AiR#=~g)4DO zCNR!j`OHl@ibOlJ1m!yH#rXq%DwJhhJ?Kl4{u`7yrf z+j-FD9!!I01RQz2un708*h#M)7?wiPL=&AxYc+yD7hN804{ow8s2~T@%IaGz~MaV`k8XMfS#E0cx1hFc6tWT=9BUbEYA{oXeXT0QS zrN}<4dDi`?>@YX>@c|}FFpJ!hatiiG9=0I5!-(s^Hq=Tf@>@;vAL(_|Xrj;Mh@*w|K z`MXN(1E(@x?f6)V^WIfO zBC$IE6ETvlKf4{X4mK2-8~Bde|K5*b}=D+-fSvq zQ=Gc44F6HRFV^l?X0J%%;VW}Y6R-latRhQFWLXt+uSZXa)g3uJHp==NOFzmxTkgBb z0=An?$=WW=exJ$P>Mc5^?Ie==xy|U~NQWSl%3UUaUH5dsE9YM5Xf0d_Z>c$z%qLQjlfE!#wLgfnbhBW)0r5#9tD!rL zYI0ig{Ng)e^W*Og#op(7EutEprE)e8uQ{l2Sn^-;U2%HX2&NLmA9TIm@MAua?Vx~pCMqolvi*yi@Ku}=G8~|}7B0-Ue1n5|U&00M&cU;;kCAVXPX6=5gd#hVFD)klM zqT%8t!I?w+ux#A~+1|>U+B~s5^UFV0OVQ-y8)ZO*@dHa3GzxUfU z9?nQ4S@JniD)v(tJM-%H3R`?;qAg5(I%n?Lhwz31k$Py!!^O#GZ!~Q3JtCQ}Agk&Y z*&XNeSXY0BbUYf_6b1)dI!?{+_1zu`l|S~Cc4QXdXgkF|_XW9r9w(c{+4@Dju2+B* zJId>@wB)=K?1O%vecCxa$6PMro zRZwnspPrd2+!xu@2Ilje@7q6W06M zMe`c$y>a78vVC3U$;Oa)3Vy_`ZWF9|LeSZJvVCJbbJ#Kbs_(R^&vIS zdL>!B-6g&!0-Ku$%+^Q);*Y1kj>_dSJtrjOu`w9pK7PHDkV!;h4@8VnFyZI2Xbg|L zg^wjj3?E^=+bSS$C#21@vbzzQ2y@}#1C+%KNOGzbh{}-{yrq9M!30P+t*k(f>8PTB z*-HGY7H7QakJ>cbRKQvOqC;!^8iq*%+cS=g#w&pc)ap|?mvJYVKFr9G5J7r*P~7Tb zGO$twr(3SOkgy>!TQ_#>EmtE0vyTm4Wyf8a3jE~~Dq!2264pQPM147$_#vA@N(g62`fa4(+cw)h!pt?Zl9qEKuiMLCwp`<;$QF4Ys@OV z+deqt!P-ShvvnZ>V91imsHI6rKqI|TTrmEP^jbih%@0(|2$78&71(saFkG+Ql7=tYd87a0EnG|4P%2}-F+99gmR zsV*Q1*R9Feivt)S1VZNcR*H^?O(t(o7IC{<^HI9@Cd(XCv z$zYAL6p&jKcl--jdE&naf7H*}8E9jDmpO8SQYO8T>WaYMp7Y!t>(n3&qssaMdWpzf z^-N+SE!shniAY=6?T)YwdCiUpJ{w?*bTsh&^2;Is(NGjPaL({3Mlqzyq0?OV`>s7u zZ4)5aTdt2K>DbDt5<0 z?;myY;d-cb@%*r>Be~}W`2K2t`M#=xd_Oc{-(MQRo^Fr5ehke&3$TH`Iwe+Ne?`z@ zEh|2(I*5dzMAro#+Zgw4Dwx~#d2L1%&lc7q$P%wv-Td_vhQe>{p~T%&iQ^q+p5D~> z)4=FX6IU==4MXQJBgOIu*sF223v-hubM=v_-X?7+^f~F6vz}g@J9c@I?C7Yar4OIM z!1J?SBeDAN=tv;AwR_vfmt2YD31YOBK;)o&5&Hp859!}J?!p4E7`&AP4mN%Tom-LG z@Mh?Z1GZJ#$U~5fFlRN2NjVMFpA0}p{VAC6%0_9w^SKdIcmJOGdaOgH7JIm-EaYXR z{=CbdtIi_TH7O)RJ0Bcjk-2Yc7;4qxQ}&4W9xZr=eIqAx8q>5t?9X4YtmpsEo()r zNB+8_Q%6jgcE+UkEBkE#%MzVBz}};06_b?;;|P6P{L{N&>ju08z5*MYo*Ff_CfsZD+lodvg4#&RB4EkUB!NF+f9s z=>m~`q-Kw}Kn-tphb}RN&yHMya85t6DVQW}tRL~GMU-pAHAr4?U>LUK z;25{$z(DsB4UB{A=HQ}x*gN?YqL1Sv`00eqMi)Znql=S=>fvMu#cvz~b5LrTLEHqR zT>xk8$)Q&>XqDElNM$mk9k8@QVv$)+8##^OtZax%PjZ+G^6kSxJKb^jiz8*V5|Fn| z1ZDlRn{}JMeNV7}yz{0R9lLHOApd4ClM0I0NI>2+7nF10w`iTZeJ}g5ga6q1%>?DX z2!8B4^#tVUEd=B*9{-F=JQ`Uqd!jQ7hHvIVn9?CuGNu`ob=e*0x;0n!&p88Y$IX1C zE0YD=ljZHKAb$fMUu$^6g%vgb2VY+uQ%CfuN%7*vi?+DCySuwXad)>{ibHWO?rs-% zFYfN{?rs;BU$WV^$$PuWBqy0U^Cjn>Gn4ZfF-ZkYL3Bb-iZdcL0&m5a8vncu+w_p| zvQhKL1sHvQ&BCtM6-QeX`wd&q`SJO&eW~iMG_Rl>iIb7t~0Al-Jog zhTUUK4B&j~ylIlp_a2l=@vz?1OvVG@x3I0dC{AuVm82vKTSq-5@-w|?X+T>2mk2ru zloW-})8vr8_ME%7k=f=RC4bKA>iCg(6SlFAy#_2dyFl<*R~fvpv{{*XdT6lQj;5C~ z&D~v}a-wGsI*C9$oBE1ZHl?h7AwD6>OZ6$4rk+Alvx(H}XYg_V`f1DAy@u7*;lP2` z53#}cy{&}YutKG|RtYtDIdW%eoeHDvLAVN9#-jJ^-1SvbJukZ%8dJs62Lko6&aPGy z&ODbNvT7+U7^-tAN4*=9$KNWSgaiK6Eow!8k+RAQ5OXsKf~@RXI9KgwQ)U)z%#r#; z#kKrp(3RVLk~6LF$ko$DT(jJFeb_N}3vYKF@9pA;24>h`IQN`(kDs(qT4eqH`T`4q zL>~SI=CHtObjilz30>v+_ENLkqB5HNo{JKDE8(j(hWwT4)$(*54$ecW3z5lWURYu; zlCH`kcZ*a5=9whiFrGO#umPzl5=xcB$O;kB+NsW}@zFDABQ0Fl!hcDlQJ}1KlO`5R|{d#<9M?w~9(O64`^o)Tlnim<~~(^~Q{g_ z0WQzRx^~k|V%FEEfPgpzzs9*y6Jg|`OpEPel@)@O#Be1{3+ghJo>)4+b}F6Lo0~qU z-r3B!#mwY{?Hm;iYthD~gSx&`v~YV#m15SyoKr2{+5%>c_D-Wf1Dx_@{OcyK1>mDa zgCa7LLc?jlJi}y&A4qhUJXqdL>Tr446{L1H#kk(7TaPuJbPr*tUT^lE5Bi!8>-5U& z4s5Sy*qdx3E!859k=yqjdxJrY#m)6DplC_~INJ1r)}xh+s}g9e2Zy z0wzq&GOWxzTJnlbkcbNT0iAR7Y)ZcGi<|gKVYu3`O=w>H3Mz2IIiWDYU%F`5%Y)Rc z7>rb)XFjAZP>=A`=dU+_3}q=o}gsf91<1S!I{I zX+&rgyI}nJu<x0LZdMuva-_!5<@Lu{F2~B&8+2t88eYD>EREv5H ztWI~q=1pIvQNz?%$Im9!W6FTXVxpnm zx%|nkt-yOMm%J)=Z?3#LV~+W>9wNF#^7nbLQyCzyZFsuC&&vzOAAz)QJQvj82&o+p zPl_hhrhiYGd3l%ewD=`Vjrh5rFR%c@+qaZN2kn~aauEXgZKuEFAQlRmm& z;P|^k(mTZBYZjt>z)II;1T}ndc;#sS+La)>@4$YSutAR+ahOFo>mVp_n>?XJ&z<_pbOf zjGol|&qMnm+=t&m(UHHai)+_8+y~+3u5;a%bf?OSd}AXn_>SJ?M@{oV=ym@Di2CSK z780Pvxx<;a*?rJ zyi#_d=ZaDWXYVL*jSuK7?JNaG+`d1)?R}Ibd|OtS5=|7}O%z7haQ!q}PJd)((Cq-s z5{`NweECujpsl#$`jDFSjDxL9^^LKfO8W3R2Z`dAB-Zbm&{vPa6%xj9W;Kd3X9egF z1$}RfZ~94|$m^r;dOLCvG=b*Suj!sgjOub;@65?BJpSW5%SZT)?ufEVvT|`+|$AVaW zX~tKkblrS84&(uedEicYJR=A~{7ys5(s zXU7|&NnDbU*UtZ3s@Q@BnY)sSd)kIH{j&Tgkm>_-_~I0JdB(l3gIDq-ra9)Iz{`AA zXo8b$BKKmAcveGEFuuLXV2InT9yFx`T2&9M>ApKz)MS(3)6j=(+x znsJ-B=CGSvSaODj%c?*1#g&T<)J3H3^ia4Z@R!g#Gh zl0|)Vn>&F;6ZF-R*?ZOS^E)B`z&;e~Nq~YerQ2b#6-!B5j`$9{Yvqq|)&xkHMY4%J zaByqiGMl=m#twlswXdx4(}F&O6A{eXIeJ^kw4a=D1@)r^`9PX;7md@;OxKT&KKqeJ zB$=~Z>dBHm1MBNIr5zHQ8*^zrxz~A&stJhaR=jYn4DaZUYJ-g|aVYQ}qZ*O~vBGt2YCK^E_G zVp4$@iG!>^9rMkCCM~n?Y5IS_UW59EbhD{H?>$0&zTBDpAF%NRTrXW6(oe*C^-r8* z_s=JV`JZ62v#mcJWH)1RJL%cv)wClwhn2)mItt4!2o(mk6 zX@NfN8t$m2f=f=;3L6cj6_r_!psgV}Ow^*Mb-CT5(cU_|lvbD|Eu#K*Xt8~X14B9S z%5u;Z(n%TXH~EjViZ1M+hy70c?rQ#uTyL_dP&t3Ab8XF)qP;Qf<}t~z${1)U#&{>P zW*==`*w9DK5J~WEw%A=I-SHe;KJJ6(_QJZB{yQE1G`Q6=QDOQU-Y(A+Gf$vP{E8*i z#A^RC#ATrso+Y#;q{%7u@9#~sPE*8Cczs7!daAD2kIHwhfj49lZY#(r7BW3lP;F|cWP6(K7WKip{!k?2|D3HXv|1R4Fl%K|MQ=`~PA3MQTcykU`xiGPRIcjlkA+clZQ#Be;c z2U(cqjs$)lLk(kf^E1ObH5T?HWyoDh6G-FFj&eus&HSAO9Y^bWPu?<~gCpr=#(Wg@ z_!xNFEo=;IM517Bu!2us$-{k^;NcBwY&AY;wwji@eeAivpcwlckjLXpTvbf;(@RdR zjqHw}l%LOVa7H-`vmw>ST|(^fZoJchG#@s$Cekb_tl5b;8!L;4kSO;;!vT> zb9rE)-&v}iK*Cw^-68Dzx4r4au!r!LcK%?#?-*@jD&`9}8`@exh0%Ftn$ryghue}* zLsU#8A0NYwKbVDw?vs3VxMj(YZbxL$V52;!_gTEW86CpK@wo{K>rXt>rLpMed@_5= zG^h_ra@Kh`C)D$t&{f|JN^#ShBP@rM=zmYIT=YPw%G9|l;vlo0w~AAyouxDA;+=6= zH74(vJ=$r_ja2vAX{yY6i+7q@u>J{BJ)P;%$zO;$;xJgO!$G6^RiN16tnl5oF)w@}`gwKumL@bGP^W3*Pq}Gj z7OPT)g@7_1s~uyZ)E>7OI4f~w6ZD2sdQI|S<$vewH-imYL=c+1x5f4Y=?O?QTKi2^ zem5bUL6o;T|M3%YgaVXY#iZoSC>HEC{zpa2(*;YHc7DOiYtibLmwW!!ApZ(%_|Lyu zI%CUb>X&ARA%_Q*rlWkxqqNT9e;&+R!VpkDLd5xe4%*#J3~%(T(4R4T{Sp?c&bvK* zRst6nUB_WsK|@6n+uvx7PaEP-`N_&SW4MyrorL>vW({y=4J&j4ZOVrZKwP@Xd#bBG zBu@V143kdFFCee&;2f>h+g4Z6I;!S-V>_qIhv6Yxs6mt~q*3*i&VoN|llyY;YJ@ol zt&Skx8DH$FRm~D)(D4iCT+;P(!>c*}a=|+#A{zIYdrDG0#~FrBiRx!O2~(Ew8OGNH?T`CC(+GlX zrGw(*i|{}n82S{8CR^M&*rYO%*sXSIT9RS%JIlV`OK^K<+Ahg^A1icO=KQZhDxm-9@M-ZY z#xfwcK-Gg{ohpB$U8X>8fQ%?0od^&l`#8DE* zM=U`NX*nmEaqsIBWZD5Q^$ST_4_6(aQVG*ATzaUwrR?JIeHA|{q*+nj*r?_%>E*oMjOyL_CRLz2t)OQIp7p%2Fo|Cgz_ z)F+#vxW|v{m?O>UMT5YfIR5opxsBaaJQ3*3PH_fRvk3h5fZx-nyESSo+nl3*#(=Vr zXDWQp zJ_5ZN{BBAjJ80q^_z&aimEXQwN*1>t;xb62-lNxz^qSqmBj~{RtzrS4lf!OwK5Ndl zyw0lbEh1{~5vD|~&j2>rV?93*K)?MF@MJXjT<$>|bIl_pja+-J#e~Kd! zg%^1PK&ZrF5ocnBCuAx{$;kR+>*Unp#=!^=pO?Y@ZKgljFukq%>!*Hj(SF_8PEl&b z@mFY!QV4tn-tT=#DQTQo(dN-Ux2c}kfGl#ZUw4%y5+6Jwi&Qi;dvItvQ;T8IZ&(o1 z#UY(82EAElt(+8X6O$L6bzweqNW|Ta1o*JiF+j9RIQWRuZ#wCK7SAWt1KvmT!d&C+ z>e?0}Qw+Kx3Lwo;2!=f000b0NK!GgW&h)X6Ser!`AB*?8o_i}2S>jNmEvU=LLLMpC zi>wR^xLl#c>Xj^GXw>E{Hbp$@c8kEDd5fJrcllIMfS+Q(QZ9hZc#MB`E zE^v*qR(o6L2<3+p)5B(kS}5VW2F!y!+OPJ&8C)AgMcGjuBm~g9DX}5Ze6nyFQbj)j zd(1r7vv1%Vv;qF=E1Vbm--Z9Y;e_UhpiR8Bs->ccJT3YXHanl!i-W8mr zB}nYRtPVh2sEmYycn&6=bs6p|>c3JcMJny4ZREZQ{(Sa2RL|~UuCc^v4E$A2;BbzM z7StG{uBcIbpxXaufDM)#?@PM_j6AF@eZ(-fvF4xg<}Y-8V+fGMCB#*h8}k}Q!iV2M zt`-{KnPlYUvw#KuiCJ>P5>;8WS0)eLDfJ-9A2(%cm^QmO0y&dE-|7EdZ&M{7m=_iA5U&1MQ}72S&A zNHun!i!E)+Xir>aK3W^cq+qskU?>`(0CY@(sedN5tfu)$Kq(IqvoEJtVriov#?eJp zv-zAC?Jgd@&ry*@E~r!P{`Q>x6PX@Imo>MEnY=nZCLb(_%#*({f6-}UKL(0!t;-a3+hCSpH6%2;C>J?v1?ulb68jw!nIx-71u_~K@sOFV znLdD0{P$710|xr{qgTX61ya%*;aSOIBDJKN)4bFd+8dAC+N7bRe9#{-2)(gTV1Oas zyZLjIJ$;uAd@04m`wg9nUGoFq-|s|{zI&qHaPHX8WZq)1e$O&@m!`H~ukQJxt31h| zRBdgcNQ@=f_>ftm&RdN3fHkWZ-(l!m&(bzD7yKT1Jw1nK6^F07pW&{bLQ$bY&7^|g zm^hYHUQDqs&De0Hqbx+q+>#AiUVt@#J!p5z(Q!&8%n;zAgN#F2pGf3H;k3B|DjQP~ z!K(Tmx)*LTN=vtl&9wG&ZxRo)HxJ;Oan5$(s>kLrxAWr#@AX>*U3=*JUz9);3n?|U zAI1Z%qul_mG-pI{k|WZ0xhhg&$ka!HnLj?=xKx&|bxkU`BO$2*sy>mR6})I^dYY&n zLkcC^lZ(@Zvb{oMJ1ejEX@sVkohE#e5UEr-m4mOar*(~DYP1@WAVMIUpyu~7s}tSF z#95MrBfF4DDEk^=fKmY_Eg#X}DywaN9oa4<=db9fkndO(+$Lzp@ctEM&@5tj-MacI zF%JwuuvMy89sId_mV6ByyH;-Dj4X2@1Pu$OhUuCY#2)!=wDLu;Ox#Mr`y%!&S)T6OUr?n@_=JjNk)Ef;kQU*x zuf4k}2RFg)?ahZo%)Qv^8P6coOF$j_XEh15Gl^pwg(&M0Ryuv_*Jbt{r zolUy~8E)cSvW8a9^aNSD4sKEEj;%DTYvG$#U4RQTQBvudo_QMrMh~azSLGkp{A&TR zf@d~&q;os!PlNhvwolSjoz~_cpRuZ|cxjfI_-Y>pkEmYma>m$9Qfe^n67gZ)ofK?9 z+>acs@n70U$9>oKoA)wA-Q4SV@LIp%JWVbv!)lT}Psnf#g9Jj`VMQCC!2o1S5t%}r z3a5)@f4?sQ9&n8w+G89Bt0b^60zSVdqxXF^SY`eHVHk-zstR6VAFQoxObE)^w}GyA zs@O>8P+z#vwwlwr+`Mzx(3CRbKco)8)yvCA(C+BCQpikmv_^FJKqRaaMC_1Ov^l+P z`Z3ZCz9Z*B8EM?5R9C&sDZrm1Xze)tB1|6&+Pv>AfZDRkuQo_`aJ|tP#G#mbW5n(j zeiiS3TWCe8dnN*m_y{5;;1=yofl}M}9#z($TJHji{*}VYxPyZE7JzaUJiRN_6goEt zJ>{P&hq6EOc1K@>){)HSZmqPfNlXpnz z*I<}X>l_U8feE~N8s9OU%q}P>P5V(qL7Qo{8jnq#$S2HbV(!sHdYb3M9sI?npw7-M zA*tg+2Ntf|DxJUO#l;6-qiA@Lnuls&v@dMf#Qn{ck@e{YgGJ69RX7+;U_P&U7w}`Pd%PR)ysnsoUYgSacz%Icy5L87M{}f3J6+qmP37St6G7CfaBM-It z`_&bJq(=h`W%o@%MW#vM+#C)Yv@DBtn}|8;$ggNLUUjrUJ* zv|`9>EiKpdXxopB+oaE@a7AxU>IW=*Na@x+oLD}>HuGcC6Ds`vr2Gr@m((8iT%xIg zi>d=*IIC(uo*NniBJJ6b zwteTi4E}qz&J(RSK7Z)$ok)c|Qno~(@gqx9;)m?XdQF{zga-`d%^TWFBQ!DK?+N1M z%w!|driPe36hl_+Xthk*3^gTp3*Bh$MF1ObQpV;Cft z`yeeH$DU_jJX*f$r_Ik+4^7~>{{8oGgP%C~<1}?j0;?<>oAKwz6a0E7Z!_E!rM|?T-;2Da`Ga`G& zs@fAJ-FK|i+#WU;bMMdUy(adQomL~=ZsyE* z?u`8!WG6WEFQv3;sam3bJq8w{M;XidyG_~T?N8`#y%4jiNm);)(a-7~AbOpAv1Gt) z+IroGYediS^UZ;+aeI+JO}G`5PjDw{eYg-OXbzu{z|QFbEr(~$cso#yqiFX+ z_eedYX@uKn09rtJNAO+dRzFmSaYP;a-x+a!IX@U{D~tEeH~NPnHtjdRG?>N&BOZDi%HCPRHDCr zyw7%{O_vZp4MO5dU#)Yygd?LvT}dR4S@ks0{jgr~(t-s<`}&Wi@Z;k|B|o@(<6~=w(?%l$7#u!NFp81Q zS6eY~+!3Dk>kbGqTtn#?L+9g$aPW!9N1yJ)CveaNV)yk2NB7iweQ+&5O8&HRyJ|(n z^$PNKCUBqde%km$^$sqQ&kSDCYwCliukJFC*nLM2KRhBy7Bcd7u=@u{Sd;=gi}yGIFu2ub10I9+i=`{`*eM?jLs=Ua63``dC^G?mV)#xXwyay!ver;O*F`T!CWc*cNYsERQnV~~c zC+jSWYJuEb%C(o4W$RD?2+8oOpMPnqF1cK)b~O|Oj^m?n+&fOIyt>lPKyUh= zuYb%2;**)85xtdo{W*2tc6MjaT?IMmQmBb@@c`OUAQkv9yLrd;TBUko;8OevQV;<1 z^pFMLnO#dUuy0O#^~kNewo!oFLWieV3Z&dgr@z}hQPkodJ=`8Xj3Ap5Jaxfi7Pc;o z#{Se_haT@%meows<;OG;9;FL>dl9%@yU*b2FT=>(2E4nT2=?v?Vhc{d`pfxJ_-Ayt zJNsd4_ zQ9pEwb0S8M2@x6L><+C;2Y!j>_Id*Vh*Pd}8&gC?|Ibjs=`IuCNEX9JcvSIOhz)UR&JIHFn_6b7KkJ zy;8>wG|ZcT%6nir;(Izb6#q?!?i!EZZP~h=rRo|K`xn)tpjuj(_M67bC#3M4g`Eai zQyQQqA-)upFC;2B<01dhsUiTNOdMYN()^B-^dcMrcKnzWjwwv^;tt`{V7;b6zi40C zdDNv7$nHN=lEM;bQ9F)>8#{p5I3`}wUywcMdg_0ctzh6y*JOh=XILt1JB=$xlEphaIgrA2=!xWvA_yd{(Tw&E+Oi0F50z$sY^i{)qGt|(@Oerh zBln0my!$aBfARY+h@koLU~X0__%BzNkx?fss$k~m_B+doHkpKAcddB@RVTyR9A*f3 z`9+H^J*xl2N#S<72i59d&mdWGfTf<0td0>H^o^yE)eExTCfst$#t-A~CQ4JBy6G$j z<1Q}gng%14x$HlP9_hyT^kzfFaffC$!E+YJ!PIjK zg1@hsbGWoHtSCO-$J<+Cx_V~xT=lmC@K?5-VJmlStn0t~W%?5ihDb>v=?jTf@Uqo7 z7(w=}31jGT_p*#ql1xCUWzc1XT_Jn_!~>?Ak<`gJDCzX6)X6c#hX+zPjOl}@fbh_; z4Sc_165;#st~SU;oR+>N+aUP{)Tf5v=laD_uQ=23ILx!)A~Df+ldJ4~HgECO;OH)aS36N?~{fqha6$48MKRk0vpr z)#eiSW53b>%tSg3l^5=0i>bk-wRPfdAZ75I0hBorE#EcllM`9l5mi394se5-9!mzM zL0O-M$l+RJup;^&dt5Xc4RgsIN~werNr}Q|c)XM@Q=DU({`!{~PR;ea+mba6`S|xF zTB}*Aj7BDreT8;&^S^V6>icsqt~s5Pz-lWj6kX`xk-q|62AT%=(Tyche-~9xN0Uok zL%c2Kl=I@GM$f$|-LDe~orj9U04_>y&3Wc6?1CdJ#QHIV9ae+E@kbTgk={OxctjhE zi%kxmFHe_3jrZpE2qal0|n9f=M)~ z$X$`%zHzNdC*!0}3CcjgG)~zHTkS#n!2sdwE8HXz63?0UdG~m+yx%z@DBnUxCap9l zweuH5HOQ9I1#c?@Is!KXy8d-Qd91tPq&swt*yMG6;i&!ggqxE#gnClJU zAHBp5|F~mx>$vprvKzC=|L!@7$Ue!hc?+3-DDYPR;_?_y))7i;0oyu>&rlRO$8b8z zb6qmw?mIN3GBVF*)(4G_iDb>urOG3it>H$X00Y`r02WLGh$aLL1LmWPwg<8|l4;uO zz`rY@{iPh$wq~w}#v$>&HGrF6nhqRl^J!I_bZ1Us$nM;i=THz0ChRoruTn&`v+B=e%VH;A; z$tf4}5|9f6f}WfQN**ZtlQFt_=Ot%Fx|@_x7Zpx)d-@wXJ;4c0%_#k#TI!>`w9Q_4 z_DW(mSI%Ug3t`5{nU~EUrqTHBfPX4YrJNr`4Da&$43=j{l_eh6v4XCL7k9@EY!0J2 zRSg6BYFGUOBFzhUjyv>O$?>-ufAWoTQ#;e9OaqMNzEoFsnIQDLt;CuyG-h)ru#qlzxkSFLrs+9O*$;S z9+5DxL*x8BbP(9mhkCGp8Z)H}*lBIf174B^g5hx7T<($G@#LKO4C*JuPkbRfCM4=g zC6)IH!BR5Hy2t;3t`2fjpPe2gpH&UVsu59tTN@{c*h~H*WNsYRrqTnQ+H&bGSY|M! zcmrbpVKB~e8>?g2jqfko>{9@lttS^sQ@F)@lz>uxlz3;KUglJM21{g#uH8EL=byvl zH57$;6#KGAo&r$|!B3R|L=@^P-YBKhHcPsiBL&{DdcJ!z*1mlDJ;`OtRO!Z?vLe2@ z!S{nk+0%vrg6f0blGQup0T%m+e_|viR4nzd^Tq7pOG72j&zFCDIEvb?;1z_8h12qkf>=D;3v{8yYxGJVxN(Y zlk%v*vm)#zo1X1wpE3McG0hdhK?@!2fx9#7 zPCsLIrS$S`fI!x%#6BvP7UwZ&Y&T!s1|c00UI(q)I=${uluq0KU9w4&Rn6$T{0qzT zxKKs6B|xl}=Pg}8H8r6|yN6r~FcOd0EbbIFgnmOL?y6i>)l%8r*os4FI-SNB@84*G zzvFo|T2nUInX<8^;j|1Yv4mVO(b#{8_44TdI9~1Cz@I5IohgfZe|_vB*t1Umg+haU zxcAH1paS-SrH&5Zms z3Wwu>!L|&Nhb$M;9_gQaN0_eQzbM6tmR1$6#cz6rh%sL-LaQ&0Y(5VHaENeqD>={( zH~Fa1L7i@%_uW-+2D6Ea(5q%5@X37MK=F5iwh{iv?gZRoQsU&Mpj!9Lm7M65DM)RM z>OUKPG4B+^)FaDH)Yf7AM%ZO0)QP52Us-<3pc5S<1fw%CPh_U08H8qKWTYA-cbS@x zddb;O&LOdYHmi%HxgAcu*|?jr&P7-QMOmLm8xIT-Wmc7TrI!bun zi!ZqwanhgGp1C&vT~35Me0lBe(bGYs7Bb)M&v%2*+4w8t&Lo2(inR_{A zhpGD(zmTCpnZyO#1_kv6X=Cvif9xjsg?zWW41IW-YJ(Ue=4E%O6l-cXdrDF;N`{gd zGJ*Jz!pa-n3if)L_|t0jRr+>3U$BcSO_~nQ1>Km!S*y1ttLIU%9xxq^232Vyjtf9u)ow?ymqAB$`A zi^HM}N_8ih>}Z;QS!}L2RS!AUKzsJe)&B-~`JpeTC`~%(mcE?nSV*>-)3(#OCk1_l z%zSyydP@%$DsF1%XoJtT%gFy)iD-@_qF@ikdjZ!3(Lt!%WC zuwQDuANX~lTN&)(=@EB{Y8?Xx3vV?Wl*HP=2j4XSLBBE?)^xO&(Wj3|=z;n^FJ7-T zdXQD~?t-wwvkMjXq9v^$I`#F4X_)5&BQtDWF zcuib2ED@@V1Y!^?m(R{0`XEsnjv9Q>oOmEOv(1BKJ-*Wv66kKGcM+unRpJz8e|dU} zB+W29H#(OvFFHHwH+4~;*M3HmEgMz@H#x~+!I~fZ7;wb2M9-0Jvh}9_A{uLATVtH6 zuWCNT`_}&vtvX+{>e)JC$J~!kYx_O@ABhSTW@_2XuY~Dg&WcMp5U6xhNq>Dl^)nzm z&hT|U$;Et(qFje87QTmkBT=Oi4QTmyz{Mwx*Z39+Tx?2GSBJj<(iP+!9hbdB@J6u( z;jFTSSaMNMqG166^dGi0N09@eXeWGijivV?8Y=!_PyA5osS7+Gj^*{lxd*O!Cpa4o z@6(oN;wmTu&6=-!8v`j-1{A}=gx>{U8ZG2Y`1B4KeK8&se~&V6STS}u!ROERD<96| z>V4=!)3mPoyb^sBggV8%HoF0kLiM|5>1>OT3yR=)aP=hgJzahx5zw+iq^{92Q~O5_ z@~gYk@Pr|*O;uO-#BMr-A?yt6EdTUb*)cpd<4bsl`qbY=BB4De1i}GkZhJF>A3Md~ z6)s-G9*=vEm>P(D2WHA5i^HmS%^-u-epi%>(rlqRBA%vzpE?U;9heXDQEB-ijHE7- zfX}@@vXXhfA-s+j*n3eGIMVWfPF&Yc)Zq&tOAWSbZIFRh9gSmzd-llQBWxjQGJy*h zDo2GmVhC0AS<0(CPb3L|4HKkjuWKLZOV6pJ)W>u&-zwXZS{afmq*6I_G2J`7y4Y+x zxlobv8n(puuZC3X@CIWQ)4G;q%%vlF&eH1pv45`ypxRr}JyrizRuVNylu*4K&RxAP zd~H#+LoeIcP*-oP;K7qqW5)XCV-;aR9OEu$J3gmTnZ!A-Wfx+d7ESr*I3i4tAbu=c zyUa$ml117@8Ni?v_AwwV`A6^bkAI<5y8Dtk4Y3(sI6IfJtPyseDd*_rg-|`*h0^|Q)efjw+X<4ea$5c9^ORrvIctb zskzk?XuKWM>HtP&P!v9#!?aKhGUl^ z$z85e`}!kxJ`f6bxGN!1Q`cg!c5ELAaOfyi3^==p>FSPQJ-HZN$4q4}(!l7l2&1;e009?I@5SESH#8yK#y zl^fFHoAMv%)kY;nJ*!1|laUdSrYSt)4(Tljyp=|4hXypN0Kk3ap6LLAMht<{)%?B$ zm%gq|M9H_bkq;|Ek+K`GzC2O+TCUZJ$gV+oPp;L)QEaxyKsWXGmc4XzMKRxgY4Tc^ z$+OKk<-|FKP&Fguks=oIT2xM3r5u+a60SW)w1`6vyA=98TVD~?j5@^hV}mVy)0PP= z=f?fC0dsO&;xr=|89fI}=~XoEG?y3gtVb#@QAYP^E~Fp#!&Cs@4n=2sj(;5u3k>Ft zzk{Fm$vZquN8r+wAC9s2Eck#g#tp=equSdfsqLl98Em_%qGR8#BgLFKaDRGFAVLw{ z(_TNBDiD;%5P3%TpThSO0oKD%AGfmCW@XQ@FzSYis*GltaW!L!8IidT1iN$QJ` z^NMRjwx`C%;7nxz|DF&p3y2fR2lCVHuW1NC3csqUQwS}lf4HQ-J_=osUWul7jIkgg zv`Z60!EDyBVZIPcP-RwD*~hN}Id{Brkgf1SL}ppLEKIf%BFlf625oLCCb(C%7x{}e3b)*z|Kff7_+cOA) z!GQ_}y1AWuD$6E<+8~qB`5B&2Gyf z%K8BRxOBhLNn);EK)tTC)M`Wf>53|zuk<6Ov&OGA0xS`}MXv2hObE*zyQblSWYLj0 z2^+y;D4J1HgKrPM<(2iX=`mFq#Xt|0JWOzHRachv=qyzopo%Tu@i1x1e=c)^f%->76!3cX(RD$MZ7x8HQX%kWB=^NNg zMkre*_;|LI3JgK8*u4S$DyX8Im4uL=S)JW@h3&_GhphT*Lx4s|5cO4Y`<>{hcTjd) zN?F+Z&&-TsZ-Xus`K5r2w4t2z5i2zYVNU%KJXWqt;#a_>1gjeK{;%xZHKEdEqR@Ai zkq}qJ%{=}ByB&S_MT%dK|G;*Mq0!x7!{W6g1)2z*67(b1+^*kTf+6}}9GR9;w;NW2 zzb;*dg4OPru_OUS?MH;TucS24Tz%8GiCEF<^(kdS93#>0zdzb-b8(1|RYoKeo=T~+x7;@=R)qVrm?2ntV{N+JPP`IY5?gRSaRZ)%d?3X=f&qXLdyidky9aw+t zkZB&yr@)cSkKrt)<&-mlCVi6QpnPl8pm40@Wr^dPy0RHt!__yuyq8}einFM5!xDs% zgKgKV8W$_4bar<>WUGb`gEo0f00ZIc&GPc>5Afy3uAQKhVTeh$$^Acrz{edQOJw$e zOijOu{mBo34_#&lNBfrV&Y~HHA_n3BoQa=ZdxQm+D~iir9PJc;%71LHJeHtm=>Wz}CD$kEY1{;fQCTJ1Ca=-8Xx^mF(VYYBlMKi^^u4R@ptSRCRosOh zO3q-sv;;^u$ptn2Q{QslIG*!wEHL9g+|u7M8pl7xSFHfIjgOb+K3gT{IN7b>2f^kJ z_q!rnrH!Jugfd;XnAY!&p>wD}_nwE~8GIQB+K!I9${8OSfX0jEaYA9&JLA&Eyd}GW zJZ>X%?YiUIIer=(TNl*|ip_fg{k%rj)B=PqqwV9Cye9JMdp~{E=qathroe6z{{csH zv;2w2(c?dNR$Gsrhq1%ekCbzmz*QylucQ$5@$UHl;_aP+L<^KG(XwsVDcklb+qP}nwr!oVZQHhOTXVW&I_~Z1 z`|f-5^CEYwoskhc_g{Wwu9eAX!eQp#f8KKaO1C~;&ugT(T5io{Wx6)>Ec3zpfgNKq zLK5Sd-Ke;K=>*5A%JsrgW7mE4Ih*W~ec>^jZFl3qwqm8wovNXVQAqmLY!5VKVe7Kdh z=M)c+CB$ZLU4Sy|d%Q__k$-)vX$axulWK)FfAi5>OH*R#G_|cc>*VmPtvNsfLeUD_ zt{TCPZ1xMM|!)Vv6_9?es6mRmJ!(j+}xuxoJW^_j6-qu z5l@=U#3y-@TC<~s(=6;qi(Y^46GHJUX?nbb^bD33Fxstvc>c__Z?2X;>#PeXpW&;Qr zA{LOYl78)rGFTbpC{-soSGagYR{v=ZKvnKzk=Az5oE^XuR6l2uwK@cGgr;PDtF5H)(+f zm>?$@TGH`cGAOA>%(g&MS+h4m@~#Lvw!h+B0I10}Ia&lHG9jkZE?%ubrfXr;a^U$b zGqUOoZ34H+x!VGx26+QFE+D}+AO@umuOkRCsz73`L42@XM;>meQ}$ID`@=8BXwRiu zZGqK--DBoSx-bYAuL4XNnj||{fkY=Wt%VBdwM&pB)Hb1$;N@|Z*l<2ZUpG>sH@mDr zD$A&hb>b=-AR3PBQi&b0E;GX}O?F)e7`t*w?Hm^Y%y0T1oIzb(`qR=vH}c^h+{rL2 z0>q4ov~B`VI#l)U&$u&4L{)s4dUFH7Y8Um-_SRAYPqKSU2+}NNX1{Ru))DqbDa~L7 zr&qu^nWd&3^GX75H=s{&>19J8T*3ERAY;1deK|)_H%)4qkhU(1hxb-NRd0FRE@5$e z)x!7E>$CNG5_hN14@hTYuYyi69-wTVZC^8qFG29KJEi`f$~9e1#0h#B*IF zym9vWSpwyOY~2?9)OAV!nGoRmNEaRR@3Gwd{DryK+HH6ADp_dy_B30qbDWvUyTpY5 zh4MW1lzSZiHZO}|8I{XT3rF_838{bg126#>)%q{>E*$^RyC^yvIJw&y(+P?TiP+jW zDgE{71^=Dyg@KiWmlw*>$-!9P8p>@wT1it5Srvn~gCMh=;}K*xsZ4oH^MZWGZ!rS`>;Z)kl~QLfJ(vMOhM?2NB}!)$TnhBa1;*^=c?XK|VuiGR zn1!>W{OQ?lrx`3-o=k+Wlpx;2%eU{FkDs59A0t7(Fo@p>LYut&C~&vU_1W%kBUfi1 z(#Q8m+xhgKa|>c8K^{qBzj(qEl+3h)*kH?#%TH`h8(p$VHL7HRH@K_a(~=;1Ke@GH z@hK-Pj<}mdI41VMKIKOGlxkBzK=OX0kb~R+k(q%B>Scrx*N1rvQOFBw5p>ZPoI{EksIzlopK0ra)lE6Mg%_aba_b-wvN4+w0oQ2~Y=mO%HZm3# z`{*mM6U0%-0st5#a7gp|9g|>q*a{W*>I@)+G7AuWFMtDrCI_m~3v$P8KMdV*c($W^ zWALZL$WT@4q!GQ|;iE9I;R;0}n`77`RK8s!=1*r8Q|M|MgSdagj=2dFwAv9Z?2KL( zg>1w4R7GCtm4Y^%JvgSaYY`_Jrl)C?Qj*gYdJ>lxe_Nqzb6~{%x4)2ia#78%cMl~6 zAf&a-RJx{ZBwku+j~^@RpQV{@^Kd?U&98ZR-k-IgPEyAbypmDPBIO{XQ~9s(ZIcmB zu6JMQQ$G8PwBpK5C9kIa_HV7LHLpIWT6W&?%z7oA`L7wcc}sh?8oh8>Ntq8~-IhVF z0ODLjWC}p!gzFDfZ?PD*K(`7*f7iEH;8ilczss7jhyj7!5Icdk0Y>;qN&#(dDNX@g z`ygIHKcxW-SoU{CK3Bk;Uh|$A$=BdlC}+p>o_x|udlg|M?gYDl_>APr@rS8yp~0*n zD4&P|S>N>ofPM^SnS4ff1qGSR78H!5WB4<_?6QGc7|5sK)j_+*^JpZ!S%zTN+ZV+g zL-^15lj#^ocSFaZtc>MEE__oRg&+w87wnJ!bjaZvbr^lQcs1+Q&KtL}^PO3Ti4IB(3B zvGBuNWL;t7U)`KV$@|gImRUScdgdw%eJpz3BSVmBr{hs+h_+d1{(>R+rY7YX)*je2 z#t*eXYZyMmtKw5Qf{ao;UWU=z0e(WSy#vF*B=%+e&cU7$-x`_wfc-)I`5kMai9Id& zO2X@v(+uW*{^z4{3*QSwKlehQ*WM31AK&Z?vGb5MHtFDw#vOsqeb!lKjZr3kCtSE8 z@~8-7^XfVdyI+3B8iRsmq=3D-U7mMd40bOXcCT{G!|JADh;-ml7FzlnRAlqP?q8KV z4*GwTyMLn?Wd7%}W~rBlD#ir>Kz9mQ@-K5T{eQ~I^v^jfeq<@!0025!1@Ql6O6Gs0 z{4W(E0}~?y>%XbStbav{|NM(9PDne=qx7F2;)_R;i+h4GPU^8{qp{^DqqTOg9U1D4 zIza&gu5P4_@Yt*%Vi2gUkl6$U4Ylz)Ir7G0aNKoJtY%!OVpv6}BeNDw@<|kzjd_Jp zIKcbPou3{uP1gLP$?M5$I1iuqo15Wt1|slhde%oy0aV@Kuj97(wYzXWrP#h#GKeuWu%QdQNPnTeyjIJA053cxFoP%EE8)vtV zi;dbWah3|&AsBh647z%}@Q-K+QI+d8%a%0!%jSvaO)@=V-FK#mvP+Jp?Nm9Hrz%@b z3`tW~+&{|Zzw%o5?=NRLqWldB`$%@R{h3R_PFu{KJbLIrf+DSu!c$zX_@QN6gd{Sw zhQY)H{PpM&?Dq3e4IL$2Ju6@h1q*UELb1U~x&Oq3@DPRk3Dj&;<-!CL)r=WN3jf1S z3rQzj;Ow}s=N`GCp_`ojx7)!yrXf(j8Xv^q!z^=Tru~haXmCx~XsnJKqvr=DQ`5r1 zpYc0Mqy)HKZ5iHSFx9rl+45?&F6FkF(mr+W9KuFlaDd;sczKqDHdn>f$9^WoGK4ZR z;`>fQ`3n^pS@Z(+-jMAgs+aZXi*=U=eGT9W>VUPs)hzf#%ETE%6KrJo-G8N_)nFy{ zJ>)v=;5*w6LmV$Mm)mD4e02_FxNln#S&{8A$Y_p8T=McB<5tK{7y!NTJP%YYf8O{@ z;}mhScajnh`nZTKC}5^@ShlID zP0rGl9S1GaXxuFZ7j9aYHgN5={J2JoRZVlo0%qSIuupgWxRBhw6%V`x=GXA!>)t0^ z3|`z#Lz+oPj21gS8`Crwt(AZ~$Do@$Y7h5Kye@81;G((#`CZ-i@g8c7BoTNOQ8Yqs zTsN50Sw#+CKRBI0*lZAOGS>`rDo|at!d)h(W-k+WxEu94XuuR9LLnIbUV=F1-aWf@ zJ6H5!4iXQ~a&ClVFtm8_b%hL3g0b2<)=K$XK6 zfL#ZKx3?yRG6dQpd_wjrEZ?su$r^X=;Vva_b(&%EYjeFn$SZ(|bjU$#EskXTV(KRu zTA39_mPNv=EQV81I!L;a%j1?^Q!Ouu;ogNtf%~7HR03Q`&>?WcGTdObFUvv(q6Gl( z1=(iUy$$oFB@SR;7EM3E7J9<0@j4YNXi<-LuG^nJ*flZuO$?K+?f6sYfqJD0;BBm* z-VsB1TvAFzv9wE{A;=7`CAKF)5LY3_G42?4<{+7hYqb#ua{g(bYQa5`#eeCpSJ0bW z!28Xrb>VT@j^CNDd~MrV2*1YS#RN8Ct^?f!KTptZ@ma#z)K%aIL|Ksq4ayhL3HwZk z;%}Q*`|W46#9?>k;Iv!D zL&%!QpKj8b{AJW84yHD4t`>0?I|E{x;JHNLw>`HM=B!-VH{EY4NBAjA0)JmVlCXN& zy38~M5$HCUQ^LCo;Qp`_!^_)X=r+jB&YQ5}k~&uXl=2R!sp5B`j>_NX<&*=hp)WW2 zt9!Lg%bmJ7IOlc5mPzyXU^h1E$6NF%BD zn6VlxOKYBc-n3&X(c6X)!Bpj1f9Xb(e`yQ#G!~Id$~R^AHrTI8?X8C)6Ne7Xotsti zs!=c2In)%LF1pn<1)Um&&ej)L8hNjMIq8sbvXHODnbW8jg=x~|h)mf9N_{x?Ie^#Q zfFbG12k3Ynr*4;K^)Ol@GFr!WlX!d?>@s^;{x$eOS`7$>N?1svIGFarg0l!J%CG5s zB{DeIY8HCyc9KvnO{^~RB_}zpR}Fn#L=Dd17sd3ITyi^It+B~$(llKig zJ9ur^Ooi}5_N9jRzqwrCue7DOo{+U@03nH|cV{L7`AOKKd&J&S2o=2V?}_6cD;=f7 zg3oD3>j_D!qp#B(M-r z)2t}|yLsV~v3_meyF=vtv0h7EoS)_;ql$bcPo?w-Pqcc#!kKk&{M@2ZJ%ZZOki})C z)w?by|1LH9J}bas1C}+C`vWgtC<&Xi-Y^c$%-Tf9&kHQM8}AUl`4Xnyqm1=Xc0{E@ zvAkKLh_bINnm_7*Zw7tjV>MszOUyb~*12pwL)XG}rGB-78k>B`bwW#d+)|d*;zSYq zW%z>dwfht28g*cI_7?11)pmd7H}5h_Q>qNz-a)D|M8lb%#i>pd+w~0;EXd#+V4)^8 z;1))|vA6T`I$?#qsE$*2i!X)7wj5q5%zLe&p~D1;Fqj~*$Q!Vh6whtRuT?dmB;|Pa zBA5Ga>P2tb{K3m`-d~YL{iz`P2l}Q(wMT1S_EWhZV2`Z|T%+EFtXSzg zt1WCg3ZFcn`j4Mn4s@~5J%Chz1Kx;QFs<6G|qI$(9W`jlh=)~ZIqcPt2Q(aXNOT~W6I*U)#jU5%AD;u zvP)wbU{@v$OZs*h6OI_+VkhP>EIh`xEhmCaP&4Z86Cxs!GXk5GB2{`USlaLUfvfEr zc5GPZRWjvc%8CUAdV7)DV=&Z%$n_rNNm5N4TSOX`)qC`*RZ6HNl@?)wsk@Oh z*?U?E#w;|oX*44qd4*e+mRggCVQH$Ubbiz7g!rRQpl2y0#{Y&8RPY(^Rd}GgabmOT z<-OJdxR7MQ<9YUIxGGcdB4Y{P;Cb$omP|>~-g~0FqIhtME|haEcLEsh+yMlXIaZD9 zm^8oqYyczhD?n5S1@t$QB8W;qrBfoj>{vg3ShHeb*}km*oL=b`@XNo>H=k#fD9#Of<|Rm3pYf~jG&ua!aQ}b?62Pxs^g&(O$sJBq@OEM zF0c}eZ}24>x_Tc;bq;5GaKQn}f6fHScQCb?vhQ$I*tB%t=G&m|QYlvTi`@dy zO@0OiE9qSvvuCdXE8K?n*=W~6_Ar2ahi3p!;N{&EDed>s z`c>!LQ38{^Rb6dzdD4odrKO<``4pOZ0Mt5LP@#m}04Oa&SzZdWK}i|vJ)J+*G4*%2 zRiDHd8Vh~$4IEIp&*KSEK zkXS34ztMQUiCUbc|CW(FxGsX0%st$D(xEM?b0 zu~@pGVZx4XFzEK$X#3@k3vPmTkc&Vxm*gZ$kP@!zDsO9*$qP>4=qcLNRKfO*! zF(bF)3i8FKz?on-$M`w!#DXVUh&jJck;RBES!6V=$L6ws%;g7!iN|^o6+432+I=i$ zpYov4`96^>vvtK9O*_9Z;l;dmLgtgq2&Cfhf-VI$fNCk9GyC=qG2GqIxd1(q$n?G; zN_d?zI?bC<7e($_)q^#rD_hZADaWnXkWT&}!Ky^vJ-{;p(}rXvw5QB(wJC}oZ93w9_cHk0m6!Hh-Q>0JRysQpI=iL4j(MI* z$u;F_Lo9Es4Yt*vE4qisxx;wEOdU?~WLmx(Rj-lM&r+%feGXc=aE!I*^~O z#6s8e5gfMEL+^f{s0DtbtraA<^NmY_xidRPLbsps zk``tviTEH%8Q`~B3!vW_NYNAePb@d< zOKGe4Yw>1yF2NZZ8-K5cDDAn_WrqlWSyE{Wvo0IJw@&{w)~u~)&(mXXpVG>vaIH@o zrw)G%+dK%VYr6MapyY5#-C9NaSL57&i%H{he?TC6A8{bA4G^>xsufXC)xS5B zKjV|nF0EUH0>d)heTk0X567}Lp{7}3hm2>;^x)WCZfDduzzbnFgY$Yi-A`lY>zFhP zbZLDcJ~5(PQK7C%3_GpAG83W9+GH9t&oTZQP;rdc{CiRCIAc)OhGYoyr5fL1h9U}> zs@SP!Nzsuf?5=*&^XUBZf5&J8|VJ^-D%^pT#XLU7-cLq?K*}eW0EeZFY;bUoqU0o?-I?x#%U7udLmpl-k7&}%mY2|9RwPtSL~#zq16fP52>?6jil zB^8?1L952=0;${GJ5YPLJecTzS53a<-aXtOUA-bau&1vW@}(Fafw(@q%ng39J=7r* zF!Tn`GoP^Jp?%M)+$)@LxrGBMsm8H(r@1B{7jL8Q&7B#Qa7Z3|`1FFGqb`>`78 zx{G~Fmo7j$OwC{QQ9!PWf^dbhMe+`BFXScW)$;0ox1qjV39BAj??X(H^eE0t!$IS& zd7ijU{#7hRcoB!2utn{uikET|=d1kf87y8WY@fW(KSY--re3v~&t2^$_U6(|-NE;< zE?X^I{lm6mJC=;B;VONkmF=iK9nH~lyqWFjI~~YT;)wTy-|7Rra)IvMl^w~uoGhC| zp7)0@q<$8TSo`lSq=FyFvXP-#1BRqeauHK;{6Zg$c;0Z9mOMoPd?Mgy2yd`4yUICDZa z-~t5Z1TnN-=&K6hpnwlDtWMQzMox}`&+M>}19Va99}4=MlJNI*%#mY-`fy|jNZMTi zR_e4qFH8iAs64yPVmzAYR{^!{4f-&{ew5^`fLBD?(dBvHb^)7c=$+tHX2`?;P9wpX z3?>I{@YG+yz+yuO?2KZ#l#+*7FavrATm-OW0-yr;DBpuB;LK}*Jod~_b$58u0(h0o zJ#c;LZ+)}fXQ;`-D0+yj6)Ei}SYpgD|#WJG@mSXDF%)7@gVMhaq#B`CVT-anTPB9CJ0@D+E?7tuY?Ly?-*PrgI zM3#ziH!-CMifqXyaYA^G7A#6bV%Kg; zMme&9oJO)yHD&;&iJ!u0V(eeh8Hbeh%y>Yt5Y?XjD^qr~{N-BZ|GUz)t9b#7#Z;~t z?WWx1xsM07f~a=`MqB+U7%_q^oOS*i>2A+?UL7P&D8y4QX4E~t|6Z<2s^5by>qbL# zOmxBw+}iysI>2ilt=CbsQIwk=@?`2)3Cb&e-6wIfMudbB^5gs8{bTrkDN%{LYu>k8 zzy~hpqC)L|JqT;~S5+=;0&kzH;B^yttdM48l~Ft(Ppvrk8isu$Px7b8B$sWxl0M#N zxpd@lo`8}VUuxJ)evyt9wGl!dCK2!0OJ>EdDgVJ20WJ!)Av}pa>SW_}Ru!JmmN4~k z=((%&cjCwAxdz8Yd@}v(yxpZi4fhPU9qo3ADi7Y2DQ2K)(Dr^!o1k+yx+qeLP4jKI zUC)qp@O)NWTw14;Sd~J|6E_McLE9(`bGD-w!F&^=M)(=?YJ%Q0^l>X4;k*8bL{EB>an!Y_YUU(#uGm*- z1O)~B`%*$6Mp*tWriSc-;5OP_qn}vCC?|iRL8UC{Y}I($*aKH(UAMmOo&La?`sTAE z2@uG1<)u5?-*waNIn#CW!*}AF<5$~A3TKD z@R0J%fvg18m(`~x*~TTw0|W<7b#NpkR06mlpa?HUfljong)rv^Hkr33ECFo%5D>9X zLAZ8Nv{|-1CYi#pm_Q&9At}-O0d945iY(g230FeRi&zBk5#x|6((QlBx9({V1)w*;-%SZ>=8qvH@lv0$zr<&Gtgo5h z8Y9sxsbw^$>!cb#H86zV6Riu-g`^86RF+j7Di%}>7r-mMt8Az3vhOmdbTTC}!I`v8 zb?TdHw+yhYJS|oBD`!kiH`Z3GS}Gbp=6Hv`@sqL)%J7e0BTK?t`bafZej0K-Np+*jS^wtOK;tdz0giO2U0o9vP+oFpmq(Dv!mUYLG$tokWlX>bsLgs7a2 zvOi)nuj4mW0Z^n6{05EXRs3jc)!=~WylQh)gM>f+pT7e zDr#}jR?4Cj+u!|s^v&iT)lziq`hFE)(6oTdkvn0=3yexuN_ZXw6CA8@E*ei% z)FJ4+KhBTqM}gBUQVM%>hqUdfODqh%VdtyOqk~zGl{iVRK~s|Q8qPtuR_mgM49$Z` zm;Nn)KhU!NOQwY{nA>c(`8xDgeyj4(v=|`!G32aV96WTq(8We%IIBW6K1a)`C!D`Q z8n2~U1LM(|Ei}(mw7pMm8!GW#)?#vX{H?n^;4b|+zOB3Nia4rt=nee9w%>)^L}92@ z`wY0@_j<<~DvdKn8Z8{5fyC23K*jV?51vtSx`Ai*aqEH>cnSI0!%p<6OmGBlF8E7Z zLS5{fm|Fc0a5O1{sZQ!p1}x(7RRvs3Rf7tqOk%r&QxmiG{hdS2sMYRGr5Kb5a=d-- zY68h(on3y7a|JEs{2nmU&P3#mxlKqr-#ThBIjGpMjpc23K3INw=Vm<%yJbye~))Cyk_a!0p|Glti+7Yyq7yT zxfw*=DBHy)$luYb^-7)YA6Zl#e+BHY(eg^cZ8%2A9hv`Ldj${84+Cd<(~_^M-;KeR zFu7cXT=z3J(GaHWz;bnf1kJgC#4;3Z~(LYsaAsSwIAS( zo0L$m-E0DQ?)fDdrv1GEW$3L+6! zkZBwiNl&Os&IXydRr6FV`iL&#WWvPus6{ci}Ff`A4Na}G8=x}64+*&g# zPmdpUS)l^AjFsy&yE4`b0NF0cY?C4vK*~S|rAN2=LP>@*(2)LV{E$8%Rr5XZ^o02G zY4D$S{2(LEgeN*6K$*#PNJW6(OII{_YP(Y>C*#hwL~||8M1^Y7$Tw4Qbz)|7%@d~r z1sgqvUBUo1My@yr)c3-{CvV`m$}2ryEo!Tn+CIZx0L#?Og5|*bVSh{AA5N-g##15d z#eI#ftzU#lNeL=HjN1H!q3I`jt)(a0fS~fx6GjV|sg+8TS4`8DSz%FWN^|K{fp_-! za0Q2l_2Gt)ec)4qRvonEj)4`;QdulKP?xM?97k%5gyAlT9@A?!=vj=5D!nXqe=~Yt zLzPQbHCW21HfnmLMYh5yXA&5B&SR(|=Z=ZiD>W!QGc&>wU7WgWGlUXK2Cp&9El6Ti zZmMLTplm3jtca+trl_DWgp$1G7hfW&2&luDXAd>MQF;%OZ{|tKv+_|K3hUpCO&!JFr=-^VPqNBPX^2a@37F z2+j@kry)H5JndccPst#L4{9n164%@IHkkFrWDK7O4MboY1=qYDu%G5-N)CzeLh^KI z>t|D737&gQq4;EBe6+tm)_0G5>CLxR2_2knD6h{)lRTXAh>H-FOy2KMmH@gbed z3iFP+>c+IzqerOXYXQnckNB_8dZRG!o_m;fjV)~!ft{xA3wrA-vAuY0$q~3+TCCRh?H{)j*laewc3T5uC^S}2 zdf0S+INv@u;chpBONqmsnQ?z*)`3P9FMmi5)k#i9jwp!7L$cO~{S&?y%qG{wjbg5Z zO~&2M306?L9$qPwvm#&j{(Ptf)t<*5qJ>Q%G9z)j3&X1nyx`v(IL#2Wkep(UekFT3 zja$R#E+>1anM}fyo@TT9E&k@P!#Zd-rTKYI|MCe(%ny67W~vc+HZnPV6O00b^! z^e{v4dSH?J%#hUL(PA6zVIP?g8vi~|mb}?&t9K`<50?J4*>sJxY=}UrK*;$z<4*%m zNx1p&2OLW+t*&n@RZ&P;KtT?M*9X^%G0k$XdvR`jo8Qu|a`LoS#LPAPHmLQ}eZ>K0 zg4<5j{XO8R1!ib&?Bez34`T&;sy~aGT%@YI7#gS{*n*5$VorKtyiv+vi*rALou9+D zz8;w$u%0O(K5Y00;l_aRcv#qObz07M^R*4L`)^mNCrN1AJNrwfYen5_Tn8;wvN1VR zC%q3DEKS~#3J30wiXr-|FD7pqPO#9Ah)GQMtybAPhii&EnVlv}Huuf;pWT$bgAQA3 zCpO3j`h$%ebm;340Kr84X`XY->bv~b(3;eFWh*1z@kwYIg<4bEu8|bu#=J$DWEo9! z;jjCZZjmp)!-iDRT9*FmAHFVxXT-JDAxaO7^V})>O3vT=eIl$Og`@8=hX;?IRlZjz zS3$Xh-9B7dvs4Jrfa1}->|g6Xj->&`V72tMFXUvj>6rvJ5cxbUf5fkO0HG~HjTa?A)$MffEa<7V5ohO z)~0t)afxM1No0RLk}l5fzDU+VMs-^m6J9ZvmJ1xUD%n4DCyxI zz^-S9Yu|Sx=f*4^fO(itY1n;hk$<9w+HVaSizP6W8;j4S z#XV(TR&p1GhEWQN0t&^q4pcCQqd5zv#sxWjeOdj7FO)0=Q@#=&e@|r1e6kzI60@^U zp7mCb$0n5$oQN4uw&F%gnTrdMVoTR=OqIogQ>5fS@b8?dAi=|$aIe1v^Rx%9NDMt1At9*w%s!*^ zAo_5@2F9#4k%(?I3G&kNtkyQKp6~8$J4|>H47vIIS}ZMt;q<`udU`GqZHZNh4QSe{ z^^e$Bs#W*;=v989WqwVKaovgET=PPXtc||#X{lwkPOL8OE+p+BY(a2#-7%Rsd!Y+@ z6}C8>vmoUbNk>mGZF&d`iB7;^3z?2n8gfN%xxU>#I&*R}JX*u(Ca0n?PiQ1%rckz! ze!aJK>7`Edyy+8E%$hl>vDgW$!E+>9!q9jb+ z05C8ru6GzGf=-?x_G$PDM6+AA{HS5*58>g(0lQ^a9;yz${|Zg3mQ9~q(BQ&U(9N$p zfSnQLmzZM~Zr zRb-D37dKp6TtGIr?1ay`XPv%$ioUgQb;QorY4gchV-`+<6v2&~o2Ja5w^ufOdCtrU z3AH0h3W;vKn0v^vg+tA{p`#_F@nV`f{~K=9>?90iyU*LVn;oFgaYC>Z`w#rw(N=_Z zJwLWLrf^0mf}0aP+MEy?^mM!^_n)wndyAoa&p1DDhYFN~6Q0_q5Li4t*qH%=0aw=$ z+b%zJ0?h;9w>2E=hFe(>es*m9THQw3ibI{UAlPK#Wa9efNBLDLQ)`pcDp;oX3kj&G zn*BcoNZ6S=TXO~T0mA_iuG^)x>0>N2Z=tWgfYQ2h2>-Id#r_Xk@&7aXneqQ%KkLQK z(#vdq*FNtIiteoA05ArDr~a$#4F4o0`48;~oveX{qLVe9%r6GU|2UuG;OO*=fq{kX z-*A|jSy}#D7p+QD+i^pr-g`&aU$jF(r{JXFBV|I_#VL_poojowZQZlYD~@KpLbLuf z;jrp;=jM!`O^iP%<$fKKMNrS~Pszz+Iv72S)aH}6_WBb~PrrLMq9*e-Pa|klWvqb!uUq*LDyjVSGls%S`4} zajPYdc`HwJ^;=H?!vkTl5xQ6LQjAuy{Ta zmT|B?PtsmU#%^W;HcA}Trix-6SmhOHq8zk__yg8^gtwz+R9fI-Mn2kZ43zC)@0HxS zL1k-#J$ao@IKkki2_o)b!1LxoTswK`kKxfg14*`g)2}@Vn`v;|0^;)|+%j9AfFFg} zx-w1VIuGPPS$^0foOYDJX$ugl@^`|*6b1qTz-{iqcuTF!_OAkR1n{Tgg=Ce&B%_4n@GkS;|Na6#x~BOOWr$;LLC!4>Vj->S+la z@$tpVl)mBl0ieD%1pzLUqzw;adANbOMMED;qb6*fDo81^T4n805kltQ_Qh3LxnP33 z$k9-bxl5?grll;;N>a=X&;E6kL`yo>&;{Z)hKA82ycL*&QRH73MPM}ITL9OE>!UR5 zEU)Xv(KyQ?7A)pYWyL_<%F)HF#>#;dr@iv!ACJCXw%PeS1TCN z;+~-=`f;31W`Z^iQILNY2WX(+W_Ib)qBN3B?3RBA*8q)zFwG4q1UB6G1YX7^^G_`0 z;_>NxHg~Ukb$hjR_sJTK!rHz$Mm3@a5nF zm1J~$e2IZ}oPn=2UQ z4$X19_NxLWMj#lr44*4~k2Y2PMmjM3s%wMfWwk&JZjvzxgVa&O%sB_SfeAtdams-huH8shi$ZV-2fL8bPROWb zrNUcCE3L?^(CcyF(tAvtScO^sd|gLBTvsUqKhxc@1P2lzc`sp5cPj81_I7UGF8VcQ zA0F1CHKoKTOKMjXSF>b787cZ(1&#dyO7T{i;H@yuU8EY^Ou5X2G@6%Kp<|#z+0q#xOMImAU!prgqH~U+RBk z_!xzP1B-9ctwFbxr8FhJlw}mIZ|sP4~q-Am@(&SXA(Jnu9OKn;qSipb@0x$VW5V)&9w}mUjY4ulAzHPG3_|ZP~?#B%i z9BKq$++44wUS&iDzEWGYBK2{YVXjiWAf%c8$01v*IyGlcrte~J*BDCY=7tS#zW&+H z^fB`Y)8%E&y};Jp$Ml6Wdn?8XjXK*HG`s3_A%Ci-)g0+F1@aQkT8VT5l2cNdGxBBH za8YnkWq6us38;xF{z6LjkH|C~XG@fn;@jkx>TB+1rO(A*v7R_9iXvU+?zGg|BvrQa zW?dDv6&3Wxcz<(!?SFS?SXwWSeAAD7a}HCr{(R2pXNhX6ud1LmCkI;_>;IQq0b9Mk zd)b^K4X`SdCLOf)zhTX8)edYe8_wn1=V4h-+T8_=D}o{OwLYBgA26X~cxY#Mn8EiK%l0kTx8Z%7{<0^itz8vIgC&e&4`@Od#921 zg&4d58H`i^nfwPJz0e>t`kv5_E=)w8b#`4#}5dWNC9AkP`_;PK01kNB@uS{$HVPQ$uQd z=urDIKdW|6-Ge#>FOs4$P2iuPc*NkWPR)ZFkDSzmF)Y11^Q=oi2T~_oM_gx2heD@J zN56)hk>h`wgWcioXkUCF5x6K^3=R$l`+o-J;tPpJyx9cVv*3!!)@5u%CEg?Aq^A$> zbma5BrRGLZ{sWS{q{c>)HZ{k(lK&HMI5->}4i87y;v0xeMW5BO#_nK$xIa1+A4&9|0o*oD2j|1{(WUqbB304q7_GknMy~&9_3ZzLf%CY}CjM`D z`f%XE$&r2@Ka@eRE?LvTykW9W=pt$v2MyGsAN{`ua!v=Q!_(2Zcpj^e$&t>(yA)#$0=#DY_O81LkSLNMYb8E8@muhIUa_q;G zimKFCPJL5&NY%>9o|k)zW3&%n)AwZa-fQAeX2Zq9lb$P7#0qWu;YrP)OJcw=nnkk#S5jxTyV z=K=bZ%`;2-E%dU?Gz9(kB-3K(N2F*K%JqTS2+qJ z+I~5DA57;BQ;CY?>NtLSAXfY!3&Ar6_Q88b@i_@ClkD*TUID)veY3al67J%V+$ech?2s{&R1i}HptFQDul5!mJu1kVC=&?-{14R@3Xw` z@jn0E$9Y`$ANO&bpX>a5KKFH22#@lP=w1 zZ@M1H6!6l;vpz5k9<0nA$tcRo?l-m2b?u+6mhpS&^znyH(0*4icbYiU?Shm)tqWl} z!DRInzDE;lS;Bc?5epTks7ID;6+ZR2HZ33gjKlggNO*l#+&yp*W?N8IsWN};X01e1 z5mYTidX!&ta}Jtzaozk~M)!ka2_Aurqz7ZXeS&xQB0@(x4VojKr=@~hsz1J_e|ZOT z^{1Z59ETz8-M3eTJPxRnXc@J-*E4 z^m$Wa*r)vX@L_OAR(j4h5i+-0X(M4I4hsw3wGM*yeVY~M9>&vuYdE^FSh7f`-8EwI#^SHa zQ=Ou+Cr>}Ed_nD4NiL7A(e3$kDoPz7-!@;vip;iH_rDMfg-1VkQhwt()Qnm)#TW4U z=$k-Z*r(F3vV861tk&#k^Ls_y};cdia%-n*V^&U z#!^r0YT4I!LscDWFE8e6x`TPnEl^o@ z+;AQuQqD0C`LQw;pFf4_%Nf|>boXc*PchgehG|Ae!eOU-tMh)@7mUL-G@EC81df7$ z4<7L(pwIV#ODZM;8TJg2yP+JnsjQ#OgNsgKJiqhte(qkS}I$u_lDE{!Y_i zUNmhRD43ql*B(l9JUc$+Y@!J`*BHqBirft65$MM8v1kS!vE1kQ&Yb9sH@U4aJuHA1 zFuUKDf!Nb`C~50$=1+cvP@p$_a5(EWY~MaNa%aBOteGx#leo;vcf?%GqffNfNf>nBV}4a})styJE`_0uFxhc^T!YQ2LX?_3i%k=-*jY$?q84Q zp75u)xtrb_fK+n~H(izbg>t6mri?)St^r#o zyW2xv?Yp6a>Ib<2L!pBK%o-{{W^DfXMxa8la@G=CS<%#G{i|dfyVP}=AutdHWG386 zWUx|^TsU~koG`k0l{|rg37DQt{LKBOv;enZQW=i(-TTNHE5oH-!wtgT0}+YYFZ;n4MVEwfQ|@Lbnfr?w_bBB0 z0z15Y4&Yb9Q1i|rgWXeLy458$Lo8!1;ywBTr}IrW!tEbjedtT?mgIi){X)}NE{WNt zdihJPKs2hf^C~Z+FDfmGNc0Y1NJF$64t|hoSo@7di`n=YDBWhSy;X`Zn&)7_L84D? zHsOSHfv;CPgbT4?CV_Pc0h%lrsKu4l(uk87k$nLne9{ZLUtED5bAAWMa$zX(bq0q% zu`lrxq$~Jd+Yp|u1^X`v2c(M{z50h-l_YwNKKDbQ*Y@T1UYqbZm=&U$!~|Nf4Nur2 z(MI-~U`X?qgQ_*_CWz|oPJ)qrevuJp8b9-P>9P)n2}i$4;d>z(a5a8)B!X{9AF*15 z-TiOjvtDYLAolO!+~|K+cO?JYYL}dd|MdFm?`MXs=0Q2FwTSC`GjZtQ>?&2-h_EKx z=%=R!*L~fN_$KGFt)u)Ver75jPP{)7&)K`Z=Jw+=|8%jE0gDU67tosa$Y?e%)_de# zag*%H)^sty0l$lJRBa-BIuc`dgfhC4zNfTuCY7U;!6>t$TVQl0L#LK=23jf0e=<3K z$EGOtsGr}5%}8!CJAY!*mDM0cwgc{(*(FqqIR(v$$O>tv9(B}$xbMmR0BcA3WLjlh z$7#zBf_qx0$079?9`~(FIgFwPGK1OPIVrceU2^Gvfw&Fi#=)Y(Gp-!{A%t8~rwB#WbV7HI|O3 zj8T8p`^d$)et`1XdSq4zji&ByT+T5Rd~c8!KMK7fmj5*OiIF?mJ1gHO_kelQmAM~C z2uC_+HVf^h)GeBT-s@-h=FT%u3FQfmf;(EhGZ`~3V~&y)a(;;Rmk#z`MzhwLqLNc~ z^K|ifl-0`_f7MNystS`ofS}LuM!41*u7@e&MdMO+IZx|X)X|&|YZ(s~Bh{Sj9&Sz! z@h#U)XY_=8Mepo-QztJsJkhV6MK_*xHu4q0M9EM!h~3GDs$ZG)o24561rJ;kiKTT* zx7UaH?B%MGF)J;C@3<#W3^{fJQ|@+S)}ZDG&(mAJp@|==etIoW&##B{pf%j4$8+lW zsB-`m$)Zj7PfyM$;G9{JVTbvyRt!1$ydHJnq3&bXaaLlqndwo@&o!|X<9(KX`Uy(e z63bD$Jq!&=F{znG$DWT%?Y?;`1qhxgC2I;cyUxyqO)V?;KOq9bA+xVL>QK_2D7j5E z|4eb#ay%5VJGFeH--v+xJR<@Vnx2P;`^>IUeAanvw#=0N1C@u|9aJ#tp8xKCPwcoB z#zIl9iH!33nJ5*=6AX#*A#eX-NohTF^j;DU^_WeVm=SulTno)d`eiz0h~fk=5o=N2 z_>|KM=)AR0=8BMXxvf(a(ujgoI9AHms2kgYBYCq1`@`o zw3+WVC9GQG8Vfx?t@a*yy^MmMluj12_lFVA4pu>lw~m}EJ8BGqF^no_>NTSKa!9_|KXPr>dL0k>HozK8Sx_EP!55O{@EO(P!6c7_ zop{UT7B`T*y;O?y((4tGpRZHVS2*v%fpMWp10i={LH)84Q(Ym04Nd)48EKe+I!_AW z{_T|2{sR!V$w-_EJv)>}grJlA@-CR$9Liwa=ZP_&uU}CZpPdT3gL}PqlV?P`)l68xk2cDpF@~%w1hKEfR45n8z>2Bj<;3q5>Xiw7RU8afcX~i{Q>q zyyh?9ws`vo256V^(EqNKJU-iT(y#xQ?G>|s@Wf`h_{=WZONM_pCHOI2D_`4rVu=Id zKgxpYB6h#d_Rt#$yYAcPgXRrhkeW^Gvx;ejvTXLrNhspESN}9^5N!2Kx3IJ!)Wb{= zwHW;e1ZTKt1wyZ@F{G{xVF~8_|9}u2c zT{9jMygKDqO_+fRj}v$vo8Vt;ZA-ReSq`s{(MDmUCtsblA}iN6w+BMb(*fm_L@iF0 z)FxtBPU}=gB94#oo^-sE45()X6V`-}Y`mOrRKnbsg*lPHH8vK)#9&;F7|`Uu@(;^A zd0iE9DF`Dqd7~8)yb-Nl%ejxynB=5T41J2`8qd6E0*M#75@}@tMgFYJ7y&MqFZ?-E zx>P# z%EGf%eKv6BpnupFxR>Uv%-2H*p)pyytCo7hD$#vg0@<@0a#4Co_)CiAwwT4D;+Hg~ zZ4rF;ObFf9lKK|}%eH_rVBta|u?C@9eo9px-*2EyJ-6?6{?m_HwW0y)MFJ;+^EZ(%E4{?HC`k#qY zn!LXVl`o0hDeOA?0C0CR8|n+qPU8mi%bRta+{2Z9hF)J;aJGwi2<2W`dTtjj4!u!@ zQAFR|mEoUQgiFY1y-xVEe{#~4J`pVsI_#jC0q$Us^gI<|PJSD)$9+m>`io9DY1{j} z2|ZTsA`R`q^1cF&FRaTWqzfIWKvaIVb=u~2KjI_Zw%;E$;z2#W7{){94SzLum@@tc z9lI>t-rcmUTG7ym_;e&s1aA~>CPtXLN6Ny4^dJgEZ|SZ%Az7|u$FB#bCVgvQcK6Yi zcPhN{(2K-7Zy&8LJUWf1^N{R`K-8%4T9zY6gr~HqRGCiH7@xy9M>?nQPGKjNR=RQ* z=nAV2yl~o3aGDNza-xF#U8>08l}e_cskmcWrCG$g#-p3mPF|fx%S{zcHEt3662v=m z1??%8W?roiQA7A1y2DrFVIld&9~4cBO@8M6zDT~4g1v;x`z>H;#NDqa(JNW6QHW0> zR)}p&pb)iy{PcY6!;tr6=rs)Lk zA#p4_;j)#Emn7Nvu}KIg|Ig#3W7+YKS=Gf2%@ECw-_`=tYPNni?b`*a_$BsQ2%&NFE zESGN<@lX(@?SJRlk0Qk%T}Roe0NU~d$N1*onh)@9(Ij_bXJ^E0es1?}$c^f{6fMzy zqc5p`{r0$)^@yj{dB01>jH+DlEObr^s1{DfzSrdepQ0^LTER(*)DKwh!nH&OQ?qN! zV=Pa1{^T{jU$-g}t=x#w$^FYKz*{RLsZJ(S?G0RZekbvmm9MNpm>l{gjpcCvv5hUM zB7F8m4wMH4nFP$Fd;O?MP~5vcF$QNDvsCL^t#2$EzhQ|jn@(>k^G)Ebl@BUX1gfS7 zV)5WqyYEB2&Dn`l^+AQ>lv=jxB}p6DoVs2rT48^*JrE-$M1kI7zP~)a>FdB)iI?4{B~<(d|zNH^@POA zSJEK8-*dM7t6bIq&|LNEeoEIOmr3Og3C*$Fuc$Kpa)!$LJX5zC5|I~{(vl&PdBg-O9^lxQ1G*bzC zh>fVJN%va$YC~+jaj`}cfZEUIXUw=kdF4l5J*VIu4q_zus(TUK*j^F9UDa!DrM1pM zOb$scQUH)osMJCz5&RmJBxvF?uXv`J3g1KShxJMxqC$3^L-58d+GDuJ0HUsfx~V zN!*5PmmAxR226~!q{G#1OGxg@M5(N}DWS3&wvKe^CG#t>HNwQflGQX?tLS%M$!`jv zA)*`c#3Ed!gm7Yyb+&O;Z3J^w=ctu|mlXLjZZ{4&4{KbXilQ;@QozCLX~v{cw!4V_efGne8l9yiPaX$SrAb4%F)T@9= zZ$S*FK`o^j4cQ3W{-#G0ORCyy9en83!wdK4vi1 zwjYKs{hYbc#-bb}?J=h8e`RP<_qim03}Cncn^wQ6)fUDbM*_#&&CBsoH978ywH~T+ zM?+%?T)8!;kE)%8;MlS5HU~vjs&s#^vIuD2N6Gq#dnZi0r8+5!;O4^Rnm04d%_zm2 z9mIFIYiq`}tmIPXyP?YD=Qw*qKdx_{Pa+t|AOelWFg*A83SOIxH}M>^w_U9p-_9kk z`xeR~kLgmsDJ&)RcGX*$VwYrqS`G#%(qA;|YT9it#^uWoXs620#NM3($zpb~M`+~u zE{+E(?=_xhy#9E;MA5EWJS5g45B6;=ib&~+c;1#5@(SQtS@xii%m9-s{kU0dSpn0` zORFnn@l16_Sd=*QM)|ADxv`?OUC*0jOEOg zkU@V(8b%^){FI;7++6o;Godh(8};4O@FO0s;53Ui@$sWmR#=~I0kZmC=K3TtRFpB3 zbP+Ws(Tr&D9H8@jVzTpcYs|`Wi%Wc)1~m;zjjmpR;h;a8QB8(%Rxjahp9=74s{Wiu z*NAMh-_JI+Q-3%X!spt(QF@#K{p4|7%8~tPyrl=qrQc0rGWfO=sesybzT(%7_}b-y zDsZZm#_Qjq)`G%qzbs71?{x?P>Z6`tP_MT+GcqNruYbbZSdLD=g7X))hH5riTPCFu zX=Z!e$t#Y6tO@krC=nk;4objN z0ectNY|t<7^nmAj2r;^TPhHTC2*zr3EK zH)rtjGsz4U0NHJYX=VjtV6O-lEoxFH`rI=McBMpYb2s2|o^SB6u2+c_QNqNnyQ#~y zU=D)m#CL!8dWs`$gxQ)jEgwaz^IQJ3yDg=1&53wGwYAJ1*Bf0KtREa352V_#3Fwh zkp&N6tP2#FhSf3bcFj#rs9Llri35pc_|z*Oa&riB!=W=dg^b%Lq4jqcx*zxsOc;iiIG0M(LqW* z!+$=j%+s&7<}nT|;8E<*KL7AgzE8og>RRJp1JggflTE$j7R!}6|CrVZC^X%x6IIav ztorP%bj9TvsKkxq+09}%MNGj8-?OYjw|&o>i(tcUj@%a?ctRKy{iK-O3*6p#IUrZ2 zJkO@@;Zm9f-knA0$hZErQMJ3KhOr06IRd+!_10qTqS+ zk$SuKfb-ecMo;9R(lg4nX9@Hgp@W0Fu)@JwQ{4Hrg7X;xx>g7eBQ|J~zSY@1r3*R9 z8Mb%XJF9<$5W%u4m*zRvWANt4;%HLGfBy7Y38thjS8As zIm-5mu|-`49$COZ(w)CVz+yt_`cG%V*{fu_ls%)>g6jtqdz?!&m9@?gpn12LWO<*q vZ|C1JbT)n%Fz}p(9yZ$We;=0(2!uQj40-<4jX@Cvk^#vx2n*|)=rQ~+M6nN6 diff --git a/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_tr.pdf b/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_tr.pdf deleted file mode 100644 index b636034524f3afae696f7b7c921bdf96897a4ef9..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 544438 zcmZ5|bzD?m(6@nrpo9o0jkKh~(ku;%ERB?;LayG^;W`6~8E1KC^xLD%xKIZ{} zz+gOQ7bi1gTRe~PKWX7QlRdvAx`;)E0@>w_h;KS!(L6DFe}nm!B9;W!Jz}1i8yH$5 zL%AK+5rXGWU-oOQ1GsbZ)zO5H0Ew+^405kv5emZ$UH9XZv>YwpN6t2g9@)~DN;!Q zqLFq&&Yu4(giBi+{}mqsT0)JH@R4bNJjSX?VLG<(LbHZ+8$+WLifBBBkzbbOSZ%?u z=db|Mi=bld7v_&gK%j%NdOHsR%(Q2E<|p5NN;lP48{o0nW7fUVtC3yL(2ThxB9#4V z`0$y&gWg5q(`ib8A~Bn=)SP$ES#NzkW``L=$TY?8AVL$K)5lmxN!0O)n5O4#uvPs!1(xWqj+zMxg%k*1D9)mC#DsZD2;N(RouJjyn>6f>9Y47)wm>c8y8cH=PRE zTLQxyH-t^`2dEB7^2@$r^to||S^7xP2BVEc$j!2pvag6&hqkwXA+9RbLh|0JikI-uLJReCV1sZoL-m}vAf+Y^Q+`f!be46mH|mmC1Y?>D-Y zVqOZ%V`khSf|z2!xiN%w{TCZSC_^%aQD!i}luo%qh=~$oA`xWp-7k6I;sgH@X?C~` z20+XA%!1Fl(ZU*7#|qvy?h($Pe1 zxlQM-*AicJmnqOl{Z=u<=s(XWBD6#wtn50xgK;Mvzu=bW18rFVynx@c4}0EQ#yq9L zDBaQC&E~oC>{*K15XP=2S+!3+a2+LO-GRaTpg;SJr{4Kwdk5CLWv*xYwBoD#Pi^$L zF0cIYzxJb7?UVQEfO)tXmdJN7a~A>V#!}0n`X7@Mf5S?Skq=vAgu2|oeJqF@IDGSC zQHb$t<=t10BZ_}scIQO8jL3sH9|5=9%zQ|dg;n$f{MW00os-JGzASs+EqE7$sYJP{ zmZOFs6xIMQm|A*6?zsz!eXG-y{<`WdX5F|)QZUVnyhBEH{JF_kx;9ToxhV{uxG{s$ zFk4@((deT*jReEUa^HArOu!LQNrv$ig_!ftz3KlY&>KKYE`sqn9cvpz)SfI+C&a_} zL`pzM&D_dAcFLW^_9k#->16H797&q%whqC@3gIpx4+>J zC|Z1TH%{?ny;O3;c=wpTWHECChTtT^l_d58y2{69p4t4~qM5I4Xv^7w)+5iZ% zFe0)6I2o}F!0vPG@}44LdAD7@-5`sSfB=Qaacm+Zn?gg@rGc)IbO)D=# zPj3T4c{-zUO04>q-!Jp`sMB8h^DT5^$oa_0T4h{lzY1)M`-l84L(DZwFGU%#G%ZL6 zn()ETgI`?3Ei}o3MGrIXHNUt&iiro}ilS#gX=n~vqyt7Do+0$QFcY5rH240lhw+c~ zn+&30%O6it7_%`8amJ_*5F_53#>-$3FK@S9_Y{-md;1YFMjT58P)?nlwsw+K<<$e` z8(oek3U5Cc0<6yD=8B~HrY@t7mB)gsx{oO}Pk12x!sH!GW2*R!~y0Y`YC8? z>BM8wn4DFw!@G?i0gWhm(b9w@d4mae9)v1y8oG7~C?i@e5w|c2V-#B1wz;`Pm|jh= zq#0ukDE<8d#F?Lo@&%!V9={`|jN%UPv5l1~x`7?hk#KTR8-TPLn$ylY!Fw)qrJvp~ z=G@yV2@nVG%ZI5}xNU{TtFw^cTrb%646&R)ui8K_PP+gDrtmN#MbBE}-NI7dxLi*N zX?MxYr&rgui@&?we!d#$5AF0K8MD_@BIaM$;P!VWSWuBIuulsD z+Atc!HYGcG3GQ!J$jkGlKLbdDfJFfhPS8zT2>nk@}UWPMP7gs+TR4Xs_>u@E{t5o z@O~exgR#P}lUL?)>fcZM(dPr@D!^)8#lM}`WcECmA7Hsbk(#=3VH4re6=*JWmdpil>d z?7g@@H886R2ru}dz+a$l^Ff+^ZRX2HJrt<>r3`PxsI*f%G@cfw&2!>0!+1zR1MCRj zGga90b!an5`67;@1NSiS1xc0k5r?IBMd_xY)+q^r)Hf20vQO~i`DFXV{*i9CB;P&2 zlDW*+%kP8fVAv2~b)#9+qq?2}+t_8%$yLg**G_{q5n&i(aJO7d1BcOkZ_w~Bo`7r# z`-HuymtuMEZ0za2WMTBak-O+D^MtxzS;LRR3R8U6)Tay2e~&#xnhICkCg8XO?89m2 z22Aarb@^+}ab8FRh4BSt?)iKrt>}2wAe)yA6sWrrELrjlzyN9D!_+wu}SvxLAMAi=J0-Ve6=88p^vU%GkA_qt7kl!GpcygG_9ydMQ2|C z%})T|kRTH-a=-7`eD}d2%;QZw8KCJ0W{QxyUF@03#7OaF9AWV{oglVDLV*6HcZVFF z42Kq$C=}H)%W4Ca;Folcn+SX@L$kR4BAb+Lm^D_m8&E1>QRR1jxE1#Ix1~u2CN+W9 zzZ?KP)TE7bnA?c3VksF8hYdmltt<3_8bJ4wwv~^>^qZdgSN{6{XiN|Jp(e1_#>pAN zt8DEuwN}s=CfPm^?NNfBAsmh!>(47svX3Yi_2UmQDidJnApt+P&`T|;7lUV{0&mwc ze!2n0B0z)H{u$y+@*Ag)1j)}nH_(;a%p(J%AFfQS1;$&M0(DvPAeNJoZ?OX^I07|w6EXf_H1LM-FJi+7Os zk~FoQy|T{qUZduhEDyD%fKYi)y7uUy-o`C+fJyZ3#m%*G9rSGjK!1tU7qle6!icBA zC4SfgPraVvgkb}U%52h@IMl!TU99$fKPUJXVjZ6Z=!^m$5gUM4K4cD_q;X%J7u(wX z%GK4mmQTF4cBhwbE-b(wUhqiiQj7Cnf~T$( z1(Ha713JJ;tjWYc@u-B%&)Ol6#f8p%D=H}>Ff~>t!15(TEiilD9qiQbfD=a1F_#C( zo@3Bei@$JIjk_|qT;og9;{(0FuJx@9$s`>g&EFI^4wRI?Os7~}PGtb5uMRvdXTnm2 z*Ltuzq5RxVMPzeUA7Zu&T&nI=I<>&Jspfrzlb0j&uem_)c`&H|ezA;I=a$GPRFJ9} zsaujEQuer9_`W*!^B_Q+l$;YNeth#e&2s;5tuPs1x65%x_PR<703bReM(035R+Ye+ zy2|HCofmt`gkLSY6}C(89b+iAw9zrvxXj3W+)VBwhe1LMO5K)piWlYRpRN(VW9_aKe4|pflbV81{sv9wTUV} zcrCQ^K=c%|zXk_R@@y~ECd=q_o)l|3>#3l>eq4s;d|C0KsO#W^V_INidM)c8?T^R1 zE1YDkZ=N?y%{KGJmbIMBpZEzZb{_>m^?*r|^kl<~>85S5R}l9W(uw;C4RB&)WS8Nh zc#7QCAl-T`U=~*Jn*+DR0mME3jnXzv!M*q;?y+XS=E&e73sat+fD5%cb4* z^h*0i;=p~)$|-C9$kCa&Z_wrV_O$IoWZ|g%`bA@p1o?fs_I*cEW>} z*sEr9rdy#u8kCvY>wTWP6FQ^2uEGx5Uk_yw7EYhz-@EfQleu>VURcL@eptI_n*}>r z`_eumTzhwADx5Pb&(NueYUyMZIJZ%s?JY@KSe;j{A~`m#ALPq99NimuclJw-lU(;i zxfwZHW9frlX%$f&=pe?2R`}Qz!*T{T4znj^Kvre= z4|Rl`_7sbT^!1Qej0a*0cRp%^1f#nbZa4@n?#<+*`nzzc?Aodo>e zeLqsj1^dGp8BpDpe&WeD)+R$){h8c_6tlTH@I$)PNoJa!$F{$jPCQ&Z zGYBRp`N;W@5+CcgLcFT;SHNZ`O}IN1u$~&bY}lKlPy>6a;l4k0lo472NzPLo#jl{` zu}J4~K`6=xnn07?VIqkr7ykLegY{SQT({VW@Om67V``U=^d2MpP$>%FofFE z{IM41fe)UK1Oynd#kd%cc5^e}`+NL_IIop-Pn9As_2+ay`sv9=$Mzx;?sN zQ8ye|_=?yO$vPd^bKrf9aw*ybG}P#Qv|b_1=TtWRt1CtPw?2!i-CO?qbme0LPbvL# zI0(8tIYx!A);jrBA*CY115rKvZ`XohC*Q~?6cs?U<7P|qk_vY|2s+o37d_o1M{>R` z+%=Yr#ozW#nNq!B6|dF_TEMe5kGI4|kZzujH}&QK$n~=Df;nHB*Cib-YB-M%%?p3zz7f#4uG;C_mlb0%vW>|{|evW{4US{MM! zn+=xd*&pltb#%hmRiil$%Q1V zD_YF&Ts#B)sJcol@ZXvN;PJ( z`Ljg71^YlGUwU2+4XYIo}7WM3YjuSr!G{awQpN?jvWtxO> zLu$Fjqj&mv(FH*k(NKcZdUVnAEN(c=Yd}tU{at@Q)xN}S708+tpWB^BhRf!LL_aPk zixnn)-bngWsU7v5KFJzuXAJ>OkfuZEp8+#klzdC9nj+^@y_IO zW4b2=A~$f?@La8`ky85bJ?~QWJ&k}q>=P;h?@s6}Obuixeczf{01D=#I3T&9f|xUK zchqD&>URaofW7he_aJ8Whq~JDnyGNar!0v6t9DW8=?&B5TT7rpt6=mcE1u3CAo!M?6IlT^M^pLb!; zx|!;%XjzMib~^Fd%Iw}q#l(|MxiU8D{AIc_Jxc)uQOoC>{cf5WE14S3d@x#_r|Bxc z?u5j+A*hoYSZX%CdR+Wt1UOA@Z zPOp=;&*d)@m5JCsqYyHb=&|eR$jF$$CtP<1vEDDJiS%A8*pA11MoIK>cak=9}; z>F*_u!~E)|viPg=?`vPo|y6O$pC6oIOUho4nEppW@pDMtYa=s}Tr6-J^ zw$qo0DzL21Ny!GST1sHrUoG)F}myR4u=~AA1M@T_wv$kHX2Ryk^8W4 z^WfROBw;YL-XrmO2DiK##lc9*8?@ELpA~`aJ*G?41>arjcu#_wW<8;@vK7R{-M)>0 zyg|?3&y6AN(n;@Gf<>INVeR!>HMNaU>|JVOK)S zuI?18CW^K^pL^vv6#39Yv{>?73Ltau%qG$rd;s4DMoqRp488vbM1*<=Uh= z)q_lGE>6eeBaYL(`xH5m&PyORZiX(r^1ZCFo|s>E+-f=3lYMxP7De^T6<>2?N)gF% zSxaeqVH(jl#gZeIFD!QGbJ1kV)n16V1=c|QS=xM(BOr;`5=B`VZorgNKr_avd6Ok6piHMV`y9}jYwY=@I6q@!IZC-Bh-ko9c^t^sFdnSvVNE zJRrqga+c+^%Xihil=EXxY|udy>GMg!v;kWZ!jRtRIJG>Uhk$MG`5T0w>r1Z+?K=wk z>krt`*gMVF^O&Z_I+&-WFhjod^yqZ9}5cWH|Xx%Y0VCQP8RA0 z$E7sE%1StThB`ysy}5d2C?XhiATVh!&nls=75Pm43fjA8&6e{6$9arh8ieCKCH1Vf zlYC(|zB|&yu;arBmrqFU)+@(R-!HGcllCBMH2DqCbkB3Ut8RHbJ<)qd?(dIrB_YVx zGd7X)9BXjHRfEDp*@lmco>UV4?P4o4-gY!XSt&y!qzFsp^rr)z&jtiFq*Qh_#&@-s^RCv#<=X1!B>Ou9WZFD65ahnk6#K{>|3WUcSa3r zpe~H_M(5n`!!dVm{79(NRA8EpNDF$W+jQaL>rxFDHE`N|)JbAH3GUB6x8vMy6H`$v zJUQniHN;QWS7kP=dlB_M6D~9$*+aD~>%TMkQ$lnR~I{AHEW3A;d{v$gH`$Nm|=&lmQRIUcM}_xry#IBc+3 z*iMY$n7G}U4=ch}@gpCE1bvA9IbswD69Xr&I8#h3SEg&O>u>dJ9PHTXdAOhhy@L6* zidL&(EDzoveST#6O{~5-)mzER%YUnBz>2L<=)*?!*uBMz`0gKFWI6Rp_~mLxC(0Sh ze3Z1~_iQS}RH_Pv9)#DqXW)i2-XR|T!$dXUZ8lAM-@}h(`|?a6PuSIK`FZC_&Clgz zD>sN6h(;49aVp`bt*7F>3PF8)H|n*KCFatJ*FMM6E3nXPxKP+N&Z-5QsJNN)IF=V6Y%MgxjTeh z^VdZ2iA^I8jd{(JPl4x5*asQY$&2Ugyh5AoDcL0I8qSYKr@Y-B_p_i6gFz&GFo|to zFHq=F!hRP&E#fKTo%vf6`P^Z)y2qWU>%8+Px^GWk>9F$3FtzEVaAuLyU03R=$gj`M zcX4i(I<6dELlSg~4Z8gR!akOenhccT+O2eI9oL7ySmHB|@afosL1);Ylu8}J0d#JD zcoz+;ALMR8oZ;`w=dgq-FC}W1CrH6z7Aw#5Vjq=U{EIcJU;+RFkgR`9CzSIJfE=AbZFCKf4D|&@<8wp#EnXDjokUe zpLZWs5H&0EMaLO3OjZL-csa|SUwqUJ&OL?H1U4m}*$k?^!1#mRP^O+B}0u z-J6ea*Yi+UmK-ol6>&-Vpx$TwL09)aF2SeXN{IXwyWD&jlNhcA+M>X2Gcpug(J`gO z>S9}XpM1u750Zshna1$! zJpcZFqz>5}Pc!9Me8XAa@J5h?MMLK&PeR7p>`xz{htb6Dp0J}^AW;!_HrdyvSBtN@ zT@=1WyyJ&_jvGk2d$w_3Xxn%3CI8H(j#uiRW!YVjw`ZyC)TNhj!t3SWvz^pUChwU* zZm_U2+J0*)bZStp-`Sb)!-RJzlwh{ro1@uN+iJ+;y@I}GEdGwyVu%kRV@>v_kI=*W zHd~h?vOhMah$EhGUv}$LF2n0|8t!>UqATS3tF{d+$>eEZ%iIe8DLAa1^?@l;cpO)gv(V4ToQw)ee% z_6}Ay)y?$iOD^o<(ESgAwL)>JUB>3a++pJs;c?HJH;$zfM$Pf$6FxdR{+Ba}CkfjI zIw(8+D4p}#`JPrzkN5O17)4KBSn^&j2MQp--nTlIne&%#lume981H~oqx9AJj(+*n zQ=Z-ixx0VmaWp9u>akNm`&+IkzR1pBUe;oESdU{*Y(CkZkL~HT_n(Ldk1fO2WL;lB zK6(JznkDcNOp#eQAc_Vx{lQhN>fOu5ukO3&FKX`y@DV}ve$at^Vs#zA=FrQ8Uylgo;}sGd?Zv~uZ5>Xcfomf=1$B1| zlP_HcII?`T0)_V6GE?v>U-t zS9CJ_glJ6XsBcu*1CeOLH%Sq^ed2_|afi{zGbxaFUjq5^%}+;d`ISzDlO@k0<48!` zOHgsCBDSZZxy-w4h315#lN2H!w8dvcO&GIb12cNw0)_j5sVBSRo7fPtZe}dng)A9r zmQfP7cI%igNroocW_nNegQ3j+Q=y!_?YAQ1&pxJ*rj$rjc|)iMkUZM#r~{S)*m7yz zfit;af>ZB3wfUdDJC?B1nR?V}Uq$=^$Mnj)nP`IL_ZY3g`!#8ss9nCB?Zb3ge&i^{ z%X$RGYpS9q!q1$&KRF#f%f5q?e-%}(41MxVUlf9Rlf?S#%u#_#p>C;R%e@E6SmlbA zpA>wX2;l~_)SlkOs~}{ha+p2q%is1mGaJ&I~@N!9*}&3pNxx; z=T$CPYaIGcJLHE2gw^VZnkEEUHGyDXeXy}I(be|N3UyZ<`%_-~L)|dNd zscc?e`7v8cmPs6i$)~QA2$mc?C`BoU!c>Z?R7=LAz<8P$mhw^+g;ua%Ezd4F%l(?I zs~*9uOR=)*tSK6ZR*q|<{=j`vi^Qzc>n?YuEH|H4XTptDB+ZGWLFz4b@%Ew>neZ_? zNLG4JKCavwNk}`*3%QGrfND(p(GTbVdFnjaYp^14S?N{Dsn!CA^1?@mA*C0i)4-e3 z%oHD&ulG~nNUh{x4h`Oe4gRlTzx#e##;LL5Sybf;!+KPGz37rtUTJ~uGYF-O=XH!P zY}Ix+=sU}z&ezydRlDIW9J22^=#pBc<9nmwUT5rzBg>{5K(b%dLn;DIdW=24vvwSJ z?@~rN5XPz!G9u9|#jsGFRZ1Tfql?B!qkB^zEyBVJ)LRk@KjH8t?2Ch)Tj7#iT7&U4 z{PO0K6v-z*3Ld+r{M7a_H+Av)tQc!lQSm?-f&hzsP{fC5gYHL?+Nij{J3uSN2hKBh zfoSusk+>Ed6>E+>4{`fNis$VrrfG*HCCi%Kf^3W*b4!3oFsL!Nh1`g*tLRH4A*qXI zXZu-&^D+4kyclNw$xy(?@T<5$#ezY_+_32SNMm&3FdFH2tZLkq%Qo}m!=uI0h=y)8 zDW97mOw1x!GF}E6yt^CxcZ+3eiHsgpxl)HjI@Mbb-tJa(Q-2MqEMGodVRIN%SmFGA zi~qwTTm7pw?f1Or48iO6V5HU?e$!Ay+UH`!@JV`%os?Cqqj`PxuNmTEdYUFeCvJz= z8vZJ@s!H5LwmE2TLeyh#!?8Lfid@cPN5TXlzNojT*q zhbYDK`uh(Cb9%)EsKRB*d?3w(kMbIrzv9H5z0w6CWE?k7XAP~rpFPI!rTiGguPV^u zR+4YQ66TqyHA90CGkiCfj1BE?FSq)=+fxhV6rh+5XH*%{=1)uY=%4$@*(2GwJSfjpsw+?Wl4?mg-Ea6uB47*+wjg4%zi%R9!HSZXl4RLg|kXejjVUskn zhCz5!dRQ(LWfcPQBGCVk{L$|1Rx&j9sVejdmPty<8RG9P+5#aidzS zuFHs8!lZR{x6C=VmEdOFQgMeS@`Wh4KLo3>)8`#`14V46bNB}Fo=81|f zQq?$XKMaynD*NRQpbGqpVDPz&ev!G4CdhZc0ysq+DxB-WeoBP9PSPtb#8ht8wsGg6 zB}=T{K~CZfiAxo(f7%Y$k^Z#mrHZI3o1jymv0&1TXHD&(cDn-S^x-{s64y|7ds?-e zBJg?4Cetv`#!*(tT^)9+r7v)6iNS15`@48~v#!(p@Y_O^Zz%a%xz$KbChSektOWUr zS6Mff#(bPG*)u|y8EV#w(vS5}SZd2Yz0{NP#otH4q!mG@;rb~!Zn8H+ruviybR$!I zw)evjajNwE;dg{JNKg-Ll)&|6TRC6#P*LBeVGG@M>xEVoN(aVnCbUmBX!TYU_xUCT zQZwNlo>+EXD1cY>yB^TAbZGL9C<^E8t!Uf$8hscEfc6lS(YAFMgf0KsH^ur&q9L&8 zy#COE_R)E-1P}{#j$FUc-xT+_uoA28CvLpu+}!YR``8GDnI1N_$eyXm*usnzpZ!rA(d9UKrrr=`NM2$pDybM$Ug-(dx&V z5xxIzzF0NW_LRqt7ViE$ozUnvU!fag+*vR*8y4r!JH>993A;IMvR7#36w%gz4K-Z< z={0~`u&PQj{wv}FuRh)pN>pey`0V9R+`@2Z>HBK1_L2PhYtUN|g9dV<79_kX5;=Z+ zdxfBd8#j7K*!7Img?uT-1oZ@f@SY(k=fb>RT}bqJ zf-(F_%TswGhMQ!q<%W{t4i4$wM;BMmir^CsG9YC0)=eK?C8Rd?hoM*~-dmO0(-J5} zN0O_4Pc^SS-0MpfAc7js1V}auaFj-?(n?2iU@!CGlDE^EPLvPx ztX|0mRG{xJlTjKUu8y#;ayd0OxGQ`ec`ON1g%}n-2DtL!HLc%mA?Mnf$V{@03HzOC zeg^q+Tzc2oCplucmC`jc{(mwpPj7@m0J~&Bs)(Bh5^F{9ZezF@sq1a@?e5Zz&zde* zsnl-jmt$4;(b#_mB;AQ#P=!L>W(3%W;xb|R%m9AbFiFutftk#UYW^|Fdcujc|Rk2`Mrl7v^x6td})oBO0Qc>C$Nv7a25zt`Z4 zZVtUK_`4V*G@p5Q9K~Fx#zU}tZypz@6gVuFI z&O~fv$m;?DySvDY?V2>zZIvlWr^M#7i@$Kq@!MP@dt$DFm<_$9 zp{@!l2@>~e2q{?IBE~Uel0K(O1>gFgDGB4Og>{lE#WheU4Vivw62nelB=2|EuV9`R zzLkHG_Tk0gN7__81U}3;Yy4fY7XDdz%D@=N%2V^dZUhzs-U6b?##cCPB=++&UCYgo z_`76(eA`aHXL=E09Q}8qRaRo5mHwJ;&hU_4MLd$Ymie-g?#xMkd`S(EfPoPRCB(ia zT71HA{fRH5c-pKVchy0~@dy5lY=5N|=U&=OeJqM=fz6Kr21Nr8CPP-9qNiXWu!{ z?C@R51dQ((a*>P5PZp& zKu88CRA-0n1Sk}x0V=7f6w)`pa7=Z3?uCrnO7wU6AiB{xcQYT}6w6L47V|gI?g60* zFNKXb(jIv6Y?mG}N{&rFZhaGWX%4ygb?c_>_$4a2YQXlR*_!#$niY0@dSl3AzOpx0&{_?}S zn-6zo<6g=XyUq;2xA2PRi~3i~4S)1>^M8Mb>VMa7`009Hp~HE3Wml)bHJ4OYu2eQ1 z(jLqWDxNsXlK^XD{8az=rz&LHAhpn{0dK>j$Xu~P2j##1nzyJ!IL8|2?w31b@|&)- zxBgp%xiGmFs!Kby;!|Y)uwv}ByJpFyo*%2dE<_SkB4E9~EC=Mmf0hDU-ocaN0of4= zv&!Tvmj%m1d7r#8*a#^ZaF+Fd!UWh_g?W~bcG_;3IUgeR(-WLb2J;?*y(fBL^&&F= zCWcFcE;x<%4zsl&6UBGsaWd`W5DPCQT=`Qr@RM}ZdU8SWDv%9@ql~s=Bf#nL8|HLJ z1+ek1{cPCXBDn4A!SnBDVqxmTO+qO`m(e39s5N(v5j`1=8sh6x^w&35fW}JIbOZ^& zR|h9Vvg$&`1#g-riAN}PHB$ut4+hmx-J%`?>L1a{G59Uyg9ct}m!Njo-PBig9o38p z>)1>Hv@)O*^LZ5nU$sUS46K0^W@k;6*QALRyF84n9O>OgDM}HVQ5bhen>DDU_57ds z0Ccd$b5pu1<#QydocA9xG9YzU|1hYR zDr7=|CreX&ry^!LeXW#lW#M8kM|yM=ZNAGrX3yC~K)3J;YXkBGcF_2bb=NZ%o7xml zo-_w$pn(?eopI+O+`RiRtW-J$&4BoZKKDqqKb=|cO`d$#9sS1nY3$#yS7a=F zX$;Y|Y*GDITXXK~hhJ-Ne6>-+9j;e%GHaN0IXVd^w?svmP?*6BzS1k63gaHv} zRT6aETrpU*o9)M0?%{TR-lud+H!YQ06&B4$quXBnsPY|w$=keyb{wlRv3D0PU%7K!>@{1SgN z7gpWyyR8?`DL(~mMG|NU{Y8TaJ6I}{|N5QvUo;qO4;j_?qwmCh2|0YEVcRuJR~a~> zl5i%=b;dxNlvEjyG)hmk^J-$SvCxPplKYq19!>J`zAoXZ8}Fd?nve~w{m(QS27kzN zhY67!xk5q%x4dlFu=s7!fe+>XgROCTVX^RRCXL$oW0lHVRMk`mnc-Sc_POqFa!-41 z?qL((PS3}`dDSObi6*sI8@**Qr8?gJ$A%cpL*k6-QyXJGTpCqH9mp`n@P_Q_cZWbq zZ}Rvk*{|`FSKHY>6dy0~3EdS!{yH~m#+z>_bWr`BDuPH8>1OOm@ilM}I33$2o=r7m z=VDFL^87$pBn&mV+^cL!EWHp4_@B}l?aepVr=%TE1}%kEuk>{onz9e{UXglgwOAKr zICpMyh=|=i5R#?&eQsTMrnx=K_%AHZrx)tFze{5ni(%Ca4$tLr7V$5&q9PCjITTZ% zZ+3h7j+$8K?+dLu3c}|43;v4??^tF}$sD&bNoK38E4Ir`!Y|ryt*uh*DGS83wsWYoRwv@}mw0ZgFu!@gY{1L(qM8cfIiZo$K0W@4Envc&xBl2Id`E6t2 z!<6IyB52nqw#7NVMJ!qr@(|@x0$WH?!I^D+*4$%K+gBMWSQ9*VhJ`u<^Rbz z24oOC03@utbZ?v}zT>>xLpjumK9w+;uxJwK0SX!HYKf^_$CS|XEVoqfz0t(5_{r6O zHFC609{FIRmYH+-MrG4?TD=L2@dRW{Jp(c_UftW%_cygFP0Z-|moe9Le?-Jo3q$Iy zm(^jU`FD2y!^b!FhbJY#ud&9x5rr4T(m?U*>gVCBlnlMA;Vy;OW5=~C>wX8$(~Jw~ zYlX96YdsMsWDI*i4bbQ8dah;SCX-Sjn`?7cAsCK#BLCPeM9rn)eo}RO)C<#D;|{I{3BB7zS8E6T`?_=3TYX#?Xqa^P#q9DR2TG z&d!SQxbbGw{{ng@XGm!ECxC1g)Gzzx*oUbEsQ4MvY-+T7D1S=t*y*bi9-c-{e~p@h z7FWub@^5uEUzCjhx6|I7d^;1!hhpkYsZv1~-9edXa!QCD8?Z>On zz{Pc6L^;L}NAoFAj<$D!7sCE~m;Y19++xMrVZBD32gSxRc_GjO=5H~@is;wqK{TOc zZT5NdoUOkVe@#g6gBBaIFy-_J+TXiE5FDPl!rScHDjXJN{#vxt-F50OB;!vjH^;5{{_ zO>Iu*+1i!cNm!)EXW@K^x)<=L+F?fz%r|!iX*qZ{$8=B*U+Q0sWJ`N+UCG&c75uo< zq*MgxY5%-~0>4O_$bo_@?+Cs@Qf;F2^?o1|=y%J_GY`oA)t$SGG@ts*^l&YZ8u`l- zn(@G!Z&o`emX;OizLOUHsjH%L^E0Sj!_&~~f`e(mnYq}jJF9Dk_}p(3E9vHcf%;9} z$E8+8^E;y>r;E%TTh{EsW<+K!hFrG%s_w-OUDA1oe}SK@vZd;G_aet(#D86QlSx%K zfAKt|0!E**jDwnNz2bnY$lgKn0!!O%gYIx>(0-pldE>H(T-)HHZKb%ewnJyOEq1xP6-&G`RTc}^vI zh0^k0L9gl`{yOK{3+l4L=VIN|`M1q5XL=7$me#2XA{Es0LYiAEPVoyLS6IRFm-pv) zXBzRWX%Jw$@q(g__YFZ3)_;SbTYzLxOt>&^?_KcvlOd_IOH@hVttp3kp54}{>U%Af zIk8EC;@S;mRcTkLgtJHqOb`ISbI32Q?Pb+wNwvLYwSL<&i#ZGuDzwiW8N?81fNox2 zOPo70bMbfeTA0t6DVOvyPO%-&xY8w9PA|i|PHPQhtC*K70_RCtBwqj-v|Pc`o0Siv ztDj}t27Xn`RRgz{C*MTHyrH3dts`$={C~Z~-3^+HhUMEs@PZte*wwo3A-4Oth9dmr zO>6$E1%J;^-00XaXo`4@z@gyonE7Wbhkx}M%Psa@?Q*=sC8Z8bxR9*?Mn(3p+zLEu zwmp2DMBGP6Ua$L(yJwrSYtx)Y6GnuIMw@)*iU%py;KO^wC|L>#e9#LgIZ)aheeSmJ zuaS|O3+N4xyVlLe7CKw@6b&gGI((IoS16yC>DlU17?5~vb?y#;v@WD6rD3Nxbn{!| zSl=a9{os>b_0t|~n7a@vKH=vQp5_*ql;LAvOC-IK5W{heE^rpw=-p=@VU(e?>Kdnl zNcTt0{fxBg*=fF$k!pX^ySd`3bP5g=V;5L6ccqqA^7?%LZ`d>^-`IZEz}D_3HwP~u z%nX^1QiUiwBVHpm?avNg3Jxsn7g48{DY{&kc!{)>O8FCGumOs5zPSbPi~KF_R9nky zXHJQXQJ@q@`NT&?XQr(h4eb00to;U2`cPN!>_=V#!lQRnp! zEgi;zjV$1ojuXyuNA1k)8oc_*a}T4V!=WPt?#{WExV>su_HSS~r?9YnF<}_6Q zdbfAeZ~ZiX><`0Exo~HwB=9%=BC89#iC1r?EO+5f0{oC0Xr1nn(#)3Ty6j2r=|0=> z$^d0{OvoqP2ZAYDPzdqF+XeW@^IKz+k(@ea#Eo&JPUsl?!FCGF;_R|xylJE*v%NXtLtxzxx0T{v z6mRhNDLeF51>Do^3Oo~RJrhrpIi=g!&=J|M$@{J@Sa^GeLlb@B$VU`qRjSi5oeLvJ z9&F}cCVsHiErcsY{#U7wy`!}F zuVj%i#paM{cl$e}_^aWt<@(I!t=1!7=An&<%mUMZ3&bs(-G5oz;T+q!D>yO;=N(gQ z3W3?6QfV_`FJa54(>^P+XLA`n{Vd#utEvymIy1qyuj2_|tV`TI(zZpaLOu=at-g9L zpJYF+20HrnlKf>4-zYZ79cO(2JxR_6EA~vp(Jm~#$p2AOd4RzdS`bo_QN*?q1ri7`F1p%$NqPbD&ir; z`J(j$HS9;;X3a;bcR)cH9;=A>_pFwB^!d}7nNNK|OGLT{K1fI05c7^9)5;FF$yM;u zdsAHd4e8xFcrJAP-u6ELWPD=HfdA(p$Ez0jKyjk-yXl3`P*x7?E^ImUU40O=l-nv{ zN;GzSm;Cqtn6lIjJgXXXRC=T5i$)3>LZH#{`!*upq7 zyyCtBC``iRLMnO15ItDqP%R&Ulan`9bj6>n_y?5_Z~L+}y&Y`lt2CI8e5SU!GIdE+ z_rIZ|#JV@1(RlB;m5m1S(WT5T;bGN2o`(7)pS{??B7fq-+Vev{JNFr_$x_TQA}b}} zSz$&)Tnpk=W~C;lp_fPNa*_zMRyz$|5OT6=s$$}IL$1wYZ?~js!}TE>P`L}&{A@V( ze8d|esZh;WwJlV1AdE2Utp+bg{8#wc#PO7i(1rH~tAkT|!2jyi%)0la7?P^XbpDSa zPazvt@dhGl_&u@QG%2yg7c}SDZr<^~YMn9-^!iJ&MSWR>-91`2mqdg;B+^h%AV?Od zw=n>3yTuI0JiGMtmT3H6mQV@0kT{n&yi*2ZXSRIu9=JwXu*)}w3-MzU=PjRV9@y`{ zgy*gsh)^3wH)&J6gJ78EUF=S~z+h7J=f=fgP`CN~IM4w}%W*3soFU(%;YK9np96s=i&Spfp- zUrxXKxUzI5`cO_SzbqMAW~VFUqqB~S+CRRvsMDm@kd@iXv-1c%bGh+A6OtCuavh`D zu&9oKoC0*)3%v)>HPnm)FaOz@JgRf^L#vyDVOm+uS6wJL|EI4+(Y}gRTu2Rq7=JfpK)w!AY<$09u;yAJXN$6+jp}$AbbbejlDhvoA{bL*0HVtl{PaA=bDuh1XLi%U7T@)p1 zL9;_9YoQ3|Kohw%qCyV|wf1p#8^z6=U2lk0_8;%Rb-zhBx@J3IGU9H5UCnb=Dp)z&5 zE^U+~s0m5XxbC;z;u#~wZHMCV^7vtY=@GrT zEbMap91hXmKzg70lq`>YIoe zA8fp&d0J2=!R1)3B=_aa(mz3=YJTj{m>+%0U(45$-WxgAC_qmMn6;uOv2H$(>_M-p z^myy`9C(t~=XW4=h%ygW&$@j!EpdtoA$r`goyLEY;$U9F0?n84HSd+iaKAwRndOt@ zg6DgZdJUv=EP3P7eE#=3x9BpgcGF9(Kkwswxq*5YKr7)D&i?F_d{philTzN8yU3tD zxXb)rD1DXvsdU2FFAu(`RqAl{mqqXg@qbrvq{xYGp9?KpmCN8K>#YGqUp_K5gbIrX zOo<6x&^&|*{vbQxE73(eD1n3m_}%o$nLFZqF3sGYPIg&c-n4`-{c!!fb5yM0%3m(< zN^<9hi2n`X!O~`U`bA)dyGp22o(o~&&rzlVIEB+xlN}A@EKGaENk<#8LW9;(TxUkT zZCCoZ+yVY+x^jf2umhnEL?rn`Eo|@w1Eo;s@6#>+=3K3Mji#@+4*LHc6GhDMhEbX) z%v6YJBIjXYqjk4W_;kki`Q@-*Vo90&Hc9HLBx{SYm;BE_lDY>xEGG{m%HXtL0-wZn z$kW;;IXB%%FaB1+v(Sq1Liiba2f3deMVP|#B78$W?C$w8jtjvCJ)bRM zx0+y~^$nc#XcN@`yp=dMrT`n{R-u}GQ^g6>mtjBW$*CURdEH=9l+^j3A@7WeS(`x< zPd{P82A$k$WXrq4UQPY*C_qN07=C#TIDFx-D{X@IXKW)sZ2NNGbli!gi~+++ ztorenfxpn$$cbLdGcv?X_GalFXEVQDR*Jea$w%Wt&WBNt!14>}uK*te9I4($ltrms z+=12K8`PRovC3Ryeyk_cQY*kWE;M_mLvh8lD!px|VSwmAd+uc+@czE-3ab~}y3BQ) z3d4bI_v=r~^F#Mf6yc<}bCji%lj!b7NvOj=EyLy(zfoQsWjj0Ns&U-zn3+nGY6pL5 zF`gxhB~gifw@q@vM&2%r%7-uK+g-^nX8B&^T09*k%SKN${sVE!Z}0E~=lPnjU=58rZQ zuy{?1`^8Yj?=tqE&Zs}{D?&uHOoj~)*^7(i`5#6Gq)a6Hv`b;saXkV%3N9UZ|J!*B zwT~cikcCVMbY+TMT-nX_z~7g8uap-SNA@2_t`>>Ds3CY*o^tKFP>O(kaLP$Yw--hZ ze|D}M_XaU2-fBH@{uunQe%O+^4=>CK??#7B$UjD+?6DCU&vd?DL>2ly^&S?cd1H6< zpnWoC>Eyk)Uft6|%70@NxTp}@*jc`%ylP{>t_}bnIXH??12?avd7Bq4I)5>AT$KN( z=Td9gi9ufeFSi4*2ybeL$;lVbuv|$F;)QKzJ>b3fcP|bY8fiOQhVOL;TPv?BXARHS zW+@uqJT0t(2f2q7PCA@H**b;FI+W(HJo^j_{=?1HFxn6EC`*0zMP_UAYTsnIPsnZj zAc>UK3NBSG-J$Q*ed6*T@O#*x;PZIPA1Sx)4D?4V@%?&D%9I=jP-_r(!%fkf8Co4vzF<@J+{&MIZRbKSR@>pS@yTllBkD>?J{)~epCQ!f)>gP5 z;waVr(k>_oKL^<6C~4&GInsYH$jAGCgY)H$zKPReL65(04;RkQGHhU(s{juc0GpVA zYrH;*FRXneryu14$kgM7JXd%7@Jt?)ed|#tN#~8Hu$R=NASio1hGR^)8 zaJDOs?9h%DGr&hCckI+y{{gg3E$)1V1>0wtjEV90dOh6dl*ckUv7Z=d_Tug94#&ny z9<2q|5c|*S6Tn?Tlqyk82xm;bFeVr_)+M~4WrF)jlT6#dVGS%>pay$V703^^yOVi> zy1>~E@bNFuM){+O`n}N#v2~)7@Hk7-kXNmjOaqJ+>UgE%42TVF$otI>a~Hlq57rutTqdAZt%>ya&XG7X9-9+VIr1kZ#n+irF7?{~{W1^kEODy;a%hK}{CcLd-)AyvJ<{ptR^6Z8t{4APPe!n za|iPdVR_R%Ny)8xWzsWH#oFW6=qW&_zIvF5j5>So_z!@Jtk;LN^Se|aQ)Zcz$@(3; ziGc=ZLvK}Xee|1k?hIV=$Q+n^OSremWAxDwbL`cQzxX`DT3;%#0J zyDUxExXh$hPN=UTks|B;=@&DwccbAHSEPO=R|c2+pGi;j>*Ews?}TpXs!DaJ{fNw6 z4XM(e(}d3WzdG>er=h$OcPc0?cEV{&?G<(qM=bIL0vF$VdbeOaY$CWwp~xvU zOKO_-{e)z0ppP$`wSdM#J}+veH9tC$A>STc9I`eVj6*en30o+rVq*Dudy!w?!jqOB z`Qz2eAcl}#b%r13pmttCf`;+@1#u`*k?1RhJMPr zVMSj*wS#~AT;9O%eY4s}1oi8>jEa&l&;F2ib16{|a^Z_G!O7*$I6+`rtRXAw$z`yo z?vtAg$~Xwj%B;W^0ccskjY%Cy!}qp0?g65O;iBZk#2u+X)xfkU`-rzcO-Hu+J@1tk z|B@;;nV)i_Rf0^J8}CcxS&SINT&6OqZl&5qi-a6eY+;Txoau(PK-*gku}Rp*4!w6b z6dnr~7~3#1+E0itVJm=9KP+Ln@CIY-Mmm`^tUv zh>WJ#fe(r>J~s$ta$>^-f=~)g6LPcOMae+3^60~fqH&WJ%tLB2 zuU)@jlW|1)b)DE49hfy~jg+gx?m~6qa7Zyirs#^o(y~_;@?J~0-dQxOCHDn$0o-h{ z;N3BaO$+rD(EZ8jk2ucT-^LfVi)s@j8cZFkxg41$#MgaGDa+9?t!bv)s=^K>s2A8C zT55P%;Argx$yy-8Zi@})p+O#$z}?=ktof-(B3c;ELinPxEJ|r79Em)kaRb~bn$zRrI_T)~H8QznFgzt_n`A2!QeDMPMW&35w zVWFFFk+Y^pP+|L)#@jyuy(;7FJ3uk%J zw=BY{)&043A~E!bPLgASs0bqcr+T8DH+xZtf^Tv0c)q6Y>xbAxd5>-)4@%+u&Qu}> zzeqFu^5GbyswE8RwSts@{DZdIrvMIvR z3=MtdL1g?q&WFrgDB>e~{pzhT3|Rf-pg(#&vbQwM_Dr9DE)BKq_~aksUJ$J|t-gs( z@KZR!#$KBHmL=OK*~B6S2!bmx{&yg+VH1aiKxuLBfTz?A`lq9$mAS=939G8-xdmjm z91Oc2b1Wb}nHlo~_us?F3X3b)U8HYY3Fc6Q^HU4Wl!FfeyWc?RWqHofN?;~MtwRyQ zw%F%KS0NN}i7U)G7tVr5sXOSSAs6r=$Rsl9rD>fz&9^7~e)x|`>5^JJs6JbF){rUh zv_~CKvFYIAzP#1&NBf3*RJ*`^;X$*3)^Kl!TY8 z^&|Mt-tMa&ug6+Xl1ymA>JDdg=@g&vZHN>}bNofMt~(M-=$N|kLKFH<>`=nI`aP#% z^4>{ame}od+;VG-!}6cyGGf#Nu|1=|w;lN4@71JS3u3=8Rp1`Y^pMH>e6qYSx{oAA zCU>e7?6NhIKP;#m?BqV+adQn$t}*jr4o&x4m5+Fk#5r~ZN|2qcvnYlu%)w=fAW1h`sKKK z_u`cCD%0rI(`tPo3?x|>O1P?;;?X9y31F?AS^IU0V*ggFk7hl*b@7VrDTR<9^6gix zCC(a$)m|;Or60!`Il?x{uU4cgW}2>k(@zRLXiiW+RDtyEj#k|KAT*h|K&?`OurS#c zUnTeamTN8HC4&`NZv8VHvOP6y3|%BpVkr(< zrhU#Zco!_>Kl-yuAd^5%iBc0U-?<&CSX8DUmmL>h(N#TsYf=4kb$*Ueq{Osv~;=6lfM;R)?stJa)D%+5v!I1erE zBUVjlxWCX2|9i%rSiQ#H5UbKv;h$gV`+U1!X=>JYwEyxu-a}CLjE)Sg)-$?MuWo8x zF}Y3&J(Z#~c`bMeZkHTo7~XjAakg6Uou7dRtBn+<{f%KT4WjT2YB64@96~#A*P&1J zyi$d|R7}F*d@-Wk{)5qbV^fL9aj5Gt@cFr?iir{VB4e`~9tP1uTCm-z8}vI~>x!}w zO#3^-pv{`xGdZbLos}INB+R?2lu%$}&ZeqBe80*HU~B)k1_qN~iQIy8WsS6L$VKUp zf5k2J>L|sUdvd)(fz8Ff{wed3G4}TJ7V*;k8nPXvC$T3bY*Rl9;629sIIQIr-N{A?D1hkV&+nXI1_D5fgs-Fwd=Lzu)~l zP~7|2Lc14}$q-n)zK8|W{=sl|C^x7@K3h+lb4-n7Q{T#m&(&7@(Hl?JIcbjDutA-W zul_WH&y4R34YRDD{k~c2|J~}X`1agO&eFiHSwvjO$qyZ#Gt8~BOr|cqpX!bB(!dU7 zywq7P5Z7Si6ZzT&d)sS9X+(>KfN7wqre_gkJBzgtFS{G=CV-%}P}sS;>`5HF%r6_C zJ|)QJ>D&yu7tl8Q6DCtLGoE18RFDf7Kb~$Qx@BcIj39dbP+bwy$B>XYQ!cJ62X*O+uvO%fHK02{TWX=URqu8zT{?jWRemX`>9md zn0sfc&pgEi`D*W1NusJ2l#xrTL-<|C=DjtUz!__4>9_ZJir#*lGhd&e5sUd=n_>GV zn?^WPJ=;c1Z09O2JZ32mZg^~)QZ+hMC1uS+^;~~fx}Nc^=1bhL(EPiVGiTGs!AHfC z9ww?+z54O^B%CRmETUg|V}4{i=?<0P^!;h``l4Na-%8N)uIdvaj;?f?Y6x;la6{Kr zBu?EWKpE1oGulXGzZ&FNe=gm)b&%PSO0h}ug52}tA#UZY&2Zs1XbAiD!RiD|o0;;f zx~v{J)9xEJGFxKd{^yIwru_OYFPp6Dj0C%qV#to8FL)xlrQbh4^xzSpW_ZrK{lRVH z7bc?2JO1dN{Pua3y^(ZT`?>R1JiOgO705HDnvfl{w9F@B9y+kzE_-F)!Vc9z9t}37 zo7R5i?1o>Fv+u&&Igjx3q+Ujg=^v5nu03nG03tzTwWn2am-t_-K7t|U4|^QhmQrf~dQ0lY0iUoKu*)9-M}EQLRr9)^60JNqk6{faxC z_wm$ogmOXGFmSyfpSb<;V9#TL__v7Xhu+5(oLv-wFW)0+w01Sx%AV_ZeT{U}3gBif zuI_P2DlOiWIuaf7lG--!oa21t6T|$Kx2VdiIxk#Y8C*pIHP?*iGi}bd%hq}Q%KjGX zO<(m$5(D|?_p-JZfXivj$3WvyACUmy>h|qRc0r94&bTkFjQt6ag0h92oc3YqO{< zr33M+Iurkt`>Q)1{?Wr_y?G+>T3cG^V#Q;y^zv9v>|T8}>yx|Vw$GEv4Ua44O(I?H zmnm;okA7bKsuIiCE-+m5X3C?6t&1{pkf-X;&hOV>O^)|oGgkd^5PltGbc>M`QRW-J zCsCW~RDJnu=BB}`oS0PuAUcWADbvXdLgf5~^i{;4Wf_o_Zlqp6>0f$T;iS76#sQ zd#dXR1YgDWA@E|1^iO6~>v?lKu-q<>Az?kOg!0aOsez_od-S&OU>nO|+Mn6#UaenG z-|zJ~y_IX$%xRES!?=oPAIsD%3w&w6xoGirpN3t5|Myf-VT_#Ct7O*R=c~2@nM4ea6e`9Gv6f}8gG4@Sg4TI=UtUU3NLFlGsnw*=g(SWqB7Rf z3{&&$-+uSP$xQeV8!HSPYiiY%Z&f@DOHEh_Vum1*X6(jG zNR!f4kIdG*SrhRT(>lqIIn4U4q;V|FOk`qHnbEJk#SPH>Qc~#K(8Qx7Gkr(Luw0KNkMGtr@v-;-fG<)?_SX84CO?e#D&?% z`4~x1I&5dVE&GKHs9459pX#FhAy6`@c?OHiSjtPuI*5sOp8 z%LlhRwxI?mKkU`P!$=(>4$^pGRm${rfgGr|{k^EWYl z>5i$|9EEN6y_;Ql^%a*b7XIo!pM!r5x?`IXnvAw%%9}yvnD{l9#tPG|3-ojiF zlOMlXdz$6Fr11Cc9)(1X=|A$?A1AgPcS;cjKAe!>t@ujcyqJ8`<PI|R%wLLA~t<)S?eqrzi=fM|u-P##Lo%}L^g(Y@BnKtq>TS`CP|82O-*4p96i_p91xP45O*LZ56bnwDAa!hDn{Tt4T8B29_ zA|3MfHwGY&N-mK=d38CwiSqrg3q8wK23>uRAH!}ro;(x1+K-_bcB7;B8#O%JO(G}_ zZOhvbaXatb>@&B|OFqN*|C~){J58oEE!-&uzKTjuV>*)kqNeF3;^OO{2(I7dt*BXb z*OLu-B4k25gdeQ{QF?)b^7U82R9# z0Qc#SpqQmM0G1pg7cDVe#nQ?SkqN|f$6QL zn&KvXUz*b$$a5ub7T|rgZp%e2a339OCSyq69tc=VVY~to|Agb#L@P=u{uC116wkuj zwHm(g#rblA8-lhN;`6-Jc-d3iU9aJ!q=T= z&tm!!5aoXfCy#38U6#s5bTp3V~qQk@$Hv?B84NDT+8moKM#IXBZG40wLf*0egDvpPClG zYqiR`*IV}^xV*4AlE6TeX)73;y^@s>jO5L|m8*tm}p!kZ~WE-qodg1W~3 z0ey_3CJ+9TGlGk40t*6gEy+SY$r`kR`_5t{R0mp?1*TyG&^{~d zfoD;#VCRLt3)O{|5tN}}+gT_kR|dcwWXGS%i>J9sCIF6q#l!TINI?r=n7526GWqU0 znid$;+XH{~(+x_XydMg7(R7Rfp`;Ejod03_;r)aPV#Tu5BlP@D8IVRm_CaJggsW-; zs}?h~$CJO7%s&JUh-?OKG^bvVb~IO|H)1Tdk4Bbqpwvlx%RGY}$Ah6*T+OA5yiE)Z z`wmROVS%@BQ!mL=XWv@#!SO19AR<~{KZ(r~M-`cUd*s7PoKMLCDnPv`K+Qn@*$Yi` zO&m193d+E7aCyJ(E}gMxM8y!NGFQ=vS02Y_C^?!V!IQ@+g7;PGV@kqDZr;LfOZ!nb=&p&+0!Ua$dQLKuSXs|v= z#Kpiagu5dfr|$u#oKVvtDR0UZ5hW*z;G%k5;s z#zkDGP+`MN`f=V|P zdE?UnIL=w?4drw=4we<79el$3rlNa@&>P3d0=qEwU=_;U>7^m+0mB`%| z2XimW1Q%p-#loX^KyL->Ck))qf8EBTtHc#pUTnF2q;(iO32;t~bNu=pJDDtbW=*jT zk_?Ks42A*Vw#3j$FhmuoT`dVSq-H~nw&ic_gqk40O&2wyoeB;Tjg*1DLrhF!k)M22WS!jes2lLHl@@{=fOe1e-^ht{*fgaJ_O5{M)l+y|07~i| z{?zh|Xk{AAmLkX<3IyHw0UcK`1e_-*(&Nc8TmC3GORgRAAX|y- z-Oo?jgj4+~J^iqS%5*~+I|gYk7G3a0A`r!K zcEbLJXl=e4%I7T4?@4Yle!H#iS^Vk4QviSOXz7Y{J}h6z_?EU^m6ApkkU{603-DlK zgN$$M8(dpg`R2xBBOstf%EP23AnSwdDW@G)c#G18rjfP=1QLA_uZnUlRM_HWas{Wk z-)277wl%NL#P`$SCIQoJu$*i4YZ}F&mz-@|+xN<>y|u?A0d;lDvy11{IdPJz&|$HB z9AfjNN5T+VOUu39z(ZWj><7Xu0`tuPvdSm$S3 zRIWMGn8!4ywn8$@$L~kgfoK-lq3SBEIe>?`O;B{-f@G9!rZeo4D_>a-HIzU!ESMP| z%pHg2({!N?VYymu9}fUfQ(Kw>b_&bj$XX|j%7Z)WebAv5pc>R`wEwL5us|$WGn%{B z=G%6>J)Yb{Dd0gwl%a8EI5vHah=#RvO$*lMx$GY0g{V#&&O^YwP1BQ`>}6WTOb1~n z^lG}U!&M*bpUGyh0J_M_*WI%fvIp`qRb$b7?o|$^$7vCj{VAzzV8mLaM84< zd54h!w9g4%;1@3fSUjK6#9gj9&SK8qVujFN*#6(FPrqBN{WX6FZ_jA{RxPan^m?~3 zm^U48b=@^BykyUtEjK^A8qj(>%EX-i+*5Y>orRu-bM-$5_9m|Tjo-+qgGWQ+_)zO7 z&1a~*U3cc{oZE^OCsQ_;TP&ARiPZ|(1VU;eormF@@NxXJ9KV9oWv&IlnSj*E;t33U zM&*tIDjrxd3c!pdKcZylPILe+UB0PhW4wDapz+}NyjZit6r~anT?_k<`EB1cnu&ng zGdH-^obPv__7_Fp_Yua@cva=b@5V=y=iQqxvo$=cQ@?Wp$d(|{AM>h-RV}ES9WI9o z8Ekx0EKmb2A=yD!g+OB_LZprE=zf0h=M!0!)F2;MXkF-v(fD#j?lMBN^AVb^WHY-B z&P?lSJ=;-}*kJ;DF)*q@Z;X<xXW1kqm>_EF!JtE}hU0=x0!%5jF)Yy2lJn<~k)*L6 zofLm!=dC;jHbD9l>p^B7@x#U6>jY!<7iw2+qnIG~A$Z^EU9LZb1dVFiK*PmNZ{g{J zQ)KME9FUJA;@umhu__!Sdt{)UHfUUycIZm96?Dvt1zM`)sm2M=Z#69cL$EBbD%n%^>E~;3>6#5l+s|ok@`aBfT(Olw zSzbCR9FTYAxsWnqLvO3_=qvw<@!E4*5}XiFuoTs$>qye!gSRKT2VGfd7LrY8;4@6n z8DG!0T#iS$7ayr?Uc3qI!juDb1AD+8BlwxZR~aY6TZwPlo3#Q#rY1cl_JthBm0kxn zKYsX9IS}(a_az-*ZEKz&N*VjNvK~x_^>4i-Wwv8n_^Iy)`N(kkYUoxHU-3XR5GKo7oe``Ok z6@F&@mSxSPmxyBcMsS``(~o`^;@voFrVcTO4^@roKqXV`)Zses_QIXFi)BNZd`A-N zZdjn(PCu0nN^VaqGJ4{EX0mCGCIL~s{}Z$RGFy1RKLdr!ZKWnMsMJm{Ez9mV9f%4_ z7_&ayXt(eB2oF+{u`-Y!N%_f!5cI0>5@x;6^ZSxm9Go&}kgWl&mOlM(Blu3zs8iDD zT%ot%#*amWSh@S%HKl`aOi)3qQK~_QMqAVZtAfABtflTJe5bh^!L>R~I@T`9%k0H! z$QrRqk9+z1vLIQ8Ju&)&rsf&vWg+$-o2PGwb}O@RFhF%`>P<`^r#4#$Y(&1ae&)A! z=5`K1f@Fm=HvCdIGK-wY`{+#WPjJj|!@DdGVunNrK$fiWZK0hk-b7+hmsFiVLn|X5 z?l@5J{0j1Dz3bF@yl9kTtC4HJ@RkAP=VW$JLO}(Ga98BQTJ7X``CUt?w3EKU6bcoP zY@9m~XZmgt^udB_6yg?At(090?tCZkBS^Nmn6LIk=WEfhao3ckPRgN+4(>R$OdHUz zSwH;AF51j%XD)$wt2P}385~wRk19yKfw9=~CInfeDi&+z~!Ouq{(+Ht#e*Uo)nEsjy48dPd*Nu3+fgM zpEJC(mr7B|3<8lNjc}Cu(;7TLrnAyR*-FDYZK}~g#zRB>Au=YF1?IaLAU@y2I^D4O z^%+7CUG$6qr@U^J^MNA{h)~Jb?u)hZq@EhUgu<=NDM6)vh4yHmH67J69cwubC}@dK zj8Q0Pq}}iy2FSG(7<#erVLf`VD{ z28)3@u;VSj-}bPFu!Fiy=!i*xsVi*IZfp@3B)V54R!t^1f(4o;n$p=(YPG)!1qB0f zT*=IumKOk>fZl|i47eRE*y(8jf1W1S`)Y<8uRnP?bOUr*nK2dp>#1EsqY^1-iPmv8 zprqNJ{03-AqN1QHJH-POoMSgctK=g!7z+XgDWzxQ==h`@8pE(a!6p{=`{Z;tF+e`_ z+L>L&E>K$xQ2SF4VeK%+EnRQaALz`$J)J*qCaPZF1%cYL!w+2QT?s)o_{erQg;SY^ zV+WvDrejwh&Ia7sbwsgWHj{Cw@?^m{6Lte+I`w&Vdb~Ib4^*R~(*BxZ_s2s}a7W3Y zINd_L^X@i~agR#T>nWpF*I-blV5}JMiY@QqM@B2s<}*d@1SDv48n+f*`8xISEd911 zs9ROu!;o=REN@3z`8z&{udY?Pl4y&v$eT190|V5r&;rfGao6PRiv=!i2cIun>%;&% z0zcI{1~bR!+h+Qp9M%{h%PPd9a<$6hQW;Px~|5kk1wr zN~9z}-G%$sUL>3Ci(FC>1D1{;5TQJI;|sx1f-Ekl$I%}!K}$?9 z7$Cal)@k-3_gt}|$q` z)TD)$V|3>|)`uWaC%HtfD_c8NKX)r_zeg|&KL-mjOJ*5qu%wT;kCUqtKm_dL9V&eP|@ZZ7=P;nv;6V$-W8vb&>tp81%g@8d>*R!z3k~hz`Pk}z*!Vv}d%%2Mt#}_> zdANAFTUY_$EdLqrz|8QA}GYquOuiZ%*UrBDyl4^B*rfwCkFY~R?XSN)6Chz z3Plvv*6x4W3jTk#6<2V#GV^qChq<^o{xcOdM@KKfyiwI)1#Mw4C)CWs&e_w&!FFDGY@Yowa)R+e@aC_CVXNK5l7+c|n#x$`PJnt57X zWBljS1o$8jf&cMpKC?d;9Gq!CHezckFUdM~Thx8Kb89U9_O#%rRySS5xB405c;mK7 z`Jk0ITm7((HkqBBE@^3LZxA%#Y|pEL=zMF~r32W-0}5Y!2RkU5iie)}P+e^Xcq0VL zSVAtQhAMT^lmqEEadb_$KI?k7SI?fG6Q==c#|PM5QVSu({cpPO-i95gfo!?92*8NuCdCxk$6(Q={M@y#o9z80kNr$ zn5jPY*tv~o_m{9Z01`2g<)xsMi+U#pwkQ&?=$A<{v;)9uzXtl9-cUiRg_~!m7?exON-h_p5!|*!B^xpDu&HNTsQxk(92bYmK>V%M6}48_WZS+4OREz=6FHD{$Z zq9*T6IQ}T$A4oJ-_P0+%@0eZxQ2v#vCJ`(9#iyYcUm$XE*PT?sE@z`!=dpBo3jWKm zE+7-tj95)TWx`*~8h{Ac@5E~SHvZM%tBpiG@+KrRP+qy_xLbk5bNO{PW?vfFU+S(O zW7xs$zr{4|oNC+AQh}OEVx+qK${$`}u9K(OG6GxZO> z=-i6`tDI?HBJl-Z4t`=w?lE8w2?ayr*_x<#;|3*L-!*YQK|FDKpwSY3^4~_Qta2q> zGh%!r=4{te1<&{piEl>^zxbxhjSr;o2FgRFkVp8BIZfBeAF`k;x>+UrvRhd-WZ^{v z3JYjq@&+2pXs#8uEzTogMu9v=~@70|k6f!>xpGhJ^2v{94`)x(YDa zY;()C?y#6QfB6ykP4?_FaSo=g3>v`H(|%;;fghGW_Os|~xxqIf>yFIQIHFZAQx(xL zRM}YBDV9ngy(wj2nT;yn_sE{TVQ0*bLB{tBn{U*q`jrBQHb8l`UL7A#RN3v`quNNz zY#=m|VOe@@6D6$c_t`WpTc|@61Tp>&<-Nq*`pB9Db$7X>n@PYXD^Ol1=I#fJCScyl z^$k-4j_-i7p*GT@@>7IEEay}B$u*S6>s*g)AD6q#Qi6nn*ZnsQKs`uLdjlG#>!rJH z$fGuLLeyfcyDUx$6f`a$)sUgCLeEdQYXjN?+UTk!E)vg6rqnNTG&ZZ|tH90^P|DRt z61xdBjv`tdnXlPbQXR43aHmbKA=satxb~&dNx8%7AB5>fX{=i_u9<+b$>k(#I)Rsk z2K?$7(5P$`LZn&bW{DMT^|9__&|Ld48lb6?BSlvCZ3m3WYi8F~L!|F$8R*LkR1oQ- z4yn*i_Vj+Q#SOd~6M!1I&etK12DqHkX_gs$q2WL=-> ze=AO6Yc}|}Ip!6$-ym`@& zkn$zhPrLsBT?H6lppQ8s)e>g5c%4hTI&II~bg)PxuneHY9 zPdRV`3Y3TPA=0c|FxtnQH6aF_=ql5@BnQ87bL^8OUla{IzU~3Q42YChVJY2s75@fB zdInY?Yksj`*h5pd`p#=@lN|6zrfnv2zX%^fB?boyo$3eB$iT9WMubVBspr^7X(W6AH^E&fBE1Jq1xM z;Db9gFCe7&s6AH@s3I3z>Xw$~olR{s#7WhipVH`B%~YBLVl1k;Ph;IA(QLr^4p4+& z=N@yM&8Ysu)K{-8x&{j?X@17OH>0|ONvDU2A98W+sZfxtRnzi@*ha?GLLtVeJzEe+ zcc1Lo8H>DJtsmr20lC(_y=Lg*OIsVrC}E9jWsT8v9vX7VfaHKMjC8C2eK7e}gmR4r zTD9HoZnl6ZL2`wCy^g%qt*^muPs8I zF@QjZk3$zD2UZOPXmiJA&3$X1Ut{DZIiTnz(nxf!C-ZggH0?VjXMrE z26bui<2r!D9iR-Uj%<;L-RBs@XswW>c^7wW6)GeL(P0E%@M?qOw&L0PJFjbTNDd5p zZ{vTe3I;nQD%Z53sRd(o+`92zp7|blBHB``?jyRAPYln`H$R+>RY!Ijsm3yWJy)iu zVs-H4^^joP?WVEny5=hQ^7PN2ky}NPqztdsZ|HiJUr&f(Mc5rwa$gieD7q0=yVs!o ztm{^h#0(^gH$tn7Q+Xx8XaV*Uaw)-*%^H_jtok2?LITmFE0|h!q=|%fp2HghID)vg zF{*H^K++fQ0x>wiGjMBzdJeRz6Ed-~@2)(QT|R`e%rh&ZZQIn7 zJuxV=%9*IiyT+K}rCV0k&(AQU5On(y6a2A_pP<$?-W9ccRJp?rWch6DrY>p z9>&TXa?j&bm+symF(v4YLmQ4P2FU>jE@l-8{SBYk@IbV04W?sVSC6{EqxK3kq^lHb zdW?2OrnV#pN?4#YEG5vSvOgzU>QAa81`3K;rr}19BGG=co0D}tzGe5hvMAOs*X*~j z*@tKbsS>d+Zah05?hgaqPe->*NWr>b_@wki+9>J|5@f&mRT_Ny-MYp zeRMT(0@eki^D-l@7pS7?$OMhAm`!fYWSI_B?(8pry*67;$h{iuILij(bk723z(5&K z%8ePmV(+<8gE1F_mS72(N#iq~KX3Z^tcNx?X;&tQ;p*aI+iP#KhH)ky-6&F);PhuN zxh!SL?~@-_c91to)z{rPvM_ zU-n=kAWk5@sFBv_RGce7lV0!lAF%<}8a0|K?AKP6n?_A~@M-r;%BRrP7<=<@D5EcM{2eolb;y!+EZIwT*%^^Ndr{V+NF~eI$=H{& zgpe#FN?I&YL^NehmO)5%Sw^;$UFrMIJ3gQ1^E|)b_j$grzveFIo_p@O=bn3(OGXRX z_K0y@-fJJ)u=qO{Sh4G>7}MHLVk||u!h~9jfcWA%G(L}qcnLu4E=aqk(`y=rVm!-T zf9|g#g`Y6IyKEcR*4~2HMuM{?hq8b^R>UVZ5Fmk=S!6%GLfOa7I1udjE+Y zh!-(|6VV09JA8)v-1UP8nTI$&>lY*WOVos>hK9y9`I5^sh8>p3q@f*bW?@^e3;A_V5=&_rKfH0_>=O_F2 zbYd^;D;-4@!^har?ZpK4w=Q6eJBiTJ;G}<%X#j|oGEy}5Q@_}^Ex|sO>dP?{GO^zm z(J5S6eGAT^H+pR4kRzPp5RPFeKw*vj5Rycz^%zW0NQfe{UdV<;l>=zO=g*ma+q0md zfX%!4AXCC{s^*k~`pcB$YBQ)hhV31EFV(LM{IAF?TTKVsRz^b;!QAu&57<8d zLF-kTJcZ@oa4G2oM(_byzpqesquu2WhzP&}MQ2F@&mv;W0^knvmr|7G+BClH4_x;pDo(~5zU6e6R3T9A%-@52Y=x5!P5`-g6jWGKTfflEn z`p>MQ`BQfITo#V3Zsndnq?X2&97K4!`qYe{AsL>$%d!g8Up7mQ6-(_#uyb2ryp+x| zE(vXK+?+Ro) z!cccf=k0E9z2_`L+v1%3nRA6)4*sB5-au_M*c)ja`?xR|^TAwg`<(KmM$JBXsD>|y zIV8fD!3F#$=L6E5rRvU~A(omdBGT<`2;-r;GYn{ z#@tc}gueraw2pa%fqfXt8~Z}t7UxwAh^Ek@*{E^c*Iv3iPfXA&0y4)j$x)PHSf21DvT|GX0KBUKIq4V$Do8HNuRnwGv z%Q1|=l*_ygO%_!K4?Yt^S07(Sg&o#X&mKZ%Yw5*L^_vq!-{bAI0bKM0YwnzbbK2E( zC~tkH5a9qp+NVL>d!&~~7Me+%7oDuW6(`D~ls+bH$pymzWVK-OcbB-u!u?_8_DH%j zMnu0g^HW@cDzQ^zldWTCsNyFqc?Lf40^YKIvT(omXNw=qV=fD^VjmvG$iS-os7bIn zRNwug@A!ueAI^IF%}(=|a^7Y8-l8IB#>mQ}Sf?75xVFdeJF25=QlVhRtLwuTv52&W zem{WoQT1j*vnrsHGi?)>nEC)E<*dDs_j$j=F&&4dqCIgV?Dme!@jm#fM<7v%Y^#JDw8D>@t%`z%PclmDy`h7~e4$Lol8H9k;5I!BKexI8Lgk1N08*d#d zP_hfCD_gbEfUoYla#`Z^-u1Ib%_AL{sN!FX}#HBAN^JMP!+kp3}<}ya>f~@Z? zVaVzRZn}_5=e=_*Qrtr7XtIj~C)YBIG8S`C&)ZWu;6PqCt-LQ^muav=EbMBa#EBFXfOv*NF$DSR@{`ispf-ct9 zVGm`@Wa!EY>N5CG-6J_hJQ14?@fziAOK74^$x7 z8YP2+s)e3qL~I;vh494QJ_yYlPGWP2?t3LtTIk(!u=jiP3SD{f^fb#RwF9^UgtD$o zrI>7?=mMN;=^9NBbpA1*E=6L@`P>lSzSX&3&g*6*2UQaBq>H4pmHu!h^IvE zwRoIF+70t!;eQ*wQWzjm9xq9cytojMv$J3rIR4%1(*TL6Z zT+cCI>7;d>&CLKucGF|R8cPp5gkRqH^-^Sl>nrTLun5bRPrmB@?6L3QgNd*$sqkG>Y+BCSb*?ZLzP6 zdUL;|q3QH6PL2@=hRC^`q|ukL@Q%s`=f|XVy$NOEg6tj(CWfSKtWOtDJuX>)$xyA` zaPUK$>Aj{T2A6lMG+v_;kC*7=Qnjp4eA?1f!_&T=G9k!uOk*}4>INiY-K^5R%j4A}w*O*GRqJK)U>dC}yugi1E{4|yWD6n% z{lY4!3y(45oWNs!O*_TjrVG8~)jp|2>p9OGhS0^ z%^E}6MZwLeXzuGgjqvw*Wma3sE8dpqb2;y8gMWRGQZZ8^ok0T1pMz$8C)|^GvRIb& zKFJ2{nEbCiUbX)6M$Rx-54?PxPmA|oXZZ>!L%TkJe~$&`Z$EVI-sE(#*Zw-ZuUL=p zkO@kV{+?Q9TiTUY9KnB&ityf25MHi?1uM(=?cEax;4u<(5D1 zNxWGoo3np~)X*=v`Kxg2XY}As&h4cBwOj@~~oEG#ILXq-duJ>07Q^qJP-sEt}5gc7B?eyZp5cOHB*(Tt!_y z!lTel>$91CKu?wJ;&RMg^ZU)oq3!!xF*iA$9-n9EbImH+zfE}Q^p*N^ALr3xcu$7L zjakI7u-7mZF8V^sQU1T+;h8mm{(a&aYgbsjdv<5owKeMjkde}?KV*Ul2`h2Wl3}S&~}F%=iNU4{=%(S57#WNS>`X?k@qA< zMshIrnNVkaj!402=X&(|D{Hun`Mq6QsnmSLPX#>Dq+xkxkk=`@bT)vnyn1Ci@QM@m z4Vp7yEZeRO>vVwZlLKsr9D20&hLN-g+^nR)e4k;*QnU2W)@ zPVEa_nv=R4uhySc9&Pwh7v_^zB*Ve=cvwmaJb9iBd()%;+Vt9GjGyD`s(h%Ox454b z!JRB>GXG_>-{tPfh}hr{awGGxq{mJhTD^PMx?$Nb7%Escz7RQs$}aGk&?-KHa%iG>&I!hF(Z8v1O^}#vXfmp z8|dLTNSkB3A$dF-Paak+AAb;!J|4Ps`I1?fxUqA-;;k136}5VHVL((NtB-%}UJ@9^ z(&c@;c=^*nW_ws52hAxgU5J0wiN=Wg-i^;nkNtdZxtHa;a;(=MDP9`sC0&Ql_1y48 zTxSQm#O8ZQAUn@f5npr7tIKv$Y0dD-WZ=c^$BkFoU-=C&F@L(gZ6^7v%kKmx*Yc9_ z>Cn~w{>F;&CKzt&;cI>Gfc`&Nq!RNV=KYZiJa**p(-liC{&!!TU+116q){s1f7E-GhU>8Vb9Uds=IwObXw zSnrEel~yp^OK!*1+XnC9QdLSi=3Dvd&lTQw^F9CE7x~Oas1A!XVFCcNhvlt?L;K|) zUD7!Yd|y4+sW5bCXL*t|I7gbQLAX4o0v^hPr-Y0Bd)=s2J{sHEltE_IdI_||=i2n& zO2y4W`cxp_@W4vtt()oiT!9?#+_ij;XCV=x`CD@Xvwo^M2Fyjwg_9z4(}J+P?=Vnr zf&+rjZ#g#=6sQj3ZM73joDHQ6%IZU~hHw8-l{mZzOXLQ_xE4&6>1A07im8~Wi74-s zGRE985bqTcdoWfukA*rKM(P;n&+&72F2vg_6&!oudKG@v;K81jXZT0{SgA$B&~AG)dtY*-MFtr zda#PBUE_*+eVTcZ4T?WTUGn9dwxiY*{{|O0yH#KEeRB0R$>RLOWB!|@#7{kv{ue}JV_UMB zz4Ac=MRLX)eLyfpiLO3WpPH_(=vnpdIavYC0|{%Dfv6YIJzfws=}ME)c&AZ%(MoM1L6%X3SZPt^K zmMA0O{BZ#A@M{~Q1?AD{2g*9B?@pZ1kFS)z^QHUz)Ny8C=$g&d_t`q)+i+NJa75_2 zAN1>qz3q;!N>spiUvP0i*8y9p$l@8Kp4fL7fgfboI%y!fgmtn9fiscG6;u&Y!})V~ z5SXA#xQn=sK$LhroZZ1v>2%n&C{yQI@(_lEv-~+XJKt+;miqnq7Cn)jy$2x;02ine zeFpKVdU9%nwsSVZK-&C8@bZ{f4#U&X?FE4j!lk3;$y0l8HG6l+*U+yW$|rGcphz5e zQT<2|xGn~Pu^8${I8vX(fc~(f+X;eVDaf-y3o5f z&>>!Sk;@s@av>M>M#jR*4+4tEH;NgWr=Sqd_>`;{HphOC`~el`>|GCqenlz(R}ESN zm*3eMJf8K1&iLCtrYHP6i@>X_nL_ z`|-{nz5$AjLy(D1ZM&n7JA8xc8aPSy5BpcNBB?Jh$XV{Aee5P9er9C0DBRF{!E4Dz;ptK)PWp}JSdW_QBG^z(o3eix%2(@uhl3Ag? z*qMj7H-Da9ycBN6+u{Hm-P@XbE({rnF?Pdj*i^$SLaKWjhrS755j3?>cl1?nNkSk1 z)44Nj7MXq~v!zFBn3;kORH5o~k6-Ep#y4_ql5_+4C>^>?nbgibb>)9v zialS}_Jx+fI@uI9NSTS8W0_8%ZMM~y;`TL)9T22DliFaJZ_0@9w<4=iPsG#iI~3%f zin~XxPK207jS4p6Db_$>>RF>0UM@9YZS>dJD=$;0H$N8sT@K<6C66q%zVg|Y!w1k4 z)+tSOeI$1M#>lt45v@Nd+B(8;FNy!MwjLXN%+zh)|M`swGT9&#Mt12C zSZ@E_efa_f^ngC{Bl%C>f9yEs>!U@2ti@g!zrvG@k)&(NTa^rk+QG_n+-*DuDo(Y|B5H~^ z?&**Z1j0S!TR2PS!HsO5zuQ%xd#-&`bYu)R4%0gC&fN%g!(cp#pXQ~qO!A)53%Zl$ zHX5&Tktb7W9f!h*uwv6qxSukhGyF-jnjRYD3hV|bUlFOL)VL@SQr8s{#*rALA68H% zz;p|&#eI_0MGDf=saZELu3V0L^|4i`J~27mGw=5c#N@re>(H2jxi;WoK)eyC)V!2F zY|M7+Na4cj1!1y#*yUo=brc5SNt~|Qzc;akv30A<+X;)4J|ztG#5o=S_qA_6~_o zxH4aBF)3MXHl=uWdzw7{BRXE2&}d#Dd1VEI;Y+$3_!xX5w^6q@Y9UH=@g_OR6Tq#a zj>KKY0^fdu_j&sD-Bl4^vy9@&<1bRVADeWOfqeX>7YKXEoW;hvb?VRhG7oPD27`k@?i12>$~*bP6AF_G8e7lnr3csW|8^8bTw!DPCrZn zq|t_u)+9+$LwX{oRQu2GN%erNyLm>^n~vnvD3*526_We#aC>hB8|>@pC=^yuE8?rx ziQ{jgYkyR~hj{#jH_tzl0hpam6skr{OTcWBVqE9ptzrC|u878QY`NRhV$MZ<{S@lV ztp<(_I6CMH$@>H4R?(;$VJ(4ddF(Nh-;F_FjrZH}bW=3$xd;iv@Nsy0@3~b~9R=LS z^fGv51|H6o&^xSjv8Ln#1d3pzv3U~=?#i)>LyQMd-}~h7mXDR@7-o8WmQS2hCu^vsio=4HsY0=E;4$=(3mPG(U>u?^bAffb7f*R1O( z%}Qy6K4j=+$zo}weV|5m31Wh0e)HuADGfTMr&MqO?f>*Ldupq2`)!TeZ9dI(E=>eZpyF@Goy_M`33YdOy?ibI7E&-H9P(H=9DCWW-n& zP5g7sW9N}}XTizhb~LWn9;JKsIgaG6Yes32!xBzwJP13_tEE#rqZN`fYQQ6ay^(geY`Z+W3y6P_iW;-gQx}a zdUad&ig0p)rp3cyC{(gDht$tnNw2j*-ZsCg(v2cE~avr6{a} z?4eU>NN{-I7-q=jN`{${QCywEhxWikq5i~sWF#NG%|S3ElVmEb_)dRt79aYR*@|GH z9$0Pibj0M9Z8QVq;|ofX$mf_PVMM{{3e1?&gV(H0GcuC^1)|0a7fxgGb$?0rWzsRn z5D(CzCotOkgZ!wM%>ssFkRtHH``teofw`h)!F${~QHgvpJXlQF#6a7u%I(SEM^H?b z{ZnIiA!dJM(hW6rIyJ$!C0i;-AiregxSTQPQ@?l?^jEJ6I+v^RpPS}`vAgN*Zv|*d z+TW6quWY%NAgwr;8DHOwA2@}gQ|mGbGc$?z2>W!s4|2*Xutmd8I9z>vlufH0$AY#q zh(cws76vN2o4qUHa)i9G1by3L>#DsQF(d*Q-I;T5=Uu}Cw#yW^qoc&R!Za3iTuy1< z8!-OT)F71_7>7A7(Q!9yZ8tj!owLv@kA)AR38{r~lJctz4i}$dWpZ_SW6MrG0 zS6Jd9qIA)kf=zKoS?cKol#iI}*IqH5cuBB24W@k~PaS@aG7~$E1GI|;E4ITt%$@6u1bnqa z*zCXIrdk^9a}UENY$eYjAb7)F%s>W|adr;62W7ne{X zq_lWLC0hS}s7k(6HKVi%ZgRKbydhDDZatUJOEX+C+uwvlAQl~1)H zn0W=N1+M}2v`lQB8-nyoB-vB{9Sm3OW72=Ws5$9^0*T5WjKQT5(_#iA5y$|&2ZhRh zWnm2^m%ePV2jb3xK4|i{UG^i+ttot0%_FSIO%*&pi>+|{A8OWj7k>U8B+DVdS?Zk&Z^MxB*KP3pE|kj#TFQ-Evbaa^uMgN*@~u9W7LO*ASl$rCC8A6`Km#KS~~CB zB8HHe$Fx#G9|O6Yh2AWSBh?v{{IBufw^Bg!{7=OCZr`?m_G{>ZQ+dyLBbek7a#Ftc zKwPFt3tnu2o5&|{k-OqmE^x4T1_$?f%Oci;0}qEXjvL_S0JEVr;}yIKpUEO z%K|#Fm&sOtHe8xqu`8jA3^~azGbD(EuTySc1ePCH#=!7_s;8utGl!$FIIrw^oBPCL zS{51;$PYV^)zM!pSJqf!M$XeHkqFBz3pf)Uuz3E9CMVXC5kqj)Wm3~C0vZ_(!D75m zzQ=;P<2JygFRrzA$Zr74NQL%$UhQf<&@Ef0^Zhr@`OVM2%;W*^tf_nPpKNi`cW~Qy z-3Y3VEt^7Jo&sHnJf#|b09De@*~DxW0qXe@pi%BWV=6WljNCS2Qri&G zx&;Qtkih~h#x&Q~e}*0-(BCZe$1t5N z!-rkoSPxdmAkZDUOp4H;Eg}t9*ky8oZx;Fv_Cx=L>@lxR7ZO!*TO>&IxFns8obSBJcL``bRg;G3$Yl+RjjDM9tedg(4s)f>f11WBFZuMC|ErR|;CS|zs}BeS zJe9jdt@GM9D7*-`a+nes!iG44o`r?2jziW;0Jka4hSmN=2dC2!m-`QvjLv*iIeKAQ zx*5w3>jc*(Wr!jKk=sZ#NJ3QR^m9s#Hy9v%iC&20-864oE$8reXzyx-hk?pN+-uOZfDqC_q6Re7 zw`U-GQg<)|Jr1`jMpC+6GO+rY%9n_~TR`DjmNagxi_*w$Jg3Z*ztTj~^Yyq#Jmjj2 z>xRhsd-!JiS$qX6D6zd~RN3(lVI&uTB^iO;#l0CX_lkyk_SO<5K8AP_X7%^^M z1TXFYb6Iik0yhfCu}K^2twOkP(-AKbbz9Y+TD>n|XgVOD8(7{1uJ0tN%ii1Jn`*Jm zhF$)pfdUAdTtHq1zL~!*p%y$QDjj2#88u!*GrlN7;*a}y8C({Q!pYhHFiJ;(2uVws zemDl73T9VSy`w{t3|(4xx50rc?^e{oo4GWRb?x?vz&#`V4|~+)QNg~ob2hdIkOgVx7FT4v6Uy~1Mx@W;Xb{hV!VnX?3*kd@c9oUeo)W=yAh?6eD^9(T+ zpL$?8v3CRT^LgY*Wui_oH&(e`HmlDMm;5d@X9@GxBc|X*c%?6lIB3ZM6o$2;-^k-` zgGn28XQ{9vU>5+)DS=nWg`hCOudIOZul!(!Z#{#@b?d0rfnpcnFPQoQV6GJqBb69% z6DUAn{3`J#q4MD}pNqh)WA$EonjVrDMW-$^W0c{~;f5`?W7BWv;UxXuDsPpTKdeAQ zYW0+JLN$PIE@lOWMsx9@pJ_tC43SE!r`OGDm!6WXiMY6L-T2Uh*5}`P`gk;L4FTLJ zQXJjxoUd{KkbXaf;dz~Xkka5x1C5J!l2WY@CqX_MyEDBEe``pbz8B}${K^mTUP`Hc zUm)NkIDQXwQ~!w%dvpO+}FbXoBy28>E73=G}ogs!&KN)`%=L8yDWTzGLFY>0jP|2 zS4NvvRo^|gCU}Aa$qm>8J@Q0{$%?wA4h@S?z%d}@F@hmzji@AIR-W}p*26#Oeo`|7 zE*WRMFzm>sxDZGzI#RrVvln}n5LWukVpE|0W%%4Q;W!8K)bMM1%%_8^g)i$rt5;)8 zWyDFVED{y7UtTQp0b{ejr()D-C0OIXOwOfIP3bc>Xb?(=6i7UZV6qHs=yzMu9V6EK zmYoGlld4&?X+*vijIdcc{z3W{2XJCHN&QdBSD=2G&wEYJNpjV;8{?r~b8$cG-Q$H@ zHDj!fkAbgZ-g`j6Xa>H)9Jd2*WJ2eD1X5^R^0V*ISlESMSq0id$H8YFVykH??Y6nG ze{=nmXoy!9fOgivO^uv%R(E>kbQO;SPb3qeG3RqAeV!C^08Ts1hZfKHK{ahpt5XMW zD%vnICBZ$h;8BZ38TkcT>Gl^|mTQ~jYgm*z~HCk1l zt>1&=TIHPr3JyL<%NOS#$+2-f+AvsZlSz*Ym1{Vu^d?9Y5hfpvS_FldvW-_wg2U*u z)3^G}xBl)X_TXEcLj7!y8=vu`frcP~>Ue~)8lRN9cBh6Vi-hZp_F_b=L1at&-FTM%uo<50*4J!%1Ji6s`b2fvc zIx912o)O11e1KvZIzTk`n->i@l*6zis#DT;;(j;=8xJV4?0s=xQS#zG&heOP%BkyQ z&S;hV;A#z(_*J41(}*fA^yPef?T_ZbRNpQ1iSCw(@11zyk`YR*H#_rcV`yo}TzIItd`{Ub!1JET=x$tca zhT1qEwW_-+3+{3t*EwurKjV((h>yKaZ*0VGbM-L)Y}Kh@1NmF3)M4+R*-svQ3P^v- z#UA8jyPpc=)vPSw-Y5*9O@8%o3Qmret+jU$aJO7q{HA1bR_%&fVyyPHPw#AG&p%SL z6wg(_nY@}F^{UtW=yab>&A@1B&Ra>@;9#nqW8B@-Ok@fXL?wU|fyjN@ zBm^c@PZU1pO7l1Up2~SpYz5dWJF5J8>W2JKHIqhfX$czh8I>5lK?h07F*0?lW`MDc zD4u{8V4Mb1h!|whQxMaU8S=SXq;Q|S8TX=o_>U!6aCOqf!tnNwykO-IbmIL%@gSfz zol*__80r(YGLjI_MBoY%lc?(ib>4S#gnGx@9{fP2vC+DBv`7x$;gLeN6(GNy*)?M_|fOd zkGJP7kJAG$Is9p{TUUZ?)797p-odaRQ~|vv_W=LS$hif<7ur)<@01=tB0h#WcxDCC7iG5zTW?h5L-RVepBuqvSZ{s^X@6w}Ho>*N{CXYCm9}~eEI7b>`fZ})@FM^xsrR$8r$k4ttWfMgt$L-0N}bt&}_OC`r75Ot52B( z2Q{vn{h_+W;0wffYHnI4cGZt&i(t0UT9Qw?BsOK#l@lQWL;I*)Gx+|>V()tx_UXRRa!pWbVeR0zx^ZWZ7_^D zt!F<^ZgmFcqTSkq^1e*-SE-H27OaMoR!8R4yVl1R&z5bolnyRFnGUXPJ6RPO@x<54 z45&NZ+=CJk)hQJoQ9Y96y8!L(9KIP<#^%q+*DOk9Jo>Tbp$pqMiSMY^~SC*@A> zbdvY^=tW+Cw=d}zsR(CsZ=wZXEt02^BC3wGdvBsf8zk*w*`mQITlq-p<_WKkDl0>J zI-u5N3yZ^b;jJ^K_<+Fhn3n>~SgCVA2JJ`vZ;mr*;GWR}4y7Xlu&AB6_EZ6e1LfPy z98=#~dzrq>H)e@Fo5=pQQ57a-RQdEIMzkabsO-J0i_A^KkBZ}(4T(Mso(=Im!~I$O zS=ILw_FzE6%W*zIK~P%(#@tVPj22!fv5VvX;G$|^-+KN^NUM1uyVXy7F17t>2KVsa5YZ~tKBc{C19 zaU@2`Mr+-rg#n$iIOu*z9Dvc)8}tJf(Y5VRFNrqBJ;NyQIjIoppi#;t`K2o>miY<>HS;s7u#SBXf4I27)$w9?uxq#I+!bOg*P$spkCW__3F>R~cCHUVF8&O>BuuF!I7i;%1xmH5Uo2$G=XI==vUh34|E|bmt^GNmHCCIk;9PE3h?zX zssWXW%FPr+*LD!&Tx!7AJ_j%)1pHVcxi=O;yPm$*EamF!{ep$A{(}sV&;?KsKdbjZ zXZvIzP)W)7AykF6h96mnSH?2GZN5xHv5ly3O6Y9U@&b?6X&{pg@G?io*?<;y;}RoU zeOP{Cf_yarrcS>=H2#UcahS~kVC=3EVISq<%n*lQJR}^Vyug%^<@4m`fH$oI3CUst z5ULm{W;Ji?7R0#jO+dhR0W+}y-RAHo6-ezYW`Ik)T2kO9)U8h3BWhy0?+pt&sEbRj zt_>=5ky9XnkN&(Hhxh>F=L1rb1hf&WPQ0zBG*S(5agR?Zfg`#|HR2* zxmpiNVSdJ(sJTpo8+rE`0s|Cw;o}AC0e;!I6irh2#3yK)E_V=gAsGe}Ah2bva#0An zN*4D91|+j4$b3-2(T;m~UNjsxeK<8jtfB&`X$}PhP_CLeowj4mN3H?NyJ_lMx#+`I zKhsU=LJH%jK+xWE5FA1XNW*^FxE_{?0f->D&~#BUixUoJa-pGcM&SS1W$26Sxm)Dw zPALfvYt>Y=M0%f1NYR{=JY=@z40)Yfn|2N$LzY9ia)6!i5@UV*cZ_=*G5G#=6@^R; z&OYXtWf(5pO?d4q1ny@_3tj!KxA1&!-F6g&1JL|H$6Oadg=_pScL@ERWMI_9iq2aW zw2C_;TFsdf(;=(7$BhNq;j26aI4vj<48cX)-nk9A1%PD>Asyv76p$ZCe`q=?W`Cf= z`3Qa!91OgHkw5UN6MCMC6<9_I9P$y@Gqb3PpD@tYzT?K2|7JgG2O=u2%9ua2dp?!lh@)RSlAFjvw{^4lBojqi_7u+pc+Jz7$c!3?0G1Qn^ng47q>vLwr zQ7t#lN4kD(#LZy!!&zI0(SUvl9O{-iWF^EU|A=S>3l!ZL9dA+Wh5k{UoK#LclSFt7>yn0L?{ z(xBZoLk`QNp>#;)JDbMDhuR4sB|OFhZbI#X@Z*g2ERKD;%56j?N|8%(in9;rqvxR{ z{e*JI(H9VTTo~R*PuyccV~SG_EqesZTrm=VH$z_$uPZ5WuX@LU8-nPa*`z??CxR=2 zy$TgfIV@GwG4!2LA|}aUHAjX(lL+{w?xHtV5vPbrERM?m1vy35u<1OhjklRumuL7^t~c z1>wySkN7LYKN-QgfMEmI!hWA@y#WA+3@{5)_mBC%y>{(6HK1DkWwgrzwEIEB+Mc;a zr}n*7OfX0iyHIILhcvwNFU&u^HuxM}-)o8_o61A{r4iaoEJ3=s7!3YT3g-e{F!PtI zjE*vn<`gR^#*TGkRAWqAd?)f-45|Jp`X~fc%ZRL+{>$4zV*b@ovXd+d5Py#_@Ad9d zJ49!1^I(RW;uYxj&Qsy8YgsdT_i>;R z4dM`TWky72L7F)+#xW$(Mpi_UO&kU*V#Wl#G_$M9>9zm%=m^FXK2Z1yMXwWDsCK3wCZw}$~@;H}G9 z&+PZ{YfO0Y>mAS_l{wrSXIhvm(r>{sLhfu`{&#rnbm3)0-;C%4!9f?QEY$MFC7N(a z%NEpW8H{)p<>(>sTqQCKc8nNg!9Ctyq-+?|D>Q$B%ZcHCLgXroZ>i88#-e>Si@MD? z-Qx92*2T4gD7_5%cYvSAoqe>^u?uKAlpWVzcB4ZyTG|ZG7_B;eYbd8K$tbEIefApDE*r_^8|AH+nqxY> z#)#K<1?d%~!3cfw2kP<*VksB(k5Q}LzY0kMV9tm*z;^bfNG=tVaVmuiK8lbyI-U-( zSw}XNkRQ`02W+rz9E&*@&vGFW{NMGIB5+%)A#4rqIYu5Wp{5iuv2J+A*dfzhix%)J zD`N=Ew#`fln}vaw^<7!NbjU5qS~XazKlS&f00NqiGt9jZ`ZT^5lR$A-}0N_bFK2Y4z#JDZa|K>GFRRo%ih)3Q$7WZww_$Cb^ z1WrhV^ykdh`Dm7&&el!}odYuPzm+W=C{q#~@8^b~}HODF`N-Cb8POah|&#xx-$VXPC zMrD*aEr^ibnZD|<+?u<0JWFp5a>@gICQ&_RRz|popb3Zkr43i0VEcczxBnR>0_CB_ z(NHN6Y(xyc^MZEj3-fCVCLODHbO{f&*n|cAk-4=xP%Av3K)Nf0p~6x;M}q1KBt};* zw8z&Cs2XQ1LShs%K;|k^E--k0XCL>Ze+LKJbZi!{->X8dZ@}U{B0mv)mZGZQ$x8|g z-fWubanSmK%Di?3f`bXZO1$u4N-V8D`mhgp2ITvfSYYbQANx@HoB;b+fqg_gDF;0$ z^sy-LWvD1+2@0y>bZYVUis7(_tk7@bgGrqQm)lplX#4LR@(zJfO(@3znX*Ee4IsdZ zJq`9)3Wd%9fB>$v_biE!t3{!%_lGq+TV@zT&KLU{%4VJ7S0J@q;X-pwSV3a|{Apm| zDIc1vU!U^3ARV94ED5kZhN~YkKjA1C3M!Y5y0J#l!vPuay{vRTbkLXprAt5>J|l+@ zUAIaRaXg5SM|sesB*f@g|S*8{7=mg?wmwsY?(99JL4uJ3X+P7C1uLjNtw$MGG&cUA}kt zTO53%N_dean4-%7e5a$#0`>caI^-dJ08q&TpC5A*L8mx|P*4K5?zFgm|D}=B6v8Ed zmT6@!qxiBD6oEz#?b0}A93QzvVF*DLI<*_%@4%xJ!ei)Ju|dfa=r=Ny+YrtHd^l~u zT_23-xpRgxhcqy3aKe|L+jyXg!sUP!=mnG2`f1i1MUgTRx>2a_iT#q!qZFh>K`-Yq zOSRVHlw%ivicamt)I$F!r&>xq8Z<2`MK6{-Jrp)^;45of(TgoFC`*ZZBSK<{`hZ2f zps+Ro>V-l_qZg%4P)=Mx8Vpe>zf)ZFfb|QmYdw^e19U-O4o_rAh60631aDTX#Hw1r{W5V)is}JoE$PGuxc!hcJDl?p z7?3-<{?aad9Y&e-6xe6#RMlRID}}P4PK%wQWvKMyI&fo~#`Ut9&BG5o(jN2nmD_`i=4-naVf*^FU)w|!y*K4SPS8}T8& zU#zB@ z3oMMz$Njd-$$R$6(|v>OckORq^RD)zS=XtovPH!`kQP2U97pqBnM4+?Oxh-7vV>#Y zPU$t@Xlg8Czj3t0Q;OYfj5|8_h8X9g6gQONs}n(@2G#YSMkg8f`ADAE23z+-Bk2LAWf}IDC;^iJD>dSBjT|=l1Q8CWiN@IxvjGj!@4iOilkn( z^)-z(n7m}F-mK!<{cCKZZ(HH1T4!X*YFaH)XFw%Tn_l&bB*W`4RUwV=k6RN}xgJd*`hT zU;jlCO6kvst;_#4A1{ml!nVx3x~9rsD5&`B^Y@Vp-R-yF(?cE8lk(4VEw&Gq1T&BI z|J*oOo8F%OygNi|n0)YW<#!_UKcoH_m`dLm>0<7xe8Oun=L*{2e4^7=KYvL#s$M7$ zpFZw)E0cEG<#}jE8&l%KL{OT4rs{L20jY|O5w5w<9;3f~%umCLo-G>vTJUq#njgzw z6I;Ar=sProQ5^F1I!d52XH|T7uRKjFwN>c_nf(FNLgpCV1 z8{#x^K1*RAW_mmM&Wb2;oI4-&`I#HlwO=wyNvZ{bt?$gL7tROYd|+8{`oZzl>5i9Mp5F&dqdsn_6gmFaQ?b6;?T4A-ixta>WL)c3c7&w1Xz zJh>Na#$6rrEx>q!`6;@xh%SVcv$=1eNP$cLZWdjGd&g=6Z{nRJ@7iWw32W(h8)*d~ zJEmN%rGMRYd1mJrWPO{TS9+|Z@=5G-3qSFI-$VN=bLazn%DY zcb|bci0RkiL_Tus*`ltNynLA#+hwkMW4T#e(~i?smUp>OdV73$5+(C5wHiPSwco?X0{ht_MJw5VU%5Ij1R@dss#Gty;zqLfCTXj5_Zud<|( z^<3ZMt7xs$LE}{l5nuWgW_J z(7G>4^)cEr(%WnP%-O59GM>_6#TMUrb+^Btugf_Z;%SK6m)psIKH|&s(D3-^F!Prqcshe{FkyS2r(@~Od0r|(R+R` zqgRgmt1#TB`DionCu{!g^~bS#Bi#>dVyFMSb+yJ7dXP zr!OU)p30TVKl}N%oMXOkXwQiAcl@05^S3!-C(CUHV}Gu< zBz4abs!Nc4S8kd%(z<&X5Bp~Ma*yrw6O~_tUYR_%eUY@l!b5c-HGS*clI-@yy$&A7 zKl^c2aAn17u-fL3*J4ja1Wi<@9=RyMtQVf$l788JbUVtEHQlg0x9H}x#gjw5^438= z;MUeiYsLi9nP*n%?v8)zr@NcqyYnWBjC6Aj>q(9>eZ9n8SwELt*&xQ4_=;EVQ{t5; zyj63G)Skh*%jHLOA8jOP_Muu7MO}_iL_lYrbtoGU87wfFpCGQ?P{q*yR8E&c3FCvTY-mFxk?iCb!6OSg$ z_&DIi*M922N2lICKB+~mA@a!SrI@5}uCb|;-MmwItINOYqtW8|b{wuHH)|L^Rho+P z{Lx=H*`Ijk%UN-*%l9!R7B}VGZ{8~P+z%*!S$eHH*X~}Ygv;PxFPCuSt z&9T3_VzJ1_@)lOA!Ml_d>vYjA>eICGrdcL>COBLt|H41t(ia!j^@iVRs`6n!^23F8u55Kh57`|5nMbKl^6hm2_pO zy<~LG%KR#IQQIl&E!RcOuxsN|k;kNe7)tGyBD@o~JTCrC%`BFp|V|qUIZ`Aa-ce#9eK&7tWdHQ|tSL#{SMZgRs$szEHY}Kzozqf-j8S zGhA#jO62;xkoDtCb63#>g=fV-8kM4pO|#%LE71}=@}Ila`MM>3pA+T6>cM>`DE%Jh z-Hw8}C%4SKk{K-(G%~QbbnWyf>LIVF4N`9exzdRBR!s~Vfr7Y?2N^Y4p;Gmdth@WL zysZzW-54NE@(SrL{;B-EkWRu42CYBy3f{8vS=@DmTTpm*1|i--w>4>r0OVbT>_H1Wz8T(qd)M-G*xH>prT?H_UN-|6+cmSM=~=SYkQ?F72R71WP6e; z-PjbSf!UDG?;??hp-v9OMI({*vV;P;k3y_c8CA-B1x;S{R~Z{lZ#T2P)_Fg{W8 z7N(9%(tJx35r!jMCAH_&nNCNOA7G5E=p%?>-n19C3HLhf)obkI&m-W9ZV;Gl?yLk)YG@ezA9tyOSIo%mdfy2gl#$E_}cHP^!vAQ{L<`~s%@I;;>FQ;dc?{!VT6GvE25#}khtL4Mu zZQrdCDhgb`RScAVzZ6Sc`Q_o|DpoRJj#MPG1fCW&r!|xcP6-s#@T(iqT>XXGKbkk5 z$O=&408EYWSE-y=!TPO z3*CIq)ZWFb#yqdQ`o%$3l;?PJg52^GlX4$HpxBLrbFWs3PB*;pPG67oxM- zaN#*{F1zkaIztQ(KzLYaa@%FKWLBTdf@pN@hqZm+wlWDGhro4!OiCwFQi^dW^Hh?3Kuvdb4mH zQ39pkNn}K;=&z35XqB@bUDrUuEknLmB=P0eDj4JFe8(LfYfl;%;eI>&UmDX9r`Yhn zwO-2{T1)$b2dc1oy2HUo`~#6kf(XZ6Ocvl0CeDSB#`frRq(SQCVF-mx+V>N>P$8_w znQ-nBJ`V$`!MNmPJdvx500rfOOvIGf414N5y=uCQN_VbD6$Hgm+}rp%I6Y777Nghd zTJ6S#v8EO(exsga@J?3dF|-^T zC>{1YA~i6Q6i}=SFAyQP6S$G}hPk!5(C3Q*80c10c^&xKmw(D864Wb3D_LF}nM5ka zwrB%yef{$Q0W!h{Z24-gRQ<5C4ab2?XT7PGXhpwQ=B+7xBFrD%=j9_yOXYO>i!6AX zEHh{T^G;0qql#^$2)TmFGT^_rJzY4A9@Mrn(Bd%O_CuWhqM_2{VmCSDc2xOM+%((J zYYdiG$)t{?0a64E)23KdaF-T%$|UVKo4XbVY=S)JQz#oowcr-0-585k8rJ)D;{Y21uP|7o!34 zex`_f27RBRA?^e8HME1i8Y zi>cNs_+Y0uzh%6xNNC<2tCOy@_&*$r^l{y>Nx`s{6}z~lDWq`zNZ7#&e2(hBz9nl2@Y~V9Hb>7=rBn2a~va{KarFLV)bm4E>zfr4Z^8ZA8(eDSJ zN-jNAqS}YgCcrO_D$?6&nN}#>3sN9UsrtpkzQTPQI#ML@J7olqonXnm&%l!|dzJ{C zivN@O9$G}&8jF3^1>lLckJ1FXSG#1#q!q!gSsq#uf?n>!%%OEx8 zlp{}8#MJW5THG(ofF#kr?9}l(n8BgQLOKh+T+XdG1w``LKlzyHpP5%^2QCC84F?f3 zZHOqj)IwVhu!~iuO{*ld&oJFt|J8Un>l$pkydXX~`kn@il&%S>JyyY_1~_)K{w=V` zK@Lia%Ma2gaU=4qE|?94dWA$L1C2pOdnGA?KqFKoe&|WZr_KFfpb-%IX_W^0rR{UB zIyRoj@W-*&LVnaBMhds${5zTSBSBUy7+NlVP~<%zYMqm8=ND(ftGx++S%-i>&RG?+ zMuR(rUh{@cv=vTXhLZYnIWCG6gQ3<&3-qBQ%F)}?@99=U-e<5~8eruH$&^L^9pCZ< zVqybo81ZT+fg+c7pxZvueqK*W#gfh(`Ez3bo~5(oss-y&f>yiPBY>W$WgU?iwXl-R z9*Vhu#ILWhFP7q!W8klQ{)H~>o`3wDoAGNrk z@o92W7Pw32g#z8jg5;a|(x?Fw?CrjIe-&licXYIE!?Gqa1DXgeA7ocbm!7{9wSbW3 z^CZ{#wGBf?ra`3sLbkQB-t?)-;CS3{AuceS2@eKzJU*3y>50;}gRo|3R4jnFw2zx+ zTlgoPh;8m#6BaNHvd16=0rFDqPfGI^7Fh1o7m?Y$DZuJK-z8%-#AepPJT4LW@}lie zXiFD#S@ip1?{tTJ>W>diQ>MpwsXlx=Uv6E~5r;REG5J$qfV>M$n7c zuG!S<>9#dRu1Y2hW;}b@^QdgS{9S|0xR&v==8G}MY1%vsY6jYxNq|tW+CrYZ>2@z# z8+e!bWlC&AFVWS8sb6Tl4N}VGx`Ol|$g6@nT1*%)5V^m`&r{LOB=dG_IrJUefKx!^g`oohK>c7a2;|H zg6&MCRMSrCBxL5f#(^mqlmu@(>Th2CUehL~Ea=3a}hZl<=GoJYCwY zNq*MB6f;G#K1SifuIT8!N5$IQacKDFze2<6y-ja+zZ1-OuNME5FNF3i0Y~2UwaWOo z%t9cmoTKq3psBWhJUq1x)EgKM=7H%un072LYy&f3eJ{LNaHNHKFn#12*!|Wc;^Wg! zJ@56#jcgNz|3RZTAJlsJ6EYV)E~NO<7pW5|o5u+(NQ$qS7R6FlHOi&IL6#?~!$pHd z<6@U<_)U3qb+ly2u5-4*FWUg0Ewd7d98TpD!a7X~LZ!i^KmmV) zDCNT#xH%KQcFPO1_N43du4mlcLE*h)h|?CA#_yqD8Iq>ZLTsEoQvva7;a^wnWE|+XoTkwna?JKKKBnSydqQ?^YIT#&O~mzG7OAM0t5pyRjG^p zZiPeuhVV5LJrt{UMG21GL!wC=qwoNdRo@r*f655hQ--EGN< zJBUtBLThHx4e}RXk^1PAxP$;~$mW~XtCxoy5_hPn7ajJTcmUP{P+~V2DGkhjr;h9P zVF1h;( zfM5uwK}OlWf|2H~U z!_ic)H!*^lt|^S3nu~w>0mz(6z5LD3ifM2eH-eXsJ@ovBFOii7BeEbbG~7L!H)or< z&cih8YP?J*V(k_kOxRFVn>cyo361Pj$>@pO`6gq7{HQ`V45KFdaU{_#L8`k zLY6X7M0yay?&ZHRZ;49J3tNd6ohf_Gh|1uKy$2DkGH+M$tP^tnaL0q03GF>6a{QAlc zKdJ5bEs&mstgun?40;d0ASq5fvU{zYT9s}R}BMxs_{)mGZB4mTC?VPhXUVX2ihjb%3ylcreKtFpXU$Ojb zu@Eit&u5NlpSn&V1esD4Oz?UA6(5Da?2)4f1wIQsY`)DT;^|tdx z@95wxB@|a|?Pd-!?Ppw!lPbd&LF9xGEy#I(<1?{1$4Hp$3X-fdwY`AJE~1NnXc;SAiQ2haF^R+U-r}a&XdQaro_mPOyQY#R z-e2)Jof%2WydfK*tC*Y%KI^rPE5NJ|CMa0zio7@Vs{CMJtQlm4QRs3YlwgXyN8)B1 zp62QempRn4mEBhbzBjDGuQwfK8(=`Zs9Mb{W&jbEmy%K(O~3Lj9Hdok=WC-@=VerS zZbd7GjxbhGNvs1)XmdK4*tv_diibtjk~s&!udp*-({GLqV)WN+l(MuDTCQo>&orW& zvcYmnvPO@G&pdB3Voiz|26mL%rLS4KGFp%sLA2p+R#R;?zaf`;3H}j?l2(@lreX^F zvB#Rk9I?aDKp3nH-%yh09h=vyytHDl)s0uXlj(CO7muGvRZT+J>4{3RCLE&SQOrel zDf@0DgA1_cX~}#!|5zX9&J-69h;6JUaeUuCLag@XW|CfYf+(d*(x~|lmYNNCs8PlI zN(FQVf@Om2=K~_h;LwswW~4-C&Qk+eRpsAX^kHI!Jk>fT+6Ctgo-X`_d!PmHnLH#( z!dM*{azu&H_)n3d&GQdPMXk>I)2Wz42anI@*QSSb4#G5q&;Q{pEFp%doSkXw; zdwJOq(YnI*^A9M3tCn&oj=g(c^Up3|B?tzsi zh7Bf$1f>ysP>(;#Qb^G;z{f<;-WB5T4knw>{V}jx6+d5U4G8yFes0|+h5dS`zO=fj zI{aP4ZMGgt*!U4^dVca?1*j4$N#4+mZzdgC!IU~Yp+GAA`_io}rnU*jewP*MDF=~X zWUX9L1RKtzH{bcUkep2QH>Ro~6)@CX6>>Sld`hN{g`i4gq{>HRe#Jp(lPaTIN*yk_ zHpt(`PsKW_4KaCWcb3$^x`QpVz-7d8X_AvmkU{GK_ewb zyQAj*dtEb@t%tegbIJS0!t?bl(kEy)F@WaZU=z-Nk+b`6un7yxzbIY0t(<3!+MG3` z2tIy=0sU|=H^Jc=r||Rrq}kpOd2kJpa>kwtLOofGREMF?OXy z&wcQF3%GL{|HTI6c-}WwDcyhZ94v5cef3Q$HOAlkT%a*bbz$lJ{P|dQv54Re7HPSv zpYY{1bBgN6ltk=hYb=)tp{fyu!IW&JJ(Tv+Rd{y4PRT6>KQ_>Py^inPZrL=+yr`?z z?(hKZ4tDx^0taA!_{sJylIg~QdQDH}Y)0q@I72=MdEJmIFA!+#}{bSuQ7;9OfKEopnE^7hi49;^zBWA817$5b$?5o}lpOev>f zqXrhX-iC$d`Sf;n%f>l&Jbx5+rQFChBl1Na`if{&`0XA!tDLNb+-R;Z=w-spOldzW zHGRT-d}gACvJov!;h)yzP_PmK-eAN8Wv$L+Q?JYm{{ESqn=E%_%jMW%CAQL$98G6) zx9RC(?y!gjj9DO@AzLiwV8X5p-FHjg<`4P?Ya*V4&*Z@gT5FIH7)H%eL5k5WApOMS zYN#v;%f#JqB}X@Xg_7rQSlYQSPdQ$ovw`l7b42%Uea`#Y55(xr2{ep7-JAlwkuFpP z!(9ov0Wx{BrNJr4R<+>_34lsn-o5!n*Pdvy&?`2S3{rPQ7|?*C(XbG|?w3WWMS&|vJv<=iK^&RaSsD>$baQ~L- zB~{D;b6viz0kdICWwV%;v)Zc!ls*zkWSA3^0b*+GMenq~p0t$Guq}-t5HhC)sc&$1E!VSpov28n9W8@%vUU+fxCRTBgIg zmX3_~EZigSca&YGJIMmOTIw1Ldk{4yH$^!6O73e8NvAKbYdD9}+;@UN{=-V+9Sqn(R$ zvl)%cr*NdM9xc?dQL@IFJDlj5m!B8wFso2aLIDPK}y)?!(Zuc|g zo>_obp(opMNK(SKcvqqqV6a{7AilW2!*Cx6ymF2G^1(^sH6;}BCQMYuvD<`}_@U&r z=9NcFp~RwRe$~1Jqh~b(o2K+GF0{?A+aSn^i(ZEN-Q7lA2f5Q9ezg9EOpLk!>Jr1fd((Nq0;mD;uwiAPglJqR*uqBx!>gV1dBAWFp?~S-QtqKAO#TI3-A= zc8Rzqf%Sc@u?qA@PAaMc0*8=`bOzPBayGu@hjRPxBe3~^0~IhmiacUlR*@hy3I2E}_K#Z1){QfN$RD#tIvJxeF4 zA^)_S*CBy_0_($4AM*;~Z(;d)S!7T6mYxXX%vVa{`kLs$f3Q;{3n0m+n=?y{H*9}7 z)C)R1{=hMb8UYv!!x*XRVJ$@je*=lX7YweWnD28X40s!f{#JJHdcXIwT=BODv6g4C zut`PXuVQ9RH{S%;iEgc4+R4NNEWF!< z+h9!uD`Ri2BX86cM}-+P=?Mc4$8hy_A7r0x#cEcHDao4mtNp^J-knD%c7+J9r*bYq zqM%vIe{RNU&CakYcp%iD6lT=@!l!y7VG7E=tS9ympJP}TmZ@}MqpWmA1a}K2u1G}# zSiZ{d`+w%JLjUO^Gw*eoxnhhc!$Ed1aqz$g27xX zB2xWa-_t6TFuI#P0=8T#!)@a{I>x>6(%M1Ui3*}LpL4NW`{R%;`lVBHa^VR4U59Wo-KVA_>~>(x>DP6~ zItb*r;KQvjiYCrA#Sf!pTZJq(eMx9=N%#PaMVsSl#|QHn*D$G`sxe=OrSxn@R5$!Q zJ!?-A`k%q#ED_Zzh#0b~xH~^yQUpNkH3Qo;UD)U)%iXyGY4{QBcp zwD8CGcKUB%OtAG3t!+nV5sWw0mqo7jYVYrgOsh_3qH>o;@i>OaZf}XAgo?cA=O>;J z7=r?TEPl)nFrSw0a`0a9d~{@4`?^>7e8{SGrR^e?E>^Dio5U|-e8mcttBN~yIiY4H zqP0qJx0{5wKJlBJ!F-6KqaH%7pIoU5y7+9k=G^>mIfPrMH}~G6o|N#rUMf08UU+~P z=d;sFn?YI@-;_D2TDN)m@wit?lvd6;!z!O&?_;E3emTTZ`*ZSc4Cw9el$tp^wuYte`cRdo=AV8QF|S=C5nTL z@zRnSwc@2ZrNgH7H)m{!RPIswA@#l*7i--7<0@AnD(w^M!<;h4;|QdH$k*LAL5?CI{QAK=}BDe9C<7sAHx&Gx$LT=^s}jL3!^*=_`3PDAQp<8}izj}+?xGM9s# z3{-FdeBh`4fSO0Sj;1VTvrzSgT{hmn0=#oGlcVnTD{NoQ8#pupC`tu*Ckec)#k}wc zTZWAP06!U!24r==q!7oZ%#aquqMLf_@YQx}teZ8X=tw*K=v1QVj5XSi3aN{S-T>ul)>A)LpY{tT|DIKcG)OeuBNrmi>6Ld?kgWK#misrT?~zF9-@ zHy7CxntXE$%{{gC42<{w1GBPw9N2JrFxunT}^^8CKiOjMLF*)4xjl3S^ z0-EcNE^u`I7KO`AWq!$`{|#&rdVMwns%-szrU#STCds8_?)8^<2ja?)Qw^~8R+n6_ zg$o7tE(^5{>#bXmlB33>lT*r8oR0O_~`)KU`rVsVD{6vyng%N6FFa)?w~PYq#-~{H+*2!9_Fu ztD^V(Kv}S$JrQhV zODRzURJkoL)>&JuB`5;@qZG~$7A~ETsY8*0^32){Op(Ndc3B%^Lho!0h)Y0ldFYZ& zhb$I^iL9!7Ldg&kugyeKj;AKm!%Rj$jp@oRROz6#_{?#$3LtAucL7jHX`_rU0OGKETyBOE}tzAcm zgcIjZ6~+feTU7a*_P#M1EV`2LMy5-GOB3~{;gn73oS&#S*tsffstcfSJ(P5XpdGy( zklFuvJtiGp5dv?#bWlA$Yv2ADihRW~cucyeS5O>oLiO(Kkk-}4xgMIY<20CMRzNZ1 zou8C)8Jiqa1k_Si7JLk!B3-vtoAoZVG`Vc0+nYoUYuq3QX^J8r4c5r5Fe$-fj z>M7rfZSlW+(<0VuQ3w`DFl>2wgckdSVz_|<{qyfX@rat*^iPNDe&9rjmW-Ow4@sEQ zr4n}PV6rNTuv1M#XHQ)JsW8mdax=`pGPdXJowAuxuo4YjoLe+;sIME7YBr?}1-AG< zhdXdB>xF@O2GUe*vzjp-KI6NqZdZ~OO4{B9#PGHaA7<_Bn8}rk`erSrtk8WwQD8Ns zIG-pUY2f8NCh=&2FhNaK{>6zG&tqNLj@^M3@`f`ux<4k1Ad@P|x;paA>d9U@0^fpR zY%Z27zwH9!P%uDNiNe-{(v0v-@OknqO!&+VM@q1)y-Ze1T$)E{wNGI=AYmfw?TRV- z_1L&)R!3H`h!Oko;y#)tPNwVSeOW11WufxZ*cbBZmdWtK!e10>fN1axY225{vGx6n zJyZu>zW;BWAguq3J*4bzXUrsTV4>t>%_K+60swq*(;Xb0h`)Hy9RCeX9mvWI_*ZJt zypB$pRTF~uWz|xQHIWznFcC|lAio42HIST!A&3`vTv$-}n0yDh;=9?vYibgI1b=5t z2eall$XeG_!7w^{6Mu%ncS3Tj{*Ej#cV$Arevo^A)IdZ#Xm+l^SA^FgfElrZSR#Vh zFIzj1yNk@K-GFF5i@3ldiioDXexM&Q(oPhDTe`!?nB?!G(0R?RJk6~;ZS}L6C|<_P z{8S;^qdtPRKYD=HQ{Z>r2wO~uG#+Ds--1qbh!!QdEtrZRKXBcm-#c3C+PJsy1Pm!e zYc6I&>#CeUcC0meLi$?Ywi(?ar-U&!e-|_J38@J<#GI2Jawvx8y|o=e=q+ak+eBY7 zh0Q3$m%ocT$7)xSO9*7ct#b4VddLZ2CRyua=s5AOG6{~q8bXWU$r&*>i|L2lHW?JC zhx>8R=QtUzo7TLERCQF+f`|pYxVI}qvqiL3h(6sWSReF7^FDeSBB5_J`XQh&j7q(z z4>gkhrjBs`9H8Umr5?kUb4fAi;IuGf$N=pxoS%MoN#w<_hO zVE6QDb8z7(A0WqqK9_czRk}YrwOaIc$1xu?@x=ylei)dHPmxWZYf|wgFeqPG7sRfN zC2b~xCyV+U{XBtUuJX)&E+U>Ic`Ag_RNAc92#;e0K(IRY!y*y-0V3UuJ{JLR0(Av& zNHA5oglk1$UH@MG_Sf7Hrh&szDx6)@RHs_R901iA9j~?!)7gkC-CU-&(JeIRJnGNh zde49&RWGVp(uK)GA#5&}JOz0cM^XRnR{_4Knc^e1D2tN<;v5Gq8=O|$^lCCf;WmA4 z$F`TS5C4K5%>DSf=iJ)bq*#T#V>0I%PeY(Tg`)!ASwB~bl5XNca#X4k)z|k;@(67R z$NL=ALvw=9Mz-$KromgelBCnm>{yCPG*wxE{gvE*J;3azb`tL06ej70n+R#`H~E*+ zxK}W7AK;i5w=hEJ=iQYGDJ|G+;VeKRWi7x)QqCg{Qp3IMIn|(Qs)LP2oAkR+sl+Nu z-;S0$Z8C;E$0ad`B9(@M>d(jp2Nm^&k7Lip1&4b6$pyz<(2fYdz==|Ru%OMnnCHM@ zsVMqd$c#~yUTo=wsTTOfyVVpWh^uA5lx4l?P7~V$M@T8CxWf~$o^=PG|^rAPE)RjO zfgZx%hSwU`W87RJIr52#=LY3F7}g&L9P&gR?(fM=saybipPM_9smx&44fmH@qK>!M zvZ|+Z@lVn0xx*NNkArcw><*9D=h;Cbucy1^vd_Q$i@wjRWsgiumpZ!qFFTp8KK?uc zua}*=eC@9<_vv2=4L+~?S{<+Ni&dZ3cN^)pA1^2AlNzS)JIC$v_Q%EYzFsf0Bxc*L z@?zV8?7@AI~sUJnPyfj>X+ZoJ+P?yG*i!!CLUxMn~8fP^q>C!dw-7bKF7I3=tPp6D*mml60Givyn4?nDZ;fmEp10Mb8^B5HwLSXB#U z8c6MgZ9)gQ0RI6D14W@d^jmeH?3N@p@y+(x}5=S-;Jp=O65?dGi4QaVRZ#|am7nBBVxlxt5 zCQd3&O+6iB7O5;8yVWmNkZDBrNSd7Pnp3`SUutZ+=>QaZN{lKn!!=A9YH@~cFN83y z$9UMGuVL^gWOKU zGi{XIm>w7Q8W`kkc3BkNnXXs7O%Tp}Ry93rN1z-o%y8%r+?0c|?$z;cTZA&$a3{4~ z_^WjRa-qii#CAxSGUdIrnPYItk=ku^MZx&sgxvx2dSn?H+FLqY%SbPoTr;9@n5i%x zBLF%Tk8W7jk#8L+3hGxlV zXJua_mQHdc zwJ(^WeY!AX(MPK9&tg}kO*w8s%V5gL^c<4%?2wxI)_trjrWbe3Gq6G0@UN^Ej zR8mayx1O9HWns~YoI3#gl>FU^$`so=N7_2Msf6E#}s(|b9tmQjSG zt;KGbQ^Ly%XUN)eoZ@unV5#p3El6+EJxFyINDN5Ch)X(fDGVS&0muz)@mji9=%N?JxV#<3&=NP;Gd#Hp-&F6mo4vJ=YzXC=K#k^f8rH zB-yWP0aE1e*qy)9Zu*hU4o+^I*J2kGGw+8Mjz#!1Peq^4a+!b4>@F?u27Ig~ zLwrNzE$W^ojtpUt4>=i)j3#+B)tKSZ1h+%cO3$!X{5J-M)Ji*0gMhnRyX0YI|2lC; zBp=Y#Y#v#Rgy}iytl!3W@<=XpAU>J5>>14R7!8r&4cK*HH)<2Z7{r5KT5+{Dyf2e} z81Eai!Eu5n$}Qr7$5<=T%aT#WW-CNL@?lk8H%Q||qelM3H2;8{Nk4sFJJLx`t#mgQ zvmQ*6GZnkc6J0q^!&340P!-6=Y9B=nZ=$2)hUZ^iE%`6TMyB#UX-0r-CMMs>X4!*qa_rR_N3L!#(NM3`VGzaYyW|5isWHy!HO5%ux7RXl z(v&snfs9QyRy~{VA*tj)JA-^*)OmJYr69-pk#!7zQ!aPZJS-p{yf$Wib7YqIs_$UE zKH!L^H^%L4I|!T36Nw*waoob#oKjhz7CBB3rvui}dXyPOpdJ<-c}~EF+B-mBC~bt} zAlRtsF}}2kBH{>nrgrfoxN6jW$nSlHRW#g0>-ffzhrD$l2a{x+0;g6qVw?nQb`_I2 zg+#~Ab(ZCUqQBjVn~tOH4E<_iykuj$-v~Y*JCO{olzgPd;IEbXzU63aAzz+Q6qivV z#V^SD=FE#UNR{Gz26y0}2!R5js>tUO;E^|$*51-X{okggOZzCCw>98U8-1K1USz^X zJ6Dg+xL-2%uU&rSS{QEZo5O`xSSHHv$r1>?V%(1rtXx^9-@Do@>A(&Q=r5!KPbRpI zzHU9BzQ&3mWn*KXKl~{k_z^TDAN8Z1?%BMw|51oua<6#c&qmZ+-`x-YALe_-D{i7b zy4N?_H@A!uSIJOohJ=eVE@H?ccu_*_-;iV$*EI+ko9TNsqJOl1J4_XaoxaUc z;}oMCRbm$r7hWpAy28AG+)kdE9jy-+fDs1qB@zvey$PJ#%k>~`*LfH+KS4HUcgNSL|&Hh_rIX5v=N48G|9#>*Vl zZANwpvlmL0NFrSj=>O)Nou}-os(ct-_xsD};80a?y4!q3J!nWKTE*G*$Y+fRHu&p< zmfaFVfd(FPk%$rBnnRMnVB+zhc$(Fyz|;*uqSISauPZYP5QfDfFXO&_FoP_DRCgfV zYVsJDr=eHjT+Bv>z!9~uu9`qWNU}f7XbsRZ4Q#=0*`}Po$`r8+R(U{9jAOAddWW_( z_cmSkNpKJ%CXtM~4S9Q*y7-Vja=nv0wzxi4ieAi~id@{{ILhzyUpjyfsSvVuJKm<+ zYV22YPpl*Or0fUFzIq>GtvSG{?QffWtuDnVcZhio=D$jern}Go98g7g0o0lY`Ccf7 zdYa-K(jIw`96BU>lW(o%QdWvtjQX`;2PpZwr&{ee5)pu)W&QIz03XyI<$siHHzsO; zeyl8p&%YO*pl~f%CgkT`lu6bno%Czjk7{z&i?^2-URJuxs=yKgz`-hc!+uc-=lG9Vx7Q$xd9j`qJXGuh`$>euWK& zW5?c}pA1^lU`wvwel^7X#k-W08#N)kG-r-~+`Y;w`Urd6 zOSDk>r&0ee(XYpPZ11+~tg+ykJY@$n9q2jXI89MLLP7T+wt)DSgmh2UHDx+wohAp)+78V ztK?)lvHfQ{$WJV0xhdIJUvy~flxcz6VE9oD&3CzwLd%h7XiP)fo_6IoK4KXW-cDgi z^9uOHUo{*>j$FP8zpCEOzqGM8SQKnJV)c(-UG>3dopx=1;7n^e{Y+g%%Q_Y;J3xfk@mI!;*F{_paxSXlp)bL3om zIQom(+J5+z#BZX$1_Si^BDM}ONNfh+ul#Zt#y?2hl()x_ZZw`ga(a}33n3oG>^Hcs zaj|&f?&`V*`=2>i_?=rwojcc${m;dR+k-#vK)#40`fh}w1ZI>i1cCs7fgAt(b01e~ z`<`2}1yhd(^xMR>)gyA{cJt!4DOTr25W3qxDOVg%Q^*dzQ$wL4Zq$fdJzVv%xxoWv zDQ~AGF59;EAhaJ;1INBz?2(ColsfRa!t6g6Z*2on5uZupz|7s=GXC^o#)jb7^cNkj zq5aLc<}AAXw)4el?HHbS_}~T{XA*u?Xg5Ue-lqtCg;5foU$VDjwjcMo0s!Jt+Xd{7 zL4C}ZIyk{X5#v5k{E-kE72`0+hxS*Td1#v=TfgVxJ_Cq$-s@_#ABupcL#Qk1$&g4< zgWH50m`96##H@?QDM3DICclemf`RfVvc>Io_7^O*6EHg0FLTVT$;rT0yCtpsHf^r1 z<^g7$(Zng^?W=mbu5*%jd^52nN>O1QT2hfm^<>bGL%ge<(k)?e$O20(F``BJqH9>$ zH3(?M(kL@7#80ar>+`^W zLx21JCrNcdb)RS~>Tbw@A&d~E1%&-8>MAIH$5{8F+w3{Nu|O7k)kbQk9VH0T3yzgJ zgNPvFX3-bhS*XzK3m)oIRhz3}d-I)~Jv9i0X!Pd=kXk-EESQ$nIk|y$lP*sbVXm8V zM&-vsxL3Y2DMa6Mp4TTfoH5@K^>s{+9BdK%U9QbcqS?v~IcT^1f@MH~wVwM$RtpcU zih0PwS>%UoNk?Hii=|d$NV#x zw^=Pp@BQ-2J;3dRnGG$_mE=�z|aIpiqRd1XIVK&!1g5*Lx-A2AB_L6y#t)iTRx(8?j?yi3MpGWLeZY5s)P&r9BbvBqh}-9$&B=@tycRZ8o2FbOtRhE(`ou>?cU!huGKR& z23GS|Dy`={qAw-_{U3q>rWYa3ia$$FjxrXSl)z${Tt#ZqL#uI>t>yza1dT!8#~k_n zfQ95ds9zWbAh~Zt%0xq3628g-xtY>hFiupo#PLsB08CrL5yCF-WD#?xrq_4*pjl-=d~490vjQTwT+)1unr4-@M-n57MXd+Rm@we-$#C&0)N zrZUA6P6zcd_4hcT?=a`zR8aI`F+v+^!$T?LFgE(tF{x%RUk%X;QW!X|YXZ@nY6(G; zfRUr_TpPb6Pr2vMeh*)hbx;4w%P0{e6(^5xcWIs~*P)RR-U%7vz|ai3$M|{5p-#<^ zdIi|jkAn-!Pn=P@J7pt%lcl%*eo?Cu67?W8KRU}lLf0w>{McC{KTgNxNLm|$C{|*- zYj};;jB<<4luWt!xe$RX%L~QY=!=aY5mu_F`IDg`Nc{jy1S(tJGY|rm4oMju6Put^gOi`uAXg!=O zj~af}_N%-OS&yaH`R@CE2%gR|1D;%0b;T9@0l$CU@%R^AQ$gJaOu@ACW}u zRfC>}Qk#%BF_cjt`2uKr)8_9PAecPWlzArz_N@7Ct-KdKjfN;S9Q)sO>-16Ay=)Km zY+l~hx5bO{du+X}TN;z?V?SBn;#=I~ijUTxKxY8C{gEfK-koRujnWNu=RPAjiq`gWGE3L$E~4yAGNl*_Yy`d;cDR>bCqM(3k^~e_^;gJphyh%| z-8lpvI)5&e9lVt9b16*ID;oZLLa&4sFS9pg^&`)ZL?2*=zl(nU8}P&aF9nSLBW$Gp z6*n?AbYfC+HgNhUj3jBTZ)(h>W^UwU_7y*3VUjR5H#Ku2W@l#-v9+>wP_olEG-eVt zb}=_J7I)BhXA(Ada#S#O5V5tkv$Zj{af0RiYBjVqGFH%cuy*_^lk~rzK+O67-N})d z`JWwUYn!jVuZ|QPjE&3ua$vvcP_A#9x~ZldQgz zgSnd)BaoTpE8B{Zh50MjpO_KA%*Dz|%*e{d@dZ>FIhfg)IfxmVnYoz1PGRN*0KX0b zI9UGq^wkF&s}4WE4wI6szM~~9%YPVGk?H@@uK&hB|GfpjO#B~f!I7Bt|6oC8w*StA z#LO%}j{jWLz#GO+YtfzYoAwz<4Qk(r_oig{T!%)j(P*VL7nAg$_0C!5qDkh2Wsx`2 z?F;w0BTItZYFhnm#*)1iRn0DWqY+Iqg;pc|54cBfs&0%|VPtZ_vrC@GSY!&RM*4Uu zlO4RY+#I+y$B*03&BymojV{STMKG{;xnf5b7sO6S&WuR;N`Z4Y8|0Y5GFrO2x;g|g zvfGogs)xG=dT=aoP=9q&Ny>!gLp0X+@SoRidHHp{IUHUOb=k%%D=TZduC!!@(-w;O zT@p9)%RqF|MGo!r>A zZQHhOC!6=v)>iFS?fik6s+sAh`=HO>_9?^{y`)x_6zQ0JV8f}T6}48JVD{A5u4CJx zc)key*Fu zqyxv8$*(~+&r4HNOE*P^Zo!JRvgOxG^&KXPs(}wh6EESZyZycWoqm=+w7YM_fDtV! z*#3xT5Gg>i`|y^Yp03H2g@!4k<{e}0wiVhA>1emi#?I}|ch{VW$YwRh(p z7_d7(uf!y2n|Nquj~TiL{RUOkZ^C4HRv#%9g$gAK6VspJu%H|494Sf-gVF$GaduIy z6D-_^02bLGoHZ#y1BQkecu;WQnrTdk;g4L1R2fwm9wjk|^f-m2rDVM*kd{2Vn|rdk zRARoVpWZnS%EN&b5iGQqUY6dSt(Q542NjaPCqaWaA+cp3E7nVZFlbaaaQyG(1F#E9 zlq}Y8bq27MZ7o*gc}GspJ+y<6J4 zkQjlBG#RmEEmMX}{}ifZsj4N6DY4KI;Z_oL;bUJ;h|i!Ph?vlVWyuQLW!J0orwjEO zLJCftY1(|3p-&ZHl0*qmr-$LxfxY>ArrQ_|nn=+^eD%!T0z(1!?3FXnw2hNXV&MVW z745)20#c*Ti+96;1@SO(L*bkmZ6z(EX-4X#ahfc)c!{dhBHD103grwoY;CIJhM3$tn_*gtGITlnPNdoWut5+1Ex|FY+mMG zCxtGK+wAZU0i6*ndya%<7!1@=jIU#aS|pOvjII7NuMzU$iG1`QoxWjPXPGZ2hld!l zV7pMF-&NBWw|9E6;0O?R|Ec@DoFQbAMe~vM^%?6KHeK5$OhMv>N|^2bA9ppke}{&K z*3QoQ@(6dy7WwQO8mgFg;X#g1sIAKn9X%g(AthGH8c_ln zrfSFOD=6vwvt{Vzw*W?Pap%%;GO>W5b?w-aD}lDfz{7I&>a?c`*R)MRdjZBu99zU6 z7A?)mt+Loz99%rT9c?7n^5*6zx4W}K1PCx-uRwy5 znsp*XqBS>Ungg@~Kp+|yP0IlRfD%w?)w#L3<>mFAo%#8lo$c-8He-fq*ag7o0Zknp z9k65vi;F7i>g-qt_8eV$`W6n7=ChE&M6Imzbnc5}L3Wy&Yl%5uDuRlDvq+LRS)9q? z+Nld3?}uk|d2?&&njGLmke|Wr(=!vynKB#L*wj?ii&V)nR6)0B5W%%H2uOjZ-rk)x zHSnJHMn*=iu4q1bdV0efd#)ISS$b}tb>di9*d$7ni;(tSQJ=t^D4{3(KL;ZQyfqt9 z=o8~o6%`dd?@KkfT+S4{R2U!4&1|DIhcMvqIE$v{#;<4mga;Vd*dKfFzV_Fj9v0f2 zL@1Cwk4yBZsc6KCgSPmA&y|yVG$E;aA4@f1V4=gIBZo|ydcJ&EwjTp*7wn z^Z?{jsdT(An@+r4U3|5A1OP33cRSe>RFw6H$F(9oglAHT+s)Rt5|t?PGRN06nLyYZ zW+!@{d!`f}8Z2Uw1ck4CfZT@~G~{@GpYbDj%vjM$d}ZtTaD{3WhV>%#g=J-syM0PB zuj)OYLmlYb9ozFj=Y3i3re==EN9cObUSCbHO`=1hl-I`#RH*`5Jgo@cH(StnCEyCN z=toSH!)7nnysh)4F^uj9PdmIHi8%zbb6GuanLQr+gOHDKLV(2rsTJkr-CtQZt((_- zdxq{X?Jv`BZo79%Z76MDVJ$dm@5^O7FD}o0%6kYoUz;bpnBdPh>g6i_)Kc}3Y>F~b z*jDm7C`AZyVffw%bFbGS(6qF)^qseXTV~eX-k?{UBuJ(g4QnKnER9rpS!&Tr;sV*V@|bABUN6_GW(iShLH5ksfq6szP0h_l68~JuA2|#p%T%2H znB=ju0@R2QE7~u=j)HU|+|W|dY|bsJ=&6O$L=32@7~-7n-__MkOievJJg~4QN&aew zIYUH6S(}fbDhzybMdilFU$pb zXCCT;A#_dzYWw)`{!PfqxpC$as2Givz@$n~!)b{WwMQh(f?ZY7 z?H>}LqYXjmSV&v|5DFdfhr;)GoEsmP>e9>UhHn8yL#x*P11LJr*sx|3cNnK^-QjW?n4VEmef{skAfeKN&M| zOx(JQtl*`dk(uLn%{j}s4!~HVSkdxlr`vCbPsw-DD&AHx7)%&2w4%Jip=9O&bhj<5 zIzPckNotK};qG?yz8tD>U4nZp@0H z-4DRy2IUv&)eO^!-KFDV2>zSB5riAS;R;gC~)9} zxi4fWp!@qmy;@dI2B_T1s@(6f03Vm%7YD63Xg*FZ@?!7ysX{%A4!sqaZMDvLq`S*& zPfRJ@hSqj3+Fdax>+8AA$(=ZD;^rY$HKja>3U5I7fQULIMZv;yoa=2v-7ky>&Wt5< zO5X1-3LFl{pVER6EMm{=rt78QB2kGh#_#)K1m8oXU~ZQUt}4aX+Z13@1S&`c=q@;*POB1mgvC!ix({#1|Aj$F7Dah?yymv z#hu5W?Y<9rxXJ+99((w2G5FwJ;@wSXxR1||70mgjQkv$0fwbhLl0UlPL^r)rbS`auq z(93Ln2YD(yA?{}@j?Fg(*jsn*l<)WkIhjUfF`ElvdT^zjF?LRB{(pl zZNMRhS@u$uGFh|dIl9|b=slJ&`yqcK{WeQZPDo_@+k7C*1YRmR($uK0;89MC!?Ev5VDKi=4FtHkrG$BJFO6iXW zR#{JNFo%1aG%Dr@z%b(Crvr-1&psW7 z^jvR3%F~A3j9GJGVPT2--wj5(-am_DiLty6fyF{cM@L`%ig?nz*RhKhT21>*QTp3YT%_I!`+O(xDK8@HCH@Ns8#Bly-< zHoIQ4Zh3J!lEj`=A!16UDt~>kJyA= zF6}lDWB#%Bn5Xw>Epo--P;g;Fr?!fQ@j7J28b9HLL%6uSZqHZxouBvn`$$d0ju?#f zGH5E5Ttqs6>CpFjr-a_E3ws=I$C+_})XcUb@c^Dombk7CmWVgzE0^}oAfgu3eO3sv z0N$Udyd$qyn@tyJU7`N|t->Rz#PO)MpwZESaZ)Q2C<*NKOAzhhSgznqlu6^*vU?9s zP7nUo#KgqzEF9QroUELx+WI3g8@zOn`?b`543QJ@riV-Jbdyt?c}l+Im-Zfx^AIAl0fdpWwjDrE23^+dHzQGOfT1tJRNF|4PiQ`VH13svhYC@3f@Mu=e99X`C}0`Bm6x!PMGd^UCB2>$eu zDfofI;SEknbQakhp?d49X+aJ9o(-WB&r#?EOZdcsPfD4|UpsITJ21Gqh9)(>!QjtG zaUa>H&U?2yw$nZvxLa%?f5*q0q~1B$Q4j{ZP~h}mIQNl#2K}Xul5{5)0@@5~{7s&@ z+5yN>F#CB)H(#d06C&lo>kQ@s^kGDc9%#-rMufgHi3c6HZGD8y6lQF3L!?kXY&R}A z=;G}XK+IUV+Uj7ZXGg!5tRSdm4Ssl-;eYvjnDOf3bM@IC$3k2!ZK$|-OlKCzs_}lC zfXCRtyiSYRN^ z-bRQ8YPcs1TA6CIzrVYIARBoEYC$)SYXR%;PzBY;Pc)UDo#EKFNuWrTT3TFi8N}Yd ztN1;7FCPG!^Wnkr4?zBOBXm3pu8W^nobicM{@G@ z4LiM3Ydwh&GAK&ma5^~h4o@PD1p*{>ZlTxS<6H(TgfDrYWdTv1m=V>}u5+AH7}@g9 zm4ytNOs)>iH;XJ$8-ERy#yF2*h{^pW4coL&G-nY9F(-OXtYL6QaDhn3;Tm26%2TIhDo+c2h&PmG_5K+c(B$?6FTT6=ln z$cB>_mzbvtg;x!Bm4Qg%-omE~0T#m1(yiGxJ73+CfuKUjkU0r7iu74OjMqXF*Ao4ArkL4a8s3P$vAl6aO6l3p@oYeycQ4>GeEq{86(|f z)ob~^C+2kie1E)lWK_xf9%Swm4q30u4IT~-f^3FQLynrx-{05EwEb)0Y6Auv!RLYR zhVeUQ4xCya>)TYifC=mG`yH7b2%ESv|DqdaHHDm~pPf~#)I`Tb3uOrYOG!=ky}Iyg zG9H18%U`nkx_0X!PLXhQbd16CK!Aa&1sv+F_wZ=W6a z+jEIQhGzj_%E^%c>l0j5>sF=MlF}{fHEtD3Mu0g4LCBErYJ88VF|AxOj&F%f@H;`K z$T$P~-1qNBEM5HNuH#%d^AM7QdW|DQCS4ht#^?eSA;XAnk!oey?*R)iR*R5W3U86$ zZZ|J&C~(A94R_tHH=Dd>@JNX5$?OODe;#@a(g-05g?4y69IdRNXn@fvsi?M_tl0-E zm5LI`k$%T$I(qsMalyuVN7d$hMR%TfgnEn7|*mWC8@;$gx%z49v@lK5cf#b%@V3= z*mdGMAy;db0c@8};WkkuLKW#L>Byk}V1P|3DQQt5M)e8aW;wn!JV3Y(_HD1p!Gan7`0B$1>BGj&4Lu>Tszg$Vv$|=-mRQ#M=7CYw)#by7 zAOJmNWay?o1CYsv#7UoMdhx`ns%jOTQXNk`u`e!8>690Ji@oWz05f;o29Y`So39#k zsCBWaBq~v#fZam?wTH7_NpmhxC^3FOsm{t);V}@-&`Y2CzHMDS7j~sszu+ zwiwei{W2kHs~aQO|McdQY-niIgeo%H=J$J_VmCK8qoSrdtQ6}W%3J2AOP8tMc@}g+ zJ`M8w9Qom8VF`9f9yfUdeWOYSqDvrS(jx7p1{DpN-KwIkdi|V8rR(ExadC+|H^~l} z5kLPpllOan`P1dn)`pqVal7rMUZYEV#uy82La1f#fr%!Z*>@)Yb);W^;T>^yD_^q1 z18V_7azL4~iPNQ6qe6*PH&`r_z`%}Pu57|fm^xyg4xckpB8YENf`*uMrc7=i-U$Jd z%N{pGFTtuQi7Lc3q807>mxecD$Ux1+P6fD{=AFoNc648fVyjCw9ISoTUawvyQb&bU}du;0&3KNio*T% z_0Cv477Z0OUDnLXzGdU}}5B&IVw-*&4H_dP+}#OEgugnNvs{w;I} zX6gbbA74!FT9dW8gM&j1sd&HI%xHhU1W9eJfamCSFPZc@2A}Uncq~bR0gFf)XLh*m z`|fVT5a2y;g{K8aS>o0-jWaEu9pM`=kXmlGTLq(dn$cGQY zISBPgxesKOThZ|`o=ojsU#6P7WKkA1%cW%EG9Tt$sWEw*276ssOaie4nYv_pK}Js2 zhq%DpaCKFMK^Pzqj&dm$@pnS>8rgg;@sdtEYgl`N+kfUe05BY&V=E@bD40bH7D0~! zsh(Cp_Lh<^Y_jll3hcK|9O-E31fGF`fhA#l)70nbP@oW00D%pxk2>xVHTnvl2mr8w zf`T@J$=7d&gw)N=1$_GgAmzqivMeX!1I7DK0@!S?0Z!8Xoj|_}K_bLUOu4uP1`tqd zmK#sN*ITq|AQ;M<;kASR*VWXe`?`>Gz21fG8x+&^{eFR9#E`yn@jWraA8iA-{4bcX zxWxBiy@q>Z;~cx0aNN_=OG`^TGqVQ3&|k~L!$XTLq(J+9*DAP^iNk=mNsSgEpo%T2 zug;QOoCM9PzTWj}3pfmvg^rH4>+9Jgnhe_hYw#d;VNIL~n<$ky7qQpP8B2Lcl}R!^5;~I=7(R68VK_ z>zqg^TY)HH7WBjU#DN3}Hz!SC*^U9@%=Yc=O*{q%6AzEijc_D?e(U$>6oz^(nim`l$~ z*G&;O8#c=n$;$J3zR+lx37VN@-ehO+_`)^H@|P zuoPrr2|RmpRz_JE?~DvQTUy+#RWy0{;GU@jLDX5Tgv;qVcxG=%LPkag?CYnlj(&)u zVEfbEMHV$=!LYo%@-RQ4si6vC@h?65?9@X1o~i#H8iPSQ$9AmYa-(M^$r=qx^pYv* zP@GJ|8*pJ(;}64mJeG5_TR#oP&_!xq!vJg@A0YFiQY^!0l>uO@q^evx0qmJ+ad>TD2mqV;bXBm`N(1eVqY+J zB~?~Z2(nr_Go78;09Z#HZ_1X8nm%=mD=RB{Df(wveluc5@N!=`|BgcjG61NytgI@4 zc`udaFFh@t=cXM3ns1m@DE8SSmp6@UD_hYF21XnkkR4+y#34Q|R)D^oMwK&s)f|WE z*qCC4N*saC^Da?u`@)r&9VajA*3OQ3);|#(;y8q+w~)8p)PJ2g5i;Z1bB^k7oY#PI zP8^%{kxc9qBS)eCz&U7X_Li|Nq`?<&7lwj5l0RcgL z1tp|SkX*ApE?RtmVdL(#9BG%DSbb~!Ts_f7ceb`*T|vI3)z1K`0&si2pLzlv@RuGyrC1e6F2-gXO{b4!$i|h)^K*&}J<>3mADp<&U596=xq> zm!M7q7Z5OORxl?a6u!x>!N3y)H7A&up(CTlsmJNMUjkgbjV$aT?vee}BKMhIYm?~C zG+<~2TMChJxGKQ!98O1pNso$-ag>QtUNyL74(>o=_Xy$O@pwT%qs4=oeDvsbp4XeK zQ|a}^)C25=0{mx+;eKHWri&T676S2Q2oTLRO@WL1^83!u&a4jCy@iC!?2*5;t!W#( z29e<+1Q;Y#Nf`sz{*8FJm~Gx?N@{8;!L)KE;HZ$$3Frp8T-Y-5G+Xt5$Xrp$2 z4j<0CR5zE(Y}zvc?>Xt&Z|dZE!J3cmTkDQid6Rs{&V(=}S1TOkm9L()EKctB?y9Hh z1`8+70)+{*EVRTu(#>3%+Wv;426Z=g|MFzF#2t*QPBu)7DZPnsq&3=Vs}4G1wn{s~~jFDy-x)nemhgc~(iw>E*3`*K7QxU*Q93Mv}XAa%I! z`EYHm&#k>J{o)Vl=DrHr+EFYn4bPGa@cw?Ew_*I=cSGoFwtl1KAfAbYH3aaU4B4ye z1yQSd_98-xdVd{S^_C%@Arotlt3?PCC(ub!-_>0mXGo^& zaLQtzxs;C7619D-|lIZRZe|cAaO(?AhZLhpHXGJ%GGJh;BJ#P9# zqR{CRq7iLqLENEfQ!-P5c~Rs^eCXsk8Yj&@wY?pg%uO+Sr$+9J#YtU^G1pSyP|c70 zFxhJq^%8+>n!@befwm_XWt=&wm?FcYWaMN#dG+G-nM7T6fmQyR6(A@9P*%#sDA3VS z=Bb*qAZ0Jk%>j~vT2`r5U=crsb`vpcKqWlFZ zgcM?i1dMC|s1N|t)1iu_A{JY^>i`3LuC%Zff`NKRM@JiGzD?}y?RU1jL`8?p5+#X} zBl*rt={o0b9%SWYf!MUPH+;X=t=(BvpD;cn%cV>{n_yj>_ht%Ru+H#HX|W=Tm2$j$ zhJ3n4^M)>q(T-CPN(`kUkLXfeyoCx>SN_z93t-C*w}-ZmI+}Pp=m?J z=su5ByBuv%C|8YDTS{L8?-jqqGhkL!j4m$=kL{_Fgp&^`IVft@Nl>U+vs@-@p(Kqw z9xiTH+Ww;2;X-P(f1~&0S|Ns8YfB}9oHg_OQw5M4!u%7*tlh!tHA@Eighm%nPe&&& zalEZfC+darRxT>6E6!V3O|a`xp^onq&G zB3mEnP^l71O;4k2+L(i`uh(`h;>#$W^Tn5kjSEZLaU!aZ?6g*k@;b8XTc$;suAM!Z zahr>ZNKZuo#G3VXTAez6wH3aAib^_ai#r=T3tJm2OBXM1XXW|S>NWfDPt7<{Yc|aS zrwIp)m|$Ijhrv$%X+rGypRy^|<_XD|$*Re}P1@5&3*lU3eFds`Sm;a+FFPwI>&?qf zCQf&Uql8$oik6a6{+w0gI!yq;IY(s7jEsD2bnJvFQ>T`e+WOWKE4Orvi-3N4MTJW{ zO)Z1MtW{QFa!WJ|aKerS%kkkM%Hhd?=S2MNr+02wRwY7i2g`2FMl-7gitF-vjy?R;8xhiaI zbQUykeq!Sq#*F)ZROjTi3@r<_${Tgp>M&wC6SGseNnV!w%bPi(y zfn*Z(NsLPY;a}tPRdarBHD!iO(i*(AY0$8de2VaH*Rr8P)g(jJ<$kyS z^Zxx}dzn&8Q}wL9^NFT|O!57Y^L06ts+WYIQTHK&eVypP8esqN1UsXvLBdcN)09Co!=X zKCy>^j|uKH2P&&A&S+_+UZ#>el)c^Uw&PLK*!bIgwzQX@=N*jreIDR%*fxi}y=7!* zCC-J=|v+#N>APha0$ zedTp<&{jV8m4iYE2gMj(Ne?P)CWrrLIt2O_zR*3E=N=-O0wPJ5+s#Ua>J#-`v1)0Y zi8-Dv5ca26q+waq0`~De`GQ$_K|B_}qO=+%iuBQhAx}a@O;u4%)%SAFxH+A(XN8}g zJ8X1-e$IkKa2k{lDNa0vU<~k#t1IT;Novs&Hmne#U`(>Wp*_;r;O68e_n#bmOsw>* z^sYaI34LZPI&z_bTXq!YE!_PRJ6uk~Coh6#Sv+rGJjc*EKRhZXzJh>_ihh26+FoA6 zVc8N+>d87*8}<QT9Io=6~5I_%r&t7uQzqMe` zzO<#~CbnO6S#A6bQ<$FjCxLWENl#HvQBze(Z}Pf~A@vD<+o^}73dL3H0cI{MY=w6AlmKE+Om z&Yy8}Hd6uFNDSsP=Iq=&x&JjI)&O%J$X=r&p%NLU>(S$vp5D8)s2-h8>-Q4cI}**= zv22moEXn1G>*TZar(-0niwv07ntK;SKn7xNJUB>0mav3*bT2Q`% z$K!c@UTc60BerO9Yk-~#AbKsTs)Ds7&$8PzU>d4D=|??03aH7FJK?_R6lS|vUc9uh z;<`Ib1b~MifG}sG%v+EgG%Dr!1nOaodoK*8i|l}JHsV8LK$=UE2^BUNU;snK1$LRZ zD*2o=7_$cFF*2DNi zh0Unt@%9!nBr3tUPqQ|sg!)$Beq>r-y?pfe+DZ7V6Bn)TZ%WdhytMQyfplhDa1 z#7GgrQ_xWXp+B?v)3fQlcH{`$6N~FLYQd6{lFVvj-RgLBj*mW9`Gl$!8S;i;awyH^ z0rQc}lKu-ieiQyC{s?KM>U@QAZsNoStp`Cv*Rl#&SUOPR6@Z71u$O+YkwC0=$@92! z7m|(yo+eEkVU$Z&JVh&$gNKElx|%Y?>x9Y((UF2f+q09}pJfmrtO@AnDE=0?s;}ji z9$4eZQ9!2t7kV8A3|JH04w3ug%s<^e*Z*cNNM9$7`5w||(xQjK;dp1~=RN(p$z$5Y z59(I|6ot+gFcHf;5da@AwZF$xcCi!r1RPH>AoSW3|KhYIweQ*c)uvNDXX>vq<8S3+ zSE*(8Wn;2%FaQWf0v3o15A8E<0?z?V$@M6^HP8i*fqdX9?B*_6g*5cL#nr#Pq!-S>fQZJ%cb|@%lNPH<%Tbi3d)mlmgVY;5zt$TTTc5)=PV?!!LP=vn; zLM>W9A@v?Him~;3yUWK{j5tzxCBpHZQ?n&D2BTU$i^zxXk{;7NA9Vt?wS>&iTh=)| zyT0?n@Qhq9R{{UX-VFXAciN?E>g13W2Do0-S83Psba}p|P=+_P*f#k`)j^^#(G+)g zZ=XC=xh%=+93rFVofgem{EF|={v$}DN>Cf-)5LrqYg!f^G;+|>+x`JpJ!kj(->f5S z|7{)lzt__^mP7z2jNm?Y|(GCr?mFO%%m{UJ}BTY~xX|ol* zW)&v#MeCQn2qlgCgzC(fW@7}%Ke(qdeZ=-MpA}NSrY9{OfsT&`G zDFEeQYZh|ol>)Jw20Pdaq}+;b8wNY@33&&68Z9{vW6_IH`NjzP4xkxjK{C?FhFB2k zi2;S$OE9^nYG0j;=F034@vi{L{7O=ud8=V3v`QoJ&>^ibe>}fz8K`n~S+sIX$xnz# zr~UKIJW)%g8Gc%0%*W6Q>&i5A#{O7NatASh5m)c5 zf$g!_6Bq)7T-GDO+yCJ{o>Bh324Z{@7Q=FR3$!l9>lV0M5vv}#^M<4d3m^y9dVc|P zPIutTefW?EX$;ofcUEZBc-GcjoShg`(H<&h+_&dfPp&fch<$SC4p$xkyy39MW%?LG zdpD!IR$=1gwXC_)>U1Yqm!o}>?J#z)gj_`5~x6k4>4|LkIDrU{c-np!7T?G`%frBEQn^2n|jX+lN#MG`L zsK6uim4#(RPYk#VRw)UCQp+Ru?fLO81jlR%cfFzbM`$mm`*p~N@yji!x?x0y(Ei4l zU>r&q%$7aUmQ^c*Q$^O*r*YizRiniKS ztX2P}kLrxZJ2f{SiyZz^z{yM)LUPfC>}G}QIl|zBjK%dgV@(=3@XpgRVXK> zLQ^TFJ`^cRCQ+-@pNPY2|Cl~OCoG?~Az7J(ItQ8j?N9g}=N?Y}*@bNRkWakxfY3Lp zZkvZz2y(>onEL||5vg`jRD`fm-EG15bobpZ^x#&EpN|+n&C%97>Yj<4VyJKk&cfI@ zfpSGe?y|BYhB){>@hdl8?WPjb=i;U5Yg2L%ND(#2%PZFz^IJbQC}yL|Lg|h5w45iV zut#<;fTE%~CI(`+q2MmzWL0NMhPa$aKmkZJ=_jI2gyX2fMfkH)T_rnpoWI~f_-QIjUQCcmfbEVKI?25^9IqBWxjHJf+1YUo~!K0(L3FX4v%X#Zd$p zb-1Zm(c*5BoUlm)SF06uUQF6pj;QRNGLAUXeHVU1^}-Itlaj@wT~9- zWU~qTtRBPU=HN2Gt-BwJih+Y4*3LkHGI#l^9*krU&}f)(U2{Wmqv0kOOkjU*O09@L zY(!oLjZFQov!KMRuTlF z4x1>g=h=Y~4`1upBJXsGCfIoSrX{Z#(SgtXq_f5j(SZjePVRh`TEB?5bbr2PDgL+l zm0qXIamg}PUuh1+uu75_B3R!LHndt1aUvdb8%#x=0KbelQw$_URpV>s;t%))-7v%j z0!%b({{h`}lz)?kq02zp4-@=EGe(V48>D$4!@OfkE3v{}Jww%iNRy+to;{Bd6!0ua ztXS!(Jajby1a80FE%wn;ld!lh=^xsfTE41j=PRn&5E##~z&1PVF%#0oBkYBJJfR~b z^}j5bw1f(O_!e?Jxh2($M3KFU7swQtOR&DT>P~^ha?g$9#bPpz^sQM0MSzCjYIVW% z5ergg;n^s2xiRRHJ#-6Qm#_CIh7rMa4AxkzbQHhq_6u4oXt!V~hhFl|x*_uk|nP&P# zQK0ZM$h4sUW<9v)(bW6bsu$r+wS6yF%Pa(c)Oj;p`5#yU3?idinRxDux)J6!1EL00 zi7`1>MU?GJZ}vh*^ehKsb)a9d_KU0rZg08}E@p4AWp0U?wh1TLxYF|?M82=qQk$a; z?ge&VdM-J1FbSI$p($*qV~O<3;Hv9Zu!?)Nw07FP=Wgt>)#vFq?n z*sG4{M2EY0yAI3m?&_{P5n-`}1ip@gmRv32z+h?DoGM?*G4BJa*Rqv4?$2OE&hQ6}J0D{SbbT z`dqu0APi^=)N{ktP86Ow(Vc#4;JV1K=beCZJcU`(RemVS19t;SRO!=Q;_Yz*QjY2; zNO`tocL8bP>|*6}x8(C>;`)8%WdWYQ9l4aW45Z}c$r-E#163{;{r3IQ_iH6nX_sE? zsG<&Cw_59Dhf03{bez{)SH}bAVy1zOYp1M~;1IA(2IQXxSrHTCk0vO>MAIaLY3PI- z{_EqobYTH%@3Ncc)eW<)hInzcdk59*#nH}LM z-w5rGPtygt3Xz`||00#HA2%(TsM|ZeH7gC(&W~sPHa#6y=g-VpPD##-3fhd{&#PtY zSJ!Ol5T|x{kfijemrH2p*0jkz*u8Y^r-_b1&zVf$ASp?QIy5EH_|gO1#`}DC(^WZk zg+z#|WNv*hg2n=Y*<#iCM*)BE-l3rB$Hwwbd34-#&T=HIbh(sy)oxp34KfEhFw_@ z6(N`9C#0Rx_^3-aJh(VOC~J^s{tR?`Y)xh%UtDwGBVW7|JhF`Umofb1vIx>B5lZXZ=q8`_(pk= zKEIHm1{aG5?^~ylF^zqQa{UE|=E#of3{A(WFS@t|U}2Lt>Pf7ss%C-dLJ2m+$`&h| z(*SkIvjNtSy<>uBS_2z9i2r;E@Ya_p(&bU=tBN^)T+=E%A_H^{^@M8mk_Tw*1DArD z^ZeCXe??c2ZZHog$dmZ~Xl!68S^zp8>*`BF8qW~jo-C}M3@rvK-5;+1ZfY0S^Q&)e zkbb<)*JV-7&1nDU(IwBWIUzL6M!!LDy``(jzvQDB0HhLQjfN6RcVJAYGI!MEfGuP2~Jj4*nBx}ZhU~ zO>808c3JKbXgS90ucC3ea;qS-A2uE|z)(v+hXvrMV>O29vC6thi9?8_6(U>fLV%_?V6ILW<{Cu$dlN`a4X4PJPgDP*nzgVcn8YKFKRDph!S{ z^o@5P;2sKdyBizqs1Ws*k5G6V1xUR+GOrl1vsQi>Nsit8lE}7U2zU|utZ=4O;z}?6 zxJ`oeY8*r{?8CvzqGr3bpL>Yf2G@_ky_>RsjTTXfp9L^0#L2mLZaOlOml#qhGtWbV z)a9ST`%JlQ0MSE#tP9LOZeO;o8KoH*VR*p`HWP?YyY>COoT=wNfkMO&V&3iDw9wNZ zKrep`^^viYFRt=I-L29agGw@%)bOH6S1}AZ_;oEwr(yFNpCIGl+RtLfYsP`*=&-f{iU??On?Vjl$17$aQm3$ zFYY=6+T!5hag~$Ib?Wb0_#BJfR_iLNOdl3aw0w=DM`?AhXO&{urLvha?c|0!Cy7PI z1~>{s;cCIU?D_8-{_8MUEiK$|>AhL|1E^V1z2^z2(uK^W)4CJdP#_| z+4uahve4MSh-S6_)>AI%OqPxQB-xI76H!=KASRj_;48)zDnQG8q}HW~a9n@a@F$-9 z!{h1uX2ION;V6brtC~M1S+wh7Yl)OcjYsl(D#%tcFK+`+oEch1OX7rk9^Kahs(xm0Vv<6zc-VMT!m{(q`Qj4 zRNGYpke-Vu{TTlEz<09|XpG^~Yy%Q$>gr<|G_Z*imqyf#I-=is6hNc$@>~RyqcqjW z|HN?!3#?%PYr~#GEKQMZ*3eWF+SAUUGE;-=n1KYnuHOzaN$Mv?8y190u-e zzG@{VI<6|6MTzNn>Txbg&U=I6_HNb*9O8Qa; ze5OMP=LphWWMzvaQoC{bd(}$r03y8FxzjxxB_L2;tbYWMAgjEK1ULgTwNg?fvM~tjAC(7c zzBQiVj6w1}=cNgd#CAq>esblAtK&_xvOa1Xc;|SY;t7h@vd6T|BJDAYR?2(n=oVB>e#kz+qUthqmFG`9dvBl zwr$%sCf_wDv*+3e`yZ^sTJ==j1xE{kypcYK-=B&0n+b(GB$frv0kar9&`r1B**|kJe?@k6wGVYI zH@3LH1W|J<6;VYD6&V1r$+{%JZ&E(1&k4i7f|`BxdCF#grwvqr-W0wB;Jxl@RuzL@ zlg_O^6(*f@2N$m~x-9Oh;Q2lgtzmvlqGO1}dQXB=rzf`kKPdG2O$R&t~o_)mvI82>;{8Pq)2Kd2R&!OX1ki zFdPG!%^QbY^0Hf80J0JT{4UVh$N5I??da{^;0rRU#FOj42w@J^|Hb8E{{OjLgF53e z7fr~U$24z{;^wzR@jbbi5XPXZT&?Ydk?B@cnSYEN?%s*C)J)?&8WuQejC7wH1}yj# ze$_d2Z|)TB`2sQ@>~Q*b`Y+FyUv`dPuD8pl3A#6ZUPdz_w`9@f*<9QzYo zVl;dyO9s)x`L2eajT{vcOTS`wEI+Va2)@Zhlo|U!CtGcOxN*a#66IRTUVaUSNvqyy zDwftqD0I3r1>dEwWMvZ--l4xiMD}DHfeIN)st*kB!s?H{8<%FnY ztYjpmM1)Is`j3{M4rr!9I%$tcbyX5?qD5Ypa+TJUhE=OUl}*N&TH71cpdV47KRwSM z$iC6p^9Cfpw&`jKvY8jeisVXBj`DE4)u-&Z55IlT~2s>RCrNYf1K9!zIUo=pR;3XK3lq-SSYn1(RjTm00*=1%dmT- zM6{>JtiTEmN4)8Pr$szbnvR7d1wv$VmH4Zq0jYR#jQmDo3&m^9L_$>#)F7tEGB8%a@Gmc)Q#C_LV&9qjfHW>QrAJ; zW^=01V8e9t&4v z>z=u=V8kSnx@_lA}Hlp3S0}yGBy@Y-7PSiAs#$yMgE|CTsPIY z;<&=KMB%DSau@X61aZiaKt808(sor^F6M92$I^QSmV||Z7U2{E0V2%Ee1n6Vl#jp% z>t^3h1;VINUiwfQ5El3Ouw*n&^IZQ4bq6~J9bB`wB~6#723xN()~nPU5v|w~sb)7p z01V7{eu0`qu~Q)Ay3UBQ({$np)}O0n=%L0F{)%IYOL)Ia|g5=_Jh;>p?OOHNL0RKw3^mi zJsXNaKmF=SzOdC9y%TG3`U39v!=r)^wF$D0cyMOl=WxBpos@!mwEv|e#x(+HBJEd& z0d`CAnY%D3B3sDs#-3gW{^l7Go7{tr(q(1BPVM@J)p)^i|GVmZ^c#ZN!?2yV ze3d;k8kTNlfF`Z@b#-PEMSq3FkpB4n73oM*WbEa_JTaolap;)?efM`89n7WE1H^ zYqqPYlJyN8su>;6$d=KSeAhdqmTSYF61@aJ(sc<^sz#!^HqbFRWHGJN-@^0(K91Q> z4xXgO6*)YU?akhtG2DgzM927)GZb##w3l)FQ8gd+W!g4Ep44ie&m|QZ?BemGrgZw94DXHj@z{)3 zZp8s=S_@^bbYBu>diGL?)xA%{gFA23u`d{!d|Tc(sF-WKGIdd@!yCMOw=NOl06oD#drj8KXk zN~_~FyjUW0S;6rc_u?2tcHtN8MhM6CvWlYM+Fp@8W_%pKjzYqfEgBatCatZF8hl{{ z>MKVh4nw3%q@qm%C&F4172c)#&j=$CTZKHHHTSyAFK>teW2M+-8&_;RfQT%TY@=C} zvSm%o8pM&w*aC4{u!YOr5;l!VCw%4QYv)Hc@GoY7TTL*XM@GFTS+bHx?(sIb{rzVq z+KHB8(r6A~Rw=ajKm{l9 znYq^9a-=%X*3_2fSE_~nB8DDK(n}^ zHl?YFVRlJ^jHZRBuC16+knetxy8{W~!KNgK7wdND%rq5CeTXck8p*O-%lX<+opPMV zX|Bia5=WJFBF({FSz9G%x`DwjHHANmZ0(S(gn4GyXu^KNfav2Re2u+)J_32N-0wuY zS>sdonLP6?A4ts>TyISECMK!%bDy^m?Ax5TknQ)F zx6lR5cof;4{8~Rr(V_h+EI>Fv@*hgH;+AfBNIT@u01p7ttM5U~6`En91DKEYMNK>i zb{OD0up8O9AN;dBzV&Eadqw*-;^bZJF&1^~RA;a$Kz4wpUmpIt;H`m0hb*MuquVp3 zs7JLqd@Q$cgA}&&@`NFBelD9c(9-IavV+$Kn{Xp)oN4NA3}TcS?!cMR20zc`*TKh< zs_yM0(1`5W;}z?j#Sr`IW~eXzWU}i(HC+f+@-RxmQdq4^a%&HjdKK3|+vMYcWbh$D zaa8yBSI@?_Z<(%)J)B(EH7jkE4z>3gQo9KiyC1dw7tNu(8#~YVDb9)tCg95l+~rJ8 zKAp}!rqHbPf=<}?ci!=>b@X#!x4pSYvKY8ZOcGa?5<4|m!h zhwza3Az1#b#tvujvVeU(s;ggte+kK!D9r5IB#6S^%OopkGoOd6NtOfa=`k;MdOo2o z^bAZvb54kKwTGc@cNy>;qq*$`*G=wB_S^pAHY_nnaD&dLOAf=I|ASB|#f6jt>~HH0~Yh_H`IkhT@YT8fJ3`dP9QB&+csA@UM&@ck~26GhAEl~x{Xg{bbOR5jN5Ff z>Xz_N_dbwz2;VzM2nA7}@V4i>dm$BKop;9{5QiajQ+LQbLdhBfuj+OU=?hOeWhCzZ z2X^Kfw&Tf-+IOaLfUViU*6qTwWo=KU<}}vJ9S|AjG4{2B3^DWd#Ey;CLDmM%uP3nZ z78>V}s2&LNsxxwT@^T#a@jCt^;&1ZGBL16*=lGvQJO>x&{};MgsWTcw(u&;q{=>pf z?$46S%?-f0lR1q%W~BK3ii?6`9w9B9I1|o~FGNcP)5UvxT&}bF(hr9&S8bLU9?6&5W~d|2p2!!OUM8!TiMqG>nRv%RCham|$g< z_ui4edkXvZ?YUPu67%^?`<(Z-SgFVx6DBF<70S`vw1~r|M*+)%jNYm$d*`1 z28srHm~_m)7%<{tS?G5i#n(A;bsN>!ZQ&kv39NuVx6an-(vv!IGChDw4wpgQOe=2H z5)*cJ`3tjiKX2~!!`pB7wlJ{UFco+1O0Yo-_G+1Mf8gEKd!E=PReX|q{h%M3G~`?h zJ6>NROG#@9pUY&-3w(_f>m4jUV7d?AtEvH<(pLFYVoly0Wgp5B^%nHY4pxO=lyyh5 zNNB+KZ zpdw}9TNkksCe3uu$S?CWOgoq}@fhhwD z-%#63n~`Yp8-wQ!wyO%kK<;l^Xk&4!NKn_5b@(9?eIm7Fn53A;4uli?};|W`8?&n()x`uI9F8yyZ zfj3m1Fwc)0KT(Iis9`I_!v%%6DQ6c*t+TgaMro!qIVC5q$!B>&g3@b=fugm?bjJ79I~0Psu=rNkTQE zS&e;qV#<8TXNZUZxQ?4t7YiPRyt6U{k7}Y-j02bA%tl=Gzc*9%|ARy&JYIO=o)PpKA45=a&)ot{T z0uV{^+asuS5WZLa*x!>}(jwLHQ;Ph7^$=+Yi5?YIw5~6#pO7|l&-yI_QgQTr^8lgr z_du?9gpOH`1TT~;4nh11ft%IdOZ>Kw2H@~m+tA5j(+g;5*Si-Cf zDUeutPaZ1hS&$dm5$_(^r{mw3Y$#wU?ld$b!d^8g1YO=h>@ex*z2ZJSCq`&Bs0iUU zC!z!eKBV|<%MhEwwv9ch4DXV_a=Tk- z>=_e8KDn$+l;TOy#=N3+sKndG9u8EC@Cy;P_* zg}j=esQLhR9CAXc<2k6pHpYp1B-_g2I7eJF@q>A0WIek0nj=4`HQ1iYVk%)j!2=8qf@v?{AHoB;t@#&|aYJ>Mf9wqP$L zcm*{)GrM^llj^&}nwJY95`NC0!iKLP`&}jceR0YJnkKbwz~{t z*a#w1N)4px?0|blPb^Iq48$@CWs=8!{^gxhmuAicpKkn`5P^b==oOJ#-&%`~Cl4=o zp+}5tsSX8uhg9H}9FSdWlw)s{*Ua+;oG1*;C~B|niEei@7SY=+ATzwDB`rP}zHkfW z-9$0&XNRRi&83X?y!9-jzQuq{yL#LIqvc(NHTdhcRME7SA802tw8cvqOO~shYt#`K zpKT2Fv~=!vS!brltW=+!Ge1=uQDrXfb0@fFpc^i((aS+aqo7s^Br}FTQrhJn~cI~GbD07i;LTBYS3#lF_ej9$-Z8DsL zY!3W^-rV|jRxX}=lit}3`x&fl%DDYN5Qop9(ZAm)yUt6m7PVlsx@L+5PXBrfV>hxD zOgImAw|Yr@0ny}Z)l?GcAb;C@r}uE0N;qdecf$PBG2O!8!yf!4QdJjg-Hy>$?y*w- z1k@xJ(|jN88hI1LdxfL%I$^6b4BoL%=e@Z6(Fg=WTr?$WN2^f0n zn=POOIsCa0!VR0Ih`Vy|0j{Kw{LD1Xq9i$&SJn>C8<-`iHqOsChRI?v^*!S!(p(oL zZ@^f;XNQ*l6+3J69`uq|v!$l&)L`pCWe`8iSX-ZCY5!YE5F|2cclETFe$UP)tm6%m zdF0p3#9w4pf0*Iz4pTob@?1#OnRni7i%3}-zH6Oc@`BeHgYVo@AV1ZPUb7{PyS3}w zqa`}fl%dhdr>f&$Gts@PDDP;Il}SC$*c%cBj%k&#*)-XRKYDf>&7e{u1?Bvryjo zF4Cxnnx}XhhS?dOm^f=j5+ey?q=Q=dt{`);q0!{_rtmAC){9 z^I#sjSYEmH=Ih7)NST*FHI|am&1~*v2VcoIKBP-gegYeo%~-!GbiK!BAS23b^l{Prtv>SGhHhX z_%FCWa4+nDZ8(B5X=wxAP_EZ!Ic5xqbXh7j`}|o&szjTLYw*%>0!(kE*PJdeCun{; zCcQ47X~eIL?{Ayu*JFZI10OvGZ8|A3@7G$rt%o*Ebow>gwaoF@b%Cwqxi4$AuZAn@ zv0|oIhh%|%wbbjk^R|@X+OJphiqUOVRqg|bQs;%0T4(7(ldtQfrCP5P{H6!Z`({Kh zkA14SS-7=DH*=fo`xTFKOqc%Z%sKP+AFSUt{nP+0W+oZXx{8~o+0{Rz%tEUxkKy!( zVZQJ0fN2Fi$k*{$kehlxJ4Q z8+@->m2{B?QBP>F_~F2_XRRVchee8})K}zXk5?w?BL?dJm5OmC(oHj%%b_9IU(kph zdz_5Mys&MuVJoBy9#Tyh+xEmKQlv*_DQZmL(b_CN=RvB07tT=LX>;vr zMWh~?@0HX^Hh>Or7lmJnBQG1LnYms`eGb6jdwU6tzOs#fTHJD{3L~DPmN<2gJFYRm z?6Nct`xun##U^go)^DV;<4`=;d5}S92}IU#q?{>z)P}NccVZ<)Ck+OkrieAyPE8Yp zj2p_8V3Nt)F#6c=wEtRoW;$_XUBj)8v3K;aTf((iI!{^TL~vNtfA;U7&gf&36w-9{ zF+SkWz{rHSy{F&H7cpxg*R0bWo7r5KqeKWrqKbxx2^9nFn~F6qevE)q#)2yr8gs7= zgj+Opj*_XfYDi<{R2>n=<_%Kv;~IXk)ZC>N9aKk)~KrFhjl{;zK&tVkKJa#?uui z0t7blBlI$Yaq?H)qi#*bDb*)zIC?vn!{$NED;YtT%gtViwn(KiZ=* zNY5x?j>tQ^LR`aAWhtQ{i^#_moed?Eg_$OKXc`dool=A=NVCX9JQ zsLvOyDTzeVA6bm0|I4PZHb~yEf??^`8at2*{5ySa4c%$FhDg4{A2#QUjtup$0LXH_ zo<~tO;5s#SI-<-UPetAP->SN1?n|Y+bP0`N;1VfY!Gy%bHM?O}K!`d_1d^>QDX-(v zg(k@qtSYFVc1AA3G>aE2*RcOyVlnGx&q<$1h!VCWBiG0mk@;=HrQleV$hKo<>6AS* za=^fIToN2kGLNYH5&!%cl)ZlCZ_9(fFU|qMlICN-;>~^t%=~C}h{4QnyF*sXq0W6#;)`5QBi)S`k7H={NLm$If23v_o) zvGdlsOMH!rkOcv+z6x$)lO^hI&ZF24{uO6>-ZO27V&Tv@ezL<|(9^0^2FNBy< z-jp$=W!&>A|%BhEvC_64}_QZzj96n=bi zHJbBqg9yW3P4uk<=QoYRCD6KIF!5k2VMJhDu(w}89PdogR7;;yk`0iYy>DuG2u@s& zg&drlshfsUB60IPC7P&tzT%8ZT`_?g8qIXY)9MARbz}6KdG@XR;@r)aV;~56t|dt` zF-%;B&4!y0$C@I_>^W7lyqcq8(KD71r*S%DHckqBpQ5*qxG*#O%jDpMr;eIgojbgejJ z(lsQIB>hmf6YOkUUzKB$?$jn(iD3zYj;@9lZ`ALy(Bj6Kz2q7)6h=ShVAO5Vh$YCw zGVaZ|`ASZ_CTV;9p?} zb~{bPJSg4M4GknwIFE;1SK|7B3vTQyu=|lH!s<%Iw{d5OzG}yN68gEd26=}ZU5xa0 zZa=%s#(Ja#iXV=ZZslRpMW$TgxJeQr!4evo0XFCXAkJ*5+c_baVEH0eCfeYIb&Zk+ zu3&NMkAii<>cE806kv#xHXdU&5`)!3?a1&1Vr@gZnbD)f`~B?{W4an;2#KIOjJdA9 zb;j09FDx?vY|4p~tv6=&6x&Q1_tqlh@)%Pi@2-Ngr}hw2p7>&1jj$Mx44ttI`U6;+m3CBNGOvel z+mCL%qUpV*>Iyp|;q{Lc#rh)JD(|^q{f&R~`wPVfb%H_5`L)0_J*4~Prn(vo4}S6h zR&MmK2N$z@Fo%xIY=LxS3>q8j@s4z)+U{%-3=@WLLtWlM8H@L!@2(W~*gKn5FfoQ1 zoxdK8%PI*;I2m~p&MhIWejCiW6tma!wG489kNv`XqN8TXYr)5tt+!!a4M22p8MWU& zTBTFQk`8ge`zXX4d_I+hid1Tcb=e26G$hc#tM#|zsog!Ol_}T?bKuTHJ(Qx?;*x*T ze5j{RfQLwo0I+pAjzEgL9Ck*!LMFq_W_j>A&Yg8T{sRPIg_BXl{|An?_{CagP4e$8xXnRF>mKV0Xb~X@}|=Amz&=|j4ArD6W<2@truSX*wl6DcG9JVYdvRgbP4RHH>)YsG;)+r03o9s)>0;PSvS`pDCZr2NUZ2#WD_b`TCZWP|sj;t@kn zN2K5U&}XEjF&{>&+;7K&z3qAPP=QYr-234jF6C_Ga>>#Fj(@WO(%n{yG!_VH)yN4tw&p6pXk85pBj5-OlDYG{?hte0R6? zhQ4P73>N19NSRma^2DCEAz$6od_XSk%Ai4G(Swiz&*>dF z3&C7#ODF1VQ2Pp?9rqH6jm~*E0t|IfMt6C;v16X@hQ$n2--;RXTch~(MLN7bv*|zh zKEJ2W?isr2eZSTLvu8MJ3#kV8ha!j?<0$^4b=nTPXf4|;{u zw^gazZ|D59sUlx*Mio-ss)`=6hy!N1L;mBrEpW2mS##X9Ipa|6QCM@;kow+tD2_JZ zmv=w6t9L7VzGYFq+vAFc^y}}h$Jj^~qT4}ogr27bFx4VtoTgUZj1c*j1RvScZ%i+r zGu}}HU%TJQ{NF9Qc5wZNz7vbLWpmft3{&stNVH#H*M~W&+wvpi$S%=LNRR0@f~~i( z)9DI5C@&+j+E1hdFC)zYQPT=oJ4MvIED=S6(^Qf0q9=yww9?=p<9R`&w9`pdFTtfE zTTATFliJOI_!6%jkpWObhS@sHBx#T*4HnTlZuNr)7kQ@vWLfCZLK<`- zri**-*b!ACx^^5A3?qZd^3B=C*VFYiHC`#=akQ>#pY-*L0MYo3Ftrl{ z1TJ#ctM;b?pc=MVJnx$=qZn!F$opL2_7q~gUx; z3++D!eUh~-y}W|#rxD-wO;iO;hv_9P%<#&Te~s~R!!c=}GnEszMbN1Gp7GKz_!-2_ z5;+9FK>9&+Tba9iSQr9Rs{?emhcv*BqhM)AR|0C7lhidd#ZuN0PTsMj;}Dc0;a zBdO4qNJ)^ijC5$Zd({Z{bb_DGy!7)2Lqa`N<@5bow8{|AW<(Dt36FWZ2ROSylftPWXBVn zaDt@b!S5jYqerKNU8<)TM-X}RZma{Y7^1u*cZ=nrTvam_v`qMh*50>>5(}@b=M4JPR z`mCDFw_lqnL>*9WXZ1W=0cp`VOuOMRLyCfA^R<|?h+6 zBZ~7^?x#Xs7jbd?L1-92l665Qc)g_XAA z!%#+PT%#o>3ozby-My`Up`a`!>wD#Nj)NoQ${cEpK0txLpi^%B4(sPA*N{|dURf7= z2cn#`*On-ej0}EUXz|td1l3KpGhrT%G39XIDsed_3bUJ{GtY%=ik$Vps_nRxK#0pN z7vas!ng6}oS9&C2(*b1Rfpiwq2mCJx?}Am9qCP_l%WE)HZ6GNfX#~L9xHT-y-paPO ziLHWEZvhY7qL@^p0x2{{)%r|4EmG6|57WbXu4gYD6@V>WsEQ?JmhPUo^qR%&5S#uN zZ~X!h*JxdziXM{*NPQu@9N&f4k%adri6u)LVU40=q)tcc>m zYHHp3AXXIq{x?!atX1`&F`^tnNqm^I6=0jMRfv#vMMq5~OqqyIfDkymBxiM&EuDwI zJFAY_nMs5f+J|Xt2Sq^D5nnej!{|xhvKUO%)FDvpb~=awu){lxYCo<`{eEfPKLD~G zRq9<*TB;Zu36x5-3A4wGQl1GU-ix^sLZDgib*zX|WcjyYLRL$Y)=~eN5Y17KLmQ@Q z(>kL{zHZ%#sh|xw$c`KsuR=GzX8Ac{n{O!5Gne)_vLg`YFAD)FuQhfGS>gpOIL!`~rSXg)Ih0S9VJyjN&aLfPS%In+_s)+`xC8pk3U8Zip+o$7m^YDCp8rA2Uj8!Nu!s{F0(n zQY(5u3{fROk!4f5L-N4r&LM=c0m>rd)bg|`Q0-VVoOAtkw|#E=o?HW)hqu7m&&9@f zZnfyigj=y>nwEo%MsVhR>nRx0>E4?BikdP-s$(uDhf}+HpAH|A9%Qe~xuTYX@3QE!5 z)udXUP{)?jEWYwGMHQEiN+$BM!R{&+g^y=h+Wy}EQvvy_*ta+mJz?hAsGgGo<{xtW zqHeZ!S(~S08#gP=SMWaJU+fS1za>R^Dszhm`9VX% zui^I@Bb@pbY)si!e_+2VdG|uy8@BleH@#RmmYjUIr!8wEhd~JlA|-fPRyg_Uy=*(? z@h|r9f&AsvGk8meGEZA|limO5Z8tvZXEd>^dt*+!gqlHiB*#uh!q%M6NwqyI z_xkukI`3|Q8ssh+dfPD1v`DK_AVA8i5*~+>{6m571%sBoMh|Set#v;o@5aw(&^E|| zt@YqDuQ@9l>S16oG6|#dNMrMVFD4d+$>*0_4==>c=SWbt# zU(%Y0##-$OETr~yp@F{syJCtdZMOl3 zJKLg@s2H_sFOawK^2@n$pYr!KQ_T2bvIe0qP5kSV3@`QAvOby#yfUbxVT4=kkgBAv z{FBN}OPdKu$`MO7VL(7cXOm{v*yk-ZK5CV12vgaR(`L`2xG?&93?I6EIW=_P_Eoqb zCP@{z91(CXIr8P&T#e(Kb5^}wmLJzm$okWLjmz7~g@h847!p-X^1spzwI(_H<)US{u2Bo}DSKO2nZO{`! zM4&w%Pv|bxzXP9t=4AA|%+3y;9=2|Oe_!HxTPs6rXk@$1XmLoy)@h3)_}0q|XR_P| zzVS2Ga^d@wx$<@UPo9VeP6~4b{PJZ&DdxlTpH%pj6FCpv{plm-kL>j?P;2a;(zO`u zU*AKox5I_GfP9at5&II+&%I5Zp|$L^^rpc}Dg#7bGfiE@zQ4IJ+|@WB5BpaOmDEgb z35L8t)#Z%Wk6JyZo{J)X@|FPw2m_d;PoB5I7pPJvm<*2T`e@4M{2Dqr^bYuHzngnw zS=vu<*-AQj6H(ZiOYj45o&EJS7xKyljK~X9ZuZD3f%6YBY(SCbZI1-E zFIdrS)O6o5kOpVpRIyL@%>thUfz>x9|LqI)KT$ZCIk^7gN>iyL6?@K((luQ@Lr~Kv zr|TDj2ucb%K_|H#z~#KIPCrUi{Q6T*5UXn$Nyv^4g>YtgL!e*d^G2zvC2&jtnXJ^@jG!XXU9iF__VUJZ2P ze|^LAcf0Ez98b$t6-{>+YjL;BeoyPNvD|lmXCy7%8Baj~Z{qL3vfEo%54+qybPYzwR z9BY0oig@MI%`K3&y`0h=kID-Wrm9{_Le-w2rYeoFSWJhH2gl$9>`wWk1Q~qMG;eFz z3qU~^l~~{v-LwuK$BwKaTbU4XF|nA~>`g(9y4T)>Qs{BRvo~AF3n5^Z=8J-*LC`?N zHP5`fN-7U4$TT}_wKmk4O7_Lj07f{wzui}2IDKFR;uPInN@P`y?AIY!fPwmIiNJ8hY zQF6KUz@QCo-N)|utYf~aahY-lO%kZ6$$j~^0fBBrR5$?(pOf<*>NQZh2c^-}DH)Ly zr3RD2qIyIn15-}M`b_P<&Q)VMj6iBUh^%ifmwU7bK#&*+1cj*%r%yndZWSyEZc&9x}xTv^7_zwTp$$`G<(mCm3M)-tUf@hv2X4M?pVWpr*|hbUq|FR5c`fo2K<9${MF#cGGenzuT{FP>wlyO8>me% zw7vWG=#64~BhNVr@YB0hqePWcHt6%^TM!G`6QnTMQ2PsV4r7$(B1RqnQuT6Lmlk0h zQ5e1`4CZOUVfdvUa?H)4n3ppeq8AXAw;pZ^O6f`T(DccEs%+xy*ooKXoZPbKD7{im z9Yx;bz!b3E%M@^|JGR{L+<8Y#rYIqQP|rt*?wE!lE&l0w1S{3HTnn)iL>&0nN++Wv z)EN@xajQ#8uMx#pnk%zKuMl{Uc_#BR%Suo~zDfF(oJbC_(Qxn}V+8edd>-jDKQd)5 z_!+@N>d2i$WI5W*TU2?9wGBc+RO$v{5uv|=j<)E1XVP==T3J61Z7#v~L7#R*$MUyH z!`l!%S;F|NOW5_2MDE%VoqAu{$>K?-@H_Y!$3x*-+|Fu-b5&sqyTLQfx-y2OcpRjR zJW&_lqJf(zu)P&dxQD+B&(f+IUb2lTRiZ+Tq@zUw?jA(RIn!=o(eGLpC^;>z3wMX8 zUL;6paRN~=u6o(A7B4i&sEx}rm0HIs2ZnouC~#}=C|p(h zqC150K9IT%o-x+1LsffW$8keKt7tI=bM|B_iockL5z+u9{5vyC;askb^3aiFw^9}M zx;OGLyHM>gQ68E{4F%RGoFsR=T*(Oiyu21FP#{2Iah-;a$b51&$ldczJw~)v^&3Af zWsYBRA<8}Rgrli@{2Lf6ZFHJge5EX#nx-vR(#;_wU79VDxaOWNpZpqrddOx1Pi#^_ zU$liK(G=W(5AUIR1J;8meP2UO zD`P3TiW+)p3VWq^5`|&Bh~c{bNWb(y3NWW^lkydnawi0Io?x=$k%R1+Q!E-2zb6M1 z+FsR!@{WynT)Y|pl?F462(lb!_0X&$#=wzb(y2ms+UR5?3jIp^cN*rDN{-S78$ww} zK-wemZ-zQ@?s21TgClGL?WVfmkT56YHGEhcbPZNQtsURlIZoi^;8~Le)=LdPG+fL^;0pC7K6XK;%t@C(S#ecT7k%ny$+#70v?0^h5y<==&vSjCj%hG znlKIy`MX)^&cqJUa1m_n-=IL{)J)clEX$#V&bbH>WzBZ79LsL321H)=C0h^@22{iB zS;DCIP^51S2XX7gd=U@)hf?4`-AsQmN!!92{nK+E9umvrT<-C#)UFF2PwjA94PG#* z{tAU&s})<Lh{pin`9FP*z@_Z@?*-58*$b`y+;g$fI5!eF4wcrUeLTijZ9Qe@iEvN?q`&k?6}Z~oPz$(vq8M;+kyMOc zE9*_B`D9?odLR@QH-w0Q{x7CifLjR#2iP3IRcLw~YR}_?$T<8itdS?fnjg-}9$wnK z>*YElX~I>Nx!fK3@Qwbi3gIw(X~R3r%~o8jExT3OOvKHwKc@Pt;asil;5Ybp?pYui z*&E^2)?X38kEwO=c9;9L6NAxs%G{&w88y=Gnntw@w`;}@d#yaBm&D|Lb|fsUcbu>u z40)BDj-UMI4?74Pt7H*p-~{rz7@1a>)Y8#5&tEeAh0WueEZsMGw16gGj@QL-u_2^b z(s~JuTE4UDyz5d_NLP$?evNJ3CKGufbS(p?4cIq6GHzWNLi9u=%*sy3oZ^?&(Cx{s z42be7b-s^W(K^opp??w!<^@)lj_(U;2KSI}!b1`%l-B5*?>@wa zIn1CzaBAJBOZk^s8g!m^Xno)ht(&PEwf^hV9Zk1#9E)o&ZzFPWY#2<>%vM6aO1EE& zi&s_JinSE<@n8QtXN59$h+K1Zy1jex9h{(@qJ_(*7j;mtR$>BhEYqp_zAuSHwl)9z z6|CyR`bARubieHT3CiR=>;K=x^8ZG);bi%b9zdhcxcx=T|6AtO?r)atIT7=d^}B$$ zr60+=w4WrePgC;|AT5ueDcIRl^Cd?JM84=c zFn`huIIwp&54Gi&KJay4}FVEp3bvO&RB&+cW>Ta=G!7axyF(E zs_1;;FQ@3pEP(oM2C1%JZeM@5U>)Y`Iwt|uP-F|5{U!3B{J$E&p8VZc)VILyE7AQA z*JeAJn(w=Vmiv$At3&)*TiDAx0p|XOap%zXx6|wKVKc)CIZ9*DPPhkr-6F9vuCqGg zh?weCa!>Kk&?^m4l96DI78N4}eL-6=h>j^8P895%=o;S`K@hfqwW@|bUFU2{h?q`7 z6S7Aw9g+{_1+QacazolAXm+K$sQsaiNotE5s~~n7-rQByuUp@O;;V!KbYGT5#zLKX zql7r~x%p4oJFtu_^vnunQ4+_+NMpvGaqOc2VZD+i0e zaHO6%6H3Sx*X&Jw3)>-u@~ls{42#EcT2%^S20b>foEn4 za{Q(nY7K@hB=6WAJ+#;M6CDi9yJWi=$22IM;F+i6SMXoh%-Q$#4>ulTj zcXdMtv@2910*LJDBKB5!R#t&9hB~5QMe%51=`#y9Ob0L`GmS}~<-7B!96YY=kmZH7 z$fA8IhN-PEEJjd4expO78k-l+SQM{fvdtgtfzYB5uNlw&q0o6IB#9Wg?bKVuylZ0i zxRoa!?Nzfw_(LfqdnnB$g%s^)5^Of+P0<<9!UDv2fTa!hlV8jiY-du)4vd z9B{O9-qRC*HCw0+;4Cm|<qLgF&>l!j0K6ks~@Dz$1^IPccvZJ%A+{JDO8ris=QhMOd!f2_S-?n zXFKZ(GZRyAFJK($CSvOGTxNW^?T=`kzxo8gyI=7W`?;O!qBQOXdKRAbeJv0`NA!y$ z%;1sIN_J|$s*~a668A+g(^^C_GMmRX{l9aID;NQir^)jP-ujwoMY$ThY+M&;E;*3; z$8QGadd}o!6=1G}BOQ_<9a>$FxXtgj#pKa(v)W!LhRttIU6~pvYyO|ne{hQn^m@bU|8h; zGz>sbYSXUNDhK;~+NPE*PXP5E9^L83MJre#^zz?@ErK80eU{?Sa4lhEg!;GA#ZR?$ z-4v5u6&J1!uE;I{!Udl{{G=zhDZYtZ)}^$WOlT9`nKp2h^P1{Nak&`CiwU zgA2AQIP4_eM|3VT0yy1DJ#G^h%xU1|>e?_}I&o^|ePuqwikw`v2m0X8miJ8*bz4yG zI-#go#xa3mjr$!iPiBev!UlCR}R|G1i8#oS6af!#K`J!1h zWoNmtOoJRRlo=9dHg_?~cws>T-dQ&ZH0l27U+RsihX*s%W!pUyjR1p&BD8-k?u1ES zlQHPSfaT&5Am#}2a_t=1AHAn&kfJ4!fXzSFsGI+@e)Fd7hc;RD;$vqd#7f;726^3i zqW#!N4F#O+RC-&ia)r3l83a?dLyDiA<8%rLRG66DAKShZhN^}jp>bs;%ImOIutaJz z6lZWcO?q3TQl%}?oTlWYkCmCxbuCg~iMo0Bi5gPYfg&d(piuoDa9E7?ISROR3DHyF zl*|{mLVJ{((|!(Msgmd~jagw)C1f^9RNPl%!w}e^v+Mk0yPz5g*A**=j>XGD?8bR8 ze>V|{*nY3Y{W>lYg71Zl89!6J0 zfFi37{zM7ht0V##%yE_!$aCP?mF(u$f%!JA9zsM%PySbDxq6#3Elw=$74eyNk+{TM zOHRMtI_J9DOf7z^=44rb&9pv60B>x}=#4+Mm}oZ$J41#+l30P=K}`bdMb#4dDme8c z=eNE`7@2%T_ZmZkzN>5` zcU9@*-xF;5`mS1&Wb;gIc#+{NR#-hmD}sJxyi+Re94qtvOP@d`{5tV4THzLLr)Hiy zUwM0KM*3cYi<1LQzXe+9Eati^MY@2p)f2)2m@& zvoN_}IQ^y7iqzhkAXaoYtUljc>d;&g?&Nd=dqMJqrPJp0_6FqcUh8K5r5b4YzRqYR zBZ-qby|rl7j)N2S3!CM2^?J8|?@3D@*ogKmuVhZER`0Y1S+cCB=xO$pj=UX*L1-8#!6C~-{ z{CqzzM=l^78SnwKbG`S-3ql7iP739p1$Zi6!M}VCo`q6Ge;#bqDxW_tMbeSCkNK!q z@QJs69UFF_(O|cKKObJF=IGAGAyBSCLrE1Q*}+@9YsFe>%98)V;3y?u-4@TGm6J(& zxbJMzJG-@%sPC&}Zk?j;NyazJOLf)O$~QPFgbfVlAa!wtcFR2?Jg8Xxlr2ONDL$`^ zEu+ghl;E9?BJ^}CZqTlk+?36%*N-@>B2xYD$yO{47HAaErv#6}M64E71w7?5q!cnu zc;Ik2%Rm*&w4pfQNGf(N{zcEF2Ho8N^&D?0^SVw0mOF^kGtk$F7VTMFEkQ}0bZu7k zsB3MtuqzEK0Z*6RU!m)n@g-TH&Gm+lOX7`q!TM7$XT7T>WcABg!{Sgq7g7wHrErKL zV1ts&&4XDBDxeSIyAAYHt!lb}@dET3o2nT;Hiz&4=9Sy#L6!wK+!1>@&w4JJGflGx zPyM8kDpN)Mjg5K41>dy?r*% z2NK{Wh+3Ps;FiSqwJZiw+I}(IN4DzXZn&S)1@i&CGZ0+Jl%9@W!M1J!O?)-eb`@?X z6V?^`OYBnm9N{faG#RX=+m+r)lE>M|UL~WH%3=aZ0>EMqb zg;U8>+NsiOP)m7GHMdx~>oSq8*MO!*biNK?{@qL|Z8vmi(JTpT6q;xVT2|ivXgef4 zWhwjGKqZ5nZ1dGgUCBDLv969coyU(obuJy#^aL05V!Um0;+S)*!WixNm|$TZu#s^Y z?NHWrSq0k``-GQcN6<0RX>XnCRBf&$_>!;-s_GIf;7kGE&^95W^57})<%WUfD{QMH z)Qt^;ncyC)6G8S(;ua6eQ&LbPiVq^h(l}q!b87gz=0=2&Nf=wGRr(}cM<1|d$^?Kb zhMnJ-Wp&fo??G(kjXzWXr&@(6&J_Xtu0UgDX>|)5o90o?2{QG8f(IC^=3b}wfG{qo z@r>1~b_WNegMQ5Fu4dyZuUSH#!w50Sjj@ko(=8=^+{-9UA7P=ZY((A&%nCu<6L;8e zxayRy@fgW-Ezb$Z%~Xq0!?;-pBN$rZQoLdHG#de01Ilg~8j+Qxg5;vWi+SiY3pHE1tUma`c*^5SX9U%o6=cheKZ zyHBH?IgJ4x(?RNzT>B2T?Et2&+P-r?H8db~@3sdiB9Da@6d#Q(N0zxql3j(uq^M4i zTbqd4f|S?tToGCd4GwKV{-DS7jcaqAlS&z|j8b)>f!H!f(vT1hOX$!L0UfggA1FR; zm#D9QKkI6+E%Q0Ef=iNM+bTi2=n#`+l){-Xp^4phGM*}F>&SaEDpQGlE6o7lET7nw zcfl5dTW+9RMO8rCZhEoIO9c8=` zGl7yZeRzsMMKh8iUnYZrpFS7I`^qzi1|oC+*2Oz@jPGO#@(`9|F_eDf!#D)5VnqHR zruPolyvMxaQo{+vjkPTK@*m2KkqSG`It`DyL+bZTcW55}ijBaL-sPYi(J9b9*OHSr zG_A=f;nXcfQmemEKrRv`h84VqmH3ScHhK3qiUf>{sDyTZw%N2qWAHB7563ub-Wzzu z=@&MGw)jxl4}d$3?L{AC45jFlighfRCwNrs%5!klZA5xMPLNr4F$E4j$fSKzp{_5A zl%x6tEuLIAL-3VECz-ev1FgI$d!(!|q;cDCA)r{d)GQVPy)GR)3h4Y8)r4$rO%P(w zDB+W8!2g!bB&|5W^O#CS)ZzAzOJcW{nx{}!Yk6iQ^)KD;Z>Zebhcf8oofljKxfjx9 zS!=W6vO(i;GPcP(9OCM#!XYZ9LDBsz_;0n7$OqwSpi zk#T>W2%@(U!7_v!`qt^p*As8ifNlEY4Mpri?`RhH-lC3>uxv|?=+sfW?((esiHkF6 z9_K6=rq}Hxuj>>jnz)^sH}02=0TCZLC=9nntEQ|=S+ zs(a}2y>sN{eoCV2^sc>n(#NGEm4iW|gzIj#Np1jn=Xt?uNRYq@U

fydaIF^D|8!OB>dB3raKmE!yPnxP+q zGRm~>a||E!JWr;~!#z@uNs42HUWu!|#$35ZC<*s{$q^^|H61KVyP4x?bGWlAB<7L* z6Kn0N(^yg_VJtzQ3H^_6Cj7uSTex1Y&&usGv}S0cLCf1z&2fMpF8Yi|iUwk-3gJs^?&+ z{>gz4)`2PebIYA@KaYAFBtMoy#>f6)$K(m=XXt$Dy_w?Nqkuvu zIM45gkT@G8D^95K+6Ryme+4Bf$hZqiv;mnRn;-52EAo-IsoR4_-@67Pj9;~#o2Y8x zsy$5HaMV@w67~QP?jQ&1*diO*KHJp?QFpP05JC~UK^z#RH#pyWaofKXgt!CK9$D&f z`-0C)LD^Jwn(!?>qk^n-smrnZX6bV>ey)ODSZ66Qql$#3)!4>q- zZ^`J#KAy5sB4FTq7fh5y8a9C6L5W;mJv!6G`YKOO(e$Twg&a8DwkZ{==Us<@uKG;a zsiH*>gL*b(tm(e#(H`~^$L{#`{HWh`_2wJ@(hG}Mbk4P{k|UB>$0E!9m8-4K7QZVe z-GmOstmCW{-|+rWh?$uQy-5)t7)8YbxqEoiP*v(Cdu|%W_P{V_C*my)QI}Cw^2}&$ zTq_|A-lkvf?TNG6p2YQLalv_+N80l7#tf;aw)*ivwE~sg}yUhNa^u7(Ta)-pjW3>z*|jjyu$iO(QL5E6a;I z)wC?8oUHsE$L_sWc4}RIl4~f|Httw!3VSZ^*@j=8AsB|ks)LKKh1?f-m91%Al26BR z!)D0fV@MSZnRn(K{^G2rrxhvhr(_`IKW4Y1sOc1Zbg6YV_IzEj&egE}J|{^b#?(eV z|Igq^|30BIcG+F(x_#!4I`u}#e=+T;s{rnHc zPw@bBADKw4!5=Raunp8h^U;OEV@&GsPvg)1_@Ig?7M^$*&ZUVQ=#Q}ZE*g)+lQ@3( z1f`|?85p^Yax>5zJbr9*KeW65-Oakx^V9bIFzNNr41}_OZ_ur!mlJ)5K7-8e{c`_# zEJbebQnE(C^ZQ4T^4>ai_8i5j{f8h$1?BC9R}{(*txyn$J?v8fkm@W& zC2dJRYy;o+NhKKEfzW?s>RCN)uv6cZ;5omncPzFH79oOKKLcm<->P-c#PAjczAxDG9F~q`_U@CAVcZNixAWJC(L$Cc2oIQIY*fab>=R z)lCzq11q#n+osdp8oln8j=RMEoi?(|I*vC*hjuq*d@qT;UZ@HF6rO z5J4(~9mmnLQC95YSJp%WhpVoB+(yI4FUZOO2)L~ncrrs$0lRn_+Igzd6hKb=77p*v zXqr9=Vs!FsH08x-Dwv9Gww#5Y2;xH4+Uf>zrI#Z1IVz|_fLEs(0<-{O1ND+c&s)CE z1bYM@5&En(2ZUSTluK=X@{LKeF8$EGii59cO#;d%(NqP{_3j0Z*6CoGVSbKqn@?Sl ziG{hO${^&xOo6p9?pLcJIt%Ss8aEzel^wSzk?H@IQp2)Y<6g*Ja!TsG{NmQDnX*Zi z`IYM&b<@s{fo_j>_G5A1rFEa<>MrBEv&=1;2?DTaqI%*L5B5FWLcc9ap3qvCW277v zq~oT$Am*0X^94>|CC(@;>we%ayd$;Yrt)y6(VVrMsrO)c&w6mva{ioP52y@_<%(&C zGTFNp#iR%F_C&l%<=JLL9gNa`^@jkV$om?s!bn9)Cz%mE)DR0kRFhE1fZguO9?Awm3;_&*b_LR2tIQN5I4(=k-{o9FVh~;f>s1uwzN>LFyQGY z+$!H#F?N!69M4O{FS@LDjRQc#>%2b#=Muc-H1)z79bT^H&~U-Ly<^`6uv+|%VtYd+%m%0)7P>k{ zkjD}hXl%@Ne4Wja>U?jyHVcp_G}T^*^D&5MbVk&8+0isOF{gFSn#~EYzM@po6*-Nf zGvN=uVF`K|CX2W@GjKWu7*dE0Run1}0gbO{8w75FHWh}f$H#On(?Z;P0Tc8nDz(a5 zAI>h*P{}Q^kF~ZZd;!N3yY9Aeb4QPR!9l|+n}FmYta5>*dg6jD&?;D^Qjtg~(j44@ z^8hjlg#dI{?AQ1bg7(Ee!o& zTH=PoPtO2^44lD%Q~wvlmF6ZGe5QnwF2kfHoHhZtOhv+xRoevk6-0;p8I{-w7u=*T zjG#i>X>C(seTF2q6XhL+3kJBb_pq*IdIbIGkQWnr9~agDei=FB{px8<_4FF|Q=R+7 zsOJ+_@jM@l{iZfc#am_^**w&fHA0`Me@uFP`vi6EQq5#&Wfg@(D=XUxTnZ|3S&Up? z{&Bcw>x>SH(et-HIxWRG0C!E1geNEC}eVn-{j zaBpl_f(XDYm4+wfq9FnrXi>ZPYDEoCxGrWF8|>H-deZZqm6f7V54Jd<8@ls6ZGiMO zF;kPQmx&?3)2GQvXbl$#;9W{vC-Cla${D5%Ue?cCXFy(!n-9|n85)k$lwW+igtS{| zDU#hP;N7ccC^5HD;xi)SkFIak^777SkP`AC9cn&gCd>L$D)7gy z5cizPSE!g?BmoBlvYlQ0!8V3Xg@*Q46E)&3+Dl?EVxZb;F9uhlW(hAM-FLt*V7cD2 z2!&PzK&Cp5*c^Oen@*0Ne`@QACKo-SXpdc)K9AN+y7jQR9)*llWPVP5V8FdAiDKs( zCmw5vPobGHA4J0}iBz{cxeajYIr|Vrdoqm`9Ky2`+}y>@lM={S+)m52>y^9@v6~?e z=cdGADwe)!dJ~aH8@6QK<1Yzj(JWXB2(mdK62T}}v~jkMzEpkwvIy2>BFjA~xOLTl zz{W8li`Rw7QBz?5t4MYF#O`iVVLmU5Qk62JYnhF05Q(#-+?9~jM0?PH9yQwXVlBM_ z0jhig?r;tCa)e44w0urr8Mhli8VRH8wG`|{UsozVqVXc8M^S{8DsuF46qV%6?|K=u zwdj{qaCywR6fCpfGFgWgG4A!qh2L6#4Bp#Y_7L>`?K*|zGFG5}&;NrTl{&7-O;wxv zsQ4y>Oqh?9Z4Mq5h1f4 z^%wFZ7HykUv|`2uI?)k_?Xh2MLTtHw8Q-H#R6>1v(tBEQP89ALf{RKV_Wi1ZdXh{0 zMsKn0g07mTq|P-J{&QpaeB57HwH?LDz18A1Xs5-2E2knv@_BeM*j8C{qx!>6Z?aOt ze#yd+B+Vy!s&C&{yzLB;z8PB#9M79tv_&>jz_v`D;js5j0yDuJhYamRch<3vxY%QH zZdmg&uYS<*ge)ZNAWqu8%?jpNmPjOKLW)Lp+IU5>P53f~;4yQm%ymZx`*kkW{`Z9a z*4ylup`@xQJ%v12QQQ>Y&G1267@?|Q-w zD-RXbyx@FW!VhT!+|jiU6DuQ2y^O{PhB-}xdP0yn|INLmuR~klXE)Z;nnf+#3cp&v^n71eJu34ZR6+X z`K&1ebtET0RdZh_|9M&G_YTY^@JHqU9hsQu|95y5BP+-MeT?e)?|4-PvHbji|CqlW z@axQ7L1l6FKk~Kg{hI&-I!H>gA~$rwygc~;F`5ULh^|lXNuHkPsjJeqsP2O80GnR)7N9^(s0Ff!E|9qyLbENu{QZdt!lB%MJwdpq>i#QOe!q-UF3rS@&Gbh`>9#%Tr@ib~@9w=~itzW% zbzJ4+>$~wU`sx(k^ootb`KKM)>31Vo)b6j_`|EKUnsHLNrXdV*HeJaJm*Q2O-Kxi) zJ4cejyM$?QFG?wgWq7B-J9> zt$UYb;zL2?7S#O+#PdzmPen1DFN2jZi@6Mxg|e^~W2EZPd3lfd+~g#Z%Xx&(J$kjq z_0iu;1P!8WHkxX?2!Pv%*-64a=)5VQH!_@(3x@MfN@n^cgVX|=o4Q=Nb1%~^Rn*6J zzsoplhU|9-yCC_HRItDKUpU~v6+2U?LX?Zm#VfCkW6E#1uhqrKCM}xwWgjDKhgZVu zi9FS})z;(jl!IJzOd+hVD(PBZb}h7xtXtI{U}k&Y+%)9h5nF|DBFD77k)`F|fjt{9Z8gJk;n!^ksbXGm@nRH88)CsAZlh{O#y ze6Y_%S>_@rmD+8Jm2;1ZEEcbN;MKvrp>9c7m7MINt#X`6&B#S!s4o&_{J)rsF+}*g z;L+KW%KQJg4DAib-A|i!Z{1?S1M-%p+`RSB*@Fb(0MG z&tN%Xgn7zOBZ@DAWii7jnX?5rf9gI(T7)-;>(*gmz2ZEZ;e`Me89k8gDB%-KHj5Nt z10mT2f+>+pDBBPk?`e<&G+69I#3CsD%q`(xBmQzo&>*_SmtVljmJbX^^084JyNc-W zWSh`0k1sSvQ>`i>fdo|$cUHd9Zs|FMG|%N5r=xF!^#nogZRp3}yUe$vMZ8NyF1RBg zz>4&@=oXQx4iSA!^^!T>Ymk$mUR_5N(hIZ0@*n`Or`#WgK3g<8`)JfNrKPQJWlL~i zC3>@?2?9RA*mG& z41N5qBX!1YofC_Te^4^Uyf0xR=JbhgAd?g! zA7IqUO||s3G`C4YTgAix&eyX(0wVV}qyrRtIas`{y7T~xq9LwOy7AIjrwBDgkb({? zk1k8a17#%i-TJ{CTGavT5u4qc$U+~nen7%EgVrtY4gGKV@m=u=cx>Boo=Qt;eNv;D zDr)D!sNJ|?>2{J1n=hpYUDMw)&z>Ym+e64sManLD^|eTR5c8EC4TsYgb|-R-vop>` zx)bRGh0@#CQr|QR5#7cGcj9&f2=K`JWp07}aQw51BQ@;_!#)4$jn|*#ngl`Em}YMf zc67lEqXLZ3!KPA2MjuK7Mo(n5U>M~+y0}Ip*`GnuWyjlXXjuOEI-vYJXEc%gM9(-- zQ#Ar3{9zs(S_x0oLF%lKhP>?Ywnop^%y^@_KQ+l^+)eYip1#;wIsy)q<<5cemf9`u z^^$o&piempCju9GFoJ#OG^%0i2T0jkOmQ5NYLFK+((Z6oP;J#*^SKTb>2@q}$>JQS zXf(*Zuz{K|RjHo8CQ3CM9DUtsk0e&s{D__3DkS}jS)7(oJ z-gm)PPon|&!%PseqOP$`1jSl|y=#2`GE-c$Yi&D<)_+MLv901XmIdwiYoX?z7=Oo? ztxixU4v0+#gXrp@SxLJLxyO+J7UbJCaO~@;9GSkZvEWDIo95iXC{3lh8Lvz#$oB02 z1w;ang_)R9reQY1lzA%pgaxt4v6p4*rTD(6djx2|t~1mP<*!*sZA!p{w%D9=9Hj4G ziUvU3MOfSgMx-|Qp5M>o^hQ(;W+zW6iS3`@Fn$-h7wsw?3Qe*v+HO^<_rYD?XzuT4 zs}vYXQN-1`(Y@MOT}I^G6fIL}OME5NKE@@w&i%7=jCGfsO%VJ38yeN=m)$BjT3?3xy^ak4pWi@bG>mIp((-qfKg zH=y7KKt}yrfTQOl=?6-Tl~YuXi*9vHwDSjBR8G^yo>8RDWg~;Jm5JMtg7r)(Mj{34 z6hx3SG}=R8jQ?YYTbgK-ux$T~TZvu}O)Odsn|&A1W~PlF?Nj0JpZETU%Q2c)!TmOg z4mhQoWQqe+#;P_G8a`txokPh2n4#(joAexZ=`8Nj#ucNFj4|dYJ(55Pa4*bGI4%R- zBF4^I^Fu1wSxL6mW0;r|nAxEEB{&O+1+3ni8PD6|Q0dNp}o$?h5GZL5aP6MdwCD+nLU; z*4>Ag1wCjlEhEsc*a_?F=e9H031*a@?8+$M-()<@5ImUs^#)RkFvn5I3g`Rd2QK8g zGY7}_pDf)|vI@cp`GP!mW7T@6Rd{VAR_ZfU$8kUYyfBiFeEofcW_t>7%2qfnXt;O#H! zvah@g%ghR-24{O)b0c{HW3}gKwVlgDB(zi!*FsRIYkj1f2f?TYV>D5=5$Xm5=7ba9 zLQU;nPX0aKb3!2XpA@2(2UbtY-eh$gamq{0F>uUMS|g=6m!vvi0=(T19%XW$b!D{! zLA*Niifp1xZD%(TcbuJ&P#K;lwtZQ-6>H4<+6D;aSjj$!KU~WXZ;-X+3uEqz*JPG; z7YJudQD>+y$6Og!*mpiNMgj3kG1HzVxts(KrB~R;9PfP^a#?JGi{Wfr?g4y*XJ3rY zu6T8d7@k^D)KTcWOE))YP0w)Mv^6RR+R^hI!rAa=SiXZZ{qF*2lrz179EF!t}jSu z@MJhEUDp1Zi^Ttp!(?BMSjNr`E=BXd7K&P93582PT+TUIANsrL%$%+vRDL6k_D#75 z661DZo8`Pw+((hlnQMfOa8*C^0q!3kMUH0COMJ#qHmmaVjwRngQlU;_! zVq|`+MG6npD>v$aZJcMMP?Uvb(z~UgkGc*&YT5g_>2&`{vNHc zxE8GueY{CXy=|(4Q>I&2FbiXiIE{4hxv&kMNeF^=6H@s4LkeKByq!gx;_`N=F%p_$ z`z49#HjI4ZeJTT&STEh4szS3{ zb}aU&X8Ad%_wzzlrcVL-Kg~k_D`o57DD>YV;w_s0Rblr8Ty#gm>n}^JYrm-aPy0pP4ds%Z zM<4BZ>zto2dCdXceu%RJzc>n=uJba0wH!D9B)iZc>(V^?bAVl9o7k6I*k#&u)YtQ) ze3kRJO{UA;)Kg!f3R~3M=h}oi7oG0m?XUE2x-W;WO=^_Y&+lsNcovq#wsI;W&}12{e~ueN=RF#_l+m#&s@o^E6( zLn*Gi2-c|vDj`B!lXgt^UO8+XuZ~v`4$*j692nyYKLEj^UP*Q3@ZaQn%v~}(1<;L? zeBXR+tYJfMkhPkDp!iWU*y?xFe?>gNgKMWI54)cGzylRiRo1zdw9ZJ(P;A`cfOTbI z2)~5Q1tkRZKw)A7BvMmW4MNO0`YR~{Z2pXGL$n?gV3QXNgaUbsM|SiC-=^s40Gt|+ z_ESRFx+N87W4fsh`6DJB0$1VYwp>*t^6ks8%<__S>XSX>lKkWodr|($$>cQE{6sL* zQb3oWHkXkx1~hV;f;HaalCTtWTf`Y2X$n9kp^;8cg)FpJ-LD+8M=ywkX;#@Vv*q1V{~rPanDHBDtsye1Gr zOGD2kuS%78Zw*oIpq$;x=8GHVwg5!4nP`d8-F>Zs5zKpm0Seo!v0*HqB%Bif2Ox&U z4ubh5-SB}d@W6O1UJ~O3rc{Hb{XPGf|lhZ_0GD6*xk2Zo+9XPZoW`?mP>C;*A3Wge+b`I3EGVFq zhU~WkrY5^f=T}*GjZsZ;Mg#}6f>N77D-u|4u_H5f6cV>GaAeAstDA{%-TNvNk9QgM z$R{*;oxb$B_7nzkphmdwt5f)$JdRV><#RzrI)T#)-lqV84krW4K1r`n+d(629MX&z zalcZ~!I@@!W5$>jgWNq0fNY|>|B)*SSypGW)rXNOj>#(}m}nOnyXl!#Z($8jlA@U< z<{C}cNu~?y;GCw^^7JSE{&p)@Y~oE%AW>t?y_`(3aO|EaQA&35>Lv%G*>^U>(+~W4fRG!(+~1?oZ`S7Ov5Iqz<$L>OwxVl9Ux)8@T6&%QIcjAfu6 zvG&Oi>J@?PAaeh5zq(UtDO08)F40b+fb?=VtQdm7f_EX z9(IaVh;B8O?ql}%4W&O{xypSwZgW!WZfZXopz*-S{YyeeDAeQfvz$cUrXkXQ&tLif zaNw1*V=ejLM0XQrcLLyJGCjq_?q%bUX4a z*?_b?8nLC$9CVFBp!B7t}xx?yX6jn%?4n*yH2GICK@dY%a{nxHtgjniJ` zztEBTI6essj}JqSmTE{#zS1ikozG7jTzv@!p$7#|pqJgM|GX}xrxO);)GF5qHQ6P! zL#)rdF0_ow9$-sQUV!evv1uW3!-@4jIci) z#d_^=5~=|TgBU%6fyYx(A<7c%+Gy!$X-B3ysH`NLRTpS7t`olQ1(eZJR$9zi2d~xJ z=amBY()R{0Qi&C}h#QBwR5_F5nk4SmIF?H@Qn7fDl@_W1%rB@wy(NYvHgRP3VjLs|+AklS3HYoK{)H3pTc1tLC zJ+XX!q50g9goC`bj5O|jBt2%mEQo#Vfn{1Yd-VR1A#7>B(zdvtMD3E@eI8n}R>!qR zol$l}))gpyypUDQ*Peqr^Uo|30gSd2mSa0EVL7B)f?~9}>+gka38_FIZUsA=4rNOhb)R`RK=RY? zusgm>rsr8W2Bs2qd}%?8jql|^#bVWJ%RHA%Dbc$nr?R>1NUmtc=B#p&&`B-sq)`C3 z&vH}^*SDr+@$B_FDoyx2YTSOM=|9Pij0Ke{&JN|k>(c0$z8#5!WXG;GR;V>53BHxAvfJLr}ekd^dUvWi+RHeC#1@hKz1qMtGd zn8TZqJzlAiN6u@2veV81ied8*VKb^)@2uXuLv0D4kG8o`32rNe%lzLyPcCIQf^Iu` z$5!5d{(dlHXCULYAq#VXddfN{gEu?1sqEJ0mBalYiAP9~Y1PBy~L@XaPT8PE3!lVkSx=^8k1$2`itIf(g~t)*pmX~Xd{ zqH}*uM!cox`}8|6N`c^Bgbc3#e)vBded7Px=zsm&=dTd0%NWQ*Jt8tLq zB+kyY3VKEsLb6vIfpl4A%YShx9AJq^G(V)u=7)e5QB&Ex8i>S&LNIrf@^bAUFU8~N z{q1#h5|I&J1Z|_lQUGt9!e12Uw_9{M-HqbwC3AOiuFc@f&>D$;#S%KGXE0RW1L5~c;JPCten z-5{z$l+up7Xm%RF|u5Tov_&LLf0-7gp>Tt0Rv1(Xv@5K`@`)6lAY+?#C5J zTL|LmJbz$7o&J7}W$DKo>f|D}(9t05C0B2zVWJPmv@5CL%JOKh- zWx4RLp>94q=tIg~i<*h{ZhUe2P5bPXndZD@V0ZX7X!qALU{OMq^W?ZM7o9=#0}0TPOAN{fULd?nCj_@(~Wn8ciQTz)B@s>MLM^HYhY% zC0G-D@Al63-Xta82w z;#}f}&p2i}g|`yS>_zqd<{kzCTYf_zLJUle1pTy_sea5PqLAb>!LhvvY3D-ZvLAyc zx^Jje!al!90K7bi=}+mLgNqRj6OaBX?IY~Jwu$c#@W%AUpMxO%3 zqOg*!qgbP5V1W$2v;ehv=W3$RrYI9MzWL9FbxD{`_4Vcnh)Ra6XzCD%If(3_(TigL z`wD-ZMf569A~-!02T2_~AE~hKA4kMj0)`Qf24Zv9i~BRyn2Ap~1pGL?g3;%#XG~wU za)po|Xa>_{_)LKK^?D-g6wlu%(`r7VkG>&npLslC+r9rm#?Z8w3WY)$H1VxWJG5*| zMb!z@oks9eSvvs_i3OaJ5|**h@D>iqH5aYS6P>9F1IZ1GFUbdec{bNeS@*7_8l&g? zD5YJaz%aE&{4OSO*4)W~y=)<{h_DHNbu}BGwKoH6mU2;Opi6C1zLIMen9gZVP&b&L&J~f-G)z-xiB+wD3<T=7( z5E~5jZbB}F$WkClOh@k84x{OK6$KirDa&dZCEGB2;kO7soV7JV32?>{7Do^VA4u89 zqpIsS7O`$^d`382{`#1tjNpu2)utj3|F7Q~T;20;j%^z{L?fDA$uIiQ2w_rUgk1Pa zi2Kl2H+4CqY11brers`aLUmq)GPci{_WmkB3X|0}VgXUq@k+l#B&4}u0-#~~%z~X5 z#d14!j&O0I^pamo>BGOL+>~0IciYn&pW(17t1{Av6zo z9gckx@O+?d=-iwe>=EbCy1DE^BN+s3S;;pm$3X6VxhxKv=B`r6xqL|)JB)rcfnK5J zA;1F%-vGana;fRm?%s>5%y7>OO<%MAkc)3ve21HTnzt|40N3(ZzgVeBazEX;kVxBZ z(5SKo)DH)IJAp0m9Ka?HrTg9rQ}vAqxT1BQV2j-d*cQ1E&~S3R79Zs(t6B`(5IbP? zR&3jL^2N4o8x`Be%YWZ% z+&9K;-2Q2wvG+N1&2?b2g~Y0tH&L$X@?+r-8cFuWUUY$lvs$Wp@xY=6wc#x+3z4>O zW)dQMy~29{Y9hvVpiIUt_h?;QxzE!PlbA7zZNC!c+AzUgPg5%|&5OqP<@lannO0Zs zHqcu?OmT${DB;Y9Y=Vs|h}H>Qc}EBv_q}lf>tEWU1(WaIi0~I+SD(#~@qGIFnr^|m z#WjQXjGJ6IlTJ!bg)*~8O+ZvGMo zBRm@^x=P(*zd-E*LA|2t@I=qqN0=ad)-qyEaNvz9>rqtSEe32+rthlnSrZdY6-}X3 z~ipU8;QmQ)>|3`DE;WF3Sqo%an#ZpY*dZRDHtvqOZGq6b0-_pfcZ$|@i@6^ zH-0pUcN4}i3Hwy{$Gi&XER^meN5nb5P-~~$ z!>m?fU<7iAf65?cXyz`)UH6JW_(p5NG*=LT@z_)$e=R7GL@+^?uwb0q6<>Z{E1`y9 zee*Qqy3DD-pw6|2;A!}*l0!*jy{$Nq6G&6YOmAkzfopIG@M0BuBQ1k7qGGjehxVjB zdHw-B0UFcTws6t9yf{4r_d4Ah;{!Ps2_p)evTWp7g%QOFe2Y#vllfv497y3SMEF;I zfji25-DC4|${vM{cLi@u#FOU)%tLLdn=!vck}J4%=83-xid0$R*XAoVg)d5ZhTcO< zd0ecr@vx92goVqBU<)%NZ+AgX!OAAJe!D-fJsYoQY(NQA$Uo*5D*4%S$JrBs$}%h6 ztFdHB2aMMVO>MKvou;X$!dh6qucU{ONT0XDqO~bI%8*(@Dz>9t~DIrG?Vm2(C%|xY0}Aa zqHf%Bu7@E^HbppH_InJ`dbC{(Nt1ZMjEv|`6CkJC?_^ef{#vlI&DA?L@DCQsZrfmN zLOk@UQI2;Pl8ywf&~q6%djvqq#J#3zwRdE-*y-hH_n+^zq}g){5R^rOw^I>*m+x9cIlS4VhnG7D0B8 ziN2uU_r^CcYT}m9|FjeR@03>D-0c4ybgKSI-P5-GM``r{YJI;(1}q#2)a-xpLpO|y z;FNcTV?O$XcHcs@MhAd$bv0#zVeLWV*Iew0?jHMiH# zdvDLN0}4H>foQTw!UO`%14=*5)^2gu@s&K@n_oUCA^;2eeYMO68I9t7i=VfBx&^ma zkLI7ZeZp9o$`?6zV!a=uRV0eRFUH^p;}2F5nOwjreD-$j?FRVu_Be`>1Gv>4Ytz!P zlYLv$e<&x4qV?(T*O!q#D#F(SQbinl@@b&!Q$bd@DBhJ%lotI&% zHJThO_I*iN6F*3==C(nA&}`I}jS3UljUI(i?4WVdd(7539$5$NY-pg@o!3{g&))re zIA?(Ww8otg77`3fc6?$@OM7>H5>IlWtO|o9oJTJC(fnTOTHCqY7bAV0l7&QnY$(l= zG)rTdQ3h)sUi(yn_L=p1V|K1%=ruWN^sg(w+DhTW=v-A$JfgK+XRKFh3%pp$wHUY@ z1%&R5h93vz2bN;OISgD1?Jad4{2}ET2*;wkxM`hh+SP$a5rsj_oUl!Cj#QYV_! z(f09Qer!dUrwZfB&q&#^U}nO}9n&jQMLMR=>JSQViNh$8yTqPE!`XV#A`0L^Bc&VJ zf@6gX=83LhWgzDTwnB5I;aF={J4=P}oRI=7UiqCSHx9Y2zDmJW3}0gMiX=L4@Y~uP z2U#{sM6h;az(eVcWRCj`*DsY&j7Y6I%IkOJV@ z>{MvFD^;Db4XLlrI5^PEJTP8r-zg!cxYA(-Q}Ql5GEQ<#MiHC(t{4KBdB*w?Jghr( ziq}(2H>gN<8ZUHQL2K!Ji7j=!1unRzs^$>VVCx!{@ZWImuwpy)ar ziVJ;qFCjs3I*{DNYK4vIc)My?qmbyztI+8ERZCh&KS${3q+)(vU?)_JP7Lc%)z*rY zxvB^_QqRarIkyLmVub~9!3qGi-FokCOLPf&I>Ojs1Zjq0R8c2J)crgbNxfzfqY}vs zuyzW>_;OksW}ud@>9be5EVIjcbq1HxCRhkE+c~lId!LDEXhZxn7TOUOkStp6RQjAJ@`e~8H_nF*;-8P7DHhv584lMDw#sl2E^ zLif*_i+q)*F&;f^Z@@m4cDRl~_;!}&+$!I6Z7iD8Ct)i5uSK%UfHu6YCjj2@o+W5_ z8|LvO(m&dqbS-4+YLi>^wxhzz!HvZe{(mBTGi5PQqA zKGj(&P?rH6q-0N=PANqX&Z0sM9S@|Z5|%5!;MBjqJV9DOEX-Al2)6Af7BjAnNVJbE zMD$99iViBuuo{DJP||w{i*sU9$;tnWqpzKyw%L+7mdL{>^C)SD#7WjgW?1mr7run; zL``VIHqIK=7lM71LsA&EiiLP1GRwrAHe82u*MTi-^4w@EeK7*^Rh{lqOR)?DC6+P? z`O5HGH;|pri-pJMjp&C=UhSH)hSsxHz{l6P^#vvbQG8}w@vagS8WsJ{kc=9tk)G~2 zrY$Ausr3=aSMp2b5M`q7Qk3%4$~RWVdIvO-!%lb`PaSA_a>DVM3pl`8xR294X_N8- zTkYS-Ils8N9G*ac6NlV`P6+ZhR4D`uyFc}2EbyTZ{X-P+ZL3e4%hDUuq8M(4C<8S( z@GXF4^pT-pRj?VigzPRIf5f_rW-<%VF7jBORVCpQwWAoUa{p8&Wu4h}1F5&^Mspby zHW2&s8YgTQ7|Va3AQwK%IntiPopAebfkOEv%v53mYPMBd`6s_W3Ptig$0a=iw4zBI zCGhMz)eOvq8@JX&y&i)gR-L{-3aCvI#02M-s9U1&3N+=}0T1fdX5~S3+b43QQc}IY zavw-rUkxko9z59JYA&9`?AMy5tMt-tbgIHwXQ~z7Nf^wQe-U&dnJL0fego4I?WG;o zm_i8O)evz!E@}N{rz^{O&*m+?zhcahkwn zrn_Eee`cy#5@F}8fTpVycoULpVEy@)hHqYsDia1@iJmBI8043z1H05yj7RV{%&ugq zzPa5l!=?RWHP>=!J=VgkdxMi7Ec81wm);wAsY*|n0Zzzk-W}!4c4BQv$12Y>vip7* zZ%Khkjpo98PNIoon!{q=dWgetkc#!*+RLlpVGeqlFsP!U9K)ptBd<8;as8Zn(Sa}g zhNoZGMKj290asUq+4-m)fe;UYQtAbdcOLs4Xc{M=sokwlnaNcT;p?Gu1qtYYe`XfW3e4TBPbI8}Z|;pnx} z`h!Y*vrT4wMg&-~9_Bd&RqGNe{9n;YQc5P;hs&|7qkYPMU8f1oQ(3+qUq2+S{uTg=@30TFwBrSI(y89h05kc9bq78){Nb`rn`b z2oseA#>FL}d+!E8&9QZ)G|fHPIed1d?w-QFdv@Qb|4{n9*U_rAe{oOoxbuFtNV%ko zcYd3&OiwM_bbik~%$&CT>^Sn)2z~!90tZ|K6TFSU$NhC(M%`i?QMF1OA6r35A}Rkm zE1TF7T}xvrA#qI52_$>02yYg^G{uCjNN#Janl#{3yP}qQbfp!^&wKX?9Jhd5iMBI} zX7GhySuIj%Sp@XVQ{~g`)5>wWt^*%AU$|zIpYg=wj~jQr3xWF1wbu4WR;epkrOXxD2=TQ~0Z zV&DwG2v~)Ns!Yqo4peJt=c{3?xeo+$u6F;@m-5{ea!FNhhFZ*>xhn*c)7{b}^tQON z=_*Y>9Ft6LuUQOMZkUICC7n7-b+yd6^?%rmZGV$MarekTH}+{vGySqHgQnR6~c~Hh+0EKg(iA0QTzWfeY=-gZ@O=!xxa`R020GfXu_4xSAb*|aKHg@^Z z6J8QunK}@JJ@nB9S<&HzeiLej52Tw`C z^Z<$-lxOOHuk_om-9jb_7f-dhqfQw-X&!C6oMRKAqSHDHpUn9O(m7k#MGnrx!ovPy zQe^Ij`?t;ngEBf+Wmj)ff`Z!l{ zHt>~*fPxR=2t;FH11ohKwxeEJRX5QMd6Yaj4lvfEbUKMy;tUQ`Aman7Oj?Ntv{`!l zwqHMD%`X8x$e%ZQmaiw76Bo`tkQ5UZMIzj=XtTl{p=0&$H}1RL{<^3ZqnL#sAE@fy!k$8#i>7qjK%E>LXui7K-5 z&CRW(!NKI9l(B*l`a#c#mQiqZl5^!HFzi;|2^4X>B7bLI{$(`#B6qnX%tTseV>V4% zhX*JrH6-KDf?Rs<$4$&1Ps0Wv^C4JCMKBo;m&?_}JQCa_ZS7OzOgY}DUQVgj1~7IP zs(H(i>-|fxI7>mj0GYTR;t5WO+B9dtOcfyFH=JxL;ep$fmM1R79D{t8Wqj)o8H)r` zGhK%CBV--PcGfNtQix@U)yZ zKXEdckn#*h)u<6hm05-G+TEOF{>_;@$a-5Xs~`54uq=_a($ET-oneFP3ry6lh;dC| z#-&cU&w_GT4F{T#lr)`Ef&h4w3(%NpEz%G?tUuj_|4aPL@YntZKw4Vc+AR{aNWCHc z35-^CCd5mU^K5xq;*P!P+jjpHl| zb}$tuumjTw@h)@T&Ma;Z__+cAKJ2V|ESriSH&rLA&C6TuD$gn5uf@=w^~&K9HrW~v zY2H@0MJnw1jTei^AMO5OR8=zV5jJ!hUWvdPg(Y7`z%i#i5``sKF{XV&ZSPtsnauJ_ zOG;38t~jJ4fck>4Qh=Xp#Ar1Bo{0}mJ9y4pm61{~=Es{P?H}g=DY38e-rrY^{g?gZ ziN6*Dxe9cLJLF%XYS!>(|DUvNEq8*+Fpmp=#aagz6COwsva{f26R!Gl`FzvHa3o3H z4`92m1!rVlJc7KBF5Su!lrF)2J)mY!N-aY*=v>}ny3!cXVE8sZV$vSh(+N*&561=sRH_ zm=xv87Uj;<-4~3fV$p1^8~*OBs}*p=^aM0!aU}6b?a|X=51m-wGzfU1!39m=k}i`R z8#x~ZcNctt(zeG!K+g}y&}2AY@PdHdO^tfdIv>{heO)l?>PK+}xwcC)r-n5={7V)o zi>$lvMVQ9Jz~Xu`SQ6ktM`DiyGr4arL-O?XJB~a|1MTII zRFTLsoh1+H#VsEf3kj)k>j<*?Rbe6bIBm={9?+eRjSXddktRp+_+TlCSL?Oq_W7Y#Nn zAvf@q^(#7AgZT;$a{z%pCFiH|>!H zO@%O0PPBSlY=Q;r0ZP#H>sm!0TpEpd`@NyLZ1(l7N^}RK14oX$Q*gNsi@+;QIvMN?;;37SX8k_z0g_zuuIr+5#{ zc+bg+>3!Q6)jw~M>FBvvCo%ji@-|dL3F9ca0iW9{V)Wl}<|UZbSzcjf#bV=D-mjrMH0IKskV zpA>PIkCOCa7UGpJ^R;;O{4@*&mgjuUxdTgxLm@ki)mf%kN@MHJ1l6>lP@mX;UMtM; z>8qt#Am*+uZ%x8kG4g#`2dodVslq`o|CJ=nfPntT4s7krsT{rx}fFaJB5>j&rh@B7Pt{am#D#~1to z3YdEbX6uBCgO1xGa>F#;v)A~4WgH1oGD$LKsl1q&m}aSuc`tlLtEqyFcO>(I9=B)v zdb%P%-QV&0|LOkrdHy($onY))k3^G2Q_}afO|5K<#P}jvBFS$5aQ`?Lg*vs@E-K~V zOwN@lo+07?lsme-R|k@86%u4}ly7ww!8`Vz@#WX| zADHXw>0eys!^eI73D(77PjaO%^6CHW;s_kR{%-rYzuWkOJrRW`vu{r{@p3~eM%?eHN6{xgJ+&9!RW=7 zrOK;FDZGMjyf~GsXBPWLdWZ0k&U+XWuqT}4HXAPkZYhzX<;y8^qB&Ee&baQb>^kI?-*zAI8l$ zitcQ-aTz~NWw9t7m{Is+9WSiXEq2Gf#8M~Vs3}!k8|c025~+oMOKj7}hIvKwej7h* zwB*M5@{P1&e+42WN`Pn;Uz1uc>|=xAgzohBwfzkW zyM2=J(Tc9ahBw1Z#ILq|j(Q@TW+Diq$t8oi#ZGi(v)v`)aPz1m`jJQD;~kLi(RdT% zWa_bLJ0*7Y>K0ewzHU+AoTsxehY{A0zuRTvy~7p*DabvN3_a)&l>)Mbg~2}jB=b`Y zitQmjgDWgEj!(TQENy;YSOGweGYoK)_Y|if>2cZ|UP`#f?SANcE9Jt}?XaS95M+xV z#?5a}%*4u<{P#u(tXnYjbCYNS3JCHpMw5?jj!&))JzCyZ5+)d!I19 zFoKzydH03V=wWDys#R@|7DZsd1!8I&EdiMob8WVa@q>MLBQ^w{Cgwb@FlD#6@o=@l zkSopTI^q(LbLC6;EAXWry^91!f|N;=RU1hfhNr|)osF>#&;dCEQ+-wW5K322#QpoRG40dKgE z7lHH7d0G_e@7-`hpSU1G0r(?5gSFcE=L5ZKop6~@$zP%v$w}T^q}15?JVfl0aMwD9 z=hfj5+<+yyLUuD?$_91KXfHkQf&4>PkWDZFUL_J6MSCau;Nm2cH?EMD=->$6dk;_u z)##Uc6nmQ+03#K#a@ane>TwI&@y< zFR8vI5fB;>0Z@A~!TZ~K-*f1om9aeA-?=r!-n5)laF~t=rh36V$@$cC`tj-ZiC_!gLfEnYM_%1R9oSRR-SWGg$csi+zV2DY#XX}R_h)X@sPl!=|9Qe z^5-)LC5GJtO zsI*n2rfamz70xYWO7x#^F&)nM%nvA=OQqh$aw zywex`7*~0pfr-{?FOvQaopSMAgd!DcV^ez|~w2qlxx?>?;%_0dKi$q<{KT}+Dtf2316trTK=!LT^6 zuma~^oE-Mn0@s@=n~$Ej9L1eS<;(MScF7PJU4J1PH9tEjr4w!j>LM9}LfBPLCM+xa z`BXArRJmCzgIl;j#1N94zzDPZ^6yrdYQ0iCH+H6-JA8C*nG4qdr55#8Qn|pYdulvp zyj<}Z`-j&qF_O$3BLvRW`A`;^vnan!8<#a9(j=`_mOtyEh%?{?)$E6EVoK3euLI!- zP@h_wC&cj zalE~*NTvlH(!q4#4MYo~AyQIo9a{%d-0MLtOnjst$M{07YRDKtTi0s3V`8p@1N+eM z?l#9nR{C#Jw=Z$Jt&n z%@jofj#CRRX(|HBJYKkKDDnyctajpcpZ_5V4ySU7R~O5c;kQ`OQUmr|h5-{R&=$jo zQ3sKEIYCHxY>4S zzxZ8!PrgMA?*UztZ_{5s3W*|Oa^+4Agkc@^cwnE66~II~P4+|Wqz%XQ3$2^NqNY%3 zAw@B^oaALRr^M6?@JB>M-hT}${kliB=x{s{v3KQbgQ}6oo4NUyAJmTGleqTukmn(Z zzmuqimF+{TBiv`&F2{DI*A_pWLvy{m+JHnSS)>1$t07afJ~lLhoEtXEv!MRts%Gev zhA;5c-Bs^xX!4W_z0Dlh(OeBpdga32apNNBjkXV+J`_!>v5T=}!$Qz+i}$&giPRpM zqQ!5rNnIBVEJa_gTmJPpCqx6r&99&QDlPrh_4_rRGL(d0lw`&87`V!eoa9qIJj_2% zr%U#VhIV6o7GNY@a2oVnfVFX(gWa(UUWlMt`_|5Pq0c+Se`zox+$Lqxg9-WB#+3#q zpgt7HLaLx44ZV~XCCU@iVR!Mh6d8NOu9F+$ov@_vo)jk_>ftjX(Uhv9XYt+&cvAd% z%jS-sH*a3x@p`e7vZe!<_}wfVb67uo^TAX5utC^Zw!AX*sGZH{faU1B{HHGA`7-ks z51rFcr+S^b3DHpt(GanHJIDdLp5tW#-Le-0`-Cxa3u~e2mkcZ2ZTKhf>?PGMfc2B> ziMs!$(bZpc-$})PKNp(rxPpNF+gSWqPUrpkiv>ZQ+vo9PF{_;CDyvK}ue=;vZq%@c zar=dR$jSKvW5C+(s&*{8bViS63g1`bsY2eMx(YOr+?@O{9R@jcGMFpm=?py+$>|=T zWl!2tvBMq(0QMS{q=vOE?m{rka$%_o>+Wb&6V&ma#$3x*mW2yp|Ge3NJ=^Vv-Qzu< zV|iSeUGkRkLoEr4b6nTze~o6F(Q2}+=FOTE@yD;pa_#Cd(r;MkfVn4@AnK55!}$c3 z+SXz*R2%=;5SWupoe#7dztd6zoiWmfR3s~6_-tTcI!|;eZ4(xGZly(=?E~spvgR1m zL>ZK#cvClDWDiJNUNo(eJI~OYvA0>xJ!~Imm`k5XfZ~hi(A(hhP5)*yL5cAK9cZtY zKm^7j!1ydmuj0UkcHge#bDGuRmdP=t^ySl9srvV8aw5u|0b&!X?ZSqO&3(Dhdlmpn zmUBg_`3%m-CtrzBx$5b-P!kDFkW3C&7klMh_gdg;t&z=mbA;4*$Ciybpkw%qRDZm( zz5YJd)Z$ODm$E>FOb=b|fn8AJSr@=Bs~1YtVOlPWuXllvP5fs@q$B4>)5GvdGm)kp zF>?NB>WNi50Vn66oiV8+C3nwiW{KDPS%czgY3KR!pSr8;G-b;{lWu_UHL#Kie(J`z z*6tE*9n{!2OKrF3*NFea$0g%8sBurC&i}MU{jc~hR%Yh^PjprNlZjz#f$u)1egiM5 z@&ShMfkMI^of_K=!1FAr^bSXyCa)osCL@fkB)ciFG(L(W5ne z66Tk6xNc;$hIZRW@`PJ2owvzfquM1Y!VR~N*@M_~NAN0)=zN*or9GD+VdNU%LpT%1 zv)?VubqB>{qy^HkDcetrAzfEX=m`Mnye9i&{jilsVPdsjQ7tw_ZNPRx8SDnJB{jkq z1Fa>CMkC4+FaKg8R3m)`MZ)e@fvuQ7r-=-qtRGXPvn68h?FU)sf)`0B#je+S+!3!{ zjS>ZFYbkXV>(IqGN?ik5Mian05Zg^TA%V)JwVlnNRkzC6KNWyV>5InWtH4oNat0Y(}qR zo%a==Jj`URPt*nY4}J9ALySt zNCqBWp20)YL7z+bi|*}spc=`%;89DNVN$Xw*+)EG*!JSg;pNPFlE7BN9K5jl0w#SW z&~1@_DTCwP1(MjMV}Skb8)^w7+FAR{#pi}^Er-Es6qP^?LUqJG5XEXM%-O_2M>zXVnVFmk8RH7&P35_M3o+Gwv(% z4oJ+)yMK*Zl5H;&?wP`$#m>CWqJ?ve2fO8;ialuOsDKh$zOTH$G$KFwjH{G3cM?^t zQ!wc=gjtdz|6kIe+Wx3T1zI6Wp6{H28=SJjJ;x@~I#h3i zPWnLi^Nm1XFU3M1gHr(8R`XRDRG}WG7gYw~3F#UUO__<*^z^6_{ul_C<0O}wGgmTP zXjHhsC`goCBwgE#dmJfL97h`CG?me?eoPKIkMS>OkSS*r$zy0F$zx5B1~ZYq5wt6_ z@(PCNp4$hkWPPGVM(Cc|q;MozzGq?I)LhcuxRcl?(^Oq!`t&sJ(u-h3NFZYJJM}h9 zWZDxg%B_^wFk&Spc6cvVZ3bwB=(8cVPUbqHDczC3ws^@c0Ybg{EUwgEM)4Sk{}A^o zcvC0jVcg=Df%hkadgm3!xsjXP_Dc`nH3x}xs#h1(!3%%fDkeJAO25@fnNiiPmDX9w z)Ug|tGtNC=c8uk{1sjrKSS<^5a`ii?Gb_%^tZb$mk_}(U3b0v}wP4|C-DFS13{UN0 z3`AMvG!^;W*repAvIsk$^(@b9TabR1Gy6^~@42M>D($?vU?h^`C@$D@DBCEtxQHhz z`;*o{-p5lbyF6e?CE)1UFpN8ET^g|<28v}%R!9tXa9E$Mh;AC=AVw}VTmZhNbZo%y zpMoCsf7X`mg%q_n=mKiVhf5nb(>BhD?T#9zgF{mAX;+Y%L>*1$ciF4K?b=my1-X?> zQATAM5QtcZiUdIAPqzNI$EzT)5riuAL*Z0@cqU*T!(sZ+amo6OCg0-98+AwRHw&f!%L;Zn+KNcM`O#s=2DgtLGa)HkMi1Q8=4cEr_;` zOh&TDSC~PZf#2kJ8se0YDw0^FCu2VYkWI5sx9!4}62Luju!yrvo?s~Ef#d@wHCG23 z$1WC1V9Y4XY86JCc0YRy)}WG!JJx7yDK4D4>q`^2#5I76`|usmP60G|ASS``tYUh4 zWnvSyNOg;+H+H8s5jOTTK?--^jA*yc4Bf9sxDvfw`>TxrHpbl#MOsB(N%f<(;*;IB z+_c~1fyJj>4{aTB?87Zvi$MX8Tt2idK;`xsNJ@8LFAd^MiWc0>@J@iPr55=3L)sZi z?mbBKBOJaJ2%5jd9>}N?O6kPXf7=8*9&tq25oFD}hEzWL z?lz)H)MPOllO4_fN=06mId}Gg$LQ@%ND1T z$5qE-0#+h@hKoEtS4<7_`9z}c4ngV>RJg{0A!L|k8uJ@hhRQe9!iAlMZg45qKUYUw z8IPGyY)?QyVy{>#>v8fyE0SBS0Lut z-1|d6+l@=@U?4paul6J_VacI=3>yclPJ>62J*=>PV-w5y8WxSwq8mobFizrR)!MCi zpxgpKJfFLt=<&8L#ZKAZPR)Ge1^=1;)Jk(89x;JIrmA$_v<}XEJ;MofhsTW>LtQiA zfP%&m>Sl=K{uKG?+wX(L<7FoW=49x6mp9EWKu@I1f}pFmo#SX|1$~P@;h)k9NTueg zPRTMdSu4$qBvPr`{NzV9pcu*H(I>{JraLDYmYxP4`z}!>tWhOBAqS}=Tbmq%mcFg6 zhL&JW1csLjtWUnVoATVM%Neb2y|Ii1b*BRE2z5-RZDfE2VoCS2!I3T8>qCmLm*bww z*i~IPh+ntiG0gGGHg=kmYE<5YH4sX>ZSv?fpC+&?sMABTdYX~;s>S1qbgr|k| zUzJ!_=b*`zlvK6uEq_jl3Q)>Whi)zO%xpEu0|$OpshD1s)m%S9ogN_*CBvNZX=&4G zh!x*$VzvY~C&di$*XW@81PyeLCGX1!LAa5mhNQto$f=1taV2G`DIMER{3cjL8I5$V zHH}5&6rUJs^bIyrbxbMO@yJOd?oXTo1yiH-Q?0K*5)!Dez3d-8izy+$MNLr5-5uA3Zd2&CmkL9@-zh5#8a_U!B;=ry*?Hk};8dKPl;z|@ zj0!^$-drG&&z&NV$WDOIsU&!k|iDK z*dO++`&i=yQFFit7>*Fc6k^map&OjLbz@$aB{W_3%eNIRQaqyGw5J;k@pG}H4bA4W zLWcj7`8GV*&%55Zet2eD!JsG9-=KfSA@kTkuq4-a8P%e}B1eJn+t^*tU|dxi9j$^Ps2?kCxPI7O=iph!>1>*a*)C#v;6=VA?9yQEX>zdrVpy& zw#b=QkzsTm@AiQc(AXOZ~AGDvS-Y|Qh^9YVj{Bu9Tn7Dpn3So-ww z+JIx5;c}x>5X#$k6yNT<`@~YYucx|+rMnN4jAA#>H^$#f({$cnKFY(B>(VbDxu>}c zHH@PaNbFwMFpuG(Q{t=&U9`FKH%Yg_TMP-3+&7X*sz=qpM(BNQ59kh!#6B7ba0T*{ za1H%o;IB!SWa9$1dMU@3cU%lGtjpjWeo5#-X(QD+`+w&hN!7%sqvc2#c^S0&wFv!D zb52w;Q{}o#)q8Lwdj&N+DT67G0nKP^x!9=b9cp* zUDqba;vplXA`&{pU$B%nkSyfe?ATKQ$NH_98Zs{HsFL^ed)jz_A)od}Dwc8(@U2nQ z3VUZbb!Ty%Xe(>JGcVjz!ftF!siy!$~BPOZ4G6HWkm!c$kQBaH_KY zVY)SGraGTM^H<^d?V1K{w_WveR9Y`}_DS6EE-<8O zMX}PY6a)0$+Yt048g0SpV>M94i3V*;#UNbQI=^8hD=;A=&~ly&6MkjApIY#~YSHc$ zTEL^44=|C0g$7DTf2%cMkXc6+E-?{N^yAK?Nf7Z-uutI;=TqUj#1qf`1^&!>Pp4Ho zeI9v$Jnmh>R2xA8kWSr>epE6li~BQMr`(1`8rwG$r!_~U4Vo(%kW$XWM-6Q#9-e_% z!}#!RTC0!0Qas!O{VF;*#F}Vi`;|HK62*ZwW@50WSg1|@MvnxxKiUw$MaL60_{XQA z-7^cIj)1l8|XpV7u5|0GiS% z7V|Q1D&+R}N7ae@9i&O565xq@bgtsm+3v@+M@O%f9<~r5rJ;%eZCMBn&XQee7#!lB zZJBlk+e3^+jxX8Pa*(d1^&*2-+DgFgy!`kZmmnnCg`D(#WP}6o@E5(`DO}l<)1{iM z06EnphC9b!c>O4o#A?l!T8M5BW{@MM>~%e;kAec*zT>Af+s7Cw4`0Y3U))dDP}-Ti zi>WHyZ9p>{y&+h}-WFSgM`#9$^$$i$BIVzftYJ^%^uOwkc62(hG#H_LGs&=B{1@^&gdO|Xi`!= zp{k()<>lgSeu=uT1U=C%!uwl+ko(x*FUClNchbLcDOmP#QN-KpDJ2b8V<@SSADvqG zI`=tH0$oAct%00b&1M)kDEVsNz4qlIK`%M|r(gWFWz17eG&@^j>bO6MXsO2!&Jm;v z(e7=S0SO}6TQo%XE|h;NfutOjoH^1F)9j?1PB!xl*Y#~kS{T3_(IyrFN7c#H9I~8# zk*^F`Px7B3IFTy+>nkPZbKMi)w9HQtrgt4QU|9*kbc`UO>*8Zc34({Jg!e||%HpKM zm+0+My8-y4Xi_@uK7JCn9j{XXT5|eZS{gi+b z!BnfuwKH5z!ro5Ky}iYYq{&~q&yq>3KFd0}rE+ydS}M}8t~iz|GnO`ggjjW|dDdO6 z!|a?WXzRe%jH>?DtMqrvs$~1@<|yunQzGFY%I6j6U_HW5Gbq7$MRpkO-exXmmta8p9d&grN;% zFKE~ltlU*7V_^P@|KXvD7&uxng2Jmqw_fF^!$0tKABA!fma|^aTHVCsTRSF5ZNXdZ zx}?rY)r3ICkNo<%+u6XIA}FVlG?rZX8In4yhMR)IB7X>(*ql$&*}(CrFC0 zkX5b|8S|6-X_%pbW;7?)NP`+NVC2r02X?qJtiIP*s=SAb>dl}s@bM5kE|u}A`JjdQ zr;b}&>}9;qNf&SsMs}3U<`Bp^n3aLJ&DFpta9g=myOzP&4DvvXXr|Dizs=Xl2=4%G z_>1OLzxM9c7%*9D@6$~GErh83-k0!FuTM`^Uv{4ON{;|`90xc#y`|?N_iF0rXnlo$ zuBG_=Al#`i_F3MzG-tg;VLhsMO7Fnn=7@n~;YU{n(h7XXW zHz}J)cNsWz6xx9EU*1nZ)qAjQ(FNB4vaGS|F11_o9e_@Zo2o=b z4$Dc>`@5?AH@jGAnGTQZya=VIZ7S^C?w%xIg*^|2SY2pbnsLDkvv^mqr5f4Ll%GG`W^^Z(w8 zOp2r!0tnFc4>jB`(x>61{KpvVhgncY=>_#R=S}~Nf|szbC6x9mGy@g*wN$tZIjk## zFgna--{s~sKWR9Uii0m}N7+yk?4jP1;twSJK}Y-jwDi~e_L!d7RHup98K{b(OsV&?)~Ea44xyz;d?SAf7Ur=I@wQM=D2IKyS%vrAb1`n|aGd8pb!c>g+s@Lb zFsUBq*1?P`Xzo|o;@age&8{96meQ4WB!TK`0qcO8}+y+f>W zwmh5KFAFV-MA_v$T?=l+za&Y$*Mjl8ou**bXnOX$!LBJJO^8tbdljd z=MT-Q5$RrpWSH-?fXY%c#!%2xGefEzG4d%&Htmc+PZV5;4U*0?5eK7*u z&s0>G{i)ZHYCHO+wAXD?-d)u`lBG50$`@J9%MPy8nXc=@ABY=99YeeSHVdzh*tCo? zJHDkzi`}o>aH)M%x!-W}`_y?Z3`LP@6K3R{s(M+z+Nh=MzZ*}C!7~Ga=ks(zh7Xs& zUVp}7$i3~-^#5rrX8+$rGFZ5|nEyM{w4^&`|L~u&nEC<4TvJ!P_eAus>EBI?Tl&$y z%aq?^c;*ZqpJ>koV)R|^7#}x`E!qVUL)zVM5qCHDK>vracL)+K>auRr#!cI{?VGl3 z+qP}nwvC&%ZQC~f{Hk83UR0xcr@c?aju~suH3smAFTEOr+QI5+NNw)zApGk??$R9{ z-azh83Ha`$J@~)~cbC6O!UiA+Fi}YC#=mV2aL0J;SOx7MJ}Ccxj@;|euQRvKbKj5X zKEKwOT{2#WIye6Zw!a;7JBOdquZ8Trr?KB~XE(F2XH41M$)au5WPVUP;q5-Lh69^W z&XRbha0We}9|t#qh(zbY1z`J+ugJxNT)#vz-H2A1Gx1xFy%|+*9Ris9m00QO}asS(}J)!rr*r(3o-D-g+$8Pj#} zDzvS-x&1E%`pS_qWCEeI5~sb+0!jolhn$3n$rO~JOwj=t4f!6dBsPD^rm(vEymIxs zg0;YQrYv_RXHY2$;nJLGr;=+-Pqa1>6SoES8H9qYTla(C^$Ld(!#`H}EJx_46&N^D zoEdscLhQy3LlHA(^)AK*e|YCD=gtb0J=of;qwv3+S>O5XQZ+Bq@3gRSLrY{Jkmv#< za8#AYv`6arX9xZ5q;WxSV2HwqMVCdmQ_Q#eyYBuzKCo}D`xRJooL`#7e&ar&kRDdF z+cg0V1i6^s9aDf*IvFGSpQtrvydxXPU@!@_JVlLn^>rzhe`27elE{+4d%>=hn|N2M z-?o`>a2}C?NTYov*DKw!7l^l8Dt7I;G4kF%7;JgA zbFRwUaXEQ0mkle$GVb`t>Q?fYbY_g*2qzDkSdHAc`I0ClwL4GLJkW0P8ef&EqZmoO zA$ZHQJ@A$q)=0mL)1pXESTbVxdL1{D1CWkd+Fzy(`7rUC+0Y&5;Jz=-7=1hwbb06H zQ{r9`mq?C)vz0VF_WIO)ferdwFW-R)nQZ*4G~zE~c2ub; zbfRQm538ZC77LV>9C#6YPsUTF(xXG&?o?|84`W+Cgv;6tL~~^9-XJvLCWsIv9Kx+v zd74Y#A%ESyCIs@h_T?(=&8SI$Dsr{b_xUrF>I zB(DJ;g=azV;0byLn1{YZjD{YgERyK zXxLsRP#x5(IiTA3t7+c9NRl`dcihL$%;YDXhm1X+=aX(#2 zH0C(Z8Qgm+aFGR@e1zDWA98j#ktex)P0=vSCOHi)_xb@t#0I|HVOmfYx# zrZO{oOxTJO0W)4GA#E4Tyot;7WUU?(s&B}=k_ExJB@?WIAdQ@{|q`6Y*4+>Slf5l zBE)Qx)qoA zgm8LL_d2B$q!kI|4F|lYT?$sJ@(vUB9x16Hc)BeoAu1XIkoJ5sVW5~gB=tv28U*n< zr<;+@0c$1TCfMyPT?*&&lF>^~0K8msRYIF4+DSn&OWwY}Lzm!y+gk_xTJLQakG6If z4@x!#be)}XHlY?4ghO1^5$IS2)GLbJEr1kl4zlZX-XsieJM-d>L-K*SN0lfH(>FGa zU6*F?^NH6Ag_Mahb|%p}!V%nGT&_VP{q}`Xa#uj6chC@O8;XMns;3OSvZx2i%CX;X zcbxu6=YzcC@3%ml=2J+O%__AwC;L%iGgP0S6Aiy~$)j#xOw*gW2pO%Hfq)?>mq)pm z`tRHL#soKN7_r|EbjqxacV$y6BcbX96QZ;%1d&tS3-JxeN$e@Yb9qr z$~%}K@UiM8gOLVvm?eD7R{UN^?mJTTg!0sDHU>aZADEYTacSQ= zf|DPN(n^=*pc*c>E0qpy!Bs`qAf)%|h#V16k&~X;6m(XTcU=Hxy0soi-4%KzZ=m5F zeH2r)>%(F@iuj8M6^<(WALn3e{)7FD)+3$ohcx}A9iuXH@PU@M%UkxO6#X=sfKcl^ zthW-{TT8kq`WGSr`)B88Sv=Wm73&vGrRRS7I@%`v^JZk_?~Ys{e|S%VB7n$mh2%)( z2;Nb)(C2-yLY=y+iL^#`$0)2ZHY&%OkKdwzqeoZ{aw=I0ysc41Y5-kZtnkhR<7K`} z+wuV;UG>1%Hz|4^c0+~8o$R(zI-*wa z!5`Wb8Qg_vOYXL9d7wPLZ{faB_9}hT^%t1*#}d)&Pgc<5{m9sRN0B_(i9`wLF-w!h z={8ay>Afe*ic|t7G@a`?OWan1JVVL(RoUNcV#X&%a|qFzbc-`&U-7rvJYOic9os-P z_KcdSY}i?w>!z+SW9FHgS5LDk6jL^4qbW65yN2IIVFc^Sn!-Vv`5>-RT%#Tp?8m!^ zzw-T~*uQTMPCj>9nP-7jq~#u!yU$>`no1ja$;?c2Lkz0EpMo zS(7j{B0UIX2}OjvIjzwx3TZENzVoSUhdn0gUm9SaB{*S!c)g*a-ZpP%t^0w$i$CGo z5swKjbJK4EmPesnvWY?w_@XOy zRvxMg&H?dC23`tg`o;dScY)S+hvfC`*!F#7`1-I@A`meLO&1#L?UuMu7K~MdS*$!T z@?PsoP^8`DSIHU)rCPk(=~t;~^h)zDg<>=3V1=z1Gb{})!09}f?^XBd>^ z*cO7y*_5`s0(w*94&lohz)%0q+26k9;jOhD8a zWuCgFWZtqPc3<0lNUq6cbomYYiq-Q^EBcE*IUzsB)gAJ^H@aYkSL{=mzCW(7C$|s4 zmcW0bw`a(`7fZvCguW7d7D>*?Y7xDb%iJ{l@^Ij14m(;CBL*e}#^=!K33v^vOcug(hk4M-saU+-~>H_DF)S!icJb*=;J zgU)2pwvu~lx#8zEr6qHtm@!ZK#KdLARn*-9C^e`88?LdowcE`XG!^eN979*{rS`7a zS6FKQw7|Ra1J7b}%I-g6*QN1^n~o*JT_4WP;R7b)MDaBF$ z0S_}YhMccD@Q62@>GGYmbQ8=l0z{&5V8CnlZ#O%*mn7UQxC`(CAnt<#p>D=mIvnF) znJt({qXwp+O3zn$;Cjf*M%G^Dl6AS}P!YitcWiB6s5Qe9FKuZA3X_^MctwXw?r1oZ zJ@?^y?awLbD7b-4$OzG!Ks@m&PSvYFJKBewH{o(z6S=nv^aoKcNw4kthyUI~GoA=; zWzMi?KL1SiCUc+BZFW>abJJo8xYk62W_HI2xRV)!govrF_{T?wZM=;TqKWO3FPQBf zZ)bt|O{)pu@@bbPOi}oOr*UBTT;*}f*1}=s5L#TVIHij-s0B1$%(=|ESfm(7phAQ} zP?t1@D>U4+G|*UVr_hA^rL;k%S+OY|C)t)5W1@Hj1hI_Pp~8>L6Gq%Mm8mcfbT44t z0lC@wq)5+qaC)AKiL5Jk;9xvzBn<01bYPRQpLyd;Lhc#)vf(-*Ca|$&uC?>C8fr`Z z_;i^5Vz?tN*LZ6!FuB_t?~DMG(kZ=bP(=9}vP>99gL5KXP0#S}vapbL!wK1&lwYku zQvCvd6^&?@5pc?4o#8e zB4?br5++D1F2pv+7Xqp7luq!bpgFH+$5IhPVe790^m%7Hs?bkF1T=g$Gh;9EF;KbC zFEkOC2Igmj^|D&Wd*}*^rM_uX=yTq$DLaRX*9jIwZx@5!5G*{*dNy`alY!?^}umZouc5n7eWIT|f(N zJf)S&TY7P>{lhV2`g{U4?y=6!3=)kNvV25@k;)t&pU0!)6eW%;Gq?hZ- z5A_gT3tU%UW~|skojW$6H(Zbup(hE2ZIhksI6bV0weoPU zz{C~{7$l{b6C>*Rxq{IW)<0?F^BP??)a`B6*~Ggl#b0FdW&Imim7ZniIAxpz>M9aM z5YdpH2_Ci3qhg>PE^ew8V@yV@ogF24-Lm}bz#k4Qc{~s`>6)1OB5a+e?Zqts4Hmou z6JIC};srdCv{Y-oJP`15EAT49@1Ec*7Sgf5A5q75@6X+EDp!71)vqL7^nP4GIzvw> z9SUx);w>j^RW+(3b6^B`RroCRs!{v4T|%;xTKoG|%R+n#9ECW^(J zg5?s|+!1w9#@oO9o~PMM(bF16+*Pj*G-g-qHOAGT(i>8jFT|zy&JGgzPt+XN08X8O z*)n8i9~3r?ig(TAZ#o2m+3_xhH`}hvYgB(*nN2#w0eco;+6*?qSmc%sjwl zymcL(xb#(4(ATB8);WZ%p1Vx$Mv?bm6I<8SEX-!H`YOVyT3Rcw)Raf3 zuvCu67S5+`ZCuiGuSpJZ6!Pp)p*d#rFO`hT(!*ScsB8BcIKin#mRSC%61=X=^}I3N zCuFFr9`U;7V3q zMcCjtwSzb7>Zhw#s*+5T{e#tROAO#eWi3Gln*Y#LhR7iFyoe&F%Mhe(=WYxtIVNOK z4VyntO1zHp$Z(OQb{M(tsMCnxMh^E>BF_E3T+V$xn`tbxaBipqJswJ~@iAI_gUhiZ z#%7KINTI>%l)1!BbIDICrR8J2m? zZa6tu-qF9H1oO90m3HkkINHqwXP1eAB&y53_V9Le$RAg)MJ!(^xKq4dgLb>6HOBvu zLOF%E|Mcg-T7$_0+`L-eIdkgBD4FBz6)int$4c)U=K#F8em&u_l?g{+2jIgIZGHDW zT+s3T{!O3@vZ><#O9EwL_`fAk=Ko&_VAp>p7uE7>LapH2pW|48tWcKY~-{`zsyz+buh0KX9wfiY_Kdx2=jJB4I(8!B&~sebvy$3{&v zKj-aWT%hXZpYO**(ctA1VK>5xsQTyf0w6aNg$EPCrKcj$ zrgAQ`-?G^>ReO^ZoG#v`^)71aUH4{2rP!`sI0O@raAo0SZRuiJw0D$|s}?dGV4RjF zJAWohMx5`_zWEhVB$==DqOW`XbJQ!VF%Gc7z^ym?kL*#G{y77Owp8)n14%BrJ@e4b z^|V%SHsb-pBHJ;#ZmNE|tdmw5(aXx<@T~w^`Y`U;-lpV8NQ<;FLI()5Lte{n)8}ie z_$0UG$#TN2;hQRT5^PXDv`uet{g^&&QG!stiR`)^s9m%=4LIUgFA7HkAk~88onNN1KL> ze?Hz5bX?0;(Q=M__`)n~wB&u~3KIpSd=N-_l6Je-pph{EksBDV+2_z~qlvlUTm zht%uO3>=Xj;6ERO82%D8CldQ?k-8wE2aN4phu;xE`iiiMV6v1(k)9r(D2Xw$oEvwu zQ_Z#_cvP-TM{ZEZM6HVMR>!1n)A_n0pUsYhakH*6vnR-9?%x# z7zy~}+&Iy3oR~&yk+VvwR%@x7fNHTh6sI>j9QaGNOfPHxXNdAr&i%EjJ#aEIGTPOA zGMZ&ana!OD2k-j=`KWEKgYOCIn)>py7(hnmgKL-h>{gZRU7X+n`F?qZ|u!!V=$7B;gHFE&(egBqBAFgvP@me1VjDXcZr_QHU4VYyps%zXf*MC2=NNPX;z6h&$48KZOidz& z&mov`Y~FntLXBff^KIB;nCsAYJoTZhc0}#_2|beb)*|Xk>rof}7PzdAbiaHa;AVwJui>VGycoNG!Vx{RujYO2Viu0C{-Fx-A5vMO^ zM|_SWOd1tzQ&2}{2*e+tKhH3>TrRkqv^U+AcraOX?7?gX+@W4H725!iwU@=zJ@#-w z>8kgeJGJb4(b0chDP>Kn%REZ%A|1a8o0DJ5HAq*KugKkbbi)6@9r)E&C|G_~<;7c~ z<6a}@DAkg^g?wmG?EA(B8lpDpR8!bolpCZ>vTG%u4UA7AeMJ9!*`snk#_-*V- z3I;$xF$?e^Z1Su3j%#PgrFhQtq$mD}F59H`PImIZ&$f&pZwy1vUI)RG%J<`F;9xK% zG0c)sn62NiL}_yGTQx~#4eess);@ZL3{5UNQ?!O|(gfc&t(eC2xd3c_-2ThsLzW^q zvre~BoZzS}E~PY)tiLKDt+il+W)c*%O{Ft%Qf~=&l_U>4Z6+0*trg_K4Z}u4RE)2q z86C6tGll0l!!CGc?^}E8FDHRd7*FBVlv!Ne@f6^GaM^Wdp^^!DKB9r&}ntf?NP9%`k>R9mt4M z!OB7*m$Wa+<8Sf4i9*o9AHZ_Djq@QyY8rlun~-v(H!(8)drfhhg?O<-%CFN~Iz3nj z_Bh`)!x^(QZhrdqtT0fKW}CU>+B%D`Qn6T6`=z@NV>UmJW$S)BWU4y$ne26BEOU)y zEUTU`kYg^F!W&^Nmtw8`r8EmbYMz9k>R8iMLQ7$+aoNl_oG<_O*Poy(a^#k#CC;Oe z(mKV3eckx=KZ1fX9F}dY4^KSV-TMfcpYAR4cxZu{{JrSF4h~8iRE|YVIHsmE=2zXp z!5FUk@>%s#va~J|+9Gk_cXHEi*b{lkhee5*Buc&WTHjgQ8~yds85Y6x7DT0+5u;)0R*nlR&{)n6~(6qhfo-z=71OF&oaBJ9s^p6mYzH%1Z< zrG1wQ$?YY#b@vvQE~+$V8}ikFR&JwsYwF_Mi(&DQQK?O)jM4FB6{TsP zvv-13XpM*d{pFg#MgyrO7j4(hJ3Fv@9lWo{IL?Ry)K@yKwZX_V6|A~DPgLPPe>wyh zXi2&U3SE?it?~^lAv+eRlj9#92*0eX70+w z+%7W2_l{D0HVva$aU?d;L-X5z#DSB6k&Qv|`}{Lg&!zdFLJG!&_m z`o{??@TrsyV)6}_xFAdrK96*o`wADT&_{bG{_vAO2Z1PoEH+u2w@-=x?gD>4R<7Sm zXZB)!=YUNM4P)SQH|!2Pk|yD_qBg_!9N$L34L2tf-YS(EAyf%IO^<6`j`z5JGMw9Z zhGN+Wf`5idhpX{+`-R|;28hu}-}#2vbNg8)%^S*gVEE{WyJs0C=LC$eS+mm zYc5bHy6Cq>0RV2#qZuum>i#a)H6R!auQv`Z1<#nBa9GfU90j>s`)K{0~3{eW7AV^mgPSz zmb!*f94Q5!xHr7-MrQ}N86ZEkStQ;@xMfSUQ+kMPPJ?oc&jP(2et;3BJ*E{bF3I^PrDEhX6V>BOb^_K~h~J-nX!*y18L{$$(#nC=Qo9P~;@6V(%>sf|OS4BEgTq zJk`ZHMb2Cyzlj7)LzLsFPn^7zkfQYv*j(vV)Y5#4&)eg{D$IxlxIDSqqENjT(>B$T zV2r{I`h!GjvEWy|N#sS~ep=Z9u?lHPO|&IA`&;rCC@Ih>>5oR8&!9 zS|FBq=4Vfm1;dVmj{?3OIZTRQ7$z71)OGl}e?pFmpc^1>5&-XvXMTQ`TUY{vxDl3i zwvMwGOFnz^k56OMeKpI zrPra)NbA^cnPz@vTcQlwiH!M1h^(%Ihg%|hk}=U&)}G){sw)OEv^*!DHq0h5jU(L8 ze7i+uUQ$=z&T<7p!gzq|UDqMD+`ygbORwJe-v#gqZD zLRgo>FF=1uS#(!9AzqFEPTOt2n+pRG94OG>WO3<%8B`~} zT309B%^W#egJjPML&KFJWv?ZbFje}+jX?;ig8&at`uk%8erZMbul=BCHA;0%SHq^+ zln_*rS7lB7Ger*u8J0>~$sFTs>+L&SlNcJ_v4bpeO-A0Te=EB?W8qyg{j|)HT*O>g zVsL%sWo*t{hNr1_w;AR2o{Azt%=GQ~Pn(Y?(>3DX+*_7oX|p3ke7q?1bl+1df`ir{ zW1JS1ni|S%A>v-T!V&Smf_^)xd8cyFr5D~5TDrew*f|YFvBbptrgElr%4{kojcUww zbl3cX7hlP1q_{`tGXZk7`*qiSoe<4jjR(18U&Zf@prVyw{@of5X$zt2M=^&H(d(? zRB_SU1G^SrAQs+$^(0Nd>zBv7(h8Ww5Ths1QHC`?T0E0F%bCQ1;Vz~Ox(5`ab&3Md z=tbf#Gl*C;d5tkZQs=(vtSmm5)PF%p*Z4rsXAkqs(M1Q)0TjsLj%o=A8H-ZAI`b=e zIH_FEaUw1db}B58M@MSc*L?yu)zY_bk40;xhGl4U2Xtqejh}>*J^|Y+xreJ#(k)#G z%speAy%r_EY|%e{{i2W(5+0=_znf={5ozO|C6kAY<Mr*Ejb864E=CD;ElK!rxvO|i#2r$wVzu+$yF0d2qH zdV*F6d76MU-+B*DK&?=ml4$IPUSqBci+wgb;@<3Xf?ISla+rS>sbr8jQtk=uE+Ey* zQcq~7O(`oZ!?r(cQArZ67AaECFudH7_&WGk`yjJT`|7}M6}|29 zF9$ww^X?RY3pdqMYHETiRBe^uM;tD4#9Wf2*NmrgYIx!Ua4d64=A%6YPO@Z)R=l#3 z2vlm1rTQ(K_HXoxbA3QA8KwR_&i;n{Qz%XH^%_}`#^uKm4=Ie?w(c}qU01DRx-Ijj z_bECVym`@4RO>q(Np@FMQ507D378VCVhk!oRDjx=U7mVIe$0zlmgkBpP6n`oueI_F6JQBy?*o~we}Drf^7 z@CMrREj=|U^hz=178hdjwXk``JGWPHu_5=DJadsaOt|HA^!_3^gdGt{_vplDNbzO8 z@aY+j_(FPWarKF22dFdTL_^FCymxX{>dE)@PiI7xsDsUpJVLg+vhb6CMi6koLm;}l zN7OCXpF1N%>z|OYv&jj<=TYr!ap&KbOx!Mo26eC(Nm4|8>>bKM(#$2tIC$g9xl)vE z3A==%Yj&c8vR}wsh1NM6h}u*a3{kB5Y~xH^-tw7eg9v~>mpD*knCITj_VDBd&>t&g znQkHgP9~tD%3B7xa5^O*c<$(U4*xBw;N%ezzwY&Q2(>>+He0;iBhg>qKn;}tOg#?E zpvyH=TEL@ow$0xU$k!rM*K!9hVyO3|ovBWyT$**YVW;M(G7YcEkH0TR6{qQA+B7_5A{44uXPdCRW4F=zg~o4Fa6Fm{Lj00dJ4>~`rFPqE zJFbz_p0@4oirecYH}JSUyz}NI$ErrYNY0VzUjFZ>CW+xIO#i6(zS#p%-YN%wPX2`| zh@B2Hhv;tJB`)_SvL zC1S^jACX~)j~~Qj@!w-(m1CXkq3qsYDY%~r-`~yc-;WGmZ*(pR1~G)=Xa7xbe-*D# z=VbBb{yf$Z&hMyp`;0e?&ftYA3|-tTR2kMS_=;8dpq_oVjdwaJ7}F~fTE{Rb;U2!TC^To29bso*kU>#Y*ci8s^?R!*Bv_$j5L;`^ZUe1|&gms! zm@Aq=zgTw5c1U3gT%~Y@yN(qp$?H^UXrzy$wV?^8M*(PcW%$*IsGOt~>@lBw7y#U1 zFi>6W{K3mrE34v0CDbMqRkc*eRSps6e6a|-_aG){j*ok-O0kWIiTDU3jpm%w$}F3m zUBao!z2dm060j_*=T^nKC-ZF_(gckPJ5eEDDQH{hZyozC_7r^eGDv_Xiy`z=zy}n_ zTFa#1ROkO5ZPdaU)10eqrcFOyam#D-p~&;Px_~V}Y?n(Z;WNh9%1VYM-VyK{x8yl3 zrxrp-J03khgazvaZHqc^#>p|bUd?^zk;li=>%G3jw*1~L?cg=v(Q_ADVXNzaP< z`DxX4!Sw+)j89x_TQ^faoksQ{&v@rYz8KCH`qE~Z|FW+mM4omP0<6+g#dfc?hXpef0F1R~ji%0Zx)Mvf} zJqTA!xuBL5vy>58tu4Tdcp9;nOBbwYLrM{2_CB0>b!k<8v}_W!u7G5jk>%fP3h19K z!XyzbD%*$M&f~BMs-tX=lj$bq2ydb?6PD=JZji7+6&C_o8didaex$7Y$UkncB`y7r zP#3^7k=!`v$qnpan+9og)qYL>O)k}5jg=CNviZan6J{yP_ICW zt%q~ypb?4p8*W!og|93Fi5=AP%51xTVk0?Q5JGf;C7!d@#Rr5>IM`Wt0R2Nqm1yWa zhd)R|M?AK{lG3YNZdL(uDHM3}E2!eCfCkW|NWix$j=PVforx1}=F?f%AzpdAv6TO% z3$KG9*fs>ssipPcat-%E>gEOu+btm5=_rUx7G(SJAjcqkE}MnK_Z56e{WmOgPvB~RFSs8x^|V?qp>wFw zk3*v~{sAE_N*{JhYkwSy|KWQv5k$_n_YuUUUFaaz#g@;LNQ!#)fq<#XNCA<>VMm3I z>(j=Xh#6z#zgGh1FG>z`?_-))$s>jtN|*qqkv-sXmH#VxO%{88UUwz2W-tU!_q#8m9#5v zV=MQkzsWpeRNS7#g(hCY*$h97cI5nmp-5E|g4snM1v9u6+Kt-mr`L{Mb<-^_LObKm zdQ%(&r2kJUqb&RsTB{){q~V0YIKK4@p;R`WItn1j2fLpGUCgrLn8%h^QVmy!Lf7pP4i5mqubajB0xmp|`a5QvoM$|dS95!HhHPR9 zlW>JG9BO3!iKrpSAStU$2FV2X87nb=kF~c0QKM_ta+dciENv67>E}fj{gPCjRr|dAjKps8EngRg7Jz9x`=G#fze1hMBc9>hj&1NKBXwoNL%r1q=OSB-`L<`ZmMcka`3 zv#MD>XKxIWa*~-YH)C<1M142p&W?84tCj!3c%Dkv9B)I|3hrQmE_ zWag~QGuDly`K)q#bBugtCSNu+8A1nPPjGQz!E?)*ZU;=*urVAG!#{o&ZoYZIHz-#AChpRQ+_ip&xN5PUtCY z)-U+*#~dNZ&c&0XGKF9;N_EhmTwS0;B4Lu!S<>3lEmg@^>+iX35PC^Dh-xw5owBd5 zm_os_?eYe~l_zRWZktz*87^T0)}u#gc&>No=vg&N4#Ux3BsqdA`?BDOz>ne<**0)Z zFM*$rfk7o~*`M){blHr-ft^X7c_d`Vt1XvKKq^5H+24W3U8;X5LbV@JP2IO@1$Fyq zjF0mSfoTs+YY*KwB|xnoJ%B4vghT;ko^GqO*Q=>(WB$1LkA2D5r?eE)`brsbt3u)= zbNzr@@lXpm!YW`1vi&xC!)6(Kc_eM#az#f3^L%h_b9#||Oq-JE zZ1F+!qrkBISO0DNs>xXLFwI=a+A#mhjH=KZL?j{>DY%OJcO!aotHte}D zPu31#tU{N;o;$W-xSD1erX_~OE7!(Tmi{5ZmiOCflz3%P!dyun*>&{W5rR{BBJV8Y zmD9&DSJCIpwrJ`*H9;b%SMpiS4-WuCuO;uZ;NM;|`k)Rt%1^b=|^{SI{%IE*&(_gvhSozo*{Rh4GH>&L?BHz!t_Rpu```L+cf&m=i=-CKs z_n7f=zqG>Ce8t(w0UjGcQMV;R?fRy22PMi6>fQM@qjzfV3(3~=+YDQ=@+WCm9Bt2^ zdH!(Vg}gYh;aCKPcPD8gC(Qam+Z(qR`4k9IDzU`e@@n2#$BAl^bAMenf+d%qlm8^t zw^1}44uB0LDme^MvDIJ05S+F>$y?9x44D?6QO+S9A6&b{%1)^|_&=#13N7cxupQsb zsOE=#7N4J&$CtB}6UKzZq(%n$UqW|$8wZH&Uk8J^J43$tr*Be0019FmGFFh?zb5Rw zLLndU25w#sz;~lF{ns{~BN7iSX&g0TR?YZW#_=HFmRO~7p-`(ta<=ppe51 z^5DC{)#Ezd2TOaRy-nhvD{UvjrQ-Y70_w8n92HpP668Up>Y!!C)scPI6+HtJbCiDP ze`VHYQmn{!f-OfE2rmfz&9j(ukHoif#y0cZ_cKsm!HV(%B(dx6`@G(dhS#v9DVf>q zwu{gSC3dDQAjzGJ?RfiMWi8cOY6SLS>zWcJy;0pOtB2*|gPI)Apy#5^fWpcCMK_GO z#5$gWCI=-^A`eN7*H#0K_06gr6ch}1Pl#qsh7W?~%j*y33|0sef8WoGT^j4>WrMWu zX;O6?`{4pVc8TkL;cW$$pA*tpn{8rU-_FsG__Y|5LT-XqS7Gt+hZL3JvvDZ}H6UnA z%w;6UP9&7ccuwYIl1IH)3V`B~W7a8FPsRCWw}?fjpp#LZ+Y0zz4D2T;csXiYAyyko zSV{&i_{px8i;{0pbFPLK{KZa$6UpjqVk@AhX^MZ>*x%*ZvE5l5G~FogbJvJKi>I=7 z!tmIQkBhfA+Da}TWPw=RDX(kZrxBKaB>3rma+{4v1cb|b$@SdsJL+9=xp1eQ z2Vj~52!tsfCE!9RgeE7MhoZ7G_odJJ-ABbTPPs}M)@Z3T+2x13Rk!RJ=D91|j(;=sS#t11zse`CZnV%w@j$_r{tfdpty6 zyU!kl&ABB3ya$y>UvT$gGqGUeEK$Da;nHQ1|XC2q8z zzAFh(AXA)h!h?%gOo5Q_>OK2`j=O%{&C)eIqj(Nd~lR>@am73@920zSCSK&g`QC-^R;lepfPoVPzh*f z2P?9tf<;DhXH@cN6SpAY)SnTt`P^XE>6!Hqy1!U3r}N$Y25+!;fRDs5r2I5PF0zEm zjOzTm<^kTyKxPRIlp+h7hzz!&+a!&%K=H|`j*l9$42%OrB=Xhsn#A zF8P;HPEXmJL`&C3!ZO5=GA$b9yyqlV?EmU4mB}ViSHf9oQ6EJsAe$2^x=RTN_gsUW zs+V}lfZ`=9Ct&f;iNra;ExQmU`WGD7P(Mmz3A={lbR^fYzAMlHnhHYA|Y6oYMF zd8-F~JrpbzQ$jo_SPN2OCwE1*hVWE2U*Ne3aS{OqXEk@JNcgu`3T~+3=pu`pYq<1V z`HeOj^|9P{FkXhMtOE%*>Ms7B;VskNYxg+Nkl(h|8u8|G{Yzg0mflPQnb!WDsDo)88jPJ6wPdzegK6B;OA*nyJVp37q9*?cD{qFfQo4=f0I@k7n*0Yebv0_T zKh-qoAJv;6k5QESzTiWDVZWW&ewidB_E#Bjo2iF_8eCfD+nxD{s4rnHu_cxqP4SA@iUJi`zW z&$#iE@gc&|W%Z{_Gb3BC@YEc%6Dr%d-~x1y^&xpx5}rE9WSXAO?@OsOZU2JHSr5Zz z$(#GIhLzcaZiOmvHji6KXS}c66}Zm+*2SBi@$y=VF_-kjyaixf;@~OCM*|PllPRyQ zrD9N}_z%9b8B_ob$TfyS2p%%V?PAQEmB-pp!erUjJiiIG^Vo391+>y_Jc^`bm9JO~ zJl~sofMmQ;%h5xtZbq$dk)yDK4(b3rYBxst$sfmTkCw7ci&(TP*!Ah{VvME;U%jyK zJ;sFsK_4|435q!Vg=}2h*s(xwApsTTAVZDi=VV%Ymyfw}>Z@z%!!YfPt%K@oJLO01 zhBv;Mot??bL2PdoAMw(RO)Daz>I`8o^56`j#uC0|^9u~D3`2Q~<#Gaps^USGwfxKPBj<49jj6mgrdqF z(9BD9>vtTScPQyVkUe_d@ras#Y9i))udgsm!&EAZ;neug3hO%4>w4S0)6@hCxE=D; zcx?P*w*#3ZrsygW7*#h^BN;C(%X{run`WBGDuo_vkt$AWg%_R}*)>ThG5JGsa(Hr< zG?xTD6KGGx15DLRt8VU>$=O+E3jL#nDyq6D*uZ7qi{p6*(#SZ?&RB{=E!@#(nsU@h zxT+l@26F+NI6I8z*JesPbStgA&Vct{6NJ({HHE_9Xq({`xa@x~!=G*s<@_`EDUQT& zs(5JcmjnAGqTF?w3j#Mw{oqRiYYBj|M}2M^l|O)-Tpj9G$0~`=F6qa@9kH#w8bU|x zBLuN=1b(;Rba--hpLsJe@J78+=3OZtr#CnSXE1eAcIlvaf%7`x zBGdF!B!gd5eJJL0^7*XGtNZU}RjyC5fYIQsgaUx(Z#dluGCo~y#z#UpzK{A>_P-Wv zXlyr^^_*!Am4{trs(5T+LqbN}2Obu>G$9eX|6#RtmGus z{!xG%@_t@{?HcWqTe@5Oe~i6TcWB|Zw3}qcwr$&-v2EM7ZQHhO+nBL!+dSD{YX|$Z zb+N9-Kj?4oqpF@dptWaLU*21`Ct!|(3!|5t@(C&)>7|YPq+aQd8Wpo6vH=Jp7cuKy z4!P9my7I53`<1;bN$;je)g7i zb%v!8j}F>LMQJ`QBL@zP@k8nEhv-Eg#N2+drIBmU&Ed1zdvEAY)%)qyvVNMGd-GjJ zd0h8f74V+xHjx@=@5DS1|8Y(8Vr6o}C7d{@q)WOr=f~q2B6*Tg6YXl*oWoO*{$6Fq zu90>1yR^$zM%audGlOZ1Q*^%8_npp~T_x^6{9$ML?}!}CjI95Q$f5C@(rZEZ^+-Sd z8LShFK=$XSgJuV9Xk_ZdkGwupVZ9sJetl8&LRK##kA9!gBI+O3a;|(MUw%+RDcvDW zBmNHjJz~`9Q2DxlBItYudVOtk_`0Nhzc#r2k##)MwwKR9O!A8}|3cJRcy#_eC`;6# z(cG0!3kR1fysGanXybc@zD#24(A^zG&O`Q&3kM7W@=679Gf3U*6Mkbr)CHNQWaBiqeBa$^cEyiW9;LYQ(NtDLokhR@8_b|7Y{ot{DW1Ssi(S$em}#Gh^@v= zi!+J}HS9?sbDPOCGNddn`5f=J8g{b;te$sV!8M0JyLyt2#CKw+mnwA*^jQhMpp|OJvgZ>uJopkLv*8xOjr%RpGh zQZLbC!y)IrUtzC6W}o63pWx=!p%@Ppc(b4$1S#5Wt4vXMEno@Cglu5(7zpLlT&JY& z)W3`7Y+fINObu%j&d5QCNEDxRDDF(B4^@~ut0BLd(Oiel zA{$CWQcYj>%mvxyLu!R!j@$xkh80pB(((^uf`QQdPJ0~TIco>?)1G8_DtP`#FMifs zLI%d4=-CKGpS(&|Xs+rb5D5+lXwH3SMAb1Qm8)D-jnFe2x5qU~pP&U1B~U}6oBSVS zrXZ?Ia{L8cpj6a%o)LZggi77gSa_*rb{+G~Rg)lkmI2A05ez-YQ>f@k4Jd@@5Klve zLzCp$vfE0N5TtZw#>T_!SO`Ub;RG>p*Q4~ zm1DZ6!W~GMF#=;VyLCJS=F{vW2IjEIOq_oni91M`^cY|Ol518$=Z18n1Lj^e*}{^r zL+J{Rd+A-82>VFvMtDB5;V@VllHMw!!Tkd?)RW;HTcT>Ilam;JJ{);k-087%A9 zIGK3K76`GJ%Fu?I&MXhJnr~Y?746;)DKA=XM+XXS(VE+8`Eyr<%qh}!c^%~ghusbt z;42E#CM<(R=M*FI>efD6g89)>JVZjUma>^)b4L~%9qJB+JfuH9e-&-~OH>R(jx7C3 zbWEINa{P`BK=P=#VVGIW_E4KoVE35*CW;Z|x&PgOH)CxgkVjJ`B(D9jZepmEjANw3 zw>fytRh(QsbP18ubKy);4uh%PVC+i!GYn!CnPpWF`cV{N^8!_FIoM{fpEOZCxT*PI zYq#Lo=ctrGGgb;^))Rl!29C0$rCuK@F}tI6QPDG+io04az&wd&QG2C?K$`sCi(&mV zWxFnU;!p&$OXj3o6{XUFQ?9B=VMw9;p4R;}0%@7D{F^;{YM&cNy?mTsCr0HW&|zRd zbbCN)FkuXz-Q|Bgu#V@tOWz%6+m+Yo<4W0NTaQqn!ICQDy`**=k0-cQDB;?x=M{@^ zdkJRAuoCx|tWVmL*|A-P0=WYSHUkQ)Ua>KVG_NmdO5eqzp<#3HlOx+aI)Agb=FIP>{5$LHdhkYPB^YnnVIlC)TrjuECMra`q9)zm>1EGCmYtPpJsba8x_F>r-ax zqXvzZS2LE2o>05n<;v}}dw$|n0lqiagD>FeBe}k1q@H4E4|~ijaK)6)ps9OY-ntH; zuf>LQ$}`6*Hi|C7C)Z#jRTu6J*r65E(W=+(QKB}6ZV*rHiW}+zewRbbjNvFl35wm- z_PCclxcm>ZEBo2f?@#FONngOe?Z(Rgu)wi0|2H8w1}3)uy}+q;)@-uEUp=6_1I}Uh zK%i3s4S~*cv}?y1yhunOp~)of{F|~9i~nfr?BS2-Q@fDZ=l++zC%4cFK^py|7hw`X zP?=P^Qv15g^!?q|@%_r^{d!0?OL+mkFv&Z;o4jNXREVE;X8d(kxD1b4d1tX@aB2bl zU44g%mgniF&CMh8d16)7&y~$Aq!lL)FBBKV2(kaq+)qd~p^kX(?wVM3#e{ID5g=wK z{mU)3Lmw|&FAjz(sRcsy(XD&giqrBeW$L~l+JVPgOxgY~U5`2<~cSen|Y zUcF+Q*ue32c9XJH#=PyDtpz?oM)l$=(<`I9J@UJ<9bp%&=?Be}XDNb=quxZ*+6#6c zVW$lNO1!rM0q)eM?ro9{UuFwvS*~}P)$x#nPAFb@-clM+9q8!7$3lKmhtoYvqZ+|r zaX(K{irHiss)*(9qg~d<9?@rV1j)+<(lUoO0i47ngc4JI`lAYI6cBfGsly4Rcny*s zR_|SFaS1ryN{*qVS9c|+F%W6LA>+ifOD;!nXN@1~jD>Mz&;a~Gr$a!n&3U2X#eHnI zhe?hn0@PSm49-5uGb$E0ws|Avo+peSV1qpRe>enGGW3@;Se8Gk&2>OPh}K)lcsx;I z`YuJ_Zu|`6jQHXxzYQONpYfk+kJidtt}H{;chgvH5TrH__B0SJ(r1aI#K~c%BM<>w zcQoT>$mKJ|=Z<5%1*I0drKHpw{qWX%(bv@&Izp*9K3Eo}lhrP&t{DEv4kc@6+3Ycc zHj!l^l;Juf0!_gX7aHT!!n>;x3?0M6@S>e6cdNjC1<4L>qW<^vvg&W+Q zL4#CxiQkON(Ums`Ny4Bt4jV0a?u3MTELV%rnNor9!v6f+zl{v`#&AGP4wSIZh;!~T zZ%7bZ*e);%9v_nEbKS`$3fAJcA9H1Sn_h0i2XNn!Y0w5*8~Pp*8l-mcqj3fBtyw_1 zLKptqY}k)BXU}%W_Mq49VS(eUHgG`!x-`|ly&BkA{bUq<`V-x8#$_V#s6(P{O1^nm zR8P%L(@;*|f?^fb?jh%*dtC=;z=vN$3_G9wAl!S)I$0Eck3ARnTLSz&*QfAZ$q&ugN;6{=rV z_P~nw3^wNDd>7)FzCCxqi4`}4`)x(m3O4*hJrgI-3D1&5JY9NyNm5$9&7BTt;raE= zmNlb>W{bUuP`6FT7GuwF7hN&(axy7+W7WVn;=gGP#xh1EFHC_zDTL_MD$fpI_TklP z$t90iYg93S^ic7%WtSbIRj3~k!hq==08Y_JpR`B50&#w3U$$U9=m3%2P zm@gbX1)?hBtObN71HbtWbaKbO65>y^s{n)cw`D;uyKK+!OKLVvckf?^(ThrL#}S)~QtIlPtDxByI=!9bI`o}rP#iT~2hT$%OIu43Eo zN2YiL-mtuWo(S0DIJHqgdra0B5_5upP0$!Wsb}$Zak-UuTiE(>^|-p{eLZmfU`vGo zt?0R?z2q8QIMhE257p=ep%RoxH+OT@CGYPImjKnh+(H_|4ojON_3&K9xt z!oD|zSo@DFbG7MloWJ>uCkml=OnqKL<>(|*ZV=s)wl8*O;T+^Yl&zQg=hG`$qo?t2Sw2%Y$zze zT5%2db$X~0>hO4#00y{?LF0(9JE%F`Ej07pIDIKMj~(8>LwXC#`DjJiU+1J(#|KG8 z^f8hjZuV|5x=IKl&+xdI+~XiyuYK=9`lO$ZSymF|r<+AOuevZ>^H!6<27g+vC<6jhLmiuS*U_ z7FA;C)=ztV4pq8!|0Mzjw zO74-y=+)G}4bWvV!~M~yjbSaSIK9v9jwq+>91#yzF9CY>sX>UYMOtMZ4i?meeq??^ zGl3vQOh^Z&*$$l4=Vp1L0+da1;U*<9yAPgdg9i7BXV|l3SqIw0K7UsQTMrIaKPfOI z4@!Y;e)w+=tn~K`C_1$-iR&4Nf+}o1~|}8=JASXI4aoYoAUN{ zfnLdN^@OuI1L)`tDd?|)nN6yH#hi@dVtnj~%bMeZ1sF6kr{Y4B+!)Dhavaz;Ib;59 z41c}rhmW&Jo1wF-i#-;WVl6O{O%utwqYS;|<^4s`HZyS5sK;_^vj$Z+nNXiLd=5jq z!q2|yQ;Ld}-JDo6s;Ede3b2-)Th8bI(sM}lv!|6=4aQZ6D&p+7?7syutf`ZLVWtco zlW7!FXc#MRXIj%FSUEy8K+|VfR5&zGzRjaOzG*nlv#ObxEm&URZ9_aIzDWgx8JV}#1B6%ibMf2@?lZI+z)yTG~$~z#Z z8uV%i;!rU^D?5(u)f_MB)Uwq*kiO!WwIIEy zOkCXku<4e`-U*J7$H#AdbSu2NE>G;2tZ9Uy;pad~eyC*!r3Rr8Wzh#aum1-jC^57W z?PEql?P!M<^JfWEEly!M>`o;@<=0uTh~w|1fP%jbq(%f zm5#7CZzyyNIq?}y>)J|pOpKJ=o_3^;r3B?5{~Tc|NBjVSYCSR&58;VPvvDSI zzF5Kxv^IzSV!zFFAC~Nv+N|WHqIy9Qc@hFl`vja#C!)*vR8Qpf08MDO-z4h{2pstEgo(clpMLr9BN_%w~L2EMN!a7a3_V^+h?y=qxD<090 zqx+$O=q!edYw^z7PkaVP8k*RsGv(v)ApyrbcQSeQe(~_QSD5}6l8#5}--i<*QIZo< z9zf*6!~05Nk{%k#S;b?(UWC{ViS`!I9_}_O67Ijd3lNm~>?{&?kN!~qIM5J&Ug)CO zl>bA0pp2q-dP&HsF^2H92AREM+q}48X1nZ`x9r#=+3orK`ur%eC)GkG=-Wud(iA81 zYsJth&ezm{&|!V=x_d&|C+_9Z6=u=xl@@qgllnnb%8qmTah_j>WU6%f`S*D8_{JSs zcl0n?dj0H~h84uXDI3GQ29lK4e{?pjmGcOdm2G3fZ>x!PfogVRr8B$S*=-50ap7`vHV&w@N8|K!a5)-k z9}N}oSF+A6Lwp}t1?u3ds0k(F_Ps~?13_hHph7SWp(bSB4s--Sha7e#TaZF$rQ>AO z`cHL`!ox?@g%|9MV#v#gIDKRYud7}hdR(@z-Dd{w#{eMjjQd_IdAEP!Nq`2q=&T=# znU{ukv0d5t)WViV`Q%FzC4*#`tVw3_&74UJ0c`|=7EruO^XQ#kx+|gl69U$ysPO8V z|62)KHJyw zZNp)I(^Z%sO-V1!d%4UMznz%giaJCRfEy#Cq4r<*Zd&HZdA8?e$tbGCSKda>9-|@5 z1EwKfT?|G-LF3qE@^tEU#dWV5{CaNX(}4v~;mQY*i9DWm|3=-skZt59-<1=l<%h0booP^_K1OB4qxQKErjS^+-9UiXn=FpMH8Z6ZDondc67fF3{+KG%zBH{id!yxbAILN z#9fc0&vw#(U9%5^J$Ur}1N=){S2D(}4@m(El>62PJ!y**ut`=J!lExKYO*X@D#a_) zz`qvikddYJ6n6;!=5hh4=xC`XdR1YZZt{!I(1dE8$vkUWgK_q()HV9OmG#=BR#Y`F z!B38QNWFFFA$GSTN!Z$9Ko$q7&Lkz)U{^QZzHh49BWP?eHQUp1TcnIMRD@zv@_|w% z*`2QrHNIMF>OK=nPFbdVbrMK(c0WfTWCvNtP|Ld8%XxRTQPT*>_->E*JtdK7eRWb& zb5W|c5V|x{vQ%lJrAn(t_$CT{r768CduAal|AVWuBl+QCsmuKVDtgRv;*&FSa7+4H zd@mJEc2Y9T%GpwA;`h+tyqsK!9=vhPUnnA}BIuIHftIff|r^WYkkCz_jf%~5xp8qb{P0#ed!9yC8H5;t(zYovj z9|LwTq_*3FzestVO|Gg=d!E+L3)BhHzP*ADuSrIeGEhz6*gE5c99g63OhmG}WNGZb zirO!A=wDXucJFSq?CYB$%l9j%_iGv1?vx|k!Uf}WUizU6P=8<8+0*?7)QO%vbAtExq zQRssirxd7`eF;N2wgW#9@(?E1#Q1p8hmGi1mbA|eG-3Is3dgR368h7Tn$Q?mh@>bz z)>$N)?c{bnu{JPY(&3AdW%4Hdb)-GzNc2HL)H2*Iej3r^2yDfR|6;4IhIbxp~GDUv^VJn3KdAjxkyBZ?4#*8 z$br@oF%?9(pchB{C&r>DRw@M?`+z3imfW(LG@$q+2W`DpsG~yD27|%?u-L0_smquw z(6lzAMh7;D`$IH#+NP^manIA`r&#Su8jSWayRoG1b%aAt0tgiP!fHXsM7xg|nK;;J z7(dK_x;Ykx2MTB2086|D?~son(ynV1kc@3EEloqZjadRQJ&zjayiDuso=Y+sn-X0m zGUDg_YE#i6&D0W$+(;77Db>zI0Nh(wuf(J2SFn|7&^?1ln0SH{=Y&DY+Fg5@vks$j z;zH%|%OGIQR-$Vn0kz2jUPSKB*u(IJ=8qW2E;JpMxvX<}gn|;cEt+yL!EEC6jN$i8 z!&Q4S*+?H!OvybDCjc3ujKLZx8Kw8d7~Wf>1*|ca#)>dwc#If_oY0D`HmcUijA&!B z60gEHspgTUD3s4Z8ruDj`kka@djI1NZmx~D?{sZk5c*0SqEv!J!~sk1V~D-+NC97L z>J8;PUc3$YJIuW}L)hrjk(tl7UOjoDT=MYwA8M6iXUTje$0HAK3Of{gKax~a%13IJ z=Z+9ViV8xOXH6C_0tQCTYT2)#sKAqkQxn*B|2zb}b#4h=D}|z-9!jGgRrtI~|1MS0 zDfoR6I2a%`+PlGaTgs}%&hc;q`cPwmJ|bZ#euHr!8dz5vB28(7xXg3q<^;%BjpW+D z_4x0a{39oirXfQO5 z_X2t7JJkgy{Q7=|f$q(jsX-0_meCl6z%H2x>6qYw$ZOy{XMMI9iR}IXzh)>o!Zm6b zkc%XgILz_W)64C@cLcZ@>4isUTfWVvuv&NIFyQ^xzVdb|BRVg4JMk2HuWH&z^zvF{ z#2NNv5xUDIX)!fhxISl}NVIQ=$on~+k1nOryf%7}JvGr5xX6n!5ni*X=TyD|QK|E^ z0pePlb1sF;vq>C;kF`ixVAZ9rJ5{B$X~Ul8JcES?>uJ??Xnz$NmE)ROj@DcaOt4Om zV`cmCxFEcy$p;4Fl43;f&dpaGfMA7Hr6KO;$87eohz(;I9mvDGEVc@6-+UqjRu$N_ z3UR8S7TZ)CxYciO-?%Ejd{A;^K7QT%lDY@+W)DEa-X)h#?Rt5WHXai8v7Vavkq!(^SW2m^bJ<1ylbSiQL2D`RALf$cv>NtN>f@ z+x?Om|D+&cd1zvhK_if-&mzbA00QpOy#K z|LSUG{ojt9YPI$lVm9dCRKe39lE_6EYEF7Rx?QWQacHpL>Yh8$&T!wIBq43(rG*7+ z!`Z?P;yX95B6jagy@W@w#KG}3e6O?`-Lrnv_pfFwUyn?m&tWNi;W)sOR_BaEwH z=#_m0gK~!6$@RFjwL`eA_0Q=e?8kX`ABOeu$HWE&ljipqY;`g>e%@>iKO^% z69ooeaXHit@JX=G3bzhE&HclMc4f-l2C>qu$$P2B5`_4RE}3;Tz0Td&&ce+?>KEm} z@{Vn8=*I6l0zY!vz&>xlM84Obd=ya`op3q@4G(hTp8(bL(x~|2ls~Ta-HPKEz;H z5EXd_IOUh;B#CNe$Ql>Y3A8|0PyI*jd$sp5phIh^EqD=zpIi&YZ8!d@RLDtIp!h$qswe8zCJ9TibxMAY27YAS&X6}G?5y5=SYK;NynjiffN5`EW z$@a%4p98{yGS$Aj>tCZ}ofQ|ji*QEht)kKQMDkVKI0T1Bkz5-9IKaJ zX_*@Bl)@6cS%oJ(jnu^N{Dx^s?pa$ZgQmu%tr=xyx6Q2|%5_M?JO_%m>TIX5|j>jl}D9lDNg?BvOYxl_%XU$`5OZ3 zG?^X&0M^jpn|6IoW{JB#%aZ>_m=G#*}&)!@+`M)G};#3@y>E0aEI> zvXeCR?JxXYOr^n02byax|frexJ(@t`Y50MPbwA4+r8`l{la)u>O z?L!r^Pd0!%-70ofzZ-unC_>_IUs;H}4`RW19=|C(x%5utcSrUyW4ui~pcP4gAPoz( z$9soesA5>Au27p37qr0i%#Y^=Bk*6%s-i^j;mSX`5Q90a+3GG*-OA{G*+GE7 z=rG79tszh`n&sE#&!I+jiQ_mLva4&yNNddaERAfk|H&)@Jp7n-GOCC>qj|RYJpUrYboNcJ;smXOS?%DV>}MwCB82+`a44?!Dse zLaunWiFxxhm%aUA@_9elOX(MY{+}MG{|d^$z{JAw|CO?)f2FL=|5wV==re!?nFr`D z-qM^Kyj-0r<{(b(@)4I$FdlDg+<26u?!w$a6!szJQ$W@Izr`$34pIA$065w zkQfvJU6F7+>b@~bpA=Cwebd0+77L&DIqKautlk1w_tlL&tCeVRidQGa?8Z^;$xhG` z)4l;bAggS36-f;MYhua%Jj)I63Q8?jEL~iXms?My1x7EV`Tph5OT@33b<+#}D`qv0 zzxYP-4VB7AJU+dD9qc`0jsJ>SGy^PM>o;KDRrQm1(J49)|RU3W{OU;dkL|82h z9_(+jv#-IX(IS2e*+7wS5x>^?;V{Fv<$wDdlr6Z+s{k1Ii-dS4d1*ssvrBOI|{I~90IbDgFR5iuJFaER};8X^|( zAa)<}nENV*fz!9Co2t;7TP0eps?|g2$Idx-+>Kbtt%8)!B~}z2z{)8|dIGJYL^o>G zGyX2hh!MNR`G@E{g{^zxYy{m4Ch?82PJy_5nf#dWq6eSD=b`9i4?47u1qE5&VTiZ} zQW+dZAUlDkh=BA6WIe|Y^-3MRFh}?Wh^8}Q*uxEt1wWism=*2 z8zPQ2ggWF4#)O8r+6ODCJ$8Dxcdet|yup+y-2>F1Yg{>Zdc4b^lo_`IH9_g0jIVys z`X?fmk8HvtJnu#s%hKmOlY3tbRU3;b8aCc9C#}7qYqlaSuJ49egWn!e_tg)MJ4W!X zmDZ!zy9~cBiG86Rfq7zJNWc2u8y@3lM|j&G8munOLDVPVD(EG=+SMl2xIfj;Qe5&M zmju>(DyF?!9&HNTXChY77@rZCNzL?h-DY%REIDOdFs!=!n`dVPmq1H-h3WlGbyEvo zEi9rhi)=Cfs7K~#xk0yDEj=rMu8JOrE`|uVY?xV&kn=0Q6j)GX!N;H&`9sIVsT?ZW zM}kuym)VNM>&XxnW}Op5p%oRyiHvtXoa?S3c~g-~G2sYhz&`m#e4j%kCF$Layl-2k z&XL91(5+|O=Y)=)MN_lF@2Q28ZwU!+e9Vt4SPhb|1 zYT}&Rj9R(hp$sR#^?Fw73t+2Zm-`>4GW&lOMrQc`)$I(ckN-|(`0oEP@)xKNS z!()w2k8cKGcZe#`-u3q!z9?>@i8Jy10rQ_zkt9k`j#aMJsV}uflFIt-H?m_~XSgUi zseRmK^8V)3^7YB!^-@5xJ8la+GtV`Vld@w1WSnK^srL0c#QxQ=wS%>0brH_EN-Nd- zb_O2`J`J&YX2|2N+m7^3K~BH~Fi*ia_~LjI{;2sr5e4DppI)c@kJ#nf3^aE8D|YRe z+pKyPE<1HP_Wi;Z&Q`<=NVI?n;I|Gmn-WC+IxX}{2(~sMZnC~}k6z#m5chIx7i84# zkdkI8FYtjV53+ChW*03>smEXc#6Zuz`8{!x@T9*-x@1W`Q#LZTymhXJ~^^V6?`pqBm%^g&^`q0o8BH{~xWZ2<}(w3aSQM8bP6( z?b+uhTH)Fup{Fpu@bqBxo6HKi{-OVPrLSTj`XzWo3YEkIEF@5zkUE8=6&t1}Mv;YJ|b}MGx2&|H~e|u&$-$v%wVW52~|msNS%bU?>?cn_-{velIhQ=@efB zk8@Nks;&q}ZT01|`N{ZRJSli_AXPyK0yhhpI1)A<^YGw<-C>eG)LeCj#p$pKM_ca0 z-*dLb@{+nSE@>Z5Mp_uMXVls1ISl<4qq&XgKBe5TFkw4P~j} z>|WrP!YY*5b~_gr8^BbnJd*AAYy*C&1;#C^4ZjK#6g<{&Vpq?23X>2qX>jpF#qQa}kCj0^ zKzxlkagCiid7%M9WV4|Y*_y*JB9lmj;en`;NEy}h7dr=g&(S_)`Bm%z)aBn}qu}4O zF@xUVS&9UNnUkE2t^!NfLye;qC_F@M9?+IS7ME;?un8hQYZHanK9*I+3WOgf{D>ak zS|&EdAMjTO$~(tx^EAWlnffklmjc{@g2pam!nw}m1+wU6q~s66vxr&VJ7ERFwK9=e z1#%v6$Sj(kTcw=x^Gp=30bgX})e!zL2DmDWLhZc#W{oCnPa=mrqv2sDxy?axyCfwD z>T?O0ss%r%x`PWc1-svaulvIcGLK>TpO19~bAu}FIShviMZ1Bc9;qbf4ho0c{S**^ zM+2(nx?#u`Es|lwEV}z1kqhCvMEf%lBFCquKVsSSaeErFLyA>SFH`++fa-2_Bo#$Q zQ4<~$&x9M=mY180NtF0*6+^L)uCb6kpqnE0=%gcB>?&zhG;rYKD%PK`G_J^L`@amD zo#W^d@N{HCHrq94?5tUaYvtC%5^;KG;)SoUSRR{UL*Z*295CnFDfg@I?HEBdkJ!$7 zoQa_wXBnm^R;fSb<@B9)XwwVXxd^!M{Q&Fh&J`ft2mE1c4%~Nvp4lo;upoXKi}gEh zVL$yej45fxF5acYwVcJmzo6}VYW*7q7Of15^_$VH$vcRNlKD8fP5g12nuD+FS3zK>{Cq?!aU`lNW0l%cQ_0d|Fb7fz>Z}Jc zTav;TpKdifdT^fDtrWT)>Z zdDX#4FlQy5kLZ)QAT~eO{#RMw~4*CH`g;8x+5=O4}TsTNQ;4rc%81N4J(4ecM zz`YWMikt(z>ueD;X)~Yk6Tej?5u30Bh%o%rG%!#X3et$qQ#J*l&_5yk6I%bAeT5OK zm)fnasd&I>aR1hDn~y&hg{lyZj6qxbD19BfZOH-;GsmN|5BqKCjCI{s_Q@lP3p2?F zXGH_-pFM}Y(vF_R@R3f11i>OGJa`JYJKZG?*nQnE^u`P{cmJoC>A#AYF|gDBFB`_N zx^(RCz0m!l`U5DFyiw>^JdeX8$bx+&=>M*HBKR}MQ%iDlP3m2Z_AY-P3)DNBH#&akdh2WSbGr1RX38o zjAHcQMKyyElKS(2fXBw+1>rh|QRr&C4IiLex39DT6(yQIOSu9a)7fUf@J#V+M_5z< zrO>(E9}66y(1)8|BIRP#iBfG>jIp-PHCrnHm>w%fn4RLh08EGWKw{BkP9RIctp1Rs zCtWifbfg8QK=*HHqA_Z}b~0rv&;kPfTS4xH!@JsN5EuvzruL9uj{>xxdz3Pb))R@0 zKuSl<%p=6_CvE^MX8OuWO$1GpSw5PYb3j?JgXrwieEo2da4xN(_Zpsml)r2%^f7)u6 zOwa(Mp1O(8uDA@_iC&$195eXvnQ*PO5bt9ODw-n;yBFSnFz?d#JYJlm4n3j=Ss$^8 zVfds2q~Vh1VND4kE1T+#W~l6BuagoLWHpBC1z)xNqO#>@H7qxLglj^!Y4S(6-~+;W zjxvb9Z(0V|-eeC~FA{cjjiSYhQ-tLMrlkgPbPRpGYF5x}Kd?2j(KaB(A*{kiYx$sI z%&k=Uo<2-60krFOB;t0F-e8{;Ln;P_6NFWW*JxaRcI%BTGAYjOy@_=9f;~zPF-~R% ziYwxSj}V923LWT9#4b)4`eFGA3px+fIg%!$X#(g7xWtq2ibxEDo3<%9ju^f6vIkj{ zH9;*u%o;QjW5Km-<<6Faq}8$lheSc!Vgx$MpGX2lN}O%vo#orxIena5dC!5cDlR?V z34g?cY8?5DoEx3BThctoU`-+Md=^96F)A~jgkRYr<9HWB)%e79-Z-16T{|i&eX8IQ zKu<=-++3`40{s;ugWP~PZS;IkPEexdai zZ4z3qZT@jzOgECJFA$L&Njdma5a-(eT02K3N~!N>HU(y`o1QVRyk1}C z!+x&XSqt-G-H3dEmQ6g=I8W)iU4qTpx12-C2Suf-zbIxn=1`pKf#h+9Jbv4Kj%gyu z;Icg_{a_|+QOd2CY4LbnHG%pR^6y1h&`BT=qm$dd68!N1Q+Z&MbbeNUFyY_WDJ7ke z@O!i~dN67}nVVe} z87_T?TE6S8ET(3q2rKz*%?06u{rp84obDSPQEue89N>D4#qG_z_ma8TZ(<%4Y8zRg zob8hH(|x@YN%vAJi6ib^Q?mN`bhb>|B(U9|hX{1#{_0c?9*}zwF|!Pj z_~-&G^Rk60ILg=0kqz?cHbmh*uE9Ru`+*G!lPF$=!~4!{H$FWry0_>-8FbK#Z!qte zXUeB;CnLP#LjDN0X??AYl;%5A%E=J%6Bpv?EDI+WPX{Y%|7tJu%FXMGr0Z^C@R4?2 z#PG+e|l8^yLMIj|LtweR`35G zKY926cpL47)e}hY$MXMn{>m3@OA4Z}$eHYCj#3y^YI{=qJ-QdR8zeWal z+Qj~gLt0kd>S52ol{cU_wk};SAMCSdBeKX|DQ5Zuza%ms*{MW@oUor6fFZAGrV{SK zgIX%S?iG^xImq49Z0+S2a;y}Ua;_gO=+&e9m5tiKMuaQIe2|IfsY0`GraUVqxZ!d* z9f%sZPhYwfthl(`9oTBh7284f;?vNd3gwfz-J9A#DE&wK{hc3ZU+7-z;;8)ZpYP(g zH`^4L!WWq!O=On<^CQHrs|(LgWzx zDE$tjKbd=#M8lkofZL(tH7)7jOBfCTvs~5@auXr~odQUZ?g9xA9OMI2NQ-%6FL3Gj z_J)#9@v^I43uam(g6P$Bdr7p{)bS)W1uMgu;Q>PCv9_wgL(|$*%15c#cj}a9 z_8B8dR;6L%2P*_+d$uSNEqol!t*|zc@IQNhpV1$_9Uab z?PpzY7?ax6Mp!gxp|N}VE=pX%5YC=k=#&7EuMpI#B2$ zQqEZASzGPEK$7D~s;q((MDBQN;9NG@@PYl_dZto|ehdd6Y3a*W$qaCkOJnlD)h*Nfto}wsOAnuHpHVdEx-F2r%Gb?V>sQxK5hN3d0jZFX2#$_MbMFja0InvG8?C5>#<4qCuZwBvM8E%VO&P5*rS zRAl&tJUcRuK>!r&cGEdRK(d?vn3G~cQ_!JPjd~_q*`&9?z`g~TWPTduP9R+XA4ZOe z8O~dyj>HTaF^VrvkI2rw+6`Wy*#BRQonx0ET)Jc{RcYI{ZQHghZQHhOo0Yb0+qTWg zx9`lX={5bKe?`QJ^X!N;2-&tk@jnRT`UmeDC0c~L2sI3ATq>{%Rj5~~um1ECyPs}Z zIi2FmV)kuUM=hdU(ufo`7AYr0eoLVVS`r`_c2``L&>0qZg7Te`=b5ZpQEBDXv7QIb z?H%grP+8Q>eZo}7f=My&P!t*!Sd{O!l~eiX#>(VOtI-+it5IezLh1}m(hS7-HUp8T zhhOcxzEPQ8L6Az}bD)%m5*hmXZ+c$*09u|b9JRz5G!pm?>9A$e-`oXo>`$Yu{)*Y{ z5mJ}z$##J~2x#Miv@adddt7P`1}tYdkwwaDmOtam7jEUn1yw7B11a-V?c^iF);K0_4X|Z>V;8&<3znEFZq^*= z)MrEXC#*Vs06!;ZrBFZ`vZ@HnD%E(qjotNmw|L1pD%-5Ws94?>k_7Bx;1% z8iMj-#aA!1|6bIsOzA6gG1OAsQuSKgLqh*%!%fK{LO)-``s?VWFz%?WFO>tU?G!sH zDz|>;xGd_dKvm}lSziTA>!|K2=+jJ-3`KD}|3EgQl=5nppUE0lS4C(+fTVWZXyODj z1hy*>M%%9_<0G~y37Sltu|9ZrnvARpJR1V*Qz*FP+MSIQKfw!23#m0 z`V7xJpH>su)hN7O_5uaEvw|Z)7cNWl@&(4TlqdpU&Iq)O;$#o830gg-qrPflWrn_M z?!HrWZ%39IQ8bfX%1?1_KN@crW$C1ZFJ4YiMN{NY)j+&PU)dJ$X@Zhqkl_V2z!HE{ zqb$($fL^PgCq)5H75hijbv%LO_WYvjbxUrD_6?5@SEBS26h{gatI#R|%jnRk$f0u& z8<`{Jrix46IH%Y@;OjcAs$u@m4Zx4PFqv)1zYvwAbtP z6vv-v#;ln~;6o<|KsG#Pon6m+O}H1b^~?nTpOalY950sJ+CJ~QJ~3}%(f`40u>V&> zn)FO;|Muh8srG-e%xdFp^^Xq@nB{n97sk7icKiyV4QzqC>uVt!2y!(8*x5%@ zEp6%B*<_yHIz!nt1)Vuf(^_{(gg!4_px&+qJaB(~K9wyl6742?_?1SAGKZl0D-B(D zut;(Xyc$x6mWf9Y;cj?7Pj&ny$qu-Mt%hx>3JvIb^m;#rI+Po$iefxkjSNlf?Zf5Z34Ke)hVln=+#`iF6KfW zqi_*s9_;MT3_VC)0)7yVRE}zX+f(!{mNc&Aa!=z@=cSvmJq;{M@VEFISK1Ss_|DuO z+)Tt8V{Li{T`u6wtEK_QtZOH8#&$KP>0r`b z3_0rn78Fg-3e+06$|)dL*PSw#B9bamic_JD-6@;_=))1gu;1U7vj( zQSgSnnScr!a?~r>8!@3IElF`k6~Csi-5`*#%2o%uT=rW7g%#IIEsfK;e}*gQ9zg;$#V$cBrQVk;2REzG z1V^tja>iXpK3a{_vQ83!MTM+a6i=Q&DI6T-0$=K5Yz-4=cL3C~%(amWPi}5ma+C#9 zPI3d(MF70Bf&Bhx)P}iKgpi`4c5zSjU}!$5xe!TLStd(W#aLNJ^FgqaX`Z}AS*rux zY1WoUXIU_fZ#1CTX8ahy6nq&CDe)dbUY&TEj(sS$%gSbPlrBwrBweexsMFun5#Zck zuzu9wVmv%X(@9_?f)f0W=!#i}5l);a@yuQJzbe&Ys$2jQ(!+wlw0g2Z73!%QlkFD` z8$hR4^JbI>>|C$qiT9{CEa`@hCPrx{W~uFkClTZ4AzB+ZWa5AY%Ca4Tl*9?jWBA11 z_A&XWz681>1EQGgSWX?jGoJ1WH{Ov#|TpARXO-kNc zt6+*5IWX~hX0S1=<1>dXlb~3jpniI)G6qV0)IYrmS2+gjXINPi7w5Ejap5r0jKjJC~21R)JukbFp(M zTg$;kaFe^isg`vYjR|i&rA}d!TS7_{y8$Q?G%!vW+;*`@6sk7RWalw(a6_3^P|0Mo z-W}IUY0K$(k@{=w8J^G5k7RX*G4X?(LCjo?WnPF4df(XABbTAEX$3t&*0VF{p@@bOiD#MCNoaPsh6uS-mah@37?JG^AFUlE!oKwaxmAujnD2GuCbm09F~$y72ogXc|U3T z+Sb!|i%X?Kwd8vAarXvdAU0Axju7sOK6>)Fb#O*fsel*nK1_?4i73`za3(3FG^juEQnS6Sez=Iz%TJjE+%5 zX9u=@M<-_~kMYbzPi@+QkJ-kfxug zH|c%IAIialXW@r(p!uO3QojEgRsNwIQ0c=`Wg-kY(x?c??=j?)%R=zj!H$=TzIQ$=+Y}IuCPpR}N&r&$2lW+@RWE znhE|4B6jp982dzRs6MoDGS99$U{N?tfR7TXGgA=JfAasxgbE4dqV&?`dBq_f&K)b> zaSlNHMiSUvrRxDKNBXBzSpp`%giaf59QBK~yFO6t2H0nsjJ01h@0FjX$prYLYXbqz zSaCXsc{(rKa1O%vWZg|eqA zahHoQ0RlJP3$+(vT^l=H1sGuP_&2ORM$akYiWj+C3UcQ+@Z{dlk@&iPhwWot3nGLLJ-?)^_=ZP-j5&0=DMiRXu zD@M4(oFJwfLD-`se)O8VVHY0$z*TS>3Nx=}1&+q3okb1iUIqrBB|1yLIRO;UgmM(- zPO(=IH!MPcnFtfcT=qBd2ne3Qr;q0lA6T5c2(P8)Xy3wO zSBc7dsrMU3JP9rQN;@O|6ScG*z&!u(`I{*dfI>A?-<*k|fuB{A2!p;O^o!J;y&zds z3}Aiot#_GOF24n&3YqAUj6A+hiHL6eaD)RG+t9*xdfpyWUyqmo^^bVFJ1|3kx)Bg+ z!?&C*T+I=_gdQY}-gG&hDBGTdNbIc(K)qMvpXm0CY-%8EOymGalWO6k(V-mITtgi$ z=dLV>(LX#fAh{OG0^WYXd~Iut{7IFmg;F%+*!||sybA$W4NujnIpe#1;0rEhsdup6 zDd~Fwei-1im7{_V;Sw8IRcW?VTjT0#iI!M;j2;GKhKcHT3F4^%L@lyCj4ORY-3crN zzi7=(jgcO}+^qGEXh>f}%sgejtC1jR&M%XQ$oRbhQU8`(3h@i9mqewTlL{azL%2yy z8@R`y*;4KsE3Q27-Rm8awi@BA?!8m;o>I+k#5kEnFIER~kHVq*=EWtWf+}A?<_O#A z6>2bpL)d{o$%#2zv2V*aOw9M<^B^$_e8^9-7UeQ7P3m3Fz2w!5w*Xy*n8)w^^)DPv z`YPK|5Q(=SbnopXu`mi*HyU)MqK*y2xsPoFC%JPdvDdVhc+bUPhT9?SldJocvnv;! zp%tX^CO$!+FAIle7IRO?Zp!It^%kgtOPEkao`(LCjv*;hPG!$a^eno*FGN?~MUdVA5DM8opmiBHr>8ct`zH=0CE>+CS`ma8S8`P7 zq(qC|$gm1)WFlH71NwIPK&q}?-ks!g$>cIO`HCoTWVPO%B^}lgokJl?gC!gZ-gQ*Q zXQnBLT+jfYk*DT*l)81lj5r$1guU?>s+72$ z&#)qS7~-LPo$s}|8xMhYPIToTt_Cj7TLp_;{?`wV+y=;{GoX>wV3wn)s&mdjKHI`* z5HAS12RcSqHE&Zl0_uTUWMR{ zj^s+0$sM!fC$Dl!F(&pyJ(_3@MZKOG8OG$!q!g)tNqV5yKowLQ0`t`uMj<|9{wB(1 z<+j)cj5Gper#qc-7j~gZ+UTWj72V)!oOPx6b#cN$0%6jS|ic1{1|}LttYeJlSIvkV82DAY|e36r+TUW!5j(t$bh|%+15b% z7`affb=qH?P!x6$e?E3)ZusHE=)hj_LU9KHw9omIF5l(WbiY9vQ#WrcbuZK z;j}qJnM^9sMJT`{;R|h$kPSv!)gpjbco9ZUBw-4fMOXt1qbb<}0HW{B23UWFqndWt zxdm%pKUMpZ7p-;9X8>p&K|6jIJlz^;8KCq8_7W!=VcY@~q(0&JAxeqUd#x6G1uiz% z{z!jl#SooiES)ds+in{uYrgyvcegbr*=V8Twy~DWkvw0-76+4!9S^8EkB%_FxP$L( zJ98FuHUkf&jN#SKtK0Ky3}ma=4@{&PF877|w!pT9 zDQo{(&pk1}haCaZsy$Kr8J66i<*vb3G}kAH zf(ycgur>Sbn}|ytZ!{&$!^s^ESP89WiIF~{xQjpqQ`dUIkjr|hBw&W*emx3&~E58WE=mL%r* zlQMDrhd`OQSM5Nv0@UESN(E^zP77@WvycW-x9En;Zvhw(U#o1A?NP3dVGxjUDvNQ8 z5;>rIViq;x2>WoMES&);A`9qs3-ii$zbS+(qg9vq6Ti#3A#Gjww)id(YmMQHCii5& z*HDOi6|0oQ$&j%L(7e*uJ!Z^uKARf@Qz3#7qqXq`$sniX>U*(|icl`2NX6{hHBTAS zSGfImv}HiDk4Y_wz&R$ZN9oH}3C>XidfXNzcgo8Nruj+A6vR1;#BMOnDWhE#wcpPH z*KqkIUorh1=nbgqBvB^f+|NRYM|$U|O}U?)&Gg+&Sqq~JXBpey7zdQ-yiLabEu0hd z!ecEK$(YIa(yS8jSuJx%A*ep1Xv&7kq*7@WFojs=C>!Q0ql6{=qQ_i{FhfI)=v*18 z@;RWJzkXx#R~E4*m6D6}Ow7n2L?N1CmSevK)gmftr>r)iP$XF#sQ5m_S=3>jM$G2S z?nL&HX%|FBnGtatE}PqAE)GDg2v883iLjC>{ePhP6c0aCYwc)N8Hjawy0&(gJk{f7 zjlcYU;C+XY_m@%omF!C+TSmFm%X4;CIBYyOe4W!ex0M+&TPWoyQ)T;Lo`5FgY?HB} zi-i8ELkmQ~*E=}+ShUa8HDV^ze^L8si}J-)VNO1BwK<@P8k*K*gpL$OfmE^+R^+CZ zC%`%4_Tp`JDvP9tuJ!#p|NQxYS*43(H?>*w+X8Y3#s|1_{P%*`Z#l5TkQ56tZood5$UR5*<(w} zxB$HtxV?jMYw~9-95}*g?PzNe#~F&@{eZN!^D-C#?bBCdSRsgnt0on!<*AvThYI``=a&_&Y6EiX#fO))6WpblB7nvbso2t`A3v; zIK+FYuEHhY1%&AN$&D=wDB~O(X$lD)#-aDDe^kkcv2+Kp&@i+Zbn^|Fw%iMkOK_HR z6`8I`iIQ^@J#oCl@9JC3s{?(S4P38pXHPz2Oj-|VeoIz>-8d@qOQ+aLslsNl+&?2v zhdDSepb)4f7kBEVHM~LRh~nOEi%*=S$RoOS>L{0(vDhT~{#-rPP&_WuG1xIH5>zsL zLa)WNma@tsTKoYt@(nE!|IO!6=ZbzvQsdRf zBB!U5ohbq<@l~S6!zCR7YXfZ<*t-PFJf+k%EtLvDx|&B+ASJ12sspZWxSLsTCt)$1=*0rH5Q>9!lq^u7D6 z_W&>SUp!sciw;&+i!mxHEvCv22TMy#Sz$yo_CBCtcgaQb3R6&i$R?&BZ)LKXTbVmc zZ;qD46b3JHl`YR4SRxKl$S2zOR#Q~q!e_B%v`5RN1n+QSu+OW4b`a7dc?$B<(B7bY zB~dk*93>$jn=psd=K=b=OaDGca-HJJ5CtQ2BlIZpKnQmzKm@Lg4OfSAOr=0$ns4V; zaEgV$Hs;qUwMukBp4h%6cYL5+=^MIUJ55=rWFK%ZTAN+*vl6;g2CoL(q4>Llkd zo$LV(1d6@QT1?7T{xHomu+U-rylpO`kX*L1OZEcBA{92erx4Id6$BCEY-WjyMP62Y zQMCkx1>WDn!ub{5_o@U!60{j{A<*XDMhZ(h&qlJCT3_3AM;pX#I**!-b;-4p<4MkUh@?}#Y>K5I;w&wDY=DW6_A%wp`QlIC%qa!K# z-_6+81)%XpM>GIcEqL$V_YMC%QMSreODFj^l!w)k$g+ENwl_{DsT8HFo$%yiE@oeU z-GZ2vtgUHn#YZ7f4~A=nWiV;*QlQnm^R~_Q>_UF=MVv9Pa0IDeR*8lK;xG6MpY||0 zv7q6s0L?gO>rx})idd1=Yb+7kVgwv6bR-EBu-7GWIYqgSA$;Ep+sk`hz=i;*_M-X(zywXb7i&duird?gP61x9XI8a9(xy@T<*KFZPY50G5+ z0`ai>vf%fjdVQAR1roLOg?&pJ>y9;Xu?X0t%Evs8kflWQ(xM=B{M@+&*}zG-RmdgC zj{>nm!0reIfd|tXi|a_T1hy8qw>Tmw1ETYOZ)IblIA;xbtSJ+9z9^*9bXDlMMeLGK zOvnK`JYEk7VaWaEvRBdHFoBfqaBCFuc?U+d+Z`@&&N;8V1;2!7izR<-= z3~BwFG$un^Xl3I@wE1uW{8wR;Zn?|VfQWR**;Q<{Qw$s9bbnV7a%*QQH1|Sp zx1Pu{Dv%~zToy?>$6!4DQF2W3Bjp_h@x5q7+dyCqA^b-d9Y=B?2DK2(C>&* zI{JtMo8luQS(h=!na1K*zOjqn#j-_{@d;#ad2di&^s1HG*3$!hNej?NYf~|oOY5f# z7lh@Hamitccyp0mCr5L7#QEED-JItdk&(rKFf+q-_y`J9FmkSS6bw>lBsr<-(&j*_T7{+7 z-SV_C^>jt##OUt#DtL7~x6aL6J?JrCvt9~_*KYQde^d8p)Vf^6Dl*R@2UnXNE*7xT zWA2pDtD~n}HYrO!E5si>o+fE~r`4a5JmGuIT=_gSOGoB{0DnO|KHggCboZ@9Blk) z7CQLfa~+elFC;T3K>)*i&N9ZRhO=J8Mu@ar86V!^hJVE*&Ps;S9!?|(A_f(&^NY7h z|FzWdGlxwkklE$k58AzR&D(x1yItJ1ne@4 zP_w3`)J75HBiZo=S?KZ7w(`Jsz$+_3*^$8SKMX)G4V<1zGROq)BLW!cD9z}Yu77(a zA#0*Tu%!tg<^8jTjbql&!N5F!Nx@&0;^XuFZm7hk#Y7nkZk^R^e$o z^#PU+^XD**DpvHGRMe>(C)9{)nrG%4Z4->A&IiR9#tn~0Z z9HuAU_?99t(HMOu>SvD}C^#jEx%#s({FHvwZCZuhUa%AM88SC{ z6W$v)IB{_Pi9|n9nyS^gL_iVkZ|*F5%Li`4US=v_g*W+1^C|{rd7A|skMMl7Xs9Ce zD(7j=p4+87VP3?}#%ZWFJgSc0xIeNiVCzWtkpp!5qz^Mp3L>CS;Glp2?3x6;c+KAo`*JIt8<82-nC$LVi`X*Vb3Rjnga@|7nqU{kPEX#HPro>Q~Ih_jnSee;i zD_~r6l*ys4^SK?VOHs`%`XC7E<}p_jsloVFu)$2BR7Ku%p=sp2Z?3}FP|Qe5GSU>& zJjVvQZK!oKCxggqZzvHSpp*HXem_X{rVW!(MX2VP=V>wCLf4uiEE`GvB)t0Vq$Ph+ zs~5P80rKxPOJ*XyKtTp^Av3rbic;Q|F_LmAyEswK&Z+m7%F**XCh4J_u&Sz5Rfv=T zY&yuHnX_BvPGjSQ z2xW>2N)m{J%2>!b<)S3Xq3!m$4O(pFs*uA%DLdy}(8PmP8q*f$&R6KAP8kXoe}wEw z-Vxk2!1%P|cLL-45(AY5lQfEL8S5r+Zwx3q$EqZp>$8S_XcgxQ)?CEV#y!|@Ba!M;(erv6ZNFi`7*aSUuC80Qm#3ER$*w0 z<&?6;EG~=PWf2mA@#ld&oAt}~*WV+1!Cv~c4ZRzm;*v-m-`O0oq8#=2z^WRv-^X*n zd6Wv0g6C?BI87jj8_gi>^Tb6VZV!zcbR96nM?0eRn>H~lz-qi7IS&1o{nym3^L^(# zAxh(DNfx#Wx-qAub-(CUHieIAYeo`@if#;RjKI!b!Nnx?s{7eGdr7llky^w&?S<~~ zkeRn22`x~FyCqtCt!+170JpCTkG{&TT7y~Z;o=YxAm!^S2?q@$tmAdeqr3M3hsGYsRq=7ptG0 z3zxWi?()OUtK0JE;ECa6h*OnpX!o^=Cn}y*(2QkLPTrJ@EPGLseTE|0+~0}HG3T42qQ2!gSBN7fs#5!fBGFvSaPE=WQ%r@ zRxs4g14nbcBjd76>Ub?rg;!7<9`3apUoDRBEB2=5d3G26s z?dG%4uFjDtI5{g zh7@Imks0oJ9j6gevF{AvA+O5>HlLn`AAc$|G`-)*dQvvON(1XiIR<{7xlU~JVUbCn z_-cz+>4#ve2-vRlHMGZ4S1;p%qG1D9D?W(TClM$VQqz|w;@L5gH?N?1LmImsX)-zi zV8z}9DehtKwD`}uT-jW2l;EGDF&`&WE-@MBH9oJr2-_T6|H=LRcfFFVO#fCQ->E4c zbKU~qb^Oo0MgN{m&ka7GvF`@Ssb*|IJM|>7Lu%{6bqHrfgyCupJlDx+d<&ArXZeWE zmzrMQ6)sgewTAkii@V2mkK2fLZ_F#7Pc`p1bsD~~B9!D9t5#p4%rg))fWhRL;qK~0 z|2Dg`E3J*xZpI^TMVDpPo9P>;gs(<$UfM{;XCY{iOANJbcm>hz(YNR;1f-sq_Um3R z*wgH*)5`)W{b%D}@Lhkayj=|Xmk=JsVlY9PHorb^pM~l6U;3~?_wG(G${e}zXy#d+ zw3nF>H&k7`2H!~o`M;k2jxTzC8{ltXw0<<(DkGj{`{)KL2w`Mrf7gFFygFe8mD+#q zrySkN^0L5@gW!AsW}?lQzI+sC=^?cdh_ruY!c$8dLKsj{C9L06)rJf6TU-2zTbuWv zStZNQL^<5T>wwtE7Xcm(7%&%xG|8#VYDr?1MCA*Fb3Hwk9@hMW%=8^H`<|j74GGkj z>4=562|J8B2W3F^*l*Wvy%ru26wH*~bw8ng-wkX(QUJiINR2OHKEnqO^ zcZcT$%Qdyi7L9yBCeW{u99M-H^L6>dCPy2~tUif*Dp}4Z$Z;fo10lTgscHI(v1@tL7mQ4+9nB*8HER3!%qE2${f{0bogjeORsw~U`W`ura=u70 zYb=H|2>M-l%#yGxGdIR&Bqo*$*=SJgZhcL`7Dx!(LaTzE{04*Naw{6PwZe9#kVQ5- zHc8YL_)gJlP^NNsGXxsjl*sE2gOw&rKz@4D#q3f-R62ENsn6^rS1_3{jToiC+(L4bbJJz`7=@3l_ z*eo(x2vK;uETgwwjdw`(rHHWo19Ei|GyLzv`I9HU3x&q~zu zKN$5}oSd_8lMr0`ut^xqJelysl!0N!Y9D=ua?(V(^ploS{6vBV#kXv*-RQNeEqs;2 z`)eip?l3X?VxUR~ln3ngWbX=LT!;$>0@?T%$a}Tz7^3aAG+~aL7)IQ=DtP7v4>4s% zf$H}NojBnhi~*n`a|Rt_a#b+$hK-8flcgEE_(*^x7IsJU#$NO*{Xj<#cAJlh}H1Y%P~BD(J&xpgO^S({DjGRFXB) z&8Cr#Y=?-UWj1Q=5HV)GS8?9Wko=TzT-z$rI|y%q(dE{BnrZtKbNXqr`ff?rrD3CJ z|Dfw-W>`vKroWC2_K3L;s~!XKB{0%5G70b;1as^&hM|1s!*JMG4#!<Ig4?u02 zy^TalZE7@@rP@9P0dT>7MUzh3E!| zl;rl>ddhxu&(#V{rdt<;&)%(;s322_4(Zi^zQ!{5f-9xrGgG+)(FKX? z!2?HB7Ey=oBtMSb_F{y;`X&9>o&$c$8?SoGl5Cwz#B!_n)diQZhCXka6@1D6z#?(iODoO<)=jbrs0d znqCDlJpGYizXJ`a!`BZqkC>Z0a2}DH!%^@TK!Y+gU;$-VIds7txQbio43x^yF?mq+7i&)q0$<+(5LjY<|N^-?_?(f9?(Nwo ziYPy|naDpcuXrB@lJ33$6nPSR{3X8{;mA>?rUPEfDLw4r`qwy7CIbxr z$=CRTm%jSJXk)z3Bg^Vkc?Re204peRz`~A2`GrTj^k-zv3QTdC-BWSZE=iX+G^ji# ztXzUMqCQ1GW>ea$Ijt>@NVFC8Rs%O&#ozBx2U~+^8RE9z3eV;W6m$Bx)zS8NRcsPr zatO2_%2FJlKEs&LW>A$xTE!aTQB^S~7_CgFaJeqMTtN>n&gGN0^QDspb@6Bn#r||g z_c{|4Txlq{ko=E@6qf9F6G6O*WELk@eWF}NF4Tty_;guo!9ALV(!h3(uLS~H(poSf zSygI|<&9-I$R~3GG#TgInS!jjRzNJUb7_)TE79M3J+QI3lLaj4U?*hS_{RM>fYYHB zi$IDpndT7Q?nXM2zsL(Fh5HR1|GqmivYDA>e}xKK=%|51*E{$N!dupbxus6vDlz8A z&Ztjf&r`KyvC|^UletNDYlFhLIF-Qes#$_*HI-;P`Pf?3Vq}tsZhp1~@GhqA5R-@9 ziApnp{sEps;#KF}ctOQMog}lX96TZGUVG(?x%xWS{Q|`or`P>Y{`bGCMrB}T{5StQ zsW};a&;s3cO#T5_giO3z=PQB@XoxyumCyykuGBc*Y6#o@(>+Hd&s#{XSpf|Hm zlj2Pl{_zs00NV{qC-x2dyW%$|JAM1^KI``$>i2!kQ3!3Bx{@Bbhn(1OV^((wf1?*4|YkpOXs}X-yCSn9-XE& z09x6exrtq%I}Cz~+mCU^{_FkUo;&w2cCpqg`zqd2%W6aXHUXYhV zh}&4(+K8ZwuQ7-H(E&XzdxCqYcGht%0|PIs}gEeK1aOj ze|iq= zYzbsi;V&MHDcKL?PKy3=0ig(tLgOi1@?y5Zb|8vYf0iNMaG5|XZ-D(krjsEBgI0o5 zsj*@&y2U9~QVVmUG|%)N^=7Q|BRP`8@N{Havc_i~IS4Z2V%7zXnC zea{%mgtJi$y-+wplXl%Ec^s9QFN(<|!M57t`bP#}c|#L3a?E`A{3P~J)^|pa*!#+i zbH}j{IQGzCZCao>9d0ekR}6t}=3Jor4goHP^Pu#~wrPX;Q8z72P~OALmGUT)HCtM# zspV&w?}BOg4mw3|BvwH8kswUxA5?-*_H>BuE17>H7(plIgmel0gVxo zJ7~1;Wa#pcIR+;bgH*4w)zIGd85|Gk^BdjMXt~yMc@z%->3w@eV6)TDuGMFZi#O#eKIyO#W zFV&qi2+ohrBdeXMtz-{7(^UNcQcAAmLcDGwNzv>Xgk8A z+6G6~C)@Xc=dy<&2@zr=HwjID>emxF9kntpbz^Gblyc4}IOvh*qNrOYlXoVzt5&zd z(`f!--L#+OW*uz8<=`GofdbS_!!8sFYrc9pYuuRzmI_OnDV6AmLKaz3PSD(fsWl;U zy+8)b;-DsJsgG{Lbsx|%gxD^IxK&K}pG0;U8Oa#}L3@p?yI+9zy5sXO6_R<0B@{2H zRI)eX^q(F^c@2q!`ywEj-lZ2a3D@z%mIAZ&b@0OzfBYBuo%Q1b~Mh58a4xm#alJY<&r6D?C$+mP#hR@%4&2*0+XTDJCb%5*{@|OwUxVttuz1dvc zb;kdpeY9lT61ZfvwVyd)`?dHx9odlNW;Kd39rBCbi5Uv7&rIGN?S_xj84RzJDX*HA zy0_{oQ-#fFHPM)z_0X+_t}IqLC|sEcT4JS#sx;ve{LE@=GRi#qK$+rWEv}iod`W^` z{}XckM5}sRa#aIKgse^xmbyHv`SO;F~WfcSKKJ~pY)vb5Xq7?*8;WWT{%$4%46D1 zh#C>AeWygc(JF^OdBf@x-YLNV=h3*39N_QMw)F{F9CjaQsts8PsAYlTxzXPUjDHYI?^Ek={6<+gEvV9+}Dk;3H3J?{MHrpRQa z)9rA8RR-xI_)l81Uu?vfPQAPYm3^e2KF?;dG%lKHG*9?OlT@E`S4hy@RY7_8iK(EY zW?9=Mu1ThNtxK;avWZLyB9JWBp;oHfVD{`4g2_8O)IL#{Gp3asA&$>8F{hZYg%wAB zEsoa@P4RSRuOiPql>6|qN`TNWvep;4l+Y5g0kmmVHs}bD4xe7-)RR(8?LMC53L800 zw3E)u(?8o(qh0GRbVcU*8{Qe3t!N1f1GSQBM)m6^g)zfM9=2^59xMaiv7RE4Z-($d zjAP_kS;|Nt=9_}pc&XHO7Op-?ECL>okUTa?jUl@IZc=Kv!y6YqP&0D&ct#>R%^Lj! zg}B+QmyRcDWGTRjS$qh&-hSZ~t_~9hTaV6T-&OES#s%hZPE%NB(-8E{zW)fpOpUSS zND3?+xDJVWUMn4m$|y8(R%OYiQju?6;&imJE** zTls}?TJcTz9^+`&xXgvNVsPU$f_rmH&a%EbxRJ;Gxi~qM-$>`picrG3oZVZE`~+M0 z=o`|KIb3~S^T~A^w)Oil3Tj2+O)Eag6hgsuDdC}9odn1omHvEfPRzz=!1|%)HDP5;_ zuB!Y|l0(WY{!&t$Te6c7YS#7%%! z!Y@y+!?69+x_28AY$mSg=8dw?HmDSK5^OG{&2wT~IoZM=N%}8Q$-V z)%OdNX7I8S6jTZmNos-uL-dryS5H%hnP}6}e@o8cdGTgp+0vDd0XTt>Z15w}GU{A= zjSq|0D+KOv8j)z=P4W<0#Wp|UnR3P_SMjOR$9vHfDM~}<_u2muMS)OCGO$8(Qvj{sU&lzDa({6 zabcxo2j{D$q>cLEbW=Kk`S$Z-=&mQOci;AnW*d&D#+B8U8_^~!DF8y-hj!|m^So$T z1r9kfb1dmikK9NSpOR4(wb@ImMbt=dNIE>#P?cmkRS175anM!##2|Yy!1F3)(moXzo zLJ#|&(~cdaWVCJPe^rWxzCJHTG)Cx@(Qx@B(1El<0-n@6*s8}ikv++Eb!O43v%l#F+a*huiBJdH(#lwzjwPT%P@1o=wMkr*@qszEm86#o1dy+8%o zDQo9G)4o8Uh+~aG2b>gaNksNdM-2Zy2<=pGVS+ztfDN{N7+bTZ7E^Ms#;NDgRt9t` zc7aH`1B}j%@p8doTuZ-61?cS*2NWQ8CVM2PVt1}J_)k&HZ3$t7{OQP*4IX)oTh91w2%~&hn#-fU851ukPzcHz#F)1nwXo+Y$3zMoU zpYt|OrV7;qDQeEOxZ)G5X9Sg9+hh<6VOG`W9*3jPgfR-?>8K}#8)u!TSFbK}Wop)b z`9thLoCLrwZIvehSQwjaKpI{<*Hb~k6F4fdWJB;^=t`7HY}$_WET?qP-<3UYSJKxe4%1 z6~XwcpJ;NI4*?g`Jk=WU?Aa>v3QU(NIbkeaMQMt${-_cAOQ2~R8Hwl_yosTDSM<<0_U0k@Eu`rH=i!zQ=WJlrbc%=Y>Bx)n zF>LfE(N&q)kN_*hjc)c<(iiv_F>S|M2IZZbZd^MuE$Gx%dfB%^EY9-OYD4QT&9?T8fy z>r}Khj!(EY5r(o@2=U}uH^4H^CL7k+Kw1r#t?Mxn?Z}ASn|;YM)oGexF6>HVPzxsl z9VZU4#teNc{ClhJT3UA)gexwJs~oQ8r<1ke{LEtU0#?8o8{nr^i67UmyRRLVuXA7l zSNhqqAeHGcAc`tw#}(i2du<~t#rXh3=DyrqQ%yB+djtHEZZL&a!JVC-O-i#qMqKh zMP5`6@^Vr+zr({XFRGSxB3EHZ*<-zT2W+-m=r2$Si3Ml#Z1;fnq0cYOKNyzlbOuv}&$7i`w^=wBv3Jzrd$fiC7N1p0Nj$h?E^8VNa z%!I*-#N|S(w^)5mW`WDq^4l?ieaMII#4VP+N7IBv_kDjEsIg@o4SyV?^ICAc-_U*i zybv&z@qS8X9gl8kIQ^NZt<~NquxyiP_b1spMRpIb4KdI&qzj_2Yi_8^LgwIc6L?BEojI2D7+wSD34|gx-EdP9_^q!^@SR-Ya*TYCNQ}D zK%1{_f*`1IZ-sF}_|aU+V5S+}{w&CFNxR3+RF(lcd(YjZ4Prc}|HE~urL`bec$M;+ znWY3z=pf{C2IIEB{$-MC6#5tk$hig{0oT#XcTlIvQT~(x2c=lk_N81KDmG3ezS`V= zb!opPp7-yC*ekET*)Um1ch6kmGnPMq*B{jjJ1AxfaJ)d8ZOTVH14%#Cqth)z|8rJz zkx~e?B_RhJ7|^u0XAc4f7WWmE+K+c*V{G0Rtl+l@CQ0z8MHrVUqxeJhf`1G0F#g+VPc!r=jNMM({^6w;60y~RCUI6}z;y47o7P7m8k zj!p@_ZymB2qH*AvbDE4^P_hpYX>Zxt)B8w7;_kG@zH&x`glf@k$6y7&P7-?EB{If+Hxk_M`o58QpFK^pQnNqGiFx$$em*z&E&d-6pBbx1f`{3T$H zH49zu``(Xjjtf>#9GV^wZ6{oJ%Pq1;$U?8h?fiMm1EfJ^vKyOuf@8ynkw=lx-zP z5x7Yw1HFq{sJMfvTY@h!19RYkY}24h)WvuYxsYboAdQJ}9errHd1)iZE(;3B0{!A- zy4N{9edg6Km5SYmgIvOvp$b`d-`s?GUJnISSwLwUP%Yz?RlItL+_c_F!v%pcA)L8l z3T&>u5aQr=5|k6q=oSUP3#neK7RRf~vFw~>#8p?oyV}pE0FN|O^{M$#`W73k90~-D z<}UG|a0Fx%F~a)+g6G>^JKM7tj8sp0Bfb z@-5kiRfQC$UVz_HqUkw%>1(IZR^au>6-Umjdc+)7qJ11`#cKM*ScR^TA&u+{~eCR(Yk7`*dj%&9?91GiBfa!zOb*YlW zHz(&h7G(vO7fv=NgLf7cNB}?Zf?Ht5gDrkXb9gMAi3C7xJ1ppjM)6MM-A5;x?z&uT zl+a{o`M2kr?Yot#%1Ma;g`9)@>qRIPDG3}5AxL7-_>F;^t5>kX3Dht&^h=2l*T73C z!ac%erZ1utg@3&sN1|+ZG_&Kv*i3J3ZrUA#&8(*{9dmfpZ#j0J<^QYNGlZ$d)sib- zoXe4_0ar+_U+L#|C9*%a2OjST)WTK7GkFlQ42Va)g}E#lD$C?|t}Cw|YkX@Dha^TK zL%q}o5>7+ZQ315>O6syEktQePOkO#l+;&G%f&LXsXynrtVup`@!I*3X2_KUk{^W8 zI|5&{%^;QL+p$$5t8k-8KZ^G~IEBiXReujdb!I&Dd+DLLZc;omvcT_Z(i6(54?9+{H1XhHMxyJoGI^_*5%95 z5Yp06&G`XWL(zqh{VBN<3k3ux-mduo^zxU^mIq32PsUH7!gEuU`k|jwLHE_~+(*f6 zad=DeD!4FQ7b|iJuZj;NG@Jw$fx9vtJ3Ef0%|K3E@J}QlrHfD*tc9{&MZ`8$gqh)p zKX%l6X=E6|8lhfsi`1F-fDOSTZ){}J3eH>6&8y6^@+#Sk8xJw-!GLAa^`>D-J=efLRXm zM+h{)GH70xE;_*RjXc0^l|A6@@V3jtkG`#Jw~%g+Mml)2@drBUB6YzCkKN(Rv^oMi z%nDNVh4FgEHDf*kY^zJt#e|GY$54Yx`l{!H>V5ncyKkbgRjIKjXNx2OeV}s3s|NC4 zk2J?r?Ht)W`o301Lm#5isPRpdN6p~)_Ip{3=AMvOo3;nvyrE0bzY+K@Kqf;4Auf1t zw==j1QGpMqa=&Rqu+=sBMc0mOn~#i$1X=ok+@CdJ>-Mh+=x(3yJzXT@q>leGNHG5o zt0s&b|EK0_Npm9lk_~QaM)eh3f>@#+PoMw|FdksdxY#v7UCDKAjU>W|xrcu-Bi=Zr z;(c4#Zf@l&ge05@9-i{)@dN~U#Fqh+5%Vh5dEo^Ab=UOs&D!y6&-?vE_5mc5^IFeC zw*-1p%7NKWFL&tC=Vu1{B)2C1K)Jl)R+aG9HCojX)E7QyWsSdiZzUoY=%)2Z?-uw3 zThQVZn{x-j7X`fb`&?6O$6&Za)5C*asI?1GAjs9A>ZZ+Q~4wc_plWU#Q|;jt(G*DSOB!$?`R zW@X&|qCFx+SRs)T8CxPDrf+;lQMjv~*PZbZ-XNU}oFm|8O2o7Z(!x z7PSp;fL6q0Q!r1=3CF`EC-=ICkD^xy)Jj;7FeaUCYF;5W1MuC5rTG9XZvh*-W|e1U zO;c)b=Y6ht$vh-afarWx6uFv5N^tb-rGSDDXBTGf7FN z$c2BlKsHkXv3P&NT0d{qjjNQ$D@kcO%pYEfBse?2Z<=$|syY<{!EtXe0ta@wR-~n+ zp3X1^nPm}B=i9Cv+74lp00uTzUPa@=T#5=;{inJ)|FkAN_Jv$<1?w-`VEdaUie^di z)W8M~u?mn|w%$qW2j?-T%qXGMDDxn$(A=)(<3J+Cgt;jjmZ@=Rs!~C0*6=9=e0l=oY?Vq6{RbM6%Z9Li5jbVy zfPohHFbjjWr_}*7z0Vf|pvAzeiWVD-$>av!mwaA>s69)it^UzB+F(?g%vH0!hor$bw%Fz~tfug)V(F8rBhrU50Pvlla5-U$!tXr?r0qAEb3A6V1aYT-L|gA$O0>F-LXhg!a@1!r3jC4>u17PHY8Ra7?gOJT)UW-G=dn{k?Gol?3vx zygnW9(};`QjUp(tHONKt8DgsfZ`$_!W32k7Fk2e!NRJ$tWW|hg{proGhoc^uNJ~zC z48)%1geJj$fKj{n4Bsl+!9#wz`mJt6ovv4qob}}zp zg^=9ic}7?p#ld7(ov4vQ-o>~nd^Y|;vEC5fOpAdNSd=f(@9zw~3R4qT_#ZlFG?(G8 z6{eh10#QV>ta2$!Z7g!`{E9~uQC5eYiMY6gs9+5(R&OGDY&;^joZr-3*@!5JQ$t1b zA`Ke9mMdHQax|Rg%8GTRccbdkwLkFA<$%oxE=Web(BF|Q>8C1BKFt{BH8k#z2ME!- z{&sTcV*A-WKR>?OLP8v0q8t1Y)`5Cet$2&tsJJU~9QRix%IG_OBlM`l0cou_H{=&% zscgipHfsh>elB+oyKKL_pD$Wj@aYCau=KGJa%~=uqVa-0hDe5*>yfEpqOoOOd!2=+ z?<6K!w5ui9Hj!qpY)fc3=37SQ<80cKHc^W7B_+m9+r*6X`>r$n3TliB@dI(|Ok(*>~hrbl_= zL0V2hSDc~fXxi8YZ~Dc7>?7+9=}g;%(7T!yW~R)pcKkI#TEFE5UmQREAoGAxGZKc1 zQ~SFOvXIs6?;eakOfF#9zi)HXI{;2Ax<7Zm5DsIp|7~#lAExA({(pm;WX(l0;`aZd zavt51B68g33t;7TG`gxf?HP)1u|yap{0GZP5`tvB#>Z|J4y~(RFE;&<0q!2G3x+}R z9iXo?aN3#rY4?MP{~4O&dsFTE#`gJE;{rh0`N-g<83L`Acf|1zX?O9~`uij#aku(E zXP^qG|8)ksa0{}7f2n|tDS3U$Z|vvh6vwy&#Rmg|g$eM&2*oD`EVhFscEb2A3X8~| z)Cclw07`vIS3S9AVlO9`rrD@MT6BG1Z0vv)kR?WlK$1Kk#+MEv#;(HD?9T?N_;2{< zc((fpW*&yvhA2#}=>E!(jY4+9l|%{ezEAo%$S(`ezWE3EgL9r6AXNE$f9l%4SSMlo zH3rCg{-Gg9TD^Z3YU|ZFkryM5Sdxlxljczr5oN58?1YypDIB)PhHl284)!G=!&Onl zfFVomrqd8v;L)&CtCM*4cL+>lFT+9@!kA`dJE^@ybx|+IVbh_#WfIJVQ6)1JbZx4% z)5Xg2QQOkLL10?O6Y8L=M|wob{2N9;2?r`C!_OQhO$p^AS%^IP$ovY^feQ~; zJ!(k#-6MIz8g`J@?2log9gDDespwsZ%SS`}{|+B!YB2eVxCY*4AB4)0*{?u*8TDOt z=74}n+8c+F?FQCoH}=;3Q}O5a2@$-9!$04rq5(V3-Z^0UwGhvgQB`8^n7N-q#Vix? zL|Vp)lSIwIyat#IrUI|Mfb8llDdw%S3JQ|QKL4?awCaf2zvXr=#Q@GPc4f@1MHJtf z+KKbB+`9J5Lf8}y8@|XNZ>2b~)IKbOY}-3}NvKNO*;>YPvz9%bynVLWm?IwQ%paB7 z|I1SOR>rq9^N?RTC|qYkES;KgjY(0CWfKZcmQeBlI?Sx7-zRtYcLTP1yjz_dr5a!@ zNZ;gm$(w}qFS)#dX&?5a`(VS27dcMYyQa9$!%{((fn0}NjxWLU&8QFRoFMz_x@Rkv$tLcwE2!G#QY%6;E1d~$_#S9)fjfX zk7cKtf|!g~aoVV*p1B;4=>x7X;mO~uH7(+vO!;DOlV(ts_q@b`WJ?aX;e+8|%@pel zcew!Mut11e42pV2YeCEBf=yVptV>P7(be| zZqu<2vkuV;7h~X7@!KSKYXpkI zL0UV4&x%>31#N(eTxB)euU4RuCuzCFFAhsC5A{XWDShGvg`o!zOXU5gSde-P!G< zP;E5^DNF|Q-TzWBhe~(dFPT(cs|{Ny#f6PCUAQLFGf>8qL!?Vy>5Jbn7ORl?+i!SJQgCb@J*ya%9Vh%(0)^*qw< zc^WOC4e!|+(RBjy?T4L-vRBRDOTSgh_W07IOtw>E8wJr@@EaNLd$mP`8%!g#-t&UN zcErpoN!!X|@1$GKvWD(W6-D~y3-wvNeZoF>t|kojzo!+}>P+&q9fre=mcmG>ttJ`k zDbYBa%h;(8(+O5Bm80TY$~ksbVtO!&)(wJgi&xI2o4yZY1a{sMxX9!dYYatRJ#YgW zq;ULbSJ;p@P+@B9Y)~eVp6JQO)F-85!`V`EY=HLPQuli^vS*v^^pd1xyf)cLEyF_+s~sH8I*LWLD`F8|Gyl@f(^j!@;ceUQOg=*IhxMH3{n0H7!q+F>8J}5?u&c*wE|K<%i$di&$Gh(Etw;ztewC@g$Rmon*OmyZ?}Ru#NSQsR-Yhyc^iKDG0A|v84hr z=~W@je*xIJ#kX=g6MwxrRVnDJ^%f`5J>U8*@swhJzja?TbX!lmxzCGcCdjQ7Rm>0Y zY5JV#IaMdqaqywP?iodeNdw2rB5%wrbtamvtfjINe?9G&F~|&uchDJ5T2n70#%=so zy7pvLDtG>5H*$CEJR+XmOOm!4S-sVIuYr^uQJ;VT*xYv0eX+`t!nWFOUdOsEikyU0 z8DJP*8!S`r)N%>Wz4y!V<%T~ginvOmyLoxZ&_UJ@-LYP>W}{nQfZwthREF~8F8+qD zyO^8K=QoSXDn#;fEWK>;rs7I2>@PWCVfwcs$+y6X=Fn(+W(aj>MR!Xz9gxy*a9^2J z%g|K&aXlQql*&@kvfxHjG7g5Hze;tRj%stNP*mFot zxh5a2lK|e&1x8V{^l~^C5;79cRy(#4=)=vMrw4$ROD2l2LAI6YV44|CA2lKx+fEye zcZh#|i1&<(|G3$K(VCY%UWJx5qFpQ&pr(?6h%3R(#%i4sQl#mbj+A^g2EU!ll~>09 z11RRoKJs4M81%8j`7;UkZS%e64-ek2iY=^SsXuZ&Xyo&F4;F~a8qZ}Sei5Jaw@h$> zTt)F&M|Q1W?BxME14d>)e3xl<%>yPN4QA2A4OSrL`SU#u7>h15p%_#uv{yzS$oBqw z)`K5E6zFN%T4Z>E@OIA1<4}v6MVY0BO`X#HpqI>>b9oY{NVwmF3QnPi)7J11c{xj1 zWjTvZzbMwVpe5ri)v#&ldci>$p5aEUDVlhUv|eI@*f!{4K3J4 zlWSaeM2%}gy7%`3SyJRq>q-9*93d>_fvjn?SZ_YJ+TZsTJdJ(WYQRZLCLIEP@Ob#b-*DHL_s2o}HY#Dn6Y z`1kWsY{l!Rp+1#c!)J@b5+h#EPq&$6+8tE)kLlaV{l%S?6voQePmC^E)Q&*90b)4k z5pI&nCKz;I0S7Mo`GXHK;Z?ftRQ+ftXq%n+!8GR#Q`i?@xYj3mlH|T>(kOH^fw8~& z@3*dC!qXs;OOg*_rCxP9whWTGp;e@@zkZiccp!=u?fh|kkltS9-sr2kcpNW7MzoI+ z=SG^%FoA3u*L>PB^ajjVC(1&r&nM8)Hbs3vwOZRxpxj&qQ)-TpoTmwhJV0tb!_h#; zrdYi8YnZITkK)J(J2WE`R!cmb0L%QCU~LPXECtvGWKS!h;(>`P*>Bsj4JW^L0ObqH zk!lz!RyIl6mA_6FN0$32bL!XOT3r_>Y5hZ_PZ!5U+IUz-J8qt8pjPBIDtpQ!Mzotg zien_FQ*?5da4OtNkup0;S%-WoJyW?VQF?B!uUa~;xz+G@7;Zdzee|NE9I!OJ=mhQYod@kBMVB0%gB07^-x5e2pltkwkrJaM0f`1EtWhqp{fnK!lORlx6*P|r0&jV`P=G16 z{5Ht0sYWZPNu$;6COMv_8LDB~pA=ZaY5u%Pu3^&7b;|_`BzV~5e2f< zxaOgBjg`(!-k}e+MARagVDmtLuZ*|HrUpu}@#06bDWynm(3uRzPiFgx?856)0O4vh zKvW9}kx;Su!e^mbp$@7+6%BokxCr?rqf9|2Q33^e_~-FL$ALiLJ1$OPo+OfjQs#W2 ztN`-A?yN!A!3q{ji5~-g?`lhTR2?Nlr_uqclAiA=+JQ$9&gdFc%E>AZdNH32bsMyrn$Y?%=`o0Qgx@ z9{5;xogfu*frFv28?CUM%=ur>tG|i@{{lg-3Faa45Vqn;K(!{P!qc;Z(b5warNp_5 ziKvH*(PAvbYN~I0F;QFOfMd^ish7>uStToz2(08m$Zb&aRcAl~$f|v+LN#OEL^GXL zXtuOugAj(oYstx3TFJoNEa90R&`#)7BA67VzR@)Nem$BthDgTZi#BubfAUwov`Xd4 zp)Uv^N%7V?_u{&OdciDkG#SD!VJwoZNpr5Iprx)$#L;Lvt60$9>*cGq{%Y|u8&}U4W)Y;L8zki^4{#zH;ewx`b?Fu zLS%HsAhP5*$}|-|*$c9AM6X@1bs+G@?Yx}j*==X$gyeg%53eV9N)`8-ejM4qw!j37 zHWcB%ytc)c?OnmSi+Io|vIFi~S_AQPh!FNx~1wk$^ zPR`4TsPY-*s55o2-I%HLUjD-?Sxvo6=r`1fzh*Y~l2oy5OWMqkVKXkMIo=KC7zl?g z)gg@((i9<3LMrJ{Mhq*L8vn#^O~Y^o~juw4+MJ%lDo^J~(7*;jvmvf0j5f zb38w%S>dR{9>PO!P|6;GVWD$sKtF$XwcFnh zK}eT3)`r*UDYhkkHfBC%?O z?0OEOUBcvoTo=zmx2MQb!XLBXjJGI*En5AL4VAv6ud4ZtC+!1Wl&gKJA2pjoGEpkj z8>ua62uGxdo#j@rXj4{U3r+&?bv$N;A$UAKci(-c2AvosKF|LozPjr@iT3?c? z+w6l98iX409##(5@EdUS&F5V@Tkx2l^q{j>M1Q5<#OzA5r4t<|8s)fS`77~&33$e| zkDaYNXb%pH!OMcKy;rzMJZ9ehJW*u#^QU({x29~P=iAhc2?oKZQ{~xM3Dok7pwd4_ z5qO;Z!?o|PLUN>S{!BB!iJfyfDkNjA&1V|Q@y9%0RIJRUTka@N7ZirykuE4HdYHWN zyy_hF6XPKGcD<(kq4>utl=br(KS_glUDoPlY^!i-3mTT};{8%xzogB*_R3$e0WY}V z$eYRG9wBOpYLsLNn>4w_33^izGOO4$FVF3DF`FCwF@>MNtS$?e`?SZnkZI{~JcCut z3$WQG9zD|OpcC5_a<^+I7v>>)8-DHspBR_!j!Km*?#f^220U&y;IBwL4Wz|tz*NPn z$W|TvfS+6MtU(DS)o6(=cq!xaqGzB1d5k~MRbMV&({=wjev>ypiJZe8t!{Rkjn*Rz z@Rv4MqETRJE0oI8bi|~j+Sq^*GO2I^P_Cgy9K9|KSLk9(!h+I(yE~|>1MyQ_>>iGDZF6WqtX5%+T?3<%F5ID9ye}l#%$0dSc(!e=dhSnt2;dy zbq+9unj7VCd*bABT5pMM3ovqFhXY_-O{;7K- z6$jTw2J-l>7|TqOr6XKm^eB9ua@to~?ltPS0a(a{F!KYrogmbKFVOPT~vP)um} z^UC1;9gObN*W+ug^Yh90_4vT!hw=w3mG75qWs+BvAplux@!tA%kddf2qp@GXW{Rqt z)c=B{yM?)L`pPqNS1)V(i<iF14}2v^1V0cWoNVe)H_FKK2G zT}}azd6!&YdE#JScgeNf-_iZqn)&&By)a4??J`>w(8<=SPkaSAG#=Kxn=6_GNdf)g zd$>TIC-8k+U83sx=7YrjAGI(zH`hIzQIa|4+=wI&X`I`6sB#wqP z$cDxL1x~uzS-G{(%hql=QFjiUG$GkMt5ZspHA>;myDBSF*&cdRQq_B^#Ns`xs5KIK zU`es~IW~tjJ}@{o#49(*F4Nf^ZO#AZjI8U?RzF__f!6N3aC#A89-RP`XXh#dAQFf` zRuMQzKUW5ndKP2cUXz5yC9BZ-;ledl`UhSe*iISA#w;vF)4i*O6d!#`Y%kL~-rQD> z-I~dTlH`W&svz|B7RN(mSoY@yJ}45U>Ujr?5}wA213} zTV1=6pST_Eg%_E+4cc8Y?CdS6E|yLyDI{EkmE}~jCZkml^APd+{0$;NL87Uaj1TsH z*CX3?=b(0@;FO=sUh-$ICO|t8$`8c~X8e0(;qsC>JtnGlfMAvv9c4WwFe7J0MVV-V zg&8y$m3GDaY`nAIeqj#GSn)2skvq{hnm|)E(H~YI(Pu@{L{bl)x>14TSeL3PBvkb7 zCDx=N6LTwVuXm1Zm`sM?T9!8%2j>D02ZMD6-H!m@%9Jv)6ObSBd$|%qQh(v>%pt%D~1s zyXofpG1@w}4f3rZE$J~!CI|Lh^Y8RYCt=U$u>(jR2{a2MKUi!{L#OR`R(nbA9Dr3( z!^9V(j{Eph-EP-m`YdxJgp~+%qHP`NJ*!vO7S2bVYo`x@ym%M^if+<)Ok$t+HEF=N z5D8B}Itb8YjOg|^2Sr;E1C>adbsRY6Mdqx_zV?MQ?myt<*w)rX(4)wS=KVn>{eK3X z_6NiS9TlsPMyIo%_8vn5zdMx`+zjH=yaZl z+&YGzFH)lB&)K5gIpDT=3Jm?;CPl^rI<-T9`MA=V(>gn2F5v-bN87CHaINc*Tx_0K zOt`_-SMoW$H8G+xzNo}XRz3(qhe*lB86Jd16)6eL3HS~0hl^4^f7dm$Vzi|R?P53N zxI`NLhM4&4tUi@6>$RNGugVITAlednopiQ2n9a>>UM4Kn7Ji8>t->%B7}NxtvXx*B zwt{+E)z5!y<1mlm_Lj-#s57#cRMGHB38TXR5BnHpagm8me?{1WjA?blBwgVG?>-BQ zX6j1Jg;cKBPi07jfgkE*O6@>=q?vOz!flti{%#=hE-18bEzc^d@+x$Vggto)JV_S< z>cQy8QMSm6YJJ6Pc30%T+>z1=2T4N_Tx_FNlx$FhNNU>aVtSx)-j5p%V0^~`r8dFd z+^aPm%yJs9I;_#rGz{8apR=>-s+Aax^vg=iG&r!w%Z=L8k_@zLso7Tys!`@Ol49jb z8XzXo`?=K~synfM9R@&_79EsP@P?a6^c7u+N${Fq66>GaD^MFx5aKC4jYrBVcG9Ty z5Naf!P{efB@t!L1tb<~eG9S^DnFDm2sGxF<9aZpPmN_)@xJb;vkY03`CS5X@v!h0cT8K5ACAO0JlqPK)wtIK=*5?ii?E~~S)ei`Y7eFJno#b*jv~0dNoz?3f zQ7$;8s1%M?c<3-r#taw_`ZnG7W4eXm#yu#bbj8uUq%)I8MB50opCHBwV$jko?+$kB;qUe%JZPwUp{88@St{W)mFdP))i`-14HqAzGunPz(X^Oa1PTQFI~M^=GQkoZ zI(L!2Ikum><*0q)vUw6xBqR5qBOx~1D=#vbXdVUn1C8u72u_LOrr~{;uk36D9X|eu zxe^y?uP@zoNfCVF+=SC=_4mfaMPqWghJ>F8FfLZRh~g$lSfmRJtCR^=RgG2W)Oih` zB{~Sjw(2bOtF1k*IeR6e1$5J-nmANoAVB0Fx2$!qdV$~c$i_b|00+dTYhXH~Xx%g5c(X-tFM^F)_|-A8 zqZ9SM7P>b~)XiMmrcOoKBS1gn@8S!rx_yC^ac|zdu>-N~-tnq&D6C+11Cfb_$j>c} z9jXxCWlER}x=j(%m|EAXAJ zKe}(YWja>~mk3=71&w8Hgp<*pc&=lXQJxwl=PvCQCH*k)cj`jvvwR5WD9(9ftudas z)}mP{W6}h-9z=jXB$UbkdUJ*5@CR?5A!fuBDRF3=mJNRDT(a}IrwG;8E`ko@aHF~7 zX`Hv`6f#^cZ+u@`0n$|dObsLpm#$@eF)z{##CRW4!RH<8#k89L?uK3R{1|Ke#{E$& zwB8dQJ+}igrM2?_CBDv+^uX`;_isc!Ri6z23DBf7%IqX=E2v}4ljfHKhJ}=^^rlPc z(MbdiGAc>4H5I5u|D*)+vh5j`2X!x^B1_31oi9#Hk%+vxBkkV~|2fs#KR^jsOKnu+ zM}u{^>OltCgaG2>9;_SMQYUizs9ih})Fh>r(cLYH@q1GCX1Ef6@o-DEy|m(UvwVpZ zlFw~NJ!V-cfGsz-TgzB(>qxk(xHi}Saf^x3bi~fN-mDTeh_AK~ z1tz(1Qj?)Ar!&yVnTBGfi6ZUy56G(vBrm$C>mie(u8N=aT!*GK3m3mSMs{;J^ikz1 z-$89Wak)3o7;Dgqf$OZsPO2D)+kpk|7E%#|d!p+(%lbm-NqdR?!+XL`Z~uTALP1{O zOboUsZfIqVkd;<(<^Gbs>>Anb!O>K^cni^TvkrYQuoQsR-7I*1JKvUKlwWKI_xbZ6 zq2H89Zorq<48EuDbUkVA=kvZ!i2gzG+vFkTGrt8g0Q?3og5dC*?D3Kdao;^4_5(Kr zpz$mn@L}my=pjyK`DX0x2-9|rtg-X)iIk0&DbsFG;yJk&1->NMAbI&$)UlWJ!27v~ z#}B*noa;ERyd&Fi($RV>2(&?6&E}!;2f*&9hQX%HJLz2uOcBiVHsv7Thygz_U z_$`p-ER-J1Pqja3f6=f~u=W7?g0q<}V={X^Gqm~kw?I+UcGl&mp!D5!3TDSR@G$6x zsUMFJLj(8ws4mU00E>6s9ASG=S4vQoeEZA%YK$^0v+&}3z9w4BZO zW{}7BOTsU-oH+TZo1Kx#0ad1V^L{@OlCD-H@0Cv}4^=4a*72NEiu>v$ zs_bQGk+d@Oj)eU~J|Mv-4~~fgkn9}BFO)cy}9_;Q{&_=c1x}!6hkAGKrnsu!V zy3~8eq|CpB`Q|e3_o`ZnqX4h!QKAlVQ1g3(AXtUJ4SjzRTTQ~m$l;mMsnt0?3~q=n zJJ;F)^&|H*N4Nv3K18;aIf%Knk85W@nX>Fuk?>}`Ht#&x!)l`~hoMt1wzuaIQI;nM z?6gTCoe#~jTM&J4;731nX1(VkW_WlbyyiTMX3Pp4rqt#hjDBp6e>E*DtQf9}3#27BGGKWV+C|!L z>dPezS<0nm`{Ikqt>f$o6QOmDgd~w3?j>3EjZnh>X4WZy-)k&0rX{O9RPYr%+ZitI z#;4rtT5!U>HoJ&J^S%rTPTtNwuLMtW=6cHviUC7Z~{vDfi$48 zfe_RX{(+D^HuFj$U0o9Le1CJyd{{zppLfeIuA30*6fy1YTj|&v zQtkR0)@`I6g(_5O ziZhe6D5MZG3&7L>iZMOAwjX6?+m3PcGcqi`1%#^k0``u}w<9=e3>{43l8Uv`|ej}71T;z3O4 zIam%J0~3mNO01?yK4AQtPn@Qp`Kg8s`wouLPnOUaV3P9xF!oMewuar7W!ScD+umW@ zwr$(CZQDC++qP}(iZ4%9%gk!$;{1Vi@m{Pp=X}QK9hhY@*%^Z3Hmm!hqx?$zkW+RI zn!`la!ycDtq#Bsqgoq+5Q z`fqwT?Jm!LCBDYlam9^u^KM>BU|{DI$G2qyse{sFLGDC1vNBoEY-k}MY4Wd2cZA*1 z+`}0ujjtTmHJC_Xv;TS0&1Xqe)QW*wtScF-=}w^ad9)SYe1zj@%A>8+3Z6|Cj!B!K zjch51ebjpbtgpF91QN=m)G}FhkW^*Ub4sNaM-r&wN(-h&>sO25d*j8TYhRJmCt95h zM4!6`0|a@+h&QWCcE_~z_Z(F}+ekxk_G;ApB&Tc1XWFed9@371EgR7LpYVf&6ke62acZ%y5N^m!kRNCL-?~9e)D*Xj zcNc1YOjaP-c6i12$n8+mwp0Mjvii(zMFUJN1d$7q@7A&)UDz-Jey$wOJyp+ikYu_e zRhxZA3b&hl#@J?3>#G+I%7*xGwLV_JOy<>+kg%}>twZcP1y@?UlTJ*Rx8^aYv^MYc zTXkBuaWq47@QQsf_d_yfenN@jW8Y;{x`Vb)aZ2ezL&6;k^|*X^eab(5#eq8no`}Ho z+|^DnQ$~#p(WIL8f_}Q9L3S0;;GzOL_CKQFZLl;h`m>&pnVAh`m@^`7C(f zl3;cBbeR(~whxAERQv3xK%_;IkAa?R3M?f;Fsj%%l}h7URapW-M0Su(>m*`SE~*6d z`>rm~fFw67RaK*~xX)gFk!w5Ijm9(yDCEXXpW?2}oca2$4wMpOK*vhtulS(sOr+M1 zXiUq~?E=?p<^;*+(VTZU@2f_$^TE|6-3<|u69yQ09B(vXh;RgPIfuZ{fO|7XIBhd9 zW0aG*94$N#F-lU%iTF&WvZra&iahMyrBc#hJWUznvmA{x^>By71;pwa4@jI9H#|+u zFggqX)diDjaIfB(KryD%0@`gA?et&>-8d7L)Y%N~ED8PjodwDA8*l?uq&9kHO*S`+ zolwvZXKVu}LRrvh#5k^|XH_Io8l_OmH&Zh;(*q6G!@y1+@?ZvOA`t zoN1JEvWT6+s7=Vc8oNn_I9E@b-10qcvkgcpp)c3QNW7W;okZZ?s2{o-poPtE5q7h| zwqO+(T!)T(Yj@3EtRL51BGUq+%cWKrWhhD9abkBK3{7J36ZwlsFVclGL6F*|kmI08 zJ2$}gDC5^dmscdOOs7dy(^k#R=hu<6k=~S%g#F+us6)|I2{pU5Vj+KbXYyl6t=gnd zNugCfc|Igp6`d-xs1AjTCgYW)pzCx(#S>AhcHuN#p-3e{av&xjj-d;BtScFXGR@u$ z_R#E>)PJtqK$bh7qXb6s$^cH5lD+5_bUA>gd+ZiumXwW}n?bwRpiUaf?rm?FbuONa z`aroHKAUjeP`nzm!khm!iv+?8Dg{lQTn7l;X5s@?82e6I?=MXjJk{OCovcNl=13du zS+mF4AOfN=IoNc;Of@Gu?SH-|VbzrE2AD`r&^USz7@d@~RPVd}bJETA687h6IQj$3 zEy!joZ@%OBLRq*13XKP0te?U4YRl3%mjqZ=H0`fo0PGM2HEh7|k9pft+1%g;w>x&q zy7(GCd=s4WWvSaZ(_E(}@xjDhry4qj zFOj$o0~hq?uC0L~l+JxJAyFkd-?j;S5aLE{waAH=T?CWmA~X@sfB0KGDY==nbZ;rC z-oLA+@ty@A@o+NE^x`8V_J#>HhH;DkH}YB{tE8WJA3;gk=J`jzffJ3y3k*LuqEYf~ ziRtd*eHMB4RkZJF$HSKcnNiB+&im}eFMm@L+u(ZvT3xLZOO7=vy&r$B!18rSiVKYt zXNngW+;hD@dFGPH+TIZ&l0vlGyq5$PGb~aJmiBg~&kR48AZs=IY-Rj4+gcrJ3ja}r zyvn(LVLD6Jx#|+&EtgHKYpCb8tqbRV7~Cq*&OR%xoNeNh7dKXX{gsV_t@xUqzPXOh z<<4*06+Z4!Hm=7g?jdh{2_1a3+kD8X58`ROqpl#( zNy_jnP%Zz4FjYyLJtvTr!2GZ66$zot993^ z`peU81>U?&Sn28Sc5+RMvFiO3_eMV{#ATq06W0)ODTcPVowduPjh;{s2dRjE$5z-} zO^#YZ*X69=2fq-S@8N&5udp%x&)z5gZ^FT}mPFnE3NHP}g0SBM0RO*(OZ9ox+Du^? zQa`@!DC0yTHaDy3`S+TwG>OB8%W74nyJTz%|Kemq~3{ot;4g9Ezcf+gA{+wOXo6ZTjy?U%2u)*fv zY2W+7Zb`=c=MN2x2?Grtmwv#Bz$UH-Da98=Y7-{zqkvvLf>-zFmRTo{M)qOVE=zlQb(f4N zTV>G?S`D_~=d&(pDU*VF@6)f;PrA3-jIi_T`}_3d^47psG&#}z0ULRUDX4VTZ3A>A ztTuwxw|j4hA}f7>Gj0=w?nhO9cu|m!UO!KR@m>d(j~gn!B5P)oxEFS5+VC?lsv7giwCW(mr&3D&zS5q?Sw8m zIhG-%ZNv;ZjwL!p_@2s41Lbe@C;wYFOsQ!shi;i`m{Jouu5{7YzFtwhkElq5+1Q{# zM}PBx(~2J#nOv$z)sGo$7xTBmQE^V5)WB@KPT6T)OvM+3?KG;as5P{f8FMIEZvaIl zZh7ATt)=tD9+NhxjzoNGAZuD^W4X$)2cSP>lyJ4zz`!;UbM^HDs~iyp!5!wAZ6CA! z#YscD`uG?4HT>}LVKT(bDbQ$MeH)V+30WWK6_wLMj0oXuQ!_<^hs->%gQ3mc5X~b2 z@Q;}>XZCn_cH>&lw1bP(R-YiP3GFB!kT`%k*FeT7`Vh@aI&~%Ibml+e)@OF&fo+b* z!m5E~1WK}L$md>0!U(0s+d2zQP^%dP+b6VY+FN-tN=Dxa>Gb*qC9+ovs}>nAVq&cc zIxY-s$E0FLPP7dG|8*L?{j4@k%#}u#iNaL|Desd69B7?VQ<2=juKpwP#7SYJJC{c3 z>G~;cwAGC4gU`OJgKQW!U%BiMpop66504O`hYu=Qc%92T$=ioSj~vjNM?7k}_|6b> zR6alsJO&D<^_0J=?;b-5RDgRHU&CiDMHlP|6ueKSjjtSh0jfkru=GI5rX{E8y8ay8 zoqJ|=$BdL>niLbH5S`b~n-fJ5_IHfUdWUhNF{e`;wNdlHF z<9Y%%fm^8~*iyng9m^(V&mPzZ$!SqA&7?dT3tYD(L8?Pf%F+n01L(BnRNRaC$6Uo- zmTRfqDNP~tph$5nyFnVorwG{TcxJASq z9ZB24)#2KSL|6ge%(}L$71K&?@a11xfDbA?R8RdUGS8BZ*-vy(e;s0N0Eg!4Rfv^7 zY>%gL82OjCC6Sz(#^5b@=w3A+JSt=2UGMI;9qtiq+ruY^YJP!uQg;{*X>EFL2$>NE z4Z;V8`9g$4+V~^T z)ZQ`0n~zMXUz0fN{bYJ$eucDOyW4XDwnGqRM?{QujTNP|`;=)Syb7(@%6KPv$trI?1bi>aKW+BKVZ>MudH9K5>^jBgHe zBD|tBSU?wIpeuZ+yCg%s`A7}5Pt_N=dh#Fd{4`Hb{e)BoYPeo?q7Pvy%4xR`O+^fg z2WHfQ&7JZ}DNBfy+o^EjxA#rV7VEP+1vY19?9B=v?cj?<0pvbF zk!xIaInP$d2o zE*wO+)REoofdgIUsD!sPDXA=7R?CU z_G5Y5^)SQx96)&iFxxhA{X9R=5D~)WaCuh+&tCE^Q`yLeRXLPIb^R|mO#Ngl*Gh)c zGpV1iiDOk#`bf6**Q(-#UV70W&YI5+y>psP5WZ-}L*H&nwRUJr06&&G<)LM+%)r+I zR@_i$KTYi=!MI))WK$5hfiu20td*N};`;A5~_*hyERE z9}G^Q8=HiFiQ?r8obXCe3X&-)GiyeA;6iU+Hj6^=VDoK-jlZu^loKUj)v-?aSa)sH zU>iG^r}9-5NXo155{q2s@~@EErGi;N{mBJ2qK+cdtV7|5o_9G55ssvXm1Vlym;}7K zAo05nl`@o-SE;&wR!h4GyDI61=4t2Zsc9h-YhvnH&LB}c26zk-Bpb=9O&$}%caL|i z_A$?~=pAiu^Reyqb(F#DR3&^Lav$fuP?|j}i1M)vF;Y;RV7X0z|}Z-ISkI1{#v*#r=fHA6FkE0*3&=zG_#LJv|p zglWxdwJ#MUPz@KdQep^YA7dYwQH*KUjG^2DAxu6hGA5^dnZ$#qwx3&gD-bdnR+vBb zraSMYH@FvOuH(}lSt|OG#4q)*u#UpZ2^61crm^Nyq}fp9qFT!+v24e^v-7w1KqFyV zH}qMtUfCDeJX}9=%qvjlMP=EE)xELd8a1q+nC?DGcC+@Ex^UnA?mAi>F7MuaOy>Q7 zI|kYl|98VY%l~MYXJ`KZl~pHWf0btc-{ZqD_}m?l0F!`g(i7d-fUVTJF&guKjJCH# zBIA~By97bddTk~R%GIM4;FF8L#4?UyY(=MpKx)9#jN8Ox2|6%ggHuYK$=AjdU`W~eI zP6pX}5Ecb`M_)qTlyLgrU3!Gyk(m733%>;Q;7u=}^1B@M%UAK=wrYjgN4q1!<#XPx zUrus81$qQh_~xP15t5p~R%tJ48r`{sz1H0`;_fX%_}9CSTIKuqYJ`N@={dhhWvIi~ z*W|B0xGClQvA3*Oj^D0=K}Xl`v*P_Ns|?mU7nRf(aGVB1h)>S~zh31RGqUITAIu2K zFJ{F07c-)Rm=YeToksE>%!t8%VMdn!3o`;TJt#dLi9XJ^&OMmJuBFzOtmu4sE=jI+ z!ouB5cKek^ae6I+gGc!1-;UWMD}98?%VoY=O#H2Df45Ov^&K*-|5F;=YcwQ~6FM%ZHXTLlO^EaQBU! zgd2k+m)gp1UM?v|9G-$K5r*yuqew!h4$1H=8s%Wee(>L{FTfw0eR{BH=4>U@RfU97YSg5c>y80P|inxZM$3wQe z&GMI)EoafHrxQc)pBy3dM{_k?F6k4On0hRylD8Yn`ob{KBR&E)R&(wT%HK8K>r zJ`G|q%Zp1znHnmoT;|o9sxjOZYx-hq}g8Q5@z3nE1= zbfQt|-nN~{KcGQhN~eZF!plxbeoTQEQ5URn9k6Z!^V)Gb`K$%D{~XFf#XSyP*O|WA ziay%VatM@FG#LS&wdhj?T3#h#P$MYz-s%N( zu1JBUG`IN17}KqwK(nS^1P&<$d(hVc)4NS>w;<#4Ad(Ucm^r1#gCD0Ra}o5+cCtg_AwJjX1*~P7_g-^M0|R<@4q%jO?gu5;eP3EiyPkSLD|Xa>+(jqyp;d46)De@ig5 zfxhvO&T=R8w;A|W+u<*fmP?!Q&EBr(qxQS9y|8~s2ZLhya*V6OAg0t zOrj0~+6_h)?AJVj$}c`@t&m5cvgy6dKPnMcMbO$JtL=02bn;oYqVDhm)o8Y*wCT!N4v_?J&Cs0v3 zplI676bqxNllCVhC4wG3QxA2=@mw+ZC9bA);LwaX?*m{3_66Ou(_N!w*YVY)| zm2m&MqI;x4MQ5$DjA_=$$d1^+=4n+YINJbs|%{nouK{%4>{{LA)e zo%v^}N{pyTbAmuwH6P054--8QQYT z&urpmYD?b5L2h-x=af~i_lC`I(#q@DHPH?)XksSm4alh4aBGZK9+G(y_oDEX!u`e) zGemg?#T}nj3rKieyz>$-ZXtMGnE5p&v4j{L{>LGlX!$ZZ>eo&7%dirhd6tA;YvWIS zk&DDeh9k*W;zr9--QX2|!#c(y&|AcQ_1T}wok~kMjk7qE6r_{EEGY{Ush_iO@8T@N7 zK{?q%R!v*WJ>y&SGb5PqHUq*r@)Fub0j39Q@{%}oFp~-r3ybrWNpUBHb%d!0@fM0H z>B~&&3xglB)8#JIbSS75!)h9h@37TDdU{1*$iqfl@zZ`0X{K;DG9a z9MYnc=1z_<+qqrBKvg)-pJGs)U8a~Hf>qjaOV5k(AvP068T|B7npE91SoP`(LD0E# zt1*HaqXjyZ1r8`Hf1gPr%cjTGvyUYbLSEbrhhkZ!Ytp$uXh@tn>pT1}%XF(eCZnUi z{ZDWB;KW{$I^?7cMKfCzt+AZuFcb)Pg>4fzQ7n(su` zCcE>>2t)a1YqKVj;uCwe=K82V2xg;S^JbZmzv)}oof6i8vgBhepvgsxs3syy3N><0 zh1gWMnVEBCN{TQY=@!hDYqV@6S#d6y)ScS#8I?s)o`zDrt}JZG^y67FF&T1}YdXG< z55jBfWK9ib-|BnkyJ1ZuS2Nj270pJdAOBjMFu!DifiKiv-@7l9^2Nqw56H~M;vm6W z4QJXm`q9@>FXV>--$Suhi1(hq%@OWQ^b0|a2kk8BuGBlNIoJy|Xz8CTNi+u{OEd#@ zBng)t*OAUU++RvKtNRf}&?&IewF6>qF3%UIw&KKQR;O+HE2tHdEl?(u?XeHth}NHG$%jBFvBWdZ(Jnv}9E!TS=kakyugmHH6b z{xVu7=tJ|f^AH?2^HO!9_h3>ax}4t^X5gnfU-SOm=|K`QhW$5#FZ=%}b;HEL$@G8L zZ?}K(dY5cSzj(bf@TvMYlz`CR&<#M-r1ULV(^+fHx-{Cjsjpw8@jc~4>Q#>*lJ-*y zZItofOXY-2-yHpeH+V8?GAo>{ZRdATyRTrse;PWyetA8g3UYlJhj68@CR_ogiJOoh zz{I7mm%Te2;7+MHb&5G5y-)#poVwSTUvBN$Exo*9apb>a?;$gI6g&q%f_Xmvul(Ul z2}l1$jbG>k5v$i{Zre(Cz@`R(>WeJ(fqMp4N@^*khYn}R@#pn(mz>lzIZ7B(_~ngO zF@l(&@f?4+fL#-k&-TqNVpR?z>FchCa@qOY#c*NT^FuGS(gdgX9}}ffdM>HYzuTwT z^HbnX!NPPWC&d}0BgsZ#opl`c^u)?(7|F!BuF{rKaoS1=Ix17*{75z zk#C|PzF>91<`Y)<6JJHR$X+{JJ)iTku@?Agbmr11;lw)R_>q~grKrU>Kruf>OBU)yoIz+JXc%OJ;SHsDeT+uTDhC&? z^0wg*#W08w-{nt^MOBlsh;=zLG;ezawIN1!WMt`(b5vy2C^CB+YY}l45l*a+ zE&4;ZG#T=hcUGcbP^Qkqb`J+ur8SRX7EKE2btgBIfy_W1S`52k6B zYq2eY8It|p8ZuarG4EzniGWSe&mV-%(BBCM9BbGVv{!o)^IHiPvR-7_WP>~9A9*@NW698eC+rVakCnZXx zFGPVE9>lQiA8B2V85AZCH{D?6EWeM=ZwXZ1iodLc z0>hIb{4JIvULZrD zsNz7NmjcTKV>yk%8FlHKT8cj8h<dWf!PF$GCF>e;_mALG_hxEDx|uN3_tajvZFNlduzrqn$)$}K9VN%1rgIXhcs=6~ zlYo4?-}mv1v8So*#h*)~^^uPC-kv%xym3LowS@}=TqqJ|`(U^=!7x>rW=`QSK(e9m z*zgM)M=}%aQ)*457&q^DX8E0+WTTbhJ*7@aHyTvP3ve*N5RNXggV+M|!ISl8VSS7O zGC^3ZO^&?A5cjGBwAlvTV?@r^^`pnZ>|-yusiR)MuO;vAX*V2y3p?qOWB-9wm_AjV zFz+fGo@!39k(xY%5%toFT>=JCFU?|T{u8{&aIW*l>3m)ku-Q<|q#|O`1w}@o;Ka_* zL~r`fog~eh9DUXEP_NGA7M*nFxi9>aTf0ydS)glQ(KJ*nqx8&ZeVpHxO-lQRU7N-E z@I@wHto{NfKQu!+;d{uL_p@gDj$G!!lx7lTlCF#BHgV0Px#{0smf{eQthuv#+KT?)g+o`_`j>Pt>fbu5EBmz4{gm+R!bFgRcU7GONnsS?=zvI-NyP zEGL=_@(dG|RGOaRx#5z-R%Ep{I3$sAYzyXFxuP4XfWZr-uFAaP*lom)I?{~=>H^*- z4}nv*GTiPlrAeCQ1}$07k;vr}h)|OiHoU5na|oZJ<`ppI@mPa5MKf{vPN{TWy^T{) zYqwvL%w{I|=@2YWg3=Wk5a+ zN@lY{i=Vh_^>*qWKJv^7Fs)Y%%DPwU?=(laYZ3&R#wAhZLCsD8D#ux{`L6p3a5B3! zySM|0fS&C?K-4-dy5=+7xD{l#XE*)xm5h#;G}hFusa7V=AdY|4t(?44ryVAVz)wrS z+EgCr|1PJ}?ntHq(^(V=%vq{jU{$x;5uX;U+D3KB>S>@ovkfYS+~#M_9IhA_qdn73 z{3@M5Wf`gSwutPjrke3luO~&w$8lRo9qlIBsC7o4qc4d@dJs~ve7lIuC|Gk$9B*FX zE4dti+m3f6;Y1>&$8RhCj<5j(ed92{<26oSXu>b;+>zW(Xu^&!ul(TJoxo??y z2W;zj!5K{1xNi*}42VO|^617?nelG+*mmB8`z6#|?FCH0o+A63Y!`sd&|{7(_~u)2 zi7&h%eQ+*80rRbSRm>gy6iFVB&3|CPzDH~KQ?$htDua4kUVdxO3@pD4Ll=gSk(cV2 z)K!?jf$ zD{x9L#y!rF`)R}ZDfnWbj9<=umW|;MtKKA!J8RkjQ`Ji6s8!=vR~&+Qx0s!Ch3Q=@ zl?KqOWcpt@TLgOWLbLl^XnDaa4yGjhvh9 z*EdF5ShWoxbOVJUTg(pZhqju*>3;oa0bdmJ`;(G_lRft@f(1=a zfG2~clW|(+T=uN2VEb&WGJfURj1u9w(~vhVeY|apx={-~cW?@O)O%>%zj%rCB^3|4 zg%u1D&tj8*I@p!kqNZ%=J-bPd51+FTAhta!R}1r494(d^dX;*tF2~J~(jdz|aoKR% zQcwQ^wwtflwt_pG@bBJ|&!|d#jq-DmCYuEQ%6NA9cWzC@8-mNbsi?~qCe?gGBpP!O ztKsOTdsWcz_420-r}2cA^;bN=%d9>z!rd{_CQtR(A1u(l(m6&Ch5hC1uib%GB~z3B$KNM~bh0Mae(sN3@W^)__(R>4Trcx62dfAi3wy7HH{ruJ|VP!@ODoWu< z3A~uIMXhGnv**?DtHjQHOg&$DV_p6Ec-;Mg2Wk+d|8GWe4yOOfEt;8u^Zz2^{3i&1 z)cRky=$boHKL04)Ut^r{sj;gd+ICxs^+Cwr@!K+S)dZ2q3)R`^YmgE3Hqr!|l}F_U zmT#VMi9SC^M@vVxDL&~u{{9&Jz1?2dReqn0pSLuVL_;{DvGYkbog*fzeX^-yRB@{q*}G&UZrLz@%`|K|(kX|Dxj; zMy+rP4#Poxx9@I>Xnv_U@npP8T0U@2lQpCl0sQQQ%dX$2X}z+d9(z$>a7Wh>tV)o? z#yh6osG+s(iQP4Kx6FFCOfnCr^kLd1m$Qr2L3+PL?AlI^zS}%9qw8+>nBIT9-##A> z{FBy`zlr*}uP@RW+EWuo?}wygAs;ZYX611Ue z7{@gez`nS)=8LdsW|jl3RwGJ0IPP1LLYe7Z`Go!+q}d(WM(%13bNW~Q6x~7@8<$N2 zeLgWQQr=3AjiQOfs3k#Mwwn&nq;7$@dQKz7}FgkuA;utsaGeT+jZEuWSw4dXkySR z)>TmiSCQilq0l3_p$-!Z;9gay3LtqTkFpfZxIG1SM6OWsk(&^pl%Uns!davHV#B z_|!qA7A76dAVvmeK-9($^=F{QBs(+%FCgd|+jLz~gFi@iZelNhRCc$*flAs;O^T+& z1%M5rw0~}T0xjogIO|fs;?=D~$0SlZ{8{At!{#)!6+PJc6&MxIyhl6&4| za){*gox_Z-M&O;etF2%}JJFhn=s{rY*TaW|h}+H)YL0$xa4V>2zOt^#y4HwxWFm!P zLE1}PFe=RwGBG#~3}Lzx!u;l@vl{ze7UDz9mAtO%O-|yph~jzX>XTg`T&^HYjeAVx zP**BW)REMPsu?~CP2w`lT`pjeDP(CdPo3@6EwGRO9)7hNn!D_ZN10R$!~nV?b|8FW zkr4;pqR*EOkA9{Ac&V9~KyQb*3Jsp+9rN5v)g7-2_FOK7}XeWm0Mk&S2p{6Si_ z882qkXnT_Ku8Y4-_eUd`HvxORaB-RCPokkHiw9*AfgLx$yF|j@qv2xQKu}X!1e2{) z6DJf}-o-&TT9%G86#^y~B>?&AL?`D-8h{TXCKY&o;kw5{OQ_^Q0z#7FGu=WBG_4bC zFp2<1Co>;UO2+Gi7Cm1Ch^QBH9T}i0e^1C88BVQnc(J1_$sZe>&M*c@RML^pgU!3) zN@if#im@=UQ4Awfn|@qsR%)AZY_0S@(>vImT7vZA9=4}7>g|LZO9Y*&V!5{9+ItJ> z&clx(mHgA<*ZzBz@VfX6QsSC;cHXEL{co{hg49Md^4z!Yucz)^v7hv2>SjBVe4#$e z>g8<}RkTM!^kngJn%kj^_3kM=M%bu#K!`^S%N9+C1}+;YlC)m~45eW$$zBB;@57AS zT?@o-f;MY8AtfM;z%R_+A+pHa`pIjaV?xA`136Dx|Wm{|X`o ziR6Ip&mXGV93bRi7G224g?r4Kw+)zP_dp*c`8@}js$}v%7@zz0BXKJ1Jn>+ZJHvfs zHEli+oD}^g?)T3C^+#w!x1ks6tB`nauv#ptz2_m+Fkh1N-uk5;2P1VS+@V=MZKAh) zNQ&H&w;WEhC{B$iorbbK@4k%WMbmXOC;HV$mZ2b}%Y;-{M}T4}IrZHWD}VaiDY_!X z50y4tPTWmLaVd8h#4AO$keubT;3wOxm@sGha0ZhmkOOT|Z%f)aBQovs7>L)(8BVA#zv11_zo+!@ z`54{Sz?yVDk@7*tWL-Mde04EJxw=V#BeC4i+i&6*&M9M1!5$CzW(yvF+pW)3SJ8n> zy{4(Zp%=ul@q)3oiU4Ma#E>pX4eOjxg;+xvK14P+l8KL7u5|0_RWXv~YgOFm^9_M9x_Kzvg*N%IQbIo#ZrN1;JcBNipn#iJs`ZFBLT zPY$(aZjW5Jf+(q2r^A)}MQ;j2W%xxRB`egKn00>@#fvdz^Qv7FxN6>I%q~Isn9lU- zIgBkA+Kv(eCj9w3Oz`x%m5^BfyGaB3Yxa#vx@CfUD;!+D1ycTKQo}nEE75>+Pxr_3 zrHHVDTLSkQxwa(gbs+6`Syp3m;WS?=XWBo*xFI?-1jwos>PWf4h;{eva4WDHr`L4M;q+Pgf7qyOn=K8GcxR_4J;S{^c4WvJv z4yfmbh{W?C1ZQt=#elO}UzWG(sajOVdd!sV*X=8)R&>)1hG`eMGs(ZiDiDsFsi&&Q z&i1dpUNpW+9z;GYPs`es$Ku?T_g}CTpTxRVB69P)`J{51(dnCxJS-}b2K`Y##gY6SU~3gE$(3HbHDvFeRZ$muFVNb znf|x<^*!A@Au_JvfpBu*pP-M5X4-roy*i7g{yNEJQ-0}I%r21aA*pR8hK922JT#1Pv4QjGSJnc~y_fs)oGo)I$L9KU-hBhT6TV`60xKF~ zxJ#Wy4$Lks%bY8?T1bhGt#<1bac868Ai22Wo(CgP+zntwxDXjqaj=>BQn8-_aCqO5 zq+K&g-huP!{5K`cj5%Wzdt{QC9B}uOj_tD6P>y6xDQs)zav_OYnP28b`b7RaUXy8~$%w|fj zo9}rxIL8))2CUcWZSSsH3PudIW9J*kMTsG76ZctO5{1>j(0n)LWg626xX3+>h)kK6 z2CC+QFPrD_n)ZQxGD zW~=@@M&A{-)G~)3;J3CO+pU@H0Ouj?51cW^79Y4W!*ee^#^&!Da;kNiD3;0SV^^Z~ zo_V*fWvIYoINNw_OG2};nH_2**K3_W81avM1}|l)-1*#8c30mk95tR#{d|CEAa4jxn?D-L|TwXEH9-KPvs#7Y^bfFg4Wtu4>%=jCXvvvX;<&U3kwrr_64F zAno`xQ5IxaC=OzwPXl3jEB7=3u z-nBL{nL74jGp?Vh+F9a7+Mkd%gUVe6GU2n4_QpwlWaqqKEk`qBQ@3dFJ%6VS-WaE2 zv=)D;!*$S;-#A1iFZav9ZGLq5Lnyp$XzKP(rOpg4S9}ZRy@v-h>){L`PEQ>~9P$5n zc(}v3_GVQm-PWTKzDBv`;T`j7#)P_}cP&-{1BSDOT}}$UlCO2x0mIp#-%(fJi?UiR zB{If>^&Vhmyty_@=|a!nSd@wAw>_6nb>;o&uhL9f<8la;9bd@^4m5hVj+JiuC3reW zJ}v8Xy4>klx_#fn{{!8@N5S~-){Fmn=inB4*vgd%eH4# zku76*imVquQRNr7xshu33Ic&;t0P6EQGHrr`2KV$kt_T`E~lH*9VHcBHmkP~leciH z*L9iKlk@Y2?v-d5K{T=0cI}+%IzNzCtXZt|A1AeTaQscBNT;Qf%6p~qhgNY_@5Gmm zudYoG?nIthiOL6AU_9Snghzo0;K%%Q@X|O$#n4|VwKJZ<;&0LR?<(m*5o$5z?9xhZ zS;z4Tvdd^)R=j1`&*P?^oM^}pdJYG`CNi~rhN$?OsV^(6jsvNO*5WC0EqJv7 zhvcfBTvTj-?vGN(1$siyKS!n+S~l~qpWDS$00mI}h6qb*r}{vx+nV z-mKi4C+Mq?o7BBU_Zl=iUA-e2Z<>2W)=<5+I&Qj zhXuzLq?9K5m!9Grx8MDO@qg_X<10pGw^ZX}IWuh6%;NbbJ%D%B#I??40)#LzjdU-bgV3(tX?X~;)6uVMR?uj18{5%_4!q|h=188Y9d);uheTN5n1MXQMlsYT8IUdxt1*ftUTIjf zhDeWH*r$ScM6O<1`Wzfbg20#}JX21TSG{KzW%`9h)a3(VbLZhzXH>QbOK&&jF-h3- z4JZ`O#&AQi2)hlomLP=XP4qeMn8JHSi4I{(xp73Th*6JT%vI{0RS%~M#40XS=iTUw6Zlzz z-3a=USL8S9JF5B6y9=uA5G6YO;&u~2y;&19g>`=^kz%RAr_C9qXud01VXffm3|J)M zG}xZk3P&d;yN=iBJ=j$&ftRSjO*TQk1V$cSIwNF|p{IWEfgzM9X&(oxZ0K#{IG{Kq zE9drrYv6SBU3uqp#Rccij}anlWX~l)CF+N2oJ6%8%pl-h`o#6&g$m^kI4r=k$o5>@ zZd6uDW0}H& z|G2>Q2^B$rYSC5Tk;9ils|ZX7VPP$GX*N0p$Hp7z9*1zBGv<~2WzFUX1uiJt!)^2C zwW4?1Z+YvF07o=rB%hBEaz&q6 zaS3=cQBO@MEr>*qt1s9T(uk|MYvVuxxm_i*FakLgZa7%&Sp=&2T;O?6hxTWBS^ulH za)IgA&3ywkKvF-e9$usG5^MY^MRS2>H{+c0I8WteVv(K7Yhs$pi?mD?zj=7%ty82@ zLj@_{w?voJyglC#4h~h@fao9ZI%dLckLK<`1IAmk{ui_ow1Y*x!uZRwl5II)5o35RMk;>#trY1+F5K7&WpbZ|=NHN@9Y<~q zG_d8{5ARJ;euL#WIQy-zo<|p0Haf@?U}U68NK=Dv15tN1-5nAuzZ50~OBD3UHb;!F z{}z5*@%>dbQT6u*T?xw0-;}Lzh6YFo`Uo4I&9gg0cVR*GY&CFKyPilz^($mtWm5|b zhlXR^04NrvDd>6LU{Z*f{$V6PmgTJcHb}xPddz4Xm3eHH>5<|^d)wU!?2^Q&U#*+Ql=TTj^X%Wn+3MGbl zEw#VpKODad`^!a!12*MTo}k;EAmdZ#22hDPlTEb@ZR2hZW(|7@X8rvuPSk`g3fpei zRI`ZSV)mB&16|ch$jS=y>A=9<^0-+vAf7kLC}J=#tp@OFqLh{TM({XDv#(}pcrE%7!m zg(Y|sx5?oSEjFUW36q8f2d|j8=HdZu-OEQ@P+x=; z1;|7r`K}>Wbk3EgVcb|^o_5jUWAJZUg-pntv9(8dPGWY}I&|?! z2)%V|#S$Svgk&nkJ2qtFv%VC75n_`C3r~DLmPWJ5g0lD2TT6RnM}eIIxx`Faa%K}2 z+AdkS{)0pSP1DI1(Vn)%iW|p$wrhH%2-JQqgPUon2T|oiTmr_eJl5rpb&ghbxyHv` zVB8%ThAnlz+)4Cya&|ySH`wImILb8cdOtNc9NX5B7E|b>U69hkse)T~+asA{t}eYnW@6@*dWa(o2*3b-2f zf7Gy&5c{BBfqfD|H(rG&|9kbB0f`U48Asz-SDamGyl@F)wxjpUJCmF#mBV;8l~AVb zf`-Ll*vk#Xsq2^Ci#>fGcW5Vfc8RMq{C$Zj2Z+-VPeE3GnAowP6Aj8?BG$l9zl>r= zv0)_DR^PR4m1UTwRSj_5>4(bxFvYyRyP~?DBCaHL8jRo~Lq!G_wYmnY-;>=e$rCYg z;n#_@t%yly<-P4^hZ`OV=H)SqV1*vlLyO_?GG!(q_Tfs;7BvcGdPFMKp`fae+>J0k z_k#;kUMm~JB}YG3ExN%K0*1-wCZp$ndnNdM$Wp=Py^JF5`Cip79KYWF4L{-}7})>I z@Wb`rl~Qpq{SU}c_y1@Uy`aliiUG>_KXIpW`_2E9i6-qP>=c@=n`!Lo>OQ%p=>a68 zd3lSM7jIEym%c)znxtrCVsrQdTsZul1$u331-cY|KGU)Tk!9%q6Y~d^;#@{y1c{cr zef-&>1a~`K((7nv2{4=blHXR_?GFf_?R;vJdwm|^bjd3($lu1OCV;ZaCougId?BF> zyw?y2{yo`oH|Bsa9}KZj5cxCQGLGZJv2@0k`|FbDhgn&0Xmh`tTQ;8T3egQdB)S;__tCHVGV-^G zs*(sJ78v8>M6CA+by*Q1Ut*hih|lcG!SV~^G^V#yT^Z6WDpYAJjDt1^e!eZsEEW_9 zM1d&FxRjgF;n|Y0JHL^_U{oQ>jXxmCkL2w3^oy^Kd*i2-P)%)Q;z^Nu1{ zCuRfut@*$Ae}N!Ufty2dTNvJ8q~67Hsd#F&!y&*N8_mh+6MEOu_s|!5_r1$n>sdq3D zPTg1Ipv>&d{EkMtzy~oCb!7i)khO8p+(cwJiOhab<~|@RLfQ*?i*wgNs!Qmw_S0t< zidw0R9*J{oj1pPTl*5R&q|#p3C%KAjT8CvrJ+*>hdT$@fPa?P}{w;aUP&Ra>MEMw! z;PNi1yB&Z+{8=4_gPM^B;KXh|$9oRCBPz{_G#bYLj$beX6f}tcWN zHA-#CS0OS<@z^un)+)2`vIo7HI#K1ufK$ebV2g5w=*f8uP`gjhAzhCU?22!na&c~H zmOTpnw^Wmo8vTjix~^uH+$!o8cOUwDB<6B8{;lsNjYMa4CfAWCbFF8w4T#PyOFpVf zvJYz`TtI}(p`CI8PIntcZ(vki+)quUTfYE7RoQ3CXsa>MHtTUksZsC6t2dvUeEwWv;&pw>!04 z5CL%6l(AS9S2`bmB}=0}*k%0b{~A@in~4<(y><-{q!Wg3N)v{XXZC}C6OuM$dK{fJ zfEjt?lZF!MYAHw^KJlnhCfI8s7f}bN6Utj1-@ckT7EZV+fHDFi6ta zOj3r~jvN-J<+&qHxkN}~JWzi*wsoH@>>`bVKOL6MVydQw{2oYpCBNAsh#AxjX0RI}C}vO=^pfeKJ9*FmxOo+-Npx`!F)90j+W4%98Q<80xP6T zV&Bw--!MP&f+q`eMg`6(=jRi1$NIt@8-s(-G$lspbZOy`jc_!B;;p^FKoG1n@+gpM zwsAd8_iNe9F#U|+zBIY5p^!vRBg?Hq>+Ew?T|}a(D2WgbloEE%DG5$BCb308Qq}uj zCP+4$DXCfkDQeclUtUETFJobsn>~W`CGrKQ=ROF!lgs{P=hB0e#=G_(YgMYZx-G*? z${tWHqAsgTH*b2W`E>XT?!4Fc?nl*TKRymTJ@Mwdfp=z_lA*V()TTYF!YeETX{7{* zn~;7pFZwo81?&S`&8+N9jk6S97n(f_JY4fG-ss`8+VT><<#rJ<_;Kzq!lvQjux{HA zMuJn6p8vYsuhjL-?#{tAyh~24@Perm_QD7^Ilb|y{v<)UNB*1OG!0ZYj~egs#6|2* zn*78!Td^Wcf1hv+)V*-tb*721g{yB`0aXvO6Ndy3W&MRWUjxtHPJ%}6o1?gj(9B# zozE(TYp+kb@~cI5HZw7y9E@j{TB}@^@;A5`gB>l9TWDpOaNa%|vx|}wktx$r0N=~K zEjn4CA++9BE)N=Tim9Wd;J%pQ5D8(>tSM8K^-uzCzub?679d1!hJ(mOkFA0bMENh$X#&< zglq|Lsojb3kH79KGmDNuj`OB@u(M~8(NfY!s{8jZwfiL-metPVz+k7RRc+9Kf&a#L zeH^T43yrX%G}>~Urcm>7FcZ8{5Qh}#eV-7A))wIHx;Ujo-521eY9AM+ z81VH*5CGgEH~RAb*SKtqEdNb@h?(nuf;6Xb#{b>2-sjfMA!rWz0b~CkF3m0a(Vo3b zhberLjK2VBRWz+KfbOFkC?vw)UPjk?*XP|2kRR(@%fyL*|!QEz62-)NS8Uf-Qd$tL+?o^oI;$C$?RR(e}Yo7@A zGgmI8MU+#w&wLU-O&d#)eMv;Z=AvDb>G(5YzS(QW=TcRvy?k9hKh9$ z8WDJL2tpTT4+HTZPhG*OReadjf^s5(x%LJ)&DAkuoqF-fu$x+HXeQHL!g`y=P)$Yg zdci{~+o5_Ln0!hLg_`xAwZ?7%^?WCvZ5OIk?01czA)ks-LTA2)mK%@LM3rJsZ+PufyWK);Tc75@+ zclx@L!u#G%3;wEnJAx`ViKfkhV~qiH1{jVBK#hO;WemRZNo8@{5YapV_u-kYxdl*V z{^S^~XWZa@#-l4;du- z{pz2v2JI^s)x><34`)mK-<;}vO=WU67{Z_}jIgb4PbuxhUeKl{&wg6ws%baTt?zc4 znfadN5Z%$No#STfAA^?Wpu^pR-;$zI^G3@qkD9d36Nm0tA6pE@fLCyTYP!hbz9N?D zH#xTAaAk?SL*a$O7V=0l32!Yr+WXeqjEnW{9Q@HU4cG*3q$hO=(*Z{Fn%C zIiTZ1Zm4~@ucWb<@<3{2<=LHMi&3c$-Yd%8Dhhi%1X34!bx?TIi?ZEr^09+z1VVz9 zX=-AceM!J4TD@4+*9eA*A_X~37Y8#gJ8%^-5PL^Lo~ao z2bPDm>PMT;3Io*z|46H-w^b@{Hsmd`F|4DJIL$f%#alS+rJe@dQES^D!xVtl_@|=VgXs0NJko}b zRZ_VMXt1@(0v$HUjJ~&ZSqc9H`HU86!LL9M-4J>cAfpdK#A}9Q&bI|}nPpq9x?g29 zjK`Cyl*cK|j5Pzu)vm4OcyJz!tLts`qPN15@*pNZ4KmozeUPhl+&dNXTA%>d3!#Y! zHSI=T&EQ(88q4LRdg#w$J9d9WoyMJGo7s)xb&7SSOCbx?x8P;C#JV#(h2K)>o^K~r zMvZJ5I5#r1z%yjyGgE5K9HyUo$Q;rajn&DYl5l0qS-3E9A9KXI_{ESbPZah_WxDj} zy({Jfvns2r5e~xiazGXFQ%tG5cJW5s=g>K(5w=)}&m=sN%D4gZ5J^Q2^Ior*Ita-G z8u}fjL4Grz(sMS-xXJCW@-z{*)nwCa)R`E13p9(Fl%hUMVxLyuUyc=8CeFF4sxvebXvnv-KSFpPo zJXYPQwI+YS3aN^YK_=+}ZS2wiy@#_Wza+l+p>>*-F*hGvrKYAh5(MZAY2NBp-1a`` z*M)^oxszGxn1+h#*puR~AR5L2Oyg3Mwk~^N&-RA(2D>rR`h~K>h*();oeQ|{VqQ0R zrrf=RgU_f=zfj~MEW6Wm_}f@=4)3G=A4PQqY^JiS{J#Snt@`cO)12fH2o2g_ z8o>P^KQ&urqDxZamIBmng>V15FU-f#iC1K_w}BnVDl}!KZs$py9hhFZb{Fd%vi8pv zZWfQ44g8Aia$lB^LW>wwN-KDs5|+XhFlq72CfM@OlL`#b*uiK7wWve2QSj(*bLt?q5G>FA)wH?C~_0|Lea>HgQ6%38zr z@DK7k!i0h6#hdeu@VfC4JATtJx2Xn3?6yH>6aE^rDE0tfBl^dNZ}LIAoq$SK+$8e@ zkDWP}A&dNm_*(qUmfg%;WQo#mxWo~aBelVB%>=K#$XMJ1cFvb(8|H^m1-re1vQqYu zs6dG#7Tw~%@4IASPfqoATh6Q061(#2StQaKD3eZkGmG{*iTqDZ*p5XvY>G%rMQz}` z*3`6`E|@F$$Cmgb16qx8+f!W(ICZc6nLeel$23Ch;Q9XRriANSuwe@JANvN~74T=o zu#h4uolTu=TKaDU_($5*s3xPWGBz34)7uXx=PqxYEEl^N(A7D5H+iai+W7@D&Q?vD7%P@fpE1G!5|i^g zq(8FXaiPJ=shz+=?da|$l0H%s-ZEIruy^jS+-B-f?fIZb#*P*J0b>zLYV^- zXgt#)1T%6^gq;G)_Q?+CGO4Pe1rR*H+-D|+qyvNR({uJLB;UzB*KYOAW*yF8`lCo* zBfPMLZc7ZLUsNKxv$%PcA^$i@2?g5w;QLXW6y%**}BE#NQ%(1g@aCgceiZ}KNnc$9tV zRn*a+@Ys^bTui_dc<{$abVf}uH+D_z9>WvZhWBZejOSNT;|VZVkq#{!7G^DSWEQ`%>XHfO% zd&|FWOYI~&DiHF*8jpjr8<*^*_U=kvEd(Don z6nB}92Z^^~11*!+kTn!4i=J|p#FyK_(5NF09}2!`iGGVe9q(RE$)Y-sCALk~4v z?MlW-IT#yw=p+<3g|$9Zy?JD1HJGKGDis&=wtlQ0C=+rSh8xmAiU#1W(GVtzUb(PR zOe1XMiQ|40eHIjF(FJ2v&~ijD1|^GkBrswpQ9?FyM)5E4@#63vEM^(v8077Z%}#l* z5)|uBI5>)A%Uan_LdIXoXs@+KYg4Q2qE`@J>CJ1&O12blJ=MY%*=hbt$Z9;%jc*d}`>9Ggd7=MI zmW~hezHRyL0(UFMJw(GR&@F`mG#iD;tfD{PPL+#M9`eJzw4&86+t_pJhG15mgWdN5 zI$)Pu84D$K5|JHVO)BOT%N0XNA9%ta%oPiV|BKS4`n>Url--|CT$DyCxE0llXUB7( zX-0zjTnYTZccG?854IYT^wYqdskndJ&`y|xz`;+5Km-_FTDjC)3flk@uQsjNO?Dh@ zhQ&{egd{Qbq6BZ_&$F`F=D0gq4W|3!T^i6ZmINR1@j+nT%x!iErq0nBrmG^>Yp#R} zsfCX{VPE-jywuhawgGgx)D)~6AIB8xom2&`;|58luh^tQ^dT>!<0R zW3gd=iiZmC6H?o35#{G&hZ%ESx(8whz>XfTr1 zu{I!PX+O%2u<#AsmW@wMhAexEO)*5(HN+hf+w!so`hpZ)EsNj5MmZW9DWv+cpfb{y zXiILlRb|{^Pcq7AZg{7F%JNsK{?MR;pwOr9i6&ZWHhQaCo9mC2xtVX3@!u^Zxm*W> z@6Qm|z@pQrZKiq9>`$f?dUD33p$9cyWXmQ^-rQ=ORySXa><{|DCVe1_MWC5k1>l(? z+>Dbu`n_seiwS#j#XOMge;*ad44U0-&dWP9uY1`^#fSl>!XyE|_iFLPn{E;6r; z+rQF9WJS7~HxQ9Ws#MWs*Ge|uuLDGdB&h9;a342bQpS?(O3svHXW3tZ0sd{5@cxLw z2=iT$_R@(TXIhEWP#2n#ABtXadPl(&+s4+4!iZb>%2h1eF`$+c;@aKy_Tx<(k7)e( zAN+1%(I=lzLf%l@MZ#G*D@!bv3KU{6VBYo6C!U!A8s}PaaxKEI4xC;cdr(sL*-^eR zq!ssyt?Ot8;PsX1l?z;0UV!v?!W_}lsi2Iu=0Y=_qdx+DuLn~oIogv2ZliK8@2}@h z&Ln{FQYVlH9=`z^k<+_>b@$_~W@t8CjKKns4R%$Gl78Ti146~RU})`p)Ab>uRE0*F zQE9culG8Qbnx>s~8OB!$BYdfj@Hh)_e6Et8S}UpH{u+^lGcLtoQqcFX(4=qmxm&*n za8<^01Zj_n*!<)@d~4x3(hq@-diHRq1O?_D^n+ZRJjW)ha!K)}+ve4!f9C04PP*%*lsEFWWBn$90}6R{-5H*rln}3t)P$ zyTxmtP8_3io}Q-ycOHg~ivan_)|#5%-c@29FCLuucnK#$q^(~qzP81G+5?`>(%+JU zJ4b2U>lRP~y>mjIxmo~s^1a^{M}S1?6;vY6oo1@D$ErY5s5u@~SPnf2!ygf0+`}3( z!SFO|;f@pHG>%C~GM-SKf8Jp|S731+t#&1;!GOjG zU1d+vj}=<{q0aI&a(MVCAeAmut-QGCF&Tu2jp<<1tAP|tjEG1!fA>O0i3l*xJZ9CI z&CcTw2*wcTn+;%}z1=D6{hpQ$W|{3y-&s8;hE?&+4K*E@IRE;t2tvREcZbdKJ%bX+gxMcpc~UHh2vXqi^wEf$vWRl1{u#ead&R*3_#0mEZ5n5ZPGbg*hgV9bHA813wZo%e>#l*#Sv)wr(7>umnbAJ2Fp?J0y&QCgS;heIeyAYbG_lt?*4Cey2CqMYq@x zx%!^C*c^FpP{Qlwkqoxk*4sHX4!MK`jwFWI%1L zjWtr!vAzon_;X^%!fr}SBQEHy{FJxu!l*ejnhc_z94Q73pN5MSi>hgZL&!$rnee83 z;?H;WF|InA1e;Ratu0O5)^~^E9T+DNCFd~>_gTiYayBHS9T1lqq;4D8#DYooN<0-z z(*79_Wg1T#iWj+T99+P_?7vwkYaqeZsZA9knOVfdS0~oFBrc$e6RaqMHxq|iXUCC> zhP^ZGM5~ZYQx_z#YZ|8IVHX^q>NW$_Um1Y4ukGs@)f%kYXJJ0E^H3F{Dkv+=*hjEi z3evX`I(EY6QpDfUKyU|EgvMW+etQLcno+cqf35TURF0a5>MVkWoGGK6S427tHXeO? z4OPH5EAD3VSuuY0(6a=K_;jZZG^JuIqN~$~DR@6Fj9i*Cq3<&)0c;l|I^XBYrh#gK zXGr`>5B1=-UNP(UE8hd&z_dNZ)uTx4lt!1F@i~;+)N#qH{8W|s2s0BbG8T)!KaRQ8 z{ItJE)Yoc;7|+`ze1c4f4E_!ft+LDL9E{^z`x=X`nsnCHj1wg#WsiII($l?$$sd=FG3x%&yYLjtl6YjB!fWx*$r5#7ij}g4h0UF?s zk4XdHXl}ocLXvfwc~r~>l3_!wO=%1(vU>GfED)z)Zs-I$(Q5`odNj?Kzv)n8k5*v| zTWssmZ*hP#$FS|gY6DoVgT03$1*xF_I}4Sm8!kj>ww>eYB>_MO4^QK zOQ~8$N|XhzaQU-X%Chz5U$H%b?)`lcY}+(dgg=#irGSp*!WzrO6dp52)6#i#K4=WL zymF(*OoyW#1g%mO1oI+pBN`za_d(`8B_)x^IH#3*iVd3Boe)<3RFTsooAdtD-#1sn z=NP6hZD9&*V(BdseT+uu&BJ3H+2_S{uH;BF#b%i`IZ+;jrvzMfr_L2Tz>bLQZ8V~m zRF7!Eg5+WW^@U5Z&+i)umG`Z2KVO(hNE76-A$1!yXPIW@ecN1K7VQyT4eGJpn#mLv zuePF#Ow*O6q_i1pVlLDaPB;#?CKyvO;a)Hhs&qv{LEK_FGC8|*PdGdk zio&+qvecMjr}7G?6tfEL$Qr_(w8<|hZTZ!X6+K_;suK3a$DJ+?qsUCbaX(i9#rvd) zr`r8mX~L*KhP&eCbXvB?JLeE4XyYV+5HnN(M<33SRX+c6VQHT)iUN^T#~KRWkOp`+wR zh@-i2CR1H28IGEz1EEf1TLSddAZ=Isck1iSzB7UVqy-6DV+8nLesOV#+Re|s&5N3Z z#&GN^8c+6N#7281WItnEFyJIr(8=}i5i?IuwfJM{*wap>rc9&PZnk;`fi|FEWVMPQLRsUVL_6F;}^j7u(wOZhaJjHZ47D&!#WVI%?pAU4+`mkTzoi@{)W69~Cs zYC76I0npa*GD7oe(b^N+ZkN)MYJl%Gh((KqdXu}}HVEUD(wz$*in`%UiCvn-iW{rJ zm$YShZB8uyY+a^zZU zN?=@|)mPf1KdXuD;J`HNv2v_9djMsV;uctb0KB5_++;5?I!+?3q=M1_=<=uI((#Zv z2D^S;{)=AKbDp~x!ZWaKhV90-ow7guwbGqMp$ETtP6C;wi&tX-2PI5G0n?0_CMBIx zXDI4Z=}7(a70siOadDVawJ0mF+hN^^IK}OLt2;d3vOB3IulwhqQh=P>uDBTUcMyD& zxp#oQoy+)iTdx|C*Hcw9#kn@pR~tgmp7lADBYW8*-? z5g^91b7q?UZ1nYWvv#v}gtjk{m`Pf$!{F~4F)y|rlVyQ`&&eO)4*XcyIW;XSf7W2E#IZyVsPj zho;*Gkq%UwOxP6IDF*XdVb*Wqs&ZAM_D{XPnEBl^_~9kj=J)NXtUc_oAmi8|B#9Tq zT`EuH78@WA^6Dzb=X%jF;(+nTr%ENX8>{cg;$l8`v|)c9#;vFh;n#)J_h~{ez4%)> z1|D1BWRgcR^Isrcb8GC*9V_zot;1a&{kq?fZ;uIjHK~_%F?0QOlL3|LIlu2e7-AaK ztMwOO0vG}e{CDDsZNEM?6}DG*7uE<@mhbu%^1~oU!x=o@f3;@Whj}#gst?rQrxYen zOfC@#R8=asCnoSzjNNDn-CWhw&qqr;Fph)GSR#3y8XcRHRhb)9>kXxN$Z!zGGWnjn zTFlizq5t`LJUg7`9hC}Fbn+-fK8z^Gs0ximILz!jKW_VYz)ZpBR#0|&xpvkrg5b-C z*sCPlDkRe<(`QI%JvuDJqRMWPW4@L{o#sWU*>o^D6wlIUr2>7NKV$vPe>u|v*e&Wb zf9W)%kdGS=YGT7=1$Msotm6$E9o^CqdKWJe*UNa>Vt_~?onG%+PLR!C1FoJNOy{u8 zyIwN8-A&^4AeyX>aU^Z5-hOC9ZYfv6Wwn{uE0mtC4sP!AQPd+@C2}Zd zx>6PjOQltO)7YrF+!1Y=^SZ@6zM;H6oY_mnEl{#XTMosx)31F*KWWvz*?eL@`@7Re z93{e))pd$^8ryN9;w6o>?`9b_@vop0cUHw5jfnlqgZ#SX=0if@v1WH(d?ZL`1m~S>`RR0)3Os$4hfVD_s4UZIsAZnKLc3&d zV+l(hI1Kpn2O!f;@!Z45Y2;)6tIQMQ=O|rW(l<+a@w?=sK)BG|z=g)^<8((0ooOf5 zLCN;$%XZqA{Xik0y(XcsJI-J_LO)Hwj8$$4C zIGx$tj0t8?%>VPUrErzdI}~&6X*Zd!`63PfWj37NLg{ z^`s1M#oINJk_BpN?#d&qj61T(ypIEbn1oFMWzc!hyP30 zv{{&+R!Z9}E=SwwoCtwR+H;CVY%+LwEVE98v!lNjt)5%8C>Op-(KXhk6TytuTB0Nm zI-@TJd}YX?@{=@_aRelc&MiGM5_6Xm*XZk_N>r0 zc7NC_=PoRrYyly~2M1w=hh3&*MY`5DX z;mWi4W@a}fp{bTN$vmDXnzcOlk?0rA=^%NnD zLT)L1f1cq=_)rkY7up9r*9bw<4`U;gJY5^5tdiP} zf}tS3ed69)>IL~7ZIqA(sZ8j{u*CgkmH3M8zLzkOlkh;*n{GEoA4; z0J$uxYlsI@UpHLBVdgyyg158j=!YXkt zlWuUlf4oZ7g1i%@%!9iPQ?gQ)t3lSl+qE;P@jCs{?mmKwWFJnbKz{b10?!%7? zguSamDS_p=W?v!ex z1_6V-X2p2fNIku4CGBHKiST_!JGc#47>4} zX2JYMJNF^QQN8+wTY*y6^Kt@=r5Wp%H~WK~yZ{i}1jDbOo1KyJy1$s=$f|f~oOHYK z-y2hrhE}2Ob7LCmz&C6Z`_et7yuj_BPyWdAAGB8{G2L-X(yNtBMoHZ-y`0IX&;X40 z4AG`sEue2zm;yA!7 zwhFDq%gVlX_qIvo3KQ7+55>@=+j!ASCKdg6%p!4-6eQ1z1lzDLu+J zpFf0M)h#%_v#R06 zVHHU9X&VM?XT>8J6FQ@@74EB*Duxg|)o6B~DZV&os>%JjkHfPeWo)_5|QvUX`|f+(u~t!{2_t`&$J^7;q}8G;9v+WofEmvQ`X+V6HE& ze$smaS$(-3F{Fd1H%R_htRMePy#U`l|JSk{!Dvd7|D1~f(=f3qaK8(gJK;N4F-n$P=hY-d~hZtr>{D}pFI?oh8V;wly zuHnzIit=m)N&n2zZo74|*Zh#1es)jEU%3p}4akUvF2{(&raTxgxk8o@L}KZV7D@Yq zyoLVxLA#1Dmh|u8RQ|*Dxgc{x@O+7BKMNmx5hOXuujOBU-7fZ)85q>V*-H;$Zrr#n z*lfO`ZRwQ7&x=2*0ZTX6%Ei2r+BC=)IC7^~Rh-zCR<4-$nA58wVW-O}$|gd-8dsT` zoUXh0veod{6^rbj-5LmZwCw^Qgfwm1p&7WLO+ZzQeHN;m>i8*wNAKD5)r^&Lm8l)T zEF^amMamCqFO~87bKbo1akCvUY3x|jtEUfM)_eOO_7Z0&=oKI2UDG~?o#ro-`a?ur z=f3hR2nbHt=%GV}3A*-b!&s73gbzF-agnB;>@rrA${Jjx!X{i7$uy1B!eCzK#s@sr zj=i%uqVjgJZbp41a2EUbW~RDx+*a7-J#F4|*kmW%*Nl+4JVwxc*g&HNdxmG{41vEy zgrhMeS5BCgjRlcg{Z`6?<`A|k{jzi+G^CRR%bnWabReaF`vGnRcc^`9yeQ7?TG4PF z#DOz)JS?@gw|>KN2y4(`5kh(!jZbv-=_CNdk6kjkLp`Js#-eWH(puMfvwB#jhz>iyBC&Nz&&w7I6(kKjn{qs>S2Kx{VPTie z#^os&MR71ZDi%zJuHaLYkOpFJzN6|*KpS%@ zhskd`PTi^*f56_xo__&lpM5ouNRbRjX-JZAJa&^eRJUJt3F?xiI!7N14lPMG6YqGB zAc;87%_BUKvy?U)7hd1Wm^9T2R|j#~22J4tDZuOqG`*Z{>$Ps5x#ay>N|nW}-h z#9>eT>9=(<`i41c-7RCaZ4MYF2KJ*knQ(0}`j3>K@$Y(r~!nnEMx8seN5;gwYd7aAT8Ayf*No zCq;iRxZS(#&03VJ4U|vTFhv%|#W1){*Ir9obR_<^(nB;H&L-xpKrxt-_O>=gpYG7- zwZx?YFVgt-vu}@;**$JQ6U*JdWyUx|Rhz&_ul92xT)m5of%?7#h$r0dx6ysJ+;M~B z!-(6(IWDkXds?ymAsW(b4`bt9zg9ttP^?VVq&d(Jxx-9w6|7$hh0h}!RjFug#Pyv- zROHBVU%cZqo7eFK2EgtWju1Fio|?(u{O&-|t}$2t5dRgtpcLGUx`s6yT=zRAXhszh zrl5!i7Kqn|GP$8f=VWcu&7mH)i2XrX{FM7gOWAqpaZ<}3MT@N~y5nR4ZY|a1gpq>? zv#CmF{)-v_6&RV@9;OOh${nBJ4C?teOcWq1?bmlOod)fR>7OFRo zJNg5}yj2yu;v#0VGDaQKCF;^K;8U3R?4guyqbkjv!;|xS-2Q!lT<5U-Bwgdh9nqkM zeu7?MXZ`F#Dyf!mVu2Y@+N1GJEV8T~!ncT&PaPTtcPXowelHxwW)B!{O&yQA;(^YM z=ob8m^(b_^Gcd;V-P1@K71J808Oq2Q5wIpsjo!TIJ~4EJ+?3mpZfj&^RM6C6a6IFg z;k%){0-F1mUjsdtUn)TjTI|5rOB2wI4o z?>^jCJoV!`$S2r8JS2YoT1&6gW1VZ%;;Lvo`(WDdA*IjUxZmj*kc>F z9&K;`SC`85@4F=Uk@!t;3A)WhL9{1d(R|J&#lpC4^u4=!^UK+06KHW7Yxd1~h!ebU zpOIRNw{#L6l*a-zitB|x2wi`AgSt$xlQuiN!W~EzrTrP(r**qLm1VZhNP?8y=nM$= zR*FRRSymX6isN4Paz=4q&*)y)$MbNqp5$d&44?%r)%mU zC-@it?k~UkrZ+#`r1*D#O1XrgPsyCIR(r%X?*8~JyTY4W1=)d{Ens?LeWSdw>cu0z&@#fMAe(Oo`Aqlm*a6mZ-ek2~20 zR_uAao~sXVJ5akt83p1GlJ<>$@|B?($RneLfKMAblLprpN%(FEB-zWzQkKClg|WW^ zXq}#9;K;)M?sNEfd3dp_20!-#&=h%Q|BI|*{_o1OnVJ3vgzQ>JCV_+vvFDNI9bu^b z(^@C`JrIn>3G^hK(-dG&?`X*I={GUky6s+;ga?r-R<$mly+*%!Se3@|$h zVe*=J;F8_f6LCp;UGL7I5X<5#!4`(pYj`CJg>p@5LUE9n546F54Qp>9>Fe>UsI58d z{2FM$ZzT2EMHeR(P_EH1go0QPRQ*?->J#vesUWe+GI0Awb?5HQYcUjy+w7dZ@t7hQLgC2IGo#`IIwt7opY4n1{LRCmK*r>maZBcCAtvE_ zlJTg48iAQX<^PAVbJ`LFTDEMZZC2X0ZQHhO+qP}nwr$&XrP!4G9>qG!6tr`3+n6RCOq7ckE3IA-;VRjrXP@CuM|&H1A<8M3{Gi8jSQ)t6ogNl zDE|C+m?9v1!Aw>E>clu|A;QIsx7|%sY2_>t(Jk{4&a`-?jKN=bVRUBYUn=rR6Tr+< zC53HSxD*jsFDl-UH?llMKl^+;1K<*RPp?8SDUFM> zm9uCb#0O${-I0+^dUMQBq4gE}o~Z$HG-;U8f$ClsTOd*BwR7aYOg9%p=;?xgE@&#G z3?!KTevv$ORaw@9aH>7b)TZ`?C+>cCY^lVlW5K1p4|V2QwaMyc`X`&ubzMsFJl-L^ zNKODeN!SUAK^Xe@*dALDxcJl%3&UShF!2``?4?`#3^0-));(T<;yE>(YGNU z%2kux8~9(Afi^zSzdA3e$L4<~VN(yMEI!H48bgx%Bi*63`|zRQFkSqv5P{+GOTn!g z$K@dan*@+cN(l`|eIXZQwyuTT#c<7LF^dNKy9ceOl!-R1I1>GYuH0JLmV@ToJ*XKd zB?-V&2F*v1w(TmCwTq`upi{7hh}JHIhupxa0vN;Moceg%Lq|N*N{3o>%j=m7 za}z$^gbT&{%<^r7F*P_g!A!7w)Db6^1z3VSgusWg?E*?l-eWkV!1K}>T>;16h(|-){LLX0o_cWNb$wj_hmzYl48plt?I#>T(F8G)8LCv`Xj^I|2~ZH&&Ybn#&Wu% zcpgN6R~5&+PlMOkqoC+tQrZPxD$1L=_PxMn&AHKa%9$xgY8-Jf7cms=z zKr6~Pp(zr0o+CZU+4MWpOJeC`iP6JX+{6PEWY#KQwq(nPW*G3|TOXSG$?OEx84hQN zcnMKLC~NCdc2UJFu9zsvS%BaMi~$YKGh^`r-Hvjga-vL@UGL_h%Ka_AILW9lmr4XA z#?zw3WTFX;rIb5o8RAl~&%o0o4DNKt@k=6WwFE>q#;G2rR0XeW8JFbYbTJH%NuoU5 zvLOK|YA;m;q#BA1DL!VBSdo;OZ@yK_&HKX$#J)QGOV8na7sdHtJUTz?81qC{FIh1f z*piqzG2&kNa-I9|xFCRt+w&S&KhU~@B{b9GF@mAct{z=}84A!shJ9F;oZKY{(=-xT6DgL4VjO|ARgjXXvQZP{=cD(=G==6Y$QmmM2hJGhsl- z^cs`Rld8??na%4JlQv!b^v!wu;|3>4q1$JWk_rI$=|Ik>tpVLe&N{`U+mtcx76Iw! zl09{WmP}_>#2Qh3Su#(~VdU#?I;XpeKt6ELSFTzPGbxm43Rv8boxO%Yp}nQ7Q4bPa z?d*qFXRrzg43X@N8C&~Z`~=j?bk3$`Tdt!fZw2ng3&JktLT=|E22YFUDwchXaBogL z)qZ7_G%j$i9@9FITp4jvK#oFJ0B*QP*7QPh#<39H_C&Dj{e|9+2IOWQr4(37?~8df zRQFo(+mux9f7}a2KTeGX?`PYHEG`kGQrPv_z4Hj0_LuCmYR2*HD-nG1osMRybxk$v z*0o)6*fy56Hjh2sEYtN-7@s$_qqVeN_#+;@Lh@G!u4)$|BBak%?<1L5Y+0yXG7KHn zROw@9rx^mp0@i9x?W1~_AW8%morm+`?RlxEtZ*CMXql>N*v<}W+|r34pZKinRm~9- z!(0k>&tS(n2yQ}|qYIglf2dQAQ>iXG=5#>9j9-`$JB;2%T7vZS{ZimQM>za2NrkaCg0(_>p(rbh^%)II3f8$B< zVh)OSc|PY@hYznu7Z37YA}Am-6F9|Sg`u8xwPg?u7I$-=IMt;bxDaxOzRjoLM z)BOU${#M%fPhsc3lM6HbZ|Kmn#$?PD3+%6B?G;P{;R#jl&cIK~?<(PZTMu>F+LI+w zxMBSEf1pFh7d;RRZD*Ghsnqhw?rvfh@6G|?9lmttEat}H^^2plHzRO2x4fN~ySpW~ z-}t0?Lkdufn=ISEapws*%FkeN^P!frIL}08J2^7_jneRj(OH!{@CO#R@&7`H+zhkY zZI|TcZU8QIgB}Zf$KTPmfAh|W?ic1(FaCC`Xh&xf`PDo$-hi!DWp8J_zGbk+!fG_& z=813b7aN30mQLFupB9dGVbTpu*yLkuhw3U55|_%$3qtKJJm}l^wOr-f`=wADv%`D0 znKIHv&kqAcaTpWV|Ff)>evt_!_vZSV^?aX<{wAKjz+FEiAPkt?+a{!|Ut?wA_D2>1 zwX_nXAr)2P=AEWIN+f1`wYc!b805g@FK(uatQTe=vk!}!;EGGkN~Ou{d3+;W)4kCN zKnUDFHRlF8#Rk*U)FyVxDbXeyv>@y523l|Zz~$r86S-oxe73diG^2=f>pC0@ifcv$ ze}kDSR#qLBpv81;hiJ-gnJ4bEwvxWil!ml3ux)AG(;gkJhTv>qYEO&1xX>uXUr|O@ zO8QgT4#qs<%rn5*uVkhs;V}lsza0y&oxtHK7bKq9dPLavrBg^i2)0gAQ8oYcuLiLo|EIw0E zo8k*pQcX|Z1qq)M0xj5ri2K0f#Hn%dDi9{aWc&ezPRXw&xV|9PidMW#WT`6E$WvCz zzTe~uY+EHrUq4v2dS7f)RmrF^qro(}USkacNg)TgK=;9q?TTXutT)23jTV#QA;iR$ z;!>wh_aB*<33C>KG5TkOVgTbD@RItlxeKE};pamO3&x`gY&6E5##J9)BMS_q#yv{! z5#IT8`Y;Sim&*R0jvd|(CdU_)i(7vR0YJkq<^>ww#Fzj)_L@TRZyl33getYPWb23! zT^wp!9}DS~*ff3c7$+p^L_u*B0%&5T-~hp-x0RVF{l^>o<6Sj%5;IE3k;YUTJ3 z)HzwXRFQyDDv*d|T0Gg&)YwK?w8iZJvvBws4IUsTEx{1vjKnD5v$XlF`ph63tzMi< zq8K)P=nQO;q)>v-63t7QQ+6`YqOeJJElA`=U@^=8fumYI)V(SLre7IWr_+|_v{AiIfD&JjJ<@UsGM^j z$aVDNVUpGKb;p`$NOC3p`*~lzQ+(S+K@#g#Jlhv~*=iuuKl-2FCTYhbT1)f`#V1-w zH2MlraxaBPLhb&(nx)qYE|XRG0}VXg+Y8R+l|3|>c4F1aDAAbvMo6X&&F75-8WA!r zXp++0OFZ}Ilb>u3NJEv60F*O}x)Kv1=39P*)xq971d)MJ;>Yoz=Y%>rKp%9mVdhie zHL+{&esCsJTNHrGuv45tHD0hdSa4FirYV53$S@WhFzG6yMbWRycF@;+M0=8qZ^_>D z()fCOfe8DyFwm>67B_ZrjF0CkYhvg(8j(MO0)f|UQn-hs3lhL>X^+hVd^1S(AXi;7 zN;%jiyYCsdt>YhNXe~N?bR=Q>EdptCLX2%OdIE@*?r^mbGM;2EN8G@zn&>)M`u86B zORwS@pT(cPz)frG9}W76$0tp+Fjto5>u&7Zlk|13?P)58UeeyaqFJ(AB18#qOlaty z^rKL=2D7>~@C3Y>AjucY?jv{a9rob6<@#FWR4#!MpsVUWss%J$?35sxj~f{cgU8eQ z#nZ)mqBTaV14U(Bm@OmBIO%t>2I7jMl+Tu~Cz^)Vu@7wxUl;)C{9Bz47C7W5kUf3W zXRT!3%4O~T?S-H9N}{so8#n^6)TF#;Rff&d^(>eVITq0l9TgLxPG;82N^#+|&hh8~ z34JUf$KyPPBG~?dqGm40&dekE-m?odNkSbtR)s+>x(GDF5ChcC8Gx#t-raVe$p^Oh z_m~=y)|j$zY(pOs#R)O$h8g52#|^+@{?y*sMv$f`fKoh%GtX7z%icoYX@_R3{BI&C zGqOjO3UsU`V{a6{n_tsaBo%y+_zkT1qH9VB%M@zTD$@ZN#ubsaytf)gQ~BC?*p_B4 zHT>?5g7Z#mETovL$1Z0WmmS5mQ*EC+djZ!uHoo{+R)1)Gdva!#{Q0TJ9Y5p(ro~Lxphvfx>LlR z#vDeTNg_T7k$gjz|(!C{p4@ zO>n*BlX$13yRJHbL;;dM@XFo| zrjd%eS(EL-kear_MP@fV1U-sfEEi#P#%ubC5rYMEhjTc?8w2fhLCa#M+0SeP}Hsn5k%RTmA(`D z_~)01>snmG)%Q|Y?+Zq*c78QMuo~9*Qit!7{tXN~FE$LJRPU^K0|%nTy+%_&EY|+6 zV23B1&^JB#cH`apzIvBtlptfmzWK!*0eiZBo!kBZJ#RRb{HNUZ-}N9^8UELiT(!pd z3}Gum&nfvkh)`o261)>QJm%Q+_*MWGQS(OX>t6fOlj1KivL3DcC!GGZblHk#SffW{ z>^v5NB>YG3!Qz1?0>1S0cI^)8`>VzM`{{o`I)LN_QFPv#B~WVl#kqVCb{6j}KbI85 zZJ8;rOD81@isYZv_vf~8JNxd9J}9zOxTrd^tz9yRhvVxxP{Yqk5%3EHxhZ_g^pLY@}9mkKeiHxr?=%>Oq#iKd;7a zUpXhB`qlf1x_ps;a-?-NM?hKxTnXH;YLo9+kW0vlA6T5Hb}=fI5RM)QP}>Qq#{vV9 zV4KTgKogbrRG0`Pai~-&*V#VwZvkC-thW8=e%bhnlM$^19O&P(jkTEnFwj5*@||et z!EJw=VMDSiP@$5(zS5H!#rAcC!40m9!vsHoNne9ND3&7JUSkhkv)+TJ5R3|Lw-nkO z=tNUpgjR9Q_GCtkh$&Qj{mmL$^yNmmk%hZPt5c z%|&#WvKd%w!ev8gy}4kHD_h=1Roq0!IW{@hl&0rJKA27LR25&Pxz~(ENHZqh8Yvlx z_r8?HXBs1@Ek3-V+Pi`)^8zbQgyk6ylOG1F+ToN$q0C>R`0eNtH6mC>LkMtcQOw%J z%sn@g+983g-Q>#^#y9Ha3}pz;t()=1VrOh$1H@rTS=O8ha|>LGi)d zk6zzL#+|PPINPt{>9eDSF=Ltz2{bEedzfXm)2v=pIXIX{rO|qp|-79Oll<1 zgyp1dqGaw#y3fR~bjLXK&UX!D8;5nElj*?|s1CCJP&#o;;TE9Us*GRc}63hI!$xumvockU}MPzv)|*SL9bH(I!GoV-1-8j?`+2ktYjFY!t9i z%|3Hrncfhm2kNk&I&+H=m;O+rcffzL%~SME=5uFS9;!AFH%icOs9K5g&E1@t10>Ac{f#O) zV_tEkb{>BPA92u`bTlbJDa1iq4Sw$?UufbSqPzw5LThbt^8!k{{-c57sm^s7g?SK% zAb9jS4t`&l@TMq65<%*u{2ZS&6NCx7$p$K z)nM(|mGO=iU$U@xjcCaue>JS7&eafqLarg9rU_Jp?_H=@RLlrJn9Q!a%GUV2U;Ue5 z0b)`voe$YdbE76wc%H4wMI?)ni0H^|L{>!H^t@i?h>N|~B;*Ck#pr;6ps!7U!ppMY zNLx{_nhV)t>vojqS+(tO6t@YH2!%7?YoI^8BpoIFnyd&?Bkg&tMH91(3jZ}eIuKxd zku2}Ak3i-J9Oii2M4G201=FX`>}8K;%lI+`ngLY~0IcS+7SCTHL+0ihsy9&W%@9-M zLW<9()E>Qdq9!#(3qmTScYHNS%SgmxKrAsuE=06d=bwE0v4>ND*O^E|RVs2)xeKuY zSBrop*Mwuy*kA7yj_NSa>n%a)mXk2BoH*w%CpF?A!ZZX+28y>qLv9mAlw4Z{fI(rkhdNDOGx0QH0c?rq8oewKE z>s*!zXLcNr!>jJ-z`?j^9@B`emDPD7*+vyo82?qJkmjzRV$mi04sfur1|BierFI_W z?$QMSHk7F9%8iYr9qDtsc`>}cy6z>mR%r z%UUYRnMorRo^q^&7S&nChJ=5RFEVUson@Rj77|cZY}N+7N4ha;UT#_yQMt25D2w0sb`ouLfJja$B774W=1yjxkWoM`?>^u9U6%#4VMFdD(yqeUdox;RJ965C9^zVTEX zoXtsume{^?8M(v3=UEak@am5q+ovKNfW%N z!50mKfb1DOOZaf}wo_o!rFsnSl^^*M0oL&;D=UL8Q z*P4T@zL%ZMifkSuAyIZFXE-xh-hbESt^Mg^T$Nubyn&Z}e5S%N&* zDNYY#jNdIu!?Zl2;QQ5*y5krh}u(GMKm|J;`xvm&ocO5nubU82lI802}NthlhdYUH(G5GpV;1L zLG$^Z!|lb}rS3NvbI3{je+avb|CM!?ft8;9|1bS6YyQ7OxBsEZIO_Td;DDlI-c9Fp zz<8BiC7m$vtfjtvLEP}iZ!~ORVk}oENf^o)N%WVs-!S{Ta(Cy1+ukYUTPx5~A-Asz zy`lB%3y@DzxM&lv4nJ>Sq2dlu9te5i!I(n%=izn(c?Y2N2Tcx@k__nx=cOx#R_Vj`T+5#ai% zy#0UKE&)D^%=MrXl2(K12GqPfm(?ypsp->w@ynz?`3MCzjfG?)^l>BWF~pb%?-;o&n6B)XY{5 zRv?p@NG~6%bE83{GP&b&`>7c2SG=HrQ2s?^LcyLkQuU$Rh+n z#rpukkr*_=d@mm52x&u&l~uKa15FzQR8La-Sq_V4iHc<+DPA1r9)*(QO~( z^!3eu|HwPG3f&dZL&j;zAEx9Z=}b_mWSy^lhaLC2xOrbEr7PVXM7{_0UP36PIv4w?wsJQkv8N!AUfI4V_?~(u>(NdlNoy6AyD^hNAF2! zNmU53=u4DM>OH-{z_KFf6c7NIZfp$2OCJn5?f|`N4LYxlfSAti6kgmIaqHwTaMkl( z%gv7+={iJ9=jlN)SsNKwpvFxyBmLA4sX=r<3_jDgQGh$DD|n zLr#M$iwiW9r9?)aL73Sx%HMLT05L_=Hy~FJcEzP|n7@F6CVzdaNEXz-ZdwQQoiv?T zq0*$$dI`c*sfo7pyk4Q9u_;EF+Uzp>ardEeldh*HIkYoXk(dc*ne;z|Go%LM*>vH;wy^>{Mh!AvJm(xHVw4u;>3_dcYk)@6(KQKVu#bS<(R@SGa1m>VS)KfekL~RDD_7Sb zITm}$SW|;qL$t+y5%we|tI!#W0jGX!%*?*xH%vgYLpeF4+37si^7J8Rs+`UN76kmQ zWxC0>(V71I6mjdU%~gZZ8<}@)YZp}(g2`#+3vg{7RC@wmDz1eNzqaPd0wMHVI}9qg z9(r4t`0=YkHku1Jo0n+Y0YA3(m~bpR2ONE?V!Z83J8ksFS-ujmcNMvUJIKfcAq=HO zkKnJ3sT_QPj4)i5j{8Mx)8Hp!elJ)~K$jQ_s~GtGw`r0jqXz?f!t_Awqf`Z>5fk%R z_kJj6FuMC)G7@0e@qWyHagG7fxl86LBj}^+6_>tV1@7}r_Qoszed@QI5U(qqD3o11 zbGPv-K1D1NfA-eJr?A?C9ziF8oG#)drQmdm2Wp_na2zH-g>?=d;v``=)^h#y(F$7E zSg5(Bl*m~^0b&Op!-Lj4Djs45Mu}`^UiRfz|7-3j!tAo1*%jWT=nLGG3(z3+g-4Ip zHf$mr@Mi&S$t}V=1ZK7}w1|j6qpHTXiSJ~27Y%;9tEF`piSm2QCVWMfQ|K>kG)AM3s(x%eV4nXMbdLN1j5< z7Ni^(A9w;Tr%33XLJx=$F)fq3aZ9sK27 z0WGQ2RJYzizfy`sb}LQt1UC6T~a zwH_t)R4n-0TBi3aoi3018O{6Y)^`8xr56qf16$S0gW13` zMQjZCTTZRgAX-5Sx;+olI`JCNnPiOOs5J}(wfH93S|+!kM#s^a6%or2hV{3W!g4B5Iga0gkyypM<3#G8 zuPz(9BRYB>w1X&b`%?<@N$)f;%P&eqPj(bygIgyOicx}0CU++q2I$^&McJ%Ku3twi zwUdyeYkchAEaI#6(`v+uNZ8TSub8!#f1x$@gO_)8Pw!60l-pi6$nhE7LT=XC!ZX#d z81ZWzyW7Y^)K>gW!ZiYfl<*?5SYZ}O#<||lZB@?SQ%7T591uP3d&AxWd)lvbdFBf# zEX>Y$3P$F3P7uyn44F8Wrj94UNGW5~P2~IUbDf|gko^(sjK4?*4v&SU7)eQGBZYzs z2t#?FK9gJL{?M?z9Hjjy1j_ZvJEng?1%V{{7a(Mdv9e^0?#N zzO&|DyGlk*(GGwnMew^FSIDm7o%dr`J@~R3>(|Oz)oTzH+a(p-X|Mz*XPgRz`4dt7~|D{`rpa22lQ|l>1*X6B+5~ z{+Iu!`4??N+5Z2~HdVi0@pE?sd?tQZB<-DeP_CU6nNtQPzy2SbBq4ESn$7IJfmLld zZgCu(golR@Kq$B$y?TTC5ysQh+TDR@-GNix#g|-PD&DUuw7n@uxXD=Sc0ZGZO%Pxp z!W7&WUoSh@6AJg&lnaW3R``8eoStix17fIiT6H@nc@1{^npB$pL5ZF8CEQGA`}nD!g|K68NcLB`xGM(1o2M_7nmShs zp&qpypr#X2i$!PalbFey!%$T8FX!ew>p7Hkqf8BxQ28a@9@3& zUU+w=R$r$h>>dJnh1N#u4YZ~RQiwt36B8{Q$Bfa;kG@Ky;} zgH*9dA25ofc!n*mbr!u~5$|cCa^YR)iAl*}%Mw-?i~!SBeVWIy>95*1T#=RirULD$ zZjYYYP(Rf?=`CR&vC*qMEMDJY0R0PTCtkt(Wrc=|to+(`tsqXKG>m1>`l>*Rg5pVAG{WoW%^=T%=Pab-x5;I`3jg?$^+TTl&#QYi>y=6+%?C|{Gy&U13?-lg` z11{GUrKO)ZrTp@i%+Ej&d*|x2Sbkc?xyU?ZyXoFjxkQ-G=D`SwGLi_R;c=P8rd4Xq znb5Dy!@U+mC2o*J`cMH+MlAqtx(8V}l$EJTFf>fZyh?NDmB0^AZ$3T~6wMgt@20>Z zo!xHRAaa9&rmBwB0d^i*1p7JE0_9|t->E+jc^8(}oV75@MR&47j5tz=M0X{S@6-6p zqpUk<2R(42e!~qiEo5CS;wYX(v)(jr&}jgGz2)i&M_#)hCq{a@(*yF+OVt*=@t)>d z_Nk!Lh12?LorSsHK1-{lhA*jy&6y6fpp8muygZ6wb*-;~Xg`xu$+=!cIwJHRFlavM zo00{VqUlb$*{ewKbnFF2BRxFC){*DNahDDIo?K7-Xy4KGz!ra3-_2Fm!AUM00mlqb zFUfLtxNp^Nj&Yu*j5!=pX&VyEa>?Hkr>H&OnTpogMz~IKgOFTy!Zkt4a}G{+Y(|!B zw)VW}(g}akhtK&vC`f;6gc6<2qPTKD*-zc z+N?tTJcgXIN=1M6MmYvnG9AS>0~kEVTg%P1DcfQt{5Ov>x?#{QUMcc!DG*UoqG!+3 zAJ7x7Ni)*<;8SPb-XU0(%KKwh){0KBc@U+EeTG=Eu7H;Use-2<%`ykta#^U#d6NRz zfMzzW%%U;_=|YYJI;wi3<#ml2BX^QMTK`G#T2GEop$T)DR)`w4KeQQ66s^yU9^r+9 zfb@*VT+=N&L5Nb32{8cbZH_5SPD&bW2G%&OD+f>BQ&KpmuCxPyj15L^h8N7v_?!ul zWjq-ccVT01{8JD}Co7^!bpvlpL_la)c;KP-fe-6FGn>I*k0XyT>~~oWF?)e*nTR9n z0R)Z;G{s~O6-pNIc)_;E`ev5o{lT8z1+^uS#G-5y*_8vEc9(Q*$|*#(@vF;zT+LC4 zsxWYyM#3|_`IBW%Urs`v9UDX4XNnAL<4J4RBG?}_Ebu&Ngvhh2@rd*v88LVBZ zinN4L@i7nGlOfYgCFe|0I*zk{g#k6{iL`AuldjX%a(`co{!Y zj70+@RTQ=ui`eH3V+;G(JJSA%j}T`n%-F6Fh};XL;q`wK7PMy@O10$UgOm_Lq5Xhc zJqZ0Iz`r-17!Og{g<$`@fwuT4ZNemF9wH~Y1f#rfjqZbb46(;Ve4Cev%4$~9QNlL4 zq@;9xw`)Slt}otDGcY%=Tp>8FdE*GtB4utNi52Asg$VUqwIr%6(h=Ks$K7-bRDAlo z-H#Bu_&N*Z4hbQP_=PkvSqfi#SV-JrH`ZQ}8&$Q-tEo<1>0vV?2f+hP&zQ}P4f1EOBOhb#D9Vgx-Hqsq@y|0xh)8FvL09j{L9RRWw& zvi0mhyg+Y#Vqe1cU}w&3c^uK^Br9bz z$XXF1B2vYp;hC$6rtnCUcS=A9(x@0FgFc@SK?G~bBfPtW``>{;G}d!Q>pUmhQ85DChdxxBQqY=)dDPYZYLp6ImNJ4m0w63*6{#^{GDwG zpHod5n$!kB-6SOCqL>j9B4x-ukPMS{K;$7(Sm8%#8SL4vxnYcCVc8hSazFC*kjG5f z0gJxP$#wuhBFy$DzUlrZ$Zob~O^hVjZ5(Nm0Ed-0fwA$#EvT6635C96Hj!gY!69q` zH<-iFg?c^z2uuqS?dn+X=%#%vSV?F?2`9iLrz($p4#D1o>mKM?UfS*;FDy+YU-L9Z z=AfDV7Ej6qR)q2PX$-D3pyUkJXDmAjuXN{8Um~t|KyhJA5ax7fczzK1I!b}47UGrS znnD=MfndmKo#`l!HQ}tu(B`9yVnvuq9bZR$${cJ8{9eSQ#`4WAb>DuAsSd1;J6^?8 z2%|@^$nt{_5$2)YB6O2l%Ha0+Rb8Aj-=z#Or2n#>pc>)?w!jo|Igl$NbMY!8@}iJK z0X(a&$B0?Q0Q8a*#R;eu2NuX7>l{JZO{*niGRo0QEH6*pPBHU*4ncZdL}Q0!uGj+u z?yzRE8preUtI#&6lA9qCf@ve9PnxHuyQend(7tRCs7ZjH5WfxNZi>Hr)#@3dZQ-wT zM~b`RBm`ULJW3bG_(BnD#QsqyyHfzB6SLvAjB){S>dm1)uSU)Vrc*jke?ID!#RgL3 zAM0mMl%|G+lWdw{Qh@4!1du|&{p`Rs^e!KKmY7>Y3nvTOPnhl7ux#Q0~N`c+(-B9 zR!l)tO@&}&I9~X~9b0EHv7Ubd`t>7!qWjZBK~0A+K}}&{X2Qnz%$Dd&DO3-(rO|5V zUpq*5I!VjBE@c#!+ubZGn>^NAPWD{koty8jZYib$6C!^3gSVF7-FO4{^JU#+25X24 z8tnB==3Uu~KYuS}#u6KL>Cd+sQ>3EuGhel{>QW;!+hYp}>f} zg^?OGkS#(;9GMoE{JrH6amcQ+~EUSH{z={f(fbY)*Xc=jCNp3{q4%PME_P#Y7wr(C@s znd6lW-cAqe=&Rr0__=OL1#Y3LIN6XwY{GEFo$ z&AGmlu(94Sbr%j#!&x&Ib)3_5);DJvk30k5S-0eAyddJoM1jr8fG9|{mjn&x2 z_@l7>Q>Nl^TPLugTSYSU%eLLnRq8mm9O%>L83FXzfp~6Ps;gkde-mM5O?YYH8uE5T z(Oiq6WzbOdsysVquMuAF&{rIUO)*rT56sc>Ukx^j)xwEN&9e{vQ3MihtK`0=N^MCr z{)89RBW)C1d9zMFkF64K=5gsJ;2t=&2#S@DF}$sSMeUZ2rm6p0xSSu-7%(n~F!CPr zq^bXkQxu*wlc1%ich9DgHcsd;^~3$y3Q<1MWQK}Dnqgry<~j7UvAYnc-Uu(TuT3)y^Qd0Z4ik>7`&Sd+7%zkUI!yhh2J?V+QI(B6P8IJ+2)?rlF6%sTO$T; zlQ%q?$wbBSa z*W`DYBMjzxZ70DoN=xVOi}5bhRbRy%7r&vTG0+{iJRFIipB*{J zFB*}l42ub)-~94S2|p4>WwWg_<&=`}HK;ollgKn%mdu><543F=vLoUWyrOfxcJV$N ze~weLz$$)(6MxRxTscbPY}tJ6SM#>&l*ZN@WPu+?5)TIT70-XW<5DCX&L)N>m=M2` zDas5|el$Zsa+XV1cj7356T`+qxh*6GeypjCn{iUWM6wB#%zAXj#IwVbp+c$C<7?X2 zBnj)e&OdXWx~gaN z_(N$y6x8}B$oojPYCL!`5A6spOkvE8M&l2vwMC52C+JSf;VJMrxI%y=+#V}61q$`U z?uaHR{ZyAqA_9RR;Y55|H!4zGa^MMMKxxU>cC`{fN7Q^MEI{;h*(a2^dj-%O&O22h zs|CX%l<~w#>g0;q=O~~P;hXffb#EuNsb&}wp;B57?Z=@_^nA=bD>aWau=2skdnuD# z8ziXBb^df6u>|2qVR_+Q2U1uflNzYO3#q^V#O^~AL?vcT0XXvQ|9H z99~f|I$ru(vE9e?N2QfckH01$@0gTyh8WLQ8@qa7Ko5)`&M-DGo3k)TM<46A==t45>&aDYSlPK4v(&VH>+YITt+3n z+Iwnjx;rU^{WD1AbHXpcSwg|uMGt~^MI~9KE(392U33-D8}gcoB;LCqt2wu z4WD*h-vgbp^_yyB*23z^m3#IMXET=y(bIzd2T3?iA%&|K zZc5noPK%`uc%|ia3Ct~sG=K`7zAz{|Y>G279){!c;qvGW(-P~l@*Pi3H2nApQH`f+ zxvwn#JgOMk(+;}SNdx_v<(HAflS&jd2>-kNt_*~PlA`)TA5&X*n>Y}?zl~Ni@G?#Q zpBNnhkqLYqQjypk=r-2d2|P$JS&nD8SMQzI6}iAucve$k6>CkZ&VC9fxG&_4CmiM= zGJeWu>3^Gyu>{fXXEHk;GAu7P*wFiAW`iNN(F1|CI6iZOzt0hj=0z3%DXLGHhI?tp z7H23kjB%io&ep+s{`FLn;a}U&hR#~I%Ht;!L%@g|IA@bIzMoxp1(ACe_rsLe7MFC! zMY3H(*jS3+y9ZQR|3MdS=3~`H+WN>~jvq7f!2$1`-1z$bblafYva?B5aLQ9*s12%@ zg*#yT!X9zvluVApl73A`xuiB>D1OgNC9Gj;2J?tNM`XEi;@75qg?)@6m2=77XmCZk ztzl!zZ+JDY`1NHKrDdJd?OR^^pZmdkG-gfCU*gK*assms*rIRQY^ou66|T+JUUNo; zvUn2Rfn=QFcJj+2SE=!=&K9?qmEdnSpKNJLj(0o&ozV=7+pgn^wiTyL%C`LX^XzZ( z+VhTdu|pLptq<~^FYhz$TQlRFNC9kY8E=F$H9{53J4f$i@kZHY0skH zRJ2c3Q5qynh-ERH&Bse(hzBp?2Dd1a-L=HXSwa44X*^z(=y0J(^#h+?C?82DWA37Z zQrx`~#j(35j`Az6Uxr(3z`FExcaOr7PMC4HE^G6y)hgepu$w!!BUZ{N**2crUNF#_ z-rQA0CQd%29bGbQ{*~=QaC(1IAwOckCEj_8H$NB%82UzF|xc zb#NrMj2j_xH`)7vRzdmsB7-h=Fz$3ONXTZlR|Mul9GsDNy z-|Ff6LA3+ATSb>P%WZVe)k(*~mb{Hy`*yCAyImt1H{hW^O;#tjLWD#b4|=`_%kmFR z4--d5e@CUO(smWtOt&4s*s(Co80*$UtE{B{-qpOdq{4!yH?hHPB&|K7zik~4d?A$& zi0l#-*moe}4s6Qx=5m|My$SBaahuVQYZ_jk4+GaBTVF|oi{W(!WjLn(4IL4}=qfI#=+P`}4AKflYkIzuPD#t-K5J%SZ*HD_e8w{VJsM|{7)-Ow< z7x7Ad|Ia|8t;cWMgt=2&-*?*l7*>h@H1Pd*4NNw=|8>bft=SoK)rK(rh4Suy((sDx z&kqLL1;wW6$uP)2+jKO9c}4Q=jix@FszW`k1vDb8>nus2e#@bJ1lFd(8`+TmD?OrK)GC|6C<3Z4_v=j~6~eR1 zpTwNx=n28=xsf}}bSI7mJ`=kEaK z3B6sn63n{3xIwUm*x!mp7r{fjy)Yx}`l8dl|D(xz3W#a)n}-(50M{qN(fj?wY{mh@ z3vm46gUCozNvM@GPFZ5Ucg-Ho5&DNW->Fg?9`JuSd&lNb0B%Wl$F^2jxqC;scT%5n<#L|*vtB7Dh z#qcH3>L+@5Fbme7gR~a$Z!DPeylEQYnM);5B7q(6ns3Y7D4;oGS7cUELtJMJEezmG%ar@63G9QwVM#`uW%|LOjbVysL)^D$Scsf{u z#!XqxPyWOd>?A{^$BKR#hA7gG*~oa42m~V|$tRs8WoMO=`QbHjHc2pKdB9gJH(~&% zId1hhZ1W0p_R31z>|Lgh=-LoU5Z9+POgWuR!If50hzFOvtysjUN-D^ciCkIL6_nN1 zRE8u*LuHAn^4mpU*P;8M?PwS$5ZaA5c;u?j-aKe3oFXQb4#6WfPM(1Hv~cDWr``pc z8Y5WD?L`63V{?K$2)WvV;)C0N4LU(1)Ea0@FE8}fM*&gwYM4=yMgnG&J(OFPh1>x# zF!0zK*yFTBv?0+`)+i=ctr$%XCPiE^=Ro|bHWGCeBk}}!B)vm>Csj}`lkjHYUbf|& zp$seFL~8cL%=9@J(D>up3#Bd&Rir5%_~ngy(31;kVm!1Kl7zQ0Cc4lUuzhM;-CbYX zQH4?ijFgot9|}qoR5rrEmAdZa2zG?cC==m%+lG#+rw9o9b*}DjeVH<{Khku`g7>cdHr=@dmbT#6k(Wa#Yx(F!S%+A(-hPgB%6e!`vs# znc5?B2>wqZdga8VOc4W^ara zYcDiusl=dsl7prZ)RTbwe^2fDocVsjU1-3qWVF_HkbN08m|JW*mebm-K3xo-96)V? zU#xp15hPa#c&Jl42|+1a*Q^AK2a1qpmj5D7LFK!o`UGFMp5pFz4X0?{yss3tj~#$_ z{w#h?W?7&h=gSx2(3cV7?SYori=u1815DkGF;7W#gwoRDJFqGq&;zE54jf9FKG?{rD#;=(ML#hzV0*=FCZP@hE|=cTFr;&` zYMyF|pzF$i%ILe2E)7_7*C1$;0}3*h91L55#_cL!_@cv|-g)6$E5Hp0osqlH`PELP z$QOlEX=?~CVIM9?vwjAqHwn!Lh|vnFG;eMptX$lSa>L{utZmxf3xoy2cNz_79Jn+o zUbAzekraW8(ZXiaWL%W7kf3{@$<@uWd~#mfPj$5R0vIv0Rb&8{-58FUpSVg#d&hU? zLdY&!T+z22PDv`ATPhY1TQ6^eMG+gMWCiTF2+q335AVT|n_2s;WCT7&aL@pwV1&i+ z>D~&lg`#+b@zxKvO|{hvw&arrYb%)ev3n#?STH-(Tw>d{DD%9}b9GkDslk%= zC%VZOoBYs^zD-dv-dG(m#71s_?Gw;j#`(QMto7*?Y$4n%xi%}NFaK;B#ms;>i4IC8 zK6>tznqC)eQEf*g;yU!dzEMwQU5p%zlVYwTtiKxkt>b|2RY9a8bl)L9sw(K|vF=Qv zqZj6?&kAL>h5jK5wFZ|SuDnuJ2mb*NBj3$}6Q+meZ<>_j%*3CME|y|&1j-oU_3t4b z&b8_0rZ99P!(gZ7+ry9Hq;YNshHP4WdQ@j13~e_CQ=)MLud`cMo07fQ=ruwZ(EZ*# z|FNMj2~kF?;X0DnXf1_wk~f%mrlcp;fh(;NY<(yZ^bNj=fpBrAYrb&SSqfZyC4yLb69acT?2 z1s!|-g9juuFi(5wsO8hyj%Q>-OlzH^TE8D=eL})hLVkD^)q`a+rlxhr`qe&z!q9%D zJ-=OnTFVJ0xO=b)y}|nVX%cc@bFMKXQ!x~5ceUf3wH#G@h>k8w9auV%Kt$`V?a2Aw z$xx<}_e*L8F;b`1yg>$dckq3es=@g))rQvO(-_@u9H`U9rOkzND_pfiXA!eWaxde@ z));P!zQuTk9mguetpr0# zPS-CAItyo{4Q12!uPBUz-p0*o;cSfs(%CY-8t_I|K`|c)_pfVCispFw*WI8kP}GTg zTR>VjvV#&@_=H9VhyCSueN%(asH`Y5W%7&|>t_+13y~I>%f^s1`+CSs6E2RWRb2g@ z?)xZ0YQ7$h0fZS5a7M_y{mv+z4uz2}t8S8Z^#vgtE070N zvxDC%Wa2cebd+U(E28i~twKa$xMEXCQ3QcNtorGJ+oh%|xHpPvG|kzmoycw?vv=;e zqSxnv7^pQSahdA3?z~dW-tRT6y2Ho%Z$Fb^Y?5+L4dhV9i>Og8egO5A1`7Y3cxL+_A#gbu{x9+TI|o*K)c&8JsV|@s zgy&{|Q5ryF&~e+u9T1JB9uu=9YR0TDU-F1Vignt}Wj9oSK+zVv^_3_>xCx=e`3V+5_k@rVFM-D7B+tqtxsgKl^);SKD7 z>CZDV(@xjerml-~pIlP&Pd<11emv+cg*(iX`E_%%AE+BZj!Z_?8qS4@28;%0&3b+L zFOKAP-AXiTe{laxLYMqX=-VI6Xs5y0%-$cTx68ZBPPF}tQ@TE8J-;ZQp!$`&8N2)u z@LU(Yn`WSDw(W>{Bd?m^HY3zXMM@f_u&3%s$>W%8GQ@<<#lR(Z=fMKhlokC#$gL*P z;vBHaWl7Zu+-jY@-)aCB{3v>_bLZlODlpjePsQuEDdu4*KlxS;mOlbP@BjtD@6xQw zAEy5-&C)H+sUylx9|%)R+6PkuxO4wv2T!Y|&p)(NeSAGdA#b-Cxp*+Mb3IskOlM<; zrdh9_ikT+>iyDTv$v5gAb!s9@Mr~$SIvVHrBlnX!T0TG3rxauwB7!AUty0}^#7Fk9 zp7FdEo?{|5OrP+XCx%QXzt7G1fR$lU4iF8N+D9vWFV4?OMBydbwHoked6ry8?c$;t zV};Z+6i0D06<4gE2TUoL5=+)Y16@iAD5;o7;!z*zwTecr3Fd;xar0K3fS8$xib^>P ztn+(_AsdxAb!oHb60lc>eD zj|m_)=+JAEm=lHOq6(+NYzdPikVTFN+rgCSn!7(`$^?o@$yCJnub{THBwCAnTl5^@ zjLE$Hw}gF7XEEGlIce949yK@^-bA4)xAWDeAJV)YVsGhOo3E6$16r5#=KIBp-brs! z&nY}E4h*0;&nT(s^S%g_y!2Y!Z3@EcYC<-IplX^bozk>$s1T+Sjt{?s=0;yb9~%f> zFE%RYQSpe2YvB@nzkaLl&gT3w=y@jf8*Pj4B_DE-LaL?%nsxrFk7RO$R-uz8O^db z1KDt4J3ni|jh}xL5`Ku-1$ycNW?KO=Zuh9NXb{HjJ-ZKxRZ8M)t8?h|?+PzD`Q}7} zisws4F^C};{%eSZF?aP^(Yq7)STaIQ4c-nMTt7` zTBmDy(ya7yJX#%DYSSToM^YwuQi6j^|dOIKwYR129-1_@tgNqkmDrd?=(?wnj z3hL2sKG2lUfWQ?!GM%EhVSI6kU~3570~XDk zQhBlw)O(uGaE0pLpc$Ggp;zcPU!46?lv?1?zj$TM@k3!iOi?r1PCApC8UY7i z#?wi*D<5g|x0*cg{{8*S#B>P2vSF(Qtka+^i}l7mlFX~?XEe6+OEb!3+8Qtm^q%`h z41;1YCaHas)~FZN%-Q2rEFQSr`SNhVR@wLvVOt>2)8aED&kI9Hz=OS=B;Z+&4c8~4 z`$DH?7IQSb1&J~Yrr|p`|>=1b7;PNTzH6LkSL; z5ghS>Y|%{?821b^X1evfBBnU^suQfpdcSq`BNFbAX|2+lln(QaKLY5NbcB9rsVM;+ ziix9HAA&=Hw&~XQc9O5XU0sVRK%)n|7Y`H_l?j&%UYp0U7z^%pquWa@n=xINrgj_| z*<<7+`Eo|is)0^rq_E*5`LPirS&lcFe}b%hnG9Ug>o;B@t7Ll>{<0{F|9rb6`^+=M zwL4-(D$L-h<(L$D)n*>oPw}5Fr~p=#2*=C&=;pp)3+tz!9ToZ(KrB14p-WJVs&6L? zL_<~;cfd`J@_Owy!^rxN(-kaVis~A!`31`*NuhcuCCH0sq{;t9eOob(U?)m)jB5m- zcMGufDKf>ic}^jNF3-{qx%^grf6|hH(XEMmho6y(p&=Qf;Cw+=Qbs$53OTS;RV0Ru+29(WJ}&ojZSQ}R0f&tP;Xhn{GgY;H}H z`y}}zpGW&lp@+Wn5UQM8@1A`Q3^>Y6uTQ(ISN4r*gW-4NqKk>AU0&_s<6-e=<<0r1 z6~VtwZ@1h6v+507ln!>5lc`#4Jx*jz>Xp>X5A|W9)_d)5p)%cy%eFZuS zo+)5q7tHnCb|n^EElQcLp_`I?r5d^M#ayov@yjG?t-mf5d}*4|GrBdBHhCJilt&H1 zC4&TH#cUh}spd7$J@Q58H6!@G5^mT2xaUe51EOWR!3^3&^rg6vl+WD*F#%8bU!Z=W2}%KpXG<%$K{8&h*Hd84}DWbv6|@qcqY_b zviVfrVb68Iviu=&49@N0%T-%F3)oy1YX>&ExTibPGnlX;A+NLFtH3FpBtSS=x>3I5 z{suLUW*&bD7qX`v7(&)?_Qv+doP#dM4!Hj3hW@Clvm?S=`|e&1_a zd2dTOu6daL+fp;K}2pWy0)kD3~<7#^#b*T@`))LLe3vAsW&(VT-`|Df;QD}E?6i2hcsCB<{REf(&iOEAfoq9pip9Xzf__0^z;dg zH1hwE2JPMk*uFk*FWwG6pN3`~0VSzh=zHiEA&B>t<@&+NS$lTB|A|tRGnKg?9ZYQ{ zFnG({m(T9)42@}Y#>Mz~7-sKtS(2M`4|GBi=$_Fw-UxmnA@{czbp>`&5%+ct%h|o7 zx?aNKf4Nyx>>jSwH;Zl`Y=!`8&HQ-$m>^E&>#=*{bK~X&rMQCxk2#kelsI)GX`6n1 zf{#(X3HW;MK3Q^p^CH;BWPeZTE(afc?vfTDCxni@_R0Qa_ST6J{7(HnYCXQdv9ZEa zi155YuruUW?JtsD!>lCLhR?h6ma;p50Xo& z1=$nW!y@dP;Tq$pGJCxYG$DCEoXms36A1r1yHA>F8>Te>el2>%`|!#}hYxKEk{w1n zLmL4fp}WuEe>{)#(DW?ZFeNFlK!iy+695_jvhN7t?=)c6O?9S@>)GWNh*+sqAB*9C z9Oik<UMidzz+`e7jYxX**4t2e~I6D8Gsq{x%Vrn)kVNj5q}%6p$kcBE>bJ^A*5DxEtt zuFXmYHq1>49*En?nHgo{jbp1_Ef~p2}MYZg`s7)z%vD-076b((|d+DQm@3m zWd2qqo2)O?B-1++EEmfhTnVY(A;9TR8vp)B0NNR^|2puDp82=ulZuLs3*Vo($fvrt zsi9f;j)6D~%&>)uO3Vz3c||55craBht_iuHItvleJ{<4(d&F==-AaleQq>jb1xxyP zO_tR0A$QuMjj{`b$X5YUdba^|OS9b2N@HO@oJ?OEN!=N|{NKzqq$L^G7jT{;-v@+_ zritjKQOxv}#^<=?#Z1wh{Bk}|rUn~bS`CV3>QF>HhnW;N$fFtHKSyvv zNi|At9RS{XrKL3HxgC(|9@(PQ#(=azr0DhELYHM; z7!LZrHEbg<=e1`|Xi%Ifvp^k0!7xoU{+H);xH{h;D;!bx@sa@&U?r%^q4O*lAS81;%X2FQPZQfkNv(lLcCT>PNDp@y_(*Id*Ik1X)N)a(~ z;Oz!0HR6$GoYtdL=n@ufAxmAyW&d8}fHb28g4AxB*x(YxTrXy_V7a917~+>G=`unj zi>Hni$UJP0m3Kcmsquh*c(+m_xm{qS#CUL}i0NfnL4MSre$1Q_cu(zNFaXG{WoUYh znZ9YWhlKW)9AV879xjCemU>sdM6=*QWRM|R_l$6IFZx%^N^^nbJ(kg@5M@XuTCI_D zcMDM}AhIOd5;l}Of$A~y3hQcjAOTmVySPZR558D|vR%aoo6iZQn{;epf!y&`cEpU` z&)=yaV)N)G0IK9k=IoP}8^Q*GMjEbVsH|K|&@ z=~>enNDr~e^tmasEF_VGC>K_>l(93p`+h^z+o|kWu_-W2A@2`(e?uqf%tI@7#xpGN z9E-i9X?;B~u#(8noS+r{h}N$Z{X8*{H32$R6KxT`5kVb zuQQM=@8Fi;jqV9CM{NMdK3HNx^I8}DHmPB{(M>bwd}G~(fSWb8r2x!NLL}@<{?PT= zOMa0H4Kp@)8*XJPE^D#~i{e!@MT$J8rka+&v|?pRm?5LZF)|zzVqbS>-oKoD7=Y5e zC8fvFA=Kfu{xJ9)8)*l5brl9;AoLQOD&T{mi-8dC|tykTWC&;w0RqKK3Uf5 z*IN8%3tuRTE+qJwp?wk9iZ;dE=Kq3g>_Qf7u1PgjHo`Im8^F$Aaqs9BU3rz-$mSwk zK5eHYT)f~SU%M_G-nhUyZ_g_I2%2Lmg`{y&IMe6T1I1g{IX2X~L)U1k>eiRltTcwE z8Rs-C+NzPKO>;{qH>p6^Di&>xW`F(yNkHy2j|z6tjo;LpRxnN}jyr?icBiqNnSGmB zD;DWJdmgKfnAS>!Z8ute`OaF|hQYb+u)3jJ??&e%b5y*ZZH1Qx!QhF6m47hGJ#L5h zEZ=;uHUnBHDX`g=QP{gbm*cp+S=*VCNU>E)w;ehZ?KcdS`Mg?YL3A6V)U-*(erZ|U zQWMVBLs(}Wl~V#|WF_k;50#iZ25n2gnH3RbZqrF}jy6s}W>LD#`LWmgaIGH9Hh%ys zg!)NZQ$5BK}p$ddRz;rm_tevAi>u z37rpHJ@<+}Q0nUzKjG0zVtIjiy6K6^yq1g+_d8<1>5`#ezNreY=O(Cj2<9x4LH_|h zN?aaD>{pbnVced472WkluXO_`)~ncNY~a?AAm)$rW^Uzv`Fgq5y>!clm!@sJz>{Cf z`Zt9?!uDKP(R{}Y6+)qUhrG&Pq3URon4tNrJp5@k@m%@~y-K+)!S&IKpdq~CW{iaXon`iEFb<;!DTP7$mO&4l-{StvSc?4A_kJ&D!?_`Az8Yv6f`k_Q?cm5taRzR9Fh$ zf7T`aj+_h~zW&JmWczCLg_M82#^q(z^>w)cB`7Y@_5C3Ob^a~4mtE`koJFF?Tyqd< zX5#;@oaB+VeYa6lqM|xx6ooIPqP~raB7|rrYX;d<+QVS(tKk~gs4`2vOl(2SbZ2z_ zAq*}r!@Y$rwZ-xoLlgJbKH!E4b{M=yNc{}pbSgW)09%!iEzFpcp2&nBAzI)-b>4D<_L zE!~S@>dOroxsL+QbAV*6=1wzkAHiO)$@%*X$QM((_?oD7S0xS;Y3d)DL+6ybji?+B z+9Gk01fAyv^GF_ux45Sc0s=ujNa8;Tf-V-t_$GirYJ)g_AYZK|f_XWA>4ek;r0?r>#k+Ba8Y8*`4e|KuZ;97Xq6-U@Cp{|> zgv#m3?2W>l)7v4!KkZu+0x%y45&kSP$9DS=|0?Aw2VMOBB6#zwuTlN!Ar7)9@qX75;_JGRWwaDs`~VNddWJIQnSjcqHWdH0VLi?a6A71NqY&{ ziRmmivKk~un_tur=Dy@gos4vilh1HRmW>cps!`o3+EF^!IZdjROY^J z|LOQGdi6j74aU>8hmb&K;9S6s;33e43+8SE;Qvx}*Wj>Yr? zL~aALo|MH0gxmUi;l`$8+RAdUoAHZeSxP=`5v^i&-sUvXh>!$mI&=es%yu(^nBBO- zw4Dds#9+`hsfrcZTrid zMBE1}wA{>zYAufC5>MVF^&P;t7_+!)C*p&JgWBGgTG(Qm573$|RdoXoP-t#PQXB@* zGZt=b*$_EBNh!X6+o2~SL^gndUNe-*8|&)ZrzD|4h2d&O-A>S4AXe)mHT>k=$RkIB z<7)~f2f`bRGNU8{Xm&tt z640TfL6|6>4ev_#j-7k@TSta|AjavJ6U(k_19TMGD56}Kt?rzpM|T-;IMS{b#AyV> z65-hkTMBRsJjH@9okPMy+{}?$tL+4GX2WZPa>fOhfOD_tpugRrjnL6u0pNEHNa+Psa)^Do zX=EiiAM}noX3b2&a1eXZB-6H4ZYyoL!v#Na!!)^abfgg*lV&jPklMl|0NobS3MIoF zgjB5~ZupE}8=h!k1WyoPe^R*f_MJl>j5E<8QXWz=F^nC-8P~qM%J2Rs109%sQ&OAyPrTIZMIK!&YaZO?aRt|1i5X&JBZokdRJ zEgZZOwd4^EtTRm|=*dV7^hr(uM>RsHmlG&Oyzk0F$A1KWy5Y`z0(;qSx{G&HRJ6)xH9Bl_; zqXxZi(R&XVN<{tF6`@Zex>jbP1eGTAT@q|0e6q|q+v1iI^v>w%P${T)ZbH6B_QYUy z1uMY{zM_DQ>SljUS-J2l1e)cW4XeC1*mE3jY@FJRx|Qi1{n61d-E;eFF^R}VIa=L` z_;dQTdF~dJIjbWMu}~}-<0%Gq@WF}7(QXcJV~*+asYoj6Cp`u^6lsoKk_6(I@;>Fg z2Dw&0n!Z?)B18%UAsa_--;p++GM(pPcvoV-^!^z6X68>A#g?i6Zv5c1@3Jz1m+Ud_ zT$q8ovMXQF%x)Vi6nBbzrviV1M2vW5me@$F&3mP=L8Z+Msl+Gowd5skWelWF(AtJ) zELg}jrn?{b0n?(08epPti-D0Ev(~qRH4K#pEt>O!{_eO^42IcS!;V=_Tz8L+mj*8@ z(UJn>cD2&kSjsapNJ-wRfyd;+BSv^KrgmIgLW?EzT{3S5NR6AMqcthwJ2il$8k>L^ zfmX}4v-%85!f(zXP`%C@ap zumeSFR5RvaQX4QRMwyGMl^=r`sUzznHyokUwpnHCe%CCtGK{X2d4o)?>c|F1g-ViZ z(}rbS7wZ9&D?1y3S8#<;=cDj~g;yDXh)+6tPo}x#5g|z?tW#97`Ni7o7xDbjZeNx; zA{e5~@Arq8F-poP_*KnxuOJj*kIPqZAae?F9go!r5MD}jv_^W6;^f=~2Ck+m%HhbSX@yF^#T~LSW zuvkI(iVo4;&t|htp=%s~G+n~PI+CRX)r7u05fxe|-FUgtNs^dn>cV93dm2`_?;2;US*rI{MxSZu1 zhH!um2u2rgA2!-huc5$$DcP#0(9$Xd-t>Do%YwYCP5V}CfGeT2TT**@G#z!Go<4Au zl+-491mSkvw~7}jhUBnnAp2_q)$MB(uQ=9FcE3#Y=n68|!6OBLld#Wv)+YrumU$PJ zH*iGege&d%>-V_ZTj}w`ucgVx(X2`gMWezBky@Ntll-PQ<8)|N4E5 ze!`T5iW6=hqe%~&q1_gG8XWmWj!(i;0Q-dS6AgPM@i`CQ5dj(S2;l9o>9|sLZT_+* zNp!2ZJMI85My8WKO2ET#^X_GBHGRs-?D8tPrW3WE4yT%#O@rw|=7c(yF*Ac13QKzJzMq|ae1w09{Bqux z%9b8$VuCKVpVRpM;hpWH8UJ@u{eQIa%tX)je?7STCp9PP`rlBXa8D@nU#Z@~@5+{; z6EE@~DA3l(G-)56WMMAJrpism5oi!@Ta^xFBq1Cep02Ns{{9;rDix{~x0CPt7YN-~ zFyGHw&-ec3!zbT42>avK(1VQ@ZGOg)E5Ja1`0?hoon3ZNhh%J>qK=3=3ZUQVn`IsR z&d{k!*d*<@CxYT0*A2V+mp>dE;5NGL!@lU(FBd3e)jkZ`&D{G{R?Y4h;d=*(f21#> z<{M`oWv8d}TGe zmy?fnS{KRsoQlJeJWh%f0p8z~|8egl;p!}4@V$G&tg~@B9V1cxr2|F!FHj`Q^CZsE z;;N8&!^>lE+blzo+tNZZu7w$DGT#&yW`V~26*5-Hi^onO*pbZ90a^J#D} z$v}b2sb^y>$!K$Y8jOK%bW<-u;q2x|30;0hO8d9RRJDSsQ}2L+P_(ooLf_5#Rns1x zK|`889~0%yd1rW;c$c)K8_TG9zJc+rX=LZP=}tcgX2iTI#XZTg>BPFaLh{%IW;aoK zl_ida2EiwfR(E?iR-mngwf}It+<>n>v(jO@rS2x?&}UwzhIajrGXE|n;=5!{8r|pS z&y_fJ;t<7z@~s`PQq1Qe>Xz0(Ou(x*8(7!)n=oyJi--&gmOTJ1RCCB`v-Uh~CX85t zPNC{+f;kPSGr;cE1y18Oig+h*z(U3D!8!8RGtmhzkGdS#0l0kNC^nrAvhfe!;+oPkaL$vT!ITMi3hFDFzP%*t30n zBHI#idKw{eu(RkL?It^>90d>+S(vVtmK3iDYXRY;ExsP&7VN;*tr17H&eu$pI3Zi6 z|B#%vkrr1nfDu&0Lyr@J*d%;SV3AsL2i7|=JE&$i=En<^;YOe`-w7WKG`D_Z+)9(M3EK}uFcbhMEhx=2mLAe{n&7+WM~TBwn#=x!~%{|yPYRZk2Jo>Wd^TN zm`y893`8}rpphl4Iv$5xrZ^JjBer57x?>2)Xbrl=ji#bIbV&wDoUt2z$GQb%+25n$ zj~59yFAFW2<&zA&_*WAkYk*x7+?9t2?}sq=5m|(zZUB=dGM*W?gRQ9cbXAq~ub5Mn zTbj{_J;MQ%Cl!GEjcsoB%QIF=`!K%6U5-D`ByX zfCJ+Ft(Zz-oqh=Hv)Jc~4IhkOlV172&Qn? zr9S-r+7i_!s=ki{6g_8)|Rlk8H@QvYY42;Dp zL4P2maI=+V)Rb`jXo2;@ESu-EyQekyP~2RUWt~fTm~LrJ;JK-)$s8&y&E9-=2m6oS zvr-W0-(@PenYOzJw3*!^Sq+UrQ70^QKS$p+AZ}RB<&Fn0Ddte=f}z~3&QAqYPGYYw zZ>(jOc&^8ElPh`6qwX)6Bsrc1Su>?>)`BnMOqmOuh0YLuV_ z6$@udpqyDpDFD((FjrbMA4@&bnid=TQv)yGcyAiS`rAbR<+tfb1@&WIJpt0&6>?!H z#KEQWle;#+mCXk0@l47Wm48Ha!6YzK)6kGwveRtsvQ>}&OZ1!bg(;fcxRv99eo-2- zBA7^%VIL{eLlM4c7MYQf5PGZMIDSJNW!^KJd&ZDn!TuKi5+EgNFE=HgthYj+k~jF% zHj-<&DfJO%i+rM=|1Lz@Ek-q4##m4k1^V<1-A1UUlv5hYF(A>u065zG4Fc)-xp_-0V~6q0?q3HO+c( z2BO=WVw)Uff=7%}KP$lPccVmH*pGiQ8ev7L#5i^p-H^~HQqXZh-~x9XNK-XPj|m0I^= z`WQNh1W|+tJXjc;lHGK9T&fF}!>Zv#!?9#GP4OErx2?Dku{)pdy(KheYux?hJ&J{2 zMP}K)I-he%<6F?&S>AME%yO5a&VJgGXTb)#Pi7-FS)v|UuBdt166@G@@W9(`I9?7z z6||6YH_dUrumaA9*?#RoELKX4;gqJ}9D|2pfFd)36f?&6W-_1AUsim%RYBVz>^D`& zZ7TDXQNoU7j{mkvLwnV>FgK~ksfEvmurNaPg;-x!DZ5F{M ztC%g4Kmkoj7-rhtPLHmsnx^5me)&t?JZ-+We%JfK$TXzm$ZKcyicPeC3gwGX0C2RK zn3L%{vg9`=Yy3SbX3meBN+(t|S#0o_o%emT54i5batCEQa+}ci^vZY=q~L0Cws~X@ax<>71D*k zq3fEzg3fwmKji}f>W0sqwRv`4OCN28rl=h1rE#$Z=)fQIFO1c!7T_qs=j7J5iq41D zY#MFm<$9wrvMHRAH9|%Cm`=l-q$pX)h^CKw`IOu8M|&bmT{9x$@f@snOwvQuh=Wf4 z&_~p6$=H;ydrIeKQE`~?GQ7Pv4b*xn}^ z*y+@5v%w%O@13vAK!+DBNGX5ZRR0krx7Wjw$^+W-u%P!lxj_akR<6sVv&z>z)*x7? zoSY6lB^@k?E3|ecZoH<~)%&3S<|1goDsP$Ypx6A# zz3tH%kY!hVtdxbRs{`&J-7O9nL9CZmYJ*>UBrPUSVCAcB8by5rIc}u5XV1 z!5bVY73qJx#K#wi-G98qhPI!3-uD+84}e*&SNcxcIbf!QEg3v?bo$QikNY9^l!{}w zqzlSECGhvm{jZha{g0K{{4Xm(_G=}u_lAPv@u1<}@9@9LVfO}ExCw@kF!{D0w!J(; zcD;bg-*VJ1UfJ2Gd*olg9QN^3FZp(VI4Sn!=@41sQ^!t;Nq7M)G7QLhIZxSsga5o) z=YRg}6LGg)nkAQYNJ%^A=X@ensSaOXlf}^n8xvpeyNkPJd2LPfO1|GOO0V~A^lbDs zDqQa%#7_EI=jXCNf!C#2C)B)jAWa)2CEx@Hj3sfqC@K-n36t3>#xK?QyjRdn<|0qb z|79c`PXD)&sLt8{+g0-a7>V=u8U6F#Cbw+IjW2#4N)(+kMyD*vQ0U)ZWZohRO`I%KTpfTO}!*7kc%I(sDrY&F8JQ@0PXsU z$OOaN(ZncIXNC_Jx7-l^b>Xo5HxN>&PNc8VMao;R-Tu_H!CZG3*(@BCJd#S&4thh9 z`WhEd6J2b$H%<1b)D)2j+G*Y2kCi(YX;7SW-8MCINt0sS6Hv79_5ii%Ztg77=5j9` z&;aDKUAgt(&DdJ@U*cmTC{6?H`8r8oN<=H-vs*QZTfEfPjz*@X`B8{};)~^EMAn zSP|BKVt%QAxVZp|iAerf9N4T>$!NBB13F#4NvQ6z|bL$-zkHP9_Jb*2tuy)hRRFTa)85ZPXNO zS)z)?W?Pn;gEW%5aNOdBQ>ObnVHO&8ZA$c%L2b!_*mI(s?y{hy3H=l}Hq*ira1mP4|GDSdKI`wL>X+zIucB35_5QCqKzba*{(}4y#~#? zIyg5aGS;m|OYKB#Dd2O`!M*HQWyp$5GLqJaS#eXQz7Ef7A-IbgB-1Z2?_LuylZqh7 zK;~0Jlx(8fAHgVS!8~tMz=TJF)FxcHr~Wq|8YV})ZB*MP8PWtcyXcW7&KChPNsZd6 z@m8a@WB_lv<-MPZ5caLyFL%L*a0ZfM+z1y)rqb0VgrDZv^UYO6>Ne>U%|L-%DR{$! zMIB8qM^~%za@*~7eBb}wsro2%XtEYd5#3%wLhYOh28LyUC^V^gehWy!=wGVe8gbZs zpGD3Q*u*}Gv&K=nQn8uZulx4XUzu<^e_tE{%oG#|DY@6<+H=G*pOCA{97xkwrDT=7 zI;PJySRs}rc?u5%C)BBpx1SDSt9vZh-dt5Lgg=32P%RK{hDQ0P8xBA&?VTmmF3R&7 zIsZGz>c9-579nIzj12MHn892o?`733WYtD6Z0iq(O`6@(BnVr5@j&|{mhs1tk;_;g zx>*W=|E*Mc5)vo24QEqLnrxugRcs<|56lOzjN;oVHRUfnk$8hs35epl!~-{Ek3l~v zI;=TQ#iQqDHubK@k+KA!U_A9K=R#T6tZNT6Hc&jC$Stdq|CX`UtDltvP*I$oL13F~ z4o-&Wor7O~+9g{C%4jw1XkJVuB2mGpc4I`P^QC#vf_^aAkKcMhGHOoFrS0?k3T2sl z2r;ZgJj*Zw)+~4VA#%eLc^e{8qb>H{i|uV zCwZ$fd?S8P@h8kmT2K_8lU~)_%d+Qw-m7^KEcT{EhRuF$sc&2q83YMF#26-$;ni^0 zL`um|xXFLNY(=Iq%qvJwm8(b{hhhkBVLt!$BHIQ)L`>hh=j!%Noi2t{3U}3WB15g= zYL*FIAcaWY4i(jjgAOCzElReEY}pI0*87^_rPhb1ZD&dk4ZY}9oU@rfHL*B8Fc_Q4 zeV3`xB4B8JK|xV;7w0$bYa))(9pN3Po6A2`i&qXt1xz|{n-N=O))@z0Q~j2FIqiv= zEK=J!Mi92wySSKUFr2*sRR{hB2PPOA2KjTLkC@af9O z=Xgifj{!(lesk6rR3GD3cs(_oH8KW)O=ZS>2s zo9Fhk5&u-S7%I$~ zf14m0v?WGECLjOU6g*=QO#=hnfl}C>(R0hVgN!jix+%qJTKD~#DjE=t>NGStTRo?X zUyb9meeLAQ*G(TY=cDDo8C$u`9vA1Zdk?Xs%zU_oj!X1(G5BurioUpjZ>5DDsgZLD zZWca}Jt#1>3-}`_@ss1oBh-}67AF(nitrf>z!3CwJuy#0>DZ=ulkPy%^MFcD!I-(5 zABR&y>Yp+{-`Xm)y^I(%@KhpkU>Yr9-c0t=%r-i6Y9qxP)^!@Z1cs$MC$$nM$Ac8S zC#4RDS{t{5^k(M86KmsrM4`VGrU&6Qv_5V1nWol1(;*0JXE`Wt$PLZDwq(a^t}fPY zz*Mn7AnuRSz!hgZIrYjcJK(<0*w<)d3lqIJQYJ~A-N{`e)i2vwB0CZlk+0h+_(-GF^_oQ$~QaA87s?u8TyI5HKl%^Tb%lJBQp46vMleAQ|in4~5- zfNnVQSqTXQCPJpd&V^9>dpS4y}09?Z;!GZhi%ygKQOSU_z9oqVowcM&*V>B7b z?hqG%ogfxIl0Q^3A&P%Qa{mIWAD4!Kp`YI)Vb7pPDCJ8`Ug(gxUWR}tFD}36w5gtp zaVTablFtYLX)Ht=HjO|s)>^H7tu|eGcA8BApQpyLdS5-;!2kbNf zOeWBD2!do3Vw)7#jva8CgcoBRBw7*RGYfz$1<{2ak%t@^G7MBnD(HgDD~_m7+C**I z0Dw~s^bxx{MG0irpdzJ_0J8&~r)C^CXCzn;ZK|}t8|MJd;AnyyBN3aHK_Tm@KFMjH zSKK2j&ZBgslad%#JOgwpMzg+g(gL?J;{e+)TojBVNAocbz>XN6Dj6brw5J`G+4vmw z=g8F~%N0cpqP7t)LwmZ|20&SJh+9I}s3eC(S=j(rbV5lX7m$<|beWScHVBd_xS`>A z5_A%HRj1?F12^xqfdJz`uTB!(pst%#7iVN!P*OvJ7)0-Zdm7wtXgWc>A5OB~02Q5js^nv04=@d-Ar4Inp7^dkwA+Fb*A#1!j`hrr@KFm%N_qhN*U&5? zFb$B&Xh0iF2Rwt2X5PFQ9~Bk@Y|T)PC!Y)Gs~~k~B@GHrWFKNOEPg10N&%VJip4_K zFTEUXKvDARj=P!lt?x_(fqOau1Zs*5C|fh4cIvrOx?JS&aqt(EpVM7$arpn z8QBPKDlx~j@{uBPuzF5OTHIIaDg*ZHoZ}APt_I$)Xr8qAx%8j$i+knMSR2ir=s;oAMYMf@ju)=c~F%Nr^ zJMOilO0n3VP4<0z@bNzo?<`pZXAN<2Vo(+iA}jQQkXHJzC*gk=tH~~?(Ai(6Wc_|W zAD+Wqb@}vaHVb&T@?pO&MVq{|{kGi3TwmECk7$1N{JcY?<0siq^vN!=?I-!u=BCKi z`*>&hzYBbK()PY<`SYKjeJnOtejzM6en&^@?q2tT5KSyGga|91lTiR+{`R2mfAsl3 z&iG$rp>YR|U?56}or8GT0u>+)Tmhr-1BrqjpwI@QFAwip0OB?hYqSOoTMOi%^DQ(> z3!+vU0ofX?m!K-Nc9BP=J{T7UjDX_8L`3}2KLJQ?cEhiac|)^HjL7=YM`6)JkVGup z0;eJF4HZLZJ`kLF4cOk^3nadKjvSx^N^Tdm>t~ z8W_512FAtS6P|Nn<@%G?kxjoMn9zKL%67OA4Q>uFqEMdl`Y{_CR`!w8Y1_x~T0rqD zcs0mC0E$wTOpr!}kiz~Ug8|e%_>*Ud(8O9uFn0&Aks=N$C{!K1fyUzdArggW%?+Cn z7otp`^TS@nk%)azA?y(!&41d!`Q_j0$z`j>X<+*Fj{%^5a>IK>`eo(z;5p2SBVz-5 z6JtCH&PGiI#br9eQ<;d>fdG>wVn|y`!PywGWSZe6#I!WX?;r{#h98JdZSiAAls*GY zhx<}2Zm0>;kRVo?Bt(0R!7=oH$KV(aMGqeApmZRuu<%FpL^k78=z&ZrI#>uPAIyr; zCa#B0nu+sPv>?T#7$iKK1`;&93nnuxF>6Ha>No~y;cEbsA^-F4=9nawHYx~K5w<& z+CBJ_M^jfV{tX|Wu6K{0P)4uE3(nu~8yk$(@87hO?y9PSj`F|PP8+pe3vOj6g_&zr zy*E=E;e~ZlXV(u{)+Mp~r?{)S4$dHml?q{79$1$Mx58aMVjXPhC~ueXP5BIzwLZPm z+`PYVravQ1?OTtgrQKQQqsK8lgX$pn=)n&J3%IiHrs!w2&+OYfpNC8ObDi{RTMJKH zlJ1?;eY2GACD&^nV)SaV{1Hnpg)vHKyC`N=yTmEJliHUMHy&JBAn;=C_~kjA80TA& z0(;FezjGUPWu4m1eFWjxIA_4l>a+W`Pv)+?Pp)eL>09oqeY1K~vH6qed%S*}zP%ro zM{TnDZqK4UlSAa)R$jwX!yENFHk|kc1#|C^L1T_$lmo{0*F;~qt{4`)=bOFxc&x&_ zyjkuuUKVO)`Jp**K@~`&6bBJFh4QISh6JxW@q6;-s`~iyzg{j+ni`apN)Xw>w0R&_ zA>^YtU~2x~KO;})p9ME+D@GqE5U}`s;Owc@5LD)l$JdIq$#(-c7;Usvx4S*mtGd#H zRJ$upK#B97;5bnQHxs@i=bp|w>E8-7Xs(vgealVfN6%P@BB}S>o!x#PUe3N1D)%M} z0H1|pv1|H$ULS8=xA}4P@F;v_vjk_xqoP3$RBh~6|G1ut&hjWPR(nQkP9VgC{Mn!p zmM{n6r!7>EvKa?AK4ge>srgp7u%t&M6~1={pjjcLjC5m}-Aom|!JKehU=JPGm3h_2 zHdpd2FOG>~9=pG!nB7-$r)r|_XH2DZPY@Ql4+mJy42QOMiJAwpJP4$!kAJNezKT9b z-eaXO$f7yOGr|&Hlb6jko`;+X?JvRXuyg7N_D@FMja1!Nsx?`F&)5r9yqS3QVRt(o#6y-oL$p!?o7He1Ds?X;(pCv!}pqFhH^3wR94W`UMb9ZX%7(Nty zLiQlMuy9MaI7ftS41kMF+-k}jK#W=g%5znP#Q=;})BpMw2tm>=Jddq}&*YC>_F6@a zjle&59a^fR^5>z5i`V6$%J0>o+a{~NXRFgkrK^UUQs>o0t?Bk~ov!V7F4bz$ar!CN z$jv#!H1P3ZCIYllQk?#96zu5pEGRHqt&q_F8aLM`QD}U7>9$v6)wxB#wq))bv%CkiqexcC ztQ*`eh46hLXjlI$+*SR@KKdYLtJ{~cIg?-oZO`v`p??*shTi@4zKmH&^qZByfZiFR zyJ=ADR7?DzFw-M{UlK1Uu@ideBujpb|YxD-h3xJQNDawZ{ue}_d zr5}5alW`lWvK<8Z+t|NYao;v}QR-D0Xq|TWmPd_p!A){WSk-YMu&uK&Sg++da1DBF~?U+OCgcPkuO} z>enDsj!hyPm1<^%!71R439q1&O7)>tL9dNLF#q;7KTUE_X#y7CftX@pgzn36iyb%N z-&#)I5uut3L*$K>Ed%piH{S-E56>Fwd?1cq><(X)Tc&_hIi< zjRGgYBy_dEjTnSQ+%Y9y|G0=TXD-#$WF zy)(p7s{Y!h4B(gC5_+-d^6y}du#KX+=q71M?7*miA?mb#f*XU%LiE{i;LRcW2fUxE zkH5|#NK5AJr8j)m`s)Pc3^ajHftY9g7(!(3J(6y#@VqW-g*9=^dc@`X7Sd{5B^2GQ z0gF(cxqrW^+=Fj;dVVM6X7zY^y?RvdU-9G_3X&#r=kKfW!^BV=|0e!es@Kf<>Df4? zUQ}wQLZHlT-Z)h`PNi{e{A)BZk)A3v$W%^8O{RUVXI8J-8Y%1vdhznM`^SiBxGTD! ztelFB1}^qNHcX1QIZ&ms{&4MP5h7OyTz3e~G(v@_7J3WVnq$*;dVD>+yIo46rVpLt zOAPY&y_L+k78yhg`etA158c1aN_f9kWGAhWjG~BNf6=P+(_c?nL&uZ*b<_XmFNe(W zVt6)P2t3wiJ`x;jHkFszuQrzx?^p@VjxcUE)kl|X3EgZC@Jx-lU02RtR8}=%>rz=K zNt^j7k&Bv0^+^deE$?z5F4n$oT%>xeb=$5!J2pl3yrGwd5wGOQ$V<%ka_XuA^9&<0 zQVG*YW!9|{! z6Bh?h9g=SFl%s3F!|>0k|J$4wi!kdy$iSX=vY9jC2UJFoeu})*nSdaox|?Z z-etxbb&__Ju7JW<{<7Xp;>K8IgIF@U!A|B*+R%yMxKBgv1s@~~4er!xzTP_Y(Y49w z?mN-8>JlY5-<~*{M_>^3=0mxbWIXDacJy7Cw%_Ex(6Fs-s1JL0zp1Zxn7k+qkJMNm zkz_4HwGVd%^j*qfab4R>*v&xBt80LCkh>Z%JaTE^(TADg9T!RWw$vd!a;Z(=WiUD8 z$n!lr(4n>C*7~N1Q?sd0AR~l?=O4jNo9n8BfHe!g#J+S)C3DrdG>m%eoqgDCp31^D z(?&@$E(@v(Rq#?S_4g+IQJq;+Z%lMVWtvokvC+H~a*pfU=vZKUml_ieT)dF29&eRi zEVo8;o;Hm>aIlG@w8QU0nSL_SP(r_a+$hXM|L!u&$Y%s?&|AK2a#KaG^72@7vlq8M zEHt>?IClOrLfp1~CMe&etvsZ z@uIsKnQ8%Zp9^Kyt5cCsXAK!_{FwOpG(3AEh&GUqvyNXaj){r13H)&N+^viN0eJ+I z;M`?DL}Zq)9GardO`+`L=i&FDiPMju?%Ytx8w@eO;I2wS&NW>`Kv3c^U^Q_!82Cbd zYK13k{ZPUK|5*;E{JF144L)5@xoL1NcG@mq4R^PzSCkzh~%cX`4F+m;9P-QvM#=% z9V@E0;gW6;l02ccebp|H@ON5mb+Ijl$SbpdILq4lou*--`s01>u3Ln@?n-%GAr{}k z@>p8ecyo>|;pC~4uM)u{jraO;@==OpN~2{`9c|X3cWm2Wn{+JOrnU-*chx^=yEu>GNU zRfe-Kr3Af*IY2JIP1|As@p*NBPujDrpA6p(3xA4#Yw9FUV8S|~OWw+ML=9>p*ZfgQ z*)Ws_wumn7y7$Ou99ObB&V%1>)_Z|^AFPMva< z{1CI29dWDVWA8T*R(_M0`DKCmE z4B)@f@X6)fii@_ly`@DCcHY``rv%m8I4zL0j+pa&zuQPHY=YqfQO~EPI)&wC<*3A9 z*~UkA>dI~dHFIg?=|@~JpoI6t%H(qZLNveC{-rhL>Tir@T7@S*8i3jLo@&MEA3@&~ zFu(@`{7Q@q>)Xd09G{}^J|4Ef)n_Mb@xCwH;Ztv^GglUB{L66tz@5~7ZnFd!aB&Qw za#?Ws7Sx?l6_Y7d<-W^$<)=`DrHndF%{sTe&!QX}2&m-Y;EMAVs}8IaSP9cK@E^6Z+G++i|(Qm7!?t8+iV=I*qfO`uQRWN zAHWGmtnkQvsL@r&4l68-G?5h!#wy8QN~KRYCQF^#CTMx`k}%`MUoI72EcJ-${BByK z07BPy>jsZ0@)}%uYXAVcTMSOgPLItTwfQ_i*z=CpcPUq4AgeaaOc_xJ4TfJF&R#VU zH$%0TcuKFkp%Xvtjc` zOj$XY|3|xpEdOw6J}74wCsRXPD38q*?TNUjR>a=FlutmiP3_1SPlN(C{p{S%&`xKT zlD+HTpGj-*ZA8&pohw#b_4mepu_S1k)hAV4yPUA2hMo^8&?MShbtdAf6amaHKCwLyQ(zyG5Fw069}*b;DByOFSQI9uGY5BS`LWKBJ#9c0FY?nDzG+zJxn&JI zb2y{kpV!AvK}hstqF|7Rm$#G-7?gxI%y6*9ifWKH%CGImXXr(e-;eE7Dm{PPj3+tx z-zue+nD9@1FjJT%xwOyxaDRCIYIDQVpRYGv_fPE{?2OeYIX}P&91SL3zH@X9>Kz7i z;2xA|tMpK!5Q(i6zMiT=B+bM}6_Nk&1&G{3GWA5oV5qYDS+qo!cr2{cdZeEww=`GX zTb)3qDTUhf@@S3!yTUZf_no1}5wTxnes+Z0Y{dZN=pZ$1I;6xuJIs?(Y42UpKn9%6 zB_Th!+rK?_BWBbfTAxYZ-gxWD@f5{;73)}*3pGPIKI8JKMn<9eB2#)6lZT4wai-1f zPH=Q^Yyl8T=dFf9F{U);ycEUo8#DH>GS=?0rBR-GZ8W(5FMgyY3-l}CD_Q#ivcGA z;2WMo;6pk+bCQB!L`PJ`e(Tp+o6>GM4344}FUdAm&=@c1Vtp!>QRBp6v$LY*mcjsG zFT&>_0@~pXjUlEi&yJDs08N2s;en+o6L)KLTJBRCs{l-&)fzEK(*i?OytpGJcSs}}>$fyt&HRiBAGITHunF)@R(S2H~**Wgw>QRw53kx_zM7fRnJ^Uc>6 zB5HK8SD~1!M#TNn@4Za zF83z>Ec}s%^Igwl4Ac4=N}xOspmz_bwe#(lHsN=#`F0yGjH_S`(~iU5$DGzKRa z=2Y=dqT07jDs=dFg#=1y-;9|G+w|3VAnGy4Uf!cjDk)cVx~pVfDdlI8jK_aZM`}#1 zq#|f-!W9z*PdhsKL>~=Gj}MTOLrtNo0Scg61pfU@gUN}?Z3&15D)8^+Cx_X57^R^= z9xR4cktD6Rqdf4*A+^-7k;^lPR1zaC-F1+GkzP!3U;~CwX$dj>Nvu`2X9dk$B@d_u z6)DjUP9cFv`epSvfXbGw!DgW69$k;Q5P9jhGKFX|TA-NfYQ;=YHaMtnMS^nWG#m(o zCmnoW{OIs7`u229@}TeMVWX^%U2F-`QTIt`;Wn1%X-~4dsIlwVy3{S{W;M->9HTQc zsb!RqA)DjUJ+8&e6C~h|ytwIKvS1c@Vyam^OL*k5tIl=ZhzwqqrB=vfQ z6zM+#5ArV&&7frk@_uR`{hcs#70f+MRyE@@;%BHD4XZ!?P`e=v<2GcnNy?;w?6hMJZj%$2u;%ncwhE!MMIFAyqB`%Btj6 zeogX+zZ#4-qtQVOHpQt1EK}7nnzgQcORp5?r0kTj00orFX7LTyP?nXs?0h`-g(rEN zXm@H+GCN9ooX?IeTGvH<*)SV&YeF8{@>*F2*Lyv2O0Sq<#7j_ol+hdN8RDQdjDSm$ zi_~{W@h}`zi55OPE-I)Q)Y^^|&2}To&zs|2i_Tl)PA*hsJ3o=9L?^m;U*%(0u!s8N zX54=x-cqOF9&+4@@AE_0y(j;-&xM>Zou#18hSY)s-Q z=>;wtj%KMqh>MU*ssk;T&IoxK;9Y$dQDsw>343>YN!NC-+l$gx;x8HxSq+`&>bk{V zl`yb`AQ6OxNHWhSdR7c%ZiE6`XF!C?=b04BR@i?_7u zt}wzy+^Y}BV1;)t8f439Of<7@YMhgH&JvW=&yx%O(qK<=GnD2rbBZP5$_mAzvweP& z3I1h$t)sIBE}6;UjZEy8qFt5o>>7KG_9_pFw8RhT%qC>%N+wKQ(RPaQ1@fJ{HDT>U z8%r}$raM()juF1>=aw!cL`$g9M;KG@xT25jLT`XmZJvw~022SOn}`fFq^A_ajj z`INi5{)TSJ&c~6!unD43Gl4!fXWB?)G}8av2#UxV9Pg$9lFOgZZB->s6FdN?$AJF zk}mN3^oMWr{W5suIo$sXzYY2t^}myK|HGhVX3qaA>uR(m(tNSo2O-U0>tov z*1?>dAM6C-n2XZr?+1F1Z^KPg6Gfw}o}XawPM@2HOEjj`vCTi6laeETkB^s+Z8Cf_ z_~V46#Cm|xJaL#bOnSSUWRA!5Q{fwDZ=c3o$fBKjC%l7#SiFu{%$|N>(g20<6 zY>CUS_~oTI*SG%L=PoO}=k6C`rp1eS8 z83A_HtRZfhG}n#jo2t$wUnKK7wvlOOlZ!{8g373t5P5EFRt2zQJS9;j7ecM@I&JWI z{5x2aZN+JAZlMgDRwk;oU7TE_=!Z{$RljFZYT0K(cV{hO%&HO6(b_Chc_g0FkZ>ML znl>18>ycA)P@dASnBXq}nWCE#Gywt!gzhNfv3VQUgm1}Q2`Eion zAqhO1M+lK8#s+A>8|?BqW-UCThN&^ZqciE3TE|8m8G&VB-U6Z$Fb$lpPYii3L?r* zG)$=L%3^Jwx>Fbt&>*@8YhxM%;m`m&6iAvWVK^3bg{n^$ntqK)$?d^q)0mcGkOn)u z+mU5umnvcIj4P3XfXo(Aaug99iqN6mJX*^K3{POxm9h<=y5?Nkw>r z8-|O>r!0{i*OjRCh64x=h}3q22~pZYMJc!-ETM?HEWA0q!&_+IjuV}2??@DSz=6Ge*oB%0nqk{m*uvXdu9w31f;Fk`AWP0X* z7CEUkdLeOyR1JVgPaUEsmQHEXF8)*nu;LzK1_$kU`k*bNyU>oawFeti)t8I03`gP; zJT|2##|+#le9B}?qKJS#>U+Wj#osL@7Nqd^i1DIR|$Z;v_mA_jNy z45I zuePgq<9CiH8gU8r4RQ~ZZ&3orS^**It^-VzDbZNhwZseS@`~%mBnaBF-q(lBB7hWx z8w0{8X!WQgtDsi+nA`j*$=)&2oBuUCC6|th4UW8OlxprkBSk}L)}%PIg>gmM^bdp3 zA}S)X@OPXBESwtll?D?dMap?0a?u*JBO-efBfk?l8#`Yi6qHdCV z3QMI}el38iI%)hMj&N&Ha0h&K~N?NX1Ut+|q;|n5Ad+ z%u(*RYNn@R8>3hjlxoY+MVn;Du4o9Sw8lG#>}_zMUYi0<9Q0;bFBY-S`bdW1t{bCa zX8t|v4qMcsEP*i`2sH%lY0A2vh&ZqDz|W%+JBYdlRJEXzl7o)fn}orjvnbU(kDQ-l zZfF45300Nsi@U!wz+FqY_RI1Ej1jNSwmv;&?XdNg%39{V zp(S`M5~)IA&YJAYgU6=db*`uHk~k~aAS%^HU%0he@HH#Dntc!Dj569zixU3h&=!r! z#NE>qfIB!RMle^+H>$0%R{*^i@w)qW2}3sDA!e&?wCauF>SMsD;a2|^TA7t3K^-mt zIs_vLCRPn8rKyOwT?rTJ`9WAM;7u&jeH2kcER}77_i=IUWBKv=fYfOcQ!~TK*_M&U z3+J*oqXYnCkP9@jU+g&h#`w@M{?_5VI$GjT@eJKzSTi1!^0=h8Ma`Ttm0=Z*VL;Eo@V8VrVbDm5^cF7km;n_b5j`8oGRgDWqe_; zZ@ALvIPfMcY@>-+`x~X@c(#f@sdSA)diGnZMCh`n73M%xK_#T|WKZP#5}k}UV4Lk9 zH*5;DII|?v6gF`TiDv$IlyLA(Pab6;RGW%na!#6+GuF(bCI|%AD6`u7y0Eq7k>;~s zwMP+Uo_;s{us%SpdD|>ZkCUCdC`t$ z_1&%qwX{)S)Jmk<*O`ozPXh#rP7Cr=(X*Xc#IQbLk75m!r56C~9o7tHpKBN6k6EAJsPuM$Bs)4;JV8FY1~4a<`|q z^kY_(oVo_vvGW_RY+Zo=T&fR{JiNAtTu(N8%zwFs^MKeBA8Sqr`OhmXesZ&3Ji7W& z#6%?m6ZnE;>77*^S2Z!2vqJKtfSnLk&b98i^nc{it^TajB`BAtFxJn4NLZ4-mwM;rJ)unc4`#ZxU0aed_5wza7j` zMJrZzegPn3TE(E-w0b`($NfKijgX&z8z$~1EX1p`d;K2a{qFnxZEN{`<@|r5voJ{G zxY&GamqICt$}=&@WggF+f5yN|Wb{Fw)d}l(bU0uAmHk=O(QY=@R71zuemoC?KDn(Z znSX%Mu^P7-Seyz9ekCU}VAtk_LeM7nb{>{G;0|8I448V4ti5kP&8YL1bL`b8-@Ly6 z{?#X+s7a5$Lz0*(lFllzA6R4>D(gK@5;tla`R!eNo;4!p_rH;9(eclZa8Q%|tx#eO z`S_Q=T*0cScKqot@1O7IE5z=nG|Z`;l8jDq_DlpT3v{0pFa0X7@kKV-CBb|~zf0$^ zpkCUrE;OY#;*1tsWOEN(X@M>yVk$zYbOXMkd43ORk6dK=R{s4jFz)YVR$1}Z*bGuo zY;mfCZhm|3J8d0}d@g8cL-XWv;BQjRPuz!Gc?^GRZObJMY8V)dlj1l>CA^7b3gqW~ zR={JkooTCQRI6WWs+Dg0EbrW(0i~LBFYfseYV~J)&?$?=I6yzME_Z9Mv8d+1RnS72 z)@wP)bTa2$?oFCql8-ZXXZ*%`m-on8J)9fb%NC5l>9CdEp-s7jNCHce!6Kw&;^|#+ zeuk~y;RU=P+DhmS+ zNic#Z>Zm6F^l*?vm!Og%&4{tP!>Sil)&lz>>iYYCg6{kv&POAbkc8AlGY(Ti0#x%1 zAhd?k$yVQA=k{@>R!4i2Ln0&6^;Q{7C;P3E%In^aWUjAU75e5-)nry1q0kh-C~@(2 zxgDyw?k&up_vGE#yb7si}W+kR~7yyQ& zfF}Y_L=qE&P}2@6wzd(or$ie|r4~rF3As>&Fm%s6kNvITQo#8|26$1>0f`oO<}b=n zPV$F(1ni*Z0B<2vQ4|6Kg^WB4#MAqODX)1(k;D##76a0+d+h;AL_J^;$MFfokJ^JuW2+yQ^~~~bs(N&O)yiL(a>NVr@Y`i5o-&G%g+v^DghV2$OxmEr zHX2%v4zBij98|@w&7>*ZnX^@Y5 zmP)6)Qv#22^KHykK_~sGuq%KP*eG84;BZ`2rs#}hS7SXeT~HZ=a+tuH@OW}~YYiNA zLq{qOVL}6vP9tM);>xG^Dw9VS`+mWs9Vo4)`=R(f1TL^xUZM!7toR43E#Bnz_6e*Z z#974IZ4=Cc5-`=b!Q`v5G}{nzvc*QFR>dHTlG$`ykRy>tVZNqbTqIp!8uu9nb(s!zHK&b+B-yVJbS=QWnHvvo=bqF|7 ztTlNvjmp~AoB*P9|IdE#pg6oV0|kKGs)oKv*?a*dm}mxy>I9-_*@w-j6=9QL8m3;| zhi&LYQ9{=mDw!Umrb!ks@(TKfX2SkUEfk=_Gss(n?-Hlrzmf01WNWmRSMvjIh3==X zJ1@r;Yt(&?p>Z_?*lgnEkPqq~id5!BdbdS}j9o*~0wn0yO)pO~YI-ha=nr`_jG`L~ z@pT@G?*^#75{w=(R&$%5W_8sorBMh@u`pML$4Y(>t`QA}W{^D*hu5$v>r3`~`j}>g zcIhMQGa>l%(gTrJ&(-WNTBNMQny~CRQ$@kR#5P8FStYJ#{Sp2GAXOk+3ZyO{=Usha zOo7hl({N?47O$tq*)xCRdjX1f>U2sQ?Ujs}Y3#InAezm%%m;B$n0xOe!?UmB*Ku&d z5=ZM|*Lp+~tJybk)Wfk)Bh{Riw4v7MRi+O$vYDK&pv>;--EyHV@?tT2ZW+w ze0Y7qZ!muMOUmIkN~1cN|7H6tV8X_d7kwoA=RiYbKEeSES8md{)ftZzmfo1Y1nvZK z$U}KNEzh+D%ma_K>36|s7Ck)qOM0gjjVDQ1AhAtnC~R~<0;v8sLm*vuyz-v0WEL$9 zQqC#5Jfz52P_5VBt>OlxsWa+|%T zdiauNk~+C$p3=I?JmBe%#8*9ko4#xk#;O&q(9+Tdh8T;&g3?X3cPg=_?HF8=1G?^a zRS3Pv#eiG?ZkXMc*dkZcu~um9ln?3r8SDnFCDV0OhGmAgUozNV$l|uU%sBHvZ#^#$ zy6It*cK}Q;)mr)M?2(n}nnu|8e_^~hQONOeTtjFr1dHSh9BQu5CAI~q_(MKc$tCg6 zrF)8jqTD`Wh+r!pE((9S6g@rCkf==~Pk@vTAI^>eMNDBBKYkxU3Ll6iL*)q4#QFC@ z3e$oxEcIwjt*IhghL9ts;yD5}N?)xgv1e{)wC0CC?t+(CKbJ4QeP5SU3xcxa;USJ& zvA`|gnop357Tr<;W^pWKB_cz1uj`&Gz5#if3hCJmR#kHf6Ax=Bu=t+WpBFbGgU^_@ zDFw^}^eCa>Ip@|P+>)DbDUs0AeOn~91t%ZQ@^@f5m7*+;diEg1s!h(?t@n0b^e=T_ z%7&TETy}Z+vC<7bF6;g^RnOLEs{VHh@_#tmXJ`Je9`Jug`$udDJ^zUfR%@pZI1mmn z3D_n(*G>rDNpg~e%ar!x-;SbDN+I1^LIwejr_n5o8d0xfd%1fR06+X$5Nr~p=Emag z{ym}damwdc8^hlXyY){3CM_aOgR`GR!Mf*KW5o0_t0GHFlo#f zp>`q1#Y`y53y(P^WW8L%JqMD2JNRX%h(TzZ7D84lN*uR$2-z89(d-S#r3G$Cv%Z&9 zBhO!xV^p!Q$1_@lsoW)eqfx!{YO@MC{e=%j^cRK zAKg$kVki(Rv)K|AYAb+OznqKs^v~dVs&sMUM=C?#D^Gs)m$jOz&;0S0)ncSGolzG) z2trC<{@5qlwDP%HoftjNoC#)n>eGzvGZnu@yC;xuYlsD8useh`4$TGXR=(3DbV7(B25Xep2x`FasO`9E4sCtw2q0Nk<$(Iobqqb?I4x}dYP zWBX={fs#Lz7e+0bD!HPyEqK!`7-dmd`Pen|>jF#tmx60mi$c9+&n(v_bC7^{gXf9p zP1Y%R^1idR%Y6WjiHn)P%v}}3>w{zCEPVR1NS>Hwu~YqnU$V$btl9v!z?eHr$GZL=dAvvk~2s zlQYA^aXh1{0lj@ZvGDkWEOso>`PR)+v`e}rx@j|UG2Q_)w$M(<5QXoOz3t3clihq= z?C=kZgpY05XsD~Fpon1}`$kIXusKEu9LBujGHQ}t%F*n#Z6r*%0O$KaM z54p(%-AtBGUR{ksokC%1f;dG?w|(zAH;{|;y7AvgBg4MSzf@Bs(4%28 z_c3e`bWD^aP^Jn>VP&wY$vi^1)+(!yL0Z%A4NI)I;7{sWFbvHp{5s;Z z4~VKN-&SN(+}89P;||O30XKK(6LhHry~n4O#yzO8qOoD(QMn$((!GehbWL-R9GdG4 zlnXBr8wtiTC+bbG2a&X>pJVw{ zm!*p<_RmRA9vqEXWx|E^U%!D{;qX3ILWxU1c%nJs!-uvGg8Bw^VkBw--r?!pOss^% z1jl^iM|~&6d+)j}=p1{o6*@^;!>q^fORgJqZ4?>ED``QgNwR z8lIH3RPh!x!x%keGUq*v`NMTYQ`ZILc%rVl%eHsvRm?lON@0(l9U06(SGg(>H6`r{ zyylalBD_oRUS7J44Sb3xxTKB*jsTAo&i&wu94^%he-8{MwGzlPH2zVGzaGnr zS7k3$*!?ezQCd7AYSYTBPDd@)qYkF=gwQS%2r5bVxrgdlrhOE8q{kJRO1_geZmUKJ z97X#)WJ|iC^)~%hNOXnFCW~#!_=I-FNk5rW5ENVdU!&91+zD9E2{cvQ)v|w|o86<- zJcL_L(CCmEjG*xl^VGuXO=rza3sy(v$EHKY9w)rgLf{8neS?SkkYxMGd_6{%MD3yY z&i2A%K`@-!*C2>CF8Ax-F17%Ks%r117N`WPYJEqb^m4prb#5{P22 z+|gudgBdr(T+RviY?7GfGuxTax>K97~Lw~#RUNB>~ z7EM|6R`?LG*RctOm23f_-ufbkkQ_xYpk$`fcw+*dU30P$7iOF|R3uw4gtoB5_zbXT zllp{klYOcH_QNhg?_`aVJmzdi)Wt}On*r(D%1qTG@x6NXz^YY5u-jC#AjRiYgetMkzb4Z&P-$7GhviY__9;ijk&c~2Bb&^hW^&Q^(zbyjdLmjg zNv{BNe2q7tGu+Kxp!)a*Ve0zA;ny#=EgRnlF0#~G)l@ZC6XR6mVKFuFGmEM+GOG|e zpr>?yg(H)$hbK6lw~P`TjkJ+O6Y=?#xQ6P0VUT_Y7%B`K^*H!_zJl2O2Iu(M z*7$w!{eH_F0Vunl7<}}@p<{%mECERSD-S-u+U%8rdaNSVZELA?QU`C5>XuLk?cdtt z4qBu2>7}T@NOMCV_3sJ@kHZQQ;bHHMNdln%nTG$1v3F{(EnwF)gB9DhZQHhO+qP}n zwr$(CR_v@eov*68yQ+I1?4$7m=D4o;jz@PGD$#f6NtYAGAYKdrDX)^1Ppr?-CM3&Q zUe%u#-JkETxgZ7D=RyTw3r|N0MMEg@CFnZCC6c&5Z6JJj=bmBf6L@`imMOJ;u!3G} zus^h#Il;qwebA$t44gTB{{yc4*otN_^*cSw!uNynYxTs2y7>aqU`tnfbuPiy>o`+w z2Vb`!F8xhZOjdNr+#E9#QK6(c?leZ(AfgJ7$w5J_3D*pQAhnl4MNq>PwN-62|0P9$ z{D%|)Xb^p%H0S18dV}RP1}p0AGwi`B?l@>8n}=a@+FE+a1F>ddE6kRl#553tBGbd; z+0THgG3^cuw=j`dvGy;?qK!2!7ug2I1!XT1%KtDU&iLYv#w$&lH@TZ?ot`!$neEDI z@RsTg`!a4=V}dP-y@ALR9Ym6<+`7YJLXGYFq6t>pJ5#0!h{+Jw@lIHsgJ41wQhR&jm9?D4i3wO&4kwSI>)sPo@X$mBC$U z`9s!$J-YFnoIG(SRB-|ag(rzJO%n2f#=uOA#cy#4zg#rwS=4pwJQ{UsLm~^)B1BBjceRZ3M$!^a4in1h<@T9R4n`zyO z0~5OT04r6232cmy^m7-c3Y%&B+)8Tx78Hmty{t6&0mkNPWW%oDqo45Rx9RZKZ_bWh zkzkiH+QPJ6Qrx?o>@y_28~TzW8RTRncm}VZx|=93fn7vvWN9|v`!vBDCK@X$Vb1ws zf~y-ApR9(EuwRHgK`Od+GvxMk2^e{-?}UxAesOCB*=~5Tb3A1x+I#3MoE-)ixbeZE zBqXJ>MTe!UXWnACTsk6q7~0@>cYgmPhaIdk8G$K6V!#89q3CXDHEgXZ z+a|0own(1Fsz~c2nOzbD_>biox11X7z8C}IBuFfiWft#CtlF^6-2!`hkC@Qp07{~m z&U}3$m+S`CfEe6#-E!#@Wwct=BhvUE>fV$^?Dh^u=FX+zohd}P@Y*xXxv89KpIV3P z2AyO<6n4dcPjY19fngrKHSXxjV21iREMv>lLj26r%x$^b_T-_1=vrQrf8LT1T#R{? z%{Lb&qyw6QCOL{RC=-n93F4$3qWdh+pl;?Zsg!ljP=y(So#)sqRKRrv2{h4ElYNZG zabFaF?3bu*RsS_6opBGYaa$H%;t^2vRvPmpv|=f0;kuem3?_moc@;#OD*5+CFHh4D z+WD{4r=p$xaoClx~ zN$I0B(ci{at^U{}5qd{FCnRMVhZB-iu)8rHd-oaYvGeT;Q#8?YDgjQKuSp4I=n_dM ztWE@=-#lj!0>>hqI4Xh-_TyX1X-#raw4tG>L61WK-JF_kXudwQ_`!F#>TU# znOw8~p1I|59L|j_6>EYRh%fA8R#({m7+2ZEsUI)7^YgH zwzkKemQAi_7@tbD$^oGJ_ox``oE42(Td zW?ms2bn0_ARXt?rc&u|HbsK^`wjo6tJ8j$ACkILOf@}-A>MDi_R=9RQJbLx3qj>Z~ zfG2Rv(dfP7sV^eNiQ+r2l6{f(V<_?{YaU5#p%E8+ykchaGHy!I&3nmyWuBGXp?23T zxO@w!Nfa)5m#2bW?{5q3_^s`HPhE3+QFraF9nND9;MB&5faEn>KoVZoYorb_WXgr5 z_a(6Qe%YCtEb>Gw;k+!YyV(j%ueuYKJ~vnH2&_OecVk6vGbNuS>c`GIn3S2tQrMLy zS{M0b`|G#zc&Em@1)P%R=-k^{FX32ga{nO2UYxNdw~u#!te|2~xZqCL7#OwmpqEqx zt~g1w>KRjyf|P>E2Gq!<86pp29Ab~y!?mfWc5j{dQ+`#c_xJXsT^5;rIy*NON~;VH zNgVPUH=UZ9S&UxXdGNJmG3o8aW*bv%ENscVXj%T^eWWU#9pf45Szazv{Z)3r5p+G5 zVKRIq*ztU61hLu=zzcVs01wBjDf{sCeN#^10B!ulF|1}QX{xIXdYv_?Waa`l4W%$g z8cUUI)~v6xI?LmMW6BYJT}5Bx2Uv!)QtOU2753|cwogw(8)g6GT*DQ0BA=oaPqug& z@nVP2S4^zZk(iAvTWZ7lLyx`oJn|tXNO)N!F`v4|eBdm$f(U*d=JZ&MJCMM*a5qo> z!fwY>e%qE}cREs*ZyJvpF=eAO2%9YXUI7#zBJ_*w6Yut-=gtdwe_#Li%O&0wymcYc z0RD^`#&5P2TUf*~;)olm08>mVCDqKYseWmR9g>TnB7+&+?639b&Xr5smr~eNadCYA z&t}0k=W9^d&HLl+H?Zd!*!lned}O8n?-|Z)EdReI&~ZCL&&RJ^D8bZ@M1DNr&*N`r z^l#>l0Br(o&fxTLk1Z`6zk)<*MF*7I+?Xl}v10v5B%bAqbAWh>FTFdnJBo1l{9X$4 zmBQz{rQ`d2>uIcS9ilj#aq!6|gH}Hz)fb4Qzv6uB5f4u>u*))|c2irWmolYy%K2Gs zyzjuF#e+ThKY7u2lAu3%xZxgz`@`H6rxE8y#QfuH+(KsWAlh%X}e&>$>3z8|;r$ch9Lqht}wuO>PaGfeqSnD{bFXJ1L%XU-qX*SL~JzCW+! zE1kbw5II4)zQRf_LZtirGNPRZL1X%Uc)omoE9Q~*pKn`oLvwo%oA}i%Ux#S(g#Ndw zWeN8nS|wZv-kEhNcdW_<f5ZYBD$TLCL zGm?$Qdv~;mXTX=B!3?ElIAX5qaX~$0Al9DSq`bh&oChz}d1j3nUBy-ewj>-`+rq5( z0M=KsJ9m?co08Eo&e*ZWe>e6LyTolKT*gfni$bq>>8dZMP1Lb?Uvwp`=r&}g#EIc_ zE-vS#wlHn)4AV*I9EmV19VH5SU$HwbAvE{kQP#zc7kiKPo(WPc7C45s+tg`!?-LInA*sOj+{zo`efEM?FQ3vf~*Uw$_;lqK({c{ zZ#qYAJcc-GY&qY zZr~3`8Hw=PL9;Uq5D*ayU5)GW(apJMmo7f)(t?`YxtVB*L9fI^Fh7vUSX~k%VbYp2 z(qNC*Uyj!SNLZYpNvL39>pwt9aj4$LD+)cd=J1vOrimT-ha4N%j!4sh?lbaQ?vp1T zlANA%5QiqNaGo^Y7k-EJ(6BpOG)0HkQ|+)%x8^aJ6p|f9OSD!2ya!Gin-2@><3$k3 zO=15MLQm8bxYSF+;*k{Q<}>y_Awt1UI2BQzT+YPa|<%grj|<6pcELHWPs^JXC1UosGs|rA}|6J;W-RIt`*zk zl<-Omgue+41)KPrQhW+4k2^DEF!IK`cFJV{ zrF)2R)kwh~!Krhr`YCHwl2tp_Sqlu35VE5m4b4J$RtB}e9tF;em#2y!JCVJYY{vDL zN@n|bjX-=gd9@aK7;Tf@%4~@4c?88_$#|S-ZWGE8+XK?pc#8D;ogZ1~?iKB7I*MGy zX%BJ|s(F#YWM2d*1krwAB7}ge{x}1V5q#R=KrNc_+z1Q2mg4V;{-h%>Rsy+EJ}-oW z$+?jtj~ncI@3xUDPKUC%8Q_Jj3CM$h1O1csycTpqg9ai9!ll#vBB+&~jmWsutl8dt zXZP5gZRt^t9vop=cLw#b~9AU%gprU2{qLsJlqUVXkpPpkiuQUU!$6HE3CKy=Hc$FS+kmz)l|bIYEA2- z=?+J}TKhAR$as(ZOJJOM&F^byZFq!%<^Kd&FG*^PMy16?EMcAi>VtCHqKm-1!jRqumlW3II83!rIv8xm6srpEkq zPMZlxR~RX#)6B&-oXD9Y#QM7&Ig;Lqf(@7aEdc(D)f_K+$yIsQ>z2d5056}7nK%zXd{dhrg1oJ7>p!&KVtrQ~%+s!(+2IZe` zmLoM`!_)ipuJI7`ibF0>r{^AY?gxNprBM@FMj~`Fq9hlqTlAX7WG-ueWdm`*&Dwnd z8uV!aK1JTnJ1;I~gxWSi751fU%GA687-$i$rY^G#g?Zg)|MnYCDafljip=-1DeR{F zTH2{wc02@!X^xR)E|vv(7xXy~TUfH>73mbaZHi+VV>Eh6H4iehi7@AE16EXJOx@05 z*$uYS;uLmS`YVWYs>&p;eJM4X21H&J;+oOUY|U-KwJ-Yaw`p7tuk+;D-GXIY@lGTq ze8h_G5n25Dfvjf)q9$i0ic3|WW=)7sjiNP?3nn|Mt=zpew>!1H^bKr)9f<6D(733& z38o;dor9(>5s4^Kb3n?B`(DRoW5QYLu(A+(9ahMF_@HVai50*jI(AGZOnMmn=dW{f zGHwO}s&DRmQ-=nQc(YT2ip5A{^NjLv5ZP#Q5Z#?~7dlb6L(d_R*a9b{4 zvf;ISAUC_1A#3iJPD((_d1+WLV}3!BjM-(OeZFtn?=wi;-fkZ^tT+GsN)XaNH)|F@ zg-_|@Xa1JIF~Ir)fND$sVyX^xGhhQXisRGcaO(TjsNVwF%P%Pc$rE?p_1SMqSly| zO|rM;h~Zm^d|PY8m561?E|-(H2OwM=DBC(H=4=A&%Lufw!N~3JpSY8lZxh~YJ-ve1 z$-mt^w|_r&Zj1tYdE5Vaj=ieTthp%$FovX3Vay!^>(%Fc32qkbDPTRaQFD!qA za&ZE8a(I4Q($&(b%so5xx%~tqGT-E7&&@RlGz!8$cJYm^YfNtb0adE~hbc_&eDz}+ z8v1mg=b+u4NQeT$Ggw#<)OVt;BQeb6BQF1_}=Ngz9Rv7_y2Bpp6T+I@_snw@I~SQOXplV`>C6qk;nm6W%A>snrE;x$D zxV80oQfT`vPx(vCEpO%?ZPvdC^E_Nr3e>Fm`Fz_jP7>)cJNn0xp%o&U0pKw8Mk=Ls zBWq+zt<+zsZ8r0zx+!5r2DSa5L&;#zn$DZ zXlh{$b7Ay8fi&Iit=||I?ds7wQFaf!Yl5?Q7(^&iVk?9^RW(Y)<1Z66jN_W|WnNU( zmkSxOq?H4xEQAxer?qR0Pp+bxptwEUoPh_?hvIU@K*iv4dXIpZdU=mHc;IvFz2rD{#zMLr2U#JenB;Y8!+o`{p>v)WQ# z?ag|KA)=Q7AzNUZilw3Iy6aboB*|&i7+I5}&SVCp2fO3TMG%13;BDk=T66a*G|0~( zq`Q-z9te7Rmoto1^83N@Be&JOdGx#lOtRTjr_>5C)$&f{nys(~#ale~gXYiOj!B5s zQz`@)`n?Ycf@CbBUV^mAM>C`}y~92FBUl*Vn)dLFx94XVG!b3(wQ5LZJo3z(J=A^T z`q5NbLdLDup;ThG7W3Zr2&z~z>fNmVSK`Ui;RfR-%F*Dr!u#;MS(v}M#?i+TB>@q- zaX7WBY2T&OlQm1h#GZr60W6+S9$#(Xr_Z$wFOnfkPC0BIgHx3fFSFF| zr{@w9#>5voWV#&*v8%aJ=}rvRMW$`hmBsqPb9a@T`j&~pFBg+F{w-z>GR&&vNz-x& zkv+C6OUQJeE0im-FxATOg2;$qa4TLw&leqfg(s8q^}L80)AS4pzcD8(O}^x_-oHSb zwhEP=H|Ciq-YDK#-zccCHN^!~3va01hgUJ}oZLK!I!!}{>R5LPDxhG8)uLlHfrA0~ z$iWk{f|kE6EYDTDI78GR+~t1)P%tq=g~x*ifq!=y+D!;9L9!9TB}ZV`Ijp4kyvC>^ zp#|}^LvYoYq!ff~dACZX!Qs>MSV(%Op<6MI7qk5FulQKUJH!?x0kL}YPzc0z3o1e$ zM#cnv*#L)Fzqw-%6WED}LpwuA)WC2O#N($5KtTy$(4v4cN^{Fop^uM*6&I}U*g%~O z;+~piB262)>OCMp4L0Dx`n9o(AR{)M98+epP%QTshPo~pC=nI{Y4r2E?tOy!APk5e zg4l4{Vb<49Yq?X8I3IZd-_)^HEQWX}&T!g%a1>sBFjop8b;OCQso&#qZWa$`Gd)?N z|1Ds|cRdE%o!{0+p~SM@vQfRN59#{s%d4Fx%HH$U<6E2;W?Yr-FN9oJDREC(k2yA6 zabK#s_cZ#kl~VFRZATbcVsK_aRALaUpBqrRBQzRb{VNHw4*1a#Ew4u0b>+@ah|xkA z5d7z->BE)&(oPN!`RF2@T;jhW+nzrh)`W`6_R}hTS)r}up-tAV&{*Nr_-1~_E0>or z$gwrPggda8Y4+qY$cFmp*Hl1PN-ycF%xrgm+z9uc`_a4Pp^Jv~h+X25tW#4~>pO~< z(({haG2*!og$TXeKIcPGKLh8Fty9&|hGDkg$~H6sf?(6MGG(3V(jr=5IN5)%f8-H*4bA&WI5U1rc||QiYrS z?{q8a^WYF{&Oa|rCNGW4-T#O7n4G8^7RD(WNp`?voS_NaHZH=7w)Oed!W3SUV6fz5 zh6#X2sRk=#sJgaAUZHBP5tKGE#M`T*7c{j#g^G@~-n$91F@!KEf5#2=nb-S!9e~C* z9Gn$ehzBZRRiMLHY7<`i1-eh67^IpBJ`{d!gqmw;ama8q?w@lR&^4NXYx!BAbP-3r$?sL;z5H1#;zX4@#Pj4Z%x-- z2)xtV1e`n%Rad_&XAR7${IhJ0?UWWPG-=nZ%gmG3mp^(n_&$*&vP_Pt=_PCQe{n=z znM$VTY3+vF_>)gAyr63gi6~zB)V2%`q<|R6ne+R?_<4~O0uj{zaNDJ;lfb$qbvwv5ISb9C$wZl}Ayw6ke=xnCD>o=x~ zQ3u}F7Y^egzn8|Rtzld?D-ul+(ZEL%-5O8a`@9V}Ublc~wS1{U`ZcS?JWuK-;2z4& zKyy*rN5lN?Ok2Oib}!2H8oXw>TxH zYii=UknE)tbzL<~7`$qTKAZ8}!j{Nzm|tSOV9YNet<2h_O}+&fKIIMF(O1FkCUAyu z@CGA1CHp@Cc(P(dycs^1EJofWj=mH0|83Th$|VbCP%J;W8BoLE@~DTdKxJa<(fbb3 z>cI(aqal}XM+~zi>1Rf=Q=q*pk|wON%xyR)THF#IUgB_lHXn9ple3T3x+vC_~t^I=#c7yu&#^*0nxw?eEXF^TJ|q z#`38#PY%+fJ}mgs)f%9gTg%Y((JO5I&4Wp0>+S26k4zGZ9gye~DYs^wlCIwgyj z&wF@&ed;`8E({JJ`ksz}6h=@WOVW9xrBWCYJE^aaAZv0dTyK|SHyv4Ux|W;+?^%+;pys zup)SS1g-iS0Ydh-3jcQ1{*08Zv`FvY|qo6mWycPIaQZa|HCsX_L9kTcI? zOU|oAz$`vdJmMU-sMP3N(#Z|5!lrvRB4w@6g&C<5>>=%`%-`E6ObZe9LB~`}1!GMkZ)FV3C(gTtRfZsKJ37 ztVnEYjcX4pV)FOTU4S#YduCJf30upmnI8BS{<@jQcnf~#jkesvI@yN4u;P`SzR~g) zPXUe|R{su%j}`$sdVj7=sz?7HT-jm+GET@uut~yds2=*_lmnishU`P4dz8{LP$V?Z^z!*ffF}bFiJ?3Wb$X=U`&Ixs#%}9YR@8Hes+d zsqT*1I}f1vI=fXtFykeUV0^b;ix}6)ZOiAhR5tdKof1<0;%5V+8qgf6zv&4tGzW9W zI{Bhcb~N)o_reg7Z}nmyBbm?anZvHpF(u(AWkEJWix*D z$iAdO{t$BW72DZqO`_;sJbTgytJ#GRI?nGwu;|rTRpd^q6gaG6Qw;#MG5VyMpd$ZaG)H*Uf@+i(B1rHDv3I&s zTS;&5$nQC!@JTJ-R;w0eWypwu-QXAeLUS=_53>|ZmaJ_CxTu8NOHkQlmvFxC)@JLW zAxm$6bqIw*lfN|v+GX%}IaMqlb|WgBtU7_84L^zUaV3=>}7|pc8 zE!tJ$Wf{YD2NW-8!;YW~quhGPkYBIMm7m(GNH(1rPSi%*gK1T;M1x5;4TBr>LeQpA z9CQYp!^O6%&dG9Vf!d}_K{hncZZMgJk6v29OwOHW^v@bruTO`ozv3@Rhv+%U^H%00 zlSG<(lx3v>!^*6nXu7Mp1keGWQQfk=VJCsUe_E+|tVyvG$JA_aVUEw&($-H(3rkWu z>BI|*!8j!Sx1t8)xqM@9?LoSgk9r&e0jAV__zR=7pb3oS^_{K9US;0*8!N#ohu<0nOVs)_sgr_!pe56xJPB2D zRooHNboT9b)|Oz2TXo5S?LoS+t||)6>3nj+wC%;xLsv0dvF|upUW4;IT_}on8Vbl= zNdsut*B*cWIfQ%DxV8|_EBh@07ws*9TSOAxcrEfBA{fFp3`JA}a(d1d$HvtSPvppz z&c6=5w4+1*Zx{8%y~H`tc>49R$U<{pH$^+fOk-g6JQu>AGgb*(Ez8ePAT6n@dbUly z?-=9T#ay*1GyT#RFhbUKhDjH}67KjuNdXU`oglnsNK_7!0#$eichK{&2-)?>@phB; z@~i^tdEC60Pe@du`<&x~Xs;cvj}_zAe706*U45SJx{^7@<^JCUO-wjX7MeN>W4G3* zu6+!1tJr;pr&}H~vo#?&In8<^7)#}KYgZcCT#@p}9U6h<-c^RKqWL;h*VU>DDQ55| zYn?&v&7@1h1^RYJjMF4W>?`mFp3+v&^*qC&G*MLLkwanJp>ZYYmRvGrC#$;ZD?lFB zm6y!n>tTCeeH(z(2bYJa@JH&mYj_8bgiqf|rsFoc2GAReMcj0z>)GlUsk<#f3h6mi=2yxmwa)z?&oHz=3veu#uadNp^ZG)b!8skvhA-Cq#&H%5?PB;^+xtD zLl~7PhEY=*GESRMOetKn{@n72xo9uX z=2F_MGtI?fsxk?7GEur~8+z=;8WWCQR!&>$cbirpH5_yn(k?cbiP0pt`((=OhRiLG zRYF_p8uOh+SEUM2ccZ8WH^i1n0~~J%YHO&zA$e$8aF`H-4M(-LMOR16Vh1QLKFpww zkm{XMR~FVYJfd{!1*MH)5E=5DfRCjvd&}F+uJPE+hh^yxQS1e@d9rh~USi4yHYm{0 zdFGX5E|=8yOL7Xs1U-Awg_C!FIV5mdt+76c7N_?R#L~jeKY?O$hkNhl*Dr%ljleK< zb?{vaa^b)=gJ&o&Yud)X`A-N09?oy7LSTwA3HChLB`gxts>tL#*QYYsEj|m+N6pa* z7Q%xfC&I7KvL9fDti}H#)5*&4-|O%&vi*Nd`CkYqE9}l0)hBQX0*MA({z4Rhg#Q)e zxlX*u3XK=56WWBSuU|Qs$z-Zd?M?3lbYSFGBZ&gBi@W$6tRFPJ_$M4_8K_y%ox$q^ z3YPESULWh)?Ov$gCp+wal*rIFkM@4@W@q4EB@)K&-=1#qpO612ksd1dmB`;T_ZPYZ zyF+Pf46GkdXCf9MZi`a(uY%z?1+^uM1bDiqqv+e==V38nzt^I^=!cDPtr3} zPS{wd|GA)ZNXp-y|Fz|T6>(pP6oEcG94D6y_dgbt=)isjt2;y)eC4n?Jz*^q@5p*1>}j@Z1;^6AD_N2P?aW z&(A;v#yx{5H4I5F#@Zy9z|}EwcRl6gT6w|7I2B{n4kT5%Ne9NPa^GFDh$?)kc*aE- zp6J#-J+a1({0@XEJNhN7K4;z0qWOM3Q(RG5#=v0OjhfxSVU8jqkcx5?XA~1zxrIie zc$9KRQBhG3%ZV=jQL;j&BFPYo&c~4pN&ek^SKvd#5{AX7;ysD8#y8n*vN$i9c%3nG zNuLwdZ#qL)Y;^zVA7{j~!da=FM`@r%U>7w|rKf@*Qd8V-xHouAc{3NE4Rp&);u%WV ziu}Z#fvA?z$6q&uH?mXX4~jJ(x-J09UL%1Hlu^lI+yHOp*34nn}E&op+Vj@ng`wBsF^=y_iHg0ssAIpsSSVZFgid31=r%Ybk;A9I?(Z;#)@*2bO?R#8I?t@&{^!%3{YtYBKogpLE+7~+XjvsUPY zPzX10XnuKXZ6qsAa-t`Uj$0|D*;{sQP` zTc&VyCe8JNwY`bwA>4uwgD@8W$|QKLpfJQ?kb)f!)f9QarJs7D5tNrHa2~Rt0@}~t zTL~jS!)BOSyfL4twn4;&Bb+w`Dogw;9SCRcbw)kTP<>yE+MN#V;=?tH`Z{+nC|S*S0K9| zLsojo7qKwxR*Ds=uHwsCXGloyE`iV~gWtE4GxeV=qEwavgduC2IPKhbD2AeFMgLNc zRNP4W9HA~ygx%o_eilsX_Jk}jo^nvbuIl=jL#p&6G2oH3`Yf|g z0k1lIqJ!uN4b;}?@SoRWTZ~C7oCSPcr1YsoE zuQ^~9mnN#^$NX;xe@s-%8AKLaCm<`%ks1YyN&uFnC7>Ks{GrdCHOs~5;B&o>&A+3Y zEbaNwpD~S7`^u!9RH1TIz7U6H~oB+jc6QdamB6RWo9hx%a;HU;X_k`b}c%eP=+ zvc&JDT_b12CeUfel6=fq>!;8wgV_;YP?S}*dZ)LHg^IgIBrAN82>~WnTR&J$0Pn!V zkE$5%dpZLJv<^eKwDoA;EADFALgywM3Rc)o8@>ncMa^iHq|TOVU-L>yP6!`IGMW>5hmAE%A3BNTgt0l`*$?@4t3}u ziFcRJ_|AK?cMO3m4EFr^goYdOFW~qwHufXk>u|cd;?eg?sz7cmNREr5>n}3{MUcj~ zgGIsHQL^BX?_!x>b zfn`OINXYDCnD=poFlXczYGYmW=4lhTE|aETd;^gI=#CJDnoHvljI(|~ne5^kNXL_^ zf@tGGGXW@#9a)E3O1$n$DF=b4_1Lq(mvpImq<7Z-gpx?d3#WzRm*m>f$c~-$Vh&x` zm5By9)!WlSY0Khl??FR%m&)$f#&Hwv9~cN*b;z@iD{y63ePTGT%dzl&0tes@=VRxa zps+a-oMcT;X{e!g85+4CDgdU~K~CwOY|sN3A7dvWqn%~X_G_~nw6fxU_?ft_^7B_C zx6bc}9Y4S)$54s?LULsM?@5k~tpA5;JEHl&5z`T#QRmA={HOnKVtVC+HDgpq)~7FV zLL&J_tr!`<{lR6UwF0tUSh44uQGiIPU%h*aJDN!N)bl^)JE>0Jt?i%Bj?bqi9sWpi zBI>+LM~yKW}k}n`)CzD<{>rTIF||rJXzizM*I9M|*NUImzF-lHUL$ z?{9!{{(lA-84>Z1y>bg4p|f&nnLVwfhKo@8lie(@Z;@=&#Y%0T+9l;L-}3VObfO_8 zXgMVS+Q@FlO)>%7XFe@5Jn2%-}qv_e6pg+Z+y{BMi~;N zV^>1>W*l1E|w2^oD%xCD$3^M{nZh?T4(eDh?l*pHN8{ ze{|D~j2oZC% zE%o7Cl5T8@g3hvAK2}k z^wy8hViolNSWs_7Id|0MlbGAFPVJWKOTMhL%hn_#&Kaw4>HZENyJDBLk&N6xKmQbp zHw<*t5+Zh9HSM}^WY#&4AS!YA!hsNr`g1XjVLD>a_tp1d+BTt^1c|r@)2SPK!f{yb-Vp?Ek^2-7ii$4c6|u zf>5zkc6LbBj|CES0WjB+ZJFitvGAJw1!f)9@+>@2Z~gh}6;B+DVMjua^${E4X_A~F zBdLxD zBmc5dyuDklG$=WMq>yhE92XXR71q+Hu+NT2P|j!!_$W$3ffQKsvl&yp2MHihD*Hzp zbLZyTIXQT0ALb>?P*Lg$rPM?W`g8jik)+s>vivT}_3L}f)AZxyHkE<|D<_fT1vgZd zqOF}FCGi(IElEQlexPndGYBbxG|%T1co@Key;L8LpZ3mn#3-Q|kW$Vevp>eMfQ!`QG@EUTpw zra|b`@yzmWts1RkjQdhLAQgt`A##FNm1wB)2(3P2GvB7M`yF}ZE6c1mJ8rs``3H_t zhufdo=TG$RjUj zStM0CdYG1}oP0(_lI*%N&%8*BLnVSUs|@sj3INF~uTg;=_aKz&r+oLEsl1`9<$QEk z&1mNh?Ly$#n!7;&gQ8g73w1q2)yTNw+BC59vT14aMs#538ND?sOwb=-Z>?yPHDfXu zNuqzNQ@2wrZ@=dj4TRElt<<*#YliW?=_Jq8++$k=VO|M(D!2eG^ViGD$bd$hM*q}s z&Q$B>NIh%dEpFki!p_uE+`*Qp1C!Kswd8heJ8>J6LLrMKBogx-+K%x_*QOz4P|vO+ zI#sqtBwCdh_8GYeghQtH*#_?^@)9gAPV}Pnv&w-6%3s~kjJKvj0@5MQQ^Md5NHe>O zQ$nNRk;rfT0)u_$I;P>c^Mt z9K6Ws!*(V@ocx4~g^I3y=Ltj>wpyvau-~;Q4e?1=4%eE)E*J-Yfs_{v@p=f$z?JW8 zo|M^T#iWA)fynvg$Q#GQmwO_iVkUCQL%QtWF*sul6Rv>hYW^7T@ZtiobDK=8fm8cX zQp8s;?-napSaqY>-t$uajH0qTb{byd$Y1R?>_;Ug_(T z&0y6Qjh&AV{vC!_bOxeEri3s1o`)kT^LdAKvh3zz%fHr}2G|jhH;)eIu$}dSY`8#> zc7AbwKK-3}*~V50lLz88UJJl#U9(bIQX1)s6Ju6O@=)nE&^ZaEs>D zZ?FyKe+o+Bo*F=qE#UFc@jJvlP>tnYHvh|(U5G*?nR49`D^j?=3?q&tgoC4y>64>( z_<<|ckZy9A?mYiu``JhP`Ix(TPs97owUv_XPdk7u#o2TQm?q94frE-l^QHRjaDY9= zZ|jwKhTEeI{>*&2`0}@h{R@MQv-x}^ExvQxc1-^Qqh${MU$cS~u=+zR&G7{xFK%<6 z&J;rJMF{*OZiZF2K6~{of;4ZgNBFH{eSV)lii4g#;&lPcJiVk8KL2S5=e?I&;X>qA z{q&SwVhziFzaPn0xqtZ>E^6?6)tS4PZtwlDQW&MTGVcAjy`Mc@_M(|i-s1H!xA_J4 z23XXXpRvVH4@!5AkzE6Ph_Fr1_VyrKud-5zfFqPq=y<{K1_dJe&+FH64jEr8}MdoX)DC(wC&*eEuw6qHzMv{4u)y8e$)n0YLI~u?2|a zI3p!O|3}xO#38?gciH?b=@LWcvCxbr>;#|uFRmPrWrc{!o z>T$oE;Xac|b%dtXa_BR^&@@IOWdAqid-lWU75q!H{OX>Y!|KkP>Fn%U?V;f2Re=GP z-r=vl3!MLlZZ?R?Uy}g)f70Xz^3;T0oz@Fa^4_^wCIyds;3@_s?Q5L|f?Ug+tiv^; z!eK;Xx<%;_350?id{lN&aaqwZ?bG!c2a9ciE#l-Jz8@hXfh4_8JAW#cq@oH@RE%e4 zP?Sl=SP$kZPv(R4mKswTDdaD<>1w$(2Lkop$KlC@Q1xRrp$B7=ap1{jT#Jv3*Pq96 zdv#nYHe_L&sVb$Dy$Dk0!8McHa$(|$lwBh6;hyQ$k5YzLgIE|f9_I)hlILJQFZ-{i z)J)>BtE)i5J@jSh+y~9z7069Xs^ZH{S)ts2Ybd6+y96(oCg%e>7W#_rpD{gCOzvZ_ znFGydYTctNc7VI9Oxrz0A`<|KU1_Y1ZsUfsQyol7>$|JlqXe=OasGC$A)Ie#u@frx zu?a-shk2DblJEneFP+F>@9Af#e#F!9-T=JR5&Jb4JY8)?`rjJe@e-QEQU)eN%~V&B zh=PwTfa}ODt=H)01`uWgaR07v!PCrtC@|8%~MtnZg5xe*zh;PJC(}m^tJ^3g@i2Ih6fOtVaaE8 z5z6|xp!4LI1sGEWq;i|=OvL{JJ#xTOiwx8g*i>p#HjuvE3IOQ6yOYn?U^m!Q4l@b@ z3yF|7qQ@>~<8WN=-=8gZC#!Ri_M4$(I#|&AdQ;w|NQ+1g;R|;sSNK0U$oJ(|fal3@ zFy)OjUQ<;-Mut^PMtBb?mn7Uu5i|*e<{`6!MMGUXjT8r+^3mzfWB}_57i@Y#z>>V2 zf~yGq9j6EymF)%scBgyj2W*Qi!Gl%P$)dcE*|)OnsPVuh6N%8N5FfO2it0c_Scxap; z2&;~!;o5Qt7n5&`?7nAS%SLrq>q;uMZBaXC3{9T zdJ5w%tg0dbCtbb;&QcFN!6tdEGIPn><8iv`Ajm0UwXtk6P`kRmI#l=-j1*vxRcigl zh>+VYxq}s=L3UPsuJLG104eWPp+czWv`vJRAFf5cC+ugBk zJL#xnJL%YVI<{>m72CFLRczbl$#?#>&iekd-oZP`pavP#Xs^2Wb8S%->jj5)yxyxR zPcwUQ*rHydaA*#6UpB_T(bp?)rhpE#x{8a%?wpm$hU~U?&F;Y_cc4 zn~&4pGsuJtmVk_*z>oQSyoUJDF{ec`6h}EKrR+D{8nN=UwA^?x7FY^z6lcCMAr@U7 zNc1gv5ZHy6GScj>l21X0nAlss)*m*4UyCZ8e0`}VuGD;Rnq)syV5Vv0 zNy%BzPwL>|$qR09q;!z^z!<2=-ql0-X-QkAq@z1-@mRn^M=`AYy38*eXVh|AomM%E zXUcNwEKbG?+1@sVb^9x2R3Cl+HZz6kBHCP={dBt;p=9kZ$LJ?})v&H{eoF>{=`8X+ zD}$!UnQJZ+qmR%$bE7zYwEeMjF4Y z!0(0*eAQnnqXlx^DhFIH1CHqPLO{oo6FYl;C_BAYg&$-nSU3kd>24;gBh*pt$>how z3m!@^y(F>R0IHHO_Z56IMA-d67d6w|MgY5H&}C0O&DqPC+%li)FC z&?$#3J^SQiak~zGa+T9|U$)RBYO0DW=b229?$*ZV`hzuQrhSfB^*38NzqIkNB=AAd zWd29>KZQH?|IUnNWcuIXZc=MJ{+tzl;|}A+k3IQfz#gc~Py$xA3|gPB?j(oGUgL|< z9rK<{a3X7R2414CxNQxa~qqIOUxtlt)w&I87|t!sPqMc|vBD2;ch84!{N;MS;TwNpiv(}R5U~AphguqKu5QKRg)onjzdflqfLxJvxd5W!!oVdz1X zif>wtP866?#CoZrm~;)-S}7fWkhhGT$mUnx4BdRos93)%Q7?BmWp_BZ zfWcUZp5@-6bdsC~6aJ-r^&rDBBnpDo!u>Oqblx4CyqA+-1cA{>}mB+ej{;zW1z;Z0C{!*-8dtH%V+VaT3IZm3fho1D=PJVwf44 zz%faT1ftbb!H6@Lk`Px+lp~)Wz|~x`PLGV1ANH#K?&_QRqpBPgizuekm8$nBoFx`@`c{b{1oBk5?RSVdibIyu55k{1LHYS;FjoX9T&1|s;N-Hn z2%u~19WZ#$OyZShzM}4rfIEzvZV@;#w_P0f5Y&sq$fZud{pd>g)d&1#Njk~8y~f`4 zF`{tj^#v2k-+~Gv$`TBW!Wg}Y=7~omsgoUByst`QvYk=&vWU6DXo&L1rx%Cf9F2Jp zIyLYYmAcQ4FzM=gt5A^wO%&4->}CkP?beZBU{cn0nP))ygi}K)ZSi&>VJ7nVn|({A z4vs}Dp3$ex_*fr*7wtc|BApcwtlC;-#nMLEG5k*GjxCh5a1P$llX3_~Dti!3ePS@l ztlnM*?=1lAsbX!0J@nZQIUbocsJ0lag5DqJ86nev(wC|X@Mnr?2b3prGi%2>@Cm_# z09#CX8HL+^BAd;~fRSe|zg9I_dK*_fv7oEKn;EPbCMQ}~fj@XXdm??IhfmHKft9h& zgUMdYu`%c4_;*15rD|=!_LI;*sXF^a$npEQfZ?BZp`$y)m)#R$z@T@_wwpyum{(^wH%HZye?zzL%jo^6Nb7kGH0QXJ7wutM z8Mg`Xqr$Qd>x~lr5oNm!0@Z1JU{*N4cqXgIxg(}5=v2;V5 zm-22`Pq0mItZ0%kNfaLzJIy*xEvVypjIW@2iN?TWgn*@RS#(RRq1HKgeCHf`G(D{cx&Sv|1?zo^B9~{_$TGI}^N~}g1j=4Is&L!{!?W?N#NO>!y zg{8f+qa6|<IGnMr4QT})5T@R_byg+5`T$m}eBKwaHCcR1GwXUNkI z8RL*CPt9c-$kw(XR&C`Qp8` z*}ag9St&L{k>86_NQA*!AM;uC=qr5H|Ra2 zWfSF?f#8sdCEM;nXN-HQ^{RY6$~saH39_E_k2v9~H?bgw68KAqanU!*IV*7GLXLnXUOsIG-)P@y)`gKT7R@%S3}6?U#;bv4&l_t#WakSFUY)3G2}*wXu_!%@bOkEr+RD?NPaZio@ro_98mO z2^*s`kJHv}TqY+N<&&DS9pQf{TcPhSyqOy}>=7eDN=yZ&9rfoa?@8C8ivCZnFVe?Rx`I zCkb{-v}K9|%V#`h4c)f={vodcwmT5b0g>UEQ@*cZlHmi3NvcXA+~-^1(bQ9X8Xa{N^dOBNmjVP?frHQVIBIn`(_XWXML@~V!0n{;xBT+%i6MUV~p2HhQl?8r> zvCc{x@g$klT8CC5xxp|nG-z2*9eIV({MOeYfTLch02ThSEYx|*Ad!@uY)l=4vC=<0 zDqrgZzGd9x5;V56Ke3Q4>NX2GcjYH&T;E7Z;slsDE6(2jMi%HMrq)w2aV;{UpAfR7 z3h__i7|R2W`GTsb8;W~pc_{vjb~Lnf8^%a zt+b)n{aU4(7kYq|v=Vtb$4Y5fx%8bHQ*Tvd&wB)M)9mTNP%izAw%d8T7-}r~ASrkL z$M0i@Gf&?I5>;FOQPPEe=EFCE$qtYqoJUecV5b7O!f`JN<|@)RrqlNKoc0?{qOAO( z__OF;dyQ;Y`1W5^fn{NkLqdaSdJKN`b>;Et9*+L)`K>l9+Vy7~$8%#FqKb)EavJCm zb5!FXJ5wr3wt+g0X5xliN=9-=Q=C>)0@kc`Uf>8r*v>C`rIl$n{?zio2h&tJ(~!Jg z$U#ej$GI@fVCdBQtbO7-GD~NXGhppX6v!nI!}4C7EkNB5YeB5L7#Qt}ei+_#*-DJP zd=dZ~A!vavi1rd5P@sXR_7dC4GdHtg=g;j+X-LM3=42!bB4~ExAp_MvgdLMQyQuZyKHq}=> zkrzOdYJPu5o}vNLcGEB{?XW;?LT>M}7sCuFg!&}MKqi*p(w-j7>@yFl4ykoUV}gK_ zkoa+0ed^eQeb6@<_M9Vzi7QG27bIW8#h|Sp_8Uaclc4*)g0u~y-JV+;Sst$!fT`{f z)*B-UNtP#$pu8s|%D~m`a91Myip16ake_nsIfd`SRhH8aRo3oJW-fNiXfBXbozcMZ z8klJ#sa=}Thn$wgS3dru0<@D{j`~2G87PAZ#@LcFjQQ~4SpNyR?aj>vBKAq;7*2EV zcR;_oVF21tE-qL~MT*vs9HF{KDmRL7d!9R*%4!S}jO8zHa@!(h9e}pqcdRJG7J5j3 zTy!PkSaKKDn$y9)K33K=3DU+$3&%5CqoiD7L8qO(ds$kZQbcowSF2Z2sn3zyj5!yp%q`W*#J!02 zd>MCGUjwtj)>AaUiLI}MCc9|34nBW1oE^dmnz4Dd!gxI~9_EiBTvlLCmhfh(Bcq?7 z3?*Gw>~ZUJk=vaeWRnM@?0Jx6*ldjE{iqag-P@rj;(<7VM;@s=VAH9t>?yXZ$KlE@ zT3ci@l5o|+2q}J=nthxzVqGF#SPiA2a|Yr9r+!pp!Z;$qZ4*oJD!Z1Q!S3!vG)k03 z(E+qQBjZ3(tX|G`$Zq<}fPx^YmR?n#+JHbnLH-84l#@RvhUJ>!o}dvqXfE$g<&HrdkmwEV-_`pU68z>|sDYS_^7q}Ieoxt>`kE+Zb_ zOLp&R9Hz02o9l-9BKXXIssOo>YIrX}q(cOK35?mb++fh+t}!q^>jx1SWTzc+&8N^d z%VVD|geGj;ttOSSY?1GD=)ZlO7RqkC zCF}GB@3kf0M)c`ftr{yzUm|eTmu;EjAd$r-$qg~jbP}Rh-k@RlIn42E;=;nTr_8&c ztm;tRw6bxUkWU9W7RJ@2EPNwjHWQZje@u7lNxfaX>=zWNBoL%ZZMDz@oR8P-m^NQCKtkw(nr-D zBL?JjGAcVuZOCcmqozS7;@8(?X5ELkJd$%84nD|2m}t?gcBb(uEVg)z4PkHLT+mhxr zb2WgF=}*rd>99606lxYE-XFX0!(6_BsIWMQ(zGkDxYAwSt@4}}CAD1RUmTm2<8bAY z1ig5hHDt}0m#%b4gn2BqdfW9>a7HSkOE-u`ZTQvDpfa7Mgu=<_Ol{s$AH{=e41-Ct ztLbLXm(3TWfyJIneeGH?PC3YH1KD2sMRzs}_??(&KqqQ87blV#yO6 z`UYZ)1R>R%;HZlmu{ar@Ycxkrlm?7u8Y4m@3Eq?V3eb!kxKCdJzl@*p;}ZD#z8Yl) z7%QaM6IP@(r;lp>9)i!Rz+p3)`7#w#FLuKZGEM^Tc)&xf)wKR&EhTIPmilR;(V!YZZz&)9e_YH1ot~0Z@ozaT30sqse(tu*PfmO?F*OJbTk|y9g`@ zaQtVB=f?#fRH)r^^WMSr45Z4#UJOOXTl&jrw&c9agw*Tbiq2p`YKyJ_V@Aa{(`wV5 zJz){^eC^K~^!#enUVLZ+h~-zpsaOp=WF*X?TYNmjvs>n}tT;&w)BtczI9|p=WZ|=N z(wqb=hO_I3`)Lr1rj<1ZaCg#Ws`?^#a3SV`(n;c)|roa%fFL3>zD-Mp~@fkb@@CU?rHXd!u z=<87p<&9u7uNS9uRoRwwzixGvrmi^tLuzLE@6O}wod1`hy`d>pP1F2sXsb;S)KH(& zZTCcgnEPJNZEDX3U8J3SQ!p8yAE$zn3%phU#{?O>9iCxBKFV+cf%v)mGw=lIFTGof zTl#S1;$eo9LAjGVz{XvO?Y!=n2}SHT4LslM+~$j+`3jQ=Qe0$v*Ueu5{tw8^_wByC zD^q{a&Clx+`GgDu50`S^-4rwnZJEWdO9dzJKzR;jnf^%=kbnw#AL4UA)tsy$Y)x5* zyR!dCz0J^kyE3;@7t1wyZ~JZ$K5T7$@?&Ad>p0E**3SN0mRJh4V0>6qdgjm4Yb^l~ z^V-aXzujwAs+_x9k~sc#e&1cB!eI3JIc}7R#%}ihxpe}VpMFyav;_FPvwD8e#r#i= z5USf36OsIZbf-wCx3D7+EUmdipULl-*a%I4Nz((7;zWx^W042ZBQ@v^%UJP){=WDS=| zJ0;bltCoOQ5~b1}O$vPdXWr^aRqE^@GzcehFQ9SEPwJAex_e#g{ICXdhKzqSO{#*EGh=PrKn2^1EGrFaY?2fQm&S#;_!W*a zRR4@v=He;4MrNu(Iw6Z%QhU*@T_+xa?{3E`lhwTT2X3`=w#T$?e;_mQ@$zr|Z%S=* zIIx!Z70)Pzcnou6$bW_!v?kI9u>D4F@2k(8@vOq!ogOx>%HrEl2qIJZk|8UZ1pGLS z1(^32Sn`Mzg+3;t({6s$(Ooh+E4AwGDyw* zGuxLr`GL))^$a=<1(JBG17GKF6N!r4r1e=Uo zBI$2|5RF%M+n=QF@usjl`4!}E1Y9@HZS+BPjiTODZ;UCv4L+t!$;0Nt-F)=A@>Slv{fnGQIaQa-%%1g?^Qmg$}L^(Dji6VnRHJSORfY4 z7JHU;hsa5ERNtNuZq?tZ8S@|uS?)3jl+}S2wfkZuG zx(hhc$T}+*c{-{GM0zH+CRIe4*oB->7j3iga!&THtcGbKE&bw>Pd8mQiWb(^Bd^0k zXC8XLHI^W((QBR9evi$^cgG|DqXX!D=xyPTtl#igTr>pWt!1`Y6q_z~4 zDV~$|T9cKIkW^c0`I+)K&3 z2+4krC1Z)%X1DPUqDmGruCeZl$B}C%nstB_wWnH(^LuDQnB#jW9^@IZ?5~Pry}vgv z%f%DFXAgzCAGHm$8-9+2UX?WJSE^yg(<{e~(d|?$pggBj%3CCJ5nP!c+yA6DBdmQ) z7B%e1T=+f7OHTu`+eT`00B1z5p!Tn0?J7u(S&UoAeCssH?2K!%(WIhm?>y8VKGfRE zW0kWg&J%0rCAn@_(46nsdXs>LDzK#PH2}G;F*-ZDfLYSzY(rdeuk7C4?H;P`k=KChmB(tlM zn8%x5Je<58_ca#$@c@W)Uu)6O!JALz0!av$y;_0G(9gdEvpfekjeos=c&Y(cW|=1_n|F z%R)(5Gjh_pHkZ{Wyu;^H$aOvs!jd|h*X)x{p2?t;-SkQrB{}P)^}j6EsSTI&pTYP7 z@@oDh(GnSxQ^_JZf#n?9IZ5jUsuTfG85!L7FpBGjK5!ue*_-50ri+eKwucM}{FMcs zR<_7$YVR~#vwxeoFqvZ>{quAZ^05DxMqViVYS_V)v%;3%$Of&9vKC9jwoMwY4I6*Q zAtGQ9xWSuOWX<1P`djLBDxij`u~#Gyn||OZXug@aEzo(3<`-=JDl@86)W)zBFPzYs zH!gRQkT7mN`ro(p83)z2!tfv23Z|sE_;nK-0yJ%5f@<=|lMcveHqR+Q+BL6e3ubYs z^VntF-(cU7?5ZbP8{W$+sL`DqOUshp>oO90%qMSO&(c_9d`IMm7}hTT_GPCS#R8_y z60(~t*ZLusLSTFqI=l`K)S-_>UJp!48R%nvHMae-qAbKA+~|@<_Qw6ceTRlcu#Q(m zKs}dSEL54J;IB#nQz1add`GvJAEbK6qJ&>G0sCxL2MIVh3jZKX@ypI^RkH`wc{*t~ zZ7-g&T!Tl?q*pdB63k{-r%i>-fMHR@5}|)CkLSM(If3T>i)vHdZ@F+MVd?G!I7)Ug zd3V(PPS7FtC+9x}*#E8qz|P6>zbgR1|6zBUP`>+}_dkU1K0qKlp^ixY}X(o+-FaVZPPu-poW8!~>4UP`3^mwZCdxvp&hXcOO zt9(A1-mmjDz)k(2YCYGIIrLL^ZBXK2Xi{teU+zbLmos*6%I;-~$`fyRV$}YjoisnU zq&ck}Rog0#K1X=a|Mes)@XJG#4iLirC6ErcGtU+!Zyp%defe-nL5~uxip(vLpyh#o zgsCOBVEWN&Pt?5D-TmP;J15p!Lh09suM3xCA4q9cq_#KHSVeki`R_H_+Y;a~p&?yIt9_*Acm@Jj!h z3(T*HmbsiX!>oi{Y2}(l(Vh(cL{t!*>->4!HzH1H1jD_$gtchlYV73MR_P?Gdm-uY zOG$bXNF?OrRNZtCb-N#>Mrhqvfb&2{9ihzHe+84lmsHjOp+^zT@mSuRf3Qh6n|V6y@l zXotNZrO?JG4qL>19kZL_FFQ#xH%yI4qtNM#N6Z unWBU!rL*<8QEd~l4v)Sa*hbW=k$M&T zk(Scinqy>1kz?Vo<@0r7NEY~kw+a<#E==FN;$-0fB*Ywi5_FVdYYkFu{Dqxp8**Il zA}ohSKEFZRih#R?_HEgj0ZR1T{?E8+4TgQTYl(*!x(Cpy=2LasPRJPlyZzWWPs@t_wfG#0VJc zk87aDoff+IZC;sVW^?I0eeNc8Jry7FYSTtWi9Pny>TkSt@#=kvSic`O`eC!Jd^DRC z5Aenkv34qN-@P9A^0}+DY>t8oD~U5ZSJNe#1>+?Pmg7*X5~DP1^e$n9+)GWmsaSv2 z6nUr$R#8(&s{00&R5o!fwQfx_-rwfNJCz#^;0)@Xg2q~>ypym}c!Y$w9#F!$vJZ@Z zMXzF|zbI$2&e6#nUGCkamJEhZ5EN>8g4x=YPPcP#y~>-tJ%zOYb=}SB^aSmZf>5BLbaxnZmnK1lRRp~+(!WA|d(kq5V;SgETti5@33gs^Z(P8V( zQF1O;PSo?71<6TTZ?BPklvovUj#76c+i{R3Nb;v#NL6V>ik0wQl{P1WenugNjcJt| zaB7$_dWBDUUb8Vth?S07s}QC`vI5QKQj7)!8gRarSg&;XQs@H0g&o{|)VOm*QrOeo z0m;IoJgqr{hWNe^;T7o!MoFEZC6zq9Fzke>TOCldF2y%*)g}M*YfyCntS4E`VOv6u z$7vdAS2cIw2d=Q{zW8VkHpi->^P>E`_y#OvAdd~wH4XI{jcu0+qX(YMxRlaS`q1kp z)@N;yZ(GUc$}=})hJ+l1(p4?ty#$`SX)Z`>J1QM*I3n;LmTd~s%@h6{Kd4oKiB3?k zRfC~yIE8N%J8cW!y(SAAiS+y*MlzCE{}(x5?1>pVQ&O~!-2G!?G(EFzp)7y6LhoYp zF7&5TL1$;(!k+0H`okuRFGlSi-;KPT*o;y~{%l+Ng)?qe%y*&`8afkV2{oow0(ku@ zl~IOJJ$41P?6j~hApc+m<*XYuNQHK2aJpD)a4w@64})W_kMvJYs<0R>FzV2e=e7u= z-JHC|T()B=;>SsL9h%<6LF@#{Wx>+Pn*(rvtAtBThMB+~aq5VbTb>27)%^nGeBB30 zF%^=PZlKkO+|$!ZzZU?=32QScmy(%DJ-aA|vYKy5h8Pq4oQu4hWBoDam#~X;^%-_Y z%q=2Br<`Wckbv9He_N5D?2>pZhOC2iW3-glIMa2inbeZf_1K+rV>FC$V|^o+`J97GQAP5_rBF;s z4U%4ZO?wce==j=#r-*1%Vmb$2;8+Xb9CJ>lMZ{e^nM1oY;Dks+!IqyUg8y?r!9fWSl!5P(12glGQPEmuGzx1r+~$c@I@|%^fT4<`xhx zPdlwhFYTJBSXkGzaHUkjBS{7o=XZS7_i4&En9(LASFvfA;y@%4khx(LW~p{BL4>nY zp4;&Y=#M^abcALI`D+LU*Ebsr*G$ho5_va)^HppWi*>cjw_&eq>lFf-226KD_+ZLU zjVjl*i4kq+^Z!|2HvY=DYM8`*9Gw-*VIA$fUuYP(0lLa>>Ru+})F=$f_AY<=G?+YR z=;x7@?f;jlBsLtOa;(7-SyHa-;*A79l~M@hJz!xSZR{8eTgKpB&~m=?+m{T1(=0%Rjb+Z$`acI9TBQI2qY1W+E(- zZQ>e)U*3CFBS>Y4FTw|OCW{1bMsIf1Tp|C#PTue>Pz}Gy#Du({DyhEjAo33A@Alx_ zsN=l?6m0c$8r1zb88D(YOm&{M<|ZR1V+8g)!QAcW{_Wrz)ws7|mG7;*>u&cwoA!AT zfEWi6`cEnLzbh}W{NLq;K`oh>yC#&b|5IMLmLjdW&i#!;*xcYj<9=OL_%~hH;be=U zn@c#Z?tFtB8n@Co40mdnWg7lPwp)gg>4`uZ4uENGYFIq2yAegOag?(0P<=Iz}uzB_6ZU}#`!uSv4cI+d`@rlE6=>YbV$5SV%+qw_%lfLC` z2tHttPwyilR_C5U<16n?98&Kc*iH0~Gv?J^*#5*Egf|Jo{65tD+Kz+6PQAeAwejov z;`QnYKt38ZA7O_bI&Ns0IM)ekpZ2NnbeeABzjn$GxOoNDkL~V6YD};0mZ`7#BlAV4 zscmxD^~EhwX=*I;`U&_yzr>no^M5_Zd46ofAk-_OB6)){;i%7CzaVDm**fuM40bX+ zcTl1w^>HDMqqD!ODi7upHM5n9$8->OSlw4-{XA$EbpP4%Ck8qhDrh4dW0GI}?Oath znO;9xaksFTC#z6v_sRz30AI}}3oSh6zm$=XvT@<36o(kG(Q5>0fOKPdE;70_JM!;WiY#b@FH66ijea3t2=;T#D z6U@Ox(=47oEs!-z#i5Zp-?|Bp$i=QHm9!vOsQ2&wu0DmNlIseec&*VRFz9 z;t^za(P;4O#>}=8xPnrP=99UCLVtK1YZ8QIAjnCEHHjuH2)~eiFK)uyx$H1HrajRE1R_bu}NiwY1@{$?>##+%#ROb!AgxY|oZl=4HI zejt#BCT=LhLK2914g?Z?o}`+ZJ{*ay&)*sJSF|q(0>UmdcmKO6{QNY5n0o!;NsWCy zW)_KHpioN~UIKV{Yi}%@n-v~Hnrk&^feqwY{`|~v^v=l&@{t33-{P;7@eVsqf?dT) zmlZ>K6B+dC0)Gv=5K8lBCOxkj0biHK(G62ID|OUTR8bQntWQLdALk|NFy;(|;W4S| zB(-aEK!f$Z8y{j@(c+$lS~%l0Er^Tb0EM<+wWR9@ULd5uWt`Rh+Q_XVF`bRpuv!xB zLW|76za2UP5{j7$ONgxP^AlhLa_65j z5nNnK>K09-4Y6D!tvaz#r})qm&U{dVa;f9OjN|%gCF&af5^|aalD;jKlSQI&?dwTe zFnCFw(!~;0xkECtp_4fa*72{9PRYHJja$BRl@{DO^jp}-X~pZi^Q4Hu+%{fG$ZL#m zjBR}XLA;CJgY1^6Tw-u};BWCM+cMT%^EuP9HI9uDm}Fa^s_rBZqv&6`nOVylA6 z!T5l^0glNEImz&@CjvY#|OjbQV2b#P^AJK14x&$^t1{UDY|!vsdJcmvk@8J`I^PX0JLJMM>g`lX0tx+ntdhCu)wO} z^EO5J#?h(?X?|A^1}ata#U>c(l_t-*ShR;)qkv;&?R+AHyO^-eM%hffXZ;XZfIB_D z(egIxhXoe~n%D()q*0?)F|f>5*e&tLyc0<`+X)1_`}9oensmEO?jP;&NZA%cwVh8? zg@65NZTm8(+KqM? zgNwu;e)GMld&EvTk@oFhA;XoJv1qq9+(@OKi9MeOfy&%&j+K@aER=#i(K?x~SW4_0WO8nJY&Fw}rf^dG?o~ ztL0^Vn9a4U2t)e_>hiX@#1qGgCkyx@YvEo8gKAp-==+j$3#8u%Q`0$o@%U6z8p7X`U@s8l=}$JuK_ylZ*bO;Jw|W_rI0x@7zx5<4p?37Fa@72cL0a?Jg;A&q5s zJST1LNW5%42+UCzDsg?`R`}kYnn-r0LB3Y4Y%)1zv1l@KR)4 z$ShhY1}RZD(Rng<<=yc?;Sj=P-Ma^=n0RMlJCa&8fL5irV%Q+C!Vy*FsXsJR=HwhpTPkrCLJ?Qc>^s`LxeWz4&J&@@n!c|I~h` zj~@i@!GJHTDghr^fe(xCTlomc{1JCn4=mjWxTLSr{LzK(_hKNA<@eb1)OWq~f5xUi z;cxJ(OmPUNPtGL1VM2%G?VBKEC@_S`03qDa?^F4qYZQqSuKvxXkesb^n4K*I;|WJ& z)0VxB`u9+~Q~UpbJ6ixBKxDcCJvLeFN`h1os@QLn?~N4UpPDfAaNbofuMp<(y8Ks? zjeox~0}<=9KGnVl0|(v&$oDd9>WkjKWWO@Kx2A~ye!TBBUp{JO;siDZ%Xx#*nOs}F z-WKTUwV%jN;164pb!63li#uU5cyqQY%G9>|ZLy*2e01UgrWCjq3Rno_Wj$P$BCBpS z-y7Nwri{c`WG#8FBc=3|>Gf86^IytTq z;QgTVn?;$38Z9vN4{!!JIV+VlMzv!ltW788hpH4ut*$2P5NB!hN2`d-4}A5WwaUX^ zFEHLk?p|x-!gx&NN`jEay7vN?*u2?U46I)CP#VqGiylNnCI_vD?nP4_Z>Nxom=gfT z7Zc5_(4ty$QF_x7zsO)65}DUvj?nSvfXW2(g+966Zjj8LE{$`QZt@rPYW5)|NWAI1 zbs!0i>>U}FnTDs!MrKE)EF8{#P36RSGh+9u;i5Ski*kt;L8(EkQK-&=Kzd`K6;R^5 zYU&<3{}#ssGGvR0M9QBB13Iiuq9COl8Z%yn{4m)h!X4y}-^K{0tj}}$dE(vnu~j}< zdmLMZdlL0>n{X?GZUP7Ztke>PnHaN-S}MaX`xaOMQOsfS?LbwO9oiFweeHMBTl$aD z5`2K7G$bZ?=`rlz0?x2@LoM;MHMHQ+x){!PivaeAKWn=?x-G4TnI6-23f+tc-9E)J z?O1Q;vqDIH)@u_eXfV@0&OC+B)*px%;;3EjgmL%+_ByIS2K>Z|3g!V|!5!wLLc-gE z)vIiZIaaeRXXh8i{wZ)d1~qI*-pwX9V?ZWYew2cfhB1!T#(AZcHxW{z&$@*w7tAeI zdQJC8C_0eGBR=YrJt7f2zg3N_EkUVE`4>6z2>OyZLhmPpUWp^=j8p64PC9|FLG>0p+A6l3zf`I||ds{^)~psWXD^sk(!G|6H{# zw7PLqsthq6sA%ywLAVxYz9(W=zyrQ+{rC2wUZZFXo+;jNN_ z$R^&Ve`+xfS1-EF)7`}~(yHh=O=f@Yq+^tH+MN5CONz1L!Y|WK^Iuo38Ti~s>H=ryp0=5BFHGIPpExq^&`XrheejnpKI#np4>(zIP$#8#=Oei$6OHS5kyEAfXh(6B-5SnyP2AuPkB z1!9QA%jd3}L}ZL_CfD@Ne^^(HZB|?7A4S8do>Q(gT*5=$&Rg9IPZpD5X+Qz1xKiRV zc`0PzQfDj8E<`GR9erq2PeTz?^tS37m3C4HcPV*HFQWWK3VIopQn0tf4VCoc=Zli+ z5laCP>E4!n?obp*J5Q)#Kymhq{*R}GtHbNpYsFu5y0BsSJ4E&1tS)+!9J(ojy;{xyDspk=O_{yLlaP%U{ke_0Z zP!>Ue9X5=M_x#W3j-F-HjEaKr5+R__&IUjJWr;JT>eIy#k%TqwvYIAkipY^YVD_r&xo1`#M*%d|y@G6z!w2(o-FlriC%j zW+UQ+fkjDuY33FddIU@BpyX6LI-RcrVIZ@PbxR~$(0WIH0tQ!qu}KVfSK1Vu`3FzN zsMx1*#!Eo+Xrc)zi4{5-ODSGNl5nlMOAuRhSha7s6Kjxx2@Q*Xk1xBVil%CKy4g+- z8mOvP{$f9oS8C(THvXCL&vy*x?H@qvO*l}L3Sho>i^m*NHQQ4P&h8EuSG7ooW<<_A z4XCZfX=;c})=}K04aV;E6lB3xx02=YpCQgcVSsrZaxUv%Qp*-rrK&{@i>(Pejv>wQ za(c1He{%cENlTq=4Y3@DrMVo>H_`x*0p?GivWO_8?#8}kOr7bjauyB4APa4NzQE!4D13mat6Cey}0ljnsQeK;*{btrG?fMmqfTKjDOj<+Me=-_57hL z4G9KVZ5D90ctU2nFbZBAcg)@LrH-gSD^)6Sp-lneK)MdGk~Ft`JuN{qK_6YFlHv7z z-xB5QQ8YD{@f%=UgOD9>nqYbRO@mmM;tW5APfNSv2*Ks)6$9Utm`uKxuo>d6*DGXRrDu*mRvM*HUYbD zPD4R*=ipVAviWZo=rn_*BO&tF9uLHSr4f>{cD6_P=qwdbt~_TwJ2+)&C^r{O zQ4OOli;Y^lMXc%4PM0-un~t3H*k|V}n(zt)@J7 zsO1-K(F>;1p${r@XK%%xLz!peAZh7ZxgJ&B(pp2vW#}fx6doFI+fZtnioN&@o5LB# z>ngEzomn$>;NSHm`9_^c4UYTGEQ9WT>ANG)8Tc~bAlXOGTYvr8-A_VCeFjJ@i2eIi zG-&z!Z2tO@-2sF6pTh5dcWCEgWc=TU_V2g${~x6E|1kDW?V$wP+GV(6+qP}nwr$(C zZQHh!6>G(|ZL4#>?!GwP`(povda9n9c;^^Lb02`nzj_-ce%GYUUoiI;Emzi*p=r`i z9B#2R&t;>XT%bVFx=JgF0(#13PhZPWN~yxOVaJf&caSv9$mEzyyf$Dz@uW@IfnUusmo%$asBT;U(qT-kFzKK zpCCgk?HeUGEUmCEZ7WTrzCFvTipN`qo-N1&JBVM&@*561h4aKsGZCPZgxo{+BG1P1 zvtT;ntYZr4pKI=92RH!b2BNopE5wbci6WDyqpxSCQZGqGimMNQM5|i1A(5-Z1AH5_d5BOtW*{j#Z35?th zsLh4((Sd3qS}$M)T&=Js_m?-Dh!IR0sR9aKn~hth{R65dIt!BS4?}>j*4f2DZNceQ za!H7~H=+wALV>!43#4pHG-C7T*%4~xk4~q^8!*JN!({*63eVDYas-04(@qx;DpD(S z%;>xbN5LVSH@I<~`95=d`m`g=dzI4C>?LSi_9u1an-!a>UPcy3z~=d;w}3 z^YD#JqEdkUN#W$Ga`V%dhaLL!2RZ5B_tKvcGmL9^q={6#_~ZpRoJR61)tY_>RHhm# zrC5>cRFIjqqvo)-f!#eMlZNWD#GgAp7L3gffg76OFLkj9eIkHxfmToegF7(_&#H(+ z%IYW_-}?BhW(3HG=%2zcW$|w8ZbgEE%oh0&T9O8Ns76M*IScUuZD)n6XGP|>{q<^w zu1yQNCbcG*&sOlOm*8!7-2!5iZsRKY_sFWuRF>w+mC4DWObe?z3yfh6&q!y9U0v+a z!1qUpr{7|i(D^VE4O207T_0R(5=I>!*HPZn5Ge9pK5>^6_z663Ifj>uF|X(8-%?YO zfNg%cSO?NS;q1k|PhvON#nxBQ+l)dJ(Rh^2OAtW_J>B*0=uI~!jo#ag^j&Ls?I1l6DIQ$ka}IWE|K z5$Eihjs-6}*7&~`utS~e)^YvuIuWwsCXnuQV$@~WExB-4F^RrLH*51mQ@1QwTKI?D#>=Gx5I_SOV0kLcB$6puVu@V}JSOP|gvC3=NEte&hX%rl z)CW*1^8|KST9R)yx_~O3+!-DH(mTQ>)J3sN|q5o_ci- zwyIP46za=8{A)%vmw)DdY|*8WkMf!80qJ+_m%pyxNsH{7(a8C{Rxr;Ovo2d*X^Zz=$bf z6pwE5GQ8D!pvX3`ODf&%9*{Ma%&H-cc_J)x7Es(p-jO(!nKjfWtApG_n3Q@N3g8AZ zJ%NcnJX^#&v%s(|Y$|qZ7w6>#sbK@vsX&@vA9Gyz(WD|+i0_AJ+FOg)>QhZ?4>I0} zw!6{z9V-?R?vify)P$Q#*h>c=R~FRi8N+NU445wC2~4PUS;MEKqHW~D7L_7!r^7bt z_rpo5Xz8xU^STu+07b|p^Rn`_ERCz{5;6p0sG+@-iKyt{4X+)(eTTSRy4O-UIf`B8 z`wCphPcTH@czjdDIIN%}bB@$tAOaLx-KS&6M6n~_SRo!>y9f-tih^^BI<3r{iTPe+ zI-4y@D6U{7w{IpS^QoKkZb>7PmaZWrI=G*X8x=rQigWPS?4G7ey}zH8o*vrTIi}5O zP_}Y2ad_Q{K4FN1*!GhkzQCOML! z{4tT?dWmwL>CRbRMS`%M0rf7-W2Jy`+|>nQ@N+nt_CkH1L3++=sLpXQ$Q~ojU-;VT zWqb&k4~~+k-$xMH*o5-QogZwv4GRzFc!r6Sa@>Rr*q8qS?5-_3-j2#-re(fA8)lTH z&_Bal+YdTcUu@sYx=9B5#e#rWG{5eo(Z11T{B#+UV`@(8XS*O~-(QP2e)-}9cseE8CoW_^lfdK3wZWK+!|*ll$li zT-b)^VYhxr-lFtw`z0^clMKm_D@ybqCjxGku+NWn{#MLNjv6io182jQ=h;%nO+0D# z#_h~jj_Rh|r?KnJsU3dbmB&R~-g8RhwNGLfBz{R&Ult%IqdY5BH*U>79YDN zDC!UIv(;)CS@)}{yAbU^j_m+FOXIY)2$?`;6LbZ7i%yvKXL(3 zPUVsYvrk()uP~n)7i+8W`s(9mW%_8re&=&}(9eFD?oEXK0ClcZnD|D~S%KN;BnmvQAkCmAVdp}nEes;mu?+CMl~es(P-|3%k@ z4_0)#94!Vjd?86H88OeFUB-`!x3idS;3P1w&b?a@{g4i?OS9zQCg`6nZrG1$jjZ7Q z|9}r_(9Lpuf4p8lZZBMs4IX~M2g-au2cv%&VngBnXFQ$0dh1;3JK#E3lTPNXOT`f5 z^lJg3lve7pr>T-04$)34ChRf;-P>D(j8YYr3%VnG&g=v< zh~86@GsE11G%I-Li{8$KzG0_;hg3UZrZO-^uSP_yJA*(&8CDN%S*obQh9JRGh($mN zmjeUsKbhW$3*Nx&`ygs6BP(W7lunu+JX_0mJ{Iq^9F7?-VQq1)>)>#wdX0`X?-@P8 zDij(KvRAlKuzsBN)|iaB@J#u9d|+nRwmj+{qc5DAPhhCn$hNH{BNbKQ=1MP*4x-F) z03(UPy{Q|>m{~~vWaEZnHI!>l|094O6+~mbTY>3L)sX~buh6(_D`&3+!Zt8Us80$K zwJRZLnUVigFnmwPUEzRit9;6$T0S>dS%i~Gmnq49tP-shXO3NZa+;p@6BQ(YJPtJj zeVCfVYjqY1nQP%A-3?$xM=Jcl84VF@iZKF_C|nOm=jcmfcOk`F8lB!UDQil~K;gbQ z3SH^7&fot|K4t^xJ5ux~*6~c5FAyX_A0RHc>0s^)#8TLp)fgxVyJdK`4EqWt4yiWI zi6NZI1ICrl=Acc_q0<3^7io6hGJc8LLd3+efL+;FIc&qAx6t+2+Wn3T$A&SH-WtpQ z#R3}Fp|BmC!u#x$`jngOsMPSw*68#5kJoV$e)Qy}$$$cL`Kk9E1DqjL(+l^6nS*}@ zQw)^4?SymRCiE6RV4K9LU3s1SoUIsM3@ljd!z7i>(wa8zx5*40U z>4-8V_?{dOv662C1l`D!q>xl7J_1X(!PuW&$^Hud8LWWHL7fbCP@uFSRm2E=h!fs2 zF>xda*d(m@TkPyXat{y`nnIvg=VlLG2pEfAl2cL;YWGZHUd)sb+SntkY&wT{u!2uY zGN{7B+TY29TnJulgrM1E0Ll9cAy>oP1G-HwRe6==AVql`!(uvVejC#b_{rQ-XBm*2 z!*I-j?Wh{MM759YJq@;wKGPD}Rs)kAS$_O?kcU}^z7B2V2Pt(757-$j0vo7Th8p#; z3n?ezP#9*OHtY+8=zP?CGnA!ME&@rA%QRinUz*!$8Sin=1810Q>m9kmgi*6@khGxV ziQsbV`0M-L>QQMUVi~qiSOZtvdNf1q`ryL3Gi*O&%JK}2qnHaEdSmFp0nCRkHq$er^_dpP7jRB_pb#{}{!% zeFUFHhPr~na6~Pk%uG1qHW#F;6kBdta#n%!*jsmR`z88CfL5wiIhP%k+{7TS4pRWT z=Wsb(+e1dx@eoI61ioV-l>xi7o&;nR5Pwurb7nB+Ku~3XHS{t60B?7BIj|6)P!9=Et-q(D*M|laG40fs@qcgw_vjEk7FO@AY(xO zH}0cw^>0I^3e@1YyGAo1@b$HDmvfCieh`b^CNf0(w7S6!jas>Sc7aBH?M(@^cN!DX zY#~t%b#Jks8-xgI@^l=h$#!XxDP2xCDO}^iwCLPf(#e8ReLz%nPFA|?8wR(D^$bP= zY5$g-%d+}-(uf|Bv(wjOD(1W~lp=mct#=FXr z_uJQim@a~dPg2QeVnoh~o>DL+D?mkooH>N{QgM>to)maJe zR<0#kWvz+xDn0yVc}kGI+f$gi*A%LljW;|Y+khkj&blWXc2@HE$SE{mDD?ueaee4+ zom@6U&5;+7M-ddw1&}f@*rI|;4#$uJYSZ2+Q3MG1gGZCs(<(ps_^sZ)0flBc`8nn5 z_%*?J7*d;fc)d@44B=+ERxsxvmdWL_(L=}{72m53;PO7nB$~TC%ZKXL7f_1mNs{?a z?{1Q*8F1k^r8snY3=mOw514w+fS5S1VR#5ZH}l z^*wS9m@-pCHHSXovj*{N3so1jDywIU)0|3UdRpaAcK`W0RT2wV9V^OqxKHrUh2rjm z?Q|QA)kg}&mhw8H5_7|)UU$~Zc`IyJ+jrbE?aQe-5`uM$H_qai%St7pyNSzcOYQhM zkO5Q*We|_akWQz_T4daDDn!+TU4NyNdsYkqP0r5nSgpx3pwj_Y904hV3KLOW7Uu?| zu70H|VTDp?I;A*Cw5r@CA~4w@Hy**E*2Z6P-u+53pl7y72f&>=G;6O|Bum8&HOztQ z0p8mz5Cc1-6(yf}U7D)3m6qB0R-ovldVm|2cr8#KR6;MRaN3Ve(zc=M?BS??F-!R& z%L`pyE0A_Ph8q|r-(zcTgUpN3(Oy}F#P=-_F2GCk&ubg4gjC-=bCSx7uNUC&JTZM@ zO1bmk-78^Ktil_}6SNtN)Y2)Glt8&oZSk|UJEWJEeOGTTT3*(qG&dn7g+#{wTs?;} z1Z+3d^Kxlm6ZBkN7ozXyuPY-gWsx4ckb|yGLYO@} zf|aB}#cf)nKMfrW4JFA~e6p$cu{)VFJ#zqUh`^W1Unamg>u*g7U4HvUgQ@C=&Pjh5 zu-4PPaqf!NYg#t?3^-&YAt6-ca%Fi)=j;65@jwK1uKq(+$;$ZO0JWHy82=YJe^^^8 z?w}o^_eAX#jycUPfqy6rU=7r9!`M~;_Np~m>bc%)d@Ir6sBd>4E_kC>>#4Oj#;iGkHJJ=wSj*TFr z{{HzFsO2^j(nE#2ozgq`N^9~uHT2<#cGvaVo#nn(68C#sbsNJ)n@Zn5iUqofZg+n- zayzdLj<$1vL%D4**ap}BUM=<7gAy#;H(v9FdyI-jat@)#MtkV`bJEtg-RvAdM`@35 z7gv`tVIMZO5iK-SLsd=8yL|gTbpw|``Zn37Q=9s-V<+ulX8Tj2t%DA?aK1mkm`NhP&{wP}MQ<Mip|ku+tT&NA91R-u4~#TI3%oN~5$=sDRyeMFLmQ zk+-gyz)7oG_3(RODEeBG%Rp3#^T8llbn+@j5+xDhsc2R4qmS^Vc zgd=pqGt(U_$jxS#JQi{ zq#hplJczo0X3Da5&rQ9(%Beonjc~QJI_1{eiPYgDU2Ce-NSx+yb6uSkQ$0$=5|}tNM4{c6(l4#0Vb_?pf2;0EBr43E zui3dYBBV;J$g~&OB8gvwKy#qDG(7Jk%v$*x;T>J>@%r0bw}yXgn6^k0-Y%$3Q>Jyr z%$9^>2#wymO)dI&XHs`7`2m0zKro2}uz15m|H^znJ~%#1nP(7oB4 zCu%InOC@U-7M=;WUbfw4+;V~GGBnbS`i}*Bs8gJ4(1n3+aUpmd<(Fj2x3pn=X0<@* zjdj(|;C_aw-#vDra>Avl@ULM7%h+W2%-yFa)h?8^qt79p*Y+*uLaQ!>=B-M{bKUHT z_NxJPS7v4^mTkFLul5QLqs$WYF52f#)i)xJBZ|+tbQT_fY7F=f2DU(Sx~a#=>%Ila zW7P>!=8k6$NRY=TN|;EI$GZ)cStj;Wrjmlu&uvnqmolx9XV&o`T6Pbhj-#-sQyC4` zO>#Lh)!IxCYFeDO68vS1?85xUKNqL*ywfl^*|VASFN^ zL79Lt!AIIFeWC9xs{LR>Lug_sg=Ka|CPR!tUO6#ZA8T6^iny^f4p1;V-_ zvXC??5th@?w$+YQ!(9AIc&XV3cQ=L%DR=mtKCD~b;-73@BNpKNvaA7L8ci@z%|z9V zovH631pjotcY;zb>mh6^ zWKhyv7(C;!Xe{xGJ)R2@RB`B%Y}7HrdhHm~tj8crK#2%*IvZd={X%dhyutE$<}weO ziaO$(%3yZ6?CdOK=`kIC_+y6NFV7>khc8a*@gwd-7uw}nBa9_nAq}A&9ONb28K&7C z=*7~136o@$$9vcPO27;pU~+{%c>F`y!E>$)!8noGeH68inaF{OXl_be`5YP}qJJ1z zrBH6e?&+tdo}Sh=4WD&u`Ps{Ag`s3OY`Ws`=C~*D1u+|>PD8}RVPIKg*qMYjR(}&t z-p^`sx0*d*qBbAQJgv<0RCo^a7H=x-Fc0qw_F^&YyVnv-f(;vRbr#9Cf)K}g2t6M! z4WCs?$F$}$PL4mm8NrmpWxu=g8baz7BG$U%o2{!~34o-$@ds+p5_ISY7Qdmnm) zv5)^5AGnT)W}*zQ;rZdEAfH75^~}^Pqowhzu6B-wWPwL`*Q^aMdhFkpR+8#qSD4h+ z8o+~U{LjMY*Ko7sn6Hwzw-Q0!{m53eG54prpgGLsPs4U=Ze8x;9k2tb;=Xe|bv^mr zT{IcK!s_0`pPSj%hlfXtnN<8b$=t{bbsu3o7ur;s0bqr9T3nTc%?UIvixw(*SM-GJ z1Ife_qNHo2v&p?)4WF7CijcE)d4@vlTxkO>To$QR13V#1@e_WJCFCUq;dyQ^9dbH2z#VLv%>=@lu!eI}-A{lUMBr)*tFisg85GBU; z7Umw_`^*dGvIOZ{)COHn54uj8WewI0Vg?{iy0t+%)%+~deC87gBoKTE{-p4~d}NbY zqrt3os4?ddae;)tsM^!Ta;NM5WYu<=VOoX|`C%7rD7X-k+Uz12(5LlgepqQ>`g-ba zPq%!B8r%YnfPY4MtINgL-Kh(Kz|0$o1Da6+6;Q{59NzeA3UT;uRp(8(4?K*4guP30%AhCfw16Cvj#;4ciaX< zFR^-SBMs==U1)(aES_kK-mkFx-Q0^i51@OjM`Y5Kmn^SgkX*!*p8cmDv^9IdZu}_? zSQ=dW_1B3Q#CW$NB)O_AQ8Ik|1AFG6PO-eC47X-I=4G-$cnorKPXmZhNRlqS8b!M$ z?6T1SJnNdn7R_ucc4mHnY-SzNDPxB?MPU78d=%EIDM#(IZ{F``jwXCW86Ff_D?so- zUe>MJu9kok5}?W0d{r|>Q_>@*UA`!3>hl>lB=4Tjj(pi^>2k5{-z>y*?LE*emW{Mw z7jD8z!1#hDr*$UWvMI+45~zd7Qa~CmP!qCnohCFRTn?M-s-TR=0l_)RRp73mR-g__ zya1=8ArJKzO0r&vaFB_-(6E3mgc^`Kpi-V3wN4rW61O$5IBtdjnhu;Sw=+L_j&(-7<}k)_VKIN9sC`OPX1>z4$w zLHKH+=$j9eE2wbFm~JUyvF1r5dGN)aS~`F5{1<$&umR70kkq=cM8dyYOfM4)_WH&3--MtiTJmwS`Y-c;W!kr43sJMVo>Lv z2(OnGDy{6~l3rf`^_XR7;OT-UnGqmX(4|{|_pMPkIJ1l58u|x_jBkYa*FxwUafEL` zb0M!BR3cvY#+$pI@U-d3)mxL(-qm?$%iJv6)%GvoxL&Dz!Xv%r!^8(iF{VHE8A=ZE zEcEsn3s-}1&&dgyc$3s21r7^@*m&%PN6U>8f$mG=4MN*Bh5}Mr)J1q21_s^;67oXS6rn z$>#z0ih151h2eT$>QrsBrNP%_c6;9?}ELZMaf%SSybaI$~fn zbJgH0wR~2?w?kXkH_G&L$o6=N?sO)RP=q}`xXeDdM8bj&*AJCIi1!$-{WY^ zjnZ|1c6F2WWuel~5t1JZ-p@w*NN-!mPWdHPj60k^*+3^gep@KI3JitK|I|XU{5LHW zBRl>7-)8^+z$u8D#3Km<2B@J||1>%|x(T525K&~g8`#}{>=i{)^DfrpcEG~_-*}2) zLmpWi$I>0L^xz+`1kD6bT*Ptl`}SsTE+L9LA@0=@V>nR8;CZW&v(L<$G%{c`gb&KbMRGqX2*hp zA9KL}F_6g@4Db7G-Cn1L*_#ph$Ic!qP*o^{QRxas=yCcfepp7Z&5rCjCw<&&AxH2IiUz2t)W{bHBIYN}g3xbu_y z&HJ_f!kG2>wn4Wv%O|))PZxEZ)90T_Q(f)VsRZ|rt~2B6e1nRkE=oo+L2<-_5-ra} zWxP3lG?tRlOcfqWiwVn4WD(PuKA_DQ!QseY&y=Lm6mQDsnW?U{)?iulq2eG%w5^Fr z{tM5`&TfQ3mw0NvZU)LfH^(U{q3IUxS3>r00q?`PS<)rtS3-tLH@44WPGA9Gt3{6w znAJA2kx+Y6DgDvut~qsK8RNtfG8rrUD7{yMze;x5O@>8Z^K;Z%F&^@Sqzh%Hph zIqHe0x&IHht7qaOjr`!IzwYCHaYmBH>#l)rm2-WF-gc-OBPX=NTSy#jUi)@y+bVQy z5wle(7K)fE-hIrZV?Hl6&0*-xT03*01`=zS@&3)BR&rhDQ`tbWKE^!kF+WF~ty4-A z{^NcOE${urpM2=g$8%FG(V+EJ&kKcIInhu4@JskO5D8R9MH}U#7>OWE#YN>J;Eq); zt?OOnam9PWWS8n1Gb7d80ha+`I9_Yj-cSnwAW`x}Dykhi(hmQA(XzR>P3zFHiBg3r zD=Pj>wT!PUsD;&7ITFeWvnuUzWzQTnh!vz1UDGz#2G=GR7wpo{YFt6n{2nM#jNeX3Q64X9ct-;r!J#GYaR$~`{`S7(?m1e0=7h8-UK-2Y z%oQ-3)Lod?eVc-9YxN@b@7R>;{?l>Ic7>YEUb;x#{!d9R7}T5Fm-zPYw^9MOhV_I} zDBJ@L=1^S2nXA@jNW^ls+?vF3%X^tXc!i;hZk|>iHiH_lXddLwMrtA-lI~(Rf7;}1 zS;QHWL9QP^6qwuK6}R>h-io(AAugx8GV6VfnBrfBux=~g+jSI zhBk_>!}i$VLN(W%j$;c{0|tj}C?j~gM?jSsnD_@w&@U1@?X=yu0k)u=Re~C;?Y9-l zq+|nGJrJny8D}VWNB#^%S1`w%+uXv7oU5W}G?q^O0Z34W3>q9baCNVQAXH3eAOYBf z1cwoa+LM-`9Otl?7mTbgVGq%PQj}G`6x@AU#Iz1-C(l9+E-kLsr;&;}5iMXbTzb_F zsNE}ZF(IE1P`Y;bqJf>izyU_>bSMJY}BNSnDG7^o=>}*@~iTYJT6Wj z+X7=g%VZC2`p|#wRQVT8_L61-6V6YLtZ?|O^^dCX{P3?rPijq&A4JjDD#(O2KXloU zf+y<~i@*RfuSU$Gp$%XSrH z_OS(c4`=JH`r-3;NIA)`MVgbcy9DjS>XM_^a9bVY#9}&u6o;QQOQk6(Go-26yB1Jwoa3 zRPFJ+_8&%SFtLzHNEJd2!G3*-7IHIv{J0Uoxp0HVDz#Y8P=kHxP%8Um6q95h2H&l! zA6f-`WKc%k$}v)Mz*gdAPYuKfW1Raa84{6JIzHdy>Q)C9zc?tB7=t z7fThWKQ2Vzmgq--m0*NtsA^@diyEf9A13zU_Qv4TziP}r*NzeJ|LJO9=sctAsoV*|6hPc`yXk~J9Onx zXw;7|uXqc*BL_GS0s8LBMnucf7w?r)APl07i04AbW|#mvo2(@kTxOL}+=BeB=w5%PM)Fz8Ik|F)#SMuBC4k9@48+CE z%~|a_s>LenOU7*Bv%*JrWs{p;-pW1)l)=ln{Cx%a?U|6rFQR@q4n;vM7jPiT&JJ438&HD?C-f z>9@eLK!qjycI;9?nU@zJ@WI2Y(7%8jo7I=C5me`Ax)DkUyE=(vPuwam3gPbHoBB7% zE^sw#b8nz5&bEJ@gA^1hZj6%M2Di49^pCkMv{s_WTRA0>TnGR&X9N0!W35I=pl~!s9yjU?@(qU z{u0fc#d;qQNo(^G@Lnqi+3=d880f%^Tx{pSuunh)hAx*k0CEs7&yF|1!7A1&t6sVK zx+tDFVXx;X%Y%|W0`9_gu)J;OpjmIgvu3m7LcNuRC)m78ZZ4@pK?zu6h0nq098Zwt zwI*zq$}omHhssCfTjCjF!a5 zA1(W)>=XPUy{c2v<$EX)1Kk{s%&=K)XAsyzN>DKwH54R$wC<_c5C{mY!GIS24)WFbyzS}xhSr|QFa7k*3DIUlw^j?_V$m?Ay=xItkSrkb~* ztMsKXFN|5n@5U{3=yt|XP~R^(GF{zHW2D&?+ykY7ad-BEpnmnQumtI^_r4hx+mo-7 zn<0-{5p^q`mx;<;b=MFJk^35efA%t7?xoL2z6VA{OCi?r!u%ELRb<2-YWtvK)2EU79kgX2V*-GChT8hz&+kYsZ z+5W2y1S8A;NAITD5lh^G@brZ82As3+0}#RpA`UgCWx*{V>Y{ecscAGicN1ld4SlST zvz1DJT0uz~6wQSj#PP*&CXwRj8EG0xFiRna*OwNcH?d>aHQV=@{{6|uXTf5Y^7Lqw zv)!Cm6Pd)?1Z(Wit=TXm0d)A_xO=cX5?^zm+5P0^>U$e9Y! zfoMrwE!=^a%2(Db`_!bkD!DgV2Nuig5#`+)MNn{}UL~7obr{yq{ zvp?O{v6`}Y>;Os?W5^t>Nf#rA>c!f%5Ogl4|1GM4TMZ>UCQ0}1G;>*~SI>0@8pKPrZ%6*r8x#*rdgbugki(z*WLs<%&mgE&$Ef z&>ZB5?esWe>A*H<@u!b+NknAs!tT^Lzq?v_rIC}om0UeZi&s9R9P{X=R>2iV9rEb- zZ~7os&T%lUOsgU-P$w&D35JBj4ZT7T%ahQMn{IK|L8GG7pxVxS1%7un?mUlV-TW-A ze%chI3V$npiG?3rMz=izqnZ=Cf{p>qilmlN3Go!$hP1m)j3yyAMofot$6O!aL$0t@ zb;~B~z$1tmLdY7q#gQFpkBvo6OWe@U&+C!?tr=aCYb@(Aun{u6-$@rh0v?3gu6^kcbX8UMQs=TX@X__0>=`eHg|+ ziC|_^_?=y)ul5haBu(wGe3K=hiFc5e?m-O7Y0^KHA0Y|$NF0VK!|;uOjW*zoEM+Tk zkD%2C)@#lAM4QO}iWN@G5uuNgr49ZlPW&n3#X>IbXgx^{RmT3^`q?=a?@n+-%NJT2 za0ep-s|*&$AKr`1#5!0X`~3bmWWg0RpxcI?C@jHjK=;UkXrEx3CPkEU9a@rz1vYUZ zb+C(VEo_By{so`|?I;Wj3|f1O_K|yIx^gQtwe41`lIQf!>XO9mdd1Hm$JmoI4LwPG zXCCX@oH^MDzhm3aVin6?+bTYnPBxb4zf(mM6Cn1xFubn?z;6CoL?plQGel3|%_F4X zH2nt7@z)fG9CA$$WHSKw0{FX@MK?Tu%E5c%}pZmK;hso(3iU4?6zFX>HRHg~(%RKU(m zPJn%s7v;hSNeAH|Y$KO(2{FZ=nrSZ@JJnAo>N|a|wwT=MJYZR^xTZ!YWle@M-Dnha1 zk@B8z6UB7uy+}M^&YFHC?*$mF2Mc;Vh^eg@mZi@v*#k>~!L}!CS+Ceu?Vd`^x^Hrh z3ZXy%*rKBOZL`{XL(K@89fS(0tP=+%7LZd8?X;Yl5bBM|goOnG%)>DTt0sJ2ddVD! zz7I}ipxlU|)Zkg|+S*HmKA8bKAG6;7%rBfhE6kq6t)9ICibDeHZ-t;u)2+Q~Y=aTk z{8#r5tOAF%XjK6xJwn`QX3N)Nd`@D1>B978>ZA7bBqHS_@#KJdDF_t0HzpOGi)m@@ z{hg42Wp2>io&f<*_4yM4-B4-&Z`2s#u_Qcx4y6Nq+tQP#yd@?wGH;&U369w+O#d9M z%MCVBI5mWiq(-@j7N;#fo{Hs^X!kOqcS@r-;X4#NklSITLwbp-fj1XFZIS4+r$v-R ztKNL=Z7(ao|90QFn%9q*t$?m1!eSDos|&rsQBjln6b`7;San*+?S z8XM1c*FV4vY!k1DqPQL%&h%Am6!@-x>+*zv>^jx95?W!(4rtRJOj{`~*Mld*Uf#c; zt^~8yr>u<^;%YY$f%Df9i`GDT1uq^1oERdcxUN40a>;vhgwbXy=^mH0DGN=nYcwva zD%Sa0>#|`ITR=CzTJW3lqwKZg?$5^2*c0EhTG@-(I}B{sk@N@k(q!xb=>4_ZV0E$q z=k@~cfDkceW~Cv`DqxGNw{x}Zp(NXl1UM<>t;s@f>&fq}>4%hR2zqB^`7iDUP@sDR zyj9DmDho~{E*>PUU&y`|h)hOt3LxgapiiB6w}i`xqH9o$9}UAG&7>a5V0YeFFWuK` z3ruQR3Ez7F%uVb0qV0vR6lUfCt0xI2;m-C^b{XD9W~n2sNZP6?g=ix%c0lS_MzOLX3mX<_jWo27kqdCtx>f}YBe zsjWZJZD3RH(cI{Q@zV1~u*ix=2(#6+^8hZjihQ~6LH5Q0_d0JT-ihGl5VK!3<=nW< zRn?7JUvaT#@22mdPCl?=+BqeAP`NO;>@#P0T3!{!Sv+7mASAxpdqS7=i-ep_`>Gy= zeqf^F$;*kG>+g{nF)MYKnBPpmo^bS*V0m0;!~B}?4MQ_(WU`LyFs$oxryycWmZAOZ zy;9q~HzIrXVx_WASBnpruN!Qy13=zz{cHe5owMmVUl`J|vV`|P5ZeEj69iM|Fm6jF z{tQ{^vH@KmT_Rhky4T^qO{oDVyP2$1J($a^yZuX?)`Rn%Z`#Oi>HQ59WF<{&lW7Bj zit5oJ&7f8KU}*KisRS-LF*d3mj9siS>)onL`h-8x40pyBy~J<(d~M*aKi@?6iWHf$ z6oO%Pj{KiA%6Pxq?tiKU|I1M-^Z&{?w`h&WGPV7tQ7GO)g`M>L17HCSfjc-dwBm=R z#B-#)>*;)boGJ*TtX->EnE0X_d|jLDk zGM<+Ye00B*-7YEyA-aJZE2$l^5O$ zs+HU#OmD6B*wg#YiXW}!`xqJuhkWelO~?ehP_j{Jfx|hDE27=Y>x%;Kj)?9dUR{^= z@azs+X&~EVUP@K$-RoDIh}LAZ+U?iRWM7(IoCz`NZw^HvQ&=>C9W_vlfWtO9#_wix z^|fsCiBOO{(L9@uyXWuhBPk=91Fs_w6wA1Xw=yr>$>vIGl)@B7%%`%*dZZYn_wgkS z24jWz z8vklDAYGK!>Xr$QWSl{ZIl^GF4OGuf{SLn@KPYiA$Dz|avm`Ap10w;GkRq=ubB92E zfg_lRu585OGH6u5UdH;%M9HgZPZC@EHjZfsHzx&noTh#TGhlIEs6UB_6s>hSFev(l z%If`j;eFqHlDLpEIyVOGyfeQ^ZPBF%(*x(~pqUswwlO;+wJDTBK{&!JAUa}UV7L}? z48vNnF_P|~(z0R6C6Z@ESq-H=L_v4&mZb$Qb!D&hE$t$3kBW#wKCwk@e&C9SPCEZn z4R?eUlD>4mcB_a=YZqp`T5lS#v96o97zmxSa7mC(6ka;EdrwiswZE57bT8ntztDj} zN`;nF{gEZ`ilqUtn?6weL%+3wzC!k`_>aIb3TkC6pj?SQ!8>^W;=T-2Ev|nNF7iWq=4gKub^2%&qaRK5C(W2tGB+g>VVyKkE$^-Bf(BYA)Bq zCiluaRT4UPq7v=^HVf<M~g!w{Ea___dSF=858*cpyo@@NGQmU^y; zoO3A+-AF8$&m){eq{dWo_+!A+DA-E^L-8r$_Nxdo+9P;liCxMRvQ5EEy_s(Z;>kH<%3yagOh70=^9Hb%`N_I;X3 ztoK~|JI(Q{#ZWxEH7qEfXJ&06rp;3t=2L7Lk3dc49!>P+lkg->r6%jlI6*|*6&;|d zFuyJ_X2}ij0WB`uJ027B7~csm^|8c!I}uY4;y6t3`p9!da^>3KACN$OAf5IcuPbbn zY#xSN!fa!KGX)9~$XBaz*x=Q+IS(bSsu_QMlS*KEt)K5Fsh6iXcvyxc9=*)@J<-Hw)0A3mUktIv1zRJy>#br^G?UzOss`1CbpaJs@)$Se zIJ_kkpVy~3Mk!wpg!IJq?a{dWt-(O#^^eEXoxwH{LFl8Y#2Eq8AgwARt{x`J)fBbg zW}3^P0L}zmQ{Yg#E2e(fq(}^{aoCnU?g4m;r;tK0Z zg6BIs9PwTSL`M4@vW!i38sWFUD66L-IRKbYDVwPrOt-#%z6Di`6Hf?zr}HUc4XWlL z@O(h400Q=rQi*?0JiK^bXI~qt)Ip?=Ikbff6kS%^sp2svOHGzHgq4j~;ieJkjJky5 z^6hWoop8S`lGmfJgq-LU(IPeatmut-(0k=kwO@SE?jr6(*~&i+W%Tz;bAsS2y z3NC#vf{Db2)HT(U^{w&qz(j zBB=7Q0?~`gKPP;WI4^m*)SoG!p`#|dDj|peO%5H|fdb%cTD)qD+t9DdC4ZL$gsscs zM;d4_)kGR&mIcKwq&=p`7SVcwZvK1~o-0XIkBxoSzu8)njaCJEt%hqq^mESRB>wLL}HO37327g7)4L7lmHn|G) zUuu_)V_c8zaBFtH;1rFpdbNS}+I9ucnSoVmff4s?&j_^;M`<8Wo{9Nh`g0hs)0bpw zz@b5^1OE>5yD*6$zm4;3Caw1xH|Ab7p9?3PYz-*m!x zhy}mH!^gC*)Q3<{=~cRx8yh?r_@B@L^C(~=5MA`O@)dioJ-!sY!Y=*1>Q2zf|Cvx> zJgEQh&~CK%2g08=_LvYF4q2qxwA(!`b5MuZwObRz={y7aD5Y)9sX+xjm?m;NJnbrf zZ*?yJ`@V6MQf%>}l--6RFwJrEpOL_-y6M@*TWk!QKQS5{3PRkIHEWFu$RoG4zFE+@ zz=^W~zunSDt{+xYME38cb!-zd3t@J>ydDAL3Vc$gMx->-iJ8&CYCy@gX*W@7V+ z&AdCq64s?x+dq=>M?C9@o9rwdP!DDifb?Jg+JnlWWf( z=OWMco`vt)t?kRoNu8I}UO-2+-+ujRlC5g_5g@l6JwT^hijOI;)8V84nC@-T-cf_d zq+O97PawOZc%WVI8uz=(|7Z;lKG@BOs@67%acx7}z<`mC2 zFE}I)&4F34{2kl?*A=gbNrv`3T#Yl{~hts_0Oeo(fVI5jjCHZ6h=>EeWw3He1vq^m?UaU zS|2|vkyeZni;mTIplZL2m&nws$0{*AJ#3ItfPNn~mRdL%JQ=)wphNhEuJo|~*Thwg zTk;nq^5K6>T#K@s)XB?C&lVpJo@OGE=DVyw>&H;rXkD z${#=V_`le&jsh64IpSg|uG6K`h=9Ki;Sy2bx4H=x&o8zqE_d!v zh1T}TAAH|jSSO|ztiE3}53y&d6vkj8Q$+3sx@OztwtWUBT+k;5}qe4^@62Lzs3VFnl{mEoP3HB%mK5J0f!O3c}a*3{R4p$p6mCy9} z490thpB5f;@^#bZMR9JRsF;~ll@s924tzhkGny^dN(UIr>774{Ft-fIjDS*EoVz+K zP^3Z7Wboceg&30M+}x*4vk?;%HfVXcwyJD#L)#JB0Xs*3-&g~1+Xeg4zHeS12CIXxDQ(5vFm zzc;m@^o|*m^EG)bd1c4XmhTI{Dz+7g7G?|&*%bG)x zQ-za#{VRXfHew0ywmv9$43@W8TCr=QQiDH3RSur@*Sn9VS9R#H0+KL z{Kp|*F4S7Vx0^IPWT@#-0VI|C(3r@vH+jH&w8_{8boQii`&eSiDqZqR~xTj`_k^ z=L6cNBAl~l*7He0HGJL&>GTNT+=@Il&P*Y_j6ft9zM7_Fu8T09(zX~cnu8FUU0uDo zof?>|#2xyfyy+8{@+sp)C#45IXH@n;eMqwxaY>k<(NQHjh>GSm?j9lC?4>CYH2Ngi z*>Lz(KC(D3Rf0x(HGR;f5%-_*yM@24Sh;Y|?Zg_xdM4Iy&P)Ybx z>95nbVANP#?nn>kDTS9lpSYinYm5Ppi9#_3p`0m%SAKDIzR_6vHN~Dlge#rG&?fa7 zptKsN)}3odP>*Z0_KD}lci7wR_Fgl){RS54kc}8vs8qzskO`eWFl?*agoWXMfkfzx zkf_>_+zsAJG1oj84^v>^Kdp8k0ZwVt#oa&iNaH{n|7?l7Hv4ScR13`lLoYw6DkWa} zRxWp}?$f(sUgiJNW+_zB$DqCfs>>q|CZ{dDZEiB_U^0U5ncrp2V%?D+TdkQ90UJIHhMKo%dxOBJEF z?YIVeJN)yf2puA-7Cqdea3WRPjs$*&BRB3KAH}bKZ(yD%WSDSd_RIdX z2J7t_0>z{|-o6+1RSaM24ZAF9owxtT15LqnSTKT8ue-8ZRt&dtssijCwnU3i#MaU*l+ zr?eM31PD;l8c-?=9$He3raP$~Kx5l!E{7lSSTZd!1qX&9x81J32WU&3rL=Vk0bLEp znB)xJ3^|v<`#lg@hBETqK3*j@ceqDb2uz*UEF2oF4{UWA8_h43$)$pOB7uooga@0a z(+PA7&7;P-;h?F}E@@_(lcZ5iHkN{5@bgEM7B<8b+8lDY*Cqr5vsEA0qr$hSZ0EDC zDutfAmKwb76)a&(O^@S8$ep9fzKLeaEdibUUTKD@s(f43SBio4W=u(S@1^Oc)heSl z=LDti^rxgOH3ED&JPx+IP2@nuWO|OM-q6Lt|t@m0+*L6fWuvaeeU&j5&UEl#8aFU5}dcE z_4Se3t!-v&UgJ>J7~X+5kA?lxjyb5Qmd=&Y-}P1ti!cIW^4=302SGA$J3s$@KP>y& zqd8ScM>N%qe~=S6=o#5~3DfPK8X-&Jw$a4J_K?JLwoZRNpit)r@382AOMg@k*cp9j z*>rbgzE#nMs?pdO1Jo_JZ7`KBF5sR8i{VrGYwwk0HpDqUN={sf1q!~_WFIx1F&mmy zw(n%>uyf?a^1X0uy7~@)p}!WJl-&B8&a=j8;wMoh9Z`!@trzux-Ua&K!HE0#wpF=D z-=hafk%WK#)Pk5asHpQC`JLJ#-o)bk9!~W{we@E0YP;@1Yr+}Uq_BFyS=je;$;+H9 zg`Q<2BqAQ$e7clh4B%WVPB zBz${lId}F<81R2yO;z2HSbujP+XNg44$hPnMtl&u-HQ^?8M7qoy-Oi*%A)6^ojAdS`yMYb{GwaFW~I|bwT1nV|0`@M>k zK{H<2Y--Clt3b(p{Pg_GQuU9*qR?zXQNzR%mlY=Hi3-f)qJ=;2pAHk$ z{_qmoF|!R-OQ%EI!hZ1qAHn7czrFdBsCB+G{*$w;^k_i+es!tgR<6Km%&E>QwddZcDP)OQEYI ziNsK2H+x%iU|Rh=&k?BrI&1DbZx5Yam$uCCh_VqhCa}QM*3Dfy0j=51;B4PtbRRHR zi(K@o(+F(brv1RKR+eO~&f|{Btg_t5N#4t2>w2alefL33$nCrJa>n526IyroO_hwY z25+P3U(4xORa=M+$csXX5^(crQ7}_5R*x0ho8@{w+`Ka{Ay=AH{<*GlD}@W7Ir6Ou zy|gD>)vh%};k;lfY(LXWMk8g`+o#*AtdM5Q{8lx@5<8z-g?=XSY{kEFWVByT8(&b7 zly%CjHAZXAsI53_gt{-bYG1%j4vmuDZ0TDqxKL(pvi5<@1+AQy^e^qy@VmA6iEIBb zsM_mwPOrKh|7Bi4!OLOux&3F&$S+QeXMx+N}2R;RaUm}Uo3EKqvhFt(?Z1k{#X!};D_TN}eO3^NjYT~-wf%>B*Gu_-HM zTO4}|d|US@VzxX7pwp%#E24?CwKZrD6-vBEDAq#PQz86=AVRh4n=~QdiMZj~*}Znf zXRP82frj-0PZ`82VreLZTt5KyPjNwQBkO7}*MSHHKV#ZAbT0Q8p}P&+Yz$-a zTj{yvDZ5iEYP|mRGi*fpCG4wT5~`5T$X-$Yz(mdf+Rn)22-Zsmme+nlcBvOt(o!zZ449uk))P=M8LSiz zQaSh)-tVEzs`|4>@Uxh*6%pwl<{6OBVDbP-WVqIV6iJn1J@?u~I^!sX()t~znpK0b z7yd`o-@N<4b&TaADeoH4QR>ow+!38XKGxvk1g3izSHHql)ePx z5qaDyBXI@|$gd<{CP73Y(0YC{+DYEcPAH$`8|oX;TD{{Am_!KoV3P~CQ+m4V3g^_S zYb}2bI)hZZoGKpWmo34ng_lO*0|3@4Q5WZ#b@A+@$Gvo;=e_eRZW0lEFW{vA=}eNRut9 zU%2m$toLyN?{>;_sXxbfV&f(~@Yye!gV0XXI%d0(+<~f4KW?^v%A;YXRoA46a>$ER z1y8^5LUBBoUy#>&>pmTBe&|V)3;al z=EpE{qU(wTXTW=`U6-X&S(*n#i9XsVsSX|dt@3Z_KhY}CoZVC`ZReGmd07(%|68a8 zb3D5NXoPO5dK>;Qp9T$$BX2qLPmibbg2CD0P!UKsh*RpUmyONIrfK|T z8kr|qq(!VuDa#`N1e<5aohTRF@XJImIFpL+TAMFE=JQrIrg0?{zeBiBLp5w4kXQ>_4JBvr5I1ibPvnVmzPTXkf`1FtwXM$3gE{*)on}~X2 z7S^%y_hoQz-r!{qKB$d50Q7wft_bbHBZ#k}~W9Y7K&s`ts z^w@G2nejQ}9mW3RNSsGgZLpz|O#`E<+*f!ljp6xOt$Qz?qi`9`i4M=z1sBe;)WC6V zadPeM;!6#K%9md!1A`GqTm84a#CWYQ-%a=r_-S}vvQh1h$k6NwKI(?B2c&bh2p7Y$Nrw5&kMHBMtahvZ>n~Ggjf91oMc7cCnxD%VFCGT%9b7b!m2P>+;?7MFC`f zl5wCD+p8i=(r?N}ckP@@>kHE2pEMB9W&4i03(poOAvh<6ddibRBZZmEo2c4eOt|)@z1?j*iD>b6vdcNMrk#{0;7lmIsmm{? zPIq`iwhs^rKXz_}wokUF{baOoS00Tb@z|cY;tPiF7Xp34*4Faur29tU$XclN)6Yn&LB*n=l&d| zC@(32qSUh)WcK}cUZyj<#>z}}$M>Gz$GM;H4$t@3+ULW>YQTB6xxL3ezRY zGt)aKWDe@_#ZP39pFv?eN&uwX@DXv5x%NY`bw`qyh*|*C6TlR|A5^Ye$N!oIxfGpl zLU@#T)MsRN{5gnG97!Vihv>qsCA+_6>`gL(flf`(_m-9a3AE5pmA>(QNDFgsJ4Rz$ zvrFf9E)6NqsRm0HmSmi!C6i&N^Lg0l&=hgltOaGp&4YEq^QApXs|N~}z-LN-rsB2* z97WiDRS*4D-PjmV2QvfvFqoBxQrGEtFUQt`T1GS~>mZr^R|p4{ln=492A=MZ;r@Xd z-|(wWyg@1ltLFDz^R#rxr+2JpcJ9)~p4Is=L5Z*AFVi}k!EHPho5hbi7!(b#qKyOoQBaUj?CCwU!%5qzzqM2P4N-2m;U1yvdLj-7 zal)sDD-pbw2wU)EFPR(x@83k#)$`P2lrKqa_E8Cip^HHp^%s^jy485AxI$hlRb#k> z%>A?(=)p-F*ervazo3M4Sk;*A}K29ytDhXzU*lsc8SI zvaqvA4cx(D*rf}&W`Ojwj?3}|+|9*elWa6&NxbWiv07*g>KJXp#5htttJ77`lWS(-JYsNr+A@m`bd#g0u`JZ6MhW+s*RY%l#X3!9yN4P=6 z54kJ|81uJWTp_+$IP)f4cFvsGXK6BbuZU2K36GlR(4!x!Hsp+eX*1ua>NUYB1KUVv zh5)CS0qpZoOastpd~#o4VM-?zRMgQ$D{0#licEyi$Daxz8E?d=trcqtI_W*nAB{hp zE}QT<`vH8hw@)ZWhrV;|V?nhGYuHpR+n3KcqKdSdQBD;ZBxY0KKAMEt38Y#EZ`7mi zU9CTW!*G8qZp$7~VbX$Rv+A)z@A5vB73^E?YojNTNu-IDqup^J-p*3XoIW{D-G{l? zeV>pDgq=TY7fbS3+FOkH%rTi!uxK19v%DBCMtpF(DYhxjTg#r*R<%>--8QO;1-g8RA|>y!hCXD?x3kebJCX2>yK=T zAP8FxwU2g#Ugwm%!*X_w1zkro-&ogQ{$VE)k?d=Z(T;tR%rQI?;jlQWC|!>TGUOBT z`2-0irN>kL?snaL&C;7_U~<}?^PS)e!=W$qHOn=bai+*4zXa>_bY~viK&nA{ z0<}BplwEb8PLGLe<;3g5JQQXA)^u9RYENSIwk}&ALmQ{*r3F5w!oalpqmIl_9?GIu zNv=mw4>0$#o~4_ZyDJKjhu_PyE>AjTuj})0c&YN1-Rv9iG|}RmQFY{vu3;9u*O|~1 zuPn6ueOLpPE#FQ~o{#{Kjh%0@>|Qv2K*dyCiNR5}0NIk$m$N6^+Lco5o1;ThBXxL^ z*(2_^fKuDP+-wDD@Ovz!^(`f!d$WHPK9Y!m`Hdr$ad+NWk4pFB0_b<{16xYaRxewWvoK8O6n&obTReLChfyt;sE;+_za8l41~!s zVxt*&iwXZ2hwV-oXmq-S){V)C_-Ylc*T&`P;PEck9+fG-k4Jx9ur}LahEA z9QbVgyM|WwT__hjB7u~W%5r!2Vy#BV=Nhx4o@wWu8ZcO}CsQ#KBNW1puDm_A50}M& zHtdx7J#fef2xFe4jr>vC(XA72O&q$Hb9#dvEJKul`=&AWqg<#HnNEIHi;& zCa8*L$d1`;hTLc_^N#6OFNaqG(fFa|^{>zG5sbvbmvL7ZMHiV>Efp|s=-h~zVDUWc z928WX80DQ#)Yb5p9U_DqM_SU!`loca2TM_Y4!W14w-sK+a4srE5cW` z$3axvw8yz3WcYags$nNnR8!?&e8ry;wUP-3 zqXQIz;IY>)2I2}%7-}}s4GJ>tcORK%1Eo9{_FE=QvojyyIqr3AzK@p7hffzOsgf1j z+`4!06%XfQsgt$MOMZx)=xJi?z%*@)6z-ltX%nn zcHgCK>_NwO)4Kf%I1)Ke?Te~AO4f~}DEtRrsW1+En4hHR;VeV*bg_Tf&aLyEQaHE^ zxoB)=Q8Ra>`)D2JvA3oo&a&(C;>s>jfv-9;h6ZE-RW6RHIgWAa!P5F|F#hlp>zi-) zjoyiZzw4@+TE{Qb6t6S;i?X79lGyj#g=uFnW>SV`efTy==IEsvhvUWGQ7XEq znNjqEeKx!kIPchmVq$`L%r}zGuEg%hHhlY!D`0DLvTF?VyYA{qA8DoJtZ3y<-8~ul zEjvZbSMTZSaJrMbu+Cs%en|;qS_ojP&P`?X^Y9aSoDv?^yYTsgGvVV>(nPiVTT9L$a&*F8a8 zB&&`RtvR}>rXZi7Es<`uO&fLlUe@HRn-ZgxHrm)B(` z!#5&>2qQySr1_4w)%+zyzOZzALFeO#UbgXdl=GWC#T#jX3HgkXe=e8xTNl+HtPl?w+b0=tEj1`i#kIE| zynBB8b_v&?N;bDTk7*XB3BgTH!nnA!)|que^ORYBzrPkuA80cvHeg)l;T!Ihva;W9 zVRSF?1LK~Cqh#{Zg^-Z>Kljoj|FM@A)L^W@kBd%jP(@~Tx;aKCRf3$-XJaB(;N7Fw zrgp)mpIb+3lOdbcmoH8p&)f@#fk(ql%II{6MT3JBsHAX3XKJ-v)O$6~rSa(((*Q#P z!@VgBq{&d-LCGWTYJ@cfr5BhsWR`T521DtY5Jm~w5F(E_Tv9C<-?)%FMg6a z8QRu24MbMRC0jBaU>Zx%zOen_dN~ejMLg(_F~p$;5xYcLkq1{hjvqFMfhh7T`KzRD z|3f)@N58C96SQqZ=b=>;T-}_rv3E-hd|U8>ftVF(o{4>DI6r$U?l}j zBE5LY%$ zBG^}jJ~o5{Zs|lcfeJA6;iidyLu|r5&(dbfG=m%9(S4OGoR7()Ho!E_ve`ZJ(Opmr zKA67Rg}|MJ;eNiAW%y%3tCxDlG#Dyb>U&0*c<;{#Q_tlnR?0sgFEOV{*w-(X?n;&p zx9U#l?ga873JMlzwaWz@nSP@iw`mbTgZ=sV15d5ZE$fP*lsS7aw$3TUWEhnHm05U2D`CNB6cWCNdF12>6+VOE>MB*yLFYfP+U~z zAly?;@`kgdgLU6s(gda4WY<=jzT`m(_?^)r+_8*kC}hY31m_uO_{%2brro=Lhc4Ci zVJDJ+(4FJ<^p=@$IKIz=pHb;fgZ3oL{%ar~n65$DH)DDnbkGWa>N}g!oRhY^Z<~>7 z9dIF5X|%MR%TTMGEQA}pnVg-i53Z9N@&mOSpC;k%(UzxKdvR)n#u9W^+DWh$v48x+ zVE<(sG!o4Al*GpH1Vk#$izHzgYVmB(A5fP;0j{N)ZCNHa7}|EW`7n{2 z|7_p4Hc~bU@H)URPcVUf)7%fmFjGyjfIW2rbr}~RACk^c^jeGAyLRiJwnuXfWUN{C zi(3uxxV9Kh12OJJc%y_^M-fguA^f*CNlgV*6m1_B@)RF!n0PT1p14rVAfeB!$8+^> zJu_{wrT5xwXV|ukBUNn~0I#Nj{pqm9K z1GG~Sr1a#yTR1rUXyvMt6=x+Vc;zJF1Upd2p*D@JpL_~J-f_cV&#ieEXe}Rc1=j(I zv6OPQ6zO8=G_bwvwCwPXH;F)Wp~iNLu-;%hf_ZPx#0_~djkM6xGJd65D4!umo2v$n zxVgb+)n}mk*U}O`C1^g+@dO*Ap8~PB;gm|mD_4z|m9lddSYT*0MJV^3nKU#i$2w}i z%U3W+1`MJ1dNH)EPT>b<|NO_+-?xQ515k?3$e(TnsUg`9sST8%zf86bNoGk7W8znX zqtZAE->($ATW*Gy?+JfFZS_ow?N(zuXqpIle2R?27#~uhn!gE|SGrbUCXHG(5>StTIbVo@?y#2&F>kupfjLz8}WCa z+Gcke@F|57B(9CT@~&cGIt5!Xpy0_nPkCf%_w5=wjmvu{twLBq&X$g(weGXAZs2`p zlg1qfaN$*+WnPu{;B&JQUjon+!MyTOA;T52@Nd?0-eI-Ss^D>!&s%#x(`mfQ-u%V^ zEDF6(<|r{msZ^88rQVll12LQ&a^mynd*Ua{rp*yc?KW&BB18vxfGDd+T2>skOL(hu zi&v5=S7Ctv@`*VlAB5_O|5|eBNjwH)7p&H2WPpsPG|LP6+B?&Pax80kqrq{w`{`D4 z8{F7^q7EJSFHAdjOO-~a3o`kEc}gw#2{$L|F_7*t@c0F|Cn0*z7`b!P);ZJCwY74v z=vezB&{9w^ zb8<;#i+JL#Dr>$j6L)(NnMlwt){+a@04cX@*9me$EDp646tiY^FscPo1hz-PT;75f zCSx))@dxJ%V~dKV3Eaxho=Tf0@)%=dX0OgiuyU;`J<}HVa=Yk@qM&yXpNfVC^^ekw z^H&lWZAl(#2OpxH*1_b77HOf2Unp3iMdSBqJRpcz7%+HF3DYXzx`wYvpy)T z8>m%ALPJu&pRpFw7Q0%=gtTNAvkQ~&i`C3Pk+SiN{>YAYUM8ooLC1eWab;C|2o-(V zZY`+6(v11nHr_XWCe4p8_aa)-)V*Vx+m|#mB`=4onVoB9mrj?)TJ7mtcri#}iv2|L z?K4Cs5;Lz8MzpFT;0KC-xp|{RKT5}`X3?C07-N$5 zEH5)r+mR5?1M^_zTnyrVw+LR3Er3O)Cv$0g?^ZQbzx{k%ZP#2h(0^~|a)VvTzOny% zS^uRz6;lz_2J5E+>gOHa=gon%<=_HeW}53)^{S&98qDW;hO#-d)-$eJKaba9_dzE5 zv3b0nN`71p;9$=##w$tYjP_AZ#nH$x*sgCl&O9tl$Yc+c7#=1BXI z1)Tsrm^;xIbNb-em6y;6J3wnk%HI|)5e{s@(}(QM_2=1^RnL6eBi92V+f={qPnWs* zAYHWo5Chg|NVy9iS`3%mo@_kcx@K)BHaG9_RPv&ttjnem0m<^Wb zFOoHct+Sz2Mq!rHXF4qMmH(iW6aYQcq|iVj7L@CLnhlZz)2)E9Ek4n@QaPd+&uh1z z=bB+dqeavD@~03%-L1_^kwmrUgh?VJ6cKok#8ruF%qP;XgfhPBtqA5_z@UV2#wmeM zAh*uQt@U^+bYiEQjagwDL1(>HPlE$7dE=>Kw!D#;WQmKjNoP(nh9m9+XYEFjE``A9 z0G>=&my~}?5US0>i4Px%D=iX`=G>j*Xi!^5Yb77;(UvI!sr8&SZ|jj>+{wgdg|-*^ z+@K2P@C0#Ych;=y6R`&akqNY!L7nr?2T%po*Hy+ZF=+1Ak@lEBdXnEg#AV&0iz=b1q1|bG7!Casl z?%Nj#lojIV6pGt4t2)h_p+E=)`~&dbUOk7-0s@hKQ|68ST3rnIShci&PUKJnpX7n2 z;|o(#XTssGc_E9mMDt{M3?Y{gL*IT!)*10dnR+^afsK}RzYrClG{a%Wf$OVIdH%V`(>3Yo zTaIgt{p2A_-TA{6_j>Q2HZG~aT|(++l%1?N+xr)P#amUv}10S6nnYZdJ`6{*($y%>`*eyJ4kiA%touM6dX4%meiG7lVzZgoxi zeakl|@@Y#-QgvWjUw;5-(!$C2|QoR0=2ZhrSJboPUkJ4E$9 zc<1yy8Y)Th?2Uh^`lvej-BrzX%;G5~b&v8C$?YVnjsWdl(_WB!Cd^DCsUwBDJjD$& zAl!6#tU@2s_PGinzmv}9?9S6jU7XH$71^y~(}^7Qi+Rc(WS_BO5&=QckoeU>C9X)8 z3|87Gh#kI+!jO6MEVLQ9*CL_yxE~)Q8;xMIhA@NaG1>|&Zoc$|e7rUmTQ6={rm~6h zLKpgx5wD|yQ&O6sOg;YZ2j83^jnJSt^dbT{dEv6QtyTvLn4nzX&gbcZn9mcVu{#4r zOnqUU#Klu_vO&CAIfdSgPZ(6@Duhh3O75`!ah*$IGG?G~!J^ThO&6*3$z2w^jFW+x*pf4bp9r*{un~dbXd%V? z@Mxp+kfdI{^U}|5`f~gO^D?@PUkBo|bft#1bOm-k(|vZe^MXhhaxV@?e4Q>Wt*woBg;?Y{_>m5?_xj*oW8I%k{?3 z@0tjo8A)+|%g>vIUo##=g_al}`8ELGi_^j)T`cNnh+`qG_dn^tjr}9?A~i&^eOO3< zrhuIH5wUV)b6vFE>zKX&;R^skpM4YztzMvpI-R*P;GT~gD-HTF+ZvHCljL_8Id0Y> ztMg_55dFuHOXgQg;7xMX;feM^o(&19+EoXg<_Z)}x;Fw4+zQwl3%KA-QF~9jjjTck zKsu=1SKXixS#!Dzc)V$2>uTN9Gbb3Rh*)V;)hx5k9ArlEb}7m>7s_QYF7njX!9{<$ zIdT@At6|ipVYs!@3|u%H+1X^CWHiG7eRdFzRtDP7P)h8BD5soLclA1qbhgO-&QcQ} z4nloq<5bsmE}-l46GGrGZ==;>J>V4r?12*@G6V5;zezZO&m&6XM~a(t-NU~?Gi!7FTE zPw}e;U}{Bx?ftTQSP-~4N@PsdI&PZ2ryx2o^i+{GO=*zWKgod5Y8RvB5~ zp_@{<SXB@GE)-Yuj+bjF75+Naw7u0zcpb|7~-HPyrS=}VWT!HX*8*Aiga zX1@5F{-9djq6QOAxorj;p6y*Dw6}6u6Khg!hM-^F7~`_Lw&&g2#hAmBVRKb;#W78> zcFB^LND_X=3XGfi^0Uz=*;3|ok|(piryF^e)O z-}wC9PJafQz8wK>N!DSqjaYdXzKh4?1y&PKrf+TI_LBQw3 zWcW)B>s?PTE9($$UISa{cCOEkG4wyJb~wv;^Z)-`$C7g-si&mSR zno&d%^v6d3AX=D4FlY9wEp#1H3Rm{*p~;dSy+1{yXDg^# z&R>v!&1HX)vKB8qGrSJVy#i~d9_9FD{XQc315_m`I6l>7&2Gof-G3AkrY*$2^LICf z+ShUERdu8}vXXyS0a5o0Pa0FNM z<0q`oRW&67B@P~Kf-4(@0hck4RAy74zVgcY?`+IkeEXzQ$LA<=u%!X71ZveCd`Yg^ zk$6%Sxe)ufFr9RID&a9xKTa(j#`%^MW~t~*wW~H1SS7E7u9Tzq5)D_cLYlGSdDq9H0y|Lh7JwX;mq}uTT5xG{$noB?${K})I`BOwo+?)2jMk99yt5u)fGEtqB4y3Q%LFbg$! z5615NBLT0zVLk-tkuE9`u*s@^M!`=epQ?nygfKf$Z9Nnlc&rw5qr1Q72*?_q46?mC zVFQHi{Uj5UlRVB&52N1+E=O;+OKx8{xdqJ5ylfdcC1|1xWo>TD3SZhAhLd*;c!o*C7`G%~ znntYE$5-d|xRrQE7lRI+(lIT^IIsUIfne#9z@qnGJ`~;Yi026#@oCZ2Rv#I_jH+x$ zvObipI2T^0`YA*tU#yxct7u)BC*GNe5y1M@w$2LrfW*;7^vz@%RROcpI&s=uI?;l* z9GrgqpZrm#ld#~W7F%9|t^|*kTjt2i%k|gr(V39~|H~yF>;NFONxHo(H1QphtZJGy zf6DY5z}GbGey)12$Hcg?XOBnwG{kBQj{?Iv#AC7nhnbzz%Qbwrdjl1^?e8I(xsrLK z4rSo47JOX=fj8DL%`MeYvjXq-uU?z6b^ClK+yN?IZWjEG5)KrSZkoae^c|Lc9QkJ?-UmaKQ!IMLq}w+4C?kz_~CeTI3b$I?09{+ExDg_ zo0Yl%B zt5yY)Q{g~?z>h9X;KeVQ4?Lk%7u7b4H<3=qBbt3y?tPaU<8DvFXh}V6l8(3*YxgYK zLmuUxl(6ne*<5AkJ5<;4sp{opr+O-8EBerYvx#P^cmyE$h8H@JMeeRhp{-;!B-=rNX>wMv_N%E&7F^`RNu-7*9c*v zVJ!JRau0X&2DGVtZ4oLeqRrNryQlT+i4n+dR~p=xoKftiV}IE=;}46)D@FRpsrKiB(1(pyGez zAr_EvJmH+xH}%tQ=J#?+IR=v{;q|sa-eJK_VWMX6U|CpQV~Y`RnlcnGn-Es7dZ`kJ zR^Aeof6c2IV0RD7pGF(97cr`DZdm2pHmH;OWH$ zYK_>Hs^0-Si=Kl@mZ$OSr1>`FPc%GZl1AH?T^Qol1vnxSaJOELdz&n3ti7D9woQ># z*$Am8=aKu`b)@y-Rd;Vg)+LHU$ESyt-*VcF{JB}Up@fM-BIuUbw1qoXu)0ou*wJ*e zKdp4jxC+?d&~x({le)k(DshFn{3V2P4lR#iqBpG%}f$Lb7tG|9-F@20YN{B_`c=-+b*$OOBM9#hrB{MY?_+)Trq~& z*9Qj#>IwQKOjGWNT~~5M&C@lD;y)>ulq6CXIb-H_+XdVfeWKkx6J9^={hx1E(_6;d z&rpREX~yOUTS4&AMy32E^T9|&EQMy9mgXh&d7kC3B7v)fe_x&)VpcaZ;+cUNkq*swdiKSRD|DVy5u&>k&&-*^<;4 z3w7Z!I*O&HQHuosA7kg(BMP)_*|Kfhwr$(CdCELx+qP}nwr$(4J~y3CUMKg%`x85R z&5SvR4Cij$gngz5QyhoXD&mq-1q|KF!H!E_0#lD|gCBrvhZb=?w`7WSweESG#iuoT znlnU`$u)w5Bxb6#JxnE1nY!4`#$;|5vHP`kq9lWiTXVCn&S;~S&x}Zl`7jFs`IT27 zVeMOaUNq1l|DE#Sgc5j@XBF^9K1`V8KnsW~C--$I)vUuz(T8jc+>5c?qUEcRMa(*< zT69|_R$8y<3wBd{&IB08#8mw7(4gW;;L#vPt@o=ZJWt^*u;MMOE;slztB|x#2E1;j zo^D(|U*^IHV?=^z+Y?Qs!_3(Jcreta4gFbI!=RdS45B!4Zl&W53=>{7YD|sj@liV%c(-xowHzh;eJYGux6x<|V|RMa_ANHSB0fDtC8# z7O|Y_Ho>uFI@%EYyYdr06)aC@>Jitg+ChUQg%$ME0jyFt>3YM``$n_eCUv}C-wA#& zSy9&uoQoH0C?6j|fHiW`uN~;tGhnj9Dp&62*pus0S>DhZA0iiuCXMY=v#T7v>sjI2 znek4{9#ql9rfle4x&1DaQ+)7U1XPeWlDCQEU*WswTM&I;PCYViPlhWpp3URIvg>9q zb}Mxm{2u^Gn+5ZhSLoIL^1Z!7r?}T!>=g@Y6LU6_$i6KGWV~J@B6Y|QCa}R z!-H|Vw*b_z!>S-M^DO;(EWKaX31&5Ou6Go^JlPzGSU;wII5E4JwGe3j(-+gpscNVBRx zf~H4TozdKdg!t_FBEgQb_#(tnKz%;r8mB`6MzOFvsB_kVvFTdjVXcItzin5Fz~`iP zj&n4hWIML%s~(7Zdry%=deLoYQ%`06H?RV&E<>#{S)k12d}P%&n_{clu~=7o=X5l7 zq^C_2NwO!b!V-sVIn#8j-I7D&q0g@9dq1SpsuT&ci{cIcaK(XDh7O5E=d4)_$V|GR z=^KP*+6bq-dW69jPO(6vs;4DpWo-B;;>}A@X5?k^+pQQ$m3AWDg5y;eT|ls zLcwNTx9kf8iDg^pg$;&*BE<(pKV@H`iUMvMTIjnM+mWiEP0_k+DKZMhM>A zN4)L}@RY>J<{KYC;J8qVotoc>5SZf=gs*3YBF-bY%W5tbih3qgwqshJ$P zYNi^24r6MZ%tPk(*=PUf?@ZNt1Ez3PmP8O9Ocj*z^|gPa>PQ~ByVt3L8ns2|B83eS zqprnib3__ho=uE$fB}Z0lPt4z)>Wa*5G^C3$B3lel4@B4f<iwC z!?)OU!S2J6vn)foryyG7s40-0l@sqDxvkdkmltiRfKSa{fpoh>Ib&ifKz~%dp7HSw zaiy*#ubd{lPAR!hJu3>0yEOAF*KT7{Em?G3%5zhKGb!6y&}0+Cas>RA1R^|n&$lVc zVS3Vtw90nCa`3A2Z77AP5$kOfzqw5s@9aQtfDv!!6Sv@SD5KZK%p^gsb*O%sR%dz) zf1);b@gzm`Q_}aUzH#av{T*LoVR$?}q9kSF;R63dA6vi43Ue+1nOL0{=@Z)@E%gfm z&`1V!j`?MTdzb-jPBp}B6gNQ>6IuX@brK3L3rfBCB%5UKUr)|G8)rFzB_6Of9J6c_ zBBzw=kT8u2f(4vM(o=Y+xsd|5pKhDZt#o=P);M9Z@Gfb50plo|f~AOpmH5XhsCc?qeE?yH=9Bq``qUx@Q5Pwypsl zWoV$eusIGX-lDn|#87tXlw&ak=xkzlK>*seYc>xOIcyZkn*q~v`vjK?oP)lrj zEMxzdAOJR96H)Fn&L-TB=&wf zBYe6~X^&-oI4dbF@(E|Q*b$4r2+oBa#D-oqu~7e5n4%h%J@jCuBBC9sEcn!%n<>ac zrBAVho7tzbmZ0wHFJ3TMsK4KHSkWLvAj;6f6bge=VBpqyAfK^LR7r$nqmC30(RhGb zmQ>x9>=W2Q8oR=V+{U`{yUt3Y2QWh@Svf|;G}cra6~FR>5PJx$7<_c{j*P_6vjlxC zDG3c?V1}lb3R+t;R0&&b2+~l_$AD3?GOI=MhZN-R(?NY0n_ zi9^nq=*4rEhsh;^DP3Fm7$wwYAbX_^&=?_9{|h*Q+{B7=v<(Akv$TrJ zmhGGfrbMJizp>*3>?oM4zkyTXlo7`m95&{9tM&(COE{X3Y1%thH$RP7&|9C7N~elo0ka;lR`i7d~XBgtLJ$M zKxgiX|3=j7f@~esMvV{V>Haw&q1dgc;iK%dx~fU*{e05A9iy=nL1q{pQJmJ|n+!eT zWAxYw>%4;JKNlW@vC+tf5xyk*YbzEYG6&w&%p}Ff#rODPp1O>opWGtM8rxAN*lD=+ z;*l_PQs@+{h9h=C6+sh9lB$JxmJPt$8*uO26~JIRAnzHu8?^vvmfh%xdSw+`ZZ3x2 zu2*H-GlE*1Q3POVuJJ4Gz&7B;{&b~ixI0SUZ9GO?EzIO_`g7P(w9@}e6(vnEgwv+O zcwfU=Qj88GG9LSj!Ay7rL6Cte&s zV`dF1IfX1!&%-mrKFQ<~vZ0R=Yy~>n^s`I*0d*FB{ih?jff$#KQ=5@7Td^1LEWF^7 zH*&p|>@ar=Kba54m>IQlfa|gW`QQ&#hNC1d5*Lnwoc^F%6jN%h&d5-OnoJr}PMpcA zd}P?@B5pOsXoW-qbF8Z1oVB?bC%5hn{}-^Ze_t1Pf(9I0N#Eqhz^F%z6c{na=b`ah ziYi`9kHlmRbPW8^a#@+cxD<2xE6K_WmBXKhQF`yx1!>wTQs^mAvj4J3Gfk*4I|odh zxKTujeXD()1oVlq_A(eX99r%ZL4d3rdJte<+xsH3H)TaNjTU-o6x-Nk(@hhNTU-zY zcCbnA|KYvfIUZ{jmd7wAA3b_r9=Hn7LN`iQk-g}?g^?)QJ_7GQ!BkXu>F(~&lP)MQ z7B9rmsf>n>v*mOtmppXw_frLWQPqT>sMaLy3Gs2+X2rlMq8S-FT)2S2xXa;(hv6x7 z8#X7M!Sbf;a#OFPd{4*X?C=VQEreYHp0VL*D2o{aDFJZ8ETV;#?(mTHhDa$qt6`(& zU;#bq_ymvn;)NLWxSfmMy*XLzXn=m=vU>D=<$&=J0;ERoMw1%pyo~tvr!D^j6vdu` zCr{);LmR1|V5&yg(CPCmHCJ|LcXU*=|GrVB5a?YUcaDJm1jlgxdf)eCec5Lqa^cfTIt{s&1Zg^4C(FEuJ#024I$T@R80#u|8_03=X)iPYh8 zqR~Dt9j=#%{*iFM4*I$42= z<>}a4R$acnD|q&BO_JleA%j~kHhDu;8B94t2S&g`+aLuN`iZ;ZVoeIyV{MjIurHGD|g*1I&O2d+a6E+j*;MNeQs|!)9 zpB)7?7AFTsQa6=X_ad+QiveHx#l`-!J!6cIcK780n2s0w_~cMSdz~Cy9w=b5o}Fs@ zh8^T2O((bAgMmp0u>(llNdmiGYt5I-8jln@9Z$&Y4~)T+!Xsn=X|o6;1lQb zGr3oHBlAH_=MrIi4SA1-o}I%PY<+@a1taCq!a&}?^##J1vMZ4>?R)!nF}o{1ch0fv z^^)5}e`#w@4FY6QE~MNODxrE|-#W#M4QTUJZSV2s3z{KD7`IOzIj51Q^mJnp4d{0x z5wN?-`xrjyfM7h9cpN+#^z_%Cw-Hsh=vb!{m8eT#UQ4jVflpMB;6F;jak{%$Qhc!m zD;H@tAhiEt7i6;dT5g!{pB?o_8snBUS;J%B;G{X1(pFUj1UHwlKUAKmfhBOeOqHzo5SVQkfVB;IDq^AE(ZI8)h;w(DDTcVeI}@3C zt8wb5Rr_3+J+lDa)c-xmlS)Nxe#=s5_UtdCu&wJa8R3y2`$7J#49W(!eIZoBaS8(~ z58jRV?Oh}=KVr!(54w+WAeL+@5;SB*04h9$C&!jl1dt{u!u)cH&S#jMb*Iw&7@v4_ zH@R-jB@1G7>^zexxyc+m&&u0a(YIYwA@5W@I)RD9&a>}*a{A{eK6g@4fVq3q_YO5g1YAdM z!Npo0%ik$+bNADW;{c<*Pje)4XQHz`EcW>w(FmE1K$7aJ-|l$p3gzVen|>dIzex^L zPlty@|NfvgXGP1hDow?6X!jB%6p1}0;P?qy34^AQaFrkVd0&+TGvQZB<^AkA_CHpa ze-cg3>@2VUc7gw|_%aq|2B!acfj8@n#}Kz8c7IYo0Z$k@kQ1C4^cnZH`hS|eCp{=#Fi+5o}a@1GZ0@TUTa7?KO-(yleQUiF>rB^1PiSxIjeqo7tPGG1rghKqaA~o7zkKX+KkTvRJhhTc zyi;=!LR>@S3iB=lGW|x1NTQjyo{~K3vgga;-RZJ)pr$pXI~fQ;=Ev778y@YP{7nO` zr-;>S0e$N-9e_nzk7m9RvY>s~^(QrsR9eKbK9VIr>n^*b+f@iQaS;A$w1AX@A1fv1 zUC8|KK@!5!0;qMsh5)jT zNJJEQ-tfVZAGw2kK}^WNUZ2r4dC9`~vF;QByofAOPPofnhk2Nv>@q=M@TuGObtHI52mAXC`E4T5QQ1nEE;) zag$LFrg^b~E4l8vlGn0|FL|6)qS}>1GoqbBOFpXd#?~!r8cBNKlc1F-<{Zv3qBYA`A+>pu#Co65j}IGG^`x)6}x2TS|3<72<~2mI=32|UtQ*wyw@_q@5vqDvbdXNxqkFShVkY=cKZ84i}n zAKVj%R#Yojj1Xs`bqeQ9ti)~(KkI^h21BFf4kMOH1yA^_jjy+6@7qJ zUI>7g9w{P761ti{@0$f?U|h3;5)rh!pqXS(MT38h!IXvo27j6gAMgL<%By@L`4oD~ zKvL4j2X(SKF@PEPtP>66AjJeUY61CLv8kpwDGMZc+Em<4sF!xb`P{x{90(da*~ znD1pv#haY}x?&XFH5gCLP(63niflGxvaew9kty*at9&Y3Vxztw|YF4KvU^MSufZFd*)b(%B1Y zKHy89C0UJTyN{WLtBCN-S2O(jW{`83;h4?O9Yf4G_1ut@f)^d|$5Xb0SQbw988VP@ zQc`m`j0#OmB_AgogiB&ti^`-Jv?XWYR+sYv z=QXQXV9bZMA!SbcnS>jjsZD}A2e++GV6MACj{?khmU;K}(!?b1#{&}3&jv~gjDnO_ zx`~65h9#1otE;qbilBx0iH3fCyUpg&8Wxxwm6k=c7J^1YTRHm}wds``Z)S^M7ZY!2 z8j&wbvmce6*8|wac;f^=d4+y7r;c_Rj{2`hC^g)3KcG{kd@XtfXAI=B4(QN)A5kqU0xss~VtwOP(iXmrT1ASQuixt~FSqcsP2u`XF3M&X#I-0w; z5eyxa34YW_$EOWC(`Ol+R$c9q)6{(2OXJEA8IY@PJnXg}~U zDAdF3QWBsYz?f?QbgRh#cxl|j6&#`jtU2kT&F7bV4GS9AuFe#oSrBZWA0pLc^*+X~ z!XMBWiTL0_n*>cuQmr+fT%x7*rc@4~-AAf5Lq90(uq$tC``L1kK%U&Ju{K#aqryKG zROu5Kpy_Sbz`B%o;^PW)0iwy^dSJ+iCk7ol_Y^kGZoeA?6E~avc!>?T%*$;NmN#MJ zJpMAgH*9K&U_ADKQcM-mtS+G$QvMb6ILAh5l`J=yyQa~2?sA;@L_1^YcA!w0)zR}N z`k>s!$y_bnOi!jpO}zin3|ae_V8_PsW{Y#Q6_oNvl~5f1JhI8&k(lGL`dFC9At2iA zKr}mNJ=*FhZgRDK!7JiD+{=BjAV6icX*L9YgP+f`B} zN=?VA2ek{EQu%?37h{~t^}r|J<`ouvPuLep1YCXBcHFsg$x~Ugh;?d7lsvDSK4o*U zWvIEjhJ_1_rs5z->?QZS^Lz*#Kuf~!&1i#++ogkVX&Yu!>EKy>Nh$zyVfV{hkykqOoma!|%- zOQCN237&uRCzhw1@#`}hL`{V0kCX^0F_w3Yim zl+s|y#X(q?)tg(;lSe>HdSh{BX7AexJ~P9$*)~W+^PefC*SgUwTB1$ayBz3xm;4WB zW;HG9Lm~en6ES5aPFBE}wS{f8O&b((V>|PTai>qcds}1i&TuwY?x4KnEfJ%1#G@*d zmIcertTtKAXY5pE(IAP(`D>LGCkDh=ds>X+94){^p8;|;0POx^Q12GNE=+#(z?N?Sz8V2iZZ)%1}VqPT%t9et-&n${0s`ITsbPmkGB4`7&1Ow1B zZ#gktkSAUcN_neKV#U3F41f6hfeRPC`ZGnAdA=$;E75t2ZVXQ+C$N@?sy;+CJ!Y$_ zno-=Q0c0JeH+NAvtk$=uDH;k&)=$A(r_OnsLjuqK{eeXK1OG5f)JYZ>(%8Fm0$^`` zatar1%5}a*F0hKMceb7PPNk9{SBk!_bR6uQL~>DH(8ztZzO(2-P1GQEwkkl&NW-d? zM_%3lB;6d^<}t1F?hnt8B9GU9b(KdbJjAaDFYSt)7qM#f*;%yewAD`lv23) zzNayi|2e*ltf48CWA3^0e4S4I0cTbwC)=W?H`$~mKS39fk-Y8sYi+Y@N|U}1UdpJK zJL+8WFoh#C7Mwj`X16_#foUlgTsbXV3CVSQI< zC761ETdQ}yqn%N-(h~C~ogQ_8+S*$|*!z9*lu2r9U*cT77|E0yl-iNgZM0i2Alo#? z1{PHIGiUI=FY_{R;A}7;3xK~3Uf-?$xHl1}-Q?X0P@1nW*gZ!`{+_7#SpSmMul0(|}I7oAm>*wmLGt^%GxPm}nH9+4nP}{%!SB+A}h{ z`}4pr*ZqO_-$If96&%gN%=rId3Bx*_HUC19>2K5zz~*;ffB+!i7C>`oc{7f=ZY$1v zFzokN*@lWSqDong|U#n;;Nz}}MI-;J)H z^U?FzzxCvlDHH`f-|ks63v^m!3zfYSUwXd! zwm%$6{IgP(PjVoHKAr?8{z%{_f{gGoztM3_N2@$Sr-*Fbo%^M)9U@!Wf*B9lo=vxl zTMzTdE~BmRgv*B?v-p3xF;S89oeuzPdTL`4}<*&O8Cb}r?SsT&@-he6WN9{_Te2JdKFbfMS5o? zNjulzQxvs*d?mb9(`3czOp1qVOP!SCI@EiU-8JX%-0|a@@pU)@Fl@Sc9A(KhoYG75 zqr<4_b1+B;Q9Z$PCu`C3ad1(-YZ!)zG%>xiMoMrcjslB+D(h4!*4I%+FZ+*FbY@i> zpj)aWgWP7?aBUU*kvN9hL`UD!b{0@f?4J_zBzP?3gE1n7!e*+stRpSS9N2ye2N$KR zqKXjOU1@L63JhvkRVA@Rt)O*Q(VY~Vkcw@_4f9UAUT8(M)H=T%m}-2oa?~s-(oTvV z8{r&Ir_=^2m8|Ktsj!M6^P?pu){7O zi+dei(wUlyk}Z+yfS-cFPh)9;n&C`PBrE`GU`*mA9l4M;Rp84jz`Ur4IBsXPCSjfp zptMTcS+8{45^MjmJ&Aqm8Ayj*lCkTS2nOQz34MGSii7Rab@@wXK!(r!S)ig56}1)M zPb+esgocKg%1cd#Zn`B+ox-M7oyJn;3*T_srw`jO)HFFCs)OmG7;p1}(R*NO?JeY~ zHWYoGhdGhuekJQ%|JY{PP#E4vBfqZ52w2j&tZpGalkzPu*F5;%wH;XiQapU0rT+Su8IE1};d)&{oClFu>FB@gA@6ws{>ee;M+bS{6D zMK8t3*Tpuv{rSkESEyjJBaCp)LjLZ;x{eG(nMu>;YA%mjYmBD6Y7N#N& zK9Ug|SIK=NV3?G&&G6K_mQ2G{(f8iwUPunp7C=m-jy;SE1}iEW4UQ0bYQ;+~gbNHBxh}dJQ;u+wk9$PWU6f1O z>~m1YecDKM(saS!{MD*QaAd+iNp^mHN=?#iv{m)MCb_ZR2+|6LUY)cXl=U4T84F%( z{71qgOpWuhGPMtII%KhEnO-pfgYD;h#~Et0iw}lGTQ5y>aBjzOU@g2^mvNaP>!U+= zH{=)~&(cVD(M3P#Y13aYDdA&G3?yu@9kx zi8*t$nQUI0{bKr{TBg#X7lhIhGy3DVZ^&`FvFJ=M`FHqo|F?;z%*j`OaIE&lgL8z* zE*A=OIU&nYewf?PugOf3^7qpa0AC|3lM@HlE2=6Iv=A`>$P_leZh&Ate^O0Q@xD0X z4K-2m*fjtM=Sb54H{B_hhsOSL>o`)>YgWg1-5DgEvOoH5=135PfJeo!WQH%Df_4`w znfaLY1{JW{>p4OJEYBV&lJ<}Xm{vZeE?9H_;JA@W!xmmVuUIBeR3C*vJ-5KLw|Ksak{iKplYPuU5W z_X)M!96YLEl~+lN=5q98fIc>U1}wy=N6QgDiNOl>!mG}qZjXzE$)>t0Tx_!W+DPD^ z!!OP8Hi>)5;d1QsAfT|MSH?wN>PlB{LT^W5%A`2M%lWF5wZ^H91x@|N11+l1^9XK* zw1B{jdKGXq716DV#^V!6SRt<&;gRSSu%~vl707mg@~v`7&0dJ}61vyUE8iPEq2b{r=8=Ab(MI)3cC5|G^wwyMWYC3F z`34+r=YIlm%tiRh?I|O?oe9SuEq2ytrN`_*Nd2bNHqVM}PV`|!KjUn|rRKr4gEK_* zkhHBeuKl%qcQWishAcGHz^SLna0SLfa`-I4Cq(Vm3aRUva1RfD|{)oDoxyIJn2$3Rxj!pK9y0FE#mukWx3IX?_M z3=eb{ncXM}cjD@oWNQ^A7t(VB^Ttt`M2Yge+@bcSyqnOR4<_pAj0!yxt8MRbOio79`z zkbg0!NgI77$gF@d#>+g;)ezrf%%9Y6q24uCi|_j^B@p)>2|yMo||Yb9!>vUL35peAo0!FH(rz z-=C?!#9)juz~qSd_Mx77x#S{FD zMgZJ^qe^f8#c_d;WIyTFF{kwbpryY#3h!^Ey#qTBw~Nn2!=mvpur&mSz^??Xc{g*V z;yHXp{x|(w-2E}ufQ;Sq9 zq96BInY;uxLKutO0@R8bBeEtfe~+j@9AZS&Y$$kAqswf{gRc5Z*!>x8Buv zaSjtMUZ*|<3i4Xp%?~L3ZP`E=z+3JlH1#&r>RNomk=eYKGG_*S?o(-%b{&V;J% z0D5x%-0bXKv{=!Zdxx5`O-qS8(>f1=1*9MovC)vZxnjV5?n=kZ#)j>4Ny&ER9~Rmb zcGdSDvW?Ejk3Pl52+gkv#xSmNwSl-0^&N>`gR;)9d|9{O04@K|l+(s;XZOXSJdfry!fhe}OK=IM z$j6KBtBblk^)3N!9}2M4%NBHG#XBw0S{IgXN0%^9`To2wTb_tf=Kyg5rpv!x%?fE1 z<6ls!s`72agi8h0_?L;Yke}Av%u~GN-=a1-FB^)fQA?RQPLFn_$2fl*)ZpHbX3s6-^&dhSamwe5mm!YLksFM{PKj(;*jP@Mq`(kO+Q%vmaZC5NsBY2mCyaa&(#sn zIB?tiNw;8s$yy^OMX%hQOzb5`_a`IdRo!NebOM^+C+esGWJ|SSO8iEsx#<#n@EV^E zEpH2Vttaw5@OhIs@uBMLkMx!tk!=?t;$hKpNHmu^#BDY<*{Vtg5ab0gsXDZ~3i@=F z!$hlP)06T;GMp5C$OOaEUDSWst_09MRit(57jb`j2)WLp)fGFnnsRanJ15-pyjJkQ znfZ)!35+$cpzSmAz~(n~=rT8FxpcF0J&M}GsTz;4wfBF{JiIJ1HiY_NE5om|>USQw zzjSP*wyW~s(HrsdzkqxMT`a=$Wi@N`gnE6DK- ztmohnt*$AscG+IkB04ajO&vw7+i-869h(*KQ!`7Pq2-EscMS64JlGjUWIbjVuSMji z=7DpSa~|>6U4AQvZj>~O`aT<>!5+8Yn)ZawNBAHsu^gNQSdsezF|hSwX_!kx293&3 z+SQpL^yG9tcb&6cTZ4Aq#Pg%O&))@1W1*a!FwGC=P2d$;Cf;`cO<dx`77NK^c_EB%Cwup(MIYdaNyU3jwGJtN#!Wm3ovP#rdLs% z`NZvVnF};OXhckZ;TO!F=FNEoIhjFYaMKtidBSvmsB&s@t`A>+`Q$nKYhDb5p6Wb? zZ*+0->tD{Dyl{UfX|Kcn=SH%n7a&h4Z$z;vN4K}qu>5!O61l(Iy8oOm<*>CY-Oqt9`}^*9H}@9>2~{^VUAx&G%*0QL3=+Q5fnoBT1hDL9v_S?kP2 zEMcF#9&QcRVFz#YPawYIpH6=K=cK@WO7PNdiPvm>oiOo>_0Cp=x9H>KZ`%`4W?#2_ z-KkBs!l#^9z8Byw!#IA1t{s{U-v?;h?XkiT^-fPwo9kMaw()G6e>FuGZ8vehIgC)p zF1q{5wnhl_;rO<~isc+sBcliktxsfV@_jkjmMMdmT31J5;)H(QKfu#0TX$aIbde{* zI&?9jR$oUDH>l6d?m>8IKJ9Y#iRkua&r|iMA%~De{1#)MoxvI@_T>oB>mL54B(;$U2DMT{ z_QkbKKGK-K^arh-LLacZ>WOrpU%QPeOg~6^ev#}!O9*9#Rwzn?Z}b1yk=rGqVl=X! zj`?LTACWb$f9wc*drR+VkKr}AOKEN;K)c@W_aQzxt&a{msyaX^IUdKv8jwTA`O4bU zzip3AV&9(oPv}47e?RLxD~>;B7YhQ|OMh2XT_VGJe>p7wFFP`Oo?E)RvxeR1MWwSBH`TDAg$L_ItcY^7> zfe8rj-V8RRW`y#f$oBd`4!5Yq3|y&&$=EvU<9^b*iW|J5aFz1q1Pw2LoWHc6(=)O&Z))sQT?%P>b` zgT!5DyO>r%Z>4Fljn(|_yjIA(TOK(Oo58(ZznCghon$ZM0di;VBRGonoDtIwr9XOe zKz4`cP7}{geS;XNgkGzz0?{;kQs^Yx5gpQ8vts*RfrQH-6yI;w2A9Ez{gB zg=}W5Os}sqncT2t4c@kh@~oeB(NOPgr`)I7bSjQA1~p3mTmef(ngjXABU_($S#0%thtcN8`YO zU%_MNPB(c~%#A8`K>}${0q6m&!@2fLX52}b@L*xHz3drYseKdIC1elX{8`#1Wj;YY zR)`h3Akec$=zHvO+k+XDIm4RyXt=wiIx&7l+M`6bsR^;LhSP+_aJJlX3o9ylR{;g{qoQUGx@ ztJcnDC`L2&l?w|S&DIE)sZ2Z{tWz*V?MuDEz11@oz!R{At~?_Olzi;&cCfhYxP4EX zplhrlMiG!>H26C}5?9*YVG+x%;B*cOrru|6FnS5BO-|}#DIJD(e+i`u&)D9Uk*6SU z(gCO?HD4Rvem=^<0u#~RXm#oXi{NQMz#G01w3MIKd{VvgmCjh8$e~Ij%W}?Odotbo z=}qzJwZ_5N@)GrF#~flBC#k!22v3%Kz$XOKB6q;&Hdxt_bQ>Am+zvdeCM}c0k3r_U=Zyh}$$YQj>_=D5sGOPwsnJ zC=-g1!q;$Kt&GQObk(AdGkG1b!Lw9+UM}cgd^?~b7yoc+ib`&c%3Bop8vi!*0sjW418Ac`uSN!}PXVjcSrLtBj27O3{4l zOYV!guNE|^@e2vKA!Jx)Eua>==3;r7dN9=5gbT4vVn))2`?Y#bw)!?sZ2~8J9d@!g z`Kv`>sa2d(H|ib<1{C)YGVl5!7Iixcm874+pI<*u9>0o5LC zy9uu;1lj{E_b2A((RPyj;Xr(R`;u1zIr|*%s+*^l@k+U};W!!o2WuqfBFO7bVwsv! zOXZk4F~o_)(8;=*JO|I4IwFZ3K~iVA+uiBX)OOU#3~Jq=-dL$@(?4XpkEw{~n;U?N z(dtRy(FD^03+!6nzEYH<7+Y}+NhJGvIUn?Zk|JRI${qzW-mz$e28bsvA*^!`VH<XOYhe>Tc1TB_n+~+lO@aukUu0qS zFl4*bvr&!D76MRRg8DakY-PPjT5lvm^}Lfg^YiHx>K^MiVYhBD6**z7!Zw-Gq#`h` zQD&*4B?)wt2hrC!v11PNXGxuWijbZxcwr2INL(Cg0aK#qV$-mDpKyzOJmO`DK}R4Y z8pYEfi9g2VFoU+f72ZZ*wPD>)9Q-kv0y!TAV@_6cer`>g<>i8ja81D#@D>vZoSN^% zmDfDmSI0J0HO;@*bw2yqYmXjgMH4`!!Wk(o1a#@LO{FDCl*%D4Iuertxqpj%rdH~c zW!$!+^Ed~|^?C=ga;MdYSasDzC+42HgBXXT5er+$2R_mjy8=$(276h{V}&tRE|~zC zF1r#m6!fo4fZ<=~H^k#5RYXSr%$m};ePW!mLPN~`%}&TUE>04k0-neVOEr{7Ey+3Bh3Oh;0(Ye9ua{_{Q(@3FWrtaqW(Gk{0U;PIKOse$QdnCVezOWBsVx zjzUsaH?=C2DT}0i)R%H~8dNQuU4J}PDSJZ5{)bA6a>ng;qU%K7t%Cx9_M1a0s12k_ z9`-ShyQ($Ui;vAWMuJpp8_oE@@vP8jwafd3wt9o|+|KQ5Pdg!6>$nGkw#p1*?}y4f zYJ=LC-zDYRh-McW<0wPb_3qhv$RwnlpT zx^>>Y&|QvQii}(*Trk7sh#hnPxfzp+m66d6XPXx?3zKc%KEu8Km|Y&<(A{E3>=+4N z<%^ysY&MYwLvNlfNvZUD9{FU;*Q($yOyHZXv6_nvl6N1kIhGcH0|M04+3=|FCW{UlH!1IxS zvt9D}V4`0%%ihxjG^hJqRWdC6K)a=%3WbLz4$N4OGwM*d$Qi*HdAtNk_ywYZN}w6b zB%`eel`A5)pgaBH*a%a&nxBvCSGg-JWiP)y`{LSd*lRGRapSD2mh)kq>$w*h+vBVE z+~x&RU=;I$AhV|iO>+FuH`DSdN5_o;8vu5D{u@i`BIQW=4jFKl5=J0OM1m*{k*^{| zs!5koF-1i$igiO1OCAAMrn#rtApmExDJxg0ir#<{Q&iz;u3;5~QVJV#h9uIa<)A%6 z)`N*VEd6|6D=!avjQEs{?^Qqd#>;&Er1qF6icAczocSf<#$N z@VHi9Orrt;DTQ<0td{9$kF5C2m)6sl z1=ZQlo;ft@3i`E%nB(?w0W(qb;XZ0x=>oQZWQhai#&pW^Rd6)F5t6cWl!VLY;xNp( zN@uK}X`*f@j3V}|fu24Aveh)@E}T#n?>(K&c9?OpY4y&Bg129$G z0cLq_ZK^4u58ZFwt{6?5LDK}0Ji@1f*u;jff;g9f=Azp8K!o&v7(1seL7-&Yrfu7{ zZQHi9(zb28(zb2ewryLt?%U}x`k}vKue~B-&Zg;=LzOl?1-og4g>e0gpS=}lP(uUc zSxDgy*)&5XGN;k}H42>hbC-7kC;5w!vab~M3v1#e&21WGu_u5wC3p?ZLKIUC!%8I+ z4TkJ7;h31t^+P*mA!DEfa36j@1^Nz{8DAyfjb`r?<007-_A$?c%PpgD1zYJ9wu`(l zMzzK;ayqf4uV^Ao;A>!gv7aaB@Y6loj=|AWu)z>vn4F4k%ExPK5Qa=Ao-5 zTDEg4)9mz4wXdJ&?ZzXPqHE2H8ywZqtop<>Fl=kzA>OAfiTA_&n7<3cAY9Les7L*9 z;7QQYt{Y~f*snS9x7iCa+Kl;)i%E-UXYf0(@b>a@bUC^;2j|q=T(cQ+4&2`J0CG<& zE%W!x`=}9kE(|eapEYi{St^gATNHT{gMh}`Cqk!*yzuSHs95)4N=OC@{d&{g29w{a z>DL5cs;WJVCa<&9zhqekUdzJB%+rzhT(`1oqWIOv*UHjHO=a>TUzE3uIbjy!-nYn( z66bD{7I2&P=IHc%hFG1ce+q~hYEgl-nYZaRe z%Xps!v}PR5d&Q1T55X6bmvBL*PD3=m3+H~$UColtzhT$ud&luaspYw(33ws)2t*VWhW{5Kn0lYBijx$7`5JL67LbT zt$2=H%)pSlj|}=R{#bhKYjLJ9&{AgiqJcI97tbW%o-sRzmc|S=XLLFA0M7LyS4Q9R(fH#V=sV=?AQ(<(b+8J~F z8J9otfXPDkQQmdwyKo;_EipL68E5r(gGFc1-E~xr^MLKtY|0Ul;iy4@yb+i7O}J3K z?$8Sa|8YzPuFb{Lj|Ji#aNsB}6{Fq`Ckzi#Kb>EDWj_9MqZ^~?i)VVliFH>lVb7B{ zI?+Fa=QSGr4ZExW3N4Ru6Rwx}qA*v-e0~&Hid=X;Go1+@5T&`Sc(OI3kVDewJt% zILOy2xt8BIT9s(q>gI2NmWPDVNKon86Q2q1#^rfV*P=aj-bT2n5Jz@)pf?Vz+nHV&BLQ{D9boEoV}To(KrxIPUbi)C0! zq?`SF`uOU}J^V_3`S0ForHTE%n>#C>-fJfdjO)^VYb!6%6MlY9hdEl;^6qc_bbekR zMgzJN93y6Q7t&KPfZ_DodG6Mm98!`4Riz$va+^S(kD2Y1D0fgN8qr;{{roH()?DXt7YOg@`y(a*fZsLO=0f2*@+kdrT%S-iQ9vewnn zJ$N|jTc1x{E*vtj)uNfh;##!x30mhNgJ$=sRZ*|JrnPAl8f9p4DM_jtxID)<@?8}y zSdf+{{G5=EKLNMMW;%iyj1%J}dJ8Qknx9L9KJ@$vu-p&lTj!HQqTQFboK1cydhcJp zl-I`sOi7OGxMtA+H_mqgI<6>axL*2aXvA60Z1M)GqgU}TO*xZEYRJUvu4HbG41+4o}GuJ+(d7_*;kJA`mN^WXwaS z#ZZ~~)INVwIdOltuuwSGtCRwsQ%YWwa2eC9;|508Y(wnUm|#x2dc}sPan&*tz{iX2 z^FsktChak&gvvWr+Ote0gE)Ag-^>sdVHq!ll$=tv0X-h42&`eL)Mrvh#gI78!a**< zC%`4Wf9r}j8KI;jPqs%S2yJAV_3@AXGg0BjK$p^lh-zG3X;)$)Xc=m-2A{LjYygVE zqP|)!W&!sy>;FtaFV+S0eRMbimIP~n*}x#HQ9Lx;HA^ic8vH<`EqbxKlyF3gRyfkV zXn^P)9%|d+bktsyXSOw8@JU|3pI0ICjy44{9$75;3e8!eRX{@SUq3vn=E1<6Lf&k9qPWe>I+9vBd z60EEsV^FxkB$5r^!~z_7LPVEAiI){tHCcSZbWOG?f3t=Yd>W*vItZ<+{ZTFi=%b>u zAC?q!0|*DlMjxfm8DMq+4dB^eh^Q6U&{Z$9)^!nY_?ikUgcw-ii@GS40A=qn8Y&;* z^nlaNX^ifmZe4>`#SqkU zG6HeHZx{xq_zfz}aDBzD%Bcmd)YS$zUb_=1WMtV5zOov8AD&rA>Nt?68#VRGSLk=S z8D5L3g#SwJ#Jm!CF9%2oI*O2_FqW{N^9ks(N_OidzFmvz_Gra*G1mNmW$}d^u(QAd zDU1wI?G#^b6NU1Lt>7Hqb+i|kQVDAt`!_UfB$l183_DJkw_ZmTnwoN;+2AQ(yWk)? zkk3KPidahIT~MMc;~vrk7sN}p=)m2Pa7@d|lek`mJ5)+>MIY<_ZC~2UBMxZLcZ7*b2Hyb~8A+I7z zo&nZ~_*fSjH}t3v<2E20=lC(yttYYb0Cv7SFs?+ljom!rZcyOmD6l}W27)__%sqZf zDfXuTZc92UL>j5r3dE@x>>`g7om%p5jWY0-OfLs))L4E?#H(PE61qbb3RjDD(w)v0 zbZ@6P+$1Pja()0zl|LQX5o17&x^`dA*j0Fycvn~q2 zVd~j9i<&=xFw6-|4#GSf?9r>M^g+HNkB4H3SHSekfqt0iiETbHT;_)yB&&@9yd*6_)oN@2EpvbGagg`X)9q?<~_s4 zPQ(Z&CyfK_EmJ+q_EQvA`2Tl5ND#{_Ia&Lu+!16)jaz_}Ozupf)stAa|7y}u1;|yx z0@{_KHdwuyIg%W2A4eJ}nVr-uxXuOCEde$qsyfg{my1_~FOHl#Hpd8yr4wInkmcfK z%y2Umt71~LTS+#{OU-`bN=rE#T$EPD429NcQGqaaJpIyY3&}^FvAE9Ug%0m<am?dzVyUD%E(IUw&0mn!X@M@FBILN?|ZuW0tWK4*i;WNaEIQdWS zhRq_Ox@h`MfXm{6lAyp@K!l24e|{yDqz+F8#}6*xeL$RE~|So)=YBRZkU0(P-vZ1RZTgo_Cdc}41#A26TF?h6>2kB z$bRU$I4?`l%ybG0A5jo;jI)z#c`>!vPst4t(ah&g{y7`urg!YDW!lSM+KGY8$&u|$ zo~$hEJ~x6r*LlL^g{3%TEVpnq8BM@F@P#Fu|wp?2YA73eBx5|)id;d!icKRBI zL{77UXMH1Q& zj@b0X-1x%139D5ebeL&&XJ}q^4wjc|;=3x9kYTB+$CJ9@C6oclOf4+vV7Ys{K4<4n zntkh{x0Qg3>~e1wk-y^4OC=iMe07UQPtP>+->_yBw^IABH?H&F(y%+K~KF=4#d$`vujy zBy|IsY&4Hz11B)BW0BqR@`yVD+8oAwC1x4zG&HZ4`%e`s!dLr=%|)tV9HVdjj`cXb zI=eqFS|xDwmKSw!=Q7HqT>137q#RGDr!l11SYt4F?T2ER$I$DIRSRMJhK~Uc8rXPz zdoJ?YdnabMZ3Ih`W%+?u8ylTccVVIQlXe@ROerYcA$DMzCc_kUWIftix(LEIq+5e;KnyLM2vx(8|EhG)zLT!r7_utOZYlmPY-wmy6O5pU9Qo$My8ug!*S6ATudT+7&3>` zsbwl&)n+y6e_)PxV8}))!}zLNS`#37v>|4SrY9M8m!|-r8yUlG!g+8@#oe zdeV9oVb1yj4Rl7-D=whM1(%7tACWWgw67ydZ>HL~x+bbl?2p+1G&F?HAu3ZD^ z3&kC~8oU;9P`DVIP^G{iYa$OlX6{(>b$06u0Y&o$Rn8z2t9P*Ye?uxY_me9O=e}}| z=^C3`gBFXoS^_Do%N1klx0fCL;tg4-bW!<>gj|yy!b>i+><)al)-s9I7m*a*cM7a$y>qK_EVBqkMe$pu|Bs$*OX*8U= zf-AG$NJIEmA{r`C*P4cdYvwn_5UiT)$_vR7lW3pV?}VcbT^H4`i_pz)I3USmn@K3Y zx;@QdBb$z6mBWjIl8Q0)YY(b%SiucWd}@}--QICNb%TgXF+$n48Teo7i5i#yuE zp1@tW$^qCnjeAQZB^gM@s4aJe6h`+iwvN8?qo*+Wv%Z=W#o`J<4@|KY&(PwtR(?m| z7hHJ_DenqVLjtc>iTi8p2K%^nCrikC5|>vKs2b9G9hZm}x1*N5HDogQdoq2OWVYL%@N8KZ`?r& zQno0DY0^09Ja#q#twu0E-xdE=ZLa;F5>`;Dwj=u&H$bRDB$%?rfu z3}$ty`s2oPU6Te;$VYe(k*EfoE;TNDNZqE0(a;h7>U~Yc61^GUduUd1Kg&J;TZLv7 z8#Au*I;WTy&XV8zNit!@A00Pw^+8UDoalLHsh6^V1tF2E@CX= z3#q%`RNF6Ere<2>AQ#=K(hR{~H}D_)Z0+BIot5fDgwj8muFvyd=GP;${67zNfMIdA z|D`QqX8T`UT+B>tjQ^LFGOgV{L){5`^N8XLC@&&e2+E)XB0(2_Lskl{wAO3BaD>J# ztH+-xA(d>_HI;j^*JsW~i}LP}^0RnL&QbmZFQ=E=6{Q?rTD!XtrN3~ipLv<d7_8gLy2UM{fV|ba)>ZrL^}?Sx{N8o?WX|>XlOS1NDyCQ{&`|J8`Xv zot>kiu%{f9&JE-;m2GsB?yCkE>^;pZbHi9#irwwAM0wDN*_UePX|ubyR`(*pd*+~; zw|e=HQ~GS;BH_�o=yZOpsFk50v7xxa5+bvDZ?xi>`O80QUYESE_S-d0RR@#E|== z-F`uylHSA?6>J-2SmrRT=#|i2;vFdoSyQi8+7Izxrp|)wZWDqaTEtU(7 zqbY+Q&71T$^)jwi_H+_c!2oomhP8WgVNJoD#7HoX)ig9oew`<)V5^XP?3y(_O?!M7 ziW}MIg~oW*V=YYLgx<+Dl7G?z6d^AI$K1-e;>mqu=;WjShR7WqYN78?A^Zo zyCqK~$@>`Zy6Gj->6N^P&{ZY)!aiuLXT89pNd>)D6%Z9&6d(~@HB%51G3|O}juh6R zi0y9%X69_)Y25_FiAa1haRQ6D;g-6FDd4t^QPkAiT*2&0@{kVtNcTimnsGq}89}^w zJ^1~A`x_4Z_pAtzFX>%;M9*1`8fkXfGYuk#VL@srSOMQtHS91Ji?cg)n~hz|@mM0P z*yB6!q1+dZi5mVuv)Giw8Bh)$a_g5ema)lSBT6;@EoumUzo>}L#Soy6=At>?a4t(z zN_2C~^pb)Q!d#~HssuVBpEx7m=9v|Q>_=dh9h{@^OcXQ_IFnYc^M4{zu4R}c=!YJtcooR)xxb`oGmP1NQhEwd z2a&+A0&{+3qt7jET*h&Ut^v@75TTy;+5+(Z3(XR%?O$UaSzXhw7d(&mgaA~B*8@|j zM;$iAQkH&_yBmmQ{U<*K@rBE?i53IN7ezYKJ^J63BOA0(qO_uzu8`mr>{j%Sk+MAB z(t~<6B+-BdlMW8HJP|M4#S(^GP6Iy5l{!0xpUG_7(~OL2CJoWi2Ba!x)+h%iQHEzc z0D3(x7kyn)vzfD=i;pQyS8tjo{62d|3&0)j*F=t{cd&kBA(D`pU1wgUJK>YwdV=Y# zj*fT3dtZ+KHPVY}Dp8bzP-Mjni7*0Of)B?Cp%ey!gw-xbOq@nzy3%*5!l__VCN)Dll%@62Oih4>g;x&fCduzP&=bU^H^aZu5*`8h{?SHsP$5Mglt8p2%N`3q z<_i=fv1hdFx|+V4+1v8RW%u3hJ=hUesIMqpOXjn<<6lvKvMuVm+xK5O*aa{X*3<|s z6EVeD+pf#}mwg>6!OFSzUYrHwZEYz(GPmxnWB!T-srv{m%M#IWkBGvm2IIo+Sjj5t zW6~5GyT{pY#%5q)zev3aJ~ZU!lz=|)S$3byVmZH77Y9+{xsXhC+7Ko4g_6}`a`u>Ct44lR z<5u%RW2kiULB2nmn0*JBwq~2+cR@}E`BGM+8{ZjrgT+*%0*+GwgEmO8x{vc_0odee zgpY7qv#kZ%LF`8`fR{Q5H7?)#7*P@Tx+-#Du%nm|yagWC-euP*VHZ!*GREj+Tsj290!OZtj)UU@v!L zss7`TZzE7|5AsmxV$MhmPrkEt=T17g=ZDY8@NEQzFeE>AJVBzWuu1`zJm?sr70k#v ztKAQ-iH|5}L5*oDXgZV}Ty!+S;tq3_jG>4RQ;yUdh{kx~BeqI*XHX`Ytu3G&Y$K2; z!PlP@SJno|m`&*{ph^1MMzhN4YQd>3C^ig3lDU( z=E#M*W1qFuj5V#HR_$&=RvzzMs>l9UbGytmp2?=eAQ|WYlqzO)!Jx>5ZJ8dPz9I9|C-x zyhno)Nl&=o3#ZM!6OR1Jz9rtSRbJD>Bn`v)M$!m5Emx2oE)wh2lZmk{xM>;kXo`-4 zWICcRcKB$N+fgZ^j%*%{%?#V<(l1Q9>eQQdVaVeVRE5QQ%b?S=JrcaC1* z?U!&m6uBsQ0E8ZXEGq_nk>?RHqacM&J2!k2uW_VSx$mIM+M3@Zr0nG_mJ4j zoW%J0nKkk8KA`5orPjO$kF&(QUC}^SH(G<0AQ<%4?axxgDS{Z0v_i|mZS0P1fYLK< z$}UgLJnJJxz^^eXc}iKfMK6vG>G(>=4qtV#qHL!vhvP5OweLzoD^l4*)Hn&&4)#>o zG2FQP%a4Gs;B}gUav-KCFE#!8n6-N`GQ(Q#ajnSSfJN6yJxW+-%SXZLf!w-mw5N{p zgw6~WaI3dQVQ2f}bRfIOmtzvCg6IBpw81d;pxxb5*jX&F*2B9`ZKBD7Yj%18+@Iqy zZ{@jw&v-YzVPocpDfUQ6?IWpboKm@YEdCKT8_sS2R3C|69PLvgMD-5UQLARd6{@hh zEFTHH=0Zcjk|R$x(o9$(xNYoR78||B zc&_kpfK+xVqwVB@qJ)p!KC(zLUhy-AOr)5}QEbd;)#z9p4ltn0B=eK%rcN#hp!H8< zggl!4RQWWDjm_-V`Ly^RvL5Gu1dEG0clsZz|4oqIg0vS3VG|*>>G8of}ke`DwA#PtBmW zx#@b#!%}kw>=F^xd$FVA1YS0=xKK(BKT+DirU{6J|Mp}JwP7c~JIHR8#Y&PeS!+f? zHUu0jRnm+yX!tFmZ!vI3dsF-9!~hJG=XTl_)L5}+hFYM=kkqBAzeAT@d($Z{V*#DA z&n!$0op9Lj75%O)ZJ0*J``b9ro1lq64`9kVcg{PKt;T&hP7zm;ezZAb3tsgH-Q_oy zFV|vs`OhrFUPV@eKDX~IpBR1@s?8UBV)?72?_VVj5oKJ$mG3qiyDZFzX}ajupZ?tw zcFzB7?^f7=nwzH_M7nc*qNIXD7hoy-PI4T*%x=x-RZl^)-KM*VP|MCZ7Vq;?czki@@?0*yE_UoM5f0sQ(7ph2ecZ32B0=ECKHe>y+s>g}E z)^zXR5=4~sc&?k<$X8bed-c+!N(Y%l%Y(JRFkHVuhAe{^iIEm<--+P96S;oZJ-<(U zU-$IB0M&_d3|;htkX;R)IDHflX70H^_a&^sjmz(w9gUQ`BS*VjesSg$v-aGdOgNXb zN%ds>=VgXd$Vz}9Kr{m704H&a0QKJJ5ZVOZz8!OCOQ{mCY5?lH8O6P`ZHAh5mIb4t zL7Fqa-oKZ7GE?658Nd=bISy%IQag|(_s zhk6hjARpDt?HvpR_u+;rBqbkcd5+Bue6{90`8elZ9izFxHp~+O7;-xm2I3?jbjl@$ z>qP6o=CMU}fGc^5s)RZDP>olV)KC`yEXO1Xnb6%CAjKWj7>OXvl*F@I6}0giW>u0D ze~%;qr;-e9xts(>%2HZHu>v< zAIDWQ+ZKv~s#hcftZl00$0lPln$*QKGv)g!#1e>|p}Nh`;+KKZe3sR!Zq zu(#-absbr57D%If&Ea;ek(6%w1AA78eJWy6iq#-Ac|XgbjVxKA5R>5{yN7erLsfov zX;F=HiwAqJLl0{~Z1X-)zL9Su1>ZjeB;^<1tu7S&aMmflqL|QEIi7!s$<~ z-B8?Mq{w-nJ*A@$W%&&eH}fnte42*++ntOl$#4B`v-DX7(iVXO#N{#D+OAYiRE2`e zu=8l>ALIo(f+68g#S-Q{d>sl-KzN}+QDc%Dn!ui(a=YTR|CWt!%Gz0i2!;TRnZH2I zG0g564ezboMnR?HDsDUgG3B|Oq{4TK@f#T7ceP&;Jsz1Ixkhc0Xi8w4{yem{ zLtAdBQEs^qP7oqH%MX%L3;EMB>3fzNty5LYLVILM$2wf?WJq`@0Wv6sKKv+?YYPfN zJ%b5e#802NxAbQ}={Nw@nKmhfr<{cMc&$blIlwBp6{MG}BOOeX57q`pj4P6xt4XE` zOIZiJ^85b0J{?vh1v!+K7Js}whYv<<8OyIIQP#*CHBB#Gddm1bsniWp=ka#H&&Q+w z<>kOaIdY8k)`)VbZ)Kl+5POn*B5T4#gE-|(PqpPN zZGYGEpxY#Iv23XmH_BABkMc%-e<{R@7>CNa&ZlQ=>}arS?jcYma{c(l^v>z&1sz<~ z1D9_rl-w;HkR1waY{;ys5+(E4P=_M_bH;N1=?IZm35`F6*2Vg}#iAowIitPPAyjR~ z3Y4d*76Q+uO3C@bo3)9nBw9!{%znjnmTl% zO||P23+#{di6nK+G%~n81JB0r@BE#PLPiGv-~D^cR|Rm>AV8hU&OJHV-DTf{@9S66 z$^iN0H7n}Z#S@%|xG~zON{{(0(kHIV`@1!@p|w3+oj^UcSA`le1$R)fJ4!RMvd4^k zi+UnepDzbNPSOf1H!u24D;jJWX56XRJF!bGUlf+w`YDH^xEB2O%BU09cN$of%e5bc z$%_+}18!Ium=^;Iigb##5R5sFox=(gqv|V}qunAR@1VSEvtU-1uyKbqBzg!RL zVhaS|tN#o2r9u6_PeS#og)xT}$(P;g<1I?Ic~=P7F>;>_4zIGi!H*p|uwXzH6#8X) zDZo=>#mES-!u(5E8ZG8+Lt)u*4iXdGi%`3ixdC!~Cn{U<^XZU`)`x)) zVmdTd&e`hIAEu&c>cM+J!Af+u)j-&o#Tg6Trn=fK$q!pG^dNivZdIh6NJf*zU5<5y zK+gLR&&iZjEv*>R@8gCa3cyj+g<#W|^l!XQ%y+i)>1rA&1NCD#x4KNpDYjcC?J0-0 z)f#hMB~~`38%}IUu9cHrd<#o~c+AEY<5ECOE8&o1r9+-jdEU<2+DDcyd)SEwL}AhA z5Bx_9{h6*@exdK-M_2QaT6n6nG+YnYOUU+qhLV2=+l>nT#7_ zpU9Ov)XHi%eBSm>O&v%ZX_d^4SF4gF>$Z!3|(MW7H4ipbMnhhYLCvk6v4pHWv#%tE>(w_W7{J)>ecK=j#BE> z-OY{P**Vyrh=)NyciO|5xfBVJ)i?>GZo;WCL@xugHKgvL1lVz~A;m_p|3H5q<;GB%65(636i z4g4|}_7-N6oFRME+%huXDW>{Ou@-y{)H{b(&_tY^mZ#Ft9(Uvz;HcQO zkK_EXrSoQ$jt@Y}-&YDZzn+IISk({pI$wa|*q&ePIA7n7_&?xnM1pkxC5N*8Pn(NO zoUH%BEw9#=jJs?@>^W6GgKrv;MS*1ThKPrW-z2$3JK7VSAazP_pW4kOvf3vqzfJ{* z_iZt)*SJ)N{+B|7@KC-M2dzWbM;V9qf1q{VAoYGXyMC`n?^gX}g4B#v6yf<-_J!pO zRUh-F%epard43+tlV8v)_qIEtByUIh%t3D-MN4l#d@~k~nw&rc59rU3AKj`ahoQ4Gn&8Pnw~e9p7Uxe7tFf9UPt-C&4JE_ z1Hlyjb@6F+LWSw)Y8oALavvRim$A3(*%4pgqxov@->ZgAj533_1Gyj3fR`XU{uM&AO$}7~OX0RL6~Zn)ZkDI9yW^M?k%NV}C+b zL26080-w)wShugoS;X=My^RqVni`O??Jim2i3G9rWd1;Ci}F21K3*%5KTevW&^tvq zv+1FY|1`SmbOQfG?oE_%oJC+nCz%fV!xXkB73(&ZC z97<8GY03MsrLof>S>D>4JIIPj|n8?BegjYw|5|WBLVtx{wj$lkTEi zcaznSsOaaN4TG+48vRMQ_QIl38%uvPbdGf6N1pV&@otO6{ZgDNd4qGrXSpSI%7H+t z>|*m)`|yHbePmJ2gN>-S9u(m;jU)o#K)i6;4dZ~)1Zp80f$M;QjAs*1fPyfnGl)+l zz-WlL#`y$OMM~V6+aSCR$~{D;Gw$Z}g&re6F7UpraX@#VtG2vJA(?m{*t4XSM_7-G9Nb-3_e(|Y%NdSd1CRdn2+ttZ9qhq6$ z$bVQ|F+gj438sjv-4in{w<%IFP4m$i0z;#uxUh;moi;?4vvC)FUOQ)~n!*JnU9$l# z3I}F4rA_O8h;*WwC~1l&@7x3cp@jZ6lUWtKn4{Y9axny?YTxu$Ug0>cvzVMraI_dx z?!rSOgEoTTphPdHjtbvts(yit_RU0fsToK27rAb$N@S4GByWk`Qy(!uF-cW4tjBU( z;&l)q%4>#je6{&l?cJ0f(y0P^^GL>QG0H>N$`J2VGIw69J5e~E${&hnF!UQP>yzt% zq0CtS1)t0&JKdRX$n)sl5THK!5k~cus(*)$Y}L%5;BGyA9fU1|4xz^QXoV{^xQU zOb`Ff(;xse*R+DzQv^xAuy`i0Y#?gic7YxB@oAl8Z%_%9b^JMM=|o#7g=)UJCX2Fn zELR6Z^}{GR_9#cSuP1B8386|i(oVTbijUiJ_|IRI{-uQ>F%fqa3_p$XafHFM9<0gs z(uD=ZW7_N9zh1&e)Mn+~In}3Y7o89p;~t76m+ZQ*E>^flk^HCj1CLFsx;*9eW5i5_ z>GhjW+UzP9*wYmk8#ex~T?ubIWp?f7c+B^-dUb?Q}0YX&qB{Lb}OkJpv zW$c*3a7PS0g{rfrApl)?EL1c4nRt4N-Fl*5K~+gXfukG%re_gc8$W-#o}8=0tXS!&*c%2|Qb4MMno6FQ+r>GM>IPQL5rZpjqDThyBx_Y# zxGz8d#r2vQ{(5G8e1efpS=&;gJo3nDSwZDXOBIK3*RF$(z(t;u(n_f>+QW}>yR!V! z0Y$T9!3J}o1(U-3K=-J**3HZMGyZQ6GjqJzF?GvnfXz9wAf}vZs?A37f~_1nJzM*P z0f7fcvK&+{4aJ^j48&g(x)sD)LA?iey1_q~H1TdKDrr#3&bkSVtPIX@%0Q$J&VtoE zaC!OKm7walZY3AnIx?}K76#1+NgGD4g86n+%vlbHDq^*Ev&? z?9e*X0#>!F1m{!%8g19GVtrc{FZthS{QCHgZR0VvCn~3Sql5Ce)9+-7X!PGQofl9d zE!_!$v1(8t6NJn8I}33W!BbJ>Wn34IZeLZ*u9<1^*1CcFd{$0N1LWee?9=y{Q4%EjwP7a|svK^BgO&U5L9A?jb`3( z5187V?zft1=)=s712-wAnBKU#Z@VJ|$E$+)Wp{hv>E4yLL%TZnnA7n>L)PS+0;WEA zIJO~QopX9bb5G~OnStz{W6*%A77u#M^us$=RKWJjZ)dYRsU4c-hyj!?5(y^9GLGnx zU~=F^IR|QTYp)UKn61n(78=Y}?X2=!qAuF{*13)g&kQ>22LgX_Sc;+XIdssCN)J12 zrd;Nqx@sD(hMZ~cfy}VK7DLkx&*vq>ii250lCe2wjgHF=jMh+vcq*FK7(HR)BY-?Y zHNnabT7X13r~tI5B%mc+lGtV+Nml7MCeu`}U&KEvy4lrJzPTjM2I|umdd;*Z)~;Q> z$!F1b26;gD%0;T&RU%rferqS}^w%a$p?z6q@Ir7cQE|>ldAy^3J&46<;R%c@aCC?2 zPfrNL*OYbp8%yp=!cbB7IFcegK*qX&=#Mbw>v1s-y}a5_O&9XR8}FRY|JAU}W)GA! zxI&RW0A>~cddaFwF!uUD%mr3j>k{)`XJZW zKF6Wx7Z`tM)aC^%?W}07Sc3o6x-te^3zKU82x4r1dftt`|D5%E2M)nvQvEM+p5uRF z$uP08{70=ktR)?H)CT)6&cDGo6}$rfSuzZm25PriXe9`%aOF(9GJH+!#aAjYk#cR{ zVrABV@zn8^D0uslu>9~*N(%O~{I?;^7m;2vySvvvlf0*vqV^O#-Csq#R9dDmk z5WqpPFYwl=R35I5V`v{7)Je^oy@_-_5B1NQ=c&0nxMg`B@%P*{L5e=j&+p5pfeT0< z#y-zleg`^*K`6!Mpp@ZBj=KC3_lIxtx#WR_-;d|WvipY*GN~Z*XSEG0IQVmy?6TW_ ze(u|^)K9M0S5Qo>><>ACY!S*N-qHi7QZsI8vc%3Sa6m-HISHDPzqQa3He%7sO=GxZ z5{9j*{mE7{1tgRHaeW_m2u}5bSPh*$xrL-n1c)?q70Dev$v2$l%rkVRx@YBpu+oCC zlms$$b4hv2y##XExUTMwjBgYcq*iJ(Fq*oXoT|}~qx^o7VS3vfx{iVJY#o+_8cwHSAe@3?zEclqrD|D&H*PJJT27usx?} zj|b6=!-7Rk{ri%jx&FT8$TAsJ!XXZvqS_e!B3(^8SW(?99ndV8s%2j^JrwTHIhhj8 z?CQw36?8mx{`kmx`k{A?US$&j6l^Br>oXm?iB|`WZv1z|4z<6ET{YPH7F`Qs6?WzQ zyjGSDf8fn1raEqeJ=riH@(d!`7-MAxy8oh^G#s`tzGYA3Ox%WM2pv1^eN754RN{!j zCiv6wynTsu1a!Ut??&Ujt;|-a`wyui-OHn4zD8bjsQf}SqOew6%=3^d^=w(G)XFFL zu4d?&`qm=B8mdtK5w4$PdRxQk_AqyVrie8`@UYyKSTKD}q)5^sZMWN0ti>S<=Y4Fr zbVdEpvI4YaM))p?Mi*4CR6RkW!~nE{hK8szdW%$zkx*8VLPeRZvbrDP`^(M769Ymm z3Bl_E3b9A!9QQWU7WrTZpqt(p+J}mnRPTTqUXD%rs=eL|#BtL4h}Xzi{EEBo%;=-v z3KgYswb5Lv+SoYZ48}vXZxN>8LGS(fIZD5Mjh_xpv7dE34)CYqANL^@zDe9i%ARB< z8DL5qiTp^rqob|sJ-u9cj{wP=7W-sYd)6^K)4O>=Q+zykKE<0N4bptRo5lbzzb@F4 za9>xG1OM9>^DH~wtQdy1Un2EqxbX_LZ!5M_OKhL`-$R1AKr0|o@yS2S$2Vo=Ux|i= z#0CJW27;h$T9v4!QCP}mP=a zWHNl6DTDL$Qi52*o1-JWX0|4?1BCN4fdTz`dN)WHZw5ex{r6Bqc2!B(0fbddD<{Qv zzg)|5IjFO}8^d>Ka~ZYXyBb6^b&7I1d{z-;OxePXwrDJj^+YliQsjn#8pncC{piLc zX2vR=;r80r&Xlz_y+;)f>x`s~-+dhywLwoL3N58c!4|f~DiMym3o}|STyO6J&P*C% zWVF2lcM=P`@nVSNpsjkADjH3U$?+~=A89QeXJFLBYlX~=+jl*$ImE%tc)mrT8VPgV zhPAUqhm>MPml0rhpuW~|dnL{lxXjzyTSu*%d3h(i43$h=EL{Ovr#6y!7%EizCF@VU z`q#BV_8v4}U!}Zh)hf7evEwZ1evEOOmxMU{_RygX;Gw||3teC9@hK91bWay&jQ95L zS%fSIxe+h|ZyS~k=iwcmTPsf}x+8da3-zutgmn^PnJEooBMgBL;pG<3j~?6wwW~G2 z_3+pgN5GyikKL$RW_F*Bidzs5jeAToqj8QNu3+3dg0FRj3~v`tv>xd@QQc1Bo>oCA zi$NJUzd}A&l{~ZO+r}|wWkf7!HS)z;VgPu=7+gfWM9Pr^ELJz(smp3pThY=|F+r|v zlRXuayH3=z)fxSdbIkJTd&5r)@1|;uJG@43+Oz}raEFu}wfFno44)q6nReZg%kR*i zj$2}IttwQ1E7Q^w>{hv!9FMRG?uDLiqa}3bz{GR}QJA2jCu+ESQVcc;L_!d6;XuOz zM1TKE>dyR+G=e}@i6tU@>9w)f*9Y#_mzv!~6P5*iX(rDG!X)dvl!@gD*l&LSj&$?n zCV(HbI0X7%Uqu*L{qBx5EFEx6k%^i11YIYD(g6~B6Jw<8S3FI(;;S@Ixm8{M-e%Rr z78(d}M0qjJ)q}_RUO!YGj38V{06j8NL+#u)G+JmX0)Lzk7t1QeniK(6mef@$dk2z4 z%XM?D*-nQZk<>vBKcMQ+Y$B(7r0tx{QBMF3N&2c7p-e>~iVy(2oeZPQ9BU@=1gmy& zZm{a9SGff*)gJb{9lcy(zRT*mYCxH5r_X;Pu_Cpq{#G7}IbT@k;?d$pbOz<-X>`WL zJ@XmEl8UpCMNuq@_EEg2{M^QQM(f}2udP8?cxYd3Z$~H`e=TT(JDrTXl)IxMbV7;| zg(a@Ism~k2az*W}|Hs%n1&J0lTe@Z2wr$(CZDW^h+qP}nwzbQ4?Xs)u?~WU{PxN^> zZ}Vxbrx`hBj?8bo0ycOhUQm7|5ieHMbeqV#m^GF)$q-#*r9Vz*Teu>9$2i_Ji;;ZB zAV!^@!TA*VS!u#G7LaVcp-H;O$Kpvgp^d~|2%wP#;8f(-=Ai`v1BXPbqc4650(dR4 zc?K_GDv?xIm}qk6ZE9vP*MZj__o0-IqkM~OV@t_*^)>@m*F2DcJo9yYyV~1>&afNv zhtk?v+{~7e$G$AP7j%`%|J|Ae@4^YR;_@=pe4b|MI@~v?>6&yhzj&chg+P7s5v_5F~ijxs1;?F`UFdBBi zgG+%G(RX-4t;cK+2i(Vj>s>pYkCZk?s~$KfInuNvw2t()I606s}S)4om8P(8~Q z2Qh<}&B17shp1V4LWAAqs-ntIFH3FXSnc5H`9fVLyeXW>u$ zH`-BCot`}d&OeEUyp+h1j;`(yf707@d5 zhVFP_$QlJD_yUlBtlWFQ|B;ZkH>J9-om4OCQhKMlznDw(?K`$sa2|~%EkgNC5DXZH zrGo*%%LEx=g{LI|5N3fp%hb^pEVoc}`o)usIOQZ0Y`;Dp8u!u%>#dg5O{rVO%? z*(|=lUhY2bJaokw03eJNvSMQ6IS`Ev=}Tu>C>cgqM%E8E>X>?fRl$(wlDpv9^H88U z{>kBKvR*HuGo1+h<{6`vkENdnfLd^(7#qGzF`z*NkfOMbOlfqGWiTtsnnB7M1Nw7{ zFIgM!V_AaY25m_bPn<+|zZe5DeiJ#Nm)W|m#g`DEa9%J=4^7|JNCsT_k3Zm3-puRh zrpFmMH>7IKKCd%xH_;`iepTkgHdGm8|KBXwjj`>ytoMY#AFzJ0u%t$*s1dMIADg3_ z%3T#vKFv(C6XZJl&}S0#a5VrVjcoEWD!7xouLaU7(r>7BK0{6cUmB2FUU}M?66=r5T*hWATa%JD3sqwKuz4fE$-*M zEY^R^#!+yoW|WF7ZOJzL$7Uvh7s#~a#HbCkC#YnWWK&g%Fg#~d+ay6y{WyO1K@tEIZGr|UygPQF6JShIwSeB1+0n+$( zt6q`1D%pzDoRI+~<5G7Qz6hCzV&5Ho!58!{cELX}FYt-N;0lttEB6oQV_KmZZDtY@dXnD^)x(r^;x4kV& z3MXAhG3ChYjErFs5KJ1a4jF?L^Q9-y@ywNueR8LIzYcO0dUgW{Y8iY59+1llC$@2tIHCwcJWR)8 zS8SD!F}>)qx^njwj`5U|$`@-X3o<8;^leAAE8>c)$8bTAosOJKydHCm>r{p?&5X=7@wRy0zd$N*ao_#q3NMo7!l~fyacfY{NWA z*>3uS{32M};eo}pCV2{%GDuS7DA_Pi7Us#+B4k08RthUwjmgw`pNLkZCAKRep()RI zGF(pbsH^)Ja%C#<5Owm=R;wku&%Q2{%qX~&Jkv-~PhfQ|zHVsHy zBSLe&q{3vwc1kkaW>#ava18a_B89rOH1OR-3V}tVc!#gj_I#ZJ8P$O-gH86$cz;zXD>UdhvIz0T?!avF*6N@D# z9-H0^oR1-Iladr$Wj7h!O3cQb{x+Zi{T%GnIcqB2LLl<*@ld2+xTrSDi;R59Fd1Nj z7y(CO00sLs%a-d(xFl}+_iUCXtJV|F%ZsBf1+U3vRgzzcpG{9O){Ec04Jt&&e|5-? zH_U|YlRCp)Cwt=;VO4+eCWkdr4{9&=@WZd`8hBLPf0GtCCrCOoNgX*8r%4&9vFzi) zP`&T3Bu=bGtV`6|EBMBIxD6K0Ql03WWm1GxK!AHsytXA@&PY)=PtJ*emHuTOr_r$*6kJlB)7);z@@2>bvUtKk5$n8gD}f5X-H z8%l@mV&E4GH1*sQo!jmjNP4CJ2G{G)L*!X_Q(MlAlnTQc;A^e`KB|Z=UTwFztr^Q1 z;Kv~QdJ^$N2wbEiua7N(%;c6`GLqMaq+jRdU{QwvWv^L}yWrOP-j(^zv@t~Os^xY| z`Br>&H?r0E8EW3-`MsjA4~drlcf#R+6eGpVz|Qc03x^i%soDPzknA8TxeEH4AR6H6 ze^biaRT!mnwc(7$ob?|<^74%1!BO4;!B`(|1kuQr_$23-YhV(@&z{Ng1QtK1U*``N z-X{uQpG~dbo5TCV?g?`E1T=gZ{^dE$Lvb)~Kz9H5QruWyZ!mz9B9Tr?@3?yk( z_xiSK@3(7avfIOXpNIN2$>3KVx$QIyx9H0c=hwsIL+Yf-{V6^_Yg?cACc{h<-LOl0 zgK&;E{crxl}E^{S~88Q-@Gt7B+ot()S$Md>JzK9NP``L2S21b zzw}@p>Ga~DrH!mTE9N@<+`z`N-Lxf788-UBl&WdgiBdkpiA_oF2TE}{*-aaa`*xqK z{(rB*g7pjXkBo4;gf!PYA?aTgX9L~jw?6bA;;seNnbi-wthL}E)0B0tHgvnRnm>7b1G}tz+ zx}@z1gNEeNO1I z@G9(8L~63>JQJDWb9pm$)O@nD-V-6F(*z10iB@rMrljWa9|5qVHPiClqB#jG-Eb3( z-f)0_U$dj)MCRv54X{Tu%noqzqUD@ZQfvslD8mq!lLQ6TV$z}sL3Y6LX&iJkl?!N6 zvdL#)f6?)DlZjUl61>dRr8b|aW!H`rr+)?=f#0*uvv>_~0XK|})oFAP0$@jCfX&5Z z6LM%NsjM_)F{s|r{u0Iw$c|&Dg#v==J1gz$WaP@9wMRx(NDw%|IAVky+tK(7>^6~- z2Z*}rP;n?Wut+LQd=#qr-q=gPtd^8#79Zgbt`sT|UF8fprkCpCE8;fj#K?O$CH2U& z6(-i8ZA9uAR+UTCwq0yI`ig+q6$eYZe4m3N~!3iYss7p~$badR7EyXU@=+DfBi zTk!A1!VdL&)-+zhl%&J zUh_AA($KaX-m9_9OiOmRW$6bBm`d_sqHM+B?i7<7SYd#46AaFGc#juK&<&EjIJNaV6~KWw42&|%f6>)OmRJf? z{orwRZt@68#<6`~!_N>T)=Cg0cx`K1vXCSso6Yg+l!|j>(Ss*NUDHiFpQKoy~AEy9d=r zU4w?%{IZf+Ju|f+Mr^*85w!G_h9)Uc#fh8);?Gr3E~UQ@!t1P9v)xb?!QBiMeJNe~ zE|xG=qs(r#2FDHKV861bZp-Kn5m9JF4-^glN^!V*AB)Aw`I}Vw3C=^cYtOwxH1Kr*kLx__yum1KN)JU_klbj!Vzl)IqEc+{3z(AG zf$H+(_8yHmDqzW6?v`2voAQ+*C_C|;1c$L585kbB&nQIVreg;0od!@KK9YpIBX1R* zQ|2L4UdIrNUF5NYbqZV4{rk1wsy{|)(`qAEoKf)NnqE;m9Am9DE~5L&({fXK@wk9w zBXyE>t!mW)Vv`q={zKB_qzDGPKCri3!so1b5qgl_q%v;md}_o_ZX7li3T0I@F=LGe#Zi1E6 zmeJ6~_`2K(8GI`D*ET#z#BN!5Z~);mTQWI(rr;^xaS0j)krHWnt{{`DJKr?0C&GjZ zl*vw|%)c&3n^C4oR?Vha7M;ItxD%Q^Ha|Bl$fr6jt^g%_VB8n%Fa_jHNHZ7HLlqk3 zBI8$dF{A@_!+=(%rg~FT=*OU-&5Fg|`P`g9yac3p#G@IwQuzjPD_8AP%BYP_D?mNU zqw(U`y#JE!g|Y*Mc$glkD7MTCUGQ}}yB#v>Yv;t2CiBPp5izC8+*G*lVH^cr?~6e% zhL~ok!}f^Kgb9}BshlG@!I$JB6^J%!-CK&jac@b%++xCz2xF}XkH#qN{~lE_GNC&A zEL|(;6n8+IH7#_EDQYzfSMW`97EA~nfwy&A*&!VDBjhl5RMm zh=o7K2Bd~ARSAVwskypjsubF-IQnYMu=@~SAtP+89b>j8>Zh4|Bb^POECasK#8KT| zw}9%dwENofi8L<3rR2)t+@T(zu%*W9=A4z|=tzB-MeGi~c;LFJCsLKTS4;}3K~q5( zo<#|(TMF93a7H6%4NZUFRh4R#2xm`$4;~L_Z$JB#zQ5Dv4HFWFPf_rzW%Iq$3FgkL zl&;X|k{ADD!hZ}};%@OeHBrriGWD~es?T1;?d7HZ5EgR$)O-wAXy={A0m$yASSMKE zm|(Ce%&I`kW{=P--W7m!Bbn?7P~tg~*wU z%Bn@pBj`#%e1+e$vn^_S|ML|wrGD3%p19r&TfmJGRw5hnjFMLen`_HRS-Rs%v;S&F$1Q`@!V1Oz;8_a68)cEJF z!=z9?t6#$_$<=aHX;gKg#ieME3DaQ=@Lt{B<>i!*+$B^&qH z`hT49Xrc@4{wPiq3!ukTS9?+Trb`F98N!ao+ccu5^9J+ooug!f{TA_7(tE<7L9iUZAGi0l$0cL>!Ii^2emH(V zX`kO7T=Fcct1BQa(CcCkY>O$5!PePwklNs(7baQ?;8%ZBZzk%p6EiUD;#bEeg(1i+ z1hz3K77Mlv(=1f2L6mxa#@?2JM6h2~(h=zq=7_LR%NX=9$N?*WnE-~dXTRgrBoPr8 z#<%kAr5M&>p#TNDZoP1c3M!tq;KzB}M>9@S@W?!@g39+E!5IrL9U=y8GhCS{5ON4u z8=56y!coj%Jn?ib5OV(TT-U_Eps|CyZiTGm?`Sa$Nut6tbJj%+G{h?{V$nte7!g3m zcv8Wx7D$O2nn&b%Ac*2Veu!#vs^6`EqJn=CWQtIv!uZ%7#}FALwO#&=K<55n`BH$h z#orum!_ysrhT+2?Fq>4%w5%!S$&SXP7A#dMzfz&Jc{g*DNFw~{j!ELfI3 z=tiVSLbAWF&592DnM>Pj5>??_Dd1etJFQ!hZRdYkaJ;0%Ls}#`A*2>7>`(im{U6 z`k1<_bV9Z_ynZ9NIHfD|`9B)H)6*QUS1B6JQmj}f5Bmaw3oyM!T-7sk7QHD~+J~(v zn>5oB0AtN#^8%T5`V4Ff|B!;21trH$AbL(2IAo1hVJ)^%NdXbLbmijFT6U;alnpve zGs)P!zx|2zB=y;pR1>3Aks2l4_n5QQlzuLLX}H5xE8d9e?JE$}9A^7oU~*>RJuW`2 z6uhs4Q4*!AEgr|D#h;M$mhpIxNNkD^i6*tOOL4QtdED@hL0flejf0ym7`Y{?kQ7>8 zN4<^qcMjIkcN~rOkRlzD$UG|c!3)?+q!DDaO_NG2>o0PzxZO=uHe9=!Tyx`8R@%8H z7u3Fsnwz$q4)$Mi2U0a8S{Fq$vG`?oeEL+%u3@3(v>rY)LlbQO4Bez4OTH$Q0-uJa zXI@hy^52X+?$lDNvp(?n+L5|h_E*hU<2 zpV&w!y>eY(kYD^IU$0n}{u}`8n#Qw+W_M=9qE{e2N}Xia96L9R&xjUtV=9uT7gx;r zsyr-5->fz~Hm24D-^OFb0(Ybhr=kH;uaa1-4>jgHAgG+0LRrmH^`&W{NHWtIX1?K< zT+xoSYO1}2M*BG>EP(&fg@8A@t#pr|Z_oRi9`^bT&M#^h6G_=NY-&cOe&iUJsq1Sd zA&~N?74>fX+MAYPr;D@mZ$B&Xa8Y*?wkGevrSBAyi^g&ET5Y7I0U{)v+@&p&FEmuzVQZbTIKNPpnY%LhrcMoiJk!LX?3E|K5*S+0|Fj z(J0gQ8Qf(!(oL8ZBQCzfDm&DKzbS=ICoIm_4o7TS2-Ldf^iy%{$8gg){9D~RkvCfwB!zXRrc2P1r@1Q%) zxz~#lJ^$GWiW&0g7&o#CDSfwo$w~yG@bYa-jB4IyrHZD5k#5U#9i3~^D*NhIhh|aT zXp&k9<$}zxeGz@(GY>vN4EoJ0_lh!(SATt9T`9e-Ug_f6JD!E+fqV3p&z1K8;Zv>s zTp9O$(o;Wsjjo(nFpq-%)`07!qI>OJ_3Xu%_n;=S1eofvF?PdTkYNo3R_q45l~%-w z2_MalGh(SodM}S_{)(y#wn%+*4#!JWDe{8T}pHKPCgZfMocN~OdLIi^%D9D7q(I61#nH0{2 z^{x2-K{|B-tw{!K1Z<1^vfB(a!AY0pAS#}F;QI?ECLF1aiWqX07Yk5P$k8+ zAmxaCcP5{ZP00BB^jfI&`(XZ$iK_Y^6ZPSLo2c*q+eH1>8b|Opj^S)|NQ@#kjG+-V zzuu;C1HgDrs!1=I`Xaf;gDe+8wVaV^*6_5HlNNfAO)*c!!GDUR z)*HTz&`%Ku4qO_nys)*H5}vdYkwf{f(zXY=tA5xcpg;L!umf2Pm9SDc3L(UY%xOe6 zQs6FvOvXe)RR~|=9+@O@a=T?=egc*98JIr!eJssXL&xYx#+esLQ^S!qc9<=W#(nt2 znsfz6PE7zwBMjFc$7W1 zjCEhJ5kC44e{74tL8x%^pvYu5L(g^@Fv3Ddu0mk-Gf2nwk>U1{`%qHK%!ft>Mx_q% zBGr;cV9H6EA(A;3wU%AGSE6GjLXSE zt|0<>XqSJ>n-T;)Uf$JS0ZoG!(cnW>TY_T0Fj`MmpQOq)C3+EVf*EFa6*Sv}Q}9-2?~8s& zLexU8czpC9(C}Pk(k=BadrRu-D}Lz1}oll-)I7<&fn*A=Ibj9 zE=f?$dM&vqh>0NfcEV5r_jD@B4kx1^U!cp&7(vRa&_mHsQ6-Bk=reE9W}2M zBxP|hd(m)IBjb zZKLq=uUP0JgzBOjBvf;|w+v|5^U7c6)srwl5_(Kw< z-o$TM(`OYRI`kEj0cg~!oPYDjK%pwiP6oGutJ-dbtRxr20Z#jUCbH@3Bu78B)fkeX(e*Onp?@n3__tHOzZSsVop|Rd$aBlL& zW+!vtG5Ym1d)Yi@;M9rn3{h%8;HV1KS zw#~fF!-DU-;MOB!xBK~- zBnY!Uq(FRlp=!d1EjBkJgjwwV4}hUtT7`oZfsW%jx&2ee$d>V`t}o6JtNzw;TgIP9 z8NQ0Zn`v_Ri3vNNm9@~5Q{E?9Jl`vZ7JJdZ;ejhn%g4+jTxn(IFkz0$3xKt~?xp`^ z)C{9;rm3KV_|jA>-CoR4F9YxNY|lWQ^y>}DH=Vq9%{KjeGzfTOAjP)bgJtQ1pX2J$ zGs^t_z(!@QXq0DO4N@2OL{(0NGQrCJVIQdY zo+9vC)PyX?52Uray~wwWV+#`=K9Z*Y`cQ7RUbytpPmH`QIoRmj9WOVP^a<{g@H0sn{zv zxb3;$$P_8!3roNlEf5JHleCN-STjY{)+R}`2{T_m3Z+C+{z~1OUiS9#%hqb}kugHb z%8#ZXxdZ;Q?u%~dLip`Nc$-&DzrLDW{%*IQ&k0uo(Rjelmx?ZbRIPWoWPq~HmwkSF zrNAz$2zlFDD!!D#K2p9f)B|pwS~j+q$5TXtrkxBI&E*P0;IeSh9N zJie%BVF$I8<$VEZJ?~Z?J4$p7^v}?1g4=w|qzwuNf;0rH6}g!82T-T6A)`evl;RRZ zpjubaFPvhwTe^R9TPf`3Y4|dJ$JvN*1q%kWiPee;8g-xA?ID`3Y!;KM>3L`EWwRCd z8ZnlfHr2{n@Zd!U@y7-7L9h@p5JuCrKq^cLjS+EJewMDL#I*j?t65Hzt_wZ~JO%@@ zIcpZb7UCMU<08|EvhY7llEmI=gh{Y8*MEX^sRjDXq z4rBuo$}|pBs;aHB0wgV)a{!3#oJxKu*I!@8tIHnPLiFv@5li(P|^ zQJV*F5719)81>Lf$CL|}0A?zwIl|XqPU&c{dLX8$%_1#Wnl0&WNMf2gL&R7&stf2Q zb}GGZ)D77Ug3lyB?}s9}!ciH)jp9Ph zMn5gi-US8Xv$-^dYL9jyvjJ`F^_Lz0xhDc@u$!i?n1RA87hJ!~S%e-tgh79zqN%tQ zi7Y6f?HPmJvlyADVG7*D%b}5%Dg#j!@hcZ7nvtp05MU5s9P&U1!@<8nA%JazA1YsM z2Y-^t(iy7|QUoq36fv8%GF=s{CB{V^hRXnmlcvHQk~KoQo&@WD3k)b`hzlgMUK;sL zWtt(S{JQx0;FH-AU@iQI)9ke6M1%N{e~iNP1{s`_mm;1bat@amq#_NfQ}Qy=D^3ic zPRqoC23Vjr5H?H%p@M<25`0>pieOVRjPsrjs54U-AkJwChCGll^DEit)IVH7BYnTg zDAC-PDTucSD1v#S7pdt9NnpTz*G2zkkHT}gE+$sGokb@wkE<&vBP9gPMd}%{3~odN z<*^d%aO(gM1`DIU{)gKcZN6?CT>DotDUJJJx>MmQ0=DA2)iprcHiyL_J&1K^-DpDe z>Lhb&?X?J+Y_=wR9BQ2QIJfL>YSv0A-mne%+t4i$6X*LZy3gLpV>ZwkyT8Y(fThGot$R^G+w3BTX`zgiXt; z+C`~ndl@LYkA)^1X^%%eB3PwD&X%;yu_;zbXYft&>)nARq_!644_Jx0TBrtdZ1BfBu~U6z>Y=jKO@g( z>dDMzih`{Dhhr&ZXpQJU?BT}!;W{-kQ4qDOk-%rVWXAvHzfF@Nv6lm;9BP#PJP{cHE4=5BCc6-swpFL;6Cjgtw|R z`fsUQD`^{-wAsK$x?H6M zDSpmViK%F7_)G}Mu|g?diPw?t?*5mjzfqP=uof|Yk^y9{cFqCjr==>+SYp7lmO-q4 z+Vpa4Pi5po~$M6TGoJ#Bs!Wk<{7dVN_fK90?EiHNqi`3P~Nowf0&A6X-a zgz}Z!CSUI@AGUee7hZmz?u}BOfdn=u*UIJ*V&`Ln80K^ea&^pzdf9xVrM z3m)LEZ_cDLOWKv$IkKb9+3}gQ=`@RMO^+8x7GMASe)qyV8)-boly^)R-sqCz2^N9y zomWz#mssGY!QKKO4ts-W-OMSV` z@-RxZ&GfJY5VNaM^FD3Zcaz{D`Dg&ttUpo19{X7@%vl%cHp^B6LA)t=O{T`}YYbon z4}qblF@N{h8xg`GtN8E0nb=(!$sXVqzb{C1kw64crbM| zM385szCC#bAzn(<_fSLefNj;tYS2WF5zo;(?$xHu-3C0bebjYnF!*!>@OsdO{7@CC z2kz!VhQAa6swt$Ff|@);+n}DPq<#UZtQDuMTC0gFpqCOe4M69LjgdkA&nzE%1M++B z-$2>KvH^(C1|*g!{{U-1gbzE;Dp=55c-$qi_;88Cl~`;r<(rW5c+aA0|5+N)Sk|0K z6q!zadqu}LW9TLGfJV=?ywZ}0Cm|{exlY~O;1~?*hhnxlyA$9j7F_6#R!%6Ul zha{Ruc!T!F`ww^~G)h;1b4%fqN?Xty94QD<3zi{i!685=`?LI^=@y?N3~a|D~Heo zY6{8_XaV?EpA57D^sYnEhTQWi8Q%chrM940752h$~io+dM$kko->}pm za2FsFiQkNDJPY8jVZFdZRS+L?98px*a#_{#!V;!n5y~@K0?-vz5>gJpa*1=ucotm= zZ?e;Kq6N&x5@_JqpjMFxDn9?Id<+I4KqOE;7#c$*z_5KfF`=NLJD5L_sS)h{GSXCM z0F*&ggg_FQx%nD{ODGWGeMfZ<>X%;RQ`-F9C%d<`p@s`TgmYV>E6dCaD#APTm6m<)L|Lt} z%Cg`(T~tZtA?;YTr+wmC{Cit@foKa3lL(`VpWO-po_ZLhKmS(Le?rB5*4TjQvyTAx z!alns^fb{p_ofoFG0^7kwrX>7)rREXw(NVSc2)61Kc8GYG<&r4diC`5>a_SVIO!%u zbDmZnORK^@Y!+J3pSmZPH4}7~WjXy)X%xPM5-OsEiqA(q0ZX102dgda1XA^-V&oU! z)s@`wZEviXOVw35AJtV^A63=Wdn|4zeF-;j96!{)TdzL2c`mM;Ex7x+yhgIj%eu3` z?sw6vur^dT^jBs~)n@6nqd!+%`Y=t7Yv%VnW$1yPF=q?{-sS}`3}EqtKlsgUe0kZg zWn0;T9NpZ+72h+UPHMUQ;_C`7z!SgjOLJ8{_>)f`sMt5+R^B!yj2P?6juqNwHqI-* zH@Zx}y2Cdr-CY-4&H2@iKbq9Hzl<#CyBr-{epG}Q0U+v z>;aBFEWA+bqBJZ}4Z2*zGfA^#=HtP5CA6%F!Z2)@3e8nDdhg{DZ}}WfHaM>Rg9M9^ z(j$fButaN}JacuGWyNTJTUTYq@zHBDKcJ%XWfF!;IdBKJpA0?q$N05)u3lg6lh!o?BRfR!n~;_S{v(LH+pg0&{i^aZ(+)Hc`lPUVShxQhWh4Vp6r0 z=pHV>g@WNIx=&LE8*03U;hjPv%r#*G2>)`+(KFA*<>wo-8xE$QqF}MmKxaZ+K_hlZ zcyX0lp`#(hIZ@>&#Z|3aICNOQZtr$>%? z8cvgC`1i%4Aqd&;&nm}J1uu|l)p{oCveXiVl;*7lN4nw6o4Z1%BG~|m;7*Dmw9<*d zm02V_a|ybvwrxO=X|*1$v7%!X-9K3mefOoi)#F#HOr_LHv<3jWhDQ3SZ7W{n_0yEovgXK5roZ~rdy{#lzT$Y*x^ zb?@|y|CGI|G1>v5TVA>nD4do91B^9(gJ#6owGPWAfQC~}As{pX_tq_*HXgKa+$^_zli>Cuci^UcPLDk* zYyZlgfzND8D$DCcu{yhHXk)99x~?h!Y$H?KO#-A$h_an~6zW93zZHS0{1AlVrN-wQ z9+Ym7*zUFUava%|IqTsDemB?q;j4{%slt`WvmH4h@j63-pm6n2L7tp_2sP!Za)?{n z`?%->(=$``%Gp)-iFdSd_ng)_Fb%LLrf{B#({DD*;qh74%VVO!%fYAIKd@<9BSDC{ zOHOD=lDk&!vnD6?l>MR6i&KUkxEaw*oIc&U1nR7C256^XNE2MM7vDPDqi#n_n6_2T zVSuPx1EY4CEw%r3G;vZ8+#tb3Yof__^GD&%qq z9%Kb!u5@uTEhbnF48k?A=RDB>?i^ct<`6UyBWqMWG6G)a+9zuBuq5nwf_-hbp76(v zO;`Wy%uvObllyUf=Ll^Cn!>TTX%EgTX|IXZoS%(`qeXA*@KBl*`r|acxt>a8`pb|s zE7om0{cF;w7PEDbFS40LuId;O6GwDSsG_G~9S7-}5!VQ+%2<9t4wu`o>TvGbUmIXf zrQ&Rye+kW8;xr#7CFcxbi4G5<<&Ga4=$(`_uV(`6RNm@R%qrx`-mowzvi#?|g86A! zP_LO!4G)!A`JwXG4O1A1?5}54_Fk`=U0%erS8!$ANH6*0lxKSH040Gux;}`t zI6cRZkhQd*I0@WN6J^@Ob{t$CHc6od);dF5=$oYRUvq&qQKY3Dk1ojLa; zL7Oo~MGSM|CyTt&@$czurYeoQ2q+Y|H2+`ZH}sqr!VN(~+ioK>8ds+Rq3v$CtMR5q z=82d5-|fW^{kbVWBek~%JF_>xA9u%hwj$hAOhukt61N`7dIa{jB77Z0H9WmoJVrZE zsLSRD9J_io?HiKmWQ3QtQ8xgi>{M7xSh(d#-mc2JNjuM$P36}wX33%i?j*)B#f^=4 z$E}hG<9;65^tr9eE1*GD-n2;E43^nsvlf|=9k0b#<`3Mo4=|_8hY^B@oAcO#l&TRO zQ{;1N&ewGwhT>McF9DGA* zG~K+2av=sfPM=Xb)C7xw$YsjvY6xa7+2~hIH0- zW!DGapLk&7yMAuZ;NLGVyFVU!zgSO$a{iW6etCQ&?afk*AYI#eMum1BlS!rq%O4LA zcpqysUF|ug+s=!^i%K)CWB#Xnx^$M_J(+%){zTfTYH7cf(p;FBqZY2W z8aW0P4H|GM@DreM`gY+e!UHEBcAgmPa00r;6Q(@7Jlv#yV9U^t!qAM)MQjUpRSbz9 z6rL$L=8ocNbaD=;7Y=xD9cVaOz0Oyg8s4YDk>d=tOFx4Z#!omc-L#m!aplv0G}9qz z%LNAX;sNVWLpUvs*PW{4|?8#u})|c=i=ig@i#?md-uofAUk3K1@y{6X5!%LS7 zo6ctHcAC=lp%HGP&b3L__IYz($bhk7G8u??-w%HuLks;6#+ar9%0Nn4uuc~}C6vaK z#f_JCaDP!^^h0wezRu2$jCBi|PI1Z8VEX%pu!!K1pPUTIYw8(u`*jH3q|-jDw?I%4_nJAD)YMcW&H>#x~U3&JRxdQXNY)hcq$WVMm$VwZ}jV@ z$FXd=T<~zgW~ZDm=Z{Whn-~R7;7x_NU7=biLLZ9fq+&j(?6%w~a?J{f5w-!~NBDah zQTnxMY#uQ(*iI;MFDyF4t;TEdj}-as{Zi<$=7GXio&y{)<@K*Qm=2U^%k|L}Q8ARu z&Fs@Mr>3r&udNRe#$5xGAm+KRc5V7{mra_3x7#tF`g@>t55Dl$T@Kd4u!db8HOOQe z;9WXJEfUf~*rTZ+nczE=D?^%eO&Sv%7b3-1f z02Y>Tn0)P(d%`YUl}6VF&6V0)%NO9Xi3|pR7v96C^SqlDjPEQTt7 z-LL2oB+HxUqAsBH8znZH%c1W|jjsFpJicSm8Bpo9qc8P;ge#SI=UqHR?K6oIbx%8r z>P|B&c5&jl>Yo7HbtYi5G&qX+ZeDqi;7QzNgvdVq}d#A?j5Y0LmAj3|BlhaMGu!BZqBM@ z)CW0rJ9P+p#-}XKvgWf>;JQL2+|HbRvvEstt#J2Kax;5Dd{BDc~z|t&w zPg%VGK7LH6GtEWM6u8tQ$Qn4`A7MgY3|joY*f1^9Ihr_CKnMGcj=f2V-U!t26e9t@^)01tW+R?Ef2LW-9ucMbdHg=v7$Je%81< zw;KnovBfmwAPc49zmk#p{1`NFD{u4f`w#H2K83sb>Z^HrVfg;@z~S@I@Pn63I0A7> zYk&?QL4%i1qfrP3u}X8QmBgXcMBC6E8^popZ8)wNZa&@u5l0)S3T?-&jP)J{uy{g(K21*F_H)pDLoBxj9jcz)&OU` zA`lT1+&%!Qz#DLyqN6EH)Mn=(_(1 zY%*@l$aGtQW08Vi2)4us`IvUO4TgC>e#Ru`dD$yLRWLqnWgyM|&5;`)m8Ce5?XZ}M z44f1)LlX@RL4E{+5)C715`A(u8Q>z43{NNVpEEBL>M-yvCx*mP?%1)oIFO_I0N9UkKB{J; z&b&OO8<|zng-%KChiGSc^-bIRwLvzs}47WFkKT~;0KB$h6UyhymzZO8^{NG2nv z+>~YF&_bMf{wMS)nSleEAk?ieO38D93RD@696X=EOq?Gwn!r{gnkQo#sz>g0A^RAS zRwI_!2}Ati!?|mgKYs)Nq$m}?;&jz=##QON z%*o7TSUVVbTpVNhg#O+7ql|%@);h#p#m8|Rc_mCjZlQ&ER6w3Y=fy$r?jwCe2)WN& zKx2gdz)#qC^^pT)WXzMBrN@A`lyiMFzKck4e$RpAxlJ> z7JWwO-?uB3&-Y{VsjKyVQe@F6-2{li@jpZxwG$p^SOjLv=u5XHe40rhITEM4)zQ!zMKU#ow`eQI`8RtAmS69cfVx6HLhlRe{aDBykvU2 z^BiPt1f_GnF0igWUC^`NpRgp+C-h4Va z?H4rd*5R-mf0Mh|clQdhp_0oXmZ&6~U^_JFLp94X5L@L*6DSX-ixT8cJV0L-xo=Lq zUu<(31wP;PG;ThZGOD(yR5Uu7mXOZED{@C2xp>ZSlL94qZ%7%q%6B)dtb+|M?*0Zi zHY>L0dFw$*pDg-(!L`rScFdruP57tK@GNY4kC?G0O@}6RWB%=h=gahIU&lfS7DeRz zy4Gc7M1q7)_9SN&U;53xx}HTZuVa3@5(*l<%t%i|JgAVRCi0WQpBvbSOa^_jsb}U9azbArM;NH#qVp4z7B` z6GE9Rqp1ke3&o2Vk{&FI7d|w^typb-I@pjO!CUH5$9F{$;F3%(&MN&s5)Z=ru=Xpa zjUXen!q2huSc^Og7P@?P&^M$%=Z`3eR( zKKcqR+bN4TyBTb0JO7sI4>rtbF@F~Kx2n2!vSAp$-zo4(JBZK#k>hbZDq%CLntg;$ z9W0#@FG^AXj+lK)%fL1sScLhyQ&}Ap$wD5aAYcN8HRyagx1<=oD+w+2ZP5}@hlt1p zB8`~@)lGNEh=;P7z7?a{=ln!+9lPXQ7ePa`W@NvfC&h3rohfPM6V~QWO^ydHUZ^Mq z?rCz0;QIu8WVNK%k1%l=O=7$5Yh8IBxJ3 zxHY23%@>Pih23K>YHEM^H1HY6P>BDH=wN66U&j0Y-CJj3WMux|OBu~t0fdDdIJFy3pQ$;<+c^rofA0fN=FbAR%LY@uj7S z0C9`j=OIkBEi~wD@E?NI`?dy+UBJMpF}cZVToA;%joFhY>a}|kV^yej3DNovz+Q$J zxEcr2(lbwyb1CiM?a@=Q38_Gsix9W!b$w5@RF{=y#(j|e+3Vn@Vp+b3u4g=HT20qG zZru)+qc@eNr1dj`^zXdP zXMz^9Gmdr1-70FzCL&DO8u7$sg3~sNirC~liZWyWa1klmEGuf0K(SVy#X^ZS?1Bmw zirX5a!k56#*rd*YgoUj_1=v&srL;A76~O{+JjkgcxE0PJ#ePxvnnau=(>9vl#s`l z3p9PcLz0A2tvqp*QtWLA8beGXQIqImVG|ahGdS&j7~KShq3IbY^vwwNL(wJ%1*CQ?1@jlyw*Z>G&cZRRESvrq_m4}8B!G@{5SXzKO zkr13P!KL0wIPv8zatKCdF;J0Tw!V2qf1-Ty>b%W#We{_=)dHPj#}W`=s7w_7b(xat z_wnOHm`2ON79)F)hp1GV#MMxpPOvaZaba8SVmeB{*7-URqQqxXUFhS`X-F@!k}f;xpg=gVh+kC;WRTT;jD$gWPY zT29gASV=B|C4mg(DW3P6MnCXa%3Djh1QWUd)tlr2$xeip!hWy}tg?S?Xg1`K``+ym zk|ZvE=I%0LWCF!?$!@MuBTmiS`q9Te+OO3y%@}eWpTW&p7A|4m6(l6|j&YA7EXS53 zA)Aze_QJ%cctJAmVWA>njh+Ss^L8H3U%<}6ML#&9f);iKCYs`3Xm?Za=&8z&I=iBJ zNS2H@Yf_!*f(2+J91T77De*`!9;MspOn8@|<|#KkPM+Gr2g2CDY_9+4M-UmRd%n~- z_*TdfdsEL6E4%!zAe4QjIq)IRPlipX*y~MjtC$$cSuQQWqkf&^gTK<~wzF zcC0-r8MZ#wts|XXr63zZIU`_e!6|{3FP$2C7xgW_a#rtt=_@;_L}-$8A24#>*+>Sb zUF4aE1=&n9s}x-B6Dvc}JFOO5G3YoGBrR65v0BF)Z=$eeS=K9Cp&bc1;vF#%*aG*W z!icUghUJ!&a?P}^AU)<{^N@mXB#Y`wv{au^+NUzDdIdsx6$0Z8ITaVA#sY#Wtu&zW z1_Qr_9~7%E2#z6{dZ56I;C+6jAFFz#$&$mn$xITfRckzK4ErVKi|o43(z1;^XgFO~ zjCt$O9IZ-Pv3aFFjpz+bd25I8t#Xe;QQ|+ZU!Go0XI|-o+0+)6KoIgAZufM+m*mgi z({Wy%7>`@J%o^H~f$LI%)%pgNYkq|Sla?e(b)-?QP^w;norz$mr8*>L=U`AT#UZDu z8F9RP$6+xX_)h<6x>H73DVB{YD@+-%=A|g0ixrC&FL!A1<`%+2dITZbyMkDprI% z7GjRJdHZNxOGZ9sQ@$9D;Zx}%)XWlmp-kvgqOo?Bnt|rx3fNJ>j5(YWsG}EE zb9v=*nSd*faNduq87??B#qa4x_RSNIw(<(Zp<>J!;Q0nuLqbJa>t6B>=Yr6X-3>0q znGR0sdd(+qG?sN8d^>-X?9A<|b5+P3vB}`Y*t|Ntbme)fkV}t$(YYjSu5i)^jug#{ zTt+$pUyN!NrSdPSKaJn)F4?3Bd(WEvw{Ctvi6Uuu7Z^`k!IB$2sT+Qo&d=NRo~qO7 z_p5#L`HcKt=x5#TKky9Q-Jt(Qhj6m}&vXdef9Q~IE$O&J4!EA#x;y-EvEm&8!Z6Sl z?6u9QC0m9tlGxV<-}LsYUHuD7Nw*RmDYJQrP8w;H_j|&`m#0$@(#=dJ#y9vN~483$%Sra6x8+1_49xDOf*-4LFlUZREF?AjBU zZ#+Bm<1pK|$6%oISZ%maGLBw^1)<)t_mHO~oW74LeZns&QTH?!t~A;$aqd4bvksbh z$hI0X8qo2KG5vdM{!2&38yToZtK!xdkRJ7e?IeSiJyR>?B2;pCk|AbW@ zpJyW=&6l5c11k-)Z~SGHtV^pUUVk$Dvi#PS3_HI3{_SjiA6o(|OL-mSlSUX@AotT? z5XGr68|q+MvaeBfD4>HQ5=<^uf$CbGQK@spHpWC^G?muNa>QH3Imse1Dex|0U~mGW!=$9k1!VG3EhLH{ z>2(QEA|G6X=_fZ)K(v`IR2aenmQj=*33_%}1@c7ty(LF79U608tnH{Ka#EorDmXWA zf45RdI*O4`w|<;}L)587BS%l( zzk#7R!iI@6*%0^DGa)qwO_XcmDvZQl_G(~KPyqkAR|rjRCwGapERedA!o1-v;lGgiT}+bp zgMPOg(^tNkR8)2w_e^=+pq}=xa^4joH}7_Qp%oINCbIEF6LkA)Del^znm2%)+aD~` zb(fm-t_sR1u1}QbFpJ5t*6O-uA6JWzfGW&WGLx%oDr@+KhmuxW6?OJ_7FUHRB?D=p znRir@UEW95f*)}Gwi*eOw(kbJrR#|}5s9po2{PFoPHB^joO(=S3Ap7+2I*{MHA5V* zES9bkz`+kZfHg~msv-z{e*wkbGxreJe$Pl22Y`B_yMBlHc1XcG* zMQcmJJPt4dNML=(n^G^GkM=YxIi5U6mF9BEJ~Ogwe2ql)@9v$XZCVE0p~z;n83*zt zQgP)^S=|Z20~)%rBew87E#|7Le`{$j%&VRtLlPpzzV2jW-ZFKY_hx1=d&m%DYCEX1 zCZ1j)hBjCtNQC#|y2_S|weq{9EetKTkZH|nJFPDEdVKrRi;3uwRRt!EGH`qJ;^-zh z+N9ZJt!40Nno?1n;$-qcGDIcpD%Iw@QXnA8rv5@S?(Vbvkv622$$848$f`yv3uVW4 zmz;*$FxsO)BV#DR+3fDrQTfxbLq|UP#+lFBe)VGUOOt5_7edg22Qh=+ir@GFD4Xmc z+ZhgfOF~q*4d_B-~ zO#vMr4H~3$8IpRgoqPn}!OU_y;;IkY$>Y#T@SlT^Gz=6ekrrwUwyTsj`vXjZUw9@n4QSu*SHdwnter${;a&u z8F0r%i;_-Tut~ZO-tZ7X@Oc+vqlLcr@=fW9K-5qdJ&9>?2#4C zyX1+ECC~9p%6h_@SdA6X;mP4qm6l_Tp2s)?e$AR~6SA(*8aDOP!iU#F`t=C2B9WCK zWym1nQH3e&r0Jmx+OFMtLf*!(#&mp-E6JN->KND30f{gnltlSVFgfo+s1ulhS0Mm( zbk25HR4=S2TbpBBH!4vkOUdvqEc;HL^&l{+?^Z#kM*ZYx4t(t%SVQhmCGlMoAV)kv z`NaqF5zAmK3=NxuZ<2-?!L)}JEH6bp-t(?6Jyt~0$q$HURYWl+Vil`Y4W*t639#5f zkv_rh(*9$fkw4V2N1{d?035^BgM!yyr|=tX{HOp8Fo%fw2?wH~%8NV}9JJ{_qY&|k zIB!`5Ep3@@J%HU^s$_m`;$=0a#^acOv{Jp%NQFDt#46nC2v6BICYzE zlA}q9lzcu9R7OxuUcu+qa;sCP_0F!@JsP^kC%GnAtgmv#qbGC=+G8}pOX?bO$ zd)b`$Y&I4 z@^pGC6bwk_z_Gfb#q=|NNL)h}vm<xq7fP&Uhd*Khy!IeYT4 zioZzTONU&}SqZTi=i1T7gndjt$IQX|ukGKZETzM(*#7dGdrqy^;Vx9&H|_$jPY?aM z7<&w z{OtXISF7@MV5I)6DZ3XUi39x2;2SP**MqEe|MFdU27Vy%|8%5KZU5$+CJQzF&`+q$ zL*4md)I2>Q#pwCDeVRRgb;j)nVbG4+uyF|QQ zet;|OI=-|$x?1C-lh*RyZ|+Xh)Z||&Sjsk!2@?{nn$%W=sBP1=bZm5X(~zj~gmRtU zARnf)>@L{={)2F5sA>DAt*eClE#q~$NCGDAlL(nW2z=lF*#GP%gX_V4$O7ys_P3kZ z*3Kkl`jL)k!oKz^`HTXNjYDlpNX9u|A*1tYA#$4h9P7i)R#u;{yQIVe(yiLHQ-+k; zGE`DzcbdnNwDCNygTo8`>AS+z$&Cj`T>Wn-_NMt%PacU+0K%!MplMLnGm>WJh9nF} zVtBeeSr!iuJx&sn{czjT)x<4+uWKuRQkIZb*Ylz@L*qliy^80;=S777pM}Oik0SyU zB3DPK8cnHHF(K>0qizrAV1_C(p8!wue1Fe9OV*#_`na#@?I@{l^D5Z z3`mSXgbPH%dFUqcr+p3Ulf91d!|+=h2hTb~Q?%s^ z9j7iG=boT-<@!1hx5leTgOyb?Xcm$%z5}(dTyT1A#z)=YB5$iFyW1ef~r0%qNrdm9O}?-}BYYqcl-$e7R4DB+|r}S1nnVRSoMp zQQw*MbKJe7j)MSA9jQy^eWZ?td88uLMqo#s5Tt`=pH9)( z$&b!&o2kQlz`ldC_nch=dinzUTp}n#H#|;6d$_|F{7KGNDJ69aj)n*-hmfW-YX8hl zyA$aImEAB^|0R)jQvTwJbQZy?_W}dVT7(;^D)j<`LeC9m^-p<_0l7vu%0jkY6ZIKZ zD0?tF6Ov3lVsE&;JQ=3#70wg;;arBo$9vjpKuZgnVS{ylAu59Z7zlC7oSaFY# z2s3HW@x$O~=3VKe_wq1JYvXH^VmM|37LNctjto>|*%`3y>h%u1=fnCfe`?rpj|G2* zN*0zik|@p-3LA!VAR6OMf#rpEYd(#KULCDfy#C?xr6mD9$WwA@Hev6Q`aS@aQ@2H1 zjClroeS;pEpeIuHLNZCOOtVS(@{k}-VLs4A*%^3KF3$>QV78O~E$q8yaBb0kbvwo4 z9veHRd6LAu+6+uDC^aFCVyf~dN9GFIQ3!|oojN^u<$`fcLJ)AMyE~hf?`s;w zK9Ggh+R4gIRkC)r8BLCWzKskWNDq($J;k^Dy4|M&YYzJNSwAb^8XTG=%^7wYMF6YyipPegw`yo)JnH+ik&pl%~hr!GMoG_38>>n0G5z_LPI0#tX^tZ zvi~n29B!@C^2o*zL?Q-yn({1qRfHl{3Kb&RbyBgDwE-6i#3ZA%VZsf2r&L&$UX966 z$xJ>Br+zY(EyRlqH)#qjm|oqJri&h z4_*LiY4od76#?usja2An%61noz>X}T=P&kp8Q^$OuzB%=x7s-0e zm|py{8j&Yc=$vXJ?{nAw_HMP4*7-nHs9Lr3*9}iBBq`qyRe3~#m^st^fujqn}%3X6OPM5+1*jbI^8#qn`Q+lOWidJqNyikP8cDu zeRk5EUvoS}T`A@n?`nl1JepZ6R!|Fmoxf4alYgN|gA-CR%L1A>Vg;-HofS3TxjL@MeQe^fYZF<8yr554^h-1nh57uxgJ<2K&e$cq zAY@h)If!%?+jyLZNL?=|&<}|~e9yakH3tu|olFL}M&|wu)Gg)KeeoGV-6s{)K{ndB zOO~AJD}0*qds@j{Y^)V*J+Pe4x50Y_7MTyl!c|#E1Ex;~AGI&3^0BeJU?wxco|NJM z{QER}#0Fm|Z{bEULaX4ES2L}y-c~iV!!vD0$Qiho{DX6a=VmW!#T|Ds%y~1Ua+f2V ztc02MeW!PsVvvhwI5yFqqw$Mj7bF*poAaq24~;qm!q6aG=;wNrmj`V2H)sb<3xXgh z$Yye(0Atxa5Pu4w1I0hF2OJkII?{X^Hj!3kosG~ZT4M$ROQ(WHzR=d(8QQ>#zf~#@ zc;j;1HkBb8DJy6<3#^qKc*T~o39jW+@Inh0-fG=++?}&{TGWDAe8hqpCG4`7r{XYsuF*7j#2X5teLnHRG4RQOwJj#_j(nt_2J&-YwF}wI3P|dbYHMWf5>W5E4 zO?WiQiQkwD9acxGNQ1^LmuSv6$9a;}&yyu%+3+ak(BkXu`H24FZZF#^zkjaZyDOh1 zt0?O8xifFhGmmC-c2hR5L zu|5?=cQLvVUb&+I9?E0i(`oVwq5dO8miW~9D(dZyM?_m|pxbeV=H(+xtDbhD-J7%O zMs=FM-}m*AjD*kM2;h2NS8%FD2-wZ3y3zu79ZCJ$^IPm%{SKLjv{~KSh3B|M6XSIG zAH!O@B&lA1e$Lx6PK~dBw~M>-z1;-F+~<385lxgM0N!(#?()lS*(=IVJ-Fpdufu2X zMlWimh#m#EV@Wsnu=b;q>r~or(LmDdv=Wn4z*0%ig#0?lgO8aUnmw{b_M(gpOLwvF zR7o6!QqI3aGooL~X{XwEp6%h0)&RL2FJqAnSxM!=^ z@ZM1T!;U-(4Q~J`+7kS=ku$m;{aPD!x)R2) zJ6r=&{VW6yXpj=nB4Ut5r~&&X-5WK{^d6u&BDuWJAZGw~O{RaMsyZb~73jFN*4~kz z50^@%rkQU1<-M=2a`mfH?a@Su>aoMvR;<$Gw$FG8B{EsGzmaLGQY!5rnM}+=Wg#P* zse!+Nx+rXHvWybX5&g+1l;VAizMbq~(Td$uJjpJ>xJ1U_xD0Pqk2AcDEZimcyoA=4 zCGRcdJ@OR0hAcuQ81p7<#Qd~?TFiGU0SJg-IH02n7%Ky1h?W#4 zaH>YAeSPKM{__raGY`&4feZZbD=mK-0r4==>wKyC9a#iAzJZbYRp$sipmaGYcR&9@$=2FU!qoGdP%F0x?N;eAS$a(PLOf@-xzQ=N?I-r zxK3DAZSm?VJxN8?jvIMkV+6{sgQN-Z)F%7EiL!R6ReOkC~Apl1+C0~ z<%hXqxRGh1&xfR&nh|dsEmV!V?7i-eqCAhomWav9GeOp`stE7BQaa=MkrxKzgf1}} z@jfgUYbz>-nWr*Dc3KQ&nR0V51ynRsm;9Mua#mbBhkxUgPH#Hz>iMlEymv;WVBRr1EHX-EsVgsRf#5Ym;c7AHrHFvITy%L&qMbh zc+Z+b?we_*v+EQLW1OKa?`5G*V0)BK@JV?Ji7L0O%Pb1{rcPQ5Y|{-n`*#m@c*>@p zi=-( zruB{oqQ*Ipm}dxHyB|CASJ!EhG;KOcnI;$nMEBDk$TE~&`IyoCd1M>~UOsB!xycU? zS!QpK7^laY0z@d4iZVrRei_d6F(Hy}>{fzcgxgodl>kFYn*yP3gty|R-@r5%gwI3< zhA6ZkbpI%1))-;LYLmkX7c}{1LMXhM%&QKHS(mRqyfnx7%^G_GB?noHQ=tANWk)FL z4~x=9MCMdck?JJ4Vn!Vn zxhCNEbRa-Mw_25rL77Ts@b!<(vy* zjnSdDJZp8e0tj@&OA&YANa!>rC1m;)L#*W6CVTU*h&d%=xkCL5(u2y=ief%C+M&?F zGEuisrNowCvT^#N>INrg3v*(4N3QCh#$&fp)Vu@%Q)FrPekrGOqjy|g%=t|eiW%Rf z16)`<#D9j#YC-{M-~P+&?ef<69cRFA17O6SqI*-&R8wOg*8Fv#b&y_20W%Y7A@0%$d#spDX!V48!oUp|s1LZ31I}Gs zg=#x3eO`nB^^in`%re6&e6DqeSW)`2_a%LtvLG>q@#65n_PFJVX_fOu-TOR2U(UT~ z9OA}U#)p8=m$zjE_(hGP#=AMSJ;(t~#8e|c<8+eoFY za8Tm`TQjANOxdF*WbZ|?YAiyx-j)(=iWqVB1sny#MNbZ~zFJq*SE_>T6ioHJMxHji zd=RqUn5kPXcU@%57y7nX9(Nn%f{0Yt;;N}&!DMmqbLkcfQ4hxS={%g>9xUm`Ctusg zSNh#am)`7^*N}up(t2WhMi~iYe73Q?vUwuaq3;;-8X@t80t(V;R zvBn!L=DfDyIMr^qcZ3*! zFbS!C^Bch#_NnSRn@QZHFfh<*SxxjSoTECwPhEafvG=#>mvHEZ;#_71#GQKa`}EoB zPB+d@MELRFhQ5B7Jkx$NsCxMZhlR06nlJQE=ma4Rj;QTlzwiOsmo^VQf)@qz1u-u* zI03c=q27SV(ojLO;@UU}&a#vH<7(`t1ZS6wr?XJ{;Ox6R0J!C`v0dn4 zo_n*!J?mU=H_&>UuDw(=y|f&PUhVf46XpQm%!yWs$`&caM5X!+5Nf#t=OtoV@9#xF zCV1}L<|zd#Wj~?609@MJ?%XRtX81Bx+z)mM&gz@IFZh>}4=lHZ_m-S-r=eqa%)&4B zU%!*M^&G{${W^+CM{B?!QPjr_X!$jdiZ=VkgkQ~Y)hpH)LaNk7!=AYfP$34#J*^&~ z{uHjQ)C|{jiM|WjU~TXP79jACqVgGejKF@<5 z2MpDR*XE~~{U_~?CnMD`@jEBpuGg0+p05ArqCa4Hn?uZh^M~+1LrXI=GX6((Vj6q= z_YdJdx9$#JWAH#Oe?AN#1JEh!Xgd(6!7Q8dzN(hpu@&S5fj%;@h+ z$gk%f5Ebt4;P`N0qv6xGULssttM!w7Scu z^XE_&qW)HDsA}PsNw*|=SG23c{db}F#cshiuUD@m@jmSiNCyXDK_oxIQb_{&P#hW{ zuhueDidp9CS-M zjP20;aw{rAiE`8LPOFMY`|K8~V*C}6EQJ?lMV)?yJ zDpN$#1d8ou&(ciad(0h#TA|*b@LAtaEjh^^*(Jn!`Z4xAioP!H{`Y(f>dd#j@OyWY zj?@N*oN<%~{Jj|2y+~uw>V$|5uRd2 zi2?CJ+y$WDse;KCI(n1IAhL*VADcLrj28$9N_txU$gfq&x%Wh`-U~2Dm|c|uaTQg9 znoLR%OII)-0}dvJV^+@CFPEGMplKx6r|wmA)nXHb7(YnCeBY$9FNXI{78mU-N!1+$ z1E7h!DHDwh9aiU{AOLn@w*-p{MGWz*2xbggXz{VY)euPvK2F*AQ|;}cMWl|x^f@G6 z*ixD8*rwJ@);w9{`Fu;;vWg+|?aseH;GGn?jZp+sM8=&v9{$K+lh_@!l6;ru6I)(UwBDi~sfbpsV*=n)+IZv*83D2#G zkq1LFY@rcTvovIbD5?S~#KJ^72Zua&$;JI2-ZIT%}DOAILH*H3!d6yJsg*Qf}4bxamTyl#qjOgsAwQekTE zWiv>wXr+gBrczu%Vab&vcZB4OLr6lz7vfo!=o{o<-?pRZd~eZsIxPKV6ha)zz}m=o zqZ$z88{BohR!mY%(!{j8;vp0ef0bOp!Y6CG(KFK0I(iQrHpg3sYHuR>g>|{69EI>; z0WNT(Yq~aR_kY+M1vCsjAxiseeA?WQiwFxDAc<@m#D+}!;Htkht8zuW~;GF=w* zjyc4X@;OpT%@_4exeBenLdTrzsMPnp(4fAR#NA537iN6gd&*M1u!#66PGg*DfI4^3 z+m$+LA}HXE!I)TgZ*xuh0_zYmjdMz;*vJVq4imwliYx^r!|SRs6bSw;&1SCY^)hU( zc(9r9h?OwisIz=qM!42FsWnnNp%_byI&NaJMj4(&eU1_ucht4qL6SU8rNPAbEH8Yb zwX{yE{fr=wYc&~zj|jWUkbo^BF5JbHIFV;Qx=mUPvfKj*00w6D;N7!WTKGQgzE zm?&TSxe|%`lsjmfMG69RT}4eQx1<``JrB@8Nb%9wlhjy-N;r}XC+rIG{VQLvlcBPi z5s{eLfO@rY$>>l*ks!prDN>_;eU`yg$xRZpX&#AbH)h&jh+2WhDv=W+jVP(m4k6>$ zw2iQJ*Xll#NM*D?hoDn^&}TnA0}s0Jx9Ud3=X+>1?MvttEdjX&M|$T<88&Zr zO3wvjRIiBeC%)qgu-j^`0S}Od4VgF?(V8a+*QL8|gy=@kAj%#rSFHgQ@i5nk2df-j zXcSSvNyX0+&M!a_Cgbbh7|t&gNsX*F*=ZL&sL@66O&)z|w@zV_YL^GQrxE0bIPkPv zmXU^zg2x622W!BBo>W$?j_HCuM^-wmXJ#C`dGsYde+JU(S-?1E4#{^3E-@Mx(qMl@ zCC5=I_6|q`^<5fao%|7|_EIxgP`(;A}Dds5vVUNL&`I(lG{t+qTQ8GNpc5@wK_ z)ow_J%SpPd5J}HuHqOe$`gO&}`uvzNHIiH}^FNHO` zx2)|!@~P=0#i-JffmCp@gl*0H_Dpc~cCZ&mnvjCs90SQer6H=0KTWoSt5tV%eJJNkz?U18z$6Fic`w?q%`l47Hy>t@>o_KLkg6Kvs?u+PWcfgD4=O_fI?I&Wm6!0$`H-_oOWGuAHSf%wxpU_dvjmEb`9lOpd|u^x`A#* z|5P3v(F0=^4qIH#dG)^J9P|Z8G`ZeoctRBs&JTm7j!L>l|x{JhVS%?Y9zNf)77xdc8 zqHfq6l81sNX?Lqh>KsSuyxw)Yh$H5l<@Pk(kTRX3+zY$OOo~(<(v9p@yh!jy_zNsj zx|ohGUCYjG^!i69t=VvrU;XCQvozUGG=sQ$6CkPa8E>>3mNEDCnI{mFKEVY&Lebnz zo6pHr(Qkpq2<46q0Iz=7+3Xzf0 zaat;2?WKufem;f=)jkyC#?d#^-F}jJL%N1a#(`nsTYWwj7L)KerX;;OV&Nnw__r>r zu67GYKov6t<;NbRTRFO>yL-+KVFHvR5EU;d);@p$Mz&3XRWqXtXR+Cxo`?{>=`(aN z2n*4@_U%v}2oT^aF)8v-VCeOV&tuHhs=5WDDvOfPq}hiOR`^0UII7TA4YlkgjCF>z z2n<^>iNfZj7?l?|_-{%4zEU8_ew$;7rK1LjyTH3{BB5L=2cr;mPQw{b5^ro}6h-;d zz#>ZwA&k))dGo}Z5}(apSRdcz7zg}Tc*$O6%oh$h_*s9nswtHn5FvzVeh6-m>oX#s z2@OkJu2Yn>%%8`5d5>~HN4nW_?&kcB-GUww6mNLEj~ljqzLtK0#p$*s{`ZB0k%58n zf8tkWV*SndU$`ml2^-4}gzTqpO+rDW3*rYhni>7vC{m%YMxQKZ;F(%;l@Ciq@O8wDE{Df;8~_JC&wg%8v{{Y37j@QL`_{^R9!cr2$5`EnPlqkMLEg_&C z=Bv=s;|P{a`BhSZl5Y;OZmvOcL9D$-HtQ}&2s(|J66~cl);JXI!9}5wAql*;a;&dv z{5l1JX~Yw>=&3dzGYb3X_tArQaWi%3*F%X6J2jvsT~;8nR5ob$m!KMU&F}5-W-b3w zmVeQTf@?!xZR+6zy;@cD2mW)~%XRWy+4$$bg3*@Ojt@rrDr7udM-;}me@zJl(?pQJ zp=(2cblFPE&`M}vph^jiiM@^@ET?x}1Vy%$WO*NO7#E_-{b|c4b$n?sg48>KG69uI z=yVq!c&$c3SglVbF^eFy&*)74TRn9!V0mjO$$ZkhL_9UyklN4kLADzO8LhwJP^rx3Ut(3*z!d)h0FyBAFXtHd5{DMoS@n9{V)+qf zrBo_QLkNT`Ij(eYq_RRGd@`-8)|`XOOiBu`bi;iwRtEQNybw00AiMmVOGqlEKHnxK z$^<A?=Ub2Su-y0jL|RsaX{S@(85Q}Tiy4)Q`~?kNf6OC>{of2EkCbn|eN%b@+NBDE zjBuE$yy+fLlHI+>OtII;=V78bA0VWCagKtYvDYZYT}Qi5SWyohfg{Q*m24tlJ)9CK z86GjT-W~ij&7n&v9dN|UB;q}OS|~;uW@(T0I7UO|px};US5%;jRqTtHGw5M*L$Wo1 z*&4Jy^sBeJ@RH>-xhuG=6Bui`a~7n3DFZg#?2a?b!8l)Ow+7ovaDzx046v3F^N%AG zDCYM;&TMHOJfhK99yuZ7f?yjw0oY#i4xiRLuor~QmncaDmX0|Kc+lj_Z8oHEvG2eW z6Owt=!pbs?B0^#6y35Fs92iVmP&FR2E#rKeRF+Nv%8Bx8Ap}eEossVpZD1aBU+q~| z;g4R1ADkL2f%d+ME%c-TwT$O_k3l3QX(MkrZ%f?gm@iyztwc{r(N5VncV6>^AqluF zE?7*xLy{F9k1}F@DOr#2<^;`qOC^E?KD6fKNdkz)8@!iFMv}$Kerk6{R2(c<cB%BbAi2@S^ zGK?VwUB$BQVCuHV{0;{0^xlNz*ax&GI|t5}!MZ8I(~u^^NmG|N*kwW5qf>HznGFjJ zi+Y7X!R06@`J-Pozva7(la+L%4VFQ7o19>|B6f}fejnKJL}}ct(6b(p^UK~_VmQ<< zJ*-<7uh@$&LOO=2A zq}a1*HAu83Dq@0Z5qnCBw4ys?8-Zdj5?-?Kr@YFNq^gTUoPhEnc&Ob?$jGCOcA312 z`*n!E#ExO)TxpgZVJ+q>U)11nI{F;O7;H+~7sJi`oyB(hHp@_6RAL&&E>+@Fn#E3Zc#NBZN_wSr`WJnn0Vc~j=JrQbsf3$|bbEg4kvgn>l zOl^tjt;0UgOKD9T&$`dLBj9XBS0t%f(2*bihO&%>HAhH=vrU9KWu#8%PEyUc)HMeR zFUQ;(YP*DGThzpTC7B_aBx#3KN)9bKMy^9B&e^Xuh?(K&(pNw?JaZY(ka+yxS4EEP zD<1q-VwW^Wdp8!6m1tJca4H^vs0>kemr{4KtqLm|ip+4HmOppaAar70Sr<<6s9{vD z4AnQdWn!N(jHr4&Nl~_}ZP2d_r-20+bd|^Mv*8$10b6Tisv!q?9(t-W3WnGx!f0H* z-BdpoR;}zSy2hNy581C-G+{{xrY}3O4ITBP(Qg=#Sr*b2Ca&5uXNVhc!Y%AoQpLOE zif<_37jMqOhDX z98sE<>d)ND(bs9dt3b_)p)* za`TjMjtK;lIvc2X!_7h|^W|=|zs}*bm3)7b25#sIG|O-@echHqO|G-toc^t^5Q~F; zc;i_rwcjOI@)qS|Hy+`TaihE63Ns`XBGx9Hb=+FvEkZ2|x*Dhvr3x)0>8f3Jg4oe3 z=hPT-AR3Na-ASj8SE%msX6KLqzfD%}p4eSR7wsJQ2P@HW)MkIEiLiskpdr_gM~Htu z6>+kulg7d?0m!n!2&^ zhg~cSev}{e-b#Rm-Z7FUR9o;$(ZV`L!S^&jVr^N!}C1%?w3cjI5N-Cu>V-vXZCx7 zOhv4m35@TW$sd`K-w`b#BeE^Y5%K}Nb|{29JL8Qc6V_{B$e5dL4OF2L<(Sfz7p-H; z0gQNZmUCK#qjtdmCW#}4&b?34cYBaAYD?oxlbX+e4|&!I=}Kq&%_I<{My3OYIEje< z?-Zrg2@eKO-nJnu?MBg)dqkmMsIRukXmid-U20$a0p&F$QU=mnG3%c)jb3)dJ|_WN zD=c1b@(%_piuOH{b}=mquDaFIjkf>7X(dBPUJ4L}AVeFKgp^$w6tABf)z* zV|{W=)Qb*~c{U#=xGOr|hyLM9sR^`$!)o({dE~U6{)>-||7_9%+fMA7dWhR4y4N1o zAY<%+nhLw&DGRO~3Hw@^c0se;0ZYZB1azc8m$f)r{fjJB@1;Q*1pAhT6fSs=H)X)M zD~T-3g{7mr3l~TSC)BcfZZ($0%2A?kJlg&HLpaVhP4h{vcqx)E43;DZ=I_*e5sK); zCeA`NJt_t3F6%bV8%T4_9NXn{+HA*VIh}tXTElzaxKMiHk2p+U;9rwAp>z>Ml5JbO zZMNmS`P#fS{SDL0cO370XtAUWYdXH8=m@2F(O0g(C8UP;slx5_VEO4qU0~IiU4NiJ zog!mu!cJGuS}b(2cvVsn>v=19I<^iu2xsdD9v9>q6oxRK z4HI*Ha3j5-U>2Ci-`^T9oaKe5-e#wTMSRUA2#jO|m+NSuhN}KJ4^q&`PP&>Tq<(0C z#6wHIG_y5eoj92FCx%13lb$YqY(j3YWl6lh3_0}#C5Sr)Jg1{P|=8t1e&{jrmrb@s0`0CzqUvRIsTkKAiS8Gnv$bYyD@tVPmM zG1#-hDj?z9WYxM%zF*AQ+U}nRf|ZHpUaB78oiVT4(ZQNJ<${`Rj;MIfW#@_)?~`YX z>IR{?)cK!u$D^$U1=h=*Jt|aYiF=v)To!vFo|eeG`OE%+VnUNI4?o>9RwWqu!*4hz z^P5#$;$PVcXIco*XN^jSv9vM$um9oJc1s)B_G}>T)Wh^B_5A7yrO*VVy=kSjHWlr@ zY73W7ypH>+5|VeOVbK+;xxawg9=iYmyZoDyWnzG>j791E1Y9!Rwv~a)^`fTM3j(Eb zz;#9(CKqpw|bNAE$!KfPq&v#9oK7wSoEw&ws)j(hEpqM`0&*h@;$d0F; zKmTch*V+1dx}BM@wWR8A%JqF8-}+29`)-1l-&5<|Z_bDV=EB1ZJN16%j>Q5@$kZSN zcTs@Du(M^9l5l}vVSvELR6al|d44BQRt-NWw&XN%Y-IahY~VHrullR@M4TX3<=a-u z4N!Tvv>6=~#7Zj{GsNJaZ@T^jNk!_hUn>UKEmJwXUVE{6KO^=92!r4GXx0)2f>;iB ztr`EiR{v3{{d>u{&^>U*AW$Oqdq-PXORn!fVd!!x7GSRp#It>JP;J@!wP5h_bSpO% zW13R+pGE70)Y3Beo|>mwq)E_)W%bWyWB3f+o#9s`k zHmMDDWPLgP@AjRI&I#6>Ao(nP^|t9MMstz&m&aB&Y0}COl27l|YT|2f)J0bKgR31#uB-UO-Z?d zJgmj0Xo>xn8i7XnN8`imlyTk}26!BC1Z66VYTZ6)r1F1#nw)#~bqxD|?0RRsmHID{ z>*q0_h-(Fb!MiB5nXIiD-aBvqESN=M@##tPH_juT=%Vmk!{^^*Y)M+@_<)+lYPHr0 zq&j^plBaeYRrOO{;r8T$Y%wQ#>!kg}dGCF-lF#IcG;uknX)G{FQD(VNenlFvBXCy# zC|birlmnT?%s`t%#M(zPayd%d?1tl)iG;4ePLxn+!Q!SqJ&J8ztAw1!WcX0&;~@SG z$OJ=aQ%8ZsNqMzFmB*<@o-_l?q`2U@T(=4szxfI+^8`n4FrDpW<^uOK&LwSMj?+p+ z+vsB6;265XXlV|Eey0c(sfs0?vFMo~I3KM?6to_fzK;n5igNrEodqp1{S)?9q0;p; zDK6A$Y~Soxr(%?@LTp61QU>%;;a0>rnjVBL83;7MfC0Sa$?wM>J)s8l`|!N~vaEp@BU#%N#at<=q@1szAtpvjOcy%77vT_4I%M)I9SLqnMA%Wg%I zozoWPAf#Si^6`L3Xz-d-kYBwvs^HKmocg@l7%qmS@B7}LT;dWi<^wUpCHacNq=N4( z2+6&LxFTTHJ_R8WQvSpb$W8*S^*^Q~^b|y3c+&%=iJ&jMmqnkM*R%HENP<#G1(49> ze&tIjxc2l3XFnVXBoOORIaUmH!-gV)N@>80gX)l398ZMKn)ga!I<_V5os8!)C@JBj;FMueq^TLopf_)>G z1vE{)wA-&3d|0*Y)1ss^Yfzi~Ug3IfFx4Oe(KaXqt(PGwt0&k^4`U{=A%ET;Z}YUJ;1 zB1&zxDEDgPfMs+X(NC*z6V*lpL4<7Q{Vp8!+df_Pazxl^cFU64 z>Zt?Ih-w&;S*VjHLG1wFYeVLazG96Vw${NRV83cfp*oQ~FrwZzuT1YcRrO8exWtTE z2Q$DzW`ArAREZsSnYxN8h>c;3d1U>d9bW?s5`#(JmR%^qi45K(sb5#lCW5o6SJVWq zLKX;#e0e7x8A&9BC?Z8xEX#bmMiv3eCE3;BsqBPg0fI$}rffP~N~sNVE~UUaCzy^i ze`T&j@Wbv`ow>OmNmVjWv?BcBMOwqq^_h#X-A2pal6<6eCEbX%fX|ET+8t|YZzSue z7eTvO(L7aV21eZ&p-|;`a*e>vKih}hSqU&xA$Wnh@CYtL#jhi?{=Om{=zMPs^+}k9 z8MZi`$I+Ji-jjtHt%3;^X0~xzrU(RaudZ|nab!-mRk?{Oq7aVshc;L$ruDZa8EV#q zW>6`)2gVLSAE{UZ@$$QMphV4b-$fWzJ6L8dYoP}Q`eb5Ruu0IE;vwfyK4hxW}FD{J+WHJ?-THCEh4(Stkr zV7Q}2&PV`*m`eVF#CmFUlZy(H{zvf<`*!A{lDN{?0ku`V_%bYx^J!%4A3PO@CJs_mi{xw_%e*$@S?k?NUy|yH0jHpyBjN~S z$qWXirUK-}TYV^r9&k@coFr;=5-~ zElzQzRfF~`*~69Ee2Rzu>mBxXY`-%awM6`*$HF-kS^*_^4Nu&hbChjZfPFQ;e12Tg zcp)|Rt9~82#Wh4UglA*@$Gf5_yS`+aoWH$gKZ^sc8s}*hT)O)SX*Mr@zw9Hw#vCU& z{KlF2k%B23T8fuB2O??KXb2h&Xi~{^TxZ5Mt0ZjU0)?S*sDGB2<3JHn&!W$L|9Jey zi5UTE9V$A)J}RjUoC?~+7U%VcnInO9#Pw80$aKay7K>YNn)89E+qoKZlK34{)b$BF z59N%_hjvcUKQ)=$Wy_R|nEoHKv@Z^y{*FXm4yc=zwKBCKvF9=X&hR0VtAEe;Cb#Rh z*c)z!4eUs*BQ+;-br#Sc)q?SYN9`D|(F`;^et$pO&np_lrA}U>Ts2}Kiewh^FpSJ6!-+P~AsOu!>qunA!~m$AR8N^*6bsiUOtj>9V)oe=w}K-!zQH3g+ky266xhs8S( z6*6ds5KU%S^SPW6cDpKR-US$ju&dBp_!-5G8b+6MKVe^08;`^b??!L^M8+vtGVu%& zp4j_~kZl1Va;+)dlt4Gg^7plw8ksS)rR#8DI?>Cf1f%6=?%|EKKx^OdUQ1Y@si-SA zIKJSns2k32XuOiGiy7GG%gb7}K*8A5R>WK~VAY~M;*OmQ;ni4wDZ>xf3ihAUKx3x< zx)f-8S5a_X3o&OrnSL#xQE|(%%acAY-a}?P8sh+NZY4-T+yaOWLgq|@H-NYfL{Kn~ z-8NZbYsm+9oO-L9gDtb2jb+5tN3{J3+;KWK%3=%?;ml716geUq4gD7_)T+cA{zSvKm_4%~!aw2W`kv>E$SD2acfp@mz)6SL(bW@|Z3Q#6b$;?mBj`Z((uAs3kexux zE@lh$%2_iu{Qw`6rei$t(<`}pnt_`+|6a&EEAjpW?0oCq+-TPhGmoarAYThYM{|$V zGqPD@e;;D*S^z5v+0+5Ue3C#&2#0Hgzecke4#(b`Cw4jXr1$9BY18mr^wLLL%*SUBR<;D)ai* z5s*Lo(OVMuLCVaupJ=~jA5FSN8vdai4PpY~`~TC7}C*^kq}Di~LhV1dy$GH*~v^w;cas zHV!|vg(Qu$R7+eGTEN(-Vybv`u&|Ukj>KE_N3C9aq@)F{L;w~u5`Ht$qG7>=Hx{Kb zjv&OumDT4useyJsMX*@0btDcM{vL{p7D<-r*VqI2Tn)hoScudsa>MK2X~VgYP#Z?*IPRnPcc)X4Gwt7qi+uK@^~Iy#B#t;ycofAU8*p#%om>XI|4 zW~9l|&!v}Gcvii|i%SS$XzR3yn@AQf9)a7Avk9847s|$!Q7(^t7@B~=-Jy@+A>)hw zs*FY5sm|fZ9LoJ03lmX^&b4#|ukESM2DfU{zMYTuj4?@U_yg&2Kez=8vZj6hnIe^E z8*7s}2%nK@BWp|e4QZ8e{T)+DNW|0hxlTKLlX1aFZ#JO*OY(mNqhhKvpT9^FQBBqC_kYUeaLlT(o7nMiiZh<4+;Hp?hF>3i^=(O zbjm83@0O{O!MyA=eX1v65gr763x?^8Q7+Emi0Xn-o~e|XH^Jj5YH;RehT|Q*XoT>K zds5q)0YpPb{<#fote6$cY?j~;JYgAI4!D%V9ao;Gj{S})FS~XeT0F`V#75ICNNl*J z^-cV+pauw1tJ%e~aYD)Pq(EYQ&XrN?yZe;o&GGZf&Yj+MXtj{;&JIGim7P=(C+~=Z z8ip^T}(A5PdZv58W)yK53To4Ux0bhAT5Mcje<6rw$eB^ z&n3SkTnP+@qxg3wnWH$JD~P3d@=x{2d^B6sO6p{?^lLdPsR}=EM(`Cj_DO$AJNjM< zm7Qb(R67*g1${&Y)T1E_Lv#iuyBL~D6~{Co&vyXc(JYCFU)D}4LBsB6k;33HBa~aj zeLr3+bPYU})PCQ0eyS+TjX+dUwVN??!jJN2xJi8$RZjl0B9_6>N~yC}Vl)OjY)lYG z^*J8-K|HgVpGS7E%rF|G@a&B8<5`ClLX$;zMUV&5?HLUMvqeA(NOk>5Il90y|4Ac} z4gY({Wu!C(j|k=7_I)j3kXNbPpFbpjF9Ci{Do}6X3d=2paN}5vbEp#XbCQ&h0{Ib1 z53*mudIBqE-ObqHU*KBFuy}hSBLfh|gx~4qHy8$u!EK?0wAth(#$fl#sHjlk^C_vu z-hhPR6>}MCAWbU9f}b^gvxk&~X**j~zNu>zOwy#~vAvFXg1_Pe*@I;J1^FDgLsH=6 z1$@v)hpG7kl8XuwimLXUW-Ju+C&TO7sT|8l6d^FCFbAyCi2lGgP=+yvrpXxV5{Bn_ zGWURd2Ak|gs6K0%8?xh)WT#GD8L(d54fYl>C*vHVcyx}V24casbN5895?a3KOq%5F zG6b519n@kee}(B0DHAM>6}2L zL`MJgT5ZXPUpFVay2FZD?oke+-}{4c-L>mcmvv8y#$nF#0U4FS?t^Ej;2RcMw;7Yb zF4+zu^;y+f40_R3M$gs#v#3TVMRy#~olJhoof-cww-1zOc8ASSgXXnG9S3cuNyI5y z-no5;SYf^W|Mxfzc>H`dEQrLSe!<*Lu-=SRptT^jGkH``3%*q^P>_BWd^4Qw-j zkK12gA7?IjNCQ3e7?t^d!ke*0>rMzTLiZii;X@(dU;5icwC_Fa*BkAhY+Kjp%~?Lt zsRS0($t$z-PUN>>>r0yy`LjF8)(#8Q0QnFN&^3n;w6j9Hot&Cim|gGCl_`o8X^~8- zI+g;!6Y9Kk^5b-$!6X9i$ySwOF@fP^P)=or4Ulct0wm+)R(zB9L8P5I?amew1gVkW) zvUf=+*4zk3JZj1xujo$qVfT_F>RoP1uIF{YKKK0mkG^Mkg7DeZIwrw(AWC_~5Q}^v z#QQxxywiNt`o3aS`^VmT?$-Or)q|Jx&2Iuka~7J{=hl@Ged!N_w#X-m$bnZESis(3 z-u5UV%{~aJ$Vaiv180o=`Ti;ILxIG;bqdhAMbm2JBj&dWvZG9%!MC(Vj{%aOdHpDL zC;V3X>sMzj1XMbU4gV3@JOQL0WoWg&ezr=^!bF`I51Hd zPGQFt%i4~2Z7j>s$p^+$)%JoN%MmBa#h6q2A7ChD%IGE`tAziwtNjr#W9?-Zbh~jR z??5H3ll)Fv{erTn!~R+ZHUj*Zudzt)U$Bco&CpK;DJc2qb&Wjmj!uZ0_Txr+D<%sn z8t6H$=IMrr5boAXMshuJUYgx=m+pi@**=f4)^A#KOI;TE@XI`o2e8(i&zA>C6x6=^ z+1@}Zr?c^X{d9x4`#LvC4i+m%v~RUN z+D9x>uWm8#-rg+z0Gs>V^HGlQ5MO4Ff#1m5G08GH>I!Er`Fpywgk-?&SBN(`IS6>ABoq^h&jj>^{$niVz%WL{7ongO&5qNwk zYDwF=ZUeRu7|PjeF{Wpll3&*R6{P#gI%L06!i-pMJ4e_)!j5;#^T)gK*?E0GcH8H2 z$$YsnbGv)rv}f~r0110n7%+tZM&|MJr5;U;OG__sAA;+^9#M1)phdH{H??agOa1=% zH(T0IXkUfq#D6OkIfIbOFtVTbeiI*LDztT5?paofz6>ujnj{WIt= z_wqRdCTk*&oiT@UhgR5z(7diO@{YJfDjNiPBtLf*eakSB^jxsRXuD23Aj4#nr_-%0 z88bumLHM`K*JvvF8ZYZr?9vL5|PkVbnrB)Yi%&h#i z2d{}1lHo5$Z#XdeBdw&sSj{*-pG^WS?X!}OJ)PiQzOt-y{bHmRH{_aW?tmZorw%KZ zSE1HStOKmtH*|a6Rqxoi+?rUw)CksvNLKeYgFI)bEjlr1JgK@1o@O`qo6mraKe@AT z{A1yg_0p4=oAj`&fHWHxDt48W%}-}eDhYWa){B$=$~oqiD#oNIr<%|7Iq=;}!kH_! z8T&TNGD!#6nI*jzDg^8FKewinySVOFvD56s3{)tPtdc`kwq4gNi|T?3^!_qtfnzjs zzCzm^WntD(wHAh#y?8$e>_!H0aO5lMd0>QNh&`0jJ!IOx8CtAY9(G=1Cu%T2!#B{R zE=#rslj2tel;@R+WL#!i(Y*rBTHuT6` zxLNbG6{35|-cv8dEa}!hXNLQb!nLdMW!g(`u4BqN3Wx*fdZp2W6xz9KGh1}#V??E_uO~WZ~p% zxa(B_nNwaXE*JBId<_JBv<;%<4d#J@+(r}rXPJw$_ftpghxO7d`}t!@)N)NX3Pa@t zN*ilCl;4eadl~>DI0MZRosD8vS?&fVy5c;hQTt&34-{L&wU2zc@?_LRcgRwn${-zk zySI)No1;n_Y}b9bR3Zj_&@L8qFwSgRG9)5(%iws30YCHiL*-pwmCH)1_xgb#P}Xx=Kqu<5As(!!4&fUV?QwVJg#p(6lm2oFSNHzLFcx zkc29gs=6Xby0`;IR?2@rIes~f9c*-ik4)|7o4?u=ct$UA*eHZ8xz~WulXf+#gi_=0 zt+);-qsh*;qW4bfn_Gn`WU!!V`y!pn(7t2mR446F{++uXb_2B3@wsHO55~&yuz~X+ zMO#oBZIxD+$&TlPFJ?3~egy4KkEVUy=_ZRcUkzVUB96Qur-q4;Te(7(X&ekV(<0cV zW^`w#dHhP=*`4xA7zRyoAbt)=$1-bqp?WZ6A^_G~l3N11{9kt%jdB8Z(y7R>U`-@P zOnPMA8Z$|Zrbp2n+txb4>aCYs23Tu4MvzN3Of35n58IE1v!-oI=uY~Ec4tfMd8UT5 z;<0BcXjKR_wu?6zTt0kIM$J^hz3g;;zfB3Tss2#;O}%>Yy)x^@v1#pTG&q=lzp z^^@YNW1nH!VXwFEYl=}i1*SQ+HlhQXG&_+PE{8#r26+`bfc)+Z$}Oj$?N?Wl6{BUZCuH?hm;UuqN?D0bZbXMu5d>qE3j$Qb zT(F$rjh^}tuFST_#{J=Wi#9Se)!???OMypDRUJT8x#~>@SW%VymV}Z5*oTQ8PTC0x z59EV2dN;ZU)LxAI5T%zfH`vux7H>b`V%=X?cflfe`7e_caMZS~ni*s^J;qIDq$Ji) zHmGS1uWNOu*B31mX%9)!#4d-y^ms8>P6PZGGLM#`)?2gP%uV&Ql^(yS5Ue_FL)f*g zk98u7WqTWMRt2aLtgzk|s+tFW`w$PfK$;3B$J!@BwpbsHxR8?9kymc6j3Jol)DcBD z%$kYljI7YdR(k5FEG}MR^N6^DmcEZwrHZ!1de2WGb+{ca=Ir}3v4?mJcY?J#d!$t~ zXorv7*9SK$Mq{yCloX*=wQtV5Wd&vT!DMCzg=buJkj%H`8xa%54Cvqh@fzY{$t242 zmU5*2!A}V6{##PfVOGi@$Y)dJo7&3>E75@dCFEZ5QEs_jnz`6)J#2pmQ|;1kN^OQz z%-jEDkN;0i{houlBb1DHP{*<9Mjplmnmd(V5*npH{Pr-?)!w-${F}JQIXI+q&b2c8 z(Nn?B4g=n)G4Au>I?js#zeSzo9W(X0;(B!zOMfE0FPL(}#0p0a^oeHKG>`!(^0_4L zJxlGDE`;@az4Xtxu`_p6-d4j^s@N&7s6cwmEzzVTgXOCWVDs=YKQTTU&X>51+mO5A zfFiBCV}!P>4WCu8C1$QHU}}eSZPas8Mx9NyMh*b(7<(i{FSS3)ll0DJ_MB5RKu6*U9pS-8$KiSYNDEVxpA zd4-rJaW!=a)?_+6BF|bj>v~vAuFKWw_L$$nZ1(1{MUW4oP)Q?|-VU9cMvK>;gCZ{C zSB~14saS0yURJir*)Nnq$3F!)({9o8T&eKyuJJt3P*o4S)`Pr9G9X`D01;oEqK-&|*QyYhDh zd?Y%5G3AqG!-BUXI-BnJy{r?HviW#&>3Ti(Ix~E%d>5(@S2FVNpOg3#d!#{Ut+t9C zo#U3er-E{`W@@Bf+k3N@kLB2WYUQq?BN0#9pmO!+bsL@NfWXp z^N=nP2q{wYRx__`klsqwF2ot->6ktc1s@zN9l84+*UhHD#dYcT)<}qv~hbiP{8=kepU0_qaMs4O3jgJU;7>$!aE9My! z9A}-mw-}_U-;NQg${0)R`M5PAmZ`?P z78I{qnE83dTX(*KB?!`;o(z}dwVSt0IkbBdqsjgH8&7k+f#1z)BAq4UrOxo|G8Q@T zLj03FQlrA?k_7AFPq&nprQYPS2fsPU(Z=U3alhxM3#)z%sFEX859IPuyhdClc{Oh4 z%DS`di_(VV#~H~SVfqkqDAsF(ahSM20HeinW#t8mlL5T`8jmSPgf9H z6^|>`;EvEe^}O_o%zHs&yhYWYj`Ra69O2&SztU3AE|OOU9KD>Jt;ykChf7w{*T!#m z_L|o(GApe;g+aaE^KT!@vx|RvRpr2HCT;Zpvwb^~++VAJ?79!ujbibhJv?cW8?fKN zTc29|JZ^JXe%hu7y=SO-PPJ4&W=<^jUis#io3|W-xxnBj9bFWc<)kg>L7y zW}Sk%Tr2i_!p?b2xG)|cz>Sf+jz;VNBw{Uc>!5c&16Z|%qzD+5?B z*W?;7Bw*vysblUu_7S}>$>#n0a{YsDByU5X65+C>10P_RYm@P)M1C~$ocDl?+u6Uy z+HtwtUU=G;gE`HXyMdhpASEA*AO)!0pRsxaVlP^y29(=w)DZ#w7VdLFGMDi4cM$m3 zm#v+*_N$|nM{C(;CeKzvPq4xrJX3>m~CrUkLHIqY9wu%>ZT+vAy zV%3s!i%y5`5+l2I?$p!S7D-jsd1JC)uJe+A1wZ3SYhGmw~kz-!M|;h5gg#9lkbt&_DE7Z@Qn) zPwOi_-7#v|3|G`>MVF3UODo>pQOgWN7URFpI)v8odAB#mx zdT%-!AC@1M8W}o5OTO@y+m`|fDn}l@&bd7*=#GR6;L9Hsb>4gEn|M$E`)Qt$k>!7s zKg`6+!0~^QNdGa1{c8L9oj?3-4#VDnL33izL)uwi@n-UhlPqs@L)?$_-R|QV)s`Hx zVqVZ#3+U6Mq5n>MjfK-@|HhEeF)g_rKW|^Sy077QeYAAGZuf7Gdrsi&j@m*eVwVqL zGbC*239+#3UvA!)p^o)z682RpGNILou5Dw~JOi)scx^d5&-ZfGh#+|PV*-bep0B^} zgYbWDcO#$W@p^+TpF`lcXP?h={&+8uzHh_0|a!+3U#1DXcF2$NPzS?Q`vVT6+iY>55j=z6m zl;%p${W|`(g#j(8CKpEdd`@yc*=8Y2nhFMiek0YSM1OR#G4!_hpL|L9y0I|ZVD-Q> zI&pftD3syG(7GvUc|}B1CL-mx)JiLzCik8idY!p2`x<6NxKzDpUUaaL7|p?Sos)RP z+CyM2Pul# z4%8^;*k6^dChrDal=TxfFkh_}zD$w>KW9*`lGz9w;Aq6^ytJ~5Md_*t7TQockI#NN zD(3>^?;|AO)-$|RHkb@`oPH2muksvBl{pAHXE*yK26gM~7IqRh+;hWFEPhUQdVBUI z-HHm<4iO}qGoKhAQOR3I=jf3zpcP_zlu5iW%X_lmU%63&>Mj~qR*%gpn0_g`-m zZ@!#UQMB_79svb~lMXf{`w`Z|$)MCuyy>@~;V0l`C-equ`;X?qlN)4go+E5J`*_DA z?_l+yy;vmt>TKs{a4qvh2c>MW)zMVdd9oXSu8%70%BgIRi=N#f0nP>(jlQN$_X5&Adh(|04NULbwvYYAooJ z#IYPZgDdoTq(=FaR10f7noGJc&*!0M30>>xIrB7L41F_*WX1i3j^Kai1soK|r+7Un zrBL3(A=>_4B=fg%CxGlo2x0+qbC7bf4|ESa&2TMR_4D>YG< zcuwwxNmkzjj2godGAWEyJY`}+h^V0KF5Wqx+yS>Uw~wZu zka6M5e3Cc`h8{6Afte0~9IjLpq5>Op!b4G3kUY*{{aO}pJzesXBG4XvvJnNZwD?%2 zxqS{#KRRnkz?t6=WELFU)PLq&L1kwiklagHP%ng@#oBtiPcT29Rzh~wKC5X2D$o?= z04Y6bQymcQV+m0)6jq<4>3u6iQowyTTttexA(HER*AHRU@2kqSTHLxTXdu8 znL%8``X)|FY4;{7?JEz&p9{rCY*vl*2dW~HcceUio=&E6a3%kZPeTldPIqVMSsL_^ zoWFpC!{)VN!LA|=qA)tLUV2n;SrzA_eGZd;h>9YK$U=Ot`SML353^3JYQngojqet9 z7>p(OaA#Vl7gxSuf;8@$H@B{N=`~h6nnj+f0={XU9@Jto7Pw4ord9;;Uj&@6Lmnu9 zhTo^^uFZmM>JS_f8@l@-*x18tGk0g>(lgSvhw3~tHnj_F^>F{q7=m>;;MmjIdbE4lI!K_f>oLrfgU=_Q}gNN4W7@O$+u2qUPFiaIW z>uubl-x~C;)+j~1bLtmjsLgv6!t>E6dQ##RViukCxbe;TOQHb2GVa;RbntKmuD z0^l<079dG)i2TnKE`apaGt2Cr5AtYs4ugOxms>ZmX<=f8HRDxiXnj6h{v#4Yin ztxUFwCS?84ER`~BILEqjXs(mbz1p7V2Bc4KkecE%i6Z=%5uMQBXm(q*Mv~*(1zD^( zM2J}ELtBGC&+di6RV7SYv>TNe3FJM{AJJ1diN?d=TCY#z2|9vn7uw0?nFTU*G(|o1BQJSr`yDeaF zr)0>50|s*1&n2Cmgo z%L0Av4e_J3SU;n1nuu;PP?LS45rvO3PL4ng;h^ii_fWhRQ%Q6Ga|yyrgn0B$*sZi) zA`uXj$Qjqtb1EBlEL~9eL0Mo+>va0R7(3@6%YtUXw{6?DJ#E{z-92sFwsqS!r)}G| zZO?3f``6ppw=Xv0L`I#gxK)vP>r@X@@}Esw+&f*6Ko z1KyJCW(E4sB6wishc?wo329NV5fQK4=)%AraK+w1Grpvn;eIB*H3<-RS~AE^)g}BN zH-Un-?W<bDL!FDbc`*w}w-7Zu`%FU(Fec4#Y6qyrzSHzIceEkwY#_?2+ z$|pUJ5;ZT`!gHoP=GlL{uvUvY;Xi_V!!nQ$eOd2bn&Y>ea#s6GrkSzjsvIuAw23a@ zn86s8i>}sNIL0dZxrAo@C0YG^Jy`FH)e?O$H^^4HcL@k&Qxu_;6ShM5LqyxV257a~ zljqgVO~a|2_-vj9Ee;|Y57UyBK1AAJTP&+`Bfl*n6pF*EST2`|HNG`Uwr3ZjNc71a zSE_KU4)ar_rGD97XN?$w9NUwEvV47tg|Bd{66!aTzz@o&!KoMg(Z& zY2SUbDaOv%4^xSoeP&(APa5&!ty;UmHz%!@F!`R!A^j55ijSKMSXSgU8mo=fJ2A~d1Y z_%-cf`NNAig}D&#y?aTR4@gtwYK>3D7ppkAgfogG4%U3o%Fn73nIEegP1JMqq`Ofb z_Pk@fgcryyk=6xA=9c#=4vKXW{=!_G_`RhgT_=g_!o9Cm9p&0@tYbH}j;S7W>(Rwb zL}(AQ3Oej$Ji^+CdS(+@3L!SX+uU$(!WD;5KXlur_5^o$!vy2em6$ycS7a*Vn0vEz zGgjh_&2_ak31p^xP+yKp#|wArOX%_hDS2aR3BI;na<7Zt?fUx?0w$2z;3~ILFr$36 zJ3Tev+wq_B%HBDMWbgSk`K9r*d&0*jTN@BUUfufoWxoTN-S*T_X22aR=GpIDn&O+; zuO=BUvW~x=B~@Yu!7yU}AQfHBkEAk#&#MC8gr8c!>HfP1Oz!^@{PjN|f|*$V&+McB zp!qo9dR{f&5JkzKF_^{xf}Mg6cBkr337JFPE{K~l|NN*UmC4?ju`L?LcwUCkhF4z` zU!Lp+pw9^9<>hA}_6MK-rZV^dW_P0x73vn_do!Sgz@WIgXBMGj756AoKx%UI>->9w z3VzWR6fIa_$15+m7ZmZD@QuDUMW*|HcqK_MV0#Ek2teJ7AK@O#5${M6!bk8E9OBdL z7@b`WXw~h<>B$NRBiHplT7u_{G(2L8M@%HF1b}5tM2V9|2+P@tpv^J^7NH) z`@C0)1IEOK_ABJbz6j_3c%nW43ZwI1^4q~d2+ z6Ea9ilykUT$R0S(udAxaafT=d+Xlr&x+B5~nZKbvw4;_0&BR2Un#6KcpIZ&EB+6q6 zW--WufX4z3sra0OO|NRkvoTcDGW-7E+JptDsxKoA$n_74sXmAYQG|!zcHne>qiU9nwnysIw1n*i7h?mnEPEd0V~>)bC*Vb z3lvbn89#+;Ry8MjOxGLBy*Ohh&M+A#3Kf+Z^m=?Z#3`kHVUKQzLRSDGrP%01)UE2o znfu*KzxmC@I5k+1^IUor8$yY7Nk8VPa=#KYMa*CTOQbWuUL|jcYpMc+`m_SYJY4hv z3OhH9d;te}8&P%CiuWTXSj5tb_oo+*83 z(f64y)OO=0%*eNLVfAXK0#3UBoJf(k+^7_imb=_8iT-@AneNi|*q z_G-ZkSOb!-g3!gJ(VC^VpdHG_yhczbT@p>IwT_Zg+ZULMAL5>lnGi)(Q@l$}(~hX( zrAl#52nIA3+46(aS{!cT!1i zON^-{&wi1^)hzxDNAwI~WmI!YX0(tvK@r^K7z#`feKl+oC2(cE*M@H6ml^H^n_UQ7 z@UgbX-B#^DJC8xOEvRX6+Sm}A+ltKzo-(~Y^aNJHnG9>Ky*n6KRL#dkj7Btt_e#y& zo6_Ds$HK=nw?P&Nn*QU*u)Z65+Ib6d)V@^L)u@de1>M3J5A2Znsuo4u3j<(R>D991 zO0c{IG{e$+_5B^1;bjzmYQ#Qm`?-x`b=zBnM(qn1Asz@IiZFye&~HmC;GoDdY{OVk zIJ9RbeL+(0JB&Rd1b&cckdhUmuUl_S4re(t7z<}t$P@Hl@xGJ=BqYtF zQMh@-tjwyixQjQ$FO5Q5f?;Ms9+c{~fID8J4r(%?7^kGTuw_84@<5J@V0MK%RIpB1 zCk{wGiWO-P2Qtk@Lc}8bjFHyzcP%%h6HG#OA;D>&urI|ntj$nYn}p3TvD*Zc`Bq*t z!jHU8Co+1^-w)a&9eG7GsO@zBwYj>JP_awa{33#){%vaEM(QM(!*4_ z)bkH{3n7oibAN@qvp(5iZ}TP=rJ^;!;GPmV)QK;HdZ^Gb;F9EO6O!YXuKRV1wO3*e z5eik+AaeZ;eh%-mUxnW}exj*zK9S9Ie>n06gb~rwz_3a0D6+OT`P@gN(DDnnAQd+P zv=Q@?Pr#Ont+(Ciu(HE%JB%)~QI?dUTN>vHUaA~X)*|r9Sq=ZJW%#o_6exH z7rYySEz#j^Bh-^>;m_uk7WsemVVcx@bRnf_j>JsU;H>;tzmkD2P}JV|YkPzL300}x z5f1R=m<=eNNkFELdIX?)Q8ytZIlLkm2>GVfi-6FX2N_l3glmfRuD71|&=LWB&3)}K|JG})$!isGLHP{|M=7HH#AU4kwGrk~{Xl0U z^t`GM^iffk*KsjLZe|`uQcSg4r_)A_q*rcEOj z|FEge#)Cje^s+yOhninqd#VJ-f(Wu(PXZ*Q!jtp^Mh=Tb=JDlPq}*zF-IgK$Q2RK) z&osQup@LbHE{MFDbCYkD@Dt%sr8IAU&o0D_%DO{+_4b}cCB#Slz48{1l8&O(;bg=~ zmBFoJ@qOFKq^PAnw1JJ|id_vgFQbfi_Ib7TIkkSbUmjQL6@1^RRAcy6y5b=4g_y~j z@ZV-FbN!dB<^N~UI5P{!{}43J!Oi`D+*C~K+Qn~jCH?j59Ux?d)THl84j%?$?et#n z*zVRL>)_pk_!P2h+KjRrPdJkQv@1gjbpM#`v^8o zr^#>vV1yY2&9)_MEd!s<$R-hQ0&60SXu#D!4+T2N+F__m)qF-67~iods)GH~8mx~i zdRGtUZ`b+oryrSZUDz5X?_cmQ8en%bfjn3cIvkyFfRvpH%vdyT04fLZ$jD% z!6pkj+ON=o0{>gyfg~OPV*+a=1!8>{I;CbA8G7VtIUb6(m&x3c5EaO>7y?#cI7L@{ zykDUwiRoc(56Bp@<};v5EQ-fcRu06R!IWlIJaGcRkx}MgOhn$P(z68=q){Y*GK&7- z*!fyuYg7wPF*c4eXxD^wVt<3>j)O85!weR{Pz((~VSgMANMdSR8#RMill3$NHZs8; zqRk<>84S76kR#-km3eVqlW z)RR$M4_L*rLs3{@pP-1$U{5K6{YG#pht9t6RAi!|1` z7%4i$?HK9?y-|h~;5EWnzetyr4~%mZxWM4$C=RnlL51MHkv3^LGB{(QHjH)z4Fzpw zCJTX^2yaaV#t}i1VH-w3f$2Je{Sp#HuJ6-FQp_1JiKBo3Q^CMNbJ-IL4%!D`g4z}s zGW8J?z$g>^22DmaP1X&2qlF>?2?^DQ3jjh>WfB~a3mpW4*1?SUR_-v|L|ZCx^JH?i z#>wcOV(uGACL07Q6G`?OUkWBvtb>Uop^iv;3C;v%B`+|M+D}YYo7|&XQpE!Wqq5A% zNGUM%urv+`J&6>s=2;^<;AC%zM6POvG@>N=SE$e87(+gK%Cm+I9YA4R&xS=5%!uNx zOY4EcuTl&(W6j*xw@fw_F~B{-1Lx>ywV{Erb(ElK^vFtlL~`?BaZbOs!-F9#vAZed>IGp7GPf1`>Cp|}?Ud_U5AE8K(v>3dybNN> zJp2~dcTIJ(=LW3JjQ||6q8JXqy3l62+;mlwGfl2llp~n7xRU3-Y}(>ZVWbXBiL;kr zORdJ{EM<@7=OmdOej;;J{5t2}Wd&b~noa_X)hJH(dSA{Q$6-IYx%ur}%B*&c9G!G(z;HNr9QjacbQ5u3iUz6CLU9Kv-f;}? zVC_|uTX)qAhXwm}_Du-Ev0rBEE>QPJ{B`A8ES>yGW^u|4^9G#cXcP&YGwVqEpKUr$ zKmWCqPF80Ztno3eNPLiZdB_w3b74?X_S{+VLtGD0e8a7(PO`O->6FU-%j2TNzw8D64hi%0v7k@_5 zd_QU5T%KHhyznsalP}cGW4?l(GTUdX(p|GT&q$nSHsMF$?D72TBe}o{zS%~3c4jIq z0mdQVVkWZAb$aEO(kr%d28BIvb5-r@(fPHfk#?IyJyhPp%4*4g=_^SPA%k5@7nd-A?MlM}@wpYzD{tkxmnWvK^^+wkPt42d(w z{xxo&ctyKI`s>oZ(BsBV$RsN+!|u4<;3i-y3VXZ2GU~h3&-y!XMyCjh({Yp?Rw8q~ z<1@Z+>$B~7r?-nfOHHdw!6W7rT*{L|pInN9^~&I=y(9Zx`p7?O`;U)~8#gYlf$8+w zloY>!gIQ;V0Qr16bDq)*03YANu|)bawN$02g!CyUAXTmVFMy`e?UA0 z7mC{AX;t8}tntJ7Tt$R6)9_&k=OEA3-fsnA_;=fvs6}<-54yd@R$%$r$kZiKuEI8K zHT_?;ErNIiDT2G3J?Rs=l9!KF?JaER9`=qN^TyQOi<+deAHNCCSFPsi`{Wv9#*89S z|G6b93=CMPX~oHwsetR{5t3X#hXrN3>5K>tC$Dam$>H)lf`PRzPdlnX)KUaZ()#;{ zkw(v<=+oQ##z1>==B14wOOPG$7_ct?q3iT!p_k95hk@_iXRrf5+V*b&X-;l@P|&s~ z0mNa(=FLif6p9Yj6#53#6ueu!_AJ5)Lh6a`$5~g_4LTA(;eMp&tG8dZSs#nT-6)Hc zU6$Sj1rP9d8<^LXH#`C`oohGfJKxG-k(m8q7E#k4MoqkFb~-7HCIVPkhiLxZy&0KJ zWwSCoXmQsvjd06^!gCg?YDfvX(^z{5@tqGPG~Z=T&n$mrqqgRyXhi@MS6i;b8-$zb z3d2z-du}@Vgq>XY1j2!EC4CqWqja7jxzD-X3ePyN?_*duDVC_&`3)=XdP=U~e_x9R zF;0&#egaD5{Gz0h095#y%nqM2^UeM|o4C0OYJyc3GW-7g0vdkTRX5c#Hv`!S=G4@} zv7q*kN;e0x=3Lp2Z(BE$6TOs_Yq26ariiy7_)#dQ=5>$5DoUw#oKg0&mvEutAe5?T zvRV_VPcg5Kv!gF>cXuAPN$vqOIVvR9Q7p1cKHeCW}}JS2Ou2 zgNnC%?`rq5a?pRR&$7gw?bSi9+v~P7|Mu@oxPR~Go`Ac%z;(35zt6wDgrEQXvKsKF zZ)M25C_BzlLP<=67k)+3Xr?K78Is`-Y{f_|8T{7K`>x=}8zJWkoB1vWoC3lWQ0s8g zhnz=pe%TQ)iaA+|1qrVp84b#ar0~zi;eP+Z8;{&5ynh|`GOb1C6)R)*!8dff;>T#8 zr>iP!q`$o2;TZAK8L=y++RyIZdD+o;#qek+ihrmCxc+f#uBUiH?SAhjmIv)hb zKWpz&>q=$Hse#!P@3)rw2)`RVpO#I(o5}RFnFZ_}sP{jsc9##GR`Qrt6|x-)W)D0& z=<{a1(D+Q%8phJB$Q~Y7*Zj&~34I<_SLHYv%v@8j!yVq{w2=GLp>^$NGJW{oOC_Zp zib>HQobQ{LeSt5x%ID7=#UgxhRz2Vo03(wT4nSI)sb*Sw27gBywRu9IjZW$+ulXiQ z2rpLZ+$?tHo4tVZej#dnOA_Vmcz!gKyLYU?4ENzUgzz{8BU*6JigE=TR#SV z43AEVt*;!rGhKJvWEQm)=z&^eHMZ*8{Pa&y{zK$30gY`MX~LefnK@aI;Sbzl$$^ zlXv%@6|bO+Up#C1dZKBD6+BDwo>L@Jco^mNFGFnOL6(;v5Xl1=nm0;92t>$sk#uPv zZ&B5q)U7M&G0Ay(XC;q~Q~jZZF-vVA6npx~Z5S6yQ*pbHIsNvLA0k0nGIF4Et%u-2ISY*w5G@x3fULZUqG2+FMhQqE z7X+eC0|G8sqsOD-)+P{OeOBaW^XsTv?JNY$2H94WN5K;}+eVuk(6#;be6OHJ2ygV_ zV`cr7`w$ke6FIf92>PPH0Gciz3(j~BwPJ{hTCg5S-E9me~d~I#lS}J$Jo<<3!nC5)3B9i zmciZcd~?FV{TL(u>3tqE6aYAZb^D9M=A|)kyYdt_xHY#&!eO6fLUg@qw#cZGif&Z@ zSk>==k~2$+jrp$Cc=-6cmy~HB#AM*~4}#t_vlFg)u} z`r0h`yRQ_q)_U6Hh{Mgk0DFy^Eo3za{kqM+XW0cbH_%`WRL!J;)#0!pMCQjXAG&NK z@yq-Pi(Lxy4;f1ooo{=8gByZzcUqR4ZV7h>ij=`CYGa>=;np8|(9`no+iWE96|ojw zUlJP+YN-8sRYW-lb_4UYu=BdNgVkdEEj`gw3^z+j0^GK0`!!S_)KEQsPm)cSW04N} zjnhAcC6n>w*mI3ry@pj>BA-#?&9)8}mk;}Zr^(pe>ld(P6K6iMm4XMOxnt=!t41B! z^ua&HefGGP)!|rpd>FR6_u?Nff(?An9FehK)CQpzOTLp6N#!w;&iB8iKE1XJ zT=C@@Es)RoUAuF9v29X2nN3qd<^*$hu{@@s;XBQ6{W|H==!v}6`xo1G0XE%NQDtd9 z;L^O~OawBb-o6V(-Y_0udP*(7O0`EQtBzZ#5%s>;&=Ack?@%ph5V|$71nORCeI4lr z_wH!^w6TbYj1t)O#TKx3c$mKBbn~TIHnuT0$>TC)@RS z{9ut9k#itHJU(o=U$5jMf(S3(eEP|S)J!?qnqcvQ!Nl(WSW~n{eT_!Zp?$w8wdCX+ z>){?gZ_?~dHGhL1)9=biD^$>XrYHQWB|n7Mi9T;iWaWhG?Q|2_S!@N_QRpONY3%8R zZRI{P$Dii;?JW&H6GSnD+~;V!}&g`n9ZA~=80NfEK+ZG z*`F?K2m%^7$}auY47HJBH^hG&yN)%F6ZL{SS^yR|B(Qw|iFoRTB1lD-yBKOVB?C@N zYRkZFzOWi6OhGeexp(WB@*bNcCekV@GH`gL+{|I!yf=}EVdXMN_#-XOBxG?Ifw{Q0 zY>|+YVGxv@#zXQWn0w6P=Y-B$vdV_b{&&ci9uEl0d2D@NTTy4M~$wfhS zRQ`Zy+e)iJAR3fW%h={RS6)8^5F*~`u@;Z|{_&Ac`4GVyI4~pdk7hu%mCi;$gtRM- z{=BFt=h-d$e#Wr59(+|Fh!lrg_3OWgEne1~U-f*LuIEPts?oqR9KE*AC7!Uck!U}v5qH=iW zVn+CL#{?HC^5FJ)-DsR-`Koy1ZXtlb5C-FrG8(z1_vpsI$!kjDyTTHYOCtwO(~r|d zz5V?9yI1tBobMi4XY#{n-EQKdVRgO*Ifw29P!splYweQ&m z#8`vhNLcg%gxQ2BX={7)kM=u?2xzv&!{UNQ@#&cLCMJZnXoqAJ_WI-q@d{ZMq|=a9 zO4Jv>TF_igJB{0&dFKHHzq${k9#b6k>!7BqmKud;s+5sMvMS5yqcbJ*677 z`4`Fyp(PUy7r`v!e+yXK0ytK91OeK?SoIJNSsYESW+MjE5RRDaVt*7#J(X~-?_W|^ zKmi=+NDu3({1Fz%v`a-ZSsY4r6yosNqa$n#Jj#u$KA?)(K_Dr%QP6^oiwW(4Y=oh( zhUX}fhV%@;WEmMUK+qT`6u`vJxHu2i6^0Qa^AfwjuI-}LhPpHIN$QDD?1J?|nUu%~ z6jYBtw>WXC4ABVpYGxrV5G{Yohcpw2w;W079<2mPUPyXRHUdMzkOF6+3F_rD6%GPH z6?WUhaDFI5D12ZN5<%g8+I0QFmWrcf1SH0cwGEhkdF1{2K;CIl;8$8SnDrKmPGUnx zEiEuaBd8sHYzjk3f-#iFQbhg38mXkSZNFLKrDKOdSTJBE8F~pGP?d#8B^_MZ(9osi zAV9G7B=s-Vgk$-Hlz#*?7z+^#Hk7GqQI~pA2#y#G`4W{f6<~x7kfKHi&qttjjE#&$-T`j#sUdMQ_3dM zj>s7j5xZJ;b*dujmAwagVF3qQo3s)vygs)nM|Vj%@q<~b0z;xJLE&So*GTp_i|Fnd z(FgrxyIkzkCpWe-tV3z|Plxe&L`F}mI{c6eNm>{d4?1i_iB&EHinfm$?+4ypNsP7{ zGfMed5#@7r(RQ|tnWbSJsvt-_Gy%lgr4*m+(2lN&LqNCG9aG;9nFp3(eyJ10TK0cB z26c6+fL|!)n|=g3tW)OrVszw+bsaFvT%uH?2I!D22_{4_b`H34n!g(6i>^Gi>k=SR zJGM@*ICp4J{ObBSaSX&ed(SAaTkfvDZ%6*X=x~2jU&IbT`oEPjKNeg4H4p601{)H; z+Gc;jnEOK(-`2N7?i4y3sfn=GDb=7WI;E#m1!~NIJc(>fGrgN5C_#cTZ%A`$upB2- z=)$KhLuqVsru4pg=qoKX!c=E6I3X$J*HO8bg%Q6(X^b3r#Iukk3$6Pk?rul&6jH%v z<${ARB`v5@Zo)$D*iVw>r9szu&{H1v>S;iW+if0PEl~np>U9WCi5Jm0A%5)fK(LuW^ay^^foOVn%zDz~3lI^Y1j9+=OP+0~M@4dwcW3n_o#DN{; z6%-vm-tgB6OGTvCdp@@)KlXFbga0PnLC&JDz8aacyP{I_tuP}hw%=oUTJ$X_uD!5| zqBx`sF|-f!+tI^*@MWLgew~Eik+P~~3Z5pAs2$(HaoO~W*C7Z_A8h-03*Bo8x_*=|r zbGJ;5qqJJlA8)kPM?sza55^^_D9ke>Ao8xPY66R6TGGr4)i=g)^GX_D2X5N%T5sUs z7wiW5i^Vpj8jYAH5pkWR2r=PLe1L!%8?MhC)PjGAzSOg||4pzDJ3H6^N2MobCf5Jq zqa8aZ6YGCXHObYTjwA21+c~A4S>WtjBfkhoGkgO_F-@%57u#HP<8i;?%D{$n%j5s@ zkS>#_=1(KLOJ^4W=a!>J5eMV?UEh{5jcUMDJzQMB%gDnS6({X{?MO6cY zw?bTECM@HPedoNO-{1At=90_DT%x1L1c|y$gX~qYZ4D8T)6!;$Fe4rO3l+1ZMSp&Q zQZ(F>w(1!rPm#?UQn=c(*|fgOGL~kf#l@xrpz+&k`9x7o2YswCfSm(}Rt~0Ec}-0~ zvOw4gWQI;o&lI>f&z^?Vk_IWgQhB^_t9_uSP$VO;n{HzgMl-3n+tlPixjI3P8xY;JNkSD@74EG)(SGW;f5;h+;=CDtsgIqU=G>9Vpd@)j5(zroN3{oJl+Hto8td7Qo zKaGo#Ui^ltl#E92JcaOTAx4py9@X+vbpDnMQdn`)K%hZY zux84F%PHcv+fbg&>nUb?RA2I}P=K9VQwqCKu-0)@#cI3Leh(IyJ5F(kjRb%wQJVy0 zCcr?fiHm`&iW&^$$&w{#grDalctZP?UBatMW=*Fe4^kzM!$u$5qJqZ6P)U`x{=m>d z*0*ep_j0iXk#(6!Ev-=Ft!zb9C>b0VcK^O`{`>nfxfy@k`)~R6Clt}+^K#YyyCn>e z-}>)f!T)XAzw7JaV)V?3Cd=vTG)-HmCU2sEL-F5T=kB)*pT+Ks6n9Qju!8%Rl~N@H zp@dukg+l03)Ji6q%!bs1gF}ArKYh^1J)w|9KAbKNZT@2^*MoJ^Yp6B$czoc_6+U!H zHvU{^7USCal(4W-R#5I25Aztac#E(ppEwJ99U*BLaI3w;ZfX(tmk86d8G=M(<$O|Q z3Q1|pP-8DIS(qoZc&R|21LmLb=rd@4CMk77o54|!H!Q>`QT`VJMt{$5R{>KASKs!O z{fZ*uW7VNZGx!?w0uK>YIte3%P*2eri<~JHkw?{xGH(%8$%SrWnyJNc6{9@A9^Fke z5bbt19JY%c?(FeXW-E%_4rh*?nQa8&qD%~s?=%1So7$MV?4UbjtB^erzlSfC8AU~ji|z#i2ttf z?=Z*L@)QXZ#j~x^6Rb6Ifa=oGG%}4Ou{jM0ZxLo9(;BsXz`TFOX@TCIlv`UvI)f6e1)cK zo}!8Jtry5*JQbmr9c0NGr$4*EuUo4-H@Y8p9VJh%f*EFSc*+%oPLoNVt*kFSC77x# ziX=4@`<4LpNXsd3iTWwjI}&-iS4bBzQ(Yf^UJW@>lODv1Vr;ZycW}MsQ)wx6eoj*L8AaYx(Kb? zI3y{8!-6z3alQt)_jEE2Pxj2>;mbs|t8OTC%|zmv=P@%qAOSIA7< zQ)2QX^VohBIA7h87l(FZ4gVlcDkJ-wfm1=^og5$(C#z z8wD=4+aVUx0JpwmzPx}qzJl@cAH&LQx%p^@vGAU~Z@^U%saW)1mO}%N%s8Xk?_w6dq}D8cuD6Ww9b|g z#egXSl>ht>p;M(@;b2nalMf*xcjiTQgC!mzLIf#~)})W7j&iJ|*FfbSf{Epgb(noZ z6{ivMqvhOu;?rpxAD!VbCaN#b!mS~ztFY@%(|&PhE-_i&Sik6bpWP8L_VYq z%iS-7tkFE=g}mPW{D6-{l4f`nHdK~B9xBu48`@!Qt9O#+>s;S%+km!{^DHvg zZ8CXt%`h~qskEQf_pHZtvQ`?O($%ck-?N@~8WeV#Pb6LRg}z6gTC#L_*E%3rS>dsd z`klt;B63T{Csp|;0Ip6M=0WMc4aYE>tjw94;uIFqi&^~LV|664_KgM{FDXZZ+DzZm z=tRr*{GFu)i=s!Cdid!ngNQKok!M(|r|Wi3*anBnlk1d9^{7jcTCA1Nf6I(KOcol0*z9bKX8-Ju#5bUT?S#L_zn5O5CWkD{) z)H!+}25`)ldS!H)q}}i;`m~EP6&q@+|JH=vA(vUZ6n=kooTR6Ia&rwn_XcaxhTNH_do5nC)~f+Yr?wx!VS>%nzu_x86rXl+Vv*E3nlvMtrQd!i|;ii z|1O{JpX!ODZaXcEeH>3ta@uVD z`~Em5tTWi<@AdnBdUx>u_n4oe{x4=kvf2Zo@$s#Tw9`PS1j3S>ZEV>FJqk% zh)wan6j$h{c8_%yX??>DuM%7Z{9;H6hW>s0$IH$25-3dVSllj2oGD@Uesvt1D12UcpL%EP|p<0=+@u%Fy^ocq4EKUf&3X z4iIj(EwHU^!c^zc0a~uO`SFTlNuTw|b1#Op?P8ZbwI-%pnXt2|&dm$94nNB|dv~Eb! zOfx95z`8~#e0(biAvrVu8GqyI%D3xnXYy|1{xVkoSlMQldp>cc-e>brUNX@O*0JqZ zuO7%PXI;@&knN*2@C^p4PJlN{Cg_%2Bkfw`n2cL}!(y%xB1O;?UV-^K6lA#;$3S|y z*=_Cnm>zxfJ`l&GI9I@QBQk>FBn6wmwW{Y~tsU2?heK8TYb%dHuAFR+6&bP_+l3~w z4|<-jpVaXfY+x*yTN9i#)fv!K5+nE>%F?kU2r6-X_Axig+Vlh7I;6!E06$%+@Wzx^ z8!GMWsc)Bl{v6o;rzPY63Ju>vicAMM5A4<1L0R%J^^{RON<1da&412)@v~Zz;9mVX zJ{@2EB6+<_-ihi)CAZT-w%An`;(*-ELU-%+qxPI2l1ST@5+|7Y^xPS*p&U8AfI2f+ z((9u~_2P7eWmk##U`^$LZ9&!#+BRDU|8Ob_L=E8cl=uS6;zLLS+u{pDw&0x1#l18? zK1ozJ69NXIuPM)7M?P4xzQ4YtZ7_EqosQDB4Yxq^fA)2mIpCUen71yjwkZiuSaF&` zyeY7COGF=e3LSVJ!yo7XKPBU)5<_(2+pq^y@;Jtx_|MwGUo*|`I4U|siBSzhn*tL# z0^$ssev_4gL)%d130b2`-nMDy2!~O zW=_JOH!41kCI!QGh@4x#+j@xE!SLD&@! zu^+_u_2`(_%o zMmr{?JRbI;z*+&F_@b>8o~so9hT|LnDHy+ig%meB;?F z3((Lkx6d>rU)iZ-F=HS*VL%i&bX(+R>CTedXUPP3sxrkV^l|(@4@Oirwz}kIg$k#S zHPTw>Lr|5+E6)J6W4I_iwN;P%48W7x zvf%LpT1LU@cpJ3j%u_}Pq%VI{E^SAI7-w!a<(m{ZO>(!=NH5#pyBzht60x&692_49 zehih+Zu~2_$dB5_;y~!-PjX^wz@;1ikd_!Rxi>|~bimcPyCBaulXh5&mir=mO(U}g zo=qxlsrirzbUJ*tMzpPeCoX0gG$3B!SH}f(3o(27?fsB8)@mICTTkmgI!UBl_~6pXdA2;qzxaW8LmfPmk~S({-J}9mhJr zuzX(`_Bxn`p=FMLI}hiDJ6j`sxOHL1;q7s<>{g(s`^)3|w(ZtI;QL~9lCZbyuh-{* zDIXG{2VPVB-_a^(1A%Uz&-dd`kE-j_HU$R*KR>ncyR~fy69RHk@7axRKCq20vd^=k z<{iCSG)EnqrBo0Nz34?q!jhDD&sFn_WwTAkIgSDDcsbH)OAUnEt_^wkx8o1DbLol# zS*m{6cQ6WqFRM|4@t&VEXH(&d;6^d%`cT4JolZh?z;+0gz@pc8o3bIsy0zsGsd2yU zU`vh;*PwuL%;zps4;eK;0Ar}I`1y5jNaKOxB9|U$0L;uKE z6t%0K$qp0>MX>OYU3mw2w0md4{lF(O1FIG6joG8m@3(_#G?zqkiNClRuu{2hNigyE?ILO?B}OEc<1zcaQ*@ zITadTvq<)=564Uxa)oO2jE};W*JjOU^DPi8^T%8Wo0OWcv6Kotn>7Nc)?5KjBF#1& z5~0#R%k{whf0lnpld6x9wktcYh!cYwW+4eIRL^UFuNycvX87S(%29dh#dGHZ*)M+l z`_k0}(cVVSK?PcF*I=YsWY-|{OYj;C*UxZ}*Wdi-{5qa5cSBtyjD6tsXytFX_dNn* z@k_IQLN(giSaO`8qcj;dRG34rC+u(kHaGlMyTOgiNwXKVds2NCO}pM)o(6q)&!F22wT;>DYp;B+zqk)s#^CqG^i6H6(_!n_9rDsx<4%RsSd`@Bz;$ z0x;FYqdYInM!WA#zdDwY(9z}AO(26*ULvX(E?n#ydZ3^AWV`(eM|u$a9iHNCadq@P zuP|KMJUo`XH{Sp0EaZ~^-|wnfSegDyV(R}p!G!I9q7txiuyOp?chxQ0TF!^DOztXwpGgT%k5p!3QA)S zRBB79WvbP`;i@a!fQ0B<(E?|rCa;kUOxzPxXcV$&CL58bAcIkRnd2d)YC$VVg3Vhq z1qdqLRlbPs@&?6dON~~?=p!3kvHF!11F=@AOLqcAfBEK_fu*oHhO5g!eH&xHCxyV)x^vdU_MP)o?v`UXo`8AMX8IF1HGrJp@*PZo5eN;JWW9K z&wfp)?UhOqQIb2B=x|R~iB5#>0ac`0l(aa}*3sjt)pj-Q0k&!CzuCUQrd7vq`l*2> z>w>~-Byk&^$vxIls8T3NZTQgh{K$h%HTi}iq+n3afIgx)xICnh!M$*Rl4MElAdaC# zlDb8~OG25^1;J6J{4R*#gG+;$*@GP&h!{~UrPKz1u-29f1XpyVtQuBH{F(z2I0T7H z_lo-=py!ytq0afRylwCHur*oYiRM8Hy&q@*fjUSL13>g3qblIWfov4ULvr=g#b%1E zS>R_}eUZ5R1m5_9(+@0XSh4NU+GKNTK**p;F+xPcg-B@9!sRe8p)R zpNh{*gZgFI@JT!py)1@xWkVQ};2`X*VO%@?4GB_;qRMemBZ^--HLgr)(3-C@2{ope6cNaSehS0?S_N%7D_`WnPK z=a?=s-uM-{Lc{5K3gU;v&uS5KE>gxM@p3_;Y;{6)^UJQfN`Eb}T@NXQ_}l zFaV}0EE`p5EYU(*XlxfCPEqz{2Vs#HBunhr{E-QmKWT#md6cB2ol52@@Ve?iPHLEU z6sf;KVNi%JS_HKKPC&DRA`^q+5T3GP_<0f|l>zl-SzwAHav{iS5QRj@%{B+F`T2A_ z$XmtpK8D($?5hH54At$=TK+h8h#jF*;<$a&LiAB*i;zY|hA4IrP}IR&Geo&9;ld0z zYRw4?WA@idaPxaV#cXLm42n?ZAeHX2rSGz0Q+~UNlK(CP86d;x)^i~@Ov0)WNN)Xs z4m(aHcTmvvca5yvIaI{=skQg>`S!YoA3xyRse-Uo9(!rS|9hPGYO#&&fb~<{ zeuTea7P;aS7;Z%F2jHdmTUKEg<0-rLLm=-cebvd$OcXZoq0 zUKid>+^N{n>;j2aA$*3?yRT(r+4FTXH`>#)S%9Ttr?(E_NO#SyPq5&rea-sYti>if zRAMPD$J1v04*Df91^jYlx|H61y7XoP@kDGw?;j7=TSIZe7a|8oWO-6bO7g>huK4}oZy!LRe=2Dii%Z~kJtXOh- zM*1BQ8^3bvq5SmHd#k(Ohu+9IkkF~+CU8GOGcqYqgoHtwGI!Is+hPwXEpFP!$EwA& zEsXHC5Uof7EuzeP)!#NtPxWd;&(AW>&iJNw@stCOw@Xns^Tw*zzB3J*_saEiCQnAp zC#^7oiCp9d~;3;VO_DHOS09$W8-b>dr=gyD2%(y!MsFU`FIa zfcvLjw+Y7G73T*RVkSL`3;iY&loDb{S4z0;l!#a6rNEs1qG>vfcbC%+takCUZrI+8 zR%g_{z_~AOmZ=&eyvuN?nQJzTzgJwZJ3M)>b~oLE?~9Mxd?hJ1%KWu1zQx`(Lmh47 z#3e64uyU!oEqy0;Mc>^wdhsqS%tNN6ZO)ps;Syi$DC^&{VF(op1KWh;WN~FCUOI}3 zh1#lLaG5sdgMps=a7y-KA5~Z=V4H>3XfY;|M`W{`#14((G4^AM9OB!{wPir1t{lSF zYt?!y2I`kXx)p&z5o0{O{FK@cRdY`i28M9(Nb;p3MgYD7xs4B6$~BQN*=|bfML4C||2$ZkR5R723>ry?|<70cb|%H&B1sgBi;6le13 zU&`9AO1A4D+x!KM9UY$I}-+mkHo-~i~rfS-D@iGj-ZU<6i&s<3Na|;>%WnI zoTwarI=QB*_@w^TM!a@4MV=+R)WgN_HW-2Yq%EkO+?&5dhh07eXj?FE zhnzMPwF2h{tD15vAE|b7*^s?!P){*xatVN}(dXd1^A&}W5|Y#=+$U##Cg#$7zIXC4 zkM^t9i!b}N?I<4F&SQTNqqR}2%Zb#0`(N;o$g!({>*3%1Km$#|1{}-1sjH2${@G|E4WlthjmsSLf=%z zfuC~i7@VQYgMnGhvpa}S31EA9g%$Mdc%C=!puK|Sd=Y)%d+K|AZT{<|oj0(@dvJFd zv%}4G0n+|P)YQ7xcEO-<9fmfDfYqyp><`;vX_nNu&W^umy-{coKI9&p;-=gSU<;HA zxA^03URjGu4l?a!rO8y?81VRt zi2KWaPFCz$$Zf11&uJLx{r&gpqU#y;9Bn6B(C2jUL1-epZCPvTTmwlBi-w^4+AHFW zBe=q@)u~^BI)|TVGGf+dE@335YlF&qx<5Jf4t6#{)OC3ct0G|3aBs6NSecTJT$NR< zyE^gB&tz47gDt#EqgB?s-_r3Tf~8jv+`kUSXSBw^rZb8Jd04HaYfhf*VcL3p&Whk! zy)}d8;-c>QXV+Vz;bcQ;?bIZvyZKn?+!M#qkas$XF`$4uuY|JEzUbVh?)JN!o$x4; z1b? zmK=Z(peWp(wj@y+Z=blTzR$lg9X%I2@Xq|ZuF`t}MX!G?P_3;KYU_xE-@~6>Ff`AD z*HxKj*BK%1?`X~zNgl$IVL9#(Gg2wQ7;Y2^ry**UYREnS1deI-yLVxjY|)gI2D%hG zcvF-newmoim5`sVER(ZtUAdcXgq{U`Ia<7EH|$l+5HnYFNXy(Dn->32zZWewD*)oN zCuX30_dgDX+P_T%3eLO}0)O3$xFa0afJPO^L4G!&%^8D`ZL$di1CbbjuaZNWr2ZFK zU}2hiLzUd_A+S|M5WRNW9;hhf`VDzDiGy7FYTx`G`UX6x3{}B32pXBKCN=DFVZXPN zzANw&bVB@%1MEM*{d@R^{GCbZ`v#~bXK(B6(;N9mzC%UO=$L`qTBOz6iLHI{RDLb6 zfM$2Cf0cpR47e2pd%qU^zU@Qd?SKAWG47b2e9y;WWp8Gid@)e#wHB~Jf7*PlY_ObdUP2oDh~8=ZWx6BlBDz5%ORq)ahWkD7@yp`F ziX`KxG2^Y7?lT>4#q5?(fggv@)Y-A)+TDuQ32OFjw|1O zYF``NML2zX5JBh0czj~|<*VnNBUU@VddYKkkKkox`j_%@Wb;w$F`{9?<4##q@~I0& zYyX$D6|47n#|42OvJ5Xp9zg5^dPAoSLCVoPm_Z7oZY47;a!nvr8SfA2N@cGXApm>vS=WgThJx%5Y^N!A7H=$Cx~Ho~f7vXr1QI>9$-(r|jOt14Rm3gN zzlC8uKzhGIZUxh_ynPWf8k4PSr$$!=XiDdp@j;cnAM2OwEbYi^!}?`qHt}gP&v|w2 zhHSdf`mn&(n&+WqkV*njjIFiulZmsnMPf@OOQE#!LCFgxZ?9%~W=q&*jvLlIu#fA? zT*}+9)?fP%EuY4h5H$(DZ#_pHQC!F>9r(*9l@Mcx z{uLd=3`=N|_{bta7`a%_bc?qngZh1PFO36B`Tch)081z7PP_b5AVH82mi*6ma_+_@ z-RJf8Oj$F1Opl!)4!EpanNy;-_7<~XjG6v6w~BO%T*@csd*ekOp4WZBW5sKG7k7zj z0j8I8m@Ab60DcjX0-!IDtinqb)61WlF+m;{%hzEoCkgCndF{(Jfs`3wcOvv-M zttDD{*JoTMR<$>p6YA# z2KcSUWLfebT2XB5od5IMBr`Y1f44Tt!pzP2f48Div}9As|H9|^px1-q_yyW|F1hFJ z2ouhB1?wh=M_Zo5>sFy zGQPkofPqQAYWdQNw^qCknOjE z#RvQ6^MB=JJxJm5iNx88B;vtu1TDpxyEGEe*RT8G*}?e(ig1@4&lVP6$zx+5>c&i{ z=;gU3=2YgOwums+G}YS&W+n(BDW$Jn1pU#^iw~5b*BFpO6qCSc%ZL2(X_iJfZC64G zn}p;}uywh)6MIFJrAH@dXP5@fPZ4Ep0VDLPpB2&A{_t6Nu44Ca1z;mbMEx{>b%lRx zA2b!OlM>Y`>y`Y95eyn>>bEUlTd?vX;aaeI`z={A=!~t0<(C^+6-cFhqdV_>{hY$V zqon6RTii>z!tQ5SLLR zF^S$@YQKnplwAW$bJV1pp;?e*!sJj^+lR|~au;9PfbvQotj+9_n2Nh>X^B6ZGsGOdXc&Ap%+<_o0-MIYu{h2PVQz6HF2Y-v|z(e2&Pfow$bse}4j<-odbuf)D;;05}d}T|`l9@E{FH2=YkuC~4&lf&IvfjyaA!$bAcE zLqZgs+z{xwRPKnjb{1$_HJ58}cD!?nM-Y|1bIl|5!AP_CyT6@S^~i~SshN(;nmTjq zMJzzBh2TFqTw~D6uaH!7soDdx3S=0d6{pcOa(86jh30pP=@ zw1)+%G%N3rG{SK|RO(5_*pdx2OTu2Kk>&Q`>!gXU37&MC9FRK(Pc;_zkIQU(x-&Q*NBZQgzZIc@32VH_YrKTdlCKA%nn zzl7uj&!{?rSUyT$Vi5Rfn1ERd=mKZcFhKx$i_-4J{kWhNpUJplda9Jo2arkeO@6_| zvZjYufUv^Df%j}K3WU+OAimj`m440Wi{jH9wX9DDCz;^cPQlJW&-CYVRIJY@$R7x~ z)>Ei0!Hv&1ma13UkE`gs`w}9z-t+c(RbU~Z&7Z9 zo>A-IIIkylw&c?!$wAi30$AkF%g57^lzq3_a{us4BH%Y7KJ3RkqyyHk$kz9pR|LXN z|8#WBcWyAh*V)1l{gqKp-zDR+kNSR9z0S&;YmhhG!(2j>cbMKR|F(?ooIIV6_kr2< zGw3fbD1TeTEML?;lit(OZ6iCud4l6sy`I$){+o|^6Dz`YK;x&h{>rY0uQzs?f5Wk4 zVUK~UfVFQdrXL_+_am#LC7^QC75qczwe@-B&Oq>THTUx6`eX8|{%v(G;7H}GH9*Je z)OFoo%iqwK_uA$VJKz}z(cR+nh9@`!IIshL_}uRT-#0z)T7k4Tma?C*guoa7o`GIU zff&MrDB4jMu)(Jr*5B!hv!Lh#b03*Mgu!QF!s&yZD0PrnE-43~k?yYIF~P`aY_a!V zV1Gc)O;Lhll{EYKLk)!U-xUSBcM|5S@0UXTz@(p0OAJOLMhTd2WiraIaYeb)#?lP9MC7JsJ>iBN<;~JHN}mz~&7eS5Lo| zjI#*sG7z7EzJ0Td-!L@>&V>4HySL3*i~V3c#V;y{1^+^gTby?BySkTW{5=$PYwo|C z$Iic}uA?@Eabbb5yHmM+`v><3j+Tfwh-#x&eK$WK_@DgwCg)cH9yYV{t9PMShdR86 z9?Ut$-j05SFD2d#rJ}BgHZP;F9fMkWnD;iRPQONfbtf}ADSD_m1W4UfIb2+)t#-gk z@@_kFHL)-StR1MV!)a;%% z3jtqkDLL>H0BJZC){+oK0-67ezIthfoJ@^-q`*=}5%-gUeTiv4?8 zaKH3xucu?>e6#rxJB?9)*pXfkSJ85thBmFhzBlz@`O0@?fpFxR)3j}AmT>caxDlr& z=Co0?+%AS5WAA9!G56`+=xqDQCZ+In4NxdkiPwtryU}15SR1>$WwW04S2DnpJ@R@5 z)lqTnc**(r3y7EdFGIHLaDRTw=`WW7dzC;Zp`I<6KJT|VKyb^&3H(1QpZ|qn^}4S%@5RiRs!s!Yq!dzOa(whZ>uZl52`%g3madstPh zyi?%y$3d(}HY|*s4|pN&w>V6ZBQi*bEQpeZCK)sVuOnw~%tO*xtfhN~2*@52UNeIv+I*OoCv z1Fl5x;YbcRA_IRV_#nSh$mCP|*|5o7^m@_Qb*L8-d~|X3X?cA2IO$_ zAj|+TiA<&i?aYe_Y->MLk<1_xe2~~A*xx|uo&jBNk3SyKnLOWlH;`$;(b^|e2mDheG(pGcs zHww!t-EuIU>tee=%edpFgJW$;2L%pwf+ejTH!8=32R1Si|1;M#BqH0^jzu#y>qFTU zLUuE=24)vcNvn@Fahiv^UNdW=DL-Jzfz^>PABkyi{K1D4au$K{{UOMcLE&gW?TFr) z18-gT$50%j+AvT%Tv`NzPO>sSQbxUx!SoLu%xRtR&TodQaA_QHiV|=&bqI=YBHoij zgYS=*fG^lt75r{y;-3NEx3#@rAEShOk(>U5f=K^&+Do+??fl2r*HYYn?2ql&O65ig!SLlai01wm6j7_{_XFK>MAK7pJ%z! zhskk1z72BE!GX8$3yYM#WFwt#+y%>i*YAk}b3zLZ(uz@N7M_zA`m$M9L9(h*yDb73 zj$Xi{-0~hf+B)>kMVpC^bxwJp69T?#KSI#z%pUz(lavZ)yF(`3&XY-^)XvU}at-Qp z^HzPFeaa)MpUOLZM?933-{VW?=d#Kru9sjSBWwfFRo-6W>+L%W#CM`M;m{m^N&`3F z;M=o3ALMT}#ebiqSqolM4px`Wh9D;z?ed8fp5O~qEV}tVJL8d%Sw^` z_F6|XN3UQL(zpDItG}!xuJ+BH5Oonh`_&@vAZb`&3t2_*aP{_CYkFMZ9oA{DCjQEW z4{C7xYhsezIA}Haqx$?EBNy>rRZ?HGx&NhQ`vvxraY&8C%15xvx$w^86P^G13a4kx z#4|6u5|+a$DVrh^l^bgX#quYr8_m6c*GuLHnEb7dY4wiLQBL@|(ar?N(^BF~N@Hdj zr0FxNm(PjTEaqcX+zTFG>rKQ*&%5Hg)2($-z)jgluIC%MS#1DBS*iOkiS7sgVJVmA zKk5XnNmki#1_P7{RoyS-#Pu&8#=|Kr(z|Gg5*YIy?=r(+%RMgLJ874_J!NAXGi9K+72`0{C44EEcuY%2_o>tGc08}{aNF44{%Pp8d+&$zLk0@ zmnC_l-ka=ieiP^lTXFyCik{(9Sj*q3kVnPtKi}y0r&+!(O`o9RBD;NM((_o(X=C+; z^_mCu7n+|f!#fJMyvO*b-pU3~!}B@nfj6OZ(i=dDWqV5)b+*hrMFb)ul@6%)z<$%N*nI~4^17;|7TMt z+W%+EzVfDDSFk{?*LP3a>C_$sfTR*qOZrdz-01}vwY~q6XbI3La(6rSB&@C3q)8MQ zF4}Zxv1d~mhUGq?^uflh_NmnP&up$$C+Xv?h(`fNHcS#y?2cs`yo8WO)Jbr&md%VX z+t2S6^7AE{bnCT*Fkz{0bKW{}GR}O>RwXWVjI?Vdd07XeINMOQP2Zx4;B%|gb_d8x1)Sa;8Nsh zq>5X>XVH=@+xfDW!nN+a-V7_%gvuK{c%FT#?;nwz!mhx%J=6&8c0>$_!cYfYX8Xkn z!=q3~R*|sugWi~5o$?@TS)k4maUsPb-3fD)k}7E2z64^`(Uk(hjErvei1(269;dBV z+`jMusIp*v6>Pis-_?uGs6jEd6ZAjHp8+~BFW5xlt&~$5p18n-3db@Ow+gmp5U4%{ zs#(jRgbDP08MVK(1%JlM7v*72%j3oa)z6N8Cx`zfjE)s}0+U1q{^*;>cm(;HUvYX} zVhlt~|LrHu97?7wCnIiayiUzHW&VVUxAoKsK$pQIKKG#>)tL^KCdN(at%% z<;0SDn3Ak<1Lw+5S)P3^Bo@O!oH^WJ^%5`)j&i@SXMGF3z&EK}GAt!c z8k#7U@0?N+iO>|qkU$#lr^_%}uwk6NiTeXCJS39jK=)Rj**<}`7>oRHtw~JHZ3>D6 zkv^yysUgf8lX}tUEiH5{Qog=Wzd5$}gLpV=xKi}k$I?fTfirsZR3ig0iWK!>Rf>Up zVU#3j6TS#(nj5`vLoDWS~R%1w&*F(3Sb4e|FOyV#`6Br#Sr^)48V|nx^+Le_I`( z;q+F3vP@L7CTx?}h9g;| zl&q@sr-fV2a$t<=VDrqFcrTNM1wWG0%oLK%5-rXleiY-q3=H(?b#(Xp^|W^{5cHh8 zkcjB}?baaR^W7l;N90M~p?Giw)YgB#-nUHjlBMSj-&|l^WA8FYP#$LQg?#r=#GwE} z^Q&;s3-hxJ^Y!Y|m*}D}Ps?ie@l4}QNa)<)sL5YlvFeO-oAV`I>~GmCH*~ctqQTVW zaZxGy&u*99s2$>7zr_b@feTZB!`Dj9qisiefJ;x`$70X+SL@x?$5`2d!t2up5V!B|m!rR?lUKeC z{in`%>etVktc@T8egz=p4h&E$>-S=1fJB1-!X`$ZXO&+0((tH-{{ZFe5wzD*0OP+I zI0jIEQ^gMO?Jr>7JGzmMBkTUubujp@5R8qh9Obd-K&lr1nU6vk<`5`&}B~IIDlxIY}w-p7H(F`3!Lpu~qc-(~k$*OQ$0`2qPbD(awaFj*=2Rr*${CDHlkR#xCK%AYrLYn`)Yy)cGl zW~aLq@zFd6>Qky${Pug@O3%irLJQn6N|Af%<0rbgRVaGg=v(4!q z)5Uh%Cu!-N`8=3;UKe;;R+l`_-l?$VL3|3vxa+uJqKz*4aSlRL*nHCIL(LWBQ3`GW zW%w=9?CRXHOZ;+evbywWTejeiZbVPTTe5=>5%6_0R!4f^-G$HAPuF@lbJrNeofOy!9_&cypVH|o5!q%%$HO`~#)gh!YKwZdy4AJ zI;U?8U>Nggw*)x1#$-RXv;uNKXd9Pu;8pB!p5SmkCC|Mu-5ZnLltXl&ceuh62&)|9Pw8jkau#MS!o7g z;y$fbChX+tsweiq|Lgv_^VI7lb*R=b=D=yDJR+*&1vRQ*;634vsQR<^l=jzdc2s7- z4w!@fc>KTovH&9??c5^w5qbH?*{hudO@sP3!W=L=!vCalIQ|z~)c+bdoc|5+gO!=} zzYsr~wI^fAxskUY(A&Yu8b07Q7s|O14qbJg^3 zhuR3k%|Tyq0Knx$lD$2`ov~z^3`k;6;+R)FpvbApO_bw-oE2v1V^q%WZ!o1WaqWXz z;py)>?f9L5)h0_(iMl#8?j6G}EYG1`Bb~IE>wI;DCvI3UNVRe{ZbQeRAitv}haIg1 zhB-whQ!bG`Bymwp0j)(S2qEqloe@+b(61nzU-QSESX^P9I@32Kuh4QrT2=1tCntGQ zTs*ZGl|y2lO7T6LRz?;7NJ?4285%mi1#@Y$BSvC#kqVcbjb*6T*V5Yl9V!O*48?}x zaPooV5!8@Q)+_j}W}8sinB7}hKaXSk1PPA!_&y{Ueh^yI6b`! zENWPCh9z9u2~HBybBZfO87gmf4>c7_cC+x`gbWX#63GReqlQr0g+xUUiaPaP#Sw2% zv4n2~OGJFxxNwr(3ByDiK#9i5l;aZ!N;Rf=;26HYgQv_BeFlwT+p2w z#SaEOB!WhY&Dls2;}lzegdpjLU*eggJ{aclrc083#*T+7UhY`S1@p%w2D~$zGq45Q z8pkrL=ozF%n7|NO-5t6`JgeDQMrs8{)_B5VuPJ$7$^->q$v(;)R>OJaAi~KdA_G2r00OI#hZN4LJp>Bch+dUWDRPoK z^wl^q;lzr;0-LRwz$(;j%uZ1iJw#hkj>7tamBJ_=JyZ_l@F+*-xltTT?YsgrHh0`gf+|=+OC2D;8ey+5NY~ecW|_ zm~$2T$VS+5f8zWp=TVenS(xdxg;IFPpchI|z{2iWlRgocEvw?c5=Tluc>U3dJd1?* zYl4@Ev7!s?zK|T`M_(V~Q*fdX!BeoOq_*UYa2lBx)N|<&em+h1v}uFyJ=b7Af)t59 z5?@umV*Q$pV)Y(-tu!`t_?@W}9|T`NRvY$|UHVm>`8^pYpAq9$Kjjrt(r6v&oXjue zJWV#dMCqn!lT_PT=5(4|uUy%{Bi8stlm~qww)nsBT6{<4iH*S#UUUlmfB8~N_s#_y zSgb?nijmTrDKMc*Sd{bi&*Vs@DlH$Zewq|hiJFItU>M$v)+t2^^Bakq=29kILzE{$ zJm8wM{Ky)GyRa6(jF-uv!b8=u%EBbU5Mn1kks&=o6j84PU-Z8VJqFey27HeS?)Pgs z$K(W##|Z|!-qjj>5`~-a-{$1@|Gw<%*D8BUKWUmxin{c&7<$P#io89E% z%VYoSG62|c3g$coV;!AQ5Kj4T#MOG9L78K1?6$3HX9TyWBF3DGbioa`&O>-$+(ew) z_DFk6bW}YkG@nI7cz4&Idc}BooTc5Q2e>m%C>ZG{@loD-zeqgHdr$2};^PBjKbVql z54C#4GLm{y9n{kiZ^LmacRdYQTa7Vwqh5$d@J=E=^X8NbDo=A4K5{=+eACRkDG{@p zRXv+BJnkYwLV-dton8w{26gVSz)ak^e^FxA!*j*%Fc8n1*JqC~fQ3?qbk>l5-yd#6 zHs-CwXeVwef`LHyPmv@%gq^5CFY5lyqZ%r`->utm2(B$qoNJId6I1>~gz%PsY99C; z^3%dDEfI}>a=1?ft$|d-`tlZj!mQg8UA!g3Eb?y3XK(j!z*iR-<#yv0I8>xIid*Wu zohh8UvcZ?qUs$Dz`gx?*!iyZ%TH#|RX|3CQ4i9_XKk?t0W=9%y$JKW10@KJGR zZW-4~Lwl5H5f)=D;?fG#Xo+k8BDZ;}MuX2#G?()(Wj07zbCe$pBPg>xtH^8|p}@F# zI43ygAjiiSpGV?Y>yt0Zudbk~-lu)hSo1_bFCxz?;=OVhAiTN~X|;4yX{3qV&fIE2 zGe;0t?hZyQ;-!~v!*FO~n5qQ6<$8~^;ipmalvYr9yl{$7XRJ%7;dtX~oGovGxGcl# zrF8M%YAvHd7%)k0&U-nD&;RV{j{TSGL4Oocbo8li+dwk`VDT6)CH2peQie%$PW|-25;yz-lVUGFRA^?X0x zUDpbJf4sguKOT=N5(eTAU?1EEXvMj}D zaE=c2=Kr${p}4NTq1t!K?R%Q0;jW|8bS`XO0l&|70$+p5F1p|~d=yIEwlMEM z_zlL!Fg29fX(zlysB(Qam^$DmS`O(IzYpUC{l1)wck*@v1a!ae!W0EX8+WA(il|A^ zmj1*R%n>uALh3WQozSzqpvrxNPps~Z7sOoS6&4y@&73)yQfW1Jdi^*xmsISRB7HmP!c;j0?Smb;JIzbfn@Jd}T8g*O%Vr>=4Tp2ZYzxC`Vj zs4;#;s&UFurYMsuLy7Z1VCx3sEYk=fkO=u|0Ov}tty_;#D{td0u07Yg!DB2sH1YDq zLylrBe|Gu@E`RjwDU!hZn?S?<_&eCIzyE8fe-`(aK7&SdtICD|QSoM1QXNz_X4=`> zaHT}hK$JDhxZ>s~>V@@V7RjAH7fGuF!q+Jz7C)Qlff9vJ!8`Y_3>JF>PCVBttWVT#?V z>hrDE^lguyRFu-*L6F+(HPao9$?7b<{8q;4`h`7jqu}6x{mgLnH*XOV{Olippkdc@ z=JMvZ($-iu=a3r1L4wJpqQurSyDU)u%})_sBSDd7oO1o&LvJprvxTm>8ea$bz}oJ1 z?qTPq{SFuv5i`MlB>4-PPY0oc-K>o zE9-so&qHzH*QYEOMd0OATi-j4&E@1EYp{}9qp`?wD!t$K31Nm@WiS>Y{FL2xte}3i zppMwsUgMe2*6yq^pRN18A1V~~|E159`M;@9IJmj~QFLKkT%FB~>|i`Mmiad$$=aQ7 zzhL+`AbnI?j*t3hnWZmQ;nCM3rXTZ!5aEFUOhBLe z;aT*bVoE9Q1!yw>Xyo_q1S8^vvnORfR{nVAErB{b0IZRD1c_tjewEN7Z3uf0K$H66 z48xe*dkSOK9yEHg2I1!^sq87@%)(ZR1|in|Ao&L>rIYPItWV)ND5&}Yf6j_zC=Z;1 zcI5Cofe1k&RubmQ$x|Q55QE3-6AqF&v=ErCY`%+9+{M{Xi9xcY?P5j-g&zPbp2gVL zE6jW*p`)3p4F1WYyhTTnF2(~+^*a{UB>AWQ@H$-0D2W^1$dLE~w6)2hcg7<%!^{E7 z7LJAmG&I}cpX7y-$=_)_wbMaq$ar1Jp69lBa0T%TW$X=3PicG*2&H6VmX5?F1IrO< zTsp?VO>-*kO;lr|DiHY8Mot{Mn_O5b+SU-~`rvw(NR$$}2^$n+KP(m*gdqW;@kk;R z@e&k;q))~3(2#f%I8tKZ|9(3}F~1x4oy9%zXUq>hJR{n)Y7d8y7)7;R!WskR=rGpt z)ef-28ikMGx`x*K$aCGfaKTX}g``SE`3}fuPNJjZy|Urg*{4H)avz1iT6Mv_p;$by zIQKqrWvxQv#Wi|mmELh>c|g0G(ni=K2M$@731uIW&xEqY#1rq6p->Ls9>B+^BWTD$ zI*`B-1j6+X_luy((JztE)!<+VV}l^enbZiNNGi*lFp$g)7@cB>YuZ-;yx|R1 z@<#&ULKfsd5**Fzt-!OV$9|IKcPNb^I>BJ0Yk9#HLMEL_|K z&078nK4g(#acHOfj$-w;z?7dOV5+&@xVOcpf*gB+T1@d5;)$Z4I#l%wLS?#vd=b%p77hZrsP z!cWiI39KTy^JrqCIqg4V8B*_-Ece|%I~3p$sHCWfB4U)%^219;l?*H!i`SJ*m5d}H zK+A=i=2`R(&_*cqCCwMdc%5{I(BGJlVIZKV6BS5_;L1%7(Z+%{%oE!zTN5Xu2Lkc1 zH4xpP^fTjchS!N$f5PNI5|Ts5kKu4LOotxwWKl(QfVT_KND8g2SkfPMm&-P#S#c!0 zU#lCF9!Xpmy$#6Xt#%I8Ql)H!HEoS;@Q{7lkhld!x*Ryb0inivLbDd`N*;%!_e`BdO2t@)cE>S z&vqSlyM4Tp!omT#-wx9RiMqbOj`MoI9-k%!zn)qJdq)G(7GDf{zn)tIZl`uXUjMz* z^XdO~?c<(^0Vrb(`1rivl`bpp{kpyv+-;=%6Y%+ZXs{j81CLGi(lSP-Qg;8Y+p~J? zqbg8q3Gi9HJ?K8?RzG=gn!k4=vB<#P(MV)4l$!pPfa`B8`NtWQ5*Xi>R%dF*w&!S@K#17|mC{XnSB6S`ZY& zKNT}sY8?8xSO^qqfr)6}L@4tG zUaD;MHZJhqN62g@dY=Pg-VbTWSW2UYwgQxX)_b=gku*Qd44h|5)^}MjWtjvC9a@8~ zr%{Zz3O4svOT0ibq;UO(9a;}gG+DaDU!5YB2Gwuy3f+NUv-qN0NmXvxarCgj+E5~e zY#u><%SU^W5l(p;i5*ROc{x+p*LU|_YhGq%`}aq`W2mu&5HW2G6ENRop$)@Q(7Dc{|cU9xAba2p=Q1-;zCgbg)-M8cc_me?NdNb!(cb1$a>(ZYex+6_r1J74I1c&z?l@1&(&q)wWXY10W1ShNkS zGFc0Xx7k0vv}%O&iUu(|YN(XF7;rLb$uScXlA|h}KoTR(cOd&w65>e-a!$`$b3%iR z8X5M~a$7$PH^-BAIfdzY)B-t8k@cH~Y8-9BM^Tq~2txh%OC4lwx=5ZW)oYdNu}LB) zOUYb#GTPDl-zk$C*{Cr*_?pf>%n#4yOwOi&3#iAa?WP)DvPJkY4gui!0 z)t$>qloU2sDOC5Y8dpm~%71ctI4dV5-s~9AQeanO`do`PJsh;z`?qkRZsi@IrDYu{2aqmb=Dw7%Th}V3ti9 zcM-X1o9u$%?ne+?rHg{X z2da}AX0R4agVzBA(a&f{4p!iinMlFYi}J6*LCs->vx(QE@Hx)jx|V0Jd5~45S-?n# z(pd}kQ?!>~k%=VP{Qmy*Xf8E}hMZ2U&Cpi25mB^pR@CmCoy%-VkTBYE9GG zSZ8*g8GZbzX8l$;bvKER9WXyCz)VM4$V}OH23@$$8}6YN+qP{xS+Tj|yY{(t?|Hwv?>=|eOwIIEJvCKN_qe-%O*mTx zNP9qr^us0^d@N!>9Rpg&{iy*w2R8RY!=Y7qyn?P4Of{84O_eDxF;ZJf#7Gisls2e; z3C0*RT-7@M8C(Ba(L~vA?vB*DA6m(-C>+9pc3g}A4u?L0JndSg<=k+-GBb>P$J5}o zuR!Od6h|#g#ahXZ6T*R$e`0m}XUr?2alcI&=h!MOzR@59X&O0U9X`t?UELjSPI`|C z1XveFd%j$I7#F%zny{2LJ(4lYCuO=_J=?8OiLz_%GubQ%&^6a062pP4Doa>8e$7<9 z6FGL!jAbFOE3pA&ghj5!0vy$Df}xd2Wuiu*pV6ZkxYiaPHWInJDXUWa4&Nz^tyiCS3S-i3l1i&hh#;4h_s>g=6 z0HZiLrw1DdiXP6!iObEa zS5|U?o`UG7I1S9sUf12;u(Ez_WJ$BApo8@Y-suYvq(>e58}Mujn+|#Zt1hrCqhb(3 z|HmKyY#{a6?%mR=jZvf!0J5#a1-LLu-8c-1t*Fp?_W3#%Uuks^jX9u&Ws!X4AB zR2|BS(jN{}pbP#Ofl1X1(?sq}FU*Vkv|e5r9KeS&DDP39yWR)qDz4=YjLmH5)QOlMQ|w4P zbl)`Co`+HXUC0sCZ3%rXaF#pLj2w_nEO4x0u6BLHvhYRUbemZJ-)GrwMdTHJkg@z5 z99u(iOcr9e2U6`cLbxrL^t|LywozEo;43<&7>_cmw9-AjbTS2xGN_o-Pa>Wb>yExk z2)s({M{1J;PnY-;s*lnl>5K)ASpm#qX)mR36sY!{OeLnk#jV-aa2fw>vzkP+kljpZ zu;u=o&A>3N0NgDl+`J5sE(ihB$L?%?`4`8aqatYpDvM}W!m)KRXa->vQE^728v_st zM|tL3ig%wPetwo}A^j8usr=!@EsfungR=3|*O$ypAtB@3V77G8%X{ zYG|U!TIS5Z=EK-RvN2BUDs)r4-^Kf5EMQK#xoVF!&~T5y3@yUe@*M1-iU@$P)^gnB zYm>4|ZmWQg!g!qxa5&Z{aT!f4SJ14VPh2CiJffO%)XI1C9(iYvyucZ{AC=j3dFEr4Lbm3$PHKZ80 z%NdQg&X+w(Pr*co(%9k_A#4|+>>cByVON@l6ru~V zcp8gs-If+#S(fO9nJ(MK4e2XMD1H2O$zyOg8o@rK`$VYpvqR9hqkF;eq?Fg&+7{Lt4u<;dM!okrU8B9u&V`^~@2_&{=z~EZilL1pv z2N4`LlgpbaPdq!x@8OISf3M=h{M7h`bj{RG^F?QNZfEw2YD$FAEJt>AcKCZHT!iUK z&lP~WLEL}Olav=q`B*6&c={VrLgP4 z!s5wW7IUG8>o~2NZ#+#f+31apk}|~Q85t_miz`2idB|fCku0L>G)1ALLh5pa)!Di& zcQWQ;J!E4Dio7Uj3X`#k@-b0NQJ@#c*K{DVM?AuoJr-K4dCjdO-6#MPQE^5EyVeme zXfzf2U}JDP1P6OH$4QSt^5`=K98#GbfifE--{;LIo;Alu;MRQ}ll=<44bNyUIMMPb zjkIL7oXAD)SehcG4&bnTDrv&kWm~@yiei69rY1E*)$wc7B|=FTy}xV-=kbq;sk(qj zU=oc-wfdMSv>($PVDp!pdSY02ObEG`aO0}rdz{0IM9&uT6^3X(3^3|3ibv z;r})_%N%^p=;;wXyS;Ce44Dv-F1O^8Kyx;G$+rpJ{8Yr$q*OXL%+&p8Bp#Yv&^*$Z zt2RJ!=TS(ma@Ex_xu)1z?pmq>&jKIckO8qF(^yZS)#Czx@~o_HEpEGJrAj!f%?%CQ zHl3E*(gdLwQ$g{Nx#xy~^ijr5b{l&c{-)>6UnHQ~oK1Ik<-n zPZi}-n);4jqi0HZ>recO;O8n|TuhemKmJ;4VlH45)Fk{GKvs{Wd9Ft~G7qv5XIFfG zw_tWhxTtintu4iSBOmfKeU~ecWHdZCmF{grhOX;ejG3n+tvUV z>X5K4Q(7h#d!e~0eDmZ@^;^qS34Rqv=B*`OdLe#&Fes)ZRap?h?2Unro7E{p& zlsX9c6-f9?DOW>xXm!{zxaf^%%L*$zm&q<>OA?5xX!ZVQdW&OOxmv2s`YtDdUTe$r z7}Fkw;^pAfRufCYeTOw`bC-vZ{mp=g7D)&1`7wYCNpty-;pk%i>S-0MX7xsW=CKZV zzK>1jEC4$2Ctcy1z(t+509&(aRXAFmsM(yQlj(Wpp}3;=NK<_GjQ}eokS8avNvL7i~W(VE9pkRyIlb~QF za(??`$UBsGqx;T^%~?Ivl$49o$ueO-wN-8X=8k_q7myz^kb&SgWq~gNt4^kkzAUcg zC4^)2cEqy!I4gVc$9Dz(D)X?)B|WR34}M0~ZpKkClQr;#jDeOlRGreBIQrx8c7JgQ zTMFok6@i_MC$)yfNLCB(nr2oP{z_x3Hmb zLcVfy1~61JS21@WyRb4~12`N6h091Fs*9SKY8f~czk=M*jOY9vK5$LqwFH&>iGFrJ zoDqefb$EO=3`R%6z;>Bjo&2Su_WtQA)l$%}y{;?QsK7ToII*2gi|u*i9A?~h7SO8H z<)df+7NpMFtXLI_;pFKCuW49g>*2XOTlM{${>d}#hwN!HoF|qsj{4MZJ8Ih@u8?wC z944LfrEDv&A|v>6zj|TKtH>V}_uC;-njIym_d;7aUh5npd$}*Fi1iP>xd)r_J$P zhSS$v3A3>+EO>Pl(>I|I-Q7;z9bQxA&0H@_9pR3lGE{O=>q#7xF&vaLGWCE$&`&}d zlhzc8+vg$EiW{EZ+_F6`Ff8+v3YHh z=zV_d-7rupwZsf1*%O*TzGP-L547R>FZ(^nT50E$(AVykP|p)uQ^ZJ3nK&{!alK9r zxlTTrJH5b1X$Wy!th`RdYagg+n#kevC-p_Oz3!_H8NJLZkJffP@81@RStJ|x$Ig8n zL;SVw+vzsm6`MO4PswX4Y@NYSo(7GQqbxF>b~eb@3ok-R%lH$)BUSBqPMMp_u4LUT zCTb_0JJBt_vv+T#Co@U{>I4Fc9XsGJa{`5T7Kvq#yu%wyubvM}{db^#mRbgLrQ-YT8F%A9Iay9U?Id)I4AhjZtOVJoH z^?4ghO<*Q|YkfPtK0nR&=F;v8b9B5det)fkpZtlPY^lqqY~SrUgxvL+F|+pV2lkmE zUlZn~A#>1Z7&{>n<{copC&G-6jSTZr7djF`Ayyj**9NC`fNvRNnIle>3ez?qcd#!X zE6yOsppMX{rEpl!9^33BUNsHV=KJZuk}&qfORTmSraejQupKg%Sx;>HE3#{!?%t(i zEOVXMmOe7;14AP{vdfq7zGagxE6v2!Bp}V5=`5Ab_s>;p?QZWdPMLk#tnc4vm?4@` z*6;g^*Uee18m|DlYN?%Rr1WBuW3>2nfup9hF#vcxlO-`Zn8-|3I4)awRt*w|98p6m zr2`?E0~lF@*w2Pds)k;w1~!rgZ;W-(h^ai{$dWM+Sz{WahMcnR$>_NDZn!Vn z$62%fyH=Xs{0~~i1~i6o8t|a0(vv$^EV-0BB{av+b~8z**e2+N^vAdkEq zC-!a#%T+evRvDqXr-6)Dupdo$FV*rp4l`Pk46DyaB)M73$coYa-xBM&)7XSVxFn&o47;U{ z#cpveq}X{KKb`xmc)9TJcHN}Nc()Z4C59mnK)(-rU&|uo=zKio5Ofm}B_nn};)i~U z5*a% z`fSx;yA{>rGwY{r-m#OEr0uG3zY(YjhJ}*6QNYn&`Aj2sjY*)5rM?Q=yu-{%l7XVl zsJ{}uQ&_wcryeW~BOtLn3?rR!@d5G|%$ zN$5vy&yi3JGj`*#9oq4$G6emiL4&6lszdzNZP7Q^!w$tVqzT=hx)#H0$}kRfUL0hYu)DVczjRs&mz8@ z0kH1^3F*-bg&kK%I}1ef{yX!+arX4xh8KZE#H+UV68CXq)A$XM$@zN!HHjs#O%AW= zG;fZvD(Ti4;>sBEgLAd$hg(=u_s?ob9f_|(t`*4h>&K;E=>vvecKO}y8<1jT^|6{r z?m!s4xYsJfpE$iM)#iWJmMIOm!gs5F9js99E8n?M6^rz2mIbNt*m)rZk34OhU+17B zMs~CU**_@LvG_!K=hep?SDV`KO{fYn+LNn96mP?`fQ+4Ke4b8nK4_2dM-^E7Tn zJf!u+3U|9#h=|7+*CCFbewYu%_Hixl!VP_7vC(95MqAnDW-1;z`~kj59WtzzLb2#s zJU4ve#^EZztz}?4^FSf-)hnKWO~Mvb@`r;>O{7_N38ZoeAE}vt+xnM?h505CJ4|iz z8ded@LdHc?ga;#b+?MI8hcb)w*UT` zu25@ikJ;PEN2P6g5Y-`N8)Z$1Wq&ii+U(6?h8=hgkenZRAL<_TEtne!H+T++oPTMb z(%!FIG&h+4YR>wZ^)c;X-NLy+aD(Om|82tGEXw^gQ`%ph-R=4M+T`Q)g*`@c<@>nm z{eJz}ul4=@8;0bs9n=kEez@M($J3;1@7=(Ls6}>R6U>jT|#Mp zdhh`>D5d{JOsG((KSTkN+jm10~MVl@ApeQOTKbl9B-Lvd1G^7}EO`*{Le!7%3OZ4QNr8Q{arrDhbS zAQJwKfsuPEkEAksY>$yQVnr0x7`{DQe<0W-_V-K9#Bk0qyZCm{93dF)M?D~^Fve3f9f+YyI-JU9Dt zcEQaokK0vUZROVqbWn}ZSb++XSf~m@!aBC45%9S(&>1*|QCJ`dt$@5o(O~~m*t6PJ zfEkJ#nZFrIwj=VzUOHHg#9q47?G*2|yJomztH7Lqe677L`7TMEGKfTRV9|5rcu$Y| z6^7Q~_stblj4XG#0b}e*PuK)$j>swz{xFjp4>aGz{lk#yN&NH-Q|4#e`CPK{CfA$W zO5{Tm;KUv!fdDvC6gXdj-y97I8$3u97%w`2SJi1kJ7&V6{$k#sZD>NF#HMDU0Ra$M zGZ6oyM)2_>ts_pxUF_O2_X-tCH#Co&GY?*fHQY7RCaJyFo0UOmeU<1O6>kokICJTS zQRaPXHJ_0|Xxsb(|>QwDwcr2p&h(v^aoMF=k zCQF9EyBk6CDSI_tPREbzdCka@M$usQL*YYa8n+}*e{&Fn3#7Nc!YJBb$ZA5PZgVmL>D+apNof?~O#skQ>AZf6l$JOQ>d_t|QPLb89|UYD^w;UfJQd ze#}3K6zP%j%n^uT9Y=n7?F3rSJ)6!MiEd`jKbvAzFq&O#rGm7V3)((|G@Hn4iTbu{ zNk7~hLX!8;jv!u!EMi3RR0y49!g1;8ti8?*xG83zP-i!*#p}%sb@GXlX9#d&-F#vG zKY1-gmPO~sfQ@W33m1VuJlEkeS+83Ui4b}qC3poccMXR741YU`BpieXa(mA(kuH}5 zmgIClwr^!zC6-ILRE@v?Q8a$*$jgcnJgKn)I-CUaTM3!6Tvp8b1gv)m}}4kDFUrBZzB{Wb*@FMK+zx)#x^Qfdn0xSqq!sAJzC>W!W%rM>Pd)F&@VWv zz%kya?D7|v!gaX8%tsyvSp4Gl@g#Sot!~B;Cqr_^E1-V+%0~F}N91pid-Y?q?YDq} zTGy}u+YPYYCg>gj>a8YlE&4x;em3iXk>b4z2;h8_I4R(Ev^XiO1gUi2cRQtu$IZrK z$oPOMByZ<$6LAR>S&3>odp1dn!J3|>COC~3at5#jnquAx0uK~W9z-RV9|;n%I_F#d z3zbd`?syqqJF{JZ+tNL2mHk@bgSz^E6h|d$AHGVQgQe*{Wkh_H=699t1h>UBFLYNh z+5tK_<~l?(Yo(mFRhnw&%>Qeqt9!pVE(_cd`StL&*pUwN3^wm^o{OD5!pc$UoXvmz ztpG{8oVLb0L<9hMvPurV30tn+%C+=U7c!4@c1F2y-F)3*hPx#W)E=R#9wDk!#7^d1 z)nB#hdGi2yz;#|s->;`l87v3EY^Hs#BHnp~DK&s%p_`5F6}TH-D*Em{}}w$(~gcV+^Vj;_hNc@o?gJqQZqNKJ70 zeA3PtX~25&RI*?dl{#TB;DuT60S?bvlk2Gzzcnxfci2b5jcwNwKgCNgyGwR7YehrO z%ejbuXp3482``(wBVWu?v($=MbT_%74QV@1y*Tes)_AWsNdW3P5b8Zl-Ah5WOKWW_ z`6zoJZH!iZ=JL)vEeWXrr?slA1|VyNyv4*j@}NUH6N1oTH2zd>h+2ax~eZp6;S z{J)*bMFCb$CJuC>Rt8Qce-UDBjZNsJO>E4Z%n6wpnE!eE(Mi;?45UX3x%otIzr-9S zWwpqMT0x|+(n+V1I@y|f*LvJ!RrO~R!9obrCaOF#*${cp~^nDH$3SytSIsT1-=W0q=8y{*TUcl% z<&H^$YAWVcY!S|!pub5H_&j>2p<@Ue{i6XD^&2`tJ+VzxA&x@gaa^fH96uR>G$Kc= zfS4hRGcQAMdz#cME5M9B5sIM~i9->0AxK@O2$#n(Oa91M>GT)JQ!=@@y{yjLb6!IV z+fQ|MkykV#rUF1$ka-4`C=A8Qpd=-nXo69sIK#TJ_+O>T?_Dj7m)4q7i=Ezx=6(rrib3E zGRicK&5Mx%W?EHXE}>P+*wCu8WiQmPWy0u_6M_Y=3E;GE-QJ$%C#7J6vlmO4@)ZcVvKuky4M+BVXa-Icj4f9u!9Gx zMdWx0RT(YOL3v8SfImW9YaynI1W(*^AznEzAx`)S#UCZ`ax6XGzUXKbq67xF&NxkmlkZhsI%M8EuA{ovtucy~ z>s8&-hcewmGQM-QqR$MhjkDK9x;=}Eq`#dpeI7Mj6CJX*Ww($StKLQRLMm2_mb050 zolne4TZTU_akp9IE-cmYVxD#_m^XY_Ejw+nui!-DiSD)YWhg8)D3ao;z&XnLG%1s8 zgB&1!66%$W3B(^6kvx2Jr!;9SLACIP(-aHp686Sb!D8A!D#Nu~25n#(5fc>%hQTJ0 z#f*m@3Q86N$xy5a<|oMzF$*=3`e87S(G*#2=+i_58w#fEe-H{kkre1OMviDw!uxZI+N;0`r%`rJ4Lcz#45%G)plR3=jl z|C)aNV;q+Ey-r;89`w(-BYuizUR0!&E;!@XUj?P7QK^B_bZJ6vMD#_1~}OjI94*ey$TIV>w6< z7jpB3&e;-`5Iesh2!$3JV^xJG1>4QplHktVVxJ}S^@+muNbe69Tcw6#D?C}Cyddys z!csdYK$2XycG2$;gsoLBo)8eXMRTOL!yrWbHa?Z^3^jk};M=*F+UU|@SW$XI&};e- zeRZqv;@Fv!fCpt2aKMQjntSXjosXf~qiEdtOVc=Yt zT&o<&fOsj-5hjuIZZE+eZ|UD{fJ>u9lR%wA9D2ztA}b&6`@NZ0f%7$Zxs?55d?|Zm z-0~WLV@_a>af)P45C*{sM){FqveRYDdU1wMP?cTt9OJ=vyjVO?dM28w@%sTWGschP zUs?JONV)%>rA!O@x3BYD559of@K0mwA1^Pzm0tqg7;SFaH3IG;QQ2kJ>ccqyM%p7Y* z^))`KM)jVsvfn;w_|R(6$0?h7`Tda!HWx99c?YzusS@DO&xk7>)SUzb}_*qpH^ch~hj$lut(4XC# z_lJlHW6@eDaVl8BIHq(|Xz36tk74@v2Gk(AY>=vQwmDrmNypM7L}V?%IhtY5a0Jz> ztRhAb<6iBsjcr=^wKNK{QbMaTmmrsF5EjuDlR^!=D0E>QGI`NTlxga;k?w64hVc^T zQC5K57ejC<5}I9yBwxnc?&Zk?Z_f0xCL1;L5Oau+p-12g2SMn3rMWM##KT(Tze@EV zXgdGBR2iB7b5E4-xA;3zy5Fgs{+@dz5P}7utPt?lS8AxQ48%rN8DmFSV;skJXI+F4 zQPuNGUyOMaR+gew@lVIG<_kh~0cUoMji^v~2$G3iK;=Ptl}W>6H2If(SMjk>k5BJ? zvIMbWhcc5-LpwXZSI@)Rzn>j;PPpRMc27@+iP0>#m#!GyadEbBD5OC6dj}rJJHc6J z7o7ee)yt93|KjO89@q$KYHU`+Rqz}WS1GoCwdOM*l}&+l(nb`YpcV%I%_}S-Kk56a zvix)q+Sx~YuA`5k@s+ejh3`Cnw_TT(4clAVNUCQKUVP`nVQHmY`~n&2?pXP6+++TS zm;QgxJ!ZE5cr@2ZlCuotM;gBIiQs8TD(LL!`~^nD&1^g;S(fMB@@;hiZODy z1rs}yG@`tjVQy6)Z~ELe94}KFtMqO8920!*;UxbpAZ?FnIEuN1Q5PzxT%9aBt4ybm zIQWg(LSBAVel@Myzr!S;BZLXmd2)zje~Pel#0vh+FnumH=_a4<7gZkWk3`nATv6Fc zT{tLoz>!@d+!iu*?A z%KYwV!Oh#5>Yq;#X$%ODe;pxA|C93$!+!uZRDSb4_CW&m`89U`YnT7HtNh;=69z&i zCPw!Elj4Sfk%@)zp9}MqH?)`bvil9k%Z>(frs>}t?lFVijsn4gc1PFLMj9Ga~k4oECxr2D2`cTpJ(A#aN%fm6=mbNnHhl7 zS`1(5~2>bP#%sV^*Z z$2RdAjb^$Rm3#7p&KF3^&$PX2bm#%F9$+~a8Nc|aqsFEj`?*|P1i960`kIdp%_+Br#>E@Z&%5d$ z3>gf%(T;3B8|+O&k|SI;c^?b)?S>RM;qx{;+_v(0of`=51e;cn6v&ft%Q)?wGyx%u zc|6J55;`}*HJcVvNEQ%^*P(HrxW? zWY2r!`1FQekU1pkL-O^%u8s$`{oUFIuvk%u9xj3$A8HqKXM1^jGY;=tURQ(7PED5J z>s9x`cX)-L_ppgb3}bIaJhDDA+rVi;$9@MhtWjW&&WH}EV|`HY90W(F z?u)vm$F7RH>(()K|q3JV$p(gj(h^{O_lVbx+eavO8Sq#m=e$` zCBtdl&H_&D5@w87(i4Y=*^L2I>l`>g5&=Z*cR^V#6hH~6N&vv0A$I{JelolbEV%lO z2UfN#xCx--nFrZ(;micGK_f1u6CUL~P|5lx^>`QZ(KR=K9Ah~V*wHVJ&n-L62yNG% zB+bNau8zgG>w0-jxKhy?0#Jv&$FwYbd{GsUwKG!)mQuz0stEWPNrhsb@iXid-9h?X z9Q?%m=tWeA4Q6iE80_@sbj+o(ypg*;H_Bufel38MgIGpXRPne+2=0KRzIR8QK=1`Q z?fN)Eh`odunNoRqxN?SSkzxkeFL#)GitO@2Txw^-Th2(m2Vo>OeXp zREr)pHs*pk87$H+6IJoyIP&XezKa}(+guAB_ej`@_kdUCk&Np3;QV}eqr*Y}@c5;) z1eoF@CqpMVYv2-$=;VneqLdj4)hzM=3sVyOWLfa*0w>v`;Bg&52WV6g{O{zmthA}N zW&!GO>4_*oPKF#qibI_&Eu~AZm}t^Yu1O({QHIeJ&IFNSL8?AMl!DmF?b2juQ{@^f z6nzMZNnrZ)eUuUvvW_L9Dz&p5S^+u~btLP*DAQ4}PW=`{hHRqH6#2>=S?p}AR8ZSz z<>56GO*|0F8nP#3@0h?qb@CfCIik15C(jOkaoJQNAqXz|M@=Lgw7K}HiwI@ajM*4k zz4lhB8RwG8Mb%u%sL22`tIv@7r$P%8!XOXwTGwGy30;T9H7i|RMj3L>#TXdY-+P+b zjqR7Qc)klupju)3`}GJ}3i)iemrd-lpuQ74`I>*-eZrDiN`EJyR(g|tU$mxPOV)}Hci7fRi*m7EBs$0HkZWmVLL@rg>JYhEAtv6* zW?1ESkUWNpLV8x@Z&(3dEH88+UKce&g3eTaUKhl_bnM?cR*=_)F4*f*7vgoT8~486 zQ$^b55J3xXu2QOc1Mess@V3n5mbcq#2?}(ZTM1NGB&#z9DbSMvmOU&=}mNZgQuYfjviXq zYSj$0i}K9z4JdDZzvS0Z<8<>HX|~~tF6-p8W4$1l(H-DN6?){mpx>14G_cU});DL1 zmdVXwL`Ld=keus@S(MIQ1O{osbaI+7%uxmaX@%38;$|CJRcr1YlJUP=7W39S&}3>9 z&x)TU%^F*63XX5}Y0O0?_7Pm9nW9GLV|kcZANc_o97DKYC(hDML)k{n8!kkvqhZT${^8`ReQSI?f7Rz5#zgMXbNYfcs*`@4KBC{CmLGB780QKZo zGBNOwbtMzlIPObg_)64A4~-nJ|NJVrIehG^5Bc5FidjAyQrBg2G!$EuRnD>t~P%UOOyQ=-9QVf z5cxup1bEem0NIp}nVaC{Xi^DAlwinYRKa-UgS2v9#YgLha8)iur~UR;E7wDGSo$r^ z27Db`thUeE*R%%jJjtW(#FAp$5IGqM&lO^ z7Ydw-i2%yVgbQI6uES3)4T23S%#jqKlV`E*?6=f$frW1}ry4SvZw(hK#757JU~OjP z0*Yy7#Hb$-J?YP^+a;t@53|gcdL%I&nW_y@o ztwzjB1*^x&Bn#?SHWS%sW1>lc%N?U$NnYbIlB1J0q@zi|O^~_|%VZ`yxP9Xe-PT7E z-av$n1VJth=P$1dh63591uhT@TC3uO#uEvZy{Qi45{$9q##Vuoxho+XreYN-AEc)~ zn)d#vH&0hqB}<+>iLlw}$wt^BiNWXnZTL5k~S6F^AC=A_H@STjviK5Sv<}*5pBN^jP>!5yQO1Hgdsjlgg{Df-Z`z znoK3hL1k6Q^R4tDVfdXDSXE7|Pyv}`DNR~Km;J}W{8@h8|YlnR> zFHTx<`c%MltxUMFyLmI-3{jOZ{IZB)ruSiYmYclL)6%jLc=rbC=n7-DllD3nnimHg zwHk7VJ0uq|ULkCRundiECL6SwsM~7tyQL(wA6urK#g$Y~yM>y4m@Or;x3=ITpqY#$#m( z;Yf0&xw3O~;>>d*IgFc)RTVh|rt(-1qaw(Wls^OI$@H(2Dzb3DT)#RW(=C{j!vm0! zqhP?ZEm2^S+qR2Vj6aw;KV4}O*?SK!P|LgkMwPid4X}f53{Y( z)1iyzbl*7i*^dj+T44s-MHr>g;_`PkxL)5b#x-tD6_yQLv>B)F@7w+NReZW_PWChy zM*^e6c>+UjrgGUK`kpWi#%XS9OLV-dfzQoKaWb=-u(GDbeFJWhT-=9k0XPc8Y6?nGNV zk1181Iu+zI3DWdx>f2&3N=b0~)TLM~>TphgNBa6BRwFp5PwwcjjGAyH994#Fqjul| zlI!WyBmX&QX3JKq$rY`8->UWwU(b_=+EBx{Uc_#_K40w3?a`7!;@NF@yKP7XqXTSa zn`}DxueO2(W-@Byl?yNhZZh5S$u_PSB6Mv~v+rYn$S+a$hsNA)2B9m*)W#0d+JF*q zFK9%y+_*b%d>7$m#JNlv9u^-j>z-(@NL?}))78+9BLX`CBlVGQ0nKYPz3xd_}vk+9zw?gU zb7!;jX3F_AZ;Ac@S!o6R8P!1vh>BzuQW0}P2sNHQ5#A3sn|C;lo+M}K;f?GODWX)^ zcRb&R5920&5Z-4^?v}0t%_mk&ss-m7$sRq7W@BaLFhDydmWk-kBP_sxv3cn;>XeDW z{WWT{@wDa%$C0p9=lt+wFEKGM6rcv9Y0}>8_oJ8LLCAgb$Ln40$C16uw}C1?Z*O-I zDe}Z3ES1HCRM(#HBH9U<&%~CHF%hQHHqY%XIj%!ZQR6l&VG`AuHRjv8yl>I|N{X-F zt`m?I_wqd=_3?wdBh|4CZGpB)0dAvUCIROuCC)0Y3;sGt3=o+(?esETHX(P9@N(Sb z3G_C%%gNi5YfQOsVql;I+T@s!=Zm+U`DuT*Cjqwm$<)zNe_&!Flcsj%KJS6y4ipu= zYnG_jxG1QMhnj9p@~b3iky>>|xOD^<&Y7N$YgMUPiRWMkYIqCnzO>VY{I~Iw-eUar zodd0H?k&_2OCr>nbd>@OSa_1W0Lq(l8W56N2mC=Ks{GJ2^#F7ja)4bTy?L`d3gvwV z4YH-Mj=Dw?6x|Q(M5Ay?IDDF=i!)Oh$R$4S+=ln0ij2X{ZXuKFy6N22j_);_l9=t$ zW8L-jo7YQ#%3tUqGI{N?)aPS$39>JvVPaNx0d9pv(3bs16h;JzG&0WY5}Ixb^Tyo^ zmm`qP<6Fb*M;cA?b>eB}650e%zEj?X=8}E?*xZe|-G!YU5CXVZ_?pe*?Dusd7}7x}S z(9n;5wPfU+kJP_KoVwWNQK+k*Qq1hGZMQY2-(3anWX)yz2cZO0uPj_~XU3b8?O=xi z&#PuDOA3uuv+H*8`+5k}<#NA{n9zFC8510|!yK20Yq*L_ku?TvRFRP^a6>wq2i!xo zBT=61aou?26_=M^dADj^`vzTSbe_EJ>|C7Hw}%q66WskF-(x^{Qyn4ErsaCVC`eCM z_qJe0#Rw+6E2r~mn@!23TEDl(!S}*f`YayFj{Xz6VqTAr&o7MCWYTgBc4<+CN*{uK z#3&gTet8QJu(^YZ91)B&0OSaC9gc)j!iiftW|drTa>>--N|-IHZM$B=UbO>FkGPD8 zeL5K(Ub9!HdzRb8!VtYB)!_WXgPQe*^hzgkg!6h`+t_QsI-Rf#jQw-(<-Wx(%W%Ei z1~8NgN^!x4JC4ltu}WUIOrEk)`n>TycZ_vb?_wRlWN2L^+VF`i?I|nUah%**bWFW| z9EF8F{Nl=gATaV`8=3tnDL8U_AgMX~v%QDA<|*W7U}x^@gqWt4Po*)erWV21gym!X zUo`%Bao0cn?bWsA9(4V=xevIIuc)&n3}Bv{Y4-eXac$oHu<_?d9LfSX=1?}`Lf0si zv!7ACEH9KQijNQEN{-#+?$i{yzS%yBU$_$rV|W*f*ZcKBgAvQMb$tb5EtdxABEI?> z*ZP{l^QrTYh>j=?5G90_)K-WIRjJ~X3tbae5_KH4*sLVD&ak!7vi0UD zadf7UNsXeExD8T{d)KaB-5cI#rj4d!LFsqR#CN)xkq?BP8${3E?4?qdRc=DBajt{K zIF;J@i_}fYL+#}nH*_tUu-1ZV z#%Zexo$x`c-!4SoFP+A%S(c5Ob?O}Di)l~hHHj2bf5YKqDa`d+^DK3A_f)Ny^1+Hd zzd*gtbDITA0jgTI92Y~3Dg$3Xb3I5jF4Sb(yy}!4tZms|j7)2L{ktD;4~>bDi#RV8 z!SIMdodUCGnT==uYIqjXw{|<8LntNE-eZbuyUO#)y0Ujrqs0y#J@secnJiZ>FC0RqX&7EP zeSu>Q5I)k8bqQaMi47VEeKa(XF4U~$<20V+5KjLzOg!g}<{NZ>rQyFJ);VFfZ{?tC zDurvq#mU{{&Dezx8Z<$?ZfrJ9!LPf_+UwZbj@vbq?da;?X@CTmqwzTNW0j!Z)ngnDbV| zU3viDxNQ!U`Ax0MEAk7=^DC=6kPj^@Eh%D=CcSjK7xwWMn${|x*ggYWY2cS3QHyTt zBbw7Ck%eAgm1ZIy_6ji$L4g1xo zI^^##1@jaiWsOqqI_TCy#VOtid|O*uh7(Wh51NU0 z@G6hN_YI046B8#hDSx_L6sBIlVfSM3tU&Hq2$SoG22iPUm!JtyS#ph~hND5#y{F1A zX=(jZtbS&OY%C9WF=}zsa2tU;+Rekq#59KNy>-BMo53FG19*w;C)Da~ zH@700m(kHg-*(s1Ns_%>HZ{HlPXqfW?wM zD)TgwWMQ~hW>^avFB0?*ihZc&rL&g$Nv(EWka<8o&(_ApOUUz4Kbre-y6>`|-ahF2 zcH&s;RiAm~&vpDAcx>>Yz2G`8Ssy(&;)3iFK!MbP+F{Q>CA>Ji3^khW1;pd1ejI6? z?;;#G?WJ++-qZV3HAsr}=$=yd+ToM`C;H~-M4>~^Z0wYux-Sbpz8X4GV#r2%1|u)b z$NAcQ=_ruAauhNOB6}>cn14V{9o%wSdeF*3-z3}s ze%%vN&`m+kS}2rhNsX%u-xOiBj&J$Vp`fgxps9`3=qjUK<0|D&?DmEj2Zby?BIwmH z#FJdlQA5<-E1aO=go?-MC*M+`x1sI~6U4r0!jBt&(Gbv`D z;7wnN%H?d;!&;-oxj`kPo}`Vxg2)|NJl(Fgg4DfVF?)H?H+|38x-+sA(h&Xx(MFtG5^JpV!(_*#DV)SnWu6eRLX1ahb;4;^P7J8+g0AUW zMj|RKnSt?RkBC|#sa&hoxtD(x`-jaHbn`DlX70whDcg(@2#tL%@amv%ZZ47AE+wp) z+s6!K%rX}5;Xr&a+`M&hKo;;8Wn(1nbICs_8I^=|990NlAH}u=l;+M`AUAa$?^8N7 zv#*mVQkJK?CyuLeIHtt_Hd#pr6$tBM%9m; zx_x+ibi(PWO5R$|0e7%Pv~P3pGhDb6|1}a8K#t;sCl|ZU0d%hJFqR!HZ7LW1aH$%( zK2(^Q>d~yU9|B?gOUB*@Av@Y3$qMiM+;z+Aqb&e;IO#^)WT*4>74*&VB*v$in_6N~ zG_r%-Dsaa~n$9TWMpY)XNHPyWSPxjD{@KqjuD(j?NFvc=C2qUGy;)O&vxL>e)hy3= zc6o-l?qrTGb_{_g{u34~PLKohE{n(DN8}szd&~S=`wi>=#o1fHR2DpaqBsl;Fu2R$ z&R`dZ!5s#7cXzkJ-MP5CySux)4DNbym&ZT(HgEU6FPqKgoT_xSRJu~hNltbDsuG_O zj@vjrT{&QM=+ASoI~ceVIDCLCVIt{!2-$AL`VMI;*T085W9G)UkdcM+A$LI2t2m?6 zdXuYUHoX>VcP609?^)sGpb86%KB_(zjKM*S3Zp5&@!9tE7)#)uDz{K5!|uYiHiuA6 zrst=a0Y!`i^C3>e^v2_im<63qMB?69n8J>3@CJs>8w<~8HR&Zb@pPz#-1wWt3(OF5 z4KE*s@gZ?$sW`VpGBf3g4ssJ#+eCXV^rx+bMjlVPT_4)meYzu}zHpi;k(%Wcq+E1H zlPA$50NGojdW&%`9)kb9-4^395ZE}@d^l0g4h%?!!+ybcYaMg%zh>vQwW~8^WV(#* zxFh3zn`;g+Tb%7}{d7+3#?oTskzoiw(_>_e@S!{NA5B4s|3=WqS&z$2=*&f@Q?A;W zMYx29rOwy|$ESoIg_+A!z7bR`g@7Q1g>_FbC^!*y>zZN9blHcu`Z}dc^Dt$Lk~Uf# z29bmBI&QQWiquK3F&ADbF?26)hzs@%I;_kDv=)gr4K4xE zWRlBAM0VV(q-4sPi{z|Z%1`co%d4x$;YaZ)D`{wuB`3j`kA=gJkHM=qdQj3~kt^RK zJ;NjXarYkW z2*?!4>55%u*T?HWecqIQB0P<7_hy-#-1ps2zgnGWFW*yjcU`nk(lMD8B7l63y5cbd zI%<@cgeJo&P z8WnKqd;e|5Rxy((B@m)xL!netaoGEfgr9KSl&|gT)nlcAyw|80!ECjAhbCOjKkCoE zwWnJtL?V4RKzxGenFA+5De0*)&|ej!o)fP$L=*eL(T@_+uV0I)9QcIS4|G|ewXQu0 z$mUvK$HS2si;Dg`2)e=WmE3TEt?;oP=XK?7+VGI`GR$1H`(2Dot;4_N4_ZEHpy$xF z)Wzb1&m0;dcLqmLD-o`Q6Aq0qU}F0bM4|{XT?ZUH2dO9)DQkk~=Y*T+BcrRZ#rDhk z4P0=UwV8m8vC0afh#GdHz?b)##C9UI($5=yt4mFjUbMjK<1Pu0h*J}BSM!@oIi(xQ zE5{e2)4j&X`bLK@Q{wTW27tceN|$Ux;vGB0XMZ<6*6(4Sy;ajV*zPUPm{&O>Y{%hx~Atra-g~*v0E=G;$mW zkVRc9lg(PynPJL}Q{n1*W7kn2vN5X1erjiKd%60o4w=N>)OgA1-QlBs{joQEl6xj2 zu#Csgj|4w*fAW|UKwK)fAgEw5)S@$%paoE;RN?xC9IvO&QO2NG4((i=m&toOkZrxY zcX@SH+Sq73DDw=dj5f-~&e{M{JFvX(0KGI)J`R;x=6`&=ytJLIsS^BKraP5oCVJ>0 z+=6B_E?}%(5+f&gjsE&x8EqzqeL>%a=(Tbtk$ z$>TC}mrtla_btio+u+jZ^&0yo;Pc({keJU_Iwh8IJ6knWJ6$>g;dk&RSey=+A zI7g2_^_SdaGEGWn!JmL#Cro>JN1C02fg|H=)72Hfst1W-R5ZIqZXuh&Sm)$V{C`9z zbjLK6*5=XB{m_~2PLKR)LUBcB>D&(*r~T`1J8f%eT$(zZ7aZ<9&0bQf(@MPa&N%ze zlzhHYqb~zojKBe}3Um>xLOn{Qcj4hWCW6(3u;6gI8FMh6RYXJD2V16VT^`|eA@3_e)JK|*H}iGMtSi*(2pmllg#6D>%IO& zGreitIdtTcxR4MmtlhZ&m!530t3xl&ZgxGQPC-)gZ2S}$yCLe&+H$;au*2ba9f_Ju zq$irkBdXA!R+_{H+(~<>tkis13MxaLT8%HC3B(-OX^p^jEX_f5>uaVtEjPal6O*#E{N>*(i}JAsE0pS)-rD#66Z z6++*p<9?lZpFb`$Z`iXng@288J>MRxB-OU#f%;g5G5H{j*?egg&%e8=3Q~5!HPCD{ zcaqXl(#yWMv{bFiT(`c`Ze|mkPFB>CUbr$tbkBl%TM-4Zx5D~F(7ADU- zy%G04i`ac2-Of*%u{fy6(5R+B>aU#+RIizRZC$8}uf8L~D}#`^Rpi2=?fYC#IjNRB zZt3Y6Hm6@k^sVTpa_H$pt*uFE)`r9sU2d|OYFjP|3nM>+SK3o8%UZ%Ob$v(#&B^UK z@D?YOB-MxeKqpNTzgBgbF*RIQ1a1LpwVpq`-qX7-!l` zlNm(-vzBUP>-`>b4IRW<*cEoxe<(EdlKRwIbx%VV7Mbqfh1A7_jDw2BAKG8WP9zeD$G2SXkK#T6Gx1$4 z%|JDHF4UmE18o)&Ib;LsAj>D4KGx|S6~Bl(+<|?A?ZPFueGCfpU`UhBPrxTyZTw0g zg#l*8Ek7o_cv!5|Sdhz{fG*5G*}NQOL3Wgo?Vp2!w5QrDw>9>XU|8`;Od?!?fJFG{ znD?o-*OS+o2g(7NtuUX-0-0a+^-0gu#Ow9nI0poEjXa;9@4sUiN5FqBzoqbvg0_)A z;@?1hw6_~u79YQgM;f<4OKQqwV`)K4T#{1Fa27`7`yEfkiUn2-MHnh-H0 z&Mk@2t~>kStnknjvn)q*yi&d3Oz^1^xDgX8mykUt>%sC)<}E>m0u!{+7ZUXOvx8zO z>~(NDd@F&g&{eAXIJ8RCHQ;i-4RrSY;{3vh1A~Z+O*)h?WV`RRnrKSH3QT`UBV^Z{ zNS{2S8&EK9UB3x$9Pp^WN3LXCqiaH0uWTx|N_LcTDE6s5yYk&}zF~LRcn9brzfI}H zbXYI%b>G}CHb1`%t$TIeBvpZQ+c%@fKfv1Ym6xk5mmAO4?zz1QTnY&I$MD8qg^DLR z_ueXKx14Wn&tF2%+?RDt7#`c2y=2}cm)kdDetgh}TrxQj)y7iC3qctzxyE|Rf3l?q z)qL{c{she()qXxi7(vmzdT0evZwn$~igTLJ>!DmRASR8#QI*$3-^F$>>hZ2hNwKZ` zrn~b&1fcT2hr%3zbrtkdIN-ep!=y_j|H|vdtdny46HvL&wR41PMe4n4f;dG!xJ!y_ zMQOd8%(@~lHpq!MMT$b*AA@$41Jf>E%bMS7V-Uw|=pL%;p%l>hH+yN@OM&4%2$$&0uY z#}ptRa4!sqw5;*tF&mj-LQR;>@8u-hqOz<>UBF3aTcH^n>ipW;{oy>#_xANk-5EXj zr)f4dVu4#)T)KFkTRAp0l77qxm^1NA<8qj@QJ?Ww)|KBDbU0q5<_$@fc1Wf57H|ER zu4_OX~e@X z%Bo*-)_KHoVH8pA7tCsY!xN;lsgXTL<9vBWWfsqZo@VVs{50rW=ow7Oru2|de!Sr^YgQ$`H7*&sx0N=Rwf2_PsK z`dXQyc=^hT?Kt*6jC)Q3yWv~dYZHHTGOvfsxw~4{t21}}?D)0UXB~+EZ=-tll3t(P z8^T$=<0a2z7+8skSL}eOf3}^B=D*&SUdv$mZ99|Muzk{PXZ4<}eR99#TV#u0Z-7q} z#Ne$L=BF!7-Sn?cZ!uPEpR@5RuTa+;83YzCr;z&3*=7JA`ci(t+0^^&eU8 zKg+N3z7|1lEq^JUDe1jh&#CxgdQo4U0pGq9!!-YAQpygZ58j(Uj8JoLWYu;vG~gO? z*Ks#Hlo1uj*L09ELN0tdhiA}YWFWmsw%h#7Cvom-{%KuqYyeqX0}&Wty@HcK>u&gVxX7B<1P-1D(7%}45!dga9<+o`v@g>R3i522D;xBAE^ znRobjp2MT^HFSfQkNjj%(Dk3M`xoedAJ1smaw~pyum`MT-$;B-Sh<%VcZtG@dc=v) zvh`R6PTs=vnZ0$}EXGxHd#mj(YMZ1l=J8)hLKx|0Lo6WekkYUOj&9xB;L>?|OQ!_+ zvsKAsapg7sz|`Y!A(wkW=WBuK4CxrtMt=@gNXrF0h(sA&knr+@XWZiZxf3d-IX=_%KyuNsA|hF9H{U z_W^Yf!<-+7E9+g@g(K(Y^6gNFc3PEhd^#V~tJlUB@yx<8OkZo4@9k{LZ!6yImR2l% zt7LJs_^KJnj-c1;C&3CWK1qTR<(}U;1xpK30;WRL8Ao?nPUm-7j8*Vsu(dJq@4V3o zyggfpW>A%4^3kz)*RJqvygfXjDyiT7`@jMI8FHfXp5N8DM`Tx~vB;R_7^rm@G@yh@e?}vz5|dN_h5 zrh8$fTeY!r4d3-RL$`Z9#c}^%k9s{Dx`_!D6_Le?~p&F31pW6SAII1eR_?RA)foh z`e&OS4ZrY3J&TKo77eU)@DKkH9dwlIw7`DYr<`Tj>kJxijFP_{(9;Qtg(SHR%Ws;( z*0|V9r>=vDS$)1gnorUqIU*t3X`6T%>UWh8+W#HzvudB=Lp&DUd?d~enlEXWNFSfj zRL)w!;l9PJ(7304o-k7h;pUu{$}UdkWgH!Ct%|X`DDhzd#{=#EyV%Ds?P8te+zfki zyu+#t;u%xz`-mLlHwYBqAqdh!(;AP|X)Y=yKO>BZkRCQRq9<~vjB!ERb`_n!62u=@ zd;S$O7FmyDvypGhHXSU6*l(B|-59VQb@C)yRVpFtDp)vrgL>!fxXJ9(JaaaudFq_< z8oahw-XVtS;}odr>APf$+$-mDqii5}TLEmW=b#~2G#O6Be5{HeB&Dc%;+uT8Lw@?5RnShtsFrx zk?LWd8K%3y93=z~HtcTgJ-4urf*%$*{5WA_WRzDp*@zugsZlXWDy2mK*m5eh=LNNc zxg%qtOfnm?CV%NM(>vLp;BrtTUsZ}&QBwiMA81?tuxXB;Fhw=#4M1rqG1NJf&Uy}Z zWv+IqCK&sT6_zWUKwN4T_L1`3t&d)`0?I4dm&tE|T$geiPnwK~5}jtY<7QW5DGZ!{ zm*H*8c5vnCRVbdT7kQyYi&vt8}g z;`)i51r~F<(Ii^)_2GHFk)Zc~er-*}e#5EzhVk$-1Efw~70k;%K-$RDs6wWFZvqad zJxz!kh-4v&x46sZd+mj!LlS!?-q~G)*er?SoD`KOKJVInlP{ewm2))rc(3?h} z^Iur}l>As;44<5jj_%W|SuB(es5xe$`N&aZ_Jf1C*+#mLPLoM9?d*|-Xs$7}N2OJ( z3J+eR;tTL|K==t!^+m;@bvPiZD`+LfT(3LuEb;?MUzER)NQi5#sCrH$5MT3|oXgi# zqs>)?SR2bp(PM7$-WU8{FFEzUg(dtSLGJ#4NQb~Lq{C@s#lU~7@_&My{STxAGb_ul z{~gi+zybJQuu2zN2u}E_?jN9u^D4sf;nT)=7xEa^_=@2wI;kbnB%^8<)p+aGc)C@6 zc4V>g5M$VJl)60*MpSX}fOtDpT&keh;6C&D_?`;sP&5d82&lRK{6uuBVqVIN6A8t! zFG`*hEAV-o(l%dC!iOES;7aiPuTx=Yq9<+tWbn>*0&TG?=KhNFPi$iZng;Qe)Qp04HyPo>9 ze*oW6Z@HuOh;O}?#)S{)-Ksd5U2mL3T2F^=!Si-!4cVm!H($~}Urh7pvq{HZPPESN zI`a8II(Zka{<{2x>FLzxzWbOw{GvwZsk$ktpVy?#zVXLv+5LogrQrd*;((RYK~1zl4}u3G+W)`zs4U&~Vm zA289h_DC~-4MKRKX^&2br+x(iVOuHkfPjNI;O+S&@Rn9{$&B_0Xj{Mht0_his0!sx zbTP0hYJJK!=DOk?x$^r(Zt4fSo~ylav3r_1tb2bpH#(Q*a&;R|3M zDI-PBx0PAYw;fdjc%%s|hLCcXW*aR|cltF)w0NIepV;m@(h#GI!PM+N@p3$%?|rQ| zpk!e>ddNMiJKK;!JZRCwO+NOiWo%H4da)Y8WQ;PZdT#!zmvDwEt9VO}{Y{*oUuAU$FE%G=c zX;2t zQK?nZSgy>V5ECO%B2&lq^%G=zf6UJwv$J?}H3P70%vnnvznSQfjHy%f^{vruDVQ(> zy#z!lmj@+WNYRrOlLxW&2L8~>o_WQJ!j>z81Gu{hN^d}tqN$KHiqct?j;!jnsRyX< zt2@%WD^$sGI8h8sSnxNvMV6V7hI33~sV4e3a$!ECKl9a`wxwdN^+SUZ3z_iw;`S?c zjU*%Z--!Hi8qkAJlTkGj)XkWY!Rk9?NAMDYC9${W!mngM$|sh?s0GLqE>(WC5_ z4%JYEmpu&}LF51eydXscw2Ug6t^-x29#72Y{@$<=`ACokH*VPNRqxg|3G?^H=O|^E zBJ!HyyjyCuQ7QTigJ7CZ7E=Bjr!yry~GRfwf&S6CP zo6co~<=f@;p!M73{ouu$&Q1jPQ|BDk^!B4nmm5Vl`*Wo5o6IW|iS_X$MSD^;X7`B{ zNm2#smMO}+#6X+!uD{5Fx6vV+^)Y3J$Cv}~HT7H<<85AFmF;cM74qZS6Y*{DQR8VC z_wh8w6)QR#nST6@cfo>m!Z7f9NN+V2%3rjRW0o=l$O&sIte5r9*AR>okfZ+>q^ABe7y4#N z-aw6aF`B~PXyuPxQ$&Fv342}=Uhb}{%N(0FRbZAdom1r6sS#ZyVPL5%(8%Q5%U`Au z;0@iS8sbmaq3{L?SdvK(WPp=RC;mdKHZw+1C#GC`!j^UgS(WMqvnCAVbEZU6AnHll zHX{dCTZXtj*n57en0=2^2uVKSdFfZIm2sS4hyG#SFe})>01es7?>14Y@+q}A=zoOW9gW=hdX!P^x%pCIdplqSeg7r{=?df&f zhK0p3fiW>pxx;`X*%2ZkIS?XM?epMw47EP<`nux1k0<)zj~b=e(Z5^rtE*wE>AmH5hpS%OGZdQ{}-w2t70FA)F8sL4F_uDPkw9X;9@x6J%$-*F=g|+-5vc7)-~<#{TG4fc$Ye~7;VLpd|Cp* zAqx*0If1A6SF5Y?sm!j#1c$W%-<}D=S5_NhG3I|30#kPB(474j+Z(ksp!Z#gnk{{S zDW76!&R5u9ip*X!{uw(A2oAyRz3q<5n;`=UdfmhR8Sk!iBdef6>Cr3wuQ8D?di9c8 z-JM)&@JwPAxfm8hThn7*F*2D*v6wtQ88EpRUUo#+1ztQQsZb}}l>7}ZC7lT_W3)Tq z#t$ERAn7j?Jf)+Kqz3&I(O)+IZ52qxK3t@qcUrf)A!A)dqiVf)I2oK@Us*qISDu-k zI*wxO+xbRp*xqbTK(My7%@1wcwTFc1-hFeWIo!0x%l$ej#J%I z)lqr)Q+#7QRy1k<>cp`vqKy)fXF*kzV_?Ql8WL5f-jt>|hu*BXqO85#RheJeSkN+} z(`K$n&0s7iqHb<%Y_1NSETP)_RT}cWBP!Yn%-~zpR^8N8ou>V`#KWyoYgw~9dqBDRl#db6PLt#-_l6SuqzG1{ zfTRpfb0O`goWw>Wg`FV8Y0N-h+)yeb!z}W?`IyI2C7FD9gE>Lq1-(Xi@pU`*b7f!i zR*nIEr7Vq_Q{yD$@b+h1MDHV=zQ_oVG0pyNVY#uQ^YHH)k zU%OoS_fz4F8Gz^Vdbkul^`KSQQnEj|Sqn=oq4w6?3suwj_CTCWnfr8E0zZ@1*f1s;W+KR%!kR!9*N*xq9QqrP;blvC6Xj ztuZfGnWW^JUclcHwc8fZMbUNrrmtM)iF80k_i__yYH8AfmUvoptb$ zg_ci>z-_}FuXu{j{b&D_>Y5~zmKJ@;TH?7*VVDrM4y}E$ESKr+4ciBOHl$mtgvM)7 zW0gMe1by$`Y2M-s$lVr(>_25NGJ7$)-xp{z}md zoF3860NJ}U6C@7boQHN<)1UI3cl=ok(n*9LKg-%^b!=)sx|+%i@pQRdZ+0BMs;M{C zce2VYHr2Os%BAGt_SqhZgWRiU&I-{Bh|p=;J)W3WP*&FWWWl+J19yU8vD8|n%}*Lj z9`nam?}HEJHV9HNRKu_!p(Iyvo7JIDUM>m3n^-r4mkUKB!)mp#&}z!4YxHU%aJC$! z+E`TEVHjbUSVyNZtQJY*u7go(bRNEG7SVQ(i)jB50<(s>qA{jaC@sXLRDtY9rpg8y zWu}g#;UO2nak0=t1X!ZjUZOX~@GMx{s8nFmBmP$TXO<(rfV_sRynOQhk%ZZ~sEKA3 z8vPW~>1>>-JSnsO?))x;NIJDvmgG?FtEdj-rX4n`1`)0*wH4-+%xWrUW-HF0tm9W4 zJ#eWu)!5c9&ww-_KHlgM>6Jua5<5GRH_5Cr_nS5+tm&y;ObpQk`qk@!U-7I&iu7_V zpzaPGl^vVYzOnE7wvr2uhqwHar)ai|^~tB7Ho{8#JKH%?(x>x$)oGbF*SP!HWKyS3 zdGN7gjYuJLD%pAFx#$oc*A~MfewTJr>(J1O<@kY0_ruT4EhWraP-}war;)|Q5eE)N zTgD}Rb0h4U>TBVmZT#5>KgHo8MOAuwdlfDI<>@KNmG61Ql+gE$C59KLWAEeDw)6hu z6|`+%J~+*uvn-?uIXPu@Oe3(5{^1HsM*q8R@yy6xe?chgWo+;mMNLG?e)=M*r2Om;6*p`-PCu^E8k;ywzoZkR^=ND`&1`fKHA4Ov}SQG zjx(KHl$_n(NprWe@&p+z@!rZl^-hCFMJhHDg&8R&;ie6<=-AyV#d7w;a-nYH0X%{>+Jm1{RJdFwo@5)*%E$yG|?Jjhi1kfkbSv3aR#qhO9fWKHw;6*>m6oU3Bw zQ#lR~B?E6nh*?06h)W~ipZ0(tAX8YTliG930H+i1W()Obj__VG?6yS1TYA^)R9-i6 zMI`F9ZU9=TnEad?iZH1qw5%}!6)Qne>X;_i;R2c51(KiAo|?^qKfWb$$SOm=00`%(BWqI3G*mEv z_5NpHJ%E!4l&7|*0GcdFWyn8bW_wy zLd%L6M2TjKpstrJa?;mkMsxBr)COocpuXWO#Ld&#Q#2mp$9}>ex+h&w#iOl*|wVx`&WWeUf#1hq``}!vpL)@Dn0U1PqYC3z;7dT;c zgOQcIBB6?Tf_gL~I7=PoSek$A9EP&K`{j~R)qkY55gOq!;*o61Z{Nadi^97p>`@39 zKRm-CN^^{)cTqK{Qj=C>2*|&Dktn$#8#aC{=^8a~ptRp5Vlc4ujuO_n@5tY4A6%mO zC`Tr`(WaY>?R@r8I8d@aM-nFATs;!MD_}R<>kh+dZpf--N( z{$e18uf?0@|6zgFU!oK$Y15`~#h+#j@>8Kx&U@NZSMgz6e9tA8Q&oH3aWN_viPLlP z(qX&BWxkND&V?MGQ-jr%`-~TKpXqOFx2LX)SbzCS`Jk(8!5pV3fBWk2Lf-L+W-DY5 zPLxZC**HIylU8$iEv|lx)E#Fl%U0Rj9|o}pW>Dt7y8b--cI<(KuKkWJI&H^!x*YUS zUB0EzO>CZ>H1}8``C5_k%vx~eZvQmO>#g!+p#B*D!b~Mc8I_?vA2QoQuDB}qLL`*U z9CSuiC8AX<@l~$AtSV%YUxCQKXu3qsAvLz4p-P1iRF9{iBM8+^oi}VAHhTo+A+XIt zeO==KHvaRLdc+-9PVOhA9DJ$$z>)blWF_RXi&lR*rZ2ksGetuNxGsq<;@PRM{$lYF z@hdg8y`@4%Hq>qJ_06+P2*N7BzZ2DcWA;Ec7Fgl!V;RV*9uwMv~2GI0>x> z^$A}>!RfP> zA;vPlae#9w9QVU{x#u(9=a$wr-IeX^j`GPG+J?LW>oniI&5y!7c>TB7G1-*+nyjYX zCfSsUFk|n$wBm2a9JW|w7Mr~MZGH$=nA2}x@lp8hd2Af8Bl|zjxWR#(RRWBK_K}-# zRn%#-_}aE1NrL|`;-1I-whGmY=Q?bYFhCyL#V|`e~;FqIj)cR_G(!U!5!Y| z3T^@W9?-5rG%JhEc>HS<`fm5GWQ!|vtTFCvo-pzs4H%9%B459fhF~lp_1e1wiq@Q! zRsz$4CZJK?adJ(;)12%GyNGSYf(Chz-%g0L+*B&)A|VF{63A~kM4R;v{bP+Lcibe^ z?6k~yXj;+}oFWYlqYPA$4Yh`o3kN-)?;YZ8V79&!^x%(oH@;wF@nsHZUG8Z>Mej_J zI%p|jJ|2qdcN^RHZP~9yHGe0-$-?Rwjejf>-^TFN&q8ZmNT8EiY)^_&Y>5t!l-YHq zDEu%Kv?aR0dLkpq)BTZ&7CUOl9m7PpfhMR@Kk^m*BTeakgpk_g6P@3+F}6m%me}98 zi9SlNZsXgv#cemox0D^0JVukp!$NUKo&h&?p-^mCy&I2qhMJS^<_F-kMv%S#GP%}NY zs0Gzyx2snf>r^JmEQRyBsKT}*? z2uo7q@q$3XZBkQvFD1oU>5iZrGI;PK{dl=Kv}7aprU<~`vG`419`ClGYHK5`*}67< zGdgXJ-Kmx)<~{q2vfG5PK}O^EdhWfsK&1$tfQu#r?#U4E*C|~m_PR~f?74{6mYlF8 zw-_R>k)?M>pTNcZTB86{y;%9e+OKle^$=5?XULp;K~b=q)(#cB`(6CGwJio04d{la zMv|Yo1YGYe&0*{g{AAWa9hk=;AZGD^TzMZ=Gv$tafC`+CjcGgf+3t(L$8&mXuxO$b3k*^niJ4ay(A5$)wzAxWLNHq z<`DmMfp-^NCH%QmCG5fwL%Zlo6hq*qpIh?UBZAZN3m_tKEwM@ebxp3lC~|eM^QM`6 z9q)e6)fADex{;x`{hnRb_Jq;@4ol!Ag7{q|_JhRDwF@rP?3m8mlMdDNoK!wR{ZlpR z*4_aMa+N55{iteVYfCnDfl4$SlZCH@-bmU+%Y4glD{IGb!7Noh{!adtcZ~kw>|)t0 zUt?y|q+At>ntvr(+gq0Zh*#C4>Pf4&^`GOa-vk($Nq`y*2{Z#2=QYkpwO8LYt_$cR z6sLu~FT1$^+T+6u5KsXQFUEU4>2Jb{|UJ^Pp0|b9h9*#{oiC6lcTi*10!HoKl*P~GXK9S z|Hs)I69*?7^Z%wi3@0-S)BloW%oEm4Yq0TZVx#P${GyZHJfcC_xv_kcyj;Dnj()Vx z3WwcjKHa*9!zt45N6!^85X%QOB=D{y8}})Is3QLd^q%ft=TPt_Y5pD?@9w3|lc0`Kk18&Wh z1l_}N?`6~+gvQ+u7o_{QYhU#EN4HWPUT!GF*_ zLbye(z#pIpO^WIDskfw_u@?Of@3Z}+`+47QLfrF_e@62|`vb2LLqmQzVz9uIwyn_W z1mvwibZYU13?DFkUye?p#Su0$`K+6a@}>$nf96q*f8`R?`gU1Q>V@SVtZRUTYV|8E zisj;SpdPXV4%%oSynp>0j z2~#$zX^|S?brF1H8G556Z^n1*T)5TkYnE3gva}Er17fe4cz#ps_?FkiJ1ci8}aOqS{kb{9w zw;#a!O)T-pSp2vvc$N`QT*QskHKWxEN0|hIgEz`vfj~9>qGBJ?EoiQD}N-* zcbn68lKHijwQ!-;aSOb(^l~@9>!yJe1s73oGb)@P?B}B@CXYrXBl2XQ4D-|fVlr}E ziX6qw74IAvvk#;Q8C{Vt~KEmt@#N@N2|o*vCa!8P zyV>*7j9@o|({s`6?V0HtThiosMPZzvLLt12b!T?}KnABfGEnp4(+U$K?pr*G9~CA* zGx0(>2hR}<*!*)=Hvq-cK6RleDFsIu4&Jlb;-FYRXfl^Fi5s!d;UI2kuUg&ePD?X4 z`46I{Bf?H!m!t>+3Tp^D_hfj~C8cp@V!<6JXhEyjNrDk9bxxM~j83=Y@RXddmJTwkDV+os< z<;p{H`*&eDK{ZTtM84uFYZuE4(bN4jA#KTC=Fh{yW6L-2s~~&(?Ujf~+f)~$HmU&eRe>?fQ$8>F5#d6ZN4sbBpbY_$3E!Y12Z_C%z+Oc*O)~>dpd9U)?*71Q*&+L{w=*_-)hWTmJ8hDVhxuX<-tMiBJ~u~GcLnI0erO0uO}8G;@~IfF_+ux?B_L?vV5L&!QxzC%1mJ7I#xkd8o{zM&?ZO zRyjrhYim;di~M9-fzkd@Y93D!a%A|rhZ{t*KNO}g(lc^O#K{LH2w$?krK8+k(argo>=aGJz)fw!%$2pRT#qyu=c) z!Wv+o!vf$D?EHN>UZ1R@npy9`5{lRnS)lLQWb3A_H;%y}b2XwLwJG{&x71ytv{2gn zl5BV|kPO0k-x$k=@kNdmBLR<>$K(C$8p?v4T+3 zo6Nkf)|PzLA#RBesZ!DT^1`Bn*IAuYBUHhf-HQT7JGr6EqA8GwnOfSL4)2l!k)p7x zS}U|I$;r9`uA>pfI6}a*h;V(|N^1{~Yg6RC{ByZB#D#$5j5g7i=o5zs9IvWS-Y=#s zb;Sn$BhGAW6bmjV=F(IH5fSyc?QsS(65N#7@M_}{-iMe#`W|OZlTP_iPsvK5#AuT_ z%c`lpTC*}X34XEgpfx)%(;;EG4BDNCik({)A!ORCtKP@W9R=CdKx7WxtcZ|E;Vs5ze>g`EIF2CTpVGmI~p&W=d;NZR4 zMW5R?0B3mvO+0cSzT8r~5@`q6*7mn@D&yGFQL58W_APdV09D6#1XQ}ZwqBp#i)%Kt zHOuX2s~%ZSNx2jd8CH=6rOsJW0Dq=gZs;A;Tr+aCk+(Z>TbF(+xFO%wWBTh#(%3}8 z5b3FRbZSLF$!V=Nt)cb`2-++G8mOmB^9k zcFA89jln^pmJZX4JF4922SWYSTLpdb&oA%H?vZdMo&z6h@b1D_xwDubz;>8nu)9ciOhZ1oK$Y*>i#)ky_mQxpLGfCif!{ zE@~_>|yF^;qGyblDT?7tB9>os&*V|ForX!pKZ*4S`&ODXrp6Zfx^~YiKmN@i*9EaPw>95BS~mG~*>4@; zGF`%YYVFX9v$=xy!xggSTvRSe!(JIDA4IuB6Lxzfdvdjc4ZkVD)65((`nN$$XdN5?qQZfjk1`I#+D@OrL1Brb&hduWK%9)k1oP*`i%Z2&xE;i z5_s^U=`S_q4r4i)bc~yyJ&GMgrK8TG>Iy@hA$&rxj!2-_91loaTV8t%7qZnyMb)#h z)yv4#v#l;ISv3`kq^$vdxv4ncs|P@?E94^1pRrqO@OS$4I3Hj{#$A%?*O;oz-~OZD z98il+Iyb8Nfbe{4`XJjF%aC#5z*u*3)^VKETHJa;N*RXdZ^BHOa9OlIyWpg?ez<#9 zh1$0{WXR-wC(kK`Rpxdxiig-wMXK|`QJ-QtYPH1RR6kV}9)T@?| zS!mP9n1okbeQ)K-SfR77mW$HNP_tMDR!;CHZLWcDZk<}9Xs5PM@&5oz9rv5E?{@V; zZoxaY%N%f79F+MBlu-8+_--JSt$V~+s;ps*TCNLk8Te9~7d~BTsY1(LfLaSs+&sX( zAKPF>zTxXi8{%0=f0AXl`LtIr4@p-5!Za+F+L2{g+&!v5r=9<6={tcJgJ9BB6|xg9 zQ?MqWMoHql;0sd740C7piSj7YJ*nl)ps8);-JN{#3r5Y!4O16e>WFTmYdaC>fZ@)l z!#3n4klX8JG9>sM^HvF%E1H8XP-dfvIhf3G19b^sQddh+uu-UeLNNuve!`?u^XvlE zVDTf0lm@W{z-~NSyD%KrY*4S?K9*Eu*P}>eZx=~EX->kOeSz)9c^kSD6m{5`V62Ya zv8_Rdz@P9$2mAw|?PT!`oyf-0J;hSHyO2`Pv2LK3?VZ2%lR&my8s2~|THIOpPVlbQ zA#X}Mk8I3jNLP*dGGF39(5hqWk#3pp#YRo%ZE~h*CAFYta(jYc;y%(|N#NZ(cNNvZ z|3le31!n?vZQ8MIr(@f;)v;~c$&;jG+qP}nPRF)wXL@R?{`tPY-kO>@+ehng)n0pD z`?^nc{H>|_(CY~LDGUl9l41vziTI_7$<6ajyWp@OVn(<%CY)?a?v{Y3O3by-57R>9tD6rR#&&k zZsS+8O*Cj%pOdKQhs;j^9|>&qPJ7m^j`ofxZdrZ|`3!#K2cjG-5=ewI$o#-uetJ&h zWF3>)sVpO@dRoh1kxH>gAf^34B*bTUk2%*~s z40=>OqiIMT{%`)PK&438@ft`NrnZ`*W(gCIO3~HJBPQ!wuEoVx@j|xpX$IT0fBo%D z0b)+qSt>*hNlc_s-AmN9HBoBg)jA5~cr$J3xe;J?yW|vWY1X7MU{#*H`ms-l=tkft;*0XO_lPu%NXyA z|I!uWYA^6*tNvXmp%49wd&0~ow>D#;O|Cl1sF*32Z)KsemVq}vA+b;gk7iW=+4=f1 z1z$(sm*4>{0Wz9IYVbUi#F^v`329|!?##eTA&}I!GXu|x=Y`3k$b$$ZpunPzLRjTY zZ$3(OTaJelnl}dev$S!gR6Fx4VVrJZ<~slRUb+#Y^++%AbReYs!P=~Ng?sv&G_|v# zyHbI6C>itx_O0=6dN^q@6GR&TqM?xMW6`JSN+)dVv|O067g28|E5ZzCf7uIm1XJM# z@8cZ&(^s8}g+__blc{2L!h^!)Zc1I4;lVSm(Yf}tx8L^jGs$^tFR)5$oe3?}3yb@MB$ zq+~|}#S+qpT=@ihr^Sw)W|sgHhJrk+tnF17uE5sTKBgoXrp*Q4^B;~TcM(&QCjM@6 zz*f6;uM66i{=(&4%ELzWuj5=k%u3b{n*hhI=BsfHliMrvSW(&-ZK_ z_|8DgEWEOI!!FV{&}`hD==y757GiIh$P#PLz{@U%JjN%G=b)nxuNW!UPr_;Ewd}7r z$4=bOZwUADX0&grE9zwY9cBLQZ6-ZE{_S~wy=z9-)@Ju~S=}q!E%E^o(i`HNTr7rt z5I&HgyPW+_;?0qCFosiZ&trk+F$#KLSR}eEEctu(U7gmoeJ9OR&49_{NG=-79?lRP z`D_;cbbWqP`gZvfr?Wm00iiC|CWUNmGlJH$r6dCSAcMjH0RAPvt{-h$)t&gjFqCkfm<349@=$PDpxga~Ev}C$ zj^71a3%$4Rdpl4-;#iZi1B1mVZuNQimP{S6%8uZs-jDRbqx;q!+W!+6*7_I6Nd?Q+ zf%&Wo@#I_X4%S>m`C~~AKSRI$R;IZ{wb_Ar{-QFfxn&OxPxa4IJ7UHk4ea$KZ?i!c zcd_efETa{)p~)#4LH)D^^+163se3%9R}W!f?g9WOQVBo}^OU%|YV3kttOPEn^%xKOD|6H!N-N+u9ZRiU&g>L2SMTg4 z@cTk(JgSbHl@t1`a_J0Ok444N6`46rr}W81;NRs&!c4BsR){&YHg`8jc+_pR=XM->9_T#rM0vP*+d7r@oLTHRhqB zP0FA8h3^t9kYczV?ntDNxM076Eu!%`dfEOMugpW+Fvs`kE}iXipIFsUUa)1-z|WKs zU2oII!4Nkq#&YBjal9UcBq-$@>w0?;&u;}|U)I-JUR~N=D0)PsV?T< zUy!$JofKY|FgNyV*&-~a+Xl|2PzF7>+#9g&aSS`-L<{LqJE^N7h-aGf!Uax#d`53w zsotRnEHFnFF6;3pC%=C+)Kn)|a zC+DyD3ETAEdsBAM+bw)#`nLch6p$L__zd4nY&>Rp^b}VQdI9szDSjBozBKgOd1cS< zW%%KLCtC+Si4e{SU3#Tk7VLvj)iSG3N!Fw@4eQZA7hx!f9Djk~M%nm)Ie@_mCCOl%;);9CpfFG-rL6H0`l=O{-mhO`o;t znz*cMI7tzYo5X?PXhW-!rpwzi0=A=Wro2gMaIz!k1X}q?cUwo}mkRI0uc}FqqKD0x zCik}YHX)$;e#7Y$En+X4pnXQkR@JJADCaHa&X+1?f#RH5{~qA+dgN6z;NyxdGO&G% z<;|T=_-1}2#@N3>>86c&w})kC1JCbSMT#!@J8uEX1?rphLohf=SZw|)%*`{Z4BX!! zP8VW@(LSLIB5SIN8+bBEeq__uu7b@jBYn-J%9h#K_Gf7Y@nX6AJAJmRN1nsyYssdE zK9DQ8y-s@UB~Wy;hxH*^dB*e}wJqB-Yp!sRN#kvQeKYs^cna?eZ}MS=myi#rCxcgg zB#Fmb;1G|i!aSEQW74_*&@D|1)_I(TY&)oTs7uHQcd8U&k|M7LH)Cj})MwFFDA9vv z3k8upFB3S8TCM?V42X^}Rx%nTKrw%5Tu!)Nkr-Vv2oT6~UX_p>;lZ1&gwq-#?IDbQ z$xr5EIERr~;i8k%rlNHf*6{?$Pm6U=GH53?gAKM}s?VaLVxk-Z?v@!tb$s(m*BLp$ zLGO?TDpR6XU9d7QmN(qJH+5>ynFSxC_f6NZ%k#X>yhZFM$VARkW_m3XR%yB2R+A90 zN&hMMtGznlvQFte^71}LRFekzJD`(1M5dcNJqCO)hFQEw&EjfbsV7YxbDq?=9>ZOA z(FRuo{Tyl+C0p1UwbFyEtD=n?8@BoFz_D|F{>r(%QI!rSb-+@MEbRjyI#SxK6^x0# zHL)v;Uqx3fUDe9k2i`ZPO^mKlQ<(F2$%{vG#(jrDkyyDxyRK`FPP%ZRb)AF_8FhTy z=08M>4p(#U^BHfe)TS)QXRUFOhVZ00_J_Xib|lxQE}Q|YqoMU>B0s;|*Vj9g9I-~v z*TLz2W~uTk4P`hQ5 zpVj3fg$^>*J|=c$xkf%L85KWa@B3Sbpx3rK{T;y_z&DD(ukxoOz=&;lCZX#T6x=Bz zgfn@tRG+Ahx4!gDgSD9Ex{39vl+4@?&uU&gi>O`I@FvVqnRB?6?E^$E;JBYTmad=z zBMpD1#9$-18#GrlH7fRMD$2C@=wEZs&9&jasaay-curw+v}{-|+%TZXB$nx3$aK*b#8p^WQOBs!-qbof*Ppu)=S5)%~z(%m#DpPU7VG?hM5sW_vD9l8>b5GRGUA4EwGsCniQ+Qiw;1W- zYkwfrsW;!fxaFub9}Yz1AIs788?`j*iRubFeDW#7o}G7AgPlR2so?V$kntr5vS+#t zB|Y{zxZQgn4D|-+el5r>^_tCED(oW~U_KV8xjJTy^alz?{^*`roqI8hFxAG zz=t9nYu-jiY~sO9ZukR75FkQ0fwJuVoau*LyMWgpr*RTM0pvbF@R_m%D~vO}d1d*C z(EG5}j^PIHl*VCvG0ie}j=3Mc5i;hA@gCctnaqeG-xdp*p)Zn`z2rklME~)CTy(y- zXK5ALL4t95CMJAfUX(EKL41tASaJ{>n~fr2d*J2mgdFEWB;jgA3{QKA54a;@;|~$e zV*vF;oGAJY^@uf~JT`tCpNSp#&1}-2@%a@M*#e(Mv%7{wq9Y46;s?!jM}*c- zR|fVD_gdRGu2{z0C$jp@G%xZkTXyi9FpwMe$;Jn5_%=5lw-=U^Ul=%#3_>vwyCyjb zDY(By_%y?Zp`E#yF=R7$H+Br_3-l8?`^$ch{P|WO1U6o0p)~D<_wD_OP%w5>gNIh{ zN85mai%-ME_gk)GkK|=Xj^5NH`v-BO`NV#u|Ew?X`)Y2dB_z!LQ@?qGFgFK~*1Wsp zoi8uajdu<>Jk(KWT!1ysA=0k`niBZ4^G$LdghQ*sr^28ju&9wgdyiOO6Ih05RpwFb zi?As0^J%yET5hPGy-Kk!tum7LDdBLRXF0~oT6NnjxHq*`N%~>bE0pIM>lji%Dhnl_a3HN)6SIE~;aFl+t zes%C(l=WcH0j@n*vXO-41Z(LWWe!iXhn8~ZiRK8Pi9IXq59&0*l-2Ca%-izd}UT)k50FKw|<~SJJf_9 zMq~@}#HPR`1+BNdhFvsZmZy^Dyq)wF|;dL?aaoZEnAJe6&uXhslUazNeW|#^=x&cF?7t$^osZAO5w>2^Q)Ca4Tple_Rq!iYTNwR$d+8MePwqX@coj9|4 zu>eZnTv=XYJu(Zi0AUe+g&)T60%dGV<`_urHKauUTCQb9S9xKEOy@&7!(&`25y&;>p+Ju|*7lJg8b!?*n;YRrs^wHkHx&BW% zs|_T!t+o+9&uNyc3wT1jTSafR3%dLOgEjgFRj_s$ZDdP*os&l7s<0Yj8W-)NUe*qlomyR0*veYwd?&?C9K!}ZCC8I-x=A5KF<1?0vs9ahi*w7 zq7oFv7HsOEzJJa!yI`l)`1YpDME2XOrip?b=TgiRx*uGXqTPNGYu0tw--7)gP&~(; z&i@D*{g*^;Wmh8?PX|*55h+n|dpj4Ee`iLK{{w8q#Pr`oNuyP4WtG*j_+K#WjBkMN z2E+`Db-=O^S0kl9VsHJOc|1wx8lNH;zW%nIg# zxi`gAY?+ZmK*WP&Q5r4}MkT}i+!W{tc}iD=U7Ic?X8C46cyB)VZ!))K0@APq6;ZSJ8k-waAFD)a<-*uZ z0#ki*xYBYU`Zn=&q6u*>oSc?xewD)3^v9-Qr-7?2_=CWOL7MLJ?LycZK*=gPs_-{Q zRur6oAvTSFzewv}>7UZ#SzvEOT6^Rnw##o7_oKj#H0g z00ST3uB7E*KRH%YSH~4YVM>uwZNG>H!IrIS2UCp8HfnE|b|FA6f-&qQ)uf&tK=4jy zD*M$4>*0~VO3M3BhVxoLGqI+0Ru@rhwx-sCrf<=>YO=Clu|gWELZ&Ji*%-{;S*#M3 zglkl|v}4zjnH^7yAy%ueLcBfoVTg2oMI_S9Dj38e;%G2U zM6F$?+92)JXm27e_;OHeB6>!q00Qy~>rsfED|}3Ym;)LDp(f~sg!9CI2BEP4Zlw%J z0IAy$csj}4+Ei)XSMeaH z>~hiKNLeo5tu+&Q^Gk&s&9;% zPJ|lqy_~?0cCumEHU0K)!hYjhrPv*NM-}8|{G;A?u}kNGwdl{i3$E{Py-VH(2>^|y z6r_^?(TVIe5R64MLk(qCX-g194OOdTj246qWmdKLbt{5kTFw~U*NCTus&=l8P_1f6 z9e~LB*agD{Lg;9*C2U$9B66YH79kiQvPOLf?GrD8i}7yd?qqQwOmc;ca73%J3>YFR zgkgbtbfn~{n&-fqfUS(uJqkUNcWRz4Yt&pjHU)vtwH|dry<8=OqTpq`zPl?z<^SnF z7H4plc!}#i2)NDXz(Qbcd#c~ql31NtDau<0MkG|)-=Tzmb{N*sfwQMlW+V|sto}Nnmr+aJ76w!l{ z@L4g;T1W{>cw0C72{1E*vbTXUkLED)-kIgVUgq;yIMio&IQssNjqU#`=AP-lrQBN^ z$K>ZHxF*RSm+uQDK?&UgB0OYF^$YT0(`>Z_k_6j)2swXn8 z$;|G2j(=aYmgF!HckQ_J*v##_1As%+3qo`>8y{3OeozKPbkD>LO!FQ@vHeGQ6`@cm zxJXb-Fl;eoY#K~4BUr&&VgspxNSmF8?ywi44dyNme(&QH50JbmQ{R6M(nOHAm>4Uf z9g03+7>tV7F^>YIYdw78PT%ur%+IumD{aJqe zx0Gt^GH{LBg)V_OE;2|KX;5JO>A>uJO7M!M8FYOX zeiUZ>Hke_I1bOLc1$|`37*6MRIW4FFb&&+TV4AW$D-+BnN~x?FQds!9NR%LUVPhI6 zuoNvyv^X&Vo~wb)13Mrv*YlN z`+L7Gp$(s}ne5R_)d^I0Tsjp%(#wbci_sxi6HOEk)jwVba7@Y7cYuRE2eopafK{^B7z3EZMQsfJpi3t zm)^!7V;F9#YQNrCFK1pL=+4HFSdlaGuJsA~EtmrcaSiQj!Rf&1@9r!FPizaVAM|fL zxpqnzYhC)3v~+PgBO>h%qsXxAhv1Q;NE$ny zax-$f-8W4-PKtzcczcZBO{CACqP<~_ncDrBHO!my@ce%8UtxtQAO&J;BR!|)kxDW? z;Oz85_ZnmT8X~*=9Wj3b^@P0~l`%&ce)kkcq+BS~q+BGx2xjoEgM3b^zp0BB-lq&c zg%1Y_Lgqkl%gWC935VwOx9~^Q#0t=bB?r{XGv9i0PudaTz0-Q8k03)+tTsdA!3}+^ zLBO9pIS#|4cuN%2|CP^KX&Z>QiY_e8&o>t%hy}v8qmHc;qQ~6Q2Ve_fxxC8M+PA-z zll~}uHAiE$-p_(K`nHu59yBJ641Bz8_@DiGz~7Dr4C7o=y|Gv6_sbX?ylH(iwCrso zQwK1p*Qo1y*o#4pCd{wy9nvX)TzUzen8s8YK|w+PNV*yZ}`|ixPDBOI_%L_>D2RFHKNfpw>dm@kzr#^cw0%8KJm7 zt(oJ4>u@H9yTDzaVmS9FZ9pTkH{i&)@bfG3lgD@=N4-8dLDyxk^40HNM2tyLi8OKe zRg)LwF7SPjZx@jpM*s#7m{^pWCZA~mHDcbNVIRxG+R2d_Wv%TWnzM=(E=x~7NN46O z!2)tcVMbarAV`(?n<~njupunGca?D{dYL`AC zW%yxhOm?Rdz^kV;@H*QgMquPgO@2>k2FCP^?M72h3~|g&fD`*IibcnU)hTkv44}B? zb(rE`-A-#6cl|PLp;qotSEPP}yIdc8N=+@`S*FFq@F#lVv`Soqb)Q+peu08s3w+8O|%!c z*;y_$^JvbNdy%)U$@2pw2Gj@q^?*VH0b@5Xk)@6sA8?8JPdEAWAil}|oXaoX5>yzB z*&|GDGG7;wJK|1aSbONXs@>Az?%MhKYb_T6V0-=?YwK48KDvCxy%_0>`jP4+|HZl^ zDFhPU_=-AVp)!5b|I_!HLZU?kb6*rEn`QoQK*7#Zj7cnWG@gvv8b5jG|F+=xncnu5 zP-1`sTt}jHedhM)0PUE+{RsaZL)~HUZ*oH5p|oM^%fURI38kCAP;UbFSN4Vd=mab{ zV{Z2e@Wv1pFeb0TT7@lqrhnrDD$3W#(YF279`(T)BQ4;D<=Yb*aT%k>yf)wUX+qFm z;lDc>)T`9NB)6Vo-x#_azKn(8HIsc4({4A$LUAz!@T@V?Kx{dnXhbdvBq-K#;oH( zoCipQhV-}TkSR)6kRQgz$d*z=`-u}p6(G)CUPa^c8rOA~b4|2x(e$m0O-rKZ1w@ww zc3Up0?Q2<*%-=wmmJr`6Xt)vqPFgq&E(HB2LtZo!9wAjvD#W{t>gynMv6Lw3ud4Bj zvYUyN7w?wgO?&Pn#^gHYSSP)ks|gxd1Z%k!Rj(xx%wBu=roa1wcYu15sxpAX!^Qjv zVj;RWXJEJ|((0)xv7J-f;eBOnZDDni;F?Cc0hi~l$%4sH zC%AIU!f>y6L#Z%}@M?t|#}PhO7u@-DK_;Q0mQG7aX_TC=`)b6TkN^eq*dZ;JZu*_1 zenlI882bG>o~xL+(p4kv%binA_Yc_@3$`T7z~<)8ni$078@lv`D?Im)E`-R)IHxLk z$NCf#+LZfp8F+DH*NzrLVlzZl?gKJ(+v=?Rjg98=O*AEV&aSJ>bU$2;?;q@Y80M%d zjh@q__bx#N>;za5vzT;0x!hV?K7_jyl2w&r#54y+jnfI0J;*evO+trgdyN)zoeG2B zR}-txtZkD~r4=K246pb|yF|VISjLlvm{va0Kq4fLVIUy$8pc?ODJM-Rcpc-|FkIR2 z@cjel^A+z}GZl|bl>*<$5b30!2&FqWF0WKEm!*x|kL)uZ#4^+}TvDoY%u*E5R!y^FjH z8rMuRyq+#lP6VJ_+A9;9ojBjwO+6vpO$ErMISlcDlAG!1#MaVT+BOHcAZ{!4;ECM! z*0B?siQ8JsKfTWDp?K$cP=p^qJ?tm2#6BtIH2Z1&Lus%W9Ur<}zf1cT&)imPK@0hz z02{vbvZ+jvUUt1*(Tu@gc`Cj4q~dh_>0g&IkCIUo%Qk( z(-5rbWlt>F&x^})A-t%#FYDr!OD@#LnGxO<$zIJCvMwgti}3L+Uk>{KZ;U!XE)i~DnZ-!3K}ODi@zfa#@;az8Ah5f@M$+#~5J85*4< zQ}TQ~?Zh0xy)@F?MQLpo;XgPQeVp(RdPc7AxW=^*uz@5?8YB*-5v^nxEEg{nBsu4M z{^XJ|A|+nsJ}yp98dHQA2@u?iW#UtWOiTfXrm^V8sHU`mv`Sj4HqBt#Rji?xRyFeJ zsdOlC%z#34jvgjvt)dYCoeB|a+l@kcWrhmJLu)5wA88=Y3%7cM*c=T2!$JMzj7`6u zcB+w*;q;$Kkc^U2#q!jB?ZUKeMC&98TNj2GjLD*@Vq8bJxD~O z^3Fi-zyQR++QV;in!C!>ipG!L#8;mm4xBo!W>e7bl7IAx#I3q2QfC8{v16?$s5gVE zIjrOSQ2e;WLGHP>)@A2P=uvooc!~4o7-MkB;mQH~H|uxD=83Y2q8hZw$t+8cszH;Q zzx8-`FJt&{vxY7#Bpm9$0ZHFhr>8vLkF0J6&+1kFBtOwn=lbT~Klb)q0CJWtpsYq8 z`s^a$1f4(EXM6|3H+L>w4NSB4~?s8=Lx>w-ZBxVEa)Te%VgIooRu3P& z_V5tZssI5g&pfl4UTgqo_Cf2oToW~d1d%bh6kzN6xo)Ktjo|UfO=N7%u3BNOEw4&a zjr1j;Dw(vKXU#j=eUH0)Hi#uLrlsP2PsmRh#yu2Y9Dn5m0gnA~lT*!RNl#|y$N%f+ z-(RcroACXj@6q#$G7W?3EL<$F2wkY48@@tSZW&wob|p2+&T_i5Cenp@h_Xc0hIQ#! zwG^z{9iEkCf%%Ol^@lg+K%UK*yXo;34`plO7;Rm4^QvwuWeEozedcAH@wqm;nH&;n zC%#ow4R@hMf?-2CI#ROxI*g510i)4vxlFyaclalX+5!E;+MFLseoq=T=o50zpWTPU zU(wnnsvBeAs2QYu+@1aOm~6x!UoC4OV$J>MNmNP2Ry8bJ8rKXgxVOANQ45&59rYJ^ zW(_+gE|5H=Cb}J!5^8y)@GCjLr)6Dj5b9pA>`|b{YSOGC|DNn2PiBzj&x`bAq~$!e z+XisA&JP_FlaQWWF>}2_FwC zllu-@G`Vww@d~RA^gKg6@T_*3$OmVC2EK;tSKex`An16+FHHdAhPm>pku0qJ z8>xIJQBlWHrRnJfOkv(14?X;OEa+*H|hL%3eyk%X=B)Z}Cw8kSd=% z+xeZb`$M?xx$qQpk#B+tV_ZTYs5g%H2YWJ>aol68y=1IR-g^XLPpYJNX!qM^Grs8h z1=W##XG@HM*A7CNWVJ6*)70vimj2Gz$G$bE68K88?A54iA~-P61_xF;X_fW$ zkWQ`N%%$O7s6)l_2*mPbM`O-FoiY6}d(!N7;95Nc7SK>ldHQvZDaLE>UXH$eD6=Id zELn260=qUakca5+Y8A?{%5yy)8c$qT8-I0;VJ_>EKj7Y(73x*rr_3fGe(bO`xPu){ zj#jx3n^s<}r|n8dYuu8+Tape}jgJ&!YscS>)q6V`B`v|$f3PiNb^G7m3aE$DD-~*X zRlY2~IJe~@(Ph$WLN887bG>$y-Sp5&(Af9OGxMy%NNxgptxg#fQ_C7xdN5Z=&9$}7 z6UWzDTGmX`H%y#TliQ=kTT31m7w*evW|SvoO1Vh_2EAYK5x@}WE_p=%;-3fC>L(<& zJELX&JsjYQXjtMfqvQ9B?t*-BfWBbc-1NCE&NKXX=K_FPu~GnC5^* zQ}0FLcMTYy5!j|X)DLs*L-c8}%9tez5Bjc&)qDTyR)C)E_0IZ1|EX$_lt%h$&Il7& zF@A^T`^whC4t`5b7K2mThP)q!e%JPW7P<#gO3;qWo+5#KBj9CmaPRv9dSv*;(-S}P zbcu0KXQ<-@lAMrB!omgrz+(`_{{x+a;Xxqebf$&0 zS_~Z6;3w3kv`N1@2}!vyP6H&i1Iy;#W$8F4??$|k6YN6#mV<=h6>HT+$kQwlJ^)Aa zPTs#A{g`#_0Y&7Qw_J$YXzKn|Q_EWT%0dFz-`K@c^fm3~dt)}S{1p6Nv4$~+YMKkI+PwE_LOT)cNH*DMN3<2;>J zJcC455r+c78lIB|dQ@UIUf!bb` zznr*&dx?Arc`2|0bBWru*(>|K=som&1=cng7xn~}kjCf2m*Jbi4_)lLwI=pUz-{Y| zsAl$Cb0v}R-RoII_vamW<-+f+lC!@?8Bb!!ktDi>!S9Yh62htSStv>c6x$1|K=>X1Kk0y)kvWp# zJx5g!e?pCiv;jtS%Uw?=gzq70BNLCiL)8L12L{lwncSrH~`R1E7PX^A9dm&#tH7e`JH!?dtV!AIS|ik>7ezH-94Nk|Q|jcOSm)#QOXV0tSw z!Yu^6*;{nhfs7nPw5^U<{H|BfB8ryz>%h^!MOG~VZIT#L^kh?|w@z%EIARzSh@IIa z)Pb-Zyk=9$3QY5zwN=g7fnZRVJy+_^QY9@}xDdt)T^XFtK#U8M@3rVpJa-@2jRYf7 ziT>D$X)D1pR};`x2e-oChZA)1s}sb+%2W6j8i8+)Sf6rjNtZDw->#88V!!vZ%z(1f~+KJL+t&o#B}V>(9b$}Jw`y=S6Uo{dswl%I zkyWH#q zD~P5w+tdYXd0Mb&mCmWdiUxaRi}|v6vu45wBS(e(VQPX>{{x!> zS0A+94<5{_8`GMnR8gD2)cUT*>KJI#+rSORBh!?nvWIc_wxz&uS+9iOC*CCmh&*|Z zAFI$w&!`SWmZsAH0QLN$FFFo6X#wdC^S*&_Kd$NDhrdMd)Tg#;56WfQ_fvM%%3N-m zCdw{ojrIie&E&BFpz(Ny@<9~tO?^X7zJ~H?9dt(etW2GrYhhd&wsA(18)!r{JH>(V z7Eg-JV>&1Kz{mcY&l1A&?Qh(0%M{J5ougp&U#9inDXoF|=(-AWYAEP@%t5Ps=w{ucGZ>cY| zA>FO7easAOQjQV-CUlz~!addi@|JJ%GEgZq5+QY+Mzr$E^8<_uPS85T(vsoerQ!Dj z^ZJpq7GadA0U+#X=rAKIEy(SDHe>;Yi;?bF9AdBG?at`6axQTJt?9t}-t`00>_T8m z?7`(cu%Suii@%P%Xnu0Rq4=XFEaC^e4JK#jKknRE{t))hn(inj!x}>E=g@EgtjJ3d)9`_Up|p+WrfgmNzq;8hNc)6=ZcG_b z$@HRd4buVSLjl7>IE-QR-%N33yNDcNAA4}{X&&-t{Jf>b*7F#Cn=hLuzT2@UzV26FTvGeY-3w)Rms z4O}@e;04(aCf=fS0oRX|)muLQd#F5>Z{5FlY3CDKs*Sl+5+*V1T`85On>kj~j%+N} zoB)&5_N~CNa^?&P4ZUK1Sp7&A8fEVsDoOYhNuVt^T)V%s)3;lw z#ZYUywNjiyV=gVe#WiH}IsK+TzIo_W)tCCiE$u{x?lvKGV;w*Y_B9p3K^y8b+#n5g z3ICTZM70+s3G_z<6H^;YQR$w486PO`O$wG3=oFZBK^b%p*1lMgI9bPsiHIDvd|UJ= z*aRnC>Es$;hif$c{YYK*ta7MCA=&wCHuWW)+OHq3Mu(}2QB~G~v>M5s)}lV-<<}gq|egV zA?{12jY4ce1?e+E(&lYq^MbhEoam$5!I;<)txi8;C|!N{i#FjHW);6fv0fTVC962{X(005EDkZ~PgOoBtfz-k0={HpZQtx-` z2Q8okqMNIuKj0-0a5R(66+E|jIgTfDq!+W-f+aD?AAzkAC#I2=BW!Wz1D9OfR-y9X z<+(X?U}d@pJthNr!Z1sjbK{hc&H{ks#i?Q%&+!)eN?G= z5~zr?+y0NehxLE=9&t+>7gHw&aT`MyQ&Cf6dlOTJ|Ahej`tJzA|HKjuK!E7BfCB$x z$^Sw+{J*v{R!(;I|LTj%)`ZqkQQhbznZgGXJz|b<_MOe1YGRIOm6L*%Rs78eKCL4- z7XSB`pp9?>w+;4`^=)9&igyW`Ce8QA>{xOstZ zbePHVo@xBf{c)BM*3d#h2{$?SVqmZhdbT`y%T(!S$^gpdY){D@|A}rE<0bYGAE2SQ zjn%kqq=mI1d*#xGomqA|HJ$pZ`6?8A=lJI!l*8D$Q~BoG&>Zk%ak4RwMD1PW7uS&c zMHmPMoJS;0oWC3Q_%C!5=?iG(;_h@8g zx33z{*}>DquWI>riDE>kc~PFPwI*X@`)Yb#K@liKEyhXOeMKYoJ5r`t2Vx8)1ytDZ z;vm>Ny!t;LIUWHHWSe2hK|J*#8ZsV8IYZn=e0yRxzx0UNQ8J+j2U1sMZHQV>zK7_E z{h>(zK(QeU2cZ~>av}?fqA-cl#tVKDbFmtx2k*k})hB6CdkrT@5`Rl1P-3SsS_AcDmMO zLr%xT!zYHkJ+oYxI~JnWQppnoZ>9x^A3$k1QnYlytAw^U#ZAi{dv|Mz?58oP#N$c0 z8Sqx>v`MUmu1UXCaE=>Nyz|j*?UETKhb+RxG$WoHtFisYo85lG>SW$bTh!W61k?c~ zqoc82iGZ^$*>HXBWoD?t>19V!^fD_56}R^uy#4K$Dc+($I;ybbPv4PnXKmaX2p5=q zvboFw6IG>v_^3~BQr`_&QSfy{BA_t>nb-uE zYZak96(0BtOWfFKY~pXLkQzufp6ZI(`JU$uJ$zgH%n zc3cj;HQsD;_TFQgj6&L`re0N#(Fwgi?5s%AI5A%spSB$i1x*z^4%k5O|BT{TdO2zu zv23Ym@ARz}r@t~M9wI?vf_d&6wtp^Ju+xdmiXY}vH0Tt7TAmE|_9xyBrS`(>`FNMg zz$a?7F_cGMn?}pQF*b0w(D4#c@X8xv1gi^JKOxXvEOfgLv<|{_+`Mt$R1R zeXjc^OebC83L|LR4HP842{UL+TzJ@T_$}@BiNN7C9;x2TzXr^l7hT(k9o3OHKPTOa zbHP(9F!65qZ?SPqZ1ZttY=AfwaC0GMeh-mo;vWbh^bY1BgD^`QLU9Kd1UhP?G0BRE zZ8Sv!MQZr2o)hSsA4 zwL-b<|M`k?ug@EdnUI|y;M!?HoBo1Uf>nW}(EfF3|0VJ4?)GbfCyfnHcxAkUok=)* zSCeb$;-K~MO%=BWe!JW2==?~Tzef^o1`G8y^D-DHeWttrYPU?_^>grENRwm(ufWXs zAdbiG4^|pItVv=}nT4IGyLhh*jHn0qYvQ8e*oN>(BNL=31#~|X?b)0tvu2dpJeaOX zh(n{0M@SKQmzLHx3H6NL=Pfa3+GV*UV7AN;h1vO_ac((n8e409>FE(u3NDK%I{H%R z*NSg!sbQw4^PNcuci0sm3)IPh*Rd16`j4j5rlekN`|Y#p`?O5Q+L2L_P%AV>CaJz- z97CH7Xy%~+{|{e_+K2ft81X8YX2Uu=uzbN9DFjDiz9zOIoLv%G-Fr?*!F~kuV&jj) zpr_YvbaKvY_4;jmh5QD%Yc=iKj!|^?IgN%aDEm`aCe6g zoZvcm5`qPHcXtc!?(VL^-Q5|OU;zeq1|1xN+vR=FIbVI}++%fr+}c%7b*-7I*?Uj- zTHR0gT91_tCW%cbHgmvoTMJ7+GX4O|l50-v9=AhnN+e%T>atr-#@93I&caUWZcnGB z=Eu0~uzDJXL~u0!!Ci%R>QOm*RkRr$Vth&xCU&*_{QfT`%w(>i@mQV2V)e%g9)RCK zO{y)$FBx~%%|CNbrJU4xcNQL8>FNC^qs9phiy6ux8ObTCiR)tw5!bUgDtVp#LQnMf znTO;k?BK8S)ln0JXvUS6Oy$hA5sVg~^1MT>az4UNJgpI)yN8}m-i<+xZ#wisu15=* zcBG4Suy6hAR@R;8SK6w@W4V%U{&42EH#=VQ2_h)Euo(?kYzB1lHL!Q#Y_fc&X5!h# zGyW}kUUu(hz#Zu?5-=W=%E|PJnnO3=PP*z73nN|47uGi&KX<5SO`;dG|)%AyiBM?0k^E~YOFQ46=d<#y{s zKqS0wy7D#&ji%ZBpvBnvv531)>@7FM5LRM*7xk$=>DEVhrf)3G>wN^|ln@GTG%U(*RfVLk_ z<59hM)k}Y>M}vKLoBs)8nME1>xe!xWn4L_m@s3J&a__sIj0|&B(R>sP6{h1!tPgQ0 zptIR8=t`tb(b-wYhksQ?WnuV?+NK_!i35f29gjBvDzA;M)$#D<-r-=~4{i3Yr#FTT zFQ*I1sk%P_5dMaGS!`oC(Atl8I&q+tQkIpWUQA*!aA*n_)M#q=%~B{aidNE0_{a5Y zd7&d&0axd862tm|BsUIX}*?r`P6q95|XY@$vE8g{C$#@pFuQ*A1N*;PR?Sf@-Tl zNy#bB5;SUY?yf3%SLd!7Tuo8Zd~Pqf&c?aD#mIqQ@zLp5CC`@=d){Bz&EU)G3x3;{ zIuwH^Jq7-_%swuXIb>8Mb)6n>@ekcvE^U({v7b-uwpR;JwBF|waP+;a+dvInV?#?K z*}2_&4!Y0hs1du;FFU*)Ek&k!Y1hj?8Ye|=MO<>TPMJ5wrB-&m@ukTQdV>+fnHt{r0&BfR>6r0M>8BKXs)?us%E&iFh4`BsH4L%-p&`JS`A zd#Fh`W6osQghtI2caOamN6PZtP;O}D!^(SRKf&nWX01KoL_Vl1ifumR|j5m0KArvlLiBkH!=XBT3}Z%2&sGQZ`PlOi)UU* z>G(;dCb7BRp-iLZU&^vQ3iGEU?ypt@ql*V3Sab<`=MZY1C)FkQhmDQ!D~=6Hg)@v6 z)7}Kr60Z@2^dIskp#45=>|P$;2tI4@%3K#S`|~l#=d)tqI*F%62cfXO5Ii1uPYs!38ch(^ikJyWl*w;h{+Shz=GL3-UZ5oiS*|F@hsY$wCep>+A;Cg7_j#$& zrsat1Q?a)XH)J5Y+VaUsJA}fakg&d(dMefVS#8A`rI>#7^aSP^{i{B;K%?Vbcp7t7 zjk9M~m1pD>;(>^%3)xu^WGZ1;$k)^^u@Xbk2u<^G$)Qot&(;Fb zxic)tx@T5fJaD_pyR`ILIA6ZxPw;y&2+!q*WOXGgP&x|mGK#tD^z|{|ctNdo;Zc!2 zh4|@}@AKC8ei0`eLJaE@lw64eP5ve>%fjryDjN zbq;$|KJqf|INe&`sbh;L=BKCUk9}W!x;|kXBVg}jbifv59##ODNkIgV_EHn5;bGWSqhex$L)MUZs z%H`%aw@6~$&+bB+j*l%E&aQe!qX#!~@DIVX6_iG4wRAeV_Bpe~T_EeAugWN-v}F-lHHMKP65^0^}4)*Gf4;ns) zrPqB`-DyK79vW~i`kkp4MFHEBjp-(0`$yIT;q1t;WHIP*{8sluc7>qJK#usa7HzLHo6aOTHETk`LaBWm0lm za+z312(ZWW6)0hVh`LEnd7CA#pr5`pdvLASPUbBH5oql}aW&7`n zzjLy2{k!7tOu=Vl-E zg&7{zvyirN^Y<3-Zzn9^(~SrL5ok=Lf2M6q6Nu4ojJ*#dIZRK}`zp9!OY&xCi;d3F zX5rXF`}5qwBS>RV_=yA+1g z2~y|IgD%Ne!a}5wnjB-9p|%PB)=pz-Ck@8H+|J>5NKqI02r&bF>ZIErw?15MqU0K7 z$Nt8dBuzy5noZ6(**!7L8S*8HE=UM8MCy80FzDAF=NG8chP*{gi;MtkTSTT1;a_;< zq?1HIDW)Irsuu}wB=Gz}Gt9Mo{z6}oMx!hdQw?gL8lfK3qmQ`-OY`R}JdQFFA2Tm2 zivSNpe!@@`=a({;C?nUEp(rB(YKDYy2!A`2H#l4Z)efg z99C2`cr{jpIx?8_`ylf;=`CHa2O_dv@vdkvt& z0lAAkLl>7>ER`66^jsZ-;T=wc@dY*kuiF;XuvY$W>i+6k_Thwj+d;`34<5U6w8M_7 zPm0vrAq}G!)~tpO+_mMa@1Qmq)^RA9Y9No~f@P$4G*|7^t9+{-t8lAgt2C>sod&BK zZF^M{Th3-X-9+rtWZBu{HO!gvhQq}#9BtVY;VxIc8dp8lVfPB}jF-gxreDu%^ai|9 zl7wKwW1gb9jDN8`$kS1yo&8zG99=WfRt0y58c1T}AJ!of#Q#kKs;3ipDRt9c`4C~7 zJgK|qvD2U?8f^Cy8R^A z`sTpTQt%u2v2>k&`X^$S7+-mtg@%UX)K45i)gSbtsfvF=!PNwknyE8tEYQO0j;WD8 zt&@<}F%ocIO2l!B)?EgaQMWtjDcIC28v}YI-%O0uteh&V@yU$KzU4L}~h=tYR z%Q}fX+St`?#f)2IvuUNkZ(L&7J*5cvxSItZwUvV+BkUD0nHl=2>2(!5i`*p7r`3H@ z2KiYSbVlX6MLL_T=;BWlL7de17j+vu{Tsj!OmL!+U#1M@8wrwBQMj|GzW1kbtc0j1 ztBR^-ZQ^}bj}R-}SBxYooK{wzi2UWQz{|q0C%V&FnuVWyS>UMqYFvxK=^~~Vn6t;7 z;Ae^8A!cqVeAkiOQB?rj*4V$am5+*G)!e|qUh(nYfz@rBnt-B!2~0&Pd$bDQnosT~ z_u#8i=X6`J3JtEs*6B94omY zpT(#*d}--Za3HuvxFNV^8WkFp5x5DsHMkJze_Tf>i-h$Y#%3cEaoH67A}%3+8+eTE zM%LoGC_F{3Lyk}viR=F|^u+~Iz>A=Tkf87qII?c*|7{Q#i3uS=sOQfI`k^L6~_qO%OVq61-naG3#C-22veRX+P0*QM=b;~Wchgm~; zn#xcmgQ*HzMTCZmb=OdehIRVTo5g>=NJc`&LaYP6EQ#rV=C0YJ0})1DTHagDpEl`jUF>|OvLSgICiHSC7smf9_}6z3Vr?On(ro1EBv;-g_^zIRdhNq%bliyIkOb7xOt^>t0e0?)oCdxDk~lDYDO}7>>G;S$-Sht5 z(_qNgk&VAILr>rq@NkP+^$Rlt`#||!Gv;ytGt!fa?Cr#{`qNsAL&hehlY{Mr2V+Z{ z#`W?YAD;9bS;5441k>K0ivVd=7Ug>Em4~I)@{9e&^)~cJv5WZF=nAW&_C&JN_^zK3 zdF&q#1smaV7YuLfYp}bGpfkBZ2QG_8lgTVPc%qNM!2{s#%_jWp$l1|)GkktZyEjZO z{4(|AF_~ZSm2&3AwkMxZGs4%r=w?Aa0aC_x8g^!-r9V)bFadiE-phTQ(% zK6l|@g}_)7BpA3!hX`c!KG-6AqOV8*GWZ~;h)*b=bGDFRI=N-o(DQKYfB8+Py2n3_ojOW4vyq$9Z>k-hE_~y1IYs4?1fQ?+hzp?E<3Hpq0AX6KDM@ z(hVZ^1addq1l?fb)1DWSogCLO1)e_P?4lqbXpaV>uQX%%rUguHaIhkU&F+<@VZ3?+ z&%Axfl>h>oMmXu94^-~ld_iLsn>9EHux|rU;0I~t--TlME|5F~wAC?B6(;tZ`GNhY z1hs?DZpqdSd{<+g(rZoJFE|DNqLKWzaDksXUTHC>gzg6A&1*xtL<$6 zz+A2sPIsZM`zKz!5Ai!y4{H$}3M>gxG2KI77F|X!la^o_Ui_Hk8fQX_fB9i#r-8EX zuG9klYcUf)WUF_;x0-$!E?m<3mCD0mJ_?-g>9sYswT+8GPgXzKwzDZUvW%x0;Z7GlSz*qYD>2gnk=h zepu@hEYBEX!Mi=gI@bjwVdaTc^|8_?WW|oZF{|H~? znJGRRoLJ$4&V1XBD%70((_@X5k*}!4oQ&44+pD$Q8G6_4l?r2faeL;d8r$u4exG`C z+U=>tKg|k(=Jo)-cDI;nSMso(Kwy1-d$3T?wH8goU%cQ+#T~<5zuSRgypt*Klcu-PyvP z-M;p2LUl8$_npp4G_lOF@4x$OWQ^F})$i$Kbo#5jK<(lE6TF@Wj<#p)_ztH|bJuc7 z^q$~69wM&QJ$eMEiUdJ;w5}{D)iODSNx39~d=EeP4(~xTGXrvp#}1wF_iCJ~=)d1( zjkB1cd))2aqqp{n!~J{cmA9i28o<6JJ8wNl6+s!5uvs#!8m6K{>^mE>#n9~>&lzrfb_HKD4eHu4{nkf zF{uW-bS2<3kG2s$+72e#(6ZD1U0=4BB-ZztY<2%5@?lW-BZoQ5N)yVJeT)Y zCm}>zSd1vWVFP7PWwUJ3;TkG;Bb&pacyO90X!SCu?o>z_O>-4|{IiIM=BL*0-QtR) zs^2E~NCyLR&PY4UR#S)g!U8@w#@W9hqzYr}@?im1NA&BuVch%$T-3iTRKnGh5L{~~ zAYxz1>{j!sk(#KNXvDQvJB%^(W(vUT0m@o6wb+qIKS5kX$;+Rn8hptG+@A~smm-6o zbB!f@TRhgED+cxA@|}OJl!~+>uU4SrW_P~4A^q-ZUDy&i<)T;3pm1^cJ;`=P;#Enu z%7pF#^W8Zq!k>%W8uT^an^#}!!(H-BtXg;2XhGD?(rNJ||BJtlcCX$z)=73T(Jfej z-He{+*OD07-HY)RoU{)#Zuk#m3{+SY?_0NbT(r2=!}Y5O_18+V^O~c-7Iug@0=D$o zGdzqOcG7>sOaQq5sqV?&%!In4i7AWZH!T4Z6JAqOR$fz9BSRx2LoNeO04KX4Cyx;i zJHVLDnAcS3fBuFJi=v&~52U~J^AuSmZB6Yy{H1%R$f9K7Ve)|;z{AR-rp5Mw;{&_S ze^(NPl>_k4=a{&bUFB80eTL5;I#A^?=nKLOzx2i64!z^XKsFQ?9SkTaEe*rP?f8ht zsE$FbI=CiZ_oi!oNIQtP z2^@{D!h3BcHfJg-bAmR5?ej|YolwO z$Mh$^6!QrDY{WNqaRVjg9q<-B z^U4}!uLBx))sDIv-lYJI)fS65Bw0uI3}e`&m>1`m8=KjS&C6uk6M~2uuCipdB>JNk zUwXI?#IS6~%5XAYQvo=4rx`K_6B{>)@i)I3L46Fgu+44Eq(#&+|9lAN-o3QW{6iJa zwyPFtGaWhD;@f>_lDJ0IEqE5X%XAKVe03wo6`aUB=`e0(yS8CsqU{irH4_n{IDGo98w0CjZjmd%*6d z*H|BHS|oDx%2WzIp_;K1d3}l(#TB2nop$#8;+&x- zzLH%p)=F5WJ%?>y6>!!p{^^KYs6tOIV%Z_ofx4x6^vF1U2gvp8nVA${nYR|);edWJ z%K{6fMPCB(4Jtl?p-W_+Qj#cZG{wV5pR@OVzn<$EXtA<*PwrNeh7m_ zH`2sKnIY84jjZB4z#(~dk=j|DnXNhko4ZY-eyX+nd6gzrqA`?(cz&m+=?>TNc(Ov> zO563>SgU3Vx;!bzVdI!xG}gL?(gH%oI$q9n8*S}=OttBfIn;&R&-N@7#eDO8h;i_q zfAl;Ap)0Hpc>=E=Nwdup zOQ>k0I+leOw+TV?5VGH^G?S7)eh{6(b`Pp8gw>p*b`QDUk_m5!KL+L2A@=0i;cQCZ zton9=PM?gz4{)Dt&Zt9d0OH4-Ct1|ouJO4%CjqwH4vAoboBJK^^EmB-Ya-VJl1%tG zJ+_l46>dbTvY%-Ecnes8(H-@3%!K_3^U)8FJ&Q%SAXG^A)F@3pRZE$c5kZJiki+_9 zvy@o9akc|b(ozvBNC)!FI!~iObrbcFddF=cbrIK|?eNmRv^%vO8}*>)WIdg;9q#b* zdx(aOYO<8y5I$;1c7d=%UoC3Dc7YTU{ZLZll1*g6Ne~NZkl~zmGZ5%==bn;){5=0A z*bpv8WEVwyGWnN*)S3J!@`-iI4J&ksnk(W~UjPKLE>IX0hY} z`yRUBT-+dAb53I22zsCJ8N$o|i-wSjPnecy@|ci2_ZykD087h)F}q~g`J-cy3};Wi z6FYW;J%jAP0RYBq%R0+MV7;pGFnz$|hmaXWJ1g{(4IW>gnR!q^J4ni&Z5N^lxf>vQ zU>dzmp@aVA(;Z;{#ivK@_4w9X(HWv1m;Re`=P^XI?H_N2Z84;`9XJMFI$bVy2ik?_ zul)zl4qP^j*IA~RE4FG_aT}Oieq?Q{9!C-g5I-j%8~!ffPaDm1oqJ3qTL-5zRZ@pE zxuKyf=lR;(-{}q#bw)weYPN8dU))h^i0%5FAG&yMb+3qd&hg4aD+l=1V{guw*Tk=! z(a$i2`i5_Dav>a$V?E=Z7XMS3JRg6Sb6oB%E3ZI1g{Mh)uUPVP4xg`A4DDv#Y-<)- zh}ApK4{F{y-abb%hQGs^e-sY8?NKkwxodQ@IKP22#AxnKA&8<_KoY6r3NZkP=~FfL z(Lr<``+SVFy6c3U|JC!?QUVQWkD_!~(K-xyj$+P%TI!ZPpZrgWBvuF9czoC$-!&;q2Z-fr23s5zRgwyBSayJubrXPnI>N|)PNmr7!!acZh%z0Wlj=k()BLd=uw;SsY2iw2$R(RUvivz5@Fsw~Y0*v&WD~hABfp15#F!mqN{vKrZbZ7&{Br%lsR5ATH(nC`KxZy1T!(bPTbC|i?MtBcBuL1YTygkGv$t!BRUzio?Lg-&ed_K#E%%VW8f*^)r?*4yCAYk>ZvcMY*(Aw&Xap(h^#!>jDC|CWI(K3-)KEnquUMG#}4lAiPXP+b|L*xGK z5c3*@S~=`lI#&pmt9z@rNvs*W=}<}a;+L!b!f}BO&aOjt5xHuoE%Vf8dG!bp?c_9D zAG~A_Eh;~z$8gB29TGyVvtp578yZm2R)X1=tU{mQhg!__X%Dgr$u)>LxXH`^9{GVA zyQAQQo(n8kiw<3Li1&Dd)=vfY-o(8H)40iaL)p!5k5o-HRamlN2F+82+ySD_i2I*6=Wjtwa{{4O;zntq;JyVSO8NN< zN+>~;Xfzv{lIy_xIo?#wn-$vIBr0UHf|HWTQm5BhcK%87WZ7k%AJ=5znv@kx(|sJ0 zKm@JDY@KI#y9n2`X0VyU-klW`*$q*OcYsUQO{Bmx^qyqZd#xTFKf%j%nWPl6@C4^n z@`r7!0tAQ-_OGNsPtB_yj|Gn^+}x;a=axp=lP)Wbd2r(0N6Bn^*OFU~T?fCuCDTk- zrJCZaPtKT@U1P#P*@RIy*qVfn+v+C*e}#n@RUT*0 zBR^6Hk}5Ljd0Nct+3}*;*8wfzgP^v>aPh%1T6(VVtb|N~lf_3O&3-mWYK+ z(HvbDs+fVN=0o8`wg0ve8!2tPm33S&hXXlTfir6p(3$p}t#^HgqbhHpuT73NnFNF)m|JwI9sn}hif;Ek}* zO1OeO-mjN>R@^r#Lz~p2UV}pw)C?GBj>C!OY-?pVY@`QPAoyO9G6wwFiZwq~u4_eU zD-s=fGL!L_%baZx9N@VP_WF3`bq)GV;%{V;{f+6$m?zMS{Yn-*(}xHqta#=~{AM%) z+nVOZ&;&$pS8SAKs^XjBysi+pdEuNZKCHmM{zBSuP-Iid2UC z$JzB-+sTb!s(4%9I4v@)mT{G9NOZ^Xks~_@TB5{>d!usgddXIoB)sX?kxTXPA^%np zlMNJY4*(j_-zi!Owxt%Hd}v4BOZ3`IZT}rvWj^Z@*3X$0#8*68=l88}{J1sJ3)Yzz zO86RD3Z1F1>|gI7NBrU2XV)A?l*t(f6N5t(42y@~`tJ(vPV!1eZhL zLC(Rd1*XI(mYpq$d|3Q>VkIVEYzHDJ(aM*KiIi0;MGj4(7xV5N&gHBqqK2}U6)8bP zDfx%*R%_y2$X4e>(34Jb^t|25lR}_u-8K=e6*mnUw*1YyBQza=-V$&1Sj=16<>sfS zAYlbdMxha%ak%`sdXGK2v|=IWuC!sFz!|oDF73DEp@St0oRJlHs_Yxn`XDZ60$-Rm zWe_`9Df!FQ&yv#Fhw%aJiy3fmY02%wZIEiVotcDgZIhG(Y+FtgXG3}Vbdy_>>UjH) zVHEHRm{W67Y4WR}e@gy@;_3mjKB{GqOZHXnmz~s7mZ@^Hbor>FEA}R!Cw(bfpqPgd z8!EDVkCb2=(7&BwKCf9^{2J?FQJ>YPK;_a6ip`yPC_N{5!@V{HU;0#esc{ntXFb@m zeV>%m(c{R-iQk^6Ixc`N7QHSOZ`EzW8S}c7m9`SJbP;v+T^()!U3t}IezTlVk~8BI ziOHWJzuI0B&ai6>XezBstey+KMc_)s@?%nfKxx673wXD~Ki+*$OfUL56`hZK)@rg<@|{80MR^GRi}pbmt2ynVmAsw3*P$Kj`L$ubVCHu@B- z1wzwjVJc#02}^Ud)wY;ArL3?mS1Nc@;BN_X^9SBHK9chfUtkd{^!)f(K0lo^HLDXX zdjVUjVKUxjb+Q!PPHZVqrtuWKO(qa5a+_rOq8ewO(?fk_abY}H$gl9GshU6AlSskJ z3Wg2ANki;rtDEZeUd08ICW|5FSXXN8?anVAVbHr&r9*nHhM6HMiqbZGLC7I}%_ny{ zODf*if0qqvr+c57ab2F1_9Mp}?^BfB)Qkz5l;zqfbJbrY7h{!IZn2#h@ymhllk(M2X#(3U8}cP=~W!+36-zXSA~${NXvXrS6lEP;Y3ZxLg3= zryqL1bv~7X#!!`WPN;Z(!<3n+N4lfEd=nRc!ADSV@)*|5~3MMNKV`8P&qL45}Xmd8{`e zy9@!2LRQ(x;Pw9lA2{$2J}@l;1RxRLkRS=B2O$2<2YOJt{euwXaQKT51TW`l08mRH zC|R)$_S_SF)>)C4tmsbmZ+Ex8YKKSKvoZh8t=RM8Z6K}q1-BxpL5LXpn_AK4jo565 z{*5ltX+@QC;6LfjRu6%<=Q-)?YDK?+Cwb!IJec2!ssRVaaVs3Ivy&zsu=s za6_9k;+osw>I_RgW7qAgP>)1)Bel!(sO5J}(t$ZH(KSBX( zQRdN@r9Ak5)(Y0X{q9Kd&{MPnK#wK5#!Fh@{^0pN59rwuU5j+Vyz2J+dDda4*_4nL zeNyZ?O^Lx)u$w-}=6|h!hH~|su@*A(V0-Dn4E1g#85{BfYgtIye}baczhmtGsvS)% zZx>ND%+!jgX9NrNu2x(L>^OUKGBDtV!Ls21URHn29LoV(f<09{miO7AHuPPGKXC1~ zNIQe0OIzZ|3fF|EAHH}b?&Iz)5P&;)PtTcr`fF~}O|oceJ-eRd4kS=M^E3~Bunxu~ zh%hL9A&(L3f~k11j2XIKcnhh;ey!-RfC_QoydKb9fQL8ui1xXQn4KVz756G+1cAil zT?F)TexlvTCvxB^g|&b2mdA%@{(kjBs{@{$ZT$VM-uWf(^6m`l>U;3Z#^h=7k{69E z>svjw+sm40?s-o_LYj@xiRVY*7sE?;z|{N4w1Y|CPQy!B0O)L*$)5! diff --git a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.cdx.json b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.cdx.json deleted file mode 100644 index 1759b3cccb..0000000000 --- a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.cdx.json +++ /dev/null @@ -1,3057 +0,0 @@ -{ - "bomFormat": "CycloneDX", - "specVersion": "1.6", - "serialNumber": "urn:uuid:17e021df-35e4-4aee-a22b-3919fd43ab3f", - "version": 1, - "metadata": { - "timestamp": "2025-10-19T11:10:02+00:00", - "licenses": [ - { - "license": { - "id": "CC-BY-SA-4.0", - "url": "https://creativecommons.org/licenses/by-sa/4.0/legalcode.txt" - } - } - ], - "supplier": { - "name": "OWASP Foundation", - "url": [ - "https://owasp.org" - ] - } - }, - "declarations": { - "standards": [ - { - "bom-ref": "ASVS-5.0.0", - "name": "Application Security Verification Standard (ASVS)", - "version": "5.0.0", - "description": "The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.", - "owner": "Application Security Verification Standard Project", - "requirements": [ - { - "bom-ref": "V1", - "identifier": "V1", - "title": "Encodage et nettoyage" - }, - { - "bom-ref": "V1.1", - "identifier": "V1.1", - "title": "Architecture d'encodage et de nettoyage", - "parent": "V1" - }, - { - "bom-ref": "V1.1.1", - "identifier": "V1.1.1", - "text": "Vérifiez que l'entrée est décodée ou non échappée vers une forme canonique une seule fois, elle n'est décodée que lorsque des données codées sous cette forme sont attendues, et que cela est fait avant de traiter davantage l'entrée, par exemple, elle n'est pas effectuée après la validation ou la désinfection de l'entrée.", - "parent": "V1.1" - }, - { - "bom-ref": "V1.1.2", - "identifier": "V1.1.2", - "text": "Vérifiez que l'application effectue l'encodage et l'échappement de sortie soit comme étape finale avant d'être utilisée par l'interpréteur pour lequel elle est destinée, soit par l'interpréteur lui-même.", - "parent": "V1.1" - }, - { - "bom-ref": "V1.2", - "identifier": "V1.2", - "title": "Prévention des injections", - "parent": "V1" - }, - { - "bom-ref": "V1.2.1", - "identifier": "V1.2.1", - "text": "Vérifiez que l'encodage de sortie d'une réponse HTTP, d'un document HTML ou d'un document XML est pertinent pour le contexte requis, comme l'encodage des caractères pertinents pour les éléments HTML, les attributs HTML, les commentaires HTML, les CSS ou les champs d'en-tête HTTP, pour éviter de modifier la structure du message ou du document.", - "parent": "V1.2" - }, - { - "bom-ref": "V1.2.2", - "identifier": "V1.2.2", - "text": "Vérifiez que, lors de la création dynamique d'URL, les données non fiables sont encodées en fonction de leur contexte (par exemple, encodage d'URL ou encodage base64url pour les paramètres de requête ou de chemin). Assurez-vous que seuls les schémas d'URL sûrs sont autorisés (par exemple, interdire javascript: ou data:).", - "parent": "V1.2" - }, - { - "bom-ref": "V1.2.3", - "identifier": "V1.2.3", - "text": "Vérifiez que l'encodage ou l'échappement de sortie est utilisé lors de la création dynamique de contenu JavaScript (y compris JSON), pour éviter de modifier la structure du message ou du document (pour éviter l'injection JavaScript et JSON).", - "parent": "V1.2" - }, - { - "bom-ref": "V1.2.4", - "identifier": "V1.2.4", - "text": "Vérifiez que la sélection de données ou les requêtes de base de données (par exemple, SQL, HQL, NoSQL, Cypher) utilisent des requêtes paramétrées, des ORM, des Framework d'entités ou sont protégées contre les injections SQL et autres attaques par injection de base de données. Ceci est également pertinent lors de l'écriture de procédures stockées.", - "parent": "V1.2" - }, - { - "bom-ref": "V1.2.5", - "identifier": "V1.2.5", - "text": "Vérifiez que l’application protège contre l’injection de commandes du système d’exploitation et que les appels du système d’exploitation utilisent des requêtes du système d’exploitation paramétrées ou utilisent un encodage de sortie de ligne de commande contextuelle.", - "parent": "V1.2" - }, - { - "bom-ref": "V1.2.6", - "identifier": "V1.2.6", - "text": "Vérifiez que l’application protège contre les vulnérabilités d’injection LDAP ou que des contrôles de sécurité spécifiques pour empêcher l’injection LDAP ont été mis en œuvre.", - "parent": "V1.2" - }, - { - "bom-ref": "V1.2.7", - "identifier": "V1.2.7", - "text": "Vérifiez que l’application est protégée contre les attaques par injection XPath en utilisant la paramétrisation des requêtes ou des requêtes précompilées.", - "parent": "V1.2" - }, - { - "bom-ref": "V1.2.8", - "identifier": "V1.2.8", - "text": "Vérifiez que les processeurs LaTeX sont configurés de manière sécurisée (par exemple, en n'utilisant pas l'indicateur « --shell-escape ») et qu'une liste d’autorisations de commandes est utilisée pour empêcher les attaques par injection LaTeX.", - "parent": "V1.2" - }, - { - "bom-ref": "V1.2.9", - "identifier": "V1.2.9", - "text": "Vérifiez que l'application échappe les caractères spéciaux dans les expressions régulières (généralement à l'aide d'une barre oblique inverse) pour éviter qu'ils ne soient mal interprétés comme des métacaractères.", - "parent": "V1.2" - }, - { - "bom-ref": "V1.2.10", - "identifier": "V1.2.10", - "text": "Vérifiez que l'application est protégée contre les injections CSV et injections de formules. L'application doit respecter les règles d'échappement définies dans les sections 2.6 et 2.7 de la RFC 4180 lors de l'export de contenu CSV. De plus, lors de l'export au format CSV ou vers d'autres formats de tableur (tels que XLS, XLSX ou ODF), les caractères spéciaux (notamment « = », « + », « - », « @ », « \\t » (tabulation) et « \\0 » (caractère null)) doivent être protégés par une apostrophe s'ils apparaissent en premier dans une valeur de champ.", - "parent": "V1.2" - }, - { - "bom-ref": "V1.3", - "identifier": "V1.3", - "title": "Nettoyage", - "parent": "V1" - }, - { - "bom-ref": "V1.3.1", - "identifier": "V1.3.1", - "text": "Vérifiez que toutes les entrées HTML non fiables provenant d'éditeurs WYSIWYG ou similaires sont nettoyées à l'aide d'une bibliothèque ou d'une fonctionnalité de Framework de nettoyage HTML bien connue et sécurisée.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.2", - "identifier": "V1.3.2", - "text": "Vérifiez que l'application évite d'utiliser eval() ou d'autres fonctionnalités d'exécution de code dynamique telles que Spring Expression Language (SpEL). En l'absence d'alternative, toute saisie utilisateur incluse doit être nettoyée avant d'être exécutée.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.3", - "identifier": "V1.3.3", - "text": "Vérifiez que les données transmises à un contexte potentiellement dangereux sont préalablement nettoyées pour appliquer des mesures de sécurité, telles qu'autoriser uniquement des caractères sûrs pour ce contexte et raccourcir des entrées trop longues.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.4", - "identifier": "V1.3.4", - "text": "Vérifiez que le contenu Scalable Vector Graphics (SVG) scriptable fourni par l'utilisateur est validé ou nettoyé pour contenir uniquement des balises et des attributs (tels que des graphiques de dessin) qui sont sûrs pour l'application, par exemple, ne contiennent pas de scripts et d'objets étrangers.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.5", - "identifier": "V1.3.5", - "text": "Vérifiez que l'application nettoie ou désactive le contenu du langage de modèle d'expression ou de script fourni par l'utilisateur, tel que les feuilles de style CSS, le Markdown ou XSL, BBCode ou similaire.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.6", - "identifier": "V1.3.6", - "text": "Vérifiez que l'application protège contre les attaques de falsification de requête côté serveur (SSRF), en validant les données non fiables par rapport à une liste d'autorisation de protocoles, de domaines, de chemins et de ports et en nettoyant les caractères potentiellement dangereux avant d'utiliser les données pour appeler un autre service.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.7", - "identifier": "V1.3.7", - "text": "Vérifiez que l'application se protège contre les attaques par injection de modèles en interdisant la création de modèles basés sur des entrées non fiables. En l'absence d'alternative, toute entrée non fiable incluse dynamiquement lors de la création du modèle doit être nettoyée ou rigoureusement validée.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.8", - "identifier": "V1.3.8", - "text": "Vérifiez que l’application nettoie correctement les entrées non fiables avant utilisation dans les requêtes Java Naming and Directory Interface (JNDI) et que JNDI est configuré de manière sécurisée pour empêcher les attaques par injection JNDI.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.9", - "identifier": "V1.3.9", - "text": "Vérifiez que l’application nettoie le contenu avant qu’il ne soit envoyé à memcache pour éviter les attaques par injection.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.10", - "identifier": "V1.3.10", - "text": "Vérifiez que les chaînes de format susceptibles d'être résolues de manière inattendue ou malveillante lors de leur utilisation sont nettoyées avant d'être traitées.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.11", - "identifier": "V1.3.11", - "text": "Vérifiez que l'application nettoie les entrées utilisateur avant de les transmettre aux systèmes de messagerie pour se protéger contre l'injection SMTP ou IMAP.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.12", - "identifier": "V1.3.12", - "text": "Vérifiez que les expressions régulières sont exemptes d'éléments provoquant \"backtracking\" exponentiel et assurez-vous que les entrées non fiables sont nettoyées pour atténuer les attaques ReDoS ou Runaway Regex.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.4", - "identifier": "V1.4", - "title": "Mémoire, chaine de caractères et code à mémoire non-managée", - "parent": "V1" - }, - { - "bom-ref": "V1.4.1", - "identifier": "V1.4.1", - "text": "Vérifiez que l'application utilise des chaînes memory-safe, une copie de mémoire et une arithmétique de pointeur renforcée pour détecter ou empêcher les débordements de pile, de tampon ou de tas.", - "parent": "V1.4" - }, - { - "bom-ref": "V1.4.2", - "identifier": "V1.4.2", - "text": "Vérifiez que les techniques de validation du signe, de la plage et de l’entrée sont utilisées pour éviter les dépassements d’entiers.", - "parent": "V1.4" - }, - { - "bom-ref": "V1.4.3", - "identifier": "V1.4.3", - "text": "Vérifiez que la mémoire et les ressources allouées dynamiquement sont libérées et que les références ou les pointeurs vers la mémoire libérée sont supprimés ou définis à null pour éviter les \"dangling pointer\" et les vulnérabilités d'utilisation après libération.", - "parent": "V1.4" - }, - { - "bom-ref": "V1.5", - "identifier": "V1.5", - "title": "Désérialisation sécurisée", - "parent": "V1" - }, - { - "bom-ref": "V1.5.1", - "identifier": "V1.5.1", - "text": "Vérifiez que l'application configure les \"parser\" XML pour utiliser une configuration restrictive et que les fonctionnalités non sûres telles que la résolution d'entités externes sont désactivées pour empêcher les attaques XML eXternal Entity (XXE).", - "parent": "V1.5" - }, - { - "bom-ref": "V1.5.2", - "identifier": "V1.5.2", - "text": "Vérifiez que la désérialisation des données non fiables garantit une gestion sécurisée des entrées, par exemple en utilisant une liste d'autorisation de types d'objets ou en limitant les types d'objets définis par le client, afin d'empêcher les attaques par désérialisation. Les mécanismes de désérialisation explicitement définis comme non sécurisés ne doivent pas être utilisés avec des entrées non fiables.", - "parent": "V1.5" - }, - { - "bom-ref": "V1.5.3", - "identifier": "V1.5.3", - "text": "Vérifiez que les différents \"parser\" utilisés dans l'application pour le même type de données (par exemple, les \"parser\" JSON, les \"parser\" XML, les \"parser\" d'URL) effectuent l'analyse de manière cohérente et utilisent le même mécanisme d'encodage de caractères pour éviter des problèmes tels que les vulnérabilités d'interopérabilité JSON ou un comportement d'analyse d'URI ou de fichier différent exploité dans les attaques d'inclusion de fichiers à distance (RFI) ou de falsification de requête côté serveur (SSRF).", - "parent": "V1.5" - }, - { - "bom-ref": "V2", - "identifier": "V2", - "title": "Validation et logique métier" - }, - { - "bom-ref": "V2.1", - "identifier": "V2.1", - "title": "Validation et documentation de la logique métier", - "parent": "V2" - }, - { - "bom-ref": "V2.1.1", - "identifier": "V2.1.1", - "text": "Vérifiez que la documentation de l'application définit des règles de validation des entrées pour vérifier la validité des éléments de données par rapport à la structure attendue. Il peut s'agir de formats de données courants tels que des numéros de carte de crédit, des adresses e-mail ou des numéros de téléphone, ou d'un format de données interne.", - "parent": "V2.1" - }, - { - "bom-ref": "V2.1.2", - "identifier": "V2.1.2", - "text": "Vérifiez que la documentation de l'application définit comment valider la cohérence logique et contextuelle des éléments de données combinés, par exemple en vérifiant que la banlieue et le code postal correspondent.", - "parent": "V2.1" - }, - { - "bom-ref": "V2.1.3", - "identifier": "V2.1.3", - "text": "Vérifiez que les attentes en matière de limites et de validations de la logique métier sont documentées, y compris par utilisateur et globalement dans l'application.", - "parent": "V2.1" - }, - { - "bom-ref": "V2.2", - "identifier": "V2.2", - "title": "Validation des entrées", - "parent": "V2" - }, - { - "bom-ref": "V2.2.1", - "identifier": "V2.2.1", - "text": "Vérifier que les entrées sont validées afin de respecter les attentes métier ou fonctionnelles. Cette validation doit être basée sur une liste de valeurs, de modèles et de plages autorisées, ou sur la comparaison des entrées avec une structure attendue et des limites logiques selon des règles prédéfinies. Pour le niveau 1, cette validation peut se concentrer sur les entrées utilisées pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau 2, elle doit s'appliquer à toutes les entrées.", - "parent": "V2.2" - }, - { - "bom-ref": "V2.2.2", - "identifier": "V2.2.2", - "text": "Vérifiez que l'application est conçue pour appliquer la validation des entrées au niveau d'une couche de service de confiance. Bien que la validation côté client améliore l'ergonomie et doit être encouragée, elle ne doit pas être considérée comme un contrôle de sécurité.", - "parent": "V2.2" - }, - { - "bom-ref": "V2.2.3", - "identifier": "V2.2.3", - "text": "Vérifiez que l’application garantit que les combinaisons d’éléments de données associés sont raisonnables selon les règles prédéfinies.", - "parent": "V2.2" - }, - { - "bom-ref": "V2.3", - "identifier": "V2.3", - "title": "Sécurité de la logique métier", - "parent": "V2" - }, - { - "bom-ref": "V2.3.1", - "identifier": "V2.3.1", - "text": "Vérifiez que l’application traitera uniquement les flux de logique métier pour le même utilisateur dans l’ordre séquentiel attendu et sans sauter d’étapes.", - "parent": "V2.3" - }, - { - "bom-ref": "V2.3.2", - "identifier": "V2.3.2", - "text": "Vérifiez que les limites de la logique métier sont implémentées conformément à la documentation de l'application, afin d'éviter que des failles de la logique métier ne soient pas exploitées.", - "parent": "V2.3" - }, - { - "bom-ref": "V2.3.3", - "identifier": "V2.3.3", - "text": "Vérifiez que les transactions sont utilisées au niveau de la logique métier de telle sorte qu'une opération de logique métier réussisse dans son intégralité ou qu'elle soit restaurée à l'état correct précédent.", - "parent": "V2.3" - }, - { - "bom-ref": "V2.3.4", - "identifier": "V2.3.4", - "text": "Vérifiez que les mécanismes de verrouillage au niveau de la logique métier sont utilisés pour garantir que les ressources en quantité limitée (telles que les sièges de théâtre ou les créneaux de livraison) ne peuvent pas être réservées deux fois en manipulant la logique de l'application.", - "parent": "V2.3" - }, - { - "bom-ref": "V2.3.5", - "identifier": "V2.3.5", - "text": "Vérifiez que les flux logiques métier à forte valeur ajoutée nécessitent l'approbation de plusieurs utilisateurs afin d'éviter toute action non autorisée ou accidentelle. Cela peut inclure, sans s'y limiter, les transferts monétaires importants, les approbations de contrats, l'accès à des informations classifiées ou les contournements de sécurité dans le secteur manufacturier.", - "parent": "V2.3" - }, - { - "bom-ref": "V2.4", - "identifier": "V2.4", - "title": "Anti-automatisation", - "parent": "V2" - }, - { - "bom-ref": "V2.4.1", - "identifier": "V2.4.1", - "text": "Vérifiez que des contrôles anti-automatisation sont en place pour protéger contre les appels excessifs aux fonctions d'application qui pourraient conduire à l'exfiltration de données, à la création de données inutiles, à l'épuisement des quotas, aux violations de limites de débit, au déni de service ou à la surutilisation de ressources coûteuses.", - "parent": "V2.4" - }, - { - "bom-ref": "V2.4.2", - "identifier": "V2.4.2", - "text": "Vérifiez que les flux logiques métier nécessitent un timing humain réaliste, évitant ainsi des soumissions de transactions excessivement rapides.", - "parent": "V2.4" - }, - { - "bom-ref": "V3", - "identifier": "V3", - "title": "Sécurité du frontend Web" - }, - { - "bom-ref": "V3.1", - "identifier": "V3.1", - "title": "Documentation sur la sécurité du frontend Web", - "parent": "V3" - }, - { - "bom-ref": "V3.1.1", - "identifier": "V3.1.1", - "text": "Vérifiez que la documentation de l'application indique les fonctionnalités de sécurité attendues que les navigateurs utilisant l'application doivent prendre en charge (telles que HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) et autres mécanismes de sécurité HTTP pertinents). Elle doit également définir le comportement de l'application lorsque certaines de ces fonctionnalités ne sont pas disponibles (par exemple, avertir l'utilisateur ou bloquer l'accès).", - "parent": "V3.1" - }, - { - "bom-ref": "V3.2", - "identifier": "V3.2", - "title": "Interprétation non intentionnelle du contenu", - "parent": "V3" - }, - { - "bom-ref": "V3.2.1", - "identifier": "V3.2.1", - "text": "Vérifiez que des contrôles de sécurité sont en place pour empêcher les navigateurs d'afficher du contenu ou des fonctionnalités dans les réponses HTTP dans un contexte incorrect (par exemple, lorsqu'une API, un fichier téléchargé par l'utilisateur ou une autre ressource est demandée directement). Les contrôles possibles peuvent inclure : ne pas transmettre le contenu sauf si les champs d'en-tête de requête HTTP (tels que Sec-Fetch-\\*) indiquent qu'il s'agit du contexte correct, utiliser la directive sandbox du champ d'en-tête Content-Security-Policy ou utiliser le type de disposition de pièce jointe dans le champ d'en-tête Content-Disposition.", - "parent": "V3.2" - }, - { - "bom-ref": "V3.2.2", - "identifier": "V3.2.2", - "text": "Vérifiez que le contenu destiné à être affiché sous forme de texte, plutôt que rendu sous forme de HTML, est géré à l'aide de fonctions de rendu sécurisées (telles que createTextNode ou textContent) pour empêcher l'exécution involontaire de contenu tel que HTML ou JavaScript.", - "parent": "V3.2" - }, - { - "bom-ref": "V3.2.3", - "identifier": "V3.2.3", - "text": "Vérifiez que l'application évite l'écrasement du DOM lors de l'utilisation de JavaScript côté client en utilisant des déclarations de variables explicites, en effectuant une vérification de type stricte, en évitant de stocker des variables globales sur l'objet document et en implémentant l'isolation de l'espace de nommage.", - "parent": "V3.2" - }, - { - "bom-ref": "V3.3", - "identifier": "V3.3", - "title": "Configuration des cookies", - "parent": "V3" - }, - { - "bom-ref": "V3.3.1", - "identifier": "V3.3.1", - "text": "Vérifiez que les cookies ont l'attribut « Secure » ​​défini et si le préfixe « \\__Host- » n'est pas utilisé pour le nom du cookie, le préfixe « __Secure- » doit être utilisé pour le nom du cookie.", - "parent": "V3.3" - }, - { - "bom-ref": "V3.3.2", - "identifier": "V3.3.2", - "text": "Vérifiez que la valeur de l'attribut « SameSite » de chaque cookie est définie en fonction de l'objectif du cookie, afin de limiter l'exposition aux attaques de réparation de l'interface utilisateur et aux attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).", - "parent": "V3.3" - }, - { - "bom-ref": "V3.3.3", - "identifier": "V3.3.3", - "text": "Vérifiez que les cookies ont le préfixe « __Host- » pour le nom du cookie, sauf s'ils sont explicitement conçus pour être partagés avec d'autres hôtes.", - "parent": "V3.3" - }, - { - "bom-ref": "V3.3.4", - "identifier": "V3.3.4", - "text": "Vérifiez que si la valeur d'un cookie n'est pas censée être accessible aux scripts côté client (comme un jeton de session), le cookie doit avoir l'attribut « HttpOnly » défini et la même valeur (par exemple, un jeton de session) ne doit être transférée au client que via le champ d'en-tête « Set-Cookie ».", - "parent": "V3.3" - }, - { - "bom-ref": "V3.3.5", - "identifier": "V3.3.5", - "text": "Vérifiez que lorsque l'application écrit un cookie, la longueur combinée du nom et de la valeur du cookie ne dépasse pas 4 096 octets. Les cookies trop volumineux ne seront pas stockés par le navigateur et ne seront donc pas envoyés avec les requêtes, empêchant ainsi l'utilisateur d'utiliser les fonctionnalités de l'application qui reposent sur ce cookie.", - "parent": "V3.3" - }, - { - "bom-ref": "V3.4", - "identifier": "V3.4", - "title": "En-têtes du mécanisme de sécurité du navigateur", - "parent": "V3" - }, - { - "bom-ref": "V3.4.1", - "identifier": "V3.4.1", - "text": "Vérifiez qu'un champ d'en-tête Strict-Transport-Security est inclus dans toutes les réponses afin d'appliquer une politique HTTP Strict Transport Security (HSTS). Une durée maximale d'au moins un an doit être définie, et pour les niveaux L2 et supérieurs, la politique doit également s'appliquer à tous les sous-domaines.", - "parent": "V3.4" - }, - { - "bom-ref": "V3.4.2", - "identifier": "V3.4.2", - "text": "Vérifiez que le champ d'en-tête Access-Control-Allow-Origin du partage de ressources cross-origine (CORS) est une valeur fixe de l'application ou, si la valeur du champ d'en-tête de requête HTTP Origin est utilisée, qu'elle est validée par rapport à une liste d'origines approuvées. Si « Access-Control-Allow-Origin: * » doit être utilisé, vérifiez que la réponse ne contient aucune information sensible.", - "parent": "V3.4" - }, - { - "bom-ref": "V3.4.3", - "identifier": "V3.4.3", - "text": "Vérifiez que les réponses HTTP incluent un champ d'en-tête de réponse Content-Security-Policy qui définit des directives garantissant que le navigateur charge et exécute uniquement du contenu ou des ressources fiables, afin de limiter l'exécution de JavaScript malveillant. Au minimum, une politique globale doit être utilisée, incluant les directives object-src 'none' et base-uri 'none', et définissant soit une lliste d’autorisations, soit des valeurs nonces ou des hachages. Pour une application L3, une politique par réponse avec des valeurs nonces ou des hachages doit être définie.", - "parent": "V3.4" - }, - { - "bom-ref": "V3.4.4", - "identifier": "V3.4.4", - "text": "Vérifiez que toutes les réponses HTTP contiennent un champ d'en-tête « X-Content-Type-Options: nosniff ». Cela indique aux navigateurs de ne pas utiliser l'analyse de contenu ni la détection du type MIME pour la réponse donnée, et d'exiger que la valeur du champ d'en-tête « Content-Type » de la réponse corresponde à la ressource de destination. Par exemple, la réponse à une demande de style n'est acceptée que si le type de contenu de la réponse est « text/css ». Cela permet également au navigateur d'utiliser la fonctionnalité de blocage de lecture inter-origines (CORB).", - "parent": "V3.4" - }, - { - "bom-ref": "V3.4.5", - "identifier": "V3.4.5", - "text": "Vérifiez que l'application définit une politique de référencement afin d'empêcher la fuite de données techniquement sensibles vers des services tiers via le champ d'en-tête de requête HTTP « Referer ». Cela peut être effectué via le champ d'en-tête de réponse HTTP « Referrer-Policy » ou via les attributs d'élément HTML. Les données sensibles peuvent inclure le chemin d'accès et les données de requête dans l'URL, et pour les applications internes non publiques, le nom d'hôte.", - "parent": "V3.4" - }, - { - "bom-ref": "V3.4.6", - "identifier": "V3.4.6", - "text": "Vérifiez que l'application Web utilise la directive frame-ancestors du champ d'en-tête Content-Security-Policy pour chaque réponse HTTP afin de garantir qu'elle ne peut pas être intégrée par défaut et que l'intégration de ressources spécifiques n'est autorisée qu'en cas de nécessité. Notez que le champ d'en-tête X-Frame-Options, bien que pris en charge par les navigateurs, est obsolète et n'est pas forcément fiable.", - "parent": "V3.4" - }, - { - "bom-ref": "V3.4.7", - "identifier": "V3.4.7", - "text": "Vérifiez que le champ d’en-tête Content-Security-Policy spécifie un emplacement pour signaler les violations.", - "parent": "V3.4" - }, - { - "bom-ref": "V3.4.8", - "identifier": "V3.4.8", - "text": "Vérifiez que toutes les réponses HTTP qui lancent le rendu d'un document (comme les réponses de type text/html) incluent le champ d'en-tête 'Cross-Origin-Opener-Policy' avec la directive 'same-origin' ou s'ame-origin-allow-popups', selon les besoins. Cela empêche les attaques abusant de l'accès partagé aux objets Window, telles que le tabnabbing et le comptage d'images.", - "parent": "V3.4" - }, - { - "bom-ref": "V3.5", - "identifier": "V3.5", - "title": "Séparation de l'origine du navigateur", - "parent": "V3" - }, - { - "bom-ref": "V3.5.1", - "identifier": "V3.5.1", - "text": "Vérifiez que, si l'application ne s'appuie pas sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher les requêtes inter-origines non autorisées d'utiliser des fonctionnalités sensibles, ces requêtes sont validées afin de garantir leur origine. Cela peut se faire en utilisant et en validant des jetons anti-falsification ou en exigeant des champs d'en-tête HTTP supplémentaires qui ne sont pas des champs d'en-tête de requête CORS safelist. Ceci permet de se protéger contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).", - "parent": "V3.5" - }, - { - "bom-ref": "V3.5.2", - "identifier": "V3.5.2", - "text": "Vérifiez que, si l'application s'appuie sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher l'utilisation inter-origines non autorisée de fonctionnalités sensibles, il est impossible d'appeler la fonctionnalité avec une requête qui ne déclenche pas de requête de pré-vérification cross-origin CORS. Cela peut nécessiter de vérifier les valeurs des champs d'en-tête de requête 'Origin' et 'Content-Type' ou d'utiliser un champ d'en-tête supplémentaire qui n'est pas un champ d'en-tête de la liste de sécurité CORS.", - "parent": "V3.5" - }, - { - "bom-ref": "V3.5.3", - "identifier": "V3.5.3", - "text": "Vérifiez que les requêtes HTTP destinées aux fonctionnalités sensibles utilisent des méthodes HTTP appropriées, telles que POST, PUT, PATCH ou DELETE, et non des méthodes définies comme « sûres » par la spécification HTTP, telles que HEAD, OPTIONS ou GET. Une validation stricte des champs d'en-tête de requête Sec-Fetch-* peut également être utilisée pour garantir que la requête ne provient pas d'un appel inter-origines inapproprié, d'une requête de navigation ou d'un chargement de ressources (comme une source d'image) inattendu.", - "parent": "V3.5" - }, - { - "bom-ref": "V3.5.4", - "identifier": "V3.5.4", - "text": "Vérifiez que des applications distinctes sont hébergées sur des noms d'hôte différents pour tirer parti des restrictions fournies par la politique de même origine, y compris la manière dont les documents ou scripts chargés par une origine peuvent interagir avec les ressources d'une autre origine et les restrictions basées sur le nom d'hôte sur les cookies.", - "parent": "V3.5" - }, - { - "bom-ref": "V3.5.5", - "identifier": "V3.5.5", - "text": "Vérifiez que les messages reçus par l'interface postMessage sont rejetés si l'origine du message n'est pas digne de confiance ou si la syntaxe du message n'est pas valide.", - "parent": "V3.5" - }, - { - "bom-ref": "V3.5.6", - "identifier": "V3.5.6", - "text": "Vérifiez que la fonctionnalité JSONP n'est activée nulle part dans l'application pour éviter les attaques Cross-Site Script Inclusion (XSSI).", - "parent": "V3.5" - }, - { - "bom-ref": "V3.5.7", - "identifier": "V3.5.7", - "text": "Vérifiez que les données nécessitant une autorisation ne sont pas incluses dans les réponses des ressources de script, comme les fichiers JavaScript, pour empêcher les attaques par inclusion de script intersite (XSSI).", - "parent": "V3.5" - }, - { - "bom-ref": "V3.5.8", - "identifier": "V3.5.8", - "text": "Vérifiez que les ressources authentifiées (telles que les images, les vidéos, les scripts et autres documents) peuvent être chargées ou intégrées pour le compte de l'utilisateur uniquement lorsque cela est prévu. Cela peut être réalisé en validant strictement les champs d'en-tête de requête HTTP Sec-Fetch-* afin de garantir que la requête ne provient pas d'un appel cross-origin inapproprié, ou en définissant un champ d'en-tête de réponse HTTP Cross-Origin-Resource-Policy restrictif pour indiquer au navigateur de bloquer le contenu renvoyé.", - "parent": "V3.5" - }, - { - "bom-ref": "V3.6", - "identifier": "V3.6", - "title": "Intégrité des ressources externes", - "parent": "V3" - }, - { - "bom-ref": "V3.6.1", - "identifier": "V3.6.1", - "text": "Vérifiez que les ressources côté client, telles que les bibliothèques JavaScript, les feuilles de style CSS ou les polices web, sont hébergées en externe (par exemple, sur un réseau de diffusion de contenu) uniquement si la ressource est statique et versionnée, et si l'intégrité des sous-ressources (SRI) est utilisée pour valider l'intégrité de la ressource. Si cela n'est pas possible, une décision de sécurité documentée doit justifier cette décision pour chaque ressource.", - "parent": "V3.6" - }, - { - "bom-ref": "V3.7", - "identifier": "V3.7", - "title": "Autres considérations sur la sécurité du navigateur", - "parent": "V3" - }, - { - "bom-ref": "V3.7.1", - "identifier": "V3.7.1", - "text": "Vérifiez que l'application utilise uniquement des technologies côté client toujours prises en charge et considérées comme sécurisées. Parmi les technologies qui ne répondent pas à cette exigence figurent les plugins NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL ou les applets Java côté client.", - "parent": "V3.7" - }, - { - "bom-ref": "V3.7.2", - "identifier": "V3.7.2", - "text": "Vérifiez que l'application redirigera automatiquement l'utilisateur vers un nom d'hôte ou un domaine différent (qui n'est pas contrôlé par l'application) uniquement lorsque la destination apparaît sur une liste d'autorisation.", - "parent": "V3.7" - }, - { - "bom-ref": "V3.7.3", - "identifier": "V3.7.3", - "text": "Vérifiez que le domaine de premier niveau de l'application (par exemple, site.tld) ​​est ajouté à la liste de préchargement publique pour HTTP Strict Transport Security (HSTS). Cela garantit que l'utilisation de TLS pour l'application est intégrée directement dans les principaux navigateurs, plutôt que de dépendre uniquement du champ d'en-tête de réponse Strict-Transport-Security.", - "parent": "V3.7" - }, - { - "bom-ref": "V3.7.4", - "identifier": "V3.7.4", - "text": "Vérifiez que l'application affiche une notification lorsque l'utilisateur est redirigé vers une URL hors du contrôle de l'application, avec une option pour annuler la navigation.", - "parent": "V3.7" - }, - { - "bom-ref": "V3.7.5", - "identifier": "V3.7.5", - "text": "Vérifiez que l'application se comporte comme documenté (par exemple, en avertissant l'utilisateur ou en bloquant l'accès) si le navigateur utilisé pour accéder à l'application ne prend pas en charge les fonctionnalités de sécurité attendues.", - "parent": "V3.7" - }, - { - "bom-ref": "V4", - "identifier": "V4", - "title": "API et service Web" - }, - { - "bom-ref": "V4.1", - "identifier": "V4.1", - "title": "Sécurité du service Web générique", - "parent": "V4" - }, - { - "bom-ref": "V4.1.1", - "identifier": "V4.1.1", - "text": "Vérifiez que chaque réponse HTTP avec un corps de message contient un champ d'en-tête Content-Type qui correspond au contenu réel de la réponse, y compris le paramètre charset pour spécifier un codage de caractères sécurisé (par exemple, UTF-8, ISO-8859-1) conformément aux types de médias IANA, tels que « text/ », « /+xml » et « /xml ».", - "parent": "V4.1" - }, - { - "bom-ref": "V4.1.2", - "identifier": "V4.1.2", - "text": "Vérifiez que seuls les terminaux utilisateurs (destinés à l'accès manuel via un navigateur web) redirigent automatiquement de HTTP vers HTTPS, tandis que les autres services ou terminaux n'implémentent pas de redirections transparentes. Cela permet d'éviter qu'un client envoie par erreur des requêtes HTTP non chiffrées, mais que, comme ces requêtes sont automatiquement redirigées vers HTTPS, la fuite de données sensibles passe inaperçue.", - "parent": "V4.1" - }, - { - "bom-ref": "V4.1.3", - "identifier": "V4.1.3", - "text": "Vérifiez que tout champ d'en-tête HTTP utilisé par l'application et défini par une couche intermédiaire, telle qu'un équilibreur de charge, un proxy web ou un service backend-for-frontend, ne peut pas être remplacé par l'utilisateur final. Les exemples d'en-têtes peuvent inclure X-Real-IP, X-Forwarded-*, ou X-User-ID.", - "parent": "V4.1" - }, - { - "bom-ref": "V4.1.4", - "identifier": "V4.1.4", - "text": "Vérifiez que seules les méthodes HTTP explicitement prises en charge par l'application ou son API (y compris les OPTIONS lors des demandes de contrôle en amont) peuvent être utilisées et que les méthodes inutilisées sont bloquées.", - "parent": "V4.1" - }, - { - "bom-ref": "V4.1.5", - "identifier": "V4.1.5", - "text": "Vérifier que les signatures numériques par message sont utilisées pour fournir une assurance supplémentaire en plus des protections de transport pour les demandes ou les transactions qui sont très sensibles ou qui traversent un certain nombre de systèmes.", - "parent": "V4.1" - }, - { - "bom-ref": "V4.2", - "identifier": "V4.2", - "title": "Validation de la structure des messages HTTP", - "parent": "V4" - }, - { - "bom-ref": "V4.2.1", - "identifier": "V4.2.1", - "text": "Vérifiez que tous les composants de l'application (y compris les équilibreurs de charge, les pares-feux et les serveurs d'applications) déterminent les limites des messages HTTP entrants à l'aide du mécanisme approprié à la version HTTP afin d'empêcher la contrebande de requêtes HTTP. Dans HTTP/1.x, si un champ d'en-tête Transfer-Encoding est présent, l'en-tête Content-Length doit être ignoré conformément à la RFC 2616. Avec HTTP/2 ou HTTP/3, si un champ d'en-tête Content-Length est présent, le récepteur doit s'assurer qu'il est cohérent avec la longueur des trames DATA.", - "parent": "V4.2" - }, - { - "bom-ref": "V4.2.2", - "identifier": "V4.2.2", - "text": "Vérifier que, lors de la génération de messages HTTP, le champ d'en-tête Content-Length n'entre pas en conflit avec la longueur du contenu déterminée par le cadrage du protocole HTTP, afin d'empêcher les attaques de type « request smuggling ».", - "parent": "V4.2" - }, - { - "bom-ref": "V4.2.3", - "identifier": "V4.2.3", - "text": "Vérifiez que l'application n'envoie ni n'accepte de messages HTTP/2 ou HTTP/3 avec des champs d'en-tête spécifiques à la connexion, tels que Transfer-Encoding, afin d'éviter les attaques par fractionnement de la réponse et par injection d'en-tête.", - "parent": "V4.2" - }, - { - "bom-ref": "V4.2.4", - "identifier": "V4.2.4", - "text": "Vérifiez que l'application n'accepte que les requêtes HTTP/2 et HTTP/3 dont les champs et valeurs d'en-tête ne contiennent pas de séquences CR (\\r), LF (\\n) ou CRLF (\\r\\n), afin d'éviter les attaques par injection d'en-tête.", - "parent": "V4.2" - }, - { - "bom-ref": "V4.2.5", - "identifier": "V4.2.5", - "text": "Vérifiez que, si l'application (backend ou frontend) construit et envoie des requêtes, elle utilise des mécanismes de validation, d'assainissement ou autres pour éviter de créer des URI (comme pour les appels API) ou des champs d'en-tête de requête HTTP (comme Authorization ou Cookie) qui sont trop longs pour être acceptés par le composant récepteur. Cela pourrait entraîner un déni de service, par exemple lors de l'envoi d'une requête trop longue (par exemple, un long champ d'en-tête de cookie), ce qui fait que le serveur répond toujours avec un statut d'erreur.", - "parent": "V4.2" - }, - { - "bom-ref": "V4.3", - "identifier": "V4.3", - "title": "GraphQL", - "parent": "V4" - }, - { - "bom-ref": "V4.3.1", - "identifier": "V4.3.1", - "text": "Vérifiez qu'une liste d'autorisation de requête, une limitation de profondeur, une limitation de quantité ou une analyse des coûts de requête est utilisée pour empêcher le déni de service (DoS) de GraphQL ou d'expression de la couche données en raison de requêtes imbriquées coûteuses.", - "parent": "V4.3" - }, - { - "bom-ref": "V4.3.2", - "identifier": "V4.3.2", - "text": "Vérifiez que les requêtes d’introspection GraphQL sont désactivées dans l’environnement de production, sauf si l’API GraphQL est destinée à être utilisée par d’autres parties.", - "parent": "V4.3" - }, - { - "bom-ref": "V4.4", - "identifier": "V4.4", - "title": "WebSocket", - "parent": "V4" - }, - { - "bom-ref": "V4.4.1", - "identifier": "V4.4.1", - "text": "Vérifiez que WebSocket sur TLS (WSS) est utilisé pour toutes les connexions WebSocket.", - "parent": "V4.4" - }, - { - "bom-ref": "V4.4.2", - "identifier": "V4.4.2", - "text": "Vérifiez que, lors de la négociation HTTP WebSocket initiale, le champ d’en-tête 'Origin' est vérifié par rapport à une liste d’origines autorisées pour l’application.", - "parent": "V4.4" - }, - { - "bom-ref": "V4.4.3", - "identifier": "V4.4.3", - "text": "Vérifiez que, si la gestion de session standard de l'application ne peut pas être utilisée, des jetons dédiés sont utilisés à cet effet, qui sont conformes aux exigences de sécurité de gestion de session pertinentes.", - "parent": "V4.4" - }, - { - "bom-ref": "V4.4.4", - "identifier": "V4.4.4", - "text": "Vérifiez que les jetons de gestion de session WebSocket dédiés sont initialement obtenus ou validés via la session HTTPS précédemment authentifiée lors de la transition d'une session HTTPS existante vers un canal WebSocket.", - "parent": "V4.4" - }, - { - "bom-ref": "V5", - "identifier": "V5", - "title": "Gestion des fichiers" - }, - { - "bom-ref": "V5.1", - "identifier": "V5.1", - "title": "Documentation sur la gestion des fichiers", - "parent": "V5" - }, - { - "bom-ref": "V5.1.1", - "identifier": "V5.1.1", - "text": "Vérifiez que la documentation définit les types de fichiers autorisés, les extensions de fichiers attendues et la taille maximale (y compris la taille décompressée) pour chaque fonctionnalité de Téléversement. De plus, assurez-vous que la documentation précise comment les fichiers sont sécurisés pour le téléchargement et le traitement des utilisateurs finaux, par exemple le comportement de l'application lorsqu'un fichier malveillant est détecté.", - "parent": "V5.1" - }, - { - "bom-ref": "V5.2", - "identifier": "V5.2", - "title": "Téléversement de fichiers et contenu", - "parent": "V5" - }, - { - "bom-ref": "V5.2.1", - "identifier": "V5.2.1", - "text": "Vérifiez que l'application n'acceptera que des fichiers d'une taille qu'elle peut traiter sans provoquer de perte de performances ou d'attaque par déni de service.", - "parent": "V5.2" - }, - { - "bom-ref": "V5.2.2", - "identifier": "V5.2.2", - "text": "Vérifiez que lorsque l'application accepte un fichier, seul ou dans une archive telle qu'un fichier zip, elle vérifie si l'extension de fichier correspond à une extension attendue et que le contenu correspond au type représenté par l'extension. Cela inclut, sans s'y limiter, la vérification des « octets magiques » initiaux, la réécriture d'images et l'utilisation de bibliothèques spécialisées pour la validation du contenu des fichiers. Pour le niveau L1, cela peut se concentrer uniquement sur les fichiers utilisés pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau L2, cela doit s'appliquer à tous les fichiers acceptés.", - "parent": "V5.2" - }, - { - "bom-ref": "V5.2.3", - "identifier": "V5.2.3", - "text": "Vérifiez que l'application vérifie les fichiers compressés (par exemple, zip, gz, docx, odt) par rapport à la taille maximale autorisée non compressée et au nombre maximal de fichiers avant de décompresser le fichier.", - "parent": "V5.2" - }, - { - "bom-ref": "V5.2.4", - "identifier": "V5.2.4", - "text": "Vérifiez qu'un quota de taille de fichier et un nombre maximal de fichiers par utilisateur sont appliqués pour garantir qu'un seul utilisateur ne puisse pas remplir le stockage avec trop de fichiers ou des fichiers excessivement volumineux.", - "parent": "V5.2" - }, - { - "bom-ref": "V5.2.5", - "identifier": "V5.2.5", - "text": "Vérifiez que l'application n'autorise pas le téléversement de fichiers compressés contenant des liens symboliques, sauf si cela est spécifiquement requis (auquel cas il sera nécessaire d'appliquer une liste d'autorisation des fichiers vers lesquels il est possible de créer des liens symboliques).", - "parent": "V5.2" - }, - { - "bom-ref": "V5.2.6", - "identifier": "V5.2.6", - "text": "Vérifiez que l'application rejette les images téléversées avec une taille de pixel supérieure au maximum autorisé, afin d'éviter les attaques par inondation de pixels.", - "parent": "V5.2" - }, - { - "bom-ref": "V5.3", - "identifier": "V5.3", - "title": "Stockage de fichiers", - "parent": "V5" - }, - { - "bom-ref": "V5.3.1", - "identifier": "V5.3.1", - "text": "Vérifiez que les fichiers téléversés ou générés par une entrée non fiable et stockés dans un dossier public ne sont pas exécutés en tant que code de programme côté serveur lorsqu'ils sont accessibles directement avec une requête HTTP.", - "parent": "V5.3" - }, - { - "bom-ref": "V5.3.2", - "identifier": "V5.3.2", - "text": "Vérifiez que lorsque l'application crée des chemins d'accès pour les opérations sur les fichiers, elle utilise des données générées en interne ou fiables plutôt que des noms de fichiers soumis par l'utilisateur. Si des noms de fichiers ou des métadonnées de fichiers soumis par l'utilisateur doivent être utilisés, une validation et un nettoyage stricts doivent être appliqués. Ceci permet de se protéger contre les attaques par traversée de chemin, l'inclusion de fichiers locaux ou distants (LFI, RFI) et la falsification de requêtes côté serveur (SSRF).", - "parent": "V5.3" - }, - { - "bom-ref": "V5.3.3", - "identifier": "V5.3.3", - "text": "Vérifiez que le traitement des fichiers côté serveur, comme la décompression des fichiers, ignore les informations de chemin fournies par l'utilisateur pour éviter les vulnérabilités telles que le \"zip slip\".", - "parent": "V5.3" - }, - { - "bom-ref": "V5.4", - "identifier": "V5.4", - "title": "Téléchargement de fichier", - "parent": "V5" - }, - { - "bom-ref": "V5.4.1", - "identifier": "V5.4.1", - "text": "Vérifiez que l’application valide ou ignore les noms de fichiers soumis par l’utilisateur, y compris dans un paramètre JSON, JSONP ou URL et spécifie un nom de fichier dans le champ d’en-tête Content-Disposition de la réponse.", - "parent": "V5.4" - }, - { - "bom-ref": "V5.4.2", - "identifier": "V5.4.2", - "text": "Vérifiez que les noms de fichiers servis (par exemple, dans les champs d'en-tête de réponse HTTP ou les pièces jointes aux e-mails) sont encodés ou nettoyés (par exemple, conformément à la RFC 6266) pour préserver la structure du document et empêcher les attaques par injection.", - "parent": "V5.4" - }, - { - "bom-ref": "V5.4.3", - "identifier": "V5.4.3", - "text": "Vérifiez que les fichiers obtenus à partir de sources non fiables sont analysés par des scanners antivirus pour empêcher la diffusion de contenu malveillant connu.", - "parent": "V5.4" - }, - { - "bom-ref": "V6", - "identifier": "V6", - "title": "Authentification" - }, - { - "bom-ref": "V6.1", - "identifier": "V6.1", - "title": "Documentation d'authentification", - "parent": "V6" - }, - { - "bom-ref": "V6.1.1", - "identifier": "V6.1.1", - "text": "Vérifiez que la documentation de l'application définit comment les contrôles, tels que la limitation de débit, l'anti-automatisation et la réponse adaptative, sont utilisés pour se défendre contre les attaques telles que le « credential stuffing » et la force brute des mots de passe. La documentation doit expliquer clairement comment ces contrôles sont configurés et empêcher le blocage malveillant des comptes.", - "parent": "V6.1" - }, - { - "bom-ref": "V6.1.2", - "identifier": "V6.1.2", - "text": "Vérifiez qu'une liste de mots spécifiques au contexte est documentée afin d'empêcher leur utilisation dans les mots de passe. Cette liste peut inclure des permutations de noms d'organisations, de produits, d'identifiants de systèmes, de noms de codes de projets, de noms de services ou de rôles, etc.", - "parent": "V6.1" - }, - { - "bom-ref": "V6.1.3", - "identifier": "V6.1.3", - "text": "Vérifiez que, si l'application inclut plusieurs voies d'authentification, celles-ci sont toutes documentées avec les contrôles de sécurité et la force d'authentification qui doivent être appliqués de manière cohérente.", - "parent": "V6.1" - }, - { - "bom-ref": "V6.2", - "identifier": "V6.2", - "title": "Sécurité des mots de passe", - "parent": "V6" - }, - { - "bom-ref": "V6.2.1", - "identifier": "V6.2.1", - "text": "Vérifiez que les mots de passe définis par l'utilisateur comportent au moins 8 caractères, bien qu'un minimum de 15 caractères soit fortement recommandé.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.2", - "identifier": "V6.2.2", - "text": "Vérifiez que les utilisateurs peuvent modifier leur mot de passe.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.3", - "identifier": "V6.2.3", - "text": "Vérifiez que la fonctionnalité de changement de mot de passe nécessite le mot de passe actuel et le nouveau mot de passe de l'utilisateur.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.4", - "identifier": "V6.2.4", - "text": "Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou du changement de mot de passe sont vérifiés par rapport à un ensemble disponible d'au moins 3 000 mots de passe principaux qui correspondent à la politique de mot de passe de l'application, par exemple la longueur minimale.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.5", - "identifier": "V6.2.5", - "text": "Vérifiez que les mots de passe peuvent être utilisés, quelle que soit leur composition, sans restriction quant au type de caractères autorisés. Aucun nombre minimal de majuscules ou de minuscules, de chiffres ou de caractères spéciaux ne doit être exigé.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.6", - "identifier": "V6.2.6", - "text": "Vérifiez que les champs de saisie du mot de passe utilisent type=password pour masquer la saisie. Les applications peuvent permettre à l'utilisateur d'afficher temporairement l'intégralité du mot de passe masqué ou le dernier caractère saisi.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.7", - "identifier": "V6.2.7", - "text": "Vérifiez que la fonctionnalité « coller », les assistants de mot de passe du navigateur et les gestionnaires de mots de passe externes sont autorisés.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.8", - "identifier": "V6.2.8", - "text": "Vérifiez que l'application vérifie le mot de passe de l'utilisateur exactement tel qu'il a été reçu de l'utilisateur, sans aucune modification telle qu'une troncature ou une transformation de casse.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.9", - "identifier": "V6.2.9", - "text": "Vérifiez que les mots de passe d’au moins 64 caractères sont autorisés.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.10", - "identifier": "V6.2.10", - "text": "Vérifiez que le mot de passe d'un utilisateur reste valide jusqu'à ce qu'il soit découvert comme compromis ou qu'il soit renouvelé. L'application ne doit pas exiger de renouvellement périodique des identifiants.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.11", - "identifier": "V6.2.11", - "text": "Vérifiez que la liste documentée de mots spécifiques au contexte est utilisée pour éviter la création de mots de passe faciles à deviner.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.12", - "identifier": "V6.2.12", - "text": "Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou des modifications de mot de passe sont vérifiés par rapport à un ensemble de mots de passe fuités.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.3", - "identifier": "V6.3", - "title": "Sécurité générale de l'authentification", - "parent": "V6" - }, - { - "bom-ref": "V6.3.1", - "identifier": "V6.3.1", - "text": "Vérifiez que les contrôles visant à empêcher les attaques telles que le bourrage d'informations d'identification et la force brute des mots de passe sont mis en œuvre conformément à la documentation de sécurité de l'application.", - "parent": "V6.3" - }, - { - "bom-ref": "V6.3.2", - "identifier": "V6.3.2", - "text": "Vérifiez que les comptes d’utilisateur par défaut (par exemple, « root », « admin » ou « sa ») ne sont pas présents dans l’application ou sont désactivés.", - "parent": "V6.3" - }, - { - "bom-ref": "V6.3.3", - "identifier": "V6.3.3", - "text": "Vérifiez que l’application exige que les utilisateurs utilisent un mécanisme d’authentification multifacteur ou une combinaison de mécanismes d’authentification à facteur unique.", - "parent": "V6.3" - }, - { - "bom-ref": "V6.3.4", - "identifier": "V6.3.4", - "text": "Vérifiez que, si l’application inclut plusieurs voies d’authentification, il n’existe aucune voie non documentée et que les contrôles de sécurité et la force d’authentification sont appliqués de manière cohérente.", - "parent": "V6.3" - }, - { - "bom-ref": "V6.3.5", - "identifier": "V6.3.5", - "text": "Vérifiez que les utilisateurs sont informés des tentatives d'authentification suspectes (réussies ou non). Il peut s'agir de tentatives d'authentification provenant d'un emplacement ou d'un client inhabituel, d'une authentification partiellement réussie (un seul facteur parmi plusieurs), d'une tentative d'authentification après une longue période d'inactivité ou d'une authentification réussie après plusieurs tentatives infructueuses.", - "parent": "V6.3" - }, - { - "bom-ref": "V6.3.6", - "identifier": "V6.3.6", - "text": "Vérifiez que le courrier électronique n’est pas utilisé comme mécanisme d’authentification à facteur unique ou à facteurs multiples.", - "parent": "V6.3" - }, - { - "bom-ref": "V6.3.7", - "identifier": "V6.3.7", - "text": "Vérifiez que les utilisateurs sont avertis après les mises à jour des détails d'authentification, telles que les réinitialisations d'informations d'identification ou la modification du nom d'utilisateur ou de l'adresse e-mail.", - "parent": "V6.3" - }, - { - "bom-ref": "V6.3.8", - "identifier": "V6.3.8", - "text": "Vérifiez que les utilisateurs valides ne peuvent pas être déduits d'échecs d'authentification, par exemple en se basant sur des messages d'erreur, des codes de réponse HTTP ou des temps de réponse différents. Les fonctionnalités d'inscription et de mot de passe oublié doivent également bénéficier de cette protection.", - "parent": "V6.3" - }, - { - "bom-ref": "V6.4", - "identifier": "V6.4", - "title": "Cycle de vie et récupération du facteur d'authentification", - "parent": "V6" - }, - { - "bom-ref": "V6.4.1", - "identifier": "V6.4.1", - "text": "Vérifiez que les mots de passe initiaux ou les codes d'activation générés par le système sont générés de manière aléatoire et sécurisée, qu'ils respectent la politique de mots de passe en vigueur et qu'ils expirent après une courte période ou après leur première utilisation. Ces secrets initiaux ne doivent pas devenir des mots de passe permanents.", - "parent": "V6.4" - }, - { - "bom-ref": "V6.4.2", - "identifier": "V6.4.2", - "text": "Vérifiez que les indices de mot de passe ou l'authentification basée sur les connaissances (appelées « questions secrètes ») ne sont pas présents.", - "parent": "V6.4" - }, - { - "bom-ref": "V6.4.3", - "identifier": "V6.4.3", - "text": "Vérifiez qu'un processus sécurisé de réinitialisation d'un mot de passe oublié est mis en œuvre, qui ne contourne aucun mécanisme d'authentification multifacteur activé.", - "parent": "V6.4" - }, - { - "bom-ref": "V6.4.4", - "identifier": "V6.4.4", - "text": "Vérifiez que si un facteur d'authentification multifacteur est perdu, la preuve de vérification d'identité est effectuée au même niveau que lors de l'inscription.", - "parent": "V6.4" - }, - { - "bom-ref": "V6.4.5", - "identifier": "V6.4.5", - "text": "Vérifiez que les instructions de renouvellement des mécanismes d'authentification qui expirent sont envoyées avec suffisamment de temps pour être exécutées avant l'expiration de l'ancien mécanisme d'authentification, en configurant des rappels automatiques si nécessaire.", - "parent": "V6.4" - }, - { - "bom-ref": "V6.4.6", - "identifier": "V6.4.6", - "text": "Vérifiez que les administrateurs peuvent initier la réinitialisation du mot de passe de l'utilisateur, mais que cela ne leur permet pas de modifier ou de choisir son mot de passe. Cela évite qu'ils ne connaissent le mot de passe de l'utilisateur.", - "parent": "V6.4" - }, - { - "bom-ref": "V6.5", - "identifier": "V6.5", - "title": "Exigences générales en matière d'authentification multifacteur", - "parent": "V6" - }, - { - "bom-ref": "V6.5.1", - "identifier": "V6.5.1", - "text": "Vérifiez que les secrets de recherche, les demandes ou codes d'authentification out-of-band et les mots de passe à usage unique basés sur le temps (TOTP) ne peuvent être utilisés avec succès qu'une seule fois.", - "parent": "V6.5" - }, - { - "bom-ref": "V6.5.2", - "identifier": "V6.5.2", - "text": "Vérifiez que, lors de leur stockage dans le backend de l'application, les secrets de recherche comportant moins de 112 bits d'entropie (19 caractères alphanumériques aléatoires ou 34 chiffres aléatoires) sont hachés avec un algorithme de hachage de stockage de mots de passe approuvé, intégrant un sel aléatoire de 32 bits. Une fonction de hachage standard peut être utilisée si le secret comporte 112 bits d'entropie ou plus.", - "parent": "V6.5" - }, - { - "bom-ref": "V6.5.3", - "identifier": "V6.5.3", - "text": "Vérifiez que les secrets de recherche, le code d'authentification out-of-band et les mots de passe à usage unique basés sur le temps sont générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) pour éviter les valeurs prévisibles.", - "parent": "V6.5" - }, - { - "bom-ref": "V6.5.4", - "identifier": "V6.5.4", - "text": "Vérifiez que les secrets de recherche et les codes d'authentification out-of-band ont un minimum de 20 bits d'entropie (généralement 4 caractères alphanumériques aléatoires ou 6 chiffres aléatoires suffisent).", - "parent": "V6.5" - }, - { - "bom-ref": "V6.5.5", - "identifier": "V6.5.5", - "text": "Vérifiez que les requêtes, codes ou jetons d'authentification out-of-band, ainsi que les mots de passe à usage unique (TOTP), ont une durée de vie définie. Les requêtes out-of-band doivent avoir une durée de vie maximale de 10 minutes et les TOTP, de 30 secondes.", - "parent": "V6.5" - }, - { - "bom-ref": "V6.5.6", - "identifier": "V6.5.6", - "text": "Vérifiez que tout facteur d’authentification (y compris les appareils physiques) peut être révoqué en cas de vol ou autre perte.", - "parent": "V6.5" - }, - { - "bom-ref": "V6.5.7", - "identifier": "V6.5.7", - "text": "Vérifiez que les mécanismes d’authentification biométrique ne sont utilisés que comme facteurs secondaires, avec quelque chose que vous possédez ou quelque chose que vous savez.", - "parent": "V6.5" - }, - { - "bom-ref": "V6.5.8", - "identifier": "V6.5.8", - "text": "Vérifiez que les mots de passe à usage unique basés sur le temps (TOTP) sont vérifiés en fonction d'une source temporelle provenant d'un service de confiance et non d'une heure non fiable ou fournie par le client.", - "parent": "V6.5" - }, - { - "bom-ref": "V6.6", - "identifier": "V6.6", - "title": "Mécanismes d'authentification out-of-band", - "parent": "V6" - }, - { - "bom-ref": "V6.6.1", - "identifier": "V6.6.1", - "text": "Vérifier que les mécanismes d'authentification utilisant le réseau téléphonique public commuté (RTPC) pour la transmission de mots de passe à usage unique (OTP) par téléphone ou SMS ne sont proposés que lorsque le numéro de téléphone a été préalablement validé. D'autres méthodes plus robustes (telles que les mots de passe à usage unique à durée déterminée) sont également proposées, et que le service informe les utilisateurs des risques de sécurité qu'elles présentent. Pour les applications de niveau 3, le téléphone et les SMS ne doivent pas être disponibles.", - "parent": "V6.6" - }, - { - "bom-ref": "V6.6.2", - "identifier": "V6.6.2", - "text": "Vérifiez que les demandes d’authentification out-of-band, les codes ou les jetons sont liés à la demande d’authentification d’origine pour laquelle ils ont été générés et ne sont pas utilisables pour une demande précédente ou ultérieure.", - "parent": "V6.6" - }, - { - "bom-ref": "V6.6.3", - "identifier": "V6.6.3", - "text": "Vérifiez qu'un mécanisme d'authentification out-of-band basé sur du code est protégé contre les attaques par force brute grâce au \"rate limiting\". Envisagez également d'utiliser un code avec au moins 64 bits d'entropie.", - "parent": "V6.6" - }, - { - "bom-ref": "V6.6.4", - "identifier": "V6.6.4", - "text": "Vérifiez que, lorsque les notifications push sont utilisées pour l'authentification multifacteur, le \"rate limiting\" est appliqué afin d'empêcher les attaques de type « push bombing ». La concordance des numéros peut également atténuer ce risque.", - "parent": "V6.6" - }, - { - "bom-ref": "V6.7", - "identifier": "V6.7", - "title": "Mécanisme d'authentification cryptographique", - "parent": "V6" - }, - { - "bom-ref": "V6.7.1", - "identifier": "V6.7.1", - "text": "Vérifiez que les certificats utilisés pour vérifier les assertions d’authentification cryptographique sont stockés de manière à les protéger contre toute modification.", - "parent": "V6.7" - }, - { - "bom-ref": "V6.7.2", - "identifier": "V6.7.2", - "text": "Vérifiez que le nonce de défi a une longueur d'au moins 64 bits et qu'il est statistiquement unique ou unique sur toute la durée de vie du périphérique cryptographique.", - "parent": "V6.7" - }, - { - "bom-ref": "V6.8", - "identifier": "V6.8", - "title": "Authentification avec un fournisseur d'identité", - "parent": "V6" - }, - { - "bom-ref": "V6.8.1", - "identifier": "V6.8.1", - "text": "Vérifiez que, si l'application prend en charge plusieurs fournisseurs d'identité (IdP), l'identité de l'utilisateur ne peut pas être usurpée via un autre fournisseur d'identité pris en charge (par exemple, en utilisant le même identifiant utilisateur). La mesure standard consisterait à ce que l'application enregistre et identifie l'utilisateur à l'aide d'une combinaison de l'ID du fournisseur d'identité (servant d'espace de noms) et de l'ID de l'utilisateur dans le fournisseur d'identité.", - "parent": "V6.8" - }, - { - "bom-ref": "V6.8.2", - "identifier": "V6.8.2", - "text": "Vérifiez que la présence et l'intégrité des signatures numériques sur les assertions d'authentification (par exemple sur les assertions JWT ou SAML) sont toujours validées, en rejetant toutes les assertions non signées ou ayant des signatures non valides.", - "parent": "V6.8" - }, - { - "bom-ref": "V6.8.3", - "identifier": "V6.8.3", - "text": "Vérifiez que les assertions SAML sont traitées de manière unique et utilisées une seule fois au cours de la période de validité pour éviter les attaques par rejeu.", - "parent": "V6.8" - }, - { - "bom-ref": "V6.8.4", - "identifier": "V6.8.4", - "text": "Si une application utilise un fournisseur d'identité (IdP) distinct et attend une force, des méthodes ou une date d'authentification spécifiques pour des fonctions spécifiques, vérifiez que l'application les vérifie à l'aide des informations renvoyées par l'IdP. Par exemple, si OIDC est utilisé, cela peut être réalisé en validant les affirmations de jeton d'identification telles que « acr », « amr » et « auth_time » (le cas échéant). Si l'IdP ne fournit pas ces informations, l'application doit disposer d'une approche de secours documentée qui suppose que le mécanisme d'authentification de force minimale a été utilisé (par exemple, une authentification à facteur unique avec nom d'utilisateur et mot de passe).", - "parent": "V6.8" - }, - { - "bom-ref": "V7", - "identifier": "V7", - "title": "Gestion des sessions" - }, - { - "bom-ref": "V7.1", - "identifier": "V7.1", - "title": "Documentation sur la gestion des sessions", - "parent": "V7" - }, - { - "bom-ref": "V7.1.1", - "identifier": "V7.1.1", - "text": "Vérifiez que le délai d'inactivité de la session de l'utilisateur et la durée de vie maximale absolue de la session sont documentés, sont appropriés en combinaison avec d'autres contrôles et que la documentation inclut une justification de tout écart par rapport aux exigences de réauthentification NIST SP 800-63B.", - "parent": "V7.1" - }, - { - "bom-ref": "V7.1.2", - "identifier": "V7.1.2", - "text": "Vérifiez que la documentation définit le nombre de sessions simultanées (parallèles) autorisées pour un compte ainsi que les comportements et actions prévus à entreprendre lorsque le nombre maximal de sessions actives est atteint.", - "parent": "V7.1" - }, - { - "bom-ref": "V7.1.3", - "identifier": "V7.1.3", - "text": "Vérifiez que tous les systèmes qui créent et gèrent des sessions utilisateur dans le cadre d'un écosystème de gestion des identités fédérées (tels que les systèmes SSO) sont documentés avec des contrôles pour coordonner la durée de vie des sessions, la résiliation et toute autre condition nécessitant une réauthentification.", - "parent": "V7.1" - }, - { - "bom-ref": "V7.2", - "identifier": "V7.2", - "title": "Sécurité fondamentale de la gestion des sessions", - "parent": "V7" - }, - { - "bom-ref": "V7.2.1", - "identifier": "V7.2.1", - "text": "Vérifiez que l’application effectue toutes les vérifications des jetons de session à l’aide d’un service backend de confiance.", - "parent": "V7.2" - }, - { - "bom-ref": "V7.2.2", - "identifier": "V7.2.2", - "text": "Vérifiez que l'application utilise des jetons autonomes ou de référence générés dynamiquement pour la gestion des sessions, c'est-à-dire sans utiliser de secrets et de clés d'API statiques.", - "parent": "V7.2" - }, - { - "bom-ref": "V7.2.3", - "identifier": "V7.2.3", - "text": "Vérifiez que si des jetons par référence sont utilisés pour représenter les sessions utilisateur, ils sont uniques et générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et possèdent au moins 128 bits d'entropie.", - "parent": "V7.2" - }, - { - "bom-ref": "V7.2.4", - "identifier": "V7.2.4", - "text": "Vérifiez que l’application génère un nouveau jeton de session lors de l’authentification de l’utilisateur, y compris la réauthentification, et met fin au jeton de session actuel.", - "parent": "V7.2" - }, - { - "bom-ref": "V7.3", - "identifier": "V7.3", - "title": "Délai d'expiration de la session", - "parent": "V7" - }, - { - "bom-ref": "V7.3.1", - "identifier": "V7.3.1", - "text": "Vérifiez qu’il existe un délai d’inactivité tel que la réauthentification soit appliquée conformément à l’analyse des risques et aux décisions de sécurité documentées.", - "parent": "V7.3" - }, - { - "bom-ref": "V7.3.2", - "identifier": "V7.3.2", - "text": "Vérifiez qu'il existe une durée de vie maximale absolue de la session de sorte que la réauthentification soit appliquée conformément à l'analyse des risques et aux décisions de sécurité documentées.", - "parent": "V7.3" - }, - { - "bom-ref": "V7.4", - "identifier": "V7.4", - "title": "Fin de session", - "parent": "V7" - }, - { - "bom-ref": "V7.4.1", - "identifier": "V7.4.1", - "text": "Vérifiez que lorsque la fin de session est déclenchée (par exemple, déconnexion ou expiration), l'application interdit toute utilisation ultérieure de la session. Pour les jetons par référence ou les sessions avec état, cela implique l'invalidation des données de session au niveau du backend de l'application. Les applications utilisant des jetons autonomes nécessiteront une solution, comme la gestion d'une liste des jetons terminés, l'interdiction des jetons produits avant une date et une heure spécifique à chaque utilisateur ou la rotation d'une clé de signature spécifique à chaque utilisateur.", - "parent": "V7.4" - }, - { - "bom-ref": "V7.4.2", - "identifier": "V7.4.2", - "text": "Vérifiez que l'application met fin à toutes les sessions actives lorsqu'un compte utilisateur est désactivé ou supprimé (par exemple, lorsqu'un employé quitte l'entreprise).", - "parent": "V7.4" - }, - { - "bom-ref": "V7.4.3", - "identifier": "V7.4.3", - "text": "Vérifiez que l'application offre la possibilité de mettre fin à toutes les autres sessions actives après une modification ou une suppression réussie de tout facteur d'authentification (y compris la modification du mot de passe via une réinitialisation ou une récupération et, le cas échéant, une mise à jour des paramètres MFA).", - "parent": "V7.4" - }, - { - "bom-ref": "V7.4.4", - "identifier": "V7.4.4", - "text": "Vérifiez que toutes les pages nécessitant une authentification disposent d’un accès facile et visible à la fonctionnalité de déconnexion.", - "parent": "V7.4" - }, - { - "bom-ref": "V7.4.5", - "identifier": "V7.4.5", - "text": "Vérifiez que les administrateurs d’applications sont en mesure de mettre fin aux sessions actives pour un utilisateur individuel ou pour tous les utilisateurs.", - "parent": "V7.4" - }, - { - "bom-ref": "V7.5", - "identifier": "V7.5", - "title": "Défenses contre les abus de session", - "parent": "V7" - }, - { - "bom-ref": "V7.5.1", - "identifier": "V7.5.1", - "text": "Vérifiez que l'application nécessite une réauthentification complète avant d'autoriser les modifications des attributs de compte sensibles qui peuvent affecter l'authentification, tels que l'adresse e-mail, le numéro de téléphone, la configuration MFA ou d'autres informations utilisées dans la récupération de compte.", - "parent": "V7.5" - }, - { - "bom-ref": "V7.5.2", - "identifier": "V7.5.2", - "text": "Vérifiez que les utilisateurs peuvent afficher et (après s'être authentifiés à nouveau avec au moins un facteur) terminer une ou toutes les sessions actuellement actives.", - "parent": "V7.5" - }, - { - "bom-ref": "V7.5.3", - "identifier": "V7.5.3", - "text": "Vérifiez que l’application nécessite une authentification supplémentaire avec au moins un facteur ou une vérification secondaire avant d’effectuer des transactions ou des opérations hautement sensibles.", - "parent": "V7.5" - }, - { - "bom-ref": "V7.6", - "identifier": "V7.6", - "title": "Réauthentification fédérée", - "parent": "V7" - }, - { - "bom-ref": "V7.6.1", - "identifier": "V7.6.1", - "text": "Vérifiez que la durée de vie et la fin de la session entre les parties de confiance (RP) et les fournisseurs d'identité (IdP) se comportent comme documenté, en exigeant une réauthentification si nécessaire, par exemple lorsque le temps maximal entre les événements d'authentification IdP est atteint.", - "parent": "V7.6" - }, - { - "bom-ref": "V7.6.2", - "identifier": "V7.6.2", - "text": "Vérifiez que la création d'une session nécessite soit le consentement de l'utilisateur, soit une action explicite, empêchant ainsi la création de nouvelles sessions d'application sans interaction de l'utilisateur.", - "parent": "V7.6" - }, - { - "bom-ref": "V8", - "identifier": "V8", - "title": "Autorisation" - }, - { - "bom-ref": "V8.1", - "identifier": "V8.1", - "title": "Documentation d'autorisation", - "parent": "V8" - }, - { - "bom-ref": "V8.1.1", - "identifier": "V8.1.1", - "text": "Vérifiez que la documentation d’autorisation définit des règles de restriction de l’accès au niveau de la fonction et aux données en fonction des autorisations du consommateur et des attributs des ressources.", - "parent": "V8.1" - }, - { - "bom-ref": "V8.1.2", - "identifier": "V8.1.2", - "text": "Vérifiez que la documentation d'autorisation définit les règles de restriction d'accès au niveau des champs (lecture et écriture) en fonction des autorisations des consommateurs et des attributs des ressources. Notez que ces règles peuvent dépendre d'autres valeurs d'attributs de l'objet de données concerné, telles que l'état ou le statut.", - "parent": "V8.1" - }, - { - "bom-ref": "V8.1.3", - "identifier": "V8.1.3", - "text": "Vérifiez que la documentation de l'application définit les attributs environnementaux et contextuels (y compris, mais sans s'y limiter, l'heure de la journée, l'emplacement de l'utilisateur, l'adresse IP ou l'appareil) qui sont utilisés dans l'application pour prendre des décisions de sécurité, y compris celles relatives à l'authentification et à l'autorisation.", - "parent": "V8.1" - }, - { - "bom-ref": "V8.1.4", - "identifier": "V8.1.4", - "text": "Vérifier que la documentation d'authentification et d'autorisation définit l'utilisation des facteurs environnementaux et contextuels dans la prise de décision, en plus des autorisations au niveau des fonctions, des données et des champs. Cela doit inclure les attributs évalués, les seuils de risque et les actions entreprises (par exemple, autorisation, contestation, refus, renforcement de l'authentification).", - "parent": "V8.1" - }, - { - "bom-ref": "V8.2", - "identifier": "V8.2", - "title": "Conception d'autorisation générale", - "parent": "V8" - }, - { - "bom-ref": "V8.2.1", - "identifier": "V8.2.1", - "text": "Vérifiez que l’application garantit que l’accès basé sur la fonction est limité aux consommateurs disposant d’autorisations explicites.", - "parent": "V8.2" - }, - { - "bom-ref": "V8.2.2", - "identifier": "V8.2.2", - "text": "Vérifiez que l'application garantit que l'accès spécifique aux données est limité aux consommateurs disposant d'autorisations explicites sur des éléments de données spécifiques afin d'atténuer les références d'objet directes non sécurisées (IDOR) et les autorisations de niveau d'objet rompues (BOLA).", - "parent": "V8.2" - }, - { - "bom-ref": "V8.2.3", - "identifier": "V8.2.3", - "text": "Vérifiez que l'application garantit que l'accès au niveau du champ est limité aux consommateurs disposant d'autorisations explicites sur des champs spécifiques afin d'atténuer les problèmes d'autorisation au niveau de la propriété d'objet (BOPLA).", - "parent": "V8.2" - }, - { - "bom-ref": "V8.2.4", - "identifier": "V8.2.4", - "text": "Vérifiez que les contrôles de sécurité adaptatifs basés sur les attributs environnementaux et contextuels du consommateur (tels que l'heure, la localisation, l'adresse IP ou l'appareil) sont mis en œuvre pour les décisions d'authentification et d'autorisation, comme défini dans la documentation de l'application. Ces contrôles doivent être appliqués lorsque le consommateur tente de démarrer une nouvelle session et également pendant une session existante.", - "parent": "V8.2" - }, - { - "bom-ref": "V8.3", - "identifier": "V8.3", - "title": "Autorisation par opération", - "parent": "V8" - }, - { - "bom-ref": "V8.3.1", - "identifier": "V8.3.1", - "text": "Vérifier que l'application applique les règles d'autorisations au niveau de la couche service de confiance et ne s’appuie pas sur des contrôles qu’un consommateur non approuvé pourrait manipuler, comme JavaScript côté client.", - "parent": "V8.3" - }, - { - "bom-ref": "V8.3.2", - "identifier": "V8.3.2", - "text": "Vérifiez que les modifications apportées aux valeurs sur lesquelles reposent les décisions d'autorisation sont appliquées immédiatement. Lorsque les modifications ne peuvent pas être appliquées immédiatement (par exemple, en s'appuyant sur des données de jetons autonomes), des contrôles d'atténuation doivent être mis en place pour alerter un consommateur lorsqu'il effectue une action alors qu'il n'est plus autorisé à le faire et annuler la modification. Notez que cette solution alternative ne limiterait pas les fuites d'informations.", - "parent": "V8.3" - }, - { - "bom-ref": "V8.3.3", - "identifier": "V8.3.3", - "text": "Vérifiez que l'accès à un objet repose sur les autorisations du sujet d'origine (par exemple, le consommateur), et non sur celles d'un intermédiaire ou d'un service agissant en son nom. Par exemple, si un consommateur appelle un service web à l'aide d'un jeton d'authentification autonome, et que ce service demande ensuite des données à un autre service, ce dernier utilisera le jeton du consommateur, plutôt qu'un jeton inter-machine du premier service, pour prendre les décisions d'autorisation.", - "parent": "V8.3" - }, - { - "bom-ref": "V8.4", - "identifier": "V8.4", - "title": "Autres considérations relatives à l'autorisation", - "parent": "V8" - }, - { - "bom-ref": "V8.4.1", - "identifier": "V8.4.1", - "text": "Vérifiez que les applications multi-tenants utilisent des contrôles inter-tenants pour garantir que les opérations des consommateurs n'affecteront jamais les tenants avec lesquels ils ne sont pas autorisés à interagir.", - "parent": "V8.4" - }, - { - "bom-ref": "V8.4.2", - "identifier": "V8.4.2", - "text": "Vérifiez que l'accès aux interfaces administratives intègre plusieurs couches de sécurité, notamment la vérification continue de l'identité du consommateur, l'évaluation de la posture de sécurité des appareils et l'analyse contextuelle des risques, garantissant que l'emplacement du réseau ou les endpoints approuvés ne sont pas les seuls facteurs d'autorisation, même s'ils peuvent réduire la probabilité d'accès non autorisé.", - "parent": "V8.4" - }, - { - "bom-ref": "V9", - "identifier": "V9", - "title": "Jetons autonomes" - }, - { - "bom-ref": "V9.1", - "identifier": "V9.1", - "title": "Source et intégrité du jeton", - "parent": "V9" - }, - { - "bom-ref": "V9.1.1", - "identifier": "V9.1.1", - "text": "Vérifiez que les jetons autonomes sont validés à l'aide de leur signature numérique ou MAC pour les protéger contre toute falsification avant d'accepter le contenu du jeton.", - "parent": "V9.1" - }, - { - "bom-ref": "V9.1.2", - "identifier": "V9.1.2", - "text": "Vérifiez que seuls les algorithmes d'une liste d’autorisations peuvent être utilisés pour créer et vérifier des jetons autonomes, dans un contexte donné. La liste d'autorisation doit inclure les algorithmes autorisés, idéalement symétriques ou asymétriques, et ne doit pas inclure l'algorithme « Aucun ». Si les algorithmes symétriques et asymétriques doivent être pris en charge, des contrôles supplémentaires seront nécessaires pour éviter toute confusion de clés.", - "parent": "V9.1" - }, - { - "bom-ref": "V9.1.3", - "identifier": "V9.1.3", - "text": "Vérifiez que les clés utilisées pour valider les jetons autonomes proviennent de sources préconfigurées et fiables pour l'émetteur du jeton, empêchant ainsi les attaquants de spécifier des sources et des clés non fiables. Pour les JWT et autres structures JWS, les en-têtes tels que « jku », « x5u » et « jwk » doivent être validés par rapport à une liste d'autorisation de sources fiables.", - "parent": "V9.1" - }, - { - "bom-ref": "V9.2", - "identifier": "V9.2", - "title": "Contenu du jeton", - "parent": "V9" - }, - { - "bom-ref": "V9.2.1", - "identifier": "V9.2.1", - "text": "Vérifiez que, si une période de validité est indiquée dans les données du jeton, celui-ci et son contenu ne sont acceptés que si la date de vérification est comprise dans cette période. Par exemple, pour les JWT, les déclarations « nbf » et « exp » doivent être vérifiées.", - "parent": "V9.2" - }, - { - "bom-ref": "V9.2.2", - "identifier": "V9.2.2", - "text": "Vérifiez que le service recevant un jeton valide le type de jeton et son utilisation avant d'en accepter le contenu. Par exemple, seuls les jetons d'accès peuvent être acceptés pour les décisions d'autorisation, et seuls les jetons d'identification peuvent être utilisés pour prouver l'authentification des utilisateurs.", - "parent": "V9.2" - }, - { - "bom-ref": "V9.2.3", - "identifier": "V9.2.3", - "text": "Vérifiez que le service accepte uniquement les jetons destinés à être utilisés avec ce service (audience). Pour les JWT, cela peut être réalisé en validant la déclaration « aud » par rapport à une liste d'autorisation définie dans le service.", - "parent": "V9.2" - }, - { - "bom-ref": "V9.2.4", - "identifier": "V9.2.4", - "text": "Si un émetteur de jetons utilise la même clé privée pour émettre des jetons destinés à différentes audiences, vérifiez que les jetons émis contiennent une restriction d'audience identifiant de manière unique les audiences visées. Cela empêchera la réutilisation d'un jeton avec une audience non prévue. Si l'identifiant d'audience est provisionné dynamiquement, l'émetteur de jetons doit valider ces audiences afin de garantir qu'elles n'entraînent pas d'usurpation d'identité.", - "parent": "V9.2" - }, - { - "bom-ref": "V10", - "identifier": "V10", - "title": "Oauth et OIDC" - }, - { - "bom-ref": "V10.1", - "identifier": "V10.1", - "title": "Sécurité générique OAuth et OIDC", - "parent": "V10" - }, - { - "bom-ref": "V10.1.1", - "identifier": "V10.1.1", - "text": "Vérifiez que les jetons sont envoyés uniquement aux composants qui en ont absolument besoin. Par exemple, lors de l'utilisation d'un modèle backend-for-frontend pour les applications JavaScript basées sur un navigateur, les jetons d'accès et d'actualisation ne doivent être accessibles qu'au backend.", - "parent": "V10.1" - }, - { - "bom-ref": "V10.1.2", - "identifier": "V10.1.2", - "text": "Vérifiez que le client n'accepte les valeurs du serveur d'autorisation (telles que le code d'autorisation ou le jeton d'identification) que si elles résultent d'un flux d'autorisation initié par la même session d'agent utilisateur et la même transaction. Cela nécessite que les secrets générés par le client, tels que la clé de preuve pour l'échange de codes (PKCE) « code_verifier », « state » ou le nonce OIDC, ne puissent être devinés, soient spécifiques à la transaction et soient liés de manière sécurisée au client et à la session d'agent utilisateur au cours de laquelle la transaction a été initiée.", - "parent": "V10.1" - }, - { - "bom-ref": "V10.2", - "identifier": "V10.2", - "title": "Client OAuth", - "parent": "V10" - }, - { - "bom-ref": "V10.2.1", - "identifier": "V10.2.1", - "text": "Vérifiez que, si le flux de code est utilisé, le client OAuth dispose d'une protection contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF), qui déclenchent des demandes de jetons, soit en utilisant la fonctionnalité de clé de preuve pour l'échange de code (PKCE), soit en vérifiant le paramètre « state » envoyé dans la demande d'autorisation.", - "parent": "V10.2" - }, - { - "bom-ref": "V10.2.2", - "identifier": "V10.2.2", - "text": "Vérifiez que, si le client OAuth peut interagir avec plusieurs serveurs d'autorisation, il dispose d'une protection contre les attaques par confusion. Par exemple, il peut exiger que le serveur d'autorisation renvoie la valeur du paramètre « iss » et la valide dans la réponse d'autorisation et la réponse du jeton.", - "parent": "V10.2" - }, - { - "bom-ref": "V10.2.3", - "identifier": "V10.2.3", - "text": "Vérifiez que le client OAuth demande uniquement les portées requises (ou d’autres paramètres d’autorisation) dans les requêtes adressées au serveur d’autorisation.", - "parent": "V10.2" - }, - { - "bom-ref": "V10.3", - "identifier": "V10.3", - "title": "Serveur de ressources OAuth", - "parent": "V10" - }, - { - "bom-ref": "V10.3.1", - "identifier": "V10.3.1", - "text": "Vérifiez que le serveur de ressources accepte uniquement les jetons d'accès destinés à être utilisés avec ce service (audience). L'audience peut être incluse dans un jeton d'accès structuré (comme la déclaration « aud » dans JWT) ou vérifiée à l'aide du endpoint d'introspection de jeton.", - "parent": "V10.3" - }, - { - "bom-ref": "V10.3.2", - "identifier": "V10.3.2", - "text": "Vérifiez que le serveur de ressources applique les décisions d'autorisation en fonction des déclarations du jeton d'accès définissant l'autorisation déléguée. Si des déclarations telles que « sub », « scope » et « authorization_details » sont présentes, elles doivent être prises en compte dans la décision.", - "parent": "V10.3" - }, - { - "bom-ref": "V10.3.3", - "identifier": "V10.3.3", - "text": "Vérifiez que si une décision de contrôle d'accès nécessite l'identification d'un utilisateur unique à partir d'un jeton d'accès (JWT ou réponse d'introspection de jeton associé), le serveur de ressources identifie l'utilisateur à partir de déclarations non ré attribuables à d'autres utilisateurs. En général, cela implique l'utilisation d'une combinaison de déclarations « iss » et « sub ».", - "parent": "V10.3" - }, - { - "bom-ref": "V10.3.4", - "identifier": "V10.3.4", - "text": "Si le serveur de ressources requiert une force d'authentification, des méthodes ou une date d'expiration spécifiques, vérifiez que le jeton d'accès présenté respecte ces contraintes. Par exemple, s'il est présent, utilisez les déclarations OIDC « acr », « amr » et « auth_time » respectivement.", - "parent": "V10.3" - }, - { - "bom-ref": "V10.3.5", - "identifier": "V10.3.5", - "text": "Vérifiez que le serveur de ressources empêche l'utilisation de jetons d'accès volés ou la relecture de jetons d'accès (de parties non autorisées) en exigeant des jetons d'accès limités par l'expéditeur, soit Mutual TLS pour OAuth 2, soit OAuth 2 Demonstration of Proof of Possession (DPoP).", - "parent": "V10.3" - }, - { - "bom-ref": "V10.4", - "identifier": "V10.4", - "title": "Serveur d'autorisation OAuth", - "parent": "V10" - }, - { - "bom-ref": "V10.4.1", - "identifier": "V10.4.1", - "text": "Vérifiez que le serveur d'autorisation valide les URI de redirection en fonction d'une liste d'autorisation spécifique au client d'URI préenregistrés à l'aide d'une comparaison de chaînes exacte.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.2", - "identifier": "V10.4.2", - "text": "Vérifiez que, si le serveur d'autorisation renvoie le code d'autorisation dans la réponse, celui-ci ne peut être utilisé qu'une seule fois pour une demande de jeton. Pour la deuxième demande valide avec un code d'autorisation déjà utilisé pour émettre un jeton d'accès, le serveur d'autorisation doit rejeter la demande de jeton et révoquer tous les jetons émis liés au code d'autorisation.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.3", - "identifier": "V10.4.3", - "text": "Vérifiez que le code d'autorisation est de courte durée. La durée de vie maximale peut atteindre 10 minutes pour les applications L1 et L2 et 1 minute pour les applications L3.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.4", - "identifier": "V10.4.4", - "text": "Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement l'utilisation des autorisations nécessaires à ce client. Notez que les autorisations « token » (flux implicite) et « password » (flux d'informations d'identification du propriétaire de la ressource) ne doivent plus être utilisées.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.5", - "identifier": "V10.4.5", - "text": "Vérifiez que le serveur d'autorisation atténue les attaques par rejeu de jetons d'actualisation pour les clients publics, de préférence en utilisant des jetons d'actualisation limités par l'expéditeur, par exemple des jetons DPoP (Demonstrating Proof of Possession) ou des jetons d'accès liés à un certificat utilisant le protocole TLS mutuel (mTLS). Pour les applications L1 et L2, la rotation des jetons d'actualisation peut être utilisée. Si cette rotation est utilisée, le serveur d'autorisation doit invalider le jeton d'actualisation après utilisation et révoquer tous les jetons d'actualisation de cette autorisation si un jeton d'actualisation déjà utilisé et invalidé est fourni.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.6", - "identifier": "V10.4.6", - "text": "Vérifiez que, si l'octroi de code est utilisé, le serveur d'autorisation atténue les attaques par interception de code en exigeant une clé de preuve pour l'échange de code (PKCE). Pour les demandes d'autorisation, le serveur d'autorisation doit exiger une valeur « code_challenge » valide et ne doit pas accepter une valeur « plain » pour « code_challenge_method ». Pour une demande de jeton, il doit exiger la validation du paramètre « code_verifier ».", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.7", - "identifier": "V10.4.7", - "text": "Vérifiez que si le serveur d'autorisation prend en charge l'enregistrement dynamique des clients non authentifiés, il réduit le risque d'applications clientes malveillantes. Il doit valider les métadonnées clientes, telles que les URI enregistrés, garantir le consentement de l'utilisateur et l'avertir avant de traiter une demande d'autorisation avec une application cliente non approuvée.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.8", - "identifier": "V10.4.8", - "text": "Vérifiez que les jetons d’actualisation ont une expiration absolue, y compris si l’expiration du jeton d’actualisation glissant est appliquée.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.9", - "identifier": "V10.4.9", - "text": "Vérifiez que les jetons d'actualisation et les jetons d'accès de référence peuvent être révoqués par un utilisateur autorisé à l'aide de l'interface utilisateur du serveur d'autorisation, afin d'atténuer le risque de clients malveillants ou de jetons volés.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.10", - "identifier": "V10.4.10", - "text": "Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.11", - "identifier": "V10.4.11", - "text": "Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.12", - "identifier": "V10.4.12", - "text": "Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement la valeur « response_mode » dont ce client a besoin. Par exemple, en vérifiant cette valeur par rapport aux valeurs attendues ou en utilisant une requête d'autorisation poussée (PAR) ou une requête d'autorisation sécurisée par JWT (JAR).", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.13", - "identifier": "V10.4.13", - "text": "Vérifiez que le type d'Autorisation « code » est toujours utilisé avec les demandes d'autorisation poussées (PAR).", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.14", - "identifier": "V10.4.14", - "text": "Vérifiez que le serveur d'autorisation émet uniquement des jetons d'accès limités à l'expéditeur (preuve de possession), soit avec des jetons d'accès liés au certificat utilisant TLS mutuel (mTLS), soit avec des jetons d'accès liés au DPoP (démonstration de preuve de possession).", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.15", - "identifier": "V10.4.15", - "text": "Vérifiez que, pour un client côté serveur (non exécuté sur l'appareil de l'utilisateur final), le serveur d'autorisation garantit que la valeur du paramètre « authorization_details » provient du backend client et que l'utilisateur ne l'a pas altérée. Par exemple, en exigeant l'utilisation d'une demande d'autorisation poussée (PAR) ou d'une demande d'autorisation sécurisée par JWT (JAR).", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.16", - "identifier": "V10.4.16", - "text": "Vérifiez que le client est confidentiel et que le serveur d'autorisation requiert l'utilisation de méthodes d'authentification client fortes (basées sur la cryptographie à clé publique et résistantes aux attaques par relecture), telles que TLS mutuel ('tls_client_auth', 'self_signed_tls_client_auth') ou JWT à clé privée ('private_key_jwt').", - "parent": "V10.4" - }, - { - "bom-ref": "V10.5", - "identifier": "V10.5", - "title": "Client OIDC", - "parent": "V10" - }, - { - "bom-ref": "V10.5.1", - "identifier": "V10.5.1", - "text": "Vérifiez que le client (en tant que partie utilisatrice) atténue les attaques par rejeu de jeton d'identification. Par exemple, en vous assurant que la valeur « nonce » du jeton d'identification correspond à la valeur « nonce » envoyée dans la demande d'authentification au fournisseur OpenID (appelée demande d'autorisation envoyée au serveur d'autorisation dans OAuth2).", - "parent": "V10.5" - }, - { - "bom-ref": "V10.5.2", - "identifier": "V10.5.2", - "text": "Vérifiez que le client identifie de manière unique l'utilisateur à partir des déclarations de jeton d'identification, généralement la déclaration « sub », qui ne peut pas être réaffectée à d'autres utilisateurs (pour la portée d'un fournisseur d'identité).", - "parent": "V10.5" - }, - { - "bom-ref": "V10.5.3", - "identifier": "V10.5.3", - "text": "Vérifiez que le client rejette les tentatives d'un serveur d'autorisation malveillant d'usurper l'identité d'un autre serveur d'autorisation via ses métadonnées. Le client doit rejeter les métadonnées du serveur d'autorisation si l'URL de l'émetteur figurant dans ces métadonnées ne correspond pas exactement à l'URL d'émetteur préconfigurée attendue par le client.", - "parent": "V10.5" - }, - { - "bom-ref": "V10.5.4", - "identifier": "V10.5.4", - "text": "Vérifiez que le client valide que le jeton d'identification est destiné à être utilisé pour ce client (audience) en vérifiant que la déclaration « aud » du jeton est égale à la valeur « client_id » pour le client.", - "parent": "V10.5" - }, - { - "bom-ref": "V10.5.5", - "identifier": "V10.5.5", - "text": "Vérifiez que, lors de l'utilisation de la déconnexion du back-channel OIDC, la partie utilisatrice atténue les risques de déni de service liés à la déconnexion forcée et à la confusion entre JWT dans le flux de déconnexion. Le client doit vérifier que le jeton de déconnexion est correctement typé avec la valeur « logout+jwt », qu'il contient la déclaration « event » avec le nom de membre correct et qu'il ne contient pas de déclaration « nonce ». Il est également recommandé d'utiliser une expiration courte (par exemple, 2 minutes).", - "parent": "V10.5" - }, - { - "bom-ref": "V10.6", - "identifier": "V10.6", - "title": "Fournisseur OpenID", - "parent": "V10" - }, - { - "bom-ref": "V10.6.1", - "identifier": "V10.6.1", - "text": "Vérifiez que le fournisseur OpenID n'autorise que les valeurs « code », « ciba », « id_token » ou « id_token code » pour le mode de réponse. Notez que « code » est préférable à « id_token code » (flux hybride OIDC) et que « token » (tout flux implicite) ne doit pas être utilisé.", - "parent": "V10.6" - }, - { - "bom-ref": "V10.6.2", - "identifier": "V10.6.2", - "text": "Vérifiez que le fournisseur OpenID atténue les risques de déni de service liés à la déconnexion forcée. Pour ce faire, obtenez une confirmation explicite de l'utilisateur final ou, le cas échéant, validez les paramètres de la requête de déconnexion (initiée par la partie utilisatrice), comme « id_token_hint ».", - "parent": "V10.6" - }, - { - "bom-ref": "V10.7", - "identifier": "V10.7", - "title": "Gestion du consentement", - "parent": "V10" - }, - { - "bom-ref": "V10.7.1", - "identifier": "V10.7.1", - "text": "Vérifiez que le serveur d'autorisation garantit le consentement de l'utilisateur à chaque demande d'autorisation. Si l'identité du client ne peut être garantie, le serveur d'autorisation doit toujours demander explicitement le consentement de l'utilisateur.", - "parent": "V10.7" - }, - { - "bom-ref": "V10.7.2", - "identifier": "V10.7.2", - "text": "Vérifiez que lorsque le serveur d'autorisation demande le consentement de l'utilisateur, il fournit des informations claires et suffisantes sur ce qui est consenti. Le cas échéant, ces informations doivent inclure la nature des autorisations demandées (généralement en fonction de la portée, du serveur de ressources et des détails d'autorisation RAR), l'identité de l'application autorisée et la durée de vie de ces autorisations.", - "parent": "V10.7" - }, - { - "bom-ref": "V10.7.3", - "identifier": "V10.7.3", - "text": "Vérifiez que l’utilisateur peut consulter, modifier et révoquer les consentements qu’il a accordés via le serveur d’autorisation.", - "parent": "V10.7" - }, - { - "bom-ref": "V11", - "identifier": "V11", - "title": "Cryptographie" - }, - { - "bom-ref": "V11.1", - "identifier": "V11.1", - "title": "Inventaire et documentation cryptographiques", - "parent": "V11" - }, - { - "bom-ref": "V11.1.1", - "identifier": "V11.1.1", - "text": "Vérifiez qu’il existe une politique documentée pour la gestion des clés cryptographiques et un cycle de vie des clés cryptographiques qui suit une norme de gestion des clés telle que NIST SP 800-57. Cela devrait inclure la garantie que les clés ne sont pas sur-partagées (par exemple, avec plus de deux entités pour les secrets partagés et plus d’une entité pour les clés privées).", - "parent": "V11.1" - }, - { - "bom-ref": "V11.1.2", - "identifier": "V11.1.2", - "text": "Vérifiez qu'un inventaire cryptographique est réalisé, maintenu et régulièrement mis à jour, et qu'il inclut toutes les clés, algorithmes et certificats cryptographiques utilisés par l'application. Il doit également documenter les emplacements du système où les clés peuvent ou non être utilisées, ainsi que les types de données qui peuvent ou non être protégées par ces clés.", - "parent": "V11.1" - }, - { - "bom-ref": "V11.1.3", - "identifier": "V11.1.3", - "text": "Vérifiez que les mécanismes de découverte cryptographique sont utilisés pour identifier toutes les instances de cryptographie dans le système, y compris les opérations de chiffrement, de hachage et de signature.", - "parent": "V11.1" - }, - { - "bom-ref": "V11.1.4", - "identifier": "V11.1.4", - "text": "Vérifier la tenue d'un inventaire cryptographique. Celui-ci doit inclure un plan documenté décrivant la migration vers de nouvelles normes cryptographiques, telles que la cryptographie post-quantique, afin de réagir aux menaces futures.", - "parent": "V11.1" - }, - { - "bom-ref": "V11.2", - "identifier": "V11.2", - "title": "Mise en œuvre sécurisée de la cryptographie", - "parent": "V11" - }, - { - "bom-ref": "V11.2.1", - "identifier": "V11.2.1", - "text": "Vérifiez que les implémentations validées par l’industrie (y compris les bibliothèques et les implémentations accélérées par le matériel) sont utilisées pour les opérations cryptographiques.", - "parent": "V11.2" - }, - { - "bom-ref": "V11.2.2", - "identifier": "V11.2.2", - "text": "Vérifiez que l'application est conçue avec une agilité cryptographique, de sorte que les nombres aléatoires, le chiffrement authentifié, le MAC ou les algorithmes de hachage, les longueurs de clés, les tours, les chiffrements et les modes puissent être reconfigurés, mis à niveau ou échangés à tout moment, afin de se protéger contre les failles cryptographiques. De même, il doit être possible de remplacer les clés et les mots de passe, ainsi que de rechiffrer les données. Cela permettra des mises à niveau transparentes vers la cryptographie post-quantique (PQC), une fois que des implémentations hautement sécurisées de schémas ou de normes PQC approuvés seront largement disponibles.", - "parent": "V11.2" - }, - { - "bom-ref": "V11.2.3", - "identifier": "V11.2.3", - "text": "Vérifiez que toutes les primitives cryptographiques utilisent un minimum de 128 bits de sécurité en fonction de l'algorithme, de la taille de la clé et de la configuration. Par exemple, une clé ECC de 256 bits offre environ 128 bits de sécurité, tandis que RSA nécessite une clé de 3072 bits pour atteindre 128 bits de sécurité.", - "parent": "V11.2" - }, - { - "bom-ref": "V11.2.4", - "identifier": "V11.2.4", - "text": "Vérifiez que toutes les opérations cryptographiques sont à temps constant, sans opérations de « court-circuit » dans les comparaisons, les calculs ou les retours, pour éviter toute fuite d'informations.", - "parent": "V11.2" - }, - { - "bom-ref": "V11.2.5", - "identifier": "V11.2.5", - "text": "Vérifiez que tous les modules cryptographiques échouent en toute sécurité et que les erreurs sont gérées de manière à ne pas permettre de vulnérabilités, telles que les attaques Padding Oracle.", - "parent": "V11.2" - }, - { - "bom-ref": "V11.3", - "identifier": "V11.3", - "title": "Algorithmes de chiffrement", - "parent": "V11" - }, - { - "bom-ref": "V11.3.1", - "identifier": "V11.3.1", - "text": "Vérifiez que les modes de bloc non sécurisés (par exemple, ECB) et les schémas de remplissage faibles (par exemple, PKCS#1 v1.5) ne sont pas utilisés.", - "parent": "V11.3" - }, - { - "bom-ref": "V11.3.2", - "identifier": "V11.3.2", - "text": "Vérifiez que seuls les chiffrements et modes approuvés tels que AES avec GCM sont utilisés.", - "parent": "V11.3" - }, - { - "bom-ref": "V11.3.3", - "identifier": "V11.3.3", - "text": "Vérifiez que les données chiffrées sont protégées contre toute modification non autorisée, de préférence en utilisant une méthode de chiffrement authentifiée approuvée ou en combinant une méthode de chiffrement approuvée avec un algorithme MAC approuvé.", - "parent": "V11.3" - }, - { - "bom-ref": "V11.3.4", - "identifier": "V11.3.4", - "text": "Vérifiez que les nonces, les vecteurs d'initialisation et autres nombres à usage unique ne sont pas utilisés pour plus d'une paire clé de chiffrement/élément de données. La méthode de génération doit être adaptée à l'algorithme utilisé.", - "parent": "V11.3" - }, - { - "bom-ref": "V11.3.5", - "identifier": "V11.3.5", - "text": "Vérifiez que toute combinaison d'un algorithme de chiffrement et d'un algorithme MAC fonctionne en mode chiffrement puis MAC.", - "parent": "V11.3" - }, - { - "bom-ref": "V11.4", - "identifier": "V11.4", - "title": "Hachage et fonctions basées sur le hachage", - "parent": "V11" - }, - { - "bom-ref": "V11.4.1", - "identifier": "V11.4.1", - "text": "Vérifiez que seules les fonctions de hachage approuvées sont utilisées pour les cas d'utilisation cryptographiques généraux, notamment les signatures numériques, HMAC, KDF et la génération de bits aléatoires. Les fonctions de hachage non autorisées, telles que MD5, ne doivent pas être utilisées à des fins cryptographiques.", - "parent": "V11.4" - }, - { - "bom-ref": "V11.4.2", - "identifier": "V11.4.2", - "text": "Vérifiez que les mots de passe sont stockés à l'aide d'une fonction de dérivation de clés approuvée et gourmande en ressources de calcul (également appelée « fonction de hachage de mots de passe »), dont les paramètres sont configurés conformément aux directives en vigueur. Ces paramètres doivent équilibrer sécurité et performances afin de rendre les attaques par force brute suffisamment difficiles pour le niveau de sécurité requis.", - "parent": "V11.4" - }, - { - "bom-ref": "V11.4.3", - "identifier": "V11.4.3", - "text": "Vérifiez que les fonctions de hachage utilisées dans les signatures numériques, dans le cadre de l'authentification ou de l'intégrité des données, sont résistantes aux collisions et possèdent des longueurs de bits appropriées. Si la résistance aux collisions est requise, la longueur de sortie doit être d'au moins 256 bits. Si seule la résistance aux attaques de seconde pré-image est requise, la longueur de sortie doit être d'au moins 128 bits.", - "parent": "V11.4" - }, - { - "bom-ref": "V11.4.4", - "identifier": "V11.4.4", - "text": "Vérifiez que l'application utilise des fonctions de dérivation de clés approuvées avec des paramètres d'extension de clés lors de la dérivation de clés secrètes à partir de mots de passe. Les paramètres utilisés doivent concilier sécurité et performances afin d'empêcher les attaques par force brute de compromettre la clé cryptographique obtenue.", - "parent": "V11.4" - }, - { - "bom-ref": "V11.5", - "identifier": "V11.5", - "title": "Valeurs aléatoires", - "parent": "V11" - }, - { - "bom-ref": "V11.5.1", - "identifier": "V11.5.1", - "text": "Vérifiez que tous les nombres et chaînes aléatoires destinés à être non devinables doivent être générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et posséder au moins 128 bits d'entropie. Notez que les UUID ne respectent pas cette condition.", - "parent": "V11.5" - }, - { - "bom-ref": "V11.5.2", - "identifier": "V11.5.2", - "text": "Vérifiez que le mécanisme de génération de nombres aléatoires utilisé est conçu pour fonctionner en toute sécurité, même en cas de forte demande.", - "parent": "V11.5" - }, - { - "bom-ref": "V11.6", - "identifier": "V11.6", - "title": "Cryptographie à clé publique", - "parent": "V11" - }, - { - "bom-ref": "V11.6.1", - "identifier": "V11.6.1", - "text": "Vérifier que seuls des algorithmes cryptographiques et des modes opératoires approuvés sont utilisés pour la génération et l'amorçage des clés, ainsi que pour la génération et la vérification des signatures numériques. Les algorithmes de génération de clés ne doivent pas générer de clés non sécurisées et vulnérables aux attaques connues, par exemple les clés RSA vulnérables à la factorisation de Fermat.", - "parent": "V11.6" - }, - { - "bom-ref": "V11.6.2", - "identifier": "V11.6.2", - "text": "Vérifiez que des algorithmes cryptographiques approuvés sont utilisés pour l'échange de clés (tels que Diffie-Hellman), en veillant à ce que les mécanismes d'échange de clés utilisent des paramètres sécurisés. Cela permettra d'éviter les attaques contre le processus d'établissement des clés, susceptibles de conduire à des attaques de type « adversaire du milieu » ou à des failles cryptographiques.", - "parent": "V11.6" - }, - { - "bom-ref": "V11.7", - "identifier": "V11.7", - "title": "Cryptographie des données en cours d'utilisation", - "parent": "V11" - }, - { - "bom-ref": "V11.7.1", - "identifier": "V11.7.1", - "text": "Vérifiez que le chiffrement complet de la mémoire est utilisé pour protéger les données sensibles pendant leur utilisation, empêchant ainsi l'accès par des utilisateurs ou des processus non autorisés.", - "parent": "V11.7" - }, - { - "bom-ref": "V11.7.2", - "identifier": "V11.7.2", - "text": "Vérifiez que la minimisation des données garantit que la quantité minimale de données est exposée pendant le traitement et assurez-vous que les données sont chiffrées immédiatement après utilisation ou dès que possible.", - "parent": "V11.7" - }, - { - "bom-ref": "V12", - "identifier": "V12", - "title": "Communication sécurisée" - }, - { - "bom-ref": "V12.1", - "identifier": "V12.1", - "title": "Conseils généraux de sécurité TLS", - "parent": "V12" - }, - { - "bom-ref": "V12.1.1", - "identifier": "V12.1.1", - "text": "Vérifiez que seules les dernières versions recommandées du protocole TLS sont activées, telles que TLS 1.2 et TLS 1.3. La dernière version du protocole TLS doit être privilégiée.", - "parent": "V12.1" - }, - { - "bom-ref": "V12.1.2", - "identifier": "V12.1.2", - "text": "Vérifiez que seules les suites de chiffrement recommandées sont activées, les suites de chiffrement les plus puissantes étant définies comme préférées. Les applications L3 doivent uniquement prendre en charge les suites de chiffrement assurant la confidentialité persistante (forward secrecy).", - "parent": "V12.1" - }, - { - "bom-ref": "V12.1.3", - "identifier": "V12.1.3", - "text": "Vérifiez que l’application valide que les certificats clients mTLS sont approuvés avant d’utiliser l’identité du certificat pour l’authentification ou l’autorisation.", - "parent": "V12.1" - }, - { - "bom-ref": "V12.1.4", - "identifier": "V12.1.4", - "text": "Vérifiez que la révocation de certification appropriée, telle que l'agrafage du protocole OCSP (Online Certificate Status Protocol), est activée et configurée.", - "parent": "V12.1" - }, - { - "bom-ref": "V12.1.5", - "identifier": "V12.1.5", - "text": "Vérifiez que Encrypted Client Hello (ECH) est activé dans les paramètres TLS de l'application pour empêcher l'exposition de métadonnées sensibles, telles que l'indication du nom du serveur (SNI), pendant les processus de négociation TLS.", - "parent": "V12.1" - }, - { - "bom-ref": "V12.2", - "identifier": "V12.2", - "title": "Communication HTTPS avec des services externes", - "parent": "V12" - }, - { - "bom-ref": "V12.2.1", - "identifier": "V12.2.1", - "text": "Vérifiez que TLS est utilisé pour toute connectivité entre un client et des services externes basés sur HTTP, et ne recourt pas à des communications non sécurisées ou non chiffrées.", - "parent": "V12.2" - }, - { - "bom-ref": "V12.2.2", - "identifier": "V12.2.2", - "text": "Vérifiez que les services externes utilisent des certificats TLS publiquement approuvés.", - "parent": "V12.2" - }, - { - "bom-ref": "V12.3", - "identifier": "V12.3", - "title": "Sécurité des communications entre services généraux", - "parent": "V12" - }, - { - "bom-ref": "V12.3.1", - "identifier": "V12.3.1", - "text": "Vérifiez qu'un protocole chiffré tel que TLS est utilisé pour toutes les connexions entrantes et sortantes vers et depuis l'application, y compris les systèmes de surveillance, les outils de gestion, l'accès à distance et SSH, les intergiciels, les bases de données, les mainframes, les systèmes partenaires ou les API externes. Le serveur ne doit pas recourir à des protocoles non sécurisés ou non chiffrés.", - "parent": "V12.3" - }, - { - "bom-ref": "V12.3.2", - "identifier": "V12.3.2", - "text": "Vérifiez que les clients TLS valident les certificats reçus avant de communiquer avec un serveur TLS.", - "parent": "V12.3" - }, - { - "bom-ref": "V12.3.3", - "identifier": "V12.3.3", - "text": "Vérifiez que TLS ou un autre mécanisme de chiffrement de transport approprié est utilisé pour toute connectivité entre les services internes basés sur HTTP au sein de l'application et ne se replie pas vers des communications non sécurisées ou non chiffrées.", - "parent": "V12.3" - }, - { - "bom-ref": "V12.3.4", - "identifier": "V12.3.4", - "text": "Vérifiez que les connexions TLS entre les services internes utilisent des certificats de confiance. Lorsque des certificats générés en interne ou auto-signés sont utilisés, le service consommateur doit être configuré pour n'approuver que des autorités de certification internes spécifiques et des certificats auto-signés spécifiques.", - "parent": "V12.3" - }, - { - "bom-ref": "V12.3.5", - "identifier": "V12.3.5", - "text": "Vérifiez que les services communiquant en interne au sein d'un système (communications intra-services) utilisent une authentification forte pour garantir la vérification de chaque endpoint. Des méthodes d'authentification forte, telles que l'authentification client TLS, doivent être utilisées pour garantir l'identité, en utilisant une infrastructure à clé publique et des mécanismes résistants aux attaques par rejeu. Pour les architectures de microservices, envisagez d'utiliser un maillage de services pour simplifier la gestion des certificats et renforcer la sécurité.", - "parent": "V12.3" - }, - { - "bom-ref": "V13", - "identifier": "V13", - "title": "Configuration" - }, - { - "bom-ref": "V13.1", - "identifier": "V13.1", - "title": "Documentation de configuration", - "parent": "V13" - }, - { - "bom-ref": "V13.1.1", - "identifier": "V13.1.1", - "text": "Vérifiez que tous les besoins de communication de l'application sont documentés. Cela doit inclure les services externes dont l'application dépend et les cas où un utilisateur final pourrait fournir un emplacement externe auquel l'application se connectera.", - "parent": "V13.1" - }, - { - "bom-ref": "V13.1.2", - "identifier": "V13.1.2", - "text": "Vérifiez que pour chaque service utilisé par l'application, la documentation définit le nombre maximal de connexions simultanées (par exemple, les limites du pool de connexions) et le comportement de l'application lorsque cette limite est atteinte, y compris les mécanismes de secours ou de récupération, pour éviter les conditions de déni de service.", - "parent": "V13.1" - }, - { - "bom-ref": "V13.1.3", - "identifier": "V13.1.3", - "text": "Vérifiez que la documentation de l'application définit des stratégies de gestion des ressources pour chaque système ou service externe utilisé (par exemple, bases de données, descripteurs de fichiers, threads, connexions HTTP). Cela doit inclure les procédures de libération des ressources, les paramètres de délai d'expiration, la gestion des échecs et l'implémentation de la logique de nouvelle tentative, en spécifiant les limites de nouvelle tentative, les délais et les algorithmes de retour arrière. Pour les opérations de requête-réponse HTTP synchrones, la documentation doit imposer des délais d'expiration courts et soit désactiver les nouvelles tentatives, soit les limiter strictement afin d'éviter les retards en cascade et l'épuisement des ressources.", - "parent": "V13.1" - }, - { - "bom-ref": "V13.1.4", - "identifier": "V13.1.4", - "text": "Vérifiez que la documentation de l'application définit les secrets essentiels à la sécurité de l'application et un calendrier de rotation de ceux-ci, en fonction du modèle de menace et des exigences commerciales de l'organisation.", - "parent": "V13.1" - }, - { - "bom-ref": "V13.2", - "identifier": "V13.2", - "title": "Configuration de la communication backend", - "parent": "V13" - }, - { - "bom-ref": "V13.2.1", - "identifier": "V13.2.1", - "text": "Vérifiez que les communications entre les composants de l'application backend qui ne prennent pas en charge le mécanisme de session utilisateur standard de l'application, notamment les API, les intergiciels et les couches de données, sont authentifiées. L'authentification doit utiliser des comptes de service individuels, des jetons à court terme ou une authentification par certificat, et non des identifiants immuables tels que des mots de passe, des clés API ou des comptes partagés avec accès privilégié.", - "parent": "V13.2" - }, - { - "bom-ref": "V13.2.2", - "identifier": "V13.2.2", - "text": "Vérifiez que les communications entre les composants de l'application backend, y compris les services locaux ou du système d'exploitation, les API, les intergiciels et les couches de données, sont effectuées avec des comptes dotés des privilèges les moins nécessaires.", - "parent": "V13.2" - }, - { - "bom-ref": "V13.2.3", - "identifier": "V13.2.3", - "text": "Vérifiez que si des informations d’identification doivent être utilisées pour l’authentification du service, les informations d’identification utilisées par le consommateur ne sont pas des informations d’identification par défaut (par exemple, root/root ou admin/admin).", - "parent": "V13.2" - }, - { - "bom-ref": "V13.2.4", - "identifier": "V13.2.4", - "text": "Vérifiez qu'une liste d’autorisations est utilisée pour définir les ressources ou systèmes externes avec lesquels l'application est autorisée à communiquer (par exemple, pour les requêtes sortantes, les chargements de données ou l'accès aux fichiers). Cette liste d'autorisation peut être implémentée au niveau de la couche applicative, du serveur web, du pare-feu ou d'une combinaison de différentes couches.", - "parent": "V13.2" - }, - { - "bom-ref": "V13.2.5", - "identifier": "V13.2.5", - "text": "Vérifiez que le serveur Web ou d’application est configuré avec une liste autorisée de ressources ou de systèmes vers lesquels le serveur peut envoyer des requêtes ou charger des données ou des fichiers.", - "parent": "V13.2" - }, - { - "bom-ref": "V13.2.6", - "identifier": "V13.2.6", - "text": "Vérifiez que lorsque l'application se connecte à des services distincts, elle suit la configuration documentée pour chaque connexion, comme le nombre maximal de connexions parallèles, le comportement lorsque le nombre maximal de connexions autorisées est atteint, les délais d'expiration de connexion et les stratégies de nouvelle tentative.", - "parent": "V13.2" - }, - { - "bom-ref": "V13.3", - "identifier": "V13.3", - "title": "Gestion des secrets", - "parent": "V13" - }, - { - "bom-ref": "V13.3.1", - "identifier": "V13.3.1", - "text": "Vérifiez qu'une solution de gestion des secrets, telle qu'un coffre-fort de clés, est utilisée pour créer, stocker, contrôler l'accès et détruire en toute sécurité les secrets backend. Ceux-ci peuvent inclure des mots de passe, du matériel de clé, des intégrations avec des bases de données et des systèmes tiers, des clés et des graines pour des jetons temporels, d'autres secrets internes et des clés API. Les secrets ne doivent pas être inclus dans le code source de l'application ni dans les artefacts de build. Pour une application L3, cela doit impliquer une solution matérielle telle qu'un HSM.", - "parent": "V13.3" - }, - { - "bom-ref": "V13.3.2", - "identifier": "V13.3.2", - "text": "Vérifiez que l’accès aux ressources secrètes respecte le principe du moindre privilège.", - "parent": "V13.3" - }, - { - "bom-ref": "V13.3.3", - "identifier": "V13.3.3", - "text": "Vérifiez que toutes les opérations cryptographiques sont effectuées à l'aide d'un module de sécurité isolé (tel qu'un coffre-fort ou un module de sécurité matériel) pour gérer et protéger en toute sécurité le matériel clé contre toute exposition en dehors du module de sécurité.", - "parent": "V13.3" - }, - { - "bom-ref": "V13.3.4", - "identifier": "V13.3.4", - "text": "Vérifiez que les secrets sont configurés pour expirer et être renouvelés en fonction de la documentation de l'application.", - "parent": "V13.3" - }, - { - "bom-ref": "V13.4", - "identifier": "V13.4", - "title": "Fuite d'informations involontaire", - "parent": "V13" - }, - { - "bom-ref": "V13.4.1", - "identifier": "V13.4.1", - "text": "Vérifiez que l'application est déployée soit sans aucune métadonnée de contrôle de source, y compris les dossiers .git ou .svn, soit de manière à ce que ces dossiers soient inaccessibles à la fois en externe et à l'application elle-même.", - "parent": "V13.4" - }, - { - "bom-ref": "V13.4.2", - "identifier": "V13.4.2", - "text": "Vérifiez que les modes de débogage sont désactivés pour tous les composants dans les environnements de production afin d’éviter l’exposition des fonctionnalités de débogage et la fuite d’informations.", - "parent": "V13.4" - }, - { - "bom-ref": "V13.4.3", - "identifier": "V13.4.3", - "text": "Vérifiez que les serveurs Web n’exposent pas les listes de répertoires aux clients, sauf si cela est explicitement prévu.", - "parent": "V13.4" - }, - { - "bom-ref": "V13.4.4", - "identifier": "V13.4.4", - "text": "Vérifiez que l’utilisation de la méthode HTTP TRACE n’est pas prise en charge dans les environnements de production, afin d’éviter toute fuite d’informations potentielle.", - "parent": "V13.4" - }, - { - "bom-ref": "V13.4.5", - "identifier": "V13.4.5", - "text": "Vérifiez que la documentation (comme pour les API internes) et les endpoints de surveillance ne sont pas exposés, sauf si cela est explicitement prévu.", - "parent": "V13.4" - }, - { - "bom-ref": "V13.4.6", - "identifier": "V13.4.6", - "text": "Vérifiez que l’application n’expose pas d’informations de version détaillées des composants backend.", - "parent": "V13.4" - }, - { - "bom-ref": "V13.4.7", - "identifier": "V13.4.7", - "text": "Vérifiez que la couche web est configuré pour servir uniquement les fichiers avec des extensions de fichier spécifiques afin d’éviter toute fuite involontaire d’informations, de configuration et de code source.", - "parent": "V13.4" - }, - { - "bom-ref": "V14", - "identifier": "V14", - "title": "Protection des données" - }, - { - "bom-ref": "V14.1", - "identifier": "V14.1", - "title": "Documentation sur la protection des données", - "parent": "V14" - }, - { - "bom-ref": "V14.1.1", - "identifier": "V14.1.1", - "text": "Vérifiez que toutes les données sensibles créées et traitées par l'application ont été identifiées et classées selon leur niveau de protection. Cela inclut les données uniquement codées et donc facilement déchiffrables, telles que les chaînes Base64 ou la charge utile en texte clair d'un JWT. Les niveaux de protection doivent tenir compte des réglementations et normes de protection des données et de confidentialité auxquelles l'application est tenue de se conformer.", - "parent": "V14.1" - }, - { - "bom-ref": "V14.1.2", - "identifier": "V14.1.2", - "text": "Vérifier que tous les niveaux de protection des données sensibles sont assortis d'un ensemble documenté d'exigences de protection. Cela doit inclure (sans s'y limiter) les exigences relatives au chiffrement général, à la vérification de l'intégrité, à la conservation, à la journalisation des données, aux contrôles d'accès aux données sensibles dans les journaux, au chiffrement au niveau de la base de données, aux technologies de confidentialité et de renforcement de la confidentialité à utiliser, ainsi qu'aux autres exigences de confidentialité.", - "parent": "V14.1" - }, - { - "bom-ref": "V14.2", - "identifier": "V14.2", - "title": "Protection générale des données", - "parent": "V14" - }, - { - "bom-ref": "V14.2.1", - "identifier": "V14.2.1", - "text": "Vérifiez que les données sensibles sont uniquement envoyées au serveur dans les champs de corps ou d’en-tête du message HTTP, et que l’URL et la chaîne de requête ne contiennent pas d’informations sensibles, telles qu’une clé API ou un jeton de session.", - "parent": "V14.2" - }, - { - "bom-ref": "V14.2.2", - "identifier": "V14.2.2", - "text": "Vérifiez que l’application empêche la mise en cache des données sensibles dans les composants du serveur, tels que les équilibreurs de charge et les caches d’application, ou garantit que les données sont purgées en toute sécurité après utilisation.", - "parent": "V14.2" - }, - { - "bom-ref": "V14.2.3", - "identifier": "V14.2.3", - "text": "Vérifiez que les données sensibles définies ne sont pas envoyées à des parties non fiables (par exemple, des trackers d'utilisateurs) pour empêcher la collecte indésirable de données en dehors du contrôle de l'application.", - "parent": "V14.2" - }, - { - "bom-ref": "V14.2.4", - "identifier": "V14.2.4", - "text": "Vérifiez que les contrôles autour des données sensibles liés au chiffrement, à la vérification de l'intégrité, à la conservation, à la manière dont les données doivent être enregistrées, aux contrôles d'accès autour des données sensibles dans les journaux, à la confidentialité et aux technologies d'amélioration de la confidentialité, sont mis en œuvre comme défini dans la documentation pour le niveau de protection des données spécifiques.", - "parent": "V14.2" - }, - { - "bom-ref": "V14.2.5", - "identifier": "V14.2.5", - "text": "Vérifiez que les mécanismes de mise en cache sont configurés pour ne mettre en cache que les réponses dont le type de contenu est conforme à la ressource et qui ne contiennent pas de contenu sensible et dynamique. Le serveur web doit renvoyer une réponse 404 ou 302 lors de l'accès à un fichier inexistant plutôt qu'un fichier valide différent. Cela devrait empêcher les attaques par empoisonnement de cache web.", - "parent": "V14.2" - }, - { - "bom-ref": "V14.2.6", - "identifier": "V14.2.6", - "text": "Vérifiez que l'application ne renvoie que les données sensibles minimales requises pour son fonctionnement. Par exemple, ne renvoyez que certains chiffres d'un numéro de carte de crédit, et non le numéro complet. Si les données complètes sont requises, elles doivent être masquées dans l'interface utilisateur, sauf si l'utilisateur les consulte spécifiquement.", - "parent": "V14.2" - }, - { - "bom-ref": "V14.2.7", - "identifier": "V14.2.7", - "text": "Vérifiez que les informations sensibles sont soumises à une classification de conservation des données, en veillant à ce que les données obsolètes ou inutiles soient supprimées automatiquement, selon un calendrier défini ou selon les besoins de la situation.", - "parent": "V14.2" - }, - { - "bom-ref": "V14.2.8", - "identifier": "V14.2.8", - "text": "Vérifiez que les informations sensibles sont supprimées des métadonnées des fichiers soumis par l'utilisateur, sauf si le stockage est autorisé par l'utilisateur.", - "parent": "V14.2" - }, - { - "bom-ref": "V14.3", - "identifier": "V14.3", - "title": "Protection des données côté client", - "parent": "V14" - }, - { - "bom-ref": "V14.3.1", - "identifier": "V14.3.1", - "text": "Vérifiez que les données authentifiées sont effacées du stockage client, comme le DOM du navigateur, après la fin du client ou de la session. Le champ d'en-tête de réponse HTTP « Clear-Site-Data » peut être utile, mais le côté client devrait également pouvoir effectuer la correction si la connexion au serveur n'est pas disponible à la fin de la session.", - "parent": "V14.3" - }, - { - "bom-ref": "V14.3.2", - "identifier": "V14.3.2", - "text": "Vérifiez que l'application définit suffisamment de champs d'en-tête de réponse HTTP anti-caching (c'est-à-dire Cache-Control : no-store) afin que les données sensibles ne soient pas mises en cache dans les navigateurs.", - "parent": "V14.3" - }, - { - "bom-ref": "V14.3.3", - "identifier": "V14.3.3", - "text": "Vérifiez que les données stockées dans le stockage du navigateur (telles que localStorage, sessionStorage, IndexedDB ou les cookies) ne contiennent pas de données sensibles, à l'exception des jetons de session.", - "parent": "V14.3" - }, - { - "bom-ref": "V15", - "identifier": "V15", - "title": "Développement et architecture sécurisés" - }, - { - "bom-ref": "V15.1", - "identifier": "V15.1", - "title": "Documentation sur le développement et l'architecture sécurisés", - "parent": "V15" - }, - { - "bom-ref": "V15.1.1", - "identifier": "V15.1.1", - "text": "Vérifiez que la documentation de l'application définit les délais de correction basés sur les risques pour les versions de composants tiers présentant des vulnérabilités et pour la mise à jour des bibliothèques en général, afin de minimiser les risques liés à ces composants.", - "parent": "V15.1" - }, - { - "bom-ref": "V15.1.2", - "identifier": "V15.1.2", - "text": "Vérifiez qu'un catalogue d'inventaire, tel qu'une nomenclature logicielle (SBOM), est conservé pour toutes les bibliothèques tierces utilisées, y compris en vérifiant que les composants proviennent de référentiels prédéfinis, fiables et continuellement maintenus.", - "parent": "V15.1" - }, - { - "bom-ref": "V15.1.3", - "identifier": "V15.1.3", - "text": "Vérifiez que la documentation de l'application identifie les fonctionnalités consommatrices en temps ou gourmandes en ressources. Elle doit notamment indiquer comment prévenir une perte de disponibilité due à une utilisation excessive de ces fonctionnalités et éviter que la génération d'une réponse ne prenne plus de temps que le délai d'expiration du consommateur. Les mesures de protection potentielles peuvent inclure le traitement asynchrone, l'utilisation de files d'attente et la limitation des processus parallèles par utilisateur et par application.", - "parent": "V15.1" - }, - { - "bom-ref": "V15.1.4", - "identifier": "V15.1.4", - "text": "Vérifiez que la documentation de l’application met en évidence les bibliothèques tierces qui sont considérées comme des « composants à risque ».", - "parent": "V15.1" - }, - { - "bom-ref": "V15.1.5", - "identifier": "V15.1.5", - "text": "Vérifiez que la documentation de l’application met en évidence les parties de l’application où des « fonctionnalités dangereuses » sont utilisées.", - "parent": "V15.1" - }, - { - "bom-ref": "V15.2", - "identifier": "V15.2", - "title": "Architecture de sécurité et dépendances", - "parent": "V15" - }, - { - "bom-ref": "V15.2.1", - "identifier": "V15.2.1", - "text": "Vérifiez que l’application contient uniquement des composants qui n’ont pas dépassé les délais de mise à jour et de correction documentés.", - "parent": "V15.2" - }, - { - "bom-ref": "V15.2.2", - "identifier": "V15.2.2", - "text": "Vérifiez que l'application a mis en œuvre des défenses contre la perte de disponibilité due à des fonctionnalités qui prennent du temps ou qui nécessitent des ressources, sur la base des décisions et stratégies de sécurité documentées à cet effet.", - "parent": "V15.2" - }, - { - "bom-ref": "V15.2.3", - "identifier": "V15.2.3", - "text": "Vérifiez que l'environnement de production inclut uniquement les fonctionnalités nécessaires au fonctionnement de l'application et n'expose pas de fonctionnalités superflues telles que du code de test, des exemples d'extraits et des fonctionnalités de développement.", - "parent": "V15.2" - }, - { - "bom-ref": "V15.2.4", - "identifier": "V15.2.4", - "text": "Vérifiez que les composants tiers et toutes leurs dépendances transitives sont inclus à partir du référentiel attendu, qu'il soit détenu en interne ou qu'il s'agisse d'une source externe, et qu'il n'y a aucun risque d'attaque par confusion de dépendances.", - "parent": "V15.2" - }, - { - "bom-ref": "V15.2.5", - "identifier": "V15.2.5", - "text": "Vérifiez que l'application implémente des protections supplémentaires autour des parties documentées comme contenant des « fonctionnalités dangereuses » ou utilisant des bibliothèques tierces considérées comme des « composants à risque ». Cela peut inclure des techniques telles que le sandboxing, l'encapsulation, la conteneurisation ou l'isolation au niveau du réseau pour retarder et dissuader les attaquants qui compromettent une partie de l'application de se propager ailleurs.", - "parent": "V15.2" - }, - { - "bom-ref": "V15.3", - "identifier": "V15.3", - "title": "Développement défensif", - "parent": "V15" - }, - { - "bom-ref": "V15.3.1", - "identifier": "V15.3.1", - "text": "Vérifiez que l'application ne renvoie que le sous-ensemble requis de champs d'un objet de données. Par exemple, elle ne doit pas renvoyer un objet de données entier, car certains champs individuels ne doivent pas être accessibles aux utilisateurs.", - "parent": "V15.3" - }, - { - "bom-ref": "V15.3.2", - "identifier": "V15.3.2", - "text": "Vérifiez que lorsque le backend de l'application effectue des appels vers des URL externes, il est configuré pour ne pas suivre les redirections, sauf s'il s'agit d'une fonctionnalité prévue.", - "parent": "V15.3" - }, - { - "bom-ref": "V15.3.3", - "identifier": "V15.3.3", - "text": "Vérifiez que l'application dispose de contre-mesures pour se protéger contre les attaques d'affectation de masse en limitant les champs autorisés par contrôleur et action, par exemple, il n'est pas possible d'insérer ou de mettre à jour une valeur de champ lorsqu'elle n'était pas destinée à faire partie de cette action.", - "parent": "V15.3" - }, - { - "bom-ref": "V15.3.4", - "identifier": "V15.3.4", - "text": "Vérifiez que tous les composants proxy et middleware transfèrent correctement l'adresse IP d'origine de l'utilisateur à l'aide de champs de données fiables qui ne peuvent pas être manipulés par l'utilisateur final, et que l'application et le serveur Web utilisent cette valeur correcte pour la journalisation et les décisions de sécurité telles que la limitation du débit, en tenant compte du fait que même l'adresse IP d'origine peut ne pas être fiable en raison d'adresses IP dynamiques, de VPN ou de pare-feu d'entreprise.", - "parent": "V15.3" - }, - { - "bom-ref": "V15.3.5", - "identifier": "V15.3.5", - "text": "Vérifiez que l'application garantit explicitement que les variables sont du type correct et effectue des opérations d'égalité et de comparaison strictes. Cela permet d'éviter les vulnérabilités liées à la confusion de types, causées par des hypothèses du code de l'application sur le type d'une variable.", - "parent": "V15.3" - }, - { - "bom-ref": "V15.3.6", - "identifier": "V15.3.6", - "text": "Vérifiez que le code JavaScript est écrit de manière à éviter la pollution du prototype, par exemple en utilisant Set() ou Map() au lieu de littéraux d'objet.", - "parent": "V15.3" - }, - { - "bom-ref": "V15.3.7", - "identifier": "V15.3.7", - "text": "Vérifiez que l'application dispose de défenses contre les attaques de pollution des paramètres HTTP, en particulier si le Framework d'application ne fait aucune distinction quant à la source des paramètres de requête (chaîne de requête, paramètres de corps, cookies ou champs d'en-tête).", - "parent": "V15.3" - }, - { - "bom-ref": "V15.4", - "identifier": "V15.4", - "title": "Concurrence sécurisée", - "parent": "V15" - }, - { - "bom-ref": "V15.4.1", - "identifier": "V15.4.1", - "text": "Vérifiez que les objets partagés dans le code multithread (tels que les caches, les fichiers ou les objets en mémoire accessibles par plusieurs threads) sont accessibles en toute sécurité à l'aide de types thread-safe et de mécanismes de synchronisation tels que des verrous ou des sémaphores pour éviter les conditions de concurrence et la corruption des données.", - "parent": "V15.4" - }, - { - "bom-ref": "V15.4.2", - "identifier": "V15.4.2", - "text": "Vérifiez que les vérifications de l'état d'une ressource, comme son existence ou ses autorisations, et des actions qui en dépendent, sont effectuées en une seule opération atomique afin d'éviter les situations de concurrence entre le moment de la vérification et le moment de l'utilisation (TOCTOU). Par exemple, vérifier l'existence d'un fichier avant de l'ouvrir ou l'accès d'un utilisateur avant de l'accorder.", - "parent": "V15.4" - }, - { - "bom-ref": "V15.4.3", - "identifier": "V15.4.3", - "text": "Vérifiez que les verrous sont utilisés de manière cohérente pour éviter que les threads ne se bloquent, que ce soit en s'attendant les uns les autres ou en réessayant sans fin, et que la logique de verrouillage reste dans le code responsable de la gestion de la ressource pour garantir que les verrous ne peuvent pas être modifiés par inadvertance ou de manière malveillante par des classes ou du code externes.", - "parent": "V15.4" - }, - { - "bom-ref": "V15.4.4", - "identifier": "V15.4.4", - "text": "Vérifiez que les politiques d'allocation des ressources empêchent la saturation de threads en garantissant un accès équitable aux ressources, par exemple en exploitant les pools de threads, permettant aux threads de priorité inférieure de continuer dans un délai raisonnable.", - "parent": "V15.4" - }, - { - "bom-ref": "V16", - "identifier": "V16", - "title": "Journalisation de sécurité et gestion des erreurs" - }, - { - "bom-ref": "V16.1", - "identifier": "V16.1", - "title": "Documentation sur la journalisation de sécurité", - "parent": "V16" - }, - { - "bom-ref": "V16.1.1", - "identifier": "V16.1.1", - "text": "Vérifiez qu'il existe un inventaire documentant la journalisation effectuée à chaque couche de la pile technologique de l'application, les événements enregistrés, les formats de journal, l'endroit où cette journalisation est stockée, la manière dont elle est utilisée, la manière dont l'accès à celle-ci est contrôlé et la durée de conservation des journaux.", - "parent": "V16.1" - }, - { - "bom-ref": "V16.2", - "identifier": "V16.2", - "title": "Journalisation générale", - "parent": "V16" - }, - { - "bom-ref": "V16.2.1", - "identifier": "V16.2.1", - "text": "Vérifiez que chaque entrée de journal inclut les métadonnées nécessaires (telles que quand, où, qui, quoi) qui permettraient une enquête détaillée sur la chronologie lorsqu'un événement se produit.", - "parent": "V16.2" - }, - { - "bom-ref": "V16.2.2", - "identifier": "V16.2.2", - "text": "Vérifiez que les sources de temps de tous les composants de journalisation sont synchronisées et que les horodatages des métadonnées des événements de sécurité utilisent le temps UTC ou incluent un décalage horaire explicite. L'UTC est recommandé pour garantir la cohérence entre les systèmes distribués et éviter toute confusion lors du passage à l'heure d'été.", - "parent": "V16.2" - }, - { - "bom-ref": "V16.2.3", - "identifier": "V16.2.3", - "text": "Vérifiez que l’application stocke ou diffuse uniquement les journaux vers les fichiers et services documentés dans l’inventaire des journaux.", - "parent": "V16.2" - }, - { - "bom-ref": "V16.2.4", - "identifier": "V16.2.4", - "text": "Vérifiez que les journaux peuvent être lus et corrélés par le processeur de journaux utilisé, de préférence en utilisant un format de journalisation commun.", - "parent": "V16.2" - }, - { - "bom-ref": "V16.2.5", - "identifier": "V16.2.5", - "text": "Vérifiez que l'application applique la journalisation en fonction du niveau de protection des données lors de la journalisation de données sensibles. Par exemple, certaines données, comme les identifiants ou les informations de paiement, peuvent être interdites. D'autres données, comme les jetons de session, ne peuvent être enregistrées que par hachage ou masquage, en totalité ou en partie.", - "parent": "V16.2" - }, - { - "bom-ref": "V16.3", - "identifier": "V16.3", - "title": "Événements de sécurité", - "parent": "V16" - }, - { - "bom-ref": "V16.3.1", - "identifier": "V16.3.1", - "text": "Vérifiez que toutes les opérations d'authentification sont enregistrées, y compris les tentatives réussies et infructueuses. Des métadonnées supplémentaires, telles que le type d'authentification ou les facteurs utilisés, doivent également être collectées.", - "parent": "V16.3" - }, - { - "bom-ref": "V16.3.2", - "identifier": "V16.3.2", - "text": "Vérifier que les tentatives d'autorisation infructueuses sont logguées. Pour le niveau 3, cela doit inclure la journalisation de toutes les décisions d'autorisation, y compris lors de l'accès à des données sensibles (sans journalisation des données sensibles elles-mêmes).", - "parent": "V16.3" - }, - { - "bom-ref": "V16.3.3", - "identifier": "V16.3.3", - "text": "Vérifiez que l'application enregistre les événements de sécurité définis dans la documentation et enregistre également les tentatives de contournement des contrôles de sécurité, tels que la validation des entrées, la logique métier et l'anti-automatisation.", - "parent": "V16.3" - }, - { - "bom-ref": "V16.3.4", - "identifier": "V16.3.4", - "text": "Vérifiez que l’application enregistre les erreurs inattendues et les échecs de contrôle de sécurité tels que les échecs TLS du backend.", - "parent": "V16.3" - }, - { - "bom-ref": "V16.4", - "identifier": "V16.4", - "title": "Protection des journaux", - "parent": "V16" - }, - { - "bom-ref": "V16.4.1", - "identifier": "V16.4.1", - "text": "Vérifiez que tous les composants de journalisation codent correctement les données pour empêcher l’injection de journaux.", - "parent": "V16.4" - }, - { - "bom-ref": "V16.4.2", - "identifier": "V16.4.2", - "text": "Vérifiez que les journaux sont protégés contre tout accès non autorisé et ne peuvent pas être modifiés.", - "parent": "V16.4" - }, - { - "bom-ref": "V16.4.3", - "identifier": "V16.4.3", - "text": "Vérifiez que les journaux sont transmis de manière sécurisée à un système logique distinct pour analyse, détection, alerte et remontée des informations. L'objectif est de garantir qu'en cas de violation de l'application, les journaux ne seront pas compromis.", - "parent": "V16.4" - }, - { - "bom-ref": "V16.5", - "identifier": "V16.5", - "title": "Gestion des erreurs", - "parent": "V16" - }, - { - "bom-ref": "V16.5.1", - "identifier": "V16.5.1", - "text": "Vérifiez qu'un message générique est renvoyé au consommateur lorsqu'une erreur inattendue ou sensible à la sécurité se produit, garantissant ainsi l'absence d'exposition de données système internes sensibles telles que les traces de pile, les requêtes, les clés secrètes et les jetons.", - "parent": "V16.5" - }, - { - "bom-ref": "V16.5.2", - "identifier": "V16.5.2", - "text": "Vérifiez que l'application continue de fonctionner en toute sécurité lorsque l'accès aux ressources externes échoue, par exemple, en utilisant des modèles tels que des disjoncteurs ou une dégradation progressive.", - "parent": "V16.5" - }, - { - "bom-ref": "V16.5.3", - "identifier": "V16.5.3", - "text": "Vérifiez que l'application échoue proprement et sécurisée, y compris lorsqu'une exception se produit, en évitant les accès en cas d'erreur telles que le traitement d'une transaction malgré les erreurs résultant de la logique de validation.", - "parent": "V16.5" - }, - { - "bom-ref": "V16.5.4", - "identifier": "V16.5.4", - "text": "Vérifiez qu'un gestionnaire d'erreurs de « dernier recours » est défini pour intercepter toutes les exceptions non gérées. Cela permet d'éviter la perte des informations d'erreur qui doivent être loguées dans les fichiers journaux et de garantir qu'une erreur ne paralyse pas l'ensemble du processus applicatif, entraînant une perte de disponibilité.", - "parent": "V16.5" - }, - { - "bom-ref": "V17", - "identifier": "V17", - "title": "WebRTC" - }, - { - "bom-ref": "V17.1", - "identifier": "V17.1", - "title": "Serveur TURN", - "parent": "V17" - }, - { - "bom-ref": "V17.1.1", - "identifier": "V17.1.1", - "text": "Vérifiez que le service TURN (Traversal Using Relays around NAT) autorise uniquement l'accès aux adresses IP non réservées à des fins spécifiques (par exemple, réseaux internes, diffusion, bouclage). Notez que cela s'applique aux adresses IPv4 et IPv6.", - "parent": "V17.1" - }, - { - "bom-ref": "V17.1.2", - "identifier": "V17.1.2", - "text": "Vérifiez que le service Traversal Using Relays around NAT (TURN) n'est pas susceptible d'épuiser ses ressources lorsque des utilisateurs légitimes tentent d'ouvrir un grand nombre de ports sur le serveur TURN.", - "parent": "V17.1" - }, - { - "bom-ref": "V17.2", - "identifier": "V17.2", - "title": "Média", - "parent": "V17" - }, - { - "bom-ref": "V17.2.1", - "identifier": "V17.2.1", - "text": "Vérifiez que la clé du certificat Datagram Transport Layer Security (DTLS) est gérée et protégée conformément à la politique documentée de gestion des clés cryptographiques.", - "parent": "V17.2" - }, - { - "bom-ref": "V17.2.2", - "identifier": "V17.2.2", - "text": "Vérifiez que le serveur multimédia est configuré pour utiliser et prendre en charge les suites de chiffrement DTLS (Datagram Transport Layer Security) approuvées et un profil de protection sécurisé pour l'extension DTLS pour l'établissement de clés pour le protocole de transport en temps réel sécurisé (DTLS-SRTP).", - "parent": "V17.2" - }, - { - "bom-ref": "V17.2.3", - "identifier": "V17.2.3", - "text": "Vérifiez que l'authentification SRTP (Secure Real-time Transport Protocol) est vérifiée sur le serveur multimédia pour empêcher les attaques par injection RTP (Real-time Transport Protocol) d'entraîner une condition de déni de service ou l'insertion de médias audio ou vidéo dans les flux multimédias.", - "parent": "V17.2" - }, - { - "bom-ref": "V17.2.4", - "identifier": "V17.2.4", - "text": "Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant lorsqu'il rencontre des paquets SRTP (Secure Real-time Transport Protocol) mal formés.", - "parent": "V17.2" - }, - { - "bom-ref": "V17.2.5", - "identifier": "V17.2.5", - "text": "Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.", - "parent": "V17.2" - }, - { - "bom-ref": "V17.2.6", - "identifier": "V17.2.6", - "text": "Vérifiez que le serveur multimédia n'est pas sensible à la vulnérabilité de condition de concurrence « ClientHello » dans Datagram Transport Layer Security (DTLS) en vérifiant si le serveur multimédia est publiquement connu comme étant vulnérable ou en effectuant le test de condition de concurrence.", - "parent": "V17.2" - }, - { - "bom-ref": "V17.2.7", - "identifier": "V17.2.7", - "text": "Vérifiez que tous les mécanismes d'enregistrement audio ou vidéo associés au serveur multimédia sont en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.", - "parent": "V17.2" - }, - { - "bom-ref": "V17.2.8", - "identifier": "V17.2.8", - "text": "Vérifiez que le certificat Datagram Transport Layer Security (DTLS) est vérifié par rapport à l'attribut d'empreinte cryptographique du protocole de description de session (SDP), en mettant fin au flux multimédia si la vérification échoue, pour garantir l'authenticité du flux multimédia.", - "parent": "V17.2" - }, - { - "bom-ref": "V17.3", - "identifier": "V17.3", - "title": "Signalisation", - "parent": "V17" - }, - { - "bom-ref": "V17.3.1", - "identifier": "V17.3.1", - "text": "Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation entrants légitimes lors d'une attaque par saturation. Cela peut être réalisé en implémentant une limitation de débit au niveau de la signalisation.", - "parent": "V17.3" - }, - { - "bom-ref": "V17.3.2", - "identifier": "V17.3.2", - "text": "Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation légitimes en cas de message mal formé susceptible de provoquer un déni de service. Cela peut inclure la validation des entrées, la gestion sécurisée des dépassements d'entiers, la prévention des dépassements de tampon et l'utilisation d'autres techniques robustes de gestion des erreurs.", - "parent": "V17.3" - } - ], - "levels": [ - { - "bom-ref": "level-1", - "identifier": "Level 1", - "description": "This level contains the minimum requirements to consider when securing an application and represents a critical starting point.", - "requirements": [ - "V1.2.1", - "V1.2.2", - "V1.2.3", - "V1.2.4", - "V1.2.5", - "V1.3.1", - "V1.3.2", - "V1.5.1", - "V2.1.1", - "V2.2.1", - "V2.2.2", - "V2.3.1", - "V3.2.1", - "V3.2.2", - "V3.3.1", - "V3.4.1", - "V3.4.2", - "V3.5.1", - "V3.5.2", - "V3.5.3", - "V4.1.1", - "V4.4.1", - "V5.2.1", - "V5.2.2", - "V5.3.1", - "V5.3.2", - "V6.1.1", - "V6.2.1", - "V6.2.2", - "V6.2.3", - "V6.2.4", - "V6.2.5", - "V6.2.6", - "V6.2.7", - "V6.2.8", - "V6.3.1", - "V6.3.2", - "V6.4.1", - "V6.4.2", - "V7.2.1", - "V7.2.2", - "V7.2.3", - "V7.2.4", - "V7.4.1", - "V7.4.2", - "V8.1.1", - "V8.2.1", - "V8.2.2", - "V8.3.1", - "V9.1.1", - "V9.1.2", - "V9.1.3", - "V9.2.1", - "V10.4.1", - "V10.4.2", - "V10.4.3", - "V10.4.4", - "V10.4.5", - "V11.3.1", - "V11.3.2", - "V11.4.1", - "V12.1.1", - "V12.2.1", - "V12.2.2", - "V13.4.1", - "V14.2.1", - "V14.3.1", - "V15.1.1", - "V15.2.1", - "V15.3.1" - ] - }, - { - "bom-ref": "level-2", - "identifier": "Level 2", - "description": "ASVS Level 2 requirements generally relate to either less common attacks or more complicated protections against common attacks. They may still be a first layer of defense, or they may require certain preconditions for the attack to be successful.", - "requirements": [ - "V1.1.1", - "V1.1.2", - "V1.2.6", - "V1.2.7", - "V1.2.8", - "V1.2.9", - "V1.3.3", - "V1.3.4", - "V1.3.5", - "V1.3.6", - "V1.3.7", - "V1.3.8", - "V1.3.9", - "V1.3.10", - "V1.3.11", - "V1.4.1", - "V1.4.2", - "V1.4.3", - "V1.5.2", - "V2.1.2", - "V2.1.3", - "V2.2.3", - "V2.3.2", - "V2.3.3", - "V2.3.4", - "V2.4.1", - "V3.3.2", - "V3.3.3", - "V3.3.4", - "V3.4.3", - "V3.4.4", - "V3.4.5", - "V3.4.6", - "V3.5.4", - "V3.5.5", - "V3.7.1", - "V3.7.2", - "V4.1.2", - "V4.1.3", - "V4.2.1", - "V4.3.1", - "V4.3.2", - "V4.4.2", - "V4.4.3", - "V4.4.4", - "V5.1.1", - "V5.2.3", - "V5.4.1", - "V5.4.2", - "V5.4.3", - "V6.1.2", - "V6.1.3", - "V6.2.9", - "V6.2.10", - "V6.2.11", - "V6.2.12", - "V6.3.3", - "V6.3.4", - "V6.4.3", - "V6.4.4", - "V6.5.1", - "V6.5.2", - "V6.5.3", - "V6.5.4", - "V6.5.5", - "V6.6.1", - "V6.6.2", - "V6.6.3", - "V6.8.1", - "V6.8.2", - "V6.8.3", - "V6.8.4", - "V7.1.1", - "V7.1.2", - "V7.1.3", - "V7.3.1", - "V7.3.2", - "V7.4.3", - "V7.4.4", - "V7.4.5", - "V7.5.1", - "V7.5.2", - "V7.6.1", - "V7.6.2", - "V8.1.2", - "V8.2.3", - "V8.4.1", - "V9.2.2", - "V9.2.3", - "V9.2.4", - "V10.1.1", - "V10.1.2", - "V10.2.1", - "V10.2.2", - "V10.3.1", - "V10.3.2", - "V10.3.3", - "V10.3.4", - "V10.4.6", - "V10.4.7", - "V10.4.8", - "V10.4.9", - "V10.4.10", - "V10.4.11", - "V10.5.1", - "V10.5.2", - "V10.5.3", - "V10.5.4", - "V10.5.5", - "V10.6.1", - "V10.6.2", - "V10.7.1", - "V10.7.2", - "V10.7.3", - "V11.1.1", - "V11.1.2", - "V11.2.1", - "V11.2.2", - "V11.2.3", - "V11.3.3", - "V11.4.2", - "V11.4.3", - "V11.4.4", - "V11.5.1", - "V11.6.1", - "V12.1.2", - "V12.1.3", - "V12.3.1", - "V12.3.2", - "V12.3.3", - "V12.3.4", - "V13.1.1", - "V13.2.1", - "V13.2.2", - "V13.2.3", - "V13.2.4", - "V13.2.5", - "V13.3.1", - "V13.3.2", - "V13.4.2", - "V13.4.3", - "V13.4.4", - "V13.4.5", - "V14.1.1", - "V14.1.2", - "V14.2.2", - "V14.2.3", - "V14.2.4", - "V14.3.2", - "V14.3.3", - "V15.1.2", - "V15.1.3", - "V15.2.2", - "V15.2.3", - "V15.3.2", - "V15.3.3", - "V15.3.4", - "V15.3.5", - "V15.3.6", - "V15.3.7", - "V16.1.1", - "V16.2.1", - "V16.2.2", - "V16.2.3", - "V16.2.4", - "V16.2.5", - "V16.3.1", - "V16.3.2", - "V16.3.3", - "V16.3.4", - "V16.4.1", - "V16.4.2", - "V16.4.3", - "V16.5.1", - "V16.5.2", - "V16.5.3", - "V17.1.1", - "V17.2.1", - "V17.2.2", - "V17.2.3", - "V17.2.4", - "V17.3.1", - "V17.3.2" - ] - }, - { - "bom-ref": "level-3", - "identifier": "Level 3", - "description": "ASVS Level 3 should be the goal for applications looking to demonstrate the highest levels of security and requirements in this section are generally either defense-in-depth mechanisms or other useful but hard-to-implement controls.", - "requirements": [ - "V1.2.10", - "V1.3.12", - "V1.5.3", - "V2.3.5", - "V2.4.2", - "V3.1.1", - "V3.2.3", - "V3.3.5", - "V3.4.7", - "V3.4.8", - "V3.5.6", - "V3.5.7", - "V3.5.8", - "V3.6.1", - "V3.7.3", - "V3.7.4", - "V3.7.5", - "V4.1.4", - "V4.1.5", - "V4.2.2", - "V4.2.3", - "V4.2.4", - "V4.2.5", - "V5.2.4", - "V5.2.5", - "V5.2.6", - "V5.3.3", - "V6.3.5", - "V6.3.6", - "V6.3.7", - "V6.3.8", - "V6.4.5", - "V6.4.6", - "V6.5.6", - "V6.5.7", - "V6.5.8", - "V6.6.4", - "V6.7.1", - "V6.7.2", - "V7.5.3", - "V8.1.3", - "V8.1.4", - "V8.2.4", - "V8.3.2", - "V8.3.3", - "V8.4.2", - "V10.2.3", - "V10.3.5", - "V10.4.12", - "V10.4.13", - "V10.4.14", - "V10.4.15", - "V10.4.16", - "V11.1.3", - "V11.1.4", - "V11.2.4", - "V11.2.5", - "V11.3.4", - "V11.3.5", - "V11.5.2", - "V11.6.2", - "V11.7.1", - "V11.7.2", - "V12.1.4", - "V12.1.5", - "V12.3.5", - "V13.1.2", - "V13.1.3", - "V13.1.4", - "V13.2.6", - "V13.3.3", - "V13.3.4", - "V13.4.6", - "V13.4.7", - "V14.2.5", - "V14.2.6", - "V14.2.7", - "V14.2.8", - "V15.1.4", - "V15.1.5", - "V15.2.4", - "V15.2.5", - "V15.4.1", - "V15.4.2", - "V15.4.3", - "V15.4.4", - "V16.5.4", - "V17.1.2", - "V17.2.5", - "V17.2.6", - "V17.2.7", - "V17.2.8" - ] - } - ], - "externalReferences": [ - { - "type": "website", - "url": "https://owasp.org/asvs" - }, - { - "type": "vcs", - "url": "https://github.com/OWASP/ASVS" - }, - { - "type": "issue-tracker", - "url": "https://github.com/OWASP/ASVS/issues" - }, - { - "type": "social", - "url": "https://twitter.com/OWASP_ASVS" - } - ] - } - ] - } -} diff --git a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.csv b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.csv deleted file mode 100644 index cbb00a9a2b..0000000000 --- a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.csv +++ /dev/null @@ -1,347 +0,0 @@ -chapter_id,chapter_name,section_id,section_name,req_id,req_description,L -V1,Encodage et nettoyage,V1.1,Architecture d'encodage et de nettoyage,V1.1.1,"Vérifiez que l'entrée est décodée ou non échappée vers une forme canonique une seule fois, elle n'est décodée que lorsque des données codées sous cette forme sont attendues, et que cela est fait avant de traiter davantage l'entrée, par exemple, elle n'est pas effectuée après la validation ou la désinfection de l'entrée.",2 -V1,Encodage et nettoyage,V1.1,Architecture d'encodage et de nettoyage,V1.1.2,"Vérifiez que l'application effectue l'encodage et l'échappement de sortie soit comme étape finale avant d'être utilisée par l'interpréteur pour lequel elle est destinée, soit par l'interpréteur lui-même.",2 -V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.1,"Vérifiez que l'encodage de sortie d'une réponse HTTP, d'un document HTML ou d'un document XML est pertinent pour le contexte requis, comme l'encodage des caractères pertinents pour les éléments HTML, les attributs HTML, les commentaires HTML, les CSS ou les champs d'en-tête HTTP, pour éviter de modifier la structure du message ou du document.",1 -V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.2,"Vérifiez que, lors de la création dynamique d'URL, les données non fiables sont encodées en fonction de leur contexte (par exemple, encodage d'URL ou encodage base64url pour les paramètres de requête ou de chemin). Assurez-vous que seuls les schémas d'URL sûrs sont autorisés (par exemple, interdire javascript: ou data:).",1 -V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.3,"Vérifiez que l'encodage ou l'échappement de sortie est utilisé lors de la création dynamique de contenu JavaScript (y compris JSON), pour éviter de modifier la structure du message ou du document (pour éviter l'injection JavaScript et JSON).",1 -V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.4,"Vérifiez que la sélection de données ou les requêtes de base de données (par exemple, SQL, HQL, NoSQL, Cypher) utilisent des requêtes paramétrées, des ORM, des Framework d'entités ou sont protégées contre les injections SQL et autres attaques par injection de base de données. Ceci est également pertinent lors de l'écriture de procédures stockées.",1 -V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.5,Vérifiez que l’application protège contre l’injection de commandes du système d’exploitation et que les appels du système d’exploitation utilisent des requêtes du système d’exploitation paramétrées ou utilisent un encodage de sortie de ligne de commande contextuelle.,1 -V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.6,Vérifiez que l’application protège contre les vulnérabilités d’injection LDAP ou que des contrôles de sécurité spécifiques pour empêcher l’injection LDAP ont été mis en œuvre.,2 -V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.7,Vérifiez que l’application est protégée contre les attaques par injection XPath en utilisant la paramétrisation des requêtes ou des requêtes précompilées.,2 -V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.8,"Vérifiez que les processeurs LaTeX sont configurés de manière sécurisée (par exemple, en n'utilisant pas l'indicateur « --shell-escape ») et qu'une liste d’autorisations de commandes est utilisée pour empêcher les attaques par injection LaTeX.",2 -V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.9,Vérifiez que l'application échappe les caractères spéciaux dans les expressions régulières (généralement à l'aide d'une barre oblique inverse) pour éviter qu'ils ne soient mal interprétés comme des métacaractères.,2 -V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.10,"Vérifiez que l'application est protégée contre les injections CSV et injections de formules. L'application doit respecter les règles d'échappement définies dans les sections 2.6 et 2.7 de la RFC 4180 lors de l'export de contenu CSV. De plus, lors de l'export au format CSV ou vers d'autres formats de tableur (tels que XLS, XLSX ou ODF), les caractères spéciaux (notamment « = », « + », « - », « @ », « \t » (tabulation) et « \0 » (caractère null)) doivent être protégés par une apostrophe s'ils apparaissent en premier dans une valeur de champ.",3 -V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.1,Vérifiez que toutes les entrées HTML non fiables provenant d'éditeurs WYSIWYG ou similaires sont nettoyées à l'aide d'une bibliothèque ou d'une fonctionnalité de Framework de nettoyage HTML bien connue et sécurisée.,1 -V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.2,"Vérifiez que l'application évite d'utiliser eval() ou d'autres fonctionnalités d'exécution de code dynamique telles que Spring Expression Language (SpEL). En l'absence d'alternative, toute saisie utilisateur incluse doit être nettoyée avant d'être exécutée.",1 -V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.3,"Vérifiez que les données transmises à un contexte potentiellement dangereux sont préalablement nettoyées pour appliquer des mesures de sécurité, telles qu'autoriser uniquement des caractères sûrs pour ce contexte et raccourcir des entrées trop longues.",2 -V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.4,"Vérifiez que le contenu Scalable Vector Graphics (SVG) scriptable fourni par l'utilisateur est validé ou nettoyé pour contenir uniquement des balises et des attributs (tels que des graphiques de dessin) qui sont sûrs pour l'application, par exemple, ne contiennent pas de scripts et d'objets étrangers.",2 -V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.5,"Vérifiez que l'application nettoie ou désactive le contenu du langage de modèle d'expression ou de script fourni par l'utilisateur, tel que les feuilles de style CSS, le Markdown ou XSL, BBCode ou similaire.",2 -V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.6,"Vérifiez que l'application protège contre les attaques de falsification de requête côté serveur (SSRF), en validant les données non fiables par rapport à une liste d'autorisation de protocoles, de domaines, de chemins et de ports et en nettoyant les caractères potentiellement dangereux avant d'utiliser les données pour appeler un autre service.",2 -V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.7,"Vérifiez que l'application se protège contre les attaques par injection de modèles en interdisant la création de modèles basés sur des entrées non fiables. En l'absence d'alternative, toute entrée non fiable incluse dynamiquement lors de la création du modèle doit être nettoyée ou rigoureusement validée.",2 -V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.8,Vérifiez que l’application nettoie correctement les entrées non fiables avant utilisation dans les requêtes Java Naming and Directory Interface (JNDI) et que JNDI est configuré de manière sécurisée pour empêcher les attaques par injection JNDI.,2 -V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.9,Vérifiez que l’application nettoie le contenu avant qu’il ne soit envoyé à memcache pour éviter les attaques par injection.,2 -V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.10,Vérifiez que les chaînes de format susceptibles d'être résolues de manière inattendue ou malveillante lors de leur utilisation sont nettoyées avant d'être traitées.,2 -V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.11,Vérifiez que l'application nettoie les entrées utilisateur avant de les transmettre aux systèmes de messagerie pour se protéger contre l'injection SMTP ou IMAP.,2 -V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.12,"Vérifiez que les expressions régulières sont exemptes d'éléments provoquant ""backtracking"" exponentiel et assurez-vous que les entrées non fiables sont nettoyées pour atténuer les attaques ReDoS ou Runaway Regex.",3 -V1,Encodage et nettoyage,V1.4,"Mémoire, chaine de caractères et code à mémoire non-managée",V1.4.1,"Vérifiez que l'application utilise des chaînes memory-safe, une copie de mémoire et une arithmétique de pointeur renforcée pour détecter ou empêcher les débordements de pile, de tampon ou de tas.",2 -V1,Encodage et nettoyage,V1.4,"Mémoire, chaine de caractères et code à mémoire non-managée",V1.4.2,"Vérifiez que les techniques de validation du signe, de la plage et de l’entrée sont utilisées pour éviter les dépassements d’entiers.",2 -V1,Encodage et nettoyage,V1.4,"Mémoire, chaine de caractères et code à mémoire non-managée",V1.4.3,"Vérifiez que la mémoire et les ressources allouées dynamiquement sont libérées et que les références ou les pointeurs vers la mémoire libérée sont supprimés ou définis à null pour éviter les ""dangling pointer"" et les vulnérabilités d'utilisation après libération.",2 -V1,Encodage et nettoyage,V1.5,Désérialisation sécurisée,V1.5.1,"Vérifiez que l'application configure les ""parser"" XML pour utiliser une configuration restrictive et que les fonctionnalités non sûres telles que la résolution d'entités externes sont désactivées pour empêcher les attaques XML eXternal Entity (XXE).",1 -V1,Encodage et nettoyage,V1.5,Désérialisation sécurisée,V1.5.2,"Vérifiez que la désérialisation des données non fiables garantit une gestion sécurisée des entrées, par exemple en utilisant une liste d'autorisation de types d'objets ou en limitant les types d'objets définis par le client, afin d'empêcher les attaques par désérialisation. Les mécanismes de désérialisation explicitement définis comme non sécurisés ne doivent pas être utilisés avec des entrées non fiables.",2 -V1,Encodage et nettoyage,V1.5,Désérialisation sécurisée,V1.5.3,"Vérifiez que les différents ""parser"" utilisés dans l'application pour le même type de données (par exemple, les ""parser"" JSON, les ""parser"" XML, les ""parser"" d'URL) effectuent l'analyse de manière cohérente et utilisent le même mécanisme d'encodage de caractères pour éviter des problèmes tels que les vulnérabilités d'interopérabilité JSON ou un comportement d'analyse d'URI ou de fichier différent exploité dans les attaques d'inclusion de fichiers à distance (RFI) ou de falsification de requête côté serveur (SSRF).",3 -V2,Validation et logique métier,V2.1,Validation et documentation de la logique métier,V2.1.1,"Vérifiez que la documentation de l'application définit des règles de validation des entrées pour vérifier la validité des éléments de données par rapport à la structure attendue. Il peut s'agir de formats de données courants tels que des numéros de carte de crédit, des adresses e-mail ou des numéros de téléphone, ou d'un format de données interne.",1 -V2,Validation et logique métier,V2.1,Validation et documentation de la logique métier,V2.1.2,"Vérifiez que la documentation de l'application définit comment valider la cohérence logique et contextuelle des éléments de données combinés, par exemple en vérifiant que la banlieue et le code postal correspondent.",2 -V2,Validation et logique métier,V2.1,Validation et documentation de la logique métier,V2.1.3,"Vérifiez que les attentes en matière de limites et de validations de la logique métier sont documentées, y compris par utilisateur et globalement dans l'application.",2 -V2,Validation et logique métier,V2.2,Validation des entrées,V2.2.1,"Vérifier que les entrées sont validées afin de respecter les attentes métier ou fonctionnelles. Cette validation doit être basée sur une liste de valeurs, de modèles et de plages autorisées, ou sur la comparaison des entrées avec une structure attendue et des limites logiques selon des règles prédéfinies. Pour le niveau 1, cette validation peut se concentrer sur les entrées utilisées pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau 2, elle doit s'appliquer à toutes les entrées.",1 -V2,Validation et logique métier,V2.2,Validation des entrées,V2.2.2,"Vérifiez que l'application est conçue pour appliquer la validation des entrées au niveau d'une couche de service de confiance. Bien que la validation côté client améliore l'ergonomie et doit être encouragée, elle ne doit pas être considérée comme un contrôle de sécurité.",1 -V2,Validation et logique métier,V2.2,Validation des entrées,V2.2.3,Vérifiez que l’application garantit que les combinaisons d’éléments de données associés sont raisonnables selon les règles prédéfinies.,2 -V2,Validation et logique métier,V2.3,Sécurité de la logique métier,V2.3.1,Vérifiez que l’application traitera uniquement les flux de logique métier pour le même utilisateur dans l’ordre séquentiel attendu et sans sauter d’étapes.,1 -V2,Validation et logique métier,V2.3,Sécurité de la logique métier,V2.3.2,"Vérifiez que les limites de la logique métier sont implémentées conformément à la documentation de l'application, afin d'éviter que des failles de la logique métier ne soient pas exploitées.",2 -V2,Validation et logique métier,V2.3,Sécurité de la logique métier,V2.3.3,Vérifiez que les transactions sont utilisées au niveau de la logique métier de telle sorte qu'une opération de logique métier réussisse dans son intégralité ou qu'elle soit restaurée à l'état correct précédent.,2 -V2,Validation et logique métier,V2.3,Sécurité de la logique métier,V2.3.4,Vérifiez que les mécanismes de verrouillage au niveau de la logique métier sont utilisés pour garantir que les ressources en quantité limitée (telles que les sièges de théâtre ou les créneaux de livraison) ne peuvent pas être réservées deux fois en manipulant la logique de l'application.,2 -V2,Validation et logique métier,V2.3,Sécurité de la logique métier,V2.3.5,"Vérifiez que les flux logiques métier à forte valeur ajoutée nécessitent l'approbation de plusieurs utilisateurs afin d'éviter toute action non autorisée ou accidentelle. Cela peut inclure, sans s'y limiter, les transferts monétaires importants, les approbations de contrats, l'accès à des informations classifiées ou les contournements de sécurité dans le secteur manufacturier.",3 -V2,Validation et logique métier,V2.4,Anti-automatisation,V2.4.1,"Vérifiez que des contrôles anti-automatisation sont en place pour protéger contre les appels excessifs aux fonctions d'application qui pourraient conduire à l'exfiltration de données, à la création de données inutiles, à l'épuisement des quotas, aux violations de limites de débit, au déni de service ou à la surutilisation de ressources coûteuses.",2 -V2,Validation et logique métier,V2.4,Anti-automatisation,V2.4.2,"Vérifiez que les flux logiques métier nécessitent un timing humain réaliste, évitant ainsi des soumissions de transactions excessivement rapides.",3 -V3,Sécurité du frontend Web,V3.1,Documentation sur la sécurité du frontend Web,V3.1.1,"Vérifiez que la documentation de l'application indique les fonctionnalités de sécurité attendues que les navigateurs utilisant l'application doivent prendre en charge (telles que HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) et autres mécanismes de sécurité HTTP pertinents). Elle doit également définir le comportement de l'application lorsque certaines de ces fonctionnalités ne sont pas disponibles (par exemple, avertir l'utilisateur ou bloquer l'accès).",3 -V3,Sécurité du frontend Web,V3.2,Interprétation non intentionnelle du contenu,V3.2.1,"Vérifiez que des contrôles de sécurité sont en place pour empêcher les navigateurs d'afficher du contenu ou des fonctionnalités dans les réponses HTTP dans un contexte incorrect (par exemple, lorsqu'une API, un fichier téléchargé par l'utilisateur ou une autre ressource est demandée directement). Les contrôles possibles peuvent inclure : ne pas transmettre le contenu sauf si les champs d'en-tête de requête HTTP (tels que Sec-Fetch-\*) indiquent qu'il s'agit du contexte correct, utiliser la directive sandbox du champ d'en-tête Content-Security-Policy ou utiliser le type de disposition de pièce jointe dans le champ d'en-tête Content-Disposition.",1 -V3,Sécurité du frontend Web,V3.2,Interprétation non intentionnelle du contenu,V3.2.2,"Vérifiez que le contenu destiné à être affiché sous forme de texte, plutôt que rendu sous forme de HTML, est géré à l'aide de fonctions de rendu sécurisées (telles que createTextNode ou textContent) pour empêcher l'exécution involontaire de contenu tel que HTML ou JavaScript.",1 -V3,Sécurité du frontend Web,V3.2,Interprétation non intentionnelle du contenu,V3.2.3,"Vérifiez que l'application évite l'écrasement du DOM lors de l'utilisation de JavaScript côté client en utilisant des déclarations de variables explicites, en effectuant une vérification de type stricte, en évitant de stocker des variables globales sur l'objet document et en implémentant l'isolation de l'espace de nommage.",3 -V3,Sécurité du frontend Web,V3.3,Configuration des cookies,V3.3.1,"Vérifiez que les cookies ont l'attribut « Secure » ​​défini et si le préfixe « \__Host- » n'est pas utilisé pour le nom du cookie, le préfixe « __Secure- » doit être utilisé pour le nom du cookie.",1 -V3,Sécurité du frontend Web,V3.3,Configuration des cookies,V3.3.2,"Vérifiez que la valeur de l'attribut « SameSite » de chaque cookie est définie en fonction de l'objectif du cookie, afin de limiter l'exposition aux attaques de réparation de l'interface utilisateur et aux attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).",2 -V3,Sécurité du frontend Web,V3.3,Configuration des cookies,V3.3.3,"Vérifiez que les cookies ont le préfixe « __Host- » pour le nom du cookie, sauf s'ils sont explicitement conçus pour être partagés avec d'autres hôtes.",2 -V3,Sécurité du frontend Web,V3.3,Configuration des cookies,V3.3.4,"Vérifiez que si la valeur d'un cookie n'est pas censée être accessible aux scripts côté client (comme un jeton de session), le cookie doit avoir l'attribut « HttpOnly » défini et la même valeur (par exemple, un jeton de session) ne doit être transférée au client que via le champ d'en-tête « Set-Cookie ».",2 -V3,Sécurité du frontend Web,V3.3,Configuration des cookies,V3.3.5,"Vérifiez que lorsque l'application écrit un cookie, la longueur combinée du nom et de la valeur du cookie ne dépasse pas 4 096 octets. Les cookies trop volumineux ne seront pas stockés par le navigateur et ne seront donc pas envoyés avec les requêtes, empêchant ainsi l'utilisateur d'utiliser les fonctionnalités de l'application qui reposent sur ce cookie.",3 -V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.1,"Vérifiez qu'un champ d'en-tête Strict-Transport-Security est inclus dans toutes les réponses afin d'appliquer une politique HTTP Strict Transport Security (HSTS). Une durée maximale d'au moins un an doit être définie, et pour les niveaux L2 et supérieurs, la politique doit également s'appliquer à tous les sous-domaines.",1 -V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.2,"Vérifiez que le champ d'en-tête Access-Control-Allow-Origin du partage de ressources cross-origine (CORS) est une valeur fixe de l'application ou, si la valeur du champ d'en-tête de requête HTTP Origin est utilisée, qu'elle est validée par rapport à une liste d'origines approuvées. Si « Access-Control-Allow-Origin: * » doit être utilisé, vérifiez que la réponse ne contient aucune information sensible.",1 -V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.3,"Vérifiez que les réponses HTTP incluent un champ d'en-tête de réponse Content-Security-Policy qui définit des directives garantissant que le navigateur charge et exécute uniquement du contenu ou des ressources fiables, afin de limiter l'exécution de JavaScript malveillant. Au minimum, une politique globale doit être utilisée, incluant les directives object-src 'none' et base-uri 'none', et définissant soit une lliste d’autorisations, soit des valeurs nonces ou des hachages. Pour une application L3, une politique par réponse avec des valeurs nonces ou des hachages doit être définie.",2 -V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.4,"Vérifiez que toutes les réponses HTTP contiennent un champ d'en-tête « X-Content-Type-Options: nosniff ». Cela indique aux navigateurs de ne pas utiliser l'analyse de contenu ni la détection du type MIME pour la réponse donnée, et d'exiger que la valeur du champ d'en-tête « Content-Type » de la réponse corresponde à la ressource de destination. Par exemple, la réponse à une demande de style n'est acceptée que si le type de contenu de la réponse est « text/css ». Cela permet également au navigateur d'utiliser la fonctionnalité de blocage de lecture inter-origines (CORB).",2 -V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.5,"Vérifiez que l'application définit une politique de référencement afin d'empêcher la fuite de données techniquement sensibles vers des services tiers via le champ d'en-tête de requête HTTP « Referer ». Cela peut être effectué via le champ d'en-tête de réponse HTTP « Referrer-Policy » ou via les attributs d'élément HTML. Les données sensibles peuvent inclure le chemin d'accès et les données de requête dans l'URL, et pour les applications internes non publiques, le nom d'hôte.",2 -V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.6,"Vérifiez que l'application Web utilise la directive frame-ancestors du champ d'en-tête Content-Security-Policy pour chaque réponse HTTP afin de garantir qu'elle ne peut pas être intégrée par défaut et que l'intégration de ressources spécifiques n'est autorisée qu'en cas de nécessité. Notez que le champ d'en-tête X-Frame-Options, bien que pris en charge par les navigateurs, est obsolète et n'est pas forcément fiable.",2 -V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.7,Vérifiez que le champ d’en-tête Content-Security-Policy spécifie un emplacement pour signaler les violations.,3 -V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.8,"Vérifiez que toutes les réponses HTTP qui lancent le rendu d'un document (comme les réponses de type text/html) incluent le champ d'en-tête 'Cross-Origin-Opener-Policy' avec la directive 'same-origin' ou s'ame-origin-allow-popups', selon les besoins. Cela empêche les attaques abusant de l'accès partagé aux objets Window, telles que le tabnabbing et le comptage d'images.",3 -V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.1,"Vérifiez que, si l'application ne s'appuie pas sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher les requêtes inter-origines non autorisées d'utiliser des fonctionnalités sensibles, ces requêtes sont validées afin de garantir leur origine. Cela peut se faire en utilisant et en validant des jetons anti-falsification ou en exigeant des champs d'en-tête HTTP supplémentaires qui ne sont pas des champs d'en-tête de requête CORS safelist. Ceci permet de se protéger contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).",1 -V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.2,"Vérifiez que, si l'application s'appuie sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher l'utilisation inter-origines non autorisée de fonctionnalités sensibles, il est impossible d'appeler la fonctionnalité avec une requête qui ne déclenche pas de requête de pré-vérification cross-origin CORS. Cela peut nécessiter de vérifier les valeurs des champs d'en-tête de requête 'Origin' et 'Content-Type' ou d'utiliser un champ d'en-tête supplémentaire qui n'est pas un champ d'en-tête de la liste de sécurité CORS.",1 -V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.3,"Vérifiez que les requêtes HTTP destinées aux fonctionnalités sensibles utilisent des méthodes HTTP appropriées, telles que POST, PUT, PATCH ou DELETE, et non des méthodes définies comme « sûres » par la spécification HTTP, telles que HEAD, OPTIONS ou GET. Une validation stricte des champs d'en-tête de requête Sec-Fetch-* peut également être utilisée pour garantir que la requête ne provient pas d'un appel inter-origines inapproprié, d'une requête de navigation ou d'un chargement de ressources (comme une source d'image) inattendu.",1 -V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.4,"Vérifiez que des applications distinctes sont hébergées sur des noms d'hôte différents pour tirer parti des restrictions fournies par la politique de même origine, y compris la manière dont les documents ou scripts chargés par une origine peuvent interagir avec les ressources d'une autre origine et les restrictions basées sur le nom d'hôte sur les cookies.",2 -V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.5,Vérifiez que les messages reçus par l'interface postMessage sont rejetés si l'origine du message n'est pas digne de confiance ou si la syntaxe du message n'est pas valide.,2 -V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.6,Vérifiez que la fonctionnalité JSONP n'est activée nulle part dans l'application pour éviter les attaques Cross-Site Script Inclusion (XSSI).,3 -V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.7,"Vérifiez que les données nécessitant une autorisation ne sont pas incluses dans les réponses des ressources de script, comme les fichiers JavaScript, pour empêcher les attaques par inclusion de script intersite (XSSI).",3 -V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.8,"Vérifiez que les ressources authentifiées (telles que les images, les vidéos, les scripts et autres documents) peuvent être chargées ou intégrées pour le compte de l'utilisateur uniquement lorsque cela est prévu. Cela peut être réalisé en validant strictement les champs d'en-tête de requête HTTP Sec-Fetch-* afin de garantir que la requête ne provient pas d'un appel cross-origin inapproprié, ou en définissant un champ d'en-tête de réponse HTTP Cross-Origin-Resource-Policy restrictif pour indiquer au navigateur de bloquer le contenu renvoyé.",3 -V3,Sécurité du frontend Web,V3.6,Intégrité des ressources externes,V3.6.1,"Vérifiez que les ressources côté client, telles que les bibliothèques JavaScript, les feuilles de style CSS ou les polices web, sont hébergées en externe (par exemple, sur un réseau de diffusion de contenu) uniquement si la ressource est statique et versionnée, et si l'intégrité des sous-ressources (SRI) est utilisée pour valider l'intégrité de la ressource. Si cela n'est pas possible, une décision de sécurité documentée doit justifier cette décision pour chaque ressource.",3 -V3,Sécurité du frontend Web,V3.7,Autres considérations sur la sécurité du navigateur,V3.7.1,"Vérifiez que l'application utilise uniquement des technologies côté client toujours prises en charge et considérées comme sécurisées. Parmi les technologies qui ne répondent pas à cette exigence figurent les plugins NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL ou les applets Java côté client.",2 -V3,Sécurité du frontend Web,V3.7,Autres considérations sur la sécurité du navigateur,V3.7.2,Vérifiez que l'application redirigera automatiquement l'utilisateur vers un nom d'hôte ou un domaine différent (qui n'est pas contrôlé par l'application) uniquement lorsque la destination apparaît sur une liste d'autorisation.,2 -V3,Sécurité du frontend Web,V3.7,Autres considérations sur la sécurité du navigateur,V3.7.3,"Vérifiez que le domaine de premier niveau de l'application (par exemple, site.tld) ​​est ajouté à la liste de préchargement publique pour HTTP Strict Transport Security (HSTS). Cela garantit que l'utilisation de TLS pour l'application est intégrée directement dans les principaux navigateurs, plutôt que de dépendre uniquement du champ d'en-tête de réponse Strict-Transport-Security.",3 -V3,Sécurité du frontend Web,V3.7,Autres considérations sur la sécurité du navigateur,V3.7.4,"Vérifiez que l'application affiche une notification lorsque l'utilisateur est redirigé vers une URL hors du contrôle de l'application, avec une option pour annuler la navigation.",3 -V3,Sécurité du frontend Web,V3.7,Autres considérations sur la sécurité du navigateur,V3.7.5,"Vérifiez que l'application se comporte comme documenté (par exemple, en avertissant l'utilisateur ou en bloquant l'accès) si le navigateur utilisé pour accéder à l'application ne prend pas en charge les fonctionnalités de sécurité attendues.",3 -V4,API et service Web,V4.1,Sécurité du service Web générique,V4.1.1,"Vérifiez que chaque réponse HTTP avec un corps de message contient un champ d'en-tête Content-Type qui correspond au contenu réel de la réponse, y compris le paramètre charset pour spécifier un codage de caractères sécurisé (par exemple, UTF-8, ISO-8859-1) conformément aux types de médias IANA, tels que « text/ », « /+xml » et « /xml ».",1 -V4,API et service Web,V4.1,Sécurité du service Web générique,V4.1.2,"Vérifiez que seuls les terminaux utilisateurs (destinés à l'accès manuel via un navigateur web) redirigent automatiquement de HTTP vers HTTPS, tandis que les autres services ou terminaux n'implémentent pas de redirections transparentes. Cela permet d'éviter qu'un client envoie par erreur des requêtes HTTP non chiffrées, mais que, comme ces requêtes sont automatiquement redirigées vers HTTPS, la fuite de données sensibles passe inaperçue.",2 -V4,API et service Web,V4.1,Sécurité du service Web générique,V4.1.3,"Vérifiez que tout champ d'en-tête HTTP utilisé par l'application et défini par une couche intermédiaire, telle qu'un équilibreur de charge, un proxy web ou un service backend-for-frontend, ne peut pas être remplacé par l'utilisateur final. Les exemples d'en-têtes peuvent inclure X-Real-IP, X-Forwarded-*, ou X-User-ID.",2 -V4,API et service Web,V4.1,Sécurité du service Web générique,V4.1.4,Vérifiez que seules les méthodes HTTP explicitement prises en charge par l'application ou son API (y compris les OPTIONS lors des demandes de contrôle en amont) peuvent être utilisées et que les méthodes inutilisées sont bloquées.,3 -V4,API et service Web,V4.1,Sécurité du service Web générique,V4.1.5,Vérifier que les signatures numériques par message sont utilisées pour fournir une assurance supplémentaire en plus des protections de transport pour les demandes ou les transactions qui sont très sensibles ou qui traversent un certain nombre de systèmes.,3 -V4,API et service Web,V4.2,Validation de la structure des messages HTTP,V4.2.1,"Vérifiez que tous les composants de l'application (y compris les équilibreurs de charge, les pares-feux et les serveurs d'applications) déterminent les limites des messages HTTP entrants à l'aide du mécanisme approprié à la version HTTP afin d'empêcher la contrebande de requêtes HTTP. Dans HTTP/1.x, si un champ d'en-tête Transfer-Encoding est présent, l'en-tête Content-Length doit être ignoré conformément à la RFC 2616. Avec HTTP/2 ou HTTP/3, si un champ d'en-tête Content-Length est présent, le récepteur doit s'assurer qu'il est cohérent avec la longueur des trames DATA.",2 -V4,API et service Web,V4.2,Validation de la structure des messages HTTP,V4.2.2,"Vérifier que, lors de la génération de messages HTTP, le champ d'en-tête Content-Length n'entre pas en conflit avec la longueur du contenu déterminée par le cadrage du protocole HTTP, afin d'empêcher les attaques de type « request smuggling ».",3 -V4,API et service Web,V4.2,Validation de la structure des messages HTTP,V4.2.3,"Vérifiez que l'application n'envoie ni n'accepte de messages HTTP/2 ou HTTP/3 avec des champs d'en-tête spécifiques à la connexion, tels que Transfer-Encoding, afin d'éviter les attaques par fractionnement de la réponse et par injection d'en-tête.",3 -V4,API et service Web,V4.2,Validation de la structure des messages HTTP,V4.2.4,"Vérifiez que l'application n'accepte que les requêtes HTTP/2 et HTTP/3 dont les champs et valeurs d'en-tête ne contiennent pas de séquences CR (\r), LF (\n) ou CRLF (\r\n), afin d'éviter les attaques par injection d'en-tête.",3 -V4,API et service Web,V4.2,Validation de la structure des messages HTTP,V4.2.5,"Vérifiez que, si l'application (backend ou frontend) construit et envoie des requêtes, elle utilise des mécanismes de validation, d'assainissement ou autres pour éviter de créer des URI (comme pour les appels API) ou des champs d'en-tête de requête HTTP (comme Authorization ou Cookie) qui sont trop longs pour être acceptés par le composant récepteur. Cela pourrait entraîner un déni de service, par exemple lors de l'envoi d'une requête trop longue (par exemple, un long champ d'en-tête de cookie), ce qui fait que le serveur répond toujours avec un statut d'erreur.",3 -V4,API et service Web,V4.3,GraphQL,V4.3.1,"Vérifiez qu'une liste d'autorisation de requête, une limitation de profondeur, une limitation de quantité ou une analyse des coûts de requête est utilisée pour empêcher le déni de service (DoS) de GraphQL ou d'expression de la couche données en raison de requêtes imbriquées coûteuses.",2 -V4,API et service Web,V4.3,GraphQL,V4.3.2,"Vérifiez que les requêtes d’introspection GraphQL sont désactivées dans l’environnement de production, sauf si l’API GraphQL est destinée à être utilisée par d’autres parties.",2 -V4,API et service Web,V4.4,WebSocket,V4.4.1,Vérifiez que WebSocket sur TLS (WSS) est utilisé pour toutes les connexions WebSocket.,1 -V4,API et service Web,V4.4,WebSocket,V4.4.2,"Vérifiez que, lors de la négociation HTTP WebSocket initiale, le champ d’en-tête 'Origin' est vérifié par rapport à une liste d’origines autorisées pour l’application.",2 -V4,API et service Web,V4.4,WebSocket,V4.4.3,"Vérifiez que, si la gestion de session standard de l'application ne peut pas être utilisée, des jetons dédiés sont utilisés à cet effet, qui sont conformes aux exigences de sécurité de gestion de session pertinentes.",2 -V4,API et service Web,V4.4,WebSocket,V4.4.4,Vérifiez que les jetons de gestion de session WebSocket dédiés sont initialement obtenus ou validés via la session HTTPS précédemment authentifiée lors de la transition d'une session HTTPS existante vers un canal WebSocket.,2 -V5,Gestion des fichiers,V5.1,Documentation sur la gestion des fichiers,V5.1.1,"Vérifiez que la documentation définit les types de fichiers autorisés, les extensions de fichiers attendues et la taille maximale (y compris la taille décompressée) pour chaque fonctionnalité de Téléversement. De plus, assurez-vous que la documentation précise comment les fichiers sont sécurisés pour le téléchargement et le traitement des utilisateurs finaux, par exemple le comportement de l'application lorsqu'un fichier malveillant est détecté.",2 -V5,Gestion des fichiers,V5.2,Téléversement de fichiers et contenu,V5.2.1,Vérifiez que l'application n'acceptera que des fichiers d'une taille qu'elle peut traiter sans provoquer de perte de performances ou d'attaque par déni de service.,1 -V5,Gestion des fichiers,V5.2,Téléversement de fichiers et contenu,V5.2.2,"Vérifiez que lorsque l'application accepte un fichier, seul ou dans une archive telle qu'un fichier zip, elle vérifie si l'extension de fichier correspond à une extension attendue et que le contenu correspond au type représenté par l'extension. Cela inclut, sans s'y limiter, la vérification des « octets magiques » initiaux, la réécriture d'images et l'utilisation de bibliothèques spécialisées pour la validation du contenu des fichiers. Pour le niveau L1, cela peut se concentrer uniquement sur les fichiers utilisés pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau L2, cela doit s'appliquer à tous les fichiers acceptés.",1 -V5,Gestion des fichiers,V5.2,Téléversement de fichiers et contenu,V5.2.3,"Vérifiez que l'application vérifie les fichiers compressés (par exemple, zip, gz, docx, odt) par rapport à la taille maximale autorisée non compressée et au nombre maximal de fichiers avant de décompresser le fichier.",2 -V5,Gestion des fichiers,V5.2,Téléversement de fichiers et contenu,V5.2.4,Vérifiez qu'un quota de taille de fichier et un nombre maximal de fichiers par utilisateur sont appliqués pour garantir qu'un seul utilisateur ne puisse pas remplir le stockage avec trop de fichiers ou des fichiers excessivement volumineux.,3 -V5,Gestion des fichiers,V5.2,Téléversement de fichiers et contenu,V5.2.5,"Vérifiez que l'application n'autorise pas le téléversement de fichiers compressés contenant des liens symboliques, sauf si cela est spécifiquement requis (auquel cas il sera nécessaire d'appliquer une liste d'autorisation des fichiers vers lesquels il est possible de créer des liens symboliques).",3 -V5,Gestion des fichiers,V5.2,Téléversement de fichiers et contenu,V5.2.6,"Vérifiez que l'application rejette les images téléversées avec une taille de pixel supérieure au maximum autorisé, afin d'éviter les attaques par inondation de pixels.",3 -V5,Gestion des fichiers,V5.3,Stockage de fichiers,V5.3.1,Vérifiez que les fichiers téléversés ou générés par une entrée non fiable et stockés dans un dossier public ne sont pas exécutés en tant que code de programme côté serveur lorsqu'ils sont accessibles directement avec une requête HTTP.,1 -V5,Gestion des fichiers,V5.3,Stockage de fichiers,V5.3.2,"Vérifiez que lorsque l'application crée des chemins d'accès pour les opérations sur les fichiers, elle utilise des données générées en interne ou fiables plutôt que des noms de fichiers soumis par l'utilisateur. Si des noms de fichiers ou des métadonnées de fichiers soumis par l'utilisateur doivent être utilisés, une validation et un nettoyage stricts doivent être appliqués. Ceci permet de se protéger contre les attaques par traversée de chemin, l'inclusion de fichiers locaux ou distants (LFI, RFI) et la falsification de requêtes côté serveur (SSRF).",1 -V5,Gestion des fichiers,V5.3,Stockage de fichiers,V5.3.3,"Vérifiez que le traitement des fichiers côté serveur, comme la décompression des fichiers, ignore les informations de chemin fournies par l'utilisateur pour éviter les vulnérabilités telles que le ""zip slip"".",3 -V5,Gestion des fichiers,V5.4,Téléchargement de fichier,V5.4.1,"Vérifiez que l’application valide ou ignore les noms de fichiers soumis par l’utilisateur, y compris dans un paramètre JSON, JSONP ou URL et spécifie un nom de fichier dans le champ d’en-tête Content-Disposition de la réponse.",2 -V5,Gestion des fichiers,V5.4,Téléchargement de fichier,V5.4.2,"Vérifiez que les noms de fichiers servis (par exemple, dans les champs d'en-tête de réponse HTTP ou les pièces jointes aux e-mails) sont encodés ou nettoyés (par exemple, conformément à la RFC 6266) pour préserver la structure du document et empêcher les attaques par injection.",2 -V5,Gestion des fichiers,V5.4,Téléchargement de fichier,V5.4.3,Vérifiez que les fichiers obtenus à partir de sources non fiables sont analysés par des scanners antivirus pour empêcher la diffusion de contenu malveillant connu.,2 -V6,Authentification,V6.1,Documentation d'authentification,V6.1.1,"Vérifiez que la documentation de l'application définit comment les contrôles, tels que la limitation de débit, l'anti-automatisation et la réponse adaptative, sont utilisés pour se défendre contre les attaques telles que le « credential stuffing » et la force brute des mots de passe. La documentation doit expliquer clairement comment ces contrôles sont configurés et empêcher le blocage malveillant des comptes.",1 -V6,Authentification,V6.1,Documentation d'authentification,V6.1.2,"Vérifiez qu'une liste de mots spécifiques au contexte est documentée afin d'empêcher leur utilisation dans les mots de passe. Cette liste peut inclure des permutations de noms d'organisations, de produits, d'identifiants de systèmes, de noms de codes de projets, de noms de services ou de rôles, etc.",2 -V6,Authentification,V6.1,Documentation d'authentification,V6.1.3,"Vérifiez que, si l'application inclut plusieurs voies d'authentification, celles-ci sont toutes documentées avec les contrôles de sécurité et la force d'authentification qui doivent être appliqués de manière cohérente.",2 -V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.1,"Vérifiez que les mots de passe définis par l'utilisateur comportent au moins 8 caractères, bien qu'un minimum de 15 caractères soit fortement recommandé.",1 -V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.2,Vérifiez que les utilisateurs peuvent modifier leur mot de passe.,1 -V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.3,Vérifiez que la fonctionnalité de changement de mot de passe nécessite le mot de passe actuel et le nouveau mot de passe de l'utilisateur.,1 -V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.4,"Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou du changement de mot de passe sont vérifiés par rapport à un ensemble disponible d'au moins 3 000 mots de passe principaux qui correspondent à la politique de mot de passe de l'application, par exemple la longueur minimale.",1 -V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.5,"Vérifiez que les mots de passe peuvent être utilisés, quelle que soit leur composition, sans restriction quant au type de caractères autorisés. Aucun nombre minimal de majuscules ou de minuscules, de chiffres ou de caractères spéciaux ne doit être exigé.",1 -V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.6,Vérifiez que les champs de saisie du mot de passe utilisent type=password pour masquer la saisie. Les applications peuvent permettre à l'utilisateur d'afficher temporairement l'intégralité du mot de passe masqué ou le dernier caractère saisi.,1 -V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.7,"Vérifiez que la fonctionnalité « coller », les assistants de mot de passe du navigateur et les gestionnaires de mots de passe externes sont autorisés.",1 -V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.8,"Vérifiez que l'application vérifie le mot de passe de l'utilisateur exactement tel qu'il a été reçu de l'utilisateur, sans aucune modification telle qu'une troncature ou une transformation de casse.",1 -V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.9,Vérifiez que les mots de passe d’au moins 64 caractères sont autorisés.,2 -V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.10,Vérifiez que le mot de passe d'un utilisateur reste valide jusqu'à ce qu'il soit découvert comme compromis ou qu'il soit renouvelé. L'application ne doit pas exiger de renouvellement périodique des identifiants.,2 -V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.11,Vérifiez que la liste documentée de mots spécifiques au contexte est utilisée pour éviter la création de mots de passe faciles à deviner.,2 -V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.12,Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou des modifications de mot de passe sont vérifiés par rapport à un ensemble de mots de passe fuités.,2 -V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.1,Vérifiez que les contrôles visant à empêcher les attaques telles que le bourrage d'informations d'identification et la force brute des mots de passe sont mis en œuvre conformément à la documentation de sécurité de l'application.,1 -V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.2,"Vérifiez que les comptes d’utilisateur par défaut (par exemple, « root », « admin » ou « sa ») ne sont pas présents dans l’application ou sont désactivés.",1 -V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.3,Vérifiez que l’application exige que les utilisateurs utilisent un mécanisme d’authentification multifacteur ou une combinaison de mécanismes d’authentification à facteur unique.,2 -V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.4,"Vérifiez que, si l’application inclut plusieurs voies d’authentification, il n’existe aucune voie non documentée et que les contrôles de sécurité et la force d’authentification sont appliqués de manière cohérente.",2 -V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.5,"Vérifiez que les utilisateurs sont informés des tentatives d'authentification suspectes (réussies ou non). Il peut s'agir de tentatives d'authentification provenant d'un emplacement ou d'un client inhabituel, d'une authentification partiellement réussie (un seul facteur parmi plusieurs), d'une tentative d'authentification après une longue période d'inactivité ou d'une authentification réussie après plusieurs tentatives infructueuses.",3 -V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.6,Vérifiez que le courrier électronique n’est pas utilisé comme mécanisme d’authentification à facteur unique ou à facteurs multiples.,3 -V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.7,"Vérifiez que les utilisateurs sont avertis après les mises à jour des détails d'authentification, telles que les réinitialisations d'informations d'identification ou la modification du nom d'utilisateur ou de l'adresse e-mail.",3 -V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.8,"Vérifiez que les utilisateurs valides ne peuvent pas être déduits d'échecs d'authentification, par exemple en se basant sur des messages d'erreur, des codes de réponse HTTP ou des temps de réponse différents. Les fonctionnalités d'inscription et de mot de passe oublié doivent également bénéficier de cette protection.",3 -V6,Authentification,V6.4,Cycle de vie et récupération du facteur d'authentification,V6.4.1,"Vérifiez que les mots de passe initiaux ou les codes d'activation générés par le système sont générés de manière aléatoire et sécurisée, qu'ils respectent la politique de mots de passe en vigueur et qu'ils expirent après une courte période ou après leur première utilisation. Ces secrets initiaux ne doivent pas devenir des mots de passe permanents.",1 -V6,Authentification,V6.4,Cycle de vie et récupération du facteur d'authentification,V6.4.2,Vérifiez que les indices de mot de passe ou l'authentification basée sur les connaissances (appelées « questions secrètes ») ne sont pas présents.,1 -V6,Authentification,V6.4,Cycle de vie et récupération du facteur d'authentification,V6.4.3,"Vérifiez qu'un processus sécurisé de réinitialisation d'un mot de passe oublié est mis en œuvre, qui ne contourne aucun mécanisme d'authentification multifacteur activé.",2 -V6,Authentification,V6.4,Cycle de vie et récupération du facteur d'authentification,V6.4.4,"Vérifiez que si un facteur d'authentification multifacteur est perdu, la preuve de vérification d'identité est effectuée au même niveau que lors de l'inscription.",2 -V6,Authentification,V6.4,Cycle de vie et récupération du facteur d'authentification,V6.4.5,"Vérifiez que les instructions de renouvellement des mécanismes d'authentification qui expirent sont envoyées avec suffisamment de temps pour être exécutées avant l'expiration de l'ancien mécanisme d'authentification, en configurant des rappels automatiques si nécessaire.",3 -V6,Authentification,V6.4,Cycle de vie et récupération du facteur d'authentification,V6.4.6,"Vérifiez que les administrateurs peuvent initier la réinitialisation du mot de passe de l'utilisateur, mais que cela ne leur permet pas de modifier ou de choisir son mot de passe. Cela évite qu'ils ne connaissent le mot de passe de l'utilisateur.",3 -V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.1,"Vérifiez que les secrets de recherche, les demandes ou codes d'authentification out-of-band et les mots de passe à usage unique basés sur le temps (TOTP) ne peuvent être utilisés avec succès qu'une seule fois.",2 -V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.2,"Vérifiez que, lors de leur stockage dans le backend de l'application, les secrets de recherche comportant moins de 112 bits d'entropie (19 caractères alphanumériques aléatoires ou 34 chiffres aléatoires) sont hachés avec un algorithme de hachage de stockage de mots de passe approuvé, intégrant un sel aléatoire de 32 bits. Une fonction de hachage standard peut être utilisée si le secret comporte 112 bits d'entropie ou plus.",2 -V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.3,"Vérifiez que les secrets de recherche, le code d'authentification out-of-band et les mots de passe à usage unique basés sur le temps sont générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) pour éviter les valeurs prévisibles.",2 -V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.4,Vérifiez que les secrets de recherche et les codes d'authentification out-of-band ont un minimum de 20 bits d'entropie (généralement 4 caractères alphanumériques aléatoires ou 6 chiffres aléatoires suffisent).,2 -V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.5,"Vérifiez que les requêtes, codes ou jetons d'authentification out-of-band, ainsi que les mots de passe à usage unique (TOTP), ont une durée de vie définie. Les requêtes out-of-band doivent avoir une durée de vie maximale de 10 minutes et les TOTP, de 30 secondes.",2 -V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.6,Vérifiez que tout facteur d’authentification (y compris les appareils physiques) peut être révoqué en cas de vol ou autre perte.,3 -V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.7,"Vérifiez que les mécanismes d’authentification biométrique ne sont utilisés que comme facteurs secondaires, avec quelque chose que vous possédez ou quelque chose que vous savez.",3 -V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.8,Vérifiez que les mots de passe à usage unique basés sur le temps (TOTP) sont vérifiés en fonction d'une source temporelle provenant d'un service de confiance et non d'une heure non fiable ou fournie par le client.,3 -V6,Authentification,V6.6,Mécanismes d'authentification out-of-band,V6.6.1,"Vérifier que les mécanismes d'authentification utilisant le réseau téléphonique public commuté (RTPC) pour la transmission de mots de passe à usage unique (OTP) par téléphone ou SMS ne sont proposés que lorsque le numéro de téléphone a été préalablement validé. D'autres méthodes plus robustes (telles que les mots de passe à usage unique à durée déterminée) sont également proposées, et que le service informe les utilisateurs des risques de sécurité qu'elles présentent. Pour les applications de niveau 3, le téléphone et les SMS ne doivent pas être disponibles.",2 -V6,Authentification,V6.6,Mécanismes d'authentification out-of-band,V6.6.2,"Vérifiez que les demandes d’authentification out-of-band, les codes ou les jetons sont liés à la demande d’authentification d’origine pour laquelle ils ont été générés et ne sont pas utilisables pour une demande précédente ou ultérieure.",2 -V6,Authentification,V6.6,Mécanismes d'authentification out-of-band,V6.6.3,"Vérifiez qu'un mécanisme d'authentification out-of-band basé sur du code est protégé contre les attaques par force brute grâce au ""rate limiting"". Envisagez également d'utiliser un code avec au moins 64 bits d'entropie.",2 -V6,Authentification,V6.6,Mécanismes d'authentification out-of-band,V6.6.4,"Vérifiez que, lorsque les notifications push sont utilisées pour l'authentification multifacteur, le ""rate limiting"" est appliqué afin d'empêcher les attaques de type « push bombing ». La concordance des numéros peut également atténuer ce risque.",3 -V6,Authentification,V6.7,Mécanisme d'authentification cryptographique,V6.7.1,Vérifiez que les certificats utilisés pour vérifier les assertions d’authentification cryptographique sont stockés de manière à les protéger contre toute modification.,3 -V6,Authentification,V6.7,Mécanisme d'authentification cryptographique,V6.7.2,Vérifiez que le nonce de défi a une longueur d'au moins 64 bits et qu'il est statistiquement unique ou unique sur toute la durée de vie du périphérique cryptographique.,3 -V6,Authentification,V6.8,Authentification avec un fournisseur d'identité,V6.8.1,"Vérifiez que, si l'application prend en charge plusieurs fournisseurs d'identité (IdP), l'identité de l'utilisateur ne peut pas être usurpée via un autre fournisseur d'identité pris en charge (par exemple, en utilisant le même identifiant utilisateur). La mesure standard consisterait à ce que l'application enregistre et identifie l'utilisateur à l'aide d'une combinaison de l'ID du fournisseur d'identité (servant d'espace de noms) et de l'ID de l'utilisateur dans le fournisseur d'identité.",2 -V6,Authentification,V6.8,Authentification avec un fournisseur d'identité,V6.8.2,"Vérifiez que la présence et l'intégrité des signatures numériques sur les assertions d'authentification (par exemple sur les assertions JWT ou SAML) sont toujours validées, en rejetant toutes les assertions non signées ou ayant des signatures non valides.",2 -V6,Authentification,V6.8,Authentification avec un fournisseur d'identité,V6.8.3,Vérifiez que les assertions SAML sont traitées de manière unique et utilisées une seule fois au cours de la période de validité pour éviter les attaques par rejeu.,2 -V6,Authentification,V6.8,Authentification avec un fournisseur d'identité,V6.8.4,"Si une application utilise un fournisseur d'identité (IdP) distinct et attend une force, des méthodes ou une date d'authentification spécifiques pour des fonctions spécifiques, vérifiez que l'application les vérifie à l'aide des informations renvoyées par l'IdP. Par exemple, si OIDC est utilisé, cela peut être réalisé en validant les affirmations de jeton d'identification telles que « acr », « amr » et « auth_time » (le cas échéant). Si l'IdP ne fournit pas ces informations, l'application doit disposer d'une approche de secours documentée qui suppose que le mécanisme d'authentification de force minimale a été utilisé (par exemple, une authentification à facteur unique avec nom d'utilisateur et mot de passe).",2 -V7,Gestion des sessions,V7.1,Documentation sur la gestion des sessions,V7.1.1,"Vérifiez que le délai d'inactivité de la session de l'utilisateur et la durée de vie maximale absolue de la session sont documentés, sont appropriés en combinaison avec d'autres contrôles et que la documentation inclut une justification de tout écart par rapport aux exigences de réauthentification NIST SP 800-63B.",2 -V7,Gestion des sessions,V7.1,Documentation sur la gestion des sessions,V7.1.2,Vérifiez que la documentation définit le nombre de sessions simultanées (parallèles) autorisées pour un compte ainsi que les comportements et actions prévus à entreprendre lorsque le nombre maximal de sessions actives est atteint.,2 -V7,Gestion des sessions,V7.1,Documentation sur la gestion des sessions,V7.1.3,"Vérifiez que tous les systèmes qui créent et gèrent des sessions utilisateur dans le cadre d'un écosystème de gestion des identités fédérées (tels que les systèmes SSO) sont documentés avec des contrôles pour coordonner la durée de vie des sessions, la résiliation et toute autre condition nécessitant une réauthentification.",2 -V7,Gestion des sessions,V7.2,Sécurité fondamentale de la gestion des sessions,V7.2.1,Vérifiez que l’application effectue toutes les vérifications des jetons de session à l’aide d’un service backend de confiance.,1 -V7,Gestion des sessions,V7.2,Sécurité fondamentale de la gestion des sessions,V7.2.2,"Vérifiez que l'application utilise des jetons autonomes ou de référence générés dynamiquement pour la gestion des sessions, c'est-à-dire sans utiliser de secrets et de clés d'API statiques.",1 -V7,Gestion des sessions,V7.2,Sécurité fondamentale de la gestion des sessions,V7.2.3,"Vérifiez que si des jetons par référence sont utilisés pour représenter les sessions utilisateur, ils sont uniques et générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et possèdent au moins 128 bits d'entropie.",1 -V7,Gestion des sessions,V7.2,Sécurité fondamentale de la gestion des sessions,V7.2.4,"Vérifiez que l’application génère un nouveau jeton de session lors de l’authentification de l’utilisateur, y compris la réauthentification, et met fin au jeton de session actuel.",1 -V7,Gestion des sessions,V7.3,Délai d'expiration de la session,V7.3.1,Vérifiez qu’il existe un délai d’inactivité tel que la réauthentification soit appliquée conformément à l’analyse des risques et aux décisions de sécurité documentées.,2 -V7,Gestion des sessions,V7.3,Délai d'expiration de la session,V7.3.2,Vérifiez qu'il existe une durée de vie maximale absolue de la session de sorte que la réauthentification soit appliquée conformément à l'analyse des risques et aux décisions de sécurité documentées.,2 -V7,Gestion des sessions,V7.4,Fin de session,V7.4.1,"Vérifiez que lorsque la fin de session est déclenchée (par exemple, déconnexion ou expiration), l'application interdit toute utilisation ultérieure de la session. Pour les jetons par référence ou les sessions avec état, cela implique l'invalidation des données de session au niveau du backend de l'application. Les applications utilisant des jetons autonomes nécessiteront une solution, comme la gestion d'une liste des jetons terminés, l'interdiction des jetons produits avant une date et une heure spécifique à chaque utilisateur ou la rotation d'une clé de signature spécifique à chaque utilisateur.",1 -V7,Gestion des sessions,V7.4,Fin de session,V7.4.2,"Vérifiez que l'application met fin à toutes les sessions actives lorsqu'un compte utilisateur est désactivé ou supprimé (par exemple, lorsqu'un employé quitte l'entreprise).",1 -V7,Gestion des sessions,V7.4,Fin de session,V7.4.3,"Vérifiez que l'application offre la possibilité de mettre fin à toutes les autres sessions actives après une modification ou une suppression réussie de tout facteur d'authentification (y compris la modification du mot de passe via une réinitialisation ou une récupération et, le cas échéant, une mise à jour des paramètres MFA).",2 -V7,Gestion des sessions,V7.4,Fin de session,V7.4.4,Vérifiez que toutes les pages nécessitant une authentification disposent d’un accès facile et visible à la fonctionnalité de déconnexion.,2 -V7,Gestion des sessions,V7.4,Fin de session,V7.4.5,Vérifiez que les administrateurs d’applications sont en mesure de mettre fin aux sessions actives pour un utilisateur individuel ou pour tous les utilisateurs.,2 -V7,Gestion des sessions,V7.5,Défenses contre les abus de session,V7.5.1,"Vérifiez que l'application nécessite une réauthentification complète avant d'autoriser les modifications des attributs de compte sensibles qui peuvent affecter l'authentification, tels que l'adresse e-mail, le numéro de téléphone, la configuration MFA ou d'autres informations utilisées dans la récupération de compte.",2 -V7,Gestion des sessions,V7.5,Défenses contre les abus de session,V7.5.2,Vérifiez que les utilisateurs peuvent afficher et (après s'être authentifiés à nouveau avec au moins un facteur) terminer une ou toutes les sessions actuellement actives.,2 -V7,Gestion des sessions,V7.5,Défenses contre les abus de session,V7.5.3,Vérifiez que l’application nécessite une authentification supplémentaire avec au moins un facteur ou une vérification secondaire avant d’effectuer des transactions ou des opérations hautement sensibles.,3 -V7,Gestion des sessions,V7.6,Réauthentification fédérée,V7.6.1,"Vérifiez que la durée de vie et la fin de la session entre les parties de confiance (RP) et les fournisseurs d'identité (IdP) se comportent comme documenté, en exigeant une réauthentification si nécessaire, par exemple lorsque le temps maximal entre les événements d'authentification IdP est atteint.",2 -V7,Gestion des sessions,V7.6,Réauthentification fédérée,V7.6.2,"Vérifiez que la création d'une session nécessite soit le consentement de l'utilisateur, soit une action explicite, empêchant ainsi la création de nouvelles sessions d'application sans interaction de l'utilisateur.",2 -V8,Autorisation,V8.1,Documentation d'autorisation,V8.1.1,Vérifiez que la documentation d’autorisation définit des règles de restriction de l’accès au niveau de la fonction et aux données en fonction des autorisations du consommateur et des attributs des ressources.,1 -V8,Autorisation,V8.1,Documentation d'autorisation,V8.1.2,"Vérifiez que la documentation d'autorisation définit les règles de restriction d'accès au niveau des champs (lecture et écriture) en fonction des autorisations des consommateurs et des attributs des ressources. Notez que ces règles peuvent dépendre d'autres valeurs d'attributs de l'objet de données concerné, telles que l'état ou le statut.",2 -V8,Autorisation,V8.1,Documentation d'autorisation,V8.1.3,"Vérifiez que la documentation de l'application définit les attributs environnementaux et contextuels (y compris, mais sans s'y limiter, l'heure de la journée, l'emplacement de l'utilisateur, l'adresse IP ou l'appareil) qui sont utilisés dans l'application pour prendre des décisions de sécurité, y compris celles relatives à l'authentification et à l'autorisation.",3 -V8,Autorisation,V8.1,Documentation d'autorisation,V8.1.4,"Vérifier que la documentation d'authentification et d'autorisation définit l'utilisation des facteurs environnementaux et contextuels dans la prise de décision, en plus des autorisations au niveau des fonctions, des données et des champs. Cela doit inclure les attributs évalués, les seuils de risque et les actions entreprises (par exemple, autorisation, contestation, refus, renforcement de l'authentification).",3 -V8,Autorisation,V8.2,Conception d'autorisation générale,V8.2.1,Vérifiez que l’application garantit que l’accès basé sur la fonction est limité aux consommateurs disposant d’autorisations explicites.,1 -V8,Autorisation,V8.2,Conception d'autorisation générale,V8.2.2,Vérifiez que l'application garantit que l'accès spécifique aux données est limité aux consommateurs disposant d'autorisations explicites sur des éléments de données spécifiques afin d'atténuer les références d'objet directes non sécurisées (IDOR) et les autorisations de niveau d'objet rompues (BOLA).,1 -V8,Autorisation,V8.2,Conception d'autorisation générale,V8.2.3,Vérifiez que l'application garantit que l'accès au niveau du champ est limité aux consommateurs disposant d'autorisations explicites sur des champs spécifiques afin d'atténuer les problèmes d'autorisation au niveau de la propriété d'objet (BOPLA).,2 -V8,Autorisation,V8.2,Conception d'autorisation générale,V8.2.4,"Vérifiez que les contrôles de sécurité adaptatifs basés sur les attributs environnementaux et contextuels du consommateur (tels que l'heure, la localisation, l'adresse IP ou l'appareil) sont mis en œuvre pour les décisions d'authentification et d'autorisation, comme défini dans la documentation de l'application. Ces contrôles doivent être appliqués lorsque le consommateur tente de démarrer une nouvelle session et également pendant une session existante.",3 -V8,Autorisation,V8.3,Autorisation par opération,V8.3.1,"Vérifier que l'application applique les règles d'autorisations au niveau de la couche service de confiance et ne s’appuie pas sur des contrôles qu’un consommateur non approuvé pourrait manipuler, comme JavaScript côté client.",1 -V8,Autorisation,V8.3,Autorisation par opération,V8.3.2,"Vérifiez que les modifications apportées aux valeurs sur lesquelles reposent les décisions d'autorisation sont appliquées immédiatement. Lorsque les modifications ne peuvent pas être appliquées immédiatement (par exemple, en s'appuyant sur des données de jetons autonomes), des contrôles d'atténuation doivent être mis en place pour alerter un consommateur lorsqu'il effectue une action alors qu'il n'est plus autorisé à le faire et annuler la modification. Notez que cette solution alternative ne limiterait pas les fuites d'informations.",3 -V8,Autorisation,V8.3,Autorisation par opération,V8.3.3,"Vérifiez que l'accès à un objet repose sur les autorisations du sujet d'origine (par exemple, le consommateur), et non sur celles d'un intermédiaire ou d'un service agissant en son nom. Par exemple, si un consommateur appelle un service web à l'aide d'un jeton d'authentification autonome, et que ce service demande ensuite des données à un autre service, ce dernier utilisera le jeton du consommateur, plutôt qu'un jeton inter-machine du premier service, pour prendre les décisions d'autorisation.",3 -V8,Autorisation,V8.4,Autres considérations relatives à l'autorisation,V8.4.1,Vérifiez que les applications multi-tenants utilisent des contrôles inter-tenants pour garantir que les opérations des consommateurs n'affecteront jamais les tenants avec lesquels ils ne sont pas autorisés à interagir.,2 -V8,Autorisation,V8.4,Autres considérations relatives à l'autorisation,V8.4.2,"Vérifiez que l'accès aux interfaces administratives intègre plusieurs couches de sécurité, notamment la vérification continue de l'identité du consommateur, l'évaluation de la posture de sécurité des appareils et l'analyse contextuelle des risques, garantissant que l'emplacement du réseau ou les endpoints approuvés ne sont pas les seuls facteurs d'autorisation, même s'ils peuvent réduire la probabilité d'accès non autorisé.",3 -V9,Jetons autonomes,V9.1,Source et intégrité du jeton,V9.1.1,Vérifiez que les jetons autonomes sont validés à l'aide de leur signature numérique ou MAC pour les protéger contre toute falsification avant d'accepter le contenu du jeton.,1 -V9,Jetons autonomes,V9.1,Source et intégrité du jeton,V9.1.2,"Vérifiez que seuls les algorithmes d'une liste d’autorisations peuvent être utilisés pour créer et vérifier des jetons autonomes, dans un contexte donné. La liste d'autorisation doit inclure les algorithmes autorisés, idéalement symétriques ou asymétriques, et ne doit pas inclure l'algorithme « Aucun ». Si les algorithmes symétriques et asymétriques doivent être pris en charge, des contrôles supplémentaires seront nécessaires pour éviter toute confusion de clés.",1 -V9,Jetons autonomes,V9.1,Source et intégrité du jeton,V9.1.3,"Vérifiez que les clés utilisées pour valider les jetons autonomes proviennent de sources préconfigurées et fiables pour l'émetteur du jeton, empêchant ainsi les attaquants de spécifier des sources et des clés non fiables. Pour les JWT et autres structures JWS, les en-têtes tels que « jku », « x5u » et « jwk » doivent être validés par rapport à une liste d'autorisation de sources fiables.",1 -V9,Jetons autonomes,V9.2,Contenu du jeton,V9.2.1,"Vérifiez que, si une période de validité est indiquée dans les données du jeton, celui-ci et son contenu ne sont acceptés que si la date de vérification est comprise dans cette période. Par exemple, pour les JWT, les déclarations « nbf » et « exp » doivent être vérifiées.",1 -V9,Jetons autonomes,V9.2,Contenu du jeton,V9.2.2,"Vérifiez que le service recevant un jeton valide le type de jeton et son utilisation avant d'en accepter le contenu. Par exemple, seuls les jetons d'accès peuvent être acceptés pour les décisions d'autorisation, et seuls les jetons d'identification peuvent être utilisés pour prouver l'authentification des utilisateurs.",2 -V9,Jetons autonomes,V9.2,Contenu du jeton,V9.2.3,"Vérifiez que le service accepte uniquement les jetons destinés à être utilisés avec ce service (audience). Pour les JWT, cela peut être réalisé en validant la déclaration « aud » par rapport à une liste d'autorisation définie dans le service.",2 -V9,Jetons autonomes,V9.2,Contenu du jeton,V9.2.4,"Si un émetteur de jetons utilise la même clé privée pour émettre des jetons destinés à différentes audiences, vérifiez que les jetons émis contiennent une restriction d'audience identifiant de manière unique les audiences visées. Cela empêchera la réutilisation d'un jeton avec une audience non prévue. Si l'identifiant d'audience est provisionné dynamiquement, l'émetteur de jetons doit valider ces audiences afin de garantir qu'elles n'entraînent pas d'usurpation d'identité.",2 -V10,Oauth et OIDC,V10.1,Sécurité générique OAuth et OIDC,V10.1.1,"Vérifiez que les jetons sont envoyés uniquement aux composants qui en ont absolument besoin. Par exemple, lors de l'utilisation d'un modèle backend-for-frontend pour les applications JavaScript basées sur un navigateur, les jetons d'accès et d'actualisation ne doivent être accessibles qu'au backend.",2 -V10,Oauth et OIDC,V10.1,Sécurité générique OAuth et OIDC,V10.1.2,"Vérifiez que le client n'accepte les valeurs du serveur d'autorisation (telles que le code d'autorisation ou le jeton d'identification) que si elles résultent d'un flux d'autorisation initié par la même session d'agent utilisateur et la même transaction. Cela nécessite que les secrets générés par le client, tels que la clé de preuve pour l'échange de codes (PKCE) « code_verifier », « state » ou le nonce OIDC, ne puissent être devinés, soient spécifiques à la transaction et soient liés de manière sécurisée au client et à la session d'agent utilisateur au cours de laquelle la transaction a été initiée.",2 -V10,Oauth et OIDC,V10.2,Client OAuth,V10.2.1,"Vérifiez que, si le flux de code est utilisé, le client OAuth dispose d'une protection contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF), qui déclenchent des demandes de jetons, soit en utilisant la fonctionnalité de clé de preuve pour l'échange de code (PKCE), soit en vérifiant le paramètre « state » envoyé dans la demande d'autorisation.",2 -V10,Oauth et OIDC,V10.2,Client OAuth,V10.2.2,"Vérifiez que, si le client OAuth peut interagir avec plusieurs serveurs d'autorisation, il dispose d'une protection contre les attaques par confusion. Par exemple, il peut exiger que le serveur d'autorisation renvoie la valeur du paramètre « iss » et la valide dans la réponse d'autorisation et la réponse du jeton.",2 -V10,Oauth et OIDC,V10.2,Client OAuth,V10.2.3,Vérifiez que le client OAuth demande uniquement les portées requises (ou d’autres paramètres d’autorisation) dans les requêtes adressées au serveur d’autorisation.,3 -V10,Oauth et OIDC,V10.3,Serveur de ressources OAuth,V10.3.1,Vérifiez que le serveur de ressources accepte uniquement les jetons d'accès destinés à être utilisés avec ce service (audience). L'audience peut être incluse dans un jeton d'accès structuré (comme la déclaration « aud » dans JWT) ou vérifiée à l'aide du endpoint d'introspection de jeton.,2 -V10,Oauth et OIDC,V10.3,Serveur de ressources OAuth,V10.3.2,"Vérifiez que le serveur de ressources applique les décisions d'autorisation en fonction des déclarations du jeton d'accès définissant l'autorisation déléguée. Si des déclarations telles que « sub », « scope » et « authorization_details » sont présentes, elles doivent être prises en compte dans la décision.",2 -V10,Oauth et OIDC,V10.3,Serveur de ressources OAuth,V10.3.3,"Vérifiez que si une décision de contrôle d'accès nécessite l'identification d'un utilisateur unique à partir d'un jeton d'accès (JWT ou réponse d'introspection de jeton associé), le serveur de ressources identifie l'utilisateur à partir de déclarations non ré attribuables à d'autres utilisateurs. En général, cela implique l'utilisation d'une combinaison de déclarations « iss » et « sub ».",2 -V10,Oauth et OIDC,V10.3,Serveur de ressources OAuth,V10.3.4,"Si le serveur de ressources requiert une force d'authentification, des méthodes ou une date d'expiration spécifiques, vérifiez que le jeton d'accès présenté respecte ces contraintes. Par exemple, s'il est présent, utilisez les déclarations OIDC « acr », « amr » et « auth_time » respectivement.",2 -V10,Oauth et OIDC,V10.3,Serveur de ressources OAuth,V10.3.5,"Vérifiez que le serveur de ressources empêche l'utilisation de jetons d'accès volés ou la relecture de jetons d'accès (de parties non autorisées) en exigeant des jetons d'accès limités par l'expéditeur, soit Mutual TLS pour OAuth 2, soit OAuth 2 Demonstration of Proof of Possession (DPoP).",3 -V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.1,Vérifiez que le serveur d'autorisation valide les URI de redirection en fonction d'une liste d'autorisation spécifique au client d'URI préenregistrés à l'aide d'une comparaison de chaînes exacte.,1 -V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.2,"Vérifiez que, si le serveur d'autorisation renvoie le code d'autorisation dans la réponse, celui-ci ne peut être utilisé qu'une seule fois pour une demande de jeton. Pour la deuxième demande valide avec un code d'autorisation déjà utilisé pour émettre un jeton d'accès, le serveur d'autorisation doit rejeter la demande de jeton et révoquer tous les jetons émis liés au code d'autorisation.",1 -V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.3,Vérifiez que le code d'autorisation est de courte durée. La durée de vie maximale peut atteindre 10 minutes pour les applications L1 et L2 et 1 minute pour les applications L3.,1 -V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.4,"Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement l'utilisation des autorisations nécessaires à ce client. Notez que les autorisations « token » (flux implicite) et « password » (flux d'informations d'identification du propriétaire de la ressource) ne doivent plus être utilisées.",1 -V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.5,"Vérifiez que le serveur d'autorisation atténue les attaques par rejeu de jetons d'actualisation pour les clients publics, de préférence en utilisant des jetons d'actualisation limités par l'expéditeur, par exemple des jetons DPoP (Demonstrating Proof of Possession) ou des jetons d'accès liés à un certificat utilisant le protocole TLS mutuel (mTLS). Pour les applications L1 et L2, la rotation des jetons d'actualisation peut être utilisée. Si cette rotation est utilisée, le serveur d'autorisation doit invalider le jeton d'actualisation après utilisation et révoquer tous les jetons d'actualisation de cette autorisation si un jeton d'actualisation déjà utilisé et invalidé est fourni.",1 -V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.6,"Vérifiez que, si l'octroi de code est utilisé, le serveur d'autorisation atténue les attaques par interception de code en exigeant une clé de preuve pour l'échange de code (PKCE). Pour les demandes d'autorisation, le serveur d'autorisation doit exiger une valeur « code_challenge » valide et ne doit pas accepter une valeur « plain » pour « code_challenge_method ». Pour une demande de jeton, il doit exiger la validation du paramètre « code_verifier ».",2 -V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.7,"Vérifiez que si le serveur d'autorisation prend en charge l'enregistrement dynamique des clients non authentifiés, il réduit le risque d'applications clientes malveillantes. Il doit valider les métadonnées clientes, telles que les URI enregistrés, garantir le consentement de l'utilisateur et l'avertir avant de traiter une demande d'autorisation avec une application cliente non approuvée.",2 -V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.8,"Vérifiez que les jetons d’actualisation ont une expiration absolue, y compris si l’expiration du jeton d’actualisation glissant est appliquée.",2 -V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.9,"Vérifiez que les jetons d'actualisation et les jetons d'accès de référence peuvent être révoqués par un utilisateur autorisé à l'aide de l'interface utilisateur du serveur d'autorisation, afin d'atténuer le risque de clients malveillants ou de jetons volés.",2 -V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.10,"Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.",2 -V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.11,"Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.",2 -V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.12,"Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement la valeur « response_mode » dont ce client a besoin. Par exemple, en vérifiant cette valeur par rapport aux valeurs attendues ou en utilisant une requête d'autorisation poussée (PAR) ou une requête d'autorisation sécurisée par JWT (JAR).",3 -V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.13,Vérifiez que le type d'Autorisation « code » est toujours utilisé avec les demandes d'autorisation poussées (PAR).,3 -V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.14,"Vérifiez que le serveur d'autorisation émet uniquement des jetons d'accès limités à l'expéditeur (preuve de possession), soit avec des jetons d'accès liés au certificat utilisant TLS mutuel (mTLS), soit avec des jetons d'accès liés au DPoP (démonstration de preuve de possession).",3 -V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.15,"Vérifiez que, pour un client côté serveur (non exécuté sur l'appareil de l'utilisateur final), le serveur d'autorisation garantit que la valeur du paramètre « authorization_details » provient du backend client et que l'utilisateur ne l'a pas altérée. Par exemple, en exigeant l'utilisation d'une demande d'autorisation poussée (PAR) ou d'une demande d'autorisation sécurisée par JWT (JAR).",3 -V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.16,"Vérifiez que le client est confidentiel et que le serveur d'autorisation requiert l'utilisation de méthodes d'authentification client fortes (basées sur la cryptographie à clé publique et résistantes aux attaques par relecture), telles que TLS mutuel ('tls_client_auth', 'self_signed_tls_client_auth') ou JWT à clé privée ('private_key_jwt').",3 -V10,Oauth et OIDC,V10.5,Client OIDC,V10.5.1,"Vérifiez que le client (en tant que partie utilisatrice) atténue les attaques par rejeu de jeton d'identification. Par exemple, en vous assurant que la valeur « nonce » du jeton d'identification correspond à la valeur « nonce » envoyée dans la demande d'authentification au fournisseur OpenID (appelée demande d'autorisation envoyée au serveur d'autorisation dans OAuth2).",2 -V10,Oauth et OIDC,V10.5,Client OIDC,V10.5.2,"Vérifiez que le client identifie de manière unique l'utilisateur à partir des déclarations de jeton d'identification, généralement la déclaration « sub », qui ne peut pas être réaffectée à d'autres utilisateurs (pour la portée d'un fournisseur d'identité).",2 -V10,Oauth et OIDC,V10.5,Client OIDC,V10.5.3,Vérifiez que le client rejette les tentatives d'un serveur d'autorisation malveillant d'usurper l'identité d'un autre serveur d'autorisation via ses métadonnées. Le client doit rejeter les métadonnées du serveur d'autorisation si l'URL de l'émetteur figurant dans ces métadonnées ne correspond pas exactement à l'URL d'émetteur préconfigurée attendue par le client.,2 -V10,Oauth et OIDC,V10.5,Client OIDC,V10.5.4,Vérifiez que le client valide que le jeton d'identification est destiné à être utilisé pour ce client (audience) en vérifiant que la déclaration « aud » du jeton est égale à la valeur « client_id » pour le client.,2 -V10,Oauth et OIDC,V10.5,Client OIDC,V10.5.5,"Vérifiez que, lors de l'utilisation de la déconnexion du back-channel OIDC, la partie utilisatrice atténue les risques de déni de service liés à la déconnexion forcée et à la confusion entre JWT dans le flux de déconnexion. Le client doit vérifier que le jeton de déconnexion est correctement typé avec la valeur « logout+jwt », qu'il contient la déclaration « event » avec le nom de membre correct et qu'il ne contient pas de déclaration « nonce ». Il est également recommandé d'utiliser une expiration courte (par exemple, 2 minutes).",2 -V10,Oauth et OIDC,V10.6,Fournisseur OpenID,V10.6.1,"Vérifiez que le fournisseur OpenID n'autorise que les valeurs « code », « ciba », « id_token » ou « id_token code » pour le mode de réponse. Notez que « code » est préférable à « id_token code » (flux hybride OIDC) et que « token » (tout flux implicite) ne doit pas être utilisé.",2 -V10,Oauth et OIDC,V10.6,Fournisseur OpenID,V10.6.2,"Vérifiez que le fournisseur OpenID atténue les risques de déni de service liés à la déconnexion forcée. Pour ce faire, obtenez une confirmation explicite de l'utilisateur final ou, le cas échéant, validez les paramètres de la requête de déconnexion (initiée par la partie utilisatrice), comme « id_token_hint ».",2 -V10,Oauth et OIDC,V10.7,Gestion du consentement,V10.7.1,"Vérifiez que le serveur d'autorisation garantit le consentement de l'utilisateur à chaque demande d'autorisation. Si l'identité du client ne peut être garantie, le serveur d'autorisation doit toujours demander explicitement le consentement de l'utilisateur.",2 -V10,Oauth et OIDC,V10.7,Gestion du consentement,V10.7.2,"Vérifiez que lorsque le serveur d'autorisation demande le consentement de l'utilisateur, il fournit des informations claires et suffisantes sur ce qui est consenti. Le cas échéant, ces informations doivent inclure la nature des autorisations demandées (généralement en fonction de la portée, du serveur de ressources et des détails d'autorisation RAR), l'identité de l'application autorisée et la durée de vie de ces autorisations.",2 -V10,Oauth et OIDC,V10.7,Gestion du consentement,V10.7.3,"Vérifiez que l’utilisateur peut consulter, modifier et révoquer les consentements qu’il a accordés via le serveur d’autorisation.",2 -V11,Cryptographie,V11.1,Inventaire et documentation cryptographiques,V11.1.1,"Vérifiez qu’il existe une politique documentée pour la gestion des clés cryptographiques et un cycle de vie des clés cryptographiques qui suit une norme de gestion des clés telle que NIST SP 800-57. Cela devrait inclure la garantie que les clés ne sont pas sur-partagées (par exemple, avec plus de deux entités pour les secrets partagés et plus d’une entité pour les clés privées).",2 -V11,Cryptographie,V11.1,Inventaire et documentation cryptographiques,V11.1.2,"Vérifiez qu'un inventaire cryptographique est réalisé, maintenu et régulièrement mis à jour, et qu'il inclut toutes les clés, algorithmes et certificats cryptographiques utilisés par l'application. Il doit également documenter les emplacements du système où les clés peuvent ou non être utilisées, ainsi que les types de données qui peuvent ou non être protégées par ces clés.",2 -V11,Cryptographie,V11.1,Inventaire et documentation cryptographiques,V11.1.3,"Vérifiez que les mécanismes de découverte cryptographique sont utilisés pour identifier toutes les instances de cryptographie dans le système, y compris les opérations de chiffrement, de hachage et de signature.",3 -V11,Cryptographie,V11.1,Inventaire et documentation cryptographiques,V11.1.4,"Vérifier la tenue d'un inventaire cryptographique. Celui-ci doit inclure un plan documenté décrivant la migration vers de nouvelles normes cryptographiques, telles que la cryptographie post-quantique, afin de réagir aux menaces futures.",3 -V11,Cryptographie,V11.2,Mise en œuvre sécurisée de la cryptographie,V11.2.1,Vérifiez que les implémentations validées par l’industrie (y compris les bibliothèques et les implémentations accélérées par le matériel) sont utilisées pour les opérations cryptographiques.,2 -V11,Cryptographie,V11.2,Mise en œuvre sécurisée de la cryptographie,V11.2.2,"Vérifiez que l'application est conçue avec une agilité cryptographique, de sorte que les nombres aléatoires, le chiffrement authentifié, le MAC ou les algorithmes de hachage, les longueurs de clés, les tours, les chiffrements et les modes puissent être reconfigurés, mis à niveau ou échangés à tout moment, afin de se protéger contre les failles cryptographiques. De même, il doit être possible de remplacer les clés et les mots de passe, ainsi que de rechiffrer les données. Cela permettra des mises à niveau transparentes vers la cryptographie post-quantique (PQC), une fois que des implémentations hautement sécurisées de schémas ou de normes PQC approuvés seront largement disponibles.",2 -V11,Cryptographie,V11.2,Mise en œuvre sécurisée de la cryptographie,V11.2.3,"Vérifiez que toutes les primitives cryptographiques utilisent un minimum de 128 bits de sécurité en fonction de l'algorithme, de la taille de la clé et de la configuration. Par exemple, une clé ECC de 256 bits offre environ 128 bits de sécurité, tandis que RSA nécessite une clé de 3072 bits pour atteindre 128 bits de sécurité.",2 -V11,Cryptographie,V11.2,Mise en œuvre sécurisée de la cryptographie,V11.2.4,"Vérifiez que toutes les opérations cryptographiques sont à temps constant, sans opérations de « court-circuit » dans les comparaisons, les calculs ou les retours, pour éviter toute fuite d'informations.",3 -V11,Cryptographie,V11.2,Mise en œuvre sécurisée de la cryptographie,V11.2.5,"Vérifiez que tous les modules cryptographiques échouent en toute sécurité et que les erreurs sont gérées de manière à ne pas permettre de vulnérabilités, telles que les attaques Padding Oracle.",3 -V11,Cryptographie,V11.3,Algorithmes de chiffrement,V11.3.1,"Vérifiez que les modes de bloc non sécurisés (par exemple, ECB) et les schémas de remplissage faibles (par exemple, PKCS#1 v1.5) ne sont pas utilisés.",1 -V11,Cryptographie,V11.3,Algorithmes de chiffrement,V11.3.2,Vérifiez que seuls les chiffrements et modes approuvés tels que AES avec GCM sont utilisés.,1 -V11,Cryptographie,V11.3,Algorithmes de chiffrement,V11.3.3,"Vérifiez que les données chiffrées sont protégées contre toute modification non autorisée, de préférence en utilisant une méthode de chiffrement authentifiée approuvée ou en combinant une méthode de chiffrement approuvée avec un algorithme MAC approuvé.",2 -V11,Cryptographie,V11.3,Algorithmes de chiffrement,V11.3.4,"Vérifiez que les nonces, les vecteurs d'initialisation et autres nombres à usage unique ne sont pas utilisés pour plus d'une paire clé de chiffrement/élément de données. La méthode de génération doit être adaptée à l'algorithme utilisé.",3 -V11,Cryptographie,V11.3,Algorithmes de chiffrement,V11.3.5,Vérifiez que toute combinaison d'un algorithme de chiffrement et d'un algorithme MAC fonctionne en mode chiffrement puis MAC.,3 -V11,Cryptographie,V11.4,Hachage et fonctions basées sur le hachage,V11.4.1,"Vérifiez que seules les fonctions de hachage approuvées sont utilisées pour les cas d'utilisation cryptographiques généraux, notamment les signatures numériques, HMAC, KDF et la génération de bits aléatoires. Les fonctions de hachage non autorisées, telles que MD5, ne doivent pas être utilisées à des fins cryptographiques.",1 -V11,Cryptographie,V11.4,Hachage et fonctions basées sur le hachage,V11.4.2,"Vérifiez que les mots de passe sont stockés à l'aide d'une fonction de dérivation de clés approuvée et gourmande en ressources de calcul (également appelée « fonction de hachage de mots de passe »), dont les paramètres sont configurés conformément aux directives en vigueur. Ces paramètres doivent équilibrer sécurité et performances afin de rendre les attaques par force brute suffisamment difficiles pour le niveau de sécurité requis.",2 -V11,Cryptographie,V11.4,Hachage et fonctions basées sur le hachage,V11.4.3,"Vérifiez que les fonctions de hachage utilisées dans les signatures numériques, dans le cadre de l'authentification ou de l'intégrité des données, sont résistantes aux collisions et possèdent des longueurs de bits appropriées. Si la résistance aux collisions est requise, la longueur de sortie doit être d'au moins 256 bits. Si seule la résistance aux attaques de seconde pré-image est requise, la longueur de sortie doit être d'au moins 128 bits.",2 -V11,Cryptographie,V11.4,Hachage et fonctions basées sur le hachage,V11.4.4,Vérifiez que l'application utilise des fonctions de dérivation de clés approuvées avec des paramètres d'extension de clés lors de la dérivation de clés secrètes à partir de mots de passe. Les paramètres utilisés doivent concilier sécurité et performances afin d'empêcher les attaques par force brute de compromettre la clé cryptographique obtenue.,2 -V11,Cryptographie,V11.5,Valeurs aléatoires,V11.5.1,Vérifiez que tous les nombres et chaînes aléatoires destinés à être non devinables doivent être générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et posséder au moins 128 bits d'entropie. Notez que les UUID ne respectent pas cette condition.,2 -V11,Cryptographie,V11.5,Valeurs aléatoires,V11.5.2,"Vérifiez que le mécanisme de génération de nombres aléatoires utilisé est conçu pour fonctionner en toute sécurité, même en cas de forte demande.",3 -V11,Cryptographie,V11.6,Cryptographie à clé publique,V11.6.1,"Vérifier que seuls des algorithmes cryptographiques et des modes opératoires approuvés sont utilisés pour la génération et l'amorçage des clés, ainsi que pour la génération et la vérification des signatures numériques. Les algorithmes de génération de clés ne doivent pas générer de clés non sécurisées et vulnérables aux attaques connues, par exemple les clés RSA vulnérables à la factorisation de Fermat.",2 -V11,Cryptographie,V11.6,Cryptographie à clé publique,V11.6.2,"Vérifiez que des algorithmes cryptographiques approuvés sont utilisés pour l'échange de clés (tels que Diffie-Hellman), en veillant à ce que les mécanismes d'échange de clés utilisent des paramètres sécurisés. Cela permettra d'éviter les attaques contre le processus d'établissement des clés, susceptibles de conduire à des attaques de type « adversaire du milieu » ou à des failles cryptographiques.",3 -V11,Cryptographie,V11.7,Cryptographie des données en cours d'utilisation,V11.7.1,"Vérifiez que le chiffrement complet de la mémoire est utilisé pour protéger les données sensibles pendant leur utilisation, empêchant ainsi l'accès par des utilisateurs ou des processus non autorisés.",3 -V11,Cryptographie,V11.7,Cryptographie des données en cours d'utilisation,V11.7.2,Vérifiez que la minimisation des données garantit que la quantité minimale de données est exposée pendant le traitement et assurez-vous que les données sont chiffrées immédiatement après utilisation ou dès que possible.,3 -V12,Communication sécurisée,V12.1,Conseils généraux de sécurité TLS,V12.1.1,"Vérifiez que seules les dernières versions recommandées du protocole TLS sont activées, telles que TLS 1.2 et TLS 1.3. La dernière version du protocole TLS doit être privilégiée.",1 -V12,Communication sécurisée,V12.1,Conseils généraux de sécurité TLS,V12.1.2,"Vérifiez que seules les suites de chiffrement recommandées sont activées, les suites de chiffrement les plus puissantes étant définies comme préférées. Les applications L3 doivent uniquement prendre en charge les suites de chiffrement assurant la confidentialité persistante (forward secrecy).",2 -V12,Communication sécurisée,V12.1,Conseils généraux de sécurité TLS,V12.1.3,Vérifiez que l’application valide que les certificats clients mTLS sont approuvés avant d’utiliser l’identité du certificat pour l’authentification ou l’autorisation.,2 -V12,Communication sécurisée,V12.1,Conseils généraux de sécurité TLS,V12.1.4,"Vérifiez que la révocation de certification appropriée, telle que l'agrafage du protocole OCSP (Online Certificate Status Protocol), est activée et configurée.",3 -V12,Communication sécurisée,V12.1,Conseils généraux de sécurité TLS,V12.1.5,"Vérifiez que Encrypted Client Hello (ECH) est activé dans les paramètres TLS de l'application pour empêcher l'exposition de métadonnées sensibles, telles que l'indication du nom du serveur (SNI), pendant les processus de négociation TLS.",3 -V12,Communication sécurisée,V12.2,Communication HTTPS avec des services externes,V12.2.1,"Vérifiez que TLS est utilisé pour toute connectivité entre un client et des services externes basés sur HTTP, et ne recourt pas à des communications non sécurisées ou non chiffrées.",1 -V12,Communication sécurisée,V12.2,Communication HTTPS avec des services externes,V12.2.2,Vérifiez que les services externes utilisent des certificats TLS publiquement approuvés.,1 -V12,Communication sécurisée,V12.3,Sécurité des communications entre services généraux,V12.3.1,"Vérifiez qu'un protocole chiffré tel que TLS est utilisé pour toutes les connexions entrantes et sortantes vers et depuis l'application, y compris les systèmes de surveillance, les outils de gestion, l'accès à distance et SSH, les intergiciels, les bases de données, les mainframes, les systèmes partenaires ou les API externes. Le serveur ne doit pas recourir à des protocoles non sécurisés ou non chiffrés.",2 -V12,Communication sécurisée,V12.3,Sécurité des communications entre services généraux,V12.3.2,Vérifiez que les clients TLS valident les certificats reçus avant de communiquer avec un serveur TLS.,2 -V12,Communication sécurisée,V12.3,Sécurité des communications entre services généraux,V12.3.3,Vérifiez que TLS ou un autre mécanisme de chiffrement de transport approprié est utilisé pour toute connectivité entre les services internes basés sur HTTP au sein de l'application et ne se replie pas vers des communications non sécurisées ou non chiffrées.,2 -V12,Communication sécurisée,V12.3,Sécurité des communications entre services généraux,V12.3.4,"Vérifiez que les connexions TLS entre les services internes utilisent des certificats de confiance. Lorsque des certificats générés en interne ou auto-signés sont utilisés, le service consommateur doit être configuré pour n'approuver que des autorités de certification internes spécifiques et des certificats auto-signés spécifiques.",2 -V12,Communication sécurisée,V12.3,Sécurité des communications entre services généraux,V12.3.5,"Vérifiez que les services communiquant en interne au sein d'un système (communications intra-services) utilisent une authentification forte pour garantir la vérification de chaque endpoint. Des méthodes d'authentification forte, telles que l'authentification client TLS, doivent être utilisées pour garantir l'identité, en utilisant une infrastructure à clé publique et des mécanismes résistants aux attaques par rejeu. Pour les architectures de microservices, envisagez d'utiliser un maillage de services pour simplifier la gestion des certificats et renforcer la sécurité.",3 -V13,Configuration,V13.1,Documentation de configuration,V13.1.1,Vérifiez que tous les besoins de communication de l'application sont documentés. Cela doit inclure les services externes dont l'application dépend et les cas où un utilisateur final pourrait fournir un emplacement externe auquel l'application se connectera.,2 -V13,Configuration,V13.1,Documentation de configuration,V13.1.2,"Vérifiez que pour chaque service utilisé par l'application, la documentation définit le nombre maximal de connexions simultanées (par exemple, les limites du pool de connexions) et le comportement de l'application lorsque cette limite est atteinte, y compris les mécanismes de secours ou de récupération, pour éviter les conditions de déni de service.",3 -V13,Configuration,V13.1,Documentation de configuration,V13.1.3,"Vérifiez que la documentation de l'application définit des stratégies de gestion des ressources pour chaque système ou service externe utilisé (par exemple, bases de données, descripteurs de fichiers, threads, connexions HTTP). Cela doit inclure les procédures de libération des ressources, les paramètres de délai d'expiration, la gestion des échecs et l'implémentation de la logique de nouvelle tentative, en spécifiant les limites de nouvelle tentative, les délais et les algorithmes de retour arrière. Pour les opérations de requête-réponse HTTP synchrones, la documentation doit imposer des délais d'expiration courts et soit désactiver les nouvelles tentatives, soit les limiter strictement afin d'éviter les retards en cascade et l'épuisement des ressources.",3 -V13,Configuration,V13.1,Documentation de configuration,V13.1.4,"Vérifiez que la documentation de l'application définit les secrets essentiels à la sécurité de l'application et un calendrier de rotation de ceux-ci, en fonction du modèle de menace et des exigences commerciales de l'organisation.",3 -V13,Configuration,V13.2,Configuration de la communication backend,V13.2.1,"Vérifiez que les communications entre les composants de l'application backend qui ne prennent pas en charge le mécanisme de session utilisateur standard de l'application, notamment les API, les intergiciels et les couches de données, sont authentifiées. L'authentification doit utiliser des comptes de service individuels, des jetons à court terme ou une authentification par certificat, et non des identifiants immuables tels que des mots de passe, des clés API ou des comptes partagés avec accès privilégié.",2 -V13,Configuration,V13.2,Configuration de la communication backend,V13.2.2,"Vérifiez que les communications entre les composants de l'application backend, y compris les services locaux ou du système d'exploitation, les API, les intergiciels et les couches de données, sont effectuées avec des comptes dotés des privilèges les moins nécessaires.",2 -V13,Configuration,V13.2,Configuration de la communication backend,V13.2.3,"Vérifiez que si des informations d’identification doivent être utilisées pour l’authentification du service, les informations d’identification utilisées par le consommateur ne sont pas des informations d’identification par défaut (par exemple, root/root ou admin/admin).",2 -V13,Configuration,V13.2,Configuration de la communication backend,V13.2.4,"Vérifiez qu'une liste d’autorisations est utilisée pour définir les ressources ou systèmes externes avec lesquels l'application est autorisée à communiquer (par exemple, pour les requêtes sortantes, les chargements de données ou l'accès aux fichiers). Cette liste d'autorisation peut être implémentée au niveau de la couche applicative, du serveur web, du pare-feu ou d'une combinaison de différentes couches.",2 -V13,Configuration,V13.2,Configuration de la communication backend,V13.2.5,Vérifiez que le serveur Web ou d’application est configuré avec une liste autorisée de ressources ou de systèmes vers lesquels le serveur peut envoyer des requêtes ou charger des données ou des fichiers.,2 -V13,Configuration,V13.2,Configuration de la communication backend,V13.2.6,"Vérifiez que lorsque l'application se connecte à des services distincts, elle suit la configuration documentée pour chaque connexion, comme le nombre maximal de connexions parallèles, le comportement lorsque le nombre maximal de connexions autorisées est atteint, les délais d'expiration de connexion et les stratégies de nouvelle tentative.",3 -V13,Configuration,V13.3,Gestion des secrets,V13.3.1,"Vérifiez qu'une solution de gestion des secrets, telle qu'un coffre-fort de clés, est utilisée pour créer, stocker, contrôler l'accès et détruire en toute sécurité les secrets backend. Ceux-ci peuvent inclure des mots de passe, du matériel de clé, des intégrations avec des bases de données et des systèmes tiers, des clés et des graines pour des jetons temporels, d'autres secrets internes et des clés API. Les secrets ne doivent pas être inclus dans le code source de l'application ni dans les artefacts de build. Pour une application L3, cela doit impliquer une solution matérielle telle qu'un HSM.",2 -V13,Configuration,V13.3,Gestion des secrets,V13.3.2,Vérifiez que l’accès aux ressources secrètes respecte le principe du moindre privilège.,2 -V13,Configuration,V13.3,Gestion des secrets,V13.3.3,Vérifiez que toutes les opérations cryptographiques sont effectuées à l'aide d'un module de sécurité isolé (tel qu'un coffre-fort ou un module de sécurité matériel) pour gérer et protéger en toute sécurité le matériel clé contre toute exposition en dehors du module de sécurité.,3 -V13,Configuration,V13.3,Gestion des secrets,V13.3.4,Vérifiez que les secrets sont configurés pour expirer et être renouvelés en fonction de la documentation de l'application.,3 -V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.1,"Vérifiez que l'application est déployée soit sans aucune métadonnée de contrôle de source, y compris les dossiers .git ou .svn, soit de manière à ce que ces dossiers soient inaccessibles à la fois en externe et à l'application elle-même.",1 -V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.2,Vérifiez que les modes de débogage sont désactivés pour tous les composants dans les environnements de production afin d’éviter l’exposition des fonctionnalités de débogage et la fuite d’informations.,2 -V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.3,"Vérifiez que les serveurs Web n’exposent pas les listes de répertoires aux clients, sauf si cela est explicitement prévu.",2 -V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.4,"Vérifiez que l’utilisation de la méthode HTTP TRACE n’est pas prise en charge dans les environnements de production, afin d’éviter toute fuite d’informations potentielle.",2 -V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.5,"Vérifiez que la documentation (comme pour les API internes) et les endpoints de surveillance ne sont pas exposés, sauf si cela est explicitement prévu.",2 -V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.6,Vérifiez que l’application n’expose pas d’informations de version détaillées des composants backend.,3 -V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.7,"Vérifiez que la couche web est configuré pour servir uniquement les fichiers avec des extensions de fichier spécifiques afin d’éviter toute fuite involontaire d’informations, de configuration et de code source.",3 -V14,Protection des données,V14.1,Documentation sur la protection des données,V14.1.1,"Vérifiez que toutes les données sensibles créées et traitées par l'application ont été identifiées et classées selon leur niveau de protection. Cela inclut les données uniquement codées et donc facilement déchiffrables, telles que les chaînes Base64 ou la charge utile en texte clair d'un JWT. Les niveaux de protection doivent tenir compte des réglementations et normes de protection des données et de confidentialité auxquelles l'application est tenue de se conformer.",2 -V14,Protection des données,V14.1,Documentation sur la protection des données,V14.1.2,"Vérifier que tous les niveaux de protection des données sensibles sont assortis d'un ensemble documenté d'exigences de protection. Cela doit inclure (sans s'y limiter) les exigences relatives au chiffrement général, à la vérification de l'intégrité, à la conservation, à la journalisation des données, aux contrôles d'accès aux données sensibles dans les journaux, au chiffrement au niveau de la base de données, aux technologies de confidentialité et de renforcement de la confidentialité à utiliser, ainsi qu'aux autres exigences de confidentialité.",2 -V14,Protection des données,V14.2,Protection générale des données,V14.2.1,"Vérifiez que les données sensibles sont uniquement envoyées au serveur dans les champs de corps ou d’en-tête du message HTTP, et que l’URL et la chaîne de requête ne contiennent pas d’informations sensibles, telles qu’une clé API ou un jeton de session.",1 -V14,Protection des données,V14.2,Protection générale des données,V14.2.2,"Vérifiez que l’application empêche la mise en cache des données sensibles dans les composants du serveur, tels que les équilibreurs de charge et les caches d’application, ou garantit que les données sont purgées en toute sécurité après utilisation.",2 -V14,Protection des données,V14.2,Protection générale des données,V14.2.3,"Vérifiez que les données sensibles définies ne sont pas envoyées à des parties non fiables (par exemple, des trackers d'utilisateurs) pour empêcher la collecte indésirable de données en dehors du contrôle de l'application.",2 -V14,Protection des données,V14.2,Protection générale des données,V14.2.4,"Vérifiez que les contrôles autour des données sensibles liés au chiffrement, à la vérification de l'intégrité, à la conservation, à la manière dont les données doivent être enregistrées, aux contrôles d'accès autour des données sensibles dans les journaux, à la confidentialité et aux technologies d'amélioration de la confidentialité, sont mis en œuvre comme défini dans la documentation pour le niveau de protection des données spécifiques.",2 -V14,Protection des données,V14.2,Protection générale des données,V14.2.5,Vérifiez que les mécanismes de mise en cache sont configurés pour ne mettre en cache que les réponses dont le type de contenu est conforme à la ressource et qui ne contiennent pas de contenu sensible et dynamique. Le serveur web doit renvoyer une réponse 404 ou 302 lors de l'accès à un fichier inexistant plutôt qu'un fichier valide différent. Cela devrait empêcher les attaques par empoisonnement de cache web.,3 -V14,Protection des données,V14.2,Protection générale des données,V14.2.6,"Vérifiez que l'application ne renvoie que les données sensibles minimales requises pour son fonctionnement. Par exemple, ne renvoyez que certains chiffres d'un numéro de carte de crédit, et non le numéro complet. Si les données complètes sont requises, elles doivent être masquées dans l'interface utilisateur, sauf si l'utilisateur les consulte spécifiquement.",3 -V14,Protection des données,V14.2,Protection générale des données,V14.2.7,"Vérifiez que les informations sensibles sont soumises à une classification de conservation des données, en veillant à ce que les données obsolètes ou inutiles soient supprimées automatiquement, selon un calendrier défini ou selon les besoins de la situation.",3 -V14,Protection des données,V14.2,Protection générale des données,V14.2.8,"Vérifiez que les informations sensibles sont supprimées des métadonnées des fichiers soumis par l'utilisateur, sauf si le stockage est autorisé par l'utilisateur.",3 -V14,Protection des données,V14.3,Protection des données côté client,V14.3.1,"Vérifiez que les données authentifiées sont effacées du stockage client, comme le DOM du navigateur, après la fin du client ou de la session. Le champ d'en-tête de réponse HTTP « Clear-Site-Data » peut être utile, mais le côté client devrait également pouvoir effectuer la correction si la connexion au serveur n'est pas disponible à la fin de la session.",1 -V14,Protection des données,V14.3,Protection des données côté client,V14.3.2,Vérifiez que l'application définit suffisamment de champs d'en-tête de réponse HTTP anti-caching (c'est-à-dire Cache-Control : no-store) afin que les données sensibles ne soient pas mises en cache dans les navigateurs.,2 -V14,Protection des données,V14.3,Protection des données côté client,V14.3.3,"Vérifiez que les données stockées dans le stockage du navigateur (telles que localStorage, sessionStorage, IndexedDB ou les cookies) ne contiennent pas de données sensibles, à l'exception des jetons de session.",2 -V15,Développement et architecture sécurisés,V15.1,Documentation sur le développement et l'architecture sécurisés,V15.1.1,"Vérifiez que la documentation de l'application définit les délais de correction basés sur les risques pour les versions de composants tiers présentant des vulnérabilités et pour la mise à jour des bibliothèques en général, afin de minimiser les risques liés à ces composants.",1 -V15,Développement et architecture sécurisés,V15.1,Documentation sur le développement et l'architecture sécurisés,V15.1.2,"Vérifiez qu'un catalogue d'inventaire, tel qu'une nomenclature logicielle (SBOM), est conservé pour toutes les bibliothèques tierces utilisées, y compris en vérifiant que les composants proviennent de référentiels prédéfinis, fiables et continuellement maintenus.",2 -V15,Développement et architecture sécurisés,V15.1,Documentation sur le développement et l'architecture sécurisés,V15.1.3,"Vérifiez que la documentation de l'application identifie les fonctionnalités consommatrices en temps ou gourmandes en ressources. Elle doit notamment indiquer comment prévenir une perte de disponibilité due à une utilisation excessive de ces fonctionnalités et éviter que la génération d'une réponse ne prenne plus de temps que le délai d'expiration du consommateur. Les mesures de protection potentielles peuvent inclure le traitement asynchrone, l'utilisation de files d'attente et la limitation des processus parallèles par utilisateur et par application.",2 -V15,Développement et architecture sécurisés,V15.1,Documentation sur le développement et l'architecture sécurisés,V15.1.4,Vérifiez que la documentation de l’application met en évidence les bibliothèques tierces qui sont considérées comme des « composants à risque ».,3 -V15,Développement et architecture sécurisés,V15.1,Documentation sur le développement et l'architecture sécurisés,V15.1.5,Vérifiez que la documentation de l’application met en évidence les parties de l’application où des « fonctionnalités dangereuses » sont utilisées.,3 -V15,Développement et architecture sécurisés,V15.2,Architecture de sécurité et dépendances,V15.2.1,Vérifiez que l’application contient uniquement des composants qui n’ont pas dépassé les délais de mise à jour et de correction documentés.,1 -V15,Développement et architecture sécurisés,V15.2,Architecture de sécurité et dépendances,V15.2.2,"Vérifiez que l'application a mis en œuvre des défenses contre la perte de disponibilité due à des fonctionnalités qui prennent du temps ou qui nécessitent des ressources, sur la base des décisions et stratégies de sécurité documentées à cet effet.",2 -V15,Développement et architecture sécurisés,V15.2,Architecture de sécurité et dépendances,V15.2.3,"Vérifiez que l'environnement de production inclut uniquement les fonctionnalités nécessaires au fonctionnement de l'application et n'expose pas de fonctionnalités superflues telles que du code de test, des exemples d'extraits et des fonctionnalités de développement.",2 -V15,Développement et architecture sécurisés,V15.2,Architecture de sécurité et dépendances,V15.2.4,"Vérifiez que les composants tiers et toutes leurs dépendances transitives sont inclus à partir du référentiel attendu, qu'il soit détenu en interne ou qu'il s'agisse d'une source externe, et qu'il n'y a aucun risque d'attaque par confusion de dépendances.",3 -V15,Développement et architecture sécurisés,V15.2,Architecture de sécurité et dépendances,V15.2.5,"Vérifiez que l'application implémente des protections supplémentaires autour des parties documentées comme contenant des « fonctionnalités dangereuses » ou utilisant des bibliothèques tierces considérées comme des « composants à risque ». Cela peut inclure des techniques telles que le sandboxing, l'encapsulation, la conteneurisation ou l'isolation au niveau du réseau pour retarder et dissuader les attaquants qui compromettent une partie de l'application de se propager ailleurs.",3 -V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.1,"Vérifiez que l'application ne renvoie que le sous-ensemble requis de champs d'un objet de données. Par exemple, elle ne doit pas renvoyer un objet de données entier, car certains champs individuels ne doivent pas être accessibles aux utilisateurs.",1 -V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.2,"Vérifiez que lorsque le backend de l'application effectue des appels vers des URL externes, il est configuré pour ne pas suivre les redirections, sauf s'il s'agit d'une fonctionnalité prévue.",2 -V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.3,"Vérifiez que l'application dispose de contre-mesures pour se protéger contre les attaques d'affectation de masse en limitant les champs autorisés par contrôleur et action, par exemple, il n'est pas possible d'insérer ou de mettre à jour une valeur de champ lorsqu'elle n'était pas destinée à faire partie de cette action.",2 -V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.4,"Vérifiez que tous les composants proxy et middleware transfèrent correctement l'adresse IP d'origine de l'utilisateur à l'aide de champs de données fiables qui ne peuvent pas être manipulés par l'utilisateur final, et que l'application et le serveur Web utilisent cette valeur correcte pour la journalisation et les décisions de sécurité telles que la limitation du débit, en tenant compte du fait que même l'adresse IP d'origine peut ne pas être fiable en raison d'adresses IP dynamiques, de VPN ou de pare-feu d'entreprise.",2 -V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.5,"Vérifiez que l'application garantit explicitement que les variables sont du type correct et effectue des opérations d'égalité et de comparaison strictes. Cela permet d'éviter les vulnérabilités liées à la confusion de types, causées par des hypothèses du code de l'application sur le type d'une variable.",2 -V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.6,"Vérifiez que le code JavaScript est écrit de manière à éviter la pollution du prototype, par exemple en utilisant Set() ou Map() au lieu de littéraux d'objet.",2 -V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.7,"Vérifiez que l'application dispose de défenses contre les attaques de pollution des paramètres HTTP, en particulier si le Framework d'application ne fait aucune distinction quant à la source des paramètres de requête (chaîne de requête, paramètres de corps, cookies ou champs d'en-tête).",2 -V15,Développement et architecture sécurisés,V15.4,Concurrence sécurisée,V15.4.1,"Vérifiez que les objets partagés dans le code multithread (tels que les caches, les fichiers ou les objets en mémoire accessibles par plusieurs threads) sont accessibles en toute sécurité à l'aide de types thread-safe et de mécanismes de synchronisation tels que des verrous ou des sémaphores pour éviter les conditions de concurrence et la corruption des données.",3 -V15,Développement et architecture sécurisés,V15.4,Concurrence sécurisée,V15.4.2,"Vérifiez que les vérifications de l'état d'une ressource, comme son existence ou ses autorisations, et des actions qui en dépendent, sont effectuées en une seule opération atomique afin d'éviter les situations de concurrence entre le moment de la vérification et le moment de l'utilisation (TOCTOU). Par exemple, vérifier l'existence d'un fichier avant de l'ouvrir ou l'accès d'un utilisateur avant de l'accorder.",3 -V15,Développement et architecture sécurisés,V15.4,Concurrence sécurisée,V15.4.3,"Vérifiez que les verrous sont utilisés de manière cohérente pour éviter que les threads ne se bloquent, que ce soit en s'attendant les uns les autres ou en réessayant sans fin, et que la logique de verrouillage reste dans le code responsable de la gestion de la ressource pour garantir que les verrous ne peuvent pas être modifiés par inadvertance ou de manière malveillante par des classes ou du code externes.",3 -V15,Développement et architecture sécurisés,V15.4,Concurrence sécurisée,V15.4.4,"Vérifiez que les politiques d'allocation des ressources empêchent la saturation de threads en garantissant un accès équitable aux ressources, par exemple en exploitant les pools de threads, permettant aux threads de priorité inférieure de continuer dans un délai raisonnable.",3 -V16,Journalisation de sécurité et gestion des erreurs,V16.1,Documentation sur la journalisation de sécurité,V16.1.1,"Vérifiez qu'il existe un inventaire documentant la journalisation effectuée à chaque couche de la pile technologique de l'application, les événements enregistrés, les formats de journal, l'endroit où cette journalisation est stockée, la manière dont elle est utilisée, la manière dont l'accès à celle-ci est contrôlé et la durée de conservation des journaux.",2 -V16,Journalisation de sécurité et gestion des erreurs,V16.2,Journalisation générale,V16.2.1,"Vérifiez que chaque entrée de journal inclut les métadonnées nécessaires (telles que quand, où, qui, quoi) qui permettraient une enquête détaillée sur la chronologie lorsqu'un événement se produit.",2 -V16,Journalisation de sécurité et gestion des erreurs,V16.2,Journalisation générale,V16.2.2,Vérifiez que les sources de temps de tous les composants de journalisation sont synchronisées et que les horodatages des métadonnées des événements de sécurité utilisent le temps UTC ou incluent un décalage horaire explicite. L'UTC est recommandé pour garantir la cohérence entre les systèmes distribués et éviter toute confusion lors du passage à l'heure d'été.,2 -V16,Journalisation de sécurité et gestion des erreurs,V16.2,Journalisation générale,V16.2.3,Vérifiez que l’application stocke ou diffuse uniquement les journaux vers les fichiers et services documentés dans l’inventaire des journaux.,2 -V16,Journalisation de sécurité et gestion des erreurs,V16.2,Journalisation générale,V16.2.4,"Vérifiez que les journaux peuvent être lus et corrélés par le processeur de journaux utilisé, de préférence en utilisant un format de journalisation commun.",2 -V16,Journalisation de sécurité et gestion des erreurs,V16.2,Journalisation générale,V16.2.5,"Vérifiez que l'application applique la journalisation en fonction du niveau de protection des données lors de la journalisation de données sensibles. Par exemple, certaines données, comme les identifiants ou les informations de paiement, peuvent être interdites. D'autres données, comme les jetons de session, ne peuvent être enregistrées que par hachage ou masquage, en totalité ou en partie.",2 -V16,Journalisation de sécurité et gestion des erreurs,V16.3,Événements de sécurité,V16.3.1,"Vérifiez que toutes les opérations d'authentification sont enregistrées, y compris les tentatives réussies et infructueuses. Des métadonnées supplémentaires, telles que le type d'authentification ou les facteurs utilisés, doivent également être collectées.",2 -V16,Journalisation de sécurité et gestion des erreurs,V16.3,Événements de sécurité,V16.3.2,"Vérifier que les tentatives d'autorisation infructueuses sont logguées. Pour le niveau 3, cela doit inclure la journalisation de toutes les décisions d'autorisation, y compris lors de l'accès à des données sensibles (sans journalisation des données sensibles elles-mêmes).",2 -V16,Journalisation de sécurité et gestion des erreurs,V16.3,Événements de sécurité,V16.3.3,"Vérifiez que l'application enregistre les événements de sécurité définis dans la documentation et enregistre également les tentatives de contournement des contrôles de sécurité, tels que la validation des entrées, la logique métier et l'anti-automatisation.",2 -V16,Journalisation de sécurité et gestion des erreurs,V16.3,Événements de sécurité,V16.3.4,Vérifiez que l’application enregistre les erreurs inattendues et les échecs de contrôle de sécurité tels que les échecs TLS du backend.,2 -V16,Journalisation de sécurité et gestion des erreurs,V16.4,Protection des journaux,V16.4.1,Vérifiez que tous les composants de journalisation codent correctement les données pour empêcher l’injection de journaux.,2 -V16,Journalisation de sécurité et gestion des erreurs,V16.4,Protection des journaux,V16.4.2,Vérifiez que les journaux sont protégés contre tout accès non autorisé et ne peuvent pas être modifiés.,2 -V16,Journalisation de sécurité et gestion des erreurs,V16.4,Protection des journaux,V16.4.3,"Vérifiez que les journaux sont transmis de manière sécurisée à un système logique distinct pour analyse, détection, alerte et remontée des informations. L'objectif est de garantir qu'en cas de violation de l'application, les journaux ne seront pas compromis.",2 -V16,Journalisation de sécurité et gestion des erreurs,V16.5,Gestion des erreurs,V16.5.1,"Vérifiez qu'un message générique est renvoyé au consommateur lorsqu'une erreur inattendue ou sensible à la sécurité se produit, garantissant ainsi l'absence d'exposition de données système internes sensibles telles que les traces de pile, les requêtes, les clés secrètes et les jetons.",2 -V16,Journalisation de sécurité et gestion des erreurs,V16.5,Gestion des erreurs,V16.5.2,"Vérifiez que l'application continue de fonctionner en toute sécurité lorsque l'accès aux ressources externes échoue, par exemple, en utilisant des modèles tels que des disjoncteurs ou une dégradation progressive.",2 -V16,Journalisation de sécurité et gestion des erreurs,V16.5,Gestion des erreurs,V16.5.3,"Vérifiez que l'application échoue proprement et sécurisée, y compris lorsqu'une exception se produit, en évitant les accès en cas d'erreur telles que le traitement d'une transaction malgré les erreurs résultant de la logique de validation.",2 -V16,Journalisation de sécurité et gestion des erreurs,V16.5,Gestion des erreurs,V16.5.4,"Vérifiez qu'un gestionnaire d'erreurs de « dernier recours » est défini pour intercepter toutes les exceptions non gérées. Cela permet d'éviter la perte des informations d'erreur qui doivent être loguées dans les fichiers journaux et de garantir qu'une erreur ne paralyse pas l'ensemble du processus applicatif, entraînant une perte de disponibilité.",3 -V17,WebRTC,V17.1,Serveur TURN,V17.1.1,"Vérifiez que le service TURN (Traversal Using Relays around NAT) autorise uniquement l'accès aux adresses IP non réservées à des fins spécifiques (par exemple, réseaux internes, diffusion, bouclage). Notez que cela s'applique aux adresses IPv4 et IPv6.",2 -V17,WebRTC,V17.1,Serveur TURN,V17.1.2,Vérifiez que le service Traversal Using Relays around NAT (TURN) n'est pas susceptible d'épuiser ses ressources lorsque des utilisateurs légitimes tentent d'ouvrir un grand nombre de ports sur le serveur TURN.,3 -V17,WebRTC,V17.2,Média,V17.2.1,Vérifiez que la clé du certificat Datagram Transport Layer Security (DTLS) est gérée et protégée conformément à la politique documentée de gestion des clés cryptographiques.,2 -V17,WebRTC,V17.2,Média,V17.2.2,Vérifiez que le serveur multimédia est configuré pour utiliser et prendre en charge les suites de chiffrement DTLS (Datagram Transport Layer Security) approuvées et un profil de protection sécurisé pour l'extension DTLS pour l'établissement de clés pour le protocole de transport en temps réel sécurisé (DTLS-SRTP).,2 -V17,WebRTC,V17.2,Média,V17.2.3,Vérifiez que l'authentification SRTP (Secure Real-time Transport Protocol) est vérifiée sur le serveur multimédia pour empêcher les attaques par injection RTP (Real-time Transport Protocol) d'entraîner une condition de déni de service ou l'insertion de médias audio ou vidéo dans les flux multimédias.,2 -V17,WebRTC,V17.2,Média,V17.2.4,Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant lorsqu'il rencontre des paquets SRTP (Secure Real-time Transport Protocol) mal formés.,2 -V17,WebRTC,V17.2,Média,V17.2.5,Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.,3 -V17,WebRTC,V17.2,Média,V17.2.6,Vérifiez que le serveur multimédia n'est pas sensible à la vulnérabilité de condition de concurrence « ClientHello » dans Datagram Transport Layer Security (DTLS) en vérifiant si le serveur multimédia est publiquement connu comme étant vulnérable ou en effectuant le test de condition de concurrence.,3 -V17,WebRTC,V17.2,Média,V17.2.7,Vérifiez que tous les mécanismes d'enregistrement audio ou vidéo associés au serveur multimédia sont en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.,3 -V17,WebRTC,V17.2,Média,V17.2.8,"Vérifiez que le certificat Datagram Transport Layer Security (DTLS) est vérifié par rapport à l'attribut d'empreinte cryptographique du protocole de description de session (SDP), en mettant fin au flux multimédia si la vérification échoue, pour garantir l'authenticité du flux multimédia.",3 -V17,WebRTC,V17.3,Signalisation,V17.3.1,Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation entrants légitimes lors d'une attaque par saturation. Cela peut être réalisé en implémentant une limitation de débit au niveau de la signalisation.,2 -V17,WebRTC,V17.3,Signalisation,V17.3.2,"Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation légitimes en cas de message mal formé susceptible de provoquer un déni de service. Cela peut inclure la validation des entrées, la gestion sécurisée des dépassements d'entiers, la prévention des dépassements de tampon et l'utilisation d'autres techniques robustes de gestion des erreurs.",2 - diff --git a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.docx b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.docx deleted file mode 100644 index 785c963570ad84b5dd7bed15234018c183f5c7ef..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 225553 zcmV)DK*7IIO9KQH00IaI06!!QsN0)1%%O+P@9#)+u4AWgQv@7QikNki;3F?liA znz{GrN-`RZH#&<};DfSe826HH9Dxy5Dl;F(pVODleLNlwrdtOgqEZuv@dD93Fc!oD zG!Kb&U}z+@UUQ^ZKWC1MFFps>?{@E)um-_k2Xl>hG>_EbDTs zVa%P&l;B9itQchn8$D#LMyq?4?^$a}KUY?_puBQmCg%KJj zfwcdieD==fC}iqAQ*xN{Sq7J%cqM(5g8C=ky1>ZoYzD|rk_6cy5C+YH*+>4k2+f2DA7f@(x_W$HnM)p>ObQS6kP96*c4 zVjJsGN!L>>fJ^Y_|8@Q_l)_B`Zm$i{zaBuoTCF5d3O5C4A%W8XTG)h50W?U(nSYi2 zUgFGr4?^ku3Rrxv7b%MCRakKm9eo2(O9KQH00IaI06+Noe~dmdUru;%oQpS5O9KQH00IaI06L^H{K8I|PP4>-+ zlOwleTMI2)QES->5FjX4O?H=DtfK2esn?TVH}+#*PJq1uVZX#$0rHfWjrFF+{v+#` zoN=4Csv^}bHz_LVV8v?Qs%Fj0xPIdsfAe>5W@)fcMVaK;m-mLdgL{F>qC8Hr^DpoH z{>9h*qkDh%w}12ci#U(!naZjFzMqv}y#DguMODqec<`W%F4Qb6ck{W*;InC7%)$y@ z7UvIM=S4g(@<^2>TyB;=*c%KE9?ZfdyC;{KUFS0Sbecr!kqkgzq`J@-DL(chg-XK; zp1ZtA=B2(`{^h;8$i9$E^=C;`W{bDgo_4i&62iLeZPMZEj zc%3JUi}3Z5>76IhM_d7ZRn>)gyw~%OxQ4&}6cZKRi58ZO_7@ z`hN1tdG$@0rmDC!GAW$EBj(fKB+n|4G$lQv`S$O#Ifn~Q)H$jTc!;E^F2B526}6H_O|r5oUZ^+A z2Jrn!@Q-=$S3lQz_1DAxi2n%w@gn%gKLr0+;}FahRt%t2^RUocXz9097VEh&Pxru| z;Rj}+CwczUEG&LHt6){&N=f|Xz0m+4G7D#Lv1tLnNy<5?^arcgMiypxgO&N(UcPfp zx`wys4Dae~A2jJaFZ*%bFI-)B-O=vdV6<1i1bnw3u7hH!X8o`n_&O=d3eG`zUWD_D z8;syo1)fF^VikB=65mL}!0HHiqYPZR8{B_rUj=81zIPdbu(TI}>CWP?h<5^2RzaP? zHIuSZLHy@m{zbh>&cO_#p((>D%gmYXE6@Q(alS$sbzZl-| z=NtrVnq-Rp1SyM~A$kK&-EeR`K7@&jK%kEYd!x|-&o+E(I)zR9n7=#u@*b>UO8+hB zzZLzLzlvIoHcAAa(PWk|91pGGqg61xXoIk-x2m{z(zrj2C z+rNRo(8J+BvIX1|rv+a`-!1G|cON9P@LZJ-WYD{FRID`KQP+6&1^99y-r_Wmeky}3 z2L+U!tA|CAzrKL&Si;=ivu~Gkm`i#KSINK3gVq=)X)^yhNmIN9{v8xwsM$opu!<+~ z-cY6v6sD@83;c5mUw#gEpsPEdJn*lEuS(b;!Q}PRJcefr>ngv87kD!*X812Sn!y`d z*-O2?A?}xzo8^K1{TzEcu6y>L;I5Gac!Ps4yX=Ms z{VVW_(K7ld>Gu8|$dtegEUbvuEA%`*z0ydQ%68P@T?e*pQ$w z%e*dw-{d7;fW241BK`#DBay=~zGtpd$k=>Up?_m+#AhE|u}B3cg@RdIz#pJgQ3*b* zsv?=xY%YN9sUD`uPbwI(a+Qi7PvgI zTBtt+Nfx6EQv^{OCWWGv4C^=W{~%{dF<^?B(x!@@G}{_bum#z z*BSKZ?}0gz9kS(Mm25e*vgN$U>$xK7BI0Wu;^iB@3kn#y%YRu3Gdw=(lrSIt{#Hn& z7x^R!!B)7)z^>k^Q}sMd=NG|4um!;a*shUXhFS2in1L;lZ<#3nCY%%`i*guR_(4hZ z$+q27bq-!<@VhX=IO|qTA(+ZpmITj=8vN5_tA++X9h>suG)zI1Z`I%)$0`f{AuQmZ z6|;676?nKx1s+)y$i{s?$}@HfFpk)tg|G16btuD!>`Zv~3*>(PW!2*6VR)at%2g4Q z>HU+Mfw#L=N9RcyhEZ^;UawMgpIl_aNeoWHB2$-JHF;;Sdy72yCak01D0hxl$(>_2 z0pJQ8RrL#%V)A57V&}w@H>wKk?QR&3`RH`OcNl327Z_DavM7ZYPR0q7FI|!`4&m$R zpMUum(5LE+3LbADdUOW2OHvTZ8RoX?jM7GNQpsRKXUy_Ri8+p5uuyf9rs@xY$_jOk zVJ21J@2e#G38uWPi{P82`nH~MUh3+P@C8^1c;c*?Vv!$*XNEpUNhNci2nNY0athJkKHp5xQ^jMcPV49jJnZu~(u#ypMO*O;G*bOKkYL8n4QZv2! zl{RtXQg|VKQ@9YuKLr|D+N)-i88v@jR zG+LEh9gVGQ#c@u<^*|Y($+b5nHNQ$!woqBEjPzO9v}y~W@Nqx^*#A4L*TRBNpNCd=M1ehV4Az(?pxd`jBN~SAu7o;&@B}sP9Id=g+wjc{mJRvHA z;0<&!Z=Fd*2KbN(Uj9clfgyt6%9gNk_Z-ppO+vVJfVe}g2F(_ z#aaqJy!sWDZ@8dc0Dr;lW-x>Jc4JA>{2aus0ui{0`NOHg$HcWwNmZlF4QWxcd^Ram zUApEItvT5!es-rvZ_X6{f)Gv|1a_jcvQucY$%clfr93L=1K2?%hl+EV!VsLCa5%dtXuneC4wkFhpq(da0#^;D2rs}-&^|(` z0Jnidi1&72cfH`uL9_kf>17zc2l3kl*Byk7k^a^Kg|V{{ied>K67MHxjvS*XG9wJh zL_-K1t9}@0h$dP~nWS)}|Dz)89?D@nl%-(c5;P6Th8De1spx{Ry=72>Z5hEc;0qpb zg&-@IGj{B3Wxv6BpiwJ%1wYGBc%k40qZfw=Hzzmf!xD58+p9pu1BV05SQKwDqZp&4 z6k+PwQ3CeRd(H@Gv5AtZF)OhJh=gW+mR_Dt-7f58SX3iVafLxhU;S%1fsKe?gQ9W&fdp}-yT;yla*FTs$@Fb?OeBWr|ImgI5y z!$mPda$};(JYj1CX0yF(wqc#WOBM>B6zmMGwr~Z})P{-Db_sel_d<_G2CA-e(T=`T^@gh%aZNh=?fJ+CniI)xIoNPHfO!A{(NGhIX6KP<@2V2cp zyNF#A%kh^h7<;N`AhWoj-Y>zk1Y>|UA`F;-fX;pQf_yqH*mhcoU@%51Iq+!a(u(?P zUkZ%4C+4SIZ-kO-4uX<)l|2X6w1Ufk=?juNEJ1w1yW1fK7(Wk6L+SVeA2gK};Ik** zVMk9|&fg*_U>QdH1Ls+B1}I=bcI5C7&*(hCI2Vgg^U|01as*ND(xx%d05H4c)RR3I zqQ4JsV1xwp{d^w6`JW`LxfoXs_a#jMx6pq4`?q9rSMT3ydy;odbAzU6iJ!A?b8TyF zZKOVPx?1qPScS6y61aTfsjOD8m}n90?8z9A3RU2akEi zW&$Xauw*fzW1{{AMLptBVWuh$D;F%R)N~4dM(O+Ha-6sffWCHKCo$h*Cc6Ls{Bym~ z0YyKS(!=rKnbg*xr`vI?oAv`mNwEEjj(wp=5=;}Sh5|X*HP)03eu~&wut}T2<%VUS* z6>{moiD;pItNM}Z!yh1+%Eh(QF*k`K{(a477jDF7RgU%hw|}>>FxRcr7-8tphP7G- zZ!3V+yaEP%bVTa4n(PLTVPBBxRV7u;#t3d1_;I8-0G(i{KNkGnJBK3ElAq4Zx}>Vptr_+gmV+Tyhju^AY-HVVi&K(Cx;jY=zE!pf4@tJD^t z3vZ6?R_cLHsKOb`^PIec*}NGQ?D<&~iVs@rm23=daeREAGIv{<#KU3^Xk48j@{S?uag=WPf)*g?`d>!m(glk| zwS=K7H>64vDJ;MNIeGHno7gz5lsyKI&4rtH8J#qbEQ{ha6;(??eDxdUR1gA#Q z8P#>A!RSUA33K^PNq}Y&NCofz?fqNlIp4p1|0nG*kiA54ByF$pp&?jA(`4^y`~YmM zl*9gLrCt3;JNW1CtOO%i=LH#n+Ofa^lj1?oqOr8@_Gws_;6b9x7-o_zL6lDrQYLDdvSZEZj}F-bCr%}po9Ao=SfI13 zKf;W{&}Bw9f~Fwf1H2kM`Xt0EbW&)oW_gTH1oH#p7w$lEl`?k)Sju(snfxSWui; z*@0lRQw+(0Tr^e_CL86}6a#*4ln;Calys^9uPa-z6=6TSK}jdz4rBGlXCs;v6$!;Q zLzAwUAqWRO40H&+Y4`U!=&RCEJVr!Y35*qcA~rdART>};{to@{p7_3LGD~zImz=Cg zLc``yDRz`ZCeDi(AGi&fyf7J81lL7blgasEQVpv>5Sk@ zyAlb`IShOQGyX`ipy~x>(wZZ*5Y3aP8UW=BTcv#`Q6Rk6IE!6bZ9*9u3QG25iQx=| zkrS12ls={i3Jg=BZP>AJ6rh34&3ECLgcc-91j$8SkmB&HUomu=%Lm&&gmaHkyH1gV zdqw$o)mx;o#5_Zd-Lm`vVTLj%pr&OOK?P9SEO~U7d8C?Vy7xPL*PD<2}71dMQOYXwFohP&S4iahZvuYx#HN)qg=VeF7=EBGqWWQ45K%S zPzV?iK=uv%$T~fu&Ww~`taqJ?^@qOyEM%xoj^P3l;WM-wIWL{ju;0J^JBl!HN{><< zykQoUKjSqfH`SOu8a4>y3QjImSoO~?6g*z={!g63wj$}ePbKVI5e>r1J$#0U((Jc3 z;`eV6!UXTNI9(;pIKfLS)wx&(TI+i}RfVQXm|F*|MnP!Ql#F#5QV+H3|6t`l^UEz7B$? zLwT&Kgc>=OPi}IhB}X4$qv)a+%+oNF zY@}Nl(*`a`h6>LwvzY~qg(u=~ z!5EC29i|%!2|S`a35NGc^K%H^JsUm7^?4Bw_-)8VfmmY;&s9;ej&sV%D$&^9c36&# zT@a>x3d!UxDOH70_+CJ`F|?r*U21~|QA6Q)NR$S#z-TvenYPkdFxwSF9LN*4db9` zQQ5$cc|1SY5naG+6bw!W^MiL}#hwJ|FtoI>syT!9= zs6mgv9%_NjJE+JJlB_y{|8ea(OzpIn>~NTzOHp6WCV`zwmX#yCP=iDX??l)NlzH?5 zEgGc+2gC9LWBdI9!U)eKD`-zRb5hR(@gP^<<0%F;O+2Kr~d$+JG^C;1A z7%w!?Lc@Ukz53tH#d8lvLv%1BvW8}w?599$$iXluG)68d$&;Ped|fE~j-gN<3@}WZH~v8DV*v#5oi>u%V2krlA2A9 z2nrxYTV~uqA?J{x8JW)<0y2h7a7z1QZh=o^D;ePgKU@PF->qN*vpUq(X)Cp%_)TnZ zWs!C2<#8}}>n`hN@R^jhK`LhxAn*h5UXVa#EafClsw&s;@eec+MK6-L#%1DU1C{G& ztJXJ!aG#aA!}q`l6{;Dlxat_I-;^7&Dw%}^YcXKom>tmQs6oJ3^ZU#iwXu?*n8x6) zf4aY>3bLX-OxmQ{k@To2O2=gv^+Lx3v}4MhKRn;LG)+pR08*D7`i=qvj3h|lit6_I z^DN84n_vJB%pk~QsBY*W)|eUOfpL$eELquf@oey&E9>)l;cqC!(J?e)nkQX2VdSWw zOHdI62kb;DI^qt~zmgcCm?VSVRACEAVWZ$+LPprpk8ZpNf`ML5jiCCX>2$D^fn z0(vYfQpJL2X^pg>oAfPOc33SXKkT83oar9yQ3A;>*$|i;;TzdvCa`fHBEL}<|K7@a|E*XRv&P##zVVJ<{roOjWQ}dOk^r)W=9! z7bk$PO~Em45-&L)tzzdGJIIZfqv_%FaBv)}!~KK(z2UJM98JREP(>pZO{aTD(`h)E z#>dwUZQi8r<2xG+x?zRW#-RoV9PU+_e|Y3QEkLCBI;_u0J+u9Yot7|J!SpPGfWdC+)1i9QC(F^c(q`R zQ7MrYQ!)tm;v!yUXQiy?LNC^Y&z8+trKgj19jaSmNRmch*gw^pR>&fwPlvtWbPum{ zI?|S;)BU5e)}`jha6uxQ2Q7!94*-Y#?&g)5vd$5Ia%O_<{ym)MHbv#$EGdNXhhlUwWC?aFdg7rbfP9z}? z0@)BeiY*iifdpId;y_rGddFyPP;TcCC2_=&)}Rl!?#qSOkyN_+Z{}9+PT5>K-kCP? zm{`2JxNmoWPPrqOO}J=PDgPEsDm#L-5S>9ciEuF$+lojg!&#Zb2fsT@N++pq$%jI? zdy4Q5P3RCZMAb?>O}8Rp99;kp(j1Y_T>dVObSvVTI`WCgB*-Z=5de&M=}4a~qa~nx zNa2i0sJX8+pA@HWHe*#TnFxujvoQXdyfyHE$=7n9SD?NwbqNL-IuO04o~WGw>*0J> zY+0LxPibR@v4sqSOIntOM}=}8R94AuPEWfRh_lnlOAfGtHq{PvPxN?9o{v|>ld|gDEpm+u(c1otN^gXy;((PGj`}~`1bwbI+W;l!V9%2 zt$AW*)8NAVodohGnNeCAZA2Y0^Xuw#nMFq(hN?V*2l#%%RWjfc`yCARQ`4Z za2U`rS`1<{+z>S5`&tuX`TJ+}JarrXxGG#$CbYmWQGYX8S0i| zR}x_?Cy&4q*&3%H(4v70ZW|t3gQU*a1h8TkOy;1gqv{l1g&I@5fOF5qn*x5=3<}}Y zK9g6D=UA}@Lr%~uHsp0@X;aNdi8(NLfkz=TY!*BN^Q#OfLD+y>b$*=ys z!l-mo5RP{Tya0pf*2x@WK{jha*uZco{~D?BYpbCqv5}{S#w|6pw?;Lzw=w4}#C=Z+ zp+(rkQ>(=2C08d>g-%>a03&kkdDrE7EQ(}*r6LiJ(efkqG!)x0(>hYz1l0B_H?-n9 zTz$X$X_Il$`<|tTtb)BASAgnLBCf}mFK%2#IR)RXN?b>$u(&juMT4#_qEANx1&%10 zN%aBEqzyl#`q=JRsrum7R-3t*?NvIyTnXL)d#6!42kUG?hko$mNmk!>LbG8ql$5r$RU}c;f*HE$5XUI!J zE_2tlL*Gv8W41`?h9ij6Nuoqd+a@sJ+FN;5CHwfmqt#0#(AYN;dL8@v?=iKflOXy= z8>Q7-!k^}pVA!Sum=Uc^?rBM;qRj=d6diBAwE!dX*%Fp-8wBuwoN@W*R71Tywbtu^ zHcJQn?WZpl%I{!*F3tTsrUD}1@47IAPC>xvn@T?#6Y zB_h+2TKhmMj7!7f)=cwIi4yq*2%#Y4ir6s|?s-KwWL}0C{N*qunrv!Pl2E}iH}jAw zj?#oM_jX?;*;EIY;FaNn=7Ayj*@r#KU11%GfB)LTr^y=Ne6*@^eShS(VI#;@UuV+S zM?R>lUk%X2*nQoysZ*jlHTQx+9qDR5C~ip`(n)$}gh_9zJ^lQXsm3pZ2S~FMqbe3bnB<;& ztI>CEj3GEng6|*J)dfE3k81M##fcXQ&_%R8ig4IRH<4cpBNEPn^DHNRyX%UTRfWsr zWA6lpn5IeS2+r%tI@t=(%+1KGus7SJVdLDkWK=;}bL9Z0)}%!OhE1L_xA^W;Zr-$e zk{3itKjm6z4k%|e7_>!RYG{JQnVB3<-vxGOUP$?l>0;-M!=o`bFciKr?vCu--N@b# zd2Gyou0hX2Mc(oCNFHIqzaV@L{p6N=78spkezm;g={0SV_G}>~!*kPTKtG@~1?&;5 zUQlS2YYfnQ;?cWgk(`wNLi#WlYTHQNYrGu0L@T(+7-8{FY%jP!cLfl2{0jPibzc27 za-Q!Fmb9tc*2(4_hLioslazjziumv~^>kT-MV!pIHzs*%ApT{7C1!b^<`c}^BE$wM zS!7kz$4t2P20cCv2B0KVec~?&ErMB);pes>_6&b$O`K(DOo5c?NlGTJDRHb<&jN^c zD70J>5I-?%*^CvskvmL4IAe9o5qQ}g&9>rq_8C{M-C%ckjkUW)-Qm*D(y`_mq}VrMz_F^Bzj_Wi?W zjwW;qskD0r8j$S~-8hH}F=-Hz7!wEL16!|A83LD>Bhtm}=d>xfu2R@v)#iHNX`As<9Sx6mW}SO15d&``pq2PEt$sQ?qBTw#hT_$CWkx^Cvv%_ zyZ!l>|L+FhehlVYjL}`9=c}sx5?JKhGpc4+ytE*qnl|h42mE0>wC30yo=b_8XvLX&6A?%_0 z0v!)Dq2BqN+Gwu&x;XcyfcfY8>W`>Gzdxf!e8{6!=-_{yQQVD06GfNbRNRb>n>m># zT8MFRN4(iEymf*J(7Hfxco7zfvb4B*SGZ(dI8BY6A)&aryp0&yp40b`!|Xa5izp3_ z(Q~2%C${W)EEa@oAg7$t%3;>pc%SY>E>Nn;yr59)YY(qd#ZrGAw~G`ke2mM!70Ong zc`FQ&mPI_l@FtU~$(C)ml-iD2BmvvMsa#*9O?UOKBstVdx`n|$i9(mg@XlVovzOO0 zQ_3+y-oK?ovK!oInqE*O4km%9jAqQ~x6L}i(XapXkyh~T&P}bYo2Qqat65mUnMWMN z>2Kbqw>6<_+GZL`!C4)H4s+Co=I{~ogOKfpYgejN3C~lPQN58~7iS5JHrHIEB%4mK zNmB+QuoZjQ#P+vkJsSt)Mg|Zi@q9}2)7HZ6)Y33zr=aHPGTRy2(}ws z{i0b!qzKeAi;;CCPiv|drk<@Ff#;T_?`BK{ih;REV_IR4{aojXZfhKC$`C>LP{YpNd*whN39G_&VJ|xzdQT>JA7bv8hTQyq`8r% zLgeMHvZgI@>FSXyES$+4Upw8piotH*p-n=h#7zqXZUnrc>u(-pua;4YR7pW}BKb72 zWk_*8H>Bp=91kg>5er+En(Mu0v&^Tkg9XE{VmT$}@mt6f3o)TG83vcE!j{x+z8-T_ zr-&LM&X9ncEc`^yss+YSA7|Uh2)=Y4Vo7O2fO{WA(qKqput-n;fFB%5TDSo^l^5tf zA<-R*q=6zSZ;B#0mGvX7thomZO+9GJp3IJ9)!+z=CYNB*rV`x4{W)rGF9(&>D3rLa zaB1?#I3KO5>ECzC45F~?$Bvx4alOxts+2m~fPBizAE%#&>7K@w@49V9LtVEE@~Lc} zIcB5?h>8xeTsAR=pNS7kS&_&Vs$W3(cWlqG>k@*~I{MRbv1iGSU!THWNPBAT=23R?D2!%A=qmSS)pcfpP+=z>8oGmC+b zaf=r{FRD!q=wr=X3rhMra%VF<9JuG*8Fngx-ImuZVohnO%Q|l(x9&sC@)+USrPElD zTRG*(Qo+>dDOT9Aau!4_L#$Rj9L2xMY~Y3tuxS|h>C~&60kQG?>&)^#Gy%X;d(`X= z-J#DMD=-W%$PBkg-y^`zZZWe|<4|i;^<4&_UQ~$}PEjBwvXk!syTb-<8j@WmY zBVHb;>G4rCJUos^@xgF~375xJ(FM8Of#4#INj$S9TnlEtp zR*Y;$v)YIyVZVn>-0nV$mQbl0Pu@i=XngN?X*kK5dBdZxPo&JGerS7t7td&9omhT)4g!IH<>Cm z9PJ&94hBbq>39&T;WSjCQfhB7I*5nE!8+ssby>DToH?~%e^h3(I83L~6s@ju6tfuK z+PFlpUEW=8C1jcLDaX(>)I>p^Nl*l1f=Q~8b)zh;J;(`b(o zqeysiJj8rY&#yf)Tyu4)veKJnG&$QPj6}TF>a|1#1g5!&X4eUX!b%$-mRWRCCu!X5 z9%N?8DQMuyYA}#eIi|K{!oW0W;a}_4aQeQrG-t#jw8V4?RJvulXs1%EA;$gi#DD+_ z$u46P)=&g8OyO7Zph|3ELCsJoY{-FdYy7a5;noqvs1{6$x{|M3u*K=4htF{F&d{M3 ztI7~_y*xW}yRHZ|pXMlW27^q8uXAkQLNzx!o=NNLa3MMtA3S}UV~@F7?*r$1%|Q|d z8k7f8MAa$(nqn8yuPLsb!Sq_sfDaa3TO2ouNIY@uHo-U?45R&UxF7Ey>>uxsM*D~R z@n|nTIy%@t9LIYgl!t0KI9!J~ekME6RAF{B=K9q3m{aH@1`0-ib>lauIh|8WCPzpc zJB_ zJ)(Xt@Ks@TM)ry@;f+e?N}~0hMjw?rvYA4xlw4})JkzN=sO5I37DKufQJZ!KT^e!K zQp-VK3U`oe2!XwnAdQgUyH?wB!@>KvwuyL#Ye<|!^f1(Q0R|lgWfzl7fIZ@rU*M&j zui~njLOe7>W8K5S>GfOIuar?BUQ?vfH{w4gfVYxJ$f4tTc{~dD#>2^UZ>;u@#{=-T zjwS~xJlKzqrr~sYbU2Ro2FGh*=JX;kA-W7MxeL}gl&-2Pt%u<3m``JHq4J{QB4Zjew2RIlMSOr&?n%i+d0SRBf^iBm?dV~!m0xdYmv6u$radg}jcX~M``{#ok zpdGusNqOUZw5mk?z$sBT6#5*T?yIb?`yQ?%Q2o#__PYX2-*J=4GuRA7YeXPQ(p+Gr zXhSAh*cxUb^2d}3=WKkR5uC zn>5$G?%_LF-d*irRc`v=xVxo~s`|)eYuwW7p1$En_Vq!&dG~(TPGB7DxwXvkc(kt$ zrw4JkKNw8I@$l$)6om)l(L_bZ69p=Dcrcl)LzFzrt*Ss_^8Jqw&z>3c#(OqeZAMPn z?k&`nXVcj+8YFj}F-=Ik%r5Nt2`DVg%cgZy5V2>bYVvlZ-7Zy6z?m?OOap3vto2RL z32z9otZl6Mg7ewbIRR6u&Vj{tq#>nUJ7)@e0{C<4W`1*`r8NVR5pX0=WraG2vu+Ug zavdhgls5D-F{t)Y%2;koZ+1-Y)cL$l*p@X}LUgP#bYgjm=S9stJZ?K;`$Y3Jj4-}! z`a9zBj}!<0O$%zC41X>Pg>#+oW$~Ks#4wn7{X&_Y6u)<FrFR ziL`VqEPn&|4RUCu%_Hmn5v|9zTfjS!*OsTNdbS)KwYfh{a0o1yzN0()>!t#AqEbFN z$tOv*Ym&tUSQ>0C%=8lBx4F&ww7Vm>v_@~n+We=o)~@*M=M*8t2XQiGgs6U3ag5c zK~NbTWtd}d#w9-Cq+Z|uo0Q5)&*tF$pGf~?iV%R>0j1#SI}ja_Puv6RUDyd|3%X_; zFrdaMIzETL)(G%ebrv%Fy2AfRXCb%?Tqy>dX+CYC7?e^EO#@$#Qbu<*g^d^&sxduo zR-jEPmno+svxFfirtQO|u=5xaV@o_%ddoZcBqU-b*e~KMsvU0jLpW2btY%ypk>N}U zxFA(BSJ2}2D?9Q zj;=lJb{*2idc4X_yd4-B+*!kI6J%Y{Rx|YuOdA62e2b5Em6q*A<4|@@zl$evS>HRT z?QML-G;C2#&Oed{rDD}UgOTQjx+g8+L^X&zarqd&qcpOuaUyESX|bC*1jXe8}&{p9XM9F3{%z9 z@~G9t!9VubR#U6cPzO%h&B9l*ZLec-ZrqROxsI?hZ}8 z(`yT2Ujf;astXH|G#|F^=;(#lGoA3X9B|?s=XGHYE5>Q1FhG&LVHl9LYy(*pF}-gq zzk+shlrV8X3mb{@&p;(sJ>Tgb4&-!Xd`3YDaIJ@>gM_)R5qwqVJkvztfPO?;VeJt% z14S^2?SSlIWh{!Bi4Dm7(jE$9ONHEkM1K)3;M+Yxz07eLOKCnI!Ql7<_M?q+ffa_C zaG;78d`gA|CbgX8B@-sN04eqZ_~cnYI|tM1=~Uu4u!Q-9xlx;O7Va6@Xmaj45_oM2 zYbopKJAj-GwaVzIL@=`;YT1`pY5OEdrjZiG9Qv!v2yIVfg+v3bfF~B;54Wgnsu+xB zKL!B?johUfgWzr#Q${e!syJvi>DTSHle|H|!bSE*gJ>{1K0Z8}9v=;lhT;CPiud;> z(Y`t!438(H!{{(P9vxg)uZ?eH9|eR`qMgeO9(vz4p^={g$d?zTZl~lAt_9q5M%Mt6 zcYQs+gsC^#HVhBwWK$FH|LEb_3qnT0zaXS3s4aZ#EZ|(Hz!8_pT%}3Yfh^`SSgolI z<&hR{CN|>_SR5W}PreGtB85{?5*)(`%al51-4gR0ayd^C^MaMn6_^umctDwn0Ow8+ z*D5a}J}JeagTra<{z-v-QcZL@WYm^Cmtzlx9B4^vBmC)rSAqmw^5h#3Nd{3(VHZJD zm%t?wlpj>l2Z$0y=HIYiPbm@1Mtv2P#SIC;-D$yS=k%z*v;N&mmT z48-E(rT}bgmNe@y87Kj+?Ub)7O*n8$6H?WubB!Gx`m~_bMT_F1RdFNV{G)9cqwT%h zZpvUWJN0zfBIFzI4gx}RQD_ru?q|04)iYGy|C?u32JinA+$W{p>VrY=vTp~*3A^-k zUu2UF8TO4QE)I*B79Pv3QCjHm9pTG#ybcuw2V+s`u(~inOM|oV^1*?^%x)MdX5o{p zFiJNI+^3(4`hp#)>v%R4{S(3BG>_-rbx!M=7U19Mrc~PY)68+;^c{hTFZ()(HzipM zmV!)3J5Cfd>r2^P6BX?=F46O@-h>9oys}=iqw*E2>eGkbl^&n(?PK zxPNguDKMt6BRFtO8Ss{2ONZkmKE7L3U4fU52v4t(#<)h}R>0;Z8r9kkrHOFctF;2S z8XsS_G}yHT{_-xY2Tky_^U-p|>A@<*>5*IXK8^N|j?^$dI-ZWzbP%b*aBnm?IGP?F z?jP?(!|8B5fw$KIfP3ooeL|B+CscTWtsH-IZ8!hWLDS+Qv#7|k{_wg_a1#*96Xy<_ zL?E~gnL(p~J(`4q-sWyo-sH7tM}^6|&{S9&P=z5q-5s8b5yDl?Bpb`LzdP_#m+;G^ zDU>8Z6mpS|+qW)Eg^%NVS3KNrH@93b>e#NsVc1M_isi|aR z$i51PGo^i?U#vLXCsagPPnd{|*?2hEsacjHlyKbSP%F(8gK1JLOuejkgNJoc!OW(; zU^qB-D<4Nk!C&rJ@LyUt-R2l^y%|>kw+V}px^92qU^g6WzSl)@@5ud<)7TFcYMj@T zRDhkMq4UKl$ylZippDs8zRBe{@~-_Y@>6m$WjAco)jEl-*t%tYB|DNf49EG! z3l0-q8RW?qn3RU;<6nuBlO0Xu8d8X1HfifKWUM5wyLnj`(kf97guk_!2dN0wb<^}3 zYaUGo`$zD8dww73Zcl=A%|5<4td=qru(s&`^?0MOn9bIJ`JtR|V>_>2T~Ygv_)}h$c*w6E+&J z@}cYZ0+$%(>R&Z|f>%1LbKFQcM@c5iQc(!Sj~0;cR$~Z8XFYT=TTk~L6pdF30J}2H zz63x@t=54ZttG^NPIB?Ec zEIE$Wp^(m_sGgg+fiojMh#3J7w24zmi&8jTqIx;`LG`t(pbuA-R2({RdISEWV6Gip zUt4oHr0e^$H<6H!%&l8H#ol`3q1{vj++5ciet3*JsVE)22{~0}gl09I3X`FfdXF4Kdv2;mM-n^Y*Xa4-Gb||29Ce`M=`TS% zB8mth8HNNvgA;Y~htgJbXlImK&Vv8*&-Fr*j!p!#A)*Bk8QNM;m+wS)Ru~k7Q;dm` zLR`1?pZ3*Z_9{gmXi= zt+3snSHRq{8YzQM*kHYz=1ISuam1n(OTlzH15uA@!K|l{(*v!6~9!?HM2S|%I zJ~&e2LA*a2A4P+3r1l2;`{U6#9PM435bq|Ajvp&D+0Rs_L{9e`!$G<+DP=LD=GGmC zxP&653z8*Q_pkx-5ZCDxb)$A^Cbf5K?b5z~SXUP~@83UpbQ1jemwygUm|Tw@N{8Zg zaKhASFoU6#ej~+X9_5y#lEh2O)F*=3lVpH03D*k`=$5iG*kmQ)7!#o)nrJXNtnG>KdYMi(K)$#!cOjLTyT_H9yD{q$($=vnMM z(jl2H-h7rNy_`zsSEuYaqykDeZN#oyKEj(@7Oc0wqs|;hs1BwD85nR&HSvV4APC#S zwgJO+$!4*^eYi-@x%N$zF;eYF^^!w_Sq4(hw`gs>_l(eSt>*mMnphjS4&%a!Ak#+hb%uZhz3iJ7 zKwySO%VF2yjEbzv+Y*oqz(V4tve7oz%||tR?^nyTvCYV+?~`jv6tBNdjp8u zg9)9cx^;rkRg)D;FglVq9r1(W>eusBmG&wgq6MS+QrKu0OV-ymsWS&wpw1gAISI2U zQO+?%t@Y5^_(T@@=U@Ii{Lgcj-oG81YGjij*$vKY>vr&|vHVPf3EByp3!xA9$Pb*f zyw`I@dR6$TXN6j@NG7!;9UZ??A4Dp9@HdMrFAAjE)^n-qHnNYa5TS<-iPg*D-gr7x z$J22C;CQe<3is4eI0A1yjKOG!u1~+8)c2UT3Xzygs+!7Gr@G^JgK+4NT^9+XENur+TKuKE8kQ z{P9kYD-Vld~5-k_CNh zj40TmY>Keq!3v@Tv+HOaU%v+I&}DTWsqiq`593%JMF&Tty~F*(gX3YO#)IMh{^8&_ z9*zzNd*kaKl$(UvPe52xNf5TGL-)ogWryn?_7u&C?)}0T4BUc@fY>xe;|+%v+=mT! zG#K;`Mmxd%i>jKJUp#m)$Etu`(BswadA@kSpZ7-(c8L9o>uspd6jlvXppsiX>kN3? z4Oe#shXi^n!Dy+l=uE7dGDIunO|~2X?YWNVhRB`d;9G4G2A5lLY@90`~%i2X0>o7S1^`QApez;Zc};tw`Zncpp);xzEd`J>pw3 z4-cuq$cFQr7@e)5F$_VzhyWi{S8tcZee9ZaB>@`J+;oBWbEdRM1Pe#X*RoY=x|its zs&^GJ`Ju~RJPD(C6o-@1=wR<)98cgs$HRC!Jr4JVhm$A@2Zu_H*FsEw=1fST1F&s! z`e{hi7p3GRsNv9k5WhEVmiwEC(!6`U{^H^i)+9}`pMrv>w0II99^Nw->TIL>t^SR^ z_39p~SO2X!5ntPhI9WLnW^^BVvYT)gFa|-+Q1}MJG>I}uTyL3t?@m)kasv%he;RXa z8Y7@yAucLbj9o|6tO)^DJwyDh&vXYe(6^?sZVkqX*W!4)2s^Kd!VJzH6?}nwVXC8! zZ04JQYkA#}o@Kh>{uW@RqkktQ7W%4qa~5x%DAsEq<>i3+!+v^JLGwa1bu9FcdrqV)!i6~l!8#}1{$oJ#g>Bj;wH&W zC(X5Hp2CTb^VeA~c=qV)UhwGqlb1cetMbdIr@O(kT;iCT%Z!avFcHyMfyWTUft0~g z2qbfpb;Mpm<>Y1S@=kdv#%ctW;Z9K5$PP)c?`AD8kDLk_p4omZL9IT`BSk9KVWfO# ziA&{%fxY1-U712v)chl-+KreUN>io+g^f!Jnf>2)p~WB}qGTao!*FfBk>k+5}=>@5>{kw`N> zwIHUID#)=GBH~JBQ6SQ8+Ic2h_aj`^mEQ6`bOnBo>WIS{YQ`y=D6dH(iMTF_&xe$~ zZad|$dQxGd^#NECI{;U&2Lm>YZ$UMCO|aC6yD#C~4EK(L?p2eF29?v`2YZJ{J?<(o zK6wB3FPjrdVwtcFhl6WgaWvkSEA9>Oir2JGj#gC|962!kG)b8;QTRf+M4ctiI?nAW zA#DvwBYV2`mYX`czt6Dxg>q0xR_wGL&XYGC2sYc)y2BC`5GQvum?M5TrsJa7A&{D1 zLqC?4j_M#9-i(^0Q?rb2EB5d}Ts?aeWcc+UO*9909*JU?`n6`z!ipr6~g5H8>nIT$;8?c+we{`q} zTNp_SLo<;XBqMJMTjDQ}*5$ln4kZ)8*x4#-wEDCn%&^LEi$AYFqhEXlI^Y#4%t$lp za2ZP~t+n7JgA_|BBWhw}4yd|rk@MiR3Ad`jTyCO-F64&KSMP{Azt@ch77xoo8OsT< zS%7=n@>*=TUW1WXod;I%u!!>cHrE9ympHVg!!b@dRb*VZDdDshgSN*q|&J{3z4 ze?RQVJ`SxCwZbD^OBD`QYwG(_XhGkXtZBOMCc{w;ZanS1I&}STa$H^myN*3F6H8{R z)|=S2vzpau zmCzv+b?U`+S8iGoAc9nDVW?4+UT4p)_e8f_ZM51M<7m5Fey7I&?@U@S6v!cZLXgS>bXcgRhIB-H;i(y}b z2Cy8|APUyO1@XfWHhp9uGUi^_cWWJ>y0(^3keNfVj-cH4PF22FVy@*&bTW3wEIt@(E+_sohx*$9%!0gB?1Z5;;bY{;TfVO9TZM-@a$z2WSRIFl$Af5kbhxMDI2uROct1Qo z*c-*_NX2R&cAL63%;P57;fLYwFmN$%68f}iE><7VbZZKL8uXh*(dc|$rMY{S6x7J! zBMIx$ruqVwBk-g_sOcmZ7B}>f+3CK1DFv}f!fKIdMxsu=#yZD|DoURfp=bo9s9U0d zW>Zv}Wc3=@*>uGP|G+J~c-yYAu!$rtt0=2H`pIQ%7p6y!80TopXJX6fpAb=v`5DbR z`ac}$p?x8qyGTxaCWW~fN(PvD z8B$e<+x)=!QpEp#R(wdxxUllqU%ZO+`$U6P+~Ab|MaMEfup{}c<4M)@W)=E|P++~| zy74@5PHOp}9@qt6_XuUPOioHsZP&uKfR5Q6Zq;J{Ak>I|Fg>euwvTYINJy&XT$X39 ztTUyOED^zM${BIO<#|Z#fl*a1{xQ84?G-IIh;A(*BAY)Kk;_4Nz6BXAVrD7k>ohzM zM1>g=I#Y}(t+n0k@qzN+ObfOHa^{``=@E0^oe)n^V_@+j9Jv-f2;z99v!+dwB5Zv@q%%+5mCY= z*())?*W`BW1<&j)h5ka{a+9%jx4pvhjoP!a5iM^pU*9A%!+c$5wtL<@uavMk@+GuW z+-r1Z&?pK&NWfl**RJs!uZLvsCdbRokP%%}u^@~z)!1q{J7Phc>}aTeY}!@1>4#)C z!(zs;a!SJd<3y=r@bl60`8^@9i9TeZaS^8D5v3Ez8_E$hk6o;sNE~s)5Y4DWFDxSk ztdwqB_@M=KsJA!4@)Sxgjv*p%G~Id`Op-~Ot&KHp6~&+^G~IX~v8?3v=+??@amUTA z46~R&3?h|=XJwL8a}@_5Y*;Bu8ic@YD=OLb-lOa5CKLAUle06O?*M&9Rc17Veua4x zd0Zh)3x+u02sk`42R z{sKcLL=>y)ltE)H|EX*kJ1KawttS|>Ifw6g-C$@{9&grAZNk8!QWv6ZBkG!Ku*e7!p2PNgY zTnJFmYzFci+TyF1@u=VJ{Ey%H2cPrK@4`^V-f=j6^za$C|M&nl+;0qlmW^pF-8f-< zNmBwbOUl(q?@zfqKkwA!-tOUNv^y!(W9$cak1nwiUOo$v64dLb8(NX+QsY~3OYW&> z?ND-KHc!%RGz>oX4S2N88;~(>n02AriPP|fdZ{xk*)%z?3n4Z!rEwNr*bbi%O2ckN z>NZA#Pm>T3boI}_{BwB$iny=JD4Z)pSYhhdA3lrwM=e{<)X!HeE}S*v9-PVFBkQ zpD@u1HhV8hwc`g(Oz$NNZN-XXw=TnNdVx|sbjEzQk8e4{H291*@^Wjz2{xRZ{lLAw z%{wt8_G+p>Ic-wqBK`;&tT4G=c%?vbE4FC5vY7K?(D2|D;BCSDk}%`*uTO&U@Mz#g zDd2cXg{}@a!f@Rx>-KlUT3Bf4$-tB$q@z;~Z#Zg@5Ntx>{`-c?>*eWL5C8KLfBF5R zuXlPYq`-Y!%86?0OJ*3sKmQ;5XW#z$|JpyjU9@_QiM{te47E;a2}l*X4%yTsh3)nl@-?yX4c}dK$GZ>G7zfLj$Ljob)E2&LiBdOG=Ow00_ z-Q!XK6XhvZ8o7ab_pAD2++5#3fAsiy@YO%C@s%l4WQgO^%pDp{EOLSnKxH!=>y+EN zKjDoP*|f01OqqE>df=vGf;-XLYA|8fE@NsoclTg~M;?rDbn^n-8=?kB!FL-kMhZz1 zXl8E^&YIX;0(^~)t0k^Yo!W)~Iz4JYfecf1t0&#q8y6&cTiq?)4{LKpW>^-8AL#`F zfhFge<(n-rCz^3BrGuxlqaj>is<^oqrcAp*fU*T0(4%dC*``4z{2CKFRbi4ELJLin z?sf;-L{X&MDA7f~gKQ`EykU7*q;WEv+vC1!+Wt zgY@!!%a@R|Ik093P^Gn-cd);?ElFVd=?3`RmqEzH0d+*W4b{BqN_q$LyYc%EUf;p| zew$f-2lHE_6E@mvn4d$HYHHL8yyqg2Ko2jNkcfSzIAKz-AOGR($&df=jSxy{)^0Kf zS&n-RP`yxsi_5k^L1pX9L*1X#rya2Rfkru@Mj}KjPW{bnEN|QF{m(loHri&4T}MQW zT2_1Zor2rk-_cvm_}1QTE1RVfWLDy~HAo`IYdJ$wh4bLC38@9AU}n^~H}9X#AD?nZ zGaB1O*s$^M6qy03Fr%ky-^r5j91nI)6o)U^eK9AhRih;XzT5P-zUj9bD(B)wnK&vD za@1?pMQL;o`c)|Ana;KZ|&u20wuRnis)07*9x|5`^s!-|Pfz z!O|DFhk~g(b>%AhoK#rN+>?5{%U+~AC9SPH!S=+;v?H;_1U3#Ublfl?%`Ao7DM_}& zY{z)goK4@*SB>)UjGtMv8=;Gg2acYv)V*tv*{7mrGzA^#yHjz?r{Z&hztJ{M*p3D( zCZtwB?%9cvKp;C8T$!+SX=s|ZUKr)i`)tJ-B6)8#&{WlydxswUWJae(uOM198BdUYM3P{^n*5qO1QPcpBaXvtegv&oS`@o*;>K z9USZ|rojzea8FR(zNQfTYrd&=Cs;-YqhD3{w})}%KM zi}wiH7*i>SswHR$Gmvz*tGYWyAAgEICxl(8Rv)Am2wzh*;!c&qD-E;jq;z!ojXjgx zqxZa?qpQh&oD_|5bhU>)^N|1EplYkRy4+%yc~U!Q}OT)}s+U9Xx%>)k>5*RUJ6IW@Ul+&RkI4el8-#?(Z_xs?KfA9X<r1D3N_Ev92mH*44~N1&tTR(|G9=e={?@+ zo8P2Y@SlJAA2;~+B#eH7LlON1X6ub^@;}!!d;~yeLdu8b<4snPrAB&FU2t%us<5eb z)0la#9_2*n^SsW&*Wo3+ajxEM+X=o27`Ou}+U#BIK}C-p#{1FXVKj)xYBW-Nqw&FD zavUB^C!8y|(o2S?+HCa}D15a~F03TGoHARm|+iIg-u0Wwu_z8wu!`6{k_ zAFK=N&(kqYtA_cTi0~bfd+w9VN`)KsxXq7Xz}tju`uz18J2*4*K$2sJjhq(3@H|$YXV6Q7!EXCrPu;#P5^qU~76PYLU=e@uIoreLovCC&pY#1S< zN$Peyx16d{-{HVWY$#WVq!SLlQ4c_gzF}vOLYixp3H>OaYaY&$qs;gtOu@v;*+X37 zKu~mJwD$~|2S`NC-_&*Fc!U1QXfx@&xQw^+4vD(r{Rgk_kf^`S_PRr&uF=vSZ#5Ei znSP7ipu|kg^5U{zhEpmRKs_*LiWH;d6nBmci=?`s_CW&K*TNHvEI>v^Cf17e5nLUJ z^mtz26+WWwX+~q9$nQC-gC%Pf-bE&Ed8cl>OK98D;RaYZ-M(t79N}F;&Dw24C%54R zDO*$TU$*114Qs_{^SiBf%Uf-$L7t%}*f2*P zHM#DiZU;llu(W;QcAx&0p^M`cp^M{zSLM3jM{pY+k5JD~-*K(i6tvh69yRakI`kWh zNRWf5dy%{K%C>7hqSDzM-KmCP-$K(nU+vKcc*RU)9T90 z8o;TE=je;~1zH2IF_wq#p-#16g-cIP-L+KPFKml1Sapg0Zm~EnT*tP$x{EK|`2D;1 z!d-k}i%seM&nmv4p;&5bELBhg<(Al|*r$UjC@epQGE*i39u$0$aIJykVYF&0od~nb z`4VaX32Qr-dK#<2u=}}b9L*&S)=ypnkE8A)F9~*<29NP-m%;s)FCX6#t>5xF-|Fa0 z*kO1rvut!PXO0=3W8cD7!p>%)y+SRYrF3;60h%bKTen4xIN%4fq|$`~t?wB3n#@Bu zeJS#xIE|fGfJ9p}z&uRWbX#Je5_?P}O|b0<*tl%=;?9&|?y@XP+9Y&L%1+4mmYvAY zJBYQv-9aqeZON45PSu^RZG6|B7}MF&tCNxjSxhXY{oN&vA?{3>)_1Yf%H70t+jw{L z(iJe~)>S*Ev2w<}UPG`dFS&z>2~9=$1xq!~JDN@o=Da$=lDN@P&#w&h8V{9DJS#9o z<}0}U;b)8$k@u;;kbwbF5KdIO`ylk7Pb7&sO`;1T&@_@dkiHdItfH%6Y=vf%Kv8~A z*?<@@JX!S91aEtdYI-{%lC(U zmH+2%LFM<<_MfA^*(@#G7JZ9=(9WzA* z!H?0jCV%?m>Eqx9dih`^(dS|ROd%J01>*gOkP0sEpPc=$ z6MUUCy|)if;06pj+hw5CeTA(v)14NtUB3iOLM9dZ17YH8sQH*PsgX4tlM@i zh!ZY&QHBY~n1{i4>UHqA2yxcXwdR>jNS|Ym?q?Kxfw>G`AOXGTFan$4-3M_JzeWeIx=nl zj3W@m*>d*ufD}R*V){eT6BB(Hu_1HkS`3+2x}lzQWeQV?C&)X zCz<20R=BxkI0lmh{wxJ_!tHygdf9>WCbPNx+LhcMNg;ljp5_kpd*k;XyuJhd-hqDC zzLFmYJpvKD-JstNDcqD!B5#G%qf>%n&m^_}c(+r6JN5*2svwj)tZJOy?Q`cZ`A z!d>jT;g0ZMVsJ}sf}92RyDei7xyf$dkt#S(^GRrl-&u)t1EV06?8d7fp>oY*m68$%U% z!8zO{#DWIy2&*)^fC{n%Ulu6b@pt$sH-Y6lHQM$vqOvE^DQ;P9yZG9Mfx-Y@dR^H4 zCc@4m=-$EHX@M}5ROkU$6+|{>K(U0$s6vIFE;hQ}9JiX&h!__fJ7MdcL(SGr7i{X_ zh~}ik-OrKG40m0Ta6vNmZ(&*qH-jtWJJ|194AGi`5|q$qi_-F z37od)U5lWw{ff|^-@bV9Og;rsk#K*F(&9;}^8j(}^`sqBseH3QBBu|ZJu#(Y8(4zh zXZ8qp1#`%bw|;_2d1wY0Q$kJ}2xH;6UBSX37G=a}Ce(xcZ7>`Rc7xw%N}qZEoG-bN zz7&<=dzZsA!xig6iJA5u`U<$2!lk z>RZqG9j_zngYsB&cFb$o0&wn0E=vn>X(}IeMTqUQ@&ZZwh!Q)Rko@4HJWxS@tYnW6 z5oI1ThotUI9uguS-k(b>8ICM=5yG*R)G!Z6v>WLD?8Lt-o8u2l=Re@Gng(gFv>o6k z=eof;=y3eUjelTXGqH4+C7V2ka5YNM2n2O>+o{dlU*s3If3nxpxNXza98&sW4*o@lFx6f!qYX0p-@^t6PH(xuIiw`v+sy>0gB#Um*$?W!zg zkDj=;;WxGY3G7a%SF}w~xCP{Go;3%YmJ*AvB;BQ?{N-bpLKbdwm%_O5`*$gfyA;M2 z$E^0YG=)*LY49oNw2-!DrBDH&t6a_*BXYgS0J`5*?#$grDSA#;t9~yyCm@BrB&9l&|})R5aH*YXxZEDL`x$uC+0sQ2b-A$#9Q}mPti$z|QI-6r5Ql`bi;tY$KIYnyubo$4}i5 z%7iLXB0)ug?10`6F@}>wx8_*t|9zgsWp!i%LQ6ADo32^ z675-{BrNe;C6)mcVmegeeEanM=WSn(w%fn@5Tc&VMHk%8hzbm=^E(3L{16__VQkcK zXN}jKhDn+(9ROz&HNB!CW7@ub`gudvM%(QN=>o1$Qf1A?F^-Ghxr-3dOU^f9QM4+KOe0e{iqv zK$o|^gU4IGgB!%N3+#M|FaX45eP{!F8@|)mQeIaaieH6XRL3G7cjWy>QDm7=O&lGM zi>r56{|lp0(hvs`^O*|8_DB{SGuUxkDA))VLBI+or;Zi;hO)2(F3pm8orb<2c0K3o z?ks%#S=it5v#_)-bxHzy(Wpx`&_}~VImeW>E$~DNMk+^j?BKF(b5K4ZU@byS%r;qr z`#y{!Dn-RpB5+U2l2D;Cf|l53CTIuSO;U5{R2R?k3?+U-Xd~VErR1+Uqb>~}K}etC zGer^hIYR14LMk~mu2C8yAS}@>ZUop$wcoZepObhIu1X5r;7r0ftfwJnmtdZ^?Xdke zR>`4|kSq)79eE+WaUZ2(-xQ0}1g|NIHx3@Q@AYW{cZA7DKy#zIzGE_$C>KJ`g$Am` zNa~AvM*Va-s;qvlx$BY*P{(S97~4j5zD77MbT*gH=Uv0yyCB>rQBQY4xHZ}$+ud;Y z8sd-y6qvGHhaoVC9KAs7zGh)@pxm(xRfD$~L#H7p!k^)U`!Gu(P;fMA5aV4VhEcpm z^=6u+mGw<+>vRsdpn2Z<5QH?^Kl)o__{>ozn>vP{>%77q^f96;4ohTix;k<+gw?ygEot)z?t__?9<4OIC9&tpgtN zQ>i$3aZxBF2&r;f;)mAMS|2~Jvxgn)GWNl1av6m zVUroo{cL5$|7hsMqI_^!-Jcd%#+=3d*J^TI-F+h_S07YX2l|G1UOM$=x544C7If3N z?ybY}_{21>Buqne`tl-C9&FyC<_#cj!Tk`qWc)CA9hh-7hnk5 zy(|XW9E7}NV9=G*Ekw7YkJT)UE1lOsI>+Hk+~?52eZEwaLv=KU z8%^WU{?YzmGMcD^@L+tXj@8lO==k_(dNhg$>)7Q#jCO~?BM(a<OI!v8~a60usd} ziw(T}12R!p_*pE56_KUWQn^Jdr+W=cAs+HHUxdZEkL^I>i?bf{Uz|~Y^56xA&4_ov zIKTJ5J$rGs(+f^WmpC6h%i(^P*kI+^4kq)2JEMVLah`^51g0~1%9xAZ*$p0>nm#8w zV@Q2d)o94rp37927=)ySZy9w>tWH0oEkxYYSweL!epA>GNkbCffkkzc*TE#sxrEH* z;Qy2LT_p2nh4JHL$X_0fC!^zWG#nisA1H8j!s&Q?Jc&nYx_>yHsQt;o;qfF=YchWJ zxS0upBqc^*CZ-Zn?aC~{ zo66K!_5#BxNnJPaJvd+pdyFUf8~OcVlUcHqN63Z2mNOei1Uy5r!h!u36 z*45R2Fes7jIR9(R0eSTLeUQl(g#h7Dvy4mGOg0NgOG(Y`7M>RPF^|vjW99+*RjQkI$n~Lf@{-{uV`ZN zRfer(&$q5w!*6x(S0jXu-K690s82*U=XGJ3#)WfuO-}s?RkyvP%X0kba~C$drYV5T zI2{@9ju|eKiCL$q$EH|^kr0iq!!$&^phzgh=q1hnD~4DZFz}s@A1ECv>*{ERh^nQ} zHQtK5(pmMvda*8yqCo!38ihh$8y?rZAC)l;D~ii-YEL|KmF6Ud0F-8 z`z}L}u9r1b8KC~z?ZtcdIGg=Lu+D@DgbHBjn=39x11hP~Si1 z9uH6OuMp%*WHtvz#e(Mev)5yS=|P1dfu%Qc&LRP)Q0+S1ATGfB-M)H}&wU4OGY_Ac3(oT50qfzZo>Zz=<(J{L*2B-)PZOjZ38 z9`*Y_-5rwKJtSLA&>`5HcEFLsCg#ZWnA0UYuQ>+6eJKf`fl^!Ad)wnyo1;cGrf|?o zPJ)f!za1PO1bI}cs?=#TRuff`&w~X<0Fn%eWil#7)p#EY9Gb|9Ynu>TsQGRT#ugKZ zWsCgMr~)R<5!0lnV(*@J=33O@ zp=O8G#ASE2UEya%oJ2p)iR5YP{N&F&&bjSW9$n||g@%(c(Ooo4?ElZ+ zyDZ0zWm%%X0_zdk?XKYak$1$DLRrdIgjk{?GiG6M;J6bCIN*r~CB>+wJ-(A_vo5o+ zo@A)gtVT6y%URIwkJOjkvmfW2eE_(Vl-wzJBnFuwlJ0n($KGqNz1B!bwZb26*g?uO zWkhFKYxjf_+IZcp-B+W;<&)qlLA+|k^Y~rxUzb%8M%Jg+V#;Ps3CQiWB7+&SjueU) zw)8wq#r00bzJsQX_#Jm9meN@=9n64QM$W{ffp!t5`WUunX|(@Jqyh12AmV*)I0E_& zQP-4|tZy@W#ab{WYR|IDh9$!JBqiDY5M1a@QD5}Do{t*4E%SxCrktMq_{>7q)E75P zb(e8jMBW%!{e~XaJN>T@_;i*(uv@yRy|J##)~^>##>aZp{PrIV#!)6~#$k`t8Qcoo zUch3pMtlfALXU+hJ=)4FnNG4(x|F=rUa=}}r4aH}R-=r=FE`P!Oy+Zn*3h9gUR1EyZltipH3 zgK%f^zJ%SlJv_ENK(}bDSkch+cp&W?IOYUa1(#l1i8u&{i>z`>R91N9rj`ViqXjBh zo8pt}gK%ti?~w2{xPG9Ge-)Lbcm)ep%$1k9g&q*+!_#5AIZ;8cYs4XXs>o~kydqYARU zXLV8i$pn72ye!$u^kAyIR#R1|!ka0zHQ*#-x*q)10eTdnC9!9<|kV;%|RuPcMHGUZ(4+NH3s5(S#fFS0bPGMAes8+Pb!o1 z32AwQ$B?OrbQEEq9fQxnniSTRm6j)J8#?iH$PY`~X}1?Us|Px<4vIpGUyM5K?Z+p< zw|TV^1N(mb9G?$|N~2(6%z_sMd7f~7OeJZr2bP-5@=2Mex4*O*GhpEYRHBWaP64^O?djT9h#rgxG@_N-)nGNZBfwK`2 zN$kJ9cxWYTag-DG;wkCC8>^J|s>UG}TNe4EUcg^Q!pD4~N+_FhE?{yKUwSi~)ZFDN zy_XDC7*P&vH!XudCs~}o8wH+sT2O_PESyY0JepjkLC}h-Ul5zj5&7G?^%nlKl;3q= z2rAwDu6@bx+CMou+dn(oS9>Ru$Yvd z+h!+(DL{S^QrAl(MS{^Tp+d@sjywY}_)8PLF92c6rS5PL=AX^ypBGH#%homyqFxm8s%kcWd%7>}K;+zDdN0YnCzflHOFmOuR8 z=kW*7Rd~o_@1nN3Y#fv6NI4mlR(eh^MZYXNl$;v{HU1X!Iwi9=jJyEM@Ga=->Keq$ z;2B_Q&#rUgmzFu+7!CGA^g?z=cywo3T5^+7Hsi{hH5*+fse=$|hzjpIPZ0@|+3vZ& zsBrgdP>4=Ma09PPCsA3HEU@n%#FLeDd?isG2BcP!5~(#wHFz(^EZeLF_{v0~QF$(v zww=pjEKEuUc&EV{bpQ>uw2XZL1j&I2fB|6%5F{_;?o^)xn#L>iACxD7FX$Jh$j94U z(#C>?hv+@)2yy}PJrB8>hsiuY{ zW?3Z_F}&nkLAxdM(r-wm&`N!Ws~X{kH@Nh(kfBIb&rg4&1JC%uzyIppz%w3r#=S*d zj(f~ARzy~8#L>>Rp-!k!&W+Tc89{W&EjHS$T~XJ!IxhW6ac8J#qvR2)F1sV+s%*HE zWgFDTvOJ$yR^zPKkS8)l8cujPqdA4`jBLf|@1HuX1*IttVo8&yLmLrMuCiWOT__CC zo14nAZ_8JK&$$ez3OGP;Gf`rS@Yrs7hrP$pR{vXJh#vQutlhclh$Uw;%S}U8Zsmg0 zp_J{dFgoH!IAU%TQ%zTeO1qgX2%197XK#b2HwxCN4B$SRv~8}d zFfs2Q3rQ~^-BME_v|9A1` z=|4dz_w4JJU%&Z!WH3?xaE8lVGL8p?tn&8n`i@8(CL~iVu7dMg4%gtF_Mg7Kcs2@N zUA}qo>f0+g=O4a)L+y4q&JdABN$(X93T^EcM%3sypbb-SU5Mssj+9~Wc#{|xH!i^9 zp4Z$=rC8&LKk09596WN6Y;;YKhhhv?+GuZ$;V=nS^lVCPH=pac->hob&-8%8E}cRVfX!uAr^=@jp6VO=6iu{3y;Zd3 zCe5-nAI*#P;$)VYZUU~y!X&^>i}HgG5Z^ETDsF)T#c<6-veyjYb|MXC$d{sBrAnZ~ zIml`#=EKtM80QjQph^tt&lf)CMQkf9n{rY014Tp0NGFJVY8&XVHg@s5~9CRE8g;L#UI;@(d4HTwf#{SUT#M%EX;`=r}mf*RvpIf zM#gTR8MKXvP;z#Z@A(4%CC1-~8P_^}&G`otkUAet8?Wx#V3cx4j#;V8*EK*`t^jci ztx$$krV|bL&N&mvkFePTHKA^IM(JONBx@~8Fq{t4q3)3qlg5q6i#ysp9+3Kac&wlJ zQu)X0(!N{&058v@0KZoBN)46XM)Om8&fMr)G@C1xGYWOhn*|FBZr{QH|5;A;++Ruc zJn$SvPR2Y|A)-J(5jSndz^j8!v<*=`PrxwLoV&Ry)h_Pb&?tnQM~e}R|v`*Rxh04otli=h$FH-a4m1BUzZsAz;0in z>k^@mHj3w!bXSH)gpCxQpJxetXSfX=q(M)5BBUo6he;aS3@YPEO#SNhi(OxEj23%> zS&EK>c-MiNVi>XjV?dn0NsPwS!$~Rzirb0JPz3Xt14^v41MUB9T~<`6j&MtIU-Y_j z?YVn4tv@$-IanFI9Ev`bgT0ee6;IEj^V5^F^Jsc>etdd3IXF2uIX&AuIowxgr{~k@ z-iCsg)8K+K0tgQvXE40}lB7`jB}I%FywZ<3PEfZYwAbEk4y@-+mprz-DNj~xp2w_N zKsbTus#x(X{55HakB0bYh>w0t@zH6&lvsGe|v>y z>Cg3wbv+8MuJh=}cj1kWK`yXA`Fs7lB-L9$n#`_sZ1?TO)0ZZUgJ%Ifvk?2;y)u8v zsj=O4rqe$2QCqX3P;pX#cw2~&|D1wtLKqu3CPo%uqw1B>!ATxET2Y5u5DkKzCil%m zBjDB7?rGia!b!0w){4Es5Z0m6?Y~!?Tu3osS+E!e^m+$$zZr9G@Bw(O=8#(%tKas3 zZzQQnrJhu2yvt^mSZURZe#K7nf|UtSy`XIwPN` zq&0_SIE9)naTc@OHN|^gRi4FVS($wYr2lAJQNeewUk2Ak)XZeA9aDJZS`6}qqdbIJ zR&z^&qg)Q-a=qiS*Q~B)n++9Z^)jV6K6hYTV;j(sy&hAA(N%8_SgLMfiP8L-^gwo5 zH&$RCz8^7s>|;#M9UaYw1lo}KnaM4dd6x;4g;~J;BQ1U|I(WDW9Xu2+WkT(=92-n= ztr*~IafZhN^-zp_fyOq7NLzCWy@8`GrJ%I`?#_$K>N)*GXN0K*uJ~E$KfZ{~FZcKM z_swP6Z!I4p?q;q(EFjm+ehdnHN5zYH|KRAqG#8q}e;MXW|K(oGjPd}J6 z598ov0`E-qhSNt#Xs3eKGyba!MUNL%E2lT6348rv*r ze7K1a=M|sIl;iPKj~43yp%b*zVEP~6PXGBO!Z{GMFA|ao1EPc8 zjk&2PL;T)cVkKJqo6-CN5|0dCJ=2W$@CyA$YZS<>Q#5g8%bdE`fRo~M0<$Ej^hHt$ z+cu;nAnW~ciRM(-8ncq8aOkZuPxi;|ZI0twE;eHxOmL?gVJhgegQBLWzl#+p5NCg^ zdF>Mu!bx7lc1n2D+)cAiQiT%E6L2dE+5|!rbI~8efivP^8yd|)C`x>o={HVbFnDCO z4m8jZ9{l^S-VHQ_frijiR8lX1y`~{_+iehl4MtZB3>mv0x4)RymeSbOSn~o>ILTvnq>A+CqYC!YQc~i581=h1&&Ow@ z;KkLe@!8q&`FMX910kIz8NDpMy~Dam_k8;?PV{d6;^Ny2B&-r$_1C|Vh<)(u-$(Gn zSN}~vW&HyL8t^0i)HmdFn-vgX3iX+@P^vmDnMhO2lMF_YC*-_iBL33i>?GH%dJSsD9$X|K>ThdUeWoPbn7A9lj?fQx9r$%lOQ{Rflr*O^U>CSmlW z%Hpx!m&Vfqx6F9dVRKcGcaOMWSrgQk8m43>$NQh(h}kxj`+oddh3WXk-awNg_Y%p&#{Q?Ga zKj{~R9TaG82F|r*kkxZWo=C!BE|qk|fWfST`f=Ha8$3}^EvG4_s0Sz&$Cd9t0p3@Z zb7u`9>>y|UGkzrGuR!jESE9%MFEV=3ABMl_4@1afGBH)?D?sM!q#%jL4`qc=>GqBA zuimX-U>vSyU>u45tW&jrbQ(@3;dBy(>TrK=a=ss`C_LMb;-k~U=pfpgOrx_6p`Hi9 zpCsap=wVgVWSbmIeJ5B?zYO?^i#TEc5OQagf01g1h6BYmX3CHZWS)pM`G!QkoyIqN zTqF(g6xjwEvJm#f_+i`lAI)c{1x=33$r2i2ml1bJzBT6HUYtW7Tl#7;LgP8if~2eU zBJ{+{7kVSgW=s0z*IM6rs!H2W!CR9pwg~ACJ=x7pOD;18nl^*WzXkKx`aP#rtc{}& z9Mvh-8}L{Oa?i-phqqpS3EaopKD0uia$%BDnx0qszyMx9`1b>NJ%HCej_D414PNVf zzU1QFoQmvaXHSKnZ^)dylu0?kL;76fsjAOOrV&uCzB6 zSUN+lq2u)>G07`BX?-VH#JwG69TpbYu(LTGvgKPQEyuyLkXPof_Mf~*vHx!19y=zc zI>G-si}DzqDOvrgq(WvF%KuVjv+9~;1K4?cmgNQX?Rls=-OTIfPlJP#{gWrb1ymRC zq7ERQ#eW^HxVXmo8drvK0Gc8K!qRpwgvfwA0;2qyd%uivDs1$%K`1Nm<}QP07jG{5 z7Bz1-$Z^n9^u8d#S;Rgo1FO*;KHEGzv852>B*UB6lOavI2A!*j*@eV9YC=gXF0i^) zV>X#bd8+tAy4C{ayT_p0@~?lx6#;ch=Jjlr!p!bpaca9^kAq%A-mR_<9G+OA$*BL; zSjslXyIh@V@Gg_N7ZkXXSNjMOwf9KNvX#@;CL;!Nrywj$gm&5|ipH=-lm2E`>NgDY z^$znsL)Bfw+zjk);|e{z_2}W@Z3W?Zc&o~J^vIE(SqelZil$8Xf+YUw>tM%wOsj8V zcNDyQ{;+Srq3fA{)@u_Up;I*P#}(|Xsq zS>H>DmXC8$SJ!!w{A8fcJQ{Hi@mbCsdiUq`1>Ud^yD$I3x17wo72#=|0|RJ8bKJRI%7y; zpnz8sBZT-K+qYt@t~ng7tT`NeTk>9EImH1EdUnoly`7_m0gJgMy87DYYSFre; zzCHz}9DR!nwi{PH>?y9=Wfe(+5js9C7rddHfrcS9a0QHmQ0aVwbeNkI68q7!B(5XM z8OpGpnuG;dWqzc>EtU{rwA>YSU@Y1zu`<4mV{>)Xdb~1fJ@KN}Bj^Pza~*h98;VajPk(<;nBBnlb) z%$RiGXYl6f<&)q=8iYE3h1EL)#T1`q{Nn33&ruTG6vNTqtrE&!`mDEqtqoy~1$y*yZ;S+i?ZL&!qoYGO^4Z>_kX*W)Eud|02 zqWL9Nj+E?l2ykxnW_m9U@jUvNYY;9?hcL12fDEOdVpm6Zq?Qc`{R%1t$O3jW4cW$! zZ4BAQZzT$NA+>VM%JjinH{Q2t2camT`-Mp@pVao8{RJ!l?E%e#$X2qjEhvgpK zK}RmLJW8Acx)@T4-ldZ;RZCb8-W{$!fAE0M{^!5^>jOSbu51rF{Qun0g~Ob?p$E;e zosL$K@UP{UuPLFgH!R{VVq?20&}O+K z3~}G83K4Q>Pef;E+1+AP{R1_ff_#ZBa4~&Pkv`F~(7ao2M-bSD@w?vf+iU)X7;K&6 z!tE^nU^M#-)qE$whQlr=+d%@UHRN}E9BlF?v2#$aowII(Fj$p495z)YmeW8fx;&5` z+$HuvSo;7<^?Dl{eJ(6?vI-VD5<+jDgzZN3-TuKOZ0)1@Y`Mh4jYx04{`%^T6KZ`V ziOo-YC@V*mGQN5OWcEoN(<1kUF&`EOcD|A|3w$z*;7MN0Ry_Xo#jiTXSoafIv!>_8 zB2Ux&lOM+2Naq)t%tw2hn9LwaXXo-8tcJ{jKh#OAerG2I|GIzEyYn&aKlWoXKiW{> zK1$vlTkcU)t5N=KWk2(=)Nwo>b5w;k*>-8h4A_ZDX7E8dc zHDviN>ZEj}c{I9$izW|UJ)pyxS|t(d(muSt8ANIY=`zuE-&?HoXeEK}ND%10kN5UN z6&@U&=$UbTeio|Zv&qr%!NGLz{NV6RogW{c?M>o)Ya~CYNO}BZKX}Ft9PH3RvY)g2 zPKJ$l>{}mIc%AtqWfvJzx}q!RA{p!9=@hMG^-*ie;oV1*w%Qzptj3jRF=bIOM#2q`krUrtYWwPxhKEwxgMa_kyP=del+t<%Umf>c1r>}O zy``VU-iWARB|+V)X|~&P#G7RW5GrSSxQ^?5 z2{`Vq=eyo8UP3#*+m9(My#;OdPl9K}(jJjgk@{(T1LTsOEVbXFkO3wmc^ zultQbbw?{1Tt|Yz^*zWL?N5%Qqr{J3sJ?mw@q{8JFxL}KDyZ%XbjSrEy>n!~N4;2DBpaR zZ+((X(j>30Z+}6giTKl@r=SX#A_Oso@{L#`o&=YiVX!~?%YA4`M%DScBE#G)LUEl! z8iN~#yIpD=!v#-{m>KJC#+dP7rUnwh@W!x7T;fnt&*VvP`!CcYf`UEf!VdVtoZyu4 z#e%nPb;;T=+ps9DcTwswsjIaZ+4aL48ZOx{8%_JT^2~l3LDsJ4Wgdg}wNEYV02Lgq zkX#lVmH^XN4_=lD<}dhw#SP~x0)(KBLHaC6*mft&7>h1N?NUg>I}NUqfs!5CvtP`uEg&xiRW z$2g#L4XPL@pax%~u?*T{6TRq%^SpF83duKQbXpg`J4}l8PKuK)niPe4i}+@Wef${ryE#F&wIux`cZEgr9$I4S1sodD zQyppGu29ciNOC_JGMxlDT?9C8@1o|wLyZrBTBWRe}KP31pVouoJNa2)=Oiak86D>0W?HjXPh#fb9?1 z{($XoXH3v%C8GvHA$Nbwt5_%7u*MMNBu90z0-|;WtYz>q##;4CsRK|w?H2V!#~ZXp zazT^VZ}>FmD!>{~<}@U2uh(V zVueMj2mXIlHlWDzxz8jj^Ln0?T~3crf~%zaI}CsT%pKZmx!*w>c1{*gCv7r;4%jYjf!RzNQcA1Mc4bxIqMub>ZV}aSZx_bS*cNy`vFB826?ptIw zhX8qF!w{sQ666r`CKfXyV-(J)MbDud%`A+hx@V)OfD8w@sZ%tnm?X$=@{QCsC(iJ{ z9`Na(l0{Ia$>KpL__qgqx^ENmb1?x!&+Enn&OA)uXx!vr3T$9Q(7+MX`~>gQt+`(Y zA?Rk_IeuSKp5C z|1aSj-@Sf`=mFQu6c?Ih^_etcR~m9XOUgxV)IU7mpuU9;+s$I=wcy#3feH-KCf$aI z)N;EJ<2r>>X>8lQNN#_DpyO?xpdT(OCXMHz-rIKxjZ)xt#lRUQ%5A34GQ-4^gOih8 zLt+CipuWMPVJ2PMrXKWS>DEg1Ba>nHuXXtMJCzm5tI=1|1I$nwP1B2CyCN7BHRcV- zi;B5X2$I5jTM%FA@LmDH`6Mca17HJ;FkEN=#zDIJrW_6mc--p=ynNI_~Mr1P}9l^Kt zB9#|GSWFU~TNfYnLX-j`8^&AmnAWUL^Y#0MUMkswY}y5it>Y}6;NLn9yaXv+$DzLo zXGs+N{zKJR+tzyZoiJptpEyXG1%FO{Ocp9m!h1}bjy>#ng;3G)N}-~2vA^A%jGY`K zWsmpWO80&&G-tX6ijFt2F@JG^qUMW1PH2i1IH;J{e%CUR^ePv;@ z?96lWTUvx=H<+;M4Ss@$#>>ws>2&T_N9*0MzI_4Ok(a^Q-ro46l@4u0vC#DFgQben zZzP7A`UpDzW5DI1J|CmWh^lXZjg2NBWyP8oU`Hhi`^5~5NzJ&^=?YkJ0jC8U26Z-H zy6;2c6xFHD`wNO^o#e4FA>~>`IEMiqg(&z9QV2jIghM6J)u(4MG&UG&%Cav$!U+34 z*~uWzK`kBN*X3(JM?x!%nT?Z>XpO9t73;gx&t)zuG$b^S?`Q{|S>fgQ!{ztbllY9R zb#Bl$Dh=shJcZqy)sY%J7r4@KYXg7>Y{k0jAo>syH~A(}(Beq`rtTI*JE5g>=ocDB zs8LnJqQWhYkVA*aCo0*?s0pmybh^oATHZTH_=ve;q#$hZP40ML3 zYT$AI6rfa$$xsW{2S@a)pi6m#p=kAMptntLM@g2a`7A-Ct8pVNeqKy-fR&ReUG|73 zntRiRlvC=*j(l8TuFE51;!4&&48bv0%`+M%W18dzZ4$6WEs>j9^P~7KYfJvnWhw+3 z1wvoaO+W)*L`0(!X)e_9k)(Ey4&!iPXaummFP4pH>P{iblDPTr8{IWYGxL>CLp)Dh^{q56sE8ErU44oV<;5mprx5ymU!a9q*r z+w7IOw|L?4N)?`C>7#b?WPj}GD~;n%jf5Xmnm=g?7k0hR$BHvs6?*Ow@oV({65mqa z>Kc!*7ylX!E`Ynv2xr8*Mx;AQLSfLsSe=hRE9Be{f=IP+{Gf4R4QIItmLYl2^54JN=f zo++=u#Rim%9(v$xGiw;;Vt<(izWcYLp(vGPfN_ZB(D!W6ZH6X<#kMV04zAkiC*a^U zacyIiQ^Z9l#*7F_@vL_PfL>iWx-n59(1uK49wTe6oK*0G&AF#Z$cbtBp{yXar_UNj z1$5_>{N=Z*^8d&>T-=EenB_)QQQxM;HZu@lTJ)HKFfwXca!VrBDoj}uOd@acWJz$1 zLQ8twj3ag@V>3%JdrAkNE!7s6`$cCA51`z#t`!fAiSlc#u2)+~Bm3&z3J$~Z%C7X| zb1&6B7`umyjufycK@9~Lr48k|2f>wZ^X#pJk5)-(o_G{6vPtS{I`=J5UhVedoK>PR zWIt-zNrzNH__NRQ4rvB*)9zbJA5_aH_ASnN7a z%A~;Sgy;o&->$=oU>8|nsVgL`r;LYL4LHCvIV|F~HiN}rStsVUP-=^Tvw;2x_Hkb4 zrNYP#K}H|}g#dp4WWqU;n>G-g4IJr64hLEa4lp3a!f=o7Y|box*w(XXsbqnyRYB9C z45JNn?IgEVxg@I93n$be8mGZ07+dwceS*;_q{hE-t0BmGfPfeQ+z9gWce>T?4o0St z&|z_1FJWG%`X_!3ctXMuN9_>}`2cE-(Ndezs56qs3@tuNWvx}@XuQ-2>Pk@Mv2OLo zl*K@p>#ohM+1>5ezXmA3-;SL(QkRSCbw7_aTdSeHlPM;A@*^35z6bw)0Qv@?ug6(b z&&9S|J1E0?-5tZmSOd**^%p_X;LNx}=`2R?$rCF1)6P5BM*^iTef0ff`8lZcSCBVV zMzanAvJglXeM^6~8{6u+zP4%@x-1k0>hnA{{4G7~^ax$aiyDT|?{v@BP2 zfSkF`YB@Fx{Ukw|LH|$s;y?|PJcTmI2XO@xpWqsY6hRrr+FHk2e`Sfgc0z7DwZ8Az zw^yiHQdV5uLBV+>hXBM;uNs+{w=yl&^gao}ZM|2jtW#3743$JU$d)ADel~$PUDcU z^S5;w)u}B7>A&$WMzm2R(`jM<>V=NcLbo#5Q46IjQ3imSafFVu^T2O zaYDU?lBu3hCIVaqe)%phVxk|+!xGE>&_9h|e-Z%x=d&nz-f$yC;o1nKIvT9SQ)sKz zN7IRs-W)8EfExyGKh6ph2{o<}FGK&H?B0-C3tR*{=;`8yp}pRrecI=t-436T`;zOG zx*$R<(qzig$l0|5ggVH=8}NgM@yVQZE+}L$HqBSW76C+rBD3AzZXF*+-dacAS)WJV za*LX~axOi7LZhr&>4c3Xt%49}<$44c>h`a7$M-nE2q9Kbj34mXJp(S#;M0>LM3oD@ zR?=_uS8Z=O#R>z|u=Wvq-sch920~@-b#l}|FMGYTZ8z`e;K}}8uSZH_2_vXmE@6=6 zC?jsAa}->9s32~ZGfa|D+*1dJ1rtSyu8{-kpjRgEqlH4uD%HtJ@Um$)!zm2OT_-a# zxHRA3$}&1==vC2Z0ZSs@Fn-rOetTW=2@RW65Jm6BEVYIc4dqzLIcbH1(=bX>;)BHM zCdme~x3!P9zE^lY4_3tkxM;4Oq&x&#ZH>-4>7#w-=Ta`uS5YocgiOWvp*oAsPtW$l zx3hOmAg)`o? znq9Z^&GU=ht^*$012PoGZIZ2{g%vt=r64~Dn*whbMx0Y+H%S4i8s|IGZZ#rA$d47a3LwMmTKt`&M@*oyyIia{s~68MuHeJWNsNuG zGD&@WOch?i%lu+@*&&D|?tKqgxJE`me=aYA3;V~HN(W`ZVX$*?@$zt&Qcy`mg@*q` zk6-=W$5UwFNE7Y?wIiHLijg`sL!2y6W(ApE8Y*MR5ar6@H8OsIwvU$LRQ-^Z^k=3> zxvbxU_BDxA8Y_n;VE~)*k-8sL)Q)wd%uCE`J%USTw;1`POb7bwkpm0&EW?pX;XDXs zQ6ra8p|DK-*l=Eb<9a$a1nKGg+~DsxT?hb%*PR%hVy5$NdY_ausNqQr6?$#OD(`Pu8q0 zms!7eU|BYw_(sUC_amq8e1V4%<%`5P+w0l#$xoxx_hijO_x>bo(w+cZhyDh$ZOx;y zpLF99?WJK$K64GzaLw9LOF#|6bR9g9jV9!4CVjFL#578|WD5;3Ga@v^Mlj z*Km((RxH!^*x64!Gyn_@07C=7KV${|;kt-lEQB{bL#GfA4y(vSgcqlo^!IXjJ6%_o!=De<}p|$sS_N+dc|= z-MG*g5158_cf2@ip$`Mz-3ra*6+PM~2{gTP_3bXK`CdKkUvgk>cRlW~&s`3mubPsi zL58S3mXMik1z$j;7gxhdYzad1Q>jw~6==;E!)#;x^DHalw z>^htz(2q8eMdc`g8Nd&E8#i$VNq^d4f;}F~5|!hftS~ z;Ru;<9wQf=r}hpyuG3x_AJ45L;-TsHgU({8|J}Fgdbh=Hzo%=z+bdA?yntQ=D5pli zzC{umZX+dy(}r2}sj@sUK;17(ij#C?KMb`s54B#mJ9O?0V5wXsrCFVjkA(W;dc3^N z+0KFWq?ZLf9_WEe_Q2Fg!qk~N+ynoB#+=Y+rbB-P7?3s+)!Y)?!x#$fioG9)(Y)T# z-0K#K=4d85Fh#3^cYBbjMq!Dpg9`0TzM$OQoFwPpGz$iUKfmJs8a z>bpP|>8By--O~mBvy|0$veGl)wjyP1_m6W|CM>w?Bcz#Z3S&yZzD9 zM6x0bu-SB02pu7@SJaJ`eqLz>^g5mV{&5xb@^w>MPEIycJ8vVqn|U6c2AID&iqAkO zc<}GPdN&XX20}q^^OmFD6AJvAKIO{wds3#bX#`UCtK^0vE$*f;{X4012Jlp&n>Bzi zg~qcyA@3y-GK~zW9W`eV?ait#H6*EAkm=xx)Q+%t!QWT!7fFGvcL$gPrd0{RRNtBf z7?7~8=5&F=X#rXokYb85-u9_b_omI~Vx|9?6dl|M&<+Wg+ChEENwwXjtd zBCE9_bK~xo1M<(b?vq9oJ;Z3*`elNwJe;B=#0m!H?JrOiSxR;o#@%|yU4JPI+yr9{ zoZZUG2#*hdn)+5Jas!#EN9iKhT=EyK^g^0(A^BnS2j;)h%=uxr? zI`W4ImX}l!*VvY{K+k4`Q0Sm7-GXCdfUUqMmZG^IBLH}2K=i}v3pzQhezWjFZ;=RQ<|Ib9jfO}ibT?4-ZIiiOxe z%il14n0QRzx-W~M)$@)ec0`7^>{QBkQDDSCnv782LL#u9i^A-=Z)1PED^o{3FX@-W zkOjqthHf{81*8em5hUCxxIEICT|$M{2->}Ynu7Th$|iDtQ*OSeMfB@+!g;UEo z$&|Qsj^Yk-2_napEmML1+%nSXsxlH3g=`rqI-4Gc(P?yete~89ei$C??VleVA06(i z)BWl3>CyR7yl2W%>n45CdRTeD-{epa}O-l%zfd` zN))*NpDgM=%gs^Cn>3-BCuEM z$x`HY?t)mL4arb)GNjdF=gq~pyCeLLq*!KmzGR)9zYsdXU> zwIO<>pAl)5Sh%!=-O(y<-<5bnQY4J{?)KqZ5uVVr}0Nw6tT^?$6sF|fyt zvms1JDwZ=Yir#k=?v_;^{Rl(doET`bkG1xF;uLgai75e#>klPG(SYC?)&TAbtp7}} z5FS^sC{-QjV}W!x&x{6);5-mw{$PRPNIl|9CWa5(uiKV#qCJoWqdz(DgZf7FuYrif zo7jK;%fE35=$t$Vwl~7u%%g?}bNS+1CPj_lVKr?jC9`5gpuK*C!FN}`XU!eZ21>Ad z@!RK5N0Q@A(?!3^#e$tG;lhI*dLp=~hiO!&9Q;C0Lo&-qQr4f_yR@l;J|0Qjc(G>l zMeg8enI>7-N%dRvkbWkKj|MBAcQ3~#TA{$kbiIW(;3+|}Xh|o=24-S|8zO`|z6>?w zWX+|2riOfmRKmJ%@O&dT_~}fKb>HCWnuT)s20Lm?U+xyyugC(oc-*I3T)!sE@#l%o ztY5O^bThInk3+ip2hmj;NLLU3{a5b>($zq^+W4FNR7n1~_oS;X6oU+2Vg=5slx;@K z(L@>Uv(?KdXS||GrC}9j%37q>YE3zyrB$badD1(Q$#$1fJEF7xjN6ebrDMJg*bb@* zVRi`vEc#LD(b(lvxNOK9kKzzrWD_dQ?(ZK26Vo20pK*aQmOK0BzUN%JxDE-mV*z{z zm%-dQJaU$D;!lk4T!(-v^Y{jMA)Vz#Qe7irfPckXQ{pz81VpQO47!Zu^+iBXsZvRG z)L%HH8+sCamnqv7)Pb#-3ynDm`PPxmk{*E=u!Oa5BD zpAh)AxgDfQ_cgl8No?UiQ%NHlkYa1dvJI7%K~#KLR5?}!;Ead_2{PNx)2qwZ-~M5@ z;b@^s3z-A%f0LA8$2v@bHBW&)bIq3SFFdgC8A#;$f*^&F0Lu-CN}xdJy1(W3`# zOedZD5_5<2;X2iphk^U)1Gn$gv_k!*)>}UK;L-TUE zW-It!53BT=2Ya8nXkh)Ynh?D6fp{tjX@3|)5K)BPl_4_h_Bs0K0uhq#auL`J`cF=uhjwG|8$G#z1ojY^03OOE+44p{UVK5n4MnbTvlK zd&(Vjdh3`n8~#%_t&wdpbu*}e?V;+rVHu*7QkN0g@7Mjx*RO(u%&12qWPm^99Ls~u zT(khFakn#yazHSpK`1;GnRsd~_ChElT)p@P|Au84s&gPm z#m@?O*f;B6d)F+_C6+PMRVlz$eeyJBFm9(N@x!v__itb<-@hBPB{q2dbUL z6h&Z|GC{|H+46{CASw++rGcolow&tGPl-y!{lPR|W~n)syPm{ekFg$k&QhKSvJE@0 z-&{WBGOpgQu?1tElqItw?xzKfxc|cs@t2p!)6Fqwm=(f zSTS)g#EuonET6eJ$hCO_(IP1FNsT>cI}PFK)pwzPHl-7NJXOpSFf?YkM{LaIMijXx zi*y>$98$6F&>wE>CPG;hNnCWLRz6fmAi-tMO(mX}xOFZM4l#z3&y1@&{Me-|7N-`V zoSF@__zkQYJ*J8IB*wc7n65m}igR50#EIa{xfYvUA|0&4?*ZmXI*!H2_U#3+H(zp{&LxhB+ z+KJ3dB1c6IbV1AwGgv4+&qmnTr0wFYxc%P|05hMFfvx)NfBwt=dI$m$g4lF2Pb!_0 zJm@U{_JB`63BJz2+;XO$yVwhz^MWdD$1NhpXmStq(UYS#UuT%1>z$!JCW4JbsMnS8 z`=ws9(s#mFQmzAbsehp9_mJyH=-ybq1>rQIy?BWsZOp}$PILo6VCV?Wix{hu2-+A~ z24a1N zQdSc=h4}ILi)XK>wk6$w5CsOwDiAR)NNO0A3rJAFnMt(H%gkv#_>+tsaA9pieF5C? zx>hOR>aDJ=Vg(fO=Paj5MMOW?GR4&(W6G*qG%t=cKuJb{fOTsd1CIv0?+VKzK;eew z-LVpg^7NpE0yL2hSGY*9mO*KtQY+L{F7#3K{o?vUnZlgw2kc4R_TMmBhdG4Fd~Fj* zi;7-C{s15c7F|%-n%iECN&&8EPsO*?V-j-*B-0T{)rYS_R>FNgYK-bY(@m)^pOluhTijcLrG^S=?o>EZOe~Ods@Tf{;9jl6t-?8E-WfWRbePe6laU?-2v~4H!Yr=2S+6;y zw{JAAgcQ!q&e{zr>EY#nVcS;Lm!c7LDVel)~ZU?9t?EqM;< z=q1xDFtde!iAijpJ!Gw2yFDPJRAgoZbt?OJeH9}?gmdRN$hab!oh#p8`~>X(i)W+Y z)sIy;3NH0)(}%(DeSrD&hdiGFv6|^`?vS8-5St>uJK%Hu;9#JQf;aCHoemWvJ_H=$ z&+6%QSdD1g0n`Agj4%b6I}Pc${#C}F^uRt2(a~vXUFFWfN+5bDHmLc$bn7PxC!1iei4~WT zHyg}g;Oop8Wj*z$!YESkq#I+}F;7r#H|3FUJiTEwE{uJ+fgDOp=qyR|mal3WMhSJW zvJhwtZ?!HPuZWG5#c$p!)TY))12vCC=;es{rVsWOh6MK;;AJ5ln_6los>~B4!IbWe z>T7@j=%53jp6J(z+>cV+y;B>eyR{>>2+9zuk#zpNCVk-uOl=A+yoHEhZHeHx~vKd@amY}O!y?*RL> zNUDYlFTR5r$ivg}!+e|}x*T6??< zEl5sIG68X^h1H&$_^3I5X(W#wAmZwF7BYBH4bCY!e#xy~T+A+3mGv%J7eZwV`!jU- zNPSR0LkStF2#Z;dl`dhraRtL1mS1Fz4t2Pk~2 z93hsw)VO62)4m2%j#_&7zNNC;&4M}WH?R^KZZ9=?i|l|WZRtet4atI?!s`2Be{xQC zed&*XeuJFsi*H^sskzE)9eEa|AysqcQ7DL;>F-daY#awWQuU>pYG(Ms7@f%*&>zC1 z4ou^95A*)gF;#P@z*ysx%| zCJg9$7>4T|hW+9kUL~ytQ0AqsL?{^>i~+9Bq6$W$9yt(+)u;IPo41&Dk<_OTAU7QHDL&;=mhEs@tLPvL)V~-jEwMyIsO388h_N!?}sXx zBRMD70r~|*sUJZNHU#ax;3_e<6J*MI!%=Us{}e{82Z-b^VpS~@8%hij8k%~y~R-TA?xR6vK0%P3ZU>E-&0pBghSSR%MiXs>X&yrbEg{dowAO}bvu>GP00jN(;Xw7aU4Y3aWh)mhe6z%jB zdznmC^dZtG`6kS`pt2>8>u93`>iNY#Z^?65vrx{fKVRsl@Mkp%t`xSVehA(Gvoo8~ zjQXAZQLjUdA+;q>Y|T0|^u#Xp*846m;^3;v(F*VBwF;}?>RPF7nNe$&{h;UaJTGQC zII)js`yR`hxvBJ6o?hp939|@R;qUNYcE0^{O;qY~3m?{+iOo-6TwUP0gH1<`6=sd+ z>102z`3`j@)(UlebWkpX#d~BgORgKT z4*4<>O`=C8>3jIbW*LaV-Xv5_(m%LPxw~mly}S1$vz0V%d$-Cy zR@ej}9p+Avowt4}>it6h6aK0)3$~g{he3c~CAe8uH{Qsa_RJ$gHoECtgP-W7<33PY zdP|t7DG{ObfTS3aYI?0lo>$tR*qt8WV{tR+9Rtir{_nuja>k|nd&2s%weBt@1> zJEq|aq!p=$Qkqk#?U6MsRQjaAfHP0J;nAvzyA5q$2M( zIA@Zg`PACi&(n>pA(4)u68&G;bj=#->GaZY5UOE9L$kHpcJyrvtugOuta%7`nk5DM zTG68afJc3w$NR^|Wi5Z6U75s6#r$)TNqirv^XXX}9Zt@U&yS8Lr$;C1`0Q|hqV|sW z; z&GrpCu#v{AIs`yWarr36R7zlTYHd>lSel$0i;5aUr4IOPIOT?Ac^eVh}fwlb_Vt$j6(4mdJ4EaxyjYsCmNOBN7(HCxm^i%dr@?q>!+^g zIW`XHqzl?vY+l8MY4iT1E;Ve2zf}12WC@xG^7uOE*qK=v9vNtJ8`8duu1Lr%3Kt;{ zIM^e~DH<~PBX-$(1!YDdJzqiW{Ta!h1%?HGFe&TwMYgEs&N#G0qq*E z_gDN4l9BX6$W~I4rcUUcG<>kBwNV}p?Gb7DMX@aEzIt1iK0yiH{$TwsD&j@zQ|Cq1 z*l4MFt+lQr9B0 z)$}#3y1s9!?`@*cjfg}e!D6z;xRskYspnTJiqj?Wbo4GQB<~E0Gph=0e}<8~-jUpA ze!9)6T+1=)=)o$UA^mp-#PlY>-__O=g)r*aRSCRKmgP30AK57lkT|^)VRP4madUI4 zaCIE91yC1#o)tc^ki=`IX*o(n(QC$AI0h*KHEDvJv$E1)KNS+k5BfFCufJJ885N-;Nd!`ScVvR2eqxc=zCjV@P7YZdf5|%IYN+_-g9U~zozK7Pcu&cI+GsV}C z=NgRPY9f^_hb(i*GKVblH~FJ2MHRAE9kY znhE!9k6!VPwqlI+Iz?-YG1L4e29hgxp-@gB`ex(?8h_A%j@526hEU!0fe72;tMTp6 z;~1TPLmMm;x5h{UQ?EQ}A;ZYMxO_n}am(aahH?7o74RJ`VL@4XYd}It>j%oEd_Iw)6Dr z^7XfWKuHLpC1!OJ_Ycnc?}4)IqrPAL$g5Xp9D39MuZLZYtUvChb-O(PTDH*H(Qev6 zq({LA1kFIGg;M?Im(Z?muKx$6#jZ1w;rI3p%+;yA;Tm_R_NS6!{p4^=^?-4Vl)RAn z*5foZjOz{M^@qVTSBP-u_A3aFmB@E+nSoTC3*wQ>zu_yyioniiGR9Dz*CFt~pljRu zT$?WgtV@**Bb>*~Tw>OECv`Mirq(LrQrwI0Fr@qs{{4{h4=I0-H~hmMr~E91O?0w4 zTUKMPRBFm=T?JR75*Z@^f2XVYI5g|MZ3NOODL#E`A;M7$ay5 zO7$@A0*oLi#|{H_&4s7amC@;$7o8rBb>t4==w@Tlqu_ZWW4uQTJHud_GztEODL7+= zb{u3z;mAW((^QSI>1`xF)RtddO;{|G05u*_@STdmavJDCT!tX^94RFGiVGAyJtpQw z4{=a>P9Ab0$m67z8enCHMVqzhd0CNEHn&ZP);vQnrFyYbhN_dt5SVVgOC*3|$II=% zXR26MScb)buAE?U9jS219kG*A&6(fYc>g0_u+Zr5Jse2L`tRsBU{NHa+$qp^^vhEY zQ7S-${t=#%b$D-NTQ(tws=px+hXD;JqJ}{m4GtFrV;TE03^K3;+L1wWtC2M*v;yW& zf@hZ3;H13-Xv{KbDBD`1IF{++L4*vUH?OUYz`NUzH~C*`YP+1I^v}owfJWurimoHD zmVkJqJ_KZVH>4p6TsGXo(6$D}@=c07q;^AUH>7sIrPS`I$Els*8Mbyf?EKM7V5;}& zYut7`!9Vzu-JJAt=$5eEwr(NzUc`x^Xi2YzI>k16RTqsQ{YhZ=lO^>PcFT2aNU^`5 z3Z>I<^r2;IhnUxVqkc)3zShvI^a7&uO>PJIV0QBBk?}D01eZna&quqa*8*+__I4 zG~$4?XCm9$HY~lk>o;y|VWJb4rT=uzG-yE0ubV}(kHMTm}DbTb5`-s+{+F^1EJh%=TLj-Lf_le}Yfmtjoi8v6gFu(l;@BN$S7rmP_+l{gw^}5#Y!3r}O$e6&QUCbwa zYW5icHA}8dKxs~>k(@2xSW7$$?F^K`5ji(qeoqHeKxIGGM+FpPAY{35rQ-&>sVTWC}24 zNosd$tRK%9C=Hv(?T>*&LMJzF&Nw_Kb@>I*{QLOv-BA9gSGBOx3t3hx(oQ3jOT8uv z0K7Fu4XecX&e@UMTjv>%}uQA&qbL6cMOp&hEN zx#!hO2Eh2izaIeO0Wj`yh<4m>z_^h`H;i+;YM@RPD75y2+&RzeN}1Wx4yAX{BAL{c z(RW?oipO@!*yU^r!y#@c?77<}3A?^z_;U<-xZV}V^Ds#<0VZ#{9P{zpkLm5l#dV&k z5f@*D39!z5t=cN#0G?x!*sp0T2%8zVy^-w;Df>NLdJTp)(g`_iljvHZ^vVtcND#|W zTp*(+Z1*s{daQBSRtzu$Bm8JLu>1`4IIovstu-)9$a9|Ky)26)Hk68=1g|@`b$8k?lZ2OILubO}jY{*yLb1PQ#KxM$hw|u9 z!OrW;UG5yc!%h*jAH4(&u*o{*-VeRaXVC27J%ZJDaStizgS|ETK=^W3Pn$37-g?iS z9wSRWYeYE>%uB^c#=NDnLU38dtRL46fLi*v&#X|Y0`|2arj7z>lP*N#&^Ei6C+XY)D9P8XyPVG{UxexbcG$=YJ2m zhd#u}Slz%-C#gjLr@HjOLf-&V;o z9_)+Bdvi8sfE)++eP{23Z1K*ZJZVqSIaj(D86h9pZHITdiPh%I+Tpp11xucIP7v@{ z;y7X86h(QVQ(f+WBdk>?yB-W|m4nM*NB&`Cnwd%=ClRI4N>uJLC7zp7iCw@wPl^bE z35o~n-`ynX?JqMOpI*Ltc?pdCCSRSQIx1KgDT>>ViyV*Oi(I;NUMgy0kE4Mi;*gQ5p1Nl;L|E{)QBQ&?Irk5 z*CM$};O1aY3f!DM*&lmK-sAXFR?P>2p=T|}pXO+KtThQNbbK9i_5L~pk^CEK8Ic!7 zE0YkbCB}}mcr>M|rA_Nb+n>APeKp!Bzs5ii;(8-KGn_-s@k2oaGq@mH(UF8R(kTZzO0J{?MayUs<*~X7YEgm8W zOhXsv5>DU%Rt{k009I}%E_2p*W0#g=MJs|a78bFLbI`XJ>Rl2X;dN9n7nNk;Tlo^x z9jRAM`?vPCqN7e3JCGQGPv0p;u+TR+W}Ex1&bH2HW$CC*SB%>3AzK2`79j2&FpaCp zua8*S`iI@SMr|wPy=&YC&Kouo7i-u&`c4*P+#>j4`VqPg2FYi`xJT!+2%6f7W>r#< zv_>>H`Yf55W4klz4A%oHzvg+=Ytl|@9<_-)-b`|1t(l8*Kn|H|4ZKL#UpN9&*pd)+ zAXa=}SI>ev0Io%U{#$NS;NE~a>IW??0Z7{Ai%T5DbnRiGl5`iToDHF5E081a5c3t| zj_blsYqhqmhw`z@(6}y-i`)1#<=+RwM z(U6AQ5EIsgspiqz$owtQ?0771zT$XyK3k>I8192nZWW}jc(^Q z8)wMN(DqzAec5Qlm)AO?yDcmJsZi6pg#TpNHYC@N=2P!o!|~@){t(1k0dbvq5ZA#N zc<$@6VmpI6mD-Q@fCtH4d76w1kN06suc`~(u03LAW8$G)Z=Jp zyG)#x)iWm{pzI~N<~WF`tSCKTTYG;=B>jg*qnD{dnALAUg4R6RdW{6#bF@hrF&~3m z!+^t493usiTUtsFe)0RdkqAn-jqT(wrTQF28;s)U03(7^Kyk|RecXBR?A2>a5N(1` zHg>m1D)i%r^Y8rr)yw_~?QHuT={3r8&pF~L6k?3J-r2!n?|o*&qR1yH+5EO5?`Cm$K<+(olMfxxf7XT1UIr1o3;rSt$X0sx-<8^=|kcr*h zX&zaPw7X$SgeZ0LDRR$+ktdZ%*}&JgHDSBS z7Ki-@y9m$H15OWQMn7@NyPUttG%f45oJ;H9&yuX^Nz%x5chMp`W1lGI0M!X05=hrx_-; zaJ|RIPysJt7WvB!JxU}WnlFr`{~K{r^kjqw#TVd%B_mi4D!o(NZJ$1dPis66bxwv> zi$KJh!y)ZyJbKn0EB5xy^woI5N(HC=J%<;3zpsu}xHmc53r|%%iT0wSX}llqogSYZ zPgHaiAD*6{?oCV!>AG=)Bft#`rZ6P2Q`zd`$31#K)3c5XYZb?@I3H4Lr1ch` z!_hkpu~*GC_2B(-VWyGz&+D{G#+8EeKqnCDc%XQ(#TU@Kp{pfnfC?V``vEE#pn@KU zQav|tYc_U!i6Yk$*J~^3xXh9*lx*qu=h9W79|0Jue@K`a$gOd+hnU2QV;e8NYT zT8e3gc^Y0nMIE5cZ&(|zLmgi)@&u=rf#3W&#f0rt>K3#DCG?d>>;lbd83CcT>%x@l zC!w{(TGD;pw~6|has2+?$~gXTiMG;4)K31fw3S?t`PoWA`}>crtpp|?dOrNrnJleQ zPHCMFX(Iwu-h=pjB_)_}UoHDvQ)S7Uss|$FzBwNg1Ut46?0x6!gVdDHgFiNq-p(1) zy|f(PrKohai8bcSDk`af`&ukYZXX@i_Fz#U~m86N$?^?pU`BMAr41}CeI?{&TA1fRvbs0T1@L7|kRh5j8mzA4GCBNb`+5b?1;Q8J zQ$Qw^sg2B`Ue|=jG`;on zSPQGKk&lhgwKvXXv_NC1l=RZ#J3(=aVjTW$bDAN>0P z3?0DG-oi=eeHTh{QAi^`!F`gEMpuhf)SC;zVu-j7xq%_oO2>xZTs(D~mR<{CRo9b` z-AK`3$*gszcIynzB8z)4k|zB zX;T%{Eu<$-D1R|xt|1;7f&_bXIJZ4|@ax}x{rRGf>g?B_fBpND;3{dI-a8Gjle}NF zomEjD@;WSLs>Ql$RhCOCVhC>qe%c(Y@^pu|r#9ZSkv>B2cuU(pnS0G!f@$S*(oj@H@;a_T#rJMde zUK-3PjkX2e1AzH_K30~7jB>daEAMrM`b8GnQr-v&Vq{JjBE6 zXU4~8kvu^0C`pK*39>+Pa?{N{2CC=)XbgbH0BHQS0F7Sj^f1X>E!$p7NY!F$R&i~t zuK&bFjFC#~WE>^1-j%klR9or@p%oB{Va|$fTru_XHYhZ3PL|i?Q&IznxxxlXej&oj zktK$^VjBd9*<>nXMfHBs6)QTwlI@H5`aJ>q44;UYs8Er*p;9P^WR!HF-QkCYa)o3b zOIpR1IDch+Cvvx(((N0*$353zRK1_hy3M3h|8K>ai zm>OdioSh-jFy*3;i@ZK0F7gk^{7EXs?sMkyhVi}L@!c=+pet;$6CjvPFAcQ?T2nE( z1W*gD&mb6L=$0u6@sg46(pLnxX_S}N#Hd|W(nm}PM>cpK`t&ya3iwEprsEkV(WK-i zM?NbQ$^Yi($XPe;9B4-ZBb8qq=l}Dfr^ix7DjeD|cSHFV5 z`{wG;?qEw#lA0xt$_IK=HX3EVIV7x6s@&~-Z(Wn2**PozcCeC-e=OMeH~V|z9Kv8= zeC0_TZG_;vzZbj;1!B1J9(_9U;a&9J^G(d|FG}x4aP>e(j?fUV_Y?wK87{D>>Mm|R zdLx?_`suvOiyy(>CX2%&c8GT~2-Jt00p8Kb*k;A;|JH}rn>wCr6f_0HNO?w4xN4=^ zq3h`4@RhESS|!w z`Z80>IJVMdi6K_leXg3x5E?M492o*sc3;01Iu4Bnq!v$G5bMhgcg9d+z&2i zW+cF};jzhTsp`S%CXg@eBJm$z`YZuxiao?N`Fowo!W1xC0k6uwIE*2dklakG&`)wLSh&m3TtbX>WDdmDKxtIpQc*C zqA*|6K^wg2E4)*)&ou9tTFxRc>&EPE2hNJU8`1UcN4>l4!UPhiF1ND~Z$)3!>nkDH zyA5N*iq9L04=6+sn_d-`l z4?7O&EwosPVT$KSs;icrhPAQ(Zv8_ULF8rTvmX3l&<7N>gtntR%JshxTp>l*NEQ0H z8EyNidQZYPY&VFbQ)M%x%NEq)TeI&WtftMb^vA-c%*$R$ZIBJgOepmiOXF0`%0VWP zzPS3+l~wbzNDMV!TigYz%!-A2Tkjr_cRqlQlpo=#-2M*)m58l{(AKKwWTg?|QPE(+ zVtGDeyR30c&D}Bb@}ui4hrcPju_i(#F?%+ZMRi4fP-PRLs&brSWwSLrV>s1`CztvW zC&bcsZAXvrFrUiTY}?zhVO>G*I(9HDU|AY9U{y{vZt941d^m zxr3`xmP{yODIQQ#X_jBQ3QPxURMP_;$c~u+XhzAE1pECU^Yo=xo_CByXBcL8}4%nmX`LNb8 zMm2i)rD(ta{VlY zg3+N5_c%o)ow$H3cEWpy>vC(?Fo*|C;|zxxjBdMubuF3rH2)vky)!ExpEgd3pE6LV zJ3oBXhJj1kI=FZOr0EQ!r{s1sIa+2*81EKK3aT z76ml~ZhFo6@bL!nw+=*Ygu$wCU~q9x4z3GS?Gt@bjE#udLGWf}qTWWbV+mj0^YVHQ zldLLoSmbf)u^LpXeY0CTfB-tZYy(#;tdV}U=1hA1Z{m;cnS@i|U`5xEW)jnj-v@U> z-|-@viyp#c%#SlYb6fK`+657sll(;dPK53U!+;7s1_TlGaJ$xn6w>(=w&5>{tqJ3M zk{@Ly0nQ^=rr73;#s=+cZ&33AA=Ue=^5dNjB4t+*vm11Hxqolfs)MG0q0b6B@)%4YTV)rv zG3RHnt$iA`=|SziaQ5KJEvw?}eoFdSBetnwg?5|%#xMKHr6RL#yY5fB)6Hq1AI}_1yTI{IuQ%SmpZM>nYm|F#A{8P5uG3MjU&A?7in? z=uHcqPBF2Aa{~D*erTe~JjojT$UAnxc^-p;WiSb&A5|8Q^>#d-7T6mXFWCx(xu29> z&fZmc-W`;Zrfohkf`U+)qpO8?@A8%3fhPU5Gm^d%z|iymGEdd{3UL0VrYWhpcA8*IBm z0t+S-4d@2Y8h69g!;2qG6Rfd`_9+R;VdhQQNX3U){e=Xq#{E^7r6Lem0Eyb>^y;Baeq=ZnRli zF_jgW)mz6m^JV)4=(B`gG%Ekim!28(xc9IQRgS|&DJR;%ET`%$E$gbT3r-ol5FL~y zc2E{-2JSex2g!y_)_1#;y*VVZLn1pQvRfLi_g}QgqTU>E%c|Q*1oX_11~x^hEJzHb zCyV}Nl~JN4=oce5Uv?QOvwx{cl(L}#D3eiGU+c`!I(UmKR~-!bvL&{0?L57D4Vx~q zG!4LSR$QiS3jI4~YO72Dj5^G0w6+-;+4}_L9Fw~PvrGXVSv5NuTzJkvg7r}`6w|)@ z@@{!f-D_bbGfBN^h%u}6VI+3Av)fxrctBFc1E=tU+Js0;xdBy~?gI?WtqSMT{Jwzk zonQ_}a6m^}k4{BR(@+{3-6%63!14t+^zB2_$KBt1s^7l#6Q$>xO8#EOt7k)42^d(o znZVwGRIMF0m1lCL>}G2Yv|UFJcUw;wLyrd@GkjPdtxhU%?MV6!tOqw5+DbrHT`veeC&T9P|@=eZTrH^$I^%Zr$Fvi$nis-fA|^yVdf$F;(-)<+$f zc0eoN0kE>|-z13Hb>Go;@Cj7HPnS??c3At&2#8ix0hf+jM-nB3jJ2qe9?KOTwpV+T z;8sX|-zIVj{jm$v!l`SbA$YAiv|9vvm@a$&16K9m-w#;TfK~N5x9No<$(d8-&x%i@tJ0S!b(?azg;CA#}q^lL_q6_U@JuVLP_D6 zP}-IM5G!m|!Vh4$WSa1HycjLBFn#g5qF+PAklk9s)h%CP@}1CEZfnQ9{7IVj&nNE)pn<*F-c*hqjn6k4y*ZPaRe&n8)MJ773PKI4_#J-VaqWr>&5$MDJ@5 z;12U+&GX~9SM%eZ@tqN#Z?C?pBm23@(Ml2+pn!^{*pZ{UKf4nf2YK2joIY;33xO13 zSYftIfsK{4nBPjX5nS1*w2w9MZ))I^2X9_pNsqS!{wx0!JX3Rh=!z$DJ`FC5T>n4( zBQFhkbm!S+e%VQE+ve)ZN^{ABbHBQBUgEo9|(x@XxLXI zQm%}m9PM{h3gwC@v*5iuTz#qc(gQhNuO5hLI_w~CY(yXhN$Bf-CTq4Q0A+`>)4kSi zc7Gj|&S5>E`U9#zp!!=H+#YQWs^8p;Z;WYR8GQHp1qHuxQt-O(ftCz6EHNY#8KCGw zf{(#*VgIu%{ciCPlJC>8i2*XAYjj0|z(YTh-gO;qv(F_C*&gHVhL3qS%W+u;W0TD& zOkXpvzGNGWobr{bQFJt60WZWn3`y7&f7tpD=)?8<VgeYYRqf|9Cr zJog;hIsnbl%IAT!jzZ}#slp>Q3lmVVK+BPwQsuShxXC&-*jb1Tfm=X_-umg+XZ(KY zv_g?RG_wJHni#6CAhRCwKhYpLf!@^j$vjMry--!D1mstP{k>qGWGFncOi%_!>Pr-# z+~?0O`{>~?B-cD7`-NaPb_8CFZDfH$v8z`_D^xFO3oRV4NvdnQe?*2K_ayk%3H7zU z26%D>UUi5i?_j?V)^4JtQo9CmUW8@&E-zy7p{Dg;mjD;BDwoUN?@GA{RGjp8x4|ZS z?UQ9&;Oy34fr0`WuL0;{DaiCu|JOD%T@kBsq-6&Cawy;=yiJmzX3TM&rl zVE~Q}b_8^t&AM>w-G+*xho5sA0!xZ2c&^FrG^sWY82Y>hmE>S&u78l;&z&0>0*CtR zZjo93P}{*MQ98)K!XCtv>byrdm}EEI1aEnACbP;Fab>93J_6F~TSgnm09bm~X7sD< z)xr;D#c1%bX03V6I_dA4MJb;iDS1>Cd9u7!_7fI1Y~lj~qotz6$}6!U`tY#6Q?UTJ zZr4^T;GL6{yZYb)xLwa`%;?iXiDgE`Y0fJ3Orf2gWagQd**d@?4HF7P@IKnd{6S}$ z*ExnEd?#ILF7+~s>uizUn}%Ucah$$Q;VrMCA3Ztk?-afZv}t;qrk-@i+!OEcggdxA z&ILM@P1561Z&Goc;6}|Vu1#|cCrG1{(Hn3+2#HzpBJ~a1Q|7sZlvODA&5>ue$|$Ks zGDptWJ+C_(C3UaY!+xp7vkXuiP$HFZK$>j~$wa2V!YYDhfV$z`h&NhNI-}J&2b>yp5_Fz& z@p{+HMR^#UXinZ|=w{l;Fzz`cU>L^3Fuu<)?lntbT{WRlVkgXIRX@!0n6Q@^wKVOV z3A;7LeF-wcMES6YuIorSFGw`whJ~7;GMdFT^;US0IfU#+{N~Qd!HpTqKQASM;aZ?K zYUhvot9_dB5ayQ?D`#-S_YZg8_q{&9J)|Dwom zD3Y?)BEnCg*@O&7&)7AUs!?f0+THEQ$d=lcbulkRz1y+QonINkokyF7J+3IPvgR|R zc_qb|o1{BBKV46BSKqW};-`ZlPl7oNqT<7%%CQ44K_vsMJR_3^u8HUuWdgprD152& zg$7NB`$~7c;*{LWyqB{2k^Set{Obcg-Dr7x(0Tsn13o=^z-J%QVD_-PUD52fu{*~V z4i+psFpA^`m%okOCY(X9=0E(XKK$_Z-9tReA9!oqxBS9?miG^z^Cfil4cWe8^^*^b|XFGx+{ri3F=T}>MtKTOOf-_*-e+Ew1sRxhI%*5Ygu>h`ta90?<@DtJ$uD=#PLxM&jRQ z!>8T~$iRL9Sx<&chN12B!N33N-OzUWc>&qbcDl*<`?&9Ir$$#;F7+K7!|uIF=^ech z9Vk3-mcvqq+vc1;z>n5^1nk#K533j2f+_(qs~mS8f!##ZGCPsRCQy6pKgnDKJJw!o zX+~>LvqJlxE&+GNgWiQ&TV4n|?sK=Sm}yR>PC7)gXx=K}x|Sg2@(DK*5r!$Bwe(i4 z+9db`nT}h)h%DD9L~U%=UR@%H7wjy!&6W)%ti$NCC~6q^>mK+$FKF?=$KGeQ!38T? zHYMcYvUJH5>@NDO-ZU00*X|;7J_-)d6;cWbnyvaoVrhcuH)*#h$E#d>nVz4){ zre1NvhG(?X;rbu7j*H3)b}xfDNP-GDce&Jp2lkE%-CPKn&8V~2l&XC{-C?$^dA9Yu z#K$9mJbW9%-8U02L7 ziZ?ZidtICZ1KDPcjd6V*WqRdQ@0kSevE9hddkMPb&%&^w$4&k@ z1q5IQfMztbf0I;f(QJlbDT^J?sp#O>pIN733**U^nDwDSyt*;#eIK(v8H+%Boa=No zi8lpZp9Ifasqq&?u)8HG19V6t;_Q5`?k9A42b{fH;j=#gw~j#(SrMYkb`e?{0_;G; zDs=h#4!FA`9Zg4Fy6qVde{d>;CK1`U>D59n6Lsl5Mgi%qBelV%Fj^-4~7IYA4B(DluHd?&NWI!~vz8fj?X)ls0YOJXxKC?61s0 z4*VSCbUXtHDbL1nJ(l_kn@U7ZgFny-k&Yow_*mJ9FSf4})SJR|Dbb8_qHuTVO)yxy z3|D>BG#v{*I0w1D)Nrn?4F=G4$q2(cey~I0(K8sz zPl+lL2>GK#@1jGLKScRMl>eKG@=yC7<=@?gaSu5l;P_sLq&U&d{6HbVMm5r^tNTjU z|37>0(&V<0rj7m;oH?7S2vV;5#b2C-T#{{dOID4lzFHl|`08H6v!)swxslB;L$?FVFiteB=921Df_e zzHMQhBGz`jYv`NjlJwl%d+oaCMR}LmivizlI!N9{p#VWwJ@VTqCE{HjV3zfGjD33C zI}s^FlW;Q!+#;cZhwr9GEje}O#YHLM0-g0NWMQtRUt$F8%V4JgbMX~i9Z<@^E8Y9@ zVU=KOu*s@DZEv2wfwnGxfh*|;OD%BBXbLH+v3PvjF{$TykFs5%D_)_!2EsI*XgC&N zk<_W4hyi4Us0`?lyQZYLXclW}%5NbsOXfukF*o2^mc9G@>I!spO zP+CD&8jZej?(kT_CuUKQLA=RJJ_zP{Qn)qNFYg>wR!`|4NjgtWgu`>C|M()7U+(W6 zoXRlGw-%d-eV8uIufxODYJQ={-;+$WQUH$VSDzmLXtj_3`VUX9E=4f%$sRCmBQJJv zaihX2xVljfo|#ozt6yJ*L?IFP(|{2#@$~BZD=Nf-d>i&!;-{2Bz`+S!QU8Aa13Dkc zoLvv3P&7pPzx=dfvp-widp};e)ZNMH(Rpxvqnx+@)NLORzAp4;_%1JgT<6kQ;S`;$ zVTz9T?l(nW24AVL&ze}hl2>`GwELmY<0}O{ z{MCoxLZ3ar(o3h%hRoOMMJG>B4o_I);P>hSls)v!=>6*Xd*&w}ec@J^)QHcwo!|Z8dKcE# zIKkp?;hvBYXe`kOH)M-CT5(VTv$lV5;`-Hfd86XSvU{VTCcY{A_|b|(516C_z48|M zRtTOff)`~835^#X_;5pJZ1qn2`Qf>1R&SE%X0wfI^-lZw(b2hg;N77l73=`t+wO+U z*Xq6X^V7XO9lexQa8VZsN4PBXV8Bc8H+FH`H)N((?5D>?IIf)8fVugq$lvKd55Eda z*xVg`k`0-o6}#p%M{dBpzoMMN+EbudhGOK}1pvGvfQ6|#NmKP_n{Quvis*c0FY|cC zv4cMu`oEy^x?Vqcg_E)3FyZT`moL0cP@La;Oh-p4;<#CgaQ}9=tW0ro=3?mfhaTnJ zeJd6F55mpu2N&*5I_w{jKaP_u;ZAXY)u|c^<1=tlh#o~G>fA0yTeRjPwfF7^ zL6~G^5{Oz>l0|ijwLpT&P5}{qqeC)6)@E@Cg&w*X+**G=nL*XixhRfBQUAQkpr0-j zNjs=CrZsiPD}V5Wb?^kUt z%U<*=K>X`i`2YMnpg0lG{GqHsFTP_Ei+ogL zV21U=Y*FV^k7nj=i&8TRv!v{t7-u@*Apy><&txXY>|7g&$cPppm3lQ1uk@0HMpr{t z!3F}eG7%&)O47mOFPWQx<*hawn#WzuXcXwPuSy5!+ka!Z{Wtx^nu%F&KThhDm~D{U z_yg2YniE62qv6A$Z8XbkfJVMIod$YFaCPzD!*rs((CP+E3p-#kJ+07m87;sV_h^b< zG`JTk-+02(X@ln0=cXxP`%YK~X|97{fEj*>QWs;?LM5SwmU0vjLpUR7$AiP961Wl@ zDWjW=s4(p4`9)}3)wW^! z)imclp#*{D0=E& z|9t;ET!+i7y?h<3zsLYh2`EiGP8BI@cn!$#at7Topy>R+ z0K8o!D2B@)rBA6qUwo31;RioxV~k-;PlC6gqoLP9ngC@6!no<-Dq6m6S~lT1K^_s2 zzjhuR+@Rjp(c?rk(7TRC&?iB96YB)gkpmrv zHOLBsI5Mu#99=t{^pD^@fu9$A-%3`wN6l<`<_nMaJObV20{ev_5_^=>pv~_R6*csJ z;qs)I2aO1(Zb^iN8lfUDQ%}g- z10;)Y9mB0*(0)|fb4#C5s_?1)VWs7T-lCZb(cG;hQbmNNm34`WbCmKKt+ye?{dUd( zQqbGRX%ie9_#`O_2fVp@%3fMqnLv+kq}N!QLZcHt>GO+=PEMQ^zwmq5soPwLC}sfI zix4e5p*U80FPkRB2gnXlM$VLeYmR32mMrAqzyIRhwvDhco^2c9>PPr1yEe49+T%7t z>a@@?4!D}&_|5V(p30w8MQC`G#(;#!cHgbh}{_{)R@7O;=31D z*TL0gaJIKMJU->nGgk8=OuX(Y=|nVCCv+i~qe<`0LvXyp3H4fe^lRv)lN$nKf=HZN zqe`ntD{-4#gtDLFx**9Lw^Ny~&?s0>WfPg*dcM^9+rmhR)x-v_&4>@2OW>qVDUUjZ zl&s2XZkO^rZJ;I7t`YRl4qV1UPQgIHr%G#YgJwd;3K4d!N$Z{=bAz96!;%OEeon55 zw+i-sVFl@lpl&Wmf=eP7^k=PeDkIsv5 ztc)LmXNcsU+vT?6<<{$dL{)kf9pS{m2(`WZycV0XmAZGi&umgRZM;m ze4vVELSM}xPPFv)oOgkhGN2qtbOUt+q8x-k4ts?AX0{tG83< z*8e|>_x8?@qVt3EXtY0CSK|C2XkY={9AyVox2yOLviE=FOgj34iLKpt?0kus+Ih)0R4Q_h|_d7p() z3-s_5khO{65aj`5{a0d`N;thbOHqLbs(%DO0Ih_q!ZpT=7ijB~NlkjyZa@Qp(;#?p z_4ElcGcHFt>n^X>zNt*KhC`lT(W)+q z+0M9ZICpyE6Z+i>km7hK+Ul4c@HT0-O`2_!W}j2i?4ZX-EFc0*esJ9X50tZvWVc&3c?6>2!aq3uJyQiD5kf-ZCZ%#8SN}fKX2J*|jQZ{f;;5E9K;sza zNy($=*r5QlL2uoOB*;$#F0^S_GP>&zZF|AU1|UTnCl>plS2OgYCtQWY3+rzj?wuac*YRiv z{X6Yb6pJ2syJS|pWcryWY%Q5(?jAXbaL8%HC6G#m6qO~UsvG&}U;c}^RHLyXeohkS!MH}U`v#(`Zw9;JiS2_vi{4pS zq4wD7E)NR5vb<)VQ?eU(H?NEvs)_;~MYQdS1V}FU65JnjrHpe#aD+NVcyxD!>r=0D^U2}Raoe#i(z@a6%2Xc)PyJBAx#weL zrC+uKmPK(+3F%D1`#pVr1;%>u?Nj}K2Ya;VCKVbsbans!F>P8@vaBZGiZ#y9luN7+h!PEpL3Q_JuN%aePoVK{>bzXz>$mj%x^AU zHIO`8+gY*g^f`~@^~RC;P@5cXDGn@<6S@>+5Hmfe$TLssU_d2mOM(ue2{$lj1Y4fo zeyna-@o7hG%~cd!7BEVhrG7C>1j& zq6ul5OR6L^J@yFoK$So#-{|PL#sj&=j_~e7x6z4*-2nte34`w=D|lBaF~8uxCOilRXb)J#(WI#Fr+i<{#VOnaHv{oOZvs{Qf^Gj;~hF^`lju|}JAXH03Z`{iV5Hvp9 z$x66lPEt~DxztbhE-&KXO1sza=&0RN-XY!cu%}t}S)$1)LbrFRCRnh3hf27qOd~hg z*cM&7&Ak2w{?In_x=!!+sMncSZXal!_;Rc{bP}J+R^(H>!lVkyNv1o0ms_Ek|88B99~5OV4-YwM)&s!e# zK0)7k8aVs9iPRPyLega&g>hj?K~1`y6Zr%@b|}{jrK02~2eh`B{ECzoVL9n=U5^Dv z2x}rQ%iEu0A=UI?>LZ`T7S21+N)PQdBh|Vj@I0X9W8`KoC}{h{W7Z?7TfJMrDJKA4 zK%u`NQ@jhh30?Pc=(`}Q&ND7y43jCQS$_Tf1$Me!vMXM)y)HF0dPo?A-Olvfag3Ih z8rnOQfCf)T-^BNBzUMGUc3u~_ck~s=4Mf`0qAQ2hxS5l*9w#9TbUM5J z8?rwxJq=^#vCkQKD9G|=(hTY2>fWIXKT*E=ScIs%bs_eAbm8$(4-)p%p%XT&E7^P; zd`~xXW0XfrD!0QWDag(AW*+D63^Z+}*<=&!TwGng`R+gQKoxYubq)6XEAI1sDd zgtz~l`3jjjrL)fsO8^CTll6`v`bcjxZRg*`&pW&hPjh;xE)kn=G{0^o+T z@0|xvg75OmiRIqDeen!w#8o*12ny%wA}r~_9-d(DT+bHAhQ|xXJ48ECWrslK-e+e4k~6JLf6NxUKYk^4TPzujgNcLxIf=b_C!Va#bbahWHdTlbk? zQv0npA;|(zlnKPIqFe@-mar6xcJo|Q+6KmYn9Fk)XtJziQals`u zzbO-DAW6PU9cMM!UOGB;kYB%W1ybA)3AJRp;UqYi>z7xQA!taIMrvc|qjzrGI zP*Vd2XM8D2VAb(^pOMQyR+G%s%dDu_5Cu5KXVI=&hPa~ggm9_FIT5$*Pkmfog! zYIx#Z>;ZoWWliK0{$YdjVcN@6J|#?snAsf%fz$csPyhi3i1%e8uGFU>;v>x9zE(h; z&^NDk!^5eQUWZe6uEV=lTc@+Pv%tgCt{Wf-fE6?(-jK+$f8FgvT7sTtna61yZL?O9 zoNQ7x>netJ3pJm#D_P5p!377#FQawH`$bEPsF6l?Yop)~k^Eo`tXSCFqCL?ml!Iz? z9)T&0K}L&Mzk0S5KQ+MIUm9Q@IBf%m2jRi_!FU`+rz#E)_x8qnqr?62+3|67aDH-h z5Fd}#`QG8Wg3QxKkm=U-sl86Rp&ZZp5hG8){R^Vq9U6e-k%}AAcNM6XaQ{l_W1v@u zdj6lk{Ko@64OksfKB-eZzz5ywKOgXEAk6b*Nj)kSuStgi93-`tVo%u=T#Xj@VABea z`!2!mpeA#1+UOP~m=(8-BD@6Wpt}8gWf}a!SplMbj!A8!vu$*?jm|!+=%NH=&DI%@LY4fn& z8|XCk++O<}zo0HdmP~CF>sTM>gDd$YQP4t47{9~xSoTCmsEa<0QIyWutLH~)8^u%p z&%-$sXj`lh-Z`&;(^fB47H6Ma&tb$B}Z|WpgUz#8Fbm`B9Ke|ELhvqanJ)M1;w4-%Q znj4%(e!pvQbw|T%pC;#cwUhJpi_5EE|7dU6+OK;0{3ok@eqX)x9&^yOS2w90+`pYI z+s9AOT!6sAFmfxWLnoPi-(7wGAzs1$L9nn?+qt85pG6LJg@`aACn=-~Z~vaE;r{+Q z4yD&3_(VxXy4Pc!P8Uwe8-eA*w9rM6fK_uRQ(MmT5859yg1bK2473pxs>VfXX{2D& zDWbQ9+5iM}fHwLRWvZM&09rG{lqG@TQ4&DNhtZFE__nme=rSh3pihCwVukg7_%?s# z5wH_4Dd`L;WVbsOres=+n5cahrS$8SH45zA?XEm%A3OL}``EJQyJ{uDkk{KT%C>*Z z5JWwXC_AIys?r7kN;m8e4df%3rNfWh{ic57dAQ(qO1ANaOsK~zs!e z8Nu(y@!hEQ&JB{IsTtnXGg%BRTj`1Vm39hD8)1XA$zAArH1Z~CRp54#nC(Qb#uDYy zXgNXIxllE?uyV7VUM-2`inCX@(wVey404}US~A{{eOh9D#kgjDQP`^8pY;XjD$Qpz zlXL=s%3bJQs#>joF3^$c^{IKu;E&mv(bswsyv>wbJyb*xDjKG4v#}?Ue)sgo2?Xm= z#U0krCWdL2syPwT7cIvd<;{|%$**nAYg_Z$*1R^fhM>>WUe~-FMkL4m2G9;}qW(q| z*Oqh<_dVRqLf}Vf@eIMAK^9wYvh>eGgxLy$vjE*aSNMr-wFd8O*{m4 z+2`7pW0xfeT(zRd#u3^u#KqrBB`n|&0C^5R0!4|aqqD!LoG8)&TwMp_<)LvHiR_tJ zZ<*5vfKoT0zPMy881{vZ2MJUtKrf9N+^{}~J0;lB;my0Sh^ak0`mo!#wXo4RRagtX zX7*{&gv>z>*;w*dgiDo2D7)Z=J$_@HzAicCNmAp)J{>Y+O7Sba88k zH;libSRbCm8U|RWz}!5uP?7G*OsZMK`$^=)E+A*`m_ndLYZ|!Yw3*>$H{W!UBeWh z7nKjXgzQx|$DE!Ns|NO=U2lU5w&Mg7>C%q7O<_Iw_uCZKHigw^PvD@}DJ(e4+n{U_ zy2&!+?`73`A5dX9&zc*gBRLCu=>R^7R6MBRO`O?3byb#Ht*gv#VXOXqJIpsci*?ZJ zELQjN>$h??Ye{mB`XY53XgAB9z@_bwr*1ps`SIcC_$(alt9|Vc9*z$V_C|-HisN`R ziuVqW&cbmtIv%gf2|Nt0{3>H($Vd zp&O3Fo<|8!+&|yrHPN5M9TSDUh`pE^keOP>r9n6F3`*p?d!h$%3g$_;rDEB7ja#qr zv-2AJEW%AV7Q5q#e+GG+yPQf^P_{cGoB&ivf@bKvV7~jthS`X-n~+9l6GbgDCW?p@ z6|)$r6dSn8z-<)-XH@G~QaiPy!shye8 z0J2bJL^K9@fBm1QmoLm=f}~+`++@se4+jeQ%Fy2PlXNVKT3=J`yx}AF&ehrQT0*}y z$%(0ls#dV*sJO*xQP(#v)a_quQ^Zo@^5|<6M!;DNv4=_1jW?n`S4hEd^e$2}!C!+V z)u*wbR*RY5rky&~gAxec-4u3N2(witmjx4q0BguC1PyX5q>hoEBmijxPKP+PEwam& zZE3Y-v_v4;!F>=2=tYDb*=F%9PXMs~j5?^Q8)Slv zyRbNT?N-}P|pv^(Gh=g5i(7sb{4Cm*ol|nc$B3tzZ*i^VpC{ zS}`MqJ4scZr}}^Nj+-eESP6d2@^^Z6@;q)&T5I*+Te5z|&Auy~+ZD52ydGYK<4Uhl zTC0~u4jc+F!jDt43WQ&@YCU1yTZH9o+UXkR%g+;n|JzBW$HpXvtpY@>mdn`krglZ9Aa zao=o$pLrzqjk5j$l>Nd{Uc?XzCs~x%+`o)+f8gq~H#|1|Do&liI?V3tUsw`nB7<38 zqQ9^BMjm-D%MISUlm2vRC;ge%Nq_ice;DUc4O2`!JhY%6z6m`HGNA7pJag}BaxF{u zrM36Yck8v_D|QEK>28RM#(TG2+X5!v7c$I9p~&l~Rz6Du(UnVcitv?F0#^T#WMAV% z`=VJgN>c7sQI;Jgj9}r~zd3_>0voa9qui+`*tPdC{VvICfO+QcjCP0HG%t|2%an)G| z0~xqUKoQGc7pC8UOK_>Hkl(3lIRT}PvL!emmPNW zWQ)pFk(-vBas`bumXtz-R!&$TdqS#$@l0m=Z?Z;RuLuoQ{gvQ** z7_?eHX}P3fLh8%!XGvi<7@{S8b~;P?!+VMA6;$0hJ;!lFPT6{ljBn;nBc_^0~zZ_tLk5ng)N|k-(+s$vqn_sW-Fb~=MQk!woM>Evx0T|19 z4v$N&3$g`$V_^#HE(xg>7P*t(QT6*_l;DaNVQrK=%j4UhNo#@hcBL$CGcZUtQ$$I~ z!fJ5qyqJJ*&`WBKPpmngEp7ikbKAee@c4ND^yK{H>>%7bJvfZQlUT(^Cntx8@yYRt z-VP3q^#86ajd$Qz6L`n>qcJ8>ezcUmYLF0Nsx6!(Xw8(0v&z^OE0JkaotnM!>E#QO zu5KOD=ziMH9-F>}gBUFwh!`F82&A^5od+ReM4M!?e?mU%I`LCDOEQFSMObzhc7`TV zuoOdRI0SPC zevKxBQV~V6n<8C$UfCl#l_R;?vSl)`d96dyMl?=c8~{Gh|k3=eT4J*c2cM_m>j5LeP~5C|m^CU6{07*Y&?Q4_2t9d09& zOj76cGV~;uitbOc$IxrWns+j2=tv7EL};haT2ae$s6zYZF>iPxx&IsspSILnt(a0K zN%IJ5!C-&2&4FPia9U8g?rJELIAhr$CWO*&xl0Sgv^BT4cYjSP&_*$?NB)Jd=!Le<5t z=O>8_TI#k~0V56TAj6Quq_E&PvWX<9J2?E5@6-r?)(@nHV^vF12&P^?@hHi{q@;XU z15Syj+;%;#cs=&JtNuLdtaT-gINJ3d+;s7J>qvKjA*8-b=TlL8T zuzYljsc8>5L4Frp1*+9)3S}eerS_mFX8dD|1#{r|wF zXd>NhnKkWbfNnGcnEly_DXbiyU8_V*XA7u40RXiBQUNGv3idHjl5p_m;$G?Fm!DjH zY4yubzx;!XR*?s$r|lwQ@;~WVE@vvLJW!1i%8{h9ScNUPd|MUSRz*I?sz~oS?_dv1 zYdP&Zc62M)!CH?w)N_YGGlBbQiVQCuk#+=RM8!Zm40-e;{KJ&+3pb!uxB=^>nUF|Q ztAOr;bVQ!I1wIfgU{~#+h64cQl2aM+fOAja$Ou5rWLw)H2;qe`!AC_fMO&8OPw0y! znWWR4qKV$?wZ}%K6o)63pUQ2I@+uv4u*t`WO>Zu>Cl2gA*o2;A2$C>l>Pm0}C|F<* zz~eU#`FI-DNg6Y95bHV4mtGzYpv5sXSiqDL9G>x*DMnY&HJER&UiHl--0*;^=LCL! zvdRhJ!H{o%t|;*~!^kRCM*W%4aS4j0+3LpDbXIISeXe3SbgC|Nxgp72wku_xtT}Bv z(>$&TXX%_JiQcaOnNF;(?E{TC13SNJHn?4mTOiF@z?N-cTiwT(bNnD75}t$nuz@2d zq~P4W$%~S4qOCFXZ7pm#kh%ZFesc1oz1y5A`xls~ArmBDpiq>JVRk+XJH8hzdh@Jn zdERCzmDSmypSL+0BE!KjcI%PDB%9}{o_naLuPcdj6nqVLZt+b8?#&-9siRsX7=%k@ zIrc^YnMu(Itk7!L&?cA6>vUoa&iKecSsIBfFES?Uhw||@VF3jI( z6*REyUT26fNgFHay&mNgAm^20T**qkrQzLgx)e5v37o$Ll&B4E%5hfPE@@N0w=_Xg z7N&+*+zyF2%Ep}zdf!ZT!!uJyz0OPt3>@1i0oas@DM>n>+Sp6(qJR#2Ra7}r2SOT@ zB~A3^8rEZg>!P!X+Pd#yLzHqb67SVp+gh=0^*YmILL0ZOSZLmfqv86^(~IY1bfrY2 zIuvpmknXi54%&Mnr6IewIK2T^g4WoYdTz!r#X3dJV>G)~n4aOARB<{Yl%I$zehGqwS4QV!pd5uz{YL(uUVhj-H(M z*_2FM!#nM+H9+U2{Q+=ZfH4?#WiM4|@E{PwW~JC0|J?@}EnT>a&{(c z-#oj8|17S|94@WQ94`_XSqtI%KbgqLkqq;b6%5W+ETKWd1rS;pS&?f%qh*ue8_>-7 zvO&HRYJ+;FARC7B^eW6k>YkFXH7D+V@&;gjUo86D$r8go+}n3cibq2WW=1Ty6u<6k z#19iXI0DIsF6?xt`E)NlN8M+EM0mXplGJ&_EE*j|-{#Jw*YqozqSJ&%f96LNyCq8Z{EE#I#Ehd6N zzeLSnabcV;vy^v=>pQgG1hSo0h^hft7g?7hJq~`SW4+?3i%yyUWIPT#({k4;kZC*RTQx5sda=h%D$0X3ec`w zeNO^D(t^eOqWqL_(R+(!oHeC;{QdvTVcLt&!-MnF^ZotsbZ`H7G>S&?!QPSDA4TJE zbbcJ4?Cl?g;dniun4^|pM!D3$AM3Dqi~Y{bvyAD9Fa<03nwn@ATecLz-mrxZ_H70z zm=8Ee7bQ>^vzI>!UZk-806gI>F-!4BeckVg$tN=s7-)EI6C!-aDl zKH>|=Ny1Q1X!L|$2JL4K+M6U^5b5ovNoi0uel}GP91^o>>K@S2#4nv>+Q{aR+Qk4t zTT`Jhe+$7QY*PRqA@Ul0l=MCe1b6lJj0jlDZC%rMt#1Eb8Lz?EBR_*9(?V?ucO5>? zbAGStL_hnV@uGDqoWA(dKw`7`LV<1vorMm%#4$$G`gN%kCaD%)XO$-4p~V5X)(3U+jL(och>FR{0}xa-)&t$lrN;rQJjt|{bjoErC-;p5ql z4;FX^5LBqLc?Hikt4u1^Ju>utfno#?st!b!zIn}jkN91^-Ov&Md+^vP{iDB#@B(T(9`XCvj-Gv#Ku=e@|pYC}+?%cJqq7@Y9n0d51mZJ@Ue^ggRVum8;Ri~K()yh6f4 zYNWKpo5t(Wd)RcwUPLi7sw^rSR={kCRS`&yO$aWE*7i zaY*f3C@V8+=QI%dPiSaoPIm3UBHc+~+3)-2<7{+W$5G#j*PG$-bawkU0AN9;UBJpA zvBGt(32W|7r-xY$1FH~#eMTSk5uYZbLev8}p zVB}0ZBFl=4TzWr_5M&6QQwgTveC{fjRmAHF>^c9##v5|4drthaFN865v1ngTkvzfA zx2z&X)Goi8oBJRhl@)5Dqsij#?9sC4=tv@&!L_nL?Q9X;W(q_Ic|-rNSyjayU`h?J z9MCdn1?>|&kY6DiAA5va17u~$Az^mf2r@=8mJMVg52W`=VH6CR=coz-L};P%{5YH z`rMh~!ogi%5z4`HKwVF>QFhd)ANQnI4yTD{`1uGZB7bJJ5FsiPsuO0Y;yhiIbJc_# zVuD#TRKeNf19>4vVU)p0m8jN6{$rU`buR<3jkoi&O}2B#(zt2Cu=~(&Ors(#34;#m z-ft~-)t9a6`r76hBK&7@W%_(sW%_*2uS_2 zc8S7cN$v(Kdx>N>DF(F#ZK*8SCB03|uiA(=r!Wi~zmpDgVlQvkM;!_Su7qZ{D{YI| zUdS7v`T0c_tM@8?_7!$dV6rU#F#+za?$mqRfCoar3hmr86JD@DQGX#jp9o7n7k{{$ zvtw@&+00s~F8;~LW{zc;pG-D$zQ05 zA0Y~+PXP6dch1~U*ra!ZG;Y1v4&IqQ%;>>tXVmZ44@bH7GCSs|3`QS4de+`%U`OAmOzCM1AT!|F*BdpdnN?!vn`f7Ac7uElOo{5nNkIufZwU=U0(dSA+vb4+F5*IS6`t2PkUV6Jgo3e!MZN| zKY#g;bzQoVs9WC?{O88aI{A$ovS`j%yJ-G!0|Ce^)L(){1LT;P!3v%!j^XbyFYTZh z!`?3z{cV3)zzig;h9vB0|734;dVU<8sl(Axc(i|XaC)pxN73Q=xf+koN2mMY{^;H$ zVGm=xJPw}Sew?c`pUt>~N(UT81Tz*@;9GOo22hQ6hPB-ZfrC3qFpt)e8Td^}FrTR) zLmj@_?>OdKEO6!ly@kFil3F4PC#e{B8RyfGgyFbv81>mOnQz)=OzDG!+PG}uGY+}} zZUgrQh(~Q)y`kFD(am6P*@9}OZlBpR=o zA(5^jm+mf+MmH2vk9jTT{CWW;SgM+{LY7-h-`t&TcePQ6A@XVAM`|Rn=HgOVmt|ro z#cU(H*N+}|T#|UOA#v)Ee@WZBGcoWMy$4&m;@#bDnM&y4o}&`_$K%o2nc6!!+dDZv zJva{c_fO)3@kw|Zjn4Ex!^3F*?C@|jS`RSfxSJADHQ%tR+OOuWjqnk76hylMl4+DC zEHvLeQpKW?V{Pr!(gcD!Su9ozU-i2ukU5B33&E<0upL!WN?I6t6JXlEJIDqc!}2VY z`D2~#L;|RwY?J_BA6MDa$LGL<>v1>s69sgy6?fV+rfs0#Q^h4Vgzd)O-rN)hZOgC{ z#y@0C&@cbhA*dB*6UCPB%RgZIwF0jC^Umdg?2tHI7m=E-bnf0}_U2|Y4w)s2nUO#oq;Q3b=*-Gt;>Sf; zRz=O5OJ0}5A3`iZJ&tvO4Oz1=){VvkU+pSK9EA>{a)3{Wx|BxI3gOxe4Vfpjew;;$M?Ty+y8Re4&3fAgjWTq1 zqug3|V{LG0GRZs&9Nc4hOp)UG2e?BaCs&FN(+s_>#EKvS7Ka;>+6&F!rK`oh>=qlj z#YV0X6S2ict`7lo+;c+HRy%V$Cb!V8)YwIYKltO|oL4ZD!e~^Z8??m?~;=Vy?HX6ow+*=yZ zKbr<)ZRTN`Pim3*f)+`lE7uOaB~8+yv5w5NOAT%*unR;a9k6rt)$3Qg1L?Si+lW?~ zLl@kzQ*s$?CDPvHKt~$SQ{>1^Dkpo9WHCgo1!WgRJ`|~;YZP_jZfHTDCz7aC(n{K?c_ZpDt$~B0 zJ&XPERLF5bGr?=!pp#(?1uQfM<0*bnT9bSlN=%!`Rcbpy(3ppT_EhQ9Q8j5Xod~!z z5>~ z^K0!+INCZspWpuP`zE=G-P3qvn`e4oyjzT^$FkUxqS=uP5eUQm@zLlYI*-oPINCpr zPEJ*Hbaob=kM>Uvk4O9ahi6JsPAe~(9RyF^`cg}#jjKxGV*>L1B%!0au~-w)Empfj z?x;xNc8BWfK9dEObZsH<5t5bP6XRN8wjiu2!h%Q#MYcFas~4JV0^V@-&w2xJ3mNSK zSF9T6kh~T6`;MV8mB`BQ!MQx}oYq#muBQoQ_)l5Y>Pc?Y4UEM1TKU_`~MW_H=j^a`lRB%H0(PVd~b4bRtZ7F&7P zU~FYyYpk+TO6%$#=WpDVD*{ucEnZg64X#)Ln>5)=^a+IFmit zpZN#@qsmg5@_^7NzsC==ZVP=nLk+)BFSy9U<2WmiidK+U2V&;B6iA@+OntNX4bOJ= zoEE%Ub2Gp^C8ZiJ6XB*Sf0PZ~aORujr|Ug*<9u7_ST7HP5J!*%qD%yTYe7zbaVp<| zPnJG@k{P=ZZzx4B6wk1!q)$#6abt>2895S@&E%1)!UE!ZIFa-MuQAxS?BOP0v6xoH zKx3NoPP7b)$^sBD)bkpIpq<`BUZGD-CQCn6cQX0dW#>G8ayax4_946I$-TSG9-2Zv zZ1$O%JN`Ba<0!}QB(=EeHtf|!fan4IkY|$=*@uYTzeIbV^gEbUoC*s1PC! z77KO`tlU|5I#h?(c}%5Wr&-5OHdB66A7ZKAA>i*$Hy12q^)K|8EkALtjCW5T~p+l7x$0LmKG+<$8zl zGU-aZ0vMXmJ0V7!pv800IpBOs@nKfwXn91vs)WPLK;W9aVUJWHz=k&Wv7FAfE{I)M zLLNFbt5UXN(^x=<+U-X^?ixC!j$|)f7QhN&1nqOSV4(1NKq~;=U^wq zo)Wt@^{uIbAZ`MTzl0_Wj^Gvzs9^OfP?61x(s&tGrCGj2PAB2H!Jhb+|9co9)sRR#(+sULmZK%_Ll=p zaOkZ%g7kvbnZY{($a0>CpsS?E{31E2nH`_tp zbi@%dTz7VdZnMRoV5ohsk$7G^l=Vu>3ZRC9w3j+3Mxk>4!zP2FC1KY zLQqS$E^VnsiKUc;F1fcgXFfj`bzR$gp4&RuLv9Xo%Z2v*I<==L(BS!T60t z?>~UaPLnuJ)w{4zR96{8-UAWan0v7(z%YhNw+dcdQV?Gxz?Ih#Hk#B%LS?~@a8+89 zSd3CKN!Br88iPfF^Ek<%&Cdyx8|BQ@id6y)7kw8W3l{+|DtSiJW!T^zQl|A$s`!4{ z-sgRA8!nK`XM`$#7&3=AqZBjOurg`n)7!rZ&r1h%cK>J+j(+YkmEk~02nui6i zRLp1r76$0Oc-;hyQZX)}2eZYKX<`+cxdS+4vn`>840s--G*nEPB*dU+yIO+1w60f9 z9WHqkH1|aD_$bK){13jo!^D?@Cvg% z7|AeKlPiv+hDI{RToD&ZIGiE&M2=?*e*|@L*mxCNNv*Az~XkA3*8mOwIGaAM;KJw#6r2S z`w=pxdCQpcU?~2xqaDH9|0b7FemQ7VON;6! zeo_4h=uNc?iozsAhlFokHT9$5!rstj{p)z@Ww-y;CH0pCiW#N1KTl0r$qdLe=%Ak> z^1RKD4Z8h_>(>|8uipkc*U3~3^YQQkv_pnfK9pa)E!FOT^{3DqY2h~2Hob;8_^^d^@X2w76c#*RkVl5pSdi{Yq~gfnW3IP) zaS6CoE(XCem&OUC>wMr%1DK4VPzdKwhVA+GCfkbJgMa_UyKTj7TXE~J7j)F`iW@ip zj1|%6VK}kOt?Z*u>r@A?xYat1nwaVW;&tAo4Xq}NvGFy5Xq723y+Rl`>_GaFAo7?u z@?EA>^g$npQEpH^yQwdNXwfBxWjGd=WPRUAM-e5TW{uOqo@mI5rHTR)csZdZ^v$OF z^vq3)+YOiXc^4;Lryp~Iz?oB9H91p(?Ag-VaP;v}ze{~!Q}mn2hyFkz!B*Q$Uz2dN zm)M`I{eLtlW*+r0L<4b4LPjq`eph7<8}z^k??Tpy3)ooaKmv0ogQR_soQQ3S%&n0a zTIlByO)2aU)7Q)1Esb@ZsBgDG|v}N1+($WTySNd_n9D^hxW37|4a%) zn@<2J{(_s*_P(S)2JpdRyD(S0Fne9vbT)gBk)-spPEmeCeJ#r0|K$=AdElA~biAVf z01FTP9w};k(QB?0!l+m(oHdK$G9EX_z8FOLm*EE_BZi|_FGgE<36T$vPAVQdNCi%C z_wew681q91W=Z_;$|uTzpUj3s&&8?fqBS?&1tSk=nPg!+SIpYWrB#`~X_(Fxj1p&% zlf+RPV*MnqO^(>WMz?ElwQI1?rBd|&@-(R&k&6^Ue&aLQcHcms3b%iYZWPHBlt2*K zj{i-Kr7Vf8KHxLp_M<)>D_jkb=yltO8!2O`&Eyt|Fw66_bnY?W;t75LE+zNIMu8+J z&os%P9S(e21C~fI!WXnZQ`%8^ChKF_<5OE#PL^fa_V*WQ3$H~%=$}km_(X>JsiIwn zdn?up6gg9_*94a)eSTReIAoH?6Y*T(EUj1%kY?$XJ|u&uI{uwxXe1jwLn{`4qZzvR z5T$vhp8YZSO1l^!X!=UK_n-w*23Io`nGj?%CTV|f9g_rz9HaSqjgYlT@J*e>>Pz#Z z-kY#q1p%1elfl6?EAt+6*RlQYH!R))ZXb?6z=Vvh4-$-JWNIJB>0_=P-;=+x!iNwUxpM`=T6>z208*-3*_{U*KrvB zrgC~vTq4{Tl-qqdDXDi(YGHe^pM(qmO|amrRDma|Q2pWcsX(f-LQV9Q3eH~WnCp8)k z3782b@Z)4&rxQaXfQ4Sklj|T!+rwi>P+bbI1BwYGsbxcRXs!_Kou=3|4xfWw?>|%8 zM$g;O6f`)INCz&Ft<(E#a96r<$h~D4_m?ut?z_ijymzRg!}Fuj-toB_9qAMEeD8RC zdKkvzv(ee%d3<(q9EJz$I92p<*)7A^vPf@>d#rQEuhAPIW(_7MN)#lMND2;+4UlYh zd;CO_!L4WXp;-c{1z8<)1+ai9!JQVs!bFTSlRg7IGn^KK9QqgzmPoGT?*AT3KI~0N z7A2(UrHCQ}*04SYakb`p5lzEI%V&!n*kT8^*ny2qom4Jz)=u8Q!f+^K!EzT;L2ECJJRc*^rAgzG3Sz&`>4dumr{4zdKu zRv!JRhdB_@PtuFU;wm(Tpvo`axnB?(9lYPugkAFXeI*eEgvmz4jo{jxG{PZc@{N!K<0@^ zsnG!+5YEMS>eK!SHx(}`#7eO1F%JAGRQ3BI_O`(=j9?iSS-DCJQ>85h1_MOCOvUR{$J`|2ae+@W zkPo=ExyE*cg$?N{;wYaG>o&M^RF|-kmT7R}q+9)O#jofE^~B?ITMs-&wg=RqE2Kz| zxEcLXhsu?aW3IBSc|%@eDx9kb(Jk0pSmsG)78_Ugop{~8_Q$bM`+}on7~?ofQJBXW zX-I2~^DGYWxK0J{))oFVRz03~4Nx6eC?B~D|1mkPZE&&;PPW0xXBC|ETRwr~3Qn0j z0f4J7kyVoakf z$wZyGP6g9x#C5W5M_jeN_8l_pWcW!BA?_xYh+E+*`SRv8mLiN?_$JpD6;{wx)jr9Y z5^|wiYl$6F8Q0tE3rgbal|*)rb+Hg(iTY;bOi8;tg$3{(@V5#DRSmtMgs;fND_EPj z;Y_)~7`x8DCo$BOv)=>Q@VMN?9a6`Z>LSf&2+%B&bFRxw$f16YUklP{L zs*Zr_QZ*$XjIWR6TV9I`*PRoJ;EYxd*L^&h>kUuf^xWY3j&e0NBv@*uO|DrmyeN=~ zm-%;;=m#?wmHD>h7zczlwbewQ>j1hVDE4Zf53uFdTSlr?8{j6<(BQwhqoA4W&J6D# z9Ge!h;fQH_nJmuhbeBoH@?BnwPh{xLZ8Cu&FZy?)j*gxVcN4leTB2D>IA`UrEJPK= z2~yrXv$W@3xA{R;LN*26hLF5)njYwKenL(JMs7kKTM)DPG}JD<{x?xjF@w4`aL)Whan49%0*Oj(E3~v8zkuUpLd3zssz@nyiN!oT~+?IId zA@l|&T`JCq2a3X(==(;kGMS4`NVye=fncV|)#XJf>vE?5rq_>y9YYusg}Qj0LFz8C8H^k_Sgoc8wTiD3SWz)UtSLMcs=NVQW4*FYjw@BL=NcTmGk#>XZuy`y;Ss~vez zbp7{Q`@6I|!#)dpEGm>~m${W1Y)YdI8X97T%CR*l_T0_EXBw>sivh$@o`MQXAL%kS zJXGx~GrrSO?{rI$JsHjm-%QEe(|j_iS=k{cT2T&L41t>L$LcCbC+(vBr~8wX{XaR zc%!0b*Ikn<-u95m=dWL0K}5)sE1PF*%hPeo`4&$7bllOx^i(x*!1sY zkmZJtm5B2?{D@y2@)Jd+z%dn)2Dir%@-|VT0AN`y>dXTGC&J&$M#31=W3-D}vK(OX z(rz^5BR-;P5B3qpv=!GtqytwiEQh-RbLxv583)4Uc}cgDe`C9Y*y)Bk((T6>C0e)@ zQ4jfrGhC9PF9@P%Q+-CFo5hE0(;qYAHKGIC0V#mWjF^nEM=9Yxspuw8-rEPT`oF(L zDzGaP+ku@%uGvo0^*Eu)2Slk#BU;0q2Vq(|^lu__VS%!a-lif$Ky8p|g4GBkwuyym zC^xj!V|`q-`)7#k$~;{Nir(g}wt1^<-fBbryMFV@-Vd$@f3a$zK zV0Pmzq-I^V)z36h2c(ANpN&T*r!wSpI*(;I6qmCaZf$ABw$$siOUstT`|{f097+r7 zbuu28W#weG4rcWyI+KA%tU~orDw0ogaQDf>c3~~uy>m`4A4!8ps6ePa);#ri30jS@ zF0YB60TD}QGLU2gt$leQe7ZCcKJx?N;~{f6VHC_shjj(P$H6!EB#ip4kSI%fN4+2r zQYtwDzO@a_sBI9->&_~{q&I~*$b4z~AW8`?@9c=%h9}$bWE-Ar=&^s?Tt0S$P9)&aH%x>S%h-s#j*ynj0hYGUc94Xwp6=X7%oe3D|y{ov6(Dh_FxPKWRrl184pu7P^d6bYqj{(eE`eaKE{@COx zO(xjrB}&ow+p3+oa90A90R5UNaIQF{m~I=TWwPl=bvUjTO0yTl5(_B|pN6rPuDRL? zR>uP)^cZqmz6_ppUbBSNDf_ml9-_an(n9GQH4O{B=lt^1m)ZufK?^`d*#w)$caYHR z>RmF{8{;>*eq{s0%`^jWszVnfdnp(t2*8xsx0vPAQ2}Ljb4}}Dq~$KY;|vIKg`DfZXV8MhlH?nOoqQ zs_OP*b(4$KdWC*J69QQuhP6xOSp^L%62RpG{T(meBDrcrx{HXn;oE>*Z)xf)&@%TNbMmtC(`4>Dzp9zBaIA@Qs$SFI@eald~vNXU%u`BVs zSN&}Ci_&8-lCsj5t)m18(idvB`{ghnRBUmJoP)w3$GC|=LU42Yaip}Xs_#Y82Dd*? z3W3sFh#n2=QCJ{@DfqS|<-oI{y-Cw&1tg&WiO??$rd-d+1l>pN{IAw+Icsd8_Z$B+ z-w8K485m#iH7k(d-!RvcV1cn9CqAEn@Frh-H`}Fd~0RM6I?Dtkz##^w0TXqKEk?|26j3gSFV8BF=#JSB;x}k%!rtP(#5bZCsY8Gj|H6SGHfwZVy6Le z__TR!HV(N4m&QXk_fKkUSaf1B;RWRBqJ%_<%p^)hR`5l;?EwEw%SX{? z#|w-I-}H*lj`LsTelMFe%VZdP*5{rXLWbfk_=eSywf^$c|JtkvHj9|IE2PXQv}**6 z)()Kv)wkUZdgC6oxwF_eDxRuzx-=ZN1nK@<@G?pFD%{tVXY-aL|IwB`)0-#QvcvVF zEUyf!`Ql9hV1QCEBaV8=vbNVhEMz;E>V1^fP+2t)Z8^m0V3!TSaH_Nq0&dWbn#t9{ zg3lYW7S>w8I~P{h+#J?v4Gddi*`t&xLK_+fbvgVYjD+Qf&mZe&3`9{WgC85;b`c`P zFN54T=t*Z(j3AjNUzI%GTOKzqAH4NdCQBCJ4(s?C@UN=rcr{<-yc~U@5o|5z!cj8w_OCcF+JDkF| z4Ln^!Q}R=ZGRoGTA-=2UA?Vhjn%{&~(ILY1nzu`?$N)AT7=no@VVtB@;rEo0YejB? z5H~puaMJUJ34vLyZ){q{E#PB|=6vw)zj(Jrb8gX`Yk!l!5+rfjYXLGu+ej+nz8kqT z1o?c=K7`F|gD)--9D#drF-Oml>0ZWA9d}9k8pL+I!@oCx%>naFV}HgduOpyJ*T;%w z-b2zF*F|fNWqt(vvi|Q$-#`l+jRXQC?=?o#G4i|2Tdx4U4t9eKATlMn_+?!pBmmJe z_WUk@_tr&g3Z65zeiP-pfk7atlBpuv7y-8B^&IkCfKviBVg`6%{y@hj!cHJQ6E4uc z+3iEXHeKHOQu2+1Q{P)Z7?NAKE z&6KM;{zowQ(?4R)&yNkf;ZGo&Oqop4u8=@_oa%{jKWs=eKroNVA8d5fBJAbfS4-Gy zlawWkXWZn|97WGcq8_0b_neu)qdHB1TR2HuvU3p6 z(Nj4p$&ft8fZ=ogf@1nGZLmbkRtgq9EHUihJSu zS;B(azW$sc6hMJRs zvw?Um)DNmcjv!9fIiN5vZ|5#x+u`H9XSv-pOd(l?%r2Qz5n*}V`63oJMY!G&*+ILp zgL;Z_BV*7c?tDPkM&IVuEdcn&hZVm)Vw!V%IczNj>!ai#o3bciecKJOk0g$0Pa@c9 z`P8bD#+fB@U0&tKwV9bx#jwhU@L%3+vv3X^Qn>HvEs{yZsn`iC0w$Ia3*AQreu{n| zrd6VK#RRO-xGze5d65X9JQYPUeCz7x%awu8m^jO*2FSgLp92tIn2E0xo=mVopLvFT1Sh$FtI!ZpOX`<9H7Zo37 zRgP{FO*CWevDRjXb)z>8um?csUpQY;fX^q6T@OAlEM5XD?zj<@Ew#ICm0|_Mj;m74 zEX*<;e+J$?)jFixAASOhCMevLd z3&@l38S*mxpqG&Wrt=X38#i}6f%9Tmgp5uJ`B!{!e8LgYw}i)rC+hmH;AxUwuB!;f zCPg}_QW_8%S|2IP_zh2Gov^R$NVErFzS@ZIvh!WfV<4d!{qs0UCGKE9&8h!U^%VW5 z3b+OIU-53{_f|oiOMh(hTz19F=24zDytqaP=-d$(!7(mQe{u6n#j7y|9jx96rHFdfOe_Ov-JS#)_9lf4jby9w7>eYedqGc{&PkQ7G6h zn0r94DF3@)vM89rga`T%0GKSLnPMl+^nfKe4by;AQd|36v3>ShQ*?dyIn!Q{sMw}C zB}gA`nA!>9gk|g`o*HG$zM1UZWyqeJ?8)YttXCoT*}LX-iqKPLh+uoR2R#7l>VgEA zfBCQAB8BYnw<=BZ;Fo{UNq+xGG!s__Y!(Q?7O${bJxWc6S`Q+t8I%g1x&DkM@S=q9RqDk zWih(#Verpt^=Cb{dZ^F*%6y@TI5Bc8!Wn*^<$!fm3D6EQG#zjj3aWX{bRd%z*(^zH zQ`mtOBG=aa>~eQNi>Sh_9jfDcy)}bFJTO8Tnool^XfVvUQFlb=TKj^Vw;13*ive0o zNudwUe1O*BuuLXaq+ne*t;68Ty-mjxF1zV^8!9?lC|b>+otQ1KUiYbNMK)~wA~gq7?6QWZ+}8`j%O(zbE9vRg1BL3td@?5U|=kCMu|o} zw$wP~bLbG`#QV04{ovn!@ornj-j=cZ>yGwYcZHPN@)9TOiE8Hrk zsLN|nSjcbVKiI>DT74xG$h29Thsvf2J1Ygzj47WU!XQEyilpcAHNF9p8fWxM9ig{Gi1R7;VX_!U+4El^F-Sm(vBnthNi=lIhR?M6F=Ie{# z@c4Ky7y`uQ%iw88q8xd7F_V4`nRJI$be&|gtDLkIv#a8yo$l}JNxQz`Rl2;^5bPj~ zZ9}H(aP`x5e0p-Er|aGs_2&j;SmnXAG;?K?wj`hU9 zo`dVE-hJsTWSJzI(XWd9o&MhNtFTn@CNA>hwM^cLo;+im7kW05SQXrv1JkxqhsViU zrsz~p5qoB4rk;v&f?lB;GC8NKog4#R#&yPJl}iL!-;1QZBc3^I#xw5U&X>hHNBcI` zp*FB#IGm(8^%vha+<6G^_ETy$dm4Nhd?WW+ZG^G^t6u#lWKvw4_WLV8!4F>c+5h>= zzXwl8B`Eeey^)TBib>QtMDI|Kqo((9Ld>PqfrxCSsv<}bmq8pNuqG{@VZy!rNE~>b z*L32?lq%cMJSoyz5SAcxDzWYLh78<+TOfI;Ji>g{bhy8Pp~Oha6I{U`z`+5PhBsjr z=hNiR^pUcG#?yC%CC25&QE(>_$S9|KIR3tnaqeOekd3AI9GqoTyJ#!fS$obI*SqBj-D3K%Qd};&Y*dh>yk5G@V zA>Lp*RIk%qb`anfx&4b!Vqy;+(Lor7e|aGQS%iBb=g@%5|J-e-$E{LGoL)V>y54vb zY&5v6@d)|ega3#k0&eHdf1mV_!z`bDQ`e!bD=A-L(hI>%cww z#4tbg9sarpf@J8lu46ZKSnsj6qvxZJ%NgXND0x}+Wdg1`Q)(ox7O=g zH2VoQY&n0!%lppjh&Ltsp-GbU)3iIFv8km zyytu)15`+r*q`8rfTS_gqV#@s>5|5}Et-wdeUs-C_z3=`2=6@{Ml_Us0ZaDt|K{~| zJyHYt!?QfXXyTh`n53I-k6$He8sy{Pm44HO-a<sMrdFOw30)-0XD zJ_kflDV!P@4NC8gjjQ0aiEGr2^&`AN@U>{hk_HRDR)@CL(@CNRHjvLDBi09pbSRV< zjRGpBE30JV;!S_|7uKcwiu3nxM)Z?+8XelNOFQ0qVY9^ zOwrp=$I`EmsW!L+P`eVBzkjhyw*(|nG2uuhg47{8$K-Dt56YhR=neCQzy^SuQpj$+ zz_G#JruWQ&{0<00GulSMH>nNh0g|$1wL^zyCSv0a3lbM`rz2_*XKV8?o?d{5afR)k z9+z#a#mLFQY6mq;qdIj0|1bqnv+9N}BO)vE6#6y;8(=jXh)5O)n39;0mbyU#ud8VD z-|}*e%yqqCQQm}o@Ksm}1q+nI2JpWZ`ae({(?2}Bgn?gOzy0ouMfBgBWgCvv%A-|? z8h6EnKHPU{g($?%?=Jey#Z{rt;PseBrpI|TU$X`!9D>G|qmDW1yjSQ8bdRf{7~y}A zj+tC^ZXpHW#|PkNa9(m?LYCb%EmK5H z!D5zA^<-lOBv#Ds3;lXfox@}&w4<>Ol-bhtk&T+QbO@n?h8M5_oedc_|Gfz1uQ-nu zJio?Qbq&Q@BL8nxK77Z@4rbsc%z|kW6*-T1fLQ}Lm@(4lgt2zJZvT!|cKO+S%IOX$ zYjViI0atoKb0#~^(U9m~@$JWHSTvNnNJ|$k2d=xyDDnfskM|-qqpAo*2?8LLCL&_{ zbzmXJ9ty1W%XR{EC?5jID@6LfBsUgxWlgdMYhVo-RGc=*`YVhF^u_Z+Dw_C`SwF!! zd2AaI1U3-iV1F`we&bDBTSz&)g1pfcHTPwcbvcfIyt*Q<@%uJyOzQiMR zvhhS@_k&T72&ieX6jK-Lb-B5-dgI^Yhloz?d7@ZDfpO&oiQ%Nl+Hy+IUP?qzh=KSpbvlVIgbPT5 zHtCh#iBMkG%Ou=0zf7h8X$J4w52y=Pb!fmb8u~7DdbpKZ_9Zwb6IM)1H-ZtFIF4~R z<6Lptl7(@iPS8K64cg=3Z|o)WBn;j@yWD*eJR?>K-Uh+|0Ho*pN2e5>Vq4Gtlf#WS zAsq;Z2`B0Rx;I~QnDLC#$U=&gLenl3Ib1;#ta>uN0gj2}&0$rKN~9`_MTx>e8~W)z z2e0GcL7=9}<iGzmhVPRpBx&`W=4owH>HM^7w1L}y zYr#>_v5T!SI`3eT=A$r0SC3&BAnrirBl9ZpJ;n5Z=E)vvWTEyXP&U!ei9#HMUx#h2 z1oo2jPV@WcwzTJ*b!RU=_~WaWYjYX@_?%9n>kl(!nv&t>`lcQRgLN@K#?+FH@ICbG zv~v-KDJK7ulGq3JDNttyMvQcZqG<$h;xsG(>SH^rfrhY7sJub4>kH|bH~rn-{u>p6 zYz}T5BKu5Bm9itPn&C)osI zRk{NfivUF~mtaOf!!eb^+HXQn?ZsK}%W2)VT=ZgPve_^PoAyg;Q@!u#ueT4n=@#|e z6%=nKh1Z@(*|~oH9O_YTGhf-9ng0`JVoLNO3GOQeg>WFW15FV;C#Dg82%>9hOP1*a zEE7mHbveW&qK?s-Y&RSKZcT4w6P3MKDa&)vKUK29$?rT)@yiN91Pwr-OWf(!J9PXp z$)kjRd52Dgh_f^`0O5uvW>H?y0`07uZbo0bikrBT>Lmz3#725@ZP|;fH(%5He9AmS zE|nmO9dP|53#ARA_VL0g98ucIU{J316n@ANk?TQVL}Q!u-^hhP)=UHY>om0_Qu;E6$?VU92c6ebRe6>6&9{}Z3SK-zH}FI7I!lvmZCHk{ zUp#x=?vOz&OxcaEXyhRqa)Qw8gbqUGiRg7*X`pXY@yVfAx(mlemLY;*Vd*{9A;}o= zId0N^=lb#$%LOym*59JvUVTN`_f5A4DQr@5u}J2&LIOwnD0FKWQ(T z-#`2MfOixNW2v(wP6~<>G7uQT1|=Pv2snaeYT*FmoEbbpGxet5HN&6*4`p!UtT4&a zFK7Z@G01uHU36IajM1+}2(R?V!xR8{&{?OaY-ae=pwrGE*7a5ru@~fzd_iL$4*B-4 z7SQLvh8rMyOOpw*YBGBjj0n<%bqZ@qVJfiH4#1D_T$~Feam?Dk7|OjD$wco8n{U~0 zCg_La&L;zRTbJ3sh}o-YXK?s{;=w2j){R>sPOx)vb-8PcH7=nQ=5}-_#xXpcvU2jF zyMw3Xf}J&&2Cz1I`LlY{ODA`2f%nxtU%dyrM2mS6T=8pD-7VGn&CNp-H(AUcDMBoL z=iz7j%D)j@3%~O$pN`-eXL_3Bd}z1fmQo|NbgeyZ))w*RyKgvjp4@-521bH?Yl(JR zz*~luo+>;b(6nq-2iCpoCIK~~D+}D!-nei)OQx;V`w~3R#v6{qmFS5xv!8$aajqxF z@-nU+UAA-e;`u9t{F)r9>EV`v>d}PQ7akkkQo-dm=pU0T!u_S`u3~KfQVKe<0kk0V zOoq07-t0Y%FIr^{Ws|oOk74g*Vq1}YG`pGKKRE@IyqG}5|5d0x)L>iHibQ|d%fW%i6S$geRfgStnH?KDS zMOYR-U6jKLTI8P?VFL7EUr8}Las`POMP$hJU z=J^Ln7^!Sn;md^@CGrUPU7=317B%{l+!{mVplXR_E=0~i)f@b5xD@0MZ^G$}^8$(hh{Q|GMO81DnMukdLLvcWBn!s*0eS|xt98X1yD5+ydC;A4QAv3sn}RP z32N7%+XUM$Hfg45ILe_+J1#LZqwP$4QB}?P7VT#nC_?B%vOH&r)5w3wi!=`Y00#93 zHQMx7{=%v3|r^>cK z&S29=ge$hrAeon5-a}}8CUkWQMAM(y3tKNnDX%~E!oTt%pRNDd(DoogZkm`>5-~i7 zx}%d%6)5y5)NWoDKjDp1dw_U+=!l5|HAdz#f_gw;DHJ85@`HXlEHyN+5d1-D+Rezd ztWDy&>pP#5LGz-oGYUS}cIv!+`{EhxK5sK_<<6V16d8+nij;$MjU^^#C4+9+_%{Kp zCIV5=p3@CTS_l+uZ2|6^uV45DWnnhtGQSRq0IOCP=Gd1}I?}k(1M7PZ15(S;$BXTD zSoVmY=L-Z-U;TbvukYoO*OxAReeM|jSJ`fVz3-c(XN8>F4^Z`EXTNMf06wetOj#d- zOO#2qHizwxS6BR|zYmK9ON~v*sgBVE)XKy#90z^uI{454UqBvmMyNvOlbnX>TqW9j z&&-kPxqt>$s|*nN_U8#9N?ba)&!cVW#a;9v>w57>N`f5=mV6A06p5SYvMeUB08QZw zAw4sNuyP_Yl|KM#7@7mqBuq+HjbfCSA-0&A4yg_iYs!cNR6dy(NUavT%p@=ng0ZWL zuSY$+26tyaOXR*68(;BwVVe1_{&j6YbA9OqiWt|1syJ@;5#sV~P>%2>QFNe1lQbuE zD77`XTqpj50G0$}_VLKcI z2g*+o166_ZS0||LzahfHlFXLl2HfXG~ww#>dUS>qx7uaYa*uo@4;w51hCvW+kA%IdQSr6UV^eISK{8c*3*EC zdK7p8WhvPnVM}})L)rQyBS^QPNv5}dn_|R=S8jr^-F#f8+|7eHO?+ZzJ&Xc8zn__i zhj&8mDDqnnI4sm#9dfF4C02=(HLvBianb69v`OmEW(ll6>HhpZ{EX=f-iW;r!#mrc)t51vgqP{0_ea>-kY9O6k{JD_TPL+fH);3QxV7;O9mC_3JfBJU zRB{fgq`=D|@xwQr$`#yNxcLV9r}j--x$=#FQ$Rdmv}=^x2e^J9!b=~BAYw=cXyoXl z$(pq}XmGV&P^;p`=aycDDWECWG}FTXGb7-o5wWF74tZc7rYeDyu+M-suyyegH#d{x z2k1Pwslv0!v~}o181z{a>#VO$zim+H3 z8c3DP-q7tD({6CM@!*qggR>FZ+6?aPB3pB!Ly>oAg@v}#0of5kdok)%{P$M(k#h^M zK5XU$^3Kqc{UBQ~86C568C3>4>1yLka`b`aS0Njh*-2qRGs+DSG;8AXSfNhXCt zh@_qt33?qVUp|3avXD;{YE`45L8*&;47kXE|%c0Dvy$w8uVK}i8CXx0< zJdDjeDIr$j%A%Akb&yp;fMg`6-HzRodEk*)oNj_8OvsLqh%{z26T;bm3IaMoL^Iz! z+8w3%C&BmHC-~*3FF)Z`W4}+DWIqPQmr4Bp{7dm7K0Mm{m!_E(o>_k@U;3AO8SPC~ z&B`yo_~PBWcTe(nVL5xEXXlINN;D(6>k&474PRdpLlA*!wISc=;A4HsqE}4%)W)As zm<8kc|J!@F-bQw8P4KS})j-3EmTcWE?}KVUmYvRvo$0c?Gk2YbDNqrVL^~AJCL?4! zpX#-r`>BD`jXjMX%+4O5pU%UaIsH_|`6Km9hKpo`LQ+^6c2ZJEsj5PytV@twTwGlD zk3Ig&WF}C?r_;oGmCgGSd%jnjPr74Bi@{NVb$v#bq;s`pOZ7B^ONB9B87)o%(QMD=n|H_(9gdOUVg zPh8O9G&l&_dkPU{<5N$rFZjt0y)N1(jO(dS`_4Z7roW5Ai7 zn1_@YE{(d98dN`J9h+90D$NpheDXWc9_jtW#-93Q$huPMZoC6kNfm;w2=O7!m+eb44FdC=iF`@>Z}q_yt>$nTRehzYRxAZ*c`V`BB$`DCN;O8z+tO z=XT3@mlMsMv=hfCZ6GKn}F_dQYw6bV1Ac8uwqmzm7?IQ?dVROe3h zXVPpbS?FWu?W+O=sDj6T4m56*DaDUlU~2d$)iXeQYFH?WHy9=#70(zLy!)s{nEZ1p zb#l|W>00@M*yI0Fx$bmnUe#HHBY<(^_^?KDz(WWLrUN<5H)b#xxegDZZ=32D8kMN4 zd^pI_i=SfvWFlaPE!Z?klLuc?EG6QxBC)V{((0J(cvXkQ;_?4hm|Lc5BG9e% zOag{hVuk6)7v-6c7oyFk=4*l?!Bm;g6kO59Z?4qkimX?ZGSRt30Yia#BNR)!->*Nm zuRs2*vLI<-Ag>lT&M;=-RLa|2hBA&K{u2i@;RS$yg;K%5q&O+K0^N69!>TBppg>0! zrwwc}huD!sfTMmgK|Nvky6KOK8oLmU0E10sKR{CJ2gPNqGi=9o-w4&n0UAkA-(iE~ z4W$;g4UDLATV3?gC)&oil-k-I;^L&6 zW=dig-17>Qn0y~7@#gOg6xD)NWJH;Z%)^!TX_gy|nH6`RaqgO_~72C7rmP z>z_X)<~OP8MetLT>SboE+uxGtj@R3@JbUDyp7HGwrd$K@(C1*2{r#{1bxG6L@Ip|l zPiEi>qb5Wm-G|X^)Hgn;2a$nc2;zBJd_6RB=#xtSo%KoRL}>_6Y&s=X3{4du2@_C? zWJ)4oTB+bm6e1uariA_s*i;WYFiR4-exfPLDVa_a6NE*catHi4666WDWvzL%>5Tdb zbm>W8F)AEg($*GH8%qs7MyfH@3G?GmW&426-=nGt)m&x9ZV&mXsn&ry77%(%+>4)QAZ-m4 zc4Bma_F^Y&j{|Zfal9=f<Qdfro5^jl!-eIDQd{aN149YWAsNrvd}v+vJ7d2)mP+W?g5a7TCs|~AkKYjN zQomnL+vF!m+EN3dHGxd<*X$I7w#jPcL4P*Z6Xx(ZE%bgUxr zst#NUJt*iDp-^f~+!KF-3TwJ-Cu}EifL%5UqJX}Rh^Q2i*+Q$?-J05wT4S;!W|GAb z2c*f79I)t;qNhrsvTjV}8HBksM45~?bvxS?9+j61kEiOR)Lve*5h|CWnn7f}#;vlP z8n;P(+uhw=ainKo4A`hBMaH6v@nlsnQb3bU|c zpchu`!@@RlpX5nV@Ovc6mlXE*r?$%d8AS^!I%Yu|xi1~o3ly|!3nGOIUf}{1cLTCY zJOufO7q9H^R(+MbCGc>#nfs#?kKvw$&cI8$aLSd&N_RsosyNV#%CawMI%i{%&RIK} zXgI%+MziVmu;bJY%Wi|Xl~NCv-MT}Ls)vcm&U&1k9 z7&>$b4HcTpIs1~saUcdn5}0s^vrmM3=q`j)QL!7y{q zo^Q^ki2r(Zq4=-Qi+@v)5ENY^in_pQHJ+}hZ*;PwzSNSlT79 zQbRsw3)U+JYF#ho$ofK#Je=o9D5@!%JkR3N*-)48n5@zzFkXFWCb0a2dqgbF{H@kk zZ2m?Idd4l6#&CxVqb{{X)CHiwGKX27!(1)(WSiFNqR~!>MiMHRATuQPf(Ljyv|=fu zV)t}3te+04F#r&SKxZ@S?X&efV@PlYY%T)U8@59C0 z>#I{Fe>YSZIr!EGQFSVxPfV?g<()aS?7N8#_B*maq|lA*8yygHxCxi-w-XgQ(wc?b zmC$#nXa8&*Ew2gX$f1#@ETV;M=#HG=0MBm=+B<=KlyP;xvR_75&<$L7r4Y(En(DkD zgeoS!1cYdfE^m7)8%yjb`s7wdjf2F2B-39cIsP)P7AwW_{>bfZ-ZsZUqfqZH=k$L~XyceeI73JEd z9aJwf&Kk8D<1G2vB2PiB)|^Y1bBZyG6=&;wmzX@)hUB@4GBrE$s;s_qXkCRzpqVN- zgLYyb8pvRbrCC>WiTC(h6l$fqd8j51uix()isq`_*G#4*)y0a3?xT|lQgzCC^& zMAf<^PFd4Q%}HvghVb$U#8+6!eFGw?EXxS`*_7DN_771xfKX~pRk5V*A2*a=RJ~JB zTiK(U4NL>36s(y9ezmJW(mXE)2$rN%K)I$0sGwVU#26v!VanbW2}}yz|D7uXJHk_1 zyay|Yn@-Up#s!s+jM^jVlvvKXla%IUur~?kI?KyXrBA+C{vKMFzvt74wBI3clTwvN z$SDz}5gccSwz6sA2o zhTiP6joTw6-5C&Q1>!~Z;-bDMYCZt|L0yIULK3(gfGgNTd5F1D? zkX}=&SR!tvT5HzIHFp_-thYW~KhWVr0nbK_y>%axH5oqoP({e@Pip@OZC-UKS&~GH z`is&jN=f!zOf2-NT;9*n4%kXsr3fYfdCJhzJ#Uqop!#~V&}blzx;$qmTZr(Ub$6u% zaH0-5YFtFq;Ts?{b*hg1REcmn2BD|m-n4BcWwPm!T0oj^j8pRnDHpI8%0Kqer9pBq zhD;SOYk{!p@_=4@ju-M24Q0~pRm5!t)Uy-qDx+dsmN9vb*^DhXi=G>yOT)8b0@!d0h>apI&yYXYES|jRZKeI8!7@3lp>^A{`Wwmj5z?S zLp;5B-6~cj3zg-vf>2)d)~}7D7s=LCf0yM91Z|&R$o&OuLVr?EIJ24cl>f#?KbO;irYPG9yPno!*Z=z zYSdlQXjHmor&no~aHCOgF5}{qlyQ`n^D87_c-n{MY6vYnlxLKuxLa1|Iuu5z-p_#$ zdsy2~GhU)eck8*EOanNpL*oarLF>qC1)3SjbF?RKEG4ns?`g-7%Gs6!&L7@NS>3rr z%~GjYKSTyiuDpOz7q6j!M*D~5*)p+cXM?V1{xOs4dQ+3X2KpK1l%IW;?+0>ZmAJ%! z&F?1CLwPymvp{IMMqa={-j?QzBye{H3tT!DMDDo?k10j}6f1O34!s;IijWiL3R^w$1nm zux5OkuX(+e&tN>Mn?f^4X~O4fmTjq0cBSRwd4Nzj+c#%wb_bKwwU(*=doTEhKS~Lm zEBaNgPflC8n$bD>BPy3FwI!Lo&-v~Lm`WpG8+MyUo^?;ErwLW8RI2Mee`&hbq2-LQ za=G$N17LkyQO)Inu9RxcoE+#%&d$zl8hO?|sh%cOu~M(+@IYHm{VP}Ih@Yba-8$_Q zQ)amKBV8>WR+e;3pM9k3ja-rEHjO;%o>Wg0s#tC2@s75f*;ziy^Bt{@^!yChexwf@ zGuFxaj&!w|zgv2aJnNoRPZO$GFVA`Ua&V+Ar~IY}`J5f;yj?@elCD=9c{$VddBbV# zXL_DK>z-9lQ|do_^F+fx+7WLx?tYq#xF!?sY=>Lxu`}LUD$7(Fv-15;oU4%he$r_b z(CgPHZwlz*PoFk!HN7d9EVyGKH9@t+?WEcK`Cg5qT(=_OyH$I1+E%-C>gs>mSvSj4 zi1CUHF_&|JsW?*!J0cv7n1HU$3b5G;eZ;s+eT{;m;5bz;ZeKMzht#>h{q_$?P-qJl z5HI;{@9`@RR2Q~ogquI*U?EzRo%_jUAy!(L-m#efqdq$r$cOE2~v*&DvA6T&L z(C@S7B*kwK&NbOwqVe|h3{!11xvNlpHEa)X{G-KY+JQ^P2V5TT+;QkR^}~Bq+iy;* z*3T2+sg|zg-p6~)3HDK?RBpUlVDT=VH>CXav8g_Ya-4L66aCmJpqB4SEyGpGrAnPq zd0mraDUAz0@)$LFz?UC8Z+`(uW0g!HFDpgPeRK@(z#F!SYB_`Q>UI0DUOif+3*p%u zs)2bFo=4A0h&!{ZmnxdSa?FdcA{$z@E%6G zk^4Yigka%gFDi!`K`Jd*NKEp~I00DXiA5r5CaN~@b8WA8C&k`L0q=VI`l@(xb$qr4 zI;Y+T%gNw|1n#5K+~(y!%rTFJ0Gf!ZI=(q?R9s6`df-+O3|mB;mr_$yQ}OdAh{T5Nllzm@g#5(-`Y`SSWN zS0B#)(mFr;c=h)B&Bcq!v{RLqcmce*Xtj6J-@q0pksq3|z8Kq6~zDK(bs_a+l zbEzXs^0e6|i)EaMA$C4?P`R|9l1!5;dn)OeU`_zw4$0_m1njLUlqtCCOg9QL3aL=t z5tTP%#+hLpHU-q@kN@2vQEL}4Y)m&r=u9Y;^&$4iKDvZ-0@J9lfE4=lWixF-okT!LWQIGjf)PrMyodMv$f%quiV6~38Qxwr1&0?h% zdO*d>19G7yneLu}qxO8JhmuZ6NwoXOocPgPh-Pw>fLBa3NdY_^XF#Dd6>!`#@;{Qb zy3o&JGFs}&ewZ{6{3Kme1D@&%8t|Mio<_`@rjdf*(P%ac4gvK)}Udfi6N+G>** zw}&;>Rc*b~RyTq(*3epG#~IqelwZzRQd_iW@O4vuE;g1Q$^+riUiIX(b0Gh(wS*Yu zZWF#awYNL&Uk~B0+DmAAvZMPqr*`bIyB-yT9r4$phV8h1J%pE+?2k-$_(umH(}Uu* zNl+XTBWAQ*fp`Ma9zCx+Gm-LA(RQ83U|ax#S{QTn1`tJ|~EXZaMarSSX?@>V#M=@6u+td_=b&!gPfKw+eD4QRZOI|U#BHG80 zu6#bJArs3zos)n#)#jpH@OAINsvIrr=KS`K^V2!sa`nSB=eKv9zkbd?p4)}B(*47t z3v!j5Z@CU;n)6p$LvJtgwOyRwz9{AkxnL<$Kb7`tSlj}a*H*FBY5O==Otln&x?`#p z%c|EqrrI%;?dxX8R6C}!E~&1sc1*RUOa=cep*lJ0YHuIJp&ZS^8c@JB3w5~5MA4#X zqzZ*ig~*ZtG_jB552vf6p$H!0R!Cal$bbCm$Oo#5b_m-E!5lgPw+;P7u`9Z0wUbrc zs`z@WdhJ7bZZxxfbn2u2<5wR-n_dCRvy%^*F68#;uc2-!=wSr)kOP?6-~OM!{npko zL5@^CKa5HE-+ueszoNY%mTz32cTjo1VircA@qh66&%xYdpn_aK!UP%BLtgEp4wW;L z-}VUvZKEmmF*IhQ1+|`tNFPqo$;Y?X=(5$B2}ACqbBqKDJ(3JVBKG(%@PK4kQ$VdVfTHaJE|z~3>6`6)KHfO zVj4tzAGL`?HGYQB(R)b}sKHm=D?E*>(T7+VYV23`kL1%RQg2D-l3PM01k3T9EXeooetr}SqHyd zcM9m2(_i4-^Q+G~^)3bjXlkA^c@=(0vk}A~iFC*heJ|9KT z|0bi_%JNaoVjMgYp{KWFPthDnK1*!fD|0y#UCHkxKzt(ZoMIi7{lNm$O=Ie}8uSMG zpg^+7%-D`T^u@>DiqPX`{wuGh`q;pL4)&=SlG#kDnMNH2gnQIiaz_d!H4&JV&Z zYT|;0155)*;feS`FBQ%*EXJfX!Jj}+IjT-Hy9xX7p$~mnDEwR$pf!$O`j|aTJwgy) z?TkhvfcF*30S@nz4}jmxyFn1@&jFfEQ*bdUp3}pnO-96*E0j{#P=pRgj05kh6f!Dr zd@07|4}3_N0?iBni9mM02ha(AFTrC4CCsJ5DJ5nk5HTQ`>DJV*3@FeXL*ua-MkuQF zu_8Q>8xEq}3+M5x3xmxu)WP)0FF?a$sJu#*?TO&!|0YVx4-_-A?mtUbD_TDsWqt9R3eDb>Oxnw?opJA zn=vJ2&H{^6jeR5n=G=nHrY^$~haA0_`BrfDR6j0Aq;o)O=nXM_ zH&^u7vs4^zimioYXj>?_XJ>iwkM>QKrB0}GUK-zCgtqU~g%ei2+vj#ma znV&f$*o}grlVPxl$7rECW5w$lcjB<|tty$3@)lKVR;cBj?PqB(JvV>;MXgDdk6(r$2u>{ct^3 zLm`yc&cViPOE|4!w^9KqcPqeeN(DqJD*AKf57m!znG?d@qHIJ}lmRNbKQ>0*oONtG zGDd~Z?wDvSbWAiSj)|#iq=Ykk8BU7!6O}8ga#%e6)oc}bh>UA>$}1HbuapMWjRA?G z-~pM99vHh+e@QE(fr=nV?Q`O!0$VcnT*rP$OilFeP6yKW4JJXRmeosxarW z%Jy4bP!;1VsknuDDIeN8d9{lApJ~Hc+aEJJb`+lA$z{O=C*H(;bP8>SwG&~2PADyg zuC!eFB6>uRfTKPishNDNXr-(@@TK!mn}G8{7Wpd(j;w-qGf^6t?_7{ZISC~5-7p3H zJ7G6v)hU}>iYAQ@tt>3L4_&G;s$xvHDXTknwh2S^WSqiCF9X{4@hUvfT1nt?nn(La(KIiJ~HLsbdot zo%+h$2m2!Kd5`v_K3!gf+P-6@Z?IBc`Z4ZUX&YE+359k$Uiz_k$q=*%L@r*mmQczY z&11I-PfiVxveX6;y&K!R3Eyst3;#^FElb7@nlrJ3^IEiHYl=Uwfb*pf{;(`Of_^L%ou<>r7E*8r3KmF~+fu*TUE+v9Tzm&_R zQuPSqDrr<34N^TkJginL-G*Cpo7F=i->)B4Ylq7SCZ%nBlxr+f!*o&XB)nf0gPaqj zau^|fQ0Ev;B~4H7Okx?6>}j!hNi*R>kyv8^1;i6NYZdl8%2E@^4~LNRy_8y>_~=?p zYtKL=2Jr=7Clbq(7pUZPq2d<~B&Xjahk24}I6ix1R^Np3OxRXD)rjm zep6K^Bb9{g2ho--;AFYsVXvn$8p$^sSH`j=k+PbQ1yP!`(Qkl;#$<86G98E`l8JS$^2ea%f*;7&S}9Ie35_ zqpe4vRhvsdYS;<19iL4LwA`@SPM~cyqgC^gxv&#xTg_*np&jIg)pkN{yP0jrXgfw* z1*5$`%?+pRZqIGyv*UB%vjvX6RkE4o^mM(ppOB!?kAxSH7-CPo=s{u^7U<$+F6ny5 zgKOf!?v4j{Jh)yStmcCSE#r3Rr6C3x4xtXy8SW!v!XNGigwF-Vb{x1K)1tC-%&m>l zR-eqiXf_{6l!&FXF(8v9Jx^_t3{-$rpr==n2M$-BnjM$#xO|(ryqX_D{^MEhI|g5Y z7%%68yKDAqm8<2$MdEugX`WM(K!Rs{dG^7n)Uezk4XDv5AMGx)ANZ`dui9u&x9#$n z-w#R1=jt4nWRI<3wLc2N(Zxwlw38+DnkZK*r5sDFABV+q(axk+vRoT(SZq%J`Egkc z{&}iiRux1ZBtM(3iLEBeB`cM~O1W2WmJh2va@43bj;cpT?orRF5T|$8JuJyjdX1Hr zOHMk~yQ*`#hQ5*4yI5H%ttuJ{{di`k^iG(T`BQT$=n|pSN~_1OE=_6FIjQggh>hv; zxWvyrRh1S5k6(R&ywME}quMy=4c}wjA*jnkU2g?%xw?+PSM6H~bo%V8N?%{0Ex5GT zqfY1rY9YwMp8P}g9p&<=sU+VO8CiS(;BM23jHJ4pD}6t&MMWTEG-#DToctQn)ra>N z`VVs6%@OlH^DETNhyHS8Uw=6&m*(<{a-_cm=#QxU6B?qw|EK>8)eg(08rrKh&;>ny zRX`*7@EML1cvvNRSox?{Z=k*M(Tg7jPpQU_t5ljz`MAoHk6Sk>bKG)9EUD4V3(i>C zvXfl3JUlAr*>N_~XY7OGn3E5PgplcC(LrBwS``X;8ZQPTs+c9c$d;VxMSQ!9cMs>c}{3?*yF$Io1{GF zsoL@K6DsYoRQ@YPaGMwNRFYe^oGzF|r72ezg;^KVtMCkwn<=*RBc@6~TNQ4)yr|2l zTq=}GyEFU3Gn8t^~xoPvFO^>iG6SnAqBB7G{(qnr??BAv&B|tx_Si=3$Mvy%NFo!?H^%PPO7z zYloG}QLRxXWj9jzS8azS4xF^Z7pI;62sYU+1#)MrWt`V81@gP*w@ZQCr9kddAeTM0 zT?*tn8Dp0Mx&0?>mo~O$<8>F%-ldK0(#CdYcGJ%6E^Ta=Hnuyln{;9~KW!|{mHjl_ zxJs3J+Ra_5Pu$$Y$FC0dsTdLgc~s5-`+X88Q7t2X>S8jYLOYEHjeXlGWLY$YWuuTg za<^B7LXM|UfC+f{fh1@Yc0GkP3*h99XMm1Z5?wT6aM$83xnD-uq7$RXzCZnCRlE4J z24{8@|4e|V;jePJf)p|^3(?361v>fo_Sz&j_T^B1Kus%;fQ1^pRvw37z}%-;v!HR| zY4-Kpx`mCNSZ%Hz9Ad|Mb`oHv7AQuH2b0ViXCRr6tFjk7CJwsl zw2GJS+ns+`M&t7S5;7p8nXY@AJ}^I5Z1bE{FRNu$A0PikDe+0&-RSD_1@i;+(>JXf zKOE{8)Ej%Ta%@Nh6E~Yn(z&o2gt&v#Td+PVULki`F^vbn%^8a3UX2t@E_q{`Oid+1=Nw z@w3muF#*!kiIYURQ$Cz(oA|QTF@=PLD+^uQJMxD-<|Gc$8BZe_L@ciMSan>Y{qoP{Is5o^tSpf&SlcoEO^NHaFTs>B+URGYQV z-1%{#w1_X287ClIKWSdWnWgL_7{sSz0&;KKYpF&8KRgG&rFIx%EgR8{@IiZnAQ*|C z4h|f_oqc(a1^azAK9CorI1r-)`L%<3;{YG<>VdrGu=lE+)EQnxiV9qeOLh1 z2b`nj0+M_ zsQ^)?k$k~-`LEgOR&N-()f+pyWv5%UY4}aP*wHOJ-RhOHrki}Rqg&Rgy)Ra(RYkWz zzPR1dEj!(s5#5?Qx;=w#wbGHMn|!gOTXwqD54C&?Vd% z%TBkXeB042JKd7|Ct2a3H@gh zY$x=eNw5tR`tZ+_RfCYzaq!e<^+nkr)kG9I#0b}R`*rSB2EDq`ik6-&bX#^5E5~Di0{!P9U`q8la=w~0vk&&FT+;HN{ z{{@ibj3(cK=Y+n_Spi21fBapeHLITQzeBc>{PgjwO3{bX$v6)Y_2|7^nTL_2B2>r0 z8g-frjHwpuVcsW@%oOJ=#RYMY?Zg7+uqdOE4Tqs0(QblhE%y|FqscuPjyzI8*XNys zPUrlU&c`toeLRI0hCoT0O|go}*nts%EF{YQ4JdgcIrK+JVA)mY{l``ecMgo4t9u}? z-4(x;kh2a_5h-Og+Wdl6kLy-9a@W+RvV>;rm2&Cj?UUD=E^N8!xNf9z)ST~!lA}f% z3zW^5&L$c-pJ%VyT)la;JA1pcw>x|JX~4KUd%LsugPgth^6Zr>t9R0;GFo$q9od?5 zb=x~`TMM`4#<_N@p`gNXmitTlH5>rLs60kFBwWGOSIGds8R+rc+pxRti zBfmR*t2=yWc{zMl%S{-j*=??M&W_zyzRpYLJ(R1ZdQtLSK3L9j!;9+yLCHl%@zi1* zeANM5h>P#|aqaw=vj*%tFWV3AWn0hyefv({4m^2ne72yG;4=6O{&_P0uDY<}QuQd& zuATOMtTMxjemI2WFGvboMn+vH9tkBzN+H^!alb2d&UA%S*wOZ(>g z2X`Bsu9iGVE5COZ-WMC1x3+F2;?zCqw9wwEtBOwx=+v#%n)z^MS8MiFie_mch|;>b zCC6n8zZg!LR4NxxROOu$eyQ8#7ro*gx4cNKv=y_Mc59}4m}-WV6JD|GCNTJAja=iG z<(OZf8~#-XTH<$d;?-P&J=-jm7d7zRvByI8=qwvBVaFxk>GfDQm#8bphl;ErU~drg zYp9yYPulo{X`hn|$a134MqEJ8f!;`SaxH|PtQ}6AT)OMO!kbjEE2=`UIAS6w{u)9# z->+fhf3WKE`k=;DoHiL3O^=&GgQYpZpp&?mX(c`jS}{F4sk8m5{R+8^j$!KZX(QqU zP#p?xyk&qX)GTL6z)2`pN-xhBv5l2mTLM-tbUu3V0@oUns#y*f8)_^{jr@iS6FvS_ z)$tApc!#B!Q@2I|Q4hgoLhh*u0C7{GF2SM0!jY1HFoPbl<0sk-y)pus# zOVoGy#8ZV_Dn`twT~!zi)y7VI%J$JEyrBR_<*(ewuW*ft0va>QZSRTYv_XRhz+j0` zTJ0Gm0Oe@sj6!8L8B!?zj+VPvW+K(~ABwf10w1%-e+^KjRH@C~<=^SJep(E_0PpD> z$GES$eBW^xcOx|f%FNN=q06Z|Cxb_v$#>*pZSS*XkJ`|?CBwr;^FFn6-E!oS2mpjh z17tV@sQx!B224eLhmI8N4<6G#4&;fJ97jBXW-nd~#I)>gk{3Pcv3oQI$Wi8_?}2+? zuY|YkTWJqC87xN6-eX++ z8p2%wPlYc{1p4H8UHKCs0uehE;X4D-}fDfMf zY!=mhN_DO$RA-IjQgn-)K*J2|yZY+NsxFtG<8g>EV}3$c)1xh1^R(KZh;36ph{1}A zm1QXSZxbV|Op%vdW;AzzZ-R())cploqnKk+-!GYWH1y7-wTqMd`V^G8Vn)w=L0+t_ z&Zo{RrT73Z%g-ddKZBCr4zgWtL;(%$(ovgR33-e>&wm3 zsP0la1=NRi0dWNoLTY=45}FFoKSxr5Nl_v1Eve!?)gs2Kit<4+2@5@J=p*Op%DE`m zdWR%;7#i3peNE$rIdVamN@79_9;xHVg*tc?ggkD)P+;wS^j34A zJc@kwET(WFu(DLxjZEl)Uu~#81Mynb!BF~_{5jW}85@oQGC6P<-q*dONK)t|+AuxA zCP|V#3oo-45z!i6=Fh$qRxZpO4)rv`nri&Sw7MYaDI)qt=esA3IiG4H4^!7TRJ8VC z^wh`SB5A`_`z#hr9;VDdAb#$N)Q0w7Utj_9<{3a=F+miO9`=KKd8s&3un46f;ZUQl zIwpULV@C=}WjY(Sf!j_>8sI~;emEFy?7tPVBWb%Wq_xQU>hlzP0_gizW8mUot($&s% zYm?&o@t>6t_mn`GW?e<*UqjH5;ifYV32*9QaxXRVV0_3O7CHk>AvrpAh#_!~Vs#HX z7`z?oI)^QYd>q=@C@Ab(;&dRaHU|!ox>QvLo}BwXdvlXlM=X%9AhQp+L~gHA5@uK? z_uF+k96kO|Ny9IC<~=x12B&wV`pXI83++21$%7@}wG=Uu0+A9Hcf^xIMaddhT~-6a zVUOVW!3fliWORIXC8tZF1}C==ojT$d1IZY~__CzABahQB#VhsA;x+C^&M)ACE_iK- z@`GUX=KA71dSc#*f38eBr5;6MT5iM{T+V+wFC=h@VSBK&1pCS;G;JCg2fm#-7~1!) zk45x-APmr1o~l4{vC^<3&DVU@jH##^0>uUM#_C8&d8Y;hD9u3QAoszu822iiOhbTg zaRBE)USaaPJ*>TtQZ1DSZe{4si7Y)~8|}RQA|6O{VAL%~Boy+latEuVVPkEFHtY-RX`Nt(mrOWQD>RPs3g~9B1*vQ3FwUO*I`i3(M&xwJ z2u|v&LgYxn(OoNru+dH6o!Bj*^_YY}p3zg>&?r*MsPdJ+UpY*q+6%WkcCr}#Yo_yw zxt*l>3*j<(C5@QYI|`F~63%W~>?IC13wuCKT~DEasx_^ZdnNjvcA6&dN^?W2 z2FBWqSa>wxTtUr)x-7rQZDqM9_*)lfV;nDF7smdF8H(x<)8p@OeQ0H5N{x>(-L(xW zzxfr+Pz4swd|#24sEEIiUvNzOUHU1_-8Fy-UW7NuUbV!0{fgXl*+ zvAb#dO=Y2e(@5$!3=E`j4f>54I1l>GW$e8lJu$6`M^}WS5x6$LYUNe=#g)@r={xd~ zfl_pgZ(G`Qk^$hcH&Tjx{M_nXqE74LLUCJC41rY$(KV#Sj8Tlmh?=lQ%$+lWJh~#4 z)FX)nM7oMMt-HaUqGa6A#3AHDbU<&SxxsJ{O>jUSSyyrntqYY;Q_cFLGp&xfw%eTt zM_;aEN)qBy6V+2LmND_zXhfm|9g*pAaiT4P3>|s$;!DQe1Ss~wVVJyWR#N93E=l4&=?p%SV<3`7`zNcXbi5AS$P=Wk>E^|TcDh3 z-pwl?+owKK-fI>0Osu_tZXyLRx^;;kEA2#Ok?9&|V0cZ}A&5iHdeqxT z?}&;Ksa!3rSYQ1DOxzH(GT`(0haNG%gU3PAwVsV1xx@H#X!ZBM{@2Z6MTiialn?49 z08*qRQCWktHjh-+z=b=J%mtH67>B)QYqMLqGH4rph~15N6N-r@yz5qfqz@wZt{mJ z;G;cdW9>|n(pAONV%uMd4tUH|YKl4_*w<{V9qRWpg4)xr0i^?yv3(P9**BWvutaWw z3gD}N8z{Z%bWZ|g=7@7iiO8{{U6fkoh{8RyscceP@YsWCZ}DKX2bUAYB5_^~?rZ-@ zx{e7EgdWE+!W5#zVThIg#~e>i^gvYaD42xc^cGr!jQlTggh(XiA&G?B6lVv9AN60b zYNf3L*I^E0c*?C1;K1Z>D@L3m%2eXrhOq`5Re92=5EHc>&+NGpW4)dvRA~GQ@m(;2 zlr5#&>C;J9;$f+oNRgIWweQmVA}JP&O1%dcE-2PZ zNs>0Bp;J^u?c`{y651c&B7t-&c?GcuT2bC4pjgB)(#SvJDT5=X3jClDzo}etCY>rU z?@E;z`w_$?xep+zMP2oykg73Jde~eGN&(@<#%L z!M&dTTBT+6*DB==CUVsk(C^p)`>6Ba3Ib~U-i%))Rg7A$6c=Xj1rl`e8dhIGzi2id zNC}l<=w~CR<&Jt@PY=E&Ebw^-018%-_u{nAs| z5_(=hoeJ^L8RmT&dR|6-$Fi9->_@|I30bf3NRjm<^dS(IiKe!pxG>Z{F2!yESk*;9#a>c5F8Ao2G=Lq2y594iHfsaJYLGxyl#>AjtzX&#+)-RqtLT#&O9)M zB`}};yrEqCjtml{JvI84kn;iu0b%G8(qA&s)3Tv+QG@X>w}hG< z(!~ODUQwS);|*scsbxE-bIGV5)L!1$EXU%s6Ob{K>>9tvF~%9ifMvsH>~`hQTf(*P z2q(h_bjJz&`!yoZ)epBpt1M-IP1luaW{)3)WpG3^({fcXzO*3+-3<6!PG z)S;aA!%QsHv~0_8>IgOZHcG#1HpJo!`pj9EWYZ>_mhGV6u7bBklWcj!$LJ*N5;3^V z=09s%wtnO`VwlC2Q1lA-luwcqlI>b<+D4yJ6Hw#7ynkse?+E8IC+<9wq!J&$tcm31ruN-bbHtMpr@8vf*%hcPEG5pmVcOsb$=SEUS>wSozMG}Xbknke?-CEP;>c)Q;ze)$K0{YH%<7ju zvTPVoIew9=@wZXoJ)!&-eTHhejO4X!O}P9{4ZbDZdcmYbLjOpapUu8MvTQvJVf-Q< zQOdVP09;}y7rsR&cMn;4)Upi$MWTEpr@^+xFw=plwukv`HmCHFWi!Hs2{>x}BHm6< z0=~rqXgvS1k3}{&^^s+RBrsE8FoP}O+!nvZE~V(t_?C?c6tHI@tYvFQvMqJX_3gQ| z0``DKh&s3%@{AXkWy@%2=1>%B4jV+-RO(o^b38)%qFBhvC12{IEt@h@F)RW?0}aB3 zNrh|L(;`q81W!?pAR!>3iXm@(}BzJg&KZKxb+>8OY+fY zfFd4>Y(a>6$+GnT71%d&8XH8@RI*ss_p#6Xhan3^aUr(cx>@Kw9&+#-W7-Qn4-c}j zkYyF#C9ip@-(M8$-&moiQg~1Yx;6GmknvKntj`OWgNUZEK?ijqVMh;~WxPl%TL3=e z!N46cZ(GW1-avD&H_&>5XY!8JOP0-xft+6r%XlmI2;j}-HmK<}pQKG)E=%rq^Y?Fww+b#Oe z%Tw9%#kx@og-_VQoOoU~L$6}lq-oJ!Eg0azmJs!t`E*D*dQSxw%y%=zYwH!;k(gUO z{FV?^3VhZnk}*UdR6Wb6Vg2Ws68@Li?^y?VuZ zd}O?pnqJ)1i3$Pj>od{Tc5K99-a`;>Pe?dGE%2j>j9DQS%chA`?gDYM5Px8k=y`&r z_57IvtbI1~xnjG9L{8vNkG~}(eaC$N0d<^#PlKSJQMapFwnNk;CUe+E>Dr;*m}2zl z@qc*P%#x~QvqY!~$X{-F25G%&yR$ELZu>YO;;_1A%_nuWmd%5*yo&nWGGC;^tXn2s z(_zR_G21b*Y$60OHv4iLE~OTA-BRcba}o^D8}dN1U7%IVX2w7swlU!W+oTGCRKnN} zUW`W6Ti7UVZ7a2{NQ1<(ohDe*1`IBT|8)v^ZP z3Op>{NGT+R&<2U1MYFk+f&;zA9O4L>Xj-$ZzQY81di*URX-iI7D(hG(%{OG6EjUxN ztguU6-3-4aM7_kJhc28p_Om%dYL*p!Duz^$5#CPKu9LBgZoOvNqUhk88|+@PkZ-h@8 z;$&kU%O*&20vpaib<38-HSJb8T^Rq%l^{B%flq|^EcMDvtW>vbBXsrncXIp<;-rNl z1P>|kyDSqhUA=DEM2JV<5^72%gt+K}WJA5G*Dad{H$yq{_x2#n7e%9VI6}N(RztRK zJB>-0(YH~zJLbfP=9wS={@4G~X1>p|nI*Qd=tCiH*w!H6Dab~Ou4#}B@V8#K9o~Qm z1i`kz{X&Uu@lyAOe0@W_jJK6#D+C8#cu#|+RO+u%iL?z22)*+l(6}jDg zP(yEzZKr$xUJ&TNl8K&{Z4P$`LpQgjg+$9E_qvOOG@5BP)y6iKdB6tFU{TMO&9##; z=@4HKnk}8!HlTSI%U5dnE#cNr)OUyGY=pH9$RYn9rm?9)FO^1?Etd;?>*LPp$2FhN)TP=k|Hl0G3*oF%sw^_p)_r!) zDIR7!E|v`g82E&B0bNucn=O$`xT5P;ygmj2L!Hpe z=pnF;`_1I=0!H5;R!yUeb=YsrJrCbCn$3ES#hmW0fZnkI_R$;W4N32Y@oeE(+wk9b zAjhZM(iq?h^hrs{*PKGT(rgs9toHLBr_0f1*QI#b2Js#e5eEIx?=LKr!YNsJzd*Jm_x_J=2I{8*IGiv0~R-M3r1gxwDW;>nW7_ z&dKA~o(BbvnRv-Ih(U~OZKM}uz(pSC>e++g$`+MQ>iXTv&{IUC}D z)wU(cw?kc@JfJJuC6s5RsO`?S{6-jkXG@5BhP#{+s0ri0hS~J-hHdQgv+hH^v5nI7 zgp)g!;_H3MMp(;+j?0A_e1mv3l`OVF35iSj0I$0vXzEgJx4crV(gK!aqvMMCJ|*b2 zhl8xm_8Yc=$T=JNY$+(j>lQ(m1M1Pyh(NKy)q|7C&D^k!Lq0N-a0!1{SSy`3X|!lI z7uX9jc?BD`VaSKrt1cyAw@N{0*>p~xJfI9dVK!!2}N*dO2w9VifbbuDk=9tI}Whk$;H;?}#?0Om7Of+l*X-Cs|gEvXj zOr?xv9X#}JeRk&;L-}{H$620Bcv~JtS9l0rZP0b=-~QXl>G|o0Z2V+f&-Q45h3jo) zhtEsma)wTYgXMY6C-y@ow!|eeR^@xy2{2>mhF@4A^hiR z(>cm^(Y92hID1%FY_o20)L{eE!2!$WEU=FI%?1Jn-*m>YY$|ZlXB^94;zb#uxspQ) zUb2`iE!j4Hw;sDoAuZ9}s6LqsB|FDM^oETE89m@^c7kmXZ!D)Uh-R=sWKE@wWkvrT zrbBYZhUCi`<_^W3T&5}8#>@VMJ(r%*pp+TSbKQc8-eJHJ&U%6@Yui)|*xlBk7=NNZ zb5YC33XLrjJuNHgY6fNkTSCQ;S8$`}jx>#1;M>zC~chvJJ z9t!3c#T{E%c(8Jzmr4Z7`ZJGhh5sO5=)G=qoP3bz}!VXoygSZR~$ zw-(LjjAK7QAN_vTG9TM;*qq!2+tQq-9dc5yW+J0)=xj#~y$m|8OTgI%%Wiq}s&Y>K zFwfz*mMhQ+zLU35HZHPV^^5)f87IWQCPVqdYaE2zl8W$I-|y&(JY>TZZrFyyK9)03 zqi+dC`?#Ae_rNv)cHiObZmUF{?J@!^9MxiT&5|y4t(KK{FQh_Xn%R50hJ(_Pce9T! zupi!Lb?@26iXPt=w+E>4lCprKGmrk;|L0S3N1be)9BczkkNO_{VkWSu(rD4tuCYr( z@dbT`WFUZ;%|>O*_CcU$aTiTuOL+JL7L+4=i_r(1v1HvgMm2zQZkA9;rHbu#LL>;J zNsQs&MVUS8W}tH{4fZ!UD{xA~Ht;lz|7I)29+9`TL(r+4(M@X`qMFEoHyq}?VH<1u z9Tr3Cla9Ou7Pd}W_o;00&_^9Q#x52aRXy7<(gDF^>{GExEVO7ge-1_1LuZfwlr7)M zHiYy84BzXA8{0;Ap{(QV0ou%o0roNho;GX)Nki7u&`e-U81@>g#?P1h!OtiGEE^`l z2!`GgYJQ;3EqcG7jgXdY4_}T=dvw!PWZO8<9JA1?HZ~?Nr1gc6A$sdQ;A|l-+n~6dZwD!lW0FND7dp&;~RUJuRCx zdIDye+ZacZ@^c=Ow+($exx>7)LH6l(&+=oOJP0 z@`KhbOW$G0^0;D|Gp}qzU*Et4iqs!dLD{yLi^oJt)vV48+o0K9;&->mk?{_SZ7$^% z@z7=&yHwi-)mHUB-a~n#T8=K7&F29PRP&B=+|73EZKG=6!3>~xhbL#Sje@o1k$ZH8 zAN-7YUbaEGu^fL(xb-#kh(}|EFiZT5@i5!)-94CuoP(#PutAhfC5~mg=!S&6zmO_x zTd8G>Me6tLf_Rx>GuAGKOjG&yArG=8DA~rk#t+3?{IEd>X3=b}*$`dJmyGdjrN_2` zuH^)x@wbGe%yZE&W0cx9%C$?zgyU^;=P*E(@*n>gTgc;p)wlS;&M-D#T7WBAd%)6Ll(BrUF<+5sVmhFtLP{VJd6ulz;<5zS=!mQa2 zw$ZFx@>OTkOCAnwV^TZv+Q!c9hGe=4}onvEHw?A zKqF;2rX-f2?$savP%51sH7ZBtKSXa`a(J`Rt{xqiqBo^VAHciiTDfHsB?kmc(S1dF zrkXQmk0ba|Ab0PNe;{Mxn_-{)dbvFLzDs&I^dg4tF&3o%q?S6w)8DT?HN?}iDouXU zqg;G@PL=c@jQX7~@`J%2|4?o;YwD?Y@^$%0+8EI{9IP=o_)~)Nl1hQ0vrI8TK(&{K&dUYgBIHDcwC#yX-Sm8ufRgxP*wP^ zzuvauyDig(EBXD4crq`je~U>|YhCmbIyer*&MetSYt zoDd8b4wvJvKNZSKWzTqXay}Kui(eZ>rCN9C1Y&vuaevK^;rRX8>H7_%HPgq5`|}_k zhJ6%3JpL3x`tL>%e~KXacOyt1vd&kSgTt_oBS=3*@Tbo~2toEKfE}niKgPv3Os!_^-HMf8VxA=8qJyw`}o&{mVVh#Sicurh#J3 zwr<@b<>}e;7wkavVjy~6Y2G0m9Kw! zzj!57d58pHf1b1SiwG^LVfEsF=5zFPe!&A}?lKjqHEZ^K`hMVoEq?8UqBTz1rq92Ugk{V=bL?hpa1gn;&)aqZq$a!1wdK+oo*>g zI%n~-$$aU!~3u30raMdZRXO}>CqwOTp7h?B18uf%)0ep3}KdqFi$BRw5Ie=WWT zDZ02ahOeZ%Axip^^!fJbFV2HbP?8l-i)WMdQTbuExRd<(d>JJ0Wq14rX(#}YD?-Ie zfj`}}D55^;`1uyjwN_SH7}A9XMF0OmeZ=YW$^GzVeshY3V5BY?Ki{RAGvjv37w@SA zK1M5Kv;6ra-Za_~H3-qAhN$a!`4d~NwFTm?zPx3qFWI%SWx zD@HoMfXx4S|88*)dhrH?szo1?OlLm%s@jeLdiT3grAPa2WL2b9FY7d-Y{ktsjz?X+ z#6Uro`V8@V&@HW^PKkY-j&lOz<>NG&VS%1{qZRkijqI08!6MVK3J+pm?C4X(w}uKs zVY=gZoQyLp;1l1-0sE}FtRkvMCG0s8fBw#gaUryv+IqnMv@ylTB&W+ z^`$s&TAHY4mU02?6HUisl21rSwIwm!XG`*E$p->3kmcL*`jjjKfZ^wHHYO<^?Ah2C z+;|N8bWF0S@9G#40jbZGdX#_y2tb7WDeK`3J0hk}y*~P5*k=POtc}3I!a!EyE8=*REcY;u zw7JiTa#aqb)IcKBWXR4WwChmpawonV#m}T{n~<2C{Go3f?s@Km(m+nN)GKmZH5C3M zryb*ON|0~U45#f`Y3uU*>t3j%!CA0#hx9H-G)-Q+i&_L;|* zTJl;^AvgtDjcD)AW1_6M9f69JObp|8eF?X1Blux|8yzmV??hJVEfuvnTp78KT&6Sp z`75u#pT<*Gj3;G20iysG%WRrtHLZ)3&Wb8wv?!Cfq)Qax!rT`w1bUjj9CT7_lw6gu zMv;b<`?4a=z+UlXW*gdIz*_hO&^cDYKP2xQ`=CJUYtC_w76c;LRT!Y=zEIgYR4b_Y zX)twB!~im1G2$8CzrDNq$D5Q`MnArGr70%TbQb{*z#Nr=Zdi(?;3F$M2JJaTRBmd9 z0cjBs7=L4OO6}UwuzigUAHX)CtJ%D2 zl(@qHIP>Kno)ul}ZcCM83mv-9+_J@j`au{eB+{4(O785i$q zUE`3onXg3W4DAQ%GC`2&Fwb7n1E{qcQ95ob~XN9k^`x)N(n^%^j za3r&U#+_d)E^UTl7bo|n&YWYV>ou*fRj;Yw7yzff9xe|6OG~BOwmfdCYi1Z|w&vIn z{k=jV($YX+^>H$)fs9hM1Td_SsOkVQ)p%T@5PEq)=*=r-?N3a!IOf&YN$ni1TG}1e zY|gQGos+;0$Xvl#oNh2+Ez--OlbavO4XYZCf)xs1{pLB?hF#tMFAn{e&n}B-!1|i@ z(u}=zSY5le@Qu5>Lvfel?(XjHE=7u4f#UA&?!~=0EQ-536nCfZYWF_(>~p_+zxVxP zJ#);gk<4T!BhO5JBMF>^5>CIik@s%NaW;9*?i7Ki-!fDCwt0nTtceA@Ve};T!ou4P zD5RQU;5N6~{04KEI^3|vr)}9Kf#4T>O!i;#t1NJ<{7j6B=Z<1&T{R+V|}Zf;6QWXuzp46CCq(9}puuxyZ^hDAn00 z>n-U2*kzG&uLs|j3>ZsQ%d0cHd2Q(1S2<2^(#6mkPL&6vO3te=M`QA7I{)9E>nxIY3tq|x58NKz>TFGdF zX*i|~^Npd!8$%0x6w6f>5!<$TFdlE`#Ow)#;W7XPHe&CV6t?a(WwF8#mOxGyqCps> z`a3EklMmwcWc>MP=#G|N;MdR6eQZgg&IC68)HQ=y);r(wmHOUL4ekd zo0kV5^nNfbO`WJt7;VT06Mt#uQz}q#p-X4sbx^`#7AG(QFK$D1l~rnu@FdVO+VXM6 zh%wo&bmf<{2_>?|$y4yjKA6nYz%bKj0zHHeiJJib4zdL&>@nyXQGhEe&~+NZ+bYvI zAE6p9vT4!%UU?Xh4(h1P&Q(-hD?J0OZ50B$Ovr>Ay6pF05vwWj5tl0@hx=6mbGq8DK*1D@}X83 zc9W$#fhC3#v#qx81iVwXdDlsiATvgrWV_Pcn0ac{s~_f!h2+ODXsD6k(Unbzh?H4( zAvUoQCW2Evk|cvk-nSwPhFYNiMJ^voSM@Sh$R0xwL7jODCwTN-s z1;p5=I)=g-Ipwl1q;Um0wynmog+JMllZqBs&bDzdKr;azL37|$ycY3l$9sXa*?8wI zh0jQmll!D`xnnjsaF9xdf@7cZ7^B_Y!h#`p#!1Hq6OR&9%bk|A18d|@Q`BukMA0z1 z1?DZaQZZ+{P$JY`Dww!q*xH4RM-t#S?8`BdqzO?jchWmg)QQ+lL8f_FxfdH^r0;FQX$9S5t-_fS)zx1J9S(Cfc_Zw9I8+6&;!ZdccE10KqQr?-I$R%wgW>AtpKLgXg>bv6&IyOGA|q;epex4^I}#L(>qku4{#z{QMyx;q#Dc>ir5Mt?A{epbf%lkJ zA8!P$8=(zh-m@k%Eb$mIqA5s*Y7Uz)32eRlJ{_Y4zhJUkOllOHW6F(LEXV~DAMMs= zwIVK3g1|Z#S-0YEgY|?&N5}|TZKQ+fumh1{I>=fUA%-202b=EF z%M-uZU`B;_0($~3LHJkc-GmkAI!BW8D&RKtI(Z{6qu?P$84lc^t-vJbD4h_38RH>< zO}m9@LIchs1ujBF7$b0Zk9}2}z+7u~T%g^+hMb2JzNi{Zp`YC_zswN;P7CV9fgmSI zz=vYBkcWvr^j%&_tS=(qtXQ2YUaRTK{DaX^Xh#_|RF!8QZdHCman|cA641at4<$+A z*&K|TlZ~s%oHE4Ri->O_ATdK!X?PR7%Mnoz@)8`;XtIl9wkufUTw(>H zM1!vH|4?xAcLqUX_-3)h!l_@&OE5ji=fqsHZ8DxM94QiqX>H`EZd#_!#Zwps&RV&6 z@VSHzs?{?OGn6GNJVgcrb%-y{$&r5E+|YjJ3P*g@f#|C@?szl6RY9FZTAv=wo-b;j zK=KlZVvo_&0orhTmpWXR{xOg}~W#8_uGwjZJ!KbjfCtCYkN z8+!eMmls1njDpjFwLPS?Llt}Q>ac%S$pH5}OL4Fgb*t6Dkn~O^je9nx8v|es4oRVo zRMbZ`58G+wbz6q_{rHeW#&`=7z3yJ zp|$b-4JYDT1nE{2_=1BJc22?4^!V&}bDLYAgj0ABSGRib z&SeVew@wU%+K(9g1vhb|s&5I7F#8##)>&vHxGmWmyH2x_y)3beajPo!by-=dknSJO z82hG~{m^Dwy!%{Lww(yT(3(^6%iR-hL#-R;Dh5G#kduyXhpI4R9wo7uZTbqT(@UsV zKrI4?xVJJ@3BnQ&0#*H6IvZp*3yc;>yXh@jI(KK37(G*Vn32H_0~{S;6MS;%ry_iZ z>C4la*Y3H-b|VAeR@v8(yp@7dq|}zp4V*l`Q)_*gWL*7*bd+F&0~N-A&ZS^hi(n{C zE~$DDxO?(|hjDHf^xcpe%wVaT^UbC0r!tOVJ*T1aY|T?D4iuruC)BerMnR8$EmXLz zZgh<7H4`0acR7R8q-M&9MpyTguUGQQFDCBM^(DcEv^vP(g&;r28+DKear&b}1LcQl zH4QkT*lg?~Me2&X3x%LLh?+WQ#_TJQU;DBYK~1z5Y&c)#6TiCi(b9EY*pa91UH*Ku z94vB|=TlB|EoU0PEf)(qQyW!>_=QfZQCDL>i*}BL6jU0%ciTT_S^7;4X*cztPGyS} zp-jDnI3MM$ytWM_AcsJVCiSh_Tb8HYWT;DKQd(-7J|B>JOV(0wBFpOXLR^@&RDQRLzlV?aocgL2oDvO;v0Z>rqie~tD z1;HW=Hq%(QzSK#i)ZQoq*|})JJcfWY)#hlSn1?KtYUC3CGGH=e-Lw}JZ^l9?ixf9~ zG%#@J^ctAa4_&09(lGYja6+mRr!fEfVwmVz*)bAXyQZ0ZOA_-j9*+%1RML}*qGFjx z2cewn>OC44b^FhD@4nVnYqmo7?K*h!(vg8~g?nV{K=wL!0Qkod`{0I*r9dRnDpFnz zG%r%rVHrhVe$F>B#O&U$);Nt)buTe;-ViU{Xfh4YSkRZ36|K-eior+dm1Vamv|y!5 z1Rku}nINlavvnTJsOVX-jz}trUNy)E9&h_qzY2r>8g)5_*{p~eFvZwP92IYJM>0Sa zP35AWoYR~;mqhfpHh)Ut9{+Ab5l3%icp)hW8QRPM2XMYNGr+~7Cd;e0vD7vd%6)DR z6%5@Vgkef!DNCuSC7n_11!eEt*VQ=-Kd=bi`|zls;hhCF?qru<)ZKXUT9=(1uC++n z4c;!8iDqg|qm>lDsoloqfqyW3!Q_Cn89M~)S-h7}>*f0hm3+6ue)467cPjEhZ3YwH zfXF|{IK{+}_(v_bENL^EW2G#CX2-i|0?2WW8pc6m@7{7>ez^YwKX~O%+ zeUEc6plSVpSxO!=O4kQU$Z{zv*FgE>y(?lw5FHg~;eiia6rkQ@4D1R0Ph|^VGHw#% zDonn6II^}DIBET@v&3ENm7Qn-xkNH0;j$$3#5cd?ik zNem%Q@F;NO0q02)%JIZ6F~dHzZ;+QZrBM`eHkZO{`qHE3(SsG&ZeZS|_S$IZIJNr= zXH7Z$rp4hQyxT?wo63QT6wGhGgz{=VuF+uuyYwF%Sl}d5<}eLV&3PNl@f1aD`8)-} z4xDr1nz2*JC@-E~(>oxSP7&*hK9A&ZN!_&FC{i+f$k3612;28i!q(A_q$C_%(I$1ZZCvqW*fFj4TjemeK^RY8P2pt#VpP=|#$r;TEJJ`VAA3rdw>0D#0X0 zJ-R^L=5)2^7CnC3sm=$Qnh)x6w@MOu(COA?R1-oRR(;2o5Urr}`!4fyGvnK(f9o?9 z8q)QE198~vwP6uKA=eJ+eKw~X?&m15&j-9D#{!=r>o9TJiQ-Jd-xA$V>oh$n2i(bI;9xNk>8G~d#eSALeThWay(PEY5hrdq@zpJ= z44uP~(E^S`dbmwnXY6kbwQlovaYO*PnPEfYBS(?+x^GMl>$Qkd3^KKm~D z1s3+Z@6fHn&4xqxX7GKlmTQ-Pj&-lr&HhmlU9|F1*v5RM89TvR$7S2y{utOf1`mU0 zsIJ0^xl9}@N0CV*-p{8P7Tifm_h*UBe8c92A zAXdlTboOI$mFhyWMe8*lusAdszi(UM{Oj_^o|u_U;Lej-w@g%E94k7~$fFz5m{4PJ zd-M()ZuEL@6dq;rEH)SQ6~qz&1<+5une~f3w8E#_SfWeUvUn=VAOujJZF?_jvICDQ zfm6fx%F>zpYC0!38W)8gd|7jOcBECtEAuh#XUzTNLVvNBqq2rx6ZQo{$qTOtf~GWH z@}iw=)ko}FA{WCivX$$P%A8n4Ck)nev$dF{8%b8T|(#m6D zg{Y05ktCd$dFvKpW?$pMuk!BCI1R=0iHA9-?bP#&Q6ap=9c<@}=nk*-d}neVP+&Ek{-l6JXr-qCL2pob%iN4UjOqgwK`{71 zBfVDj(0q-n;H*1h3cfY*b5wz>1IPW~8PRa|5IRBY?quc#-)IS!lb}gDf2g-k9@jWI zzCY19*cS@8weG!h_*SY$9O(05pM6Ou#bK6+VC|2aee~GQrCjZdKLlbGOSB_Q^h$mW~Koo-TfY z|0k_R`SQapn-BzqN*xpgc=;!-ws3TGb#Qbw|MU-BZSS$l(eO^kKbq<-D1>21aklIb zn^`2?F1;JQ=05pW0G<#B0}G)Al0^UOnK$oL%fYx$d1b=RFveV#G#8ox!2*gkxX0gP zJ;JeB4!>rvWpZcwahX$2qvF8j?yNDl){kV?a`SEXf;c@7OTZX!Bi(U}ZpP=Os=oO} z7bCsGn1P*ao(1;e53V-6qy1^sluw66vFnU_ylczn{dvN%=AO`d40GOPlqa1Im5tC3rnonjL*CER4)_$$=#lSQfvnv@fqtkXmB zZFOAw&T{O$KV10j0@n2Z(A`Sg$8SYD%be5xaY`BTzocLsKo{+B8bhr?cvN_8+P8@u z%_nM@4tfBR(e{vVP~nI1Sw>E`8m`l;P!0o?+enev=hcI2U7S)Qmw@DP;n^` zNOt*a*)FQkZT4IfNngOa|4DXjuqnp5(z7S7_ro3{u|<+8d|-avWEC5VeJcu`kMy5B zJo5YlcI|1EYO9u?UjKmI^WR|CVfJPbv*jxg>=yk7yJHvdcHMtIX0TCy;MF=&UOicC z#sYh020!!t9U1#HJ&>fqSXWu)>#RY`S)YgN9hZM`-LcG%JAT1lYSH0pDRCBbc3u$>>o!{Z>bx@Ru1WiK>p{T^ zTsQ~{eUFhkQmu`B$GKmIK)wca ze0rh2rs*R;>!!~cuA|z8K)pU~1oo>JHUzDLqQXJtK-YxHG9L_&7^oHx|D)JeWC>x6 z(lj$Z&lMflFy9F2TN7*L7R#{QX$m}OpQzoGLT#$smNsqXtSn~Dq#f&e&Kh*lw_h7>M zRoWo0FV{S0Dp%Bwy_!QVmaB0b98q1osYF(mgID29;tUXqPKRKuzRo-ofoMzSRL49e z<0DQGJL7`9o09p$t6Vb{n1o0DQ9krkPNV~AkkMmjT=`YbV)e_w-Ujh=`*zMJ;v^`Z zd6n7`w|S+<*tH8Be|3>=`PA7jw+&$IM5aQ5FQ=uTTaBN2{2Y+*Qz1gs%)0?M%&~T% zVqf@dWl($t+L&k`+uKZuN*TU(r>&hd)kbch`}u)A`$U0v4Id#D<_=L031nxn-Y4>j z2MS0}PID*vgo<2Ib)VHRKkxXp`{);r><&UsD@MMw{?rt|fWHWxRvh9+x;;E12zzfU zVjv3*r*K}LGBVSY)9rSBx!qE{#e(GD6qryw0zzHEVZ7{Ucmi}X-eHuCL0GinTke`W zs#{pBQSRZW%wkq@Q~wwmmhm{8{AF%hHxArFW)WZoaGUB<>K(?SCO2tx67d9EHJfFO zMu^+C7st0vTt|nx8s4J{ROk>S`5^D*s4T*Apj0?A@#>xBAa_oIr^~p#xHzUiM^@TvQ6_cDjv4t3VMH@Sh{?< zJCm0+q_x;sN!Y%;gx_rLN8KT&aa^{YZ^&F!)6Du&E(W@~xO53>2X4!rsTqyNi34KU z{n~HZ8*x1U&~B;n5yRF!C#N~gPfg|A*oUIUJp|lkdsT)j=v5I4?lCv(L;Th(*j0?p z4HWp)8g`-p)R^_l4Eq#Dk~IdU&cXNvm&mI?V@kO!g3^toh-_}&OmxwWCNZ!&MEZYX z!8}R05yH`o?9Rd=Y#EfYM5r~J_^gQdD>^QP?W-3)tD8DMVmw(72(mD4%(f5Z+p-#l z|3F=doih(2(eCH-mPXE7u!-s~NYCNu6PTeeH*uO%GRwj29y*u&d{}Fs74tnF07iHI zs^V=6Nb$93F38JM#yWYHiR?=<}+Bdea#v$fkt5o)l z4Mod0OM-ohT3r^TA8u5IkVG|lm;$ai6*_67Q)QvsxL}Z_rdz>g*lK>}yv*WL%-~5D zguBoIT+QGy6!-!uKOs+>mwb)Zyc0%&(&JCg*glTao#$UpRsK(>-y)!@n5>zqji5qU zvLKr|Yce*hcerDc$tD$F#5FtR*e{f$?6xbfxQABS{RIjFe$p}Xg;uQ4m9)rgFWE5q zz^+O<`R5lL)V2{8)~(;{+-|*pH;2Ub<{k!VzT7tzgsA)p54(UHqva*Q-^Dg15uQ>w z1?_2+pe(G*>Lk8 ziosyEemw4C)kn2$>xI2|Qq6g~HmzEX3^8*khE(IwR>DwUq?E`@v89E~S~@k}WVTRN zNaGN}tT1DoJhyG*{G(hIIWUIz;KT-G;Y#w^qIPjK4PSDgt?;WckQ$AAR&p7%C)|Pu zNMSzfGs;4`f*`%|@Y_2i%cUS=#EA$I|qLcpxFt)p`M7&(+&Er4%qF5 z06&Z@bi#l)EIwgTVZD{=2XWguVe^M*D#&ZBK;$x{PO>9Xf&$TmX{Reu#hB2#KDK6B z>r>CD)&TlMoY)_n^mrkp;a*~?2aB#gXOI&H+fxsIXx1j-?m?@`NIk}l;OhV^lD*?F z7|jwk;e~A{LnAP0N_J{!@nr;zR5YJ};s8Ess9;ch*OuD18PgnKlPS1#jOgvIJ~2xu zyd3m}UU>txy1njy88^70i0GRDXSZax=T6&&3)w2^p7kIONX~)CGSLgA} zlPL{-IV3cpboMG-yva0cjV*?oR3g7uu0!cjmJZ7^|$ctt*xH0mWukz<7JswdwP^}o$cytV zA4s?TH_}!3Uy*L?e<9rvAkr278|mi!KOG}nz6KuS4fBor4rjg+U1$8vkR=$` z%1d(YrMqWI$hs3sA6y~aSGIQ=;H3Pp%`St+*s|tC;C3#ar+ks&@Wf7!{t6XxbPx!U z!Cu)`P9GECvPB-iuG<_{+rkwQ+8B5Aabm@Ho*E-OLY$=0Wy0$-@*u)E7%#wfgK^u0 zYfhNRDy0e7QrHc=7CVQ_?Hy+g=}crFc3W)_>U!!*ocFHzS?N`A|OcuA!!qK{O4dpe76l>G;zKhzz)IfLr(Zam<)6G4xaP_4<9@YZOz)LYdGy z?M-wg){!PL`-uSrmlgRUvl$v(a+g98Hseh)g2UAX`YJnN&(+ljfZCysh&gjhn+=C-eRE5Pu_(oe$l52}x^}1Qb0qgr-=mHi zlFlPpJ>$HtX=Wsi5V^tHoh_LFbsDxQdEf$rPYh_Ax{~R$MNo?5BI(Mwpz-P0ysg73 zm5Sj&%F2a&FLIVX;~L;Z@mNs1BV|z9d)o^XQIT&U;A0CUvq9$y6;723DiF_GO|_td zB$I^{uNV3U)SdkUb!{E6q;w&(LT$T6lsD6$Qy_YmnVAWlM}+dUgEi!E;5mg+A?d)H zQ#G>1Oy-A5lLPYc&kKlvZWVzRb)jP^F4wcX7)IdRxT>VqW$9F<(e$b`^(|a0@R)(D zT)ilDI%m$0te$xo7fyMldh-b4BV_P)5o_6kKY5Ccdvzg1*q{~|J=`l^!oi)a3fTK& z+K#=}x4$wT1O~GpV(XqG=wL)tNrCTH;)zy&pT;#Oz|rpFXt8WJ2>`YPW1Rjpt8y_^ zV*ohp!;p&p{X8XMta8%nL11fYz1_InVG101d8Bw=bXa}X?pKb(K+&tH`6x|998)Q~ z&^V-%79Y{_W&+upe4$OJ*^6@PYnGVMAPr0&RF|y_L(jmR+Dq&(KSb_Mw);bp zZA6i?42k8MyH{+#JQLV3U%QZlY*U|$iviYB$hQs%$^J)atFCqUl0>+$U6iT1t~IHq z#3D|)#9|Ews434pu~JTpYNr9gh5%)FEc*#I@o6Mxc(xy)n^`+tS!~Ez&mH^8>d$x~ zby!!{>>c}rsi7{TjTm8`C|uA!-tuvKFJ^%nr@R)@gWvX>hn0y8AyVq}`_Jm2DXhZH zXm}am85MCtsP~qwGZ#ShRS;AAjK?8j(3k1@HPJ?=lRUQ`pSwaKJvfB7nJ_?^>^3v~ z+Vt+IqiUBjYs;(`UnxT)k?PyN-ixN@W^U{JjdeGEW8KWoB^rBq49nwFYSi7zg8RW! zJX3k-O|@@Cj8R}^Op`YJ7^VoEc#L*D8g17N+cJei&D0pWKY8I?QFfKb>8jUCo=J!S zPZ)VA=GE@~lWgHu!-WkqFFzz)q>*YJ{HxODYQm}D5*hEz(*=^rmlTrq#4iQ&O(1Vp zI2g9iw@5x`NGS-)`MS%b*Jx&aogTvr)BKP9=^X({LOX8w-tjm^3EG~G}z^U4)F>n%9>2hbvM*s zhnFXieHbsE(vC`7ZYrl=U0jVcOpLK!C?}o(5lKa#%REaKQk6t+rc?}%51s%PyYPgj z+bNG3@N|~)G31TZ^w|U0ew|@yB%sIXOXn+pW8K%938N%jg1k?gBOAd2B>F+4;^%0Q z(xvkW@Dd4wY4qGe5{;CU0%5zzc1Zpt$q5PSSbjDVJA*ig@P@=lO@$@AdedE`z(MsF z>BTAKLX;vvs+U)+SIcUjP>Vg2a8N;HO^0e!WTgbF4K`ATkV}Nz>518|ICwx{6FSk9 zumgV5`~VUkLVd)kmh=(7H~}mF-QC)4A|6j5>MXNGywL+;`aR6OFGZ5s9Xrz2wze~L zmMnCfc0me>EHio>g73NRd?$jAdb|1dERS(|eQ$7;*QIWJ+*LKQ;)h^}_r$vy2A@hE zv{>Z;MM|pFCezCZob~}@&ywx}cR`y+X}a+ifHsx}U7#7*i={G8n$eb^L6;3-ml=1=;m%BrxL zw5jGc0u4G#6Ka+&ukYz_BxvsMwqNNaX~?jEsgbf3)+caXSgA5! zH++eP>-d-5-am!fKO0#YSf2r1z3So5#fS~{JAHn^^|z9DFX;I1w*rWw#%qCGm+4PxnCijHh7)WFU?*GW z>ZeCxkcp6w@b-uGJwLi92V3G0I_wvjHDYkP_Kq%ZHn5}0CNI3#LvrYKvZR%`?oS2f z^;SlPs|}@}WWs-jWrw2Cv#K;Qfb{l_V^h2%7?iKZ^SU^Ot3uI%`ICm3QJJ`}fgRx8 zMjGiCl9MGYXU|a6UYl-Sr77+k22{C^X?-t(A|6;zPSRV@s-iWds-tolPe|*%({Wfg zIGJYE$k1vI`#(_HoVxQLi@vYKmK>F%WWuf!=)&-3O|lI%WEj`i4!!l z3p5@Bc@Q0%J(u^FnGNjp+(%L_xt@NP{NyI98D*a?vK#<|n|NEl%B1>um92eLP*SbW zWq6U!0+C!jLrk+weQm~3xE|XHM0KbY9USd%tgFH@ULi3}%6@-l_$+P4ML@p^3Kt9d z&h~R!l%0Uz@ETKCStR*UC+y3k+GhfZ&4ps(cVz5eBBa7OOJ}=rxxXaFSR%+6O*TDM zO9O|g11!726V8J)L39K2b>W)uXgd>}6U2A5#rhW4;$v1qd*4Pa3_sSP7sLDH$G;CO zvfsum+2>3M!GSLUQl~wj7YuaS1~asOrsswIJloD_ssQwx$fN5wwsT-Wz7CWcMxin; zBBo?3S30z!U`#lb3Sc@s|4_$|)pOwJsO;2Bo<4IQ(66BC%-gj|n2|P+kc!C!dIE#E z`}7k>z3Ouj7_@c*_o7>p_u?GxB~jo{*>`9OF3ta<(*g03b_+vl>o7B z2_~m2vn@gkK#W~?#$ahASuMScml4<1xkwZjYMY^~>O&sg%K|Q9K(&iH*q7irrsH5Q z^n}<_%oJxSpEIX*uDW(svIX0DLp<Hj7f3R){F1s9Ui@}!B4s0Dak1#V5R>U@!p07`%K5^ATV8hX1G(;~q{Yar6r;h9!$^A>w4joFsRO!Qrzo~14K>Y) z2px`FQ?6_G0`gePI`xp?nR zlMM2r`%kW*o<5P79h6GIV)+f51HrVrq4*K(nlzupGzBOA%Z_{OuEH)X(%RKwv`3Da zDnTo8J%Fg6pFt_hJRw>T*#mS84bs8T>sY%`4`tUguWr4R7|g* zW^uTQ{RRD>T-VTcKbi{(1Z4g@CE%}Ljdvqj>jkJAh8Iwd=O0l=Tq(bJ@-@PEr7 zW>^(J{Z)jkqF%!|-}5qzHu(NCGdA*RR6e10*8Kh;smonKF~P36Q>yX7QQ_A+qu+kE z-_0HHFz1GoLC*wiNkzC|J6{g@M&ivZ1AC6j#%U}54jHW3yAyGq@zj(3{ewHZHXH^f zrdjQe?IWeca2==~X}q*m3UtWu&eO}mL<}j|qk4L31{TD;FL8y-^K6^s#18^mmQ*%- zv7PN?8~v!CB(mo9!-#I-Iy5+)BzSWk8SilJ6PV{G6y@oHp4jl z@A^OXXzh<{HyB_O_nH`(GfbSXF_#Vo$O?K#rd(4;k4>&Ezn>WFRTb0HLU$hI730uC z8?5)yTXQ4&9hh89`mON_9(N_RpA=={tG8+U>#V_3pBxN1_W%GD^4jZg z?G>eA>Kx12Yu=}tOi*EN`5xEU3XPe^UKi(G*&Tw1<0tbQx;BSrt8Xs9jGLNo?)v9l z)d4Dz%gZgm0}llFbFt@@M;?llwnm!|6x=cOy0cEjoK^e`N-28eCKoe(cvgKpx~LI< zT$^>#Se#wZR>3lIN(=l*v=(NE1m|adyf5HuF3xj1em}L~VTu{yLNl&XRFv2+AH4HP z?3Q;(c8vyO-L1&irCCdY8{aMa@BM*sTie9hngee!+4&|-eu(?uJ%s(W%g zm5ol)n|)%#(OIc=HDK(ai+g@;x!cqA;r#WU!oVWaExqrKp5fNIVQEnF0c_ObtFZ4!c&^Yz!u#K{fhW2N^Wz}WuDetEGa`C{&*agqDqKoV zZ5@H$5Cx}eXQyKx+WF|BVF3srSJb_BPF4T7R;2d%0xsaUzUmao-;yqKV;SqG5k3Z2yKw+5j_mo1Jb*r29_vqPxBxlL z;J+mV3%?H*DeM*p3K-lv?F)d@qmkK+!pVO>9SjeGHTX|H;4L)VEG$eFp+0^yKakEN zRCHeZhaTKN^xRJXfDn`#-QvbypI8Z~u3LA{{@3zUodD=tjqicBxJcG?1*&Zld? ztb`N1Y=R8=m6;IcO-2c@J_C|~iV*)+jH6~%oh9M6C@JnUW?^MVM9NBk<6(VSF}34s zHa}2O_+A%B^!NMwU1A6}nBVR#K#9XUV~!IHV?TuwU7$Y1BEJbCgE&k0Oqa%HO729q z+*p{kiK+Oj2rD~mLa>Dn9sw2`@Hxs>B_+ZxQ*yGw{XrHscmzCbiymMYGwEFUn(N_f z_!;_~a8%u~9jsHoKYm`;RS_Xt9)dAL&uR#0rfs{dPB75e1MB(&`r;cV^?JR&20xAk0LIKbk+G{G~h zZBhQjAr3frwg~v{F@8w5x|x&ThHcFW#s;1NI`Kz4Jpk%&X&EZxqytpOvZ@tZ>jG+o z5VLj6`JNl<->SG%a=O8PB0YhyEw+FsMOfqVE=*N%d+-yP@(TUeqyICLfq2R|1d=B4d6eP5~R-;u;!aP+?=Oga3vGf~se zGuFA<1JSlq{aANWw>OTJztw=b=tj7pZ1MaqPW|fMJMX4-4h(kf(g>Jy(|R_KRFW>m zTyiB$d1w$n`nVCnl@WFa0iwJ~C?77=x>DI~a=z|nTC-OZNi3d!5?X`b?r_wee#xorKC(+SH2G6gge(XcrGPakDK7fPV+=<)x=Ug+cy~15DcbAMGv-Y2t2uI*CB`!}ody zHrXFV_iQ=jAb)2xzyfIJe^)%dRn0|A$t%mQvyrcNXapuUs2|LK6~hAUzv+<@@vhz2 z=W}N~3bS2JS^vBBKq7+u)#Mrxffge9DIMW6j{4JS53de&!IJfgN*cGGO)6xUz|=f) zrs7RU+D6IA#KWx5vp{Z5&3kNJ#)2YwXvqAWAE_`#W%-+2IDy7*3#!WiT964l(1QAH zep{r5>g?83eS5dRPG2iJ;ot&t@y%WuJSr!@VepDL7rRx78=?U4y}BbR{6CnXe+IrB zDI?W9dYZTBrz>vh+`-S?P=A{rcm|EtU*-j#VV~F5ZJEc5G-TuRfDSw-n;^C;oD&x0 zFZ=r4+9~sd|2B^101M?!RwY*d(=QHp=sg=#1QlQzO&4dMejE3{ZL;|?8^dLbk<^phxB{){+_fmLK$5)E! z=nk}#gY|cc5lqLyF#RwJ!)6%B)aurnle(CXvky!n+b!TVHT^EY;Np`eu%ep&87AE? zGCbA2B`0;AsSF~iR~iG;d{tB+U!UKtd0 zz>&s~IubB8Uk?wEBxh|7(mSXn8KZ7vRq6FC}fh z5sK~Pk3`=##_v;~*nM?hivrI+*MBm5JtkYN*E$>-U==&?^d(JHBwmi;&70Q{e!D4T3{5+(h-7~}$YTaC;>dcxPTcmY5j3!da?@qa%yRI_}T6nslOechn5 zpJeNQ7+YnXxazvTmuvK??c|^3+oW@xWSjjHdpPL2-bCF5GRP0(gHC={DdH`?Xqw@Z_r- z@VY>H^0i9%w)}uJ=d?97;h}>4lD1(jm^HR1 z97_fV>JJvpY{_v~qT3~CA1z0eMAoQ3{tnE#ZO#7@MHkMT95+1$jHL`G3d!=RE)?!# zN(b|Vu!N}STN=Cm`A^@^+LxJ8h|AS0DPhrwunrs?d#%e$afcSBqBWV(h%WXV9MsLr zOC&26rs%wExS5an%S$ES<#49$>{N{@Gpsn8%bC$t+3;7@(!%L8qU~t`5I7S<9GDj0 zqby7_;aK}58tdgl(t*R1-_f@IiuV3jw9vnzN&Jo`x1^R>@-J*z>aOUeTJke}@lOp@C3c+MPr z)Lhm(pv@fDGoKw*<;dpy=LNHbM{Vic?LjD__P>uabI0|Cd2vBN6q!IlkpDH#{N(Cs z_m|u7nZCBiDi_dWn9nc6b406SParY9@Q%{5LH^V|hX$@;xkO4oAtLep4m>E5#NXBBgkB61sKfh&8DDx&RzDGc>G64ruJV)dRhY>LD46hU0siF7IzjdR~P6qeh5iuUJG0;IQO-}(fL@zG#P#U3)Z-kq zz7ezDbkcS;Ic`wO+CE|=f}Uj5;YQd1lhq&d$WrN#ixx`?<>z{FUPy2@4ROW-!}-GO zB!w}JdftiQXxZThI!g#6#JdO^OuaPpD=&D|Yaq|+&LQm0@sJQSlsO;=ggFRQP7EaM zwJgk8+V-0394eHR)@cnf47lnBz#JCtcb1^=0r~8`6(JJGN&zez%?Tn<0kJ;f(u+{M$%Z9)$wN zr&!DLP<{$`3`MfVgG%~FOX(+H75yNOQMF^m=OK?(Z|`Y*jM#(t%c;gU-e)KIRUdET zFvprwpIJwyufGl+P9i(;-q_!==Q{yI9@<2A-H*v#8U?88v=t_c#*RRRU6UrW>bJUi^M0qGD#nXWz zZGHZsWLOEsfv>GB<3h*5Ge#Yh40pLz#eIoQY(5Ps5{e5mkE1#neA=>_)h&C^_}Bd^ zB>jP2T0*|`d7xNRDDYNaAlZh%GK@g=*`XuAB`IRE@*cJmazN+?8oBF4^fJNe23mkZ z)^DK$D6IV!dVm69256~6+FcH97BS~yi#^JK9|}4hr69_dU2af)D+(-gI-K-ZRt1Et zxhZpW*H2u-7CnJCKK?MN!{j!NLDfxe7f2t%Gd!{%H^U|Sy~j7~s7WYIq;^D)$lyGr zn#sw#MU^NBQ0G7SnmmQA_pluQe6a?rGep_5&5+w*okvg~pSkoW5 z=vRt^A|yJ10q($nvyWU5E92+g5$vGLP^)U#EC49qlvp$M-E zs2K7%Z*6=K7g!8)v&-xCLRjT3QeX<&S!M|;B2+it4@J!p8F6M2ds5xG?(V;ajC~V3 zT0un+?jMtYYYE1slo0Id^%VLDxbQodmNIP(J5Z|Zy$O}3U%~_svkx?N zP7N}-$SmW=A3a(lqr$d?v$j5bMvf|V9g~8t^AUNf}-Er#!m z^i{y@ixLYsLMO=@5uX_8!Pn1f0Mx4yoX=s|#Q8`Wpe8ZtpasadsxCMr5;8z~V0h$k z$@P6|YN>B(>ND_%(>LYR7Enj`RaA5dZy^7}DYDFTUDp5M>>a}^YqquF*tTukwr#s( z+qP|^V_O~DUUAZ~txo#Ov(Gv2KKs4CU+<5qS*zAP##&d+F-v32yFd}(<#!zML2JrL z|0!YNWcM($v3Z$VTHdc3YMFJH#j_mr3>g2IG^<+zt&Kv`1e2nf6?==!smq5EY9yoY>VNpC)W-L30Gqz7&#sDs; z4#HZO_1n9Mhh;#`jR05Qf(IF{sS^)6M9V%Fw4WCH-yn=`3(vCOTueQS&fiF@e~`=n zAX)xFV*eLXp7P>bZTdeFQ%**nWyjy}e<_~e`i7hR1DE*+PX7=5U$B{P82RCUz*7Iu z@Baf^d74Eqg?&K!enA#E-0jWNnOGBKmSMkn{YZP_t?>=U>i+RFyq}!5+)r`VWKK|1 zhK5qVv1w}Xo>M!c`Dyi05{q23vdqDaCuG8tPut?=YDspf_%TN1J-IhdT8ekUbj`Om zrKC%$%PQP``$^h4L;LRVg1EDDCSH&XGxG>^nyC3=y(4CU=MDEw-oiGK4?bG?2kn@C zij&J)U?Xv@oy_fAUn-ry^Y4-xqNJ!EA_rf8hY0OE<=Oj;x+-XX!k4j<5$YmBsEq&_ z9;d9o#VBIMm-rv?(;_B<(^wlz5t6IFr%%x@T7(z9sXL?edQ-xYigmPs-Rcbf z&~Y_H5>goJ5nSn8={d?PsAiEk{Ff# zxFoGwalE}&q)Cfdl{>6yKkt-_yQ&9F_<&_6fk>!9&7`qgh^b4&f6QO4B&SZVaD5YS zs4NLmRys8Y93v;|2TLs=k%)_$QR4_WP~+sLptaJlM+cI0R}^zS6ZMyoq)|q&thpyQ zJ51e|cI}D~Lv?cc!^Nrv1E2E7fKMSS=klqEiM}a!(pdGfT$9_`U6nP7{C(KjMZ0qF zXOa*kaG)(`oQ^v2Ygt+g={?p@ur-x-YEOaubMY8!&n_~)h-n=;wS=ILK?;oYrJ7jK zl-!nV0Fi!qg?^TgKfajzyXlKNB2pzpeC|jfKiqBwwlR1CA%^#Zuj7qvaqBa(4c1|6F!A3Na8 z15`EB*YEzua+$gCs1oIJSiM{nuDm~n!WyYDM;Q}fdz<$Mhf`rwGRDFzP?;$(>*P8e zpYA(uZ75I9%_I@CFHeiedGB9`*fyM+WZs;U@!i&ts=YQN?%NVZHw6;gDW}5b!rI|A z9<(&L1^IL`!j2PiG8&J_iuBE&*w{{7mYRvS5)-fJWmM-BBp}k2WM+saVhtZDb&)58 zQg~ZqY`xMm>ohy1bk?f#D_SmA+$*_k$GgLy9Bfwm`OJd_whg4zNJ!+cx@w-6 zWlrbN=2uhgS^;Lwp@7(c8=%Kjn??FVY0!ECQOLS@z14s-&66VVi{LS~rHqfWWmQi5 zQ`hDv+jl9RiL+&E(e8rYcnJwjIObsXPbHf()7^${n0LGFBXj5P5 zh7L?yIjiQ$kMXq(}z5GsN1tX(wCP-9{WQ`_(X*@d$IYx zYj78W@*Vq@7nj&Zu5n>n6Sd?CC@~4FJtB$w#*%O-Mjo!~?Iy=BHwL-Zc*gXpGi$Py zI|i+>f}o{GKDATnVZ7}H?Abbt=(pl(R9rO43Ugv__6$bR_^QuIO`FG56z`oy6>LsE zO=GWBi4(oDGHD}Ey$`1Qp^mh8LnN%W4Q;L9+|4Pwd?L-u3x9v;`#1G_%*3)Y%miZS z`_*h}-J(?-nyk|A`)M+suG?kTTXvF5RDh7uuavB21&U#<{o3d#+Y}GJS==9RSCGD8cucO(dz1SaSZ#>X@A$ z0mDBxe9Y+PYJmE?-Z}I@vrnhw1r;l+|w>^S_IjFT!H2M(amp3CRto950LN6&_?JnLG8V z$VtS<1+S~GTC9YQ3aXzK*<{0S3Mp8LTG9%&u{FU&94Se5&lFM;DzE*CvA3Xg=}C`Q z$1F_;ULg#ml$2+h(Vutbdx1Dn67`%~@|tfJZ`_W!t4D<c7@Ahzl<}!#-7L|-!RJ#MhHnqq9|F0va~|(e`Hx% zCb9&F!8l`hkV{&PXKvV(Mpuy4t&aZrJciLm!GJeq@8R=V#0)h6n>Ci~tx9;_5lg#Y zqkk3{_xY{E;zIoGgJ-}mTPKW*9ttUSXTJN@dqd`)S7OKOrD13mcBd{&uQ+p@>@z4s z=~#n6|h2G5%T)8r)ShFl%76y3<(VfTO$ z7nVFYC=q{g6)YDDCHG@@A{{D2!&GkvPTF+hJf9%En&|F^Nk?`n!x*)N;CsQ#NO#u+ zGk-~EKo5j0SBdro?ob<@NS`ULQSJ*#0$BIdf@5-l!>cRp#?La zo9)k3GW%M5WA*-j^;Bov4%&S7iV=yWGPn&&Q-cX%y2);I>p$M3RCIMQa1)>0rVdp7 zL^j_i)nf8$8{3?F+NW*Z!t`^)-I0!k&e$gW%2Rx5zIZTG)gK(8j`oq_B8GlU4H=HG zVz3F>?->_GJ|pDoWT0wd+udeb3>;Uy1unJ+Y+J^6#u;Uhne`>pLr2{pq4GER2}atv zo4R?{KrT}(*8qBW2^eJ}z(^^GSV*?#iMB#V@cc|Pz*9qis4Zms?%F)qtjL{ZCMmJHfrA|krqbn=@G65AVJdbDjUdhSU55HiYU{iA(33Hq(Eie zqcG363al);u~4`GPgPl&$eewwi1AQlMZ2w=tfoLyOmQ|BF`G*ReBhUq9^n(U`9hH*8V6tJ(F zxy6$qHSvrMEHlvZMY?g1OS_{3UaVF`4-Z+~}LEH;a&zzi6$_{2egOkMkn6)0X51;zrFv zsREl48HF4SKbAXK3s(W`({k-`ju${`lLE!=xABha_jv<>Y+d32Y@yk^-_cT_zx4-T z{M)R*+!bZQU|gi*;QAZ^Gb6g59YNV)3qPtx@%O?z&ZVuOzFwlhtR`k@n05_$YUu%7 z-<>|{BH*J}a%cYZ9KH;!9b7Rbk6{HUyjf;-kV8j3JiIARLtaF5M521%ace3jpMfox zu43sCRV40oQgCs{_Q0^aTIXERnp^i3vPfwY~usXQ(r zg2v$iip|?^_1-O|u6Fc2C5x9wk?DREMGARl%^dwZilA1a3dP5VeIucpKH&wWJ*@tPC601AsmFKhG~)>Ad?MwA(e zil?9tt?bF!B*s%y2?JnDS7|fGH(eNf8LPx%vQ6SXYu_}>k{pr%=>*)m8vYp=oO=~H zuZ59C!bD^|k%;qSiQLLXl9)7g#@Som>7Q!#SL@qOx+_iS36ea;4lTNGIRoxKO%%lh z^UN$Oh^Knd#XyH@N)?P_>>!-4vJrWO(!V9VE_}%h;VG>R*PP>=ajSRPNr~1Q9AImA{Lht2)%_#44S@l_1g22W?}5QO@uq?M32U~(TYy|KGt9k$xF?D zQxaI}P~wR$2Aar`d|X86D?uUct5F`4?49WFE`#C9*(k~}BP@Hs(p)V)+^)X%yxil> za>DXlhV@r_&GNnL3=b%HA!|7lVz|=NCXJg}{OCwp9(X!*S3_&6LTR-*Gf(qCf_BnqvzJto8qbe zSLT{(QxLEp;(I`yA=v5I^U{7f4ITD7J$la9|F1bG2>9WuQQ<`mhtGToYd$8_3oIC6SRpoA#Xx0y5C+b& ziI|~*QfD(xP~o9o2<=?zR5MliU$hk5^u7*yjRr+oT{P<%Gy1C6G4GHSM5N?s$v*^) z;gDGUiv5C^BTtHxCKCk%%OW8^F2>$a>M5wy;HXqK+FGeBEr;2Akt2{%uArg(UiHs&;qrTj&EoyzQhklc>JOpqZ-u;0zW!E){=tKX| zC#AW7cc0zWar*qM>>qh^m763Ad`ha`y3sDvfMbRrC(juOKE{W*aH*99!GB1zXCZbA zn%6p>9-!*aJ|+_8WyFA3Wm@PirWJo?nXJb}nUQd@+a7;8$w5iy+(7b&&C=Sx$7>WoVbIZT^mW~9WAbQzCW5uZB+;bp z5i@iss^PuWq3c$Ntc`|BZUN5CZn?3Q`PI1girhyM2|`|Rakp!2rKV<|43CbUK^B{mfQPOE={|2&jVJtrJy-CMtVVn^@)xA_49 z5d&F9d1L^8H@OHH5D?P0`Td_}H+FRVr`2=SrtCMFka{pr1(ABjQgbC?Lo5<`sGKdW zK{YN}MQd$~(WDb&kzX#llT9@2y`vRayO%vXcv<@W?BKbDA^{uR^pxP_MrqZp+cRgX zPoD?0W%~=i%8Hi>s%EdsefV{e?HGoa($oDt#Bwpi@Mlg zT4&V~>{DT&(-0*ea}YjY1EMSHx8F>JkM<+tQF#GSIcvD3CYj(JtU2#ZiW*t4onxWW zz3iM`-Qz5sEz?d^o}o1tTmKuOn2H-0XtzsA(&;U%8Tf9*0HP8_K}l}PW>zA1*UO`1R9HZ}5tlWVQA^d0jL;@abe?{~-Jlh`$n~&CQZ;Tsw*0t?#R%uzX8Mxz; zZHZ1PG(T)3vi0PnJ=(e7-p3|NTCl?Fk`@MA4RrKSr=VUQX$9UUw>_YJbVt0L(DG{) zK3X$iGH=@DRAv#m&?5z!)f`vBh=ZkvLYN{iu^8&i^4uzqn&Eri^e~&`AO<+oar} z$={Y-NDf#6(w{B( z&vp1i2;NmBCAq(=_j-kazB-iUDNtaL97bpMP1nay_|}%*;+Cw#r2@>Z#p$TMsS#hC zXo%MJ;^0ZX8-d%*X`~|x4%)T&)flrkuHSrCm7`?~SLi#?z`Vj`a;M9@`F?$A?jZo_ ze<&yJ`=&(_>2WUc4x2oW?rMaCs zf?H;pg!P9mkT^nF)M6ErfLpb+wzVIQFz?MIysel3! zk93$>j$h$jc>t6O!8UBQ>~xKXAWIMF2)u-Zl3g6nD!J9!^sx__u^%6)930r9_=a%F z)rho|=bQ!EgncjT8m+RySxy%uqM@yZfX$cgkE&9qP7~)0;&dK}MzMG`bB6^9g=fK# zw>|h4I37^B_f4U=E_{rGjRAwJP_=hij)Thi8LN|dCGu{!r>HhT*z!m_el)|2g1FS8x#NJ zePyt#Ys9W((DHiC`SDa0wDxC>^H!hn1IrV9GUgh>pX*VRd0EJ7q4_)J;6Wd>UdXGl zF~~uq%dg#P51opFE6=u&)}Z7XvsqtcG*z#8a5JCRb`|3my{e|RZc6}tb5#fAMwKHK zC{2&b5oXvodXy=Vix7p+1nY92Djn7VMs?EMrAz}`DkHxk%Ph4>+z9`&*A{o;r7M$#2^j+7j=*1^^vikhCpD!6c?n{W5 zE8Rj*T-PHp3B9Aqh0fH%9tu4j=ch8koe1HEjSX}mX2mBK86XnN-L$oD>J)zIO2za6 zyiD*hC&}$a!FNJZuO#{L+?i&|)#f_kT&yR&iZLid*()293(w#uub2}Ub+K=IFtaTB zJ@539rmge|HRWSB+d+%Xd~#8mMy5X8XXjIL@vCmFnQi;DH!*}guCyy&b@>p3_f9pq zN!Cuia%^>Zex!!I9@uyg&MxXo*<->!_PX|GT>tHLb=aIcVO*z;)5v%|sH)o{)4jPe zl^YMrL~R*M>vG}lb)>>o7ssY2L@jTmV+dz;L=LHf!$L1GLM9w`q=~4kLMG{R#CKvU z)5}M!+BoOEAZj)%2=}sS)#1yM0j1Koy7#3999fawuS&Q)LAANoTPJy|F+iEM{S6Q0 z$doR&Ctje#nIkH)aA%+cU|`fve`;Wy+a#fP{so%$U%uVSP118nEM%HewKp_-*<$Ub z&pd9iNk404tvgAv3JGo7l0yNo#2QDg=FD-gU8&2!duvm1Sh4BekgR1z)>wf`&){&S z`_x@aa{}kO=Qj3WPnxi#eR-DWB#K#$K@XG6{}tCRkBt%d?S!DJ|Mmx!4ha;D(z*7+ zis&p_w{>;;*i(3-l@^oH`CL|!1t&q7sI8@@s)^CVu9mJ&h1L%qAd@_A%MtoStA5{nPn8i zx>_Rzz-<84vY#&NvWe}qQ!(&fHG>d&U{Gm|TTgL%+NbyC=cS*AJbYIQ=RopE z4_eKph=CGh`kQ_ak;Y){$tK^hs-;JGqP9CtW$I#8R)4Nq6Vjk{@n(f!vM`dX()(>) z^o>vSIEIt4%J1+>Rz*7WJQOlR}!8Qcgv3o;JSpzrX4Q|8{wOV{~n zP`&(&+pE&Q&-pRbchd?Oia_8}F>2R+*&Z!aw^sA(|II;z{i)Ht>}u0mw|UtHVgIsE zvg&+1;(=^1V)H`yJ!bsp4C0?rh1HcT81OyeY=r-hRinMDnz4!Pzb5*>)8!R6nXtxg zQl9aPw}=@_>x+q~TyxmC;L7v#$LwlG+|9b_dk6ha@Y@oYt{SAfZ|!KDj%Y6%Q$&<; zS1-e?N;Gg!8b9X_4f6vQueMp!c}z*r(R&Uda{4Zi;>G3O8V>seuI$+KC9Q@{Q(+W% zu2ZQzJWkG1uB3g4Iy4Y!PO4@c$K+dP0r?e9qrb9l1mGzI%F)%kF8VOmMKI=v(PfBzc)_cI9Y^S$cCxXMWTXsLTAvhwW+lTUfaeNb%S)+gB+y`<0rJ)<1C8y2PVbwaWt1I zcTeX%g-=eBwULxcv&HQ4BeGeVNy9f8!}X+=6@{U%lRz`^X>I+9bzK_tGy7DRt68mF zhK&X$QlG@F53vtKl7PZTsjfQw;dSLSaVLFr{CmSSm^OvtF6Fk^xFNuGWf3#+0Ho}hDL4-87=3fk{# zjxab@cZk?!F)DzJmQphBHZ-}ILasp>@*)bgN^6KH4RmoVc7kCdNy=H|BQE50aG59O z&=YAxL;tS6KL>if0Ul5Lrj3_&F*UZ*VEc$# z1BM|Q;u=1Vu$uiAA_0U{SP&1-5jLZ?dpG=QE-ze+XG{xa1T3>&Yy{pEt|E8*1lf53 zd3gaj`g+r|f*ITs%Sx~YQk^N2nV*OX-U^G%3uq-{r{%>Z?tTBibLl)XW`gMNZ`z^% z*UI0;+|~8_ZODJE{983PRW_xN{C4Xd&%DCSP1or$Da45oiZ0>RNj6TBmYaB|#aCFH zR((I8rEp-Q;bqB#Fxe{R9(#R!pRWnYC3%TrBp8b)lu_b@PRfOPwZ#mt)9(rvx*wV? z><73it)#oJMNd>HW#ytsqyUOJv;m&5pQF zGSehg(sMrWjf1(d>}4@7CCA%GUxppRg4XFmFk{33dJPWC=6m*Yo&^|IlomwcLIfFi zM({>emfP&Lb!#|u^enuZBQx5!Ej?CggCzEP%6oIrG~uM{TF_QDz{Wxcefg$r2RcrA z?G?EUB%Ady?*O)RvKfY3&mvYuT!=2uU%TOe1R@L5#>j)H3V+GW$EM~xRCPJJX~WU& zr16_I3&>tg@Tl;TFDWfO+(F1^&G8l#?vR1b!zD8B(Jz?aOaW0bZOJBrmc2L(0ei>0 zgeC#r#8h8`UFf_BaPCku^v87+r;hnmgW+(lkPKG9I_JotuFyAN zN^RFv5#7*3RF)UFqv+hqVZh%_aZ-DaMY0#3_1oS_y1_x z8NV5mKbN~Fh+DOzYDZwetQTO6z>#--0?_uhYoQC|zl<#sUS<000UHUyf+;Dd~zJgnJ^GoULx-G@D^Bs0=-)z?Kg0to04N3~wl*H{Kr_tAKktat#|Y zmPcvKEmnsg@KY#}^h7Uv+1)S`Y<5-k!f1aq`qGTAoBOl)N-j8%$Vy)xy0PK~|ZEkOu{dtC{pEN+<%W{dZUQWu#d zmqa0xX1x7)f|p)K5`z3}Quqz{J0aXICjkPtD9gH8&{eT`&=n-W?k2j1OoV(P zG1YU)&`_rd)hA`BD@KcNn!K3$0iHb}e5gp^&-3<4SN1lhoo4v4N!_fG0BtrO-PG~1 z$=6y1;cmxU%|)|CmUbXMo4sr-#GZ$;H9>T=C5zXScSRRo4Sgf9CG<=ecj= z>HTK$Y*%vwO?JlvPm9~?Si;pz@hl+VTEpR9slKVNho-tIK#K@yuASv-?Puu41q-7< z=$|@5zc?M0p@tC@pF;&eHgS@nvl313x&~p|CQOvrJ zW>2O~0(h0i&fp?7O+^sbTp$6|y`ER!-0)3nI+H2CJZG<51i|yvDgL~_Ygzn3bzBO; z?w_Xw=QGGFZ*Oy)@|MljG&JH8&6dX-L_Ke~KHVE|BdA4SQIz z&O_JL4Zg2TmtAvJr$`SYVT)UWOQLWgW%XvPCqW^YjG6Te$CEiW zu)qNV;WVuFjL=>9h>-BC_J}UvsIY4k;!UaC1h>*x?h~V&XFY+2*o2TD`l~o&H}NAf ze1}1(8;r~=$)bp-aE2g+Wx=FDC8t4!skLdO!60pH(5)G{RDSLEyg-=pQ2kRv*7lh? z!2i}AGD$^R#0QVJ>TTj+-XH@K5xqoHLMKh97#0EXs1OxEHb`o5G$~k@0+le~WqHWP zONv>%xEExE*YqIcSvoK@JPnEzIyT`2SB8nXiQTd?IlyHZ^`>a+f0ZgK>#iq&_E50? zXEc#S0;k?C@}K&Oag|sYQ!%86g4I7_k*nJDlz(Y;0yt4|+6@hUd_Dt)jOylfWjCMn ziM`J)MGDbN(v1YNM6Vtq7e-L6ICtJDxD+no#lCk`2l(L~lnBz+;-&1Xvj_28m;XwOM;tHcObnG`@CbLD*y>*P3C)WBc5u=9?<=~LE z<0^I(q17!B`jY!C)x)-!=W8Y+&KQe9*+2+=VQ^+BR05f&77=PikAXpaDg%Pe(%$~gE~N>YK{xxN zkPU???%wZo-|V=|@t*{w`xq{2r`c_`>6n|BsjK0!`L&jol67m;DeujNf!x~4%Erj& zvrUA<<63x;N@y*rD)PIzFCEKkcr?wvKVR8=zQ44$wQ)S1T^7jp*R?+2fDfLEwLlXMVtE|@P+o-dvn;bT$r{tLaNO`1&9_`aWkq#;ZAM!crB6kJEoc{gFxHYZs zqtxymO+OYWxG&Gs?5Yi7lAe%uKOHx=v9)d@m5kS#oMP;^eX#G{kch{zBE6S<^@_5! z6(jk)65_-+gSE3>gTErZaFA>6PX%!Sx=GHHPJYjoh4qHE0_0|`+;DjNYv`nqzHd#1 zI!Y*;7jI}`eG=Gb&TCsZ}uZzEUm>YwI-{4(T7zT;1-S^arJaae|(BM=&=fwR(S zwZKY3@^nT{Yiqm8Gs@Pyc)jyO-~`%as0JlB+C>&lIOf0+Er3RI>O@6a3hcP^*${75rDylX0*RZMu zRlMf7JGu^%2>6ZX*37M$rG0${FYtH^7JiS6&N%ZiGlIT2Si$2L@I?-hOGC;O^F>4N{(x*8oZ8M-ZG5kS#v*;0T{PM26x+}DCsb2) zz@6zBoE?wlyb!Z~bQksluyA7JV8_cstaB0Z%)EEk3Jtr!X1jg6C?uk`oqTPc6&LB* zHrB$H1CB6qC?;xALCbU_;4nQS;|F#YHp9$*H99kge3(gw=5T=@*p|LZ zOk)Be?=?+LSC!0gWg|{yvnft#ulbRC%l%JwHa1skFCqvmLBslijS%{JqTQ9Pz3+Zk zchN^|07@2FIEi3d;cix4-ADlo9D03u-pps}1yB?%+IGLK-gds7#xUahi(5Htu84^$ zm5J*Sv3=!KD=V{lfC5d?)pN1lu#26u@+Jeir;}AAazag2`>^Wcc3`N@MY6KipcSAX zQw>Hn?xl|okm2=6yS~4xs;zCjLmkx}_z5C?PbYn+Cy(>K@?i>Y#~9OC2?PgiCNx8k zO4#G-Q(3KV@oC)46|M$#V~oU$8nc^#Ct#v3S?!xlgxpkm9)1LmI&`ub8ih*FL2-Ou zA0QDhmS-7WT_glKmK6*a0p9t1y=`NoS?4qX2{uqT@e;)|4*`#7W)-Y2gir|i8J={0 zevao%R2fB01gEf^*AN1U2>7#U-{^EW7PTO$JDZ4CK(_F^?{xzo03aDx>b!}p)$Sd2 zPrq(y$}@LA7>3T6Z=vTE+zkJH3;^;Q6*v$##zR&RN~JO05RE|8Z4F&(TFcldcf++a znGl=GAT#{ag7tE1WDKthuM3g!L;-l{)VmE{YkVC#@iV+l3V)@fn$38} z#-TOfVd?F9oxC#%F;O!vGu|w39*FUkyeCAR(bhh{GUKvar(*HXCH`IpUGUVO7`(Cx zm0r-;JGJHg2xrm!;wajza=3hU9uADKBJxXJzu7-Uhm&+ zyID6@uR^5lm(X$e1U$JPtV0WT9dcNmo8c1Sg1zfUm#s=Vp0vbjjoJ=%J+-;7=&Y4u zwf`yvX=N;jW-E7$jU(h#2qvG);^`{rOf1fm>&de|S-sjUEvjDrD%sglk^ZbY$0;Df z%IXw#{`79a2DG(Lk~6z6cR&>^RQmZmOOs!iW-`#x$wsB)q#RR63x`Rj z(H9HdPXd}9|1oQ6q{!0-mXnWmmz|wms|>0{Dsn}?Nt+PI76O-TAuT~BWnocHA!+t1 zVR!!7&*Y}78*{bkBb0K}fMp(MhpG^U3;~B_bU2LnVBa-S*KHqP>K=qX3PZ1}1pAVY zd+t5vC_qAJn+G;10?dpt>_?MFiYYP}&NeaFx_nY`kpfV6u5m?9n}qfGb`^1dT; z*iuphR3ZB!&1RdO3nH8xzr{3G4xd*tI%bBJv{R#e7K`@i1r;a8;SI1UC@ZJ^mZev4 z{KxZEGdwPb_htfK<+54LlhMR{PtoG(nLyIrtEJAc=2A&P3WY+h=d&rI|JEp4oD+LQ z_stNqo|zXxTB`P+EtAbw(+qXIpN?m^WXv~O6Jd>+r9yo(`K)6y6lq#*WOn7H=;^Mz zeO3aQKU>ewX=rI_QxKhFaCLmx8qm?v8AfI!&#;Av;HO#C?901vy2mVLv#dVJkq36P z4tn*Ctb5p*CIkMQjv$VFF6|HHQ-+Vt)3;@{of4XCe>8~toJ4oFeIrQ5l@IPnT0eUv9gOtxn zQQw08I`^Z;F{036A00x@kVSV@pC|iQ70M(uY6 zt<+9Nv*}3q_?d!75u3d1wO2ye>T}&aCqd;-=!gRrA3?IQu_3@zYj^m~L+3(`FPsSR zF;gF4Uf=r_UaQj!Ack2hYC}vVY%o0E83R);pUJflKa9S#Ef~-2B%9P56mJ1yHBfM|3u{5a|PKI zF)dvEJ&|&SyZfgce+7(+p56@;PvA&1qt9CIITjfEnxq$Lv|QhEG$a3Sik)`<2qme? z`+%a~WY$~y+XKDqiadu<#U4XaM+qneZPG*yMZF# zUFhB!vF_I_jKkmBDv$MBcH%M|>?qa(bfiuRhoG z$6kSAzmcDrZCtZx|H|2#i^55q+krIs2?G05-$2Tc#8OyC-}Xm`{b($4hWt;#~Em=?lkAhpbAh_{A9DCb^AoLc*c34Yz8z_(zAi4h_J&8g=OushRXp^ z$TS${$DLUWBrv;|!tMRM#ye=u05Frbn~Q$!C25OFTBuPHA1_qs4pzzU zt*xy9ntZ*3KB+BB<=02O`*};aUWl;ZzqiXbc86W?*OS4CQpBZj7>|En#{ydB{yZ7# zI!Q;F8e7~Sp^@k<^IJb!enhI_*D*yJh$;kLZ&OJS(IWfi7fBIblYfU_FT02no4-{l z(#W*iO=;-1nv|v8P-nQxXOw4~2)+&=US4DM5EL{K5- z>r)&(AoTx`d|_a=03Yl}^xKDBWN7D#iytSiy{CxzM1`lxWwKD;R&#yyEtF&OksbAHz@?l1f=R5xT}kZ2@f z!o9f&ObtIh_=r5Q64`#T`i|6kOR8`zb8-z~VvM@hi7cu3MRj;&Txs-U_0Y(dyVDY|{fk;lhm{@#E@9)4-`RE)~IzWUG+-Fy5Wp^|X-Ur%_T1wL9AMj9-Wl4I`rm zXx79u8D3!zN+z#-V}hAgyAq>cPwpbRX#r$3)23V0&MXyNEO`HZFTB7*X0Iy{CP9Pg zKrnb+K9NAk4r-V;@eW?4a3&agL^TZ<9KvvO8Gn{dO7fEqg=Gkjole#rM{3b6YYXX>KF#$RKv z14vBhpjd*1K}J#Dh;F3Z6qZJP?<@5@$3xa*FLBmnY;p!~>rSTp)RYG2#N1 z-D-XC&*RsmZAyJo6@eOiz4sMbGcLzV($ps*E8Q#Q9HFE@@n8Vx zF~*}1XJaOrj(v;?aJ&8sX%ppN#1MN{BpT7V;4X3o`-_-JTNAZY-fQ177GgmnE+eLX zJcI?Tl}gNM>UX;C{XOk-wc(daO2bY-#4MT7z;7vso^|8kfpt%Q$2VhC#~T@|gcAeL z0b*M8`2r{##6`1My-c}V)odXs;wDZvjEZNeGYu0LP96}B!KaX_ioLF&O8ZRSc3Dx# zn(!nr<~gVsNE4>pY3BybL^K2AEkX~kGaky)Yj`ItU$$>vg*)&SUT@dwmEQ{3sx8QH zQC*uAd~sH+#eh+`BXDw3eMm=#7=p3}?&Kr@vc@bd3QYJrrSp(m0U>3=Tsxii zrR_iTVR#k-Mmv-x_!bE!<~~I}e?#3BGu4Sj&P7X-eYr9g*!a^e1az5Q{&Z1RV20DD zXO{>@429c)_RY$J1&bU!?2?Fe*GmbWRU(48reS#^q632tyGVq?A}0gA!#=*7D2z%Z zr{j`P!8sGc1-Uc+>9i+~Ejp!H<2V6qdXo`eq!1~2_A7TkJmYSbC>b?QH_C@74a*FG z16b+w_D8Ir9b-7+1sN=g?vgYSl!I+{W!Uq$@5crORE>6NMm0jA2__c(oCv zggHUzx=e?qyyL$|ID%F=Dj=!Et~psTYd{w*%va?q@_OBITSovUV`IY0T~bh=du2xz z6y)70h_6y@*^4FFFh)sa#D}2`*~z8MpvIDO+s)LB)Nj`7Lfr;HP_j?aWFw)F4>`#< z%1h0XBR6&_L9}hLH0muskDl>2@xOADf*_QGu(8zI$8~?TzPbhpqA{I`d6E2obiHGE zWlh^H8m!ppSRFenPCB-Yj-8He+crB+r(@f;ZQFLT^Ss|V`#NX8&%Ul&Ki2#)XU)5+ z#;BTA_ZZ^Yo;R4CS3#LTHmmM($mD!P)~?CUH@*_FPu2n6>n1sK$&yA2?;a;7!XtFk z`T6Us)sWw4sSw>=Jo@Hg^M4i2*CSgz779s5r#J|TKg7E@W{)*sr9<>UWVh{}AAMfg z7rmF5J`dx>@?hpRI93MU)6jt~dTNLcW$L1&{s`isA;Av%o&z91_2=kumN%vz+&y;6 zr3ME0`}!L_ex_L^w?c-=ki^vmdK>n*j`8A*U5=@iZ446nNLLQ>v_^z=UFzpx1>PHM z^fPoE4J@Q|Jc+bQ`9;#D12|qkFY{wsxFS#WQu+Igy5U1_+pbnO-`9O=Aq=k4m`$2r zVf?pV$5U{TAvaepK7{ZqG&)AC+uSNpTkUyBqJN+%u+(+@AO&JP&0xk2+}D@BPJLda z65<5+d>x4WcI1yqs#DsWg!L0@QHdhWH=r-)8VD1*^u61O;9dat1+>Phn5Vj%gAxI1)TowqfP_`N?;+)wu&&vs3`f_pcwF*rSgz!^fk3LZ8Iao)7WuGVC_$Y5YwtktSI8O*{{kRp^RD z9qZ?#tO-QhQJ_Mn6b`b6kQ}U4PKOsxMmF{C)j0d6V_Z62I;!XE$zsO>iVWhrP-vX$ zm@xleP9>9Hlrfr8OMPpehgv$W^RCmB_L4Ju$2EF z{?K>_2%nX3{sVsYDMrJCK zL-vM>1blXDjM=MHIBk9CsR|mz>fbNMKyipfb_#f)F(6E*=Dn&QE|g#yK90eb;XdC9 zKXMI;fltCa9aJk*m+G~@vJKT-R0!Qx04A|(Wk+98CLQI8u(*8hDF~~BvkKZSAuFDa z?Fbb@V?-y15};dArCJ3XM^%|8H13b;zQjuiJ{RkcaR%cKZ4kR5@#0g$8)MddLbcw!>mb%K}#tGDn zlLa0ju#eT_CPhRZ`on-~JuUjYZ%%|_`C$1m4CTrRA^-sc^wc;e4u=~@qU6op;B#(@ zY<71JNRdNBu489S>`rKzSbysSpEk_Ugux%#*s`bfB79+XPAOy58iFG?wx4?~yDmU0 z8uVG}kin(-j-_&N@w#22r){`#rf55^eis@%dF1N8)n{T(9J&--h<0;;ady!I#(m5D z=z%-i5Ypg=6jJ83CxquPGO3}aSg8qpta_k5pi7K8&XPVbxe5L>K%X?!qO3$4F4($A zdBT~xAEp^%1e+?vn2y08Tdt^G2c|m)w^Oop62}viA(J8 zTLB6BYdI)H94Jg3v&ptL6-fQpO%sOv{`-@Rwgrb_Vk?}P-f5Q##-!@{M2!4(5aj$M zpoO6)zZ?I4YJWTGDQyL_nuh(_p|Sh!KS_u_4(qK;J`fn&g~8RS8{{ux`JR;Y+c*Fc z>884mvhPoKJ?y&Ot(`8swBEsxKiKDcYR_BbxQD+>lhyIhPH(dYyI%6ug^TMQQEBJ} zd)cHx8ZL?v(><4!FObg$@i@Yfo_r=8GTZhCq{v3%qXeZ*S{B${7Y0yqA%GlqyP}g~ zz{~7Nr-Dc$Vu1`G1Pl`Sp~dn4RR#ka^GwAIMnr@CwcYPhfzTP^Y-ina5tc6W5-7M= zecQafRM%-3j2{9k}09 z_xU#YxtD918l9Qe!x&T}1=$Qms(3m5yS;qn1!QsvOC+4JKs|2aeRG zjekW;YuaIVc4JC56Bh-NY6#x&Hf2g}f@0@D(=n{d70|;-ip87`mVh6dzDkS-oh%fj zfC>LX@mzInpA#(}($@-hNA!;N77`A41?BU1H0cILc*YTbLBSU9m4XIm6l|e91Nis| zy2&pIW#{iV^IWi5M-ka6O?*998cA6dbi<<2^zs$%wW$|YrCd%kIFD!bMLw^ZA&^Mi zww)e=dZ|xf=sAHfVtdMr;oVHirjVy69wm3LEi8 zF5xfT{CDHEeWb+?(p&tD6gW0~Rr1XU9Hau4VOb!>qme-GxCVZ24WmvZlsvPk5ddx~ zma#>^ZJi%;fZ0^)L7+S7wN&?WrS`?wVq@XdVTe^p^-kN zc>#W__0-GAH`p|0KWKve1Io?Z-_>Sl0SFFI16Lj;*2(66LTK7eNOj#?h6afEY;!-S zK`z!wv0e1v0nC7{|2 z?$NJW-)IIpl;{>)!xnyR@&RQvF+WNmitUyMnpJ(NG5sCJubDs*Y5X+z5edkKFD~Mu^-{krUrxq}VYd}bbiyJ!hQevrDB zl9F-u`}`U&5ga7ufAejwiv&%twwo_ zu}^6Baddo;)ac3&97|qY#5u|7rMN~*M64R6s|@``p!15H*5?rabzDh~6a414d-%XN zH*@;cu4)-=b(ux8`6q=Jq^c)opSS#0FuU!Ug`Icl_(J;Wm&ez76jqY;_;N=()~FO4Zru_Faf^!>Wst%1_(0$8W=w!F8S92W zsU2HD@)2qdfOk3LaMMU^Ue~#IrP;8EbP>h`OEm=<)Yv}2L|-e}*z0w5GnzbiMRHgk z|EZF(CGO>~0~R<{Ifbn24d3W(4SJjZLgS`W>+Zovx|$W;iRRYEtz(VM>(TFdqcrk> z>OUo_kJR<`s8|KewtQyEj-zeX_|DEy(`ClN+6D@o1=3P|6^IGH{99NX|LrJ%<3hhP~wt_)sStg;!sf&s(A z?C5@S8>;nb%5VcEI&C0lY862QO+Wlt_~lo6|K#ykdGNYdE)Kf7wot3OFeK4qXK2Ae zMvCNN;j^wtpbh*H62`^`D9hO%`jvNU&~gg?Msef*JH|i9M3YDb53qPvg9^#*iRh_E zugLc%C3IpBlfdSmjpuy^9^Q%zjpBp^qF2f8G~-8`vA2|{P8mU!aJ`iRX(_If$a>H}$g}wfgbXD_$({(G{PfPUu_4Obe{G9B@?6GOYigt?$*m4H zGN%#;8-V`m|A77ZdbSApAo$+Pp9@4;+TF4FCThaZ2r0pBBY%e)1h*?UA5Y%1i61X1 z40)3C!dr+Rw$uP}KYA}C87r4?4MAeK1po8Ox2NkW4>1zg)*vkv$_lKvwV(da#4M@g zY|Ge@XJ_5uM~*%)mYJ-45c(4%LO;3vI{5*2E&op2YK_utfChcdc#3{cI9pM6R6-^c z#D)XOeTMMrt{l#$_PQUfPQ<3;)hEt7MMI5xV1zPo!Jo@og^Q^@s!RM~*U+Hm&o#cj zhiM2T@g^W3Wq2424$R^^{xW;?qFq*>uPA+%mSuHMDueJgZ&%mGFLTpbGQ(27otz

jQ1gRQCu6u2~DoXj@>RjeXVox6AYxa-#MM;<^l7`V;Nm&50Y1VN0-68afsfxY*% z+4JlwZyR)-*9C3KrBxt<%OH{-nqVbvb zb5wHFG9Z2i+2HI30-S`~e=zJ}mUjT)Dx4L*YiCB&fFKG^^f&gbNo$wF{K&$l{R%uJ2rxBXuf$jwl^lgg+-(r3~ta)!HBP<1qa+kNu z_jDQh*3<*1sHC#U^bq93xii4%WP`!0Jy5&nE)$4L=p@jh`cc85gh7iut=6JxklWg< zZdEr$qq=aaQ2&b8U^}CzXE1i>)57qA0WDczS2j98ubXe+|FWpmV9yq+1;>pu|j^5A!*aG%bamP!(ZG>0$Wf3*y)kt`s6wj#ds+@ zk#rs=356kd1H4xzyXbpd(gtA64>~dAdNxmg83HlBs^nR$;av#8u}4V9&8W9{&!9I3 zvMf+7-Rv`XO%u57d8{DnrMGTl6=Y==`>E@nT>5;zKETmIfu9E8UUwq?bmjaya}tcP zkw&9V{3EoPEXdGMG=le;-YMFjC*fk-V6w60l#9dgwh5sC&aGRfSZ2l(C7{No_F+sR z4@q6q>j(egez_oR-Rej<;?0B$|?}%t>GA&+%!(Pj7Ot0`_-#Q2i*4zeQd&4-O)u&yJ`tHd%a1`LBKIIazaZ&5_()vOwUkw%i*5jM zOTQ$}mlrx#K%uO_tgjf%5WKlZWalB>V;<$XtEvjE~i z>gAebz0m@R1g_#$xQvD0*s*xXf*moYG`@%Ed4q#8uY%t}%~tNroM+$MX3!;HD!GoI zseRlp)$pBC`AT%)IBUcdctGAV`?tr_oWlR(PAvYH{u& z$9HZ8ugYzy!Q>YIDpxd~xe<4zOW%lNO-+QFu`<r_=!`D0( z!;0L05}vY02c|N51WSn!Gy}EAgzeGg)37H}@BZ~J%uqJXzy0}jCIg4DTdZPOS_XvQ@MU&|lr+4BF6hJ{&*X+F5 zLM};sO$YBIv}})3VA6!PkL$&6Go>qjfUfh?M4JB14K^KmdHq>hN8qbNC6Ine?JZh* zt5Lp3E$Ff>#90^S$6#Z?4MAx9Ks9Ld@%cWM6N@ho*AMeNGJ8|sw z-vYP|BB3D#TwkONuv9%wb*nHH+O6V3V!MFBfrAT}`>YJ00W zRx5v}9w4o-Dy$5;>oYqAi(}g;;b$oKbuiH*@7hqdU;sfJSROzY`QW6BT)$kax}fzd z{UZr~!UCa*RG!gwuE3|bgI3bQl#aH(rPz4oX<_WjTm;OUi7q9`5*yOMIC$X-cU|MT z-*NSbbTF3Z^fb3+oNS?)Im&BMBVc7yfMCR_0F&OTPH13kx%;CeKYv1&9zmoR#&!G$ z@K4p$;IXt}z`$i7YGz)d>Wc7YYGN&^w7vb^8a50$(+l*>^hK8GYS2_$tHXpJ@oza; z=EUeYuB)+GpSxJ97`}kf+5emi0il5oJx?n=Crr1}&uKl(}yX5dQKEPAZhU zmsM=kA@=F(*~RG7cNPepHMsmmql6H zQ2B9{QLBlA(_V*Mn+g-P4H}`$slDy=_u6~T=?O`$hreA`wB4&Y5%0J?pJK%XhD-X& zU-;&ExfLT3VsbuS7CSD`kQOf{eZIT`f_7lIi-PT1(^FsDBJt%oAmPp01fE-gh%{09 zKa{OXYK|cPz+crV#uxd5?YpbsaU5+MR`jp-cm%E!4`ZAl0bo8Z`AMq5JXFdV7KCv z(9@+PI`38@S!xUM#g(v*WPHrdy{uLndt?Hoj|(2-rP{M#Za_Jcl!jwyOolT!<5!06 z6p0P68WN?1@-G_Bi^mez+2cT_{XUMa%l751>xlHnsF`O`EOMRmQ2xZdj$~+h)~gkm#KAmGF)p6sDP?@Eoc&F&;&Kxh*bTw zcxol{vX#^zkV?B`tzr=Z{#Bqpwc?~=Xvv$<)h1H@2_+GOaH&qLNf8E?so{u~8r37& z_O^rT5oJarq!JgDPV)|VBEDha^0LZ07kM6-%ikreZkm_FQ|C!N$rsb-SF9C}kyckw zK?H*m<`3jj6sLm91erEsr|=b};sfXqT?e*HD{1cw)xJSdS5TXEgMf2E!^QTD8iDg( z8`yUi%x~8Zny(|eT{N3`sXQIt&#^`h2?`)v0+N%;RZ#iJrg6l_uXlErbNDkls-Hl_ z1#y>n&kyCe_2u3V7AqJzkbYi@)%RPf0s@L>THzFY8*C^mE2K3dk940 zuZ)09OSBOHuM=YUjz^Q!s?>=WH=Ycv(h8xc)U9Ylt(jo>xjo{bhS91m&F2?-0Md!a z2TOf47)j3zVcE&)2XR6@w?O6-M6>;`7EBH5A-&iw+Nd#$@UR4G>AeUec^};tcGTMX ze(*gF%V`Yv8R!Q3X$)%C379otwP7vUw7*BUm%m{)1b}zgPVC0;9B7inp2=;ZY5S}8 z_P?wadDCE;HIL7}t7kOxt7Xu!M4RojSI`lDyo>SKA2FIdSh53C%$^Cr!aeODh%+nt zNyZ}iECvt(!Eve8W7Y)}-(3l6dVie;Zu@=bM|~T&D%Y?ranNL5{YiQ1kRp-*Sq2$^ z3To`nUp=eg=ODS%p(wi8(f*1jwfnp^Tqn*)zA~={eZGUZUTad>P6sKnf13`}_vZ`u z2&f@Z{|oO>+ZHZTHx-3&>qbmZKs@K6*CYIZlCHpz0FC8enw06RQ-|_MOTUh5(>Cn= z`O5dS0p#Y5Nz}to0_VFHy{65ij^gy_e`0EUa7SBSkSagTBXw?q3EYMV*ggCO;tMWD zjp#udTW@`)AD4m0(+hwMQt1ArV73_af?6zcGOO+$SGvQ6BXM$zCuFaNNF`zMzT%_+ z6i0)$fu9NPhN+xtDBb_9g{x>{7gpWhJ@f{~4(m4X<_`h)c8pMl#$60EYR{zz5xeAh zaID=leHC~Y7y>2GTf+k1$yl9gb2*xfT{$vz@AXvYhiIX+ypF+6^hB7S0ybNFC|-({ zG5P%b{L#lkE}`~q4lUu@V35^zMMN7D=R!0vw6CGJO^*YbMZPuo7vh*Q&^QM*(VlxZ zS_N~f$@@KjemkvE9JOqrM^Kdocu|25K0 z2}y~@&}fVpt>Zk1mXf0kP4Qsi3jLI&7xGue{%AxLT^~Lgbq{p6f7x3)_?w!-k)uR} zf&)lZ{YdmO*W!VX?qW*X|{cclZ(r#=j)lm9r-D}n{H6Fi?FMI9- zIi-UECONT!fwR}PS6otAYCix<31s3EmVqH8#pelu7X8p$vTQc`vD09I$8H87(x`7u z)AiSMO)b2$G?oCpZ(}_U6mF2Dn#x@q`>@Y^uWt_S3lq`N?+AW$v{%Nnc=kEhe*xRm zXzc;Pk(lzP8Ep(CbG#T4p6|GuSJj5=#J0OKZsKZmyQSk~ak^6j8Qi14MLN9-ys&rW zMuI702TvL_ZIm>w)1&Q9!kl%bf2WKuZU2G~WNy4-D^&QT6#q`j@47@Gm7gbIVRAOa zzGIF%7OgM>*k)e*IwI}fbYPw`bBEa%<0tJ7q8`JK+903=|n<5D#769 zRBXkt{{2W{i$wrjWmE@*FQgp7lxn87q-8|OzI*BG2(}X;yL@?3ol*`}RdixVe!4RE zq*wCWDbO@PF@}cqI?L-oooB<{lI6I-ZsG6w*Aje}xnT)hj^-3~T)2SKvdPU@jA*Bo z)bF!aJei26!ZH5?^#W;^Xj*TqOIX0S3msH7sKcHB%+Eo;!MDBlI?G$kHxSb*r#u(` zjes1ByQf-yXLbDYCpc1^oNz2nkW8yWfcV0bXvl!BM<)v`fP`HOAB(#!WYaC=!tVj^ z@+9-=)?>%P6IbvZXl;sl>DS$RJ+bJ>OE7U-?g9YI!f6nZ{q8wZaywC5-H3CW;+}00 zx&BH5hm`Ot_aPM@8B&X7`BxlrS5iD;gQB~h>w`=YWPqHJ0V87h6Wphn&l;$6zWt7O7yl7!t} zXK&l~tulnrvN{Jw1RjvgHdo68?4^oIbYQ1#>K^>|GlLGhfi7gBAh{I}d^Uc&m1}$@ zif#hkXoh}(j~P>w#86A_VjPZb8b%!}&arR{F#9!q|D(HaMTtPY;(TevAk%;tAk8ZB zj0jWPw=Kk_(Kk(y`E9D!HnNE{1g-ZOSYU!sE`YYD1L_a0T@-fWjWyqxSOPiJ3JWN~ zDcEo-_=K+T!5_AYe>)XlCpWXjFIJFMukE5D;cU}V%K8q|=xJyi+G(W@)dfFnlvEJL z4K{o66Dx7g<|idsWqPbrJ`$QIO+Jc5tAa=_iNok^&fVqQhormwQ%cH6Kx0^^ZJI*c zxH!Gj9tH)~p8o-{tXg|-t%cbYQw34$qyLhz8LRbVX7cL3*twZ%!41HYq;t$C8DnIV z;)ip@H-*rZ{HVZDP8u?71c>V2JM3u~f{e{0A z{UwyL_L60@H8Jm+W7zz$G2h*j5bee$hz&9(lg@dHG@bLvvh#T|)2DQP19-crM?XEK z!Y9Mj2SNpGMr^ODhN;9#(a{AMaphxzbwKZtMoZ{dNTGyS!5rWzFd^mIe7{E%f3Q_a zp=Il(K4J(v;*T#WcEA7-3Cvh{S||}a;w!E}hYkh;`Z-VnFGD%Ac;pTk1}e92Z?;zx zt{<~~utyZkUCuEHvA3x_Y2gX}mUj^ni&2H6eW&82>%8*JcZa*au35|LUrl+LoQh%?eX`UpbO$j<;C*4dPl*NwSvSF*(L8OpJ z)A!gr^{^&?YzUf&;8_UoA6pg9Ig*2g0h6pL3txoipY8mJSIyDwfC#R%*S<#Z5~X@)X=uv_3>q290`h0<~v{0^}<58+3o%} zbsnK0Pm8WqgRVu)zx|J+kS_jPy3)LcHJ0anc|ru(Un4fxQWpJNQW+JTL)n8dD38UohcmOm+V?7EY1Srb|?TPKm##s9v;lHUo%`rGK$zGRo<-U@@ zB3fh>(+mL-f6Ncs&k)1RKj1Fuw7ZYCz^*p z*TeAf?3A%hUPeSIu;8snpYSTPi>lTQhQ@q;Y3Tj8HqL9W@`m`AHcsf5BFO&%Xw3hJ zt$hJnbO!KCRDk9lKlT#MVW^nWhykO1Tzh_<*LRVlTf;L}M)2kV9}U{f>}TK}7+S{j z+obESz57`S^o=;|(Ijbk;C(NTVG{#JLFMhh6X8Dx07!B^^H{!JB zws$O%$=Hg1)!-Ar@i408Vncw7(7_X&&b`1kG_oreq?fWIySd-*5&~1UF935dc;=Yl z%hZe{3G(`~ZJ|0zP~8=8cSL;${7jcnTcaWohw&LFfHT-YatG6sk^C5d)5-EXX3&7& zzVQkqu4+LQPF$B!GstC96;_v0fcb%i&Hj*3+MYn5dzO(~4-|UqOf3i}03;ZnbF!8B zs!^IbR8)SWADGc&wD~?5lgSaD_g*p6-DUr*>mkXId*&;&$9|33FY-Lt*F|VcjA&Pn zMZ7)9qe%urcn335pEE=pK`sMV_ynx|3pW zwe$w!_MTI|rV(xW=!lMrxc`=1j>ZeW`BnJm6L^26m<1P$LMRcJa~WwgM%1RhdjQA2 zAlD>j<^5keH2=t1oU(Nr{v-c6hWKB-j_E(WF2%|wp96VtGuv?!^qLm}6&k>*UGH|J zQX)I;{OGigMUmrgwY(=$^nStKz&MQGs-50piZwPi=@T;u-u`Z1CTSuUNQ?Emr90~K zN1#FSH%Bg~P9IG~)WtZ~JZx%gGNni1g4g|vNj_^Nvn&{>ykco2Jh}C@3bzwC)WZV7 zn?KZ5dhu2#xMS2YR%{UD8-8J9xG#Q{bo5x{iapBA!e0(@2#AEQ(@cJd$Ys8{Ar7SG z_T0?=NJ7LmJ7n5ZSFp%swpfk|`AGQ#S&H+ZK|lTYRYK6U#a@PY1{ULjwG}<_&F09+ z7UO>GD?7nu+6iuN2ZzDV+tM`X1of>(BY})5XqQFQ{FUpv8^j2JeQ^#V4mF3Fr+fu| zf1pl|vrklq&1m5gm?ig~8lX8Y4zrMaVsQ27Dg7c) zU}NmNN5s<4!h5c(oI|^36_4}`_M>HfTD>LENXFykD>@Q0ECSwa`F<*Q0)$b<);x}W&T4^4-UlB>Ob`j);LtKe zw-S2QzQ$~tRk3d8H)$GPF^?bYxdAVzPavgKpQ9vHd=v*{VtDRKL9<14#$e@A@__y` zex4uhP;(5Hr7fljc=+?sYg|wE+d$MmcrbT>Z)hsU^u!X%7+hJ092f;S8<%GR^lb@a&J&Vw+*8Fy``FPc0z2B~ick{^J(OkFJE2EH zZQENlEAOZHST!;PnD5X)-`mcnB>#2~d!qMA;Zu(pC6)sWapjiD@-%58r@9|gM1StC zurLGNG^T2D`i5cEeZZ?q%R?62t?3H;=hfv<`Z>{lRNj(mjbYf``WgkvKANThx-Ban zLyD@Prf%@>zheQmDe-#Pw$NNfx;Y4_%|^^>zc=Y%EhTDH)K-JqOS~G}dVS6V$@Obvqbg}4+{Ng0d zSd&7$(f1>ty`219R%eiRP$n^<1LiuF*7VaLkH=AeZ?5G^!mq=-hP>1JFN@z9&!-fZB( z&)Pb2nZL#!dz9Fn=sxM*UFd#I%Kw|?Cf+CD{)^@Q(G54Y|2LKs8uAnQPUDoX++5nS z3U!5pR@M)-JaK%^h5R3uv-RtK@cc00CUAT9L=AG$8?YxsLyz>@W0X)C*{2ui++fRx zc3VJ6ix-qg&S9=Sa=X7Dy}>e>aMh!;@|_&t!&*6R|CWXN1ZwHfUkdC&yRBZf3a=)Hn#I&c3K%luZ z0ouy0?B>x@D)>{5$k578;g@p#i$J zz5b~&?F67|XoH(>-Rsz?A8p;p^n8$%V5Kwyfye8C5E#_PBB^ZXNjdFtc2;~XD=9O( z5nk&o7=L0uF%#C)nC+ZI%{lig}lZY2ZLLy2nL?CRrBxV(E+` z2}R|mf4w89w9DUVFSq_BJc`zOmuw^It_8wB4{?mn?U(}OG z#Gg%)^B1xXogGiUWhwhwzG~;c&aDXIPq5J-KtRO4)Jy*N-0FXN-G5lFE=B4e!6x5- z1e*Zb7?fK_`t6owwXwR(Ah>05O|2mfP@;L3Z1I$_j%Rg8K9}+ZMidj|;j;(GVZGaf z*b_o`gL19J>=%r?fypGZoV7CGDKIh;%{XbD^oQ+3EKU5z;r1FkanHWZ&&O|v*}T>v zX?l=l^v|}MWF!uB!mM?)S!H&9PwE1wqMYM>>Vj|)zpy2$>I-S>wN|T78^fmo4v3mE z@@_Fr#dgDAX5z-Ca1mrvwehS5V3!Z@hvUebIBL_3Lp-1Wf|d!!lFwhtdJ?74{2LNP zRVSf)*`n?P&08$-9@4OKB=<2A(`E(vj?~d;nW{~J!;v*$FjzH7Dn!nW#qJ;#u|$oe z6g!})&Qp5GRF|?<(5m%;dD$Il$Qlqbb{lfIu=r`Xs)+Y5I;}eCyvnEd`Rd&*PnF5i zW;Il{ROXX(!44d78aJ%PE3gc*h248Ceruh3eO__w?yDomYV>^Oa!O8#9(tI!_s^Kk zHE+gwhAyF@!gVw)saLL(1My%rww>1!Vh*-VvV)K_AZsN2v0Kpyo%+J*`ed)LNq95W zEI85O;d`;~-9PYOmy`?PEfLRz@5z#b$Z`ge| z>S9P^G16$&1nRe!3#OL@Jv#%7mU;M7ym(g9Ld;{`F(lDCnmP9m{-DpVk7QVZ2uzU3 zvIPd@G7<;tTZY69zYU%du|Mbi^>EnwT3SjHalLrQ)86)iw=&;tyv99A{;Ej6xWPYm zIN!-cWws-nZ)*eNM;5^vIyT9gwyMpIiDM2Y2&dXhdL0 z!;mBMX|WkDZbKWc4*}-?+}?fIqpqRXz&2@hyh>wCKqY zaDbTm#{GfSHf-ak=FRO1-Dp&6k&9INIX z%3torH|AlYt1_U}k4V1HxP=n`og3@j!*A{YN}U3RnKB#q>;gQN%ey8$8DIaqdHd$N z5Ya<<5w&Y~gqZ1f+CRb9;z&e&Lb-YyoT8pauf~HE07D0{q-sHN(kWXmoKlGSa-pC; zf<6;IpI>)Xq=41BaVDW548EBCcPo1v7!XW&%a&tE$2<4}WZ2Zd~{d$H zbO+sOKxaQq)2!LJi;bWp{Ss;(iN{E+&}Uq=ajKzn%(#OgitZSE@6$WxuDP=pV}?(A zM|eswppNE~M9O=Mevm0&cs(HIA+A+=P=NaZ$%TsQjy=5{l}!CxfLQB83K6I~lV{|cZRh?KWvUjTaY-vIib zuWfy)nl`I!=)Rj!XME7^RKTw3{$w&-C)nW>7XAPni3MIu4?WTq48gAtZiBKR?~nN5 ziAIZNI~=Wh-KfL8F^2;})R%mga0Wbj^!6IjmX~AobXtE{Mo0IDKJJ|t!Yrl4m4Ag! zp~jqv(Vih4@_pWUGi!-kcb_T3v(w@)(@-r>*$KDwK%kn4WZ6?631$`6*&Z3h6)i2x zXK{9%HqYbkvh)jfDH>pB4Z3PQ@KH$3rSo6o)ud%pq+%Vha-hHv&hR zJDeix_w=6b1Tq#oc4;3!DyG-+juUWm^8tv`Qx&3YSuTaiRhoiNuvS$%8q&G7H$8Ak zf0n$@&9Wi5hxd+rcOMD-a|)JHQ?s_6>dRnCrOIjH>}p4i0Qr-3Z<~{Z09J9-D%EAr z`B}j&-SlTem*E`y2Sez>n_J!?0m|2k;TK+h&qsPaImADFE>W>;SK(p=S`7LDnv=al z0_Qy*3g0WSieJL<9H*IoaP*f_cH_qaS5356v+|*~PNL zeVcsk1`*SIYp_baw7bpq_#LZ}wKC*@73G57QDX_t7Lptk(prdTQxz2XPGr^lzdF|o zia}kxUl7_xa=>_auwPoQ;6ZJx-2^HyNditJRd|l&$4I^hYi2hR={Ps?OS8ZjMn|0I z%&i-3*F{-UgByJ7+5R5Bn^XQU+B5HtV2=P9d)bI$p1FsMbPl z0s&HgiSVyVX$9xc-wIRN@XAGtxJ-T1WJjpd6zu}+@JS2KNGfs6;g~c;DASc=uQD&3zVPs2Q{F{a3vl34Y!}=wj3UncMr-4@AV%sxEP-Rm z60zQ=`<2)n7Xw&q@acn|V|^}x=xeP08{)Nyr5eSFPylnAB`GFAWFo;9teG~V^X{xE za)QXP&CMKdqeIFNwAZ+$rBZxi%M=Z9fV9NhcyQf6S5vm>Q(f_A5p#C=@U--4LDBcu z0bju|(%3gOvcNt$jWX3V(sz#OFl%wL-wu+PDpgsU3Rxc3Nj{$y5KUtm`zqF{1(mjG zEJz7JhDv|&==APYt@sgEb z+tC~Cp56X;O=41(7bimnI=<($)veRJJ_Qn(7+Hs(pU zqK0h@UP4upRZzNMST-BAPB$O^O7_GNSyN?JG5?{$zW#k9qt9hRmq7)l=pW2{C(iBy z+~>mj=q~XbFzlDLx9a`{uh{%;%*CHZ0lR7uj996q5_~k6!94L_*erd}Zfe8Yw|Abxm@yq&Q;1Qbi{_cM^zMQfnFB0=<++xIXSW&a$3sJWiWr z%&32U9(&)lgqA&ElMG**j>+jvd;cr{l#nBKw0#BX`~NLi|Cz@BCs>h_)#1HBc*w2y zoJ+krcG(|^yP*k%ct&*R;Lw_O(uT`R9lJLVtd3^6y;1Q`orL$h*}DAm3k~e}4blgX4d69L=osO^p99LXHru zU($`~{}FQBh%9RV`h#vJBqT2(Bt-OOs`Sgu(ijAUGR{y>Pf?tfa!4OlPj6_Ph6>i+ zMKLrqQcRRA&pS&a2Sg1Ch55BY6fnZkbygnkDRw2TIT2Yf0*LMHP;GbZRj21ERS zhksK-F)$B?hX;FshkrdFO~FVKh|)J=`lUzI2L)09BY{LRy5;>9>VMO=0L%;e6@d{+dUL5Og4>7BW5 z|LoRw*54f%`<>?TdFXb~T>CiDcIoEB%w@NMHl0O<0t*uh@_#K$f&9`LM-r?O{On+l zmz$Whj~DB+$*(83+xcQQl&)@1@~^MMyMs5%%WwLRJ}-M=++Hurv)|qCj)i9u0`{-qF-@#p`EA#k<9 zWrL6TNw1sia5y>I>~OfpoeYOrclo86LA+vrU!tWXRb@8=4+(T6mr9n7CzGQejwhdA z00#pjRXLf9r&ghsDCezydVS5vC3q$Mm*;#vToXBT;L1T0kAk`wy35w>U<{kneJ?bV z!%a~(izC-7OYyWwE_;ESt{pTEeyP@dt)20b|eHN>Qszi=={=Y}jmjNwD zVKybEBWTcD-A$WdsZ$pb06DTP6tZ`<-D@w5&5Xi!aSAp$VYys0d|KH_zdRSuY$EGM z;^9o!x4yV+`$ozS_TQyLz*kgelVc*8V1HjK#ptj?yT)XaV7U@L?e*~-4U3g38Z8us zB-m&;Uc`QXgzPJ7$!%`8lCt##T+Wt*xZBD9eanBY=%InJn6K>dyG5kSDR<*z(KlMH zQ**go%q7>FOuCO=(Xt|<)A(ajz-Ow#exs+QQubKGMqb7HA%CF?~B%Ew->Mym6FjBd!HKp|$!hgqze-r#@&1!{o zwn#2zzvOB%Uo580?Jr(N7(lU5lC0i*Ft5V_gF@ZIlLMG z@xSQ$>W8elU~9z(q#LBWyGueEq`OP$?(P&MmG178?huqlN{~iCLb{u8^WOW@C-)EF z;hcT;o>^AX(HgYmSEr~Pp>4S&WcvWcI&TO~5;sPAx_lY}6=`dMYvAokRz zTKNnypE?cr>I-5~3ctsfVZ|#pyXBUR7vz6XD`ZK`Ds?BSjYLZ{YjQ8IuC%n&b|jwq z6+Ip_D7uQa=>> zllIccwE4m^Z}ct2I= zR}80tPn2wq>r!z1_FYukDst%V!X&1{$;!=du`I@OLySk$uli7Q$)AkU0ZCwKuh3Cj z@8I75`7Qp@c(&TeF}Tlf*Y&d4jt7z}8N-x7r}inaLR&hKL96Fipuv;p{*n*uVH;1F zuHR_w8kO+@ zFJSsRAMUM0_e$8{cqE@?rcIY>B!LYimC9j}KA)oV`Kid`{&+`PzJ2&+)6beueYY>#Xe)1MpZ*V zgK8Wkl5*wXfO#a1J4vEc+cTZVA#yLW;>oAb`~==3k)L5K;W20-67g&L-kfO&Bg+9m z(1ie1qFnIloRCinOO2KAiktSyc+epVjxYkz-!K&7!C*KHc@l8vRXtgI3ch=Yu7^XkwxL+tGy}h<9=qb(S|- z#%s64_2~auWBV(bVEkLv+ zQ&3$kEV@)3dSMdT;r1XHH4&$Lb_*tfoc*0ia^0JM1V;i@&%B<*D=d-V%Z27dHLZGG z><_GD`F=WD`(9h>(VOgi1x?xyvU2=XiHgke`T(WY7voPH7Ru6vKR;8*Gr*x!z-s+2 zbHQP|yS>%j0duv@91U=}g8~EBe^%%?p8S#9J4w85^W00-ZFUr|)a_s>w)9)=f#&tQ zZ)@0BHd`1lg0h&%kJE4WlpatnAXo~+|Mb)b*GvNsNF*o-rl-Y@X7CMw3@@-yd*S+$ z+~m)23Z)N#PfCoqY^L$2+mlwIvN)`(HD+o7NdQ)ujb$c)IjQ|6pQ$$>*lINJeYr$} z-sWo4HbojBLv4gr>QPF6qG*`RfPZpR2LsG#s!0@j=d$(WY9lJ#JE?;S)=nt9^%s ztk*JVX8U6@DT~2lGZf>p>W$cJ6N;td_n9P=Ic-K0e(@N>{`JM9*7Vf7Gy+$NjLM(o z^!^2mR0^93+0uv3C*S11Pyj=i_<~Nh$t4X;RqjU%@~n2NJ?v%3j!ZsGrq?e|##WbS zmc5Gx^N<@&=6_avaoy7fSvo3R)q{_A6{A?CvC{kD?n1lo=CE<4@yTeRP7Y4$s3Zid z+V5)P6>c$q7m8Rd4U^_5?`qEl~2PBGWXv?oMLV z3l=4I@GC77%e72qf8=~pDd5k3`c)ni6(13~YK`s9UgH;sH3>qUdOMY3KK){QBift$ zn^aPaQ1XZ?2vKnzEUZdcfYYyu0>}GXkCTKi{xF9`w!neTVKE_QzyEYLD}O{S8PQ0Q zq8X~J*f!*gy(Rn}9O?-ftQR1Yd`e^d<#oYd`qo3-r2qCX zFNVToF#en-mGrA(XxjN}bOeGWl>iFwR zlr}Sa!Nb(P1lu>>8ZI< z4Sg2xIswf;C(geQl;^8HTRPlL|(OXL$Soo(G7fAtw?`zwxv!33W$&Wkd!2Av@(&t*63^KCv|Y~ZR{H{h@!6fbg3FhN1gqq2|<&uAiP}j^>)mx?|KhIRvjas zI9!I(V72+|fwA}(nOqtN+B){BDI6?p>@^aeRK}R#X9ygI=ZPXO*9+L)#a4}P(S-Ce zNepq+3Yj=Rf?QG=v`XV6aacuG+NDXK$gt>#{Ew*LP|zSG)lCsAmRQgmr!VpRj@Rpa zcR~}_hF-0d!q?aLoDi0?5fZ>|HVWG_;rFn|T{YU8LT)B+lTNFgUk!1i6MkYVc8K{) zj7UYFA7=R_3J1Z6e+g;#8%$(O^S&G5)?SiTXKlQwsmnc|sWO;}_?umgeLU`&moJ;5 zOhxm;HkyF9&B2`jr@%o5>)B&0Jkv#2`CH zpFa(SAw|GY67x`T9J$GLRp%hs-jTb5@eOE!f+A5>fIAnSj>${^OKrPeft_+Sq15Sf z(@j6WjR6*1G=Sf2Kb@o4zyO($4|7N7riyISz-l8!D^CJwr1Xh* zFMH8uQ=d87BI9$(nvSJX7H96uO~}f9AbH6=$?HC;w4wPgTq&0V>-`Y@*3d9}>gG3s zaB+F#2ZP;N?dkJBjM`EFbhMjj5`-n8^4PEVpKgtda@ozTQ<8fMM#j*q$7lIohhxC% zyQuQw{0rsE(6W_O2;=lxT`gcnbQ*27_AZ;s$0Uh;C^Gomu!GZ8q`C$niHv%5?Ve}o z?)IJ^5=k8hp4!&5P=a<-3vC{?9G0_+fq{VxE{3{lR2r4K$D%Wp z%EgML8fh!O6e|u;D5}qMj@G^n0MTQ8f3cP5VEF?w7!OR>S0B6AX8d7k1}e;#S9UW;=az{lDfZMj4gE7;H775$1Ps0m)X z4p+FASF^Vj70G7M0a#NL$Tt=6&x86y+5-I*@HjUgj>76}=G6gweD^mfSXL#| z$P!El$Dr!Z77kipYWI?GH8GzDP(CrG)^xnug2seP{-3C^f&lUUR?Mq|MP#vDnPC%S zF`Uf00i?4;(~&e85XY=vBh$%4?W6KIUDwsAJbdqOw$KRpPKB6;DBk!NEr03Xjiyer zf*~zK zPNxmWp#GVFg#Q#@H6UF%lNgyUQTqh4vztY- zQZF$=INvw~lr$z5&sn($EPARS-)m`rQ;fK$OPJx3MGUXLm`s$YP&YfQh0@-&P6ECz zZW2fri1}Kcz%6yPTDH(cLc(a~>mEVOgwgt90Mn1mj{l*l%!1t%STg zGXE^GAh!jM=-{wen0192v79a&0@{%IkGfS} z$%G1->}$UV4GU{7B^J*qnkzXqv8O4An0yyKKWCPJ7gdFJLww)ISCWF-2zL<+9w6){ z0Np@aioO&?1Mz1eL34GsjE@7?N4nniejr^_Th0DNDKjTwM)&rgmwp44NwtC{G2-iU zGq^RLConR)asP=*j_&>U=mhVplhy?oH^4*fBfEeqRshZ~n?!+o^+%wn4>4egWRXiE zw-(C^Je4Q&Al7zMw`Vg31w(Gj9+;`GGfYO)wW#D%DF7pME5h9eA7F*zxh}o$iihV@a5_%E@`pyeOZ5BnTMQ^&oVoa!wR0kKtQTP50kz|0=-5e ztxC~E_SNr&H9R=?^f!R*8W*ym&-LA~9(FyqC^?3n-{9LkdNGLn?|XYE`ZGqQa@#G% z7s{p1ew&Av2qzT{i^$5#8p|{%;DOT&c_Y7Z_o3Rhb-hft*0UawfTfG>viRi_dq*?S ze=jnX=6YOPja|^`PbB3ti9$#z4yeQ!%r#iO`ek|>1(E9d3W=>kCrYDy8-Hj&R_PKZ zVm_3}aNjq@=W)Y0mw{Y?6X zwkXL+vHnqTBnBp7=X)mm3(bkd;*Sij13trSm1KyR4*b9WKWrGXJfC;B%;a$p>A3rY zALP)q%pZyLxk$D~PP6QW+!TQVHL**3Lwd17hnx2uMwLi@I1Z0_>{N*k_wE~p%UArI z^XwTR&@qT=|Ej!)9M5%dI1iTE=?%DS=o;;o&pC*Tu4R&0a%3OQG-y?eV^wY(-lHE< zL8%nUf!o{~rL#JG*6;6b8gM|+8qWvf#Do|YNo@;*S~DjQ@!z{}mJmPj)o|XDgdP{~ zn3|*Taoq1UE)NPl+~$eOeB+E`&|!f;#Oc0x$P2zFA zTk@!x!)Oa>94$V;zqDDZ8<^m;TWC@O%!6ioqM)`eQ#JaDTpmeg=%FwIve95}2tpKI zC(|C4LZ+@M$WV4|N1;r6HE8J7>;ZH2mNIYN_;Uq&octL81C^~g(}BRH&F8vfY>|;A z=tK7yQ~+7k)>fdC{O7~Gfs#P0u2VVz32>rOfjIA5rA+H%{u3DmkiT5U%Q_gcD^KFO zJ3FCT@XP)g&QEYy9`1wnO=j`>8nH_6o0Jrj$dE&v0f5WVpW8oVb?R>YQIjxBW1HE&V+r6KV?*^ zm3mbo2x+bSG4iSjs}ez5-Hew6V+^WkzW zM!DW{`hzdm-Hl`nk@R0K8*3GdC1*p`f54km7d@=zXtBrHj+(`CN4v=?_(2tkC_GB> zkJ$C)(W;SD&9{Q~J zh53osU`g=bh)gAn7d{zGpf3~&FF(nGK}iI~D9HvmKd_jWG0#e~0nk*x`3tf};-~`d zFX12~*Z)nx{aoy4jTS0Jg9d(gCZ))`=}&B1e(^44iIEbO!v0dVGJa0iqMPlh=33Qq z&GGHKrWbIRYyp;PWg+W7b*t?IY?OeIDy*cY_RW{{yAPwl9vsDaIoPQNs z@#PT$$|k4P&son)kj$nK)9&x@6A50zSKJ+aC;q>FTL1B)j>A#<-&miD+ z8U#gR(TI$#IUWEqiAfK^y;0Ht-PDa&E>|y|=Z%(BB0P%9TjPula6TbsG5d?q`e~R? zEXtueRAFbFL6g1k<9(CT9f$p?#UgSQJ8>q`=Bg2p9@1xP21oDu>J8-6c}SC(^x)0t zy?oTZsM2m9t;Hm&USFU6Jtl7-V)U>s#{4Jb`3pj1xh?MxJ0AvsT7QZg69?;BZVc`3RNdTzgO~t> z{J%>~_!Q3#sO@*AN>Cx7r~%QL%c5PFd4GiP zxd(?+*cZp=V|`SL70&UZ3Hdj9^>N71@SOwet1LZGrLry9!?_$*H+ zb`J{J>MBv!PhcMZAqcL2j9zXlaQ#n@v$)l30j3R3h7Tc)6nyj&$FniO@^>- zZUNs-sKZ8_{<*fITBWbIGgVP0snXJLbkO-Qm>-VeV)HrbsgsiOzrR0DE;&r#)a2uK zFfO{}`M1K}Z!L*pMH*@o+yQCqMzoFap3n2N_@_p<2s9x2AGO`beAI|D1e_nKdN2FB-$fsXd%9?`*XBOQ|rC8MPn2|NjN^Aw*y;P zi)%)|Um~vOo%}2^6ciicK-pr*s;b=-4jmSsnAN$x&(5A6zP2whJ_e zU!29M?vk_cWJNT!fxDo416XVbZUqeX;If)0iZZu3dK;lNyqPToDcH@9y$=zyVsAq z`CWIDx#DV^e4?5|@mk)i*hYPMht>#;|>^c625$vP7gEZ^PEDRxzFapYuhE6Q}%L}5i^-peQ zkqb%xMfWZOs8A|T(LQ5(52!wc*f%W~TSmwh=R0SRN`p?O&(sQuZXY}8fw1Oa+2-EV z3d-CKF`b>ADmOdztVA41RhpF^8h~l^RG7N$&0#4=Qh}gw4DRY`ozCRmMLakJ7~!n~ z0+w7FmrE&!<&@Nlv`h{4^EO!h7H4Ul$`Y%7H8pF*3%&B?78e=YV=L9pWi0v zp>G+w|BklFk_lOZ@Bft{`9t_C=A{$y0=Mw0pBTkAjFmy*)1Oosr9V+6`1?PzG1__M zm1#8v93@@ca0@LSDonaNZwBSKwn_*=?C3JYJZ}TFJIINJYWR}Y|^puy;sBmn*Zu;A)iLQ8Oa$z@X5)! z-zH^dfPLnY8b(9+m>}t9k>`U)E|qIm=_al0%DcN1ZIbbL6%oYxE?&}>w>n`iVw3IO z(Z3fNFBf{LN2kSjgdSc?Vo<)#uV3|&3?Zj_K8DINTpW%t&}86yG)zOVyU}{kF{xin zu#lb>=dS`e^oRbsLVWTN8;XR-SAPI#he(40s*rGhOOZNoNRa@MK@FvB45@7Y{I%IW z!JZM+o@%M;z^T2b+xNVg`!jrwSZD<7{!9U{Q_G18SNjfRLN>AMk{)5qzvx}T-$6*( z2-c1+gA4m?$y;`utIy-7&u;2D@ey4=O><>nJ7T5p*|(8+fco%EWXEDz^Nf{0o~O`$ zUMYzGA7jM|FO)m>o4Q!nETxNA3s&-3f{dF}0x%c2vTa^(4U+@M;Xamq(!~8_A0u6n zc#6wrevurxb06p>ms)4x!{^wqR;WIUvPqiGRGkhgJELWr*(Y>r*rQ6`@7QKOkBN@5 z1k?~=w9~3~PpMkM2?|XXC@|w5A?A;&$ik=qgrZAsn5^U!KR6Tm>vfsbDw+5rVNzEL z^K>T-SQ%WRPppb3{8YZVek39F87Zj^7To)(eXjc)K|$#Bb{5nxqDe7I}Z|EvHKRD~ePr)JK%j z&^@C^5*k=Y>&-4~e^pRvIK;rIB22)ndi>CVM009FP5YdhgoA3BvELffK!Et7nSD(6 zvb%nPX3(<biP@kbG?2;s`Fnw-sA_`QPN4;C!_#3-q zl}!J9+3SSbCPF&~_gIx?a~mc2Z6ELq@vl2dU*KOtY+V#In-B#aGtw6L&mxB`$Wn14 z$|d2X3?H^?uRYBBu?Svel+cxr)BP@D0s|wUT?u62;c&#CJ)FkA7IuSV#vHU?WPa7l z5V+_mPN6X(3%hVK6XoYPy{ri{edAD+(SP12%Eq66^eGUZUA!*L90yHOn<9%cQdS5B zp9!vi zo62Zds~Yl)??E;4@1z8U!IBOmUAoSIm8zen`kQ`QS5tOkzNGQetZns_S&# zR^BUI$nkkOkjhy`-BM>wT$Av;O<}o1d5Dab^{|H>^!08Ofm_LkhDRg1-vg0gnoTlf zcx5sr7tWQaQK{u?f3y41JDctoScvJctbId8YNnAqM0p{^J6(Cxn~iB6F)sx`oabC5NkFpythT9xpc2 znrFc9r{I^28lGt;W_t|V{KpS(elmd;(Eq*vBS6p44$AVlOR)+>2gDraJ8n&J zUp6n6{gP5a@sCm_J~k^M2&yA5)*lzL(i`yC1W1q@dK>nN1&$^ud?pbjNDcRYz*eym276D__REiXOBvnsuWxwWmULB4;z)=GLDkGS zqNV?;#aR*MJD8OR-5qozrM43FTkttWQ&?O@Z|lJzFyG_6+ZR+0({8G$%zFey6Lb{q z4tWwrj)lBa&$$27N%2wNRL*Fzn+<|6%Z!A_@q=pIXeA#<=Gpdpzzj%sHJ1s`;Q zzu=v97?&*}v|_8TdIwsv=5JS3r=q5By3LHd0nE zHWy6ndnpW0yBQ6Lu0@|h6kc_ugj}1fCZz}c@wv;+!Y>+I>m*1IW$fMAF6lBcucsJ- zILZ}SV8X{FrqHWCsXQvg2-utIz~OXG6(9kTcBKEMB_a6_`G89O}@{>hZfXMl&l#ZY*$8%MZ(&N8=2lp4x^OyW*@FTImM-!ce zlKyf;><>pe;Bg<=Uv3;re9t1XJ(R>GtzpvZUZqMqLXQz@7-0stqKERCXe0ip9f-Q{ zkr|liET6johBY4D{WW)^1Pa^6fc>bBkpsb$OlX-<_U5N-yGY95RE1-XP z#hjThpTU2QH;^`xlUzbKGs^zg{?(%^_x72c}3s;PJe54r8&3k>PHn6K0q6iit z=nb%9h_oy=8NKiK6r)d?DmSeLu5DewR?%*Y_Ol)v2-@Y`@Pj22nDHkRXV+Vq^cMPx z=kGi3uFJAf5&Br6UQdZVk4z~}j`-yeaR$56?ORG`s3{>ZTcuq;=n1b({zwKt_&=*O z0EX;D6t(dXxrbYfZuQ$aS*YaX?*cH}&j{oMObRh%_b2CTSRLI~+_uB^F+!ecscH$?{M6nuGI5QmeA*SlAFJAMTND=67q0MD zRiI#!Z6AvTLCGI>!#j)Xk{SMyBU%7tSx2D$6uYfp7h*I4oBE@f;l8Mi%fg@Q&R+2` z=F-5fq^cFk6K>BmG7Bu{8k&S;f!k@yL-NSO@~iT*gwaSaUkEcfMAX9prCY*sx}5d} z4B}zR$>f}5@EkP$f{;3z+RcLOTFyr$r(a)80)xBMW1&jf2z#EKD!D?q!^mbwPKCu5d=x3C3= zlUg=gZ^Uxs-MZ^v?2z6(s5Dxslybkg^l312r)m<5y03FoZTXjvy; z+^kzqCmyI(s=;qu=0UBpfkA!Cv<%Wg$ zMi`hk=x=;iOS8O1n00Q5L@ec@^ktrr<^sa?yiDPn=ic)lMuwn(JwpcUOvi|0KeK$! zQy7wk3|=Z*_aH(^eO8piQbEjs8bK78rG|rG__r5GUhE%_%owz;YpyjYVHC`{wQT8O z@x!(Y4wYK^KO#K+ks3l`%2-+zsy$)ISA$yDC?H*ZFR3PWpWhh1>d|om83;JFGhi)p zJAbh4ZW=M&v4`1`x4GbORxr5*?)R^d29Yz?K?PB?ebuSArL^g=B}c$!ipA%)4Ms%D zY&d8;iH?8BZd)HpQ}})L9pMUT;7l?akM?Y5<}(}yb?`4{V{!})Mc&sSc~Ds%=Kh6S z``&pOWQ7+1jOvy!a&Dp&A13i2E6vDXpMSK~Tys}M04IE$pIu4mwYy`Y?5@lTI5~6d zFX#fjK9X#D5}N#Q=KM0K!{h#yXNBH3c0;I9(=hW2z!F1 z%zIlJQGZzq*b=oav+yugv_@zH^NtVcS4qUAweK-uB!O<$i+nC>QhmTk>k;96Rr#^b z`j;~3bIYmOT`X%fT?hWZne*-;C^{%E%LS=#QN(5`Jv_yM`nBp6u?{KCP%%bSn0^kB zSgSgtAeg`;%!murCikOU?;J$fQ}x5l_k(e<{(5kagbbK!-VK>%~@wN}>Gtw=5oqcTq#> z%}$UU{+y2wBoDO7Jv8ZzIt{RAqI3a`OP(@1c-*!O#SOqYIGq04PkyC60ypOoEuL9U zga1btXt{0*A6e7?{Q3t}X8mVX+s`5)@G0S6(S68YD&cR4BLuZB_5#+2P9;kdj!rot zxJLKYm%n}mW0TJ}rUKhrLgj%TxFTb>2ImQgHZT3WO21Y52zuno?eZ(Cam3kS5ly;H zufK_9JO7P=(tDWvt!VMMCR2?ljYV@TgdC}?VOiHC$funL?wr!3qpstL7TO$ zJ6EqS1)X$4_?HzglG1hrF|$rq-F*Hb~@C3J}tKYh`;V=yy6 zR~)tPT%AQ?IJT3Ro$cBp1a%ueW(3$NtS&wkOZ-h#I=R4Quk$-B=3~8fTOipgu;4IR zwi0sLnVM)(vl>YbA1CMj;~($>uz2LTubReUhQ+;K3EEmo<{RuL=|)yfaWmuTHRM6g z!aByV%`7hG*Tffu$NFAEx{N<@wLa2`<_#e`!_n_{sm_&> z=PP(G#w6F#TY8+v>2M`xx4$fq1I^#a|X@NX@!lmf=5Z;pBk>K>7pWn>+9Ks zKCPc~D6LWDK>FCeIYuxhnD#zqUN`K5U)dI9mRKqtTEP3>k24DWFGzL=o(SiHxpk z=>44?4ROa4ev}hu&d5G&l@O!N{T_T=b5yYvi_Ky_p^9td2CeorWIPTjKG)r1YA~i4 z$`)<5-l^!1Dx1Xg*oU2mpC);KFgEIsTG?PVh3QIm{Np?BabI&LZnVEIW9 zUNKFFzDVC#A*UZ*0jAD(Z?oKK zn2Y(%PSyv=Fa5eWVI<_r;HVU;yIu(J3)fJpots}-Cj!h;eJ-^l>V=QR)U<6AO z^LcBoY}aatYg#Lf{r)Z@E*jDpL*0R&O*I0vFIv#)av|o{au!hcy4~w+qC&t8UxX1V zy~wU~Gke#rEk|y*@NL52qN&~z@u*t&m;lSQB$Yj8*ZO{E#I|61mL+fbs2V-aswDkp z>L<##QfO*PT}k=Q+Y_m*3-jM2oe*7N+`Fxajw}T(7hg%ZmlgJR1*2AG5WaSaI7Mx? zp3-gitfwqJ?&cYnP?OG$^;d%6aa!kxyji0p_~PB?Xj6#7>qz#waoO`VP)zn>)7Z)K zsCq~ufPvNOXF1&D`T@J|Ob4(^`XnFd-Mv78YVw$qhJQuJ035j`q$mN0>EgmU;JGZP z_v6ekLis7)NESG+Z^J;B;r81D?(N&@zECM{pdE2n(E@WH<{xiucwUN|Cr^clngp6lC{qSrw)l$k*h^pY6) zVr*;8{9?G=8XN~o8^YJoo};kX`FjBv!!R2>L6};H99%MdZu{j}@6QTU`Rk`Sp=RC~ zyb@z1BgCKzM!vhLQWrH$a^&w47_=7dB}nJ9C;T9#d)_JG-HMfOS#NplcxFz&B~A!h z9ZW0ZWH3m%x&sMf`n_;d+N`@4S~i+zOvP^6bXj2MSD%~r{~$GTl$NOLBwy~#G3D5! zYQ5M^RLYYau;S*weEkpP17)o%q_8VD-i_UQ;Lc z9*bYeVeP`-+Od88ye7$W^$_o1bMj~87$9q_Rm;bQGYuRL^53vkqoGLnr5vb}#$|&> z3$lLReO7TGN!HHze+A41-Fs#$3mEg(y@77oaL9D zM1hm6?@tY0(@k3Sw5eLf13{mov?;r}G($M)Sl z%5&bEQ@cLhC&y(s<|wZ!#*@&jQKQQlQzhN%pmHA&)7MZKd`-7**20#5Un0V2xNx|e?wD8P{}+c-|KB^9n2}wC;GHU40Eicq;zx%01OX6I`+J2vb zAk*~QTs0mq1RHIGgn3RAIR5^dxzPa8UVMgD;5r2{6G`_eL?XI>M-82f{r9Cv0D^oD6@T4Lrfxh zYe=HkcCj@C44YWQ{yCJucyX*Tw@mXcFYJcf(UMH)lO8mTJcTxB?`X;qrP0h@IjN=; z^$Krsz-cH)%?-9^q+jQcOilLH>5`dLfwr-?Nhypx?<`gH3l>z-NA=%4Wd;U(;*(9U zT~c@>*M3Iv|C&k2;a2$8!Y^p^V=ShcYD_6CN*sIG+rNFxi-3}Pp?diMuZB|-e5`&J zOwy~uYz9q!7Sc^9Zp%;VF4Qe{e2hh(pBm8z zhtVmy*)@tPE;HU&a)m06%-dqA4X#c{yd<_uth1OL3>!={9QO+;9mb}ZzgAe6>92?R>8aD{h;o_;qks$ zr#Joz0YIZ7*zAdB>QZSl^%8;5;&?o5UugxT(a^gtLx?EyKKr6-UGz9F_xG}a7T}=J zNyJ=I`c6v?r62{AuKb{5Sutp*x0jGu8Pq;2Ntz;L9#@@bm${e7My1x(*aFJ3ol?I>b zld8;@cr_)(i_^Gm2S;?c>m$aSx=AU}5F%5$C8XP(?HdURbX6g}&@}s24)qH>O~NFS zB3laO-#-#7(7R#?>3i?70}HEmF^8Z}4ao=g-M>Cc3ZunZKjr8+paM^xhYofNAt7Vf zMlajHxCX|IK-9b+fw`i39S3C1j(;Xh`2$4}P#qDOg)y-_wG>J1u8ud9^*8EZvDcIN zU2l_DR&oBK>C+tZZVHe{gBp7+qdr<-O*$0R!cU z(Ia-;Ye7$8uX7&N4(AOSxrlb*#e@f*j4hnaN7sOEQHK{Fc<9P(k>hbE;9N55~(+`8iP4LU*! zaq@OhNBXwrYBOJ=)rai3JIjj1K3WnQg=ZOh{(Hytvyg%BNE)`pJ9mxW!~%8SO%H2+ z`5AVaE(~Y9Zd5OZAxbwHNm}4Jh7(o2%Pq>;Y`UQ=)Ml%Ik|KP&k zMPM@J9#01!bP#I2R=-9f8t?MdP%$m&3PtW zT>*(wM(@{oqRjCx{`|63E{le*d%+CL4k6FvmEEqe1*|K@{NxdF
<`2 zy@#LTbojjQyn3a6YiT#6mb26!8yhFo=mR{Lz3a}DG`o~UJgV<4q`5)ZTtSzdlxbJEQ{zj$pkR|uB&KJW8{3*MA z+pXVsIgbyWIb${bP^}dBmo(ye&K!523lvQ*Bzk)4Be>VYCz?>8)Z-Vqh0uR0;3?TN zW&s{`9LhuQJmE=!7Ab+iTnDvM)i_{=X`a!9crmLi$rbZIIO3Q<(!6%9g1JPw^B~B? z{p8VbZzHTA6NNI=on>U1S;Z%lG_Bt})xz(9r!SB{0u$Xn_}RqPh^i7S5CK_s+k%Oj z!fa=&g+c8SJ2z1!Gqp^u=EHoWUD&SmPxuHkNZ15l>5Edz41N>e*|xmvIg{5oLyFV* zGGb6)sUy>#4`kuHSUX`?KI8QOa4UU9Bqe)c_FF96 zWMW+!t;LkQ{VOnyAeuQ+Z^`5M>|K8k`S^WUKPHnS~0~ws4=+%_)@+jVa zi`15?!iqq|iq>Z%dfA9!XyJ$6 z-x%K%ew5-cX*Q88^!{eX=Rp(nRT=RXr|3VhTo)(F_1(J`a9s3kRl<09kvx2*-+Z1% zt1+S}*1nQNKG&O4Ptc z>xtcpc7-BGh@ehpOqjL~pogonYBq%B^eXR|5Nd;oArK&Q?@t3tbN1kcn_kCf7$khD z`km?ZvP1*vs-<>t?C)N!0dJ_2HT94-g> zT+FhhED6x4(H^$MJ6Gny>R?QVyb)w=aR*k2)%wO@yCXf*syexHEwb!tfk8w$`^|Gv z9+H^dq0Gxr=Uxe5)AJ5|Ms@903dJfRb%w`DVYk#K!Lc`K!=;At38+Kd!2wvx2<`mU zBM(?2K386D4-!-Q^R9afHla72V$Yz(jl|eQxXNHf;NhA?p3$E9DvtX|!10H_DuL}W zbeJs;M`g%ksOTQ#Io6V)>~j&1=ulA=yxt<$aNQ83LVts^1)T2Cp)i;wBK=UuD!%u9 zo62jGc*pf@=%>U#41CpWN0YV0Rx^R#o|emsC@(dPJT~%YB+ZIfTu!MsjIU3$5VXfA zMB;pN3jUSKIHZIz3d`|G`IP$EL4Guhhh?t+ifs@g>h)*C zkARA*Q`;Lp_=+wSz55m^UF8^rESSlzQ*UV^^%s<$B3URCNC_pzX)+Ja_ZRW|)GO~6 zlv(Sn23cn$c2n99JC{dE-XCdUS%kkE1OX)E4WZhPS}^gAETPL$XA$hvT^Fh7x9`gpne}Z9nLb&_ts)L7tDW0Iy1;uta93tr-a2#*`YlWxJ%cE3zodbWH}MH zy{hPDO@g!SwXqUDe|$&q+}-k>u>8Ar=*_;@;vaVw8Rmia{!kd|CP8Tume!!7?Y!Jd zY~ETW{|jCJghI%rJ{aAhK_Ha_*^G*$dsT|HewZT~x^5;LPZKwFd#XZ@I8N_Eqf?nq zLW!5|b&8EyD;Gx=vNZBVfSB}$h937&aXd!#{1)T9>b-$jS5L=UtP;j6U3wfSt5#f* z=-(oHa}AUHt@p|fmzW2X{_FFauDc6prm_8IaPQ4pPPZw1T251QFusifA93(6`4}Pl zj&_4TKD2lG7QZgXBt~#ddPgKs^!8?9CKOdmbo-)9Tg%yd2Ep_)ric5Rsv(=L8gkQb zZR5ojQ$v4>c7%!8w=v(tO{rVFiDa?tsg3xLe|e(9A|g)ZrD)8(+2ZZvfdZ=H1Y+8n znh|#UMm8UH`MW88(7(L&b#kt(G$ORuv@U|wdYpz#UC}9D;b5ud0+Q4-YG5?o7N}I`yqAzu72tlofNJFBNl_Y-v;CLLz-qb)_)FZ{e|-`7 zi1EgD_U`4mm5jNXQaO!J=;|4Kog~Nl^Jgk|-iunf1Z*qA=mZC8O zX)_Kdwl_99S%~ig8ci>37i9(7{7MHa+NYx+Gb(oI?lL%}#55>)5l4_E4U|O|B64G0 z1=gLmA1abS6{Ijkfhv;En9x(o7otBYU-={uq8 z%l83E8AMP)QlP?7Uv0c@E;eBsVTbXihHO~AgI_eqDXAelY>SC z8tLxt?(P!*>)hYH_w&ww=FI2}ejoenz1Ldr`@ByKX9%|x)7uLpAhphOtLDo)JlxnL zT-#Yyvp;96=g(*TQAGeVqxwe89gr{Ui)+;bGsUwbg8hHl0ylczEK`&R6rT3>cC%_4K=T$rI)W*|kR=6t>b&H*ZZ{aL;i26Ft+wDqU9x zbWCSqgcDD|gkv&p)K@`~{f*79auN#EIzZ$Pax5GOX!O#70=N%3P7z zDN#bp##qD>*E+*kpMEYz=;-}@GEmr{tcv>#pok3+ivpaNl6ah-iFmU&VWP$gkZe;y zSzFJK_T#F%1P=KL9y$JGN!JLuxbaQMY68m=0jp$fA+sNlV40)mu>=5R8EdY6z@HUu zVDNE%t`uK^Z*UN!zU}k-ayrlP+YtSlW#3wmIztc`$O^GE`RI(rHNl3j%nHr2W(GS2P79P;l9) zQy*d?}WA3W0EipvY%M-ewypq)<%_~% zZlma{!nO~Rh@@MQnFRJJbtr5Cxt>TdZRE?Vlu(!@7KH z?0wdVdTe~N1__6m1iK)%JgHJV85cMLaH9orjb>Gu&l!WUC9hd^JVnc|BnnG;9f&EM$= ziC8OjJtcn|f@km3)*9q$8D@$|wy6dDuAGktLL9|isb@1cky=OLjwL<%S=EUcRC2cX zp5Y*##U+}U{bb2i`<+{a^2hz>h_Mg{ep#%qDH2rJ!dASH8}}9oM@^k)_0%$-%=r^8 zNynwWKDef*opkB6(Q{9ZBvVP#Y1>IaxivtgA7Jq0H9hq9ezKR`aOGZGuuBNTe!i5dd7q8@O+N^ST9)3Z8ehsSE>s=>LTtOTUlJpNiD-r{w z*D}@2DM)8FP}?B^DKa1kQQ5BMOWz+c5nLrdZATa8P`3>D(YiiE*nya%PQOLUwmHGl z7TXna-j2g_5C@(q2dpF>JS@sd9~)}40w320vDpyEcCA#&9sK~m!CCv;xvM1)pSwBx zi>cFQ0}%s$iB?Io39pkCKP%<<;Xxd#=ArC1@FyM`#ul%~gqb^t)gDj_^p5o%#&82( zN_nc?iuv0ws`yTT7YK(==jF#g*7ax}baux_I)ceaz=%SL9`LBOwp@8o#uUt<&S@w$m^bzuqp0| z!VY1uP~<|Ef*0#ua$IZR5GeGTy*{{voO?WTyWsbw?^7TtEXwc*Z$VbgaZC5bT!`cm z7ElTj1OkY!GAorso%}2bKOY}W(0Xa_xhNhUPIIL4t2x$$wn@3mcGu51pGN$o(OiAF z_`beVy6(N`3tRMg;*uR)-1762=0bf3Gh;Ve)tI)|MiV{CDy0^j9x;IkAPj*SluY?9CE-n$0sTt*?1-l0Z zcAlP;D7_jy!i(_j@Qk8l-$e`SC^#%^=4yH;{JyDA%7HEMLlGLLbJRmJVEIL3wo6Gv z-RR~bmScUVv1h7`!{dOU6aEi}COg!0N6%q%V6);EX?zycOhu=`WfIx(^iS_C5H)%p z^R~ned4Bb788PIM6sW*I)i3PUY-);hgU5>{9WU5D{D#^s1sjCT(uV!&mE$9!&w}nz zE24NBCVXe&Wz?Q6<&csP!t2*Mf0iRz>ff(EOl07^=kWIheE^mG*EiQ?hC$O5XC4Rh z4cv_x0#|9cx)V7Bj40(NjPn%+{t<-2iWtL6^Kw0+^&{?y|Fx>#rrzX$i`yMR! z$+)Rvf9N{xM&Bd@mJ_Y?rz3co0X)`D;q(>=6?$|;5}PcL5bnnBZXv1W+8OxS7lO&Y@Rm2jaK9I( zo6WZl6aKYn64;B*czb4ZRvxb^QQY9G+HQA+@N4yPVd+frTw#Xnjsy5z4lt@oSAZtW z9QR0hPq{>s_2rvP-+?slx4=%qy2zef*0>G^X-8iFxVb4=ncb=SXI7hjXy6A%zZv^A zFmvp%0*(h=E;us#DGIOXUxZqq{khoKRSo{(?9`4|G(yyQ4gr+AEYELXo2qB%g$LUd zqXJlch{x>d!W*L~KYs{wk}Vfi8%2a@uHNn*DBFF!-+>o^(^`FS%0PKvfecgXJG0te zUxa-`IBgOuK5T#?DqWNYNmqd~X(|o7WRu2>4|4gOsbPK~5}^p}Og%2ldcy)HheHb{ z_d6b-2imIKm&DesE5<}m&_$Bn7R5K1h%+5_n))&b)d>3DL)YI1kzf+)f_%Vl>B?Ov7Nz4!%-|0-{ zdJnkB=(no2?$i$tp$;FHn>>Fk{pOiWPZJxaB+vxs zS)N{tPnG#O4b*}a&ggnu|?Rl@fu>mo&~g#-p%P3w;mUGqu(ibT_jgfQ)2G1w@5fpGnb>+C^6HxPB?fmx%(e0O?@1gCDRBBLi+|I64sQ&kE^O9 z{Sr6aK;uY}dYJ$~;y)w;binChx`FiDT(x)%nG}Lrt{vt}&CE=wr3Rb#ol~91VNp(l z1AjPn2&r(hNkKp*+l+o;=^xXI4v)2tP-+t#q)vmKnsayi{V68gq+9u$XwxI4XSRbt zmHaio0~iu2?57a_|3-??!?trum(?Qq_lIO)pxp~(72iJx#LoS?YzEGdu;>#|Ne-YQ zZYYir)4pHbN~ee>6aBQ^)z{HSmqb-brJNxXm!)$5Fzk!upQk&ydA2c_gWn{`Db#fD zCwdMHn%0hw%c0;C5-jz^Wv6`37TDf5SKEU>NJ#r(16rVKGyB4TqLp;&Tl5=flKy->5{jFa4s z>tDL@H$wEoebW36t5R;~ZL!lsZIH1o(k76}Zn0ElLL3fM_edxyP(>ptJm>#K3ApvUoJ>o#C{nYu&MsQ*5*4-A#3KNGt49WHa3; zK%|u9IF8{;LR_HyN_hw&>EdajBRF{~!we9A%E@HjEWJRW9PRl7g;Z8uY}h)sa~97Uv94kyLS-u zfYbt_e#Un-(gz3MO(*>5qg#B{O4O9kwt5*xbELS72vz4wZ|q+m{!GE;I~dB0rB>*o z5IuS_VZYpFp<=ccfW%k3qpfN}pq4fs_dhnf5bTgb3y~crS8JlceC}tpK=-dt&RQ;Bj+eFgQ;Iqi{4bmKD>8kFiOKK#(}%2X z7Bb*BTf!PFEDoR%4}gBA)L<{q3wW&M0hJV+&x70TRf;VzonrLhv@Uk3G8v@zhe!JY z7NuvP=sD0G8-B+KJk7&XPcX&?rV0@ofu;zI10>WA!RpB{b)H)I+qxHSMgPGixzI zeOkdxCwOtB|1k{gBop`9P!`xwg25Kc0n{<@igbn<5anaBX_b0_{!@&8kuuoCA@^NR zoR-7p5Ov@)+=M5_5ubjTY|6$P4=wQ4@?`^Ib8UR{QW;}e4rn(yt-qe!d^{iIR@l$@ zpACmcYK3!CE$0W3u#fgJ&3~`9qu^FeomPA&Q|l8^sBP0_g4W{u=H(Sxlfh;y8o-H( znY7gK%#%_B2U4zbj^rl_S(jKr&#NA&NNK;eG-gX8@W&Q#y{|F;9dyZNGJxlo$mUQ4 zOt9Z`SuK#guwtu5f^#}r0Or`c+MRU)jg2Nqf}DdC!+*Wft(>rS6(jF$mKqD2j$7^h z|8Me-iO6b^&gfVwq+zRPLd>_^}z77)^p@Aa*Kda4&DjMv|#P2;vCtNPelIvCSUg+5YFCbrt z6Ai|P3660&Y(wDMkvJrN{FF26Br!L{~cK9tK@i~&Z|2E znbwztKMv;!gLgz^%$85PN{;_rH$ls5!2P0PDN`OG_uVhll2nMeDX8z-7)%^a{Z;+; zpG}<%<{J_jYQmD_AQ)Kn|H~*~Sjh1m>CwM7nkWo#3rXH)^_$3|#fsAm5;c6g>q5bI zAPpM&7$UoPvI9hK1GDT7R|8tSu8*l21(M|_&T99P(pCVv%LCq)UjTVm303Qd51?k! z0E#nup?=x>cHNngjE|2mPfV=c7<=dw!;(u5s?r3~!$Of5sK@+N)|z;7 z=7=1$Sl`?<5caxx^GdIdak@-5)^fVMcaV^K^D1o~TC^W6w$R@E?p>!nyO>q=L&(=- z6n1Aivcv)t{y`821#GQjX(G3n!h8%H5RlB{xsE$n)VR-1DsT> zg*ZmHXWP>a=FqciWgWtilRvA=$zgGKqh(gPn)7D3Lk8Oz)H~0|jy;##RP)ns-Hi6-<-4MCX^OpBoq7kr}YW?SF<_*$!gfa-?xk3fJ)5a z_{b4`wOfhgS(xFklXNP3EO*fCbC$2H{PzCM4#tfHgl?)Sb2WuPoh1j9!Uw1YJn-N>4#yaYNH+1DG#X5vq~IwCD#!LEFI8F= za#(4Fk;|T`HvNpUBP;@jf8X3ik_$JcnBISHlR0S%klG5{WY`#46~`=s48Pr&wE|eu zhCBb~R6$pb{zZ@7HR?KG{-a&z@w)gfYQz~Yff#pVyAaqbdc9j$m2y43JA52oa&Mir z^R|D`pWbV_Uh@3>oEjqPL=o~lhU}fwmmQr8EaflJ0d(X6WPun>2wF|=jWLVMu3AhV z-BWaG8-WNa?b@f?^uW{BhWDBuu=7$qk9diW{7_T6KTCNF7>V(OZ*H@lW?N%Cf%*3* zT5N?g=0r6}IW~T?LYHaTBYbN(L+Po6iX0-M?-RtYqOIUWZg%R8s9mt3EOxsI^7XZV z1)yXO;1A-Hd@6DdE&9k+Z!=rf8S=K5+QAny-*z*4c;awAqK-ul}yt zi+8e6Cm4%b*63nz*;x18SeXw0o#TB*jeWc14?)@4H@%_xZtF%GTGd8*C9_p3cTT&J z9cl^aQzpbF{mJTuU2i*%Wfk3483f^Xh#(?Q{{7J=Z!PwAdpZHk?R5&bRJ71?Cbx4w zn*mUt!|g=B4`|ipE|u}1|F{hsdg*?w9a#Yx8KfUpdG%MyHzB}7K=N6OwlsrANkyZr zE5Fyx3Ay#1F*c`LHO%e(y(;)0g|5Fpn*Z_H=l1f&T%Dt74eP6%{lu2fn|%p68!x|% ze-?hk(@{1Aed4v*COSi*bMX{rUzKjThR@^-u%|_7-|tc&q@C+6qMlTZ3Gma8ak zK9F}zoD)nNGi7I2cyZs)$jThaYK>~^~9>?k8XPl&$q$ZQCs^f8f znVA19fhREih!u{a&oJ*DMyK`Uj$?`C6GAsc8&4hOe{(PA&b4V#Iwy0C-Af{X_iss* zj0;`7vq~L7sM$y0QMVk)N;=sdtR>M zg+y7+rm8mrPd3HLb!w`EQvBEoQxgEY6^Qu3#z`&|v}WRCvkqUKS9!-fXssG0_1Wjx z{&R^H{C+lz^_bn2KUBahST4isfi<4#eZpSzDSRXW?-w87OJDDDm>h4B$qfFZ6wHvp zYRVxGhhDt*@SW&OY+V6dmo#=VR9$z{9rnETYXM7PU70#7r>%Ih7>g*)_=ZU*Pl37< z_bMUrJO2mcAaA_RXSzisSXfw{x?UxpM1n4M)tv~ZXl+E=->f`^?hF6-nF)KsPiB|u zg?sjJ>&WM@fjF4PpUCI3BVybim&KMRH_m_DC{7ueg3DNZIr^-ea1;^|`JZnD8VsR97b@lT1 zT~_EsPv5P4Sl}MwK$Wa>UDgGJwYYg1Ck{L@2(HZ^Z0|-nU0I*&rA0*N4<3$t7a!A; zwQGULgrtdclrVv=?#pXr>*Y$p2dNs1OL|HJ%Mt{ zR%2MAD2s;xBnm2Z@wLe`zA%FW9Qa|NG-3bb0ZJLq-jQBOrDpCRaQ_P^PcC*<$N8@t zHYF%9#ywG|_1{5Y(4^p)jWK5$joB5FIYN!RLXCEbR2#BBi{&t_MX~N*6pmxgZEQew zHSRC@8$W7)w77I(cvs`5tm&@!h6B_hMY>J(nlvg2pp?g~MQ5JCkOuy-m0nV>kGVTg zX&`@JY%>Hf{bhgOU4I*GW9?9ED^>;`X4Y1#ms?_u?9mlF;3agM%Xh%pbY9bgz`(b+j13(Jo`0 zS}}LLgH1KojsNNRSU86J`_q43S#aYd6nzaXNnVgQ@=U}n24*;-5%K6-t#-G`#5imW znB(y{p0izjj7-z2Hl`F7ZaH~nI0!T9wLTn{XM-pd3&3+VeXa4J#70kif!{tq{PxlpKt1 zDC=BsRM`9~M;T%}5b>r>5LVCo5|`<>PoZbL^_%d-=TfvsjKbSjiW#A16C1+>+!pdc zksgkrWD5RJdyGGu&|{Rr=k&lK=5wNJ^C{cLXjY!7Gz_jh9g70lT&jR?8fxh1;PN_z z2)3xa9C(G2qphI9{HM|YB}WA_OnPp5i$2VE+vRkZFi#IXsF(i;I9Vc@9=;lOhP?*4 zFG%M*M&jRM3Z&iK&ahlT6(X_$xw##&I&CN(DdytN{3xCs23(rZWsT5*2>vBv;^Lnymen6dtFbaF7|yKkvR1 zS?l$~vjBth#VBHP&^+@M7{q=zr|aXN0-u?KV5*v( z{qh`!z3O`a3&=NG&sI^x!l5;ElcY%wD0b@^9LPtiTVnF8M!I4Ho7A9PIJLdP-XMHL z#ILV?*;AC#*^+$j54o$8Cu-Ax2{zEm53Z!JCWMweAtZG#>dzUx!zwjblK`nNd(MRX%O)c@&?UTr1c0gv)jA>!J^1#rS@J1=Jy})UsEnkO~PVgAchhl zo?fd@(`9H=SNqdY1}}p^6h&Y-UP=xcAt!JCHc+318an7A)r$#44byy-gu6p$@tGku zKIJw6E4&h&R3Jo4Chotz1ayT{!(6dwH-C6K2vQn=u<*;Nm43gUS-}OsC_;XKiU@zM z6Sp^67Ln57=_;8@j)_7ag8&~nnLaJ7U-##fvRB)?$`%vybe~YgMOv|8flqoqAc~Fv za8b~_OT)QXtx(JgBSP_LxkV{mUegZ#!eUL&XiR&c&w)`P*bCrvl2xQp*z1KSY|oaU z9jv)(0W%`in^frpKVm(1r(&jiv0DC6Ring4f!&PH6;Nsyf2;HoI1q0f`2=2s12{Je z3wsg~r2k$RMzjK1B+Dz12k?mtdAJP-S~0tq0(vN08TLU~#%th<4Bw>HBIHdQ(R(lh z3j^~n?e&P$2g=+NesT(cmY;sr=Z-Y6)HFIEu-=1lV&=|G8fnA;}`ZMa3*z zGpzY=SU7N9ocTizoWv_XU^*N6M(1~-RT3MA%>vJwDLW$Kj>HOZzN2a{ND|WF>jdPv zgpoZbjLdK$$V?`$SI0@>r` zgvnr%OL~Q`TR@AEdBO);*S*ie9DhASTnIqA6`;g7X}0=EXx|EWJ~UAu5n`lPK;^(; zxg}qunFSk3%pSxu&jA5>x)pK(&o(xOOyo!~-*eSQ1f{9t%r>M_2Rfj^W@Tjsi8=yW zdDLgGEoM`J;gs$=-;s0zPJDW1^AJTglO8iXu4lOPI2u4~Z_44_<#Y#(GTVjPpM8g@ z>6&JQQR)8A3${$%+CNgPQ7nlqLDVBi(SQBod`lS|q%XhOeevxf2R{VxvH}PJ$jg&U z7y*LBO{V}2(N-B)XtG5twGKmqu%3{?1db%4`q~THsG_pba#SQdxuMso&-FOW?rv|D z=UuGRge-n>`=`AkR2Pkk$B#X++7DT!EP%ct;t_UK5BiVc5mC+O|9rSex;4 zr$AvvWgt%PRoXmrj7Oh8`Xny6k95MzXY;@_2jHH|G|LgnKQlkfM%$c z2i}-aIVKE9+F77M2F~_vTd+)9K?}~zM%IitkbRxXC>>w$;H}JQa`EincU%J#kISh* zT_=kaqar{Aq^;5cokCZaRugfXA~vuFBjd6=b9v`RoPKl7ybbHyA@7^f>v4G?!(VIr zVs$~1PJxD?x|VKL0rH$#m(iF9un@WCE>-IUSfbj3tzW8*7T^H?cf~y6*H;31@vn61 z-w3>jZTf03u|bHyC0oaK`=&}lCYh>=I0{2JPCLUG*vtkc9%lOa>(8j!VKq2B3}`5A z9*55wihBMRX90h)Ks=%H1{3AT$i(vCMDQ9AlJukb(=u0YO&|24xF@xOV`UdOZE|d% z55EKfGt4hqY02~{{C-os02XBL<*iOz@&OEQ+ISkyWFoE>YM4}1^f+4n2zl;P7Y)TL ze&fdHuI_W{(Q@I`)0^ONy7vnISpj(qvw27ENe{W9v1Y&_onn4fBj=Upti#O{JT4tE zb6JD-Y3$4;oKOKupFN7xiYhBew{Mlw?{%bTO=U$JMPRjig52*&>vfCK&9kz)5 z?G14NX)OnsL;ci_{n$#HgyXmcpzT+LoLZ}(dQ$!K_}d&*jU7SeTqTtTvF(T#$J5Ky z$4ZGXnPL!F`toY}k9rg$t%Uz<^G{$hC|Y$xfO|J9DBMl`X$ZN9;gy0-w*l+D7gLPE z%iY%78zhTaEH?{!17!16Ir4=D4PIg$1nNFHD8~+>)YNLsl*J8%<9j`#CE6BZyHeiG z*E!O9ztUdwR_D1zBmA?Vh1IHcG=PORp##JjKT<3w3NSYZQ>Ix=;1LkUT`=2?rw+6x zzRSJ+F)#6Y8nK{psOZ7lJ`zjT|F3=tkav8B`jWuj-1OMy>mHxn-h;oj__9#|&@fNM zWRBfD0g3&t;yrh=peb5mMEfx@2W!{~#Adl!0a&Oa|A{FqFAinFiE^A$GS-%hCy~g< zdTp4G#pAez5}CoW)Z=4n(avR20$4h6at|~0lwe0&EPQTGd^K^Q2CdP?zbSk(AOD75 zsSM5oTO-->x8>>I6mpueA!;=H%D4Ax5CWXPyNoA(EU-XnPqsv_UW9Xn-}0043ns4s zKXI4hV?Qqd0~^weL1;1u$Q&YIvCB*ghFRpKXk8A4`7pVKig~P&0OrlYCFXhk!=%AM zK`%eOAZvxp^xMsx7+jpJif24kskPGbsD4bb`TS=};aq@okj3Im1dCQt9u5H|7X+A& zFEDS7HQt^VfL*0a!G9j^_3Lkl0zMBjg$``UotW&a|8q=WfP4eMCsRQ>J!pIHwi>N> z5WUXgmVU?WLd$H-%|N7i^Jvtxh5Mykqfl(~Poy$kF=@>{A*3skSni;QN^T5n)vMZ< z=ODyw@@>SS(1}62dW4-<#glGsd_fZqdw705+^C${YAL19LAH`#$bw z7*?)RetvAe+bdS9cQSwX=iH;-eV-;GnPk+d>kYTAJ<%veGGH2hXWE2tn0Ycalh6* zJ^6rdsGr_pYhX7N$(KdXM#MRhc%vC0O+boy!WJXm1EkYA!z?NRb6DLuIas4ckxXYBOJ zsP8z0U_B12KlfrKa~Ya2WC-M6bRK0Krit+f3sR8&Cng%oK4$` zUu!y)itkO%ynOG{|DzBvT=FB%u1e?gYu3#+9sX1WK)- z5uzF{*D8ASNDKD=@d7x-RZMQmMG^X|paZ+(Ad($c94Im{O{p`uKQ_l`Ps+yE=_$HF zVElFv!8Z(qMj;z&^(;P;aP>Noq_w39A<4;aUUZ`qCX_?-}1G-eO6pFl;YU`wOV)2>oQW7 zD-_-VH<*{Gzn$ok1Pkr%NgdbC*%Z^gSJwlLM7enD+6vu)GizH@^&@pe@)Wz&=f7W| zB`LBjO&Cs>1s;0ks@%$h#C5&CFCf?#I#ekDnTS>OA`JxCZVxxC#Jmmxj|;VtwV~F- zOHDXMBfW(lmwTWTYo`mnrB>M~bico{ZrA^?H8xKt6-GRVvBKQ@^K{*7>i%==H?O}4LH;7)ou2jfPs|KI<0(2ZJ3IZ zLb{HAy9r=s=cr@xH-)!Ohd1YgpLSh(F`gH$5&uPc4&k;9ky6+Z6lx{bqq>4 zyT%SZLQF(7G>sxA0nYd}sqMe74bX}Wt*f%Wnc}d*58{ErZAv6{7YME6%;9C4zbSCF zMFw1X6>j$UwfMwF?Nsr;(`E49Ce1e1)UJgYvKwv<;2j3~$l!Qbob7+PhoqPE@-YM&gQk%3(WYO^#%mRrAB>?TcLdpn%yO%PgNkU)nC*Yh zASi5dGIj#R#Xz9!fc4GtlpE3=*f9&hic^`J&Qhi-n_8ulC~b!r{A30i^@*pCi|dI3 zufy=3^)j}iFIF{98SO>Z>d>BmBQp77ma3o4sIDw)f#BHHCxbq$wVo|dFvGYfFr3Ar zZ-u@=A)P~o`eldhGqLc3?9V>`cer@@f$8AyLa*DiW)?N;E*`@!lsU35X<{NG2(aGw zS9!v9_ut|nT8a#Cbksn`tvhk% zW+Gy)+5yJJ7qJ_lU_Tk#1@E*n!20s+c&H+hF)%8UpP2I5F6Kv$FLr4h7P`+$MQSUO zk~6>TsTQ!DDm(o$`jabyMj`plxyhhT@rKDR(DeP(V!yK>`ZM(wb!;?t)U&*A-*Qi_ z@FEEA@P9X;Er@QZN}z1wD<)%{U^L<{W3LFF`t=}Iz)hOQ(yBJN98$~^Z<#odGvlG;(lME~V6-eH^mxI@=@OlNmxrktd1jrv zi#{^lPv7#{t~8vyz!ZKCaPe?;%qOLwCl1K$OrVuTLPCn^T3vhUW+Cg(kY$jrrT&us z<6E^TLhpY{S>Hv(6XcAMkvFQ`XnId8gM3?Bgw;#msmq#HOiTX?lYHt2FikAl#(SGy zEO77B=H(+wNb!MG?V?cChI>t>^V#;WrwXw%Crztx1iQ)5h^9Dik^S>NfOV)I%ygyt zr7C8dscT$09v!Vw<8kJ+mTh(ym6tv=0GQ^V!ha;A)pglh3UKB))JMTIL*@9h5ZiYJ zj^~_y^c1yQVCiPRTG=9Tv#3Wxo6M$ub36Ig9K=IF2|{N5yw&G_BnMIOQ(rRVp?D@N zHoC{Ekj19rG}9Aql1k}4V}4UBueCS-jkz-vyW8Ocg!@n=^$)9iK5C&&Y!Rmmx+?A> zjxjvwDD&Alq5baxgH5NK9S}!y9QuHVfx!|k0*D&BIYQnA@4j1@aLNQJt6sKm^PZld z=H#1qtAz&*rSr@6zh#^jdr=%mr(T6~`Qm6i^}AdkkW7hM`~YbqIpD#_gicea+ml*9 zG=9i2fyd+Yz8Gk)_`8-Yp@{}&kASO%v{+|ovo;fqPWny|=VCh$5{C0q?AZB89@Jf2 zf)W{(LK>HBqFfeY!11WtC<#!SZ&irm!3bm=cnOEBCl!1Fn5OhG!BX-VX3Eqr0MRH| z_D=@!2q9NxG{~ZE{{2fuTD@Tb$Ihk20f&=R$PJ^D#0v#>6nn+At^RTkpOyV>sjdPT zkg+ai_7dQ|G6pk=P+h`aPxa38I042CYoEn>=LD8n?gm-}Q9guRa8Zo)w_r&p5$B{B}Pl|H>^BRD%=fnecm%5{78^aVphzU?c zAf!5}Mfu08$#T66P*H4IssHH5mmDmifowayhf_Yi3B^uVlhTPqgn;g?jroN|Zj81% zbOr~QpIIP}p^lh$l+QFdkqNlWCoDdlh*-oM7#faE4eZ$}6X#+QdcVI~J5V?O zlp-rdz|YOuI|aiK<-@jZGJOnb#x@eQk~e<3xV=S1>ZP)UeuE}8&*`A_crZSSqkolnVy$<37F_p8F`AmH{@WPWe%BY=90PsH}>tWk~>IHrmH#2SCgU! zzYzoK-fs@YN)@_DMG+~_3G=yTv;r$=^U<}}N8I|c$$*-jL+*bmjl3apwb6?W=rwig zrPLoQA&Xc8Hm+^D;~z=+w_LoH7-%r6y}=CZq6UBB@7wb4#=y@E>A`dY_^Hf&s&a*X zFRl;fhmN)9K$9=h+O?L#W5ggP>F;zkO-07|g{a@jR8-G^%+9qzph<0=|$ba%8^Ec)(3 z04O$z&AJ!gH$8r-jyr6;a=uAiL&{zVqwUfDL|u2Hx+;TOnf}C+K|GcAiLP?>ms8>` z+~?6fNIfgW?n*Z}VA6~X%SIDaGBQ8pEfCLwZ)!?1vdE1X;BL|NLR1WZKDkyCMA#=2 zy|I0FQr$^rYQG&ORI)rhZe-NN1brF=OAuoU#0j!llWrU+(y1&f|rj=~ttg z2VdDbgeotb9So59fnhSSVR8Em$F8)tH}9Ik2ansGM|XK)izy{kkh4h{E6hs2JqRra z92w@kjbK9_QQG%W$$tMP`g{LkJjz&CT2XTp!0DG0E*>N#MXH~Y*qLBEmkHvh+p!Iy zZ%blVsu9JMj#>Q@H=U3$c0=p?_ccXW(wKS#f<2={UZl(Qb(h5J0m{=uEHBh<=UTs@OKeOo36*1wP>3hk}ScR;KS;EU4i0 zCR1m(x0;YxU|>>01^pK$vFcZ*ZLa1^=s+`xObEgu?J7TIEX*7{j5;J2XcuhS&)RP#KDm}ec%t|J$`miB z$&6Q4{T>|imef2J;fKW}eLdhY_LdgemZ|ls0DC2>yezyA*(c*l!lOVJNUX|gen0z+ zo`*;C-M!h2H>}j-T{wxb&w&pd$&`F74JuGA^|fnEs3oq3x+--v1!^jZz`N?$>=@&{ zJ$84`7FHT+ZMZ&iR}mbmzox3eH<#jiIC=C($hTxNZ0mEP9wkFG6A|e;PW?gqWpbsW zDYp#{sb!b#NKjXWh}72?0YXt?sB&n~9z+m@`ISlr3q2^Hs0s;0Ag3hww5YjoC;V8> zc7J98=EC-j3ObvTC#Y*y=S5(tGt_eG7Mjpj{{aR^{Z>LtFE6rs?~$A+@OHl##6TbC1y;$I$t#NgT$#7CCN4}%}X zfRBw^@2FOq5fLh@Eu~JXenE=uhd7l2Mxm;pH#01vv=(MIUjz_+&DCfHFXTCst^_*O zKz>S2+I}gO?AMSW6cVx0ci+e6GJ7dg1U+k?ACyCM?1?!nq-iSvbz;|BV%o1XG8rp@ zZYl7aiPN|68gI6r`wrsF?LUzz-%otYj&R&9la4?NP4&ge$qyKzh_U>vB-*+JF?twU z3^uLbqzyzl*2KRiN$?j9)>R<;q#P^tF4s&s4{oW>FnH{7)cpbiEtG&zA*4Av@@lI$ zEjV8>P1d+SVN!R0(bHudO`(}o^ldbw^bhPH!;&L)ftPA(<2*G(M8y&mykBP>+MkI# zeI1mR^aQ+jmZsT&P^_e-e123KP=2Rbj86S>C*UN(H*hhk!M{X2_)e?Y=K8kl`=YK| z784?m6x5kz2-hiV0uYGS#msRy{acBV2G+a7O@l1V;2^n}ZoLIsz$n=~jd%P6l%lCG zgV@3l?HtI|kt_yC&QdOyb3uEG*$p$H!$Y|P@b2%**!Uygd2tNFi1?Uh7 zpr~*#Lw#rmb+27kJ=aLMl`Nlzp5U3tsVKCq_3$Ve7=_zpZCND5s1X+z+CK?(xgBqJpTc|Of`(OuRB z@Ye3A=3}#2V9MFcBmPbOCE88g?TOG2kEzS1^TqjBu?D zs%PoiYd|=(A~sd;vW-$)*23KmC=%k`DxalTf3TC1!bg8@rN5381Kimga=yHsjybjK zX)SxUt^=T@rsOn!|5yY4#M3l;Q>y|v*m~^fQ=J%R)XB6w+22NZUySh@)!D?Bm!wvV zl@vPr5oVvA0J`Og(3ma@1u@oyTUe#UDHezKoYQ-J4&M2jD&u|u;`+i%V?0!O^$`TZ zdr-B+N7cK9V#(fL*Er&HTM3AE_a2i?Vez;=HtrI8R4d0C=l~xACleRj6F`Tg+W(>0 z#cScZRMHZ0{wDFbjGKrw;#UJw55S>w@jbtZmyoyK${3YkeX+OE6o)k3Ap0doBtPgU zQkp8}tuHsaSA+NRwjWY!yR4X+wp50Nfgu7gNg-51E_rh{M%No_ToO07#up2toyx(n zv^|Ithi0T7btqfA#hnEdCUqanFg@#PN)VQFq@o%Z@P%R|eFayHIzr@=8Iw5Dbj*2d z7JlL=iCKY^KE6p?7#qNf2E&3y1YQT;~48l9}}$`PQY8=iQDEXT{9c{BfV2 zB9BD?-;zi^+ZhKGVcQ!mxh7*q+YyIMt~Yzb*7Lc7Ui|zIY{q>&@74Mp%*XTdK%(7m znG0z>w0W4yC||}UFeIq3!C<|J1H&>r*`Lk#kcebvQT|t>Cv??^iSQp{(T(t@K=73< zHtZX0$OM)?0tS8;13!OffgnZM_0Z|1aR~95QV$;YTn)OPbjAt@(fQ^CIf#cpex4Uh zCbr%3aP~~6(T%mu)WvQ6_*jW}&NUNg#9||YMHui-&eXNgchmO(MEVUfSX}P0>rN4a z&jn3k_;BJM5 zhF@3AU9GL1M{nA_4H?S!B7(thajrtK9*XSwAxjLN(!-sR z`jxi9=_Z_X{08F@V@}(C7v6!G**20XHi47DDeOZ(-&YVLJkB37jR|{g3NHkWDiZ7! zciNtLxPjXmnG8xpswK5Bi($%m!|B3f&=9HsZh4won8u4J?kmL2CBEX>aNC3*LMmS$GyK%^hwU8=EiFx_uZW%0WnvgvS74zuN>BcgutHG*YJ zPvaR{FN~$7wv5_xcLuzHdwB%%^;8xe8IGNE2nDAFTRd3m^nulYzJrW}q+H}*?)td$ z3+~Qm_PX}h8=%>vbb)$uH?>(t{K^n^)qVe1Pt82`JkF@o=g%Q`uVBZ57jI|F3s%b= z?NC5A=Y2cUsUjTOOCI6{yYF)+BTHK~^vpGWkfOKet{9OM?pD}OkIL<#xyNO^E0Wn~ zqx$&zU{+iJ#;A6Oi`?MqW`qRstAa?^#;g6GNG;4Jq(zBy>)SBtWNh!N%y4|V4=S?+ zkI6Cel&if0k!7WN`!k)~G~XhN+HV6%Nj5*04cj2ebA<0llhrRG0X1dJQ%mHgc)Bb( zvcKl4;$eX!j)arSu&$H=*P^!-=VU=kEjB^MM383i6d9V*UY} zDVM`EKIgC*$2YYgyfehDt$jMM{Bu>~Y&Z_n-o6{F4~AXn6I$;GT!sWW=hT;8DvZL* z6dxkQH=v$SxnPVTYfcm^u2PY$9E&7jJ^?NDHbJKP#*wyV6p%jJqka(d15_73C?(dr zTk+~Exi>rks~6<*U^aF}b(}CTHrx*JiOwdlPnY)1zFB#oN|-NFq{?fDeANmj2N(tr zM!u>}4j&nM;kb=Om_@#Y4K?w@l$w1=2!(}(l}@Of*YUpftFEB39Ry(t^~DL(6Dh3T z^~Q!t=eOG(Nci4bU|7iT@;U`{T5;UAx_Xk~mHr@)7o;3W-%`16d0)+%_8n{KfQ=Iw zXfnQJn*$6dgjR(d6mx!bk;x@)uRE8Lvpzicr2K%U<%4$m!!o1_-)JE!~U=O0u!O;z3 z%LO{=4x}9?Y^|l7j}NB^w+^s`L$b{dd4Mf8!+%xG+%j=^Q6*2R>mw}pg*;7g$m!we z9sCPoKi?FH5%oubijTrfi8vN*gION0IUg67PR@r_x+wOwqq7+aF3n+qLn#9Tm&I9( zRyg%eLPn;SczI5+ekU?+WF7$UIcd}Vu3akquY-pA*PDJntVC?HRT0&!$Tp@h;Bf~0gR0s_+A-Jo;`N_QiO5>iS_iXb5%A=2F)3iu7@+&t5TW=6RlRZDN02P1bo5t#~WMGJc>35-F09z*PC(TVaxJ zpL2c#uLMv$9gb#5_QrLmq*62twMlR4)9r0cqyvf)6VD;d)zCfdO?W#PPRtMdk8~`)t4gIL*@ZRw%81!VCJmbK=pWeI}&J~6N449#O~m}ht<@66Y?P1`sARY0zpnA z?g;1GjfLnX)M4sv9gt(hf#O5aF;Vy&yMu4#u~hfpeczBxB`7={wcw}qwWh+6q|(eb z_PuWUqOx~~*tt0nQx9V%-~sZrdqq@F6!RXp0AB#O2>-wbvg$9dp1j49qIM^LWOG4E z7vYhMdq3Nc*u#lkuD7+pgWG%{3KCheF7ep6GSVgH4T8U;oDnVH>_DTyK_kn@S6@_` zqX~IY)8Y& zl3adVk|oAY-Ppj+!T2hYTtJe1v?~7F_ci(;nh$y~t5o$u}j-4$j! z_{5@Iiz1)QFVE7tERzy49N!8hRlZL_1|dnTd^?D8z>%y--N5Zx!p8$iX7;#@1<=1; z?j26J2{1%+)>=$(l;2?UP8BfQg9)k0bJ7*NuikW8RwJPjU30aN>p!7UzC*i}!SX$+-Rmqq zHpZxwD?=y)RL<|1e9F;c?`yZ(NXw57CQ_LqXyhJ()WBI@YI;_LBY>QEd8nAZ>|!}4 zavolAUw$HwmF6`4{i^|wtJuGvdc2CD^3()GhcKb71ka9pTb9t{e^-9LF zYi0Lh@Z3VT5=Ye~(&oe44=P+8Qc_{9?5k-?FbJ>&4vY@|H5xeKJi4r^jPRkml&}*( ztVM`RYZD7I_OBtHDl4TZjdw(S@pAp8JUBncLt}$QGvw75FrG zkG8%(Uax^L7;s{MCsZ}ba4T}YD^cuY5>GDavs3~;L;tEGn$0A9}{dgpCi!fvru)m^EDn0UbiiUt|uFSI>>5t}EYrejY$Tvv1H6D*v zSjei=-H=2tY7c$ z@}Iam?|*6ylWA|IrZH?wRpWo-BVeLP*}ZNZU`saBk?v*Oa>r1S^`+dQuoI7T*X$!>?WCluE~@saf~N{gdY@{1JwZj<2KaD;DI+8UgT)edl4xUnhT1d)si z@-{$_FGcV>nRYGqRVv246>IVIP<1`ty#Mk};6SCez;p;RM3sF_P{xV$XkI3b&8*l# z2qc2e>ALl)%h=(qV8*(ev_kFG^KVvP2VjnZ3m)?oa}*Ux6`jv$;AO6#@>v1(7G6o5 z9dz5QfI;CRo`xw?O+$9^eg7lRNa!$hM+UKBvaJ?A-5) zffI3Z{fm(JA7w7I!d>?Hq1V)l5(-`qR35(j4$~)>h{l*=Vg(ZX;^sb2+EjC8B*4XY zscqGTLHQXE`#0rm1}qo&Ns*m&*cI-=aQMq~haC;FB#j?|bJlfpKAP z!ZZ5N#bn_L`8`MC�uF;CYx>f-ZLk2H`cl_9}e?dl0#A{@~VmF|FLNEu|!YQva|z zONNi&gGZ`B;qv$^Z-6)e9%$4s1Qqq#`*sT`rY>1&T~9PXgdd#}A|z6FxhAsZ+;*k# zkDPSxZy}#UA{cFr(07{-Bu3E9UZdHr zP}>_v*me?e!tzYL#KcBPDN1Y2Ri&Wty8ke>Veox9C&Cw1mcf&9uK76L2nUwHU7Cn0`4O&s2Kv zu25deQf6*q^A6TKhZ2PA`<}7H^T=NRalE-(-96U9tM@+%v+I#@8eba3L)TDqlY32V zJQIl7*7n#~F^5JXR0#xd3Pj#LI`czmu}aBnzmCj2;-qwV*$CjTPfr_8Il`&H)9LH9K@zX&_CE-^Ze|c2 z9EjaIz3fax+^tA3806b8`H^4WIKhBFpMad87e z5&bZemi>x}!5rb#tJXlddcOvy)8&-GqsMI8`6<`&MwGvy8;nX$yrKE`PxEn!Bq628|(r5FUaCMQ2$b0wQFoBwFH&Zbjs=otwnuqugs ziFr3Yf+&z!Sok@mg<3&~_w7b!6xW-4x?hM`?q{gE)ZZ%IisTL2^w(4<%^KL!Y96YG zV+S51|NIK&#Ep>=OcRnKBklE#c#e) z9zNxCZ((i$C~w&ftuJ57OeKJzny~M@A0ck&^NZC(I5H zf1$42^q*`H{v@)!fp`p?l-|vN7Qda@(1vw<_`SYK0aM)J!SY~drP#yl z!F=WH{Afw^Cwvbs*wnN<<2UiIvn8Ww_pIN_E8BE2TPN17&^Db4VjliL8H}h_;RVrd1Pc~`pI(TXw*Yv$m&(y4}Gqp zkS1uxVmGBh8*GBY=badCJ&@@usLQ+XGX1slMGN-k{Zr zjWCV}t`-;2d#)?!8>s6&4w$(xR%8&B$;&>I&h6oxa9duI@?JTFIRt{kb9ekRKR(e% z70Y{kjTGg%T&m1@3<6tEf_+}Vq3*WUx((cMt$qKd9b@HvGqLkD`Bx=S6_l~G^@EHQ z5Obo_1w)#LxcB+X!%C>1slQ1`CF^FJagkKSTB#BdG}tt!Ktmgj^_3kF0yUZEt$a5* zNm@9Ok8Nu#k2rcr+%lbuQr<2`M+#?3<1@a?I6@|MnHZ%$WeQJPr_f$l+1mb^F2P_q zs3L7RwKtg1X4#v{{LE?C$?f&BgVfNe8=iIMn?w__7+$n?N5f*(U_s>7EkV6$ad&yT z;$Rsl!!d1BzcsRAr1qfeG$lTvn*co~3q$vzvyUk@if1B1K$GQoTb9->lHFl5uXLxb z2awCmz)KkCVhL|WMSo*BFngJhOi{j~$Th!^o}CJQTjE zPXIdYz@pgdrZJuo@JOXu4J&JTaIIYyuRVfN5wqn(ZUP-pNXt#P^l9I!%NdnUI3b5f zge&os*gjA_bH2Dy4ijw(4!@Q^?hoJ=U;T2iU1NTNNnsro38@C(wj;meu@z_!5E%qk z<(UM%yTmS!b*HDTi#hta67c7QRM9GE>7#V$j(fG&{m1&WCA3!BB@OER)K~?RwNwp} z4xFawNNZ6FwZHGzKWX|rQ><0R=2c}Ff@{(F`CN#&+bLkAF-WbbVSDf=C|l^t1f&<= zS0;AFAKoJzw93!=W0kH;B9qbDl=8LT{45MpsZkSob+Af*PG-876~_bbJq_L=t8RS? zpC>8`O0A!7r=+|$&ZJ!I3!_17;me7a@2=>zpWe*ahJf+cdqN-aFgF(44Tu zBe8IG+eO}mod)X(=2NMMAX{MZl>TY)$!Y-_HSPX%JEf0YI{JpAjYj3_wf5Nf0w~oN z3^KOsgA1IbUc)6CAgiQ%vs|UUqcf%9`?|pNo7^IqGj><*8xsi{QuPiAoiz1`(jX_; zvT50U6#+bxga7b(n2~-{UOhHLWDJ(NJu2Yq^6nO@tFo0QA&`;BMH`K>8H5`L3sj|! z4sR9?$Lo6KKEM{ZTB1LPQ8mE!Apd&ACDU{+<45!RH3|32lsq=p>BSt2MrQiWJIpG=Br!+j#W_iRGsV@>i zdT@)V@Z#|GIg8G_H)RhP)4gRJT3(w8w!Cq+{sz(=5I0`Zn#we53q`ly=+6{0tH1Lh zN``LCmrv2xAklea{3{<3_&ARBG%`S8zr)y@uS`4o#w?mhLGcr+ML!mw-=zCf+j6fU ztd@>-pcz}CjB%L9v8q4e2t&O&*iX>vBxNZh3DG{F5DJbk#o0qa z7QZCE|KWJ;V4?sH^peAfJpmH_3JlL91j}4)3Gm*mKhl!i3--M?I%s%yk<6^eOJ3&REN5Dw# zW6~bBIuCLzQT&O?;JO=h%yT@=M@n3#6~4SmE}%bq$KdVFXF3wyXz7o9tx@=%>?~9I z^TdIt0UA^1xsQ>hw-&Q<|Q85TGtfxcRj^7mdriRu>Yniq4hQAl18A9Nqi z{Nc1R1fwsK<}SB#llZ_(GtMMon_Et6pJG>|oCH4kxlRS8WIl<(oNkV=z=tKNt> z9LKuM7gZT79a1&n{l!sHBV_{|=56#^HZsHEHyzS-hZUfTd#vD9i+cKXnoa~{&T;^c zrUI;n3UBY-t>%EKWVyz*YnOy)x0}}^X&zRYPmwz8lSvql=SQ}Hc7kcd8#{01!}%@w zr*DglBa$W$Xn<%9yvRC@^fyx(Bds1R;V#_?)(LZbrBbpDAGp zTE25BbWqxdrTH=tqZUj9Ha~n@dY-6~7!l3qAWP)mv6@{;l#OB?*ce~9WV#^=6zM~XyAJ7Vf?cepT5%`e>rEezu zRi6bGB5)EI6W2scBiVioe?tYl;WaspZn62a`@-OD7nD6}#7U2{@8ZJK7B+Jkl=UjttwN}jJ}PCUhN9E1aY0ff%^Lc19tbv_#YgEuRy6?3AjfV>MC8oyAt5lEcw^(suvxG8gtWf^mCK2Opr+ zK|1b6gKBc+`*8;{#mKrhWE7P5W2qM&=G}SvXtc`4#uA_joN>i=4?eBYgd?}lR+g1e zM`Knw1rSfJ(3m}2PnSbzxPc@kZYo#d-iEy-YCu0incL-H`b}2Ef=y zj>;dc!-TNLnJm%Va9%dF^pu|&ME)YqvJDs+)yWB;=J!X)0B4)Wi@pVi?K}*cu$uyO zOQ)p!O*orGu;rfFV{{ACRv0(vPQ@7p2Tm~}Fd9@}g*u<;*1A3oC1REVQa+WAHC8F5 zA4pf2zTyf`nkP#GRm}bYv;Ho#uI77qVTRXgW6smWi}<2_Y4qE3GnjgLK;}M~e?QGh zZftA^^Oho+PQ9l_5e-RscW2%<2CdYs8yX*cE)p<39DARf>ZSQO)4UjY;+n0X*f?L? z2Ix^peD^@b_H4x1UtHb$I0VsMxA@i^FMOQ`qZUd5^#3)Xvr9gv0Kh15y2JnlCRC;*&CF`Qu2x z4Gdl3XgNjE4?)deNW1j7PR_N>H=ebC$Qy0qs`dV}U^+}3oJ|JgTCQx39b;t%cNL+} z5VThYAttp#z3->Q0C5NE+h={U)D{+gMhoA?+rB;)Jt6d3K*Y#(&^Mr6h|QqFsJ0I% z3XW(lDcO=%pCWbQu`QY6NFDz4TvqCgcc|n2fp>HDt>2s4YKpq}z3C`gcpJQz)}Je; za&*hEw$7nq2qiq|SqCL4JL^;0)9sr_A}NnoBX**Aw~~4qOs2;iQhelsdsxR^-`YR0 zdqR)1a5-I(x#h_4m{4|(6C<0Clyl@h)=?zFr>7?j^%V9brR%!b{!jbuv?qIsEUB*Z zOwD!pBzjqHojjqfpEwp;h-esERqjaMIw8^#JtlXy>`JL~J91^T`FdmmM8fjk{9J^utUsenIf=(ma$~ z7w0JLjBai7FG`4Vk~`cKXIFf48!{R2-((QjX|Jq$OEQUQ4Vst1cdF<;FXQW*h=MW8 z{?OPVuQDJZDQ&8jNzlChaQb2o$&FHH#;L7e#C;G*HVloDGCJEIGv)X!(LHi@uHq}C zwHLe1p>ND^TsL*!N%SopN%Uowl)tc<7Tk~*W=WutRb}-hFO0wU9Eu!uBT}|oppulI za(`KN(+z2{)@KjNXJgfMGC^i_IRnG-SEArQNP0ge^aNw-4(8W#pFL0Zm;_$Cw*vz< z{7~-RLD;E?2$3HOjgBlFuMN33lxxU{F{df~VCU+sc3K%LWXb&eozjyk^DYyZ$l1!`x|oY~;b3pegJ1>rwS5^Q73CB6o3mBSoIlxEo(yaOJ`oLbnx-)6++m zBxY7Bp@L$7(!@>~sJ{T+AxZ!rap^|2Y~!uz){uC%Wg5tj({xv(BO%#PE4{g+#~QTF zq!yXmuh|qLSpW&B-qLKTY-YW+BEUr4|3dA4?kBYPf6c&)o?t#;NM3!gIF)yGUcJU? zg-AYyukSdpj|Pp2MyW*PHto6eto7_wo?To)?reYj)+Zpy+K=*d>j7~`ssQgGhzkGz z?p3zYG20lXeu3p%`#xv$xo)WMoV368)xs!#@gm>`C%Zg=EfD{?z6KK%9h~fG1F@ec z^V(GFD62$Z*SI`~+?2FA`NyACxBj()ukTwFIbQSE?m{iirEF)iamy18!qoHWY*Hxh zt}+=9G`tuv$qd|br01=JZdLy{bA8~H{D73(Aw=8;NEv;SluY1W{G@6R`Iqx1(@ z7^lr&x973hPq&~a-E_!fTNc5_*$ftGl_9Ly$#2f_+X>oz_ZXGSwh^&#?Y`1BR42(9 zF3mkAyPqLc{a?HOA4OwR0{K&#zVLFt)U`BDldg>DrZ@1$YVhyGau5=-YQm1un7?#9 zHHl(;M*XXQH2dr<9ta!~>Gks;|BrU`KfVP#d(IVZII2nj1ch5&3tQ6z*pVPd7wLMF z9|dJqAp?9|P0T6K!_r*JF600*Oy1GXyjiYJdc9Z0&ha1yPR!3tqJQtW_n9wOHbdk+ zUYn0Vlfz}idITYUbYL;00Veas$Lndg++IYmRbOoi)J?nZw!fOlb2W}d;~A)9ja5%U0!H_k$YP@t>-}D~i&$~nbpgs!5D;1^JE-r{xS~SlCZE7G}3fuh~L7LGh z83EHYksqW5&%kA4FD#ttUCkvGcN_iAaT#sTE?(5AjThqTjA1sgD_+F6-=0{&&5@a|<=cr$6c#*e5?Cy0uyLB;r^3`MC z8&5yg)!f5pw!8$m@eDDEzj(s zWjU;Lac}B~Y)|hp=%S?xxUelFW9-)szNVk+ij}?HvxxWC+kF_K%o%dWbUSlX?UVE{ zTEF(9cAs5s!2RQ(3nvzP|1Dpf;Rj5>vSmvr!&sc$*0_>8)~~|ph^^hLl#;s zRrTjQpn8abBpaUe(hSZ&Ou);?W3swOODx`$p(uRR@^T*Z5SgfZ;S@=K61buEJbZj= zPvwZ8i7EKP?nbdnz@6{wG=d8^9g+SvELPV|%lTGd@7H#8 z0wyKjvqG^kO(0|wyI-ue(3P#;leP;8I@4SdMHbL|)47(Kap^DX;v2EEUauW27Z$5T zByoT3Q#B`7NU+;q)hO`Fu)~Rx&TuQ6=SYq$wSoa5&IQEo(RweB7Hn?Uc6?dEcR*AB zzX|)_7gmE`0-8c4ftRj`+MPo#pC+Zf*NaG<5lNTUPXKZPrMS%7 zZTDW>&D>ud409Dl|Jyn^ zE-DhD99&a=kPnP z=BMf?q5Wl;3Q}jZ%kBBUvme%zU?wQEqw}rZW(gD0G7vrPH^pBI0i8r zOIg^RFHgv|Msn#?yk4Get`yg25nj7@|EpE_$(G#}US}2{B{H_XX8PBxav?eI5D02r zY4O`?zZ%+^CSw4v4^%kL_)X5W)(;x2TTU)vVh$?sGNB;fz%~7@@FgMiVMEA27#%oF zbCyc%B)K1abt!n5DLT&`9QW^<@XL1*d}Nu3B)EaRDOyR>M>JU^pvInE@AXam7-vJI z@xqyqwk#y^%hXhL_Xa@8kIV@#uo>hD?|=A`*bN%sqC)Qbj(JQU{77O7TzpB_s5V!AZy|(!TLjzjzum5>VSP1;bMs(64QSm8_z#J&5kzw z2;s4G25RKc_F^@jfnd=k?2mBfzuz_-`y`3SLK2iZTyil!{B1XWg=VTZAeYL|jY%PR zU(5EK#Jw4at(p~55}X6Rak=$i(liKNkFfO%hv9#5!Rr(BIZgQ%+)DteVmztYS1|Kr zVnZ)rk{C*=0-xX)d;ha4m(yniC`T`qm?-Zp4_2VGZf(P~Nd&pyqFiq!3=|sL#qdvXt@oWmTTG|w2qDT`TmJLB2$Niq3uqrv_x0<~gLc0p<*w{Ur5fxQlUko>sT zTL=>`lgTj_nDTuhECNG&n<8f#yuW>-(M=)eURtM_i%~&%CBP{b0vzto&-FjO|*?KCfi%&`BI!Ciz-w zfO@7e4yEm9F3Y_5^0mrF_bSwN;y>TZ`ImM2zMP0`wy{X9Yv9n+?m)b5&tskE3cHJa zv|-p+s?Q+}{j&;y;?s(|1fxaEUKK-Ub@Xz=JxhrB43vtYzG_$?ysDOgMJ|xUW6Xu} zhusm#&Quw>%F*v&utt7EkCacH0~SSwwRR1ji4=&$uA`h``Cj9FLqS1VyyY3cC*Z!z zRN=KiUJWAholdV_L_t}^BtA1dkWT4*!PbZUmq#$YEuxjp&~G+WM1HsEfyPB8W#&?l zkcD6?v5?0;%L|%AGL&+vs9Rp{=0KJt(4I!$Ft>T8%BZM9`jlW5B66D87F`K9VgSAM z%E{mU_q_oYF{;PDpC#q@Z-E4YNlV-1)VcP-!UAApZVnF|QQhW!ED|=)$^?gmyneLc z1);R0luIvLwQQ7aZA+F?x-3glgIB)0ztS}3390;ZE{Qbqpp^5NbF{`VtA6UzD7&+8 znDmm7ln3BaUat%`O4D#A7#b;JH=I3(9MQIBT6yc_2{C~skf6zBqrh9FtKL`F?-j?a z8h8PVY|+t;0Oj{F3PaY0Hlt2C+Rx!xv|nUZHSAc$YwtshWMY`~ zu0BRV$4eMZ3vJs6ggI+K&^)j{?>cTcrb9)*%q33aJ7JN_17K7}?oGhwI< zWBHHCba#N_%cX6^TWi+OuuL_r3Umr3XLX7y;n|tU0&w#vsvckX+e=tSu{0WhqLvvN zWhQ4Nw2B4q#a?P!o(bS3ln)VNd}Htf+^!0M=H#!`YDXj$s=vzW-l&rTHe#M_)X1G| z$%y=jP2`}zY$FIXoRJUt9jGi&y@1PUlq-~6%V+Rrn0@mF%te@_d_y840>}Wq-qowZ zmhZb}H{Fs~ZeT=P*1~ZHd+CSO;??TsSM}S(Od_;W5%z^_zjM9MuIbB**E_*+8GR36 z!YXjCpdHDckOIDV9zz5ve*5ZUUr1PNFZ3vamACG*3S8k%7jzQ^X{!u7gLZd8>uV%; z;#jT#Ks<=g;diB@e-@)Ny(3Gr0mDI{TFA*;MezkY&E?!a+wC^u+2*QnaC$>UzPOC4 zKt(6PPs}i4Cc56w4^Kyth3yng>G(EIbW#{89zxM|Iccs;*FJ( z^2U5JEbWHH@&afcL3@Pbx%iB7C6B9n`-0GH=eJ=6eJiAobzTou@nc2?)l;$pW~-6f zk+o7yZM#Qrbb$3Ux@_G?`L~5au@R;*oN|(wr>D=BRF7V)^T6g;5E3U77NBFWTMTa) zSIjUBdA95Rap)@v6MN(n!1ZgvGUT|ssBFGDpX>-AiNfmLH|e*$zA4px+Y_=z#r)sR z|KAVrHcBd#qp{IEg3mPR0EBIoJX0oP_`thR;$pS?-U} z#IM}fn0lV>os}n_G`#%%GmwwJWylg=yOH^qod>6c5a|mkccL?R!=|T?&JzfGdwyx0 zsIs9Pe5Dodyf$h?nwpvKfGDg39fM6n9yE+(=b z3I+j_$SVC}XpVGhTkLdP3?>#<9whJjKyAoc+Q-=G8PE$LC&*xDiupI!*;ix$rM4}< zL+qta9lzK1(sSj=d(A?t@;siy*O%F*EpI_GKnyeUSuw6Dl&mCVx!=2__gp^y^U~{k z1W;icG3YgeIa=yfL-;lEvlJjzFGV^C&}nm6^_u?82_B=HybD9E7o^sfM=J`G`3CN4 zu})j^SoZpMrwJ7*pzmHnek20N)_j}v`WPth^4t|rSMLh!?-6{PPqqoaw2-nirqJ}V z;duEPZA@V5ZeY=0wvLQY-=QnqR}4W7B+Gg2OQHUw01`3%hc0j-vEpFo-ijs)ToR{TwnflQ#bl zXP(rT{4jxowXd?E#heGu{hRx$UR!|0>l4IP1%1q{NS|n9SfUE3e1DeLT|#@Snsa9xEA$ zu|$o;##BP~P}V`5CL5T2cg!dw{^r&4;%@@9(L^*II3f_q=#OiU!sNCrfl^HvrAVmA z$XC%E-K+4y2e|pE=;ACp&eFnb;n@vI&Qoi&?D;a29zz!s_wQs?j-$Iv%J$rKVqAaQ z%5)?f3nP*|UmhPHn^s3epa$}enxtR3kP^nTE4lM}BTNx1h!GXU@Z@2?cQZQ%4u;PX z=LqE{hl7rFeNUcF*XjsAV6a}8^>+}Bv=guWEnvinqAx@|EqA*n-VJJg)X{QeZ;Vy| z$V)omI`tl5hZewT=G2ghzhDuBT1fk{6UsK|%B1L}M64C4KF?#H_trC%trDFoR4@J% zMJ;AJ6Nq`w5jY4p4BAzoI81IuWZ+*WaU(I>VK^*F42i?ISvmE10xGuCMCc`ybtYKu#`IiEnG7IOB3MX=`Y>?xNg}JjJsQz5Ch@;zpSsW zl8w*9lfpxVcqUc`LLd!0edT6r#mULZ65tLOA7kI5Qs4v492+{@Z@XqBy$ua(j5Mz3 zKMv9H0oo=x?wW9&;V-*?Ns4dJ74Ae^Q&T3Vwb8--&iigGtFLZC5j7AfqiYE8^;O4l z-JV7Nm?)H-r;sd}8A&nXE=M*L->$6Hf^;S?@aHE%tdTJyDf~$U1B8?E1`F>cimB*b zOL5Hsfu%OrXLRx}l<*xfk<;*pYh2ht6fF4k^t(+Dsp^>Mm@lH4Pb=5_ZfjD8$6xMt zlMVS6Oo`^h)e%k-n7UqYeATg2i>8+~zRUwShfl9(S#^-G9``euXrF=V<;CUlg2-v(N7=2#k-O+Ca73#TgK-0|3Ub zH_K(;1N=$8swP;b+_>trO)tlcUmP>*#ElX`W~S?95{|&5`Wra@NIW#9{=93 zegp}(Y47B_7;cMu0h)kf2u=d1qrKcPV8q3>-y3^Caj4snEaWC+y5DP@B&PirE0ka( zUFL2kheA)^LIb_O6_m0FjkQ;LcW8WqShbCzv{bFU7NtzFiZ>i1xPWx@P1nPPa_p|t zg57a6>K#$MXHmX5F*%phENJ~Or<*Rke=nL@(aAxDJooN=z^m%7rA1*Jdv^CQ?%LKo z8b%s5Qnsr$b&Xm^WU1jbT@FRLE)s}9LP8g%p}z1w%|VM;_VMh}f$heImr3{7#D>d; z(1NEfc#-y3SUr=s#~NR*ZW z1xEyd^wYOT3cfkULSnB?dMM<1I~u^n8*&)@Dm?Phf8A#iNj{N7;>L{|>sW!~HIf-Q zIpXX|hVyV<*Y00va|BPMPjjZWn=EPfS(dMs84pzf)eIY7~7#M^HsY zI;kM;{7s zf4<*;Zhx7Osz8IiGu`{;%a;R|(Ivx`R$r>d=GJAQa76FRkuq)|=v0{Xw|#xr`#l4f z&vnwbEc*zwqy_h$jM^YeiHk2Lnxqdx@w56P&UD;g4T2-mh>c9gZR6{?^obtaP$`=t z9k0g%U%hTpQ{RqeQ2ZQ2`Q!eYd{*>1zdW>An~5SwteXS3N#1RYyQihCZMi|mTjS=< zn?*~UGobl2`F^?S)736xte*zOzulvy zAf!J^j>gBwTf~hB9Rq35Y&LqmPKcJa+0ABB7~+39IdlgXM0>QvAA%g0`$@%6Onm%v zsEF}eV%brQ9y{qr?_qrUsoK=kl=UK;m-z42=m%>gU$5on=1vlDDO#8)b7PIrPC7lH zm0V2oSnq?-{K(poCKa}iu+MtRxchf2#>BTa6SuIXz71uzR#_Di>v}4`ef!qO>#6SV z1`(m6I_vyhJ;^d;ypD3~HO<)ASg#owQ?KK9*gp9HLSbfLU?@js)coD@ z52!>`%FbU{0@=}T>N`bs*tZTd&YL^f5S}TG0AHW`10CN+^$J^SdwUIU0?x|OyK|^1 z;`5r(T`WS5Of6YII&If1h)%t_$>dY{_t@DtG5?rBk0fE*U&NHq)=rIM*DZ4E5vF|B z*;i~-9ztEC3MY(gF2hBo3hoX1Su{4JhGIk*dcU%ce!fBg|1zb6_b0`AE#62QP$CWm!iSz zwLq-TZl9Fki|0w3y+{j;6Lg?SW93d@FdCBKv zYnc0Z*YJZ<{Qzup7oS+>wJ+Bg8QZ08N9UH&YlHet9-Bw6@Pr(l#<4=xvghU&7G9s@ zw60b9L|&ZlaWN*U;lA)K;`cY4j~+F!I~8oh-H{_j;U*4cAKzkY*|`kDFs@#!{KECH z5n+_P&3p2_Y($AOa5u`0()jjmKj(yJ>FLFQDdWlJ*$_@jPA+t7I1G3e9bHGsf=lz; zYCcH~^Ys>mTun%Cw($2v9-HyinYdbIulx5CKq)8_(D3|o&JNx0-#>ioF4SxhAMNwn zqbf8s^t2&Lq!{%@T6$Ji)@}>FqUopEj=cwSjK7Z{95iRRfHz6zpiOP&LYjvHFy#(Z z!^X`R*w_^6K6>zd-(AWc&l}!(RW*LK=8AGY86hFz>kSLm@iM8_)>Z{(R@Om)---rg zv`%+*cYpRt7!q@YDsZjKIW&JFHFKqjX1RsT}-lwtKY5{o0$AEJIJbC%~YYv=)^%^;b7vl zJgf}+fs(yUsEVAljLf!$eqml-o3z~M+*IXosj%JgnDu3+CO}d0TPz-E>J}H-cLiYD*b|~tblgF+`s%)aCmr21X zt1tVpXpjtzs@EPF4l(_JFfFP?M`u-M=BEDbQG7*|(7=R`^h!8Sh+x5nV#isPNl;DAUu^ zyHI%CV!7NbG(6l<>iH7=pNoSuw2mJ3{N4*&-`=jOVnKQNKozF405S#cWlrPp9g?7Z zV@{?&H>Aya*pR5mXGTXgUvVX))xpLEV39DYHTtijR3*qzp>_!0Vc{w#Cua$HrqiF} zv=GK=gFSD3>5lQj>W|~W;@xDZij1EM7Ng3|&ArLVDOFN<(+BI1)g}iT#$WmlrHIQP zzC(WXvC~01a)|+%l|3pY<)zPQhvJ#aRs|HVo+HhW{NuW|0nl9iQvaX=9HiA@;TZzS z|Dx0Pj3|O^4|$Q!pvl09z17;*<}Rq&B=*}biSQ$Z^{Do#Qj`ubou5aKu`n^AeWLip ziju^RLr(q*a`_gYS4U)IWX!z-27Z6d2;?*zs)D6$y{?IR?Ta6cMb94{u|@i?)7svh zTrr&Q`o5tqBlBVKqNnKZmqkJehue-kzA}6zIgE&Hz&Uz$R;2M2GPr}?U2@4?H}kW7NG5pK{$TK9UT6{#>2=WtX!Bh2LfUrBBigG2m;)r{;G2>2v;f<9XoO z0|(UIiH4I`5cSCo4aFdq5*@0ei;9iST{33e!KIaCqM>P$&BVR<$2}b0hDk*k^*A#G z{ItE#Uu-OnUK@Se?N@x9DZ5ME0y!nxy%X3V0n}z>Y#exh*Z+4P0fEfQ3_CbIx318VXK*WYRAkJpQ#@&<`c{NaI8-2q?!LWc-S7AXj@ z_d)((FG(ZG8~kk%M?W5+t2jhNc`4LlTz1pqXQE25F;PUsl>F%f;eZcxE|bF0>hs`W z0hO?>P5n_G6nDr7GcMpqMV80Cqo_CpJpaAOJcuTiGT+_2^oKR5Y{g*F+xv z)pc~zw!1Effm?)Kx`=-81w~Uz!fd!Vv-&zu1m4MU&AZ2`8i}AT9iN){w^4xt>!dN&fcChtnOQ-ZL$$o^`bb&( zTwm{r4ZdlAUWC29J=Z4|cFMTq!r|dzo0?RMKcB)^7oOrMSYNqR7*4#`JEyNZFcd=GC;zR%`V z(5Nv+=fF8ZDoo2;{QR0D=PsCTX59V&zB^ztEGDDJ0)O*R;8&D0|Lx(JSk@p^WLXl6 z9y?yd_E7>iWVKC<%#S!YJbb`v;(HqBMTaP9!+ih%MR+3%v+Vvk$w{bTq~hKm8x=%K z9w_hlNS;TqK34EaEGS8xT9NloV|PneSC^WzbLEAExmgVjjnI$~v)-~X|G(T)HmuGM z$zpMq`i~qI)XFX5!C@)yOmX?K70D0f8G^+(lCL*6HSMMrX%8Oke;I^y;Pc(Z5mj7V z+*!8`&wiDS&H00l!+4cVI?O8P6I9W|&{V&~r%y8h=u_C^ z(ohJY@O(HSy%vc3^ZblJ)**tGaISCfj^*IsAU_ai%eH#Kb9Q{sq6M|KOP-M3%t}fk zi4=D`xejjIAU&)6gtVf1;7H4JU}Se2-*S%M-rU?=5q?kj#}Y5nm<>}+h`%Hg=N`D! zx4y4(g0sIA%-pV+(u>a7-`~Aoo-WKe*A#H^w!B_^*q0n55DXt+=Du4npJLvfD&NHM zN|rb`QQY{!g9l3OA`5?;0pRoOR`IPJ-OZSvmbja6;F$I*zxRr2{q^)7^?NWmW$w;D zI9lj&=E+apbL$(k>8Tv}{COF0GzxE_6mfbt!&4GHW2sRWwZP=xrZT!Q zwu@C0Gx`Rp{)P`cYaO2Oc69jrqtI7aJkMznui)(H5_d4J%+>utXL{)mM?jEj)5lR^ zC-qWup#lQFq$L!@i$otjQj$eNMj!}akf0$%G*q=}i6T?VkPwJU30UFllPMet!E5Q9xf2)v&< zLLe^f{--NzCo6p;doyd3zdclXr}k}uD+q)lI}!r>m-ddx$p1c+gQJ_}zjyGvL2D8C zW<+3f*>i~BEXw(7nFi zfy)Q|(fld}G6LR$lD&Vv!N-9f^5~hAKQ-60 zwf%4FpNH`nN*Q(yT>RUG--mH8^-rx0oE#i&tp3}<&zFCpLO($Zjl)O~2*O`3UrYO+ zhj%nJvNB@-=lhMnb;0RK_h=NJpcM0W`{P~xpZ%>J)%5f&|7U@ppCOg*21O{myDIeG z?N7$~pY{$$j*c*N{%8N6pFrne7-0v-6E-^Q^yja^>;Gx)Vx+J7TMz%<02F3{wO~lE z=xrGf0&({D*B)HC|I>q&k)fF$yS=m_#|<`HYm>7v@bf)fp}C%s4fo&!gZI~$sBQV5 z9!!n&42|snYQXQ!YU6jnfWcsZUt6=mnEYo&__sCZ-^{ z($PPU@>@q|m#0R&pJ2YdHH|=={rz<=iNNCU&wKoL9GO|^nHc?NAf1QFhd_|PpLqDm K&>SWL;{O4g+IEZp diff --git a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.flat.json b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.flat.json deleted file mode 100644 index 4cf21ad9ef..0000000000 --- a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.flat.json +++ /dev/null @@ -1,3109 +0,0 @@ -{ - "requirements": [ - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.1", - "section_name": "Architecture d'encodage et de nettoyage", - "req_id": "V1.1.1", - "req_description": "Vérifiez que l'entrée est décodée ou non échappée vers une forme canonique une seule fois, elle n'est décodée que lorsque des données codées sous cette forme sont attendues, et que cela est fait avant de traiter davantage l'entrée, par exemple, elle n'est pas effectuée après la validation ou la désinfection de l'entrée.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.1", - "section_name": "Architecture d'encodage et de nettoyage", - "req_id": "V1.1.2", - "req_description": "Vérifiez que l'application effectue l'encodage et l'échappement de sortie soit comme étape finale avant d'être utilisée par l'interpréteur pour lequel elle est destinée, soit par l'interpréteur lui-même.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.2", - "section_name": "Prévention des injections", - "req_id": "V1.2.1", - "req_description": "Vérifiez que l'encodage de sortie d'une réponse HTTP, d'un document HTML ou d'un document XML est pertinent pour le contexte requis, comme l'encodage des caractères pertinents pour les éléments HTML, les attributs HTML, les commentaires HTML, les CSS ou les champs d'en-tête HTTP, pour éviter de modifier la structure du message ou du document.", - "L": "1" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.2", - "section_name": "Prévention des injections", - "req_id": "V1.2.2", - "req_description": "Vérifiez que, lors de la création dynamique d'URL, les données non fiables sont encodées en fonction de leur contexte (par exemple, encodage d'URL ou encodage base64url pour les paramètres de requête ou de chemin). Assurez-vous que seuls les schémas d'URL sûrs sont autorisés (par exemple, interdire javascript: ou data:).", - "L": "1" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.2", - "section_name": "Prévention des injections", - "req_id": "V1.2.3", - "req_description": "Vérifiez que l'encodage ou l'échappement de sortie est utilisé lors de la création dynamique de contenu JavaScript (y compris JSON), pour éviter de modifier la structure du message ou du document (pour éviter l'injection JavaScript et JSON).", - "L": "1" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.2", - "section_name": "Prévention des injections", - "req_id": "V1.2.4", - "req_description": "Vérifiez que la sélection de données ou les requêtes de base de données (par exemple, SQL, HQL, NoSQL, Cypher) utilisent des requêtes paramétrées, des ORM, des Framework d'entités ou sont protégées contre les injections SQL et autres attaques par injection de base de données. Ceci est également pertinent lors de l'écriture de procédures stockées.", - "L": "1" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.2", - "section_name": "Prévention des injections", - "req_id": "V1.2.5", - "req_description": "Vérifiez que l’application protège contre l’injection de commandes du système d’exploitation et que les appels du système d’exploitation utilisent des requêtes du système d’exploitation paramétrées ou utilisent un encodage de sortie de ligne de commande contextuelle.", - "L": "1" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.2", - "section_name": "Prévention des injections", - "req_id": "V1.2.6", - "req_description": "Vérifiez que l’application protège contre les vulnérabilités d’injection LDAP ou que des contrôles de sécurité spécifiques pour empêcher l’injection LDAP ont été mis en œuvre.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.2", - "section_name": "Prévention des injections", - "req_id": "V1.2.7", - "req_description": "Vérifiez que l’application est protégée contre les attaques par injection XPath en utilisant la paramétrisation des requêtes ou des requêtes précompilées.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.2", - "section_name": "Prévention des injections", - "req_id": "V1.2.8", - "req_description": "Vérifiez que les processeurs LaTeX sont configurés de manière sécurisée (par exemple, en n'utilisant pas l'indicateur « --shell-escape ») et qu'une liste d’autorisations de commandes est utilisée pour empêcher les attaques par injection LaTeX.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.2", - "section_name": "Prévention des injections", - "req_id": "V1.2.9", - "req_description": "Vérifiez que l'application échappe les caractères spéciaux dans les expressions régulières (généralement à l'aide d'une barre oblique inverse) pour éviter qu'ils ne soient mal interprétés comme des métacaractères.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.2", - "section_name": "Prévention des injections", - "req_id": "V1.2.10", - "req_description": "Vérifiez que l'application est protégée contre les injections CSV et injections de formules. L'application doit respecter les règles d'échappement définies dans les sections 2.6 et 2.7 de la RFC 4180 lors de l'export de contenu CSV. De plus, lors de l'export au format CSV ou vers d'autres formats de tableur (tels que XLS, XLSX ou ODF), les caractères spéciaux (notamment « = », « + », « - », « @ », « \\t » (tabulation) et « \\0 » (caractère null)) doivent être protégés par une apostrophe s'ils apparaissent en premier dans une valeur de champ.", - "L": "3" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.3", - "section_name": "Nettoyage", - "req_id": "V1.3.1", - "req_description": "Vérifiez que toutes les entrées HTML non fiables provenant d'éditeurs WYSIWYG ou similaires sont nettoyées à l'aide d'une bibliothèque ou d'une fonctionnalité de Framework de nettoyage HTML bien connue et sécurisée.", - "L": "1" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.3", - "section_name": "Nettoyage", - "req_id": "V1.3.2", - "req_description": "Vérifiez que l'application évite d'utiliser eval() ou d'autres fonctionnalités d'exécution de code dynamique telles que Spring Expression Language (SpEL). En l'absence d'alternative, toute saisie utilisateur incluse doit être nettoyée avant d'être exécutée.", - "L": "1" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.3", - "section_name": "Nettoyage", - "req_id": "V1.3.3", - "req_description": "Vérifiez que les données transmises à un contexte potentiellement dangereux sont préalablement nettoyées pour appliquer des mesures de sécurité, telles qu'autoriser uniquement des caractères sûrs pour ce contexte et raccourcir des entrées trop longues.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.3", - "section_name": "Nettoyage", - "req_id": "V1.3.4", - "req_description": "Vérifiez que le contenu Scalable Vector Graphics (SVG) scriptable fourni par l'utilisateur est validé ou nettoyé pour contenir uniquement des balises et des attributs (tels que des graphiques de dessin) qui sont sûrs pour l'application, par exemple, ne contiennent pas de scripts et d'objets étrangers.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.3", - "section_name": "Nettoyage", - "req_id": "V1.3.5", - "req_description": "Vérifiez que l'application nettoie ou désactive le contenu du langage de modèle d'expression ou de script fourni par l'utilisateur, tel que les feuilles de style CSS, le Markdown ou XSL, BBCode ou similaire.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.3", - "section_name": "Nettoyage", - "req_id": "V1.3.6", - "req_description": "Vérifiez que l'application protège contre les attaques de falsification de requête côté serveur (SSRF), en validant les données non fiables par rapport à une liste d'autorisation de protocoles, de domaines, de chemins et de ports et en nettoyant les caractères potentiellement dangereux avant d'utiliser les données pour appeler un autre service.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.3", - "section_name": "Nettoyage", - "req_id": "V1.3.7", - "req_description": "Vérifiez que l'application se protège contre les attaques par injection de modèles en interdisant la création de modèles basés sur des entrées non fiables. En l'absence d'alternative, toute entrée non fiable incluse dynamiquement lors de la création du modèle doit être nettoyée ou rigoureusement validée.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.3", - "section_name": "Nettoyage", - "req_id": "V1.3.8", - "req_description": "Vérifiez que l’application nettoie correctement les entrées non fiables avant utilisation dans les requêtes Java Naming and Directory Interface (JNDI) et que JNDI est configuré de manière sécurisée pour empêcher les attaques par injection JNDI.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.3", - "section_name": "Nettoyage", - "req_id": "V1.3.9", - "req_description": "Vérifiez que l’application nettoie le contenu avant qu’il ne soit envoyé à memcache pour éviter les attaques par injection.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.3", - "section_name": "Nettoyage", - "req_id": "V1.3.10", - "req_description": "Vérifiez que les chaînes de format susceptibles d'être résolues de manière inattendue ou malveillante lors de leur utilisation sont nettoyées avant d'être traitées.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.3", - "section_name": "Nettoyage", - "req_id": "V1.3.11", - "req_description": "Vérifiez que l'application nettoie les entrées utilisateur avant de les transmettre aux systèmes de messagerie pour se protéger contre l'injection SMTP ou IMAP.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.3", - "section_name": "Nettoyage", - "req_id": "V1.3.12", - "req_description": "Vérifiez que les expressions régulières sont exemptes d'éléments provoquant \"backtracking\" exponentiel et assurez-vous que les entrées non fiables sont nettoyées pour atténuer les attaques ReDoS ou Runaway Regex.", - "L": "3" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.4", - "section_name": "Mémoire, chaine de caractères et code à mémoire non-managée", - "req_id": "V1.4.1", - "req_description": "Vérifiez que l'application utilise des chaînes memory-safe, une copie de mémoire et une arithmétique de pointeur renforcée pour détecter ou empêcher les débordements de pile, de tampon ou de tas.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.4", - "section_name": "Mémoire, chaine de caractères et code à mémoire non-managée", - "req_id": "V1.4.2", - "req_description": "Vérifiez que les techniques de validation du signe, de la plage et de l’entrée sont utilisées pour éviter les dépassements d’entiers.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.4", - "section_name": "Mémoire, chaine de caractères et code à mémoire non-managée", - "req_id": "V1.4.3", - "req_description": "Vérifiez que la mémoire et les ressources allouées dynamiquement sont libérées et que les références ou les pointeurs vers la mémoire libérée sont supprimés ou définis à null pour éviter les \"dangling pointer\" et les vulnérabilités d'utilisation après libération.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.5", - "section_name": "Désérialisation sécurisée", - "req_id": "V1.5.1", - "req_description": "Vérifiez que l'application configure les \"parser\" XML pour utiliser une configuration restrictive et que les fonctionnalités non sûres telles que la résolution d'entités externes sont désactivées pour empêcher les attaques XML eXternal Entity (XXE).", - "L": "1" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.5", - "section_name": "Désérialisation sécurisée", - "req_id": "V1.5.2", - "req_description": "Vérifiez que la désérialisation des données non fiables garantit une gestion sécurisée des entrées, par exemple en utilisant une liste d'autorisation de types d'objets ou en limitant les types d'objets définis par le client, afin d'empêcher les attaques par désérialisation. Les mécanismes de désérialisation explicitement définis comme non sécurisés ne doivent pas être utilisés avec des entrées non fiables.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.5", - "section_name": "Désérialisation sécurisée", - "req_id": "V1.5.3", - "req_description": "Vérifiez que les différents \"parser\" utilisés dans l'application pour le même type de données (par exemple, les \"parser\" JSON, les \"parser\" XML, les \"parser\" d'URL) effectuent l'analyse de manière cohérente et utilisent le même mécanisme d'encodage de caractères pour éviter des problèmes tels que les vulnérabilités d'interopérabilité JSON ou un comportement d'analyse d'URI ou de fichier différent exploité dans les attaques d'inclusion de fichiers à distance (RFI) ou de falsification de requête côté serveur (SSRF).", - "L": "3" - }, - { - "chapter_id": "V2", - "chapter_name": "Validation et logique métier", - "section_id": "V2.1", - "section_name": "Validation et documentation de la logique métier", - "req_id": "V2.1.1", - "req_description": "Vérifiez que la documentation de l'application définit des règles de validation des entrées pour vérifier la validité des éléments de données par rapport à la structure attendue. Il peut s'agir de formats de données courants tels que des numéros de carte de crédit, des adresses e-mail ou des numéros de téléphone, ou d'un format de données interne.", - "L": "1" - }, - { - "chapter_id": "V2", - "chapter_name": "Validation et logique métier", - "section_id": "V2.1", - "section_name": "Validation et documentation de la logique métier", - "req_id": "V2.1.2", - "req_description": "Vérifiez que la documentation de l'application définit comment valider la cohérence logique et contextuelle des éléments de données combinés, par exemple en vérifiant que la banlieue et le code postal correspondent.", - "L": "2" - }, - { - "chapter_id": "V2", - "chapter_name": "Validation et logique métier", - "section_id": "V2.1", - "section_name": "Validation et documentation de la logique métier", - "req_id": "V2.1.3", - "req_description": "Vérifiez que les attentes en matière de limites et de validations de la logique métier sont documentées, y compris par utilisateur et globalement dans l'application.", - "L": "2" - }, - { - "chapter_id": "V2", - "chapter_name": "Validation et logique métier", - "section_id": "V2.2", - "section_name": "Validation des entrées", - "req_id": "V2.2.1", - "req_description": "Vérifier que les entrées sont validées afin de respecter les attentes métier ou fonctionnelles. Cette validation doit être basée sur une liste de valeurs, de modèles et de plages autorisées, ou sur la comparaison des entrées avec une structure attendue et des limites logiques selon des règles prédéfinies. Pour le niveau 1, cette validation peut se concentrer sur les entrées utilisées pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau 2, elle doit s'appliquer à toutes les entrées.", - "L": "1" - }, - { - "chapter_id": "V2", - "chapter_name": "Validation et logique métier", - "section_id": "V2.2", - "section_name": "Validation des entrées", - "req_id": "V2.2.2", - "req_description": "Vérifiez que l'application est conçue pour appliquer la validation des entrées au niveau d'une couche de service de confiance. Bien que la validation côté client améliore l'ergonomie et doit être encouragée, elle ne doit pas être considérée comme un contrôle de sécurité.", - "L": "1" - }, - { - "chapter_id": "V2", - "chapter_name": "Validation et logique métier", - "section_id": "V2.2", - "section_name": "Validation des entrées", - "req_id": "V2.2.3", - "req_description": "Vérifiez que l’application garantit que les combinaisons d’éléments de données associés sont raisonnables selon les règles prédéfinies.", - "L": "2" - }, - { - "chapter_id": "V2", - "chapter_name": "Validation et logique métier", - "section_id": "V2.3", - "section_name": "Sécurité de la logique métier", - "req_id": "V2.3.1", - "req_description": "Vérifiez que l’application traitera uniquement les flux de logique métier pour le même utilisateur dans l’ordre séquentiel attendu et sans sauter d’étapes.", - "L": "1" - }, - { - "chapter_id": "V2", - "chapter_name": "Validation et logique métier", - "section_id": "V2.3", - "section_name": "Sécurité de la logique métier", - "req_id": "V2.3.2", - "req_description": "Vérifiez que les limites de la logique métier sont implémentées conformément à la documentation de l'application, afin d'éviter que des failles de la logique métier ne soient pas exploitées.", - "L": "2" - }, - { - "chapter_id": "V2", - "chapter_name": "Validation et logique métier", - "section_id": "V2.3", - "section_name": "Sécurité de la logique métier", - "req_id": "V2.3.3", - "req_description": "Vérifiez que les transactions sont utilisées au niveau de la logique métier de telle sorte qu'une opération de logique métier réussisse dans son intégralité ou qu'elle soit restaurée à l'état correct précédent.", - "L": "2" - }, - { - "chapter_id": "V2", - "chapter_name": "Validation et logique métier", - "section_id": "V2.3", - "section_name": "Sécurité de la logique métier", - "req_id": "V2.3.4", - "req_description": "Vérifiez que les mécanismes de verrouillage au niveau de la logique métier sont utilisés pour garantir que les ressources en quantité limitée (telles que les sièges de théâtre ou les créneaux de livraison) ne peuvent pas être réservées deux fois en manipulant la logique de l'application.", - "L": "2" - }, - { - "chapter_id": "V2", - "chapter_name": "Validation et logique métier", - "section_id": "V2.3", - "section_name": "Sécurité de la logique métier", - "req_id": "V2.3.5", - "req_description": "Vérifiez que les flux logiques métier à forte valeur ajoutée nécessitent l'approbation de plusieurs utilisateurs afin d'éviter toute action non autorisée ou accidentelle. Cela peut inclure, sans s'y limiter, les transferts monétaires importants, les approbations de contrats, l'accès à des informations classifiées ou les contournements de sécurité dans le secteur manufacturier.", - "L": "3" - }, - { - "chapter_id": "V2", - "chapter_name": "Validation et logique métier", - "section_id": "V2.4", - "section_name": "Anti-automatisation", - "req_id": "V2.4.1", - "req_description": "Vérifiez que des contrôles anti-automatisation sont en place pour protéger contre les appels excessifs aux fonctions d'application qui pourraient conduire à l'exfiltration de données, à la création de données inutiles, à l'épuisement des quotas, aux violations de limites de débit, au déni de service ou à la surutilisation de ressources coûteuses.", - "L": "2" - }, - { - "chapter_id": "V2", - "chapter_name": "Validation et logique métier", - "section_id": "V2.4", - "section_name": "Anti-automatisation", - "req_id": "V2.4.2", - "req_description": "Vérifiez que les flux logiques métier nécessitent un timing humain réaliste, évitant ainsi des soumissions de transactions excessivement rapides.", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.1", - "section_name": "Documentation sur la sécurité du frontend Web", - "req_id": "V3.1.1", - "req_description": "Vérifiez que la documentation de l'application indique les fonctionnalités de sécurité attendues que les navigateurs utilisant l'application doivent prendre en charge (telles que HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) et autres mécanismes de sécurité HTTP pertinents). Elle doit également définir le comportement de l'application lorsque certaines de ces fonctionnalités ne sont pas disponibles (par exemple, avertir l'utilisateur ou bloquer l'accès).", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.2", - "section_name": "Interprétation non intentionnelle du contenu", - "req_id": "V3.2.1", - "req_description": "Vérifiez que des contrôles de sécurité sont en place pour empêcher les navigateurs d'afficher du contenu ou des fonctionnalités dans les réponses HTTP dans un contexte incorrect (par exemple, lorsqu'une API, un fichier téléchargé par l'utilisateur ou une autre ressource est demandée directement). Les contrôles possibles peuvent inclure : ne pas transmettre le contenu sauf si les champs d'en-tête de requête HTTP (tels que Sec-Fetch-\\*) indiquent qu'il s'agit du contexte correct, utiliser la directive sandbox du champ d'en-tête Content-Security-Policy ou utiliser le type de disposition de pièce jointe dans le champ d'en-tête Content-Disposition.", - "L": "1" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.2", - "section_name": "Interprétation non intentionnelle du contenu", - "req_id": "V3.2.2", - "req_description": "Vérifiez que le contenu destiné à être affiché sous forme de texte, plutôt que rendu sous forme de HTML, est géré à l'aide de fonctions de rendu sécurisées (telles que createTextNode ou textContent) pour empêcher l'exécution involontaire de contenu tel que HTML ou JavaScript.", - "L": "1" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.2", - "section_name": "Interprétation non intentionnelle du contenu", - "req_id": "V3.2.3", - "req_description": "Vérifiez que l'application évite l'écrasement du DOM lors de l'utilisation de JavaScript côté client en utilisant des déclarations de variables explicites, en effectuant une vérification de type stricte, en évitant de stocker des variables globales sur l'objet document et en implémentant l'isolation de l'espace de nommage.", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.3", - "section_name": "Configuration des cookies", - "req_id": "V3.3.1", - "req_description": "Vérifiez que les cookies ont l'attribut « Secure » ​​défini et si le préfixe « \\__Host- » n'est pas utilisé pour le nom du cookie, le préfixe « __Secure- » doit être utilisé pour le nom du cookie.", - "L": "1" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.3", - "section_name": "Configuration des cookies", - "req_id": "V3.3.2", - "req_description": "Vérifiez que la valeur de l'attribut « SameSite » de chaque cookie est définie en fonction de l'objectif du cookie, afin de limiter l'exposition aux attaques de réparation de l'interface utilisateur et aux attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).", - "L": "2" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.3", - "section_name": "Configuration des cookies", - "req_id": "V3.3.3", - "req_description": "Vérifiez que les cookies ont le préfixe « __Host- » pour le nom du cookie, sauf s'ils sont explicitement conçus pour être partagés avec d'autres hôtes.", - "L": "2" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.3", - "section_name": "Configuration des cookies", - "req_id": "V3.3.4", - "req_description": "Vérifiez que si la valeur d'un cookie n'est pas censée être accessible aux scripts côté client (comme un jeton de session), le cookie doit avoir l'attribut « HttpOnly » défini et la même valeur (par exemple, un jeton de session) ne doit être transférée au client que via le champ d'en-tête « Set-Cookie ».", - "L": "2" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.3", - "section_name": "Configuration des cookies", - "req_id": "V3.3.5", - "req_description": "Vérifiez que lorsque l'application écrit un cookie, la longueur combinée du nom et de la valeur du cookie ne dépasse pas 4 096 octets. Les cookies trop volumineux ne seront pas stockés par le navigateur et ne seront donc pas envoyés avec les requêtes, empêchant ainsi l'utilisateur d'utiliser les fonctionnalités de l'application qui reposent sur ce cookie.", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.4", - "section_name": "En-têtes du mécanisme de sécurité du navigateur", - "req_id": "V3.4.1", - "req_description": "Vérifiez qu'un champ d'en-tête Strict-Transport-Security est inclus dans toutes les réponses afin d'appliquer une politique HTTP Strict Transport Security (HSTS). Une durée maximale d'au moins un an doit être définie, et pour les niveaux L2 et supérieurs, la politique doit également s'appliquer à tous les sous-domaines.", - "L": "1" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.4", - "section_name": "En-têtes du mécanisme de sécurité du navigateur", - "req_id": "V3.4.2", - "req_description": "Vérifiez que le champ d'en-tête Access-Control-Allow-Origin du partage de ressources cross-origine (CORS) est une valeur fixe de l'application ou, si la valeur du champ d'en-tête de requête HTTP Origin est utilisée, qu'elle est validée par rapport à une liste d'origines approuvées. Si « Access-Control-Allow-Origin: * » doit être utilisé, vérifiez que la réponse ne contient aucune information sensible.", - "L": "1" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.4", - "section_name": "En-têtes du mécanisme de sécurité du navigateur", - "req_id": "V3.4.3", - "req_description": "Vérifiez que les réponses HTTP incluent un champ d'en-tête de réponse Content-Security-Policy qui définit des directives garantissant que le navigateur charge et exécute uniquement du contenu ou des ressources fiables, afin de limiter l'exécution de JavaScript malveillant. Au minimum, une politique globale doit être utilisée, incluant les directives object-src 'none' et base-uri 'none', et définissant soit une lliste d’autorisations, soit des valeurs nonces ou des hachages. Pour une application L3, une politique par réponse avec des valeurs nonces ou des hachages doit être définie.", - "L": "2" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.4", - "section_name": "En-têtes du mécanisme de sécurité du navigateur", - "req_id": "V3.4.4", - "req_description": "Vérifiez que toutes les réponses HTTP contiennent un champ d'en-tête « X-Content-Type-Options: nosniff ». Cela indique aux navigateurs de ne pas utiliser l'analyse de contenu ni la détection du type MIME pour la réponse donnée, et d'exiger que la valeur du champ d'en-tête « Content-Type » de la réponse corresponde à la ressource de destination. Par exemple, la réponse à une demande de style n'est acceptée que si le type de contenu de la réponse est « text/css ». Cela permet également au navigateur d'utiliser la fonctionnalité de blocage de lecture inter-origines (CORB).", - "L": "2" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.4", - "section_name": "En-têtes du mécanisme de sécurité du navigateur", - "req_id": "V3.4.5", - "req_description": "Vérifiez que l'application définit une politique de référencement afin d'empêcher la fuite de données techniquement sensibles vers des services tiers via le champ d'en-tête de requête HTTP « Referer ». Cela peut être effectué via le champ d'en-tête de réponse HTTP « Referrer-Policy » ou via les attributs d'élément HTML. Les données sensibles peuvent inclure le chemin d'accès et les données de requête dans l'URL, et pour les applications internes non publiques, le nom d'hôte.", - "L": "2" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.4", - "section_name": "En-têtes du mécanisme de sécurité du navigateur", - "req_id": "V3.4.6", - "req_description": "Vérifiez que l'application Web utilise la directive frame-ancestors du champ d'en-tête Content-Security-Policy pour chaque réponse HTTP afin de garantir qu'elle ne peut pas être intégrée par défaut et que l'intégration de ressources spécifiques n'est autorisée qu'en cas de nécessité. Notez que le champ d'en-tête X-Frame-Options, bien que pris en charge par les navigateurs, est obsolète et n'est pas forcément fiable.", - "L": "2" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.4", - "section_name": "En-têtes du mécanisme de sécurité du navigateur", - "req_id": "V3.4.7", - "req_description": "Vérifiez que le champ d’en-tête Content-Security-Policy spécifie un emplacement pour signaler les violations.", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.4", - "section_name": "En-têtes du mécanisme de sécurité du navigateur", - "req_id": "V3.4.8", - "req_description": "Vérifiez que toutes les réponses HTTP qui lancent le rendu d'un document (comme les réponses de type text/html) incluent le champ d'en-tête 'Cross-Origin-Opener-Policy' avec la directive 'same-origin' ou s'ame-origin-allow-popups', selon les besoins. Cela empêche les attaques abusant de l'accès partagé aux objets Window, telles que le tabnabbing et le comptage d'images.", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.5", - "section_name": "Séparation de l'origine du navigateur", - "req_id": "V3.5.1", - "req_description": "Vérifiez que, si l'application ne s'appuie pas sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher les requêtes inter-origines non autorisées d'utiliser des fonctionnalités sensibles, ces requêtes sont validées afin de garantir leur origine. Cela peut se faire en utilisant et en validant des jetons anti-falsification ou en exigeant des champs d'en-tête HTTP supplémentaires qui ne sont pas des champs d'en-tête de requête CORS safelist. Ceci permet de se protéger contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).", - "L": "1" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.5", - "section_name": "Séparation de l'origine du navigateur", - "req_id": "V3.5.2", - "req_description": "Vérifiez que, si l'application s'appuie sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher l'utilisation inter-origines non autorisée de fonctionnalités sensibles, il est impossible d'appeler la fonctionnalité avec une requête qui ne déclenche pas de requête de pré-vérification cross-origin CORS. Cela peut nécessiter de vérifier les valeurs des champs d'en-tête de requête 'Origin' et 'Content-Type' ou d'utiliser un champ d'en-tête supplémentaire qui n'est pas un champ d'en-tête de la liste de sécurité CORS.", - "L": "1" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.5", - "section_name": "Séparation de l'origine du navigateur", - "req_id": "V3.5.3", - "req_description": "Vérifiez que les requêtes HTTP destinées aux fonctionnalités sensibles utilisent des méthodes HTTP appropriées, telles que POST, PUT, PATCH ou DELETE, et non des méthodes définies comme « sûres » par la spécification HTTP, telles que HEAD, OPTIONS ou GET. Une validation stricte des champs d'en-tête de requête Sec-Fetch-* peut également être utilisée pour garantir que la requête ne provient pas d'un appel inter-origines inapproprié, d'une requête de navigation ou d'un chargement de ressources (comme une source d'image) inattendu.", - "L": "1" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.5", - "section_name": "Séparation de l'origine du navigateur", - "req_id": "V3.5.4", - "req_description": "Vérifiez que des applications distinctes sont hébergées sur des noms d'hôte différents pour tirer parti des restrictions fournies par la politique de même origine, y compris la manière dont les documents ou scripts chargés par une origine peuvent interagir avec les ressources d'une autre origine et les restrictions basées sur le nom d'hôte sur les cookies.", - "L": "2" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.5", - "section_name": "Séparation de l'origine du navigateur", - "req_id": "V3.5.5", - "req_description": "Vérifiez que les messages reçus par l'interface postMessage sont rejetés si l'origine du message n'est pas digne de confiance ou si la syntaxe du message n'est pas valide.", - "L": "2" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.5", - "section_name": "Séparation de l'origine du navigateur", - "req_id": "V3.5.6", - "req_description": "Vérifiez que la fonctionnalité JSONP n'est activée nulle part dans l'application pour éviter les attaques Cross-Site Script Inclusion (XSSI).", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.5", - "section_name": "Séparation de l'origine du navigateur", - "req_id": "V3.5.7", - "req_description": "Vérifiez que les données nécessitant une autorisation ne sont pas incluses dans les réponses des ressources de script, comme les fichiers JavaScript, pour empêcher les attaques par inclusion de script intersite (XSSI).", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.5", - "section_name": "Séparation de l'origine du navigateur", - "req_id": "V3.5.8", - "req_description": "Vérifiez que les ressources authentifiées (telles que les images, les vidéos, les scripts et autres documents) peuvent être chargées ou intégrées pour le compte de l'utilisateur uniquement lorsque cela est prévu. Cela peut être réalisé en validant strictement les champs d'en-tête de requête HTTP Sec-Fetch-* afin de garantir que la requête ne provient pas d'un appel cross-origin inapproprié, ou en définissant un champ d'en-tête de réponse HTTP Cross-Origin-Resource-Policy restrictif pour indiquer au navigateur de bloquer le contenu renvoyé.", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.6", - "section_name": "Intégrité des ressources externes", - "req_id": "V3.6.1", - "req_description": "Vérifiez que les ressources côté client, telles que les bibliothèques JavaScript, les feuilles de style CSS ou les polices web, sont hébergées en externe (par exemple, sur un réseau de diffusion de contenu) uniquement si la ressource est statique et versionnée, et si l'intégrité des sous-ressources (SRI) est utilisée pour valider l'intégrité de la ressource. Si cela n'est pas possible, une décision de sécurité documentée doit justifier cette décision pour chaque ressource.", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.7", - "section_name": "Autres considérations sur la sécurité du navigateur", - "req_id": "V3.7.1", - "req_description": "Vérifiez que l'application utilise uniquement des technologies côté client toujours prises en charge et considérées comme sécurisées. Parmi les technologies qui ne répondent pas à cette exigence figurent les plugins NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL ou les applets Java côté client.", - "L": "2" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.7", - "section_name": "Autres considérations sur la sécurité du navigateur", - "req_id": "V3.7.2", - "req_description": "Vérifiez que l'application redirigera automatiquement l'utilisateur vers un nom d'hôte ou un domaine différent (qui n'est pas contrôlé par l'application) uniquement lorsque la destination apparaît sur une liste d'autorisation.", - "L": "2" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.7", - "section_name": "Autres considérations sur la sécurité du navigateur", - "req_id": "V3.7.3", - "req_description": "Vérifiez que le domaine de premier niveau de l'application (par exemple, site.tld) ​​est ajouté à la liste de préchargement publique pour HTTP Strict Transport Security (HSTS). Cela garantit que l'utilisation de TLS pour l'application est intégrée directement dans les principaux navigateurs, plutôt que de dépendre uniquement du champ d'en-tête de réponse Strict-Transport-Security.", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.7", - "section_name": "Autres considérations sur la sécurité du navigateur", - "req_id": "V3.7.4", - "req_description": "Vérifiez que l'application affiche une notification lorsque l'utilisateur est redirigé vers une URL hors du contrôle de l'application, avec une option pour annuler la navigation.", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.7", - "section_name": "Autres considérations sur la sécurité du navigateur", - "req_id": "V3.7.5", - "req_description": "Vérifiez que l'application se comporte comme documenté (par exemple, en avertissant l'utilisateur ou en bloquant l'accès) si le navigateur utilisé pour accéder à l'application ne prend pas en charge les fonctionnalités de sécurité attendues.", - "L": "3" - }, - { - "chapter_id": "V4", - "chapter_name": "API et service Web", - "section_id": "V4.1", - "section_name": "Sécurité du service Web générique", - "req_id": "V4.1.1", - "req_description": "Vérifiez que chaque réponse HTTP avec un corps de message contient un champ d'en-tête Content-Type qui correspond au contenu réel de la réponse, y compris le paramètre charset pour spécifier un codage de caractères sécurisé (par exemple, UTF-8, ISO-8859-1) conformément aux types de médias IANA, tels que « text/ », « /+xml » et « /xml ».", - "L": "1" - }, - { - "chapter_id": "V4", - "chapter_name": "API et service Web", - "section_id": "V4.1", - "section_name": "Sécurité du service Web générique", - "req_id": "V4.1.2", - "req_description": "Vérifiez que seuls les terminaux utilisateurs (destinés à l'accès manuel via un navigateur web) redirigent automatiquement de HTTP vers HTTPS, tandis que les autres services ou terminaux n'implémentent pas de redirections transparentes. Cela permet d'éviter qu'un client envoie par erreur des requêtes HTTP non chiffrées, mais que, comme ces requêtes sont automatiquement redirigées vers HTTPS, la fuite de données sensibles passe inaperçue.", - "L": "2" - }, - { - "chapter_id": "V4", - "chapter_name": "API et service Web", - "section_id": "V4.1", - "section_name": "Sécurité du service Web générique", - "req_id": "V4.1.3", - "req_description": "Vérifiez que tout champ d'en-tête HTTP utilisé par l'application et défini par une couche intermédiaire, telle qu'un équilibreur de charge, un proxy web ou un service backend-for-frontend, ne peut pas être remplacé par l'utilisateur final. Les exemples d'en-têtes peuvent inclure X-Real-IP, X-Forwarded-*, ou X-User-ID.", - "L": "2" - }, - { - "chapter_id": "V4", - "chapter_name": "API et service Web", - "section_id": "V4.1", - "section_name": "Sécurité du service Web générique", - "req_id": "V4.1.4", - "req_description": "Vérifiez que seules les méthodes HTTP explicitement prises en charge par l'application ou son API (y compris les OPTIONS lors des demandes de contrôle en amont) peuvent être utilisées et que les méthodes inutilisées sont bloquées.", - "L": "3" - }, - { - "chapter_id": "V4", - "chapter_name": "API et service Web", - "section_id": "V4.1", - "section_name": "Sécurité du service Web générique", - "req_id": "V4.1.5", - "req_description": "Vérifier que les signatures numériques par message sont utilisées pour fournir une assurance supplémentaire en plus des protections de transport pour les demandes ou les transactions qui sont très sensibles ou qui traversent un certain nombre de systèmes.", - "L": "3" - }, - { - "chapter_id": "V4", - "chapter_name": "API et service Web", - "section_id": "V4.2", - "section_name": "Validation de la structure des messages HTTP", - "req_id": "V4.2.1", - "req_description": "Vérifiez que tous les composants de l'application (y compris les équilibreurs de charge, les pares-feux et les serveurs d'applications) déterminent les limites des messages HTTP entrants à l'aide du mécanisme approprié à la version HTTP afin d'empêcher la contrebande de requêtes HTTP. Dans HTTP/1.x, si un champ d'en-tête Transfer-Encoding est présent, l'en-tête Content-Length doit être ignoré conformément à la RFC 2616. Avec HTTP/2 ou HTTP/3, si un champ d'en-tête Content-Length est présent, le récepteur doit s'assurer qu'il est cohérent avec la longueur des trames DATA.", - "L": "2" - }, - { - "chapter_id": "V4", - "chapter_name": "API et service Web", - "section_id": "V4.2", - "section_name": "Validation de la structure des messages HTTP", - "req_id": "V4.2.2", - "req_description": "Vérifier que, lors de la génération de messages HTTP, le champ d'en-tête Content-Length n'entre pas en conflit avec la longueur du contenu déterminée par le cadrage du protocole HTTP, afin d'empêcher les attaques de type « request smuggling ».", - "L": "3" - }, - { - "chapter_id": "V4", - "chapter_name": "API et service Web", - "section_id": "V4.2", - "section_name": "Validation de la structure des messages HTTP", - "req_id": "V4.2.3", - "req_description": "Vérifiez que l'application n'envoie ni n'accepte de messages HTTP/2 ou HTTP/3 avec des champs d'en-tête spécifiques à la connexion, tels que Transfer-Encoding, afin d'éviter les attaques par fractionnement de la réponse et par injection d'en-tête.", - "L": "3" - }, - { - "chapter_id": "V4", - "chapter_name": "API et service Web", - "section_id": "V4.2", - "section_name": "Validation de la structure des messages HTTP", - "req_id": "V4.2.4", - "req_description": "Vérifiez que l'application n'accepte que les requêtes HTTP/2 et HTTP/3 dont les champs et valeurs d'en-tête ne contiennent pas de séquences CR (\\r), LF (\\n) ou CRLF (\\r\\n), afin d'éviter les attaques par injection d'en-tête.", - "L": "3" - }, - { - "chapter_id": "V4", - "chapter_name": "API et service Web", - "section_id": "V4.2", - "section_name": "Validation de la structure des messages HTTP", - "req_id": "V4.2.5", - "req_description": "Vérifiez que, si l'application (backend ou frontend) construit et envoie des requêtes, elle utilise des mécanismes de validation, d'assainissement ou autres pour éviter de créer des URI (comme pour les appels API) ou des champs d'en-tête de requête HTTP (comme Authorization ou Cookie) qui sont trop longs pour être acceptés par le composant récepteur. Cela pourrait entraîner un déni de service, par exemple lors de l'envoi d'une requête trop longue (par exemple, un long champ d'en-tête de cookie), ce qui fait que le serveur répond toujours avec un statut d'erreur.", - "L": "3" - }, - { - "chapter_id": "V4", - "chapter_name": "API et service Web", - "section_id": "V4.3", - "section_name": "GraphQL", - "req_id": "V4.3.1", - "req_description": "Vérifiez qu'une liste d'autorisation de requête, une limitation de profondeur, une limitation de quantité ou une analyse des coûts de requête est utilisée pour empêcher le déni de service (DoS) de GraphQL ou d'expression de la couche données en raison de requêtes imbriquées coûteuses.", - "L": "2" - }, - { - "chapter_id": "V4", - "chapter_name": "API et service Web", - "section_id": "V4.3", - "section_name": "GraphQL", - "req_id": "V4.3.2", - "req_description": "Vérifiez que les requêtes d’introspection GraphQL sont désactivées dans l’environnement de production, sauf si l’API GraphQL est destinée à être utilisée par d’autres parties.", - "L": "2" - }, - { - "chapter_id": "V4", - "chapter_name": "API et service Web", - "section_id": "V4.4", - "section_name": "WebSocket", - "req_id": "V4.4.1", - "req_description": "Vérifiez que WebSocket sur TLS (WSS) est utilisé pour toutes les connexions WebSocket.", - "L": "1" - }, - { - "chapter_id": "V4", - "chapter_name": "API et service Web", - "section_id": "V4.4", - "section_name": "WebSocket", - "req_id": "V4.4.2", - "req_description": "Vérifiez que, lors de la négociation HTTP WebSocket initiale, le champ d’en-tête 'Origin' est vérifié par rapport à une liste d’origines autorisées pour l’application.", - "L": "2" - }, - { - "chapter_id": "V4", - "chapter_name": "API et service Web", - "section_id": "V4.4", - "section_name": "WebSocket", - "req_id": "V4.4.3", - "req_description": "Vérifiez que, si la gestion de session standard de l'application ne peut pas être utilisée, des jetons dédiés sont utilisés à cet effet, qui sont conformes aux exigences de sécurité de gestion de session pertinentes.", - "L": "2" - }, - { - "chapter_id": "V4", - "chapter_name": "API et service Web", - "section_id": "V4.4", - "section_name": "WebSocket", - "req_id": "V4.4.4", - "req_description": "Vérifiez que les jetons de gestion de session WebSocket dédiés sont initialement obtenus ou validés via la session HTTPS précédemment authentifiée lors de la transition d'une session HTTPS existante vers un canal WebSocket.", - "L": "2" - }, - { - "chapter_id": "V5", - "chapter_name": "Gestion des fichiers", - "section_id": "V5.1", - "section_name": "Documentation sur la gestion des fichiers", - "req_id": "V5.1.1", - "req_description": "Vérifiez que la documentation définit les types de fichiers autorisés, les extensions de fichiers attendues et la taille maximale (y compris la taille décompressée) pour chaque fonctionnalité de Téléversement. De plus, assurez-vous que la documentation précise comment les fichiers sont sécurisés pour le téléchargement et le traitement des utilisateurs finaux, par exemple le comportement de l'application lorsqu'un fichier malveillant est détecté.", - "L": "2" - }, - { - "chapter_id": "V5", - "chapter_name": "Gestion des fichiers", - "section_id": "V5.2", - "section_name": "Téléversement de fichiers et contenu", - "req_id": "V5.2.1", - "req_description": "Vérifiez que l'application n'acceptera que des fichiers d'une taille qu'elle peut traiter sans provoquer de perte de performances ou d'attaque par déni de service.", - "L": "1" - }, - { - "chapter_id": "V5", - "chapter_name": "Gestion des fichiers", - "section_id": "V5.2", - "section_name": "Téléversement de fichiers et contenu", - "req_id": "V5.2.2", - "req_description": "Vérifiez que lorsque l'application accepte un fichier, seul ou dans une archive telle qu'un fichier zip, elle vérifie si l'extension de fichier correspond à une extension attendue et que le contenu correspond au type représenté par l'extension. Cela inclut, sans s'y limiter, la vérification des « octets magiques » initiaux, la réécriture d'images et l'utilisation de bibliothèques spécialisées pour la validation du contenu des fichiers. Pour le niveau L1, cela peut se concentrer uniquement sur les fichiers utilisés pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau L2, cela doit s'appliquer à tous les fichiers acceptés.", - "L": "1" - }, - { - "chapter_id": "V5", - "chapter_name": "Gestion des fichiers", - "section_id": "V5.2", - "section_name": "Téléversement de fichiers et contenu", - "req_id": "V5.2.3", - "req_description": "Vérifiez que l'application vérifie les fichiers compressés (par exemple, zip, gz, docx, odt) par rapport à la taille maximale autorisée non compressée et au nombre maximal de fichiers avant de décompresser le fichier.", - "L": "2" - }, - { - "chapter_id": "V5", - "chapter_name": "Gestion des fichiers", - "section_id": "V5.2", - "section_name": "Téléversement de fichiers et contenu", - "req_id": "V5.2.4", - "req_description": "Vérifiez qu'un quota de taille de fichier et un nombre maximal de fichiers par utilisateur sont appliqués pour garantir qu'un seul utilisateur ne puisse pas remplir le stockage avec trop de fichiers ou des fichiers excessivement volumineux.", - "L": "3" - }, - { - "chapter_id": "V5", - "chapter_name": "Gestion des fichiers", - "section_id": "V5.2", - "section_name": "Téléversement de fichiers et contenu", - "req_id": "V5.2.5", - "req_description": "Vérifiez que l'application n'autorise pas le téléversement de fichiers compressés contenant des liens symboliques, sauf si cela est spécifiquement requis (auquel cas il sera nécessaire d'appliquer une liste d'autorisation des fichiers vers lesquels il est possible de créer des liens symboliques).", - "L": "3" - }, - { - "chapter_id": "V5", - "chapter_name": "Gestion des fichiers", - "section_id": "V5.2", - "section_name": "Téléversement de fichiers et contenu", - "req_id": "V5.2.6", - "req_description": "Vérifiez que l'application rejette les images téléversées avec une taille de pixel supérieure au maximum autorisé, afin d'éviter les attaques par inondation de pixels.", - "L": "3" - }, - { - "chapter_id": "V5", - "chapter_name": "Gestion des fichiers", - "section_id": "V5.3", - "section_name": "Stockage de fichiers", - "req_id": "V5.3.1", - "req_description": "Vérifiez que les fichiers téléversés ou générés par une entrée non fiable et stockés dans un dossier public ne sont pas exécutés en tant que code de programme côté serveur lorsqu'ils sont accessibles directement avec une requête HTTP.", - "L": "1" - }, - { - "chapter_id": "V5", - "chapter_name": "Gestion des fichiers", - "section_id": "V5.3", - "section_name": "Stockage de fichiers", - "req_id": "V5.3.2", - "req_description": "Vérifiez que lorsque l'application crée des chemins d'accès pour les opérations sur les fichiers, elle utilise des données générées en interne ou fiables plutôt que des noms de fichiers soumis par l'utilisateur. Si des noms de fichiers ou des métadonnées de fichiers soumis par l'utilisateur doivent être utilisés, une validation et un nettoyage stricts doivent être appliqués. Ceci permet de se protéger contre les attaques par traversée de chemin, l'inclusion de fichiers locaux ou distants (LFI, RFI) et la falsification de requêtes côté serveur (SSRF).", - "L": "1" - }, - { - "chapter_id": "V5", - "chapter_name": "Gestion des fichiers", - "section_id": "V5.3", - "section_name": "Stockage de fichiers", - "req_id": "V5.3.3", - "req_description": "Vérifiez que le traitement des fichiers côté serveur, comme la décompression des fichiers, ignore les informations de chemin fournies par l'utilisateur pour éviter les vulnérabilités telles que le \"zip slip\".", - "L": "3" - }, - { - "chapter_id": "V5", - "chapter_name": "Gestion des fichiers", - "section_id": "V5.4", - "section_name": "Téléchargement de fichier", - "req_id": "V5.4.1", - "req_description": "Vérifiez que l’application valide ou ignore les noms de fichiers soumis par l’utilisateur, y compris dans un paramètre JSON, JSONP ou URL et spécifie un nom de fichier dans le champ d’en-tête Content-Disposition de la réponse.", - "L": "2" - }, - { - "chapter_id": "V5", - "chapter_name": "Gestion des fichiers", - "section_id": "V5.4", - "section_name": "Téléchargement de fichier", - "req_id": "V5.4.2", - "req_description": "Vérifiez que les noms de fichiers servis (par exemple, dans les champs d'en-tête de réponse HTTP ou les pièces jointes aux e-mails) sont encodés ou nettoyés (par exemple, conformément à la RFC 6266) pour préserver la structure du document et empêcher les attaques par injection.", - "L": "2" - }, - { - "chapter_id": "V5", - "chapter_name": "Gestion des fichiers", - "section_id": "V5.4", - "section_name": "Téléchargement de fichier", - "req_id": "V5.4.3", - "req_description": "Vérifiez que les fichiers obtenus à partir de sources non fiables sont analysés par des scanners antivirus pour empêcher la diffusion de contenu malveillant connu.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.1", - "section_name": "Documentation d'authentification", - "req_id": "V6.1.1", - "req_description": "Vérifiez que la documentation de l'application définit comment les contrôles, tels que la limitation de débit, l'anti-automatisation et la réponse adaptative, sont utilisés pour se défendre contre les attaques telles que le « credential stuffing » et la force brute des mots de passe. La documentation doit expliquer clairement comment ces contrôles sont configurés et empêcher le blocage malveillant des comptes.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.1", - "section_name": "Documentation d'authentification", - "req_id": "V6.1.2", - "req_description": "Vérifiez qu'une liste de mots spécifiques au contexte est documentée afin d'empêcher leur utilisation dans les mots de passe. Cette liste peut inclure des permutations de noms d'organisations, de produits, d'identifiants de systèmes, de noms de codes de projets, de noms de services ou de rôles, etc.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.1", - "section_name": "Documentation d'authentification", - "req_id": "V6.1.3", - "req_description": "Vérifiez que, si l'application inclut plusieurs voies d'authentification, celles-ci sont toutes documentées avec les contrôles de sécurité et la force d'authentification qui doivent être appliqués de manière cohérente.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.2", - "section_name": "Sécurité des mots de passe", - "req_id": "V6.2.1", - "req_description": "Vérifiez que les mots de passe définis par l'utilisateur comportent au moins 8 caractères, bien qu'un minimum de 15 caractères soit fortement recommandé.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.2", - "section_name": "Sécurité des mots de passe", - "req_id": "V6.2.2", - "req_description": "Vérifiez que les utilisateurs peuvent modifier leur mot de passe.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.2", - "section_name": "Sécurité des mots de passe", - "req_id": "V6.2.3", - "req_description": "Vérifiez que la fonctionnalité de changement de mot de passe nécessite le mot de passe actuel et le nouveau mot de passe de l'utilisateur.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.2", - "section_name": "Sécurité des mots de passe", - "req_id": "V6.2.4", - "req_description": "Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou du changement de mot de passe sont vérifiés par rapport à un ensemble disponible d'au moins 3 000 mots de passe principaux qui correspondent à la politique de mot de passe de l'application, par exemple la longueur minimale.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.2", - "section_name": "Sécurité des mots de passe", - "req_id": "V6.2.5", - "req_description": "Vérifiez que les mots de passe peuvent être utilisés, quelle que soit leur composition, sans restriction quant au type de caractères autorisés. Aucun nombre minimal de majuscules ou de minuscules, de chiffres ou de caractères spéciaux ne doit être exigé.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.2", - "section_name": "Sécurité des mots de passe", - "req_id": "V6.2.6", - "req_description": "Vérifiez que les champs de saisie du mot de passe utilisent type=password pour masquer la saisie. Les applications peuvent permettre à l'utilisateur d'afficher temporairement l'intégralité du mot de passe masqué ou le dernier caractère saisi.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.2", - "section_name": "Sécurité des mots de passe", - "req_id": "V6.2.7", - "req_description": "Vérifiez que la fonctionnalité « coller », les assistants de mot de passe du navigateur et les gestionnaires de mots de passe externes sont autorisés.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.2", - "section_name": "Sécurité des mots de passe", - "req_id": "V6.2.8", - "req_description": "Vérifiez que l'application vérifie le mot de passe de l'utilisateur exactement tel qu'il a été reçu de l'utilisateur, sans aucune modification telle qu'une troncature ou une transformation de casse.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.2", - "section_name": "Sécurité des mots de passe", - "req_id": "V6.2.9", - "req_description": "Vérifiez que les mots de passe d’au moins 64 caractères sont autorisés.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.2", - "section_name": "Sécurité des mots de passe", - "req_id": "V6.2.10", - "req_description": "Vérifiez que le mot de passe d'un utilisateur reste valide jusqu'à ce qu'il soit découvert comme compromis ou qu'il soit renouvelé. L'application ne doit pas exiger de renouvellement périodique des identifiants.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.2", - "section_name": "Sécurité des mots de passe", - "req_id": "V6.2.11", - "req_description": "Vérifiez que la liste documentée de mots spécifiques au contexte est utilisée pour éviter la création de mots de passe faciles à deviner.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.2", - "section_name": "Sécurité des mots de passe", - "req_id": "V6.2.12", - "req_description": "Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou des modifications de mot de passe sont vérifiés par rapport à un ensemble de mots de passe fuités.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.3", - "section_name": "Sécurité générale de l'authentification", - "req_id": "V6.3.1", - "req_description": "Vérifiez que les contrôles visant à empêcher les attaques telles que le bourrage d'informations d'identification et la force brute des mots de passe sont mis en œuvre conformément à la documentation de sécurité de l'application.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.3", - "section_name": "Sécurité générale de l'authentification", - "req_id": "V6.3.2", - "req_description": "Vérifiez que les comptes d’utilisateur par défaut (par exemple, « root », « admin » ou « sa ») ne sont pas présents dans l’application ou sont désactivés.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.3", - "section_name": "Sécurité générale de l'authentification", - "req_id": "V6.3.3", - "req_description": "Vérifiez que l’application exige que les utilisateurs utilisent un mécanisme d’authentification multifacteur ou une combinaison de mécanismes d’authentification à facteur unique.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.3", - "section_name": "Sécurité générale de l'authentification", - "req_id": "V6.3.4", - "req_description": "Vérifiez que, si l’application inclut plusieurs voies d’authentification, il n’existe aucune voie non documentée et que les contrôles de sécurité et la force d’authentification sont appliqués de manière cohérente.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.3", - "section_name": "Sécurité générale de l'authentification", - "req_id": "V6.3.5", - "req_description": "Vérifiez que les utilisateurs sont informés des tentatives d'authentification suspectes (réussies ou non). Il peut s'agir de tentatives d'authentification provenant d'un emplacement ou d'un client inhabituel, d'une authentification partiellement réussie (un seul facteur parmi plusieurs), d'une tentative d'authentification après une longue période d'inactivité ou d'une authentification réussie après plusieurs tentatives infructueuses.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.3", - "section_name": "Sécurité générale de l'authentification", - "req_id": "V6.3.6", - "req_description": "Vérifiez que le courrier électronique n’est pas utilisé comme mécanisme d’authentification à facteur unique ou à facteurs multiples.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.3", - "section_name": "Sécurité générale de l'authentification", - "req_id": "V6.3.7", - "req_description": "Vérifiez que les utilisateurs sont avertis après les mises à jour des détails d'authentification, telles que les réinitialisations d'informations d'identification ou la modification du nom d'utilisateur ou de l'adresse e-mail.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.3", - "section_name": "Sécurité générale de l'authentification", - "req_id": "V6.3.8", - "req_description": "Vérifiez que les utilisateurs valides ne peuvent pas être déduits d'échecs d'authentification, par exemple en se basant sur des messages d'erreur, des codes de réponse HTTP ou des temps de réponse différents. Les fonctionnalités d'inscription et de mot de passe oublié doivent également bénéficier de cette protection.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.4", - "section_name": "Cycle de vie et récupération du facteur d'authentification", - "req_id": "V6.4.1", - "req_description": "Vérifiez que les mots de passe initiaux ou les codes d'activation générés par le système sont générés de manière aléatoire et sécurisée, qu'ils respectent la politique de mots de passe en vigueur et qu'ils expirent après une courte période ou après leur première utilisation. Ces secrets initiaux ne doivent pas devenir des mots de passe permanents.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.4", - "section_name": "Cycle de vie et récupération du facteur d'authentification", - "req_id": "V6.4.2", - "req_description": "Vérifiez que les indices de mot de passe ou l'authentification basée sur les connaissances (appelées « questions secrètes ») ne sont pas présents.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.4", - "section_name": "Cycle de vie et récupération du facteur d'authentification", - "req_id": "V6.4.3", - "req_description": "Vérifiez qu'un processus sécurisé de réinitialisation d'un mot de passe oublié est mis en œuvre, qui ne contourne aucun mécanisme d'authentification multifacteur activé.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.4", - "section_name": "Cycle de vie et récupération du facteur d'authentification", - "req_id": "V6.4.4", - "req_description": "Vérifiez que si un facteur d'authentification multifacteur est perdu, la preuve de vérification d'identité est effectuée au même niveau que lors de l'inscription.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.4", - "section_name": "Cycle de vie et récupération du facteur d'authentification", - "req_id": "V6.4.5", - "req_description": "Vérifiez que les instructions de renouvellement des mécanismes d'authentification qui expirent sont envoyées avec suffisamment de temps pour être exécutées avant l'expiration de l'ancien mécanisme d'authentification, en configurant des rappels automatiques si nécessaire.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.4", - "section_name": "Cycle de vie et récupération du facteur d'authentification", - "req_id": "V6.4.6", - "req_description": "Vérifiez que les administrateurs peuvent initier la réinitialisation du mot de passe de l'utilisateur, mais que cela ne leur permet pas de modifier ou de choisir son mot de passe. Cela évite qu'ils ne connaissent le mot de passe de l'utilisateur.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.5", - "section_name": "Exigences générales en matière d'authentification multifacteur", - "req_id": "V6.5.1", - "req_description": "Vérifiez que les secrets de recherche, les demandes ou codes d'authentification out-of-band et les mots de passe à usage unique basés sur le temps (TOTP) ne peuvent être utilisés avec succès qu'une seule fois.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.5", - "section_name": "Exigences générales en matière d'authentification multifacteur", - "req_id": "V6.5.2", - "req_description": "Vérifiez que, lors de leur stockage dans le backend de l'application, les secrets de recherche comportant moins de 112 bits d'entropie (19 caractères alphanumériques aléatoires ou 34 chiffres aléatoires) sont hachés avec un algorithme de hachage de stockage de mots de passe approuvé, intégrant un sel aléatoire de 32 bits. Une fonction de hachage standard peut être utilisée si le secret comporte 112 bits d'entropie ou plus.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.5", - "section_name": "Exigences générales en matière d'authentification multifacteur", - "req_id": "V6.5.3", - "req_description": "Vérifiez que les secrets de recherche, le code d'authentification out-of-band et les mots de passe à usage unique basés sur le temps sont générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) pour éviter les valeurs prévisibles.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.5", - "section_name": "Exigences générales en matière d'authentification multifacteur", - "req_id": "V6.5.4", - "req_description": "Vérifiez que les secrets de recherche et les codes d'authentification out-of-band ont un minimum de 20 bits d'entropie (généralement 4 caractères alphanumériques aléatoires ou 6 chiffres aléatoires suffisent).", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.5", - "section_name": "Exigences générales en matière d'authentification multifacteur", - "req_id": "V6.5.5", - "req_description": "Vérifiez que les requêtes, codes ou jetons d'authentification out-of-band, ainsi que les mots de passe à usage unique (TOTP), ont une durée de vie définie. Les requêtes out-of-band doivent avoir une durée de vie maximale de 10 minutes et les TOTP, de 30 secondes.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.5", - "section_name": "Exigences générales en matière d'authentification multifacteur", - "req_id": "V6.5.6", - "req_description": "Vérifiez que tout facteur d’authentification (y compris les appareils physiques) peut être révoqué en cas de vol ou autre perte.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.5", - "section_name": "Exigences générales en matière d'authentification multifacteur", - "req_id": "V6.5.7", - "req_description": "Vérifiez que les mécanismes d’authentification biométrique ne sont utilisés que comme facteurs secondaires, avec quelque chose que vous possédez ou quelque chose que vous savez.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.5", - "section_name": "Exigences générales en matière d'authentification multifacteur", - "req_id": "V6.5.8", - "req_description": "Vérifiez que les mots de passe à usage unique basés sur le temps (TOTP) sont vérifiés en fonction d'une source temporelle provenant d'un service de confiance et non d'une heure non fiable ou fournie par le client.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.6", - "section_name": "Mécanismes d'authentification out-of-band", - "req_id": "V6.6.1", - "req_description": "Vérifier que les mécanismes d'authentification utilisant le réseau téléphonique public commuté (RTPC) pour la transmission de mots de passe à usage unique (OTP) par téléphone ou SMS ne sont proposés que lorsque le numéro de téléphone a été préalablement validé. D'autres méthodes plus robustes (telles que les mots de passe à usage unique à durée déterminée) sont également proposées, et que le service informe les utilisateurs des risques de sécurité qu'elles présentent. Pour les applications de niveau 3, le téléphone et les SMS ne doivent pas être disponibles.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.6", - "section_name": "Mécanismes d'authentification out-of-band", - "req_id": "V6.6.2", - "req_description": "Vérifiez que les demandes d’authentification out-of-band, les codes ou les jetons sont liés à la demande d’authentification d’origine pour laquelle ils ont été générés et ne sont pas utilisables pour une demande précédente ou ultérieure.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.6", - "section_name": "Mécanismes d'authentification out-of-band", - "req_id": "V6.6.3", - "req_description": "Vérifiez qu'un mécanisme d'authentification out-of-band basé sur du code est protégé contre les attaques par force brute grâce au \"rate limiting\". Envisagez également d'utiliser un code avec au moins 64 bits d'entropie.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.6", - "section_name": "Mécanismes d'authentification out-of-band", - "req_id": "V6.6.4", - "req_description": "Vérifiez que, lorsque les notifications push sont utilisées pour l'authentification multifacteur, le \"rate limiting\" est appliqué afin d'empêcher les attaques de type « push bombing ». La concordance des numéros peut également atténuer ce risque.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.7", - "section_name": "Mécanisme d'authentification cryptographique", - "req_id": "V6.7.1", - "req_description": "Vérifiez que les certificats utilisés pour vérifier les assertions d’authentification cryptographique sont stockés de manière à les protéger contre toute modification.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.7", - "section_name": "Mécanisme d'authentification cryptographique", - "req_id": "V6.7.2", - "req_description": "Vérifiez que le nonce de défi a une longueur d'au moins 64 bits et qu'il est statistiquement unique ou unique sur toute la durée de vie du périphérique cryptographique.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.8", - "section_name": "Authentification avec un fournisseur d'identité", - "req_id": "V6.8.1", - "req_description": "Vérifiez que, si l'application prend en charge plusieurs fournisseurs d'identité (IdP), l'identité de l'utilisateur ne peut pas être usurpée via un autre fournisseur d'identité pris en charge (par exemple, en utilisant le même identifiant utilisateur). La mesure standard consisterait à ce que l'application enregistre et identifie l'utilisateur à l'aide d'une combinaison de l'ID du fournisseur d'identité (servant d'espace de noms) et de l'ID de l'utilisateur dans le fournisseur d'identité.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.8", - "section_name": "Authentification avec un fournisseur d'identité", - "req_id": "V6.8.2", - "req_description": "Vérifiez que la présence et l'intégrité des signatures numériques sur les assertions d'authentification (par exemple sur les assertions JWT ou SAML) sont toujours validées, en rejetant toutes les assertions non signées ou ayant des signatures non valides.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.8", - "section_name": "Authentification avec un fournisseur d'identité", - "req_id": "V6.8.3", - "req_description": "Vérifiez que les assertions SAML sont traitées de manière unique et utilisées une seule fois au cours de la période de validité pour éviter les attaques par rejeu.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.8", - "section_name": "Authentification avec un fournisseur d'identité", - "req_id": "V6.8.4", - "req_description": "Si une application utilise un fournisseur d'identité (IdP) distinct et attend une force, des méthodes ou une date d'authentification spécifiques pour des fonctions spécifiques, vérifiez que l'application les vérifie à l'aide des informations renvoyées par l'IdP. Par exemple, si OIDC est utilisé, cela peut être réalisé en validant les affirmations de jeton d'identification telles que « acr », « amr » et « auth_time » (le cas échéant). Si l'IdP ne fournit pas ces informations, l'application doit disposer d'une approche de secours documentée qui suppose que le mécanisme d'authentification de force minimale a été utilisé (par exemple, une authentification à facteur unique avec nom d'utilisateur et mot de passe).", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.1", - "section_name": "Documentation sur la gestion des sessions", - "req_id": "V7.1.1", - "req_description": "Vérifiez que le délai d'inactivité de la session de l'utilisateur et la durée de vie maximale absolue de la session sont documentés, sont appropriés en combinaison avec d'autres contrôles et que la documentation inclut une justification de tout écart par rapport aux exigences de réauthentification NIST SP 800-63B.", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.1", - "section_name": "Documentation sur la gestion des sessions", - "req_id": "V7.1.2", - "req_description": "Vérifiez que la documentation définit le nombre de sessions simultanées (parallèles) autorisées pour un compte ainsi que les comportements et actions prévus à entreprendre lorsque le nombre maximal de sessions actives est atteint.", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.1", - "section_name": "Documentation sur la gestion des sessions", - "req_id": "V7.1.3", - "req_description": "Vérifiez que tous les systèmes qui créent et gèrent des sessions utilisateur dans le cadre d'un écosystème de gestion des identités fédérées (tels que les systèmes SSO) sont documentés avec des contrôles pour coordonner la durée de vie des sessions, la résiliation et toute autre condition nécessitant une réauthentification.", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.2", - "section_name": "Sécurité fondamentale de la gestion des sessions", - "req_id": "V7.2.1", - "req_description": "Vérifiez que l’application effectue toutes les vérifications des jetons de session à l’aide d’un service backend de confiance.", - "L": "1" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.2", - "section_name": "Sécurité fondamentale de la gestion des sessions", - "req_id": "V7.2.2", - "req_description": "Vérifiez que l'application utilise des jetons autonomes ou de référence générés dynamiquement pour la gestion des sessions, c'est-à-dire sans utiliser de secrets et de clés d'API statiques.", - "L": "1" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.2", - "section_name": "Sécurité fondamentale de la gestion des sessions", - "req_id": "V7.2.3", - "req_description": "Vérifiez que si des jetons par référence sont utilisés pour représenter les sessions utilisateur, ils sont uniques et générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et possèdent au moins 128 bits d'entropie.", - "L": "1" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.2", - "section_name": "Sécurité fondamentale de la gestion des sessions", - "req_id": "V7.2.4", - "req_description": "Vérifiez que l’application génère un nouveau jeton de session lors de l’authentification de l’utilisateur, y compris la réauthentification, et met fin au jeton de session actuel.", - "L": "1" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.3", - "section_name": "Délai d'expiration de la session", - "req_id": "V7.3.1", - "req_description": "Vérifiez qu’il existe un délai d’inactivité tel que la réauthentification soit appliquée conformément à l’analyse des risques et aux décisions de sécurité documentées.", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.3", - "section_name": "Délai d'expiration de la session", - "req_id": "V7.3.2", - "req_description": "Vérifiez qu'il existe une durée de vie maximale absolue de la session de sorte que la réauthentification soit appliquée conformément à l'analyse des risques et aux décisions de sécurité documentées.", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.4", - "section_name": "Fin de session", - "req_id": "V7.4.1", - "req_description": "Vérifiez que lorsque la fin de session est déclenchée (par exemple, déconnexion ou expiration), l'application interdit toute utilisation ultérieure de la session. Pour les jetons par référence ou les sessions avec état, cela implique l'invalidation des données de session au niveau du backend de l'application. Les applications utilisant des jetons autonomes nécessiteront une solution, comme la gestion d'une liste des jetons terminés, l'interdiction des jetons produits avant une date et une heure spécifique à chaque utilisateur ou la rotation d'une clé de signature spécifique à chaque utilisateur.", - "L": "1" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.4", - "section_name": "Fin de session", - "req_id": "V7.4.2", - "req_description": "Vérifiez que l'application met fin à toutes les sessions actives lorsqu'un compte utilisateur est désactivé ou supprimé (par exemple, lorsqu'un employé quitte l'entreprise).", - "L": "1" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.4", - "section_name": "Fin de session", - "req_id": "V7.4.3", - "req_description": "Vérifiez que l'application offre la possibilité de mettre fin à toutes les autres sessions actives après une modification ou une suppression réussie de tout facteur d'authentification (y compris la modification du mot de passe via une réinitialisation ou une récupération et, le cas échéant, une mise à jour des paramètres MFA).", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.4", - "section_name": "Fin de session", - "req_id": "V7.4.4", - "req_description": "Vérifiez que toutes les pages nécessitant une authentification disposent d’un accès facile et visible à la fonctionnalité de déconnexion.", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.4", - "section_name": "Fin de session", - "req_id": "V7.4.5", - "req_description": "Vérifiez que les administrateurs d’applications sont en mesure de mettre fin aux sessions actives pour un utilisateur individuel ou pour tous les utilisateurs.", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.5", - "section_name": "Défenses contre les abus de session", - "req_id": "V7.5.1", - "req_description": "Vérifiez que l'application nécessite une réauthentification complète avant d'autoriser les modifications des attributs de compte sensibles qui peuvent affecter l'authentification, tels que l'adresse e-mail, le numéro de téléphone, la configuration MFA ou d'autres informations utilisées dans la récupération de compte.", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.5", - "section_name": "Défenses contre les abus de session", - "req_id": "V7.5.2", - "req_description": "Vérifiez que les utilisateurs peuvent afficher et (après s'être authentifiés à nouveau avec au moins un facteur) terminer une ou toutes les sessions actuellement actives.", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.5", - "section_name": "Défenses contre les abus de session", - "req_id": "V7.5.3", - "req_description": "Vérifiez que l’application nécessite une authentification supplémentaire avec au moins un facteur ou une vérification secondaire avant d’effectuer des transactions ou des opérations hautement sensibles.", - "L": "3" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.6", - "section_name": "Réauthentification fédérée", - "req_id": "V7.6.1", - "req_description": "Vérifiez que la durée de vie et la fin de la session entre les parties de confiance (RP) et les fournisseurs d'identité (IdP) se comportent comme documenté, en exigeant une réauthentification si nécessaire, par exemple lorsque le temps maximal entre les événements d'authentification IdP est atteint.", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.6", - "section_name": "Réauthentification fédérée", - "req_id": "V7.6.2", - "req_description": "Vérifiez que la création d'une session nécessite soit le consentement de l'utilisateur, soit une action explicite, empêchant ainsi la création de nouvelles sessions d'application sans interaction de l'utilisateur.", - "L": "2" - }, - { - "chapter_id": "V8", - "chapter_name": "Autorisation", - "section_id": "V8.1", - "section_name": "Documentation d'autorisation", - "req_id": "V8.1.1", - "req_description": "Vérifiez que la documentation d’autorisation définit des règles de restriction de l’accès au niveau de la fonction et aux données en fonction des autorisations du consommateur et des attributs des ressources.", - "L": "1" - }, - { - "chapter_id": "V8", - "chapter_name": "Autorisation", - "section_id": "V8.1", - "section_name": "Documentation d'autorisation", - "req_id": "V8.1.2", - "req_description": "Vérifiez que la documentation d'autorisation définit les règles de restriction d'accès au niveau des champs (lecture et écriture) en fonction des autorisations des consommateurs et des attributs des ressources. Notez que ces règles peuvent dépendre d'autres valeurs d'attributs de l'objet de données concerné, telles que l'état ou le statut.", - "L": "2" - }, - { - "chapter_id": "V8", - "chapter_name": "Autorisation", - "section_id": "V8.1", - "section_name": "Documentation d'autorisation", - "req_id": "V8.1.3", - "req_description": "Vérifiez que la documentation de l'application définit les attributs environnementaux et contextuels (y compris, mais sans s'y limiter, l'heure de la journée, l'emplacement de l'utilisateur, l'adresse IP ou l'appareil) qui sont utilisés dans l'application pour prendre des décisions de sécurité, y compris celles relatives à l'authentification et à l'autorisation.", - "L": "3" - }, - { - "chapter_id": "V8", - "chapter_name": "Autorisation", - "section_id": "V8.1", - "section_name": "Documentation d'autorisation", - "req_id": "V8.1.4", - "req_description": "Vérifier que la documentation d'authentification et d'autorisation définit l'utilisation des facteurs environnementaux et contextuels dans la prise de décision, en plus des autorisations au niveau des fonctions, des données et des champs. Cela doit inclure les attributs évalués, les seuils de risque et les actions entreprises (par exemple, autorisation, contestation, refus, renforcement de l'authentification).", - "L": "3" - }, - { - "chapter_id": "V8", - "chapter_name": "Autorisation", - "section_id": "V8.2", - "section_name": "Conception d'autorisation générale", - "req_id": "V8.2.1", - "req_description": "Vérifiez que l’application garantit que l’accès basé sur la fonction est limité aux consommateurs disposant d’autorisations explicites.", - "L": "1" - }, - { - "chapter_id": "V8", - "chapter_name": "Autorisation", - "section_id": "V8.2", - "section_name": "Conception d'autorisation générale", - "req_id": "V8.2.2", - "req_description": "Vérifiez que l'application garantit que l'accès spécifique aux données est limité aux consommateurs disposant d'autorisations explicites sur des éléments de données spécifiques afin d'atténuer les références d'objet directes non sécurisées (IDOR) et les autorisations de niveau d'objet rompues (BOLA).", - "L": "1" - }, - { - "chapter_id": "V8", - "chapter_name": "Autorisation", - "section_id": "V8.2", - "section_name": "Conception d'autorisation générale", - "req_id": "V8.2.3", - "req_description": "Vérifiez que l'application garantit que l'accès au niveau du champ est limité aux consommateurs disposant d'autorisations explicites sur des champs spécifiques afin d'atténuer les problèmes d'autorisation au niveau de la propriété d'objet (BOPLA).", - "L": "2" - }, - { - "chapter_id": "V8", - "chapter_name": "Autorisation", - "section_id": "V8.2", - "section_name": "Conception d'autorisation générale", - "req_id": "V8.2.4", - "req_description": "Vérifiez que les contrôles de sécurité adaptatifs basés sur les attributs environnementaux et contextuels du consommateur (tels que l'heure, la localisation, l'adresse IP ou l'appareil) sont mis en œuvre pour les décisions d'authentification et d'autorisation, comme défini dans la documentation de l'application. Ces contrôles doivent être appliqués lorsque le consommateur tente de démarrer une nouvelle session et également pendant une session existante.", - "L": "3" - }, - { - "chapter_id": "V8", - "chapter_name": "Autorisation", - "section_id": "V8.3", - "section_name": "Autorisation par opération", - "req_id": "V8.3.1", - "req_description": "Vérifier que l'application applique les règles d'autorisations au niveau de la couche service de confiance et ne s’appuie pas sur des contrôles qu’un consommateur non approuvé pourrait manipuler, comme JavaScript côté client.", - "L": "1" - }, - { - "chapter_id": "V8", - "chapter_name": "Autorisation", - "section_id": "V8.3", - "section_name": "Autorisation par opération", - "req_id": "V8.3.2", - "req_description": "Vérifiez que les modifications apportées aux valeurs sur lesquelles reposent les décisions d'autorisation sont appliquées immédiatement. Lorsque les modifications ne peuvent pas être appliquées immédiatement (par exemple, en s'appuyant sur des données de jetons autonomes), des contrôles d'atténuation doivent être mis en place pour alerter un consommateur lorsqu'il effectue une action alors qu'il n'est plus autorisé à le faire et annuler la modification. Notez que cette solution alternative ne limiterait pas les fuites d'informations.", - "L": "3" - }, - { - "chapter_id": "V8", - "chapter_name": "Autorisation", - "section_id": "V8.3", - "section_name": "Autorisation par opération", - "req_id": "V8.3.3", - "req_description": "Vérifiez que l'accès à un objet repose sur les autorisations du sujet d'origine (par exemple, le consommateur), et non sur celles d'un intermédiaire ou d'un service agissant en son nom. Par exemple, si un consommateur appelle un service web à l'aide d'un jeton d'authentification autonome, et que ce service demande ensuite des données à un autre service, ce dernier utilisera le jeton du consommateur, plutôt qu'un jeton inter-machine du premier service, pour prendre les décisions d'autorisation.", - "L": "3" - }, - { - "chapter_id": "V8", - "chapter_name": "Autorisation", - "section_id": "V8.4", - "section_name": "Autres considérations relatives à l'autorisation", - "req_id": "V8.4.1", - "req_description": "Vérifiez que les applications multi-tenants utilisent des contrôles inter-tenants pour garantir que les opérations des consommateurs n'affecteront jamais les tenants avec lesquels ils ne sont pas autorisés à interagir.", - "L": "2" - }, - { - "chapter_id": "V8", - "chapter_name": "Autorisation", - "section_id": "V8.4", - "section_name": "Autres considérations relatives à l'autorisation", - "req_id": "V8.4.2", - "req_description": "Vérifiez que l'accès aux interfaces administratives intègre plusieurs couches de sécurité, notamment la vérification continue de l'identité du consommateur, l'évaluation de la posture de sécurité des appareils et l'analyse contextuelle des risques, garantissant que l'emplacement du réseau ou les endpoints approuvés ne sont pas les seuls facteurs d'autorisation, même s'ils peuvent réduire la probabilité d'accès non autorisé.", - "L": "3" - }, - { - "chapter_id": "V9", - "chapter_name": "Jetons autonomes", - "section_id": "V9.1", - "section_name": "Source et intégrité du jeton", - "req_id": "V9.1.1", - "req_description": "Vérifiez que les jetons autonomes sont validés à l'aide de leur signature numérique ou MAC pour les protéger contre toute falsification avant d'accepter le contenu du jeton.", - "L": "1" - }, - { - "chapter_id": "V9", - "chapter_name": "Jetons autonomes", - "section_id": "V9.1", - "section_name": "Source et intégrité du jeton", - "req_id": "V9.1.2", - "req_description": "Vérifiez que seuls les algorithmes d'une liste d’autorisations peuvent être utilisés pour créer et vérifier des jetons autonomes, dans un contexte donné. La liste d'autorisation doit inclure les algorithmes autorisés, idéalement symétriques ou asymétriques, et ne doit pas inclure l'algorithme « Aucun ». Si les algorithmes symétriques et asymétriques doivent être pris en charge, des contrôles supplémentaires seront nécessaires pour éviter toute confusion de clés.", - "L": "1" - }, - { - "chapter_id": "V9", - "chapter_name": "Jetons autonomes", - "section_id": "V9.1", - "section_name": "Source et intégrité du jeton", - "req_id": "V9.1.3", - "req_description": "Vérifiez que les clés utilisées pour valider les jetons autonomes proviennent de sources préconfigurées et fiables pour l'émetteur du jeton, empêchant ainsi les attaquants de spécifier des sources et des clés non fiables. Pour les JWT et autres structures JWS, les en-têtes tels que « jku », « x5u » et « jwk » doivent être validés par rapport à une liste d'autorisation de sources fiables.", - "L": "1" - }, - { - "chapter_id": "V9", - "chapter_name": "Jetons autonomes", - "section_id": "V9.2", - "section_name": "Contenu du jeton", - "req_id": "V9.2.1", - "req_description": "Vérifiez que, si une période de validité est indiquée dans les données du jeton, celui-ci et son contenu ne sont acceptés que si la date de vérification est comprise dans cette période. Par exemple, pour les JWT, les déclarations « nbf » et « exp » doivent être vérifiées.", - "L": "1" - }, - { - "chapter_id": "V9", - "chapter_name": "Jetons autonomes", - "section_id": "V9.2", - "section_name": "Contenu du jeton", - "req_id": "V9.2.2", - "req_description": "Vérifiez que le service recevant un jeton valide le type de jeton et son utilisation avant d'en accepter le contenu. Par exemple, seuls les jetons d'accès peuvent être acceptés pour les décisions d'autorisation, et seuls les jetons d'identification peuvent être utilisés pour prouver l'authentification des utilisateurs.", - "L": "2" - }, - { - "chapter_id": "V9", - "chapter_name": "Jetons autonomes", - "section_id": "V9.2", - "section_name": "Contenu du jeton", - "req_id": "V9.2.3", - "req_description": "Vérifiez que le service accepte uniquement les jetons destinés à être utilisés avec ce service (audience). Pour les JWT, cela peut être réalisé en validant la déclaration « aud » par rapport à une liste d'autorisation définie dans le service.", - "L": "2" - }, - { - "chapter_id": "V9", - "chapter_name": "Jetons autonomes", - "section_id": "V9.2", - "section_name": "Contenu du jeton", - "req_id": "V9.2.4", - "req_description": "Si un émetteur de jetons utilise la même clé privée pour émettre des jetons destinés à différentes audiences, vérifiez que les jetons émis contiennent une restriction d'audience identifiant de manière unique les audiences visées. Cela empêchera la réutilisation d'un jeton avec une audience non prévue. Si l'identifiant d'audience est provisionné dynamiquement, l'émetteur de jetons doit valider ces audiences afin de garantir qu'elles n'entraînent pas d'usurpation d'identité.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.1", - "section_name": "Sécurité générique OAuth et OIDC", - "req_id": "V10.1.1", - "req_description": "Vérifiez que les jetons sont envoyés uniquement aux composants qui en ont absolument besoin. Par exemple, lors de l'utilisation d'un modèle backend-for-frontend pour les applications JavaScript basées sur un navigateur, les jetons d'accès et d'actualisation ne doivent être accessibles qu'au backend.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.1", - "section_name": "Sécurité générique OAuth et OIDC", - "req_id": "V10.1.2", - "req_description": "Vérifiez que le client n'accepte les valeurs du serveur d'autorisation (telles que le code d'autorisation ou le jeton d'identification) que si elles résultent d'un flux d'autorisation initié par la même session d'agent utilisateur et la même transaction. Cela nécessite que les secrets générés par le client, tels que la clé de preuve pour l'échange de codes (PKCE) « code_verifier », « state » ou le nonce OIDC, ne puissent être devinés, soient spécifiques à la transaction et soient liés de manière sécurisée au client et à la session d'agent utilisateur au cours de laquelle la transaction a été initiée.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.2", - "section_name": "Client OAuth", - "req_id": "V10.2.1", - "req_description": "Vérifiez que, si le flux de code est utilisé, le client OAuth dispose d'une protection contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF), qui déclenchent des demandes de jetons, soit en utilisant la fonctionnalité de clé de preuve pour l'échange de code (PKCE), soit en vérifiant le paramètre « state » envoyé dans la demande d'autorisation.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.2", - "section_name": "Client OAuth", - "req_id": "V10.2.2", - "req_description": "Vérifiez que, si le client OAuth peut interagir avec plusieurs serveurs d'autorisation, il dispose d'une protection contre les attaques par confusion. Par exemple, il peut exiger que le serveur d'autorisation renvoie la valeur du paramètre « iss » et la valide dans la réponse d'autorisation et la réponse du jeton.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.2", - "section_name": "Client OAuth", - "req_id": "V10.2.3", - "req_description": "Vérifiez que le client OAuth demande uniquement les portées requises (ou d’autres paramètres d’autorisation) dans les requêtes adressées au serveur d’autorisation.", - "L": "3" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.3", - "section_name": "Serveur de ressources OAuth", - "req_id": "V10.3.1", - "req_description": "Vérifiez que le serveur de ressources accepte uniquement les jetons d'accès destinés à être utilisés avec ce service (audience). L'audience peut être incluse dans un jeton d'accès structuré (comme la déclaration « aud » dans JWT) ou vérifiée à l'aide du endpoint d'introspection de jeton.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.3", - "section_name": "Serveur de ressources OAuth", - "req_id": "V10.3.2", - "req_description": "Vérifiez que le serveur de ressources applique les décisions d'autorisation en fonction des déclarations du jeton d'accès définissant l'autorisation déléguée. Si des déclarations telles que « sub », « scope » et « authorization_details » sont présentes, elles doivent être prises en compte dans la décision.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.3", - "section_name": "Serveur de ressources OAuth", - "req_id": "V10.3.3", - "req_description": "Vérifiez que si une décision de contrôle d'accès nécessite l'identification d'un utilisateur unique à partir d'un jeton d'accès (JWT ou réponse d'introspection de jeton associé), le serveur de ressources identifie l'utilisateur à partir de déclarations non ré attribuables à d'autres utilisateurs. En général, cela implique l'utilisation d'une combinaison de déclarations « iss » et « sub ».", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.3", - "section_name": "Serveur de ressources OAuth", - "req_id": "V10.3.4", - "req_description": "Si le serveur de ressources requiert une force d'authentification, des méthodes ou une date d'expiration spécifiques, vérifiez que le jeton d'accès présenté respecte ces contraintes. Par exemple, s'il est présent, utilisez les déclarations OIDC « acr », « amr » et « auth_time » respectivement.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.3", - "section_name": "Serveur de ressources OAuth", - "req_id": "V10.3.5", - "req_description": "Vérifiez que le serveur de ressources empêche l'utilisation de jetons d'accès volés ou la relecture de jetons d'accès (de parties non autorisées) en exigeant des jetons d'accès limités par l'expéditeur, soit Mutual TLS pour OAuth 2, soit OAuth 2 Demonstration of Proof of Possession (DPoP).", - "L": "3" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.4", - "section_name": "Serveur d'autorisation OAuth", - "req_id": "V10.4.1", - "req_description": "Vérifiez que le serveur d'autorisation valide les URI de redirection en fonction d'une liste d'autorisation spécifique au client d'URI préenregistrés à l'aide d'une comparaison de chaînes exacte.", - "L": "1" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.4", - "section_name": "Serveur d'autorisation OAuth", - "req_id": "V10.4.2", - "req_description": "Vérifiez que, si le serveur d'autorisation renvoie le code d'autorisation dans la réponse, celui-ci ne peut être utilisé qu'une seule fois pour une demande de jeton. Pour la deuxième demande valide avec un code d'autorisation déjà utilisé pour émettre un jeton d'accès, le serveur d'autorisation doit rejeter la demande de jeton et révoquer tous les jetons émis liés au code d'autorisation.", - "L": "1" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.4", - "section_name": "Serveur d'autorisation OAuth", - "req_id": "V10.4.3", - "req_description": "Vérifiez que le code d'autorisation est de courte durée. La durée de vie maximale peut atteindre 10 minutes pour les applications L1 et L2 et 1 minute pour les applications L3.", - "L": "1" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.4", - "section_name": "Serveur d'autorisation OAuth", - "req_id": "V10.4.4", - "req_description": "Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement l'utilisation des autorisations nécessaires à ce client. Notez que les autorisations « token » (flux implicite) et « password » (flux d'informations d'identification du propriétaire de la ressource) ne doivent plus être utilisées.", - "L": "1" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.4", - "section_name": "Serveur d'autorisation OAuth", - "req_id": "V10.4.5", - "req_description": "Vérifiez que le serveur d'autorisation atténue les attaques par rejeu de jetons d'actualisation pour les clients publics, de préférence en utilisant des jetons d'actualisation limités par l'expéditeur, par exemple des jetons DPoP (Demonstrating Proof of Possession) ou des jetons d'accès liés à un certificat utilisant le protocole TLS mutuel (mTLS). Pour les applications L1 et L2, la rotation des jetons d'actualisation peut être utilisée. Si cette rotation est utilisée, le serveur d'autorisation doit invalider le jeton d'actualisation après utilisation et révoquer tous les jetons d'actualisation de cette autorisation si un jeton d'actualisation déjà utilisé et invalidé est fourni.", - "L": "1" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.4", - "section_name": "Serveur d'autorisation OAuth", - "req_id": "V10.4.6", - "req_description": "Vérifiez que, si l'octroi de code est utilisé, le serveur d'autorisation atténue les attaques par interception de code en exigeant une clé de preuve pour l'échange de code (PKCE). Pour les demandes d'autorisation, le serveur d'autorisation doit exiger une valeur « code_challenge » valide et ne doit pas accepter une valeur « plain » pour « code_challenge_method ». Pour une demande de jeton, il doit exiger la validation du paramètre « code_verifier ».", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.4", - "section_name": "Serveur d'autorisation OAuth", - "req_id": "V10.4.7", - "req_description": "Vérifiez que si le serveur d'autorisation prend en charge l'enregistrement dynamique des clients non authentifiés, il réduit le risque d'applications clientes malveillantes. Il doit valider les métadonnées clientes, telles que les URI enregistrés, garantir le consentement de l'utilisateur et l'avertir avant de traiter une demande d'autorisation avec une application cliente non approuvée.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.4", - "section_name": "Serveur d'autorisation OAuth", - "req_id": "V10.4.8", - "req_description": "Vérifiez que les jetons d’actualisation ont une expiration absolue, y compris si l’expiration du jeton d’actualisation glissant est appliquée.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.4", - "section_name": "Serveur d'autorisation OAuth", - "req_id": "V10.4.9", - "req_description": "Vérifiez que les jetons d'actualisation et les jetons d'accès de référence peuvent être révoqués par un utilisateur autorisé à l'aide de l'interface utilisateur du serveur d'autorisation, afin d'atténuer le risque de clients malveillants ou de jetons volés.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.4", - "section_name": "Serveur d'autorisation OAuth", - "req_id": "V10.4.10", - "req_description": "Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.4", - "section_name": "Serveur d'autorisation OAuth", - "req_id": "V10.4.11", - "req_description": "Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.4", - "section_name": "Serveur d'autorisation OAuth", - "req_id": "V10.4.12", - "req_description": "Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement la valeur « response_mode » dont ce client a besoin. Par exemple, en vérifiant cette valeur par rapport aux valeurs attendues ou en utilisant une requête d'autorisation poussée (PAR) ou une requête d'autorisation sécurisée par JWT (JAR).", - "L": "3" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.4", - "section_name": "Serveur d'autorisation OAuth", - "req_id": "V10.4.13", - "req_description": "Vérifiez que le type d'Autorisation « code » est toujours utilisé avec les demandes d'autorisation poussées (PAR).", - "L": "3" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.4", - "section_name": "Serveur d'autorisation OAuth", - "req_id": "V10.4.14", - "req_description": "Vérifiez que le serveur d'autorisation émet uniquement des jetons d'accès limités à l'expéditeur (preuve de possession), soit avec des jetons d'accès liés au certificat utilisant TLS mutuel (mTLS), soit avec des jetons d'accès liés au DPoP (démonstration de preuve de possession).", - "L": "3" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.4", - "section_name": "Serveur d'autorisation OAuth", - "req_id": "V10.4.15", - "req_description": "Vérifiez que, pour un client côté serveur (non exécuté sur l'appareil de l'utilisateur final), le serveur d'autorisation garantit que la valeur du paramètre « authorization_details » provient du backend client et que l'utilisateur ne l'a pas altérée. Par exemple, en exigeant l'utilisation d'une demande d'autorisation poussée (PAR) ou d'une demande d'autorisation sécurisée par JWT (JAR).", - "L": "3" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.4", - "section_name": "Serveur d'autorisation OAuth", - "req_id": "V10.4.16", - "req_description": "Vérifiez que le client est confidentiel et que le serveur d'autorisation requiert l'utilisation de méthodes d'authentification client fortes (basées sur la cryptographie à clé publique et résistantes aux attaques par relecture), telles que TLS mutuel ('tls_client_auth', 'self_signed_tls_client_auth') ou JWT à clé privée ('private_key_jwt').", - "L": "3" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.5", - "section_name": "Client OIDC", - "req_id": "V10.5.1", - "req_description": "Vérifiez que le client (en tant que partie utilisatrice) atténue les attaques par rejeu de jeton d'identification. Par exemple, en vous assurant que la valeur « nonce » du jeton d'identification correspond à la valeur « nonce » envoyée dans la demande d'authentification au fournisseur OpenID (appelée demande d'autorisation envoyée au serveur d'autorisation dans OAuth2).", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.5", - "section_name": "Client OIDC", - "req_id": "V10.5.2", - "req_description": "Vérifiez que le client identifie de manière unique l'utilisateur à partir des déclarations de jeton d'identification, généralement la déclaration « sub », qui ne peut pas être réaffectée à d'autres utilisateurs (pour la portée d'un fournisseur d'identité).", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.5", - "section_name": "Client OIDC", - "req_id": "V10.5.3", - "req_description": "Vérifiez que le client rejette les tentatives d'un serveur d'autorisation malveillant d'usurper l'identité d'un autre serveur d'autorisation via ses métadonnées. Le client doit rejeter les métadonnées du serveur d'autorisation si l'URL de l'émetteur figurant dans ces métadonnées ne correspond pas exactement à l'URL d'émetteur préconfigurée attendue par le client.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.5", - "section_name": "Client OIDC", - "req_id": "V10.5.4", - "req_description": "Vérifiez que le client valide que le jeton d'identification est destiné à être utilisé pour ce client (audience) en vérifiant que la déclaration « aud » du jeton est égale à la valeur « client_id » pour le client.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.5", - "section_name": "Client OIDC", - "req_id": "V10.5.5", - "req_description": "Vérifiez que, lors de l'utilisation de la déconnexion du back-channel OIDC, la partie utilisatrice atténue les risques de déni de service liés à la déconnexion forcée et à la confusion entre JWT dans le flux de déconnexion. Le client doit vérifier que le jeton de déconnexion est correctement typé avec la valeur « logout+jwt », qu'il contient la déclaration « event » avec le nom de membre correct et qu'il ne contient pas de déclaration « nonce ». Il est également recommandé d'utiliser une expiration courte (par exemple, 2 minutes).", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.6", - "section_name": "Fournisseur OpenID", - "req_id": "V10.6.1", - "req_description": "Vérifiez que le fournisseur OpenID n'autorise que les valeurs « code », « ciba », « id_token » ou « id_token code » pour le mode de réponse. Notez que « code » est préférable à « id_token code » (flux hybride OIDC) et que « token » (tout flux implicite) ne doit pas être utilisé.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.6", - "section_name": "Fournisseur OpenID", - "req_id": "V10.6.2", - "req_description": "Vérifiez que le fournisseur OpenID atténue les risques de déni de service liés à la déconnexion forcée. Pour ce faire, obtenez une confirmation explicite de l'utilisateur final ou, le cas échéant, validez les paramètres de la requête de déconnexion (initiée par la partie utilisatrice), comme « id_token_hint ».", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.7", - "section_name": "Gestion du consentement", - "req_id": "V10.7.1", - "req_description": "Vérifiez que le serveur d'autorisation garantit le consentement de l'utilisateur à chaque demande d'autorisation. Si l'identité du client ne peut être garantie, le serveur d'autorisation doit toujours demander explicitement le consentement de l'utilisateur.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.7", - "section_name": "Gestion du consentement", - "req_id": "V10.7.2", - "req_description": "Vérifiez que lorsque le serveur d'autorisation demande le consentement de l'utilisateur, il fournit des informations claires et suffisantes sur ce qui est consenti. Le cas échéant, ces informations doivent inclure la nature des autorisations demandées (généralement en fonction de la portée, du serveur de ressources et des détails d'autorisation RAR), l'identité de l'application autorisée et la durée de vie de ces autorisations.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.7", - "section_name": "Gestion du consentement", - "req_id": "V10.7.3", - "req_description": "Vérifiez que l’utilisateur peut consulter, modifier et révoquer les consentements qu’il a accordés via le serveur d’autorisation.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.1", - "section_name": "Inventaire et documentation cryptographiques", - "req_id": "V11.1.1", - "req_description": "Vérifiez qu’il existe une politique documentée pour la gestion des clés cryptographiques et un cycle de vie des clés cryptographiques qui suit une norme de gestion des clés telle que NIST SP 800-57. Cela devrait inclure la garantie que les clés ne sont pas sur-partagées (par exemple, avec plus de deux entités pour les secrets partagés et plus d’une entité pour les clés privées).", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.1", - "section_name": "Inventaire et documentation cryptographiques", - "req_id": "V11.1.2", - "req_description": "Vérifiez qu'un inventaire cryptographique est réalisé, maintenu et régulièrement mis à jour, et qu'il inclut toutes les clés, algorithmes et certificats cryptographiques utilisés par l'application. Il doit également documenter les emplacements du système où les clés peuvent ou non être utilisées, ainsi que les types de données qui peuvent ou non être protégées par ces clés.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.1", - "section_name": "Inventaire et documentation cryptographiques", - "req_id": "V11.1.3", - "req_description": "Vérifiez que les mécanismes de découverte cryptographique sont utilisés pour identifier toutes les instances de cryptographie dans le système, y compris les opérations de chiffrement, de hachage et de signature.", - "L": "3" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.1", - "section_name": "Inventaire et documentation cryptographiques", - "req_id": "V11.1.4", - "req_description": "Vérifier la tenue d'un inventaire cryptographique. Celui-ci doit inclure un plan documenté décrivant la migration vers de nouvelles normes cryptographiques, telles que la cryptographie post-quantique, afin de réagir aux menaces futures.", - "L": "3" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.2", - "section_name": "Mise en œuvre sécurisée de la cryptographie", - "req_id": "V11.2.1", - "req_description": "Vérifiez que les implémentations validées par l’industrie (y compris les bibliothèques et les implémentations accélérées par le matériel) sont utilisées pour les opérations cryptographiques.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.2", - "section_name": "Mise en œuvre sécurisée de la cryptographie", - "req_id": "V11.2.2", - "req_description": "Vérifiez que l'application est conçue avec une agilité cryptographique, de sorte que les nombres aléatoires, le chiffrement authentifié, le MAC ou les algorithmes de hachage, les longueurs de clés, les tours, les chiffrements et les modes puissent être reconfigurés, mis à niveau ou échangés à tout moment, afin de se protéger contre les failles cryptographiques. De même, il doit être possible de remplacer les clés et les mots de passe, ainsi que de rechiffrer les données. Cela permettra des mises à niveau transparentes vers la cryptographie post-quantique (PQC), une fois que des implémentations hautement sécurisées de schémas ou de normes PQC approuvés seront largement disponibles.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.2", - "section_name": "Mise en œuvre sécurisée de la cryptographie", - "req_id": "V11.2.3", - "req_description": "Vérifiez que toutes les primitives cryptographiques utilisent un minimum de 128 bits de sécurité en fonction de l'algorithme, de la taille de la clé et de la configuration. Par exemple, une clé ECC de 256 bits offre environ 128 bits de sécurité, tandis que RSA nécessite une clé de 3072 bits pour atteindre 128 bits de sécurité.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.2", - "section_name": "Mise en œuvre sécurisée de la cryptographie", - "req_id": "V11.2.4", - "req_description": "Vérifiez que toutes les opérations cryptographiques sont à temps constant, sans opérations de « court-circuit » dans les comparaisons, les calculs ou les retours, pour éviter toute fuite d'informations.", - "L": "3" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.2", - "section_name": "Mise en œuvre sécurisée de la cryptographie", - "req_id": "V11.2.5", - "req_description": "Vérifiez que tous les modules cryptographiques échouent en toute sécurité et que les erreurs sont gérées de manière à ne pas permettre de vulnérabilités, telles que les attaques Padding Oracle.", - "L": "3" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.3", - "section_name": "Algorithmes de chiffrement", - "req_id": "V11.3.1", - "req_description": "Vérifiez que les modes de bloc non sécurisés (par exemple, ECB) et les schémas de remplissage faibles (par exemple, PKCS#1 v1.5) ne sont pas utilisés.", - "L": "1" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.3", - "section_name": "Algorithmes de chiffrement", - "req_id": "V11.3.2", - "req_description": "Vérifiez que seuls les chiffrements et modes approuvés tels que AES avec GCM sont utilisés.", - "L": "1" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.3", - "section_name": "Algorithmes de chiffrement", - "req_id": "V11.3.3", - "req_description": "Vérifiez que les données chiffrées sont protégées contre toute modification non autorisée, de préférence en utilisant une méthode de chiffrement authentifiée approuvée ou en combinant une méthode de chiffrement approuvée avec un algorithme MAC approuvé.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.3", - "section_name": "Algorithmes de chiffrement", - "req_id": "V11.3.4", - "req_description": "Vérifiez que les nonces, les vecteurs d'initialisation et autres nombres à usage unique ne sont pas utilisés pour plus d'une paire clé de chiffrement/élément de données. La méthode de génération doit être adaptée à l'algorithme utilisé.", - "L": "3" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.3", - "section_name": "Algorithmes de chiffrement", - "req_id": "V11.3.5", - "req_description": "Vérifiez que toute combinaison d'un algorithme de chiffrement et d'un algorithme MAC fonctionne en mode chiffrement puis MAC.", - "L": "3" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.4", - "section_name": "Hachage et fonctions basées sur le hachage", - "req_id": "V11.4.1", - "req_description": "Vérifiez que seules les fonctions de hachage approuvées sont utilisées pour les cas d'utilisation cryptographiques généraux, notamment les signatures numériques, HMAC, KDF et la génération de bits aléatoires. Les fonctions de hachage non autorisées, telles que MD5, ne doivent pas être utilisées à des fins cryptographiques.", - "L": "1" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.4", - "section_name": "Hachage et fonctions basées sur le hachage", - "req_id": "V11.4.2", - "req_description": "Vérifiez que les mots de passe sont stockés à l'aide d'une fonction de dérivation de clés approuvée et gourmande en ressources de calcul (également appelée « fonction de hachage de mots de passe »), dont les paramètres sont configurés conformément aux directives en vigueur. Ces paramètres doivent équilibrer sécurité et performances afin de rendre les attaques par force brute suffisamment difficiles pour le niveau de sécurité requis.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.4", - "section_name": "Hachage et fonctions basées sur le hachage", - "req_id": "V11.4.3", - "req_description": "Vérifiez que les fonctions de hachage utilisées dans les signatures numériques, dans le cadre de l'authentification ou de l'intégrité des données, sont résistantes aux collisions et possèdent des longueurs de bits appropriées. Si la résistance aux collisions est requise, la longueur de sortie doit être d'au moins 256 bits. Si seule la résistance aux attaques de seconde pré-image est requise, la longueur de sortie doit être d'au moins 128 bits.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.4", - "section_name": "Hachage et fonctions basées sur le hachage", - "req_id": "V11.4.4", - "req_description": "Vérifiez que l'application utilise des fonctions de dérivation de clés approuvées avec des paramètres d'extension de clés lors de la dérivation de clés secrètes à partir de mots de passe. Les paramètres utilisés doivent concilier sécurité et performances afin d'empêcher les attaques par force brute de compromettre la clé cryptographique obtenue.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.5", - "section_name": "Valeurs aléatoires", - "req_id": "V11.5.1", - "req_description": "Vérifiez que tous les nombres et chaînes aléatoires destinés à être non devinables doivent être générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et posséder au moins 128 bits d'entropie. Notez que les UUID ne respectent pas cette condition.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.5", - "section_name": "Valeurs aléatoires", - "req_id": "V11.5.2", - "req_description": "Vérifiez que le mécanisme de génération de nombres aléatoires utilisé est conçu pour fonctionner en toute sécurité, même en cas de forte demande.", - "L": "3" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.6", - "section_name": "Cryptographie à clé publique", - "req_id": "V11.6.1", - "req_description": "Vérifier que seuls des algorithmes cryptographiques et des modes opératoires approuvés sont utilisés pour la génération et l'amorçage des clés, ainsi que pour la génération et la vérification des signatures numériques. Les algorithmes de génération de clés ne doivent pas générer de clés non sécurisées et vulnérables aux attaques connues, par exemple les clés RSA vulnérables à la factorisation de Fermat.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.6", - "section_name": "Cryptographie à clé publique", - "req_id": "V11.6.2", - "req_description": "Vérifiez que des algorithmes cryptographiques approuvés sont utilisés pour l'échange de clés (tels que Diffie-Hellman), en veillant à ce que les mécanismes d'échange de clés utilisent des paramètres sécurisés. Cela permettra d'éviter les attaques contre le processus d'établissement des clés, susceptibles de conduire à des attaques de type « adversaire du milieu » ou à des failles cryptographiques.", - "L": "3" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.7", - "section_name": "Cryptographie des données en cours d'utilisation", - "req_id": "V11.7.1", - "req_description": "Vérifiez que le chiffrement complet de la mémoire est utilisé pour protéger les données sensibles pendant leur utilisation, empêchant ainsi l'accès par des utilisateurs ou des processus non autorisés.", - "L": "3" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.7", - "section_name": "Cryptographie des données en cours d'utilisation", - "req_id": "V11.7.2", - "req_description": "Vérifiez que la minimisation des données garantit que la quantité minimale de données est exposée pendant le traitement et assurez-vous que les données sont chiffrées immédiatement après utilisation ou dès que possible.", - "L": "3" - }, - { - "chapter_id": "V12", - "chapter_name": "Communication sécurisée", - "section_id": "V12.1", - "section_name": "Conseils généraux de sécurité TLS", - "req_id": "V12.1.1", - "req_description": "Vérifiez que seules les dernières versions recommandées du protocole TLS sont activées, telles que TLS 1.2 et TLS 1.3. La dernière version du protocole TLS doit être privilégiée.", - "L": "1" - }, - { - "chapter_id": "V12", - "chapter_name": "Communication sécurisée", - "section_id": "V12.1", - "section_name": "Conseils généraux de sécurité TLS", - "req_id": "V12.1.2", - "req_description": "Vérifiez que seules les suites de chiffrement recommandées sont activées, les suites de chiffrement les plus puissantes étant définies comme préférées. Les applications L3 doivent uniquement prendre en charge les suites de chiffrement assurant la confidentialité persistante (forward secrecy).", - "L": "2" - }, - { - "chapter_id": "V12", - "chapter_name": "Communication sécurisée", - "section_id": "V12.1", - "section_name": "Conseils généraux de sécurité TLS", - "req_id": "V12.1.3", - "req_description": "Vérifiez que l’application valide que les certificats clients mTLS sont approuvés avant d’utiliser l’identité du certificat pour l’authentification ou l’autorisation.", - "L": "2" - }, - { - "chapter_id": "V12", - "chapter_name": "Communication sécurisée", - "section_id": "V12.1", - "section_name": "Conseils généraux de sécurité TLS", - "req_id": "V12.1.4", - "req_description": "Vérifiez que la révocation de certification appropriée, telle que l'agrafage du protocole OCSP (Online Certificate Status Protocol), est activée et configurée.", - "L": "3" - }, - { - "chapter_id": "V12", - "chapter_name": "Communication sécurisée", - "section_id": "V12.1", - "section_name": "Conseils généraux de sécurité TLS", - "req_id": "V12.1.5", - "req_description": "Vérifiez que Encrypted Client Hello (ECH) est activé dans les paramètres TLS de l'application pour empêcher l'exposition de métadonnées sensibles, telles que l'indication du nom du serveur (SNI), pendant les processus de négociation TLS.", - "L": "3" - }, - { - "chapter_id": "V12", - "chapter_name": "Communication sécurisée", - "section_id": "V12.2", - "section_name": "Communication HTTPS avec des services externes", - "req_id": "V12.2.1", - "req_description": "Vérifiez que TLS est utilisé pour toute connectivité entre un client et des services externes basés sur HTTP, et ne recourt pas à des communications non sécurisées ou non chiffrées.", - "L": "1" - }, - { - "chapter_id": "V12", - "chapter_name": "Communication sécurisée", - "section_id": "V12.2", - "section_name": "Communication HTTPS avec des services externes", - "req_id": "V12.2.2", - "req_description": "Vérifiez que les services externes utilisent des certificats TLS publiquement approuvés.", - "L": "1" - }, - { - "chapter_id": "V12", - "chapter_name": "Communication sécurisée", - "section_id": "V12.3", - "section_name": "Sécurité des communications entre services généraux", - "req_id": "V12.3.1", - "req_description": "Vérifiez qu'un protocole chiffré tel que TLS est utilisé pour toutes les connexions entrantes et sortantes vers et depuis l'application, y compris les systèmes de surveillance, les outils de gestion, l'accès à distance et SSH, les intergiciels, les bases de données, les mainframes, les systèmes partenaires ou les API externes. Le serveur ne doit pas recourir à des protocoles non sécurisés ou non chiffrés.", - "L": "2" - }, - { - "chapter_id": "V12", - "chapter_name": "Communication sécurisée", - "section_id": "V12.3", - "section_name": "Sécurité des communications entre services généraux", - "req_id": "V12.3.2", - "req_description": "Vérifiez que les clients TLS valident les certificats reçus avant de communiquer avec un serveur TLS.", - "L": "2" - }, - { - "chapter_id": "V12", - "chapter_name": "Communication sécurisée", - "section_id": "V12.3", - "section_name": "Sécurité des communications entre services généraux", - "req_id": "V12.3.3", - "req_description": "Vérifiez que TLS ou un autre mécanisme de chiffrement de transport approprié est utilisé pour toute connectivité entre les services internes basés sur HTTP au sein de l'application et ne se replie pas vers des communications non sécurisées ou non chiffrées.", - "L": "2" - }, - { - "chapter_id": "V12", - "chapter_name": "Communication sécurisée", - "section_id": "V12.3", - "section_name": "Sécurité des communications entre services généraux", - "req_id": "V12.3.4", - "req_description": "Vérifiez que les connexions TLS entre les services internes utilisent des certificats de confiance. Lorsque des certificats générés en interne ou auto-signés sont utilisés, le service consommateur doit être configuré pour n'approuver que des autorités de certification internes spécifiques et des certificats auto-signés spécifiques.", - "L": "2" - }, - { - "chapter_id": "V12", - "chapter_name": "Communication sécurisée", - "section_id": "V12.3", - "section_name": "Sécurité des communications entre services généraux", - "req_id": "V12.3.5", - "req_description": "Vérifiez que les services communiquant en interne au sein d'un système (communications intra-services) utilisent une authentification forte pour garantir la vérification de chaque endpoint. Des méthodes d'authentification forte, telles que l'authentification client TLS, doivent être utilisées pour garantir l'identité, en utilisant une infrastructure à clé publique et des mécanismes résistants aux attaques par rejeu. Pour les architectures de microservices, envisagez d'utiliser un maillage de services pour simplifier la gestion des certificats et renforcer la sécurité.", - "L": "3" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.1", - "section_name": "Documentation de configuration", - "req_id": "V13.1.1", - "req_description": "Vérifiez que tous les besoins de communication de l'application sont documentés. Cela doit inclure les services externes dont l'application dépend et les cas où un utilisateur final pourrait fournir un emplacement externe auquel l'application se connectera.", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.1", - "section_name": "Documentation de configuration", - "req_id": "V13.1.2", - "req_description": "Vérifiez que pour chaque service utilisé par l'application, la documentation définit le nombre maximal de connexions simultanées (par exemple, les limites du pool de connexions) et le comportement de l'application lorsque cette limite est atteinte, y compris les mécanismes de secours ou de récupération, pour éviter les conditions de déni de service.", - "L": "3" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.1", - "section_name": "Documentation de configuration", - "req_id": "V13.1.3", - "req_description": "Vérifiez que la documentation de l'application définit des stratégies de gestion des ressources pour chaque système ou service externe utilisé (par exemple, bases de données, descripteurs de fichiers, threads, connexions HTTP). Cela doit inclure les procédures de libération des ressources, les paramètres de délai d'expiration, la gestion des échecs et l'implémentation de la logique de nouvelle tentative, en spécifiant les limites de nouvelle tentative, les délais et les algorithmes de retour arrière. Pour les opérations de requête-réponse HTTP synchrones, la documentation doit imposer des délais d'expiration courts et soit désactiver les nouvelles tentatives, soit les limiter strictement afin d'éviter les retards en cascade et l'épuisement des ressources.", - "L": "3" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.1", - "section_name": "Documentation de configuration", - "req_id": "V13.1.4", - "req_description": "Vérifiez que la documentation de l'application définit les secrets essentiels à la sécurité de l'application et un calendrier de rotation de ceux-ci, en fonction du modèle de menace et des exigences commerciales de l'organisation.", - "L": "3" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.2", - "section_name": "Configuration de la communication backend", - "req_id": "V13.2.1", - "req_description": "Vérifiez que les communications entre les composants de l'application backend qui ne prennent pas en charge le mécanisme de session utilisateur standard de l'application, notamment les API, les intergiciels et les couches de données, sont authentifiées. L'authentification doit utiliser des comptes de service individuels, des jetons à court terme ou une authentification par certificat, et non des identifiants immuables tels que des mots de passe, des clés API ou des comptes partagés avec accès privilégié.", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.2", - "section_name": "Configuration de la communication backend", - "req_id": "V13.2.2", - "req_description": "Vérifiez que les communications entre les composants de l'application backend, y compris les services locaux ou du système d'exploitation, les API, les intergiciels et les couches de données, sont effectuées avec des comptes dotés des privilèges les moins nécessaires.", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.2", - "section_name": "Configuration de la communication backend", - "req_id": "V13.2.3", - "req_description": "Vérifiez que si des informations d’identification doivent être utilisées pour l’authentification du service, les informations d’identification utilisées par le consommateur ne sont pas des informations d’identification par défaut (par exemple, root/root ou admin/admin).", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.2", - "section_name": "Configuration de la communication backend", - "req_id": "V13.2.4", - "req_description": "Vérifiez qu'une liste d’autorisations est utilisée pour définir les ressources ou systèmes externes avec lesquels l'application est autorisée à communiquer (par exemple, pour les requêtes sortantes, les chargements de données ou l'accès aux fichiers). Cette liste d'autorisation peut être implémentée au niveau de la couche applicative, du serveur web, du pare-feu ou d'une combinaison de différentes couches.", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.2", - "section_name": "Configuration de la communication backend", - "req_id": "V13.2.5", - "req_description": "Vérifiez que le serveur Web ou d’application est configuré avec une liste autorisée de ressources ou de systèmes vers lesquels le serveur peut envoyer des requêtes ou charger des données ou des fichiers.", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.2", - "section_name": "Configuration de la communication backend", - "req_id": "V13.2.6", - "req_description": "Vérifiez que lorsque l'application se connecte à des services distincts, elle suit la configuration documentée pour chaque connexion, comme le nombre maximal de connexions parallèles, le comportement lorsque le nombre maximal de connexions autorisées est atteint, les délais d'expiration de connexion et les stratégies de nouvelle tentative.", - "L": "3" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.3", - "section_name": "Gestion des secrets", - "req_id": "V13.3.1", - "req_description": "Vérifiez qu'une solution de gestion des secrets, telle qu'un coffre-fort de clés, est utilisée pour créer, stocker, contrôler l'accès et détruire en toute sécurité les secrets backend. Ceux-ci peuvent inclure des mots de passe, du matériel de clé, des intégrations avec des bases de données et des systèmes tiers, des clés et des graines pour des jetons temporels, d'autres secrets internes et des clés API. Les secrets ne doivent pas être inclus dans le code source de l'application ni dans les artefacts de build. Pour une application L3, cela doit impliquer une solution matérielle telle qu'un HSM.", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.3", - "section_name": "Gestion des secrets", - "req_id": "V13.3.2", - "req_description": "Vérifiez que l’accès aux ressources secrètes respecte le principe du moindre privilège.", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.3", - "section_name": "Gestion des secrets", - "req_id": "V13.3.3", - "req_description": "Vérifiez que toutes les opérations cryptographiques sont effectuées à l'aide d'un module de sécurité isolé (tel qu'un coffre-fort ou un module de sécurité matériel) pour gérer et protéger en toute sécurité le matériel clé contre toute exposition en dehors du module de sécurité.", - "L": "3" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.3", - "section_name": "Gestion des secrets", - "req_id": "V13.3.4", - "req_description": "Vérifiez que les secrets sont configurés pour expirer et être renouvelés en fonction de la documentation de l'application.", - "L": "3" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.4", - "section_name": "Fuite d'informations involontaire", - "req_id": "V13.4.1", - "req_description": "Vérifiez que l'application est déployée soit sans aucune métadonnée de contrôle de source, y compris les dossiers .git ou .svn, soit de manière à ce que ces dossiers soient inaccessibles à la fois en externe et à l'application elle-même.", - "L": "1" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.4", - "section_name": "Fuite d'informations involontaire", - "req_id": "V13.4.2", - "req_description": "Vérifiez que les modes de débogage sont désactivés pour tous les composants dans les environnements de production afin d’éviter l’exposition des fonctionnalités de débogage et la fuite d’informations.", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.4", - "section_name": "Fuite d'informations involontaire", - "req_id": "V13.4.3", - "req_description": "Vérifiez que les serveurs Web n’exposent pas les listes de répertoires aux clients, sauf si cela est explicitement prévu.", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.4", - "section_name": "Fuite d'informations involontaire", - "req_id": "V13.4.4", - "req_description": "Vérifiez que l’utilisation de la méthode HTTP TRACE n’est pas prise en charge dans les environnements de production, afin d’éviter toute fuite d’informations potentielle.", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.4", - "section_name": "Fuite d'informations involontaire", - "req_id": "V13.4.5", - "req_description": "Vérifiez que la documentation (comme pour les API internes) et les endpoints de surveillance ne sont pas exposés, sauf si cela est explicitement prévu.", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.4", - "section_name": "Fuite d'informations involontaire", - "req_id": "V13.4.6", - "req_description": "Vérifiez que l’application n’expose pas d’informations de version détaillées des composants backend.", - "L": "3" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.4", - "section_name": "Fuite d'informations involontaire", - "req_id": "V13.4.7", - "req_description": "Vérifiez que la couche web est configuré pour servir uniquement les fichiers avec des extensions de fichier spécifiques afin d’éviter toute fuite involontaire d’informations, de configuration et de code source.", - "L": "3" - }, - { - "chapter_id": "V14", - "chapter_name": "Protection des données", - "section_id": "V14.1", - "section_name": "Documentation sur la protection des données", - "req_id": "V14.1.1", - "req_description": "Vérifiez que toutes les données sensibles créées et traitées par l'application ont été identifiées et classées selon leur niveau de protection. Cela inclut les données uniquement codées et donc facilement déchiffrables, telles que les chaînes Base64 ou la charge utile en texte clair d'un JWT. Les niveaux de protection doivent tenir compte des réglementations et normes de protection des données et de confidentialité auxquelles l'application est tenue de se conformer.", - "L": "2" - }, - { - "chapter_id": "V14", - "chapter_name": "Protection des données", - "section_id": "V14.1", - "section_name": "Documentation sur la protection des données", - "req_id": "V14.1.2", - "req_description": "Vérifier que tous les niveaux de protection des données sensibles sont assortis d'un ensemble documenté d'exigences de protection. Cela doit inclure (sans s'y limiter) les exigences relatives au chiffrement général, à la vérification de l'intégrité, à la conservation, à la journalisation des données, aux contrôles d'accès aux données sensibles dans les journaux, au chiffrement au niveau de la base de données, aux technologies de confidentialité et de renforcement de la confidentialité à utiliser, ainsi qu'aux autres exigences de confidentialité.", - "L": "2" - }, - { - "chapter_id": "V14", - "chapter_name": "Protection des données", - "section_id": "V14.2", - "section_name": "Protection générale des données", - "req_id": "V14.2.1", - "req_description": "Vérifiez que les données sensibles sont uniquement envoyées au serveur dans les champs de corps ou d’en-tête du message HTTP, et que l’URL et la chaîne de requête ne contiennent pas d’informations sensibles, telles qu’une clé API ou un jeton de session.", - "L": "1" - }, - { - "chapter_id": "V14", - "chapter_name": "Protection des données", - "section_id": "V14.2", - "section_name": "Protection générale des données", - "req_id": "V14.2.2", - "req_description": "Vérifiez que l’application empêche la mise en cache des données sensibles dans les composants du serveur, tels que les équilibreurs de charge et les caches d’application, ou garantit que les données sont purgées en toute sécurité après utilisation.", - "L": "2" - }, - { - "chapter_id": "V14", - "chapter_name": "Protection des données", - "section_id": "V14.2", - "section_name": "Protection générale des données", - "req_id": "V14.2.3", - "req_description": "Vérifiez que les données sensibles définies ne sont pas envoyées à des parties non fiables (par exemple, des trackers d'utilisateurs) pour empêcher la collecte indésirable de données en dehors du contrôle de l'application.", - "L": "2" - }, - { - "chapter_id": "V14", - "chapter_name": "Protection des données", - "section_id": "V14.2", - "section_name": "Protection générale des données", - "req_id": "V14.2.4", - "req_description": "Vérifiez que les contrôles autour des données sensibles liés au chiffrement, à la vérification de l'intégrité, à la conservation, à la manière dont les données doivent être enregistrées, aux contrôles d'accès autour des données sensibles dans les journaux, à la confidentialité et aux technologies d'amélioration de la confidentialité, sont mis en œuvre comme défini dans la documentation pour le niveau de protection des données spécifiques.", - "L": "2" - }, - { - "chapter_id": "V14", - "chapter_name": "Protection des données", - "section_id": "V14.2", - "section_name": "Protection générale des données", - "req_id": "V14.2.5", - "req_description": "Vérifiez que les mécanismes de mise en cache sont configurés pour ne mettre en cache que les réponses dont le type de contenu est conforme à la ressource et qui ne contiennent pas de contenu sensible et dynamique. Le serveur web doit renvoyer une réponse 404 ou 302 lors de l'accès à un fichier inexistant plutôt qu'un fichier valide différent. Cela devrait empêcher les attaques par empoisonnement de cache web.", - "L": "3" - }, - { - "chapter_id": "V14", - "chapter_name": "Protection des données", - "section_id": "V14.2", - "section_name": "Protection générale des données", - "req_id": "V14.2.6", - "req_description": "Vérifiez que l'application ne renvoie que les données sensibles minimales requises pour son fonctionnement. Par exemple, ne renvoyez que certains chiffres d'un numéro de carte de crédit, et non le numéro complet. Si les données complètes sont requises, elles doivent être masquées dans l'interface utilisateur, sauf si l'utilisateur les consulte spécifiquement.", - "L": "3" - }, - { - "chapter_id": "V14", - "chapter_name": "Protection des données", - "section_id": "V14.2", - "section_name": "Protection générale des données", - "req_id": "V14.2.7", - "req_description": "Vérifiez que les informations sensibles sont soumises à une classification de conservation des données, en veillant à ce que les données obsolètes ou inutiles soient supprimées automatiquement, selon un calendrier défini ou selon les besoins de la situation.", - "L": "3" - }, - { - "chapter_id": "V14", - "chapter_name": "Protection des données", - "section_id": "V14.2", - "section_name": "Protection générale des données", - "req_id": "V14.2.8", - "req_description": "Vérifiez que les informations sensibles sont supprimées des métadonnées des fichiers soumis par l'utilisateur, sauf si le stockage est autorisé par l'utilisateur.", - "L": "3" - }, - { - "chapter_id": "V14", - "chapter_name": "Protection des données", - "section_id": "V14.3", - "section_name": "Protection des données côté client", - "req_id": "V14.3.1", - "req_description": "Vérifiez que les données authentifiées sont effacées du stockage client, comme le DOM du navigateur, après la fin du client ou de la session. Le champ d'en-tête de réponse HTTP « Clear-Site-Data » peut être utile, mais le côté client devrait également pouvoir effectuer la correction si la connexion au serveur n'est pas disponible à la fin de la session.", - "L": "1" - }, - { - "chapter_id": "V14", - "chapter_name": "Protection des données", - "section_id": "V14.3", - "section_name": "Protection des données côté client", - "req_id": "V14.3.2", - "req_description": "Vérifiez que l'application définit suffisamment de champs d'en-tête de réponse HTTP anti-caching (c'est-à-dire Cache-Control : no-store) afin que les données sensibles ne soient pas mises en cache dans les navigateurs.", - "L": "2" - }, - { - "chapter_id": "V14", - "chapter_name": "Protection des données", - "section_id": "V14.3", - "section_name": "Protection des données côté client", - "req_id": "V14.3.3", - "req_description": "Vérifiez que les données stockées dans le stockage du navigateur (telles que localStorage, sessionStorage, IndexedDB ou les cookies) ne contiennent pas de données sensibles, à l'exception des jetons de session.", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.1", - "section_name": "Documentation sur le développement et l'architecture sécurisés", - "req_id": "V15.1.1", - "req_description": "Vérifiez que la documentation de l'application définit les délais de correction basés sur les risques pour les versions de composants tiers présentant des vulnérabilités et pour la mise à jour des bibliothèques en général, afin de minimiser les risques liés à ces composants.", - "L": "1" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.1", - "section_name": "Documentation sur le développement et l'architecture sécurisés", - "req_id": "V15.1.2", - "req_description": "Vérifiez qu'un catalogue d'inventaire, tel qu'une nomenclature logicielle (SBOM), est conservé pour toutes les bibliothèques tierces utilisées, y compris en vérifiant que les composants proviennent de référentiels prédéfinis, fiables et continuellement maintenus.", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.1", - "section_name": "Documentation sur le développement et l'architecture sécurisés", - "req_id": "V15.1.3", - "req_description": "Vérifiez que la documentation de l'application identifie les fonctionnalités consommatrices en temps ou gourmandes en ressources. Elle doit notamment indiquer comment prévenir une perte de disponibilité due à une utilisation excessive de ces fonctionnalités et éviter que la génération d'une réponse ne prenne plus de temps que le délai d'expiration du consommateur. Les mesures de protection potentielles peuvent inclure le traitement asynchrone, l'utilisation de files d'attente et la limitation des processus parallèles par utilisateur et par application.", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.1", - "section_name": "Documentation sur le développement et l'architecture sécurisés", - "req_id": "V15.1.4", - "req_description": "Vérifiez que la documentation de l’application met en évidence les bibliothèques tierces qui sont considérées comme des « composants à risque ».", - "L": "3" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.1", - "section_name": "Documentation sur le développement et l'architecture sécurisés", - "req_id": "V15.1.5", - "req_description": "Vérifiez que la documentation de l’application met en évidence les parties de l’application où des « fonctionnalités dangereuses » sont utilisées.", - "L": "3" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.2", - "section_name": "Architecture de sécurité et dépendances", - "req_id": "V15.2.1", - "req_description": "Vérifiez que l’application contient uniquement des composants qui n’ont pas dépassé les délais de mise à jour et de correction documentés.", - "L": "1" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.2", - "section_name": "Architecture de sécurité et dépendances", - "req_id": "V15.2.2", - "req_description": "Vérifiez que l'application a mis en œuvre des défenses contre la perte de disponibilité due à des fonctionnalités qui prennent du temps ou qui nécessitent des ressources, sur la base des décisions et stratégies de sécurité documentées à cet effet.", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.2", - "section_name": "Architecture de sécurité et dépendances", - "req_id": "V15.2.3", - "req_description": "Vérifiez que l'environnement de production inclut uniquement les fonctionnalités nécessaires au fonctionnement de l'application et n'expose pas de fonctionnalités superflues telles que du code de test, des exemples d'extraits et des fonctionnalités de développement.", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.2", - "section_name": "Architecture de sécurité et dépendances", - "req_id": "V15.2.4", - "req_description": "Vérifiez que les composants tiers et toutes leurs dépendances transitives sont inclus à partir du référentiel attendu, qu'il soit détenu en interne ou qu'il s'agisse d'une source externe, et qu'il n'y a aucun risque d'attaque par confusion de dépendances.", - "L": "3" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.2", - "section_name": "Architecture de sécurité et dépendances", - "req_id": "V15.2.5", - "req_description": "Vérifiez que l'application implémente des protections supplémentaires autour des parties documentées comme contenant des « fonctionnalités dangereuses » ou utilisant des bibliothèques tierces considérées comme des « composants à risque ». Cela peut inclure des techniques telles que le sandboxing, l'encapsulation, la conteneurisation ou l'isolation au niveau du réseau pour retarder et dissuader les attaquants qui compromettent une partie de l'application de se propager ailleurs.", - "L": "3" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.3", - "section_name": "Développement défensif", - "req_id": "V15.3.1", - "req_description": "Vérifiez que l'application ne renvoie que le sous-ensemble requis de champs d'un objet de données. Par exemple, elle ne doit pas renvoyer un objet de données entier, car certains champs individuels ne doivent pas être accessibles aux utilisateurs.", - "L": "1" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.3", - "section_name": "Développement défensif", - "req_id": "V15.3.2", - "req_description": "Vérifiez que lorsque le backend de l'application effectue des appels vers des URL externes, il est configuré pour ne pas suivre les redirections, sauf s'il s'agit d'une fonctionnalité prévue.", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.3", - "section_name": "Développement défensif", - "req_id": "V15.3.3", - "req_description": "Vérifiez que l'application dispose de contre-mesures pour se protéger contre les attaques d'affectation de masse en limitant les champs autorisés par contrôleur et action, par exemple, il n'est pas possible d'insérer ou de mettre à jour une valeur de champ lorsqu'elle n'était pas destinée à faire partie de cette action.", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.3", - "section_name": "Développement défensif", - "req_id": "V15.3.4", - "req_description": "Vérifiez que tous les composants proxy et middleware transfèrent correctement l'adresse IP d'origine de l'utilisateur à l'aide de champs de données fiables qui ne peuvent pas être manipulés par l'utilisateur final, et que l'application et le serveur Web utilisent cette valeur correcte pour la journalisation et les décisions de sécurité telles que la limitation du débit, en tenant compte du fait que même l'adresse IP d'origine peut ne pas être fiable en raison d'adresses IP dynamiques, de VPN ou de pare-feu d'entreprise.", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.3", - "section_name": "Développement défensif", - "req_id": "V15.3.5", - "req_description": "Vérifiez que l'application garantit explicitement que les variables sont du type correct et effectue des opérations d'égalité et de comparaison strictes. Cela permet d'éviter les vulnérabilités liées à la confusion de types, causées par des hypothèses du code de l'application sur le type d'une variable.", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.3", - "section_name": "Développement défensif", - "req_id": "V15.3.6", - "req_description": "Vérifiez que le code JavaScript est écrit de manière à éviter la pollution du prototype, par exemple en utilisant Set() ou Map() au lieu de littéraux d'objet.", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.3", - "section_name": "Développement défensif", - "req_id": "V15.3.7", - "req_description": "Vérifiez que l'application dispose de défenses contre les attaques de pollution des paramètres HTTP, en particulier si le Framework d'application ne fait aucune distinction quant à la source des paramètres de requête (chaîne de requête, paramètres de corps, cookies ou champs d'en-tête).", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.4", - "section_name": "Concurrence sécurisée", - "req_id": "V15.4.1", - "req_description": "Vérifiez que les objets partagés dans le code multithread (tels que les caches, les fichiers ou les objets en mémoire accessibles par plusieurs threads) sont accessibles en toute sécurité à l'aide de types thread-safe et de mécanismes de synchronisation tels que des verrous ou des sémaphores pour éviter les conditions de concurrence et la corruption des données.", - "L": "3" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.4", - "section_name": "Concurrence sécurisée", - "req_id": "V15.4.2", - "req_description": "Vérifiez que les vérifications de l'état d'une ressource, comme son existence ou ses autorisations, et des actions qui en dépendent, sont effectuées en une seule opération atomique afin d'éviter les situations de concurrence entre le moment de la vérification et le moment de l'utilisation (TOCTOU). Par exemple, vérifier l'existence d'un fichier avant de l'ouvrir ou l'accès d'un utilisateur avant de l'accorder.", - "L": "3" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.4", - "section_name": "Concurrence sécurisée", - "req_id": "V15.4.3", - "req_description": "Vérifiez que les verrous sont utilisés de manière cohérente pour éviter que les threads ne se bloquent, que ce soit en s'attendant les uns les autres ou en réessayant sans fin, et que la logique de verrouillage reste dans le code responsable de la gestion de la ressource pour garantir que les verrous ne peuvent pas être modifiés par inadvertance ou de manière malveillante par des classes ou du code externes.", - "L": "3" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.4", - "section_name": "Concurrence sécurisée", - "req_id": "V15.4.4", - "req_description": "Vérifiez que les politiques d'allocation des ressources empêchent la saturation de threads en garantissant un accès équitable aux ressources, par exemple en exploitant les pools de threads, permettant aux threads de priorité inférieure de continuer dans un délai raisonnable.", - "L": "3" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.1", - "section_name": "Documentation sur la journalisation de sécurité", - "req_id": "V16.1.1", - "req_description": "Vérifiez qu'il existe un inventaire documentant la journalisation effectuée à chaque couche de la pile technologique de l'application, les événements enregistrés, les formats de journal, l'endroit où cette journalisation est stockée, la manière dont elle est utilisée, la manière dont l'accès à celle-ci est contrôlé et la durée de conservation des journaux.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.2", - "section_name": "Journalisation générale", - "req_id": "V16.2.1", - "req_description": "Vérifiez que chaque entrée de journal inclut les métadonnées nécessaires (telles que quand, où, qui, quoi) qui permettraient une enquête détaillée sur la chronologie lorsqu'un événement se produit.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.2", - "section_name": "Journalisation générale", - "req_id": "V16.2.2", - "req_description": "Vérifiez que les sources de temps de tous les composants de journalisation sont synchronisées et que les horodatages des métadonnées des événements de sécurité utilisent le temps UTC ou incluent un décalage horaire explicite. L'UTC est recommandé pour garantir la cohérence entre les systèmes distribués et éviter toute confusion lors du passage à l'heure d'été.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.2", - "section_name": "Journalisation générale", - "req_id": "V16.2.3", - "req_description": "Vérifiez que l’application stocke ou diffuse uniquement les journaux vers les fichiers et services documentés dans l’inventaire des journaux.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.2", - "section_name": "Journalisation générale", - "req_id": "V16.2.4", - "req_description": "Vérifiez que les journaux peuvent être lus et corrélés par le processeur de journaux utilisé, de préférence en utilisant un format de journalisation commun.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.2", - "section_name": "Journalisation générale", - "req_id": "V16.2.5", - "req_description": "Vérifiez que l'application applique la journalisation en fonction du niveau de protection des données lors de la journalisation de données sensibles. Par exemple, certaines données, comme les identifiants ou les informations de paiement, peuvent être interdites. D'autres données, comme les jetons de session, ne peuvent être enregistrées que par hachage ou masquage, en totalité ou en partie.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.3", - "section_name": "Événements de sécurité", - "req_id": "V16.3.1", - "req_description": "Vérifiez que toutes les opérations d'authentification sont enregistrées, y compris les tentatives réussies et infructueuses. Des métadonnées supplémentaires, telles que le type d'authentification ou les facteurs utilisés, doivent également être collectées.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.3", - "section_name": "Événements de sécurité", - "req_id": "V16.3.2", - "req_description": "Vérifier que les tentatives d'autorisation infructueuses sont logguées. Pour le niveau 3, cela doit inclure la journalisation de toutes les décisions d'autorisation, y compris lors de l'accès à des données sensibles (sans journalisation des données sensibles elles-mêmes).", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.3", - "section_name": "Événements de sécurité", - "req_id": "V16.3.3", - "req_description": "Vérifiez que l'application enregistre les événements de sécurité définis dans la documentation et enregistre également les tentatives de contournement des contrôles de sécurité, tels que la validation des entrées, la logique métier et l'anti-automatisation.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.3", - "section_name": "Événements de sécurité", - "req_id": "V16.3.4", - "req_description": "Vérifiez que l’application enregistre les erreurs inattendues et les échecs de contrôle de sécurité tels que les échecs TLS du backend.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.4", - "section_name": "Protection des journaux", - "req_id": "V16.4.1", - "req_description": "Vérifiez que tous les composants de journalisation codent correctement les données pour empêcher l’injection de journaux.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.4", - "section_name": "Protection des journaux", - "req_id": "V16.4.2", - "req_description": "Vérifiez que les journaux sont protégés contre tout accès non autorisé et ne peuvent pas être modifiés.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.4", - "section_name": "Protection des journaux", - "req_id": "V16.4.3", - "req_description": "Vérifiez que les journaux sont transmis de manière sécurisée à un système logique distinct pour analyse, détection, alerte et remontée des informations. L'objectif est de garantir qu'en cas de violation de l'application, les journaux ne seront pas compromis.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.5", - "section_name": "Gestion des erreurs", - "req_id": "V16.5.1", - "req_description": "Vérifiez qu'un message générique est renvoyé au consommateur lorsqu'une erreur inattendue ou sensible à la sécurité se produit, garantissant ainsi l'absence d'exposition de données système internes sensibles telles que les traces de pile, les requêtes, les clés secrètes et les jetons.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.5", - "section_name": "Gestion des erreurs", - "req_id": "V16.5.2", - "req_description": "Vérifiez que l'application continue de fonctionner en toute sécurité lorsque l'accès aux ressources externes échoue, par exemple, en utilisant des modèles tels que des disjoncteurs ou une dégradation progressive.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.5", - "section_name": "Gestion des erreurs", - "req_id": "V16.5.3", - "req_description": "Vérifiez que l'application échoue proprement et sécurisée, y compris lorsqu'une exception se produit, en évitant les accès en cas d'erreur telles que le traitement d'une transaction malgré les erreurs résultant de la logique de validation.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.5", - "section_name": "Gestion des erreurs", - "req_id": "V16.5.4", - "req_description": "Vérifiez qu'un gestionnaire d'erreurs de « dernier recours » est défini pour intercepter toutes les exceptions non gérées. Cela permet d'éviter la perte des informations d'erreur qui doivent être loguées dans les fichiers journaux et de garantir qu'une erreur ne paralyse pas l'ensemble du processus applicatif, entraînant une perte de disponibilité.", - "L": "3" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.1", - "section_name": "Serveur TURN", - "req_id": "V17.1.1", - "req_description": "Vérifiez que le service TURN (Traversal Using Relays around NAT) autorise uniquement l'accès aux adresses IP non réservées à des fins spécifiques (par exemple, réseaux internes, diffusion, bouclage). Notez que cela s'applique aux adresses IPv4 et IPv6.", - "L": "2" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.1", - "section_name": "Serveur TURN", - "req_id": "V17.1.2", - "req_description": "Vérifiez que le service Traversal Using Relays around NAT (TURN) n'est pas susceptible d'épuiser ses ressources lorsque des utilisateurs légitimes tentent d'ouvrir un grand nombre de ports sur le serveur TURN.", - "L": "3" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Média", - "req_id": "V17.2.1", - "req_description": "Vérifiez que la clé du certificat Datagram Transport Layer Security (DTLS) est gérée et protégée conformément à la politique documentée de gestion des clés cryptographiques.", - "L": "2" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Média", - "req_id": "V17.2.2", - "req_description": "Vérifiez que le serveur multimédia est configuré pour utiliser et prendre en charge les suites de chiffrement DTLS (Datagram Transport Layer Security) approuvées et un profil de protection sécurisé pour l'extension DTLS pour l'établissement de clés pour le protocole de transport en temps réel sécurisé (DTLS-SRTP).", - "L": "2" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Média", - "req_id": "V17.2.3", - "req_description": "Vérifiez que l'authentification SRTP (Secure Real-time Transport Protocol) est vérifiée sur le serveur multimédia pour empêcher les attaques par injection RTP (Real-time Transport Protocol) d'entraîner une condition de déni de service ou l'insertion de médias audio ou vidéo dans les flux multimédias.", - "L": "2" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Média", - "req_id": "V17.2.4", - "req_description": "Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant lorsqu'il rencontre des paquets SRTP (Secure Real-time Transport Protocol) mal formés.", - "L": "2" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Média", - "req_id": "V17.2.5", - "req_description": "Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.", - "L": "3" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Média", - "req_id": "V17.2.6", - "req_description": "Vérifiez que le serveur multimédia n'est pas sensible à la vulnérabilité de condition de concurrence « ClientHello » dans Datagram Transport Layer Security (DTLS) en vérifiant si le serveur multimédia est publiquement connu comme étant vulnérable ou en effectuant le test de condition de concurrence.", - "L": "3" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Média", - "req_id": "V17.2.7", - "req_description": "Vérifiez que tous les mécanismes d'enregistrement audio ou vidéo associés au serveur multimédia sont en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.", - "L": "3" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Média", - "req_id": "V17.2.8", - "req_description": "Vérifiez que le certificat Datagram Transport Layer Security (DTLS) est vérifié par rapport à l'attribut d'empreinte cryptographique du protocole de description de session (SDP), en mettant fin au flux multimédia si la vérification échoue, pour garantir l'authenticité du flux multimédia.", - "L": "3" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.3", - "section_name": "Signalisation", - "req_id": "V17.3.1", - "req_description": "Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation entrants légitimes lors d'une attaque par saturation. Cela peut être réalisé en implémentant une limitation de débit au niveau de la signalisation.", - "L": "2" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.3", - "section_name": "Signalisation", - "req_id": "V17.3.2", - "req_description": "Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation légitimes en cas de message mal formé susceptible de provoquer un déni de service. Cela peut inclure la validation des entrées, la gestion sécurisée des dépassements d'entiers, la prévention des dépassements de tampon et l'utilisation d'autres techniques robustes de gestion des erreurs.", - "L": "2" - } - ] -} diff --git a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.flat.legacy.json b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.flat.legacy.json deleted file mode 100644 index da3d145c8e..0000000000 --- a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.flat.legacy.json +++ /dev/null @@ -1,4489 +0,0 @@ -{ - "requirements": [ - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.1", - "section_name": "Architecture d'encodage et de nettoyage", - "req_id": "V1.1.1", - "req_description": "Vérifiez que l'entrée est décodée ou non échappée vers une forme canonique une seule fois, elle n'est décodée que lorsque des données codées sous cette forme sont attendues, et que cela est fait avant de traiter davantage l'entrée, par exemple, elle n'est pas effectuée après la validation ou la désinfection de l'entrée.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.1", - "section_name": "Architecture d'encodage et de nettoyage", - "req_id": "V1.1.2", - "req_description": "Vérifiez que l'application effectue l'encodage et l'échappement de sortie soit comme étape finale avant d'être utilisée par l'interpréteur pour lequel elle est destinée, soit par l'interpréteur lui-même.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.2", - "section_name": "Prévention des injections", - "req_id": "V1.2.1", - "req_description": "Vérifiez que l'encodage de sortie d'une réponse HTTP, d'un document HTML ou d'un document XML est pertinent pour le contexte requis, comme l'encodage des caractères pertinents pour les éléments HTML, les attributs HTML, les commentaires HTML, les CSS ou les champs d'en-tête HTTP, pour éviter de modifier la structure du message ou du document.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.2", - "section_name": "Prévention des injections", - "req_id": "V1.2.2", - "req_description": "Vérifiez que, lors de la création dynamique d'URL, les données non fiables sont encodées en fonction de leur contexte (par exemple, encodage d'URL ou encodage base64url pour les paramètres de requête ou de chemin). Assurez-vous que seuls les schémas d'URL sûrs sont autorisés (par exemple, interdire javascript: ou data:).", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.2", - "section_name": "Prévention des injections", - "req_id": "V1.2.3", - "req_description": "Vérifiez que l'encodage ou l'échappement de sortie est utilisé lors de la création dynamique de contenu JavaScript (y compris JSON), pour éviter de modifier la structure du message ou du document (pour éviter l'injection JavaScript et JSON).", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.2", - "section_name": "Prévention des injections", - "req_id": "V1.2.4", - "req_description": "Vérifiez que la sélection de données ou les requêtes de base de données (par exemple, SQL, HQL, NoSQL, Cypher) utilisent des requêtes paramétrées, des ORM, des Framework d'entités ou sont protégées contre les injections SQL et autres attaques par injection de base de données. Ceci est également pertinent lors de l'écriture de procédures stockées.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.2", - "section_name": "Prévention des injections", - "req_id": "V1.2.5", - "req_description": "Vérifiez que l’application protège contre l’injection de commandes du système d’exploitation et que les appels du système d’exploitation utilisent des requêtes du système d’exploitation paramétrées ou utilisent un encodage de sortie de ligne de commande contextuelle.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.2", - "section_name": "Prévention des injections", - "req_id": "V1.2.6", - "req_description": "Vérifiez que l’application protège contre les vulnérabilités d’injection LDAP ou que des contrôles de sécurité spécifiques pour empêcher l’injection LDAP ont été mis en œuvre.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.2", - "section_name": "Prévention des injections", - "req_id": "V1.2.7", - "req_description": "Vérifiez que l’application est protégée contre les attaques par injection XPath en utilisant la paramétrisation des requêtes ou des requêtes précompilées.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.2", - "section_name": "Prévention des injections", - "req_id": "V1.2.8", - "req_description": "Vérifiez que les processeurs LaTeX sont configurés de manière sécurisée (par exemple, en n'utilisant pas l'indicateur « --shell-escape ») et qu'une liste d’autorisations de commandes est utilisée pour empêcher les attaques par injection LaTeX.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.2", - "section_name": "Prévention des injections", - "req_id": "V1.2.9", - "req_description": "Vérifiez que l'application échappe les caractères spéciaux dans les expressions régulières (généralement à l'aide d'une barre oblique inverse) pour éviter qu'ils ne soient mal interprétés comme des métacaractères.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.2", - "section_name": "Prévention des injections", - "req_id": "V1.2.10", - "req_description": "Vérifiez que l'application est protégée contre les injections CSV et injections de formules. L'application doit respecter les règles d'échappement définies dans les sections 2.6 et 2.7 de la RFC 4180 lors de l'export de contenu CSV. De plus, lors de l'export au format CSV ou vers d'autres formats de tableur (tels que XLS, XLSX ou ODF), les caractères spéciaux (notamment « = », « + », « - », « @ », « \\t » (tabulation) et « \\0 » (caractère null)) doivent être protégés par une apostrophe s'ils apparaissent en premier dans une valeur de champ.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.3", - "section_name": "Nettoyage", - "req_id": "V1.3.1", - "req_description": "Vérifiez que toutes les entrées HTML non fiables provenant d'éditeurs WYSIWYG ou similaires sont nettoyées à l'aide d'une bibliothèque ou d'une fonctionnalité de Framework de nettoyage HTML bien connue et sécurisée.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.3", - "section_name": "Nettoyage", - "req_id": "V1.3.2", - "req_description": "Vérifiez que l'application évite d'utiliser eval() ou d'autres fonctionnalités d'exécution de code dynamique telles que Spring Expression Language (SpEL). En l'absence d'alternative, toute saisie utilisateur incluse doit être nettoyée avant d'être exécutée.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.3", - "section_name": "Nettoyage", - "req_id": "V1.3.3", - "req_description": "Vérifiez que les données transmises à un contexte potentiellement dangereux sont préalablement nettoyées pour appliquer des mesures de sécurité, telles qu'autoriser uniquement des caractères sûrs pour ce contexte et raccourcir des entrées trop longues.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.3", - "section_name": "Nettoyage", - "req_id": "V1.3.4", - "req_description": "Vérifiez que le contenu Scalable Vector Graphics (SVG) scriptable fourni par l'utilisateur est validé ou nettoyé pour contenir uniquement des balises et des attributs (tels que des graphiques de dessin) qui sont sûrs pour l'application, par exemple, ne contiennent pas de scripts et d'objets étrangers.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.3", - "section_name": "Nettoyage", - "req_id": "V1.3.5", - "req_description": "Vérifiez que l'application nettoie ou désactive le contenu du langage de modèle d'expression ou de script fourni par l'utilisateur, tel que les feuilles de style CSS, le Markdown ou XSL, BBCode ou similaire.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.3", - "section_name": "Nettoyage", - "req_id": "V1.3.6", - "req_description": "Vérifiez que l'application protège contre les attaques de falsification de requête côté serveur (SSRF), en validant les données non fiables par rapport à une liste d'autorisation de protocoles, de domaines, de chemins et de ports et en nettoyant les caractères potentiellement dangereux avant d'utiliser les données pour appeler un autre service.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.3", - "section_name": "Nettoyage", - "req_id": "V1.3.7", - "req_description": "Vérifiez que l'application se protège contre les attaques par injection de modèles en interdisant la création de modèles basés sur des entrées non fiables. En l'absence d'alternative, toute entrée non fiable incluse dynamiquement lors de la création du modèle doit être nettoyée ou rigoureusement validée.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.3", - "section_name": "Nettoyage", - "req_id": "V1.3.8", - "req_description": "Vérifiez que l’application nettoie correctement les entrées non fiables avant utilisation dans les requêtes Java Naming and Directory Interface (JNDI) et que JNDI est configuré de manière sécurisée pour empêcher les attaques par injection JNDI.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.3", - "section_name": "Nettoyage", - "req_id": "V1.3.9", - "req_description": "Vérifiez que l’application nettoie le contenu avant qu’il ne soit envoyé à memcache pour éviter les attaques par injection.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.3", - "section_name": "Nettoyage", - "req_id": "V1.3.10", - "req_description": "Vérifiez que les chaînes de format susceptibles d'être résolues de manière inattendue ou malveillante lors de leur utilisation sont nettoyées avant d'être traitées.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.3", - "section_name": "Nettoyage", - "req_id": "V1.3.11", - "req_description": "Vérifiez que l'application nettoie les entrées utilisateur avant de les transmettre aux systèmes de messagerie pour se protéger contre l'injection SMTP ou IMAP.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.3", - "section_name": "Nettoyage", - "req_id": "V1.3.12", - "req_description": "Vérifiez que les expressions régulières sont exemptes d'éléments provoquant \"backtracking\" exponentiel et assurez-vous que les entrées non fiables sont nettoyées pour atténuer les attaques ReDoS ou Runaway Regex.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.4", - "section_name": "Mémoire, chaine de caractères et code à mémoire non-managée", - "req_id": "V1.4.1", - "req_description": "Vérifiez que l'application utilise des chaînes memory-safe, une copie de mémoire et une arithmétique de pointeur renforcée pour détecter ou empêcher les débordements de pile, de tampon ou de tas.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.4", - "section_name": "Mémoire, chaine de caractères et code à mémoire non-managée", - "req_id": "V1.4.2", - "req_description": "Vérifiez que les techniques de validation du signe, de la plage et de l’entrée sont utilisées pour éviter les dépassements d’entiers.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.4", - "section_name": "Mémoire, chaine de caractères et code à mémoire non-managée", - "req_id": "V1.4.3", - "req_description": "Vérifiez que la mémoire et les ressources allouées dynamiquement sont libérées et que les références ou les pointeurs vers la mémoire libérée sont supprimés ou définis à null pour éviter les \"dangling pointer\" et les vulnérabilités d'utilisation après libération.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.5", - "section_name": "Désérialisation sécurisée", - "req_id": "V1.5.1", - "req_description": "Vérifiez que l'application configure les \"parser\" XML pour utiliser une configuration restrictive et que les fonctionnalités non sûres telles que la résolution d'entités externes sont désactivées pour empêcher les attaques XML eXternal Entity (XXE).", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.5", - "section_name": "Désérialisation sécurisée", - "req_id": "V1.5.2", - "req_description": "Vérifiez que la désérialisation des données non fiables garantit une gestion sécurisée des entrées, par exemple en utilisant une liste d'autorisation de types d'objets ou en limitant les types d'objets définis par le client, afin d'empêcher les attaques par désérialisation. Les mécanismes de désérialisation explicitement définis comme non sécurisés ne doivent pas être utilisés avec des entrées non fiables.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Encodage et nettoyage", - "section_id": "V1.5", - "section_name": "Désérialisation sécurisée", - "req_id": "V1.5.3", - "req_description": "Vérifiez que les différents \"parser\" utilisés dans l'application pour le même type de données (par exemple, les \"parser\" JSON, les \"parser\" XML, les \"parser\" d'URL) effectuent l'analyse de manière cohérente et utilisent le même mécanisme d'encodage de caractères pour éviter des problèmes tels que les vulnérabilités d'interopérabilité JSON ou un comportement d'analyse d'URI ou de fichier différent exploité dans les attaques d'inclusion de fichiers à distance (RFI) ou de falsification de requête côté serveur (SSRF).", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Validation et logique métier", - "section_id": "V2.1", - "section_name": "Validation et documentation de la logique métier", - "req_id": "V2.1.1", - "req_description": "Vérifiez que la documentation de l'application définit des règles de validation des entrées pour vérifier la validité des éléments de données par rapport à la structure attendue. Il peut s'agir de formats de données courants tels que des numéros de carte de crédit, des adresses e-mail ou des numéros de téléphone, ou d'un format de données interne.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Validation et logique métier", - "section_id": "V2.1", - "section_name": "Validation et documentation de la logique métier", - "req_id": "V2.1.2", - "req_description": "Vérifiez que la documentation de l'application définit comment valider la cohérence logique et contextuelle des éléments de données combinés, par exemple en vérifiant que la banlieue et le code postal correspondent.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Validation et logique métier", - "section_id": "V2.1", - "section_name": "Validation et documentation de la logique métier", - "req_id": "V2.1.3", - "req_description": "Vérifiez que les attentes en matière de limites et de validations de la logique métier sont documentées, y compris par utilisateur et globalement dans l'application.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Validation et logique métier", - "section_id": "V2.2", - "section_name": "Validation des entrées", - "req_id": "V2.2.1", - "req_description": "Vérifier que les entrées sont validées afin de respecter les attentes métier ou fonctionnelles. Cette validation doit être basée sur une liste de valeurs, de modèles et de plages autorisées, ou sur la comparaison des entrées avec une structure attendue et des limites logiques selon des règles prédéfinies. Pour le niveau 1, cette validation peut se concentrer sur les entrées utilisées pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau 2, elle doit s'appliquer à toutes les entrées.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Validation et logique métier", - "section_id": "V2.2", - "section_name": "Validation des entrées", - "req_id": "V2.2.2", - "req_description": "Vérifiez que l'application est conçue pour appliquer la validation des entrées au niveau d'une couche de service de confiance. Bien que la validation côté client améliore l'ergonomie et doit être encouragée, elle ne doit pas être considérée comme un contrôle de sécurité.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Validation et logique métier", - "section_id": "V2.2", - "section_name": "Validation des entrées", - "req_id": "V2.2.3", - "req_description": "Vérifiez que l’application garantit que les combinaisons d’éléments de données associés sont raisonnables selon les règles prédéfinies.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Validation et logique métier", - "section_id": "V2.3", - "section_name": "Sécurité de la logique métier", - "req_id": "V2.3.1", - "req_description": "Vérifiez que l’application traitera uniquement les flux de logique métier pour le même utilisateur dans l’ordre séquentiel attendu et sans sauter d’étapes.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Validation et logique métier", - "section_id": "V2.3", - "section_name": "Sécurité de la logique métier", - "req_id": "V2.3.2", - "req_description": "Vérifiez que les limites de la logique métier sont implémentées conformément à la documentation de l'application, afin d'éviter que des failles de la logique métier ne soient pas exploitées.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Validation et logique métier", - "section_id": "V2.3", - "section_name": "Sécurité de la logique métier", - "req_id": "V2.3.3", - "req_description": "Vérifiez que les transactions sont utilisées au niveau de la logique métier de telle sorte qu'une opération de logique métier réussisse dans son intégralité ou qu'elle soit restaurée à l'état correct précédent.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Validation et logique métier", - "section_id": "V2.3", - "section_name": "Sécurité de la logique métier", - "req_id": "V2.3.4", - "req_description": "Vérifiez que les mécanismes de verrouillage au niveau de la logique métier sont utilisés pour garantir que les ressources en quantité limitée (telles que les sièges de théâtre ou les créneaux de livraison) ne peuvent pas être réservées deux fois en manipulant la logique de l'application.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Validation et logique métier", - "section_id": "V2.3", - "section_name": "Sécurité de la logique métier", - "req_id": "V2.3.5", - "req_description": "Vérifiez que les flux logiques métier à forte valeur ajoutée nécessitent l'approbation de plusieurs utilisateurs afin d'éviter toute action non autorisée ou accidentelle. Cela peut inclure, sans s'y limiter, les transferts monétaires importants, les approbations de contrats, l'accès à des informations classifiées ou les contournements de sécurité dans le secteur manufacturier.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Validation et logique métier", - "section_id": "V2.4", - "section_name": "Anti-automatisation", - "req_id": "V2.4.1", - "req_description": "Vérifiez que des contrôles anti-automatisation sont en place pour protéger contre les appels excessifs aux fonctions d'application qui pourraient conduire à l'exfiltration de données, à la création de données inutiles, à l'épuisement des quotas, aux violations de limites de débit, au déni de service ou à la surutilisation de ressources coûteuses.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Validation et logique métier", - "section_id": "V2.4", - "section_name": "Anti-automatisation", - "req_id": "V2.4.2", - "req_description": "Vérifiez que les flux logiques métier nécessitent un timing humain réaliste, évitant ainsi des soumissions de transactions excessivement rapides.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.1", - "section_name": "Documentation sur la sécurité du frontend Web", - "req_id": "V3.1.1", - "req_description": "Vérifiez que la documentation de l'application indique les fonctionnalités de sécurité attendues que les navigateurs utilisant l'application doivent prendre en charge (telles que HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) et autres mécanismes de sécurité HTTP pertinents). Elle doit également définir le comportement de l'application lorsque certaines de ces fonctionnalités ne sont pas disponibles (par exemple, avertir l'utilisateur ou bloquer l'accès).", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.2", - "section_name": "Interprétation non intentionnelle du contenu", - "req_id": "V3.2.1", - "req_description": "Vérifiez que des contrôles de sécurité sont en place pour empêcher les navigateurs d'afficher du contenu ou des fonctionnalités dans les réponses HTTP dans un contexte incorrect (par exemple, lorsqu'une API, un fichier téléchargé par l'utilisateur ou une autre ressource est demandée directement). Les contrôles possibles peuvent inclure : ne pas transmettre le contenu sauf si les champs d'en-tête de requête HTTP (tels que Sec-Fetch-\\*) indiquent qu'il s'agit du contexte correct, utiliser la directive sandbox du champ d'en-tête Content-Security-Policy ou utiliser le type de disposition de pièce jointe dans le champ d'en-tête Content-Disposition.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.2", - "section_name": "Interprétation non intentionnelle du contenu", - "req_id": "V3.2.2", - "req_description": "Vérifiez que le contenu destiné à être affiché sous forme de texte, plutôt que rendu sous forme de HTML, est géré à l'aide de fonctions de rendu sécurisées (telles que createTextNode ou textContent) pour empêcher l'exécution involontaire de contenu tel que HTML ou JavaScript.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.2", - "section_name": "Interprétation non intentionnelle du contenu", - "req_id": "V3.2.3", - "req_description": "Vérifiez que l'application évite l'écrasement du DOM lors de l'utilisation de JavaScript côté client en utilisant des déclarations de variables explicites, en effectuant une vérification de type stricte, en évitant de stocker des variables globales sur l'objet document et en implémentant l'isolation de l'espace de nommage.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.3", - "section_name": "Configuration des cookies", - "req_id": "V3.3.1", - "req_description": "Vérifiez que les cookies ont l'attribut « Secure » ​​défini et si le préfixe « \\__Host- » n'est pas utilisé pour le nom du cookie, le préfixe « __Secure- » doit être utilisé pour le nom du cookie.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.3", - "section_name": "Configuration des cookies", - "req_id": "V3.3.2", - "req_description": "Vérifiez que la valeur de l'attribut « SameSite » de chaque cookie est définie en fonction de l'objectif du cookie, afin de limiter l'exposition aux attaques de réparation de l'interface utilisateur et aux attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.3", - "section_name": "Configuration des cookies", - "req_id": "V3.3.3", - "req_description": "Vérifiez que les cookies ont le préfixe « __Host- » pour le nom du cookie, sauf s'ils sont explicitement conçus pour être partagés avec d'autres hôtes.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.3", - "section_name": "Configuration des cookies", - "req_id": "V3.3.4", - "req_description": "Vérifiez que si la valeur d'un cookie n'est pas censée être accessible aux scripts côté client (comme un jeton de session), le cookie doit avoir l'attribut « HttpOnly » défini et la même valeur (par exemple, un jeton de session) ne doit être transférée au client que via le champ d'en-tête « Set-Cookie ».", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.3", - "section_name": "Configuration des cookies", - "req_id": "V3.3.5", - "req_description": "Vérifiez que lorsque l'application écrit un cookie, la longueur combinée du nom et de la valeur du cookie ne dépasse pas 4 096 octets. Les cookies trop volumineux ne seront pas stockés par le navigateur et ne seront donc pas envoyés avec les requêtes, empêchant ainsi l'utilisateur d'utiliser les fonctionnalités de l'application qui reposent sur ce cookie.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.4", - "section_name": "En-têtes du mécanisme de sécurité du navigateur", - "req_id": "V3.4.1", - "req_description": "Vérifiez qu'un champ d'en-tête Strict-Transport-Security est inclus dans toutes les réponses afin d'appliquer une politique HTTP Strict Transport Security (HSTS). Une durée maximale d'au moins un an doit être définie, et pour les niveaux L2 et supérieurs, la politique doit également s'appliquer à tous les sous-domaines.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.4", - "section_name": "En-têtes du mécanisme de sécurité du navigateur", - "req_id": "V3.4.2", - "req_description": "Vérifiez que le champ d'en-tête Access-Control-Allow-Origin du partage de ressources cross-origine (CORS) est une valeur fixe de l'application ou, si la valeur du champ d'en-tête de requête HTTP Origin est utilisée, qu'elle est validée par rapport à une liste d'origines approuvées. Si « Access-Control-Allow-Origin: * » doit être utilisé, vérifiez que la réponse ne contient aucune information sensible.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.4", - "section_name": "En-têtes du mécanisme de sécurité du navigateur", - "req_id": "V3.4.3", - "req_description": "Vérifiez que les réponses HTTP incluent un champ d'en-tête de réponse Content-Security-Policy qui définit des directives garantissant que le navigateur charge et exécute uniquement du contenu ou des ressources fiables, afin de limiter l'exécution de JavaScript malveillant. Au minimum, une politique globale doit être utilisée, incluant les directives object-src 'none' et base-uri 'none', et définissant soit une lliste d’autorisations, soit des valeurs nonces ou des hachages. Pour une application L3, une politique par réponse avec des valeurs nonces ou des hachages doit être définie.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.4", - "section_name": "En-têtes du mécanisme de sécurité du navigateur", - "req_id": "V3.4.4", - "req_description": "Vérifiez que toutes les réponses HTTP contiennent un champ d'en-tête « X-Content-Type-Options: nosniff ». Cela indique aux navigateurs de ne pas utiliser l'analyse de contenu ni la détection du type MIME pour la réponse donnée, et d'exiger que la valeur du champ d'en-tête « Content-Type » de la réponse corresponde à la ressource de destination. Par exemple, la réponse à une demande de style n'est acceptée que si le type de contenu de la réponse est « text/css ». Cela permet également au navigateur d'utiliser la fonctionnalité de blocage de lecture inter-origines (CORB).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.4", - "section_name": "En-têtes du mécanisme de sécurité du navigateur", - "req_id": "V3.4.5", - "req_description": "Vérifiez que l'application définit une politique de référencement afin d'empêcher la fuite de données techniquement sensibles vers des services tiers via le champ d'en-tête de requête HTTP « Referer ». Cela peut être effectué via le champ d'en-tête de réponse HTTP « Referrer-Policy » ou via les attributs d'élément HTML. Les données sensibles peuvent inclure le chemin d'accès et les données de requête dans l'URL, et pour les applications internes non publiques, le nom d'hôte.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.4", - "section_name": "En-têtes du mécanisme de sécurité du navigateur", - "req_id": "V3.4.6", - "req_description": "Vérifiez que l'application Web utilise la directive frame-ancestors du champ d'en-tête Content-Security-Policy pour chaque réponse HTTP afin de garantir qu'elle ne peut pas être intégrée par défaut et que l'intégration de ressources spécifiques n'est autorisée qu'en cas de nécessité. Notez que le champ d'en-tête X-Frame-Options, bien que pris en charge par les navigateurs, est obsolète et n'est pas forcément fiable.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.4", - "section_name": "En-têtes du mécanisme de sécurité du navigateur", - "req_id": "V3.4.7", - "req_description": "Vérifiez que le champ d’en-tête Content-Security-Policy spécifie un emplacement pour signaler les violations.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.4", - "section_name": "En-têtes du mécanisme de sécurité du navigateur", - "req_id": "V3.4.8", - "req_description": "Vérifiez que toutes les réponses HTTP qui lancent le rendu d'un document (comme les réponses de type text/html) incluent le champ d'en-tête 'Cross-Origin-Opener-Policy' avec la directive 'same-origin' ou s'ame-origin-allow-popups', selon les besoins. Cela empêche les attaques abusant de l'accès partagé aux objets Window, telles que le tabnabbing et le comptage d'images.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.5", - "section_name": "Séparation de l'origine du navigateur", - "req_id": "V3.5.1", - "req_description": "Vérifiez que, si l'application ne s'appuie pas sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher les requêtes inter-origines non autorisées d'utiliser des fonctionnalités sensibles, ces requêtes sont validées afin de garantir leur origine. Cela peut se faire en utilisant et en validant des jetons anti-falsification ou en exigeant des champs d'en-tête HTTP supplémentaires qui ne sont pas des champs d'en-tête de requête CORS safelist. Ceci permet de se protéger contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.5", - "section_name": "Séparation de l'origine du navigateur", - "req_id": "V3.5.2", - "req_description": "Vérifiez que, si l'application s'appuie sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher l'utilisation inter-origines non autorisée de fonctionnalités sensibles, il est impossible d'appeler la fonctionnalité avec une requête qui ne déclenche pas de requête de pré-vérification cross-origin CORS. Cela peut nécessiter de vérifier les valeurs des champs d'en-tête de requête 'Origin' et 'Content-Type' ou d'utiliser un champ d'en-tête supplémentaire qui n'est pas un champ d'en-tête de la liste de sécurité CORS.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.5", - "section_name": "Séparation de l'origine du navigateur", - "req_id": "V3.5.3", - "req_description": "Vérifiez que les requêtes HTTP destinées aux fonctionnalités sensibles utilisent des méthodes HTTP appropriées, telles que POST, PUT, PATCH ou DELETE, et non des méthodes définies comme « sûres » par la spécification HTTP, telles que HEAD, OPTIONS ou GET. Une validation stricte des champs d'en-tête de requête Sec-Fetch-* peut également être utilisée pour garantir que la requête ne provient pas d'un appel inter-origines inapproprié, d'une requête de navigation ou d'un chargement de ressources (comme une source d'image) inattendu.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.5", - "section_name": "Séparation de l'origine du navigateur", - "req_id": "V3.5.4", - "req_description": "Vérifiez que des applications distinctes sont hébergées sur des noms d'hôte différents pour tirer parti des restrictions fournies par la politique de même origine, y compris la manière dont les documents ou scripts chargés par une origine peuvent interagir avec les ressources d'une autre origine et les restrictions basées sur le nom d'hôte sur les cookies.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.5", - "section_name": "Séparation de l'origine du navigateur", - "req_id": "V3.5.5", - "req_description": "Vérifiez que les messages reçus par l'interface postMessage sont rejetés si l'origine du message n'est pas digne de confiance ou si la syntaxe du message n'est pas valide.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.5", - "section_name": "Séparation de l'origine du navigateur", - "req_id": "V3.5.6", - "req_description": "Vérifiez que la fonctionnalité JSONP n'est activée nulle part dans l'application pour éviter les attaques Cross-Site Script Inclusion (XSSI).", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.5", - "section_name": "Séparation de l'origine du navigateur", - "req_id": "V3.5.7", - "req_description": "Vérifiez que les données nécessitant une autorisation ne sont pas incluses dans les réponses des ressources de script, comme les fichiers JavaScript, pour empêcher les attaques par inclusion de script intersite (XSSI).", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.5", - "section_name": "Séparation de l'origine du navigateur", - "req_id": "V3.5.8", - "req_description": "Vérifiez que les ressources authentifiées (telles que les images, les vidéos, les scripts et autres documents) peuvent être chargées ou intégrées pour le compte de l'utilisateur uniquement lorsque cela est prévu. Cela peut être réalisé en validant strictement les champs d'en-tête de requête HTTP Sec-Fetch-* afin de garantir que la requête ne provient pas d'un appel cross-origin inapproprié, ou en définissant un champ d'en-tête de réponse HTTP Cross-Origin-Resource-Policy restrictif pour indiquer au navigateur de bloquer le contenu renvoyé.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.6", - "section_name": "Intégrité des ressources externes", - "req_id": "V3.6.1", - "req_description": "Vérifiez que les ressources côté client, telles que les bibliothèques JavaScript, les feuilles de style CSS ou les polices web, sont hébergées en externe (par exemple, sur un réseau de diffusion de contenu) uniquement si la ressource est statique et versionnée, et si l'intégrité des sous-ressources (SRI) est utilisée pour valider l'intégrité de la ressource. Si cela n'est pas possible, une décision de sécurité documentée doit justifier cette décision pour chaque ressource.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.7", - "section_name": "Autres considérations sur la sécurité du navigateur", - "req_id": "V3.7.1", - "req_description": "Vérifiez que l'application utilise uniquement des technologies côté client toujours prises en charge et considérées comme sécurisées. Parmi les technologies qui ne répondent pas à cette exigence figurent les plugins NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL ou les applets Java côté client.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.7", - "section_name": "Autres considérations sur la sécurité du navigateur", - "req_id": "V3.7.2", - "req_description": "Vérifiez que l'application redirigera automatiquement l'utilisateur vers un nom d'hôte ou un domaine différent (qui n'est pas contrôlé par l'application) uniquement lorsque la destination apparaît sur une liste d'autorisation.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.7", - "section_name": "Autres considérations sur la sécurité du navigateur", - "req_id": "V3.7.3", - "req_description": "Vérifiez que le domaine de premier niveau de l'application (par exemple, site.tld) ​​est ajouté à la liste de préchargement publique pour HTTP Strict Transport Security (HSTS). Cela garantit que l'utilisation de TLS pour l'application est intégrée directement dans les principaux navigateurs, plutôt que de dépendre uniquement du champ d'en-tête de réponse Strict-Transport-Security.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.7", - "section_name": "Autres considérations sur la sécurité du navigateur", - "req_id": "V3.7.4", - "req_description": "Vérifiez que l'application affiche une notification lorsque l'utilisateur est redirigé vers une URL hors du contrôle de l'application, avec une option pour annuler la navigation.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Sécurité du frontend Web", - "section_id": "V3.7", - "section_name": "Autres considérations sur la sécurité du navigateur", - "req_id": "V3.7.5", - "req_description": "Vérifiez que l'application se comporte comme documenté (par exemple, en avertissant l'utilisateur ou en bloquant l'accès) si le navigateur utilisé pour accéder à l'application ne prend pas en charge les fonctionnalités de sécurité attendues.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API et service Web", - "section_id": "V4.1", - "section_name": "Sécurité du service Web générique", - "req_id": "V4.1.1", - "req_description": "Vérifiez que chaque réponse HTTP avec un corps de message contient un champ d'en-tête Content-Type qui correspond au contenu réel de la réponse, y compris le paramètre charset pour spécifier un codage de caractères sécurisé (par exemple, UTF-8, ISO-8859-1) conformément aux types de médias IANA, tels que « text/ », « /+xml » et « /xml ».", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API et service Web", - "section_id": "V4.1", - "section_name": "Sécurité du service Web générique", - "req_id": "V4.1.2", - "req_description": "Vérifiez que seuls les terminaux utilisateurs (destinés à l'accès manuel via un navigateur web) redirigent automatiquement de HTTP vers HTTPS, tandis que les autres services ou terminaux n'implémentent pas de redirections transparentes. Cela permet d'éviter qu'un client envoie par erreur des requêtes HTTP non chiffrées, mais que, comme ces requêtes sont automatiquement redirigées vers HTTPS, la fuite de données sensibles passe inaperçue.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API et service Web", - "section_id": "V4.1", - "section_name": "Sécurité du service Web générique", - "req_id": "V4.1.3", - "req_description": "Vérifiez que tout champ d'en-tête HTTP utilisé par l'application et défini par une couche intermédiaire, telle qu'un équilibreur de charge, un proxy web ou un service backend-for-frontend, ne peut pas être remplacé par l'utilisateur final. Les exemples d'en-têtes peuvent inclure X-Real-IP, X-Forwarded-*, ou X-User-ID.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API et service Web", - "section_id": "V4.1", - "section_name": "Sécurité du service Web générique", - "req_id": "V4.1.4", - "req_description": "Vérifiez que seules les méthodes HTTP explicitement prises en charge par l'application ou son API (y compris les OPTIONS lors des demandes de contrôle en amont) peuvent être utilisées et que les méthodes inutilisées sont bloquées.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API et service Web", - "section_id": "V4.1", - "section_name": "Sécurité du service Web générique", - "req_id": "V4.1.5", - "req_description": "Vérifier que les signatures numériques par message sont utilisées pour fournir une assurance supplémentaire en plus des protections de transport pour les demandes ou les transactions qui sont très sensibles ou qui traversent un certain nombre de systèmes.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API et service Web", - "section_id": "V4.2", - "section_name": "Validation de la structure des messages HTTP", - "req_id": "V4.2.1", - "req_description": "Vérifiez que tous les composants de l'application (y compris les équilibreurs de charge, les pares-feux et les serveurs d'applications) déterminent les limites des messages HTTP entrants à l'aide du mécanisme approprié à la version HTTP afin d'empêcher la contrebande de requêtes HTTP. Dans HTTP/1.x, si un champ d'en-tête Transfer-Encoding est présent, l'en-tête Content-Length doit être ignoré conformément à la RFC 2616. Avec HTTP/2 ou HTTP/3, si un champ d'en-tête Content-Length est présent, le récepteur doit s'assurer qu'il est cohérent avec la longueur des trames DATA.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API et service Web", - "section_id": "V4.2", - "section_name": "Validation de la structure des messages HTTP", - "req_id": "V4.2.2", - "req_description": "Vérifier que, lors de la génération de messages HTTP, le champ d'en-tête Content-Length n'entre pas en conflit avec la longueur du contenu déterminée par le cadrage du protocole HTTP, afin d'empêcher les attaques de type « request smuggling ».", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API et service Web", - "section_id": "V4.2", - "section_name": "Validation de la structure des messages HTTP", - "req_id": "V4.2.3", - "req_description": "Vérifiez que l'application n'envoie ni n'accepte de messages HTTP/2 ou HTTP/3 avec des champs d'en-tête spécifiques à la connexion, tels que Transfer-Encoding, afin d'éviter les attaques par fractionnement de la réponse et par injection d'en-tête.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API et service Web", - "section_id": "V4.2", - "section_name": "Validation de la structure des messages HTTP", - "req_id": "V4.2.4", - "req_description": "Vérifiez que l'application n'accepte que les requêtes HTTP/2 et HTTP/3 dont les champs et valeurs d'en-tête ne contiennent pas de séquences CR (\\r), LF (\\n) ou CRLF (\\r\\n), afin d'éviter les attaques par injection d'en-tête.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API et service Web", - "section_id": "V4.2", - "section_name": "Validation de la structure des messages HTTP", - "req_id": "V4.2.5", - "req_description": "Vérifiez que, si l'application (backend ou frontend) construit et envoie des requêtes, elle utilise des mécanismes de validation, d'assainissement ou autres pour éviter de créer des URI (comme pour les appels API) ou des champs d'en-tête de requête HTTP (comme Authorization ou Cookie) qui sont trop longs pour être acceptés par le composant récepteur. Cela pourrait entraîner un déni de service, par exemple lors de l'envoi d'une requête trop longue (par exemple, un long champ d'en-tête de cookie), ce qui fait que le serveur répond toujours avec un statut d'erreur.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API et service Web", - "section_id": "V4.3", - "section_name": "GraphQL", - "req_id": "V4.3.1", - "req_description": "Vérifiez qu'une liste d'autorisation de requête, une limitation de profondeur, une limitation de quantité ou une analyse des coûts de requête est utilisée pour empêcher le déni de service (DoS) de GraphQL ou d'expression de la couche données en raison de requêtes imbriquées coûteuses.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API et service Web", - "section_id": "V4.3", - "section_name": "GraphQL", - "req_id": "V4.3.2", - "req_description": "Vérifiez que les requêtes d’introspection GraphQL sont désactivées dans l’environnement de production, sauf si l’API GraphQL est destinée à être utilisée par d’autres parties.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API et service Web", - "section_id": "V4.4", - "section_name": "WebSocket", - "req_id": "V4.4.1", - "req_description": "Vérifiez que WebSocket sur TLS (WSS) est utilisé pour toutes les connexions WebSocket.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API et service Web", - "section_id": "V4.4", - "section_name": "WebSocket", - "req_id": "V4.4.2", - "req_description": "Vérifiez que, lors de la négociation HTTP WebSocket initiale, le champ d’en-tête 'Origin' est vérifié par rapport à une liste d’origines autorisées pour l’application.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API et service Web", - "section_id": "V4.4", - "section_name": "WebSocket", - "req_id": "V4.4.3", - "req_description": "Vérifiez que, si la gestion de session standard de l'application ne peut pas être utilisée, des jetons dédiés sont utilisés à cet effet, qui sont conformes aux exigences de sécurité de gestion de session pertinentes.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API et service Web", - "section_id": "V4.4", - "section_name": "WebSocket", - "req_id": "V4.4.4", - "req_description": "Vérifiez que les jetons de gestion de session WebSocket dédiés sont initialement obtenus ou validés via la session HTTPS précédemment authentifiée lors de la transition d'une session HTTPS existante vers un canal WebSocket.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Gestion des fichiers", - "section_id": "V5.1", - "section_name": "Documentation sur la gestion des fichiers", - "req_id": "V5.1.1", - "req_description": "Vérifiez que la documentation définit les types de fichiers autorisés, les extensions de fichiers attendues et la taille maximale (y compris la taille décompressée) pour chaque fonctionnalité de Téléversement. De plus, assurez-vous que la documentation précise comment les fichiers sont sécurisés pour le téléchargement et le traitement des utilisateurs finaux, par exemple le comportement de l'application lorsqu'un fichier malveillant est détecté.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Gestion des fichiers", - "section_id": "V5.2", - "section_name": "Téléversement de fichiers et contenu", - "req_id": "V5.2.1", - "req_description": "Vérifiez que l'application n'acceptera que des fichiers d'une taille qu'elle peut traiter sans provoquer de perte de performances ou d'attaque par déni de service.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Gestion des fichiers", - "section_id": "V5.2", - "section_name": "Téléversement de fichiers et contenu", - "req_id": "V5.2.2", - "req_description": "Vérifiez que lorsque l'application accepte un fichier, seul ou dans une archive telle qu'un fichier zip, elle vérifie si l'extension de fichier correspond à une extension attendue et que le contenu correspond au type représenté par l'extension. Cela inclut, sans s'y limiter, la vérification des « octets magiques » initiaux, la réécriture d'images et l'utilisation de bibliothèques spécialisées pour la validation du contenu des fichiers. Pour le niveau L1, cela peut se concentrer uniquement sur les fichiers utilisés pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau L2, cela doit s'appliquer à tous les fichiers acceptés.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Gestion des fichiers", - "section_id": "V5.2", - "section_name": "Téléversement de fichiers et contenu", - "req_id": "V5.2.3", - "req_description": "Vérifiez que l'application vérifie les fichiers compressés (par exemple, zip, gz, docx, odt) par rapport à la taille maximale autorisée non compressée et au nombre maximal de fichiers avant de décompresser le fichier.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Gestion des fichiers", - "section_id": "V5.2", - "section_name": "Téléversement de fichiers et contenu", - "req_id": "V5.2.4", - "req_description": "Vérifiez qu'un quota de taille de fichier et un nombre maximal de fichiers par utilisateur sont appliqués pour garantir qu'un seul utilisateur ne puisse pas remplir le stockage avec trop de fichiers ou des fichiers excessivement volumineux.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Gestion des fichiers", - "section_id": "V5.2", - "section_name": "Téléversement de fichiers et contenu", - "req_id": "V5.2.5", - "req_description": "Vérifiez que l'application n'autorise pas le téléversement de fichiers compressés contenant des liens symboliques, sauf si cela est spécifiquement requis (auquel cas il sera nécessaire d'appliquer une liste d'autorisation des fichiers vers lesquels il est possible de créer des liens symboliques).", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Gestion des fichiers", - "section_id": "V5.2", - "section_name": "Téléversement de fichiers et contenu", - "req_id": "V5.2.6", - "req_description": "Vérifiez que l'application rejette les images téléversées avec une taille de pixel supérieure au maximum autorisé, afin d'éviter les attaques par inondation de pixels.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Gestion des fichiers", - "section_id": "V5.3", - "section_name": "Stockage de fichiers", - "req_id": "V5.3.1", - "req_description": "Vérifiez que les fichiers téléversés ou générés par une entrée non fiable et stockés dans un dossier public ne sont pas exécutés en tant que code de programme côté serveur lorsqu'ils sont accessibles directement avec une requête HTTP.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Gestion des fichiers", - "section_id": "V5.3", - "section_name": "Stockage de fichiers", - "req_id": "V5.3.2", - "req_description": "Vérifiez que lorsque l'application crée des chemins d'accès pour les opérations sur les fichiers, elle utilise des données générées en interne ou fiables plutôt que des noms de fichiers soumis par l'utilisateur. Si des noms de fichiers ou des métadonnées de fichiers soumis par l'utilisateur doivent être utilisés, une validation et un nettoyage stricts doivent être appliqués. Ceci permet de se protéger contre les attaques par traversée de chemin, l'inclusion de fichiers locaux ou distants (LFI, RFI) et la falsification de requêtes côté serveur (SSRF).", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Gestion des fichiers", - "section_id": "V5.3", - "section_name": "Stockage de fichiers", - "req_id": "V5.3.3", - "req_description": "Vérifiez que le traitement des fichiers côté serveur, comme la décompression des fichiers, ignore les informations de chemin fournies par l'utilisateur pour éviter les vulnérabilités telles que le \"zip slip\".", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Gestion des fichiers", - "section_id": "V5.4", - "section_name": "Téléchargement de fichier", - "req_id": "V5.4.1", - "req_description": "Vérifiez que l’application valide ou ignore les noms de fichiers soumis par l’utilisateur, y compris dans un paramètre JSON, JSONP ou URL et spécifie un nom de fichier dans le champ d’en-tête Content-Disposition de la réponse.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Gestion des fichiers", - "section_id": "V5.4", - "section_name": "Téléchargement de fichier", - "req_id": "V5.4.2", - "req_description": "Vérifiez que les noms de fichiers servis (par exemple, dans les champs d'en-tête de réponse HTTP ou les pièces jointes aux e-mails) sont encodés ou nettoyés (par exemple, conformément à la RFC 6266) pour préserver la structure du document et empêcher les attaques par injection.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Gestion des fichiers", - "section_id": "V5.4", - "section_name": "Téléchargement de fichier", - "req_id": "V5.4.3", - "req_description": "Vérifiez que les fichiers obtenus à partir de sources non fiables sont analysés par des scanners antivirus pour empêcher la diffusion de contenu malveillant connu.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.1", - "section_name": "Documentation d'authentification", - "req_id": "V6.1.1", - "req_description": "Vérifiez que la documentation de l'application définit comment les contrôles, tels que la limitation de débit, l'anti-automatisation et la réponse adaptative, sont utilisés pour se défendre contre les attaques telles que le « credential stuffing » et la force brute des mots de passe. La documentation doit expliquer clairement comment ces contrôles sont configurés et empêcher le blocage malveillant des comptes.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.1", - "section_name": "Documentation d'authentification", - "req_id": "V6.1.2", - "req_description": "Vérifiez qu'une liste de mots spécifiques au contexte est documentée afin d'empêcher leur utilisation dans les mots de passe. Cette liste peut inclure des permutations de noms d'organisations, de produits, d'identifiants de systèmes, de noms de codes de projets, de noms de services ou de rôles, etc.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.1", - "section_name": "Documentation d'authentification", - "req_id": "V6.1.3", - "req_description": "Vérifiez que, si l'application inclut plusieurs voies d'authentification, celles-ci sont toutes documentées avec les contrôles de sécurité et la force d'authentification qui doivent être appliqués de manière cohérente.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.2", - "section_name": "Sécurité des mots de passe", - "req_id": "V6.2.1", - "req_description": "Vérifiez que les mots de passe définis par l'utilisateur comportent au moins 8 caractères, bien qu'un minimum de 15 caractères soit fortement recommandé.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.2", - "section_name": "Sécurité des mots de passe", - "req_id": "V6.2.2", - "req_description": "Vérifiez que les utilisateurs peuvent modifier leur mot de passe.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.2", - "section_name": "Sécurité des mots de passe", - "req_id": "V6.2.3", - "req_description": "Vérifiez que la fonctionnalité de changement de mot de passe nécessite le mot de passe actuel et le nouveau mot de passe de l'utilisateur.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.2", - "section_name": "Sécurité des mots de passe", - "req_id": "V6.2.4", - "req_description": "Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou du changement de mot de passe sont vérifiés par rapport à un ensemble disponible d'au moins 3 000 mots de passe principaux qui correspondent à la politique de mot de passe de l'application, par exemple la longueur minimale.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.2", - "section_name": "Sécurité des mots de passe", - "req_id": "V6.2.5", - "req_description": "Vérifiez que les mots de passe peuvent être utilisés, quelle que soit leur composition, sans restriction quant au type de caractères autorisés. Aucun nombre minimal de majuscules ou de minuscules, de chiffres ou de caractères spéciaux ne doit être exigé.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.2", - "section_name": "Sécurité des mots de passe", - "req_id": "V6.2.6", - "req_description": "Vérifiez que les champs de saisie du mot de passe utilisent type=password pour masquer la saisie. Les applications peuvent permettre à l'utilisateur d'afficher temporairement l'intégralité du mot de passe masqué ou le dernier caractère saisi.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.2", - "section_name": "Sécurité des mots de passe", - "req_id": "V6.2.7", - "req_description": "Vérifiez que la fonctionnalité « coller », les assistants de mot de passe du navigateur et les gestionnaires de mots de passe externes sont autorisés.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.2", - "section_name": "Sécurité des mots de passe", - "req_id": "V6.2.8", - "req_description": "Vérifiez que l'application vérifie le mot de passe de l'utilisateur exactement tel qu'il a été reçu de l'utilisateur, sans aucune modification telle qu'une troncature ou une transformation de casse.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.2", - "section_name": "Sécurité des mots de passe", - "req_id": "V6.2.9", - "req_description": "Vérifiez que les mots de passe d’au moins 64 caractères sont autorisés.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.2", - "section_name": "Sécurité des mots de passe", - "req_id": "V6.2.10", - "req_description": "Vérifiez que le mot de passe d'un utilisateur reste valide jusqu'à ce qu'il soit découvert comme compromis ou qu'il soit renouvelé. L'application ne doit pas exiger de renouvellement périodique des identifiants.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.2", - "section_name": "Sécurité des mots de passe", - "req_id": "V6.2.11", - "req_description": "Vérifiez que la liste documentée de mots spécifiques au contexte est utilisée pour éviter la création de mots de passe faciles à deviner.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.2", - "section_name": "Sécurité des mots de passe", - "req_id": "V6.2.12", - "req_description": "Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou des modifications de mot de passe sont vérifiés par rapport à un ensemble de mots de passe fuités.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.3", - "section_name": "Sécurité générale de l'authentification", - "req_id": "V6.3.1", - "req_description": "Vérifiez que les contrôles visant à empêcher les attaques telles que le bourrage d'informations d'identification et la force brute des mots de passe sont mis en œuvre conformément à la documentation de sécurité de l'application.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.3", - "section_name": "Sécurité générale de l'authentification", - "req_id": "V6.3.2", - "req_description": "Vérifiez que les comptes d’utilisateur par défaut (par exemple, « root », « admin » ou « sa ») ne sont pas présents dans l’application ou sont désactivés.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.3", - "section_name": "Sécurité générale de l'authentification", - "req_id": "V6.3.3", - "req_description": "Vérifiez que l’application exige que les utilisateurs utilisent un mécanisme d’authentification multifacteur ou une combinaison de mécanismes d’authentification à facteur unique.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.3", - "section_name": "Sécurité générale de l'authentification", - "req_id": "V6.3.4", - "req_description": "Vérifiez que, si l’application inclut plusieurs voies d’authentification, il n’existe aucune voie non documentée et que les contrôles de sécurité et la force d’authentification sont appliqués de manière cohérente.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.3", - "section_name": "Sécurité générale de l'authentification", - "req_id": "V6.3.5", - "req_description": "Vérifiez que les utilisateurs sont informés des tentatives d'authentification suspectes (réussies ou non). Il peut s'agir de tentatives d'authentification provenant d'un emplacement ou d'un client inhabituel, d'une authentification partiellement réussie (un seul facteur parmi plusieurs), d'une tentative d'authentification après une longue période d'inactivité ou d'une authentification réussie après plusieurs tentatives infructueuses.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.3", - "section_name": "Sécurité générale de l'authentification", - "req_id": "V6.3.6", - "req_description": "Vérifiez que le courrier électronique n’est pas utilisé comme mécanisme d’authentification à facteur unique ou à facteurs multiples.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.3", - "section_name": "Sécurité générale de l'authentification", - "req_id": "V6.3.7", - "req_description": "Vérifiez que les utilisateurs sont avertis après les mises à jour des détails d'authentification, telles que les réinitialisations d'informations d'identification ou la modification du nom d'utilisateur ou de l'adresse e-mail.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.3", - "section_name": "Sécurité générale de l'authentification", - "req_id": "V6.3.8", - "req_description": "Vérifiez que les utilisateurs valides ne peuvent pas être déduits d'échecs d'authentification, par exemple en se basant sur des messages d'erreur, des codes de réponse HTTP ou des temps de réponse différents. Les fonctionnalités d'inscription et de mot de passe oublié doivent également bénéficier de cette protection.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.4", - "section_name": "Cycle de vie et récupération du facteur d'authentification", - "req_id": "V6.4.1", - "req_description": "Vérifiez que les mots de passe initiaux ou les codes d'activation générés par le système sont générés de manière aléatoire et sécurisée, qu'ils respectent la politique de mots de passe en vigueur et qu'ils expirent après une courte période ou après leur première utilisation. Ces secrets initiaux ne doivent pas devenir des mots de passe permanents.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.4", - "section_name": "Cycle de vie et récupération du facteur d'authentification", - "req_id": "V6.4.2", - "req_description": "Vérifiez que les indices de mot de passe ou l'authentification basée sur les connaissances (appelées « questions secrètes ») ne sont pas présents.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.4", - "section_name": "Cycle de vie et récupération du facteur d'authentification", - "req_id": "V6.4.3", - "req_description": "Vérifiez qu'un processus sécurisé de réinitialisation d'un mot de passe oublié est mis en œuvre, qui ne contourne aucun mécanisme d'authentification multifacteur activé.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.4", - "section_name": "Cycle de vie et récupération du facteur d'authentification", - "req_id": "V6.4.4", - "req_description": "Vérifiez que si un facteur d'authentification multifacteur est perdu, la preuve de vérification d'identité est effectuée au même niveau que lors de l'inscription.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.4", - "section_name": "Cycle de vie et récupération du facteur d'authentification", - "req_id": "V6.4.5", - "req_description": "Vérifiez que les instructions de renouvellement des mécanismes d'authentification qui expirent sont envoyées avec suffisamment de temps pour être exécutées avant l'expiration de l'ancien mécanisme d'authentification, en configurant des rappels automatiques si nécessaire.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.4", - "section_name": "Cycle de vie et récupération du facteur d'authentification", - "req_id": "V6.4.6", - "req_description": "Vérifiez que les administrateurs peuvent initier la réinitialisation du mot de passe de l'utilisateur, mais que cela ne leur permet pas de modifier ou de choisir son mot de passe. Cela évite qu'ils ne connaissent le mot de passe de l'utilisateur.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.5", - "section_name": "Exigences générales en matière d'authentification multifacteur", - "req_id": "V6.5.1", - "req_description": "Vérifiez que les secrets de recherche, les demandes ou codes d'authentification out-of-band et les mots de passe à usage unique basés sur le temps (TOTP) ne peuvent être utilisés avec succès qu'une seule fois.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.5", - "section_name": "Exigences générales en matière d'authentification multifacteur", - "req_id": "V6.5.2", - "req_description": "Vérifiez que, lors de leur stockage dans le backend de l'application, les secrets de recherche comportant moins de 112 bits d'entropie (19 caractères alphanumériques aléatoires ou 34 chiffres aléatoires) sont hachés avec un algorithme de hachage de stockage de mots de passe approuvé, intégrant un sel aléatoire de 32 bits. Une fonction de hachage standard peut être utilisée si le secret comporte 112 bits d'entropie ou plus.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.5", - "section_name": "Exigences générales en matière d'authentification multifacteur", - "req_id": "V6.5.3", - "req_description": "Vérifiez que les secrets de recherche, le code d'authentification out-of-band et les mots de passe à usage unique basés sur le temps sont générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) pour éviter les valeurs prévisibles.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.5", - "section_name": "Exigences générales en matière d'authentification multifacteur", - "req_id": "V6.5.4", - "req_description": "Vérifiez que les secrets de recherche et les codes d'authentification out-of-band ont un minimum de 20 bits d'entropie (généralement 4 caractères alphanumériques aléatoires ou 6 chiffres aléatoires suffisent).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.5", - "section_name": "Exigences générales en matière d'authentification multifacteur", - "req_id": "V6.5.5", - "req_description": "Vérifiez que les requêtes, codes ou jetons d'authentification out-of-band, ainsi que les mots de passe à usage unique (TOTP), ont une durée de vie définie. Les requêtes out-of-band doivent avoir une durée de vie maximale de 10 minutes et les TOTP, de 30 secondes.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.5", - "section_name": "Exigences générales en matière d'authentification multifacteur", - "req_id": "V6.5.6", - "req_description": "Vérifiez que tout facteur d’authentification (y compris les appareils physiques) peut être révoqué en cas de vol ou autre perte.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.5", - "section_name": "Exigences générales en matière d'authentification multifacteur", - "req_id": "V6.5.7", - "req_description": "Vérifiez que les mécanismes d’authentification biométrique ne sont utilisés que comme facteurs secondaires, avec quelque chose que vous possédez ou quelque chose que vous savez.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.5", - "section_name": "Exigences générales en matière d'authentification multifacteur", - "req_id": "V6.5.8", - "req_description": "Vérifiez que les mots de passe à usage unique basés sur le temps (TOTP) sont vérifiés en fonction d'une source temporelle provenant d'un service de confiance et non d'une heure non fiable ou fournie par le client.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.6", - "section_name": "Mécanismes d'authentification out-of-band", - "req_id": "V6.6.1", - "req_description": "Vérifier que les mécanismes d'authentification utilisant le réseau téléphonique public commuté (RTPC) pour la transmission de mots de passe à usage unique (OTP) par téléphone ou SMS ne sont proposés que lorsque le numéro de téléphone a été préalablement validé. D'autres méthodes plus robustes (telles que les mots de passe à usage unique à durée déterminée) sont également proposées, et que le service informe les utilisateurs des risques de sécurité qu'elles présentent. Pour les applications de niveau 3, le téléphone et les SMS ne doivent pas être disponibles.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.6", - "section_name": "Mécanismes d'authentification out-of-band", - "req_id": "V6.6.2", - "req_description": "Vérifiez que les demandes d’authentification out-of-band, les codes ou les jetons sont liés à la demande d’authentification d’origine pour laquelle ils ont été générés et ne sont pas utilisables pour une demande précédente ou ultérieure.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.6", - "section_name": "Mécanismes d'authentification out-of-band", - "req_id": "V6.6.3", - "req_description": "Vérifiez qu'un mécanisme d'authentification out-of-band basé sur du code est protégé contre les attaques par force brute grâce au \"rate limiting\". Envisagez également d'utiliser un code avec au moins 64 bits d'entropie.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.6", - "section_name": "Mécanismes d'authentification out-of-band", - "req_id": "V6.6.4", - "req_description": "Vérifiez que, lorsque les notifications push sont utilisées pour l'authentification multifacteur, le \"rate limiting\" est appliqué afin d'empêcher les attaques de type « push bombing ». La concordance des numéros peut également atténuer ce risque.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.7", - "section_name": "Mécanisme d'authentification cryptographique", - "req_id": "V6.7.1", - "req_description": "Vérifiez que les certificats utilisés pour vérifier les assertions d’authentification cryptographique sont stockés de manière à les protéger contre toute modification.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.7", - "section_name": "Mécanisme d'authentification cryptographique", - "req_id": "V6.7.2", - "req_description": "Vérifiez que le nonce de défi a une longueur d'au moins 64 bits et qu'il est statistiquement unique ou unique sur toute la durée de vie du périphérique cryptographique.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.8", - "section_name": "Authentification avec un fournisseur d'identité", - "req_id": "V6.8.1", - "req_description": "Vérifiez que, si l'application prend en charge plusieurs fournisseurs d'identité (IdP), l'identité de l'utilisateur ne peut pas être usurpée via un autre fournisseur d'identité pris en charge (par exemple, en utilisant le même identifiant utilisateur). La mesure standard consisterait à ce que l'application enregistre et identifie l'utilisateur à l'aide d'une combinaison de l'ID du fournisseur d'identité (servant d'espace de noms) et de l'ID de l'utilisateur dans le fournisseur d'identité.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.8", - "section_name": "Authentification avec un fournisseur d'identité", - "req_id": "V6.8.2", - "req_description": "Vérifiez que la présence et l'intégrité des signatures numériques sur les assertions d'authentification (par exemple sur les assertions JWT ou SAML) sont toujours validées, en rejetant toutes les assertions non signées ou ayant des signatures non valides.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.8", - "section_name": "Authentification avec un fournisseur d'identité", - "req_id": "V6.8.3", - "req_description": "Vérifiez que les assertions SAML sont traitées de manière unique et utilisées une seule fois au cours de la période de validité pour éviter les attaques par rejeu.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Authentification", - "section_id": "V6.8", - "section_name": "Authentification avec un fournisseur d'identité", - "req_id": "V6.8.4", - "req_description": "Si une application utilise un fournisseur d'identité (IdP) distinct et attend une force, des méthodes ou une date d'authentification spécifiques pour des fonctions spécifiques, vérifiez que l'application les vérifie à l'aide des informations renvoyées par l'IdP. Par exemple, si OIDC est utilisé, cela peut être réalisé en validant les affirmations de jeton d'identification telles que « acr », « amr » et « auth_time » (le cas échéant). Si l'IdP ne fournit pas ces informations, l'application doit disposer d'une approche de secours documentée qui suppose que le mécanisme d'authentification de force minimale a été utilisé (par exemple, une authentification à facteur unique avec nom d'utilisateur et mot de passe).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.1", - "section_name": "Documentation sur la gestion des sessions", - "req_id": "V7.1.1", - "req_description": "Vérifiez que le délai d'inactivité de la session de l'utilisateur et la durée de vie maximale absolue de la session sont documentés, sont appropriés en combinaison avec d'autres contrôles et que la documentation inclut une justification de tout écart par rapport aux exigences de réauthentification NIST SP 800-63B.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.1", - "section_name": "Documentation sur la gestion des sessions", - "req_id": "V7.1.2", - "req_description": "Vérifiez que la documentation définit le nombre de sessions simultanées (parallèles) autorisées pour un compte ainsi que les comportements et actions prévus à entreprendre lorsque le nombre maximal de sessions actives est atteint.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.1", - "section_name": "Documentation sur la gestion des sessions", - "req_id": "V7.1.3", - "req_description": "Vérifiez que tous les systèmes qui créent et gèrent des sessions utilisateur dans le cadre d'un écosystème de gestion des identités fédérées (tels que les systèmes SSO) sont documentés avec des contrôles pour coordonner la durée de vie des sessions, la résiliation et toute autre condition nécessitant une réauthentification.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.2", - "section_name": "Sécurité fondamentale de la gestion des sessions", - "req_id": "V7.2.1", - "req_description": "Vérifiez que l’application effectue toutes les vérifications des jetons de session à l’aide d’un service backend de confiance.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.2", - "section_name": "Sécurité fondamentale de la gestion des sessions", - "req_id": "V7.2.2", - "req_description": "Vérifiez que l'application utilise des jetons autonomes ou de référence générés dynamiquement pour la gestion des sessions, c'est-à-dire sans utiliser de secrets et de clés d'API statiques.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.2", - "section_name": "Sécurité fondamentale de la gestion des sessions", - "req_id": "V7.2.3", - "req_description": "Vérifiez que si des jetons par référence sont utilisés pour représenter les sessions utilisateur, ils sont uniques et générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et possèdent au moins 128 bits d'entropie.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.2", - "section_name": "Sécurité fondamentale de la gestion des sessions", - "req_id": "V7.2.4", - "req_description": "Vérifiez que l’application génère un nouveau jeton de session lors de l’authentification de l’utilisateur, y compris la réauthentification, et met fin au jeton de session actuel.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.3", - "section_name": "Délai d'expiration de la session", - "req_id": "V7.3.1", - "req_description": "Vérifiez qu’il existe un délai d’inactivité tel que la réauthentification soit appliquée conformément à l’analyse des risques et aux décisions de sécurité documentées.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.3", - "section_name": "Délai d'expiration de la session", - "req_id": "V7.3.2", - "req_description": "Vérifiez qu'il existe une durée de vie maximale absolue de la session de sorte que la réauthentification soit appliquée conformément à l'analyse des risques et aux décisions de sécurité documentées.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.4", - "section_name": "Fin de session", - "req_id": "V7.4.1", - "req_description": "Vérifiez que lorsque la fin de session est déclenchée (par exemple, déconnexion ou expiration), l'application interdit toute utilisation ultérieure de la session. Pour les jetons par référence ou les sessions avec état, cela implique l'invalidation des données de session au niveau du backend de l'application. Les applications utilisant des jetons autonomes nécessiteront une solution, comme la gestion d'une liste des jetons terminés, l'interdiction des jetons produits avant une date et une heure spécifique à chaque utilisateur ou la rotation d'une clé de signature spécifique à chaque utilisateur.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.4", - "section_name": "Fin de session", - "req_id": "V7.4.2", - "req_description": "Vérifiez que l'application met fin à toutes les sessions actives lorsqu'un compte utilisateur est désactivé ou supprimé (par exemple, lorsqu'un employé quitte l'entreprise).", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.4", - "section_name": "Fin de session", - "req_id": "V7.4.3", - "req_description": "Vérifiez que l'application offre la possibilité de mettre fin à toutes les autres sessions actives après une modification ou une suppression réussie de tout facteur d'authentification (y compris la modification du mot de passe via une réinitialisation ou une récupération et, le cas échéant, une mise à jour des paramètres MFA).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.4", - "section_name": "Fin de session", - "req_id": "V7.4.4", - "req_description": "Vérifiez que toutes les pages nécessitant une authentification disposent d’un accès facile et visible à la fonctionnalité de déconnexion.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.4", - "section_name": "Fin de session", - "req_id": "V7.4.5", - "req_description": "Vérifiez que les administrateurs d’applications sont en mesure de mettre fin aux sessions actives pour un utilisateur individuel ou pour tous les utilisateurs.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.5", - "section_name": "Défenses contre les abus de session", - "req_id": "V7.5.1", - "req_description": "Vérifiez que l'application nécessite une réauthentification complète avant d'autoriser les modifications des attributs de compte sensibles qui peuvent affecter l'authentification, tels que l'adresse e-mail, le numéro de téléphone, la configuration MFA ou d'autres informations utilisées dans la récupération de compte.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.5", - "section_name": "Défenses contre les abus de session", - "req_id": "V7.5.2", - "req_description": "Vérifiez que les utilisateurs peuvent afficher et (après s'être authentifiés à nouveau avec au moins un facteur) terminer une ou toutes les sessions actuellement actives.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.5", - "section_name": "Défenses contre les abus de session", - "req_id": "V7.5.3", - "req_description": "Vérifiez que l’application nécessite une authentification supplémentaire avec au moins un facteur ou une vérification secondaire avant d’effectuer des transactions ou des opérations hautement sensibles.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.6", - "section_name": "Réauthentification fédérée", - "req_id": "V7.6.1", - "req_description": "Vérifiez que la durée de vie et la fin de la session entre les parties de confiance (RP) et les fournisseurs d'identité (IdP) se comportent comme documenté, en exigeant une réauthentification si nécessaire, par exemple lorsque le temps maximal entre les événements d'authentification IdP est atteint.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Gestion des sessions", - "section_id": "V7.6", - "section_name": "Réauthentification fédérée", - "req_id": "V7.6.2", - "req_description": "Vérifiez que la création d'une session nécessite soit le consentement de l'utilisateur, soit une action explicite, empêchant ainsi la création de nouvelles sessions d'application sans interaction de l'utilisateur.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Autorisation", - "section_id": "V8.1", - "section_name": "Documentation d'autorisation", - "req_id": "V8.1.1", - "req_description": "Vérifiez que la documentation d’autorisation définit des règles de restriction de l’accès au niveau de la fonction et aux données en fonction des autorisations du consommateur et des attributs des ressources.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Autorisation", - "section_id": "V8.1", - "section_name": "Documentation d'autorisation", - "req_id": "V8.1.2", - "req_description": "Vérifiez que la documentation d'autorisation définit les règles de restriction d'accès au niveau des champs (lecture et écriture) en fonction des autorisations des consommateurs et des attributs des ressources. Notez que ces règles peuvent dépendre d'autres valeurs d'attributs de l'objet de données concerné, telles que l'état ou le statut.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Autorisation", - "section_id": "V8.1", - "section_name": "Documentation d'autorisation", - "req_id": "V8.1.3", - "req_description": "Vérifiez que la documentation de l'application définit les attributs environnementaux et contextuels (y compris, mais sans s'y limiter, l'heure de la journée, l'emplacement de l'utilisateur, l'adresse IP ou l'appareil) qui sont utilisés dans l'application pour prendre des décisions de sécurité, y compris celles relatives à l'authentification et à l'autorisation.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Autorisation", - "section_id": "V8.1", - "section_name": "Documentation d'autorisation", - "req_id": "V8.1.4", - "req_description": "Vérifier que la documentation d'authentification et d'autorisation définit l'utilisation des facteurs environnementaux et contextuels dans la prise de décision, en plus des autorisations au niveau des fonctions, des données et des champs. Cela doit inclure les attributs évalués, les seuils de risque et les actions entreprises (par exemple, autorisation, contestation, refus, renforcement de l'authentification).", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Autorisation", - "section_id": "V8.2", - "section_name": "Conception d'autorisation générale", - "req_id": "V8.2.1", - "req_description": "Vérifiez que l’application garantit que l’accès basé sur la fonction est limité aux consommateurs disposant d’autorisations explicites.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Autorisation", - "section_id": "V8.2", - "section_name": "Conception d'autorisation générale", - "req_id": "V8.2.2", - "req_description": "Vérifiez que l'application garantit que l'accès spécifique aux données est limité aux consommateurs disposant d'autorisations explicites sur des éléments de données spécifiques afin d'atténuer les références d'objet directes non sécurisées (IDOR) et les autorisations de niveau d'objet rompues (BOLA).", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Autorisation", - "section_id": "V8.2", - "section_name": "Conception d'autorisation générale", - "req_id": "V8.2.3", - "req_description": "Vérifiez que l'application garantit que l'accès au niveau du champ est limité aux consommateurs disposant d'autorisations explicites sur des champs spécifiques afin d'atténuer les problèmes d'autorisation au niveau de la propriété d'objet (BOPLA).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Autorisation", - "section_id": "V8.2", - "section_name": "Conception d'autorisation générale", - "req_id": "V8.2.4", - "req_description": "Vérifiez que les contrôles de sécurité adaptatifs basés sur les attributs environnementaux et contextuels du consommateur (tels que l'heure, la localisation, l'adresse IP ou l'appareil) sont mis en œuvre pour les décisions d'authentification et d'autorisation, comme défini dans la documentation de l'application. Ces contrôles doivent être appliqués lorsque le consommateur tente de démarrer une nouvelle session et également pendant une session existante.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Autorisation", - "section_id": "V8.3", - "section_name": "Autorisation par opération", - "req_id": "V8.3.1", - "req_description": "Vérifier que l'application applique les règles d'autorisations au niveau de la couche service de confiance et ne s’appuie pas sur des contrôles qu’un consommateur non approuvé pourrait manipuler, comme JavaScript côté client.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Autorisation", - "section_id": "V8.3", - "section_name": "Autorisation par opération", - "req_id": "V8.3.2", - "req_description": "Vérifiez que les modifications apportées aux valeurs sur lesquelles reposent les décisions d'autorisation sont appliquées immédiatement. Lorsque les modifications ne peuvent pas être appliquées immédiatement (par exemple, en s'appuyant sur des données de jetons autonomes), des contrôles d'atténuation doivent être mis en place pour alerter un consommateur lorsqu'il effectue une action alors qu'il n'est plus autorisé à le faire et annuler la modification. Notez que cette solution alternative ne limiterait pas les fuites d'informations.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Autorisation", - "section_id": "V8.3", - "section_name": "Autorisation par opération", - "req_id": "V8.3.3", - "req_description": "Vérifiez que l'accès à un objet repose sur les autorisations du sujet d'origine (par exemple, le consommateur), et non sur celles d'un intermédiaire ou d'un service agissant en son nom. Par exemple, si un consommateur appelle un service web à l'aide d'un jeton d'authentification autonome, et que ce service demande ensuite des données à un autre service, ce dernier utilisera le jeton du consommateur, plutôt qu'un jeton inter-machine du premier service, pour prendre les décisions d'autorisation.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Autorisation", - "section_id": "V8.4", - "section_name": "Autres considérations relatives à l'autorisation", - "req_id": "V8.4.1", - "req_description": "Vérifiez que les applications multi-tenants utilisent des contrôles inter-tenants pour garantir que les opérations des consommateurs n'affecteront jamais les tenants avec lesquels ils ne sont pas autorisés à interagir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Autorisation", - "section_id": "V8.4", - "section_name": "Autres considérations relatives à l'autorisation", - "req_id": "V8.4.2", - "req_description": "Vérifiez que l'accès aux interfaces administratives intègre plusieurs couches de sécurité, notamment la vérification continue de l'identité du consommateur, l'évaluation de la posture de sécurité des appareils et l'analyse contextuelle des risques, garantissant que l'emplacement du réseau ou les endpoints approuvés ne sont pas les seuls facteurs d'autorisation, même s'ils peuvent réduire la probabilité d'accès non autorisé.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V9", - "chapter_name": "Jetons autonomes", - "section_id": "V9.1", - "section_name": "Source et intégrité du jeton", - "req_id": "V9.1.1", - "req_description": "Vérifiez que les jetons autonomes sont validés à l'aide de leur signature numérique ou MAC pour les protéger contre toute falsification avant d'accepter le contenu du jeton.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V9", - "chapter_name": "Jetons autonomes", - "section_id": "V9.1", - "section_name": "Source et intégrité du jeton", - "req_id": "V9.1.2", - "req_description": "Vérifiez que seuls les algorithmes d'une liste d’autorisations peuvent être utilisés pour créer et vérifier des jetons autonomes, dans un contexte donné. La liste d'autorisation doit inclure les algorithmes autorisés, idéalement symétriques ou asymétriques, et ne doit pas inclure l'algorithme « Aucun ». Si les algorithmes symétriques et asymétriques doivent être pris en charge, des contrôles supplémentaires seront nécessaires pour éviter toute confusion de clés.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V9", - "chapter_name": "Jetons autonomes", - "section_id": "V9.1", - "section_name": "Source et intégrité du jeton", - "req_id": "V9.1.3", - "req_description": "Vérifiez que les clés utilisées pour valider les jetons autonomes proviennent de sources préconfigurées et fiables pour l'émetteur du jeton, empêchant ainsi les attaquants de spécifier des sources et des clés non fiables. Pour les JWT et autres structures JWS, les en-têtes tels que « jku », « x5u » et « jwk » doivent être validés par rapport à une liste d'autorisation de sources fiables.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V9", - "chapter_name": "Jetons autonomes", - "section_id": "V9.2", - "section_name": "Contenu du jeton", - "req_id": "V9.2.1", - "req_description": "Vérifiez que, si une période de validité est indiquée dans les données du jeton, celui-ci et son contenu ne sont acceptés que si la date de vérification est comprise dans cette période. Par exemple, pour les JWT, les déclarations « nbf » et « exp » doivent être vérifiées.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V9", - "chapter_name": "Jetons autonomes", - "section_id": "V9.2", - "section_name": "Contenu du jeton", - "req_id": "V9.2.2", - "req_description": "Vérifiez que le service recevant un jeton valide le type de jeton et son utilisation avant d'en accepter le contenu. Par exemple, seuls les jetons d'accès peuvent être acceptés pour les décisions d'autorisation, et seuls les jetons d'identification peuvent être utilisés pour prouver l'authentification des utilisateurs.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V9", - "chapter_name": "Jetons autonomes", - "section_id": "V9.2", - "section_name": "Contenu du jeton", - "req_id": "V9.2.3", - "req_description": "Vérifiez que le service accepte uniquement les jetons destinés à être utilisés avec ce service (audience). Pour les JWT, cela peut être réalisé en validant la déclaration « aud » par rapport à une liste d'autorisation définie dans le service.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V9", - "chapter_name": "Jetons autonomes", - "section_id": "V9.2", - "section_name": "Contenu du jeton", - "req_id": "V9.2.4", - "req_description": "Si un émetteur de jetons utilise la même clé privée pour émettre des jetons destinés à différentes audiences, vérifiez que les jetons émis contiennent une restriction d'audience identifiant de manière unique les audiences visées. Cela empêchera la réutilisation d'un jeton avec une audience non prévue. Si l'identifiant d'audience est provisionné dynamiquement, l'émetteur de jetons doit valider ces audiences afin de garantir qu'elles n'entraînent pas d'usurpation d'identité.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.1", - "section_name": "Sécurité générique OAuth et OIDC", - "req_id": "V10.1.1", - "req_description": "Vérifiez que les jetons sont envoyés uniquement aux composants qui en ont absolument besoin. Par exemple, lors de l'utilisation d'un modèle backend-for-frontend pour les applications JavaScript basées sur un navigateur, les jetons d'accès et d'actualisation ne doivent être accessibles qu'au backend.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.1", - "section_name": "Sécurité générique OAuth et OIDC", - "req_id": "V10.1.2", - "req_description": "Vérifiez que le client n'accepte les valeurs du serveur d'autorisation (telles que le code d'autorisation ou le jeton d'identification) que si elles résultent d'un flux d'autorisation initié par la même session d'agent utilisateur et la même transaction. Cela nécessite que les secrets générés par le client, tels que la clé de preuve pour l'échange de codes (PKCE) « code_verifier », « state » ou le nonce OIDC, ne puissent être devinés, soient spécifiques à la transaction et soient liés de manière sécurisée au client et à la session d'agent utilisateur au cours de laquelle la transaction a été initiée.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.2", - "section_name": "Client OAuth", - "req_id": "V10.2.1", - "req_description": "Vérifiez que, si le flux de code est utilisé, le client OAuth dispose d'une protection contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF), qui déclenchent des demandes de jetons, soit en utilisant la fonctionnalité de clé de preuve pour l'échange de code (PKCE), soit en vérifiant le paramètre « state » envoyé dans la demande d'autorisation.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.2", - "section_name": "Client OAuth", - "req_id": "V10.2.2", - "req_description": "Vérifiez que, si le client OAuth peut interagir avec plusieurs serveurs d'autorisation, il dispose d'une protection contre les attaques par confusion. Par exemple, il peut exiger que le serveur d'autorisation renvoie la valeur du paramètre « iss » et la valide dans la réponse d'autorisation et la réponse du jeton.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.2", - "section_name": "Client OAuth", - "req_id": "V10.2.3", - "req_description": "Vérifiez que le client OAuth demande uniquement les portées requises (ou d’autres paramètres d’autorisation) dans les requêtes adressées au serveur d’autorisation.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.3", - "section_name": "Serveur de ressources OAuth", - "req_id": "V10.3.1", - "req_description": "Vérifiez que le serveur de ressources accepte uniquement les jetons d'accès destinés à être utilisés avec ce service (audience). L'audience peut être incluse dans un jeton d'accès structuré (comme la déclaration « aud » dans JWT) ou vérifiée à l'aide du endpoint d'introspection de jeton.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.3", - "section_name": "Serveur de ressources OAuth", - "req_id": "V10.3.2", - "req_description": "Vérifiez que le serveur de ressources applique les décisions d'autorisation en fonction des déclarations du jeton d'accès définissant l'autorisation déléguée. Si des déclarations telles que « sub », « scope » et « authorization_details » sont présentes, elles doivent être prises en compte dans la décision.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.3", - "section_name": "Serveur de ressources OAuth", - "req_id": "V10.3.3", - "req_description": "Vérifiez que si une décision de contrôle d'accès nécessite l'identification d'un utilisateur unique à partir d'un jeton d'accès (JWT ou réponse d'introspection de jeton associé), le serveur de ressources identifie l'utilisateur à partir de déclarations non ré attribuables à d'autres utilisateurs. En général, cela implique l'utilisation d'une combinaison de déclarations « iss » et « sub ».", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.3", - "section_name": "Serveur de ressources OAuth", - "req_id": "V10.3.4", - "req_description": "Si le serveur de ressources requiert une force d'authentification, des méthodes ou une date d'expiration spécifiques, vérifiez que le jeton d'accès présenté respecte ces contraintes. Par exemple, s'il est présent, utilisez les déclarations OIDC « acr », « amr » et « auth_time » respectivement.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.3", - "section_name": "Serveur de ressources OAuth", - "req_id": "V10.3.5", - "req_description": "Vérifiez que le serveur de ressources empêche l'utilisation de jetons d'accès volés ou la relecture de jetons d'accès (de parties non autorisées) en exigeant des jetons d'accès limités par l'expéditeur, soit Mutual TLS pour OAuth 2, soit OAuth 2 Demonstration of Proof of Possession (DPoP).", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.4", - "section_name": "Serveur d'autorisation OAuth", - "req_id": "V10.4.1", - "req_description": "Vérifiez que le serveur d'autorisation valide les URI de redirection en fonction d'une liste d'autorisation spécifique au client d'URI préenregistrés à l'aide d'une comparaison de chaînes exacte.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.4", - "section_name": "Serveur d'autorisation OAuth", - "req_id": "V10.4.2", - "req_description": "Vérifiez que, si le serveur d'autorisation renvoie le code d'autorisation dans la réponse, celui-ci ne peut être utilisé qu'une seule fois pour une demande de jeton. Pour la deuxième demande valide avec un code d'autorisation déjà utilisé pour émettre un jeton d'accès, le serveur d'autorisation doit rejeter la demande de jeton et révoquer tous les jetons émis liés au code d'autorisation.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.4", - "section_name": "Serveur d'autorisation OAuth", - "req_id": "V10.4.3", - "req_description": "Vérifiez que le code d'autorisation est de courte durée. La durée de vie maximale peut atteindre 10 minutes pour les applications L1 et L2 et 1 minute pour les applications L3.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.4", - "section_name": "Serveur d'autorisation OAuth", - "req_id": "V10.4.4", - "req_description": "Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement l'utilisation des autorisations nécessaires à ce client. Notez que les autorisations « token » (flux implicite) et « password » (flux d'informations d'identification du propriétaire de la ressource) ne doivent plus être utilisées.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.4", - "section_name": "Serveur d'autorisation OAuth", - "req_id": "V10.4.5", - "req_description": "Vérifiez que le serveur d'autorisation atténue les attaques par rejeu de jetons d'actualisation pour les clients publics, de préférence en utilisant des jetons d'actualisation limités par l'expéditeur, par exemple des jetons DPoP (Demonstrating Proof of Possession) ou des jetons d'accès liés à un certificat utilisant le protocole TLS mutuel (mTLS). Pour les applications L1 et L2, la rotation des jetons d'actualisation peut être utilisée. Si cette rotation est utilisée, le serveur d'autorisation doit invalider le jeton d'actualisation après utilisation et révoquer tous les jetons d'actualisation de cette autorisation si un jeton d'actualisation déjà utilisé et invalidé est fourni.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.4", - "section_name": "Serveur d'autorisation OAuth", - "req_id": "V10.4.6", - "req_description": "Vérifiez que, si l'octroi de code est utilisé, le serveur d'autorisation atténue les attaques par interception de code en exigeant une clé de preuve pour l'échange de code (PKCE). Pour les demandes d'autorisation, le serveur d'autorisation doit exiger une valeur « code_challenge » valide et ne doit pas accepter une valeur « plain » pour « code_challenge_method ». Pour une demande de jeton, il doit exiger la validation du paramètre « code_verifier ».", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.4", - "section_name": "Serveur d'autorisation OAuth", - "req_id": "V10.4.7", - "req_description": "Vérifiez que si le serveur d'autorisation prend en charge l'enregistrement dynamique des clients non authentifiés, il réduit le risque d'applications clientes malveillantes. Il doit valider les métadonnées clientes, telles que les URI enregistrés, garantir le consentement de l'utilisateur et l'avertir avant de traiter une demande d'autorisation avec une application cliente non approuvée.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.4", - "section_name": "Serveur d'autorisation OAuth", - "req_id": "V10.4.8", - "req_description": "Vérifiez que les jetons d’actualisation ont une expiration absolue, y compris si l’expiration du jeton d’actualisation glissant est appliquée.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.4", - "section_name": "Serveur d'autorisation OAuth", - "req_id": "V10.4.9", - "req_description": "Vérifiez que les jetons d'actualisation et les jetons d'accès de référence peuvent être révoqués par un utilisateur autorisé à l'aide de l'interface utilisateur du serveur d'autorisation, afin d'atténuer le risque de clients malveillants ou de jetons volés.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.4", - "section_name": "Serveur d'autorisation OAuth", - "req_id": "V10.4.10", - "req_description": "Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.4", - "section_name": "Serveur d'autorisation OAuth", - "req_id": "V10.4.11", - "req_description": "Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.4", - "section_name": "Serveur d'autorisation OAuth", - "req_id": "V10.4.12", - "req_description": "Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement la valeur « response_mode » dont ce client a besoin. Par exemple, en vérifiant cette valeur par rapport aux valeurs attendues ou en utilisant une requête d'autorisation poussée (PAR) ou une requête d'autorisation sécurisée par JWT (JAR).", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.4", - "section_name": "Serveur d'autorisation OAuth", - "req_id": "V10.4.13", - "req_description": "Vérifiez que le type d'Autorisation « code » est toujours utilisé avec les demandes d'autorisation poussées (PAR).", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.4", - "section_name": "Serveur d'autorisation OAuth", - "req_id": "V10.4.14", - "req_description": "Vérifiez que le serveur d'autorisation émet uniquement des jetons d'accès limités à l'expéditeur (preuve de possession), soit avec des jetons d'accès liés au certificat utilisant TLS mutuel (mTLS), soit avec des jetons d'accès liés au DPoP (démonstration de preuve de possession).", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.4", - "section_name": "Serveur d'autorisation OAuth", - "req_id": "V10.4.15", - "req_description": "Vérifiez que, pour un client côté serveur (non exécuté sur l'appareil de l'utilisateur final), le serveur d'autorisation garantit que la valeur du paramètre « authorization_details » provient du backend client et que l'utilisateur ne l'a pas altérée. Par exemple, en exigeant l'utilisation d'une demande d'autorisation poussée (PAR) ou d'une demande d'autorisation sécurisée par JWT (JAR).", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.4", - "section_name": "Serveur d'autorisation OAuth", - "req_id": "V10.4.16", - "req_description": "Vérifiez que le client est confidentiel et que le serveur d'autorisation requiert l'utilisation de méthodes d'authentification client fortes (basées sur la cryptographie à clé publique et résistantes aux attaques par relecture), telles que TLS mutuel ('tls_client_auth', 'self_signed_tls_client_auth') ou JWT à clé privée ('private_key_jwt').", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.5", - "section_name": "Client OIDC", - "req_id": "V10.5.1", - "req_description": "Vérifiez que le client (en tant que partie utilisatrice) atténue les attaques par rejeu de jeton d'identification. Par exemple, en vous assurant que la valeur « nonce » du jeton d'identification correspond à la valeur « nonce » envoyée dans la demande d'authentification au fournisseur OpenID (appelée demande d'autorisation envoyée au serveur d'autorisation dans OAuth2).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.5", - "section_name": "Client OIDC", - "req_id": "V10.5.2", - "req_description": "Vérifiez que le client identifie de manière unique l'utilisateur à partir des déclarations de jeton d'identification, généralement la déclaration « sub », qui ne peut pas être réaffectée à d'autres utilisateurs (pour la portée d'un fournisseur d'identité).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.5", - "section_name": "Client OIDC", - "req_id": "V10.5.3", - "req_description": "Vérifiez que le client rejette les tentatives d'un serveur d'autorisation malveillant d'usurper l'identité d'un autre serveur d'autorisation via ses métadonnées. Le client doit rejeter les métadonnées du serveur d'autorisation si l'URL de l'émetteur figurant dans ces métadonnées ne correspond pas exactement à l'URL d'émetteur préconfigurée attendue par le client.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.5", - "section_name": "Client OIDC", - "req_id": "V10.5.4", - "req_description": "Vérifiez que le client valide que le jeton d'identification est destiné à être utilisé pour ce client (audience) en vérifiant que la déclaration « aud » du jeton est égale à la valeur « client_id » pour le client.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.5", - "section_name": "Client OIDC", - "req_id": "V10.5.5", - "req_description": "Vérifiez que, lors de l'utilisation de la déconnexion du back-channel OIDC, la partie utilisatrice atténue les risques de déni de service liés à la déconnexion forcée et à la confusion entre JWT dans le flux de déconnexion. Le client doit vérifier que le jeton de déconnexion est correctement typé avec la valeur « logout+jwt », qu'il contient la déclaration « event » avec le nom de membre correct et qu'il ne contient pas de déclaration « nonce ». Il est également recommandé d'utiliser une expiration courte (par exemple, 2 minutes).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.6", - "section_name": "Fournisseur OpenID", - "req_id": "V10.6.1", - "req_description": "Vérifiez que le fournisseur OpenID n'autorise que les valeurs « code », « ciba », « id_token » ou « id_token code » pour le mode de réponse. Notez que « code » est préférable à « id_token code » (flux hybride OIDC) et que « token » (tout flux implicite) ne doit pas être utilisé.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.6", - "section_name": "Fournisseur OpenID", - "req_id": "V10.6.2", - "req_description": "Vérifiez que le fournisseur OpenID atténue les risques de déni de service liés à la déconnexion forcée. Pour ce faire, obtenez une confirmation explicite de l'utilisateur final ou, le cas échéant, validez les paramètres de la requête de déconnexion (initiée par la partie utilisatrice), comme « id_token_hint ».", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.7", - "section_name": "Gestion du consentement", - "req_id": "V10.7.1", - "req_description": "Vérifiez que le serveur d'autorisation garantit le consentement de l'utilisateur à chaque demande d'autorisation. Si l'identité du client ne peut être garantie, le serveur d'autorisation doit toujours demander explicitement le consentement de l'utilisateur.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.7", - "section_name": "Gestion du consentement", - "req_id": "V10.7.2", - "req_description": "Vérifiez que lorsque le serveur d'autorisation demande le consentement de l'utilisateur, il fournit des informations claires et suffisantes sur ce qui est consenti. Le cas échéant, ces informations doivent inclure la nature des autorisations demandées (généralement en fonction de la portée, du serveur de ressources et des détails d'autorisation RAR), l'identité de l'application autorisée et la durée de vie de ces autorisations.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "Oauth et OIDC", - "section_id": "V10.7", - "section_name": "Gestion du consentement", - "req_id": "V10.7.3", - "req_description": "Vérifiez que l’utilisateur peut consulter, modifier et révoquer les consentements qu’il a accordés via le serveur d’autorisation.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.1", - "section_name": "Inventaire et documentation cryptographiques", - "req_id": "V11.1.1", - "req_description": "Vérifiez qu’il existe une politique documentée pour la gestion des clés cryptographiques et un cycle de vie des clés cryptographiques qui suit une norme de gestion des clés telle que NIST SP 800-57. Cela devrait inclure la garantie que les clés ne sont pas sur-partagées (par exemple, avec plus de deux entités pour les secrets partagés et plus d’une entité pour les clés privées).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.1", - "section_name": "Inventaire et documentation cryptographiques", - "req_id": "V11.1.2", - "req_description": "Vérifiez qu'un inventaire cryptographique est réalisé, maintenu et régulièrement mis à jour, et qu'il inclut toutes les clés, algorithmes et certificats cryptographiques utilisés par l'application. Il doit également documenter les emplacements du système où les clés peuvent ou non être utilisées, ainsi que les types de données qui peuvent ou non être protégées par ces clés.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.1", - "section_name": "Inventaire et documentation cryptographiques", - "req_id": "V11.1.3", - "req_description": "Vérifiez que les mécanismes de découverte cryptographique sont utilisés pour identifier toutes les instances de cryptographie dans le système, y compris les opérations de chiffrement, de hachage et de signature.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.1", - "section_name": "Inventaire et documentation cryptographiques", - "req_id": "V11.1.4", - "req_description": "Vérifier la tenue d'un inventaire cryptographique. Celui-ci doit inclure un plan documenté décrivant la migration vers de nouvelles normes cryptographiques, telles que la cryptographie post-quantique, afin de réagir aux menaces futures.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.2", - "section_name": "Mise en œuvre sécurisée de la cryptographie", - "req_id": "V11.2.1", - "req_description": "Vérifiez que les implémentations validées par l’industrie (y compris les bibliothèques et les implémentations accélérées par le matériel) sont utilisées pour les opérations cryptographiques.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.2", - "section_name": "Mise en œuvre sécurisée de la cryptographie", - "req_id": "V11.2.2", - "req_description": "Vérifiez que l'application est conçue avec une agilité cryptographique, de sorte que les nombres aléatoires, le chiffrement authentifié, le MAC ou les algorithmes de hachage, les longueurs de clés, les tours, les chiffrements et les modes puissent être reconfigurés, mis à niveau ou échangés à tout moment, afin de se protéger contre les failles cryptographiques. De même, il doit être possible de remplacer les clés et les mots de passe, ainsi que de rechiffrer les données. Cela permettra des mises à niveau transparentes vers la cryptographie post-quantique (PQC), une fois que des implémentations hautement sécurisées de schémas ou de normes PQC approuvés seront largement disponibles.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.2", - "section_name": "Mise en œuvre sécurisée de la cryptographie", - "req_id": "V11.2.3", - "req_description": "Vérifiez que toutes les primitives cryptographiques utilisent un minimum de 128 bits de sécurité en fonction de l'algorithme, de la taille de la clé et de la configuration. Par exemple, une clé ECC de 256 bits offre environ 128 bits de sécurité, tandis que RSA nécessite une clé de 3072 bits pour atteindre 128 bits de sécurité.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.2", - "section_name": "Mise en œuvre sécurisée de la cryptographie", - "req_id": "V11.2.4", - "req_description": "Vérifiez que toutes les opérations cryptographiques sont à temps constant, sans opérations de « court-circuit » dans les comparaisons, les calculs ou les retours, pour éviter toute fuite d'informations.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.2", - "section_name": "Mise en œuvre sécurisée de la cryptographie", - "req_id": "V11.2.5", - "req_description": "Vérifiez que tous les modules cryptographiques échouent en toute sécurité et que les erreurs sont gérées de manière à ne pas permettre de vulnérabilités, telles que les attaques Padding Oracle.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.3", - "section_name": "Algorithmes de chiffrement", - "req_id": "V11.3.1", - "req_description": "Vérifiez que les modes de bloc non sécurisés (par exemple, ECB) et les schémas de remplissage faibles (par exemple, PKCS#1 v1.5) ne sont pas utilisés.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.3", - "section_name": "Algorithmes de chiffrement", - "req_id": "V11.3.2", - "req_description": "Vérifiez que seuls les chiffrements et modes approuvés tels que AES avec GCM sont utilisés.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.3", - "section_name": "Algorithmes de chiffrement", - "req_id": "V11.3.3", - "req_description": "Vérifiez que les données chiffrées sont protégées contre toute modification non autorisée, de préférence en utilisant une méthode de chiffrement authentifiée approuvée ou en combinant une méthode de chiffrement approuvée avec un algorithme MAC approuvé.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.3", - "section_name": "Algorithmes de chiffrement", - "req_id": "V11.3.4", - "req_description": "Vérifiez que les nonces, les vecteurs d'initialisation et autres nombres à usage unique ne sont pas utilisés pour plus d'une paire clé de chiffrement/élément de données. La méthode de génération doit être adaptée à l'algorithme utilisé.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.3", - "section_name": "Algorithmes de chiffrement", - "req_id": "V11.3.5", - "req_description": "Vérifiez que toute combinaison d'un algorithme de chiffrement et d'un algorithme MAC fonctionne en mode chiffrement puis MAC.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.4", - "section_name": "Hachage et fonctions basées sur le hachage", - "req_id": "V11.4.1", - "req_description": "Vérifiez que seules les fonctions de hachage approuvées sont utilisées pour les cas d'utilisation cryptographiques généraux, notamment les signatures numériques, HMAC, KDF et la génération de bits aléatoires. Les fonctions de hachage non autorisées, telles que MD5, ne doivent pas être utilisées à des fins cryptographiques.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.4", - "section_name": "Hachage et fonctions basées sur le hachage", - "req_id": "V11.4.2", - "req_description": "Vérifiez que les mots de passe sont stockés à l'aide d'une fonction de dérivation de clés approuvée et gourmande en ressources de calcul (également appelée « fonction de hachage de mots de passe »), dont les paramètres sont configurés conformément aux directives en vigueur. Ces paramètres doivent équilibrer sécurité et performances afin de rendre les attaques par force brute suffisamment difficiles pour le niveau de sécurité requis.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.4", - "section_name": "Hachage et fonctions basées sur le hachage", - "req_id": "V11.4.3", - "req_description": "Vérifiez que les fonctions de hachage utilisées dans les signatures numériques, dans le cadre de l'authentification ou de l'intégrité des données, sont résistantes aux collisions et possèdent des longueurs de bits appropriées. Si la résistance aux collisions est requise, la longueur de sortie doit être d'au moins 256 bits. Si seule la résistance aux attaques de seconde pré-image est requise, la longueur de sortie doit être d'au moins 128 bits.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.4", - "section_name": "Hachage et fonctions basées sur le hachage", - "req_id": "V11.4.4", - "req_description": "Vérifiez que l'application utilise des fonctions de dérivation de clés approuvées avec des paramètres d'extension de clés lors de la dérivation de clés secrètes à partir de mots de passe. Les paramètres utilisés doivent concilier sécurité et performances afin d'empêcher les attaques par force brute de compromettre la clé cryptographique obtenue.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.5", - "section_name": "Valeurs aléatoires", - "req_id": "V11.5.1", - "req_description": "Vérifiez que tous les nombres et chaînes aléatoires destinés à être non devinables doivent être générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et posséder au moins 128 bits d'entropie. Notez que les UUID ne respectent pas cette condition.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.5", - "section_name": "Valeurs aléatoires", - "req_id": "V11.5.2", - "req_description": "Vérifiez que le mécanisme de génération de nombres aléatoires utilisé est conçu pour fonctionner en toute sécurité, même en cas de forte demande.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.6", - "section_name": "Cryptographie à clé publique", - "req_id": "V11.6.1", - "req_description": "Vérifier que seuls des algorithmes cryptographiques et des modes opératoires approuvés sont utilisés pour la génération et l'amorçage des clés, ainsi que pour la génération et la vérification des signatures numériques. Les algorithmes de génération de clés ne doivent pas générer de clés non sécurisées et vulnérables aux attaques connues, par exemple les clés RSA vulnérables à la factorisation de Fermat.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.6", - "section_name": "Cryptographie à clé publique", - "req_id": "V11.6.2", - "req_description": "Vérifiez que des algorithmes cryptographiques approuvés sont utilisés pour l'échange de clés (tels que Diffie-Hellman), en veillant à ce que les mécanismes d'échange de clés utilisent des paramètres sécurisés. Cela permettra d'éviter les attaques contre le processus d'établissement des clés, susceptibles de conduire à des attaques de type « adversaire du milieu » ou à des failles cryptographiques.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.7", - "section_name": "Cryptographie des données en cours d'utilisation", - "req_id": "V11.7.1", - "req_description": "Vérifiez que le chiffrement complet de la mémoire est utilisé pour protéger les données sensibles pendant leur utilisation, empêchant ainsi l'accès par des utilisateurs ou des processus non autorisés.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Cryptographie", - "section_id": "V11.7", - "section_name": "Cryptographie des données en cours d'utilisation", - "req_id": "V11.7.2", - "req_description": "Vérifiez que la minimisation des données garantit que la quantité minimale de données est exposée pendant le traitement et assurez-vous que les données sont chiffrées immédiatement après utilisation ou dès que possible.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Communication sécurisée", - "section_id": "V12.1", - "section_name": "Conseils généraux de sécurité TLS", - "req_id": "V12.1.1", - "req_description": "Vérifiez que seules les dernières versions recommandées du protocole TLS sont activées, telles que TLS 1.2 et TLS 1.3. La dernière version du protocole TLS doit être privilégiée.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Communication sécurisée", - "section_id": "V12.1", - "section_name": "Conseils généraux de sécurité TLS", - "req_id": "V12.1.2", - "req_description": "Vérifiez que seules les suites de chiffrement recommandées sont activées, les suites de chiffrement les plus puissantes étant définies comme préférées. Les applications L3 doivent uniquement prendre en charge les suites de chiffrement assurant la confidentialité persistante (forward secrecy).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Communication sécurisée", - "section_id": "V12.1", - "section_name": "Conseils généraux de sécurité TLS", - "req_id": "V12.1.3", - "req_description": "Vérifiez que l’application valide que les certificats clients mTLS sont approuvés avant d’utiliser l’identité du certificat pour l’authentification ou l’autorisation.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Communication sécurisée", - "section_id": "V12.1", - "section_name": "Conseils généraux de sécurité TLS", - "req_id": "V12.1.4", - "req_description": "Vérifiez que la révocation de certification appropriée, telle que l'agrafage du protocole OCSP (Online Certificate Status Protocol), est activée et configurée.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Communication sécurisée", - "section_id": "V12.1", - "section_name": "Conseils généraux de sécurité TLS", - "req_id": "V12.1.5", - "req_description": "Vérifiez que Encrypted Client Hello (ECH) est activé dans les paramètres TLS de l'application pour empêcher l'exposition de métadonnées sensibles, telles que l'indication du nom du serveur (SNI), pendant les processus de négociation TLS.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Communication sécurisée", - "section_id": "V12.2", - "section_name": "Communication HTTPS avec des services externes", - "req_id": "V12.2.1", - "req_description": "Vérifiez que TLS est utilisé pour toute connectivité entre un client et des services externes basés sur HTTP, et ne recourt pas à des communications non sécurisées ou non chiffrées.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Communication sécurisée", - "section_id": "V12.2", - "section_name": "Communication HTTPS avec des services externes", - "req_id": "V12.2.2", - "req_description": "Vérifiez que les services externes utilisent des certificats TLS publiquement approuvés.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Communication sécurisée", - "section_id": "V12.3", - "section_name": "Sécurité des communications entre services généraux", - "req_id": "V12.3.1", - "req_description": "Vérifiez qu'un protocole chiffré tel que TLS est utilisé pour toutes les connexions entrantes et sortantes vers et depuis l'application, y compris les systèmes de surveillance, les outils de gestion, l'accès à distance et SSH, les intergiciels, les bases de données, les mainframes, les systèmes partenaires ou les API externes. Le serveur ne doit pas recourir à des protocoles non sécurisés ou non chiffrés.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Communication sécurisée", - "section_id": "V12.3", - "section_name": "Sécurité des communications entre services généraux", - "req_id": "V12.3.2", - "req_description": "Vérifiez que les clients TLS valident les certificats reçus avant de communiquer avec un serveur TLS.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Communication sécurisée", - "section_id": "V12.3", - "section_name": "Sécurité des communications entre services généraux", - "req_id": "V12.3.3", - "req_description": "Vérifiez que TLS ou un autre mécanisme de chiffrement de transport approprié est utilisé pour toute connectivité entre les services internes basés sur HTTP au sein de l'application et ne se replie pas vers des communications non sécurisées ou non chiffrées.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Communication sécurisée", - "section_id": "V12.3", - "section_name": "Sécurité des communications entre services généraux", - "req_id": "V12.3.4", - "req_description": "Vérifiez que les connexions TLS entre les services internes utilisent des certificats de confiance. Lorsque des certificats générés en interne ou auto-signés sont utilisés, le service consommateur doit être configuré pour n'approuver que des autorités de certification internes spécifiques et des certificats auto-signés spécifiques.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Communication sécurisée", - "section_id": "V12.3", - "section_name": "Sécurité des communications entre services généraux", - "req_id": "V12.3.5", - "req_description": "Vérifiez que les services communiquant en interne au sein d'un système (communications intra-services) utilisent une authentification forte pour garantir la vérification de chaque endpoint. Des méthodes d'authentification forte, telles que l'authentification client TLS, doivent être utilisées pour garantir l'identité, en utilisant une infrastructure à clé publique et des mécanismes résistants aux attaques par rejeu. Pour les architectures de microservices, envisagez d'utiliser un maillage de services pour simplifier la gestion des certificats et renforcer la sécurité.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.1", - "section_name": "Documentation de configuration", - "req_id": "V13.1.1", - "req_description": "Vérifiez que tous les besoins de communication de l'application sont documentés. Cela doit inclure les services externes dont l'application dépend et les cas où un utilisateur final pourrait fournir un emplacement externe auquel l'application se connectera.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.1", - "section_name": "Documentation de configuration", - "req_id": "V13.1.2", - "req_description": "Vérifiez que pour chaque service utilisé par l'application, la documentation définit le nombre maximal de connexions simultanées (par exemple, les limites du pool de connexions) et le comportement de l'application lorsque cette limite est atteinte, y compris les mécanismes de secours ou de récupération, pour éviter les conditions de déni de service.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.1", - "section_name": "Documentation de configuration", - "req_id": "V13.1.3", - "req_description": "Vérifiez que la documentation de l'application définit des stratégies de gestion des ressources pour chaque système ou service externe utilisé (par exemple, bases de données, descripteurs de fichiers, threads, connexions HTTP). Cela doit inclure les procédures de libération des ressources, les paramètres de délai d'expiration, la gestion des échecs et l'implémentation de la logique de nouvelle tentative, en spécifiant les limites de nouvelle tentative, les délais et les algorithmes de retour arrière. Pour les opérations de requête-réponse HTTP synchrones, la documentation doit imposer des délais d'expiration courts et soit désactiver les nouvelles tentatives, soit les limiter strictement afin d'éviter les retards en cascade et l'épuisement des ressources.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.1", - "section_name": "Documentation de configuration", - "req_id": "V13.1.4", - "req_description": "Vérifiez que la documentation de l'application définit les secrets essentiels à la sécurité de l'application et un calendrier de rotation de ceux-ci, en fonction du modèle de menace et des exigences commerciales de l'organisation.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.2", - "section_name": "Configuration de la communication backend", - "req_id": "V13.2.1", - "req_description": "Vérifiez que les communications entre les composants de l'application backend qui ne prennent pas en charge le mécanisme de session utilisateur standard de l'application, notamment les API, les intergiciels et les couches de données, sont authentifiées. L'authentification doit utiliser des comptes de service individuels, des jetons à court terme ou une authentification par certificat, et non des identifiants immuables tels que des mots de passe, des clés API ou des comptes partagés avec accès privilégié.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.2", - "section_name": "Configuration de la communication backend", - "req_id": "V13.2.2", - "req_description": "Vérifiez que les communications entre les composants de l'application backend, y compris les services locaux ou du système d'exploitation, les API, les intergiciels et les couches de données, sont effectuées avec des comptes dotés des privilèges les moins nécessaires.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.2", - "section_name": "Configuration de la communication backend", - "req_id": "V13.2.3", - "req_description": "Vérifiez que si des informations d’identification doivent être utilisées pour l’authentification du service, les informations d’identification utilisées par le consommateur ne sont pas des informations d’identification par défaut (par exemple, root/root ou admin/admin).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.2", - "section_name": "Configuration de la communication backend", - "req_id": "V13.2.4", - "req_description": "Vérifiez qu'une liste d’autorisations est utilisée pour définir les ressources ou systèmes externes avec lesquels l'application est autorisée à communiquer (par exemple, pour les requêtes sortantes, les chargements de données ou l'accès aux fichiers). Cette liste d'autorisation peut être implémentée au niveau de la couche applicative, du serveur web, du pare-feu ou d'une combinaison de différentes couches.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.2", - "section_name": "Configuration de la communication backend", - "req_id": "V13.2.5", - "req_description": "Vérifiez que le serveur Web ou d’application est configuré avec une liste autorisée de ressources ou de systèmes vers lesquels le serveur peut envoyer des requêtes ou charger des données ou des fichiers.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.2", - "section_name": "Configuration de la communication backend", - "req_id": "V13.2.6", - "req_description": "Vérifiez que lorsque l'application se connecte à des services distincts, elle suit la configuration documentée pour chaque connexion, comme le nombre maximal de connexions parallèles, le comportement lorsque le nombre maximal de connexions autorisées est atteint, les délais d'expiration de connexion et les stratégies de nouvelle tentative.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.3", - "section_name": "Gestion des secrets", - "req_id": "V13.3.1", - "req_description": "Vérifiez qu'une solution de gestion des secrets, telle qu'un coffre-fort de clés, est utilisée pour créer, stocker, contrôler l'accès et détruire en toute sécurité les secrets backend. Ceux-ci peuvent inclure des mots de passe, du matériel de clé, des intégrations avec des bases de données et des systèmes tiers, des clés et des graines pour des jetons temporels, d'autres secrets internes et des clés API. Les secrets ne doivent pas être inclus dans le code source de l'application ni dans les artefacts de build. Pour une application L3, cela doit impliquer une solution matérielle telle qu'un HSM.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.3", - "section_name": "Gestion des secrets", - "req_id": "V13.3.2", - "req_description": "Vérifiez que l’accès aux ressources secrètes respecte le principe du moindre privilège.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.3", - "section_name": "Gestion des secrets", - "req_id": "V13.3.3", - "req_description": "Vérifiez que toutes les opérations cryptographiques sont effectuées à l'aide d'un module de sécurité isolé (tel qu'un coffre-fort ou un module de sécurité matériel) pour gérer et protéger en toute sécurité le matériel clé contre toute exposition en dehors du module de sécurité.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.3", - "section_name": "Gestion des secrets", - "req_id": "V13.3.4", - "req_description": "Vérifiez que les secrets sont configurés pour expirer et être renouvelés en fonction de la documentation de l'application.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.4", - "section_name": "Fuite d'informations involontaire", - "req_id": "V13.4.1", - "req_description": "Vérifiez que l'application est déployée soit sans aucune métadonnée de contrôle de source, y compris les dossiers .git ou .svn, soit de manière à ce que ces dossiers soient inaccessibles à la fois en externe et à l'application elle-même.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.4", - "section_name": "Fuite d'informations involontaire", - "req_id": "V13.4.2", - "req_description": "Vérifiez que les modes de débogage sont désactivés pour tous les composants dans les environnements de production afin d’éviter l’exposition des fonctionnalités de débogage et la fuite d’informations.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.4", - "section_name": "Fuite d'informations involontaire", - "req_id": "V13.4.3", - "req_description": "Vérifiez que les serveurs Web n’exposent pas les listes de répertoires aux clients, sauf si cela est explicitement prévu.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.4", - "section_name": "Fuite d'informations involontaire", - "req_id": "V13.4.4", - "req_description": "Vérifiez que l’utilisation de la méthode HTTP TRACE n’est pas prise en charge dans les environnements de production, afin d’éviter toute fuite d’informations potentielle.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.4", - "section_name": "Fuite d'informations involontaire", - "req_id": "V13.4.5", - "req_description": "Vérifiez que la documentation (comme pour les API internes) et les endpoints de surveillance ne sont pas exposés, sauf si cela est explicitement prévu.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.4", - "section_name": "Fuite d'informations involontaire", - "req_id": "V13.4.6", - "req_description": "Vérifiez que l’application n’expose pas d’informations de version détaillées des composants backend.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Configuration", - "section_id": "V13.4", - "section_name": "Fuite d'informations involontaire", - "req_id": "V13.4.7", - "req_description": "Vérifiez que la couche web est configuré pour servir uniquement les fichiers avec des extensions de fichier spécifiques afin d’éviter toute fuite involontaire d’informations, de configuration et de code source.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Protection des données", - "section_id": "V14.1", - "section_name": "Documentation sur la protection des données", - "req_id": "V14.1.1", - "req_description": "Vérifiez que toutes les données sensibles créées et traitées par l'application ont été identifiées et classées selon leur niveau de protection. Cela inclut les données uniquement codées et donc facilement déchiffrables, telles que les chaînes Base64 ou la charge utile en texte clair d'un JWT. Les niveaux de protection doivent tenir compte des réglementations et normes de protection des données et de confidentialité auxquelles l'application est tenue de se conformer.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Protection des données", - "section_id": "V14.1", - "section_name": "Documentation sur la protection des données", - "req_id": "V14.1.2", - "req_description": "Vérifier que tous les niveaux de protection des données sensibles sont assortis d'un ensemble documenté d'exigences de protection. Cela doit inclure (sans s'y limiter) les exigences relatives au chiffrement général, à la vérification de l'intégrité, à la conservation, à la journalisation des données, aux contrôles d'accès aux données sensibles dans les journaux, au chiffrement au niveau de la base de données, aux technologies de confidentialité et de renforcement de la confidentialité à utiliser, ainsi qu'aux autres exigences de confidentialité.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Protection des données", - "section_id": "V14.2", - "section_name": "Protection générale des données", - "req_id": "V14.2.1", - "req_description": "Vérifiez que les données sensibles sont uniquement envoyées au serveur dans les champs de corps ou d’en-tête du message HTTP, et que l’URL et la chaîne de requête ne contiennent pas d’informations sensibles, telles qu’une clé API ou un jeton de session.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Protection des données", - "section_id": "V14.2", - "section_name": "Protection générale des données", - "req_id": "V14.2.2", - "req_description": "Vérifiez que l’application empêche la mise en cache des données sensibles dans les composants du serveur, tels que les équilibreurs de charge et les caches d’application, ou garantit que les données sont purgées en toute sécurité après utilisation.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Protection des données", - "section_id": "V14.2", - "section_name": "Protection générale des données", - "req_id": "V14.2.3", - "req_description": "Vérifiez que les données sensibles définies ne sont pas envoyées à des parties non fiables (par exemple, des trackers d'utilisateurs) pour empêcher la collecte indésirable de données en dehors du contrôle de l'application.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Protection des données", - "section_id": "V14.2", - "section_name": "Protection générale des données", - "req_id": "V14.2.4", - "req_description": "Vérifiez que les contrôles autour des données sensibles liés au chiffrement, à la vérification de l'intégrité, à la conservation, à la manière dont les données doivent être enregistrées, aux contrôles d'accès autour des données sensibles dans les journaux, à la confidentialité et aux technologies d'amélioration de la confidentialité, sont mis en œuvre comme défini dans la documentation pour le niveau de protection des données spécifiques.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Protection des données", - "section_id": "V14.2", - "section_name": "Protection générale des données", - "req_id": "V14.2.5", - "req_description": "Vérifiez que les mécanismes de mise en cache sont configurés pour ne mettre en cache que les réponses dont le type de contenu est conforme à la ressource et qui ne contiennent pas de contenu sensible et dynamique. Le serveur web doit renvoyer une réponse 404 ou 302 lors de l'accès à un fichier inexistant plutôt qu'un fichier valide différent. Cela devrait empêcher les attaques par empoisonnement de cache web.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Protection des données", - "section_id": "V14.2", - "section_name": "Protection générale des données", - "req_id": "V14.2.6", - "req_description": "Vérifiez que l'application ne renvoie que les données sensibles minimales requises pour son fonctionnement. Par exemple, ne renvoyez que certains chiffres d'un numéro de carte de crédit, et non le numéro complet. Si les données complètes sont requises, elles doivent être masquées dans l'interface utilisateur, sauf si l'utilisateur les consulte spécifiquement.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Protection des données", - "section_id": "V14.2", - "section_name": "Protection générale des données", - "req_id": "V14.2.7", - "req_description": "Vérifiez que les informations sensibles sont soumises à une classification de conservation des données, en veillant à ce que les données obsolètes ou inutiles soient supprimées automatiquement, selon un calendrier défini ou selon les besoins de la situation.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Protection des données", - "section_id": "V14.2", - "section_name": "Protection générale des données", - "req_id": "V14.2.8", - "req_description": "Vérifiez que les informations sensibles sont supprimées des métadonnées des fichiers soumis par l'utilisateur, sauf si le stockage est autorisé par l'utilisateur.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Protection des données", - "section_id": "V14.3", - "section_name": "Protection des données côté client", - "req_id": "V14.3.1", - "req_description": "Vérifiez que les données authentifiées sont effacées du stockage client, comme le DOM du navigateur, après la fin du client ou de la session. Le champ d'en-tête de réponse HTTP « Clear-Site-Data » peut être utile, mais le côté client devrait également pouvoir effectuer la correction si la connexion au serveur n'est pas disponible à la fin de la session.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Protection des données", - "section_id": "V14.3", - "section_name": "Protection des données côté client", - "req_id": "V14.3.2", - "req_description": "Vérifiez que l'application définit suffisamment de champs d'en-tête de réponse HTTP anti-caching (c'est-à-dire Cache-Control : no-store) afin que les données sensibles ne soient pas mises en cache dans les navigateurs.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Protection des données", - "section_id": "V14.3", - "section_name": "Protection des données côté client", - "req_id": "V14.3.3", - "req_description": "Vérifiez que les données stockées dans le stockage du navigateur (telles que localStorage, sessionStorage, IndexedDB ou les cookies) ne contiennent pas de données sensibles, à l'exception des jetons de session.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.1", - "section_name": "Documentation sur le développement et l'architecture sécurisés", - "req_id": "V15.1.1", - "req_description": "Vérifiez que la documentation de l'application définit les délais de correction basés sur les risques pour les versions de composants tiers présentant des vulnérabilités et pour la mise à jour des bibliothèques en général, afin de minimiser les risques liés à ces composants.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.1", - "section_name": "Documentation sur le développement et l'architecture sécurisés", - "req_id": "V15.1.2", - "req_description": "Vérifiez qu'un catalogue d'inventaire, tel qu'une nomenclature logicielle (SBOM), est conservé pour toutes les bibliothèques tierces utilisées, y compris en vérifiant que les composants proviennent de référentiels prédéfinis, fiables et continuellement maintenus.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.1", - "section_name": "Documentation sur le développement et l'architecture sécurisés", - "req_id": "V15.1.3", - "req_description": "Vérifiez que la documentation de l'application identifie les fonctionnalités consommatrices en temps ou gourmandes en ressources. Elle doit notamment indiquer comment prévenir une perte de disponibilité due à une utilisation excessive de ces fonctionnalités et éviter que la génération d'une réponse ne prenne plus de temps que le délai d'expiration du consommateur. Les mesures de protection potentielles peuvent inclure le traitement asynchrone, l'utilisation de files d'attente et la limitation des processus parallèles par utilisateur et par application.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.1", - "section_name": "Documentation sur le développement et l'architecture sécurisés", - "req_id": "V15.1.4", - "req_description": "Vérifiez que la documentation de l’application met en évidence les bibliothèques tierces qui sont considérées comme des « composants à risque ».", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.1", - "section_name": "Documentation sur le développement et l'architecture sécurisés", - "req_id": "V15.1.5", - "req_description": "Vérifiez que la documentation de l’application met en évidence les parties de l’application où des « fonctionnalités dangereuses » sont utilisées.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.2", - "section_name": "Architecture de sécurité et dépendances", - "req_id": "V15.2.1", - "req_description": "Vérifiez que l’application contient uniquement des composants qui n’ont pas dépassé les délais de mise à jour et de correction documentés.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.2", - "section_name": "Architecture de sécurité et dépendances", - "req_id": "V15.2.2", - "req_description": "Vérifiez que l'application a mis en œuvre des défenses contre la perte de disponibilité due à des fonctionnalités qui prennent du temps ou qui nécessitent des ressources, sur la base des décisions et stratégies de sécurité documentées à cet effet.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.2", - "section_name": "Architecture de sécurité et dépendances", - "req_id": "V15.2.3", - "req_description": "Vérifiez que l'environnement de production inclut uniquement les fonctionnalités nécessaires au fonctionnement de l'application et n'expose pas de fonctionnalités superflues telles que du code de test, des exemples d'extraits et des fonctionnalités de développement.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.2", - "section_name": "Architecture de sécurité et dépendances", - "req_id": "V15.2.4", - "req_description": "Vérifiez que les composants tiers et toutes leurs dépendances transitives sont inclus à partir du référentiel attendu, qu'il soit détenu en interne ou qu'il s'agisse d'une source externe, et qu'il n'y a aucun risque d'attaque par confusion de dépendances.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.2", - "section_name": "Architecture de sécurité et dépendances", - "req_id": "V15.2.5", - "req_description": "Vérifiez que l'application implémente des protections supplémentaires autour des parties documentées comme contenant des « fonctionnalités dangereuses » ou utilisant des bibliothèques tierces considérées comme des « composants à risque ». Cela peut inclure des techniques telles que le sandboxing, l'encapsulation, la conteneurisation ou l'isolation au niveau du réseau pour retarder et dissuader les attaquants qui compromettent une partie de l'application de se propager ailleurs.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.3", - "section_name": "Développement défensif", - "req_id": "V15.3.1", - "req_description": "Vérifiez que l'application ne renvoie que le sous-ensemble requis de champs d'un objet de données. Par exemple, elle ne doit pas renvoyer un objet de données entier, car certains champs individuels ne doivent pas être accessibles aux utilisateurs.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.3", - "section_name": "Développement défensif", - "req_id": "V15.3.2", - "req_description": "Vérifiez que lorsque le backend de l'application effectue des appels vers des URL externes, il est configuré pour ne pas suivre les redirections, sauf s'il s'agit d'une fonctionnalité prévue.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.3", - "section_name": "Développement défensif", - "req_id": "V15.3.3", - "req_description": "Vérifiez que l'application dispose de contre-mesures pour se protéger contre les attaques d'affectation de masse en limitant les champs autorisés par contrôleur et action, par exemple, il n'est pas possible d'insérer ou de mettre à jour une valeur de champ lorsqu'elle n'était pas destinée à faire partie de cette action.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.3", - "section_name": "Développement défensif", - "req_id": "V15.3.4", - "req_description": "Vérifiez que tous les composants proxy et middleware transfèrent correctement l'adresse IP d'origine de l'utilisateur à l'aide de champs de données fiables qui ne peuvent pas être manipulés par l'utilisateur final, et que l'application et le serveur Web utilisent cette valeur correcte pour la journalisation et les décisions de sécurité telles que la limitation du débit, en tenant compte du fait que même l'adresse IP d'origine peut ne pas être fiable en raison d'adresses IP dynamiques, de VPN ou de pare-feu d'entreprise.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.3", - "section_name": "Développement défensif", - "req_id": "V15.3.5", - "req_description": "Vérifiez que l'application garantit explicitement que les variables sont du type correct et effectue des opérations d'égalité et de comparaison strictes. Cela permet d'éviter les vulnérabilités liées à la confusion de types, causées par des hypothèses du code de l'application sur le type d'une variable.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.3", - "section_name": "Développement défensif", - "req_id": "V15.3.6", - "req_description": "Vérifiez que le code JavaScript est écrit de manière à éviter la pollution du prototype, par exemple en utilisant Set() ou Map() au lieu de littéraux d'objet.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.3", - "section_name": "Développement défensif", - "req_id": "V15.3.7", - "req_description": "Vérifiez que l'application dispose de défenses contre les attaques de pollution des paramètres HTTP, en particulier si le Framework d'application ne fait aucune distinction quant à la source des paramètres de requête (chaîne de requête, paramètres de corps, cookies ou champs d'en-tête).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.4", - "section_name": "Concurrence sécurisée", - "req_id": "V15.4.1", - "req_description": "Vérifiez que les objets partagés dans le code multithread (tels que les caches, les fichiers ou les objets en mémoire accessibles par plusieurs threads) sont accessibles en toute sécurité à l'aide de types thread-safe et de mécanismes de synchronisation tels que des verrous ou des sémaphores pour éviter les conditions de concurrence et la corruption des données.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.4", - "section_name": "Concurrence sécurisée", - "req_id": "V15.4.2", - "req_description": "Vérifiez que les vérifications de l'état d'une ressource, comme son existence ou ses autorisations, et des actions qui en dépendent, sont effectuées en une seule opération atomique afin d'éviter les situations de concurrence entre le moment de la vérification et le moment de l'utilisation (TOCTOU). Par exemple, vérifier l'existence d'un fichier avant de l'ouvrir ou l'accès d'un utilisateur avant de l'accorder.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.4", - "section_name": "Concurrence sécurisée", - "req_id": "V15.4.3", - "req_description": "Vérifiez que les verrous sont utilisés de manière cohérente pour éviter que les threads ne se bloquent, que ce soit en s'attendant les uns les autres ou en réessayant sans fin, et que la logique de verrouillage reste dans le code responsable de la gestion de la ressource pour garantir que les verrous ne peuvent pas être modifiés par inadvertance ou de manière malveillante par des classes ou du code externes.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Développement et architecture sécurisés", - "section_id": "V15.4", - "section_name": "Concurrence sécurisée", - "req_id": "V15.4.4", - "req_description": "Vérifiez que les politiques d'allocation des ressources empêchent la saturation de threads en garantissant un accès équitable aux ressources, par exemple en exploitant les pools de threads, permettant aux threads de priorité inférieure de continuer dans un délai raisonnable.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.1", - "section_name": "Documentation sur la journalisation de sécurité", - "req_id": "V16.1.1", - "req_description": "Vérifiez qu'il existe un inventaire documentant la journalisation effectuée à chaque couche de la pile technologique de l'application, les événements enregistrés, les formats de journal, l'endroit où cette journalisation est stockée, la manière dont elle est utilisée, la manière dont l'accès à celle-ci est contrôlé et la durée de conservation des journaux.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.2", - "section_name": "Journalisation générale", - "req_id": "V16.2.1", - "req_description": "Vérifiez que chaque entrée de journal inclut les métadonnées nécessaires (telles que quand, où, qui, quoi) qui permettraient une enquête détaillée sur la chronologie lorsqu'un événement se produit.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.2", - "section_name": "Journalisation générale", - "req_id": "V16.2.2", - "req_description": "Vérifiez que les sources de temps de tous les composants de journalisation sont synchronisées et que les horodatages des métadonnées des événements de sécurité utilisent le temps UTC ou incluent un décalage horaire explicite. L'UTC est recommandé pour garantir la cohérence entre les systèmes distribués et éviter toute confusion lors du passage à l'heure d'été.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.2", - "section_name": "Journalisation générale", - "req_id": "V16.2.3", - "req_description": "Vérifiez que l’application stocke ou diffuse uniquement les journaux vers les fichiers et services documentés dans l’inventaire des journaux.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.2", - "section_name": "Journalisation générale", - "req_id": "V16.2.4", - "req_description": "Vérifiez que les journaux peuvent être lus et corrélés par le processeur de journaux utilisé, de préférence en utilisant un format de journalisation commun.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.2", - "section_name": "Journalisation générale", - "req_id": "V16.2.5", - "req_description": "Vérifiez que l'application applique la journalisation en fonction du niveau de protection des données lors de la journalisation de données sensibles. Par exemple, certaines données, comme les identifiants ou les informations de paiement, peuvent être interdites. D'autres données, comme les jetons de session, ne peuvent être enregistrées que par hachage ou masquage, en totalité ou en partie.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.3", - "section_name": "Événements de sécurité", - "req_id": "V16.3.1", - "req_description": "Vérifiez que toutes les opérations d'authentification sont enregistrées, y compris les tentatives réussies et infructueuses. Des métadonnées supplémentaires, telles que le type d'authentification ou les facteurs utilisés, doivent également être collectées.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.3", - "section_name": "Événements de sécurité", - "req_id": "V16.3.2", - "req_description": "Vérifier que les tentatives d'autorisation infructueuses sont logguées. Pour le niveau 3, cela doit inclure la journalisation de toutes les décisions d'autorisation, y compris lors de l'accès à des données sensibles (sans journalisation des données sensibles elles-mêmes).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.3", - "section_name": "Événements de sécurité", - "req_id": "V16.3.3", - "req_description": "Vérifiez que l'application enregistre les événements de sécurité définis dans la documentation et enregistre également les tentatives de contournement des contrôles de sécurité, tels que la validation des entrées, la logique métier et l'anti-automatisation.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.3", - "section_name": "Événements de sécurité", - "req_id": "V16.3.4", - "req_description": "Vérifiez que l’application enregistre les erreurs inattendues et les échecs de contrôle de sécurité tels que les échecs TLS du backend.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.4", - "section_name": "Protection des journaux", - "req_id": "V16.4.1", - "req_description": "Vérifiez que tous les composants de journalisation codent correctement les données pour empêcher l’injection de journaux.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.4", - "section_name": "Protection des journaux", - "req_id": "V16.4.2", - "req_description": "Vérifiez que les journaux sont protégés contre tout accès non autorisé et ne peuvent pas être modifiés.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.4", - "section_name": "Protection des journaux", - "req_id": "V16.4.3", - "req_description": "Vérifiez que les journaux sont transmis de manière sécurisée à un système logique distinct pour analyse, détection, alerte et remontée des informations. L'objectif est de garantir qu'en cas de violation de l'application, les journaux ne seront pas compromis.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.5", - "section_name": "Gestion des erreurs", - "req_id": "V16.5.1", - "req_description": "Vérifiez qu'un message générique est renvoyé au consommateur lorsqu'une erreur inattendue ou sensible à la sécurité se produit, garantissant ainsi l'absence d'exposition de données système internes sensibles telles que les traces de pile, les requêtes, les clés secrètes et les jetons.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.5", - "section_name": "Gestion des erreurs", - "req_id": "V16.5.2", - "req_description": "Vérifiez que l'application continue de fonctionner en toute sécurité lorsque l'accès aux ressources externes échoue, par exemple, en utilisant des modèles tels que des disjoncteurs ou une dégradation progressive.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.5", - "section_name": "Gestion des erreurs", - "req_id": "V16.5.3", - "req_description": "Vérifiez que l'application échoue proprement et sécurisée, y compris lorsqu'une exception se produit, en évitant les accès en cas d'erreur telles que le traitement d'une transaction malgré les erreurs résultant de la logique de validation.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Journalisation de sécurité et gestion des erreurs", - "section_id": "V16.5", - "section_name": "Gestion des erreurs", - "req_id": "V16.5.4", - "req_description": "Vérifiez qu'un gestionnaire d'erreurs de « dernier recours » est défini pour intercepter toutes les exceptions non gérées. Cela permet d'éviter la perte des informations d'erreur qui doivent être loguées dans les fichiers journaux et de garantir qu'une erreur ne paralyse pas l'ensemble du processus applicatif, entraînant une perte de disponibilité.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.1", - "section_name": "Serveur TURN", - "req_id": "V17.1.1", - "req_description": "Vérifiez que le service TURN (Traversal Using Relays around NAT) autorise uniquement l'accès aux adresses IP non réservées à des fins spécifiques (par exemple, réseaux internes, diffusion, bouclage). Notez que cela s'applique aux adresses IPv4 et IPv6.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.1", - "section_name": "Serveur TURN", - "req_id": "V17.1.2", - "req_description": "Vérifiez que le service Traversal Using Relays around NAT (TURN) n'est pas susceptible d'épuiser ses ressources lorsque des utilisateurs légitimes tentent d'ouvrir un grand nombre de ports sur le serveur TURN.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Média", - "req_id": "V17.2.1", - "req_description": "Vérifiez que la clé du certificat Datagram Transport Layer Security (DTLS) est gérée et protégée conformément à la politique documentée de gestion des clés cryptographiques.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Média", - "req_id": "V17.2.2", - "req_description": "Vérifiez que le serveur multimédia est configuré pour utiliser et prendre en charge les suites de chiffrement DTLS (Datagram Transport Layer Security) approuvées et un profil de protection sécurisé pour l'extension DTLS pour l'établissement de clés pour le protocole de transport en temps réel sécurisé (DTLS-SRTP).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Média", - "req_id": "V17.2.3", - "req_description": "Vérifiez que l'authentification SRTP (Secure Real-time Transport Protocol) est vérifiée sur le serveur multimédia pour empêcher les attaques par injection RTP (Real-time Transport Protocol) d'entraîner une condition de déni de service ou l'insertion de médias audio ou vidéo dans les flux multimédias.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Média", - "req_id": "V17.2.4", - "req_description": "Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant lorsqu'il rencontre des paquets SRTP (Secure Real-time Transport Protocol) mal formés.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Média", - "req_id": "V17.2.5", - "req_description": "Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Média", - "req_id": "V17.2.6", - "req_description": "Vérifiez que le serveur multimédia n'est pas sensible à la vulnérabilité de condition de concurrence « ClientHello » dans Datagram Transport Layer Security (DTLS) en vérifiant si le serveur multimédia est publiquement connu comme étant vulnérable ou en effectuant le test de condition de concurrence.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Média", - "req_id": "V17.2.7", - "req_description": "Vérifiez que tous les mécanismes d'enregistrement audio ou vidéo associés au serveur multimédia sont en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Média", - "req_id": "V17.2.8", - "req_description": "Vérifiez que le certificat Datagram Transport Layer Security (DTLS) est vérifié par rapport à l'attribut d'empreinte cryptographique du protocole de description de session (SDP), en mettant fin au flux multimédia si la vérification échoue, pour garantir l'authenticité du flux multimédia.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.3", - "section_name": "Signalisation", - "req_id": "V17.3.1", - "req_description": "Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation entrants légitimes lors d'une attaque par saturation. Cela peut être réalisé en implémentant une limitation de débit au niveau de la signalisation.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.3", - "section_name": "Signalisation", - "req_id": "V17.3.2", - "req_description": "Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation légitimes en cas de message mal formé susceptible de provoquer un déni de service. Cela peut inclure la validation des entrées, la gestion sécurisée des dépassements d'entiers, la prévention des dépassements de tampon et l'utilisation d'autres techniques robustes de gestion des erreurs.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - } - ] -} diff --git a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.json b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.json deleted file mode 100644 index dc558e6b1a..0000000000 --- a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.json +++ /dev/null @@ -1,2774 +0,0 @@ -{ - "Name": "Application Security Verification Standard Project", - "ShortName": "ASVS", - "Version": "5.0.0", - "Description": "The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.", - "Requirements": [ - { - "Shortcode": "V1", - "Ordinal": 1, - "ShortName": "Encoding", - "Name": "Encodage et nettoyage", - "Items": [ - { - "Shortcode": "V1.1", - "Ordinal": 1, - "Name": "Architecture d'encodage et de nettoyage", - "Items": [ - { - "Shortcode": "V1.1.1", - "Ordinal": 1, - "Description": "Vérifiez que l'entrée est décodée ou non échappée vers une forme canonique une seule fois, elle n'est décodée que lorsque des données codées sous cette forme sont attendues, et que cela est fait avant de traiter davantage l'entrée, par exemple, elle n'est pas effectuée après la validation ou la désinfection de l'entrée.", - "L": "2" - }, - { - "Shortcode": "V1.1.2", - "Ordinal": 2, - "Description": "Vérifiez que l'application effectue l'encodage et l'échappement de sortie soit comme étape finale avant d'être utilisée par l'interpréteur pour lequel elle est destinée, soit par l'interpréteur lui-même.", - "L": "2" - } - ] - }, - { - "Shortcode": "V1.2", - "Ordinal": 2, - "Name": "Prévention des injections", - "Items": [ - { - "Shortcode": "V1.2.1", - "Ordinal": 1, - "Description": "Vérifiez que l'encodage de sortie d'une réponse HTTP, d'un document HTML ou d'un document XML est pertinent pour le contexte requis, comme l'encodage des caractères pertinents pour les éléments HTML, les attributs HTML, les commentaires HTML, les CSS ou les champs d'en-tête HTTP, pour éviter de modifier la structure du message ou du document.", - "L": "1" - }, - { - "Shortcode": "V1.2.2", - "Ordinal": 2, - "Description": "Vérifiez que, lors de la création dynamique d'URL, les données non fiables sont encodées en fonction de leur contexte (par exemple, encodage d'URL ou encodage base64url pour les paramètres de requête ou de chemin). Assurez-vous que seuls les schémas d'URL sûrs sont autorisés (par exemple, interdire javascript: ou data:).", - "L": "1" - }, - { - "Shortcode": "V1.2.3", - "Ordinal": 3, - "Description": "Vérifiez que l'encodage ou l'échappement de sortie est utilisé lors de la création dynamique de contenu JavaScript (y compris JSON), pour éviter de modifier la structure du message ou du document (pour éviter l'injection JavaScript et JSON).", - "L": "1" - }, - { - "Shortcode": "V1.2.4", - "Ordinal": 4, - "Description": "Vérifiez que la sélection de données ou les requêtes de base de données (par exemple, SQL, HQL, NoSQL, Cypher) utilisent des requêtes paramétrées, des ORM, des Framework d'entités ou sont protégées contre les injections SQL et autres attaques par injection de base de données. Ceci est également pertinent lors de l'écriture de procédures stockées.", - "L": "1" - }, - { - "Shortcode": "V1.2.5", - "Ordinal": 5, - "Description": "Vérifiez que l’application protège contre l’injection de commandes du système d’exploitation et que les appels du système d’exploitation utilisent des requêtes du système d’exploitation paramétrées ou utilisent un encodage de sortie de ligne de commande contextuelle.", - "L": "1" - }, - { - "Shortcode": "V1.2.6", - "Ordinal": 6, - "Description": "Vérifiez que l’application protège contre les vulnérabilités d’injection LDAP ou que des contrôles de sécurité spécifiques pour empêcher l’injection LDAP ont été mis en œuvre.", - "L": "2" - }, - { - "Shortcode": "V1.2.7", - "Ordinal": 7, - "Description": "Vérifiez que l’application est protégée contre les attaques par injection XPath en utilisant la paramétrisation des requêtes ou des requêtes précompilées.", - "L": "2" - }, - { - "Shortcode": "V1.2.8", - "Ordinal": 8, - "Description": "Vérifiez que les processeurs LaTeX sont configurés de manière sécurisée (par exemple, en n'utilisant pas l'indicateur « --shell-escape ») et qu'une liste d’autorisations de commandes est utilisée pour empêcher les attaques par injection LaTeX.", - "L": "2" - }, - { - "Shortcode": "V1.2.9", - "Ordinal": 9, - "Description": "Vérifiez que l'application échappe les caractères spéciaux dans les expressions régulières (généralement à l'aide d'une barre oblique inverse) pour éviter qu'ils ne soient mal interprétés comme des métacaractères.", - "L": "2" - }, - { - "Shortcode": "V1.2.10", - "Ordinal": 10, - "Description": "Vérifiez que l'application est protégée contre les injections CSV et injections de formules. L'application doit respecter les règles d'échappement définies dans les sections 2.6 et 2.7 de la RFC 4180 lors de l'export de contenu CSV. De plus, lors de l'export au format CSV ou vers d'autres formats de tableur (tels que XLS, XLSX ou ODF), les caractères spéciaux (notamment « = », « + », « - », « @ », « \\t » (tabulation) et « \\0 » (caractère null)) doivent être protégés par une apostrophe s'ils apparaissent en premier dans une valeur de champ.", - "L": "3" - } - ] - }, - { - "Shortcode": "V1.3", - "Ordinal": 3, - "Name": "Nettoyage", - "Items": [ - { - "Shortcode": "V1.3.1", - "Ordinal": 1, - "Description": "Vérifiez que toutes les entrées HTML non fiables provenant d'éditeurs WYSIWYG ou similaires sont nettoyées à l'aide d'une bibliothèque ou d'une fonctionnalité de Framework de nettoyage HTML bien connue et sécurisée.", - "L": "1" - }, - { - "Shortcode": "V1.3.2", - "Ordinal": 2, - "Description": "Vérifiez que l'application évite d'utiliser eval() ou d'autres fonctionnalités d'exécution de code dynamique telles que Spring Expression Language (SpEL). En l'absence d'alternative, toute saisie utilisateur incluse doit être nettoyée avant d'être exécutée.", - "L": "1" - }, - { - "Shortcode": "V1.3.3", - "Ordinal": 3, - "Description": "Vérifiez que les données transmises à un contexte potentiellement dangereux sont préalablement nettoyées pour appliquer des mesures de sécurité, telles qu'autoriser uniquement des caractères sûrs pour ce contexte et raccourcir des entrées trop longues.", - "L": "2" - }, - { - "Shortcode": "V1.3.4", - "Ordinal": 4, - "Description": "Vérifiez que le contenu Scalable Vector Graphics (SVG) scriptable fourni par l'utilisateur est validé ou nettoyé pour contenir uniquement des balises et des attributs (tels que des graphiques de dessin) qui sont sûrs pour l'application, par exemple, ne contiennent pas de scripts et d'objets étrangers.", - "L": "2" - }, - { - "Shortcode": "V1.3.5", - "Ordinal": 5, - "Description": "Vérifiez que l'application nettoie ou désactive le contenu du langage de modèle d'expression ou de script fourni par l'utilisateur, tel que les feuilles de style CSS, le Markdown ou XSL, BBCode ou similaire.", - "L": "2" - }, - { - "Shortcode": "V1.3.6", - "Ordinal": 6, - "Description": "Vérifiez que l'application protège contre les attaques de falsification de requête côté serveur (SSRF), en validant les données non fiables par rapport à une liste d'autorisation de protocoles, de domaines, de chemins et de ports et en nettoyant les caractères potentiellement dangereux avant d'utiliser les données pour appeler un autre service.", - "L": "2" - }, - { - "Shortcode": "V1.3.7", - "Ordinal": 7, - "Description": "Vérifiez que l'application se protège contre les attaques par injection de modèles en interdisant la création de modèles basés sur des entrées non fiables. En l'absence d'alternative, toute entrée non fiable incluse dynamiquement lors de la création du modèle doit être nettoyée ou rigoureusement validée.", - "L": "2" - }, - { - "Shortcode": "V1.3.8", - "Ordinal": 8, - "Description": "Vérifiez que l’application nettoie correctement les entrées non fiables avant utilisation dans les requêtes Java Naming and Directory Interface (JNDI) et que JNDI est configuré de manière sécurisée pour empêcher les attaques par injection JNDI.", - "L": "2" - }, - { - "Shortcode": "V1.3.9", - "Ordinal": 9, - "Description": "Vérifiez que l’application nettoie le contenu avant qu’il ne soit envoyé à memcache pour éviter les attaques par injection.", - "L": "2" - }, - { - "Shortcode": "V1.3.10", - "Ordinal": 10, - "Description": "Vérifiez que les chaînes de format susceptibles d'être résolues de manière inattendue ou malveillante lors de leur utilisation sont nettoyées avant d'être traitées.", - "L": "2" - }, - { - "Shortcode": "V1.3.11", - "Ordinal": 11, - "Description": "Vérifiez que l'application nettoie les entrées utilisateur avant de les transmettre aux systèmes de messagerie pour se protéger contre l'injection SMTP ou IMAP.", - "L": "2" - }, - { - "Shortcode": "V1.3.12", - "Ordinal": 12, - "Description": "Vérifiez que les expressions régulières sont exemptes d'éléments provoquant \"backtracking\" exponentiel et assurez-vous que les entrées non fiables sont nettoyées pour atténuer les attaques ReDoS ou Runaway Regex.", - "L": "3" - } - ] - }, - { - "Shortcode": "V1.4", - "Ordinal": 4, - "Name": "Mémoire, chaine de caractères et code à mémoire non-managée", - "Items": [ - { - "Shortcode": "V1.4.1", - "Ordinal": 1, - "Description": "Vérifiez que l'application utilise des chaînes memory-safe, une copie de mémoire et une arithmétique de pointeur renforcée pour détecter ou empêcher les débordements de pile, de tampon ou de tas.", - "L": "2" - }, - { - "Shortcode": "V1.4.2", - "Ordinal": 2, - "Description": "Vérifiez que les techniques de validation du signe, de la plage et de l’entrée sont utilisées pour éviter les dépassements d’entiers.", - "L": "2" - }, - { - "Shortcode": "V1.4.3", - "Ordinal": 3, - "Description": "Vérifiez que la mémoire et les ressources allouées dynamiquement sont libérées et que les références ou les pointeurs vers la mémoire libérée sont supprimés ou définis à null pour éviter les \"dangling pointer\" et les vulnérabilités d'utilisation après libération.", - "L": "2" - } - ] - }, - { - "Shortcode": "V1.5", - "Ordinal": 5, - "Name": "Désérialisation sécurisée", - "Items": [ - { - "Shortcode": "V1.5.1", - "Ordinal": 1, - "Description": "Vérifiez que l'application configure les \"parser\" XML pour utiliser une configuration restrictive et que les fonctionnalités non sûres telles que la résolution d'entités externes sont désactivées pour empêcher les attaques XML eXternal Entity (XXE).", - "L": "1" - }, - { - "Shortcode": "V1.5.2", - "Ordinal": 2, - "Description": "Vérifiez que la désérialisation des données non fiables garantit une gestion sécurisée des entrées, par exemple en utilisant une liste d'autorisation de types d'objets ou en limitant les types d'objets définis par le client, afin d'empêcher les attaques par désérialisation. Les mécanismes de désérialisation explicitement définis comme non sécurisés ne doivent pas être utilisés avec des entrées non fiables.", - "L": "2" - }, - { - "Shortcode": "V1.5.3", - "Ordinal": 3, - "Description": "Vérifiez que les différents \"parser\" utilisés dans l'application pour le même type de données (par exemple, les \"parser\" JSON, les \"parser\" XML, les \"parser\" d'URL) effectuent l'analyse de manière cohérente et utilisent le même mécanisme d'encodage de caractères pour éviter des problèmes tels que les vulnérabilités d'interopérabilité JSON ou un comportement d'analyse d'URI ou de fichier différent exploité dans les attaques d'inclusion de fichiers à distance (RFI) ou de falsification de requête côté serveur (SSRF).", - "L": "3" - } - ] - } - ] - }, - { - "Shortcode": "V2", - "Ordinal": 2, - "ShortName": "Validation", - "Name": "Validation et logique métier", - "Items": [ - { - "Shortcode": "V2.1", - "Ordinal": 1, - "Name": "Validation et documentation de la logique métier", - "Items": [ - { - "Shortcode": "V2.1.1", - "Ordinal": 1, - "Description": "Vérifiez que la documentation de l'application définit des règles de validation des entrées pour vérifier la validité des éléments de données par rapport à la structure attendue. Il peut s'agir de formats de données courants tels que des numéros de carte de crédit, des adresses e-mail ou des numéros de téléphone, ou d'un format de données interne.", - "L": "1" - }, - { - "Shortcode": "V2.1.2", - "Ordinal": 2, - "Description": "Vérifiez que la documentation de l'application définit comment valider la cohérence logique et contextuelle des éléments de données combinés, par exemple en vérifiant que la banlieue et le code postal correspondent.", - "L": "2" - }, - { - "Shortcode": "V2.1.3", - "Ordinal": 3, - "Description": "Vérifiez que les attentes en matière de limites et de validations de la logique métier sont documentées, y compris par utilisateur et globalement dans l'application.", - "L": "2" - } - ] - }, - { - "Shortcode": "V2.2", - "Ordinal": 2, - "Name": "Validation des entrées", - "Items": [ - { - "Shortcode": "V2.2.1", - "Ordinal": 1, - "Description": "Vérifier que les entrées sont validées afin de respecter les attentes métier ou fonctionnelles. Cette validation doit être basée sur une liste de valeurs, de modèles et de plages autorisées, ou sur la comparaison des entrées avec une structure attendue et des limites logiques selon des règles prédéfinies. Pour le niveau 1, cette validation peut se concentrer sur les entrées utilisées pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau 2, elle doit s'appliquer à toutes les entrées.", - "L": "1" - }, - { - "Shortcode": "V2.2.2", - "Ordinal": 2, - "Description": "Vérifiez que l'application est conçue pour appliquer la validation des entrées au niveau d'une couche de service de confiance. Bien que la validation côté client améliore l'ergonomie et doit être encouragée, elle ne doit pas être considérée comme un contrôle de sécurité.", - "L": "1" - }, - { - "Shortcode": "V2.2.3", - "Ordinal": 3, - "Description": "Vérifiez que l’application garantit que les combinaisons d’éléments de données associés sont raisonnables selon les règles prédéfinies.", - "L": "2" - } - ] - }, - { - "Shortcode": "V2.3", - "Ordinal": 3, - "Name": "Sécurité de la logique métier", - "Items": [ - { - "Shortcode": "V2.3.1", - "Ordinal": 1, - "Description": "Vérifiez que l’application traitera uniquement les flux de logique métier pour le même utilisateur dans l’ordre séquentiel attendu et sans sauter d’étapes.", - "L": "1" - }, - { - "Shortcode": "V2.3.2", - "Ordinal": 2, - "Description": "Vérifiez que les limites de la logique métier sont implémentées conformément à la documentation de l'application, afin d'éviter que des failles de la logique métier ne soient pas exploitées.", - "L": "2" - }, - { - "Shortcode": "V2.3.3", - "Ordinal": 3, - "Description": "Vérifiez que les transactions sont utilisées au niveau de la logique métier de telle sorte qu'une opération de logique métier réussisse dans son intégralité ou qu'elle soit restaurée à l'état correct précédent.", - "L": "2" - }, - { - "Shortcode": "V2.3.4", - "Ordinal": 4, - "Description": "Vérifiez que les mécanismes de verrouillage au niveau de la logique métier sont utilisés pour garantir que les ressources en quantité limitée (telles que les sièges de théâtre ou les créneaux de livraison) ne peuvent pas être réservées deux fois en manipulant la logique de l'application.", - "L": "2" - }, - { - "Shortcode": "V2.3.5", - "Ordinal": 5, - "Description": "Vérifiez que les flux logiques métier à forte valeur ajoutée nécessitent l'approbation de plusieurs utilisateurs afin d'éviter toute action non autorisée ou accidentelle. Cela peut inclure, sans s'y limiter, les transferts monétaires importants, les approbations de contrats, l'accès à des informations classifiées ou les contournements de sécurité dans le secteur manufacturier.", - "L": "3" - } - ] - }, - { - "Shortcode": "V2.4", - "Ordinal": 4, - "Name": "Anti-automatisation", - "Items": [ - { - "Shortcode": "V2.4.1", - "Ordinal": 1, - "Description": "Vérifiez que des contrôles anti-automatisation sont en place pour protéger contre les appels excessifs aux fonctions d'application qui pourraient conduire à l'exfiltration de données, à la création de données inutiles, à l'épuisement des quotas, aux violations de limites de débit, au déni de service ou à la surutilisation de ressources coûteuses.", - "L": "2" - }, - { - "Shortcode": "V2.4.2", - "Ordinal": 2, - "Description": "Vérifiez que les flux logiques métier nécessitent un timing humain réaliste, évitant ainsi des soumissions de transactions excessivement rapides.", - "L": "3" - } - ] - } - ] - }, - { - "Shortcode": "V3", - "Ordinal": 3, - "ShortName": "Web", - "Name": "Sécurité du frontend Web", - "Items": [ - { - "Shortcode": "V3.1", - "Ordinal": 1, - "Name": "Documentation sur la sécurité du frontend Web", - "Items": [ - { - "Shortcode": "V3.1.1", - "Ordinal": 1, - "Description": "Vérifiez que la documentation de l'application indique les fonctionnalités de sécurité attendues que les navigateurs utilisant l'application doivent prendre en charge (telles que HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) et autres mécanismes de sécurité HTTP pertinents). Elle doit également définir le comportement de l'application lorsque certaines de ces fonctionnalités ne sont pas disponibles (par exemple, avertir l'utilisateur ou bloquer l'accès).", - "L": "3" - } - ] - }, - { - "Shortcode": "V3.2", - "Ordinal": 2, - "Name": "Interprétation non intentionnelle du contenu", - "Items": [ - { - "Shortcode": "V3.2.1", - "Ordinal": 1, - "Description": "Vérifiez que des contrôles de sécurité sont en place pour empêcher les navigateurs d'afficher du contenu ou des fonctionnalités dans les réponses HTTP dans un contexte incorrect (par exemple, lorsqu'une API, un fichier téléchargé par l'utilisateur ou une autre ressource est demandée directement). Les contrôles possibles peuvent inclure : ne pas transmettre le contenu sauf si les champs d'en-tête de requête HTTP (tels que Sec-Fetch-\\*) indiquent qu'il s'agit du contexte correct, utiliser la directive sandbox du champ d'en-tête Content-Security-Policy ou utiliser le type de disposition de pièce jointe dans le champ d'en-tête Content-Disposition.", - "L": "1" - }, - { - "Shortcode": "V3.2.2", - "Ordinal": 2, - "Description": "Vérifiez que le contenu destiné à être affiché sous forme de texte, plutôt que rendu sous forme de HTML, est géré à l'aide de fonctions de rendu sécurisées (telles que createTextNode ou textContent) pour empêcher l'exécution involontaire de contenu tel que HTML ou JavaScript.", - "L": "1" - }, - { - "Shortcode": "V3.2.3", - "Ordinal": 3, - "Description": "Vérifiez que l'application évite l'écrasement du DOM lors de l'utilisation de JavaScript côté client en utilisant des déclarations de variables explicites, en effectuant une vérification de type stricte, en évitant de stocker des variables globales sur l'objet document et en implémentant l'isolation de l'espace de nommage.", - "L": "3" - } - ] - }, - { - "Shortcode": "V3.3", - "Ordinal": 3, - "Name": "Configuration des cookies", - "Items": [ - { - "Shortcode": "V3.3.1", - "Ordinal": 1, - "Description": "Vérifiez que les cookies ont l'attribut « Secure » ​​défini et si le préfixe « \\__Host- » n'est pas utilisé pour le nom du cookie, le préfixe « __Secure- » doit être utilisé pour le nom du cookie.", - "L": "1" - }, - { - "Shortcode": "V3.3.2", - "Ordinal": 2, - "Description": "Vérifiez que la valeur de l'attribut « SameSite » de chaque cookie est définie en fonction de l'objectif du cookie, afin de limiter l'exposition aux attaques de réparation de l'interface utilisateur et aux attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).", - "L": "2" - }, - { - "Shortcode": "V3.3.3", - "Ordinal": 3, - "Description": "Vérifiez que les cookies ont le préfixe « __Host- » pour le nom du cookie, sauf s'ils sont explicitement conçus pour être partagés avec d'autres hôtes.", - "L": "2" - }, - { - "Shortcode": "V3.3.4", - "Ordinal": 4, - "Description": "Vérifiez que si la valeur d'un cookie n'est pas censée être accessible aux scripts côté client (comme un jeton de session), le cookie doit avoir l'attribut « HttpOnly » défini et la même valeur (par exemple, un jeton de session) ne doit être transférée au client que via le champ d'en-tête « Set-Cookie ».", - "L": "2" - }, - { - "Shortcode": "V3.3.5", - "Ordinal": 5, - "Description": "Vérifiez que lorsque l'application écrit un cookie, la longueur combinée du nom et de la valeur du cookie ne dépasse pas 4 096 octets. Les cookies trop volumineux ne seront pas stockés par le navigateur et ne seront donc pas envoyés avec les requêtes, empêchant ainsi l'utilisateur d'utiliser les fonctionnalités de l'application qui reposent sur ce cookie.", - "L": "3" - } - ] - }, - { - "Shortcode": "V3.4", - "Ordinal": 4, - "Name": "En-têtes du mécanisme de sécurité du navigateur", - "Items": [ - { - "Shortcode": "V3.4.1", - "Ordinal": 1, - "Description": "Vérifiez qu'un champ d'en-tête Strict-Transport-Security est inclus dans toutes les réponses afin d'appliquer une politique HTTP Strict Transport Security (HSTS). Une durée maximale d'au moins un an doit être définie, et pour les niveaux L2 et supérieurs, la politique doit également s'appliquer à tous les sous-domaines.", - "L": "1" - }, - { - "Shortcode": "V3.4.2", - "Ordinal": 2, - "Description": "Vérifiez que le champ d'en-tête Access-Control-Allow-Origin du partage de ressources cross-origine (CORS) est une valeur fixe de l'application ou, si la valeur du champ d'en-tête de requête HTTP Origin est utilisée, qu'elle est validée par rapport à une liste d'origines approuvées. Si « Access-Control-Allow-Origin: * » doit être utilisé, vérifiez que la réponse ne contient aucune information sensible.", - "L": "1" - }, - { - "Shortcode": "V3.4.3", - "Ordinal": 3, - "Description": "Vérifiez que les réponses HTTP incluent un champ d'en-tête de réponse Content-Security-Policy qui définit des directives garantissant que le navigateur charge et exécute uniquement du contenu ou des ressources fiables, afin de limiter l'exécution de JavaScript malveillant. Au minimum, une politique globale doit être utilisée, incluant les directives object-src 'none' et base-uri 'none', et définissant soit une lliste d’autorisations, soit des valeurs nonces ou des hachages. Pour une application L3, une politique par réponse avec des valeurs nonces ou des hachages doit être définie.", - "L": "2" - }, - { - "Shortcode": "V3.4.4", - "Ordinal": 4, - "Description": "Vérifiez que toutes les réponses HTTP contiennent un champ d'en-tête « X-Content-Type-Options: nosniff ». Cela indique aux navigateurs de ne pas utiliser l'analyse de contenu ni la détection du type MIME pour la réponse donnée, et d'exiger que la valeur du champ d'en-tête « Content-Type » de la réponse corresponde à la ressource de destination. Par exemple, la réponse à une demande de style n'est acceptée que si le type de contenu de la réponse est « text/css ». Cela permet également au navigateur d'utiliser la fonctionnalité de blocage de lecture inter-origines (CORB).", - "L": "2" - }, - { - "Shortcode": "V3.4.5", - "Ordinal": 5, - "Description": "Vérifiez que l'application définit une politique de référencement afin d'empêcher la fuite de données techniquement sensibles vers des services tiers via le champ d'en-tête de requête HTTP « Referer ». Cela peut être effectué via le champ d'en-tête de réponse HTTP « Referrer-Policy » ou via les attributs d'élément HTML. Les données sensibles peuvent inclure le chemin d'accès et les données de requête dans l'URL, et pour les applications internes non publiques, le nom d'hôte.", - "L": "2" - }, - { - "Shortcode": "V3.4.6", - "Ordinal": 6, - "Description": "Vérifiez que l'application Web utilise la directive frame-ancestors du champ d'en-tête Content-Security-Policy pour chaque réponse HTTP afin de garantir qu'elle ne peut pas être intégrée par défaut et que l'intégration de ressources spécifiques n'est autorisée qu'en cas de nécessité. Notez que le champ d'en-tête X-Frame-Options, bien que pris en charge par les navigateurs, est obsolète et n'est pas forcément fiable.", - "L": "2" - }, - { - "Shortcode": "V3.4.7", - "Ordinal": 7, - "Description": "Vérifiez que le champ d’en-tête Content-Security-Policy spécifie un emplacement pour signaler les violations.", - "L": "3" - }, - { - "Shortcode": "V3.4.8", - "Ordinal": 8, - "Description": "Vérifiez que toutes les réponses HTTP qui lancent le rendu d'un document (comme les réponses de type text/html) incluent le champ d'en-tête 'Cross-Origin-Opener-Policy' avec la directive 'same-origin' ou s'ame-origin-allow-popups', selon les besoins. Cela empêche les attaques abusant de l'accès partagé aux objets Window, telles que le tabnabbing et le comptage d'images.", - "L": "3" - } - ] - }, - { - "Shortcode": "V3.5", - "Ordinal": 5, - "Name": "Séparation de l'origine du navigateur", - "Items": [ - { - "Shortcode": "V3.5.1", - "Ordinal": 1, - "Description": "Vérifiez que, si l'application ne s'appuie pas sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher les requêtes inter-origines non autorisées d'utiliser des fonctionnalités sensibles, ces requêtes sont validées afin de garantir leur origine. Cela peut se faire en utilisant et en validant des jetons anti-falsification ou en exigeant des champs d'en-tête HTTP supplémentaires qui ne sont pas des champs d'en-tête de requête CORS safelist. Ceci permet de se protéger contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).", - "L": "1" - }, - { - "Shortcode": "V3.5.2", - "Ordinal": 2, - "Description": "Vérifiez que, si l'application s'appuie sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher l'utilisation inter-origines non autorisée de fonctionnalités sensibles, il est impossible d'appeler la fonctionnalité avec une requête qui ne déclenche pas de requête de pré-vérification cross-origin CORS. Cela peut nécessiter de vérifier les valeurs des champs d'en-tête de requête 'Origin' et 'Content-Type' ou d'utiliser un champ d'en-tête supplémentaire qui n'est pas un champ d'en-tête de la liste de sécurité CORS.", - "L": "1" - }, - { - "Shortcode": "V3.5.3", - "Ordinal": 3, - "Description": "Vérifiez que les requêtes HTTP destinées aux fonctionnalités sensibles utilisent des méthodes HTTP appropriées, telles que POST, PUT, PATCH ou DELETE, et non des méthodes définies comme « sûres » par la spécification HTTP, telles que HEAD, OPTIONS ou GET. Une validation stricte des champs d'en-tête de requête Sec-Fetch-* peut également être utilisée pour garantir que la requête ne provient pas d'un appel inter-origines inapproprié, d'une requête de navigation ou d'un chargement de ressources (comme une source d'image) inattendu.", - "L": "1" - }, - { - "Shortcode": "V3.5.4", - "Ordinal": 4, - "Description": "Vérifiez que des applications distinctes sont hébergées sur des noms d'hôte différents pour tirer parti des restrictions fournies par la politique de même origine, y compris la manière dont les documents ou scripts chargés par une origine peuvent interagir avec les ressources d'une autre origine et les restrictions basées sur le nom d'hôte sur les cookies.", - "L": "2" - }, - { - "Shortcode": "V3.5.5", - "Ordinal": 5, - "Description": "Vérifiez que les messages reçus par l'interface postMessage sont rejetés si l'origine du message n'est pas digne de confiance ou si la syntaxe du message n'est pas valide.", - "L": "2" - }, - { - "Shortcode": "V3.5.6", - "Ordinal": 6, - "Description": "Vérifiez que la fonctionnalité JSONP n'est activée nulle part dans l'application pour éviter les attaques Cross-Site Script Inclusion (XSSI).", - "L": "3" - }, - { - "Shortcode": "V3.5.7", - "Ordinal": 7, - "Description": "Vérifiez que les données nécessitant une autorisation ne sont pas incluses dans les réponses des ressources de script, comme les fichiers JavaScript, pour empêcher les attaques par inclusion de script intersite (XSSI).", - "L": "3" - }, - { - "Shortcode": "V3.5.8", - "Ordinal": 8, - "Description": "Vérifiez que les ressources authentifiées (telles que les images, les vidéos, les scripts et autres documents) peuvent être chargées ou intégrées pour le compte de l'utilisateur uniquement lorsque cela est prévu. Cela peut être réalisé en validant strictement les champs d'en-tête de requête HTTP Sec-Fetch-* afin de garantir que la requête ne provient pas d'un appel cross-origin inapproprié, ou en définissant un champ d'en-tête de réponse HTTP Cross-Origin-Resource-Policy restrictif pour indiquer au navigateur de bloquer le contenu renvoyé.", - "L": "3" - } - ] - }, - { - "Shortcode": "V3.6", - "Ordinal": 6, - "Name": "Intégrité des ressources externes", - "Items": [ - { - "Shortcode": "V3.6.1", - "Ordinal": 1, - "Description": "Vérifiez que les ressources côté client, telles que les bibliothèques JavaScript, les feuilles de style CSS ou les polices web, sont hébergées en externe (par exemple, sur un réseau de diffusion de contenu) uniquement si la ressource est statique et versionnée, et si l'intégrité des sous-ressources (SRI) est utilisée pour valider l'intégrité de la ressource. Si cela n'est pas possible, une décision de sécurité documentée doit justifier cette décision pour chaque ressource.", - "L": "3" - } - ] - }, - { - "Shortcode": "V3.7", - "Ordinal": 7, - "Name": "Autres considérations sur la sécurité du navigateur", - "Items": [ - { - "Shortcode": "V3.7.1", - "Ordinal": 1, - "Description": "Vérifiez que l'application utilise uniquement des technologies côté client toujours prises en charge et considérées comme sécurisées. Parmi les technologies qui ne répondent pas à cette exigence figurent les plugins NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL ou les applets Java côté client.", - "L": "2" - }, - { - "Shortcode": "V3.7.2", - "Ordinal": 2, - "Description": "Vérifiez que l'application redirigera automatiquement l'utilisateur vers un nom d'hôte ou un domaine différent (qui n'est pas contrôlé par l'application) uniquement lorsque la destination apparaît sur une liste d'autorisation.", - "L": "2" - }, - { - "Shortcode": "V3.7.3", - "Ordinal": 3, - "Description": "Vérifiez que le domaine de premier niveau de l'application (par exemple, site.tld) ​​est ajouté à la liste de préchargement publique pour HTTP Strict Transport Security (HSTS). Cela garantit que l'utilisation de TLS pour l'application est intégrée directement dans les principaux navigateurs, plutôt que de dépendre uniquement du champ d'en-tête de réponse Strict-Transport-Security.", - "L": "3" - }, - { - "Shortcode": "V3.7.4", - "Ordinal": 4, - "Description": "Vérifiez que l'application affiche une notification lorsque l'utilisateur est redirigé vers une URL hors du contrôle de l'application, avec une option pour annuler la navigation.", - "L": "3" - }, - { - "Shortcode": "V3.7.5", - "Ordinal": 5, - "Description": "Vérifiez que l'application se comporte comme documenté (par exemple, en avertissant l'utilisateur ou en bloquant l'accès) si le navigateur utilisé pour accéder à l'application ne prend pas en charge les fonctionnalités de sécurité attendues.", - "L": "3" - } - ] - } - ] - }, - { - "Shortcode": "V4", - "Ordinal": 4, - "ShortName": "API", - "Name": "API et service Web", - "Items": [ - { - "Shortcode": "V4.1", - "Ordinal": 1, - "Name": "Sécurité du service Web générique", - "Items": [ - { - "Shortcode": "V4.1.1", - "Ordinal": 1, - "Description": "Vérifiez que chaque réponse HTTP avec un corps de message contient un champ d'en-tête Content-Type qui correspond au contenu réel de la réponse, y compris le paramètre charset pour spécifier un codage de caractères sécurisé (par exemple, UTF-8, ISO-8859-1) conformément aux types de médias IANA, tels que « text/ », « /+xml » et « /xml ».", - "L": "1" - }, - { - "Shortcode": "V4.1.2", - "Ordinal": 2, - "Description": "Vérifiez que seuls les terminaux utilisateurs (destinés à l'accès manuel via un navigateur web) redirigent automatiquement de HTTP vers HTTPS, tandis que les autres services ou terminaux n'implémentent pas de redirections transparentes. Cela permet d'éviter qu'un client envoie par erreur des requêtes HTTP non chiffrées, mais que, comme ces requêtes sont automatiquement redirigées vers HTTPS, la fuite de données sensibles passe inaperçue.", - "L": "2" - }, - { - "Shortcode": "V4.1.3", - "Ordinal": 3, - "Description": "Vérifiez que tout champ d'en-tête HTTP utilisé par l'application et défini par une couche intermédiaire, telle qu'un équilibreur de charge, un proxy web ou un service backend-for-frontend, ne peut pas être remplacé par l'utilisateur final. Les exemples d'en-têtes peuvent inclure X-Real-IP, X-Forwarded-*, ou X-User-ID.", - "L": "2" - }, - { - "Shortcode": "V4.1.4", - "Ordinal": 4, - "Description": "Vérifiez que seules les méthodes HTTP explicitement prises en charge par l'application ou son API (y compris les OPTIONS lors des demandes de contrôle en amont) peuvent être utilisées et que les méthodes inutilisées sont bloquées.", - "L": "3" - }, - { - "Shortcode": "V4.1.5", - "Ordinal": 5, - "Description": "Vérifier que les signatures numériques par message sont utilisées pour fournir une assurance supplémentaire en plus des protections de transport pour les demandes ou les transactions qui sont très sensibles ou qui traversent un certain nombre de systèmes.", - "L": "3" - } - ] - }, - { - "Shortcode": "V4.2", - "Ordinal": 2, - "Name": "Validation de la structure des messages HTTP", - "Items": [ - { - "Shortcode": "V4.2.1", - "Ordinal": 1, - "Description": "Vérifiez que tous les composants de l'application (y compris les équilibreurs de charge, les pares-feux et les serveurs d'applications) déterminent les limites des messages HTTP entrants à l'aide du mécanisme approprié à la version HTTP afin d'empêcher la contrebande de requêtes HTTP. Dans HTTP/1.x, si un champ d'en-tête Transfer-Encoding est présent, l'en-tête Content-Length doit être ignoré conformément à la RFC 2616. Avec HTTP/2 ou HTTP/3, si un champ d'en-tête Content-Length est présent, le récepteur doit s'assurer qu'il est cohérent avec la longueur des trames DATA.", - "L": "2" - }, - { - "Shortcode": "V4.2.2", - "Ordinal": 2, - "Description": "Vérifier que, lors de la génération de messages HTTP, le champ d'en-tête Content-Length n'entre pas en conflit avec la longueur du contenu déterminée par le cadrage du protocole HTTP, afin d'empêcher les attaques de type « request smuggling ».", - "L": "3" - }, - { - "Shortcode": "V4.2.3", - "Ordinal": 3, - "Description": "Vérifiez que l'application n'envoie ni n'accepte de messages HTTP/2 ou HTTP/3 avec des champs d'en-tête spécifiques à la connexion, tels que Transfer-Encoding, afin d'éviter les attaques par fractionnement de la réponse et par injection d'en-tête.", - "L": "3" - }, - { - "Shortcode": "V4.2.4", - "Ordinal": 4, - "Description": "Vérifiez que l'application n'accepte que les requêtes HTTP/2 et HTTP/3 dont les champs et valeurs d'en-tête ne contiennent pas de séquences CR (\\r), LF (\\n) ou CRLF (\\r\\n), afin d'éviter les attaques par injection d'en-tête.", - "L": "3" - }, - { - "Shortcode": "V4.2.5", - "Ordinal": 5, - "Description": "Vérifiez que, si l'application (backend ou frontend) construit et envoie des requêtes, elle utilise des mécanismes de validation, d'assainissement ou autres pour éviter de créer des URI (comme pour les appels API) ou des champs d'en-tête de requête HTTP (comme Authorization ou Cookie) qui sont trop longs pour être acceptés par le composant récepteur. Cela pourrait entraîner un déni de service, par exemple lors de l'envoi d'une requête trop longue (par exemple, un long champ d'en-tête de cookie), ce qui fait que le serveur répond toujours avec un statut d'erreur.", - "L": "3" - } - ] - }, - { - "Shortcode": "V4.3", - "Ordinal": 3, - "Name": "GraphQL", - "Items": [ - { - "Shortcode": "V4.3.1", - "Ordinal": 1, - "Description": "Vérifiez qu'une liste d'autorisation de requête, une limitation de profondeur, une limitation de quantité ou une analyse des coûts de requête est utilisée pour empêcher le déni de service (DoS) de GraphQL ou d'expression de la couche données en raison de requêtes imbriquées coûteuses.", - "L": "2" - }, - { - "Shortcode": "V4.3.2", - "Ordinal": 2, - "Description": "Vérifiez que les requêtes d’introspection GraphQL sont désactivées dans l’environnement de production, sauf si l’API GraphQL est destinée à être utilisée par d’autres parties.", - "L": "2" - } - ] - }, - { - "Shortcode": "V4.4", - "Ordinal": 4, - "Name": "WebSocket", - "Items": [ - { - "Shortcode": "V4.4.1", - "Ordinal": 1, - "Description": "Vérifiez que WebSocket sur TLS (WSS) est utilisé pour toutes les connexions WebSocket.", - "L": "1" - }, - { - "Shortcode": "V4.4.2", - "Ordinal": 2, - "Description": "Vérifiez que, lors de la négociation HTTP WebSocket initiale, le champ d’en-tête 'Origin' est vérifié par rapport à une liste d’origines autorisées pour l’application.", - "L": "2" - }, - { - "Shortcode": "V4.4.3", - "Ordinal": 3, - "Description": "Vérifiez que, si la gestion de session standard de l'application ne peut pas être utilisée, des jetons dédiés sont utilisés à cet effet, qui sont conformes aux exigences de sécurité de gestion de session pertinentes.", - "L": "2" - }, - { - "Shortcode": "V4.4.4", - "Ordinal": 4, - "Description": "Vérifiez que les jetons de gestion de session WebSocket dédiés sont initialement obtenus ou validés via la session HTTPS précédemment authentifiée lors de la transition d'une session HTTPS existante vers un canal WebSocket.", - "L": "2" - } - ] - } - ] - }, - { - "Shortcode": "V5", - "Ordinal": 5, - "ShortName": "File", - "Name": "Gestion des fichiers", - "Items": [ - { - "Shortcode": "V5.1", - "Ordinal": 1, - "Name": "Documentation sur la gestion des fichiers", - "Items": [ - { - "Shortcode": "V5.1.1", - "Ordinal": 1, - "Description": "Vérifiez que la documentation définit les types de fichiers autorisés, les extensions de fichiers attendues et la taille maximale (y compris la taille décompressée) pour chaque fonctionnalité de Téléversement. De plus, assurez-vous que la documentation précise comment les fichiers sont sécurisés pour le téléchargement et le traitement des utilisateurs finaux, par exemple le comportement de l'application lorsqu'un fichier malveillant est détecté.", - "L": "2" - } - ] - }, - { - "Shortcode": "V5.2", - "Ordinal": 2, - "Name": "Téléversement de fichiers et contenu", - "Items": [ - { - "Shortcode": "V5.2.1", - "Ordinal": 1, - "Description": "Vérifiez que l'application n'acceptera que des fichiers d'une taille qu'elle peut traiter sans provoquer de perte de performances ou d'attaque par déni de service.", - "L": "1" - }, - { - "Shortcode": "V5.2.2", - "Ordinal": 2, - "Description": "Vérifiez que lorsque l'application accepte un fichier, seul ou dans une archive telle qu'un fichier zip, elle vérifie si l'extension de fichier correspond à une extension attendue et que le contenu correspond au type représenté par l'extension. Cela inclut, sans s'y limiter, la vérification des « octets magiques » initiaux, la réécriture d'images et l'utilisation de bibliothèques spécialisées pour la validation du contenu des fichiers. Pour le niveau L1, cela peut se concentrer uniquement sur les fichiers utilisés pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau L2, cela doit s'appliquer à tous les fichiers acceptés.", - "L": "1" - }, - { - "Shortcode": "V5.2.3", - "Ordinal": 3, - "Description": "Vérifiez que l'application vérifie les fichiers compressés (par exemple, zip, gz, docx, odt) par rapport à la taille maximale autorisée non compressée et au nombre maximal de fichiers avant de décompresser le fichier.", - "L": "2" - }, - { - "Shortcode": "V5.2.4", - "Ordinal": 4, - "Description": "Vérifiez qu'un quota de taille de fichier et un nombre maximal de fichiers par utilisateur sont appliqués pour garantir qu'un seul utilisateur ne puisse pas remplir le stockage avec trop de fichiers ou des fichiers excessivement volumineux.", - "L": "3" - }, - { - "Shortcode": "V5.2.5", - "Ordinal": 5, - "Description": "Vérifiez que l'application n'autorise pas le téléversement de fichiers compressés contenant des liens symboliques, sauf si cela est spécifiquement requis (auquel cas il sera nécessaire d'appliquer une liste d'autorisation des fichiers vers lesquels il est possible de créer des liens symboliques).", - "L": "3" - }, - { - "Shortcode": "V5.2.6", - "Ordinal": 6, - "Description": "Vérifiez que l'application rejette les images téléversées avec une taille de pixel supérieure au maximum autorisé, afin d'éviter les attaques par inondation de pixels.", - "L": "3" - } - ] - }, - { - "Shortcode": "V5.3", - "Ordinal": 3, - "Name": "Stockage de fichiers", - "Items": [ - { - "Shortcode": "V5.3.1", - "Ordinal": 1, - "Description": "Vérifiez que les fichiers téléversés ou générés par une entrée non fiable et stockés dans un dossier public ne sont pas exécutés en tant que code de programme côté serveur lorsqu'ils sont accessibles directement avec une requête HTTP.", - "L": "1" - }, - { - "Shortcode": "V5.3.2", - "Ordinal": 2, - "Description": "Vérifiez que lorsque l'application crée des chemins d'accès pour les opérations sur les fichiers, elle utilise des données générées en interne ou fiables plutôt que des noms de fichiers soumis par l'utilisateur. Si des noms de fichiers ou des métadonnées de fichiers soumis par l'utilisateur doivent être utilisés, une validation et un nettoyage stricts doivent être appliqués. Ceci permet de se protéger contre les attaques par traversée de chemin, l'inclusion de fichiers locaux ou distants (LFI, RFI) et la falsification de requêtes côté serveur (SSRF).", - "L": "1" - }, - { - "Shortcode": "V5.3.3", - "Ordinal": 3, - "Description": "Vérifiez que le traitement des fichiers côté serveur, comme la décompression des fichiers, ignore les informations de chemin fournies par l'utilisateur pour éviter les vulnérabilités telles que le \"zip slip\".", - "L": "3" - } - ] - }, - { - "Shortcode": "V5.4", - "Ordinal": 4, - "Name": "Téléchargement de fichier", - "Items": [ - { - "Shortcode": "V5.4.1", - "Ordinal": 1, - "Description": "Vérifiez que l’application valide ou ignore les noms de fichiers soumis par l’utilisateur, y compris dans un paramètre JSON, JSONP ou URL et spécifie un nom de fichier dans le champ d’en-tête Content-Disposition de la réponse.", - "L": "2" - }, - { - "Shortcode": "V5.4.2", - "Ordinal": 2, - "Description": "Vérifiez que les noms de fichiers servis (par exemple, dans les champs d'en-tête de réponse HTTP ou les pièces jointes aux e-mails) sont encodés ou nettoyés (par exemple, conformément à la RFC 6266) pour préserver la structure du document et empêcher les attaques par injection.", - "L": "2" - }, - { - "Shortcode": "V5.4.3", - "Ordinal": 3, - "Description": "Vérifiez que les fichiers obtenus à partir de sources non fiables sont analysés par des scanners antivirus pour empêcher la diffusion de contenu malveillant connu.", - "L": "2" - } - ] - } - ] - }, - { - "Shortcode": "V6", - "Ordinal": 6, - "ShortName": "Authentication", - "Name": "Authentification", - "Items": [ - { - "Shortcode": "V6.1", - "Ordinal": 1, - "Name": "Documentation d'authentification", - "Items": [ - { - "Shortcode": "V6.1.1", - "Ordinal": 1, - "Description": "Vérifiez que la documentation de l'application définit comment les contrôles, tels que la limitation de débit, l'anti-automatisation et la réponse adaptative, sont utilisés pour se défendre contre les attaques telles que le « credential stuffing » et la force brute des mots de passe. La documentation doit expliquer clairement comment ces contrôles sont configurés et empêcher le blocage malveillant des comptes.", - "L": "1" - }, - { - "Shortcode": "V6.1.2", - "Ordinal": 2, - "Description": "Vérifiez qu'une liste de mots spécifiques au contexte est documentée afin d'empêcher leur utilisation dans les mots de passe. Cette liste peut inclure des permutations de noms d'organisations, de produits, d'identifiants de systèmes, de noms de codes de projets, de noms de services ou de rôles, etc.", - "L": "2" - }, - { - "Shortcode": "V6.1.3", - "Ordinal": 3, - "Description": "Vérifiez que, si l'application inclut plusieurs voies d'authentification, celles-ci sont toutes documentées avec les contrôles de sécurité et la force d'authentification qui doivent être appliqués de manière cohérente.", - "L": "2" - } - ] - }, - { - "Shortcode": "V6.2", - "Ordinal": 2, - "Name": "Sécurité des mots de passe", - "Items": [ - { - "Shortcode": "V6.2.1", - "Ordinal": 1, - "Description": "Vérifiez que les mots de passe définis par l'utilisateur comportent au moins 8 caractères, bien qu'un minimum de 15 caractères soit fortement recommandé.", - "L": "1" - }, - { - "Shortcode": "V6.2.2", - "Ordinal": 2, - "Description": "Vérifiez que les utilisateurs peuvent modifier leur mot de passe.", - "L": "1" - }, - { - "Shortcode": "V6.2.3", - "Ordinal": 3, - "Description": "Vérifiez que la fonctionnalité de changement de mot de passe nécessite le mot de passe actuel et le nouveau mot de passe de l'utilisateur.", - "L": "1" - }, - { - "Shortcode": "V6.2.4", - "Ordinal": 4, - "Description": "Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou du changement de mot de passe sont vérifiés par rapport à un ensemble disponible d'au moins 3 000 mots de passe principaux qui correspondent à la politique de mot de passe de l'application, par exemple la longueur minimale.", - "L": "1" - }, - { - "Shortcode": "V6.2.5", - "Ordinal": 5, - "Description": "Vérifiez que les mots de passe peuvent être utilisés, quelle que soit leur composition, sans restriction quant au type de caractères autorisés. Aucun nombre minimal de majuscules ou de minuscules, de chiffres ou de caractères spéciaux ne doit être exigé.", - "L": "1" - }, - { - "Shortcode": "V6.2.6", - "Ordinal": 6, - "Description": "Vérifiez que les champs de saisie du mot de passe utilisent type=password pour masquer la saisie. Les applications peuvent permettre à l'utilisateur d'afficher temporairement l'intégralité du mot de passe masqué ou le dernier caractère saisi.", - "L": "1" - }, - { - "Shortcode": "V6.2.7", - "Ordinal": 7, - "Description": "Vérifiez que la fonctionnalité « coller », les assistants de mot de passe du navigateur et les gestionnaires de mots de passe externes sont autorisés.", - "L": "1" - }, - { - "Shortcode": "V6.2.8", - "Ordinal": 8, - "Description": "Vérifiez que l'application vérifie le mot de passe de l'utilisateur exactement tel qu'il a été reçu de l'utilisateur, sans aucune modification telle qu'une troncature ou une transformation de casse.", - "L": "1" - }, - { - "Shortcode": "V6.2.9", - "Ordinal": 9, - "Description": "Vérifiez que les mots de passe d’au moins 64 caractères sont autorisés.", - "L": "2" - }, - { - "Shortcode": "V6.2.10", - "Ordinal": 10, - "Description": "Vérifiez que le mot de passe d'un utilisateur reste valide jusqu'à ce qu'il soit découvert comme compromis ou qu'il soit renouvelé. L'application ne doit pas exiger de renouvellement périodique des identifiants.", - "L": "2" - }, - { - "Shortcode": "V6.2.11", - "Ordinal": 11, - "Description": "Vérifiez que la liste documentée de mots spécifiques au contexte est utilisée pour éviter la création de mots de passe faciles à deviner.", - "L": "2" - }, - { - "Shortcode": "V6.2.12", - "Ordinal": 12, - "Description": "Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou des modifications de mot de passe sont vérifiés par rapport à un ensemble de mots de passe fuités.", - "L": "2" - } - ] - }, - { - "Shortcode": "V6.3", - "Ordinal": 3, - "Name": "Sécurité générale de l'authentification", - "Items": [ - { - "Shortcode": "V6.3.1", - "Ordinal": 1, - "Description": "Vérifiez que les contrôles visant à empêcher les attaques telles que le bourrage d'informations d'identification et la force brute des mots de passe sont mis en œuvre conformément à la documentation de sécurité de l'application.", - "L": "1" - }, - { - "Shortcode": "V6.3.2", - "Ordinal": 2, - "Description": "Vérifiez que les comptes d’utilisateur par défaut (par exemple, « root », « admin » ou « sa ») ne sont pas présents dans l’application ou sont désactivés.", - "L": "1" - }, - { - "Shortcode": "V6.3.3", - "Ordinal": 3, - "Description": "Vérifiez que l’application exige que les utilisateurs utilisent un mécanisme d’authentification multifacteur ou une combinaison de mécanismes d’authentification à facteur unique.", - "L": "2" - }, - { - "Shortcode": "V6.3.4", - "Ordinal": 4, - "Description": "Vérifiez que, si l’application inclut plusieurs voies d’authentification, il n’existe aucune voie non documentée et que les contrôles de sécurité et la force d’authentification sont appliqués de manière cohérente.", - "L": "2" - }, - { - "Shortcode": "V6.3.5", - "Ordinal": 5, - "Description": "Vérifiez que les utilisateurs sont informés des tentatives d'authentification suspectes (réussies ou non). Il peut s'agir de tentatives d'authentification provenant d'un emplacement ou d'un client inhabituel, d'une authentification partiellement réussie (un seul facteur parmi plusieurs), d'une tentative d'authentification après une longue période d'inactivité ou d'une authentification réussie après plusieurs tentatives infructueuses.", - "L": "3" - }, - { - "Shortcode": "V6.3.6", - "Ordinal": 6, - "Description": "Vérifiez que le courrier électronique n’est pas utilisé comme mécanisme d’authentification à facteur unique ou à facteurs multiples.", - "L": "3" - }, - { - "Shortcode": "V6.3.7", - "Ordinal": 7, - "Description": "Vérifiez que les utilisateurs sont avertis après les mises à jour des détails d'authentification, telles que les réinitialisations d'informations d'identification ou la modification du nom d'utilisateur ou de l'adresse e-mail.", - "L": "3" - }, - { - "Shortcode": "V6.3.8", - "Ordinal": 8, - "Description": "Vérifiez que les utilisateurs valides ne peuvent pas être déduits d'échecs d'authentification, par exemple en se basant sur des messages d'erreur, des codes de réponse HTTP ou des temps de réponse différents. Les fonctionnalités d'inscription et de mot de passe oublié doivent également bénéficier de cette protection.", - "L": "3" - } - ] - }, - { - "Shortcode": "V6.4", - "Ordinal": 4, - "Name": "Cycle de vie et récupération du facteur d'authentification", - "Items": [ - { - "Shortcode": "V6.4.1", - "Ordinal": 1, - "Description": "Vérifiez que les mots de passe initiaux ou les codes d'activation générés par le système sont générés de manière aléatoire et sécurisée, qu'ils respectent la politique de mots de passe en vigueur et qu'ils expirent après une courte période ou après leur première utilisation. Ces secrets initiaux ne doivent pas devenir des mots de passe permanents.", - "L": "1" - }, - { - "Shortcode": "V6.4.2", - "Ordinal": 2, - "Description": "Vérifiez que les indices de mot de passe ou l'authentification basée sur les connaissances (appelées « questions secrètes ») ne sont pas présents.", - "L": "1" - }, - { - "Shortcode": "V6.4.3", - "Ordinal": 3, - "Description": "Vérifiez qu'un processus sécurisé de réinitialisation d'un mot de passe oublié est mis en œuvre, qui ne contourne aucun mécanisme d'authentification multifacteur activé.", - "L": "2" - }, - { - "Shortcode": "V6.4.4", - "Ordinal": 4, - "Description": "Vérifiez que si un facteur d'authentification multifacteur est perdu, la preuve de vérification d'identité est effectuée au même niveau que lors de l'inscription.", - "L": "2" - }, - { - "Shortcode": "V6.4.5", - "Ordinal": 5, - "Description": "Vérifiez que les instructions de renouvellement des mécanismes d'authentification qui expirent sont envoyées avec suffisamment de temps pour être exécutées avant l'expiration de l'ancien mécanisme d'authentification, en configurant des rappels automatiques si nécessaire.", - "L": "3" - }, - { - "Shortcode": "V6.4.6", - "Ordinal": 6, - "Description": "Vérifiez que les administrateurs peuvent initier la réinitialisation du mot de passe de l'utilisateur, mais que cela ne leur permet pas de modifier ou de choisir son mot de passe. Cela évite qu'ils ne connaissent le mot de passe de l'utilisateur.", - "L": "3" - } - ] - }, - { - "Shortcode": "V6.5", - "Ordinal": 5, - "Name": "Exigences générales en matière d'authentification multifacteur", - "Items": [ - { - "Shortcode": "V6.5.1", - "Ordinal": 1, - "Description": "Vérifiez que les secrets de recherche, les demandes ou codes d'authentification out-of-band et les mots de passe à usage unique basés sur le temps (TOTP) ne peuvent être utilisés avec succès qu'une seule fois.", - "L": "2" - }, - { - "Shortcode": "V6.5.2", - "Ordinal": 2, - "Description": "Vérifiez que, lors de leur stockage dans le backend de l'application, les secrets de recherche comportant moins de 112 bits d'entropie (19 caractères alphanumériques aléatoires ou 34 chiffres aléatoires) sont hachés avec un algorithme de hachage de stockage de mots de passe approuvé, intégrant un sel aléatoire de 32 bits. Une fonction de hachage standard peut être utilisée si le secret comporte 112 bits d'entropie ou plus.", - "L": "2" - }, - { - "Shortcode": "V6.5.3", - "Ordinal": 3, - "Description": "Vérifiez que les secrets de recherche, le code d'authentification out-of-band et les mots de passe à usage unique basés sur le temps sont générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) pour éviter les valeurs prévisibles.", - "L": "2" - }, - { - "Shortcode": "V6.5.4", - "Ordinal": 4, - "Description": "Vérifiez que les secrets de recherche et les codes d'authentification out-of-band ont un minimum de 20 bits d'entropie (généralement 4 caractères alphanumériques aléatoires ou 6 chiffres aléatoires suffisent).", - "L": "2" - }, - { - "Shortcode": "V6.5.5", - "Ordinal": 5, - "Description": "Vérifiez que les requêtes, codes ou jetons d'authentification out-of-band, ainsi que les mots de passe à usage unique (TOTP), ont une durée de vie définie. Les requêtes out-of-band doivent avoir une durée de vie maximale de 10 minutes et les TOTP, de 30 secondes.", - "L": "2" - }, - { - "Shortcode": "V6.5.6", - "Ordinal": 6, - "Description": "Vérifiez que tout facteur d’authentification (y compris les appareils physiques) peut être révoqué en cas de vol ou autre perte.", - "L": "3" - }, - { - "Shortcode": "V6.5.7", - "Ordinal": 7, - "Description": "Vérifiez que les mécanismes d’authentification biométrique ne sont utilisés que comme facteurs secondaires, avec quelque chose que vous possédez ou quelque chose que vous savez.", - "L": "3" - }, - { - "Shortcode": "V6.5.8", - "Ordinal": 8, - "Description": "Vérifiez que les mots de passe à usage unique basés sur le temps (TOTP) sont vérifiés en fonction d'une source temporelle provenant d'un service de confiance et non d'une heure non fiable ou fournie par le client.", - "L": "3" - } - ] - }, - { - "Shortcode": "V6.6", - "Ordinal": 6, - "Name": "Mécanismes d'authentification out-of-band", - "Items": [ - { - "Shortcode": "V6.6.1", - "Ordinal": 1, - "Description": "Vérifier que les mécanismes d'authentification utilisant le réseau téléphonique public commuté (RTPC) pour la transmission de mots de passe à usage unique (OTP) par téléphone ou SMS ne sont proposés que lorsque le numéro de téléphone a été préalablement validé. D'autres méthodes plus robustes (telles que les mots de passe à usage unique à durée déterminée) sont également proposées, et que le service informe les utilisateurs des risques de sécurité qu'elles présentent. Pour les applications de niveau 3, le téléphone et les SMS ne doivent pas être disponibles.", - "L": "2" - }, - { - "Shortcode": "V6.6.2", - "Ordinal": 2, - "Description": "Vérifiez que les demandes d’authentification out-of-band, les codes ou les jetons sont liés à la demande d’authentification d’origine pour laquelle ils ont été générés et ne sont pas utilisables pour une demande précédente ou ultérieure.", - "L": "2" - }, - { - "Shortcode": "V6.6.3", - "Ordinal": 3, - "Description": "Vérifiez qu'un mécanisme d'authentification out-of-band basé sur du code est protégé contre les attaques par force brute grâce au \"rate limiting\". Envisagez également d'utiliser un code avec au moins 64 bits d'entropie.", - "L": "2" - }, - { - "Shortcode": "V6.6.4", - "Ordinal": 4, - "Description": "Vérifiez que, lorsque les notifications push sont utilisées pour l'authentification multifacteur, le \"rate limiting\" est appliqué afin d'empêcher les attaques de type « push bombing ». La concordance des numéros peut également atténuer ce risque.", - "L": "3" - } - ] - }, - { - "Shortcode": "V6.7", - "Ordinal": 7, - "Name": "Mécanisme d'authentification cryptographique", - "Items": [ - { - "Shortcode": "V6.7.1", - "Ordinal": 1, - "Description": "Vérifiez que les certificats utilisés pour vérifier les assertions d’authentification cryptographique sont stockés de manière à les protéger contre toute modification.", - "L": "3" - }, - { - "Shortcode": "V6.7.2", - "Ordinal": 2, - "Description": "Vérifiez que le nonce de défi a une longueur d'au moins 64 bits et qu'il est statistiquement unique ou unique sur toute la durée de vie du périphérique cryptographique.", - "L": "3" - } - ] - }, - { - "Shortcode": "V6.8", - "Ordinal": 8, - "Name": "Authentification avec un fournisseur d'identité", - "Items": [ - { - "Shortcode": "V6.8.1", - "Ordinal": 1, - "Description": "Vérifiez que, si l'application prend en charge plusieurs fournisseurs d'identité (IdP), l'identité de l'utilisateur ne peut pas être usurpée via un autre fournisseur d'identité pris en charge (par exemple, en utilisant le même identifiant utilisateur). La mesure standard consisterait à ce que l'application enregistre et identifie l'utilisateur à l'aide d'une combinaison de l'ID du fournisseur d'identité (servant d'espace de noms) et de l'ID de l'utilisateur dans le fournisseur d'identité.", - "L": "2" - }, - { - "Shortcode": "V6.8.2", - "Ordinal": 2, - "Description": "Vérifiez que la présence et l'intégrité des signatures numériques sur les assertions d'authentification (par exemple sur les assertions JWT ou SAML) sont toujours validées, en rejetant toutes les assertions non signées ou ayant des signatures non valides.", - "L": "2" - }, - { - "Shortcode": "V6.8.3", - "Ordinal": 3, - "Description": "Vérifiez que les assertions SAML sont traitées de manière unique et utilisées une seule fois au cours de la période de validité pour éviter les attaques par rejeu.", - "L": "2" - }, - { - "Shortcode": "V6.8.4", - "Ordinal": 4, - "Description": "Si une application utilise un fournisseur d'identité (IdP) distinct et attend une force, des méthodes ou une date d'authentification spécifiques pour des fonctions spécifiques, vérifiez que l'application les vérifie à l'aide des informations renvoyées par l'IdP. Par exemple, si OIDC est utilisé, cela peut être réalisé en validant les affirmations de jeton d'identification telles que « acr », « amr » et « auth_time » (le cas échéant). Si l'IdP ne fournit pas ces informations, l'application doit disposer d'une approche de secours documentée qui suppose que le mécanisme d'authentification de force minimale a été utilisé (par exemple, une authentification à facteur unique avec nom d'utilisateur et mot de passe).", - "L": "2" - } - ] - } - ] - }, - { - "Shortcode": "V7", - "Ordinal": 7, - "ShortName": "Session", - "Name": "Gestion des sessions", - "Items": [ - { - "Shortcode": "V7.1", - "Ordinal": 1, - "Name": "Documentation sur la gestion des sessions", - "Items": [ - { - "Shortcode": "V7.1.1", - "Ordinal": 1, - "Description": "Vérifiez que le délai d'inactivité de la session de l'utilisateur et la durée de vie maximale absolue de la session sont documentés, sont appropriés en combinaison avec d'autres contrôles et que la documentation inclut une justification de tout écart par rapport aux exigences de réauthentification NIST SP 800-63B.", - "L": "2" - }, - { - "Shortcode": "V7.1.2", - "Ordinal": 2, - "Description": "Vérifiez que la documentation définit le nombre de sessions simultanées (parallèles) autorisées pour un compte ainsi que les comportements et actions prévus à entreprendre lorsque le nombre maximal de sessions actives est atteint.", - "L": "2" - }, - { - "Shortcode": "V7.1.3", - "Ordinal": 3, - "Description": "Vérifiez que tous les systèmes qui créent et gèrent des sessions utilisateur dans le cadre d'un écosystème de gestion des identités fédérées (tels que les systèmes SSO) sont documentés avec des contrôles pour coordonner la durée de vie des sessions, la résiliation et toute autre condition nécessitant une réauthentification.", - "L": "2" - } - ] - }, - { - "Shortcode": "V7.2", - "Ordinal": 2, - "Name": "Sécurité fondamentale de la gestion des sessions", - "Items": [ - { - "Shortcode": "V7.2.1", - "Ordinal": 1, - "Description": "Vérifiez que l’application effectue toutes les vérifications des jetons de session à l’aide d’un service backend de confiance.", - "L": "1" - }, - { - "Shortcode": "V7.2.2", - "Ordinal": 2, - "Description": "Vérifiez que l'application utilise des jetons autonomes ou de référence générés dynamiquement pour la gestion des sessions, c'est-à-dire sans utiliser de secrets et de clés d'API statiques.", - "L": "1" - }, - { - "Shortcode": "V7.2.3", - "Ordinal": 3, - "Description": "Vérifiez que si des jetons par référence sont utilisés pour représenter les sessions utilisateur, ils sont uniques et générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et possèdent au moins 128 bits d'entropie.", - "L": "1" - }, - { - "Shortcode": "V7.2.4", - "Ordinal": 4, - "Description": "Vérifiez que l’application génère un nouveau jeton de session lors de l’authentification de l’utilisateur, y compris la réauthentification, et met fin au jeton de session actuel.", - "L": "1" - } - ] - }, - { - "Shortcode": "V7.3", - "Ordinal": 3, - "Name": "Délai d'expiration de la session", - "Items": [ - { - "Shortcode": "V7.3.1", - "Ordinal": 1, - "Description": "Vérifiez qu’il existe un délai d’inactivité tel que la réauthentification soit appliquée conformément à l’analyse des risques et aux décisions de sécurité documentées.", - "L": "2" - }, - { - "Shortcode": "V7.3.2", - "Ordinal": 2, - "Description": "Vérifiez qu'il existe une durée de vie maximale absolue de la session de sorte que la réauthentification soit appliquée conformément à l'analyse des risques et aux décisions de sécurité documentées.", - "L": "2" - } - ] - }, - { - "Shortcode": "V7.4", - "Ordinal": 4, - "Name": "Fin de session", - "Items": [ - { - "Shortcode": "V7.4.1", - "Ordinal": 1, - "Description": "Vérifiez que lorsque la fin de session est déclenchée (par exemple, déconnexion ou expiration), l'application interdit toute utilisation ultérieure de la session. Pour les jetons par référence ou les sessions avec état, cela implique l'invalidation des données de session au niveau du backend de l'application. Les applications utilisant des jetons autonomes nécessiteront une solution, comme la gestion d'une liste des jetons terminés, l'interdiction des jetons produits avant une date et une heure spécifique à chaque utilisateur ou la rotation d'une clé de signature spécifique à chaque utilisateur.", - "L": "1" - }, - { - "Shortcode": "V7.4.2", - "Ordinal": 2, - "Description": "Vérifiez que l'application met fin à toutes les sessions actives lorsqu'un compte utilisateur est désactivé ou supprimé (par exemple, lorsqu'un employé quitte l'entreprise).", - "L": "1" - }, - { - "Shortcode": "V7.4.3", - "Ordinal": 3, - "Description": "Vérifiez que l'application offre la possibilité de mettre fin à toutes les autres sessions actives après une modification ou une suppression réussie de tout facteur d'authentification (y compris la modification du mot de passe via une réinitialisation ou une récupération et, le cas échéant, une mise à jour des paramètres MFA).", - "L": "2" - }, - { - "Shortcode": "V7.4.4", - "Ordinal": 4, - "Description": "Vérifiez que toutes les pages nécessitant une authentification disposent d’un accès facile et visible à la fonctionnalité de déconnexion.", - "L": "2" - }, - { - "Shortcode": "V7.4.5", - "Ordinal": 5, - "Description": "Vérifiez que les administrateurs d’applications sont en mesure de mettre fin aux sessions actives pour un utilisateur individuel ou pour tous les utilisateurs.", - "L": "2" - } - ] - }, - { - "Shortcode": "V7.5", - "Ordinal": 5, - "Name": "Défenses contre les abus de session", - "Items": [ - { - "Shortcode": "V7.5.1", - "Ordinal": 1, - "Description": "Vérifiez que l'application nécessite une réauthentification complète avant d'autoriser les modifications des attributs de compte sensibles qui peuvent affecter l'authentification, tels que l'adresse e-mail, le numéro de téléphone, la configuration MFA ou d'autres informations utilisées dans la récupération de compte.", - "L": "2" - }, - { - "Shortcode": "V7.5.2", - "Ordinal": 2, - "Description": "Vérifiez que les utilisateurs peuvent afficher et (après s'être authentifiés à nouveau avec au moins un facteur) terminer une ou toutes les sessions actuellement actives.", - "L": "2" - }, - { - "Shortcode": "V7.5.3", - "Ordinal": 3, - "Description": "Vérifiez que l’application nécessite une authentification supplémentaire avec au moins un facteur ou une vérification secondaire avant d’effectuer des transactions ou des opérations hautement sensibles.", - "L": "3" - } - ] - }, - { - "Shortcode": "V7.6", - "Ordinal": 6, - "Name": "Réauthentification fédérée", - "Items": [ - { - "Shortcode": "V7.6.1", - "Ordinal": 1, - "Description": "Vérifiez que la durée de vie et la fin de la session entre les parties de confiance (RP) et les fournisseurs d'identité (IdP) se comportent comme documenté, en exigeant une réauthentification si nécessaire, par exemple lorsque le temps maximal entre les événements d'authentification IdP est atteint.", - "L": "2" - }, - { - "Shortcode": "V7.6.2", - "Ordinal": 2, - "Description": "Vérifiez que la création d'une session nécessite soit le consentement de l'utilisateur, soit une action explicite, empêchant ainsi la création de nouvelles sessions d'application sans interaction de l'utilisateur.", - "L": "2" - } - ] - } - ] - }, - { - "Shortcode": "V8", - "Ordinal": 8, - "ShortName": "Authorization", - "Name": "Autorisation", - "Items": [ - { - "Shortcode": "V8.1", - "Ordinal": 1, - "Name": "Documentation d'autorisation", - "Items": [ - { - "Shortcode": "V8.1.1", - "Ordinal": 1, - "Description": "Vérifiez que la documentation d’autorisation définit des règles de restriction de l’accès au niveau de la fonction et aux données en fonction des autorisations du consommateur et des attributs des ressources.", - "L": "1" - }, - { - "Shortcode": "V8.1.2", - "Ordinal": 2, - "Description": "Vérifiez que la documentation d'autorisation définit les règles de restriction d'accès au niveau des champs (lecture et écriture) en fonction des autorisations des consommateurs et des attributs des ressources. Notez que ces règles peuvent dépendre d'autres valeurs d'attributs de l'objet de données concerné, telles que l'état ou le statut.", - "L": "2" - }, - { - "Shortcode": "V8.1.3", - "Ordinal": 3, - "Description": "Vérifiez que la documentation de l'application définit les attributs environnementaux et contextuels (y compris, mais sans s'y limiter, l'heure de la journée, l'emplacement de l'utilisateur, l'adresse IP ou l'appareil) qui sont utilisés dans l'application pour prendre des décisions de sécurité, y compris celles relatives à l'authentification et à l'autorisation.", - "L": "3" - }, - { - "Shortcode": "V8.1.4", - "Ordinal": 4, - "Description": "Vérifier que la documentation d'authentification et d'autorisation définit l'utilisation des facteurs environnementaux et contextuels dans la prise de décision, en plus des autorisations au niveau des fonctions, des données et des champs. Cela doit inclure les attributs évalués, les seuils de risque et les actions entreprises (par exemple, autorisation, contestation, refus, renforcement de l'authentification).", - "L": "3" - } - ] - }, - { - "Shortcode": "V8.2", - "Ordinal": 2, - "Name": "Conception d'autorisation générale", - "Items": [ - { - "Shortcode": "V8.2.1", - "Ordinal": 1, - "Description": "Vérifiez que l’application garantit que l’accès basé sur la fonction est limité aux consommateurs disposant d’autorisations explicites.", - "L": "1" - }, - { - "Shortcode": "V8.2.2", - "Ordinal": 2, - "Description": "Vérifiez que l'application garantit que l'accès spécifique aux données est limité aux consommateurs disposant d'autorisations explicites sur des éléments de données spécifiques afin d'atténuer les références d'objet directes non sécurisées (IDOR) et les autorisations de niveau d'objet rompues (BOLA).", - "L": "1" - }, - { - "Shortcode": "V8.2.3", - "Ordinal": 3, - "Description": "Vérifiez que l'application garantit que l'accès au niveau du champ est limité aux consommateurs disposant d'autorisations explicites sur des champs spécifiques afin d'atténuer les problèmes d'autorisation au niveau de la propriété d'objet (BOPLA).", - "L": "2" - }, - { - "Shortcode": "V8.2.4", - "Ordinal": 4, - "Description": "Vérifiez que les contrôles de sécurité adaptatifs basés sur les attributs environnementaux et contextuels du consommateur (tels que l'heure, la localisation, l'adresse IP ou l'appareil) sont mis en œuvre pour les décisions d'authentification et d'autorisation, comme défini dans la documentation de l'application. Ces contrôles doivent être appliqués lorsque le consommateur tente de démarrer une nouvelle session et également pendant une session existante.", - "L": "3" - } - ] - }, - { - "Shortcode": "V8.3", - "Ordinal": 3, - "Name": "Autorisation par opération", - "Items": [ - { - "Shortcode": "V8.3.1", - "Ordinal": 1, - "Description": "Vérifier que l'application applique les règles d'autorisations au niveau de la couche service de confiance et ne s’appuie pas sur des contrôles qu’un consommateur non approuvé pourrait manipuler, comme JavaScript côté client.", - "L": "1" - }, - { - "Shortcode": "V8.3.2", - "Ordinal": 2, - "Description": "Vérifiez que les modifications apportées aux valeurs sur lesquelles reposent les décisions d'autorisation sont appliquées immédiatement. Lorsque les modifications ne peuvent pas être appliquées immédiatement (par exemple, en s'appuyant sur des données de jetons autonomes), des contrôles d'atténuation doivent être mis en place pour alerter un consommateur lorsqu'il effectue une action alors qu'il n'est plus autorisé à le faire et annuler la modification. Notez que cette solution alternative ne limiterait pas les fuites d'informations.", - "L": "3" - }, - { - "Shortcode": "V8.3.3", - "Ordinal": 3, - "Description": "Vérifiez que l'accès à un objet repose sur les autorisations du sujet d'origine (par exemple, le consommateur), et non sur celles d'un intermédiaire ou d'un service agissant en son nom. Par exemple, si un consommateur appelle un service web à l'aide d'un jeton d'authentification autonome, et que ce service demande ensuite des données à un autre service, ce dernier utilisera le jeton du consommateur, plutôt qu'un jeton inter-machine du premier service, pour prendre les décisions d'autorisation.", - "L": "3" - } - ] - }, - { - "Shortcode": "V8.4", - "Ordinal": 4, - "Name": "Autres considérations relatives à l'autorisation", - "Items": [ - { - "Shortcode": "V8.4.1", - "Ordinal": 1, - "Description": "Vérifiez que les applications multi-tenants utilisent des contrôles inter-tenants pour garantir que les opérations des consommateurs n'affecteront jamais les tenants avec lesquels ils ne sont pas autorisés à interagir.", - "L": "2" - }, - { - "Shortcode": "V8.4.2", - "Ordinal": 2, - "Description": "Vérifiez que l'accès aux interfaces administratives intègre plusieurs couches de sécurité, notamment la vérification continue de l'identité du consommateur, l'évaluation de la posture de sécurité des appareils et l'analyse contextuelle des risques, garantissant que l'emplacement du réseau ou les endpoints approuvés ne sont pas les seuls facteurs d'autorisation, même s'ils peuvent réduire la probabilité d'accès non autorisé.", - "L": "3" - } - ] - } - ] - }, - { - "Shortcode": "V9", - "Ordinal": 9, - "ShortName": "Self", - "Name": "Jetons autonomes", - "Items": [ - { - "Shortcode": "V9.1", - "Ordinal": 1, - "Name": "Source et intégrité du jeton", - "Items": [ - { - "Shortcode": "V9.1.1", - "Ordinal": 1, - "Description": "Vérifiez que les jetons autonomes sont validés à l'aide de leur signature numérique ou MAC pour les protéger contre toute falsification avant d'accepter le contenu du jeton.", - "L": "1" - }, - { - "Shortcode": "V9.1.2", - "Ordinal": 2, - "Description": "Vérifiez que seuls les algorithmes d'une liste d’autorisations peuvent être utilisés pour créer et vérifier des jetons autonomes, dans un contexte donné. La liste d'autorisation doit inclure les algorithmes autorisés, idéalement symétriques ou asymétriques, et ne doit pas inclure l'algorithme « Aucun ». Si les algorithmes symétriques et asymétriques doivent être pris en charge, des contrôles supplémentaires seront nécessaires pour éviter toute confusion de clés.", - "L": "1" - }, - { - "Shortcode": "V9.1.3", - "Ordinal": 3, - "Description": "Vérifiez que les clés utilisées pour valider les jetons autonomes proviennent de sources préconfigurées et fiables pour l'émetteur du jeton, empêchant ainsi les attaquants de spécifier des sources et des clés non fiables. Pour les JWT et autres structures JWS, les en-têtes tels que « jku », « x5u » et « jwk » doivent être validés par rapport à une liste d'autorisation de sources fiables.", - "L": "1" - } - ] - }, - { - "Shortcode": "V9.2", - "Ordinal": 2, - "Name": "Contenu du jeton", - "Items": [ - { - "Shortcode": "V9.2.1", - "Ordinal": 1, - "Description": "Vérifiez que, si une période de validité est indiquée dans les données du jeton, celui-ci et son contenu ne sont acceptés que si la date de vérification est comprise dans cette période. Par exemple, pour les JWT, les déclarations « nbf » et « exp » doivent être vérifiées.", - "L": "1" - }, - { - "Shortcode": "V9.2.2", - "Ordinal": 2, - "Description": "Vérifiez que le service recevant un jeton valide le type de jeton et son utilisation avant d'en accepter le contenu. Par exemple, seuls les jetons d'accès peuvent être acceptés pour les décisions d'autorisation, et seuls les jetons d'identification peuvent être utilisés pour prouver l'authentification des utilisateurs.", - "L": "2" - }, - { - "Shortcode": "V9.2.3", - "Ordinal": 3, - "Description": "Vérifiez que le service accepte uniquement les jetons destinés à être utilisés avec ce service (audience). Pour les JWT, cela peut être réalisé en validant la déclaration « aud » par rapport à une liste d'autorisation définie dans le service.", - "L": "2" - }, - { - "Shortcode": "V9.2.4", - "Ordinal": 4, - "Description": "Si un émetteur de jetons utilise la même clé privée pour émettre des jetons destinés à différentes audiences, vérifiez que les jetons émis contiennent une restriction d'audience identifiant de manière unique les audiences visées. Cela empêchera la réutilisation d'un jeton avec une audience non prévue. Si l'identifiant d'audience est provisionné dynamiquement, l'émetteur de jetons doit valider ces audiences afin de garantir qu'elles n'entraînent pas d'usurpation d'identité.", - "L": "2" - } - ] - } - ] - }, - { - "Shortcode": "V10", - "Ordinal": 10, - "ShortName": "OAuth", - "Name": "Oauth et OIDC", - "Items": [ - { - "Shortcode": "V10.1", - "Ordinal": 1, - "Name": "Sécurité générique OAuth et OIDC", - "Items": [ - { - "Shortcode": "V10.1.1", - "Ordinal": 1, - "Description": "Vérifiez que les jetons sont envoyés uniquement aux composants qui en ont absolument besoin. Par exemple, lors de l'utilisation d'un modèle backend-for-frontend pour les applications JavaScript basées sur un navigateur, les jetons d'accès et d'actualisation ne doivent être accessibles qu'au backend.", - "L": "2" - }, - { - "Shortcode": "V10.1.2", - "Ordinal": 2, - "Description": "Vérifiez que le client n'accepte les valeurs du serveur d'autorisation (telles que le code d'autorisation ou le jeton d'identification) que si elles résultent d'un flux d'autorisation initié par la même session d'agent utilisateur et la même transaction. Cela nécessite que les secrets générés par le client, tels que la clé de preuve pour l'échange de codes (PKCE) « code_verifier », « state » ou le nonce OIDC, ne puissent être devinés, soient spécifiques à la transaction et soient liés de manière sécurisée au client et à la session d'agent utilisateur au cours de laquelle la transaction a été initiée.", - "L": "2" - } - ] - }, - { - "Shortcode": "V10.2", - "Ordinal": 2, - "Name": "Client OAuth", - "Items": [ - { - "Shortcode": "V10.2.1", - "Ordinal": 1, - "Description": "Vérifiez que, si le flux de code est utilisé, le client OAuth dispose d'une protection contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF), qui déclenchent des demandes de jetons, soit en utilisant la fonctionnalité de clé de preuve pour l'échange de code (PKCE), soit en vérifiant le paramètre « state » envoyé dans la demande d'autorisation.", - "L": "2" - }, - { - "Shortcode": "V10.2.2", - "Ordinal": 2, - "Description": "Vérifiez que, si le client OAuth peut interagir avec plusieurs serveurs d'autorisation, il dispose d'une protection contre les attaques par confusion. Par exemple, il peut exiger que le serveur d'autorisation renvoie la valeur du paramètre « iss » et la valide dans la réponse d'autorisation et la réponse du jeton.", - "L": "2" - }, - { - "Shortcode": "V10.2.3", - "Ordinal": 3, - "Description": "Vérifiez que le client OAuth demande uniquement les portées requises (ou d’autres paramètres d’autorisation) dans les requêtes adressées au serveur d’autorisation.", - "L": "3" - } - ] - }, - { - "Shortcode": "V10.3", - "Ordinal": 3, - "Name": "Serveur de ressources OAuth", - "Items": [ - { - "Shortcode": "V10.3.1", - "Ordinal": 1, - "Description": "Vérifiez que le serveur de ressources accepte uniquement les jetons d'accès destinés à être utilisés avec ce service (audience). L'audience peut être incluse dans un jeton d'accès structuré (comme la déclaration « aud » dans JWT) ou vérifiée à l'aide du endpoint d'introspection de jeton.", - "L": "2" - }, - { - "Shortcode": "V10.3.2", - "Ordinal": 2, - "Description": "Vérifiez que le serveur de ressources applique les décisions d'autorisation en fonction des déclarations du jeton d'accès définissant l'autorisation déléguée. Si des déclarations telles que « sub », « scope » et « authorization_details » sont présentes, elles doivent être prises en compte dans la décision.", - "L": "2" - }, - { - "Shortcode": "V10.3.3", - "Ordinal": 3, - "Description": "Vérifiez que si une décision de contrôle d'accès nécessite l'identification d'un utilisateur unique à partir d'un jeton d'accès (JWT ou réponse d'introspection de jeton associé), le serveur de ressources identifie l'utilisateur à partir de déclarations non ré attribuables à d'autres utilisateurs. En général, cela implique l'utilisation d'une combinaison de déclarations « iss » et « sub ».", - "L": "2" - }, - { - "Shortcode": "V10.3.4", - "Ordinal": 4, - "Description": "Si le serveur de ressources requiert une force d'authentification, des méthodes ou une date d'expiration spécifiques, vérifiez que le jeton d'accès présenté respecte ces contraintes. Par exemple, s'il est présent, utilisez les déclarations OIDC « acr », « amr » et « auth_time » respectivement.", - "L": "2" - }, - { - "Shortcode": "V10.3.5", - "Ordinal": 5, - "Description": "Vérifiez que le serveur de ressources empêche l'utilisation de jetons d'accès volés ou la relecture de jetons d'accès (de parties non autorisées) en exigeant des jetons d'accès limités par l'expéditeur, soit Mutual TLS pour OAuth 2, soit OAuth 2 Demonstration of Proof of Possession (DPoP).", - "L": "3" - } - ] - }, - { - "Shortcode": "V10.4", - "Ordinal": 4, - "Name": "Serveur d'autorisation OAuth", - "Items": [ - { - "Shortcode": "V10.4.1", - "Ordinal": 1, - "Description": "Vérifiez que le serveur d'autorisation valide les URI de redirection en fonction d'une liste d'autorisation spécifique au client d'URI préenregistrés à l'aide d'une comparaison de chaînes exacte.", - "L": "1" - }, - { - "Shortcode": "V10.4.2", - "Ordinal": 2, - "Description": "Vérifiez que, si le serveur d'autorisation renvoie le code d'autorisation dans la réponse, celui-ci ne peut être utilisé qu'une seule fois pour une demande de jeton. Pour la deuxième demande valide avec un code d'autorisation déjà utilisé pour émettre un jeton d'accès, le serveur d'autorisation doit rejeter la demande de jeton et révoquer tous les jetons émis liés au code d'autorisation.", - "L": "1" - }, - { - "Shortcode": "V10.4.3", - "Ordinal": 3, - "Description": "Vérifiez que le code d'autorisation est de courte durée. La durée de vie maximale peut atteindre 10 minutes pour les applications L1 et L2 et 1 minute pour les applications L3.", - "L": "1" - }, - { - "Shortcode": "V10.4.4", - "Ordinal": 4, - "Description": "Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement l'utilisation des autorisations nécessaires à ce client. Notez que les autorisations « token » (flux implicite) et « password » (flux d'informations d'identification du propriétaire de la ressource) ne doivent plus être utilisées.", - "L": "1" - }, - { - "Shortcode": "V10.4.5", - "Ordinal": 5, - "Description": "Vérifiez que le serveur d'autorisation atténue les attaques par rejeu de jetons d'actualisation pour les clients publics, de préférence en utilisant des jetons d'actualisation limités par l'expéditeur, par exemple des jetons DPoP (Demonstrating Proof of Possession) ou des jetons d'accès liés à un certificat utilisant le protocole TLS mutuel (mTLS). Pour les applications L1 et L2, la rotation des jetons d'actualisation peut être utilisée. Si cette rotation est utilisée, le serveur d'autorisation doit invalider le jeton d'actualisation après utilisation et révoquer tous les jetons d'actualisation de cette autorisation si un jeton d'actualisation déjà utilisé et invalidé est fourni.", - "L": "1" - }, - { - "Shortcode": "V10.4.6", - "Ordinal": 6, - "Description": "Vérifiez que, si l'octroi de code est utilisé, le serveur d'autorisation atténue les attaques par interception de code en exigeant une clé de preuve pour l'échange de code (PKCE). Pour les demandes d'autorisation, le serveur d'autorisation doit exiger une valeur « code_challenge » valide et ne doit pas accepter une valeur « plain » pour « code_challenge_method ». Pour une demande de jeton, il doit exiger la validation du paramètre « code_verifier ».", - "L": "2" - }, - { - "Shortcode": "V10.4.7", - "Ordinal": 7, - "Description": "Vérifiez que si le serveur d'autorisation prend en charge l'enregistrement dynamique des clients non authentifiés, il réduit le risque d'applications clientes malveillantes. Il doit valider les métadonnées clientes, telles que les URI enregistrés, garantir le consentement de l'utilisateur et l'avertir avant de traiter une demande d'autorisation avec une application cliente non approuvée.", - "L": "2" - }, - { - "Shortcode": "V10.4.8", - "Ordinal": 8, - "Description": "Vérifiez que les jetons d’actualisation ont une expiration absolue, y compris si l’expiration du jeton d’actualisation glissant est appliquée.", - "L": "2" - }, - { - "Shortcode": "V10.4.9", - "Ordinal": 9, - "Description": "Vérifiez que les jetons d'actualisation et les jetons d'accès de référence peuvent être révoqués par un utilisateur autorisé à l'aide de l'interface utilisateur du serveur d'autorisation, afin d'atténuer le risque de clients malveillants ou de jetons volés.", - "L": "2" - }, - { - "Shortcode": "V10.4.10", - "Ordinal": 10, - "Description": "Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.", - "L": "2" - }, - { - "Shortcode": "V10.4.11", - "Ordinal": 11, - "Description": "Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.", - "L": "2" - }, - { - "Shortcode": "V10.4.12", - "Ordinal": 12, - "Description": "Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement la valeur « response_mode » dont ce client a besoin. Par exemple, en vérifiant cette valeur par rapport aux valeurs attendues ou en utilisant une requête d'autorisation poussée (PAR) ou une requête d'autorisation sécurisée par JWT (JAR).", - "L": "3" - }, - { - "Shortcode": "V10.4.13", - "Ordinal": 13, - "Description": "Vérifiez que le type d'Autorisation « code » est toujours utilisé avec les demandes d'autorisation poussées (PAR).", - "L": "3" - }, - { - "Shortcode": "V10.4.14", - "Ordinal": 14, - "Description": "Vérifiez que le serveur d'autorisation émet uniquement des jetons d'accès limités à l'expéditeur (preuve de possession), soit avec des jetons d'accès liés au certificat utilisant TLS mutuel (mTLS), soit avec des jetons d'accès liés au DPoP (démonstration de preuve de possession).", - "L": "3" - }, - { - "Shortcode": "V10.4.15", - "Ordinal": 15, - "Description": "Vérifiez que, pour un client côté serveur (non exécuté sur l'appareil de l'utilisateur final), le serveur d'autorisation garantit que la valeur du paramètre « authorization_details » provient du backend client et que l'utilisateur ne l'a pas altérée. Par exemple, en exigeant l'utilisation d'une demande d'autorisation poussée (PAR) ou d'une demande d'autorisation sécurisée par JWT (JAR).", - "L": "3" - }, - { - "Shortcode": "V10.4.16", - "Ordinal": 16, - "Description": "Vérifiez que le client est confidentiel et que le serveur d'autorisation requiert l'utilisation de méthodes d'authentification client fortes (basées sur la cryptographie à clé publique et résistantes aux attaques par relecture), telles que TLS mutuel ('tls_client_auth', 'self_signed_tls_client_auth') ou JWT à clé privée ('private_key_jwt').", - "L": "3" - } - ] - }, - { - "Shortcode": "V10.5", - "Ordinal": 5, - "Name": "Client OIDC", - "Items": [ - { - "Shortcode": "V10.5.1", - "Ordinal": 1, - "Description": "Vérifiez que le client (en tant que partie utilisatrice) atténue les attaques par rejeu de jeton d'identification. Par exemple, en vous assurant que la valeur « nonce » du jeton d'identification correspond à la valeur « nonce » envoyée dans la demande d'authentification au fournisseur OpenID (appelée demande d'autorisation envoyée au serveur d'autorisation dans OAuth2).", - "L": "2" - }, - { - "Shortcode": "V10.5.2", - "Ordinal": 2, - "Description": "Vérifiez que le client identifie de manière unique l'utilisateur à partir des déclarations de jeton d'identification, généralement la déclaration « sub », qui ne peut pas être réaffectée à d'autres utilisateurs (pour la portée d'un fournisseur d'identité).", - "L": "2" - }, - { - "Shortcode": "V10.5.3", - "Ordinal": 3, - "Description": "Vérifiez que le client rejette les tentatives d'un serveur d'autorisation malveillant d'usurper l'identité d'un autre serveur d'autorisation via ses métadonnées. Le client doit rejeter les métadonnées du serveur d'autorisation si l'URL de l'émetteur figurant dans ces métadonnées ne correspond pas exactement à l'URL d'émetteur préconfigurée attendue par le client.", - "L": "2" - }, - { - "Shortcode": "V10.5.4", - "Ordinal": 4, - "Description": "Vérifiez que le client valide que le jeton d'identification est destiné à être utilisé pour ce client (audience) en vérifiant que la déclaration « aud » du jeton est égale à la valeur « client_id » pour le client.", - "L": "2" - }, - { - "Shortcode": "V10.5.5", - "Ordinal": 5, - "Description": "Vérifiez que, lors de l'utilisation de la déconnexion du back-channel OIDC, la partie utilisatrice atténue les risques de déni de service liés à la déconnexion forcée et à la confusion entre JWT dans le flux de déconnexion. Le client doit vérifier que le jeton de déconnexion est correctement typé avec la valeur « logout+jwt », qu'il contient la déclaration « event » avec le nom de membre correct et qu'il ne contient pas de déclaration « nonce ». Il est également recommandé d'utiliser une expiration courte (par exemple, 2 minutes).", - "L": "2" - } - ] - }, - { - "Shortcode": "V10.6", - "Ordinal": 6, - "Name": "Fournisseur OpenID", - "Items": [ - { - "Shortcode": "V10.6.1", - "Ordinal": 1, - "Description": "Vérifiez que le fournisseur OpenID n'autorise que les valeurs « code », « ciba », « id_token » ou « id_token code » pour le mode de réponse. Notez que « code » est préférable à « id_token code » (flux hybride OIDC) et que « token » (tout flux implicite) ne doit pas être utilisé.", - "L": "2" - }, - { - "Shortcode": "V10.6.2", - "Ordinal": 2, - "Description": "Vérifiez que le fournisseur OpenID atténue les risques de déni de service liés à la déconnexion forcée. Pour ce faire, obtenez une confirmation explicite de l'utilisateur final ou, le cas échéant, validez les paramètres de la requête de déconnexion (initiée par la partie utilisatrice), comme « id_token_hint ».", - "L": "2" - } - ] - }, - { - "Shortcode": "V10.7", - "Ordinal": 7, - "Name": "Gestion du consentement", - "Items": [ - { - "Shortcode": "V10.7.1", - "Ordinal": 1, - "Description": "Vérifiez que le serveur d'autorisation garantit le consentement de l'utilisateur à chaque demande d'autorisation. Si l'identité du client ne peut être garantie, le serveur d'autorisation doit toujours demander explicitement le consentement de l'utilisateur.", - "L": "2" - }, - { - "Shortcode": "V10.7.2", - "Ordinal": 2, - "Description": "Vérifiez que lorsque le serveur d'autorisation demande le consentement de l'utilisateur, il fournit des informations claires et suffisantes sur ce qui est consenti. Le cas échéant, ces informations doivent inclure la nature des autorisations demandées (généralement en fonction de la portée, du serveur de ressources et des détails d'autorisation RAR), l'identité de l'application autorisée et la durée de vie de ces autorisations.", - "L": "2" - }, - { - "Shortcode": "V10.7.3", - "Ordinal": 3, - "Description": "Vérifiez que l’utilisateur peut consulter, modifier et révoquer les consentements qu’il a accordés via le serveur d’autorisation.", - "L": "2" - } - ] - } - ] - }, - { - "Shortcode": "V11", - "Ordinal": 11, - "ShortName": "Cryptography", - "Name": "Cryptographie", - "Items": [ - { - "Shortcode": "V11.1", - "Ordinal": 1, - "Name": "Inventaire et documentation cryptographiques", - "Items": [ - { - "Shortcode": "V11.1.1", - "Ordinal": 1, - "Description": "Vérifiez qu’il existe une politique documentée pour la gestion des clés cryptographiques et un cycle de vie des clés cryptographiques qui suit une norme de gestion des clés telle que NIST SP 800-57. Cela devrait inclure la garantie que les clés ne sont pas sur-partagées (par exemple, avec plus de deux entités pour les secrets partagés et plus d’une entité pour les clés privées).", - "L": "2" - }, - { - "Shortcode": "V11.1.2", - "Ordinal": 2, - "Description": "Vérifiez qu'un inventaire cryptographique est réalisé, maintenu et régulièrement mis à jour, et qu'il inclut toutes les clés, algorithmes et certificats cryptographiques utilisés par l'application. Il doit également documenter les emplacements du système où les clés peuvent ou non être utilisées, ainsi que les types de données qui peuvent ou non être protégées par ces clés.", - "L": "2" - }, - { - "Shortcode": "V11.1.3", - "Ordinal": 3, - "Description": "Vérifiez que les mécanismes de découverte cryptographique sont utilisés pour identifier toutes les instances de cryptographie dans le système, y compris les opérations de chiffrement, de hachage et de signature.", - "L": "3" - }, - { - "Shortcode": "V11.1.4", - "Ordinal": 4, - "Description": "Vérifier la tenue d'un inventaire cryptographique. Celui-ci doit inclure un plan documenté décrivant la migration vers de nouvelles normes cryptographiques, telles que la cryptographie post-quantique, afin de réagir aux menaces futures.", - "L": "3" - } - ] - }, - { - "Shortcode": "V11.2", - "Ordinal": 2, - "Name": "Mise en œuvre sécurisée de la cryptographie", - "Items": [ - { - "Shortcode": "V11.2.1", - "Ordinal": 1, - "Description": "Vérifiez que les implémentations validées par l’industrie (y compris les bibliothèques et les implémentations accélérées par le matériel) sont utilisées pour les opérations cryptographiques.", - "L": "2" - }, - { - "Shortcode": "V11.2.2", - "Ordinal": 2, - "Description": "Vérifiez que l'application est conçue avec une agilité cryptographique, de sorte que les nombres aléatoires, le chiffrement authentifié, le MAC ou les algorithmes de hachage, les longueurs de clés, les tours, les chiffrements et les modes puissent être reconfigurés, mis à niveau ou échangés à tout moment, afin de se protéger contre les failles cryptographiques. De même, il doit être possible de remplacer les clés et les mots de passe, ainsi que de rechiffrer les données. Cela permettra des mises à niveau transparentes vers la cryptographie post-quantique (PQC), une fois que des implémentations hautement sécurisées de schémas ou de normes PQC approuvés seront largement disponibles.", - "L": "2" - }, - { - "Shortcode": "V11.2.3", - "Ordinal": 3, - "Description": "Vérifiez que toutes les primitives cryptographiques utilisent un minimum de 128 bits de sécurité en fonction de l'algorithme, de la taille de la clé et de la configuration. Par exemple, une clé ECC de 256 bits offre environ 128 bits de sécurité, tandis que RSA nécessite une clé de 3072 bits pour atteindre 128 bits de sécurité.", - "L": "2" - }, - { - "Shortcode": "V11.2.4", - "Ordinal": 4, - "Description": "Vérifiez que toutes les opérations cryptographiques sont à temps constant, sans opérations de « court-circuit » dans les comparaisons, les calculs ou les retours, pour éviter toute fuite d'informations.", - "L": "3" - }, - { - "Shortcode": "V11.2.5", - "Ordinal": 5, - "Description": "Vérifiez que tous les modules cryptographiques échouent en toute sécurité et que les erreurs sont gérées de manière à ne pas permettre de vulnérabilités, telles que les attaques Padding Oracle.", - "L": "3" - } - ] - }, - { - "Shortcode": "V11.3", - "Ordinal": 3, - "Name": "Algorithmes de chiffrement", - "Items": [ - { - "Shortcode": "V11.3.1", - "Ordinal": 1, - "Description": "Vérifiez que les modes de bloc non sécurisés (par exemple, ECB) et les schémas de remplissage faibles (par exemple, PKCS#1 v1.5) ne sont pas utilisés.", - "L": "1" - }, - { - "Shortcode": "V11.3.2", - "Ordinal": 2, - "Description": "Vérifiez que seuls les chiffrements et modes approuvés tels que AES avec GCM sont utilisés.", - "L": "1" - }, - { - "Shortcode": "V11.3.3", - "Ordinal": 3, - "Description": "Vérifiez que les données chiffrées sont protégées contre toute modification non autorisée, de préférence en utilisant une méthode de chiffrement authentifiée approuvée ou en combinant une méthode de chiffrement approuvée avec un algorithme MAC approuvé.", - "L": "2" - }, - { - "Shortcode": "V11.3.4", - "Ordinal": 4, - "Description": "Vérifiez que les nonces, les vecteurs d'initialisation et autres nombres à usage unique ne sont pas utilisés pour plus d'une paire clé de chiffrement/élément de données. La méthode de génération doit être adaptée à l'algorithme utilisé.", - "L": "3" - }, - { - "Shortcode": "V11.3.5", - "Ordinal": 5, - "Description": "Vérifiez que toute combinaison d'un algorithme de chiffrement et d'un algorithme MAC fonctionne en mode chiffrement puis MAC.", - "L": "3" - } - ] - }, - { - "Shortcode": "V11.4", - "Ordinal": 4, - "Name": "Hachage et fonctions basées sur le hachage", - "Items": [ - { - "Shortcode": "V11.4.1", - "Ordinal": 1, - "Description": "Vérifiez que seules les fonctions de hachage approuvées sont utilisées pour les cas d'utilisation cryptographiques généraux, notamment les signatures numériques, HMAC, KDF et la génération de bits aléatoires. Les fonctions de hachage non autorisées, telles que MD5, ne doivent pas être utilisées à des fins cryptographiques.", - "L": "1" - }, - { - "Shortcode": "V11.4.2", - "Ordinal": 2, - "Description": "Vérifiez que les mots de passe sont stockés à l'aide d'une fonction de dérivation de clés approuvée et gourmande en ressources de calcul (également appelée « fonction de hachage de mots de passe »), dont les paramètres sont configurés conformément aux directives en vigueur. Ces paramètres doivent équilibrer sécurité et performances afin de rendre les attaques par force brute suffisamment difficiles pour le niveau de sécurité requis.", - "L": "2" - }, - { - "Shortcode": "V11.4.3", - "Ordinal": 3, - "Description": "Vérifiez que les fonctions de hachage utilisées dans les signatures numériques, dans le cadre de l'authentification ou de l'intégrité des données, sont résistantes aux collisions et possèdent des longueurs de bits appropriées. Si la résistance aux collisions est requise, la longueur de sortie doit être d'au moins 256 bits. Si seule la résistance aux attaques de seconde pré-image est requise, la longueur de sortie doit être d'au moins 128 bits.", - "L": "2" - }, - { - "Shortcode": "V11.4.4", - "Ordinal": 4, - "Description": "Vérifiez que l'application utilise des fonctions de dérivation de clés approuvées avec des paramètres d'extension de clés lors de la dérivation de clés secrètes à partir de mots de passe. Les paramètres utilisés doivent concilier sécurité et performances afin d'empêcher les attaques par force brute de compromettre la clé cryptographique obtenue.", - "L": "2" - } - ] - }, - { - "Shortcode": "V11.5", - "Ordinal": 5, - "Name": "Valeurs aléatoires", - "Items": [ - { - "Shortcode": "V11.5.1", - "Ordinal": 1, - "Description": "Vérifiez que tous les nombres et chaînes aléatoires destinés à être non devinables doivent être générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et posséder au moins 128 bits d'entropie. Notez que les UUID ne respectent pas cette condition.", - "L": "2" - }, - { - "Shortcode": "V11.5.2", - "Ordinal": 2, - "Description": "Vérifiez que le mécanisme de génération de nombres aléatoires utilisé est conçu pour fonctionner en toute sécurité, même en cas de forte demande.", - "L": "3" - } - ] - }, - { - "Shortcode": "V11.6", - "Ordinal": 6, - "Name": "Cryptographie à clé publique", - "Items": [ - { - "Shortcode": "V11.6.1", - "Ordinal": 1, - "Description": "Vérifier que seuls des algorithmes cryptographiques et des modes opératoires approuvés sont utilisés pour la génération et l'amorçage des clés, ainsi que pour la génération et la vérification des signatures numériques. Les algorithmes de génération de clés ne doivent pas générer de clés non sécurisées et vulnérables aux attaques connues, par exemple les clés RSA vulnérables à la factorisation de Fermat.", - "L": "2" - }, - { - "Shortcode": "V11.6.2", - "Ordinal": 2, - "Description": "Vérifiez que des algorithmes cryptographiques approuvés sont utilisés pour l'échange de clés (tels que Diffie-Hellman), en veillant à ce que les mécanismes d'échange de clés utilisent des paramètres sécurisés. Cela permettra d'éviter les attaques contre le processus d'établissement des clés, susceptibles de conduire à des attaques de type « adversaire du milieu » ou à des failles cryptographiques.", - "L": "3" - } - ] - }, - { - "Shortcode": "V11.7", - "Ordinal": 7, - "Name": "Cryptographie des données en cours d'utilisation", - "Items": [ - { - "Shortcode": "V11.7.1", - "Ordinal": 1, - "Description": "Vérifiez que le chiffrement complet de la mémoire est utilisé pour protéger les données sensibles pendant leur utilisation, empêchant ainsi l'accès par des utilisateurs ou des processus non autorisés.", - "L": "3" - }, - { - "Shortcode": "V11.7.2", - "Ordinal": 2, - "Description": "Vérifiez que la minimisation des données garantit que la quantité minimale de données est exposée pendant le traitement et assurez-vous que les données sont chiffrées immédiatement après utilisation ou dès que possible.", - "L": "3" - } - ] - } - ] - }, - { - "Shortcode": "V12", - "Ordinal": 12, - "ShortName": "Secure", - "Name": "Communication sécurisée", - "Items": [ - { - "Shortcode": "V12.1", - "Ordinal": 1, - "Name": "Conseils généraux de sécurité TLS", - "Items": [ - { - "Shortcode": "V12.1.1", - "Ordinal": 1, - "Description": "Vérifiez que seules les dernières versions recommandées du protocole TLS sont activées, telles que TLS 1.2 et TLS 1.3. La dernière version du protocole TLS doit être privilégiée.", - "L": "1" - }, - { - "Shortcode": "V12.1.2", - "Ordinal": 2, - "Description": "Vérifiez que seules les suites de chiffrement recommandées sont activées, les suites de chiffrement les plus puissantes étant définies comme préférées. Les applications L3 doivent uniquement prendre en charge les suites de chiffrement assurant la confidentialité persistante (forward secrecy).", - "L": "2" - }, - { - "Shortcode": "V12.1.3", - "Ordinal": 3, - "Description": "Vérifiez que l’application valide que les certificats clients mTLS sont approuvés avant d’utiliser l’identité du certificat pour l’authentification ou l’autorisation.", - "L": "2" - }, - { - "Shortcode": "V12.1.4", - "Ordinal": 4, - "Description": "Vérifiez que la révocation de certification appropriée, telle que l'agrafage du protocole OCSP (Online Certificate Status Protocol), est activée et configurée.", - "L": "3" - }, - { - "Shortcode": "V12.1.5", - "Ordinal": 5, - "Description": "Vérifiez que Encrypted Client Hello (ECH) est activé dans les paramètres TLS de l'application pour empêcher l'exposition de métadonnées sensibles, telles que l'indication du nom du serveur (SNI), pendant les processus de négociation TLS.", - "L": "3" - } - ] - }, - { - "Shortcode": "V12.2", - "Ordinal": 2, - "Name": "Communication HTTPS avec des services externes", - "Items": [ - { - "Shortcode": "V12.2.1", - "Ordinal": 1, - "Description": "Vérifiez que TLS est utilisé pour toute connectivité entre un client et des services externes basés sur HTTP, et ne recourt pas à des communications non sécurisées ou non chiffrées.", - "L": "1" - }, - { - "Shortcode": "V12.2.2", - "Ordinal": 2, - "Description": "Vérifiez que les services externes utilisent des certificats TLS publiquement approuvés.", - "L": "1" - } - ] - }, - { - "Shortcode": "V12.3", - "Ordinal": 3, - "Name": "Sécurité des communications entre services généraux", - "Items": [ - { - "Shortcode": "V12.3.1", - "Ordinal": 1, - "Description": "Vérifiez qu'un protocole chiffré tel que TLS est utilisé pour toutes les connexions entrantes et sortantes vers et depuis l'application, y compris les systèmes de surveillance, les outils de gestion, l'accès à distance et SSH, les intergiciels, les bases de données, les mainframes, les systèmes partenaires ou les API externes. Le serveur ne doit pas recourir à des protocoles non sécurisés ou non chiffrés.", - "L": "2" - }, - { - "Shortcode": "V12.3.2", - "Ordinal": 2, - "Description": "Vérifiez que les clients TLS valident les certificats reçus avant de communiquer avec un serveur TLS.", - "L": "2" - }, - { - "Shortcode": "V12.3.3", - "Ordinal": 3, - "Description": "Vérifiez que TLS ou un autre mécanisme de chiffrement de transport approprié est utilisé pour toute connectivité entre les services internes basés sur HTTP au sein de l'application et ne se replie pas vers des communications non sécurisées ou non chiffrées.", - "L": "2" - }, - { - "Shortcode": "V12.3.4", - "Ordinal": 4, - "Description": "Vérifiez que les connexions TLS entre les services internes utilisent des certificats de confiance. Lorsque des certificats générés en interne ou auto-signés sont utilisés, le service consommateur doit être configuré pour n'approuver que des autorités de certification internes spécifiques et des certificats auto-signés spécifiques.", - "L": "2" - }, - { - "Shortcode": "V12.3.5", - "Ordinal": 5, - "Description": "Vérifiez que les services communiquant en interne au sein d'un système (communications intra-services) utilisent une authentification forte pour garantir la vérification de chaque endpoint. Des méthodes d'authentification forte, telles que l'authentification client TLS, doivent être utilisées pour garantir l'identité, en utilisant une infrastructure à clé publique et des mécanismes résistants aux attaques par rejeu. Pour les architectures de microservices, envisagez d'utiliser un maillage de services pour simplifier la gestion des certificats et renforcer la sécurité.", - "L": "3" - } - ] - } - ] - }, - { - "Shortcode": "V13", - "Ordinal": 13, - "ShortName": "Configuration", - "Name": "Configuration", - "Items": [ - { - "Shortcode": "V13.1", - "Ordinal": 1, - "Name": "Documentation de configuration", - "Items": [ - { - "Shortcode": "V13.1.1", - "Ordinal": 1, - "Description": "Vérifiez que tous les besoins de communication de l'application sont documentés. Cela doit inclure les services externes dont l'application dépend et les cas où un utilisateur final pourrait fournir un emplacement externe auquel l'application se connectera.", - "L": "2" - }, - { - "Shortcode": "V13.1.2", - "Ordinal": 2, - "Description": "Vérifiez que pour chaque service utilisé par l'application, la documentation définit le nombre maximal de connexions simultanées (par exemple, les limites du pool de connexions) et le comportement de l'application lorsque cette limite est atteinte, y compris les mécanismes de secours ou de récupération, pour éviter les conditions de déni de service.", - "L": "3" - }, - { - "Shortcode": "V13.1.3", - "Ordinal": 3, - "Description": "Vérifiez que la documentation de l'application définit des stratégies de gestion des ressources pour chaque système ou service externe utilisé (par exemple, bases de données, descripteurs de fichiers, threads, connexions HTTP). Cela doit inclure les procédures de libération des ressources, les paramètres de délai d'expiration, la gestion des échecs et l'implémentation de la logique de nouvelle tentative, en spécifiant les limites de nouvelle tentative, les délais et les algorithmes de retour arrière. Pour les opérations de requête-réponse HTTP synchrones, la documentation doit imposer des délais d'expiration courts et soit désactiver les nouvelles tentatives, soit les limiter strictement afin d'éviter les retards en cascade et l'épuisement des ressources.", - "L": "3" - }, - { - "Shortcode": "V13.1.4", - "Ordinal": 4, - "Description": "Vérifiez que la documentation de l'application définit les secrets essentiels à la sécurité de l'application et un calendrier de rotation de ceux-ci, en fonction du modèle de menace et des exigences commerciales de l'organisation.", - "L": "3" - } - ] - }, - { - "Shortcode": "V13.2", - "Ordinal": 2, - "Name": "Configuration de la communication backend", - "Items": [ - { - "Shortcode": "V13.2.1", - "Ordinal": 1, - "Description": "Vérifiez que les communications entre les composants de l'application backend qui ne prennent pas en charge le mécanisme de session utilisateur standard de l'application, notamment les API, les intergiciels et les couches de données, sont authentifiées. L'authentification doit utiliser des comptes de service individuels, des jetons à court terme ou une authentification par certificat, et non des identifiants immuables tels que des mots de passe, des clés API ou des comptes partagés avec accès privilégié.", - "L": "2" - }, - { - "Shortcode": "V13.2.2", - "Ordinal": 2, - "Description": "Vérifiez que les communications entre les composants de l'application backend, y compris les services locaux ou du système d'exploitation, les API, les intergiciels et les couches de données, sont effectuées avec des comptes dotés des privilèges les moins nécessaires.", - "L": "2" - }, - { - "Shortcode": "V13.2.3", - "Ordinal": 3, - "Description": "Vérifiez que si des informations d’identification doivent être utilisées pour l’authentification du service, les informations d’identification utilisées par le consommateur ne sont pas des informations d’identification par défaut (par exemple, root/root ou admin/admin).", - "L": "2" - }, - { - "Shortcode": "V13.2.4", - "Ordinal": 4, - "Description": "Vérifiez qu'une liste d’autorisations est utilisée pour définir les ressources ou systèmes externes avec lesquels l'application est autorisée à communiquer (par exemple, pour les requêtes sortantes, les chargements de données ou l'accès aux fichiers). Cette liste d'autorisation peut être implémentée au niveau de la couche applicative, du serveur web, du pare-feu ou d'une combinaison de différentes couches.", - "L": "2" - }, - { - "Shortcode": "V13.2.5", - "Ordinal": 5, - "Description": "Vérifiez que le serveur Web ou d’application est configuré avec une liste autorisée de ressources ou de systèmes vers lesquels le serveur peut envoyer des requêtes ou charger des données ou des fichiers.", - "L": "2" - }, - { - "Shortcode": "V13.2.6", - "Ordinal": 6, - "Description": "Vérifiez que lorsque l'application se connecte à des services distincts, elle suit la configuration documentée pour chaque connexion, comme le nombre maximal de connexions parallèles, le comportement lorsque le nombre maximal de connexions autorisées est atteint, les délais d'expiration de connexion et les stratégies de nouvelle tentative.", - "L": "3" - } - ] - }, - { - "Shortcode": "V13.3", - "Ordinal": 3, - "Name": "Gestion des secrets", - "Items": [ - { - "Shortcode": "V13.3.1", - "Ordinal": 1, - "Description": "Vérifiez qu'une solution de gestion des secrets, telle qu'un coffre-fort de clés, est utilisée pour créer, stocker, contrôler l'accès et détruire en toute sécurité les secrets backend. Ceux-ci peuvent inclure des mots de passe, du matériel de clé, des intégrations avec des bases de données et des systèmes tiers, des clés et des graines pour des jetons temporels, d'autres secrets internes et des clés API. Les secrets ne doivent pas être inclus dans le code source de l'application ni dans les artefacts de build. Pour une application L3, cela doit impliquer une solution matérielle telle qu'un HSM.", - "L": "2" - }, - { - "Shortcode": "V13.3.2", - "Ordinal": 2, - "Description": "Vérifiez que l’accès aux ressources secrètes respecte le principe du moindre privilège.", - "L": "2" - }, - { - "Shortcode": "V13.3.3", - "Ordinal": 3, - "Description": "Vérifiez que toutes les opérations cryptographiques sont effectuées à l'aide d'un module de sécurité isolé (tel qu'un coffre-fort ou un module de sécurité matériel) pour gérer et protéger en toute sécurité le matériel clé contre toute exposition en dehors du module de sécurité.", - "L": "3" - }, - { - "Shortcode": "V13.3.4", - "Ordinal": 4, - "Description": "Vérifiez que les secrets sont configurés pour expirer et être renouvelés en fonction de la documentation de l'application.", - "L": "3" - } - ] - }, - { - "Shortcode": "V13.4", - "Ordinal": 4, - "Name": "Fuite d'informations involontaire", - "Items": [ - { - "Shortcode": "V13.4.1", - "Ordinal": 1, - "Description": "Vérifiez que l'application est déployée soit sans aucune métadonnée de contrôle de source, y compris les dossiers .git ou .svn, soit de manière à ce que ces dossiers soient inaccessibles à la fois en externe et à l'application elle-même.", - "L": "1" - }, - { - "Shortcode": "V13.4.2", - "Ordinal": 2, - "Description": "Vérifiez que les modes de débogage sont désactivés pour tous les composants dans les environnements de production afin d’éviter l’exposition des fonctionnalités de débogage et la fuite d’informations.", - "L": "2" - }, - { - "Shortcode": "V13.4.3", - "Ordinal": 3, - "Description": "Vérifiez que les serveurs Web n’exposent pas les listes de répertoires aux clients, sauf si cela est explicitement prévu.", - "L": "2" - }, - { - "Shortcode": "V13.4.4", - "Ordinal": 4, - "Description": "Vérifiez que l’utilisation de la méthode HTTP TRACE n’est pas prise en charge dans les environnements de production, afin d’éviter toute fuite d’informations potentielle.", - "L": "2" - }, - { - "Shortcode": "V13.4.5", - "Ordinal": 5, - "Description": "Vérifiez que la documentation (comme pour les API internes) et les endpoints de surveillance ne sont pas exposés, sauf si cela est explicitement prévu.", - "L": "2" - }, - { - "Shortcode": "V13.4.6", - "Ordinal": 6, - "Description": "Vérifiez que l’application n’expose pas d’informations de version détaillées des composants backend.", - "L": "3" - }, - { - "Shortcode": "V13.4.7", - "Ordinal": 7, - "Description": "Vérifiez que la couche web est configuré pour servir uniquement les fichiers avec des extensions de fichier spécifiques afin d’éviter toute fuite involontaire d’informations, de configuration et de code source.", - "L": "3" - } - ] - } - ] - }, - { - "Shortcode": "V14", - "Ordinal": 14, - "ShortName": "Data", - "Name": "Protection des données", - "Items": [ - { - "Shortcode": "V14.1", - "Ordinal": 1, - "Name": "Documentation sur la protection des données", - "Items": [ - { - "Shortcode": "V14.1.1", - "Ordinal": 1, - "Description": "Vérifiez que toutes les données sensibles créées et traitées par l'application ont été identifiées et classées selon leur niveau de protection. Cela inclut les données uniquement codées et donc facilement déchiffrables, telles que les chaînes Base64 ou la charge utile en texte clair d'un JWT. Les niveaux de protection doivent tenir compte des réglementations et normes de protection des données et de confidentialité auxquelles l'application est tenue de se conformer.", - "L": "2" - }, - { - "Shortcode": "V14.1.2", - "Ordinal": 2, - "Description": "Vérifier que tous les niveaux de protection des données sensibles sont assortis d'un ensemble documenté d'exigences de protection. Cela doit inclure (sans s'y limiter) les exigences relatives au chiffrement général, à la vérification de l'intégrité, à la conservation, à la journalisation des données, aux contrôles d'accès aux données sensibles dans les journaux, au chiffrement au niveau de la base de données, aux technologies de confidentialité et de renforcement de la confidentialité à utiliser, ainsi qu'aux autres exigences de confidentialité.", - "L": "2" - } - ] - }, - { - "Shortcode": "V14.2", - "Ordinal": 2, - "Name": "Protection générale des données", - "Items": [ - { - "Shortcode": "V14.2.1", - "Ordinal": 1, - "Description": "Vérifiez que les données sensibles sont uniquement envoyées au serveur dans les champs de corps ou d’en-tête du message HTTP, et que l’URL et la chaîne de requête ne contiennent pas d’informations sensibles, telles qu’une clé API ou un jeton de session.", - "L": "1" - }, - { - "Shortcode": "V14.2.2", - "Ordinal": 2, - "Description": "Vérifiez que l’application empêche la mise en cache des données sensibles dans les composants du serveur, tels que les équilibreurs de charge et les caches d’application, ou garantit que les données sont purgées en toute sécurité après utilisation.", - "L": "2" - }, - { - "Shortcode": "V14.2.3", - "Ordinal": 3, - "Description": "Vérifiez que les données sensibles définies ne sont pas envoyées à des parties non fiables (par exemple, des trackers d'utilisateurs) pour empêcher la collecte indésirable de données en dehors du contrôle de l'application.", - "L": "2" - }, - { - "Shortcode": "V14.2.4", - "Ordinal": 4, - "Description": "Vérifiez que les contrôles autour des données sensibles liés au chiffrement, à la vérification de l'intégrité, à la conservation, à la manière dont les données doivent être enregistrées, aux contrôles d'accès autour des données sensibles dans les journaux, à la confidentialité et aux technologies d'amélioration de la confidentialité, sont mis en œuvre comme défini dans la documentation pour le niveau de protection des données spécifiques.", - "L": "2" - }, - { - "Shortcode": "V14.2.5", - "Ordinal": 5, - "Description": "Vérifiez que les mécanismes de mise en cache sont configurés pour ne mettre en cache que les réponses dont le type de contenu est conforme à la ressource et qui ne contiennent pas de contenu sensible et dynamique. Le serveur web doit renvoyer une réponse 404 ou 302 lors de l'accès à un fichier inexistant plutôt qu'un fichier valide différent. Cela devrait empêcher les attaques par empoisonnement de cache web.", - "L": "3" - }, - { - "Shortcode": "V14.2.6", - "Ordinal": 6, - "Description": "Vérifiez que l'application ne renvoie que les données sensibles minimales requises pour son fonctionnement. Par exemple, ne renvoyez que certains chiffres d'un numéro de carte de crédit, et non le numéro complet. Si les données complètes sont requises, elles doivent être masquées dans l'interface utilisateur, sauf si l'utilisateur les consulte spécifiquement.", - "L": "3" - }, - { - "Shortcode": "V14.2.7", - "Ordinal": 7, - "Description": "Vérifiez que les informations sensibles sont soumises à une classification de conservation des données, en veillant à ce que les données obsolètes ou inutiles soient supprimées automatiquement, selon un calendrier défini ou selon les besoins de la situation.", - "L": "3" - }, - { - "Shortcode": "V14.2.8", - "Ordinal": 8, - "Description": "Vérifiez que les informations sensibles sont supprimées des métadonnées des fichiers soumis par l'utilisateur, sauf si le stockage est autorisé par l'utilisateur.", - "L": "3" - } - ] - }, - { - "Shortcode": "V14.3", - "Ordinal": 3, - "Name": "Protection des données côté client", - "Items": [ - { - "Shortcode": "V14.3.1", - "Ordinal": 1, - "Description": "Vérifiez que les données authentifiées sont effacées du stockage client, comme le DOM du navigateur, après la fin du client ou de la session. Le champ d'en-tête de réponse HTTP « Clear-Site-Data » peut être utile, mais le côté client devrait également pouvoir effectuer la correction si la connexion au serveur n'est pas disponible à la fin de la session.", - "L": "1" - }, - { - "Shortcode": "V14.3.2", - "Ordinal": 2, - "Description": "Vérifiez que l'application définit suffisamment de champs d'en-tête de réponse HTTP anti-caching (c'est-à-dire Cache-Control : no-store) afin que les données sensibles ne soient pas mises en cache dans les navigateurs.", - "L": "2" - }, - { - "Shortcode": "V14.3.3", - "Ordinal": 3, - "Description": "Vérifiez que les données stockées dans le stockage du navigateur (telles que localStorage, sessionStorage, IndexedDB ou les cookies) ne contiennent pas de données sensibles, à l'exception des jetons de session.", - "L": "2" - } - ] - } - ] - }, - { - "Shortcode": "V15", - "Ordinal": 15, - "ShortName": "Secure", - "Name": "Développement et architecture sécurisés", - "Items": [ - { - "Shortcode": "V15.1", - "Ordinal": 1, - "Name": "Documentation sur le développement et l'architecture sécurisés", - "Items": [ - { - "Shortcode": "V15.1.1", - "Ordinal": 1, - "Description": "Vérifiez que la documentation de l'application définit les délais de correction basés sur les risques pour les versions de composants tiers présentant des vulnérabilités et pour la mise à jour des bibliothèques en général, afin de minimiser les risques liés à ces composants.", - "L": "1" - }, - { - "Shortcode": "V15.1.2", - "Ordinal": 2, - "Description": "Vérifiez qu'un catalogue d'inventaire, tel qu'une nomenclature logicielle (SBOM), est conservé pour toutes les bibliothèques tierces utilisées, y compris en vérifiant que les composants proviennent de référentiels prédéfinis, fiables et continuellement maintenus.", - "L": "2" - }, - { - "Shortcode": "V15.1.3", - "Ordinal": 3, - "Description": "Vérifiez que la documentation de l'application identifie les fonctionnalités consommatrices en temps ou gourmandes en ressources. Elle doit notamment indiquer comment prévenir une perte de disponibilité due à une utilisation excessive de ces fonctionnalités et éviter que la génération d'une réponse ne prenne plus de temps que le délai d'expiration du consommateur. Les mesures de protection potentielles peuvent inclure le traitement asynchrone, l'utilisation de files d'attente et la limitation des processus parallèles par utilisateur et par application.", - "L": "2" - }, - { - "Shortcode": "V15.1.4", - "Ordinal": 4, - "Description": "Vérifiez que la documentation de l’application met en évidence les bibliothèques tierces qui sont considérées comme des « composants à risque ».", - "L": "3" - }, - { - "Shortcode": "V15.1.5", - "Ordinal": 5, - "Description": "Vérifiez que la documentation de l’application met en évidence les parties de l’application où des « fonctionnalités dangereuses » sont utilisées.", - "L": "3" - } - ] - }, - { - "Shortcode": "V15.2", - "Ordinal": 2, - "Name": "Architecture de sécurité et dépendances", - "Items": [ - { - "Shortcode": "V15.2.1", - "Ordinal": 1, - "Description": "Vérifiez que l’application contient uniquement des composants qui n’ont pas dépassé les délais de mise à jour et de correction documentés.", - "L": "1" - }, - { - "Shortcode": "V15.2.2", - "Ordinal": 2, - "Description": "Vérifiez que l'application a mis en œuvre des défenses contre la perte de disponibilité due à des fonctionnalités qui prennent du temps ou qui nécessitent des ressources, sur la base des décisions et stratégies de sécurité documentées à cet effet.", - "L": "2" - }, - { - "Shortcode": "V15.2.3", - "Ordinal": 3, - "Description": "Vérifiez que l'environnement de production inclut uniquement les fonctionnalités nécessaires au fonctionnement de l'application et n'expose pas de fonctionnalités superflues telles que du code de test, des exemples d'extraits et des fonctionnalités de développement.", - "L": "2" - }, - { - "Shortcode": "V15.2.4", - "Ordinal": 4, - "Description": "Vérifiez que les composants tiers et toutes leurs dépendances transitives sont inclus à partir du référentiel attendu, qu'il soit détenu en interne ou qu'il s'agisse d'une source externe, et qu'il n'y a aucun risque d'attaque par confusion de dépendances.", - "L": "3" - }, - { - "Shortcode": "V15.2.5", - "Ordinal": 5, - "Description": "Vérifiez que l'application implémente des protections supplémentaires autour des parties documentées comme contenant des « fonctionnalités dangereuses » ou utilisant des bibliothèques tierces considérées comme des « composants à risque ». Cela peut inclure des techniques telles que le sandboxing, l'encapsulation, la conteneurisation ou l'isolation au niveau du réseau pour retarder et dissuader les attaquants qui compromettent une partie de l'application de se propager ailleurs.", - "L": "3" - } - ] - }, - { - "Shortcode": "V15.3", - "Ordinal": 3, - "Name": "Développement défensif", - "Items": [ - { - "Shortcode": "V15.3.1", - "Ordinal": 1, - "Description": "Vérifiez que l'application ne renvoie que le sous-ensemble requis de champs d'un objet de données. Par exemple, elle ne doit pas renvoyer un objet de données entier, car certains champs individuels ne doivent pas être accessibles aux utilisateurs.", - "L": "1" - }, - { - "Shortcode": "V15.3.2", - "Ordinal": 2, - "Description": "Vérifiez que lorsque le backend de l'application effectue des appels vers des URL externes, il est configuré pour ne pas suivre les redirections, sauf s'il s'agit d'une fonctionnalité prévue.", - "L": "2" - }, - { - "Shortcode": "V15.3.3", - "Ordinal": 3, - "Description": "Vérifiez que l'application dispose de contre-mesures pour se protéger contre les attaques d'affectation de masse en limitant les champs autorisés par contrôleur et action, par exemple, il n'est pas possible d'insérer ou de mettre à jour une valeur de champ lorsqu'elle n'était pas destinée à faire partie de cette action.", - "L": "2" - }, - { - "Shortcode": "V15.3.4", - "Ordinal": 4, - "Description": "Vérifiez que tous les composants proxy et middleware transfèrent correctement l'adresse IP d'origine de l'utilisateur à l'aide de champs de données fiables qui ne peuvent pas être manipulés par l'utilisateur final, et que l'application et le serveur Web utilisent cette valeur correcte pour la journalisation et les décisions de sécurité telles que la limitation du débit, en tenant compte du fait que même l'adresse IP d'origine peut ne pas être fiable en raison d'adresses IP dynamiques, de VPN ou de pare-feu d'entreprise.", - "L": "2" - }, - { - "Shortcode": "V15.3.5", - "Ordinal": 5, - "Description": "Vérifiez que l'application garantit explicitement que les variables sont du type correct et effectue des opérations d'égalité et de comparaison strictes. Cela permet d'éviter les vulnérabilités liées à la confusion de types, causées par des hypothèses du code de l'application sur le type d'une variable.", - "L": "2" - }, - { - "Shortcode": "V15.3.6", - "Ordinal": 6, - "Description": "Vérifiez que le code JavaScript est écrit de manière à éviter la pollution du prototype, par exemple en utilisant Set() ou Map() au lieu de littéraux d'objet.", - "L": "2" - }, - { - "Shortcode": "V15.3.7", - "Ordinal": 7, - "Description": "Vérifiez que l'application dispose de défenses contre les attaques de pollution des paramètres HTTP, en particulier si le Framework d'application ne fait aucune distinction quant à la source des paramètres de requête (chaîne de requête, paramètres de corps, cookies ou champs d'en-tête).", - "L": "2" - } - ] - }, - { - "Shortcode": "V15.4", - "Ordinal": 4, - "Name": "Concurrence sécurisée", - "Items": [ - { - "Shortcode": "V15.4.1", - "Ordinal": 1, - "Description": "Vérifiez que les objets partagés dans le code multithread (tels que les caches, les fichiers ou les objets en mémoire accessibles par plusieurs threads) sont accessibles en toute sécurité à l'aide de types thread-safe et de mécanismes de synchronisation tels que des verrous ou des sémaphores pour éviter les conditions de concurrence et la corruption des données.", - "L": "3" - }, - { - "Shortcode": "V15.4.2", - "Ordinal": 2, - "Description": "Vérifiez que les vérifications de l'état d'une ressource, comme son existence ou ses autorisations, et des actions qui en dépendent, sont effectuées en une seule opération atomique afin d'éviter les situations de concurrence entre le moment de la vérification et le moment de l'utilisation (TOCTOU). Par exemple, vérifier l'existence d'un fichier avant de l'ouvrir ou l'accès d'un utilisateur avant de l'accorder.", - "L": "3" - }, - { - "Shortcode": "V15.4.3", - "Ordinal": 3, - "Description": "Vérifiez que les verrous sont utilisés de manière cohérente pour éviter que les threads ne se bloquent, que ce soit en s'attendant les uns les autres ou en réessayant sans fin, et que la logique de verrouillage reste dans le code responsable de la gestion de la ressource pour garantir que les verrous ne peuvent pas être modifiés par inadvertance ou de manière malveillante par des classes ou du code externes.", - "L": "3" - }, - { - "Shortcode": "V15.4.4", - "Ordinal": 4, - "Description": "Vérifiez que les politiques d'allocation des ressources empêchent la saturation de threads en garantissant un accès équitable aux ressources, par exemple en exploitant les pools de threads, permettant aux threads de priorité inférieure de continuer dans un délai raisonnable.", - "L": "3" - } - ] - } - ] - }, - { - "Shortcode": "V16", - "Ordinal": 16, - "ShortName": "Security", - "Name": "Journalisation de sécurité et gestion des erreurs", - "Items": [ - { - "Shortcode": "V16.1", - "Ordinal": 1, - "Name": "Documentation sur la journalisation de sécurité", - "Items": [ - { - "Shortcode": "V16.1.1", - "Ordinal": 1, - "Description": "Vérifiez qu'il existe un inventaire documentant la journalisation effectuée à chaque couche de la pile technologique de l'application, les événements enregistrés, les formats de journal, l'endroit où cette journalisation est stockée, la manière dont elle est utilisée, la manière dont l'accès à celle-ci est contrôlé et la durée de conservation des journaux.", - "L": "2" - } - ] - }, - { - "Shortcode": "V16.2", - "Ordinal": 2, - "Name": "Journalisation générale", - "Items": [ - { - "Shortcode": "V16.2.1", - "Ordinal": 1, - "Description": "Vérifiez que chaque entrée de journal inclut les métadonnées nécessaires (telles que quand, où, qui, quoi) qui permettraient une enquête détaillée sur la chronologie lorsqu'un événement se produit.", - "L": "2" - }, - { - "Shortcode": "V16.2.2", - "Ordinal": 2, - "Description": "Vérifiez que les sources de temps de tous les composants de journalisation sont synchronisées et que les horodatages des métadonnées des événements de sécurité utilisent le temps UTC ou incluent un décalage horaire explicite. L'UTC est recommandé pour garantir la cohérence entre les systèmes distribués et éviter toute confusion lors du passage à l'heure d'été.", - "L": "2" - }, - { - "Shortcode": "V16.2.3", - "Ordinal": 3, - "Description": "Vérifiez que l’application stocke ou diffuse uniquement les journaux vers les fichiers et services documentés dans l’inventaire des journaux.", - "L": "2" - }, - { - "Shortcode": "V16.2.4", - "Ordinal": 4, - "Description": "Vérifiez que les journaux peuvent être lus et corrélés par le processeur de journaux utilisé, de préférence en utilisant un format de journalisation commun.", - "L": "2" - }, - { - "Shortcode": "V16.2.5", - "Ordinal": 5, - "Description": "Vérifiez que l'application applique la journalisation en fonction du niveau de protection des données lors de la journalisation de données sensibles. Par exemple, certaines données, comme les identifiants ou les informations de paiement, peuvent être interdites. D'autres données, comme les jetons de session, ne peuvent être enregistrées que par hachage ou masquage, en totalité ou en partie.", - "L": "2" - } - ] - }, - { - "Shortcode": "V16.3", - "Ordinal": 3, - "Name": "Événements de sécurité", - "Items": [ - { - "Shortcode": "V16.3.1", - "Ordinal": 1, - "Description": "Vérifiez que toutes les opérations d'authentification sont enregistrées, y compris les tentatives réussies et infructueuses. Des métadonnées supplémentaires, telles que le type d'authentification ou les facteurs utilisés, doivent également être collectées.", - "L": "2" - }, - { - "Shortcode": "V16.3.2", - "Ordinal": 2, - "Description": "Vérifier que les tentatives d'autorisation infructueuses sont logguées. Pour le niveau 3, cela doit inclure la journalisation de toutes les décisions d'autorisation, y compris lors de l'accès à des données sensibles (sans journalisation des données sensibles elles-mêmes).", - "L": "2" - }, - { - "Shortcode": "V16.3.3", - "Ordinal": 3, - "Description": "Vérifiez que l'application enregistre les événements de sécurité définis dans la documentation et enregistre également les tentatives de contournement des contrôles de sécurité, tels que la validation des entrées, la logique métier et l'anti-automatisation.", - "L": "2" - }, - { - "Shortcode": "V16.3.4", - "Ordinal": 4, - "Description": "Vérifiez que l’application enregistre les erreurs inattendues et les échecs de contrôle de sécurité tels que les échecs TLS du backend.", - "L": "2" - } - ] - }, - { - "Shortcode": "V16.4", - "Ordinal": 4, - "Name": "Protection des journaux", - "Items": [ - { - "Shortcode": "V16.4.1", - "Ordinal": 1, - "Description": "Vérifiez que tous les composants de journalisation codent correctement les données pour empêcher l’injection de journaux.", - "L": "2" - }, - { - "Shortcode": "V16.4.2", - "Ordinal": 2, - "Description": "Vérifiez que les journaux sont protégés contre tout accès non autorisé et ne peuvent pas être modifiés.", - "L": "2" - }, - { - "Shortcode": "V16.4.3", - "Ordinal": 3, - "Description": "Vérifiez que les journaux sont transmis de manière sécurisée à un système logique distinct pour analyse, détection, alerte et remontée des informations. L'objectif est de garantir qu'en cas de violation de l'application, les journaux ne seront pas compromis.", - "L": "2" - } - ] - }, - { - "Shortcode": "V16.5", - "Ordinal": 5, - "Name": "Gestion des erreurs", - "Items": [ - { - "Shortcode": "V16.5.1", - "Ordinal": 1, - "Description": "Vérifiez qu'un message générique est renvoyé au consommateur lorsqu'une erreur inattendue ou sensible à la sécurité se produit, garantissant ainsi l'absence d'exposition de données système internes sensibles telles que les traces de pile, les requêtes, les clés secrètes et les jetons.", - "L": "2" - }, - { - "Shortcode": "V16.5.2", - "Ordinal": 2, - "Description": "Vérifiez que l'application continue de fonctionner en toute sécurité lorsque l'accès aux ressources externes échoue, par exemple, en utilisant des modèles tels que des disjoncteurs ou une dégradation progressive.", - "L": "2" - }, - { - "Shortcode": "V16.5.3", - "Ordinal": 3, - "Description": "Vérifiez que l'application échoue proprement et sécurisée, y compris lorsqu'une exception se produit, en évitant les accès en cas d'erreur telles que le traitement d'une transaction malgré les erreurs résultant de la logique de validation.", - "L": "2" - }, - { - "Shortcode": "V16.5.4", - "Ordinal": 4, - "Description": "Vérifiez qu'un gestionnaire d'erreurs de « dernier recours » est défini pour intercepter toutes les exceptions non gérées. Cela permet d'éviter la perte des informations d'erreur qui doivent être loguées dans les fichiers journaux et de garantir qu'une erreur ne paralyse pas l'ensemble du processus applicatif, entraînant une perte de disponibilité.", - "L": "3" - } - ] - } - ] - }, - { - "Shortcode": "V17", - "Ordinal": 17, - "ShortName": "WebRTC", - "Name": "WebRTC", - "Items": [ - { - "Shortcode": "V17.1", - "Ordinal": 1, - "Name": "Serveur TURN", - "Items": [ - { - "Shortcode": "V17.1.1", - "Ordinal": 1, - "Description": "Vérifiez que le service TURN (Traversal Using Relays around NAT) autorise uniquement l'accès aux adresses IP non réservées à des fins spécifiques (par exemple, réseaux internes, diffusion, bouclage). Notez que cela s'applique aux adresses IPv4 et IPv6.", - "L": "2" - }, - { - "Shortcode": "V17.1.2", - "Ordinal": 2, - "Description": "Vérifiez que le service Traversal Using Relays around NAT (TURN) n'est pas susceptible d'épuiser ses ressources lorsque des utilisateurs légitimes tentent d'ouvrir un grand nombre de ports sur le serveur TURN.", - "L": "3" - } - ] - }, - { - "Shortcode": "V17.2", - "Ordinal": 2, - "Name": "Média", - "Items": [ - { - "Shortcode": "V17.2.1", - "Ordinal": 1, - "Description": "Vérifiez que la clé du certificat Datagram Transport Layer Security (DTLS) est gérée et protégée conformément à la politique documentée de gestion des clés cryptographiques.", - "L": "2" - }, - { - "Shortcode": "V17.2.2", - "Ordinal": 2, - "Description": "Vérifiez que le serveur multimédia est configuré pour utiliser et prendre en charge les suites de chiffrement DTLS (Datagram Transport Layer Security) approuvées et un profil de protection sécurisé pour l'extension DTLS pour l'établissement de clés pour le protocole de transport en temps réel sécurisé (DTLS-SRTP).", - "L": "2" - }, - { - "Shortcode": "V17.2.3", - "Ordinal": 3, - "Description": "Vérifiez que l'authentification SRTP (Secure Real-time Transport Protocol) est vérifiée sur le serveur multimédia pour empêcher les attaques par injection RTP (Real-time Transport Protocol) d'entraîner une condition de déni de service ou l'insertion de médias audio ou vidéo dans les flux multimédias.", - "L": "2" - }, - { - "Shortcode": "V17.2.4", - "Ordinal": 4, - "Description": "Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant lorsqu'il rencontre des paquets SRTP (Secure Real-time Transport Protocol) mal formés.", - "L": "2" - }, - { - "Shortcode": "V17.2.5", - "Ordinal": 5, - "Description": "Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.", - "L": "3" - }, - { - "Shortcode": "V17.2.6", - "Ordinal": 6, - "Description": "Vérifiez que le serveur multimédia n'est pas sensible à la vulnérabilité de condition de concurrence « ClientHello » dans Datagram Transport Layer Security (DTLS) en vérifiant si le serveur multimédia est publiquement connu comme étant vulnérable ou en effectuant le test de condition de concurrence.", - "L": "3" - }, - { - "Shortcode": "V17.2.7", - "Ordinal": 7, - "Description": "Vérifiez que tous les mécanismes d'enregistrement audio ou vidéo associés au serveur multimédia sont en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.", - "L": "3" - }, - { - "Shortcode": "V17.2.8", - "Ordinal": 8, - "Description": "Vérifiez que le certificat Datagram Transport Layer Security (DTLS) est vérifié par rapport à l'attribut d'empreinte cryptographique du protocole de description de session (SDP), en mettant fin au flux multimédia si la vérification échoue, pour garantir l'authenticité du flux multimédia.", - "L": "3" - } - ] - }, - { - "Shortcode": "V17.3", - "Ordinal": 3, - "Name": "Signalisation", - "Items": [ - { - "Shortcode": "V17.3.1", - "Ordinal": 1, - "Description": "Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation entrants légitimes lors d'une attaque par saturation. Cela peut être réalisé en implémentant une limitation de débit au niveau de la signalisation.", - "L": "2" - }, - { - "Shortcode": "V17.3.2", - "Ordinal": 2, - "Description": "Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation légitimes en cas de message mal formé susceptible de provoquer un déni de service. Cela peut inclure la validation des entrées, la gestion sécurisée des dépassements d'entiers, la prévention des dépassements de tampon et l'utilisation d'autres techniques robustes de gestion des erreurs.", - "L": "2" - } - ] - } - ] - } - ] -} diff --git a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.csv b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.csv deleted file mode 100644 index 15b13d7673..0000000000 --- a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.csv +++ /dev/null @@ -1,347 +0,0 @@ -chapter_id,chapter_name,section_id,section_name,req_id,req_description,level1,level2,level3,cwe,nist -V1,Encodage et nettoyage,V1.1,Architecture d'encodage et de nettoyage,V1.1.1,"Vérifiez que l'entrée est décodée ou non échappée vers une forme canonique une seule fois, elle n'est décodée que lorsque des données codées sous cette forme sont attendues, et que cela est fait avant de traiter davantage l'entrée, par exemple, elle n'est pas effectuée après la validation ou la désinfection de l'entrée.",,✓,✓,, -V1,Encodage et nettoyage,V1.1,Architecture d'encodage et de nettoyage,V1.1.2,"Vérifiez que l'application effectue l'encodage et l'échappement de sortie soit comme étape finale avant d'être utilisée par l'interpréteur pour lequel elle est destinée, soit par l'interpréteur lui-même.",,✓,✓,, -V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.1,"Vérifiez que l'encodage de sortie d'une réponse HTTP, d'un document HTML ou d'un document XML est pertinent pour le contexte requis, comme l'encodage des caractères pertinents pour les éléments HTML, les attributs HTML, les commentaires HTML, les CSS ou les champs d'en-tête HTTP, pour éviter de modifier la structure du message ou du document.",✓,✓,✓,, -V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.2,"Vérifiez que, lors de la création dynamique d'URL, les données non fiables sont encodées en fonction de leur contexte (par exemple, encodage d'URL ou encodage base64url pour les paramètres de requête ou de chemin). Assurez-vous que seuls les schémas d'URL sûrs sont autorisés (par exemple, interdire javascript: ou data:).",✓,✓,✓,, -V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.3,"Vérifiez que l'encodage ou l'échappement de sortie est utilisé lors de la création dynamique de contenu JavaScript (y compris JSON), pour éviter de modifier la structure du message ou du document (pour éviter l'injection JavaScript et JSON).",✓,✓,✓,, -V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.4,"Vérifiez que la sélection de données ou les requêtes de base de données (par exemple, SQL, HQL, NoSQL, Cypher) utilisent des requêtes paramétrées, des ORM, des Framework d'entités ou sont protégées contre les injections SQL et autres attaques par injection de base de données. Ceci est également pertinent lors de l'écriture de procédures stockées.",✓,✓,✓,, -V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.5,Vérifiez que l’application protège contre l’injection de commandes du système d’exploitation et que les appels du système d’exploitation utilisent des requêtes du système d’exploitation paramétrées ou utilisent un encodage de sortie de ligne de commande contextuelle.,✓,✓,✓,, -V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.6,Vérifiez que l’application protège contre les vulnérabilités d’injection LDAP ou que des contrôles de sécurité spécifiques pour empêcher l’injection LDAP ont été mis en œuvre.,,✓,✓,, -V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.7,Vérifiez que l’application est protégée contre les attaques par injection XPath en utilisant la paramétrisation des requêtes ou des requêtes précompilées.,,✓,✓,, -V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.8,"Vérifiez que les processeurs LaTeX sont configurés de manière sécurisée (par exemple, en n'utilisant pas l'indicateur « --shell-escape ») et qu'une liste d’autorisations de commandes est utilisée pour empêcher les attaques par injection LaTeX.",,✓,✓,, -V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.9,Vérifiez que l'application échappe les caractères spéciaux dans les expressions régulières (généralement à l'aide d'une barre oblique inverse) pour éviter qu'ils ne soient mal interprétés comme des métacaractères.,,✓,✓,, -V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.10,"Vérifiez que l'application est protégée contre les injections CSV et injections de formules. L'application doit respecter les règles d'échappement définies dans les sections 2.6 et 2.7 de la RFC 4180 lors de l'export de contenu CSV. De plus, lors de l'export au format CSV ou vers d'autres formats de tableur (tels que XLS, XLSX ou ODF), les caractères spéciaux (notamment « = », « + », « - », « @ », « \t » (tabulation) et « \0 » (caractère null)) doivent être protégés par une apostrophe s'ils apparaissent en premier dans une valeur de champ.",,,✓,, -V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.1,Vérifiez que toutes les entrées HTML non fiables provenant d'éditeurs WYSIWYG ou similaires sont nettoyées à l'aide d'une bibliothèque ou d'une fonctionnalité de Framework de nettoyage HTML bien connue et sécurisée.,✓,✓,✓,, -V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.2,"Vérifiez que l'application évite d'utiliser eval() ou d'autres fonctionnalités d'exécution de code dynamique telles que Spring Expression Language (SpEL). En l'absence d'alternative, toute saisie utilisateur incluse doit être nettoyée avant d'être exécutée.",✓,✓,✓,, -V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.3,"Vérifiez que les données transmises à un contexte potentiellement dangereux sont préalablement nettoyées pour appliquer des mesures de sécurité, telles qu'autoriser uniquement des caractères sûrs pour ce contexte et raccourcir des entrées trop longues.",,✓,✓,, -V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.4,"Vérifiez que le contenu Scalable Vector Graphics (SVG) scriptable fourni par l'utilisateur est validé ou nettoyé pour contenir uniquement des balises et des attributs (tels que des graphiques de dessin) qui sont sûrs pour l'application, par exemple, ne contiennent pas de scripts et d'objets étrangers.",,✓,✓,, -V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.5,"Vérifiez que l'application nettoie ou désactive le contenu du langage de modèle d'expression ou de script fourni par l'utilisateur, tel que les feuilles de style CSS, le Markdown ou XSL, BBCode ou similaire.",,✓,✓,, -V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.6,"Vérifiez que l'application protège contre les attaques de falsification de requête côté serveur (SSRF), en validant les données non fiables par rapport à une liste d'autorisation de protocoles, de domaines, de chemins et de ports et en nettoyant les caractères potentiellement dangereux avant d'utiliser les données pour appeler un autre service.",,✓,✓,, -V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.7,"Vérifiez que l'application se protège contre les attaques par injection de modèles en interdisant la création de modèles basés sur des entrées non fiables. En l'absence d'alternative, toute entrée non fiable incluse dynamiquement lors de la création du modèle doit être nettoyée ou rigoureusement validée.",,✓,✓,, -V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.8,Vérifiez que l’application nettoie correctement les entrées non fiables avant utilisation dans les requêtes Java Naming and Directory Interface (JNDI) et que JNDI est configuré de manière sécurisée pour empêcher les attaques par injection JNDI.,,✓,✓,, -V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.9,Vérifiez que l’application nettoie le contenu avant qu’il ne soit envoyé à memcache pour éviter les attaques par injection.,,✓,✓,, -V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.10,Vérifiez que les chaînes de format susceptibles d'être résolues de manière inattendue ou malveillante lors de leur utilisation sont nettoyées avant d'être traitées.,,✓,✓,, -V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.11,Vérifiez que l'application nettoie les entrées utilisateur avant de les transmettre aux systèmes de messagerie pour se protéger contre l'injection SMTP ou IMAP.,,✓,✓,, -V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.12,"Vérifiez que les expressions régulières sont exemptes d'éléments provoquant ""backtracking"" exponentiel et assurez-vous que les entrées non fiables sont nettoyées pour atténuer les attaques ReDoS ou Runaway Regex.",,,✓,, -V1,Encodage et nettoyage,V1.4,"Mémoire, chaine de caractères et code à mémoire non-managée",V1.4.1,"Vérifiez que l'application utilise des chaînes memory-safe, une copie de mémoire et une arithmétique de pointeur renforcée pour détecter ou empêcher les débordements de pile, de tampon ou de tas.",,✓,✓,, -V1,Encodage et nettoyage,V1.4,"Mémoire, chaine de caractères et code à mémoire non-managée",V1.4.2,"Vérifiez que les techniques de validation du signe, de la plage et de l’entrée sont utilisées pour éviter les dépassements d’entiers.",,✓,✓,, -V1,Encodage et nettoyage,V1.4,"Mémoire, chaine de caractères et code à mémoire non-managée",V1.4.3,"Vérifiez que la mémoire et les ressources allouées dynamiquement sont libérées et que les références ou les pointeurs vers la mémoire libérée sont supprimés ou définis à null pour éviter les ""dangling pointer"" et les vulnérabilités d'utilisation après libération.",,✓,✓,, -V1,Encodage et nettoyage,V1.5,Désérialisation sécurisée,V1.5.1,"Vérifiez que l'application configure les ""parser"" XML pour utiliser une configuration restrictive et que les fonctionnalités non sûres telles que la résolution d'entités externes sont désactivées pour empêcher les attaques XML eXternal Entity (XXE).",✓,✓,✓,, -V1,Encodage et nettoyage,V1.5,Désérialisation sécurisée,V1.5.2,"Vérifiez que la désérialisation des données non fiables garantit une gestion sécurisée des entrées, par exemple en utilisant une liste d'autorisation de types d'objets ou en limitant les types d'objets définis par le client, afin d'empêcher les attaques par désérialisation. Les mécanismes de désérialisation explicitement définis comme non sécurisés ne doivent pas être utilisés avec des entrées non fiables.",,✓,✓,, -V1,Encodage et nettoyage,V1.5,Désérialisation sécurisée,V1.5.3,"Vérifiez que les différents ""parser"" utilisés dans l'application pour le même type de données (par exemple, les ""parser"" JSON, les ""parser"" XML, les ""parser"" d'URL) effectuent l'analyse de manière cohérente et utilisent le même mécanisme d'encodage de caractères pour éviter des problèmes tels que les vulnérabilités d'interopérabilité JSON ou un comportement d'analyse d'URI ou de fichier différent exploité dans les attaques d'inclusion de fichiers à distance (RFI) ou de falsification de requête côté serveur (SSRF).",,,✓,, -V2,Validation et logique métier,V2.1,Validation et documentation de la logique métier,V2.1.1,"Vérifiez que la documentation de l'application définit des règles de validation des entrées pour vérifier la validité des éléments de données par rapport à la structure attendue. Il peut s'agir de formats de données courants tels que des numéros de carte de crédit, des adresses e-mail ou des numéros de téléphone, ou d'un format de données interne.",✓,✓,✓,, -V2,Validation et logique métier,V2.1,Validation et documentation de la logique métier,V2.1.2,"Vérifiez que la documentation de l'application définit comment valider la cohérence logique et contextuelle des éléments de données combinés, par exemple en vérifiant que la banlieue et le code postal correspondent.",,✓,✓,, -V2,Validation et logique métier,V2.1,Validation et documentation de la logique métier,V2.1.3,"Vérifiez que les attentes en matière de limites et de validations de la logique métier sont documentées, y compris par utilisateur et globalement dans l'application.",,✓,✓,, -V2,Validation et logique métier,V2.2,Validation des entrées,V2.2.1,"Vérifier que les entrées sont validées afin de respecter les attentes métier ou fonctionnelles. Cette validation doit être basée sur une liste de valeurs, de modèles et de plages autorisées, ou sur la comparaison des entrées avec une structure attendue et des limites logiques selon des règles prédéfinies. Pour le niveau 1, cette validation peut se concentrer sur les entrées utilisées pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau 2, elle doit s'appliquer à toutes les entrées.",✓,✓,✓,, -V2,Validation et logique métier,V2.2,Validation des entrées,V2.2.2,"Vérifiez que l'application est conçue pour appliquer la validation des entrées au niveau d'une couche de service de confiance. Bien que la validation côté client améliore l'ergonomie et doit être encouragée, elle ne doit pas être considérée comme un contrôle de sécurité.",✓,✓,✓,, -V2,Validation et logique métier,V2.2,Validation des entrées,V2.2.3,Vérifiez que l’application garantit que les combinaisons d’éléments de données associés sont raisonnables selon les règles prédéfinies.,,✓,✓,, -V2,Validation et logique métier,V2.3,Sécurité de la logique métier,V2.3.1,Vérifiez que l’application traitera uniquement les flux de logique métier pour le même utilisateur dans l’ordre séquentiel attendu et sans sauter d’étapes.,✓,✓,✓,, -V2,Validation et logique métier,V2.3,Sécurité de la logique métier,V2.3.2,"Vérifiez que les limites de la logique métier sont implémentées conformément à la documentation de l'application, afin d'éviter que des failles de la logique métier ne soient pas exploitées.",,✓,✓,, -V2,Validation et logique métier,V2.3,Sécurité de la logique métier,V2.3.3,Vérifiez que les transactions sont utilisées au niveau de la logique métier de telle sorte qu'une opération de logique métier réussisse dans son intégralité ou qu'elle soit restaurée à l'état correct précédent.,,✓,✓,, -V2,Validation et logique métier,V2.3,Sécurité de la logique métier,V2.3.4,Vérifiez que les mécanismes de verrouillage au niveau de la logique métier sont utilisés pour garantir que les ressources en quantité limitée (telles que les sièges de théâtre ou les créneaux de livraison) ne peuvent pas être réservées deux fois en manipulant la logique de l'application.,,✓,✓,, -V2,Validation et logique métier,V2.3,Sécurité de la logique métier,V2.3.5,"Vérifiez que les flux logiques métier à forte valeur ajoutée nécessitent l'approbation de plusieurs utilisateurs afin d'éviter toute action non autorisée ou accidentelle. Cela peut inclure, sans s'y limiter, les transferts monétaires importants, les approbations de contrats, l'accès à des informations classifiées ou les contournements de sécurité dans le secteur manufacturier.",,,✓,, -V2,Validation et logique métier,V2.4,Anti-automatisation,V2.4.1,"Vérifiez que des contrôles anti-automatisation sont en place pour protéger contre les appels excessifs aux fonctions d'application qui pourraient conduire à l'exfiltration de données, à la création de données inutiles, à l'épuisement des quotas, aux violations de limites de débit, au déni de service ou à la surutilisation de ressources coûteuses.",,✓,✓,, -V2,Validation et logique métier,V2.4,Anti-automatisation,V2.4.2,"Vérifiez que les flux logiques métier nécessitent un timing humain réaliste, évitant ainsi des soumissions de transactions excessivement rapides.",,,✓,, -V3,Sécurité du frontend Web,V3.1,Documentation sur la sécurité du frontend Web,V3.1.1,"Vérifiez que la documentation de l'application indique les fonctionnalités de sécurité attendues que les navigateurs utilisant l'application doivent prendre en charge (telles que HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) et autres mécanismes de sécurité HTTP pertinents). Elle doit également définir le comportement de l'application lorsque certaines de ces fonctionnalités ne sont pas disponibles (par exemple, avertir l'utilisateur ou bloquer l'accès).",,,✓,, -V3,Sécurité du frontend Web,V3.2,Interprétation non intentionnelle du contenu,V3.2.1,"Vérifiez que des contrôles de sécurité sont en place pour empêcher les navigateurs d'afficher du contenu ou des fonctionnalités dans les réponses HTTP dans un contexte incorrect (par exemple, lorsqu'une API, un fichier téléchargé par l'utilisateur ou une autre ressource est demandée directement). Les contrôles possibles peuvent inclure : ne pas transmettre le contenu sauf si les champs d'en-tête de requête HTTP (tels que Sec-Fetch-\*) indiquent qu'il s'agit du contexte correct, utiliser la directive sandbox du champ d'en-tête Content-Security-Policy ou utiliser le type de disposition de pièce jointe dans le champ d'en-tête Content-Disposition.",✓,✓,✓,, -V3,Sécurité du frontend Web,V3.2,Interprétation non intentionnelle du contenu,V3.2.2,"Vérifiez que le contenu destiné à être affiché sous forme de texte, plutôt que rendu sous forme de HTML, est géré à l'aide de fonctions de rendu sécurisées (telles que createTextNode ou textContent) pour empêcher l'exécution involontaire de contenu tel que HTML ou JavaScript.",✓,✓,✓,, -V3,Sécurité du frontend Web,V3.2,Interprétation non intentionnelle du contenu,V3.2.3,"Vérifiez que l'application évite l'écrasement du DOM lors de l'utilisation de JavaScript côté client en utilisant des déclarations de variables explicites, en effectuant une vérification de type stricte, en évitant de stocker des variables globales sur l'objet document et en implémentant l'isolation de l'espace de nommage.",,,✓,, -V3,Sécurité du frontend Web,V3.3,Configuration des cookies,V3.3.1,"Vérifiez que les cookies ont l'attribut « Secure » ​​défini et si le préfixe « \__Host- » n'est pas utilisé pour le nom du cookie, le préfixe « __Secure- » doit être utilisé pour le nom du cookie.",✓,✓,✓,, -V3,Sécurité du frontend Web,V3.3,Configuration des cookies,V3.3.2,"Vérifiez que la valeur de l'attribut « SameSite » de chaque cookie est définie en fonction de l'objectif du cookie, afin de limiter l'exposition aux attaques de réparation de l'interface utilisateur et aux attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).",,✓,✓,, -V3,Sécurité du frontend Web,V3.3,Configuration des cookies,V3.3.3,"Vérifiez que les cookies ont le préfixe « __Host- » pour le nom du cookie, sauf s'ils sont explicitement conçus pour être partagés avec d'autres hôtes.",,✓,✓,, -V3,Sécurité du frontend Web,V3.3,Configuration des cookies,V3.3.4,"Vérifiez que si la valeur d'un cookie n'est pas censée être accessible aux scripts côté client (comme un jeton de session), le cookie doit avoir l'attribut « HttpOnly » défini et la même valeur (par exemple, un jeton de session) ne doit être transférée au client que via le champ d'en-tête « Set-Cookie ».",,✓,✓,, -V3,Sécurité du frontend Web,V3.3,Configuration des cookies,V3.3.5,"Vérifiez que lorsque l'application écrit un cookie, la longueur combinée du nom et de la valeur du cookie ne dépasse pas 4 096 octets. Les cookies trop volumineux ne seront pas stockés par le navigateur et ne seront donc pas envoyés avec les requêtes, empêchant ainsi l'utilisateur d'utiliser les fonctionnalités de l'application qui reposent sur ce cookie.",,,✓,, -V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.1,"Vérifiez qu'un champ d'en-tête Strict-Transport-Security est inclus dans toutes les réponses afin d'appliquer une politique HTTP Strict Transport Security (HSTS). Une durée maximale d'au moins un an doit être définie, et pour les niveaux L2 et supérieurs, la politique doit également s'appliquer à tous les sous-domaines.",✓,✓,✓,, -V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.2,"Vérifiez que le champ d'en-tête Access-Control-Allow-Origin du partage de ressources cross-origine (CORS) est une valeur fixe de l'application ou, si la valeur du champ d'en-tête de requête HTTP Origin est utilisée, qu'elle est validée par rapport à une liste d'origines approuvées. Si « Access-Control-Allow-Origin: * » doit être utilisé, vérifiez que la réponse ne contient aucune information sensible.",✓,✓,✓,, -V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.3,"Vérifiez que les réponses HTTP incluent un champ d'en-tête de réponse Content-Security-Policy qui définit des directives garantissant que le navigateur charge et exécute uniquement du contenu ou des ressources fiables, afin de limiter l'exécution de JavaScript malveillant. Au minimum, une politique globale doit être utilisée, incluant les directives object-src 'none' et base-uri 'none', et définissant soit une lliste d’autorisations, soit des valeurs nonces ou des hachages. Pour une application L3, une politique par réponse avec des valeurs nonces ou des hachages doit être définie.",,✓,✓,, -V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.4,"Vérifiez que toutes les réponses HTTP contiennent un champ d'en-tête « X-Content-Type-Options: nosniff ». Cela indique aux navigateurs de ne pas utiliser l'analyse de contenu ni la détection du type MIME pour la réponse donnée, et d'exiger que la valeur du champ d'en-tête « Content-Type » de la réponse corresponde à la ressource de destination. Par exemple, la réponse à une demande de style n'est acceptée que si le type de contenu de la réponse est « text/css ». Cela permet également au navigateur d'utiliser la fonctionnalité de blocage de lecture inter-origines (CORB).",,✓,✓,, -V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.5,"Vérifiez que l'application définit une politique de référencement afin d'empêcher la fuite de données techniquement sensibles vers des services tiers via le champ d'en-tête de requête HTTP « Referer ». Cela peut être effectué via le champ d'en-tête de réponse HTTP « Referrer-Policy » ou via les attributs d'élément HTML. Les données sensibles peuvent inclure le chemin d'accès et les données de requête dans l'URL, et pour les applications internes non publiques, le nom d'hôte.",,✓,✓,, -V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.6,"Vérifiez que l'application Web utilise la directive frame-ancestors du champ d'en-tête Content-Security-Policy pour chaque réponse HTTP afin de garantir qu'elle ne peut pas être intégrée par défaut et que l'intégration de ressources spécifiques n'est autorisée qu'en cas de nécessité. Notez que le champ d'en-tête X-Frame-Options, bien que pris en charge par les navigateurs, est obsolète et n'est pas forcément fiable.",,✓,✓,, -V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.7,Vérifiez que le champ d’en-tête Content-Security-Policy spécifie un emplacement pour signaler les violations.,,,✓,, -V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.8,"Vérifiez que toutes les réponses HTTP qui lancent le rendu d'un document (comme les réponses de type text/html) incluent le champ d'en-tête 'Cross-Origin-Opener-Policy' avec la directive 'same-origin' ou s'ame-origin-allow-popups', selon les besoins. Cela empêche les attaques abusant de l'accès partagé aux objets Window, telles que le tabnabbing et le comptage d'images.",,,✓,, -V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.1,"Vérifiez que, si l'application ne s'appuie pas sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher les requêtes inter-origines non autorisées d'utiliser des fonctionnalités sensibles, ces requêtes sont validées afin de garantir leur origine. Cela peut se faire en utilisant et en validant des jetons anti-falsification ou en exigeant des champs d'en-tête HTTP supplémentaires qui ne sont pas des champs d'en-tête de requête CORS safelist. Ceci permet de se protéger contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).",✓,✓,✓,, -V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.2,"Vérifiez que, si l'application s'appuie sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher l'utilisation inter-origines non autorisée de fonctionnalités sensibles, il est impossible d'appeler la fonctionnalité avec une requête qui ne déclenche pas de requête de pré-vérification cross-origin CORS. Cela peut nécessiter de vérifier les valeurs des champs d'en-tête de requête 'Origin' et 'Content-Type' ou d'utiliser un champ d'en-tête supplémentaire qui n'est pas un champ d'en-tête de la liste de sécurité CORS.",✓,✓,✓,, -V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.3,"Vérifiez que les requêtes HTTP destinées aux fonctionnalités sensibles utilisent des méthodes HTTP appropriées, telles que POST, PUT, PATCH ou DELETE, et non des méthodes définies comme « sûres » par la spécification HTTP, telles que HEAD, OPTIONS ou GET. Une validation stricte des champs d'en-tête de requête Sec-Fetch-* peut également être utilisée pour garantir que la requête ne provient pas d'un appel inter-origines inapproprié, d'une requête de navigation ou d'un chargement de ressources (comme une source d'image) inattendu.",✓,✓,✓,, -V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.4,"Vérifiez que des applications distinctes sont hébergées sur des noms d'hôte différents pour tirer parti des restrictions fournies par la politique de même origine, y compris la manière dont les documents ou scripts chargés par une origine peuvent interagir avec les ressources d'une autre origine et les restrictions basées sur le nom d'hôte sur les cookies.",,✓,✓,, -V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.5,Vérifiez que les messages reçus par l'interface postMessage sont rejetés si l'origine du message n'est pas digne de confiance ou si la syntaxe du message n'est pas valide.,,✓,✓,, -V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.6,Vérifiez que la fonctionnalité JSONP n'est activée nulle part dans l'application pour éviter les attaques Cross-Site Script Inclusion (XSSI).,,,✓,, -V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.7,"Vérifiez que les données nécessitant une autorisation ne sont pas incluses dans les réponses des ressources de script, comme les fichiers JavaScript, pour empêcher les attaques par inclusion de script intersite (XSSI).",,,✓,, -V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.8,"Vérifiez que les ressources authentifiées (telles que les images, les vidéos, les scripts et autres documents) peuvent être chargées ou intégrées pour le compte de l'utilisateur uniquement lorsque cela est prévu. Cela peut être réalisé en validant strictement les champs d'en-tête de requête HTTP Sec-Fetch-* afin de garantir que la requête ne provient pas d'un appel cross-origin inapproprié, ou en définissant un champ d'en-tête de réponse HTTP Cross-Origin-Resource-Policy restrictif pour indiquer au navigateur de bloquer le contenu renvoyé.",,,✓,, -V3,Sécurité du frontend Web,V3.6,Intégrité des ressources externes,V3.6.1,"Vérifiez que les ressources côté client, telles que les bibliothèques JavaScript, les feuilles de style CSS ou les polices web, sont hébergées en externe (par exemple, sur un réseau de diffusion de contenu) uniquement si la ressource est statique et versionnée, et si l'intégrité des sous-ressources (SRI) est utilisée pour valider l'intégrité de la ressource. Si cela n'est pas possible, une décision de sécurité documentée doit justifier cette décision pour chaque ressource.",,,✓,, -V3,Sécurité du frontend Web,V3.7,Autres considérations sur la sécurité du navigateur,V3.7.1,"Vérifiez que l'application utilise uniquement des technologies côté client toujours prises en charge et considérées comme sécurisées. Parmi les technologies qui ne répondent pas à cette exigence figurent les plugins NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL ou les applets Java côté client.",,✓,✓,, -V3,Sécurité du frontend Web,V3.7,Autres considérations sur la sécurité du navigateur,V3.7.2,Vérifiez que l'application redirigera automatiquement l'utilisateur vers un nom d'hôte ou un domaine différent (qui n'est pas contrôlé par l'application) uniquement lorsque la destination apparaît sur une liste d'autorisation.,,✓,✓,, -V3,Sécurité du frontend Web,V3.7,Autres considérations sur la sécurité du navigateur,V3.7.3,"Vérifiez que le domaine de premier niveau de l'application (par exemple, site.tld) ​​est ajouté à la liste de préchargement publique pour HTTP Strict Transport Security (HSTS). Cela garantit que l'utilisation de TLS pour l'application est intégrée directement dans les principaux navigateurs, plutôt que de dépendre uniquement du champ d'en-tête de réponse Strict-Transport-Security.",,,✓,, -V3,Sécurité du frontend Web,V3.7,Autres considérations sur la sécurité du navigateur,V3.7.4,"Vérifiez que l'application affiche une notification lorsque l'utilisateur est redirigé vers une URL hors du contrôle de l'application, avec une option pour annuler la navigation.",,,✓,, -V3,Sécurité du frontend Web,V3.7,Autres considérations sur la sécurité du navigateur,V3.7.5,"Vérifiez que l'application se comporte comme documenté (par exemple, en avertissant l'utilisateur ou en bloquant l'accès) si le navigateur utilisé pour accéder à l'application ne prend pas en charge les fonctionnalités de sécurité attendues.",,,✓,, -V4,API et service Web,V4.1,Sécurité du service Web générique,V4.1.1,"Vérifiez que chaque réponse HTTP avec un corps de message contient un champ d'en-tête Content-Type qui correspond au contenu réel de la réponse, y compris le paramètre charset pour spécifier un codage de caractères sécurisé (par exemple, UTF-8, ISO-8859-1) conformément aux types de médias IANA, tels que « text/ », « /+xml » et « /xml ».",✓,✓,✓,, -V4,API et service Web,V4.1,Sécurité du service Web générique,V4.1.2,"Vérifiez que seuls les terminaux utilisateurs (destinés à l'accès manuel via un navigateur web) redirigent automatiquement de HTTP vers HTTPS, tandis que les autres services ou terminaux n'implémentent pas de redirections transparentes. Cela permet d'éviter qu'un client envoie par erreur des requêtes HTTP non chiffrées, mais que, comme ces requêtes sont automatiquement redirigées vers HTTPS, la fuite de données sensibles passe inaperçue.",,✓,✓,, -V4,API et service Web,V4.1,Sécurité du service Web générique,V4.1.3,"Vérifiez que tout champ d'en-tête HTTP utilisé par l'application et défini par une couche intermédiaire, telle qu'un équilibreur de charge, un proxy web ou un service backend-for-frontend, ne peut pas être remplacé par l'utilisateur final. Les exemples d'en-têtes peuvent inclure X-Real-IP, X-Forwarded-*, ou X-User-ID.",,✓,✓,, -V4,API et service Web,V4.1,Sécurité du service Web générique,V4.1.4,Vérifiez que seules les méthodes HTTP explicitement prises en charge par l'application ou son API (y compris les OPTIONS lors des demandes de contrôle en amont) peuvent être utilisées et que les méthodes inutilisées sont bloquées.,,,✓,, -V4,API et service Web,V4.1,Sécurité du service Web générique,V4.1.5,Vérifier que les signatures numériques par message sont utilisées pour fournir une assurance supplémentaire en plus des protections de transport pour les demandes ou les transactions qui sont très sensibles ou qui traversent un certain nombre de systèmes.,,,✓,, -V4,API et service Web,V4.2,Validation de la structure des messages HTTP,V4.2.1,"Vérifiez que tous les composants de l'application (y compris les équilibreurs de charge, les pares-feux et les serveurs d'applications) déterminent les limites des messages HTTP entrants à l'aide du mécanisme approprié à la version HTTP afin d'empêcher la contrebande de requêtes HTTP. Dans HTTP/1.x, si un champ d'en-tête Transfer-Encoding est présent, l'en-tête Content-Length doit être ignoré conformément à la RFC 2616. Avec HTTP/2 ou HTTP/3, si un champ d'en-tête Content-Length est présent, le récepteur doit s'assurer qu'il est cohérent avec la longueur des trames DATA.",,✓,✓,, -V4,API et service Web,V4.2,Validation de la structure des messages HTTP,V4.2.2,"Vérifier que, lors de la génération de messages HTTP, le champ d'en-tête Content-Length n'entre pas en conflit avec la longueur du contenu déterminée par le cadrage du protocole HTTP, afin d'empêcher les attaques de type « request smuggling ».",,,✓,, -V4,API et service Web,V4.2,Validation de la structure des messages HTTP,V4.2.3,"Vérifiez que l'application n'envoie ni n'accepte de messages HTTP/2 ou HTTP/3 avec des champs d'en-tête spécifiques à la connexion, tels que Transfer-Encoding, afin d'éviter les attaques par fractionnement de la réponse et par injection d'en-tête.",,,✓,, -V4,API et service Web,V4.2,Validation de la structure des messages HTTP,V4.2.4,"Vérifiez que l'application n'accepte que les requêtes HTTP/2 et HTTP/3 dont les champs et valeurs d'en-tête ne contiennent pas de séquences CR (\r), LF (\n) ou CRLF (\r\n), afin d'éviter les attaques par injection d'en-tête.",,,✓,, -V4,API et service Web,V4.2,Validation de la structure des messages HTTP,V4.2.5,"Vérifiez que, si l'application (backend ou frontend) construit et envoie des requêtes, elle utilise des mécanismes de validation, d'assainissement ou autres pour éviter de créer des URI (comme pour les appels API) ou des champs d'en-tête de requête HTTP (comme Authorization ou Cookie) qui sont trop longs pour être acceptés par le composant récepteur. Cela pourrait entraîner un déni de service, par exemple lors de l'envoi d'une requête trop longue (par exemple, un long champ d'en-tête de cookie), ce qui fait que le serveur répond toujours avec un statut d'erreur.",,,✓,, -V4,API et service Web,V4.3,GraphQL,V4.3.1,"Vérifiez qu'une liste d'autorisation de requête, une limitation de profondeur, une limitation de quantité ou une analyse des coûts de requête est utilisée pour empêcher le déni de service (DoS) de GraphQL ou d'expression de la couche données en raison de requêtes imbriquées coûteuses.",,✓,✓,, -V4,API et service Web,V4.3,GraphQL,V4.3.2,"Vérifiez que les requêtes d’introspection GraphQL sont désactivées dans l’environnement de production, sauf si l’API GraphQL est destinée à être utilisée par d’autres parties.",,✓,✓,, -V4,API et service Web,V4.4,WebSocket,V4.4.1,Vérifiez que WebSocket sur TLS (WSS) est utilisé pour toutes les connexions WebSocket.,✓,✓,✓,, -V4,API et service Web,V4.4,WebSocket,V4.4.2,"Vérifiez que, lors de la négociation HTTP WebSocket initiale, le champ d’en-tête 'Origin' est vérifié par rapport à une liste d’origines autorisées pour l’application.",,✓,✓,, -V4,API et service Web,V4.4,WebSocket,V4.4.3,"Vérifiez que, si la gestion de session standard de l'application ne peut pas être utilisée, des jetons dédiés sont utilisés à cet effet, qui sont conformes aux exigences de sécurité de gestion de session pertinentes.",,✓,✓,, -V4,API et service Web,V4.4,WebSocket,V4.4.4,Vérifiez que les jetons de gestion de session WebSocket dédiés sont initialement obtenus ou validés via la session HTTPS précédemment authentifiée lors de la transition d'une session HTTPS existante vers un canal WebSocket.,,✓,✓,, -V5,Gestion des fichiers,V5.1,Documentation sur la gestion des fichiers,V5.1.1,"Vérifiez que la documentation définit les types de fichiers autorisés, les extensions de fichiers attendues et la taille maximale (y compris la taille décompressée) pour chaque fonctionnalité de Téléversement. De plus, assurez-vous que la documentation précise comment les fichiers sont sécurisés pour le téléchargement et le traitement des utilisateurs finaux, par exemple le comportement de l'application lorsqu'un fichier malveillant est détecté.",,✓,✓,, -V5,Gestion des fichiers,V5.2,Téléversement de fichiers et contenu,V5.2.1,Vérifiez que l'application n'acceptera que des fichiers d'une taille qu'elle peut traiter sans provoquer de perte de performances ou d'attaque par déni de service.,✓,✓,✓,, -V5,Gestion des fichiers,V5.2,Téléversement de fichiers et contenu,V5.2.2,"Vérifiez que lorsque l'application accepte un fichier, seul ou dans une archive telle qu'un fichier zip, elle vérifie si l'extension de fichier correspond à une extension attendue et que le contenu correspond au type représenté par l'extension. Cela inclut, sans s'y limiter, la vérification des « octets magiques » initiaux, la réécriture d'images et l'utilisation de bibliothèques spécialisées pour la validation du contenu des fichiers. Pour le niveau L1, cela peut se concentrer uniquement sur les fichiers utilisés pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau L2, cela doit s'appliquer à tous les fichiers acceptés.",✓,✓,✓,, -V5,Gestion des fichiers,V5.2,Téléversement de fichiers et contenu,V5.2.3,"Vérifiez que l'application vérifie les fichiers compressés (par exemple, zip, gz, docx, odt) par rapport à la taille maximale autorisée non compressée et au nombre maximal de fichiers avant de décompresser le fichier.",,✓,✓,, -V5,Gestion des fichiers,V5.2,Téléversement de fichiers et contenu,V5.2.4,Vérifiez qu'un quota de taille de fichier et un nombre maximal de fichiers par utilisateur sont appliqués pour garantir qu'un seul utilisateur ne puisse pas remplir le stockage avec trop de fichiers ou des fichiers excessivement volumineux.,,,✓,, -V5,Gestion des fichiers,V5.2,Téléversement de fichiers et contenu,V5.2.5,"Vérifiez que l'application n'autorise pas le téléversement de fichiers compressés contenant des liens symboliques, sauf si cela est spécifiquement requis (auquel cas il sera nécessaire d'appliquer une liste d'autorisation des fichiers vers lesquels il est possible de créer des liens symboliques).",,,✓,, -V5,Gestion des fichiers,V5.2,Téléversement de fichiers et contenu,V5.2.6,"Vérifiez que l'application rejette les images téléversées avec une taille de pixel supérieure au maximum autorisé, afin d'éviter les attaques par inondation de pixels.",,,✓,, -V5,Gestion des fichiers,V5.3,Stockage de fichiers,V5.3.1,Vérifiez que les fichiers téléversés ou générés par une entrée non fiable et stockés dans un dossier public ne sont pas exécutés en tant que code de programme côté serveur lorsqu'ils sont accessibles directement avec une requête HTTP.,✓,✓,✓,, -V5,Gestion des fichiers,V5.3,Stockage de fichiers,V5.3.2,"Vérifiez que lorsque l'application crée des chemins d'accès pour les opérations sur les fichiers, elle utilise des données générées en interne ou fiables plutôt que des noms de fichiers soumis par l'utilisateur. Si des noms de fichiers ou des métadonnées de fichiers soumis par l'utilisateur doivent être utilisés, une validation et un nettoyage stricts doivent être appliqués. Ceci permet de se protéger contre les attaques par traversée de chemin, l'inclusion de fichiers locaux ou distants (LFI, RFI) et la falsification de requêtes côté serveur (SSRF).",✓,✓,✓,, -V5,Gestion des fichiers,V5.3,Stockage de fichiers,V5.3.3,"Vérifiez que le traitement des fichiers côté serveur, comme la décompression des fichiers, ignore les informations de chemin fournies par l'utilisateur pour éviter les vulnérabilités telles que le ""zip slip"".",,,✓,, -V5,Gestion des fichiers,V5.4,Téléchargement de fichier,V5.4.1,"Vérifiez que l’application valide ou ignore les noms de fichiers soumis par l’utilisateur, y compris dans un paramètre JSON, JSONP ou URL et spécifie un nom de fichier dans le champ d’en-tête Content-Disposition de la réponse.",,✓,✓,, -V5,Gestion des fichiers,V5.4,Téléchargement de fichier,V5.4.2,"Vérifiez que les noms de fichiers servis (par exemple, dans les champs d'en-tête de réponse HTTP ou les pièces jointes aux e-mails) sont encodés ou nettoyés (par exemple, conformément à la RFC 6266) pour préserver la structure du document et empêcher les attaques par injection.",,✓,✓,, -V5,Gestion des fichiers,V5.4,Téléchargement de fichier,V5.4.3,Vérifiez que les fichiers obtenus à partir de sources non fiables sont analysés par des scanners antivirus pour empêcher la diffusion de contenu malveillant connu.,,✓,✓,, -V6,Authentification,V6.1,Documentation d'authentification,V6.1.1,"Vérifiez que la documentation de l'application définit comment les contrôles, tels que la limitation de débit, l'anti-automatisation et la réponse adaptative, sont utilisés pour se défendre contre les attaques telles que le « credential stuffing » et la force brute des mots de passe. La documentation doit expliquer clairement comment ces contrôles sont configurés et empêcher le blocage malveillant des comptes.",✓,✓,✓,, -V6,Authentification,V6.1,Documentation d'authentification,V6.1.2,"Vérifiez qu'une liste de mots spécifiques au contexte est documentée afin d'empêcher leur utilisation dans les mots de passe. Cette liste peut inclure des permutations de noms d'organisations, de produits, d'identifiants de systèmes, de noms de codes de projets, de noms de services ou de rôles, etc.",,✓,✓,, -V6,Authentification,V6.1,Documentation d'authentification,V6.1.3,"Vérifiez que, si l'application inclut plusieurs voies d'authentification, celles-ci sont toutes documentées avec les contrôles de sécurité et la force d'authentification qui doivent être appliqués de manière cohérente.",,✓,✓,, -V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.1,"Vérifiez que les mots de passe définis par l'utilisateur comportent au moins 8 caractères, bien qu'un minimum de 15 caractères soit fortement recommandé.",✓,✓,✓,, -V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.2,Vérifiez que les utilisateurs peuvent modifier leur mot de passe.,✓,✓,✓,, -V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.3,Vérifiez que la fonctionnalité de changement de mot de passe nécessite le mot de passe actuel et le nouveau mot de passe de l'utilisateur.,✓,✓,✓,, -V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.4,"Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou du changement de mot de passe sont vérifiés par rapport à un ensemble disponible d'au moins 3 000 mots de passe principaux qui correspondent à la politique de mot de passe de l'application, par exemple la longueur minimale.",✓,✓,✓,, -V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.5,"Vérifiez que les mots de passe peuvent être utilisés, quelle que soit leur composition, sans restriction quant au type de caractères autorisés. Aucun nombre minimal de majuscules ou de minuscules, de chiffres ou de caractères spéciaux ne doit être exigé.",✓,✓,✓,, -V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.6,Vérifiez que les champs de saisie du mot de passe utilisent type=password pour masquer la saisie. Les applications peuvent permettre à l'utilisateur d'afficher temporairement l'intégralité du mot de passe masqué ou le dernier caractère saisi.,✓,✓,✓,, -V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.7,"Vérifiez que la fonctionnalité « coller », les assistants de mot de passe du navigateur et les gestionnaires de mots de passe externes sont autorisés.",✓,✓,✓,, -V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.8,"Vérifiez que l'application vérifie le mot de passe de l'utilisateur exactement tel qu'il a été reçu de l'utilisateur, sans aucune modification telle qu'une troncature ou une transformation de casse.",✓,✓,✓,, -V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.9,Vérifiez que les mots de passe d’au moins 64 caractères sont autorisés.,,✓,✓,, -V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.10,Vérifiez que le mot de passe d'un utilisateur reste valide jusqu'à ce qu'il soit découvert comme compromis ou qu'il soit renouvelé. L'application ne doit pas exiger de renouvellement périodique des identifiants.,,✓,✓,, -V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.11,Vérifiez que la liste documentée de mots spécifiques au contexte est utilisée pour éviter la création de mots de passe faciles à deviner.,,✓,✓,, -V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.12,Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou des modifications de mot de passe sont vérifiés par rapport à un ensemble de mots de passe fuités.,,✓,✓,, -V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.1,Vérifiez que les contrôles visant à empêcher les attaques telles que le bourrage d'informations d'identification et la force brute des mots de passe sont mis en œuvre conformément à la documentation de sécurité de l'application.,✓,✓,✓,, -V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.2,"Vérifiez que les comptes d’utilisateur par défaut (par exemple, « root », « admin » ou « sa ») ne sont pas présents dans l’application ou sont désactivés.",✓,✓,✓,, -V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.3,Vérifiez que l’application exige que les utilisateurs utilisent un mécanisme d’authentification multifacteur ou une combinaison de mécanismes d’authentification à facteur unique.,,✓,✓,, -V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.4,"Vérifiez que, si l’application inclut plusieurs voies d’authentification, il n’existe aucune voie non documentée et que les contrôles de sécurité et la force d’authentification sont appliqués de manière cohérente.",,✓,✓,, -V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.5,"Vérifiez que les utilisateurs sont informés des tentatives d'authentification suspectes (réussies ou non). Il peut s'agir de tentatives d'authentification provenant d'un emplacement ou d'un client inhabituel, d'une authentification partiellement réussie (un seul facteur parmi plusieurs), d'une tentative d'authentification après une longue période d'inactivité ou d'une authentification réussie après plusieurs tentatives infructueuses.",,,✓,, -V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.6,Vérifiez que le courrier électronique n’est pas utilisé comme mécanisme d’authentification à facteur unique ou à facteurs multiples.,,,✓,, -V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.7,"Vérifiez que les utilisateurs sont avertis après les mises à jour des détails d'authentification, telles que les réinitialisations d'informations d'identification ou la modification du nom d'utilisateur ou de l'adresse e-mail.",,,✓,, -V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.8,"Vérifiez que les utilisateurs valides ne peuvent pas être déduits d'échecs d'authentification, par exemple en se basant sur des messages d'erreur, des codes de réponse HTTP ou des temps de réponse différents. Les fonctionnalités d'inscription et de mot de passe oublié doivent également bénéficier de cette protection.",,,✓,, -V6,Authentification,V6.4,Cycle de vie et récupération du facteur d'authentification,V6.4.1,"Vérifiez que les mots de passe initiaux ou les codes d'activation générés par le système sont générés de manière aléatoire et sécurisée, qu'ils respectent la politique de mots de passe en vigueur et qu'ils expirent après une courte période ou après leur première utilisation. Ces secrets initiaux ne doivent pas devenir des mots de passe permanents.",✓,✓,✓,, -V6,Authentification,V6.4,Cycle de vie et récupération du facteur d'authentification,V6.4.2,Vérifiez que les indices de mot de passe ou l'authentification basée sur les connaissances (appelées « questions secrètes ») ne sont pas présents.,✓,✓,✓,, -V6,Authentification,V6.4,Cycle de vie et récupération du facteur d'authentification,V6.4.3,"Vérifiez qu'un processus sécurisé de réinitialisation d'un mot de passe oublié est mis en œuvre, qui ne contourne aucun mécanisme d'authentification multifacteur activé.",,✓,✓,, -V6,Authentification,V6.4,Cycle de vie et récupération du facteur d'authentification,V6.4.4,"Vérifiez que si un facteur d'authentification multifacteur est perdu, la preuve de vérification d'identité est effectuée au même niveau que lors de l'inscription.",,✓,✓,, -V6,Authentification,V6.4,Cycle de vie et récupération du facteur d'authentification,V6.4.5,"Vérifiez que les instructions de renouvellement des mécanismes d'authentification qui expirent sont envoyées avec suffisamment de temps pour être exécutées avant l'expiration de l'ancien mécanisme d'authentification, en configurant des rappels automatiques si nécessaire.",,,✓,, -V6,Authentification,V6.4,Cycle de vie et récupération du facteur d'authentification,V6.4.6,"Vérifiez que les administrateurs peuvent initier la réinitialisation du mot de passe de l'utilisateur, mais que cela ne leur permet pas de modifier ou de choisir son mot de passe. Cela évite qu'ils ne connaissent le mot de passe de l'utilisateur.",,,✓,, -V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.1,"Vérifiez que les secrets de recherche, les demandes ou codes d'authentification out-of-band et les mots de passe à usage unique basés sur le temps (TOTP) ne peuvent être utilisés avec succès qu'une seule fois.",,✓,✓,, -V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.2,"Vérifiez que, lors de leur stockage dans le backend de l'application, les secrets de recherche comportant moins de 112 bits d'entropie (19 caractères alphanumériques aléatoires ou 34 chiffres aléatoires) sont hachés avec un algorithme de hachage de stockage de mots de passe approuvé, intégrant un sel aléatoire de 32 bits. Une fonction de hachage standard peut être utilisée si le secret comporte 112 bits d'entropie ou plus.",,✓,✓,, -V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.3,"Vérifiez que les secrets de recherche, le code d'authentification out-of-band et les mots de passe à usage unique basés sur le temps sont générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) pour éviter les valeurs prévisibles.",,✓,✓,, -V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.4,Vérifiez que les secrets de recherche et les codes d'authentification out-of-band ont un minimum de 20 bits d'entropie (généralement 4 caractères alphanumériques aléatoires ou 6 chiffres aléatoires suffisent).,,✓,✓,, -V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.5,"Vérifiez que les requêtes, codes ou jetons d'authentification out-of-band, ainsi que les mots de passe à usage unique (TOTP), ont une durée de vie définie. Les requêtes out-of-band doivent avoir une durée de vie maximale de 10 minutes et les TOTP, de 30 secondes.",,✓,✓,, -V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.6,Vérifiez que tout facteur d’authentification (y compris les appareils physiques) peut être révoqué en cas de vol ou autre perte.,,,✓,, -V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.7,"Vérifiez que les mécanismes d’authentification biométrique ne sont utilisés que comme facteurs secondaires, avec quelque chose que vous possédez ou quelque chose que vous savez.",,,✓,, -V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.8,Vérifiez que les mots de passe à usage unique basés sur le temps (TOTP) sont vérifiés en fonction d'une source temporelle provenant d'un service de confiance et non d'une heure non fiable ou fournie par le client.,,,✓,, -V6,Authentification,V6.6,Mécanismes d'authentification out-of-band,V6.6.1,"Vérifier que les mécanismes d'authentification utilisant le réseau téléphonique public commuté (RTPC) pour la transmission de mots de passe à usage unique (OTP) par téléphone ou SMS ne sont proposés que lorsque le numéro de téléphone a été préalablement validé. D'autres méthodes plus robustes (telles que les mots de passe à usage unique à durée déterminée) sont également proposées, et que le service informe les utilisateurs des risques de sécurité qu'elles présentent. Pour les applications de niveau 3, le téléphone et les SMS ne doivent pas être disponibles.",,✓,✓,, -V6,Authentification,V6.6,Mécanismes d'authentification out-of-band,V6.6.2,"Vérifiez que les demandes d’authentification out-of-band, les codes ou les jetons sont liés à la demande d’authentification d’origine pour laquelle ils ont été générés et ne sont pas utilisables pour une demande précédente ou ultérieure.",,✓,✓,, -V6,Authentification,V6.6,Mécanismes d'authentification out-of-band,V6.6.3,"Vérifiez qu'un mécanisme d'authentification out-of-band basé sur du code est protégé contre les attaques par force brute grâce au ""rate limiting"". Envisagez également d'utiliser un code avec au moins 64 bits d'entropie.",,✓,✓,, -V6,Authentification,V6.6,Mécanismes d'authentification out-of-band,V6.6.4,"Vérifiez que, lorsque les notifications push sont utilisées pour l'authentification multifacteur, le ""rate limiting"" est appliqué afin d'empêcher les attaques de type « push bombing ». La concordance des numéros peut également atténuer ce risque.",,,✓,, -V6,Authentification,V6.7,Mécanisme d'authentification cryptographique,V6.7.1,Vérifiez que les certificats utilisés pour vérifier les assertions d’authentification cryptographique sont stockés de manière à les protéger contre toute modification.,,,✓,, -V6,Authentification,V6.7,Mécanisme d'authentification cryptographique,V6.7.2,Vérifiez que le nonce de défi a une longueur d'au moins 64 bits et qu'il est statistiquement unique ou unique sur toute la durée de vie du périphérique cryptographique.,,,✓,, -V6,Authentification,V6.8,Authentification avec un fournisseur d'identité,V6.8.1,"Vérifiez que, si l'application prend en charge plusieurs fournisseurs d'identité (IdP), l'identité de l'utilisateur ne peut pas être usurpée via un autre fournisseur d'identité pris en charge (par exemple, en utilisant le même identifiant utilisateur). La mesure standard consisterait à ce que l'application enregistre et identifie l'utilisateur à l'aide d'une combinaison de l'ID du fournisseur d'identité (servant d'espace de noms) et de l'ID de l'utilisateur dans le fournisseur d'identité.",,✓,✓,, -V6,Authentification,V6.8,Authentification avec un fournisseur d'identité,V6.8.2,"Vérifiez que la présence et l'intégrité des signatures numériques sur les assertions d'authentification (par exemple sur les assertions JWT ou SAML) sont toujours validées, en rejetant toutes les assertions non signées ou ayant des signatures non valides.",,✓,✓,, -V6,Authentification,V6.8,Authentification avec un fournisseur d'identité,V6.8.3,Vérifiez que les assertions SAML sont traitées de manière unique et utilisées une seule fois au cours de la période de validité pour éviter les attaques par rejeu.,,✓,✓,, -V6,Authentification,V6.8,Authentification avec un fournisseur d'identité,V6.8.4,"Si une application utilise un fournisseur d'identité (IdP) distinct et attend une force, des méthodes ou une date d'authentification spécifiques pour des fonctions spécifiques, vérifiez que l'application les vérifie à l'aide des informations renvoyées par l'IdP. Par exemple, si OIDC est utilisé, cela peut être réalisé en validant les affirmations de jeton d'identification telles que « acr », « amr » et « auth_time » (le cas échéant). Si l'IdP ne fournit pas ces informations, l'application doit disposer d'une approche de secours documentée qui suppose que le mécanisme d'authentification de force minimale a été utilisé (par exemple, une authentification à facteur unique avec nom d'utilisateur et mot de passe).",,✓,✓,, -V7,Gestion des sessions,V7.1,Documentation sur la gestion des sessions,V7.1.1,"Vérifiez que le délai d'inactivité de la session de l'utilisateur et la durée de vie maximale absolue de la session sont documentés, sont appropriés en combinaison avec d'autres contrôles et que la documentation inclut une justification de tout écart par rapport aux exigences de réauthentification NIST SP 800-63B.",,✓,✓,, -V7,Gestion des sessions,V7.1,Documentation sur la gestion des sessions,V7.1.2,Vérifiez que la documentation définit le nombre de sessions simultanées (parallèles) autorisées pour un compte ainsi que les comportements et actions prévus à entreprendre lorsque le nombre maximal de sessions actives est atteint.,,✓,✓,, -V7,Gestion des sessions,V7.1,Documentation sur la gestion des sessions,V7.1.3,"Vérifiez que tous les systèmes qui créent et gèrent des sessions utilisateur dans le cadre d'un écosystème de gestion des identités fédérées (tels que les systèmes SSO) sont documentés avec des contrôles pour coordonner la durée de vie des sessions, la résiliation et toute autre condition nécessitant une réauthentification.",,✓,✓,, -V7,Gestion des sessions,V7.2,Sécurité fondamentale de la gestion des sessions,V7.2.1,Vérifiez que l’application effectue toutes les vérifications des jetons de session à l’aide d’un service backend de confiance.,✓,✓,✓,, -V7,Gestion des sessions,V7.2,Sécurité fondamentale de la gestion des sessions,V7.2.2,"Vérifiez que l'application utilise des jetons autonomes ou de référence générés dynamiquement pour la gestion des sessions, c'est-à-dire sans utiliser de secrets et de clés d'API statiques.",✓,✓,✓,, -V7,Gestion des sessions,V7.2,Sécurité fondamentale de la gestion des sessions,V7.2.3,"Vérifiez que si des jetons par référence sont utilisés pour représenter les sessions utilisateur, ils sont uniques et générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et possèdent au moins 128 bits d'entropie.",✓,✓,✓,, -V7,Gestion des sessions,V7.2,Sécurité fondamentale de la gestion des sessions,V7.2.4,"Vérifiez que l’application génère un nouveau jeton de session lors de l’authentification de l’utilisateur, y compris la réauthentification, et met fin au jeton de session actuel.",✓,✓,✓,, -V7,Gestion des sessions,V7.3,Délai d'expiration de la session,V7.3.1,Vérifiez qu’il existe un délai d’inactivité tel que la réauthentification soit appliquée conformément à l’analyse des risques et aux décisions de sécurité documentées.,,✓,✓,, -V7,Gestion des sessions,V7.3,Délai d'expiration de la session,V7.3.2,Vérifiez qu'il existe une durée de vie maximale absolue de la session de sorte que la réauthentification soit appliquée conformément à l'analyse des risques et aux décisions de sécurité documentées.,,✓,✓,, -V7,Gestion des sessions,V7.4,Fin de session,V7.4.1,"Vérifiez que lorsque la fin de session est déclenchée (par exemple, déconnexion ou expiration), l'application interdit toute utilisation ultérieure de la session. Pour les jetons par référence ou les sessions avec état, cela implique l'invalidation des données de session au niveau du backend de l'application. Les applications utilisant des jetons autonomes nécessiteront une solution, comme la gestion d'une liste des jetons terminés, l'interdiction des jetons produits avant une date et une heure spécifique à chaque utilisateur ou la rotation d'une clé de signature spécifique à chaque utilisateur.",✓,✓,✓,, -V7,Gestion des sessions,V7.4,Fin de session,V7.4.2,"Vérifiez que l'application met fin à toutes les sessions actives lorsqu'un compte utilisateur est désactivé ou supprimé (par exemple, lorsqu'un employé quitte l'entreprise).",✓,✓,✓,, -V7,Gestion des sessions,V7.4,Fin de session,V7.4.3,"Vérifiez que l'application offre la possibilité de mettre fin à toutes les autres sessions actives après une modification ou une suppression réussie de tout facteur d'authentification (y compris la modification du mot de passe via une réinitialisation ou une récupération et, le cas échéant, une mise à jour des paramètres MFA).",,✓,✓,, -V7,Gestion des sessions,V7.4,Fin de session,V7.4.4,Vérifiez que toutes les pages nécessitant une authentification disposent d’un accès facile et visible à la fonctionnalité de déconnexion.,,✓,✓,, -V7,Gestion des sessions,V7.4,Fin de session,V7.4.5,Vérifiez que les administrateurs d’applications sont en mesure de mettre fin aux sessions actives pour un utilisateur individuel ou pour tous les utilisateurs.,,✓,✓,, -V7,Gestion des sessions,V7.5,Défenses contre les abus de session,V7.5.1,"Vérifiez que l'application nécessite une réauthentification complète avant d'autoriser les modifications des attributs de compte sensibles qui peuvent affecter l'authentification, tels que l'adresse e-mail, le numéro de téléphone, la configuration MFA ou d'autres informations utilisées dans la récupération de compte.",,✓,✓,, -V7,Gestion des sessions,V7.5,Défenses contre les abus de session,V7.5.2,Vérifiez que les utilisateurs peuvent afficher et (après s'être authentifiés à nouveau avec au moins un facteur) terminer une ou toutes les sessions actuellement actives.,,✓,✓,, -V7,Gestion des sessions,V7.5,Défenses contre les abus de session,V7.5.3,Vérifiez que l’application nécessite une authentification supplémentaire avec au moins un facteur ou une vérification secondaire avant d’effectuer des transactions ou des opérations hautement sensibles.,,,✓,, -V7,Gestion des sessions,V7.6,Réauthentification fédérée,V7.6.1,"Vérifiez que la durée de vie et la fin de la session entre les parties de confiance (RP) et les fournisseurs d'identité (IdP) se comportent comme documenté, en exigeant une réauthentification si nécessaire, par exemple lorsque le temps maximal entre les événements d'authentification IdP est atteint.",,✓,✓,, -V7,Gestion des sessions,V7.6,Réauthentification fédérée,V7.6.2,"Vérifiez que la création d'une session nécessite soit le consentement de l'utilisateur, soit une action explicite, empêchant ainsi la création de nouvelles sessions d'application sans interaction de l'utilisateur.",,✓,✓,, -V8,Autorisation,V8.1,Documentation d'autorisation,V8.1.1,Vérifiez que la documentation d’autorisation définit des règles de restriction de l’accès au niveau de la fonction et aux données en fonction des autorisations du consommateur et des attributs des ressources.,✓,✓,✓,, -V8,Autorisation,V8.1,Documentation d'autorisation,V8.1.2,"Vérifiez que la documentation d'autorisation définit les règles de restriction d'accès au niveau des champs (lecture et écriture) en fonction des autorisations des consommateurs et des attributs des ressources. Notez que ces règles peuvent dépendre d'autres valeurs d'attributs de l'objet de données concerné, telles que l'état ou le statut.",,✓,✓,, -V8,Autorisation,V8.1,Documentation d'autorisation,V8.1.3,"Vérifiez que la documentation de l'application définit les attributs environnementaux et contextuels (y compris, mais sans s'y limiter, l'heure de la journée, l'emplacement de l'utilisateur, l'adresse IP ou l'appareil) qui sont utilisés dans l'application pour prendre des décisions de sécurité, y compris celles relatives à l'authentification et à l'autorisation.",,,✓,, -V8,Autorisation,V8.1,Documentation d'autorisation,V8.1.4,"Vérifier que la documentation d'authentification et d'autorisation définit l'utilisation des facteurs environnementaux et contextuels dans la prise de décision, en plus des autorisations au niveau des fonctions, des données et des champs. Cela doit inclure les attributs évalués, les seuils de risque et les actions entreprises (par exemple, autorisation, contestation, refus, renforcement de l'authentification).",,,✓,, -V8,Autorisation,V8.2,Conception d'autorisation générale,V8.2.1,Vérifiez que l’application garantit que l’accès basé sur la fonction est limité aux consommateurs disposant d’autorisations explicites.,✓,✓,✓,, -V8,Autorisation,V8.2,Conception d'autorisation générale,V8.2.2,Vérifiez que l'application garantit que l'accès spécifique aux données est limité aux consommateurs disposant d'autorisations explicites sur des éléments de données spécifiques afin d'atténuer les références d'objet directes non sécurisées (IDOR) et les autorisations de niveau d'objet rompues (BOLA).,✓,✓,✓,, -V8,Autorisation,V8.2,Conception d'autorisation générale,V8.2.3,Vérifiez que l'application garantit que l'accès au niveau du champ est limité aux consommateurs disposant d'autorisations explicites sur des champs spécifiques afin d'atténuer les problèmes d'autorisation au niveau de la propriété d'objet (BOPLA).,,✓,✓,, -V8,Autorisation,V8.2,Conception d'autorisation générale,V8.2.4,"Vérifiez que les contrôles de sécurité adaptatifs basés sur les attributs environnementaux et contextuels du consommateur (tels que l'heure, la localisation, l'adresse IP ou l'appareil) sont mis en œuvre pour les décisions d'authentification et d'autorisation, comme défini dans la documentation de l'application. Ces contrôles doivent être appliqués lorsque le consommateur tente de démarrer une nouvelle session et également pendant une session existante.",,,✓,, -V8,Autorisation,V8.3,Autorisation par opération,V8.3.1,"Vérifier que l'application applique les règles d'autorisations au niveau de la couche service de confiance et ne s’appuie pas sur des contrôles qu’un consommateur non approuvé pourrait manipuler, comme JavaScript côté client.",✓,✓,✓,, -V8,Autorisation,V8.3,Autorisation par opération,V8.3.2,"Vérifiez que les modifications apportées aux valeurs sur lesquelles reposent les décisions d'autorisation sont appliquées immédiatement. Lorsque les modifications ne peuvent pas être appliquées immédiatement (par exemple, en s'appuyant sur des données de jetons autonomes), des contrôles d'atténuation doivent être mis en place pour alerter un consommateur lorsqu'il effectue une action alors qu'il n'est plus autorisé à le faire et annuler la modification. Notez que cette solution alternative ne limiterait pas les fuites d'informations.",,,✓,, -V8,Autorisation,V8.3,Autorisation par opération,V8.3.3,"Vérifiez que l'accès à un objet repose sur les autorisations du sujet d'origine (par exemple, le consommateur), et non sur celles d'un intermédiaire ou d'un service agissant en son nom. Par exemple, si un consommateur appelle un service web à l'aide d'un jeton d'authentification autonome, et que ce service demande ensuite des données à un autre service, ce dernier utilisera le jeton du consommateur, plutôt qu'un jeton inter-machine du premier service, pour prendre les décisions d'autorisation.",,,✓,, -V8,Autorisation,V8.4,Autres considérations relatives à l'autorisation,V8.4.1,Vérifiez que les applications multi-tenants utilisent des contrôles inter-tenants pour garantir que les opérations des consommateurs n'affecteront jamais les tenants avec lesquels ils ne sont pas autorisés à interagir.,,✓,✓,, -V8,Autorisation,V8.4,Autres considérations relatives à l'autorisation,V8.4.2,"Vérifiez que l'accès aux interfaces administratives intègre plusieurs couches de sécurité, notamment la vérification continue de l'identité du consommateur, l'évaluation de la posture de sécurité des appareils et l'analyse contextuelle des risques, garantissant que l'emplacement du réseau ou les endpoints approuvés ne sont pas les seuls facteurs d'autorisation, même s'ils peuvent réduire la probabilité d'accès non autorisé.",,,✓,, -V9,Jetons autonomes,V9.1,Source et intégrité du jeton,V9.1.1,Vérifiez que les jetons autonomes sont validés à l'aide de leur signature numérique ou MAC pour les protéger contre toute falsification avant d'accepter le contenu du jeton.,✓,✓,✓,, -V9,Jetons autonomes,V9.1,Source et intégrité du jeton,V9.1.2,"Vérifiez que seuls les algorithmes d'une liste d’autorisations peuvent être utilisés pour créer et vérifier des jetons autonomes, dans un contexte donné. La liste d'autorisation doit inclure les algorithmes autorisés, idéalement symétriques ou asymétriques, et ne doit pas inclure l'algorithme « Aucun ». Si les algorithmes symétriques et asymétriques doivent être pris en charge, des contrôles supplémentaires seront nécessaires pour éviter toute confusion de clés.",✓,✓,✓,, -V9,Jetons autonomes,V9.1,Source et intégrité du jeton,V9.1.3,"Vérifiez que les clés utilisées pour valider les jetons autonomes proviennent de sources préconfigurées et fiables pour l'émetteur du jeton, empêchant ainsi les attaquants de spécifier des sources et des clés non fiables. Pour les JWT et autres structures JWS, les en-têtes tels que « jku », « x5u » et « jwk » doivent être validés par rapport à une liste d'autorisation de sources fiables.",✓,✓,✓,, -V9,Jetons autonomes,V9.2,Contenu du jeton,V9.2.1,"Vérifiez que, si une période de validité est indiquée dans les données du jeton, celui-ci et son contenu ne sont acceptés que si la date de vérification est comprise dans cette période. Par exemple, pour les JWT, les déclarations « nbf » et « exp » doivent être vérifiées.",✓,✓,✓,, -V9,Jetons autonomes,V9.2,Contenu du jeton,V9.2.2,"Vérifiez que le service recevant un jeton valide le type de jeton et son utilisation avant d'en accepter le contenu. Par exemple, seuls les jetons d'accès peuvent être acceptés pour les décisions d'autorisation, et seuls les jetons d'identification peuvent être utilisés pour prouver l'authentification des utilisateurs.",,✓,✓,, -V9,Jetons autonomes,V9.2,Contenu du jeton,V9.2.3,"Vérifiez que le service accepte uniquement les jetons destinés à être utilisés avec ce service (audience). Pour les JWT, cela peut être réalisé en validant la déclaration « aud » par rapport à une liste d'autorisation définie dans le service.",,✓,✓,, -V9,Jetons autonomes,V9.2,Contenu du jeton,V9.2.4,"Si un émetteur de jetons utilise la même clé privée pour émettre des jetons destinés à différentes audiences, vérifiez que les jetons émis contiennent une restriction d'audience identifiant de manière unique les audiences visées. Cela empêchera la réutilisation d'un jeton avec une audience non prévue. Si l'identifiant d'audience est provisionné dynamiquement, l'émetteur de jetons doit valider ces audiences afin de garantir qu'elles n'entraînent pas d'usurpation d'identité.",,✓,✓,, -V10,Oauth et OIDC,V10.1,Sécurité générique OAuth et OIDC,V10.1.1,"Vérifiez que les jetons sont envoyés uniquement aux composants qui en ont absolument besoin. Par exemple, lors de l'utilisation d'un modèle backend-for-frontend pour les applications JavaScript basées sur un navigateur, les jetons d'accès et d'actualisation ne doivent être accessibles qu'au backend.",,✓,✓,, -V10,Oauth et OIDC,V10.1,Sécurité générique OAuth et OIDC,V10.1.2,"Vérifiez que le client n'accepte les valeurs du serveur d'autorisation (telles que le code d'autorisation ou le jeton d'identification) que si elles résultent d'un flux d'autorisation initié par la même session d'agent utilisateur et la même transaction. Cela nécessite que les secrets générés par le client, tels que la clé de preuve pour l'échange de codes (PKCE) « code_verifier », « state » ou le nonce OIDC, ne puissent être devinés, soient spécifiques à la transaction et soient liés de manière sécurisée au client et à la session d'agent utilisateur au cours de laquelle la transaction a été initiée.",,✓,✓,, -V10,Oauth et OIDC,V10.2,Client OAuth,V10.2.1,"Vérifiez que, si le flux de code est utilisé, le client OAuth dispose d'une protection contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF), qui déclenchent des demandes de jetons, soit en utilisant la fonctionnalité de clé de preuve pour l'échange de code (PKCE), soit en vérifiant le paramètre « state » envoyé dans la demande d'autorisation.",,✓,✓,, -V10,Oauth et OIDC,V10.2,Client OAuth,V10.2.2,"Vérifiez que, si le client OAuth peut interagir avec plusieurs serveurs d'autorisation, il dispose d'une protection contre les attaques par confusion. Par exemple, il peut exiger que le serveur d'autorisation renvoie la valeur du paramètre « iss » et la valide dans la réponse d'autorisation et la réponse du jeton.",,✓,✓,, -V10,Oauth et OIDC,V10.2,Client OAuth,V10.2.3,Vérifiez que le client OAuth demande uniquement les portées requises (ou d’autres paramètres d’autorisation) dans les requêtes adressées au serveur d’autorisation.,,,✓,, -V10,Oauth et OIDC,V10.3,Serveur de ressources OAuth,V10.3.1,Vérifiez que le serveur de ressources accepte uniquement les jetons d'accès destinés à être utilisés avec ce service (audience). L'audience peut être incluse dans un jeton d'accès structuré (comme la déclaration « aud » dans JWT) ou vérifiée à l'aide du endpoint d'introspection de jeton.,,✓,✓,, -V10,Oauth et OIDC,V10.3,Serveur de ressources OAuth,V10.3.2,"Vérifiez que le serveur de ressources applique les décisions d'autorisation en fonction des déclarations du jeton d'accès définissant l'autorisation déléguée. Si des déclarations telles que « sub », « scope » et « authorization_details » sont présentes, elles doivent être prises en compte dans la décision.",,✓,✓,, -V10,Oauth et OIDC,V10.3,Serveur de ressources OAuth,V10.3.3,"Vérifiez que si une décision de contrôle d'accès nécessite l'identification d'un utilisateur unique à partir d'un jeton d'accès (JWT ou réponse d'introspection de jeton associé), le serveur de ressources identifie l'utilisateur à partir de déclarations non ré attribuables à d'autres utilisateurs. En général, cela implique l'utilisation d'une combinaison de déclarations « iss » et « sub ».",,✓,✓,, -V10,Oauth et OIDC,V10.3,Serveur de ressources OAuth,V10.3.4,"Si le serveur de ressources requiert une force d'authentification, des méthodes ou une date d'expiration spécifiques, vérifiez que le jeton d'accès présenté respecte ces contraintes. Par exemple, s'il est présent, utilisez les déclarations OIDC « acr », « amr » et « auth_time » respectivement.",,✓,✓,, -V10,Oauth et OIDC,V10.3,Serveur de ressources OAuth,V10.3.5,"Vérifiez que le serveur de ressources empêche l'utilisation de jetons d'accès volés ou la relecture de jetons d'accès (de parties non autorisées) en exigeant des jetons d'accès limités par l'expéditeur, soit Mutual TLS pour OAuth 2, soit OAuth 2 Demonstration of Proof of Possession (DPoP).",,,✓,, -V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.1,Vérifiez que le serveur d'autorisation valide les URI de redirection en fonction d'une liste d'autorisation spécifique au client d'URI préenregistrés à l'aide d'une comparaison de chaînes exacte.,✓,✓,✓,, -V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.2,"Vérifiez que, si le serveur d'autorisation renvoie le code d'autorisation dans la réponse, celui-ci ne peut être utilisé qu'une seule fois pour une demande de jeton. Pour la deuxième demande valide avec un code d'autorisation déjà utilisé pour émettre un jeton d'accès, le serveur d'autorisation doit rejeter la demande de jeton et révoquer tous les jetons émis liés au code d'autorisation.",✓,✓,✓,, -V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.3,Vérifiez que le code d'autorisation est de courte durée. La durée de vie maximale peut atteindre 10 minutes pour les applications L1 et L2 et 1 minute pour les applications L3.,✓,✓,✓,, -V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.4,"Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement l'utilisation des autorisations nécessaires à ce client. Notez que les autorisations « token » (flux implicite) et « password » (flux d'informations d'identification du propriétaire de la ressource) ne doivent plus être utilisées.",✓,✓,✓,, -V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.5,"Vérifiez que le serveur d'autorisation atténue les attaques par rejeu de jetons d'actualisation pour les clients publics, de préférence en utilisant des jetons d'actualisation limités par l'expéditeur, par exemple des jetons DPoP (Demonstrating Proof of Possession) ou des jetons d'accès liés à un certificat utilisant le protocole TLS mutuel (mTLS). Pour les applications L1 et L2, la rotation des jetons d'actualisation peut être utilisée. Si cette rotation est utilisée, le serveur d'autorisation doit invalider le jeton d'actualisation après utilisation et révoquer tous les jetons d'actualisation de cette autorisation si un jeton d'actualisation déjà utilisé et invalidé est fourni.",✓,✓,✓,, -V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.6,"Vérifiez que, si l'octroi de code est utilisé, le serveur d'autorisation atténue les attaques par interception de code en exigeant une clé de preuve pour l'échange de code (PKCE). Pour les demandes d'autorisation, le serveur d'autorisation doit exiger une valeur « code_challenge » valide et ne doit pas accepter une valeur « plain » pour « code_challenge_method ». Pour une demande de jeton, il doit exiger la validation du paramètre « code_verifier ».",,✓,✓,, -V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.7,"Vérifiez que si le serveur d'autorisation prend en charge l'enregistrement dynamique des clients non authentifiés, il réduit le risque d'applications clientes malveillantes. Il doit valider les métadonnées clientes, telles que les URI enregistrés, garantir le consentement de l'utilisateur et l'avertir avant de traiter une demande d'autorisation avec une application cliente non approuvée.",,✓,✓,, -V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.8,"Vérifiez que les jetons d’actualisation ont une expiration absolue, y compris si l’expiration du jeton d’actualisation glissant est appliquée.",,✓,✓,, -V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.9,"Vérifiez que les jetons d'actualisation et les jetons d'accès de référence peuvent être révoqués par un utilisateur autorisé à l'aide de l'interface utilisateur du serveur d'autorisation, afin d'atténuer le risque de clients malveillants ou de jetons volés.",,✓,✓,, -V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.10,"Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.",,✓,✓,, -V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.11,"Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.",,✓,✓,, -V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.12,"Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement la valeur « response_mode » dont ce client a besoin. Par exemple, en vérifiant cette valeur par rapport aux valeurs attendues ou en utilisant une requête d'autorisation poussée (PAR) ou une requête d'autorisation sécurisée par JWT (JAR).",,,✓,, -V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.13,Vérifiez que le type d'Autorisation « code » est toujours utilisé avec les demandes d'autorisation poussées (PAR).,,,✓,, -V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.14,"Vérifiez que le serveur d'autorisation émet uniquement des jetons d'accès limités à l'expéditeur (preuve de possession), soit avec des jetons d'accès liés au certificat utilisant TLS mutuel (mTLS), soit avec des jetons d'accès liés au DPoP (démonstration de preuve de possession).",,,✓,, -V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.15,"Vérifiez que, pour un client côté serveur (non exécuté sur l'appareil de l'utilisateur final), le serveur d'autorisation garantit que la valeur du paramètre « authorization_details » provient du backend client et que l'utilisateur ne l'a pas altérée. Par exemple, en exigeant l'utilisation d'une demande d'autorisation poussée (PAR) ou d'une demande d'autorisation sécurisée par JWT (JAR).",,,✓,, -V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.16,"Vérifiez que le client est confidentiel et que le serveur d'autorisation requiert l'utilisation de méthodes d'authentification client fortes (basées sur la cryptographie à clé publique et résistantes aux attaques par relecture), telles que TLS mutuel ('tls_client_auth', 'self_signed_tls_client_auth') ou JWT à clé privée ('private_key_jwt').",,,✓,, -V10,Oauth et OIDC,V10.5,Client OIDC,V10.5.1,"Vérifiez que le client (en tant que partie utilisatrice) atténue les attaques par rejeu de jeton d'identification. Par exemple, en vous assurant que la valeur « nonce » du jeton d'identification correspond à la valeur « nonce » envoyée dans la demande d'authentification au fournisseur OpenID (appelée demande d'autorisation envoyée au serveur d'autorisation dans OAuth2).",,✓,✓,, -V10,Oauth et OIDC,V10.5,Client OIDC,V10.5.2,"Vérifiez que le client identifie de manière unique l'utilisateur à partir des déclarations de jeton d'identification, généralement la déclaration « sub », qui ne peut pas être réaffectée à d'autres utilisateurs (pour la portée d'un fournisseur d'identité).",,✓,✓,, -V10,Oauth et OIDC,V10.5,Client OIDC,V10.5.3,Vérifiez que le client rejette les tentatives d'un serveur d'autorisation malveillant d'usurper l'identité d'un autre serveur d'autorisation via ses métadonnées. Le client doit rejeter les métadonnées du serveur d'autorisation si l'URL de l'émetteur figurant dans ces métadonnées ne correspond pas exactement à l'URL d'émetteur préconfigurée attendue par le client.,,✓,✓,, -V10,Oauth et OIDC,V10.5,Client OIDC,V10.5.4,Vérifiez que le client valide que le jeton d'identification est destiné à être utilisé pour ce client (audience) en vérifiant que la déclaration « aud » du jeton est égale à la valeur « client_id » pour le client.,,✓,✓,, -V10,Oauth et OIDC,V10.5,Client OIDC,V10.5.5,"Vérifiez que, lors de l'utilisation de la déconnexion du back-channel OIDC, la partie utilisatrice atténue les risques de déni de service liés à la déconnexion forcée et à la confusion entre JWT dans le flux de déconnexion. Le client doit vérifier que le jeton de déconnexion est correctement typé avec la valeur « logout+jwt », qu'il contient la déclaration « event » avec le nom de membre correct et qu'il ne contient pas de déclaration « nonce ». Il est également recommandé d'utiliser une expiration courte (par exemple, 2 minutes).",,✓,✓,, -V10,Oauth et OIDC,V10.6,Fournisseur OpenID,V10.6.1,"Vérifiez que le fournisseur OpenID n'autorise que les valeurs « code », « ciba », « id_token » ou « id_token code » pour le mode de réponse. Notez que « code » est préférable à « id_token code » (flux hybride OIDC) et que « token » (tout flux implicite) ne doit pas être utilisé.",,✓,✓,, -V10,Oauth et OIDC,V10.6,Fournisseur OpenID,V10.6.2,"Vérifiez que le fournisseur OpenID atténue les risques de déni de service liés à la déconnexion forcée. Pour ce faire, obtenez une confirmation explicite de l'utilisateur final ou, le cas échéant, validez les paramètres de la requête de déconnexion (initiée par la partie utilisatrice), comme « id_token_hint ».",,✓,✓,, -V10,Oauth et OIDC,V10.7,Gestion du consentement,V10.7.1,"Vérifiez que le serveur d'autorisation garantit le consentement de l'utilisateur à chaque demande d'autorisation. Si l'identité du client ne peut être garantie, le serveur d'autorisation doit toujours demander explicitement le consentement de l'utilisateur.",,✓,✓,, -V10,Oauth et OIDC,V10.7,Gestion du consentement,V10.7.2,"Vérifiez que lorsque le serveur d'autorisation demande le consentement de l'utilisateur, il fournit des informations claires et suffisantes sur ce qui est consenti. Le cas échéant, ces informations doivent inclure la nature des autorisations demandées (généralement en fonction de la portée, du serveur de ressources et des détails d'autorisation RAR), l'identité de l'application autorisée et la durée de vie de ces autorisations.",,✓,✓,, -V10,Oauth et OIDC,V10.7,Gestion du consentement,V10.7.3,"Vérifiez que l’utilisateur peut consulter, modifier et révoquer les consentements qu’il a accordés via le serveur d’autorisation.",,✓,✓,, -V11,Cryptographie,V11.1,Inventaire et documentation cryptographiques,V11.1.1,"Vérifiez qu’il existe une politique documentée pour la gestion des clés cryptographiques et un cycle de vie des clés cryptographiques qui suit une norme de gestion des clés telle que NIST SP 800-57. Cela devrait inclure la garantie que les clés ne sont pas sur-partagées (par exemple, avec plus de deux entités pour les secrets partagés et plus d’une entité pour les clés privées).",,✓,✓,, -V11,Cryptographie,V11.1,Inventaire et documentation cryptographiques,V11.1.2,"Vérifiez qu'un inventaire cryptographique est réalisé, maintenu et régulièrement mis à jour, et qu'il inclut toutes les clés, algorithmes et certificats cryptographiques utilisés par l'application. Il doit également documenter les emplacements du système où les clés peuvent ou non être utilisées, ainsi que les types de données qui peuvent ou non être protégées par ces clés.",,✓,✓,, -V11,Cryptographie,V11.1,Inventaire et documentation cryptographiques,V11.1.3,"Vérifiez que les mécanismes de découverte cryptographique sont utilisés pour identifier toutes les instances de cryptographie dans le système, y compris les opérations de chiffrement, de hachage et de signature.",,,✓,, -V11,Cryptographie,V11.1,Inventaire et documentation cryptographiques,V11.1.4,"Vérifier la tenue d'un inventaire cryptographique. Celui-ci doit inclure un plan documenté décrivant la migration vers de nouvelles normes cryptographiques, telles que la cryptographie post-quantique, afin de réagir aux menaces futures.",,,✓,, -V11,Cryptographie,V11.2,Mise en œuvre sécurisée de la cryptographie,V11.2.1,Vérifiez que les implémentations validées par l’industrie (y compris les bibliothèques et les implémentations accélérées par le matériel) sont utilisées pour les opérations cryptographiques.,,✓,✓,, -V11,Cryptographie,V11.2,Mise en œuvre sécurisée de la cryptographie,V11.2.2,"Vérifiez que l'application est conçue avec une agilité cryptographique, de sorte que les nombres aléatoires, le chiffrement authentifié, le MAC ou les algorithmes de hachage, les longueurs de clés, les tours, les chiffrements et les modes puissent être reconfigurés, mis à niveau ou échangés à tout moment, afin de se protéger contre les failles cryptographiques. De même, il doit être possible de remplacer les clés et les mots de passe, ainsi que de rechiffrer les données. Cela permettra des mises à niveau transparentes vers la cryptographie post-quantique (PQC), une fois que des implémentations hautement sécurisées de schémas ou de normes PQC approuvés seront largement disponibles.",,✓,✓,, -V11,Cryptographie,V11.2,Mise en œuvre sécurisée de la cryptographie,V11.2.3,"Vérifiez que toutes les primitives cryptographiques utilisent un minimum de 128 bits de sécurité en fonction de l'algorithme, de la taille de la clé et de la configuration. Par exemple, une clé ECC de 256 bits offre environ 128 bits de sécurité, tandis que RSA nécessite une clé de 3072 bits pour atteindre 128 bits de sécurité.",,✓,✓,, -V11,Cryptographie,V11.2,Mise en œuvre sécurisée de la cryptographie,V11.2.4,"Vérifiez que toutes les opérations cryptographiques sont à temps constant, sans opérations de « court-circuit » dans les comparaisons, les calculs ou les retours, pour éviter toute fuite d'informations.",,,✓,, -V11,Cryptographie,V11.2,Mise en œuvre sécurisée de la cryptographie,V11.2.5,"Vérifiez que tous les modules cryptographiques échouent en toute sécurité et que les erreurs sont gérées de manière à ne pas permettre de vulnérabilités, telles que les attaques Padding Oracle.",,,✓,, -V11,Cryptographie,V11.3,Algorithmes de chiffrement,V11.3.1,"Vérifiez que les modes de bloc non sécurisés (par exemple, ECB) et les schémas de remplissage faibles (par exemple, PKCS#1 v1.5) ne sont pas utilisés.",✓,✓,✓,, -V11,Cryptographie,V11.3,Algorithmes de chiffrement,V11.3.2,Vérifiez que seuls les chiffrements et modes approuvés tels que AES avec GCM sont utilisés.,✓,✓,✓,, -V11,Cryptographie,V11.3,Algorithmes de chiffrement,V11.3.3,"Vérifiez que les données chiffrées sont protégées contre toute modification non autorisée, de préférence en utilisant une méthode de chiffrement authentifiée approuvée ou en combinant une méthode de chiffrement approuvée avec un algorithme MAC approuvé.",,✓,✓,, -V11,Cryptographie,V11.3,Algorithmes de chiffrement,V11.3.4,"Vérifiez que les nonces, les vecteurs d'initialisation et autres nombres à usage unique ne sont pas utilisés pour plus d'une paire clé de chiffrement/élément de données. La méthode de génération doit être adaptée à l'algorithme utilisé.",,,✓,, -V11,Cryptographie,V11.3,Algorithmes de chiffrement,V11.3.5,Vérifiez que toute combinaison d'un algorithme de chiffrement et d'un algorithme MAC fonctionne en mode chiffrement puis MAC.,,,✓,, -V11,Cryptographie,V11.4,Hachage et fonctions basées sur le hachage,V11.4.1,"Vérifiez que seules les fonctions de hachage approuvées sont utilisées pour les cas d'utilisation cryptographiques généraux, notamment les signatures numériques, HMAC, KDF et la génération de bits aléatoires. Les fonctions de hachage non autorisées, telles que MD5, ne doivent pas être utilisées à des fins cryptographiques.",✓,✓,✓,, -V11,Cryptographie,V11.4,Hachage et fonctions basées sur le hachage,V11.4.2,"Vérifiez que les mots de passe sont stockés à l'aide d'une fonction de dérivation de clés approuvée et gourmande en ressources de calcul (également appelée « fonction de hachage de mots de passe »), dont les paramètres sont configurés conformément aux directives en vigueur. Ces paramètres doivent équilibrer sécurité et performances afin de rendre les attaques par force brute suffisamment difficiles pour le niveau de sécurité requis.",,✓,✓,, -V11,Cryptographie,V11.4,Hachage et fonctions basées sur le hachage,V11.4.3,"Vérifiez que les fonctions de hachage utilisées dans les signatures numériques, dans le cadre de l'authentification ou de l'intégrité des données, sont résistantes aux collisions et possèdent des longueurs de bits appropriées. Si la résistance aux collisions est requise, la longueur de sortie doit être d'au moins 256 bits. Si seule la résistance aux attaques de seconde pré-image est requise, la longueur de sortie doit être d'au moins 128 bits.",,✓,✓,, -V11,Cryptographie,V11.4,Hachage et fonctions basées sur le hachage,V11.4.4,Vérifiez que l'application utilise des fonctions de dérivation de clés approuvées avec des paramètres d'extension de clés lors de la dérivation de clés secrètes à partir de mots de passe. Les paramètres utilisés doivent concilier sécurité et performances afin d'empêcher les attaques par force brute de compromettre la clé cryptographique obtenue.,,✓,✓,, -V11,Cryptographie,V11.5,Valeurs aléatoires,V11.5.1,Vérifiez que tous les nombres et chaînes aléatoires destinés à être non devinables doivent être générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et posséder au moins 128 bits d'entropie. Notez que les UUID ne respectent pas cette condition.,,✓,✓,, -V11,Cryptographie,V11.5,Valeurs aléatoires,V11.5.2,"Vérifiez que le mécanisme de génération de nombres aléatoires utilisé est conçu pour fonctionner en toute sécurité, même en cas de forte demande.",,,✓,, -V11,Cryptographie,V11.6,Cryptographie à clé publique,V11.6.1,"Vérifier que seuls des algorithmes cryptographiques et des modes opératoires approuvés sont utilisés pour la génération et l'amorçage des clés, ainsi que pour la génération et la vérification des signatures numériques. Les algorithmes de génération de clés ne doivent pas générer de clés non sécurisées et vulnérables aux attaques connues, par exemple les clés RSA vulnérables à la factorisation de Fermat.",,✓,✓,, -V11,Cryptographie,V11.6,Cryptographie à clé publique,V11.6.2,"Vérifiez que des algorithmes cryptographiques approuvés sont utilisés pour l'échange de clés (tels que Diffie-Hellman), en veillant à ce que les mécanismes d'échange de clés utilisent des paramètres sécurisés. Cela permettra d'éviter les attaques contre le processus d'établissement des clés, susceptibles de conduire à des attaques de type « adversaire du milieu » ou à des failles cryptographiques.",,,✓,, -V11,Cryptographie,V11.7,Cryptographie des données en cours d'utilisation,V11.7.1,"Vérifiez que le chiffrement complet de la mémoire est utilisé pour protéger les données sensibles pendant leur utilisation, empêchant ainsi l'accès par des utilisateurs ou des processus non autorisés.",,,✓,, -V11,Cryptographie,V11.7,Cryptographie des données en cours d'utilisation,V11.7.2,Vérifiez que la minimisation des données garantit que la quantité minimale de données est exposée pendant le traitement et assurez-vous que les données sont chiffrées immédiatement après utilisation ou dès que possible.,,,✓,, -V12,Communication sécurisée,V12.1,Conseils généraux de sécurité TLS,V12.1.1,"Vérifiez que seules les dernières versions recommandées du protocole TLS sont activées, telles que TLS 1.2 et TLS 1.3. La dernière version du protocole TLS doit être privilégiée.",✓,✓,✓,, -V12,Communication sécurisée,V12.1,Conseils généraux de sécurité TLS,V12.1.2,"Vérifiez que seules les suites de chiffrement recommandées sont activées, les suites de chiffrement les plus puissantes étant définies comme préférées. Les applications L3 doivent uniquement prendre en charge les suites de chiffrement assurant la confidentialité persistante (forward secrecy).",,✓,✓,, -V12,Communication sécurisée,V12.1,Conseils généraux de sécurité TLS,V12.1.3,Vérifiez que l’application valide que les certificats clients mTLS sont approuvés avant d’utiliser l’identité du certificat pour l’authentification ou l’autorisation.,,✓,✓,, -V12,Communication sécurisée,V12.1,Conseils généraux de sécurité TLS,V12.1.4,"Vérifiez que la révocation de certification appropriée, telle que l'agrafage du protocole OCSP (Online Certificate Status Protocol), est activée et configurée.",,,✓,, -V12,Communication sécurisée,V12.1,Conseils généraux de sécurité TLS,V12.1.5,"Vérifiez que Encrypted Client Hello (ECH) est activé dans les paramètres TLS de l'application pour empêcher l'exposition de métadonnées sensibles, telles que l'indication du nom du serveur (SNI), pendant les processus de négociation TLS.",,,✓,, -V12,Communication sécurisée,V12.2,Communication HTTPS avec des services externes,V12.2.1,"Vérifiez que TLS est utilisé pour toute connectivité entre un client et des services externes basés sur HTTP, et ne recourt pas à des communications non sécurisées ou non chiffrées.",✓,✓,✓,, -V12,Communication sécurisée,V12.2,Communication HTTPS avec des services externes,V12.2.2,Vérifiez que les services externes utilisent des certificats TLS publiquement approuvés.,✓,✓,✓,, -V12,Communication sécurisée,V12.3,Sécurité des communications entre services généraux,V12.3.1,"Vérifiez qu'un protocole chiffré tel que TLS est utilisé pour toutes les connexions entrantes et sortantes vers et depuis l'application, y compris les systèmes de surveillance, les outils de gestion, l'accès à distance et SSH, les intergiciels, les bases de données, les mainframes, les systèmes partenaires ou les API externes. Le serveur ne doit pas recourir à des protocoles non sécurisés ou non chiffrés.",,✓,✓,, -V12,Communication sécurisée,V12.3,Sécurité des communications entre services généraux,V12.3.2,Vérifiez que les clients TLS valident les certificats reçus avant de communiquer avec un serveur TLS.,,✓,✓,, -V12,Communication sécurisée,V12.3,Sécurité des communications entre services généraux,V12.3.3,Vérifiez que TLS ou un autre mécanisme de chiffrement de transport approprié est utilisé pour toute connectivité entre les services internes basés sur HTTP au sein de l'application et ne se replie pas vers des communications non sécurisées ou non chiffrées.,,✓,✓,, -V12,Communication sécurisée,V12.3,Sécurité des communications entre services généraux,V12.3.4,"Vérifiez que les connexions TLS entre les services internes utilisent des certificats de confiance. Lorsque des certificats générés en interne ou auto-signés sont utilisés, le service consommateur doit être configuré pour n'approuver que des autorités de certification internes spécifiques et des certificats auto-signés spécifiques.",,✓,✓,, -V12,Communication sécurisée,V12.3,Sécurité des communications entre services généraux,V12.3.5,"Vérifiez que les services communiquant en interne au sein d'un système (communications intra-services) utilisent une authentification forte pour garantir la vérification de chaque endpoint. Des méthodes d'authentification forte, telles que l'authentification client TLS, doivent être utilisées pour garantir l'identité, en utilisant une infrastructure à clé publique et des mécanismes résistants aux attaques par rejeu. Pour les architectures de microservices, envisagez d'utiliser un maillage de services pour simplifier la gestion des certificats et renforcer la sécurité.",,,✓,, -V13,Configuration,V13.1,Documentation de configuration,V13.1.1,Vérifiez que tous les besoins de communication de l'application sont documentés. Cela doit inclure les services externes dont l'application dépend et les cas où un utilisateur final pourrait fournir un emplacement externe auquel l'application se connectera.,,✓,✓,, -V13,Configuration,V13.1,Documentation de configuration,V13.1.2,"Vérifiez que pour chaque service utilisé par l'application, la documentation définit le nombre maximal de connexions simultanées (par exemple, les limites du pool de connexions) et le comportement de l'application lorsque cette limite est atteinte, y compris les mécanismes de secours ou de récupération, pour éviter les conditions de déni de service.",,,✓,, -V13,Configuration,V13.1,Documentation de configuration,V13.1.3,"Vérifiez que la documentation de l'application définit des stratégies de gestion des ressources pour chaque système ou service externe utilisé (par exemple, bases de données, descripteurs de fichiers, threads, connexions HTTP). Cela doit inclure les procédures de libération des ressources, les paramètres de délai d'expiration, la gestion des échecs et l'implémentation de la logique de nouvelle tentative, en spécifiant les limites de nouvelle tentative, les délais et les algorithmes de retour arrière. Pour les opérations de requête-réponse HTTP synchrones, la documentation doit imposer des délais d'expiration courts et soit désactiver les nouvelles tentatives, soit les limiter strictement afin d'éviter les retards en cascade et l'épuisement des ressources.",,,✓,, -V13,Configuration,V13.1,Documentation de configuration,V13.1.4,"Vérifiez que la documentation de l'application définit les secrets essentiels à la sécurité de l'application et un calendrier de rotation de ceux-ci, en fonction du modèle de menace et des exigences commerciales de l'organisation.",,,✓,, -V13,Configuration,V13.2,Configuration de la communication backend,V13.2.1,"Vérifiez que les communications entre les composants de l'application backend qui ne prennent pas en charge le mécanisme de session utilisateur standard de l'application, notamment les API, les intergiciels et les couches de données, sont authentifiées. L'authentification doit utiliser des comptes de service individuels, des jetons à court terme ou une authentification par certificat, et non des identifiants immuables tels que des mots de passe, des clés API ou des comptes partagés avec accès privilégié.",,✓,✓,, -V13,Configuration,V13.2,Configuration de la communication backend,V13.2.2,"Vérifiez que les communications entre les composants de l'application backend, y compris les services locaux ou du système d'exploitation, les API, les intergiciels et les couches de données, sont effectuées avec des comptes dotés des privilèges les moins nécessaires.",,✓,✓,, -V13,Configuration,V13.2,Configuration de la communication backend,V13.2.3,"Vérifiez que si des informations d’identification doivent être utilisées pour l’authentification du service, les informations d’identification utilisées par le consommateur ne sont pas des informations d’identification par défaut (par exemple, root/root ou admin/admin).",,✓,✓,, -V13,Configuration,V13.2,Configuration de la communication backend,V13.2.4,"Vérifiez qu'une liste d’autorisations est utilisée pour définir les ressources ou systèmes externes avec lesquels l'application est autorisée à communiquer (par exemple, pour les requêtes sortantes, les chargements de données ou l'accès aux fichiers). Cette liste d'autorisation peut être implémentée au niveau de la couche applicative, du serveur web, du pare-feu ou d'une combinaison de différentes couches.",,✓,✓,, -V13,Configuration,V13.2,Configuration de la communication backend,V13.2.5,Vérifiez que le serveur Web ou d’application est configuré avec une liste autorisée de ressources ou de systèmes vers lesquels le serveur peut envoyer des requêtes ou charger des données ou des fichiers.,,✓,✓,, -V13,Configuration,V13.2,Configuration de la communication backend,V13.2.6,"Vérifiez que lorsque l'application se connecte à des services distincts, elle suit la configuration documentée pour chaque connexion, comme le nombre maximal de connexions parallèles, le comportement lorsque le nombre maximal de connexions autorisées est atteint, les délais d'expiration de connexion et les stratégies de nouvelle tentative.",,,✓,, -V13,Configuration,V13.3,Gestion des secrets,V13.3.1,"Vérifiez qu'une solution de gestion des secrets, telle qu'un coffre-fort de clés, est utilisée pour créer, stocker, contrôler l'accès et détruire en toute sécurité les secrets backend. Ceux-ci peuvent inclure des mots de passe, du matériel de clé, des intégrations avec des bases de données et des systèmes tiers, des clés et des graines pour des jetons temporels, d'autres secrets internes et des clés API. Les secrets ne doivent pas être inclus dans le code source de l'application ni dans les artefacts de build. Pour une application L3, cela doit impliquer une solution matérielle telle qu'un HSM.",,✓,✓,, -V13,Configuration,V13.3,Gestion des secrets,V13.3.2,Vérifiez que l’accès aux ressources secrètes respecte le principe du moindre privilège.,,✓,✓,, -V13,Configuration,V13.3,Gestion des secrets,V13.3.3,Vérifiez que toutes les opérations cryptographiques sont effectuées à l'aide d'un module de sécurité isolé (tel qu'un coffre-fort ou un module de sécurité matériel) pour gérer et protéger en toute sécurité le matériel clé contre toute exposition en dehors du module de sécurité.,,,✓,, -V13,Configuration,V13.3,Gestion des secrets,V13.3.4,Vérifiez que les secrets sont configurés pour expirer et être renouvelés en fonction de la documentation de l'application.,,,✓,, -V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.1,"Vérifiez que l'application est déployée soit sans aucune métadonnée de contrôle de source, y compris les dossiers .git ou .svn, soit de manière à ce que ces dossiers soient inaccessibles à la fois en externe et à l'application elle-même.",✓,✓,✓,, -V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.2,Vérifiez que les modes de débogage sont désactivés pour tous les composants dans les environnements de production afin d’éviter l’exposition des fonctionnalités de débogage et la fuite d’informations.,,✓,✓,, -V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.3,"Vérifiez que les serveurs Web n’exposent pas les listes de répertoires aux clients, sauf si cela est explicitement prévu.",,✓,✓,, -V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.4,"Vérifiez que l’utilisation de la méthode HTTP TRACE n’est pas prise en charge dans les environnements de production, afin d’éviter toute fuite d’informations potentielle.",,✓,✓,, -V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.5,"Vérifiez que la documentation (comme pour les API internes) et les endpoints de surveillance ne sont pas exposés, sauf si cela est explicitement prévu.",,✓,✓,, -V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.6,Vérifiez que l’application n’expose pas d’informations de version détaillées des composants backend.,,,✓,, -V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.7,"Vérifiez que la couche web est configuré pour servir uniquement les fichiers avec des extensions de fichier spécifiques afin d’éviter toute fuite involontaire d’informations, de configuration et de code source.",,,✓,, -V14,Protection des données,V14.1,Documentation sur la protection des données,V14.1.1,"Vérifiez que toutes les données sensibles créées et traitées par l'application ont été identifiées et classées selon leur niveau de protection. Cela inclut les données uniquement codées et donc facilement déchiffrables, telles que les chaînes Base64 ou la charge utile en texte clair d'un JWT. Les niveaux de protection doivent tenir compte des réglementations et normes de protection des données et de confidentialité auxquelles l'application est tenue de se conformer.",,✓,✓,, -V14,Protection des données,V14.1,Documentation sur la protection des données,V14.1.2,"Vérifier que tous les niveaux de protection des données sensibles sont assortis d'un ensemble documenté d'exigences de protection. Cela doit inclure (sans s'y limiter) les exigences relatives au chiffrement général, à la vérification de l'intégrité, à la conservation, à la journalisation des données, aux contrôles d'accès aux données sensibles dans les journaux, au chiffrement au niveau de la base de données, aux technologies de confidentialité et de renforcement de la confidentialité à utiliser, ainsi qu'aux autres exigences de confidentialité.",,✓,✓,, -V14,Protection des données,V14.2,Protection générale des données,V14.2.1,"Vérifiez que les données sensibles sont uniquement envoyées au serveur dans les champs de corps ou d’en-tête du message HTTP, et que l’URL et la chaîne de requête ne contiennent pas d’informations sensibles, telles qu’une clé API ou un jeton de session.",✓,✓,✓,, -V14,Protection des données,V14.2,Protection générale des données,V14.2.2,"Vérifiez que l’application empêche la mise en cache des données sensibles dans les composants du serveur, tels que les équilibreurs de charge et les caches d’application, ou garantit que les données sont purgées en toute sécurité après utilisation.",,✓,✓,, -V14,Protection des données,V14.2,Protection générale des données,V14.2.3,"Vérifiez que les données sensibles définies ne sont pas envoyées à des parties non fiables (par exemple, des trackers d'utilisateurs) pour empêcher la collecte indésirable de données en dehors du contrôle de l'application.",,✓,✓,, -V14,Protection des données,V14.2,Protection générale des données,V14.2.4,"Vérifiez que les contrôles autour des données sensibles liés au chiffrement, à la vérification de l'intégrité, à la conservation, à la manière dont les données doivent être enregistrées, aux contrôles d'accès autour des données sensibles dans les journaux, à la confidentialité et aux technologies d'amélioration de la confidentialité, sont mis en œuvre comme défini dans la documentation pour le niveau de protection des données spécifiques.",,✓,✓,, -V14,Protection des données,V14.2,Protection générale des données,V14.2.5,Vérifiez que les mécanismes de mise en cache sont configurés pour ne mettre en cache que les réponses dont le type de contenu est conforme à la ressource et qui ne contiennent pas de contenu sensible et dynamique. Le serveur web doit renvoyer une réponse 404 ou 302 lors de l'accès à un fichier inexistant plutôt qu'un fichier valide différent. Cela devrait empêcher les attaques par empoisonnement de cache web.,,,✓,, -V14,Protection des données,V14.2,Protection générale des données,V14.2.6,"Vérifiez que l'application ne renvoie que les données sensibles minimales requises pour son fonctionnement. Par exemple, ne renvoyez que certains chiffres d'un numéro de carte de crédit, et non le numéro complet. Si les données complètes sont requises, elles doivent être masquées dans l'interface utilisateur, sauf si l'utilisateur les consulte spécifiquement.",,,✓,, -V14,Protection des données,V14.2,Protection générale des données,V14.2.7,"Vérifiez que les informations sensibles sont soumises à une classification de conservation des données, en veillant à ce que les données obsolètes ou inutiles soient supprimées automatiquement, selon un calendrier défini ou selon les besoins de la situation.",,,✓,, -V14,Protection des données,V14.2,Protection générale des données,V14.2.8,"Vérifiez que les informations sensibles sont supprimées des métadonnées des fichiers soumis par l'utilisateur, sauf si le stockage est autorisé par l'utilisateur.",,,✓,, -V14,Protection des données,V14.3,Protection des données côté client,V14.3.1,"Vérifiez que les données authentifiées sont effacées du stockage client, comme le DOM du navigateur, après la fin du client ou de la session. Le champ d'en-tête de réponse HTTP « Clear-Site-Data » peut être utile, mais le côté client devrait également pouvoir effectuer la correction si la connexion au serveur n'est pas disponible à la fin de la session.",✓,✓,✓,, -V14,Protection des données,V14.3,Protection des données côté client,V14.3.2,Vérifiez que l'application définit suffisamment de champs d'en-tête de réponse HTTP anti-caching (c'est-à-dire Cache-Control : no-store) afin que les données sensibles ne soient pas mises en cache dans les navigateurs.,,✓,✓,, -V14,Protection des données,V14.3,Protection des données côté client,V14.3.3,"Vérifiez que les données stockées dans le stockage du navigateur (telles que localStorage, sessionStorage, IndexedDB ou les cookies) ne contiennent pas de données sensibles, à l'exception des jetons de session.",,✓,✓,, -V15,Développement et architecture sécurisés,V15.1,Documentation sur le développement et l'architecture sécurisés,V15.1.1,"Vérifiez que la documentation de l'application définit les délais de correction basés sur les risques pour les versions de composants tiers présentant des vulnérabilités et pour la mise à jour des bibliothèques en général, afin de minimiser les risques liés à ces composants.",✓,✓,✓,, -V15,Développement et architecture sécurisés,V15.1,Documentation sur le développement et l'architecture sécurisés,V15.1.2,"Vérifiez qu'un catalogue d'inventaire, tel qu'une nomenclature logicielle (SBOM), est conservé pour toutes les bibliothèques tierces utilisées, y compris en vérifiant que les composants proviennent de référentiels prédéfinis, fiables et continuellement maintenus.",,✓,✓,, -V15,Développement et architecture sécurisés,V15.1,Documentation sur le développement et l'architecture sécurisés,V15.1.3,"Vérifiez que la documentation de l'application identifie les fonctionnalités consommatrices en temps ou gourmandes en ressources. Elle doit notamment indiquer comment prévenir une perte de disponibilité due à une utilisation excessive de ces fonctionnalités et éviter que la génération d'une réponse ne prenne plus de temps que le délai d'expiration du consommateur. Les mesures de protection potentielles peuvent inclure le traitement asynchrone, l'utilisation de files d'attente et la limitation des processus parallèles par utilisateur et par application.",,✓,✓,, -V15,Développement et architecture sécurisés,V15.1,Documentation sur le développement et l'architecture sécurisés,V15.1.4,Vérifiez que la documentation de l’application met en évidence les bibliothèques tierces qui sont considérées comme des « composants à risque ».,,,✓,, -V15,Développement et architecture sécurisés,V15.1,Documentation sur le développement et l'architecture sécurisés,V15.1.5,Vérifiez que la documentation de l’application met en évidence les parties de l’application où des « fonctionnalités dangereuses » sont utilisées.,,,✓,, -V15,Développement et architecture sécurisés,V15.2,Architecture de sécurité et dépendances,V15.2.1,Vérifiez que l’application contient uniquement des composants qui n’ont pas dépassé les délais de mise à jour et de correction documentés.,✓,✓,✓,, -V15,Développement et architecture sécurisés,V15.2,Architecture de sécurité et dépendances,V15.2.2,"Vérifiez que l'application a mis en œuvre des défenses contre la perte de disponibilité due à des fonctionnalités qui prennent du temps ou qui nécessitent des ressources, sur la base des décisions et stratégies de sécurité documentées à cet effet.",,✓,✓,, -V15,Développement et architecture sécurisés,V15.2,Architecture de sécurité et dépendances,V15.2.3,"Vérifiez que l'environnement de production inclut uniquement les fonctionnalités nécessaires au fonctionnement de l'application et n'expose pas de fonctionnalités superflues telles que du code de test, des exemples d'extraits et des fonctionnalités de développement.",,✓,✓,, -V15,Développement et architecture sécurisés,V15.2,Architecture de sécurité et dépendances,V15.2.4,"Vérifiez que les composants tiers et toutes leurs dépendances transitives sont inclus à partir du référentiel attendu, qu'il soit détenu en interne ou qu'il s'agisse d'une source externe, et qu'il n'y a aucun risque d'attaque par confusion de dépendances.",,,✓,, -V15,Développement et architecture sécurisés,V15.2,Architecture de sécurité et dépendances,V15.2.5,"Vérifiez que l'application implémente des protections supplémentaires autour des parties documentées comme contenant des « fonctionnalités dangereuses » ou utilisant des bibliothèques tierces considérées comme des « composants à risque ». Cela peut inclure des techniques telles que le sandboxing, l'encapsulation, la conteneurisation ou l'isolation au niveau du réseau pour retarder et dissuader les attaquants qui compromettent une partie de l'application de se propager ailleurs.",,,✓,, -V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.1,"Vérifiez que l'application ne renvoie que le sous-ensemble requis de champs d'un objet de données. Par exemple, elle ne doit pas renvoyer un objet de données entier, car certains champs individuels ne doivent pas être accessibles aux utilisateurs.",✓,✓,✓,, -V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.2,"Vérifiez que lorsque le backend de l'application effectue des appels vers des URL externes, il est configuré pour ne pas suivre les redirections, sauf s'il s'agit d'une fonctionnalité prévue.",,✓,✓,, -V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.3,"Vérifiez que l'application dispose de contre-mesures pour se protéger contre les attaques d'affectation de masse en limitant les champs autorisés par contrôleur et action, par exemple, il n'est pas possible d'insérer ou de mettre à jour une valeur de champ lorsqu'elle n'était pas destinée à faire partie de cette action.",,✓,✓,, -V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.4,"Vérifiez que tous les composants proxy et middleware transfèrent correctement l'adresse IP d'origine de l'utilisateur à l'aide de champs de données fiables qui ne peuvent pas être manipulés par l'utilisateur final, et que l'application et le serveur Web utilisent cette valeur correcte pour la journalisation et les décisions de sécurité telles que la limitation du débit, en tenant compte du fait que même l'adresse IP d'origine peut ne pas être fiable en raison d'adresses IP dynamiques, de VPN ou de pare-feu d'entreprise.",,✓,✓,, -V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.5,"Vérifiez que l'application garantit explicitement que les variables sont du type correct et effectue des opérations d'égalité et de comparaison strictes. Cela permet d'éviter les vulnérabilités liées à la confusion de types, causées par des hypothèses du code de l'application sur le type d'une variable.",,✓,✓,, -V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.6,"Vérifiez que le code JavaScript est écrit de manière à éviter la pollution du prototype, par exemple en utilisant Set() ou Map() au lieu de littéraux d'objet.",,✓,✓,, -V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.7,"Vérifiez que l'application dispose de défenses contre les attaques de pollution des paramètres HTTP, en particulier si le Framework d'application ne fait aucune distinction quant à la source des paramètres de requête (chaîne de requête, paramètres de corps, cookies ou champs d'en-tête).",,✓,✓,, -V15,Développement et architecture sécurisés,V15.4,Concurrence sécurisée,V15.4.1,"Vérifiez que les objets partagés dans le code multithread (tels que les caches, les fichiers ou les objets en mémoire accessibles par plusieurs threads) sont accessibles en toute sécurité à l'aide de types thread-safe et de mécanismes de synchronisation tels que des verrous ou des sémaphores pour éviter les conditions de concurrence et la corruption des données.",,,✓,, -V15,Développement et architecture sécurisés,V15.4,Concurrence sécurisée,V15.4.2,"Vérifiez que les vérifications de l'état d'une ressource, comme son existence ou ses autorisations, et des actions qui en dépendent, sont effectuées en une seule opération atomique afin d'éviter les situations de concurrence entre le moment de la vérification et le moment de l'utilisation (TOCTOU). Par exemple, vérifier l'existence d'un fichier avant de l'ouvrir ou l'accès d'un utilisateur avant de l'accorder.",,,✓,, -V15,Développement et architecture sécurisés,V15.4,Concurrence sécurisée,V15.4.3,"Vérifiez que les verrous sont utilisés de manière cohérente pour éviter que les threads ne se bloquent, que ce soit en s'attendant les uns les autres ou en réessayant sans fin, et que la logique de verrouillage reste dans le code responsable de la gestion de la ressource pour garantir que les verrous ne peuvent pas être modifiés par inadvertance ou de manière malveillante par des classes ou du code externes.",,,✓,, -V15,Développement et architecture sécurisés,V15.4,Concurrence sécurisée,V15.4.4,"Vérifiez que les politiques d'allocation des ressources empêchent la saturation de threads en garantissant un accès équitable aux ressources, par exemple en exploitant les pools de threads, permettant aux threads de priorité inférieure de continuer dans un délai raisonnable.",,,✓,, -V16,Journalisation de sécurité et gestion des erreurs,V16.1,Documentation sur la journalisation de sécurité,V16.1.1,"Vérifiez qu'il existe un inventaire documentant la journalisation effectuée à chaque couche de la pile technologique de l'application, les événements enregistrés, les formats de journal, l'endroit où cette journalisation est stockée, la manière dont elle est utilisée, la manière dont l'accès à celle-ci est contrôlé et la durée de conservation des journaux.",,✓,✓,, -V16,Journalisation de sécurité et gestion des erreurs,V16.2,Journalisation générale,V16.2.1,"Vérifiez que chaque entrée de journal inclut les métadonnées nécessaires (telles que quand, où, qui, quoi) qui permettraient une enquête détaillée sur la chronologie lorsqu'un événement se produit.",,✓,✓,, -V16,Journalisation de sécurité et gestion des erreurs,V16.2,Journalisation générale,V16.2.2,Vérifiez que les sources de temps de tous les composants de journalisation sont synchronisées et que les horodatages des métadonnées des événements de sécurité utilisent le temps UTC ou incluent un décalage horaire explicite. L'UTC est recommandé pour garantir la cohérence entre les systèmes distribués et éviter toute confusion lors du passage à l'heure d'été.,,✓,✓,, -V16,Journalisation de sécurité et gestion des erreurs,V16.2,Journalisation générale,V16.2.3,Vérifiez que l’application stocke ou diffuse uniquement les journaux vers les fichiers et services documentés dans l’inventaire des journaux.,,✓,✓,, -V16,Journalisation de sécurité et gestion des erreurs,V16.2,Journalisation générale,V16.2.4,"Vérifiez que les journaux peuvent être lus et corrélés par le processeur de journaux utilisé, de préférence en utilisant un format de journalisation commun.",,✓,✓,, -V16,Journalisation de sécurité et gestion des erreurs,V16.2,Journalisation générale,V16.2.5,"Vérifiez que l'application applique la journalisation en fonction du niveau de protection des données lors de la journalisation de données sensibles. Par exemple, certaines données, comme les identifiants ou les informations de paiement, peuvent être interdites. D'autres données, comme les jetons de session, ne peuvent être enregistrées que par hachage ou masquage, en totalité ou en partie.",,✓,✓,, -V16,Journalisation de sécurité et gestion des erreurs,V16.3,Événements de sécurité,V16.3.1,"Vérifiez que toutes les opérations d'authentification sont enregistrées, y compris les tentatives réussies et infructueuses. Des métadonnées supplémentaires, telles que le type d'authentification ou les facteurs utilisés, doivent également être collectées.",,✓,✓,, -V16,Journalisation de sécurité et gestion des erreurs,V16.3,Événements de sécurité,V16.3.2,"Vérifier que les tentatives d'autorisation infructueuses sont logguées. Pour le niveau 3, cela doit inclure la journalisation de toutes les décisions d'autorisation, y compris lors de l'accès à des données sensibles (sans journalisation des données sensibles elles-mêmes).",,✓,✓,, -V16,Journalisation de sécurité et gestion des erreurs,V16.3,Événements de sécurité,V16.3.3,"Vérifiez que l'application enregistre les événements de sécurité définis dans la documentation et enregistre également les tentatives de contournement des contrôles de sécurité, tels que la validation des entrées, la logique métier et l'anti-automatisation.",,✓,✓,, -V16,Journalisation de sécurité et gestion des erreurs,V16.3,Événements de sécurité,V16.3.4,Vérifiez que l’application enregistre les erreurs inattendues et les échecs de contrôle de sécurité tels que les échecs TLS du backend.,,✓,✓,, -V16,Journalisation de sécurité et gestion des erreurs,V16.4,Protection des journaux,V16.4.1,Vérifiez que tous les composants de journalisation codent correctement les données pour empêcher l’injection de journaux.,,✓,✓,, -V16,Journalisation de sécurité et gestion des erreurs,V16.4,Protection des journaux,V16.4.2,Vérifiez que les journaux sont protégés contre tout accès non autorisé et ne peuvent pas être modifiés.,,✓,✓,, -V16,Journalisation de sécurité et gestion des erreurs,V16.4,Protection des journaux,V16.4.3,"Vérifiez que les journaux sont transmis de manière sécurisée à un système logique distinct pour analyse, détection, alerte et remontée des informations. L'objectif est de garantir qu'en cas de violation de l'application, les journaux ne seront pas compromis.",,✓,✓,, -V16,Journalisation de sécurité et gestion des erreurs,V16.5,Gestion des erreurs,V16.5.1,"Vérifiez qu'un message générique est renvoyé au consommateur lorsqu'une erreur inattendue ou sensible à la sécurité se produit, garantissant ainsi l'absence d'exposition de données système internes sensibles telles que les traces de pile, les requêtes, les clés secrètes et les jetons.",,✓,✓,, -V16,Journalisation de sécurité et gestion des erreurs,V16.5,Gestion des erreurs,V16.5.2,"Vérifiez que l'application continue de fonctionner en toute sécurité lorsque l'accès aux ressources externes échoue, par exemple, en utilisant des modèles tels que des disjoncteurs ou une dégradation progressive.",,✓,✓,, -V16,Journalisation de sécurité et gestion des erreurs,V16.5,Gestion des erreurs,V16.5.3,"Vérifiez que l'application échoue proprement et sécurisée, y compris lorsqu'une exception se produit, en évitant les accès en cas d'erreur telles que le traitement d'une transaction malgré les erreurs résultant de la logique de validation.",,✓,✓,, -V16,Journalisation de sécurité et gestion des erreurs,V16.5,Gestion des erreurs,V16.5.4,"Vérifiez qu'un gestionnaire d'erreurs de « dernier recours » est défini pour intercepter toutes les exceptions non gérées. Cela permet d'éviter la perte des informations d'erreur qui doivent être loguées dans les fichiers journaux et de garantir qu'une erreur ne paralyse pas l'ensemble du processus applicatif, entraînant une perte de disponibilité.",,,✓,, -V17,WebRTC,V17.1,Serveur TURN,V17.1.1,"Vérifiez que le service TURN (Traversal Using Relays around NAT) autorise uniquement l'accès aux adresses IP non réservées à des fins spécifiques (par exemple, réseaux internes, diffusion, bouclage). Notez que cela s'applique aux adresses IPv4 et IPv6.",,✓,✓,, -V17,WebRTC,V17.1,Serveur TURN,V17.1.2,Vérifiez que le service Traversal Using Relays around NAT (TURN) n'est pas susceptible d'épuiser ses ressources lorsque des utilisateurs légitimes tentent d'ouvrir un grand nombre de ports sur le serveur TURN.,,,✓,, -V17,WebRTC,V17.2,Média,V17.2.1,Vérifiez que la clé du certificat Datagram Transport Layer Security (DTLS) est gérée et protégée conformément à la politique documentée de gestion des clés cryptographiques.,,✓,✓,, -V17,WebRTC,V17.2,Média,V17.2.2,Vérifiez que le serveur multimédia est configuré pour utiliser et prendre en charge les suites de chiffrement DTLS (Datagram Transport Layer Security) approuvées et un profil de protection sécurisé pour l'extension DTLS pour l'établissement de clés pour le protocole de transport en temps réel sécurisé (DTLS-SRTP).,,✓,✓,, -V17,WebRTC,V17.2,Média,V17.2.3,Vérifiez que l'authentification SRTP (Secure Real-time Transport Protocol) est vérifiée sur le serveur multimédia pour empêcher les attaques par injection RTP (Real-time Transport Protocol) d'entraîner une condition de déni de service ou l'insertion de médias audio ou vidéo dans les flux multimédias.,,✓,✓,, -V17,WebRTC,V17.2,Média,V17.2.4,Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant lorsqu'il rencontre des paquets SRTP (Secure Real-time Transport Protocol) mal formés.,,✓,✓,, -V17,WebRTC,V17.2,Média,V17.2.5,Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.,,,✓,, -V17,WebRTC,V17.2,Média,V17.2.6,Vérifiez que le serveur multimédia n'est pas sensible à la vulnérabilité de condition de concurrence « ClientHello » dans Datagram Transport Layer Security (DTLS) en vérifiant si le serveur multimédia est publiquement connu comme étant vulnérable ou en effectuant le test de condition de concurrence.,,,✓,, -V17,WebRTC,V17.2,Média,V17.2.7,Vérifiez que tous les mécanismes d'enregistrement audio ou vidéo associés au serveur multimédia sont en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.,,,✓,, -V17,WebRTC,V17.2,Média,V17.2.8,"Vérifiez que le certificat Datagram Transport Layer Security (DTLS) est vérifié par rapport à l'attribut d'empreinte cryptographique du protocole de description de session (SDP), en mettant fin au flux multimédia si la vérification échoue, pour garantir l'authenticité du flux multimédia.",,,✓,, -V17,WebRTC,V17.3,Signalisation,V17.3.1,Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation entrants légitimes lors d'une attaque par saturation. Cela peut être réalisé en implémentant une limitation de débit au niveau de la signalisation.,,✓,✓,, -V17,WebRTC,V17.3,Signalisation,V17.3.2,"Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation légitimes en cas de message mal formé susceptible de provoquer un déni de service. Cela peut inclure la validation des entrées, la gestion sécurisée des dépassements d'entiers, la prévention des dépassements de tampon et l'utilisation d'autres techniques robustes de gestion des erreurs.",,✓,✓,, - diff --git a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.json b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.json deleted file mode 100644 index a1fdbe08df..0000000000 --- a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.json +++ /dev/null @@ -1,7259 +0,0 @@ -{ - "Name": "Application Security Verification Standard Project", - "ShortName": "ASVS", - "Version": "5.0.0", - "Description": "The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.", - "Requirements": [ - { - "Shortcode": "V1", - "Ordinal": 1, - "ShortName": "Encoding", - "Name": "Encodage et nettoyage", - "Items": [ - { - "Shortcode": "V1.1", - "Ordinal": 1, - "Name": "Architecture d'encodage et de nettoyage", - "Items": [ - { - "Shortcode": "V1.1.1", - "Ordinal": 1, - "Description": "Vérifiez que l'entrée est décodée ou non échappée vers une forme canonique une seule fois, elle n'est décodée que lorsque des données codées sous cette forme sont attendues, et que cela est fait avant de traiter davantage l'entrée, par exemple, elle n'est pas effectuée après la validation ou la désinfection de l'entrée.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.1.2", - "Ordinal": 2, - "Description": "Vérifiez que l'application effectue l'encodage et l'échappement de sortie soit comme étape finale avant d'être utilisée par l'interpréteur pour lequel elle est destinée, soit par l'interpréteur lui-même.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V1.2", - "Ordinal": 2, - "Name": "Prévention des injections", - "Items": [ - { - "Shortcode": "V1.2.1", - "Ordinal": 1, - "Description": "Vérifiez que l'encodage de sortie d'une réponse HTTP, d'un document HTML ou d'un document XML est pertinent pour le contexte requis, comme l'encodage des caractères pertinents pour les éléments HTML, les attributs HTML, les commentaires HTML, les CSS ou les champs d'en-tête HTTP, pour éviter de modifier la structure du message ou du document.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.2.2", - "Ordinal": 2, - "Description": "Vérifiez que, lors de la création dynamique d'URL, les données non fiables sont encodées en fonction de leur contexte (par exemple, encodage d'URL ou encodage base64url pour les paramètres de requête ou de chemin). Assurez-vous que seuls les schémas d'URL sûrs sont autorisés (par exemple, interdire javascript: ou data:).", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.2.3", - "Ordinal": 3, - "Description": "Vérifiez que l'encodage ou l'échappement de sortie est utilisé lors de la création dynamique de contenu JavaScript (y compris JSON), pour éviter de modifier la structure du message ou du document (pour éviter l'injection JavaScript et JSON).", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.2.4", - "Ordinal": 4, - "Description": "Vérifiez que la sélection de données ou les requêtes de base de données (par exemple, SQL, HQL, NoSQL, Cypher) utilisent des requêtes paramétrées, des ORM, des Framework d'entités ou sont protégées contre les injections SQL et autres attaques par injection de base de données. Ceci est également pertinent lors de l'écriture de procédures stockées.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.2.5", - "Ordinal": 5, - "Description": "Vérifiez que l’application protège contre l’injection de commandes du système d’exploitation et que les appels du système d’exploitation utilisent des requêtes du système d’exploitation paramétrées ou utilisent un encodage de sortie de ligne de commande contextuelle.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.2.6", - "Ordinal": 6, - "Description": "Vérifiez que l’application protège contre les vulnérabilités d’injection LDAP ou que des contrôles de sécurité spécifiques pour empêcher l’injection LDAP ont été mis en œuvre.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.2.7", - "Ordinal": 7, - "Description": "Vérifiez que l’application est protégée contre les attaques par injection XPath en utilisant la paramétrisation des requêtes ou des requêtes précompilées.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.2.8", - "Ordinal": 8, - "Description": "Vérifiez que les processeurs LaTeX sont configurés de manière sécurisée (par exemple, en n'utilisant pas l'indicateur « --shell-escape ») et qu'une liste d’autorisations de commandes est utilisée pour empêcher les attaques par injection LaTeX.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.2.9", - "Ordinal": 9, - "Description": "Vérifiez que l'application échappe les caractères spéciaux dans les expressions régulières (généralement à l'aide d'une barre oblique inverse) pour éviter qu'ils ne soient mal interprétés comme des métacaractères.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.2.10", - "Ordinal": 10, - "Description": "Vérifiez que l'application est protégée contre les injections CSV et injections de formules. L'application doit respecter les règles d'échappement définies dans les sections 2.6 et 2.7 de la RFC 4180 lors de l'export de contenu CSV. De plus, lors de l'export au format CSV ou vers d'autres formats de tableur (tels que XLS, XLSX ou ODF), les caractères spéciaux (notamment « = », « + », « - », « @ », « \\t » (tabulation) et « \\0 » (caractère null)) doivent être protégés par une apostrophe s'ils apparaissent en premier dans une valeur de champ.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V1.3", - "Ordinal": 3, - "Name": "Nettoyage", - "Items": [ - { - "Shortcode": "V1.3.1", - "Ordinal": 1, - "Description": "Vérifiez que toutes les entrées HTML non fiables provenant d'éditeurs WYSIWYG ou similaires sont nettoyées à l'aide d'une bibliothèque ou d'une fonctionnalité de Framework de nettoyage HTML bien connue et sécurisée.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.2", - "Ordinal": 2, - "Description": "Vérifiez que l'application évite d'utiliser eval() ou d'autres fonctionnalités d'exécution de code dynamique telles que Spring Expression Language (SpEL). En l'absence d'alternative, toute saisie utilisateur incluse doit être nettoyée avant d'être exécutée.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.3", - "Ordinal": 3, - "Description": "Vérifiez que les données transmises à un contexte potentiellement dangereux sont préalablement nettoyées pour appliquer des mesures de sécurité, telles qu'autoriser uniquement des caractères sûrs pour ce contexte et raccourcir des entrées trop longues.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.4", - "Ordinal": 4, - "Description": "Vérifiez que le contenu Scalable Vector Graphics (SVG) scriptable fourni par l'utilisateur est validé ou nettoyé pour contenir uniquement des balises et des attributs (tels que des graphiques de dessin) qui sont sûrs pour l'application, par exemple, ne contiennent pas de scripts et d'objets étrangers.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.5", - "Ordinal": 5, - "Description": "Vérifiez que l'application nettoie ou désactive le contenu du langage de modèle d'expression ou de script fourni par l'utilisateur, tel que les feuilles de style CSS, le Markdown ou XSL, BBCode ou similaire.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.6", - "Ordinal": 6, - "Description": "Vérifiez que l'application protège contre les attaques de falsification de requête côté serveur (SSRF), en validant les données non fiables par rapport à une liste d'autorisation de protocoles, de domaines, de chemins et de ports et en nettoyant les caractères potentiellement dangereux avant d'utiliser les données pour appeler un autre service.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.7", - "Ordinal": 7, - "Description": "Vérifiez que l'application se protège contre les attaques par injection de modèles en interdisant la création de modèles basés sur des entrées non fiables. En l'absence d'alternative, toute entrée non fiable incluse dynamiquement lors de la création du modèle doit être nettoyée ou rigoureusement validée.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.8", - "Ordinal": 8, - "Description": "Vérifiez que l’application nettoie correctement les entrées non fiables avant utilisation dans les requêtes Java Naming and Directory Interface (JNDI) et que JNDI est configuré de manière sécurisée pour empêcher les attaques par injection JNDI.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.9", - "Ordinal": 9, - "Description": "Vérifiez que l’application nettoie le contenu avant qu’il ne soit envoyé à memcache pour éviter les attaques par injection.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.10", - "Ordinal": 10, - "Description": "Vérifiez que les chaînes de format susceptibles d'être résolues de manière inattendue ou malveillante lors de leur utilisation sont nettoyées avant d'être traitées.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.11", - "Ordinal": 11, - "Description": "Vérifiez que l'application nettoie les entrées utilisateur avant de les transmettre aux systèmes de messagerie pour se protéger contre l'injection SMTP ou IMAP.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.12", - "Ordinal": 12, - "Description": "Vérifiez que les expressions régulières sont exemptes d'éléments provoquant \"backtracking\" exponentiel et assurez-vous que les entrées non fiables sont nettoyées pour atténuer les attaques ReDoS ou Runaway Regex.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V1.4", - "Ordinal": 4, - "Name": "Mémoire, chaine de caractères et code à mémoire non-managée", - "Items": [ - { - "Shortcode": "V1.4.1", - "Ordinal": 1, - "Description": "Vérifiez que l'application utilise des chaînes memory-safe, une copie de mémoire et une arithmétique de pointeur renforcée pour détecter ou empêcher les débordements de pile, de tampon ou de tas.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.4.2", - "Ordinal": 2, - "Description": "Vérifiez que les techniques de validation du signe, de la plage et de l’entrée sont utilisées pour éviter les dépassements d’entiers.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.4.3", - "Ordinal": 3, - "Description": "Vérifiez que la mémoire et les ressources allouées dynamiquement sont libérées et que les références ou les pointeurs vers la mémoire libérée sont supprimés ou définis à null pour éviter les \"dangling pointer\" et les vulnérabilités d'utilisation après libération.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V1.5", - "Ordinal": 5, - "Name": "Désérialisation sécurisée", - "Items": [ - { - "Shortcode": "V1.5.1", - "Ordinal": 1, - "Description": "Vérifiez que l'application configure les \"parser\" XML pour utiliser une configuration restrictive et que les fonctionnalités non sûres telles que la résolution d'entités externes sont désactivées pour empêcher les attaques XML eXternal Entity (XXE).", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.5.2", - "Ordinal": 2, - "Description": "Vérifiez que la désérialisation des données non fiables garantit une gestion sécurisée des entrées, par exemple en utilisant une liste d'autorisation de types d'objets ou en limitant les types d'objets définis par le client, afin d'empêcher les attaques par désérialisation. Les mécanismes de désérialisation explicitement définis comme non sécurisés ne doivent pas être utilisés avec des entrées non fiables.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.5.3", - "Ordinal": 3, - "Description": "Vérifiez que les différents \"parser\" utilisés dans l'application pour le même type de données (par exemple, les \"parser\" JSON, les \"parser\" XML, les \"parser\" d'URL) effectuent l'analyse de manière cohérente et utilisent le même mécanisme d'encodage de caractères pour éviter des problèmes tels que les vulnérabilités d'interopérabilité JSON ou un comportement d'analyse d'URI ou de fichier différent exploité dans les attaques d'inclusion de fichiers à distance (RFI) ou de falsification de requête côté serveur (SSRF).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V2", - "Ordinal": 2, - "ShortName": "Validation", - "Name": "Validation et logique métier", - "Items": [ - { - "Shortcode": "V2.1", - "Ordinal": 1, - "Name": "Validation et documentation de la logique métier", - "Items": [ - { - "Shortcode": "V2.1.1", - "Ordinal": 1, - "Description": "Vérifiez que la documentation de l'application définit des règles de validation des entrées pour vérifier la validité des éléments de données par rapport à la structure attendue. Il peut s'agir de formats de données courants tels que des numéros de carte de crédit, des adresses e-mail ou des numéros de téléphone, ou d'un format de données interne.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V2.1.2", - "Ordinal": 2, - "Description": "Vérifiez que la documentation de l'application définit comment valider la cohérence logique et contextuelle des éléments de données combinés, par exemple en vérifiant que la banlieue et le code postal correspondent.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V2.1.3", - "Ordinal": 3, - "Description": "Vérifiez que les attentes en matière de limites et de validations de la logique métier sont documentées, y compris par utilisateur et globalement dans l'application.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V2.2", - "Ordinal": 2, - "Name": "Validation des entrées", - "Items": [ - { - "Shortcode": "V2.2.1", - "Ordinal": 1, - "Description": "Vérifier que les entrées sont validées afin de respecter les attentes métier ou fonctionnelles. Cette validation doit être basée sur une liste de valeurs, de modèles et de plages autorisées, ou sur la comparaison des entrées avec une structure attendue et des limites logiques selon des règles prédéfinies. Pour le niveau 1, cette validation peut se concentrer sur les entrées utilisées pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau 2, elle doit s'appliquer à toutes les entrées.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V2.2.2", - "Ordinal": 2, - "Description": "Vérifiez que l'application est conçue pour appliquer la validation des entrées au niveau d'une couche de service de confiance. Bien que la validation côté client améliore l'ergonomie et doit être encouragée, elle ne doit pas être considérée comme un contrôle de sécurité.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V2.2.3", - "Ordinal": 3, - "Description": "Vérifiez que l’application garantit que les combinaisons d’éléments de données associés sont raisonnables selon les règles prédéfinies.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V2.3", - "Ordinal": 3, - "Name": "Sécurité de la logique métier", - "Items": [ - { - "Shortcode": "V2.3.1", - "Ordinal": 1, - "Description": "Vérifiez que l’application traitera uniquement les flux de logique métier pour le même utilisateur dans l’ordre séquentiel attendu et sans sauter d’étapes.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V2.3.2", - "Ordinal": 2, - "Description": "Vérifiez que les limites de la logique métier sont implémentées conformément à la documentation de l'application, afin d'éviter que des failles de la logique métier ne soient pas exploitées.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V2.3.3", - "Ordinal": 3, - "Description": "Vérifiez que les transactions sont utilisées au niveau de la logique métier de telle sorte qu'une opération de logique métier réussisse dans son intégralité ou qu'elle soit restaurée à l'état correct précédent.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V2.3.4", - "Ordinal": 4, - "Description": "Vérifiez que les mécanismes de verrouillage au niveau de la logique métier sont utilisés pour garantir que les ressources en quantité limitée (telles que les sièges de théâtre ou les créneaux de livraison) ne peuvent pas être réservées deux fois en manipulant la logique de l'application.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V2.3.5", - "Ordinal": 5, - "Description": "Vérifiez que les flux logiques métier à forte valeur ajoutée nécessitent l'approbation de plusieurs utilisateurs afin d'éviter toute action non autorisée ou accidentelle. Cela peut inclure, sans s'y limiter, les transferts monétaires importants, les approbations de contrats, l'accès à des informations classifiées ou les contournements de sécurité dans le secteur manufacturier.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V2.4", - "Ordinal": 4, - "Name": "Anti-automatisation", - "Items": [ - { - "Shortcode": "V2.4.1", - "Ordinal": 1, - "Description": "Vérifiez que des contrôles anti-automatisation sont en place pour protéger contre les appels excessifs aux fonctions d'application qui pourraient conduire à l'exfiltration de données, à la création de données inutiles, à l'épuisement des quotas, aux violations de limites de débit, au déni de service ou à la surutilisation de ressources coûteuses.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V2.4.2", - "Ordinal": 2, - "Description": "Vérifiez que les flux logiques métier nécessitent un timing humain réaliste, évitant ainsi des soumissions de transactions excessivement rapides.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V3", - "Ordinal": 3, - "ShortName": "Web", - "Name": "Sécurité du frontend Web", - "Items": [ - { - "Shortcode": "V3.1", - "Ordinal": 1, - "Name": "Documentation sur la sécurité du frontend Web", - "Items": [ - { - "Shortcode": "V3.1.1", - "Ordinal": 1, - "Description": "Vérifiez que la documentation de l'application indique les fonctionnalités de sécurité attendues que les navigateurs utilisant l'application doivent prendre en charge (telles que HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) et autres mécanismes de sécurité HTTP pertinents). Elle doit également définir le comportement de l'application lorsque certaines de ces fonctionnalités ne sont pas disponibles (par exemple, avertir l'utilisateur ou bloquer l'accès).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V3.2", - "Ordinal": 2, - "Name": "Interprétation non intentionnelle du contenu", - "Items": [ - { - "Shortcode": "V3.2.1", - "Ordinal": 1, - "Description": "Vérifiez que des contrôles de sécurité sont en place pour empêcher les navigateurs d'afficher du contenu ou des fonctionnalités dans les réponses HTTP dans un contexte incorrect (par exemple, lorsqu'une API, un fichier téléchargé par l'utilisateur ou une autre ressource est demandée directement). Les contrôles possibles peuvent inclure : ne pas transmettre le contenu sauf si les champs d'en-tête de requête HTTP (tels que Sec-Fetch-\\*) indiquent qu'il s'agit du contexte correct, utiliser la directive sandbox du champ d'en-tête Content-Security-Policy ou utiliser le type de disposition de pièce jointe dans le champ d'en-tête Content-Disposition.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.2.2", - "Ordinal": 2, - "Description": "Vérifiez que le contenu destiné à être affiché sous forme de texte, plutôt que rendu sous forme de HTML, est géré à l'aide de fonctions de rendu sécurisées (telles que createTextNode ou textContent) pour empêcher l'exécution involontaire de contenu tel que HTML ou JavaScript.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.2.3", - "Ordinal": 3, - "Description": "Vérifiez que l'application évite l'écrasement du DOM lors de l'utilisation de JavaScript côté client en utilisant des déclarations de variables explicites, en effectuant une vérification de type stricte, en évitant de stocker des variables globales sur l'objet document et en implémentant l'isolation de l'espace de nommage.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V3.3", - "Ordinal": 3, - "Name": "Configuration des cookies", - "Items": [ - { - "Shortcode": "V3.3.1", - "Ordinal": 1, - "Description": "Vérifiez que les cookies ont l'attribut « Secure » ​​défini et si le préfixe « \\__Host- » n'est pas utilisé pour le nom du cookie, le préfixe « __Secure- » doit être utilisé pour le nom du cookie.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.3.2", - "Ordinal": 2, - "Description": "Vérifiez que la valeur de l'attribut « SameSite » de chaque cookie est définie en fonction de l'objectif du cookie, afin de limiter l'exposition aux attaques de réparation de l'interface utilisateur et aux attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.3.3", - "Ordinal": 3, - "Description": "Vérifiez que les cookies ont le préfixe « __Host- » pour le nom du cookie, sauf s'ils sont explicitement conçus pour être partagés avec d'autres hôtes.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.3.4", - "Ordinal": 4, - "Description": "Vérifiez que si la valeur d'un cookie n'est pas censée être accessible aux scripts côté client (comme un jeton de session), le cookie doit avoir l'attribut « HttpOnly » défini et la même valeur (par exemple, un jeton de session) ne doit être transférée au client que via le champ d'en-tête « Set-Cookie ».", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.3.5", - "Ordinal": 5, - "Description": "Vérifiez que lorsque l'application écrit un cookie, la longueur combinée du nom et de la valeur du cookie ne dépasse pas 4 096 octets. Les cookies trop volumineux ne seront pas stockés par le navigateur et ne seront donc pas envoyés avec les requêtes, empêchant ainsi l'utilisateur d'utiliser les fonctionnalités de l'application qui reposent sur ce cookie.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V3.4", - "Ordinal": 4, - "Name": "En-têtes du mécanisme de sécurité du navigateur", - "Items": [ - { - "Shortcode": "V3.4.1", - "Ordinal": 1, - "Description": "Vérifiez qu'un champ d'en-tête Strict-Transport-Security est inclus dans toutes les réponses afin d'appliquer une politique HTTP Strict Transport Security (HSTS). Une durée maximale d'au moins un an doit être définie, et pour les niveaux L2 et supérieurs, la politique doit également s'appliquer à tous les sous-domaines.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.4.2", - "Ordinal": 2, - "Description": "Vérifiez que le champ d'en-tête Access-Control-Allow-Origin du partage de ressources cross-origine (CORS) est une valeur fixe de l'application ou, si la valeur du champ d'en-tête de requête HTTP Origin est utilisée, qu'elle est validée par rapport à une liste d'origines approuvées. Si « Access-Control-Allow-Origin: * » doit être utilisé, vérifiez que la réponse ne contient aucune information sensible.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.4.3", - "Ordinal": 3, - "Description": "Vérifiez que les réponses HTTP incluent un champ d'en-tête de réponse Content-Security-Policy qui définit des directives garantissant que le navigateur charge et exécute uniquement du contenu ou des ressources fiables, afin de limiter l'exécution de JavaScript malveillant. Au minimum, une politique globale doit être utilisée, incluant les directives object-src 'none' et base-uri 'none', et définissant soit une lliste d’autorisations, soit des valeurs nonces ou des hachages. Pour une application L3, une politique par réponse avec des valeurs nonces ou des hachages doit être définie.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.4.4", - "Ordinal": 4, - "Description": "Vérifiez que toutes les réponses HTTP contiennent un champ d'en-tête « X-Content-Type-Options: nosniff ». Cela indique aux navigateurs de ne pas utiliser l'analyse de contenu ni la détection du type MIME pour la réponse donnée, et d'exiger que la valeur du champ d'en-tête « Content-Type » de la réponse corresponde à la ressource de destination. Par exemple, la réponse à une demande de style n'est acceptée que si le type de contenu de la réponse est « text/css ». Cela permet également au navigateur d'utiliser la fonctionnalité de blocage de lecture inter-origines (CORB).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.4.5", - "Ordinal": 5, - "Description": "Vérifiez que l'application définit une politique de référencement afin d'empêcher la fuite de données techniquement sensibles vers des services tiers via le champ d'en-tête de requête HTTP « Referer ». Cela peut être effectué via le champ d'en-tête de réponse HTTP « Referrer-Policy » ou via les attributs d'élément HTML. Les données sensibles peuvent inclure le chemin d'accès et les données de requête dans l'URL, et pour les applications internes non publiques, le nom d'hôte.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.4.6", - "Ordinal": 6, - "Description": "Vérifiez que l'application Web utilise la directive frame-ancestors du champ d'en-tête Content-Security-Policy pour chaque réponse HTTP afin de garantir qu'elle ne peut pas être intégrée par défaut et que l'intégration de ressources spécifiques n'est autorisée qu'en cas de nécessité. Notez que le champ d'en-tête X-Frame-Options, bien que pris en charge par les navigateurs, est obsolète et n'est pas forcément fiable.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.4.7", - "Ordinal": 7, - "Description": "Vérifiez que le champ d’en-tête Content-Security-Policy spécifie un emplacement pour signaler les violations.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.4.8", - "Ordinal": 8, - "Description": "Vérifiez que toutes les réponses HTTP qui lancent le rendu d'un document (comme les réponses de type text/html) incluent le champ d'en-tête 'Cross-Origin-Opener-Policy' avec la directive 'same-origin' ou s'ame-origin-allow-popups', selon les besoins. Cela empêche les attaques abusant de l'accès partagé aux objets Window, telles que le tabnabbing et le comptage d'images.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V3.5", - "Ordinal": 5, - "Name": "Séparation de l'origine du navigateur", - "Items": [ - { - "Shortcode": "V3.5.1", - "Ordinal": 1, - "Description": "Vérifiez que, si l'application ne s'appuie pas sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher les requêtes inter-origines non autorisées d'utiliser des fonctionnalités sensibles, ces requêtes sont validées afin de garantir leur origine. Cela peut se faire en utilisant et en validant des jetons anti-falsification ou en exigeant des champs d'en-tête HTTP supplémentaires qui ne sont pas des champs d'en-tête de requête CORS safelist. Ceci permet de se protéger contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.5.2", - "Ordinal": 2, - "Description": "Vérifiez que, si l'application s'appuie sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher l'utilisation inter-origines non autorisée de fonctionnalités sensibles, il est impossible d'appeler la fonctionnalité avec une requête qui ne déclenche pas de requête de pré-vérification cross-origin CORS. Cela peut nécessiter de vérifier les valeurs des champs d'en-tête de requête 'Origin' et 'Content-Type' ou d'utiliser un champ d'en-tête supplémentaire qui n'est pas un champ d'en-tête de la liste de sécurité CORS.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.5.3", - "Ordinal": 3, - "Description": "Vérifiez que les requêtes HTTP destinées aux fonctionnalités sensibles utilisent des méthodes HTTP appropriées, telles que POST, PUT, PATCH ou DELETE, et non des méthodes définies comme « sûres » par la spécification HTTP, telles que HEAD, OPTIONS ou GET. Une validation stricte des champs d'en-tête de requête Sec-Fetch-* peut également être utilisée pour garantir que la requête ne provient pas d'un appel inter-origines inapproprié, d'une requête de navigation ou d'un chargement de ressources (comme une source d'image) inattendu.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.5.4", - "Ordinal": 4, - "Description": "Vérifiez que des applications distinctes sont hébergées sur des noms d'hôte différents pour tirer parti des restrictions fournies par la politique de même origine, y compris la manière dont les documents ou scripts chargés par une origine peuvent interagir avec les ressources d'une autre origine et les restrictions basées sur le nom d'hôte sur les cookies.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.5.5", - "Ordinal": 5, - "Description": "Vérifiez que les messages reçus par l'interface postMessage sont rejetés si l'origine du message n'est pas digne de confiance ou si la syntaxe du message n'est pas valide.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.5.6", - "Ordinal": 6, - "Description": "Vérifiez que la fonctionnalité JSONP n'est activée nulle part dans l'application pour éviter les attaques Cross-Site Script Inclusion (XSSI).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.5.7", - "Ordinal": 7, - "Description": "Vérifiez que les données nécessitant une autorisation ne sont pas incluses dans les réponses des ressources de script, comme les fichiers JavaScript, pour empêcher les attaques par inclusion de script intersite (XSSI).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.5.8", - "Ordinal": 8, - "Description": "Vérifiez que les ressources authentifiées (telles que les images, les vidéos, les scripts et autres documents) peuvent être chargées ou intégrées pour le compte de l'utilisateur uniquement lorsque cela est prévu. Cela peut être réalisé en validant strictement les champs d'en-tête de requête HTTP Sec-Fetch-* afin de garantir que la requête ne provient pas d'un appel cross-origin inapproprié, ou en définissant un champ d'en-tête de réponse HTTP Cross-Origin-Resource-Policy restrictif pour indiquer au navigateur de bloquer le contenu renvoyé.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V3.6", - "Ordinal": 6, - "Name": "Intégrité des ressources externes", - "Items": [ - { - "Shortcode": "V3.6.1", - "Ordinal": 1, - "Description": "Vérifiez que les ressources côté client, telles que les bibliothèques JavaScript, les feuilles de style CSS ou les polices web, sont hébergées en externe (par exemple, sur un réseau de diffusion de contenu) uniquement si la ressource est statique et versionnée, et si l'intégrité des sous-ressources (SRI) est utilisée pour valider l'intégrité de la ressource. Si cela n'est pas possible, une décision de sécurité documentée doit justifier cette décision pour chaque ressource.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V3.7", - "Ordinal": 7, - "Name": "Autres considérations sur la sécurité du navigateur", - "Items": [ - { - "Shortcode": "V3.7.1", - "Ordinal": 1, - "Description": "Vérifiez que l'application utilise uniquement des technologies côté client toujours prises en charge et considérées comme sécurisées. Parmi les technologies qui ne répondent pas à cette exigence figurent les plugins NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL ou les applets Java côté client.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.7.2", - "Ordinal": 2, - "Description": "Vérifiez que l'application redirigera automatiquement l'utilisateur vers un nom d'hôte ou un domaine différent (qui n'est pas contrôlé par l'application) uniquement lorsque la destination apparaît sur une liste d'autorisation.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.7.3", - "Ordinal": 3, - "Description": "Vérifiez que le domaine de premier niveau de l'application (par exemple, site.tld) ​​est ajouté à la liste de préchargement publique pour HTTP Strict Transport Security (HSTS). Cela garantit que l'utilisation de TLS pour l'application est intégrée directement dans les principaux navigateurs, plutôt que de dépendre uniquement du champ d'en-tête de réponse Strict-Transport-Security.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.7.4", - "Ordinal": 4, - "Description": "Vérifiez que l'application affiche une notification lorsque l'utilisateur est redirigé vers une URL hors du contrôle de l'application, avec une option pour annuler la navigation.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.7.5", - "Ordinal": 5, - "Description": "Vérifiez que l'application se comporte comme documenté (par exemple, en avertissant l'utilisateur ou en bloquant l'accès) si le navigateur utilisé pour accéder à l'application ne prend pas en charge les fonctionnalités de sécurité attendues.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V4", - "Ordinal": 4, - "ShortName": "API", - "Name": "API et service Web", - "Items": [ - { - "Shortcode": "V4.1", - "Ordinal": 1, - "Name": "Sécurité du service Web générique", - "Items": [ - { - "Shortcode": "V4.1.1", - "Ordinal": 1, - "Description": "Vérifiez que chaque réponse HTTP avec un corps de message contient un champ d'en-tête Content-Type qui correspond au contenu réel de la réponse, y compris le paramètre charset pour spécifier un codage de caractères sécurisé (par exemple, UTF-8, ISO-8859-1) conformément aux types de médias IANA, tels que « text/ », « /+xml » et « /xml ».", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.1.2", - "Ordinal": 2, - "Description": "Vérifiez que seuls les terminaux utilisateurs (destinés à l'accès manuel via un navigateur web) redirigent automatiquement de HTTP vers HTTPS, tandis que les autres services ou terminaux n'implémentent pas de redirections transparentes. Cela permet d'éviter qu'un client envoie par erreur des requêtes HTTP non chiffrées, mais que, comme ces requêtes sont automatiquement redirigées vers HTTPS, la fuite de données sensibles passe inaperçue.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.1.3", - "Ordinal": 3, - "Description": "Vérifiez que tout champ d'en-tête HTTP utilisé par l'application et défini par une couche intermédiaire, telle qu'un équilibreur de charge, un proxy web ou un service backend-for-frontend, ne peut pas être remplacé par l'utilisateur final. Les exemples d'en-têtes peuvent inclure X-Real-IP, X-Forwarded-*, ou X-User-ID.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.1.4", - "Ordinal": 4, - "Description": "Vérifiez que seules les méthodes HTTP explicitement prises en charge par l'application ou son API (y compris les OPTIONS lors des demandes de contrôle en amont) peuvent être utilisées et que les méthodes inutilisées sont bloquées.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.1.5", - "Ordinal": 5, - "Description": "Vérifier que les signatures numériques par message sont utilisées pour fournir une assurance supplémentaire en plus des protections de transport pour les demandes ou les transactions qui sont très sensibles ou qui traversent un certain nombre de systèmes.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V4.2", - "Ordinal": 2, - "Name": "Validation de la structure des messages HTTP", - "Items": [ - { - "Shortcode": "V4.2.1", - "Ordinal": 1, - "Description": "Vérifiez que tous les composants de l'application (y compris les équilibreurs de charge, les pares-feux et les serveurs d'applications) déterminent les limites des messages HTTP entrants à l'aide du mécanisme approprié à la version HTTP afin d'empêcher la contrebande de requêtes HTTP. Dans HTTP/1.x, si un champ d'en-tête Transfer-Encoding est présent, l'en-tête Content-Length doit être ignoré conformément à la RFC 2616. Avec HTTP/2 ou HTTP/3, si un champ d'en-tête Content-Length est présent, le récepteur doit s'assurer qu'il est cohérent avec la longueur des trames DATA.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.2.2", - "Ordinal": 2, - "Description": "Vérifier que, lors de la génération de messages HTTP, le champ d'en-tête Content-Length n'entre pas en conflit avec la longueur du contenu déterminée par le cadrage du protocole HTTP, afin d'empêcher les attaques de type « request smuggling ».", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.2.3", - "Ordinal": 3, - "Description": "Vérifiez que l'application n'envoie ni n'accepte de messages HTTP/2 ou HTTP/3 avec des champs d'en-tête spécifiques à la connexion, tels que Transfer-Encoding, afin d'éviter les attaques par fractionnement de la réponse et par injection d'en-tête.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.2.4", - "Ordinal": 4, - "Description": "Vérifiez que l'application n'accepte que les requêtes HTTP/2 et HTTP/3 dont les champs et valeurs d'en-tête ne contiennent pas de séquences CR (\\r), LF (\\n) ou CRLF (\\r\\n), afin d'éviter les attaques par injection d'en-tête.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.2.5", - "Ordinal": 5, - "Description": "Vérifiez que, si l'application (backend ou frontend) construit et envoie des requêtes, elle utilise des mécanismes de validation, d'assainissement ou autres pour éviter de créer des URI (comme pour les appels API) ou des champs d'en-tête de requête HTTP (comme Authorization ou Cookie) qui sont trop longs pour être acceptés par le composant récepteur. Cela pourrait entraîner un déni de service, par exemple lors de l'envoi d'une requête trop longue (par exemple, un long champ d'en-tête de cookie), ce qui fait que le serveur répond toujours avec un statut d'erreur.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V4.3", - "Ordinal": 3, - "Name": "GraphQL", - "Items": [ - { - "Shortcode": "V4.3.1", - "Ordinal": 1, - "Description": "Vérifiez qu'une liste d'autorisation de requête, une limitation de profondeur, une limitation de quantité ou une analyse des coûts de requête est utilisée pour empêcher le déni de service (DoS) de GraphQL ou d'expression de la couche données en raison de requêtes imbriquées coûteuses.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.3.2", - "Ordinal": 2, - "Description": "Vérifiez que les requêtes d’introspection GraphQL sont désactivées dans l’environnement de production, sauf si l’API GraphQL est destinée à être utilisée par d’autres parties.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V4.4", - "Ordinal": 4, - "Name": "WebSocket", - "Items": [ - { - "Shortcode": "V4.4.1", - "Ordinal": 1, - "Description": "Vérifiez que WebSocket sur TLS (WSS) est utilisé pour toutes les connexions WebSocket.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.4.2", - "Ordinal": 2, - "Description": "Vérifiez que, lors de la négociation HTTP WebSocket initiale, le champ d’en-tête 'Origin' est vérifié par rapport à une liste d’origines autorisées pour l’application.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.4.3", - "Ordinal": 3, - "Description": "Vérifiez que, si la gestion de session standard de l'application ne peut pas être utilisée, des jetons dédiés sont utilisés à cet effet, qui sont conformes aux exigences de sécurité de gestion de session pertinentes.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.4.4", - "Ordinal": 4, - "Description": "Vérifiez que les jetons de gestion de session WebSocket dédiés sont initialement obtenus ou validés via la session HTTPS précédemment authentifiée lors de la transition d'une session HTTPS existante vers un canal WebSocket.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V5", - "Ordinal": 5, - "ShortName": "File", - "Name": "Gestion des fichiers", - "Items": [ - { - "Shortcode": "V5.1", - "Ordinal": 1, - "Name": "Documentation sur la gestion des fichiers", - "Items": [ - { - "Shortcode": "V5.1.1", - "Ordinal": 1, - "Description": "Vérifiez que la documentation définit les types de fichiers autorisés, les extensions de fichiers attendues et la taille maximale (y compris la taille décompressée) pour chaque fonctionnalité de Téléversement. De plus, assurez-vous que la documentation précise comment les fichiers sont sécurisés pour le téléchargement et le traitement des utilisateurs finaux, par exemple le comportement de l'application lorsqu'un fichier malveillant est détecté.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V5.2", - "Ordinal": 2, - "Name": "Téléversement de fichiers et contenu", - "Items": [ - { - "Shortcode": "V5.2.1", - "Ordinal": 1, - "Description": "Vérifiez que l'application n'acceptera que des fichiers d'une taille qu'elle peut traiter sans provoquer de perte de performances ou d'attaque par déni de service.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V5.2.2", - "Ordinal": 2, - "Description": "Vérifiez que lorsque l'application accepte un fichier, seul ou dans une archive telle qu'un fichier zip, elle vérifie si l'extension de fichier correspond à une extension attendue et que le contenu correspond au type représenté par l'extension. Cela inclut, sans s'y limiter, la vérification des « octets magiques » initiaux, la réécriture d'images et l'utilisation de bibliothèques spécialisées pour la validation du contenu des fichiers. Pour le niveau L1, cela peut se concentrer uniquement sur les fichiers utilisés pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau L2, cela doit s'appliquer à tous les fichiers acceptés.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V5.2.3", - "Ordinal": 3, - "Description": "Vérifiez que l'application vérifie les fichiers compressés (par exemple, zip, gz, docx, odt) par rapport à la taille maximale autorisée non compressée et au nombre maximal de fichiers avant de décompresser le fichier.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V5.2.4", - "Ordinal": 4, - "Description": "Vérifiez qu'un quota de taille de fichier et un nombre maximal de fichiers par utilisateur sont appliqués pour garantir qu'un seul utilisateur ne puisse pas remplir le stockage avec trop de fichiers ou des fichiers excessivement volumineux.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V5.2.5", - "Ordinal": 5, - "Description": "Vérifiez que l'application n'autorise pas le téléversement de fichiers compressés contenant des liens symboliques, sauf si cela est spécifiquement requis (auquel cas il sera nécessaire d'appliquer une liste d'autorisation des fichiers vers lesquels il est possible de créer des liens symboliques).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V5.2.6", - "Ordinal": 6, - "Description": "Vérifiez que l'application rejette les images téléversées avec une taille de pixel supérieure au maximum autorisé, afin d'éviter les attaques par inondation de pixels.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V5.3", - "Ordinal": 3, - "Name": "Stockage de fichiers", - "Items": [ - { - "Shortcode": "V5.3.1", - "Ordinal": 1, - "Description": "Vérifiez que les fichiers téléversés ou générés par une entrée non fiable et stockés dans un dossier public ne sont pas exécutés en tant que code de programme côté serveur lorsqu'ils sont accessibles directement avec une requête HTTP.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V5.3.2", - "Ordinal": 2, - "Description": "Vérifiez que lorsque l'application crée des chemins d'accès pour les opérations sur les fichiers, elle utilise des données générées en interne ou fiables plutôt que des noms de fichiers soumis par l'utilisateur. Si des noms de fichiers ou des métadonnées de fichiers soumis par l'utilisateur doivent être utilisés, une validation et un nettoyage stricts doivent être appliqués. Ceci permet de se protéger contre les attaques par traversée de chemin, l'inclusion de fichiers locaux ou distants (LFI, RFI) et la falsification de requêtes côté serveur (SSRF).", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V5.3.3", - "Ordinal": 3, - "Description": "Vérifiez que le traitement des fichiers côté serveur, comme la décompression des fichiers, ignore les informations de chemin fournies par l'utilisateur pour éviter les vulnérabilités telles que le \"zip slip\".", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V5.4", - "Ordinal": 4, - "Name": "Téléchargement de fichier", - "Items": [ - { - "Shortcode": "V5.4.1", - "Ordinal": 1, - "Description": "Vérifiez que l’application valide ou ignore les noms de fichiers soumis par l’utilisateur, y compris dans un paramètre JSON, JSONP ou URL et spécifie un nom de fichier dans le champ d’en-tête Content-Disposition de la réponse.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V5.4.2", - "Ordinal": 2, - "Description": "Vérifiez que les noms de fichiers servis (par exemple, dans les champs d'en-tête de réponse HTTP ou les pièces jointes aux e-mails) sont encodés ou nettoyés (par exemple, conformément à la RFC 6266) pour préserver la structure du document et empêcher les attaques par injection.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V5.4.3", - "Ordinal": 3, - "Description": "Vérifiez que les fichiers obtenus à partir de sources non fiables sont analysés par des scanners antivirus pour empêcher la diffusion de contenu malveillant connu.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V6", - "Ordinal": 6, - "ShortName": "Authentication", - "Name": "Authentification", - "Items": [ - { - "Shortcode": "V6.1", - "Ordinal": 1, - "Name": "Documentation d'authentification", - "Items": [ - { - "Shortcode": "V6.1.1", - "Ordinal": 1, - "Description": "Vérifiez que la documentation de l'application définit comment les contrôles, tels que la limitation de débit, l'anti-automatisation et la réponse adaptative, sont utilisés pour se défendre contre les attaques telles que le « credential stuffing » et la force brute des mots de passe. La documentation doit expliquer clairement comment ces contrôles sont configurés et empêcher le blocage malveillant des comptes.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.1.2", - "Ordinal": 2, - "Description": "Vérifiez qu'une liste de mots spécifiques au contexte est documentée afin d'empêcher leur utilisation dans les mots de passe. Cette liste peut inclure des permutations de noms d'organisations, de produits, d'identifiants de systèmes, de noms de codes de projets, de noms de services ou de rôles, etc.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.1.3", - "Ordinal": 3, - "Description": "Vérifiez que, si l'application inclut plusieurs voies d'authentification, celles-ci sont toutes documentées avec les contrôles de sécurité et la force d'authentification qui doivent être appliqués de manière cohérente.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V6.2", - "Ordinal": 2, - "Name": "Sécurité des mots de passe", - "Items": [ - { - "Shortcode": "V6.2.1", - "Ordinal": 1, - "Description": "Vérifiez que les mots de passe définis par l'utilisateur comportent au moins 8 caractères, bien qu'un minimum de 15 caractères soit fortement recommandé.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.2", - "Ordinal": 2, - "Description": "Vérifiez que les utilisateurs peuvent modifier leur mot de passe.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.3", - "Ordinal": 3, - "Description": "Vérifiez que la fonctionnalité de changement de mot de passe nécessite le mot de passe actuel et le nouveau mot de passe de l'utilisateur.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.4", - "Ordinal": 4, - "Description": "Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou du changement de mot de passe sont vérifiés par rapport à un ensemble disponible d'au moins 3 000 mots de passe principaux qui correspondent à la politique de mot de passe de l'application, par exemple la longueur minimale.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.5", - "Ordinal": 5, - "Description": "Vérifiez que les mots de passe peuvent être utilisés, quelle que soit leur composition, sans restriction quant au type de caractères autorisés. Aucun nombre minimal de majuscules ou de minuscules, de chiffres ou de caractères spéciaux ne doit être exigé.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.6", - "Ordinal": 6, - "Description": "Vérifiez que les champs de saisie du mot de passe utilisent type=password pour masquer la saisie. Les applications peuvent permettre à l'utilisateur d'afficher temporairement l'intégralité du mot de passe masqué ou le dernier caractère saisi.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.7", - "Ordinal": 7, - "Description": "Vérifiez que la fonctionnalité « coller », les assistants de mot de passe du navigateur et les gestionnaires de mots de passe externes sont autorisés.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.8", - "Ordinal": 8, - "Description": "Vérifiez que l'application vérifie le mot de passe de l'utilisateur exactement tel qu'il a été reçu de l'utilisateur, sans aucune modification telle qu'une troncature ou une transformation de casse.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.9", - "Ordinal": 9, - "Description": "Vérifiez que les mots de passe d’au moins 64 caractères sont autorisés.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.10", - "Ordinal": 10, - "Description": "Vérifiez que le mot de passe d'un utilisateur reste valide jusqu'à ce qu'il soit découvert comme compromis ou qu'il soit renouvelé. L'application ne doit pas exiger de renouvellement périodique des identifiants.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.11", - "Ordinal": 11, - "Description": "Vérifiez que la liste documentée de mots spécifiques au contexte est utilisée pour éviter la création de mots de passe faciles à deviner.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.12", - "Ordinal": 12, - "Description": "Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou des modifications de mot de passe sont vérifiés par rapport à un ensemble de mots de passe fuités.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V6.3", - "Ordinal": 3, - "Name": "Sécurité générale de l'authentification", - "Items": [ - { - "Shortcode": "V6.3.1", - "Ordinal": 1, - "Description": "Vérifiez que les contrôles visant à empêcher les attaques telles que le bourrage d'informations d'identification et la force brute des mots de passe sont mis en œuvre conformément à la documentation de sécurité de l'application.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.3.2", - "Ordinal": 2, - "Description": "Vérifiez que les comptes d’utilisateur par défaut (par exemple, « root », « admin » ou « sa ») ne sont pas présents dans l’application ou sont désactivés.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.3.3", - "Ordinal": 3, - "Description": "Vérifiez que l’application exige que les utilisateurs utilisent un mécanisme d’authentification multifacteur ou une combinaison de mécanismes d’authentification à facteur unique.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.3.4", - "Ordinal": 4, - "Description": "Vérifiez que, si l’application inclut plusieurs voies d’authentification, il n’existe aucune voie non documentée et que les contrôles de sécurité et la force d’authentification sont appliqués de manière cohérente.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.3.5", - "Ordinal": 5, - "Description": "Vérifiez que les utilisateurs sont informés des tentatives d'authentification suspectes (réussies ou non). Il peut s'agir de tentatives d'authentification provenant d'un emplacement ou d'un client inhabituel, d'une authentification partiellement réussie (un seul facteur parmi plusieurs), d'une tentative d'authentification après une longue période d'inactivité ou d'une authentification réussie après plusieurs tentatives infructueuses.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.3.6", - "Ordinal": 6, - "Description": "Vérifiez que le courrier électronique n’est pas utilisé comme mécanisme d’authentification à facteur unique ou à facteurs multiples.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.3.7", - "Ordinal": 7, - "Description": "Vérifiez que les utilisateurs sont avertis après les mises à jour des détails d'authentification, telles que les réinitialisations d'informations d'identification ou la modification du nom d'utilisateur ou de l'adresse e-mail.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.3.8", - "Ordinal": 8, - "Description": "Vérifiez que les utilisateurs valides ne peuvent pas être déduits d'échecs d'authentification, par exemple en se basant sur des messages d'erreur, des codes de réponse HTTP ou des temps de réponse différents. Les fonctionnalités d'inscription et de mot de passe oublié doivent également bénéficier de cette protection.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V6.4", - "Ordinal": 4, - "Name": "Cycle de vie et récupération du facteur d'authentification", - "Items": [ - { - "Shortcode": "V6.4.1", - "Ordinal": 1, - "Description": "Vérifiez que les mots de passe initiaux ou les codes d'activation générés par le système sont générés de manière aléatoire et sécurisée, qu'ils respectent la politique de mots de passe en vigueur et qu'ils expirent après une courte période ou après leur première utilisation. Ces secrets initiaux ne doivent pas devenir des mots de passe permanents.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.4.2", - "Ordinal": 2, - "Description": "Vérifiez que les indices de mot de passe ou l'authentification basée sur les connaissances (appelées « questions secrètes ») ne sont pas présents.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.4.3", - "Ordinal": 3, - "Description": "Vérifiez qu'un processus sécurisé de réinitialisation d'un mot de passe oublié est mis en œuvre, qui ne contourne aucun mécanisme d'authentification multifacteur activé.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.4.4", - "Ordinal": 4, - "Description": "Vérifiez que si un facteur d'authentification multifacteur est perdu, la preuve de vérification d'identité est effectuée au même niveau que lors de l'inscription.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.4.5", - "Ordinal": 5, - "Description": "Vérifiez que les instructions de renouvellement des mécanismes d'authentification qui expirent sont envoyées avec suffisamment de temps pour être exécutées avant l'expiration de l'ancien mécanisme d'authentification, en configurant des rappels automatiques si nécessaire.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.4.6", - "Ordinal": 6, - "Description": "Vérifiez que les administrateurs peuvent initier la réinitialisation du mot de passe de l'utilisateur, mais que cela ne leur permet pas de modifier ou de choisir son mot de passe. Cela évite qu'ils ne connaissent le mot de passe de l'utilisateur.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V6.5", - "Ordinal": 5, - "Name": "Exigences générales en matière d'authentification multifacteur", - "Items": [ - { - "Shortcode": "V6.5.1", - "Ordinal": 1, - "Description": "Vérifiez que les secrets de recherche, les demandes ou codes d'authentification out-of-band et les mots de passe à usage unique basés sur le temps (TOTP) ne peuvent être utilisés avec succès qu'une seule fois.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.5.2", - "Ordinal": 2, - "Description": "Vérifiez que, lors de leur stockage dans le backend de l'application, les secrets de recherche comportant moins de 112 bits d'entropie (19 caractères alphanumériques aléatoires ou 34 chiffres aléatoires) sont hachés avec un algorithme de hachage de stockage de mots de passe approuvé, intégrant un sel aléatoire de 32 bits. Une fonction de hachage standard peut être utilisée si le secret comporte 112 bits d'entropie ou plus.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.5.3", - "Ordinal": 3, - "Description": "Vérifiez que les secrets de recherche, le code d'authentification out-of-band et les mots de passe à usage unique basés sur le temps sont générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) pour éviter les valeurs prévisibles.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.5.4", - "Ordinal": 4, - "Description": "Vérifiez que les secrets de recherche et les codes d'authentification out-of-band ont un minimum de 20 bits d'entropie (généralement 4 caractères alphanumériques aléatoires ou 6 chiffres aléatoires suffisent).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.5.5", - "Ordinal": 5, - "Description": "Vérifiez que les requêtes, codes ou jetons d'authentification out-of-band, ainsi que les mots de passe à usage unique (TOTP), ont une durée de vie définie. Les requêtes out-of-band doivent avoir une durée de vie maximale de 10 minutes et les TOTP, de 30 secondes.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.5.6", - "Ordinal": 6, - "Description": "Vérifiez que tout facteur d’authentification (y compris les appareils physiques) peut être révoqué en cas de vol ou autre perte.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.5.7", - "Ordinal": 7, - "Description": "Vérifiez que les mécanismes d’authentification biométrique ne sont utilisés que comme facteurs secondaires, avec quelque chose que vous possédez ou quelque chose que vous savez.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.5.8", - "Ordinal": 8, - "Description": "Vérifiez que les mots de passe à usage unique basés sur le temps (TOTP) sont vérifiés en fonction d'une source temporelle provenant d'un service de confiance et non d'une heure non fiable ou fournie par le client.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V6.6", - "Ordinal": 6, - "Name": "Mécanismes d'authentification out-of-band", - "Items": [ - { - "Shortcode": "V6.6.1", - "Ordinal": 1, - "Description": "Vérifier que les mécanismes d'authentification utilisant le réseau téléphonique public commuté (RTPC) pour la transmission de mots de passe à usage unique (OTP) par téléphone ou SMS ne sont proposés que lorsque le numéro de téléphone a été préalablement validé. D'autres méthodes plus robustes (telles que les mots de passe à usage unique à durée déterminée) sont également proposées, et que le service informe les utilisateurs des risques de sécurité qu'elles présentent. Pour les applications de niveau 3, le téléphone et les SMS ne doivent pas être disponibles.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.6.2", - "Ordinal": 2, - "Description": "Vérifiez que les demandes d’authentification out-of-band, les codes ou les jetons sont liés à la demande d’authentification d’origine pour laquelle ils ont été générés et ne sont pas utilisables pour une demande précédente ou ultérieure.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.6.3", - "Ordinal": 3, - "Description": "Vérifiez qu'un mécanisme d'authentification out-of-band basé sur du code est protégé contre les attaques par force brute grâce au \"rate limiting\". Envisagez également d'utiliser un code avec au moins 64 bits d'entropie.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.6.4", - "Ordinal": 4, - "Description": "Vérifiez que, lorsque les notifications push sont utilisées pour l'authentification multifacteur, le \"rate limiting\" est appliqué afin d'empêcher les attaques de type « push bombing ». La concordance des numéros peut également atténuer ce risque.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V6.7", - "Ordinal": 7, - "Name": "Mécanisme d'authentification cryptographique", - "Items": [ - { - "Shortcode": "V6.7.1", - "Ordinal": 1, - "Description": "Vérifiez que les certificats utilisés pour vérifier les assertions d’authentification cryptographique sont stockés de manière à les protéger contre toute modification.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.7.2", - "Ordinal": 2, - "Description": "Vérifiez que le nonce de défi a une longueur d'au moins 64 bits et qu'il est statistiquement unique ou unique sur toute la durée de vie du périphérique cryptographique.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V6.8", - "Ordinal": 8, - "Name": "Authentification avec un fournisseur d'identité", - "Items": [ - { - "Shortcode": "V6.8.1", - "Ordinal": 1, - "Description": "Vérifiez que, si l'application prend en charge plusieurs fournisseurs d'identité (IdP), l'identité de l'utilisateur ne peut pas être usurpée via un autre fournisseur d'identité pris en charge (par exemple, en utilisant le même identifiant utilisateur). La mesure standard consisterait à ce que l'application enregistre et identifie l'utilisateur à l'aide d'une combinaison de l'ID du fournisseur d'identité (servant d'espace de noms) et de l'ID de l'utilisateur dans le fournisseur d'identité.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.8.2", - "Ordinal": 2, - "Description": "Vérifiez que la présence et l'intégrité des signatures numériques sur les assertions d'authentification (par exemple sur les assertions JWT ou SAML) sont toujours validées, en rejetant toutes les assertions non signées ou ayant des signatures non valides.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.8.3", - "Ordinal": 3, - "Description": "Vérifiez que les assertions SAML sont traitées de manière unique et utilisées une seule fois au cours de la période de validité pour éviter les attaques par rejeu.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.8.4", - "Ordinal": 4, - "Description": "Si une application utilise un fournisseur d'identité (IdP) distinct et attend une force, des méthodes ou une date d'authentification spécifiques pour des fonctions spécifiques, vérifiez que l'application les vérifie à l'aide des informations renvoyées par l'IdP. Par exemple, si OIDC est utilisé, cela peut être réalisé en validant les affirmations de jeton d'identification telles que « acr », « amr » et « auth_time » (le cas échéant). Si l'IdP ne fournit pas ces informations, l'application doit disposer d'une approche de secours documentée qui suppose que le mécanisme d'authentification de force minimale a été utilisé (par exemple, une authentification à facteur unique avec nom d'utilisateur et mot de passe).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V7", - "Ordinal": 7, - "ShortName": "Session", - "Name": "Gestion des sessions", - "Items": [ - { - "Shortcode": "V7.1", - "Ordinal": 1, - "Name": "Documentation sur la gestion des sessions", - "Items": [ - { - "Shortcode": "V7.1.1", - "Ordinal": 1, - "Description": "Vérifiez que le délai d'inactivité de la session de l'utilisateur et la durée de vie maximale absolue de la session sont documentés, sont appropriés en combinaison avec d'autres contrôles et que la documentation inclut une justification de tout écart par rapport aux exigences de réauthentification NIST SP 800-63B.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.1.2", - "Ordinal": 2, - "Description": "Vérifiez que la documentation définit le nombre de sessions simultanées (parallèles) autorisées pour un compte ainsi que les comportements et actions prévus à entreprendre lorsque le nombre maximal de sessions actives est atteint.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.1.3", - "Ordinal": 3, - "Description": "Vérifiez que tous les systèmes qui créent et gèrent des sessions utilisateur dans le cadre d'un écosystème de gestion des identités fédérées (tels que les systèmes SSO) sont documentés avec des contrôles pour coordonner la durée de vie des sessions, la résiliation et toute autre condition nécessitant une réauthentification.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V7.2", - "Ordinal": 2, - "Name": "Sécurité fondamentale de la gestion des sessions", - "Items": [ - { - "Shortcode": "V7.2.1", - "Ordinal": 1, - "Description": "Vérifiez que l’application effectue toutes les vérifications des jetons de session à l’aide d’un service backend de confiance.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.2.2", - "Ordinal": 2, - "Description": "Vérifiez que l'application utilise des jetons autonomes ou de référence générés dynamiquement pour la gestion des sessions, c'est-à-dire sans utiliser de secrets et de clés d'API statiques.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.2.3", - "Ordinal": 3, - "Description": "Vérifiez que si des jetons par référence sont utilisés pour représenter les sessions utilisateur, ils sont uniques et générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et possèdent au moins 128 bits d'entropie.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.2.4", - "Ordinal": 4, - "Description": "Vérifiez que l’application génère un nouveau jeton de session lors de l’authentification de l’utilisateur, y compris la réauthentification, et met fin au jeton de session actuel.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V7.3", - "Ordinal": 3, - "Name": "Délai d'expiration de la session", - "Items": [ - { - "Shortcode": "V7.3.1", - "Ordinal": 1, - "Description": "Vérifiez qu’il existe un délai d’inactivité tel que la réauthentification soit appliquée conformément à l’analyse des risques et aux décisions de sécurité documentées.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.3.2", - "Ordinal": 2, - "Description": "Vérifiez qu'il existe une durée de vie maximale absolue de la session de sorte que la réauthentification soit appliquée conformément à l'analyse des risques et aux décisions de sécurité documentées.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V7.4", - "Ordinal": 4, - "Name": "Fin de session", - "Items": [ - { - "Shortcode": "V7.4.1", - "Ordinal": 1, - "Description": "Vérifiez que lorsque la fin de session est déclenchée (par exemple, déconnexion ou expiration), l'application interdit toute utilisation ultérieure de la session. Pour les jetons par référence ou les sessions avec état, cela implique l'invalidation des données de session au niveau du backend de l'application. Les applications utilisant des jetons autonomes nécessiteront une solution, comme la gestion d'une liste des jetons terminés, l'interdiction des jetons produits avant une date et une heure spécifique à chaque utilisateur ou la rotation d'une clé de signature spécifique à chaque utilisateur.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.4.2", - "Ordinal": 2, - "Description": "Vérifiez que l'application met fin à toutes les sessions actives lorsqu'un compte utilisateur est désactivé ou supprimé (par exemple, lorsqu'un employé quitte l'entreprise).", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.4.3", - "Ordinal": 3, - "Description": "Vérifiez que l'application offre la possibilité de mettre fin à toutes les autres sessions actives après une modification ou une suppression réussie de tout facteur d'authentification (y compris la modification du mot de passe via une réinitialisation ou une récupération et, le cas échéant, une mise à jour des paramètres MFA).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.4.4", - "Ordinal": 4, - "Description": "Vérifiez que toutes les pages nécessitant une authentification disposent d’un accès facile et visible à la fonctionnalité de déconnexion.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.4.5", - "Ordinal": 5, - "Description": "Vérifiez que les administrateurs d’applications sont en mesure de mettre fin aux sessions actives pour un utilisateur individuel ou pour tous les utilisateurs.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V7.5", - "Ordinal": 5, - "Name": "Défenses contre les abus de session", - "Items": [ - { - "Shortcode": "V7.5.1", - "Ordinal": 1, - "Description": "Vérifiez que l'application nécessite une réauthentification complète avant d'autoriser les modifications des attributs de compte sensibles qui peuvent affecter l'authentification, tels que l'adresse e-mail, le numéro de téléphone, la configuration MFA ou d'autres informations utilisées dans la récupération de compte.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.5.2", - "Ordinal": 2, - "Description": "Vérifiez que les utilisateurs peuvent afficher et (après s'être authentifiés à nouveau avec au moins un facteur) terminer une ou toutes les sessions actuellement actives.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.5.3", - "Ordinal": 3, - "Description": "Vérifiez que l’application nécessite une authentification supplémentaire avec au moins un facteur ou une vérification secondaire avant d’effectuer des transactions ou des opérations hautement sensibles.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V7.6", - "Ordinal": 6, - "Name": "Réauthentification fédérée", - "Items": [ - { - "Shortcode": "V7.6.1", - "Ordinal": 1, - "Description": "Vérifiez que la durée de vie et la fin de la session entre les parties de confiance (RP) et les fournisseurs d'identité (IdP) se comportent comme documenté, en exigeant une réauthentification si nécessaire, par exemple lorsque le temps maximal entre les événements d'authentification IdP est atteint.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.6.2", - "Ordinal": 2, - "Description": "Vérifiez que la création d'une session nécessite soit le consentement de l'utilisateur, soit une action explicite, empêchant ainsi la création de nouvelles sessions d'application sans interaction de l'utilisateur.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V8", - "Ordinal": 8, - "ShortName": "Authorization", - "Name": "Autorisation", - "Items": [ - { - "Shortcode": "V8.1", - "Ordinal": 1, - "Name": "Documentation d'autorisation", - "Items": [ - { - "Shortcode": "V8.1.1", - "Ordinal": 1, - "Description": "Vérifiez que la documentation d’autorisation définit des règles de restriction de l’accès au niveau de la fonction et aux données en fonction des autorisations du consommateur et des attributs des ressources.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V8.1.2", - "Ordinal": 2, - "Description": "Vérifiez que la documentation d'autorisation définit les règles de restriction d'accès au niveau des champs (lecture et écriture) en fonction des autorisations des consommateurs et des attributs des ressources. Notez que ces règles peuvent dépendre d'autres valeurs d'attributs de l'objet de données concerné, telles que l'état ou le statut.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V8.1.3", - "Ordinal": 3, - "Description": "Vérifiez que la documentation de l'application définit les attributs environnementaux et contextuels (y compris, mais sans s'y limiter, l'heure de la journée, l'emplacement de l'utilisateur, l'adresse IP ou l'appareil) qui sont utilisés dans l'application pour prendre des décisions de sécurité, y compris celles relatives à l'authentification et à l'autorisation.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V8.1.4", - "Ordinal": 4, - "Description": "Vérifier que la documentation d'authentification et d'autorisation définit l'utilisation des facteurs environnementaux et contextuels dans la prise de décision, en plus des autorisations au niveau des fonctions, des données et des champs. Cela doit inclure les attributs évalués, les seuils de risque et les actions entreprises (par exemple, autorisation, contestation, refus, renforcement de l'authentification).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V8.2", - "Ordinal": 2, - "Name": "Conception d'autorisation générale", - "Items": [ - { - "Shortcode": "V8.2.1", - "Ordinal": 1, - "Description": "Vérifiez que l’application garantit que l’accès basé sur la fonction est limité aux consommateurs disposant d’autorisations explicites.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V8.2.2", - "Ordinal": 2, - "Description": "Vérifiez que l'application garantit que l'accès spécifique aux données est limité aux consommateurs disposant d'autorisations explicites sur des éléments de données spécifiques afin d'atténuer les références d'objet directes non sécurisées (IDOR) et les autorisations de niveau d'objet rompues (BOLA).", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V8.2.3", - "Ordinal": 3, - "Description": "Vérifiez que l'application garantit que l'accès au niveau du champ est limité aux consommateurs disposant d'autorisations explicites sur des champs spécifiques afin d'atténuer les problèmes d'autorisation au niveau de la propriété d'objet (BOPLA).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V8.2.4", - "Ordinal": 4, - "Description": "Vérifiez que les contrôles de sécurité adaptatifs basés sur les attributs environnementaux et contextuels du consommateur (tels que l'heure, la localisation, l'adresse IP ou l'appareil) sont mis en œuvre pour les décisions d'authentification et d'autorisation, comme défini dans la documentation de l'application. Ces contrôles doivent être appliqués lorsque le consommateur tente de démarrer une nouvelle session et également pendant une session existante.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V8.3", - "Ordinal": 3, - "Name": "Autorisation par opération", - "Items": [ - { - "Shortcode": "V8.3.1", - "Ordinal": 1, - "Description": "Vérifier que l'application applique les règles d'autorisations au niveau de la couche service de confiance et ne s’appuie pas sur des contrôles qu’un consommateur non approuvé pourrait manipuler, comme JavaScript côté client.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V8.3.2", - "Ordinal": 2, - "Description": "Vérifiez que les modifications apportées aux valeurs sur lesquelles reposent les décisions d'autorisation sont appliquées immédiatement. Lorsque les modifications ne peuvent pas être appliquées immédiatement (par exemple, en s'appuyant sur des données de jetons autonomes), des contrôles d'atténuation doivent être mis en place pour alerter un consommateur lorsqu'il effectue une action alors qu'il n'est plus autorisé à le faire et annuler la modification. Notez que cette solution alternative ne limiterait pas les fuites d'informations.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V8.3.3", - "Ordinal": 3, - "Description": "Vérifiez que l'accès à un objet repose sur les autorisations du sujet d'origine (par exemple, le consommateur), et non sur celles d'un intermédiaire ou d'un service agissant en son nom. Par exemple, si un consommateur appelle un service web à l'aide d'un jeton d'authentification autonome, et que ce service demande ensuite des données à un autre service, ce dernier utilisera le jeton du consommateur, plutôt qu'un jeton inter-machine du premier service, pour prendre les décisions d'autorisation.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V8.4", - "Ordinal": 4, - "Name": "Autres considérations relatives à l'autorisation", - "Items": [ - { - "Shortcode": "V8.4.1", - "Ordinal": 1, - "Description": "Vérifiez que les applications multi-tenants utilisent des contrôles inter-tenants pour garantir que les opérations des consommateurs n'affecteront jamais les tenants avec lesquels ils ne sont pas autorisés à interagir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V8.4.2", - "Ordinal": 2, - "Description": "Vérifiez que l'accès aux interfaces administratives intègre plusieurs couches de sécurité, notamment la vérification continue de l'identité du consommateur, l'évaluation de la posture de sécurité des appareils et l'analyse contextuelle des risques, garantissant que l'emplacement du réseau ou les endpoints approuvés ne sont pas les seuls facteurs d'autorisation, même s'ils peuvent réduire la probabilité d'accès non autorisé.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V9", - "Ordinal": 9, - "ShortName": "Self", - "Name": "Jetons autonomes", - "Items": [ - { - "Shortcode": "V9.1", - "Ordinal": 1, - "Name": "Source et intégrité du jeton", - "Items": [ - { - "Shortcode": "V9.1.1", - "Ordinal": 1, - "Description": "Vérifiez que les jetons autonomes sont validés à l'aide de leur signature numérique ou MAC pour les protéger contre toute falsification avant d'accepter le contenu du jeton.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V9.1.2", - "Ordinal": 2, - "Description": "Vérifiez que seuls les algorithmes d'une liste d’autorisations peuvent être utilisés pour créer et vérifier des jetons autonomes, dans un contexte donné. La liste d'autorisation doit inclure les algorithmes autorisés, idéalement symétriques ou asymétriques, et ne doit pas inclure l'algorithme « Aucun ». Si les algorithmes symétriques et asymétriques doivent être pris en charge, des contrôles supplémentaires seront nécessaires pour éviter toute confusion de clés.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V9.1.3", - "Ordinal": 3, - "Description": "Vérifiez que les clés utilisées pour valider les jetons autonomes proviennent de sources préconfigurées et fiables pour l'émetteur du jeton, empêchant ainsi les attaquants de spécifier des sources et des clés non fiables. Pour les JWT et autres structures JWS, les en-têtes tels que « jku », « x5u » et « jwk » doivent être validés par rapport à une liste d'autorisation de sources fiables.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V9.2", - "Ordinal": 2, - "Name": "Contenu du jeton", - "Items": [ - { - "Shortcode": "V9.2.1", - "Ordinal": 1, - "Description": "Vérifiez que, si une période de validité est indiquée dans les données du jeton, celui-ci et son contenu ne sont acceptés que si la date de vérification est comprise dans cette période. Par exemple, pour les JWT, les déclarations « nbf » et « exp » doivent être vérifiées.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V9.2.2", - "Ordinal": 2, - "Description": "Vérifiez que le service recevant un jeton valide le type de jeton et son utilisation avant d'en accepter le contenu. Par exemple, seuls les jetons d'accès peuvent être acceptés pour les décisions d'autorisation, et seuls les jetons d'identification peuvent être utilisés pour prouver l'authentification des utilisateurs.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V9.2.3", - "Ordinal": 3, - "Description": "Vérifiez que le service accepte uniquement les jetons destinés à être utilisés avec ce service (audience). Pour les JWT, cela peut être réalisé en validant la déclaration « aud » par rapport à une liste d'autorisation définie dans le service.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V9.2.4", - "Ordinal": 4, - "Description": "Si un émetteur de jetons utilise la même clé privée pour émettre des jetons destinés à différentes audiences, vérifiez que les jetons émis contiennent une restriction d'audience identifiant de manière unique les audiences visées. Cela empêchera la réutilisation d'un jeton avec une audience non prévue. Si l'identifiant d'audience est provisionné dynamiquement, l'émetteur de jetons doit valider ces audiences afin de garantir qu'elles n'entraînent pas d'usurpation d'identité.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V10", - "Ordinal": 10, - "ShortName": "OAuth", - "Name": "Oauth et OIDC", - "Items": [ - { - "Shortcode": "V10.1", - "Ordinal": 1, - "Name": "Sécurité générique OAuth et OIDC", - "Items": [ - { - "Shortcode": "V10.1.1", - "Ordinal": 1, - "Description": "Vérifiez que les jetons sont envoyés uniquement aux composants qui en ont absolument besoin. Par exemple, lors de l'utilisation d'un modèle backend-for-frontend pour les applications JavaScript basées sur un navigateur, les jetons d'accès et d'actualisation ne doivent être accessibles qu'au backend.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.1.2", - "Ordinal": 2, - "Description": "Vérifiez que le client n'accepte les valeurs du serveur d'autorisation (telles que le code d'autorisation ou le jeton d'identification) que si elles résultent d'un flux d'autorisation initié par la même session d'agent utilisateur et la même transaction. Cela nécessite que les secrets générés par le client, tels que la clé de preuve pour l'échange de codes (PKCE) « code_verifier », « state » ou le nonce OIDC, ne puissent être devinés, soient spécifiques à la transaction et soient liés de manière sécurisée au client et à la session d'agent utilisateur au cours de laquelle la transaction a été initiée.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V10.2", - "Ordinal": 2, - "Name": "Client OAuth", - "Items": [ - { - "Shortcode": "V10.2.1", - "Ordinal": 1, - "Description": "Vérifiez que, si le flux de code est utilisé, le client OAuth dispose d'une protection contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF), qui déclenchent des demandes de jetons, soit en utilisant la fonctionnalité de clé de preuve pour l'échange de code (PKCE), soit en vérifiant le paramètre « state » envoyé dans la demande d'autorisation.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.2.2", - "Ordinal": 2, - "Description": "Vérifiez que, si le client OAuth peut interagir avec plusieurs serveurs d'autorisation, il dispose d'une protection contre les attaques par confusion. Par exemple, il peut exiger que le serveur d'autorisation renvoie la valeur du paramètre « iss » et la valide dans la réponse d'autorisation et la réponse du jeton.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.2.3", - "Ordinal": 3, - "Description": "Vérifiez que le client OAuth demande uniquement les portées requises (ou d’autres paramètres d’autorisation) dans les requêtes adressées au serveur d’autorisation.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V10.3", - "Ordinal": 3, - "Name": "Serveur de ressources OAuth", - "Items": [ - { - "Shortcode": "V10.3.1", - "Ordinal": 1, - "Description": "Vérifiez que le serveur de ressources accepte uniquement les jetons d'accès destinés à être utilisés avec ce service (audience). L'audience peut être incluse dans un jeton d'accès structuré (comme la déclaration « aud » dans JWT) ou vérifiée à l'aide du endpoint d'introspection de jeton.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.3.2", - "Ordinal": 2, - "Description": "Vérifiez que le serveur de ressources applique les décisions d'autorisation en fonction des déclarations du jeton d'accès définissant l'autorisation déléguée. Si des déclarations telles que « sub », « scope » et « authorization_details » sont présentes, elles doivent être prises en compte dans la décision.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.3.3", - "Ordinal": 3, - "Description": "Vérifiez que si une décision de contrôle d'accès nécessite l'identification d'un utilisateur unique à partir d'un jeton d'accès (JWT ou réponse d'introspection de jeton associé), le serveur de ressources identifie l'utilisateur à partir de déclarations non ré attribuables à d'autres utilisateurs. En général, cela implique l'utilisation d'une combinaison de déclarations « iss » et « sub ».", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.3.4", - "Ordinal": 4, - "Description": "Si le serveur de ressources requiert une force d'authentification, des méthodes ou une date d'expiration spécifiques, vérifiez que le jeton d'accès présenté respecte ces contraintes. Par exemple, s'il est présent, utilisez les déclarations OIDC « acr », « amr » et « auth_time » respectivement.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.3.5", - "Ordinal": 5, - "Description": "Vérifiez que le serveur de ressources empêche l'utilisation de jetons d'accès volés ou la relecture de jetons d'accès (de parties non autorisées) en exigeant des jetons d'accès limités par l'expéditeur, soit Mutual TLS pour OAuth 2, soit OAuth 2 Demonstration of Proof of Possession (DPoP).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V10.4", - "Ordinal": 4, - "Name": "Serveur d'autorisation OAuth", - "Items": [ - { - "Shortcode": "V10.4.1", - "Ordinal": 1, - "Description": "Vérifiez que le serveur d'autorisation valide les URI de redirection en fonction d'une liste d'autorisation spécifique au client d'URI préenregistrés à l'aide d'une comparaison de chaînes exacte.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.2", - "Ordinal": 2, - "Description": "Vérifiez que, si le serveur d'autorisation renvoie le code d'autorisation dans la réponse, celui-ci ne peut être utilisé qu'une seule fois pour une demande de jeton. Pour la deuxième demande valide avec un code d'autorisation déjà utilisé pour émettre un jeton d'accès, le serveur d'autorisation doit rejeter la demande de jeton et révoquer tous les jetons émis liés au code d'autorisation.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.3", - "Ordinal": 3, - "Description": "Vérifiez que le code d'autorisation est de courte durée. La durée de vie maximale peut atteindre 10 minutes pour les applications L1 et L2 et 1 minute pour les applications L3.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.4", - "Ordinal": 4, - "Description": "Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement l'utilisation des autorisations nécessaires à ce client. Notez que les autorisations « token » (flux implicite) et « password » (flux d'informations d'identification du propriétaire de la ressource) ne doivent plus être utilisées.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.5", - "Ordinal": 5, - "Description": "Vérifiez que le serveur d'autorisation atténue les attaques par rejeu de jetons d'actualisation pour les clients publics, de préférence en utilisant des jetons d'actualisation limités par l'expéditeur, par exemple des jetons DPoP (Demonstrating Proof of Possession) ou des jetons d'accès liés à un certificat utilisant le protocole TLS mutuel (mTLS). Pour les applications L1 et L2, la rotation des jetons d'actualisation peut être utilisée. Si cette rotation est utilisée, le serveur d'autorisation doit invalider le jeton d'actualisation après utilisation et révoquer tous les jetons d'actualisation de cette autorisation si un jeton d'actualisation déjà utilisé et invalidé est fourni.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.6", - "Ordinal": 6, - "Description": "Vérifiez que, si l'octroi de code est utilisé, le serveur d'autorisation atténue les attaques par interception de code en exigeant une clé de preuve pour l'échange de code (PKCE). Pour les demandes d'autorisation, le serveur d'autorisation doit exiger une valeur « code_challenge » valide et ne doit pas accepter une valeur « plain » pour « code_challenge_method ». Pour une demande de jeton, il doit exiger la validation du paramètre « code_verifier ».", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.7", - "Ordinal": 7, - "Description": "Vérifiez que si le serveur d'autorisation prend en charge l'enregistrement dynamique des clients non authentifiés, il réduit le risque d'applications clientes malveillantes. Il doit valider les métadonnées clientes, telles que les URI enregistrés, garantir le consentement de l'utilisateur et l'avertir avant de traiter une demande d'autorisation avec une application cliente non approuvée.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.8", - "Ordinal": 8, - "Description": "Vérifiez que les jetons d’actualisation ont une expiration absolue, y compris si l’expiration du jeton d’actualisation glissant est appliquée.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.9", - "Ordinal": 9, - "Description": "Vérifiez que les jetons d'actualisation et les jetons d'accès de référence peuvent être révoqués par un utilisateur autorisé à l'aide de l'interface utilisateur du serveur d'autorisation, afin d'atténuer le risque de clients malveillants ou de jetons volés.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.10", - "Ordinal": 10, - "Description": "Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.11", - "Ordinal": 11, - "Description": "Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.12", - "Ordinal": 12, - "Description": "Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement la valeur « response_mode » dont ce client a besoin. Par exemple, en vérifiant cette valeur par rapport aux valeurs attendues ou en utilisant une requête d'autorisation poussée (PAR) ou une requête d'autorisation sécurisée par JWT (JAR).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.13", - "Ordinal": 13, - "Description": "Vérifiez que le type d'Autorisation « code » est toujours utilisé avec les demandes d'autorisation poussées (PAR).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.14", - "Ordinal": 14, - "Description": "Vérifiez que le serveur d'autorisation émet uniquement des jetons d'accès limités à l'expéditeur (preuve de possession), soit avec des jetons d'accès liés au certificat utilisant TLS mutuel (mTLS), soit avec des jetons d'accès liés au DPoP (démonstration de preuve de possession).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.15", - "Ordinal": 15, - "Description": "Vérifiez que, pour un client côté serveur (non exécuté sur l'appareil de l'utilisateur final), le serveur d'autorisation garantit que la valeur du paramètre « authorization_details » provient du backend client et que l'utilisateur ne l'a pas altérée. Par exemple, en exigeant l'utilisation d'une demande d'autorisation poussée (PAR) ou d'une demande d'autorisation sécurisée par JWT (JAR).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.16", - "Ordinal": 16, - "Description": "Vérifiez que le client est confidentiel et que le serveur d'autorisation requiert l'utilisation de méthodes d'authentification client fortes (basées sur la cryptographie à clé publique et résistantes aux attaques par relecture), telles que TLS mutuel ('tls_client_auth', 'self_signed_tls_client_auth') ou JWT à clé privée ('private_key_jwt').", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V10.5", - "Ordinal": 5, - "Name": "Client OIDC", - "Items": [ - { - "Shortcode": "V10.5.1", - "Ordinal": 1, - "Description": "Vérifiez que le client (en tant que partie utilisatrice) atténue les attaques par rejeu de jeton d'identification. Par exemple, en vous assurant que la valeur « nonce » du jeton d'identification correspond à la valeur « nonce » envoyée dans la demande d'authentification au fournisseur OpenID (appelée demande d'autorisation envoyée au serveur d'autorisation dans OAuth2).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.5.2", - "Ordinal": 2, - "Description": "Vérifiez que le client identifie de manière unique l'utilisateur à partir des déclarations de jeton d'identification, généralement la déclaration « sub », qui ne peut pas être réaffectée à d'autres utilisateurs (pour la portée d'un fournisseur d'identité).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.5.3", - "Ordinal": 3, - "Description": "Vérifiez que le client rejette les tentatives d'un serveur d'autorisation malveillant d'usurper l'identité d'un autre serveur d'autorisation via ses métadonnées. Le client doit rejeter les métadonnées du serveur d'autorisation si l'URL de l'émetteur figurant dans ces métadonnées ne correspond pas exactement à l'URL d'émetteur préconfigurée attendue par le client.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.5.4", - "Ordinal": 4, - "Description": "Vérifiez que le client valide que le jeton d'identification est destiné à être utilisé pour ce client (audience) en vérifiant que la déclaration « aud » du jeton est égale à la valeur « client_id » pour le client.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.5.5", - "Ordinal": 5, - "Description": "Vérifiez que, lors de l'utilisation de la déconnexion du back-channel OIDC, la partie utilisatrice atténue les risques de déni de service liés à la déconnexion forcée et à la confusion entre JWT dans le flux de déconnexion. Le client doit vérifier que le jeton de déconnexion est correctement typé avec la valeur « logout+jwt », qu'il contient la déclaration « event » avec le nom de membre correct et qu'il ne contient pas de déclaration « nonce ». Il est également recommandé d'utiliser une expiration courte (par exemple, 2 minutes).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V10.6", - "Ordinal": 6, - "Name": "Fournisseur OpenID", - "Items": [ - { - "Shortcode": "V10.6.1", - "Ordinal": 1, - "Description": "Vérifiez que le fournisseur OpenID n'autorise que les valeurs « code », « ciba », « id_token » ou « id_token code » pour le mode de réponse. Notez que « code » est préférable à « id_token code » (flux hybride OIDC) et que « token » (tout flux implicite) ne doit pas être utilisé.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.6.2", - "Ordinal": 2, - "Description": "Vérifiez que le fournisseur OpenID atténue les risques de déni de service liés à la déconnexion forcée. Pour ce faire, obtenez une confirmation explicite de l'utilisateur final ou, le cas échéant, validez les paramètres de la requête de déconnexion (initiée par la partie utilisatrice), comme « id_token_hint ».", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V10.7", - "Ordinal": 7, - "Name": "Gestion du consentement", - "Items": [ - { - "Shortcode": "V10.7.1", - "Ordinal": 1, - "Description": "Vérifiez que le serveur d'autorisation garantit le consentement de l'utilisateur à chaque demande d'autorisation. Si l'identité du client ne peut être garantie, le serveur d'autorisation doit toujours demander explicitement le consentement de l'utilisateur.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.7.2", - "Ordinal": 2, - "Description": "Vérifiez que lorsque le serveur d'autorisation demande le consentement de l'utilisateur, il fournit des informations claires et suffisantes sur ce qui est consenti. Le cas échéant, ces informations doivent inclure la nature des autorisations demandées (généralement en fonction de la portée, du serveur de ressources et des détails d'autorisation RAR), l'identité de l'application autorisée et la durée de vie de ces autorisations.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.7.3", - "Ordinal": 3, - "Description": "Vérifiez que l’utilisateur peut consulter, modifier et révoquer les consentements qu’il a accordés via le serveur d’autorisation.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V11", - "Ordinal": 11, - "ShortName": "Cryptography", - "Name": "Cryptographie", - "Items": [ - { - "Shortcode": "V11.1", - "Ordinal": 1, - "Name": "Inventaire et documentation cryptographiques", - "Items": [ - { - "Shortcode": "V11.1.1", - "Ordinal": 1, - "Description": "Vérifiez qu’il existe une politique documentée pour la gestion des clés cryptographiques et un cycle de vie des clés cryptographiques qui suit une norme de gestion des clés telle que NIST SP 800-57. Cela devrait inclure la garantie que les clés ne sont pas sur-partagées (par exemple, avec plus de deux entités pour les secrets partagés et plus d’une entité pour les clés privées).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.1.2", - "Ordinal": 2, - "Description": "Vérifiez qu'un inventaire cryptographique est réalisé, maintenu et régulièrement mis à jour, et qu'il inclut toutes les clés, algorithmes et certificats cryptographiques utilisés par l'application. Il doit également documenter les emplacements du système où les clés peuvent ou non être utilisées, ainsi que les types de données qui peuvent ou non être protégées par ces clés.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.1.3", - "Ordinal": 3, - "Description": "Vérifiez que les mécanismes de découverte cryptographique sont utilisés pour identifier toutes les instances de cryptographie dans le système, y compris les opérations de chiffrement, de hachage et de signature.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.1.4", - "Ordinal": 4, - "Description": "Vérifier la tenue d'un inventaire cryptographique. Celui-ci doit inclure un plan documenté décrivant la migration vers de nouvelles normes cryptographiques, telles que la cryptographie post-quantique, afin de réagir aux menaces futures.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V11.2", - "Ordinal": 2, - "Name": "Mise en œuvre sécurisée de la cryptographie", - "Items": [ - { - "Shortcode": "V11.2.1", - "Ordinal": 1, - "Description": "Vérifiez que les implémentations validées par l’industrie (y compris les bibliothèques et les implémentations accélérées par le matériel) sont utilisées pour les opérations cryptographiques.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.2.2", - "Ordinal": 2, - "Description": "Vérifiez que l'application est conçue avec une agilité cryptographique, de sorte que les nombres aléatoires, le chiffrement authentifié, le MAC ou les algorithmes de hachage, les longueurs de clés, les tours, les chiffrements et les modes puissent être reconfigurés, mis à niveau ou échangés à tout moment, afin de se protéger contre les failles cryptographiques. De même, il doit être possible de remplacer les clés et les mots de passe, ainsi que de rechiffrer les données. Cela permettra des mises à niveau transparentes vers la cryptographie post-quantique (PQC), une fois que des implémentations hautement sécurisées de schémas ou de normes PQC approuvés seront largement disponibles.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.2.3", - "Ordinal": 3, - "Description": "Vérifiez que toutes les primitives cryptographiques utilisent un minimum de 128 bits de sécurité en fonction de l'algorithme, de la taille de la clé et de la configuration. Par exemple, une clé ECC de 256 bits offre environ 128 bits de sécurité, tandis que RSA nécessite une clé de 3072 bits pour atteindre 128 bits de sécurité.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.2.4", - "Ordinal": 4, - "Description": "Vérifiez que toutes les opérations cryptographiques sont à temps constant, sans opérations de « court-circuit » dans les comparaisons, les calculs ou les retours, pour éviter toute fuite d'informations.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.2.5", - "Ordinal": 5, - "Description": "Vérifiez que tous les modules cryptographiques échouent en toute sécurité et que les erreurs sont gérées de manière à ne pas permettre de vulnérabilités, telles que les attaques Padding Oracle.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V11.3", - "Ordinal": 3, - "Name": "Algorithmes de chiffrement", - "Items": [ - { - "Shortcode": "V11.3.1", - "Ordinal": 1, - "Description": "Vérifiez que les modes de bloc non sécurisés (par exemple, ECB) et les schémas de remplissage faibles (par exemple, PKCS#1 v1.5) ne sont pas utilisés.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.3.2", - "Ordinal": 2, - "Description": "Vérifiez que seuls les chiffrements et modes approuvés tels que AES avec GCM sont utilisés.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.3.3", - "Ordinal": 3, - "Description": "Vérifiez que les données chiffrées sont protégées contre toute modification non autorisée, de préférence en utilisant une méthode de chiffrement authentifiée approuvée ou en combinant une méthode de chiffrement approuvée avec un algorithme MAC approuvé.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.3.4", - "Ordinal": 4, - "Description": "Vérifiez que les nonces, les vecteurs d'initialisation et autres nombres à usage unique ne sont pas utilisés pour plus d'une paire clé de chiffrement/élément de données. La méthode de génération doit être adaptée à l'algorithme utilisé.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.3.5", - "Ordinal": 5, - "Description": "Vérifiez que toute combinaison d'un algorithme de chiffrement et d'un algorithme MAC fonctionne en mode chiffrement puis MAC.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V11.4", - "Ordinal": 4, - "Name": "Hachage et fonctions basées sur le hachage", - "Items": [ - { - "Shortcode": "V11.4.1", - "Ordinal": 1, - "Description": "Vérifiez que seules les fonctions de hachage approuvées sont utilisées pour les cas d'utilisation cryptographiques généraux, notamment les signatures numériques, HMAC, KDF et la génération de bits aléatoires. Les fonctions de hachage non autorisées, telles que MD5, ne doivent pas être utilisées à des fins cryptographiques.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.4.2", - "Ordinal": 2, - "Description": "Vérifiez que les mots de passe sont stockés à l'aide d'une fonction de dérivation de clés approuvée et gourmande en ressources de calcul (également appelée « fonction de hachage de mots de passe »), dont les paramètres sont configurés conformément aux directives en vigueur. Ces paramètres doivent équilibrer sécurité et performances afin de rendre les attaques par force brute suffisamment difficiles pour le niveau de sécurité requis.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.4.3", - "Ordinal": 3, - "Description": "Vérifiez que les fonctions de hachage utilisées dans les signatures numériques, dans le cadre de l'authentification ou de l'intégrité des données, sont résistantes aux collisions et possèdent des longueurs de bits appropriées. Si la résistance aux collisions est requise, la longueur de sortie doit être d'au moins 256 bits. Si seule la résistance aux attaques de seconde pré-image est requise, la longueur de sortie doit être d'au moins 128 bits.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.4.4", - "Ordinal": 4, - "Description": "Vérifiez que l'application utilise des fonctions de dérivation de clés approuvées avec des paramètres d'extension de clés lors de la dérivation de clés secrètes à partir de mots de passe. Les paramètres utilisés doivent concilier sécurité et performances afin d'empêcher les attaques par force brute de compromettre la clé cryptographique obtenue.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V11.5", - "Ordinal": 5, - "Name": "Valeurs aléatoires", - "Items": [ - { - "Shortcode": "V11.5.1", - "Ordinal": 1, - "Description": "Vérifiez que tous les nombres et chaînes aléatoires destinés à être non devinables doivent être générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et posséder au moins 128 bits d'entropie. Notez que les UUID ne respectent pas cette condition.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.5.2", - "Ordinal": 2, - "Description": "Vérifiez que le mécanisme de génération de nombres aléatoires utilisé est conçu pour fonctionner en toute sécurité, même en cas de forte demande.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V11.6", - "Ordinal": 6, - "Name": "Cryptographie à clé publique", - "Items": [ - { - "Shortcode": "V11.6.1", - "Ordinal": 1, - "Description": "Vérifier que seuls des algorithmes cryptographiques et des modes opératoires approuvés sont utilisés pour la génération et l'amorçage des clés, ainsi que pour la génération et la vérification des signatures numériques. Les algorithmes de génération de clés ne doivent pas générer de clés non sécurisées et vulnérables aux attaques connues, par exemple les clés RSA vulnérables à la factorisation de Fermat.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.6.2", - "Ordinal": 2, - "Description": "Vérifiez que des algorithmes cryptographiques approuvés sont utilisés pour l'échange de clés (tels que Diffie-Hellman), en veillant à ce que les mécanismes d'échange de clés utilisent des paramètres sécurisés. Cela permettra d'éviter les attaques contre le processus d'établissement des clés, susceptibles de conduire à des attaques de type « adversaire du milieu » ou à des failles cryptographiques.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V11.7", - "Ordinal": 7, - "Name": "Cryptographie des données en cours d'utilisation", - "Items": [ - { - "Shortcode": "V11.7.1", - "Ordinal": 1, - "Description": "Vérifiez que le chiffrement complet de la mémoire est utilisé pour protéger les données sensibles pendant leur utilisation, empêchant ainsi l'accès par des utilisateurs ou des processus non autorisés.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.7.2", - "Ordinal": 2, - "Description": "Vérifiez que la minimisation des données garantit que la quantité minimale de données est exposée pendant le traitement et assurez-vous que les données sont chiffrées immédiatement après utilisation ou dès que possible.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V12", - "Ordinal": 12, - "ShortName": "Secure", - "Name": "Communication sécurisée", - "Items": [ - { - "Shortcode": "V12.1", - "Ordinal": 1, - "Name": "Conseils généraux de sécurité TLS", - "Items": [ - { - "Shortcode": "V12.1.1", - "Ordinal": 1, - "Description": "Vérifiez que seules les dernières versions recommandées du protocole TLS sont activées, telles que TLS 1.2 et TLS 1.3. La dernière version du protocole TLS doit être privilégiée.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V12.1.2", - "Ordinal": 2, - "Description": "Vérifiez que seules les suites de chiffrement recommandées sont activées, les suites de chiffrement les plus puissantes étant définies comme préférées. Les applications L3 doivent uniquement prendre en charge les suites de chiffrement assurant la confidentialité persistante (forward secrecy).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V12.1.3", - "Ordinal": 3, - "Description": "Vérifiez que l’application valide que les certificats clients mTLS sont approuvés avant d’utiliser l’identité du certificat pour l’authentification ou l’autorisation.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V12.1.4", - "Ordinal": 4, - "Description": "Vérifiez que la révocation de certification appropriée, telle que l'agrafage du protocole OCSP (Online Certificate Status Protocol), est activée et configurée.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V12.1.5", - "Ordinal": 5, - "Description": "Vérifiez que Encrypted Client Hello (ECH) est activé dans les paramètres TLS de l'application pour empêcher l'exposition de métadonnées sensibles, telles que l'indication du nom du serveur (SNI), pendant les processus de négociation TLS.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V12.2", - "Ordinal": 2, - "Name": "Communication HTTPS avec des services externes", - "Items": [ - { - "Shortcode": "V12.2.1", - "Ordinal": 1, - "Description": "Vérifiez que TLS est utilisé pour toute connectivité entre un client et des services externes basés sur HTTP, et ne recourt pas à des communications non sécurisées ou non chiffrées.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V12.2.2", - "Ordinal": 2, - "Description": "Vérifiez que les services externes utilisent des certificats TLS publiquement approuvés.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V12.3", - "Ordinal": 3, - "Name": "Sécurité des communications entre services généraux", - "Items": [ - { - "Shortcode": "V12.3.1", - "Ordinal": 1, - "Description": "Vérifiez qu'un protocole chiffré tel que TLS est utilisé pour toutes les connexions entrantes et sortantes vers et depuis l'application, y compris les systèmes de surveillance, les outils de gestion, l'accès à distance et SSH, les intergiciels, les bases de données, les mainframes, les systèmes partenaires ou les API externes. Le serveur ne doit pas recourir à des protocoles non sécurisés ou non chiffrés.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V12.3.2", - "Ordinal": 2, - "Description": "Vérifiez que les clients TLS valident les certificats reçus avant de communiquer avec un serveur TLS.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V12.3.3", - "Ordinal": 3, - "Description": "Vérifiez que TLS ou un autre mécanisme de chiffrement de transport approprié est utilisé pour toute connectivité entre les services internes basés sur HTTP au sein de l'application et ne se replie pas vers des communications non sécurisées ou non chiffrées.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V12.3.4", - "Ordinal": 4, - "Description": "Vérifiez que les connexions TLS entre les services internes utilisent des certificats de confiance. Lorsque des certificats générés en interne ou auto-signés sont utilisés, le service consommateur doit être configuré pour n'approuver que des autorités de certification internes spécifiques et des certificats auto-signés spécifiques.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V12.3.5", - "Ordinal": 5, - "Description": "Vérifiez que les services communiquant en interne au sein d'un système (communications intra-services) utilisent une authentification forte pour garantir la vérification de chaque endpoint. Des méthodes d'authentification forte, telles que l'authentification client TLS, doivent être utilisées pour garantir l'identité, en utilisant une infrastructure à clé publique et des mécanismes résistants aux attaques par rejeu. Pour les architectures de microservices, envisagez d'utiliser un maillage de services pour simplifier la gestion des certificats et renforcer la sécurité.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V13", - "Ordinal": 13, - "ShortName": "Configuration", - "Name": "Configuration", - "Items": [ - { - "Shortcode": "V13.1", - "Ordinal": 1, - "Name": "Documentation de configuration", - "Items": [ - { - "Shortcode": "V13.1.1", - "Ordinal": 1, - "Description": "Vérifiez que tous les besoins de communication de l'application sont documentés. Cela doit inclure les services externes dont l'application dépend et les cas où un utilisateur final pourrait fournir un emplacement externe auquel l'application se connectera.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.1.2", - "Ordinal": 2, - "Description": "Vérifiez que pour chaque service utilisé par l'application, la documentation définit le nombre maximal de connexions simultanées (par exemple, les limites du pool de connexions) et le comportement de l'application lorsque cette limite est atteinte, y compris les mécanismes de secours ou de récupération, pour éviter les conditions de déni de service.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.1.3", - "Ordinal": 3, - "Description": "Vérifiez que la documentation de l'application définit des stratégies de gestion des ressources pour chaque système ou service externe utilisé (par exemple, bases de données, descripteurs de fichiers, threads, connexions HTTP). Cela doit inclure les procédures de libération des ressources, les paramètres de délai d'expiration, la gestion des échecs et l'implémentation de la logique de nouvelle tentative, en spécifiant les limites de nouvelle tentative, les délais et les algorithmes de retour arrière. Pour les opérations de requête-réponse HTTP synchrones, la documentation doit imposer des délais d'expiration courts et soit désactiver les nouvelles tentatives, soit les limiter strictement afin d'éviter les retards en cascade et l'épuisement des ressources.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.1.4", - "Ordinal": 4, - "Description": "Vérifiez que la documentation de l'application définit les secrets essentiels à la sécurité de l'application et un calendrier de rotation de ceux-ci, en fonction du modèle de menace et des exigences commerciales de l'organisation.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V13.2", - "Ordinal": 2, - "Name": "Configuration de la communication backend", - "Items": [ - { - "Shortcode": "V13.2.1", - "Ordinal": 1, - "Description": "Vérifiez que les communications entre les composants de l'application backend qui ne prennent pas en charge le mécanisme de session utilisateur standard de l'application, notamment les API, les intergiciels et les couches de données, sont authentifiées. L'authentification doit utiliser des comptes de service individuels, des jetons à court terme ou une authentification par certificat, et non des identifiants immuables tels que des mots de passe, des clés API ou des comptes partagés avec accès privilégié.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.2.2", - "Ordinal": 2, - "Description": "Vérifiez que les communications entre les composants de l'application backend, y compris les services locaux ou du système d'exploitation, les API, les intergiciels et les couches de données, sont effectuées avec des comptes dotés des privilèges les moins nécessaires.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.2.3", - "Ordinal": 3, - "Description": "Vérifiez que si des informations d’identification doivent être utilisées pour l’authentification du service, les informations d’identification utilisées par le consommateur ne sont pas des informations d’identification par défaut (par exemple, root/root ou admin/admin).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.2.4", - "Ordinal": 4, - "Description": "Vérifiez qu'une liste d’autorisations est utilisée pour définir les ressources ou systèmes externes avec lesquels l'application est autorisée à communiquer (par exemple, pour les requêtes sortantes, les chargements de données ou l'accès aux fichiers). Cette liste d'autorisation peut être implémentée au niveau de la couche applicative, du serveur web, du pare-feu ou d'une combinaison de différentes couches.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.2.5", - "Ordinal": 5, - "Description": "Vérifiez que le serveur Web ou d’application est configuré avec une liste autorisée de ressources ou de systèmes vers lesquels le serveur peut envoyer des requêtes ou charger des données ou des fichiers.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.2.6", - "Ordinal": 6, - "Description": "Vérifiez que lorsque l'application se connecte à des services distincts, elle suit la configuration documentée pour chaque connexion, comme le nombre maximal de connexions parallèles, le comportement lorsque le nombre maximal de connexions autorisées est atteint, les délais d'expiration de connexion et les stratégies de nouvelle tentative.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V13.3", - "Ordinal": 3, - "Name": "Gestion des secrets", - "Items": [ - { - "Shortcode": "V13.3.1", - "Ordinal": 1, - "Description": "Vérifiez qu'une solution de gestion des secrets, telle qu'un coffre-fort de clés, est utilisée pour créer, stocker, contrôler l'accès et détruire en toute sécurité les secrets backend. Ceux-ci peuvent inclure des mots de passe, du matériel de clé, des intégrations avec des bases de données et des systèmes tiers, des clés et des graines pour des jetons temporels, d'autres secrets internes et des clés API. Les secrets ne doivent pas être inclus dans le code source de l'application ni dans les artefacts de build. Pour une application L3, cela doit impliquer une solution matérielle telle qu'un HSM.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.3.2", - "Ordinal": 2, - "Description": "Vérifiez que l’accès aux ressources secrètes respecte le principe du moindre privilège.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.3.3", - "Ordinal": 3, - "Description": "Vérifiez que toutes les opérations cryptographiques sont effectuées à l'aide d'un module de sécurité isolé (tel qu'un coffre-fort ou un module de sécurité matériel) pour gérer et protéger en toute sécurité le matériel clé contre toute exposition en dehors du module de sécurité.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.3.4", - "Ordinal": 4, - "Description": "Vérifiez que les secrets sont configurés pour expirer et être renouvelés en fonction de la documentation de l'application.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V13.4", - "Ordinal": 4, - "Name": "Fuite d'informations involontaire", - "Items": [ - { - "Shortcode": "V13.4.1", - "Ordinal": 1, - "Description": "Vérifiez que l'application est déployée soit sans aucune métadonnée de contrôle de source, y compris les dossiers .git ou .svn, soit de manière à ce que ces dossiers soient inaccessibles à la fois en externe et à l'application elle-même.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.4.2", - "Ordinal": 2, - "Description": "Vérifiez que les modes de débogage sont désactivés pour tous les composants dans les environnements de production afin d’éviter l’exposition des fonctionnalités de débogage et la fuite d’informations.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.4.3", - "Ordinal": 3, - "Description": "Vérifiez que les serveurs Web n’exposent pas les listes de répertoires aux clients, sauf si cela est explicitement prévu.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.4.4", - "Ordinal": 4, - "Description": "Vérifiez que l’utilisation de la méthode HTTP TRACE n’est pas prise en charge dans les environnements de production, afin d’éviter toute fuite d’informations potentielle.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.4.5", - "Ordinal": 5, - "Description": "Vérifiez que la documentation (comme pour les API internes) et les endpoints de surveillance ne sont pas exposés, sauf si cela est explicitement prévu.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.4.6", - "Ordinal": 6, - "Description": "Vérifiez que l’application n’expose pas d’informations de version détaillées des composants backend.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.4.7", - "Ordinal": 7, - "Description": "Vérifiez que la couche web est configuré pour servir uniquement les fichiers avec des extensions de fichier spécifiques afin d’éviter toute fuite involontaire d’informations, de configuration et de code source.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V14", - "Ordinal": 14, - "ShortName": "Data", - "Name": "Protection des données", - "Items": [ - { - "Shortcode": "V14.1", - "Ordinal": 1, - "Name": "Documentation sur la protection des données", - "Items": [ - { - "Shortcode": "V14.1.1", - "Ordinal": 1, - "Description": "Vérifiez que toutes les données sensibles créées et traitées par l'application ont été identifiées et classées selon leur niveau de protection. Cela inclut les données uniquement codées et donc facilement déchiffrables, telles que les chaînes Base64 ou la charge utile en texte clair d'un JWT. Les niveaux de protection doivent tenir compte des réglementations et normes de protection des données et de confidentialité auxquelles l'application est tenue de se conformer.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V14.1.2", - "Ordinal": 2, - "Description": "Vérifier que tous les niveaux de protection des données sensibles sont assortis d'un ensemble documenté d'exigences de protection. Cela doit inclure (sans s'y limiter) les exigences relatives au chiffrement général, à la vérification de l'intégrité, à la conservation, à la journalisation des données, aux contrôles d'accès aux données sensibles dans les journaux, au chiffrement au niveau de la base de données, aux technologies de confidentialité et de renforcement de la confidentialité à utiliser, ainsi qu'aux autres exigences de confidentialité.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V14.2", - "Ordinal": 2, - "Name": "Protection générale des données", - "Items": [ - { - "Shortcode": "V14.2.1", - "Ordinal": 1, - "Description": "Vérifiez que les données sensibles sont uniquement envoyées au serveur dans les champs de corps ou d’en-tête du message HTTP, et que l’URL et la chaîne de requête ne contiennent pas d’informations sensibles, telles qu’une clé API ou un jeton de session.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V14.2.2", - "Ordinal": 2, - "Description": "Vérifiez que l’application empêche la mise en cache des données sensibles dans les composants du serveur, tels que les équilibreurs de charge et les caches d’application, ou garantit que les données sont purgées en toute sécurité après utilisation.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V14.2.3", - "Ordinal": 3, - "Description": "Vérifiez que les données sensibles définies ne sont pas envoyées à des parties non fiables (par exemple, des trackers d'utilisateurs) pour empêcher la collecte indésirable de données en dehors du contrôle de l'application.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V14.2.4", - "Ordinal": 4, - "Description": "Vérifiez que les contrôles autour des données sensibles liés au chiffrement, à la vérification de l'intégrité, à la conservation, à la manière dont les données doivent être enregistrées, aux contrôles d'accès autour des données sensibles dans les journaux, à la confidentialité et aux technologies d'amélioration de la confidentialité, sont mis en œuvre comme défini dans la documentation pour le niveau de protection des données spécifiques.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V14.2.5", - "Ordinal": 5, - "Description": "Vérifiez que les mécanismes de mise en cache sont configurés pour ne mettre en cache que les réponses dont le type de contenu est conforme à la ressource et qui ne contiennent pas de contenu sensible et dynamique. Le serveur web doit renvoyer une réponse 404 ou 302 lors de l'accès à un fichier inexistant plutôt qu'un fichier valide différent. Cela devrait empêcher les attaques par empoisonnement de cache web.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V14.2.6", - "Ordinal": 6, - "Description": "Vérifiez que l'application ne renvoie que les données sensibles minimales requises pour son fonctionnement. Par exemple, ne renvoyez que certains chiffres d'un numéro de carte de crédit, et non le numéro complet. Si les données complètes sont requises, elles doivent être masquées dans l'interface utilisateur, sauf si l'utilisateur les consulte spécifiquement.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V14.2.7", - "Ordinal": 7, - "Description": "Vérifiez que les informations sensibles sont soumises à une classification de conservation des données, en veillant à ce que les données obsolètes ou inutiles soient supprimées automatiquement, selon un calendrier défini ou selon les besoins de la situation.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V14.2.8", - "Ordinal": 8, - "Description": "Vérifiez que les informations sensibles sont supprimées des métadonnées des fichiers soumis par l'utilisateur, sauf si le stockage est autorisé par l'utilisateur.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V14.3", - "Ordinal": 3, - "Name": "Protection des données côté client", - "Items": [ - { - "Shortcode": "V14.3.1", - "Ordinal": 1, - "Description": "Vérifiez que les données authentifiées sont effacées du stockage client, comme le DOM du navigateur, après la fin du client ou de la session. Le champ d'en-tête de réponse HTTP « Clear-Site-Data » peut être utile, mais le côté client devrait également pouvoir effectuer la correction si la connexion au serveur n'est pas disponible à la fin de la session.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V14.3.2", - "Ordinal": 2, - "Description": "Vérifiez que l'application définit suffisamment de champs d'en-tête de réponse HTTP anti-caching (c'est-à-dire Cache-Control : no-store) afin que les données sensibles ne soient pas mises en cache dans les navigateurs.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V14.3.3", - "Ordinal": 3, - "Description": "Vérifiez que les données stockées dans le stockage du navigateur (telles que localStorage, sessionStorage, IndexedDB ou les cookies) ne contiennent pas de données sensibles, à l'exception des jetons de session.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V15", - "Ordinal": 15, - "ShortName": "Secure", - "Name": "Développement et architecture sécurisés", - "Items": [ - { - "Shortcode": "V15.1", - "Ordinal": 1, - "Name": "Documentation sur le développement et l'architecture sécurisés", - "Items": [ - { - "Shortcode": "V15.1.1", - "Ordinal": 1, - "Description": "Vérifiez que la documentation de l'application définit les délais de correction basés sur les risques pour les versions de composants tiers présentant des vulnérabilités et pour la mise à jour des bibliothèques en général, afin de minimiser les risques liés à ces composants.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.1.2", - "Ordinal": 2, - "Description": "Vérifiez qu'un catalogue d'inventaire, tel qu'une nomenclature logicielle (SBOM), est conservé pour toutes les bibliothèques tierces utilisées, y compris en vérifiant que les composants proviennent de référentiels prédéfinis, fiables et continuellement maintenus.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.1.3", - "Ordinal": 3, - "Description": "Vérifiez que la documentation de l'application identifie les fonctionnalités consommatrices en temps ou gourmandes en ressources. Elle doit notamment indiquer comment prévenir une perte de disponibilité due à une utilisation excessive de ces fonctionnalités et éviter que la génération d'une réponse ne prenne plus de temps que le délai d'expiration du consommateur. Les mesures de protection potentielles peuvent inclure le traitement asynchrone, l'utilisation de files d'attente et la limitation des processus parallèles par utilisateur et par application.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.1.4", - "Ordinal": 4, - "Description": "Vérifiez que la documentation de l’application met en évidence les bibliothèques tierces qui sont considérées comme des « composants à risque ».", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.1.5", - "Ordinal": 5, - "Description": "Vérifiez que la documentation de l’application met en évidence les parties de l’application où des « fonctionnalités dangereuses » sont utilisées.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V15.2", - "Ordinal": 2, - "Name": "Architecture de sécurité et dépendances", - "Items": [ - { - "Shortcode": "V15.2.1", - "Ordinal": 1, - "Description": "Vérifiez que l’application contient uniquement des composants qui n’ont pas dépassé les délais de mise à jour et de correction documentés.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.2.2", - "Ordinal": 2, - "Description": "Vérifiez que l'application a mis en œuvre des défenses contre la perte de disponibilité due à des fonctionnalités qui prennent du temps ou qui nécessitent des ressources, sur la base des décisions et stratégies de sécurité documentées à cet effet.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.2.3", - "Ordinal": 3, - "Description": "Vérifiez que l'environnement de production inclut uniquement les fonctionnalités nécessaires au fonctionnement de l'application et n'expose pas de fonctionnalités superflues telles que du code de test, des exemples d'extraits et des fonctionnalités de développement.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.2.4", - "Ordinal": 4, - "Description": "Vérifiez que les composants tiers et toutes leurs dépendances transitives sont inclus à partir du référentiel attendu, qu'il soit détenu en interne ou qu'il s'agisse d'une source externe, et qu'il n'y a aucun risque d'attaque par confusion de dépendances.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.2.5", - "Ordinal": 5, - "Description": "Vérifiez que l'application implémente des protections supplémentaires autour des parties documentées comme contenant des « fonctionnalités dangereuses » ou utilisant des bibliothèques tierces considérées comme des « composants à risque ». Cela peut inclure des techniques telles que le sandboxing, l'encapsulation, la conteneurisation ou l'isolation au niveau du réseau pour retarder et dissuader les attaquants qui compromettent une partie de l'application de se propager ailleurs.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V15.3", - "Ordinal": 3, - "Name": "Développement défensif", - "Items": [ - { - "Shortcode": "V15.3.1", - "Ordinal": 1, - "Description": "Vérifiez que l'application ne renvoie que le sous-ensemble requis de champs d'un objet de données. Par exemple, elle ne doit pas renvoyer un objet de données entier, car certains champs individuels ne doivent pas être accessibles aux utilisateurs.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.3.2", - "Ordinal": 2, - "Description": "Vérifiez que lorsque le backend de l'application effectue des appels vers des URL externes, il est configuré pour ne pas suivre les redirections, sauf s'il s'agit d'une fonctionnalité prévue.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.3.3", - "Ordinal": 3, - "Description": "Vérifiez que l'application dispose de contre-mesures pour se protéger contre les attaques d'affectation de masse en limitant les champs autorisés par contrôleur et action, par exemple, il n'est pas possible d'insérer ou de mettre à jour une valeur de champ lorsqu'elle n'était pas destinée à faire partie de cette action.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.3.4", - "Ordinal": 4, - "Description": "Vérifiez que tous les composants proxy et middleware transfèrent correctement l'adresse IP d'origine de l'utilisateur à l'aide de champs de données fiables qui ne peuvent pas être manipulés par l'utilisateur final, et que l'application et le serveur Web utilisent cette valeur correcte pour la journalisation et les décisions de sécurité telles que la limitation du débit, en tenant compte du fait que même l'adresse IP d'origine peut ne pas être fiable en raison d'adresses IP dynamiques, de VPN ou de pare-feu d'entreprise.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.3.5", - "Ordinal": 5, - "Description": "Vérifiez que l'application garantit explicitement que les variables sont du type correct et effectue des opérations d'égalité et de comparaison strictes. Cela permet d'éviter les vulnérabilités liées à la confusion de types, causées par des hypothèses du code de l'application sur le type d'une variable.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.3.6", - "Ordinal": 6, - "Description": "Vérifiez que le code JavaScript est écrit de manière à éviter la pollution du prototype, par exemple en utilisant Set() ou Map() au lieu de littéraux d'objet.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.3.7", - "Ordinal": 7, - "Description": "Vérifiez que l'application dispose de défenses contre les attaques de pollution des paramètres HTTP, en particulier si le Framework d'application ne fait aucune distinction quant à la source des paramètres de requête (chaîne de requête, paramètres de corps, cookies ou champs d'en-tête).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V15.4", - "Ordinal": 4, - "Name": "Concurrence sécurisée", - "Items": [ - { - "Shortcode": "V15.4.1", - "Ordinal": 1, - "Description": "Vérifiez que les objets partagés dans le code multithread (tels que les caches, les fichiers ou les objets en mémoire accessibles par plusieurs threads) sont accessibles en toute sécurité à l'aide de types thread-safe et de mécanismes de synchronisation tels que des verrous ou des sémaphores pour éviter les conditions de concurrence et la corruption des données.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.4.2", - "Ordinal": 2, - "Description": "Vérifiez que les vérifications de l'état d'une ressource, comme son existence ou ses autorisations, et des actions qui en dépendent, sont effectuées en une seule opération atomique afin d'éviter les situations de concurrence entre le moment de la vérification et le moment de l'utilisation (TOCTOU). Par exemple, vérifier l'existence d'un fichier avant de l'ouvrir ou l'accès d'un utilisateur avant de l'accorder.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.4.3", - "Ordinal": 3, - "Description": "Vérifiez que les verrous sont utilisés de manière cohérente pour éviter que les threads ne se bloquent, que ce soit en s'attendant les uns les autres ou en réessayant sans fin, et que la logique de verrouillage reste dans le code responsable de la gestion de la ressource pour garantir que les verrous ne peuvent pas être modifiés par inadvertance ou de manière malveillante par des classes ou du code externes.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.4.4", - "Ordinal": 4, - "Description": "Vérifiez que les politiques d'allocation des ressources empêchent la saturation de threads en garantissant un accès équitable aux ressources, par exemple en exploitant les pools de threads, permettant aux threads de priorité inférieure de continuer dans un délai raisonnable.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V16", - "Ordinal": 16, - "ShortName": "Security", - "Name": "Journalisation de sécurité et gestion des erreurs", - "Items": [ - { - "Shortcode": "V16.1", - "Ordinal": 1, - "Name": "Documentation sur la journalisation de sécurité", - "Items": [ - { - "Shortcode": "V16.1.1", - "Ordinal": 1, - "Description": "Vérifiez qu'il existe un inventaire documentant la journalisation effectuée à chaque couche de la pile technologique de l'application, les événements enregistrés, les formats de journal, l'endroit où cette journalisation est stockée, la manière dont elle est utilisée, la manière dont l'accès à celle-ci est contrôlé et la durée de conservation des journaux.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V16.2", - "Ordinal": 2, - "Name": "Journalisation générale", - "Items": [ - { - "Shortcode": "V16.2.1", - "Ordinal": 1, - "Description": "Vérifiez que chaque entrée de journal inclut les métadonnées nécessaires (telles que quand, où, qui, quoi) qui permettraient une enquête détaillée sur la chronologie lorsqu'un événement se produit.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.2.2", - "Ordinal": 2, - "Description": "Vérifiez que les sources de temps de tous les composants de journalisation sont synchronisées et que les horodatages des métadonnées des événements de sécurité utilisent le temps UTC ou incluent un décalage horaire explicite. L'UTC est recommandé pour garantir la cohérence entre les systèmes distribués et éviter toute confusion lors du passage à l'heure d'été.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.2.3", - "Ordinal": 3, - "Description": "Vérifiez que l’application stocke ou diffuse uniquement les journaux vers les fichiers et services documentés dans l’inventaire des journaux.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.2.4", - "Ordinal": 4, - "Description": "Vérifiez que les journaux peuvent être lus et corrélés par le processeur de journaux utilisé, de préférence en utilisant un format de journalisation commun.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.2.5", - "Ordinal": 5, - "Description": "Vérifiez que l'application applique la journalisation en fonction du niveau de protection des données lors de la journalisation de données sensibles. Par exemple, certaines données, comme les identifiants ou les informations de paiement, peuvent être interdites. D'autres données, comme les jetons de session, ne peuvent être enregistrées que par hachage ou masquage, en totalité ou en partie.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V16.3", - "Ordinal": 3, - "Name": "Événements de sécurité", - "Items": [ - { - "Shortcode": "V16.3.1", - "Ordinal": 1, - "Description": "Vérifiez que toutes les opérations d'authentification sont enregistrées, y compris les tentatives réussies et infructueuses. Des métadonnées supplémentaires, telles que le type d'authentification ou les facteurs utilisés, doivent également être collectées.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.3.2", - "Ordinal": 2, - "Description": "Vérifier que les tentatives d'autorisation infructueuses sont logguées. Pour le niveau 3, cela doit inclure la journalisation de toutes les décisions d'autorisation, y compris lors de l'accès à des données sensibles (sans journalisation des données sensibles elles-mêmes).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.3.3", - "Ordinal": 3, - "Description": "Vérifiez que l'application enregistre les événements de sécurité définis dans la documentation et enregistre également les tentatives de contournement des contrôles de sécurité, tels que la validation des entrées, la logique métier et l'anti-automatisation.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.3.4", - "Ordinal": 4, - "Description": "Vérifiez que l’application enregistre les erreurs inattendues et les échecs de contrôle de sécurité tels que les échecs TLS du backend.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V16.4", - "Ordinal": 4, - "Name": "Protection des journaux", - "Items": [ - { - "Shortcode": "V16.4.1", - "Ordinal": 1, - "Description": "Vérifiez que tous les composants de journalisation codent correctement les données pour empêcher l’injection de journaux.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.4.2", - "Ordinal": 2, - "Description": "Vérifiez que les journaux sont protégés contre tout accès non autorisé et ne peuvent pas être modifiés.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.4.3", - "Ordinal": 3, - "Description": "Vérifiez que les journaux sont transmis de manière sécurisée à un système logique distinct pour analyse, détection, alerte et remontée des informations. L'objectif est de garantir qu'en cas de violation de l'application, les journaux ne seront pas compromis.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V16.5", - "Ordinal": 5, - "Name": "Gestion des erreurs", - "Items": [ - { - "Shortcode": "V16.5.1", - "Ordinal": 1, - "Description": "Vérifiez qu'un message générique est renvoyé au consommateur lorsqu'une erreur inattendue ou sensible à la sécurité se produit, garantissant ainsi l'absence d'exposition de données système internes sensibles telles que les traces de pile, les requêtes, les clés secrètes et les jetons.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.5.2", - "Ordinal": 2, - "Description": "Vérifiez que l'application continue de fonctionner en toute sécurité lorsque l'accès aux ressources externes échoue, par exemple, en utilisant des modèles tels que des disjoncteurs ou une dégradation progressive.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.5.3", - "Ordinal": 3, - "Description": "Vérifiez que l'application échoue proprement et sécurisée, y compris lorsqu'une exception se produit, en évitant les accès en cas d'erreur telles que le traitement d'une transaction malgré les erreurs résultant de la logique de validation.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.5.4", - "Ordinal": 4, - "Description": "Vérifiez qu'un gestionnaire d'erreurs de « dernier recours » est défini pour intercepter toutes les exceptions non gérées. Cela permet d'éviter la perte des informations d'erreur qui doivent être loguées dans les fichiers journaux et de garantir qu'une erreur ne paralyse pas l'ensemble du processus applicatif, entraînant une perte de disponibilité.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V17", - "Ordinal": 17, - "ShortName": "WebRTC", - "Name": "WebRTC", - "Items": [ - { - "Shortcode": "V17.1", - "Ordinal": 1, - "Name": "Serveur TURN", - "Items": [ - { - "Shortcode": "V17.1.1", - "Ordinal": 1, - "Description": "Vérifiez que le service TURN (Traversal Using Relays around NAT) autorise uniquement l'accès aux adresses IP non réservées à des fins spécifiques (par exemple, réseaux internes, diffusion, bouclage). Notez que cela s'applique aux adresses IPv4 et IPv6.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V17.1.2", - "Ordinal": 2, - "Description": "Vérifiez que le service Traversal Using Relays around NAT (TURN) n'est pas susceptible d'épuiser ses ressources lorsque des utilisateurs légitimes tentent d'ouvrir un grand nombre de ports sur le serveur TURN.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V17.2", - "Ordinal": 2, - "Name": "Média", - "Items": [ - { - "Shortcode": "V17.2.1", - "Ordinal": 1, - "Description": "Vérifiez que la clé du certificat Datagram Transport Layer Security (DTLS) est gérée et protégée conformément à la politique documentée de gestion des clés cryptographiques.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V17.2.2", - "Ordinal": 2, - "Description": "Vérifiez que le serveur multimédia est configuré pour utiliser et prendre en charge les suites de chiffrement DTLS (Datagram Transport Layer Security) approuvées et un profil de protection sécurisé pour l'extension DTLS pour l'établissement de clés pour le protocole de transport en temps réel sécurisé (DTLS-SRTP).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V17.2.3", - "Ordinal": 3, - "Description": "Vérifiez que l'authentification SRTP (Secure Real-time Transport Protocol) est vérifiée sur le serveur multimédia pour empêcher les attaques par injection RTP (Real-time Transport Protocol) d'entraîner une condition de déni de service ou l'insertion de médias audio ou vidéo dans les flux multimédias.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V17.2.4", - "Ordinal": 4, - "Description": "Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant lorsqu'il rencontre des paquets SRTP (Secure Real-time Transport Protocol) mal formés.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V17.2.5", - "Ordinal": 5, - "Description": "Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V17.2.6", - "Ordinal": 6, - "Description": "Vérifiez que le serveur multimédia n'est pas sensible à la vulnérabilité de condition de concurrence « ClientHello » dans Datagram Transport Layer Security (DTLS) en vérifiant si le serveur multimédia est publiquement connu comme étant vulnérable ou en effectuant le test de condition de concurrence.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V17.2.7", - "Ordinal": 7, - "Description": "Vérifiez que tous les mécanismes d'enregistrement audio ou vidéo associés au serveur multimédia sont en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V17.2.8", - "Ordinal": 8, - "Description": "Vérifiez que le certificat Datagram Transport Layer Security (DTLS) est vérifié par rapport à l'attribut d'empreinte cryptographique du protocole de description de session (SDP), en mettant fin au flux multimédia si la vérification échoue, pour garantir l'authenticité du flux multimédia.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V17.3", - "Ordinal": 3, - "Name": "Signalisation", - "Items": [ - { - "Shortcode": "V17.3.1", - "Ordinal": 1, - "Description": "Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation entrants légitimes lors d'une attaque par saturation. Cela peut être réalisé en implémentant une limitation de débit au niveau de la signalisation.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V17.3.2", - "Ordinal": 2, - "Description": "Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation légitimes en cas de message mal formé susceptible de provoquer un déni de service. Cela peut inclure la validation des entrées, la gestion sécurisée des dépassements d'entiers, la prévention des dépassements de tampon et l'utilisation d'autres techniques robustes de gestion des erreurs.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - } - ] -} diff --git a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.xml b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.xml deleted file mode 100644 index 4225c650e7..0000000000 --- a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.xml +++ /dev/null @@ -1 +0,0 @@ -Application Security Verification Standard ProjectASVS5.0.0The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.V11EncodingEncodage et nettoyageV1.11Architecture d'encodage et de nettoyageV1.1.11Vérifiez que l'entrée est décodée ou non échappée vers une forme canonique une seule fois, elle n'est décodée que lorsque des données codées sous cette forme sont attendues, et que cela est fait avant de traiter davantage l'entrée, par exemple, elle n'est pas effectuée après la validation ou la désinfection de l'entrée.FalseTrue✓True✓V1.1.22Vérifiez que l'application effectue l'encodage et l'échappement de sortie soit comme étape finale avant d'être utilisée par l'interpréteur pour lequel elle est destinée, soit par l'interpréteur lui-même.FalseTrue✓True✓V1.22Prévention des injectionsV1.2.11Vérifiez que l'encodage de sortie d'une réponse HTTP, d'un document HTML ou d'un document XML est pertinent pour le contexte requis, comme l'encodage des caractères pertinents pour les éléments HTML, les attributs HTML, les commentaires HTML, les CSS ou les champs d'en-tête HTTP, pour éviter de modifier la structure du message ou du document.True✓True✓True✓V1.2.22Vérifiez que, lors de la création dynamique d'URL, les données non fiables sont encodées en fonction de leur contexte (par exemple, encodage d'URL ou encodage base64url pour les paramètres de requête ou de chemin). Assurez-vous que seuls les schémas d'URL sûrs sont autorisés (par exemple, interdire javascript: ou data:).True✓True✓True✓V1.2.33Vérifiez que l'encodage ou l'échappement de sortie est utilisé lors de la création dynamique de contenu JavaScript (y compris JSON), pour éviter de modifier la structure du message ou du document (pour éviter l'injection JavaScript et JSON).True✓True✓True✓V1.2.44Vérifiez que la sélection de données ou les requêtes de base de données (par exemple, SQL, HQL, NoSQL, Cypher) utilisent des requêtes paramétrées, des ORM, des Framework d'entités ou sont protégées contre les injections SQL et autres attaques par injection de base de données. Ceci est également pertinent lors de l'écriture de procédures stockées.True✓True✓True✓V1.2.55Vérifiez que l’application protège contre l’injection de commandes du système d’exploitation et que les appels du système d’exploitation utilisent des requêtes du système d’exploitation paramétrées ou utilisent un encodage de sortie de ligne de commande contextuelle.True✓True✓True✓V1.2.66Vérifiez que l’application protège contre les vulnérabilités d’injection LDAP ou que des contrôles de sécurité spécifiques pour empêcher l’injection LDAP ont été mis en œuvre.FalseTrue✓True✓V1.2.77Vérifiez que l’application est protégée contre les attaques par injection XPath en utilisant la paramétrisation des requêtes ou des requêtes précompilées.FalseTrue✓True✓V1.2.88Vérifiez que les processeurs LaTeX sont configurés de manière sécurisée (par exemple, en n'utilisant pas l'indicateur « --shell-escape ») et qu'une liste d’autorisations de commandes est utilisée pour empêcher les attaques par injection LaTeX.FalseTrue✓True✓V1.2.99Vérifiez que l'application échappe les caractères spéciaux dans les expressions régulières (généralement à l'aide d'une barre oblique inverse) pour éviter qu'ils ne soient mal interprétés comme des métacaractères.FalseTrue✓True✓V1.2.1010Vérifiez que l'application est protégée contre les injections CSV et injections de formules. L'application doit respecter les règles d'échappement définies dans les sections 2.6 et 2.7 de la RFC 4180 lors de l'export de contenu CSV. De plus, lors de l'export au format CSV ou vers d'autres formats de tableur (tels que XLS, XLSX ou ODF), les caractères spéciaux (notamment « = », « + », « - », « @ », « \t » (tabulation) et « \0 » (caractère null)) doivent être protégés par une apostrophe s'ils apparaissent en premier dans une valeur de champ.FalseFalseTrue✓V1.33NettoyageV1.3.11Vérifiez que toutes les entrées HTML non fiables provenant d'éditeurs WYSIWYG ou similaires sont nettoyées à l'aide d'une bibliothèque ou d'une fonctionnalité de Framework de nettoyage HTML bien connue et sécurisée.True✓True✓True✓V1.3.22Vérifiez que l'application évite d'utiliser eval() ou d'autres fonctionnalités d'exécution de code dynamique telles que Spring Expression Language (SpEL). En l'absence d'alternative, toute saisie utilisateur incluse doit être nettoyée avant d'être exécutée.True✓True✓True✓V1.3.33Vérifiez que les données transmises à un contexte potentiellement dangereux sont préalablement nettoyées pour appliquer des mesures de sécurité, telles qu'autoriser uniquement des caractères sûrs pour ce contexte et raccourcir des entrées trop longues.FalseTrue✓True✓V1.3.44Vérifiez que le contenu Scalable Vector Graphics (SVG) scriptable fourni par l'utilisateur est validé ou nettoyé pour contenir uniquement des balises et des attributs (tels que des graphiques de dessin) qui sont sûrs pour l'application, par exemple, ne contiennent pas de scripts et d'objets étrangers.FalseTrue✓True✓V1.3.55Vérifiez que l'application nettoie ou désactive le contenu du langage de modèle d'expression ou de script fourni par l'utilisateur, tel que les feuilles de style CSS, le Markdown ou XSL, BBCode ou similaire.FalseTrue✓True✓V1.3.66Vérifiez que l'application protège contre les attaques de falsification de requête côté serveur (SSRF), en validant les données non fiables par rapport à une liste d'autorisation de protocoles, de domaines, de chemins et de ports et en nettoyant les caractères potentiellement dangereux avant d'utiliser les données pour appeler un autre service.FalseTrue✓True✓V1.3.77Vérifiez que l'application se protège contre les attaques par injection de modèles en interdisant la création de modèles basés sur des entrées non fiables. En l'absence d'alternative, toute entrée non fiable incluse dynamiquement lors de la création du modèle doit être nettoyée ou rigoureusement validée.FalseTrue✓True✓V1.3.88Vérifiez que l’application nettoie correctement les entrées non fiables avant utilisation dans les requêtes Java Naming and Directory Interface (JNDI) et que JNDI est configuré de manière sécurisée pour empêcher les attaques par injection JNDI.FalseTrue✓True✓V1.3.99Vérifiez que l’application nettoie le contenu avant qu’il ne soit envoyé à memcache pour éviter les attaques par injection.FalseTrue✓True✓V1.3.1010Vérifiez que les chaînes de format susceptibles d'être résolues de manière inattendue ou malveillante lors de leur utilisation sont nettoyées avant d'être traitées.FalseTrue✓True✓V1.3.1111Vérifiez que l'application nettoie les entrées utilisateur avant de les transmettre aux systèmes de messagerie pour se protéger contre l'injection SMTP ou IMAP.FalseTrue✓True✓V1.3.1212Vérifiez que les expressions régulières sont exemptes d'éléments provoquant "backtracking" exponentiel et assurez-vous que les entrées non fiables sont nettoyées pour atténuer les attaques ReDoS ou Runaway Regex.FalseFalseTrue✓V1.44Mémoire, chaine de caractères et code à mémoire non-managéeV1.4.11Vérifiez que l'application utilise des chaînes memory-safe, une copie de mémoire et une arithmétique de pointeur renforcée pour détecter ou empêcher les débordements de pile, de tampon ou de tas.FalseTrue✓True✓V1.4.22Vérifiez que les techniques de validation du signe, de la plage et de l’entrée sont utilisées pour éviter les dépassements d’entiers.FalseTrue✓True✓V1.4.33Vérifiez que la mémoire et les ressources allouées dynamiquement sont libérées et que les références ou les pointeurs vers la mémoire libérée sont supprimés ou définis à null pour éviter les "dangling pointer" et les vulnérabilités d'utilisation après libération.FalseTrue✓True✓V1.55Désérialisation sécuriséeV1.5.11Vérifiez que l'application configure les "parser" XML pour utiliser une configuration restrictive et que les fonctionnalités non sûres telles que la résolution d'entités externes sont désactivées pour empêcher les attaques XML eXternal Entity (XXE).True✓True✓True✓V1.5.22Vérifiez que la désérialisation des données non fiables garantit une gestion sécurisée des entrées, par exemple en utilisant une liste d'autorisation de types d'objets ou en limitant les types d'objets définis par le client, afin d'empêcher les attaques par désérialisation. Les mécanismes de désérialisation explicitement définis comme non sécurisés ne doivent pas être utilisés avec des entrées non fiables.FalseTrue✓True✓V1.5.33Vérifiez que les différents "parser" utilisés dans l'application pour le même type de données (par exemple, les "parser" JSON, les "parser" XML, les "parser" d'URL) effectuent l'analyse de manière cohérente et utilisent le même mécanisme d'encodage de caractères pour éviter des problèmes tels que les vulnérabilités d'interopérabilité JSON ou un comportement d'analyse d'URI ou de fichier différent exploité dans les attaques d'inclusion de fichiers à distance (RFI) ou de falsification de requête côté serveur (SSRF).FalseFalseTrue✓V22ValidationValidation et logique métierV2.11Validation et documentation de la logique métierV2.1.11Vérifiez que la documentation de l'application définit des règles de validation des entrées pour vérifier la validité des éléments de données par rapport à la structure attendue. Il peut s'agir de formats de données courants tels que des numéros de carte de crédit, des adresses e-mail ou des numéros de téléphone, ou d'un format de données interne.True✓True✓True✓V2.1.22Vérifiez que la documentation de l'application définit comment valider la cohérence logique et contextuelle des éléments de données combinés, par exemple en vérifiant que la banlieue et le code postal correspondent.FalseTrue✓True✓V2.1.33Vérifiez que les attentes en matière de limites et de validations de la logique métier sont documentées, y compris par utilisateur et globalement dans l'application.FalseTrue✓True✓V2.22Validation des entréesV2.2.11Vérifier que les entrées sont validées afin de respecter les attentes métier ou fonctionnelles. Cette validation doit être basée sur une liste de valeurs, de modèles et de plages autorisées, ou sur la comparaison des entrées avec une structure attendue et des limites logiques selon des règles prédéfinies. Pour le niveau 1, cette validation peut se concentrer sur les entrées utilisées pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau 2, elle doit s'appliquer à toutes les entrées.True✓True✓True✓V2.2.22Vérifiez que l'application est conçue pour appliquer la validation des entrées au niveau d'une couche de service de confiance. Bien que la validation côté client améliore l'ergonomie et doit être encouragée, elle ne doit pas être considérée comme un contrôle de sécurité.True✓True✓True✓V2.2.33Vérifiez que l’application garantit que les combinaisons d’éléments de données associés sont raisonnables selon les règles prédéfinies.FalseTrue✓True✓V2.33Sécurité de la logique métierV2.3.11Vérifiez que l’application traitera uniquement les flux de logique métier pour le même utilisateur dans l’ordre séquentiel attendu et sans sauter d’étapes.True✓True✓True✓V2.3.22Vérifiez que les limites de la logique métier sont implémentées conformément à la documentation de l'application, afin d'éviter que des failles de la logique métier ne soient pas exploitées.FalseTrue✓True✓V2.3.33Vérifiez que les transactions sont utilisées au niveau de la logique métier de telle sorte qu'une opération de logique métier réussisse dans son intégralité ou qu'elle soit restaurée à l'état correct précédent.FalseTrue✓True✓V2.3.44Vérifiez que les mécanismes de verrouillage au niveau de la logique métier sont utilisés pour garantir que les ressources en quantité limitée (telles que les sièges de théâtre ou les créneaux de livraison) ne peuvent pas être réservées deux fois en manipulant la logique de l'application.FalseTrue✓True✓V2.3.55Vérifiez que les flux logiques métier à forte valeur ajoutée nécessitent l'approbation de plusieurs utilisateurs afin d'éviter toute action non autorisée ou accidentelle. Cela peut inclure, sans s'y limiter, les transferts monétaires importants, les approbations de contrats, l'accès à des informations classifiées ou les contournements de sécurité dans le secteur manufacturier.FalseFalseTrue✓V2.44Anti-automatisationV2.4.11Vérifiez que des contrôles anti-automatisation sont en place pour protéger contre les appels excessifs aux fonctions d'application qui pourraient conduire à l'exfiltration de données, à la création de données inutiles, à l'épuisement des quotas, aux violations de limites de débit, au déni de service ou à la surutilisation de ressources coûteuses.FalseTrue✓True✓V2.4.22Vérifiez que les flux logiques métier nécessitent un timing humain réaliste, évitant ainsi des soumissions de transactions excessivement rapides.FalseFalseTrue✓V33WebSécurité du frontend WebV3.11Documentation sur la sécurité du frontend WebV3.1.11Vérifiez que la documentation de l'application indique les fonctionnalités de sécurité attendues que les navigateurs utilisant l'application doivent prendre en charge (telles que HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) et autres mécanismes de sécurité HTTP pertinents). Elle doit également définir le comportement de l'application lorsque certaines de ces fonctionnalités ne sont pas disponibles (par exemple, avertir l'utilisateur ou bloquer l'accès).FalseFalseTrue✓V3.22Interprétation non intentionnelle du contenuV3.2.11Vérifiez que des contrôles de sécurité sont en place pour empêcher les navigateurs d'afficher du contenu ou des fonctionnalités dans les réponses HTTP dans un contexte incorrect (par exemple, lorsqu'une API, un fichier téléchargé par l'utilisateur ou une autre ressource est demandée directement). Les contrôles possibles peuvent inclure : ne pas transmettre le contenu sauf si les champs d'en-tête de requête HTTP (tels que Sec-Fetch-\*) indiquent qu'il s'agit du contexte correct, utiliser la directive sandbox du champ d'en-tête Content-Security-Policy ou utiliser le type de disposition de pièce jointe dans le champ d'en-tête Content-Disposition.True✓True✓True✓V3.2.22Vérifiez que le contenu destiné à être affiché sous forme de texte, plutôt que rendu sous forme de HTML, est géré à l'aide de fonctions de rendu sécurisées (telles que createTextNode ou textContent) pour empêcher l'exécution involontaire de contenu tel que HTML ou JavaScript.True✓True✓True✓V3.2.33Vérifiez que l'application évite l'écrasement du DOM lors de l'utilisation de JavaScript côté client en utilisant des déclarations de variables explicites, en effectuant une vérification de type stricte, en évitant de stocker des variables globales sur l'objet document et en implémentant l'isolation de l'espace de nommage.FalseFalseTrue✓V3.33Configuration des cookiesV3.3.11Vérifiez que les cookies ont l'attribut « Secure » ​​défini et si le préfixe « \__Host- » n'est pas utilisé pour le nom du cookie, le préfixe « __Secure- » doit être utilisé pour le nom du cookie.True✓True✓True✓V3.3.22Vérifiez que la valeur de l'attribut « SameSite » de chaque cookie est définie en fonction de l'objectif du cookie, afin de limiter l'exposition aux attaques de réparation de l'interface utilisateur et aux attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).FalseTrue✓True✓V3.3.33Vérifiez que les cookies ont le préfixe « __Host- » pour le nom du cookie, sauf s'ils sont explicitement conçus pour être partagés avec d'autres hôtes.FalseTrue✓True✓V3.3.44Vérifiez que si la valeur d'un cookie n'est pas censée être accessible aux scripts côté client (comme un jeton de session), le cookie doit avoir l'attribut « HttpOnly » défini et la même valeur (par exemple, un jeton de session) ne doit être transférée au client que via le champ d'en-tête « Set-Cookie ».FalseTrue✓True✓V3.3.55Vérifiez que lorsque l'application écrit un cookie, la longueur combinée du nom et de la valeur du cookie ne dépasse pas 4 096 octets. Les cookies trop volumineux ne seront pas stockés par le navigateur et ne seront donc pas envoyés avec les requêtes, empêchant ainsi l'utilisateur d'utiliser les fonctionnalités de l'application qui reposent sur ce cookie.FalseFalseTrue✓V3.44En-têtes du mécanisme de sécurité du navigateurV3.4.11Vérifiez qu'un champ d'en-tête Strict-Transport-Security est inclus dans toutes les réponses afin d'appliquer une politique HTTP Strict Transport Security (HSTS). Une durée maximale d'au moins un an doit être définie, et pour les niveaux L2 et supérieurs, la politique doit également s'appliquer à tous les sous-domaines.True✓True✓True✓V3.4.22Vérifiez que le champ d'en-tête Access-Control-Allow-Origin du partage de ressources cross-origine (CORS) est une valeur fixe de l'application ou, si la valeur du champ d'en-tête de requête HTTP Origin est utilisée, qu'elle est validée par rapport à une liste d'origines approuvées. Si « Access-Control-Allow-Origin: * » doit être utilisé, vérifiez que la réponse ne contient aucune information sensible.True✓True✓True✓V3.4.33Vérifiez que les réponses HTTP incluent un champ d'en-tête de réponse Content-Security-Policy qui définit des directives garantissant que le navigateur charge et exécute uniquement du contenu ou des ressources fiables, afin de limiter l'exécution de JavaScript malveillant. Au minimum, une politique globale doit être utilisée, incluant les directives object-src 'none' et base-uri 'none', et définissant soit une lliste d’autorisations, soit des valeurs nonces ou des hachages. Pour une application L3, une politique par réponse avec des valeurs nonces ou des hachages doit être définie.FalseTrue✓True✓V3.4.44Vérifiez que toutes les réponses HTTP contiennent un champ d'en-tête « X-Content-Type-Options: nosniff ». Cela indique aux navigateurs de ne pas utiliser l'analyse de contenu ni la détection du type MIME pour la réponse donnée, et d'exiger que la valeur du champ d'en-tête « Content-Type » de la réponse corresponde à la ressource de destination. Par exemple, la réponse à une demande de style n'est acceptée que si le type de contenu de la réponse est « text/css ». Cela permet également au navigateur d'utiliser la fonctionnalité de blocage de lecture inter-origines (CORB).FalseTrue✓True✓V3.4.55Vérifiez que l'application définit une politique de référencement afin d'empêcher la fuite de données techniquement sensibles vers des services tiers via le champ d'en-tête de requête HTTP « Referer ». Cela peut être effectué via le champ d'en-tête de réponse HTTP « Referrer-Policy » ou via les attributs d'élément HTML. Les données sensibles peuvent inclure le chemin d'accès et les données de requête dans l'URL, et pour les applications internes non publiques, le nom d'hôte.FalseTrue✓True✓V3.4.66Vérifiez que l'application Web utilise la directive frame-ancestors du champ d'en-tête Content-Security-Policy pour chaque réponse HTTP afin de garantir qu'elle ne peut pas être intégrée par défaut et que l'intégration de ressources spécifiques n'est autorisée qu'en cas de nécessité. Notez que le champ d'en-tête X-Frame-Options, bien que pris en charge par les navigateurs, est obsolète et n'est pas forcément fiable.FalseTrue✓True✓V3.4.77Vérifiez que le champ d’en-tête Content-Security-Policy spécifie un emplacement pour signaler les violations.FalseFalseTrue✓V3.4.88Vérifiez que toutes les réponses HTTP qui lancent le rendu d'un document (comme les réponses de type text/html) incluent le champ d'en-tête 'Cross-Origin-Opener-Policy' avec la directive 'same-origin' ou s'ame-origin-allow-popups', selon les besoins. Cela empêche les attaques abusant de l'accès partagé aux objets Window, telles que le tabnabbing et le comptage d'images.FalseFalseTrue✓V3.55Séparation de l'origine du navigateurV3.5.11Vérifiez que, si l'application ne s'appuie pas sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher les requêtes inter-origines non autorisées d'utiliser des fonctionnalités sensibles, ces requêtes sont validées afin de garantir leur origine. Cela peut se faire en utilisant et en validant des jetons anti-falsification ou en exigeant des champs d'en-tête HTTP supplémentaires qui ne sont pas des champs d'en-tête de requête CORS safelist. Ceci permet de se protéger contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).True✓True✓True✓V3.5.22Vérifiez que, si l'application s'appuie sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher l'utilisation inter-origines non autorisée de fonctionnalités sensibles, il est impossible d'appeler la fonctionnalité avec une requête qui ne déclenche pas de requête de pré-vérification cross-origin CORS. Cela peut nécessiter de vérifier les valeurs des champs d'en-tête de requête 'Origin' et 'Content-Type' ou d'utiliser un champ d'en-tête supplémentaire qui n'est pas un champ d'en-tête de la liste de sécurité CORS.True✓True✓True✓V3.5.33Vérifiez que les requêtes HTTP destinées aux fonctionnalités sensibles utilisent des méthodes HTTP appropriées, telles que POST, PUT, PATCH ou DELETE, et non des méthodes définies comme « sûres » par la spécification HTTP, telles que HEAD, OPTIONS ou GET. Une validation stricte des champs d'en-tête de requête Sec-Fetch-* peut également être utilisée pour garantir que la requête ne provient pas d'un appel inter-origines inapproprié, d'une requête de navigation ou d'un chargement de ressources (comme une source d'image) inattendu.True✓True✓True✓V3.5.44Vérifiez que des applications distinctes sont hébergées sur des noms d'hôte différents pour tirer parti des restrictions fournies par la politique de même origine, y compris la manière dont les documents ou scripts chargés par une origine peuvent interagir avec les ressources d'une autre origine et les restrictions basées sur le nom d'hôte sur les cookies.FalseTrue✓True✓V3.5.55Vérifiez que les messages reçus par l'interface postMessage sont rejetés si l'origine du message n'est pas digne de confiance ou si la syntaxe du message n'est pas valide.FalseTrue✓True✓V3.5.66Vérifiez que la fonctionnalité JSONP n'est activée nulle part dans l'application pour éviter les attaques Cross-Site Script Inclusion (XSSI).FalseFalseTrue✓V3.5.77Vérifiez que les données nécessitant une autorisation ne sont pas incluses dans les réponses des ressources de script, comme les fichiers JavaScript, pour empêcher les attaques par inclusion de script intersite (XSSI).FalseFalseTrue✓V3.5.88Vérifiez que les ressources authentifiées (telles que les images, les vidéos, les scripts et autres documents) peuvent être chargées ou intégrées pour le compte de l'utilisateur uniquement lorsque cela est prévu. Cela peut être réalisé en validant strictement les champs d'en-tête de requête HTTP Sec-Fetch-* afin de garantir que la requête ne provient pas d'un appel cross-origin inapproprié, ou en définissant un champ d'en-tête de réponse HTTP Cross-Origin-Resource-Policy restrictif pour indiquer au navigateur de bloquer le contenu renvoyé.FalseFalseTrue✓V3.66Intégrité des ressources externesV3.6.11Vérifiez que les ressources côté client, telles que les bibliothèques JavaScript, les feuilles de style CSS ou les polices web, sont hébergées en externe (par exemple, sur un réseau de diffusion de contenu) uniquement si la ressource est statique et versionnée, et si l'intégrité des sous-ressources (SRI) est utilisée pour valider l'intégrité de la ressource. Si cela n'est pas possible, une décision de sécurité documentée doit justifier cette décision pour chaque ressource.FalseFalseTrue✓V3.77Autres considérations sur la sécurité du navigateurV3.7.11Vérifiez que l'application utilise uniquement des technologies côté client toujours prises en charge et considérées comme sécurisées. Parmi les technologies qui ne répondent pas à cette exigence figurent les plugins NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL ou les applets Java côté client.FalseTrue✓True✓V3.7.22Vérifiez que l'application redirigera automatiquement l'utilisateur vers un nom d'hôte ou un domaine différent (qui n'est pas contrôlé par l'application) uniquement lorsque la destination apparaît sur une liste d'autorisation.FalseTrue✓True✓V3.7.33Vérifiez que le domaine de premier niveau de l'application (par exemple, site.tld) ​​est ajouté à la liste de préchargement publique pour HTTP Strict Transport Security (HSTS). Cela garantit que l'utilisation de TLS pour l'application est intégrée directement dans les principaux navigateurs, plutôt que de dépendre uniquement du champ d'en-tête de réponse Strict-Transport-Security.FalseFalseTrue✓V3.7.44Vérifiez que l'application affiche une notification lorsque l'utilisateur est redirigé vers une URL hors du contrôle de l'application, avec une option pour annuler la navigation.FalseFalseTrue✓V3.7.55Vérifiez que l'application se comporte comme documenté (par exemple, en avertissant l'utilisateur ou en bloquant l'accès) si le navigateur utilisé pour accéder à l'application ne prend pas en charge les fonctionnalités de sécurité attendues.FalseFalseTrue✓V44APIAPI et service WebV4.11Sécurité du service Web génériqueV4.1.11Vérifiez que chaque réponse HTTP avec un corps de message contient un champ d'en-tête Content-Type qui correspond au contenu réel de la réponse, y compris le paramètre charset pour spécifier un codage de caractères sécurisé (par exemple, UTF-8, ISO-8859-1) conformément aux types de médias IANA, tels que « text/ », « /+xml » et « /xml ».True✓True✓True✓V4.1.22Vérifiez que seuls les terminaux utilisateurs (destinés à l'accès manuel via un navigateur web) redirigent automatiquement de HTTP vers HTTPS, tandis que les autres services ou terminaux n'implémentent pas de redirections transparentes. Cela permet d'éviter qu'un client envoie par erreur des requêtes HTTP non chiffrées, mais que, comme ces requêtes sont automatiquement redirigées vers HTTPS, la fuite de données sensibles passe inaperçue.FalseTrue✓True✓V4.1.33Vérifiez que tout champ d'en-tête HTTP utilisé par l'application et défini par une couche intermédiaire, telle qu'un équilibreur de charge, un proxy web ou un service backend-for-frontend, ne peut pas être remplacé par l'utilisateur final. Les exemples d'en-têtes peuvent inclure X-Real-IP, X-Forwarded-*, ou X-User-ID.FalseTrue✓True✓V4.1.44Vérifiez que seules les méthodes HTTP explicitement prises en charge par l'application ou son API (y compris les OPTIONS lors des demandes de contrôle en amont) peuvent être utilisées et que les méthodes inutilisées sont bloquées.FalseFalseTrue✓V4.1.55Vérifier que les signatures numériques par message sont utilisées pour fournir une assurance supplémentaire en plus des protections de transport pour les demandes ou les transactions qui sont très sensibles ou qui traversent un certain nombre de systèmes.FalseFalseTrue✓V4.22Validation de la structure des messages HTTPV4.2.11Vérifiez que tous les composants de l'application (y compris les équilibreurs de charge, les pares-feux et les serveurs d'applications) déterminent les limites des messages HTTP entrants à l'aide du mécanisme approprié à la version HTTP afin d'empêcher la contrebande de requêtes HTTP. Dans HTTP/1.x, si un champ d'en-tête Transfer-Encoding est présent, l'en-tête Content-Length doit être ignoré conformément à la RFC 2616. Avec HTTP/2 ou HTTP/3, si un champ d'en-tête Content-Length est présent, le récepteur doit s'assurer qu'il est cohérent avec la longueur des trames DATA.FalseTrue✓True✓V4.2.22Vérifier que, lors de la génération de messages HTTP, le champ d'en-tête Content-Length n'entre pas en conflit avec la longueur du contenu déterminée par le cadrage du protocole HTTP, afin d'empêcher les attaques de type « request smuggling ».FalseFalseTrue✓V4.2.33Vérifiez que l'application n'envoie ni n'accepte de messages HTTP/2 ou HTTP/3 avec des champs d'en-tête spécifiques à la connexion, tels que Transfer-Encoding, afin d'éviter les attaques par fractionnement de la réponse et par injection d'en-tête.FalseFalseTrue✓V4.2.44Vérifiez que l'application n'accepte que les requêtes HTTP/2 et HTTP/3 dont les champs et valeurs d'en-tête ne contiennent pas de séquences CR (\r), LF (\n) ou CRLF (\r\n), afin d'éviter les attaques par injection d'en-tête.FalseFalseTrue✓V4.2.55Vérifiez que, si l'application (backend ou frontend) construit et envoie des requêtes, elle utilise des mécanismes de validation, d'assainissement ou autres pour éviter de créer des URI (comme pour les appels API) ou des champs d'en-tête de requête HTTP (comme Authorization ou Cookie) qui sont trop longs pour être acceptés par le composant récepteur. Cela pourrait entraîner un déni de service, par exemple lors de l'envoi d'une requête trop longue (par exemple, un long champ d'en-tête de cookie), ce qui fait que le serveur répond toujours avec un statut d'erreur.FalseFalseTrue✓V4.33GraphQLV4.3.11Vérifiez qu'une liste d'autorisation de requête, une limitation de profondeur, une limitation de quantité ou une analyse des coûts de requête est utilisée pour empêcher le déni de service (DoS) de GraphQL ou d'expression de la couche données en raison de requêtes imbriquées coûteuses.FalseTrue✓True✓V4.3.22Vérifiez que les requêtes d’introspection GraphQL sont désactivées dans l’environnement de production, sauf si l’API GraphQL est destinée à être utilisée par d’autres parties.FalseTrue✓True✓V4.44WebSocketV4.4.11Vérifiez que WebSocket sur TLS (WSS) est utilisé pour toutes les connexions WebSocket.True✓True✓True✓V4.4.22Vérifiez que, lors de la négociation HTTP WebSocket initiale, le champ d’en-tête 'Origin' est vérifié par rapport à une liste d’origines autorisées pour l’application.FalseTrue✓True✓V4.4.33Vérifiez que, si la gestion de session standard de l'application ne peut pas être utilisée, des jetons dédiés sont utilisés à cet effet, qui sont conformes aux exigences de sécurité de gestion de session pertinentes.FalseTrue✓True✓V4.4.44Vérifiez que les jetons de gestion de session WebSocket dédiés sont initialement obtenus ou validés via la session HTTPS précédemment authentifiée lors de la transition d'une session HTTPS existante vers un canal WebSocket.FalseTrue✓True✓V55FileGestion des fichiersV5.11Documentation sur la gestion des fichiersV5.1.11Vérifiez que la documentation définit les types de fichiers autorisés, les extensions de fichiers attendues et la taille maximale (y compris la taille décompressée) pour chaque fonctionnalité de Téléversement. De plus, assurez-vous que la documentation précise comment les fichiers sont sécurisés pour le téléchargement et le traitement des utilisateurs finaux, par exemple le comportement de l'application lorsqu'un fichier malveillant est détecté.FalseTrue✓True✓V5.22Téléversement de fichiers et contenuV5.2.11Vérifiez que l'application n'acceptera que des fichiers d'une taille qu'elle peut traiter sans provoquer de perte de performances ou d'attaque par déni de service.True✓True✓True✓V5.2.22Vérifiez que lorsque l'application accepte un fichier, seul ou dans une archive telle qu'un fichier zip, elle vérifie si l'extension de fichier correspond à une extension attendue et que le contenu correspond au type représenté par l'extension. Cela inclut, sans s'y limiter, la vérification des « octets magiques » initiaux, la réécriture d'images et l'utilisation de bibliothèques spécialisées pour la validation du contenu des fichiers. Pour le niveau L1, cela peut se concentrer uniquement sur les fichiers utilisés pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau L2, cela doit s'appliquer à tous les fichiers acceptés.True✓True✓True✓V5.2.33Vérifiez que l'application vérifie les fichiers compressés (par exemple, zip, gz, docx, odt) par rapport à la taille maximale autorisée non compressée et au nombre maximal de fichiers avant de décompresser le fichier.FalseTrue✓True✓V5.2.44Vérifiez qu'un quota de taille de fichier et un nombre maximal de fichiers par utilisateur sont appliqués pour garantir qu'un seul utilisateur ne puisse pas remplir le stockage avec trop de fichiers ou des fichiers excessivement volumineux.FalseFalseTrue✓V5.2.55Vérifiez que l'application n'autorise pas le téléversement de fichiers compressés contenant des liens symboliques, sauf si cela est spécifiquement requis (auquel cas il sera nécessaire d'appliquer une liste d'autorisation des fichiers vers lesquels il est possible de créer des liens symboliques).FalseFalseTrue✓V5.2.66Vérifiez que l'application rejette les images téléversées avec une taille de pixel supérieure au maximum autorisé, afin d'éviter les attaques par inondation de pixels.FalseFalseTrue✓V5.33Stockage de fichiersV5.3.11Vérifiez que les fichiers téléversés ou générés par une entrée non fiable et stockés dans un dossier public ne sont pas exécutés en tant que code de programme côté serveur lorsqu'ils sont accessibles directement avec une requête HTTP.True✓True✓True✓V5.3.22Vérifiez que lorsque l'application crée des chemins d'accès pour les opérations sur les fichiers, elle utilise des données générées en interne ou fiables plutôt que des noms de fichiers soumis par l'utilisateur. Si des noms de fichiers ou des métadonnées de fichiers soumis par l'utilisateur doivent être utilisés, une validation et un nettoyage stricts doivent être appliqués. Ceci permet de se protéger contre les attaques par traversée de chemin, l'inclusion de fichiers locaux ou distants (LFI, RFI) et la falsification de requêtes côté serveur (SSRF).True✓True✓True✓V5.3.33Vérifiez que le traitement des fichiers côté serveur, comme la décompression des fichiers, ignore les informations de chemin fournies par l'utilisateur pour éviter les vulnérabilités telles que le "zip slip".FalseFalseTrue✓V5.44Téléchargement de fichierV5.4.11Vérifiez que l’application valide ou ignore les noms de fichiers soumis par l’utilisateur, y compris dans un paramètre JSON, JSONP ou URL et spécifie un nom de fichier dans le champ d’en-tête Content-Disposition de la réponse.FalseTrue✓True✓V5.4.22Vérifiez que les noms de fichiers servis (par exemple, dans les champs d'en-tête de réponse HTTP ou les pièces jointes aux e-mails) sont encodés ou nettoyés (par exemple, conformément à la RFC 6266) pour préserver la structure du document et empêcher les attaques par injection.FalseTrue✓True✓V5.4.33Vérifiez que les fichiers obtenus à partir de sources non fiables sont analysés par des scanners antivirus pour empêcher la diffusion de contenu malveillant connu.FalseTrue✓True✓V66AuthenticationAuthentificationV6.11Documentation d'authentificationV6.1.11Vérifiez que la documentation de l'application définit comment les contrôles, tels que la limitation de débit, l'anti-automatisation et la réponse adaptative, sont utilisés pour se défendre contre les attaques telles que le « credential stuffing » et la force brute des mots de passe. La documentation doit expliquer clairement comment ces contrôles sont configurés et empêcher le blocage malveillant des comptes.True✓True✓True✓V6.1.22Vérifiez qu'une liste de mots spécifiques au contexte est documentée afin d'empêcher leur utilisation dans les mots de passe. Cette liste peut inclure des permutations de noms d'organisations, de produits, d'identifiants de systèmes, de noms de codes de projets, de noms de services ou de rôles, etc.FalseTrue✓True✓V6.1.33Vérifiez que, si l'application inclut plusieurs voies d'authentification, celles-ci sont toutes documentées avec les contrôles de sécurité et la force d'authentification qui doivent être appliqués de manière cohérente.FalseTrue✓True✓V6.22Sécurité des mots de passeV6.2.11Vérifiez que les mots de passe définis par l'utilisateur comportent au moins 8 caractères, bien qu'un minimum de 15 caractères soit fortement recommandé.True✓True✓True✓V6.2.22Vérifiez que les utilisateurs peuvent modifier leur mot de passe.True✓True✓True✓V6.2.33Vérifiez que la fonctionnalité de changement de mot de passe nécessite le mot de passe actuel et le nouveau mot de passe de l'utilisateur.True✓True✓True✓V6.2.44Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou du changement de mot de passe sont vérifiés par rapport à un ensemble disponible d'au moins 3 000 mots de passe principaux qui correspondent à la politique de mot de passe de l'application, par exemple la longueur minimale.True✓True✓True✓V6.2.55Vérifiez que les mots de passe peuvent être utilisés, quelle que soit leur composition, sans restriction quant au type de caractères autorisés. Aucun nombre minimal de majuscules ou de minuscules, de chiffres ou de caractères spéciaux ne doit être exigé.True✓True✓True✓V6.2.66Vérifiez que les champs de saisie du mot de passe utilisent type=password pour masquer la saisie. Les applications peuvent permettre à l'utilisateur d'afficher temporairement l'intégralité du mot de passe masqué ou le dernier caractère saisi.True✓True✓True✓V6.2.77Vérifiez que la fonctionnalité « coller », les assistants de mot de passe du navigateur et les gestionnaires de mots de passe externes sont autorisés.True✓True✓True✓V6.2.88Vérifiez que l'application vérifie le mot de passe de l'utilisateur exactement tel qu'il a été reçu de l'utilisateur, sans aucune modification telle qu'une troncature ou une transformation de casse.True✓True✓True✓V6.2.99Vérifiez que les mots de passe d’au moins 64 caractères sont autorisés.FalseTrue✓True✓V6.2.1010Vérifiez que le mot de passe d'un utilisateur reste valide jusqu'à ce qu'il soit découvert comme compromis ou qu'il soit renouvelé. L'application ne doit pas exiger de renouvellement périodique des identifiants.FalseTrue✓True✓V6.2.1111Vérifiez que la liste documentée de mots spécifiques au contexte est utilisée pour éviter la création de mots de passe faciles à deviner.FalseTrue✓True✓V6.2.1212Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou des modifications de mot de passe sont vérifiés par rapport à un ensemble de mots de passe fuités.FalseTrue✓True✓V6.33Sécurité générale de l'authentificationV6.3.11Vérifiez que les contrôles visant à empêcher les attaques telles que le bourrage d'informations d'identification et la force brute des mots de passe sont mis en œuvre conformément à la documentation de sécurité de l'application.True✓True✓True✓V6.3.22Vérifiez que les comptes d’utilisateur par défaut (par exemple, « root », « admin » ou « sa ») ne sont pas présents dans l’application ou sont désactivés.True✓True✓True✓V6.3.33Vérifiez que l’application exige que les utilisateurs utilisent un mécanisme d’authentification multifacteur ou une combinaison de mécanismes d’authentification à facteur unique.FalseTrue✓True✓V6.3.44Vérifiez que, si l’application inclut plusieurs voies d’authentification, il n’existe aucune voie non documentée et que les contrôles de sécurité et la force d’authentification sont appliqués de manière cohérente.FalseTrue✓True✓V6.3.55Vérifiez que les utilisateurs sont informés des tentatives d'authentification suspectes (réussies ou non). Il peut s'agir de tentatives d'authentification provenant d'un emplacement ou d'un client inhabituel, d'une authentification partiellement réussie (un seul facteur parmi plusieurs), d'une tentative d'authentification après une longue période d'inactivité ou d'une authentification réussie après plusieurs tentatives infructueuses.FalseFalseTrue✓V6.3.66Vérifiez que le courrier électronique n’est pas utilisé comme mécanisme d’authentification à facteur unique ou à facteurs multiples.FalseFalseTrue✓V6.3.77Vérifiez que les utilisateurs sont avertis après les mises à jour des détails d'authentification, telles que les réinitialisations d'informations d'identification ou la modification du nom d'utilisateur ou de l'adresse e-mail.FalseFalseTrue✓V6.3.88Vérifiez que les utilisateurs valides ne peuvent pas être déduits d'échecs d'authentification, par exemple en se basant sur des messages d'erreur, des codes de réponse HTTP ou des temps de réponse différents. Les fonctionnalités d'inscription et de mot de passe oublié doivent également bénéficier de cette protection.FalseFalseTrue✓V6.44Cycle de vie et récupération du facteur d'authentificationV6.4.11Vérifiez que les mots de passe initiaux ou les codes d'activation générés par le système sont générés de manière aléatoire et sécurisée, qu'ils respectent la politique de mots de passe en vigueur et qu'ils expirent après une courte période ou après leur première utilisation. Ces secrets initiaux ne doivent pas devenir des mots de passe permanents.True✓True✓True✓V6.4.22Vérifiez que les indices de mot de passe ou l'authentification basée sur les connaissances (appelées « questions secrètes ») ne sont pas présents.True✓True✓True✓V6.4.33Vérifiez qu'un processus sécurisé de réinitialisation d'un mot de passe oublié est mis en œuvre, qui ne contourne aucun mécanisme d'authentification multifacteur activé.FalseTrue✓True✓V6.4.44Vérifiez que si un facteur d'authentification multifacteur est perdu, la preuve de vérification d'identité est effectuée au même niveau que lors de l'inscription.FalseTrue✓True✓V6.4.55Vérifiez que les instructions de renouvellement des mécanismes d'authentification qui expirent sont envoyées avec suffisamment de temps pour être exécutées avant l'expiration de l'ancien mécanisme d'authentification, en configurant des rappels automatiques si nécessaire.FalseFalseTrue✓V6.4.66Vérifiez que les administrateurs peuvent initier la réinitialisation du mot de passe de l'utilisateur, mais que cela ne leur permet pas de modifier ou de choisir son mot de passe. Cela évite qu'ils ne connaissent le mot de passe de l'utilisateur.FalseFalseTrue✓V6.55Exigences générales en matière d'authentification multifacteurV6.5.11Vérifiez que les secrets de recherche, les demandes ou codes d'authentification out-of-band et les mots de passe à usage unique basés sur le temps (TOTP) ne peuvent être utilisés avec succès qu'une seule fois.FalseTrue✓True✓V6.5.22Vérifiez que, lors de leur stockage dans le backend de l'application, les secrets de recherche comportant moins de 112 bits d'entropie (19 caractères alphanumériques aléatoires ou 34 chiffres aléatoires) sont hachés avec un algorithme de hachage de stockage de mots de passe approuvé, intégrant un sel aléatoire de 32 bits. Une fonction de hachage standard peut être utilisée si le secret comporte 112 bits d'entropie ou plus.FalseTrue✓True✓V6.5.33Vérifiez que les secrets de recherche, le code d'authentification out-of-band et les mots de passe à usage unique basés sur le temps sont générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) pour éviter les valeurs prévisibles.FalseTrue✓True✓V6.5.44Vérifiez que les secrets de recherche et les codes d'authentification out-of-band ont un minimum de 20 bits d'entropie (généralement 4 caractères alphanumériques aléatoires ou 6 chiffres aléatoires suffisent).FalseTrue✓True✓V6.5.55Vérifiez que les requêtes, codes ou jetons d'authentification out-of-band, ainsi que les mots de passe à usage unique (TOTP), ont une durée de vie définie. Les requêtes out-of-band doivent avoir une durée de vie maximale de 10 minutes et les TOTP, de 30 secondes.FalseTrue✓True✓V6.5.66Vérifiez que tout facteur d’authentification (y compris les appareils physiques) peut être révoqué en cas de vol ou autre perte.FalseFalseTrue✓V6.5.77Vérifiez que les mécanismes d’authentification biométrique ne sont utilisés que comme facteurs secondaires, avec quelque chose que vous possédez ou quelque chose que vous savez.FalseFalseTrue✓V6.5.88Vérifiez que les mots de passe à usage unique basés sur le temps (TOTP) sont vérifiés en fonction d'une source temporelle provenant d'un service de confiance et non d'une heure non fiable ou fournie par le client.FalseFalseTrue✓V6.66Mécanismes d'authentification out-of-bandV6.6.11Vérifier que les mécanismes d'authentification utilisant le réseau téléphonique public commuté (RTPC) pour la transmission de mots de passe à usage unique (OTP) par téléphone ou SMS ne sont proposés que lorsque le numéro de téléphone a été préalablement validé. D'autres méthodes plus robustes (telles que les mots de passe à usage unique à durée déterminée) sont également proposées, et que le service informe les utilisateurs des risques de sécurité qu'elles présentent. Pour les applications de niveau 3, le téléphone et les SMS ne doivent pas être disponibles.FalseTrue✓True✓V6.6.22Vérifiez que les demandes d’authentification out-of-band, les codes ou les jetons sont liés à la demande d’authentification d’origine pour laquelle ils ont été générés et ne sont pas utilisables pour une demande précédente ou ultérieure.FalseTrue✓True✓V6.6.33Vérifiez qu'un mécanisme d'authentification out-of-band basé sur du code est protégé contre les attaques par force brute grâce au "rate limiting". Envisagez également d'utiliser un code avec au moins 64 bits d'entropie.FalseTrue✓True✓V6.6.44Vérifiez que, lorsque les notifications push sont utilisées pour l'authentification multifacteur, le "rate limiting" est appliqué afin d'empêcher les attaques de type « push bombing ». La concordance des numéros peut également atténuer ce risque.FalseFalseTrue✓V6.77Mécanisme d'authentification cryptographiqueV6.7.11Vérifiez que les certificats utilisés pour vérifier les assertions d’authentification cryptographique sont stockés de manière à les protéger contre toute modification.FalseFalseTrue✓V6.7.22Vérifiez que le nonce de défi a une longueur d'au moins 64 bits et qu'il est statistiquement unique ou unique sur toute la durée de vie du périphérique cryptographique.FalseFalseTrue✓V6.88Authentification avec un fournisseur d'identitéV6.8.11Vérifiez que, si l'application prend en charge plusieurs fournisseurs d'identité (IdP), l'identité de l'utilisateur ne peut pas être usurpée via un autre fournisseur d'identité pris en charge (par exemple, en utilisant le même identifiant utilisateur). La mesure standard consisterait à ce que l'application enregistre et identifie l'utilisateur à l'aide d'une combinaison de l'ID du fournisseur d'identité (servant d'espace de noms) et de l'ID de l'utilisateur dans le fournisseur d'identité.FalseTrue✓True✓V6.8.22Vérifiez que la présence et l'intégrité des signatures numériques sur les assertions d'authentification (par exemple sur les assertions JWT ou SAML) sont toujours validées, en rejetant toutes les assertions non signées ou ayant des signatures non valides.FalseTrue✓True✓V6.8.33Vérifiez que les assertions SAML sont traitées de manière unique et utilisées une seule fois au cours de la période de validité pour éviter les attaques par rejeu.FalseTrue✓True✓V6.8.44Si une application utilise un fournisseur d'identité (IdP) distinct et attend une force, des méthodes ou une date d'authentification spécifiques pour des fonctions spécifiques, vérifiez que l'application les vérifie à l'aide des informations renvoyées par l'IdP. Par exemple, si OIDC est utilisé, cela peut être réalisé en validant les affirmations de jeton d'identification telles que « acr », « amr » et « auth_time » (le cas échéant). Si l'IdP ne fournit pas ces informations, l'application doit disposer d'une approche de secours documentée qui suppose que le mécanisme d'authentification de force minimale a été utilisé (par exemple, une authentification à facteur unique avec nom d'utilisateur et mot de passe).FalseTrue✓True✓V77SessionGestion des sessionsV7.11Documentation sur la gestion des sessionsV7.1.11Vérifiez que le délai d'inactivité de la session de l'utilisateur et la durée de vie maximale absolue de la session sont documentés, sont appropriés en combinaison avec d'autres contrôles et que la documentation inclut une justification de tout écart par rapport aux exigences de réauthentification NIST SP 800-63B.FalseTrue✓True✓V7.1.22Vérifiez que la documentation définit le nombre de sessions simultanées (parallèles) autorisées pour un compte ainsi que les comportements et actions prévus à entreprendre lorsque le nombre maximal de sessions actives est atteint.FalseTrue✓True✓V7.1.33Vérifiez que tous les systèmes qui créent et gèrent des sessions utilisateur dans le cadre d'un écosystème de gestion des identités fédérées (tels que les systèmes SSO) sont documentés avec des contrôles pour coordonner la durée de vie des sessions, la résiliation et toute autre condition nécessitant une réauthentification.FalseTrue✓True✓V7.22Sécurité fondamentale de la gestion des sessionsV7.2.11Vérifiez que l’application effectue toutes les vérifications des jetons de session à l’aide d’un service backend de confiance.True✓True✓True✓V7.2.22Vérifiez que l'application utilise des jetons autonomes ou de référence générés dynamiquement pour la gestion des sessions, c'est-à-dire sans utiliser de secrets et de clés d'API statiques.True✓True✓True✓V7.2.33Vérifiez que si des jetons par référence sont utilisés pour représenter les sessions utilisateur, ils sont uniques et générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et possèdent au moins 128 bits d'entropie.True✓True✓True✓V7.2.44Vérifiez que l’application génère un nouveau jeton de session lors de l’authentification de l’utilisateur, y compris la réauthentification, et met fin au jeton de session actuel.True✓True✓True✓V7.33Délai d'expiration de la sessionV7.3.11Vérifiez qu’il existe un délai d’inactivité tel que la réauthentification soit appliquée conformément à l’analyse des risques et aux décisions de sécurité documentées.FalseTrue✓True✓V7.3.22Vérifiez qu'il existe une durée de vie maximale absolue de la session de sorte que la réauthentification soit appliquée conformément à l'analyse des risques et aux décisions de sécurité documentées.FalseTrue✓True✓V7.44Fin de sessionV7.4.11Vérifiez que lorsque la fin de session est déclenchée (par exemple, déconnexion ou expiration), l'application interdit toute utilisation ultérieure de la session. Pour les jetons par référence ou les sessions avec état, cela implique l'invalidation des données de session au niveau du backend de l'application. Les applications utilisant des jetons autonomes nécessiteront une solution, comme la gestion d'une liste des jetons terminés, l'interdiction des jetons produits avant une date et une heure spécifique à chaque utilisateur ou la rotation d'une clé de signature spécifique à chaque utilisateur.True✓True✓True✓V7.4.22Vérifiez que l'application met fin à toutes les sessions actives lorsqu'un compte utilisateur est désactivé ou supprimé (par exemple, lorsqu'un employé quitte l'entreprise).True✓True✓True✓V7.4.33Vérifiez que l'application offre la possibilité de mettre fin à toutes les autres sessions actives après une modification ou une suppression réussie de tout facteur d'authentification (y compris la modification du mot de passe via une réinitialisation ou une récupération et, le cas échéant, une mise à jour des paramètres MFA).FalseTrue✓True✓V7.4.44Vérifiez que toutes les pages nécessitant une authentification disposent d’un accès facile et visible à la fonctionnalité de déconnexion.FalseTrue✓True✓V7.4.55Vérifiez que les administrateurs d’applications sont en mesure de mettre fin aux sessions actives pour un utilisateur individuel ou pour tous les utilisateurs.FalseTrue✓True✓V7.55Défenses contre les abus de sessionV7.5.11Vérifiez que l'application nécessite une réauthentification complète avant d'autoriser les modifications des attributs de compte sensibles qui peuvent affecter l'authentification, tels que l'adresse e-mail, le numéro de téléphone, la configuration MFA ou d'autres informations utilisées dans la récupération de compte.FalseTrue✓True✓V7.5.22Vérifiez que les utilisateurs peuvent afficher et (après s'être authentifiés à nouveau avec au moins un facteur) terminer une ou toutes les sessions actuellement actives.FalseTrue✓True✓V7.5.33Vérifiez que l’application nécessite une authentification supplémentaire avec au moins un facteur ou une vérification secondaire avant d’effectuer des transactions ou des opérations hautement sensibles.FalseFalseTrue✓V7.66Réauthentification fédéréeV7.6.11Vérifiez que la durée de vie et la fin de la session entre les parties de confiance (RP) et les fournisseurs d'identité (IdP) se comportent comme documenté, en exigeant une réauthentification si nécessaire, par exemple lorsque le temps maximal entre les événements d'authentification IdP est atteint.FalseTrue✓True✓V7.6.22Vérifiez que la création d'une session nécessite soit le consentement de l'utilisateur, soit une action explicite, empêchant ainsi la création de nouvelles sessions d'application sans interaction de l'utilisateur.FalseTrue✓True✓V88AuthorizationAutorisationV8.11Documentation d'autorisationV8.1.11Vérifiez que la documentation d’autorisation définit des règles de restriction de l’accès au niveau de la fonction et aux données en fonction des autorisations du consommateur et des attributs des ressources.True✓True✓True✓V8.1.22Vérifiez que la documentation d'autorisation définit les règles de restriction d'accès au niveau des champs (lecture et écriture) en fonction des autorisations des consommateurs et des attributs des ressources. Notez que ces règles peuvent dépendre d'autres valeurs d'attributs de l'objet de données concerné, telles que l'état ou le statut.FalseTrue✓True✓V8.1.33Vérifiez que la documentation de l'application définit les attributs environnementaux et contextuels (y compris, mais sans s'y limiter, l'heure de la journée, l'emplacement de l'utilisateur, l'adresse IP ou l'appareil) qui sont utilisés dans l'application pour prendre des décisions de sécurité, y compris celles relatives à l'authentification et à l'autorisation.FalseFalseTrue✓V8.1.44Vérifier que la documentation d'authentification et d'autorisation définit l'utilisation des facteurs environnementaux et contextuels dans la prise de décision, en plus des autorisations au niveau des fonctions, des données et des champs. Cela doit inclure les attributs évalués, les seuils de risque et les actions entreprises (par exemple, autorisation, contestation, refus, renforcement de l'authentification).FalseFalseTrue✓V8.22Conception d'autorisation généraleV8.2.11Vérifiez que l’application garantit que l’accès basé sur la fonction est limité aux consommateurs disposant d’autorisations explicites.True✓True✓True✓V8.2.22Vérifiez que l'application garantit que l'accès spécifique aux données est limité aux consommateurs disposant d'autorisations explicites sur des éléments de données spécifiques afin d'atténuer les références d'objet directes non sécurisées (IDOR) et les autorisations de niveau d'objet rompues (BOLA).True✓True✓True✓V8.2.33Vérifiez que l'application garantit que l'accès au niveau du champ est limité aux consommateurs disposant d'autorisations explicites sur des champs spécifiques afin d'atténuer les problèmes d'autorisation au niveau de la propriété d'objet (BOPLA).FalseTrue✓True✓V8.2.44Vérifiez que les contrôles de sécurité adaptatifs basés sur les attributs environnementaux et contextuels du consommateur (tels que l'heure, la localisation, l'adresse IP ou l'appareil) sont mis en œuvre pour les décisions d'authentification et d'autorisation, comme défini dans la documentation de l'application. Ces contrôles doivent être appliqués lorsque le consommateur tente de démarrer une nouvelle session et également pendant une session existante.FalseFalseTrue✓V8.33Autorisation par opérationV8.3.11Vérifier que l'application applique les règles d'autorisations au niveau de la couche service de confiance et ne s’appuie pas sur des contrôles qu’un consommateur non approuvé pourrait manipuler, comme JavaScript côté client.True✓True✓True✓V8.3.22Vérifiez que les modifications apportées aux valeurs sur lesquelles reposent les décisions d'autorisation sont appliquées immédiatement. Lorsque les modifications ne peuvent pas être appliquées immédiatement (par exemple, en s'appuyant sur des données de jetons autonomes), des contrôles d'atténuation doivent être mis en place pour alerter un consommateur lorsqu'il effectue une action alors qu'il n'est plus autorisé à le faire et annuler la modification. Notez que cette solution alternative ne limiterait pas les fuites d'informations.FalseFalseTrue✓V8.3.33Vérifiez que l'accès à un objet repose sur les autorisations du sujet d'origine (par exemple, le consommateur), et non sur celles d'un intermédiaire ou d'un service agissant en son nom. Par exemple, si un consommateur appelle un service web à l'aide d'un jeton d'authentification autonome, et que ce service demande ensuite des données à un autre service, ce dernier utilisera le jeton du consommateur, plutôt qu'un jeton inter-machine du premier service, pour prendre les décisions d'autorisation.FalseFalseTrue✓V8.44Autres considérations relatives à l'autorisationV8.4.11Vérifiez que les applications multi-tenants utilisent des contrôles inter-tenants pour garantir que les opérations des consommateurs n'affecteront jamais les tenants avec lesquels ils ne sont pas autorisés à interagir.FalseTrue✓True✓V8.4.22Vérifiez que l'accès aux interfaces administratives intègre plusieurs couches de sécurité, notamment la vérification continue de l'identité du consommateur, l'évaluation de la posture de sécurité des appareils et l'analyse contextuelle des risques, garantissant que l'emplacement du réseau ou les endpoints approuvés ne sont pas les seuls facteurs d'autorisation, même s'ils peuvent réduire la probabilité d'accès non autorisé.FalseFalseTrue✓V99SelfJetons autonomesV9.11Source et intégrité du jetonV9.1.11Vérifiez que les jetons autonomes sont validés à l'aide de leur signature numérique ou MAC pour les protéger contre toute falsification avant d'accepter le contenu du jeton.True✓True✓True✓V9.1.22Vérifiez que seuls les algorithmes d'une liste d’autorisations peuvent être utilisés pour créer et vérifier des jetons autonomes, dans un contexte donné. La liste d'autorisation doit inclure les algorithmes autorisés, idéalement symétriques ou asymétriques, et ne doit pas inclure l'algorithme « Aucun ». Si les algorithmes symétriques et asymétriques doivent être pris en charge, des contrôles supplémentaires seront nécessaires pour éviter toute confusion de clés.True✓True✓True✓V9.1.33Vérifiez que les clés utilisées pour valider les jetons autonomes proviennent de sources préconfigurées et fiables pour l'émetteur du jeton, empêchant ainsi les attaquants de spécifier des sources et des clés non fiables. Pour les JWT et autres structures JWS, les en-têtes tels que « jku », « x5u » et « jwk » doivent être validés par rapport à une liste d'autorisation de sources fiables.True✓True✓True✓V9.22Contenu du jetonV9.2.11Vérifiez que, si une période de validité est indiquée dans les données du jeton, celui-ci et son contenu ne sont acceptés que si la date de vérification est comprise dans cette période. Par exemple, pour les JWT, les déclarations « nbf » et « exp » doivent être vérifiées.True✓True✓True✓V9.2.22Vérifiez que le service recevant un jeton valide le type de jeton et son utilisation avant d'en accepter le contenu. Par exemple, seuls les jetons d'accès peuvent être acceptés pour les décisions d'autorisation, et seuls les jetons d'identification peuvent être utilisés pour prouver l'authentification des utilisateurs.FalseTrue✓True✓V9.2.33Vérifiez que le service accepte uniquement les jetons destinés à être utilisés avec ce service (audience). Pour les JWT, cela peut être réalisé en validant la déclaration « aud » par rapport à une liste d'autorisation définie dans le service.FalseTrue✓True✓V9.2.44Si un émetteur de jetons utilise la même clé privée pour émettre des jetons destinés à différentes audiences, vérifiez que les jetons émis contiennent une restriction d'audience identifiant de manière unique les audiences visées. Cela empêchera la réutilisation d'un jeton avec une audience non prévue. Si l'identifiant d'audience est provisionné dynamiquement, l'émetteur de jetons doit valider ces audiences afin de garantir qu'elles n'entraînent pas d'usurpation d'identité.FalseTrue✓True✓V1010OAuthOauth et OIDCV10.11Sécurité générique OAuth et OIDCV10.1.11Vérifiez que les jetons sont envoyés uniquement aux composants qui en ont absolument besoin. Par exemple, lors de l'utilisation d'un modèle backend-for-frontend pour les applications JavaScript basées sur un navigateur, les jetons d'accès et d'actualisation ne doivent être accessibles qu'au backend.FalseTrue✓True✓V10.1.22Vérifiez que le client n'accepte les valeurs du serveur d'autorisation (telles que le code d'autorisation ou le jeton d'identification) que si elles résultent d'un flux d'autorisation initié par la même session d'agent utilisateur et la même transaction. Cela nécessite que les secrets générés par le client, tels que la clé de preuve pour l'échange de codes (PKCE) « code_verifier », « state » ou le nonce OIDC, ne puissent être devinés, soient spécifiques à la transaction et soient liés de manière sécurisée au client et à la session d'agent utilisateur au cours de laquelle la transaction a été initiée.FalseTrue✓True✓V10.22Client OAuthV10.2.11Vérifiez que, si le flux de code est utilisé, le client OAuth dispose d'une protection contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF), qui déclenchent des demandes de jetons, soit en utilisant la fonctionnalité de clé de preuve pour l'échange de code (PKCE), soit en vérifiant le paramètre « state » envoyé dans la demande d'autorisation.FalseTrue✓True✓V10.2.22Vérifiez que, si le client OAuth peut interagir avec plusieurs serveurs d'autorisation, il dispose d'une protection contre les attaques par confusion. Par exemple, il peut exiger que le serveur d'autorisation renvoie la valeur du paramètre « iss » et la valide dans la réponse d'autorisation et la réponse du jeton.FalseTrue✓True✓V10.2.33Vérifiez que le client OAuth demande uniquement les portées requises (ou d’autres paramètres d’autorisation) dans les requêtes adressées au serveur d’autorisation.FalseFalseTrue✓V10.33Serveur de ressources OAuthV10.3.11Vérifiez que le serveur de ressources accepte uniquement les jetons d'accès destinés à être utilisés avec ce service (audience). L'audience peut être incluse dans un jeton d'accès structuré (comme la déclaration « aud » dans JWT) ou vérifiée à l'aide du endpoint d'introspection de jeton.FalseTrue✓True✓V10.3.22Vérifiez que le serveur de ressources applique les décisions d'autorisation en fonction des déclarations du jeton d'accès définissant l'autorisation déléguée. Si des déclarations telles que « sub », « scope » et « authorization_details » sont présentes, elles doivent être prises en compte dans la décision.FalseTrue✓True✓V10.3.33Vérifiez que si une décision de contrôle d'accès nécessite l'identification d'un utilisateur unique à partir d'un jeton d'accès (JWT ou réponse d'introspection de jeton associé), le serveur de ressources identifie l'utilisateur à partir de déclarations non ré attribuables à d'autres utilisateurs. En général, cela implique l'utilisation d'une combinaison de déclarations « iss » et « sub ».FalseTrue✓True✓V10.3.44Si le serveur de ressources requiert une force d'authentification, des méthodes ou une date d'expiration spécifiques, vérifiez que le jeton d'accès présenté respecte ces contraintes. Par exemple, s'il est présent, utilisez les déclarations OIDC « acr », « amr » et « auth_time » respectivement.FalseTrue✓True✓V10.3.55Vérifiez que le serveur de ressources empêche l'utilisation de jetons d'accès volés ou la relecture de jetons d'accès (de parties non autorisées) en exigeant des jetons d'accès limités par l'expéditeur, soit Mutual TLS pour OAuth 2, soit OAuth 2 Demonstration of Proof of Possession (DPoP).FalseFalseTrue✓V10.44Serveur d'autorisation OAuthV10.4.11Vérifiez que le serveur d'autorisation valide les URI de redirection en fonction d'une liste d'autorisation spécifique au client d'URI préenregistrés à l'aide d'une comparaison de chaînes exacte.True✓True✓True✓V10.4.22Vérifiez que, si le serveur d'autorisation renvoie le code d'autorisation dans la réponse, celui-ci ne peut être utilisé qu'une seule fois pour une demande de jeton. Pour la deuxième demande valide avec un code d'autorisation déjà utilisé pour émettre un jeton d'accès, le serveur d'autorisation doit rejeter la demande de jeton et révoquer tous les jetons émis liés au code d'autorisation.True✓True✓True✓V10.4.33Vérifiez que le code d'autorisation est de courte durée. La durée de vie maximale peut atteindre 10 minutes pour les applications L1 et L2 et 1 minute pour les applications L3.True✓True✓True✓V10.4.44Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement l'utilisation des autorisations nécessaires à ce client. Notez que les autorisations « token » (flux implicite) et « password » (flux d'informations d'identification du propriétaire de la ressource) ne doivent plus être utilisées.True✓True✓True✓V10.4.55Vérifiez que le serveur d'autorisation atténue les attaques par rejeu de jetons d'actualisation pour les clients publics, de préférence en utilisant des jetons d'actualisation limités par l'expéditeur, par exemple des jetons DPoP (Demonstrating Proof of Possession) ou des jetons d'accès liés à un certificat utilisant le protocole TLS mutuel (mTLS). Pour les applications L1 et L2, la rotation des jetons d'actualisation peut être utilisée. Si cette rotation est utilisée, le serveur d'autorisation doit invalider le jeton d'actualisation après utilisation et révoquer tous les jetons d'actualisation de cette autorisation si un jeton d'actualisation déjà utilisé et invalidé est fourni.True✓True✓True✓V10.4.66Vérifiez que, si l'octroi de code est utilisé, le serveur d'autorisation atténue les attaques par interception de code en exigeant une clé de preuve pour l'échange de code (PKCE). Pour les demandes d'autorisation, le serveur d'autorisation doit exiger une valeur « code_challenge » valide et ne doit pas accepter une valeur « plain » pour « code_challenge_method ». Pour une demande de jeton, il doit exiger la validation du paramètre « code_verifier ».FalseTrue✓True✓V10.4.77Vérifiez que si le serveur d'autorisation prend en charge l'enregistrement dynamique des clients non authentifiés, il réduit le risque d'applications clientes malveillantes. Il doit valider les métadonnées clientes, telles que les URI enregistrés, garantir le consentement de l'utilisateur et l'avertir avant de traiter une demande d'autorisation avec une application cliente non approuvée.FalseTrue✓True✓V10.4.88Vérifiez que les jetons d’actualisation ont une expiration absolue, y compris si l’expiration du jeton d’actualisation glissant est appliquée.FalseTrue✓True✓V10.4.99Vérifiez que les jetons d'actualisation et les jetons d'accès de référence peuvent être révoqués par un utilisateur autorisé à l'aide de l'interface utilisateur du serveur d'autorisation, afin d'atténuer le risque de clients malveillants ou de jetons volés.FalseTrue✓True✓V10.4.1010Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.FalseTrue✓True✓V10.4.1111Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.FalseTrue✓True✓V10.4.1212Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement la valeur « response_mode » dont ce client a besoin. Par exemple, en vérifiant cette valeur par rapport aux valeurs attendues ou en utilisant une requête d'autorisation poussée (PAR) ou une requête d'autorisation sécurisée par JWT (JAR).FalseFalseTrue✓V10.4.1313Vérifiez que le type d'Autorisation « code » est toujours utilisé avec les demandes d'autorisation poussées (PAR).FalseFalseTrue✓V10.4.1414Vérifiez que le serveur d'autorisation émet uniquement des jetons d'accès limités à l'expéditeur (preuve de possession), soit avec des jetons d'accès liés au certificat utilisant TLS mutuel (mTLS), soit avec des jetons d'accès liés au DPoP (démonstration de preuve de possession).FalseFalseTrue✓V10.4.1515Vérifiez que, pour un client côté serveur (non exécuté sur l'appareil de l'utilisateur final), le serveur d'autorisation garantit que la valeur du paramètre « authorization_details » provient du backend client et que l'utilisateur ne l'a pas altérée. Par exemple, en exigeant l'utilisation d'une demande d'autorisation poussée (PAR) ou d'une demande d'autorisation sécurisée par JWT (JAR).FalseFalseTrue✓V10.4.1616Vérifiez que le client est confidentiel et que le serveur d'autorisation requiert l'utilisation de méthodes d'authentification client fortes (basées sur la cryptographie à clé publique et résistantes aux attaques par relecture), telles que TLS mutuel ('tls_client_auth', 'self_signed_tls_client_auth') ou JWT à clé privée ('private_key_jwt').FalseFalseTrue✓V10.55Client OIDCV10.5.11Vérifiez que le client (en tant que partie utilisatrice) atténue les attaques par rejeu de jeton d'identification. Par exemple, en vous assurant que la valeur « nonce » du jeton d'identification correspond à la valeur « nonce » envoyée dans la demande d'authentification au fournisseur OpenID (appelée demande d'autorisation envoyée au serveur d'autorisation dans OAuth2).FalseTrue✓True✓V10.5.22Vérifiez que le client identifie de manière unique l'utilisateur à partir des déclarations de jeton d'identification, généralement la déclaration « sub », qui ne peut pas être réaffectée à d'autres utilisateurs (pour la portée d'un fournisseur d'identité).FalseTrue✓True✓V10.5.33Vérifiez que le client rejette les tentatives d'un serveur d'autorisation malveillant d'usurper l'identité d'un autre serveur d'autorisation via ses métadonnées. Le client doit rejeter les métadonnées du serveur d'autorisation si l'URL de l'émetteur figurant dans ces métadonnées ne correspond pas exactement à l'URL d'émetteur préconfigurée attendue par le client.FalseTrue✓True✓V10.5.44Vérifiez que le client valide que le jeton d'identification est destiné à être utilisé pour ce client (audience) en vérifiant que la déclaration « aud » du jeton est égale à la valeur « client_id » pour le client.FalseTrue✓True✓V10.5.55Vérifiez que, lors de l'utilisation de la déconnexion du back-channel OIDC, la partie utilisatrice atténue les risques de déni de service liés à la déconnexion forcée et à la confusion entre JWT dans le flux de déconnexion. Le client doit vérifier que le jeton de déconnexion est correctement typé avec la valeur « logout+jwt », qu'il contient la déclaration « event » avec le nom de membre correct et qu'il ne contient pas de déclaration « nonce ». Il est également recommandé d'utiliser une expiration courte (par exemple, 2 minutes).FalseTrue✓True✓V10.66Fournisseur OpenIDV10.6.11Vérifiez que le fournisseur OpenID n'autorise que les valeurs « code », « ciba », « id_token » ou « id_token code » pour le mode de réponse. Notez que « code » est préférable à « id_token code » (flux hybride OIDC) et que « token » (tout flux implicite) ne doit pas être utilisé.FalseTrue✓True✓V10.6.22Vérifiez que le fournisseur OpenID atténue les risques de déni de service liés à la déconnexion forcée. Pour ce faire, obtenez une confirmation explicite de l'utilisateur final ou, le cas échéant, validez les paramètres de la requête de déconnexion (initiée par la partie utilisatrice), comme « id_token_hint ».FalseTrue✓True✓V10.77Gestion du consentementV10.7.11Vérifiez que le serveur d'autorisation garantit le consentement de l'utilisateur à chaque demande d'autorisation. Si l'identité du client ne peut être garantie, le serveur d'autorisation doit toujours demander explicitement le consentement de l'utilisateur.FalseTrue✓True✓V10.7.22Vérifiez que lorsque le serveur d'autorisation demande le consentement de l'utilisateur, il fournit des informations claires et suffisantes sur ce qui est consenti. Le cas échéant, ces informations doivent inclure la nature des autorisations demandées (généralement en fonction de la portée, du serveur de ressources et des détails d'autorisation RAR), l'identité de l'application autorisée et la durée de vie de ces autorisations.FalseTrue✓True✓V10.7.33Vérifiez que l’utilisateur peut consulter, modifier et révoquer les consentements qu’il a accordés via le serveur d’autorisation.FalseTrue✓True✓V1111CryptographyCryptographieV11.11Inventaire et documentation cryptographiquesV11.1.11Vérifiez qu’il existe une politique documentée pour la gestion des clés cryptographiques et un cycle de vie des clés cryptographiques qui suit une norme de gestion des clés telle que NIST SP 800-57. Cela devrait inclure la garantie que les clés ne sont pas sur-partagées (par exemple, avec plus de deux entités pour les secrets partagés et plus d’une entité pour les clés privées).FalseTrue✓True✓V11.1.22Vérifiez qu'un inventaire cryptographique est réalisé, maintenu et régulièrement mis à jour, et qu'il inclut toutes les clés, algorithmes et certificats cryptographiques utilisés par l'application. Il doit également documenter les emplacements du système où les clés peuvent ou non être utilisées, ainsi que les types de données qui peuvent ou non être protégées par ces clés.FalseTrue✓True✓V11.1.33Vérifiez que les mécanismes de découverte cryptographique sont utilisés pour identifier toutes les instances de cryptographie dans le système, y compris les opérations de chiffrement, de hachage et de signature.FalseFalseTrue✓V11.1.44Vérifier la tenue d'un inventaire cryptographique. Celui-ci doit inclure un plan documenté décrivant la migration vers de nouvelles normes cryptographiques, telles que la cryptographie post-quantique, afin de réagir aux menaces futures.FalseFalseTrue✓V11.22Mise en œuvre sécurisée de la cryptographieV11.2.11Vérifiez que les implémentations validées par l’industrie (y compris les bibliothèques et les implémentations accélérées par le matériel) sont utilisées pour les opérations cryptographiques.FalseTrue✓True✓V11.2.22Vérifiez que l'application est conçue avec une agilité cryptographique, de sorte que les nombres aléatoires, le chiffrement authentifié, le MAC ou les algorithmes de hachage, les longueurs de clés, les tours, les chiffrements et les modes puissent être reconfigurés, mis à niveau ou échangés à tout moment, afin de se protéger contre les failles cryptographiques. De même, il doit être possible de remplacer les clés et les mots de passe, ainsi que de rechiffrer les données. Cela permettra des mises à niveau transparentes vers la cryptographie post-quantique (PQC), une fois que des implémentations hautement sécurisées de schémas ou de normes PQC approuvés seront largement disponibles.FalseTrue✓True✓V11.2.33Vérifiez que toutes les primitives cryptographiques utilisent un minimum de 128 bits de sécurité en fonction de l'algorithme, de la taille de la clé et de la configuration. Par exemple, une clé ECC de 256 bits offre environ 128 bits de sécurité, tandis que RSA nécessite une clé de 3072 bits pour atteindre 128 bits de sécurité.FalseTrue✓True✓V11.2.44Vérifiez que toutes les opérations cryptographiques sont à temps constant, sans opérations de « court-circuit » dans les comparaisons, les calculs ou les retours, pour éviter toute fuite d'informations.FalseFalseTrue✓V11.2.55Vérifiez que tous les modules cryptographiques échouent en toute sécurité et que les erreurs sont gérées de manière à ne pas permettre de vulnérabilités, telles que les attaques Padding Oracle.FalseFalseTrue✓V11.33Algorithmes de chiffrementV11.3.11Vérifiez que les modes de bloc non sécurisés (par exemple, ECB) et les schémas de remplissage faibles (par exemple, PKCS#1 v1.5) ne sont pas utilisés.True✓True✓True✓V11.3.22Vérifiez que seuls les chiffrements et modes approuvés tels que AES avec GCM sont utilisés.True✓True✓True✓V11.3.33Vérifiez que les données chiffrées sont protégées contre toute modification non autorisée, de préférence en utilisant une méthode de chiffrement authentifiée approuvée ou en combinant une méthode de chiffrement approuvée avec un algorithme MAC approuvé.FalseTrue✓True✓V11.3.44Vérifiez que les nonces, les vecteurs d'initialisation et autres nombres à usage unique ne sont pas utilisés pour plus d'une paire clé de chiffrement/élément de données. La méthode de génération doit être adaptée à l'algorithme utilisé.FalseFalseTrue✓V11.3.55Vérifiez que toute combinaison d'un algorithme de chiffrement et d'un algorithme MAC fonctionne en mode chiffrement puis MAC.FalseFalseTrue✓V11.44Hachage et fonctions basées sur le hachageV11.4.11Vérifiez que seules les fonctions de hachage approuvées sont utilisées pour les cas d'utilisation cryptographiques généraux, notamment les signatures numériques, HMAC, KDF et la génération de bits aléatoires. Les fonctions de hachage non autorisées, telles que MD5, ne doivent pas être utilisées à des fins cryptographiques.True✓True✓True✓V11.4.22Vérifiez que les mots de passe sont stockés à l'aide d'une fonction de dérivation de clés approuvée et gourmande en ressources de calcul (également appelée « fonction de hachage de mots de passe »), dont les paramètres sont configurés conformément aux directives en vigueur. Ces paramètres doivent équilibrer sécurité et performances afin de rendre les attaques par force brute suffisamment difficiles pour le niveau de sécurité requis.FalseTrue✓True✓V11.4.33Vérifiez que les fonctions de hachage utilisées dans les signatures numériques, dans le cadre de l'authentification ou de l'intégrité des données, sont résistantes aux collisions et possèdent des longueurs de bits appropriées. Si la résistance aux collisions est requise, la longueur de sortie doit être d'au moins 256 bits. Si seule la résistance aux attaques de seconde pré-image est requise, la longueur de sortie doit être d'au moins 128 bits.FalseTrue✓True✓V11.4.44Vérifiez que l'application utilise des fonctions de dérivation de clés approuvées avec des paramètres d'extension de clés lors de la dérivation de clés secrètes à partir de mots de passe. Les paramètres utilisés doivent concilier sécurité et performances afin d'empêcher les attaques par force brute de compromettre la clé cryptographique obtenue.FalseTrue✓True✓V11.55Valeurs aléatoiresV11.5.11Vérifiez que tous les nombres et chaînes aléatoires destinés à être non devinables doivent être générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et posséder au moins 128 bits d'entropie. Notez que les UUID ne respectent pas cette condition.FalseTrue✓True✓V11.5.22Vérifiez que le mécanisme de génération de nombres aléatoires utilisé est conçu pour fonctionner en toute sécurité, même en cas de forte demande.FalseFalseTrue✓V11.66Cryptographie à clé publiqueV11.6.11Vérifier que seuls des algorithmes cryptographiques et des modes opératoires approuvés sont utilisés pour la génération et l'amorçage des clés, ainsi que pour la génération et la vérification des signatures numériques. Les algorithmes de génération de clés ne doivent pas générer de clés non sécurisées et vulnérables aux attaques connues, par exemple les clés RSA vulnérables à la factorisation de Fermat.FalseTrue✓True✓V11.6.22Vérifiez que des algorithmes cryptographiques approuvés sont utilisés pour l'échange de clés (tels que Diffie-Hellman), en veillant à ce que les mécanismes d'échange de clés utilisent des paramètres sécurisés. Cela permettra d'éviter les attaques contre le processus d'établissement des clés, susceptibles de conduire à des attaques de type « adversaire du milieu » ou à des failles cryptographiques.FalseFalseTrue✓V11.77Cryptographie des données en cours d'utilisationV11.7.11Vérifiez que le chiffrement complet de la mémoire est utilisé pour protéger les données sensibles pendant leur utilisation, empêchant ainsi l'accès par des utilisateurs ou des processus non autorisés.FalseFalseTrue✓V11.7.22Vérifiez que la minimisation des données garantit que la quantité minimale de données est exposée pendant le traitement et assurez-vous que les données sont chiffrées immédiatement après utilisation ou dès que possible.FalseFalseTrue✓V1212SecureCommunication sécuriséeV12.11Conseils généraux de sécurité TLSV12.1.11Vérifiez que seules les dernières versions recommandées du protocole TLS sont activées, telles que TLS 1.2 et TLS 1.3. La dernière version du protocole TLS doit être privilégiée.True✓True✓True✓V12.1.22Vérifiez que seules les suites de chiffrement recommandées sont activées, les suites de chiffrement les plus puissantes étant définies comme préférées. Les applications L3 doivent uniquement prendre en charge les suites de chiffrement assurant la confidentialité persistante (forward secrecy).FalseTrue✓True✓V12.1.33Vérifiez que l’application valide que les certificats clients mTLS sont approuvés avant d’utiliser l’identité du certificat pour l’authentification ou l’autorisation.FalseTrue✓True✓V12.1.44Vérifiez que la révocation de certification appropriée, telle que l'agrafage du protocole OCSP (Online Certificate Status Protocol), est activée et configurée.FalseFalseTrue✓V12.1.55Vérifiez que Encrypted Client Hello (ECH) est activé dans les paramètres TLS de l'application pour empêcher l'exposition de métadonnées sensibles, telles que l'indication du nom du serveur (SNI), pendant les processus de négociation TLS.FalseFalseTrue✓V12.22Communication HTTPS avec des services externesV12.2.11Vérifiez que TLS est utilisé pour toute connectivité entre un client et des services externes basés sur HTTP, et ne recourt pas à des communications non sécurisées ou non chiffrées.True✓True✓True✓V12.2.22Vérifiez que les services externes utilisent des certificats TLS publiquement approuvés.True✓True✓True✓V12.33Sécurité des communications entre services générauxV12.3.11Vérifiez qu'un protocole chiffré tel que TLS est utilisé pour toutes les connexions entrantes et sortantes vers et depuis l'application, y compris les systèmes de surveillance, les outils de gestion, l'accès à distance et SSH, les intergiciels, les bases de données, les mainframes, les systèmes partenaires ou les API externes. Le serveur ne doit pas recourir à des protocoles non sécurisés ou non chiffrés.FalseTrue✓True✓V12.3.22Vérifiez que les clients TLS valident les certificats reçus avant de communiquer avec un serveur TLS.FalseTrue✓True✓V12.3.33Vérifiez que TLS ou un autre mécanisme de chiffrement de transport approprié est utilisé pour toute connectivité entre les services internes basés sur HTTP au sein de l'application et ne se replie pas vers des communications non sécurisées ou non chiffrées.FalseTrue✓True✓V12.3.44Vérifiez que les connexions TLS entre les services internes utilisent des certificats de confiance. Lorsque des certificats générés en interne ou auto-signés sont utilisés, le service consommateur doit être configuré pour n'approuver que des autorités de certification internes spécifiques et des certificats auto-signés spécifiques.FalseTrue✓True✓V12.3.55Vérifiez que les services communiquant en interne au sein d'un système (communications intra-services) utilisent une authentification forte pour garantir la vérification de chaque endpoint. Des méthodes d'authentification forte, telles que l'authentification client TLS, doivent être utilisées pour garantir l'identité, en utilisant une infrastructure à clé publique et des mécanismes résistants aux attaques par rejeu. Pour les architectures de microservices, envisagez d'utiliser un maillage de services pour simplifier la gestion des certificats et renforcer la sécurité.FalseFalseTrue✓V1313ConfigurationConfigurationV13.11Documentation de configurationV13.1.11Vérifiez que tous les besoins de communication de l'application sont documentés. Cela doit inclure les services externes dont l'application dépend et les cas où un utilisateur final pourrait fournir un emplacement externe auquel l'application se connectera.FalseTrue✓True✓V13.1.22Vérifiez que pour chaque service utilisé par l'application, la documentation définit le nombre maximal de connexions simultanées (par exemple, les limites du pool de connexions) et le comportement de l'application lorsque cette limite est atteinte, y compris les mécanismes de secours ou de récupération, pour éviter les conditions de déni de service.FalseFalseTrue✓V13.1.33Vérifiez que la documentation de l'application définit des stratégies de gestion des ressources pour chaque système ou service externe utilisé (par exemple, bases de données, descripteurs de fichiers, threads, connexions HTTP). Cela doit inclure les procédures de libération des ressources, les paramètres de délai d'expiration, la gestion des échecs et l'implémentation de la logique de nouvelle tentative, en spécifiant les limites de nouvelle tentative, les délais et les algorithmes de retour arrière. Pour les opérations de requête-réponse HTTP synchrones, la documentation doit imposer des délais d'expiration courts et soit désactiver les nouvelles tentatives, soit les limiter strictement afin d'éviter les retards en cascade et l'épuisement des ressources.FalseFalseTrue✓V13.1.44Vérifiez que la documentation de l'application définit les secrets essentiels à la sécurité de l'application et un calendrier de rotation de ceux-ci, en fonction du modèle de menace et des exigences commerciales de l'organisation.FalseFalseTrue✓V13.22Configuration de la communication backendV13.2.11Vérifiez que les communications entre les composants de l'application backend qui ne prennent pas en charge le mécanisme de session utilisateur standard de l'application, notamment les API, les intergiciels et les couches de données, sont authentifiées. L'authentification doit utiliser des comptes de service individuels, des jetons à court terme ou une authentification par certificat, et non des identifiants immuables tels que des mots de passe, des clés API ou des comptes partagés avec accès privilégié.FalseTrue✓True✓V13.2.22Vérifiez que les communications entre les composants de l'application backend, y compris les services locaux ou du système d'exploitation, les API, les intergiciels et les couches de données, sont effectuées avec des comptes dotés des privilèges les moins nécessaires.FalseTrue✓True✓V13.2.33Vérifiez que si des informations d’identification doivent être utilisées pour l’authentification du service, les informations d’identification utilisées par le consommateur ne sont pas des informations d’identification par défaut (par exemple, root/root ou admin/admin).FalseTrue✓True✓V13.2.44Vérifiez qu'une liste d’autorisations est utilisée pour définir les ressources ou systèmes externes avec lesquels l'application est autorisée à communiquer (par exemple, pour les requêtes sortantes, les chargements de données ou l'accès aux fichiers). Cette liste d'autorisation peut être implémentée au niveau de la couche applicative, du serveur web, du pare-feu ou d'une combinaison de différentes couches.FalseTrue✓True✓V13.2.55Vérifiez que le serveur Web ou d’application est configuré avec une liste autorisée de ressources ou de systèmes vers lesquels le serveur peut envoyer des requêtes ou charger des données ou des fichiers.FalseTrue✓True✓V13.2.66Vérifiez que lorsque l'application se connecte à des services distincts, elle suit la configuration documentée pour chaque connexion, comme le nombre maximal de connexions parallèles, le comportement lorsque le nombre maximal de connexions autorisées est atteint, les délais d'expiration de connexion et les stratégies de nouvelle tentative.FalseFalseTrue✓V13.33Gestion des secretsV13.3.11Vérifiez qu'une solution de gestion des secrets, telle qu'un coffre-fort de clés, est utilisée pour créer, stocker, contrôler l'accès et détruire en toute sécurité les secrets backend. Ceux-ci peuvent inclure des mots de passe, du matériel de clé, des intégrations avec des bases de données et des systèmes tiers, des clés et des graines pour des jetons temporels, d'autres secrets internes et des clés API. Les secrets ne doivent pas être inclus dans le code source de l'application ni dans les artefacts de build. Pour une application L3, cela doit impliquer une solution matérielle telle qu'un HSM.FalseTrue✓True✓V13.3.22Vérifiez que l’accès aux ressources secrètes respecte le principe du moindre privilège.FalseTrue✓True✓V13.3.33Vérifiez que toutes les opérations cryptographiques sont effectuées à l'aide d'un module de sécurité isolé (tel qu'un coffre-fort ou un module de sécurité matériel) pour gérer et protéger en toute sécurité le matériel clé contre toute exposition en dehors du module de sécurité.FalseFalseTrue✓V13.3.44Vérifiez que les secrets sont configurés pour expirer et être renouvelés en fonction de la documentation de l'application.FalseFalseTrue✓V13.44Fuite d'informations involontaireV13.4.11Vérifiez que l'application est déployée soit sans aucune métadonnée de contrôle de source, y compris les dossiers .git ou .svn, soit de manière à ce que ces dossiers soient inaccessibles à la fois en externe et à l'application elle-même.True✓True✓True✓V13.4.22Vérifiez que les modes de débogage sont désactivés pour tous les composants dans les environnements de production afin d’éviter l’exposition des fonctionnalités de débogage et la fuite d’informations.FalseTrue✓True✓V13.4.33Vérifiez que les serveurs Web n’exposent pas les listes de répertoires aux clients, sauf si cela est explicitement prévu.FalseTrue✓True✓V13.4.44Vérifiez que l’utilisation de la méthode HTTP TRACE n’est pas prise en charge dans les environnements de production, afin d’éviter toute fuite d’informations potentielle.FalseTrue✓True✓V13.4.55Vérifiez que la documentation (comme pour les API internes) et les endpoints de surveillance ne sont pas exposés, sauf si cela est explicitement prévu.FalseTrue✓True✓V13.4.66Vérifiez que l’application n’expose pas d’informations de version détaillées des composants backend.FalseFalseTrue✓V13.4.77Vérifiez que la couche web est configuré pour servir uniquement les fichiers avec des extensions de fichier spécifiques afin d’éviter toute fuite involontaire d’informations, de configuration et de code source.FalseFalseTrue✓V1414DataProtection des donnéesV14.11Documentation sur la protection des donnéesV14.1.11Vérifiez que toutes les données sensibles créées et traitées par l'application ont été identifiées et classées selon leur niveau de protection. Cela inclut les données uniquement codées et donc facilement déchiffrables, telles que les chaînes Base64 ou la charge utile en texte clair d'un JWT. Les niveaux de protection doivent tenir compte des réglementations et normes de protection des données et de confidentialité auxquelles l'application est tenue de se conformer.FalseTrue✓True✓V14.1.22Vérifier que tous les niveaux de protection des données sensibles sont assortis d'un ensemble documenté d'exigences de protection. Cela doit inclure (sans s'y limiter) les exigences relatives au chiffrement général, à la vérification de l'intégrité, à la conservation, à la journalisation des données, aux contrôles d'accès aux données sensibles dans les journaux, au chiffrement au niveau de la base de données, aux technologies de confidentialité et de renforcement de la confidentialité à utiliser, ainsi qu'aux autres exigences de confidentialité.FalseTrue✓True✓V14.22Protection générale des donnéesV14.2.11Vérifiez que les données sensibles sont uniquement envoyées au serveur dans les champs de corps ou d’en-tête du message HTTP, et que l’URL et la chaîne de requête ne contiennent pas d’informations sensibles, telles qu’une clé API ou un jeton de session.True✓True✓True✓V14.2.22Vérifiez que l’application empêche la mise en cache des données sensibles dans les composants du serveur, tels que les équilibreurs de charge et les caches d’application, ou garantit que les données sont purgées en toute sécurité après utilisation.FalseTrue✓True✓V14.2.33Vérifiez que les données sensibles définies ne sont pas envoyées à des parties non fiables (par exemple, des trackers d'utilisateurs) pour empêcher la collecte indésirable de données en dehors du contrôle de l'application.FalseTrue✓True✓V14.2.44Vérifiez que les contrôles autour des données sensibles liés au chiffrement, à la vérification de l'intégrité, à la conservation, à la manière dont les données doivent être enregistrées, aux contrôles d'accès autour des données sensibles dans les journaux, à la confidentialité et aux technologies d'amélioration de la confidentialité, sont mis en œuvre comme défini dans la documentation pour le niveau de protection des données spécifiques.FalseTrue✓True✓V14.2.55Vérifiez que les mécanismes de mise en cache sont configurés pour ne mettre en cache que les réponses dont le type de contenu est conforme à la ressource et qui ne contiennent pas de contenu sensible et dynamique. Le serveur web doit renvoyer une réponse 404 ou 302 lors de l'accès à un fichier inexistant plutôt qu'un fichier valide différent. Cela devrait empêcher les attaques par empoisonnement de cache web.FalseFalseTrue✓V14.2.66Vérifiez que l'application ne renvoie que les données sensibles minimales requises pour son fonctionnement. Par exemple, ne renvoyez que certains chiffres d'un numéro de carte de crédit, et non le numéro complet. Si les données complètes sont requises, elles doivent être masquées dans l'interface utilisateur, sauf si l'utilisateur les consulte spécifiquement.FalseFalseTrue✓V14.2.77Vérifiez que les informations sensibles sont soumises à une classification de conservation des données, en veillant à ce que les données obsolètes ou inutiles soient supprimées automatiquement, selon un calendrier défini ou selon les besoins de la situation.FalseFalseTrue✓V14.2.88Vérifiez que les informations sensibles sont supprimées des métadonnées des fichiers soumis par l'utilisateur, sauf si le stockage est autorisé par l'utilisateur.FalseFalseTrue✓V14.33Protection des données côté clientV14.3.11Vérifiez que les données authentifiées sont effacées du stockage client, comme le DOM du navigateur, après la fin du client ou de la session. Le champ d'en-tête de réponse HTTP « Clear-Site-Data » peut être utile, mais le côté client devrait également pouvoir effectuer la correction si la connexion au serveur n'est pas disponible à la fin de la session.True✓True✓True✓V14.3.22Vérifiez que l'application définit suffisamment de champs d'en-tête de réponse HTTP anti-caching (c'est-à-dire Cache-Control : no-store) afin que les données sensibles ne soient pas mises en cache dans les navigateurs.FalseTrue✓True✓V14.3.33Vérifiez que les données stockées dans le stockage du navigateur (telles que localStorage, sessionStorage, IndexedDB ou les cookies) ne contiennent pas de données sensibles, à l'exception des jetons de session.FalseTrue✓True✓V1515SecureDéveloppement et architecture sécurisésV15.11Documentation sur le développement et l'architecture sécurisésV15.1.11Vérifiez que la documentation de l'application définit les délais de correction basés sur les risques pour les versions de composants tiers présentant des vulnérabilités et pour la mise à jour des bibliothèques en général, afin de minimiser les risques liés à ces composants.True✓True✓True✓V15.1.22Vérifiez qu'un catalogue d'inventaire, tel qu'une nomenclature logicielle (SBOM), est conservé pour toutes les bibliothèques tierces utilisées, y compris en vérifiant que les composants proviennent de référentiels prédéfinis, fiables et continuellement maintenus.FalseTrue✓True✓V15.1.33Vérifiez que la documentation de l'application identifie les fonctionnalités consommatrices en temps ou gourmandes en ressources. Elle doit notamment indiquer comment prévenir une perte de disponibilité due à une utilisation excessive de ces fonctionnalités et éviter que la génération d'une réponse ne prenne plus de temps que le délai d'expiration du consommateur. Les mesures de protection potentielles peuvent inclure le traitement asynchrone, l'utilisation de files d'attente et la limitation des processus parallèles par utilisateur et par application.FalseTrue✓True✓V15.1.44Vérifiez que la documentation de l’application met en évidence les bibliothèques tierces qui sont considérées comme des « composants à risque ».FalseFalseTrue✓V15.1.55Vérifiez que la documentation de l’application met en évidence les parties de l’application où des « fonctionnalités dangereuses » sont utilisées.FalseFalseTrue✓V15.22Architecture de sécurité et dépendancesV15.2.11Vérifiez que l’application contient uniquement des composants qui n’ont pas dépassé les délais de mise à jour et de correction documentés.True✓True✓True✓V15.2.22Vérifiez que l'application a mis en œuvre des défenses contre la perte de disponibilité due à des fonctionnalités qui prennent du temps ou qui nécessitent des ressources, sur la base des décisions et stratégies de sécurité documentées à cet effet.FalseTrue✓True✓V15.2.33Vérifiez que l'environnement de production inclut uniquement les fonctionnalités nécessaires au fonctionnement de l'application et n'expose pas de fonctionnalités superflues telles que du code de test, des exemples d'extraits et des fonctionnalités de développement.FalseTrue✓True✓V15.2.44Vérifiez que les composants tiers et toutes leurs dépendances transitives sont inclus à partir du référentiel attendu, qu'il soit détenu en interne ou qu'il s'agisse d'une source externe, et qu'il n'y a aucun risque d'attaque par confusion de dépendances.FalseFalseTrue✓V15.2.55Vérifiez que l'application implémente des protections supplémentaires autour des parties documentées comme contenant des « fonctionnalités dangereuses » ou utilisant des bibliothèques tierces considérées comme des « composants à risque ». Cela peut inclure des techniques telles que le sandboxing, l'encapsulation, la conteneurisation ou l'isolation au niveau du réseau pour retarder et dissuader les attaquants qui compromettent une partie de l'application de se propager ailleurs.FalseFalseTrue✓V15.33Développement défensifV15.3.11Vérifiez que l'application ne renvoie que le sous-ensemble requis de champs d'un objet de données. Par exemple, elle ne doit pas renvoyer un objet de données entier, car certains champs individuels ne doivent pas être accessibles aux utilisateurs.True✓True✓True✓V15.3.22Vérifiez que lorsque le backend de l'application effectue des appels vers des URL externes, il est configuré pour ne pas suivre les redirections, sauf s'il s'agit d'une fonctionnalité prévue.FalseTrue✓True✓V15.3.33Vérifiez que l'application dispose de contre-mesures pour se protéger contre les attaques d'affectation de masse en limitant les champs autorisés par contrôleur et action, par exemple, il n'est pas possible d'insérer ou de mettre à jour une valeur de champ lorsqu'elle n'était pas destinée à faire partie de cette action.FalseTrue✓True✓V15.3.44Vérifiez que tous les composants proxy et middleware transfèrent correctement l'adresse IP d'origine de l'utilisateur à l'aide de champs de données fiables qui ne peuvent pas être manipulés par l'utilisateur final, et que l'application et le serveur Web utilisent cette valeur correcte pour la journalisation et les décisions de sécurité telles que la limitation du débit, en tenant compte du fait que même l'adresse IP d'origine peut ne pas être fiable en raison d'adresses IP dynamiques, de VPN ou de pare-feu d'entreprise.FalseTrue✓True✓V15.3.55Vérifiez que l'application garantit explicitement que les variables sont du type correct et effectue des opérations d'égalité et de comparaison strictes. Cela permet d'éviter les vulnérabilités liées à la confusion de types, causées par des hypothèses du code de l'application sur le type d'une variable.FalseTrue✓True✓V15.3.66Vérifiez que le code JavaScript est écrit de manière à éviter la pollution du prototype, par exemple en utilisant Set() ou Map() au lieu de littéraux d'objet.FalseTrue✓True✓V15.3.77Vérifiez que l'application dispose de défenses contre les attaques de pollution des paramètres HTTP, en particulier si le Framework d'application ne fait aucune distinction quant à la source des paramètres de requête (chaîne de requête, paramètres de corps, cookies ou champs d'en-tête).FalseTrue✓True✓V15.44Concurrence sécuriséeV15.4.11Vérifiez que les objets partagés dans le code multithread (tels que les caches, les fichiers ou les objets en mémoire accessibles par plusieurs threads) sont accessibles en toute sécurité à l'aide de types thread-safe et de mécanismes de synchronisation tels que des verrous ou des sémaphores pour éviter les conditions de concurrence et la corruption des données.FalseFalseTrue✓V15.4.22Vérifiez que les vérifications de l'état d'une ressource, comme son existence ou ses autorisations, et des actions qui en dépendent, sont effectuées en une seule opération atomique afin d'éviter les situations de concurrence entre le moment de la vérification et le moment de l'utilisation (TOCTOU). Par exemple, vérifier l'existence d'un fichier avant de l'ouvrir ou l'accès d'un utilisateur avant de l'accorder.FalseFalseTrue✓V15.4.33Vérifiez que les verrous sont utilisés de manière cohérente pour éviter que les threads ne se bloquent, que ce soit en s'attendant les uns les autres ou en réessayant sans fin, et que la logique de verrouillage reste dans le code responsable de la gestion de la ressource pour garantir que les verrous ne peuvent pas être modifiés par inadvertance ou de manière malveillante par des classes ou du code externes.FalseFalseTrue✓V15.4.44Vérifiez que les politiques d'allocation des ressources empêchent la saturation de threads en garantissant un accès équitable aux ressources, par exemple en exploitant les pools de threads, permettant aux threads de priorité inférieure de continuer dans un délai raisonnable.FalseFalseTrue✓V1616SecurityJournalisation de sécurité et gestion des erreursV16.11Documentation sur la journalisation de sécuritéV16.1.11Vérifiez qu'il existe un inventaire documentant la journalisation effectuée à chaque couche de la pile technologique de l'application, les événements enregistrés, les formats de journal, l'endroit où cette journalisation est stockée, la manière dont elle est utilisée, la manière dont l'accès à celle-ci est contrôlé et la durée de conservation des journaux.FalseTrue✓True✓V16.22Journalisation généraleV16.2.11Vérifiez que chaque entrée de journal inclut les métadonnées nécessaires (telles que quand, où, qui, quoi) qui permettraient une enquête détaillée sur la chronologie lorsqu'un événement se produit.FalseTrue✓True✓V16.2.22Vérifiez que les sources de temps de tous les composants de journalisation sont synchronisées et que les horodatages des métadonnées des événements de sécurité utilisent le temps UTC ou incluent un décalage horaire explicite. L'UTC est recommandé pour garantir la cohérence entre les systèmes distribués et éviter toute confusion lors du passage à l'heure d'été.FalseTrue✓True✓V16.2.33Vérifiez que l’application stocke ou diffuse uniquement les journaux vers les fichiers et services documentés dans l’inventaire des journaux.FalseTrue✓True✓V16.2.44Vérifiez que les journaux peuvent être lus et corrélés par le processeur de journaux utilisé, de préférence en utilisant un format de journalisation commun.FalseTrue✓True✓V16.2.55Vérifiez que l'application applique la journalisation en fonction du niveau de protection des données lors de la journalisation de données sensibles. Par exemple, certaines données, comme les identifiants ou les informations de paiement, peuvent être interdites. D'autres données, comme les jetons de session, ne peuvent être enregistrées que par hachage ou masquage, en totalité ou en partie.FalseTrue✓True✓V16.33Événements de sécuritéV16.3.11Vérifiez que toutes les opérations d'authentification sont enregistrées, y compris les tentatives réussies et infructueuses. Des métadonnées supplémentaires, telles que le type d'authentification ou les facteurs utilisés, doivent également être collectées.FalseTrue✓True✓V16.3.22Vérifier que les tentatives d'autorisation infructueuses sont logguées. Pour le niveau 3, cela doit inclure la journalisation de toutes les décisions d'autorisation, y compris lors de l'accès à des données sensibles (sans journalisation des données sensibles elles-mêmes).FalseTrue✓True✓V16.3.33Vérifiez que l'application enregistre les événements de sécurité définis dans la documentation et enregistre également les tentatives de contournement des contrôles de sécurité, tels que la validation des entrées, la logique métier et l'anti-automatisation.FalseTrue✓True✓V16.3.44Vérifiez que l’application enregistre les erreurs inattendues et les échecs de contrôle de sécurité tels que les échecs TLS du backend.FalseTrue✓True✓V16.44Protection des journauxV16.4.11Vérifiez que tous les composants de journalisation codent correctement les données pour empêcher l’injection de journaux.FalseTrue✓True✓V16.4.22Vérifiez que les journaux sont protégés contre tout accès non autorisé et ne peuvent pas être modifiés.FalseTrue✓True✓V16.4.33Vérifiez que les journaux sont transmis de manière sécurisée à un système logique distinct pour analyse, détection, alerte et remontée des informations. L'objectif est de garantir qu'en cas de violation de l'application, les journaux ne seront pas compromis.FalseTrue✓True✓V16.55Gestion des erreursV16.5.11Vérifiez qu'un message générique est renvoyé au consommateur lorsqu'une erreur inattendue ou sensible à la sécurité se produit, garantissant ainsi l'absence d'exposition de données système internes sensibles telles que les traces de pile, les requêtes, les clés secrètes et les jetons.FalseTrue✓True✓V16.5.22Vérifiez que l'application continue de fonctionner en toute sécurité lorsque l'accès aux ressources externes échoue, par exemple, en utilisant des modèles tels que des disjoncteurs ou une dégradation progressive.FalseTrue✓True✓V16.5.33Vérifiez que l'application échoue proprement et sécurisée, y compris lorsqu'une exception se produit, en évitant les accès en cas d'erreur telles que le traitement d'une transaction malgré les erreurs résultant de la logique de validation.FalseTrue✓True✓V16.5.44Vérifiez qu'un gestionnaire d'erreurs de « dernier recours » est défini pour intercepter toutes les exceptions non gérées. Cela permet d'éviter la perte des informations d'erreur qui doivent être loguées dans les fichiers journaux et de garantir qu'une erreur ne paralyse pas l'ensemble du processus applicatif, entraînant une perte de disponibilité.FalseFalseTrue✓V1717WebRTCWebRTCV17.11Serveur TURNV17.1.11Vérifiez que le service TURN (Traversal Using Relays around NAT) autorise uniquement l'accès aux adresses IP non réservées à des fins spécifiques (par exemple, réseaux internes, diffusion, bouclage). Notez que cela s'applique aux adresses IPv4 et IPv6.FalseTrue✓True✓V17.1.22Vérifiez que le service Traversal Using Relays around NAT (TURN) n'est pas susceptible d'épuiser ses ressources lorsque des utilisateurs légitimes tentent d'ouvrir un grand nombre de ports sur le serveur TURN.FalseFalseTrue✓V17.22MédiaV17.2.11Vérifiez que la clé du certificat Datagram Transport Layer Security (DTLS) est gérée et protégée conformément à la politique documentée de gestion des clés cryptographiques.FalseTrue✓True✓V17.2.22Vérifiez que le serveur multimédia est configuré pour utiliser et prendre en charge les suites de chiffrement DTLS (Datagram Transport Layer Security) approuvées et un profil de protection sécurisé pour l'extension DTLS pour l'établissement de clés pour le protocole de transport en temps réel sécurisé (DTLS-SRTP).FalseTrue✓True✓V17.2.33Vérifiez que l'authentification SRTP (Secure Real-time Transport Protocol) est vérifiée sur le serveur multimédia pour empêcher les attaques par injection RTP (Real-time Transport Protocol) d'entraîner une condition de déni de service ou l'insertion de médias audio ou vidéo dans les flux multimédias.FalseTrue✓True✓V17.2.44Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant lorsqu'il rencontre des paquets SRTP (Secure Real-time Transport Protocol) mal formés.FalseTrue✓True✓V17.2.55Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.FalseFalseTrue✓V17.2.66Vérifiez que le serveur multimédia n'est pas sensible à la vulnérabilité de condition de concurrence « ClientHello » dans Datagram Transport Layer Security (DTLS) en vérifiant si le serveur multimédia est publiquement connu comme étant vulnérable ou en effectuant le test de condition de concurrence.FalseFalseTrue✓V17.2.77Vérifiez que tous les mécanismes d'enregistrement audio ou vidéo associés au serveur multimédia sont en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.FalseFalseTrue✓V17.2.88Vérifiez que le certificat Datagram Transport Layer Security (DTLS) est vérifié par rapport à l'attribut d'empreinte cryptographique du protocole de description de session (SDP), en mettant fin au flux multimédia si la vérification échoue, pour garantir l'authenticité du flux multimédia.FalseFalseTrue✓V17.33SignalisationV17.3.11Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation entrants légitimes lors d'une attaque par saturation. Cela peut être réalisé en implémentant une limitation de débit au niveau de la signalisation.FalseTrue✓True✓V17.3.22Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation légitimes en cas de message mal formé susceptible de provoquer un déni de service. Cela peut inclure la validation des entrées, la gestion sécurisée des dépassements d'entiers, la prévention des dépassements de tampon et l'utilisation d'autres techniques robustes de gestion des erreurs.FalseTrue✓True✓ diff --git a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.xml b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.xml deleted file mode 100644 index 1dfb448a78..0000000000 --- a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.xml +++ /dev/null @@ -1 +0,0 @@ -Application Security Verification Standard ProjectASVS5.0.0The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.V11EncodingEncodage et nettoyageV1.11Architecture d'encodage et de nettoyageV1.1.11Vérifiez que l'entrée est décodée ou non échappée vers une forme canonique une seule fois, elle n'est décodée que lorsque des données codées sous cette forme sont attendues, et que cela est fait avant de traiter davantage l'entrée, par exemple, elle n'est pas effectuée après la validation ou la désinfection de l'entrée.2V1.1.22Vérifiez que l'application effectue l'encodage et l'échappement de sortie soit comme étape finale avant d'être utilisée par l'interpréteur pour lequel elle est destinée, soit par l'interpréteur lui-même.2V1.22Prévention des injectionsV1.2.11Vérifiez que l'encodage de sortie d'une réponse HTTP, d'un document HTML ou d'un document XML est pertinent pour le contexte requis, comme l'encodage des caractères pertinents pour les éléments HTML, les attributs HTML, les commentaires HTML, les CSS ou les champs d'en-tête HTTP, pour éviter de modifier la structure du message ou du document.1V1.2.22Vérifiez que, lors de la création dynamique d'URL, les données non fiables sont encodées en fonction de leur contexte (par exemple, encodage d'URL ou encodage base64url pour les paramètres de requête ou de chemin). Assurez-vous que seuls les schémas d'URL sûrs sont autorisés (par exemple, interdire javascript: ou data:).1V1.2.33Vérifiez que l'encodage ou l'échappement de sortie est utilisé lors de la création dynamique de contenu JavaScript (y compris JSON), pour éviter de modifier la structure du message ou du document (pour éviter l'injection JavaScript et JSON).1V1.2.44Vérifiez que la sélection de données ou les requêtes de base de données (par exemple, SQL, HQL, NoSQL, Cypher) utilisent des requêtes paramétrées, des ORM, des Framework d'entités ou sont protégées contre les injections SQL et autres attaques par injection de base de données. Ceci est également pertinent lors de l'écriture de procédures stockées.1V1.2.55Vérifiez que l’application protège contre l’injection de commandes du système d’exploitation et que les appels du système d’exploitation utilisent des requêtes du système d’exploitation paramétrées ou utilisent un encodage de sortie de ligne de commande contextuelle.1V1.2.66Vérifiez que l’application protège contre les vulnérabilités d’injection LDAP ou que des contrôles de sécurité spécifiques pour empêcher l’injection LDAP ont été mis en œuvre.2V1.2.77Vérifiez que l’application est protégée contre les attaques par injection XPath en utilisant la paramétrisation des requêtes ou des requêtes précompilées.2V1.2.88Vérifiez que les processeurs LaTeX sont configurés de manière sécurisée (par exemple, en n'utilisant pas l'indicateur « --shell-escape ») et qu'une liste d’autorisations de commandes est utilisée pour empêcher les attaques par injection LaTeX.2V1.2.99Vérifiez que l'application échappe les caractères spéciaux dans les expressions régulières (généralement à l'aide d'une barre oblique inverse) pour éviter qu'ils ne soient mal interprétés comme des métacaractères.2V1.2.1010Vérifiez que l'application est protégée contre les injections CSV et injections de formules. L'application doit respecter les règles d'échappement définies dans les sections 2.6 et 2.7 de la RFC 4180 lors de l'export de contenu CSV. De plus, lors de l'export au format CSV ou vers d'autres formats de tableur (tels que XLS, XLSX ou ODF), les caractères spéciaux (notamment « = », « + », « - », « @ », « \t » (tabulation) et « \0 » (caractère null)) doivent être protégés par une apostrophe s'ils apparaissent en premier dans une valeur de champ.3V1.33NettoyageV1.3.11Vérifiez que toutes les entrées HTML non fiables provenant d'éditeurs WYSIWYG ou similaires sont nettoyées à l'aide d'une bibliothèque ou d'une fonctionnalité de Framework de nettoyage HTML bien connue et sécurisée.1V1.3.22Vérifiez que l'application évite d'utiliser eval() ou d'autres fonctionnalités d'exécution de code dynamique telles que Spring Expression Language (SpEL). En l'absence d'alternative, toute saisie utilisateur incluse doit être nettoyée avant d'être exécutée.1V1.3.33Vérifiez que les données transmises à un contexte potentiellement dangereux sont préalablement nettoyées pour appliquer des mesures de sécurité, telles qu'autoriser uniquement des caractères sûrs pour ce contexte et raccourcir des entrées trop longues.2V1.3.44Vérifiez que le contenu Scalable Vector Graphics (SVG) scriptable fourni par l'utilisateur est validé ou nettoyé pour contenir uniquement des balises et des attributs (tels que des graphiques de dessin) qui sont sûrs pour l'application, par exemple, ne contiennent pas de scripts et d'objets étrangers.2V1.3.55Vérifiez que l'application nettoie ou désactive le contenu du langage de modèle d'expression ou de script fourni par l'utilisateur, tel que les feuilles de style CSS, le Markdown ou XSL, BBCode ou similaire.2V1.3.66Vérifiez que l'application protège contre les attaques de falsification de requête côté serveur (SSRF), en validant les données non fiables par rapport à une liste d'autorisation de protocoles, de domaines, de chemins et de ports et en nettoyant les caractères potentiellement dangereux avant d'utiliser les données pour appeler un autre service.2V1.3.77Vérifiez que l'application se protège contre les attaques par injection de modèles en interdisant la création de modèles basés sur des entrées non fiables. En l'absence d'alternative, toute entrée non fiable incluse dynamiquement lors de la création du modèle doit être nettoyée ou rigoureusement validée.2V1.3.88Vérifiez que l’application nettoie correctement les entrées non fiables avant utilisation dans les requêtes Java Naming and Directory Interface (JNDI) et que JNDI est configuré de manière sécurisée pour empêcher les attaques par injection JNDI.2V1.3.99Vérifiez que l’application nettoie le contenu avant qu’il ne soit envoyé à memcache pour éviter les attaques par injection.2V1.3.1010Vérifiez que les chaînes de format susceptibles d'être résolues de manière inattendue ou malveillante lors de leur utilisation sont nettoyées avant d'être traitées.2V1.3.1111Vérifiez que l'application nettoie les entrées utilisateur avant de les transmettre aux systèmes de messagerie pour se protéger contre l'injection SMTP ou IMAP.2V1.3.1212Vérifiez que les expressions régulières sont exemptes d'éléments provoquant "backtracking" exponentiel et assurez-vous que les entrées non fiables sont nettoyées pour atténuer les attaques ReDoS ou Runaway Regex.3V1.44Mémoire, chaine de caractères et code à mémoire non-managéeV1.4.11Vérifiez que l'application utilise des chaînes memory-safe, une copie de mémoire et une arithmétique de pointeur renforcée pour détecter ou empêcher les débordements de pile, de tampon ou de tas.2V1.4.22Vérifiez que les techniques de validation du signe, de la plage et de l’entrée sont utilisées pour éviter les dépassements d’entiers.2V1.4.33Vérifiez que la mémoire et les ressources allouées dynamiquement sont libérées et que les références ou les pointeurs vers la mémoire libérée sont supprimés ou définis à null pour éviter les "dangling pointer" et les vulnérabilités d'utilisation après libération.2V1.55Désérialisation sécuriséeV1.5.11Vérifiez que l'application configure les "parser" XML pour utiliser une configuration restrictive et que les fonctionnalités non sûres telles que la résolution d'entités externes sont désactivées pour empêcher les attaques XML eXternal Entity (XXE).1V1.5.22Vérifiez que la désérialisation des données non fiables garantit une gestion sécurisée des entrées, par exemple en utilisant une liste d'autorisation de types d'objets ou en limitant les types d'objets définis par le client, afin d'empêcher les attaques par désérialisation. Les mécanismes de désérialisation explicitement définis comme non sécurisés ne doivent pas être utilisés avec des entrées non fiables.2V1.5.33Vérifiez que les différents "parser" utilisés dans l'application pour le même type de données (par exemple, les "parser" JSON, les "parser" XML, les "parser" d'URL) effectuent l'analyse de manière cohérente et utilisent le même mécanisme d'encodage de caractères pour éviter des problèmes tels que les vulnérabilités d'interopérabilité JSON ou un comportement d'analyse d'URI ou de fichier différent exploité dans les attaques d'inclusion de fichiers à distance (RFI) ou de falsification de requête côté serveur (SSRF).3V22ValidationValidation et logique métierV2.11Validation et documentation de la logique métierV2.1.11Vérifiez que la documentation de l'application définit des règles de validation des entrées pour vérifier la validité des éléments de données par rapport à la structure attendue. Il peut s'agir de formats de données courants tels que des numéros de carte de crédit, des adresses e-mail ou des numéros de téléphone, ou d'un format de données interne.1V2.1.22Vérifiez que la documentation de l'application définit comment valider la cohérence logique et contextuelle des éléments de données combinés, par exemple en vérifiant que la banlieue et le code postal correspondent.2V2.1.33Vérifiez que les attentes en matière de limites et de validations de la logique métier sont documentées, y compris par utilisateur et globalement dans l'application.2V2.22Validation des entréesV2.2.11Vérifier que les entrées sont validées afin de respecter les attentes métier ou fonctionnelles. Cette validation doit être basée sur une liste de valeurs, de modèles et de plages autorisées, ou sur la comparaison des entrées avec une structure attendue et des limites logiques selon des règles prédéfinies. Pour le niveau 1, cette validation peut se concentrer sur les entrées utilisées pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau 2, elle doit s'appliquer à toutes les entrées.1V2.2.22Vérifiez que l'application est conçue pour appliquer la validation des entrées au niveau d'une couche de service de confiance. Bien que la validation côté client améliore l'ergonomie et doit être encouragée, elle ne doit pas être considérée comme un contrôle de sécurité.1V2.2.33Vérifiez que l’application garantit que les combinaisons d’éléments de données associés sont raisonnables selon les règles prédéfinies.2V2.33Sécurité de la logique métierV2.3.11Vérifiez que l’application traitera uniquement les flux de logique métier pour le même utilisateur dans l’ordre séquentiel attendu et sans sauter d’étapes.1V2.3.22Vérifiez que les limites de la logique métier sont implémentées conformément à la documentation de l'application, afin d'éviter que des failles de la logique métier ne soient pas exploitées.2V2.3.33Vérifiez que les transactions sont utilisées au niveau de la logique métier de telle sorte qu'une opération de logique métier réussisse dans son intégralité ou qu'elle soit restaurée à l'état correct précédent.2V2.3.44Vérifiez que les mécanismes de verrouillage au niveau de la logique métier sont utilisés pour garantir que les ressources en quantité limitée (telles que les sièges de théâtre ou les créneaux de livraison) ne peuvent pas être réservées deux fois en manipulant la logique de l'application.2V2.3.55Vérifiez que les flux logiques métier à forte valeur ajoutée nécessitent l'approbation de plusieurs utilisateurs afin d'éviter toute action non autorisée ou accidentelle. Cela peut inclure, sans s'y limiter, les transferts monétaires importants, les approbations de contrats, l'accès à des informations classifiées ou les contournements de sécurité dans le secteur manufacturier.3V2.44Anti-automatisationV2.4.11Vérifiez que des contrôles anti-automatisation sont en place pour protéger contre les appels excessifs aux fonctions d'application qui pourraient conduire à l'exfiltration de données, à la création de données inutiles, à l'épuisement des quotas, aux violations de limites de débit, au déni de service ou à la surutilisation de ressources coûteuses.2V2.4.22Vérifiez que les flux logiques métier nécessitent un timing humain réaliste, évitant ainsi des soumissions de transactions excessivement rapides.3V33WebSécurité du frontend WebV3.11Documentation sur la sécurité du frontend WebV3.1.11Vérifiez que la documentation de l'application indique les fonctionnalités de sécurité attendues que les navigateurs utilisant l'application doivent prendre en charge (telles que HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) et autres mécanismes de sécurité HTTP pertinents). Elle doit également définir le comportement de l'application lorsque certaines de ces fonctionnalités ne sont pas disponibles (par exemple, avertir l'utilisateur ou bloquer l'accès).3V3.22Interprétation non intentionnelle du contenuV3.2.11Vérifiez que des contrôles de sécurité sont en place pour empêcher les navigateurs d'afficher du contenu ou des fonctionnalités dans les réponses HTTP dans un contexte incorrect (par exemple, lorsqu'une API, un fichier téléchargé par l'utilisateur ou une autre ressource est demandée directement). Les contrôles possibles peuvent inclure : ne pas transmettre le contenu sauf si les champs d'en-tête de requête HTTP (tels que Sec-Fetch-\*) indiquent qu'il s'agit du contexte correct, utiliser la directive sandbox du champ d'en-tête Content-Security-Policy ou utiliser le type de disposition de pièce jointe dans le champ d'en-tête Content-Disposition.1V3.2.22Vérifiez que le contenu destiné à être affiché sous forme de texte, plutôt que rendu sous forme de HTML, est géré à l'aide de fonctions de rendu sécurisées (telles que createTextNode ou textContent) pour empêcher l'exécution involontaire de contenu tel que HTML ou JavaScript.1V3.2.33Vérifiez que l'application évite l'écrasement du DOM lors de l'utilisation de JavaScript côté client en utilisant des déclarations de variables explicites, en effectuant une vérification de type stricte, en évitant de stocker des variables globales sur l'objet document et en implémentant l'isolation de l'espace de nommage.3V3.33Configuration des cookiesV3.3.11Vérifiez que les cookies ont l'attribut « Secure » ​​défini et si le préfixe « \__Host- » n'est pas utilisé pour le nom du cookie, le préfixe « __Secure- » doit être utilisé pour le nom du cookie.1V3.3.22Vérifiez que la valeur de l'attribut « SameSite » de chaque cookie est définie en fonction de l'objectif du cookie, afin de limiter l'exposition aux attaques de réparation de l'interface utilisateur et aux attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).2V3.3.33Vérifiez que les cookies ont le préfixe « __Host- » pour le nom du cookie, sauf s'ils sont explicitement conçus pour être partagés avec d'autres hôtes.2V3.3.44Vérifiez que si la valeur d'un cookie n'est pas censée être accessible aux scripts côté client (comme un jeton de session), le cookie doit avoir l'attribut « HttpOnly » défini et la même valeur (par exemple, un jeton de session) ne doit être transférée au client que via le champ d'en-tête « Set-Cookie ».2V3.3.55Vérifiez que lorsque l'application écrit un cookie, la longueur combinée du nom et de la valeur du cookie ne dépasse pas 4 096 octets. Les cookies trop volumineux ne seront pas stockés par le navigateur et ne seront donc pas envoyés avec les requêtes, empêchant ainsi l'utilisateur d'utiliser les fonctionnalités de l'application qui reposent sur ce cookie.3V3.44En-têtes du mécanisme de sécurité du navigateurV3.4.11Vérifiez qu'un champ d'en-tête Strict-Transport-Security est inclus dans toutes les réponses afin d'appliquer une politique HTTP Strict Transport Security (HSTS). Une durée maximale d'au moins un an doit être définie, et pour les niveaux L2 et supérieurs, la politique doit également s'appliquer à tous les sous-domaines.1V3.4.22Vérifiez que le champ d'en-tête Access-Control-Allow-Origin du partage de ressources cross-origine (CORS) est une valeur fixe de l'application ou, si la valeur du champ d'en-tête de requête HTTP Origin est utilisée, qu'elle est validée par rapport à une liste d'origines approuvées. Si « Access-Control-Allow-Origin: * » doit être utilisé, vérifiez que la réponse ne contient aucune information sensible.1V3.4.33Vérifiez que les réponses HTTP incluent un champ d'en-tête de réponse Content-Security-Policy qui définit des directives garantissant que le navigateur charge et exécute uniquement du contenu ou des ressources fiables, afin de limiter l'exécution de JavaScript malveillant. Au minimum, une politique globale doit être utilisée, incluant les directives object-src 'none' et base-uri 'none', et définissant soit une lliste d’autorisations, soit des valeurs nonces ou des hachages. Pour une application L3, une politique par réponse avec des valeurs nonces ou des hachages doit être définie.2V3.4.44Vérifiez que toutes les réponses HTTP contiennent un champ d'en-tête « X-Content-Type-Options: nosniff ». Cela indique aux navigateurs de ne pas utiliser l'analyse de contenu ni la détection du type MIME pour la réponse donnée, et d'exiger que la valeur du champ d'en-tête « Content-Type » de la réponse corresponde à la ressource de destination. Par exemple, la réponse à une demande de style n'est acceptée que si le type de contenu de la réponse est « text/css ». Cela permet également au navigateur d'utiliser la fonctionnalité de blocage de lecture inter-origines (CORB).2V3.4.55Vérifiez que l'application définit une politique de référencement afin d'empêcher la fuite de données techniquement sensibles vers des services tiers via le champ d'en-tête de requête HTTP « Referer ». Cela peut être effectué via le champ d'en-tête de réponse HTTP « Referrer-Policy » ou via les attributs d'élément HTML. Les données sensibles peuvent inclure le chemin d'accès et les données de requête dans l'URL, et pour les applications internes non publiques, le nom d'hôte.2V3.4.66Vérifiez que l'application Web utilise la directive frame-ancestors du champ d'en-tête Content-Security-Policy pour chaque réponse HTTP afin de garantir qu'elle ne peut pas être intégrée par défaut et que l'intégration de ressources spécifiques n'est autorisée qu'en cas de nécessité. Notez que le champ d'en-tête X-Frame-Options, bien que pris en charge par les navigateurs, est obsolète et n'est pas forcément fiable.2V3.4.77Vérifiez que le champ d’en-tête Content-Security-Policy spécifie un emplacement pour signaler les violations.3V3.4.88Vérifiez que toutes les réponses HTTP qui lancent le rendu d'un document (comme les réponses de type text/html) incluent le champ d'en-tête 'Cross-Origin-Opener-Policy' avec la directive 'same-origin' ou s'ame-origin-allow-popups', selon les besoins. Cela empêche les attaques abusant de l'accès partagé aux objets Window, telles que le tabnabbing et le comptage d'images.3V3.55Séparation de l'origine du navigateurV3.5.11Vérifiez que, si l'application ne s'appuie pas sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher les requêtes inter-origines non autorisées d'utiliser des fonctionnalités sensibles, ces requêtes sont validées afin de garantir leur origine. Cela peut se faire en utilisant et en validant des jetons anti-falsification ou en exigeant des champs d'en-tête HTTP supplémentaires qui ne sont pas des champs d'en-tête de requête CORS safelist. Ceci permet de se protéger contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).1V3.5.22Vérifiez que, si l'application s'appuie sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher l'utilisation inter-origines non autorisée de fonctionnalités sensibles, il est impossible d'appeler la fonctionnalité avec une requête qui ne déclenche pas de requête de pré-vérification cross-origin CORS. Cela peut nécessiter de vérifier les valeurs des champs d'en-tête de requête 'Origin' et 'Content-Type' ou d'utiliser un champ d'en-tête supplémentaire qui n'est pas un champ d'en-tête de la liste de sécurité CORS.1V3.5.33Vérifiez que les requêtes HTTP destinées aux fonctionnalités sensibles utilisent des méthodes HTTP appropriées, telles que POST, PUT, PATCH ou DELETE, et non des méthodes définies comme « sûres » par la spécification HTTP, telles que HEAD, OPTIONS ou GET. Une validation stricte des champs d'en-tête de requête Sec-Fetch-* peut également être utilisée pour garantir que la requête ne provient pas d'un appel inter-origines inapproprié, d'une requête de navigation ou d'un chargement de ressources (comme une source d'image) inattendu.1V3.5.44Vérifiez que des applications distinctes sont hébergées sur des noms d'hôte différents pour tirer parti des restrictions fournies par la politique de même origine, y compris la manière dont les documents ou scripts chargés par une origine peuvent interagir avec les ressources d'une autre origine et les restrictions basées sur le nom d'hôte sur les cookies.2V3.5.55Vérifiez que les messages reçus par l'interface postMessage sont rejetés si l'origine du message n'est pas digne de confiance ou si la syntaxe du message n'est pas valide.2V3.5.66Vérifiez que la fonctionnalité JSONP n'est activée nulle part dans l'application pour éviter les attaques Cross-Site Script Inclusion (XSSI).3V3.5.77Vérifiez que les données nécessitant une autorisation ne sont pas incluses dans les réponses des ressources de script, comme les fichiers JavaScript, pour empêcher les attaques par inclusion de script intersite (XSSI).3V3.5.88Vérifiez que les ressources authentifiées (telles que les images, les vidéos, les scripts et autres documents) peuvent être chargées ou intégrées pour le compte de l'utilisateur uniquement lorsque cela est prévu. Cela peut être réalisé en validant strictement les champs d'en-tête de requête HTTP Sec-Fetch-* afin de garantir que la requête ne provient pas d'un appel cross-origin inapproprié, ou en définissant un champ d'en-tête de réponse HTTP Cross-Origin-Resource-Policy restrictif pour indiquer au navigateur de bloquer le contenu renvoyé.3V3.66Intégrité des ressources externesV3.6.11Vérifiez que les ressources côté client, telles que les bibliothèques JavaScript, les feuilles de style CSS ou les polices web, sont hébergées en externe (par exemple, sur un réseau de diffusion de contenu) uniquement si la ressource est statique et versionnée, et si l'intégrité des sous-ressources (SRI) est utilisée pour valider l'intégrité de la ressource. Si cela n'est pas possible, une décision de sécurité documentée doit justifier cette décision pour chaque ressource.3V3.77Autres considérations sur la sécurité du navigateurV3.7.11Vérifiez que l'application utilise uniquement des technologies côté client toujours prises en charge et considérées comme sécurisées. Parmi les technologies qui ne répondent pas à cette exigence figurent les plugins NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL ou les applets Java côté client.2V3.7.22Vérifiez que l'application redirigera automatiquement l'utilisateur vers un nom d'hôte ou un domaine différent (qui n'est pas contrôlé par l'application) uniquement lorsque la destination apparaît sur une liste d'autorisation.2V3.7.33Vérifiez que le domaine de premier niveau de l'application (par exemple, site.tld) ​​est ajouté à la liste de préchargement publique pour HTTP Strict Transport Security (HSTS). Cela garantit que l'utilisation de TLS pour l'application est intégrée directement dans les principaux navigateurs, plutôt que de dépendre uniquement du champ d'en-tête de réponse Strict-Transport-Security.3V3.7.44Vérifiez que l'application affiche une notification lorsque l'utilisateur est redirigé vers une URL hors du contrôle de l'application, avec une option pour annuler la navigation.3V3.7.55Vérifiez que l'application se comporte comme documenté (par exemple, en avertissant l'utilisateur ou en bloquant l'accès) si le navigateur utilisé pour accéder à l'application ne prend pas en charge les fonctionnalités de sécurité attendues.3V44APIAPI et service WebV4.11Sécurité du service Web génériqueV4.1.11Vérifiez que chaque réponse HTTP avec un corps de message contient un champ d'en-tête Content-Type qui correspond au contenu réel de la réponse, y compris le paramètre charset pour spécifier un codage de caractères sécurisé (par exemple, UTF-8, ISO-8859-1) conformément aux types de médias IANA, tels que « text/ », « /+xml » et « /xml ».1V4.1.22Vérifiez que seuls les terminaux utilisateurs (destinés à l'accès manuel via un navigateur web) redirigent automatiquement de HTTP vers HTTPS, tandis que les autres services ou terminaux n'implémentent pas de redirections transparentes. Cela permet d'éviter qu'un client envoie par erreur des requêtes HTTP non chiffrées, mais que, comme ces requêtes sont automatiquement redirigées vers HTTPS, la fuite de données sensibles passe inaperçue.2V4.1.33Vérifiez que tout champ d'en-tête HTTP utilisé par l'application et défini par une couche intermédiaire, telle qu'un équilibreur de charge, un proxy web ou un service backend-for-frontend, ne peut pas être remplacé par l'utilisateur final. Les exemples d'en-têtes peuvent inclure X-Real-IP, X-Forwarded-*, ou X-User-ID.2V4.1.44Vérifiez que seules les méthodes HTTP explicitement prises en charge par l'application ou son API (y compris les OPTIONS lors des demandes de contrôle en amont) peuvent être utilisées et que les méthodes inutilisées sont bloquées.3V4.1.55Vérifier que les signatures numériques par message sont utilisées pour fournir une assurance supplémentaire en plus des protections de transport pour les demandes ou les transactions qui sont très sensibles ou qui traversent un certain nombre de systèmes.3V4.22Validation de la structure des messages HTTPV4.2.11Vérifiez que tous les composants de l'application (y compris les équilibreurs de charge, les pares-feux et les serveurs d'applications) déterminent les limites des messages HTTP entrants à l'aide du mécanisme approprié à la version HTTP afin d'empêcher la contrebande de requêtes HTTP. Dans HTTP/1.x, si un champ d'en-tête Transfer-Encoding est présent, l'en-tête Content-Length doit être ignoré conformément à la RFC 2616. Avec HTTP/2 ou HTTP/3, si un champ d'en-tête Content-Length est présent, le récepteur doit s'assurer qu'il est cohérent avec la longueur des trames DATA.2V4.2.22Vérifier que, lors de la génération de messages HTTP, le champ d'en-tête Content-Length n'entre pas en conflit avec la longueur du contenu déterminée par le cadrage du protocole HTTP, afin d'empêcher les attaques de type « request smuggling ».3V4.2.33Vérifiez que l'application n'envoie ni n'accepte de messages HTTP/2 ou HTTP/3 avec des champs d'en-tête spécifiques à la connexion, tels que Transfer-Encoding, afin d'éviter les attaques par fractionnement de la réponse et par injection d'en-tête.3V4.2.44Vérifiez que l'application n'accepte que les requêtes HTTP/2 et HTTP/3 dont les champs et valeurs d'en-tête ne contiennent pas de séquences CR (\r), LF (\n) ou CRLF (\r\n), afin d'éviter les attaques par injection d'en-tête.3V4.2.55Vérifiez que, si l'application (backend ou frontend) construit et envoie des requêtes, elle utilise des mécanismes de validation, d'assainissement ou autres pour éviter de créer des URI (comme pour les appels API) ou des champs d'en-tête de requête HTTP (comme Authorization ou Cookie) qui sont trop longs pour être acceptés par le composant récepteur. Cela pourrait entraîner un déni de service, par exemple lors de l'envoi d'une requête trop longue (par exemple, un long champ d'en-tête de cookie), ce qui fait que le serveur répond toujours avec un statut d'erreur.3V4.33GraphQLV4.3.11Vérifiez qu'une liste d'autorisation de requête, une limitation de profondeur, une limitation de quantité ou une analyse des coûts de requête est utilisée pour empêcher le déni de service (DoS) de GraphQL ou d'expression de la couche données en raison de requêtes imbriquées coûteuses.2V4.3.22Vérifiez que les requêtes d’introspection GraphQL sont désactivées dans l’environnement de production, sauf si l’API GraphQL est destinée à être utilisée par d’autres parties.2V4.44WebSocketV4.4.11Vérifiez que WebSocket sur TLS (WSS) est utilisé pour toutes les connexions WebSocket.1V4.4.22Vérifiez que, lors de la négociation HTTP WebSocket initiale, le champ d’en-tête 'Origin' est vérifié par rapport à une liste d’origines autorisées pour l’application.2V4.4.33Vérifiez que, si la gestion de session standard de l'application ne peut pas être utilisée, des jetons dédiés sont utilisés à cet effet, qui sont conformes aux exigences de sécurité de gestion de session pertinentes.2V4.4.44Vérifiez que les jetons de gestion de session WebSocket dédiés sont initialement obtenus ou validés via la session HTTPS précédemment authentifiée lors de la transition d'une session HTTPS existante vers un canal WebSocket.2V55FileGestion des fichiersV5.11Documentation sur la gestion des fichiersV5.1.11Vérifiez que la documentation définit les types de fichiers autorisés, les extensions de fichiers attendues et la taille maximale (y compris la taille décompressée) pour chaque fonctionnalité de Téléversement. De plus, assurez-vous que la documentation précise comment les fichiers sont sécurisés pour le téléchargement et le traitement des utilisateurs finaux, par exemple le comportement de l'application lorsqu'un fichier malveillant est détecté.2V5.22Téléversement de fichiers et contenuV5.2.11Vérifiez que l'application n'acceptera que des fichiers d'une taille qu'elle peut traiter sans provoquer de perte de performances ou d'attaque par déni de service.1V5.2.22Vérifiez que lorsque l'application accepte un fichier, seul ou dans une archive telle qu'un fichier zip, elle vérifie si l'extension de fichier correspond à une extension attendue et que le contenu correspond au type représenté par l'extension. Cela inclut, sans s'y limiter, la vérification des « octets magiques » initiaux, la réécriture d'images et l'utilisation de bibliothèques spécialisées pour la validation du contenu des fichiers. Pour le niveau L1, cela peut se concentrer uniquement sur les fichiers utilisés pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau L2, cela doit s'appliquer à tous les fichiers acceptés.1V5.2.33Vérifiez que l'application vérifie les fichiers compressés (par exemple, zip, gz, docx, odt) par rapport à la taille maximale autorisée non compressée et au nombre maximal de fichiers avant de décompresser le fichier.2V5.2.44Vérifiez qu'un quota de taille de fichier et un nombre maximal de fichiers par utilisateur sont appliqués pour garantir qu'un seul utilisateur ne puisse pas remplir le stockage avec trop de fichiers ou des fichiers excessivement volumineux.3V5.2.55Vérifiez que l'application n'autorise pas le téléversement de fichiers compressés contenant des liens symboliques, sauf si cela est spécifiquement requis (auquel cas il sera nécessaire d'appliquer une liste d'autorisation des fichiers vers lesquels il est possible de créer des liens symboliques).3V5.2.66Vérifiez que l'application rejette les images téléversées avec une taille de pixel supérieure au maximum autorisé, afin d'éviter les attaques par inondation de pixels.3V5.33Stockage de fichiersV5.3.11Vérifiez que les fichiers téléversés ou générés par une entrée non fiable et stockés dans un dossier public ne sont pas exécutés en tant que code de programme côté serveur lorsqu'ils sont accessibles directement avec une requête HTTP.1V5.3.22Vérifiez que lorsque l'application crée des chemins d'accès pour les opérations sur les fichiers, elle utilise des données générées en interne ou fiables plutôt que des noms de fichiers soumis par l'utilisateur. Si des noms de fichiers ou des métadonnées de fichiers soumis par l'utilisateur doivent être utilisés, une validation et un nettoyage stricts doivent être appliqués. Ceci permet de se protéger contre les attaques par traversée de chemin, l'inclusion de fichiers locaux ou distants (LFI, RFI) et la falsification de requêtes côté serveur (SSRF).1V5.3.33Vérifiez que le traitement des fichiers côté serveur, comme la décompression des fichiers, ignore les informations de chemin fournies par l'utilisateur pour éviter les vulnérabilités telles que le "zip slip".3V5.44Téléchargement de fichierV5.4.11Vérifiez que l’application valide ou ignore les noms de fichiers soumis par l’utilisateur, y compris dans un paramètre JSON, JSONP ou URL et spécifie un nom de fichier dans le champ d’en-tête Content-Disposition de la réponse.2V5.4.22Vérifiez que les noms de fichiers servis (par exemple, dans les champs d'en-tête de réponse HTTP ou les pièces jointes aux e-mails) sont encodés ou nettoyés (par exemple, conformément à la RFC 6266) pour préserver la structure du document et empêcher les attaques par injection.2V5.4.33Vérifiez que les fichiers obtenus à partir de sources non fiables sont analysés par des scanners antivirus pour empêcher la diffusion de contenu malveillant connu.2V66AuthenticationAuthentificationV6.11Documentation d'authentificationV6.1.11Vérifiez que la documentation de l'application définit comment les contrôles, tels que la limitation de débit, l'anti-automatisation et la réponse adaptative, sont utilisés pour se défendre contre les attaques telles que le « credential stuffing » et la force brute des mots de passe. La documentation doit expliquer clairement comment ces contrôles sont configurés et empêcher le blocage malveillant des comptes.1V6.1.22Vérifiez qu'une liste de mots spécifiques au contexte est documentée afin d'empêcher leur utilisation dans les mots de passe. Cette liste peut inclure des permutations de noms d'organisations, de produits, d'identifiants de systèmes, de noms de codes de projets, de noms de services ou de rôles, etc.2V6.1.33Vérifiez que, si l'application inclut plusieurs voies d'authentification, celles-ci sont toutes documentées avec les contrôles de sécurité et la force d'authentification qui doivent être appliqués de manière cohérente.2V6.22Sécurité des mots de passeV6.2.11Vérifiez que les mots de passe définis par l'utilisateur comportent au moins 8 caractères, bien qu'un minimum de 15 caractères soit fortement recommandé.1V6.2.22Vérifiez que les utilisateurs peuvent modifier leur mot de passe.1V6.2.33Vérifiez que la fonctionnalité de changement de mot de passe nécessite le mot de passe actuel et le nouveau mot de passe de l'utilisateur.1V6.2.44Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou du changement de mot de passe sont vérifiés par rapport à un ensemble disponible d'au moins 3 000 mots de passe principaux qui correspondent à la politique de mot de passe de l'application, par exemple la longueur minimale.1V6.2.55Vérifiez que les mots de passe peuvent être utilisés, quelle que soit leur composition, sans restriction quant au type de caractères autorisés. Aucun nombre minimal de majuscules ou de minuscules, de chiffres ou de caractères spéciaux ne doit être exigé.1V6.2.66Vérifiez que les champs de saisie du mot de passe utilisent type=password pour masquer la saisie. Les applications peuvent permettre à l'utilisateur d'afficher temporairement l'intégralité du mot de passe masqué ou le dernier caractère saisi.1V6.2.77Vérifiez que la fonctionnalité « coller », les assistants de mot de passe du navigateur et les gestionnaires de mots de passe externes sont autorisés.1V6.2.88Vérifiez que l'application vérifie le mot de passe de l'utilisateur exactement tel qu'il a été reçu de l'utilisateur, sans aucune modification telle qu'une troncature ou une transformation de casse.1V6.2.99Vérifiez que les mots de passe d’au moins 64 caractères sont autorisés.2V6.2.1010Vérifiez que le mot de passe d'un utilisateur reste valide jusqu'à ce qu'il soit découvert comme compromis ou qu'il soit renouvelé. L'application ne doit pas exiger de renouvellement périodique des identifiants.2V6.2.1111Vérifiez que la liste documentée de mots spécifiques au contexte est utilisée pour éviter la création de mots de passe faciles à deviner.2V6.2.1212Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou des modifications de mot de passe sont vérifiés par rapport à un ensemble de mots de passe fuités.2V6.33Sécurité générale de l'authentificationV6.3.11Vérifiez que les contrôles visant à empêcher les attaques telles que le bourrage d'informations d'identification et la force brute des mots de passe sont mis en œuvre conformément à la documentation de sécurité de l'application.1V6.3.22Vérifiez que les comptes d’utilisateur par défaut (par exemple, « root », « admin » ou « sa ») ne sont pas présents dans l’application ou sont désactivés.1V6.3.33Vérifiez que l’application exige que les utilisateurs utilisent un mécanisme d’authentification multifacteur ou une combinaison de mécanismes d’authentification à facteur unique.2V6.3.44Vérifiez que, si l’application inclut plusieurs voies d’authentification, il n’existe aucune voie non documentée et que les contrôles de sécurité et la force d’authentification sont appliqués de manière cohérente.2V6.3.55Vérifiez que les utilisateurs sont informés des tentatives d'authentification suspectes (réussies ou non). Il peut s'agir de tentatives d'authentification provenant d'un emplacement ou d'un client inhabituel, d'une authentification partiellement réussie (un seul facteur parmi plusieurs), d'une tentative d'authentification après une longue période d'inactivité ou d'une authentification réussie après plusieurs tentatives infructueuses.3V6.3.66Vérifiez que le courrier électronique n’est pas utilisé comme mécanisme d’authentification à facteur unique ou à facteurs multiples.3V6.3.77Vérifiez que les utilisateurs sont avertis après les mises à jour des détails d'authentification, telles que les réinitialisations d'informations d'identification ou la modification du nom d'utilisateur ou de l'adresse e-mail.3V6.3.88Vérifiez que les utilisateurs valides ne peuvent pas être déduits d'échecs d'authentification, par exemple en se basant sur des messages d'erreur, des codes de réponse HTTP ou des temps de réponse différents. Les fonctionnalités d'inscription et de mot de passe oublié doivent également bénéficier de cette protection.3V6.44Cycle de vie et récupération du facteur d'authentificationV6.4.11Vérifiez que les mots de passe initiaux ou les codes d'activation générés par le système sont générés de manière aléatoire et sécurisée, qu'ils respectent la politique de mots de passe en vigueur et qu'ils expirent après une courte période ou après leur première utilisation. Ces secrets initiaux ne doivent pas devenir des mots de passe permanents.1V6.4.22Vérifiez que les indices de mot de passe ou l'authentification basée sur les connaissances (appelées « questions secrètes ») ne sont pas présents.1V6.4.33Vérifiez qu'un processus sécurisé de réinitialisation d'un mot de passe oublié est mis en œuvre, qui ne contourne aucun mécanisme d'authentification multifacteur activé.2V6.4.44Vérifiez que si un facteur d'authentification multifacteur est perdu, la preuve de vérification d'identité est effectuée au même niveau que lors de l'inscription.2V6.4.55Vérifiez que les instructions de renouvellement des mécanismes d'authentification qui expirent sont envoyées avec suffisamment de temps pour être exécutées avant l'expiration de l'ancien mécanisme d'authentification, en configurant des rappels automatiques si nécessaire.3V6.4.66Vérifiez que les administrateurs peuvent initier la réinitialisation du mot de passe de l'utilisateur, mais que cela ne leur permet pas de modifier ou de choisir son mot de passe. Cela évite qu'ils ne connaissent le mot de passe de l'utilisateur.3V6.55Exigences générales en matière d'authentification multifacteurV6.5.11Vérifiez que les secrets de recherche, les demandes ou codes d'authentification out-of-band et les mots de passe à usage unique basés sur le temps (TOTP) ne peuvent être utilisés avec succès qu'une seule fois.2V6.5.22Vérifiez que, lors de leur stockage dans le backend de l'application, les secrets de recherche comportant moins de 112 bits d'entropie (19 caractères alphanumériques aléatoires ou 34 chiffres aléatoires) sont hachés avec un algorithme de hachage de stockage de mots de passe approuvé, intégrant un sel aléatoire de 32 bits. Une fonction de hachage standard peut être utilisée si le secret comporte 112 bits d'entropie ou plus.2V6.5.33Vérifiez que les secrets de recherche, le code d'authentification out-of-band et les mots de passe à usage unique basés sur le temps sont générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) pour éviter les valeurs prévisibles.2V6.5.44Vérifiez que les secrets de recherche et les codes d'authentification out-of-band ont un minimum de 20 bits d'entropie (généralement 4 caractères alphanumériques aléatoires ou 6 chiffres aléatoires suffisent).2V6.5.55Vérifiez que les requêtes, codes ou jetons d'authentification out-of-band, ainsi que les mots de passe à usage unique (TOTP), ont une durée de vie définie. Les requêtes out-of-band doivent avoir une durée de vie maximale de 10 minutes et les TOTP, de 30 secondes.2V6.5.66Vérifiez que tout facteur d’authentification (y compris les appareils physiques) peut être révoqué en cas de vol ou autre perte.3V6.5.77Vérifiez que les mécanismes d’authentification biométrique ne sont utilisés que comme facteurs secondaires, avec quelque chose que vous possédez ou quelque chose que vous savez.3V6.5.88Vérifiez que les mots de passe à usage unique basés sur le temps (TOTP) sont vérifiés en fonction d'une source temporelle provenant d'un service de confiance et non d'une heure non fiable ou fournie par le client.3V6.66Mécanismes d'authentification out-of-bandV6.6.11Vérifier que les mécanismes d'authentification utilisant le réseau téléphonique public commuté (RTPC) pour la transmission de mots de passe à usage unique (OTP) par téléphone ou SMS ne sont proposés que lorsque le numéro de téléphone a été préalablement validé. D'autres méthodes plus robustes (telles que les mots de passe à usage unique à durée déterminée) sont également proposées, et que le service informe les utilisateurs des risques de sécurité qu'elles présentent. Pour les applications de niveau 3, le téléphone et les SMS ne doivent pas être disponibles.2V6.6.22Vérifiez que les demandes d’authentification out-of-band, les codes ou les jetons sont liés à la demande d’authentification d’origine pour laquelle ils ont été générés et ne sont pas utilisables pour une demande précédente ou ultérieure.2V6.6.33Vérifiez qu'un mécanisme d'authentification out-of-band basé sur du code est protégé contre les attaques par force brute grâce au "rate limiting". Envisagez également d'utiliser un code avec au moins 64 bits d'entropie.2V6.6.44Vérifiez que, lorsque les notifications push sont utilisées pour l'authentification multifacteur, le "rate limiting" est appliqué afin d'empêcher les attaques de type « push bombing ». La concordance des numéros peut également atténuer ce risque.3V6.77Mécanisme d'authentification cryptographiqueV6.7.11Vérifiez que les certificats utilisés pour vérifier les assertions d’authentification cryptographique sont stockés de manière à les protéger contre toute modification.3V6.7.22Vérifiez que le nonce de défi a une longueur d'au moins 64 bits et qu'il est statistiquement unique ou unique sur toute la durée de vie du périphérique cryptographique.3V6.88Authentification avec un fournisseur d'identitéV6.8.11Vérifiez que, si l'application prend en charge plusieurs fournisseurs d'identité (IdP), l'identité de l'utilisateur ne peut pas être usurpée via un autre fournisseur d'identité pris en charge (par exemple, en utilisant le même identifiant utilisateur). La mesure standard consisterait à ce que l'application enregistre et identifie l'utilisateur à l'aide d'une combinaison de l'ID du fournisseur d'identité (servant d'espace de noms) et de l'ID de l'utilisateur dans le fournisseur d'identité.2V6.8.22Vérifiez que la présence et l'intégrité des signatures numériques sur les assertions d'authentification (par exemple sur les assertions JWT ou SAML) sont toujours validées, en rejetant toutes les assertions non signées ou ayant des signatures non valides.2V6.8.33Vérifiez que les assertions SAML sont traitées de manière unique et utilisées une seule fois au cours de la période de validité pour éviter les attaques par rejeu.2V6.8.44Si une application utilise un fournisseur d'identité (IdP) distinct et attend une force, des méthodes ou une date d'authentification spécifiques pour des fonctions spécifiques, vérifiez que l'application les vérifie à l'aide des informations renvoyées par l'IdP. Par exemple, si OIDC est utilisé, cela peut être réalisé en validant les affirmations de jeton d'identification telles que « acr », « amr » et « auth_time » (le cas échéant). Si l'IdP ne fournit pas ces informations, l'application doit disposer d'une approche de secours documentée qui suppose que le mécanisme d'authentification de force minimale a été utilisé (par exemple, une authentification à facteur unique avec nom d'utilisateur et mot de passe).2V77SessionGestion des sessionsV7.11Documentation sur la gestion des sessionsV7.1.11Vérifiez que le délai d'inactivité de la session de l'utilisateur et la durée de vie maximale absolue de la session sont documentés, sont appropriés en combinaison avec d'autres contrôles et que la documentation inclut une justification de tout écart par rapport aux exigences de réauthentification NIST SP 800-63B.2V7.1.22Vérifiez que la documentation définit le nombre de sessions simultanées (parallèles) autorisées pour un compte ainsi que les comportements et actions prévus à entreprendre lorsque le nombre maximal de sessions actives est atteint.2V7.1.33Vérifiez que tous les systèmes qui créent et gèrent des sessions utilisateur dans le cadre d'un écosystème de gestion des identités fédérées (tels que les systèmes SSO) sont documentés avec des contrôles pour coordonner la durée de vie des sessions, la résiliation et toute autre condition nécessitant une réauthentification.2V7.22Sécurité fondamentale de la gestion des sessionsV7.2.11Vérifiez que l’application effectue toutes les vérifications des jetons de session à l’aide d’un service backend de confiance.1V7.2.22Vérifiez que l'application utilise des jetons autonomes ou de référence générés dynamiquement pour la gestion des sessions, c'est-à-dire sans utiliser de secrets et de clés d'API statiques.1V7.2.33Vérifiez que si des jetons par référence sont utilisés pour représenter les sessions utilisateur, ils sont uniques et générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et possèdent au moins 128 bits d'entropie.1V7.2.44Vérifiez que l’application génère un nouveau jeton de session lors de l’authentification de l’utilisateur, y compris la réauthentification, et met fin au jeton de session actuel.1V7.33Délai d'expiration de la sessionV7.3.11Vérifiez qu’il existe un délai d’inactivité tel que la réauthentification soit appliquée conformément à l’analyse des risques et aux décisions de sécurité documentées.2V7.3.22Vérifiez qu'il existe une durée de vie maximale absolue de la session de sorte que la réauthentification soit appliquée conformément à l'analyse des risques et aux décisions de sécurité documentées.2V7.44Fin de sessionV7.4.11Vérifiez que lorsque la fin de session est déclenchée (par exemple, déconnexion ou expiration), l'application interdit toute utilisation ultérieure de la session. Pour les jetons par référence ou les sessions avec état, cela implique l'invalidation des données de session au niveau du backend de l'application. Les applications utilisant des jetons autonomes nécessiteront une solution, comme la gestion d'une liste des jetons terminés, l'interdiction des jetons produits avant une date et une heure spécifique à chaque utilisateur ou la rotation d'une clé de signature spécifique à chaque utilisateur.1V7.4.22Vérifiez que l'application met fin à toutes les sessions actives lorsqu'un compte utilisateur est désactivé ou supprimé (par exemple, lorsqu'un employé quitte l'entreprise).1V7.4.33Vérifiez que l'application offre la possibilité de mettre fin à toutes les autres sessions actives après une modification ou une suppression réussie de tout facteur d'authentification (y compris la modification du mot de passe via une réinitialisation ou une récupération et, le cas échéant, une mise à jour des paramètres MFA).2V7.4.44Vérifiez que toutes les pages nécessitant une authentification disposent d’un accès facile et visible à la fonctionnalité de déconnexion.2V7.4.55Vérifiez que les administrateurs d’applications sont en mesure de mettre fin aux sessions actives pour un utilisateur individuel ou pour tous les utilisateurs.2V7.55Défenses contre les abus de sessionV7.5.11Vérifiez que l'application nécessite une réauthentification complète avant d'autoriser les modifications des attributs de compte sensibles qui peuvent affecter l'authentification, tels que l'adresse e-mail, le numéro de téléphone, la configuration MFA ou d'autres informations utilisées dans la récupération de compte.2V7.5.22Vérifiez que les utilisateurs peuvent afficher et (après s'être authentifiés à nouveau avec au moins un facteur) terminer une ou toutes les sessions actuellement actives.2V7.5.33Vérifiez que l’application nécessite une authentification supplémentaire avec au moins un facteur ou une vérification secondaire avant d’effectuer des transactions ou des opérations hautement sensibles.3V7.66Réauthentification fédéréeV7.6.11Vérifiez que la durée de vie et la fin de la session entre les parties de confiance (RP) et les fournisseurs d'identité (IdP) se comportent comme documenté, en exigeant une réauthentification si nécessaire, par exemple lorsque le temps maximal entre les événements d'authentification IdP est atteint.2V7.6.22Vérifiez que la création d'une session nécessite soit le consentement de l'utilisateur, soit une action explicite, empêchant ainsi la création de nouvelles sessions d'application sans interaction de l'utilisateur.2V88AuthorizationAutorisationV8.11Documentation d'autorisationV8.1.11Vérifiez que la documentation d’autorisation définit des règles de restriction de l’accès au niveau de la fonction et aux données en fonction des autorisations du consommateur et des attributs des ressources.1V8.1.22Vérifiez que la documentation d'autorisation définit les règles de restriction d'accès au niveau des champs (lecture et écriture) en fonction des autorisations des consommateurs et des attributs des ressources. Notez que ces règles peuvent dépendre d'autres valeurs d'attributs de l'objet de données concerné, telles que l'état ou le statut.2V8.1.33Vérifiez que la documentation de l'application définit les attributs environnementaux et contextuels (y compris, mais sans s'y limiter, l'heure de la journée, l'emplacement de l'utilisateur, l'adresse IP ou l'appareil) qui sont utilisés dans l'application pour prendre des décisions de sécurité, y compris celles relatives à l'authentification et à l'autorisation.3V8.1.44Vérifier que la documentation d'authentification et d'autorisation définit l'utilisation des facteurs environnementaux et contextuels dans la prise de décision, en plus des autorisations au niveau des fonctions, des données et des champs. Cela doit inclure les attributs évalués, les seuils de risque et les actions entreprises (par exemple, autorisation, contestation, refus, renforcement de l'authentification).3V8.22Conception d'autorisation généraleV8.2.11Vérifiez que l’application garantit que l’accès basé sur la fonction est limité aux consommateurs disposant d’autorisations explicites.1V8.2.22Vérifiez que l'application garantit que l'accès spécifique aux données est limité aux consommateurs disposant d'autorisations explicites sur des éléments de données spécifiques afin d'atténuer les références d'objet directes non sécurisées (IDOR) et les autorisations de niveau d'objet rompues (BOLA).1V8.2.33Vérifiez que l'application garantit que l'accès au niveau du champ est limité aux consommateurs disposant d'autorisations explicites sur des champs spécifiques afin d'atténuer les problèmes d'autorisation au niveau de la propriété d'objet (BOPLA).2V8.2.44Vérifiez que les contrôles de sécurité adaptatifs basés sur les attributs environnementaux et contextuels du consommateur (tels que l'heure, la localisation, l'adresse IP ou l'appareil) sont mis en œuvre pour les décisions d'authentification et d'autorisation, comme défini dans la documentation de l'application. Ces contrôles doivent être appliqués lorsque le consommateur tente de démarrer une nouvelle session et également pendant une session existante.3V8.33Autorisation par opérationV8.3.11Vérifier que l'application applique les règles d'autorisations au niveau de la couche service de confiance et ne s’appuie pas sur des contrôles qu’un consommateur non approuvé pourrait manipuler, comme JavaScript côté client.1V8.3.22Vérifiez que les modifications apportées aux valeurs sur lesquelles reposent les décisions d'autorisation sont appliquées immédiatement. Lorsque les modifications ne peuvent pas être appliquées immédiatement (par exemple, en s'appuyant sur des données de jetons autonomes), des contrôles d'atténuation doivent être mis en place pour alerter un consommateur lorsqu'il effectue une action alors qu'il n'est plus autorisé à le faire et annuler la modification. Notez que cette solution alternative ne limiterait pas les fuites d'informations.3V8.3.33Vérifiez que l'accès à un objet repose sur les autorisations du sujet d'origine (par exemple, le consommateur), et non sur celles d'un intermédiaire ou d'un service agissant en son nom. Par exemple, si un consommateur appelle un service web à l'aide d'un jeton d'authentification autonome, et que ce service demande ensuite des données à un autre service, ce dernier utilisera le jeton du consommateur, plutôt qu'un jeton inter-machine du premier service, pour prendre les décisions d'autorisation.3V8.44Autres considérations relatives à l'autorisationV8.4.11Vérifiez que les applications multi-tenants utilisent des contrôles inter-tenants pour garantir que les opérations des consommateurs n'affecteront jamais les tenants avec lesquels ils ne sont pas autorisés à interagir.2V8.4.22Vérifiez que l'accès aux interfaces administratives intègre plusieurs couches de sécurité, notamment la vérification continue de l'identité du consommateur, l'évaluation de la posture de sécurité des appareils et l'analyse contextuelle des risques, garantissant que l'emplacement du réseau ou les endpoints approuvés ne sont pas les seuls facteurs d'autorisation, même s'ils peuvent réduire la probabilité d'accès non autorisé.3V99SelfJetons autonomesV9.11Source et intégrité du jetonV9.1.11Vérifiez que les jetons autonomes sont validés à l'aide de leur signature numérique ou MAC pour les protéger contre toute falsification avant d'accepter le contenu du jeton.1V9.1.22Vérifiez que seuls les algorithmes d'une liste d’autorisations peuvent être utilisés pour créer et vérifier des jetons autonomes, dans un contexte donné. La liste d'autorisation doit inclure les algorithmes autorisés, idéalement symétriques ou asymétriques, et ne doit pas inclure l'algorithme « Aucun ». Si les algorithmes symétriques et asymétriques doivent être pris en charge, des contrôles supplémentaires seront nécessaires pour éviter toute confusion de clés.1V9.1.33Vérifiez que les clés utilisées pour valider les jetons autonomes proviennent de sources préconfigurées et fiables pour l'émetteur du jeton, empêchant ainsi les attaquants de spécifier des sources et des clés non fiables. Pour les JWT et autres structures JWS, les en-têtes tels que « jku », « x5u » et « jwk » doivent être validés par rapport à une liste d'autorisation de sources fiables.1V9.22Contenu du jetonV9.2.11Vérifiez que, si une période de validité est indiquée dans les données du jeton, celui-ci et son contenu ne sont acceptés que si la date de vérification est comprise dans cette période. Par exemple, pour les JWT, les déclarations « nbf » et « exp » doivent être vérifiées.1V9.2.22Vérifiez que le service recevant un jeton valide le type de jeton et son utilisation avant d'en accepter le contenu. Par exemple, seuls les jetons d'accès peuvent être acceptés pour les décisions d'autorisation, et seuls les jetons d'identification peuvent être utilisés pour prouver l'authentification des utilisateurs.2V9.2.33Vérifiez que le service accepte uniquement les jetons destinés à être utilisés avec ce service (audience). Pour les JWT, cela peut être réalisé en validant la déclaration « aud » par rapport à une liste d'autorisation définie dans le service.2V9.2.44Si un émetteur de jetons utilise la même clé privée pour émettre des jetons destinés à différentes audiences, vérifiez que les jetons émis contiennent une restriction d'audience identifiant de manière unique les audiences visées. Cela empêchera la réutilisation d'un jeton avec une audience non prévue. Si l'identifiant d'audience est provisionné dynamiquement, l'émetteur de jetons doit valider ces audiences afin de garantir qu'elles n'entraînent pas d'usurpation d'identité.2V1010OAuthOauth et OIDCV10.11Sécurité générique OAuth et OIDCV10.1.11Vérifiez que les jetons sont envoyés uniquement aux composants qui en ont absolument besoin. Par exemple, lors de l'utilisation d'un modèle backend-for-frontend pour les applications JavaScript basées sur un navigateur, les jetons d'accès et d'actualisation ne doivent être accessibles qu'au backend.2V10.1.22Vérifiez que le client n'accepte les valeurs du serveur d'autorisation (telles que le code d'autorisation ou le jeton d'identification) que si elles résultent d'un flux d'autorisation initié par la même session d'agent utilisateur et la même transaction. Cela nécessite que les secrets générés par le client, tels que la clé de preuve pour l'échange de codes (PKCE) « code_verifier », « state » ou le nonce OIDC, ne puissent être devinés, soient spécifiques à la transaction et soient liés de manière sécurisée au client et à la session d'agent utilisateur au cours de laquelle la transaction a été initiée.2V10.22Client OAuthV10.2.11Vérifiez que, si le flux de code est utilisé, le client OAuth dispose d'une protection contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF), qui déclenchent des demandes de jetons, soit en utilisant la fonctionnalité de clé de preuve pour l'échange de code (PKCE), soit en vérifiant le paramètre « state » envoyé dans la demande d'autorisation.2V10.2.22Vérifiez que, si le client OAuth peut interagir avec plusieurs serveurs d'autorisation, il dispose d'une protection contre les attaques par confusion. Par exemple, il peut exiger que le serveur d'autorisation renvoie la valeur du paramètre « iss » et la valide dans la réponse d'autorisation et la réponse du jeton.2V10.2.33Vérifiez que le client OAuth demande uniquement les portées requises (ou d’autres paramètres d’autorisation) dans les requêtes adressées au serveur d’autorisation.3V10.33Serveur de ressources OAuthV10.3.11Vérifiez que le serveur de ressources accepte uniquement les jetons d'accès destinés à être utilisés avec ce service (audience). L'audience peut être incluse dans un jeton d'accès structuré (comme la déclaration « aud » dans JWT) ou vérifiée à l'aide du endpoint d'introspection de jeton.2V10.3.22Vérifiez que le serveur de ressources applique les décisions d'autorisation en fonction des déclarations du jeton d'accès définissant l'autorisation déléguée. Si des déclarations telles que « sub », « scope » et « authorization_details » sont présentes, elles doivent être prises en compte dans la décision.2V10.3.33Vérifiez que si une décision de contrôle d'accès nécessite l'identification d'un utilisateur unique à partir d'un jeton d'accès (JWT ou réponse d'introspection de jeton associé), le serveur de ressources identifie l'utilisateur à partir de déclarations non ré attribuables à d'autres utilisateurs. En général, cela implique l'utilisation d'une combinaison de déclarations « iss » et « sub ».2V10.3.44Si le serveur de ressources requiert une force d'authentification, des méthodes ou une date d'expiration spécifiques, vérifiez que le jeton d'accès présenté respecte ces contraintes. Par exemple, s'il est présent, utilisez les déclarations OIDC « acr », « amr » et « auth_time » respectivement.2V10.3.55Vérifiez que le serveur de ressources empêche l'utilisation de jetons d'accès volés ou la relecture de jetons d'accès (de parties non autorisées) en exigeant des jetons d'accès limités par l'expéditeur, soit Mutual TLS pour OAuth 2, soit OAuth 2 Demonstration of Proof of Possession (DPoP).3V10.44Serveur d'autorisation OAuthV10.4.11Vérifiez que le serveur d'autorisation valide les URI de redirection en fonction d'une liste d'autorisation spécifique au client d'URI préenregistrés à l'aide d'une comparaison de chaînes exacte.1V10.4.22Vérifiez que, si le serveur d'autorisation renvoie le code d'autorisation dans la réponse, celui-ci ne peut être utilisé qu'une seule fois pour une demande de jeton. Pour la deuxième demande valide avec un code d'autorisation déjà utilisé pour émettre un jeton d'accès, le serveur d'autorisation doit rejeter la demande de jeton et révoquer tous les jetons émis liés au code d'autorisation.1V10.4.33Vérifiez que le code d'autorisation est de courte durée. La durée de vie maximale peut atteindre 10 minutes pour les applications L1 et L2 et 1 minute pour les applications L3.1V10.4.44Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement l'utilisation des autorisations nécessaires à ce client. Notez que les autorisations « token » (flux implicite) et « password » (flux d'informations d'identification du propriétaire de la ressource) ne doivent plus être utilisées.1V10.4.55Vérifiez que le serveur d'autorisation atténue les attaques par rejeu de jetons d'actualisation pour les clients publics, de préférence en utilisant des jetons d'actualisation limités par l'expéditeur, par exemple des jetons DPoP (Demonstrating Proof of Possession) ou des jetons d'accès liés à un certificat utilisant le protocole TLS mutuel (mTLS). Pour les applications L1 et L2, la rotation des jetons d'actualisation peut être utilisée. Si cette rotation est utilisée, le serveur d'autorisation doit invalider le jeton d'actualisation après utilisation et révoquer tous les jetons d'actualisation de cette autorisation si un jeton d'actualisation déjà utilisé et invalidé est fourni.1V10.4.66Vérifiez que, si l'octroi de code est utilisé, le serveur d'autorisation atténue les attaques par interception de code en exigeant une clé de preuve pour l'échange de code (PKCE). Pour les demandes d'autorisation, le serveur d'autorisation doit exiger une valeur « code_challenge » valide et ne doit pas accepter une valeur « plain » pour « code_challenge_method ». Pour une demande de jeton, il doit exiger la validation du paramètre « code_verifier ».2V10.4.77Vérifiez que si le serveur d'autorisation prend en charge l'enregistrement dynamique des clients non authentifiés, il réduit le risque d'applications clientes malveillantes. Il doit valider les métadonnées clientes, telles que les URI enregistrés, garantir le consentement de l'utilisateur et l'avertir avant de traiter une demande d'autorisation avec une application cliente non approuvée.2V10.4.88Vérifiez que les jetons d’actualisation ont une expiration absolue, y compris si l’expiration du jeton d’actualisation glissant est appliquée.2V10.4.99Vérifiez que les jetons d'actualisation et les jetons d'accès de référence peuvent être révoqués par un utilisateur autorisé à l'aide de l'interface utilisateur du serveur d'autorisation, afin d'atténuer le risque de clients malveillants ou de jetons volés.2V10.4.1010Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.2V10.4.1111Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.2V10.4.1212Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement la valeur « response_mode » dont ce client a besoin. Par exemple, en vérifiant cette valeur par rapport aux valeurs attendues ou en utilisant une requête d'autorisation poussée (PAR) ou une requête d'autorisation sécurisée par JWT (JAR).3V10.4.1313Vérifiez que le type d'Autorisation « code » est toujours utilisé avec les demandes d'autorisation poussées (PAR).3V10.4.1414Vérifiez que le serveur d'autorisation émet uniquement des jetons d'accès limités à l'expéditeur (preuve de possession), soit avec des jetons d'accès liés au certificat utilisant TLS mutuel (mTLS), soit avec des jetons d'accès liés au DPoP (démonstration de preuve de possession).3V10.4.1515Vérifiez que, pour un client côté serveur (non exécuté sur l'appareil de l'utilisateur final), le serveur d'autorisation garantit que la valeur du paramètre « authorization_details » provient du backend client et que l'utilisateur ne l'a pas altérée. Par exemple, en exigeant l'utilisation d'une demande d'autorisation poussée (PAR) ou d'une demande d'autorisation sécurisée par JWT (JAR).3V10.4.1616Vérifiez que le client est confidentiel et que le serveur d'autorisation requiert l'utilisation de méthodes d'authentification client fortes (basées sur la cryptographie à clé publique et résistantes aux attaques par relecture), telles que TLS mutuel ('tls_client_auth', 'self_signed_tls_client_auth') ou JWT à clé privée ('private_key_jwt').3V10.55Client OIDCV10.5.11Vérifiez que le client (en tant que partie utilisatrice) atténue les attaques par rejeu de jeton d'identification. Par exemple, en vous assurant que la valeur « nonce » du jeton d'identification correspond à la valeur « nonce » envoyée dans la demande d'authentification au fournisseur OpenID (appelée demande d'autorisation envoyée au serveur d'autorisation dans OAuth2).2V10.5.22Vérifiez que le client identifie de manière unique l'utilisateur à partir des déclarations de jeton d'identification, généralement la déclaration « sub », qui ne peut pas être réaffectée à d'autres utilisateurs (pour la portée d'un fournisseur d'identité).2V10.5.33Vérifiez que le client rejette les tentatives d'un serveur d'autorisation malveillant d'usurper l'identité d'un autre serveur d'autorisation via ses métadonnées. Le client doit rejeter les métadonnées du serveur d'autorisation si l'URL de l'émetteur figurant dans ces métadonnées ne correspond pas exactement à l'URL d'émetteur préconfigurée attendue par le client.2V10.5.44Vérifiez que le client valide que le jeton d'identification est destiné à être utilisé pour ce client (audience) en vérifiant que la déclaration « aud » du jeton est égale à la valeur « client_id » pour le client.2V10.5.55Vérifiez que, lors de l'utilisation de la déconnexion du back-channel OIDC, la partie utilisatrice atténue les risques de déni de service liés à la déconnexion forcée et à la confusion entre JWT dans le flux de déconnexion. Le client doit vérifier que le jeton de déconnexion est correctement typé avec la valeur « logout+jwt », qu'il contient la déclaration « event » avec le nom de membre correct et qu'il ne contient pas de déclaration « nonce ». Il est également recommandé d'utiliser une expiration courte (par exemple, 2 minutes).2V10.66Fournisseur OpenIDV10.6.11Vérifiez que le fournisseur OpenID n'autorise que les valeurs « code », « ciba », « id_token » ou « id_token code » pour le mode de réponse. Notez que « code » est préférable à « id_token code » (flux hybride OIDC) et que « token » (tout flux implicite) ne doit pas être utilisé.2V10.6.22Vérifiez que le fournisseur OpenID atténue les risques de déni de service liés à la déconnexion forcée. Pour ce faire, obtenez une confirmation explicite de l'utilisateur final ou, le cas échéant, validez les paramètres de la requête de déconnexion (initiée par la partie utilisatrice), comme « id_token_hint ».2V10.77Gestion du consentementV10.7.11Vérifiez que le serveur d'autorisation garantit le consentement de l'utilisateur à chaque demande d'autorisation. Si l'identité du client ne peut être garantie, le serveur d'autorisation doit toujours demander explicitement le consentement de l'utilisateur.2V10.7.22Vérifiez que lorsque le serveur d'autorisation demande le consentement de l'utilisateur, il fournit des informations claires et suffisantes sur ce qui est consenti. Le cas échéant, ces informations doivent inclure la nature des autorisations demandées (généralement en fonction de la portée, du serveur de ressources et des détails d'autorisation RAR), l'identité de l'application autorisée et la durée de vie de ces autorisations.2V10.7.33Vérifiez que l’utilisateur peut consulter, modifier et révoquer les consentements qu’il a accordés via le serveur d’autorisation.2V1111CryptographyCryptographieV11.11Inventaire et documentation cryptographiquesV11.1.11Vérifiez qu’il existe une politique documentée pour la gestion des clés cryptographiques et un cycle de vie des clés cryptographiques qui suit une norme de gestion des clés telle que NIST SP 800-57. Cela devrait inclure la garantie que les clés ne sont pas sur-partagées (par exemple, avec plus de deux entités pour les secrets partagés et plus d’une entité pour les clés privées).2V11.1.22Vérifiez qu'un inventaire cryptographique est réalisé, maintenu et régulièrement mis à jour, et qu'il inclut toutes les clés, algorithmes et certificats cryptographiques utilisés par l'application. Il doit également documenter les emplacements du système où les clés peuvent ou non être utilisées, ainsi que les types de données qui peuvent ou non être protégées par ces clés.2V11.1.33Vérifiez que les mécanismes de découverte cryptographique sont utilisés pour identifier toutes les instances de cryptographie dans le système, y compris les opérations de chiffrement, de hachage et de signature.3V11.1.44Vérifier la tenue d'un inventaire cryptographique. Celui-ci doit inclure un plan documenté décrivant la migration vers de nouvelles normes cryptographiques, telles que la cryptographie post-quantique, afin de réagir aux menaces futures.3V11.22Mise en œuvre sécurisée de la cryptographieV11.2.11Vérifiez que les implémentations validées par l’industrie (y compris les bibliothèques et les implémentations accélérées par le matériel) sont utilisées pour les opérations cryptographiques.2V11.2.22Vérifiez que l'application est conçue avec une agilité cryptographique, de sorte que les nombres aléatoires, le chiffrement authentifié, le MAC ou les algorithmes de hachage, les longueurs de clés, les tours, les chiffrements et les modes puissent être reconfigurés, mis à niveau ou échangés à tout moment, afin de se protéger contre les failles cryptographiques. De même, il doit être possible de remplacer les clés et les mots de passe, ainsi que de rechiffrer les données. Cela permettra des mises à niveau transparentes vers la cryptographie post-quantique (PQC), une fois que des implémentations hautement sécurisées de schémas ou de normes PQC approuvés seront largement disponibles.2V11.2.33Vérifiez que toutes les primitives cryptographiques utilisent un minimum de 128 bits de sécurité en fonction de l'algorithme, de la taille de la clé et de la configuration. Par exemple, une clé ECC de 256 bits offre environ 128 bits de sécurité, tandis que RSA nécessite une clé de 3072 bits pour atteindre 128 bits de sécurité.2V11.2.44Vérifiez que toutes les opérations cryptographiques sont à temps constant, sans opérations de « court-circuit » dans les comparaisons, les calculs ou les retours, pour éviter toute fuite d'informations.3V11.2.55Vérifiez que tous les modules cryptographiques échouent en toute sécurité et que les erreurs sont gérées de manière à ne pas permettre de vulnérabilités, telles que les attaques Padding Oracle.3V11.33Algorithmes de chiffrementV11.3.11Vérifiez que les modes de bloc non sécurisés (par exemple, ECB) et les schémas de remplissage faibles (par exemple, PKCS#1 v1.5) ne sont pas utilisés.1V11.3.22Vérifiez que seuls les chiffrements et modes approuvés tels que AES avec GCM sont utilisés.1V11.3.33Vérifiez que les données chiffrées sont protégées contre toute modification non autorisée, de préférence en utilisant une méthode de chiffrement authentifiée approuvée ou en combinant une méthode de chiffrement approuvée avec un algorithme MAC approuvé.2V11.3.44Vérifiez que les nonces, les vecteurs d'initialisation et autres nombres à usage unique ne sont pas utilisés pour plus d'une paire clé de chiffrement/élément de données. La méthode de génération doit être adaptée à l'algorithme utilisé.3V11.3.55Vérifiez que toute combinaison d'un algorithme de chiffrement et d'un algorithme MAC fonctionne en mode chiffrement puis MAC.3V11.44Hachage et fonctions basées sur le hachageV11.4.11Vérifiez que seules les fonctions de hachage approuvées sont utilisées pour les cas d'utilisation cryptographiques généraux, notamment les signatures numériques, HMAC, KDF et la génération de bits aléatoires. Les fonctions de hachage non autorisées, telles que MD5, ne doivent pas être utilisées à des fins cryptographiques.1V11.4.22Vérifiez que les mots de passe sont stockés à l'aide d'une fonction de dérivation de clés approuvée et gourmande en ressources de calcul (également appelée « fonction de hachage de mots de passe »), dont les paramètres sont configurés conformément aux directives en vigueur. Ces paramètres doivent équilibrer sécurité et performances afin de rendre les attaques par force brute suffisamment difficiles pour le niveau de sécurité requis.2V11.4.33Vérifiez que les fonctions de hachage utilisées dans les signatures numériques, dans le cadre de l'authentification ou de l'intégrité des données, sont résistantes aux collisions et possèdent des longueurs de bits appropriées. Si la résistance aux collisions est requise, la longueur de sortie doit être d'au moins 256 bits. Si seule la résistance aux attaques de seconde pré-image est requise, la longueur de sortie doit être d'au moins 128 bits.2V11.4.44Vérifiez que l'application utilise des fonctions de dérivation de clés approuvées avec des paramètres d'extension de clés lors de la dérivation de clés secrètes à partir de mots de passe. Les paramètres utilisés doivent concilier sécurité et performances afin d'empêcher les attaques par force brute de compromettre la clé cryptographique obtenue.2V11.55Valeurs aléatoiresV11.5.11Vérifiez que tous les nombres et chaînes aléatoires destinés à être non devinables doivent être générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et posséder au moins 128 bits d'entropie. Notez que les UUID ne respectent pas cette condition.2V11.5.22Vérifiez que le mécanisme de génération de nombres aléatoires utilisé est conçu pour fonctionner en toute sécurité, même en cas de forte demande.3V11.66Cryptographie à clé publiqueV11.6.11Vérifier que seuls des algorithmes cryptographiques et des modes opératoires approuvés sont utilisés pour la génération et l'amorçage des clés, ainsi que pour la génération et la vérification des signatures numériques. Les algorithmes de génération de clés ne doivent pas générer de clés non sécurisées et vulnérables aux attaques connues, par exemple les clés RSA vulnérables à la factorisation de Fermat.2V11.6.22Vérifiez que des algorithmes cryptographiques approuvés sont utilisés pour l'échange de clés (tels que Diffie-Hellman), en veillant à ce que les mécanismes d'échange de clés utilisent des paramètres sécurisés. Cela permettra d'éviter les attaques contre le processus d'établissement des clés, susceptibles de conduire à des attaques de type « adversaire du milieu » ou à des failles cryptographiques.3V11.77Cryptographie des données en cours d'utilisationV11.7.11Vérifiez que le chiffrement complet de la mémoire est utilisé pour protéger les données sensibles pendant leur utilisation, empêchant ainsi l'accès par des utilisateurs ou des processus non autorisés.3V11.7.22Vérifiez que la minimisation des données garantit que la quantité minimale de données est exposée pendant le traitement et assurez-vous que les données sont chiffrées immédiatement après utilisation ou dès que possible.3V1212SecureCommunication sécuriséeV12.11Conseils généraux de sécurité TLSV12.1.11Vérifiez que seules les dernières versions recommandées du protocole TLS sont activées, telles que TLS 1.2 et TLS 1.3. La dernière version du protocole TLS doit être privilégiée.1V12.1.22Vérifiez que seules les suites de chiffrement recommandées sont activées, les suites de chiffrement les plus puissantes étant définies comme préférées. Les applications L3 doivent uniquement prendre en charge les suites de chiffrement assurant la confidentialité persistante (forward secrecy).2V12.1.33Vérifiez que l’application valide que les certificats clients mTLS sont approuvés avant d’utiliser l’identité du certificat pour l’authentification ou l’autorisation.2V12.1.44Vérifiez que la révocation de certification appropriée, telle que l'agrafage du protocole OCSP (Online Certificate Status Protocol), est activée et configurée.3V12.1.55Vérifiez que Encrypted Client Hello (ECH) est activé dans les paramètres TLS de l'application pour empêcher l'exposition de métadonnées sensibles, telles que l'indication du nom du serveur (SNI), pendant les processus de négociation TLS.3V12.22Communication HTTPS avec des services externesV12.2.11Vérifiez que TLS est utilisé pour toute connectivité entre un client et des services externes basés sur HTTP, et ne recourt pas à des communications non sécurisées ou non chiffrées.1V12.2.22Vérifiez que les services externes utilisent des certificats TLS publiquement approuvés.1V12.33Sécurité des communications entre services générauxV12.3.11Vérifiez qu'un protocole chiffré tel que TLS est utilisé pour toutes les connexions entrantes et sortantes vers et depuis l'application, y compris les systèmes de surveillance, les outils de gestion, l'accès à distance et SSH, les intergiciels, les bases de données, les mainframes, les systèmes partenaires ou les API externes. Le serveur ne doit pas recourir à des protocoles non sécurisés ou non chiffrés.2V12.3.22Vérifiez que les clients TLS valident les certificats reçus avant de communiquer avec un serveur TLS.2V12.3.33Vérifiez que TLS ou un autre mécanisme de chiffrement de transport approprié est utilisé pour toute connectivité entre les services internes basés sur HTTP au sein de l'application et ne se replie pas vers des communications non sécurisées ou non chiffrées.2V12.3.44Vérifiez que les connexions TLS entre les services internes utilisent des certificats de confiance. Lorsque des certificats générés en interne ou auto-signés sont utilisés, le service consommateur doit être configuré pour n'approuver que des autorités de certification internes spécifiques et des certificats auto-signés spécifiques.2V12.3.55Vérifiez que les services communiquant en interne au sein d'un système (communications intra-services) utilisent une authentification forte pour garantir la vérification de chaque endpoint. Des méthodes d'authentification forte, telles que l'authentification client TLS, doivent être utilisées pour garantir l'identité, en utilisant une infrastructure à clé publique et des mécanismes résistants aux attaques par rejeu. Pour les architectures de microservices, envisagez d'utiliser un maillage de services pour simplifier la gestion des certificats et renforcer la sécurité.3V1313ConfigurationConfigurationV13.11Documentation de configurationV13.1.11Vérifiez que tous les besoins de communication de l'application sont documentés. Cela doit inclure les services externes dont l'application dépend et les cas où un utilisateur final pourrait fournir un emplacement externe auquel l'application se connectera.2V13.1.22Vérifiez que pour chaque service utilisé par l'application, la documentation définit le nombre maximal de connexions simultanées (par exemple, les limites du pool de connexions) et le comportement de l'application lorsque cette limite est atteinte, y compris les mécanismes de secours ou de récupération, pour éviter les conditions de déni de service.3V13.1.33Vérifiez que la documentation de l'application définit des stratégies de gestion des ressources pour chaque système ou service externe utilisé (par exemple, bases de données, descripteurs de fichiers, threads, connexions HTTP). Cela doit inclure les procédures de libération des ressources, les paramètres de délai d'expiration, la gestion des échecs et l'implémentation de la logique de nouvelle tentative, en spécifiant les limites de nouvelle tentative, les délais et les algorithmes de retour arrière. Pour les opérations de requête-réponse HTTP synchrones, la documentation doit imposer des délais d'expiration courts et soit désactiver les nouvelles tentatives, soit les limiter strictement afin d'éviter les retards en cascade et l'épuisement des ressources.3V13.1.44Vérifiez que la documentation de l'application définit les secrets essentiels à la sécurité de l'application et un calendrier de rotation de ceux-ci, en fonction du modèle de menace et des exigences commerciales de l'organisation.3V13.22Configuration de la communication backendV13.2.11Vérifiez que les communications entre les composants de l'application backend qui ne prennent pas en charge le mécanisme de session utilisateur standard de l'application, notamment les API, les intergiciels et les couches de données, sont authentifiées. L'authentification doit utiliser des comptes de service individuels, des jetons à court terme ou une authentification par certificat, et non des identifiants immuables tels que des mots de passe, des clés API ou des comptes partagés avec accès privilégié.2V13.2.22Vérifiez que les communications entre les composants de l'application backend, y compris les services locaux ou du système d'exploitation, les API, les intergiciels et les couches de données, sont effectuées avec des comptes dotés des privilèges les moins nécessaires.2V13.2.33Vérifiez que si des informations d’identification doivent être utilisées pour l’authentification du service, les informations d’identification utilisées par le consommateur ne sont pas des informations d’identification par défaut (par exemple, root/root ou admin/admin).2V13.2.44Vérifiez qu'une liste d’autorisations est utilisée pour définir les ressources ou systèmes externes avec lesquels l'application est autorisée à communiquer (par exemple, pour les requêtes sortantes, les chargements de données ou l'accès aux fichiers). Cette liste d'autorisation peut être implémentée au niveau de la couche applicative, du serveur web, du pare-feu ou d'une combinaison de différentes couches.2V13.2.55Vérifiez que le serveur Web ou d’application est configuré avec une liste autorisée de ressources ou de systèmes vers lesquels le serveur peut envoyer des requêtes ou charger des données ou des fichiers.2V13.2.66Vérifiez que lorsque l'application se connecte à des services distincts, elle suit la configuration documentée pour chaque connexion, comme le nombre maximal de connexions parallèles, le comportement lorsque le nombre maximal de connexions autorisées est atteint, les délais d'expiration de connexion et les stratégies de nouvelle tentative.3V13.33Gestion des secretsV13.3.11Vérifiez qu'une solution de gestion des secrets, telle qu'un coffre-fort de clés, est utilisée pour créer, stocker, contrôler l'accès et détruire en toute sécurité les secrets backend. Ceux-ci peuvent inclure des mots de passe, du matériel de clé, des intégrations avec des bases de données et des systèmes tiers, des clés et des graines pour des jetons temporels, d'autres secrets internes et des clés API. Les secrets ne doivent pas être inclus dans le code source de l'application ni dans les artefacts de build. Pour une application L3, cela doit impliquer une solution matérielle telle qu'un HSM.2V13.3.22Vérifiez que l’accès aux ressources secrètes respecte le principe du moindre privilège.2V13.3.33Vérifiez que toutes les opérations cryptographiques sont effectuées à l'aide d'un module de sécurité isolé (tel qu'un coffre-fort ou un module de sécurité matériel) pour gérer et protéger en toute sécurité le matériel clé contre toute exposition en dehors du module de sécurité.3V13.3.44Vérifiez que les secrets sont configurés pour expirer et être renouvelés en fonction de la documentation de l'application.3V13.44Fuite d'informations involontaireV13.4.11Vérifiez que l'application est déployée soit sans aucune métadonnée de contrôle de source, y compris les dossiers .git ou .svn, soit de manière à ce que ces dossiers soient inaccessibles à la fois en externe et à l'application elle-même.1V13.4.22Vérifiez que les modes de débogage sont désactivés pour tous les composants dans les environnements de production afin d’éviter l’exposition des fonctionnalités de débogage et la fuite d’informations.2V13.4.33Vérifiez que les serveurs Web n’exposent pas les listes de répertoires aux clients, sauf si cela est explicitement prévu.2V13.4.44Vérifiez que l’utilisation de la méthode HTTP TRACE n’est pas prise en charge dans les environnements de production, afin d’éviter toute fuite d’informations potentielle.2V13.4.55Vérifiez que la documentation (comme pour les API internes) et les endpoints de surveillance ne sont pas exposés, sauf si cela est explicitement prévu.2V13.4.66Vérifiez que l’application n’expose pas d’informations de version détaillées des composants backend.3V13.4.77Vérifiez que la couche web est configuré pour servir uniquement les fichiers avec des extensions de fichier spécifiques afin d’éviter toute fuite involontaire d’informations, de configuration et de code source.3V1414DataProtection des donnéesV14.11Documentation sur la protection des donnéesV14.1.11Vérifiez que toutes les données sensibles créées et traitées par l'application ont été identifiées et classées selon leur niveau de protection. Cela inclut les données uniquement codées et donc facilement déchiffrables, telles que les chaînes Base64 ou la charge utile en texte clair d'un JWT. Les niveaux de protection doivent tenir compte des réglementations et normes de protection des données et de confidentialité auxquelles l'application est tenue de se conformer.2V14.1.22Vérifier que tous les niveaux de protection des données sensibles sont assortis d'un ensemble documenté d'exigences de protection. Cela doit inclure (sans s'y limiter) les exigences relatives au chiffrement général, à la vérification de l'intégrité, à la conservation, à la journalisation des données, aux contrôles d'accès aux données sensibles dans les journaux, au chiffrement au niveau de la base de données, aux technologies de confidentialité et de renforcement de la confidentialité à utiliser, ainsi qu'aux autres exigences de confidentialité.2V14.22Protection générale des donnéesV14.2.11Vérifiez que les données sensibles sont uniquement envoyées au serveur dans les champs de corps ou d’en-tête du message HTTP, et que l’URL et la chaîne de requête ne contiennent pas d’informations sensibles, telles qu’une clé API ou un jeton de session.1V14.2.22Vérifiez que l’application empêche la mise en cache des données sensibles dans les composants du serveur, tels que les équilibreurs de charge et les caches d’application, ou garantit que les données sont purgées en toute sécurité après utilisation.2V14.2.33Vérifiez que les données sensibles définies ne sont pas envoyées à des parties non fiables (par exemple, des trackers d'utilisateurs) pour empêcher la collecte indésirable de données en dehors du contrôle de l'application.2V14.2.44Vérifiez que les contrôles autour des données sensibles liés au chiffrement, à la vérification de l'intégrité, à la conservation, à la manière dont les données doivent être enregistrées, aux contrôles d'accès autour des données sensibles dans les journaux, à la confidentialité et aux technologies d'amélioration de la confidentialité, sont mis en œuvre comme défini dans la documentation pour le niveau de protection des données spécifiques.2V14.2.55Vérifiez que les mécanismes de mise en cache sont configurés pour ne mettre en cache que les réponses dont le type de contenu est conforme à la ressource et qui ne contiennent pas de contenu sensible et dynamique. Le serveur web doit renvoyer une réponse 404 ou 302 lors de l'accès à un fichier inexistant plutôt qu'un fichier valide différent. Cela devrait empêcher les attaques par empoisonnement de cache web.3V14.2.66Vérifiez que l'application ne renvoie que les données sensibles minimales requises pour son fonctionnement. Par exemple, ne renvoyez que certains chiffres d'un numéro de carte de crédit, et non le numéro complet. Si les données complètes sont requises, elles doivent être masquées dans l'interface utilisateur, sauf si l'utilisateur les consulte spécifiquement.3V14.2.77Vérifiez que les informations sensibles sont soumises à une classification de conservation des données, en veillant à ce que les données obsolètes ou inutiles soient supprimées automatiquement, selon un calendrier défini ou selon les besoins de la situation.3V14.2.88Vérifiez que les informations sensibles sont supprimées des métadonnées des fichiers soumis par l'utilisateur, sauf si le stockage est autorisé par l'utilisateur.3V14.33Protection des données côté clientV14.3.11Vérifiez que les données authentifiées sont effacées du stockage client, comme le DOM du navigateur, après la fin du client ou de la session. Le champ d'en-tête de réponse HTTP « Clear-Site-Data » peut être utile, mais le côté client devrait également pouvoir effectuer la correction si la connexion au serveur n'est pas disponible à la fin de la session.1V14.3.22Vérifiez que l'application définit suffisamment de champs d'en-tête de réponse HTTP anti-caching (c'est-à-dire Cache-Control : no-store) afin que les données sensibles ne soient pas mises en cache dans les navigateurs.2V14.3.33Vérifiez que les données stockées dans le stockage du navigateur (telles que localStorage, sessionStorage, IndexedDB ou les cookies) ne contiennent pas de données sensibles, à l'exception des jetons de session.2V1515SecureDéveloppement et architecture sécurisésV15.11Documentation sur le développement et l'architecture sécurisésV15.1.11Vérifiez que la documentation de l'application définit les délais de correction basés sur les risques pour les versions de composants tiers présentant des vulnérabilités et pour la mise à jour des bibliothèques en général, afin de minimiser les risques liés à ces composants.1V15.1.22Vérifiez qu'un catalogue d'inventaire, tel qu'une nomenclature logicielle (SBOM), est conservé pour toutes les bibliothèques tierces utilisées, y compris en vérifiant que les composants proviennent de référentiels prédéfinis, fiables et continuellement maintenus.2V15.1.33Vérifiez que la documentation de l'application identifie les fonctionnalités consommatrices en temps ou gourmandes en ressources. Elle doit notamment indiquer comment prévenir une perte de disponibilité due à une utilisation excessive de ces fonctionnalités et éviter que la génération d'une réponse ne prenne plus de temps que le délai d'expiration du consommateur. Les mesures de protection potentielles peuvent inclure le traitement asynchrone, l'utilisation de files d'attente et la limitation des processus parallèles par utilisateur et par application.2V15.1.44Vérifiez que la documentation de l’application met en évidence les bibliothèques tierces qui sont considérées comme des « composants à risque ».3V15.1.55Vérifiez que la documentation de l’application met en évidence les parties de l’application où des « fonctionnalités dangereuses » sont utilisées.3V15.22Architecture de sécurité et dépendancesV15.2.11Vérifiez que l’application contient uniquement des composants qui n’ont pas dépassé les délais de mise à jour et de correction documentés.1V15.2.22Vérifiez que l'application a mis en œuvre des défenses contre la perte de disponibilité due à des fonctionnalités qui prennent du temps ou qui nécessitent des ressources, sur la base des décisions et stratégies de sécurité documentées à cet effet.2V15.2.33Vérifiez que l'environnement de production inclut uniquement les fonctionnalités nécessaires au fonctionnement de l'application et n'expose pas de fonctionnalités superflues telles que du code de test, des exemples d'extraits et des fonctionnalités de développement.2V15.2.44Vérifiez que les composants tiers et toutes leurs dépendances transitives sont inclus à partir du référentiel attendu, qu'il soit détenu en interne ou qu'il s'agisse d'une source externe, et qu'il n'y a aucun risque d'attaque par confusion de dépendances.3V15.2.55Vérifiez que l'application implémente des protections supplémentaires autour des parties documentées comme contenant des « fonctionnalités dangereuses » ou utilisant des bibliothèques tierces considérées comme des « composants à risque ». Cela peut inclure des techniques telles que le sandboxing, l'encapsulation, la conteneurisation ou l'isolation au niveau du réseau pour retarder et dissuader les attaquants qui compromettent une partie de l'application de se propager ailleurs.3V15.33Développement défensifV15.3.11Vérifiez que l'application ne renvoie que le sous-ensemble requis de champs d'un objet de données. Par exemple, elle ne doit pas renvoyer un objet de données entier, car certains champs individuels ne doivent pas être accessibles aux utilisateurs.1V15.3.22Vérifiez que lorsque le backend de l'application effectue des appels vers des URL externes, il est configuré pour ne pas suivre les redirections, sauf s'il s'agit d'une fonctionnalité prévue.2V15.3.33Vérifiez que l'application dispose de contre-mesures pour se protéger contre les attaques d'affectation de masse en limitant les champs autorisés par contrôleur et action, par exemple, il n'est pas possible d'insérer ou de mettre à jour une valeur de champ lorsqu'elle n'était pas destinée à faire partie de cette action.2V15.3.44Vérifiez que tous les composants proxy et middleware transfèrent correctement l'adresse IP d'origine de l'utilisateur à l'aide de champs de données fiables qui ne peuvent pas être manipulés par l'utilisateur final, et que l'application et le serveur Web utilisent cette valeur correcte pour la journalisation et les décisions de sécurité telles que la limitation du débit, en tenant compte du fait que même l'adresse IP d'origine peut ne pas être fiable en raison d'adresses IP dynamiques, de VPN ou de pare-feu d'entreprise.2V15.3.55Vérifiez que l'application garantit explicitement que les variables sont du type correct et effectue des opérations d'égalité et de comparaison strictes. Cela permet d'éviter les vulnérabilités liées à la confusion de types, causées par des hypothèses du code de l'application sur le type d'une variable.2V15.3.66Vérifiez que le code JavaScript est écrit de manière à éviter la pollution du prototype, par exemple en utilisant Set() ou Map() au lieu de littéraux d'objet.2V15.3.77Vérifiez que l'application dispose de défenses contre les attaques de pollution des paramètres HTTP, en particulier si le Framework d'application ne fait aucune distinction quant à la source des paramètres de requête (chaîne de requête, paramètres de corps, cookies ou champs d'en-tête).2V15.44Concurrence sécuriséeV15.4.11Vérifiez que les objets partagés dans le code multithread (tels que les caches, les fichiers ou les objets en mémoire accessibles par plusieurs threads) sont accessibles en toute sécurité à l'aide de types thread-safe et de mécanismes de synchronisation tels que des verrous ou des sémaphores pour éviter les conditions de concurrence et la corruption des données.3V15.4.22Vérifiez que les vérifications de l'état d'une ressource, comme son existence ou ses autorisations, et des actions qui en dépendent, sont effectuées en une seule opération atomique afin d'éviter les situations de concurrence entre le moment de la vérification et le moment de l'utilisation (TOCTOU). Par exemple, vérifier l'existence d'un fichier avant de l'ouvrir ou l'accès d'un utilisateur avant de l'accorder.3V15.4.33Vérifiez que les verrous sont utilisés de manière cohérente pour éviter que les threads ne se bloquent, que ce soit en s'attendant les uns les autres ou en réessayant sans fin, et que la logique de verrouillage reste dans le code responsable de la gestion de la ressource pour garantir que les verrous ne peuvent pas être modifiés par inadvertance ou de manière malveillante par des classes ou du code externes.3V15.4.44Vérifiez que les politiques d'allocation des ressources empêchent la saturation de threads en garantissant un accès équitable aux ressources, par exemple en exploitant les pools de threads, permettant aux threads de priorité inférieure de continuer dans un délai raisonnable.3V1616SecurityJournalisation de sécurité et gestion des erreursV16.11Documentation sur la journalisation de sécuritéV16.1.11Vérifiez qu'il existe un inventaire documentant la journalisation effectuée à chaque couche de la pile technologique de l'application, les événements enregistrés, les formats de journal, l'endroit où cette journalisation est stockée, la manière dont elle est utilisée, la manière dont l'accès à celle-ci est contrôlé et la durée de conservation des journaux.2V16.22Journalisation généraleV16.2.11Vérifiez que chaque entrée de journal inclut les métadonnées nécessaires (telles que quand, où, qui, quoi) qui permettraient une enquête détaillée sur la chronologie lorsqu'un événement se produit.2V16.2.22Vérifiez que les sources de temps de tous les composants de journalisation sont synchronisées et que les horodatages des métadonnées des événements de sécurité utilisent le temps UTC ou incluent un décalage horaire explicite. L'UTC est recommandé pour garantir la cohérence entre les systèmes distribués et éviter toute confusion lors du passage à l'heure d'été.2V16.2.33Vérifiez que l’application stocke ou diffuse uniquement les journaux vers les fichiers et services documentés dans l’inventaire des journaux.2V16.2.44Vérifiez que les journaux peuvent être lus et corrélés par le processeur de journaux utilisé, de préférence en utilisant un format de journalisation commun.2V16.2.55Vérifiez que l'application applique la journalisation en fonction du niveau de protection des données lors de la journalisation de données sensibles. Par exemple, certaines données, comme les identifiants ou les informations de paiement, peuvent être interdites. D'autres données, comme les jetons de session, ne peuvent être enregistrées que par hachage ou masquage, en totalité ou en partie.2V16.33Événements de sécuritéV16.3.11Vérifiez que toutes les opérations d'authentification sont enregistrées, y compris les tentatives réussies et infructueuses. Des métadonnées supplémentaires, telles que le type d'authentification ou les facteurs utilisés, doivent également être collectées.2V16.3.22Vérifier que les tentatives d'autorisation infructueuses sont logguées. Pour le niveau 3, cela doit inclure la journalisation de toutes les décisions d'autorisation, y compris lors de l'accès à des données sensibles (sans journalisation des données sensibles elles-mêmes).2V16.3.33Vérifiez que l'application enregistre les événements de sécurité définis dans la documentation et enregistre également les tentatives de contournement des contrôles de sécurité, tels que la validation des entrées, la logique métier et l'anti-automatisation.2V16.3.44Vérifiez que l’application enregistre les erreurs inattendues et les échecs de contrôle de sécurité tels que les échecs TLS du backend.2V16.44Protection des journauxV16.4.11Vérifiez que tous les composants de journalisation codent correctement les données pour empêcher l’injection de journaux.2V16.4.22Vérifiez que les journaux sont protégés contre tout accès non autorisé et ne peuvent pas être modifiés.2V16.4.33Vérifiez que les journaux sont transmis de manière sécurisée à un système logique distinct pour analyse, détection, alerte et remontée des informations. L'objectif est de garantir qu'en cas de violation de l'application, les journaux ne seront pas compromis.2V16.55Gestion des erreursV16.5.11Vérifiez qu'un message générique est renvoyé au consommateur lorsqu'une erreur inattendue ou sensible à la sécurité se produit, garantissant ainsi l'absence d'exposition de données système internes sensibles telles que les traces de pile, les requêtes, les clés secrètes et les jetons.2V16.5.22Vérifiez que l'application continue de fonctionner en toute sécurité lorsque l'accès aux ressources externes échoue, par exemple, en utilisant des modèles tels que des disjoncteurs ou une dégradation progressive.2V16.5.33Vérifiez que l'application échoue proprement et sécurisée, y compris lorsqu'une exception se produit, en évitant les accès en cas d'erreur telles que le traitement d'une transaction malgré les erreurs résultant de la logique de validation.2V16.5.44Vérifiez qu'un gestionnaire d'erreurs de « dernier recours » est défini pour intercepter toutes les exceptions non gérées. Cela permet d'éviter la perte des informations d'erreur qui doivent être loguées dans les fichiers journaux et de garantir qu'une erreur ne paralyse pas l'ensemble du processus applicatif, entraînant une perte de disponibilité.3V1717WebRTCWebRTCV17.11Serveur TURNV17.1.11Vérifiez que le service TURN (Traversal Using Relays around NAT) autorise uniquement l'accès aux adresses IP non réservées à des fins spécifiques (par exemple, réseaux internes, diffusion, bouclage). Notez que cela s'applique aux adresses IPv4 et IPv6.2V17.1.22Vérifiez que le service Traversal Using Relays around NAT (TURN) n'est pas susceptible d'épuiser ses ressources lorsque des utilisateurs légitimes tentent d'ouvrir un grand nombre de ports sur le serveur TURN.3V17.22MédiaV17.2.11Vérifiez que la clé du certificat Datagram Transport Layer Security (DTLS) est gérée et protégée conformément à la politique documentée de gestion des clés cryptographiques.2V17.2.22Vérifiez que le serveur multimédia est configuré pour utiliser et prendre en charge les suites de chiffrement DTLS (Datagram Transport Layer Security) approuvées et un profil de protection sécurisé pour l'extension DTLS pour l'établissement de clés pour le protocole de transport en temps réel sécurisé (DTLS-SRTP).2V17.2.33Vérifiez que l'authentification SRTP (Secure Real-time Transport Protocol) est vérifiée sur le serveur multimédia pour empêcher les attaques par injection RTP (Real-time Transport Protocol) d'entraîner une condition de déni de service ou l'insertion de médias audio ou vidéo dans les flux multimédias.2V17.2.44Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant lorsqu'il rencontre des paquets SRTP (Secure Real-time Transport Protocol) mal formés.2V17.2.55Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.3V17.2.66Vérifiez que le serveur multimédia n'est pas sensible à la vulnérabilité de condition de concurrence « ClientHello » dans Datagram Transport Layer Security (DTLS) en vérifiant si le serveur multimédia est publiquement connu comme étant vulnérable ou en effectuant le test de condition de concurrence.3V17.2.77Vérifiez que tous les mécanismes d'enregistrement audio ou vidéo associés au serveur multimédia sont en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.3V17.2.88Vérifiez que le certificat Datagram Transport Layer Security (DTLS) est vérifié par rapport à l'attribut d'empreinte cryptographique du protocole de description de session (SDP), en mettant fin au flux multimédia si la vérification échoue, pour garantir l'authenticité du flux multimédia.3V17.33SignalisationV17.3.11Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation entrants légitimes lors d'une attaque par saturation. Cela peut être réalisé en implémentant une limitation de débit au niveau de la signalisation.2V17.3.22Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation légitimes en cas de message mal formé susceptible de provoquer un déni de service. Cela peut inclure la validation des entrées, la gestion sécurisée des dépassements d'entiers, la prévention des dépassements de tampon et l'utilisation d'autres techniques robustes de gestion des erreurs.2 diff --git a/5.0/docs_fr/fr b/5.0/docs_fr/fr deleted file mode 100644 index e69de29bb2..0000000000 diff --git a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.cdx.json b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.cdx.json deleted file mode 100644 index 6c2b163dad..0000000000 --- a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.cdx.json +++ /dev/null @@ -1,3057 +0,0 @@ -{ - "bomFormat": "CycloneDX", - "specVersion": "1.6", - "serialNumber": "urn:uuid:a402bfff-35e4-4c36-bc66-be15e7c21d10", - "version": 1, - "metadata": { - "timestamp": "2025-10-15T15:46:01+00:00", - "licenses": [ - { - "license": { - "id": "CC-BY-SA-4.0", - "url": "https://creativecommons.org/licenses/by-sa/4.0/legalcode.txt" - } - } - ], - "supplier": { - "name": "OWASP Foundation", - "url": [ - "https://owasp.org" - ] - } - }, - "declarations": { - "standards": [ - { - "bom-ref": "ASVS-", - "name": "Application Security Verification Standard (ASVS)", - "version": "", - "description": "The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.", - "owner": "Application Security Verification Standard Project", - "requirements": [ - { - "bom-ref": "V1", - "identifier": "V1", - "title": "Кодировка и нейтрализация" - }, - { - "bom-ref": "V1.1", - "identifier": "V1.1", - "title": "Архитектура кодировки и нейтрализации", - "parent": "V1" - }, - { - "bom-ref": "V1.1.1", - "identifier": "V1.1.1", - "text": "Убедитесь, что входные данные декодируются или деэкранируются в каноническую форму (в стандартное представление) только один раз. Декодирование происходит только тогда, когда ожидаются закодированные данные в этой форме, и что это делается перед дальнейшей обработкой входных данных, например, это не выполняется после проверки или нейтрализации.", - "parent": "V1.1" - }, - { - "bom-ref": "V1.1.2", - "identifier": "V1.1.2", - "text": "Убедитесь, что приложение выполняет кодирование и экранирование выходных данных либо в качестве последнего шага перед использованием интерпретатором, для которого оно предназначено, либо самим интерпретатором.", - "parent": "V1.1" - }, - { - "bom-ref": "V1.2", - "identifier": "V1.2", - "title": "Предотвращение инъекций", - "parent": "V1" - }, - { - "bom-ref": "V1.2.1", - "identifier": "V1.2.1", - "text": "Убедитесь, что выходная кодировка для ответа HTTP, документа HTML или документа XML соответствует требуемому контексту, например, кодировка соответствующих символов для элементов HTML, атрибутов HTML, комментариев HTML, CSS или полей заголовка HTTP делается таким способом, чтобы избежать изменения структуры сообщения или документа.", - "parent": "V1.2" - }, - { - "bom-ref": "V1.2.2", - "identifier": "V1.2.2", - "text": "Убедитесь, что при динамическом построении URL-адресов недоверенные данные кодируются в соответствии с их контекстом (например, кодирование URL-адресов или кодирование base64url для query или path параметров или пути). Убедитесь, что разрешены только безопасные протоколы URL-адресов (например, запрещен javascript: или data:).", - "parent": "V1.2" - }, - { - "bom-ref": "V1.2.3", - "identifier": "V1.2.3", - "text": "Убедитесь, что при динамическом построении содержимого JavaScript (включая JSON) используется кодирование или экранирование выходных данных, чтобы избежать изменения структуры сообщения или документа (чтобы избежать JavaScript и JSON-инъекций).", - "parent": "V1.2" - }, - { - "bom-ref": "V1.2.4", - "identifier": "V1.2.4", - "text": "Убедитесь, что выборка данных (Redis, Memcached, чтение из файлов, обращение по API) или запросы к базе данных (например, SQL, HQL, NoSQL, Cypher) используют параметризованные запросы, ORM, Entity Frameworks или иным образом защищены от SQL-инъекций и других атак. Это также актуально при написании хранимых процедур.", - "parent": "V1.2" - }, - { - "bom-ref": "V1.2.5", - "identifier": "V1.2.5", - "text": "Убедитесь, что приложение защищено от внедрения команд ОС и что вызовы операционной системы используют параметризованные запросы к ОС или используют контекстное кодирование вывода командной строки.", - "parent": "V1.2" - }, - { - "bom-ref": "V1.2.6", - "identifier": "V1.2.6", - "text": "Убедитесь, что приложение защищено от LDAP-инъекций, или что реализованы специальные меры безопасности для их предотвращения.", - "parent": "V1.2" - }, - { - "bom-ref": "V1.2.7", - "identifier": "V1.2.7", - "text": "Убедитесь, что приложение защищено от атак с использованием XPath-инъекций с помощью параметризации запросов или предварительно скомпилированных запросов.", - "parent": "V1.2" - }, - { - "bom-ref": "V1.2.8", - "identifier": "V1.2.8", - "text": "Убедитесь, что процессоры LaTeX настроены безопасно (например, не используется флаг «–shell‑escape») и используется разрешенный список команд для предотвращения LaTeX-инъекций.", - "parent": "V1.2" - }, - { - "bom-ref": "V1.2.9", - "identifier": "V1.2.9", - "text": "Убедитесь, что приложение экранирует специальные символы в регулярных выражениях (обычно с помощью обратной косой черты), чтобы предотвратить их ошибочную интерпретацию как метасимволов.", - "parent": "V1.2" - }, - { - "bom-ref": "V1.2.10", - "identifier": "V1.2.10", - "text": "Убедитесь, что приложение защищено от внедрения формул CSV (CSV Injection). Приложение должно следовать правилам экранирования, определенным в RFC 4180, разделы 2.6 и 2.7, при экспорте содержимого CSV. Кроме того, при экспорте в CSV или другие форматы электронных таблиц (такие как XLS, XLSX или ODF) специальные символы (включая '=', '+', '-', '@', '\\t' (табуляция), и '\\0' (нулевой символ)) должны экранироваться одинарной кавычкой, если они появляются в качестве первого символа в значении поля.", - "parent": "V1.2" - }, - { - "bom-ref": "V1.3", - "identifier": "V1.3", - "title": "Нейтрализация", - "parent": "V1" - }, - { - "bom-ref": "V1.3.1", - "identifier": "V1.3.1", - "text": "Убедитесь, что все ненадежные входные данные HTML из редакторов WYSIWYG или аналогичных программ нейтрализуются с помощью известных и безопасных библиотек или функций фреймворка для санитизации HTML.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.2", - "identifier": "V1.3.2", - "text": "Убедитесь, что приложение избегает использования eval() или других динамических функций выполнения кода, таких как Spring Expression Language (SpEL). Если нет альтернативы, любой пользовательский ввод должен быть нейтрализован перед выполнением.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.3", - "identifier": "V1.3.3", - "text": "Убедитесь, что данные, передаваемые в потенциально опасный контекст, предварительно нейтрализованы, чтобы обеспечить соблюдение мер безопасности, таких как разрешение только тех символов, которые безопасны для данного контекста, и обрезка слишком длинного ввода.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.4", - "identifier": "V1.3.4", - "text": "Убедитесь, что предоставленный пользователем файл .SVG проверен или нейтрализован, чтобы он содержал только теги и атрибуты (например, относящиеся к рисованию), которые безопасны для приложения, например, не содержат скриптов и foreignObject.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.5", - "identifier": "V1.3.5", - "text": "Убедитесь, что приложение нейтралует или отключает предоставленные пользователем скриптовые данные или выражения шаблонных языков, такие как таблицы стилей Markdown, CSS или XSL, BBCode или аналогичные.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.6", - "identifier": "V1.3.6", - "text": "Убедитесь, что приложение защищено от атак с подделкой запросов на стороне сервера (SSRF), проверяя ненадежные данные по разрешенному списку протоколов, доменов, путей и портов, а также нейтрализуя потенциально опасные символы перед использованием данных для вызова другой службы.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.7", - "identifier": "V1.3.7", - "text": "Убедитесь, что приложение защищено от атак с внедрением шаблонов (template injection), не позволяя создавать шаблоны на основе недоверенных входных данных. Если нет альтернативы, любые недоверенные входные данные, включаемые динамически во время создания шаблона, должны быть нейтрализованы или тщательно провалидированы.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.8", - "identifier": "V1.3.8", - "text": "Убедитесь, что приложение надлежащим образом нейтрализует недоверенные входные данные перед использованием в запросах Java Naming and Directory Interface (JNDI) и что JNDI настроен безопасно для предотвращения атак с использованием JNDI-инъекций.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.9", - "identifier": "V1.3.9", - "text": "Убедитесь, что приложение нейтрализует данные перед отправкой в Memcache, чтобы предотвратить атаки методом инъекций.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.10", - "identifier": "V1.3.10", - "text": "Убедитесь, что строки форматирования, которые могут быть использованы неожидаемым или вредоносным образом, нейтрализуются перед дальнейшим использованием.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.11", - "identifier": "V1.3.11", - "text": "Убедитесь, что приложение нейтрализует вводимые пользователем данные перед передачей в почтовые системы для защиты от SMTP или IMAP-инъекций.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.12", - "identifier": "V1.3.12", - "text": "Убедитесь, что регулярные выражения не содержат элементов, вызывающих экспоненциальный возврат, и убедитесь в нейтрализации недоверенных входных данных для предотвращения атак ReDoS или Runaway Regex.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.4", - "identifier": "V1.4", - "title": "Память, строки и неуправляемый код", - "parent": "V1" - }, - { - "bom-ref": "V1.4.1", - "identifier": "V1.4.1", - "text": "Убедитесь, что для обнаружения или предотвращения ситуаций переполнения стека, буфера или кучи приложение учитывает размер доступной области памяти при строковых операциях, копировании в память, в арифметике указателей и т.п.", - "parent": "V1.4" - }, - { - "bom-ref": "V1.4.2", - "identifier": "V1.4.2", - "text": "Убедитесь, что для предотвращения целочисленного переполнения применяется контроль знака, диапазона и типа допустимых входных данных.", - "parent": "V1.4" - }, - { - "bom-ref": "V1.4.3", - "identifier": "V1.4.3", - "text": "Убедитесь, что динамически выделенная память и ресурсы освобождены, а ссылки или указатели на освобожденную память удалены или установлены в значение null, чтобы предотвратить появление висячих указателей и уязвимостей, связанных с использованием памяти после освобождения.", - "parent": "V1.4" - }, - { - "bom-ref": "V1.5", - "identifier": "V1.5", - "title": "Безопасная десериализация", - "parent": "V1" - }, - { - "bom-ref": "V1.5.1", - "identifier": "V1.5.1", - "text": "Убедитесь, что приложение настраивает XML-парсеры на использование строгой конфигурации и что небезопасные функции, такие как разрешение внешних сущностей, отключены для предотвращения атак XML eXternal Entity (XXE).", - "parent": "V1.5" - }, - { - "bom-ref": "V1.5.2", - "identifier": "V1.5.2", - "text": "Убедитесь, что десериализация недоверенных данных обеспечивает безопасную обработку ввода, например, используя список разрешенных типов объектов или ограничивая типы объектов, определяемые клиентом, для предотвращения атак десериализации. Механизмы десериализации, которые явно определены как небезопасные, не должны использоваться с недоверенным вводом.", - "parent": "V1.5" - }, - { - "bom-ref": "V1.5.3", - "identifier": "V1.5.3", - "text": "Убедитесь, что различные парсеры, используемые в приложении для одного и того же типа данных (например, парсеры JSON, XML, URL), выполняют парсинг согласованным образом и используют один и тот же механизм кодирования символов, чтобы избежать таких проблем, как уязвимости взаимодействия JSON (JSON Interoperability) или различное поведение анализа URI или файлов, которые могут использоваться в атаках удаленного включения файлов (RFI) или подделки запросов на стороне сервера (SSRF).", - "parent": "V1.5" - }, - { - "bom-ref": "V2", - "identifier": "V2", - "title": "Валидация и бизнес-логика" - }, - { - "bom-ref": "V2.1", - "identifier": "V2.1", - "title": "Документация валидации и бизнес-логики", - "parent": "V2" - }, - { - "bom-ref": "V2.1.1", - "identifier": "V2.1.1", - "text": "Убедитесь, что в документации приложения определены правила проверки входных данных на соответствие ожидаемой структуре. Это могут быть распространённые форматы данных, такие как номера кредитных карт, адреса электронной почты, номера телефонов, или внутренний формат данных.", - "parent": "V2.1" - }, - { - "bom-ref": "V2.1.2", - "identifier": "V2.1.2", - "text": "Убедитесь, что в документации приложения указано, как проверять логическую и контекстную согласованность объединенных данных, например, проверять соответствие района и почтового индекса.", - "parent": "V2.1" - }, - { - "bom-ref": "V2.1.3", - "identifier": "V2.1.3", - "text": "Убедитесь, что ожидания относительно ограничений и проверок бизнес-логики задокументированы как для уровня отдельного пользователя, так и для глобального уровня всего приложения.", - "parent": "V2.1" - }, - { - "bom-ref": "V2.2", - "identifier": "V2.2", - "title": "Валидация ввода", - "parent": "V2" - }, - { - "bom-ref": "V2.2.1", - "identifier": "V2.2.1", - "text": "Убедитесь, что входные данные провалидированы для обеспечения соответствия бизнес- или функциональным ожиданиям. Валидация должна осуществляться либо по списку допустимых значений, шаблонов и диапазонов, либо путем сравнения входных данных с ожидаемой структурой и логическими ограничениями в соответствии с предопределенными правилами. Для L1 валидация может быть сосредоточена на входных данных, используемых для принятия конкретных бизнес-решений или решений, связанных с безопасностью. Для L2 и выше это должно применяться ко всем входным данным.", - "parent": "V2.2" - }, - { - "bom-ref": "V2.2.2", - "identifier": "V2.2.2", - "text": "Убедитесь, что приложение разработано с принудительной валидацией входных данных на уровне доверенного сервиса. Хотя проверка на стороне клиента повышает удобство использования и должна поощряться, на неё не следует полагаться как на средство контроля безопасности.", - "parent": "V2.2" - }, - { - "bom-ref": "V2.2.3", - "identifier": "V2.2.3", - "text": "Убедитесь, что приложение обеспечивает обоснованность комбинаций данных в соответствии с предопределенными правилам. Например: возраст должен соответствовать дате рождения; страна и почтовый индекс; количество товара в заказе и на складе.", - "parent": "V2.2" - }, - { - "bom-ref": "V2.3", - "identifier": "V2.3", - "title": "Безопасность бизнес-логики", - "parent": "V2" - }, - { - "bom-ref": "V2.3.1", - "identifier": "V2.3.1", - "text": "Убедитесь, что приложение обрабатывает потоки бизнес-логики для одного и того же пользователя в ожидаемом последовательном порядке шагов и без пропуска шагов.", - "parent": "V2.3" - }, - { - "bom-ref": "V2.3.2", - "identifier": "V2.3.2", - "text": "Убедитесь, что ограничения бизнес-логики реализованы в соответствии с документацией приложения, чтобы избежать эксплуатации её недостатков.", - "parent": "V2.3" - }, - { - "bom-ref": "V2.3.3", - "identifier": "V2.3.3", - "text": "Убедитесь, что транзакции используются на уровне бизнес-логики таким образом, что операция бизнес-логики либо выполняется полностью, либо откатывается к предыдущему корректному состоянию.", - "parent": "V2.3" - }, - { - "bom-ref": "V2.3.4", - "identifier": "V2.3.4", - "text": "Убедитесь, что на уровне бизнес-логики используются механизмы блокировки, чтобы гарантировать невозможность двойного бронирования ограниченных по количеству ресурсов (например, мест в театре или слотов доставки) путем манипулирования логикой приложения.", - "parent": "V2.3" - }, - { - "bom-ref": "V2.3.5", - "identifier": "V2.3.5", - "text": "Убедитесь, что для важных потоков бизнес-логики требуется многопользовательское (multi-user) одобрение, чтобы предотвратить несанкционированные или случайные действия. Потоки бизнес-логики могут включать, помимо прочего, крупные денежные переводы, утверждение контрактов, доступ к секретной информации или обход ограничений безопасности на производстве.", - "parent": "V2.3" - }, - { - "bom-ref": "V2.4", - "identifier": "V2.4", - "title": "Анти-автоматизация", - "parent": "V2" - }, - { - "bom-ref": "V2.4.1", - "identifier": "V2.4.1", - "text": "Убедитесь, что используются средства противодействия автоматизации для защиты от чрезмерных вызовов функций приложения, которые могут привести к утечке данных, созданию ненужных данных, исчерпанию квот, нарушению ограничений скорости, отказу в обслуживании или чрезмерному использованию дорогостоящих ресурсов.", - "parent": "V2.4" - }, - { - "bom-ref": "V2.4.2", - "identifier": "V2.4.2", - "text": "Убедитесь, что потоки бизнес-логики требуют реалистичного человеческого времени, предотвращая чрезмерно быструю отправку транзакций.", - "parent": "V2.4" - }, - { - "bom-ref": "V3", - "identifier": "V3", - "title": "Безопасность веб-интерфейса" - }, - { - "bom-ref": "V3.1", - "identifier": "V3.1", - "title": "Документация по безопасности веб-интерфейса", - "parent": "V3" - }, - { - "bom-ref": "V3.1.1", - "identifier": "V3.1.1", - "text": "Убедитесь, что в документации приложения описаны ожидаемые функции безопасности, которые должны поддерживать браузеры, использующие приложение (такие как HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) и другие соответствующие механизмы безопасности HTTP). В документации также должно быть обязательно определено, как приложение должно себя вести, если некоторые из этих функций недоступны (например, предупреждать пользователя или блокировать доступ).", - "parent": "V3.1" - }, - { - "bom-ref": "V3.2", - "identifier": "V3.2", - "title": "Непреднамеренная интерпретация контента", - "parent": "V3" - }, - { - "bom-ref": "V3.2.1", - "identifier": "V3.2.1", - "text": "Убедитесь, что реализованы меры безопасности, предотвращающие отображение контента или функций браузерами в HTTP-ответах в некорректном контексте (например, запрос API, загруженный пользователем файл или другой ресурс запрашивается напрямую). Возможные способы контроля включают: не обрабатывать содержимое, если поля заголовка HTTP-запроса (например, Sec-Fetch-*) не указывают на корректность контекста; использование заголовка и значения Content-Security-Policy: sandbox directive; или использование заголовка и значения Content-Disposition: attachment.", - "parent": "V3.2" - }, - { - "bom-ref": "V3.2.2", - "identifier": "V3.2.2", - "text": "Убедитесь, что данные, предназначенные для отображения в виде текста, а не визуализации в виде HTML, обрабатывается с использованием безопасных функций визуализации (таких как createTextNode или textContent), чтобы предотвратить непреднамеренное выполнение содержимого, такого как HTML или JavaScript.", - "parent": "V3.2" - }, - { - "bom-ref": "V3.2.3", - "identifier": "V3.2.3", - "text": "Убедитесь, что приложение избегает затирания DOM при использовании JavaScript на стороне клиента, применяя явные объявления переменных, выполняя строгую проверку типов, избегая сохранения глобальных переменных в объекте документа и реализуя изоляцию пространства имен.", - "parent": "V3.2" - }, - { - "bom-ref": "V3.3", - "identifier": "V3.3", - "title": "Настройка файлов cookie", - "parent": "V3" - }, - { - "bom-ref": "V3.3.1", - "identifier": "V3.3.1", - "text": "Убедитесь, что у файлов cookie установлен атрибут «Secure», и если префикс «__Host‑» не используется в названии cookie, необходимо использовать префикс «__Secure‑».", - "parent": "V3.3" - }, - { - "bom-ref": "V3.3.2", - "identifier": "V3.3.2", - "text": "Убедитесь, что значение атрибута SameSite каждой cookie установлено в соответствии с назначением cookie, чтобы ограничить подверженность атакам на восстановление пользовательского интерфейса и атакам с подделкой запросов на уровне браузера, обычно называемым подделкой межсайтовых запросов (CSRF).", - "parent": "V3.3" - }, - { - "bom-ref": "V3.3.3", - "identifier": "V3.3.3", - "text": "Убедитесь, что cookie имеют префикс «__Host‑» в названии, если только они явно не предназначены для совместного использования с другими хостами.", - "parent": "V3.3" - }, - { - "bom-ref": "V3.3.4", - "identifier": "V3.3.4", - "text": "Убедитесь, что если значение cookie не должно быть доступно для клиентских скриптов (например, сессионный токен), для cookie должен быть установлен атрибут «HttpOnly», а само значение должно передаваться клиенту только через поле заголовка «Set-Cookie».", - "parent": "V3.3" - }, - { - "bom-ref": "V3.3.5", - "identifier": "V3.3.5", - "text": "Убедитесь, что при записи cookie приложением общая длина имени и значения cookie не превышает 4096 байт. Слишком большие cookie не будут сохраняться браузером и, следовательно, не будут отправляться с запросами, что помешает пользователю использовать функции приложения, зависящие от этого cookie.", - "parent": "V3.3" - }, - { - "bom-ref": "V3.4", - "identifier": "V3.4", - "title": "Заголовки механизма безопасности браузера", - "parent": "V3" - }, - { - "bom-ref": "V3.4.1", - "identifier": "V3.4.1", - "text": "Убедитесь, что поле заголовка Strict‑Transport‑Security включено во все ответы для реализации политики HTTP Strict Transport Security (HSTS). Необходимо указать максимальное время не менее 1 года, а для L2 и выше политика должна применяться также ко всем поддоменам.", - "parent": "V3.4" - }, - { - "bom-ref": "V3.4.2", - "identifier": "V3.4.2", - "text": "Убедитесь, что поле заголовка Cross‑Origin Resource Sharing (CORS) «Access‑Control‑Allow‑Origin» имеет фиксированное значение, заданное приложением, или, если используется заголовок Origin, оно проверяется по списку доверенных источников. При необходимости использования «Access‑Control‑Allow‑Origin: *» убедитесь, что ответ не содержит конфиденциальной информации.", - "parent": "V3.4" - }, - { - "bom-ref": "V3.4.3", - "identifier": "V3.4.3", - "text": "Убедитесь, что HTTP-ответы содержат поле заголовка Content-Security-Policy, которое определяет директивы, гарантирующие загрузку и выполнение браузером только доверенного контента или ресурсов, чтобы ограничить выполнение вредоносного JavaScript. Как минимум, необходимо использовать глобальную политику, включающую директивы object-src «none» и base-uri «none», а также определяющую список разрешенных адресов или использующую одноразовые коды или хэши. Для приложений L3 необходимо определить политику использования 'nonce' или hash-конструкций для каждого ответа.", - "parent": "V3.4" - }, - { - "bom-ref": "V3.4.4", - "identifier": "V3.4.4", - "text": "Убедитесь, что все HTTP-ответы содержат поле заголовка «X‑Content‑Type‑Options: nosniff». Это предписывает браузерам не использовать анализ контента и определение типа MIME для данного ответа, а также требовать, чтобы значение поля заголовка Content‑Type в ответе соответствовало целевому ресурсу. Например, ответ на запрос стиля принимается только в том случае, если Content‑Type в ответе — «text/css». Это также позволяет браузеру использовать функцию Cross‑Origin Read Blocking (CORB).", - "parent": "V3.4" - }, - { - "bom-ref": "V3.4.5", - "identifier": "V3.4.5", - "text": "Убедитесь, что приложение устанавливает политику реферера для предотвращения утечки технически конфиденциальных данных сторонним сервисам через поле заголовка HTTP-запроса «Referer». Это можно сделать с помощью поля заголовка HTTP-ответа «Referrer‑Policy» или через атрибуты HTML-элемента. Конфиденциальные данные могут включать путь и данные запроса в URL-адресе, а для внутренних непубличных приложений также имя хоста.", - "parent": "V3.4" - }, - { - "bom-ref": "V3.4.6", - "identifier": "V3.4.6", - "text": "Убедитесь, что веб-приложение использует директиву frame‑ancestors поля заголовка Content‑Security‑Policy для каждого HTTP-ответа, чтобы гарантировать невозможность его внедрения по умолчанию и внедрение определённых ресурсов разрешено только при необходимости. Обратите внимание, что поле заголовка X‑Frame‑Options, хотя и поддерживается браузерами, устарело и не может быть использовано в качестве основы.", - "parent": "V3.4" - }, - { - "bom-ref": "V3.4.7", - "identifier": "V3.4.7", - "text": "Убедитесь, что в поле заголовка Content‑Security‑Policy указано место, куда следует сообщать о нарушениях.", - "parent": "V3.4" - }, - { - "bom-ref": "V3.4.8", - "identifier": "V3.4.8", - "text": "Убедитесь, что все HTTP-ответы, инициирующие рендеринг документа (например, ответы с типом содержимого text/html), включают поле заголовка Cross-Origin-Opener-Policy с директивой same-origin или same-origin-allow-popups (при необходимости). Это предотвращает атаки, злоупотребляющие общим доступом к объектам Window, такие как Tabnabbing и Frame Counting.", - "parent": "V3.4" - }, - { - "bom-ref": "V3.5", - "identifier": "V3.5", - "title": "Браузерное разделение источников", - "parent": "V3" - }, - { - "bom-ref": "V3.5.1", - "identifier": "V3.5.1", - "text": "Убедитесь, что, если приложение не использует механизм предварительной проверки CORS для предотвращения запрещённых кросс-доменных запросов на использование чувствительного функционала, эти запросы валидируются на предмет их происхождения от самого приложения. Это можно сделать, используя и проверяя специальные токены для защиты от подделки или требуя дополнительные поля HTTP-заголовка, не входящие в список «простых заголовков» (CORS-safelisted request-header). Это необходимо для защиты от атак с подделкой запросов через браузер, широко известных как межсайтовая подделка запросов (CSRF).", - "parent": "V3.5" - }, - { - "bom-ref": "V3.5.2", - "identifier": "V3.5.2", - "text": "Убедитесь, что если приложение использует механизм предварительной проверки CORS для предотвращения неразрешённого использования чувствительного функционала между источниками, вызов этого функционала невозможен с помощью запроса, который не запускает предварительную проверку CORS. Для этого может потребоваться проверка значений полей заголовка запроса «Origin» и «Content-Type» или использование дополнительного поля заголовка, не входящего в безопасный список CORS.", - "parent": "V3.5" - }, - { - "bom-ref": "V3.5.3", - "identifier": "V3.5.3", - "text": "Убедитесь, что HTTP-запросы к чувствительному функционалу используют соответствующие HTTP-методы, такие как POST, PUT, PATCH или DELETE, а не методы, определённые спецификацией HTTP как «безопасные», такие как HEAD, OPTIONS или GET. В качестве альтернативы можно использовать строгую валидацию полей заголовка запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, навигационного запроса или загрузки ресурса (например, источника изображения), где это не ожидается.", - "parent": "V3.5" - }, - { - "bom-ref": "V3.5.4", - "identifier": "V3.5.4", - "text": "Убедитесь, что отдельные приложения размещены на разных именах хостов, чтобы использовать ограничения, предусмотренные политикой same-origin, включая то, как документы или скрипты, загруженные одним источником, могут взаимодействовать с ресурсами из другого источника, а также ограничения на cookie на основе имени хоста.", - "parent": "V3.5" - }, - { - "bom-ref": "V3.5.5", - "identifier": "V3.5.5", - "text": "Убедитесь, что сообщения, полученные интерфейсом postMessage, отвергаются, если источник сообщения не является доверенным или если синтаксис сообщения недействителен.", - "parent": "V3.5" - }, - { - "bom-ref": "V3.5.6", - "identifier": "V3.5.6", - "text": "Убедитесь, что функциональность JSONP не включена нигде в приложении, чтобы избежать атак с использованием межсайтового включения скриптов (XSSI).", - "parent": "V3.5" - }, - { - "bom-ref": "V3.5.7", - "identifier": "V3.5.7", - "text": "Убедитесь, что данные, требующие авторизации, не включены в ответы ресурсов скриптов, таких как файлы JavaScript, чтобы предотвратить атаки с использованием межсайтового включения скриптов (XSSI).", - "parent": "V3.5" - }, - { - "bom-ref": "V3.5.8", - "identifier": "V3.5.8", - "text": "Убедитесь, что аутентифицированные ресурсы (такие как изображения, видео, скрипты и другие документы) могут быть загружены или внедрены от имени пользователя только по назначению. Этого можно добиться путём строгой валидации полей заголовка HTTP-запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, или путём установки ограничительного поля заголовка HTTP-ответа Cross‑Origin‑Resource‑Policy, чтобы браузер блокировал возвращаемый контент.", - "parent": "V3.5" - }, - { - "bom-ref": "V3.6", - "identifier": "V3.6", - "title": "Целостность внешних ресурсов", - "parent": "V3" - }, - { - "bom-ref": "V3.6.1", - "identifier": "V3.6.1", - "text": "Убедитесь, что клиентские ресурсы, такие как библиотеки JavaScript, CSS или веб-шрифты, размещаются только на внешнем сервере (например, в сети доставки контента (Content Delivery Network)), если ресурс статический и имеет версии, а для проверки целостности ресурса используется механизм проверки целостности подресурсов (SRI). Если это невозможно, для каждого ресурса должно быть задокументировано решение по безопасности, обосновывающее это.", - "parent": "V3.6" - }, - { - "bom-ref": "V3.7", - "identifier": "V3.7", - "title": "Другие соображения по безопасности браузера", - "parent": "V3" - }, - { - "bom-ref": "V3.7.1", - "identifier": "V3.7.1", - "text": "Убедитесь, что приложение использует только те клиентские технологии, которые по-прежнему поддерживаются и считаются безопасными. Примерами технологий, не соответствующих этому требованию, являются плагины NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL или клиентские Java-апплеты.", - "parent": "V3.7" - }, - { - "bom-ref": "V3.7.2", - "identifier": "V3.7.2", - "text": "Убедитесь, что приложение будет автоматически перенаправлять пользователя на другое имя хоста или домен (который не контролируется приложением), только если этот хост или домен указаны в списке разрешенных.", - "parent": "V3.7" - }, - { - "bom-ref": "V3.7.3", - "identifier": "V3.7.3", - "text": "Убедитесь, что приложение отображает уведомление, что пользователь перенаправляется на URL-адрес, находящийся вне контроля приложения, с возможностью отмены навигации.", - "parent": "V3.7" - }, - { - "bom-ref": "V3.7.4", - "identifier": "V3.7.4", - "text": "Убедитесь, что домен верхнего уровня приложения (например, site.tld) ​​добавлен в публичный список предварительной загрузки (preload list) для HTTP Strict Transport Security (HSTS). Это гарантирует, что использование TLS для приложения будет встроено непосредственно в основные браузеры, а не будет полагаться только на поле заголовка ответа Strict-Transport-Security.", - "parent": "V3.7" - }, - { - "bom-ref": "V3.7.5", - "identifier": "V3.7.5", - "text": "Убедитесь, что приложение ведет себя так, как описано в документации (например, предупреждает пользователя или блокирует доступ), если браузер, используемый для доступа к приложению, не поддерживает ожидаемые функции безопасности.", - "parent": "V3.7" - }, - { - "bom-ref": "V4", - "identifier": "V4", - "title": "API и Веб-сервис" - }, - { - "bom-ref": "V4.1", - "identifier": "V4.1", - "title": "Общая безопасность веб-сервисов", - "parent": "V4" - }, - { - "bom-ref": "V4.1.1", - "identifier": "V4.1.1", - "text": "Убедитесь, что каждый HTTP-ответ с телом сообщения содержит заголовок Content-Type, который соответствует фактическому содержимому ответа, таким как «text/», «/+xml» и «/xml», включая параметр charset для указания безопасной кодировки символов (например, UTF-8, ISO-8859-1) согласно IANA Media Types.", - "parent": "V4.1" - }, - { - "bom-ref": "V4.1.2", - "identifier": "V4.1.2", - "text": "Убедитесь, что только конечные точки, предназначенные для взаимодействия с пользователем через веб-браузер, автоматически перенаправляют HTTP на HTTPS, в то время как другие сервисы или конечные точки не реализуют прозрачные редиректы. Это необходимо, чтобы избежать ситуации, когда клиент ошибочно отправляет незашифрованные HTTP-запросы а из-за того, что запрос по HTTP автоматически перенаправляется на HTTPS другим сервисом без обработки на входе, утечка чувствительных данных остаётся незамеченной.", - "parent": "V4.1" - }, - { - "bom-ref": "V4.1.3", - "identifier": "V4.1.3", - "text": "Убедитесь, что любой HTTP-заголовок, используемый приложением и устанавливаемый промежуточным уровнем, таким как балансировщик нагрузки, веб-прокси или backend-for-frontend сервис, не может быть переопределён конечным пользователем. Примеры заголовков: X-Real-IP, X-Forwarded-*, X-User-ID.", - "parent": "V4.1" - }, - { - "bom-ref": "V4.1.4", - "identifier": "V4.1.4", - "text": "Убедитесь, что разрешены только HTTP-методы, которые явно поддерживаются приложением или его API (включая OPTIONS для preflight-запросов), а неиспользуемые методы заблокированы.", - "parent": "V4.1" - }, - { - "bom-ref": "V4.1.5", - "identifier": "V4.1.5", - "text": "Убедитесь, что для особо чувствительных запросов или транзакций, проходящих через несколько систем, используются цифровые подписи на уровне сообщений, дополнительно к транспортным средствам защиты.", - "parent": "V4.1" - }, - { - "bom-ref": "V4.2", - "identifier": "V4.2", - "title": "Валидация структуры HTTP-сообщений", - "parent": "V4" - }, - { - "bom-ref": "V4.2.1", - "identifier": "V4.2.1", - "text": "Убедитесь, что все компоненты приложения (включая балансировщики нагрузки, файрволы и серверы приложений) определяют границы входящих HTTP-сообщений с использованием механизма, соответствующего версии HTTP, чтобы предотвратить HTTP request smuggling. В HTTP/1.x, если присутствует заголовок Transfer-Encoding, заголовок Content-Length должен игнорироваться согласно RFC 2616. При использовании HTTP/2 или HTTP/3, если присутствует Content-Length, веб-сервер должен убедиться, что он совпадает с длиной DATA-фреймов.", - "parent": "V4.2" - }, - { - "bom-ref": "V4.2.2", - "identifier": "V4.2.2", - "text": "Убедитесь, что при генерации HTTP-сообщений заголовок Content-Length не конфликтует с длиной содержимого, определяемой рамками протокола HTTP, чтобы предотвратить HTTP Request Smuggling.", - "parent": "V4.2" - }, - { - "bom-ref": "V4.2.3", - "identifier": "V4.2.3", - "text": "Убедитесь, что приложение не отправляет и не принимает HTTP/2 и HTTP/3 сообщения с заголовками, специфичными для соединения, такими как Transfer-Encoding, чтобы предотвратить HTTP Response Splitting и HTTP Header Injection.", - "parent": "V4.2" - }, - { - "bom-ref": "V4.2.4", - "identifier": "V4.2.4", - "text": "Убедитесь, что приложение принимает HTTP/2 и HTTP/3 запросы только в случае, если поля заголовков и их значения не содержат последовательностей CR (\\r), LF (\\n) или CRLF (\\r\\n), чтобы предотвратить HTTP Header Injection.", - "parent": "V4.2" - }, - { - "bom-ref": "V4.2.5", - "identifier": "V4.2.5", - "text": "Убедитесь, что если приложение (бекенд или фронтенд) формирует и отправляет запросы, оно использует валидацию, очистку или другие механизмы, чтобы не создавать URI (например, для API-вызовов) или HTTP-заголовки (например, Authorization или Cookie) слишком большой длины, чтобы их не принимал приёмник. Это может привести к отказу в обслуживании, например, при отправке слишком длинного запроса (длинный cookie-заголовок), из-за чего сервер постоянно возвращает ошибку.", - "parent": "V4.2" - }, - { - "bom-ref": "V4.3", - "identifier": "V4.3", - "title": "GraphQL", - "parent": "V4" - }, - { - "bom-ref": "V4.3.1", - "identifier": "V4.3.1", - "text": "Убедитесь, что используется белый список запросов, ограничение глубины вложенности, ограничение количества или анализ стоимости запроса, чтобы предотвратить DoS-атаки на уровне GraphQL или слоя данных из-за дорогостоящих вложенных запросов.", - "parent": "V4.3" - }, - { - "bom-ref": "V4.3.2", - "identifier": "V4.3.2", - "text": "Убедитесь, что introspection-запросы GraphQL отключены в продакшен-среде, если GraphQL API не предназначен для использования сторонними клиентами.", - "parent": "V4.3" - }, - { - "bom-ref": "V4.4", - "identifier": "V4.4", - "title": "WebSocket", - "parent": "V4" - }, - { - "bom-ref": "V4.4.1", - "identifier": "V4.4.1", - "text": "Убедитесь, что для всех WebSocket-соединений используется WebSocket поверх TLS (WSS).", - "parent": "V4.4" - }, - { - "bom-ref": "V4.4.2", - "identifier": "V4.4.2", - "text": "Убедитесь, что при первоначальном HTTP WebSocket handshake заголовок Origin проверяется на соответствие списку разрешённых источников для приложения.", - "parent": "V4.4" - }, - { - "bom-ref": "V4.4.3", - "identifier": "V4.4.3", - "text": "Убедитесь, что если стандартное управление сессиями приложения не может быть использовано, применяются специальные токены, соответствующие требованиям безопасности управления сессиями.", - "parent": "V4.4" - }, - { - "bom-ref": "V4.4.4", - "identifier": "V4.4.4", - "text": "Убедитесь, что специальные токены управления сессиями WebSocket изначально получаются или валидируются через ранее аутентифицированную HTTPS-сессию при переходе от HTTPS к WebSocket.", - "parent": "V4.4" - }, - { - "bom-ref": "V5", - "identifier": "V5", - "title": "Работа с файлами" - }, - { - "bom-ref": "V5.1", - "identifier": "V5.1", - "title": "Документация по работе с файлами", - "parent": "V5" - }, - { - "bom-ref": "V5.1.1", - "identifier": "V5.1.1", - "text": "Убедитесь, что документация определяет допустимые типы файлов, ожидаемые расширения и максимальный размер (включая распакованный размер) для каждой функции загрузки. Также убедитесь, что в документации указано, как файлы обезвреживаются для конечных пользователей (например, как приложение ведёт себя при обнаружении вредоносного файла).", - "parent": "V5.1" - }, - { - "bom-ref": "V5.2", - "identifier": "V5.2", - "title": "Загрузка файлов и содержимое", - "parent": "V5" - }, - { - "bom-ref": "V5.2.1", - "identifier": "V5.2.1", - "text": "Убедитесь, что приложение принимает только те файлы, которые может обработать без потери производительности или отказа в обслуживании.", - "parent": "V5.2" - }, - { - "bom-ref": "V5.2.2", - "identifier": "V5.2.2", - "text": "Убедитесь, что при загрузке файла (включая файлы внутри архивов, таких как ZIP) приложение проверяет, соответствует ли расширение ожидаемому, и валидирует, соответствует ли содержимое типу, указанному в расширении. Это включает проверку начальных 'magic bytes', перезапись изображений, использование специализированных библиотек. Для уровня 1 — достаточно проверок для файлов, критичных с точки зрения бизнеса или безопасности. Для уровней 2 и выше — для всех файлов.", - "parent": "V5.2" - }, - { - "bom-ref": "V5.2.3", - "identifier": "V5.2.3", - "text": "Убедитесь, что приложение проверяет архивы (например, zip, gz, docx, odt) на максимально допустимый распакованный размер и максимальное количество файлов до распаковки.", - "parent": "V5.2" - }, - { - "bom-ref": "V5.2.4", - "identifier": "V5.2.4", - "text": "Убедитесь, что для каждого пользователя установлены квоты на общий размер и количество файлов, чтобы один пользователь не мог переполнить хранилище.", - "parent": "V5.2" - }, - { - "bom-ref": "V5.2.5", - "identifier": "V5.2.5", - "text": "Убедитесь, что приложение не позволяет загружать архивы с символьными ссылками (symlinks), если это не требуется по бизнес-логике. Если требуется — разрешён только строго определённый список допустимых символьных ссылок.", - "parent": "V5.2" - }, - { - "bom-ref": "V5.2.6", - "identifier": "V5.2.6", - "text": "Убедитесь, что приложение отклоняет изображения с числом пикселей выше допустимого, чтобы предотвратить атаки 'pixel flood'.", - "parent": "V5.2" - }, - { - "bom-ref": "V5.3", - "identifier": "V5.3", - "title": "Хранение файлов", - "parent": "V5" - }, - { - "bom-ref": "V5.3.1", - "identifier": "V5.3.1", - "text": "Убедитесь, что загруженные или сгенерированные из недоверенного ввода файлы, находящиеся в публичной директории, не исполняются как серверный код при обращении к ним по HTTP.", - "parent": "V5.3" - }, - { - "bom-ref": "V5.3.2", - "identifier": "V5.3.2", - "text": "Убедитесь, что при создании путей к файлам приложение использует внутренние или доверенные данные, а не пользовательские имена файлов. Если использование пользовательских имён или метаданных необходимо — требуется строгая проверка и очистка. Это защита от path traversal, LFI, RFI и SSRF.", - "parent": "V5.3" - }, - { - "bom-ref": "V5.3.3", - "identifier": "V5.3.3", - "text": "Убедитесь, что при обработке файлов на сервере (например, при распаковке) игнорируются пути, заданные пользователем, во избежание уязвимостей типа 'zip slip'.", - "parent": "V5.3" - }, - { - "bom-ref": "V5.4", - "identifier": "V5.4", - "title": "Скачивание файлов", - "parent": "V5" - }, - { - "bom-ref": "V5.4.1", - "identifier": "V5.4.1", - "text": "Убедитесь, что приложение валидирует или игнорирует имена файлов, переданных пользователем (включая в JSON, JSONP или URL-параметре), и указывает имя файла в заголовке Content-Disposition при ответе.", - "parent": "V5.4" - }, - { - "bom-ref": "V5.4.2", - "identifier": "V5.4.2", - "text": "Убедитесь, что имена файлов, передаваемые (например, в HTTP-заголовках или вложениях в email), кодируются или очищаются (например, по RFC 6266), чтобы сохранить структуру документа и предотвратить инъекции.", - "parent": "V5.4" - }, - { - "bom-ref": "V5.4.3", - "identifier": "V5.4.3", - "text": "Убедитесь, что файлы, полученные из недоверенных источников, сканируются антивирусом, чтобы не распространять известное вредоносное содержимое.", - "parent": "V5.4" - }, - { - "bom-ref": "V6", - "identifier": "V6", - "title": "Аутентификация" - }, - { - "bom-ref": "V6.1", - "identifier": "V6.1", - "title": "Документация по аутентификации", - "parent": "V6" - }, - { - "bom-ref": "V6.1.1", - "identifier": "V6.1.1", - "text": "Убедитесь, что в документации приложения описано, как используются механизмы, такие как ограничение частоты запросов (rate limiting), защита от автоматизации и адаптивные реакции, для защиты от атак, таких как подстановка учётных данных и перебор паролей. Документация должна ясно описывать конфигурацию этих механизмов и предотвращение злонамеренной блокировки аккаунтов.", - "parent": "V6.1" - }, - { - "bom-ref": "V6.1.2", - "identifier": "V6.1.2", - "text": "Убедитесь, что задокументирован список контекстно-зависимых слов, запрещённых к использованию в паролях. В него могут входить производные от названий организаций, продуктов, идентификаторов систем, кодовых названий проектов, названий отделов или ролей и тому подобное.", - "parent": "V6.1" - }, - { - "bom-ref": "V6.1.3", - "identifier": "V6.1.3", - "text": "Убедитесь, что если приложение поддерживает несколько способов аутентификации, то все они документированы вместе с описанием применяемых средств защиты и уровнем стойкости аутентификации, которые должны быть одинаково применены ко всем способам.", - "parent": "V6.1" - }, - { - "bom-ref": "V6.2", - "identifier": "V6.2", - "title": "Безопасность паролей", - "parent": "V6" - }, - { - "bom-ref": "V6.2.1", - "identifier": "V6.2.1", - "text": "Убедитесь, что пользовательские пароли содержат не менее 8 символов. Рекомендуется минимальная длина в 15 символов.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.2", - "identifier": "V6.2.2", - "text": "Убедитесь, что пользователи могут менять свои пароли.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.3", - "identifier": "V6.2.3", - "text": "Убедитесь, что для смены пароля требуется ввести как текущий, так и новый пароль.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.4", - "identifier": "V6.2.4", - "text": "Убедитесь, что при регистрации или смене пароля введённый пароль проверяется по списку как минимум из 3000 самых популярных паролей, соответствующих политике (например, минимальной длине).", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.5", - "identifier": "V6.2.5", - "text": "Убедитесь, что допускаются пароли любой структуры, без ограничений на использование определённых символов. Не должно быть требований по обязательному наличию заглавных/строчных букв, цифр или специальных символов.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.6", - "identifier": "V6.2.6", - "text": "Убедитесь, что поля ввода пароля используют type=password для скрытия символов. Разрешено временное отображение всего пароля или последнего введённого символа.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.7", - "identifier": "V6.2.7", - "text": "Убедитесь, что разрешены вставка (paste), использование менеджеров паролей браузера и внешних менеджеров паролей.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.8", - "identifier": "V6.2.8", - "text": "Убедитесь, что пароль проверяется строго в том виде, в котором он был введён пользователем — без обрезки, изменения регистра и других модификаций.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.9", - "identifier": "V6.2.9", - "text": "Убедитесь, что система позволяет использовать пароли длиной не менее 64 символов.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.10", - "identifier": "V6.2.10", - "text": "Убедитесь, что пароль остаётся действительным, пока не будет скомпрометирован или не будет изменён пользователем. Приложение не должно требовать регулярной смены пароля.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.11", - "identifier": "V6.2.11", - "text": "Убедитесь, что используется документированный список контекстно-зависимых слов (например, названия компаний, проектов и т.д.) для предотвращения использования легко угадываемых паролей.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.12", - "identifier": "V6.2.12", - "text": "Убедитесь, что при регистрации или смене пароля проверяется, не входит ли он в список скомпрометированных (утёкших) паролей.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.3", - "identifier": "V6.3", - "title": "Общие требования к безопасности аутентификации", - "parent": "V6" - }, - { - "bom-ref": "V6.3.1", - "identifier": "V6.3.1", - "text": "Убедитесь, что реализованы меры защиты от атак типа credential stuffing (массовая подстановка учётных данных) и brute-force (перебор паролей), согласно документации по безопасности приложения.", - "parent": "V6.3" - }, - { - "bom-ref": "V6.3.2", - "identifier": "V6.3.2", - "text": "Убедитесь, что в приложении отсутствуют или отключены учётные записи по умолчанию (например, root, admin, sa).", - "parent": "V6.3" - }, - { - "bom-ref": "V6.3.3", - "identifier": "V6.3.3", - "text": "Убедитесь, что для доступа к приложению используется либо механизм многофакторной аутентификации, либо комбинация однофакторных. Для уровня L3 один из факторов должен быть аппаратным, обеспечивающим защиту от фишинга, устойчивость к компрометации и подтверждение намерения аутентификации через явное действие пользователя (например, нажатие кнопки на FIDO-ключе или телефоне). Ослабление этих требований допускается только при наличии обоснования и компенсирующих мер.", - "parent": "V6.3" - }, - { - "bom-ref": "V6.3.4", - "identifier": "V6.3.4", - "text": "Убедитесь, что при наличии нескольких способов аутентификации, они все задокументированы, и для них единообразно применяются меры защиты и уровни доверия.", - "parent": "V6.3" - }, - { - "bom-ref": "V6.3.5", - "identifier": "V6.3.5", - "text": "Убедитесь, что пользователи получают уведомления о подозрительных попытках аутентификации (удачных и неудачных). Это может включать попытки (например, подключения) с необычного устройства или места, частично успешную MFA, попытку после долгого отсутствия или успешную аутентификацию после серии неудачных.", - "parent": "V6.3" - }, - { - "bom-ref": "V6.3.6", - "identifier": "V6.3.6", - "text": "Убедитесь, что email не используется ни как однофакторный, ни как многофакторный механизм аутентификации.", - "parent": "V6.3" - }, - { - "bom-ref": "V6.3.7", - "identifier": "V6.3.7", - "text": "Убедитесь, что пользователи получают уведомление при изменении данных аутентификации, таких как сброс пароля или изменение логина/email.", - "parent": "V6.3" - }, - { - "bom-ref": "V6.3.8", - "identifier": "V6.3.8", - "text": "Убедитесь, что из сообщений об ошибке, HTTP-кодов ответа или различий во времени ответа нельзя определить, существует ли пользователь с таким логином. Это правило также должно применяться к функциям регистрации и восстановления пароля.", - "parent": "V6.3" - }, - { - "bom-ref": "V6.4", - "identifier": "V6.4", - "title": "Жизненный цикл и восстановление факторов аутентификации", - "parent": "V6" - }, - { - "bom-ref": "V6.4.1", - "identifier": "V6.4.1", - "text": "Убедитесь, что начальные пароли или коды активации, генерируемые системой, создаются с использованием надёжного генератора случайных чисел, соответствуют текущей политике паролей и истекают через короткий период времени либо после первого использования. Эти секреты не должны использоваться как постоянные пароли.", - "parent": "V6.4" - }, - { - "bom-ref": "V6.4.2", - "identifier": "V6.4.2", - "text": "Убедитесь, что в системе отсутствуют подсказки к паролю или вопросы на знание («секретные вопросы»).", - "parent": "V6.4" - }, - { - "bom-ref": "V6.4.3", - "identifier": "V6.4.3", - "text": "Убедитесь, что реализован безопасный процесс сброса забытого пароля, который не обходит активные механизмы многофакторной аутентификации.", - "parent": "V6.4" - }, - { - "bom-ref": "V6.4.4", - "identifier": "V6.4.4", - "text": "Убедитесь, что в случае утраты одного из факторов MFA проводится удостоверение личности (identity proofing) на том же уровне, что и при первичной регистрации.", - "parent": "V6.4" - }, - { - "bom-ref": "V6.4.5", - "identifier": "V6.4.5", - "text": "Убедитесь, что инструкции по обновлению истекающих механизмов аутентификации отправляются заранее, с достаточным запасом времени для выполнения замены, при необходимости с настройкой автоматических напоминаний.", - "parent": "V6.4" - }, - { - "bom-ref": "V6.4.6", - "identifier": "V6.4.6", - "text": "Убедитесь, что администраторы могут инициировать процесс сброса пароля, но не могут задать или выбрать новый пароль за пользователя. Это исключает ситуацию, при которой администратор знает пароль пользователя.", - "parent": "V6.4" - }, - { - "bom-ref": "V6.5", - "identifier": "V6.5", - "title": "Общие требования к многофакторной аутентификации", - "parent": "V6" - }, - { - "bom-ref": "V6.5.1", - "identifier": "V6.5.1", - "text": "Убедитесь, что lookup-секреты, внеполосные коды/запросы и TOTP-коды можно использовать только один раз.", - "parent": "V6.5" - }, - { - "bom-ref": "V6.5.2", - "identifier": "V6.5.2", - "text": "Убедитесь, что при хранении lookup-секретов с энтропией менее 112 бит (например, 19 случайных буквенно-цифровых символов или 34 случайные цифры) они хэшируются с использованием разрешённого алгоритма хеширования паролей и случайной соли минимум 32 бита. Если у секрета ≥112 бит энтропии — допустимо использовать стандартный хэш.", - "parent": "V6.5" - }, - { - "bom-ref": "V6.5.3", - "identifier": "V6.5.3", - "text": "Убедитесь, что lookup-секреты, коды внеполосной аутентификации и сиды для TOTP генерируются с использованием криптографически стойкого генератора случайных чисел (CSPRNG), чтобы избежать предсказуемых значений.", - "parent": "V6.5" - }, - { - "bom-ref": "V6.5.4", - "identifier": "V6.5.4", - "text": "Убедитесь, что lookup-секреты и внеполосные коды аутентификации имеют минимум 20 бит энтропии (достаточно, например, 4 случайных алфавитно-цифровых символов или 6 случайных цифр).", - "parent": "V6.5" - }, - { - "bom-ref": "V6.5.5", - "identifier": "V6.5.5", - "text": "Убедитесь, что все внеполосные запросы, коды и токены, а также TOTP-коды имеют ограниченный срок действия. Максимум для out-of-band — 10 минут, для TOTP — 30 секунд.", - "parent": "V6.5" - }, - { - "bom-ref": "V6.5.6", - "identifier": "V6.5.6", - "text": "Убедитесь, что любой фактор аутентификации (включая физические устройства) может быть отозван в случае кражи или утери.", - "parent": "V6.5" - }, - { - "bom-ref": "V6.5.7", - "identifier": "V6.5.7", - "text": "Убедитесь, что биометрические механизмы аутентификации используются только как вторичный фактор — в сочетании с «чем-то, что вы знаете» или «чем-то, что у вас есть».", - "parent": "V6.5" - }, - { - "bom-ref": "V6.5.8", - "identifier": "V6.5.8", - "text": "Убедитесь, что TOTP-коды проверяются по источнику времени, полученному от доверенного сервиса, а не от клиента или недоверенного источника.", - "parent": "V6.5" - }, - { - "bom-ref": "V6.6", - "identifier": "V6.6", - "title": "Внеполосные механизмы аутентификации", - "parent": "V6" - }, - { - "bom-ref": "V6.6.1", - "identifier": "V6.6.1", - "text": "Убедитесь, что механизмы аутентификации через телефонную сеть общего пользования (PSTN) для доставки одноразовых паролей (OTP) по телефону или SMS используются только в случае предварительной валидации номера, при этом предлагаются альтернативные более безопасные методы (например, TOTP), и пользователю сообщаются риски. Для приложений уровня L3 использование телефона и SMS недопустимо.", - "parent": "V6.6" - }, - { - "bom-ref": "V6.6.2", - "identifier": "V6.6.2", - "text": "Убедитесь, что внеполосные запросы, коды или токены привязаны к исходному запросу аутентификации, для которого они были сгенерированы, и не могут быть использованы повторно для других попыток.", - "parent": "V6.6" - }, - { - "bom-ref": "V6.6.3", - "identifier": "V6.6.3", - "text": "Убедитесь, что внеполосные механизмы на основе кода защищены от атак методом подбора (brute force) путём применения ограничения частоты запросов (rate limiting). Также рекомендуется использовать коды с энтропией не менее 64 бит.", - "parent": "V6.6" - }, - { - "bom-ref": "V6.6.4", - "identifier": "V6.6.4", - "text": "Убедитесь, что при использовании push-уведомлений для MFA применяется ограничение частоты (rate limiting), чтобы предотвратить атаки push-бомбинга. Также может помочь механизм сопоставления номеров (number matching).", - "parent": "V6.6" - }, - { - "bom-ref": "V6.7", - "identifier": "V6.7", - "title": "Криптографические механизмы аутентификации", - "parent": "V6" - }, - { - "bom-ref": "V6.7.1", - "identifier": "V6.7.1", - "text": "Убедитесь, что сертификаты, используемые для проверки криптографических утверждений об аутентификации, хранятся таким образом, чтобы исключить возможность их модификации.", - "parent": "V6.7" - }, - { - "bom-ref": "V6.7.2", - "identifier": "V6.7.2", - "text": "Убедитесь, что nonce (случайная строка), используемая в процессе вызова, имеет длину не менее 64 бит и является статистически уникальной или уникальной на протяжении всего срока службы криптографического устройства.", - "parent": "V6.7" - }, - { - "bom-ref": "V6.8", - "identifier": "V6.8", - "title": "Аутентификация с использованием провайдера идентификаций (IdP)", - "parent": "V6" - }, - { - "bom-ref": "V6.8.1", - "identifier": "V6.8.1", - "text": "Убедитесь, что при поддержке несколькими IdP, невозможно подделать личность пользователя через другой IdP (например, с тем же user ID). Стандартным способом защиты является регистрация пользователя с использованием сочетания ID самого IdP (в качестве пространства имён) и пользовательского ID внутри IdP.", - "parent": "V6.8" - }, - { - "bom-ref": "V6.8.2", - "identifier": "V6.8.2", - "text": "Убедитесь, что наличие и целостность цифровой подписи в утверждениях аутентификации (например, в JWT или SAML) всегда проверяются, а неподписанные или недействительные утверждения отклоняются.", - "parent": "V6.8" - }, - { - "bom-ref": "V6.8.3", - "identifier": "V6.8.3", - "text": "Убедитесь, что SAML-утверждения обрабатываются только один раз в течение периода их действия, чтобы исключить атаки воспроизведения (replay attacks).", - "parent": "V6.8" - }, - { - "bom-ref": "V6.8.4", - "identifier": "V6.8.4", - "text": "Убедитесь, что если приложение использует внешний поставщик идентификации (IdP) и для определенных функций требуется особый уровень, метод или срок действия аутентификации, то приложение использует данные, возвращаемые IdP, для проверки этих условий. Например, при использовании OIDC можно проверить значения полей ID Token — acr, amr, auth_time (если они есть). Если IdP не предоставляет эти данные, приложение должно иметь документированный план действий по умолчанию, предполагающий использование минимально допустимой силы аутентификации (например, одноступенчатая — логин и пароль).", - "parent": "V6.8" - }, - { - "bom-ref": "V7", - "identifier": "V7", - "title": "Управление сессиями" - }, - { - "bom-ref": "V7.1", - "identifier": "V7.1", - "title": "Документация по управлению сессиями", - "parent": "V7" - }, - { - "bom-ref": "V7.1.1", - "identifier": "V7.1.1", - "text": "Убедитесь, что тайм-аут бездействия и абсолютное максимальное время жизни сессии задокументированы, соответствуют другим контрольным мерам и сопровождаются обоснованием любых отклонений от требований повторной аутентификации NIST SP 800-63B.", - "parent": "V7.1" - }, - { - "bom-ref": "V7.1.2", - "identifier": "V7.1.2", - "text": "Убедитесь, что документация определяет допустимое количество одновременных (параллельных) сессий для одного аккаунта, а также поведение системы и действия при достижении этого лимита.", - "parent": "V7.1" - }, - { - "bom-ref": "V7.1.3", - "identifier": "V7.1.3", - "text": "Убедитесь, что все системы, создающие и управляющие сессиями пользователей в рамках федеративной идентификации (например, SSO), задокументированы вместе с механизмами координации сроков действия сессий, условий завершения и случаев, требующих повторной аутентификации.", - "parent": "V7.1" - }, - { - "bom-ref": "V7.2", - "identifier": "V7.2", - "title": "Базовая безопасность сессий", - "parent": "V7" - }, - { - "bom-ref": "V7.2.1", - "identifier": "V7.2.1", - "text": "Убедитесь, что все проверки сессионных токенов выполняются на доверенной серверной стороне.", - "parent": "V7.2" - }, - { - "bom-ref": "V7.2.2", - "identifier": "V7.2.2", - "text": "Убедитесь, что приложение использует либо автономные токены, либо ссылочные токены, которые генерируются динамически, не используя статические API-секреты или ключи.", - "parent": "V7.2" - }, - { - "bom-ref": "V7.2.3", - "identifier": "V7.2.3", - "text": "Убедитесь, что ссылочные токены являются уникальными, создаются с использованием криптографически безопасного генератора псевдослучайных чисел (CSPRNG) и обладают энтропией не менее 128 бит.", - "parent": "V7.2" - }, - { - "bom-ref": "V7.2.4", - "identifier": "V7.2.4", - "text": "Убедитесь, что при аутентификации пользователя (включая повторную) создается новый токен сессии, а текущий — аннулируется.", - "parent": "V7.2" - }, - { - "bom-ref": "V7.3", - "identifier": "V7.3", - "title": "Тайм-ауты сессии", - "parent": "V7" - }, - { - "bom-ref": "V7.3.1", - "identifier": "V7.3.1", - "text": "Убедитесь, что есть тайм-аут бездействия, после которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.", - "parent": "V7.3" - }, - { - "bom-ref": "V7.3.2", - "identifier": "V7.3.2", - "text": "Убедитесь, что установлено абсолютное максимальное время жизни сессии, по истечении которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.", - "parent": "V7.3" - }, - { - "bom-ref": "V7.4", - "identifier": "V7.4", - "title": "Завершение сессий", - "parent": "V7" - }, - { - "bom-ref": "V7.4.1", - "identifier": "V7.4.1", - "text": "Убедитесь, что после завершения сессии (logout, истечение срока) дальнейшее её использование невозможно. Для ссылочных токенов или сессий с сохранением состояния это означает аннулирование на сервере. Для self-contained токенов необходимо реализовать механизм отзыва, например, список отозванных токенов, проверку времени выпуска или ротацию ключей подписи для каждого пользователя.", - "parent": "V7.4" - }, - { - "bom-ref": "V7.4.2", - "identifier": "V7.4.2", - "text": "Убедитесь, что при удалении или отключении пользователя все активные сессии немедленно завершаются.", - "parent": "V7.4" - }, - { - "bom-ref": "V7.4.3", - "identifier": "V7.4.3", - "text": "Убедитесь, что после изменения или удаления факторов аутентификации (например, смена пароля или MFA) приложение предлагает завершить все другие активные сессии.", - "parent": "V7.4" - }, - { - "bom-ref": "V7.4.4", - "identifier": "V7.4.4", - "text": "Убедитесь, что на всех страницах, требующих аутентификации, имеется простой и видимый способ выхода.", - "parent": "V7.4" - }, - { - "bom-ref": "V7.4.5", - "identifier": "V7.4.5", - "text": "Убедитесь, что администраторы могут завершать активные сессии конкретного пользователя или всех пользователей.", - "parent": "V7.4" - }, - { - "bom-ref": "V7.5", - "identifier": "V7.5", - "title": "Защита от злоупотреблений сессией", - "parent": "V7" - }, - { - "bom-ref": "V7.5.1", - "identifier": "V7.5.1", - "text": "Убедитесь, что приложение требует полной повторной аутентификации перед изменением чувствительных атрибутов аккаунта, которые могут влиять на аутентификацию (например, email, номер телефона, настройки MFA или данных восстановления доступа).", - "parent": "V7.5" - }, - { - "bom-ref": "V7.5.2", - "identifier": "V7.5.2", - "text": "Убедитесь, что пользователь может просматривать и (после повторной аутентификации хотя бы по одному фактору) завершать активные сессии.", - "parent": "V7.5" - }, - { - "bom-ref": "V7.5.3", - "identifier": "V7.5.3", - "text": "Убедитесь, что перед выполнением критически важных операций приложение требует повторной аутентификации (по крайней мере, одного фактора) или дополнительной проверки.", - "parent": "V7.5" - }, - { - "bom-ref": "V7.6", - "identifier": "V7.6", - "title": "Федеративная повторная аутентификация", - "parent": "V7" - }, - { - "bom-ref": "V7.6.1", - "identifier": "V7.6.1", - "text": "Убедитесь, что срок действия и завершение сессий между RP и IdP соответствуют документации и включают повторную аутентификацию, если достигнут максимальный допустимый интервал между событиями аутентификации.", - "parent": "V7.6" - }, - { - "bom-ref": "V7.6.2", - "identifier": "V7.6.2", - "text": "Убедитесь, что создание сессии требует согласия пользователя или явного действия, предотвращающего несанкционированное создание сессий без участия пользователя.", - "parent": "V7.6" - }, - { - "bom-ref": "V8", - "identifier": "V8", - "title": "Авторизация" - }, - { - "bom-ref": "V8.1", - "identifier": "V8.1", - "title": "Документация по авторизации", - "parent": "V8" - }, - { - "bom-ref": "V8.1.1", - "identifier": "V8.1.1", - "text": "Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне функций и на уровне данных на основе прав субъекта и атрибутов ресурса.", - "parent": "V8.1" - }, - { - "bom-ref": "V8.1.2", - "identifier": "V8.1.2", - "text": "Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне полей (как на чтение, так и на запись) на основе прав субъекта и атрибутов ресурса. Эти правила могут зависеть от других атрибутов объекта данных, например, статуса.", - "parent": "V8.1" - }, - { - "bom-ref": "V8.1.3", - "identifier": "V8.1.3", - "text": "Убедитесь, что документация определяет, какие атрибуты окружения и контекста (например, время суток, IP-адрес, местоположение, устройство) используются приложением для принятия решений в области аутентификации и авторизации.", - "parent": "V8.1" - }, - { - "bom-ref": "V8.1.4", - "identifier": "V8.1.4", - "text": "Убедитесь, что документация по аутентификации и авторизации определяет, как используются факторы окружения и контекста в принятии решений, наряду с правилами доступа к функциям, данным и полям. Документация должна содержать оцениваемые атрибуты, пороговые значения риска, действия (разрешить, отказать, повысить уровень аутентификации и др.).", - "parent": "V8.1" - }, - { - "bom-ref": "V8.2", - "identifier": "V8.2", - "title": "Архитектура авторизации", - "parent": "V8" - }, - { - "bom-ref": "V8.2.1", - "identifier": "V8.2.1", - "text": "Убедитесь, что приложение обеспечивает доступ на уровне функций (function-level) только субъектам с явными разрешениями.", - "parent": "V8.2" - }, - { - "bom-ref": "V8.2.2", - "identifier": "V8.2.2", - "text": "Убедитесь, что приложение обеспечивает доступ на уровне данных (data-specific) только тем субъектам, которым явно предоставлены права к определённым элементам данных, чтобы предотвратить IDOR (Insecure Direct Object Reference) и BOLA-уязвимости (Broken Object Level Authorization).", - "parent": "V8.2" - }, - { - "bom-ref": "V8.2.3", - "identifier": "V8.2.3", - "text": "Убедитесь, что приложение обеспечивает доступ на уровне полей (field-level) только тем субъектам, которым явно предоставлены права к определённым полям, чтобы предотвратить BOPLA (Broken Object Property Level Authorization).", - "parent": "V8.2" - }, - { - "bom-ref": "V8.2.4", - "identifier": "V8.2.4", - "text": "Убедитесь, что реализованы адаптивные меры безопасности, основанные на атрибутах окружения и контекста субъекта (время, местоположение, IP, устройство), которые используются для принятия решений об аутентификации и авторизации, как это определено в документации приложения. Эти меры должны применяться как при попытке субъекта начать новую сессию, так и во время существующей сессии.", - "parent": "V8.2" - }, - { - "bom-ref": "V8.3", - "identifier": "V8.3", - "title": "Авторизация на уровне операций", - "parent": "V8" - }, - { - "bom-ref": "V8.3.1", - "identifier": "V8.3.1", - "text": "Убедитесь, что правила авторизации реализуются на доверенном сервисном уровне и не зависят от элементов, которые может контролировать клиент (например, JavaScript на стороне клиента).", - "parent": "V8.3" - }, - { - "bom-ref": "V8.3.2", - "identifier": "V8.3.2", - "text": "Убедитесь, что изменения значений, влияющих на авторизацию, применяются немедленно. Если это невозможно (например, при использовании автономных токенов), должны быть реализованы компенсирующие меры: оповещения о попытке несанкционированного действия и откат изменений. Обратите внимание, что данный подход не предотвращает утечку информации.", - "parent": "V8.3" - }, - { - "bom-ref": "V8.3.3", - "identifier": "V8.3.3", - "text": "Убедитесь, что доступ к объекту осуществляется на основе прав субъекта, инициировавшего запрос, а не прав промежуточного сервиса, действующего от его имени. Например, если пользователь обращается к веб-сервису с автономным токеном для аутентификации, а сервис затем запрашивает данные у другого сервиса, второй сервис должен использовать токен пользователя, а не токен первого сервиса для принятия решения о доступе.", - "parent": "V8.3" - }, - { - "bom-ref": "V8.4", - "identifier": "V8.4", - "title": "Прочие аспекты авторизации", - "parent": "V8" - }, - { - "bom-ref": "V8.4.1", - "identifier": "V8.4.1", - "text": "Убедитесь, что в мультитенантных приложениях реализованы механизмы, предотвращающие действия потребителя в отношении арендаторов, к которым у него нет доступа.", - "parent": "V8.4" - }, - { - "bom-ref": "V8.4.2", - "identifier": "V8.4.2", - "text": "Убедитесь, что доступ к административным интерфейсам защищён несколькими уровнями контроля, включая непрерывную проверку личности, контроль защищённости устройства и анализ контекстных рисков. Недостаточно опираться только на IP-адрес или доверенные устройства.", - "parent": "V8.4" - }, - { - "bom-ref": "V9", - "identifier": "V9", - "title": "Автономные токены" - }, - { - "bom-ref": "V9.1", - "identifier": "V9.1", - "title": "Источник токена и его целостность", - "parent": "V9" - }, - { - "bom-ref": "V9.1.1", - "identifier": "V9.1.1", - "text": "Убедитесь, что автономные токены проверяются на целостность с помощью цифровой подписи или MAC, прежде чем доверять их содержимому.", - "parent": "V9.1" - }, - { - "bom-ref": "V9.1.2", - "identifier": "V9.1.2", - "text": "Проверяйте, что автономные токены создаются и проверяются исключительно с помощью алгоритмов из списка допустимых в данном контексте. Список допустимых алгоритмов должен включать только разрешенные алгоритмы (желательно либо только симметричные, либо только асимметричные) и ни в коем случае не содержать алгоритм None. Если необходимо поддерживать оба типа алгоритмов, потребуются дополнительные средства контроля для предотвращения путаницы с ключами (key confusion).", - "parent": "V9.1" - }, - { - "bom-ref": "V9.1.3", - "identifier": "V9.1.3", - "text": "Убедитесь, что ключи, используемые для проверки автономных токенов, получены из доверенных, предварительно настроенных источников. Это предотвращает возможность указания злоумышленниками ненадёжных источников и ключей. Для JWT и других JWS структур заголовки 'jku', 'x5u' и 'jwk' должны проверяться по белому списку.", - "parent": "V9.1" - }, - { - "bom-ref": "V9.2", - "identifier": "V9.2", - "title": "Содержимое токена", - "parent": "V9" - }, - { - "bom-ref": "V9.2.1", - "identifier": "V9.2.1", - "text": "Убедитесь, что при указанном сроке действия токен и его содержимое принимаются только в том случае, если срок действия токена не истёк. Например, для JWT нужно проверить поля 'nbf' и 'exp'.", - "parent": "V9.2" - }, - { - "bom-ref": "V9.2.2", - "identifier": "V9.2.2", - "text": "Убедитесь, что сервис, принимающий токен, проверяет его тип и соответствие назначению перед обработкой содержимого токена. Например, для принятия решений об авторизации могут быть приняты только Access Token, а для подтверждения аутентификации пользователя — только ID Token.", - "parent": "V9.2" - }, - { - "bom-ref": "V9.2.3", - "identifier": "V9.2.3", - "text": "Убедитесь, что сервис принимает только токены, предназначенные для использования с этим сервисом (audience). Для JWT это можно сделать, проверив наличие утверждения «aud» по белому списку, определенному в сервисе.", - "parent": "V9.2" - }, - { - "bom-ref": "V9.2.4", - "identifier": "V9.2.4", - "text": "Убедитесь, что, если эмитент токенов использует один и тот же закрытый ключ для выпуска токенов различным сервисам (audiences), выпущенные токены содержат явное указание целевых сервисов. Это предотвратит повторное использования токенов в не предназначенных для них сервисах. Если идентификатор сервиса (audience identifier) назначается динамически, эмитент токенов должен проверить audiences для исключения подмены получателей (audience impersonation).", - "parent": "V9.2" - }, - { - "bom-ref": "V10", - "identifier": "V10", - "title": "OAuth и OIDC" - }, - { - "bom-ref": "V10.1", - "identifier": "V10.1", - "title": "Общие требования безопасности OAuth и OIDC", - "parent": "V10" - }, - { - "bom-ref": "V10.1.1", - "identifier": "V10.1.1", - "text": "Убедитесь, что токены передаются только тем компонентам, которым они действительно необходимы. Например, при использовании схемы backend-for-frontend для браузерных JavaScript-приложений, access и refresh токены должны быть доступны только на backend.", - "parent": "V10.1" - }, - { - "bom-ref": "V10.1.2", - "identifier": "V10.1.2", - "text": "Убедитесь, что клиент принимает значения от авторизационного сервера (например, authorization code или ID Token) только если они получены в результате авторизационного потока, инициированного в той же сессии пользовательского агента и в рамках той же транзакции. Для этого клиентские секреты, такие как proof key для code exchange (PKCE) — 'code_verifier', 'state' или OIDC 'nonce' — должны быть непредсказуемыми, специфичными для транзакции и надежно привязанными как к клиенту, так и к сессии пользовательского агента, в которой началась транзакция.", - "parent": "V10.1" - }, - { - "bom-ref": "V10.2", - "identifier": "V10.2", - "title": "Клиент OAuth", - "parent": "V10" - }, - { - "bom-ref": "V10.2.1", - "identifier": "V10.2.1", - "text": "Убедитесь, что если используется механизм authorization code flow, OAuth клиент защищён от CSRF, вызывающих запросы токенов либо за счёт использования механизма proof key for code exchange (PKCE), либо за счёт проверки параметра 'state', который был отправлен в запросе авторизации.", - "parent": "V10.2" - }, - { - "bom-ref": "V10.2.2", - "identifier": "V10.2.2", - "text": "Убедитесь, что если OAuth клиент может взаимодействовать с более чем одним сервером авторизации, у него есть защита от атак смешивания (mix-up attacks). Например, клиент должен требовать, чтобы сервер авторизации возвращал параметр 'iss' и проверять его в ответах на авторизацию и токены.", - "parent": "V10.2" - }, - { - "bom-ref": "V10.2.3", - "identifier": "V10.2.3", - "text": "Убедитесь, что OAuth клиент запрашивает только необходимые области доступа (scopes) или другие параметры авторизации в запросах к серверу авторизации.", - "parent": "V10.2" - }, - { - "bom-ref": "V10.3", - "identifier": "V10.3", - "title": "Сервер ресурсов OAuth", - "parent": "V10" - }, - { - "bom-ref": "V10.3.1", - "identifier": "V10.3.1", - "text": "Убедитесь, что сервер ресурсов принимает только те access токены, которые предназначены для использования с этим сервисом (свойство audience). Эта принадлежность сервису может быть включена в структурированный access токен (например, в поле 'aud' в JWT) или проверяться через endpoint интроспекции токена.", - "parent": "V10.3" - }, - { - "bom-ref": "V10.3.2", - "identifier": "V10.3.2", - "text": "Убедитесь, что сервер ресурсов принимает решения по авторизации на основе claims из access токена, определяющих делегированную авторизацию. Если присутствуют claims, такие как 'sub', 'scope' и 'authorization_details', они должны участвовать в принятии решения.", - "parent": "V10.3" - }, - { - "bom-ref": "V10.3.3", - "identifier": "V10.3.3", - "text": "Убедитесь, что если для принятия решения по контролю доступа необходимо однозначно идентифицировать пользователя из access токена (JWT или ответа интроспекции), сервер ресурсов использует claims, которые не могут быть переприсвоены другим пользователям. Обычно это комбинация claims 'iss' и 'sub'.", - "parent": "V10.3" - }, - { - "bom-ref": "V10.3.4", - "identifier": "V10.3.4", - "text": "Убедитесь, что если сервер ресурсов требует определённой силы аутентификации, методов или свежести аутентификации, он проверяет, что предъявленный access токен удовлетворяет этим требованиям. Например, при наличии, могут использоваться claims OIDC 'acr', 'amr' и 'auth_time'.", - "parent": "V10.3" - }, - { - "bom-ref": "V10.3.5", - "identifier": "V10.3.5", - "text": "Убедитесь, что сервер ресурсов предотвращает использование украденных access токенов или их повторное использование (replay) неавторизованными лицами, требуя access токены с подтверждением отправителя — например, Mutual TLS для OAuth 2 или OAuth 2 Demonstration of Proof of Possession (DPoP).", - "parent": "V10.3" - }, - { - "bom-ref": "V10.4", - "identifier": "V10.4", - "title": "Сервер авторизации OAuth", - "parent": "V10" - }, - { - "bom-ref": "V10.4.1", - "identifier": "V10.4.1", - "text": "Убедитесь, что сервер авторизации проверяет URI перенаправления (redirect URI), сверяя его с заранее зарегистрированным списком разрешённых URI для данного клиента (allowlist), используя точное сравнение строк.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.2", - "identifier": "V10.4.2", - "text": "Убедитесь, что если сервер авторизации возвращает authorization code в ответе авторизации, этот код может быть использован только один раз для запроса токена. При втором валидном запросе с уже использованным кодом сервер должен отклонить запрос и отозвать любые токены, связанные с этим кодом.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.3", - "identifier": "V10.4.3", - "text": "Убедитесь, что authorization code имеет короткое время жизни. Максимальная продолжительность — до 10 минут для приложений L1 и L2 и до 1 минуты для приложений L3.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.4", - "identifier": "V10.4.4", - "text": "Убедитесь, что сервер авторизации для конкретного клиента разрешает использование только тех типов авторизации, которые необходимы этому клиенту. Обратите внимание, что тип авторизации Implicit flow и Resource Owner Password Credentials flow больше не должны использоваться.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.5", - "identifier": "V10.4.5", - "text": "Убедитесь, что сервер авторизации предотвращает атаки повторного использования refresh токенов для публичных клиентов, предпочтительно используя sender-constrained refresh токены, такие как DPoP или сертификат-связанные токены с mutual TLS (mTLS). Для L1 и L2 допускается ротация refresh токенов с обязательной их инвалидацией после использования. Если используется ротация, сервер должен отозвать все refresh токены при попытке использовать уже инвалидированный токен.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.6", - "identifier": "V10.4.6", - "text": "Убедитесь, что при использовании типа авторизации «Authorization Code» сервер предотвращает атаки перехвата authorization code, требуя Proof Key for Code Exchange (PKCE). В запросах авторизации сервер должен требовать валидное значение 'code_challenge' и не принимать 'code_challenge_method' со значением 'plain'. В запросах токена обязательно валидировать параметр 'code_verifier'.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.7", - "identifier": "V10.4.7", - "text": "Убедитесь, что если сервер авторизации поддерживает динамическую регистрацию клиентов без аутентификации, он минимизирует риски вредоносных клиентов. Сервер должен валидировать метаданные клиента (например, зарегистрированные URI), обеспечивать согласие пользователя и предупреждать пользователя перед обработкой запроса авторизации от недоверенного клиента.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.8", - "identifier": "V10.4.8", - "text": "Убедитесь, что refresh токены имеют абсолютный срок действия, включая случаи, когда применяется скользящее время истечения срока.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.9", - "identifier": "V10.4.9", - "text": "Убедитесь, что пользователи могут отзывать refresh токены и reference access токены через пользовательский интерфейс сервера авторизации для снижения риска от вредоносных клиентов или кражи токенов.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.10", - "identifier": "V10.4.10", - "text": "Убедитесь, что конфиденциальный клиент аутентифицируется при взаимодействии с сервером авторизации через backchannel, например при запросах токена, pushed authorization requests (PAR) и запросах на отзыв токенов.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.11", - "identifier": "V10.4.11", - "text": "Убедитесь, что конфигурация сервера авторизации назначает OAuth клиенту только необходимые области доступа (scopes).", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.12", - "identifier": "V10.4.12", - "text": "Убедитесь, что для конкретного клиента сервер авторизации разрешает только те значения 'response_mode', которые необходимы этому клиенту. Например, сервер должен валидировать это значение против ожидаемых или использовать pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.13", - "identifier": "V10.4.13", - "text": "Убедитесь, что грант типа 'code' всегда используется вместе с pushed authorization requests (PAR).", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.14", - "identifier": "V10.4.14", - "text": "Убедитесь, что сервер авторизации выдаёт только sender-constrained (Proof-of-Possession) access токены, либо с сертификат-связанными токенами через mutual TLS (mTLS), либо DPoP-bound токены (Demonstration of Proof of Possession).", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.15", - "identifier": "V10.4.15", - "text": "Убедитесь, что для серверного клиента (не выполняющегося на устройстве конечного пользователя) сервер авторизации проверяет, что значение параметра 'authorization_details' исходит из клиентского backend и что пользователь не изменял его. Например, это достигается использованием pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.16", - "identifier": "V10.4.16", - "text": "Убедитесь, что клиент является конфиденциальным и сервер авторизации требует использования сильных методов аутентификации клиента (основанных на криптографии с открытым ключом и устойчивых к атакам повторного воспроизведения), таких как mutual TLS ('tls_client_auth', 'self_signed_tls_client_auth') или private key JWT ('private_key_jwt').", - "parent": "V10.4" - }, - { - "bom-ref": "V10.5", - "identifier": "V10.5", - "title": "Клиент OIDC", - "parent": "V10" - }, - { - "bom-ref": "V10.5.1", - "identifier": "V10.5.1", - "text": "Убедитесь, что клиент (relying party) защищается от повторного использования ID Token (replay-атак). Например, это достигается проверкой того, что значение 'nonce' в ID Token совпадает со значением 'nonce', отправленным в запросе аутентификации провайдеру OpenID (authorization server).", - "parent": "V10.5" - }, - { - "bom-ref": "V10.5.2", - "identifier": "V10.5.2", - "text": "Убедитесь, что клиент однозначно идентифицирует пользователя по утверждениям (claims) ID Token, обычно это 'sub', который не может быть переназначен другому пользователю (в пределах конкретного провайдера идентификации).", - "parent": "V10.5" - }, - { - "bom-ref": "V10.5.3", - "identifier": "V10.5.3", - "text": "Убедитесь, что клиент отклоняет попытки злоумышленного сервера авторизации выдавать себя за другой сервер авторизации через метаданные сервера авторизации. Клиент должен отклонить метаданные, если URL издателя (issuer) в метаданных не совпадает точно с преднастроенным URL издателя, ожидаемым клиентом.", - "parent": "V10.5" - }, - { - "bom-ref": "V10.5.4", - "identifier": "V10.5.4", - "text": "Убедитесь, что клиент проверяет, что ID Token предназначен для него (проверка audience), сравнивая значение 'aud' в токене с 'client_id' клиента.", - "parent": "V10.5" - }, - { - "bom-ref": "V10.5.5", - "identifier": "V10.5.5", - "text": "Убедитесь, что при использовании OIDC back-channel logout клиент снижает риск отказа в обслуживании, вызванный принудительным выходом из системы и путаницей между разными типами JWT (cross-JWT confusion) в процессе логаута. Клиент должен проверить, что токен выхода корректно типизирован со значением 'logout+jwt', содержит claim 'event' с правильным именем участника и не содержит 'nonce'. Также рекомендуется установить короткий срок действия токена (например, 2 минуты).", - "parent": "V10.5" - }, - { - "bom-ref": "V10.6", - "identifier": "V10.6", - "title": "Провайдер OpenID", - "parent": "V10" - }, - { - "bom-ref": "V10.6.1", - "identifier": "V10.6.1", - "text": "Убедитесь, что провайдер OpenID допускает только значения 'code', 'ciba', 'id_token' или 'id_token code' для параметра response mode. При этом предпочтение отдаётся 'code' по сравнению с 'id_token code' (гибридный поток OIDC), а значение 'token' (любой Implicit flow) не должно использоваться.", - "parent": "V10.6" - }, - { - "bom-ref": "V10.6.2", - "identifier": "V10.6.2", - "text": "Убедитесь, что провайдер OpenID предотвращает отказ в обслуживании (DoS) через принудительный выход (logout), запрашивая явное подтверждение от конечного пользователя или, если применимо, проверяя параметры в запросе выхода (инициированном relying party), например параметр 'id_token_hint'.", - "parent": "V10.6" - }, - { - "bom-ref": "V10.7", - "identifier": "V10.7", - "title": "Управление согласием", - "parent": "V10" - }, - { - "bom-ref": "V10.7.1", - "identifier": "V10.7.1", - "text": "Убедитесь, что авторизационный сервер обеспечивает получение согласия пользователя для каждого запроса авторизации. Если личность клиента не может быть подтверждена, сервер авторизации всегда должен явно запрашивать согласие пользователя.", - "parent": "V10.7" - }, - { - "bom-ref": "V10.7.2", - "identifier": "V10.7.2", - "text": "Убедитесь, что при запросе согласия пользователя авторизационный сервер предоставляет достаточную и понятную информацию о том, на что даётся согласие. При необходимости это должно включать характер запрашиваемых разрешений (обычно основанных на scope, ресурсном сервере, деталях авторизации Rich Authorization Requests (RAR)), идентификацию авторизованного приложения и срок действия этих разрешений.", - "parent": "V10.7" - }, - { - "bom-ref": "V10.7.3", - "identifier": "V10.7.3", - "text": "Убедитесь, что пользователь может просматривать, изменять и отзывать согласия, которые он предоставил, через авторизационный сервер.", - "parent": "V10.7" - }, - { - "bom-ref": "V11", - "identifier": "V11", - "title": "Криптография" - }, - { - "bom-ref": "V11.1", - "identifier": "V11.1", - "title": "Инвентаризация и документирование криптографии", - "parent": "V11" - }, - { - "bom-ref": "V11.1.1", - "identifier": "V11.1.1", - "text": "Убедитесь, что задокументирована политика управления криптографическими ключами и описан их жизненный цикл в соответствии со стандартом управления ключей, таким как NIST SP 800-57. Убедитесь, что ключи известны только тем сущностям, которым они должны быть доступны (например, ключи не передавались более чем двум участникам для общих секретов и более чем одному участнику для приватных ключей).", - "parent": "V11.1" - }, - { - "bom-ref": "V11.1.2", - "identifier": "V11.1.2", - "text": "Убедитесь, что проводится инвентаризация криптографических средств, которая непрерывно поддерживается, регулярно обновляется и включает все криптографические ключи, алгоритмы и сертификаты, используемые в приложении. Также должна быть задокументирована информация о том, где ключи могут и не могут использоваться в системе, а также какие типы данных могут и не могут быть защищены с помощью этих ключей.", - "parent": "V11.1" - }, - { - "bom-ref": "V11.1.3", - "identifier": "V11.1.3", - "text": "Убедитесь, что используются механизмы обнаружения криптографии для идентификации всех случаев применения криптографии в системе , включая операции шифрования, хеширования и цифровой подписи.", - "parent": "V11.1" - }, - { - "bom-ref": "V11.1.4", - "identifier": "V11.1.4", - "text": "Убедитесь, что ведётся и поддерживается инвентаризация криптографических средств. В неё должен входить документированный план, описывающий переход на новые криптографические стандарты, такие как постквантовая криптография, чтобы своевременно реагировать на будущие угрозы.", - "parent": "V11.1" - }, - { - "bom-ref": "V11.2", - "identifier": "V11.2", - "title": "Безопасная реализация криптографии", - "parent": "V11" - }, - { - "bom-ref": "V11.2.1", - "identifier": "V11.2.1", - "text": "Убедитесь, что для криптографических операций используются утвержденные в индустрии реализации (включая библиотеки и аппаратные реализации).", - "parent": "V11.2" - }, - { - "bom-ref": "V11.2.2", - "identifier": "V11.2.2", - "text": "Убедитесь, что архитектура приложения поддерживает быструю реконфигурацию, усовершенствование или смену в любой момент случайных чисел, аутентифицированного шифрования, MAC, алгоритмов хеширования, длин ключей, количества раундов, шифров и режимов шифрования для защиты от криптографических атак. Также должна поддерживаться возможность смены ключей, паролей и повторного шифрования данных. Это позволит беспрепятственно перейти на постквантовую криптографию (PQC), как только станут широко доступны высоконадёжные реализации одобренных схем или стандартов PQC.", - "parent": "V11.2" - }, - { - "bom-ref": "V11.2.3", - "identifier": "V11.2.3", - "text": "Убедитесь, что все криптографические примитивы используют как минимум 128-бит стойкости с учетом алгоритма, размера ключа и конфигурации. Например, 256-битный ECC ключ обеспечивает примерно 128 бит безопасности, тогда как для достижения того же уровня безопасности в RSA требуется ключ длиной 3072 бита.", - "parent": "V11.2" - }, - { - "bom-ref": "V11.2.4", - "identifier": "V11.2.4", - "text": "Убедитесь, что все криптографические операции выполняются за константное время, без использования «short-circuit» операций в сравнениях, вычислениях, возвратах функций для избежания утечек информации.", - "parent": "V11.2" - }, - { - "bom-ref": "V11.2.5", - "identifier": "V11.2.5", - "text": "Убедитесь, что все криптографические модули обеспечивают безопасное завершение работы при ошибках, а обработка ошибок реализована таким образом, чтобы не создавать уязвимостей, например, таких как атаки Padding Oracle.", - "parent": "V11.2" - }, - { - "bom-ref": "V11.3", - "identifier": "V11.3", - "title": "Алгоритмы шифрования", - "parent": "V11" - }, - { - "bom-ref": "V11.3.1", - "identifier": "V11.3.1", - "text": "Убедитесь, что не используются небезопасные режимы блочного шифрования (н-р, ECB) и слабые схемы дополнения (padding) (н-р, PKCS#1 v1.5).", - "parent": "V11.3" - }, - { - "bom-ref": "V11.3.2", - "identifier": "V11.3.2", - "text": "Убедитесь, что используются только утверждённые шифры и режимы, такие как AES с GCM.", - "parent": "V11.3" - }, - { - "bom-ref": "V11.3.3", - "identifier": "V11.3.3", - "text": "Убедитесь, что зашифрованные данные защищены от несанкционированного изменения, предпочтительно с использованием утверждённого метода аутентифицированного шифрования или путём комбинирования утверждённого метода шифрования с утверждённым алгоритмом MAC.", - "parent": "V11.3" - }, - { - "bom-ref": "V11.3.4", - "identifier": "V11.3.4", - "text": "Убедитесь, что случайные числа (nonce), векторы инициализации (IV) и другие одноразовые числа не используются более одного раза для одной и той же пары ключа шифрования и элемента данных. Метод их генерации должен соответствовать требованиям используемого алгоритма.", - "parent": "V11.3" - }, - { - "bom-ref": "V11.3.5", - "identifier": "V11.3.5", - "text": "Убедитесь, что любая комбинация алгоритма шифрования и алгоритма MAC работает в режиме encrypt-then-MAC (EtM).", - "parent": "V11.3" - }, - { - "bom-ref": "V11.4", - "identifier": "V11.4", - "title": "Хеширование и функции на основе хеширования", - "parent": "V11" - }, - { - "bom-ref": "V11.4.1", - "identifier": "V11.4.1", - "text": "Убедитесь, что только утвержденные хэш-функции используются для стандартных сценариев использования в криптографии, включая цифровую подпись, HMAC, KDF, генерацию случайных чисел. Запрещено использовать неустойчивые хэш-функции, (н-р, MD5) для любого использования в криптографии.", - "parent": "V11.4" - }, - { - "bom-ref": "V11.4.2", - "identifier": "V11.4.2", - "text": "Убедитесь, что пароли хранятся с использованием утверждённой, вычислительно затратной функции генерации ключа (также известной как «функция хеширования паролей»), с параметрами, настроенными в соответствии с актуальными рекомендациями. Настройки должны обеспечивать баланс между безопасностью и производительностью, чтобы сделать атаки перебором достаточно сложными для требуемого уровня безопасности.", - "parent": "V11.4" - }, - { - "bom-ref": "V11.4.3", - "identifier": "V11.4.3", - "text": "Убедитесь, что хэш-функции, используемые в формировании цифровой подписи, как часть аутентификации и целостности данных, устойчивы к коллизиям и имеют достаточную длину.", - "parent": "V11.4" - }, - { - "bom-ref": "V11.4.4", - "identifier": "V11.4.4", - "text": "Убедитесь, что приложение использует утвержденную функцию генерации ключа с использованием параметров расширения ключа (key stretching) при генерации ключа из пароля. Параметры должны быть сбалансированы с точки зрения безопасности, производительности и устойчивости к атакам полного перебора при компрометации результирующего криптографического ключа.", - "parent": "V11.4" - }, - { - "bom-ref": "V11.5", - "identifier": "V11.5", - "title": "Случайные значения", - "parent": "V11" - }, - { - "bom-ref": "V11.5.1", - "identifier": "V11.5.1", - "text": "Убедитесь, что все случайные числа и строки, которые должны быть непредсказуемы, должны быть сгенерированы с помощью CSPRNG и иметь хотя бы 128 бит энтропии. Учтите, что UUID не удовлетворяют данному условию.", - "parent": "V11.5" - }, - { - "bom-ref": "V11.5.2", - "identifier": "V11.5.2", - "text": "Убедитесь, что механизм генерации случайных чисел является надежным даже при высокой нагрузке.", - "parent": "V11.5" - }, - { - "bom-ref": "V11.6", - "identifier": "V11.6", - "title": "Криптография с публичным ключом", - "parent": "V11" - }, - { - "bom-ref": "V11.6.1", - "identifier": "V11.6.1", - "text": "Убедитесь, что только утвержденные криптографические алгоритмы и режимы операций используются для генерации ключа и инициализации случайного значения для его генерации (seeding), а также для генерации цифровой подписи и верификации. Алгоритмы генерации ключей не должны генерировать небезопасные ключи уязвимые к известным атакам, например, ключи RSA уязвимы к факторизации Ферма.", - "parent": "V11.6" - }, - { - "bom-ref": "V11.6.2", - "identifier": "V11.6.2", - "text": "Убедитесь, что для обмена ключами используются утверждённые криптографические алгоритмы (например, Диффи-Хеллман) с особым вниманием к обеспечению использования безопасных параметров. Это предотвратит атаки на процесс установления ключа, которые могут привести к атакам «человек посередине» или криптографическим взломам.", - "parent": "V11.6" - }, - { - "bom-ref": "V11.7", - "identifier": "V11.7", - "title": "Шифрование данных в процессе использования", - "parent": "V11" - }, - { - "bom-ref": "V11.7.1", - "identifier": "V11.7.1", - "text": "Убедитесь, что используется полное шифрование памяти, которое защищает конфиденциальные данные во время их использования, предотвращая доступ к ним неавторизованных пользователей или процессов.", - "parent": "V11.7" - }, - { - "bom-ref": "V11.7.2", - "identifier": "V11.7.2", - "text": "Убедитесь, что минимизация данных обеспечивает раскрытие минимально необходимого объёма данных во время обработки, а также что данные шифруются сразу после использования или как можно скорее.", - "parent": "V11.7" - }, - { - "bom-ref": "V12", - "identifier": "V12", - "title": "Безопасная коммуникация" - }, - { - "bom-ref": "V12.1", - "identifier": "V12.1", - "title": "Общие рекомендации по безопасности TLS", - "parent": "V12" - }, - { - "bom-ref": "V12.1.1", - "identifier": "V12.1.1", - "text": "Убедитесь, что включены только актуальные и рекомендуемые версии протокола TLS, такие как TLS 1.2 и TLS 1.3. Наиболее свежая версия TLS должна быть выбрана как предпочтительная.", - "parent": "V12.1" - }, - { - "bom-ref": "V12.1.2", - "identifier": "V12.1.2", - "text": "Убедитесь, что включены рекомендуемые шифронаборы (cipher suites), предпочтение также стоит отдать самому сильному шифронабору. L3 приложения должны поддерживать только те наборы шифров (cipher suites), которые обеспечивают прямую (forward) секретность. Пояснение: Прямая секретность (Forward Secrecy, FS) — это криптографическая особенность, при которой сессионные ключи уникальны для каждой сессии и не зависят от долгосрочных ключей. Это гарантирует, что даже при компрометации долгосрочного ключа злоумышленник не сможет расшифровать ранее перехваченные зашифрованные сессии.", - "parent": "V12.1" - }, - { - "bom-ref": "V12.1.3", - "identifier": "V12.1.3", - "text": "Убедитесь, что приложение проверяет доверенность клиентских сертификатов mTLS, прежде чем использовать идентификацию по сертификату для аутентификации или авторизации.", - "parent": "V12.1" - }, - { - "bom-ref": "V12.1.4", - "identifier": "V12.1.4", - "text": "Убедитесь, что включена и настроена правильная проверка отзыва сертификатов, такая как Online Certificate Status Protocol (OCSP) Stapling.", - "parent": "V12.1" - }, - { - "bom-ref": "V12.1.5", - "identifier": "V12.1.5", - "text": "Убедитесь, что в настройках TLS приложения включена функция Encrypted Client Hello (ECH) для предотвращения раскрытия конфиденциальных метаданных, таких как Server Name Indication (SNI), во время процесса TLS-рукопожатия.", - "parent": "V12.1" - }, - { - "bom-ref": "V12.2", - "identifier": "V12.2", - "title": "HTTPS коммуникация с внешними сервисами", - "parent": "V12" - }, - { - "bom-ref": "V12.2.1", - "identifier": "V12.2.1", - "text": "Убедитесь, что для всех соединений между клиентом и внешними HTTP-сервисами используется TLS и не происходит отката к небезопасным или незашифрованным протоколам.", - "parent": "V12.2" - }, - { - "bom-ref": "V12.2.2", - "identifier": "V12.2.2", - "text": "Убедитесь, что внешние сервисы используют публично доверенные TLS-сертификаты.", - "parent": "V12.2" - }, - { - "bom-ref": "V12.3", - "identifier": "V12.3", - "title": "Общая безопасность межсервисного взаимодействия", - "parent": "V12" - }, - { - "bom-ref": "V12.3.1", - "identifier": "V12.3.1", - "text": "Убедитесь, что для всех входящих и исходящих соединений приложения используется зашифрованный протокол, например TLS, включая системы мониторинга, инструменты управления, удалённый доступ и SSH, промежуточное ПО, базы данных, мейнфреймы, партнёрские системы и внешние API. Сервер не должен допускать откат к небезопасным или незашифрованным протоколам.", - "parent": "V12.3" - }, - { - "bom-ref": "V12.3.2", - "identifier": "V12.3.2", - "text": "Убедитесь, что TLS-клиент проверяет сертификат сервера до установления защищенного соединения с TLS-сервером.", - "parent": "V12.3" - }, - { - "bom-ref": "V12.3.3", - "identifier": "V12.3.3", - "text": "Убедитесь, что все внутренние HTTP-взаимодействия между компонентами приложения используют TLS или другой подходящий механизм транспортного шифрования, и не происходит откат к небезопасным или незашифрованным коммуникациям.", - "parent": "V12.3" - }, - { - "bom-ref": "V12.3.4", - "identifier": "V12.3.4", - "text": "Убедитесь, что TLS-соединения между внутренними сервисами используют доверенные сертификаты. Если используются внутренние или самоподписанные сертификаты, потребляющий сервис должен быть настроен на доверие только к конкретным внутренним центрам сертификации (CA) и конкретным самоподписанным сертификатам.", - "parent": "V12.3" - }, - { - "bom-ref": "V12.3.5", - "identifier": "V12.3.5", - "text": "Убедитесь, что сервисы, взаимодействующие внутри системы (intra-service communications), используют строгую аутентификацию для проверки каждого конечного узла. Для проверки подлинности взаимодействующих сторон должны применяться методы строгой аутентификации, такие как аутентификация TLS-клиента, с использованием инфраструктуры открытых ключей и механизмов, устойчивых к атакам повтора (replay attacks). Для микросервисных архитектур рекомендуется использование service mesh для упрощения управления сертификатами и повышения безопасности.", - "parent": "V12.3" - }, - { - "bom-ref": "V13", - "identifier": "V13", - "title": "Конфигурация" - }, - { - "bom-ref": "V13.1", - "identifier": "V13.1", - "title": "Документация конфигурации", - "parent": "V13" - }, - { - "bom-ref": "V13.1.1", - "identifier": "V13.1.1", - "text": "Убедитесь, что все необходимые доступы приложения задокументированы. Сюда должны быть включены как внешние сервисы, от которых зависит приложение, так и сценарии, когда конечный пользователь может задавать адреса для внешнего подключения.", - "parent": "V13.1" - }, - { - "bom-ref": "V13.1.2", - "identifier": "V13.1.2", - "text": "Убедитесь, что для каждого сервиса, используемого приложением, в документации определено максимальное количество одновременных соединений (например, лимиты пула соединений) и описано поведение приложения при достижении этого лимита, включая любые механизмы отказоустойчивости или восстановления, чтобы предотвратить ситуации отказа в обслуживании (DoS).", - "parent": "V13.1" - }, - { - "bom-ref": "V13.1.3", - "identifier": "V13.1.3", - "text": "Убедитесь, что в документации приложения определены стратегии управления ресурсами для каждой внешней системы или сервиса, которые оно использует (например, базы данных, файловые дескрипторы, потоки, HTTP-соединения). Стратегии должны включать процедуры освобождения ресурсов, настройки таймаутов, обработку сбоев, а также, если реализована логика повторных попыток, указание лимитов, задержек и алгоритмов back-off. Для синхронных HTTP-запросов должны быть заданы короткие таймауты, а повторные запросы должны быть отключены, либо строго ограничены по числу попыток, чтобы предотвратить каскадные задержки и истощение ресурсов.", - "parent": "V13.1" - }, - { - "bom-ref": "V13.1.4", - "identifier": "V13.1.4", - "text": "Убедитесь, что в документации приложения определены секреты, критически важные для безопасности приложения, а также установлен график их ротации в соответствии с моделью угроз организации и её бизнес-требованиями.", - "parent": "V13.1" - }, - { - "bom-ref": "V13.2", - "identifier": "V13.2", - "title": "Конфигурация бэкенд соединений", - "parent": "V13" - }, - { - "bom-ref": "V13.2.1", - "identifier": "V13.2.1", - "text": "Убедитесь, что коммуникации между компонентами бэкенда приложения (включая API, промежуточное ПО и уровни данных), которые не поддерживают стандартный механизм пользовательских сессий, проходят с аутентификацией. Аутентификация должна использовать индивидуальные сервисные аккаунты, краткосрочные токены или аутентификацию на основе сертификатов, а не постоянные учётные данные, такие как пароли, API-ключи или общие аккаунты с привилегированным доступом.", - "parent": "V13.2" - }, - { - "bom-ref": "V13.2.2", - "identifier": "V13.2.2", - "text": "Убедитесь, что коммуникации между компонентами бэкенда приложения, включая локальные или системные службы, API, промежуточное ПО и уровни данных, выполняются с использованием аккаунтов, которым назначены минимально необходимые привилегии.", - "parent": "V13.2" - }, - { - "bom-ref": "V13.2.3", - "identifier": "V13.2.3", - "text": "Убедитесь, что если для аутентификации в сервисе используются учётные данные, то используемые потребителем учётные данные не являются стандартными (например, root/root или admin/admin).", - "parent": "V13.2" - }, - { - "bom-ref": "V13.2.4", - "identifier": "V13.2.4", - "text": "Убедитесь, что используется белый список (allowlist) для определения внешних ресурсов или систем, с которыми приложению разрешено взаимодействовать (например, для исходящих запросов, загрузки данных или доступа к файлам). Этот белый список может быть реализован на уровне приложения, веб-сервера, межсетевого экрана или комбинации различных уровней.", - "parent": "V13.2" - }, - { - "bom-ref": "V13.2.5", - "identifier": "V13.2.5", - "text": "Убедитесь, что веб- или прикладной сервер настроен с белым списком ресурсов или систем, к которым сервер может отправлять запросы или из которых может загружать данные и файлы.", - "parent": "V13.2" - }, - { - "bom-ref": "V13.2.6", - "identifier": "V13.2.6", - "text": "Убедитесь, что при подключении приложения к другим сервисам соблюдается задокументированная конфигурация для каждого соединения, включая максимальное количество параллельных соединений, поведение при достижении их максимума, таймауты и стратегии повторных попыток подключения.", - "parent": "V13.2" - }, - { - "bom-ref": "V13.3", - "identifier": "V13.3", - "title": "Управление секретами", - "parent": "V13" - }, - { - "bom-ref": "V13.3.1", - "identifier": "V13.3.1", - "text": "Убедитесь, что для безопасного создания, хранения, контроля доступа и уничтожения секретов бэкенда используется решение для управления секретами, например, хранилище ключей (key vault). Секретами могут быть пароли, ключевой материал, интеграции с базами данных и сторонними системами, ключи и seed-значения для токенов с ограниченным временем действия, другие внутренние секреты и API-ключи. Секреты не должны включаться в исходный код приложения или артефакты сборки. Для приложений уровня L3 необходимо использовать аппаратное решение, например, аппаратный модуль безопасности (HSM).", - "parent": "V13.3" - }, - { - "bom-ref": "V13.3.2", - "identifier": "V13.3.2", - "text": "Убедитесь, что доступ к секретным ресурсам осуществляется в соответствии с принципом минимально необходимых привилегий (least privilege).", - "parent": "V13.3" - }, - { - "bom-ref": "V13.3.3", - "identifier": "V13.3.3", - "text": "Убедитесь, что все криптографические операции выполняются с использованием изолированного модуля безопасности (например, хранилища ключей или аппаратного модуля безопасности), чтобы надежно управлять ключевым материалом и защищать его от утечки за пределы модуля безопасности.", - "parent": "V13.3" - }, - { - "bom-ref": "V13.3.4", - "identifier": "V13.3.4", - "text": "Убедитесь, что секреты настроены на срок действия и ротацию в соответствии с документацией приложения.", - "parent": "V13.3" - }, - { - "bom-ref": "V13.4", - "identifier": "V13.4", - "title": "Непреднамеренная утечка информации", - "parent": "V13" - }, - { - "bom-ref": "V13.4.1", - "identifier": "V13.4.1", - "text": "Убедитесь, что приложение развернуто либо без метаданных систем контроля версий (включая папки .git или .svn), либо так, чтобы эти папки были недоступны как извне, так и для самого приложения.", - "parent": "V13.4" - }, - { - "bom-ref": "V13.4.2", - "identifier": "V13.4.2", - "text": "Убедитесь, что режимы отладки отключены для всех компонентов в промышленной среде, чтобы предотвратить раскрытие функций отладки и утечку информации.", - "parent": "V13.4" - }, - { - "bom-ref": "V13.4.3", - "identifier": "V13.4.3", - "text": "Убедитесь, что веб-серверы не показывают клиентам списки содержимого каталогов, если это явно не предусмотрено.", - "parent": "V13.4" - }, - { - "bom-ref": "V13.4.4", - "identifier": "V13.4.4", - "text": "Убедитесь, что метод HTTP TRACE не поддерживается в продуктовой среде, чтобы избежать потенциальной утечки информации.", - "parent": "V13.4" - }, - { - "bom-ref": "V13.4.5", - "identifier": "V13.4.5", - "text": "Убедитесь, что документация (например, по внутренним API) и мониторинговые эндпоинты не доступны, если это явно не предусмотрено.", - "parent": "V13.4" - }, - { - "bom-ref": "V13.4.6", - "identifier": "V13.4.6", - "text": "Убедитесь, что приложение не раскрывает подробную информацию о версиях компонентов бэкенда.", - "parent": "V13.4" - }, - { - "bom-ref": "V13.4.7", - "identifier": "V13.4.7", - "text": "Убедитесь, что веб-слой настроен на обслуживание только файлов с определёнными расширениями, чтобы предотвратить непреднамеренную утечку информации, конфигураций и исходного кода.", - "parent": "V13.4" - }, - { - "bom-ref": "V14", - "identifier": "V14", - "title": "Защита информации" - }, - { - "bom-ref": "V14.1", - "identifier": "V14.1", - "title": "Документация по защите информации", - "parent": "V14" - }, - { - "bom-ref": "V14.1.1", - "identifier": "V14.1.1", - "text": "Убедитесь, что все конфиденциальные данные, создаваемые и обрабатываемые приложением, идентифицированы и классифицированы по уровням защиты. Включая закодированные данные, которые легко декодируются, например, строки Base64 или незашифрованные данные в полезной нагрузке JWT. Уровни защиты должны учитывать требования по защите данных и конфиденциальности, которым должно соответствовать приложение.", - "parent": "V14.1" - }, - { - "bom-ref": "V14.1.2", - "identifier": "V14.1.2", - "text": "Убедитесь, что для каждого уровня защиты конфиденциальных данных требования к защите задокументированы. Они должны включать (но не ограничиваться) требования по шифрованию, проверке целостности, срокам хранения, способам логирования данных, контролю доступа к чувствительным данным в логах, шифрованию на уровне базы данных, применению технологий повышения конфиденциальности, а также другим требованиям по конфиденциальности.", - "parent": "V14.1" - }, - { - "bom-ref": "V14.2", - "identifier": "V14.2", - "title": "Базовые меры по защите информации", - "parent": "V14" - }, - { - "bom-ref": "V14.2.1", - "identifier": "V14.2.1", - "text": "Убедитесь, что конфиденциальные данные передаются на сервер только в теле HTTP-запроса или в заголовках. URL и строка запроса не должны содержать конфиденциальную информацию, такую как API-ключ или сессионный токен.", - "parent": "V14.2" - }, - { - "bom-ref": "V14.2.2", - "identifier": "V14.2.2", - "text": "Убедитесь, что приложение предотвращает кэширование конфиденциальных данных в серверных компонентах, таких как балансировщики нагрузки и кэши приложений, либо гарантирует их надежное удаление после использования.", - "parent": "V14.2" - }, - { - "bom-ref": "V14.2.3", - "identifier": "V14.2.3", - "text": "Убедитесь, что заранее определённые конфиденциальные данные не отправляются ненадёжным сторонам (например, системам трекинга пользователей), чтобы предотвратить нежелательный сбор данных вне контроля приложения.", - "parent": "V14.2" - }, - { - "bom-ref": "V14.2.4", - "identifier": "V14.2.4", - "text": "Убедитесь, что для конфиденциальных данных реализованы меры по шифрованию, проверке целостности, срокам хранения, способам логирования, контролю доступа к данным в логах, а также применяются технологии повышения конфиденциальности в соответствии с документацией для соответствующего уровня защиты данных.", - "parent": "V14.2" - }, - { - "bom-ref": "V14.2.5", - "identifier": "V14.2.5", - "text": "Убедитесь, что механизмы кэширования настроены так, чтобы кэшировать только ответы с ожидаемым типом содержимого для данного ресурса и не содержать конфиденциального динамического контента. При обращении к несуществующему файлу, веб-сервер должен возвращать ответ 404 или 302, а не подменять на другой существующий файл, что позволит предотвратить атаки типа Web Cache Deception.", - "parent": "V14.2" - }, - { - "bom-ref": "V14.2.6", - "identifier": "V14.2.6", - "text": "Убедитесь, что приложение возвращает только минимально необходимый объем конфиденциальных данных для выполнения своей функциональности. Например, показывает только часть цифр номера кредитной карты, а не полный номер. Если требуется отображение полных данных, они должны быть замаскированы в пользовательском интерфейсе, пока пользователь специально не запросил их просмотр.", - "parent": "V14.2" - }, - { - "bom-ref": "V14.2.7", - "identifier": "V14.2.7", - "text": "Убедитесь, что конфиденциальная информация подлежит классификации по срокам хранения, чтобы устаревшие или ненужные данные удалялись автоматически, по расписанию или по мере необходимости.", - "parent": "V14.2" - }, - { - "bom-ref": "V14.2.8", - "identifier": "V14.2.8", - "text": "Убедитесь, что конфиденциальная информация удаляется из метаданных файлов, загружаемых пользователями, если пользователь явно не согласился на ее хранение.", - "parent": "V14.2" - }, - { - "bom-ref": "V14.3", - "identifier": "V14.3", - "title": "Защита данных на стороне клиента", - "parent": "V14" - }, - { - "bom-ref": "V14.3.1", - "identifier": "V14.3.1", - "text": "Убедитесь, что аутентифицированные данные очищаются из клиентского хранилища, например, из DOM браузера, после завершения работы клиента или сессии. Заголовок HTTP-ответа Clear-Site-Data может помочь в этом, но клиентская сторона также должна уметь очищать данные, если соединение с сервером недоступно при завершении сессии.", - "parent": "V14.3" - }, - { - "bom-ref": "V14.3.2", - "identifier": "V14.3.2", - "text": "Убедитесь, что приложение устанавливает HTTP-заголовки, достаточные для предотвращения кэширования (например, Cache-Control: no-store), чтобы конфиденциальные данные не сохранялись в браузерах.", - "parent": "V14.3" - }, - { - "bom-ref": "V14.3.3", - "identifier": "V14.3.3", - "text": "Убедитесь, что данные, хранящиеся в браузерном хранилище (например, localStorage, sessionStorage, IndexedDB или cookie), не содержат конфиденциальной информации, за исключением сессионных токенов.", - "parent": "V14.3" - }, - { - "bom-ref": "V15", - "identifier": "V15", - "title": "Безопасная разработка и архитектура" - }, - { - "bom-ref": "V15.1", - "identifier": "V15.1", - "title": "Документация по безопасной разработке и архитектуре", - "parent": "V15" - }, - { - "bom-ref": "V15.1.1", - "identifier": "V15.1.1", - "text": "Убедитесь, что в документации по приложению определены сроки устранения уязвимостей на основе оценки рисков для внешних зависимостей с уязвимостями и для обновления библиотек в целом, чтобы минимизировать риск, связанный с этими компонентами.", - "parent": "V15.1" - }, - { - "bom-ref": "V15.1.2", - "identifier": "V15.1.2", - "text": "Убедитесь, что ведется реестр всех используемых сторонних библиотек (например, Software Bill of Materials, SBOM), с обязательной проверкой, что компоненты получены из предопределенных, доверенных и регулярно поддерживаемых репозиториев.", - "parent": "V15.1" - }, - { - "bom-ref": "V15.1.3", - "identifier": "V15.1.3", - "text": "Убедитесь, что в документации приложения указан функционал, требующий значительных временных или вычислительных ресурсов. Необходимо указать, как предотвратить потерю доступности из-за чрезмерного использования этого функционала и как избежать ситуаций, когда формирование ответа занимает больше времени, чем установленный системой таймаут. Возможные меры защиты могут включать асинхронную обработку, использование очередей и ограничение количества параллельных процессов для каждого пользователя и приложения.", - "parent": "V15.1" - }, - { - "bom-ref": "V15.1.4", - "identifier": "V15.1.4", - "text": "Убедитесь, что в документации приложения указаны внешние библиотеки, которые считаются «компонентами с повышенным риском».", - "parent": "V15.1" - }, - { - "bom-ref": "V15.1.5", - "identifier": "V15.1.5", - "text": "Убедитесь, что в документации приложения выделены те части приложения, в которых используются «функционал с повышенным риском».", - "parent": "V15.1" - }, - { - "bom-ref": "V15.2", - "identifier": "V15.2", - "title": "Архитектура безопасности и зависимости", - "parent": "V15" - }, - { - "bom-ref": "V15.2.1", - "identifier": "V15.2.1", - "text": "Убедитесь, что приложение содержит только те компоненты, которые не нарушили задокументированные сроки обновления и исправления.", - "parent": "V15.2" - }, - { - "bom-ref": "V15.2.2", - "identifier": "V15.2.2", - "text": "Убедитесь, что в приложении реализованы меры защиты от потери доступности из-за функциональности, требующей много времени или ресурсов, на основе задокументированных решений и стратегий безопасности для этого.", - "parent": "V15.2" - }, - { - "bom-ref": "V15.2.3", - "identifier": "V15.2.3", - "text": "Убедитесь, что производственная среда включает только те функции, которые необходимы для работы приложения, и не предоставляет лишние функции, такие как тестовый код, примеры кода и инструменты разработки.", - "parent": "V15.2" - }, - { - "bom-ref": "V15.2.4", - "identifier": "V15.2.4", - "text": "Убедитесь, что сторонние компоненты и все их транзитивные зависимости загружаются только из ожидаемых репозиториев (внутренних или внешних) и отсутствует риск атаки через подмену зависимостей (dependency confusion attack)", - "parent": "V15.2" - }, - { - "bom-ref": "V15.2.5", - "identifier": "V15.2.5", - "text": "Убедитесь, что приложение реализует дополнительные меры защиты для тех частей приложения, которые документированы как содержащие «функционал с повышенным риском» или использующие сторонние библиотеки, считающиеся «функционалом с повышенным риском». Это могут быть такие методы, как «песочница», инкапсуляция, контейнеризация или изоляция на сетевом уровне, чтобы задержать и предотвратить продвижение (pivoting) злоумышленников, скомпрометировавших одну часть приложения, к другим частям приложения.", - "parent": "V15.2" - }, - { - "bom-ref": "V15.3", - "identifier": "V15.3", - "title": "Безопасное программирование", - "parent": "V15" - }, - { - "bom-ref": "V15.3.1", - "identifier": "V15.3.1", - "text": "Убедитесь, что приложение возвращает только необходимое подмножество полей из объекта данных. Например, оно не должно возвращать весь объект данных, поскольку некоторые отдельные поля должны быть недоступны пользователям.", - "parent": "V15.3" - }, - { - "bom-ref": "V15.3.2", - "identifier": "V15.3.2", - "text": "Убедитесь, что при вызовах внешних URL-адресов бэкэнд приложения настроен так, чтобы не выполнять перенаправления, если только это не предусмотрено функционалом.", - "parent": "V15.3" - }, - { - "bom-ref": "V15.3.3", - "identifier": "V15.3.3", - "text": "Убедитесь, что в приложении реализованы защитные механизмы против атак типа массового присвоения (mass assignment) путем строгого ограничения разрешенных полей для каждого контроллера и действия, исключая возможность добавления или изменения значений полей, которые не должны быть доступны для данной конкретной операции.", - "parent": "V15.3" - }, - { - "bom-ref": "V15.3.4", - "identifier": "V15.3.4", - "text": "Убедитесь, что все прокси и промежуточное ПО корректно передают исходный IP-адрес пользователя, используя доверенные поля данных, которые не могут быть изменены конечным пользователем, а приложение и веб-сервер используют это правильное значение для ведения логирования и принятия решений по безопасности, таких как ограничение запросов. При этом следует учитывать, что даже исходный IP-адрес может быть ненадежным из-за динамических IP-адресов, VPN или корпоративных файрволов.", - "parent": "V15.3" - }, - { - "bom-ref": "V15.3.5", - "identifier": "V15.3.5", - "text": "Убедитесь, что приложение явно проверяет соответствие переменных ожидаемому типу данных и использует строгие операции сравнения. Это необходимо для предотвращения уязвимостей, связанных с type juggling и type confusion, вызванных тем, что код приложения делает предположения о типе переменной.", - "parent": "V15.3" - }, - { - "bom-ref": "V15.3.6", - "identifier": "V15.3.6", - "text": "Убедитесь, что JavaScript-код написан таким образом, чтобы предотвратить prototype pollution, например, используя Set() или Map() вместо обычных литералов объекта.", - "parent": "V15.3" - }, - { - "bom-ref": "V15.3.7", - "identifier": "V15.3.7", - "text": "Убедитесь, что приложение защищено от атак типа HTTP Parameter Pollution (HPP), особенно если используемый фреймворк не различает источники параметров запроса (строка запроса, тело запроса, куки или заголовки).", - "parent": "V15.3" - }, - { - "bom-ref": "V15.4", - "identifier": "V15.4", - "title": "Безопасная работа с параллельными процессами", - "parent": "V15" - }, - { - "bom-ref": "V15.4.1", - "identifier": "V15.4.1", - "text": "Убедитесь, что к общим объектам в многопоточном коде (например, кэшам, файлам или объектам в памяти, используемым несколькими потоками) используется безопасный многопоточный доступ и механизмов синхронизации, таких как блокировки или семафоры, чтобы избежать состояний гонки и повреждения данных.", - "parent": "V15.4" - }, - { - "bom-ref": "V15.4.2", - "identifier": "V15.4.2", - "text": "Убедитесь, что проверки состояния ресурса, например его существования или разрешений, а также зависящие от него действия выполняются как одна атомарная операция, чтобы предотвратить условия гонки времени проверки и времени использования (TOCTOU). Например, проверка существования файла перед его открытием или проверка прав доступа пользователя перед его предоставлением.", - "parent": "V15.4" - }, - { - "bom-ref": "V15.4.3", - "identifier": "V15.4.3", - "text": "Убедитесь, что блокировки применяются согласованно, чтобы предотвратить взаимные блокировки потоков (deadlocks) или их бесконечные повторы, а также что логика блокировки инкапсулирована в коде, отвечающем за управление ресурсом. Это гарантирует, что блокировки не могут быть случайно или намеренно изменены внешними классами или кодом.", - "parent": "V15.4" - }, - { - "bom-ref": "V15.4.4", - "identifier": "V15.4.4", - "text": "Убедитесь, что политики распределения ресурсов предотвращают нехватку ресурсов у потоков, обеспечивая справедливый доступ к ресурсам, например, используя пулы потоков, позволяя потокам с более низким приоритетом выполняться в течение разумного периода времени.", - "parent": "V15.4" - }, - { - "bom-ref": "V16", - "identifier": "V16", - "title": "Журналирование событий безопасности и обработка ошибок" - }, - { - "bom-ref": "V16.1", - "identifier": "V16.1", - "title": "Документация по ведению логов", - "parent": "V16" - }, - { - "bom-ref": "V16.1.1", - "identifier": "V16.1.1", - "text": "Убедитесь в существовании реестра, в котором документируется ведение журнала на каждом уровне технологического стека приложения, включая какие события регистрируются, форматы логов, где хранятся эти журналы, как они используются, как контролируется доступ к ним и как долго хранятся журналы.", - "parent": "V16.1" - }, - { - "bom-ref": "V16.2", - "identifier": "V16.2", - "title": "Общее журналирование", - "parent": "V16" - }, - { - "bom-ref": "V16.2.1", - "identifier": "V16.2.1", - "text": "Убедитесь, что каждая запись журнала содержит необходимые метаданные (например, когда, где, кто, что), которые позволят провести подробное исследование временной шкалы, когда произошло событие.", - "parent": "V16.2" - }, - { - "bom-ref": "V16.2.2", - "identifier": "V16.2.2", - "text": "Убедитесь, что все источники времени компонентов системы журналирования синхронизированы, а временные метки в метаданных событий безопасности используют UTC или содержат явное указание смещения часового пояса. Рекомендуется применять UTC для обеспечения согласованности в распределённых системах и предотвращения ошибок при переходе на летнее/зимнее время.", - "parent": "V16.2" - }, - { - "bom-ref": "V16.2.3", - "identifier": "V16.2.3", - "text": "Убедитесь, что приложение записывает и передаёт логи исключительно в те файлы и сервисы, которые указаны в реестре журналирования.", - "parent": "V16.2" - }, - { - "bom-ref": "V16.2.4", - "identifier": "V16.2.4", - "text": "Убедитесь, что логи могут быть прочитаны и коррелированы используемой системой обработки журналов, предпочтительно с использованием общего стандартного формата логирования.", - "parent": "V16.2" - }, - { - "bom-ref": "V16.2.5", - "identifier": "V16.2.5", - "text": "Убедитесь, что приложение применяет соответствующие меры защиты при логировании конфиденциальных данных в зависимости от уровня их чувствительности: например, полностью запрещает запись в логи таких данных, как учетные данные или платежные реквизиты, а для других данных (например, сессионных токенов) использует хеширование или частичное/полное маскирование.", - "parent": "V16.2" - }, - { - "bom-ref": "V16.3", - "identifier": "V16.3", - "title": "Инциденты безопасности", - "parent": "V16" - }, - { - "bom-ref": "V16.3.1", - "identifier": "V16.3.1", - "text": "Убедитесь, что все операции аутентификации регистрируются, включая успешные и неудачные попытки. Также следует фиксировать дополнительные метаданные, такие как тип аутентификации или использованные факторы проверки.", - "parent": "V16.3" - }, - { - "bom-ref": "V16.3.2", - "identifier": "V16.3.2", - "text": "Убедитесь, что ведется журнал неудачных попыток авторизации. Для уровня L3 это должно включать в себя журналирование всех решений об авторизации, включая журналирование доступа к конфиденциальным данным (без регистрации самих конфиденциальных данных).", - "parent": "V16.3" - }, - { - "bom-ref": "V16.3.3", - "identifier": "V16.3.3", - "text": "Убедитесь, что приложение регистрирует все события безопасности, определенные в документации, а также фиксирует попытки обхода механизмов защиты, включая проверку входных данных, бизнес-логики и системы защиты от автоматизированных атак.", - "parent": "V16.3" - }, - { - "bom-ref": "V16.3.4", - "identifier": "V16.3.4", - "text": "Убедитесь, что приложение регистрирует в журналах неожиданные ошибки и сбои механизмов безопасности, включая, например, ошибки TLS-соединения на стороне сервера.", - "parent": "V16.3" - }, - { - "bom-ref": "V16.4", - "identifier": "V16.4", - "title": "Защита журналов", - "parent": "V16" - }, - { - "bom-ref": "V16.4.1", - "identifier": "V16.4.1", - "text": "Убедитесь, что все компоненты системы логирования корректно кодируют данные, чтобы предотвратить атаки типа внедрения в журналы (log injection).", - "parent": "V16.4" - }, - { - "bom-ref": "V16.4.2", - "identifier": "V16.4.2", - "text": "Убедитесь, что логи защищены от неавторизованного доступа и не могут быть модифицированы.", - "parent": "V16.4" - }, - { - "bom-ref": "V16.4.3", - "identifier": "V16.4.3", - "text": "Убедитесь, что логи безопасно передаются в логически изолированную систему для анализа, обнаружения угроз, генерации оповещений и эскалации инцидентов. Это гарантирует сохранность журналов даже в случае компрометации основного приложения.", - "parent": "V16.4" - }, - { - "bom-ref": "V16.5", - "identifier": "V16.5", - "title": "Обработка ошибок", - "parent": "V16" - }, - { - "bom-ref": "V16.5.1", - "identifier": "V16.5.1", - "text": "Убедитесь, что при возникновении непредвиденной или связанной с безопасностью ошибки пользователю возвращается только общее сообщение, гарантируя отсутствие раскрытия конфиденциальных внутренних данных системы, таких как трассировки стека, запросы, секретные ключи и токены.", - "parent": "V16.5" - }, - { - "bom-ref": "V16.5.2", - "identifier": "V16.5.2", - "text": "Убедитесь, что приложение продолжает работать в безопасном режиме при недоступности внешних ресурсов, используя такие механизмы, как автоматические выключатели (circuit breakers) или плавное снижение функциональности (graceful degradation).", - "parent": "V16.5" - }, - { - "bom-ref": "V16.5.3", - "identifier": "V16.5.3", - "text": "Убедитесь, что приложение корректно и безопасно завершает работу при возникновении исключений, предотвращая опасные сценарии по типу «fail-open», когда, например, транзакция ошибочно выполняется, несмотря на ошибки в логике валидации.", - "parent": "V16.5" - }, - { - "bom-ref": "V16.5.4", - "identifier": "V16.5.4", - "text": "Убедитесь, что определён обработчик ошибок «крайние меры», который будет перехватывать все необработанные ошибки. Это необходимо как для предотвращения потери информации об ошибках, которая должна быть записана в файлы журналов, так и для того, чтобы ошибка не остановила весь процесс приложения, что привело бы к потере доступности.", - "parent": "V16.5" - }, - { - "bom-ref": "V17", - "identifier": "V17", - "title": "WebRTC" - }, - { - "bom-ref": "V17.1", - "identifier": "V17.1", - "title": "TURN-сервер", - "parent": "V17" - }, - { - "bom-ref": "V17.1.1", - "identifier": "V17.1.1", - "text": "Убедитесь, что сервис TURN (Traversal Using Relays around NAT) разрешает доступ только к IP-адресам, не зарезервированным для специальных целей (например, внутренние сети, широковещательная рассылка, loopback-адреса). Данное требование применяется как к IPv4, так и к IPv6 адресам.", - "parent": "V17.1" - }, - { - "bom-ref": "V17.1.2", - "identifier": "V17.1.2", - "text": "Убедитесь, что сервис TURN (Traversal Using Relays around NAT) защищен от исчерпания ресурсов при попытках легитимных пользователей открыть чрезмерное количество портов на сервере.", - "parent": "V17.1" - }, - { - "bom-ref": "V17.2", - "identifier": "V17.2", - "title": "Требования к медиасерверам", - "parent": "V17" - }, - { - "bom-ref": "V17.2.1", - "identifier": "V17.2.1", - "text": "Убедитесь, что ключ сертификата Datagram Transport Layer Security (DTLS) управляется и защищается в соответствии с документированной политикой управления криптографическими ключами.", - "parent": "V17.2" - }, - { - "bom-ref": "V17.2.2", - "identifier": "V17.2.2", - "text": "Убедитесь, что медиасервер настроен на использование только одобренных наборов шифров Datagram Transport Layer Security (DTLS) и защищенного профиля безопасности для расширения DTLS, применяемого при установке ключей для Secure Real-time Transport Protocol (DTLS-SRTP).", - "parent": "V17.2" - }, - { - "bom-ref": "V17.2.3", - "identifier": "V17.2.3", - "text": "Убедитесь, что медиасервер проверяет аутентификацию Secure Real-time Transport Protocol (SRTP) для предотвращения атак с внедрением Real-time Transport Protocol (RTP), которые могут привести к отказу в обслуживании (Denial of Service) или вставке поддельного аудио-/видеоконтента в медиапотоки.", - "parent": "V17.2" - }, - { - "bom-ref": "V17.2.4", - "identifier": "V17.2.4", - "text": "Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика при получении некорректных пакетов Secure Real-time Transport Protocol (SRTP).", - "parent": "V17.2" - }, - { - "bom-ref": "V17.2.5", - "identifier": "V17.2.5", - "text": "Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетами Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.", - "parent": "V17.2" - }, - { - "bom-ref": "V17.2.6", - "identifier": "V17.2.6", - "text": "Убедитесь, что медиасервер не подвержен уязвимости «Гонка ClientHello» (ClientHello Race Condition) в Datagram Transport Layer Security (DTLS), проверив наличие известных уязвимостей в публичных источниках или выполнив тестирование на воспроизведение условий гонки.", - "parent": "V17.2" - }, - { - "bom-ref": "V17.2.7", - "identifier": "V17.2.7", - "text": "Убедитесь, что механизмы аудио- и видеозаписи, связанные с медиасервером, способны продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетов Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.", - "parent": "V17.2" - }, - { - "bom-ref": "V17.2.8", - "identifier": "V17.2.8", - "text": "Убедитесь, что сертификат Datagram Transport Layer Security (DTLS) проверяется на соответствие атрибуту отпечатка (fingerprint) в Session Description Protocol (SDP), с немедленным прекращением медиапотока в случае несоответствия — это гарантирует подлинность передаваемых данных.", - "parent": "V17.2" - }, - { - "bom-ref": "V17.3", - "identifier": "V17.3", - "title": "Сигнализация", - "parent": "V17" - }, - { - "bom-ref": "V17.3.1", - "identifier": "V17.3.1", - "text": "Убедитесь, что сигнальный сервер способен продолжать обработку легитимных входящих сообщений сигнализации даже в условиях флуд-атаки. Для этого необходимо реализовать механизм ограничения частоты запросов (rate limiting) на уровне сигнализации.", - "parent": "V17.3" - }, - { - "bom-ref": "V17.3.2", - "identifier": "V17.3.2", - "text": "Убедитесь, что сигнальный сервер способен продолжать обработку легитимных сообщений сигнализации даже при получении некорректных сообщений, которые могут вызвать отказ в обслуживании (Denial of Service, DoS). Для этого необходимо реализовать: проверку входных данных (input validation), безопасную обработку целочисленных переполнений (integer overflows), защиту от переполнения буферов (buffer overflows) и другие надежные методы обработки ошибок.", - "parent": "V17.3" - } - ], - "levels": [ - { - "bom-ref": "level-1", - "identifier": "Level 1", - "description": "This level contains the minimum requirements to consider when securing an application and represents a critical starting point.", - "requirements": [ - "V1.2.1", - "V1.2.2", - "V1.2.3", - "V1.2.4", - "V1.2.5", - "V1.3.1", - "V1.3.2", - "V1.5.1", - "V2.1.1", - "V2.2.1", - "V2.2.2", - "V2.3.1", - "V3.2.1", - "V3.2.2", - "V3.3.1", - "V3.4.1", - "V3.4.2", - "V3.5.1", - "V3.5.2", - "V3.5.3", - "V4.1.1", - "V4.4.1", - "V5.2.1", - "V5.2.2", - "V5.3.1", - "V5.3.2", - "V6.1.1", - "V6.2.1", - "V6.2.2", - "V6.2.3", - "V6.2.4", - "V6.2.5", - "V6.2.6", - "V6.2.7", - "V6.2.8", - "V6.3.1", - "V6.3.2", - "V6.4.1", - "V6.4.2", - "V7.2.1", - "V7.2.2", - "V7.2.3", - "V7.2.4", - "V7.4.1", - "V7.4.2", - "V8.1.1", - "V8.2.1", - "V8.2.2", - "V8.3.1", - "V9.1.1", - "V9.1.2", - "V9.1.3", - "V9.2.1", - "V10.4.1", - "V10.4.2", - "V10.4.3", - "V10.4.4", - "V10.4.5", - "V11.3.1", - "V11.3.2", - "V11.4.1", - "V12.1.1", - "V12.2.1", - "V12.2.2", - "V13.4.1", - "V14.2.1", - "V14.3.1", - "V15.1.1", - "V15.2.1", - "V15.3.1" - ] - }, - { - "bom-ref": "level-2", - "identifier": "Level 2", - "description": "ASVS Level 2 requirements generally relate to either less common attacks or more complicated protections against common attacks. They may still be a first layer of defense, or they may require certain preconditions for the attack to be successful.", - "requirements": [ - "V1.1.1", - "V1.1.2", - "V1.2.6", - "V1.2.7", - "V1.2.8", - "V1.2.9", - "V1.3.3", - "V1.3.4", - "V1.3.5", - "V1.3.6", - "V1.3.7", - "V1.3.8", - "V1.3.9", - "V1.3.10", - "V1.3.11", - "V1.4.1", - "V1.4.2", - "V1.4.3", - "V1.5.2", - "V2.1.2", - "V2.1.3", - "V2.2.3", - "V2.3.2", - "V2.3.3", - "V2.3.4", - "V2.4.1", - "V3.3.2", - "V3.3.3", - "V3.3.4", - "V3.4.3", - "V3.4.4", - "V3.4.5", - "V3.4.6", - "V3.5.4", - "V3.5.5", - "V3.7.1", - "V3.7.2", - "V4.1.2", - "V4.1.3", - "V4.2.1", - "V4.3.1", - "V4.3.2", - "V4.4.2", - "V4.4.3", - "V4.4.4", - "V5.1.1", - "V5.2.3", - "V5.4.1", - "V5.4.2", - "V5.4.3", - "V6.1.2", - "V6.1.3", - "V6.2.9", - "V6.2.10", - "V6.2.11", - "V6.2.12", - "V6.3.3", - "V6.3.4", - "V6.4.3", - "V6.4.4", - "V6.5.1", - "V6.5.2", - "V6.5.3", - "V6.5.4", - "V6.5.5", - "V6.6.1", - "V6.6.2", - "V6.6.3", - "V6.8.1", - "V6.8.2", - "V6.8.3", - "V6.8.4", - "V7.1.1", - "V7.1.2", - "V7.1.3", - "V7.3.1", - "V7.3.2", - "V7.4.3", - "V7.4.4", - "V7.4.5", - "V7.5.1", - "V7.5.2", - "V7.6.1", - "V7.6.2", - "V8.1.2", - "V8.2.3", - "V8.4.1", - "V9.2.2", - "V9.2.3", - "V9.2.4", - "V10.1.1", - "V10.1.2", - "V10.2.1", - "V10.2.2", - "V10.3.1", - "V10.3.2", - "V10.3.3", - "V10.3.4", - "V10.4.6", - "V10.4.7", - "V10.4.8", - "V10.4.9", - "V10.4.10", - "V10.4.11", - "V10.5.1", - "V10.5.2", - "V10.5.3", - "V10.5.4", - "V10.5.5", - "V10.6.1", - "V10.6.2", - "V10.7.1", - "V10.7.2", - "V10.7.3", - "V11.1.1", - "V11.1.2", - "V11.2.1", - "V11.2.2", - "V11.2.3", - "V11.3.3", - "V11.4.2", - "V11.4.3", - "V11.4.4", - "V11.5.1", - "V11.6.1", - "V12.1.2", - "V12.1.3", - "V12.3.1", - "V12.3.2", - "V12.3.3", - "V12.3.4", - "V13.1.1", - "V13.2.1", - "V13.2.2", - "V13.2.3", - "V13.2.4", - "V13.2.5", - "V13.3.1", - "V13.3.2", - "V13.4.2", - "V13.4.3", - "V13.4.4", - "V13.4.5", - "V14.1.1", - "V14.1.2", - "V14.2.2", - "V14.2.3", - "V14.2.4", - "V14.3.2", - "V14.3.3", - "V15.1.2", - "V15.1.3", - "V15.2.2", - "V15.2.3", - "V15.3.2", - "V15.3.3", - "V15.3.4", - "V15.3.5", - "V15.3.6", - "V15.3.7", - "V16.1.1", - "V16.2.1", - "V16.2.2", - "V16.2.3", - "V16.2.4", - "V16.2.5", - "V16.3.1", - "V16.3.2", - "V16.3.3", - "V16.3.4", - "V16.4.1", - "V16.4.2", - "V16.4.3", - "V16.5.1", - "V16.5.2", - "V16.5.3", - "V17.1.1", - "V17.2.1", - "V17.2.2", - "V17.2.3", - "V17.2.4", - "V17.3.1", - "V17.3.2" - ] - }, - { - "bom-ref": "level-3", - "identifier": "Level 3", - "description": "ASVS Level 3 should be the goal for applications looking to demonstrate the highest levels of security and requirements in this section are generally either defense-in-depth mechanisms or other useful but hard-to-implement controls.", - "requirements": [ - "V1.2.10", - "V1.3.12", - "V1.5.3", - "V2.3.5", - "V2.4.2", - "V3.1.1", - "V3.2.3", - "V3.3.5", - "V3.4.7", - "V3.4.8", - "V3.5.6", - "V3.5.7", - "V3.5.8", - "V3.6.1", - "V3.7.3", - "V3.7.4", - "V3.7.5", - "V4.1.4", - "V4.1.5", - "V4.2.2", - "V4.2.3", - "V4.2.4", - "V4.2.5", - "V5.2.4", - "V5.2.5", - "V5.2.6", - "V5.3.3", - "V6.3.5", - "V6.3.6", - "V6.3.7", - "V6.3.8", - "V6.4.5", - "V6.4.6", - "V6.5.6", - "V6.5.7", - "V6.5.8", - "V6.6.4", - "V6.7.1", - "V6.7.2", - "V7.5.3", - "V8.1.3", - "V8.1.4", - "V8.2.4", - "V8.3.2", - "V8.3.3", - "V8.4.2", - "V10.2.3", - "V10.3.5", - "V10.4.12", - "V10.4.13", - "V10.4.14", - "V10.4.15", - "V10.4.16", - "V11.1.3", - "V11.1.4", - "V11.2.4", - "V11.2.5", - "V11.3.4", - "V11.3.5", - "V11.5.2", - "V11.6.2", - "V11.7.1", - "V11.7.2", - "V12.1.4", - "V12.1.5", - "V12.3.5", - "V13.1.2", - "V13.1.3", - "V13.1.4", - "V13.2.6", - "V13.3.3", - "V13.3.4", - "V13.4.6", - "V13.4.7", - "V14.2.5", - "V14.2.6", - "V14.2.7", - "V14.2.8", - "V15.1.4", - "V15.1.5", - "V15.2.4", - "V15.2.5", - "V15.4.1", - "V15.4.2", - "V15.4.3", - "V15.4.4", - "V16.5.4", - "V17.1.2", - "V17.2.5", - "V17.2.6", - "V17.2.7", - "V17.2.8" - ] - } - ], - "externalReferences": [ - { - "type": "website", - "url": "https://owasp.org/asvs" - }, - { - "type": "vcs", - "url": "https://github.com/OWASP/ASVS" - }, - { - "type": "issue-tracker", - "url": "https://github.com/OWASP/ASVS/issues" - }, - { - "type": "social", - "url": "https://twitter.com/OWASP_ASVS" - } - ] - } - ] - } -} diff --git a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.csv b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.csv deleted file mode 100644 index f339063108..0000000000 --- a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.csv +++ /dev/null @@ -1,347 +0,0 @@ -chapter_id,chapter_name,section_id,section_name,req_id,req_description,L -V1,Кодировка и нейтрализация,V1.1,Архитектура кодировки и нейтрализации,V1.1.1,"Убедитесь, что входные данные декодируются или деэкранируются в каноническую форму (в стандартное представление) только один раз. Декодирование происходит только тогда, когда ожидаются закодированные данные в этой форме, и что это делается перед дальнейшей обработкой входных данных, например, это не выполняется после проверки или нейтрализации.",2 -V1,Кодировка и нейтрализация,V1.1,Архитектура кодировки и нейтрализации,V1.1.2,"Убедитесь, что приложение выполняет кодирование и экранирование выходных данных либо в качестве последнего шага перед использованием интерпретатором, для которого оно предназначено, либо самим интерпретатором.",2 -V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.1,"Убедитесь, что выходная кодировка для ответа HTTP, документа HTML или документа XML соответствует требуемому контексту, например, кодировка соответствующих символов для элементов HTML, атрибутов HTML, комментариев HTML, CSS или полей заголовка HTTP делается таким способом, чтобы избежать изменения структуры сообщения или документа.",1 -V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.2,"Убедитесь, что при динамическом построении URL-адресов недоверенные данные кодируются в соответствии с их контекстом (например, кодирование URL-адресов или кодирование base64url для query или path параметров или пути). Убедитесь, что разрешены только безопасные протоколы URL-адресов (например, запрещен javascript: или data:).",1 -V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.3,"Убедитесь, что при динамическом построении содержимого JavaScript (включая JSON) используется кодирование или экранирование выходных данных, чтобы избежать изменения структуры сообщения или документа (чтобы избежать JavaScript и JSON-инъекций).",1 -V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.4,"Убедитесь, что выборка данных (Redis, Memcached, чтение из файлов, обращение по API) или запросы к базе данных (например, SQL, HQL, NoSQL, Cypher) используют параметризованные запросы, ORM, Entity Frameworks или иным образом защищены от SQL-инъекций и других атак. Это также актуально при написании хранимых процедур.",1 -V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.5,"Убедитесь, что приложение защищено от внедрения команд ОС и что вызовы операционной системы используют параметризованные запросы к ОС или используют контекстное кодирование вывода командной строки.",1 -V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.6,"Убедитесь, что приложение защищено от LDAP-инъекций, или что реализованы специальные меры безопасности для их предотвращения.",2 -V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.7,"Убедитесь, что приложение защищено от атак с использованием XPath-инъекций с помощью параметризации запросов или предварительно скомпилированных запросов.",2 -V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.8,"Убедитесь, что процессоры LaTeX настроены безопасно (например, не используется флаг «–shell‑escape») и используется разрешенный список команд для предотвращения LaTeX-инъекций.",2 -V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.9,"Убедитесь, что приложение экранирует специальные символы в регулярных выражениях (обычно с помощью обратной косой черты), чтобы предотвратить их ошибочную интерпретацию как метасимволов.",2 -V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.10,"Убедитесь, что приложение защищено от внедрения формул CSV (CSV Injection). Приложение должно следовать правилам экранирования, определенным в RFC 4180, разделы 2.6 и 2.7, при экспорте содержимого CSV. Кроме того, при экспорте в CSV или другие форматы электронных таблиц (такие как XLS, XLSX или ODF) специальные символы (включая '=', '+', '-', '@', '\t' (табуляция), и '\0' (нулевой символ)) должны экранироваться одинарной кавычкой, если они появляются в качестве первого символа в значении поля.",3 -V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.1,"Убедитесь, что все ненадежные входные данные HTML из редакторов WYSIWYG или аналогичных программ нейтрализуются с помощью известных и безопасных библиотек или функций фреймворка для санитизации HTML.",1 -V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.2,"Убедитесь, что приложение избегает использования eval() или других динамических функций выполнения кода, таких как Spring Expression Language (SpEL). Если нет альтернативы, любой пользовательский ввод должен быть нейтрализован перед выполнением.",1 -V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.3,"Убедитесь, что данные, передаваемые в потенциально опасный контекст, предварительно нейтрализованы, чтобы обеспечить соблюдение мер безопасности, таких как разрешение только тех символов, которые безопасны для данного контекста, и обрезка слишком длинного ввода.",2 -V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.4,"Убедитесь, что предоставленный пользователем файл .SVG проверен или нейтрализован, чтобы он содержал только теги и атрибуты (например, относящиеся к рисованию), которые безопасны для приложения, например, не содержат скриптов и foreignObject.",2 -V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.5,"Убедитесь, что приложение нейтралует или отключает предоставленные пользователем скриптовые данные или выражения шаблонных языков, такие как таблицы стилей Markdown, CSS или XSL, BBCode или аналогичные.",2 -V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.6,"Убедитесь, что приложение защищено от атак с подделкой запросов на стороне сервера (SSRF), проверяя ненадежные данные по разрешенному списку протоколов, доменов, путей и портов, а также нейтрализуя потенциально опасные символы перед использованием данных для вызова другой службы.",2 -V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.7,"Убедитесь, что приложение защищено от атак с внедрением шаблонов (template injection), не позволяя создавать шаблоны на основе недоверенных входных данных. Если нет альтернативы, любые недоверенные входные данные, включаемые динамически во время создания шаблона, должны быть нейтрализованы или тщательно провалидированы.",2 -V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.8,"Убедитесь, что приложение надлежащим образом нейтрализует недоверенные входные данные перед использованием в запросах Java Naming and Directory Interface (JNDI) и что JNDI настроен безопасно для предотвращения атак с использованием JNDI-инъекций.",2 -V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.9,"Убедитесь, что приложение нейтрализует данные перед отправкой в Memcache, чтобы предотвратить атаки методом инъекций.",2 -V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.10,"Убедитесь, что строки форматирования, которые могут быть использованы неожидаемым или вредоносным образом, нейтрализуются перед дальнейшим использованием.",2 -V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.11,"Убедитесь, что приложение нейтрализует вводимые пользователем данные перед передачей в почтовые системы для защиты от SMTP или IMAP-инъекций.",2 -V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.12,"Убедитесь, что регулярные выражения не содержат элементов, вызывающих экспоненциальный возврат, и убедитесь в нейтрализации недоверенных входных данных для предотвращения атак ReDoS или Runaway Regex.",3 -V1,Кодировка и нейтрализация,V1.4,"Память, строки и неуправляемый код",V1.4.1,"Убедитесь, что для обнаружения или предотвращения ситуаций переполнения стека, буфера или кучи приложение учитывает размер доступной области памяти при строковых операциях, копировании в память, в арифметике указателей и т.п.",2 -V1,Кодировка и нейтрализация,V1.4,"Память, строки и неуправляемый код",V1.4.2,"Убедитесь, что для предотвращения целочисленного переполнения применяется контроль знака, диапазона и типа допустимых входных данных.",2 -V1,Кодировка и нейтрализация,V1.4,"Память, строки и неуправляемый код",V1.4.3,"Убедитесь, что динамически выделенная память и ресурсы освобождены, а ссылки или указатели на освобожденную память удалены или установлены в значение null, чтобы предотвратить появление висячих указателей и уязвимостей, связанных с использованием памяти после освобождения.",2 -V1,Кодировка и нейтрализация,V1.5,Безопасная десериализация,V1.5.1,"Убедитесь, что приложение настраивает XML-парсеры на использование строгой конфигурации и что небезопасные функции, такие как разрешение внешних сущностей, отключены для предотвращения атак XML eXternal Entity (XXE).",1 -V1,Кодировка и нейтрализация,V1.5,Безопасная десериализация,V1.5.2,"Убедитесь, что десериализация недоверенных данных обеспечивает безопасную обработку ввода, например, используя список разрешенных типов объектов или ограничивая типы объектов, определяемые клиентом, для предотвращения атак десериализации. Механизмы десериализации, которые явно определены как небезопасные, не должны использоваться с недоверенным вводом.",2 -V1,Кодировка и нейтрализация,V1.5,Безопасная десериализация,V1.5.3,"Убедитесь, что различные парсеры, используемые в приложении для одного и того же типа данных (например, парсеры JSON, XML, URL), выполняют парсинг согласованным образом и используют один и тот же механизм кодирования символов, чтобы избежать таких проблем, как уязвимости взаимодействия JSON (JSON Interoperability) или различное поведение анализа URI или файлов, которые могут использоваться в атаках удаленного включения файлов (RFI) или подделки запросов на стороне сервера (SSRF).",3 -V2,Валидация и бизнес-логика,V2.1,Документация валидации и бизнес-логики,V2.1.1,"Убедитесь, что в документации приложения определены правила проверки входных данных на соответствие ожидаемой структуре. Это могут быть распространённые форматы данных, такие как номера кредитных карт, адреса электронной почты, номера телефонов, или внутренний формат данных.",1 -V2,Валидация и бизнес-логика,V2.1,Документация валидации и бизнес-логики,V2.1.2,"Убедитесь, что в документации приложения указано, как проверять логическую и контекстную согласованность объединенных данных, например, проверять соответствие района и почтового индекса.",2 -V2,Валидация и бизнес-логика,V2.1,Документация валидации и бизнес-логики,V2.1.3,"Убедитесь, что ожидания относительно ограничений и проверок бизнес-логики задокументированы как для уровня отдельного пользователя, так и для глобального уровня всего приложения.",2 -V2,Валидация и бизнес-логика,V2.2,Валидация ввода,V2.2.1,"Убедитесь, что входные данные провалидированы для обеспечения соответствия бизнес- или функциональным ожиданиям. Валидация должна осуществляться либо по списку допустимых значений, шаблонов и диапазонов, либо путем сравнения входных данных с ожидаемой структурой и логическими ограничениями в соответствии с предопределенными правилами. Для L1 валидация может быть сосредоточена на входных данных, используемых для принятия конкретных бизнес-решений или решений, связанных с безопасностью. Для L2 и выше это должно применяться ко всем входным данным.",1 -V2,Валидация и бизнес-логика,V2.2,Валидация ввода,V2.2.2,"Убедитесь, что приложение разработано с принудительной валидацией входных данных на уровне доверенного сервиса. Хотя проверка на стороне клиента повышает удобство использования и должна поощряться, на неё не следует полагаться как на средство контроля безопасности.",1 -V2,Валидация и бизнес-логика,V2.2,Валидация ввода,V2.2.3,"Убедитесь, что приложение обеспечивает обоснованность комбинаций данных в соответствии с предопределенными правилам. Например: возраст должен соответствовать дате рождения; страна и почтовый индекс; количество товара в заказе и на складе.",2 -V2,Валидация и бизнес-логика,V2.3,Безопасность бизнес-логики,V2.3.1,"Убедитесь, что приложение обрабатывает потоки бизнес-логики для одного и того же пользователя в ожидаемом последовательном порядке шагов и без пропуска шагов.",1 -V2,Валидация и бизнес-логика,V2.3,Безопасность бизнес-логики,V2.3.2,"Убедитесь, что ограничения бизнес-логики реализованы в соответствии с документацией приложения, чтобы избежать эксплуатации её недостатков.",2 -V2,Валидация и бизнес-логика,V2.3,Безопасность бизнес-логики,V2.3.3,"Убедитесь, что транзакции используются на уровне бизнес-логики таким образом, что операция бизнес-логики либо выполняется полностью, либо откатывается к предыдущему корректному состоянию.",2 -V2,Валидация и бизнес-логика,V2.3,Безопасность бизнес-логики,V2.3.4,"Убедитесь, что на уровне бизнес-логики используются механизмы блокировки, чтобы гарантировать невозможность двойного бронирования ограниченных по количеству ресурсов (например, мест в театре или слотов доставки) путем манипулирования логикой приложения.",2 -V2,Валидация и бизнес-логика,V2.3,Безопасность бизнес-логики,V2.3.5,"Убедитесь, что для важных потоков бизнес-логики требуется многопользовательское (multi-user) одобрение, чтобы предотвратить несанкционированные или случайные действия. Потоки бизнес-логики могут включать, помимо прочего, крупные денежные переводы, утверждение контрактов, доступ к секретной информации или обход ограничений безопасности на производстве.",3 -V2,Валидация и бизнес-логика,V2.4,Анти-автоматизация,V2.4.1,"Убедитесь, что используются средства противодействия автоматизации для защиты от чрезмерных вызовов функций приложения, которые могут привести к утечке данных, созданию ненужных данных, исчерпанию квот, нарушению ограничений скорости, отказу в обслуживании или чрезмерному использованию дорогостоящих ресурсов.",2 -V2,Валидация и бизнес-логика,V2.4,Анти-автоматизация,V2.4.2,"Убедитесь, что потоки бизнес-логики требуют реалистичного человеческого времени, предотвращая чрезмерно быструю отправку транзакций.",3 -V3,Безопасность веб-интерфейса,V3.1,Документация по безопасности веб-интерфейса,V3.1.1,"Убедитесь, что в документации приложения описаны ожидаемые функции безопасности, которые должны поддерживать браузеры, использующие приложение (такие как HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) и другие соответствующие механизмы безопасности HTTP). В документации также должно быть обязательно определено, как приложение должно себя вести, если некоторые из этих функций недоступны (например, предупреждать пользователя или блокировать доступ).",3 -V3,Безопасность веб-интерфейса,V3.2,Непреднамеренная интерпретация контента,V3.2.1,"Убедитесь, что реализованы меры безопасности, предотвращающие отображение контента или функций браузерами в HTTP-ответах в некорректном контексте (например, запрос API, загруженный пользователем файл или другой ресурс запрашивается напрямую). Возможные способы контроля включают: не обрабатывать содержимое, если поля заголовка HTTP-запроса (например, Sec-Fetch-*) не указывают на корректность контекста; использование заголовка и значения Content-Security-Policy: sandbox directive; или использование заголовка и значения Content-Disposition: attachment.",1 -V3,Безопасность веб-интерфейса,V3.2,Непреднамеренная интерпретация контента,V3.2.2,"Убедитесь, что данные, предназначенные для отображения в виде текста, а не визуализации в виде HTML, обрабатывается с использованием безопасных функций визуализации (таких как createTextNode или textContent), чтобы предотвратить непреднамеренное выполнение содержимого, такого как HTML или JavaScript.",1 -V3,Безопасность веб-интерфейса,V3.2,Непреднамеренная интерпретация контента,V3.2.3,"Убедитесь, что приложение избегает затирания DOM при использовании JavaScript на стороне клиента, применяя явные объявления переменных, выполняя строгую проверку типов, избегая сохранения глобальных переменных в объекте документа и реализуя изоляцию пространства имен.",3 -V3,Безопасность веб-интерфейса,V3.3,Настройка файлов cookie,V3.3.1,"Убедитесь, что у файлов cookie установлен атрибут «Secure», и если префикс «__Host‑» не используется в названии cookie, необходимо использовать префикс «__Secure‑».",1 -V3,Безопасность веб-интерфейса,V3.3,Настройка файлов cookie,V3.3.2,"Убедитесь, что значение атрибута SameSite каждой cookie установлено в соответствии с назначением cookie, чтобы ограничить подверженность атакам на восстановление пользовательского интерфейса и атакам с подделкой запросов на уровне браузера, обычно называемым подделкой межсайтовых запросов (CSRF).",2 -V3,Безопасность веб-интерфейса,V3.3,Настройка файлов cookie,V3.3.3,"Убедитесь, что cookie имеют префикс «__Host‑» в названии, если только они явно не предназначены для совместного использования с другими хостами.",2 -V3,Безопасность веб-интерфейса,V3.3,Настройка файлов cookie,V3.3.4,"Убедитесь, что если значение cookie не должно быть доступно для клиентских скриптов (например, сессионный токен), для cookie должен быть установлен атрибут «HttpOnly», а само значение должно передаваться клиенту только через поле заголовка «Set-Cookie».",2 -V3,Безопасность веб-интерфейса,V3.3,Настройка файлов cookie,V3.3.5,"Убедитесь, что при записи cookie приложением общая длина имени и значения cookie не превышает 4096 байт. Слишком большие cookie не будут сохраняться браузером и, следовательно, не будут отправляться с запросами, что помешает пользователю использовать функции приложения, зависящие от этого cookie.",3 -V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.1,"Убедитесь, что поле заголовка Strict‑Transport‑Security включено во все ответы для реализации политики HTTP Strict Transport Security (HSTS). Необходимо указать максимальное время не менее 1 года, а для L2 и выше политика должна применяться также ко всем поддоменам.",1 -V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.2,"Убедитесь, что поле заголовка Cross‑Origin Resource Sharing (CORS) «Access‑Control‑Allow‑Origin» имеет фиксированное значение, заданное приложением, или, если используется заголовок Origin, оно проверяется по списку доверенных источников. При необходимости использования «Access‑Control‑Allow‑Origin: *» убедитесь, что ответ не содержит конфиденциальной информации.",1 -V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.3,"Убедитесь, что HTTP-ответы содержат поле заголовка Content-Security-Policy, которое определяет директивы, гарантирующие загрузку и выполнение браузером только доверенного контента или ресурсов, чтобы ограничить выполнение вредоносного JavaScript. Как минимум, необходимо использовать глобальную политику, включающую директивы object-src «none» и base-uri «none», а также определяющую список разрешенных адресов или использующую одноразовые коды или хэши. Для приложений L3 необходимо определить политику использования 'nonce' или hash-конструкций для каждого ответа.",2 -V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.4,"Убедитесь, что все HTTP-ответы содержат поле заголовка «X‑Content‑Type‑Options: nosniff». Это предписывает браузерам не использовать анализ контента и определение типа MIME для данного ответа, а также требовать, чтобы значение поля заголовка Content‑Type в ответе соответствовало целевому ресурсу. Например, ответ на запрос стиля принимается только в том случае, если Content‑Type в ответе — «text/css». Это также позволяет браузеру использовать функцию Cross‑Origin Read Blocking (CORB).",2 -V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.5,"Убедитесь, что приложение устанавливает политику реферера для предотвращения утечки технически конфиденциальных данных сторонним сервисам через поле заголовка HTTP-запроса «Referer». Это можно сделать с помощью поля заголовка HTTP-ответа «Referrer‑Policy» или через атрибуты HTML-элемента. Конфиденциальные данные могут включать путь и данные запроса в URL-адресе, а для внутренних непубличных приложений также имя хоста.",2 -V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.6,"Убедитесь, что веб-приложение использует директиву frame‑ancestors поля заголовка Content‑Security‑Policy для каждого HTTP-ответа, чтобы гарантировать невозможность его внедрения по умолчанию и внедрение определённых ресурсов разрешено только при необходимости. Обратите внимание, что поле заголовка X‑Frame‑Options, хотя и поддерживается браузерами, устарело и не может быть использовано в качестве основы.",2 -V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.7,"Убедитесь, что в поле заголовка Content‑Security‑Policy указано место, куда следует сообщать о нарушениях.",3 -V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.8,"Убедитесь, что все HTTP-ответы, инициирующие рендеринг документа (например, ответы с типом содержимого text/html), включают поле заголовка Cross-Origin-Opener-Policy с директивой same-origin или same-origin-allow-popups (при необходимости). Это предотвращает атаки, злоупотребляющие общим доступом к объектам Window, такие как Tabnabbing и Frame Counting.",3 -V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.1,"Убедитесь, что, если приложение не использует механизм предварительной проверки CORS для предотвращения запрещённых кросс-доменных запросов на использование чувствительного функционала, эти запросы валидируются на предмет их происхождения от самого приложения. Это можно сделать, используя и проверяя специальные токены для защиты от подделки или требуя дополнительные поля HTTP-заголовка, не входящие в список «простых заголовков» (CORS-safelisted request-header). Это необходимо для защиты от атак с подделкой запросов через браузер, широко известных как межсайтовая подделка запросов (CSRF).",1 -V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.2,"Убедитесь, что если приложение использует механизм предварительной проверки CORS для предотвращения неразрешённого использования чувствительного функционала между источниками, вызов этого функционала невозможен с помощью запроса, который не запускает предварительную проверку CORS. Для этого может потребоваться проверка значений полей заголовка запроса «Origin» и «Content-Type» или использование дополнительного поля заголовка, не входящего в безопасный список CORS.",1 -V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.3,"Убедитесь, что HTTP-запросы к чувствительному функционалу используют соответствующие HTTP-методы, такие как POST, PUT, PATCH или DELETE, а не методы, определённые спецификацией HTTP как «безопасные», такие как HEAD, OPTIONS или GET. В качестве альтернативы можно использовать строгую валидацию полей заголовка запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, навигационного запроса или загрузки ресурса (например, источника изображения), где это не ожидается.",1 -V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.4,"Убедитесь, что отдельные приложения размещены на разных именах хостов, чтобы использовать ограничения, предусмотренные политикой same-origin, включая то, как документы или скрипты, загруженные одним источником, могут взаимодействовать с ресурсами из другого источника, а также ограничения на cookie на основе имени хоста.",2 -V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.5,"Убедитесь, что сообщения, полученные интерфейсом postMessage, отвергаются, если источник сообщения не является доверенным или если синтаксис сообщения недействителен.",2 -V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.6,"Убедитесь, что функциональность JSONP не включена нигде в приложении, чтобы избежать атак с использованием межсайтового включения скриптов (XSSI).",3 -V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.7,"Убедитесь, что данные, требующие авторизации, не включены в ответы ресурсов скриптов, таких как файлы JavaScript, чтобы предотвратить атаки с использованием межсайтового включения скриптов (XSSI).",3 -V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.8,"Убедитесь, что аутентифицированные ресурсы (такие как изображения, видео, скрипты и другие документы) могут быть загружены или внедрены от имени пользователя только по назначению. Этого можно добиться путём строгой валидации полей заголовка HTTP-запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, или путём установки ограничительного поля заголовка HTTP-ответа Cross‑Origin‑Resource‑Policy, чтобы браузер блокировал возвращаемый контент.",3 -V3,Безопасность веб-интерфейса,V3.6,Целостность внешних ресурсов,V3.6.1,"Убедитесь, что клиентские ресурсы, такие как библиотеки JavaScript, CSS или веб-шрифты, размещаются только на внешнем сервере (например, в сети доставки контента (Content Delivery Network)), если ресурс статический и имеет версии, а для проверки целостности ресурса используется механизм проверки целостности подресурсов (SRI). Если это невозможно, для каждого ресурса должно быть задокументировано решение по безопасности, обосновывающее это.",3 -V3,Безопасность веб-интерфейса,V3.7,Другие соображения по безопасности браузера,V3.7.1,"Убедитесь, что приложение использует только те клиентские технологии, которые по-прежнему поддерживаются и считаются безопасными. Примерами технологий, не соответствующих этому требованию, являются плагины NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL или клиентские Java-апплеты.",2 -V3,Безопасность веб-интерфейса,V3.7,Другие соображения по безопасности браузера,V3.7.2,"Убедитесь, что приложение будет автоматически перенаправлять пользователя на другое имя хоста или домен (который не контролируется приложением), только если этот хост или домен указаны в списке разрешенных.",2 -V3,Безопасность веб-интерфейса,V3.7,Другие соображения по безопасности браузера,V3.7.3,"Убедитесь, что приложение отображает уведомление, что пользователь перенаправляется на URL-адрес, находящийся вне контроля приложения, с возможностью отмены навигации.",3 -V3,Безопасность веб-интерфейса,V3.7,Другие соображения по безопасности браузера,V3.7.4,"Убедитесь, что домен верхнего уровня приложения (например, site.tld) ​​добавлен в публичный список предварительной загрузки (preload list) для HTTP Strict Transport Security (HSTS). Это гарантирует, что использование TLS для приложения будет встроено непосредственно в основные браузеры, а не будет полагаться только на поле заголовка ответа Strict-Transport-Security.",3 -V3,Безопасность веб-интерфейса,V3.7,Другие соображения по безопасности браузера,V3.7.5,"Убедитесь, что приложение ведет себя так, как описано в документации (например, предупреждает пользователя или блокирует доступ), если браузер, используемый для доступа к приложению, не поддерживает ожидаемые функции безопасности.",3 -V4,API и Веб-сервис,V4.1,Общая безопасность веб-сервисов,V4.1.1,"Убедитесь, что каждый HTTP-ответ с телом сообщения содержит заголовок Content-Type, который соответствует фактическому содержимому ответа, таким как «text/», «/+xml» и «/xml», включая параметр charset для указания безопасной кодировки символов (например, UTF-8, ISO-8859-1) согласно IANA Media Types.",1 -V4,API и Веб-сервис,V4.1,Общая безопасность веб-сервисов,V4.1.2,"Убедитесь, что только конечные точки, предназначенные для взаимодействия с пользователем через веб-браузер, автоматически перенаправляют HTTP на HTTPS, в то время как другие сервисы или конечные точки не реализуют прозрачные редиректы. Это необходимо, чтобы избежать ситуации, когда клиент ошибочно отправляет незашифрованные HTTP-запросы а из-за того, что запрос по HTTP автоматически перенаправляется на HTTPS другим сервисом без обработки на входе, утечка чувствительных данных остаётся незамеченной.",2 -V4,API и Веб-сервис,V4.1,Общая безопасность веб-сервисов,V4.1.3,"Убедитесь, что любой HTTP-заголовок, используемый приложением и устанавливаемый промежуточным уровнем, таким как балансировщик нагрузки, веб-прокси или backend-for-frontend сервис, не может быть переопределён конечным пользователем. Примеры заголовков: X-Real-IP, X-Forwarded-*, X-User-ID.",2 -V4,API и Веб-сервис,V4.1,Общая безопасность веб-сервисов,V4.1.4,"Убедитесь, что разрешены только HTTP-методы, которые явно поддерживаются приложением или его API (включая OPTIONS для preflight-запросов), а неиспользуемые методы заблокированы.",3 -V4,API и Веб-сервис,V4.1,Общая безопасность веб-сервисов,V4.1.5,"Убедитесь, что для особо чувствительных запросов или транзакций, проходящих через несколько систем, используются цифровые подписи на уровне сообщений, дополнительно к транспортным средствам защиты.",3 -V4,API и Веб-сервис,V4.2,Валидация структуры HTTP-сообщений,V4.2.1,"Убедитесь, что все компоненты приложения (включая балансировщики нагрузки, файрволы и серверы приложений) определяют границы входящих HTTP-сообщений с использованием механизма, соответствующего версии HTTP, чтобы предотвратить HTTP request smuggling. В HTTP/1.x, если присутствует заголовок Transfer-Encoding, заголовок Content-Length должен игнорироваться согласно RFC 2616. При использовании HTTP/2 или HTTP/3, если присутствует Content-Length, веб-сервер должен убедиться, что он совпадает с длиной DATA-фреймов.",2 -V4,API и Веб-сервис,V4.2,Валидация структуры HTTP-сообщений,V4.2.2,"Убедитесь, что при генерации HTTP-сообщений заголовок Content-Length не конфликтует с длиной содержимого, определяемой рамками протокола HTTP, чтобы предотвратить HTTP Request Smuggling.",3 -V4,API и Веб-сервис,V4.2,Валидация структуры HTTP-сообщений,V4.2.3,"Убедитесь, что приложение не отправляет и не принимает HTTP/2 и HTTP/3 сообщения с заголовками, специфичными для соединения, такими как Transfer-Encoding, чтобы предотвратить HTTP Response Splitting и HTTP Header Injection.",3 -V4,API и Веб-сервис,V4.2,Валидация структуры HTTP-сообщений,V4.2.4,"Убедитесь, что приложение принимает HTTP/2 и HTTP/3 запросы только в случае, если поля заголовков и их значения не содержат последовательностей CR (\r), LF (\n) или CRLF (\r\n), чтобы предотвратить HTTP Header Injection.",3 -V4,API и Веб-сервис,V4.2,Валидация структуры HTTP-сообщений,V4.2.5,"Убедитесь, что если приложение (бекенд или фронтенд) формирует и отправляет запросы, оно использует валидацию, очистку или другие механизмы, чтобы не создавать URI (например, для API-вызовов) или HTTP-заголовки (например, Authorization или Cookie) слишком большой длины, чтобы их не принимал приёмник. Это может привести к отказу в обслуживании, например, при отправке слишком длинного запроса (длинный cookie-заголовок), из-за чего сервер постоянно возвращает ошибку.",3 -V4,API и Веб-сервис,V4.3,GraphQL,V4.3.1,"Убедитесь, что используется белый список запросов, ограничение глубины вложенности, ограничение количества или анализ стоимости запроса, чтобы предотвратить DoS-атаки на уровне GraphQL или слоя данных из-за дорогостоящих вложенных запросов.",2 -V4,API и Веб-сервис,V4.3,GraphQL,V4.3.2,"Убедитесь, что introspection-запросы GraphQL отключены в продакшен-среде, если GraphQL API не предназначен для использования сторонними клиентами.",2 -V4,API и Веб-сервис,V4.4,WebSocket,V4.4.1,"Убедитесь, что для всех WebSocket-соединений используется WebSocket поверх TLS (WSS).",1 -V4,API и Веб-сервис,V4.4,WebSocket,V4.4.2,"Убедитесь, что при первоначальном HTTP WebSocket handshake заголовок Origin проверяется на соответствие списку разрешённых источников для приложения.",2 -V4,API и Веб-сервис,V4.4,WebSocket,V4.4.3,"Убедитесь, что если стандартное управление сессиями приложения не может быть использовано, применяются специальные токены, соответствующие требованиям безопасности управления сессиями.",2 -V4,API и Веб-сервис,V4.4,WebSocket,V4.4.4,"Убедитесь, что специальные токены управления сессиями WebSocket изначально получаются или валидируются через ранее аутентифицированную HTTPS-сессию при переходе от HTTPS к WebSocket.",2 -V5,Работа с файлами,V5.1,Документация по работе с файлами,V5.1.1,"Убедитесь, что документация определяет допустимые типы файлов, ожидаемые расширения и максимальный размер (включая распакованный размер) для каждой функции загрузки. Также убедитесь, что в документации указано, как файлы обезвреживаются для конечных пользователей (например, как приложение ведёт себя при обнаружении вредоносного файла).",2 -V5,Работа с файлами,V5.2,Загрузка файлов и содержимое,V5.2.1,"Убедитесь, что приложение принимает только те файлы, которые может обработать без потери производительности или отказа в обслуживании.",1 -V5,Работа с файлами,V5.2,Загрузка файлов и содержимое,V5.2.2,"Убедитесь, что при загрузке файла (включая файлы внутри архивов, таких как ZIP) приложение проверяет, соответствует ли расширение ожидаемому, и валидирует, соответствует ли содержимое типу, указанному в расширении. Это включает проверку начальных 'magic bytes', перезапись изображений, использование специализированных библиотек. Для уровня 1 — достаточно проверок для файлов, критичных с точки зрения бизнеса или безопасности. Для уровней 2 и выше — для всех файлов.",1 -V5,Работа с файлами,V5.2,Загрузка файлов и содержимое,V5.2.3,"Убедитесь, что приложение проверяет архивы (например, zip, gz, docx, odt) на максимально допустимый распакованный размер и максимальное количество файлов до распаковки.",2 -V5,Работа с файлами,V5.2,Загрузка файлов и содержимое,V5.2.4,"Убедитесь, что для каждого пользователя установлены квоты на общий размер и количество файлов, чтобы один пользователь не мог переполнить хранилище.",3 -V5,Работа с файлами,V5.2,Загрузка файлов и содержимое,V5.2.5,"Убедитесь, что приложение не позволяет загружать архивы с символьными ссылками (symlinks), если это не требуется по бизнес-логике. Если требуется — разрешён только строго определённый список допустимых символьных ссылок.",3 -V5,Работа с файлами,V5.2,Загрузка файлов и содержимое,V5.2.6,"Убедитесь, что приложение отклоняет изображения с числом пикселей выше допустимого, чтобы предотвратить атаки 'pixel flood'.",3 -V5,Работа с файлами,V5.3,Хранение файлов,V5.3.1,"Убедитесь, что загруженные или сгенерированные из недоверенного ввода файлы, находящиеся в публичной директории, не исполняются как серверный код при обращении к ним по HTTP.",1 -V5,Работа с файлами,V5.3,Хранение файлов,V5.3.2,"Убедитесь, что при создании путей к файлам приложение использует внутренние или доверенные данные, а не пользовательские имена файлов. Если использование пользовательских имён или метаданных необходимо — требуется строгая проверка и очистка. Это защита от path traversal, LFI, RFI и SSRF.",1 -V5,Работа с файлами,V5.3,Хранение файлов,V5.3.3,"Убедитесь, что при обработке файлов на сервере (например, при распаковке) игнорируются пути, заданные пользователем, во избежание уязвимостей типа 'zip slip'.",3 -V5,Работа с файлами,V5.4,Скачивание файлов,V5.4.1,"Убедитесь, что приложение валидирует или игнорирует имена файлов, переданных пользователем (включая в JSON, JSONP или URL-параметре), и указывает имя файла в заголовке Content-Disposition при ответе.",2 -V5,Работа с файлами,V5.4,Скачивание файлов,V5.4.2,"Убедитесь, что имена файлов, передаваемые (например, в HTTP-заголовках или вложениях в email), кодируются или очищаются (например, по RFC 6266), чтобы сохранить структуру документа и предотвратить инъекции.",2 -V5,Работа с файлами,V5.4,Скачивание файлов,V5.4.3,"Убедитесь, что файлы, полученные из недоверенных источников, сканируются антивирусом, чтобы не распространять известное вредоносное содержимое.",2 -V6,Аутентификация,V6.1,Документация по аутентификации,V6.1.1,"Убедитесь, что в документации приложения описано, как используются механизмы, такие как ограничение частоты запросов (rate limiting), защита от автоматизации и адаптивные реакции, для защиты от атак, таких как подстановка учётных данных и перебор паролей. Документация должна ясно описывать конфигурацию этих механизмов и предотвращение злонамеренной блокировки аккаунтов.",1 -V6,Аутентификация,V6.1,Документация по аутентификации,V6.1.2,"Убедитесь, что задокументирован список контекстно-зависимых слов, запрещённых к использованию в паролях. В него могут входить производные от названий организаций, продуктов, идентификаторов систем, кодовых названий проектов, названий отделов или ролей и тому подобное.",2 -V6,Аутентификация,V6.1,Документация по аутентификации,V6.1.3,"Убедитесь, что если приложение поддерживает несколько способов аутентификации, то все они документированы вместе с описанием применяемых средств защиты и уровнем стойкости аутентификации, которые должны быть одинаково применены ко всем способам.",2 -V6,Аутентификация,V6.2,Безопасность паролей,V6.2.1,"Убедитесь, что пользовательские пароли содержат не менее 8 символов. Рекомендуется минимальная длина в 15 символов.",1 -V6,Аутентификация,V6.2,Безопасность паролей,V6.2.2,"Убедитесь, что пользователи могут менять свои пароли.",1 -V6,Аутентификация,V6.2,Безопасность паролей,V6.2.3,"Убедитесь, что для смены пароля требуется ввести как текущий, так и новый пароль.",1 -V6,Аутентификация,V6.2,Безопасность паролей,V6.2.4,"Убедитесь, что при регистрации или смене пароля введённый пароль проверяется по списку как минимум из 3000 самых популярных паролей, соответствующих политике (например, минимальной длине).",1 -V6,Аутентификация,V6.2,Безопасность паролей,V6.2.5,"Убедитесь, что допускаются пароли любой структуры, без ограничений на использование определённых символов. Не должно быть требований по обязательному наличию заглавных/строчных букв, цифр или специальных символов.",1 -V6,Аутентификация,V6.2,Безопасность паролей,V6.2.6,"Убедитесь, что поля ввода пароля используют type=password для скрытия символов. Разрешено временное отображение всего пароля или последнего введённого символа.",1 -V6,Аутентификация,V6.2,Безопасность паролей,V6.2.7,"Убедитесь, что разрешены вставка (paste), использование менеджеров паролей браузера и внешних менеджеров паролей.",1 -V6,Аутентификация,V6.2,Безопасность паролей,V6.2.8,"Убедитесь, что пароль проверяется строго в том виде, в котором он был введён пользователем — без обрезки, изменения регистра и других модификаций.",1 -V6,Аутентификация,V6.2,Безопасность паролей,V6.2.9,"Убедитесь, что система позволяет использовать пароли длиной не менее 64 символов.",2 -V6,Аутентификация,V6.2,Безопасность паролей,V6.2.10,"Убедитесь, что пароль остаётся действительным, пока не будет скомпрометирован или не будет изменён пользователем. Приложение не должно требовать регулярной смены пароля.",2 -V6,Аутентификация,V6.2,Безопасность паролей,V6.2.11,"Убедитесь, что используется документированный список контекстно-зависимых слов (например, названия компаний, проектов и т.д.) для предотвращения использования легко угадываемых паролей.",2 -V6,Аутентификация,V6.2,Безопасность паролей,V6.2.12,"Убедитесь, что при регистрации или смене пароля проверяется, не входит ли он в список скомпрометированных (утёкших) паролей.",2 -V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.1,"Убедитесь, что реализованы меры защиты от атак типа credential stuffing (массовая подстановка учётных данных) и brute-force (перебор паролей), согласно документации по безопасности приложения.",1 -V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.2,"Убедитесь, что в приложении отсутствуют или отключены учётные записи по умолчанию (например, root, admin, sa).",1 -V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.3,"Убедитесь, что для доступа к приложению используется либо механизм многофакторной аутентификации, либо комбинация однофакторных. Для уровня L3 один из факторов должен быть аппаратным, обеспечивающим защиту от фишинга, устойчивость к компрометации и подтверждение намерения аутентификации через явное действие пользователя (например, нажатие кнопки на FIDO-ключе или телефоне). Ослабление этих требований допускается только при наличии обоснования и компенсирующих мер.",2 -V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.4,"Убедитесь, что при наличии нескольких способов аутентификации, они все задокументированы, и для них единообразно применяются меры защиты и уровни доверия.",2 -V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.5,"Убедитесь, что пользователи получают уведомления о подозрительных попытках аутентификации (удачных и неудачных). Это может включать попытки (например, подключения) с необычного устройства или места, частично успешную MFA, попытку после долгого отсутствия или успешную аутентификацию после серии неудачных.",3 -V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.6,"Убедитесь, что email не используется ни как однофакторный, ни как многофакторный механизм аутентификации.",3 -V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.7,"Убедитесь, что пользователи получают уведомление при изменении данных аутентификации, таких как сброс пароля или изменение логина/email.",3 -V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.8,"Убедитесь, что из сообщений об ошибке, HTTP-кодов ответа или различий во времени ответа нельзя определить, существует ли пользователь с таким логином. Это правило также должно применяться к функциям регистрации и восстановления пароля.",3 -V6,Аутентификация,V6.4,Жизненный цикл и восстановление факторов аутентификации,V6.4.1,"Убедитесь, что начальные пароли или коды активации, генерируемые системой, создаются с использованием надёжного генератора случайных чисел, соответствуют текущей политике паролей и истекают через короткий период времени либо после первого использования. Эти секреты не должны использоваться как постоянные пароли.",1 -V6,Аутентификация,V6.4,Жизненный цикл и восстановление факторов аутентификации,V6.4.2,"Убедитесь, что в системе отсутствуют подсказки к паролю или вопросы на знание («секретные вопросы»).",1 -V6,Аутентификация,V6.4,Жизненный цикл и восстановление факторов аутентификации,V6.4.3,"Убедитесь, что реализован безопасный процесс сброса забытого пароля, который не обходит активные механизмы многофакторной аутентификации.",2 -V6,Аутентификация,V6.4,Жизненный цикл и восстановление факторов аутентификации,V6.4.4,"Убедитесь, что в случае утраты одного из факторов MFA проводится удостоверение личности (identity proofing) на том же уровне, что и при первичной регистрации.",2 -V6,Аутентификация,V6.4,Жизненный цикл и восстановление факторов аутентификации,V6.4.5,"Убедитесь, что инструкции по обновлению истекающих механизмов аутентификации отправляются заранее, с достаточным запасом времени для выполнения замены, при необходимости с настройкой автоматических напоминаний.",3 -V6,Аутентификация,V6.4,Жизненный цикл и восстановление факторов аутентификации,V6.4.6,"Убедитесь, что администраторы могут инициировать процесс сброса пароля, но не могут задать или выбрать новый пароль за пользователя. Это исключает ситуацию, при которой администратор знает пароль пользователя.",3 -V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.1,"Убедитесь, что lookup-секреты, внеполосные коды/запросы и TOTP-коды можно использовать только один раз.",2 -V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.2,"Убедитесь, что при хранении lookup-секретов с энтропией менее 112 бит (например, 19 случайных буквенно-цифровых символов или 34 случайные цифры) они хэшируются с использованием разрешённого алгоритма хеширования паролей и случайной соли минимум 32 бита. Если у секрета ≥112 бит энтропии — допустимо использовать стандартный хэш.",2 -V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.3,"Убедитесь, что lookup-секреты, коды внеполосной аутентификации и сиды для TOTP генерируются с использованием криптографически стойкого генератора случайных чисел (CSPRNG), чтобы избежать предсказуемых значений.",2 -V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.4,"Убедитесь, что lookup-секреты и внеполосные коды аутентификации имеют минимум 20 бит энтропии (достаточно, например, 4 случайных алфавитно-цифровых символов или 6 случайных цифр).",2 -V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.5,"Убедитесь, что все внеполосные запросы, коды и токены, а также TOTP-коды имеют ограниченный срок действия. Максимум для out-of-band — 10 минут, для TOTP — 30 секунд.",2 -V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.6,"Убедитесь, что любой фактор аутентификации (включая физические устройства) может быть отозван в случае кражи или утери.",3 -V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.7,"Убедитесь, что биометрические механизмы аутентификации используются только как вторичный фактор — в сочетании с «чем-то, что вы знаете» или «чем-то, что у вас есть».",3 -V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.8,"Убедитесь, что TOTP-коды проверяются по источнику времени, полученному от доверенного сервиса, а не от клиента или недоверенного источника.",3 -V6,Аутентификация,V6.6,Внеполосные механизмы аутентификации,V6.6.1,"Убедитесь, что механизмы аутентификации через телефонную сеть общего пользования (PSTN) для доставки одноразовых паролей (OTP) по телефону или SMS используются только в случае предварительной валидации номера, при этом предлагаются альтернативные более безопасные методы (например, TOTP), и пользователю сообщаются риски. Для приложений уровня L3 использование телефона и SMS недопустимо.",2 -V6,Аутентификация,V6.6,Внеполосные механизмы аутентификации,V6.6.2,"Убедитесь, что внеполосные запросы, коды или токены привязаны к исходному запросу аутентификации, для которого они были сгенерированы, и не могут быть использованы повторно для других попыток.",2 -V6,Аутентификация,V6.6,Внеполосные механизмы аутентификации,V6.6.3,"Убедитесь, что внеполосные механизмы на основе кода защищены от атак методом подбора (brute force) путём применения ограничения частоты запросов (rate limiting). Также рекомендуется использовать коды с энтропией не менее 64 бит.",2 -V6,Аутентификация,V6.6,Внеполосные механизмы аутентификации,V6.6.4,"Убедитесь, что при использовании push-уведомлений для MFA применяется ограничение частоты (rate limiting), чтобы предотвратить атаки push-бомбинга. Также может помочь механизм сопоставления номеров (number matching).",3 -V6,Аутентификация,V6.7,Криптографические механизмы аутентификации,V6.7.1,"Убедитесь, что сертификаты, используемые для проверки криптографических утверждений об аутентификации, хранятся таким образом, чтобы исключить возможность их модификации.",3 -V6,Аутентификация,V6.7,Криптографические механизмы аутентификации,V6.7.2,"Убедитесь, что nonce (случайная строка), используемая в процессе вызова, имеет длину не менее 64 бит и является статистически уникальной или уникальной на протяжении всего срока службы криптографического устройства.",3 -V6,Аутентификация,V6.8,Аутентификация с использованием провайдера идентификаций (IdP),V6.8.1,"Убедитесь, что при поддержке несколькими IdP, невозможно подделать личность пользователя через другой IdP (например, с тем же user ID). Стандартным способом защиты является регистрация пользователя с использованием сочетания ID самого IdP (в качестве пространства имён) и пользовательского ID внутри IdP.",2 -V6,Аутентификация,V6.8,Аутентификация с использованием провайдера идентификаций (IdP),V6.8.2,"Убедитесь, что наличие и целостность цифровой подписи в утверждениях аутентификации (например, в JWT или SAML) всегда проверяются, а неподписанные или недействительные утверждения отклоняются.",2 -V6,Аутентификация,V6.8,Аутентификация с использованием провайдера идентификаций (IdP),V6.8.3,"Убедитесь, что SAML-утверждения обрабатываются только один раз в течение периода их действия, чтобы исключить атаки воспроизведения (replay attacks).",2 -V6,Аутентификация,V6.8,Аутентификация с использованием провайдера идентификаций (IdP),V6.8.4,"Убедитесь, что если приложение использует внешний поставщик идентификации (IdP) и для определенных функций требуется особый уровень, метод или срок действия аутентификации, то приложение использует данные, возвращаемые IdP, для проверки этих условий. Например, при использовании OIDC можно проверить значения полей ID Token — acr, amr, auth_time (если они есть). Если IdP не предоставляет эти данные, приложение должно иметь документированный план действий по умолчанию, предполагающий использование минимально допустимой силы аутентификации (например, одноступенчатая — логин и пароль).",2 -V7,Управление сессиями,V7.1,Документация по управлению сессиями,V7.1.1,"Убедитесь, что тайм-аут бездействия и абсолютное максимальное время жизни сессии задокументированы, соответствуют другим контрольным мерам и сопровождаются обоснованием любых отклонений от требований повторной аутентификации NIST SP 800-63B.",2 -V7,Управление сессиями,V7.1,Документация по управлению сессиями,V7.1.2,"Убедитесь, что документация определяет допустимое количество одновременных (параллельных) сессий для одного аккаунта, а также поведение системы и действия при достижении этого лимита.",2 -V7,Управление сессиями,V7.1,Документация по управлению сессиями,V7.1.3,"Убедитесь, что все системы, создающие и управляющие сессиями пользователей в рамках федеративной идентификации (например, SSO), задокументированы вместе с механизмами координации сроков действия сессий, условий завершения и случаев, требующих повторной аутентификации.",2 -V7,Управление сессиями,V7.2,Базовая безопасность сессий,V7.2.1,"Убедитесь, что все проверки сессионных токенов выполняются на доверенной серверной стороне.",1 -V7,Управление сессиями,V7.2,Базовая безопасность сессий,V7.2.2,"Убедитесь, что приложение использует либо автономные токены, либо ссылочные токены, которые генерируются динамически, не используя статические API-секреты или ключи.",1 -V7,Управление сессиями,V7.2,Базовая безопасность сессий,V7.2.3,"Убедитесь, что ссылочные токены являются уникальными, создаются с использованием криптографически безопасного генератора псевдослучайных чисел (CSPRNG) и обладают энтропией не менее 128 бит.",1 -V7,Управление сессиями,V7.2,Базовая безопасность сессий,V7.2.4,"Убедитесь, что при аутентификации пользователя (включая повторную) создается новый токен сессии, а текущий — аннулируется.",1 -V7,Управление сессиями,V7.3,Тайм-ауты сессии,V7.3.1,"Убедитесь, что есть тайм-аут бездействия, после которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.",2 -V7,Управление сессиями,V7.3,Тайм-ауты сессии,V7.3.2,"Убедитесь, что установлено абсолютное максимальное время жизни сессии, по истечении которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.",2 -V7,Управление сессиями,V7.4,Завершение сессий,V7.4.1,"Убедитесь, что после завершения сессии (logout, истечение срока) дальнейшее её использование невозможно. Для ссылочных токенов или сессий с сохранением состояния это означает аннулирование на сервере. Для self-contained токенов необходимо реализовать механизм отзыва, например, список отозванных токенов, проверку времени выпуска или ротацию ключей подписи для каждого пользователя.",1 -V7,Управление сессиями,V7.4,Завершение сессий,V7.4.2,"Убедитесь, что при удалении или отключении пользователя все активные сессии немедленно завершаются.",1 -V7,Управление сессиями,V7.4,Завершение сессий,V7.4.3,"Убедитесь, что после изменения или удаления факторов аутентификации (например, смена пароля или MFA) приложение предлагает завершить все другие активные сессии.",2 -V7,Управление сессиями,V7.4,Завершение сессий,V7.4.4,"Убедитесь, что на всех страницах, требующих аутентификации, имеется простой и видимый способ выхода.",2 -V7,Управление сессиями,V7.4,Завершение сессий,V7.4.5,"Убедитесь, что администраторы могут завершать активные сессии конкретного пользователя или всех пользователей.",2 -V7,Управление сессиями,V7.5,Защита от злоупотреблений сессией,V7.5.1,"Убедитесь, что приложение требует полной повторной аутентификации перед изменением чувствительных атрибутов аккаунта, которые могут влиять на аутентификацию (например, email, номер телефона, настройки MFA или данных восстановления доступа).",2 -V7,Управление сессиями,V7.5,Защита от злоупотреблений сессией,V7.5.2,"Убедитесь, что пользователь может просматривать и (после повторной аутентификации хотя бы по одному фактору) завершать активные сессии.",2 -V7,Управление сессиями,V7.5,Защита от злоупотреблений сессией,V7.5.3,"Убедитесь, что перед выполнением критически важных операций приложение требует повторной аутентификации (по крайней мере, одного фактора) или дополнительной проверки.",3 -V7,Управление сессиями,V7.6,Федеративная повторная аутентификация,V7.6.1,"Убедитесь, что срок действия и завершение сессий между RP и IdP соответствуют документации и включают повторную аутентификацию, если достигнут максимальный допустимый интервал между событиями аутентификации.",2 -V7,Управление сессиями,V7.6,Федеративная повторная аутентификация,V7.6.2,"Убедитесь, что создание сессии требует согласия пользователя или явного действия, предотвращающего несанкционированное создание сессий без участия пользователя.",2 -V8,Авторизация,V8.1,Документация по авторизации,V8.1.1,"Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне функций и на уровне данных на основе прав субъекта и атрибутов ресурса.",1 -V8,Авторизация,V8.1,Документация по авторизации,V8.1.2,"Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне полей (как на чтение, так и на запись) на основе прав субъекта и атрибутов ресурса. Эти правила могут зависеть от других атрибутов объекта данных, например, статуса.",2 -V8,Авторизация,V8.1,Документация по авторизации,V8.1.3,"Убедитесь, что документация определяет, какие атрибуты окружения и контекста (например, время суток, IP-адрес, местоположение, устройство) используются приложением для принятия решений в области аутентификации и авторизации.",3 -V8,Авторизация,V8.1,Документация по авторизации,V8.1.4,"Убедитесь, что документация по аутентификации и авторизации определяет, как используются факторы окружения и контекста в принятии решений, наряду с правилами доступа к функциям, данным и полям. Документация должна содержать оцениваемые атрибуты, пороговые значения риска, действия (разрешить, отказать, повысить уровень аутентификации и др.).",3 -V8,Авторизация,V8.2,Архитектура авторизации,V8.2.1,"Убедитесь, что приложение обеспечивает доступ на уровне функций (function-level) только субъектам с явными разрешениями.",1 -V8,Авторизация,V8.2,Архитектура авторизации,V8.2.2,"Убедитесь, что приложение обеспечивает доступ на уровне данных (data-specific) только тем субъектам, которым явно предоставлены права к определённым элементам данных, чтобы предотвратить IDOR (Insecure Direct Object Reference) и BOLA-уязвимости (Broken Object Level Authorization).",1 -V8,Авторизация,V8.2,Архитектура авторизации,V8.2.3,"Убедитесь, что приложение обеспечивает доступ на уровне полей (field-level) только тем субъектам, которым явно предоставлены права к определённым полям, чтобы предотвратить BOPLA (Broken Object Property Level Authorization).",2 -V8,Авторизация,V8.2,Архитектура авторизации,V8.2.4,"Убедитесь, что реализованы адаптивные меры безопасности, основанные на атрибутах окружения и контекста субъекта (время, местоположение, IP, устройство), которые используются для принятия решений об аутентификации и авторизации, как это определено в документации приложения. Эти меры должны применяться как при попытке субъекта начать новую сессию, так и во время существующей сессии.",3 -V8,Авторизация,V8.3,Авторизация на уровне операций,V8.3.1,"Убедитесь, что правила авторизации реализуются на доверенном сервисном уровне и не зависят от элементов, которые может контролировать клиент (например, JavaScript на стороне клиента).",1 -V8,Авторизация,V8.3,Авторизация на уровне операций,V8.3.2,"Убедитесь, что изменения значений, влияющих на авторизацию, применяются немедленно. Если это невозможно (например, при использовании автономных токенов), должны быть реализованы компенсирующие меры: оповещения о попытке несанкционированного действия и откат изменений. Обратите внимание, что данный подход не предотвращает утечку информации.",3 -V8,Авторизация,V8.3,Авторизация на уровне операций,V8.3.3,"Убедитесь, что доступ к объекту осуществляется на основе прав субъекта, инициировавшего запрос, а не прав промежуточного сервиса, действующего от его имени. Например, если пользователь обращается к веб-сервису с автономным токеном для аутентификации, а сервис затем запрашивает данные у другого сервиса, второй сервис должен использовать токен пользователя, а не токен первого сервиса для принятия решения о доступе.",3 -V8,Авторизация,V8.4,Прочие аспекты авторизации,V8.4.1,"Убедитесь, что в мультитенантных приложениях реализованы механизмы, предотвращающие действия потребителя в отношении арендаторов, к которым у него нет доступа.",2 -V8,Авторизация,V8.4,Прочие аспекты авторизации,V8.4.2,"Убедитесь, что доступ к административным интерфейсам защищён несколькими уровнями контроля, включая непрерывную проверку личности, контроль защищённости устройства и анализ контекстных рисков. Недостаточно опираться только на IP-адрес или доверенные устройства.",3 -V9,Автономные токены,V9.1,Источник токена и его целостность,V9.1.1,"Убедитесь, что автономные токены проверяются на целостность с помощью цифровой подписи или MAC, прежде чем доверять их содержимому.",1 -V9,Автономные токены,V9.1,Источник токена и его целостность,V9.1.2,"Проверяйте, что автономные токены создаются и проверяются исключительно с помощью алгоритмов из списка допустимых в данном контексте. Список допустимых алгоритмов должен включать только разрешенные алгоритмы (желательно либо только симметричные, либо только асимметричные) и ни в коем случае не содержать алгоритм None. Если необходимо поддерживать оба типа алгоритмов, потребуются дополнительные средства контроля для предотвращения путаницы с ключами (key confusion).",1 -V9,Автономные токены,V9.1,Источник токена и его целостность,V9.1.3,"Убедитесь, что ключи, используемые для проверки автономных токенов, получены из доверенных, предварительно настроенных источников. Это предотвращает возможность указания злоумышленниками ненадёжных источников и ключей. Для JWT и других JWS структур заголовки 'jku', 'x5u' и 'jwk' должны проверяться по белому списку.",1 -V9,Автономные токены,V9.2,Содержимое токена,V9.2.1,"Убедитесь, что при указанном сроке действия токен и его содержимое принимаются только в том случае, если срок действия токена не истёк. Например, для JWT нужно проверить поля 'nbf' и 'exp'.",1 -V9,Автономные токены,V9.2,Содержимое токена,V9.2.2,"Убедитесь, что сервис, принимающий токен, проверяет его тип и соответствие назначению перед обработкой содержимого токена. Например, для принятия решений об авторизации могут быть приняты только Access Token, а для подтверждения аутентификации пользователя — только ID Token.",2 -V9,Автономные токены,V9.2,Содержимое токена,V9.2.3,"Убедитесь, что сервис принимает только токены, предназначенные для использования с этим сервисом (audience). Для JWT это можно сделать, проверив наличие утверждения «aud» по белому списку, определенному в сервисе.",2 -V9,Автономные токены,V9.2,Содержимое токена,V9.2.4,"Убедитесь, что, если эмитент токенов использует один и тот же закрытый ключ для выпуска токенов различным сервисам (audiences), выпущенные токены содержат явное указание целевых сервисов. Это предотвратит повторное использования токенов в не предназначенных для них сервисах. Если идентификатор сервиса (audience identifier) назначается динамически, эмитент токенов должен проверить audiences для исключения подмены получателей (audience impersonation).",2 -V10,OAuth и OIDC,V10.1,Общие требования безопасности OAuth и OIDC,V10.1.1,"Убедитесь, что токены передаются только тем компонентам, которым они действительно необходимы. Например, при использовании схемы backend-for-frontend для браузерных JavaScript-приложений, access и refresh токены должны быть доступны только на backend.",2 -V10,OAuth и OIDC,V10.1,Общие требования безопасности OAuth и OIDC,V10.1.2,"Убедитесь, что клиент принимает значения от авторизационного сервера (например, authorization code или ID Token) только если они получены в результате авторизационного потока, инициированного в той же сессии пользовательского агента и в рамках той же транзакции. Для этого клиентские секреты, такие как proof key для code exchange (PKCE) — 'code_verifier', 'state' или OIDC 'nonce' — должны быть непредсказуемыми, специфичными для транзакции и надежно привязанными как к клиенту, так и к сессии пользовательского агента, в которой началась транзакция.",2 -V10,OAuth и OIDC,V10.2,Клиент OAuth,V10.2.1,"Убедитесь, что если используется механизм authorization code flow, OAuth клиент защищён от CSRF, вызывающих запросы токенов либо за счёт использования механизма proof key for code exchange (PKCE), либо за счёт проверки параметра 'state', который был отправлен в запросе авторизации.",2 -V10,OAuth и OIDC,V10.2,Клиент OAuth,V10.2.2,"Убедитесь, что если OAuth клиент может взаимодействовать с более чем одним сервером авторизации, у него есть защита от атак смешивания (mix-up attacks). Например, клиент должен требовать, чтобы сервер авторизации возвращал параметр 'iss' и проверять его в ответах на авторизацию и токены.",2 -V10,OAuth и OIDC,V10.2,Клиент OAuth,V10.2.3,"Убедитесь, что OAuth клиент запрашивает только необходимые области доступа (scopes) или другие параметры авторизации в запросах к серверу авторизации.",3 -V10,OAuth и OIDC,V10.3,Сервер ресурсов OAuth,V10.3.1,"Убедитесь, что сервер ресурсов принимает только те access токены, которые предназначены для использования с этим сервисом (свойство audience). Эта принадлежность сервису может быть включена в структурированный access токен (например, в поле 'aud' в JWT) или проверяться через endpoint интроспекции токена.",2 -V10,OAuth и OIDC,V10.3,Сервер ресурсов OAuth,V10.3.2,"Убедитесь, что сервер ресурсов принимает решения по авторизации на основе claims из access токена, определяющих делегированную авторизацию. Если присутствуют claims, такие как 'sub', 'scope' и 'authorization_details', они должны участвовать в принятии решения.",2 -V10,OAuth и OIDC,V10.3,Сервер ресурсов OAuth,V10.3.3,"Убедитесь, что если для принятия решения по контролю доступа необходимо однозначно идентифицировать пользователя из access токена (JWT или ответа интроспекции), сервер ресурсов использует claims, которые не могут быть переприсвоены другим пользователям. Обычно это комбинация claims 'iss' и 'sub'.",2 -V10,OAuth и OIDC,V10.3,Сервер ресурсов OAuth,V10.3.4,"Убедитесь, что если сервер ресурсов требует определённой силы аутентификации, методов или свежести аутентификации, он проверяет, что предъявленный access токен удовлетворяет этим требованиям. Например, при наличии, могут использоваться claims OIDC 'acr', 'amr' и 'auth_time'.",2 -V10,OAuth и OIDC,V10.3,Сервер ресурсов OAuth,V10.3.5,"Убедитесь, что сервер ресурсов предотвращает использование украденных access токенов или их повторное использование (replay) неавторизованными лицами, требуя access токены с подтверждением отправителя — например, Mutual TLS для OAuth 2 или OAuth 2 Demonstration of Proof of Possession (DPoP).",3 -V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.1,"Убедитесь, что сервер авторизации проверяет URI перенаправления (redirect URI), сверяя его с заранее зарегистрированным списком разрешённых URI для данного клиента (allowlist), используя точное сравнение строк.",1 -V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.2,"Убедитесь, что если сервер авторизации возвращает authorization code в ответе авторизации, этот код может быть использован только один раз для запроса токена. При втором валидном запросе с уже использованным кодом сервер должен отклонить запрос и отозвать любые токены, связанные с этим кодом.",1 -V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.3,"Убедитесь, что authorization code имеет короткое время жизни. Максимальная продолжительность — до 10 минут для приложений L1 и L2 и до 1 минуты для приложений L3.",1 -V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.4,"Убедитесь, что сервер авторизации для конкретного клиента разрешает использование только тех типов авторизации, которые необходимы этому клиенту. Обратите внимание, что тип авторизации Implicit flow и Resource Owner Password Credentials flow больше не должны использоваться.",1 -V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.5,"Убедитесь, что сервер авторизации предотвращает атаки повторного использования refresh токенов для публичных клиентов, предпочтительно используя sender-constrained refresh токены, такие как DPoP или сертификат-связанные токены с mutual TLS (mTLS). Для L1 и L2 допускается ротация refresh токенов с обязательной их инвалидацией после использования. Если используется ротация, сервер должен отозвать все refresh токены при попытке использовать уже инвалидированный токен.",1 -V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.6,"Убедитесь, что при использовании типа авторизации «Authorization Code» сервер предотвращает атаки перехвата authorization code, требуя Proof Key for Code Exchange (PKCE). В запросах авторизации сервер должен требовать валидное значение 'code_challenge' и не принимать 'code_challenge_method' со значением 'plain'. В запросах токена обязательно валидировать параметр 'code_verifier'.",2 -V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.7,"Убедитесь, что если сервер авторизации поддерживает динамическую регистрацию клиентов без аутентификации, он минимизирует риски вредоносных клиентов. Сервер должен валидировать метаданные клиента (например, зарегистрированные URI), обеспечивать согласие пользователя и предупреждать пользователя перед обработкой запроса авторизации от недоверенного клиента.",2 -V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.8,"Убедитесь, что refresh токены имеют абсолютный срок действия, включая случаи, когда применяется скользящее время истечения срока.",2 -V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.9,"Убедитесь, что пользователи могут отзывать refresh токены и reference access токены через пользовательский интерфейс сервера авторизации для снижения риска от вредоносных клиентов или кражи токенов.",2 -V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.10,"Убедитесь, что конфиденциальный клиент аутентифицируется при взаимодействии с сервером авторизации через backchannel, например при запросах токена, pushed authorization requests (PAR) и запросах на отзыв токенов.",2 -V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.11,"Убедитесь, что конфигурация сервера авторизации назначает OAuth клиенту только необходимые области доступа (scopes).",2 -V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.12,"Убедитесь, что для конкретного клиента сервер авторизации разрешает только те значения 'response_mode', которые необходимы этому клиенту. Например, сервер должен валидировать это значение против ожидаемых или использовать pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).",3 -V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.13,"Убедитесь, что грант типа 'code' всегда используется вместе с pushed authorization requests (PAR).",3 -V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.14,"Убедитесь, что сервер авторизации выдаёт только sender-constrained (Proof-of-Possession) access токены, либо с сертификат-связанными токенами через mutual TLS (mTLS), либо DPoP-bound токены (Demonstration of Proof of Possession).",3 -V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.15,"Убедитесь, что для серверного клиента (не выполняющегося на устройстве конечного пользователя) сервер авторизации проверяет, что значение параметра 'authorization_details' исходит из клиентского backend и что пользователь не изменял его. Например, это достигается использованием pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).",3 -V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.16,"Убедитесь, что клиент является конфиденциальным и сервер авторизации требует использования сильных методов аутентификации клиента (основанных на криптографии с открытым ключом и устойчивых к атакам повторного воспроизведения), таких как mutual TLS ('tls_client_auth', 'self_signed_tls_client_auth') или private key JWT ('private_key_jwt').",3 -V10,OAuth и OIDC,V10.5,Клиент OIDC,V10.5.1,"Убедитесь, что клиент (relying party) защищается от повторного использования ID Token (replay-атак). Например, это достигается проверкой того, что значение 'nonce' в ID Token совпадает со значением 'nonce', отправленным в запросе аутентификации провайдеру OpenID (authorization server).",2 -V10,OAuth и OIDC,V10.5,Клиент OIDC,V10.5.2,"Убедитесь, что клиент однозначно идентифицирует пользователя по утверждениям (claims) ID Token, обычно это 'sub', который не может быть переназначен другому пользователю (в пределах конкретного провайдера идентификации).",2 -V10,OAuth и OIDC,V10.5,Клиент OIDC,V10.5.3,"Убедитесь, что клиент отклоняет попытки злоумышленного сервера авторизации выдавать себя за другой сервер авторизации через метаданные сервера авторизации. Клиент должен отклонить метаданные, если URL издателя (issuer) в метаданных не совпадает точно с преднастроенным URL издателя, ожидаемым клиентом.",2 -V10,OAuth и OIDC,V10.5,Клиент OIDC,V10.5.4,"Убедитесь, что клиент проверяет, что ID Token предназначен для него (проверка audience), сравнивая значение 'aud' в токене с 'client_id' клиента.",2 -V10,OAuth и OIDC,V10.5,Клиент OIDC,V10.5.5,"Убедитесь, что при использовании OIDC back-channel logout клиент снижает риск отказа в обслуживании, вызванный принудительным выходом из системы и путаницей между разными типами JWT (cross-JWT confusion) в процессе логаута. Клиент должен проверить, что токен выхода корректно типизирован со значением 'logout+jwt', содержит claim 'event' с правильным именем участника и не содержит 'nonce'. Также рекомендуется установить короткий срок действия токена (например, 2 минуты).",2 -V10,OAuth и OIDC,V10.6,Провайдер OpenID,V10.6.1,"Убедитесь, что провайдер OpenID допускает только значения 'code', 'ciba', 'id_token' или 'id_token code' для параметра response mode. При этом предпочтение отдаётся 'code' по сравнению с 'id_token code' (гибридный поток OIDC), а значение 'token' (любой Implicit flow) не должно использоваться.",2 -V10,OAuth и OIDC,V10.6,Провайдер OpenID,V10.6.2,"Убедитесь, что провайдер OpenID предотвращает отказ в обслуживании (DoS) через принудительный выход (logout), запрашивая явное подтверждение от конечного пользователя или, если применимо, проверяя параметры в запросе выхода (инициированном relying party), например параметр 'id_token_hint'.",2 -V10,OAuth и OIDC,V10.7,Управление согласием,V10.7.1,"Убедитесь, что авторизационный сервер обеспечивает получение согласия пользователя для каждого запроса авторизации. Если личность клиента не может быть подтверждена, сервер авторизации всегда должен явно запрашивать согласие пользователя.",2 -V10,OAuth и OIDC,V10.7,Управление согласием,V10.7.2,"Убедитесь, что при запросе согласия пользователя авторизационный сервер предоставляет достаточную и понятную информацию о том, на что даётся согласие. При необходимости это должно включать характер запрашиваемых разрешений (обычно основанных на scope, ресурсном сервере, деталях авторизации Rich Authorization Requests (RAR)), идентификацию авторизованного приложения и срок действия этих разрешений.",2 -V10,OAuth и OIDC,V10.7,Управление согласием,V10.7.3,"Убедитесь, что пользователь может просматривать, изменять и отзывать согласия, которые он предоставил, через авторизационный сервер.",2 -V11,Криптография,V11.1,Инвентаризация и документирование криптографии,V11.1.1,"Убедитесь, что задокументирована политика управления криптографическими ключами и описан их жизненный цикл в соответствии со стандартом управления ключей, таким как NIST SP 800-57. Убедитесь, что ключи известны только тем сущностям, которым они должны быть доступны (например, ключи не передавались более чем двум участникам для общих секретов и более чем одному участнику для приватных ключей).",2 -V11,Криптография,V11.1,Инвентаризация и документирование криптографии,V11.1.2,"Убедитесь, что проводится инвентаризация криптографических средств, которая непрерывно поддерживается, регулярно обновляется и включает все криптографические ключи, алгоритмы и сертификаты, используемые в приложении. Также должна быть задокументирована информация о том, где ключи могут и не могут использоваться в системе, а также какие типы данных могут и не могут быть защищены с помощью этих ключей.",2 -V11,Криптография,V11.1,Инвентаризация и документирование криптографии,V11.1.3,"Убедитесь, что используются механизмы обнаружения криптографии для идентификации всех случаев применения криптографии в системе , включая операции шифрования, хеширования и цифровой подписи.",3 -V11,Криптография,V11.1,Инвентаризация и документирование криптографии,V11.1.4,"Убедитесь, что ведётся и поддерживается инвентаризация криптографических средств. В неё должен входить документированный план, описывающий переход на новые криптографические стандарты, такие как постквантовая криптография, чтобы своевременно реагировать на будущие угрозы.",3 -V11,Криптография,V11.2,Безопасная реализация криптографии,V11.2.1,"Убедитесь, что для криптографических операций используются утвержденные в индустрии реализации (включая библиотеки и аппаратные реализации).",2 -V11,Криптография,V11.2,Безопасная реализация криптографии,V11.2.2,"Убедитесь, что архитектура приложения поддерживает быструю реконфигурацию, усовершенствование или смену в любой момент случайных чисел, аутентифицированного шифрования, MAC, алгоритмов хеширования, длин ключей, количества раундов, шифров и режимов шифрования для защиты от криптографических атак. Также должна поддерживаться возможность смены ключей, паролей и повторного шифрования данных. Это позволит беспрепятственно перейти на постквантовую криптографию (PQC), как только станут широко доступны высоконадёжные реализации одобренных схем или стандартов PQC.",2 -V11,Криптография,V11.2,Безопасная реализация криптографии,V11.2.3,"Убедитесь, что все криптографические примитивы используют как минимум 128-бит стойкости с учетом алгоритма, размера ключа и конфигурации. Например, 256-битный ECC ключ обеспечивает примерно 128 бит безопасности, тогда как для достижения того же уровня безопасности в RSA требуется ключ длиной 3072 бита.",2 -V11,Криптография,V11.2,Безопасная реализация криптографии,V11.2.4,"Убедитесь, что все криптографические операции выполняются за константное время, без использования «short-circuit» операций в сравнениях, вычислениях, возвратах функций для избежания утечек информации.",3 -V11,Криптография,V11.2,Безопасная реализация криптографии,V11.2.5,"Убедитесь, что все криптографические модули обеспечивают безопасное завершение работы при ошибках, а обработка ошибок реализована таким образом, чтобы не создавать уязвимостей, например, таких как атаки Padding Oracle.",3 -V11,Криптография,V11.3,Алгоритмы шифрования,V11.3.1,"Убедитесь, что не используются небезопасные режимы блочного шифрования (н-р, ECB) и слабые схемы дополнения (padding) (н-р, PKCS#1 v1.5).",1 -V11,Криптография,V11.3,Алгоритмы шифрования,V11.3.2,"Убедитесь, что используются только утверждённые шифры и режимы, такие как AES с GCM.",1 -V11,Криптография,V11.3,Алгоритмы шифрования,V11.3.3,"Убедитесь, что зашифрованные данные защищены от несанкционированного изменения, предпочтительно с использованием утверждённого метода аутентифицированного шифрования или путём комбинирования утверждённого метода шифрования с утверждённым алгоритмом MAC.",2 -V11,Криптография,V11.3,Алгоритмы шифрования,V11.3.4,"Убедитесь, что случайные числа (nonce), векторы инициализации (IV) и другие одноразовые числа не используются более одного раза для одной и той же пары ключа шифрования и элемента данных. Метод их генерации должен соответствовать требованиям используемого алгоритма.",3 -V11,Криптография,V11.3,Алгоритмы шифрования,V11.3.5,"Убедитесь, что любая комбинация алгоритма шифрования и алгоритма MAC работает в режиме encrypt-then-MAC (EtM).",3 -V11,Криптография,V11.4,Хеширование и функции на основе хеширования,V11.4.1,"Убедитесь, что только утвержденные хэш-функции используются для стандартных сценариев использования в криптографии, включая цифровую подпись, HMAC, KDF, генерацию случайных чисел. Запрещено использовать неустойчивые хэш-функции, (н-р, MD5) для любого использования в криптографии.",1 -V11,Криптография,V11.4,Хеширование и функции на основе хеширования,V11.4.2,"Убедитесь, что пароли хранятся с использованием утверждённой, вычислительно затратной функции генерации ключа (также известной как «функция хеширования паролей»), с параметрами, настроенными в соответствии с актуальными рекомендациями. Настройки должны обеспечивать баланс между безопасностью и производительностью, чтобы сделать атаки перебором достаточно сложными для требуемого уровня безопасности.",2 -V11,Криптография,V11.4,Хеширование и функции на основе хеширования,V11.4.3,"Убедитесь, что хэш-функции, используемые в формировании цифровой подписи, как часть аутентификации и целостности данных, устойчивы к коллизиям и имеют достаточную длину.",2 -V11,Криптография,V11.4,Хеширование и функции на основе хеширования,V11.4.4,"Убедитесь, что приложение использует утвержденную функцию генерации ключа с использованием параметров расширения ключа (key stretching) при генерации ключа из пароля. Параметры должны быть сбалансированы с точки зрения безопасности, производительности и устойчивости к атакам полного перебора при компрометации результирующего криптографического ключа.",2 -V11,Криптография,V11.5,Случайные значения,V11.5.1,"Убедитесь, что все случайные числа и строки, которые должны быть непредсказуемы, должны быть сгенерированы с помощью CSPRNG и иметь хотя бы 128 бит энтропии. Учтите, что UUID не удовлетворяют данному условию.",2 -V11,Криптография,V11.5,Случайные значения,V11.5.2,"Убедитесь, что механизм генерации случайных чисел является надежным даже при высокой нагрузке.",3 -V11,Криптография,V11.6,Криптография с публичным ключом,V11.6.1,"Убедитесь, что только утвержденные криптографические алгоритмы и режимы операций используются для генерации ключа и инициализации случайного значения для его генерации (seeding), а также для генерации цифровой подписи и верификации. Алгоритмы генерации ключей не должны генерировать небезопасные ключи уязвимые к известным атакам, например, ключи RSA уязвимы к факторизации Ферма.",2 -V11,Криптография,V11.6,Криптография с публичным ключом,V11.6.2,"Убедитесь, что для обмена ключами используются утверждённые криптографические алгоритмы (например, Диффи-Хеллман) с особым вниманием к обеспечению использования безопасных параметров. Это предотвратит атаки на процесс установления ключа, которые могут привести к атакам «человек посередине» или криптографическим взломам.",3 -V11,Криптография,V11.7,Шифрование данных в процессе использования,V11.7.1,"Убедитесь, что используется полное шифрование памяти, которое защищает конфиденциальные данные во время их использования, предотвращая доступ к ним неавторизованных пользователей или процессов.",3 -V11,Криптография,V11.7,Шифрование данных в процессе использования,V11.7.2,"Убедитесь, что минимизация данных обеспечивает раскрытие минимально необходимого объёма данных во время обработки, а также что данные шифруются сразу после использования или как можно скорее.",3 -V12,Безопасная коммуникация,V12.1,Общие рекомендации по безопасности TLS,V12.1.1,"Убедитесь, что включены только актуальные и рекомендуемые версии протокола TLS, такие как TLS 1.2 и TLS 1.3. Наиболее свежая версия TLS должна быть выбрана как предпочтительная.",1 -V12,Безопасная коммуникация,V12.1,Общие рекомендации по безопасности TLS,V12.1.2,"Убедитесь, что включены рекомендуемые шифронаборы (cipher suites), предпочтение также стоит отдать самому сильному шифронабору. L3 приложения должны поддерживать только те наборы шифров (cipher suites), которые обеспечивают прямую (forward) секретность. Пояснение: Прямая секретность (Forward Secrecy, FS) — это криптографическая особенность, при которой сессионные ключи уникальны для каждой сессии и не зависят от долгосрочных ключей. Это гарантирует, что даже при компрометации долгосрочного ключа злоумышленник не сможет расшифровать ранее перехваченные зашифрованные сессии.",2 -V12,Безопасная коммуникация,V12.1,Общие рекомендации по безопасности TLS,V12.1.3,"Убедитесь, что приложение проверяет доверенность клиентских сертификатов mTLS, прежде чем использовать идентификацию по сертификату для аутентификации или авторизации.",2 -V12,Безопасная коммуникация,V12.1,Общие рекомендации по безопасности TLS,V12.1.4,"Убедитесь, что включена и настроена правильная проверка отзыва сертификатов, такая как Online Certificate Status Protocol (OCSP) Stapling.",3 -V12,Безопасная коммуникация,V12.1,Общие рекомендации по безопасности TLS,V12.1.5,"Убедитесь, что в настройках TLS приложения включена функция Encrypted Client Hello (ECH) для предотвращения раскрытия конфиденциальных метаданных, таких как Server Name Indication (SNI), во время процесса TLS-рукопожатия.",3 -V12,Безопасная коммуникация,V12.2,HTTPS коммуникация с внешними сервисами,V12.2.1,"Убедитесь, что для всех соединений между клиентом и внешними HTTP-сервисами используется TLS и не происходит отката к небезопасным или незашифрованным протоколам.",1 -V12,Безопасная коммуникация,V12.2,HTTPS коммуникация с внешними сервисами,V12.2.2,"Убедитесь, что внешние сервисы используют публично доверенные TLS-сертификаты.",1 -V12,Безопасная коммуникация,V12.3,Общая безопасность межсервисного взаимодействия,V12.3.1,"Убедитесь, что для всех входящих и исходящих соединений приложения используется зашифрованный протокол, например TLS, включая системы мониторинга, инструменты управления, удалённый доступ и SSH, промежуточное ПО, базы данных, мейнфреймы, партнёрские системы и внешние API. Сервер не должен допускать откат к небезопасным или незашифрованным протоколам.",2 -V12,Безопасная коммуникация,V12.3,Общая безопасность межсервисного взаимодействия,V12.3.2,"Убедитесь, что TLS-клиент проверяет сертификат сервера до установления защищенного соединения с TLS-сервером.",2 -V12,Безопасная коммуникация,V12.3,Общая безопасность межсервисного взаимодействия,V12.3.3,"Убедитесь, что все внутренние HTTP-взаимодействия между компонентами приложения используют TLS или другой подходящий механизм транспортного шифрования, и не происходит откат к небезопасным или незашифрованным коммуникациям.",2 -V12,Безопасная коммуникация,V12.3,Общая безопасность межсервисного взаимодействия,V12.3.4,"Убедитесь, что TLS-соединения между внутренними сервисами используют доверенные сертификаты. Если используются внутренние или самоподписанные сертификаты, потребляющий сервис должен быть настроен на доверие только к конкретным внутренним центрам сертификации (CA) и конкретным самоподписанным сертификатам.",2 -V12,Безопасная коммуникация,V12.3,Общая безопасность межсервисного взаимодействия,V12.3.5,"Убедитесь, что сервисы, взаимодействующие внутри системы (intra-service communications), используют строгую аутентификацию для проверки каждого конечного узла. Для проверки подлинности взаимодействующих сторон должны применяться методы строгой аутентификации, такие как аутентификация TLS-клиента, с использованием инфраструктуры открытых ключей и механизмов, устойчивых к атакам повтора (replay attacks). Для микросервисных архитектур рекомендуется использование service mesh для упрощения управления сертификатами и повышения безопасности.",3 -V13,Конфигурация,V13.1,Документация конфигурации,V13.1.1,"Убедитесь, что все необходимые доступы приложения задокументированы. Сюда должны быть включены как внешние сервисы, от которых зависит приложение, так и сценарии, когда конечный пользователь может задавать адреса для внешнего подключения.",2 -V13,Конфигурация,V13.1,Документация конфигурации,V13.1.2,"Убедитесь, что для каждого сервиса, используемого приложением, в документации определено максимальное количество одновременных соединений (например, лимиты пула соединений) и описано поведение приложения при достижении этого лимита, включая любые механизмы отказоустойчивости или восстановления, чтобы предотвратить ситуации отказа в обслуживании (DoS).",3 -V13,Конфигурация,V13.1,Документация конфигурации,V13.1.3,"Убедитесь, что в документации приложения определены стратегии управления ресурсами для каждой внешней системы или сервиса, которые оно использует (например, базы данных, файловые дескрипторы, потоки, HTTP-соединения). Стратегии должны включать процедуры освобождения ресурсов, настройки таймаутов, обработку сбоев, а также, если реализована логика повторных попыток, указание лимитов, задержек и алгоритмов back-off. Для синхронных HTTP-запросов должны быть заданы короткие таймауты, а повторные запросы должны быть отключены, либо строго ограничены по числу попыток, чтобы предотвратить каскадные задержки и истощение ресурсов.",3 -V13,Конфигурация,V13.1,Документация конфигурации,V13.1.4,"Убедитесь, что в документации приложения определены секреты, критически важные для безопасности приложения, а также установлен график их ротации в соответствии с моделью угроз организации и её бизнес-требованиями.",3 -V13,Конфигурация,V13.2,Конфигурация бэкенд соединений,V13.2.1,"Убедитесь, что коммуникации между компонентами бэкенда приложения (включая API, промежуточное ПО и уровни данных), которые не поддерживают стандартный механизм пользовательских сессий, проходят с аутентификацией. Аутентификация должна использовать индивидуальные сервисные аккаунты, краткосрочные токены или аутентификацию на основе сертификатов, а не постоянные учётные данные, такие как пароли, API-ключи или общие аккаунты с привилегированным доступом.",2 -V13,Конфигурация,V13.2,Конфигурация бэкенд соединений,V13.2.2,"Убедитесь, что коммуникации между компонентами бэкенда приложения, включая локальные или системные службы, API, промежуточное ПО и уровни данных, выполняются с использованием аккаунтов, которым назначены минимально необходимые привилегии.",2 -V13,Конфигурация,V13.2,Конфигурация бэкенд соединений,V13.2.3,"Убедитесь, что если для аутентификации в сервисе используются учётные данные, то используемые потребителем учётные данные не являются стандартными (например, root/root или admin/admin).",2 -V13,Конфигурация,V13.2,Конфигурация бэкенд соединений,V13.2.4,"Убедитесь, что используется белый список (allowlist) для определения внешних ресурсов или систем, с которыми приложению разрешено взаимодействовать (например, для исходящих запросов, загрузки данных или доступа к файлам). Этот белый список может быть реализован на уровне приложения, веб-сервера, межсетевого экрана или комбинации различных уровней.",2 -V13,Конфигурация,V13.2,Конфигурация бэкенд соединений,V13.2.5,"Убедитесь, что веб- или прикладной сервер настроен с белым списком ресурсов или систем, к которым сервер может отправлять запросы или из которых может загружать данные и файлы.",2 -V13,Конфигурация,V13.2,Конфигурация бэкенд соединений,V13.2.6,"Убедитесь, что при подключении приложения к другим сервисам соблюдается задокументированная конфигурация для каждого соединения, включая максимальное количество параллельных соединений, поведение при достижении их максимума, таймауты и стратегии повторных попыток подключения.",3 -V13,Конфигурация,V13.3,Управление секретами,V13.3.1,"Убедитесь, что для безопасного создания, хранения, контроля доступа и уничтожения секретов бэкенда используется решение для управления секретами, например, хранилище ключей (key vault). Секретами могут быть пароли, ключевой материал, интеграции с базами данных и сторонними системами, ключи и seed-значения для токенов с ограниченным временем действия, другие внутренние секреты и API-ключи. Секреты не должны включаться в исходный код приложения или артефакты сборки. Для приложений уровня L3 необходимо использовать аппаратное решение, например, аппаратный модуль безопасности (HSM).",2 -V13,Конфигурация,V13.3,Управление секретами,V13.3.2,"Убедитесь, что доступ к секретным ресурсам осуществляется в соответствии с принципом минимально необходимых привилегий (least privilege).",2 -V13,Конфигурация,V13.3,Управление секретами,V13.3.3,"Убедитесь, что все криптографические операции выполняются с использованием изолированного модуля безопасности (например, хранилища ключей или аппаратного модуля безопасности), чтобы надежно управлять ключевым материалом и защищать его от утечки за пределы модуля безопасности.",3 -V13,Конфигурация,V13.3,Управление секретами,V13.3.4,"Убедитесь, что секреты настроены на срок действия и ротацию в соответствии с документацией приложения.",3 -V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.1,"Убедитесь, что приложение развернуто либо без метаданных систем контроля версий (включая папки .git или .svn), либо так, чтобы эти папки были недоступны как извне, так и для самого приложения.",1 -V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.2,"Убедитесь, что режимы отладки отключены для всех компонентов в промышленной среде, чтобы предотвратить раскрытие функций отладки и утечку информации.",2 -V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.3,"Убедитесь, что веб-серверы не показывают клиентам списки содержимого каталогов, если это явно не предусмотрено.",2 -V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.4,"Убедитесь, что метод HTTP TRACE не поддерживается в продуктовой среде, чтобы избежать потенциальной утечки информации.",2 -V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.5,"Убедитесь, что документация (например, по внутренним API) и мониторинговые эндпоинты не доступны, если это явно не предусмотрено.",2 -V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.6,"Убедитесь, что приложение не раскрывает подробную информацию о версиях компонентов бэкенда.",3 -V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.7,"Убедитесь, что веб-слой настроен на обслуживание только файлов с определёнными расширениями, чтобы предотвратить непреднамеренную утечку информации, конфигураций и исходного кода.",3 -V14,Защита информации,V14.1,Документация по защите информации,V14.1.1,"Убедитесь, что все конфиденциальные данные, создаваемые и обрабатываемые приложением, идентифицированы и классифицированы по уровням защиты. Включая закодированные данные, которые легко декодируются, например, строки Base64 или незашифрованные данные в полезной нагрузке JWT. Уровни защиты должны учитывать требования по защите данных и конфиденциальности, которым должно соответствовать приложение.",2 -V14,Защита информации,V14.1,Документация по защите информации,V14.1.2,"Убедитесь, что для каждого уровня защиты конфиденциальных данных требования к защите задокументированы. Они должны включать (но не ограничиваться) требования по шифрованию, проверке целостности, срокам хранения, способам логирования данных, контролю доступа к чувствительным данным в логах, шифрованию на уровне базы данных, применению технологий повышения конфиденциальности, а также другим требованиям по конфиденциальности.",2 -V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.1,"Убедитесь, что конфиденциальные данные передаются на сервер только в теле HTTP-запроса или в заголовках. URL и строка запроса не должны содержать конфиденциальную информацию, такую как API-ключ или сессионный токен.",1 -V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.2,"Убедитесь, что приложение предотвращает кэширование конфиденциальных данных в серверных компонентах, таких как балансировщики нагрузки и кэши приложений, либо гарантирует их надежное удаление после использования.",2 -V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.3,"Убедитесь, что заранее определённые конфиденциальные данные не отправляются ненадёжным сторонам (например, системам трекинга пользователей), чтобы предотвратить нежелательный сбор данных вне контроля приложения.",2 -V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.4,"Убедитесь, что для конфиденциальных данных реализованы меры по шифрованию, проверке целостности, срокам хранения, способам логирования, контролю доступа к данным в логах, а также применяются технологии повышения конфиденциальности в соответствии с документацией для соответствующего уровня защиты данных.",2 -V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.5,"Убедитесь, что механизмы кэширования настроены так, чтобы кэшировать только ответы с ожидаемым типом содержимого для данного ресурса и не содержать конфиденциального динамического контента. При обращении к несуществующему файлу, веб-сервер должен возвращать ответ 404 или 302, а не подменять на другой существующий файл, что позволит предотвратить атаки типа Web Cache Deception.",3 -V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.6,"Убедитесь, что приложение возвращает только минимально необходимый объем конфиденциальных данных для выполнения своей функциональности. Например, показывает только часть цифр номера кредитной карты, а не полный номер. Если требуется отображение полных данных, они должны быть замаскированы в пользовательском интерфейсе, пока пользователь специально не запросил их просмотр.",3 -V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.7,"Убедитесь, что конфиденциальная информация подлежит классификации по срокам хранения, чтобы устаревшие или ненужные данные удалялись автоматически, по расписанию или по мере необходимости.",3 -V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.8,"Убедитесь, что конфиденциальная информация удаляется из метаданных файлов, загружаемых пользователями, если пользователь явно не согласился на ее хранение.",3 -V14,Защита информации,V14.3,Защита данных на стороне клиента,V14.3.1,"Убедитесь, что аутентифицированные данные очищаются из клиентского хранилища, например, из DOM браузера, после завершения работы клиента или сессии. Заголовок HTTP-ответа Clear-Site-Data может помочь в этом, но клиентская сторона также должна уметь очищать данные, если соединение с сервером недоступно при завершении сессии.",1 -V14,Защита информации,V14.3,Защита данных на стороне клиента,V14.3.2,"Убедитесь, что приложение устанавливает HTTP-заголовки, достаточные для предотвращения кэширования (например, Cache-Control: no-store), чтобы конфиденциальные данные не сохранялись в браузерах.",2 -V14,Защита информации,V14.3,Защита данных на стороне клиента,V14.3.3,"Убедитесь, что данные, хранящиеся в браузерном хранилище (например, localStorage, sessionStorage, IndexedDB или cookie), не содержат конфиденциальной информации, за исключением сессионных токенов.",2 -V15,Безопасная разработка и архитектура,V15.1,Документация по безопасной разработке и архитектуре,V15.1.1,"Убедитесь, что в документации по приложению определены сроки устранения уязвимостей на основе оценки рисков для внешних зависимостей с уязвимостями и для обновления библиотек в целом, чтобы минимизировать риск, связанный с этими компонентами.",1 -V15,Безопасная разработка и архитектура,V15.1,Документация по безопасной разработке и архитектуре,V15.1.2,"Убедитесь, что ведется реестр всех используемых сторонних библиотек (например, Software Bill of Materials, SBOM), с обязательной проверкой, что компоненты получены из предопределенных, доверенных и регулярно поддерживаемых репозиториев.",2 -V15,Безопасная разработка и архитектура,V15.1,Документация по безопасной разработке и архитектуре,V15.1.3,"Убедитесь, что в документации приложения указан функционал, требующий значительных временных или вычислительных ресурсов. Необходимо указать, как предотвратить потерю доступности из-за чрезмерного использования этого функционала и как избежать ситуаций, когда формирование ответа занимает больше времени, чем установленный системой таймаут. Возможные меры защиты могут включать асинхронную обработку, использование очередей и ограничение количества параллельных процессов для каждого пользователя и приложения.",2 -V15,Безопасная разработка и архитектура,V15.1,Документация по безопасной разработке и архитектуре,V15.1.4,"Убедитесь, что в документации приложения указаны внешние библиотеки, которые считаются «компонентами с повышенным риском».",3 -V15,Безопасная разработка и архитектура,V15.1,Документация по безопасной разработке и архитектуре,V15.1.5,"Убедитесь, что в документации приложения выделены те части приложения, в которых используются «функционал с повышенным риском».",3 -V15,Безопасная разработка и архитектура,V15.2,Архитектура безопасности и зависимости,V15.2.1,"Убедитесь, что приложение содержит только те компоненты, которые не нарушили задокументированные сроки обновления и исправления.",1 -V15,Безопасная разработка и архитектура,V15.2,Архитектура безопасности и зависимости,V15.2.2,"Убедитесь, что в приложении реализованы меры защиты от потери доступности из-за функциональности, требующей много времени или ресурсов, на основе задокументированных решений и стратегий безопасности для этого.",2 -V15,Безопасная разработка и архитектура,V15.2,Архитектура безопасности и зависимости,V15.2.3,"Убедитесь, что производственная среда включает только те функции, которые необходимы для работы приложения, и не предоставляет лишние функции, такие как тестовый код, примеры кода и инструменты разработки.",2 -V15,Безопасная разработка и архитектура,V15.2,Архитектура безопасности и зависимости,V15.2.4,"Убедитесь, что сторонние компоненты и все их транзитивные зависимости загружаются только из ожидаемых репозиториев (внутренних или внешних) и отсутствует риск атаки через подмену зависимостей (dependency confusion attack)",3 -V15,Безопасная разработка и архитектура,V15.2,Архитектура безопасности и зависимости,V15.2.5,"Убедитесь, что приложение реализует дополнительные меры защиты для тех частей приложения, которые документированы как содержащие «функционал с повышенным риском» или использующие сторонние библиотеки, считающиеся «функционалом с повышенным риском». Это могут быть такие методы, как «песочница», инкапсуляция, контейнеризация или изоляция на сетевом уровне, чтобы задержать и предотвратить продвижение (pivoting) злоумышленников, скомпрометировавших одну часть приложения, к другим частям приложения.",3 -V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.1,"Убедитесь, что приложение возвращает только необходимое подмножество полей из объекта данных. Например, оно не должно возвращать весь объект данных, поскольку некоторые отдельные поля должны быть недоступны пользователям.",1 -V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.2,"Убедитесь, что при вызовах внешних URL-адресов бэкэнд приложения настроен так, чтобы не выполнять перенаправления, если только это не предусмотрено функционалом.",2 -V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.3,"Убедитесь, что в приложении реализованы защитные механизмы против атак типа массового присвоения (mass assignment) путем строгого ограничения разрешенных полей для каждого контроллера и действия, исключая возможность добавления или изменения значений полей, которые не должны быть доступны для данной конкретной операции.",2 -V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.4,"Убедитесь, что все прокси и промежуточное ПО корректно передают исходный IP-адрес пользователя, используя доверенные поля данных, которые не могут быть изменены конечным пользователем, а приложение и веб-сервер используют это правильное значение для ведения логирования и принятия решений по безопасности, таких как ограничение запросов. При этом следует учитывать, что даже исходный IP-адрес может быть ненадежным из-за динамических IP-адресов, VPN или корпоративных файрволов.",2 -V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.5,"Убедитесь, что приложение явно проверяет соответствие переменных ожидаемому типу данных и использует строгие операции сравнения. Это необходимо для предотвращения уязвимостей, связанных с type juggling и type confusion, вызванных тем, что код приложения делает предположения о типе переменной.",2 -V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.6,"Убедитесь, что JavaScript-код написан таким образом, чтобы предотвратить prototype pollution, например, используя Set() или Map() вместо обычных литералов объекта.",2 -V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.7,"Убедитесь, что приложение защищено от атак типа HTTP Parameter Pollution (HPP), особенно если используемый фреймворк не различает источники параметров запроса (строка запроса, тело запроса, куки или заголовки).",2 -V15,Безопасная разработка и архитектура,V15.4,Безопасная работа с параллельными процессами,V15.4.1,"Убедитесь, что к общим объектам в многопоточном коде (например, кэшам, файлам или объектам в памяти, используемым несколькими потоками) используется безопасный многопоточный доступ и механизмов синхронизации, таких как блокировки или семафоры, чтобы избежать состояний гонки и повреждения данных.",3 -V15,Безопасная разработка и архитектура,V15.4,Безопасная работа с параллельными процессами,V15.4.2,"Убедитесь, что проверки состояния ресурса, например его существования или разрешений, а также зависящие от него действия выполняются как одна атомарная операция, чтобы предотвратить условия гонки времени проверки и времени использования (TOCTOU). Например, проверка существования файла перед его открытием или проверка прав доступа пользователя перед его предоставлением.",3 -V15,Безопасная разработка и архитектура,V15.4,Безопасная работа с параллельными процессами,V15.4.3,"Убедитесь, что блокировки применяются согласованно, чтобы предотвратить взаимные блокировки потоков (deadlocks) или их бесконечные повторы, а также что логика блокировки инкапсулирована в коде, отвечающем за управление ресурсом. Это гарантирует, что блокировки не могут быть случайно или намеренно изменены внешними классами или кодом.",3 -V15,Безопасная разработка и архитектура,V15.4,Безопасная работа с параллельными процессами,V15.4.4,"Убедитесь, что политики распределения ресурсов предотвращают нехватку ресурсов у потоков, обеспечивая справедливый доступ к ресурсам, например, используя пулы потоков, позволяя потокам с более низким приоритетом выполняться в течение разумного периода времени.",3 -V16,Журналирование событий безопасности и обработка ошибок,V16.1,Документация по ведению логов,V16.1.1,"Убедитесь в существовании реестра, в котором документируется ведение журнала на каждом уровне технологического стека приложения, включая какие события регистрируются, форматы логов, где хранятся эти журналы, как они используются, как контролируется доступ к ним и как долго хранятся журналы.",2 -V16,Журналирование событий безопасности и обработка ошибок,V16.2,Общее журналирование,V16.2.1,"Убедитесь, что каждая запись журнала содержит необходимые метаданные (например, когда, где, кто, что), которые позволят провести подробное исследование временной шкалы, когда произошло событие.",2 -V16,Журналирование событий безопасности и обработка ошибок,V16.2,Общее журналирование,V16.2.2,"Убедитесь, что все источники времени компонентов системы журналирования синхронизированы, а временные метки в метаданных событий безопасности используют UTC или содержат явное указание смещения часового пояса. Рекомендуется применять UTC для обеспечения согласованности в распределённых системах и предотвращения ошибок при переходе на летнее/зимнее время.",2 -V16,Журналирование событий безопасности и обработка ошибок,V16.2,Общее журналирование,V16.2.3,"Убедитесь, что приложение записывает и передаёт логи исключительно в те файлы и сервисы, которые указаны в реестре журналирования.",2 -V16,Журналирование событий безопасности и обработка ошибок,V16.2,Общее журналирование,V16.2.4,"Убедитесь, что логи могут быть прочитаны и коррелированы используемой системой обработки журналов, предпочтительно с использованием общего стандартного формата логирования.",2 -V16,Журналирование событий безопасности и обработка ошибок,V16.2,Общее журналирование,V16.2.5,"Убедитесь, что приложение применяет соответствующие меры защиты при логировании конфиденциальных данных в зависимости от уровня их чувствительности: например, полностью запрещает запись в логи таких данных, как учетные данные или платежные реквизиты, а для других данных (например, сессионных токенов) использует хеширование или частичное/полное маскирование.",2 -V16,Журналирование событий безопасности и обработка ошибок,V16.3,Инциденты безопасности,V16.3.1,"Убедитесь, что все операции аутентификации регистрируются, включая успешные и неудачные попытки. Также следует фиксировать дополнительные метаданные, такие как тип аутентификации или использованные факторы проверки.",2 -V16,Журналирование событий безопасности и обработка ошибок,V16.3,Инциденты безопасности,V16.3.2,"Убедитесь, что ведется журнал неудачных попыток авторизации. Для уровня L3 это должно включать в себя журналирование всех решений об авторизации, включая журналирование доступа к конфиденциальным данным (без регистрации самих конфиденциальных данных).",2 -V16,Журналирование событий безопасности и обработка ошибок,V16.3,Инциденты безопасности,V16.3.3,"Убедитесь, что приложение регистрирует все события безопасности, определенные в документации, а также фиксирует попытки обхода механизмов защиты, включая проверку входных данных, бизнес-логики и системы защиты от автоматизированных атак.",2 -V16,Журналирование событий безопасности и обработка ошибок,V16.3,Инциденты безопасности,V16.3.4,"Убедитесь, что приложение регистрирует в журналах неожиданные ошибки и сбои механизмов безопасности, включая, например, ошибки TLS-соединения на стороне сервера.",2 -V16,Журналирование событий безопасности и обработка ошибок,V16.4,Защита журналов,V16.4.1,"Убедитесь, что все компоненты системы логирования корректно кодируют данные, чтобы предотвратить атаки типа внедрения в журналы (log injection).",2 -V16,Журналирование событий безопасности и обработка ошибок,V16.4,Защита журналов,V16.4.2,"Убедитесь, что логи защищены от неавторизованного доступа и не могут быть модифицированы.",2 -V16,Журналирование событий безопасности и обработка ошибок,V16.4,Защита журналов,V16.4.3,"Убедитесь, что логи безопасно передаются в логически изолированную систему для анализа, обнаружения угроз, генерации оповещений и эскалации инцидентов. Это гарантирует сохранность журналов даже в случае компрометации основного приложения.",2 -V16,Журналирование событий безопасности и обработка ошибок,V16.5,Обработка ошибок,V16.5.1,"Убедитесь, что при возникновении непредвиденной или связанной с безопасностью ошибки пользователю возвращается только общее сообщение, гарантируя отсутствие раскрытия конфиденциальных внутренних данных системы, таких как трассировки стека, запросы, секретные ключи и токены.",2 -V16,Журналирование событий безопасности и обработка ошибок,V16.5,Обработка ошибок,V16.5.2,"Убедитесь, что приложение продолжает работать в безопасном режиме при недоступности внешних ресурсов, используя такие механизмы, как автоматические выключатели (circuit breakers) или плавное снижение функциональности (graceful degradation).",2 -V16,Журналирование событий безопасности и обработка ошибок,V16.5,Обработка ошибок,V16.5.3,"Убедитесь, что приложение корректно и безопасно завершает работу при возникновении исключений, предотвращая опасные сценарии по типу «fail-open», когда, например, транзакция ошибочно выполняется, несмотря на ошибки в логике валидации.",2 -V16,Журналирование событий безопасности и обработка ошибок,V16.5,Обработка ошибок,V16.5.4,"Убедитесь, что определён обработчик ошибок «крайние меры», который будет перехватывать все необработанные ошибки. Это необходимо как для предотвращения потери информации об ошибках, которая должна быть записана в файлы журналов, так и для того, чтобы ошибка не остановила весь процесс приложения, что привело бы к потере доступности.",3 -V17,WebRTC,V17.1,TURN-сервер,V17.1.1,"Убедитесь, что сервис TURN (Traversal Using Relays around NAT) разрешает доступ только к IP-адресам, не зарезервированным для специальных целей (например, внутренние сети, широковещательная рассылка, loopback-адреса). Данное требование применяется как к IPv4, так и к IPv6 адресам.",2 -V17,WebRTC,V17.1,TURN-сервер,V17.1.2,"Убедитесь, что сервис TURN (Traversal Using Relays around NAT) защищен от исчерпания ресурсов при попытках легитимных пользователей открыть чрезмерное количество портов на сервере.",3 -V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.1,"Убедитесь, что ключ сертификата Datagram Transport Layer Security (DTLS) управляется и защищается в соответствии с документированной политикой управления криптографическими ключами.",2 -V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.2,"Убедитесь, что медиасервер настроен на использование только одобренных наборов шифров Datagram Transport Layer Security (DTLS) и защищенного профиля безопасности для расширения DTLS, применяемого при установке ключей для Secure Real-time Transport Protocol (DTLS-SRTP).",2 -V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.3,"Убедитесь, что медиасервер проверяет аутентификацию Secure Real-time Transport Protocol (SRTP) для предотвращения атак с внедрением Real-time Transport Protocol (RTP), которые могут привести к отказу в обслуживании (Denial of Service) или вставке поддельного аудио-/видеоконтента в медиапотоки.",2 -V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.4,"Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика при получении некорректных пакетов Secure Real-time Transport Protocol (SRTP).",2 -V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.5,"Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетами Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.",3 -V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.6,"Убедитесь, что медиасервер не подвержен уязвимости «Гонка ClientHello» (ClientHello Race Condition) в Datagram Transport Layer Security (DTLS), проверив наличие известных уязвимостей в публичных источниках или выполнив тестирование на воспроизведение условий гонки.",3 -V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.7,"Убедитесь, что механизмы аудио- и видеозаписи, связанные с медиасервером, способны продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетов Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.",3 -V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.8,"Убедитесь, что сертификат Datagram Transport Layer Security (DTLS) проверяется на соответствие атрибуту отпечатка (fingerprint) в Session Description Protocol (SDP), с немедленным прекращением медиапотока в случае несоответствия — это гарантирует подлинность передаваемых данных.",3 -V17,WebRTC,V17.3,Сигнализация,V17.3.1,"Убедитесь, что сигнальный сервер способен продолжать обработку легитимных входящих сообщений сигнализации даже в условиях флуд-атаки. Для этого необходимо реализовать механизм ограничения частоты запросов (rate limiting) на уровне сигнализации.",2 -V17,WebRTC,V17.3,Сигнализация,V17.3.2,"Убедитесь, что сигнальный сервер способен продолжать обработку легитимных сообщений сигнализации даже при получении некорректных сообщений, которые могут вызвать отказ в обслуживании (Denial of Service, DoS). Для этого необходимо реализовать: проверку входных данных (input validation), безопасную обработку целочисленных переполнений (integer overflows), защиту от переполнения буферов (buffer overflows) и другие надежные методы обработки ошибок.",2 - diff --git a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.docx b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.docx deleted file mode 100644 index 2d46ed8ceaa7499d06776cb46b7e7e0069ceae70..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 243966 zcmV)JK)b(CO9KQH00IaI0Kk1uTf7#JoU;J{0JaJM022TJ09!+EZggdCbYE0?aAk8{ zE_iKh#g^G>!!QsN0)1%%O+P@9#)+u4AWgQv@7QikNki;3F?liA znz{GrN-`RZH#&<};DfSe826HH9Dxy5Dl;F(pVODleLNlwrdtOgqEZuv@dD93Fc!oD zG!Kb&U}z+@UUQ^ZKWC1MFFps>?{@E)um-_k2Xl>hG>_EbDTs zVa%P&l;B9itQchn8$D#LMyq?4?^$a}KUY?_puBQmCg%KJj zfwcdieD==fC}iqAQ*xN{Sq7J%cqM(5g8C=ky1>ZoYzD|rk_6cy5C+YH*+>4k2+f2DA7f@(x_W$HnM)p>ObQS6kP96*c4 zVjJsGN!L>>fJ^Y_|8@Q_l)_B`Zm$i{zaBuoTCF5d3O5C4A%W8XTG)h50W?U(nSYi2 zUgFGr4?^ku3Rrxv7b%MCRakKm9eo2(O9KQH00IaI0Kk1uTeo+l@8+Noe~dmdUru;%oQpS5O9KQH00IaI0Kk1uTcxTp zud(|90H9J201*HH0C#V4WG`fIV|8t1ZgehqZEWnldv9Dvb}#x>_EnHT#O;>&erV$4 zdgRAwAdeMGu@xY|MU!k=98;vyq%7{Td)KaAwQ8;3`mNvk+rR(l=0f&iy|FyMwD`)I zp>u<0vijo8((L@=`>&k&$7^p?C(r!--~H{K3$sfzw{O-LS2Fea#pMfkUO97PW#!g| z^XHdmZq#qqmd`ESsxPYF%`G)<)>hO%8}FaLv(%Wq)mWOTFE6Xh-CQ_7JUBRh{$_1{ z@eEz&W;d5vnwy)SslP@8;ESx>;EOb#_acq@LTyDo_wtSTTg!a4rB}|}ZY*A)OI2^q z&oq{nm*!TgGfOuw;8o~9{EZLGzVYGB1^(Qfp}{V$ttXAYQS0W(W*fCTiRryHKl2<{ zP~Td)-7t@L=hkyv!+rIy;V;kVg*3f1dsqMW7W{Fg0spzWa(AJg-MR2#ZQ+$O*XCCi z)ZNej-QS)!pMXDL@m*NHRhy~5a^_Z}zFcp7SU>Z3#qT<6MYA|4wu@%xUS~~zZ3Vu3 z>Sr~?H<>KH`Nn7 zQ%`WHCTmqaL%Xx8-qdkTS#hY}PO+zM_*C6EoU-%0=#ne%>h0;3UKih&dR3^$%R3v# z^k8G>2G0%l_$05@R(g7h->5})TnlV?aCj^_{N>pd`VWp!oiSHxjg_~je=h#@W^G}i z-neUwLv30;<3=z-COE{)AjeY9aj%A-&nc(%9)kM?K(Z`{NnOT<68Zr z)BxVTnEmro_Ba1>duioIL)8)dOZLwn z_UV^IZ)m8O)&3vheWGtEHsE0~;G$gxlO_(IqSft)hkF_Ew^?|j9!86%W)LsB0Cw z{Pjwv?$<1y!JnJ@vTE#lj&k)IzH1JvZ>#f}`OPXksh-8A8f&gU)p-c_PCi=tPMP}8 z0bJr4AFMR^$QI7xwfgx7Cj~a0c7-j5Knb`p!l;hWL~6 z=j{OCMYiz<-UD_Xb{<6E+qu#$`ugIm*r4Z=yLU|N-llp9_~KUez>8KD?%UKOt`>O} z-o?jo|7Uvq$Fj43=?@~agMbP12GO@&FC3c;T#$<17|Kn^k_UQv7#C}|bfi_EePjN8 zh%Lf#Pz0g=dP^Np3-gP0_^Udlbl5rbk%~@-2B$_R)a=fv195b4cw}T8Uy1tE++2NT z<#qh*^ebo78d!io8}R1}{D~jcUO^+9tuN20--WLj9Kcu3oXKFhsGH$pxxzt_x=8H; zOy>NI_^WcbYT50^{P&2r{_bzp-*n7|e_8xc-BZtx{>RMEKD2{AcYgk6?fv@l`2`g) zE-u&4-O?TkjCUk9UcLZcuBLBsd1>Z@i??HIr|7+@m+q=HN9|3SIv3* z{ab2}yjfqmnd!f%;i@sg^=ltqUgpv9XY|h(m-NW+HVcc{omb9GjVa6G|4PrOwoCAj zmD>CQ{o}m;7Cq+jEi;+$=FdATO8#4K7`rphiw)E5CcLCq4ei8UEW!7)KtEOizxFkI zxZ}m8TX!4t@84L-zWe`_wHchOYLk;)yHU^He(%+*SF$&jZZFOPb`w7pUg&6wKY@W> z(??=korC63RgRE4Ll2ds@R|Mro~7I0BZ|7AeCmdJzaOZrGf(?w^o+SmgU0HfIs6^t zhhORbWvc(~WEUHCHI*OMRm5`h=F;MF_Ug(?V}AO!p5E$J+?~xs&f9-65)0S($F;fd=6?~d4^oHD5k?Skb z<;jI;0EbB z-ljpT-@T`Pz5<~soD%9^cg)$Ze}7rck`7|ETlCHn{_f6&g_`^q{PN<`!tI-j;`h!E z7MFhVtU=jg=$k@4VTP5nD7~W{W1I zEux6=6J>Zesw&vl#_3SUfX8EhFql=jiFluwP1!dDu)Zkv9tuJQ(RBNdJ zl+0Q;hvG!pp*ShC2?+2iFB!1es)`r%fu)hu1H^WZC%53E-lw;Guh?(ow8%^2RGnqUuG9;jm7%i6E%5P)#`05WpCDQ&wNiS zG+Abari2yR2Iu$*MJpz|V-lVjilV35wkW3fzM*`Y+NQijM)Fq9s_rSFj!#niDz zgfhy@H6fRVNvvSRkb|>1%^c7m01nm99|sw)JbS$#K-sTg7-}}Z>^#Kmt2b^BrKxC$ zs;xe*KJzJJRT-dOFlxZB02<{ao<-dBA+rylss3WdsdqIqtqOvtPhkSriyfRy_0wlM z(F%9T37N}bQS4|8DVtwjzFkM$?9KU=pWL2y(v}+UJFv+|HKI-R&27MIbDd>utDq21 zzC9d$XQT6=Kj7qsem)qLNV5ew{^s%K+Tn9K1mo(RVO|?B$V0gLwsHq(wscz3j8t9j z)vNDbg@w?BwDSQxOJ|jrx5oK)D&|$It9%Mjvw8;_&d>Cs(U-1dm}zcjI>)aDiuYLK zud7cFO_@)h%Ze{BTdgh!H>7o{u~h(EVWI8eM$>@p9^_HY%gt~i*44juDJLGA$O;W< z6<5ij&d$;Vs=KYjOsS!&zdhoWw8b+*Yfg_0O#$Ta)kN+Qz)Nessf|Qd{7JuT^~8@d zyuH42OW*BxFg|TF_SIE^o`wIyIoPCk0r~dgEB#J8_thGK5Bx#DXf;V2#XeZ4eR%G# zI=@iY*fJl18NY`gpgkS8SUCDNyaqGPz)awG(aNg0o13saHpwFB_rIzpcVE4@$NIzU zVA_qJ(`PylG!Fw=A6sBTR`thV9qFI!!mHfIO$?W6=?fuFe-Nxsb+HyL4E>JvGq!1U z#a^D>g8H8U#NRa(KjodV_E#fiq=b=Cas1NOqtgL$1>JLsdSXF6j@_wmhv!$2Gr5N} zAF}+GV*@X`ue_tPdIJx*R&Ff8yNtfXA@LHooIKOy5Ab!3`~&1(Gc&NHx__aL1J z-|vg-0x-oM7+gI@$mlgg?*P)p{s|5Tk+$5B<>Yll`9NGt=ubvGv+V4L>XPS12JouG zL(+@ba>+`WS^!(T4A8HM+)S^#OuG_rA$?r2cdkwv?Fj={uE{506N!OvK*KwD=DbF= z5<8#3sjWVaN2xi34tdhlx9POn<`u=Slw4H()fd>`YMW!n&#e6R^RCL&WniywSjSby3E?V<^33(X%p?|sqtL)!5+8F zh6nZ#?%@1F46tb_C-T;pH7cuLt4urE;>od0-^DB4thaS@*qK_5j)n;ek ztvBZ9#8rGh_^jI5i?g-H?0^cae(yUkc2VXQZMqMk+rGBN^3YPdtO`yEeo!A(ZANiC z+ow0A#0GGxfjRY=T@45Ht5vf1973i@>_m9722~x|&zOZy4uLTZ=oy)NA(ed>o^OpY zH|=0OfNA)IHk#gG@R?5ylU&UjoFB-ukNSV?K&Wkr4g|#Pc>deRYZH%tAKg1R=YjEs zU!)LLNB0qu7_Nn*Pv(AX?8h)HbZwr(Dh$Hlz-4vjw7gp3LT0=Jh>hq>k4(K@y}L)< z{84Bzdl}6+W0^2M0oo?MnGC!YWw605gcw2_2K3#Y0-D(bADwryf8QL@jW$@LO~xAV zN>ut_mfpIJpsKJx^T^YZm#U`;ibG&~e2g(tMearuda1PsM(>`oTupLR%~yaCseZ5z zcFS5Mu+mI@%uN_>7w|LK=$gp5p2Acx8efG16jqf==WUlLRu3fIN#fe z*m^SzHrse|YCjkVuAhl`0}VEQ6n>=lsoEcZ;4=y8u7>P7!*dWrsTSgud-S*x5x^7q z7qBD`F+B9|6!QUcKYXDLr+3dL+_??j;*OmK9HCgA4};+kNAL+k2ymO?1NgvQwduSdM$;cF`i1ijVl{EX&m=6sbL+}{9=#U69 zDor#rB_Za?*nGdGAR6L9ZG0%N0@`f9E|~(|kan4!p5TU19{{!E#=%poFeFSoUuZ>owqZg=w zg?|JF*m&FBgXwr2t=cbz8-Z6O`-7P(onnjvc_{w&_S@OC~&I;q}7s`E9n? zB;uT!SM&`23K*X_@N9gp2h282Y>6kPpavrPH8NCx!q+60l`!NY_t(-z(46y(X2^eco2~35&u?4ZESn+!|g#5 zK+qrr;-I-2IuruT7B-r@g)6uM+F&X;cX`0;HkQQB#d5Y8&sJ<2okSTOtLjTn%nB#u z<_jIWu98)5E0fT(+3vo=UZ0++JojkHsXH!Gr1+FovJT2itJao3Tt1dO_x}MqVebS- z$KUslCH6yPv18fLcm#1&p0l?MWF;DEae@;AE#m9psfH1&_I)*Q!1wehAp}gcAR#O^ zXpn!^d%`<-O>l+#B`3JY!~qqA4sWb))~}1PM6DGr$Y}CKnSmFXe)%#q$C_;5Bw=7pm8N07RUQ$AyAYg1By7+t z4zL6O=-c5fvHJkE+lo0FO?e@pC?H(wd{adr#sR4SAo~O+YE$5IWQO-J=87YYj+chM zJ$Ol$ITxfU%Thg3W(f%p5bwZ{O+aXA5l_@_)(Ou$Vik!P1Cp(|3#fIQWT2xs7^?AR zn@+UixUPxQJH+k#WB0#7o3}2#U78GXgPt(+4*Xj*$AkiW_s1g)_jh~dsD7qbmYzd^ z8JQ&kI|*5zbpGsX(;j;fXaStX5FD#$47S)G#? zu>tCVtK&7hcvPVSZb?71Vux2sAO7&HCvd!IlrQevX804 zs|J3hIZL3X0x~q}@xW0#56|lSh{IsvI*O6x1S5TdXE_mfFwB^(lrmEQB`E zxi!G>c}1AQAc+@qHY)VlHiBvJ{-L;u!r#~meiT_hxvA!nlggKQCKF>Vvd*~)W}d-j zc$ft_u$BW3WSE~3G*pPZJNL{6#r&LJ`mg=$Dq4hxXs_HSTx0jC@Wik5hqkSsVRPUR zb6_L^@>ut&WU6oO>o4J<_u!1m@tMepTBAq7SzJG27E>mPX;`rPJxkgQwogWB0Ky(} z9ZvxS!dng?p>T(ZZ(%_aE*q?G`qXSVc}!=Jjcg)8OuF6dzOTk`zZR5u;niELQ)b9R zAj$d*2GYoa+Zfxh_-PgI;|eCHXP4;wkTUbuAuRD{1OQSJez)M7Ldkb7MbZ2bQ)Q-I z%#iphuzpN{19BesO~!?1l6M{XFRt#ab(18wFSp##^4ax0C6eAP;Veav@-p4F5uw`_ zKi4{+AB!8GKur1u7kyo52JSYjrN~JsVFOckjBXrK{(*7EYjKNei3~TjnQ#(Rbd?p~ z!eTJhoh49>GXzuQ%ob-igA3>41hJSVoewd8H5FktqvXFMht>prL8!$v5Xa}>UQphs z1-oU#92E59HiQUzIUlf-&2&#<=9M{b=9a7KVA=rkNFJ2HSRkP*bwdqt;(#VJ!~8<}tzF%d}gSnN#{eC;0t=12o$qC_zzFvxo*Al*k;wk6Zjmdx+& zNH!Mae83XP;9m!{@tPcQYP?Kvi#v}lXgK45>h2t>MOz~pxWd#&BERi=g_KDZjR>hC ze-R$b+VJr9{=!M!5JsP~gfxW06AH3kxXEzE9;Z`d#V-Dv0o4QwMePcsqy#aY;%2EW zN_&WiYcqwBgaPIXc3~+3a%6(WbkbSQOkpbR!nv`Sjd}uoc0VTL-sGt{3}hOb z!~x<`80)#mcxgabp|o=w6Ng-*V&MN4g`Z^GRg8+oD+Sekp<|kvi1ir_Eg(zw>mW2} zjWgq0_H0skS~N@!z$QbqDbyr=ryuEy`rQNN0vqa zyN0Wl+9KxVGQoY^(;5M5S>^$84~WkK;8Up~?LnSwFAP0S%wcx%M!mL@UA-&?J(>X z%1ihImQ8^DkrT+2-s{Gwnp!G&ey+k}nw!j%fqgOg-*7MDS&KM;KBf-K@T`b)RHmRd zA{5kO>-Sh3q=@_4KUN#5wY2rdjtoR?Mt4b?cO-c?0)w#Iu=PUKgb2y4aWAwcdvn5iez-Tkg>W^?9-@|bv8DBTBosFJsPkHx!`Wm1bAP_ z!a}HTA9pQD`4IRRA6Z^u84$|Guy@zyxkLVnUx~{n-~o3>`V>vmHaT3#e_=*2DLjdq zM^;urDp=FD$1*Hr8+C1XV7obh#n}d5Hc|hEiTW!hbGltn^&ompI+XzB!7(>l!$py$ z(vP-COYa3ZHSpS31^^fgxDD5PJT@! zL3wx*5?wImg^vtd+WiE1!kngT5|^+zFeoxlgGZkf1vISRgCH2M*j|6pklRd z&mv!G%;6x44u#k2Gt+Y;!{bA>iLtqn>B-^A;n~57+W6?;+{AEgc5r-dbh17?ICd=O z(^o~hh?|f!f3KDJDt$ZJzC11w9!xxM5{=H&d%|Ps5cBk50>x`L2xQr^oOdotV%g+* zIdkJ4dWA$-EQl)<4X)MPaFmQF>~S-Qxxh|{G6F~${5G~*yP{kCaH+_zVIceLcEgcW zgoK3X@lFTfQ$y&CK7Jl0Bv|i>z|nYuAR70slK-!#y=nRh8utdsbInQwtTfsTz~_r3 zKJA)ny1zsQ9@<-Y(|G?w$~!#LF~zzj_7hU&@!R_IE};@6l;^^@6UcmAYJ*#t61h?J zl(xp|IdOm*KE$2e!i2-NuyYAQn4V3Yk-2Yod*|VIdlhrm9m2``5Qe=g%EfJj1L-oV z4|JUzcnQqcKpDPBWTH=LqafgOkb7m$A`e=afbg6Y)lH7>Mqyfm>ec=Pi=h#r!;}bR z>BY$r2Xvw@_H-~e)RT9BfaJj;NgOb~0tn%Yf9rkUxjI}Z0HzV57O6QYAs8SNr;Y{65{t!t(9tgiCWV92J(uxEL(>w zYIAwkFyDVa6APs6yS@T~41k3aqr|$foG=!6(?sa~{F%&57>V^Qo+PUa z-7-Z`YEhrHe4<0j;kr44HD;C>J4+r8mRG2SG*BVCWl0O-x88VVexRM9zHw5P7{Z_s zRndzeUQ`eQ`C%%hOjIfEkH?QKECHg~lHzV1V9kO2I8*&v5*q zTEJG}2R_OH0i2)MAx0NVP=eizSjV(iD*KS@n%iax_Q;4rj>-NggTFsp>UXiU%{C;f z!s|j8fmeYFmayJ-5Dc>(3+*s5<$97_3bwtNj>M3)-&w8t zEVjfB4NnIBdv}b8wxOr;kmMVvfGtNp^|nQ`+>DmV>+TsHhTNGSy;;^N8)S$x;(}~0 z4Pzpt24bXXYlj5WSEQXBH;&sYMRQfon!w8y75bp|i&!vN$WR6X zU|}~sB|PsI4Vx7$)|l}F0?6Pz0@Ig-SePb?n=Y`(2OLc#ol%HNC~@v-y+xC5G1stQ z^|Fv-kZ>gWNf+q-;{6muge->E1bul};#OkcJE0s|zzilo*)_JPMdTMtgafvSb5ANuLFEpbG~W)jN$4{5 z!W}{iZLPRq2g;d%tdm@wc-XNeH5HU*IVE!;j!YVEPYM*N(HRsns`gYg^$ zRzB1(5;@51xraafp%OW9nq%Pqd5)aJN@^xrdDzL{F{yI(Hh=4$C_Oa%h?Jz32Le>` z2apR|3$ql0vmIqZB&@lg+Ml@~-QaDI>xFyGWDUUx?||NriUa-&PxRU3AQB^<#Q&H zm-GJNz~lg;I}w)cBFe#z2%fk(9p~vt+604!zhlEMR{@#TI-Oupduz}Xw#Yr5c&c1> z=x#PExE5e-MmgHN8y=%+gcL*0Vw0`Uo-a$$^4R-_tiMaxlnpW3Mp~C|e|e~qT^`n# zyFAh#i45T}xw;@p%aPt+-6qGntKf0?o4G`i3d>FR9fwp$m#4h4K4pf2sWbN*0+_o0 z81YiFOm~7x#=c;9vJ%ATv6s|>M2)JIU=Ycm*hecF`Rf~2wycR1s>0Bct=F5}%FaaV zoe`x06*B!7U`8F5nFulUeMkCG%YInE7ERD9dE8h**z_?dfxhJ)|5;egh*b+#P!DQ{ zva6V(H5ARNd%>g&aV)IEZ|ykzt&ti>-~5QKJR9FW*_DG;ZC_Z93u|9mJ1_EM_J!nr z(j{i?LaEJys~mAinuf#(PT0<)NO!k{;(DXUSr8U0sz8_}-SY5^B3>=`$gi;9aL;w@ zx#sl}J@jiT(@q;ouS>BwH+8yi6Umre-;aSYMcDd9vzXtEnt$e{FM$OiLAxbOjFiDvBD?!hc-*5$=)?`tH z4IL>P%o{gVb?EoPgH?_vF_qPA(xN=D0zl|}U=dDwB}gQw^9!t(KsQsrlurqqcDc=D zV`ToKKb5fe{FoeP>@(LzV%T663Jn>?-Z4)}x-kGXk|~C`P#X$nhh`qmVMMl&_0W5dIvH}K8!or6VI;t?MV5w|@}_!<5c7cZoKo_(aP`HJC=HGvl}a61 zD$i^^H%IFtHHiSsLAMUccI_F`9wrHGRfr>Ook+PSeAP(QYz`u)4~1KfV{-o7D5zCL ze2JEG*8X5L!2^~;eoA4uboF>$P?|W9YjOCJu_)gG+T*QPBk)>T$Dz@Y2)qWTUUleL z++eSRTi;w<*|H`Uk;{@r(A?sK*hZzrQNkMKUC(;yR8(;bRyt|14~Zp_dtiDuBVMex zFq=sHQ3o{?cR_^X8)hK4L&t}>EJl@%60+!1sYN_I_}B5NAZfP$LUSbhN;}&hmBOu9 zmZ`)yyTp2C@s=~9&fIkpPkA}Pe-X&Hwb1Wqce`W%+ebzNiU$ifXa9^^0VRE zX8%9>Obp=I;%{}4@BXNq@-OIx!)o0ib(-dPdjnE0*4vkOs^(k)2#7%H%(Dat(?1tS zXUn&xc55Un*mdI8@2cgvkE2QVakvle<8a^H$1lQQk^8jyc~Y;uo(@ZH62-)nSeE6H z&y8_2jHLwIu(|Nr%fkaldT?W99-NGA6LDwgyT+T!C#%B1P17Am0bZLZ8;;tZ#C?bs zHM>^)@(^VE^b{N=O(!~mh)l;x^$^9Ws?SHOY?_(Mkk%328hVZ7uNBPVlvk4Z8(S-m z--|GPof7PxJx1#SxJX2m{J5v^Q2U}UqT|r6aR_&WOY1<0;&~B8hKD$*y|{7r=TrppUtQxdl=_z|DjsqnGX=c?6I!$R}J41^xf$NXl4B=yT5=CJ6)h zgJETUZIV+Gn>2t?8}P_OMaHX+1dJBeQ~*7onNfZ)^Dxc z7?7qUHygeXrBv`VMtO&gX)7tc(ODIbxJ9n5t*`6BM3jlSk4iCjtWAT3Qk7mu)%9ko z)@#ucr^jMRzP3XNcx8@mku#JZB3B-!rri>sBGv`+kdR)(2W`{Q_|yQu9U)PYVIhl2 z&E<}aN~zXP0`5-=wtOjMMmm;@ER``jp?rp{ZH)8c1X~EVT+z@9NbC6iK?wi*Dx^Nc_M$2mSZrka9Pqk0QYp9TnsiHrYA2ikRit zakTUN`ac5V^>X}IB%D}rmLRzuNCj1bB3-V^aJ4j$wsapsgN~=VVX#S0(80;`ur4zM zOq}T3$55lGzX!BO455fZN3I6KxCd0V01XT5kny=U5bS2ie6QeYL#Vkk6#?EpBzU}n zb;bLByf{)3fs%eC(<=7>_TLWpP&hO|#zgT+%$#(4LiytV;#Xy=?_(qW;Z?OOkzZ<+ z^BPsZ2I*M%;a^*SrOOuW-80%ek$c&kxM=o7dGA&0-n~^{`Rzu&l#suin&8=r3F}Z< zy9zcJU&5w23Zz*d85>McGJRm(@kk4!C^9r*1Y1B%1hc)sSKwyW%?dRJjW-ArCyFsA z@^1a%o0#;R(|pxywhN}r%F|d00vaePl0-mAYls+T^?Cx6p$(%FK>_7E`}Zw?C|^!n zC%>shuGX4dBu9uyME#@iw2PwucCOwXshCE4biB2g>;>KH!>YYDa87(-h9LPsi_2;` zyn5x5)DlzU);uUcEA3+?3(ev2e%0YdV6IXh3q_<9lHY#y_R0-@$M4mr-??^?v>wXd ztt)yYh-A@XEA;L_{+L{9QEb)qSyQHzJv!xESaPO7=e3HYd7}NOJ0G95mAB3O+x9KW z`BL0BH#*XmkOF7f16&`@pvteC_3+t0-}_AupMIFbQ zx{`r(RtsyOv6Vzq2v|T+P>8Oytl8BJ>KZbFP_3ZPj;ZS8*>4#NDPXNnO)hcY`<%F# zBw$)6wS~(0s{%*Knd@RN3Y?5B!y#^A88LnM5PV=|z0vBgq2W{pp^H-4#oIUWFY^l@ zF7OKFszCM2OSAmLp}|4pc$sgxEBoToP4!-SI_-XAXODy_?d)Y|Vf|!{`a-?7Tpz$$ zcue?N6PaqQSnLU=^EVNb<-A!Ao_(1w7LW6Ysen&=ExZpff7xOE$(SBDPzApdyhpOV z_aybDgyAnrx+D?f&_oJCG2sxR04KFAnf=jJsw`5=OlGo!f-R%x2G5P)J{ePg9UM3f zOUmq>*pkx5$XilTAXJ=qDDxpw8~6sOIDH+WS@9b#$3c&{Noot8%kD27^p7x7|3bcF zPPH7Hw4I{hkmxBWi1KDL`wo+ zUZYwhlwEq180aYi__xB7_(+bSzd{4Q)eH?;W5X8SWp$QRjJJF1+hp^8fl z+d~g-8(q2FNpPU@02Vme<1#HF^P)@ZC_~f~)Bpi94L z%-3sj{HCEG`=%)s(kjq36G zOBxkN)^k?EravLCVCdXmo%^ffvJhteY?0TNnDb-HYW=#GLH;uAug84QZR3Cumks?V zViP)!Nl)YZUoUM-Uu=sw82fKqoG@Y?911Lh*>TN|$#nK$Ykm}KLvjji&2XP>jY}^& z8TRI}iJ#VhlW0T~xf8&@f*}G~l4G+fJvw?sA~_io_|jni#TxAXL@q9O1RcQxQv>2~ z)lxB}bYlYIT*MWuoRCS@CU~rev3Q`#J}Ha)nK-FF5}?mP7#Nq;DM2F_mS#Ta6^{G^ zRBcd;FLl??ODbwnvVp3_;78PpzKEzDBA^dXsFCE~!Ru#@C^bi<4+5nPf)QZl8U5;# z2sp?Z4ownn5z0jtwSPuSOapNb0o}vVSSDz2RVs2a=|W0dx~9`Ea@Zi$G(bGIc@8R< z+U-3l^ZfYEuTzjsv}>()wnU0vWTZOW`NUn%dK$&QN&3RpFI(*{o9J;Xc#Mcjq+b`H zkSHbJ!ZKcdTU_QSKO4_YVl!+DO`R0fXjbFI2^z^Y?!I7vhxAbDs!* zjeA$3V#cn^oXlA`>YI~^y?qD=O10N>swaQea#mz&4Y2;PYRQrRGMf1B9!;=1py`uz zGNv@w~0msUOfgUu3 zCdcERB~ok=xe!~F)c7BLd^$-gnx#Mm;cMM+uHW-fHon@oh31$EYT+g?sidtg}* zfMumlK2tt_UzRhqH{MNk7(!N^6lvqiHJQ8Cq|l33->qanz54dg;3Wv5$B@e<;-xlk z2OBXV1A=8Y_HCtK$I3(t4n_&R()1z}T?U)ox4RlE>uEJMENjgSs|ZYWHAbQ0M(O?1lkmsYd&Z$5o4D>t9R2_Gh-0ot;~1d@xXP^SdpNXvJxpC}VLe#pcV2$ZDTu z-(evh-SXTtdTa+Rw4Q@l%3_LAfHjZwq%cKCDQ=@KFnY;tjB*>lAGPtn2d%Lin->ur zinW9*C+J(14Xwd3L^O`3koar~-R8oy|LnQXo9y5-%=T)eiwb!ona>rW9qc_CCn%?6 z5hDknuR1S&Ri-F9=GI|jeHe)56?rvg)sL^=BvJDfUGYLg_xj}2)NH*rJ~UIC zo}QVQovPPIhHHbhiNU$r$mr0_+~`bgYIbVkSUf@2uYp4zqZ!IF#(2)rZPWs1LJLh<+d;Ank%W^8PFczk$xs9qnO9G;k~O$<$q&P~n^&drRC4o*#v zj~$N^FxOy|7YrVKumo!vOXwV=OzWPUSnrFBl8^}Xnvy-ifS)j_vTCEQC&S`aEdL+r z6_1W!+}}Hdz#ZD=aDT24nQXF~2D)F|3yoz@GKjXf0qDeK0Q;#-s+4d67YoZn1kPCG zXpbee;s3M1-U|N9>VQ}l$|+-CGkz&;*u<&wSw95yU!18fBXQ9%a^?!u!fBwLTKr-4 zYETi6^bD?p$2wDZ{)k^{IssvWN(Uy$sY9HH1IRM!j_p2dC#)6g-;9mZAvVU<)MCeh zeCX$LEL@Bp&nl*JNiYfr_`(XHE41k%_2W#si7Wz&$TvIpdOlS_9{c0_CmS z6gqBrYX^y~>6L@+a(QZ-6b_{(leO}F-GT#CbWDgnQEHEOHS`rS2n`hX<;ZIinz_u z=tpo1-5LjwSEJk{HH=nFQ zG}Yv`G(TulLc;)_sK2I2(vy2HZ^G8Ot;~wH>Y|D3mOl1`j+~CXdc$T|Y>MPQ3T~qw zmqDj${dIWuJ*LD!+J~@otCsx$sw><=knM;N}$5+rC?yB5&<2z z=)nQwdWs2uLm$!W@Vh_q6h}Sr`26PI?V;W&ahL7U(az-Mz|!D(@QHQl9+2a7p#2H3 zckCGD6rO-7gGj_NltjYsX(gaHm2u-q!!YBalUTZqzKT&maL!jZv_g4W*lC+VMf#ItCC8P}s?p zw?z2E>e8Qm`@L7MUdgU4-O7drA;;W_N#{Gehc`q-x=frJ+{KxjqpwR8$#CGru}2XH zx?zy|wq2+xqTXY68VmI8r`$4&%A#)-gTlKt&!r6=M2CaxBV!X&!}YO|(fZ8H%-s0Y z-1Ok^)Wqn_WNormAFPiJkIqg^503p%At25Hh5DFp1lmJnDL;qB>Z>uAW=-$2J!89$ zKxdD44ouYatY{L;PxfxsjscCMMGcdqrtshS+i1*i>#+1K2{oa2D42u^{R~;3=RZg* z`WU1$=8(GDI&=M?z;+O8{xmYcS= zDWJt^DfVP5&;y+JeNLH06$ZLC3ce`6_*I#7=eU&aj3hmQ7J?E~QhB=<|E(vo$m4Jb z1VWo`U}6Y;ON0NG_YQ*fPhgom!$Xk!gVUKn2MuU@BHs>m+c3qef4E&pVOLsMP1uki z;A$?3(K(>fu!L+336X`R|4J02MXWju>D%H6WRSUWu8{Ha~q288_xi?OD{N7#DjmC$iqcu1?H8L?XH8wLiQ6Czu537F; zj*RMT@yO8J%<$Co(A?O>{V2mUC z%guxF3pT(fjFx)zOXTFP8LkTC6R!@Sme|H`M`rl&GX{%$T2`ctY<^Fpr481;h%?4{^AJej7TOwGF zk-aIxYx86jO=~9)xP!%ZVfySA)T#vxEWb{#a3>)`>;$HW4sh0%v(0999Vu$0=UP^y zV2J4tP>$Ao_aH+d;D`kvU$4YA9{XwLB@EfhQ}<2^)Y*OK@y3E+8%#W*GYZlSh@PjK zPISV`0@rC}UU;~g)=ZAuTPolYB`oeETq9kdLp~qcvB{J1ZiW_Mhi-<6m418-XwlKo z8A|!4>zi}yaV`y(Mpj4c^iI&X7Q?R?FM|qtbjbTK^WgftWCaFsSgCw)BGFsIg0@oN z;NeR5iBAog^s|ljwk%=5sCRTvPaYp}93fH%scOL7otxvq#lPh{W;XaXckJ6r`#o5p zZL$s`Vu1;PE;9z9_LinE9dCvf zo4NElHdUK&qG_gmn0kWDqHgcAfzH4lMli&Mb1_Li{)r>CjWCRl9!jt;>~JHpYH(CJ)d^7!Y?SG6B>TXy4E4Pv z(2)b1DAr|T-PF2@1l%go0V%DnU*hsgZKb|YUtZSjBL_sWM+$-30Lvx;GqOiwwRNAa z8!xK^8XuKrN3OAIYK=&3&kE-vcG+Y>f;c>ss1yUBgv1)}#0msOe<^z=W~Mq5wgP>q<9F}44?xtevD_vM zC@Fl>*?SokxdxFI`fjR4yl)ddLml+?)A!)lL9n>fySvQmeb^C#5*FUhu`W7Fip-dk zvRlG`GA46N+DEM4mwW*=Q-3Nk8AiCnb?)29_yHUo0>WoDQgl*pcxgi^a|Q#GMhU!< z@AxLZt$Q}Z?0PM9n&~&5>?=VD3csf@E&;*(#@}#aMH_` zxqyS`6&V2#?KLUr}T@@J{@ch;vNiN{O5h zgue?*+;--JT0FdM3EQ=#s+IAU@;; zxmKL%c9)|9TC;0cv#fGzTr$JNQ&v-p_gEaw-*mBS`sQYS#ifd|3fAryT2L|-%|;7p z5HEp>HQqYxi|jn}ru5)Y-Kp5e?UJ0pBiG;A5={p@zqQHPF+P~r>ymp0hTB^3;G%p7 zPQWuOLM?bC^faRzejvgmO}dG3YIT=y$5n7@mbGiF_*-?KXw({Kt?(hP7t<4@L~#z( z5AF3m_TX4TK0EtNm?tGlJOh(l=%(oi5$>LKP=o5sCX%ycVqm*$;m3`smEO>FV=cas zjhqV$!bu~*B?7dgrQAtK9FzD$I$EaV1z&@Ig=+xU9Ozg;37o(u4&;3>qyccpQvtvU zFXR2g<_PI7VsQl^k|kK@!G5KTSQB8QUGmyKMasSS*g+fQmaOz9Zh zX(&`pHH_Vq_YkixkVK|XB+4+dDrC{rO+0?KWdkYI*EmYE22sDm3rN)8Ks3|`XY8ZKdq3My?sj11C;lc6giILH%+SJ(8WYRmO}$+UfYA#ZbP65pH*3-z-ThBKQtUd5~h01y@f<4~=bJ@H?+i zt|y(7v#-5+^%|7jsQ(T`YO>tAIPok9Ro$AuRbQB2tjoHqykZi^!sY10Sp4b~DWm%cJZd?j{rCu4mdL+*kjY zdp|*lyd%6*1mHGt1L*@gso;XIm1*TZQq8^;mL#-58KmXB6`N?u;|UnXz^p^$ysdPh zc^}R{Rwc0F_r@)9C!I?X!PB}2;4VeY&RRs8o+!g;a$^sw@3ysH%<%UsX46SFskaL{ za2?j%jdbFG7lI*svY8RS#T4G5_X>Px2UnpuBRN|~C7NzAOS&(`0Zl0T`;1!K5NpTE z06S3>O+T~KbCa?VwTY|lQcj1xL~4S$w?h{vI9LIfG0CJ?CVb@v`Rs7L-o6)*^<(}1 zpAHufL7AZmRBS4SO8T}6S9LA1#BjEe?|L9X`-J<4`PJ3V7gTz|B5HhkB)>LRi?40g4Eo5qrT9t;6h&B= zq6_*gmkvlX8C^tFP}CcJWErfQ?C5GBhT)l+&6K@#g|y&IX?kocjIb$mCK zZo+^PO$*EO^vt!eL_5h_ad} zih8V3+VeuYeG9g}0rz7cx3O(KFONBf3^9E;l%2giG!Qhe8$CB@q)*$Zx(xWXv+A5f zi1MK_k)D{U-eUUfEQK81L&2HD#R$OQfeQM7D4!k3wD>#2YF@Q7t4rggh=WS!1EHN| z4);*&5UrLbfjh-FY~?B*2iasvTS+!DSH`TFbg`7GGE{v>R;(!pH1;zexFL& zCEtAz9r9#GHAKjx4eG!02m-FX;g~GtKIue&vjofK8G1;JJ@Dt^h$@l9iO}z;*V%hV z&%1~sQ93JG3FFocQGJ(j$(nX@ykaL#Y~6F@FoXPv1}A+5Q8?={PqvLHfr(i{q@WzH z+H%56I&V5_Oc+{4pSC}z@i)&=9mnsA8&;=IjiVFNmCR%DPzelH#L43Nv`lEs7|P|M z%&QLhHeu6mGpa0X#sF$r;kR3Ek|p*c$#Szw4)^SY<$@O%dpUz@_ad$R5Q}cCD0Vs( zNTpnR#CAfmbVdMyL!~})J(j;C&hQz1Mz*w~m0k?U+CL(vU~zyl$F*zs%NM5+zw(6< z#IMrj(c@+1(USsP7nzL~J8)X?hG4iY3!Km|K)vx0U3Y`%aJi_P4aymOpe9@uQHHq%162-F z=TmVi6a1n}LX^KuIs|HY8t;3raHLtYp~0#6l${-!{ObY7sgdDV_x19|?WRb&`RlDp+8Z4B_MdD_EYK-XTz_g`j2G zkTnX)3q#2IMQ|!hEndSB*;df-)>}q@&c?d<3_zc3mR0DuRhYD{_|1EHF~L=dEnVT? zpg0l%V(BJ|`Z85aMDhcWcob00+Tg25*03R1`+%dw7yDrozOwu=5D;_OW3nw!llG5i zQ4@kwcJ&ASz|poI76B0n-lLx!Ev$05^*Cc^6-7S;BvWpOmVSISlB&3KXxZ@FXv6Yx z)XSD7?=dfVRUEuIQfHQ9wGs6@kqW$W^xs&K{4zTMS*z=p+p+x)HgLbhr-F-C-1ZAj zsD!aki#lPT^trw}k=2PahgK$x7RU{ET~)@+2+|kf&%Re&20^<}+6g_g4O{*cbd40n zH{@vGmD1=t3MIxgDf*LMh^Iqfyb^^^mmP`nRslwG7o`e@2%CURHpy!QoBC-%CC82q zh~T5ddQ9VNfW360*NgcbbF zNYi%7bhP3Mer$@n4aq1^0J`SnoGH$YIKo|@UuB9q6C<*t$lS!_#L%qS%MKN6phsqqR4$_3>$)qHQI+Jq956kY+;qd>9f$jufg9O&;r= z3lJ~QxnC&C0{E1AS|2Cs&l z8UYqQ#nZ3ja9E2a6nNv*nv@v!Obf;0`JFuzi;G_hB1z1DMW@;=%I}Lg2AU)v84+5q z%%F?Raw3f$%aj+k7h~`WoR`}nqB~P%+n{hK=xutw05y`jF5$deOftUaN{azmFP+^O zL)Tzzwc@)tQvS?%xOUFLVjSetFeSyUbP5hmAe{u9v)L; z>d2@f2^S*$8(h?ks?S^~!@Q`jB+m?RF4`zxUu<`TSg(IJC@%Byp z%lyKJ3;d9bj;UW>n&lr34GtQTn)#MHITx31s>kldPQ3lf3 z;vvC88Vo0r1&LCmI=YzVDzk>=7A;WLsIxHx?+0E~MYxZtyLwU5cqkq4nj$twhP)(~JS&+DKi4fbPJh!p#7c zlVz+NXtub=hhd1C6ROw}*-^|;HVwq<@K|8^`p{M-LI^iHBveQZ7Fo6eKIBqaF7+ zV28nUHe(9prX3fkomfxxkkrNRS;JJx(7TLkp9euz?&yb<^@eoMYox!gVu}^B5{1>S zW#)}ZWWp-#Ff|OUK(Fr5_mEDEV3r=INLvm7xG)Rsb|;8>Qn6ZwN8)VB-N$X?VS`0g z&^yAZwZKYv?ze^&@S*D;i4ppxu+%&v0copHw$SCuumiI!X?Rr9+)Yma&D{$=J;z@7 zCN6$SEPPnj=7fPG57*M!tM!Gs>deyON^O3zKAT-z`k=nJJb?RN#8qCQ8-pUd5dlS( z0Tu#^q8=bQ5@*-a8$u2ZotEiiVLya%+eCjA<$ii!{{rnv!S%|L)}|M5ZURv&TfzYu zcKm%H{Rt|D5tSYKM=WdPhG|=wnsma!&)iDU!jC}#;A*pFWD33v>f=Zn}xQ_88>#Kwl$4&pv87!)wM#G1kv)S4nT!!qGuT+)GVR#PkJ)yB+?`IY+2iuyUNqHj!?+8cnq$*!m)tkY{{{+1&RZu79wLPUhj zOfX%M={k+-K^S%Dr?-ClBavXD+3fX!m1P@{Xx{w9MGHY7s6wDcVil3cP zb|BX6Ho5&g$voU#sSE8T4|HpisA?%P~34?lfs zu`U8WQO+UOFN63-n;NAQC0p(Yg)(nHT+J`^`q$bESWSY5XES?uNS7Y|GPb#m3K^B@ zxHxw?3NA44@Ami=Hr>{-O|@u#MM-OSzlbq zURT~wy-{14S3f^{@txNPJUc)Xc#yBfPOG2bl2^0yxyb?|{D&=ESLLzd4P=WuS(!5u z*asy`qAw-w-K>U-@4c>v{j*D2amk~~mo-bOI5rO?&D>f}U~6Gj&`yK+_@6#d%SW6ezq34udSP+H`rRWg(9z;~Xi=9fS!h9&I)$`6ax zgfvnbyr2eS(P;+l0pqawt~1sWKTWb%GOjYPWxr|553rr(enX(Ar=2`Kkn_>mG*_jD zDSU!3a)?2^%;#;mTpxOcPJfS{{m8OD;uE58=k>v{skzb7>4}-K+F)&BXrw+hTN@sn z8y+8k8)^jwvH-Uxu;(apK2K~A4mbNgK69n(M^j*o4apb?#VS0a&F2WU9&-{ zT$}IDvBDptPTl1A;(Nufva>U_mHPWjjl0#Q#f7`tRa+iF_yintvBS2Kg-lV1n_`!s z@KN6)kewis7}xV3AT`${(UQ?oNOAk9;%2OJk|D5MfJYf)i!K|GTOhbGS?qD)$-t?N zRDE@8Yy2X6`>V;ada6m;zKUXd2$!gsl?_5Qa*nH!S7jr?V=A?JoE}x2fG7H%z^M9H zL*W-DwLQ4jX}rkIjk3!_+1c;@So{Xg)f`o07(V)LPi>#e!|;LMc~KdEK%Z8ZN8lrm z;p*G4oRLYw*N|H2O;DrR=d-OKjz6nDVgIa{phiU^i*Ea_oE243)D;U`eS(bzLqV~` z)tQa#Nuf4Nk=s5`l70X+G5zrEe4m51KM^brLh6_+=$dp#BGQMJ@o%6s2bn{5BI-P$ zvf_PRHPe?yJn?c7=nN2VkW~shZuxs9*31GJ0>}t9H;|lPQ`~RGi{!?yxVIS#Zo{%x zqWE3ApP#^|sF4?M2yMYF%~iYb4qan zz54dg^wz!p)@9quhqhOT`!HZ)6TnTZC$SZ{^1yq7UVI0Nm4qB4Ql((Q*wS_9jDchp zDiCQ<$RAk@iw5fesf%Dbkp$_yvF`DdNm&HD>S7vItbK=l)T~;bUtjPPd2hin?Ay8W ztymOI4D}&4HWJL}d+6;V`pOkYie1M8GSeqS-ASEH|8r<~aDd%4(zk1x)R56vitI^=w*kVnI=WX`<( z9>%0L32iAQIc;x2m10kco1l`xCjFDnXUK1|$)DEuQnyQpwIXYZt(0uQ;-L@5Y6c>t zEG`??R)D2>f*1sk71CZW-#+m zh?gGXr~^@0|I{&<_RMXrwUx0+E2t=smdGlVD+9tUcym&$Ftv{Q5vzPl9$V8{w1L48 zaV1vfcZ7gOwBwnf;ufJ`EKVvWTw9_}zkmu5pk{(nH?a-5d*&vkZA_J;mIFZ?n~aLJ z_Oa$#@wRM1K^p5>1uDV%dv>9bHzyhwNG=Jn+PmrFR0zQU>hOU}#rC^sL#z2OtdC(^ z93KE5SmbuGAZXVcka@h4Qd5dpNFyN-M<8r9LbxNp+F%@O&alAYYhg5nns5gUHl}(9 zVe2Nu5Iv&+lk}M!Y&+5{xzjg=z} z4yC~};<2Dw-B?rpgNaCq<#Z9!<3) z^gXKLkZxAxgB^=I^$l+}gII~%JM-E%hbrB9&lSUvh$Fs07w_>zkWI~ue8iT0#1MmH z#02&_Y;C*!5 zaYLk^p#$@bQsgpe{xL`CoRo~6t1yBG$e7S~KLQ4zhV2L@?HPVVQ|*CnEpxiYe$ub8 z7r!dwfesCd%-M%S)qslKq+0uEv$5_q`+AYCepiJCU;D!_42$S6x(8=P;}vRV1**DL zKa4$=9N@p(8wPQ6|I&M$%5h7!jwt!^UD-|<&4x}OKe?Zmm|!Z1ik>Ncd8nu`3$91{ zh8?eLzyzBV0@!2hY(hBo^A0uc8*qvrAgp16LHrqg{n5g7i?ZVXh3T!%jl{f$fgoDr zU!9c4N!&>g9YjJBl}t$Kw}a|zZZ;*sZ8uQ3D1$)CEbuqTSnVR0BhmldbZaqvmE3`l zFmQh)(7v**#t0se-b;GHxuF)uzdACACigHN5+Po!D(fI3$OP}|)hm}O&WkjtIEJ?X zLv`-i*vYL9H^Ak*A~=L+wY1J>#V{_9>4MBhAbb6wY5C@8Pmr{B5%MzirAJ8(NW}ayYI5w zAL!`I!YSy&=}Q)LS<)?fzL7#`!@?q%YzK|)d3}TcYZ5e2ocxX7t!*beJ6oTtFD}>r zeD90-MfJyQ{npBj0T1YFTThNflv<<_*fy_HT71*o#c0w%^@D(AQC=Tb}ato^X=ZmdRK%AvIpt;QVi5 zl`0c#qRi8D4kRLN4UUv)ZszE{XuCo^yCv`{8Xpw96;?Nr`8LBPvv|MlWF->w&2XNY z&Uw31Q%2D&Q^> z8xJcDZ1lb_LVN3zIAR)hUuJwid%$n8mG}J((>)J-qqt{5%qAvNwNxa*(`E{;!*DwL z$+fpG54ckpuGBToQTQ50Q1}Q>zr#mF#9PuIj$7iD=>_@^QOu_o9J_O^Hod^rUFvu5 zsh_Xhy`?Nn?e@x&w#s*`9)kM)Wo5n959hSCdS^-f4!BPXHToA6nZhqGE-l=?xkx|J zzjuDHxb%}B*A{2Zzup!9LJ5Y!;XyWna_nz5=4bU^-&g-tSH$rRtJ8so*xS#~JJ(#n zn>5VL^a)aL@Q_v-x9jFx{Gl2A^Gf5W(@1JV+_~`c8UFc9eQ~AU=)vCqRpd3FwoEth>Z~hN(cy1Fc zzbfs&h&%$YVjH;yXu%{%Vf58ouKjg^3^-H{DBPeZ4NFeQE-Od>EDDQ+&7W;nCMafT z4fv@g0F)2toCl_BD{gwD=d61*0=W%&+A80ZcW)mtaXv+6a?9d+_E5s!xNfUnatuYL zowJpAMGViiANwhKMNvF09ZpuV@F0|Jf@RR}B>XA3Y`NKb>a1B7!N*e}KcuA@KIO)x zWc(-0xP$;+Y=tGzAsV3U8qyAyH>luy}hTiyk#fy66EVW40|FJ~EmBYbi@Ol^QQiMtrPCt6S}2Hd!Vf zWWj@BzQsFN0QLe;{lM*{5hnVWn0sX~8@N5Cw}fZJtieCTiooc!9AN~GNl0O$f9@_&6@{Wk6?AQ_SJUHYGx+t#UI z&wfJJhi<_95|@OIy&UNih0`1)5E0*kr_!Dp(LFX%B+~u@RhVqkAL_|LzrJ|&s(0og zwXwi*$vu&MxOOE(fD8jAENyTz72NUfDHC5p9ovqlZe>Ifs63Dk@6`J{X+dVmK06h5 z;*b>gu4+yt`1>fHUPOt00a_ZxoR1*JnNnddWb7jI z$L@J-z_yqs@`dTza(#UCc4L8U$G_aJH}3M6Zq;-<0G}-;uX+fEB-gzH(sSSOI=uyb zTVqbM-~C8^De`o&sbT6G=|*QiuYFiso@vbATDidEo~^CaE)2Xh1~1kajQm9#gG6-w zQ?u+qVX zH;6{PTHfu$bLHwkC{Oq&`j4M2!QU_5y>+AB2sb#Bv3liLzx~czmF#tt&V8d%yIH@p z)c9c8VZ=QQs!c7sm7630!&MD1*l561GIi_NLXg@ZI9g4#2NK;Ts|hnB0`c5X zp9(G+rN{cXKvk}LFSq!M-Qr`XW{XGjr_Pck1Ui%z+TgGhh!r}=@jF2`0OLW8voP_3 z?G{WYl!BDOj5H{mPcLGtg4w{)(AJDy)%WCy5|TLdt-x5*d2I6>!d`Bs=if}@ ze}S9n@@ubN2@ZgY@hweU=4mIe$YiYVE1rX8Z7msRGjcl#e)LIOz^9u{Gkk91FK_{~ zZ$ijOn!|GaN^Rvv=<7r@oML9)D9#H5?*SaRjJFUJ?T7-ijN?V^4Hd4eJH=(*RbMXr z7rXE$Pu0Q)e;A6OA@iGEu3f8NXH7hVHAD?;6z4jKNQ+v`{XVK0X5ans&-eaq`9^(V z;m`NJs4vgdZq-Q*IsIJ^uVVp^RdV~=+W&D}Gwv9Ww)yz9!9IPtBVO!|m^xKE!aoXp zDmLkR#M{t|&5rPcJZb{Z1taef+n*8(S2L+r6Na#FE9*biBgn(BxpnZ>^}JG<{?# zUzb}=;5}BU=y8o3;)DRbdP4PBUn9xb70^pu2o=693LUMt^&c)rM0<;f*0pXY zP?(0-@=ndDFjP+5fTruhaO(rTR5q0rK<167PAR_YfA+gSzWvT?ufLQ1_@AK55{_Ny znCVyyYb0XN+<6Es4f$sAV9}q|BUIPC!jUa*Ny$szmRy*oiJ-i>37c&{`PL$N*Y1^Z zC(BC4rks+okryDE*kgUz2r9LAFOYaF3b+svST*_`q3(qLgvh6)&?hC-=P!sNt_l;W z>WZn0ClTvtUa)ExR9%JCJlV3)hq z;6^t+r2FlQ+)-JH7R%w_-CzP*1k%J_jO}HuF`89UkhjvovZP1fbi0FcC-2O`JmPr!)@T=vV==oD2J<_o@E5h zI#Tr6d;fIx(tH2(rZM#>{Lj73KQT^s$0@OmoIkSbVwiTxK{O9TR=Q*;>Wn`RN_>r9 zB#Ui#VluO)AdL4;XU*XP=(#v)A@AwtSdE;vIw3#*!L;@#?8&Cx)Vdnb*?};5fFVX$ zZ;<;UtveCfVp}aB;&v<-((dimTMZS@Wv_pvA8}bXYQJ1teE)Xs{d#ux>aEu=>%0zo zk;MT%LBhwWSh8i_ZGUan z2}H=vf?HW(Tcj@Hm7O3ktd!Hb(yLZ)51I0Jl_N~R0*aby6Kz`q0-T*>#1Y%m0SPDf z`w_v+g;l_zzC>_ihPd7_pZ-I(Mq$A=Ms| z?o4k(>eAWbc0*uBOn*&H;u+{=CkAc@^=yif{@h1GiWG=Ssn42*RdY*?`uzKgZ%=D( z$IG4gVt3*xufK7&57F#+YoP|G=u1$(o0H92Td4NntjkEDJl!>5=>;uA^hvh?jV7H& zXEJ>yb5>Bt08TB6RlHSed@#FoXVDR}xPJ9=CHwJ@FD}j2%R<{Y%=>cxJpcarODwr@ zDi$D{KuLmKlc#bshBj473>Ab}zM2dlUlGpLM#diwTK%1I>y{s_Fu7vT4e& zQJ6Ka+>FR2pS&~=FVsAouA;4o@7yF|*{5hIB9aV|1JERmd)-LgAAnmP!%J;`Ex(fe ztaekQ!?nfP?6vuZGDS;`yV)iEV&~LkWM_Z+v)4c%gP&XfJ19$w6{U4k_SJPAr@rgU z@~~sxd#AfREWNK%`$exvu1(>_5=K&{>+-E8hnifE)kfzy&_sW^Twie7{nV6YNqr8d zNT`gQ$Fd3m4>oQn(GBz(S5hBGMp0-DBSaY$462l8<;%LY;+ zH*?JyqMW0GG=!Km?IJG-6u=#m5&T4ejlTX5c`QLk*sE`8;ac2Am)?qKr@UO-FL-UA z8b(MbC@W_PMi;P7q-FvwW@70!OmOj{-_OeJ=(_V zxj=*7-28XyuPqsT{hiy3wL7)D>WA;wKRRhUsFy0DNU_FLNwLP%pi`_dTGc_51~&BR zUX{K=RsX++V%BX#RP08h-+2{DKgU$iF{- zoTbmP-Fu{A?k5+q}?NLl3DgVe_}#-GjR3h{k+z z&RM9=;v8qJ%0fvonHw*CYkld^(lz-XDI=m=_%_gIWZRN;(_OI*5(8UC+=g|nNr4Go z2e*j!d#w1~T&xSQP7p796an*2^8xNtN=9fx(JZ&1sKn;%-Lg0;(ZOVjEx>q`(QDjw zuNiN>73BlE-K_H9iBVGIo@fwF^=tQZ*2gU*-2}Mj9%MvXHqwada=TKCAYHD-gCV{U zo?9i8Mz8b8u`f;+$tE(5KrM6+wjPkFR$)V!;Ku#-%ZiJhe}4YX%ZiKd=_J0axad=S zFnWqAE<`6g$B4>e%~IbP4t0=PX8w2TB(i5l#Xps($pf6Pc|u)lok*$=kw~jg1cZf% zok|QJeXbQ$T#L=&O$E8|dW?FGw98ueEyK5hqFLLiECjrg6=-v7WHn zpf?Wm@mNK0a}|K2O*jg+(Yr^+)~fyl@Y75O^uWsIf_dUyhD8kJ0Jx}}g9yH=6Tz9^ z29h(aZ1MKOLf3gYqkJPGC5VqVV6Q(&9~$d`18kw#0-dTmNra$VAi(J{ADgjLseN6B zf=zMA5kk4HL_gpjG`fT--JoN~{aQWPzh^+C(^ePszvt@ILol*#*aSYog z*dfNs^yVf1lO|zL6dA|&ZnArXE<@7lK~2V&+-AGBGcyz2jY@MyS4Va(eLE~i*5Vtb z9hVM?F0koVNpB)d(jPPqz^GMIx`LpkhtP4E8qgasSC)8{_Lb!kHBYkaL8B=CCJ>Ve zv^4Bv(U&=;cM}wHV`oi}cS(X(c|>d~EU`>UV>vi|NJF5_7WUBEs@OF zDFVk*6k0-!nmV0BSk(2mE>}@65l0+jJobPUB9l@&|+ph6#k(jez>1|(@`Nzr~{Eh3~9pO+132Oj0 zxH>L$u*>~kt}}9qWFls?8&}u9>Gn&8=ZiKurv{Sr1978m%x87D=L<)vCGZ1skvZEI zxP|G@K=PylJuhv~>bVZO)o?|hofX|Se4ye7{v z0dIZ`{iCNGR|{j1l6DQHT*{Dzj?j#8Fa;xf8o^4S*6tZNUi&ZxO%-PDF>5aQ;LoduPevmcb^))WdP7R;&PqK#lqWC*!x;oe1e(%+* zSD*o@Z7h^sY1BVdt5*N@;*EN3CA)f~USIKN#EkAl&Ckej%+JNf((-b4b$+FuU7cyn z-&)Znnx}b|Mvr5bUVHnk?8mj``s`oce2pE)d}*xU^^aVv;51Lt_;F0qd-dt;YJKK* zL(k5&`Z6q~H*e3+)-Pli7v|MmRj;al@UKqCOidieOhNhh>x(l>v$)%qv^hT=^D+5i z=R+ByD{8^a-OZ}JMway&0o~-QwZ-|B`TtRaJ$8A1x>0M~Jsq<&^uEmh#9}lzD%*ws5dQS&;0yNl(v2Zf?w-{Vp(qT)l4Jrk_rgz1{~f2tIPs#Ejk?yc9QOL3^R)%uNqsu4 zUf{G0z1V4abx}(?FDx~1K9=UPXkebbdwXG#|25z9&iSDx>qUnhjoRY->d;=U%`5x! zYWB1Go$U2SP0yN+$#Ev<;jI71cP?kjIH)hGxy-IL>Wh57DRXfX#8Oy4yPL@jBW4JS z&!>JjS{6gPUMWbmnQb%36gQ2Ha+{B8?OYWRFSI3V2{S<~lj?p1bituGZ@Voi#Oz!TgO+p#y~RHPs`75Ykl<37gdI&y35hH> zX%RJ3qYJus0zoF8I;L{U&n+nh3wz?695>l(De-W_4diZD93Gq7?va#g9N|;Edp!UC zk|o^p&(FVP3BP0sp9*r3IxS8SOSrULBvNJ+=frvT+bN2`^2xNs)dBnBUUc{_N9p=P?epldoXd(obxb!~zp*(wJ47ZS>hnS83*$9QF%)#{<+%_xY6o|hi~o0N zF7l3Po45Voj9Zax6x+OCZMqK{ zNleHb(Ybh*$kb;X6B-fE3Yok14Py9H=f0Lf!h&^JEU5b{5k_#5-0V&?zAy6-BLy=I zv?aX8-cka153%XNF^f9C2}=;A$}6|@_uxH>0y&{x6Pbi$Wst}Sktd2rFFbMES0~7f zCHWkhx3m})#FO%YJbR76z8dYf0OmHiJ7aq22PkP}z3C0S2d535K|OiP{vraI@Bq^7 zoFV^p4;Ird&bw`u8W8xo3IXp--6SRFgOm)5Sle-T{!m;iS^MaJd`q^s+PA8hEGE1r zdhL6Z^TA3VX#`+(BPmlNBcL~XzuYzB zm|(#g7voKalMf!+$M6dGpa`^?iL_t*ZFny_hk2u_q+LBr*ku~w2f`-wls}=A-!4gd z9L75dVgeA$t@Tz|&$y73yZzIfyjbXFPudP0aj(a2wkdHu+KHKSe zS;goCdHLr-}$H>wi`5RQC`2ZHey(=(l&+`_FmMhejkD0 zCUMtU;xrBOg6!wf+5R?VSiBS@I1hnFQOi1NAg>w+jC11xwrFBJRDhj9hvwjDPhK91 zMw*du5p-i$1vj`&<7^VHl%ArL(2Lh7EGN>M5n>hS0e)Dn&5l%6+Yv$|;-^V@=0MOB zQQgiXJ2Ar<>1PA7L-2@L#7PZMBp71uY2V$!PH(~!r;K#E84kmzh~W^ewPAfTmP~76 zhGx}nj&;78)DelHEJyQ}M0rkDcoJTW)UiwrI3;Rh7--6+Nj0M)H;z(TQ*yAWjmSE3 z_brH6l2FOL)8i1#;b)AWQg<{mMXk;k@gM}TDh-`C(aJi)OD2@ zw)ZT7gHH~YiKD*J5u{b)%#_U~dX&uw^kzgT_vY~mVvQb6Xvkd&Fak>FQknf=QQ~OT} zBtZ*pir@wyE6y)oEL(0_V&qEiPWS1=oxYqtRjyP)Bq4z$2v+F{fLHL7>@~+_&N1hj zYXP7D8q0;MR4hTbtTorXjPZ?ce4mMIVw@mGs9Vpkk5IP}>Xw$MZaPH(SU{)0s9W5I zOnX?>GDPgM;kMO{bZs01mRJck$kd2!oM&!>)gP~psHemnIyAO4oX!ENhNTw$u3-zH z(w)~#rwF0wu@%g^Y!h11`KGn1Bu)5}tbUr!!g8Z6hH>MABG zeu(|vNu(w21R_%kwxYt702q#u6lOxMR|HW;_#${Pja|{*N?ksx!X5^bO=jUkA_IJ_Fre@J{V@8W~ zf@oS(+LDY9F|LJW6kflyo?;S~Z-`x93&tKk+N>0^kHU)_$K(eOMM|r>Hts#gesqh4 z;7Cu|i;9$tP7HOzvaL{5&hGLy(HkPWI*`700iZp>WQe+{z2gY`kbwYjA+O*Z0#>cm zWNBPw0$A&ZB<&@9F-#q*Dol!wO{WTQ;dkNGHgx+q)miO|MEu3re$bd|7ggFYZL9-M z*wj_Cp#$CD&B$VsG`!+K_eBeIpULw1r2gP4r47=dIQ;FP_4|&$Jp{12zkf`vemF5< z8-Q~fBGGTuBt*KV|DIZCm=}w(C-(3q*xF=_8x8YybYc7}xD~8`GmQrV>;HI4l`mjqOYbeR>L!h&Ij~r@3N^;$IQ`INzf+T**{})ARa79-dM|9 z+m9;Bsi&}xh9rYG$m-{K_1T=I^LV}gs9e~}m&?KJ;wOc*;T^5Sb<`P#@aqvU_+1Zo za}bKuvh0$;s#>F=F~*~^V)`){JF|u^`MLw=z1|ry5aY|GF#moCo>uoCl=8VsIj9t2 znk;Q^Zx+^IAUGghhit86PO>Mg?S7+}y^@ z#9DrJacyyaa&2y5J~zF#o?FjNE-ubZtWD1kVlMt_I?-8z@cWqJQIBi!imMY%1UZc@ z3ZhvOMXD#<9Et;h*Npm86k5`KY~ozLR9lg&X_TW^P*_M$~zQb4T`noib+4Q>YB-ljN*#Ibh7XhBKbtz=N?ZlzKx ztW|>hrQB9|yBHqiI`JR-`O5v3@l0@|7*3Zh@eg;4VaoTpvNgUt9#{%_v4)INW6r~? z^B+~}`o@(~NBk2rkd`BSAU*X^T|wexK7mR{mOs*5A-^7oEU#EPj-PG~m~y1O+ zlk@ZW`RU1tiP^cejm6yh)YSCiWNtpUIzPLSpPHDOS)Z8C4afm)T4|2|DSTQyAJ1D= zLj6(dpvoR{dsu`c`jif3jg~Mhj4O*!|4gK~9boLaL@>UbPWn6|=*D#*`oB$&P*g9u zgX(Iu=M-!-h*lQ8a`mr=x;gz^x4<6>jRn4?Q7k)(Wk<2>Pd1iKk@i|#OPi)C#z&%Y z3_yy~JX>V9oBK%wVqlFh70+c&Y#6@fiQe`-T|K^S-xn1L-l5WMrdN)HZ}2(lcX(qY zXk1_g`iSN;=%fjzi1{^y&a9p#x-^BgsfZUs*OqAcAP)~}i6uh0$HBu?j9#?&-XoaL z)7xuonM~H8eyS#8(O60TDm@P|eBo=J0S@E-?5%ud?Lqc$#@V2PXgkK47tzqjQdo`oZ??M{gFw zbg5iWwVwBaT&0p*d+;!Peb|ENH1{J^NYXS0Mpm^NGTP`r;I$%nW33V)INEVr^&Dr}F| zcc0gHYTB{=pb&TXAFr5!pt~5+sKK=P~-?nhL(;ZkPKCKXNx^k_05xBZ~F<|xc*tk1dsdrBG;n%zyCnN zL(K#F1&)k^5`hXR_*L?}DDfUKq}BXx8n9to!|w`oC9)!?CL|X^iLRZaZXP_@6Sdi8 zIs8@6HH)rH1H!tdLC(+q`9S_WnL-UiomI^%z1+jo$X|m$^<-J(@MGO(O>HFmN_3YR z3N#!I)1SStU~wT;;0((7oRGO%YbZ^}#yG;p4!HK*{SN84iq|diR0Fx;txMg9bF2|R z<1SU*ETBeU7n3=V?TK!O;1^c4F!}fc+_WeFh2H?@=RhJsXNxMxKG3tUSaay~=0DFz z0A0_oj{v$6K$n)FF-0qW!>)nP#SsEIrEx#Q_Ujy1*cT?Ae&T*k1)SLx1? z(xk~2@kX@fbQl|~gmLIfp_0cW`!$64CrQf!85@ZTZ7#%u(1kV^6>x&xm{>QJ^J6V( zAtEH{;agQ94|+(zKSr;!90QrS!gffgeODJ4?dq{ZwC9Yx4} zaO>EeMnlCI5U^Jo-d|Fo)@wM+PTC}ZjV>nk1&rNTxp!;mcmrwfoSaURLLDtzsuaB7 zQhe;;6g_@Kp#tU^SiPD&B*s3}S@6b52&X0MS(yTUyl(?2JZkoms#B>0kd}9h2jOUL zUw&?L^)>`mrICS2@nsBl`w@pg(LC;cUoTs4t!3OOgd6$u$)Of z%i*_;XZRQR+N2|bu}A7E>il`7vVCW3^K*zhtDN%t&UV{qi13ADAn#c2CFY*@?Nu&2 zAP|J~R^e16T*=;mTN}RMGVLoeJqmGzp+gV?TY6p3cP|))u@Cms1EN&N2#)(N>)!gV zwY>4fk)}X16N__bN*_i>*MinxKmy$j3r&XcEC~eIYxpi>0@)Yw8KKL8_KTRjL2946B*8Rc2=++F6vMX2 z-w~moV(`t6&`$~~>U@4;W->QDpUdUe=jInCb8C|uGYhM;xw*Od#p#KS#fi1`jmd$u z@BM08DYX5Qv;Wqk?&{U4%+{ zx|J#Xv+h|EJ1wJ%+5=T=gaS*D+*;Eh)|s(l@^mk2aKYKYrDlVT-c=RsE%x6 z`@J611NbMb#~Y<$xg0LRJEg)Wg{|OTzFd4%TFVD34{{}?Cp32B&b^iKFuPw`Tg$^c z6$h|X+zkJ;w7FS)tUvqqjFUEqxCmXeC1`P_I2Z+G9LMr4al8d!AV}hLY!%JERb?E9 zmzhD>vT3oV948EqSGZtiAj)1R?$=jvb!Y+;w7$bAE=DRifm{~;au;L#Uhp^JFo(Ap z@3+Hyq_(aV)C=Vm_TY4$O{GTCV7= zSmScH`h0OQ25>>#q)=DqWU@TBX(xH3T_e4omQeu5u4?#QtYf=s9EH*@YMI`vitB3> zq~@UYFWC9q0FX>c)a=8q*c&UrC3_-;R7M}|{fyh;@-@CK@=Su_>fh(rD%o;rE!@Di zid%U&2ZGgHIiC$5x_&W2I&+@6{tdnNYO~KbZKIJxyKhz1gWwcE4?6E*U@n`y^4jd7 zghs3INRQD13?Ai^_H%^^UJF>lF?tN01h=PS2Hb8|7jAgSf z{IQ33htFy)-_y7M^MJ0Kp2>q;`2h=Kk*uoeY0w25CMg_QN1(q6cvObC{K1u;!XT!M z?|6Q_{r=Y!jD=&Va@Nnc6?f{+HV7%c7i<;FTZN5{w`ZgP)-=^`2h8+zTl#2Va+_w? z2&GBkIedKL7()!vVK&S#wPw`zBtk|wCw*v~18*Ns+I9KgJ5=>jC1Hapzi z4?BMdCy?rzy1rH}i#cL3uUmpg?wKetCq@K?4iC9VCYM_e-rp>)eadOv`y&oepSQ!5 zRb`#FD1T8zR2D_pLWCg*im{S$Y!;H+q0Ti8;co!UAyuEEss|D)60^~W%Yof(1#1^M z7du$3L{eUNYz1Fa_1o|7T^&{MYRmWqt{TzGZ`9Of&AYmvig9*o(!Z9ObZRBrIG)jKR9m&Kmd*zG|TfBKMkk0&TfZ)&W>Gtgq2d*593ME;TzD zsebzVJfmP>G-cfnHcGjNDvryAxlXxKES0+qVi?BI3pOSLi7fVh_>b1engZT)Op8jZ zq(c9tx`nS=+Et|{=LT@aE8O zuQuAHF2767r)QVy1{d{iDW=|tQ;ccS=mWa14&(^C1@b6j(V?7T)bZ({{bbmtV`skB za8JjD^h`%T8Uh71H94TlW5MZkWZ<5v-gM;a^!Eup*=UQ=B51_)0fVr}^#_%Qo8uAG zxkGtDWxQF;ce8i4^IQ2+mRHekE1^-D*{^F4s!To!{(=>(3Y*epwgX>3tQ{O$66XisK?&V zt#0L3S5@*K-UFPU;lA@|OZmX0ZzE9ui6?Hdb(EjDY1vF%o6R~A0aTo`HXRY8ldP}E zJ0MQyY|wfcy{y1@S>D>SX9SZj^70hU?<8`@5i>(CK=46reLs zlaZzFr*pYyQGfzFdzYe4;ddE3N!bW3JGWGQ*mNVp9?cFiLeGd&YlwTS zVSp7Q2Z8V0-4Jv0|MJoEzr=H%2PPm zA}hFP+eA|iw-42JIhZog z(9wWqT%!_%ikIC=Wn1^mi<8fa8k>v^S?4fC(8dBh-h>$sU9S3=YOn<`ap&$KB0r`Z z_RuCNzWrVVe|k>HuL}SF?HO|Ev*p}IezQJaPYTbrz?&%zjQwNR@CrF+00bbFeR4@8iDDEgjbY(28(WEDDE{hMdrThws^k zw2=8gaf9v`Ag25iS=8d0YwxC3k>6Ev+V0;nX=v+C)~RVn+fjzQvKi3{Tn~$<#h9d+aKKjKzJco-_!E4P}p|`B0>vXRSO-O zcK4W`=WJ{J+~ z#xrsqU3L?kSGDSS4;$A?eoawdl&MSj-@mcovaU-VoK{77wo!jC2qU zKiJS=(z%tk>bi(SYj8Le*wkQ5QymV6Xnqq4cd$kK?73>(N(VL4Xc<~HBU;R2^(DBm zs4+j0Js!-WwpTxvh`NRS-Ht-9vW|LeM&qk07<$Ak#(_!qVNh zt)ZdlEc;|1;Bepm#mb$J?rN7aso4YZew~6a;K4?qp1N~9 zw$PyHweEZrcxIySSrmrk5Y@UQln{0WTz|c?vOIK9WV$J_vngU|TSkDQW}umvVOm3k zE}<=z@y&Ut!#Kp(NH>Ku|4gQ8V0AX32tRK)DP3FbX`1P1-K1~bq=!o01;>u)^|54yjrtUm{zKKqM?^I3SYIw~GOhe66jiK$7ZQ8qy2POO?%XWMA6Zqlu|Lf^%(ISf}8ox!e{x?=fOw$%Hv|`)A4a> z=p+Utpq_ZEEr1%CjIt~7_jV~AwxwVs^Tv0`N2`54)=xqcL>E7RG_*(tKDKgiSyAl% zk?-6T2wlyEOpLIDd+B~(Ar!NZ0y)S?3L(NGhu$!9us4yOXcc>+IoaV3jA(s1aur8IL04pKxS6pQ6aPYxcDjw6^!0 zJ#+X+T6Fu5Zrilewh!N%!uSThV4N#l<&IHRuB=KC> zNk%B+$B-Wtra?y|xFJfGGJ+!+Z@cmtK#q05VLn<}y1SeSZiRd6gG{jUpt$zw zV7gkQ?xAylNq4<}K1F?78P=(kkfAC%(TfT4 zVa)1b)RsS^jibLCM{20l{*#m{)!2Nd2zTsZXgU;{0UyIUm}7!$>(+1Kz>xjo<}y3uDxbtu7`)FS~?8)3*qd z%L6k><$-Bo)U7~lCBCPgYIY!Y+^xTuU$`>l{ttRq#k3{+ZT!@lYg`j8Gw*f0;;lyy z@ehT~&o(vqO9L7Hoj&+{TcIFZp9Up(fTiX2$*I}@;qH|s z`$_SK{zq3k=Sseky@4%2zxmD2i{(l-2>)@T@Y`TLU&$3V%kDtviyE$Bnd|Sc-1&HE zqSq z(nhiLFdf4)Ju!&6bo0)K!Hv!0>S`YBhA%yTJYmALD+?|EEs?J}BNzss&17@ig=`o< zFxy914s{z*O!jcP|7s>!y1NXdn{OjO=smFgVUXb55+y|u)9YCmEXqy~Brf_V^OF&L z>dFG8zqI!iPll^IE%rqQ@K@xz4F);5IY;`fBUga*JI!ajLHq%`M&FZB%HTvJt&;42kQ|VA|~17o?i{GQqDu)P<;@sqy~1+v6aWK^3tR zG?1-A_jD(sNV32PfSQbVoREfFg!cu!`&e$2U1M~NG2~Ok6312OAa`$iqrg}p?vfxb zo$+&MU~AZg=H3IE8Bv-Xs}FfB)iUx4Msx-a#SBv)NHAtN%QMG89yahk%~EA* z5vPXb<)oV}VJ1N$*=VgS5>AiJhTyoz$#LPDkN3r~U6p-#Y35RtGo?X^s*dN>oxPG_ z+x39S|J;Rh>hu_h*h}>D$Bz=RKGk<(KRv5pQoi&C?ni%ahaL(U$hDs(igPCm+O*O5 zXkUnkoWi0%hGL+}+SP9N6xz?4l(NJ2=dgtE3X~+tQ|LN#wHLg?p(vOLFXO~IGFR>N z`CpLu=w+U%&0>N_YQYqN6Einxdkr+d>J{8FJ+P`tUTYcYCti)!L5_Nb0W^W05L@H-a#n%6ZuBb@>_wu>T?DE}A_{Uqt(&Jod zJ-?p)8}-*;hL1SAd~>vZ`@4QqLsE1}+^XeJ22UO(YZo{^fW_AA(2o+g)Jb>|Sdj|e zA9Ioptv-#BnBpEl--oT!6VCH-&DM+AZ)_!PTq{u-n)Bgn4oNfdPA!J?5bwC76=u{c zwLB6-rHFr#u+dRR*BeOKzogbFe5YWdtGbxT4x+_1lpcj&ZFro4bgk%16U-W!<6{E1 zC>oUKVg$K>>x<8$%%7XJY8z8oSAnd3kj1K< zf=X0gqxR73gGyyP8+{}Ls%}iF;<$5FLG-F{=Z{|1mDM-cfm0SY$i+KcKB{@~0BPh> zpBp75s;*y_rfEC33AtS~YO2TG{ACm+(Zs#Vj#WYV;iFGJ*$kgsCVZ*9UEC_?gYx!f zp;Cd@(9kLXgB6EOr8{~CWzz}c@c9pKO=D40Cht;I1K(-A}^ixa}kKu81Ru^+~ zS5e^oE0mKwZK2Ar7@tZ@`rbw~c3T%#8ss@+HHz+VYe(dD9R8!0$Of zSq+KcBr@D--wzl|qPAAK$EvcHe4#S4y2eqptLN88)vi&sD=iW4REnxyhYGL=NcHdn zkq36S@VBKoHKABAg#u3-PC=b!07#mk){Oh9R`2ruZ0ls)wLL-vTnL(ei9XnNbRBmd zbffZYIa^mVNrWu6B{Sk)@XOr>3ji2Lq5~j~seigYdF{6m16YvKvde>>N+a}?ZRAVY z54P5d>kwWf)FW@_w?3&nFmV)g6e{k27Y*zS>NLPy*_*@)nXrdcpP_ayJ#C>3%0QKR9Gk$mY$Z`%78KuxhOnfb+bB zl@VZe`5iMgrA3Yndx$^BJ(Dv&tKc3m!Xa4)T^z!6uj)TEds-Tl(ywqz&$mQvP{A^1_M=79-$j#} znu~wYbg?8HW`fOf0d*cU+p4OPzX+vTF}nUt;jJT>E&Ue`gwz+GHdSf`=T-q(jx-iW zDn<%!+zZC6$B{f(Mtk>ibfy?(N%^*ma%gI%=gsSPC>u#ds#PT}vzx(F#n?xRa>DtW5G;g2<^~jAH3gCH zavPQpxo>%WfyX4YAKpBgb$VDh;~7~V_=+$KJ8QmR7uIkJYE0a5WRXm}a9*WvJ4`O` z%_f%j=B)DGbQWq_|7&wVg}P~OBD|`S8~t2hSqIgbz@e((FKMy0YFuSja#IS9+tKA< ziV&cF&LsIa#44;KCDrs=qQ9G5!a&r*D&I?_vO8^et~M$x>DTR-xYgmLJ`86t%NC+f zu2qwH)qc)(7zi~$>di7q&%%ZHTR>DpCq|xLs4gToEc=f0 zSXGVmP3PovVJ$2c6+zXQI0su5l1=VPa;R0Nl}i-z3{LHJ~6?D=QM>qG$y4qF@tr$DXsUh zk5^X4hb>4uK&cALGA z)yX0Wyn#Ps7YP(#+n|1 zLLVQy729F%Pu82ZK&LQaGYl%zfkQGNSS*2pYO*Y)FV5FO6`pcPSIUf|Wz*kflNz2> z7c;U;ZBG$$)HSlDj}>M}0d-0^D7MI`oVgV`lf(65T6YP!hN5Uhi4<@MDKw+t3Xpfn zitBvgoPIUdZZT-VisBsTJ4xTFNQTnplc2O2p~!3*Qw&Ccd1Oq1FHTNO>T!E_5%hrw z>fifd<-W0BxFX^F%MD865SeF2R56CX;_5aNg^EM17X= zCw|PeV(F8F$I;t$Cyrvh&jT{kXW{;(?c(NU@zP__8R-3y*7nTgAl7zx)|sV!KVJqm z{m&j1*7NV_RX{Hf-)i>`)6`WD6aQ6*4c*xFc#h{8SJPYmTcRe$tknCS&B`K282@Ck zArv}D!$7Uu)4V5Bh}j_AUG-@-*RVZT-g+%WW=@T8$i% z>E!$glU3kezHU`xjUGJpF<+XTvF_e3c8LzC=a5!BF{2hMp6*+ziS*VPNpGE1%KTpU zK&8_k4u@RHwac&Mo=V)aN}B%<{)@txNnTW!EB(r}Ya-gv(P@B+v-bVDt_)Ep!zU!m zd@9xFN@Bm$}k}2l=O7uxAzF(A$i+6@8F;jrUC^RZv*LzQzsIVpVPMA?2P~+j%%RnIERPv(7!V# zWod9k6lmgIiY-Hdraq5&lz?eO2Ly6vBC4bMx`m`Jk*U0rx+mVwHaZ5qZMzWHDSd2X z%dC65!fQK+LeIYbM4jn9$8bqZl!9g~9jgpo3H%+w-I+w50c2g`YMeBu?o;IOoeYDCH2+g9!X|RcOe?mE7oBBkUp;8|TH5nAbFbm6 zaW^m^Jl4^ip|8s?=PpW*gd-fH;n%Z0cT7GM&lIgC*m8NRq`i^)lr~23RHipfohtx{<@SMv1COMNYMdTwEb4Ve6~z0 z;T7aja)Fo(mAK*YtD@E+A_@@=5o6Sc};dTe%_Bf#itH0=@j z!yynd_V7DYsQv_I735#sS)dXIOacDq^4;--b!3qYWuu-9*HJ$ob@%>@vk3GEm zVeXT{TCnQYH4F_9n&}Mr`JR!^)si)+8l1jY5rI60|#&^1Q>Y%K4jTTCquw1fTG)AinTV25KWc3D4lI(%_Z zn#r=WsS*{8K(t4O+3EnDxYJ6NpEK^JavD$xTQ2?!0VSUc22(0Sra5xn1~eelytEEEd-XmTabPNvi+E*9nuG zKo+bz;dEAq12iYCI^lrofzv_jzwBSNVjj=^52o&SS%#S?iYM_54J@JcQ4X98L<>Pj zYK$3g>6;i4ocXi?!7q!Kk#?^Xu0i zk4k%^(q1|uv^2>#$^?h@Jhd@vvVw7|aY^s+t~cI&lXv4oD$`Z%LZI5;h2Iuj(g6w3 z?IR|Q2s0Avv667AJKE}Ok1mcH(T>hsFQHJ)Bz*-u97~p!JRV4z8w#43dBr&{j#I!WP&Ud()j5-F>be;)1E0MHdZ1Fu~F5PTQ5oLSonzgI|ei zU{#l4#mGTI87cYOQLD58umWE>x};a_h{@9ffZ#+Fvk-_xl><$~{I8NOo^~gI-kHDZ zeGHwW0ecLGcso~l5L8OJ&+?^mZd2KWEN6myx0cnHtgPI-HCovHUDzor`b52f-8M8* z`7wt`%}ep6Z6aDxsf{}(h(ZE_Hjz5nDjv&2HI8B2fKIk1f+eqjv#blg`#?!NY#9|} zwLi7VL3$`qjo%fvgYsr!djx58327`OLK=$}q%o6)O}WZ!*Q)KNQ`azQp7(#x}2tnLA0;S?x|>EfVA(<_eqR8G_5)%tf>7ze4#6 z{V(3+h`inBrsn2s`%D$D7*-CFbRhdz>qQ9~q&zKUAF6G*B(}>m9=QWg?EZ+j0 zjY^{har?pRScP8T%%9SPwbn!x^)|o@ZU@vYnkrq7SYi@L(B7e@Lzw;HvfE>xH@id< zo730uTk|sW(>KqPli$UpeqofXYy`z(-$ie|S8;TQaJ zd$X8ZzbZ+`J`PErweUXpZSLWA`03(C@Tjb`+?atFY!pjDuC!XHlyardgAFxkrEp=S zWSIJ_h4;a4w>NWJ=oehv@Bxnf_!Td(+K(^(Vdq~5_0=Cj*VFrPT~GbF`ah*^#5YRC zhr!2%PYc`m^+K+TMdLZ(W)ox)XA@-+7scWC*<3a%8?7y@4!S)JdlE&Q3tGRA|4Hw0 z<3Gf^mPDK#$f-UQl86Z->G4JT5=FngEf_>^!{qD&$Q64O)xJjgK&^Gx64v0{Gp#8X zb`v%J5)8`;yJ)i8S)`Zq&=In+`Z^WneIQ)fTxMN{?@Ij=))KTZ$0=VnX2mt%<$6$c zA&8FPPgUf-O$Z#lgNT3+npL0l$s)~jkj>Ba_Z)Ne4TF!CmBRJiU}0h+I~PgZ2BM=J zk%d7s(zZ0+Lva`>7*jQ`Ys}-68b)h|Z6Kk&h#y81C0EEloLEQ!ev$H1GtC*A#)`hG z`}7q!yKB}jNHjv#x&Hsw@9ENa6h#42L)OPKZh|^*DEmOU$gq zDe+%y64)S8R-D&HRDjfW<3mSud_1;`pFPXo560ep-}*NIN6}5^Shskg&ZgSjzM$QK z(wJl44j7Iz^zHtK$KfRY&_iBM_=sL}(~O>5@Xy$H(0F^M@U1GKM7UVOJH!KsKvE^MP8E7sg4YXMDJd|1Xa9*R51G8jr(u|0^AnYgc|{nRlLIMpW` z9aRQAdB)$3cj6N>BYa81Cm?UT9}fIW6=-|OQa*3Gv4FjAD~2^r{mD$h0_}1kkJ0gu&UNVSsTzg#&RP zZeye`)%P7JJwzVFwPS2KlpcpAu0bfY&T!9FGGJw220K7L5N{f__Se#0*xj>4Ec^od z?0D@F^6)Ljw9vE%)L|9jDgFUPxJDpZs&7)#*+i$FD!h(s>m(i{!!J2TV2y6W2LWM@ z)#gp4{1Qn40!O?0dTl^WieI{ys%c$q zOAC(isKAwoAq@}e^sUnCNqnf;L?49NMGIe=%EoEjXYHVCKw#2T(0b|reJAL|BK3i%P(MH!rDqI^c>~fqoq-NNIQ(4-#m}MrU$^bUB87P3 zRMbq5p@4BjZ)!hBCcWY1p5uF?VzqUw7&E&aXTyQ+)(_~ohwuZgupSONZn|0ZeyOM9JYr zaC_2U2Y^&jkBm69^Z|Mfg<4T3BIvdKEWF4+Q9mP9jCSoh$L*<%SFA6glb*}3&XmI> zGWo+^-v-vR z^Zg}by#4P0yvU-t>ZN%X-plT@H98U=T6X2W3diE5?_*RD==t?gL10u6NJ|EvDjysB zbZ$rFa^%r!RhFxi$p<wf zyqr`XQx+qTuZw7q`V+*X4_gJ2V;(#`F)v-S%>Qcj`@2?`!2pF|(a ze9ODp7?>#B|> zet#$ad|D=cd&i!Pzz!hl9@6&4!U zFQ04vU5Bq3P1OEQ)P=N6)NaCk+p+49NLm4OLL7rIwo@%@K)nwFmDZWHPbP`OLEoVc zt6sIyk`?_)kT*&+6qX3J5}rU7%W2jliB6XGMiafy6MZo)6J637F$#&e&UrRsmp)TB z`C}8~d<&bNn;H7pH{Ha=scVxHX_;~M*2+H4FFDy1o$69#N;OTBcG{`#MScbS@-=Lj z#ySUX)hPWhxy>B0I-fH;Xoqb$45YvF5iQT%G}O*MF(HLL*+4s#J$sSR(YomKx=2qw zFt&d@fnMvi#q5!}??nkMmO7HvV0kg1qPg>$+KxQ+YpvsJ<2`z_McvQNAcz5W@;>nP zk6CTNpru0`rl)?==r zaRVZUPb)6)E9y9p?bY}4*E@68h*Boaw-{D@p&5FrnQOhHO zE{?Ras8nVco0Uw?*;nr^*|xmpXNVjv!d{d;h`9o_o+wdt-b%Zad%D)Jjun;@O$&i zHxmbox4*XAMA%7$bG}(4DcgbbI=5^*Qrgm4m3;>WsdbZYt88eHFat zzv{9cWm&8tZP~4Jc`OXF;KWl;Ae_H&4mRo3i)f6P5UM&kmq!qc@Cd9zog@bqV?wS_$iOdEg^d5_Au z4ZeO5Ib_RBu^BpTOl_~^66_nG^-rV;>ki+Yn?BcPh36J)wF{qjm5R9!W+1|bJ@o|z zW8Dl-pVgjorL_lz&+_ZRT5W(BxkU1Z$RdM3zCa`*+ zCvzGaEiyr2Yi;w93d-N>_ge0==JwnF4rYAJ@$T=n-#0itfE)DqK>v6*I5U6-Cl8sr zhuPZqMLIXz_j~lpjf`5KMy*ey)~8YHlV^V)R@AmF1%QQ62oxVke#|cbrd@=CwNidP z9K%9xGbmRcZEPq@kuk_Ac2TnofsdZW!IV#Ouv&Ul$!9l;rL}zcrAbm@nv^8=usHik~6$*6f+rC~T6t&M#@WP{U z@(%J8`b!a1dqt`lU$UU4S7-$^=MbrPL3u(u&;8OB26wCxtq*xo4s1`<6>x%}&H%C} zC#0a^u?qo(9grna_3sXTB+&|_RNllRFyg;Lf+|8rvV)v5sM_Fr!?8FZS&W)P*cP_c2eCW;6 zlPq70l!Qo_uY=Slv}ze?c;ds?Na?QG;!cn^7|&Yje74|lG+eiI`RY#9Y&7%xJM+`i zTNo=Jfd8!R6IEgh8a$3^8e6$L!SG%fh z+do{7GoB8=SH$J&j>gG;2@9*wur7V7rlv>n-A*d)dlhNU0E<9$zrt8Zm=JW5S$2F5 z!d3DL`pTh)%InSt&na4aL)Ion=K&H2b*Z}`>{DZ46T>aB@*+}c zK&WDilZKq{P3YM9t4X@Zpb8pvG$+;8kFc{GVK3PJLb+$4O-cKJd0RfZdADA!!U(ZcV=jNxTC-ZabtCQ<9a~qTMvs04` zxyb=BzGs5g|8Ci4oG03hGx-UEF1CvR4g&@JKg~sTbWoIj8qq{XDuN@Nh%zn>6<47$ zxPrz`skSgyE^btUO7YYDRv9f!UEtIGz=K?A{c*08=MTY%E0~smOGxZ2VR66bb41b| z-s&@FO}1X`9caxyCjT(f=6cdowm%)tKkJ72K%g6b zf#t-(hf}!EV=~wOF#*0(w6rx6ogOi-M$D^$X9FYV)fMG|GwESoK{@;@qe|z>Of#53 zelGzs5j;hprka_#(FDP9<^Y(C+V9lTfFu$x1D}m4GO5i`6XK{+nEcBQk!8)d+wPF!b+px{< zbdw`yQbY?nl;I43UWh9r{~b%86dm|@h#%fs3Pj5@TI52owXd7MWqUsrhln;nSk+ho z`1F;}gY8nWsQC2b)Y(Y7hOhC;bW6M_F6f#U$1?QQ2yS_>^3hc9?^I6@4~UHRNH|>f zMX;%{DVe-*Bk!*hpxQ*(TkY!_9F`omHwae)K&)o;u178bWdV>lUxmb?5ee)G2o~}i zrtI?uS++#G(-c5QQ9&<6qy<$C?hV7l}2JtmB@qo#Aj6>8S^A_0}Yi<1E5@k-~~H*tZ;w~grapz}6 z6?b)NZEj<6YJPq)pPR_d&acm`O-!tBOm3{rPt46v&a5p?FD&NP2UNwK?Mk=nvT?W< ztsg|;7N)XO?XsQTAm#+jeuH2z;@tW`fW(%s>ji~Os(-> zES86R`om2`+ITi&@E@1g`NheJ$r-+0{i*mR+}&NNdd;Kl ztPSQ3`$f0D6=9E7aYJe*&NQ|Vw_xS5`*-f&9Uu0ayYr}$EpB90!AlvlLx_gKT$A91 z+PEj-zpCxRJ7G{B-il(?4q`#{dSg6in4TP}u#YM7^pJB%{4bz&V805GtF(IG{U!E= zhZQ(>zm(f5hXYnnG=|@Ul9% zRa2H)&T4dwZZhsZ%83f=PS~$V`K9Q90sd1$qbH1Zq%Y;}GOyrFl!WynV_CC=xA4oA z_e~>aH4}Vv>xO<>G1tW{=VH~xw1J*dP4bjv(siyPWCo9AL7Pn@)nDGgqX6l=tB6M~ zc}~PA-{!o^tDtcZ>a(t5df)J50COf5E!hcT?o+znaJnN3w}qFiVVH>5@CWQ7QH1GhUvG2LtaEt}mqQ&t zk1!mflTp;QOKLxKQ-%|LkC9zaxig)WEO7^yeL3cTFm_|*?!AwGHqJw%0CN;aP-FL6 z(i>`qyv$t;z9PYBP4#t6rG}O1T~o$KJT@New5s5^1vKA2P^Kng4~a3Khfl@>=|@jo zP#Ote`T`{ouuR_l89wJ-ZuIG)-;Xv;ZxT)SP{kk6{bPfs;b_o;A?V%7NT0T8SA7||2#dx0iDtS zIUddU{?7RHFe=Z;pX|gg{U$S{ERhZ15~xU|v&6-?B{`^T{y<}7U*1UD0Gv`vn!-4r z!lkJLV%X+wx|zVUDUvfwQdjYHFC_;rwpO1B{Vn*4I!q5KWM|HhvvMHwJw)=#SC}jl zz7Zx8ib$bCa+^q@f)zp1ZPnhM@l^MJz{|WCErq@=h17_kIpGC2Oo98eVPRYl`l18v zI~Q|N9a!w^lZVVl9|x4GBYs-|yZ ztN+BZ(G}nPy8JhrjlL+@=u^4;Vs2t8zc4YC%gs-%O;1kGu1@DC)~BXsCRe9(Q#1Lg z#r({G*ywXX>sx;u+}rl*8Lp&@y*%&y&qi?AhYWSH8TRti)P8KXU7qQ+P7zZ09+fNr z=qY1(lK)ePb~I*c_+ln@Vf8u>NWlhg*KqW#f>R8LuVF6nrwC!~f*jo&c5|76v9=$T zA7tZXthHyVI+qQ3&v!%N@BTaFMopi1t)Z$K--13+Rj-0!_9x(%xlbWJozx8r9Tt$0 zO+`2cWK*BR=%3Qyp7Z=x4AHM>s||j2XZdbM2x(|b2tF3VNAdfF1tF%_-Ie64^=U=4L27%FppCVNC@m@g4m)6<!UEF3VR+PnkoV=_tuhvc$2wH)_gOp$nKY9dD{!K<_H+n*$pIjt`2Mr>A z!^-l9S=cXjs4#P(fiOo1m>*3#dP$LHZXe_N-C05g6Jpu{9s>%VFv9ra#WgaO=t@$@_=X@xMS4hIzqm3)|AluU2q3<=#AfoNL$lrqwKsi;~nh zliJ*%*SQ{k{+y0$QPIWS8;^T+{Ax7Nb&6=azG^3q^V1X$#qDYDISb)UxQV<}xhRT? z?$T9NSy+^f-@RdZzfaVEH+>0ML&L^FD1X=B3GRtR2)9j4Evm@crl+B6&}T^x;n0#w zQA4W!azxWhI=ZWW==ZMFXG&wd;8uJf_YMc1SUk8)E&va&N{YQ`34*%Q*Bo98=~>7; z!E(o}X_|6)-2hgy2U-}QJMNeeQ@W9>|6WBC25wqMKm#Skrm1QKN3_nL z0IhQ_J+#hVQEq8-=nIpuArCEX=BhciFU2l z6{!qf2W{QL^KRLQ(HuIw+p?|j1kW55cpe+jMue+cWkV}}>+chtix`YTiyu{_&QZk1 z2&uiIyRG>U8V3aMkQX@}i#?HENdF7b-pg@XUAusG5g<+{FrC~EA_*{p`Yl7%iXvE}zs;UX#FL=dg!8 z*fc5Ev<`)_F8!Jp6x8CXi2X>Z99>>GW|fIxY_;^Lk`FeDrM3LHRS}S4JjTE>0-X|c z%mDEod8zU`RTmqKm2%;4Y!)6CDoT=3*92aBniV_VFi=9ziKPX}? zCrPp!gB4>Ud8@w1p)su9EzrIR9_A`*4`BTc*)n?98vSBYjecQL)ad8u zXVxbtX6NT}Gt;v(>l5?qx!mGnesMDV>q0I+Ik7l9zp*|wpc?&r(E6846>5f|Uf=gC zx6Qv^0JIp%s7R<}r@bdi7s4R|KVA=RE#JJ8>0+C3F=Kz4_Khj#)fC4Ok6it0Qcx0? zA+UE~nI>1_;;QV>wt|P~MVOtwp!~FH7{hQTW7+YkS?EbZ-U-!W!V!?XELjqcL@i5N zO71;^4|D^Hlr*+g+=AExBAiR!e=AOL2|l9sSoj77{_5=+;`^Sy4GOK#s8NUS&xpkM zf;4affu`jO|z9m%qR4olhKK;TMBjq(xTVZ?vAn%OZ( zT`I`lTIWC$+V6A0a$ztUPV;><8yrc;jB1Sk_o&7=sxb~1N;03G8Y5AHWDtTxFDC|R zv00wxRPfUZ|BDV<9fLavd0dfC_Hs|A$5PC~BH5O%b`!<$}DFH6d&djdOFD%Tg&rhwcuT8CQOwP}( zFXrcF7bfQxXJ$9nW>!}>rq>1pE-rNF4(Ozd!e@Y58ONFhOi8-Cjh_T#%j;c;>GunK z{LZ~N1OXE-PD1h;BgZDYSi+#n&%Qutf+2ihTM#kX`+LAe{tw3@Ev^U1+fjY47ZuZE z+Kyue5{{!kZ|v73UkE>pDS9{(K3uhhjFoq`9h{&A)g-A@3B>4}Z zS>03WfNx`yJDL6vXzEowH}OjYZnaV0&D~-eH`~J-K7-@=lzbJ)z8Yr87sOzD z3X~f_V)m=Nk!M(m|dAiQrTc2rvSu8CgVwAPq}%T9Fc4nR{z zMhqXZ#Zxl!wx&LpJ&-g=TbVyk8_Si$fl$sU<#FH~vNg+z-9-Zfq^8m{-A>`Nx)Mi> z!E*`1KF82f{VqqKHM2z9Onp=fbA+UgkhBq!_ESaD7Se;H87pDha$);C#qG=v)^*^6 zz1wa$WpCRQa#eHv?FTTwTW-^#xJPBPRbHUCU9Up`>`n z6KMF~2n-|qMN08Nnn?ZPut6BujByp6dZ5B4-p~nFTAQD>2T)RgNbK zg#Et2t9<~ph(xirXsUh~{Nm&Ly2WPc!`tHqz&q9upDQAyrF|l{Rkp|3IWaMeZlUd* z<-ZSP&74B0d2W7mv~v2pa#BNtSJN^ZJ5{Kt^9l=6EonH`PVgKEPyj(tz8K!Aw}?6q zS-vB?*|BV7__&Z7@6rOQgQ#ImT=`fjzrC6JJjhilxwTKrLr0uV`}9r^|6Ge*MBDOQ z*nlNIBsO+p1Ys16qQJb<1Tc>QY{NopYB0NIvTKz-e?gQX1io!Zf_P>a-(haQFSCh^ z=q)iMw60l zabes5@aeg1hqX!<2){gMbWIMRci@d6QImy?_n6zPq=Xy#VcPb*Fk2Nge(uZyn#Tcr zR*m9U6u7g`ebg`XYy4CKu%-pb4TSD7qd=;%0xvtT%6$lsZmf>Q{vJPTj%a&nUs(<0iYKec)P4F=; zwkKHp_yVx*hA4it8rMV_tIy`{vwROdS&4hOo_#h#v<1F`Y;d#iNuiS4G}XSJJu0l{ z!!OL2-7yg?%3&IzKHDfd5@_KNDf4kPIBV!Wu5{jS7dG;1pRa{K@?mZ(_euU?`0pth zuGxW3s9Q^amy&Vlv$o-#kC(zx_&C2BtmM}omDEbQpD(N4LR?Yr>A!9iOU{%^$%yq? zy$?t1ZmwK@Tr8~zE0tn+0OW%k5AwN6u<{_EPs@txGp`-T#j;vOY8U<`{7J93zk8%sSaGYIzQJ1Tb4$mK<&`DacXEm<>Fh9l{2i}+WFE2le3Y;7=);dwq6HznQP(3Y+C{)&=1q2i?5E(&lDCO~o!o#FOSM zx@nI5x9NlwXli24q(Gm|D@}n&n;Q6W0S6cuR;_xs$l7g;Qr*5rGNh#X;P0qVU|}Fql{qB8$hZIi_}G3 zh;N5lNH)pNt1zEjKlQgaBcUtm1#t|F#99|vmsS{VVjUX@q$qfXHCfUMXB0e&sQmo? z{ku?BRv#7DL8T?nxL6uYvAQrGCahMPLYk|7EJQ~%T-OGexB_s40`!R7A%b*@&7`CV zRdxIoYbvvkFv2{m(8 zTLfF*&Vj7c*VHaVhBo+7WkC6qF=iOKCXCK^(Px@*2@-WG?R@S29L`VCx9n+x74rb# zP$Yojmo<35Q03SQK=G=&M%nOE(prr^12l7&Iz5x&FFBc=77k;03a`C}@k`>C8)51g zo;Yy}35P!bL2=rVL7171A?xN9_P2J{ZoAl~qIR}Jxivx%|V!nhZ$ zLpi(wGa0EPP=91GI(#Hbnu7rRbD(mA3SE2eTB~+V@5?AGY2)hg62=Jy8EY@p+srA_ zG<&7czRQ719CsnLE*GNEwm6YO527=kg!jTN*B4p8L;v{VK!LtX0-?#bl_9?wDAB+^ z*&q(>4xCFa@9CvJc8x&*xm@mpBIBXW!B3Km>2c0nhIajDG8opOqZZ8SP?hA>!4DVo3b3_Z3*ElNCp{wfYh#jim zM?PD#1Xkll#+TV9+LbL@neDa7Y@`xQl+LWWDNp9xesSr{x2JB#@Y+;Qg7?~V1v+wV z-DSpuI0FBKoQ4{*mncpPgMli9-%V`vp(ZAf#3di5BcUz}jJ_CW5EXuhD~JT5sHqr8 z9ptp4_Ax_QVDpu4jJHo6`vP^V1qN>kJOESk}n z^dLsNsvZy@$GJjq#QG~97Pdf`@cw}K7TTDpS<_0%y3hVkeFsup=HbnNugcWS>Aj<_ zJ5ng}HMn!=3#p_>W|D)<6NpR{KESF|H8W8>utB+!tK>HxZI0_a6(I)vhs}JstorTc z47FAFbR(LOzEj~2Bq|7B#m?WTHYa8<4ag#Q$%b~v&N-tgDRzDV*EarH$E*ii*3-9O zG0!&#V+=$DskDP6;H0!SobW>N+pEFY%F3N_>Cr@aN{krUsPU@j*RMYwHD0|V-E!1; zbtOdGFqleD;}t+MC#?o~zj@ITM8;Kc1$*`x$fXhh+5qf#*QOI%ewP8@ly6`^v=NjJ zM+!hW3F3VM3UjL)j8n2-iTb0Fj-{CGH6U?P9@0ig=%iKm3rFJLaqx!;v;c?95Z7L-dv@*`}GjZn@^2Ar!8DZ?s_g zyI@k&422nkGpjOE$;0TmSotT^mEGc*tUt%d#}KO2fNB54D`C_kUUO{6NwmmIIYh@} zQKc>oTGx=OL@-uLS5D#Z+@Yk!@T#%E0kA|;k>e!ebb7>yqSq~JF;FztZ7~c@^m-Vk zZ!KScoX`ZY$OI2RPB?Gjgi~46WubX@ko9N0?QgR3VGRfvoKkgqaWOIJHzxG@Vy+Ac z>`@=u16yG*8M!GIf`3DeKeT(a9Ai8S1#LA=pO{6X80Gstzdp+MNBMqQLZzwn7@}6nfZB`Gm)qifNdh6u0}vWp&uT@|S$= zvTeq^S9el2k%tg{r?4ebzic^LO4ASuogu~4(!d$w9J%PeB_}MMnwIV^L#!seJ6f)# z(r7L8cP*qQd+jh;wJem8@Q5%Mv7~F|yDV?rL4~-3@VqZD2H3?c7#76^T^u#X4-vDm zOswEEK^rKgayWKld>W9;#0MH?^}5md})LM|*YzeVnS zr!8TmO)7>I#Mf;GC5tm%^9)NbEd(7!PHb`$v33&ZO(V>t=hsJ=$p|w^OQwo;QJ5b*mKaMCny< zkzFfpRdR)`{JMXK5;V^GqQw9K&Oi0Q6s&ZGxvp{geOV(KKzI1N$*63sGJ7mKNKGS{nWh5K&0 zaZc0xSZh!C_~}1dj4bhiFwtCq`1o_eK>Kr*Ez%7e5vgiXT%G6IStKHf!8ITh*+J z<+6zaq9?L2QX5!lWEM&zd|lYjo_t-7u<4Z*PC$D|F+?rL?1&L|oCUU3zhnBKTnDhV zn`(yI)?K2Yv9jw(trd_b9SSvj=<1dt>{X!K-(hwE!iErC@x!IQYM+WhLKVgU(LnXB zYqLRJkHJ!c`u<~s{p(cNk#|C8G0ejOIMF^^rhA+OkG-;P@x|V^XCu6Mgg1}y=ASCw zJewxG*^{u^bQbnGq&jM^_1+6A=^saubwqx@3V-F$SJ5LjFkIg&O+fa@dpONgBGNnr zkobVb<*P{)oEN^FKmRaS*vtgf9L68sTGCPIvA}s-;5X}G zFV)GCuFV#O)fD;;4)>Bw5$Nj8Yrcu{a3E&lC1PssAfKZVvL4r~O5?-tIS5EPQ3~}a z=}`%zwfDz+&gMqby1&ypO{lFt2t?<$I0~@)uWfa!qQb>%-ani4Embl+?)v!ZVFirg zq(6m_{scpRmTs#VH(5+UB&b{+7n^>9yQtIbK5Q!@VMcWULIBK=073|Z*$`<%KqWf<|pdVYPBuaENev_w&J>B-mIv35W#VVl%bfT9Jjm9tiG z?=Eilcav3ZTORFCVoXac`b8wrQs0o6Z%ci0Bdd7?pWO2{?m*$u6&S@AwVwzoqRAV@ z8l|F~o1TE5l+@pFFRj$%-4T5~yVu=LD&WmvW`)I>j@3wzP0^)GPmg9h&KQtVTTZ6K!aeh8G~ zyqVMP&AWK14Y9*v8PiQqU9ZIOsU!8oJ0Bx-9jkWo%sk`+3dCf0K9MeI&A~j}g|0{i zOasxSYhSS+dno@R*OIH_M737dZ1S&C)my&T(vEbyikE{6Ekku(r+*tP@?eQ*u@te; zlZVcCz$6KYO-)E4v4xJlivGzm5RiMJqmiQjVy+(>mM7GIQH{KJ`>7e5eRG~kCD30|Q;o8sBYhq+ zY{6cLnrMi9223;TE`g-vRPYcoET8}znAd+d&M6jq_F;F^4cc|P_=osS!_e^bGOdFD z(H&-(5R6--fzo!2B1uhQBzZqV@P8DrX@uZk3Cy^VCX2hv9dll*Ehh*i$z<3b zziRnuWkg07yyh?}1qJ6*rc~5D@3C2I=g7_T z!&&Y}S_%}GD8kPeXRC(L=Vg{KZVL0k!mQzq={t+m{hj=JA z>*#D0>W#2eKtCfBEZ@yb&Sb&iUU=zg`R;I5US={SF538&;KG>Qu4CQj$jihLB!vz;g#{_V z8krl;si#HW}m=j6e8B7V=KN(?>T%Iutt*nz;9;&TW;rZb!NVs_h6a)Y{IhcWrt}D&M zYeUy)@~-^jBn8;1iA4*moyx*=dqRcqQ;2VNR6F!lg0xdX>-WB^__5L1e={Uvxkzdd z0OQM!$gm1EUH4b&+KNGM6O+-5lX%u;gzl^M5jQ7NylatmGQ3ZO5r%NMW2zOfZq2!zUUh?r@+w924r+jgW}hrQ)ag zE&kYTwVZ>cN0kS~QsH+wwZw-mnMnJZOb;;F*EK0{_>Dq-bKQS*{21%eAPLPed<+K{UjFOSu{w&J43-5yjg-`NgnP3F69~EfHhA&k#y2o@1}`;d{Ra3g;l;JqZO-^@-;ob zIF-0z+nnANE=<%+oSd-W!s(dqfvg(&tUSW9Ek~+iK+xfIOpAf`1Ld_|k&;0o^14T^<(N zRlpWUWw`Q^cxxan2du>Gw#fMb+O=XViAI3p2v8gWia!BBF-<15-89HVWom>inekxL zhepHhv!a)*O&&V}1SLuZQ%Hz%kQAhpd$a>dVa@7xbK8GJHaj={#mZfux3=M~D>_iNV5*a=i2Gq$plZ&wG&Q#p9qgxP7GW=dZd8gVqM1agNTDk7M~&kdrdo+^{QW5(}L z#~&xoPw^HEMg^V?9k*nCQ?X((<`LU(#-H+CR#!+KZQhcmQ%m30mWV)2CJJUwPFe`m zOqSLZ5Sg-o_+HTBes;C2wV4169Gc9jvM%Mvrmp>=U-fw#v@n{(Ld2zodwupi%{J_R3xs( z3vC1@_5At>Od5enX$fi5WQrVa!il@1x8kNU&X`ovp(rC~-Q(+&oa4q?_=WvvVE%-?{Hy}-3yl!5X7?wcWOEfH@ zi~^9PuNA9>1A|k|tEnUBQlqLYnHr6i94|68ZDA3?R6b+{SfN9OUTjG& zG;j4$2dImd3I44&QOW|LPr`2v5=21*GU+GcM|B)bD#BZ&BS?|0K0{0NUjWvWn?qfeotmI|l-FH@roSeF9T}_J*=MGCBr8N6FNCOccwFctd zRW#LVydL*&uEM6Zj;ACJv6%H>U$v}3e%jBvUEMtiYA$NFi~QX{{;qco`FEzdZnZTR z2C`KRg|_Cm0YNlJ#5&E-uzXF{%Em2bELXfU>NuU!t zxntOz*L+j|M1rkGnG=6cT^z<*x_#Lghqd=S!=G`-ieYv;0;=NxSx7dFgERCe?mfSN zl*;z1fdI~?dUDnSr|KD8o|%{0`I)+>t!{{`Fs)UUg*r&!snM>HeXSW+sBfGb#<<~w zqJso&WSR_w@qJx z!rm<9q@{K6lu$vne&cS=(DjaiCx?6slS0>YuRd-a>JQ5|Z-iI%(l@!)Nm&mQfwRZvH2d`;CGl2YBSL>SGf^ZCfIcEF=q#;{uQ(Om2Vm+oHc1h(ts4?#V z#x2sFU2;m+d;u>)V!_Q{n@(y6cma({BgsjwgmJ6W7l|b6dC$v8M9HnzX+!x6F84Gm zA8uA1=&*}r{ZnBe)saOdy!uD`vLbViH&^dvU1bDttQijt*T@<}bpQ8P?$gD49^qdX~rVlf(5l1unHv5$(TmZz)f?`Y5@`vObRrlK(_U-bO?sC+Rh zU!()MT}+kYXBT0ZiCb*eUNts=+0_Sf`|B`bc@e<&_XT~Cw(35n30db%=fkBNy4nG$ zP5^AfhS-1EFpS^oI;mq=b$|9C)wWfleeeuZ5xcU+7!NVbAj|-Yc+3 zRI)6hQw^Wrh$s`dUmK3%7<}KE0TVD@Kf~nH714mDiAD-LSYJ`!n~8ZpWMAG-j8lLG z83ZPQNV_LwgQ&A!c{Jx9f{%(@c|kI6MWy5JBwR=S4 z=|AmVOjAt($pPQG>-oCC&ROI@!mJO>gNNjI?9=?`!CG-^<577SySmf9XQqddtGBm| z2kT-LK{4lqIe0ffQAWZzHFi~b<0(iYYm8>~A*5{fma8HTU9i+23fv64g*8+(oJe4) z`(PT7DP$c(UQCc!kPou=B?r-u?HVKI-Ya|G9^EXNKYq ze>*$4JM87Ehvk7k{&YBoBO+5^WeKE>%$18X%nw97md0e^`r{HkyDhYk z2pytt(i4Ij6mv2o>l(7i*%a{Y1%(zc?p=ig=YSkL4;0H1_*GaxA*3Us0%LB^naGyi zHv-saI;UwM)yDE?G;m1LFYM5m>q=?esKlBw9oBN77Q$70P-@x z`dz2|7rP)uX?hgA=O=BI>ZtIi7)n|y$f^$=CTnlVqSFY7@A>r+5I+Lq(~^j%PUY54 zKUr6TNDm&SzdVgi(bf~yMNiy44}bU&|89e7qCd6UP~)7A$M8p9wobh*ug50yJqKa8 zxY&m@4TmD{*;?Hgj=X0$(!l(0w+A*H=}XLpdm|jODo%pVqzH#I{zO4i3o{Wnanp5= zQE?FKVM~gWj{nIEkv-_fdvtsS9Ph-p!Mb$CggviIbx6OmoN!iSO%nNiK!OoF`qJ83 zzFbC59(KX=HK;rA(n^zcDPub9gCBPOVE^*+P5jkiTgPec30q8)=&~*4U@c=*iE-qT zb&WO?3oLL!vLn2p7>m!bG8)Ac#&VC=3!o@&0r0FdWYmSi_p`k;SsKacL}k~ub4v_Q z`|bDP557I?07PbdQm*IpMoekVZ48~vMA}zXT2z>2EN5ORh zE#@9o9;oh%Vqtx4Al;yo6L!%e@gD6RV5ZyF&&7dk3B%C(2}3uf%p3fjLM$S>Z;m(7 zJBTAcjyb8eNq7a(hLtNrvQ6p~*r0gW(v2Nenxi||@Q0_=QOnigj1z(P0RU0bD9sU} zxl1w-zV0PQ1X#4kah2E-;aIx63}&suuw6!G(C;@+6+$gfn53bnBTot)Rc-Z*h~PNP z5e8{JuEf^gdg5OouBl>*rS4G0&r~^vr*sAoP2H3d6C*YQlk|>-5V7k&;j2%=t2%_4 zaT?s&&TlQ>3~m&+wv@@vnA#P_xt0l?jRao76_Nn$E12=B?0tYev~)T~BgABU<{DN` zeT-I4#@P$qa>x^YBhH#=MI2U9X(e)U3yE9LV5w<^p(!rML(-TXTUog?PR)-OZItUi z)5}1ZhM?PC(E1Me7FsGMOq#J)eBhB0MSd+@`w2mM__7}RL-h-B{bUYHLVY%QHTLE?}BPZP~hMvQ3)eeU7fCE)`vMJR`D}+PT{BecL8H zGo`LvB?>@IGs6;hP;0NG#Ma$UJrdNAUa6segPAT&dDxCYkSC7Q5q?g)6#yTduxy@j0 zGfWpNc+ShWWe`|nxl9rx2>;T4(#Aee>LEJBWqQJ01M2h#xrMI;FU3-1@H}n2irEFt%|5!ZEtudr3|!Pn zZ#EG9)t8(BSG^xw`=efYdL{>B_wwc9qtaSFSWzD_+)-*M`mo%dF7AK*T)9&(Ymj}V1YD_n?srSlZ`f~6HZJq-VIEFdWV zX$qT^rs}jjJ!4D&7HOI;(~{(2>j=)y)H&(m-xJp*I_qQ~}^&eIeN`_AJn zSl4&-E)UK!=3MYURaN7V>7$vl(MS)x0$?EVWH8mi6JHPq=elK1tp1`7;c(y~b?}Ss zd-osQs^jxrJNyF#r%p-`(qT;n9N{eNH3fJVEe%Wof80D^rtcH;UVig)rOp=)O6Bu# z8s3ct7m1ik#^YnaX+lECfHV<58A8ke%=)vsbfTh7OuyBB^eti(J1kMweqyqgBRZ%k8_0?V%eEpw)vSUEB7GrHl#p+I0CG_>Tz%)kt{<>(nm zqN*#uTESkeFDZ4_qII?t5<36*mae*iFoC)XbkT#lMp|`vnUW0%GYCNT0`4J-)5Gu( zle~`l*ghRYq0}MDjNU#X>^T?x)m%;zns;p>FQ%0wq-Jftt0RkRU%%I&)htk>*>lCK)DN80!nFVqfp4ZR9|HaU2k#~!Sa}6bcL;wXl zm4MUrF{`hDy6f#;(B7)ozWV%BpCzLoR4Uu$_pV=us`9n1eC7Jo^(!gAzf&84cVzmk z6Rk%k4EhS|Ff{A=&+?l^#qYUZ-p;R;FF#V=qK^^=mZvmnN!nti#wAjgW^iM!do~c% zt(0PeOzQI1r!$d#V>i;3j@Tk9^YXii9t#%VHAt(i@|MuXtl^q%ToY#xt0KPrUb1@L zo?S`()!?$+J=C(*Pa&jfu%|g=?y~JU&fm>qoe8?2TaTod?LKXvL1?K4 z@VD5)bXRLohXL`MKkM$wKwQ0)l{qo!#l%F~7K2;`Q1D^v_e3-njS3(R|2EJW9u=Kp z;${78bsT2p?h%f`m7e@jZB(fAhns;#=xh)Ty(NhF>Q?#;^33)fHIRKQUT$-ALPRPN zPE8G30q(7kfV($i*96R_CN__i@*DXQuvD>18|^;=Eg!=k4Ra0nG5|$s>J!P=7F!gCdJTj;;M3vs?=yDP|5K!G3Mdv(3WF2ptE)d`G{a+faaV>ZaU1(Nf<{7s z@r*5@YylBp;3pK`)v1p0K$`?KG9G%-8Hs%9$~SQ+;}{MNy&YUQ74(KTz*SKpL1b0b zK(U`*H4#HXtVrG2Yhr$Bw+jOO>)aTC)pQ}Pn0Ozk^Dd$2Lt+MMv##(vZcjS0YgAZ- zfU!zY5S-0j>#LkVT4{e&p~ zBxIK$`I51dvbtv0L5v3!3E%dl0?Md@p%xb60fdznPrVxnzl?-m2HDp)5`MXoj!w1N zrbqe3rP*lVGJm3rNJ>D!0w!~s&EvQnHMnr)=(RYqst%0>C_vHr6hUTjj5tt-c|s`9 zYHlrzK-aSy#Zq>o6lOEwUv%UJf(qe@@rHS|O71lGS#D*mRM@U~N*W4(Bbrk9GbPFb z>~XV{AT{Sk+S8u9;s_9*(3PgI$#BS*UuyJ5>|i~rQ{bqB91tX!#NIt}3EEX35Sg=R zd~3z^JO?P8!Hqlfl^bw)Q5(V?ErLVD9N%a^YRK<9Uo1+M!*Z&|BzfY^q!M*P`hmLk z9M9PMhLV^gOvsOT!=hrj#i6jin@zpmP(>6QtFVKVf>W31M>%ZG;sPsGiMHu+p`MoQ zQn9!ZC?#~-n&2Vif4lY|xAjRr7`yxb-1q<}Deq8bNqTQ@YD?GD~O5Jvq#+0l2t^y)K32lnd20?4oS0ZU!_Slx%wcXRTE2{0P zikXRtaC8I&5f*p=6rm>oUZJ04a{Y(3{&h-#5Exm58>-S{>x*DK zfrFn=HyC0W!55dNooV*>!azH*0@DBidk3V`>$CgA6`{g=}fw6>IYP%7TSh#6j$F6yex)IOHZ|cR6_o0BS&$zhwn2&1`HiL1;{R4lDA^#?5PR z^f8D+Bjuzay%<0^NI)|BPF{~k)E!A1ULVVlDabZy5(!ApfJ(EPataL40V7XCuQX3l zI>l)9$JPwj-mD9v>_}K@M1Qm3Lc&O@lS;*UESFN%mNh;gqSeS)h(YYdv0A)V=pZte ztTjZ|8zk20(tHv$glTh<7xPE{W1QR5YUH#UIju(i9IBCd;-S_>hFJI5)n5)3GPZZB z4+;TO2klg4^ZQ>Y6>_YlT;KTMUFy5P(9zHr2#@2@oG#3GT40u@m;zK1-^wHQzlngg zIp}ikJ^eFN1W+_ep$b4DdLao-BcO!^>3SpRYF@Hwr{;X3H8|8~)~o_#OyZ5kN>f3Q zz+|UL6K;O;Q;lWw6S5s5lZg#h8r&$(k{}zIQTFLF%+?2kg|}jQXGd7jcy476Y{w2! z>PJtQAHqMblu3Wp1(&YC?D7k&)J zT^P}uGtXL0gsrOV?M*~=%U6Yk*WTh1xWT^Sh);~tL(PfWqx4hbHe%zJ8%pd*JY>%v z_dIg!P=}VN6{*m8h z*}TUP3?6FUksE_>Fj~}N5Pe%;-3@HHeQvU^D82HCLGvr)pzHv8day-u?p;#8#N^Tl z(UAx;KY{{UNSPNn>c6_#-(@eWP3zMoC;sM0-R*ikIR(3Yk-RKO+WckKvUt z%eT4fAT~$+z!N`->QF{Zx35AOqE+s>YLqed12Om3_jylF!i1;89;N`fco?BEBbQ4f zJWqV?pr+xg>3@|zYr|ozndRTsqw4A@J$s;v#Kr;Q)3Pjs{KBx5?05|7-w4QXZsci{ zT{|yCI!$0tu^$=eySgHay5CLaSu}Wow;w*}I10Ns!|0u4Yp3(pVuYKcgoCXQXMbmD z;k@Slo)+6L{Q0!lJ}tKACLvtRPqBS~fAqnK9uk;iIay$E3bJvcYh(K}O6J*GO2n?F z%WsJkSNadEj`3qCZ+yns9jc?rZ&Zn7h&Zol35ql@VuiHzNDq`)Kt-rRdkYgB25)M~ zf{CbprK>j?)vuB{_i#!q5XK(-Z*sRZl z;EGjIbTTaLWJvg0z5Cy9mFuO-&iEQI1u>6g(n@05a2t5S9#DeVcC5kFjf~ihT0)Ps~J7{z-tz9-C~uTd$<@9UL&qqf?6rp7(c zEzqi@$CPv^WyoV5euEyfz;U;ACIe$)UP1l+{rY}sC%N_BhTT?P(2ZsK=iB9b)!n^% z4TlD*+sRG9;j90s?(L;FsXm^0`)2j##0h}EDUNJ43rDs%XXD70Y#dp*^f_KM*^-SW zi&S4P7gNRxRUx>;(1W!O1iYE~Xa(7bQY?EU=o(b?XkNz5=(j@%Mp$Ep7H$XUZ*(j? z5w2g6pZ&J~YWvlw7g^z5{x) zjh^8Ye}kJ3lDe;rmek#XXtt8TaLHK6?mfcqk;?+Ck9M6D4ffjVoEIAnPjDZ!Ayc5z z6sR->D*YUQN=rEfD#hCGUNtQF@PiwsgTT3hEnSr+Hd~cid9$v58G9NGGkMD6Rw_ez zK@%$|enJ0~{0c4t=p4bWZQ^4%_kthtw{VZtMY3lRoZxAuw6jxvuv6Kq&jy%gk)@GX zDnOnBpOgcHR-(x*PA4s)$=HVZI7hjGzl1B^!;WmKBNbu|w5AbbGt~uZy)h;EaYUsy zRDy8k(Xcz(p%bM~k2NP|;-G&$Pp4?xp{CRu8EgUwaIImLnp{)f!EYh$8W` zti@B2tL|;cwNMkW&}CHkI(I0urG6@gHly!MLfWHZQr3+Y2F2i3fDL*s5kh||wZDYb z`4S?f@U7w;5hn`P()H1V-h{tv`hr>>p6V>8yFuBFG@5`LKYf%R#p+?>7T$RkY17#&dM zrz^6vQ%)D_6*kA)Wxex>Shf2*X-F})RSKVC zYic0u{F9IiWH|riQNCS{u*IbL`<#RRmaeSk#@}D4=nhag0`jO*984tC3m$D>vPQ9%vvhp_^q z)eQ>_(+_USwW!P2vnjgTCXPRVL=tH2dTkc64o^}Uko^(;*N>3mWDj5o`WYtAd8R9| zCvF!bwo9Om(xDe1wCRKOtf}c4vFTaMi|Glcws>Nmpp4iv*zyWic*r^G0k(-1QPQhk9T$Pof`rtKV#-CUkG zB{Za}NW0}7pQKY?H!B@2B=`6C?v}Tl5>~DJ|Lm9d>U+t|&1)abCZTU(>J~B~)AKXt z^OGCkp*TO!f#{1HB12kw$#{l&oKM27m^??uw>{mfqu#6e0ry=9;xI%lA^?N%unwL+ z@kEsL(*L+$-Q6qy{$6$K(v)Xj1H+NcSUg;{gc(ho61CyJZUaCQib<-V0y3!Bn)Ms2 z;(N1vsdlCC6@UM`TgAQd=6)^xb-OY30ss2nr@uaFrfKjT<)oXY+`ti0aT8)p?rlzl zo!A_wdAJzir8@asJ&8)6HNj4xfSity}f4!fCW@&mz%RE4};>d%W|WzrW%Av~&j zys$&}18Q}2jcj>4yI8GSf*k}1zR+!vGa4`qCIVmc1|_zL^cM{}Gmb{@olgVz$v2Ss z!79q~FjC2he%>I(_hd-WgUhg&r3Rq3u4c7xx%4i;MKU9px&`|M6oOCT{$9d2L*@cs z)ke6pYSpWJUyUT;v>i4?yY#$Z|H1kLuz*@N26WkAx>66j-b9X7ul1{>Z_!2zQU^8H%n<5Im0a?py9cYH6EuJrr#O27Z72leqi zTK=4e`kyF!)*=&tgxRy^ZT76?qO>~2YGrHl?*={TYqDf5C%r!jTkY{@Ugc{>FZ}v! zSl@%;Vra){|A_RvEa9|TdFNsJT*>`(y%dq0vW&Wafp)(M(;N}~W!CO9YRF^{)!+pf z=>sj*en{me6`>RKBuLc-+FZ8eKzWa0~|}}YCvOyLkAc;!bHj@tD;sH=<2nC z?`=v(jxo{cb)z+;iHOX1tGk<%(ycLX1i5=5hB@XY`2>#)jdu|XHe0Wu zoj>=K+*<>(buTbcQ6*BI&e)|bxOQ#g5{;ZAUzT&kYGq*y>hMx4 z>4Rhjl?rCHDZsH3M`>mv4*gh#)oc*ViO}+KxxFM4pRkTb$%jxf;rH<*nUNgnkgZ`Q zEC_eHP-4@bT8~j%kNjX$Z0ph2JZ(fGX;DA`b~ycMx?L5D>T`B+wCjdMg;LX9PMxXh zH*(m?<8U%u`CJSwghuCvx~nU8{b(S2UEo3mGwS%^2k&98>sZ*+nabYYe(I?q7V!Qa ztM9E~K&7cIQ7xda<%D&w)dU)$OBXx<998bc9L2=3<>lT4CaP&S`Qm$6gehnV93(M+y~}?HEltMI0aO=^TMLR(t4>! zeD4x806p^_lj>rV=748|0aK3!f}{Q+RmeW;0jJnG&fu$o8tjq?U?G5x;UCag-KPaLjzKER!r>t340?V-@4ACI zaKh|R?jldb@{YG;nV#ss$u@F}q=D6H9ZR0UBdq|_MIkbk1xX_1b{2Pnqqgj`mn>LZ z$2qJ=sQ-z>Cgw9?6ALzMVx{PpZ;I9X<=x8GxZo2jND*&clIqQYC%-HhMW71)r566O z02D~);Q=Uylo&I}iZ;$vj{{dRw2IrLfi4C{Qb1;k=er?#b%a$x`gKK_92}NN46ytd z-=kXCLW2AjSXqi8Ar!C>U-Y#Nc>6SKD4AJkEKwU9e9HcpQxwI8Kfn55ilUgJC~}gk zuH*CMXR($D-6D_g&>D?dIFi5=p@Cu&`i$r+wz z3V(ObEvXR?M51^gv!vWwU6R~^+R(>7B8`03 zMF!1j=1hP#+!}!b1l!&4fR|MT3?JGln;bK}HZ^J5HX$?kU>h?XWd55#&Up4QzrR}< zW9dJCW=j1}ya>FISp;6Ri@>Wz;?)*{y}ee^W$5mmkEd%1tM_uvU$PN+M?VKP5hG^`zUZ6drW`pM~RBwz?$HSGXw$Ib^+i*>HQt0S?~d+ zvsQ4dCL)e$&LLgkxCY_}mCd_h2Clti=7Vb=%&NpVGQ6Y~-TqdYVCz{ZOE4Yvi!#7U zU&B?xt2DJyBeqfb8I=kfpReq6jEon`OFlAQuwb#@p+9c>!Y!`J^I5jL47RmRSh~Xt zR`qRoi&bU(FRRtx)nU2b)2T8J(!x-U~Kk z@0mf)onLut;2rPo-^2f??0meVvt(Mx^oKXL_`~_Rg;jnA{a5k*W1jSGn)lasD!U&g zHF$xw8(RyDOMmBDo|^rp_>cZ>C_7YDBlTBy%XRmG^~ERa@s~&Y_`mtxwT+wf;uo&W zDVpGVb+fvYT)$f`)sv08vZi(JXeo-#f z$~8jPez;e1WVI)E+15tCY-{uDV##jZttlJzes!z7la$gRU_&wbR_YIv>($-8%2pZK z&-Ze&Uh5-Yuho^sl}yq4+Yf0uZ|>jTscaJUUrrWmX>Rljw!A(sHrU$_(^ye2OPZM8 zsc1@lc9c0;tND?y)!NF!np~^$$Cb^pW5#}2EA5Uouo~eCEsTDJR_9jJO|w_suca$< zV|S~vS*llSdvFl-%H?Ev7Dv83>vJn>$=`4M=GV#Z%C~uP_lSLYFN~0EOAw7Aq*lI)lS}nN&lq|`Ot<(MRj+ zt8;T{_Oe$`uJ6}sDuB9KOK(O+3ASP9ustU$HR3pZt5({si`7tT^NU*bLHgt3FG_pL zxZhWR-#q0q%OeiWagAicJU^nE!iejx4np7!O0fvdO%vJO@@9Q3HQDviz3vfb7tX_9 zuhz=R{CFef5iZ7v6Nz`P-MnF$Ne+*PSdKu4WZCVI$e%4`bx&5-B}{d`7#54^KOMH0 zGJhdd>U`4sQ}}wpQxWd}ESo2Q+VL@roV1H1=YxcL=|L{e&kg$&7wQQ8o4IDHDkU+E(A_hNCzw*ox6lR`Q8ctC7 zfM;O2)wlWbMq1{n3sVyI?CqGrp zD5Ew1i*v7K@iKSTAK>|p@qzIEJFw#wITe9O!bamU0PaxXNitq}EpS%iGH7qZ#?=kI zBHUc?4qgJZ8P!{{ZQzM;JQXl$G5iE6c;J9E^sHBeQFgM{`Y*~`DIbt-#7EHG1zYkN ztl()>3s0{gI8LBJy)dLX$9Bzt)5CV!#7 zOZTu^-bXMss2xK)uy2R3KD1HkJvCq{o|3tUhaF&{5uSCJ{yN`=05+##%a35pI&7zq z*7`FrC};flE|ySF|CN~Yj^PBrE04s$X@K}0(Op_>kM5}_ z5>O*R`dn=Z!Dr?KOb0j~CI;kQ{Sc6LAg`+w&YD5n)FU0x&?-=v)yBCsS_AFJoBCxU zP}tIOy9~m!zlFvINdVg)mcu(UN~=S}LpqlXNtFie9GD%JZfKAJLoX6AB5IrakpS`T zcM-Fy=_sC>VDvDSY8W{^0#6YyCTwU;_eh&IOr{*JAS`F%FIP)Y$A zo6E~v<@uHEg|+p$`R&ry!rI!({Bn79d39l{JdQm4xAXH?=9AtZ(?@J_J}I%X2oiUV zjy1v^_f?k&_Vla{*Bj3;-{KKeTEC9Vk0IL`#D)c!d6&qv?#Oa&bd z9QUwlv&cyT#IT?H-%1Vx4j_EplRgrhn56*rf=|JAE3mj8*aFouZ`1=<`UK`Z(t{3v zm9EQyFEL|HX+&hsVEW{1IKwYdZOVHiW^@SP%qn9w`Uc z=5W0WM(`Qe5ELN=V{eM+IGSd;`#8t-d3>CcJ9$uL3> zTvwON{?sm;u>=+th)}P?&N4gcs%+2av zz4%}DOS|>`d&%|M!~69rc;bhJN_tbO%p4|VLqMi#G)n#YU4}iRN9Z%V+FV=_eRF&S07BdH=O&Ka&L_JPG56& zHcel1#Jz#lk$5iMAlwYuH5G`Dtfzqm6}>AdkF-j?I1@{S-T`?i(tq047HV4I`=wiH z!N?lBxpQ`NzrL|?E7`c2tj*08mshVO19aNptJ+v) zRHrrI)?RuQ&+LoK2M06wg@y^aJbjw9MB1^b85^+~%MV#eZ0_B~?GSR$ZO>-_^|TL- z>WQ0{wp8LV=bqKr23^NJUP-}bJwluX7)Y%KZI$Y|Hl03jOBW}kQWL~{`uDrUOb(p* zY5{|Ip`Y>qW$eFv9H9KDBI}yH_M#aMdBhQd28yaygr&0CncAryQI$V%2w0^pY zFjP&&1s*muuqPbMe`l_P?~gEYNihKsR*S8e4y7qX9~i+Pgp%TS*|B$^=AdF2MmY_a z`#80B!pvmiqC}PdJW`fdS_!Hx{-^-epF(nD<2P4tymNilg~V}x#{$KvFAa30VZk2( z2B2ea4_Vvs7hYDEfRq-U#-PPH(G4XiA(0+5>{ht14y*>uz;SgY9N` zm~b#Lg`fOfxvzXZ{@aYC7#!Tj)iSCHcz_{!nb;cQ&nw7oTfYrr8H{uq&GY@^dmO(`RO$b z-%Si;)PZnDmkiG#ZoxtQ^JIQuO_i;nm_jq&&`2fZuaj{41q%jYB6tDDJ2}+J8m9ud zzJq&MSYDx9q1w+o*RSiZ%TkXqUjh~*eWZjQDFe$53yQicv@pk-;+w$#VjS_1EFFRo zHIP3eF;*T>;VrpDrE+sU9na51o(Fv7;@s*2-FFxmK0WwvaPV`~BN_VOyL~#S6%k5a z(g3``P2Q!@4IL&?d{E&Z;vm?`S@XWHe%QNPt<{U0mD=WhrLIOkyiBU;>o`B{e_BA# ziDBNE{W(Sil=U=}cl?CNIp`~OYm}!z_D{bzS^LNOy zn|`aAO}{m}>9<()5nRPkJ~Xb*-eS`G7Y{-fx`9h;-}$%mMkzfH>*>~4E4lWL5}`=0 z-z}y8Z($B~Qw2={o>=`C3bpEyN%e-EyS2MT(}u^zKc6-{rVWqW#5jvNYIp#&HQLhe z05Za50BeaFB}^uOBKG5K6U@E!cdq|pmhj060QHQSP(JO^IT$`Vt+g#sVS-V|YSW+rmw>QUCwp>bj|I>%#5P_}i|Fi@3 zzc7;L(h8hmy##A|2X3(FK8Tpqll{3SMogU^DxMSmWhgihQx$ayt%RT?pDI&KE~+SQnLHKtvSpF>w; zDL-9}jOwqLzepX$*MSHtnwk?Uxr?*aa9p8#&;wS54Ap~}j|Dy#d)C7WypGVH>A*`p zGzMO2C>4mLo@7Ji)0pGm2)5C}Qe{LWibuCw0Ue*nN)~jl=KZ&qXLaF%5&eVYsNyR$ zX$e=(tM5xWYWJ8(&SU@t_#aG}9w|1TIKV<@bXoE~lg7`5Qk=e^9kS@*2t5MH)vF)m zmm)uTkQv1aWnZ1C;qwFjw1Fja`mZ)ZvS_lbtL@&oW^joUx;Jnxh^N=-ufkzBDoh|4 zTVL!12huG5x)3bx5Gm+1sX9u2skd_!K}DmO3p4D}igtOo@N47WbeSpyakB)Y=>ZX( z>F){^CHO6BZe!27D|vp&CkTMHE?y1=@t!nWmh*nZQhqv#5uX{Z8Q`?2h9=tuuYqhy zW@L$_M7|2N`6N$Nn`j|un~I49(I6-UbQcq(x$Y7>^b1|%PY4$ZusZK-VO&F_4E>|& zsTlF8$W50nKw9E=%b++P4C`SQReI7V1KjgKnHATyc1fNmy=!#O9;0mP^FJy-O!n%v za((kIfR-4-op~$jxCjT|e+r!W*3}sv<#EEMPawQ#&lbT%0u*)5z}LNyHys^r8th-m zPBX z#KATuvu(4&m8NjpX5NOJFBkoGc+rxI8zbC&IqCh?>&3elpOj9Ftm{MX(eG8Hf2@+} zCc3qZY&)3|5*C%s(#}q5CX{k`Ik~x4-ruSgYo*<->b>OG`}b~_YsoLmyX9J`Ua9V; zf4OnEzeENy_}zF zIn6m{1LVjP_L0`Y*D{T06=()^-$)kXv8?g2UL@<#Yol8f`6YbArzj?j>S|(^-*r|> z*TFz(^@4o(;f=Rx{_%*Y@6Nz(H{o%gauTa`Q&H0ZJ+OiWJjq{hIpK#XKP761$2*kt zWe15Uu_l!QZ1zmjU)K7{wnC&T{;1!74xrQ*=|@2s-=A_bz9B$OD58td(fL0%garXC*7`fxF1cJGM-l-dq#l*D zV6ua8T>`MyjP$Tks6tOkAS&w_wPzYu3PRbEgXw#_vb|j?7k^dW*|}Frlgzh&1&H={ zc6KWF>y^#q`hI%f-fz8gJ^ekqvy#PMYj%;97dDKTqBe9sL4xX#1tzay#~IdeNT`zD zUkqeUNy~=Vs;Rtm4kbce^6o!BPkHG(+LNSF<8~QZblIoyUlRkI)Y}4#?nw?Iw)1Pm4x{{ylbT};6YpMUbL%$aw z_2mldfR0Yq{FqyG#Qua+2GgiEjjoJ?mQ`==g*vTi{tG8|VLk zJD=&YjSOZa+#Z$>T(A+mo(&7Be|`(+JN@ILnveo4h7tzp%u=j)fN{Gz zCQXb!Wy|~2#cJt6iVV1>cWPm@$Zwtt8ehua0E9*WJD8>sxU3F0hPw)nqU0#J;oRtT zxG?86;Qiucppnyx^r>I{08e~IuAT*wdaR$S40=n^7E+cvP^5)5*}EvtGHFKRO{*~r znbnv@F)mo%Dz9yAZ7-D9msU#4<+-)h+Y9Bb+ncKk+uQ4_a|>$=>)VTK^W!SItR}tx z?aqT*v<+&$^++1;ab%-?x8FH5$Oa5#<%gC>;OJGt&=sN~a z7}gEUU%({)c0Qu$9lMF37rKh zpO3yx?DyDqh}8zaq@Q|C98LqZU)>WJ*XSHM$%01>lSK)QTQZD!(6r~1{|5dT8_u;s z3&!H1iLi#+i8L^(nM%eneXVHHoYWa@kg{R~9tGU%XRikveKR;NYzr+VSm0?0C;(te z|3y!eI<~2{_OeHuiHJ9WxBsalN>fO#ZTxma7SDth4wmgiOXRuwCKQ>%k?TWPy^d*o z;y}Nb(5VlHnAAN9vMDx$Onnz+=?lNGKsdLWIZ?YRCTjn2Zf<#LX>RNG>eANA*6p?O z*3$CQ>eA-&YPr0=U0T>$UR_%&&##Un)JdbbEAvV3JACyl&Eb&5YVy{58m9X1f#7x{jkXtHzyS^UefP&(_YW%fDq5

o0$idovqDMZEKcS zIc%ok&(0~^1T=Th)Dv{dRUGLFYPe0} zdj&(O-j|kxRSOaT?lhD8wd&UXrkeRKBzyJJozxr@lCAQ`<(=yNd*$7FA*q-5>I&?K zh0|6H(*jI%>DK#v@U9P#Zk+f`G(feWJO>_LpuF|h4oEAye7>P5OfyP7Pc}Rd?pS>% z1CZwd56NK5M7-q8j|$f6o94a?#gYfi!oS1uitSBItcZP9nJi8F2M%-E$iMLCSEr5q zX(K-$9mq7q%26ZVKO!mB&LW^S91#<-Fe&ex(!`?L(W1;IF*WY=C3Ry6!a*u z2~=!vi&R3Dxu6!*KwnB1!U-#Z8do`)9x7L)qu9Lc2M1ETG z-hqhkby3ObP;*?dZp~~~?%z$l(cXR~4ZmgsVq99fSv1fwhh>ET$W4ggpn-~1s48pN zdEkT49UNUr-dhaBY1~rPlNDGK(Nl~Pk}0NW4l$rM&nF95froX_)KP(JsgW?VU9CNU zaNnZ7(POO?C_aTqlveL8$nc@q)j$!5z#k?v@8UPB#%Qg)`LK|@yD2s%%pHVl#QycHl4z#{;~TtIAqf?0^q7F`joXK z=$$@?`+7taiCi)O*&~(XBaER77Jx&t1;iQFLf7rN#AylkFI4uK-qYt4 zYQytu(QuQS^bJ>@E|B7mWRZrJTY!5k=epv0dvY}=&A8`!5=R;L+|a0o2_s)}v2&J;& zi#)71Jrkon6Zs)gwE`X*M0L5q8$LatZYl9eIYpL+!`_S3;x>UUHGD2~{NG@ocbfcW zcc-#jPOg`0^~!c-vs5o98}(9se=oUNtJbTV)tzMKH`h0A&Z>{^r@wn=(spdFQL}2t z=11JGX>U+u+x!%hz+lwtZgGb{{~eU-D{m#&cPi=9CW^hJs<=yjWuz!VNO8V^3&pi- z`T^j&A!BJcB-tMA%7$8xTJr1Cy>fD6cT1fO;P~A5^$k=YwUN3uy1aoUN)_du5}5Kw znw^}u9QO@Tv#Xg*Ppg9I=^wWiSJ##{=T{b2))v-pua!!RORGyOE1Tuj`PJ2O`S#Z4 z_U6Lc^0+#13(2o;-MYCEg-$`kUtlSSgGhi`pqYGW9k@*20Uy8v6-oKx6AbQ8ooDc# zz)ux3`pJR7tzZF_Alg5pE=wd6K%i0+kK_<+-jcQob0aG%%tR1OYy21fd|Kn5*7$Q1 zFD>M##!nH9?mGuC3)$Gtw(pP7;(Jah-us5=jLTSffe4JC2e^OP}Fr_px3Mfn%2 z_?!oN50giykn^(sLaxgCX8*RVSOj2>KK;rt{y!4}kiX5A9bad1cdT069V=VQ>)Q(p z>#Ix4%iHryE1S3Hw-&ZbrG@p<-1hqBV!6CDSK1m^e7(pBw?La z%L2_VTOtqnU=5jNOUK)Ak^f{~(L(fLvk9 zf;kQNrvd-ZI^bW-Z@{1a$EO66Cd5C+>CUI&ydYRmjRIU_@%V`skNZ4}hz)YQmOTW7 zKvtXv#|~CUHM9#6pmPA^3FC4{P%%2wbb2Qa-$y&y*!Y!}HN!yRsIR3xl{fjm_gw+i zNMAT(bOrRwimd+=aD^u%VDYlY8qnVWaOspoQR@LchkWhk4RC?lzdIzE>0{BTJjhC% zO1LWg>Cxo$$Z6(2bs#xX)60V`i4S&^i&F(UzRCkAr z%6aGsh$;U1HIR1+eskus1iv&YV>z`7Z(tR21KF|b?S*JrlLrTF*X>e4Br}!WdaYDc z*R5=plg;YAd;7bDi~$UK$ZQy1UYrJuVkJpk-p9AKB|_Uw@>--Ppre-NM`8%r{SG`d zpkCh-bCm;@1m_2}4wVb#cgG*mv-E&j2vkZw5MR-z47s5b zcg@J+XcReMc4mcfsWl3oz&QPBKwO+Lu#IG z0e)$KNhWhZH9iN;+xT92@2;L3J))FbfXo85jHs!lnE`y#FZEn+T*Q6SZ1bCY>MDqCepa5t;F+m$=}q(Fa1kxu4hkw#3MC>N<-t?s1%C%IGJ zE!PyL{iEILgLHMO)h&O~_A=Hh`>c(8yA_y&>?pj7fa(}()&~Rdci#seuCi%85hRl zE+>MJ(IJWI3A)R`>JA#WwMNo|%B7TXWKdx@linX8xJJ%I71;-=ud~+Ub*OwI)RZCi zB{u-J36}auhGGc;dxIRLz~)evvy?T*G#IpsrKVd%qBEz3ct{+U9@yMuOu85Z;~`(e zyMGB&C3w?)hy6T#OE3)B^NOu+>z?b?P=a{TdzsVvtN_;WTIq^C38v)tHM~rwEzdQ3e@hsD60EM8yNm2 z>!wg9Pl$y-3K;`g?e0=(;eb`P)T43TjRi}Cuf-u*z(RDGTPPEy4r=H}Ekc)Ns_Ekq0r@Y>2P*3}Z^92UWvGXGoIa{WUh; zyTYx}L2A-72;v&gYQ40=OOqojqo8wSaWk;q&ZJ2CpCI|%^4e^=H3#v2*X_5-IQEQ) zT%o}d0Qm8qP*;iyJR<{I8%YTD>(n=ZLIUb54uEBxSj^~oXWp)E%ubrE$u&>NVy@Vp zvP?qo?09y(;C0VJu< z;N2XD7Z|$zUh$9yzD^+bJ?azNP|r~>#46G=c!H*r&Zqxu5nv2Cnm3LVhx*Orc4_mYVs(340~Ek{ zb^4zoB80Aw=++ms36Qz4nKAu_n*w9gE}{HS8Du8b5_W?B#7s)4OA4_|;rEJQm^|V$ z@c%+GyGJyPJyM9!T$PGEt&N7>U*(}(2^Bj|;i<*V^XgMEmyTpt7DJuQH}xtb_A0pn zxQ@!Jm_izs;pnIv=23{A8hDP-I-h0WcY@dUR9XYG7KzY1IYq@}vI6?4251v;o%Kv9 zcPV@K9M1BK1Z>1}9XuK$LSMN(dB|7(tmhWeV%kw>kG)$$C#=aWM`y>A#kg{Enqch@dSDV@|+L4 z+xCv8fu4$uY*sX4_rNaS1O|*wBVq=HzID1V=@R{cl2U#pAWo&4OF?;SJ2GsWP}A!b z#f<7e9th}0eGLirx!_3-^e+uhbl^_Wco#&E(`3D##YHGEqL;&V;mM`o0njV;x^E@D z|CjIpjpWr27t#lPb%u|q*~hVqn1vqjr=6Y*rC&MiN?rK#X;*66mC8->kS8j(uqNt| zP#6(jMI5Y0`h&qqHje@Hi;ieNbTEq0Mm3=5&@n7Qwsr(h*?0j&V5~LPa_U>G>d4rC z!jGV5WiecfPq3ik!M|iotk}@J3_A7>xN0B`b%b!-sSuPSnQXA$)^@Ro@URf!7eq*9L{k}~Tu_s4=fVl#@A_cXj ziajG|!8hL3qLS_+2+k*<569Y|aO53E_nG){I=nx6E191r;h3#tpy354(NWGkb2-KI zvBy@^Gj+b-*uWN0qKdL00Yx1+KW7~?I`z_2Bf1tUEDcjgJqMd+H9ey!3GdKOUOguF zr!qh7G;WOah7lWS+U~IxpT8gEj6#hry+OsCJx#a4*~s`#TO3xLwm{s1G>TqBtyZnp zud4sUR-&|Zud;g;{_n)~n{$6a^3xfJvZ6hM*!D~8_r9b`;%PEd+S#c-*s1K*jm(4( zRcYI}Dk{)h-Kdba!U1f{AB4LEPt1rziw1==N?#^64t1K%5R1z==QJd#?fD#vqc5=A zVOLJs)L1peQ`5Chz5Oh!n)MH(Yb+6LTyhL`c4_j%c2uOTr-a<{Uh20f=^oMF=ZrdgQq z-k>Sb82r^kQ~5dS#qg?FvQbX%tfwXGBWTq^99pg8>$cp$W^PHIfA-ka2bX7nAf5`XiqH4Fvmb<7o2_cRQBaFF|VX zNSWdGM&!&wZ`SYIHpE%B1&%%T(nFsfIGD}?PjjeCt=iv!xUfjrTJf36prA2%Tl38T z$CLxzuYTzLDfE}BSBv#z<9ko+iBDxzpt#MjyDqK-RjeDhI*KLruOKa3rMIO_$OOq_Q4w9hK$9N`UuP_bA%p_>KUg<}@Iu1BmC zC5k)({}iQ`vmL2V*)N_7GCGBrwyFANJ}N&<|ZLwqTeXKt_is= zPPP*lY6Fx6+Q^GSPK#&N36*E2F)U=BWK+}ty1u6&BW?hot9#}0R#7%pWMFSvy6{%i zEqG{l&Cc34lVmOIe_9B$f`c6l(bU>7Vs(3Vch+8V^&6ISKxihT&k~x3IGS4cYPTN8 zc(1v8{RrO7Cy*Lo@7EBe*qoSllyf4=UFmPUw-^ETMLYG1uZ5DH{voAC_HGYtU-!=# ztk8vS|5=c&hXB_zzuI_zTJ0aT`Oi<2+ENTT^{6r2${H|_cHy62=tQ0LZTZY)!t8P1 zqL4HIB!=(hYHXy{%T0~*PB{%)ll!&G$CaJ(o$_=$k9s@jr@Kph3Blyi%%tG-Ap&eo zulM!v3)p=*bLwXVy*4H|W9B8$g7V^#hD#kxp2~9mY9y~lzuajokAWM7FF>jkbQ#|e+Y`YcCy!7AbE@w{8k?*Q`8sn_|L(;mVq0KF z--6VDne{ZDq{EU2F2of|J&?jHn@i-SxMI=aGVD;$#4m>=9PPPR;3MMI6@6Jl97ziD#5Ddq#TcsJe_Ih-1=3gmE;w&inP9A3&(ak%GV-gPe#LVTDX_)-r6 z_be$m8*r0Ho*VdK4)A`E;v}c&p~7%xUQOfeA0U^})64 z@5E=;W%rHj?=cDyLNJ5L*jM$v zcJl_32A@M%(bnaV4q8&I_k9iMAax4bG?}mAATmInn%#-n#yOk8aM`swT8{)nQMR~b zimCG3K}IXjEUFK?B5CYD%?O_@{M)4M!<=_Hm#(blW*_QE^$f9sVKwzIW4NQME(wwe z$|pPSk~t4IIWUwx;tBzR2Zto4&1n9?=@^)t6=DMnCz{cgzce~K=1$%(?UwG8;Xmom+=UxXa#ZcjtFfQ0X6)+4Ig2)SsVK-K-wY{m zG40W%L@9Ujg@=a$giorF=pG{-kS||ZZu&ULic|G-?O-Y9r7zT`qDE0yz zBiOJZ;#BB^KXs=Tv3hbw6%Rw}K?lB7aHJ6JpA)daxEEHTvWFT2?R{(WNDlF?inr27 zKIQ1AZ&(B%0E9z<`34tjp5wN=jCc00{Vx>BIU*Z6lFa?Y8i|aLio)P(rba7R)&t~i z;J6OkT4!<^wSb@Utcf+Vkp`%b0H%N;rw$J@OoWYG`kTM=g32d-OX{RRiJjslL;$WL z(N162F;QNt+apMOUvi`9A(fEj3G8b%*NTMqa%?_*#8+pYrL%b#qzuwH*n2nU8hUXw5+*EW8;QDC@EgLp4=Q#Oj3>IW4+t;(h~<@?_u zJLuq<5{8ooin;_EuzvYcYscXSzcklHNbn=f4g@UuX zQjg`;+3<3}uE4t;eXLs%Ri+$px`$-M)w)D%=2E6OFjNc0js4WXOdA9b;R@u|?0v{) zM6Drnwwav`95_f4>(jeRUT{DY_IbSQNoF*lQCezgrQ@_cigRta?js3Qdr9?DBHF>K zLK~l454stcMCQE|5|D0e1q|zR``MoAP(V`bp#c>x7W#K$r7y!F{#A}X@iKan3&_fV zu>rCX0rZac>>(I8daVua)36F0y^=#YOMwVbsv&mK>}fU>C&ck&wq(8MDe@a1f~Sh< zPg@>@bc@nGLjXq_2XRM%pSYY5!k0ct0*v+pqFEnZ9MGAzn5agf$GKPW2%~d>uJu1TWVijj:nhe%788dP1g_bCcF3U;;i(9; zY{Gpke#p}e>Jo4%u>hes=bSdK4x8lWJ?;rwYs?>p+Rh}j)z21<;7xFVgR1>Q`;F-t zEM(pKgyShg0oLMOLvdM`Xt^Dy5uoKuU*IG2M^iZKg+IUgUUVar z$0HdwTpf@&F}tvp<22YCn4brFo^nv+Ib-eh_DmD)5y9c?tVIy;gb6pk?g5!}gNAP#hr1j%+jiFfj8EB)+ z+|J(h7fAx*baB=R7{G4{cIP|4!0(dC0D6hxLZNCt1*o$bM>C}NrKJ|Ib_fHApFst# z%V9VlOCDrK{He#igy|O1d;&KI)sd_VdPQ)%5%eTPP#sN8ye31FFWLY-=Agcr&q^Iu zb2hfwq?IPO>gp=liJV$9bf`laI=g&t@uvpWJITZjQ)|hc(aQ!QtY;M$*XQiw;zE&l zstBl8)rW7e zrUP~Hj;V3Mgg27;>&QyeuQ3-x?_#JR+a7fEuoNCws8fItHwZPgf=`)#2xO@P`n7KL z5KP$%cz`xB6r17W$e`~a=N5K`s$lZc;v!8~d0Ky%)*q(zho5czA#eJQ!xkRwvc4wR zKo%Y|X=Q^_6%>`gH!$E*w3Jnh#t0eY=M?%ix&8d%2k!||_AWMLov-jXA}wFqU{b62 zlg9AeJZQ@j#;S)R2`h#41ZzKbHKM1lxiu#(TFmwA?NY9k0fS=(A%qOg8JzaNCRDbJ zaW0lQOD(fZb{0(I1WtpxgwG(BQt9&n-wJ@)PO((x$RM@#T?ctmrH1-*B(UQwU4xxC zs?@Y}p!o?8btaY#&ik3C%_f81NjqveuSVrb?(YR}F31&n;o*l1*4hPmkz`2}zORKF zH@(1*x>wmZJk6?76JmXIXq!2;Ii(S}Mh1d)_CiA%Kf<5szApPFVmWpV2R^RHgOLM1 ziQFHw{7fwCO!p$y+<=4~a)62o%|ujChbo$8)kU4Mqo{LAvRS{<*?!$h=bP|aYW5iK zuc4XtMXxou?vYv8nA(IlunGB@3Jz6bn@FU`G zso#Ch#kVfYqXj5Dj(PS>ayj=c8gxQHwJw@enoG2)7HUeiVxkdsAmCJL>=$?OHE_P2 z5G$cg$F7g4LX&Hvz@wn%r%8}o2<}%10-bzNrInX7S(?+m@x{3X#CHiw3btkxWi(84 zg$OA8n*_xKxJOIn6xXo2|?JedEj*BXF=4y5FoR7*3@YZtG&G++x)Y|blz{S^>zkEGQl zH1eO2X>yeb{R|^4Xtz*%rhz2-yr_g|Ifa1^&9ABt{~2Wv<_j#IT!wNRcy54%)%q?U z)f^beGg3RKj?*CAt%X2pMv^Agy2t8=7T!r8?UNqRg#*6mB^MSWfA8Q=#U`<9k!^)i zHWM#qzHw@mMr@VxL-3FlA~bNU&8<5>wTBnmf$CuzV5PHGeSye$g{ z*MTvvKrMtTa{Z?S!Tw5988bNCG^L6Cr~in6@w)YdrS>zvaqbak0LQ0?XT*nR?dN@X z#6Hzts2yd16{INzN5Q+Ng-*kMfhbcn`&8V0SbS8FNIb{$3{wtfLK9F9*6E!*faMz! zo~(1HKa4e+x3NZx4mpH)bxMJvQM9V9t)k83I4-2oqQe|vg?gk)BJRrJmkg|5);+#H z&gc&bPa9iMqfjn;AO`WAYM2N2F{SZFxR<3zfGrxqi!Bm6iT(6plF}W;Rx-RU!W2t0 z#nMc%G(QI{O`i018))xhgEYbRVi#sVzL0nt2vvkF6cs~XEH0=Ks=ndv-@Knt6;XBS zA<-{bJ#@rBs#Mst8~S?c6!H22gDkKvsvhxg7HCJQry$Bl*AmmeyuMQ|)ruRHdb#*^ zsa`@NiXRQJqKfn%1O1P7Sgc>-t^39@%g2U8ti;XSaucdDDEG%2X2X;rz9?3MTSD%D;6 z?;E>Y<^NjVdixjb^)}NKprST^uoXC{5g2B$ERZa!6dE(+Wd`hoN)J2zh9X8S?ba*B&D7VazrTyQ?{=lUv$f~0VSp8N5>|9^v@7~{ zb#q^F!xDAu?dpC#v_^Z$?T5+x)qk$+?38k`Q1c6`<6z;1-B#9n?S8HLPvy;eE>>h= zeQ6vkaUNTT^ol z@9fvA_si+3eYmUk(J#xp<#ZVnD6NS7^+Ea0{tlY)nP0wr^Ml!>`f>UNmGXm}EZf>x zm(5+Sjs5#-b@r;YbmQGnk?(G~t~cg8yLT$P<#J7Vz+ac^5303~a-rDR-R{GX5hJg%>HDxKqdf`8B5s$<-ki$k+GH#gct^Siq$0l8mF|41F0 z0Bm)Lb@4N1$ceAUezxHJ%*v)!(ro(d%SDekxzT@G#HO+738?yeQArvoXyB)mnx3i} zxcZ%8v+#?FG%PDh3h&mE(5(SdJ9ulsbU0jPSR7i$VQJV0&Yz6Kp9#JmqZR??Z-jOt zHuWhtuk@%VD;OBQd@Nr$thW)qZatRDSXA|WUVlyUCljQM@Muu!d%-^~*!LBf4D2Bz zI|9oAOrH(J4Pp_3y|~lxn2`p-i7kxHCdMPd#K7fgHQ-7cE_1EYf!ztg^n!dW(XA1G zr4EhXU8KzP_QXe~FyP-@UD#s)~+1)E3lX-v^1x@4|HKo21A$ZoWK z0gkn;gf{fML1M8?f8GB|X{VsSef2}1X z(Ebzkr~+TZgEO9aYTy_kYx9c7H?EaX&2A(>lYcZy4Hf{H1JVQ7NnhQQAh()o?piPW z#2SY}u(n0p-zB~wsTkS7?bsqrPTM}@79|7BP6P*xUV_0o0G!Wr<07rK3Bbekf*b?V ziD>!!uMbarwgS^%d^U~+5fX6d8ASq$AlTT#6o!q)rE#kCdiY-YPk?&(DGXLx)OJma z?8RDM(5f|F0Hh;e6#W1i&TVvXaBlQQK{OO%y!0%J9~OhrY_Zl;2L}9U1Q?ae(Oq1^ z8B0%7@RT`o_eA4i%*1(mrhsOU)TJfQrAW?r9^u9Fx_89>f zK#tarj`W=mG4=Sp$*JfbwH&U7Us$gd<`x~=a52DaM!}oL+hG1?MCt^++1K#GUdCXP z@J%o1RO>PF&mcoR6VORRPh&ea1FU?MK6pz@-=y!^JH|h4+#tc0u#{lo9)XFlMZ9_q zq;fJeo?d8>%{u!mURP>i;PmI#O~n$9t0f~x=r)^vv8!k=G#Fr6Wo&Jg4R z_PCrcJ&cEc`~d99Q^lKL)9Zz z26lskz(sM0GQqG~*QD^;#!dL~6PrG5|nHh9h6sgNMz^%0_@m$hhIbJl$8%o z8tgLH2>#_~b@wl}EVqgrB?oOao-P#X!kH6&4_GQB|%` zep#?(N0FZjQn&^cAuWZ*Cj9QXwXcb{I{g=Pg^t46Mc?C*T!@?1RWdEs z8R5cuiRL2xVuzhjma2O%V0!2^6tgM&gDf_%c+_gA+hnP7CPf2^5_LEDhE9l3@i|nv zG<4mgIFHeuzsix`UyKW98WZ+<9yuO<`nE)7r;@G(qgl16=uD3& zQAeHW*(s{Zk8opHJ}3h6o3_ZNEwX8g?B~!T%adeXkVVH6Pqkp%hd~fx6eH3BUwQ;F z${9x?Sx8mZR@EK1a1*Odme`F!CM{^sc|$2r`fy=v@L;(dt0vhcBDD(y3IiZlUU?h} zk>@6&uu8B3-(=Oh3!!fE5NC-?=Nk7d6dS{XLnOjVut$1;qMe^6 z8is_ueZVN=$%)9ZTZHUVK20dN06f9bf6BlSq?x-xT(=AsgFCts&4d}c2fs$^paJnh znuvRMFKn%(qc|*TW~+R^yt`H2-F%pAR(H4e_kek+UN3EaG&^DEE9Z@gJSnOL(;N{N zvUqNUEH0~uP5uZZ2uHVVOQ-RSj;oF!H6maV5UD|WcC>J4sd|! z7%Z#Mw~FmwBT&~?56ge>RFOI70MYQKU9{!QF4~Gk1)?N3{NdkLF?-g$*BV!2ZP6zH z>2ipiaXXXHM0-SvO(2d0yR2!)Fp6yA%Lo$N8?IHQ^W>lQ@7&o*SFxa|2J2P$?0$7; zXCDZeAobN7y;WfOJ3L(4*oi_wMr$D4mP0ih^*o2V$Iu)|L_mcApAqC-Y2zs6x>J~x z`**O=7ThB+0;Om^P7z|p&W`dXEwhJET>af>SFjjxjCazotwPJLcyQ;3T+7Hfx%0kg?!6qa7GrfS!B2Q>>gE3s;^}kJI6bw^?3rT`j$yHl}aXY;6%m z5lnT6jK_v^UAuWhAuEM_JRn$kBTUd@2{?2U;3h!cZ{hzDBP#`D&z!rBRQ1Dpl2)bE z1ji`rh}jyEeuJ##F~)RA715$RS3~B*!jo;#2*>ghti#N`(%xQ@{{PCIUB$IK3zZ*w zq;%C7Q`^?{PAxfUa~DBLhy%!;(be=`pDXuE+e%1x%7uV{3BSmm6yq!^^pjtU?qsAa`b8V(gqM`_&sFCo^b812Kf>pksyPrKef zhpu;?#HE7XaXAx0VHaaX&`CQ4IdAsmNsZ}(Fcl-&EBX+EWRDx*U2FmB1{&4Gl&3kTL;+O= zpX-yTl3zS8aEQEAO8pwr#GWVmbUo*<2+Yw*GU1k~?Q7L%bcW$UIV%ZKzuJF9Ep!;& zBezPW9ij3>tWRR((D39OL+QiG#YH7wr=5&m?@%hvH4?t*k)*+ag|Il#d*i0? zw;5FkuT}Uoz)}z^n?w#!pta}MgYc-dNSpCIa*N7JrB`W0!uvK7PCP401=8T)n0D

.`, où chaque élément est un numéro. Par exemple, « 1.11.3 ». - -* La valeur `` correspond au chapitre d'où provient l'exigence ; par exemple, toutes les exigences `1.#.#` proviennent du chapitre 'Encodage et nettoyage'. -* La valeur `
` correspond à la section de ce chapitre où apparaît l'exigence ; par exemple, toutes les exigences `1.2.#` se trouvent dans la section 'Prévention des injections' du chapitre 'Encodage et nettoyage'. -* La valeur `` identifie l'exigence spécifique au sein du chapitre et de la section, par exemple, `1.2.5` qui, dans la version 5.0.0 de ce référentiel, est : - -> Vérifiez que l'application protège contre l'injection de commandes du système d'exploitation et que les appels du système d'exploitation utilisent des requêtes OS paramétrées ou un encodage contextuel de la sortie de ligne de commande. - -Les identifiants pouvant varier d'une version à l'autre du référentiel, il est préférable, pour les autres documents, rapports ou outils, d'utiliser le format suivant : `v-.
.`, où 'version' correspond à la balise de version ASVS. Par exemple, 'v5.0.0-1.2.5' désigne spécifiquement la 5ème exigence de la section 'Prévention des injections' du chapitre 'Encodage et nettoyage' de la version 5.0.0. (Ceci pourrait être résumé par `v-`.) - -Remarque : Le `v` précédant le numéro de version dans le format doit toujours être en minuscule. - -Si des identifiants sont utilisés sans inclure l'élément `v`, ils doivent être considérés comme faisant référence au contenu le plus récent du Référentiel de vérification de la sécurité des applications. À mesure que le référentiel évolue, cela devient problématique ; c'est pourquoi les rédacteurs et les développeurs doivent inclure l'élément « version ». - -Les listes d'exigences de l'ASVS sont disponibles aux formats CSV, JSON et autres, utiles à des fins de référence ou d'utilisation programmatique. - -### Forker l'ASVS - -Les organisations peuvent tirer profit de l'adoption d'ASVS en choisissant l'un des trois niveaux ou en créant un fork spécifique au domaine qui ajuste les exigences en fonction du niveau de risque applicatif. Ce type de fork est encouragé, à condition de garantir la traçabilité de l'exigence 4.1.1, garantissant ainsi la même cohérence pour toutes les versions. - -Idéalement, chaque organisation devrait créer son propre ASVS personnalisé, en supprimant les sections non pertinentes (par exemple, GraphQL, Websockets, SOAP, si elles ne sont pas utilisées). Le fork doit commencer par le niveau 1 d'ASVS comme référence, puis progresser vers les niveaux 2 ou 3 en fonction du risque de l'application. - -## Cas d'utilisation de l'ASVS - -L'ASVS peut être utilisé pour évaluer la sécurité d'une application, ce point étant approfondi dans le chapitre suivant. Cependant, plusieurs autres utilisations potentielles de l'ASVS (ou d'une version dérivée) ont été identifiées. - -### En tant que conseil détaillé sur l'architecture de sécurité - -L'une des utilisations les plus courantes du Référentiel de vérification de la sécurité des applications (ASVS) est de servir de ressource aux architectes de sécurité. Les ressources disponibles pour construire une architecture applicative sécurisée sont limitées, notamment pour les applications modernes. L'ASVS peut combler ces lacunes en permettant aux architectes de sécurité de choisir de meilleurs contrôles pour les problèmes courants, tels que les modèles de protection des données et les stratégies de validation des entrées. Les exigences en matière d'architecture et de documentation seront particulièrement utiles à cet égard. - -### Référence spécialisée en developpement sécurisé - -L'ASVS peut servir de base à la préparation d'une référence de développement sécurisé lors du développement d'applications, aidant ainsi les développeurs à prendre en compte la sécurité lors de la création de logiciels. Bien que l'ASVS puisse servir de base, les organisations doivent élaborer leurs propres directives claires et unifiées, idéalement basées sur les recommandations des ingénieurs ou architectes de sécurité. De plus, les organisations sont encouragées, dans la mesure du possible, à préparer des mécanismes et bibliothèques de sécurité approuvés, référencés dans les directives et utilisables par les développeurs. - -### Guide pour les tests unitaires et d'intégration automatisés - -L'ASVS est conçu pour être hautement testable. Certaines vérifications seront techniques, tandis que d'autres exigences (telles que les exigences d'architecture et de documentation) pourront nécessiter une revue de documentation ou d'architecture. En créant des tests unitaires et d'intégration qui testent et analysent par fuzzing des cas d'abus spécifiques et pertinents liés aux exigences, vérifiables par des moyens techniques, il devrait être plus facile de vérifier le bon fonctionnement de ces contrôles à chaque build. Par exemple, des tests supplémentaires peuvent être créés pour la suite de tests d'un contrôleur de connexion afin de tester la présence de valeur par défaut courante pour le paramètre username, l'énumération des comptes, le force brute, l'injection LDAP et SQL, et les attaques XSS. De même, un test sur le paramètre password doit inclure les mots de passe courants, la longueur des mots de passe, l'injection d'octets nuls, la suppression du paramètre, les attaques XSS, etc. - -### Pour la formation au développement sécurisé - -L'ASVS peut également servir à définir les caractéristiques d'un logiciel sécurisé. De nombreux cours de « codage sécurisé » se résument à des cours de piratage éthique, avec quelques conseils de codage. Cela n'aide pas forcément les développeurs à écrire du code plus sécurisé. Les cours de développement sécurisé peuvent plutôt utiliser l'ASVS en mettant l'accent sur ses mécanismes positifs, plutôt que sur les 10 principes négatifs à éviter. La structure de l'ASVS offre également une structure logique pour aborder les différents sujets liés à la sécurisation d'une application. - -### En tant que cadre pour l'approvisionnement des logiciels sécurisés - -L'ASVS est un cadre idéal pour faciliter l'approvisionnement des logiciels sécurisés ou l'acquisition de services de développement de développement sur mesure. L'acheteur peut simplement exiger que le logiciel qu'il souhaite acquérir soit développé au niveau X de l'ASVS et demander au vendeur de prouver que le logiciel satisfait à ce niveau. - -## Appliquer l'ASVS en pratique - -Les menaces varient selon les motivations. Certains secteurs disposent de ressources informatiques et technologiques spécifiques et d'exigences de conformité réglementaire spécifiques à leur domaine. - -Il est fortement recommandé aux organisations d'analyser en profondeur les caractéristiques de risque spécifiques à leur activité et de déterminer le niveau d'ASVS approprié en fonction de ces risques et des exigences métier. diff --git a/5.0/fr/0x04-Assessment_and_Certification.md b/5.0/fr/0x04-Assessment_and_Certification.md deleted file mode 100644 index b6805320ce..0000000000 --- a/5.0/fr/0x04-Assessment_and_Certification.md +++ /dev/null @@ -1,47 +0,0 @@ -# Évaluation et certification - -## Position de l'OWASP sur les certifications et marques de confiance ASVS - -L'OWASP, en tant qu'organisation à but non lucratif neutre, ne certifie actuellement aucun vendeur, vérificateur ou logiciel. Toutes ces assertions d'assurance, marques de confiance ou certifications ne sont pas officiellement vérifiées, enregistrées ou certifiées par l'OWASP, de sorte qu'une organisation qui s'appuie sur ce point de vue doit être prudente quant à la confiance placée dans une tierce partie ou une marque de confiance revendiquant la certification ASVS. - -Cela ne devrait pas empêcher les organisations d'offrir de tels services d'assurance, tant qu'elles ne revendiquent pas la certification officielle de l'OWASP. - -## Comment vérifier la conformité ASVS - -L'ASVS n'est volontairement pas prescriptif quant à la manière précise de vérifier la conformité au niveau d'un guide de tests. Il est toutefois important de souligner certains points clés. - -### Rapport de vérification - -Les tests d'intrusion traditionnels signalent les problèmes « par exception », en ne listant que les échecs. Cependant, un rapport de certification ASVS doit inclure le périmètre, un résumé de toutes les exigences vérifiées, les exigences pour lesquelles des exceptions ont été constatées et des conseils pour résoudre les problèmes. Certaines exigences peuvent ne pas être applicables (par exemple, la gestion des sessions dans les API sans état), et cela doit être mentionné dans le rapport. - -### Périmètre de la vérification - -Une organisation développant une application n'implémentera généralement pas toutes les exigences, certaines pouvant être non pertinentes ou moins importantes selon les fonctionnalités de l'application. Le vérificateur doit préciser le périmètre de la vérification, notamment le niveau que l'organisation souhaite atteindre et les exigences incluses. Il doit s'agir de ce qui a été inclus plutôt que de ce qui ne l'a pas été. Il doit également fournir un avis sur les raisons justifiant l'exclusion des exigences non implémentées. - -Cela devrait permettre au consommateur d’un rapport de vérification de comprendre le contexte de la vérification et de prendre une décision éclairée sur le niveau de confiance qu’il peut accorder à l’application. - -Les organismes de certification peuvent choisir leurs méthodes de test, mais devraient les indiquer dans le rapport, et elles devraient idéalement être reproductibles. Différentes méthodes, comme les tests d'intrusion manuels ou l'analyse du code source, peuvent être utilisées pour vérifier des aspects tels que la validation des entrées, selon l'application et les exigences. - -### Mécanismes de vérification - -Plusieurs techniques différentes peuvent être utilisées pour vérifier une même exigence ASVS. Outre les tests d'intrusion (utilisant des "credentials" valides pour une couverture complète de l'application), la vérification des exigences ASVS peut nécessiter l'accès à la documentation, au code source, à la configuration et aux personnes impliquées dans le processus de développement. Ceci est particulièrement vrai pour la vérification des exigences L2 et L3. Il est courant de fournir des preuves solides des résultats au moyen d'une documentation détaillée, pouvant inclure des documents de travail, des captures d'écran, des scripts et des journaux de tests. L'exécution d'un outil automatisé sans tests approfondis ne suffit pas à obtenir la certification, car chaque exigence doit être testée de manière vérifiable. - -L'utilisation de l'automatisation pour vérifier les exigences ASVS est un sujet qui suscite un intérêt constant. Il est donc important de clarifier certains points relatifs aux tests automatisés et en boîte noire. - -#### Le rôle des outils de test de sécurité automatisés - -Lorsque des outils de tests de sécurité automatisés, tels que les tests de sécurité dynamiques et statiques des applications (DAST et SAST), sont correctement implémentés dans le pipeline de développement, ils peuvent identifier des problèmes de sécurité qui ne devraient jamais exister. Cependant, sans une configuration et un réglage minutieux, ils n'offriront pas la couverture requise et leur niveau de bruit empêchera l'identification et la résolution des véritables problèmes de sécurité. - -Bien que cela puisse couvrir certaines des exigences techniques les plus basiques et les plus simples, telles que celles relatives à l'encodage ou à l'assainissement de sortie, il est essentiel de noter que ces outils ne seront pas entièrement en mesure de vérifier bon nombre des exigences ASVS les plus complexes ou celles liées à la logique métier et au contrôle d'accès. - -Pour les exigences moins simples, l'automatisation reste probablement envisageable, mais des vérifications spécifiques à l'application devront être écrites pour y parvenir. Ces vérifications peuvent être similaires aux tests unitaires et d'intégration déjà utilisés par l'organisation. Il est donc possible d'utiliser l'infrastructure d'automatisation des tests existante pour écrire ces tests spécifiques à ASVS. Bien que cela nécessite un investissement à court terme, les avantages à long terme de la vérification continue des exigences ASVS seront significatifs. - -En résumé, testable en utilisant l'automatisation != exécuter un outil sur étagère. - -#### Le rôle des tests de pénétration - -Bien que L1 dans la version 4.0 ait été optimisé pour les tests de « boîte noire » (sans documentation et sans source), même dans ce cas, le standard était clair sur le fait qu'il ne s'agissait pas d'une activité d'assurance efficace et qu'elle devait être activement découragée. - -Les tests sans accès aux informations supplémentaires nécessaires constituent un mécanisme sous-productifs et inefficaces de vérification de la sécurité, car ils ne permettent pas d’examiner le code source, d’identifier les menaces et les contrôles manquants, et d’effectuer un test beaucoup plus approfondi dans un délai plus court. - -Il est fortement encouragé d'effectuer des tests d'intrusion basés sur la documentation ou le code source (hybrides), avec un accès complet aux développeurs et à la documentation de l'application, plutôt que des tests d'intrusion traditionnels. Cela sera certainement nécessaire pour vérifier de nombreuses exigences ASVS. diff --git a/5.0/fr/0x05-For-Users-Of-4.0.md b/5.0/fr/0x05-For-Users-Of-4.0.md deleted file mode 100644 index be7360d367..0000000000 --- a/5.0/fr/0x05-For-Users-Of-4.0.md +++ /dev/null @@ -1,90 +0,0 @@ -# Modifications par rapport à la version 4.x - -## Introduction - -Les utilisateurs familiarisés avec la version 4.x du référentiel trouveront utile de consulter les principales modifications apportées à la version 5.0, notamment les mises à jour de contenu, de périmètre et de philosophie sous-jacente. - -Sur les 286 exigences de la version 4.0.3, seules 11 restent inchangées, tandis que 15 ont subi des ajustements grammaticaux mineurs sans altérer leur sens. Au total, 109 exigences (38 %) ne sont plus des exigences distinctes dans la version 5.0 : 50 ont été simplement supprimées, 28 ont été supprimées car doublons et 31 ont été fusionnées avec d'autres exigences. Les autres ont été révisées. Même les exigences n'ayant pas subi de modifications substantielles ont des identifiants différents à la suite d'une réorganisation ou une restructuration. - -Pour faciliter l'adoption de la version 5.0, des documents de correspondance sont fournis pour aider les utilisateurs à identifier les correspondances entre les exigences de la version 4.x et celles de la version 5.0. Ces correspondances ne sont pas liées au numéro de version et peuvent être mises à jour ou clarifiées si nécessaire. - -## Philosophie des exigences - -### Périmètre et orientation - -La version 4.x incluait des exigences qui ne correspondaient pas au périmètre prévu du référentiel ; celles-ci ont été supprimées. Les exigences qui ne répondaient pas aux critères du périmètre de la version 5.0 ou qui n'étaient pas vérifiables ont également été exclues. - -### Priorité aux objectifs de sécurité plutôt qu'aux mécanismes - -Dans la version 4.x, de nombreuses exigences se concentraient sur des mécanismes spécifiques plutôt que sur les objectifs de sécurité sous-jacents. Dans la version 5.0, les exigences sont centrées sur les objectifs de sécurité, ne référençant des mécanismes particuliers que lorsqu'ils constituent la seule solution pratique, ou les fournissant à titre d'exemple ou de conseil complémentaire. - -Cette approche reconnaît que plusieurs méthodes peuvent exister pour atteindre un objectif de sécurité donné et évite toute prescription inutile susceptible de limiter la flexibilité organisationnelle. - -De plus, les exigences traitant d'une même préoccupation de sécurité ont été consolidées lorsque cela était opportun. - -### Décisions de sécurité documentées - -Bien que le concept de décisions de sécurité documentées puisse paraître nouveau dans la version 5.0, il s'agit d'une évolution des exigences antérieures liées à l'application des politiques et à la modélisation des menaces dans la version 4.0. Auparavant, certaines exigences exigeaient implicitement une analyse pour éclairer la mise en œuvre des contrôles de sécurité, comme la détermination des connexions réseau autorisées. - -Afin de garantir la disponibilité des informations nécessaires à la mise en œuvre et à la vérification, ces attentes sont désormais explicitement définies comme des exigences de documentation, ce qui les rend claires, actionnables et vérifiables. - -## Modifications structurelles et nouveaux chapitres - -Plusieurs chapitres de la version 5.0 introduisent du contenu entièrement nouveau : - -* OAuth et OIDC – Compte tenu de l’adoption généralisée de ces protocoles pour la délégation d’accès et l’authentification unique, des exigences spécifiques ont été ajoutées pour répondre aux divers scénarios rencontrés par les développeurs. Ce domaine pourrait à terme évoluer vers une norme autonome, similaire à la gestion des exigences mobiles et IoT dans les versions précédentes. -* WebRTC – Avec la popularité croissante de cette technologie, ses considérations et défis de sécurité spécifiques sont désormais abordés dans une section dédiée. - -Des efforts ont également été déployés pour garantir que les chapitres et sections soient organisés autour d’ensembles cohérents d’exigences connexes. - -Cette restructuration a conduit à la création de chapitres supplémentaires : - -* Jetons autonomes – Auparavant regroupés sous la rubrique « gestion de session », les jetons autonomes sont désormais reconnus comme un mécanisme distinct et un élément fondamental de la communication sans état (comme dans OAuth et OIDC). En raison de leurs implications spécifiques en matière de sécurité, elles sont traitées dans un chapitre dédié, avec l'introduction de nouvelles exigences dans la version 5.x. -* Sécurité du frontend web – Avec la complexité croissante des applications basées sur un navigateur et l'essor des architectures exclusivement basées sur des API, les exigences de sécurité du frontend ont été séparées dans un chapitre dédié. -* Codage et architecture sécurisés – Les nouvelles exigences concernant les pratiques de sécurité générales qui ne cadraient pas avec les chapitres existants ont été regroupées ici. - -D'autres modifications organisationnelles ont été apportées à la version 5.0 afin de clarifier l'intention. Par exemple, les exigences de validation des entrées ont été déplacées avec la logique métier, reflétant ainsi leur rôle dans l'application des règles métier, plutôt que d'être regroupées avec le nettoyage et l'encodage. - -L'ancien chapitre « Architecture » ​​de la version 1 a été supprimé. Sa section initiale contenait des exigences hors du périmètre, tandis que les sections suivantes ont été redistribuées aux chapitres concernés, les exigences étant dédupliquées et clarifiées si nécessaire. - -## Suppression des correspondances directes avec d'autres normes - -Les correspondances directes avec d'autres normes ont été supprimées du corps du référentiel. L'objectif est de préparer une correspondance avec le projet OWASP Common Requirement Enumeration (CRE), qui reliera ASVS à divers projets OWASP et normes externes. - -Les correspondances directes avec CWE et NIST ne sont plus maintenues, comme expliqué ci-dessous. - -### Couplage réduit avec les directives du NIST sur l'identité numérique - -Les directives du NIST sur l'identité numérique (SP 800-63) (https://pages.nist.gov/800-63-3/) servent depuis longtemps de référence pour les contrôles d'authentification et d'autorisation. Dans la version 4.x, certains chapitres étaient étroitement alignés sur la structure et la terminologie du NIST. - -Si ces directives demeurent une référence importante, un alignement strict a engendré des difficultés, notamment une terminologie moins reconnue, la duplication d'exigences similaires et des correspondances incomplètes. La version 5.0 s'éloigne de cette approche pour plus de clarté et de pertinence. - -### S'éloigner de l'énumération des faiblesses communes (CWE) - -L'[Énumération des Faiblesses Communes (CWE)](https://cwe.mitre.org/) fournit une taxonomie utile des faiblesses de sécurité logicielle. Cependant, des défis tels que les CWE par catégorie, les difficultés de correspondance des exigences à une CWE unique et la présence de mappages imprécis dans la version 4.x ont conduit à la décision d'abandonner les mappages CWE directs dans la version 5.0. - -## Repenser les définitions de niveaux - -La version 4.x décrivait les niveaux comme L1 (« Minimum »), L2 (« Standard ») et L3 (« Avancé »), ce qui implique que toutes les applications manipulant des données sensibles doivent au moins atteindre le niveau L2. - -La version 5.0 corrige plusieurs problèmes liés à cette approche, décrits dans les paragraphes suivants. - -En pratique, alors que la version 4.x utilisait des graduations pour les indicateurs de niveau, la version 5.x utilise un simple numéro pour tous les formats du référentiel, notamment Markdown, PDF, DOCX, CSV, JSON et XML. Pour des raisons de rétrocompatibilité, les anciennes versions des sorties CSV, JSON et XML utilisant encore des graduations sont également générées. - -### Niveau d'entrée simplifié - -Les retours ont indiqué que le nombre important d'exigences de niveau 1 (environ 120), combiné à sa désignation comme niveau « minimum », insuffisant pour la plupart des applications, freinait l'adoption. La version 5.0 vise à lever cet obstacle en définissant le niveau 1 principalement autour des exigences de défense de première couche, ce qui se traduit par des exigences plus claires et moins nombreuses à ce niveau. À titre d'exemple, la version 4.0.3 comptait 128 exigences de niveau 1 sur un total de 278, soit 46 %. La version 5.0.0 compte 70 exigences de niveau 1 sur un total de 345, soit 20 %. - -### L'illusion de la testabilité - -Un facteur clé dans le choix des contrôles de niveau 1 dans la version 4.x était leur aptitude à être évalués par des tests d'intrusion externes de type « boîte noire ». Cependant, cette approche n'était pas totalement conforme à l'objectif du niveau 1 en tant qu'ensemble minimal de contrôles de sécurité. Certains utilisateurs ont fait valoir que le niveau 1 était insuffisant pour sécuriser les applications, tandis que d’autres ont trouvé qu’il était trop difficile à tester. - -S'appuyer sur la testabilité comme critère est à la fois relatif et parfois trompeur. Le fait qu'une exigence soit testable ne garantit pas qu'elle puisse être testée de manière automatisée ou simple. De plus, les exigences les plus facilement testables ne sont pas toujours celles qui ont le plus grand impact sur la sécurité ou les plus simples à mettre en œuvre. - -Par conséquent, dans la version 5.0, les décisions de niveau ont été prises principalement en fonction de la réduction des risques et en tenant compte de l'effort de mise en œuvre. - -### Pas seulement une question de risque - -L'utilisation de niveaux prescriptifs, basés sur les risques, imposant un niveau spécifique à certaines applications s'est avérée trop rigide. En pratique, la priorisation et la mise en œuvre des contrôles de sécurité dépendent de multiples facteurs, notamment la réduction des risques et les efforts nécessaires à leur mise en œuvre. - -Par conséquent, les organisations sont encouragées à atteindre le niveau qu'elles estiment devoir atteindre en fonction de leur maturité et du message qu'elles souhaitent transmettre à leurs utilisateurs. diff --git a/5.0/fr/0x10-V1-Encoding-and-Sanitization.md b/5.0/fr/0x10-V1-Encoding-and-Sanitization.md deleted file mode 100644 index 6c022ba7a5..0000000000 --- a/5.0/fr/0x10-V1-Encoding-and-Sanitization.md +++ /dev/null @@ -1,103 +0,0 @@ -# V1 Encodage et nettoyage - -## Objectif de contrôle - -Ce chapitre aborde les failles de sécurité les plus courantes des applications web liées au traitement non sécurisé de données non fiables. Ces failles peuvent entraîner diverses vulnérabilités techniques, où les données non fiables sont interprétées selon les règles syntaxiques de l'interpréteur concerné. - -Pour les applications web modernes, il est toujours préférable d'utiliser des API plus sûres, telles que les requêtes paramétrées, l'échappement automatique ou les Framework de création de modèles. Dans le cas contraire, un encodage, un échappement ou un nettoyage des sorties soigneusement effectués deviennent essentiels à la sécurité de l'application. - -La validation des entrées constitue un mécanisme de défense en profondeur contre les contenus inattendus ou dangereux. Cependant, son objectif principal étant de garantir que le contenu entrant répond aux attentes fonctionnelles et métier, les exigences afférentes sont décrites dans le chapitre « Validation et logique métier ». - -## V1.1 Architecture d'encodage et de nettoyage - -Les sections ci-dessous présentent les exigences spécifiques à la syntaxe ou à l'interpréteur pour traiter en toute sécurité les contenus non sécurisés afin d'éviter les failles de sécurité. Ces exigences précisent l'ordre et le lieu de traitement. Elles visent également à garantir que les données soient stockées dans leur état d'origine et ne soient pas stockées sous une forme encodée ou échappée (par exemple, encodage HTML), afin d'éviter les problèmes de double encodage. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **1.1.1** | Vérifiez que l'entrée est décodée ou non échappée vers une forme canonique une seule fois, elle n'est décodée que lorsque des données codées sous cette forme sont attendues, et que cela est fait avant de traiter davantage l'entrée, par exemple, elle n'est pas effectuée après la validation ou la désinfection de l'entrée. | 2 | -| **1.1.2** | Vérifiez que l'application effectue l'encodage et l'échappement de sortie soit comme étape finale avant d'être utilisée par l'interpréteur pour lequel elle est destinée, soit par l'interpréteur lui-même. | 2 | - -## V1.2 Prévention des injections - -L'encodage ou l'échappement de sortie, effectué à proximité d'un contexte potentiellement dangereux, est essentiel pour la sécurité de toute application. Généralement, l'encodage et l'échappement de sortie ne sont pas conservés, mais servent à sécuriser la sortie pour une utilisation immédiate dans l'interpréteur approprié. Une tentative d'exécution trop précoce peut entraîner une altération du contenu ou rendre l'encodage ou l'échappement inefficaces. - -Dans de nombreux cas, les bibliothèques logicielles incluent des fonctions sûres ou plus sûres qui exécutent cela automatiquement, même s'il est nécessaire de s'assurer qu'elles sont correctes pour le contexte actuel. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **1.2.1** | Vérifiez que l'encodage de sortie d'une réponse HTTP, d'un document HTML ou d'un document XML est pertinent pour le contexte requis, comme l'encodage des caractères pertinents pour les éléments HTML, les attributs HTML, les commentaires HTML, les CSS ou les champs d'en-tête HTTP, pour éviter de modifier la structure du message ou du document. | 1 | -| **1.2.2** | Vérifiez que, lors de la création dynamique d'URL, les données non fiables sont encodées en fonction de leur contexte (par exemple, encodage d'URL ou encodage base64url pour les paramètres de requête ou de chemin). Assurez-vous que seuls les schémas d'URL sûrs sont autorisés (par exemple, interdire javascript: ou data:). | 1 | -| **1.2.3** | Vérifiez que l'encodage ou l'échappement de sortie est utilisé lors de la création dynamique de contenu JavaScript (y compris JSON), pour éviter de modifier la structure du message ou du document (pour éviter l'injection JavaScript et JSON). | 1 | -| **1.2.4** | Vérifiez que la sélection de données ou les requêtes de base de données (par exemple, SQL, HQL, NoSQL, Cypher) utilisent des requêtes paramétrées, des ORM, des Framework d'entités ou sont protégées contre les injections SQL et autres attaques par injection de base de données. Ceci est également pertinent lors de l'écriture de procédures stockées. | 1 | -| **1.2.5** | Vérifiez que l’application protège contre l’injection de commandes du système d’exploitation et que les appels du système d’exploitation utilisent des requêtes du système d’exploitation paramétrées ou utilisent un encodage de sortie de ligne de commande contextuelle. | 1 | -| **1.2.6** | Vérifiez que l’application protège contre les vulnérabilités d’injection LDAP ou que des contrôles de sécurité spécifiques pour empêcher l’injection LDAP ont été mis en œuvre. | 2 | -| **1.2.7** | Vérifiez que l’application est protégée contre les attaques par injection XPath en utilisant la paramétrisation des requêtes ou des requêtes précompilées. | 2 | -| **1.2.8** | Vérifiez que les processeurs LaTeX sont configurés de manière sécurisée (par exemple, en n'utilisant pas l'indicateur « --shell-escape ») et qu'une liste d’autorisations de commandes est utilisée pour empêcher les attaques par injection LaTeX. | 2 | -| **1.2.9** | Vérifiez que l'application échappe les caractères spéciaux dans les expressions régulières (généralement à l'aide d'une barre oblique inverse) pour éviter qu'ils ne soient mal interprétés comme des métacaractères. | 2 | -| **1.2.10** | Vérifiez que l'application est protégée contre les injections CSV et injections de formules. L'application doit respecter les règles d'échappement définies dans les sections 2.6 et 2.7 de la RFC 4180 lors de l'export de contenu CSV. De plus, lors de l'export au format CSV ou vers d'autres formats de tableur (tels que XLS, XLSX ou ODF), les caractères spéciaux (notamment « = », « + », « - », « @ », « \t » (tabulation) et « \0 » (caractère null)) doivent être protégés par une apostrophe s'ils apparaissent en premier dans une valeur de champ. | 3 | - -Remarque : L'utilisation de requêtes paramétrées ou l'échappement SQL ne sont pas toujours suffisants. Les parties de requête telles que les noms de table et de colonne (y compris les noms de colonne « ORDER BY ») ne peuvent pas être échappées. L'inclusion de données utilisateur échappées dans ces champs entraîne l'échec des requêtes ou une injection SQL. - -## V1.3 Nettoyage - -La protection idéale contre l'utilisation de contenu non fiable dans un contexte dangereux est d'utiliser un encodage ou un échappement spécifique au contexte, qui conserve la même signification sémantique du contenu dangereux mais le rend sûr pour une utilisation dans ce contexte particulier, comme expliqué plus en détail dans la section précédente. - -Lorsque cela n'est pas possible, un nettoyage devient nécessaire, supprimant les caractères ou contenus potentiellement dangereux. Dans certains cas, cela peut modifier la signification sémantique de la saisie, mais pour des raisons de sécurité, il peut n'y avoir aucune autre solution. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **1.3.1** | Vérifiez que toutes les entrées HTML non fiables provenant d'éditeurs WYSIWYG ou similaires sont nettoyées à l'aide d'une bibliothèque ou d'une fonctionnalité de Framework de nettoyage HTML bien connue et sécurisée. | 1 | -| **1.3.2** | Vérifiez que l'application évite d'utiliser eval() ou d'autres fonctionnalités d'exécution de code dynamique telles que Spring Expression Language (SpEL). En l'absence d'alternative, toute saisie utilisateur incluse doit être nettoyée avant d'être exécutée. | 1 | -| **1.3.3** | Vérifiez que les données transmises à un contexte potentiellement dangereux sont préalablement nettoyées pour appliquer des mesures de sécurité, telles qu'autoriser uniquement des caractères sûrs pour ce contexte et raccourcir des entrées trop longues. | 2 | -| **1.3.4** | Vérifiez que le contenu Scalable Vector Graphics (SVG) scriptable fourni par l'utilisateur est validé ou nettoyé pour contenir uniquement des balises et des attributs (tels que des graphiques de dessin) qui sont sûrs pour l'application, par exemple, ne contiennent pas de scripts et d'objets étrangers. | 2 | -| **1.3.5** | Vérifiez que l'application nettoie ou désactive le contenu du langage de modèle d'expression ou de script fourni par l'utilisateur, tel que les feuilles de style CSS, le Markdown ou XSL, BBCode ou similaire. | 2 | -| **1.3.6** | Vérifiez que l'application protège contre les attaques de falsification de requête côté serveur (SSRF), en validant les données non fiables par rapport à une liste d'autorisation de protocoles, de domaines, de chemins et de ports et en nettoyant les caractères potentiellement dangereux avant d'utiliser les données pour appeler un autre service. | 2 | -| **1.3.7** | Vérifiez que l'application se protège contre les attaques par injection de modèles en interdisant la création de modèles basés sur des entrées non fiables. En l'absence d'alternative, toute entrée non fiable incluse dynamiquement lors de la création du modèle doit être nettoyée ou rigoureusement validée. | 2 | -| **1.3.8** | Vérifiez que l’application nettoie correctement les entrées non fiables avant utilisation dans les requêtes Java Naming and Directory Interface (JNDI) et que JNDI est configuré de manière sécurisée pour empêcher les attaques par injection JNDI. | 2 | -| **1.3.9** | Vérifiez que l’application nettoie le contenu avant qu’il ne soit envoyé à memcache pour éviter les attaques par injection. | 2 | -| **1.3.10** | Vérifiez que les chaînes de format susceptibles d'être résolues de manière inattendue ou malveillante lors de leur utilisation sont nettoyées avant d'être traitées. | 2 | -| **1.3.11** | Vérifiez que l'application nettoie les entrées utilisateur avant de les transmettre aux systèmes de messagerie pour se protéger contre l'injection SMTP ou IMAP. | 2 | -| **1.3.12** | Vérifiez que les expressions régulières sont exemptes d'éléments provoquant "backtracking" exponentiel et assurez-vous que les entrées non fiables sont nettoyées pour atténuer les attaques ReDoS ou Runaway Regex. | 3 | - -## V1.4 Mémoire, chaine de caractères et code à mémoire non-managée - -Les exigences suivantes traitent des risques associés à une utilisation non sécurisée de la mémoire, qui s’appliquent généralement lorsque l’application utilise un langage système ou un code à mémoire non-managée. - -Dans certains cas, il peut être possible d'y parvenir en définissant des indicateurs de compilateur qui activent les protections contre les dépassements de tampon et les avertissements, y compris la randomisation de la pile et la prévention de l'exécution des données, et qui interrompent la construction si des opérations de pointeur, de mémoire, de chaîne de format, d'entier ou de chaine de caractères non sûres sont trouvées. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **1.4.1** | Vérifiez que l'application utilise des chaînes memory-safe, une copie de mémoire et une arithmétique de pointeur renforcée pour détecter ou empêcher les débordements de pile, de tampon ou de tas. | 2 | -| **1.4.2** | Vérifiez que les techniques de validation du signe, de la plage et de l’entrée sont utilisées pour éviter les dépassements d’entiers. | 2 | -| **1.4.3** | Vérifiez que la mémoire et les ressources allouées dynamiquement sont libérées et que les références ou les pointeurs vers la mémoire libérée sont supprimés ou définis à null pour éviter les "dangling pointer" et les vulnérabilités d'utilisation après libération. | 2 | - -## V1.5 Désérialisation sécurisée - -La conversion de données stockées ou transmises en objets applicatifs (désérialisation) a toujours été à l'origine de diverses vulnérabilités par injection de code. Il est important d'effectuer ce processus avec précaution et de manière sécurisée pour éviter ce type de problèmes. - -En particulier, certaines méthodes de désérialisation ont été identifiées par la documentation des langages de programmation ou des Framework comme étant non sécurisées et ne peuvent être sécurisées avec des données non fiables. Pour chaque mécanisme utilisé, une vérification rigoureuse doit être effectuée. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **1.5.1** | Vérifiez que l'application configure les "parser" XML pour utiliser une configuration restrictive et que les fonctionnalités non sûres telles que la résolution d'entités externes sont désactivées pour empêcher les attaques XML eXternal Entity (XXE). | 1 | -| **1.5.2** | Vérifiez que la désérialisation des données non fiables garantit une gestion sécurisée des entrées, par exemple en utilisant une liste d'autorisation de types d'objets ou en limitant les types d'objets définis par le client, afin d'empêcher les attaques par désérialisation. Les mécanismes de désérialisation explicitement définis comme non sécurisés ne doivent pas être utilisés avec des entrées non fiables. | 2 | -| **1.5.3** | Vérifiez que les différents "parser" utilisés dans l'application pour le même type de données (par exemple, les "parser" JSON, les "parser" XML, les "parser" d'URL) effectuent l'analyse de manière cohérente et utilisent le même mécanisme d'encodage de caractères pour éviter des problèmes tels que les vulnérabilités d'interopérabilité JSON ou un comportement d'analyse d'URI ou de fichier différent exploité dans les attaques d'inclusion de fichiers à distance (RFI) ou de falsification de requête côté serveur (SSRF). | 3 | - -## Références - -Pour plus d'informations, voir également : - -* [OWASP LDAP Injection Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html) -* [OWASP Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) -* [OWASP DOM Based Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html) -* [OWASP XML External Entity Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html) -* [OWASP Web Security Testing Guide: Client-Side Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/11-Client-side_Testing) -* [OWASP Java Encoding Project](https://owasp.org/owasp-java-encoder/) -* [DOMPurify - Client-side HTML Sanitization Library](https://github.com/cure53/DOMPurify) -* [RFC4180 - Common Format and MIME Type for Comma-Separated Values (CSV) Files](https://datatracker.ietf.org/doc/html/rfc4180#section-2) - -Pour plus d'informations, notamment sur les problèmes de désérialisation ou d'analyse, veuillez consulter : - -* [OWASP Deserialization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) -* [An Exploration of JSON Interoperability Vulnerabilities](https://bishopfox.com/blog/json-interoperability-vulnerabilities) -* [Orange Tsai - A New Era of SSRF Exploiting URL Parser In Trending Programming Languages](https://www.blackhat.com/docs/us-17/thursday/us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf) diff --git a/5.0/fr/0x11-V2-Validation-and-Business-Logic.md b/5.0/fr/0x11-V2-Validation-and-Business-Logic.md deleted file mode 100644 index 98c9dec4b1..0000000000 --- a/5.0/fr/0x11-V2-Validation-and-Business-Logic.md +++ /dev/null @@ -1,73 +0,0 @@ -# V2 Validation et logique métier - -## Objectif de contrôle - -Ce chapitre vise à garantir qu'une application vérifiée répond aux objectifs de haut niveau suivants : - -* Les entrées reçues par l'application correspondent aux attentes métier ou fonctionnelles. -* Le flux logique métier est séquentiel, traité dans l’ordre et ne peut pas être contourné. -* La logique métier inclut des limites et des contrôles pour détecter et prévenir les attaques automatisées, telles que les transferts continus de petits fonds ou l'ajout d'un million d'amis un par un. -* Les flux logiques métier à haute valeur ajoutée ont pris en compte les cas d'abus et les acteurs malveillants, et disposent de protections contre l'usurpation d'identité, la falsification, la divulgation d'informations et les attaques par élévation de privilèges. - -## V2.1 Validation et documentation de la logique métier - -La documentation de validation et de logique métier doit définir clairement les limites de la logique métier, les règles de validation et la cohérence contextuelle des éléments de données combinés, afin que ce qui doit être implémenté dans l'application soit clair. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **2.1.1** | Vérifiez que la documentation de l'application définit des règles de validation des entrées pour vérifier la validité des éléments de données par rapport à la structure attendue. Il peut s'agir de formats de données courants tels que des numéros de carte de crédit, des adresses e-mail ou des numéros de téléphone, ou d'un format de données interne. | 1 | -| **2.1.2** | Vérifiez que la documentation de l'application définit comment valider la cohérence logique et contextuelle des éléments de données combinés, par exemple en vérifiant que la banlieue et le code postal correspondent. | 2 | -| **2.1.3** | Vérifiez que les attentes en matière de limites et de validations de la logique métier sont documentées, y compris par utilisateur et globalement dans l'application. | 2 | - -## V2.2 Validation des entrées - -Des contrôles de validation des entrées efficaces renforcent les attentes métier ou fonctionnelles concernant le type de données que l'application s'attend à recevoir. Cela garantit une bonne qualité des données et réduit la surface d'attaque. Cependant, cela ne supprime ni ne remplace la nécessité d'utiliser un codage, un paramétrage ou un nettoyage corrects lors de l'utilisation des données dans un autre composant ou pour leur présentation en sortie. - -Dans ce contexte, les « entrées » peuvent provenir d'une grande variété de sources, notamment des champs de formulaire HTML, des requêtes REST, des paramètres d'URL, des champs d'en-tête HTTP, des cookies, des fichiers sur disque, des bases de données et des API externes. - -Un contrôle de logique métier peut vérifier qu'une entrée particulière est un nombre inférieur à 100. Une attente fonctionnelle peut vérifier qu'un nombre est inférieur à un certain seuil, car ce nombre contrôle le nombre de fois qu'une boucle particulière aura lieu, et un nombre élevé pourrait entraîner un traitement excessif et une condition potentielle de déni de service. - -Bien que la validation de schéma ne soit pas explicitement obligatoire, elle peut être le mécanisme le plus efficace pour une couverture de validation complète des API HTTP ou d'autres interfaces qui utilisent JSON ou XML. - -Veuillez noter les points suivants concernant la validation du schéma : - -* La « version publiée » de la spécification de validation du schéma JSON est considérée comme prête pour la production, mais pas à proprement parler « stable ». Lorsque vous utilisez la validation du schéma JSON, assurez-vous qu'il n'y a aucune lacune par rapport aux instructions des exigences ci-dessous. -* Toutes les bibliothèques de validation de schéma JSON utilisées doivent également être surveillées et mises à jour si nécessaire une fois la norme formalisée. -* La validation DTD ne doit pas être utilisée et l'évaluation DTD du Framework doit être désactivée pour éviter les problèmes liés aux attaques XXE contre les DTD. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **2.2.1** | Vérifier que les entrées sont validées afin de respecter les attentes métier ou fonctionnelles. Cette validation doit être basée sur une liste de valeurs, de modèles et de plages autorisées, ou sur la comparaison des entrées avec une structure attendue et des limites logiques selon des règles prédéfinies. Pour le niveau 1, cette validation peut se concentrer sur les entrées utilisées pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau 2, elle doit s'appliquer à toutes les entrées. | 1 | -| **2.2.2** | Vérifiez que l'application est conçue pour appliquer la validation des entrées au niveau d'une couche de service de confiance. Bien que la validation côté client améliore l'ergonomie et doit être encouragée, elle ne doit pas être considérée comme un contrôle de sécurité. | 1 | -| **2.2.3** | Vérifiez que l’application garantit que les combinaisons d’éléments de données associés sont raisonnables selon les règles prédéfinies. | 2 | - -## V2.3 Sécurité de la logique métier - -Cette section examine les exigences clés pour garantir que l’application applique les processus de logique métier de manière correcte et n’est pas vulnérable aux attaques qui exploitent la logique et le flux de l’application. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **2.3.1** | Vérifiez que l’application traitera uniquement les flux de logique métier pour le même utilisateur dans l’ordre séquentiel attendu et sans sauter d’étapes. | 1 | -| **2.3.2** | Vérifiez que les limites de la logique métier sont implémentées conformément à la documentation de l'application, afin d'éviter que des failles de la logique métier ne soient pas exploitées. | 2 | -| **2.3.3** | Vérifiez que les transactions sont utilisées au niveau de la logique métier de telle sorte qu'une opération de logique métier réussisse dans son intégralité ou qu'elle soit restaurée à l'état correct précédent. | 2 | -| **2.3.4** | Vérifiez que les mécanismes de verrouillage au niveau de la logique métier sont utilisés pour garantir que les ressources en quantité limitée (telles que les sièges de théâtre ou les créneaux de livraison) ne peuvent pas être réservées deux fois en manipulant la logique de l'application. | 2 | -| **2.3.5** | Vérifiez que les flux logiques métier à forte valeur ajoutée nécessitent l'approbation de plusieurs utilisateurs afin d'éviter toute action non autorisée ou accidentelle. Cela peut inclure, sans s'y limiter, les transferts monétaires importants, les approbations de contrats, l'accès à des informations classifiées ou les contournements de sécurité dans le secteur manufacturier. | 3 | - -## V2.4 Anti-automatisation - -Cette section comprend des contrôles anti-automatisation pour garantir que les interactions de type humaine sont requises et que les demandes automatisées excessives sont évitées. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **2.4.1** | Vérifiez que des contrôles anti-automatisation sont en place pour protéger contre les appels excessifs aux fonctions d'application qui pourraient conduire à l'exfiltration de données, à la création de données inutiles, à l'épuisement des quotas, aux violations de limites de débit, au déni de service ou à la surutilisation de ressources coûteuses. | 2 | -| **2.4.2** | Vérifiez que les flux logiques métier nécessitent un timing humain réaliste, évitant ainsi des soumissions de transactions excessivement rapides. | 3 | - -## Références - -Pour plus d'informations, voir également : - -* [OWASP Web Security Testing Guide 4.2: Input Validation Testing](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/README.html) -* [OWASP Web Security Testing Guide 4.2: Business Logic Testing](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/10-Business_Logic_Testing/README) -* La lutte contre l'automatisation peut se faire de différentes manières, notamment par l'utilisation de l'[OWASP Automated Threats to Web Applications](https://owasp.org/www-project-automated-threats-to-web-applications/) -* [OWASP Input Validation Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html) -* [JSON Schema](https://json-schema.org/specification.html) diff --git a/5.0/fr/0x12-V3-Web-Frontend-Security.md b/5.0/fr/0x12-V3-Web-Frontend-Security.md deleted file mode 100644 index 2e74c3eb55..0000000000 --- a/5.0/fr/0x12-V3-Web-Frontend-Security.md +++ /dev/null @@ -1,100 +0,0 @@ -# V3 Sécurité du frontend Web - -## Objectif de contrôle - -Cette catégorie se concentre sur les exigences visant à protéger contre les attaques exécutées via un frontend web. Ces exigences ne s'appliquent pas aux solutions "machine-to-machine". - -## V3.1 Documentation sur la sécurité du frontend Web - -Cette section décrit les fonctionnalités de sécurité du navigateur qui doivent être spécifiées dans la documentation de l'application. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **3.1.1** | Vérifiez que la documentation de l'application indique les fonctionnalités de sécurité attendues que les navigateurs utilisant l'application doivent prendre en charge (telles que HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) et autres mécanismes de sécurité HTTP pertinents). Elle doit également définir le comportement de l'application lorsque certaines de ces fonctionnalités ne sont pas disponibles (par exemple, avertir l'utilisateur ou bloquer l'accès). | 3 | - -## V3.2 Interprétation non intentionnelle du contenu - -Le rendu de contenu ou de fonctionnalité dans un contexte incorrect peut entraîner l'exécution ou l'affichage de contenu malveillant. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **3.2.1** | Vérifiez que des contrôles de sécurité sont en place pour empêcher les navigateurs d'afficher du contenu ou des fonctionnalités dans les réponses HTTP dans un contexte incorrect (par exemple, lorsqu'une API, un fichier téléchargé par l'utilisateur ou une autre ressource est demandée directement). Les contrôles possibles peuvent inclure : ne pas transmettre le contenu sauf si les champs d'en-tête de requête HTTP (tels que Sec-Fetch-\*) indiquent qu'il s'agit du contexte correct, utiliser la directive sandbox du champ d'en-tête Content-Security-Policy ou utiliser le type de disposition de pièce jointe dans le champ d'en-tête Content-Disposition. | 1 | -| **3.2.2** | Vérifiez que le contenu destiné à être affiché sous forme de texte, plutôt que rendu sous forme de HTML, est géré à l'aide de fonctions de rendu sécurisées (telles que createTextNode ou textContent) pour empêcher l'exécution involontaire de contenu tel que HTML ou JavaScript. | 1 | -| **3.2.3** | Vérifiez que l'application évite l'écrasement du DOM lors de l'utilisation de JavaScript côté client en utilisant des déclarations de variables explicites, en effectuant une vérification de type stricte, en évitant de stocker des variables globales sur l'objet document et en implémentant l'isolation de l'espace de nommage. | 3 | - -## V3.3 Configuration des cookies - -Cette section décrit les exigences de configuration sécurisée des cookies sensibles afin de fournir un niveau d'assurance plus élevé qu'ils ont été créés par l'application elle-même et d'empêcher que leur contenu ne fuite ou ne soit modifié de manière inappropriée. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **3.3.1** | Vérifiez que les cookies ont l'attribut « Secure » ​​défini et si le préfixe « \__Host- » n'est pas utilisé pour le nom du cookie, le préfixe « __Secure- » doit être utilisé pour le nom du cookie. | 1 | -| **3.3.2** | Vérifiez que la valeur de l'attribut « SameSite » de chaque cookie est définie en fonction de l'objectif du cookie, afin de limiter l'exposition aux attaques de réparation de l'interface utilisateur et aux attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF). | 2 | -| **3.3.3** | Vérifiez que les cookies ont le préfixe « __Host- » pour le nom du cookie, sauf s'ils sont explicitement conçus pour être partagés avec d'autres hôtes. | 2 | -| **3.3.4** | Vérifiez que si la valeur d'un cookie n'est pas censée être accessible aux scripts côté client (comme un jeton de session), le cookie doit avoir l'attribut « HttpOnly » défini et la même valeur (par exemple, un jeton de session) ne doit être transférée au client que via le champ d'en-tête « Set-Cookie ». | 2 | -| **3.3.5** | Vérifiez que lorsque l'application écrit un cookie, la longueur combinée du nom et de la valeur du cookie ne dépasse pas 4 096 octets. Les cookies trop volumineux ne seront pas stockés par le navigateur et ne seront donc pas envoyés avec les requêtes, empêchant ainsi l'utilisateur d'utiliser les fonctionnalités de l'application qui reposent sur ce cookie. | 3 | - -## V3.4 En-têtes du mécanisme de sécurité du navigateur - -Cette section décrit les en-têtes de sécurité qui doivent être définis sur les réponses HTTP pour activer les fonctionnalités et restrictions de sécurité du navigateur lors du traitement des réponses de l'application. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **3.4.1** | Vérifiez qu'un champ d'en-tête Strict-Transport-Security est inclus dans toutes les réponses afin d'appliquer une politique HTTP Strict Transport Security (HSTS). Une durée maximale d'au moins un an doit être définie, et pour les niveaux L2 et supérieurs, la politique doit également s'appliquer à tous les sous-domaines. | 1 | -| **3.4.2** | Vérifiez que le champ d'en-tête Access-Control-Allow-Origin du partage de ressources cross-origine (CORS) est une valeur fixe de l'application ou, si la valeur du champ d'en-tête de requête HTTP Origin est utilisée, qu'elle est validée par rapport à une liste d'origines approuvées. Si « Access-Control-Allow-Origin: * » doit être utilisé, vérifiez que la réponse ne contient aucune information sensible. | 1 | -| **3.4.3** | Vérifiez que les réponses HTTP incluent un champ d'en-tête de réponse Content-Security-Policy qui définit des directives garantissant que le navigateur charge et exécute uniquement du contenu ou des ressources fiables, afin de limiter l'exécution de JavaScript malveillant. Au minimum, une politique globale doit être utilisée, incluant les directives object-src 'none' et base-uri 'none', et définissant soit une lliste d’autorisations, soit des valeurs nonces ou des hachages. Pour une application L3, une politique par réponse avec des valeurs nonces ou des hachages doit être définie. | 2 | -| **3.4.4** | Vérifiez que toutes les réponses HTTP contiennent un champ d'en-tête « X-Content-Type-Options: nosniff ». Cela indique aux navigateurs de ne pas utiliser l'analyse de contenu ni la détection du type MIME pour la réponse donnée, et d'exiger que la valeur du champ d'en-tête « Content-Type » de la réponse corresponde à la ressource de destination. Par exemple, la réponse à une demande de style n'est acceptée que si le type de contenu de la réponse est « text/css ». Cela permet également au navigateur d'utiliser la fonctionnalité de blocage de lecture inter-origines (CORB). | 2 | -| **3.4.5** | Vérifiez que l'application définit une politique de référencement afin d'empêcher la fuite de données techniquement sensibles vers des services tiers via le champ d'en-tête de requête HTTP « Referer ». Cela peut être effectué via le champ d'en-tête de réponse HTTP « Referrer-Policy » ou via les attributs d'élément HTML. Les données sensibles peuvent inclure le chemin d'accès et les données de requête dans l'URL, et pour les applications internes non publiques, le nom d'hôte. | 2 | -| **3.4.6** | Vérifiez que l'application Web utilise la directive frame-ancestors du champ d'en-tête Content-Security-Policy pour chaque réponse HTTP afin de garantir qu'elle ne peut pas être intégrée par défaut et que l'intégration de ressources spécifiques n'est autorisée qu'en cas de nécessité. Notez que le champ d'en-tête X-Frame-Options, bien que pris en charge par les navigateurs, est obsolète et n'est pas forcément fiable. | 2 | -| **3.4.7** | Vérifiez que le champ d’en-tête Content-Security-Policy spécifie un emplacement pour signaler les violations. | 3 | -| **3.4.8** | Vérifiez que toutes les réponses HTTP qui lancent le rendu d'un document (comme les réponses de type text/html) incluent le champ d'en-tête 'Cross-Origin-Opener-Policy' avec la directive 'same-origin' ou s'ame-origin-allow-popups', selon les besoins. Cela empêche les attaques abusant de l'accès partagé aux objets Window, telles que le tabnabbing et le comptage d'images. | 3 | - -## V3.5 Séparation de l'origine du navigateur - -Lorsqu'elle accepte une demande d'accès à une fonctionnalité sensible du côté du serveur, l'application doit s'assurer que la demande est initiée par l'application elle-même ou par un tiers de confiance et qu'elle n'a pas été falsifiée par un attaquant. - -Les fonctionnalités sensibles dans ce contexte peuvent inclure l'acceptation de soumission de formulaires pour des utilisateurs authentifiés et non authentifiés (comme une demande d'authentification), des opérations de changement d'état ou des fonctionnalités exigeantes en ressources (comme l'exportation de données). - -Les principales protections sont les politiques de sécurité du navigateur, comme la politique de même origine pour JavaScript et la logique SameSite pour les cookies. Le mécanisme de requête de pré-vérification cross-origin CORS est une autre protection courante. Ce mécanisme est essentiel pour les "endpoints" conçus pour être appelés depuis une origine différente, mais il peut également constituer un mécanisme utile de prévention contre la falsification de requêtes pour les "endpoints" qui ne sont pas conçus pour être appelés depuis une origine différente. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **3.5.1** | Vérifiez que, si l'application ne s'appuie pas sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher les requêtes inter-origines non autorisées d'utiliser des fonctionnalités sensibles, ces requêtes sont validées afin de garantir leur origine. Cela peut se faire en utilisant et en validant des jetons anti-falsification ou en exigeant des champs d'en-tête HTTP supplémentaires qui ne sont pas des champs d'en-tête de requête CORS safelist. Ceci permet de se protéger contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF). | 1 | -| **3.5.2** | Vérifiez que, si l'application s'appuie sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher l'utilisation inter-origines non autorisée de fonctionnalités sensibles, il est impossible d'appeler la fonctionnalité avec une requête qui ne déclenche pas de requête de pré-vérification cross-origin CORS. Cela peut nécessiter de vérifier les valeurs des champs d'en-tête de requête 'Origin' et 'Content-Type' ou d'utiliser un champ d'en-tête supplémentaire qui n'est pas un champ d'en-tête de la liste de sécurité CORS. | 1 | -| **3.5.3** | Vérifiez que les requêtes HTTP destinées aux fonctionnalités sensibles utilisent des méthodes HTTP appropriées, telles que POST, PUT, PATCH ou DELETE, et non des méthodes définies comme « sûres » par la spécification HTTP, telles que HEAD, OPTIONS ou GET. Une validation stricte des champs d'en-tête de requête Sec-Fetch-* peut également être utilisée pour garantir que la requête ne provient pas d'un appel inter-origines inapproprié, d'une requête de navigation ou d'un chargement de ressources (comme une source d'image) inattendu. | 1 | -| **3.5.4** | Vérifiez que des applications distinctes sont hébergées sur des noms d'hôte différents pour tirer parti des restrictions fournies par la politique de même origine, y compris la manière dont les documents ou scripts chargés par une origine peuvent interagir avec les ressources d'une autre origine et les restrictions basées sur le nom d'hôte sur les cookies. | 2 | -| **3.5.5** | Vérifiez que les messages reçus par l'interface postMessage sont rejetés si l'origine du message n'est pas digne de confiance ou si la syntaxe du message n'est pas valide. | 2 | -| **3.5.6** | Vérifiez que la fonctionnalité JSONP n'est activée nulle part dans l'application pour éviter les attaques Cross-Site Script Inclusion (XSSI). | 3 | -| **3.5.7** | Vérifiez que les données nécessitant une autorisation ne sont pas incluses dans les réponses des ressources de script, comme les fichiers JavaScript, pour empêcher les attaques par inclusion de script intersite (XSSI). | 3 | -| **3.5.8** | Vérifiez que les ressources authentifiées (telles que les images, les vidéos, les scripts et autres documents) peuvent être chargées ou intégrées pour le compte de l'utilisateur uniquement lorsque cela est prévu. Cela peut être réalisé en validant strictement les champs d'en-tête de requête HTTP Sec-Fetch-* afin de garantir que la requête ne provient pas d'un appel cross-origin inapproprié, ou en définissant un champ d'en-tête de réponse HTTP Cross-Origin-Resource-Policy restrictif pour indiquer au navigateur de bloquer le contenu renvoyé. | 3 | - -## V3.6 Intégrité des ressources externes - -Cette section fournit des conseils pour l’hébergement sécurisé de contenu sur des sites tiers. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **3.6.1** | Vérifiez que les ressources côté client, telles que les bibliothèques JavaScript, les feuilles de style CSS ou les polices web, sont hébergées en externe (par exemple, sur un réseau de diffusion de contenu) uniquement si la ressource est statique et versionnée, et si l'intégrité des sous-ressources (SRI) est utilisée pour valider l'intégrité de la ressource. Si cela n'est pas possible, une décision de sécurité documentée doit justifier cette décision pour chaque ressource. | 3 | - -## V3.7 Autres considérations sur la sécurité du navigateur - -Cette section comprend divers autres contrôles de sécurité et fonctionnalités de sécurité de navigateur modernes nécessaires pour la sécurité du navigateur côté client. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **3.7.1** | Vérifiez que l'application utilise uniquement des technologies côté client toujours prises en charge et considérées comme sécurisées. Parmi les technologies qui ne répondent pas à cette exigence figurent les plugins NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL ou les applets Java côté client. | 2 | -| **3.7.2** | Vérifiez que l'application redirigera automatiquement l'utilisateur vers un nom d'hôte ou un domaine différent (qui n'est pas contrôlé par l'application) uniquement lorsque la destination apparaît sur une liste d'autorisation. | 2 | -| **3.7.3** | Vérifiez que le domaine de premier niveau de l'application (par exemple, site.tld) ​​est ajouté à la liste de préchargement publique pour HTTP Strict Transport Security (HSTS). Cela garantit que l'utilisation de TLS pour l'application est intégrée directement dans les principaux navigateurs, plutôt que de dépendre uniquement du champ d'en-tête de réponse Strict-Transport-Security. | 3 | -| **3.7.4** | Vérifiez que l'application affiche une notification lorsque l'utilisateur est redirigé vers une URL hors du contrôle de l'application, avec une option pour annuler la navigation. | 3 | -| **3.7.5** | Vérifiez que l'application se comporte comme documenté (par exemple, en avertissant l'utilisateur ou en bloquant l'accès) si le navigateur utilisé pour accéder à l'application ne prend pas en charge les fonctionnalités de sécurité attendues. | 3 | - -## Références - -Pour plus d'informations, voir également : - -* [Set-Cookie __Host- prefix details](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#cookie_prefixes) -* [OWASP Content Security Policy Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html) -* [OWASP Secure Headers Project](https://owasp.org/www-project-secure-headers/) -* [OWASP Cross-Site Request Forgery Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html) -* [HSTS Browser Preload List submission form](https://hstspreload.org/) -* [OWASP DOM Clobbering Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/DOM_Clobbering_Prevention_Cheat_Sheet.html) diff --git a/5.0/fr/0x13-V4-API-and-Web-Service.md b/5.0/fr/0x13-V4-API-and-Web-Service.md deleted file mode 100644 index 92f8afa0bd..0000000000 --- a/5.0/fr/0x13-V4-API-and-Web-Service.md +++ /dev/null @@ -1,64 +0,0 @@ -# V4 API et service Web - -## Objectif de contrôle - -Plusieurs considérations s'appliquent spécifiquement aux applications exposant des API destinées aux navigateurs web ou à d'autres consommateurs (généralement via JSON, XML ou GraphQL). Ce chapitre présente les configurations et mécanismes de sécurité pertinents à appliquer. - -Notez que les problèmes d’authentification, de gestion de session et de validation des entrées des autres chapitres s’appliquent également aux API. Ce chapitre ne peut donc pas être sorti de son contexte ni testé de manière isolée. - -## V4.1 Sécurité du service Web générique - -Cette section aborde les considérations générales sur la sécurité des services Web et, par conséquent, les pratiques d’hygiène de base des services Web. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **4.1.1** | Vérifiez que chaque réponse HTTP avec un corps de message contient un champ d'en-tête Content-Type qui correspond au contenu réel de la réponse, y compris le paramètre charset pour spécifier un codage de caractères sécurisé (par exemple, UTF-8, ISO-8859-1) conformément aux types de médias IANA, tels que « text/ », « /+xml » et « /xml ». | 1 | -| **4.1.2** | Vérifiez que seuls les terminaux utilisateurs (destinés à l'accès manuel via un navigateur web) redirigent automatiquement de HTTP vers HTTPS, tandis que les autres services ou terminaux n'implémentent pas de redirections transparentes. Cela permet d'éviter qu'un client envoie par erreur des requêtes HTTP non chiffrées, mais que, comme ces requêtes sont automatiquement redirigées vers HTTPS, la fuite de données sensibles passe inaperçue. | 2 | -| **4.1.3** | Vérifiez que tout champ d'en-tête HTTP utilisé par l'application et défini par une couche intermédiaire, telle qu'un équilibreur de charge, un proxy web ou un service backend-for-frontend, ne peut pas être remplacé par l'utilisateur final. Les exemples d'en-têtes peuvent inclure X-Real-IP, X-Forwarded-*, ou X-User-ID. | 2 | -| **4.1.4** | Vérifiez que seules les méthodes HTTP explicitement prises en charge par l'application ou son API (y compris les OPTIONS lors des demandes de contrôle en amont) peuvent être utilisées et que les méthodes inutilisées sont bloquées. | 3 | -| **4.1.5** | Vérifier que les signatures numériques par message sont utilisées pour fournir une assurance supplémentaire en plus des protections de transport pour les demandes ou les transactions qui sont très sensibles ou qui traversent un certain nombre de systèmes. | 3 | - -## V4.2 Validation de la structure des messages HTTP - -Cette section explique comment la structure et les champs d'en-tête d'un message HTTP doivent être validés afin de prévenir les attaques telles que la contrebande de requêtes, le fractionnement de réponses, l'injection d'en-têtes et le déni de service via des messages HTTP trop longs. - -Ces exigences sont pertinentes pour le traitement et la génération de messages HTTP généraux, mais sont particulièrement importantes lors de la conversion de messages HTTP entre différentes versions HTTP. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **4.2.1** | Vérifiez que tous les composants de l'application (y compris les équilibreurs de charge, les pares-feux et les serveurs d'applications) déterminent les limites des messages HTTP entrants à l'aide du mécanisme approprié à la version HTTP afin d'empêcher la contrebande de requêtes HTTP. Dans HTTP/1.x, si un champ d'en-tête Transfer-Encoding est présent, l'en-tête Content-Length doit être ignoré conformément à la RFC 2616. Avec HTTP/2 ou HTTP/3, si un champ d'en-tête Content-Length est présent, le récepteur doit s'assurer qu'il est cohérent avec la longueur des trames DATA. | 2 | -| **4.2.2** | Vérifier que, lors de la génération de messages HTTP, le champ d'en-tête Content-Length n'entre pas en conflit avec la longueur du contenu déterminée par le cadrage du protocole HTTP, afin d'empêcher les attaques de type « request smuggling ». | 3 | -| **4.2.3** | Vérifiez que l'application n'envoie ni n'accepte de messages HTTP/2 ou HTTP/3 avec des champs d'en-tête spécifiques à la connexion, tels que Transfer-Encoding, afin d'éviter les attaques par fractionnement de la réponse et par injection d'en-tête. | 3 | -| **4.2.4** | Vérifiez que l'application n'accepte que les requêtes HTTP/2 et HTTP/3 dont les champs et valeurs d'en-tête ne contiennent pas de séquences CR (\r), LF (\n) ou CRLF (\r\n), afin d'éviter les attaques par injection d'en-tête. | 3 | -| **4.2.5** | Vérifiez que, si l'application (backend ou frontend) construit et envoie des requêtes, elle utilise des mécanismes de validation, d'assainissement ou autres pour éviter de créer des URI (comme pour les appels API) ou des champs d'en-tête de requête HTTP (comme Authorization ou Cookie) qui sont trop longs pour être acceptés par le composant récepteur. Cela pourrait entraîner un déni de service, par exemple lors de l'envoi d'une requête trop longue (par exemple, un long champ d'en-tête de cookie), ce qui fait que le serveur répond toujours avec un statut d'erreur. | 3 | - -## V4.3 GraphQL - -GraphQL est de plus en plus utilisé pour créer des clients riches en données, peu couplés à divers services backend. Cette section aborde les considérations de sécurité pour GraphQL. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **4.3.1** | Vérifiez qu'une liste d'autorisation de requête, une limitation de profondeur, une limitation de quantité ou une analyse des coûts de requête est utilisée pour empêcher le déni de service (DoS) de GraphQL ou d'expression de la couche données en raison de requêtes imbriquées coûteuses. | 2 | -| **4.3.2** | Vérifiez que les requêtes d’introspection GraphQL sont désactivées dans l’environnement de production, sauf si l’API GraphQL est destinée à être utilisée par d’autres parties. | 2 | - -## V4.4 WebSocket - -WebSocket est un protocole de communication qui fournit un canal de communication bidirectionnel simultané via une seule connexion TCP. Il a été normalisé par l'IETF sous la RFC 6455 en 2011 et se distingue de HTTP, bien qu'il soit conçu pour fonctionner sur les ports HTTP 443 et 80. - -Cette section fournit les principales exigences de sécurité pour empêcher les attaques liées à la sécurité des communications et à la gestion des sessions qui exploitent spécifiquement ce canal de communication en temps réel. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **4.4.1** | Vérifiez que WebSocket sur TLS (WSS) est utilisé pour toutes les connexions WebSocket. | 1 | -| **4.4.2** | Vérifiez que, lors de la négociation HTTP WebSocket initiale, le champ d’en-tête 'Origin' est vérifié par rapport à une liste d’origines autorisées pour l’application. | 2 | -| **4.4.3** | Vérifiez que, si la gestion de session standard de l'application ne peut pas être utilisée, des jetons dédiés sont utilisés à cet effet, qui sont conformes aux exigences de sécurité de gestion de session pertinentes. | 2 | -| **4.4.4** | Vérifiez que les jetons de gestion de session WebSocket dédiés sont initialement obtenus ou validés via la session HTTPS précédemment authentifiée lors de la transition d'une session HTTPS existante vers un canal WebSocket. | 2 | - -## Références - -Pour plus d'informations, voir également : - -* [OWASP REST Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html) -* Resources on GraphQL Authorization from [graphql.org](https://graphql.org/learn/authorization/) and [Apollo](https://www.apollographql.com/docs/apollo-server/security/authentication/#authorization-methods). -* [OWASP Web Security Testing Guide: GraphQL Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/12-API_Testing/01-Testing_GraphQL) -* [OWASP Web Security Testing Guide: Testing WebSockets](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/11-Client-side_Testing/10-Testing_WebSockets) diff --git a/5.0/fr/0x14-V5-File-Handling.md b/5.0/fr/0x14-V5-File-Handling.md deleted file mode 100644 index 74a11f7a7d..0000000000 --- a/5.0/fr/0x14-V5-File-Handling.md +++ /dev/null @@ -1,54 +0,0 @@ -# V5 Gestion des fichiers - -## Objectif de contrôle - -L'utilisation de fichiers peut présenter divers risques pour l'application, notamment le déni de service, l'accès non autorisé et l'épuisement de l'espace de stockage. Ce chapitre présente les exigences pour gérer ces risques. - -## V5.1 Documentation sur la gestion des fichiers - -Cette section comprend l’obligation de documenter les caractéristiques attendues des fichiers acceptés par l’application, comme condition préalable nécessaire au développement et à la vérification des contrôles de sécurité pertinents. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **5.1.1** | Vérifiez que la documentation définit les types de fichiers autorisés, les extensions de fichiers attendues et la taille maximale (y compris la taille décompressée) pour chaque fonctionnalité de Téléversement. De plus, assurez-vous que la documentation précise comment les fichiers sont sécurisés pour le téléchargement et le traitement des utilisateurs finaux, par exemple le comportement de l'application lorsqu'un fichier malveillant est détecté.| 2 | - -## V5.2 Téléversement de fichiers et contenu - -La fonctionnalité de téléversement de fichiers est une source majeure de fichiers non fiables. Cette section décrit les exigences permettant de garantir que la présence, le volume ou le contenu de ces fichiers ne nuisent pas à l'application. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **5.2.1** | Vérifiez que l'application n'acceptera que des fichiers d'une taille qu'elle peut traiter sans provoquer de perte de performances ou d'attaque par déni de service. | 1 | -| **5.2.2** | Vérifiez que lorsque l'application accepte un fichier, seul ou dans une archive telle qu'un fichier zip, elle vérifie si l'extension de fichier correspond à une extension attendue et que le contenu correspond au type représenté par l'extension. Cela inclut, sans s'y limiter, la vérification des « octets magiques » initiaux, la réécriture d'images et l'utilisation de bibliothèques spécialisées pour la validation du contenu des fichiers. Pour le niveau L1, cela peut se concentrer uniquement sur les fichiers utilisés pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau L2, cela doit s'appliquer à tous les fichiers acceptés. | 1 | -| **5.2.3** | Vérifiez que l'application vérifie les fichiers compressés (par exemple, zip, gz, docx, odt) par rapport à la taille maximale autorisée non compressée et au nombre maximal de fichiers avant de décompresser le fichier. | 2 | -| **5.2.4** | Vérifiez qu'un quota de taille de fichier et un nombre maximal de fichiers par utilisateur sont appliqués pour garantir qu'un seul utilisateur ne puisse pas remplir le stockage avec trop de fichiers ou des fichiers excessivement volumineux. | 3 | -| **5.2.5** | Vérifiez que l'application n'autorise pas le téléversement de fichiers compressés contenant des liens symboliques, sauf si cela est spécifiquement requis (auquel cas il sera nécessaire d'appliquer une liste d'autorisation des fichiers vers lesquels il est possible de créer des liens symboliques).| 3 | -| **5.2.6** | Vérifiez que l'application rejette les images téléversées avec une taille de pixel supérieure au maximum autorisé, afin d'éviter les attaques par inondation de pixels.| 3 | - -## V5.3 Stockage de fichiers - -Cette section comprend des exigences visant à empêcher l'exécution inappropriée des fichiers après leur téléversement, à détecter le contenu dangereux et à éviter que des données non fiables ne soient utilisées pour contrôler l'emplacement de stockage des fichiers. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **5.3.1** | Vérifiez que les fichiers téléversés ou générés par une entrée non fiable et stockés dans un dossier public ne sont pas exécutés en tant que code de programme côté serveur lorsqu'ils sont accessibles directement avec une requête HTTP. | 1 | -| **5.3.2** | Vérifiez que lorsque l'application crée des chemins d'accès pour les opérations sur les fichiers, elle utilise des données générées en interne ou fiables plutôt que des noms de fichiers soumis par l'utilisateur. Si des noms de fichiers ou des métadonnées de fichiers soumis par l'utilisateur doivent être utilisés, une validation et un nettoyage stricts doivent être appliqués. Ceci permet de se protéger contre les attaques par traversée de chemin, l'inclusion de fichiers locaux ou distants (LFI, RFI) et la falsification de requêtes côté serveur (SSRF). | 1 | -| **5.3.3** | Vérifiez que le traitement des fichiers côté serveur, comme la décompression des fichiers, ignore les informations de chemin fournies par l'utilisateur pour éviter les vulnérabilités telles que le "zip slip". | 3 | - -## V5.4 Téléchargement de fichier - -Cette section décrit les exigences visant à atténuer les risques liés au téléchargement de fichiers, notamment les attaques par traversée de chemin et par injection. Elle s'assure également qu'ils ne contiennent pas de contenu dangereux. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **5.4.1** | Vérifiez que l’application valide ou ignore les noms de fichiers soumis par l’utilisateur, y compris dans un paramètre JSON, JSONP ou URL et spécifie un nom de fichier dans le champ d’en-tête Content-Disposition de la réponse. | 2 | -| **5.4.2** | Vérifiez que les noms de fichiers servis (par exemple, dans les champs d'en-tête de réponse HTTP ou les pièces jointes aux e-mails) sont encodés ou nettoyés (par exemple, conformément à la RFC 6266) pour préserver la structure du document et empêcher les attaques par injection. | 2 | -| **5.4.3** | Vérifiez que les fichiers obtenus à partir de sources non fiables sont analysés par des scanners antivirus pour empêcher la diffusion de contenu malveillant connu. | 2 | - -## Références - -Pour plus d'informations, voir également : - -* [OWASP File Upload Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html) -* [Example of using symlinks for arbitrary file read](https://hackerone.com/reports/1439593) -* [Explanation of "Magic Bytes" from Wikipedia](https://en.wikipedia.org/wiki/List_of_file_signatures) diff --git a/5.0/fr/0x15-V6-Authentication.md b/5.0/fr/0x15-V6-Authentication.md deleted file mode 100644 index 9120b56135..0000000000 --- a/5.0/fr/0x15-V6-Authentication.md +++ /dev/null @@ -1,166 +0,0 @@ -# V6 Authentification - -## Objectif de contrôle - -L'authentification est le processus permettant d'établir ou de confirmer l'authenticité d'une personne ou d'un appareil. Elle consiste à vérifier les déclarations d'une personne ou d'un appareil, à garantir la résistance à l'usurpation d'identité et à empêcher la récupération ou l'interception des mots de passe. - -Le [NIST SP 800-63](https://pages.nist.gov/800-63-3/) est une norme moderne, fondée sur des preuves, qui est précieuse pour les organisations du monde entier, mais qui est particulièrement pertinente pour les agences américaines et ceux qui intéragissent avec les agences américaines. - -Bien que de nombreuses exigences de ce chapitre soient basées sur la deuxième section de la norme (appelée NIST SP 800-63B « Directives relatives à l'identité numérique - Authentification et gestion du cycle de vie »), ce chapitre se concentre sur les menaces courantes et les faiblesses d'authentification fréquemment exploitées. Il ne prétend pas couvrir tous les points de la norme de manière exhaustive. Pour les cas où une conformité totale à la norme NIST SP 800-63 est nécessaire, veuillez vous référer à cette dernière. - -De plus, la terminologie du NIST SP 800-63 peut parfois différer, et ce chapitre utilise souvent une terminologie plus communément comprise pour améliorer la clarté. - -Une fonctionnalité commune aux applications plus avancées est la possibilité d'adapter les étapes d'authentification requises en fonction de divers facteurs de risque. Cette fonctionnalité est abordée dans le chapitre « Autorisation », car ces mécanismes doivent également être pris en compte dans les décisions d'autorisation. - -## V6.1 Documentation d'authentification - -Cette section détaille les exigences relatives à la documentation d'authentification à conserver pour une application. Elle est essentielle à la mise en œuvre et à l'évaluation de la configuration des contrôles d'authentification pertinents. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **6.1.1** | Vérifiez que la documentation de l'application définit comment les contrôles, tels que la limitation de débit, l'anti-automatisation et la réponse adaptative, sont utilisés pour se défendre contre les attaques telles que le « credential stuffing » et la force brute des mots de passe. La documentation doit expliquer clairement comment ces contrôles sont configurés et empêcher le blocage malveillant des comptes. | 1 | -| **6.1.2** | Vérifiez qu'une liste de mots spécifiques au contexte est documentée afin d'empêcher leur utilisation dans les mots de passe. Cette liste peut inclure des permutations de noms d'organisations, de produits, d'identifiants de systèmes, de noms de codes de projets, de noms de services ou de rôles, etc. | 2 | -| **6.1.3** | Vérifiez que, si l'application inclut plusieurs voies d'authentification, celles-ci sont toutes documentées avec les contrôles de sécurité et la force d'authentification qui doivent être appliqués de manière cohérente. | 2 | - -## V6.2 Sécurité des mots de passe - -Les mots de passe, appelés « secrets mémorisés » par la norme NIST SP 800-63, comprennent les mots de passe, les phrases de passe, les codes PIN, les schémas de déverrouillage et choisir « le bon chaton » ou d'un autre élément d'image. Ils sont généralement considérés comme « quelque chose que vous connaissez » et sont souvent utilisés comme mécanisme d'authentification à facteur unique. - -Cette section contient donc des exigences visant à garantir la création et la gestion sécurisées des mots de passe. La plupart des exigences sont de niveau 1, car elles sont les plus importantes à ce niveau. À partir du niveau 2, des mécanismes d'authentification multifacteur sont requis, les mots de passe pouvant être l'un de ces facteurs. - -Les exigences de cette section concernent principalement le chapitre [§ 5.1.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver) du [Guide du NIST](https://pages.nist.gov/800-63-3/sp800-63b.html). - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **6.2.1** | Vérifiez que les mots de passe définis par l'utilisateur comportent au moins 8 caractères, bien qu'un minimum de 15 caractères soit fortement recommandé. | 1 | -| **6.2.2** | Vérifiez que les utilisateurs peuvent modifier leur mot de passe. | 1 | -| **6.2.3** | Vérifiez que la fonctionnalité de changement de mot de passe nécessite le mot de passe actuel et le nouveau mot de passe de l'utilisateur. | 1 | -| **6.2.4** | Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou du changement de mot de passe sont vérifiés par rapport à un ensemble disponible d'au moins 3 000 mots de passe principaux qui correspondent à la politique de mot de passe de l'application, par exemple la longueur minimale. | 1 | -| **6.2.5** | Vérifiez que les mots de passe peuvent être utilisés, quelle que soit leur composition, sans restriction quant au type de caractères autorisés. Aucun nombre minimal de majuscules ou de minuscules, de chiffres ou de caractères spéciaux ne doit être exigé. | 1 | -| **6.2.6** | Vérifiez que les champs de saisie du mot de passe utilisent type=password pour masquer la saisie. Les applications peuvent permettre à l'utilisateur d'afficher temporairement l'intégralité du mot de passe masqué ou le dernier caractère saisi. | 1 | -| **6.2.7** | Vérifiez que la fonctionnalité « coller », les assistants de mot de passe du navigateur et les gestionnaires de mots de passe externes sont autorisés. | 1 | -| **6.2.8** | Vérifiez que l'application vérifie le mot de passe de l'utilisateur exactement tel qu'il a été reçu de l'utilisateur, sans aucune modification telle qu'une troncature ou une transformation de casse. | 1 | -| **6.2.9** | Vérifiez que les mots de passe d’au moins 64 caractères sont autorisés. | 2 | -| **6.2.10** | Vérifiez que le mot de passe d'un utilisateur reste valide jusqu'à ce qu'il soit découvert comme compromis ou qu'il soit renouvelé. L'application ne doit pas exiger de renouvellement périodique des identifiants. | 2 | -| **6.2.11** | Vérifiez que la liste documentée de mots spécifiques au contexte est utilisée pour éviter la création de mots de passe faciles à deviner. | 2 | -| **6.2.12** | Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou des modifications de mot de passe sont vérifiés par rapport à un ensemble de mots de passe fuités. | 2 | - -## V6.3 Sécurité générale de l'authentification - -Cette section contient les exigences générales relatives à la sécurité des mécanismes d'authentification et définit les différentes attentes en matière de niveaux. Les applications L2 doivent recourir à l'authentification multifacteur (MFA). Les applications L3 doivent utiliser une authentification matérielle, réalisée dans un environnement d'exécution certifié et approuvé (TEE). Cela peut inclure des clés d'accès liées à l'appareil, des authentificateurs eIDAS à niveau d'assurance élevé (LoA), des authentificateurs avec l'assurance NIST Authenticator Assurance Level 3 (AAL3) ou un mécanisme équivalent. - -Bien qu'il s'agisse d'une position relativement agressive concernant l'authentification multifacteur, il est essentiel de relever le niveau à ce sujet pour protéger les utilisateurs, et toute tentative d'assouplissement de ces exigences doit être accompagnée d'un plan clair sur la manière dont les risques liés à l'authentification seront atténués, en tenant compte des orientations et des recherches du NIST sur le sujet. - -Veuillez noter qu'au moment de la publication, la norme NIST SP 800-63 considère l'email comme [non acceptable](https://pages.nist.gov/800-63-FAQ/#q-b11) comme mécanisme d'authentification ([copie archivée](https://pages.nist.gov/800-63-FAQ/#q-b11)). - -Les exigences de cette section concernent diverses sections du [Guide du NIST](https://pages.nist.gov/800-63-3/sp800-63b.html), incluant : [§ 4.2.1](https://pages.nist.gov/800-63-3/sp800-63b.html#421-permitted-authenticator-types), [§ 4.3.1](https://pages.nist.gov/800-63-3/sp800-63b.html#431-permitted-authenticator-types), [§ 5.2.2](https://pages.nist.gov/800-63-3/sp800-63b.html#522-rate-limiting-throttling), et [§ 6.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#-612-post-enrollment-binding). - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **6.3.1** | Vérifiez que les contrôles visant à empêcher les attaques telles que le bourrage d'informations d'identification et la force brute des mots de passe sont mis en œuvre conformément à la documentation de sécurité de l'application. | 1 | -| **6.3.2** | Vérifiez que les comptes d’utilisateur par défaut (par exemple, « root », « admin » ou « sa ») ne sont pas présents dans l’application ou sont désactivés. | 1 | -| **6.3.3** | Vérifiez que l’application exige que les utilisateurs utilisent un mécanisme d’authentification multifacteur ou une combinaison de mécanismes d’authentification à facteur unique. | 2 | -| **6.3.4** | Vérifiez que, si l’application inclut plusieurs voies d’authentification, il n’existe aucune voie non documentée et que les contrôles de sécurité et la force d’authentification sont appliqués de manière cohérente. | 2 | -| **6.3.5** | Vérifiez que les utilisateurs sont informés des tentatives d'authentification suspectes (réussies ou non). Il peut s'agir de tentatives d'authentification provenant d'un emplacement ou d'un client inhabituel, d'une authentification partiellement réussie (un seul facteur parmi plusieurs), d'une tentative d'authentification après une longue période d'inactivité ou d'une authentification réussie après plusieurs tentatives infructueuses. | 3 | -| **6.3.6** | Vérifiez que le courrier électronique n’est pas utilisé comme mécanisme d’authentification à facteur unique ou à facteurs multiples. | 3 | -| **6.3.7** | Vérifiez que les utilisateurs sont avertis après les mises à jour des détails d'authentification, telles que les réinitialisations d'informations d'identification ou la modification du nom d'utilisateur ou de l'adresse e-mail. | 3 | -| **6.3.8** | Vérifiez que les utilisateurs valides ne peuvent pas être déduits d'échecs d'authentification, par exemple en se basant sur des messages d'erreur, des codes de réponse HTTP ou des temps de réponse différents. Les fonctionnalités d'inscription et de mot de passe oublié doivent également bénéficier de cette protection. | 3 | - -## V6.4 Cycle de vie et récupération du facteur d'authentification - -Les facteurs d'authentification peuvent inclure des mots de passe, des jetons logiciels, des jetons matériels et des dispositifs biométriques. La gestion sécurisée du cycle de vie de ces mécanismes est essentielle à la sécurité d'une application, et cette section présente les exigences afférentes. - -Les exigences de cette section concernent principalement les chapitres [§ 5.1.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver) ou [§ 6.1.2.3](https://pages.nist.gov/800-63-3/sp800-63b.html#replacement) of [Guide du NIST](https://pages.nist.gov/800-63-3/sp800-63b.html). - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **6.4.1** | Vérifiez que les mots de passe initiaux ou les codes d'activation générés par le système sont générés de manière aléatoire et sécurisée, qu'ils respectent la politique de mots de passe en vigueur et qu'ils expirent après une courte période ou après leur première utilisation. Ces secrets initiaux ne doivent pas devenir des mots de passe permanents. | 1 | -| **6.4.2** | Vérifiez que les indices de mot de passe ou l'authentification basée sur les connaissances (appelées « questions secrètes ») ne sont pas présents. | 1 | -| **6.4.3** | Vérifiez qu'un processus sécurisé de réinitialisation d'un mot de passe oublié est mis en œuvre, qui ne contourne aucun mécanisme d'authentification multifacteur activé. | 2 | -| **6.4.4** | Vérifiez que si un facteur d'authentification multifacteur est perdu, la preuve de vérification d'identité est effectuée au même niveau que lors de l'inscription. | 2 | -| **6.4.5** | Vérifiez que les instructions de renouvellement des mécanismes d'authentification qui expirent sont envoyées avec suffisamment de temps pour être exécutées avant l'expiration de l'ancien mécanisme d'authentification, en configurant des rappels automatiques si nécessaire. | 3 | -| **6.4.6** | Vérifiez que les administrateurs peuvent initier la réinitialisation du mot de passe de l'utilisateur, mais que cela ne leur permet pas de modifier ou de choisir son mot de passe. Cela évite qu'ils ne connaissent le mot de passe de l'utilisateur. | 3 | - -## V6.5 Exigences générales en matière d'authentification multifacteur - -Cette section fournit des conseils généraux qui seront pertinents pour différentes méthodes d’authentification multifacteur. - -Les mécanismes comprennent : - -* Secret recherché dans une table -* Mots de passe à usage unique basés sur le temps (TOTP) -* Mécanismes out-of-band - -Les secrets de recherche sont des listes pré-générées de codes secrets, similaires aux numéros d'autorisation de transaction (TAN), aux codes de récupération des réseaux sociaux ou à une grille contenant un ensemble de valeurs aléatoires. Ce type de mécanisme d'authentification est considéré comme « quelque chose que vous possédez », car les codes sont volontairement non mémorisables et doivent donc être stockés quelque part. - -Les mots de passe à usage unique basés sur le temps (TOTP) sont des jetons physiques ou logiciels qui affichent un code pseudo-aléatoire à usage unique et changeant en permanence. Ce type de mécanisme d'authentification est considéré comme « quelque chose que vous possédez ». Les TOTP multifactoriels sont similaires aux TOTP à simple facteur", mais nécessitent la saisie d'un code PIN valide, un déverrouillage biométrique, une clé USB ou un appairage NFC, ou d'une valeur supplémentaire (comme des calculateurs de signature de transaction) pour créer le mot de passe à usage unique (OTP) final. - -Des détails sur les mécanismes out-of-band seront fournis dans la section suivante. - -Les exigences de ces sections concernent principalement les chapitres [§ 5.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#-512-look-up-secrets), [§ 5.1.3](https://pages.nist.gov/800-63-3/sp800-63b.html#-513-out-of-band-devices), [§ 5.1.4.2](https://pages.nist.gov/800-63-3/sp800-63b.html#5142-single-factor-otp-verifiers), [§ 5.1.5.2](https://pages.nist.gov/800-63-3/sp800-63b.html#5152-multi-factor-otp-verifiers), [§ 5.2.1](https://pages.nist.gov/800-63-3/sp800-63b.html#521-physical-authenticators), et [§ 5.2.3](https://pages.nist.gov/800-63-3/sp800-63b.html#523-use-of-biometrics) du [Guide du NIST](https://pages.nist.gov/800-63-3/sp800-63b.html). - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **6.5.1** | Vérifiez que les secrets de recherche, les demandes ou codes d'authentification out-of-band et les mots de passe à usage unique basés sur le temps (TOTP) ne peuvent être utilisés avec succès qu'une seule fois. | 2 | -| **6.5.2** | Vérifiez que, lors de leur stockage dans le backend de l'application, les secrets de recherche comportant moins de 112 bits d'entropie (19 caractères alphanumériques aléatoires ou 34 chiffres aléatoires) sont hachés avec un algorithme de hachage de stockage de mots de passe approuvé, intégrant un sel aléatoire de 32 bits. Une fonction de hachage standard peut être utilisée si le secret comporte 112 bits d'entropie ou plus. | 2 | -| **6.5.3** | Vérifiez que les secrets de recherche, le code d'authentification out-of-band et les mots de passe à usage unique basés sur le temps sont générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) pour éviter les valeurs prévisibles. | 2 | -| **6.5.4** | Vérifiez que les secrets de recherche et les codes d'authentification out-of-band ont un minimum de 20 bits d'entropie (généralement 4 caractères alphanumériques aléatoires ou 6 chiffres aléatoires suffisent). | 2 | -| **6.5.5** | Vérifiez que les requêtes, codes ou jetons d'authentification out-of-band, ainsi que les mots de passe à usage unique (TOTP), ont une durée de vie définie. Les requêtes out-of-band doivent avoir une durée de vie maximale de 10 minutes et les TOTP, de 30 secondes. | 2 | -| **6.5.6** | Vérifiez que tout facteur d’authentification (y compris les appareils physiques) peut être révoqué en cas de vol ou autre perte. | 3 | -| **6.5.7** | Vérifiez que les mécanismes d’authentification biométrique ne sont utilisés que comme facteurs secondaires, avec quelque chose que vous possédez ou quelque chose que vous savez. | 3 | -| **6.5.8** | Vérifiez que les mots de passe à usage unique basés sur le temps (TOTP) sont vérifiés en fonction d'une source temporelle provenant d'un service de confiance et non d'une heure non fiable ou fournie par le client. | 3 | - -## V6.6 Mécanismes d'authentification out-of-band - -Cela implique généralement que le serveur d'authentification communique avec un appareil physique via un canal secondaire sécurisé. Par exemple, l'envoi de notifications push aux appareils mobiles. Ce type de mécanisme d'authentification est considéré comme « quelque chose que vous possédez ». - -Les mécanismes d'authentification out-of-band non sécurisés tels que le courrier électronique et la VoIP ne sont pas autorisés. L'authentification PSTN et SMS est actuellement considérée comme des [mécanismes d'authentification « restreints »](https://pages.nist.gov/800-63-FAQ/#q-b01) par le NIST et devrait être déconseillée au profit des mots de passe à usage unique basés sur le temps (TOTP), d'un mécanisme cryptographique ou similaire. La norme NIST SP 800-63B [§ 5.1.3.3](https://pages.nist.gov/800-63-3/sp800-63b.html#-5133-authentication-using-the-public-switched-telephone-network) recommande de traiter les risques d'échange d'appareil, de changement de carte SIM, de portage de numéro ou d'autres comportements anormaux, si l'authentification out-of-band par téléphone ou SMS doit absolument être prise en charge. Bien que cette section ASVS n'impose pas cela comme une exigence, le fait de ne pas prendre ces précautions pour une application L2 sensible ou une application L3 doit être considéré comme un signal d'alarme important. - -Notez que le NIST a également récemment publié des directives [déconseillant l'utilisation des notifications push](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#fig-3). Bien que cette section ASVS ne le fasse pas, il est important d'être conscient des risques de « push bombing ». - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **6.6.1** | Vérifier que les mécanismes d'authentification utilisant le réseau téléphonique public commuté (RTPC) pour la transmission de mots de passe à usage unique (OTP) par téléphone ou SMS ne sont proposés que lorsque le numéro de téléphone a été préalablement validé. D'autres méthodes plus robustes (telles que les mots de passe à usage unique à durée déterminée) sont également proposées, et que le service informe les utilisateurs des risques de sécurité qu'elles présentent. Pour les applications de niveau 3, le téléphone et les SMS ne doivent pas être disponibles. | 2 | -| **6.6.2** | Vérifiez que les demandes d’authentification out-of-band, les codes ou les jetons sont liés à la demande d’authentification d’origine pour laquelle ils ont été générés et ne sont pas utilisables pour une demande précédente ou ultérieure. | 2 | -| **6.6.3** | Vérifiez qu'un mécanisme d'authentification out-of-band basé sur du code est protégé contre les attaques par force brute grâce au "rate limiting". Envisagez également d'utiliser un code avec au moins 64 bits d'entropie. | 2 | -| **6.6.4** | Vérifiez que, lorsque les notifications push sont utilisées pour l'authentification multifacteur, le "rate limiting" est appliqué afin d'empêcher les attaques de type « push bombing ». La concordance des numéros peut également atténuer ce risque. | 3 | - -## V6.7 Mécanisme d'authentification cryptographique - -Les mécanismes d'authentification cryptographique incluent les cartes à puce ou les clés FIDO. L'utilisateur doit connecter ou appairer le dispositif cryptographique à l'ordinateur pour finaliser l'authentification. Le serveur d'authentification envoie un nonce de défi au dispositif ou au logiciel cryptographique, qui calcule une réponse à partir d'une clé cryptographique stockée de manière sécurisée. Les exigences de cette section fournissent des conseils spécifiques à la mise en œuvre de ces mécanismes, les conseils sur les algorithmes cryptographiques étant traités dans le chapitre « Cryptographie ». - -Lorsque des clés partagées ou secrètes sont utilisées pour l'authentification cryptographique, elles doivent être stockées à l'aide des mêmes mécanismes que les autres secrets système, comme documenté dans la section « Gestion des secrets » du chapitre « Configuration ». - -Les exigences de cette section concernent principalement le chapitre [§ 5.1.7.2](https://pages.nist.gov/800-63-3/sp800-63b.html#sfcdv) du [Guide du NIST](https://pages.nist.gov/800-63-3/sp800-63b.html). - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **6.7.1** | Vérifiez que les certificats utilisés pour vérifier les assertions d’authentification cryptographique sont stockés de manière à les protéger contre toute modification. | 3 | -| **6.7.2** | Vérifiez que le nonce de défi a une longueur d'au moins 64 bits et qu'il est statistiquement unique ou unique sur toute la durée de vie du périphérique cryptographique. | 3 | - -## V6.8 Authentification avec un fournisseur d'identité - -Les fournisseurs d'identité (IdP) fournissent une identité fédérée aux utilisateurs. Ces derniers possèdent souvent plusieurs identités auprès de plusieurs IdP, comme une identité d'entreprise utilisant Azure AD, Okta, Ping Identity ou Google, ou une identité grand public utilisant Facebook, Twitter, Google ou WeChat, pour ne citer que quelques alternatives courantes. Cette liste ne constitue pas une recommandation pour ces entreprises ou services, mais simplement un encouragement aux développeurs à prendre en compte le fait que de nombreux utilisateurs possèdent de nombreuses identités établies. Les organisations devraient envisager l'intégration avec les identités utilisateur existantes, en fonction du profil de risque lié à la fiabilité de la vérification d'identité de l'IdP. Par exemple, il est peu probable qu'une organisation gouvernementale accepte une identité de réseau social comme identifiant pour des systèmes sensibles, car il est facile de créer de fausses identités ou des identités jetables, tandis qu'une entreprise de jeux mobiles pourrait avoir besoin de s'intégrer aux principales plateformes de réseaux sociaux pour développer sa base de joueurs actifs. - -L'utilisation sécurisée de fournisseurs d'identité externes nécessite une configuration et une vérification rigoureuses afin d'éviter l'usurpation d'identité ou la falsification d'assertions. Cette section décrit les exigences pour gérer ces risques. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **6.8.1** | Vérifiez que, si l'application prend en charge plusieurs fournisseurs d'identité (IdP), l'identité de l'utilisateur ne peut pas être usurpée via un autre fournisseur d'identité pris en charge (par exemple, en utilisant le même identifiant utilisateur). La mesure standard consisterait à ce que l'application enregistre et identifie l'utilisateur à l'aide d'une combinaison de l'ID du fournisseur d'identité (servant d'espace de noms) et de l'ID de l'utilisateur dans le fournisseur d'identité. | 2 | -| **6.8.2** | Vérifiez que la présence et l'intégrité des signatures numériques sur les assertions d'authentification (par exemple sur les assertions JWT ou SAML) sont toujours validées, en rejetant toutes les assertions non signées ou ayant des signatures non valides. | 2 | -| **6.8.3** | Vérifiez que les assertions SAML sont traitées de manière unique et utilisées une seule fois au cours de la période de validité pour éviter les attaques par rejeu. | 2 | -| **6.8.4** | Si une application utilise un fournisseur d'identité (IdP) distinct et attend une force, des méthodes ou une date d'authentification spécifiques pour des fonctions spécifiques, vérifiez que l'application les vérifie à l'aide des informations renvoyées par l'IdP. Par exemple, si OIDC est utilisé, cela peut être réalisé en validant les affirmations de jeton d'identification telles que « acr », « amr » et « auth_time » (le cas échéant). Si l'IdP ne fournit pas ces informations, l'application doit disposer d'une approche de secours documentée qui suppose que le mécanisme d'authentification de force minimale a été utilisé (par exemple, une authentification à facteur unique avec nom d'utilisateur et mot de passe). | 2 | - -## Références - -Pour plus d'informations, voir également : - -* [NIST SP 800-63 - Digital Identity Guidelines](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-3.pdf) -* [NIST SP 800-63B - Authentication and Lifecycle Management](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf) -* [NIST SP 800-63 FAQ](https://pages.nist.gov/800-63-FAQ/) -* [OWASP Web Security Testing Guide: Testing for Authentication](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/04-Authentication_Testing) -* [OWASP Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html) -* [OWASP Forgot Password Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html) -* [OWASP Choosing and Using Security Questions Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Choosing_and_Using_Security_Questions_Cheat_Sheet.html) -* [CISA Guidance on "Number Matching"](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implement-number-matching-in-mfa-applications-508c.pdf) -* [Details on the FIDO Alliance](https://fidoalliance.org/) diff --git a/5.0/fr/0x16-V7-Session-Management.md b/5.0/fr/0x16-V7-Session-Management.md deleted file mode 100644 index 18e5450eed..0000000000 --- a/5.0/fr/0x16-V7-Session-Management.md +++ /dev/null @@ -1,91 +0,0 @@ -# V7 Gestion des sessions - -## Objectif de contrôle - -Les mécanismes de gestion de session permettent aux applications de corréler les interactions entre utilisateurs et appareils au fil du temps, même avec des protocoles de communication sans état (comme HTTP). Les applications modernes peuvent utiliser plusieurs jetons de session aux caractéristiques et objectifs distincts. Un système de gestion de session sécurisé empêche les attaquants d'obtenir, d'utiliser ou d'abuser de la session d'une victime. Les applications gérant des sessions doivent garantir le respect des exigences de gestion de session de haut niveau suivantes : - -* Les sessions sont uniques à chaque individu et ne peuvent être ni devinées ni partagées. -* Les sessions sont invalidées lorsqu'elles ne sont plus nécessaires et expirent pendant les périodes d'inactivité. - -De nombreuses exigences de ce chapitre concernent des contrôles sélectionnés de [NIST SP 800-63 Digital Identity Guidelines](https://pages.nist.gov/800-63-4/), en se concentrant sur les menaces courantes et les faiblesses d'authentification couramment exploitées. - -Notez que les exigences relatives aux détails d’implémentation spécifiques de certains mécanismes de gestion de session peuvent être trouvées ailleurs : - -* Les cookies HTTP sont un mécanisme courant de sécurisation des jetons de session. Les exigences de sécurité spécifiques aux cookies sont décrites dans le chapitre « Sécurité de l'interface web ». -* Les jetons autonomes sont fréquemment utilisés pour maintenir les sessions. Les exigences de sécurité spécifiques sont décrites dans le chapitre « Jetons autonomes ». - -## V7.1 Documentation sur la gestion des sessions - -Il n'existe pas de modèle unique convenant à toutes les applications. Il est donc impossible de définir des limites universelles et adaptées à tous les cas. Une analyse des risques, accompagnée de décisions de sécurité documentées relatives à la gestion des sessions, doit être réalisée avant la mise en œuvre et les tests. Cela garantit que le système de gestion des sessions est adapté aux exigences spécifiques de l'application. - -Que le mécanisme de session choisi soit avec ou sans état, l'analyse doit être complète et documentée afin de démontrer que la solution sélectionnée est capable de satisfaire à toutes les exigences de sécurité pertinentes. L'interaction avec les mécanismes d'authentification unique (SSO) utilisés doit également être prise en compte. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **7.1.1** | Vérifiez que le délai d'inactivité de la session de l'utilisateur et la durée de vie maximale absolue de la session sont documentés, sont appropriés en combinaison avec d'autres contrôles et que la documentation inclut une justification de tout écart par rapport aux exigences de réauthentification NIST SP 800-63B. | 2 | -| **7.1.2** | Vérifiez que la documentation définit le nombre de sessions simultanées (parallèles) autorisées pour un compte ainsi que les comportements et actions prévus à entreprendre lorsque le nombre maximal de sessions actives est atteint. | 2 | -| **7.1.3** | Vérifiez que tous les systèmes qui créent et gèrent des sessions utilisateur dans le cadre d'un écosystème de gestion des identités fédérées (tels que les systèmes SSO) sont documentés avec des contrôles pour coordonner la durée de vie des sessions, la résiliation et toute autre condition nécessitant une réauthentification. | 2 | - -## V7.2 Sécurité fondamentale de la gestion des sessions - -Cette section satisfait aux exigences essentielles des sessions sécurisées en vérifiant que les jetons de session sont générés et validés de manière sécurisée. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **7.2.1** | Vérifiez que l’application effectue toutes les vérifications des jetons de session à l’aide d’un service backend de confiance. | 1 | -| **7.2.2** | Vérifiez que l'application utilise des jetons autonomes ou de référence générés dynamiquement pour la gestion des sessions, c'est-à-dire sans utiliser de secrets et de clés d'API statiques. | 1 | -| **7.2.3** | Vérifiez que si des jetons par référence sont utilisés pour représenter les sessions utilisateur, ils sont uniques et générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et possèdent au moins 128 bits d'entropie. | 1 | -| **7.2.4** | Vérifiez que l’application génère un nouveau jeton de session lors de l’authentification de l’utilisateur, y compris la réauthentification, et met fin au jeton de session actuel. | 1 | - -## V7.3 Délai d'expiration de la session - -Les mécanismes de temporisation de session servent à minimiser les risques de détournement de session et autres formes d'abus. Les temporisations doivent respecter des décisions de sécurité documentées. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **7.3.1** | Vérifiez qu’il existe un délai d’inactivité tel que la réauthentification soit appliquée conformément à l’analyse des risques et aux décisions de sécurité documentées. | 2 | -| **7.3.2** | Vérifiez qu'il existe une durée de vie maximale absolue de la session de sorte que la réauthentification soit appliquée conformément à l'analyse des risques et aux décisions de sécurité documentées. | 2 | - -## V7.4 Fin de session - -La fin de session peut être gérée soit par l'application elle-même, soit par le fournisseur d'authentification unique (SSO) si ce dernier gère la session à sa place. Il peut être nécessaire de déterminer si le fournisseur d'authentification unique est concerné par les exigences de cette section, car certaines peuvent être contrôlées par lui. - -La fin de session doit entraîner une réauthentification et être effective dans l'ensemble de l'application, de la connexion fédérée (si présente) et de toutes les parties utilisatrices. - -Pour les mécanismes de session avec état, la terminaison implique généralement l'invalidation de la session sur le serveur principal. Dans le cas de jetons autonomes, des mesures supplémentaires sont nécessaires pour révoquer ou bloquer ces jetons, car ils pourraient sinon rester valides jusqu'à leur expiration. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **7.4.1** | Vérifiez que lorsque la fin de session est déclenchée (par exemple, déconnexion ou expiration), l'application interdit toute utilisation ultérieure de la session. Pour les jetons par référence ou les sessions avec état, cela implique l'invalidation des données de session au niveau du backend de l'application. Les applications utilisant des jetons autonomes nécessiteront une solution, comme la gestion d'une liste des jetons terminés, l'interdiction des jetons produits avant une date et une heure spécifique à chaque utilisateur ou la rotation d'une clé de signature spécifique à chaque utilisateur. | 1 | -| **7.4.2** | Vérifiez que l'application met fin à toutes les sessions actives lorsqu'un compte utilisateur est désactivé ou supprimé (par exemple, lorsqu'un employé quitte l'entreprise). | 1 | -| **7.4.3** | Vérifiez que l'application offre la possibilité de mettre fin à toutes les autres sessions actives après une modification ou une suppression réussie de tout facteur d'authentification (y compris la modification du mot de passe via une réinitialisation ou une récupération et, le cas échéant, une mise à jour des paramètres MFA). | 2 | -| **7.4.4** | Vérifiez que toutes les pages nécessitant une authentification disposent d’un accès facile et visible à la fonctionnalité de déconnexion. | 2 | -| **7.4.5** | Vérifiez que les administrateurs d’applications sont en mesure de mettre fin aux sessions actives pour un utilisateur individuel ou pour tous les utilisateurs. | 2 | - -## V7.5 Défenses contre les abus de session - -Cette section décrit les exigences visant à atténuer le risque posé par les sessions actives détournées ou utilisées abusivement par des vecteurs s'appuyant sur l'existence et les capacités des sessions utilisateur actives. Par exemple, l'exécution de contenu malveillant pour forcer un navigateur authentifié à effectuer une action en utilisant la session de la victime. - -Veuillez noter que les instructions spécifiques au niveau dans le chapitre « Authentification » doivent être prises en compte lors de l'examen des exigences de cette section. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **7.5.1** | Vérifiez que l'application nécessite une réauthentification complète avant d'autoriser les modifications des attributs de compte sensibles qui peuvent affecter l'authentification, tels que l'adresse e-mail, le numéro de téléphone, la configuration MFA ou d'autres informations utilisées dans la récupération de compte. | 2 | -| **7.5.2** | Vérifiez que les utilisateurs peuvent afficher et (après s'être authentifiés à nouveau avec au moins un facteur) terminer une ou toutes les sessions actuellement actives. | 2 | -| **7.5.3** | Vérifiez que l’application nécessite une authentification supplémentaire avec au moins un facteur ou une vérification secondaire avant d’effectuer des transactions ou des opérations hautement sensibles. | 3 | - -## V7.6 Réauthentification fédérée - -Cette section s'adresse aux développeurs de code de partie utilisatrice (RP) ou de fournisseur d'identité (IdP). Ces exigences découlent de la norme [NIST SP 800-63C](https://pages.nist.gov/800-63-4/sp800-63c.html) relative à la fédération et aux assertions. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **7.6.1** | Vérifiez que la durée de vie et la fin de la session entre les parties de confiance (RP) et les fournisseurs d'identité (IdP) se comportent comme documenté, en exigeant une réauthentification si nécessaire, par exemple lorsque le temps maximal entre les événements d'authentification IdP est atteint. | 2 | -| **7.6.2** | Vérifiez que la création d'une session nécessite soit le consentement de l'utilisateur, soit une action explicite, empêchant ainsi la création de nouvelles sessions d'application sans interaction de l'utilisateur. | 2 | - -## Références - -Pour plus d'informations, voir également : - -* [OWASP Web Security Testing Guide: Session Management Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/06-Session_Management_Testing) -* [OWASP Session Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html) diff --git a/5.0/fr/0x17-V8-Authorization.md b/5.0/fr/0x17-V8-Authorization.md deleted file mode 100644 index 1b3d4630fe..0000000000 --- a/5.0/fr/0x17-V8-Authorization.md +++ /dev/null @@ -1,56 +0,0 @@ -# V8 Autorisation - -## Objectif de contrôle - -L'autorisation garantit que l'accès est accordé uniquement aux utilisateurs autorisés (utilisateurs, serveurs et autres clients). Pour appliquer le principe du moindre privilège (POLP), les applications vérifiées doivent répondre aux exigences générales suivantes : - -* Documenter les règles d'autorisation des documents, y compris les facteurs de prise de décision et les contextes environnementaux. -* Les consommateurs ne devraient avoir accès qu'aux ressources autorisées par leurs droits définis. - -## V8.1 Documentation d'autorisation - -Une documentation exhaustive des autorisations est essentielle pour garantir que les décisions de sécurité sont appliquées de manière cohérente, vérifiables et conformes aux politiques de l'organisation. Cela réduit le risque d'accès non autorisé en clarifiant les exigences de sécurité et en les rendant applicables aux développeurs, administrateurs et testeurs. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **8.1.1** | Vérifiez que la documentation d’autorisation définit des règles de restriction de l’accès au niveau de la fonction et aux données en fonction des autorisations du consommateur et des attributs des ressources. | 1 | -| **8.1.2** | Vérifiez que la documentation d'autorisation définit les règles de restriction d'accès au niveau des champs (lecture et écriture) en fonction des autorisations des consommateurs et des attributs des ressources. Notez que ces règles peuvent dépendre d'autres valeurs d'attributs de l'objet de données concerné, telles que l'état ou le statut. | 2 | -| **8.1.3** | Vérifiez que la documentation de l'application définit les attributs environnementaux et contextuels (y compris, mais sans s'y limiter, l'heure de la journée, l'emplacement de l'utilisateur, l'adresse IP ou l'appareil) qui sont utilisés dans l'application pour prendre des décisions de sécurité, y compris celles relatives à l'authentification et à l'autorisation. | 3 | -| **8.1.4** | Vérifier que la documentation d'authentification et d'autorisation définit l'utilisation des facteurs environnementaux et contextuels dans la prise de décision, en plus des autorisations au niveau des fonctions, des données et des champs. Cela doit inclure les attributs évalués, les seuils de risque et les actions entreprises (par exemple, autorisation, contestation, refus, renforcement de l'authentification). | 3 | - -## V8.2 Conception d'autorisation générale - -La mise en œuvre de contrôles d’autorisation granulaires aux niveaux de la fonction, des données et des champs garantis que les consommateurs ne pourront accéder qu’à ce qui leur a été explicitement accordé. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **8.2.1** | Vérifiez que l’application garantit que l’accès basé sur la fonction est limité aux consommateurs disposant d’autorisations explicites. | 1 | -| **8.2.2** | Vérifiez que l'application garantit que l'accès spécifique aux données est limité aux consommateurs disposant d'autorisations explicites sur des éléments de données spécifiques afin d'atténuer les références d'objet directes non sécurisées (IDOR) et les autorisations de niveau d'objet rompues (BOLA). | 1 | -| **8.2.3** | Vérifiez que l'application garantit que l'accès au niveau du champ est limité aux consommateurs disposant d'autorisations explicites sur des champs spécifiques afin d'atténuer les problèmes d'autorisation au niveau de la propriété d'objet (BOPLA). | 2 | -| **8.2.4** | Vérifiez que les contrôles de sécurité adaptatifs basés sur les attributs environnementaux et contextuels du consommateur (tels que l'heure, la localisation, l'adresse IP ou l'appareil) sont mis en œuvre pour les décisions d'authentification et d'autorisation, comme défini dans la documentation de l'application. Ces contrôles doivent être appliqués lorsque le consommateur tente de démarrer une nouvelle session et également pendant une session existante. | 3 | - -## V8.3 Autorisation par opération - -L'application immédiate des modifications d'autorisation dans le niveau approprié de l'architecture d'une application est essentielle pour empêcher les actions non autorisées, en particulier dans les environnements dynamiques. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **8.3.1** | Vérifier que l'application applique les règles d'autorisations au niveau de la couche service de confiance et ne s’appuie pas sur des contrôles qu’un consommateur non approuvé pourrait manipuler, comme JavaScript côté client. | 1 | -| **8.3.2** | Vérifiez que les modifications apportées aux valeurs sur lesquelles reposent les décisions d'autorisation sont appliquées immédiatement. Lorsque les modifications ne peuvent pas être appliquées immédiatement (par exemple, en s'appuyant sur des données de jetons autonomes), des contrôles d'atténuation doivent être mis en place pour alerter un consommateur lorsqu'il effectue une action alors qu'il n'est plus autorisé à le faire et annuler la modification. Notez que cette solution alternative ne limiterait pas les fuites d'informations. | 3 | -| **8.3.3** | Vérifiez que l'accès à un objet repose sur les autorisations du sujet d'origine (par exemple, le consommateur), et non sur celles d'un intermédiaire ou d'un service agissant en son nom. Par exemple, si un consommateur appelle un service web à l'aide d'un jeton d'authentification autonome, et que ce service demande ensuite des données à un autre service, ce dernier utilisera le jeton du consommateur, plutôt qu'un jeton inter-machine du premier service, pour prendre les décisions d'autorisation. | 3 | - -## V8.4 Autres considérations relatives à l'autorisation - -Des considérations supplémentaires concernant l’autorisation, en particulier pour les interfaces administratives et les environnements multi-tenants, aident à empêcher tout accès non autorisé. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **8.4.1** | Vérifiez que les applications multi-tenants utilisent des contrôles inter-tenants pour garantir que les opérations des consommateurs n'affecteront jamais les tenants avec lesquels ils ne sont pas autorisés à interagir. | 2 | -| **8.4.2** | Vérifiez que l'accès aux interfaces administratives intègre plusieurs couches de sécurité, notamment la vérification continue de l'identité du consommateur, l'évaluation de la posture de sécurité des appareils et l'analyse contextuelle des risques, garantissant que l'emplacement du réseau ou les endpoints approuvés ne sont pas les seuls facteurs d'autorisation, même s'ils peuvent réduire la probabilité d'accès non autorisé. | 3 | - -## Références - -Pour plus d'informations, voir également : - -* [OWASP Web Security Testing Guide: Authorization](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/05-Authorization_Testing) -* [OWASP Authorization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html) diff --git a/5.0/fr/0x18-V9-Self-contained-Tokens.md b/5.0/fr/0x18-V9-Self-contained-Tokens.md deleted file mode 100644 index e347810721..0000000000 --- a/5.0/fr/0x18-V9-Self-contained-Tokens.md +++ /dev/null @@ -1,36 +0,0 @@ -# V9 Jetons autonomes - -## Objectif de contrôle - -Le concept de jeton autonome est mentionné dans la RFC 6749 OAuth 2.0 originale de 2012. Il désigne un jeton contenant des données ou des déclarations sur lesquelles un service récepteur s'appuie pour prendre des décisions de sécurité. Il convient de le distinguer d'un simple jeton contenant uniquement un identifiant, qu'un service récepteur utilise pour rechercher des données localement. Les exemples les plus courants de jetons autonomes sont les jetons Web JSON (JWT) et les assertions SAML. - -L'utilisation de jetons autonomes est devenue très répandue, même en dehors d'OAuth et d'OIDC. Parallèlement, la sécurité de ce mécanisme repose sur la capacité à valider l'intégrité du jeton et à garantir sa validité dans un contexte particulier. Ce processus présente de nombreux pièges, et ce chapitre détaille les mécanismes que les applications devraient mettre en place pour les éviter. - -## V9.1 Source et intégrité du jeton - -Cette section comprend des exigences visant à garantir que le jeton a été produit par une partie de confiance et n’a pas été falsifié. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **9.1.1** | Vérifiez que les jetons autonomes sont validés à l'aide de leur signature numérique ou MAC pour les protéger contre toute falsification avant d'accepter le contenu du jeton. | 1 | -| **9.1.2** | Vérifiez que seuls les algorithmes d'une liste d’autorisations peuvent être utilisés pour créer et vérifier des jetons autonomes, dans un contexte donné. La liste d'autorisation doit inclure les algorithmes autorisés, idéalement symétriques ou asymétriques, et ne doit pas inclure l'algorithme « Aucun ». Si les algorithmes symétriques et asymétriques doivent être pris en charge, des contrôles supplémentaires seront nécessaires pour éviter toute confusion de clés. | 1 | -| **9.1.3** | Vérifiez que les clés utilisées pour valider les jetons autonomes proviennent de sources préconfigurées et fiables pour l'émetteur du jeton, empêchant ainsi les attaquants de spécifier des sources et des clés non fiables. Pour les JWT et autres structures JWS, les en-têtes tels que « jku », « x5u » et « jwk » doivent être validés par rapport à une liste d'autorisation de sources fiables. | 1 | - -## V9.2 Contenu du jeton - -Avant de prendre des décisions de sécurité basées sur le contenu d'un jeton autonome, il est nécessaire de vérifier que le jeton a été présenté pendant sa période de validité et qu'il est destiné à être utilisé par le service destinataire et pour l'usage pour lequel il a été présenté. Cela permet d'éviter toute utilisation croisée non sécurisée entre différents services ou avec différents types de jetons provenant du même émetteur. - -Les exigences spécifiques pour OAuth et OIDC sont couvertes dans le chapitre dédié. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **9.2.1** | Vérifiez que, si une période de validité est indiquée dans les données du jeton, celui-ci et son contenu ne sont acceptés que si la date de vérification est comprise dans cette période. Par exemple, pour les JWT, les déclarations « nbf » et « exp » doivent être vérifiées. | 1 | -| **9.2.2** | Vérifiez que le service recevant un jeton valide le type de jeton et son utilisation avant d'en accepter le contenu. Par exemple, seuls les jetons d'accès peuvent être acceptés pour les décisions d'autorisation, et seuls les jetons d'identification peuvent être utilisés pour prouver l'authentification des utilisateurs. | 2 | -| **9.2.3** | Vérifiez que le service accepte uniquement les jetons destinés à être utilisés avec ce service (audience). Pour les JWT, cela peut être réalisé en validant la déclaration « aud » par rapport à une liste d'autorisation définie dans le service. | 2 | -| **9.2.4** | Si un émetteur de jetons utilise la même clé privée pour émettre des jetons destinés à différentes audiences, vérifiez que les jetons émis contiennent une restriction d'audience identifiant de manière unique les audiences visées. Cela empêchera la réutilisation d'un jeton avec une audience non prévue. Si l'identifiant d'audience est provisionné dynamiquement, l'émetteur de jetons doit valider ces audiences afin de garantir qu'elles n'entraînent pas d'usurpation d'identité. | 2 | - -## Références - -Pour plus d'informations, voir également : - -* [OWASP JSON Web Token Cheat Sheet for Java Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_for_Java_Cheat_Sheet.html) (mais il contient des orientations générales utiles) diff --git a/5.0/fr/0x19-V10-OAuth-and-OIDC.md b/5.0/fr/0x19-V10-OAuth-and-OIDC.md deleted file mode 100644 index 51ad34fcce..0000000000 --- a/5.0/fr/0x19-V10-OAuth-and-OIDC.md +++ /dev/null @@ -1,169 +0,0 @@ -# V10 Oauth et OIDC - -## Objectif de contrôle - -OAuth2 (appelé OAuth dans ce chapitre) est un framework standard pour l'autorisation déléguée. Par exemple, grâce à OAuth, une application cliente peut accéder aux API (ressources serveur) au nom d'un utilisateur, à condition que ce dernier l'ait autorisée. - -OAuth n'est pas conçu pour l'authentification dOauth et OIDCes utilisateurs. Le Framework OpenID Connect (OIDC) étend OAuth en ajoutant une couche d'identité utilisateur. OIDC prend en charge des fonctionnalités telles que la standardisation des informations utilisateur, l'authentification unique (SSO) et la gestion des sessions. OIDC étant une extension d'OAuth, les exigences OAuth décrites dans ce chapitre s'appliquent également à OIDC. - -Les rôles suivants sont définis dans OAuth : - -* Le client OAuth est l'application qui tente d'accéder aux ressources du serveur (par exemple, en appelant une API à l'aide du jeton d'accès émis). Il s'agit souvent d'une application côté serveur. - * Un client confidentiel est un client capable de maintenir la confidentialité des informations d’identification qu’il utilise pour s’authentifier auprès du serveur d’autorisation. - * Un client public n'est pas en mesure de préserver la confidentialité des informations d'identification nécessaires à l'authentification auprès du serveur d'autorisation. Par conséquent, au lieu de s'authentifier (par exemple, à l'aide des paramètres « client_id » et « client_secret »), il s'identifie uniquement (à l'aide du paramètre « client_id »). -* Le serveur de ressources OAuth (RS) est l’API du serveur qui expose les ressources aux clients OAuth. -* Le serveur d'autorisation OAuth (AS) est une application serveur qui émet des jetons d'accès aux clients OAuth. Ces jetons permettent aux clients OAuth d'accéder aux ressources RS, soit pour le compte d'un utilisateur final, soit pour leur propre compte. L'AS est souvent une application distincte, mais (le cas échéant) il peut être intégré à un RS approprié. -* Le propriétaire de la ressource (RO) est l'utilisateur final qui autorise les clients OAuth à obtenir en son nom un accès limité aux ressources hébergées sur le serveur de ressources. Le propriétaire de la ressource consent à cette autorisation déléguée en interagissant avec le serveur d'autorisation. - -Les rôles suivants sont définis dans OIDC : - -* La partie de confiance (RP) est l'application cliente qui demande l'authentification de l'utilisateur final via le fournisseur OpenID. Elle joue le rôle de client OAuth. -* Le fournisseur OpenID (OP) est un AS OAuth capable d'authentifier l'utilisateur final et de fournir des déclarations OIDC à un RP. L'OP peut être le fournisseur d'identité (IdP), mais dans les scénarios fédérés, l'OP et le fournisseur d'identité (où l'utilisateur final s'authentifie) peuvent être des applications serveur différentes. - -OAuth et OIDC ont été initialement conçus pour les applications tierces. Aujourd'hui, ils sont également souvent utilisés par les applications propriétaires. Cependant, lorsqu'ils sont utilisés dans des scénarios propriétaires, comme l'authentification et la gestion de session, le protocole ajoute une certaine complexité, ce qui peut engendrer de nouveaux défis de sécurité. - -OAuth et OIDC peuvent être utilisés pour de nombreux types d'applications, mais l'accent d'ASVS et les exigences de ce chapitre portent sur les applications Web et les API. - -Étant donné que OAuth et OIDC peuvent être considérés comme une logique au-dessus des technologies Web, les exigences générales des autres chapitres s'appliquent toujours et ce chapitre ne peut pas être sorti de son contexte. - -Ce chapitre présente les meilleures pratiques actuelles pour OAuth2 et OIDC, conformément aux spécifications disponibles sur et . Même si les RFC sont considérées comme matures, elles sont fréquemment mises à jour. Il est donc important de se conformer aux dernières versions lors de l'application des exigences de ce chapitre. Consultez la section Références pour plus de détails. - -Compte tenu de la complexité du domaine, il est essentiel qu’une solution OAuth ou OIDC sécurisée utilise des serveurs d’autorisation standard bien connus du secteur et applique la configuration de sécurité recommandée. - -La terminologie utilisée dans ce chapitre est conforme aux RFC OAuth et aux spécifications OIDC ; mais notez que la terminologie OIDC n'est utilisée que pour les exigences spécifiques à OIDC, sinon, la terminologie OAuth est utilisée. - -Dans le contexte d'OAuth et d'OIDC, le terme « jeton » dans ce chapitre fait référence à : - -* Les jetons d'accès, qui ne peuvent être consommés que par le serveur de sécurité (RS) et qui peuvent être des jetons de référence validés par introspection ou des jetons autonomes validés à l'aide d'un matériau clé. -* Jetons de rafraîchissement, qui ne seront consommés que par le serveur d'autorisation qui a émis le jeton. -* Jetons d'identification OIDC, qui ne doivent être consommés que par le client qui a déclenché le flux d'autorisation. - -Les niveaux de risque pour certaines exigences de ce chapitre varient selon que le client est confidentiel ou public. L'utilisation d'une authentification client forte limitant de nombreux vecteurs d'attaque, certaines exigences peuvent être assouplies lors de l'utilisation d'un client confidentiel pour les applications L1. - -## V10.1 Sécurité générique OAuth et OIDC - -Cette section couvre les exigences architecturales génériques qui s’appliquent à toutes les applications utilisant OAuth ou OIDC. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **10.1.1** | Vérifiez que les jetons sont envoyés uniquement aux composants qui en ont absolument besoin. Par exemple, lors de l'utilisation d'un modèle backend-for-frontend pour les applications JavaScript basées sur un navigateur, les jetons d'accès et d'actualisation ne doivent être accessibles qu'au backend. | 2 | -| **10.1.2** | Vérifiez que le client n'accepte les valeurs du serveur d'autorisation (telles que le code d'autorisation ou le jeton d'identification) que si elles résultent d'un flux d'autorisation initié par la même session d'agent utilisateur et la même transaction. Cela nécessite que les secrets générés par le client, tels que la clé de preuve pour l'échange de codes (PKCE) « code_verifier », « state » ou le nonce OIDC, ne puissent être devinés, soient spécifiques à la transaction et soient liés de manière sécurisée au client et à la session d'agent utilisateur au cours de laquelle la transaction a été initiée. | 2 | - -## V10.2 Client OAuth - -Ces exigences détaillent les responsabilités des applications clientes OAuth. Le client peut être, par exemple, un serveur web backend (souvent utilisé comme backend pour frontend, BFF), une intégration de service backend ou une application monopage frontend (SPA, également appelée application basée sur un navigateur). - -En général, les clients backend sont considérés comme confidentiels et les clients frontend comme publics. Cependant, les applications natives exécutées sur l'appareil de l'utilisateur final peuvent être considérées comme confidentielles lorsqu'elles s'enregistrent dynamiquement des clients OAuth. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **10.2.1** | Vérifiez que, si le flux de code est utilisé, le client OAuth dispose d'une protection contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF), qui déclenchent des demandes de jetons, soit en utilisant la fonctionnalité de clé de preuve pour l'échange de code (PKCE), soit en vérifiant le paramètre « state » envoyé dans la demande d'autorisation. | 2 | -| **10.2.2** | Vérifiez que, si le client OAuth peut interagir avec plusieurs serveurs d'autorisation, il dispose d'une protection contre les attaques par confusion. Par exemple, il peut exiger que le serveur d'autorisation renvoie la valeur du paramètre « iss » et la valide dans la réponse d'autorisation et la réponse du jeton. | 2 | -| **10.2.3** | Vérifiez que le client OAuth demande uniquement les portées requises (ou d’autres paramètres d’autorisation) dans les requêtes adressées au serveur d’autorisation. | 3 | - -## V10.3 Serveur de ressources OAuth - -Dans le contexte d'ASVS et de ce chapitre, le serveur de ressources est une API. Pour fournir un accès sécurisé, le serveur de ressources doit : - -* Valider le jeton d'accès, conformément au format du jeton et aux spécifications du protocole, par exemple, validation JWT ou introspection du jeton OAuth. -* S'il est valide, appliquer les décisions d'autorisation en fonction des informations du jeton d'accès et des autorisations accordées. Par exemple, le serveur de ressources doit vérifier que le client (agissant au nom du RO) est autorisé à accéder à la ressource demandée. - -Par conséquent, les exigences répertoriées ici sont spécifiques à OAuth ou OIDC et doivent être exécutées après la validation du jeton et avant d'effectuer l'autorisation basée sur les informations du jeton. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **10.3.1** | Vérifiez que le serveur de ressources accepte uniquement les jetons d'accès destinés à être utilisés avec ce service (audience). L'audience peut être incluse dans un jeton d'accès structuré (comme la déclaration « aud » dans JWT) ou vérifiée à l'aide du endpoint d'introspection de jeton. | 2 | -| **10.3.2** | Vérifiez que le serveur de ressources applique les décisions d'autorisation en fonction des déclarations du jeton d'accès définissant l'autorisation déléguée. Si des déclarations telles que « sub », « scope » et « authorization_details » sont présentes, elles doivent être prises en compte dans la décision. | 2 | -| **10.3.3** | Vérifiez que si une décision de contrôle d'accès nécessite l'identification d'un utilisateur unique à partir d'un jeton d'accès (JWT ou réponse d'introspection de jeton associé), le serveur de ressources identifie l'utilisateur à partir de déclarations non ré attribuables à d'autres utilisateurs. En général, cela implique l'utilisation d'une combinaison de déclarations « iss » et « sub ». | 2 | -| **10.3.4** | Si le serveur de ressources requiert une force d'authentification, des méthodes ou une date d'expiration spécifiques, vérifiez que le jeton d'accès présenté respecte ces contraintes. Par exemple, s'il est présent, utilisez les déclarations OIDC « acr », « amr » et « auth_time » respectivement. | 2 | -| **10.3.5** | Vérifiez que le serveur de ressources empêche l'utilisation de jetons d'accès volés ou la relecture de jetons d'accès (de parties non autorisées) en exigeant des jetons d'accès limités par l'expéditeur, soit Mutual TLS pour OAuth 2, soit OAuth 2 Demonstration of Proof of Possession (DPoP). | 3 | - -## V10.4 Serveur d'autorisation OAuth - -Ces exigences détaillent les responsabilités des serveurs d’autorisation OAuth, y compris les fournisseurs OpenID. - -Pour l'authentification client, la méthode « self_signed_tls_client_auth » est autorisée avec les prérequis requis par la [section 2.2](https://datatracker.ietf.org/doc/html/rfc8705#name-self-signed-certificate-mut) de la [RFC 8705](https://datatracker.ietf.org/doc/html/rfc8705). - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **10.4.1** | Vérifiez que le serveur d'autorisation valide les URI de redirection en fonction d'une liste d'autorisation spécifique au client d'URI préenregistrés à l'aide d'une comparaison de chaînes exacte. | 1 | -| **10.4.2** | Vérifiez que, si le serveur d'autorisation renvoie le code d'autorisation dans la réponse, celui-ci ne peut être utilisé qu'une seule fois pour une demande de jeton. Pour la deuxième demande valide avec un code d'autorisation déjà utilisé pour émettre un jeton d'accès, le serveur d'autorisation doit rejeter la demande de jeton et révoquer tous les jetons émis liés au code d'autorisation. | 1 | -| **10.4.3** | Vérifiez que le code d'autorisation est de courte durée. La durée de vie maximale peut atteindre 10 minutes pour les applications L1 et L2 et 1 minute pour les applications L3. | 1 | -| **10.4.4** | Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement l'utilisation des autorisations nécessaires à ce client. Notez que les autorisations « token » (flux implicite) et « password » (flux d'informations d'identification du propriétaire de la ressource) ne doivent plus être utilisées. | 1 | -| **10.4.5** | Vérifiez que le serveur d'autorisation atténue les attaques par rejeu de jetons d'actualisation pour les clients publics, de préférence en utilisant des jetons d'actualisation limités par l'expéditeur, par exemple des jetons DPoP (Demonstrating Proof of Possession) ou des jetons d'accès liés à un certificat utilisant le protocole TLS mutuel (mTLS). Pour les applications L1 et L2, la rotation des jetons d'actualisation peut être utilisée. Si cette rotation est utilisée, le serveur d'autorisation doit invalider le jeton d'actualisation après utilisation et révoquer tous les jetons d'actualisation de cette autorisation si un jeton d'actualisation déjà utilisé et invalidé est fourni. | 1 | -| **10.4.6** | Vérifiez que, si l'octroi de code est utilisé, le serveur d'autorisation atténue les attaques par interception de code en exigeant une clé de preuve pour l'échange de code (PKCE). Pour les demandes d'autorisation, le serveur d'autorisation doit exiger une valeur « code_challenge » valide et ne doit pas accepter une valeur « plain » pour « code_challenge_method ». Pour une demande de jeton, il doit exiger la validation du paramètre « code_verifier ». | 2 | -| **10.4.7** | Vérifiez que si le serveur d'autorisation prend en charge l'enregistrement dynamique des clients non authentifiés, il réduit le risque d'applications clientes malveillantes. Il doit valider les métadonnées clientes, telles que les URI enregistrés, garantir le consentement de l'utilisateur et l'avertir avant de traiter une demande d'autorisation avec une application cliente non approuvée. | 2 | -| **10.4.8** | Vérifiez que les jetons d’actualisation ont une expiration absolue, y compris si l’expiration du jeton d’actualisation glissant est appliquée. | 2 | -| **10.4.9** | Vérifiez que les jetons d'actualisation et les jetons d'accès de référence peuvent être révoqués par un utilisateur autorisé à l'aide de l'interface utilisateur du serveur d'autorisation, afin d'atténuer le risque de clients malveillants ou de jetons volés. | 2 | -| **10.4.10** | Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton. | 2 | -| **10.4.11** | Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton. | 2 | -| **10.4.12** | Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement la valeur « response_mode » dont ce client a besoin. Par exemple, en vérifiant cette valeur par rapport aux valeurs attendues ou en utilisant une requête d'autorisation poussée (PAR) ou une requête d'autorisation sécurisée par JWT (JAR). | 3 | -| **10.4.13** | Vérifiez que le type d'Autorisation « code » est toujours utilisé avec les demandes d'autorisation poussées (PAR). | 3 | -| **10.4.14** | Vérifiez que le serveur d'autorisation émet uniquement des jetons d'accès limités à l'expéditeur (preuve de possession), soit avec des jetons d'accès liés au certificat utilisant TLS mutuel (mTLS), soit avec des jetons d'accès liés au DPoP (démonstration de preuve de possession). | 3 | -| **10.4.15** | Vérifiez que, pour un client côté serveur (non exécuté sur l'appareil de l'utilisateur final), le serveur d'autorisation garantit que la valeur du paramètre « authorization_details » provient du backend client et que l'utilisateur ne l'a pas altérée. Par exemple, en exigeant l'utilisation d'une demande d'autorisation poussée (PAR) ou d'une demande d'autorisation sécurisée par JWT (JAR). | 3 | -| **10.4.16** | Vérifiez que le client est confidentiel et que le serveur d'autorisation requiert l'utilisation de méthodes d'authentification client fortes (basées sur la cryptographie à clé publique et résistantes aux attaques par relecture), telles que TLS mutuel ('tls_client_auth', 'self_signed_tls_client_auth') ou JWT à clé privée ('private_key_jwt'). | 3 | - -## V10.5 Client OIDC - -Étant donné que la partie utilisatrice d'OIDC agit en tant que client OAuth, les exigences de la section « Client OAuth » s'appliquent également. - -Notez que la section « Authentification avec un fournisseur d’identité » du chapitre « Authentification » contient également des exigences générales pertinentes. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **10.5.1** | Vérifiez que le client (en tant que partie utilisatrice) atténue les attaques par rejeu de jeton d'identification. Par exemple, en vous assurant que la valeur « nonce » du jeton d'identification correspond à la valeur « nonce » envoyée dans la demande d'authentification au fournisseur OpenID (appelée demande d'autorisation envoyée au serveur d'autorisation dans OAuth2). | 2 | -| **10.5.2** | Vérifiez que le client identifie de manière unique l'utilisateur à partir des déclarations de jeton d'identification, généralement la déclaration « sub », qui ne peut pas être réaffectée à d'autres utilisateurs (pour la portée d'un fournisseur d'identité). | 2 | -| **10.5.3** | Vérifiez que le client rejette les tentatives d'un serveur d'autorisation malveillant d'usurper l'identité d'un autre serveur d'autorisation via ses métadonnées. Le client doit rejeter les métadonnées du serveur d'autorisation si l'URL de l'émetteur figurant dans ces métadonnées ne correspond pas exactement à l'URL d'émetteur préconfigurée attendue par le client. | 2 | -| **10.5.4** | Vérifiez que le client valide que le jeton d'identification est destiné à être utilisé pour ce client (audience) en vérifiant que la déclaration « aud » du jeton est égale à la valeur « client_id » pour le client. | 2 | -| **10.5.5** | Vérifiez que, lors de l'utilisation de la déconnexion du back-channel OIDC, la partie utilisatrice atténue les risques de déni de service liés à la déconnexion forcée et à la confusion entre JWT dans le flux de déconnexion. Le client doit vérifier que le jeton de déconnexion est correctement typé avec la valeur « logout+jwt », qu'il contient la déclaration « event » avec le nom de membre correct et qu'il ne contient pas de déclaration « nonce ». Il est également recommandé d'utiliser une expiration courte (par exemple, 2 minutes). | 2 | - -## V10.6 Fournisseur OpenID - -Étant donné que les fournisseurs OpenID agissent comme des serveurs d'autorisation OAuth, les exigences de la section « Serveur d'autorisation OAuth » s'appliquent également. - -Notez que si vous utilisez le flux de jeton d'identification (et non le flux de code), aucun jeton d'accès n'est émis et de nombreuses exigences pour OAuth AS ne sont pas applicables. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **10.6.1** | Vérifiez que le fournisseur OpenID n'autorise que les valeurs « code », « ciba », « id_token » ou « id_token code » pour le mode de réponse. Notez que « code » est préférable à « id_token code » (flux hybride OIDC) et que « token » (tout flux implicite) ne doit pas être utilisé. | 2 | -| **10.6.2** | Vérifiez que le fournisseur OpenID atténue les risques de déni de service liés à la déconnexion forcée. Pour ce faire, obtenez une confirmation explicite de l'utilisateur final ou, le cas échéant, validez les paramètres de la requête de déconnexion (initiée par la partie utilisatrice), comme « id_token_hint ». | 2 | - -## V10.7 Gestion du consentement - -Ces exigences couvrent la vérification du consentement de l'utilisateur par le serveur d'autorisation. Sans vérification appropriée du consentement de l'utilisateur, un acteur malveillant peut obtenir des autorisations au nom de l'utilisateur par usurpation d'identité ou ingénierie sociale. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **10.7.1** | Vérifiez que le serveur d'autorisation garantit le consentement de l'utilisateur à chaque demande d'autorisation. Si l'identité du client ne peut être garantie, le serveur d'autorisation doit toujours demander explicitement le consentement de l'utilisateur. | 2 | -| **10.7.2** | Vérifiez que lorsque le serveur d'autorisation demande le consentement de l'utilisateur, il fournit des informations claires et suffisantes sur ce qui est consenti. Le cas échéant, ces informations doivent inclure la nature des autorisations demandées (généralement en fonction de la portée, du serveur de ressources et des détails d'autorisation RAR), l'identité de l'application autorisée et la durée de vie de ces autorisations. | 2 | -| **10.7.3** | Vérifiez que l’utilisateur peut consulter, modifier et révoquer les consentements qu’il a accordés via le serveur d’autorisation. | 2 | - -## Références - -Pour plus d'informations, voir également : - -* [oauth.net](https://oauth.net/) -* [OWASP OAuth 2.0 Protocol Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/OAuth2_Cheat_Sheet.html) - -Pour les exigences liées à OAuth dans ASVS, les RFC publiées et à l'état de projet suivantes sont utilisées : - -* [RFC6749 The OAuth 2.0 Authorization Framework](https://datatracker.ietf.org/doc/html/rfc6749) -* [RFC6750 The OAuth 2.0 Authorization Framework: Bearer Token Usage](https://datatracker.ietf.org/doc/html/rfc6750) -* [RFC6819 OAuth 2.0 Threat Model and Security Considerations](https://datatracker.ietf.org/doc/html/rfc6819) -* [RFC7636 Proof Key for Code Exchange by OAuth Public Clients](https://datatracker.ietf.org/doc/html/rfc7636) -* [RFC7591 OAuth 2.0 Dynamic Client Registration Protocol](https://datatracker.ietf.org/doc/html/rfc7591) -* [RFC8628 OAuth 2.0 Device Authorization Grant](https://datatracker.ietf.org/doc/html/rfc8628) -* [RFC8707 Resource Indicators for OAuth 2.0](https://datatracker.ietf.org/doc/html/rfc8707) -* [RFC9068 JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens](https://datatracker.ietf.org/doc/html/rfc9068) -* [RFC9126 OAuth 2.0 Pushed Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9126) -* [RFC9207 OAuth 2.0 Authorization Server Issuer Identification](https://datatracker.ietf.org/doc/html/rfc9207) -* [RFC9396 OAuth 2.0 Rich Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9396) -* [RFC9449 OAuth 2.0 Demonstrating Proof of Possession (DPoP)](https://datatracker.ietf.org/doc/html/rfc9449) -* [RFC9700 Best Current Practice for OAuth 2.0 Security](https://datatracker.ietf.org/doc/html/rfc9700) -* [draft OAuth 2.0 for Browser-Based Applications](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-browser-based-apps) -* [draft The OAuth 2.1 Authorization Framework](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-12) - -Pour plus d'informations sur OpenID Connect, veuillez consulter : - -* [OpenID Connect Core 1.0](https://openid.net/specs/openid-connect-core-1_0.html) -* [FAPI 2.0 Security Profile](https://openid.net/specs/fapi-security-profile-2_0-final.html) diff --git a/5.0/fr/0x20-V11-Cryptography.md b/5.0/fr/0x20-V11-Cryptography.md deleted file mode 100644 index 033da4784a..0000000000 --- a/5.0/fr/0x20-V11-Cryptography.md +++ /dev/null @@ -1,107 +0,0 @@ -# V11 Cryptographie - -## Objectif de contrôle - -L'objectif de ce chapitre est de définir les meilleures pratiques pour l'utilisation générale de la cryptographie, ainsi que d'inculquer une compréhension fondamentale des principes cryptographiques et d'encourager une évolution vers des approches plus résilientes et modernes. Il encourage les actions suivantes : - -* Mise en œuvre de systèmes cryptographiques robustes, sécurisés, adaptables à l'évolution des menaces et pérennes. -* Utilisation de mécanismes cryptographiques sécurisés et conformes aux meilleures pratiques du secteur. -* Maintien d'un système de gestion des clés cryptographiques sécurisé, avec des contrôles d'accès et des audits appropriés. -* Évaluation régulière du paysage cryptographique pour identifier les nouveaux risques et adapter les algorithmes en conséquence. -* Identification et gestion des cas d'utilisation cryptographiques tout au long du cycle de vie de l'application afin de garantir la prise en compte et la sécurité de tous les actifs cryptographiques. - -Outre les principes généraux et les bonnes pratiques, ce document fournit également des informations techniques plus détaillées sur les exigences de l'annexe V – Normes de cryptographie. Cela inclut les algorithmes et les modes considérés comme « approuvés » aux fins des exigences de ce chapitre. - -Les exigences qui utilisent la cryptographie pour résoudre un problème distinct, comme la gestion des secrets ou la sécurité des communications, figureront dans différentes parties de la norme. - -## V11.1 Inventaire et documentation cryptographiques - -Les applications doivent être conçues avec une architecture cryptographique robuste afin de protéger les données selon leur classification. Chiffrer tout est un gaspillage ; ne rien chiffrer est une négligence juridique. Un équilibre doit être trouvé, généralement lors de la conception architecturale ou de haut niveau, des sprints de conception ou des pics d'architecture. Concevoir la cryptographie au fur et à mesure ou la moderniser coûtera inévitablement beaucoup plus cher à mettre en œuvre de manière sécurisée que de l'intégrer dès le départ. - -Il est important de veiller à ce que tous les actifs cryptographiques soient régulièrement découverts, inventoriés et évalués. Veuillez consulter l'annexe pour plus d'informations sur la procédure à suivre. - -Il est également crucial de pérenniser les systèmes cryptographiques face à l'essor futur de l'informatique quantique. La cryptographie post-quantique (PQC) désigne les algorithmes cryptographiques conçus pour résister aux attaques des ordinateurs quantiques, qui sont susceptibles de casser des algorithmes largement utilisés tels que RSA et la cryptographie à courbe elliptique (ECC). - -Veuillez consulter l'annexe pour obtenir des conseils actualisés sur les primitives et les normes PQC approuvées. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **11.1.1** | Vérifiez qu’il existe une politique documentée pour la gestion des clés cryptographiques et un cycle de vie des clés cryptographiques qui suit une norme de gestion des clés telle que NIST SP 800-57. Cela devrait inclure la garantie que les clés ne sont pas sur-partagées (par exemple, avec plus de deux entités pour les secrets partagés et plus d’une entité pour les clés privées). | 2 | -| **11.1.2** | Vérifiez qu'un inventaire cryptographique est réalisé, maintenu et régulièrement mis à jour, et qu'il inclut toutes les clés, algorithmes et certificats cryptographiques utilisés par l'application. Il doit également documenter les emplacements du système où les clés peuvent ou non être utilisées, ainsi que les types de données qui peuvent ou non être protégées par ces clés. | 2 | -| **11.1.3** | Vérifiez que les mécanismes de découverte cryptographique sont utilisés pour identifier toutes les instances de cryptographie dans le système, y compris les opérations de chiffrement, de hachage et de signature. | 3 | -| **11.1.4** | Vérifier la tenue d'un inventaire cryptographique. Celui-ci doit inclure un plan documenté décrivant la migration vers de nouvelles normes cryptographiques, telles que la cryptographie post-quantique, afin de réagir aux menaces futures. | 3 | - -## V11.2 Mise en œuvre sécurisée de la cryptographie - -Cette section définit les exigences relatives à la sélection, à la mise en œuvre et à la gestion continue des algorithmes cryptographiques de base d'une application. L'objectif est de garantir que seules des primitives cryptographiques robustes et reconnues par l'industrie soient déployées, conformément aux normes en vigueur (par exemple, NIST, ISO/IEC) et aux meilleures pratiques. Les organisations doivent s'assurer que chaque composant cryptographique est sélectionné sur la base de preuves validées par des pairs et de tests de sécurité pratiques. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **11.2.1** | Vérifiez que les implémentations validées par l’industrie (y compris les bibliothèques et les implémentations accélérées par le matériel) sont utilisées pour les opérations cryptographiques. | 2 | -| **11.2.2** | Vérifiez que l'application est conçue avec une agilité cryptographique, de sorte que les nombres aléatoires, le chiffrement authentifié, le MAC ou les algorithmes de hachage, les longueurs de clés, les tours, les chiffrements et les modes puissent être reconfigurés, mis à niveau ou échangés à tout moment, afin de se protéger contre les failles cryptographiques. De même, il doit être possible de remplacer les clés et les mots de passe, ainsi que de rechiffrer les données. Cela permettra des mises à niveau transparentes vers la cryptographie post-quantique (PQC), une fois que des implémentations hautement sécurisées de schémas ou de normes PQC approuvés seront largement disponibles. | 2 | -| **11.2.3** | Vérifiez que toutes les primitives cryptographiques utilisent un minimum de 128 bits de sécurité en fonction de l'algorithme, de la taille de la clé et de la configuration. Par exemple, une clé ECC de 256 bits offre environ 128 bits de sécurité, tandis que RSA nécessite une clé de 3072 bits pour atteindre 128 bits de sécurité. | 2 | -| **11.2.4** | Vérifiez que toutes les opérations cryptographiques sont à temps constant, sans opérations de « court-circuit » dans les comparaisons, les calculs ou les retours, pour éviter toute fuite d'informations. | 3 | -| **11.2.5** | Vérifiez que tous les modules cryptographiques échouent en toute sécurité et que les erreurs sont gérées de manière à ne pas permettre de vulnérabilités, telles que les attaques Padding Oracle. | 3 | - -## V11.3 Algorithmes de chiffrement - -Les algorithmes de chiffrement authentifiés basés sur AES et CHACHA20 constituent l’épine dorsale de la pratique cryptographique moderne. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **11.3.1** | Vérifiez que les modes de bloc non sécurisés (par exemple, ECB) et les schémas de remplissage faibles (par exemple, PKCS#1 v1.5) ne sont pas utilisés. | 1 | -| **11.3.2** | Vérifiez que seuls les chiffrements et modes approuvés tels que AES avec GCM sont utilisés. | 1 | -| **11.3.3** | Vérifiez que les données chiffrées sont protégées contre toute modification non autorisée, de préférence en utilisant une méthode de chiffrement authentifiée approuvée ou en combinant une méthode de chiffrement approuvée avec un algorithme MAC approuvé. | 2 | -| **11.3.4** | Vérifiez que les nonces, les vecteurs d'initialisation et autres nombres à usage unique ne sont pas utilisés pour plus d'une paire clé de chiffrement/élément de données. La méthode de génération doit être adaptée à l'algorithme utilisé. | 3 | -| **11.3.5** | Vérifiez que toute combinaison d'un algorithme de chiffrement et d'un algorithme MAC fonctionne en mode chiffrement puis MAC. | 3 | - -## V11.4 Hachage et fonctions basées sur le hachage - -Les hachages cryptographiques sont utilisés dans une grande variété de protocoles cryptographiques, tels que les signatures numériques, HMAC, les fonctions de dérivation de clés (KDF), la génération de bits aléatoires et le stockage de mots de passe. La sécurité d'un système cryptographique dépend des fonctions de hachage sous-jacentes utilisées. Cette section décrit les exigences relatives à l'utilisation de fonctions de hachage sécurisées dans les opérations cryptographiques. - -Pour le stockage des mots de passe, ainsi que pour l'annexe sur la cryptographie, la [OWASP Password Storage Cheatsheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#password-hashing-algorithms) fournira également un contexte et des conseils utiles. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **11.4.1** | Vérifiez que seules les fonctions de hachage approuvées sont utilisées pour les cas d'utilisation cryptographiques généraux, notamment les signatures numériques, HMAC, KDF et la génération de bits aléatoires. Les fonctions de hachage non autorisées, telles que MD5, ne doivent pas être utilisées à des fins cryptographiques. | 1 | -| **11.4.2** | Vérifiez que les mots de passe sont stockés à l'aide d'une fonction de dérivation de clés approuvée et gourmande en ressources de calcul (également appelée « fonction de hachage de mots de passe »), dont les paramètres sont configurés conformément aux directives en vigueur. Ces paramètres doivent équilibrer sécurité et performances afin de rendre les attaques par force brute suffisamment difficiles pour le niveau de sécurité requis. | 2 | -| **11.4.3** | Vérifiez que les fonctions de hachage utilisées dans les signatures numériques, dans le cadre de l'authentification ou de l'intégrité des données, sont résistantes aux collisions et possèdent des longueurs de bits appropriées. Si la résistance aux collisions est requise, la longueur de sortie doit être d'au moins 256 bits. Si seule la résistance aux attaques de seconde pré-image est requise, la longueur de sortie doit être d'au moins 128 bits. | 2 | -| **11.4.4** | Vérifiez que l'application utilise des fonctions de dérivation de clés approuvées avec des paramètres d'extension de clés lors de la dérivation de clés secrètes à partir de mots de passe. Les paramètres utilisés doivent concilier sécurité et performances afin d'empêcher les attaques par force brute de compromettre la clé cryptographique obtenue. | 2 | - -## V11.5 Valeurs aléatoires - -La génération de nombres pseudo-aléatoires cryptographiquement sécurisée (CSPRNG) est extrêmement difficile à mettre en œuvre. En général, les bonnes sources d'entropie d'un système s'épuisent rapidement si elles sont surexploitées, tandis que des sources moins aléatoires peuvent conduire à des clés et des secrets prévisibles. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **11.5.1** | Vérifiez que tous les nombres et chaînes aléatoires destinés à être non devinables doivent être générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et posséder au moins 128 bits d'entropie. Notez que les UUID ne respectent pas cette condition. | 2 | -| **11.5.2** | Vérifiez que le mécanisme de génération de nombres aléatoires utilisé est conçu pour fonctionner en toute sécurité, même en cas de forte demande. | 3 | - -## V11.6 Cryptographie à clé publique - -La cryptographie à clé publique sera utilisée lorsqu'il est impossible ou non souhaitable de partager une clé secrète entre plusieurs parties. - -Dans ce contexte, des mécanismes d'échange de clés approuvés, tels que Diffie-Hellman et Elliptic Curve Diffie-Hellman (ECDH), sont nécessaires pour garantir la sécurité du cryptosystème face aux menaces modernes. Le chapitre « Communication sécurisée » décrit les exigences pour TLS. Les exigences de cette section sont donc destinées aux situations où la cryptographie à clé publique est utilisée dans des cas d'utilisation autres que TLS. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **11.6.1** | Vérifier que seuls des algorithmes cryptographiques et des modes opératoires approuvés sont utilisés pour la génération et l'amorçage des clés, ainsi que pour la génération et la vérification des signatures numériques. Les algorithmes de génération de clés ne doivent pas générer de clés non sécurisées et vulnérables aux attaques connues, par exemple les clés RSA vulnérables à la factorisation de Fermat. | 2 | -| **11.6.2** | Vérifiez que des algorithmes cryptographiques approuvés sont utilisés pour l'échange de clés (tels que Diffie-Hellman), en veillant à ce que les mécanismes d'échange de clés utilisent des paramètres sécurisés. Cela permettra d'éviter les attaques contre le processus d'établissement des clés, susceptibles de conduire à des attaques de type « adversaire du milieu » ou à des failles cryptographiques. | 3 | - -## V11.7 Cryptographie des données en cours d'utilisation - -La protection des données pendant leur traitement est "le nec plus ultra". Des techniques telles que le chiffrement intégral de la mémoire, le chiffrement des données en transit et s'assurer que le les données sont chiffrés le plus tôt possible après utilisation. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **11.7.1** | Vérifiez que le chiffrement complet de la mémoire est utilisé pour protéger les données sensibles pendant leur utilisation, empêchant ainsi l'accès par des utilisateurs ou des processus non autorisés. | 3 | -| **11.7.2** | Vérifiez que la minimisation des données garantit que la quantité minimale de données est exposée pendant le traitement et assurez-vous que les données sont chiffrées immédiatement après utilisation ou dès que possible. | 3 | - -## Références - -Pour plus d'informations, voir également : - -* [OWASP Web Security Testing Guide: Testing for Weak Cryptography](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography) -* [OWASP Cryptographic Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html) -* [FIPS 140-3](https://csrc.nist.gov/pubs/fips/140-3/final) -* [NIST SP 800-57](https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final) diff --git a/5.0/fr/0x21-V12-Secure-Communication.md b/5.0/fr/0x21-V12-Secure-Communication.md deleted file mode 100644 index a2555e4ea7..0000000000 --- a/5.0/fr/0x21-V12-Secure-Communication.md +++ /dev/null @@ -1,57 +0,0 @@ -# V12 Communication sécurisée - -## Objectif de contrôle - -Ce chapitre comprend des exigences relatives aux mécanismes spécifiques qui doivent être mis en place pour protéger les données en transit, à la fois entre un client utilisateur final et un service backend, ainsi qu'entre les services internes et backend. - -Les concepts généraux promus par ce chapitre sont les suivants - -* S'assurer que les communications sont chiffrées à l'extérieur et, idéalement, à l'intérieur. -* Configurer les mécanismes de chiffrement en utilisant les dernières recommandations, y compris les algorithmes et les chiffrements préférés. -* S'assurer que les communications ne sont pas interceptées par des parties non autorisées à l'aide de certificats signés. - -Outre les principes généraux et les meilleures pratiques, l'ASVS fournit également des informations techniques plus approfondies sur la puissance cryptographique dans l'annexe C - Normes de cryptographie. - -## V12.1 Conseils généraux de sécurité TLS - -Cette section fournit des conseils initiaux sur la sécurisation des communications TLS. Des outils à jour doivent être utilisés pour vérifier régulièrement la configuration TLS. - -Bien que l'utilisation de certificats TLS génériques ne soit pas intrinsèquement dangereuse, la compromission d'un certificat déployé dans tous les environnements (par exemple, production, préproduction, développement et test) peut compromettre la sécurité des applications qui l'utilisent. Une protection et une gestion appropriées, ainsi que l'utilisation de certificats TLS distincts dans différents environnements, sont recommandées si possible. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **12.1.1** | Vérifiez que seules les dernières versions recommandées du protocole TLS sont activées, telles que TLS 1.2 et TLS 1.3. La dernière version du protocole TLS doit être privilégiée. | 1 | -| **12.1.2** | Vérifiez que seules les suites de chiffrement recommandées sont activées, les suites de chiffrement les plus puissantes étant définies comme préférées. Les applications L3 doivent uniquement prendre en charge les suites de chiffrement assurant la confidentialité persistante (forward secrecy). | 2 | -| **12.1.3** | Vérifiez que l’application valide que les certificats clients mTLS sont approuvés avant d’utiliser l’identité du certificat pour l’authentification ou l’autorisation. | 2 | -| **12.1.4** | Vérifiez que la révocation de certification appropriée, telle que l'agrafage du protocole OCSP (Online Certificate Status Protocol), est activée et configurée. | 3 | -| **12.1.5** | Vérifiez que Encrypted Client Hello (ECH) est activé dans les paramètres TLS de l'application pour empêcher l'exposition de métadonnées sensibles, telles que l'indication du nom du serveur (SNI), pendant les processus de négociation TLS. | 3 | - -## V12.2 Communication HTTPS avec des services externes - -Assurez-vous que tout le trafic HTTP vers les services externes exposés par l'application est envoyé chiffré, avec des certificats de confiance publique. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **12.2.1** | Vérifiez que TLS est utilisé pour toute connectivité entre un client et des services externes basés sur HTTP, et ne recourt pas à des communications non sécurisées ou non chiffrées. | 1 | -| **12.2.2** | Vérifiez que les services externes utilisent des certificats TLS publiquement approuvés. | 1 | - -## V12.3 Sécurité des communications entre services généraux - -Les communications serveur (internes et externes) ne se limitent pas au protocole HTTP. Les connexions vers et depuis d'autres systèmes doivent également être sécurisées, idéalement via TLS. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **12.3.1** | Vérifiez qu'un protocole chiffré tel que TLS est utilisé pour toutes les connexions entrantes et sortantes vers et depuis l'application, y compris les systèmes de surveillance, les outils de gestion, l'accès à distance et SSH, les intergiciels, les bases de données, les mainframes, les systèmes partenaires ou les API externes. Le serveur ne doit pas recourir à des protocoles non sécurisés ou non chiffrés. | 2 | -| **12.3.2** | Vérifiez que les clients TLS valident les certificats reçus avant de communiquer avec un serveur TLS. | 2 | -| **12.3.3** | Vérifiez que TLS ou un autre mécanisme de chiffrement de transport approprié est utilisé pour toute connectivité entre les services internes basés sur HTTP au sein de l'application et ne se replie pas vers des communications non sécurisées ou non chiffrées. | 2 | -| **12.3.4** | Vérifiez que les connexions TLS entre les services internes utilisent des certificats de confiance. Lorsque des certificats générés en interne ou auto-signés sont utilisés, le service consommateur doit être configuré pour n'approuver que des autorités de certification internes spécifiques et des certificats auto-signés spécifiques. | 2 | -| **12.3.5** | Vérifiez que les services communiquant en interne au sein d'un système (communications intra-services) utilisent une authentification forte pour garantir la vérification de chaque endpoint. Des méthodes d'authentification forte, telles que l'authentification client TLS, doivent être utilisées pour garantir l'identité, en utilisant une infrastructure à clé publique et des mécanismes résistants aux attaques par rejeu. Pour les architectures de microservices, envisagez d'utiliser un maillage de services pour simplifier la gestion des certificats et renforcer la sécurité. | 3 | - -## Références - -Pour plus d'informations, voir également : - -* [OWASP - Transport Layer Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html) -* [Mozilla's Server Side TLS configuration guide](https://wiki.mozilla.org/Security/Server_Side_TLS) -* [Mozilla's tool to generate known good TLS configurations](https://ssl-config.mozilla.org/). -* [O-Saft - OWASP Project to validate TLS configuration](https://owasp.org/www-project-o-saft/) diff --git a/5.0/fr/0x22-V13-Configuration.md b/5.0/fr/0x22-V13-Configuration.md deleted file mode 100644 index 7ff625280d..0000000000 --- a/5.0/fr/0x22-V13-Configuration.md +++ /dev/null @@ -1,68 +0,0 @@ -# V13 Configuration - -## Objectif de contrôle - -La configuration par défaut de l'application doit être sécurisée pour une utilisation sur Internet. - -Ce chapitre fournit des conseils sur les différentes configurations nécessaires pour y parvenir, y compris celles appliquées pendant le développement, la construction et le déploiement. - -Les sujets abordés incluent la prévention des fuites de données, la gestion sécurisée des communications entre les composants et la protection des secrets. - -## V13.1 Documentation de configuration - -Cette section décrit les exigences de documentation relatives à la communication de l'application avec les services internes et externes, ainsi que les techniques permettant d'éviter toute perte de disponibilité due à l'inaccessibilité des services. Elle aborde également la documentation relative aux secrets. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **13.1.1** | Vérifiez que tous les besoins de communication de l'application sont documentés. Cela doit inclure les services externes dont l'application dépend et les cas où un utilisateur final pourrait fournir un emplacement externe auquel l'application se connectera. | 2 | -| **13.1.2** | Vérifiez que pour chaque service utilisé par l'application, la documentation définit le nombre maximal de connexions simultanées (par exemple, les limites du pool de connexions) et le comportement de l'application lorsque cette limite est atteinte, y compris les mécanismes de secours ou de récupération, pour éviter les conditions de déni de service. | 3 | -| **13.1.3** | Vérifiez que la documentation de l'application définit des stratégies de gestion des ressources pour chaque système ou service externe utilisé (par exemple, bases de données, descripteurs de fichiers, threads, connexions HTTP). Cela doit inclure les procédures de libération des ressources, les paramètres de délai d'expiration, la gestion des échecs et l'implémentation de la logique de nouvelle tentative, en spécifiant les limites de nouvelle tentative, les délais et les algorithmes de retour arrière. Pour les opérations de requête-réponse HTTP synchrones, la documentation doit imposer des délais d'expiration courts et soit désactiver les nouvelles tentatives, soit les limiter strictement afin d'éviter les retards en cascade et l'épuisement des ressources. | 3 | -| **13.1.4** | Vérifiez que la documentation de l'application définit les secrets essentiels à la sécurité de l'application et un calendrier de rotation de ceux-ci, en fonction du modèle de menace et des exigences commerciales de l'organisation. | 3 | - -## V13.2 Configuration de la communication backend - -Les applications interagissent avec plusieurs services, notamment des API, des bases de données ou d'autres composants. Ceux-ci peuvent être considérés comme internes à l'application, mais non inclus dans les mécanismes de contrôle d'accès standard de l'application, ou être entièrement externes. Dans les deux cas, il est nécessaire de configurer l'application pour interagir en toute sécurité avec ces composants et, si nécessaire, de protéger cette configuration. - -Remarque : le chapitre « Communication sécurisée » fournit des conseils pour le chiffrement en transit. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **13.2.1** | Vérifiez que les communications entre les composants de l'application backend qui ne prennent pas en charge le mécanisme de session utilisateur standard de l'application, notamment les API, les intergiciels et les couches de données, sont authentifiées. L'authentification doit utiliser des comptes de service individuels, des jetons à court terme ou une authentification par certificat, et non des identifiants immuables tels que des mots de passe, des clés API ou des comptes partagés avec accès privilégié. | 2 | -| **13.2.2** | Vérifiez que les communications entre les composants de l'application backend, y compris les services locaux ou du système d'exploitation, les API, les intergiciels et les couches de données, sont effectuées avec des comptes dotés des privilèges les moins nécessaires. | 2 | -| **13.2.3** | Vérifiez que si des informations d’identification doivent être utilisées pour l’authentification du service, les informations d’identification utilisées par le consommateur ne sont pas des informations d’identification par défaut (par exemple, root/root ou admin/admin). | 2 | -| **13.2.4** | Vérifiez qu'une liste d’autorisations est utilisée pour définir les ressources ou systèmes externes avec lesquels l'application est autorisée à communiquer (par exemple, pour les requêtes sortantes, les chargements de données ou l'accès aux fichiers). Cette liste d'autorisation peut être implémentée au niveau de la couche applicative, du serveur web, du pare-feu ou d'une combinaison de différentes couches. | 2 | -| **13.2.5** | Vérifiez que le serveur Web ou d’application est configuré avec une liste autorisée de ressources ou de systèmes vers lesquels le serveur peut envoyer des requêtes ou charger des données ou des fichiers. | 2 | -| **13.2.6** | Vérifiez que lorsque l'application se connecte à des services distincts, elle suit la configuration documentée pour chaque connexion, comme le nombre maximal de connexions parallèles, le comportement lorsque le nombre maximal de connexions autorisées est atteint, les délais d'expiration de connexion et les stratégies de nouvelle tentative. | 3 | - -## V13.3 Gestion des secrets - -La gestion des secrets est une tâche de configuration essentielle pour garantir la protection des données utilisées dans l'application. Les exigences spécifiques en matière de cryptographie sont décrites dans le chapitre « Cryptographie », mais cette section se concentre sur les aspects de gestion et de traitement des secrets. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **13.3.1** | Vérifiez qu'une solution de gestion des secrets, telle qu'un coffre-fort de clés, est utilisée pour créer, stocker, contrôler l'accès et détruire en toute sécurité les secrets backend. Ceux-ci peuvent inclure des mots de passe, du matériel de clé, des intégrations avec des bases de données et des systèmes tiers, des clés et des graines pour des jetons temporels, d'autres secrets internes et des clés API. Les secrets ne doivent pas être inclus dans le code source de l'application ni dans les artefacts de build. Pour une application L3, cela doit impliquer une solution matérielle telle qu'un HSM. | 2 | -| **13.3.2** | Vérifiez que l’accès aux ressources secrètes respecte le principe du moindre privilège. | 2 | -| **13.3.3** | Vérifiez que toutes les opérations cryptographiques sont effectuées à l'aide d'un module de sécurité isolé (tel qu'un coffre-fort ou un module de sécurité matériel) pour gérer et protéger en toute sécurité le matériel clé contre toute exposition en dehors du module de sécurité. | 3 | -| **13.3.4** | Vérifiez que les secrets sont configurés pour expirer et être renouvelés en fonction de la documentation de l'application. | 3 | - -## V13.4 Fuite d'informations involontaire - -Les configurations de production doivent être renforcées afin d'éviter la divulgation de données inutiles. Nombre de ces problèmes sont rarement considérés comme des risques importants, mais sont souvent associés à d'autres vulnérabilités. Si ces problèmes ne sont pas présents par défaut, la barre est plus haute pour les attaques contre une application. - -Par exemple, masquer la version des composants côté serveur n'élimine pas la nécessité de corriger tous les composants, et désactiver la liste des dossiers ne supprime pas la nécessité d'utiliser des contrôles d'autorisation ou de garder les fichiers loin du dossier public, mais cela place la barre plus haut. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **13.4.1** | Vérifiez que l'application est déployée soit sans aucune métadonnée de contrôle de source, y compris les dossiers .git ou .svn, soit de manière à ce que ces dossiers soient inaccessibles à la fois en externe et à l'application elle-même. | 1 | -| **13.4.2** | Vérifiez que les modes de débogage sont désactivés pour tous les composants dans les environnements de production afin d’éviter l’exposition des fonctionnalités de débogage et la fuite d’informations. | 2 | -| **13.4.3** | Vérifiez que les serveurs Web n’exposent pas les listes de répertoires aux clients, sauf si cela est explicitement prévu. | 2 | -| **13.4.4** | Vérifiez que l’utilisation de la méthode HTTP TRACE n’est pas prise en charge dans les environnements de production, afin d’éviter toute fuite d’informations potentielle. | 2 | -| **13.4.5** | Vérifiez que la documentation (comme pour les API internes) et les endpoints de surveillance ne sont pas exposés, sauf si cela est explicitement prévu. | 2 | -| **13.4.6** | Vérifiez que l’application n’expose pas d’informations de version détaillées des composants backend. | 3 | -| **13.4.7** | Vérifiez que la couche web est configuré pour servir uniquement les fichiers avec des extensions de fichier spécifiques afin d’éviter toute fuite involontaire d’informations, de configuration et de code source. | 3 | - -## Références - -Pour plus d'informations, voir également : - -* [OWASP Web Security Testing Guide: Configuration and Deployment Management Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing) diff --git a/5.0/fr/0x23-V14-Data-Protection.md b/5.0/fr/0x23-V14-Data-Protection.md deleted file mode 100644 index b037d03866..0000000000 --- a/5.0/fr/0x23-V14-Data-Protection.md +++ /dev/null @@ -1,60 +0,0 @@ -# V14 Protection des données - -## Objectif de contrôle - -Les applications ne peuvent pas prendre en compte tous les modèles d’utilisation et comportements des utilisateurs et doivent donc mettre en œuvre des contrôles pour limiter l’accès non autorisé aux données sensibles sur les appareils clients. - -Ce chapitre comprend les exigences relatives à la définition des données à protéger, de la manière dont elles doivent être protégées et des mécanismes spécifiques à mettre en œuvre ou des pièges à éviter. - -Un autre élément à prendre en compte pour la protection des données est l'extraction massive, la modification ou l'utilisation excessive. Les exigences de chaque système étant probablement très différentes, déterminer ce qui est « anormal » doit tenir compte du modèle de menace et du risque métier. Du point de vue d'ASVS, la détection de ces problèmes est traitée dans le chapitre « Journalisation de sécurité et gestion des erreurs », et la définition de limites dans le chapitre « Validation et logique métier ». - -## V14.1 Documentation sur la protection des données - -Une condition préalable essentielle à la protection des données est de catégoriser les données considérées comme sensibles. Il existe probablement plusieurs niveaux de sensibilité, et pour chaque niveau, les contrôles requis pour protéger les données seront différents. - -Il existe diverses réglementations et lois sur la confidentialité qui régissent la manière dont les applications doivent gérer le stockage, l'utilisation et la transmission des informations personnelles sensibles. Cette section ne vise plus à reproduire ces types de législation sur la protection des données ou la confidentialité, mais se concentre plutôt sur les considérations techniques clés pour la protection des données sensibles. Veuillez consulter les lois et réglementations locales et, si nécessaire, faire appel à un spécialiste de la confidentialité ou à un avocat qualifié. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **14.1.1** | Vérifiez que toutes les données sensibles créées et traitées par l'application ont été identifiées et classées selon leur niveau de protection. Cela inclut les données uniquement codées et donc facilement déchiffrables, telles que les chaînes Base64 ou la charge utile en texte clair d'un JWT. Les niveaux de protection doivent tenir compte des réglementations et normes de protection des données et de confidentialité auxquelles l'application est tenue de se conformer. | 2 | -| **14.1.2** | Vérifier que tous les niveaux de protection des données sensibles sont assortis d'un ensemble documenté d'exigences de protection. Cela doit inclure (sans s'y limiter) les exigences relatives au chiffrement général, à la vérification de l'intégrité, à la conservation, à la journalisation des données, aux contrôles d'accès aux données sensibles dans les journaux, au chiffrement au niveau de la base de données, aux technologies de confidentialité et de renforcement de la confidentialité à utiliser, ainsi qu'aux autres exigences de confidentialité. | 2 | - -## V14.2 Protection générale des données - -Cette section présente diverses exigences pratiques relatives à la protection des données. La plupart sont spécifiques à des problématiques particulières, telles que les fuites involontaires de données, mais il existe également une exigence générale de mise en œuvre de contrôles de protection en fonction du niveau de protection requis pour chaque donnée. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **14.2.1** | Vérifiez que les données sensibles sont uniquement envoyées au serveur dans les champs de corps ou d’en-tête du message HTTP, et que l’URL et la chaîne de requête ne contiennent pas d’informations sensibles, telles qu’une clé API ou un jeton de session. | 1 | -| **14.2.2** | Vérifiez que l’application empêche la mise en cache des données sensibles dans les composants du serveur, tels que les équilibreurs de charge et les caches d’application, ou garantit que les données sont purgées en toute sécurité après utilisation. | 2 | -| **14.2.3** | Vérifiez que les données sensibles définies ne sont pas envoyées à des parties non fiables (par exemple, des trackers d'utilisateurs) pour empêcher la collecte indésirable de données en dehors du contrôle de l'application. | 2 | -| **14.2.4** | Vérifiez que les contrôles autour des données sensibles liés au chiffrement, à la vérification de l'intégrité, à la conservation, à la manière dont les données doivent être enregistrées, aux contrôles d'accès autour des données sensibles dans les journaux, à la confidentialité et aux technologies d'amélioration de la confidentialité, sont mis en œuvre comme défini dans la documentation pour le niveau de protection des données spécifiques. | 2 | -| **14.2.5** | Vérifiez que les mécanismes de mise en cache sont configurés pour ne mettre en cache que les réponses dont le type de contenu est conforme à la ressource et qui ne contiennent pas de contenu sensible et dynamique. Le serveur web doit renvoyer une réponse 404 ou 302 lors de l'accès à un fichier inexistant plutôt qu'un fichier valide différent. Cela devrait empêcher les attaques par empoisonnement de cache web. | 3 | -| **14.2.6** | Vérifiez que l'application ne renvoie que les données sensibles minimales requises pour son fonctionnement. Par exemple, ne renvoyez que certains chiffres d'un numéro de carte de crédit, et non le numéro complet. Si les données complètes sont requises, elles doivent être masquées dans l'interface utilisateur, sauf si l'utilisateur les consulte spécifiquement. | 3 | -| **14.2.7** | Vérifiez que les informations sensibles sont soumises à une classification de conservation des données, en veillant à ce que les données obsolètes ou inutiles soient supprimées automatiquement, selon un calendrier défini ou selon les besoins de la situation. | 3 | -| **14.2.8** | Vérifiez que les informations sensibles sont supprimées des métadonnées des fichiers soumis par l'utilisateur, sauf si le stockage est autorisé par l'utilisateur. | 3 | - -## V14.3 Protection des données côté client - -Cette section contient des exigences empêchant la fuite de données de manière spécifique du côté client ou de l'agent utilisateur d'une application. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **14.3.1** | Vérifiez que les données authentifiées sont effacées du stockage client, comme le DOM du navigateur, après la fin du client ou de la session. Le champ d'en-tête de réponse HTTP « Clear-Site-Data » peut être utile, mais le côté client devrait également pouvoir effectuer la correction si la connexion au serveur n'est pas disponible à la fin de la session. | 1 | -| **14.3.2** | Vérifiez que l'application définit suffisamment de champs d'en-tête de réponse HTTP anti-caching (c'est-à-dire Cache-Control : no-store) afin que les données sensibles ne soient pas mises en cache dans les navigateurs. | 2 | -| **14.3.3** | Vérifiez que les données stockées dans le stockage du navigateur (telles que localStorage, sessionStorage, IndexedDB ou les cookies) ne contiennent pas de données sensibles, à l'exception des jetons de session. | 2 | - -## Références - -Pour plus d'informations, voir également : - -* [Consider using the Security Headers website to check security and anti-caching header fields](https://securityheaders.com/) -* [Documentation about anti-caching headers by Mozilla](https://developer.mozilla.org/en-US/docs/Web/HTTP/Caching) -* [OWASP Secure Headers project](https://owasp.org/www-project-secure-headers/) -* [OWASP Privacy Risks Project](https://owasp.org/www-project-top-10-privacy-risks/) -* [OWASP User Privacy Protection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/User_Privacy_Protection_Cheat_Sheet.html) -* [Australian Privacy Principle 11 - Security of personal information](https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-11-app-11-security-of-personal-information) -* [European Union General Data Protection Regulation (GDPR) overview](https://www.edps.europa.eu/data-protection_en) -* [European Union Data Protection Supervisor - Internet Privacy Engineering Network](https://www.edps.europa.eu/data-protection/ipen-internet-privacy-engineering-network_en) -* [Information on the "Clear-Site-Data" header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Clear-Site-Data) -* [White paper on Web Cache Deception](https://www.blackhat.com/docs/us-17/wednesday/us-17-Gil-Web-Cache-Deception-Attack-wp.pdf) diff --git a/5.0/fr/0x24-V15-Secure-Coding-and-Architecture.md b/5.0/fr/0x24-V15-Secure-Coding-and-Architecture.md deleted file mode 100644 index 536544ca11..0000000000 --- a/5.0/fr/0x24-V15-Secure-Coding-and-Architecture.md +++ /dev/null @@ -1,77 +0,0 @@ -# V15 Développement et architecture sécurisés - -## Objectif de contrôle - -De nombreuses exigences de l'ASVS se rapportent soit à un domaine particulier de la sécurité, comme l'authentification ou l'autorisation, soit à un type particulier de fonctionnalité de l'application, comme la journalisation ou la gestion des fichiers. - -Ce chapitre présente les exigences générales de sécurité à prendre en compte lors de la conception et du développement d'applications. Ces exigences portent non seulement sur la propreté de l'architecture et la qualité du code, mais aussi sur les pratiques spécifiques d'architecture et de codage nécessaires à la sécurité des applications. - -## V15.1 Documentation sur le développement et l'architecture sécurisés - -De nombreuses exigences pour établir une architecture sécurisée et défendable dépendent d’une documentation claire des décisions prises concernant la mise en œuvre de contrôles de sécurité spécifiques et des composants utilisés dans l’application. - -Cette section décrit les exigences en matière de documentation, notamment l’identification des composants considérés comme contenant des « fonctionnalités dangereuses » ou comme des « composants à risque ». - -Un composant présentant une « fonctionnalité dangereuse » peut être un composant développé en interne ou par un tiers, effectuant des opérations telles que la désérialisation de données non fiables, l'analyse de fichiers bruts ou binaires, l'exécution de code dynamique ou la manipulation directe de la mémoire. Les vulnérabilités dans ces types d'opérations présentent un risque élevé de compromettre l'application et d'exposer potentiellement son infrastructure sous-jacente. - -Un « composant à risque » est une bibliothèque tierce (c'est-à-dire non développée en interne) dont les contrôles de sécurité concernant ses processus de développement ou ses fonctionnalités sont absents ou mal implémentés. Il peut s'agir, par exemple, de composants mal entretenus, non pris en charge, en fin de vie ou présentant des antécédents de vulnérabilités importantes. - -Cette section souligne également l’importance de définir des délais appropriés pour traiter les vulnérabilités des composants tiers. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **15.1.1** | Vérifiez que la documentation de l'application définit les délais de correction basés sur les risques pour les versions de composants tiers présentant des vulnérabilités et pour la mise à jour des bibliothèques en général, afin de minimiser les risques liés à ces composants. | 1 | -| **15.1.2** | Vérifiez qu'un catalogue d'inventaire, tel qu'une nomenclature logicielle (SBOM), est conservé pour toutes les bibliothèques tierces utilisées, y compris en vérifiant que les composants proviennent de référentiels prédéfinis, fiables et continuellement maintenus. | 2 | -| **15.1.3** | Vérifiez que la documentation de l'application identifie les fonctionnalités consommatrices en temps ou gourmandes en ressources. Elle doit notamment indiquer comment prévenir une perte de disponibilité due à une utilisation excessive de ces fonctionnalités et éviter que la génération d'une réponse ne prenne plus de temps que le délai d'expiration du consommateur. Les mesures de protection potentielles peuvent inclure le traitement asynchrone, l'utilisation de files d'attente et la limitation des processus parallèles par utilisateur et par application. | 2 | -| **15.1.4** | Vérifiez que la documentation de l’application met en évidence les bibliothèques tierces qui sont considérées comme des « composants à risque ». | 3 | -| **15.1.5** | Vérifiez que la documentation de l’application met en évidence les parties de l’application où des « fonctionnalités dangereuses » sont utilisées. | 3 | - -## V15.2 Architecture de sécurité et dépendances - -Cette section inclut les exigences relatives à la gestion des dépendances et des composants risqués, obsolètes ou non sécurisés. - -Elle inclut également l'utilisation de techniques au niveau architectural telles que le sandboxing, l'encapsulation, la conteneurisation et l'isolation du réseau pour réduire l'impact de l'utilisation d'« opérations dangereuses » ou de « composants risqués » (tels que définis dans la section précédente) et éviter la perte de disponibilité due à une utilisation excessive de fonctionnalités exigeantes en ressources. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **15.2.1** | Vérifiez que l’application contient uniquement des composants qui n’ont pas dépassé les délais de mise à jour et de correction documentés. | 1 | -| **15.2.2** | Vérifiez que l'application a mis en œuvre des défenses contre la perte de disponibilité due à des fonctionnalités qui prennent du temps ou qui nécessitent des ressources, sur la base des décisions et stratégies de sécurité documentées à cet effet. | 2 | -| **15.2.3** | Vérifiez que l'environnement de production inclut uniquement les fonctionnalités nécessaires au fonctionnement de l'application et n'expose pas de fonctionnalités superflues telles que du code de test, des exemples d'extraits et des fonctionnalités de développement. | 2 | -| **15.2.4** | Vérifiez que les composants tiers et toutes leurs dépendances transitives sont inclus à partir du référentiel attendu, qu'il soit détenu en interne ou qu'il s'agisse d'une source externe, et qu'il n'y a aucun risque d'attaque par confusion de dépendances. | 3 | -| **15.2.5** | Vérifiez que l'application implémente des protections supplémentaires autour des parties documentées comme contenant des « fonctionnalités dangereuses » ou utilisant des bibliothèques tierces considérées comme des « composants à risque ». Cela peut inclure des techniques telles que le sandboxing, l'encapsulation, la conteneurisation ou l'isolation au niveau du réseau pour retarder et dissuader les attaquants qui compromettent une partie de l'application de se propager ailleurs. | 3 | - -## V15.3 Développement défensif - -Cette section couvre les types de vulnérabilités, y compris le jonglage de types, la pollution de prototypes et autres, qui résultent de l'utilisation de modèles de codage non sécurisés dans un langage particulier. Certaines peuvent ne pas être pertinentes pour tous les langages, tandis que d'autres bénéficieront de correctifs spécifiques à chaque langage ou pourront être liées à la façon dont un langage ou un Framework particulier gère une fonctionnalité telle que les paramètres HTTP. Elle aborde également le risque lié à l'absence de validation cryptographique des mises à jour d'applications. - -Elle prend également en compte les risques liés à l'utilisation d'objets pour représenter des éléments de données, ainsi qu'à leur acceptation et leur renvoi via des API externes. Dans ce cas, l'application doit s'assurer que les champs de données non accessibles en écriture ne sont pas modifiés par l'utilisateur (affectation de masse) et que l'API sélectionne les champs de données renvoyés. Lorsque l'accès aux champs dépend des autorisations de l'utilisateur, il convient d'en tenir compte dans le contexte des exigences de contrôle d'accès au niveau des champs décrites dans le chapitre « Autorisation ». - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **15.3.1** | Vérifiez que l'application ne renvoie que le sous-ensemble requis de champs d'un objet de données. Par exemple, elle ne doit pas renvoyer un objet de données entier, car certains champs individuels ne doivent pas être accessibles aux utilisateurs. | 1 | -| **15.3.2** | Vérifiez que lorsque le backend de l'application effectue des appels vers des URL externes, il est configuré pour ne pas suivre les redirections, sauf s'il s'agit d'une fonctionnalité prévue. | 2 | -| **15.3.3** | Vérifiez que l'application dispose de contre-mesures pour se protéger contre les attaques d'affectation de masse en limitant les champs autorisés par contrôleur et action, par exemple, il n'est pas possible d'insérer ou de mettre à jour une valeur de champ lorsqu'elle n'était pas destinée à faire partie de cette action. | 2 | -| **15.3.4** | Vérifiez que tous les composants proxy et middleware transfèrent correctement l'adresse IP d'origine de l'utilisateur à l'aide de champs de données fiables qui ne peuvent pas être manipulés par l'utilisateur final, et que l'application et le serveur Web utilisent cette valeur correcte pour la journalisation et les décisions de sécurité telles que la limitation du débit, en tenant compte du fait que même l'adresse IP d'origine peut ne pas être fiable en raison d'adresses IP dynamiques, de VPN ou de pare-feu d'entreprise. | 2 | -| **15.3.5** | Vérifiez que l'application garantit explicitement que les variables sont du type correct et effectue des opérations d'égalité et de comparaison strictes. Cela permet d'éviter les vulnérabilités liées à la confusion de types, causées par des hypothèses du code de l'application sur le type d'une variable. | 2 | -| **15.3.6** | Vérifiez que le code JavaScript est écrit de manière à éviter la pollution du prototype, par exemple en utilisant Set() ou Map() au lieu de littéraux d'objet. | 2 | -| **15.3.7** | Vérifiez que l'application dispose de défenses contre les attaques de pollution des paramètres HTTP, en particulier si le Framework d'application ne fait aucune distinction quant à la source des paramètres de requête (chaîne de requête, paramètres de corps, cookies ou champs d'en-tête). | 2 | - -## V15.4 Concurrence sécurisée - -Les problèmes de concurrence tels que les situations de concurrence, les vulnérabilités TOCTOU (Time-of-Check-to-Time-of-Use), les interblocages, les livelock, la privation de threads et les synchronisations incorrectes peuvent entraîner des comportements imprévisibles et des risques de sécurité. Cette section présente diverses techniques et stratégies pour atténuer ces risques. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **15.4.1** | Vérifiez que les objets partagés dans le code multithread (tels que les caches, les fichiers ou les objets en mémoire accessibles par plusieurs threads) sont accessibles en toute sécurité à l'aide de types thread-safe et de mécanismes de synchronisation tels que des verrous ou des sémaphores pour éviter les conditions de concurrence et la corruption des données. | 3 | -| **15.4.2** | Vérifiez que les vérifications de l'état d'une ressource, comme son existence ou ses autorisations, et des actions qui en dépendent, sont effectuées en une seule opération atomique afin d'éviter les situations de concurrence entre le moment de la vérification et le moment de l'utilisation (TOCTOU). Par exemple, vérifier l'existence d'un fichier avant de l'ouvrir ou l'accès d'un utilisateur avant de l'accorder. | 3 | -| **15.4.3** | Vérifiez que les verrous sont utilisés de manière cohérente pour éviter que les threads ne se bloquent, que ce soit en s'attendant les uns les autres ou en réessayant sans fin, et que la logique de verrouillage reste dans le code responsable de la gestion de la ressource pour garantir que les verrous ne peuvent pas être modifiés par inadvertance ou de manière malveillante par des classes ou du code externes. | 3 | -| **15.4.4** | Vérifiez que les politiques d'allocation des ressources empêchent la saturation de threads en garantissant un accès équitable aux ressources, par exemple en exploitant les pools de threads, permettant aux threads de priorité inférieure de continuer dans un délai raisonnable. | 3 | - -## Références - -Pour plus d'informations, voir également : - -* [OWASP Prototype Pollution Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html) -* [OWASP Mass Assignment Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html) -* [OWASP CycloneDX Bill of Materials Specification](https://owasp.org/www-project-cyclonedx/) -* [OWASP Web Security Testing Guide: Testing for HTTP Parameter Pollution](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/07-Input_Validation_Testing/04-Testing_for_HTTP_Parameter_Pollution) diff --git a/5.0/fr/0x25-V16-Security-Logging-and-Error-Handling.md b/5.0/fr/0x25-V16-Security-Logging-and-Error-Handling.md deleted file mode 100644 index 38b7b7fe55..0000000000 --- a/5.0/fr/0x25-V16-Security-Logging-and-Error-Handling.md +++ /dev/null @@ -1,84 +0,0 @@ -# V16 Journalisation de sécurité et gestion des erreurs - -## Objectif de contrôle - -Les journaux de sécurité se distinguent des journaux d'erreurs ou de performances et servent à enregistrer les événements liés à la sécurité, tels que les décisions d'authentification, les décisions de contrôle d'accès et les tentatives de contournement des contrôles de sécurité, comme la validation des entrées ou la validation de la logique métier. Leur objectif est de faciliter la détection, la réponse et l'investigation en fournissant des données structurées et à haut niveau de signal aux outils d'analyse tels que les SIEM. - -Les journaux ne doivent pas contenir de données personnelles sensibles, sauf obligation légale, et toutes les données enregistrées doivent être protégées comme des ressources de grande valeur. La journalisation ne doit pas compromettre la confidentialité ni la sécurité du système. Les applications doivent également être sécurisées, évitant toute divulgation ou interruption inutile. - -Pour des conseils de mise en œuvre détaillés, consultez les aide-mémoire de l'OWASP indiquées dans la section Références. - -## V16.1 Documentation sur la journalisation de sécurité - -Cette section garantit un inventaire clair et complet de la journalisation de l'ensemble de la pile applicative. Ceci est essentiel pour une surveillance efficace de la sécurité, une réponse aux incidents et une conformité optimale. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **16.1.1** | Vérifiez qu'il existe un inventaire documentant la journalisation effectuée à chaque couche de la pile technologique de l'application, les événements enregistrés, les formats de journal, l'endroit où cette journalisation est stockée, la manière dont elle est utilisée, la manière dont l'accès à celle-ci est contrôlé et la durée de conservation des journaux. | 2 | - -## V16.2 Journalisation générale - -La présente section énonce des exigences visant à garantir que les journaux de sécurité sont structurés de manière cohérente et contiennent les métadonnées attendues. L'objectif est de rendre les journaux lisibles par une machine et analysables par des systèmes et des outils distribués. - -Les événements de sécurité impliquent souvent des données sensibles. Si ces données sont enregistrées sans surveillance, les journaux eux-mêmes deviennent classifiés et donc soumis à des exigences de chiffrement, à des politiques de conservation plus strictes et à une divulgation potentielle lors des audits. - -Il est donc essentiel de ne loguer que ce qui est nécessaire et de traiter les données des journaux avec le même soin que les autres ressources sensibles. - -Les exigences ci-dessous établissent les exigences fondamentales pour la journalisation des métadonnées, la synchronisation, le format et le contrôle. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **16.2.1** | Vérifiez que chaque entrée de journal inclut les métadonnées nécessaires (telles que quand, où, qui, quoi) qui permettraient une enquête détaillée sur la chronologie lorsqu'un événement se produit. | 2 | -| **16.2.2** | Vérifiez que les sources de temps de tous les composants de journalisation sont synchronisées et que les horodatages des métadonnées des événements de sécurité utilisent le temps UTC ou incluent un décalage horaire explicite. L'UTC est recommandé pour garantir la cohérence entre les systèmes distribués et éviter toute confusion lors du passage à l'heure d'été. | 2 | -| **16.2.3** | Vérifiez que l’application stocke ou diffuse uniquement les journaux vers les fichiers et services documentés dans l’inventaire des journaux. | 2 | -| **16.2.4** | Vérifiez que les journaux peuvent être lus et corrélés par le processeur de journaux utilisé, de préférence en utilisant un format de journalisation commun. | 2 | -| **16.2.5** | Vérifiez que l'application applique la journalisation en fonction du niveau de protection des données lors de la journalisation de données sensibles. Par exemple, certaines données, comme les identifiants ou les informations de paiement, peuvent être interdites. D'autres données, comme les jetons de session, ne peuvent être enregistrées que par hachage ou masquage, en totalité ou en partie. | 2 | - -## V16.3 Événements de sécurité - -Cette section définit les exigences relatives à la journalisation des événements de sécurité au sein de l'application. La capture de ces événements est essentielle pour détecter les comportements suspects, faciliter les enquêtes et respecter les obligations de conformité. - -Cette section décrit les types d'événements à journaliser, sans toutefois prétendre à l'exhaustivité. Chaque application présente des facteurs de risque et un contexte opérationnel spécifiques. - -Notez que si ASVS inclut la journalisation des événements de sécurité, les alertes et la corrélation (par exemple, les règles SIEM ou l'infrastructure de surveillance) sont considérées comme hors du périmètre et sont gérées par les systèmes opérationnels et de surveillance. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **16.3.1** | Vérifiez que toutes les opérations d'authentification sont enregistrées, y compris les tentatives réussies et infructueuses. Des métadonnées supplémentaires, telles que le type d'authentification ou les facteurs utilisés, doivent également être collectées. | 2 | -| **16.3.2** | Vérifier que les tentatives d'autorisation infructueuses sont logguées. Pour le niveau 3, cela doit inclure la journalisation de toutes les décisions d'autorisation, y compris lors de l'accès à des données sensibles (sans journalisation des données sensibles elles-mêmes). | 2 | -| **16.3.3** | Vérifiez que l'application enregistre les événements de sécurité définis dans la documentation et enregistre également les tentatives de contournement des contrôles de sécurité, tels que la validation des entrées, la logique métier et l'anti-automatisation. | 2 | -| **16.3.4** | Vérifiez que l’application enregistre les erreurs inattendues et les échecs de contrôle de sécurité tels que les échecs TLS du backend. | 2 | - -## V16.4 Protection des journaux - -Les journaux sont des artefacts d'investigation précieux et doivent être protégés. S'ils peuvent être facilement modifiés ou supprimés, ils perdent leur intégrité et deviennent peu fiables pour les enquêtes sur les incidents ou les procédures légales. Ils peuvent exposer le comportement interne des applications ou des métadonnées sensibles, ce qui en fait une cible de choix pour les attaquants. - -Cette section définit les exigences visant à garantir la protection des journaux contre les accès non autorisés, les falsifications et les divulgations, ainsi que leur transmission et leur stockage sécurisés dans des systèmes sécurisés et isolés. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **16.4.1** | Vérifiez que tous les composants de journalisation codent correctement les données pour empêcher l’injection de journaux. | 2 | -| **16.4.2** | Vérifiez que les journaux sont protégés contre tout accès non autorisé et ne peuvent pas être modifiés. | 2 | -| **16.4.3** | Vérifiez que les journaux sont transmis de manière sécurisée à un système logique distinct pour analyse, détection, alerte et remontée des informations. L'objectif est de garantir qu'en cas de violation de l'application, les journaux ne seront pas compromis. | 2 | - -## V16.5 Gestion des erreurs - -Cette section définit les exigences visant à garantir que les applications échouent proprement et sécurisée sans divulguer de détails internes sensibles. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **16.5.1** | Vérifiez qu'un message générique est renvoyé au consommateur lorsqu'une erreur inattendue ou sensible à la sécurité se produit, garantissant ainsi l'absence d'exposition de données système internes sensibles telles que les traces de pile, les requêtes, les clés secrètes et les jetons. | 2 | -| **16.5.2** | Vérifiez que l'application continue de fonctionner en toute sécurité lorsque l'accès aux ressources externes échoue, par exemple, en utilisant des modèles tels que des disjoncteurs ou une dégradation progressive. | 2 | -| **16.5.3** | Vérifiez que l'application échoue proprement et sécurisée, y compris lorsqu'une exception se produit, en évitant les accès en cas d'erreur telles que le traitement d'une transaction malgré les erreurs résultant de la logique de validation. | 2 | -| **16.5.4** | Vérifiez qu'un gestionnaire d'erreurs de « dernier recours » est défini pour intercepter toutes les exceptions non gérées. Cela permet d'éviter la perte des informations d'erreur qui doivent être loguées dans les fichiers journaux et de garantir qu'une erreur ne paralyse pas l'ensemble du processus applicatif, entraînant une perte de disponibilité. | 3 | - -Remarque : Certains langages (dont Swift, Go et, par des pratiques de conception courantes, de nombreux langages fonctionnels) ne prennent pas en charge les exceptions ni les gestionnaires d'événements de dernier recours. Dans ce cas, les architectes et les développeurs doivent utiliser une méthode compatible avec les modèles, les langages ou les frameworks pour garantir que les applications peuvent gérer en toute sécurité les événements exceptionnels, inattendus ou liés à la sécurité. - -## Références - -Pour plus d'informations, voir également : - -* [OWASP Web Security Testing Guide: Testing for Error Handling](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/README) -* [OWASP Authentication Cheat Sheet section about error messages](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#authentication-and-error-messages) -* [OWASP Logging Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html) -* [OWASP Application Logging Vocabulary Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Vocabulary_Cheat_Sheet.html) diff --git a/5.0/fr/0x26-V17-WebRTC.md b/5.0/fr/0x26-V17-WebRTC.md deleted file mode 100644 index aeeda82a98..0000000000 --- a/5.0/fr/0x26-V17-WebRTC.md +++ /dev/null @@ -1,75 +0,0 @@ -# V17 WebRTC - -## Objectif de contrôle - -La communication Web en temps réel (WebRTC) permet l'échange de voix, de vidéo et de données en temps réel dans les applications modernes. Avec l'adoption croissante de cette technologie, la sécurisation de l'infrastructure WebRTC devient cruciale. Cette section présente les exigences de sécurité pour les acteurs qui développent, hébergent ou intègrent des systèmes WebRTC. - -Le marché du WebRTC peut être classé en trois segments : - -1. Développeurs de produits : Fournisseurs propriétaires et open source qui créent et fournissent des produits et solutions WebRTC. Leur objectif est de développer des technologies WebRTC robustes et sécurisées, utilisables par d'autres. - -2. Plateformes de communication en tant que service (CPaaS) : fournisseurs proposant des API, des SDK et l'infrastructure ou les plateformes nécessaires pour exploiter les fonctionnalités WebRTC. Les fournisseurs CPaaS peuvent utiliser des produits de la première catégorie ou développer leur propre logiciel WebRTC pour offrir ces services. - -3. Fournisseurs de services : organisations qui exploitent les produits de développeurs ou de fournisseurs CPaaS, ou qui développent leurs propres solutions WebRTC. Elles créent et implémentent des applications pour les conférences en ligne, la santé, l'apprentissage en ligne et d'autres domaines où la communication en temps réel est essentielle. - -Les exigences de sécurité décrites ici s'adressent principalement aux développeurs de produits, aux CPaaS et aux fournisseurs de services qui : - -* utilisent des solutions open source pour développer leurs applications WebRTC ; -* utilisent des produits WebRTC commerciaux au sein de leur infrastructure ; -* utilisent des solutions WebRTC développées en interne ou intègrent divers composants dans une offre de services cohérente. - -Il est important de noter que ces exigences de sécurité ne s'appliquent pas aux développeurs qui utilisent exclusivement les SDK et les API fournis par les fournisseurs CPaaS. Pour ces développeurs, les fournisseurs CPaaS sont généralement responsables de la plupart des problèmes de sécurité sous-jacents à leurs plateformes, et une norme de sécurité générique comme ASVS peut ne pas répondre pleinement à leurs besoins. - -## V17.1 Serveur TURN - -Cette section définit les exigences de sécurité pour les systèmes utilisant leurs propres serveurs TURN (Traversal Using Relays around NAT). Les serveurs TURN contribuent au relais des médias dans les environnements réseau restrictifs, mais peuvent présenter des risques en cas de mauvaise configuration. Ces contrôles se concentrent sur le filtrage sécurisé des adresses et la protection contre l'épuisement des ressources. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **17.1.1** | Vérifiez que le service TURN (Traversal Using Relays around NAT) autorise uniquement l'accès aux adresses IP non réservées à des fins spécifiques (par exemple, réseaux internes, diffusion, bouclage). Notez que cela s'applique aux adresses IPv4 et IPv6. | 2 | -| **17.1.2** | Vérifiez que le service Traversal Using Relays around NAT (TURN) n'est pas susceptible d'épuiser ses ressources lorsque des utilisateurs légitimes tentent d'ouvrir un grand nombre de ports sur le serveur TURN. | 3 | - -## V17.2 Média - -Ces exigences s'appliquent uniquement aux systèmes hébergeant leurs propres serveurs multimédias WebRTC, tels que les unités de transfert sélectif (SFU), les unités de contrôle multipoint (MCU), les serveurs d'enregistrement ou les serveurs de passerelle. Les serveurs multimédias gèrent et distribuent les flux multimédias, ce qui rend leur sécurité essentielle pour protéger les communications entre homologues. La protection des flux multimédias est primordiale dans les applications WebRTC pour prévenir les écoutes clandestines, les falsifications et les attaques par déni de service susceptibles de compromettre la confidentialité des utilisateurs et la qualité des communications. - -En particulier, il est nécessaire de mettre en œuvre des protections contre les attaques par saturation, telles que la limitation du débit, la validation des horodatages, l'utilisation d'horloges synchronisées pour correspondre aux intervalles en temps réel et la gestion des tampons afin d'éviter les débordements et de maintenir une synchronisation correcte. Si les paquets d'une session multimédia spécifique arrivent trop rapidement, les paquets excédentaires doivent être rejetés. Il est également important de protéger le système contre les paquets malformés en implémentant la validation des entrées, en gérant en toute sécurité les dépassements d'entiers, en prévenant les dépassements de tampon et en utilisant d'autres techniques robustes de gestion des erreurs. - -Les systèmes qui s'appuient uniquement sur la communication multimédia peer-to-peer entre navigateurs Web, sans l'intervention de serveurs multimédias intermédiaires, sont exclus de ces exigences de sécurité spécifiques liées aux médias. - -Cette section traite de l'utilisation de la sécurité de la couche de transport des datagrammes (DTLS) dans le contexte de WebRTC. L'exigence relative à la mise en place d'une politique documentée de gestion des clés cryptographiques est décrite dans le chapitre « Cryptographie ». Des informations sur les méthodes cryptographiques approuvées sont disponibles dans l'annexe Cryptographie de l'ASVS ou dans des documents tels que NIST SP 800-52 Rev. 2 ou BSI TR-02102-2 (version 2025-01). - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **17.2.1** | Vérifiez que la clé du certificat Datagram Transport Layer Security (DTLS) est gérée et protégée conformément à la politique documentée de gestion des clés cryptographiques. | 2 | -| **17.2.2** | Vérifiez que le serveur multimédia est configuré pour utiliser et prendre en charge les suites de chiffrement DTLS (Datagram Transport Layer Security) approuvées et un profil de protection sécurisé pour l'extension DTLS pour l'établissement de clés pour le protocole de transport en temps réel sécurisé (DTLS-SRTP). | 2 | -| **17.2.3** | Vérifiez que l'authentification SRTP (Secure Real-time Transport Protocol) est vérifiée sur le serveur multimédia pour empêcher les attaques par injection RTP (Real-time Transport Protocol) d'entraîner une condition de déni de service ou l'insertion de médias audio ou vidéo dans les flux multimédias. | 2 | -| **17.2.4** | Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant lorsqu'il rencontre des paquets SRTP (Secure Real-time Transport Protocol) mal formés. | 2 | -| **17.2.5** | Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes. | 3 | -| **17.2.6** | Vérifiez que le serveur multimédia n'est pas sensible à la vulnérabilité de condition de concurrence « ClientHello » dans Datagram Transport Layer Security (DTLS) en vérifiant si le serveur multimédia est publiquement connu comme étant vulnérable ou en effectuant le test de condition de concurrence. | 3 | -| **17.2.7** | Vérifiez que tous les mécanismes d'enregistrement audio ou vidéo associés au serveur multimédia sont en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes. | 3 | -| **17.2.8** | Vérifiez que le certificat Datagram Transport Layer Security (DTLS) est vérifié par rapport à l'attribut d'empreinte cryptographique du protocole de description de session (SDP), en mettant fin au flux multimédia si la vérification échoue, pour garantir l'authenticité du flux multimédia. | 3 | - -## V17.3 Signalisation - -Cette section définit les exigences pour les systèmes qui exploitent leurs propres serveurs de signalisation WebRTC. La signalisation coordonne les communications "pair à pair" et doit être résiliente face aux attaques susceptibles de perturber l'établissement ou le contrôle des sessions. - -Pour garantir une signalisation sécurisée, les systèmes doivent gérer correctement les entrées malformées et rester disponibles sous charge. - -| # | Description | Niveau | -| :---: | :--- | :---: | -| **17.3.1** | Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation entrants légitimes lors d'une attaque par saturation. Cela peut être réalisé en implémentant une limitation de débit au niveau de la signalisation. | 2 | -| **17.3.2** | Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation légitimes en cas de message mal formé susceptible de provoquer un déni de service. Cela peut inclure la validation des entrées, la gestion sécurisée des dépassements d'entiers, la prévention des dépassements de tampon et l'utilisation d'autres techniques robustes de gestion des erreurs. | 2 | - -## Références - -Pour plus d'informations, voir également : - -* Le WebRTC DTLS ClientHello DoS est mieux documenté ici : [Article du blog d'Enable Security destiné aux professionnels de la sécurité](https://www.enablesecurity.com/blog/novel-dos-vulnerability-affecting-webrtc-media-servers/) et ici [livre blanc destiné aux développeurs WebRTC](https://www.enablesecurity.com/blog/webrtc-hello-race-conditions-paper/) -* [RFC 3550 - RTP: A Transport Protocol for Real-Time Applications](https://www.rfc-editor.org/rfc/rfc3550) -* [RFC 3711 - The Secure Real-time Transport Protocol (SRTP)](https://datatracker.ietf.org/doc/html/rfc3711) -* [RFC 5764 - Datagram Transport Layer Security (DTLS) Extension to Establish Keys for the Secure Real-time Transport Protocol (SRTP))](https://datatracker.ietf.org/doc/html/rfc5764) -* [RFC 8825 - Overview: Real-Time Protocols for Browser-Based Applications](https://www.rfc-editor.org/info/rfc8825) -* [RFC 8826 - Security Considerations for WebRTC](https://www.rfc-editor.org/info/rfc8826) -* [RFC 8827 - WebRTC Security Architecture](https://www.rfc-editor.org/info/rfc8827) -* [DTLS-SRTP Protection Profiles](https://www.iana.org/assignments/srtp-protection/srtp-protection.xhtml) diff --git a/5.0/fr/0x90-Appendix-A_Glossary.md b/5.0/fr/0x90-Appendix-A_Glossary.md deleted file mode 100644 index ebcad83488..0000000000 --- a/5.0/fr/0x90-Appendix-A_Glossary.md +++ /dev/null @@ -1,89 +0,0 @@ -# Annexe A : Glossaire - -* **Architecture de sécurité** – Abstraction de la conception d'une application qui identifie et décrit où et comment les contrôles de sécurité sont utilisés, et identifie et décrit également l'emplacement et la sensibilité des données utilisateur et applicatives. -* **Address Space Layout Randomization (ASLR)** - Une technique pour rendre plus difficile l'exploitation des bugs de corruption de la mémoire. -* **Analyse de la composition logicielle** (SCA) – Ensemble de technologies conçues pour analyser la composition, les dépendances, les bibliothèques et les packages des applications afin de détecter les vulnérabilités de sécurité des versions de composants spécifiques utilisées. À ne pas confondre avec l'analyse du code source, communément appelée SAST. -* **Authentification** – Vérification de l'identité revendiquée par un utilisateur d'application. -* **Authentification client TLS**, également appelée **TLS mutuel** (mTLS) - Dans une connexion TLS standard, un client peut utiliser le certificat fourni par le serveur pour valider son identité. Lorsque l'authentification client TLS est utilisée, le client utilise également sa propre clé privée et son propre certificat pour permettre au serveur de valider également son identité. -* **Authentificateur à facteur unique** – Mécanisme permettant de vérifier l'authentification d'un utilisateur. Il peut s'agir d'un élément que vous connaissez (secrets mémorisés, mots de passe, phrases secrètes, codes PIN), d'une information que vous êtes (biométrie, empreinte digitale, reconnaissance faciale) ou d'un élément que vous possédez (jetons OTP, dispositif cryptographique tel qu'une carte à puce). -* **Authentification multifacteur** (MFA) - Authentification qui inclut au moins deux facteurs uniques. -* **Authentification par authentification unique** (SSO) – Elle se produit lorsqu'un utilisateur se connecte à une application et est ensuite automatiquement connecté à d'autres applications sans avoir à se réauthentifier. Par exemple, lorsqu'il se connecte à Google, il sera automatiquement connecté à d'autres services Google tels que YouTube, Google Docs et Gmail. -* **Bill of Materials logiciels** (SBOM) – Liste structurée et complète de tous les composants, modules, bibliothèques, Framework et autres ressources nécessaires à la création ou à l'assemblage d'une application logicielle. -* **Certificat X.509** – Un certificat X.509 est un certificat numérique qui utilise la norme internationale d'infrastructure à clés publiques (PKI) X.509, largement acceptée, pour vérifier qu'une clé publique appartient à l'identité de l'utilisateur, de l'ordinateur ou du service contenue dans le certificat. -* **Code d'authentification de message** (MAC) - Somme de contrôle cryptographique des données, calculée par un algorithme de génération de MAC, utilisée pour garantir leur intégrité et leur authenticité. -* **Communication Web en temps réel** (WebRTC) – Pile de protocoles et API web associée, utilisées pour le transport de flux multimédias dans les applications web, généralement dans le cadre de téléconférences. Basée sur SRTP, SRTCP, DTLS, SDP et STUN/TURN. -* **Configuration de sécurité** – Configuration d'exécution d'une application qui affecte l'utilisation des contrôles de sécurité. -* **Contrôle de sécurité** – Fonction ou composant qui effectue un contrôle de sécurité (par exemple, un contrôle d'autorisation) ou, lorsqu'il est appelé, produit un effet de sécurité (par exemple, la génération d'un enregistrement d'audit). -* **Composant** – Unité de code autonome, avec des interfaces disque et réseau associées, qui communique avec d'autres composants. -* **Couche de service sécurisé** – Tout point d'application de contrôle sécurisé, tel qu'un microservice, une API sans serveur, côté serveur, une API sécurisée sur un appareil client doté d'un démarrage sécurisé, des API partenaires ou externes, etc. Le terme « sécurisé » signifie qu'il n'y a aucun risque qu'un utilisateur non sécurisé puisse contourner ou ignorer la couche ou les contrôles implémentés à cette couche. -* **Cross-Site Scripting** (XSS) – Vulnérabilité de sécurité généralement présente dans les applications web, permettant l'injection de scripts côté client dans le contenu. -* **Cycle de vie du développement logiciel** (SDLC) – Processus étape par étape de développement d'un logiciel, depuis les exigences initiales jusqu'au déploiement et à la maintenance. -* **Datagram Transport Layer Security** (DTLS) – Protocole cryptographique assurant la sécurité des communications sur une connexion réseau. Basé sur le protocole TLS, il est adapté à la protection des protocoles orientés datagrammes (généralement via UDP). Défini dans la RFC 9147 pour DTLS 1.3. -* **Délai d'inactivité** – Durée pendant laquelle une session peut rester active en l'absence d'interaction de l'utilisateur avec l'application. Il s'agit d'un élément de l'expiration de la session. -* **Durée de vie maximale absolue d'une session** – Également appelée « délai d'expiration global » par le NIST, il s'agit de la durée maximale pendant laquelle une session peut rester active après authentification, quelle que soit l'interaction de l'utilisateur. Il s'agit d'un élément de l'expiration de la session. -* **Entité externe XML** (XXE) – Type d'entité XML permettant d'accéder à du contenu local ou distant via un identifiant système déclaré. Cela peut conduire à diverses attaques par injection. -* **Énumération des faiblesses courantes** (CWE) – Liste communautaire des faiblesses courantes en matière de sécurité logicielle. Elle sert de langage commun, de critère de mesure pour les outils de sécurité logicielle et de référence pour l'identification, l'atténuation et la prévention des faiblesses. -* **Environnement d'exécution sécurisé** (TEE) - Un environnement de traitement isolé dans lequel les applications peuvent être exécutées en toute sécurité, indépendamment du reste du système. -* **Extension de sécurité de la couche de transport de datagrammes pour l'établissement de clés pour le protocole de transport sécurisé en temps réel** (DTLS-SRTP) – Mécanisme d'utilisation d'une négociation DTLS pour l'établissement des clés d'une session SRTP. Définie dans la RFC 5764. -* **Falsification de requête côté serveur** (SSRF) – Attaque qui exploite les fonctionnalités du serveur pour lire ou mettre à jour des ressources internes. L'attaquant fournit ou modifie une URL, que le code exécuté sur le serveur lit ou à laquelle il soumet des données. -* **Fast IDentity Online** (FIDO) – Ensemble de normes d'authentification permettant l'utilisation de différentes méthodes d'authentification, notamment la biométrie, les modules de plateforme sécurisée (TPM), les jetons de sécurité USB, etc. -* **Fonction de dérivation de clé basée sur un mot de passe 2** (PBKDF2) – Algorithme unidirectionnel spécial utilisé pour créer une clé cryptographique forte à partir d'un texte d'entrée (tel qu'un mot de passe) et d'une valeur de sel aléatoire supplémentaire. Il peut donc être utilisé pour rendre plus difficile le forçage d'un mot de passe hors ligne si la valeur résultante est stockée à la place du mot de passe d'origine. -* **Fournisseur d'identité** (IdP) – Également appelé fournisseur de services d'identification (CSP) dans les références NIST. Entité qui fournit une source d'authentification pour d'autres applications. -* **Fournisseur de services d'identification** (CSP) – Également appelé fournisseur d'identité (IdP). Source de données utilisateur pouvant être utilisée comme source d'authentification par d'autres applications. -* **Générateur de nombres pseudo-aléatoires cryptographiquement sécurisé** (CSPRNG) - Un générateur de nombres pseudo-aléatoires avec des propriétés qui le rendent adapté à une utilisation en cryptographie, également appelé générateur de nombres aléatoires cryptographiques (CRNG). -* **Gestion des informations et des événements de sécurité** (SIEM) - Système de détection des menaces, de conformité et de gestion des incidents de sécurité par la collecte et l'analyse de données de sécurité provenant de diverses sources au sein de l'infrastructure informatique d'une organisation. -* **Graphiques vectoriels évolutifs** (SVG) – Langage de balisage XML pour la description de graphiques vectoriels bidimensionnels. -* **Hardware Security Module** (HSM) – Composant matériel qui stocke les clés cryptographiques et autres secrets de manière protégée. -* **Hibernate Query Language** (HQL) – Langage de requête similaire au SQL utilisé par la bibliothèque Hibernate ORM. -* **HTTP Strict Transport Security** (HSTS) – Politique qui indique au navigateur de se connecter uniquement au domaine renvoyant l'en-tête via TLS et lorsqu'un certificat valide est présenté. Elle est activée via le champ d'en-tête de réponse Strict-Transport-Security. -* **HyperText Transfer Protocol** (HTTP) – Protocole d'application pour les systèmes d'information hypermédia distribués et collaboratifs. Il constitue le fondement de la communication de données sur le World Wide Web. -* **Identifiant de ressource uniforme** (URI) – Chaîne de caractères unique identifiant une ressource, telle qu'une page web, une adresse e-mail, des lieux. -* **Identifiant de session** ou **ID de session** – Clé identifiant une session avec état stockée dans le backend. Transférée vers et depuis le client, soit sous forme de jeton de référence, soit à l'intérieur d'un jeton de référence. -* **Identifiant unique universel** (UUID) – Un numéro de référence unique utilisé comme identifiant dans un logiciel. -* **Inclusion de fichiers distants** (RFI) – Attaque exploitant des procédures d'inclusion vulnérables dans l'application, entraînant l'inclusion de fichiers distants. -* **Inclusion de fichiers locaux** (LFI) – Attaque exploitant les procédures d'inclusion de fichiers vulnérables d'une application, entraînant l'inclusion de fichiers locaux déjà présents sur le serveur. -* **Inclusion de script intersite** (XSSI) – Variante d'une attaque de script intersite (XSS) dans laquelle une application web récupère du code malveillant depuis une ressource externe et l'intègre à son propre contenu. -* **Infrastructure à clés publiques** (PKI) – Dispositif qui lie les clés publiques aux identités respectives des entités. Cette liaison est établie par un processus d'enregistrement et de délivrance de certificats auprès et par une autorité de certification (AC). -* **Injection SQL** (SQLi) - Technique d'injection de code utilisée pour attaquer les applications pilotées par les données, dans laquelle des instructions SQL malveillantes sont insérées dans un endpoint. -* **Jeton anti-falsification** – Mécanisme par lequel un ou plusieurs jetons sont transmis dans une requête et validés par le serveur d'app. -* **Code d'authentification de message** (MAC) - Somme de contrôle cryptographique des données, calculée par un algorithme de génération de MAC, utilisée pour garantir leur intégrité et leur authenticité. -* **Jeton autonome** – Jeton qui encapsule un ou plusieurs attributs indépendants de l'état côté serveur ou d'un autre stockage externe. Ces jetons garantissent l'authenticité et l'intégrité des attributs qu'ils contiennent, permettant un échange d'informations sécurisé et « sans état » entre les systèmes. Les jetons autonomes sont généralement sécurisés à l'aide de techniques cryptographiques, telles que les signatures numériques ou les codes d'authentification de messages (MAC), afin de garantir l'authenticité, l'intégrité et, dans certains cas, la confidentialité de leurs données. Les assertions SAML et les JWT en sont des exemples courants. -* **Jeton de référence** – Type de jeton servant de pointeur ou d'identifiant vers un état ou des métadonnées stockées sur un serveur, parfois appelés jetons aléatoires ou jetons opaques. Contrairement aux jetons autonomes, qui intègrent certaines de leurs données pertinentes au sein même du jeton, les jetons de référence ne contiennent aucune information intrinsèque et dépendent du serveur pour le contexte. Le jeton de référence sera ou contiendra un identifiant de session. -* **Jeton de session** – Expression générique utilisée dans la présente norme pour désigner le jeton ou la valeur utilisé(e) dans les mécanismes de session sans état (qui utilisent un jeton autonome) ou dans les mécanismes de session avec état (qui utilisent un jeton de référence). -* **Jeton Web JSON** (JWT) – La RFC 7519 définit une norme pour un objet de données JSON composé d'une section d'en-tête expliquant comment valider l'objet, d'une section de corps contenant un ensemble de déclarations et d'une section de signature contenant une signature numérique permettant de valider le contenu de la section de corps. Il s'agit d'un type de jeton autonome. -* **Liste d'autorisation** – Liste de données ou d'opérations autorisées, par exemple une liste de caractères autorisés à valider les entrées. -* **Localisateur de ressources uniforme** (URL) – Chaîne spécifiant l'emplacement d'une ressource sur Internet. -* **Malware** - Code introduit dans une application pendant son développement, à l'insu de son propriétaire, qui contourne la politique de sécurité prévue de l'application. Différent des logiciels malveillants tels qu'un virus ou un ver ! -* **Mappage objet-relationnel** (ORM) - Système permettant de référencer et d'interroger une base de données relationnelle/table au sein d'un programme d'application à l'aide d'un modèle objet compatible avec l'application. -* **Mécanisme de session avec état** - Dans un mécanisme de session avec état, l'application conserve l'état de la session dans le backend, ce qui correspond généralement à un jeton de session, généré à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG), délivré à l'utilisateur final. -* **Mécanisme de session sans état** - Un mécanisme de session sans état utilise un jeton autonome transmis aux clients et contenant des informations de session qui ne sont pas nécessairement stockées au sein du service, qui reçoit et valide ensuite le jeton. En réalité, un service doit avoir accès à certaines informations de session (comme une liste de révocation JWT) pour pouvoir appliquer les contrôles de sécurité requis. -* **Module cryptographique** – Matériel, logiciel et/ou micrologiciel implémentant des algorithmes cryptographiques et/ou générant des clés cryptographiques. -* **Module de plateforme sécurisé** (TPM) – Type de HSM généralement rattaché à un composant matériel plus important, comme une carte mère, et servant de « racine de confiance » pour ce système. -* **Mot de passe à usage unique** (OTP) - Mot de passe généré de manière unique pour une utilisation unique. -* **Open Worldwide Application Security Project** (OWASP) – L'OWASP (Open Worldwide Application Security Project) est une communauté mondiale, libre et ouverte, qui se consacre à l'amélioration de la sécurité des logiciels applicatifs. Notre mission est de rendre la sécurité des applications visible, afin que les personnes et les organisations puissent prendre des décisions éclairées face aux risques de sécurité applicative. Voir : [https://www.owasp.org/](https://www.owasp.org/). -* **OTP basé sur l'heure** - Méthode de génération d'un OTP où l'heure actuelle fait partie de l'algorithme de génération du mot de passe. -* **Partie de confiance** (RP) – Généralement une application qui s'appuie sur l'authentification d'un utilisateur auprès d'un fournisseur d'authentification distinct. L'application s'appuie sur un jeton ou un ensemble d'assertions signées fournies par ce fournisseur d'authentification pour garantir que l'utilisateur est bien celui qu'il prétend être. -* **Protocole de description de session** (SDP) - Format de message permettant de configurer une session multimédia (utilisé par exemple dans WebRTC). Défini dans la RFC 4566. -* **Protocole de transport en temps réel** (RTP) et **Protocole de contrôle de transport en temps réel** (RTCP) - Deux protocoles utilisés conjointement pour le transport de flux multimédia. Utilisé par la pile WebRTC. Défini dans la RFC 3550. -* **Protocole de transfert hypertexte sur SSL/TLS** (HTTPS) – Méthode de sécurisation des communications HTTP par chiffrement à l'aide du protocole TLS (Transport Layer Security). -* **Rapport de vérification de la sécurité des applications** – Rapport documentant les résultats globaux et l'analyse justificative produite par le vérificateur pour une application donnée. -* **Réseau téléphonique public commuté** (RTPC) – Réseau téléphonique traditionnel qui comprend à la fois les téléphones fixes et les téléphones mobiles. -* **Secure Real-time Transport Protocol** (SRTP) et **Secure Real-time Transport Control Protocol** (SRTCP) – Profil des protocoles RTP et RTCP prenant en charge le chiffrement des messages, l'authentification et la protection de leur intégrité. Défini dans la RFC 3711. -* **Security Assertion Markup Language** (SAML) – Une norme ouverte pour l’authentification unique basée sur la transmission d’assertions signées (généralement des objets XML) entre le fournisseur d’identité et la partie utilisatrice. -* **Sécurité des applications** – La sécurité au niveau des applications se concentre sur l'analyse des composants de la couche applicative du modèle de référence d'interconnexion des systèmes ouverts (OSI), plutôt que sur le système d'exploitation sous-jacent ou les réseaux connectés, par exemple. -* **Test boîte noire** – Méthode de test logiciel qui examine les fonctionnalités d'une application sans scruter ses structures ou son fonctionnement internes. -* **Tests dynamiques de sécurité des applications** (DAST) – Technologies conçues pour détecter les conditions indiquant une vulnérabilité de sécurité dans une application en cours d'exécution. -* **Time-of-check to time-of-use** (TOCTOU) - Situation dans laquelle une application vérifie l'état d'une ressource avant de l'utiliser, mais cet état peut être modifié entre la vérification et l'utilisation. Cela peut invalider les résultats de la vérification et entraîner des actions non valides de l'application en raison de cette incohérence d'état. -* **Time based One-time Passwords** (TOTPs) - Méthode de génération d'un OTP dans laquelle l'heure actuelle fait partie de l'algorithme de génération du mot de passe. -* **Transport Layer Security** (TLS) - Protocoles cryptographiques qui assurent la sécurité des communications sur une connexion réseau. -* **Traversée utilisant des relais autour de NAT** (TURN) – Extension du protocole STUN utilisant un serveur TURN comme relais lorsque les connexions "pair à pair" directes ne peuvent être établies. Défini dans la RFC 8656. -* **TLS mutuel** (mTLS) - Voir authentification client TLS. -* **Utilitaires de traversée de session pour NAT** (STUN) - Protocole utilisé pour faciliter la traversée NAT afin d'établir des communications "pair à pair". Défini dans la RFC 3489. -* **Validation des entrées** - Canonisation et validation des entrées utilisateur non fiables. -* **Vérificateur** – Personne ou équipe qui examine une demande par rapport aux exigences ASVS de l'OWASP. -* **Vérification automatisée** – Utilisation d'outils automatisés (analyse dynamique, analyse statique, ou les deux) qui utilisent les signatures de vulnérabilité pour détecter les problèmes. -* **Vérification de la conception** – Évaluation technique de l'architecture de sécurité d'une application. -* **Vérification de la sécurité des applications** – Évaluation technique d'une application par rapport à l'ASVS de l'OWASP. -* **Vérification dynamique** – Utilisation d'outils automatisés utilisant les signatures de vulnérabilité pour détecter les problèmes lors de l'exécution d'une application. -* **WebSocket sur TLS** (WSS) – Pratique de sécurisation des communications WebSocket en superposant WebSocket sur le protocole TLS. -* **What You See Is What You Get** (WYSIWYG) – Éditeur de contenu riche qui montre l'apparence réelle du contenu une fois rendu, plutôt que le codage utilisé pour gérer le rendu. diff --git a/5.0/fr/0x91-Appendix-B_References.md b/5.0/fr/0x91-Appendix-B_References.md deleted file mode 100644 index c982de0e9b..0000000000 --- a/5.0/fr/0x91-Appendix-B_References.md +++ /dev/null @@ -1,43 +0,0 @@ -# Annexe B : Références - -Les projets OWASP suivants sont les plus susceptibles d’être utiles aux utilisateurs/adoptants de cette norme : - -## Projets principaux de l'OWASP - -1. OWASP Top 10 Project : [https://owasp.org/www-project-top-ten/](https://owasp.org/www-project-top-ten/) -2. OWASP Web Security Testing Guide : [https://owasp.org/www-project-web-security-testing-guide/](https://owasp.org/www-project-web-security-testing-guide/) -3. OWASP Proactive Controls : [https://owasp.org/www-project-proactive-controls/](https://owasp.org/www-project-proactive-controls/) -4. OWASP Software Assurance Maturity Model (SAMM) : [https://owasp.org/www-project-samm/](https://owasp.org/www-project-samm/) -5. OWASP Secure Headers Project : [https://owasp.org/www-project-secure-headers/](https://owasp.org/www-project-secure-headers/) - -## Projet de la série de fiches aide-mémoire de l'OWASP - -[Ce projet](https://owasp.org/www-project-cheat-sheets/) contient plusieurs aide-mémoires qui seront pertinents pour différents sujets de l'ASVS. - -Il existe un mappage vers l'ASVS qui peut être trouvé ici : [https://cheatsheetseries.owasp.org/IndexASVS.html](https://cheatsheetseries.owasp.org/IndexASVS.html) - -## Projets liés à la sécurité mobile - -1. OWASP Mobile Security Project: [https://owasp.org/www-project-mobile-security/](https://owasp.org/www-project-mobile-security/) -2. OWASP Mobile Top 10 Risks: [https://owasp.org/www-project-mobile-top-10/](https://owasp.org/www-project-mobile-top-10/) -3. OWASP Mobile Security Testing Guide and Mobile Application Security Verification Standard: [https://owasp.org/www-project-mobile-security-testing-guide/](https://owasp.org/www-project-mobile-security-testing-guide/) - -## Projets Internet des objets de l'OWASP - -1. OWASP Internet of Things Project: [https://owasp.org/www-project-internet-of-things/](https://owasp.org/www-project-internet-of-things/) - -## Projets sans serveur OWASP - -1. OWASP Serverless Project : [https://owasp.org/www-project-serverless-top-10/](https://owasp.org/www-project-serverless-top-10/) - -## Autres - -De même, les sites Web suivants sont susceptibles d’être utiles aux utilisateurs/adoptants de cette norme - -1. SecLists Github : [https://github.com/danielmiessler/SecLists](https://github.com/danielmiessler/SecLists) -2. MITRE Common Weakness Enumeration : [https://cwe.mitre.org/](https://cwe.mitre.org/) -3. PCI Security Standards Council : [https://www.pcisecuritystandards.org/](https://www.pcisecuritystandards.org/) -4. PCI Data Security Standard (DSS) v3.2.1 Requirements and Security Assessment Procedures : [https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf](https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf) -5. PCI Software Security Framework - Secure Software Requirements and Assessment Procedures : [https://www.pcisecuritystandards.org/documents/PCI-Secure-Software-Standard-v1_0.pdf](https://www.pcisecuritystandards.org/documents/PCI-Secure-Software-Standard-v1_0.pdf) -6. PCI Secure Software Lifecycle (Secure SLC) Requirements and Assessment Procedures : [https://www.pcisecuritystandards.org/documents/PCI-Secure-SLC-Standard-v1_0.pdf](https://www.pcisecuritystandards.org/documents/PCI-Secure-SLC-Standard-v1_0.pdf) -7. OWASP ASVS 4.0 Testing Guide : [https://github.com/BlazingWind/OWASP-ASVS-4.0-testing-guide](https://github.com/BlazingWind/OWASP-ASVS-4.0-testing-guide) diff --git a/5.0/fr/0x92-Appendix-C_Cryptography.md b/5.0/fr/0x92-Appendix-C_Cryptography.md deleted file mode 100644 index 88dc182bad..0000000000 --- a/5.0/fr/0x92-Appendix-C_Cryptography.md +++ /dev/null @@ -1,312 +0,0 @@ -# Annexe C : Standards cryptographiques - -Le chapitre « Cryptographie » va au-delà de la simple définition des bonnes pratiques. Il vise à améliorer la compréhension des principes de cryptographie et à encourager l'adoption de méthodes de sécurité plus résilientes et modernes. Cette annexe fournit des informations techniques détaillées sur chaque exigence, en complément des normes générales décrites dans le chapitre « Cryptographie ». - -Cette annexe définit le niveau d'approbation des différents mécanismes cryptographiques : - -* Les mécanismes _Approuvés_ (A) peuvent être utilisés dans les applications. -* Les mécanismes _Hérités_ (L) ne devraient pas être utilisés dans les applications, mais peuvent néanmoins être utilisés uniquement pour assurer la compatibilité avec les applications ou le code existants. Bien que l'utilisation de ces mécanismes ne soit pas actuellement considérée comme une vulnérabilité en soi, ils devraient être remplacés par des mécanismes plus sûrs et évolutifs dès que possible. -* Les mécanismes _Interdits_ (D) ne devraient pas être utilisés car ils sont actuellement considérés comme cassés ou n'offrent pas une sécurité suffisante. - -Cette liste peut être modifiée dans le contexte d'une application donnée pour diverses raisons, notamment : - -* nouvelles évolutions dans le domaine de la cryptographie ; -* conformité à une réglementation. - -## Inventaire et documentation cryptographiques - -Cette section fournit des informations complémentaires -sur l'inventaire et la documentation cryptographiques V11.1. - -Il est important de s'assurer que tous les actifs cryptographiques, tels que les algorithmes, les clés et les certificats, sont régulièrement découverts, inventoriés et évalués. Pour le niveau 3, cela devrait inclure l'utilisation d'analyses statiques et dynamiques pour découvrir l'utilisation de la cryptographie dans une application. Des outils tels que les SAST et DAST peuvent être utiles, mais des outils dédiés pourraient être nécessaires pour une couverture plus complète. Voici quelques exemples d'outils gratuits : - -* [CryptoMon - Moniteur de cryptographie réseau - utilisant eBPF, écrit en python](https://github.com/Santandersecurityresearch/CryptoMon) -* [Cryptobom Forge Tool: Generating Comprehensive CBOMs from CodeQL Outputs](https://github.com/Santandersecurityresearch/cryptobom-forge) - -## Forces équivalentes des paramètres cryptographiques - -Les niveaux de sécurité relatifs des différents systèmes cryptographiques sont présentés dans ce tableau (extrait de [NIST SP 800-57 Partie 1](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final), p.71) : - -| Force de sécurité | Algorithmes à clés symétriques | Corps finis | Factorisation d'entiers | Courbe elliptique | -|--|--|--|--|--| -| <= 80 | 2TDEA | L = 1024
N = 160 | k = 1024 | f = 160-223 | -| 112 | 3TDEA | L = 2048
N = 224 | k = 2048 | f = 224-255 | -| 128 | AES-128 | L = 3072
N = 256 | k = 3072 | f = 256-383 | -| 192 | AES-192 | L = 7680
N = 384 | k = 7680 | f = 384-511 | -| 256 | AES-256 | L = 15360
N = 512 | k = 15360 | f = 512+ | - -Exemples d'applications : - -* Cryptographie à corps finis : DSA, FFDH, MQV -* Cryptographie à factorisation entière : RSA -* Cryptographie à courbes elliptiques : ECDSA, EdDSA, ECDH, MQV - -Remarque : cette section suppose qu'aucun ordinateur quantique n'existe ; si un tel ordinateur existait, les estimations des trois dernières colonnes ne seraient plus valides. - -## Valeurs aléatoires - -Cette section fournit des informations supplémentaires -sur les valeurs aléatoires de la version 11.5. - -| Nom | Version/Référence | Notes | Statut | -|:---|:----|:----|:-:| -| `/dev/random` | Linux 4.8+ [(oct. 2016)](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=818e607b57c94ade9824dad63a96c2ea6b21baf3), également présent dans iOS, Android et d'autres systèmes d'exploitation POSIX basés sur Linux. Basé sur [RFC7539](https://datatracker.ietf.org/doc/html/rfc7539) | Utilise le flux ChaCha20. Trouvé dans iOS [`SecRandomCopyBytes`](https://developer.apple.com/documentation/security/secrandomcopybytes(_:_:_:)?language=objc) et Android [`Secure Random`](https://developer.android.com/reference/java/security/SecureRandom) avec les paramètres corrects fournis pour chacun. | A | -| `/dev/urandom` | Fichier spécial du noyau Linux pour fournir des données aléatoires | Fournit des sources d'entropie de haute qualité à partir du caractère aléatoire matériel | A | -| `AES-CTR-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | Tel qu'utilisé dans les implémentations courantes, telles que [l'API Windows CNG `BCryptGenRandom`](https://learn.microsoft.com/en-us/windows/win32/api/bcrypt/nf-bcrypt-bcryptgenrandom) définie par [`BCRYPT_RNG_ALGORITHM`](https://learn.microsoft.com/en-us/windows/win32/seccng/cng-algorithm-identifiers). | A | -| `HMAC-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | | A | -| `Hash-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | | A | -| `getentropy()` | [OpenBSD](https://man.openbsd.org/getentropy.2), disponible sous [Linux glibc 2.25+](https://man7.org/linux/man-pages/man3/getentropy.3.html) et [macOS 10.12+](https://support.apple.com/en-gb/guide/security/seca0c73a75b/web) | Fournit des octets aléatoires sécurisés directement depuis la source d'entropie du noyau, grâce à une API simple et minimale. Plus moderne, elle évite les pièges des anciennes API. | A | - -La fonction de hachage sous-jacente utilisée avec HMAC-DRBG ou Hash-DRBG doit être approuvée pour cette utilisation. - -## Algorithmes de chiffrement - -Cette section fournit des informations supplémentaires -sur les algorithmes de chiffrement V11.3. - -Les algorithmes de chiffrement approuvés sont classés par ordre de préférence. - -| Algorithmes à clé symétrique | Référence | Statut | -| ------ | ------ |:-:| -| AES-256 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | A | -| Salsa20 | [Salsa 20 specification](https://cr.yp.to/snuffle/spec.pdf) | A | -| XChaCha20 | [XChaCha20 Draft](https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-xchacha-03) | A | -| XSalsa20 | [Extending the Salsa20 nonce](https://cr.yp.to/snuffle/xsalsa-20110204.pdf) | A | -| ChaCha20 | [RFC 8439](https://www.rfc-editor.org/info/rfc8439) | A | -| AES-192 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | A | -| AES-128 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | L | -| 2TDEA | | D | -| TDEA (3DES/3DEA) | | D | -| IDEA | | D | -| RC4 | | D | -| Blowfish| | D | -| ARC4 | | D | -| DES | | D | - -### Modes de chiffrement AES - -Les chiffrements par blocs, comme AES, peuvent être utilisés avec différents modes opératoires. De nombreux modes, comme le livre de codes électronique (ECB), ne sont pas sécurisés et ne doivent pas être utilisés. Les modes Galois/Compteur (GCM) et Compteur avec chaînage de blocs et code d'authentification de message (CCM) assurent un chiffrement authentifié et doivent être utilisés dans les applications modernes. - -Les modes approuvés sont classés par ordre de préférence. - -| Mode | Authentifié | Référence | Statut | Restriction | -|--|--|--|--|--| -| GCM | Oui | [NIST SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | | -| CCM | Oui | [NIST SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | | -| CBC | Non | [NIST SP 800-38A](https://csrc.nist.gov/pubs/sp/800/38/a/final) | L | | -| CCM-8 | Oui | | D | | -| ECB | Non | | D | | -| CFB | Non | | D | | -| OFB | Non | | D | | -| CTR | Non | | D | | - -Remarques : - -* Tous les messages chiffrés doivent être authentifiés. Toute utilisation du mode CBC nécessite l'association d'un algorithme MAC de hachage pour valider le message. En général, cet algorithme doit être appliqué à la méthode « Chiffrer puis hacher » (mais TLS 1.2 utilise plutôt la méthode « Hash puis chiffrer »). Si cela ne peut être garanti, le mode CBC NE DOIT PAS être utilisé. La seule application où le chiffrement sans algorithme MAC est autorisé est le chiffrement de disque. -* Si le mode CBC est utilisé, la vérification du remplissage doit être garantie en temps constant. -* Lors de l'utilisation de CCM-8, la balise MAC ne dispose que de 64 bits de sécurité. Ceci n'est pas conforme à l'exigence 6.2.9 qui exige au moins 128 bits de sécurité. -* Le chiffrement de disque est considéré comme hors du périmètre de l'ASVS. Par conséquent, cette annexe ne répertorie aucune méthode approuvée pour le chiffrement de disque. Pour cette utilisation, le chiffrement sans authentification est généralement accepté et les modes XTS, XEX et LRW sont généralement utilisés. - -### key wrapping - -L'encapsulation (et le déchiffrement) d'une clé cryptographique est une méthode de protection d'une clé existante par encapsulation (c'est-à-dire par encapsulation) grâce à un mécanisme de chiffrement supplémentaire, afin que la clé d'origine ne soit pas exposée de manière visible, par exemple lors d'un transfert. Cette clé supplémentaire, utilisée pour protéger la clé d'origine, est appelée clé d'encapsulation. - -Cette opération peut être effectuée lorsqu'il est souhaitable de protéger des clés dans des emplacements jugés non fiables, ou d'envoyer des clés sensibles sur des réseaux non fiables ou au sein d'applications. -Cependant, il est important de bien comprendre la nature (par exemple, l'identité et la finalité) de la clé d'origine avant de s'engager dans une procédure d'encapsulation/déchiffrement, car cela peut avoir des répercussions sur les systèmes/applications sources et cibles en termes de sécurité, et notamment de conformité, ce qui peut inclure des pistes d'audit de la fonction d'une clé (par exemple, la signature) ainsi qu'un stockage approprié des clés. - -Plus précisément, AES-256 doit être utilisé pour l'encapsulation des clés, conformément à la norme NIST SP 800-38F (https://csrc.nist.gov/pubs/sp/800/38/f/final) et en tenant compte des dispositions prospectives contre la menace quantique. Les modes de chiffrement utilisant AES sont les suivants, par ordre de préférence : - -| Enveloppement de clé | Référence | Statut | -|--|--|:-:| -| KW | [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) | A | -| KWP | [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) | A | - -AES-192 et AES-128 PEUVENT être utilisés si le cas d'utilisation l'exige, mais leur motivation DOIT être documentée dans l'inventaire cryptographique de l'entité. - -### Chiffrement authentifié - -À l'exception du chiffrement du disque, les données chiffrées doivent être protégées contre toute modification non autorisée à l'aide d'un schéma de chiffrement authentifié (AE), généralement un schéma de chiffrement authentifié avec données associées (AEAD). - -L'application doit de préférence utiliser un schéma AEAD approuvé. Elle peut également combiner un schéma de chiffrement approuvé et un algorithme MAC approuvé avec une construction « Chiffrer puis MAC ». - -La méthode « MAC puis chiffrer » est toujours autorisée pour des raisons de compatibilité avec les applications existantes. Elle est utilisée dans TLS v1.2 avec les anciennes suites de chiffrement. - -| Mécanisme AEAD | Référence | Statut | -|---|---------|:-:| -|AES-GCM | [SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | -|AES-CCM | [SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | -|ChaCha-Poly1305 | [RFC 7539](https://datatracker.ietf.org/doc/html/rfc7539) | A | -|AEGIS-256 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | -|AEGIS-128 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | -|AEGIS-128L| [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | -|Encrypt-then-MAC | | A | -|MAC-then-encrypt | | L | - -## Fonctions de hachage - -Cette section fournit des informations supplémentaires -sur le hachage V11.4 et les fonctions basées sur le hachage. - -### Fonctions de hachage pour les cas d'utilisation généraux - -Le tableau suivant répertorie les fonctions de hachage approuvées pour les cas d'utilisation cryptographiques généraux, tels que les signatures numériques : - -* Les fonctions de hachage approuvées offrent une forte résistance aux collisions et conviennent aux applications de haute sécurité. -* Certains de ces algorithmes offrent une forte résistance aux attaques lorsqu'ils sont utilisés avec une gestion appropriée des clés cryptographiques. Ils sont donc également approuvés pour les fonctions HMAC, KDF et RBG. -* Les fonctions de hachage dont le résultat est inférieur à 254 bits présentent une résistance aux collisions insuffisante et ne doivent pas être utilisées pour la signature numérique ou d'autres applications nécessitant une résistance aux collisions. Pour d'autres utilisations, elles peuvent être utilisées à des fins de compatibilité et de vérification UNIQUEMENT avec les systèmes existants, mais ne doivent pas être utilisées dans les nouvelles conceptions. - -| Fonction de hachage | Référence | Statut | Restrictions | -| ------ | ----------- |:-:| ---------- | -| SHA3-512 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | -| SHA-512 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | -| SHA3-384 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | -| SHA-384 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | -| SHA3-256 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | -| SHA-512/256 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | -| SHA-256 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | -| SHAKE256 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | -| BLAKE2s | [BLAKE2: simpler, smaller, fast as MD5](https://eprint.iacr.org/2013/322) | A | | -| BLAKE2b | [BLAKE2: simpler, smaller, fast as MD5](https://eprint.iacr.org/2013/322) | A | | -| BLAKE3 | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | | -| SHA-224 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | L | Ne convient pas aux signatures numériques HMAC, KDF, RBG | -| SHA-512/224 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | L | Ne convient pas aux signatures numériques HMAC, KDF, RBG | -| SHA3-224 | [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | L | Ne convient pas aux signatures numériques HMAC, KDF, RBG | -| SHA-1 | [RFC 3174](https://www.rfc-editor.org/info/rfc3174) et [RFC 6194](https://www.rfc-editor.org/info/rfc6194) | L | Ne convient pas aux signatures numériques HMAC, KDF, RBG | -| CRC (toute longueur) | | D | | -| MD4 | [RFC 1320](https://www.rfc-editor.org/info/rfc1320) | D | | -| MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | | - -### Fonctions de hachage pour le stockage des mots de passe - -Pour un hachage sécurisé des mots de passe, des fonctions de hachage dédiées doivent être utilisées. Ces algorithmes de hachage lent atténuent les attaques par force brute et par dictionnaire en augmentant la difficulté de calcul du craquage des mots de passe. - -| KDF | Référence | Paramètres requis | Statut | -| ---------- | --------- | ------------ |:-:| -| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1 | A | -| | | t = 2: m ≥ 19456 (19 MiB), p = 1 | A | -| | | t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | -| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8 | A | -| | | p = 2: N ≥ 2^16 (64 MiB), r = 8 | A | -| | | p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | -| bcrypt | [A Future-Adaptable Password Scheme](https://www.researchgate.net/publication/2519476_A_Future-Adaptable_Password_Scheme) | coût ≥ 10 | A | -| PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | itérations ≥ 210,000 | A | -| PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | itérations ≥ 600,000 | A | -| PBKDF2-HMAC-SHA-1 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | itérations ≥ 1,300,000 | L | - -Les fonctions de dérivation de clés basées sur des mots de passe approuvées peuvent être utilisées pour le stockage des mots de passe. - -## Fonctions de dérivations de clés (KDFs) - -### Fonctions de dérivations de clés générales - -| KDF | Référence | Statut | -| ---------------- | -------- |:-:| -| HKDF | [RFC 5869](https://www.rfc-editor.org/info/rfc5869) | A | -| TLS 1.2 PRF | [RFC 5248](https://www.rfc-editor.org/info/rfc5248) | L | -| KDFs à base de MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | -| KDFs à base de SHA-1 | [RFC 3174](https://www.rfc-editor.org/info/rfc3174), [RFC 6194](https://www.rfc-editor.org/info/rfc6194) | D | - -### Fonctions de dérivations de clés à base de mot de passe - -| KDF | Référence | Paramètres requis | Statut | -| ---------- | --------- | ------------ |:-:| -| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1 | A | -| | | t = 2: m ≥ 19456 (19 MiB), p = 1 | A | -| | | t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | -| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8 | A | -| | | p = 2: N ≥ 2^16 (64 MiB), r = 8 | A | -| | | p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | -| PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | itérations ≥ 210,000 | A | -| PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | itérations ≥ 600,000 | A | -| PBKDF2-HMAC-SHA-1 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | itérations ≥ 1,300,000 | L | - -## Mécanismes d'échange de clés - -Cette section fournit des informations complémentaires -sur la cryptographie à clé publique V11.6. - -### Systèmes KEX - -Une force de sécurité de 112 bits ou plus DOIT être garantie pour tous les méthodes d'échange de clés, et leur mise en œuvre DOIT suivre les choix de paramètres dans le tableau suivant. - -| Schéma | Paramètres du domaine | Confidentialité persistante | Statut | -|--|--|--|:-:| -| Diffie-Hellman à corps finis (FFDH) | L >= 3072 et N >= 256 | Oui | A | -| Courbe elliptique Diffie-Hellman (ECDH) | f >= 256-383 | Oui | A | -| Transport de clés chiffrées avec RSA-PKCS#1 v1.5 | | Non | D | - -Où les paramètres suivants sont : - -* k est la taille de la clé RSA. -* L est la taille de la clé publique et N est la taille de la clé privée pour la cryptographie à corps finis. -* f est la plage de tailles de clés pour ECC. - -Toute nouvelle implémentation NE DOIT PAS utiliser de schéma non conforme aux normes [NIST SP 800-56A](https://csrc.nist.gov/pubs/sp/800/56/a/r3/final) et [B](https://csrc.nist.gov/pubs/sp/800/56/b/r2/final) et [NIST SP 800-77](https://csrc.nist.gov/pubs/sp/800/77/r1/final). Plus précisément, IKEv1 NE DOIT PAS être utilisé en production. - -### Groupes Diffie-Hellman - -Les groupes suivants sont approuvés pour la mise en œuvre de l'échange de clés Diffie-Hellman. Les niveaux de sécurité sont décrits dans la norme NIST SP 800-56A (https://csrc.nist.gov/pubs/sp/800/56/a/r3/final), l'annexe D et la norme NIST SP 800-57, partie 1, révision 5 (https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final). - -| Groupe | Statut | -|------------------|:------:| -| P-224, secp224r1 | A | -| P-256, secp256r1 | A | -| P-384, secp384r1 | A | -| P-521, secp521r1 | A | -| K-233, sect233k1 | A | -| K-283, sect283k1 | A | -| K-409, sect409k1 | A | -| K-571, sect571k1 | A | -| B-233, sect233r1 | A | -| B-283, sect283r1 | A | -| B-409, sect409r1 | A | -| B-571, sect571r1 | A | -| Curve448 | A | -| Curve25519 | A | -| MODP-2048 | A | -| MODP-3072 | A | -| MODP-4096 | A | -| MODP-6144 | A | -| MODP-8192 | A | -| ffdhe2048 | A | -| ffdhe3072 | A | -| ffdhe4096 | A | -| ffdhe6144 | A | -| ffdhe8192 | A | - -## Codes d'authentification des messages (MAC) - -Les codes d'authentification de message (MAC) sont des structures cryptographiques permettant de vérifier l'intégrité et l'authenticité d'un message. Un MAC prend en entrée un message et une clé secrète et génère une étiquette de taille fixe (la valeur MAC). Les MAC sont largement utilisés dans les protocoles de communication sécurisés (par exemple, TLS/SSL) pour garantir l'authenticité et l'intégrité des messages échangés entre les parties. - -| Algorithme MAC | Référence | Statut | -| ---------- | --------------- |:-:| -| HMAC-SHA-256 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) et [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | -| HMAC-SHA-384 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) et [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | -| HMAC-SHA-512 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) et [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | -| KMAC128 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | -| KMAC256 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | -| BLAKE3 (mode keyed_hash) | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | -| AES-CMAC | [RFC 4493](https://datatracker.ietf.org/doc/html/rfc4493) et [NIST SP 800-38B](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38b.pdf) | A | -| AES-GMAC | [NIST SP 800-38D](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf) | A | -| Poly1305-AES | [The Poly1305-AES message-authentication code](https://cr.yp.to/mac/poly1305-20050329.pdf) | A | -| HMAC-SHA-1 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) et [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | L | -| HMAC-MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | - -## Signatures numériques - -Les schémas de signature DOIVENT utiliser des tailles de clés et des paramètres approuvés conformément à la norme [NIST SP 800-57 Partie 1](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final). - -| Algorithme de signature | Référence | Statut | -| ------------------------------ | --------------------------------------------- | :-: | -| EdDSA (Ed25519, Ed448) | [RFC 8032](https://www.rfc-editor.org/info/rfc8032) | A | -| XEdDSA (Curve25519, Curve448) | [XEdDSA](https://signal.org/docs/specifications/xeddsa/) | A | -| ECDSA (P-256, P-384, P-521) | [FIPS 186-4](https://csrc.nist.gov/pubs/fips/186-5/final) | A | -| RSA-RSSA-PSS | [RFC 8017](https://www.rfc-editor.org/info/rfc8017) | A | -| RSA-SSA-PKCS#1 v1.5 | [RFC 8017](https://www.rfc-editor.org/info/rfc8017) | D | -| DSA (n'importe quelle taille de clé) | [FIPS 186-4](https://csrc.nist.gov/pubs/fips/186-4/final) | D | - -## Normes de chiffrement post-quantique - -Les mises en œuvre de la cryptographie post-quantique (PQC) doivent respecter les normes [FIPS-203](https://csrc.nist.gov/pubs/fips/203/ipd), [FIPS-204](https://csrc.nist.gov/pubs/fips/204/ipd) et [FIPS-205](https://csrc.nist.gov/pubs/fips/205/ipd). À l'heure actuelle, il n'existe pas beaucoup d'exemples de codes renforcés ou d'implémentations de référence disponibles pour ces normes. Pour plus de détails, voir [l'annonce par le NIST des trois premières normes de chiffrement post-quantique finalisées (août 2024)](https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards). - -La méthode d'accord de clé TLS hybride post-quantique proposée [mlkem768x25519](https://datatracker.ietf.org/doc/draft-kwiatkowski-tls-ecdhe-mlkem/03/) est prise en charge par les principaux navigateurs tels que [Firefox version 132](https://www.mozilla.org/en-US/firefox/132.0/releasenotes/) et [Chrome version 131](https://security.googleblog.com/2024/09/a-new-path-for-kyber-on-web.html). Elle peut être utilisée dans des environnements de test cryptographique ou lorsqu'elle est disponible dans des bibliothèques approuvées par l'industrie ou le gouvernement. diff --git a/5.0/fr/0x93-Appendix-D_Recommendations.md b/5.0/fr/0x93-Appendix-D_Recommendations.md deleted file mode 100644 index 8c77ce077b..0000000000 --- a/5.0/fr/0x93-Appendix-D_Recommendations.md +++ /dev/null @@ -1,49 +0,0 @@ -# Annexe D : Recommandations - -## Introduction - -Lors de la préparation de la version 5.0 de la norme de vérification de la sécurité des applications (ASVS), il est apparu clairement que plusieurs éléments, existants ou nouvellement proposés, ne devaient pas être inclus comme exigences dans la version 5.0. Cela peut s'expliquer par le fait qu'ils n'entraient pas dans le champ d'application de l'ASVS selon la définition de la version 5.0, ou bien par le fait que, malgré leur pertinence, ils ne pouvaient être rendus obligatoires. - -Ne voulant pas perdre tous ces éléments entièrement, certains ont été capturés dans cette annexe. - -## Mécanismes de périmètre recommandés - -Les éléments suivants sont concernés par ASVS. Ils ne devraient pas être rendus obligatoires, mais il est fortement recommandé de les prendre en compte dans le cadre d'une application sécurisée. - -* Un indicateur de sécurité des mots de passe devrait être fourni pour aider les utilisateurs à définir un mot de passe plus fort. -* Créez un fichier security.txt accessible au public à la racine ou dans le répertoire .well-known de l'application, définissant clairement un lien ou une adresse e-mail permettant de contacter les propriétaires en cas de problème de sécurité. -* La validation des entrées côté client devrait être appliquée en plus de la validation au niveau d'une couche de service de confiance, car cela permet de détecter si un utilisateur a contourné les contrôles côté client pour tenter d'attaquer l'application. -* Empêchez l'affichage de pages sensibles et accessibles accidentellement dans les moteurs de recherche à l'aide d'un fichier robots.txt, de l'en-tête de réponse X-Robots-Tag ou d'une balise méta HTML robots. -* Lorsque vous utilisez GraphQL, implémentez la logique d'autorisation au niveau de la couche logique métier plutôt que dans la couche GraphQL ou du résolveur afin d'éviter de gérer l'autorisation sur chaque interface distincte. - -Références : - -* [Plus d'informations sur security.txt, y compris un lien vers la RFC](https://securitytxt.org/) - -## Principes de sécurité des logiciels - -Les éléments suivants figuraient déjà dans ASVS, mais ne constituent pas de véritables exigences. Il s'agit plutôt de principes à prendre en compte lors de la mise en œuvre de contrôles de sécurité, dont le respect permettra de renforcer la robustesse. Parmi ceux-ci : - -* Les contrôles de sécurité doivent être centralisés, simples (économie de conception), vérifiables et réutilisables. Cela permet d'éviter les contrôles dupliqués, manquants ou inefficaces. -* Dans la mesure du possible, utilisez des implémentations de contrôle de sécurité préalablement écrites et bien contrôlées plutôt que de vous fier à la mise en œuvre de contrôles à partir de zéro. -* Idéalement, un mécanisme de contrôle d'accès unique devrait être utilisé pour accéder aux données et ressources protégées. Toutes les requêtes devraient transiter par ce mécanisme unique afin d'éviter les copier-coller ou les chemins alternatifs non sécurisés. -* Le contrôle d'accès basé sur les attributs ou les fonctionnalités est un modèle recommandé : le code vérifie l'autorisation de l'utilisateur pour une fonctionnalité ou un élément de données, plutôt que simplement son rôle. Les autorisations doivent toujours être attribuées à l'aide de rôles. - -## Processus de sécurité des logiciels - -Plusieurs processus de sécurité ont été supprimés d'ASVS 5.0, mais restent pertinents. Le projet OWASP SAMM pourrait être une bonne source d'inspiration pour une mise en œuvre efficace de ces processus. Parmi les éléments précédemment présents dans ASVS, on peut citer : - -* Vérifier l'utilisation d'un cycle de vie sécurisé pour le développement de logiciels qui prend en compte la sécurité à tous les stades du développement. -* Vérifier l'utilisation de la modélisation des menaces pour chaque changement de conception ou planification de sprint afin d'identifier les menaces, de planifier les contre-mesures, de faciliter les réponses appropriées aux risques et d'orienter les tests de sécurité. -* Vérifier que toutes les histoires d'utilisateurs et les caractéristiques contiennent des contraintes de sécurité fonctionnelles, telles que "En tant qu'utilisateur, je devrais être en mesure de voir et de modifier mon profil. Je ne dois pas pouvoir consulter ou modifier le profil de quelqu'un d'autre" -* Vérifier la disponibilité d'une liste de contrôle de codage sécurisé, d'exigences de sécurité, de lignes directrices ou d'une politique pour tous les développeurs et les testeurs. -* Vérifier l'existence d'un processus permanent visant à garantir que le code source de l'application est exempt de portes dérobées, de codes malveillants (attaques par salami, bombes logiques, bombes à retardement) et de caractéristiques non documentées ou cachées (œufs de Pâques, outils de débogage non sécurisés). Il n'est pas possible de se conformer à cette section sans un accès complet au code source, y compris aux bibliothèques tierces, et cela ne convient donc probablement qu'aux applications exigeant les niveaux de sécurité les plus élevés. -* Vérifier que des mécanismes sont en place pour détecter les dérives de configuration dans les environnements déployés et y répondre. Il peut s'agir de l'utilisation d'une infrastructure immuable, d'un redéploiement automatisé à partir d'une base sécurisée ou d'outils de détection de dérive qui comparent l'état actuel aux configurations approuvées. -* Vérifier que le durcissement de la configuration est effectué sur tous les produits tiers, les bibliothèques, - -Références: - -* [OWASP Threat Modeling Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html) -* [OWASP Threat modeling](https://owasp.org/www-community/Application_Threat_Modeling) -* [OWASP Software Assurance Maturity Model Project](https://owasp.org/www-project-samm/) -* [Microsoft SDL](https://www.microsoft.com/en-us/securityengineering/sdl/) diff --git a/5.0/fr/0x94-Appendix-E_Contributors.md b/5.0/fr/0x94-Appendix-E_Contributors.md deleted file mode 100644 index 40f1767efb..0000000000 --- a/5.0/fr/0x94-Appendix-E_Contributors.md +++ /dev/null @@ -1,71 +0,0 @@ -# Appendix E - Contributeurs - -Nous remercions les personnes suivantes pour leurs contributions, leurs commentaires et leurs demandes d'extension depuis la publication de ASVS 4.0.0. - -Si vous avez connaissance d'erreurs ou si vous souhaitez que votre nom apparaisse différemment, merci de nous le faire savoir. - -| | | | | -|---|---|---|---| -| Johan Sydseter ([sydseter](https://github.com/sydseter)) | luis servin ([lfservin](https://github.com/lfservin)) | Oleksii Dovydkov ([oleksiidov](https://github.com/oleksiidov)) | IZUKA Masahiro ([maizuka](https://github.com/maizuka)) | -| James Sulinski ([jsulinski](https://github.com/jsulinski)) | Eli Saad ([ThunderSon](https://github.com/ThunderSon)) | [kkshitish9](https://github.com/kkshitish9) | Andrew van der Stock ([vanderaj](https://github.com/vanderaj)) | -| Rick M ([kingthorin](https://github.com/kingthorin)) | Bankde Eakasit ([Bankde](https://github.com/Bankde)) | Michael Gargiullo ([mgargiullo](https://github.com/mgargiullo)) | Raphael Dunant ([Racater](https://github.com/Racater)) | -| Cesar Kohl ([cesarkohl](https://github.com/cesarkohl)) | [inaz0](https://github.com/inaz0) | Joerg Bruenner ([JoergBruenner](https://github.com/JoergBruenner)) | David Deatherage ([securitydave](https://github.com/securitydave)) | -| John Carroll ([yosignals](https://github.com/yosignals)) | Jim Fenton ([jimfenton](https://github.com/jimfenton)) | Matteo Pace ([M4tteoP](https://github.com/M4tteoP)) | Sebastien gioria ([SPoint42](https://github.com/SPoint42)) | -| Steven van der Baan ([vdbaan](https://github.com/vdbaan)) | Jeremy Bonghwan Choi ([jeremychoi](https://github.com/jeremychoi)) | [craig-shony](https://github.com/craig-shony) | Riccardo Sirigu ([ricsirigu](https://github.com/ricsirigu)) | -| Tomasz Wrobel ([tw2as](https://github.com/tw2as)) | Alena Dubeshko ([belalena](https://github.com/belalena)) | Rafael Green ([RafaelGreen1](https://github.com/RafaelGreen1)) | [mjang-cobalt](https://github.com/mjang-cobalt) | -| [clallier94](https://github.com/clallier94) | Kevin W. Wall ([kwwall](https://github.com/kwwall)) | Jordan Sherman ([jsherm-fwdsec](https://github.com/jsherm-fwdsec) / [deleterepo](https://github.com/deleterepo)) | Ingo Rauner ([ingo-rauner](https://github.com/ingo-rauner)) | -| Dirk Wetter ([drwetter](https://github.com/drwetter)) | Moshe Zioni ([moshe-apiiro](https://github.com/moshe-apiiro)) | Patrick Dwyer ([coderpatros](https://github.com/coderpatros)) | David Clarke ([davidclarke-au](https://github.com/davidclarke-au)) | -| Takaharu Ogasa ([takaharuogasa](https://github.com/takaharuogasa)) | Arkadii Yakovets ([arkid15r](https://github.com/arkid15r)) | Motoyasu Saburi ([motoyasu-saburi](https://github.com/motoyasu-saburi)) | [leirn](https://github.com/leirn) | -| [wet-certitude](https://github.com/wet-certitude) | [timhemel](https://github.com/timhemel) | RL Thornton ([thornshadow99](https://github.com/thornshadow99)) | Thomas Bandt ([aspnetde](https://github.com/aspnetde)) | -| Roel Storms ([roelstorms](https://github.com/roelstorms)) | Jeroen Willemsen ([commjoen](https://github.com/commjoen)) | [anonymous-31](https://github.com/anonymous-31) | Kamran Saifullah ([deFr0ggy](https://github.com/deFr0ggy)) | -| Steve Springett ([stevespringett](https://github.com/stevespringett)) | Spyros ([northdpole](https://github.com/northdpole)) | Hans Herrera ([hansphp](https://github.com/hansphp)) | [Marx314](https://github.com/Marx314) | -| [CarlosAllendes](https://github.com/CarlosAllendes) | Yonah Russ ([yruss972](https://github.com/yruss972)) | Sander Maijers ([sanmai-NL](https://github.com/sanmai-NL)) | Luboš Bretschneider ([bretik](https://github.com/bretik)) | -| Eva Sarafianou ([esarafianou](https://github.com/esarafianou)) | Ata Seren [ataseren](https://github.com/ataseren) | Steve Thomas ([Sc00bz](https://github.com/Sc00bz)) | Dominique RIGHETTO ([righettod](https://github.com/righettod)) | -| Steven van der Baan ([svdb-ncc](https://github.com/svdb-ncc)) | Michael Vacarella ([Aif4thah](https://github.com/Aif4thah)) | Tonimir Kisasondi ([tkisason](https://github.com/tkisason)) | Stefan Streichsbier ([streichsbaer](https://github.com/streichsbaer)) | -| [hi-unc1e](https://github.com/hi-unc1e) | sb3k ([starbuck3000](https://github.com/starbuck3000)) | [mario-platt](https://github.com/mario-platt) | Devdatta Akhawe ([devd](https://github.com/devd)) | -| Michael Gissing ([scolytus](https://github.com/scolytus)) | Jet Anderson ([thatsjet](https://github.com/thatsjet)) | Dave Wichers ([davewichers](https://github.com/davewichers)) | Jonny Schnittger ([JonnySchnittger](https://github.com/JonnySchnittger)) | -| Silvia Väli ([silviavali](https://github.com/silviavali)) | [jackgates73](https://github.com/jackgates73) | [1songb1rd](https://github.com/1songb1rd) | Timur - ([timurozkul](https://github.com/timurozkul)) | -| Gareth Heyes ([hackvertor](https://github.com/hackvertor)) | [appills](https://github.com/appills) | [suvikaartinen](https://github.com/suvikaartinen) | chaals ([chaals](https://github.com/chaals)) | -| DanielPharos ([AtlasHackert](https://github.com/AtlasHackert)) | will Farrell ([willfarrell](https://github.com/willfarrell)) | Alina Vasiljeva ([avasiljeva](https://github.com/avasiljeva)) | Paul McCann ([ismisepaul](https://github.com/ismisepaul)) | -| Sage ([SajjadPourali](https://github.com/SajjadPourali)) | [rbsec](https://github.com/rbsec) | Benedikt Bauer ([mastacheata](https://github.com/mastacheata)) | James Jardine ([jamesjardine](https://github.com/jamesjardine)) | -| Mark Burnett ([m8urnett](https://github.com/m8urnett)) | [dschwarz91](https://github.com/dschwarz91) | Cyber-AppSec ([Cyber-AppSec](https://github.com/Cyber-AppSec)) | [Tib3rius](https://github.com/Tib3rius) | -| BitnessWise ([bitnesswise](https://github.com/bitnesswise)) | damienbod ([damienbod](https://github.com/damienbod)) | Jared Meit ([jmeit-fwdsec](https://github.com/jmeit-fwdsec)) | Stefan Seelmann ([sseelmann](https://github.com/sseelmann)) | -| Brendan O'Connor ([ussjoin](https://github.com/ussjoin)) | Andrei Titov ([andrettv](https://github.com/andrettv)) | Hans-Petter Fjeld ([atluxity](https://github.com/atluxity)) | [markehack](https://github.com/markehack) | -| Neil Madden ([NeilMadden](https://github.com/NeilMadden)) | Michael Geramb ([mgeramb](https://github.com/mgeramb)) | Osama Elnaggar ([ossie-git](https://github.com/ossie-git)) | [mackowski](https://github.com/mackowski) | -| Ravi Balla ([raviballa](https://github.com/raviballa)) | Hazana ([hazanasec](https://github.com/hazanasec)) | David Means ([dmeans82](https://github.com/dmeans82)) | Alexander Stein ([tohch4](https://github.com/tohch4)) | -| BaeSenseii ([baesenseii](https://github.com/baesenseii)) | Vincent De Schutter ([VincentDS](https://github.com/VincentDS)) | S Bani ([sbani](https://github.com/sbani)) | Mitsuaki Akiyama ([mak1yama](https://github.com/mak1yama)) | -| Christopher Loessl ([hashier](https://github.com/hashier)) | [victorxm](https://github.com/victorxm) | Michal Rada ([michalradacz](https://github.com/michalradacz)) | Veeresh Devireddy ([drveresh](https://github.com/drveresh)) | -| [MaknaSEO](https://github.com/MaknaSEO) | [darkzero2022](https://github.com/darkzero2022) | Liam ([LiamDobbelaere](https://github.com/LiamDobbelaere)) | Frank Denis ([jedisct1](https://github.com/jedisct1)) | -| Otto Sulin ([ottosulin](https://github.com/ottosulin)) | [carllaw6885](https://github.com/carllaw6885) | Anders Johan Holmefjord ([aholmis](https://github.com/aholmis)) | Richard Fritsch ([rfricz](https://github.com/rfricz)) | -| [mesutgungor](https://github.com/mesutgungor) | Scott Helme ([ScottHelme](https://github.com/ScottHelme)) | Carlo Reggiani ([carloreggiani](https://github.com/carloreggiani)) | Suyash Srivastava ([suyash5053](https://github.com/suyash5053)) | -| Mark Potter ([markonweb](https://github.com/markonweb)) | Arjan Lamers ([alamers](https://github.com/alamers)) | Gøran Breivik ([gobrtg](https://github.com/gobrtg)) | [flo-blg](https://github.com/flo-blg) | -| Guillaume Déflache ([guillaume-d](https://github.com/guillaume-d)) | Toufik Airane ([toufik-airane](https://github.com/toufik-airane)) | Keith Hoodlet ([securingdev](https://github.com/securingdev)) | Sinner ([SoftwareSinner](https://github.com/SoftwareSinner)) | -| [iloving](https://github.com/iloving) | Jeroen Beckers ([TheDauntless](https://github.com/TheDauntless)) | Joubin Jabbari ([joubin](https://github.com/joubin)) | yu fujioka ([fujiokayu](https://github.com/fujiokayu)) | -| execjosh ([execjosh](https://github.com/execjosh)) | Alicja Kario ([tomato42](https://github.com/tomato42)) | Sidney Ribeiro ([srjsoftware](https://github.com/srjsoftware)) | Gabriel Marquet ([Gby56](https://github.com/Gby56)) | -| Drew Schulz ([drschulz](https://github.com/drschulz)) | [bedirhan](https://github.com/bedirhan) | [muralito](https://github.com/muralito) | Ronnie Flathers ([ropnop](https://github.com/ropnop)) | -| Philippe De Ryck ([philippederyck](https://github.com/philippederyck)) | Malte ([mal33](https://github.com/mal33)) | [MazeOfThoughts](https://github.com/MazeOfThoughts) | Andreas Falk ([andifalk](https://github.com/andifalk)) | -| Javi ([javixeneize](https://github.com/javixeneize)) | Daniel Hahn ([averell23](https://github.com/averell23)) | [borislav-c](https://github.com/borislav-c) | Robin Wood ([digininja](https://github.com/digininja)) | -| [miro2ns](https://github.com/miro2ns) | Jan Dockx ([jandockx](https://github.com/jandockx)) | [vipinsaini434](https://github.com/vipinsaini434) | [priyanshukumar397](https://github.com/priyanshukumar397) | -| Nat Sakimura ([sakimura](https://github.com/sakimura)) | Benjamin Häublein ([BenjaminHae](https://github.com/BenjaminHae)) | [unknown-user-from](https://github.com/unknown-user-from) | Ali Ramazan TAŞDELEN ([alitasdln](https://github.com/alitasdln)) | -| Pedro Escaleira ([oEscal](https://github.com/oEscal)) | Josh ([josh-hemphill](https://github.com/josh-hemphill)) | Tim Würtele ([SECtim](https://github.com/SECtim)) | AviD ([avidouglen](https://github.com/avidouglen)) | -| SheHacksPurple ([shehackspurple](https://github.com/shehackspurple)) | [fcerullo-cycubix](https://github.com/fcerullo-cycubix) | Hector Eryx Paredes Camacho ([heryxpc](https://github.com/heryxpc)) | Irene Michlin ([irene221b](https://github.com/irene221b)) | -| Jonah Y-M ([TG-Techie](https://github.com/TG-Techie)) | Dhiraj Bahroos ([bahroos](https://github.com/bahroos)) | Jef Meijvis ([jefmeijvis](https://github.com/jefmeijvis)) | [IzmaDoesItbeta](https://github.com/IzmaDoesItbeta) | -| Abdessamad TEMMAR ([TmmmmmR](https://github.com/TmmmmmR)) | [sectroyer](https://github.com/sectroyer) | Soh Satoh ([sohsatoh](https://github.com/sohsatoh)) | [regoravalaz](https://github.com/regoravalaz) | -| james-t ([james-bitherder](https://github.com/james-bitherder)) | Aram Hovsepyan ([aramhovsepyan](https://github.com/aramhovsepyan)) | [JaimeGomezGarciaSan](https://github.com/JaimeGomezGarciaSan) | [ValdiGit01](https://github.com/ValdiGit01) | -| iwatachan ([ishowta](https://github.com/ishowta)) | Vinod Anandan ([VinodAnandan](https://github.com/VinodAnandan)) | Kevin Kien ([KevinKien](https://github.com/KevinKien)) | [paul-williamson-swoop](https://github.com/paul-williamson-swoop) | -| [endergzr](https://github.com/endergzr) | Radhwan Alshamamri ([Rado0z](https://github.com/Rado0z)) | Grant Ongers ([rewtd](https://github.com/rewtd)) | Cure53 ([cure53](https://github.com/cure53)) | -| [AliR2Linux](https://github.com/AliR2Linux) | Ads Dawson ([GangGreenTemperTatum](https://github.com/GangGreenTemperTatum)) | William Reyor ([BillReyor](https://github.com/BillReyor)) | gabe ([gcrow](https://github.com/gcrow)) | -| [mascotter](https://github.com/mascotter) | [luissaiz](https://github.com/luissaiz) | Suren Manukyan ([vx-sec](https://github.com/vx-sec)) | Piotr Gliźniewicz ([pglizniewicz](https://github.com/pglizniewicz)) | -| Tadeusz Wachowski ([tadeuszwachowski](https://github.com/tadeuszwachowski)) | Nasir aka Nate ([andesec](https://github.com/andesec)) | [settantasette](https://github.com/settantasette) | Lars Haulin ([LarsH](https://github.com/LarsH)) | -| Terence Eden ([edent](https://github.com/edent)) | [JasmineScholz](https://github.com/JasmineScholz) | Arun Sivadasan ([teavanist](https://github.com/teavanist)) | Yusuf GÜR ([yusuffgur](https://github.com/yusuffgur)) | -| Troy Marshall ([troymarshall](https://github.com/troymarshall)) | Tanner Prynn ([tprynn](https://github.com/tprynn)) | Nick K. ([nickific](https://github.com/nickific)) | [raoul361](https://github.com/raoul361) | -| Azeem Ilyas ([TheAxZim](https://github.com/TheAxZim)) | Evo Stamatov ([avioli](https://github.com/avioli)) | Tim Potter ([timpotter87](https://github.com/timpotter87)) | Gavin Ray ([GavinRay97](https://github.com/GavinRay97)) | -| monis ([demideus](https://github.com/demideus)) | Marcin Hoppe ([MarcinHoppe](https://github.com/MarcinHoppe)) | Grambulf ([ramshazar](https://github.com/ramshazar)) | Jordan Pike ([computersarebad](https://github.com/computersarebad)) | -| Jason Rogers ([jason-invision](https://github.com/jason-invision)) | Ben Hall ([benbhall](https://github.com/benbhall)) | JamesPoppyCock ([jamesly123](https://github.com/jamesly123)) | WhiteHackLabs ([whitehacklabs](https://github.com/whitehacklabs)) | -| Alex Gaynor ([alex](https://github.com/alex)) | Filip van Laenen ([filipvanlaenen](https://github.com/filipvanlaenen)) | [jeurgen](https://github.com/jeurgen) | [GraoMelo](https://github.com/GraoMelo) | -| Andreas Kurtz ([ay-kay](https://github.com/ay-kay)) | Tom Tervoort ([TomTervoort](https://github.com/TomTervoort)) | old man ([deveras](https://github.com/deveras)) | Marco Schnüriger ([marcortw](https://github.com/marcortw)) | -| [stiiin](https://github.com/stiiin) | infoseclearn ([teaminfoseclearn](https://github.com/teaminfoseclearn)) | [hljupkij](https://github.com/hljupkij) | Noe ([nmarher](https://github.com/nmarher)) | -| Lyz ([lyz-code](https://github.com/lyz-code)) | Martin Riedel ([mrtnrdl](https://github.com/mrtnrdl)) | KIM Jaesuck ([tcaesvk](https://github.com/tcaesvk)) | Barbara Schachner ([bschach](https://github.com/bschach)) | -| René Reuter ([AresSec](https://github.com/AresSec)) | [carhackpils](https://github.com/carhackpils) | Tyler ([tyler2cr](https://github.com/tyler2cr)) | Hugo ([hasousa](https://github.com/hasousa)) | -| Wouter Bloeyaert ([Someniak](https://github.com/Someniak)) | Mark de Rijk ([markderijkinfosec](https://github.com/markderijkinfosec)) | Ramin ([picohub](https://github.com/picohub)) | Philip D. Turner ([philipdturner](https://github.com/philipdturner)) | -| Will Chatham ([willc](https://github.com/willc)) | | | | diff --git a/5.0/ru/0x00-Header.yaml b/5.0/ru/0x00-Header.yaml deleted file mode 100644 index eb86984808..0000000000 --- a/5.0/ru/0x00-Header.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- - title: "Стандарт верификации требований к безопасности приложений" - subtitle: "Версия 5.0.0" - date: Май 2025 - titlepage: true - titlepage-rule-height: 0 - titlepage-logo: "images/owasp_logo_1c_notext.png" - table-use-row-colors: true - toc: true - toc-own-page: true - geometry: "left=2cm,right=2cm,top=3cm,bottom=3cm" - CJKmainfont: "Noto Sans CJK JP" - mainfont: "Source Serif 4" - sansfont: "Source Sans 3" ---- diff --git a/5.0/ru/0x01-Frontispiece.md b/5.0/ru/0x01-Frontispiece.md deleted file mode 100644 index 55578529a5..0000000000 --- a/5.0/ru/0x01-Frontispiece.md +++ /dev/null @@ -1,46 +0,0 @@ -# Фронтиспис - -## О стандарте - -Стандарт верификации требований к безопасности приложений — это перечень требований к безопасности приложений (тестов), которыми могут пользоваться архитекторы, разработчики, тестировщики, специалисты по безопасности, разработчики инструментов и конечные пользователи для проектирования, разработки, тестирования и контроля безопасных приложений. - -## Авторские права и лицензия - -Версия 5.0.0, май 2025 - -![лицензия](../images/license.png) - -Copyright © 2008-2025 The OWASP Foundation. - -Этот документ выпущен под [лицензией Creative Commons Attribution-ShareAlike 4.0 International](https://creativecommons.org/licenses/by-sa/4.0/). - -При воспроизведении или распространении этого документа необходимо разъяснить условия лицензии на него. - -## Руководители проекта - -| | | -|---------------------- |----------------- | -| Elar Lang | Josh C Grossman | -| Jim Manico | Daniel Cuthbert | - -## Рабочая группа - -| | | | | -|---------------- |------------------ |------------------- |----------------- | -| Tobias Ahnoff | Ralph Andalis | Ryan Armstrong | Gabriel Corona | -| Meghan Jacquot | Shanni Prutchi | Iman Sharafaldin | Eden Yardeni | - -## Основные участники - -| | | -|-------------------|-------------------| -| Sjoerd Langkemper | Isaac Lewis | -| Mark Carney | Sandro Gauci | - -## Другие участники и рецензенты - -Список остальных участников перечислен в Приложении E. - -Если Вы — участник проекта, но Вашего имени нет в приведенном выше списке, пожалуйста, зарегистрируйте issue на GitHub для признания в будущих обновлениях. - -Пятая версия стандарта верификации требований к безопасности приложений опирается на предыдущие версии ASVS, начиная с первой, вышедшей в 2008 году, и до четвертой, в 2019 году. Большая часть разделов оглавления и пунктов требований, до сих пор присутствующих в ASVS, изначально были написаны Эндрю ван дер Стоком, Майком Боберски, Джеффом Уильямсом и Дэйвом Уичерсом, но участников было гораздо больше - спасибо им всем. Полные списки всех, кто внес свой вклад в более ранние версии, есть в соответствующих версиях документа. diff --git a/5.0/ru/0x02-Preface.md b/5.0/ru/0x02-Preface.md deleted file mode 100644 index 4470b3236f..0000000000 --- a/5.0/ru/0x02-Preface.md +++ /dev/null @@ -1,29 +0,0 @@ -# Предисловие - -Добро пожаловать в Стандарт верификации требований к безопасности приложений (ASVS) версии 5.0 - -## Введение - -Изначально представленный в 2008 году совместными усилиями мирового сообщества, ASVS определяет исчерпывающий набор требований безопасности для проектирования, разработки и тестирования современных веб-приложений и сервисов. - -После выхода версии ASVS 4.0 в 2019 году и ее незначительного обновления (v4.0.3) в 2021 году, версия 5.0 является значительным шагом вперед — она была модернизирована, чтобы учесть последние достижения в области безопасности программного обеспечения. - -ASVS 5.0 стал результатом масштабного вклада руководителей проекта, членов рабочей группы и широкого сообщества OWASP, направленного на обновление и совершенствование этого важного стандарта. - -## Ключевые принципы версии 5.0 - -Эта масштабная редакция была разработана с учетом нескольких ключевых принципов: - -* Уточнение границ и целей: Данная версия стандарта была разработана для более точного соответствия основным принципам, отраженным в его названии: Приложение (Application), Безопасность (Security), Проверка (Verification), Стандарт (Standard). Требования были переформулированы - теперь они направлены на предотвращение недостатков безопасности, а не на обязательное применение конкретных технических решений. Тексты требований являются самодостаточными и поясняют свою необходимость. - -* Поддержка документирования решений по безопасности: ASVS 5.0 вводит требования к документированию ключевых решений по безопасности. Данный подход улучшает отслеживаемость решений и способствует контекстуально-ориентированным реализациям, предоставляя организациям возможность настраивать свою защиту в соответствии с индивидуальными требованиями и рисками. - -* Обновленные уровни: Несмотря на сохранение трехуровневой модели, определения уровней были пересмотрены для упрощения внедрения ASVS. Уровень 1 предназначен для начального этапа внедрения стандарта и обеспечивает базовый уровень защиты. Уровень 2 представляет собой комплексный набор стандартных практик безопасности. Уровень 3 охватывает расширенные требования для обеспечения повышенной гарантии безопасности. - -* Реструктуризированное и расширенное содержание: ASVS 5.0 включает приблизительно 350 требований, распределенных по 17 главам. Структура глав была переработана для большей ясности и удобства использования. Для облегчения перехода предоставлено двустороннее соответствие между версиями 4.0 и 5.0. - -## Взгляд в будущее - -Так же, как и обеспечение безопасности приложения никогда не может быть полностью завершено, работа над ASVS также никогда не прекращается. Несмотря на то, что версия 5.0 является крупным релизом, разработка стандарта продолжается. Данный выпуск позволяет сообществу воспользоваться преимуществами накопленных улучшений и дополнений, а также закладывает основу для будущего развития. Это может включать в себя инициативы сообщества по созданию руководств по внедрению и проверке, основанных на базовом наборе требований. - -ASVS 5.0 предназначен для того, чтобы служить надежной основой для разработки безопасного программного обеспечения. Сообществу предлагается применять этот стандарт, вносить в него свой вклад и развивать его, чтобы совместно двигать вперёд состояние безопасности приложений. diff --git a/5.0/ru/0x03-What-is-the-ASVS.md b/5.0/ru/0x03-What-is-the-ASVS.md deleted file mode 100644 index bc1d58331e..0000000000 --- a/5.0/ru/0x03-What-is-the-ASVS.md +++ /dev/null @@ -1,195 +0,0 @@ -# Что такое ASVS? - -Стандарт верификации требований к безопасности приложений (ASVS) определяет требования безопасности для веб-приложений и сервисов, представляя собой ценный ресурс для всех, кто стремится проектировать, разрабатывать и поддерживать безопасные приложения или оценивать их уровень защищённости. - -В этой главе описываются ключевые аспекты применения ASVS, включая его область действия, структуру уровней, основанных на приоритетах, и основные сценарии использования стандарта. - -## Область действия ASVS - -Область действия ASVS определяется его названием: Приложение (Application), Безопасность (Security), Верификация (Verification) и Стандарт (Standard). Он устанавливает, какие требования включены в стандарт, а какие — исключены из него, с глобальной целью определения основополагающих принципов безопасности, которые должны быть достигнуты. Область действия также учитывает требования к документации, которые служат основой для требований к реализации. - -Не существует такого понятия, как «область действия» для злоумышленника. Поэтому требования ASVS должны оцениваться в совокупности с рекомендациями по другим аспектам жизненного цикла приложения, включая процессы CI/CD, хостинг и операционную деятельность. - -### Приложение - -ASVS определяет «Приложение» как разрабатываемый программный продукт, в который должны быть интегрированы механизмы безопасности. ASVS не регламентирует процессы жизненного цикла разработки и не указывает на методы сборки приложения в CI/CD. Его задача — описать требуемый уровень защищённости, который должен быть достигнут в конечном продукте. - -Компоненты для обработки HTTP-трафика (WAF, балансировщики нагрузки, прокси) могут считаться частью приложения в контексте безопасности, поскольку некоторые механизмы безопасности напрямую зависят от них или могут быть реализованы с их помощью. Это касается требований по кешированию, rate limiting, а также фильтрации входящих/исходящих подключений по источнику и получателю. - -В свою очередь, ASVS не включает требования, не относящиеся к приложению напрямую или находящиеся за пределами его зоны ответственности. Так, например, проблемы DNS обычно относятся в ведении отдельной команды или функции. - -Аналогично, хотя в зону ответственности приложения входит обработка входящих данных и генерация исходящих данных, если внешний процесс взаимодействует с приложением или его данными, это считается выходящим за рамки ASVS. Например, резервное копирование приложения или его данных обычно выполняется внешними процессами и не контролируется самим приложением или его разработчиками. - -### Безопасность - -Каждое требование должно иметь очевидное влияние на безопасность. Отсутствие требования должно привести к снижению уровня защищённости приложения, а реализация требования должна либо уменьшить вероятность возникновения риска безопасности, либо смягчить последствия. - -Все прочие аспекты, такие как функциональные характеристики, стиль кода или требования политик, выходят за рамки стандарта. - -### Верификация - -Требование должно быть верифицируемым, а его проверка должна приводить к однозначному решению: «не выполнено» или «выполнено». - -### Стандарт - -ASVS представляет собой набор требований безопасности, которые необходимо реализовать для соответствия стандарту. Это означает, что требования ограничиваются определением целевого показателя безопасности, которого необходимо достичь. Прочая сопутствующая информация может быть надстроена на основе ASVS или связана с ним через сопоставления. - -В частности, в рамках OWASP существует множество проектов, и ASVS намеренно избегает дублирования содержания других проектов. Например, у разработчиков может возникнуть вопрос: «как мне реализовать конкретное требование в моем технологическом стеке или окружении?» — на него должен отвечать проект Cheat Sheet Series. У тестировщиков может возникнуть вопрос: «как мне проверить это требование в данном окружении?» — на него должен отвечать проект Web Security Testing Guide. - -Хотя ASVS предназначен не только для специалистов по безопасности, он ожидает, что читатель обладает техническими знаниями для понимания содержания или способен самостоятельно изучить конкретные концепции. - -### Требование - -Слово «Требование» специально используется в ASVS, поскольку оно описывает обязательное условие, которое должно быть достигнуто для его выполнения. ASVS содержит только требования (обязательные к выполнению) и не содержит рекомендаций. - -Другими словами, рекомендации, независимо от того, являются ли они лишь одним из многих возможных вариантов для решения проблем или вопросов стиля кода, не удовлетворяют определению требования. - -Требования ASVS определяют цели безопасности, не привязываясь к конкретным технологиям или методам реализации. Их назначение понятно из самого текста, и они не предписывают, как именно следует проводить проверку. - -### Документированные решения по безопасности - -В области безопасности программного обеспечения заблаговременное планирование архитектуры безопасности и защитных механизмов позволяет добиться более последовательной и предсказуемой реализации в конечном продукте или функции. - -Кроме того, некоторые требования сложны в реализации и зависят от специфики приложения. Например, система прав доступа, проверка вводимых данных и защита данных с разной степенью чувствительности. - -Чтобы учесть это, вместо общих формулировок, таких как «все данные должны быть зашифрованы», или попыток охватить каждый возможный случай в требовании, были включены требования к документации. Они предписывают, чтобы подход и конфигурация, выбранные разработчиком приложения для механизмов управления, были задокументированы. Это позволяет провести оценку целесообразности подхода, а затем сравнить фактическую реализацию с документацией, чтобы оценить, соответствует ли реализация ожиданиям. - -Задача этих требований — фиксировать решения, которые организация-разработчик приняла в отношении того, каким образом реализовать определенные требования безопасности. - -Требования к документации всегда размещаются в первом разделе главы (хотя присутствуют не в каждой из них), и каждое из них всегда связано с соответствующим требованием к реализации, в рамках которого документированные решения должны быть воплощены на практике. Ключевая идея заключается в том, что проверка наличия документации и проверка фактической реализации — это два самостоятельных вида деятельности. - -Существует две ключевые причины для включения этих требований. Первая причина заключается в том, что требование информационной безопасности часто предполагает принудительное применение правил, например, какие типы файлов разрешены для загрузки, какие бизнес-контроли должны быть реализованы, какие символы допустимы для конкретного поля. Эти правила уникальны для каждого приложения и поэтому ASVS не может предписать, какими они должны быть. Ни чек-лист, ни развернутое руководство в данном случае не будут полезны. Также, если эти решения не документированы, то невозможно проверить реализацию на соответствие требованиям. - -Вторая причина заключается в необходимости обеспечить гибкость для разработчиков приложения в выборе подходов к решению отдельных вопросов безопасности. Например, в прошлых версиях ASVS ограничения времени жизни сессии были строго фиксированы. На практике многие приложения, особенно ориентированные на прямое взаимодействие с потребителями, применяют более мягкие правила, отдавая предпочтение иным компенсирующим механизмам защиты. Таким образом, настоящие требования к документации прямо разрешают такую гибкость. - -Очевидно, что предполагается, что подобные решения будут приниматься и документироваться не отдельными разработчиками, а организацией в целом. На организацию возлагается ответственность за принятие данных решений, доведение их до сведения разработчиков и обеспечение их соблюдения. - -Предоставление разработчикам спецификаций и проектов новых функций является стандартной практикой в процессе разработки программного обеспечения. Аналогичным образом, от разработчиков ожидается использование общепринятых компонентов и механизмов пользовательского интерфейса, а не принятие самостоятельных решений каждый раз. Таким образом, распространение данного подхода на безопасность не должно восприниматься как нечто удивительное или спорное. - -Кроме того, существует гибкость в выборе способа достижения данной цели. Решения в области безопасности могут быть документированы в виде явного документа, с которым разработчики обязаны знакомиться. Альтернативно, эти решения могут быть документированы и реализованы в рамках общей библиотеки, которую все разработчики обязаны использовать. Результат достигается в обоих случаях. - -## Уровни соответствия ASVS - -Стандарт верификации требований к безопасности приложений определяет три уровня соответствия, каждый из которых усиливает требования предыдущего. Рекомендуемый подход для организаций — начинать с первого уровня для митигации наиболее критичных рисков безопасности с последующим переходом на более высокие уровни в зависимости от конкретных потребностей приложения и организации. В документации и требованиях используются сокращения L1, L2 и L3. - -Каждый уровень соответствия определяет требования безопасности, которые необходимо выполнить для его достижения. Требования же вышестоящих уровней носят рекомендательный характер. - -Во избежание дублирования требований или наличия требований, теряющих актуальность на более высоких уровнях, некоторые из них применяются к конкретному уровню, но предусматривают более строгие условия для последующих уровней. - -### Оценка уровней соответствия - -Уровни соответствия определяются путём приоритизационной оценки каждого требования, основанной на опыте их внедрения и тестирования. Основное внимание уделяется сопоставлению снижения рисков с усилиями по реализации требования. Другим ключевым фактором является сохранение низкого порога вхождения. - -Оценка снижения риска рассматривает, насколько требование уменьшает уровень риска безопасности в приложении. При этом принимаются во внимание классические факторы воздействия на Конфиденциальность, Целостность и Доступность, а также то, является ли данное требование основным рубежом обороны или же оно рассматривается как элемент эшелонированной защиты. - -В результате тщательных обсуждений как самих критериев, так и решений по отнесению их к уровням соответствия, была выработана классификация, которая должна оставаться справедливой для подавляющего большинства случаев, при этом допуская, что она не может быть универсальной для всех ситуаций. Это означает, что в отдельных случаях организации могут пожелать отдать приоритет требованиям более высокого уровня ранее, основываясь на собственной оценке рисков. - -Требования на каждом уровне можно охарактеризовать следующим образом: - -### Уровень 1 - -Данный уровень содержит минимальный набор требований для обеспечения безопасности приложения, и представляет собой критически важную отправную точку. На этот уровень приходится около 20% требований ASVS. Цель этого уровня — иметь как можно меньше требований для снижения порога вхождения. - -Эти требования, как правило, являются критически важными или базовыми, представляя собой первый рубеж защиты от распространённых атак, для эксплуатации которых не требуется наличия других уязвимостей или предварительных условий. - -Помимо требований первого рубежа защиты, некоторые требования имеют меньшее значение на более высоких уровнях, например, требования, связанные с паролями. Они более важны для первого уровня, поскольку, начиная с более высоких уровней становятся актуальными требования многофакторной аутентификации. - -Первый уровень не обязательно поддаётся полноценному тестированию на проникновение внешним специалистом без доступа ко внутренней документации или коду (например, при тестировании по методу «чёрного ящика»), хотя меньшее количество требований должно упростить процесс верификации. - -### Уровень 2 - -Большинству приложений следует стремиться к достижению данного уровня безопасности. На Уровень 2 (L2) приходится около 50% требований ASVS, что означает, что приложению необходимо реализовать порядка 70% требований ASVS (все требования уровней L1 и L2) для соответствия этому уровню. - -Эти требования, как правило, связаны либо с менее распространёнными атаками, либо с более сложными механизмами защиты от распространённых атак. Они могут по-прежнему представлять собой первый рубеж обороны, либо же для успешной атаки могут требоваться определённые предварительные условия. - -### Уровень 3 - -Данный уровень должен быть целью для приложений, стремящихся продемонстрировать наивысший уровень защищённости, и содержит оставшиеся ~30% требований для полного соответствия. - -Требования в данном разделе, как правило, представляют собой либо механизмы глубокой эшелонированной обороны (defense-in-depth), либо иные полезные, но сложные в реализации средства контроля. - -### Какого уровня следует достичь - -Уровни, основанные на приоритетах, призваны отражать степень зрелости системы безопасности организации и приложения. Вместо того, чтобы предписывать, какого уровня должно достигать приложение, ASVS предлагает организации проанализировать свои риски и самостоятельно определить целевой уровень, исходя из критичности приложения и, конечно же, ожиданий его пользователей. - -Например, стартап на ранней стадии, собирающий лишь ограниченный объём конфиденциальных данных, может принять решение сфокусироваться на первом уровне на начальном этапе. В то же время банк не сможет объяснить клиентам выбор уровня ниже, чем Уровень 3, для своего онлайн банковского приложения. - -## Как применять этот стандарт - -### Структура ASVS - -ASVS состоит в общей сложности из приблизительно 350 требований, которые разделены на 17 глав. Каждая глава, в свою очередь, делится на разделы. - -Цель такого деления на главы и разделы — упростить выбор или исключение соответствующих глав и разделов в зависимости от релевантности для конкретного приложения. Например, требования главы V3, касающиеся веб-интерфейсов, не будут актуальны в случае API для межмашинного взаимодействия. Если в системе не используется OAuth или WebRTC, то соответствующие главы также могут быть проигнорированы. - -### Стратегия выпусков - -Выпуски ASVS следуют схеме "Major.Minor.Patch", где номера версий указывают на характер изменений в выпуске. При мажорном выпуске изменяется первое число, при минорном — второе, а при патче — третье. - -* Мажорный выпуск (Major release) — Полная реорганизация. Могут быть изменены практически все элементы, включая нумерацию требований. Для подтверждения соответствия потребуется проведение повторной оценки (например, переход с версии 4.0.3 на 5.0.0). -* Минорный выпуск (Minor release) — Требования могут добавляться или удаляться, но общая структура нумерации остаётся прежней. Для подтверждения соответствия потребуется повторная оценка, но она должна быть проще (например, переход с версии 5.0.0 на 5.1.0). -* Выпуск патча (Patch release) — Требования могут быть удалены (например, если они являются дубликатами или устарели) или смягчены. Приложение, соответствовавшее предыдущему выпуску, будет соответствовать и патч-выпуску (например, переход с версии 5.0.0 на 5.0.1). - -Вышеизложенное относится только к самим требованиям. Изменения в пояснительных текстах и приложениях не являются критическими. - -### Гибкость использования ASVS - -Ряд рассмотренных принципов (например, требования к документации и система уровней) предоставляет возможность применять ASVS гибко, с учётом специфики организации. - -Кроме того, организациям настоятельно рекомендуется создавать специализированные ответвления (форки) стандарта, адаптированные для организации или домена, которые корректируют требования исходя из специфических характеристик и уровней риска их приложений. Однако важно сохранять прослеживаемость (traceability), чтобы соответствие требованию, например, 4.1.1, означало одно и то же во всех версиях. - -В идеале, каждой организации следует создавать собственную адаптированную версию ASVS, исключая нерелевантные разделы (например, GraphQL, WebSockets, SOAP, если они не используются). Версия ASVS, адаптированная под организацию, или дополнение к ней также является хорошим способом предоставить специфичные для организации руководства по реализации, уточняя библиотеки или ресурсы, которые следует использовать для выполнения требований. - -### Как ссылаться на требования ASVS - -Каждое требование имеет идентификатор в формате `.
.` где каждый элемент является числом, например: `1.11.3`. - -* Значение `` соответствует главе, в которой находится это требование, например: все требования `1.#.#` находятся в главе 'Архитектура кодировки и нейтрализации'. -* Значение `
` соответствует разделу в этой главе, где находится это требование; например, все требования `1.2.#` находятся в разделе 'Предотвращение инъекций' главы 'Архитектура кодировки и нейтрализации'. -* Значение `` указывает на конкретное требование в главе и разделе, например, `1.2.5`, которым в версии 5.0.0 этого стандарта является: - -> Убедитесь, что приложение защищено от внедрения команд ОС и что вызовы операционной системы используют параметризованные запросы к ОС или используют контекстное кодирование вывода командной строки. - -Идентификаторы требований могут меняться от версии к версии, поэтому желательно, чтобы другие документы, отчеты или инструменты использовали формат: `v-.
.`, где: 'version' это метка версии ASVS. Например: `v5.0.0-1.2.5` будет означать 5-е требование в разделе 'Предотвращение инъекций' главы 'Архитектура кодировки и обработки' в версии 5.0.0. (Резюмируя, `v-`.) - -Примечание. Буква `v`, предшествующая версии, должна быть в нижнем регистре. - -Считается, что если идентификаторы указаны без элемента `v`, то они относятся к последней версии стандарта. По мере развития и изменения стандарта это станет проблематичным, поэтому авторы и разработчики должны включать элемент версии. - -Списки требований ASVS доступны в форматах CSV, JSON и других, которые могут оказаться полезными для справки или использования в программах. - -### Создание ответвлений ASVS - -Организации могут извлечь пользу из применения ASVS, выбрав один из трёх уровней или создав предметно-ориентированное ответвление (fork), которое адаптирует требования в соответствии с уровнем риска каждого приложения. Такой подход настоятельно рекомендуется при условии сохранения прослеживаемости (traceability), чтобы соответствие требованию, например, 4.1.1, означало одно и то же во всех версиях. - -В идеале каждой организации следует создать собственную адаптированную версию ASVS, исключая нерелевантные разделы (например, GraphQL, WebSockets, SOAP, если они не используются). Создание ответвления следует начинать с использования ASVS Уровня 1 в качестве базового, с последующим переходом на Уровни 2 или 3 в зависимости от рисков, присущих приложению. - -## Сценарии применения ASVS - -ASVS может быть использован для оценки безопасности приложения, и этот вопрос более глубоко исследуется в следующей главе. Тем не менее, был выявлен ряд других потенциальных вариантов использования ASVS (или его модифицированной версии). - -### Как подробное руководство по архитектуре безопасности - -Одним из наиболее распространенных вариантов использования Стандарта верификации требований к безопасности приложений является его применение в качестве ресурса для архитекторов безопасности. В настоящее время существует ограниченное количество материалов о том, как построить безопасную архитектуру современного приложения. ASVS может быть использован для восполнения этих пробелов, позволяя архитекторам безопасности выбирать более эффективные меры для решения распространенных проблем, таких как шаблоны защиты и стратегии валидации входных данных. Требования, связанные с архитектурой и документацией, будут особенно полезны для этой цели. - -### Как специализированное руководство по безопасной разработке - -ASVS может быть использован как основа для подготовки руководства по безопасной разработке в процессе разработки приложения, помогая разработчикам не упускать из виду аспекты безопасности при создании программного обеспечения. Хотя ASVS может служить основой, организациям следует подготовить свои собственные конкретные руководства, которые являются четкими и унифицированными, и в идеале их следует составлять на основе рекомендаций инженеров или архитекторов безопасности. В развитие этого подхода организациям настоятельно рекомендуется, по возможности, подготовить одобренные механизмы безопасности и библиотеки, на которые можно ссылаться в руководствах и которые разработчики могут использовать. - -### Как руководство по автоматизированному модульному и интеграционному тестированию - -ASVS создавался таким, чтобы его можно было легко протестировать. Некоторые проверки носят технический характер, в то время как другие требования могут потребовать анализа документации или архитектуры. Благодаря модульным и интеграционным тестам, которые проверяют характерные случаи фаззинга и недокументированного использования, связанных с требованиями, поддающимися технической верификации, можно упростить проверку корректности работы этих контролей при каждой сборке. Например, для набора тестов для контроллера входа в систему можно разработать дополнительные тесты, проверяющие атрибут username на совпадение с наиболее распространенными именами пользователей по умолчанию, перебор учетных записей, LDAP- и SQL-инъекции, а также XSS. Аналогично, проверка атрибута password должна включать перебор самых распространенных паролей, оценку длины пароля, вставку нулевого байта, удаление этого атрибута, XSS и многое другое. - -### Как курс по безопасной разработке - -ASVS также можно использовать для определения характеристик защищенного программного обеспечения. Многие «курсы безопасной разработки» — это просто курсы по этичному хакингу с легким намеком на советы по безопасной разработке. Не факт, что это как-то поможет разработчикам писать более безопасный код. Вместо этого курсы по безопасной разработке должны делать упор на упреждающие меры из ASVS, а не на список того, чего делать не стоит (OWASP Top 10). Структура ASVS также предоставляет логичную основу для последовательного изучения различных тем, связанных с защитой приложения. - -### Как руководство по приобретению безопасного программного обеспечения - -ASVS — это отличное руководство по приобретению безопасного программного обеспечения или заказных услуг по его разработке. Заказчику достаточно указать требование, что программное обеспечение, которое он хочет приобрести, должно быть разработано на уровне ASVS LX, и потребовать, чтобы Исполнитель доказал, что оно ему соответствует. - -## Применение ASVS на практике - -Разные угрозы имеют разную мотивацию. В отдельных отраслях имеются уникальные информационные и технологические ресурсы или отраслевые регуляторные требования. - -Организациям настоятельно рекомендуется внимательно изучить риски, присущие характеру их бизнеса, и на их основе, и с учетом бизнес-требований определить соответствующий уровень ASVS. diff --git a/5.0/ru/0x04-Assessment_and_Certification.md b/5.0/ru/0x04-Assessment_and_Certification.md deleted file mode 100644 index 1edc5c19f8..0000000000 --- a/5.0/ru/0x04-Assessment_and_Certification.md +++ /dev/null @@ -1,47 +0,0 @@ -# Оценка и сертификация - -## Позиция OWASP в отношении сертификатов и знаков доверия ASVS - -OWASP, будучи независимой от поставщиков некоммерческой организацией, не сертифицирует разработчиков, аудиторов или программное обеспечение. Любые заверения, знаки доверия или сертификаты, претендующие на соответствие ASVS, официально не поддерживаются OWASP, поэтому организации должны проявлять осторожность в заявлении третьих сторон о сертификации по ASVS. - -Организации могут предлагать услуги по предоставлению гарантий соответствия при условии, что они не претендуют на официальную сертификацию OWASP. - -## Как проверять соответствие ASVS - -Стандарт намеренно не предписывает конкретные методы проверки соответствия на уровне руководства по тестированию. Тем не менее, важно выделить некоторые ключевые моменты. - -### Отчет о проверке - -Традиционные отчёты о тестировании на проникновение фиксируют только неудачные проверки. Однако отчёт о проверке соответствия ASVS должен включать в себя область исследования, сводку всех проверяемых требований, а также требования, по которым были отмечены исключения, и руководство по устранению выявленных проблем. Некоторые требования могут быть неприменимы (например, управление сессиями в stateless API), и это должно быть явно указано в отчёте. - -### Область исследования - -Организация, разрабатывающая приложение, как правило, реализует не все требования, поскольку некоторые из них могут быть нерелевантными или менее значимыми исходя из функциональности приложения. Аудитор должен чётко определить область проверки, включая то, какого уровня соответствия пытается достичь организация и какие требования были включены в оценку. Это должно быть представлено с точки зрения того, что было включено, а не того, что было исключено. Кроме того, аудитор должен предоставить заключение с обоснованием причин исключения требований, которые не были реализованы. - -Это должно позволить заказчику отчёта о проверке понять контекст проведённого исследования и принять взвешенное решение о том, какой уровень доверия может быть предоставлен приложению. - -Сертифицирующие организации могут выбирать свои методы тестирования, но должны раскрывать их в отчёте и в идеале эти методы должны быть воспроизводимыми. Для проверки различных аспектов (таких как валидация входных данных) в зависимости от приложения и конкретных требований могут использоваться разные методы, например, ручное тестирование на проникновение или анализ исходного кода. - -### Методы тестирования - -Для верификации конкретных требований ASVS может потребоваться применение ряда различных методик. Помимо тестирования на проникновение (с использованием действительных учётных данных для обеспечения полного охвата приложения), проверка соответствия требованиям ASVS может потребовать доступа к документации, исходному коду, конфигурациям, а также к лицам, причастным к процессу разработки. Это особенно актуально для верификации требований Уровней 2 и 3. Стандартной практикой является предоставление убедительных доказательств обнаруженных недостатков с подробным документированием, которое может включать записи тестировщика, скриншоты, скрипты и журналы тестирования. Простого запуска автоматизированного инструмента недостаточно для сертификации, поскольку каждое требование должно быть тщательно протестировано. - -Использование средств автоматизации для верификации требований ASVS — это тема, которая неизменно вызывает значительный интерес. В связи с этим важно прояснить некоторые моменты, связанные с автоматизированным тестированием и тестированием по методу «чёрного ящика». - -#### Роль инструментов автоматизированного тестирования безопасности - -Когда автоматизированные инструменты динамического и статического анализа безопасности приложений (DAST и SAST) корректно интегрированы в pipeline сборки, они могут выявлять некоторые проблемы безопасности, которые не должны существовать в принципе. Однако без тщательной конфигурации и настройки они не обеспечат необходимый охват, а большое количество ложных срабатываний помешает выявлению и устранению реальных проблем безопасности. - -Хотя это может обеспечить покрытие некоторых более базовых и простых технических требований, относящихся к кодированию или нейтрализации выходных данных, крайне важно отметить, что эти инструменты неспособны в полной мере проверить многие из более сложных требований ASVS или тех, что связаны с бизнес-логикой и контролем доступа. - -Что касается менее тривиальных требований, вероятно, что автоматизацию всё же можно задействовать, однако для этого потребуется написание специфичных для приложения проверок. Они могут быть аналогичны модульным и интеграционным тестам, которые организация, возможно, уже использует. Следовательно, может оказаться возможным использовать существующую инфраструктуру автоматизации тестирования для создания этих специализированных тестов под требования ASVS. Хотя для этого потребуются краткосрочные инвестиции, долгосрочные преимущества, связанные с возможностью постоянной верификации этих требований ASVS, будут значительными. - -Подводя итог, автоматизированное тестирование != запуску стандартного инструмента «из коробки». - -#### Роль тестирования на проникновение - -Несмотря на то, что Уровень 1 (L1) в версии 4.0 был оптимизирован для проведения тестирования по методу «чёрного ящика» (без доступа к документации и исходному коду), даже в то время стандарт четко давал понять, что это не является эффективной деятельностью, гарантирующей соответствие, и такой подход не следует активно применять. - -Тестирование без доступа к необходимой дополнительной информации является неэффективным и малорезультативным, поскольку при этом упускается возможность проверки исходного кода, выявления угроз и отсутствующих мер защиты, а также выполнения гораздо более тщательного тестирования в более короткие сроки. - -Настоятельно рекомендуется проводить тестирование на проникновение, основанное на изучении документации и исходного кода (гибридный подход), в ходе которого тестировщики имеют полный доступ к разработчикам приложения и его документации, в отличие от традиционного тестирования на проникновение. Этот подход будет необходимым для верификации многих требований ASVS. diff --git a/5.0/ru/0x05-For-Users-Of-4.0.md b/5.0/ru/0x05-For-Users-Of-4.0.md deleted file mode 100644 index bd02aecb2d..0000000000 --- a/5.0/ru/0x05-For-Users-Of-4.0.md +++ /dev/null @@ -1,90 +0,0 @@ -# Изменения по сравнению с v4.x - -## Введение - -Пользователям, знакомым со стандартом версии 4.x, может быть полезно ознакомиться с ключевыми изменениями, внесёнными в версию 5.0, включая обновления в содержании, области применения и основополагающей философии. - -Из 286 требований версии 4.0.3 только 11 остались без изменений, в то время как 15 претерпели незначительные грамматические правки, не повлиявшие на их смысл. В общей сложности 109 требований (38%) более не являются отдельными требованиями в версии 5.0 – 50 были просто удалены, 28 удалены как дубликаты и 31 объединено с другими требованиями. Остальные требования были так или иначе пересмотрены. Даже требования, не претерпевшие существенных изменений, имеют новые идентификаторы из-за переупорядочивания или реструктуризации. - -Для облегчения перехода на версию 5.0 предоставляются документы сопоставления, которые помогают пользователям отследить, как требования из версии 4.x соотносятся с требованиями в версии 5.0. Эти сопоставления не привязаны к версиям выпусков и могут при необходимости обновляться или уточняться. - -## Философия требований - -### Целевая область применения - -Версия 4.x включала требования, которые не соответствовали целевой области применения стандарта - они были удалены. Требования, которые не удовлетворяли критериям области применения для версии 5.0 или не поддавались верификации, также были исключены. - -### Акцент на целях безопасности, а не на механизмах - -В версии 4.x многие требования были сфокусированы на конкретных механизмах, а не на лежащих в их основе целях безопасности. В версии 5.0 требования сконцентрированы на целях безопасности, ссылаясь на конкретные механизмы только в тех случаях, когда они являются единственным практическим решением, или предоставляя их в качестве примеров или дополнительного руководства. - -Такой подход допускает разные методы достижения цели, избегая излишних предписаний, которые могли бы ограничить гибкость компаний. - -Кроме того, требования, касающиеся одной и той же проблемы безопасности, были объединены там, где это было необходимо. - -### Документированные решения по безопасности - -Хотя концепция документированных решений по безопасности может показаться новой в версии 5.0, она является развитием более ранних требований, связанных с применением политик и моделированием угроз в версии 4.0. Ранее некоторые требования неявно предполагали проведение анализа для обоснования реализации средств контроля безопасности, такого как определение разрешенных сетевых подключений. - -Чтобы обеспечить доступность необходимой информации для реализации и проверки, эти ожидания теперь явно определены как требования к документации, делая их понятными, практичными и проверяемыми. - -## Структурные изменения и новые главы - -Несколько глав в версии 5.0 представляют полностью новый контент: - -* OAuth и OIDC – Учитывая широкое распространение этих протоколов для делегирования доступа и единого входа, были добавлены специальные требования для решения разнообразных сценариев, с которыми могут столкнуться разработчики. Эта область может в конечном итоге развиться в самостоятельный стандарт, аналогично тому, как это произошло с требованиями для мобильных устройств и IoT в предыдущих версиях. -* WebRTC – Поскольку эта технология набирает популярность, ее уникальные проблемы и аспекты безопасности теперь рассматриваются в отдельном разделе. - -Также были приложены усилия, чтобы обеспечить организацию глав и разделов вокруг логичных наборов связанных требований. - -Эта реструктуризация привела к созданию дополнительных глав: - -* Автономные токены (Self-contained Tokens) – Ранее относящиеся к управлению сессиями, автономные токены теперь признаны самостоятельным механизмом и базовым элементом для взаимодействия без сохранения состояния (такого как в OAuth и OIDC). Ввиду их уникальных аспектов безопасности, они рассматриваются в отдельной главе с некоторыми новыми требованиями, введенными в версии 5.x. -* Безопасность веб-интерфейсов (Web Frontend Security) – В связи с растущей сложностью браузерных приложений и распространением API-ориентированных архитектур, требования к безопасности фронтенда были выделены в отдельную главу. -* Безопасная разработка и архитектура (Secure Coding and Architecture) – Новые требования, касающиеся общих практик безопасности, которые не вписывались в существующие главы, были сгруппированы здесь. - -Другие организационные изменения в версии 5.0 были внесены для уточнения целей. Например, требования к валидации входных данных были помещены рядом с бизнес-логикой, а не с кодировкой и обработкой, отражая их роль в обеспечении соблюдения бизнес-правил. - -Бывшая глава V1 «Архитектура, проектирование и моделирование угроз» была удалена. Ее начальный раздел содержал требования, которые выходили за рамки области проверки, в то время как последующие разделы были перераспределены в соответствующие главы, с удалением дубликатов и уточнениями по мере необходимости. - -## Удаление прямых соответствий с другими стандартами - -Прямые соответствия другим стандартам были удалены из основного тела стандарта. Цель состоит в подготовке соответствия с проектом OWASP Common Requirement Enumeration (CRE), который, в свою очередь, свяжет ASVS с рядом проектов OWASP и внешними стандартами. - -Прямые соответствия CWE и NIST более не поддерживаются, как поясняется ниже. - -### Снижение связи с NIST Digital Identity Guidelines - -Рекомендации NIST [Digital Identity Guidelines (SP 800-63)](https://pages.nist.gov/800-63-3/) долгое время служили ориентиром для средств контроля аутентификации и авторизации. В версии 4.x определенные главы были тесно связаны со структурой и терминологией NIST. - -Хотя эти рекомендации остаются важным ориентиром, строгое соответствие создавало проблемы, включая менее распространенную терминологию, дублирование схожих требований и неполные соответствия. Версия 5.0 отходит от этого подхода для повышения ясности и релевантности. - -### Отступление от Common Weakness Enumeration (CWE) - -[Common Weakness Enumeration (CWE)](https://cwe.mitre.org/) предоставляет полезную систематику уязвимостей программного обеспечения. Однако такие проблемы, как широкие классы CWЕ (category-only CWEs), трудности в сопоставлении требований с отдельным CWE, а также наличие неточных соответствий в версии 4.x, привели к решению отказаться от прямых сопоставлений с CWE в версии 5.0. - -## Переосмысление определений уровней - -Версия 4.x описывала уровни как L1 («Минимальный»), L2 («Стандартный») и L3 («Продвинутый»), с подразумеванием, что все приложения, обрабатывающие конфиденциальные данные, должны соответствовать как минимум L2. - -Версия 5.0 решает несколько проблем этого подхода, которые описаны в следующих параграфах. - -С практической точки зрения, в то время как версия 4.x использовала галочки для обозначения уровней, версия 5.x использует простое число во всех форматах стандарта, включая markdown, PDF, DOCX, CSV, JSON и XML. Для обратной совместимости также генерируются устаревшие версии выводов CSV, JSON и XML, которые все еще используют галочки. - -### Снижение порога входа - -Обратная связь показала, что большое количество требований Уровня 1 (~120) в сочетании с его обозначением как «минимального» уровня, которого недостаточно для большинства приложений, препятствовало внедрению. Цель версии 5.0 — уменьшить этот барьер за счет определения требований Уровня 1 как первого эшелона защиты, благодаря чему они становятся более четкими и их количество сокращается. Чтобы продемонстрировать это численно, в v4.0.3 было 128 требований L1 из общего числа в 278 требований, что составляет 46%. В 5.0.0 насчитывается 70 требований L1 из общего числа в 345 требований, что составляет 20%. - -### Иллюзия проверяемости - -Ключевым фактором при выборе средств контроля для Уровня 1 в версии 4.x была их пригодность для оценки с помощью внешнего тестирования на проникновение по методу «черного ящика». Однако этот подход не был полностью согласован с целью Уровня 1 как минимального набора средств обеспечения безопасности. Некоторые пользователи утверждали, что Уровня 1 недостаточно для защиты приложений, в то время как другие считали его слишком сложным для тестирования. - -Опора на проверяемость как на критерий является относительной и, в ряде случаев, вводящей в заблуждение. Тот факт, что требование является проверяемым, не гарантирует, что его можно проверить автоматизированным или простым способом. Более того, наиболее легко проверяемые требования не всегда являются теми, которые оказывают наибольшее влияние на безопасность или которые проще всего реализовать. - -Таким образом, в версии 5.0 решения об уровнях принимались в первую очередь с целью снижения рисков, а также с учетом необходимых усилий по реализации. - -### Не только оценка рисков - -Использование предписывающих уровней, основанных на оценке риска, которые устанавливают определенный уровень для определенных приложений, оказалось слишком жестким. На практике расстановка приоритетов и внедрение средств безопасности зависят от множества факторов, включая как снижение рисков, так и усилия, необходимые для реализации. - -Следовательно, организациям следует стремиться к достижению того уровня, который они считают необходимым, исходя из своей зрелости и ценностей, которые они хотят демонстрировать своим клиентам. diff --git a/5.0/ru/0x10-V1-Encoding-and-Sanitization.md b/5.0/ru/0x10-V1-Encoding-and-Sanitization.md deleted file mode 100644 index 83d23a0ab8..0000000000 --- a/5.0/ru/0x10-V1-Encoding-and-Sanitization.md +++ /dev/null @@ -1,103 +0,0 @@ -# V1 Кодировка и нейтрализация - -## Задачи контроля - -В этой главе рассматриваются наиболее распространенные уязвимости безопасности веб-приложений, связанные с небезопасной обработкой недоверенных (пользовательских) данных. Такие уязвимости могут привести к различным техническим уязвимостям, где такие данные интерпретируются в соответствии с правилами синтаксиса соответствующего интерпретатора. - -Для современных веб-приложений всегда лучше использовать более архитектурно безопасные API, такие как параметризованные запросы, автоматическое экранирование или шаблонные фреймворки. В ином случае, самостоятельное тщательное выполнение кодирования выходных данных, экранирование или нейтрализация становятся критически важными для безопасности приложения. - -Валидация входных данных служит механизмом многослойной/глубокоэшелонированной (defense‑in‑depth) защиты от неожидаемого или опасного контента. Однако, поскольку ее основная цель заключается в обеспечении соответствия входящих данных функциональным и бизнес-ожиданиям, требования, связанные с этим, можно найти в главе «Валидация и бизнес-логика». - -## V1.1 Архитектура кодировки и нейтрализации - -В разделах ниже приведены требования для синтаксиса или интерпретатора, предназначенные для безопасной обработки небезопасного содержимого и предотвращения уязвимостей безопасности. Требования в этом разделе охватывают порядок, в котором должна происходить эта обработка, и где она должна происходить. Они также направлены на то, чтобы гарантировать, что при каждом сохранении данных они остаются в своем исходном состоянии и не хранятся в закодированной или экранированной форме (например, кодировка HTML), чтобы предотвратить проблемы с двойным кодированием. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **1.1.1** | Убедитесь, что входные данные декодируются или деэкранируются в каноническую форму (в стандартное представление) только один раз. Декодирование происходит только тогда, когда ожидаются закодированные данные в этой форме, и что это делается перед дальнейшей обработкой входных данных, например, это не выполняется после проверки или нейтрализации. | 2 | -| **1.1.2** | Убедитесь, что приложение выполняет кодирование и экранирование выходных данных либо в качестве последнего шага перед использованием интерпретатором, для которого оно предназначено, либо самим интерпретатором. | 2 | - -## V1.2 Предотвращение инъекций - -Кодирование или экранирование выходных данных, выполняемое близко или смежно с потенциально опасным контекстом, критично для безопасности любого приложения. Обычно кодирование и экранирование выходных данных не сохраняется, а вместо этого используется для обеспечения безопасности выходных данных для немедленного использования в соответствующем интерпретаторе. Попытка выполнить это на более ранних этапах может привести к искажению содержимого или неэффективно отобразить кодирование или экранирование. - -Во многих случаях библиотеки программного обеспечения включают более или полностью безопасные функции, которые выполняют это автоматически, хотя необходимо убедиться, что они корректны для текущего контекста. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **1.2.1** | Убедитесь, что выходная кодировка для ответа HTTP, документа HTML или документа XML соответствует требуемому контексту, например, кодировка соответствующих символов для элементов HTML, атрибутов HTML, комментариев HTML, CSS или полей заголовка HTTP делается таким способом, чтобы избежать изменения структуры сообщения или документа. | 1 | -| **1.2.2** | Убедитесь, что при динамическом построении URL-адресов недоверенные данные кодируются в соответствии с их контекстом (например, кодирование URL-адресов или кодирование base64url для query или path параметров или пути). Убедитесь, что разрешены только безопасные протоколы URL-адресов (например, запрещен javascript: или data:). | 1 | -| **1.2.3** | Убедитесь, что при динамическом построении содержимого JavaScript (включая JSON) используется кодирование или экранирование выходных данных, чтобы избежать изменения структуры сообщения или документа (чтобы избежать JavaScript и JSON-инъекций). | 1 | -| **1.2.4** | Убедитесь, что выборка данных (Redis, Memcached, чтение из файлов, обращение по API) или запросы к базе данных (например, SQL, HQL, NoSQL, Cypher) используют параметризованные запросы, ORM, Entity Frameworks или иным образом защищены от SQL-инъекций и других атак. Это также актуально при написании хранимых процедур. | 1 | -| **1.2.5** | Убедитесь, что приложение защищено от внедрения команд ОС и что вызовы операционной системы используют параметризованные запросы к ОС или используют контекстное кодирование вывода командной строки. | 1 | -| **1.2.6** | Убедитесь, что приложение защищено от LDAP-инъекций, или что реализованы специальные меры безопасности для их предотвращения. | 2 | -| **1.2.7** | Убедитесь, что приложение защищено от атак с использованием XPath-инъекций с помощью параметризации запросов или предварительно скомпилированных запросов. | 2 | -| **1.2.8** | Убедитесь, что процессоры LaTeX настроены безопасно (например, не используется флаг «–shell‑escape») и используется разрешенный список команд для предотвращения LaTeX-инъекций. | 2 | -| **1.2.9** | Убедитесь, что приложение экранирует специальные символы в регулярных выражениях (обычно с помощью обратной косой черты), чтобы предотвратить их ошибочную интерпретацию как метасимволов. | 2 | -| **1.2.10** | Убедитесь, что приложение защищено от внедрения формул CSV (CSV Injection). Приложение должно следовать правилам экранирования, определенным в RFC 4180, разделы 2.6 и 2.7, при экспорте содержимого CSV. Кроме того, при экспорте в CSV или другие форматы электронных таблиц (такие как XLS, XLSX или ODF) специальные символы (включая '=', '+', '-', '@', '\t' (табуляция), и '\0' (нулевой символ)) должны экранироваться одинарной кавычкой, если они появляются в качестве первого символа в значении поля. | 3 | - -Примечание: Использование параметризованных запросов или экранирование SQL не всегда достаточно. Части запроса, такие как имена таблиц и столбцов (включая имена столбцов «ORDER BY»), не могут быть экранированы. Включение экранированных пользовательских данных в эти поля приводит к сбоям запросов или SQL-инъекции. - -## V1.3 Нейтрализация - -Идеальной защитой от использования недоверенных данных в небезопасном контексте является использование контекстно-зависимого кодирования или экранирования, которое сохраняет то же семантическое значение небезопасного контента, но делает его безопасным для использования в этом конкретном контексте, как обсуждалось более подробно в предыдущем разделе. - -Если это невозможно, необходима нейтрализация, удаляющая потенциально опасные символы или данные. В некоторых случаях это может изменить семантическое значение ввода, но по соображениям безопасности альтернативы может не быть. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **1.3.1** | Убедитесь, что все ненадежные входные данные HTML из редакторов WYSIWYG или аналогичных программ нейтрализуются с помощью известных и безопасных библиотек или функций фреймворка для санитизации HTML. | 1 | -| **1.3.2** | Убедитесь, что приложение избегает использования eval() или других динамических функций выполнения кода, таких как Spring Expression Language (SpEL). Если нет альтернативы, любой пользовательский ввод должен быть нейтрализован перед выполнением. | 1 | -| **1.3.3** | Убедитесь, что данные, передаваемые в потенциально опасный контекст, предварительно нейтрализованы, чтобы обеспечить соблюдение мер безопасности, таких как разрешение только тех символов, которые безопасны для данного контекста, и обрезка слишком длинного ввода. | 2 | -| **1.3.4** | Убедитесь, что предоставленный пользователем файл .SVG проверен или нейтрализован, чтобы он содержал только теги и атрибуты (например, относящиеся к рисованию), которые безопасны для приложения, например, не содержат скриптов и foreignObject. | 2 | -| **1.3.5** | Убедитесь, что приложение нейтралует или отключает предоставленные пользователем скриптовые данные или выражения шаблонных языков, такие как таблицы стилей Markdown, CSS или XSL, BBCode или аналогичные. | 2 | -| **1.3.6** | Убедитесь, что приложение защищено от атак с подделкой запросов на стороне сервера (SSRF), проверяя ненадежные данные по разрешенному списку протоколов, доменов, путей и портов, а также нейтрализуя потенциально опасные символы перед использованием данных для вызова другой службы. | 2 | -| **1.3.7** | Убедитесь, что приложение защищено от атак с внедрением шаблонов (template injection), не позволяя создавать шаблоны на основе недоверенных входных данных. Если нет альтернативы, любые недоверенные входные данные, включаемые динамически во время создания шаблона, должны быть нейтрализованы или тщательно провалидированы. | 2 | -| **1.3.8** | Убедитесь, что приложение надлежащим образом нейтрализует недоверенные входные данные перед использованием в запросах Java Naming and Directory Interface (JNDI) и что JNDI настроен безопасно для предотвращения атак с использованием JNDI-инъекций. | 2 | -| **1.3.9** | Убедитесь, что приложение нейтрализует данные перед отправкой в Memcache, чтобы предотвратить атаки методом инъекций. | 2 | -| **1.3.10** | Убедитесь, что строки форматирования, которые могут быть использованы неожидаемым или вредоносным образом, нейтрализуются перед дальнейшим использованием. | 2 | -| **1.3.11** | Убедитесь, что приложение нейтрализует вводимые пользователем данные перед передачей в почтовые системы для защиты от SMTP или IMAP-инъекций. | 2 | -| **1.3.12** | Убедитесь, что регулярные выражения не содержат элементов, вызывающих экспоненциальный возврат, и убедитесь в нейтрализации недоверенных входных данных для предотвращения атак ReDoS или Runaway Regex. | 3 | - -## V1.4 Память, строки и неуправляемый код - -Следующие требования касаются рисков, связанных с небезопасным использованием памяти, которые обычно применяются, когда приложение использует системный язык или неуправляемый код. - -В некоторых случаях этого можно добиться, установив флаги компилятора, которые включают защиту от переполнения буфера и предупреждения, включая рандомизацию стека и предотвращение выполнения данных, и которые прерывают сборку, если обнаружены небезопасные операции с указателем, памятью, строкой формата, целым числом или строкой. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **1.4.1** | Убедитесь, что для обнаружения или предотвращения ситуаций переполнения стека, буфера или кучи приложение учитывает размер доступной области памяти при строковых операциях, копировании в память, в арифметике указателей и т.п. | 2 | -| **1.4.2** | Убедитесь, что для предотвращения целочисленного переполнения применяется контроль знака, диапазона и типа допустимых входных данных. | 2 | -| **1.4.3** | Убедитесь, что динамически выделенная память и ресурсы освобождены, а ссылки или указатели на освобожденную память удалены или установлены в значение null, чтобы предотвратить появление висячих указателей и уязвимостей, связанных с использованием памяти после освобождения. | 2 | - -## V1.5 Безопасная десериализация - -Преобразование данных из сохраненного или переданного представления в фактические объекты приложения (десериализация) исторически было причиной различных уязвимостей внедрения кода. Важно выполнять этот процесс осторожно и безопасно, чтобы избежать подобных проблем. - -В частности, некоторые методы десериализации были определены в документации по языку программирования или фреймворку как небезопасные и не могут безопасно применяться с недоверенными данными. Для каждого используемого механизма следует проводить тщательную проверку. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **1.5.1** | Убедитесь, что приложение настраивает XML-парсеры на использование строгой конфигурации и что небезопасные функции, такие как разрешение внешних сущностей, отключены для предотвращения атак XML eXternal Entity (XXE). | 1 | -| **1.5.2** | Убедитесь, что десериализация недоверенных данных обеспечивает безопасную обработку ввода, например, используя список разрешенных типов объектов или ограничивая типы объектов, определяемые клиентом, для предотвращения атак десериализации. Механизмы десериализации, которые явно определены как небезопасные, не должны использоваться с недоверенным вводом. | 2 | -| **1.5.3** | Убедитесь, что различные парсеры, используемые в приложении для одного и того же типа данных (например, парсеры JSON, XML, URL), выполняют парсинг согласованным образом и используют один и тот же механизм кодирования символов, чтобы избежать таких проблем, как уязвимости взаимодействия JSON (JSON Interoperability) или различное поведение анализа URI или файлов, которые могут использоваться в атаках удаленного включения файлов (RFI) или подделки запросов на стороне сервера (SSRF). | 3 | - -## Ссылки - -Для дополнительной информации см. также: - -* [OWASP LDAP Injection Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html) -* [OWASP Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) -* [OWASP DOM Based Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html) -* [OWASP XML External Entity Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html) -* [OWASP Web Security Testing Guide: Client-Side Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/11-Client-side_Testing) -* [OWASP Java Encoding Project](https://owasp.org/owasp-java-encoder/) -* [DOMPurify - Client-side HTML Sanitization Library](https://github.com/cure53/DOMPurify) -* [RFC4180 - Common Format and MIME Type for Comma-Separated Values (CSV) Files](https://datatracker.ietf.org/doc/html/rfc4180#section-2) - -Для более подробной информации о проблемах сериализации и парсинга см. также: - -* [OWASP Deserialization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) -* [An Exploration of JSON Interoperability Vulnerabilities](https://bishopfox.com/blog/json-interoperability-vulnerabilities) -* [Orange Tsai - A New Era of SSRF Exploiting URL Parser In Trending Programming Languages](https://www.blackhat.com/docs/us-17/thursday/us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf) diff --git a/5.0/ru/0x11-V2-Validation-and-Business-Logic.md b/5.0/ru/0x11-V2-Validation-and-Business-Logic.md deleted file mode 100644 index 2a2e4d18ed..0000000000 --- a/5.0/ru/0x11-V2-Validation-and-Business-Logic.md +++ /dev/null @@ -1,73 +0,0 @@ -# V2 Валидация и бизнес-логика - -## Задачи контроля - -Цель этой главы — убедиться, что проверенное приложение соответствует следующим высокоуровневым целям: - -* Входные данные, полученные приложением, соответствуют бизнес- или функциональным ожиданиям. -* Поток бизнес-логики последователен, выполняется по порядку и не может быть обойден. -* Бизнес-логика содержит ограничения и механизмы для обнаружения и предотвращения автоматизированных атак, таких как постоянные небольшие переводы средств или добавление миллиона друзей по одному за раз. -* Критически важные потоки бизнес-логики учитывают случаи злоупотреблений и действий злоумышленников и имеют защиту от подмены, подделки, раскрытия информации и атак с повышением привилегий. - -## V2.1 Документация валидации и бизнес-логики - -Документация по валидации и бизнес-логике должна четко определять ограничения бизнес-логики, правила валидации и контекстную согласованность объединенных данных, чтобы было понятно, что необходимо реализовать в приложении. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **2.1.1** | Убедитесь, что в документации приложения определены правила проверки входных данных на соответствие ожидаемой структуре. Это могут быть распространённые форматы данных, такие как номера кредитных карт, адреса электронной почты, номера телефонов, или внутренний формат данных. | 1 | -| **2.1.2** | Убедитесь, что в документации приложения указано, как проверять логическую и контекстную согласованность объединенных данных, например, проверять соответствие района и почтового индекса. | 2 | -| **2.1.3** | Убедитесь, что ожидания относительно ограничений и проверок бизнес-логики задокументированы как для уровня отдельного пользователя, так и для глобального уровня всего приложения. | 2 | - -## V2.2 Валидация ввода - -Эффективные средства контроля валидации входных данных обеспечивают соответствие бизнес- или функциональных ожиданий приложения относительно типа данных. Такой контроль валидации обеспечивает высокое качество данных и уменьшает поверхность атаки. Однако такой контроль не устраняет и не заменяет необходимость использования корректного кодирования, параметризации или санитизации данных при использовании данных в другом компоненте или для их представления для вывода. - -В данном контексте «входные данные» могут поступать из самых разных источников, включая поля HTML-форм, запросы REST, параметры URL, поля заголовков HTTP, файлы cookie, файлы на диске, базы данных и внешние API. - -Механизм бизнес-логики может проверять, что конкретное входное значение представляет собой число меньше 100. Функционал будет проверять и ожидать, что число ниже определенного порогового значения, поскольку это число определяет количество повторений конкретного цикла, а большое значение может привести к чрезмерной нагрузке и потенциальному отказу в обслуживании. - -Хотя валидация по схеме явно не предписана, она может быть наиболее эффективным механизмом для полного охвата валидацией HTTP API или других интерфейсов, использующих JSON или XML. - -Обратите внимание на следующие моменты при валидации по схеме: - -* «Опубликованная версия» спецификации валидации по JSON-схеме считается готовой к использованию, но, грубо говоря, «нестабильной». При использовании валидации по JSON-схеме убедитесь в отсутствии расхождений с приведенными ниже требованиями. -* Любые используемые библиотеки валидации по JSON-схеме также следует отслеживать и при необходимости обновлять после формализации стандарта. -* Валидацию DTD не следует использовать, а оценку DTD фреймворка следует отключить, чтобы избежать проблем с атаками XXE на DTD. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **2.2.1** | Убедитесь, что входные данные провалидированы для обеспечения соответствия бизнес- или функциональным ожиданиям. Валидация должна осуществляться либо по списку допустимых значений, шаблонов и диапазонов, либо путем сравнения входных данных с ожидаемой структурой и логическими ограничениями в соответствии с предопределенными правилами. Для L1 валидация может быть сосредоточена на входных данных, используемых для принятия конкретных бизнес-решений или решений, связанных с безопасностью. Для L2 и выше это должно применяться ко всем входным данным. | 1 | -| **2.2.2** | Убедитесь, что приложение разработано с принудительной валидацией входных данных на уровне доверенного сервиса. Хотя проверка на стороне клиента повышает удобство использования и должна поощряться, на неё не следует полагаться как на средство контроля безопасности. | 1 | -| **2.2.3** | Убедитесь, что приложение обеспечивает обоснованность комбинаций данных в соответствии с предопределенными правилам. Например: возраст должен соответствовать дате рождения; страна и почтовый индекс; количество товара в заказе и на складе. | 2 | - -## V2.3 Безопасность бизнес-логики - -В этом разделе рассматриваются ключевые требования, гарантирующие, что приложение обеспечит корректное выполнение процессов бизнес-логики и не будет уязвимо для атак, использующих логику и поток работы приложения. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **2.3.1** | Убедитесь, что приложение обрабатывает потоки бизнес-логики для одного и того же пользователя в ожидаемом последовательном порядке шагов и без пропуска шагов. | 1 | -| **2.3.2** | Убедитесь, что ограничения бизнес-логики реализованы в соответствии с документацией приложения, чтобы избежать эксплуатации её недостатков. | 2 | -| **2.3.3** | Убедитесь, что транзакции используются на уровне бизнес-логики таким образом, что операция бизнес-логики либо выполняется полностью, либо откатывается к предыдущему корректному состоянию. | 2 | -| **2.3.4** | Убедитесь, что на уровне бизнес-логики используются механизмы блокировки, чтобы гарантировать невозможность двойного бронирования ограниченных по количеству ресурсов (например, мест в театре или слотов доставки) путем манипулирования логикой приложения. | 2 | -| **2.3.5** | Убедитесь, что для важных потоков бизнес-логики требуется многопользовательское (multi-user) одобрение, чтобы предотвратить несанкционированные или случайные действия. Потоки бизнес-логики могут включать, помимо прочего, крупные денежные переводы, утверждение контрактов, доступ к секретной информации или обход ограничений безопасности на производстве. | 3 | - -## V2.4 Анти-автоматизация - -В этом разделе представлены меры по борьбе с автоматизацией, гарантирующие необходимость взаимодействия, аналогичного человеческому, и предотвращают чрезмерные автоматизированные запросы. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **2.4.1** | Убедитесь, что используются средства противодействия автоматизации для защиты от чрезмерных вызовов функций приложения, которые могут привести к утечке данных, созданию ненужных данных, исчерпанию квот, нарушению ограничений скорости, отказу в обслуживании или чрезмерному использованию дорогостоящих ресурсов. | 2 | -| **2.4.2** | Убедитесь, что потоки бизнес-логики требуют реалистичного человеческого времени, предотвращая чрезмерно быструю отправку транзакций. | 3 | - -## Ссылки - -Для дополнительной информации см. также: - -* [OWASP Web Security Testing Guide: Input Validation Testing](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/README.html) -* [OWASP Web Security Testing Guide: Business Logic Testing](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/10-Business_Logic_Testing/README) -* Анти-автоматизация может быть достигнута разными путями, включая применение [OWASP Automated Threats to Web Applications](https://owasp.org/www-project-automated-threats-to-web-applications/) -* [OWASP Input Validation Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html) -* [JSON Schema](https://json-schema.org/specification.html) diff --git a/5.0/ru/0x12-V3-Web-Frontend-Security.md b/5.0/ru/0x12-V3-Web-Frontend-Security.md deleted file mode 100644 index 0215d4a612..0000000000 --- a/5.0/ru/0x12-V3-Web-Frontend-Security.md +++ /dev/null @@ -1,100 +0,0 @@ -# V3 Безопасность веб-интерфейса - -## Задачи контроля - -Эта категория фокусируется на требованиях, направленных на защиту от атак, воспроизводимых через веб-интерфейс. Эти требования не применяются к решениям «машина-машина». - -## V3.1 Документация по безопасности веб-интерфейса - -В этом разделе описываются функции безопасности браузера, которые должны быть описаны в документации приложения. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **3.1.1** | Убедитесь, что в документации приложения описаны ожидаемые функции безопасности, которые должны поддерживать браузеры, использующие приложение (такие как HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) и другие соответствующие механизмы безопасности HTTP). В документации также должно быть обязательно определено, как приложение должно себя вести, если некоторые из этих функций недоступны (например, предупреждать пользователя или блокировать доступ). | 3 | - -## V3.2 Непреднамеренная интерпретация контента - -Отображение контента или функциональности в неправильном контексте может привести к выполнению или отображению вредоносного контента. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **3.2.1** | Убедитесь, что реализованы меры безопасности, предотвращающие отображение контента или функций браузерами в HTTP-ответах в некорректном контексте (например, запрос API, загруженный пользователем файл или другой ресурс запрашивается напрямую). Возможные способы контроля включают: не обрабатывать содержимое, если поля заголовка HTTP-запроса (например, Sec-Fetch-*) не указывают на корректность контекста; использование заголовка и значения Content-Security-Policy: sandbox directive; или использование заголовка и значения Content-Disposition: attachment. | 1 | -| **3.2.2** | Убедитесь, что данные, предназначенные для отображения в виде текста, а не визуализации в виде HTML, обрабатывается с использованием безопасных функций визуализации (таких как createTextNode или textContent), чтобы предотвратить непреднамеренное выполнение содержимого, такого как HTML или JavaScript. | 1 | -| **3.2.3** | Убедитесь, что приложение избегает затирания DOM при использовании JavaScript на стороне клиента, применяя явные объявления переменных, выполняя строгую проверку типов, избегая сохранения глобальных переменных в объекте документа и реализуя изоляцию пространства имен. | 3 | - -## V3.3 Настройка файлов cookie - -В этом разделе изложены требования к безопасной настройке чувствительных cookie, позволяющие обеспечить более высокий уровень уверенности в том, что они были созданы самим приложением, а также предотвратить утечку или ненадлежащее изменение их содержимого. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **3.3.1** | Убедитесь, что у файлов cookie установлен атрибут «Secure», и если префикс «__Host‑» не используется в названии cookie, необходимо использовать префикс «__Secure‑». | 1 | -| **3.3.2** | Убедитесь, что значение атрибута SameSite каждой cookie установлено в соответствии с назначением cookie, чтобы ограничить подверженность атакам на восстановление пользовательского интерфейса и атакам с подделкой запросов на уровне браузера, обычно называемым подделкой межсайтовых запросов (CSRF). | 2 | -| **3.3.3** | Убедитесь, что cookie имеют префикс «__Host‑» в названии, если только они явно не предназначены для совместного использования с другими хостами. | 2 | -| **3.3.4** | Убедитесь, что если значение cookie не должно быть доступно для клиентских скриптов (например, сессионный токен), для cookie должен быть установлен атрибут «HttpOnly», а само значение должно передаваться клиенту только через поле заголовка «Set-Cookie». | 2 | -| **3.3.5** | Убедитесь, что при записи cookie приложением общая длина имени и значения cookie не превышает 4096 байт. Слишком большие cookie не будут сохраняться браузером и, следовательно, не будут отправляться с запросами, что помешает пользователю использовать функции приложения, зависящие от этого cookie. | 3 | - -## V3.4 Заголовки механизма безопасности браузера - -В этом разделе описывается, какие заголовки безопасности следует устанавливать в HTTP-ответах, чтобы включить функции безопасности браузера и ограничения при обработке ответов от приложения. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **3.4.1** | Убедитесь, что поле заголовка Strict‑Transport‑Security включено во все ответы для реализации политики HTTP Strict Transport Security (HSTS). Необходимо указать максимальное время не менее 1 года, а для L2 и выше политика должна применяться также ко всем поддоменам. | 1 | -| **3.4.2** | Убедитесь, что поле заголовка Cross‑Origin Resource Sharing (CORS) «Access‑Control‑Allow‑Origin» имеет фиксированное значение, заданное приложением, или, если используется заголовок Origin, оно проверяется по списку доверенных источников. При необходимости использования «Access‑Control‑Allow‑Origin: *» убедитесь, что ответ не содержит конфиденциальной информации. | 1 | -| **3.4.3** | Убедитесь, что HTTP-ответы содержат поле заголовка Content-Security-Policy, которое определяет директивы, гарантирующие загрузку и выполнение браузером только доверенного контента или ресурсов, чтобы ограничить выполнение вредоносного JavaScript. Как минимум, необходимо использовать глобальную политику, включающую директивы object-src «none» и base-uri «none», а также определяющую список разрешенных адресов или использующую одноразовые коды или хэши. Для приложений L3 необходимо определить политику использования 'nonce' или hash-конструкций для каждого ответа. | 2 | -| **3.4.4** | Убедитесь, что все HTTP-ответы содержат поле заголовка «X‑Content‑Type‑Options: nosniff». Это предписывает браузерам не использовать анализ контента и определение типа MIME для данного ответа, а также требовать, чтобы значение поля заголовка Content‑Type в ответе соответствовало целевому ресурсу. Например, ответ на запрос стиля принимается только в том случае, если Content‑Type в ответе — «text/css». Это также позволяет браузеру использовать функцию Cross‑Origin Read Blocking (CORB). | 2 | -| **3.4.5** | Убедитесь, что приложение устанавливает политику реферера для предотвращения утечки технически конфиденциальных данных сторонним сервисам через поле заголовка HTTP-запроса «Referer». Это можно сделать с помощью поля заголовка HTTP-ответа «Referrer‑Policy» или через атрибуты HTML-элемента. Конфиденциальные данные могут включать путь и данные запроса в URL-адресе, а для внутренних непубличных приложений также имя хоста. | 2 | -| **3.4.6** | Убедитесь, что веб-приложение использует директиву frame‑ancestors поля заголовка Content‑Security‑Policy для каждого HTTP-ответа, чтобы гарантировать невозможность его внедрения по умолчанию и внедрение определённых ресурсов разрешено только при необходимости. Обратите внимание, что поле заголовка X‑Frame‑Options, хотя и поддерживается браузерами, устарело и не может быть использовано в качестве основы. | 2 | -| **3.4.7** | Убедитесь, что в поле заголовка Content‑Security‑Policy указано место, куда следует сообщать о нарушениях. | 3 | -| **3.4.8** | Убедитесь, что все HTTP-ответы, инициирующие рендеринг документа (например, ответы с типом содержимого text/html), включают поле заголовка Cross-Origin-Opener-Policy с директивой same-origin или same-origin-allow-popups (при необходимости). Это предотвращает атаки, злоупотребляющие общим доступом к объектам Window, такие как Tabnabbing и Frame Counting. | 3 | - -## V3.5 Браузерное разделение источников - -Принимая запрос к чувствительному функционалу на стороне сервера, приложение должно убедиться, что запрос инициирован самим приложением или доверенной стороной и не был подделан злоумышленником. - -К чувствительному функционалу в данном контексте могут относиться принятие форм POST для аутентифицированных и неаутентифицированных пользователей (например, запрос аутентификации), операции по изменению состояния или ресурсоемкие функции (например, экспорт данных). - -Ключевыми средствами защиты здесь являются политики безопасности браузера, такие как Same Origin Policy для JavaScript и логика SameSite для cookie. Другим распространённым средством защиты является механизм предварительной проверки CORS. Этот механизм критически важен для конечных точек, спроектированных и предназначенных, чтобы вызываться из другого источника, но он также может быть полезным механизмом предотвращения подделки запросов для конечных точек, которые не предназначены для вызова из другого источника. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **3.5.1** | Убедитесь, что, если приложение не использует механизм предварительной проверки CORS для предотвращения запрещённых кросс-доменных запросов на использование чувствительного функционала, эти запросы валидируются на предмет их происхождения от самого приложения. Это можно сделать, используя и проверяя специальные токены для защиты от подделки или требуя дополнительные поля HTTP-заголовка, не входящие в список «простых заголовков» (CORS-safelisted request-header). Это необходимо для защиты от атак с подделкой запросов через браузер, широко известных как межсайтовая подделка запросов (CSRF). | 1 | -| **3.5.2** | Убедитесь, что если приложение использует механизм предварительной проверки CORS для предотвращения неразрешённого использования чувствительного функционала между источниками, вызов этого функционала невозможен с помощью запроса, который не запускает предварительную проверку CORS. Для этого может потребоваться проверка значений полей заголовка запроса «Origin» и «Content-Type» или использование дополнительного поля заголовка, не входящего в безопасный список CORS. | 1 | -| **3.5.3** | Убедитесь, что HTTP-запросы к чувствительному функционалу используют соответствующие HTTP-методы, такие как POST, PUT, PATCH или DELETE, а не методы, определённые спецификацией HTTP как «безопасные», такие как HEAD, OPTIONS или GET. В качестве альтернативы можно использовать строгую валидацию полей заголовка запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, навигационного запроса или загрузки ресурса (например, источника изображения), где это не ожидается. | 1 | -| **3.5.4** | Убедитесь, что отдельные приложения размещены на разных именах хостов, чтобы использовать ограничения, предусмотренные политикой same-origin, включая то, как документы или скрипты, загруженные одним источником, могут взаимодействовать с ресурсами из другого источника, а также ограничения на cookie на основе имени хоста. | 2 | -| **3.5.5** | Убедитесь, что сообщения, полученные интерфейсом postMessage, отвергаются, если источник сообщения не является доверенным или если синтаксис сообщения недействителен. | 2 | -| **3.5.6** | Убедитесь, что функциональность JSONP не включена нигде в приложении, чтобы избежать атак с использованием межсайтового включения скриптов (XSSI). | 3 | -| **3.5.7** | Убедитесь, что данные, требующие авторизации, не включены в ответы ресурсов скриптов, таких как файлы JavaScript, чтобы предотвратить атаки с использованием межсайтового включения скриптов (XSSI). | 3 | -| **3.5.8** | Убедитесь, что аутентифицированные ресурсы (такие как изображения, видео, скрипты и другие документы) могут быть загружены или внедрены от имени пользователя только по назначению. Этого можно добиться путём строгой валидации полей заголовка HTTP-запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, или путём установки ограничительного поля заголовка HTTP-ответа Cross‑Origin‑Resource‑Policy, чтобы браузер блокировал возвращаемый контент. | 3 | - -## V3.6 Целостность внешних ресурсов - -В этом разделе приведены рекомендации по безопасному размещению контента на сторонних сайтах. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **3.6.1** | Убедитесь, что клиентские ресурсы, такие как библиотеки JavaScript, CSS или веб-шрифты, размещаются только на внешнем сервере (например, в сети доставки контента (Content Delivery Network)), если ресурс статический и имеет версии, а для проверки целостности ресурса используется механизм проверки целостности подресурсов (SRI). Если это невозможно, для каждого ресурса должно быть задокументировано решение по безопасности, обосновывающее это. | 3 | - -## V3.7 Другие соображения по безопасности браузера - -В этом разделе рассматриваются различные другие элементы управления безопасностью и современные функции безопасности браузера, необходимые для обеспечения безопасности браузера на стороне клиента. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **3.7.1** | Убедитесь, что приложение использует только те клиентские технологии, которые по-прежнему поддерживаются и считаются безопасными. Примерами технологий, не соответствующих этому требованию, являются плагины NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL или клиентские Java-апплеты. | 2 | -| **3.7.2** | Убедитесь, что приложение будет автоматически перенаправлять пользователя на другое имя хоста или домен (который не контролируется приложением), только если этот хост или домен указаны в списке разрешенных. | 2 | -| **3.7.3** | Убедитесь, что приложение отображает уведомление, что пользователь перенаправляется на URL-адрес, находящийся вне контроля приложения, с возможностью отмены навигации. | 3 | -| **3.7.4** | Убедитесь, что домен верхнего уровня приложения (например, site.tld) ​​добавлен в публичный список предварительной загрузки (preload list) для HTTP Strict Transport Security (HSTS). Это гарантирует, что использование TLS для приложения будет встроено непосредственно в основные браузеры, а не будет полагаться только на поле заголовка ответа Strict-Transport-Security. | 3 | -| **3.7.5** | Убедитесь, что приложение ведет себя так, как описано в документации (например, предупреждает пользователя или блокирует доступ), если браузер, используемый для доступа к приложению, не поддерживает ожидаемые функции безопасности. | 3 | - -## Ссылки - -Для дополнительной информации см. также: - -* [Set-Cookie __Host- prefix details](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#cookie_prefixes) -* [OWASP Content Security Policy Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html) -* [OWASP Secure Headers Project](https://owasp.org/www-project-secure-headers/) -* [OWASP Cross-Site Request Forgery Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html) -* [HSTS Browser Preload List submission form](https://hstspreload.org/) -* [OWASP DOM Clobbering Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/DOM_Clobbering_Prevention_Cheat_Sheet.html) diff --git a/5.0/ru/0x13-V4-API-and-Web-Service.md b/5.0/ru/0x13-V4-API-and-Web-Service.md deleted file mode 100644 index ca15f7df32..0000000000 --- a/5.0/ru/0x13-V4-API-and-Web-Service.md +++ /dev/null @@ -1,64 +0,0 @@ -# V4 API и Веб-сервис - -## Задачи контроля - -Существует несколько моментов, применимых только к приложениям, предоставляющим API для использования веб-браузерами или другими клиентами (обычно с использованием JSON, XML или GraphQL). В этой главе рассматриваются соответствующие настройки и механизмы безопасности, которые следует применять. - -Обратите внимание, что вопросы аутентификации, управления сессиями и проверки входных данных, рассмотренные в других главах, также относятся к API. Поэтому эту главу нельзя рассматривать изолированно или тестировать отдельно. - -## V4.1 Общая безопасность веб-сервисов - -В этом разделе рассматриваются общие вопросы безопасности веб-сервисов и базовые практики гигиены веб-сервисов. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **4.1.1** | Убедитесь, что каждый HTTP-ответ с телом сообщения содержит заголовок Content-Type, который соответствует фактическому содержимому ответа, таким как «text/», «/+xml» и «/xml», включая параметр charset для указания безопасной кодировки символов (например, UTF-8, ISO-8859-1) согласно IANA Media Types. | 1 | -| **4.1.2** | Убедитесь, что только конечные точки, предназначенные для взаимодействия с пользователем через веб-браузер, автоматически перенаправляют HTTP на HTTPS, в то время как другие сервисы или конечные точки не реализуют прозрачные редиректы. Это необходимо, чтобы избежать ситуации, когда клиент ошибочно отправляет незашифрованные HTTP-запросы а из-за того, что запрос по HTTP автоматически перенаправляется на HTTPS другим сервисом без обработки на входе, утечка чувствительных данных остаётся незамеченной. | 2 | -| **4.1.3** | Убедитесь, что любой HTTP-заголовок, используемый приложением и устанавливаемый промежуточным уровнем, таким как балансировщик нагрузки, веб-прокси или backend-for-frontend сервис, не может быть переопределён конечным пользователем. Примеры заголовков: X-Real-IP, X-Forwarded-*, X-User-ID. | 2 | -| **4.1.4** | Убедитесь, что разрешены только HTTP-методы, которые явно поддерживаются приложением или его API (включая OPTIONS для preflight-запросов), а неиспользуемые методы заблокированы. | 3 | -| **4.1.5** | Убедитесь, что для особо чувствительных запросов или транзакций, проходящих через несколько систем, используются цифровые подписи на уровне сообщений, дополнительно к транспортным средствам защиты. | 3 | - -## V4.2 Валидация структуры HTTP-сообщений - -Этот раздел объясняет, как должна проверяться структура и заголовки HTTP-сообщений, чтобы предотвратить атаки типа request smuggling, response splitting, header injection и отказ в обслуживании из-за слишком длинных HTTP-сообщений. - -Эти требования актуальны для обработки и генерации HTTP-сообщений в целом, но особенно важны при конвертации сообщений между разными версиями HTTP. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **4.2.1** | Убедитесь, что все компоненты приложения (включая балансировщики нагрузки, файрволы и серверы приложений) определяют границы входящих HTTP-сообщений с использованием механизма, соответствующего версии HTTP, чтобы предотвратить HTTP request smuggling. В HTTP/1.x, если присутствует заголовок Transfer-Encoding, заголовок Content-Length должен игнорироваться согласно RFC 2616. При использовании HTTP/2 или HTTP/3, если присутствует Content-Length, веб-сервер должен убедиться, что он совпадает с длиной DATA-фреймов. | 2 | -| **4.2.2** | Убедитесь, что при генерации HTTP-сообщений заголовок Content-Length не конфликтует с длиной содержимого, определяемой рамками протокола HTTP, чтобы предотвратить HTTP Request Smuggling. | 3 | -| **4.2.3** | Убедитесь, что приложение не отправляет и не принимает HTTP/2 и HTTP/3 сообщения с заголовками, специфичными для соединения, такими как Transfer-Encoding, чтобы предотвратить HTTP Response Splitting и HTTP Header Injection. | 3 | -| **4.2.4** | Убедитесь, что приложение принимает HTTP/2 и HTTP/3 запросы только в случае, если поля заголовков и их значения не содержат последовательностей CR (\r), LF (\n) или CRLF (\r\n), чтобы предотвратить HTTP Header Injection. | 3 | -| **4.2.5** | Убедитесь, что если приложение (бекенд или фронтенд) формирует и отправляет запросы, оно использует валидацию, очистку или другие механизмы, чтобы не создавать URI (например, для API-вызовов) или HTTP-заголовки (например, Authorization или Cookie) слишком большой длины, чтобы их не принимал приёмник. Это может привести к отказу в обслуживании, например, при отправке слишком длинного запроса (длинный cookie-заголовок), из-за чего сервер постоянно возвращает ошибку. | 3 | - -## V4.3 GraphQL - -GraphQL становится всё более популярным способом создания клиентов с большим объёмом данных, которые не жёстко связаны с разными бэкенд-сервисами. В этом разделе рассмотрены вопросы безопасности для GraphQL. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **4.3.1** | Убедитесь, что используется белый список запросов, ограничение глубины вложенности, ограничение количества или анализ стоимости запроса, чтобы предотвратить DoS-атаки на уровне GraphQL или слоя данных из-за дорогостоящих вложенных запросов. | 2 | -| **4.3.2** | Убедитесь, что introspection-запросы GraphQL отключены в продакшен-среде, если GraphQL API не предназначен для использования сторонними клиентами. | 2 | - -## V4.4 WebSocket - -WebSocket — это протокол связи, обеспечивающий двунаправленную одновременную коммуникацию по одному TCP-соединению. Он был стандартизирован IETF в RFC 6455 в 2011 году и отличается от HTTP, хотя и работает поверх портов HTTP 443 и 80. - -В этом разделе приведены основные требования по безопасности, чтобы предотвратить атаки, связанные с безопасностью коммуникаций и управлением сессиями, которые эксплуатируют этот канал реального времени. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **4.4.1** | Убедитесь, что для всех WebSocket-соединений используется WebSocket поверх TLS (WSS). | 1 | -| **4.4.2** | Убедитесь, что при первоначальном HTTP WebSocket handshake заголовок Origin проверяется на соответствие списку разрешённых источников для приложения. | 2 | -| **4.4.3** | Убедитесь, что если стандартное управление сессиями приложения не может быть использовано, применяются специальные токены, соответствующие требованиям безопасности управления сессиями. | 2 | -| **4.4.4** | Убедитесь, что специальные токены управления сессиями WebSocket изначально получаются или валидируются через ранее аутентифицированную HTTPS-сессию при переходе от HTTPS к WebSocket. | 2 | - -## Ссылки - -Для дополнительной информации см. также: - -* [OWASP REST Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html) -* Ресурсы по авторизации GraphQL от [graphql.org](https://graphql.org/learn/authorization/) и [Apollo](https://www.apollographql.com/docs/apollo-server/security/authentication/#authorization-methods). -* [OWASP Web Security Testing Guide: GraphQL Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/12-API_Testing/01-Testing_GraphQL) -* [OWASP Web Security Testing Guide: Testing WebSockets](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/11-Client-side_Testing/10-Testing_WebSockets) diff --git a/5.0/ru/0x14-V5-File-Handling.md b/5.0/ru/0x14-V5-File-Handling.md deleted file mode 100644 index 118568c67d..0000000000 --- a/5.0/ru/0x14-V5-File-Handling.md +++ /dev/null @@ -1,54 +0,0 @@ -# V5 Работа с файлами - -## Задачи контроля - -Использование файлов может нести различные риски для приложения, включая отказ в обслуживании (DoS), несанкционированный доступ и переполнение хранилища. В этой главе приведены требования, для предотвращения этих рисков. - -## V5.1 Документация по работе с файлами - -Этот раздел содержит требование документировать ожидаемые характеристики файлов, принимаемых приложением, как необходимое условие для разработки и проверки соответствующих мер безопасности. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **5.1.1** | Убедитесь, что документация определяет допустимые типы файлов, ожидаемые расширения и максимальный размер (включая распакованный размер) для каждой функции загрузки. Также убедитесь, что в документации указано, как файлы обезвреживаются для конечных пользователей (например, как приложение ведёт себя при обнаружении вредоносного файла). | 2 | - -## V5.2 Загрузка файлов и содержимое - -Функциональность загрузки файлов является основным источником недоверенных файлов. Этот раздел описывает требования, обеспечивающие безопасность приложения от вреда, связанного с наличием, объёмом или содержимым этих файлов. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **5.2.1** | Убедитесь, что приложение принимает только те файлы, которые может обработать без потери производительности или отказа в обслуживании. | 1 | -| **5.2.2** | Убедитесь, что при загрузке файла (включая файлы внутри архивов, таких как ZIP) приложение проверяет, соответствует ли расширение ожидаемому, и валидирует, соответствует ли содержимое типу, указанному в расширении. Это включает проверку начальных 'magic bytes', перезапись изображений, использование специализированных библиотек. Для уровня 1 — достаточно проверок для файлов, критичных с точки зрения бизнеса или безопасности. Для уровней 2 и выше — для всех файлов. | 1 | -| **5.2.3** | Убедитесь, что приложение проверяет архивы (например, zip, gz, docx, odt) на максимально допустимый распакованный размер и максимальное количество файлов до распаковки. | 2 | -| **5.2.4** | Убедитесь, что для каждого пользователя установлены квоты на общий размер и количество файлов, чтобы один пользователь не мог переполнить хранилище. | 3 | -| **5.2.5** | Убедитесь, что приложение не позволяет загружать архивы с символьными ссылками (symlinks), если это не требуется по бизнес-логике. Если требуется — разрешён только строго определённый список допустимых символьных ссылок. | 3 | -| **5.2.6** | Убедитесь, что приложение отклоняет изображения с числом пикселей выше допустимого, чтобы предотвратить атаки 'pixel flood'. | 3 | - -## V5.3 Хранение файлов - -Этот раздел содержит требования для предотвращения исполнения файлов после загрузки, обнаружения опасного содержимого и предотвращения использования недоверенных данных для управления путями хранения файлов. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **5.3.1** | Убедитесь, что загруженные или сгенерированные из недоверенного ввода файлы, находящиеся в публичной директории, не исполняются как серверный код при обращении к ним по HTTP. | 1 | -| **5.3.2** | Убедитесь, что при создании путей к файлам приложение использует внутренние или доверенные данные, а не пользовательские имена файлов. Если использование пользовательских имён или метаданных необходимо — требуется строгая проверка и очистка. Это защита от path traversal, LFI, RFI и SSRF. | 1 | -| **5.3.3** | Убедитесь, что при обработке файлов на сервере (например, при распаковке) игнорируются пути, заданные пользователем, во избежание уязвимостей типа 'zip slip'. | 3 | - -## V5.4 Скачивание файлов - -Этот раздел содержит требования для снижения рисков при выдаче файлов на загрузку, включая защиту от path traversal и инъекций, а также проверку содержимого. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **5.4.1** | Убедитесь, что приложение валидирует или игнорирует имена файлов, переданных пользователем (включая в JSON, JSONP или URL-параметре), и указывает имя файла в заголовке Content-Disposition при ответе. | 2 | -| **5.4.2** | Убедитесь, что имена файлов, передаваемые (например, в HTTP-заголовках или вложениях в email), кодируются или очищаются (например, по RFC 6266), чтобы сохранить структуру документа и предотвратить инъекции. | 2 | -| **5.4.3** | Убедитесь, что файлы, полученные из недоверенных источников, сканируются антивирусом, чтобы не распространять известное вредоносное содержимое. | 2 | - -## Ссылки - -Для дополнительной информации см. также: - -* [OWASP File Upload Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html) -* [Example of using symlinks for arbitrary file read](https://hackerone.com/reports/1439593) -* [Explanation of "Magic Bytes" from Wikipedia](https://en.wikipedia.org/wiki/List_of_file_signatures) diff --git a/5.0/ru/0x15-V6-Authentication.md b/5.0/ru/0x15-V6-Authentication.md deleted file mode 100644 index 5f1cb68a52..0000000000 --- a/5.0/ru/0x15-V6-Authentication.md +++ /dev/null @@ -1,166 +0,0 @@ -# V6 Аутентификация - -## Задачи контроля - -Аутентификация — это процесс установления или подтверждения подлинности личности или устройства. Он включает в себя проверку заявленных данных, устойчивость к подмене личности и защиту от перехвата или восстановления паролей. - -[Документ NIST SP 800-63](https://pages.nist.gov/800-63-3/) является современным и основанным на фактических данных стандартом, особенно актуальным для государственных структур США и организаций, взаимодействующих с ними. - -Хотя многие требования этой главы основаны на разделе NIST SP 800-63B («Руководство по цифровой идентификации — Управление аутентификацией и жизненным циклом»), акцент сделан на распространённых угрозах и часто эксплуатируемых слабостях. Эта глава не охватывает весь стандарт. Для полной реализации NIST SP 800-63 необходимо обратиться к оригиналу. - -В тексте используется более понятная терминология, отличающаяся от формулировок NIST. - -Многие современные приложения адаптируют этапы аутентификации в зависимости от уровня риска. Эти механизмы рассматриваются в главе «Авторизация», поскольку они также касаются авторизационных решений. - -## V6.1 Документация по аутентификации - -Этот раздел содержит требования к документации по аутентификации, которую необходимо вести для приложения. Это критически важно для того, чтобы правильно настроить и оценить соответствующие механизмы управления аутентификацией. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **6.1.1** | Убедитесь, что в документации приложения описано, как используются механизмы, такие как ограничение частоты запросов (rate limiting), защита от автоматизации и адаптивные реакции, для защиты от атак, таких как подстановка учётных данных и перебор паролей. Документация должна ясно описывать конфигурацию этих механизмов и предотвращение злонамеренной блокировки аккаунтов. | 1 | -| **6.1.2** | Убедитесь, что задокументирован список контекстно-зависимых слов, запрещённых к использованию в паролях. В него могут входить производные от названий организаций, продуктов, идентификаторов систем, кодовых названий проектов, названий отделов или ролей и тому подобное. | 2 | -| **6.1.3** | Убедитесь, что если приложение поддерживает несколько способов аутентификации, то все они документированы вместе с описанием применяемых средств защиты и уровнем стойкости аутентификации, которые должны быть одинаково применены ко всем способам. | 2 | - -## V6.2 Безопасность паролей - -Пароли (в терминологии NIST SP 800-63 — «запоминаемые секреты») включают в себя пароли, кодовые фразы, PIN-коды, графические шаблоны разблокировки и, например, выбор нужного котёнка или другого элемента на изображении. Они относятся к категории «что-то, что вам известно» и часто используются как однофакторный механизм аутентификации. - -Соответственно, в этом разделе перечислены требования, направленные на безопасное создание и обработку паролей. Большинство требований относятся к уровню L1, поскольку на этом уровне они наиболее важны. Начиная с уровня L2, требуется использование многофакторной аутентификации, в которой пароли могут быть одним из факторов. - -Требования в данном разделе в основном соответствуют [§ 5.1.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver) [руководства NIST](https://pages.nist.gov/800-63-3/sp800-63b.html). - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **6.2.1** | Убедитесь, что пользовательские пароли содержат не менее 8 символов. Рекомендуется минимальная длина в 15 символов. | 1 | -| **6.2.2** | Убедитесь, что пользователи могут менять свои пароли. | 1 | -| **6.2.3** | Убедитесь, что для смены пароля требуется ввести как текущий, так и новый пароль. | 1 | -| **6.2.4** | Убедитесь, что при регистрации или смене пароля введённый пароль проверяется по списку как минимум из 3000 самых популярных паролей, соответствующих политике (например, минимальной длине). | 1 | -| **6.2.5** | Убедитесь, что допускаются пароли любой структуры, без ограничений на использование определённых символов. Не должно быть требований по обязательному наличию заглавных/строчных букв, цифр или специальных символов. | 1 | -| **6.2.6** | Убедитесь, что поля ввода пароля используют type=password для скрытия символов. Разрешено временное отображение всего пароля или последнего введённого символа. | 1 | -| **6.2.7** | Убедитесь, что разрешены вставка (paste), использование менеджеров паролей браузера и внешних менеджеров паролей. | 1 | -| **6.2.8** | Убедитесь, что пароль проверяется строго в том виде, в котором он был введён пользователем — без обрезки, изменения регистра и других модификаций. | 1 | -| **6.2.9** | Убедитесь, что система позволяет использовать пароли длиной не менее 64 символов. | 2 | -| **6.2.10** | Убедитесь, что пароль остаётся действительным, пока не будет скомпрометирован или не будет изменён пользователем. Приложение не должно требовать регулярной смены пароля. | 2 | -| **6.2.11** | Убедитесь, что используется документированный список контекстно-зависимых слов (например, названия компаний, проектов и т.д.) для предотвращения использования легко угадываемых паролей. | 2 | -| **6.2.12** | Убедитесь, что при регистрации или смене пароля проверяется, не входит ли он в список скомпрометированных (утёкших) паролей. | 2 | - -## V6.3 Общие требования к безопасности аутентификации - -В этом разделе изложены общие требования к безопасности механизмов аутентификации, а также различные ожидания для разных уровней защиты. Для приложений уровня L2 обязательно использование многофакторной аутентификации (MFA). Для приложений уровня L3 требуется аппаратная аутентификация, выполняемая в аттестованной и доверенной среде исполнения (TEE). Это может включать: ключи passkey, привязанные к устройству; аутентификаторы, соответствующие eIDAS LoA High; аутентификаторы с уровнем доверия NIST AAL3; или эквивалентные механизмы. - -Это достаточно строгий подход к MFA, но он необходим для повышения уровня защиты пользователей. Любое смягчение этих требований должно сопровождаться документированным обоснованием и чётким планом по смягчению рисков с учётом рекомендаций и исследований NIST. - -Обратите внимание: на момент публикации NIST SP 800-63 рассматривает email как [недопустимый](https://pages.nist.gov/800-63-FAQ/#q-b11) механизм аутентификации ([archived copy](https://web.archive.org/web/20250330115328/https://pages.nist.gov/800-63-FAQ/#q-b11)). - -Требования в этом разделе опираются на следующие части [руководства NIST](https://pages.nist.gov/800-63-3/sp800-63b.html), including: [§ 4.2.1](https://pages.nist.gov/800-63-3/sp800-63b.html#421-permitted-authenticator-types), [§ 4.3.1](https://pages.nist.gov/800-63-3/sp800-63b.html#431-permitted-authenticator-types), [§ 5.2.2](https://pages.nist.gov/800-63-3/sp800-63b.html#522-rate-limiting-throttling), и [§ 6.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#-612-post-enrollment-binding). - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **6.3.1** | Убедитесь, что реализованы меры защиты от атак типа credential stuffing (массовая подстановка учётных данных) и brute-force (перебор паролей), согласно документации по безопасности приложения. | 1 | -| **6.3.2** | Убедитесь, что в приложении отсутствуют или отключены учётные записи по умолчанию (например, root, admin, sa). | 1 | -| **6.3.3** | Убедитесь, что для доступа к приложению используется либо механизм многофакторной аутентификации, либо комбинация однофакторных. Для уровня L3 один из факторов должен быть аппаратным, обеспечивающим защиту от фишинга, устойчивость к компрометации и подтверждение намерения аутентификации через явное действие пользователя (например, нажатие кнопки на FIDO-ключе или телефоне). Ослабление этих требований допускается только при наличии обоснования и компенсирующих мер. | 2 | -| **6.3.4** | Убедитесь, что при наличии нескольких способов аутентификации, они все задокументированы, и для них единообразно применяются меры защиты и уровни доверия. | 2 | -| **6.3.5** | Убедитесь, что пользователи получают уведомления о подозрительных попытках аутентификации (удачных и неудачных). Это может включать попытки (например, подключения) с необычного устройства или места, частично успешную MFA, попытку после долгого отсутствия или успешную аутентификацию после серии неудачных. | 3 | -| **6.3.6** | Убедитесь, что email не используется ни как однофакторный, ни как многофакторный механизм аутентификации. | 3 | -| **6.3.7** | Убедитесь, что пользователи получают уведомление при изменении данных аутентификации, таких как сброс пароля или изменение логина/email. | 3 | -| **6.3.8** | Убедитесь, что из сообщений об ошибке, HTTP-кодов ответа или различий во времени ответа нельзя определить, существует ли пользователь с таким логином. Это правило также должно применяться к функциям регистрации и восстановления пароля. | 3 | - -## V6.4 Жизненный цикл и восстановление факторов аутентификации - -Факторы аутентификации могут включать пароли, программные токены (soft tokens), аппаратные токены (hardware tokens) и биометрические устройства. Безопасное управление жизненным циклом этих механизмов критически важно для безопасности приложения, и данный раздел включает соответствующие требования. - -Требования в этом разделе в основном соответствуют разделам [§ 5.1.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver) или [§ 6.1.2.3](https://pages.nist.gov/800-63-3/sp800-63b.html#replacement) [руководства NIST](https://pages.nist.gov/800-63-3/sp800-63b.html). - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **6.4.1** | Убедитесь, что начальные пароли или коды активации, генерируемые системой, создаются с использованием надёжного генератора случайных чисел, соответствуют текущей политике паролей и истекают через короткий период времени либо после первого использования. Эти секреты не должны использоваться как постоянные пароли. | 1 | -| **6.4.2** | Убедитесь, что в системе отсутствуют подсказки к паролю или вопросы на знание («секретные вопросы»). | 1 | -| **6.4.3** | Убедитесь, что реализован безопасный процесс сброса забытого пароля, который не обходит активные механизмы многофакторной аутентификации. | 2 | -| **6.4.4** | Убедитесь, что в случае утраты одного из факторов MFA проводится удостоверение личности (identity proofing) на том же уровне, что и при первичной регистрации. | 2 | -| **6.4.5** | Убедитесь, что инструкции по обновлению истекающих механизмов аутентификации отправляются заранее, с достаточным запасом времени для выполнения замены, при необходимости с настройкой автоматических напоминаний. | 3 | -| **6.4.6** | Убедитесь, что администраторы могут инициировать процесс сброса пароля, но не могут задать или выбрать новый пароль за пользователя. Это исключает ситуацию, при которой администратор знает пароль пользователя. | 3 | - -## V6.5 Общие требования к многофакторной аутентификации - -Этот раздел содержит общие рекомендации, применимые к различным методам многофакторной аутентификации (MFA). - -К таким механизмам относятся: - -* Lookup-секреты -* Временные одноразовые пароли (TOTP) -* Out-of-Band (внеполосные) механизмы - -Lookup-секреты — заранее сгенерированные списки одноразовых кодов, аналогичные TAN-кодам (Transaction Authorization Numbers), кодам восстановления для соцсетей или таблицам с наборами случайных значений. Эти коды считаются фактором типа «что-то, что у вас есть», поскольку они не запоминаются и должны быть где-то сохранены. - -Временные одноразовые пароли (TOTP) — аппаратные или программные токены, генерирующие постоянно меняющиеся псевдослучайные коды. Это также фактор типа «что-то, что у вас есть». MFA-варианты TOTP предполагают дополнительное подтверждение — например, PIN-код, биометрию, вставку USB-ключа, NFC или дополнительные значения (например, калькуляторы для подписания транзакций). - -Out-of-Band (внеполосные) механизмы рассматриваются в следующем разделе. - -Требования этого раздела в основном соответствуют [§ 5.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#-512-look-up-secrets), [§ 5.1.3](https://pages.nist.gov/800-63-3/sp800-63b.html#-513-out-of-band-devices), [§ 5.1.4.2](https://pages.nist.gov/800-63-3/sp800-63b.html#5142-single-factor-otp-verifiers), [§ 5.1.5.2](https://pages.nist.gov/800-63-3/sp800-63b.html#5152-multi-factor-otp-verifiers), [§ 5.2.1](https://pages.nist.gov/800-63-3/sp800-63b.html#521-physical-authenticators), и [§ 5.2.3](https://pages.nist.gov/800-63-3/sp800-63b.html#523-use-of-biometrics) [руководства NIST](https://pages.nist.gov/800-63-3/sp800-63b.html). - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **6.5.1** | Убедитесь, что lookup-секреты, внеполосные коды/запросы и TOTP-коды можно использовать только один раз. | 2 | -| **6.5.2** | Убедитесь, что при хранении lookup-секретов с энтропией менее 112 бит (например, 19 случайных буквенно-цифровых символов или 34 случайные цифры) они хэшируются с использованием разрешённого алгоритма хеширования паролей и случайной соли минимум 32 бита. Если у секрета ≥112 бит энтропии — допустимо использовать стандартный хэш. | 2 | -| **6.5.3** | Убедитесь, что lookup-секреты, коды внеполосной аутентификации и сиды для TOTP генерируются с использованием криптографически стойкого генератора случайных чисел (CSPRNG), чтобы избежать предсказуемых значений. | 2 | -| **6.5.4** | Убедитесь, что lookup-секреты и внеполосные коды аутентификации имеют минимум 20 бит энтропии (достаточно, например, 4 случайных алфавитно-цифровых символов или 6 случайных цифр). | 2 | -| **6.5.5** | Убедитесь, что все внеполосные запросы, коды и токены, а также TOTP-коды имеют ограниченный срок действия. Максимум для out-of-band — 10 минут, для TOTP — 30 секунд. | 2 | -| **6.5.6** | Убедитесь, что любой фактор аутентификации (включая физические устройства) может быть отозван в случае кражи или утери. | 3 | -| **6.5.7** | Убедитесь, что биометрические механизмы аутентификации используются только как вторичный фактор — в сочетании с «чем-то, что вы знаете» или «чем-то, что у вас есть». | 3 | -| **6.5.8** | Убедитесь, что TOTP-коды проверяются по источнику времени, полученному от доверенного сервиса, а не от клиента или недоверенного источника. | 3 | - -## V6.6 Внеполосные механизмы аутентификации - -Обычно внеполосная аутентификация предполагает, что сервер аутентификации взаимодействует с физическим устройством пользователя через безопасный вторичный канал. Например, путём отправки push-уведомления на мобильное устройство. Такой механизм считается фактором типа «что-то, что у вас есть». - -Небезопасные внеполосные методы аутентификации, такие как электронная почта и VOIP, не допускаются. Аутентификация через PSTN и SMS в настоящее время [считается ограниченной](https://pages.nist.gov/800-63-FAQ/#q-b01) по версии NIST и должна постепенно заменяться на временные одноразовые пароли (TOTP), криптографические механизмы или аналогичные средства. Руководство NIST SP 800-63B [§ 5.1.3.3](https://pages.nist.gov/800-63-3/sp800-63b.html#-5133-authentication-using-the-public-switched-telephone-network) рекомендует принимать меры против таких угроз, как замена устройства, смена SIM-карты, перенос номера и прочие аномалии, если всё же приходится использовать телефонную или SMS-аутентификацию. Хотя этот раздел ASVS не требует строго выполнять эти рекомендации, их игнорирование для чувствительных приложений уровня L2 или L3 считается серьёзным сигналом риска. - -Также стоит отметить, что NIST недавно выпустил рекомендации, в которых отговаривает от [использования push-уведомлений](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#fig-3). Хотя ASVS пока этого не запрещает, важно учитывать риск push-бомбинга (массовой отправки уведомлений для перегрузки пользователя). - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **6.6.1** | Убедитесь, что механизмы аутентификации через телефонную сеть общего пользования (PSTN) для доставки одноразовых паролей (OTP) по телефону или SMS используются только в случае предварительной валидации номера, при этом предлагаются альтернативные более безопасные методы (например, TOTP), и пользователю сообщаются риски. Для приложений уровня L3 использование телефона и SMS недопустимо. | 2 | -| **6.6.2** | Убедитесь, что внеполосные запросы, коды или токены привязаны к исходному запросу аутентификации, для которого они были сгенерированы, и не могут быть использованы повторно для других попыток. | 2 | -| **6.6.3** | Убедитесь, что внеполосные механизмы на основе кода защищены от атак методом подбора (brute force) путём применения ограничения частоты запросов (rate limiting). Также рекомендуется использовать коды с энтропией не менее 64 бит. | 2 | -| **6.6.4** | Убедитесь, что при использовании push-уведомлений для MFA применяется ограничение частоты (rate limiting), чтобы предотвратить атаки push-бомбинга. Также может помочь механизм сопоставления номеров (number matching). | 3 | - -## V6.7 Криптографические механизмы аутентификации - -Криптографические механизмы аутентификации включают, например, смарт-карты или ключи FIDO, при использовании которых пользователь должен подключить или сопрячь криптографическое устройство с компьютером для завершения аутентификации. Аутентификационный сервер отправляет случайную строку (nonce) на криптографическое устройство или программное обеспечение, и устройство или программа вычисляет ответ на основе надежно хранимого криптографического ключа. Требования в этом разделе содержат рекомендации по реализации подобных механизмов. Рекомендации по выбору криптографических алгоритмов приведены в главе «Криптография». - -Если для криптографической аутентификации используются общие или секретные ключи, они должны храниться с использованием тех же механизмов, что и другие системные секреты — как указано в разделе «Управление секретами» главы «Конфигурация». - -Требования этого раздела в основном соответствуют пункту [§ 5.1.7.2](https://pages.nist.gov/800-63-3/sp800-63b.html#sfcdv) [руководства NIST](https://pages.nist.gov/800-63-3/sp800-63b.html). - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **6.7.1** | Убедитесь, что сертификаты, используемые для проверки криптографических утверждений об аутентификации, хранятся таким образом, чтобы исключить возможность их модификации. | 3 | -| **6.7.2** | Убедитесь, что nonce (случайная строка), используемая в процессе вызова, имеет длину не менее 64 бит и является статистически уникальной или уникальной на протяжении всего срока службы криптографического устройства. | 3 | - -## V6.8 Аутентификация с использованием провайдера идентификаций (IdP) - -Провайдеры идентификаций (IdP) предоставляют пользователям федеративную идентификацию. У одного пользователя может быть несколько различных идентификаторов через разные IdP, например, корпоративная учётная запись через Azure AD, Okta, Ping Identity или Google, а также потребительская через Facebook, Twitter, Google или WeChat. Этот перечень не является рекламой данных сервисов, а лишь отражает реальность: у многих пользователей есть уже существующие идентификации. Организациям стоит учитывать возможность интеграции с такими внешними IdP в зависимости от уровня доверия к процедурам подтверждения личности у этих провайдеров. Например, государственная система вряд ли примет соцсети в качестве логина, так как там легко создать фальшивую учётную запись, а вот мобильной игре может быть полезна авторизация через соцсети для роста пользовательской базы. - -Безопасное использование внешних IdP требует тщательной настройки и проверки, чтобы не допустить подделки личности или ложных утверждений (assertions). Данный раздел описывает требования, направленные на снижение этих рисков. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **6.8.1** | Убедитесь, что при поддержке несколькими IdP, невозможно подделать личность пользователя через другой IdP (например, с тем же user ID). Стандартным способом защиты является регистрация пользователя с использованием сочетания ID самого IdP (в качестве пространства имён) и пользовательского ID внутри IdP. | 2 | -| **6.8.2** | Убедитесь, что наличие и целостность цифровой подписи в утверждениях аутентификации (например, в JWT или SAML) всегда проверяются, а неподписанные или недействительные утверждения отклоняются. | 2 | -| **6.8.3** | Убедитесь, что SAML-утверждения обрабатываются только один раз в течение периода их действия, чтобы исключить атаки воспроизведения (replay attacks). | 2 | -| **6.8.4** | Убедитесь, что если приложение использует внешний поставщик идентификации (IdP) и для определенных функций требуется особый уровень, метод или срок действия аутентификации, то приложение использует данные, возвращаемые IdP, для проверки этих условий. Например, при использовании OIDC можно проверить значения полей ID Token — acr, amr, auth_time (если они есть). Если IdP не предоставляет эти данные, приложение должно иметь документированный план действий по умолчанию, предполагающий использование минимально допустимой силы аутентификации (например, одноступенчатая — логин и пароль). | 2 | - -## Ссылки - -Для дополнительной информации см. также: - -* [NIST SP 800-63 - Digital Identity Guidelines](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-3.pdf) -* [NIST SP 800-63B - Authentication and Lifecycle Management](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf) -* [NIST SP 800-63 FAQ](https://pages.nist.gov/800-63-FAQ/) -* [OWASP Web Security Testing Guide: Testing for Authentication](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/04-Authentication_Testing) -* [OWASP Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html) -* [OWASP Forgot Password Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html) -* [OWASP Choosing and Using Security Questions Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Choosing_and_Using_Security_Questions_Cheat_Sheet.html) -* [CISA Guidance on "Number Matching"](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implement-number-matching-in-mfa-applications-508c.pdf) -* [Details on the FIDO Alliance](https://fidoalliance.org/) diff --git a/5.0/ru/0x16-V7-Session-Management.md b/5.0/ru/0x16-V7-Session-Management.md deleted file mode 100644 index 9823970c9e..0000000000 --- a/5.0/ru/0x16-V7-Session-Management.md +++ /dev/null @@ -1,91 +0,0 @@ -# V7 Управление сессиями - -## Задачи контроля - -Механизмы управления сессиями позволяют приложениям связывать взаимодействия пользователя и устройства во времени, даже при использовании протоколов без состояния (например, HTTP). Современные приложения могут использовать несколько токенов сессии с разными характеристиками и назначением. Безопасная система управления сессиями — это система, предотвращающая получение, использование или иное злоупотребление сессией жертвы злоумышленником. Приложения, поддерживающие сессии, должны соответствовать следующим концептуальным требованиям: - -* Сессии уникальны для каждого пользователя, их идентификаторы нельзя угадать, и ими нельзя «поделиться» с другими. -* Сессии становятся недействительными, когда они больше не нужны, т.е. при бездействии пользователя срок действия сессии истекает. - -Многие требования в этой главе основаны на [NIST SP 800-63 Digital Identity Guidelines](https://pages.nist.gov/800-63-4/), с фокусом на распространённые угрозы и уязвимости аутентификации. - -Обратите внимание, что конкретные требования по реализации различных механизмов управления сессиями приведены в других разделах: - -* Требования по безопасности HTTP cookies — в разделе «Безопасность веб-интерфеса». -* Требования по автономным токенам — в разделе «Автономные токены». - -## V7.1 Документация по управлению сессиями - -Нет единого шаблона, подходящего для всех приложений. Поэтому необходимо проводить анализ рисков с документированием решений по безопасности, касающихся управления сессиями, до реализации и тестирования. Это обеспечивает адаптацию системы управления сессиями к конкретным требованиям приложения. - -Независимо от того, используется ли механизм сессий с сохранением состояния (stateful) или без (stateless), анализ должен быть завершён и задокументирован, чтобы продемонстрировать соответствие всем требованиям безопасности. Также необходимо учесть взаимодействие с системами единого входа (SSO), если они используются. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **7.1.1** | Убедитесь, что тайм-аут бездействия и абсолютное максимальное время жизни сессии задокументированы, соответствуют другим контрольным мерам и сопровождаются обоснованием любых отклонений от требований повторной аутентификации NIST SP 800-63B. | 2 | -| **7.1.2** | Убедитесь, что документация определяет допустимое количество одновременных (параллельных) сессий для одного аккаунта, а также поведение системы и действия при достижении этого лимита. | 2 | -| **7.1.3** | Убедитесь, что все системы, создающие и управляющие сессиями пользователей в рамках федеративной идентификации (например, SSO), задокументированы вместе с механизмами координации сроков действия сессий, условий завершения и случаев, требующих повторной аутентификации. | 2 | - -## V7.2 Базовая безопасность сессий - -Требования этого раздела обеспечивают безопасное создание и валидацию сессионных токенов. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **7.2.1** | Убедитесь, что все проверки сессионных токенов выполняются на доверенной серверной стороне. | 1 | -| **7.2.2** | Убедитесь, что приложение использует либо автономные токены, либо ссылочные токены, которые генерируются динамически, не используя статические API-секреты или ключи. | 1 | -| **7.2.3** | Убедитесь, что ссылочные токены являются уникальными, создаются с использованием криптографически безопасного генератора псевдослучайных чисел (CSPRNG) и обладают энтропией не менее 128 бит. | 1 | -| **7.2.4** | Убедитесь, что при аутентификации пользователя (включая повторную) создается новый токен сессии, а текущий — аннулируется. | 1 | - -## V7.3 Тайм-ауты сессии - -Механизмы тайм-аутов сессии уменьшают временное окно для угонов и других атак. Тайм-ауты должны соответствовать документированным решениям по безопасности. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **7.3.1** | Убедитесь, что есть тайм-аут бездействия, после которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями. | 2 | -| **7.3.2** | Убедитесь, что установлено абсолютное максимальное время жизни сессии, по истечении которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями. | 2 | - -## V7.4 Завершение сессий - -Завершение сессии может происходить как со стороны самого приложения, так и через поставщика SSO, если управление сессиями делегировано ему. Некоторые требования этого раздела могут быть реализованы на стороне поставщика SSO. - -Завершение сессии должно требовать повторной аутентификации и быть эффективным во всех компонентах: приложении, федеративной аутентификации и других доверяющих сторонах. - -Сессии с сохранением состояния обычно аннулируются на серверной стороне. self-contained токены нужно отзывать или блокировать, иначе они могут оставаться действительными до истечения срока их действия. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **7.4.1** | Убедитесь, что после завершения сессии (logout, истечение срока) дальнейшее её использование невозможно. Для ссылочных токенов или сессий с сохранением состояния это означает аннулирование на сервере. Для self-contained токенов необходимо реализовать механизм отзыва, например, список отозванных токенов, проверку времени выпуска или ротацию ключей подписи для каждого пользователя. | 1 | -| **7.4.2** | Убедитесь, что при удалении или отключении пользователя все активные сессии немедленно завершаются. | 1 | -| **7.4.3** | Убедитесь, что после изменения или удаления факторов аутентификации (например, смена пароля или MFA) приложение предлагает завершить все другие активные сессии. | 2 | -| **7.4.4** | Убедитесь, что на всех страницах, требующих аутентификации, имеется простой и видимый способ выхода. | 2 | -| **7.4.5** | Убедитесь, что администраторы могут завершать активные сессии конкретного пользователя или всех пользователей. | 2 | - -## V7.5 Защита от злоупотреблений сессией - -Этот раздел направлен на снижение рисков при активных сессиях, включая атаки с использованием действующей сессии жертвы. - -При рассмотрении требований этого раздела нужно учитывать рекомендации для конкретных уровней, приведенные в разделе «Аутентификация» - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **7.5.1** | Убедитесь, что приложение требует полной повторной аутентификации перед изменением чувствительных атрибутов аккаунта, которые могут влиять на аутентификацию (например, email, номер телефона, настройки MFA или данных восстановления доступа). | 2 | -| **7.5.2** | Убедитесь, что пользователь может просматривать и (после повторной аутентификации хотя бы по одному фактору) завершать активные сессии. | 2 | -| **7.5.3** | Убедитесь, что перед выполнением критически важных операций приложение требует повторной аутентификации (по крайней мере, одного фактора) или дополнительной проверки. | 3 | - -## V7.6 Федеративная повторная аутентификация - -Требования для сторон, реализующих логику Relying Party (RP) и Identity Provider (IdP), основаны на [NIST SP 800-63C](https://pages.nist.gov/800-63-4/sp800-63c.html). - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **7.6.1** | Убедитесь, что срок действия и завершение сессий между RP и IdP соответствуют документации и включают повторную аутентификацию, если достигнут максимальный допустимый интервал между событиями аутентификации. | 2 | -| **7.6.2** | Убедитесь, что создание сессии требует согласия пользователя или явного действия, предотвращающего несанкционированное создание сессий без участия пользователя. | 2 | - -## Ссылки - -Для дополнительной информации см. также: - -* [OWASP Web Security Testing Guide: Session Management Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/06-Session_Management_Testing) -* [OWASP Session Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html) diff --git a/5.0/ru/0x17-V8-Authorization.md b/5.0/ru/0x17-V8-Authorization.md deleted file mode 100644 index eb25da0fc1..0000000000 --- a/5.0/ru/0x17-V8-Authorization.md +++ /dev/null @@ -1,56 +0,0 @@ -# V8 Авторизация - -## Задачи контроля - -Механизмы авторизации обеспечивают доступ только разрешённым субъектам (пользователям, сервисам и другим клиентам). Для соблюдения принципа наименьших привилегий (POLP) проверяемые приложения должны соответствовать следующим концептуальным требованиям: - -* Документировать правила авторизации, включая факторы принятия решений и контекст окружения. -* Субъекты должны иметь доступ только к тем ресурсам, на которые у них есть разрешения. - -## V8.1 Документация по авторизации - -Полная документация по авторизации необходима для обеспечения согласованного применения решений в области безопасности, возможности аудита и соответствия политикам организации. Это снижает риск несанкционированного доступа, делая требования безопасности понятными и выполнимыми для разработчиков, администраторов и тестировщиков. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **8.1.1** | Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне функций и на уровне данных на основе прав субъекта и атрибутов ресурса. | 1 | -| **8.1.2** | Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне полей (как на чтение, так и на запись) на основе прав субъекта и атрибутов ресурса. Эти правила могут зависеть от других атрибутов объекта данных, например, статуса. | 2 | -| **8.1.3** | Убедитесь, что документация определяет, какие атрибуты окружения и контекста (например, время суток, IP-адрес, местоположение, устройство) используются приложением для принятия решений в области аутентификации и авторизации. | 3 | -| **8.1.4** | Убедитесь, что документация по аутентификации и авторизации определяет, как используются факторы окружения и контекста в принятии решений, наряду с правилами доступа к функциям, данным и полям. Документация должна содержать оцениваемые атрибуты, пороговые значения риска, действия (разрешить, отказать, повысить уровень аутентификации и др.). | 3 | - -## V8.2 Архитектура авторизации - -Реализация детализированных механизмов авторизации на уровне функций, данных и полей обеспечивает субъектам наличие прав доступа только к тем компонентам, которые были им явно предоставлены. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **8.2.1** | Убедитесь, что приложение обеспечивает доступ на уровне функций (function-level) только субъектам с явными разрешениями. | 1 | -| **8.2.2** | Убедитесь, что приложение обеспечивает доступ на уровне данных (data-specific) только тем субъектам, которым явно предоставлены права к определённым элементам данных, чтобы предотвратить IDOR (Insecure Direct Object Reference) и BOLA-уязвимости (Broken Object Level Authorization). | 1 | -| **8.2.3** | Убедитесь, что приложение обеспечивает доступ на уровне полей (field-level) только тем субъектам, которым явно предоставлены права к определённым полям, чтобы предотвратить BOPLA (Broken Object Property Level Authorization). | 2 | -| **8.2.4** | Убедитесь, что реализованы адаптивные меры безопасности, основанные на атрибутах окружения и контекста субъекта (время, местоположение, IP, устройство), которые используются для принятия решений об аутентификации и авторизации, как это определено в документации приложения. Эти меры должны применяться как при попытке субъекта начать новую сессию, так и во время существующей сессии. | 3 | - -## V8.3 Авторизация на уровне операций - -Немедленное применение изменений авторизации на соответствующем уровне архитектуры критически важно для предотвращения несанкционированных действий, особенно в динамически меняющихся системах. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **8.3.1** | Убедитесь, что правила авторизации реализуются на доверенном сервисном уровне и не зависят от элементов, которые может контролировать клиент (например, JavaScript на стороне клиента). | 1 | -| **8.3.2** | Убедитесь, что изменения значений, влияющих на авторизацию, применяются немедленно. Если это невозможно (например, при использовании автономных токенов), должны быть реализованы компенсирующие меры: оповещения о попытке несанкционированного действия и откат изменений. Обратите внимание, что данный подход не предотвращает утечку информации. | 3 | -| **8.3.3** | Убедитесь, что доступ к объекту осуществляется на основе прав субъекта, инициировавшего запрос, а не прав промежуточного сервиса, действующего от его имени. Например, если пользователь обращается к веб-сервису с автономным токеном для аутентификации, а сервис затем запрашивает данные у другого сервиса, второй сервис должен использовать токен пользователя, а не токен первого сервиса для принятия решения о доступе. | 3 | - -## V8.4 Прочие аспекты авторизации - -Дополнительные меры контроля, особенно в административных интерфейсах и многопользовательских (мультитенантных) системах, помогают предотвратить несанкционированный доступ. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **8.4.1** | Убедитесь, что в мультитенантных приложениях реализованы механизмы, предотвращающие действия потребителя в отношении арендаторов, к которым у него нет доступа. | 2 | -| **8.4.2** | Убедитесь, что доступ к административным интерфейсам защищён несколькими уровнями контроля, включая непрерывную проверку личности, контроль защищённости устройства и анализ контекстных рисков. Недостаточно опираться только на IP-адрес или доверенные устройства. | 3 | - -## Ссылки - -Для дополнительной информации см. также: - -* [OWASP Web Security Testing Guide: Authorization](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/05-Authorization_Testing) -* [OWASP Authorization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html) diff --git a/5.0/ru/0x18-V9-Self-contained-Tokens.md b/5.0/ru/0x18-V9-Self-contained-Tokens.md deleted file mode 100644 index 7ca2676c0d..0000000000 --- a/5.0/ru/0x18-V9-Self-contained-Tokens.md +++ /dev/null @@ -1,36 +0,0 @@ -# V9 Автономные токены - -## Задачи контроля - -В оригинальном RFC 6749 OAuth 2.0 от 2012 года упоминается концепция автономного токена (self-contained token). Она относится к токенам, которые содержат данные или утверждения (claims), на основе которых получатель будет принимать решения по безопасности. Автономный токен следует отличать от простого токена, содержащего только идентификатор, который принимающая сторона использует для локального поиска данных. - -Наиболее распространёнными примерами автономных токенов являются JSON Web Tokens (JWTs) и SAML Assertions. Но автономные токены получили широкое распространение даже за пределами OAuth и OIDC. Безопасность этой концепции зависит от возможности проверить целостность токена и убедиться, что он действителен для конкретного контекста. Этот процесс сопряжен с множеством подводных камней, и в этой главе подробно описываются механизмы, помогающие приложениям обходить их. - -## V9.1 Источник токена и его целостность - -В данном разделе изложены требования, гарантирующие, что токен был выпущен доверенной стороной и не был модифицирован. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **9.1.1** | Убедитесь, что автономные токены проверяются на целостность с помощью цифровой подписи или MAC, прежде чем доверять их содержимому. | 1 | -| **9.1.2** | Проверяйте, что автономные токены создаются и проверяются исключительно с помощью алгоритмов из списка допустимых в данном контексте. Список допустимых алгоритмов должен включать только разрешенные алгоритмы (желательно либо только симметричные, либо только асимметричные) и ни в коем случае не содержать алгоритм None. Если необходимо поддерживать оба типа алгоритмов, потребуются дополнительные средства контроля для предотвращения путаницы с ключами (key confusion). | 1 | -| **9.1.3** | Убедитесь, что ключи, используемые для проверки автономных токенов, получены из доверенных, предварительно настроенных источников. Это предотвращает возможность указания злоумышленниками ненадёжных источников и ключей. Для JWT и других JWS структур заголовки 'jku', 'x5u' и 'jwk' должны проверяться по белому списку. | 1 | - -## V9.2 Содержимое токена - -Прежде чем принимать решения по безопасности на основе данных из токена, важно проверить два момента: что срок действия токена актуален на момент предъявления, и что токен предназначен для использования принимающим сервисом в тех целях, для которых он был передан. Это предотвращает небезопасное перекрестное использование токена между различными сервисами или использование разного типа токенов от одного и того же эмитента. - -Конкретные требования для OAuth и OIDC рассматриваются в соответствующей главе. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **9.2.1** | Убедитесь, что при указанном сроке действия токен и его содержимое принимаются только в том случае, если срок действия токена не истёк. Например, для JWT нужно проверить поля 'nbf' и 'exp'. | 1 | -| **9.2.2** | Убедитесь, что сервис, принимающий токен, проверяет его тип и соответствие назначению перед обработкой содержимого токена. Например, для принятия решений об авторизации могут быть приняты только Access Token, а для подтверждения аутентификации пользователя — только ID Token. | 2 | -| **9.2.3** | Убедитесь, что сервис принимает только токены, предназначенные для использования с этим сервисом (audience). Для JWT это можно сделать, проверив наличие утверждения «aud» по белому списку, определенному в сервисе. | 2 | -| **9.2.4** | Убедитесь, что, если эмитент токенов использует один и тот же закрытый ключ для выпуска токенов различным сервисам (audiences), выпущенные токены содержат явное указание целевых сервисов. Это предотвратит повторное использования токенов в не предназначенных для них сервисах. Если идентификатор сервиса (audience identifier) назначается динамически, эмитент токенов должен проверить audiences для исключения подмены получателей (audience impersonation). | 2 | - -## Ссылки - -Для дополнительной информации см. также: - -* [OWASP JSON Web Token Cheat Sheet for Java Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_for_Java_Cheat_Sheet.html) (но имеет полезные общие рекомендации) diff --git a/5.0/ru/0x19-V10-OAuth-and-OIDC.md b/5.0/ru/0x19-V10-OAuth-and-OIDC.md deleted file mode 100644 index 4d26a8e666..0000000000 --- a/5.0/ru/0x19-V10-OAuth-and-OIDC.md +++ /dev/null @@ -1,169 +0,0 @@ -# V10 OAuth и OIDC - -## Задачи контроля - -OAuth2 (в этой главе именуется просто OAuth) — это общепринятый отраслевой стандарт делегированной авторизации. Например, с помощью OAuth клиентское приложение может получить доступ к API (ресурсам сервера) от имени пользователя, если тот дал на это разрешение. - -Сама по себе технология OAuth не предназначена для аутентификации пользователей. Фреймворк OpenID Connect (OIDC) расширяет OAuth, добавляя слой идентификации пользователя. OIDC поддерживает такие функции, как стандартизированная информация о пользователе, единый вход (SSO) и управление сессиями. Поскольку OIDC является надстройкой над OAuth, все требования, предъявляемые к OAuth, также применимы к OIDC. - -В OAuth определены следующие роли: - -* OAuth-клиент — приложение, пытающееся получить доступ к серверным ресурсам (например, через вызов API с использованием access token). Чаще всего это серверное приложение. - * Конфиденциальный клиент (confidential client) — клиент, способный сохранять в тайне свои учетные данные (например, client_secret) для аутентификации на авторизационном сервере. - * Публичный клиент (public client) — клиент, неспособный хранить учетные данные в секрете. Вместо аутентификации (например, с использованием пары client_id и client_secret) он лишь идентифицирует себя через client_id. -* OAuth-ресурсный сервер (Resource Server, RS) — сервер API, предоставляющий ресурсы клиентам OAuth. -* OAuth-авторизационный сервер (Authorization Server, AS) — сервер, выдающий клиентам access token'ы. Эти токены позволяют клиенту получать доступ к ресурсам RS — либо от имени пользователя, либо от имени самого клиента. Часто AS — это отдельное приложение, но при необходимости может быть интегрирован в RS. -* Владелец ресурса (Resource Owner, RO) — конечный пользователь, разрешающий OAuth-клиенту ограниченный доступ к своим данным на RS. Пользователь предоставляет это разрешение через взаимодействие с AS. - -В OIDC определены следующие роли: - -* Relying Party (RP) — клиентское приложение, запрашивающее аутентификацию пользователя через OpenID-провайдера. В терминах OAuth оно также является OAuth-клиентом. -* OpenID-провайдер (OP) — авторизационный сервер OAuth, способный аутентифицировать пользователя и предоставлять RP claims в рамках OIDC. OP может быть IdP (провайдером идентификации), но в федеративных сценариях OP и IdP могут быть разными приложениями. - -Изначально OAuth и OIDC были разработаны для сторонних приложений. Однако в настоящее время они часто используются и в first-party сценариях. Например, для аутентификации и управления сессиями. В таких случаях протоколы добавляют некоторую сложность, которая может привести к новым проблемам с безопасностью. - -OAuth и OIDC могут использоваться в различных типах приложений, однако в OWASP ASVS акцент делается на веб-приложения и API. - -Поскольку OAuth и OIDC работают поверх веб-технологий, на них распространяются общие требования из других глав. Этот раздел не следует рассматривать изолированно. - -В этой главе рассматриваются лучшие современные практики OAuth2 и OIDC в ​​соответствии со спецификациями, представленными на и . Поскольку RFC часто обновляются, при применении требований, изложенных в этой главе, следует сверяться с их последними версиями. Подробнее см. в разделе «Ссылки». - -С учетом сложности темы крайне важно использовать проверенные стандартные решения (например, авторизационные серверы от крупных вендоров) и применять рекомендованные параметры безопасности. - -Терминология в этой главе соответствует RFC OAuth и спецификациям OIDC. Однако OIDC-термины используются только в OIDC-специфичных требованиях. В остальных случаях применяется терминология OAuth. - -В этом разделе под «токеном» понимается: - -* Access Token используется только ресурсным сервером (RS). Он может быть ссылочным (reference token), проверяемым через introspection, или автономным (self-contained), проверяемым через криптографически подписанный материал. -* Refresh Token используется только авторизационным сервером, выдавшим токен. -* OIDC ID Token используется только клиентским приложением, инициировавшим процесс авторизации. - -Уровни риска для некоторых требований зависят от того, является ли клиент конфиденциальным или публичным. Поскольку сильная клиентская аутентификация снижает многие риски, в случае конфиденциальных клиентов на уровне L1 возможны послабления. - -## V10.1 Общие требования безопасности OAuth и OIDC - -В этом разделе изложены универсальные архитектурные требования, применимые ко всем приложениям, использующим OAuth или OIDC. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **10.1.1** | Убедитесь, что токены передаются только тем компонентам, которым они действительно необходимы. Например, при использовании схемы backend-for-frontend для браузерных JavaScript-приложений, access и refresh токены должны быть доступны только на backend. | 2 | -| **10.1.2** | Убедитесь, что клиент принимает значения от авторизационного сервера (например, authorization code или ID Token) только если они получены в результате авторизационного потока, инициированного в той же сессии пользовательского агента и в рамках той же транзакции. Для этого клиентские секреты, такие как proof key для code exchange (PKCE) — 'code_verifier', 'state' или OIDC 'nonce' — должны быть непредсказуемыми, специфичными для транзакции и надежно привязанными как к клиенту, так и к сессии пользовательского агента, в которой началась транзакция. | 2 | - -## V10.2 Клиент OAuth - -Данные требования описывают обязанности приложений-клиентов OAuth. Клиентом может быть, например, backend веб-сервера (часто выступающий как Backend For Frontend, BFF), интеграция backend-сервиса или frontend-приложение одностраничного типа (SPA, то есть браузерное приложение). - -В общем случае backend-клиенты считаются конфиденциальными (confidential clients), а frontend — публичными (public clients). Однако нативные приложения, работающие на устройстве конечного пользователя, могут рассматриваться как конфиденциальные при использовании динамической регистрации OAuth клиента. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **10.2.1** | Убедитесь, что если используется механизм authorization code flow, OAuth клиент защищён от CSRF, вызывающих запросы токенов либо за счёт использования механизма proof key for code exchange (PKCE), либо за счёт проверки параметра 'state', который был отправлен в запросе авторизации. | 2 | -| **10.2.2** | Убедитесь, что если OAuth клиент может взаимодействовать с более чем одним сервером авторизации, у него есть защита от атак смешивания (mix-up attacks). Например, клиент должен требовать, чтобы сервер авторизации возвращал параметр 'iss' и проверять его в ответах на авторизацию и токены. | 2 | -| **10.2.3** | Убедитесь, что OAuth клиент запрашивает только необходимые области доступа (scopes) или другие параметры авторизации в запросах к серверу авторизации. | 3 | - -## V10.3 Сервер ресурсов OAuth - -В контексте ASVS и данного раздела сервер ресурсов — это API. Для обеспечения безопасного доступа сервер ресурсов должен: - -* Валидировать access token в соответствии с форматом токена и спецификациями протокола, например, валидация JWT или интроспекция OAuth токена. -* Если токен действителен, принимать решения по авторизации на основе информации из токена и предоставленных разрешений. Например, сервер ресурсов должен проверить, что клиент (действующий от имени владельца ресурса) имеет право доступа к запрошенному ресурсу. - -Таким образом, требования здесь специфичны для OAuth или OIDC и должны выполняться после валидации токена и перед принятием решения об авторизации на основе информации из токена. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **10.3.1** | Убедитесь, что сервер ресурсов принимает только те access токены, которые предназначены для использования с этим сервисом (свойство audience). Эта принадлежность сервису может быть включена в структурированный access токен (например, в поле 'aud' в JWT) или проверяться через endpoint интроспекции токена. | 2 | -| **10.3.2** | Убедитесь, что сервер ресурсов принимает решения по авторизации на основе claims из access токена, определяющих делегированную авторизацию. Если присутствуют claims, такие как 'sub', 'scope' и 'authorization_details', они должны участвовать в принятии решения. | 2 | -| **10.3.3** | Убедитесь, что если для принятия решения по контролю доступа необходимо однозначно идентифицировать пользователя из access токена (JWT или ответа интроспекции), сервер ресурсов использует claims, которые не могут быть переприсвоены другим пользователям. Обычно это комбинация claims 'iss' и 'sub'. | 2 | -| **10.3.4** | Убедитесь, что если сервер ресурсов требует определённой силы аутентификации, методов или свежести аутентификации, он проверяет, что предъявленный access токен удовлетворяет этим требованиям. Например, при наличии, могут использоваться claims OIDC 'acr', 'amr' и 'auth_time'. | 2 | -| **10.3.5** | Убедитесь, что сервер ресурсов предотвращает использование украденных access токенов или их повторное использование (replay) неавторизованными лицами, требуя access токены с подтверждением отправителя — например, Mutual TLS для OAuth 2 или OAuth 2 Demonstration of Proof of Possession (DPoP). | 3 | - -## V10.4 Сервер авторизации OAuth - -Эти требования описывают обязанности серверов авторизации OAuth, включая OpenID провайдеров. - -Для аутентификации клиента разрешён метод 'self_signed_tls_client_auth' при выполнении предварительных требований, указанных в [разделе 2.2](https://datatracker.ietf.org/doc/html/rfc8705#name-self-signed-certificate-mut) стандарта [RFC 8705](https://datatracker.ietf.org/doc/html/rfc8705). - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **10.4.1** | Убедитесь, что сервер авторизации проверяет URI перенаправления (redirect URI), сверяя его с заранее зарегистрированным списком разрешённых URI для данного клиента (allowlist), используя точное сравнение строк. | 1 | -| **10.4.2** | Убедитесь, что если сервер авторизации возвращает authorization code в ответе авторизации, этот код может быть использован только один раз для запроса токена. При втором валидном запросе с уже использованным кодом сервер должен отклонить запрос и отозвать любые токены, связанные с этим кодом. | 1 | -| **10.4.3** | Убедитесь, что authorization code имеет короткое время жизни. Максимальная продолжительность — до 10 минут для приложений L1 и L2 и до 1 минуты для приложений L3. | 1 | -| **10.4.4** | Убедитесь, что сервер авторизации для конкретного клиента разрешает использование только тех типов авторизации, которые необходимы этому клиенту. Обратите внимание, что тип авторизации Implicit flow и Resource Owner Password Credentials flow больше не должны использоваться. | 1 | -| **10.4.5** | Убедитесь, что сервер авторизации предотвращает атаки повторного использования refresh токенов для публичных клиентов, предпочтительно используя sender-constrained refresh токены, такие как DPoP или сертификат-связанные токены с mutual TLS (mTLS). Для L1 и L2 допускается ротация refresh токенов с обязательной их инвалидацией после использования. Если используется ротация, сервер должен отозвать все refresh токены при попытке использовать уже инвалидированный токен. | 1 | -| **10.4.6** | Убедитесь, что при использовании типа авторизации «Authorization Code» сервер предотвращает атаки перехвата authorization code, требуя Proof Key for Code Exchange (PKCE). В запросах авторизации сервер должен требовать валидное значение 'code_challenge' и не принимать 'code_challenge_method' со значением 'plain'. В запросах токена обязательно валидировать параметр 'code_verifier'. | 2 | -| **10.4.7** | Убедитесь, что если сервер авторизации поддерживает динамическую регистрацию клиентов без аутентификации, он минимизирует риски вредоносных клиентов. Сервер должен валидировать метаданные клиента (например, зарегистрированные URI), обеспечивать согласие пользователя и предупреждать пользователя перед обработкой запроса авторизации от недоверенного клиента. | 2 | -| **10.4.8** | Убедитесь, что refresh токены имеют абсолютный срок действия, включая случаи, когда применяется скользящее время истечения срока. | 2 | -| **10.4.9** | Убедитесь, что пользователи могут отзывать refresh токены и reference access токены через пользовательский интерфейс сервера авторизации для снижения риска от вредоносных клиентов или кражи токенов. | 2 | -| **10.4.10** | Убедитесь, что конфиденциальный клиент аутентифицируется при взаимодействии с сервером авторизации через backchannel, например при запросах токена, pushed authorization requests (PAR) и запросах на отзыв токенов. | 2 | -| **10.4.11** | Убедитесь, что конфигурация сервера авторизации назначает OAuth клиенту только необходимые области доступа (scopes). | 2 | -| **10.4.12** | Убедитесь, что для конкретного клиента сервер авторизации разрешает только те значения 'response_mode', которые необходимы этому клиенту. Например, сервер должен валидировать это значение против ожидаемых или использовать pushed authorization request (PAR) или JWT-secured Authorization Request (JAR). | 3 | -| **10.4.13** | Убедитесь, что грант типа 'code' всегда используется вместе с pushed authorization requests (PAR). | 3 | -| **10.4.14** | Убедитесь, что сервер авторизации выдаёт только sender-constrained (Proof-of-Possession) access токены, либо с сертификат-связанными токенами через mutual TLS (mTLS), либо DPoP-bound токены (Demonstration of Proof of Possession). | 3 | -| **10.4.15** | Убедитесь, что для серверного клиента (не выполняющегося на устройстве конечного пользователя) сервер авторизации проверяет, что значение параметра 'authorization_details' исходит из клиентского backend и что пользователь не изменял его. Например, это достигается использованием pushed authorization request (PAR) или JWT-secured Authorization Request (JAR). | 3 | -| **10.4.16** | Убедитесь, что клиент является конфиденциальным и сервер авторизации требует использования сильных методов аутентификации клиента (основанных на криптографии с открытым ключом и устойчивых к атакам повторного воспроизведения), таких как mutual TLS ('tls_client_auth', 'self_signed_tls_client_auth') или private key JWT ('private_key_jwt'). | 3 | - -## V10.5 Клиент OIDC - -Поскольку OIDC клиент (relying party) выступает в роли OAuth клиента, на него также распространяются требования из раздела «OAuth Client». - -Обратите внимание, что в разделе «Аутентификация с использованием провайдера идентификаций (IdP)» главы «Аутентификация» содержатся дополнительные общие требования. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **10.5.1** | Убедитесь, что клиент (relying party) защищается от повторного использования ID Token (replay-атак). Например, это достигается проверкой того, что значение 'nonce' в ID Token совпадает со значением 'nonce', отправленным в запросе аутентификации провайдеру OpenID (authorization server). | 2 | -| **10.5.2** | Убедитесь, что клиент однозначно идентифицирует пользователя по утверждениям (claims) ID Token, обычно это 'sub', который не может быть переназначен другому пользователю (в пределах конкретного провайдера идентификации). | 2 | -| **10.5.3** | Убедитесь, что клиент отклоняет попытки злоумышленного сервера авторизации выдавать себя за другой сервер авторизации через метаданные сервера авторизации. Клиент должен отклонить метаданные, если URL издателя (issuer) в метаданных не совпадает точно с преднастроенным URL издателя, ожидаемым клиентом. | 2 | -| **10.5.4** | Убедитесь, что клиент проверяет, что ID Token предназначен для него (проверка audience), сравнивая значение 'aud' в токене с 'client_id' клиента. | 2 | -| **10.5.5** | Убедитесь, что при использовании OIDC back-channel logout клиент снижает риск отказа в обслуживании, вызванный принудительным выходом из системы и путаницей между разными типами JWT (cross-JWT confusion) в процессе логаута. Клиент должен проверить, что токен выхода корректно типизирован со значением 'logout+jwt', содержит claim 'event' с правильным именем участника и не содержит 'nonce'. Также рекомендуется установить короткий срок действия токена (например, 2 минуты). | 2 | - -## V10.6 Провайдер OpenID - -Поскольку провайдеры OpenID выступают в роли OAuth серверов авторизации, на них также распространяются требования из раздела «Сервер авторизации OAuth». - -Обратите внимание, что при использовании потока ID Token (а не code flow) access токены не выдаются, и многие требования к OAuth AS в этом случае неприменимы. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **10.6.1** | Убедитесь, что провайдер OpenID допускает только значения 'code', 'ciba', 'id_token' или 'id_token code' для параметра response mode. При этом предпочтение отдаётся 'code' по сравнению с 'id_token code' (гибридный поток OIDC), а значение 'token' (любой Implicit flow) не должно использоваться. | 2 | -| **10.6.2** | Убедитесь, что провайдер OpenID предотвращает отказ в обслуживании (DoS) через принудительный выход (logout), запрашивая явное подтверждение от конечного пользователя или, если применимо, проверяя параметры в запросе выхода (инициированном relying party), например параметр 'id_token_hint'. | 2 | - -## V10.7 Управление согласием - -Эти требования касаются проверки согласия пользователя авторизационным сервером. Без правильной проверки согласия пользователя злоумышленник может получить разрешения от имени пользователя с помощью подделки или социальной инженерии. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **10.7.1** | Убедитесь, что авторизационный сервер обеспечивает получение согласия пользователя для каждого запроса авторизации. Если личность клиента не может быть подтверждена, сервер авторизации всегда должен явно запрашивать согласие пользователя. | 2 | -| **10.7.2** | Убедитесь, что при запросе согласия пользователя авторизационный сервер предоставляет достаточную и понятную информацию о том, на что даётся согласие. При необходимости это должно включать характер запрашиваемых разрешений (обычно основанных на scope, ресурсном сервере, деталях авторизации Rich Authorization Requests (RAR)), идентификацию авторизованного приложения и срок действия этих разрешений. | 2 | -| **10.7.3** | Убедитесь, что пользователь может просматривать, изменять и отзывать согласия, которые он предоставил, через авторизационный сервер. | 2 | - -## Ссылки - -Для дополнительной информации об OAuth см.: - -* [oauth.net](https://oauth.net/) -* [OWASP OAuth 2.0 Protocol Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/OAuth2_Cheat_Sheet.html) - -Для требований, связанных с OAuth, в ASVS используются следующие опубликованные и находящиеся в статусе черновика RFC: - -* [RFC6749 The OAuth 2.0 Authorization Framework](https://datatracker.ietf.org/doc/html/rfc6749) -* [RFC6750 The OAuth 2.0 Authorization Framework: Bearer Token Usage](https://datatracker.ietf.org/doc/html/rfc6750) -* [RFC6819 OAuth 2.0 Threat Model and Security Considerations](https://datatracker.ietf.org/doc/html/rfc6819) -* [RFC7636 Proof Key for Code Exchange by OAuth Public Clients](https://datatracker.ietf.org/doc/html/rfc7636) -* [RFC7591 OAuth 2.0 Dynamic Client Registration Protocol](https://datatracker.ietf.org/doc/html/rfc7591) -* [RFC8628 OAuth 2.0 Device Authorization Grant](https://datatracker.ietf.org/doc/html/rfc8628) -* [RFC8707 Resource Indicators for OAuth 2.0](https://datatracker.ietf.org/doc/html/rfc8707) -* [RFC9068 JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens](https://datatracker.ietf.org/doc/html/rfc9068) -* [RFC9126 OAuth 2.0 Pushed Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9126) -* [RFC9207 OAuth 2.0 Authorization Server Issuer Identification](https://datatracker.ietf.org/doc/html/rfc9207) -* [RFC9396 OAuth 2.0 Rich Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9396) -* [RFC9449 OAuth 2.0 Demonstrating Proof of Possession (DPoP)](https://datatracker.ietf.org/doc/html/rfc9449) -* [RFC9700 Best Current Practice for OAuth 2.0 Security](https://datatracker.ietf.org/doc/html/rfc9700) -* [draft OAuth 2.0 for Browser-Based Applications](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-browser-based-apps) -* [draft The OAuth 2.1 Authorization Framework](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-12) - -Для получения дополнительной информации об OpenID Connect см.: - -* [OpenID Connect Core 1.0](https://openid.net/specs/openid-connect-core-1_0.html) -* [FAPI 2.0 Security Profile](https://openid.net/specs/fapi-security-profile-2_0-final.html) diff --git a/5.0/ru/0x20-V11-Cryptography.md b/5.0/ru/0x20-V11-Cryptography.md deleted file mode 100644 index 9d9a9a4ff1..0000000000 --- a/5.0/ru/0x20-V11-Cryptography.md +++ /dev/null @@ -1,107 +0,0 @@ -# V11 Криптография - -## Задачи контроля - -Цель этой главы - определить наилучшие методы общего использования криптографии, а также привить фундаментальное понимание ее принципов и стимулировать переход к более устойчивым и современным подходам. В ней рассмотрены следующие пункты: - -* Внедрение надежных криптографических систем, которые являются отказоустойчивыми, адаптируются к меняющимся угрозам и ориентированы на будущее. -* Использование криптографических механизмов, которые одновременно являются безопасными и соответствуют лучшим практикам индустрии. -* Поддержка безопасной системы управления криптографическими ключами с надлежащим контролем доступа и аудитом. -* Регулярная оценка криптографической отрасли для определения рисков и соответствующей адаптации алгоритмов. -* Обнаружение и управление криптографическими сценариями использования на протяжении всего жизненного цикла приложения с целью обеспечения учёта и защиты всех криптографических ресурсов. - -В дополнение к обозначенным общим принципам и лучшим практикам данный документ также представляет более углубленную техническую информацию о требованиях в Приложении C - Стандарты криптографии. Он содержит алгоритмы и конфигурации, которые считаются «утвержденными» в соответствии с требованиями, изложенными в данном разделе. - -Требования для решения отдельных криптографических задач, таких как управление секретами или обеспечение безопасного соединения будут рассмотрены в разных частях стандарта. - -## V11.1 Инвентаризация и документирование криптографии - -Приложения должны проектироваться с использованием надёжной криптографической архитектуры для защиты данных в соответствии с их классификацией. Шифровать всё подряд — это расточительно, а не шифровать ничего — юридическая халатность. Необходимо найти баланс, который обычно достигается на этапе архитектурного или высокоуровневого проектирования, в ходе дизайн-спринтов или архитектурных исследований. Проектирование криптографии «на ходу» или доработка её после разработки приложения неизбежно приведёт к гораздо большим затратам на обеспечение безопасности, чем если бы она была заложена с самого начала. - -Важно регулярно обнаруживать, вести учёт и оценивать все криптографические активы. В приложении приведена дополнительная информация о том, как это делать. - -Также критически важно подготовить криптографические системы к будущему появлению квантовых компьютеров. Постквантовая криптография (Post-Quantum Cryptography, PQC) — это криптографические алгоритмы, разработанные так, чтобы оставаться надёжными против атак квантовых компьютеров, которые, как ожидается, смогут взламывать широко используемые алгоритмы, такие как RSA и эллиптические кривые (ECC). - -В приложении также содержатся текущие рекомендации по проверенным PQC-примитивам и стандартам. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **11.1.1** | Убедитесь, что задокументирована политика управления криптографическими ключами и описан их жизненный цикл в соответствии со стандартом управления ключей, таким как NIST SP 800-57. Убедитесь, что ключи известны только тем сущностям, которым они должны быть доступны (например, ключи не передавались более чем двум участникам для общих секретов и более чем одному участнику для приватных ключей). | 2 | -| **11.1.2** | Убедитесь, что проводится инвентаризация криптографических средств, которая непрерывно поддерживается, регулярно обновляется и включает все криптографические ключи, алгоритмы и сертификаты, используемые в приложении. Также должна быть задокументирована информация о том, где ключи могут и не могут использоваться в системе, а также какие типы данных могут и не могут быть защищены с помощью этих ключей. | 2 | -| **11.1.3** | Убедитесь, что используются механизмы обнаружения криптографии для идентификации всех случаев применения криптографии в системе , включая операции шифрования, хеширования и цифровой подписи. | 3 | -| **11.1.4** | Убедитесь, что ведётся и поддерживается инвентаризация криптографических средств. В неё должен входить документированный план, описывающий переход на новые криптографические стандарты, такие как постквантовая криптография, чтобы своевременно реагировать на будущие угрозы. | 3 | - -## V11.2 Безопасная реализация криптографии - -Данный раздел содержит требования для определения (выбора), реализации и дальнейшего управления основными криптографическими алгоритмами в приложении. Основная цель - убедиться в том, что используются исключительно надежные, утвержденные криптографические примитивы в соответствии с текущими стандартами (н-р, NIST, ISO/IEC) и лучшими практиками разработки. Организации должны убедиться, что каждый криптографический компонент выбран с учетом рецензируемых исследований и практического тестирования безопасности. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **11.2.1** | Убедитесь, что для криптографических операций используются утвержденные в индустрии реализации (включая библиотеки и аппаратные реализации). | 2 | -| **11.2.2** | Убедитесь, что архитектура приложения поддерживает быструю реконфигурацию, усовершенствование или смену в любой момент случайных чисел, аутентифицированного шифрования, MAC, алгоритмов хеширования, длин ключей, количества раундов, шифров и режимов шифрования для защиты от криптографических атак. Также должна поддерживаться возможность смены ключей, паролей и повторного шифрования данных. Это позволит беспрепятственно перейти на постквантовую криптографию (PQC), как только станут широко доступны высоконадёжные реализации одобренных схем или стандартов PQC. | 2 | -| **11.2.3** | Убедитесь, что все криптографические примитивы используют как минимум 128-бит стойкости с учетом алгоритма, размера ключа и конфигурации. Например, 256-битный ECC ключ обеспечивает примерно 128 бит безопасности, тогда как для достижения того же уровня безопасности в RSA требуется ключ длиной 3072 бита. | 2 | -| **11.2.4** | Убедитесь, что все криптографические операции выполняются за константное время, без использования «short-circuit» операций в сравнениях, вычислениях, возвратах функций для избежания утечек информации. | 3 | -| **11.2.5** | Убедитесь, что все криптографические модули обеспечивают безопасное завершение работы при ошибках, а обработка ошибок реализована таким образом, чтобы не создавать уязвимостей, например, таких как атаки Padding Oracle. | 3 | - -## V11.3 Алгоритмы шифрования - -Алгоритмы аутентифицированного шифрования на основе AES и ChaCha20 составляют основу современной криптографической практики. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **11.3.1** | Убедитесь, что не используются небезопасные режимы блочного шифрования (н-р, ECB) и слабые схемы дополнения (padding) (н-р, PKCS#1 v1.5). | 1 | -| **11.3.2** | Убедитесь, что используются только утверждённые шифры и режимы, такие как AES с GCM. | 1 | -| **11.3.3** | Убедитесь, что зашифрованные данные защищены от несанкционированного изменения, предпочтительно с использованием утверждённого метода аутентифицированного шифрования или путём комбинирования утверждённого метода шифрования с утверждённым алгоритмом MAC. | 2 | -| **11.3.4** | Убедитесь, что случайные числа (nonce), векторы инициализации (IV) и другие одноразовые числа не используются более одного раза для одной и той же пары ключа шифрования и элемента данных. Метод их генерации должен соответствовать требованиям используемого алгоритма. | 3 | -| **11.3.5** | Убедитесь, что любая комбинация алгоритма шифрования и алгоритма MAC работает в режиме encrypt-then-MAC (EtM). | 3 | - -## V11.4 Хеширование и функции на основе хеширования - -Криптографические хеш-функции применяются во множестве криптографических протоколов, таких как цифровые подписи, HMAC, функции генерации ключа (KDF), генерация случайных битов и хранение паролей. Безопасность криптографической системы напрямую зависит от стойкости используемых хеш-функций. В этом разделе изложены требования к использованию надёжных хеш-функций в криптографических операциях. - -Для рекомендаций по хранению паролей, вместе с Приложениием C - Стандарты криптографии, рекомендуем использовать [OWASP Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#password-hashing-algorithms) - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **11.4.1** | Убедитесь, что только утвержденные хэш-функции используются для стандартных сценариев использования в криптографии, включая цифровую подпись, HMAC, KDF, генерацию случайных чисел. Запрещено использовать неустойчивые хэш-функции, (н-р, MD5) для любого использования в криптографии. | 1 | -| **11.4.2** | Убедитесь, что пароли хранятся с использованием утверждённой, вычислительно затратной функции генерации ключа (также известной как «функция хеширования паролей»), с параметрами, настроенными в соответствии с актуальными рекомендациями. Настройки должны обеспечивать баланс между безопасностью и производительностью, чтобы сделать атаки перебором достаточно сложными для требуемого уровня безопасности. | 2 | -| **11.4.3** | Убедитесь, что хэш-функции, используемые в формировании цифровой подписи, как часть аутентификации и целостности данных, устойчивы к коллизиям и имеют достаточную длину. | 2 | -| **11.4.4** | Убедитесь, что приложение использует утвержденную функцию генерации ключа с использованием параметров расширения ключа (key stretching) при генерации ключа из пароля. Параметры должны быть сбалансированы с точки зрения безопасности, производительности и устойчивости к атакам полного перебора при компрометации результирующего криптографического ключа. | 2 | - -## V11.5 Случайные значения - -Криптографически стойкая генерация псевдослучайных чисел (Cryptographically secure Pseudo-random Number Generation (CSPRNG)) чрезвычайно сложна для правильной реализации. Как правило, хорошие источники энтропии в системе быстро истощаются при чрезмерном использовании, тогда как источники с меньшей степенью случайности могут приводить к предсказуемым ключам и секретам. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **11.5.1** | Убедитесь, что все случайные числа и строки, которые должны быть непредсказуемы, должны быть сгенерированы с помощью CSPRNG и иметь хотя бы 128 бит энтропии. Учтите, что UUID не удовлетворяют данному условию. | 2 | -| **11.5.2** | Убедитесь, что механизм генерации случайных чисел является надежным даже при высокой нагрузке. | 3 | - -## V11.6 Криптография с публичным ключом - -Криптография с публичным ключом используется там, где невозможно или нежелательно распределять ключ между несколькими сторонами. - -Также существует потребность в утвержденных методах обмена ключами, таких как Diffie-Hellman (DH) и Elliptic Curve Diffie-Hellman (ECDH), чтобы убедиться, что криптосистема остается безопасной к современным угрозам. Раздел «Безопасная коммуникация» содержит требования для TLS, так что требования данной секции применимы в ситуациях, где криптография с открытым ключом используется отдельно от TLS. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **11.6.1** | Убедитесь, что только утвержденные криптографические алгоритмы и режимы операций используются для генерации ключа и инициализации случайного значения для его генерации (seeding), а также для генерации цифровой подписи и верификации. Алгоритмы генерации ключей не должны генерировать небезопасные ключи уязвимые к известным атакам, например, ключи RSA уязвимы к факторизации Ферма. | 2 | -| **11.6.2** | Убедитесь, что для обмена ключами используются утверждённые криптографические алгоритмы (например, Диффи-Хеллман) с особым вниманием к обеспечению использования безопасных параметров. Это предотвратит атаки на процесс установления ключа, которые могут привести к атакам «человек посередине» или криптографическим взломам. | 3 | - -## V11.7 Шифрование данных в процессе использования - -Защита данных во время их обработки имеет первостепенное значение. Рекомендуется использовать такие методы, как полное шифрование памяти, шифрование данных при передаче, а также обеспечение как можно более быстрого шифрования данных после их использования. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **11.7.1** | Убедитесь, что используется полное шифрование памяти, которое защищает конфиденциальные данные во время их использования, предотвращая доступ к ним неавторизованных пользователей или процессов. | 3 | -| **11.7.2** | Убедитесь, что минимизация данных обеспечивает раскрытие минимально необходимого объёма данных во время обработки, а также что данные шифруются сразу после использования или как можно скорее. | 3 | - -## Ссылки - -Для дополнительной информации см. также: - -* [OWASP Web Security Testing Guide: Testing for Weak Cryptography](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography) -* [OWASP Cryptographic Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html) -* [FIPS 140-3](https://csrc.nist.gov/pubs/fips/140-3/final) -* [NIST SP 800-57](https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final) diff --git a/5.0/ru/0x21-V12-Secure-Communication.md b/5.0/ru/0x21-V12-Secure-Communication.md deleted file mode 100644 index 531de161f5..0000000000 --- a/5.0/ru/0x21-V12-Secure-Communication.md +++ /dev/null @@ -1,57 +0,0 @@ -# V12 Безопасная коммуникация - -## Задачи контроля - -В этой главе изложены требования, связанные с механизмами защиты данных при передаче, как между клиентом конечного пользователя и серверной частью, так и между компонентами внутренней сервисной архитектуры. - -Основные концепции главы: - -* Шифрование внешних коммуникаций, а в идеале — и внутри системы. -* Настройку механизмов шифрования в соответствии с актуальными рекомендациями, включая предпочтительные алгоритмы и шифры. -* Использование подписанных сертификатов для защиты от перехвата данных третьими лицами. - -Кроме того, помимо общих принципов и лучших практик, ASVS предоставляет более глубокую техническую информацию о криптографической стойкости в Приложении C - Стандарты криптографии. - -## V12.1 Общие рекомендации по безопасности TLS - -В этом разделе приводятся первоначальные рекомендации по обеспечению безопасности TLS-соединений. Для постоянного контроля конфигурации TLS следует использовать актуальные инструменты. - -Хотя использование универсальных (wildcard) TLS-сертификатов само по себе не является небезопасным, компрометация такого сертификата, который используется во всех управляемых окружениях (например, в production, staging, development, test), может привести к нарушению безопасности приложений, использующих этот сертификат. Поэтому при возможности рекомендуется применять надёжную защиту, управление и использовать отдельные TLS-сертификаты для разных сред. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **12.1.1** | Убедитесь, что включены только актуальные и рекомендуемые версии протокола TLS, такие как TLS 1.2 и TLS 1.3. Наиболее свежая версия TLS должна быть выбрана как предпочтительная. | 1 | -| **12.1.2** | Убедитесь, что включены рекомендуемые шифронаборы (cipher suites), предпочтение также стоит отдать самому сильному шифронабору. L3 приложения должны поддерживать только те наборы шифров (cipher suites), которые обеспечивают прямую (forward) секретность. Пояснение: Прямая секретность (Forward Secrecy, FS) — это криптографическая особенность, при которой сессионные ключи уникальны для каждой сессии и не зависят от долгосрочных ключей. Это гарантирует, что даже при компрометации долгосрочного ключа злоумышленник не сможет расшифровать ранее перехваченные зашифрованные сессии. | 2 | -| **12.1.3** | Убедитесь, что приложение проверяет доверенность клиентских сертификатов mTLS, прежде чем использовать идентификацию по сертификату для аутентификации или авторизации. | 2 | -| **12.1.4** | Убедитесь, что включена и настроена правильная проверка отзыва сертификатов, такая как Online Certificate Status Protocol (OCSP) Stapling. | 3 | -| **12.1.5** | Убедитесь, что в настройках TLS приложения включена функция Encrypted Client Hello (ECH) для предотвращения раскрытия конфиденциальных метаданных, таких как Server Name Indication (SNI), во время процесса TLS-рукопожатия. | 3 | - -## V12.2 HTTPS коммуникация с внешними сервисами - -Убедитесь, что весь HTTP-трафик к внешним сервисам, которые предоставляет приложение, передавался в зашифрованном виде с использованием публично доверенных сертификатов. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **12.2.1** | Убедитесь, что для всех соединений между клиентом и внешними HTTP-сервисами используется TLS и не происходит отката к небезопасным или незашифрованным протоколам. | 1 | -| **12.2.2** | Убедитесь, что внешние сервисы используют публично доверенные TLS-сертификаты. | 1 | - -## V12.3 Общая безопасность межсервисного взаимодействия - -Все взаимодействия между серверами (включая внутренние и внешние подключения) должны быть защищены, предпочтительно с применением TLS-шифрования. Соединения с другими системами также должны быть защищены, желательно с использованием TLS. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **12.3.1** | Убедитесь, что для всех входящих и исходящих соединений приложения используется зашифрованный протокол, например TLS, включая системы мониторинга, инструменты управления, удалённый доступ и SSH, промежуточное ПО, базы данных, мейнфреймы, партнёрские системы и внешние API. Сервер не должен допускать откат к небезопасным или незашифрованным протоколам. | 2 | -| **12.3.2** | Убедитесь, что TLS-клиент проверяет сертификат сервера до установления защищенного соединения с TLS-сервером. | 2 | -| **12.3.3** | Убедитесь, что все внутренние HTTP-взаимодействия между компонентами приложения используют TLS или другой подходящий механизм транспортного шифрования, и не происходит откат к небезопасным или незашифрованным коммуникациям. | 2 | -| **12.3.4** | Убедитесь, что TLS-соединения между внутренними сервисами используют доверенные сертификаты. Если используются внутренние или самоподписанные сертификаты, потребляющий сервис должен быть настроен на доверие только к конкретным внутренним центрам сертификации (CA) и конкретным самоподписанным сертификатам. | 2 | -| **12.3.5** | Убедитесь, что сервисы, взаимодействующие внутри системы (intra-service communications), используют строгую аутентификацию для проверки каждого конечного узла. Для проверки подлинности взаимодействующих сторон должны применяться методы строгой аутентификации, такие как аутентификация TLS-клиента, с использованием инфраструктуры открытых ключей и механизмов, устойчивых к атакам повтора (replay attacks). Для микросервисных архитектур рекомендуется использование service mesh для упрощения управления сертификатами и повышения безопасности. | 3 | - -## Ссылки - -Для дополнительной информации см. также: - -* [OWASP - Transport Layer Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html) -* [Mozilla's Server Side TLS configuration guide](https://wiki.mozilla.org/Security/Server_Side_TLS) -* [Mozilla's tool to generate known good TLS configurations](https://ssl-config.mozilla.org/). -* [O-Saft - OWASP Project to validate TLS configuration](https://owasp.org/www-project-o-saft/) diff --git a/5.0/ru/0x22-V13-Configuration.md b/5.0/ru/0x22-V13-Configuration.md deleted file mode 100644 index 79b0cf80a5..0000000000 --- a/5.0/ru/0x22-V13-Configuration.md +++ /dev/null @@ -1,68 +0,0 @@ -# V13 Конфигурация - -## Задачи контроля - -Стандартная конфигурация приложения должна быть безопасной для использования в Интернете. - -В этой главе приводятся рекомендации по различным настройкам, необходимым для достижения этого, включая те, которые применяются на этапах разработки, сборки и развертывания. - -Рассматриваемые темы включают предотвращение утечек данных, безопасное управление коммуникациями между компонентами и защиту секретов. - -## V13.1 Документация конфигурации - -Этот раздел описывает требования к документации, связанные с тем, как приложение взаимодействует с внутренними и внешними сервисами, а также методы предотвращения потери доступности из-за недоступности сервисов. Также рассматриваются вопросы, касающиеся документации секретных данных. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **13.1.1** | Убедитесь, что все необходимые доступы приложения задокументированы. Сюда должны быть включены как внешние сервисы, от которых зависит приложение, так и сценарии, когда конечный пользователь может задавать адреса для внешнего подключения. | 2 | -| **13.1.2** | Убедитесь, что для каждого сервиса, используемого приложением, в документации определено максимальное количество одновременных соединений (например, лимиты пула соединений) и описано поведение приложения при достижении этого лимита, включая любые механизмы отказоустойчивости или восстановления, чтобы предотвратить ситуации отказа в обслуживании (DoS). | 3 | -| **13.1.3** | Убедитесь, что в документации приложения определены стратегии управления ресурсами для каждой внешней системы или сервиса, которые оно использует (например, базы данных, файловые дескрипторы, потоки, HTTP-соединения). Стратегии должны включать процедуры освобождения ресурсов, настройки таймаутов, обработку сбоев, а также, если реализована логика повторных попыток, указание лимитов, задержек и алгоритмов back-off. Для синхронных HTTP-запросов должны быть заданы короткие таймауты, а повторные запросы должны быть отключены, либо строго ограничены по числу попыток, чтобы предотвратить каскадные задержки и истощение ресурсов. | 3 | -| **13.1.4** | Убедитесь, что в документации приложения определены секреты, критически важные для безопасности приложения, а также установлен график их ротации в соответствии с моделью угроз организации и её бизнес-требованиями. | 3 | - -## V13.2 Конфигурация бэкенд соединений - -Приложения взаимодействуют с множеством сервисов, включая API, базы данных и другие компоненты. Эти сервисы могут считаться внутренними для приложения, но не включёнными в стандартные механизмы контроля доступа приложения, либо быть полностью внешними. В любом случае необходимо настроить приложение для безопасного взаимодействия с этими компонентами и, при необходимости, защитить соответствующую конфигурацию. - -Важно: Глава «Безопасная коммуникация» содержит рекомендации по шифрованию данных при передаче. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **13.2.1** | Убедитесь, что коммуникации между компонентами бэкенда приложения (включая API, промежуточное ПО и уровни данных), которые не поддерживают стандартный механизм пользовательских сессий, проходят с аутентификацией. Аутентификация должна использовать индивидуальные сервисные аккаунты, краткосрочные токены или аутентификацию на основе сертификатов, а не постоянные учётные данные, такие как пароли, API-ключи или общие аккаунты с привилегированным доступом. | 2 | -| **13.2.2** | Убедитесь, что коммуникации между компонентами бэкенда приложения, включая локальные или системные службы, API, промежуточное ПО и уровни данных, выполняются с использованием аккаунтов, которым назначены минимально необходимые привилегии. | 2 | -| **13.2.3** | Убедитесь, что если для аутентификации в сервисе используются учётные данные, то используемые потребителем учётные данные не являются стандартными (например, root/root или admin/admin). | 2 | -| **13.2.4** | Убедитесь, что используется белый список (allowlist) для определения внешних ресурсов или систем, с которыми приложению разрешено взаимодействовать (например, для исходящих запросов, загрузки данных или доступа к файлам). Этот белый список может быть реализован на уровне приложения, веб-сервера, межсетевого экрана или комбинации различных уровней. | 2 | -| **13.2.5** | Убедитесь, что веб- или прикладной сервер настроен с белым списком ресурсов или систем, к которым сервер может отправлять запросы или из которых может загружать данные и файлы. | 2 | -| **13.2.6** | Убедитесь, что при подключении приложения к другим сервисам соблюдается задокументированная конфигурация для каждого соединения, включая максимальное количество параллельных соединений, поведение при достижении их максимума, таймауты и стратегии повторных попыток подключения. | 3 | - -## V13.3 Управление секретами - -Управление секретами — это важная задача конфигурации, необходимая для обеспечения защиты данных, используемых в приложении. Конкретные требования к криптографии изложены в главе «Криптография», а данный раздел сосредоточен на аспектах управления и обработки секретов. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **13.3.1** | Убедитесь, что для безопасного создания, хранения, контроля доступа и уничтожения секретов бэкенда используется решение для управления секретами, например, хранилище ключей (key vault). Секретами могут быть пароли, ключевой материал, интеграции с базами данных и сторонними системами, ключи и seed-значения для токенов с ограниченным временем действия, другие внутренние секреты и API-ключи. Секреты не должны включаться в исходный код приложения или артефакты сборки. Для приложений уровня L3 необходимо использовать аппаратное решение, например, аппаратный модуль безопасности (HSM). | 2 | -| **13.3.2** | Убедитесь, что доступ к секретным ресурсам осуществляется в соответствии с принципом минимально необходимых привилегий (least privilege). | 2 | -| **13.3.3** | Убедитесь, что все криптографические операции выполняются с использованием изолированного модуля безопасности (например, хранилища ключей или аппаратного модуля безопасности), чтобы надежно управлять ключевым материалом и защищать его от утечки за пределы модуля безопасности. | 3 | -| **13.3.4** | Убедитесь, что секреты настроены на срок действия и ротацию в соответствии с документацией приложения. | 3 | - -## V13.4 Непреднамеренная утечка информации - -Конфигурации в промышленной среде должны быть усилены, чтобы избежать раскрытия избыточных данных. Многие из подобных проблем редко оцениваются как значительные риски, но часто используются в связке с другими уязвимостями. Если таких проблем нет по умолчанию, это повышает уровень защиты приложения. - -Например, скрытие версии серверных компонентов не отменяет необходимости обновлять все компоненты, а отключение отображения содержимого папок не исключает необходимости использовать механизмы авторизации или хранить файлы вне публичных каталогов, но всё это повышает уровень безопасности. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **13.4.1** | Убедитесь, что приложение развернуто либо без метаданных систем контроля версий (включая папки .git или .svn), либо так, чтобы эти папки были недоступны как извне, так и для самого приложения. | 1 | -| **13.4.2** | Убедитесь, что режимы отладки отключены для всех компонентов в промышленной среде, чтобы предотвратить раскрытие функций отладки и утечку информации. | 2 | -| **13.4.3** | Убедитесь, что веб-серверы не показывают клиентам списки содержимого каталогов, если это явно не предусмотрено. | 2 | -| **13.4.4** | Убедитесь, что метод HTTP TRACE не поддерживается в продуктовой среде, чтобы избежать потенциальной утечки информации. | 2 | -| **13.4.5** | Убедитесь, что документация (например, по внутренним API) и мониторинговые эндпоинты не доступны, если это явно не предусмотрено. | 2 | -| **13.4.6** | Убедитесь, что приложение не раскрывает подробную информацию о версиях компонентов бэкенда. | 3 | -| **13.4.7** | Убедитесь, что веб-слой настроен на обслуживание только файлов с определёнными расширениями, чтобы предотвратить непреднамеренную утечку информации, конфигураций и исходного кода. | 3 | - -## Ссылки - -Для дополнительной информации см. также: - -* [OWASP Web Security Testing Guide: Configuration and Deployment Management Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing) diff --git a/5.0/ru/0x23-V14-Data-Protection.md b/5.0/ru/0x23-V14-Data-Protection.md deleted file mode 100644 index b403f6c5be..0000000000 --- a/5.0/ru/0x23-V14-Data-Protection.md +++ /dev/null @@ -1,60 +0,0 @@ -# V14 Защита информации - -## Задачи контроля - -Приложения не могут предусмотреть все сценарии использования и поведение пользователей, поэтому они должны реализовывать механизмы, ограничивающие несанкционированный доступ к конфиденциальным данным на устройствах клиентов. - -В эту главу входят требования, связанные с определением перечня данных, подлежащих защите, методы их защиты, а также конкретные механизмы реализации и ошибки, которых следует избегать. - -Ещё один важный аспект защиты данных — предотвращение массового извлечения, изменения или чрезмерного использования данных. Требования для каждой системы, вероятно, будут сильно различаться, поэтому определение «аномального» поведения должно основываться на модели угроз и бизнес-рисках. С точки зрения ASVS, обнаружение таких проблем рассматривается в главе «Журналирование событий безопасности и обработка ошибок», а установка ограничений — в главе «Валидация и бизнес-логика». - -## V14.1 Документация по защите информации - -Ключевым условием для защиты данных является классификация данных по уровню конфиденциальности. Данные следует классифицировать по нескольким уровням конфиденциальности, где для каждого уровня требуются разные меры защиты. - -Существует множество законов и нормативных актов в области защиты персональных данных, которые определяют то, как приложения должны подходить к хранению, использованию и передаче конфиденциальных данных. Этот раздел не пытается дублировать такие законы и нормы, а сосредоточен на ключевых технических аспектах защиты чувствительных данных. При работе с данными следует учитывать требования местного законодательства и нормативных актов, а при необходимости консультироваться с профильным специалистом по защите данных или юристом. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **14.1.1** | Убедитесь, что все конфиденциальные данные, создаваемые и обрабатываемые приложением, идентифицированы и классифицированы по уровням защиты. Включая закодированные данные, которые легко декодируются, например, строки Base64 или незашифрованные данные в полезной нагрузке JWT. Уровни защиты должны учитывать требования по защите данных и конфиденциальности, которым должно соответствовать приложение. | 2 | -| **14.1.2** | Убедитесь, что для каждого уровня защиты конфиденциальных данных требования к защите задокументированы. Они должны включать (но не ограничиваться) требования по шифрованию, проверке целостности, срокам хранения, способам логирования данных, контролю доступа к чувствительным данным в логах, шифрованию на уровне базы данных, применению технологий повышения конфиденциальности, а также другим требованиям по конфиденциальности. | 2 | - -## V14.2 Базовые меры по защите информации - -Этот раздел содержит различные практические требования, связанные с защитой данных. Большинство из них направлены на непреднамеренную утечку данных, но также есть общее требование — реализовывать меры защиты в зависимости от необходимого уровня защиты для каждого типа данных. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **14.2.1** | Убедитесь, что конфиденциальные данные передаются на сервер только в теле HTTP-запроса или в заголовках. URL и строка запроса не должны содержать конфиденциальную информацию, такую как API-ключ или сессионный токен. | 1 | -| **14.2.2** | Убедитесь, что приложение предотвращает кэширование конфиденциальных данных в серверных компонентах, таких как балансировщики нагрузки и кэши приложений, либо гарантирует их надежное удаление после использования. | 2 | -| **14.2.3** | Убедитесь, что заранее определённые конфиденциальные данные не отправляются ненадёжным сторонам (например, системам трекинга пользователей), чтобы предотвратить нежелательный сбор данных вне контроля приложения. | 2 | -| **14.2.4** | Убедитесь, что для конфиденциальных данных реализованы меры по шифрованию, проверке целостности, срокам хранения, способам логирования, контролю доступа к данным в логах, а также применяются технологии повышения конфиденциальности в соответствии с документацией для соответствующего уровня защиты данных. | 2 | -| **14.2.5** | Убедитесь, что механизмы кэширования настроены так, чтобы кэшировать только ответы с ожидаемым типом содержимого для данного ресурса и не содержать конфиденциального динамического контента. При обращении к несуществующему файлу, веб-сервер должен возвращать ответ 404 или 302, а не подменять на другой существующий файл, что позволит предотвратить атаки типа Web Cache Deception. | 3 | -| **14.2.6** | Убедитесь, что приложение возвращает только минимально необходимый объем конфиденциальных данных для выполнения своей функциональности. Например, показывает только часть цифр номера кредитной карты, а не полный номер. Если требуется отображение полных данных, они должны быть замаскированы в пользовательском интерфейсе, пока пользователь специально не запросил их просмотр. | 3 | -| **14.2.7** | Убедитесь, что конфиденциальная информация подлежит классификации по срокам хранения, чтобы устаревшие или ненужные данные удалялись автоматически, по расписанию или по мере необходимости. | 3 | -| **14.2.8** | Убедитесь, что конфиденциальная информация удаляется из метаданных файлов, загружаемых пользователями, если пользователь явно не согласился на ее хранение. | 3 | - -## V14.3 Защита данных на стороне клиента - -В этом разделе содержатся требования, направленные на предотвращение утечки данных на стороне клиента или user agent приложения. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **14.3.1** | Убедитесь, что аутентифицированные данные очищаются из клиентского хранилища, например, из DOM браузера, после завершения работы клиента или сессии. Заголовок HTTP-ответа Clear-Site-Data может помочь в этом, но клиентская сторона также должна уметь очищать данные, если соединение с сервером недоступно при завершении сессии. | 1 | -| **14.3.2** | Убедитесь, что приложение устанавливает HTTP-заголовки, достаточные для предотвращения кэширования (например, Cache-Control: no-store), чтобы конфиденциальные данные не сохранялись в браузерах. | 2 | -| **14.3.3** | Убедитесь, что данные, хранящиеся в браузерном хранилище (например, localStorage, sessionStorage, IndexedDB или cookie), не содержат конфиденциальной информации, за исключением сессионных токенов. | 2 | - -## Ссылки - -Для дополнительной информации см. также: - -* [Consider using the Security Headers website to check security and anti-caching header fields](https://securityheaders.com/) -* [Documentation about anti-caching headers by Mozilla](https://developer.mozilla.org/en-US/docs/Web/HTTP/Caching) -* [OWASP Secure Headers project](https://owasp.org/www-project-secure-headers/) -* [OWASP Privacy Risks Project](https://owasp.org/www-project-top-10-privacy-risks/) -* [OWASP User Privacy Protection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/User_Privacy_Protection_Cheat_Sheet.html) -* [Australian Privacy Principle 11 - Security of personal information](https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-11-app-11-security-of-personal-information) -* [European Union General Data Protection Regulation (GDPR) overview](https://www.edps.europa.eu/data-protection_en) -* [European Union Data Protection Supervisor - Internet Privacy Engineering Network](https://www.edps.europa.eu/data-protection/ipen-internet-privacy-engineering-network_en) -* [Information on the "Clear-Site-Data" header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Clear-Site-Data) -* [White paper on Web Cache Deception](https://www.blackhat.com/docs/us-17/wednesday/us-17-Gil-Web-Cache-Deception-Attack-wp.pdf) diff --git a/5.0/ru/0x24-V15-Secure-Coding-and-Architecture.md b/5.0/ru/0x24-V15-Secure-Coding-and-Architecture.md deleted file mode 100644 index 49a5c2c210..0000000000 --- a/5.0/ru/0x24-V15-Secure-Coding-and-Architecture.md +++ /dev/null @@ -1,77 +0,0 @@ -# V15 Безопасная разработка и архитектура - -## Задачи контроля - -Многие требования ASVS относятся либо к конкретной области безопасности, такой как аутентификация или авторизация, либо к определённому типу функциональности приложения, например, к логированию или работе с файлами. - -В этой главе представлены общие требования безопасности, которые следует учитывать при проектировании и разработке приложений. Эти требования касаются не только чистоты архитектуры и качества кода, но и конкретных практик проектирования и программирования, необходимых для обеспечения безопасности приложений. - -## V15.1 Документация по безопасной разработке и архитектуре - -Многие требования по созданию безопасной и защищенной архитектуры зависят от четкого документирования решений, принятых в отношении реализации конкретных механизмов безопасности и компонентов, используемых в приложении. - -В этом разделе излагаются требования к документации, включая определение компонентов, которые считаются содержащими «опасную функциональность» или «рискованными компонентами». - -Компонент с «опасной функциональностью» может быть разработан внутри компании или представлять собой внешнюю зависимость, который выполняет такие операции, как десериализация ненадежных данных, парсинг необработанных файлов или двоичных данных, динамическое выполнение кода или непосредственное управление памятью. Уязвимости в таких операциях создают высокий риск компрометации приложения и его инфраструктуры. - -«Компонент с повышенным риском» — это сторонняя библиотека (т.е. не разработанная внутри компании) с отсутствующими или неэффективно реализованными средствами контроля безопасности в отношении процессов разработки или функциональности. Примерами служат компоненты, которые не поддерживаются, находятся на этапе завершения жизненного цикла или ранее содержали серьезные уязвимости. - -В этом разделе также подчеркивается важность определения соответствующих сроков устранения уязвимостей в сторонних компонентах. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **15.1.1** | Убедитесь, что в документации по приложению определены сроки устранения уязвимостей на основе оценки рисков для внешних зависимостей с уязвимостями и для обновления библиотек в целом, чтобы минимизировать риск, связанный с этими компонентами. | 1 | -| **15.1.2** | Убедитесь, что ведется реестр всех используемых сторонних библиотек (например, Software Bill of Materials, SBOM), с обязательной проверкой, что компоненты получены из предопределенных, доверенных и регулярно поддерживаемых репозиториев. | 2 | -| **15.1.3** | Убедитесь, что в документации приложения указан функционал, требующий значительных временных или вычислительных ресурсов. Необходимо указать, как предотвратить потерю доступности из-за чрезмерного использования этого функционала и как избежать ситуаций, когда формирование ответа занимает больше времени, чем установленный системой таймаут. Возможные меры защиты могут включать асинхронную обработку, использование очередей и ограничение количества параллельных процессов для каждого пользователя и приложения. | 2 | -| **15.1.4** | Убедитесь, что в документации приложения указаны внешние библиотеки, которые считаются «компонентами с повышенным риском». | 3 | -| **15.1.5** | Убедитесь, что в документации приложения выделены те части приложения, в которых используются «функционал с повышенным риском». | 3 | - -## V15.2 Архитектура безопасности и зависимости - -В этом разделе содержатся требования по работе с уязвимыми, устаревшими и небезопасными зависимостями и компонентами посредством управления зависимостями. - -Он также включает использование методов архитектурного уровня, таких как «песочница», инкапсуляция, контейнеризация и сетевая изоляция, для снижения влияния использования «операций с повышенным риском» и «компонентов с повышенным риском» (как определено в предыдущем разделе) и предотвращения потери доступности из-за чрезмерного использования ресурсоемких функций. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **15.2.1** | Убедитесь, что приложение содержит только те компоненты, которые не нарушили задокументированные сроки обновления и исправления. | 1 | -| **15.2.2** | Убедитесь, что в приложении реализованы меры защиты от потери доступности из-за функциональности, требующей много времени или ресурсов, на основе задокументированных решений и стратегий безопасности для этого. | 2 | -| **15.2.3** | Убедитесь, что производственная среда включает только те функции, которые необходимы для работы приложения, и не предоставляет лишние функции, такие как тестовый код, примеры кода и инструменты разработки. | 2 | -| **15.2.4** | Убедитесь, что сторонние компоненты и все их транзитивные зависимости загружаются только из ожидаемых репозиториев (внутренних или внешних) и отсутствует риск атаки через подмену зависимостей (dependency confusion attack) | 3 | -| **15.2.5** | Убедитесь, что приложение реализует дополнительные меры защиты для тех частей приложения, которые документированы как содержащие «функционал с повышенным риском» или использующие сторонние библиотеки, считающиеся «функционалом с повышенным риском». Это могут быть такие методы, как «песочница», инкапсуляция, контейнеризация или изоляция на сетевом уровне, чтобы задержать и предотвратить продвижение (pivoting) злоумышленников, скомпрометировавших одну часть приложения, к другим частям приложения. | 3 | - -## V15.3 Безопасное программирование - -В этом разделе рассматриваются типы уязвимостей, включая type juggling, prototype pollution и другие, возникающие из-за использования небезопасных паттернов программирования на конкретном языке. Некоторые уязвимости актуальны не для всех языков, тогда как другие требуют исправлений, зависящих от конкретного языка программирования, или связаны с особенностями обработки функций (например, HTTP-параметров) в конкретном языке или фреймворке. Также рассматривается риск установки обновлений приложения без криптографической проверки. - -В данном разделе также рассматриваются риски, связанные с использованием объектов для представления данных и их передачей через внешние API. В этом случае приложение должно гарантировать, что поля данных, которые не должны быть доступны для записи, не будут изменены пользовательским вводом (mass assignment), и что API избирательно определяет, какие поля данных возвращаются. Если доступ к полю зависит от прав пользователя, это следует рассматривать в контексте требования к контролю доступа на уровне полей в главе «Авторизация». - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **15.3.1** | Убедитесь, что приложение возвращает только необходимое подмножество полей из объекта данных. Например, оно не должно возвращать весь объект данных, поскольку некоторые отдельные поля должны быть недоступны пользователям. | 1 | -| **15.3.2** | Убедитесь, что при вызовах внешних URL-адресов бэкэнд приложения настроен так, чтобы не выполнять перенаправления, если только это не предусмотрено функционалом. | 2 | -| **15.3.3** | Убедитесь, что в приложении реализованы защитные механизмы против атак типа массового присвоения (mass assignment) путем строгого ограничения разрешенных полей для каждого контроллера и действия, исключая возможность добавления или изменения значений полей, которые не должны быть доступны для данной конкретной операции. | 2 | -| **15.3.4** | Убедитесь, что все прокси и промежуточное ПО корректно передают исходный IP-адрес пользователя, используя доверенные поля данных, которые не могут быть изменены конечным пользователем, а приложение и веб-сервер используют это правильное значение для ведения логирования и принятия решений по безопасности, таких как ограничение запросов. При этом следует учитывать, что даже исходный IP-адрес может быть ненадежным из-за динамических IP-адресов, VPN или корпоративных файрволов. | 2 | -| **15.3.5** | Убедитесь, что приложение явно проверяет соответствие переменных ожидаемому типу данных и использует строгие операции сравнения. Это необходимо для предотвращения уязвимостей, связанных с type juggling и type confusion, вызванных тем, что код приложения делает предположения о типе переменной. | 2 | -| **15.3.6** | Убедитесь, что JavaScript-код написан таким образом, чтобы предотвратить prototype pollution, например, используя Set() или Map() вместо обычных литералов объекта. | 2 | -| **15.3.7** | Убедитесь, что приложение защищено от атак типа HTTP Parameter Pollution (HPP), особенно если используемый фреймворк не различает источники параметров запроса (строка запроса, тело запроса, куки или заголовки). | 2 | - -## V15.4 Безопасная работа с параллельными процессами - -Проблемы безопасности работы параллельных процессов, такие как состояния гонки (race conditions), уязвимости типа «проблем синхронизации проверки и использования ресурсов» (TOCTOU), взаимные блокировки (deadlocks), постоянно повторяющиеся блокировки (livelocks), нехватка ресурсов у потоков (thread starvation) и некорректная синхронизация (improper synchronization), могут приводить к неожиданному поведению системы и создавать угрозы безопасности. В этом разделе рассматриваются различные методы и стратегии, помогающие снизить эти риски. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **15.4.1** | Убедитесь, что к общим объектам в многопоточном коде (например, кэшам, файлам или объектам в памяти, используемым несколькими потоками) используется безопасный многопоточный доступ и механизмов синхронизации, таких как блокировки или семафоры, чтобы избежать состояний гонки и повреждения данных. | 3 | -| **15.4.2** | Убедитесь, что проверки состояния ресурса, например его существования или разрешений, а также зависящие от него действия выполняются как одна атомарная операция, чтобы предотвратить условия гонки времени проверки и времени использования (TOCTOU). Например, проверка существования файла перед его открытием или проверка прав доступа пользователя перед его предоставлением. | 3 | -| **15.4.3** | Убедитесь, что блокировки применяются согласованно, чтобы предотвратить взаимные блокировки потоков (deadlocks) или их бесконечные повторы, а также что логика блокировки инкапсулирована в коде, отвечающем за управление ресурсом. Это гарантирует, что блокировки не могут быть случайно или намеренно изменены внешними классами или кодом. | 3 | -| **15.4.4** | Убедитесь, что политики распределения ресурсов предотвращают нехватку ресурсов у потоков, обеспечивая справедливый доступ к ресурсам, например, используя пулы потоков, позволяя потокам с более низким приоритетом выполняться в течение разумного периода времени. | 3 | - -## Ссылки - -Для дополнительной информации см. также: - -* [OWASP Prototype Pollution Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html) -* [OWASP Mass Assignment Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html) -* [OWASP CycloneDX Bill of Materials Specification](https://owasp.org/www-project-cyclonedx/) -* [OWASP Web Security Testing Guide: Testing for HTTP Parameter Pollution](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/07-Input_Validation_Testing/04-Testing_for_HTTP_Parameter_Pollution) diff --git a/5.0/ru/0x25-V16-Security-Logging-and-Error-Handling.md b/5.0/ru/0x25-V16-Security-Logging-and-Error-Handling.md deleted file mode 100644 index 9ad8c623c1..0000000000 --- a/5.0/ru/0x25-V16-Security-Logging-and-Error-Handling.md +++ /dev/null @@ -1,84 +0,0 @@ -# V16 Журналирование событий безопасности и обработка ошибок - -## Задачи контроля - -Журналы безопасности отличаются от журналов ошибок или производительности и служат для записи событий, связанных с безопасностью, таких как решения по аутентификации, контроль доступа или попытки обхода механизмов защиты (например, проверка входных данных или бизнес-логики). Их основная задача — обеспечить обнаружение, реагирование и расследование инцидентов за счёт предоставления структурированных данных с высокой информативной ценностью для аналитических систем, таких как SIEM. - -Журналы не должны содержать конфиденциальные персональные данные, если это не предусмотрено законом, а все залогированные сведения должны защищаться как актив высокой важности. Процесс журналирования не должен нарушать конфиденциальность или безопасность системы. Кроме того, приложения должны отрабатывать ошибки безопасным образом, исключая необоснованное раскрытие информации или disruption (нарушение работы). - -Подробные инструкции по внедрению см. в OWASP Cheat Sheets в разделе ссылок. - -## V16.1 Документация по ведению логов - -Этот раздел обеспечивает четкий и полный учет журналирования во всем стеке приложения. Это необходимо для эффективного мониторинга безопасности, реагирования на инциденты и соответствия требованиям. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **16.1.1** | Убедитесь в существовании реестра, в котором документируется ведение журнала на каждом уровне технологического стека приложения, включая какие события регистрируются, форматы логов, где хранятся эти журналы, как они используются, как контролируется доступ к ним и как долго хранятся журналы. | 2 | - -## V16.2 Общее журналирование - -В этом разделе устанавливаются требования, обеспечивающие единообразную структуру журналов безопасности и наличие метаданных. Цель — обеспечить машиночитаемость логов и возможность их анализа в распределённых системах и инструментах мониторинга. - -Естественно, события безопасности часто связаны с конфиденциальными данными. Если такие данные регистрируются без должного внимания, сами журналы становятся секретными и, следовательно, подпадают под действие требований шифрования (прим. автора - законодательства), более строгих политик хранения и могут быть раскрыты в ходе аудита. - -Крайне важно регистрировать только необходимые данные и обращаться с данными журналов с той же осторожностью, что и с другими конфиденциальными активами. - -Приведенные ниже требования устанавливают основополагающие требования к регистрации метаданных, синхронизации, форматированию и контролю. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **16.2.1** | Убедитесь, что каждая запись журнала содержит необходимые метаданные (например, когда, где, кто, что), которые позволят провести подробное исследование временной шкалы, когда произошло событие. | 2 | -| **16.2.2** | Убедитесь, что все источники времени компонентов системы журналирования синхронизированы, а временные метки в метаданных событий безопасности используют UTC или содержат явное указание смещения часового пояса. Рекомендуется применять UTC для обеспечения согласованности в распределённых системах и предотвращения ошибок при переходе на летнее/зимнее время. | 2 | -| **16.2.3** | Убедитесь, что приложение записывает и передаёт логи исключительно в те файлы и сервисы, которые указаны в реестре журналирования. | 2 | -| **16.2.4** | Убедитесь, что логи могут быть прочитаны и коррелированы используемой системой обработки журналов, предпочтительно с использованием общего стандартного формата логирования. | 2 | -| **16.2.5** | Убедитесь, что приложение применяет соответствующие меры защиты при логировании конфиденциальных данных в зависимости от уровня их чувствительности: например, полностью запрещает запись в логи таких данных, как учетные данные или платежные реквизиты, а для других данных (например, сессионных токенов) использует хеширование или частичное/полное маскирование. | 2 | - -## V16.3 Инциденты безопасности - -В этом разделе определяются требования к журналированию событий безопасности в приложении. Фиксация этих событий критически важна для выявления подозрительной активности, проведения расследований и выполнения нормативных требований. - -В этом разделе описываются типы регистрируемых событий, но он не претендует на исчерпывающую информацию. Каждое приложение имеет уникальные факторы риска и эксплуатационный контекст. - -Обратите внимание, что, хотя ASVS включает регистрацию событий безопасности в свою область применения, функции оповещения и корреляции (например, правила SIEM или инфраструктура мониторинга) не входят в сферу применения и обрабатываются операционными системами и системами мониторинга. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **16.3.1** | Убедитесь, что все операции аутентификации регистрируются, включая успешные и неудачные попытки. Также следует фиксировать дополнительные метаданные, такие как тип аутентификации или использованные факторы проверки. | 2 | -| **16.3.2** | Убедитесь, что ведется журнал неудачных попыток авторизации. Для уровня L3 это должно включать в себя журналирование всех решений об авторизации, включая журналирование доступа к конфиденциальным данным (без регистрации самих конфиденциальных данных). | 2 | -| **16.3.3** | Убедитесь, что приложение регистрирует все события безопасности, определенные в документации, а также фиксирует попытки обхода механизмов защиты, включая проверку входных данных, бизнес-логики и системы защиты от автоматизированных атак. | 2 | -| **16.3.4** | Убедитесь, что приложение регистрирует в журналах неожиданные ошибки и сбои механизмов безопасности, включая, например, ошибки TLS-соединения на стороне сервера. | 2 | - -## V16.4 Защита журналов - -Журналы представляют собой ценные источники forensic-данных и должны быть надёжно защищены. Если логи можно легко изменить или удалить, они теряют целостность и становятся ненадёжными для расследования инцидентов или судебных разбирательств. Кроме того, журналы могут раскрывать внутреннюю логику работы приложения или содержать конфиденциальные метаданные, что делает их привлекательной целью для злоумышленников. - -В данном разделе определены требования, обеспечивающие защиту журналов от несанкционированного доступа, изменений и раскрытия и безопасную передачу и хранение в изолированных защищённых системах. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **16.4.1** | Убедитесь, что все компоненты системы логирования корректно кодируют данные, чтобы предотвратить атаки типа внедрения в журналы (log injection). | 2 | -| **16.4.2** | Убедитесь, что логи защищены от неавторизованного доступа и не могут быть модифицированы. | 2 | -| **16.4.3** | Убедитесь, что логи безопасно передаются в логически изолированную систему для анализа, обнаружения угроз, генерации оповещений и эскалации инцидентов. Это гарантирует сохранность журналов даже в случае компрометации основного приложения. | 2 | - -## V16.5 Обработка ошибок - -Данный раздел определяет требования к безопасному и корректному завершению работы приложений в случае сбоев, исключающему раскрытие конфиденциальной внутренней информации. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **16.5.1** | Убедитесь, что при возникновении непредвиденной или связанной с безопасностью ошибки пользователю возвращается только общее сообщение, гарантируя отсутствие раскрытия конфиденциальных внутренних данных системы, таких как трассировки стека, запросы, секретные ключи и токены. | 2 | -| **16.5.2** | Убедитесь, что приложение продолжает работать в безопасном режиме при недоступности внешних ресурсов, используя такие механизмы, как автоматические выключатели (circuit breakers) или плавное снижение функциональности (graceful degradation). | 2 | -| **16.5.3** | Убедитесь, что приложение корректно и безопасно завершает работу при возникновении исключений, предотвращая опасные сценарии по типу «fail-open», когда, например, транзакция ошибочно выполняется, несмотря на ошибки в логике валидации. | 2 | -| **16.5.4** | Убедитесь, что определён обработчик ошибок «крайние меры», который будет перехватывать все необработанные ошибки. Это необходимо как для предотвращения потери информации об ошибках, которая должна быть записана в файлы журналов, так и для того, чтобы ошибка не остановила весь процесс приложения, что привело бы к потере доступности. | 3 | - -Примечание: Некоторые языки программирования (включая Swift, Go и многие функциональные языки в силу их парадигмы) не поддерживают исключения или обработчики событий «крайней меры». В таких случаях архитекторам и разработчикам следует использовать подходы, соответствующие паттернам, языковым особенностям или возможностям фреймворка, чтобы гарантировать безопасную обработку исключительных, непредвиденных или связанных с безопасностью событий. - -## Ссылки - -Для дополнительной информации см. также: - -* [OWASP Web Security Testing Guide: Testing for Error Handling](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/README) -* [OWASP Authentication Cheat Sheet section about error messages](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#authentication-and-error-messages) -* [OWASP Logging Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html) -* [OWASP Application Logging Vocabulary Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Vocabulary_Cheat_Sheet.html) diff --git a/5.0/ru/0x26-V17-WebRTC.md b/5.0/ru/0x26-V17-WebRTC.md deleted file mode 100644 index fafc396930..0000000000 --- a/5.0/ru/0x26-V17-WebRTC.md +++ /dev/null @@ -1,75 +0,0 @@ -# V17 WebRTC - -## Задачи контроля - -Web Real-Time Communication (WebRTC) — технология, обеспечивающая передачу голоса, видео и данных в реальном времени в современных приложениях. По мере роста WebRTC обеспечение безопасности инфраструктуры WebRTC становится критически важным. В данном разделе представлены требования по безопасности для разработчиков, хостинг-провайдеров и интеграторов решений на основе WebRTC. - -Рынок WebRTC можно разделить на три основных сегмента: - -1. Разработчики продуктов — поставщики, создающие и поставляющие продукты и решения WebRTC как с собственным, так и с открытым исходным кодом. Они специализируются на разработке надежных и безопасных технологий WebRTC, которые могут использоваться другими. - -2. Платформы коммуникаций как услуга (CPaaS) — провайдеры, предлагающие API, SDK и инфраструктуру для реализации WebRTC-функциональности. Они могут использовать продукты первой категории или разрабатывать собственное ПО WebRTC для предоставления этих услуг. - -3. Поставщики услуг — организации, внедряющие WebRTC-решения (на базе готовых продуктов или собственных разработок) для создания приложений для онлайн-конференций, здравоохранения, электронного обучения и других областей, где критически важна коммуникация в режиме реального времени. - -Изложенные здесь требования безопасности в первую очередь ориентированы на разработчиков продуктов, CPaaS-провайдеров, поставщиков услуг, которые: - -* Используют open-source решения для создания своих WebRTC-приложений. -* Применяют коммерческие WebRTC-продукты как часть своей инфраструктуры. -* Разрабатывают собственные WebRTC-решения или интегрируют различные компоненты в единый сервис. - -Важно отметить, что эти требования безопасности не распространяются на разработчиков, использующих исключительно SDK и API, предоставляемые поставщиками CPaaS. Для таких разработчиков CPaaS-провайдеры обычно несут ответственность за обеспечение базовой безопасности своей платформы, и универсальные стандарты безопасности (например, ASVS) могут не полностью покрывать их потребности. - -## V17.1 TURN-сервер - -В этом разделе определяются требования безопасности для систем, использующих собственные серверы TURN (Traversal Using Relays around NAT). Серверы TURN помогают ретранслировать медиаданные в сетевых средах с ограничениями, но могут представлять опасность при неправильной настройке. Эти меры контроля направлены на безопасную фильтрацию адресов и защиту от исчерпания ресурсов. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **17.1.1** | Убедитесь, что сервис TURN (Traversal Using Relays around NAT) разрешает доступ только к IP-адресам, не зарезервированным для специальных целей (например, внутренние сети, широковещательная рассылка, loopback-адреса). Данное требование применяется как к IPv4, так и к IPv6 адресам. | 2 | -| **17.1.2** | Убедитесь, что сервис TURN (Traversal Using Relays around NAT) защищен от исчерпания ресурсов при попытках легитимных пользователей открыть чрезмерное количество портов на сервере. | 3 | - -## V17.2 Требования к медиасерверам - -Данные требования применяются только к системам, использующим собственные WebRTC-медиасерверы, такие как, SFU (Selective Forwarding Units), MCU (Multipoint Control Units), серверы записи, шлюзовые серверы. Медиасерверы обрабатывают и распределяют медиапотоки, поэтому их безопасность критически важна для защиты взаимодействия между участниками. Обеспечение безопасности медиапотоков в WebRTC-приложениях является приоритетной задачей для предотвращения перехвата данных, манипуляций с трафиком, атак типа «отказ в обслуживании». Эти угрозы могут нарушить конфиденциальность пользователей и качество связи. - -В частности, необходимо реализовать защиту от флуд-атак, включая: ограничение частоты запросов (rate limiting), проверку временных меток, использование синхронизированных часов для контроля временных интервалов и управление буферами для предотвращения переполнения и поддержания правильной временной синхронизации. Если пакеты для конкретного медиасеанса прибывают слишком быстро, избыточные пакеты должны отбрасываться. Также важно защитить систему от некорректных пакетов путем валидации входных данных, безопасной обработки целочисленных переполнений, предотвращения переполнения буферов и применения других надежных методов обработки ошибок. - -Системы, использующие исключительно peer-to-peer медиакоммуникацию между веб-браузерами без промежуточных медиасерверов, не подпадают под эти специфические требования к медиабезопасности. - -Данный раздел относится к использованию Datagram Transport Layer Security (DTLS) в контексте WebRTC. Требования к документированной политике управления криптографическими ключами приведены в главе «Криптография». Информацию об одобренных криптографических методах можно найти в Приложении С - Криптография ASVS или в таких документах, как NIST SP 800-52 Rev. 2 или BSI TR-02102-2 (версия 2025-01). - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **17.2.1** | Убедитесь, что ключ сертификата Datagram Transport Layer Security (DTLS) управляется и защищается в соответствии с документированной политикой управления криптографическими ключами. | 2 | -| **17.2.2** | Убедитесь, что медиасервер настроен на использование только одобренных наборов шифров Datagram Transport Layer Security (DTLS) и защищенного профиля безопасности для расширения DTLS, применяемого при установке ключей для Secure Real-time Transport Protocol (DTLS-SRTP). | 2 | -| **17.2.3** | Убедитесь, что медиасервер проверяет аутентификацию Secure Real-time Transport Protocol (SRTP) для предотвращения атак с внедрением Real-time Transport Protocol (RTP), которые могут привести к отказу в обслуживании (Denial of Service) или вставке поддельного аудио-/видеоконтента в медиапотоки. | 2 | -| **17.2.4** | Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика при получении некорректных пакетов Secure Real-time Transport Protocol (SRTP). | 2 | -| **17.2.5** | Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетами Secure Real-time Transport Protocol (SRTP) от легитимных пользователей. | 3 | -| **17.2.6** | Убедитесь, что медиасервер не подвержен уязвимости «Гонка ClientHello» (ClientHello Race Condition) в Datagram Transport Layer Security (DTLS), проверив наличие известных уязвимостей в публичных источниках или выполнив тестирование на воспроизведение условий гонки. | 3 | -| **17.2.7** | Убедитесь, что механизмы аудио- и видеозаписи, связанные с медиасервером, способны продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетов Secure Real-time Transport Protocol (SRTP) от легитимных пользователей. | 3 | -| **17.2.8** | Убедитесь, что сертификат Datagram Transport Layer Security (DTLS) проверяется на соответствие атрибуту отпечатка (fingerprint) в Session Description Protocol (SDP), с немедленным прекращением медиапотока в случае несоответствия — это гарантирует подлинность передаваемых данных. | 3 | - -## V17.3 Сигнализация - -Данный раздел устанавливает требования для систем, использующих собственные серверы сигнализации WebRTC. Сигнализация координирует peer-to-peer (P2P) взаимодействие и должна быть устойчива к атакам, способным нарушить установление сеансов или управление соединениями. - -Для обеспечения безопасной сигнализации системы должны корректно обрабатывать некорректные входные данные и оставаться доступными под нагрузкой. - -| # | Описание | Уровень | -| :---: | :--- | :---: | -| **17.3.1** | Убедитесь, что сигнальный сервер способен продолжать обработку легитимных входящих сообщений сигнализации даже в условиях флуд-атаки. Для этого необходимо реализовать механизм ограничения частоты запросов (rate limiting) на уровне сигнализации. | 2 | -| **17.3.2** | Убедитесь, что сигнальный сервер способен продолжать обработку легитимных сообщений сигнализации даже при получении некорректных сообщений, которые могут вызвать отказ в обслуживании (Denial of Service, DoS). Для этого необходимо реализовать: проверку входных данных (input validation), безопасную обработку целочисленных переполнений (integer overflows), защиту от переполнения буферов (buffer overflows) и другие надежные методы обработки ошибок. | 2 | - -## Ссылки - -Для дополнительной информации см. также: - -* DoS-атака WebRTC DTLS ClientHello лучше всего документирована [в записи блога Enable Security для специалистов по безопасности](https://www.enablesecurity.com/blog/novel-dos-vulnerability-affecting-webrtc-media-servers/) и соответствующем [техническом документе для разработчиков WebRTC](https://www.enablesecurity.com/blog/webrtc-hello-race-conditions-paper/) -* [RFC 3550 - RTP: A Transport Protocol for Real-Time Applications](https://www.rfc-editor.org/rfc/rfc3550) -* [RFC 3711 - The Secure Real-time Transport Protocol (SRTP)](https://datatracker.ietf.org/doc/html/rfc3711) -* [RFC 5764 - Datagram Transport Layer Security (DTLS) Extension to Establish Keys for the Secure Real-time Transport Protocol (SRTP))](https://datatracker.ietf.org/doc/html/rfc5764) -* [RFC 8825 - Overview: Real-Time Protocols for Browser-Based Applications](https://www.rfc-editor.org/info/rfc8825) -* [RFC 8826 - Security Considerations for WebRTC](https://www.rfc-editor.org/info/rfc8826) -* [RFC 8827 - WebRTC Security Architecture](https://www.rfc-editor.org/info/rfc8827) -* [DTLS-SRTP Protection Profiles](https://www.iana.org/assignments/srtp-protection/srtp-protection.xhtml) diff --git a/5.0/ru/0x90-Appendix-A_Glossary.md b/5.0/ru/0x90-Appendix-A_Glossary.md deleted file mode 100644 index d4b6b3c79d..0000000000 --- a/5.0/ru/0x90-Appendix-A_Glossary.md +++ /dev/null @@ -1,89 +0,0 @@ -# Приложение A: Термины и сокращения - -* **Absolute Maximum Session Lifetime** (абсолютный максимальный срок действия сессии) — также известный как "Overall Timeout" в NIST, это максимальное время, в течение которого сеанс может оставаться активным после аутентификации, независимо от действий пользователя. Это составная часть механизма завершения сессии. -* **Allowlist** — список разрешённых данных или операций, например список символов, разрешённых форматно-логическим контролем. -* **Anti-forgery token** (токен защиты от подделки) — механизм, при котором один или несколько токенов передаются в запросе и проверяются сервером приложения, чтобы гарантировать, что запрос поступил из ожидаемой конечной точки. -* **Application Security** (безопасность приложений) — это анализ компонентов, составляющих прикладной уровень эталонной модели взаимодействия открытых систем (модели OSI), и в меньшей степени – инфраструктуры, например, операционных систем или сетей. -* **Application Security Verification** (верификация требований к безопасности приложений) — технический анализ приложения по стандарту OWASP ASVS. -* **Application Security Verification Report** — отчёт по тестированию конкретного приложения, в котором аудитор документирует общие результаты и даёт сопроводительные пояснения. -* **Authentication** (аутентификация) — проверка учетных данных, предъявленных пользователем приложения. -* **Automated Verification** (автоматизированная проверка) – поиск сигнатур уязвимостей с помощью автоматизированных инструментов динамического и/или статического анализа безопасности кода. -* **Black box testing** (метод «чёрного ящика») — метод тестирования программного обеспечения, который проверяет функциональность приложения, не заглядывая в его внутреннюю структуру и операции. -* **Common Weakness Enumeration** (CWE, список общих недостатков) – разработанный сообществом список распространенных недостатков безопасности программного обеспечения. Он служит общим языком, мерилом для средств обеспечения безопасности программного обеспечения, а также основой для выявления недостатков, их устранения и предотвращения. -* **Component** (компонент) – автономный блок кода со связанными дисковыми и сетевыми интерфейсами, который взаимодействует с другими компонентами. -* **Credential Service Provider** (CSP) — также называемый поставщиком идентификационных данных (IdP). Источник пользовательских данных, который может использоваться другими приложениями для аутентификации. -* **Cross-Site Script Inclusion** (XSSI) — разновидность атаки межсайтового скриптинга (XSS), при которой веб-приложение загружает вредоносный код из внешнего источника и включает его в состав собственного содержимого. -* **Cross-Site Scripting** (XSS, межсайтовый скриптинг) — уязвимость в системе безопасности, обычно обнаруживаемая в web-приложениях, позволяющая внедрять скрипты в контент на стороне клиента. -* **Cryptographic module** (криптографический модуль) — аппаратное, программное и/или микропрограммное обеспечение, реализующее криптографические алгоритмы и/или генерирующее криптографические ключи. -* **Cryptographically secure pseudo-random number generator** (CSPRNG, криптографически стойкий генератор псевдослучайных чисел) — генератор псевдослучайных чисел со свойствами, делающими его пригодным для использования в криптографии, также называется криптографическим генератором случайных чисел (cryptographic random number generator, CRNG). -* **Datagram Transport Layer Security** (DTLS) — криптографический протокол, обеспечивающий безопасность связи по сетевому соединению. Он основан на протоколе TLS, но адаптирован для защиты ориентированных на датаграммы протоколов (обычно поверх UDP). Версия DTLS 1.3 стандартизирована в RFC 9147. -* **Datagram Transport Layer Security Extension to Establish Keys for the Secure Real-time Transport Protocol** (DTLS-SRTP) — механизм использования DTLS-рукопожатия для формирования ключей сеанса SRTP. Стандартизирован в RFC 5764. -* **Design Verification** (верификация архитектуры) — технический анализ архитектуры безопасности приложения. -* **Dynamic Application Security Testing** (DAST, динамический анализ приложения) — технологии, предназначенные для обнаружения условий, указывающих на уязвимость системы безопасности в приложении, производящийся во время его выполнения. -* **Dynamic Verification** (динамическая верификация) — использование автоматизированных инструментов, использующих сигнатуры уязвимостей для поиска проблем во время выполнения приложения. -* **Fast IDentity Online** (FIDO) — набор стандартов аутентификации, которые позволяют использовать различные методы аутентификации, включая биометрические данные, модули доверенной платформы (TPM), USB-токены и т.д. -* **Hardware Security Module** (HSM, аппаратный модуль безопасности) — аппаратный компонент, способный хранить криптографические ключи и другие секреты в защищённом виде. -* **Hibernate Query Language** (HQL) — язык запросов, внешне похожий на SQL, используемый библиотекой Hibernate ORM. -* **HTTP Strict Transport Security** (HSTS) — политика, которая предписывает браузеру подключаться к домену, возвращающему заголовок, только через TLS и при наличии действительного сертификата. Активируется с помощью поля заголовка ответа Strict-Transport-Security. -* **HyperText Transfer Protocol** (HTTP) — протокол приложений для распределенных, гипермедиа (гипертекст+мультимедиа)-систем и совместной работы. Основа для передачи данных в World Wide Web. -* **HyperText Transfer Protocol over SSL/TLS** (HTTPS) — Способ защиты HTTP-соединения путём его шифрования с использованием TLS. -* **Identity Provider** (IdP) — также называется провайдером услуг аутентификации (CSP) в ссылках NIST. Сущность, которая предоставляет источник аутентификации для других приложений. -* **Inactivity Timeout** (таймаут бездействия) — промежуток времени, в течение которого сессия может оставаться активной при отсутствии взаимодействия пользователя с приложением. Это составная часть механизма завершения сессии. -* **Input Validation** (форматно-логический контроль) — нормализация и проверка корректности недоверенных входных данных. -* **JSON Web Token** (JWT) – RFC 7519 определяет стандарт для объекта данных JSON, состоящего из раздела заголовка (header), который объясняет, как проверять объект, раздела тела (body), содержащего набор утверждений (claims), и раздела подписи (signature), содержащей цифровую подпись для проверки содержимого раздела тела. Это тип автономного (self-contained) токена. -* **Local File Inclusion** (LFI) – атака, использующая уязвимые процедуры включения файлов в приложении, что приводит к подключению локальных файлов, уже присутствующих на сервере. -* **Malicious Code** (вредоносный код) — код, попавший в приложение во время его разработки без ведома владельца, который обходит имеющуюся политику безопасности приложения. Не путать с вредоносным ПО, таким как вирусы или черви. -* **Malware** (вредоносное ПО) — исполняемый код, который попадает в приложение во время выполнения без ведома пользователя или администратора приложения. -* **Message authentication code** (MAC) — криптографическая контрольная сумма данных, вычисляемая алгоритмом генерации MAC, которая используется для обеспечения целостности и подлинности. -* **Multi-factor authentication** (MFA, многофакторная аутентификация) — аутентификация, использующая два или более различных факторов. -* **Mutual TLS** (mTLS) – См. TLS client authentication. -* **Object-relational Mapping** (ORM) – система, позволяющая приложению делать запросы к реляционной/табличной базе данных, используя объектную модель, совместимую с приложением. -* **One-time Password** (OTP, одноразовый пароль) — уникальный пароль, сгенерированный для одноразового использования. -* **Open Worldwide Application Security Project** (OWASP) – бесплатно распространяемый проект и открытое международное сообщество, занимающееся повышением безопасности прикладного программного обеспечения. Наша миссия — сделать безопасность приложений «видимой», чтобы люди и организации могли принимать обоснованные решения о рисках безопасности приложений. См.: [https://www.owasp.org/](https://www.owasp.org/). -* **Password-Based Key Derivation Function 2** (PBKDF2) – специальный односторонний алгоритм для формирования стойкого криптографического ключа на основе введённого текста (например, пароля) и дополнительного случайного значения — соли, которая затрудняет взлом пароля в режиме offline, если вместо исходного пароля хранится результирующее значение. -* **Public Key Infrastructure** (PKI, инфраструктура открытых ключей) — механизм, который связывает открытые ключи с соответствующими идентификаторами сущностей. Привязка устанавливается посредством процесса регистрации и выдачи сертификатов в центре сертификации (CA) и с его помощью. -* **Public Switched Telephone Network** (PSTN, коммутируемая телефонная сеть общего пользования, ТСОП, ТфОП) — традиционная телефонная сеть, соединяющая как стационарные, так и мобильные телефоны. -* **Real-time Transport Protocol** (RTP) и **Real-time Transport Control Protocol** (RTCP) — два протокола, используемые совместно для передачи мультимедийных потоков. Применяются в стеке WebRTC. Стандартизированы в RFC 3550. -* **Reference Token** (ссылочный токен) — тип токена, который служит указателем или идентификатором для состояния или метаданных, хранящихся на сервере, также известен как случайный или непрозрачный токен. В отличие от автономных (self-contained) токенов, сслылочный токен не содержат собственной информации, а зависят от контекста сервера. Ссылочный токен либо является идентификатором сессии, либо содержит его. -* **Relying Party** (RP, проверяющая сторона) — как правило, приложение, которое полагается на то, что пользователь прошёл аутентификацию у отдельного поставщика аутентификации. Приложение проверяет токен или набор подписанных утверждений, предоставляемых этим поставщиком, чтобы убедиться, что пользователь является тем, за кого себя выдает. -* **Remote File Inclusion** (RFI, подключение удалённых файлов) — атака, эксплуатирующая уязвимые процедуры включения файлов в приложении, что приводит к подключению удалённых файлов. -* **Scalable Vector Graphics** (SVG, масштабируемая векторная графика) — язык разметки на основе XML для описания двумерной векторной графики. -* **Secure Real-time Transport Protocol** (SRTP) и **Secure Real-time Transport Control Protocol** (SRTCP) – расширение протоколов RTP и RTCP, предоставляющее функции шифрования сообщений, проверки подлинности и обеспечения целостности. Стандартизирован в RFC 3711. -* **Security Architecture** (архитектура безопасности) — абстракция дизайна приложения, которая определяет и описывает, где и как применяются меры безопасности, а также местоположение и категории информации. -* **Security Assertion Markup Language** (SAML) — открытый стандарт для единого входа (SSO), основанный на передаче подписанных утверждений (обычно в формате XML) между поставщиком идентификации и проверяющей стороной. -* **Security Configuration** (конфигурация безопасности) — конфигурация среды выполнения приложения, которая влияет на то, как применяются меры безопасности. -* **Security Control** (мера обеспечения безопасности) — функция или компонент, который контролирует (например, меры контроля доступа) или приводит к действию по обеспечению безопасности (например, регистрирует запись в журнале аудита). -* **Security information and event management** (SIEM) — система для обнаружения угроз, обеспечения соответствия требованиям и управления инцидентами безопасности путём сбора и анализа связанных с безопасностью данных из различных источников ИТ-инфраструктуры организации. -* **Self-Contained Token** (автономный токен) — токен, который инкапсулирует один или несколько атрибутов, не зависящих от серверного состояния или другого внешнего хранилища. Эти токены обеспечивают подлинность и целостность содержащихся в них атрибутов, позволяя осуществлять безопасный обмен информацией между системами «без сохранения состояния». Автономные токены обычно защищаются с помощью криптографических методов, таких как цифровые подписи или коды аутентификации сообщений (MAC), для обеспечения подлинности, целостности, а в некоторых случаях и конфиденциальности своих данных. Распространёнными примерами являются SAML Assertions и JWT. -* **Server-side Request Forgery** (SSRF, подделка запросов на стороне сервера) — атака, которая злоупотребляет функциональными возможностями сервера для чтения или обновления внутренних ресурсов путем предоставления или изменения URL-адреса, по которому код, запущенный на сервере, будет читать или отправлять данные. -* **Session Description Protocol** (SDP) — формат сообщений для настройки мультимедийного сеанса (используется, например, в WebRTC). Стандартизирован в RFC 4566. -* **Session Identifier** или **Session ID** (идентификатор сессии) — ключ, который идентифицирует сессию с сохранением состояния, хранящийся на серверной стороне. Передаётся клиенту и обратно с помощью ссылочного токена (reference token). -* **Session Token** (сессионный токен) — общий термин, используемый в данном стандарте для обозначения токена или значения, применяемого в сессиях без сохранения состояния (которые используют автономный токен) или в сессиях с сохранением состояния (которые используют ссылочный токен). -* **Session Traversal Utilities for NAT** (STUN) — протокол, используемый для преодоления ограничений NAT с целью установления одноранговой связи. Стандартизирован в RFC 3489. -* **Single-factor authenticator** — Механизм проверки аутентификации пользователя. Фактором аутентификации может быть что-то, что вы знаете (запоминаемые секреты, пароли, парольные фразы, PIN-коды), что-то, что вы представляете собой (биометрия, отпечатки пальцев, сканы лица), или что-то, чем вы владеете (OTP-токены, криптографическое устройство, такое как смарт-карта). -* **Single Sign-on Authentication** (SSO, аутентификация единого входа) — пользователь входит в одно приложение, одновременно получая возможность войти в несколько других, без необходимости повторной аутентификации. Например, когда вы входите в Google, вы автоматически входите в другие сервисы Google, такие как YouTube, Google Docs, Gmail и т.д. -* **Software bill of materials** (SBOM) — структурированный и исчерпывающий перечень всех компонентов, модулей, библиотек, фреймворков и других ресурсов, необходимых для сборки или компиляции программного приложения. -* **Software Composition Analysis** (SCA, композиционный анализ) — Совокупность технологий, предназначенных для анализа состава приложений, зависимостей, библиотек и пакетов на наличие уязвимостей безопасности в используемых версиях компонентов. Не следует путать с анализом исходного кода, который теперь обычно обозначается как SAST. -* **Software development lifecycle** (SDLC, жизненный цикл разработки программного обеспечения) – пошаговый процесс разработки ПО, начиная с первоначальных требований, и заканчивая развертыванием и сопровождением. -* **SQL Injection** (SQLi, SQL-инъекция) — метод внедрения кода, используемый для атаки приложений, управляемых данными, в котором вредоносные SQL-выражения вставляются в точку входа. -* **Stateful Session Mechanism** (механизм сессии с сохранением состояния) — механизм управления сессией, когда приложение сохраняет состояние сеанса на серверной стороне, который обычно соответствует токену сеанса, сгенерированному с использованием криптографически стойкого генератора псевдослучайных чисел (CSPRNG), и выданному конечному пользователю. -* **Stateless Session Mechanism** (механизм сессии без сохранения состояния) — механизм управления сессией, который использует автономный токен, который передаётся клиентам и содержит информацию о сеансе, не обязательно хранящуюся в службе, которая затем получает и проверяет токен. На практике службе потребуется доступ к некоторой информации о сеансе (например, к списку отозванных JWT), чтобы иметь возможность применять необходимые меры безопасности. -* **Static application security testing** (SAST, статический анализ безопасности приложений) — набор технологий, предназначенных для анализа исходного кода, байт-кода и бинарных файлов приложения с целью выявления условий на уровне кода или архитектуры, указывающих на уязвимости безопасности. Решения SAST анализируют приложение «изнутри наружу» в статическом состоянии (без выполнения). -* **Threat Modeling** (моделирование угроз) — метод, состоящий в совершенствовании архитектур безопасности для выявления нарушителей, границ доверия, мер безопасности, а также ключевых технических и бизнес-активов. -* **Time-of-check to time-of-use** (TOCTOU) — ситуация, когда приложение проверяет состояние ресурса перед его использованием, но состояние ресурса может быть изменено между проверкой и использованием. Это может сделать результаты проверки недействительными и привести к ситуации, когда приложение выполняет некорректные действия из-за несоответствия состояния. -* **Time based One-time Passwords** (TOTPs) — метод создания OTP, при котором текущее время является входным аргументом для алгоритма формирования пароля. -* **TLS client authentication**, также называемый **Mutual TLS** (mTLS) — в стандартном TLS-соединении клиент может использовать сертификат, предоставленный сервером, для проверки подлинности сервера. При использовании mTLS клиент также использует свой собственный закрытый ключ и сертификат, чтобы позволить серверу проверить подлинность клиента. -* **Transport Layer Security** (TLS, безопасность транспортного уровня) — криптографические протоколы, обеспечивающие безопасность канала связи по сетевому соединению. -* **Traversal Using Relays around NAT** (TURN) — расширение протокола STUN, использующее TURN-сервер в качестве ретранслятора, когда прямое одноранговое соединение не может быть установлено. Стандартизировано в RFC 8656. -* **Trusted execution environment** (TEE) — изолированная среда выполнения, обеспечивающая безопасное исполнение приложений вне зависимости от состояния остальной системы. -* **Trusted Platform Module** (TPM, модуль доверенной платформы) — тип HSM, который обычно является компонентом другого оборудования, например, материнской платы, и выступает в роли «корня доверия» для этой системы. -* **Trusted Service Layer** (уровень доверенных служб) — любая доверенная точка принудительного контроля, такая как микросервис, бессерверный API, серверная часть, доверенный API на клиентском устройстве с безопасной загрузкой, партнёрские или внешние API и т.д. «Доверенный» означает, что нет опасений, что недоверенный пользователь сможет обойти или пропустить слой или элементы управления, реализованные на этом уровне. -* **Uniform Resource Identifier** (URI, унифицированный идентификатор ресурса) — это строка символов, используемая для идентификации ресурса, например, веб-страницы, почтового адреса, места. -* **Uniform Resource Locator** (URL, унифицированный адрес ресурса) — это строка, указывающая местоположение ресурса в Интернете. -* **Universally Unique Identifier** (UUID, универсальный уникальный идентификатор) — уникальный номер-идентификатор, используемый в качестве средства идентификации в программном обеспечении. -* **Verifier** (верификатор/аудитор) — лицо или группа людей, которые анализируют безопасность приложения на соответствие требованиям OWASP ASVS. -* **Web Real-Time Communication** (WebRTC) — стек протоколов и связанный с ним веб-API, используемые для передачи мультимедийных потоков в веб-приложениях, обычно в контексте телеконференций. Основан на SRTP, SRTCP, DTLS, SDP и STUN/TURN. -* **WebSocket over TLS** (WSS) — практика защиты WebSocket-соединения путём размещения протокола WebSocket поверх протокола TLS. -* **What You See Is What You Get** (WYSIWYG) – тип редактора гипермедиа, который показывает, как на самом деле будет выглядеть содержимое при отображении, а не код разметки, управляющий отображением. -* **X.509 Certificate** — электронный сертификат, соответствующий общепринятому международному стандарту инфраструктуры открытых ключей X.509 (PKI) для проверки принадлежности открытого ключа идентификатору пользователя, компьютера или сервиса, указанному в сертификате. -* **XML eXternal Entity** (XXE) — тип элемента XML, который может получать доступ к локальному или удаленному содержимому через объявленный идентификатор. Может привести к атакам инъекции. diff --git a/5.0/ru/0x91-Appendix-B_References.md b/5.0/ru/0x91-Appendix-B_References.md deleted file mode 100644 index ccd2905473..0000000000 --- a/5.0/ru/0x91-Appendix-B_References.md +++ /dev/null @@ -1,43 +0,0 @@ -# Приложение B: Полезные ссылки - -Следующие проекты OWASP, скорее всего, будут полезны для читателей/последователей этого стандарта: - -## Основные проекты OWASP - -1. Проект OWASP Top 10: [https://owasp.org/www-project-top-ten/](https://owasp.org/www-project-top-ten/) -2. OWASP Web Security Testing Guide: [https://owasp.org/www-project-web-security-testing-guide/](https://owasp.org/www-project-web-security-testing-guide/) -3. OWASP Proactive Controls: [https://owasp.org/www-project-proactive-controls/](https://owasp.org/www-project-proactive-controls/) -4. OWASP Software Assurance Maturity Model (SAMM): [https://owasp.org/www-project-samm/](https://owasp.org/www-project-samm/) -5. OWASP Secure Headers Project: [https://owasp.org/www-project-secure-headers/](https://owasp.org/www-project-secure-headers/) - -## Проект OWASP Cheat Sheet Series - -[В этом проекте](https://owasp.org/www-project-cheat-sheets/) есть памятки, которые будут актуальны для многих требований ASVS. - -Сопоставление памяток с требованиями ASVS можно найти здесь: [https://cheatsheetseries.owasp.org/IndexASVS.html](https://cheatsheetseries.owasp.org/IndexASVS.html) - -## Проекты Mobile Security - -1. OWASP Mobile Security Project: [https://owasp.org/www-project-mobile-security/](https://owasp.org/www-project-mobile-security/) -2. OWASP Mobile Top 10 Risks: [https://owasp.org/www-project-mobile-top-10/](https://owasp.org/www-project-mobile-top-10/) -3. OWASP Mobile Security Testing Guide and Mobile Application Security Verification Standard: [https://owasp.org/www-project-mobile-security-testing-guide/](https://owasp.org/www-project-mobile-security-testing-guide/) - -## Проект OWASP Internet of Things - -1. OWASP Internet of Things Project: [https://owasp.org/www-project-internet-of-things/](https://owasp.org/www-project-internet-of-things/) - -## Проект OWASP Serverless - -1. OWASP Serverless Project: [https://owasp.org/www-project-serverless-top-10/](https://owasp.org/www-project-serverless-top-10/) - -## Другие - -Следующие веб-сайты, скорее всего, также будут полезны для читателей/последователей этого стандарта: - -1. SecLists Github: [https://github.com/danielmiessler/SecLists](https://github.com/danielmiessler/SecLists) -2. MITRE Common Weakness Enumeration: [https://cwe.mitre.org/](https://cwe.mitre.org/) -3. PCI Security Standards Council: [https://www.pcisecuritystandards.org/](https://www.pcisecuritystandards.org/) -4. PCI Data Security Standard (DSS) v3.2.1 Requirements and Security Assessment Procedures: [https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf](https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf) -5. PCI Software Security Framework - Secure Software Requirements and Assessment Procedures: [https://www.pcisecuritystandards.org/documents/PCI-Secure-Software-Standard-v1_0.pdf](https://www.pcisecuritystandards.org/documents/PCI-Secure-Software-Standard-v1_0.pdf) -6. PCI Secure Software Lifecycle (Secure SLC) Requirements and Assessment Procedures: [https://www.pcisecuritystandards.org/documents/PCI-Secure-SLC-Standard-v1_0.pdf](https://www.pcisecuritystandards.org/documents/PCI-Secure-SLC-Standard-v1_0.pdf) -7. OWASP ASVS 4.0 Testing Guide [https://github.com/BlazingWind/OWASP-ASVS-4.0-testing-guide](https://github.com/BlazingWind/OWASP-ASVS-4.0-testing-guide) diff --git a/5.0/ru/0x92-Appendix-C_Cryptography.md b/5.0/ru/0x92-Appendix-C_Cryptography.md deleted file mode 100644 index 204928d870..0000000000 --- a/5.0/ru/0x92-Appendix-C_Cryptography.md +++ /dev/null @@ -1,312 +0,0 @@ -# Приложение C: Стандарты криптографии - -Глава «Криптография» выходит за рамки простого описания передовых практик. Она направлена ​​на углубление понимания принципов криптографии и поощрение внедрения более надёжных и современных методов безопасности. В этом приложении представлена ​​подробная техническая информация по каждому требованию, дополняющая общие стандарты, изложенные в главе «Криптография». - -В этом приложении определяются уровни допустимости различных криптографических механизмов: - -* Допустимые механизмы (A) могут использоваться в приложениях. -* Устаревшие механизмы (L) не должны использоваться в приложениях, но могут использоваться только для обеспечения совместимости с существующими устаревшими приложениями или кодом. Хотя использование таких механизмов в настоящее время само по себе не считается уязвимостью, их следует как можно скорее заменить более безопасными и перспективными механизмами. -* Запрещенные механизмы (D) не должны использоваться, поскольку в настоящее время они считаются ненадежными или не обеспечивают достаточной безопасности. - -Этот список может быть переопределен в контексте конкретного приложения по разным причинам, включая: - -* новые разработки в области криптографии; -* соблюдение нормативных требований. - -## Инвентаризация и документирование криптографии - -В этом разделе представлена ​​дополнительная информация -для V11.1 «Инвентаризация и документирование криптографии». - -Важно обеспечить регулярное обнаружение, инвентаризацию и оценку всех криптографических активов, таких как алгоритмы, ключи и сертификаты. Для уровня 3 это должно включать статическое и динамическое сканирование для обнаружения использования криптографии в приложении. Такие инструменты, как SAST и DAST, могут помочь в этом, но для более полного охвата могут потребоваться специализированные инструменты. Примеры бесплатных инструментов: - -* [CryptoMon - Network Cryptography Monitor - using eBPF, written in python](https://github.com/Santandersecurityresearch/CryptoMon) -* [Cryptobom Forge Tool: Generating Comprehensive CBOMs from CodeQL Outputs](https://github.com/Santandersecurityresearch/cryptobom-forge) - -## Эквивалентная стойкость криптографических параметров - -Относительные уровни безопасности различных криптографических систем приведены в следующей таблице (из [NIST SP 800-57 Часть 1](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final), стр.71): - -| Количество бит стойкости | Симметричные алгоритмы | Конечное поле | Целочисленная факторизация | Эллиптическая кривая | -|--|--|--|--|--| -| <= 80 | 2TDEA | L = 1024
N = 160 | k = 1024 | f = 160-223 | -| 112 | 3TDEA | L = 2048
N = 224 | k = 2048 | f = 224-255 | -| 128 | AES-128 | L = 3072
N = 256 | k = 3072 | f = 256-383 | -| 192 | AES-192 | L = 7680
N = 384 | k = 7680 | f = 384-511 | -| 256 | AES-256 | L = 15360
N = 512 | k = 15360 | f = 512+ | - -Примеры применения: - -* Криптография на конечных полях: DSA, FFDH, MQV -* Криптография на целочисленной факторизации: RSA -* Криптография на эллиптических кривых: ECDSA, EdDSA, ECDH, MQV - -Примечание: в этом разделе предполагается, что квантового компьютера не существует; если бы такой компьютер существовал, оценки для последних трех столбцов стали бы недействительными. - -## Случайные значения - -В этом разделе представлена ​​дополнительная информация -для V11.5 «Случайные значения». - -| Имя | Версия/Ссылка | Примечания | Статус | -|:---|:----|:----|:-:| -| `/dev/random` | Linux 4.8+ [(Окт 2016)](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=818e607b57c94ade9824dad63a96c2ea6b21baf3), также встречается в iOS, Android и других операционных системах POSIX на базе Linux. Основан на [RFC7539](https://datatracker.ietf.org/doc/html/rfc7539) | Использование ChaCha20. Найдено в iOS [`SecRandomCopyBytes`](https://developer.apple.com/documentation/security/secrandomcopybytes(_:_:_:)?language=objc) и Android [`Secure Random`](https://developer.android.com/reference/java/security/SecureRandom) с правильными настройками, предоставленными для каждого. | A | -| `/dev/urandom` | Специальный файл ядра Linux для предоставления случайных данных | Обеспечивает высококачественный источник энтропии на основе аппаратной случайности. | A | -| `AES-CTR-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | Используется в распространенных реализациях, таких как [Windows CNG API `BCryptGenRandom`](https://learn.microsoft.com/en-us/windows/win32/api/bcrypt/nf-bcrypt-bcryptgenrandom) при установке [`BCRYPT_RNG_ALGORITHM`](https://learn.microsoft.com/en-us/windows/win32/seccng/cng-algorithm-identifiers). | A | -| `HMAC-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | | A | -| `Hash-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | | A | -| `getentropy()` | [OpenBSD](https://man.openbsd.org/getentropy.2), доступный в [Linux glibc 2.25+](https://man7.org/linux/man-pages/man3/getentropy.3.html) и [macOS 10.12+](https://support.apple.com/en-gb/guide/security/seca0c73a75b/web) | Обеспечивает безопасный доступ к случайным байтам непосредственно из источника энтропии ядра с помощью простого и минималистичного API. Он более современный и позволяет избежать ошибок, связанных со старыми API. | A | - -Базовая хэш-функция, используемая с HMAC-DRBG или Hash-DRBG, должна быть допустима для такого применения. - -## Алгоритмы шифрования - -В этом разделе представлена ​​дополнительная информация -для V11.3 «Алгоритмы шифрования». - -Допустимые алгоритмы шифрования перечислены в порядке предпочтения. - -| Симметричные алгоритмы | Ссылка | Статус | -| ------ | ------ |:-:| -| AES-256 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | A | -| Salsa20 | [Salsa 20 specification](https://cr.yp.to/snuffle/spec.pdf) | A | -| XChaCha20 | [XChaCha20 Draft](https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-xchacha-03) | A | -| XSalsa20 | [Extending the Salsa20 nonce](https://cr.yp.to/snuffle/xsalsa-20110204.pdf) | A | -| ChaCha20 | [RFC 8439](https://www.rfc-editor.org/info/rfc8439) | A | -| AES-192 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | A | -| AES-128 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | L | -| 2TDEA | | D | -| TDEA (3DES/3DEA) | | D | -| IDEA | | D | -| RC4 | | D | -| Blowfish| | D | -| ARC4 | | D | -| DES | | D | - -### Режимы шифрования AES - -Блочные шифры, такие как AES, могут использоваться в различных режимах работы. Многие режимы работы, такие как Electronic codebook (ECB), небезопасны и не должны использоваться. Режимы работы Galois/Counter Mode (GCM) и «Счётчик с кодом аутентификации сообщений цепочки блоков шифра» (CCM) обеспечивают аутентифицированное шифрование и должны использоваться в современных приложениях. - -Допустимые режимы перечислены в порядке предпочтения. - -| Режим | Поддержка аутентификации | Ссылка | Статус | Ограничение | -|--|--|--|--|--| -| GCM | Yes | [NIST SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | | -| CCM | Yes | [NIST SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | | -| CBC | No | [NIST SP 800-38A](https://csrc.nist.gov/pubs/sp/800/38/a/final) | L | | -| CCM-8 | Yes | | D | | -| ECB | No | | D | | -| CFB | No | | D | | -| OFB | No | | D | | -| CTR | No | | D | | - -Примечания: - -* Все зашифрованные сообщения должны быть аутентифицированы. Для ЛЮБОГО использования режима CBC ОБЯЗАТЕЛЬНО должен быть соответствующий алгоритм хеширования MAC для проверки сообщения. Как правило, он ДОЛЖЕН применяться в методе «Шифрование-затем-хеширование» (но в TLS 1.2 вместо этого используется «Хеширование-затем-шифрование»). Если это невозможно гарантировать, то CBC НЕ ДОЛЖЕН использоваться. Единственной опцией, где разрешено шифрование без алгоритма MAC, является шифрование диска. -* При использовании CBC должно быть гарантировано, что проверка заполнения выполняется за константное время. -* При использовании CCM-8 тег MAC имеет только 64 бита стойкости. Это не соответствует требованию 6.2.9, которое требует не менее 128 бит стойкости. -* Шифрование диска считается выходящим за рамки ASVS. Поэтому в данном приложении не перечислены какие-либо утверждённые методы шифрования диска. В этом случае обычно допускается шифрование без аутентификации, и обычно используются режимы XTS, XEX и LRW. - -### Шифрование ключей - -Шифрование ключа (key wrap) и соответствующее расшифрование ключа (key unwrap) — это метод защиты существующего ключа путём его инкапсуляции с использованием дополнительного механизма шифрования, чтобы исходный ключ не был явно раскрыт, например, во время передачи. Этот дополнительный ключ, используемый для защиты исходного ключа, называется ключом обёртывания (wrap key). - -Эта операция может выполняться в случае необходимости защиты ключей в местах, которые считаются недоверенными, а также для передачи конфиденциальных ключей по ненадежным сетям или внутри приложений. -Однако перед началом процедуры шифрования/расшифрования ключей необходимо оценить характер исходного ключа (например, идентичность и назначение). Это может повлиять на безопасность и соответствие требованиям как исходных (до передачи), так и целевых систем/приложений, включая требования по аудиту действий с ключами (например, подпись) и хранению ключей. - -В частности, для шифрования ключей ОБЯЗАТЕЛЬНО должен использоваться алгоритм AES-256, соответствующий [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) и с учётом перспективных мер защиты от квантовых угроз. Режимы шифрования с использованием AES применяются в следующем порядке предпочтения: - -| Шифрование ключа | Ссылка | Статус | -|--|--|:-:| -| KW | [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) | A | -| KWP | [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) | A | - -AES-192 и AES-128 МОГУТ использоваться, если того требует сценарий использования, но обоснование этого ДОЛЖНО быть задокументировано в реестре криптографии организации. - -### Аутентифицированное шифрование - -За исключением шифрования диска, зашифрованные данные должны быть защищены от несанкционированного изменения с использованием какой-либо схемы аутентифицированного шифрования (AE), обычно с использованием схемы аутентифицированного шифрования с соответствующими данными (AEAD). - -Предпочтительно, чтобы приложение использовало утверждённую схему AEAD. В качестве альтернативы, оно может комбинировать утверждённую схему шифрования и утверждённый алгоритм MAC с конструкцией Encrypt-then-MAC. - -MAC-then-encrypt по-прежнему разрешен для совместимости со старыми приложениями. Он используется в TLS версии 1.2 со старыми наборами шифров. - -| Схема AEAD | Ссылка | Статус | -|---|---------|:-:| -|AES-GCM | [SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | -|AES-CCM | [SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | -|ChaCha-Poly1305 | [RFC 7539](https://datatracker.ietf.org/doc/html/rfc7539) | A | -|AEGIS-256 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | -|AEGIS-128 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | -|AEGIS-128L| [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | -|Encrypt-then-MAC | | A | -|MAC-then-encrypt | | L | - -## Хэш-функции - -В этом разделе представлена ​​дополнительная информация -для V11.4 «Хеширование и функции на основе хеширования». - -### Основные случаи использования хэш функций - -В следующей таблице перечислены хэш-функции, допустимые для основных случаев использования криптографии, таких как цифровые подписи: - -* Допустимые хеш-функции обеспечивают высокую устойчивость к коллизиям и подходят для приложений с высоким уровнем безопасности. -* Некоторые из этих алгоритмов обеспечивают высокую устойчивость к атакам при использовании с надлежащим управлением криптографическими ключами, поэтому они дополнительно допустимы для функций HMAC, KDF и RBG. -* Хэш-функции с длиной выходного значения менее 254 бит обладают недостаточной устойчивостью к коллизиям и не должны использоваться для цифровой подписи или других приложений, требующих устойчивости к коллизиям. В других случаях они могут использоваться ТОЛЬКО для обеспечения совместимости и верификации с устаревшими системами, но не должны использоваться в новых разработках. - -| Хэш-функция | Ссылка | Статус | Ограничения | -| ------ | ----------- |:-:| ---------- | -| SHA3-512 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | -| SHA-512 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | -| SHA3-384 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | -| SHA-384 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | -| SHA3-256 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | -| SHA-512/256 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | -| SHA-256 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | -| SHAKE256 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | -| BLAKE2s | [BLAKE2: simpler, smaller, fast as MD5](https://eprint.iacr.org/2013/322) | A | | -| BLAKE2b | [BLAKE2: simpler, smaller, fast as MD5](https://eprint.iacr.org/2013/322) | A | | -| BLAKE3 | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | | -| SHA-224 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | L | Not suitable for HMAC, KDF, RBG, digital signatures | -| SHA-512/224 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | L | Not suitable for HMAC, KDF, RBG, digital signatures | -| SHA3-224 | [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | L | Not suitable for HMAC, KDF, RBG, digital signatures | -| SHA-1 | [RFC 3174](https://www.rfc-editor.org/info/rfc3174) & [RFC 6194](https://www.rfc-editor.org/info/rfc6194) | L | Not suitable for HMAC, KDF, RBG, digital signatures | -| CRC (any length) | | D | | -| MD4 | [RFC 1320](https://www.rfc-editor.org/info/rfc1320) | D | | -| MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | | - -### Хэш-функции для хранения паролей - -Для безопасного хеширования паролей необходимо использовать специальные хеш-функции. Эти медленные алгоритмы хеширования снижают риск атак методом перебора и перебора по словарю, увеличивая вычислительную сложность взлома паролей. - -| KDF | Ссылка | Обязательные параметры | Статус | -| ---------- | --------- | ------------ |:-:| -| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1 | A | -| | | t = 2: m ≥ 19456 (19 MiB), p = 1 | A | -| | | t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | -| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8 | A | -| | | p = 2: N ≥ 2^16 (64 MiB), r = 8 | A | -| | | p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | -| bcrypt | [A Future-Adaptable Password Scheme](https://www.researchgate.net/publication/2519476_A_Future-Adaptable_Password_Scheme) | cost ≥ 10 | A | -| PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 210,000 | A | -| PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 600,000 | A | -| PBKDF2-HMAC-SHA-1 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 1,300,000 | L | - -Для хранения паролей можно использовать допустимые функции формирования ключей на основе паролей. - -## Функции формирования ключа (KDFs) - -### Основные функции формирования ключа - -| KDF | Ссылка | Статус | -| ---------------- | -------- |:-:| -| HKDF | [RFC 5869](https://www.rfc-editor.org/info/rfc5869) | A | -| TLS 1.2 PRF | [RFC 5248](https://www.rfc-editor.org/info/rfc5248) | L | -| MD5-based KDFs | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | -| SHA-1-based KDFs | [RFC 3174](https://www.rfc-editor.org/info/rfc3174) & [RFC 6194](https://www.rfc-editor.org/info/rfc6194) | D | - -### Функции формирования ключа на основе пароля - -| KDF | Ссылка | Обязательные параметры | Статус | -| ---------- | --------- | ------------ |:-:| -| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1 | A | -| | | t = 2: m ≥ 19456 (19 MiB), p = 1 | A | -| | | t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | -| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8 | A | -| | | p = 2: N ≥ 2^16 (64 MiB), r = 8 | A | -| | | p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | -| PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 210,000 | A | -| PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 600,000 | A | -| PBKDF2-HMAC-SHA-1 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 1,300,000 | L | - -## Механизмы обмена ключами - -В этом разделе представлена ​​дополнительная информация -для V11.6 «Криптография с публичным ключом». - -### Схемы KEX - -Для всех схем обмена ключами ДОЛЖНА быть обеспечена стойкость в 112 бит или выше, а их реализация ДОЛЖНА соответствовать выбору параметров, представленному в следующей таблице. - -| Схема | Параметры | Прямая секретность | Статус | -|--|--|--|:-:| -| Диффи-Хеллман на конечных полях (FFDH) | L >= 3072 & N >= 256 | Yes | A | -| Диффи-Хеллман на эллиптических кривых (ECDH) | f >= 256-383 | Yes | A | -| Передача зашифрованного ключа с помощью RSA-PKCS#1 v1.5 | | No | D | - -Где следующие параметры: - -* k — длина ключа для RSA. -* L — длина открытого ключа, а N — длина закрытого ключа для криптографии на конечном поле. -* f — диапазон длин ключей для ECC. - -Любая новая реализация НЕ ДОЛЖНА использовать схему, НЕ соответствующую [NIST SP 800-56A](https://csrc.nist.gov/pubs/sp/800/56/a/r3/final) & [B](https://csrc.nist.gov/pubs/sp/800/56/b/r2/final) и [NIST SP 800-77](https://csrc.nist.gov/pubs/sp/800/77/r1/final). В частности, IKEv1 НЕ ДОЛЖЕН использоваться в промышленной среде. - -### Группы Диффи-Хеллмана - -Следующие группы допустимы для реализации обмена ключами Диффи-Хеллмана. Уровни безопасности описаны в [NIST SP 800-56A](https://csrc.nist.gov/pubs/sp/800/56/a/r3/final), Приложение D, и [NIST SP 800-57 Часть 1, Ред. 5](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final). - -| Группа | Статус | -|------------------|:------:| -| P-224, secp224r1 | A | -| P-256, secp256r1 | A | -| P-384, secp384r1 | A | -| P-521, secp521r1 | A | -| K-233, sect233k1 | A | -| K-283, sect283k1 | A | -| K-409, sect409k1 | A | -| K-571, sect571k1 | A | -| B-233, sect233r1 | A | -| B-283, sect283r1 | A | -| B-409, sect409r1 | A | -| B-571, sect571r1 | A | -| Curve448 | A | -| Curve25519 | A | -| MODP-2048 | A | -| MODP-3072 | A | -| MODP-4096 | A | -| MODP-6144 | A | -| MODP-8192 | A | -| ffdhe2048 | A | -| ffdhe3072 | A | -| ffdhe4096 | A | -| ffdhe6144 | A | -| ffdhe8192 | A | - -## Коды аутентификации сообщений (MAC) - -Коды аутентификации сообщений (MAC) — это криптографические конструкции, используемые для проверки целостности и подлинности сообщения. MAC принимает сообщение и секретный ключ в качестве входных данных и создаёт тег фиксированного размера (значение MAC). MAC широко используется в протоколах защищённой связи (например, TLS/SSL) для обеспечения подлинности и целостности сообщений, которыми обмениваются стороны. - -| Алгоритм MAC | Ссылка | Статус | -| ---------- | --------------- |:-:| -| HMAC-SHA-256 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | -| HMAC-SHA-384 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | -| HMAC-SHA-512 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | -| KMAC128 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | -| KMAC256 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | -| BLAKE3 (keyed_hash mode) | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | -| AES-CMAC | [RFC 4493](https://datatracker.ietf.org/doc/html/rfc4493) & [NIST SP 800-38B](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38b.pdf) | A | -| AES-GMAC | [NIST SP 800-38D](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf) | A | -| Poly1305-AES | [The Poly1305-AES message-authentication code](https://cr.yp.to/mac/poly1305-20050329.pdf) | A | -| HMAC-SHA-1 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | L | -| HMAC-MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | - -## Цифровые подписи - -Схемы подписи ДОЛЖНЫ использовать утвержденные размеры ключей и параметры согласно [NIST SP 800-57 Часть 1](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final). - -| Алгоритм подписи | Ссылка | Статус | -| ------------------------------ | --------------------------------------------- | :-: | -| EdDSA (Ed25519, Ed448) | [RFC 8032](https://www.rfc-editor.org/info/rfc8032) | A | -| XEdDSA (Curve25519, Curve448) | [XEdDSA](https://signal.org/docs/specifications/xeddsa/) | A | -| ECDSA (P-256, P-384, P-521) | [FIPS 186-4](https://csrc.nist.gov/pubs/fips/186-5/final) | A | -| RSA-RSSA-PSS | [RFC 8017](https://www.rfc-editor.org/info/rfc8017) | A | -| RSA-SSA-PKCS#1 v1.5 | [RFC 8017](https://www.rfc-editor.org/info/rfc8017) | D | -| DSA (any key size) | [FIPS 186-4](https://csrc.nist.gov/pubs/fips/186-4/final) | D | - -## Стандарты постквантового шифрования - -Реализации постквантовой криптографии (PQC) должны соответствовать стандартам [FIPS-203](https://csrc.nist.gov/pubs/fips/203/ipd), [FIPS-204](https://csrc.nist.gov/pubs/fips/204/ipd) и [FIPS-205](https://csrc.nist.gov/pubs/fips/205/ipd). В настоящее время для этих стандартов доступно не так много примеров эталонных реализаций. Подробнее см. [объявление NIST о первых трёх финализированных постквантовых стандартах шифрования (август 2024 г.)](https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards). - -Предлагаемый постквантовый гибридный метод согласования ключей TLS [mlkem768x25519](https://datatracker.ietf.org/doc/draft-kwiatkowski-tls-ecdhe-mlkem/03/) поддерживается основными браузерами, такими как [Firefox версии 132](https://www.mozilla.org/en-US/firefox/132.0/releasenotes/) и [Chrome версии 131](https://security.googleblog.com/2024/09/a-new-path-for-kyber-on-web.html). Он может использоваться в средах тестирования криптографии или при наличии в библиотеках, допустимых отраслевыми или государственными органами. diff --git a/5.0/ru/0x93-Appendix-D_Recommendations.md b/5.0/ru/0x93-Appendix-D_Recommendations.md deleted file mode 100644 index c51830efae..0000000000 --- a/5.0/ru/0x93-Appendix-D_Recommendations.md +++ /dev/null @@ -1,49 +0,0 @@ -# Приложение D: Рекомендации - -## Введение - -При подготовке версии 5.0 Стандарта верификации требований к безопасности приложений (ASVS) стало очевидно, что ряд существующих и вновь предложенных пунктов не следует включать в требования версии 5.0. Это могло быть связано с тем, что они не входят в область действия ASVS согласно определению для версии 5.0, или же потому, что, хотя эти идеи и представлялись полезными, их нельзя было сделать обязательными. - -Не желая полностью потерять все эти материалы, некоторые из них были включены в это приложение. - -## Рекомендуемые механизмы, входящие в область применения - -Следующие пункты входят в область действия ASVS. Они не должны быть обязательными, но настоятельно рекомендуется рассматривать их как часть безопасного приложения. - -* Необходимо предоставить индикатор надежности пароля, чтобы помочь пользователям установить более стойкий пароль. -* Создайте общедоступный файл security.txt в корневом каталоге или каталоге .well-known приложения, в котором будет чётко указана ссылка или адрес электронной почты, по которым пользователи смогут связаться с владельцами по вопросам безопасности. -* В дополнение к проверке на уровне доверенных служб следует применять проверку входных данных на стороне клиента, поскольку это даёт хорошую возможность обнаружить, когда кто-то обходит клиентские средства защиты при попытке атаки на приложение. -* Предотвращайте появление в поисковых системах случайно доступных и конфиденциальных страниц с помощью файла robots.txt, заголовка ответа X-Robots-Tag или метатега robots.html. -* При использовании GraphQL реализуйте логику авторизации на уровне бизнес-логики, а не на уровне GraphQL или резолвера, чтобы избежать необходимости обрабатывать авторизацию на каждом отдельном интерфейсе. - -Ссылки: - -* [Дополнительная информация о security.txt, включая ссылку на RFC](https://securitytxt.org/) - -## Принципы безопасности программного обеспечения - -Следующие пункты ранее присутствовали в ASVS, но они не являются требованиями. Скорее, это принципы, которые следует учитывать при реализации мер безопасности, соблюдение которых приведет к повышению надежности этих мер. К ним относятся: - -* Средства управления безопасностью должны быть централизованными, простыми (экономия времени), проверяемо безопасными и допускающими повторное использование. Это позволит избежать дублирования, отсутствия или неэффективности средств управления. -* По возможности используйте ранее написанные и проверенные реализации средств управления безопасностью, а не полагайтесь на их реализацию с нуля. -* В идеале для доступа к защищённым данным и ресурсам следует использовать единый механизм управления доступом. Все запросы должны проходить через этот механизм, чтобы избежать копирования и вставки или небезопасных альтернативных путей. -* Управление доступом на основе атрибутов или функций — рекомендуемый шаблон, при котором код проверяет авторизацию пользователя для функции или элемента данных, а не только его роль. Разрешения по-прежнему должны предоставляться с использованием ролей. - -## Процессы обеспечения безопасности программного обеспечения - -Ряд процессов обеспечения безопасности были исключены из ASVS 5.0, но всё ещё представляют собой хорошую идею. Проект OWASP SAMM может стать хорошим источником информации о том, как эффективно реализовать эти процессы. Ранее в ASVS присутствовали следующие элементы: - -* Убедитесь в использовании безопасного жизненного цикла разработки программного обеспечения, который обеспечивает безопасность на всех этапах разработки. -* Убедитесь в применении моделирования угроз для каждого изменения дизайна или планирования спринта, чтобы выявлять угрозы, планировать контрмеры, способствовать надлежащему реагированию на риски и управлять тестированием безопасности. -* Убедитесь, что все пользовательские истории и функции содержат функциональные ограничения безопасности. Например, "Как пользователь, я должен иметь возможность просматривать и редактировать свой профиль, но не должен иметь возможности просматривать или редактировать чужой профиль". -* Убедитесь в наличии чек-листа для безопасной разработки, требований, политик и стандартов безопасности, а также в их доступности для разработчиков и тестировщиков. -* Убедитесь, что существует непрерывный процесс, гарантирующий отсутствие в исходном коде приложения бэкдоров, вредоносного кода (такого как атаки типа «нарезка салями», обход логики или «логические бомбы») и недокументированных или скрытых функций (например, «пасхальных яиц», небезопасных инструментов отладки). Выполнение требований этого раздела невозможно без полного доступа к исходному коду, включая сторонние библиотеки, и поэтому, вероятно, подходит только для приложений, требующих высочайшего уровня безопасности. -* Убедитесь, что в средах развертывания реализованы механизмы обнаружения и реагирования на отклонения конфигурации. Это может включать использование неизменяемой инфраструктуры, автоматическое повторное развертывание с безопасной базовой конфигурацией или инструменты обнаружения отклонений, сравнивающие текущее состояние с утверждёнными конфигурациями. -* Убедитесь, что усиление защиты конфигурации выполняется для всех сторонних продуктов, библиотек, фреймворков и служб в соответствии с их индивидуальными рекомендациями. - -Ссылки: - -* [OWASP Threat Modeling Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html) -* [OWASP Threat modeling](https://owasp.org/www-community/Application_Threat_Modeling) -* [OWASP Software Assurance Maturity Model Project](https://owasp.org/www-project-samm/) -* [Microsoft SDL](https://www.microsoft.com/en-us/securityengineering/sdl/) diff --git a/5.0/ru/0x94-Appendix-E_Contributors.md b/5.0/ru/0x94-Appendix-E_Contributors.md deleted file mode 100644 index 1b845cc51e..0000000000 --- a/5.0/ru/0x94-Appendix-E_Contributors.md +++ /dev/null @@ -1,71 +0,0 @@ -# Приложение E: Участники - -Мы выражаем благодарность следующим людям, которые комментировали или открывали пул-реквесты после выпуска ASVS 4.0.0. - -Если вам известно о каких-либо ошибках или вы хотите, чтобы ваше имя отображалось иначе, пожалуйста, сообщите нам об этом. - -| | | | | -|---|---|---|---| -| Johan Sydseter ([sydseter](https://github.com/sydseter)) | luis servin ([lfservin](https://github.com/lfservin)) | Oleksii Dovydkov ([oleksiidov](https://github.com/oleksiidov)) | IZUKA Masahiro ([maizuka](https://github.com/maizuka)) | -| James Sulinski ([jsulinski](https://github.com/jsulinski)) | Eli Saad ([ThunderSon](https://github.com/ThunderSon)) | [kkshitish9](https://github.com/kkshitish9) | Andrew van der Stock ([vanderaj](https://github.com/vanderaj)) | -| Rick M ([kingthorin](https://github.com/kingthorin)) | Bankde Eakasit ([Bankde](https://github.com/Bankde)) | Michael Gargiullo ([mgargiullo](https://github.com/mgargiullo)) | Raphael Dunant ([Racater](https://github.com/Racater)) | -| Cesar Kohl ([cesarkohl](https://github.com/cesarkohl)) | [inaz0](https://github.com/inaz0) | Joerg Bruenner ([JoergBruenner](https://github.com/JoergBruenner)) | David Deatherage ([securitydave](https://github.com/securitydave)) | -| John Carroll ([yosignals](https://github.com/yosignals)) | Jim Fenton ([jimfenton](https://github.com/jimfenton)) | Matteo Pace ([M4tteoP](https://github.com/M4tteoP)) | Sebastien gioria ([SPoint42](https://github.com/SPoint42)) | -| Steven van der Baan ([vdbaan](https://github.com/vdbaan)) | Jeremy Bonghwan Choi ([jeremychoi](https://github.com/jeremychoi)) | [craig-shony](https://github.com/craig-shony) | Riccardo Sirigu ([ricsirigu](https://github.com/ricsirigu)) | -| Tomasz Wrobel ([tw2as](https://github.com/tw2as)) | Alena Dubeshko ([belalena](https://github.com/belalena)) | Rafael Green ([RafaelGreen1](https://github.com/RafaelGreen1)) | [mjang-cobalt](https://github.com/mjang-cobalt) | -| [clallier94](https://github.com/clallier94) | Kevin W. Wall ([kwwall](https://github.com/kwwall)) | Jordan Sherman ([jsherm-fwdsec](https://github.com/jsherm-fwdsec) / [deleterepo](https://github.com/deleterepo)) | Ingo Rauner ([ingo-rauner](https://github.com/ingo-rauner)) | -| Dirk Wetter ([drwetter](https://github.com/drwetter)) | Moshe Zioni ([moshe-apiiro](https://github.com/moshe-apiiro)) | Patrick Dwyer ([coderpatros](https://github.com/coderpatros)) | David Clarke ([davidclarke-au](https://github.com/davidclarke-au)) | -| Takaharu Ogasa ([takaharuogasa](https://github.com/takaharuogasa)) | Arkadii Yakovets ([arkid15r](https://github.com/arkid15r)) | Motoyasu Saburi ([motoyasu-saburi](https://github.com/motoyasu-saburi)) | [leirn](https://github.com/leirn) | -| [wet-certitude](https://github.com/wet-certitude) | [timhemel](https://github.com/timhemel) | RL Thornton ([thornshadow99](https://github.com/thornshadow99)) | Thomas Bandt ([aspnetde](https://github.com/aspnetde)) | -| Roel Storms ([roelstorms](https://github.com/roelstorms)) | Jeroen Willemsen ([commjoen](https://github.com/commjoen)) | [anonymous-31](https://github.com/anonymous-31) | Kamran Saifullah ([deFr0ggy](https://github.com/deFr0ggy)) | -| Steve Springett ([stevespringett](https://github.com/stevespringett)) | Spyros ([northdpole](https://github.com/northdpole)) | Hans Herrera ([hansphp](https://github.com/hansphp)) | [Marx314](https://github.com/Marx314) | -| [CarlosAllendes](https://github.com/CarlosAllendes) | Yonah Russ ([yruss972](https://github.com/yruss972)) | Sander Maijers ([sanmai-NL](https://github.com/sanmai-NL)) | Luboš Bretschneider ([bretik](https://github.com/bretik)) | -| Eva Sarafianou ([esarafianou](https://github.com/esarafianou)) | Ata Seren [ataseren](https://github.com/ataseren) | Steve Thomas ([Sc00bz](https://github.com/Sc00bz)) | Dominique RIGHETTO ([righettod](https://github.com/righettod)) | -| Steven van der Baan ([svdb-ncc](https://github.com/svdb-ncc)) | Michael Vacarella ([Aif4thah](https://github.com/Aif4thah)) | Tonimir Kisasondi ([tkisason](https://github.com/tkisason)) | Stefan Streichsbier ([streichsbaer](https://github.com/streichsbaer)) | -| [hi-unc1e](https://github.com/hi-unc1e) | sb3k ([starbuck3000](https://github.com/starbuck3000)) | [mario-platt](https://github.com/mario-platt) | Devdatta Akhawe ([devd](https://github.com/devd)) | -| Michael Gissing ([scolytus](https://github.com/scolytus)) | Jet Anderson ([thatsjet](https://github.com/thatsjet)) | Dave Wichers ([davewichers](https://github.com/davewichers)) | Jonny Schnittger ([JonnySchnittger](https://github.com/JonnySchnittger)) | -| Silvia Väli ([silviavali](https://github.com/silviavali)) | [jackgates73](https://github.com/jackgates73) | [1songb1rd](https://github.com/1songb1rd) | Timur - ([timurozkul](https://github.com/timurozkul)) | -| Gareth Heyes ([hackvertor](https://github.com/hackvertor)) | [appills](https://github.com/appills) | [suvikaartinen](https://github.com/suvikaartinen) | chaals ([chaals](https://github.com/chaals)) | -| DanielPharos ([AtlasHackert](https://github.com/AtlasHackert)) | will Farrell ([willfarrell](https://github.com/willfarrell)) | Alina Vasiljeva ([avasiljeva](https://github.com/avasiljeva)) | Paul McCann ([ismisepaul](https://github.com/ismisepaul)) | -| Sage ([SajjadPourali](https://github.com/SajjadPourali)) | [rbsec](https://github.com/rbsec) | Benedikt Bauer ([mastacheata](https://github.com/mastacheata)) | James Jardine ([jamesjardine](https://github.com/jamesjardine)) | -| Mark Burnett ([m8urnett](https://github.com/m8urnett)) | [dschwarz91](https://github.com/dschwarz91) | Cyber-AppSec ([Cyber-AppSec](https://github.com/Cyber-AppSec)) | [Tib3rius](https://github.com/Tib3rius) | -| BitnessWise ([bitnesswise](https://github.com/bitnesswise)) | damienbod ([damienbod](https://github.com/damienbod)) | Jared Meit ([jmeit-fwdsec](https://github.com/jmeit-fwdsec)) | Stefan Seelmann ([sseelmann](https://github.com/sseelmann)) | -| Brendan O'Connor ([ussjoin](https://github.com/ussjoin)) | Andrei Titov ([andrettv](https://github.com/andrettv)) | Hans-Petter Fjeld ([atluxity](https://github.com/atluxity)) | [markehack](https://github.com/markehack) | -| Neil Madden ([NeilMadden](https://github.com/NeilMadden)) | Michael Geramb ([mgeramb](https://github.com/mgeramb)) | Osama Elnaggar ([ossie-git](https://github.com/ossie-git)) | [mackowski](https://github.com/mackowski) | -| Ravi Balla ([raviballa](https://github.com/raviballa)) | Hazana ([hazanasec](https://github.com/hazanasec)) | David Means ([dmeans82](https://github.com/dmeans82)) | Alexander Stein ([tohch4](https://github.com/tohch4)) | -| BaeSenseii ([baesenseii](https://github.com/baesenseii)) | Vincent De Schutter ([VincentDS](https://github.com/VincentDS)) | S Bani ([sbani](https://github.com/sbani)) | Mitsuaki Akiyama ([mak1yama](https://github.com/mak1yama)) | -| Christopher Loessl ([hashier](https://github.com/hashier)) | [victorxm](https://github.com/victorxm) | Michal Rada ([michalradacz](https://github.com/michalradacz)) | Veeresh Devireddy ([drveresh](https://github.com/drveresh)) | -| [MaknaSEO](https://github.com/MaknaSEO) | [darkzero2022](https://github.com/darkzero2022) | Liam ([LiamDobbelaere](https://github.com/LiamDobbelaere)) | Frank Denis ([jedisct1](https://github.com/jedisct1)) | -| Otto Sulin ([ottosulin](https://github.com/ottosulin)) | [carllaw6885](https://github.com/carllaw6885) | Anders Johan Holmefjord ([aholmis](https://github.com/aholmis)) | Richard Fritsch ([rfricz](https://github.com/rfricz)) | -| [mesutgungor](https://github.com/mesutgungor) | Scott Helme ([ScottHelme](https://github.com/ScottHelme)) | Carlo Reggiani ([carloreggiani](https://github.com/carloreggiani)) | Suyash Srivastava ([suyash5053](https://github.com/suyash5053)) | -| Mark Potter ([markonweb](https://github.com/markonweb)) | Arjan Lamers ([alamers](https://github.com/alamers)) | Gøran Breivik ([gobrtg](https://github.com/gobrtg)) | [flo-blg](https://github.com/flo-blg) | -| Guillaume Déflache ([guillaume-d](https://github.com/guillaume-d)) | Toufik Airane ([toufik-airane](https://github.com/toufik-airane)) | Keith Hoodlet ([securingdev](https://github.com/securingdev)) | Sinner ([SoftwareSinner](https://github.com/SoftwareSinner)) | -| [iloving](https://github.com/iloving) | Jeroen Beckers ([TheDauntless](https://github.com/TheDauntless)) | Joubin Jabbari ([joubin](https://github.com/joubin)) | yu fujioka ([fujiokayu](https://github.com/fujiokayu)) | -| execjosh ([execjosh](https://github.com/execjosh)) | Alicja Kario ([tomato42](https://github.com/tomato42)) | Sidney Ribeiro ([srjsoftware](https://github.com/srjsoftware)) | Gabriel Marquet ([Gby56](https://github.com/Gby56)) | -| Drew Schulz ([drschulz](https://github.com/drschulz)) | [bedirhan](https://github.com/bedirhan) | [muralito](https://github.com/muralito) | Ronnie Flathers ([ropnop](https://github.com/ropnop)) | -| Philippe De Ryck ([philippederyck](https://github.com/philippederyck)) | Malte ([mal33](https://github.com/mal33)) | [MazeOfThoughts](https://github.com/MazeOfThoughts) | Andreas Falk ([andifalk](https://github.com/andifalk)) | -| Javi ([javixeneize](https://github.com/javixeneize)) | Daniel Hahn ([averell23](https://github.com/averell23)) | [borislav-c](https://github.com/borislav-c) | Robin Wood ([digininja](https://github.com/digininja)) | -| [miro2ns](https://github.com/miro2ns) | Jan Dockx ([jandockx](https://github.com/jandockx)) | [vipinsaini434](https://github.com/vipinsaini434) | [priyanshukumar397](https://github.com/priyanshukumar397) | -| Nat Sakimura ([sakimura](https://github.com/sakimura)) | Benjamin Häublein ([BenjaminHae](https://github.com/BenjaminHae)) | [unknown-user-from](https://github.com/unknown-user-from) | Ali Ramazan TAŞDELEN ([alitasdln](https://github.com/alitasdln)) | -| Pedro Escaleira ([oEscal](https://github.com/oEscal)) | Josh ([josh-hemphill](https://github.com/josh-hemphill)) | Tim Würtele ([SECtim](https://github.com/SECtim)) | AviD ([avidouglen](https://github.com/avidouglen)) | -| SheHacksPurple ([shehackspurple](https://github.com/shehackspurple)) | [fcerullo-cycubix](https://github.com/fcerullo-cycubix) | Hector Eryx Paredes Camacho ([heryxpc](https://github.com/heryxpc)) | Irene Michlin ([irene221b](https://github.com/irene221b)) | -| Jonah Y-M ([TG-Techie](https://github.com/TG-Techie)) | Dhiraj Bahroos ([bahroos](https://github.com/bahroos)) | Jef Meijvis ([jefmeijvis](https://github.com/jefmeijvis)) | [IzmaDoesItbeta](https://github.com/IzmaDoesItbeta) | -| Abdessamad TEMMAR ([TmmmmmR](https://github.com/TmmmmmR)) | [sectroyer](https://github.com/sectroyer) | Soh Satoh ([sohsatoh](https://github.com/sohsatoh)) | [regoravalaz](https://github.com/regoravalaz) | -| james-t ([james-bitherder](https://github.com/james-bitherder)) | Aram Hovsepyan ([aramhovsepyan](https://github.com/aramhovsepyan)) | [JaimeGomezGarciaSan](https://github.com/JaimeGomezGarciaSan) | [ValdiGit01](https://github.com/ValdiGit01) | -| iwatachan ([ishowta](https://github.com/ishowta)) | Vinod Anandan ([VinodAnandan](https://github.com/VinodAnandan)) | Kevin Kien ([KevinKien](https://github.com/KevinKien)) | [paul-williamson-swoop](https://github.com/paul-williamson-swoop) | -| [endergzr](https://github.com/endergzr) | Radhwan Alshamamri ([Rado0z](https://github.com/Rado0z)) | Grant Ongers ([rewtd](https://github.com/rewtd)) | Cure53 ([cure53](https://github.com/cure53)) | -| [AliR2Linux](https://github.com/AliR2Linux) | Ads Dawson ([GangGreenTemperTatum](https://github.com/GangGreenTemperTatum)) | William Reyor ([BillReyor](https://github.com/BillReyor)) | gabe ([gcrow](https://github.com/gcrow)) | -| [mascotter](https://github.com/mascotter) | [luissaiz](https://github.com/luissaiz) | Suren Manukyan ([vx-sec](https://github.com/vx-sec)) | Piotr Gliźniewicz ([pglizniewicz](https://github.com/pglizniewicz)) | -| Tadeusz Wachowski ([tadeuszwachowski](https://github.com/tadeuszwachowski)) | Nasir aka Nate ([andesec](https://github.com/andesec)) | [settantasette](https://github.com/settantasette) | Lars Haulin ([LarsH](https://github.com/LarsH)) | -| Terence Eden ([edent](https://github.com/edent)) | [JasmineScholz](https://github.com/JasmineScholz) | Arun Sivadasan ([teavanist](https://github.com/teavanist)) | Yusuf GÜR ([yusuffgur](https://github.com/yusuffgur)) | -| Troy Marshall ([troymarshall](https://github.com/troymarshall)) | Tanner Prynn ([tprynn](https://github.com/tprynn)) | Nick K. ([nickific](https://github.com/nickific)) | [raoul361](https://github.com/raoul361) | -| Azeem Ilyas ([TheAxZim](https://github.com/TheAxZim)) | Evo Stamatov ([avioli](https://github.com/avioli)) | Tim Potter ([timpotter87](https://github.com/timpotter87)) | Gavin Ray ([GavinRay97](https://github.com/GavinRay97)) | -| monis ([demideus](https://github.com/demideus)) | Marcin Hoppe ([MarcinHoppe](https://github.com/MarcinHoppe)) | Grambulf ([ramshazar](https://github.com/ramshazar)) | Jordan Pike ([computersarebad](https://github.com/computersarebad)) | -| Jason Rogers ([jason-invision](https://github.com/jason-invision)) | Ben Hall ([benbhall](https://github.com/benbhall)) | JamesPoppyCock ([jamesly123](https://github.com/jamesly123)) | WhiteHackLabs ([whitehacklabs](https://github.com/whitehacklabs)) | -| Alex Gaynor ([alex](https://github.com/alex)) | Filip van Laenen ([filipvanlaenen](https://github.com/filipvanlaenen)) | [jeurgen](https://github.com/jeurgen) | [GraoMelo](https://github.com/GraoMelo) | -| Andreas Kurtz ([ay-kay](https://github.com/ay-kay)) | Tom Tervoort ([TomTervoort](https://github.com/TomTervoort)) | old man ([deveras](https://github.com/deveras)) | Marco Schnüriger ([marcortw](https://github.com/marcortw)) | -| [stiiin](https://github.com/stiiin) | infoseclearn ([teaminfoseclearn](https://github.com/teaminfoseclearn)) | [hljupkij](https://github.com/hljupkij) | Noe ([nmarher](https://github.com/nmarher)) | -| Lyz ([lyz-code](https://github.com/lyz-code)) | Martin Riedel ([mrtnrdl](https://github.com/mrtnrdl)) | KIM Jaesuck ([tcaesvk](https://github.com/tcaesvk)) | Barbara Schachner ([bschach](https://github.com/bschach)) | -| René Reuter ([AresSec](https://github.com/AresSec)) | [carhackpils](https://github.com/carhackpils) | Tyler ([tyler2cr](https://github.com/tyler2cr)) | Hugo ([hasousa](https://github.com/hasousa)) | -| Wouter Bloeyaert ([Someniak](https://github.com/Someniak)) | Mark de Rijk ([markderijkinfosec](https://github.com/markderijkinfosec)) | Ramin ([picohub](https://github.com/picohub)) | Philip D. Turner ([philipdturner](https://github.com/philipdturner)) | -| Will Chatham ([willc](https://github.com/willc)) | | | | diff --git a/5.0/tr/0x00-Header.yaml b/5.0/tr/0x00-Header.yaml deleted file mode 100644 index 008ba53ddc..0000000000 --- a/5.0/tr/0x00-Header.yaml +++ /dev/null @@ -1,16 +0,0 @@ ---- - title: "Uygulama Güvenliği Doğrulama Standardı" - subtitle: "Versiyon 5.0.0" - date: Mayıs 2025 - titlepage: true - titlepage-rule-height: 0 - titlepage-logo: "images/owasp_logo_1c_notext.png" - table-use-row-colors: true - toc: true - toc-own-page: true - geometry: "left=2cm,right=2cm,top=3cm,bottom=3cm" - CJKmainfont: "Noto Sans CJK JP" - mainfont: "Source Serif 4" - sansfont: "Source Sans 3" ---- - diff --git a/5.0/tr/0x01-Frontispiece.md b/5.0/tr/0x01-Frontispiece.md deleted file mode 100644 index 10cc928d18..0000000000 --- a/5.0/tr/0x01-Frontispiece.md +++ /dev/null @@ -1,46 +0,0 @@ -# Bilgilendirme - -## Standart Hakkında - -Uygulama Güvenliği Doğrulama Standardı, mimarlar, geliştiriciler, test uzmanları, güvenlik profesyonelleri, araç satıcıları ve tüketiciler tarafından güvenli uygulamaları tanımlamak, inşa etmek, test etmek ve doğrulamak için kullanılabilecek uygulama güvenliği gereksinimleri veya testlerinin bir listesidir. - -## Telif Hakkı ve Lisans - -Versiyon 5.0.0, Mayıs 2025 - -![license](../images/license.png) - -Copyright © 2008-2025 The OWASP Foundation. - -Bu doküman [Creative Commons Attribution-ShareAlike 4.0 Uluslararası Lisansı](https://creativecommons.org/licenses/by-sa/4.0/) altında yayımlanmıştır. - -Dokümanın yeniden kullanımı veya dağıtımı esnasında bu lisans göz önünde bulundurulmalıdır. - -## Proje Liderleri - -| | | -|---------------------- |----------------- | -| Elar Lang | Josh C Grossman | -| Jim Manico | Daniel Cuthbert | - -## Çalışma Grubu - -| | | | | -|---------------- |------------------ |------------------- |----------------- | -| Tobias Ahnoff | Ralph Andalis | Ryan Armstrong | Gabriel Corona | -| Meghan Jacquot | Shanni Prutchi | Iman Sharafaldin | Eden Yardeni | - -## Diğer Önemli Katkıda Bulunanlar - -| | | -|-------------------|-------------------| -| Sjoerd Langkemper | Isaac Lewis | -| Mark Carney | Sandro Gauci | - -## Diğer Katkıda Bulunanlar ve Değerlendirenler - -Diğer katkıda bulunanların bir listesini Ek E'ye ekledik. - -Eğer 5.x katkıda bulunanlar listesinde eksik bir kişi varsa, gelecekteki 5.x güncellemelerinde eklenmesi için lütfen GitHub'da bir olay açın. - -Uygulama Güvenliği Doğrulama Standardı, 2008'de ASVS 1.0'dan 2019'da ASVS 4.0'a kadar katkıda bulunanların emeğiyle inşa edilmiştir. ASVS'nin bugünkü yapısının ve doğrulama maddelerinin çoğu, başlangıçta Andrew van der Stock, Mike Boberski, Jeff Williams ve/veya Dave Wichers tarafından yazılmış olsa da, katkıda bulunan çok daha fazla kişi bulunmaktadır. Daha önce katkıda bulunan herkese teşekkür ederiz. Önceki sürümlere katkıda bulunanların tam listesi için lütfen önceki ilgili sürümleri inceleyin. diff --git a/5.0/tr/0x02-Preface.md b/5.0/tr/0x02-Preface.md deleted file mode 100644 index 685fb10e54..0000000000 --- a/5.0/tr/0x02-Preface.md +++ /dev/null @@ -1,29 +0,0 @@ -# Önsöz - -Uygulama Güvenliği Doğrulama Standardı (ASVS) 5.0 sürümüne hoş geldiniz. - -## Giriş - -İlk olarak 2008 yılında küresel bir topluluk iş birliğiyle başlatılan ASVS, modern web uygulamaları ve servislerinin tasarımı, geliştirilmesi ve test edilmesi için kapsamlı bir güvenlik gereksinimleri setini tanımlar. - -2019’da ASVS 4.0 sürümü ve 2021’deki küçük güncellemesi (v4.0.3) sonrası, 5.0 sürümü yazılım güvenliğindeki en son gelişmeleri yansıtacak şekilde modernleştirilmiş önemli bir dönüm noktasıdır. - -ASVS 5.0, proje liderleri, çalışma grubu üyeleri ve bunlardan daha geniş OWASP topluluğunun bu önemli standardı güncellemek ve geliştirmek amacıyla verdikleri yoğun katkıların sonucudur. - -## 5.0 Sürümünün Arkasındaki İlkeler - -Bu büyük revizyon, birkaç temel ilke göz önünde bulundurularak geliştirilmiştir: - -* Daha Net Kapsam ve Odak: Standardın bu sürümü, adındaki temel dayanaklar "Uygulama, Güvenlik, Doğrulama ve Standart" ile daha doğrudan uyumlu olacak şekilde tasarlanmıştır. Gereksinimler, belirli teknik uygulamaları zorunlu kılmak yerine, güvenlik açıklarının önlenmesine vurgu yapacak şekilde yeniden yazılmıştır. Gereksinim metinlerinin kendi kendilerini açıklaması ve neden var olduklarını açıklaması amaçlanmıştır. - -* Belgelenmiş Güvenlik Kararları Desteği: ASVS 5.0, temel güvenlik kararlarının belgelenmesine dair gereksinimler getirmektedir. Bu sayede izlenebilirlik artar ve bağlama duyarlı uygulamalar desteklenerek, organizasyonların güvenlik duruşlarını özel ihtiyaç ve risklerine göre uyarlamalarına olanak sağlar. - -* Güncellenmiş Seviyeler: ASVS üç katmanlı modelini korurken, benimsenmelerinin kolaylaştırması için seviye tanımları geliştirilmiştir. Seviye 1, ASVS’yi benimsemenin ilk adımı olarak tasarlanmıştır ve ilk savunma katmanını sağlamaktadır. Seviye 2, standart güvenlik uygulamalarının kapsamlı bir görünümünü sunar. Seviye 3 ise gelişmiş ve yüksek seviye güvence gereksinimlerini kapsar. - -* Yeniden Yapılandırılmış ve Genişletilmiş İçerik: ASVS 5.0, 17 bölümde yaklaşık 350 gereksinimi içermektedir. Bölümler, açıklık ve kullanılabilirliği artırmak için yeniden düzenlenmiştir. Geçişi kolaylaştırmak amacıyla v4.0 ile v5.0 arasında çift yönlü bir eşleştirme sağlanmıştır. - -## ASVS'nin Geleceği - -Bir uygulamanın güvenliğini sağlamak hiçbir zaman tam anlamıyla bitmeyeceği gibi, ASVS de bitmeyecektir. 5.0 sürümü büyük bir adım olsa da, geliştirme süreci devam etmektedir. Bu sürüm, topluluğun biriken geliştirmelerden ve eklemelerden faydalanmasını sağlamakla kalmaz, aynı zamanda gelecekteki iyileştirmeler için zemin hazırlar. Bunlar arasında topluluk tarafından oluşturulan uygulama ve doğrulama rehberlerinin temel gereksinim seti üzerine inşa edilmesi de olabilir. - -ASVS 5.0, güvenli yazılım geliştirme için güvenilir bir temel oluşturacak şekilde tasarlanmıştır. Topluluk, uygulama güvenliğinin durumunu kolektif olarak ilerletmek için bu standardı benimsemeye, katkıda bulunmaya ve üzerine inşa etmeye davet edilmektedir. diff --git a/5.0/tr/0x03-What-is-the-ASVS.md b/5.0/tr/0x03-What-is-the-ASVS.md deleted file mode 100644 index 0802a8a406..0000000000 --- a/5.0/tr/0x03-What-is-the-ASVS.md +++ /dev/null @@ -1,195 +0,0 @@ -# ASVS Nedir? - -Uygulama Güvenliği Doğrulama Standardı (ASVS), web uygulamaları ve hizmetleri için güvenlik gereksinimlerini tanımlar ve güvenli uygulamalar tasarlamayı, geliştirmeyi ve sürdürmeyi veya bunların güvenliğini değerlendirmeyi amaçlayan herkes için değerli bir kaynaktır. - -Bu bölümde ASVS'nin kapsamı, önceliğe dayalı seviyelerinin yapısı ve standart için birincil kullanım durumları da dahil olmak üzere ASVS'yi kullanmanın temel yönleri özetlenmektedir. - -## ASVS'nin Kapsamı - -ASVS'nin kapsamı adıyla tanımlanmaktadır: Uygulama, Güvenlik, Doğrulama ve Standart. Ulaşılması gereken güvenlik ilkelerini tanımlamak amacıyla hangi gereksinimlerin dahil edileceğini veya hariç tutulacağını belirler. Kapsam, uygulama gereksinimleri için temel teşkil eden dokümantasyon gereksinimlerini de dikkate alır. - -Saldırganlar için kapsam diye bir şey yoktur. Bu nedenle ASVS gereksinimleri, CI/CD süreçleri, hosting ve operasyonel faaliyetler de dahil olmak üzere uygulama yaşam döngüsünün diğer yönlerine ilişkin yönlendirmelerle birlikte değerlendirilmelidir. - -### Uygulama - -ASVS bir “uygulamayı”, güvenlik kontrollerinin entegre edilmesi gereken ve geliştirilmekte olan yazılım ürünü olarak tanımlar. ASVS, geliştirme yaşam döngüsü faaliyetlerini belirlemez veya uygulamanın bir CI/CD boru hattı aracılığıyla nasıl oluşturulması gerektiğini dikte etmez. Bunun yerine, ürünün kendi içinde elde edilmesi gereken güvenlik sonuçlarını belirtir. - -Web Uygulaması Güvenlik Duvarları (WAF'lar), yük dengeleyiciler veya proxy'ler gibi HTTP trafiğini sunan, değiştiren veya doğrulayan bileşenler, bazı güvenlik kontrolleri doğrudan bunlara bağlı olduğundan veya bunlar aracılığıyla uygulanabildiğinden, bu özel amaçlar için uygulamanın bir parçası olarak kabul edilebilir. Bu bileşenler, önbelleğe alınan yanıtlar, hız sınırlaması veya gelen ve giden bağlantıların kaynak ve hedefe göre kısıtlanmasıyla ilgili gereksinimler için dikkate alınmalıdır. - -Tersine, ASVS genellikle uygulamayla doğrudan ilgili olmayan veya yapılandırmanın uygulamanın sorumluluğu dışında olduğu gereksinimleri hariç tutar. Örneğin, DNS sorunları genellikle ayrı bir ekip veya işlev tarafından yönetilir. - -Benzer şekilde, uygulama girdiyi nasıl tükettiğinden ve çıktıyı nasıl ürettiğinden sorumlu olsa da, harici bir süreç uygulama veya verileriyle etkileşime giriyorsa, ASVS için kapsam dışı kabul edilir. Örneğin, uygulamanın veya verilerinin yedeklenmesi genellikle harici bir sürecin sorumluluğundadır ve uygulama veya geliştiricileri tarafından kontrol edilmez. - -### Güvenlik - -Her gerekliliğin güvenlik üzerinde kanıtlanabilir bir etkisi olmalıdır. Bir gerekliliğin olmaması daha az güvenli bir uygulama ile sonuçlanmalı ve gerekliliğin uygulanması bir güvenlik riskinin olasılığını veya etkisini azaltmalıdır. - -İşlevsel yönler, kod stili veya politika gereksinimleri gibi diğer tüm hususlar kapsam dışıdır. - -### Doğrulama - -Gereksinim doğrulanabilir olmalı ve doğrulama “başarısız” veya “başarılı” kararıyla sonuçlanmalıdır. - -### Standart - -ASVS, standarda uymak için uygulanması gereken bir güvenlik gereksinimleri koleksiyonu olarak tasarlanmıştır. Bu, gereksinimlerin bunu başarmak için güvenlik hedefini tanımlamakla sınırlı olduğu anlamına gelir. Diğer ilgili bilgiler ASVS'nin üzerine inşa edilebilir veya eşleştirmeler yoluyla bağlanabilir. - -Özellikle, OWASP'ın birçok projesi vardır ve ASVS kasıtlı olarak diğer projelerdeki içerikle örtüşmekten kaçınır. Örneğin, geliştiricilerin “belirli bir gereksinimi kendi teknolojimde veya ortamımda nasıl uygulayabilirim” şeklinde bir sorusu olabilir ve bu, Cheat Sheet Series projesi kapsamında ele alınmalıdır. Doğrulayıcıların “bu gereksinimi bu ortamda nasıl test edebilirim” şeklinde bir sorusu olabilir ve bu Web Güvenliği Test Kılavuzu projesi kapsamında ele alınmalıdır. - -ASVS sadece güvenlik uzmanlarının kullanımına yönelik olmamakla birlikte, okuyucunun içeriği anlamak için teknik bilgiye veya belirli kavramları araştırma becerisine sahip olmasını beklemektedir. - -### Gereksinim - -Gereksinim kelimesi ASVS'de özel olarak kullanılır çünkü bu kelimenin karşılanması için nelerin başarılması gerektiğini tanımlar. ASVS sadece gereksinimleri (must) içerir ve ana koşul olarak tavsiyeleri (should) içermez. - -Başka bir deyişle, ister bir sorunu çözmek için birçok olası seçenekten biri isterse de kod stili hususları olsun, öneriler bir gereksinim olma tanımını karşılamaz. - -ASVS gereksinimleri, uygulamaya veya teknolojiye özgü olmadan belirli güvenlik ilkelerini ele almayı ve aynı zamanda neden var olduklarına dair açıklayıcı olmayı amaçlamaktadır. Bu aynı zamanda gereksinimlerin belirli bir doğrulama yöntemi veya uygulaması etrafında oluşturulmadığı anlamına gelir. - -### Belgelenmiş güvenlik kararları - -Yazılım güvenliğinde, güvenlik tasarımını ve kullanılacak mekanizmaları erkenden planlamak, bitmiş üründe veya özellikte daha tutarlı ve güvenilir bir uygulama oluşturacaktır. - -Ayrıca, belirli gereksinimler için uygulama, karmaşık ve bir uygulamanın ihtiyaçlarına çok spesifik olacaktır. Yaygın örnekler arasında izinler, girdi doğrulama ve farklı hassas veri seviyeleri etrafında koruyucu kontroller yer alır. - -Bunu hesaba katmak için "tüm veriler şifrelenmelidir" gibi kapsamlı ifadeler veya bir gereksinimde olası her kullanım durumunu kapsamaya çalışmak yerine, uygulama geliştiricisinin bu tür kontrollere yaklaşımının ve yapılandırmasının belgelenmesini zorunlu kılan dokümantasyon gereksinimleri dahil edilmiştir. Bu daha sonra uygunluk açısından gözden geçirilebilir ve ardından gerçek uygulama, uygulamanın beklentilere uyup uymadığını değerlendirmek için belgelerle karşılaştırılabilir. - -Bu gereksinimler, uygulamayı geliştiren kuruluşun belirli güvenlik gereksinimlerinin nasıl uygulanacağına ilişkin aldığı kararları belgelemeyi amaçlamaktadır. - -Dokümantasyon gereksinimleri her zaman bir bölümün ilk kısmında yer alır (her bölümde olmasa da) ve her zaman dokümante edilen kararların gerçekten uygulamaya konulması gereken ilgili bir uygulama gerekliliğine sahiptir. Burada önemli olan nokta, dokümantasyonun yerinde olduğunu ve fiili uygulamanın iki ayrı faaliyet olduğunu doğrulamaktır. - -Bu gereksinimleri dahil etmenin iki temel nedeni vardır. İlk neden, güvenlik gereksiniminin genellikle kuralların uygulanmasını içermesidir. Örneğin hangi tür dosya türlerinin yüklenmesine izin verilir, hangi iş kontrolleri uygulanmalıdır, belirli bir alan için izin verilen karakterler nelerdir gibi uygulanma biçimleri. Bu kurallar her uygulama için farklı olacaktır ve bu nedenle ASVS, bunların ne olması gerektiğini kuralcı bir şekilde tanımlayamaz ve bu durumda bir cheat sheet veya daha ayrıntılı bir yanıt da yardımcı olmaz. Benzer şekilde, bu kararlar belgelenmeden, bu kararları uygulayan gereksinimlerin doğrulanması mümkün olmayacaktır. - -İkinci neden ise, belirli gereksinimler için belirli güvenlik sorunlarının nasıl ele alınacağı konusunda esnekliğe sahip bir uygulama geliştirme sağlamanın önemli olmasıdır. Örneğin, önceki ASVS sürümlerinde oturum zaman aşımı kuralları çok kuralcıydı. Pratik olarak, birçok uygulama, özellikle tüketicilere yönelik olanlar, çok daha esnek kurallara sahiptir ve bunun yerine diğer risk azaltma kontrollerini uygulamayı tercih eder. Bu nedenle, belgeleme gereksinimleri bu konuda açıkça esneklik sağlar. - -Elbette ki, bu kararların bireysel geliştiriciler tarafından alınması ve belgelenmesi beklenmemektedir. Aksine, bu kararlar organizasyonun bir bütün olarak alınacak ve geliştiricilere iletilecek, geliştiriciler de bu kararları uygulamaya özen gösterecektir. - -Geliştiricilere yeni özellikler ve işlevler için spesifikasyonlar ve tasarımlar sağlamak, yazılım geliştirmenin standart bir parçasıdır. Benzer şekilde, geliştiricilerin her seferinde kendi kararlarını vermek yerine ortak bileşenleri ve kullanıcı arayüzü mekanizmalarını kullanmaları beklenir. Bu nedenle, bunu güvenliğe genişletmek şaşırtıcı veya tartışmalı olarak görülmemelidir. - -Bunu nasıl başaracağınız konusunda da esneklik vardır. Güvenlik kararları, geliştiricilerin başvurması beklenen yazılı bir belgede belgelenebilir. Alternatif olarak, güvenlik kararları belgelenebilir ve tüm geliştiricilerin kullanması zorunlu olan ortak bir kod kütüphanesinde uygulanabilir. Her iki durumda da istenen sonuç elde edilir. - -## Uygulama Güvenliği Doğrulama Seviyeleri - -ASVS, seviyesi arttıkça derinliği ve karmaşıklığı artan üç güvenlik doğrulama seviyesi tanımlar. Genel amaç, kuruluşların en kritik güvenlik sorunlarını ele almak için ilk seviyeden başlaması ve ardından kuruluşun ve uygulamanın ihtiyaçlarına göre daha yüksek seviyelere geçmesidir. Seviyeler, belgede ve gereksinim metinlerinde L1, L2 ve L3 olarak gösterilebilir. - -Her ASVS seviyesi, o seviyeden elde edilmesi gereken güvenlik gereksinimlerini belirtir ve kalan daha yüksek seviye gereksinimler öneri olarak sunulur. - -Yinelenen gereksinimleri veya daha yüksek seviyelerde artık geçerli olmayan gereksinimleri önlemek için bazı gereksinimler belirli bir seviyeye özel uygulanır. Fakat bu gereksinimler daha yüksek seviyeler için daha katı koşullar içerir. - -### Seviye değerlendirmesi - -Seviyeler, güvenlik gereksinimlerinin uygulanması ve test edilmesi deneyimine dayalı olarak her bir gereksinimin öncelik bazlı değerlendirmesiyle tanımlanır. Ana odak noktası, risk azaltma ile gereksinimin uygulanması için gereken çabayı karşılaştırmaktır. Bir diğer önemli faktör ise giriş engelini düşük tutmaktır. - -Risk azaltma, gereksinimin uygulama içindeki güvenlik riskinin düzeyini ne ölçüde azalttığını, klasik Gizlilik, Bütünlük ve Kullanılabilirlik etki faktörlerini dikkate alarak ve bunun birincil savunma katmanı mı yoksa derinlemesine savunma mı olduğunu değerlendirerek değerlendirir. - -Kriterler ve seviyelendirme kararları etrafında yapılan titiz tartışmalar, her duruma %100 uymayabileceğini kabul etmekle birlikte, vakaların büyük çoğunluğu için geçerli olması gereken bir dağılımla sonuçlanmıştır. Bu, belirli durumlarda kuruluşların kendi özel risk değerlendirmelerine göre daha yüksek seviyedeki gereksinimleri daha erken önceliklendirmek isteyebilecekleri anlamına gelir. - -Her seviyedeki gereksinim türleri aşağıdaki gibi tanımlanabilir: - -### Seviye 1 - -Bu seviye, bir uygulamayı güvenli hale getirirken dikkate alınması gereken minimum gereksinimleri içerir ve kritik bir başlangıç noktasıdır. Bu seviye, ASVS gereksinimlerinin yaklaşık %20'sini içerir. Bu seviyenin amacı, giriş engelini azaltmak için mümkün olduğunca az gereksinim olmasını sağlamaktır. - -Bu gereksinimler genellikle kritik veya temel, diğer güvenlik açıklarının veya ön koşulların istismar edilmesini gerektirmeyen yaygın saldırıları önlemek için birinci katman savunma gereksinimleridir. - -Birinci savunma katmanı gereksinimlerine ek olarak, bazı gereksinimlerin daha yüksek seviyelerde etkisi daha azdır, şifrelerle ilgili gereksinimler gibi. Bunlar Seviye 1 için daha önemlidir, çünkü daha yüksek seviyelerde çok faktörlü kimlik doğrulama gereksinimleri önem kazanır. - -Seviye 1, belgelere veya koda iç erişimi olmayan bir dış test uzmanı tarafından mutlaka penetrasyon testi yapılabilir değildir (örneğin "kara kutu" testi), ancak gereksinimlerin sayısının az olması doğrulamayı kolaylaştırmalıdır. - -### Seviye 2 - -Çoğu uygulama bu güvenlik seviyesine ulaşmak için çaba göstermelidir. ASVS'deki gereksinimlerin yaklaşık %50'si L2 seviyesindedir, yani bir uygulamanın L2 seviyesine uymak için ASVS'deki gereksinimlerin yaklaşık %70'ini (tüm L1 ve L2 gereksinimlerini) uygulaması gerekir. - -Bu gereksinimler genellikle daha az yaygın saldırılarla veya yaygın saldırılara karşı daha karmaşık korumalarla ilgilidir. Bunlar hala ilk savunma katmanı olabilir veya saldırının başarılı olması için belirli ön koşullar gerektirebilir. - -### Seviye 3 - -Bu seviye, en yüksek güvenlik seviyelerini göstermek isteyen uygulamalar için bir hedef olmalıdır. Bu seviye, uyum sağlamak için gereken gereksinimlerin son %30'unu sağlar. - -Bu bölümdeki gereksinimler genellikle derinlemesine savunma mekanizmaları veya diğer yararlı ancak uygulanması zor kontrollerden oluşur. - -### Hangi seviyeye ulaşılmalı? - -Öncelik tabanlı seviyeler, kuruluşun ve uygulamanın uygulama güvenliği olgunluğunu yansıtmayı amaçlamaktadır. ASVS, bir uygulamanın hangi seviyede olması gerektiğini kuralcı bir şekilde belirtmek yerine, kuruluşun risklerini analiz etmesi ve uygulamanın hassasiyetine ve elbette uygulamanın kullanıcılarının beklentilerine bağlı olarak hangi seviyede olması gerektiğini belirlemesi gerekir. - -Örneğin, yalnızca sınırlı miktarda hassas veri toplayan erken aşamadaki bir girişim, ilk güvenlik hedefleri için Seviye 1'e odaklanmaya karar verebilir, ancak bir banka, çevrimiçi bankacılık uygulaması için müşterilerine Seviye 3'ten daha düşük bir seviyeyi haklı çıkarmakta zorlanabilir. - -## ASVS nasıl kullanılır? - -### ASVS'nin yapısı - -ASVS, toplamda yaklaşık 350 gereksinimden oluşur ve bu gereksinimler 17 bölüme ayrılmıştır. Her bölüm de alt bölümlere ayrılmıştır. - -Bölüm ve alt bölümlerin ayrılmasının amacı, uygulama ile ilgili olanları seçmeyi veya filtrelemeyi kolaylaştırmaktır. Örneğin, bir makineler arası API için, V3 bölümündeki web ön uçlarıyla ilgili gereksinimler ilgili olmayacaktır. OAuth veya WebRTC kullanılmıyorsa, bu bölümler de göz ardı edilebilir. - -### Sürüm stratejisi - -ASVS sürümleri "Major.Minor.Patch" ("Büyük.Küçük.Yama") modelini izler ve sayılar sürüm içinde nelerin değiştiği hakkında bilgi verir. Büyük bir sürümde ilk sayı, küçük bir sürümde ikinci sayı ve yama sürümünde üçüncü sayı değişir. - -* Büyük sürüm - Tamamen yeniden düzenleme yapılmıştır. Gereksinim numaraları da dahil olmak üzere neredeyse her şey değişebilir. Uyumluluk için yeniden değerlendirme gerekli olacaktır (örneğin, 4.0.3 -> 5.0.0). -* Küçük sürüm - Gereksinimler eklenebilir veya kaldırılabilir, ancak genel numaralandırma aynı kalır. Uyumluluk için yeniden değerlendirme gerekli olacaktır, ancak daha kolay olacaktır (örneğin, 5.0.0 -> 5.1.0). -* Yama sürümü - Gereksinimler kaldırılabilir (örneğin, tekrar eden veya güncelliğini yitiren gereksinimler) veya daha az katı hale getirilebilir, ancak önceki sürüme uygun olan bir uygulama, yama sürümüne de uygun olacaktır (örneğin, 5.0.0 -> 5.0.1). - -Yukarıdaki bilgiler özellikle ASVS'deki gereksinimlerle ilgilidir. Gereksinimleri çevreleyen metin ve ekler gibi diğer içeriklerdeki değişiklikler, önemli bir değişiklik olarak değerlendirilmeyecektir. - -### ASVS ile esneklik - -Yukarıda açıklanan belgeleme gereksinimleri ve seviye mekanizması gibi bazı noktalar, ASVS'yi daha esnek ve kuruluşa özgü bir şekilde kullanma olanağı sağlar. - -Ayrıca, kuruluşların uygulamalarının belirli özelliklerine ve risk seviyelerine göre gereksinimleri ayarlayan, kuruluşa veya alana özgü bir "fork" oluşturmaları şiddetle tavsiye edilir. Ancak, gereksinim 4.1.1'in tüm sürümlerde aynı anlama gelmesi için izlenebilirliği korumak önemlidir. - -İdeal olarak, her kuruluş kendi özel ASVS'sini oluşturmalı ve ilgisiz bölümleri (örneğin, kullanılmıyorsa GraphQL, WebSockets, SOAP) çıkarmalıdır. Kuruluşa özgü bir ASVS sürümü veya eki, gereksinimlere uyum sağlarken kullanılacak kütüphaneleri veya kaynakları ayrıntılı olarak açıklayan, kuruluşa özgü uygulama kılavuzları sağlamak için de iyi bir varlıktır. - -### ASVS Gereksinimlerine Nasıl Atıfta Bulunulur? - -Her gereksinim, her ögesinin bir sayı olduğu `..` biçiminde bir tanımlayıcıya sahiptir. Örneğin, `1.11.3`. - -* `` (chapter) değeri, gereksinimin geldiği bölümü belirtir. Örneğin, tüm `1.#.#` gereksinimleri "Kodlama (Encoding) ve Temizleme" bölümünden gelir. -* `` (section) değeri, o bölüm içinde gereksinimin yer aldığı kısmı belirtir. Örneğin, tüm `1.2.#` gereksinimleri "Kodlama ve Temizleme" bölümünün "Enjeksiyon Önleme" bölümündedir. -* `` (requirement) değeri, bölüm ve kısım içindeki belirli bir gereksinimi tanımlar. Örneğin, bu standardın 5.0.0 sürümünde `1.2.5` şu şekildedir: - -> Uygulamanın işletim sistemi komut enjeksiyonuna karşı koruma sağladığını ve işletim sistemi çağrılarının parametreli işletim sistemi sorguları veya bağlamsal komut satırı çıktı kodlaması kullandığını doğrulayın. - -Tanımlayıcılar standardın sürümleri arasında değişebileceğinden, diğer belgeler, raporlar veya araçlar için aşağıdaki biçimin kullanılması tercih edilir: `v-..`, burada: 'sürüm' ASVS sürüm etiketidir. Örneğin: `v5.0.0-1.2.5`, 5.0.0 sürümünün "Kodlama ve Temizleme" bölümünün "Enjeksiyon Önleme" alt bölümündeki 5. gereksinimi ifade eder. (Bu, `v-` olarak özetlenebilir.) - -Not: Format içinde sürüm numarasından önce gelen v her zaman küçük harf olmalıdır. - -Tanımlayıcılar v öğesi olmadan kullanıldığında, varsayılan olarak en güncel Uygulama Güvenliği Doğrulama Standardı içeriğine atıfta bulunulduğu kabul edilir. Ancak standart büyüyüp değiştikçe bu durum sorun yaratabilir, bu nedenle yazarlar veya geliştiriciler sürüm öğesini eklemelidir. - -ASVS gereksinim listeleri, başvuru veya programatik kullanım için yararlı olabilecek CSV, JSON ve diğer formatlarda sunulmaktadır. - -### ASVS’yi Çatallama (Forklama) - -Kuruluşlar, üç seviyeden birini seçerek veya uygulama risk seviyesine göre gereksinimleri ayarlayan alana özgü bir fork oluşturarak ASVS'den faydalanabilir. Bu tür bir fork, izlenebilirliği koruduğu sürece teşvik edilir, böylece 4.1.1 gereksiniminin karşılanması tüm sürümlerde aynı anlama gelir. - -İdeal olarak, her kuruluş kendi özel ASVS'sini oluşturmalı ve alakasız bölümleri (örneğin, kullanılmıyorsa GraphQL, Websockets, SOAP) çıkarmalıdır. Fork oluşturma, ASVS Seviye 1'i temel alarak başlamalı ve uygulamanın riskine göre Seviye 2 veya 3'e ilerlemelidir. - -## ASVS’nin kullanım alanları - -ASVS, bir uygulamanın güvenliğini değerlendirmek amacıyla kullanılabilir ve bu konu bir sonraki bölümde daha ayrıntılı olarak ele alınacaktır. Ancak, ASVS'nin (veya forklanmış bir sürümünün) başka potansiyel kullanım alanları da belirlenmiştir. - -### Ayrıntılı Güvenlik Mimarisi Rehberi Olarak Kullanma - -Uygulama Güvenliği Doğrulama Standardı'nın en yaygın kullanım alanlarından biri, güvenlik mimarları için bir kaynak olarak kullanılmasıdır. Özellikle modern uygulamalarda, güvenli bir uygulama mimarisi oluşturmak için sınırlı sayıda kaynak mevcuttur. ASVS, güvenlik mimarlarının veri koruma modelleri ve girdi doğrulama stratejileri gibi yaygın sorunlar için daha iyi kontroller seçmelerine olanak tanıyarak bu boşlukları doldurmak için kullanılabilir. Mimari ve dokümantasyon gereksinimleri bu konuda özellikle yararlı olacaktır. - -### Özelleştirilmiş Bir Güvenli Kodlama Referansı Olarak Kullanma - -ASVS, uygulama geliştirme sırasında güvenli kodlama referansı hazırlamak için temel olarak kullanılabilir ve geliştiricilerin yazılım oluştururken güvenliği göz önünde bulundurmalarını sağlar. ASVS temel olarak kullanılabilirken, kuruluşlar kendi özel kılavuzlarını hazırlamalıdır. Bu kılavuzlar açık ve birleşik olmalı ve ideal olarak güvenlik mühendisleri veya güvenlik mimarlarının rehberliğine dayalı olarak hazırlanmalıdır. Bunun bir uzantısı olarak, kuruluşların mümkün olduğunca kılavuzda referans gösterilebilecek ve geliştiriciler tarafından kullanılabilecek onaylanmış güvenlik mekanizmaları ve kütüphaneleri hazırlamaları teşvik edilir. - -### Otomatik Birim ve Entegrasyon Testleri İçin Rehber Olarak Kullanma - -ASVS, yüksek düzeyde test edilebilir şekilde tasarlanmıştır. Bazı doğrulamalar teknik nitelikteyken, bazı gereksinimler (mimari ve dokümantasyon gereksinimleri gibi) dokümantasyon veya mimari incelemesi gerektirebilir. Teknik yollarla doğrulanabilir gereksinimlerle ilgili belirli ve ilgili kötüye kullanım durumlarını test eden ve "fuzz" yapan birim ve entegrasyon testleri oluşturarak, bu kontrollerin her derlemede doğru şekilde çalıştığını kontrol etmek daha kolay hale gelmelidir. Örneğin, bir oturum açma denetleyicisi için test paketi için ek testler oluşturulabilir. Bu testlerde, kullanıcı adı parametresi için yaygın varsayılan kullanıcı adları, hesap numaralandırma, kaba kuvvet saldırısı, LDAP ve SQL enjeksiyonu ve XSS test edilir. Benzer şekilde, şifre parametresi üzerinde yapılan bir testte yaygın şifreler, şifre uzunluğu, null byte enjeksiyonu, parametrenin kaldırılması, XSS ve daha fazlası yer almalıdır. - -### Güvenli Geliştirme Eğitimi İçin Kullanma - -ASVS, güvenli yazılımın özelliklerini tanımlamak için de kullanılabilir. Birçok "güvenli kodlama kursu", kodlama ipuçlarının hafifçe serpiştirildiği etik hackleme kurslarından ibarettir. Bu, geliştiricilerin daha güvenli kod yazmasına yardımcı olmayabilir. Güvenli geliştirme kursları, yapılmaması gereken en önemli 10 olumsuz şey yerine ASVS'yi kullanarak ASVS'de bulunan olumlu mekanizmalara odaklanabilir. ASVS yapısı, bir uygulamayı güvenli hale getirirken farklı konuları ele almak için mantıklı bir yapı da sağlar. - -### Güvenli Yazılım Satın Alımına Rehberlik Eden Bir Çerçeve Olarak Kullanma - -ASVS, güvenli yazılım satın alımına veya özel geliştirme hizmetleri satın alımına yardımcı olan harika bir çerçevedir. Alıcı, satın almak istediği yazılımın ASVS seviye X'te geliştirilmesi gerektiğini belirten bir gereksinim belirleyebilir ve satıcıdan yazılımın ASVS seviye X'i karşıladığını kanıtlamasını isteyebilir. - -## ASVS'nin Pratikte Uygulanması - -Farklı tehditlerin farklı motivasyonları vardır. Bazı sektörler, benzersiz bilgi ve teknoloji varlıklarına ve alana özgü yasal uyumluluk gereksinimlerine sahiptir. - -Kuruluşların, işlerinin doğasına göre benzersiz risk özelliklerini derinlemesine incelemeleri ve bu risk ve iş gereksinimlerine göre uygun ASVS seviyesini belirlemeleri şiddetle tavsiye edilir. diff --git a/5.0/tr/0x04-Assessment_and_Certification.md b/5.0/tr/0x04-Assessment_and_Certification.md deleted file mode 100644 index fd9eb4016b..0000000000 --- a/5.0/tr/0x04-Assessment_and_Certification.md +++ /dev/null @@ -1,47 +0,0 @@ -# Değerlendirme ve Sertifikasyon - -## OWASP’in ASVS Sertifikaları ve Güven Damgaları Konusundaki Tutumu - -OWASP, satıcıdan bağımsız bir kar amacı gütmeyen kuruluş olarak, herhangi bir satıcıyı, doğrulayıcıyı veya yazılımı sertifikalandırmaz. ASVS uyumluluğunu iddia eden herhangi bir güvence, güven damgası veya sertifikasyon OWASP tarafından resmi olarak onaylanmamaktadır. Bu nedenle, kuruluşlar üçüncü tarafların ASVS sertifikasyonu iddialarına karşı dikkatli olmalıdır. - -Kuruluşlar, resmi bir OWASP sertifikası sunduklarını iddia etmemek koşuluyla güvence hizmetleri sunabilirler. - -## ASVS Uyumluluğu Nasıl Doğrulanır? - -ASVS, uyumluluğun nasıl doğrulanacağı konusunda kasıtlı olarak kesin bir yöntem belirtmez. Ancak, bazı temel noktaların vurgulanması önemlidir. - -### Doğrulama Raporlaması - -Geleneksel sızma testi raporları, yalnızca başarısız olan durumları istisnalarla listeler. Ancak bir ASVS sertifikasyon raporu; kapsamı, kontrol edilen tüm gereksinimlerin özetini, istisna tespit edilen gereksinimleri ve bu sorunların nasıl çözüleceğine dair rehberliği içermelidir. Bazı gereksinimler uygulanabilir olmayabilir (örneğin, durum bilgisi olmayan API'lerde oturum yönetimi) ve bu durum raporda açıkça belirtilmelidir. - -### Doğrulama Kapsamı - -Uygulama geliştiren bir organizasyon, uygulamanın işlevselliğine bağlı olarak bazı gereksinimleri uygulamayabilir, çünkü bunlar alakasız veya daha az önemli olabilir. Doğrulayıcı kişi veya kurum, doğrulamanın kapsamını açıkça belirtmelidir. Organizasyonun hangi Seviye’yi hedeflediği ve hangi gereksinimlerin dahil edildiği açıklanmalıdır. Bu, nelerin hariç tutulduğundan ziyade, nelerin dahil edildiği bakış açısından ele alınmalıdır. Ayrıca, uygulanmayan gereksinimlerin neden dışlandığına dair gerekçeli bir görüş sunulmalıdır. - -Bu yaklaşım, raporu okuyan tarafın doğrulamanın bağlamını anlamasına ve uygulamaya ne kadar güvenebileceğine dair bilinçli bir karar vermesine olanak tanır. - -Sertifikasyon yapan kuruluşlar kendi test yöntemlerini seçebilir, ancak bu yöntemler raporda açıkça belirtilmeli ve ideal olarak tekrarlanabilir olmalıdır. Girdi doğrulama gibi konular için sızma testi ya da kaynak kod analizi gibi farklı yöntemler kullanılabilir. - -### Doğrulama Mekanizmaları - -Bazı ASVS gereksinimlerinin doğrulanması için birden fazla teknik gerekebilir. Geçerli kullanıcı bilgileriyle tüm uygulama kapsamı elde edilerek yapılan sızma testlerine ek olarak ASVS gereksinimlerinin doğrulanması; dokümantasyon, kaynak kodu, yapılandırmalar ve geliştirme sürecine dahil kişilere, özellikle Seviye 2 ve Seviye 3 gereksinimlerinin doğrulanması için erişim gerektirebilir. Bulguların belgelenmesi standart bir uygulamadır ve buna çalışma notları, ekran görüntüleri, betikler ve test günlükleri (logs) dahil olabilir. Yalnızca otomatik bir araç çalıştırmak ve derinlemesine test yapmamak sertifikasyon için yeterli değildir; her gereksinimin doğrulanabilir şekilde test edilmiş olması gerekir. - -ASVS gereksinimlerinin otomasyonla doğrulanması, her zaman ilgi çeken bir konudur. Bu nedenle, otomatik ve kara kutu (black box) testlerle ilgili bazı noktaların netleştirilmesi önemlidir. - -#### Otomatik Güvenlik Testi Araçlarının Rolü - -DAST ve SAST gibi dinamik ve statik güvenlik test araçları doğru şekilde build pipeline’a entegre edildiğinde, asla var olmaması gereken bazı güvenlik açıklarını tespit edebilir. Ancak, dikkatli bir şekilde yapılandırılmaz ve ayarlanmazlarsa, yeterli kapsama alanı sağlamazlar ve yüksek sayıda yanlış pozitif, gerçek güvenlik sorunlarının tespitini ve düzeltilmesini engeller. - -Bu araçlar, çıktı kodlaması veya veri temizleme gibi bazı temel teknik gereksinimlerin doğrulanmasında yardımcı olabilir. Ancak, iş mantığı veya erişim kontrolü gibi daha karmaşık ASVS gereksinimlerinin doğrulanmasında yetersiz kalacaklardır. - -Daha karmaşık gereksinimler için otomasyon yine de kullanılabilir, ancak uygulamaya özel testlerin yazılması gerekebilir. Bunlar, organizasyonun halihazırda kullandığı birim ve entegrasyon testlerine benzer şekilde tasarlanabilir. Mevcut test altyapısı kullanılarak bu ASVS'ye özel testler yazılabilir. Bu kısa vadede yatırım gerektirse de, uzun vadede bu gereksinimlerin sürekli olarak doğrulanabilmesi açısından önemli bir fayda sağlar. - -Özetle, "otomasyon ile test edilebilir" ifadesi "hazır bir aracı çalıştırmak" anlamına gelmez. - -#### Sızma Testlerinin Rolü - -4.0 sürümünde Seviye 1, kara kutu (black box) test için optimize edilmişti (yani dokümantasyon veya kaynak kod olmadan). Ancak o zaman bile bunun etkili bir güvence yöntemi olmadığı ve aktif olarak kaçınılması gerektiği vurgulanmıştır. - -Gerekli ek bilgilere erişim olmadan test yapmak, güvenlik doğrulaması açısından hem verimsiz hem de etkisizdir. Bu durum, kaynak kodun incelenmesi, tehditlerin ve eksik kontrollerin tespiti gibi daha kapsamlı analizlerin yapılmasını engeller ve süreci uzatır. - -Geleneksel sızma testlerinin yerini, dokümantasyon ve/veya kaynak kod temelli (hibrit) sızma testlerinin almasını şiddetle tavsiye ediyoruz. Geliştirici ekip ve uygulamanın dokümantasyonuna tam erişim ile yapılan bu testler, birçok ASVS gereksiniminin doğrulanması için gerekli olacaktır. diff --git a/5.0/tr/0x05-For-Users-Of-4.0.md b/5.0/tr/0x05-For-Users-Of-4.0.md deleted file mode 100644 index cbbe7a5279..0000000000 --- a/5.0/tr/0x05-For-Users-Of-4.0.md +++ /dev/null @@ -1,90 +0,0 @@ -# v4.x ile Karşılaştırıldığında Yapılan Değişiklikler - -## Giriş - -Standartın 4.x sürümüne aşina olan kullanıcılar, 5.0 sürümünde yapılan temel değişiklikleri içerik, kapsam ve altında yatan felsefe bakımından gözden geçirmeyi faydalı bulabilirler. - -Sürüm 4.0.3'te yer alan 286 gereksinimin yalnızca 11 tanesi hiçbir değişikliğe uğramadan korunmuştur. 15 gereksinimde ise yalnızca anlamı değiştirmeyen dilbilgisel düzeltmeler yapılmıştır. Toplamda 109 gereksinim (%38) artık 5.0 sürümünde bağımsız birer gereksinim olarak yer almamaktadır. Bunların 50’si doğrudan silinmiş, 28’i yinelenen olarak kaldırılmış ve 31’i başka gereksinimlerle birleştirilmiştir. Geri kalan tüm gereksinimler bir şekilde revize edilmiştir. İçeriği esasen değiştirilmemiş olan gereksinimler bile, yeniden sıralama veya yapısal değişiklikler nedeniyle artık farklı tanımlayıcılara (ID) sahiptir. - -Sürüm 5.0'ın benimsenmesini kolaylaştırmak için, kullanıcıların sürüm 4.x'teki gereksinimlerin sürüm 5.0'daki gereksinimlerle nasıl eşleştiğini izlemelerine yardımcı olmak için eşleme belgeleri sağlanmıştır. Bu eşlemeler sürüm numaralandırmasına bağlı değildir ve gerektiğinde güncellenebilir veya açıklığa kavuşturulabilir. - -## Gereksinim Felsefesi - -### Kapsam ve Odak - -Sürüm 4.x, standardın hedeflenen kapsamıyla uyumlu olmayan bazı gereksinimler içeriyordu. Bu gereksinimler kaldırılmıştır. 5.0 sürümünün kapsam kriterlerini karşılamayan veya doğrulanabilir olmayan gereksinimler de eklenen gereksinimlerden hariç tutulmuştur. - -### Mekanizmalar Yerine Güvenlik Hedeflerine Önem Verilmesi - -Sürüm 4.x'te birçok gereksinim, altında yatan güvenlik hedefleri yerine belirli mekanizmalara odaklanıyordu. 5.0 sürümünde ise gereksinimler, belirli güvenlik hedefleri etrafında yapılandırılmıştır. Belirli mekanizmalara yalnızca bunların tek pratik çözüm olması durumunda doğrudan referans verilmiş veya örnek/rehber olarak yer verilmiştir. - -Bu yaklaşım, belirli bir güvenlik hedefinin birden fazla yolla gerçekleştirilebileceğini kabul eder ve kuruluşların esnekliğini kısıtlayabilecek gereksiz derecede kuralcı yönlendirmelerden kaçınır. - -Ayrıca, aynı güvenlik sorununu ele alan gereksinimler uygun şekilde birleştirilmiştir. - -### Belgelenmiş Güvenlik Kararları - -"Belgelenmiş güvenlik kararları" kavramı 5.0 sürümünde yeni gibi görünse de, 4.0 sürümündeki politika uygulamaları ve tehdit modellemesi ile ilgili daha önceki gereksinimlerin evrimleşmiş halidir. Önceki sürümlerde bazı gereksinimler, örneğin izin verilen ağ bağlantılarının belirlenmesi gibi, güvenlik kontrollerinin uygulanmasına yön verecek analizlerin yapılmasını dolaylı olarak talep etmekteydi. - -Gerekli bilgilerin hem uygulama hem de doğrulama süreçlerinde erişilebilir olmasını sağlamak amacıyla bu beklentiler artık açıkça belgelenmesi gereken gereksinimler olarak tanımlanmıştır. Böylece bu gereksinimler daha net, uygulanabilir ve doğrulanabilir hale getirilmiştir. - -## Yapısal Değişiklikler ve Yeni Bölümler - -Sürüm 5.0’daki bazı bölümler tamamen yeni içerikler sunmaktadır: - -* OAuth ve OIDC – Bu protokollerin erişim yetkisi devri ve tek oturum açma (SSO) için yaygın biçimde benimsenmiş olması nedeniyle, geliştiricilerin karşılaşabileceği çeşitli senaryoları kapsayan özel gereksinimler eklenmiştir. Bu alan, geçmişte Mobil ve IoT gereksinimlerinin ayrı bir standarda dönüştürülmesinde olduğu gibi, zamanla bağımsız bir standarda da dönüşebilir. -* WebRTC – Bu teknolojinin yaygınlaşmasıyla birlikte, kendine özgü güvenlik gereksinimleri ve zorlukları artık özel bir bölümde ele alınmaktadır. - -Bölüm ve kısımların birbiriyle ilişkili gereksinim kümeleri etrafında daha tutarlı şekilde düzenlenmesine de özen gösterilmiştir. - -Bu yeniden yapılandırma kapsamında şu ek bölümler oluşturulmuştur: - -* Kendi İçinde Taşıyıcı Token’lar – Daha önce oturum yönetimi altında yer alan bu mekanizmalar artık ayrı bir yapı olarak tanınmakta ve OAuth ile OIDC gibi durumsuz iletişim yapılarının temel unsurlarından biri olarak ele alınmaktadır. Kendilerine özgü güvenlik etkileri nedeniyle, 5.x sürümünde bazı yeni gereksinimlerle birlikte ayrı bir bölümde toplanmıştır. -* Web Ön Yüz Güvenliği (Frontend Security) – Tarayıcı tabanlı uygulamaların artan karmaşıklığı ve yalnızca API’lara dayalı mimarilerin yaygınlaşması nedeniyle, frontend güvenliği gereksinimleri ayrı bir bölümde ele alınmıştır. -* Güvenli Kodlama ve Mimari – Diğer mevcut bölümlere doğrudan uymayan genel güvenlik uygulamalarıyla ilgili yeni gereksinimler burada gruplandırılmıştır. - -Sürüm 5.0’daki diğer düzenleyici değişiklikler ise niyetin daha net şekilde anlaşılmasını sağlamayı amaçlamıştır. Örneğin, girdi doğrulama gereksinimleri iş kuralları doğrultusunda işletim sağladıkları için artık iş mantığı ile birlikte gruplanmış, eski yapıda yer aldıkları temizleme ve kodlama (sanitization & encoding) konularından ayrılmıştır. - -Önceki V1 Mimari bölümü tamamen kaldırılmıştır. Bu bölümün ilk kısmı kapsam dışı gereksinimler içeriyordu. Sonraki kısımlar ise ilgili yeni bölümlere taşınmış, gereksinimler sadeleştirilmiş ve gerektiğinde yinelenen maddeler birleştirilerek açıklığa kavuşturulmuştur. - -## Diğer Standartlara Yapılan Doğrudan Eşlemelerin Kaldırılması - -Standardın ana kısmında yer alan diğer standartlara yönelik doğrudan eşlemeler kaldırılmıştır. Bunun yerine, ASVS'nin OWASP projeleri ve harici standartlarla ilişkilendirilmesini sağlayacak OWASP Common Requirement Enumeration (CRE) projesiyle bir eşleme hazırlanması hedeflenmektedir. - -Aşağıda açıklanan nedenlerle, CWE ve NIST gibi standartlara yapılan doğrudan eşlemeler artık devam ettirilmemektedir. - -### NIST Dijital Kimlik Kılavuzları (Digital Identity Guidelines) ile Azaltılmış Bağlılık - -NIST [Digital Identity Guidelines (SP 800-63)](https://pages.nist.gov/800-63-3/) uzun süredir kimlik doğrulama ve yetkilendirme kontrolleri için bir başvuru noktası olarak kullanılmıştır. Sürüm 4.x’te bazı bölümler, NIST’in yapısı ve terminolojisiyle oldukça örtüşüyordu. - -Bu kılavuzlar hâlâ önemli bir referans noktası olsa da, böyle bir sıkı örtüşme birtakım sorunlara yol açmıştır. Bu sorunlara yaygın olarak benimsenmemiş terimlerin kullanımı, benzer gereksinimlerin yinelenmesi ve eşlemenin eksik kalması örnek verilebilir. Sürüm 5.0, bu yaklaşımdan uzaklaşarak daha açık ve uygulanabilir bir yapı sunmayı hedeflemektedir. - -### Common Weakness Enumeration'dan (CWE) Uzaklaşma - -Common Weakness Enumeration (CWE), yazılım güvenliği zafiyetleri için faydalı bir sınıflandırma sistemidir. Ancak, yalnızca kategori düzeyinde tanımlanmış CWE’ler, bir gereksinimin yalnızca tek bir CWE ile eşleştirilememesi gibi eşleme zorlukları ve sürüm 4.x’teki bazı belirsiz eşlemeler sürüm 5.0’da doğrudan CWE eşlemelerinin sonlandırılmasına neden olmuştur. - -## Seviye Tanımlarının Yeniden Düşünülmesi - -Sürüm 4.x’te seviyeler L1 ("Minimum"), L2 ("Standart") ve L3 ("Gelişmiş") olarak tanımlanıyordu. Hassas veri işleyen tüm uygulamaların en az L2 seviyesini sağlaması gerektiği ima ediliyordu. - -Sürüm 5.0, bu yaklaşıma dair çeşitli sorunları ele almaktadır. - -Sürüm 4.x'te seviye göstergeleri tik işaretleriyle ifade edilirken, 5.x sürümünde tüm formatlarda (Markdown, PDF, DOCX, CSV, JSON ve XML) basit sayılar kullanılmaktadır. Geriye dönük uyumluluk için eski CSV, JSON ve XML çıktı formatlarında onay işaretleri hâlâ kullanılmaktadır. - -### Daha Kolay Giriş Seviyesi - -Geri bildirimler, yaklaşık 120 maddeden oluşan Seviye 1 gereksinimlerinin, aynı zamanda "minimum" olarak etiketlenip birçok uygulama için yetersiz görülmesi nedeniyle benimsenmesinin zorlaştığını göstermiştir. Sürüm 5.0, bu eşiği düşürmeyi hedefleyerek Seviye 1’i öncelikli olarak ilk savunma katmanına ait gereksinimler etrafında tanımlar ve bu seviyedeki gereksinimleri daha az ve daha net hale getirir. Sayısal olarak örnek vermek gerekirse sürüm 4.0.3'te 278 gereksinimden 128’i Seviye 1’di (%46). Sürüm 5.0.0'da ise 345 gereksinimden yalnızca 70’i Seviye 1’dir (%20). - -### Test Edilebilirlik Yanılgısı - -Sürüm 4.x’te Seviye 1 gereksinimleri belirlenirken, "dışsal kara kutu sızma testleriyle değerlendirilebilirlik" ön plandaydı. Ancak bu yaklaşım, Seviye 1’in güvenlik kontrolleri için minimum bir temel olması yönündeki amacıyla tam olarak örtüşmüyordu. Bazı kullanıcılar, Seviye 1’in yetersiz olduğunu savunurken, bazıları ise uygulanabilirliğini zor buluyordu. - -Test edilebilirliğe odaklanmak hem göreceli hem de zaman zaman yanıltıcı olabilir. Bir gereksinimin test edilebilir olması, onun kolayca veya otomatik biçimde test edilebileceği anlamına gelmez. Ayrıca, en kolay test edilebilen gereksinimler her zaman en yüksek güvenlik katkısına sahip ya da en kolay uygulanabilir olanlar değildir. - -Bu nedenle sürüm 5.0’da seviye belirleme kararları, esas olarak risk azaltımı temeline dayanır ve uygulama çabası da göz önünde bulundurulmuştur. - -### Sadece Risk Odaklı Değil - -Belirli uygulamalar için belirli bir seviyeyi zorunlu kılan, katı ve risk bazlı seviye yaklaşımı fazlasıyla sert bir yapıya dönüşmüştür. Gerçekte, güvenlik kontrollerinin önceliklendirilmesi ve uygulanması yalnızca risk değil, aynı zamanda uygulama çabası, organizasyonel olgunluk ve kullanıcıya verilmek istenen güvenlik mesajı gibi çeşitli faktörlere bağlıdır. - -Bu nedenle, kuruluşların olgunluk düzeylerine ve kullanıcılarına vermek istedikleri mesaja göre hangi seviyeyi hedeflemeleri gerektiğine kendilerinin karar vermesi teşvik edilmektedir. diff --git a/5.0/tr/0x10-V1-Encoding-and-Sanitization.md b/5.0/tr/0x10-V1-Encoding-and-Sanitization.md deleted file mode 100644 index f010cc04ea..0000000000 --- a/5.0/tr/0x10-V1-Encoding-and-Sanitization.md +++ /dev/null @@ -1,104 +0,0 @@ -# V1 Kodlama (Encoding) ve Temizleme - -## Kontrol Amacı - -Bu bölüm, güvenilmeyen verilerin güvensiz işlenmesiyle ilişkili en yaygın web uygulaması güvenlik zayıflıklarına odaklanır. Bu tür durumlar, güvenilmeyen verinin ilgili yorumlayıcının sözdizimi kuralları çerçevesinde yanlış şekilde yorumlanmasına neden olan çeşitli teknik güvenlik açıklarına yol açar. - -Modern web uygulamalarında, parametreli sorgular, otomatik kaçış (escaping) veya şablonlama (templating) çerçeveleri gibi daha güvenli API'ların kullanımı her zaman en iyi yaklaşımdır. Aksi takdirde ya da bu mümkün değilse, çıktı kodlaması, kaçış veya temizleme işlemlerinin dikkatle uygulanması uygulamanın güvenliği için kritik öneme sahiptir. - -Girdi doğrulama, beklenmeyen ve tehlikeli içeriklere karşı savunma derinliği mekanizması olarak kullanılabilir. Ancak asıl amacı gelen verinin işlevsel ve iş gereksinimleriyle uyumlu olup olmadığını kontrol etmektir. Bu nedenle, bu konudaki gereksinimler "Doğrulama ve İş Mantığı" bölümünde ele alınmıştır. - -## V1.1 Kodlama ve Temizleme Mimarisi - -Aşağıdaki bölümlerde, güvenli olmayan içeriklerin güvenli şekilde işlenmesine yönelik, sözdizimi veya yorumlayıcıya özel güvenlik gereksinimleri sunulmaktadır. Bu bölümdeki gereksinimler, bu işlemlerin hangi sırayla ve nerede gerçekleştirilmesi gerektiğini kapsar. Ayrıca, verilerin saklandığı her durumda orijinal (ham) haliyle saklanması gerektiğini (örneğin HTML kodlaması gibi kodlanmış/kaçırılmış biçimde değil) vurgular. Bu sayede çift kodlama (double encoding) gibi sorunlar önlenmiş olur. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **1.1.1** | Girdinin yalnızca bir kez kanonik forma (canonical form) çözümlendiği veya kaçış işlemlerinin kaldırıldığı, bu işlemin yalnızca verinin bu biçimde beklenmesi durumunda yapıldığı ve bu işlemin girdi doğrulama veya temizleme işlemlerinden sonra değil, önce gerçekleştiği doğrulanmalıdır. | 2 | -| **1.1.2** | Uygulamanın, çıktıyı kullanılması gereken yorumlayıcıya verilmeden hemen önce veya yorumlayıcının kendisi tarafından çıktı kodlaması ya da kaçış işlemi yaptığı doğrulanmalıdır. | 2 | - -## V1.2 Enjeksiyon Önleme - -Potansiyel olarak tehlikeli içeriklerin yakınında yapılan çıktı kodlama veya kaçış işlemleri, uygulama güvenliği için kritiktir. Genellikle çıktı kodlama ve kaçış işlemleri kalıcı değildir. Yalnızca verinin anlık olarak yorumlayıcı tarafından güvenli şekilde işlenebilmesi için uygulanır. Bu işlemin çok erken yapılması, içeriğin bozulmasına veya etkisiz hale gelmesine neden olabilir. - -Çoğu durumda, yazılım kütüphaneleri bu işlemleri otomatik olarak gerçekleştiren güvenli veya daha güvenli işlevler sağlar. Ancak, bu işlevlerin geçerli bağlama uygun olduğundan emin olunmalıdır. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **1.2.1** | HTTP yanıtı, HTML veya XML belgesi için yapılan çıktı kodlamasının; HTML elemanları, HTML öznitelikleri, HTML yorumları, CSS ya da HTTP başlık alanları gibi bağlamlara uygun olduğu doğrulanmalıdır. Böylece mesaj veya belge yapısının bozulması önlenir. | 1 | -| **1.2.2** | Dinamik olarak URL oluşturulurken, güvenilmeyen verinin bağlamına göre (örneğin, sorgu veya yol parametreleri için URL kodlaması ya da base64url kodlaması) kodlandığı doğrulanmalıdır. Yalnızca güvenli URL protokollerine izin verilmelidir (örneğin, javascript: veya data: yasaklanmalıdır). | 1 | -| **1.2.3** |JavaScript içeriği (JSON dahil) dinamik olarak oluşturulurken çıktı kodlama/kaçış kullanıldığı doğrulanmalıdır. Böylece mesaj veya belge yapısı değiştirilmemiş olur (JavaScript ve JSON enjeksiyonlarının önüne geçilir). | 1 | -| **1.2.4** | Veri sorguları veya veritabanı sorguları (SQL, HQL, NoSQL, Cypher vb.) için parametreli sorgular, ORM’ler, entity framework’ler kullanıldığı ya da SQL enjeksiyonu ve diğer veritabanı enjeksiyon saldırılarına karşı koruma sağlandığı doğrulanmalıdır. Bu durum, saklı yordam (stored procedure) yazarken de geçerlidir. | 1 | -| **1.2.5** | Uygulamanın işletim sistemi komut enjeksiyonlarına karşı korunduğu ve işletim sistemi çağrılarında parametreli OS sorguları veya bağlama özgü komut satırı çıktı kodlamasının kullanıldığı doğrulanmalıdır. | 1 | -| **1.2.6** | Uygulamanın LDAP enjeksiyon zafiyetlerine karşı korunduğu ya da LDAP enjeksiyonlarını önlemek için özel güvenlik kontrollerinin uygulandığı doğrulanmalıdır. | 2 | -| **1.2.7** | XPath enjeksiyon saldırılarına karşı, sorgu parametrelemesi veya önceden derlenmiş sorgular kullanılarak koruma sağlandığı doğrulanmalıdır. | 2 | -| **1.2.8** | LaTeX işlemcilerinin güvenli şekilde yapılandırıldığı (örneğin, --shell-escape bayrağının kullanılmadığı) ve yalnızca izin verilen komutlardan oluşan bir listeyle çalıştırıldığı doğrulanmalıdır. | 2 | -| **1.2.9** | Düzenli ifadelerde (regex) özel karakterlerin (genellikle ters eğik çizgi \ ile) kaçırılarak meta karakter olarak yorumlanmalarının önlendiği doğrulanmalıdır. | 2 | -| **1.2.10** | Uygulamanın CSV ve formül enjeksiyonlarına karşı korunduğu doğrulanmalıdır. Uygulama, CSV içeriği dışa aktarırken RFC 4180 Bölüm 2.6 ve 2.7'de tanımlanan kaçış kurallarına uymalıdır. Ayrıca, CSV veya diğer tablo formatlarına (XLS, XLSX, ODF gibi) aktarım yapılırken, alanın ilk karakteri olarak çıkan özel karakterler ('=', '+', '-', '@', '\t' (sekme), '\0' (null karakter)) tek tırnak (') ile kaçırılmalıdır. | 3 | - -Not: Parametreli sorguların veya SQL kaçışlarının kullanılması her zaman yeterli değildir. Örneğin, tablo ve sütun adları (özellikle “ORDER BY” gibi) kaçırılamaz. Bu alanlarda kullanıcı tarafından sağlanan veriler kaçırılmış olarak dahil edilirse sorgular başarısız olur veya SQL enjeksiyonuna neden olabilir. - -## V1.3 Temizleme (Sanitization) - -Güvenilmeyen içeriğin güvensiz bir bağlamda kullanılmasına karşı ideal koruma yöntemi, önceki bölümde detaylı olarak açıklandığı gibi, bağlama özel kodlama veya kaçıştırma (escaping) kullanmaktır. Bu yöntem, içeriğin anlamını koruyarak güvenli hale getirir. - -Bu mümkün olmadığında, potansiyel olarak tehlikeli karakterlerin veya içeriğin temizlenmesi (sanitize) gerekir. Bazı durumlarda, bu işlem girdinin anlamını değiştirebilir; ancak güvenlik açısından başka bir seçenek olmayabilir. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **1.3.1** | WYSIWYG editörlerinden veya benzer kaynaklardan gelen tüm güvenilmeyen HTML girdilerinin, bilinen ve güvenli bir HTML temizleme kütüphanesi ya da çerçeve özelliği ile temizlendiği doğrulanmalıdır. | 1 | -| **1.3.2** | Uygulamanın eval() veya Spring Expression Language (SpEL) gibi dinamik kod çalıştırma özelliklerini kullanmaktan kaçındığı doğrulanmalıdır. Alternatif yoksa, kullanıcı girdisi çalıştırılmadan önce mutlaka temizlenmelidir. | 1 | -| **1.3.3** | Potansiyel olarak tehlikeli bir bağlamda kullanılacak verilerin, bu bağlama uygun karakterlere izin vermek ve çok uzun girdileri kısaltmak gibi güvenlik önlemleriyle önceden temizlendiği doğrulanmalıdır. | 2 | -| **1.3.4** | Kullanıcı tarafından sağlanan SVG içeriğinin, yalnızca güvenli etiket ve özellikler (örneğin grafik çizme ile ilgili) içerdiğinden emin olmak için onaylandığı veya temizlendiği doğrulanmalıdır (ör. script veya foreignObject içermemelidir). | 2 | -| **1.3.5** | Markdown, CSS, XSL stil sayfaları, BBCode veya benzeri ifade şablon dillerinde kullanıcı girdisinin temizlendiği veya bu tür özelliklerin devre dışı bırakıldığı doğrulanmalıdır. | 2 | -| **1.3.6** | Uygulamanın, güvenilmeyen verileri başka servislere iletmeden önce izinli protokol, alan adı, yol ve port listelerine göre doğruladığı ve tehlikeli karakterleri temizlediği doğrulanarak SSRF (Sunucu Taraflı İstek Sahteciliği) saldırılarına karşı korunduğu doğrulanmalıdır. | 2 | -| **1.3.7** | Uygulamanın şablon enjeksiyon saldırılarına karşı, güvenilmeyen girdilere dayalı şablon oluşturmayı engellediği; eğer bu kaçınılmazsa, bu girdilerin mutlaka temizlendiği veya sıkı şekilde onaylandığı doğrulanmalıdır. | 2 | -| **1.3.8** | JNDI sorgularında kullanılmadan önce güvenilmeyen girdilerin temizlendiği ve JNDI'nin enjeksiyonlara karşı güvenli şekilde yapılandırıldığı doğrulanmalıdır. | 2 | -| **1.3.9** | Memcache’e gönderilmeden önce içeriğin temizlenerek enjeksiyon saldırılarına karşı korunduğu doğrulanmalıdır. | 2 | -| **1.3.10** | Format dizgilerinin (format strings) beklenmeyen veya zararlı şekilde çözümlenmesini önlemek için işlenmeden önce temizlendiği doğrulanmalıdır. | 2 | -| **1.3.11** | SMTP veya IMAP enjeksiyonlarını önlemek için, kullanıcı girdisinin posta sistemlerine iletilmeden önce temizlendiği doğrulanmalıdır. | 2 | -| **1.3.12** | Regex girdilerinin üstel geri izlemeye (exponential backtracking) neden olan öğeler içermediği ve güvenilmeyen girdilerin ReDoS (Regex Denial of Service) gibi saldırılara karşı temizlendiği doğrulanmalıdır. | 3 | - -## V1.4 Bellek, Dizgi ve Yönetilmeyen Kod - -Aşağıdaki gereksinimler, sistem programlama dilleri veya yönetilmeyen kod kullanan uygulamalarda görülen güvensiz bellek kullanımıyla ilişkili riskleri ele alır. - -Bazı durumlarda, taşma korumaları ve uyarılar, yığın (stack) rastgeleleştirme ve veri yürütme engelleme gibi önlemleri etkinleştiren derleyici bayrakları (compiler flags) kullanılarak bu risklerin önüne geçilebilir. Ayrıca, tehlikeli işaretçi, bellek, format dizgisi, tamsayı ve dizgi işlemleri tespit edildiğinde derlemenin başarısız olmasını sağlayan ayarlar tercih edilmelidir. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **1.4.1** | Yığın, arabellek (buffer) veya yığın belleği taşmalarını önlemek ya da tespit etmek amacıyla, bellek güvenli dizgi işlemlerinin, daha güvenli bellek kopyalama ve işaretçi aritmetiğinin kullanıldığı doğrulanmalıdır. | 2 | -| **1.4.2** | Tamsayı taşmalarını önlemek için işaret (sign), aralık (range) ve giriş doğrulama tekniklerinin kullanıldığı doğrulanmalıdır. | 2 | -| **1.4.3** | Dinamik olarak ayrılan belleğin ve kaynakların serbest bırakıldığı ve boşaltılan belleklere ait referansların veya işaretçilerin kaldırıldığı veya null yapıldığı doğrulanmalıdır (dangling pointer ve use-after-free zafiyetlerine karşı). | 2 | - -## V1.5 Güvenli Ters Serileştirme (Safe Deserialization) - -Verilerin saklanmış veya iletilmiş bir temsilinden uygulama nesnelerine dönüştürülmesi işlemi olan ters serileştirme, geçmişte çeşitli kod enjeksiyonu zafiyetlerinin kaynağı olmuştur. Bu işlemin dikkatli ve güvenli bir şekilde yapılması, bu tür güvenlik açıklarının önlenmesi açısından son derece önemlidir. - -Özellikle, bazı ters serileştirme yöntemleri, kullanılan programlama dili veya çerçevenin dokümantasyonunda güvensiz olarak tanımlanmıştır ve güvenilmeyen verilerle kullanıldığında güvenli hâle getirilemez. Kullanılan her yöntem için dikkatli bir inceleme yapılmalıdır. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **1.5.1** | XML ayrıştırıcılarının (parser) kısıtlayıcı şekilde yapılandırıldığı ve dış varlık çözümleme (external entity resolution) gibi güvensiz özelliklerin XXE (XML eXternal Entity) saldırılarına karşı devre dışı bırakıldığı doğrulanmalıdır . | 1 | -| **1.5.2** | Güvenilmeyen verilerin ters serileştirilmesinde, nesne türleri için izinli liste kullanımı veya istemci tanımlı nesne türlerinin kısıtlanması gibi güvenli giriş işleme önlemlerinin uygulandığı doğrulanmalıdır. Güvensiz olarak tanımlanmış ters serileştirme mekanizmaları, güvenilmeyen girdilerle kullanılmamalıdır. | 2 | -| **1.5.3** | Aynı veri türü için uygulamada kullanılan farklı parser'ların (ör. JSON, XML, URL parser'ları), veriyi tutarlı şekilde ayrıştırdığı ve aynı karakter kodlamasını kullandığı doğrulanmalıdır. Böylece JSON birlikte çalışabilirlik açıkları, URI veya dosya ayrıştırma farkları gibi sorunlar nedeniyle RFI veya SSRF saldırılarının istismar edilmesi önlenir. | 3 | - -## Referanslar - -Daha fazla bilgi için: - -* [OWASP LDAP Injection Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html) -* [OWASP Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) -* [OWASP DOM Based Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html) -* [OWASP XML External Entity Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html) -* [OWASP Testing Guide 4.0: Client-Side Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/11-Client-side_Testing/README) -* [OWASP Java Encoding Project](https://owasp.org/owasp-java-encoder/) -* [DOMPurify - Client-side HTML Sanitization Library](https://github.com/cure53/DOMPurify) -* [RFC4180 - Common Format and MIME Type for Comma-Separated Values (CSV) Files](https://datatracker.ietf.org/doc/html/rfc4180#section-2) - -Ters serileştirme ve parser konularında daha fazla bilgi için: - -* [OWASP Deserialization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) -* [OWASP Deserialization of Untrusted Data Guide](https://owasp.org/www-community/vulnerabilities/Deserialization_of_untrusted_data) -* [An Exploration of JSON Interoperability Vulnerabilities](https://bishopfox.com/blog/json-interoperability-vulnerabilities) -* [Orange Tsai - A New Era of SSRF Exploiting URL Parser In Trending Programming Languages](https://www.blackhat.com/docs/us-17/thursday/us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf) diff --git a/5.0/tr/0x11-V2-Validation-and-Business-Logic.md b/5.0/tr/0x11-V2-Validation-and-Business-Logic.md deleted file mode 100644 index 3177eba8c3..0000000000 --- a/5.0/tr/0x11-V2-Validation-and-Business-Logic.md +++ /dev/null @@ -1,73 +0,0 @@ -# V2 Doğrulama ve İş Mantığı - -## Kontrol Amacı - -Bu bölümün amacı, doğrulanan bir uygulamanın aşağıdaki üst düzey hedefleri karşıladığından emin olmaktır: - -* Uygulamanın aldığı girdiler, işlevsel veya iş gereksinimleriyle uyumludur. -* İş mantığı akışı sıralıdır, sırayla işlenir ve atlanamaz. -* İş mantığı, sürekli küçük para transferleri veya her seferinde 1 tane olmak üzere 1 milyon arkadaş ekleme gibi otomatik saldırıları tespit edip engellemek için sınırlar ve kontroller içerir. -* Yüksek değerli iş mantığı akışları, kötüye kullanım senaryoları ve kötü niyetli aktörler göz önüne alınarak oluşturulmuştur ve kimlik sahteciliği, manipülasyon, bilgi sızıntısı ve yetki yükseltme saldırılarına karşı korumaya sahiptir. - -## V2.1 Doğrulama ve İş Mantığı Dokümantasyonu - -Doğrulama ve iş mantığı dokümantasyonu; iş mantığı sınırlarını, doğrulama kurallarını ve birleştirilmiş veri öğelerinin bağlamsal tutarlılığını açıkça tanımlamalıdır. Böylece uygulamada neyin uygulanması gerektiği net olur. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **2.1.1** | Uygulama dokümantasyonunda, veri öğelerinin beklenen yapıya göre nasıl doğrulanacağına ilişkin giriş doğrulama kurallarının tanımlandığı doğrulanmalıdır. Bu; kredi kartı numaraları, e-posta adresleri, telefon numaraları gibi yaygın veri biçimleri olabileceği gibi iç sistemlere özel biçimler de olabilir. | 1 | -| **2.1.2** | Uygulama dokümantasyonunda, birleştirilmiş veri öğelerinin mantıksal ve bağlamsal tutarlılığının nasıl doğrulanacağı tanımlanmalıdır (örneğin, mahalle ve posta kodunun eşleşip eşleşmediğinin kontrolü). | 2 | -| **2.1.3** | Hem kullanıcı bazında hem de uygulama genelinde geçerli olacak şekilde, iş mantığı sınırları ve doğrulama beklentilerinin belgelendiği doğrulanmalıdır. | 2 | - -## V2.2 Girdi Doğrulama - -Etkili girdi doğrulama kontrolleri, uygulamanın beklediği veri türüne yönelik işlevsel ya da iş gereksinimlerinin sağlanmasını zorunlu kılar. Bu sayede veri kalitesi artar ve saldırı yüzeyi daraltılır. Ancak bu, verinin başka bileşenlerde kullanılmadan veya çıktıya aktarılmadan önce doğru şekilde kodlanması, parametreleştirilmesi ya da temizlenmesi ihtiyacını ortadan kaldırmaz. - -Bu bağlamda "girdi"; HTML form alanları, REST istekleri, URL parametreleri, HTTP başlıkları, çerezler, disk dosyaları, veritabanları veya harici API'lerden gelebilir. - -Bir iş mantığı kontrolü, belirli bir girdinin 100'den küçük bir sayı olup olmadığını kontrol edebilir. Bir işlevsel beklenti ise bu sayının belirli bir eşiğin altında olmasını isteyebilir, çünkü bu sayı örneğin bir döngünün kaç kez çalışacağını belirliyor olabilir; büyük bir değer, aşırı işlemeye ve hizmet reddi (DoS) durumuna yol açabilir. - -Şema doğrulaması zorunlu tutulmamış olsa da, HTTP API'leri veya JSON/XML kullanan diğer arayüzlerin tamamen doğrulanması için en etkili yöntem olabilir. - -Şema doğrulamasıyla ilgili aşağıdaki hususlara dikkat edilmelidir: - -* JSON Schema doğrulama standardının “yayınlanmış sürümü” üretime hazır kabul edilmekte ancak “stabil” değildir. Kullanıldığında, aşağıdaki gereksinimlerle çelişmediğinden emin olunmalıdır. -* Kullanılan JSON Schema kütüphaneleri, standart resmileştiğinde izlenmeli ve gerekirse güncellenmelidir. -* DTD'lere karşı yapılan XXE saldırılarını önlemek için DTD doğrulaması kullanılmamalı ve çerçeve içindeki DTD işleme özellikleri devre dışı bırakılmalıdır. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **2.2.1** | Girdilerin, işlevsel ya da iş gereksinimlerine uygunluğunun doğrulandığı teyit edilmelidir. Bu işlem; izinli değerler, desenler ve aralıklar listesine karşı pozitif doğrulama ile ya da girdinin beklenen yapıya ve mantıksal sınırlara uygunluğunun önceden tanımlanmış kurallara göre karşılaştırılması ile yapılmalıdır. Seviye 1 için bu, güvenlik veya iş kararlarında kullanılan girdilere odaklanabilir. Seviye 2 ve üstü için tüm girdilere uygulanmalıdır. | 1 | -| **2.2.2** | Uygulamanın, güvenilir bir servis katmanında girdi doğrulama zorunluluğu uygulayacak şekilde tasarlandığı doğrulanmalıdır. İstemci tarafında gerçekleştirilen doğrulama, kullanılabilirliği artırabilir ve teşvik edilmelidir. Ancak bu doğrulama,güvenlik kontrolü olarak kabul edilmemelidir. | 1 | -| **2.2.3** | Uygulamanın, ilişkili veri öğelerinin önceden tanımlanmış kurallara göre makul olup olmadığını kontrol ettiği doğrulanmalıdır. | 2 | - -## V2.3 İş Mantığı Güvenliği - -Bu bölüm, uygulamanın iş mantığı süreçlerini doğru şekilde yürüttüğünden ve bu mantık ve akışın istismarına karşı savunmasız olmadığından emin olunması için temel gereksinimleri kapsar. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **2.3.1** | Uygulamanın, aynı kullanıcı için iş mantığı akışlarını yalnızca beklenen adım sırasına göre ve adım atlamadan işlediği doğrulanmalıdır. | 1 | -| **2.3.2** | İş mantığı sınırlarının, uygulama dokümantasyonuna uygun şekilde uygulandığı doğrulanmalıdır. | 2 | -| **2.3.3** | İş mantığı seviyesinde işlemlerin (transaction) kullanıldığı ve bir iş mantığı işleminin ya bütünüyle başarıyla tamamlandığı ya da önceki geçerli duruma geri döndürüldüğü (rollback) doğrulanmalıdır. | 2 | -| **2.3.4** | İş mantığı düzeyinde kilitleme mekanizmalarının, sınırlı kaynakların (ör. sinema koltukları, teslimat zamanları) uygulamanın mantığı manipüle edilerek çift rezervasyona neden olmamasını sağladığı doğrulanmalıdır. | 2 | -| **2.3.5** | Yüksek değerli iş mantığı akışlarının, yetkisiz veya kazara gerçekleşebilecek işlemleri önlemek için çoklu kullanıcı onayı gerektirdiği doğrulanmalıdır. Bu işlemler büyük para transferleri, sözleşme onayları, gizli bilgilere erişim veya üretimde güvenlik kurallarının geçersiz kılınmaları gibi durumları içerebilir. | 3 | - -## V2.4 Otomasyon Karşıtı Önlemler - -Bu bölümde, insan benzeri etkileşimlerin zorunlu kılındığı ve aşırı miktardaki otomatik taleplerin engellendiği kontroller yer alır. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **2.4.1** | Uygulama işlevlerine yönelik aşırı miktardaki çağrılara karşı; veri sızdırma, anlamsız veri üretme, kota tüketme, hız sınırının aşılması, hizmet reddi (DoS) ya da maliyetli kaynakların aşırı kullanımı gibi risklere karşı otomasyon karşıtı kontrollerin bulunduğu doğrulanmalıdır. | 2 | -| **2.4.2** | İş mantığı akışlarının, aşırı hızlı işlem gönderimlerini önleyecek şekilde gerçekçi insan zamanlaması gerektirdiği doğrulanmalıdır. | 3 | - -## Referanslar - -Daha fazla bilgi için: - -* [OWASP Web Security Testing Guide 4.2: Input Validation Testing](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/README.html) -* [OWASP Web Security Testing Guide 4.2: Business Logic Testing](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/10-Business_Logic_Testing/README) -* Anti-automation can be achieved in many ways, including the use of the [OWASP Automated Threats to Web Applications](https://owasp.org/www-project-automated-threats-to-web-applications/) -* [OWASP Input Validation Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html) -* [JSON Schema](https://json-schema.org/specification.html) diff --git a/5.0/tr/0x12-V3-Web-Frontend-Security.md b/5.0/tr/0x12-V3-Web-Frontend-Security.md deleted file mode 100644 index 6f1c2907b2..0000000000 --- a/5.0/tr/0x12-V3-Web-Frontend-Security.md +++ /dev/null @@ -1,101 +0,0 @@ -# V3 Web Ön Uç (Frontend) Güvenliği - -## Kontrol Amacı - -Bu kategori, bir web frontend'i üzerinden gerçekleştirilen saldırılara karşı koruma sağlamak amacıyla belirlenmiş gereksinimlere odaklanır. Bu gereksinimler, makineden makineye çözümler için geçerli değildir. - -## V3.1 Web Frontend Güvenlik Dokümantasyonu - -Bu bölüm, uygulamanın dokümantasyonunda belirtilmesi gereken tarayıcı güvenlik özelliklerini tanımlar. - -| # | Açıklama | Seviye | -| :---: | :---: | :---: | -| **3.1.1** | Uygulama dokümantasyonunda, uygulamayı kullanan tarayıcıların desteklemesi gereken güvenlik özelliklerinin (ör. HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) ve diğer ilgili HTTP güvenlik mekanizmaları) tanımlandığı doğrulanmalıdır. Ayrıca bu özelliklerin mevcut olmadığı durumlarda uygulamanın nasıl davranması gerektiği (ör. kullanıcıyı uyarmak veya erişimi engellemek) de tanımlanmalıdır. | 3 | - -## V3.2 İçeriğin Yanlış Yorumlanması - -İçerik veya işlevin yanlış bir bağlamda sunulması, kötü amaçlı içeriğin çalıştırılmasına veya görüntülenmesine neden olabilir. - -| # | Açıklama | Seviye | -| :---: | :---: | :---: | -| **3.2.1** | Tarayıcıların HTTP yanıtlarında içerik veya işlevi yanlış bir bağlamda sunmalarını önlemek amacıyla güvenlik kontrollerinin uygulandığı doğrulanmalıdır (ör. API, kullanıcı tarafından yüklenen dosya veya başka bir kaynağın doğrudan çağrılması durumunda). Olası kontroller arasında; yalnızca HTTP istek başlıklarının (ör. Sec-Fetch-\*) doğru bağlamı gösterdiği durumlarda içeriğin sunulması, Content-Security-Policy başlığında "sandbox" yönergesinin kullanılması veya Content-Disposition başlığında "attachment" biçiminin kullanılması yer alabilir. | 1 | -| **3.2.2** | HTML yerine metin olarak görüntülenmesi amaçlanan içeriğin, HTML veya JavaScript gibi içeriklerin istenmeden çalıştırılmasını önleyecek şekilde "createTextNode" veya "textContent" gibi güvenli işleme fonksiyonlarıyla işlendiği doğrulanmalıdır. | 1 | -| **3.2.3** | Uygulamanın istemci tarafı JavaScript kullanırken açık değişken tanımlamaları yaparak, sıkı tür kontrolü uygulayarak, global değişkenleri document nesnesine kaydetmekten kaçınarak ve ad alanı izolasyonu sağlayarak DOM clobbering’den kaçındığı doğrulanmalıdır. | 3 | - -## V3.3 Çerez Yapılandırması - -Bu bölüm, hassas çerezlerin güvenli biçimde yapılandırılması için gereksinimleri tanımlar. Amaç, çerezlerin gerçekten uygulama tarafından oluşturulduğuna dair daha yüksek düzeyde güvence sağlamak ve içeriklerinin sızmasını veya uygunsuz şekilde değiştirilmesini önlemektir. - -| # | Açıklama | Seviye | -| :---: | :---: | :---: | -| **3.3.1** | Çerezlerin 'Secure' niteliğine sahip olduğu ve eğer çerez adı '\__Host-' ön eki ile başlamıyorsa, '__Secure-' ön ekinin kullanıldığı doğrulanmalıdır. | 1 | -| **3.3.2** | Kullanıcı arayüzü kandırma saldırılarına ve tarayıcı tabanlı istek sahteciliği saldırılarına (CSRF) karşı koruma sağlamak amacıyla, her çerezin 'SameSite' niteliğinin kullanım amacına uygun şekilde ayarlandığı doğrulanmalıdır. | 2 | -| **3.3.3** | Çerez adı, diğer sunucularla paylaşılmak üzere açıkça tasarlanmadığı sürece '__Host-' ön eki ile tanımlanmalıdır. | 2 | -| **3.3.4** | Bir çerez değeri istemci tarafı betikleri tarafından erişilememesi gereken bir veri içeriyorsa (ör. oturum token'ı), çerezin 'HttpOnly' niteliğine sahip olduğu ve aynı değerin (ör. oturum token'ı) yalnızca 'Set-Cookie' başlığı ile istemciye iletildiği doğrulanmalıdır. | 2 | -| **3.3.5** | Uygulama bir çerez oluştururken, çerez adı ve değerinin toplam uzunluğunun 4096 baytı aşmadığı doğrulanmalıdır. Çok büyük çerezler tarayıcı tarafından saklanmaz ve isteklerle gönderilmez; bu da çereze bağlı çalışan uygulama işlevlerinin bozulmasına yol açabilir. | 3 | - -## V3.4 Tarayıcı Güvenlik Mekanizması Başlıkları (Header) - -Bu bölüm, tarayıcıların uygulamadan gelen yanıtları işlerken güvenlik özelliklerini etkinleştirmesi ve kısıtlamaları uygulaması için HTTP yanıtlarında hangi güvenlik header'larının ayarlanması gerektiğini açıklar. - -| # | Açıklama | Seviye | -| :---: | :---: | :---: | -| **3.4.1**| Tüm yanıtların, HTTP Strict Transport Security (HSTS) politikasını zorunlu kılmak için Strict-Transport-Security header alanını içerdiği doğrulanmalıdır. En az 1 yıl süreli bir max-age tanımlanmalı ve Seviye 2 ve üzeri için bu politika tüm alt alan adlarını da kapsamalıdır. | 1 | -| **3.4.2** | Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header'ı, uygulama tarafından sabit bir değer olarak tanımlanmalı veya gelen Origin header değeri güvenilir origin’lerden oluşan bir izinli listeye karşı doğrulanmalıdır. ‘Access-Control-Allow-Origin: *’ kullanılması gerekiyorsa, yanıtın hassas bilgi içermediği doğrulanmalıdır. | 1 | -| **3.4.3** | HTTP yanıtlarında Content-Security-Policy header'ı bulunduğu ve bu header'ın yalnızca güvenilen içeriklerin veya kaynakların yüklenmesini ve çalıştırılmasını sağlayan yönergeler içerdiği doğrulanmalıdır. Minimum olarak "global policy", object-src 'none', base-uri 'none' yönergelerini içermeli ve izinli liste, nonce veya hash temelli bir yapı içermelidir. Seviye 3 uygulamalarında her yanıt için nonce veya hash içeren özel bir politika tanımlanmalıdır. | 2 | -| **3.4.4** | Tüm HTTP yanıtlarının 'X-Content-Type-Options: nosniff' header'ını içerdiği doğrulanmalıdır. Bu, tarayıcıya içerik türünü tahmin etmeyi bırakmasını ve yanıtın Content-Type header'ında belirtilen MIME türünün, beklenen kaynak türüyle eşleşmesini zorunlu kılar. Ayrıca bu, tarayıcıda CORB (Cross-Origin Read Blocking) özelliğini etkinleştirir. | 2 | -| **3.4.5** | Uygulamanın, 'Referer' başlığı yoluyla üçüncü taraflara teknik olarak hassas verilerin sızmasını önlemek için bir 'referrer policy' belirlediği doğrulanmalıdır. Bu, Referrer-Policy HTTP header'ıyla veya HTML öğe nitelikleriyle (element attributes) sağlanabilir. Sızabilecek hassas bilgiler, URL’deki yol ve sorgu parametreleri ile sınırlı uygulamalarda hostname bilgisini içerebilir. | 2 | -| **3.4.6** | Uygulamanın, Content-Security-Policy header'ı altında 'frame-ancestors' yönergesini her HTTP yanıtında tanımladığı ve bu sayede içeriklerin varsayılan olarak başka sayfalara gömülmesini engellediği doğrulanmalıdır. Gerekli durumlarda özel olarak izin verildiğinden emin olunmalıdır. 'X-Frame-Options' header'ı, tarayıcılar tarafından desteklenmesine rağmen, artık güncel değildir ve güvenlik amacıyla kullanılmamalıdır. | 2 | -| **3.4.7**| Content-Security-Policy header'ında ihlal bildirimlerinin gönderileceği bir adresin tanımlandığı doğrulanmalıdır. | 3 | -| **3.4.8** | Bir belgenin işlenmesini ve sunulmasını başlatan tüm HTTP yanıtlarında (örneğin 'text/html' tipi yanıtlar), 'Cross-Origin-Opener-Policy' header'ı 'same-origin' veya 'same-origin-allow-popups' yönergeleriyle birlikte yer almalıdır. Bu, tabnabbing ve frame counting gibi, pencere nesnelerine paylaşımlı erişimi sömüren saldırılara karşı koruma sağlar. | 3 | - -## V3.5 Tarayıcı Menşei Ayırımı - -Sunucu tarafında hassas işlevlere yönelik bir isteği kabul ederken, uygulamanın, isteğin uygulamanın kendisi veya güvenilir bir tarafça başlatıldığından ve bir saldırgan tarafından taklit edilmediğinden emin olması gerekir. - -Bu bağlamda hassas işlevsellik, kimliği doğrulanmış ve doğrulanmamış kullanıcılar için form gönderilerinin kabul edilmesini (kimlik doğrulama isteği gibi), durum değiştirme işlemlerini veya kaynak gerektiren işlevselliği (veri dışa aktarma gibi) içerebilir. - -Buradaki temel korumalar, JavaScript için Same Origin Policy ve çerezler için SameSite mantığı gibi tarayıcı güvenlik politikalarıdır. Bir diğer yaygın koruma ise CORS ön kontrol mekanizmasıdır. Bu mekanizma, farklı bir kaynaktan çağrılmak üzere tasarlanmış uç noktalar için kritik olacaktır, ancak farklı bir kaynaktan çağrılmak üzere tasarlanmamış uç noktalar için de yararlı bir istek sahteciliği önleme mekanizması olabilir. - -| # | Açıklama | Seviye | -| :---: | :---: | :---: | -| **3.5.1** | Uygulama, hassas işlevselliğe yönelik izinsiz cross-origin istekleri önlemek için CORS preflight mekanizmasına güvenmiyorsa, bu tür isteklerin gerçekten uygulamadan geldiği doğrulanmalıdır. Bu, anti-forgery token kullanımı veya CORS tarafından güvenli kabul edilmeyen özel HTTP header'larının zorunlu kılınmasıyla yapılabilir. Bu, tarayıcı tabanlı istek sahteciliği (CSRF) saldırılarına karşı bir savunmadır. | 1 | -| **3.5.2** | Uygulama, hassas işlevlerin izinsiz cross-origin çağrılmasını önlemek için CORS preflight mekanizmasına güveniyorsa, bu işlevlerin bir CORS-preflight isteğini tetiklemeden çağrılamadığı doğrulanmalıdır. Bu, 'Origin' ve 'Content-Type' header'larının doğrulanmasını veya CORS-safelisted olmayan bir header'ın ve alanın kullanılmasını gerektirebilir. | 1 | -| **3.5.3**| Hassas işlevselliğe yönelik HTTP isteklerinin 'POST', 'PUT', 'PATCH' veya 'DELETE' gibi uygun HTTP yöntemlerini kullandığı ve HTTP spesifikasyonuna göre "güvenli" olan 'GET', 'OPTIONS' veya 'HEAD' gibi yöntemlerle çağrılamadığı doğrulanmalıdır. Alternatif olarak 'Sec-Fetch-*' header'larının sıkı şekilde doğrulanması da uygunsuz cross-origin, navigasyon veya medya yükleme isteklerini ayırt etmek için kullanılabilir. | 1 | -| **3.5.4** | Farklı uygulamaların farklı hostname'lerde barındırıldığı ve böylece Same-Origin Policy tarafından sağlanan kısıtlamalardan (örneğin çerez erişim sınırları, kaynaklar arası etkileşim kontrolleri) faydalanıldığı doğrulanmalıdır. | 2 | -| **3.5.5**| postMessage arayüzü üzerinden alınan iletilerin, mesajın kökeni güvenilir değilse veya mesaj sözdizimi geçersizse reddedildiği doğrulanmalıdır. | 2 | -| **3.5.6** | Uygulamanın herhangi bir yerinde JSONP işlevselliğinin etkin olmadığı doğrulanmalıdır. Bu, XSSI (Cross-Site Script Inclusion) saldırılarını önlemek içindir. | 3 | -| **3.5.7** | Yetkilendirme gerektiren verilerin, JavaScript dosyaları gibi betik kaynaklarının yanıtlarında yer almadığı, XSSI saldırılarını önlemek için doğrulanmalıdır. | 3 | -| **3.5.8** | Kimliği doğrulanmış kaynakların (örneğin görseller, videolar, betikler ve belgeler) yalnızca gerçekten amaçlandığında kullanıcı adına yüklenebildiği veya gömülebildiği doğrulanmalıdır. Bu, isteğin uygun olmayan bir çapraz kaynak çağrısından kaynaklanmadığından emin olmak için Sec-Fetch-* HTTP istek başlığı alanlarının sıkı bir şekilde doğrulanmasıyla veya tarayıcıya döndürülen içeriği engelleme talimatı vermek için kısıtlayıcı bir Cross-Origin-Resource-Policy HTTP yanıt başlığı alanı ayarlayarak gerçekleştirilebilir. | 3 | - -## V3.6 Harici Kaynak Bütünlüğü - -Bu bölüm, içeriklerin üçüncü taraf sitelerde güvenli şekilde barındırılmasıyla ilgili rehberlik sunar. - -| # | Açıklama | Seviye | -| :---: | :---: | :---: | -| **3.6.1** | JavaScript kütüphaneleri, CSS veya web fontları gibi istemci tarafı varlıkların yalnızca statik ve sürümlü olması, varlığın bütünlüğünü doğrulamak için Subresource Integrity (SRI) kullanılması durumunda harici olarak (örneğin, bir İçerik Dağıtım Ağı üzerinde) barındırıldığı doğrulanmalıdır. Bu mümkün değilse, her bir kaynak için bunu gerekçelendiren belgelenmiş bir güvenlik kararı bulunmalıdır. | 3 | - -## V3.7 Diğer Tarayıcı Güvenliği Hususları - -Bu bölüm, istemci tarafı tarayıcı güvenliği için gerekli olan çeşitli diğer güvenlik kontrolleri ve modern tarayıcı güvenlik özelliklerini içerir. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **3.7.1** | Uygulamanın yalnızca hâlâ desteklenen ve güvenli kabul edilen istemci tarafı teknolojileri kullandığı doğrulanmalıdır. Bu gereksinimi karşılamayan teknolojilere örnek olarak NSAPI eklentileri, Flash, Shockwave, ActiveX, Silverlight, NACL veya istemci tarafı Java applet’leri verilebilir. | 2 | -| **3.7.2** | Uygulamanın, yalnızca hedef adres bir izinli listede yer alıyorsa kullanıcıyı otomatik olarak farklı bir ana makine adına veya uygulamanın kontrolünde olmayan bir etki alanına yönlendirdiği doğrulanmalıdır. | 2 | -| **3.7.3** | Uygulamanın, kullanıcı uygulamanın kontrolü dışındaki bir URL’ye yönlendirildiğinde, yönlendirme hakkında bir bildirim gösterdiği ve kullanıcının bu gezintiyi iptal edebilmesi için bir seçenek sunduğu doğrulanmalıdır. | 3 | -| **3.7.4** | Uygulamanın en üst düzey etki alanının (örneğin, site.tld) HTTP Strict Transport Security (HSTS) için genel preload listesine eklendiği doğrulanmalıdır. Bu, uygulamanın TLS kullanımının ana tarayıcılar tarafından doğrudan tanınmasını ve yalnızca Strict-Transport-Security yanıt header'ına bağlı kalınmamasını sağlar. | 3 | -| **3.7.5** | Uygulamaya erişen tarayıcının beklenen güvenlik özelliklerini desteklememesi durumunda, uygulamanın dokümantasyona uygun şekilde davrandığı (örneğin kullanıcıyı uyarma veya erişimi engelleme) doğrulanmalıdır. | 3 | - -## Referanslar - -Daha fazla bilgi için: - -* [Set-Cookie __Host- prefix details](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#cookie_prefixes) -* [OWASP Content Security Policy Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html) -* [Exploiting CORS misconfiguration for BitCoins and Bounties](https://portswigger.net/blog/exploiting-cors-misconfigurations-for-bitcoins-and-bounties) -* [Sandboxing third-party components](https://cheatsheetseries.owasp.org/cheatsheets/Third_Party_Javascript_Management_Cheat_Sheet.html#sandboxing-content) -* [OWASP Secure Headers Project](https://owasp.org/www-project-secure-headers/) -* [OWASP Cross-Site Request Forgery Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html) -* [HSTS Browser Preload List submission form](https://hstspreload.org/) diff --git a/5.0/tr/0x13-V4-API-and-Web-Service.md b/5.0/tr/0x13-V4-API-and-Web-Service.md deleted file mode 100644 index b86db010ae..0000000000 --- a/5.0/tr/0x13-V4-API-and-Web-Service.md +++ /dev/null @@ -1,64 +0,0 @@ -# V4 API ve Web Servisi - -## Kontrol Amacı - -Web tarayıcıları veya diğer istemciler tarafından kullanılmak üzere API'ler sunan uygulamalara özgü bazı ek değerlendirmeler bulunmaktadır (genellikle JSON, XML veya GraphQL kullanılır). Bu bölüm, uygulanması gereken ilgili güvenlik yapılandırmaları ve mekanizmaları kapsar. - -Kimlik doğrulama, oturum yönetimi ve girdi doğrulama gibi diğer bölümlerde ele alınan konuların API'ler için de geçerli olduğunu unutmayın; bu nedenle bu bölüm bağlamından bağımsız düşünülemez veya tek başına test edilemez. - -## V4.1 Genel Web Servisi Güvenliği - -Bu bölüm, genel web servisi güvenliğiyle ilgili değerlendirmeleri ve temel web servisi hijyen uygulamalarını ele alır. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **4.1.1** | İleti gövdesi içeren her HTTP yanıtında, yanıtın gerçek içeriğiyle eşleşen bir Content-Type header alanı bulunduğu ve güvenli karakter kodlamasını (örneğin, UTF-8, ISO-8859-1) belirtmek üzere charset parametresi içerdiği doğrulanmalıdır. Bu işlem, IANA Medya Türleri'nden "text/", "/+xml" ve "/xml" gibi içerikler için geçerlidir. | 1 | -| **4.1.2** | Yalnızca kullanıcı arayüzüne yönelik uç noktaların (manuel olarak web tarayıcısı ile erişilmesi amaçlanan) otomatik olarak HTTP'den HTTPS'e yönlendirme yaptığı ve diğer hizmetlerin veya uç noktaların şeffaf yönlendirme gerçekleştirmediği doğrulanmalıdır. Bu, istemcinin farkında olmadan şifrelenmemiş HTTP istekleri göndermesi ve bu isteklerin otomatik olarak HTTPS'e yönlendirilmesi sonucunda hassas verilerin sızmasının fark edilmemesi riskini önlemek içindir. | 2 | -| **4.1.3** | Uygulama tarafından kullanılan ve yük dengeleyici, web proxy veya frontend için backend hizmeti gibi bir ara katman tarafından ayarlanan herhangi bir HTTP başlık alanının, son kullanıcı tarafından geçersiz kılınamayacağı doğrulanmalıdır. Örnek başlıklar arasında X-Real-IP, X-Forwarded-* veya X-User-ID yer alabilir. | 2 | -| **4.1.4** | Uygulama veya API tarafından açıkça desteklenen HTTP yöntemlerinin (preflight istekleri sırasında OPTIONS dahil) dışında hiçbir yöntemin kullanılmadığı ve kullanılmayan yöntemlerin engellendiği doğrulanmalıdır. | 3 | -| **4.1.5** | Çok hassas istekler veya birçok sistemden geçen işlemler için, taşıma katmanı güvenliğinin üzerine ek bir güvence sağlamak amacıyla, her iletiye özel dijital imzaların kullanıldığı doğrulanmalıdır. | 3 | - -## V4.2 HTTP İleti Yapısı Doğrulama - -Bu bölüm, HTTP ileti yapısının ve başlık alanlarının doğrulanma biçimini açıklar. Amaç, istek kaçakçılığı, yanıt bölme, başlık enjeksiyonu ve aşırı uzun HTTP iletileri aracılığıyla hizmet reddi gibi saldırıları önlemektir. - -Bu gereksinimler, genel HTTP ileti işleme ve üretimi için geçerlidir; ancak farklı HTTP sürümleri arasında HTTP iletileri dönüştürülürken özellikle önemlidir. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **4.2.1** | Tüm uygulama bileşenlerinin (yük dengeleyiciler, güvenlik duvarları ve uygulama sunucuları dahil) HTTP sürümüne uygun mekanizmaları kullanarak gelen HTTP iletilerinin sınırlarını belirlediği ve bu sayede HTTP istek kaçakçılığına karşı koruma sağlandığı doğrulanmalıdır. HTTP/1.x sürümünde Transfer-Encoding başlık alanı varsa, RFC 2616'ya göre Content-Length başlığı göz ardı edilmelidir. HTTP/2 veya HTTP/3 kullanıldığında, Content-Length başlığı varsa, alıcının bu değerin DATA çerçevelerinin uzunluğuyla tutarlı olduğunu doğrulaması gerekir. | 2 | -| **4.2.2** | HTTP iletileri üretilirken, Content-Length başlığının, HTTP protokolünün çerçeveleme yöntemine göre belirlenen içerik uzunluğu ile çelişmediği doğrulanmalıdır. Bu, istek kaçakçılığı saldırılarını önlemek için gereklidir. | 3 | -| **4.2.3** | Uygulamanın, yanıt bölme ve header enjeksiyonu saldırılarını önlemek amacıyla, bağlantıya özel başlık alanları (örneğin Transfer-Encoding) içeren HTTP/2 veya HTTP/3 iletilerini göndermediği ve kabul etmediği doğrulanmalıdır. | 3 | -| **4.2.4** | Uygulamanın yalnızca başlık alanları ve değerleri CR (\r), LF (\n) veya CRLF (\r\n) karakter dizileri içermeyen HTTP/2 ve HTTP/3 isteklerini kabul ettiği doğrulanmalıdır. Bu, başlık enjeksiyonu saldırılarını önlemek içindir. | 3 | -| **4.2.5** | Uygulama (backend veya frontend) istek oluşturuyor ve gönderiyorsa, URI'ler (örneğin API çağrıları için) veya HTTP istek başlıkları (örneğin Authorization veya Cookie) gibi bileşenlerin, alıcı sistemler tarafından kabul edilemeyecek kadar uzun olmamasını sağlamak amacıyla doğrulama, temizleme veya diğer mekanizmaları kullandığı doğrulanmalıdır. Bu tür çok uzun istekler (örneğin çok uzun bir Cookie başlığı) gönderildiğinde sunucunun sürekli hata durumu döndürmesiyle hizmet reddi oluşabilir. | 3 | - -## V4.3 GraphQL - -GraphQL, veri açısından zengin istemcilerin çeşitli backend servislerine sıkı sıkıya bağlı olmadan oluşturulması için giderek daha yaygın hale gelen bir yöntemdir. Bu bölüm, GraphQL ile ilgili güvenlik değerlendirmelerini kapsar. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **4.3.1** | Maliyetli ve iç içe geçmiş sorgular sonucu oluşabilecek GraphQL veya veri katmanı ifadelerine yönelik Hizmet Reddi (DoS) saldırılarını önlemek için, sorgu izin listesi (allowlist), derinlik sınırlandırması, sorgu sayısı sınırlandırması veya sorgu maliyeti analizi kullanıldığı doğrulanmalıdır. | 2 | -| **4.3.2** | GraphQL introspection (iç yapı sorgulama) sorgularının, GraphQL API'nin üçüncü taraflar tarafından kullanılmasına yönelik olmadığı sürece, üretim ortamında devre dışı bırakıldığı doğrulanmalıdır. | 2 | - -## V4.4 WebSocket - -WebSocket, tek bir TCP bağlantısı üzerinden eşzamanlı çift yönlü iletişim sağlayan bir iletişim protokolüdür. 2011 yılında IETF tarafından RFC 6455 olarak standartlaştırılmıştır ve HTTP'den farklıdır, ancak 443 ve 80 numaralı HTTP portları üzerinden çalışacak şekilde tasarlanmıştır. - -Bu bölüm, özellikle bu gerçek zamanlı iletişim kanalını hedef alan iletişim güvenliği ve oturum yönetimi ile ilgili saldırılara karşı korunmak için gerekli olan güvenlik gereksinimlerini sunar. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **4.4.1** | Tüm WebSocket bağlantılarında TLS üzerinden WebSocket (WSS) kullanıldığı doğrulanmalıdır. | 1 | -| **4.4.2** | WebSocket'in başlangıçtaki HTTP el sıkışması (handshake) sırasında, Origin başlık alanının uygulama için izin verilen origin listesiyle karşılaştırılarak kontrol edildiği doğrulanmalıdır. | 2 | -| **4.4.3** | Uygulamanın standart oturum yönetimi kullanılamıyorsa, bunun yerine ilgili Oturum Yönetimi güvenlik gereksinimlerine uygun özel token'ların kullanıldığı doğrulanmalıdır. | 2 | -| **4.4.4** | HTTPS oturumu WebSocket kanalına geçerken, özel WebSocket oturum yönetim token’larının önceki şekilde kimliği doğrulanmış HTTPS oturumu aracılığıyla elde edildiği veya doğrulandığı doğrulanmalıdır. | 2 | - -## Referanslar - -Daha fazla bilgi için: - -* [OWASP REST Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html) -* Resources on GraphQL Authorization from [graphql.org](https://graphql.org/learn/authorization/) and [Apollo](https://www.apollographql.com/docs/apollo-server/security/authentication/#authorization-methods). -* [WSTG - v4.2 | GraphQL Testing](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/12-API_Testing/01-Testing_GraphQL) -* [WSTG - v4.1 | OWASP Foundation](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/11-Client-side_Testing/10-Testing_WebSockets) diff --git a/5.0/tr/0x14-V5-File-Handling.md b/5.0/tr/0x14-V5-File-Handling.md deleted file mode 100644 index 6061a1488c..0000000000 --- a/5.0/tr/0x14-V5-File-Handling.md +++ /dev/null @@ -1,54 +0,0 @@ -# V5 Dosya İşleme - -## Kontrol Amacı - -Dosya kullanımı, hizmet reddi, yetkisiz erişim ve depolama alanının tükenmesi gibi uygulama için çeşitli riskler oluşturabilir. Bu bölüm, bu riskleri ele almak için gereken gereksinimleri içerir. - -## V5.1 Dosya İşleme Dokümantasyonu - -Bu bölüm, uygulama tarafından kabul edilen dosyaların beklenen özelliklerinin belgelenmesini gerektirir. Bu, ilgili güvenlik kontrollerinin geliştirilmesi ve doğrulanması için gerekli bir ön koşuldur. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **5.1.1** | Dokümantasyonun, her yükleme özelliği için izin verilen dosya türlerini, beklenen dosya uzantılarını ve maksimum boyutu (açılmış hali dahil) tanımladığı doğrulanmalıdır. Ayrıca, dosyaların son kullanıcılar için nasıl güvenli hâle getirileceği (örneğin kötü amaçlı bir dosya tespit edildiğinde uygulamanın nasıl davranacağı) gibi bilgilerin de belgede yer aldığı doğrulanmalıdır. | 2 | - -## V5.2 Dosya Yükleme ve İçerik - -Dosya yükleme işlevi, güvenilmeyen dosyaların birincil kaynağıdır. Bu bölüm, bu dosyaların varlığının, hacminin veya içeriğinin uygulamaya zarar vermemesini sağlamak için gereken gereksinimleri açıklar. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **5.2.1** | Uygulamanın, yalnızca performans kaybına veya hizmet reddine yol açmayacak boyuttaki dosyaları kabul ettiği doğrulanmalıdır. | 1 | -| **5.2.2** | Uygulama bir dosyayı, doğrudan veya bir arşiv (ör. zip dosyası) içinde kabul ettiğinde, dosya uzantısının beklenen uzantıyla eşleşip eşleşmediğini kontrol ettiği ve içeriğin uzantı tarafından temsil edilen türle uyumlu olduğunu doğruladığı kontrol edilmelidir. Bu; ilk 'magic byte' kontrolü, görüntü yeniden yazımı ve dosya içeriği doğrulama için özel kütüphanelerin kullanımı gibi yöntemleri içerir. Seviye 1 için bu, yalnızca iş veya güvenlik kararlarında kullanılan dosyalarla sınırlı olabilir. Seviye 2 ve üzeri için tüm dosyalar bu kontrole tabi olmalıdır. | 1 | -| **5.2.3** | Sıkıştırılmış dosyaların (ör. zip, gz, docx, odt) açılmadan önce, izin verilen maksimum açılmış boyuta ve maksimum dosya sayısına göre kontrol edildiği doğrulanmalıdır. | 2 | -| **5.2.4** | Her kullanıcı için dosya boyutu kotası ve maksimum dosya sayısının uygulandığı doğrulanmalıdır. Böylece tek bir kullanıcının çok sayıda veya aşırı büyük dosya yükleyerek depolama alanını doldurması engellenir. | 3 | -| **5.2.5** | Uygulamanın, içinde sembolik bağlantılar (symlink) bulunan sıkıştırılmış dosyaların yüklenmesine yalnızca bu durum özel olarak gerekli olduğunda izin verdiği doğrulanmalıdır. Bu durumda, sembolik bağlantı verilebilecek dosyaların bir izinli listesi uygulanmalıdır. | 3 | -| **5.2.6** | Uygulamanın, piksel boyutu izin verilen maksimum değeri aşan görüntü dosyalarının yüklenmesini reddettiği doğrulanmalıdır. Bu, pixel flood saldırılarını önlemek için gereklidir. | 3 | - -## V5.3 Dosya Depolama - -Bu bölüm, yüklenen dosyaların uygunsuz şekilde çalıştırılmasını önlemeye, tehlikeli içeriğin tespitine ve güvenilmeyen verilerle dosya depolama konumlarının kontrol edilmesinin engellenmesine yönelik gereksinimleri içerir. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **5.3.1** | Güvenilmeyen girdilerle yüklenen veya oluşturulan ve herkese açık klasörlerde depolanan dosyaların, bir HTTP isteğiyle doğrudan erişildiğinde sunucu taraflı program kodu olarak çalıştırılmadığı doğrulanmalıdır. | 1 | -| **5.3.2** | Uygulamanın, dosya işlemleri için dosya yollarını oluştururken kullanıcı tarafından gönderilen dosya adlarını değil, dahili olarak oluşturulan veya güvenilir verileri kullandığı; eğer kullanıcı tarafından gönderilen dosya adları veya meta veriler kullanılacaksa, sıkı doğrulama ve temizleme işlemlerinin uygulandığı doğrulanmalıdır. Bu, yol geçişi (path traversal), yerel veya uzak dosya dahil etme (LFI, RFI) ve sunucu tarafı istek sahteciliği (SSRF) saldırılarına karşı koruma sağlar. | 1 | -| **5.3.3** | Sunucu tarafında gerçekleşen dosya işlemlerinin (örneğin dosya açma/decompress işlemi), kullanıcı tarafından sağlanan yol bilgilerini yok saydığı ve zip slip gibi güvenlik açıklarını önlediği doğrulanmalıdır. | 3 | - -## V5.4 Dosya İndirme - -Bu bölüm, indirilebilir dosyaların sunulmasında ortaya çıkabilecek riskleri azaltmaya yönelik gereksinimleri içerir. Bunlar; yol geçişi (path traversal), enjeksiyon saldırıları ve dosyanın tehlikeli içerik barındırıp barındırmadığına ilişkin kontrolleri kapsar. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **5.4.1** | Uygulamanın, kullanıcı tarafından gönderilen dosya adlarını (ör. JSON, JSONP veya URL parametresinde) doğruladığı veya göz ardı ettiği ve yanıtın Content-Disposition başlık alanında bir dosya adı belirttiği doğrulanmalıdır. | 2 | -| **5.4.2** | Sunulan dosya adlarının (örneğin HTTP yanıt header'larında veya e-posta eklerinde), belge yapısını korumak ve enjeksiyon saldırılarını önlemek için kodlandığı veya temizlendiği (ör. RFC 6266’ya uygun) doğrulanmalıdır. | 2 | -| **5.4.3** | Güvenilmeyen kaynaklardan elde edilen dosyaların, bilinen kötü amaçlı içeriklerin sunulmasını önlemek amacıyla antivirüs tarayıcılarıyla tarandığı doğrulanmalıdır. | 2 | - -## Referanslar - -Daha fazla bilgi için: - -* [File Extension Handling for Sensitive Information](https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload) -* [Example of using symlinks for arbitrary file read](https://hackerone.com/reports/1439593) -* [Explanation of "Magic Bytes" from Wikipedia](https://en.wikipedia.org/wiki/List_of_file_signatures) diff --git a/5.0/tr/0x15-V6-Authentication.md b/5.0/tr/0x15-V6-Authentication.md deleted file mode 100644 index 9b01cbe2c7..0000000000 --- a/5.0/tr/0x15-V6-Authentication.md +++ /dev/null @@ -1,166 +0,0 @@ -# V6 Kimlik Doğrulama - -## Kontrol Amacı - -Kimlik doğrulama, bir kişinin ya da cihazın kimliğini kanıtlama veya doğrulama sürecidir. Bu süreç; bir kişi ya da cihaz hakkında yapılan iddiaların doğrulanmasını, taklit girişimlerine karşı dayanıklılığı ve parolaların ele geçirilmesine ya da dinlenmesine karşı korunmayı kapsar. - -[NIST SP 800-63](https://pages.nist.gov/800-63-3/), özellikle ABD kurumları ve bu kurumlarla etkileşimde bulunanlar için geçerli olmakla birlikte, dünya çapında kuruluşlar için değerli olan modern ve kanıta dayalı bir standarttır. - -Bu bölümdeki birçok gereksinim, söz konusu standardın ikinci bölümü olan NIST SP 800-63B "Dijital Kimlik Rehberi – Kimlik Doğrulama ve Yaşam Döngüsü Yönetimi" bölümünden esinlenmiştir. Ancak bu bölüm, yaygın tehditlere ve sıkça suistimal edilen kimlik doğrulama zayıflıklarına odaklanır; standardın tüm yönlerini kapsamaya çalışmaz. Tam NIST SP 800-63 uyumu gerekiyorsa, doğrudan bu belgeye başvurulmalıdır. - -Ayrıca, NIST SP 800-63 terimleriyle bu bölümde kullanılan terimler zaman zaman farklılık gösterebilir. Bu bölümde, anlaşılırlığı artırmak amacıyla daha yaygın kullanılan terimler tercih edilmiştir. - -Daha gelişmiş uygulamaların ortak bir özelliği, çeşitli risk faktörlerine bağlı olarak kimlik doğrulama aşamalarının uyarlanabilir şekilde yapılandırılabilmesidir. Bu özellik, yetkilendirme kararlarıyla da ilgili olduğundan "Yetkilendirme" bölümünde ele alınmıştır. - -## V6.1 Kimlik Doğrulama Dokümantasyonu - -Bu bölüm, bir uygulamada kimlik doğrulama ile ilgili tutulması gereken dokümantasyon gereksinimlerini içerir. Bu, ilgili kimlik doğrulama kontrollerinin nasıl yapılandırılması gerektiğini uygulamak ve değerlendirmek açısından kritik öneme sahiptir. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **6.1.1** | Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırılarına karşı oran sınırlama (rate limiting), otomasyon karşıtı önlemler ve uyarlanabilir yanıt gibi kontrollerin nasıl kullanıldığını açıklayan bir uygulama dokümantasyonu bulunduğu doğrulanmalıdır. Dokümantasyon, bu kontrollerin nasıl yapılandırıldığını ve kötü niyetli hesap kilitlemenin nasıl önlendiğini açıkça ortaya koymalıdır. | 1 | -| **6.1.2** | Parolalarda kullanılmasını önlemek amacıyla, bağlama özgü sözcüklerin (örneğin kurum adlarının permütasyonları, ürün adları, sistem tanımlayıcıları, proje kod adları, departman veya rol adları vb.) bulunduğu belgelenmiş bir liste mevcut olduğu doğrulanmalıdır. | 2 | -| **6.1.3** | Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, bunların tümünün belgelenmiş olduğu ve her yol için tutarlı şekilde uygulanması gereken güvenlik kontrolleri ile kimlik doğrulama gücünün tanımlandığı doğrulanmalıdır. | 2 | - -## V6.2 Parola Güvenliği - -Parolalar, NIST SP 800-63 tarafından "Ezberlenmiş Sırlar" (Memorized Secrets) olarak tanımlanır ve parolalar, parola öbekleri, PIN'ler, desen kilitleri ya da "doğru kedinin veya başka bir görsel öğenin seçilmesi" gibi yöntemleri kapsar. Genellikle "bildiğiniz bir şey" olarak kabul edilirler ve tek faktörlü kimlik doğrulamada yaygın olarak kullanılırlar. - -Bu nedenle, bu bölüm parolaların güvenli şekilde oluşturulmasını ve işlenmesini sağlamak amacıyla oluşturulmuş gereksinimleri içerir. Gereksinimlerin çoğu Seviye 1’dedir çünkü temel düzeyde en önemli olanlardır. Seviye 2 ve sonrasında, çok faktörlü kimlik doğrulama mekanizmaları gereklidir ve parola bu faktörlerden yalnızca biri olabilir. - -Bu bölümdeki gereksinimler büyük ölçüde [NIST's Guidance](https://pages.nist.gov/800-63-3/sp800-63b.html)'ın [§ 5.1.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver) kısmı ile ilişkilidir. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **6.2.1** | Kullanıcı tarafından belirlenen parolaların en az 8 karakter uzunluğunda olması sağlanmalı, ancak 15 karakter ve üzeri uzunlukta parolalar olmaları şiddetle tavsiye edilir. | 1 | -| **6.2.2** | Kullanıcıların parolalarını değiştirebilmeleri sağlanmalıdır. | 1 | -| **6.2.3** | Parola değiştirme işlevinin hem mevcut hem de yeni parolayı gerektirdiği doğrulanmalıdır. | 1 | -| **6.2.4** | Kayıt veya parola değişimi sırasında girilen parolaların, uygulamanın parola politikasına (örneğin minimum uzunluk) uyan ilk 3000 yaygın parolaya karşı kontrol edildiği doğrulanmalıdır. | 1 | -| **6.2.5** | Her tür karakterin kullanılmasına izin verildiği ve büyük/küçük harf, sayı veya özel karakter şartlarının zorunlu tutulmadığı doğrulanmalıdır. | 1 | -| **6.2.6** | Parola giriş alanlarının, girdiyi maskelemek için "type=password" kullandığı doğrulanmalıdır. Uygulamalar, kullanıcının tüm maskelenmiş parolayı ya da son girilen karakteri geçici olarak görüntülemesine izin verebilir. | 1 | -| **6.2.7** | "Yapıştır" özelliğinin, tarayıcı parola yardımcılarının ve harici parola yöneticilerinin kullanımına izin verildiği doğrulanmalıdır. | 1 | -| **6.2.8** | Uygulamanın, kullanıcıdan aldığı parolayı herhangi bir şekilde değiştirmeden, örneğin kesmeden veya harf büyüklüğünü değiştirmeden, tam olarak doğruladığı teyit edilmelidir. | 1 | -| **6.2.9** | En az 64 karakter uzunluğundaki parolalara izin verildiği doğrulanmalıdır. | 2 | -| **6.2.10** | Kullanıcının parolasının, yalnızca ele geçirildiği tespit edildiğinde veya kullanıcı tarafından yenilendiğinde geçerliliğini yitirdiği doğrulanmalıdır. Uygulama, belirli aralıklarla parola yenilenmesini zorunlu kılmamalıdır. | 2 | -| **6.2.11** | Tahmin edilmesi kolay parolaların oluşturulmasını önlemek amacıyla, bağlama özgü kelimelerin yer aldığı belgelenmiş listenin parola doğrulamada kullanıldığı teyit edilmelidir. | 2 | -| **6.2.12** | Kayıt veya parola değişikliği sırasında girilen parolaların, ele geçirilmiş parolalar listesine karşı kontrol edildiği doğrulanmalıdır. | 2 | - -## V6.3 Genel Kimlik Doğrulama Güvenliği - -Bu bölüm, kimlik doğrulama mekanizmalarının güvenliğine ilişkin genel gereksinimleri içerir ve farklı güvenlik seviyeleri için beklentileri ortaya koyar. Seviye 2 uygulamalarında çok faktörlü kimlik doğrulama (MFA) zorunlu olmalıdır. Seviye 3 uygulamalarında, donanım tabanlı, kanıtlanmış ve güvenli yürütme ortamında (Trusted Execution Environment - TEE) gerçekleştirilen kimlik doğrulama kullanılmalıdır. Bu, cihaza bağlı passkey’ler, eIDAS Yüksek Güvence Seviyesi (LoA High) zorunlu kimlik doğrulayıcılar, NIST Kimlik Doğrulayıcı Güvence Seviyesi 3 (AAL3) güvencesine sahip kimlik doğrulayıcılar veya eşdeğer mekanizmaları içerebilir. - -Bu yaklaşım MFA konusunda oldukça katı bir duruş sergilese de, kullanıcıları korumak adına güvenlik seviyesini yükseltmek kritiktir. Bu gereksinimlerin gevşetilmesi yönündeki her girişim, kimlik doğrulama ile ilgili risklerin nasıl azaltılacağını açıkça ortaya koyan bir planla birlikte sunulmalıdır. Bu plan, NIST’in konuyla ilgili rehberleri ve araştırmalarını dikkate almalıdır. - -Yayın tarihi itibarıyla, NIST SP 800-63 e-posta kullanımını bir kimlik doğrulama mekanizması olarak [kabul edilemez](https://pages.nist.gov/800-63-FAQ/#q-b11) olarak değerlendirmektedir ([arşivlenmiş kopya](https://web.archive.org/web/20250330115328/https://pages.nist.gov/800-63-FAQ/#q-b11)). - -Bu bölümdeki gereksinimler, [NIST's Guidance](https://pages.nist.gov/800-63-3/sp800-63b.html)'ın [§ 4.2.1](https://pages.nist.gov/800-63-3/sp800-63b.html#421-permitted-authenticator-types), [§ 4.3.1](https://pages.nist.gov/800-63-3/sp800-63b.html#431-permitted-authenticator-types), [§ 5.2.2](https://pages.nist.gov/800-63-3/sp800-63b.html#522-rate-limiting-throttling) ve [§ 6.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#-612-post-enrollment-binding) bölümleriyle ilgilidir. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **6.3.1** | Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırıları gibi saldırıları önlemeye yönelik kontrollerin, uygulamanın güvenlik dokümantasyonuna göre uygulandığı doğrulanmalıdır. | 1 | -| **6.3.2** | "root", "admin" veya "sa" gibi varsayılan kullanıcı hesaplarının uygulamada yer almadığı veya devre dışı bırakıldığı doğrulanmalıdır. | 1 | -| **6.3.3** | Uygulamaya erişim için ya çok faktörlü bir kimlik doğrulama mekanizması ya da tek faktörlü mekanizmaların kombinasyonu kullanılmalıdır. Seviye 3 için, bu faktörlerden biri, oltalama saldırılarına karşı direnç sağlayan ve kimlik doğrulama niyetini bir kullanıcı etkileşimi (örneğin FIDO donanım anahtarında bir düğmeye basma veya mobil telefonda bir onay) gerektirerek doğrulayan donanım tabanlı bir kimlik doğrulayıcı olmalıdır. Bu gereksinimdeki herhangi bir esneklik için, gerekçesi belgelenmiş ve riskleri azaltıcı kapsamlı kontroller içeren bir plan gereklidir. | 2 | -| **6.3.4** | Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, belgelendirilmemiş bir yol bulunmadığı ve tüm yollar için güvenlik kontrolleri ile kimlik doğrulama gücünün tutarlı şekilde uygulandığı doğrulanmalıdır. | 2 | -| **6.3.5** | Başarılı veya başarısız şüpheli kimlik doğrulama girişimlerinin kullanıcıya bildirildiği doğrulanmalıdır. Bu, olağandışı bir konum veya istemciden gelen girişimler, yalnızca bir faktörle yapılan kısmen başarılı doğrulamalar, uzun süreli inaktiflik sonrası yapılan girişimler veya birçok başarısız denemeden sonraki başarılı girişimler gibi durumları içerebilir. | 3 | -| **6.3.6** | E-postanın, tek faktörlü ya da çok faktörlü kimlik doğrulama mekanizması olarak kullanılmadığı doğrulanmalıdır. | 3 | -| **6.3.7** | Kimlik doğrulama detaylarında yapılan güncellemeler sonrasında (örneğin kimlik bilgisi sıfırlama, kullanıcı adı veya e-posta adresi değişiklikleri), kullanıcıların bilgilendirildiği doğrulanmalıdır. | 3 | -| **6.3.8** | Başarısız kimlik doğrulama girişimlerinden, geçerli kullanıcıların hata mesajları, HTTP yanıt kodları veya farklı yanıt süreleri gibi sonuçlara dayanarak tespit edilemediği doğrulanmalıdır. Bu koruma, kayıt ve "parolamı unuttum" işlevselliğinde de geçerli olmalıdır. | 3 | - -## V6.4 Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma - -Kimlik doğrulama faktörleri; parolalar, yazılım tabanlı token'lar, donanım token'ları ve biyometrik cihazlar gibi öğeleri kapsar. Bu mekanizmaların yaşam döngüsünün güvenli şekilde yönetilmesi, bir uygulamanın güvenliği açısından kritik öneme sahiptir. Bu bölüm, bu mekanizmalarla ilgili gereksinimleri içerir. - -Bu bölümdeki gereksinimler, büyük ölçüde [NIST's Guidance](https://pages.nist.gov/800-63-3/sp800-63b.html)'ın [§ 5.1.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver) veya [§ 6.1.2.3](https://pages.nist.gov/800-63-3/sp800-63b.html#replacement) bölümleri ile ilişkilidir. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **6.4.1** | Sistem tarafından oluşturulan ilk parolaların veya etkinleştirme kodlarının güvenli bir şekilde rastgele üretildiği, mevcut parola politikasına uygun olduğu, kısa bir süre içinde veya ilk kullanım sonrasında geçerliliğini yitirdiği doğrulanmalıdır. Bu başlangıç sırları uzun vadeli parola olarak kullanılmasına izin verilmemelidir. | 1 | -| **6.4.2** | Parola ipuçlarının veya "gizli sorular" olarak bilinen, bilgiye dayalı kimlik doğrulama mekanizmalarının mevcut olmadığı doğrulanmalıdır. | 1 | -| **6.4.3** | Unutulmuş parolanın sıfırlanması için, etkin olan çok faktörlü kimlik doğrulama mekanizmalarını atlamayan güvenli bir sürecin uygulandığı doğrulanmalıdır. | 2 | -| **6.4.4** | Çok faktörlü kimlik doğrulama faktörlerinden biri kaybolursa, kayıt sırasında uygulanan kimlik kanıtlama seviyesiyle aynı seviyede kimlik doğrulama yapıldığı doğrulanmalıdır. | 2 | -| **6.4.5** | Süresi dolacak kimlik doğrulama mekanizmalarının yenilenmesine ilişkin talimatların, süresi dolmadan önce tamamlanacak şekilde yeterli sürede gönderildiği ve gerekiyorsa otomatik hatırlatıcıların yapılandırıldığı doğrulanmalıdır. | 3 | -| **6.4.6** | Yönetici yetkisi olan kullanıcıların, kullanıcının parola sıfırlama sürecini başlatabildiği ancak kullanıcının yeni parolasını belirleyemediği veya değiştiremediği doğrulanmalıdır. Bu, yönetici yetkisi olan kullanıcıların, kullanıcı parolasını bilmesini engeller. | 3 | - -## V6.5 Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler - -Bu bölüm, çeşitli çok faktörlü kimlik doğrulama yöntemleriyle ilgili genel yönergeleri sunar. - -Bu mekanizmalar şunları içerir: - -* Arama Sırları (Lookup Secrets) -* Zamana Dayalı Tek Kullanımlık Parolalar (TOTP) -* Bant Dışı (Out-of-Band) mekanizmalar - -"Arama sırları", daha önceden oluşturulmuş gizli kod listeleridir. Bunlar, İşlem Yetkilendirme Numaraları (TAN), sosyal medya kurtarma kodları veya rastgele değerler içeren bir tablo şeklinde olabilir. Bu tür kimlik doğrulama mekanizmaları, “sahip olduğunuz bir şey” olarak değerlendirilir çünkü kodlar kasıtlı olarak ezberlenemez olacak şekilde tasarlanır ve bir yerde saklanmaları gerekir. - -Zamana Dayalı Tek Kullanımlık Parolalar (TOTP), fiziksel veya yazılımsal token'lardır ve sürekli değişen, sözde rastgele (pseudo-random) bir tek kullanımlık parola gösterir. Bu mekanizmalar da “sahip olduğunuz bir şey” kategorisindedir. Çok faktörlü TOTP'ler tek faktörlü TOTP'lere benzer, ancak nihai Tek Kullanımlık Parolayı (OTP) oluşturmak için geçerli bir PIN kodu, biyometrik kilit açma, USB takma, NFC eşleştirme veya bazı ek değerlerin (işlem imzalama hesaplayıcıları gibi) girilmesini gerektirir. - -Bant dışı mekanizmalar bir sonraki bölümde açıklanacaktır. - -Bu bölümlerdeki gereklilikler çoğunlukla [NIST's Guidance](https://pages.nist.gov/800-63-3/sp800-63b.html)'ın [§ 5.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#-512-look-up-secrets), [§ 5.1.3](https://pages.nist.gov/800-63-3/sp800-63b.html#-513-out-of-band-devices), [§ 5.1.4.2](https://pages.nist.gov/800-63-3/sp800-63b.html#5142-single-factor-otp-verifiers), [§ 5.1.5.2](https://pages.nist.gov/800-63-3/sp800-63b.html#5152-multi-factor-otp-verifiers), [§ 5.2.1](https://pages.nist.gov/800-63-3/sp800-63b.html#521-physical-authenticators) ve [§ 5.2.3](https://pages.nist.gov/800-63-3/sp800-63b.html#523-use-of-biometrics) kısımları ile ilgilidir. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **6.5.1** | Arama sırları, bant dışı kimlik doğrulama istekleri veya kodları ve zamana dayalı tek kullanımlık parolaların (TOTP) yalnızca bir kez kullanılabildiği doğrulanmalıdır. | 2 | -| **6.5.2** | Uygulamanın backend tarafında saklanırken, 112 bitten az entropiye sahip (örneğin 19 rastgele harf-rakam karakteri veya 34 rastgele rakam) arama sırlarının, 32-bit rastgele bir salt içeren onaylı bir parola saklama algoritmasıyla hash’lendiği doğrulanmalıdır. Gizli bilginin entropisi 112 bit veya daha fazlaysa standart bir hash fonksiyonu kullanılabilir. | 2 | -| **6.5.3** | Arama sırları, bant dışı kimlik doğrulama kodları ve zamana dayalı tek kullanımlık parola seed'lerinin, öngörülebilir değerlerden kaçınmak için Kriptografik Olarak Güvenli Sözde Rastgele Sayı Üreteci (CSPRNG) ile oluşturulduğu doğrulanmalıdır. | 2 | -| **6.5.4** | Arama sırlarının ve bant dışı kimlik doğrulama kodlarının en az 20 bit entropiye (genellikle 4 rastgele harf-rakam karakteri veya 6 rastgele rakam) sahip olduğu doğrulanmalıdır. | 2 | -| **6.5.5** | Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının ve zamana dayalı tek kullanımlık parolaların (TOTP) belirli bir ömre sahip olduğu doğrulanmalıdır. Bant dışı istekler en fazla 10 dakika, TOTP’ler ise en fazla 30 saniye geçerli olmalıdır. | 2 | -| **6.5.6** | Herhangi bir kimlik doğrulama faktörünün (fiziksel cihazlar dahil) çalınması veya kaybı durumunda iptal edilebildiği doğrulanmalıdır. | 3 | -| **6.5.7** | Biyometrik kimlik doğrulama mekanizmalarının yalnızca ikincil faktör olarak, “sahip olduğunuz bir şey” veya “bildiğiniz bir şey” ile birlikte kullanıldığı doğrulanmalıdır. | 3 | -| **6.5.8** | Zamana dayalı tek kullanımlık parolaların (TOTP) doğrulamasının, güvenilir bir hizmetten alınan zaman kaynağına dayanarak yapıldığı ve güvenilir olmayan veya istemci tarafından sağlanan zaman kaynağına dayanmadığı doğrulanmalıdır. | 3 | - -## V6.6 Bant Dışı Kimlik Doğrulama Mekanizmaları - -Bu mekanizmalar genellikle kimlik doğrulama sunucusunun, fiziksel bir cihazla güvenli bir ikinci kanal üzerinden iletişim kurmasını (örneğin mobil cihazlara gönderilen bildirimler) içerir. Bu tür mekanizmalar, “sahip olduğunuz bir şey” olarak değerlendirilir. - -E-posta ve VOIP gibi güvenli olmayan bant dışı kimlik doğrulama yöntemlerine izin verilmemektedir. PSTN ve SMS ile yapılan kimlik doğrulama şu anda NIST tarafından ["sınırlandırılmış" doğrulama mekanizmaları](https://pages.nist.gov/800-63-FAQ/#q-b01) olarak değerlendirilmekte ve yerlerine zamana dayalı tek kullanımlık parolalar (TOTP) veya benzer kriptografik mekanizmaların tercih edilmesi önerilmektedir. NIST SP 800-63B [§ 5.1.3.3](https://pages.nist.gov/800-63-3/sp800-63b.html#-5133-authentication-using-the-public-switched-telephone-network), telefon veya SMS kullanılması gerekiyorsa cihaz değişimi, SIM değişikliği, numara taşıma gibi anormal davranışların risklerinin ele alınmasını önermektedir. Bu ASVS bölümü bunu zorunlu kılmasa da, bu önlemlerin alınmaması Seviye 2'deki hassas bir uygulamada veya Seviye 3’teki bir uygulamada ciddi bir güvenlik riski olarak değerlendirilmelidir. - -Ayrıca NIST, yakın zamanda [anlık bildirimlerin kullanılmamasını öneren](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#fig-3) bir yönerge oluşturmuştur. Bu ASVS bölümü bu konuda bir zorunluluk getirmese de, “push bombing” risklerine karşı farkındalık önemlidir. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **6.6.1** | Tek kullanımlık parolaların (OTP) telefon veya SMS ile Public Switched Telephone Network (PSTN) üzerinden iletildiği kimlik doğrulama mekanizmalarının, yalnızca telefon numarası önceden doğrulanmışsa, alternatif daha güçlü yöntemler (örneğin TOTP) de sunuluyorsa ve kullanıcıya güvenlik riskleri hakkında bilgi veriliyorsa sunulduğu doğrulanmalıdır. Seviye 3 uygulamalar için telefon ve SMS seçenekleri sunulmamalıdır. | 2 | -| **6.6.2** | Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının, oluşturuldukları özgün kimlik doğrulama isteğiyle bağlantılı olduğu ve daha önceki ya da sonraki bir istek için kullanılamadığı doğrulanmalıdır. | 2 | -| **6.6.3** | Kod tabanlı bant dışı kimlik doğrulama mekanizmalarının, oran sınırlaması ile kaba kuvvet saldırılarına karşı korunduğu doğrulanmalıdır. En az 64 bit entropiye sahip kodlar kullanılması da değerlendirilmelidir. | 2 | -| **6.6.4** | Çok faktörlü kimlik doğrulama için push bildirimleri kullanılıyorsa, push bombing saldırılarına karşı oran sınırlamasının kullanıldığı doğrulanmalıdır. “Numara eşleştirme” de bu riski azaltabilir. | 3 | - -## V6.7 Kriptografik Kimlik Doğrulama Mekanizması - -Kriptografik kimlik doğrulama mekanizmaları, akıllı kartlar veya FIDO anahtarları gibi kullanıcıların kimlik doğrulama işlemini tamamlamak için kriptografik cihazı bilgisayara takması ya da eşleştirmesini gerektiren mekanizmaları içerir. Kimlik doğrulama sunucusu, kriptografik cihaza veya yazılıma bir "challenge nonce" gönderir; cihaz ya da yazılım da güvenli bir şekilde saklanan kriptografik anahtara dayalı olarak bir yanıt üretir. Bu bölümdeki gereksinimler bu mekanizmalar için, “Kriptografi” bölümünde ele alınan kriptografik algoritmalarla ilgili rehberlik sağlayan kısımlarla birlikte, uygulamaya özel rehberlik sağlar. - -Kriptografik kimlik doğrulama için paylaşımlı veya gizli anahtarların kullanıldığı durumlarda, diğer sistem gizli anahtarlarıyla aynı mekanizmalar kullanılarak saklanmalıdır. Bu mekanizmalar “Yapılandırma” başlığındaki “Gizli Yönetimi” bölümünde belgelenmiştir. - -Bu bölümdeki gereksinimler çoğunlukla [NIST's Guidance](https://pages.nist.gov/800-63-3/sp800-63b.html)'ın [§ 5.1.7.2](https://pages.nist.gov/800-63-3/sp800-63b.html#sfcdv) kısmı ile ilişkilidir. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **6.7.1** | Kriptografik kimlik doğrulama beyanlarını doğrulamak için kullanılan sertifikaların, değiştirilmeye karşı korumalı şekilde saklandığı doğrulanmalıdır. | 3 | -| **6.7.2** | Challenge nonce değerinin en az 64 bit uzunluğunda olduğu ve istatistiksel olarak benzersiz ya da cihazın ömrü boyunca benzersiz olduğu doğrulanmalıdır. | 3 | - -## V6.8 Kimlik Sağlayıcısı ile Kimlik Doğrulama - -Kimlik Sağlayıcılar (IdP'ler), kullanıcılar için birleştirilmiş kimlikler sunar. Kullanıcılar genellikle birden fazla IdP ile birden fazla kimliğe sahiptir; örneğin Azure AD, Okta, Ping Identity veya Google gibi bir kurumsal kimlik ya da Facebook, Twitter, Google veya WeChat gibi bir tüketici kimliği. Bu liste, bu şirketlere veya hizmetlere bir onay niteliğinde değil, sadece geliştiricilerin çoğu kullanıcının halihazırda birçok kimliğe sahip olduğu gerçeğini dikkate almaları gerektiğine dair bir hatırlatmadır. Kuruluşlar, IdP'nin kimlik doğrulama gücüne ilişkin risk profiline göre mevcut kullanıcı kimlikleriyle entegrasyon sağlamayı değerlendirmelidir. Örneğin, sahte veya geçici kimliklerin kolayca oluşturulabilmesi nedeniyle bir devlet kurumu, sosyal medya kimliklerini hassas sistemlere giriş için kabul etmeyebilir; ancak bir mobil oyun şirketi, aktif oyuncu kitlesini artırmak için büyük sosyal medya platformlarıyla entegrasyon yapmayı tercih edebilir. - -Harici kimlik sağlayıcıların güvenli kullanımı, kimlik sahtekarlığını veya sahte beyanları önlemek için dikkatli yapılandırma ve doğrulama gerektirir. Bu bölüm, bu riskleri ele almak için gereksinimleri sunar. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **6.8.1** | Uygulama birden fazla kimlik sağlayıcıyı (IdP) destekliyorsa, başka bir desteklenen kimlik sağlayıcı aracılığıyla (örneğin aynı kullanıcı tanımlayıcısını kullanarak) kullanıcının kimliğinin taklit edilemediği doğrulanmalıdır. Standart önlem, uygulamanın kullanıcıyı IdP kimliği (bir ad alanı işlevi görür) ve IdP içindeki kullanıcı kimliğinin birleşimiyle kaydetmesi ve tanımlamasıdır. | 2 | -| **6.8.2** | Kimlik doğrulama beyanları üzerindeki dijital imzaların (örneğin JWT veya SAML beyanları) varlığı ve bütünlüğünün her zaman doğrulandığı ve imzasız veya geçersiz imzalı beyanların reddedildiği doğrulanmalıdır. | 2 | -| **6.8.3** | SAML beyanlarının benzersiz biçimde işlendiği ve yalnızca geçerlilik süresi içinde bir kez kullanıldığı, tekrar oynatma (replay) saldırılarını önlemek amacıyla doğrulanmalıdır. | 2 | -| **6.8.4** | Uygulama ayrı bir Kimlik Sağlayıcı (IdP) kullanıyorsa ve belirli işlemler için belirli kimlik doğrulama gücü, yöntemleri veya zaman bilgisi bekliyorsa, uygulamanın bu bilgileri IdP tarafından döndürülen veriler üzerinden doğruladığı teyit edilmelidir. Örneğin OIDC kullanılıyorsa, bu durum ID Token üzerindeki 'acr', 'amr' ve 'auth_time' gibi claim’lerin (varsa) doğrulanması ile sağlanabilir. Eğer IdP bu bilgileri sağlamıyorsa, uygulamanın asgari kimlik doğrulama gücünün kullanıldığını varsayan (örneğin yalnızca kullanıcı adı ve parola ile tek faktörlü doğrulama) belgelenmiş bir yedek yaklaşımı olmalıdır. | 2 | - -## Referanslar - -Daha fazla bilgi için: - -* [NIST SP 800-63 - Digital Identity Guidelines](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-3.pdf) -* [NIST SP 800-63B - Authentication and Lifecycle Management](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf) -* [NIST SP 800-63 FAQ](https://pages.nist.gov/800-63-FAQ/) -* [OWASP Testing Guide 4.0: Testing for Authentication](https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/04-Authentication_Testing/README.html) -* [OWASP Cheat Sheet - Password storage](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html) -* [OWASP Cheat Sheet - Forgot password](https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html) -* [OWASP Cheat Sheet - Choosing and using security questions](https://cheatsheetseries.owasp.org/cheatsheets/Choosing_and_Using_Security_Questions_Cheat_Sheet.html) -* [CISA Guidance on "Number Matching"](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implement-number-matching-in-mfa-applications-508c.pdf) -* [Details on the FIDO Alliance](https://fidoalliance.org/) diff --git a/5.0/tr/0x16-V7-Session-Management.md b/5.0/tr/0x16-V7-Session-Management.md deleted file mode 100644 index b600167bf0..0000000000 --- a/5.0/tr/0x16-V7-Session-Management.md +++ /dev/null @@ -1,91 +0,0 @@ -# V7 Oturum Yönetimi - -## Kontrol Amacı - -Oturum yönetim mekanizmaları, durum bilgisi olmayan iletişim protokolleri (örneğin HTTP) kullanılırken bile uygulamaların kullanıcı ve cihaz etkileşimlerini zaman içinde ilişkilendirmesini sağlar. Modern uygulamalar, farklı özelliklere ve amaçlara sahip birden fazla oturum belirteci kullanabilir. Güvenli bir oturum yönetim sistemi, saldırganların bir kurbanın oturumunu ele geçirmesini, kullanmasını veya kötüye kullanmasını önlemelidir. Oturumları yöneten uygulamaların aşağıdaki üst düzey oturum yönetimi gereksinimlerini karşılaması gerekir: - -* Oturumlar her bireye özgüdür, tahmin edilemez veya paylaşılamaz. -* Oturumlar artık gerekmediğinde geçersiz kılınır ve inaktivite durumunda zaman aşımına uğrar. - -Bu bölümdeki birçok gereksinim, yaygın tehditlere ve sıkça kötüye kullanılan kimlik doğrulama zayıflıklarına odaklanarak seçilmiş [NIST SP 800-63 Digital Identity Guidelines](https://pages.nist.gov/800-63-4/) kontrolleriyle ilgilidir. - -Belirli oturum yönetim mekanizmalarının bazı uygulama detaylarına ilişkin gereksinimler diğer bölümlerde yer almaktadır: - -* HTTP Çerezleri, oturum belirteçlerini güvence altına almak için yaygın bir mekanizmadır. Çerezler için özel güvenlik gereksinimleri "Web Frontend Güvenliği" bölümünde bulunabilir. -* Kendinden içerikli token'lar, oturumları sürdürmenin yaygın yollarından biridir. Bu token'lara özel güvenlik gereksinimleri "Kendinden İçerikli Token'lar" bölümünde ele alınmıştır. - -## V7.1 Oturum Yönetim Dokümantasyonu - -Tüm uygulamalara uyan tek bir kalıp yoktur. Bu nedenle, tüm durumlara uygun evrensel sınırlar ve limitler tanımlamak mümkün değildir. Oturum yönetimi uygulama ve testine başlanmadan önce, oturum işleme ile ilgili güvenlik kararlarının belgelenmiş olduğu bir risk analizi yapılmalıdır. Bu, oturum yönetim sisteminin uygulamanın özel ihtiyaçlarına göre uyarlanmasını sağlar. - -Durum bilgili ya da durumsuz (stateful ya da stateless) oturum mekanizması tercih edilse bile, analiz eksiksiz ve belgelenmiş olmalı ve seçilen çözümün ilgili tüm güvenlik gereksinimlerini karşılayabildiğini göstermelidir. Kullanılan herhangi bir Tek Oturum Açma (SSO) mekanizması ile olan etkileşim de değerlendirilmelidir. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **7.1.1** | Kullanıcının oturum inaktivite zaman aşımı süresi ve mutlak maksimum oturum süresinin belgelendiği, diğer kontrollerle birlikte uygun olduğu ve NIST SP 800-63B yeniden kimlik doğrulama gereksinimlerinden herhangi bir sapma varsa gerekçesinin belgede yer aldığı doğrulanmalıdır. | 2 | -| **7.1.2** | Belgede bir hesap için kaç adet eşzamanlı (paralel) oturuma izin verildiği ile birlikte, maksimum aktif oturum sayısına ulaşıldığında uygulanacak davranış ve işlemlerin tanımlandığı doğrulanmalıdır. | 2 | -| **7.1.3** | Birleşik kimlik yönetim ekosisteminin bir parçası olarak kullanıcı oturumu oluşturan ve yöneten tüm sistemlerin, oturum ömrü, sonlandırma ve yeniden kimlik doğrulama gerektiren diğer koşulların nasıl koordine edildiğini açıklayan kontrollerle birlikte belgede yer aldığı doğrulanmalıdır. | 2 | - -## V7.2 Temel Oturum Yönetimi Güvenliği - -Bu bölüm, oturum token'larının güvenli bir şekilde oluşturulup doğrulandığını teyit eden, güvenli oturumların temel gereksinimlerini içerir. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **7.2.1** | Uygulamanın tüm oturum token'ı doğrulama işlemlerini güvenilir bir backend servisi aracılığıyla gerçekleştirdiği doğrulanmalıdır. | 1 | -| **7.2.2** | Uygulamanın, statik API gizli anahtarları veya sabit değerler yerine, oturum yönetimi için dinamik olarak oluşturulan kendi kendine yeterli veya referans token'ları kullandığı doğrulanmalıdır. | 1 | -| **7.2.3** | Uygulama kullanıcı oturumlarını temsil etmek için referans token'ları kullanıyorsa, bu token'ların benzersiz olduğu, kriptografik olarak güvenli bir sözde rastgele sayı üreteci (CSPRNG) kullanılarak üretildiği ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. | 1 | -| **7.2.4** | Uygulamanın, kullanıcı kimlik doğrulaması (yeniden kimlik doğrulama dahil) sırasında yeni bir oturum token'ı oluşturduğu ve mevcut oturum token'ını sonlandırdığı doğrulanmalıdır. | 1 | - -## V7.3 Oturum Zaman Aşımı - -Oturum zaman aşımı mekanizmaları, oturum gaspı (session hijacking) ve diğer oturum kötüye kullanımı biçimlerine karşı fırsat aralığını en aza indirmeyi amaçlar. Zaman aşımı süreleri, belgelenmiş güvenlik kararlarını karşılamalıdır. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **7.3.1** | Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde bir hareketsizlik zaman aşımı bulunduğu doğrulanmalıdır. | 2 | -| **7.3.2** | Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde mutlak bir maksimum oturum süresi bulunduğu doğrulanmalıdır. | 2 | - -## V7.4 Oturum Sonlandırma - -Oturum sonlandırma işlemi, uygulamanın kendisi tarafından veya oturum yönetimi uygulama yerine SSO sağlayıcısı tarafından yürütülüyorsa SSO sağlayıcısı tarafından gerçekleştirilebilir. Bu bölümdeki gereksinimler değerlendirilirken SSO sağlayıcısının kapsam dahilinde olup olmadığına karar verilmesi gerekebilir çünkü bazı kontroller sağlayıcı tarafından yürütülüyor olabilir. - -Oturum sonlandırma, yeniden kimlik doğrulamanın gerekli olmasını sağlamalı ve uygulama genelinde, birleşik oturum açma (varsa) ve tüm güvenen taraflar genelinde etkili olmalıdır. - -Durum bilgili oturum mekanizmaları için sonlandırma tipik olarak oturumu backend tarafında geçersiz kılmayı içerir. Kendinden içerikli token'lar durumunda ise, bu token'ları geçersiz kılmak veya engellemek için ek önlemler gerekir; aksi halde bunlar süresi dolana kadar geçerli kalabilir. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **7.4.1** | Oturum sonlandırma tetiklendiğinde (örneğin, çıkış yapıldığında veya süre dolduğunda), uygulamanın oturumun daha fazla kullanılmasına izin vermediği doğrulanmalıdır. Referans token'lar veya durum bilgili oturumlar için bu, oturum verilerinin uygulama arka ucunda geçersiz kılınması anlamına gelir. Kapsamlı token kullanan uygulamaların; sonlandırılmış token listesi tutmak, kullanıcıya özel tarih ve saatten önce oluşturulan token'ları reddetmek veya kullanıcıya özel imzalama anahtarını yenilemek gibi bir çözüm uygulaması gerekir. | 1 | -| **7.4.2** | Bir kullanıcı hesabı devre dışı bırakıldığında veya silindiğinde (örneğin bir çalışanın şirketten ayrılması), uygulamanın tüm aktif oturumları sonlandırdığı doğrulanmalıdır. | 1 | -| **7.4.3** | Herhangi bir kimlik doğrulama faktörünün başarılı bir şekilde değiştirilmesi veya kaldırılmasından (şifre sıfırlama veya kurtarma yoluyla yapılan değişiklikler dahil ve varsa MFA ayarları güncellemeleri dahil) sonra, uygulamanın diğer tüm aktif oturumları sonlandırma seçeneği sunduğu doğrulanmalıdır. | 2 | -| **7.4.4** | Kimlik doğrulama gerektiren tüm sayfalarda kolay erişilebilir ve görünür bir çıkış yap (logout) işlevi bulunduğu doğrulanmalıdır. | 2 | -| **7.4.5** | Uygulama yöneticilerinin, bireysel bir kullanıcının veya tüm kullanıcıların aktif oturumlarını sonlandırabilme yetkisine sahip olduğu doğrulanmalıdır. | 2 | - -## V7.5 Oturum Kötüye Kullanımına Karşı Savunmalar - -Bu bölüm, aktif oturumların ele geçirilmesi veya kötüye kullanılması riskini azaltmaya yönelik gereksinimleri içerir. Bu riskler, örneğin kimliği doğrulanmış bir kurbanın internet tarayıcısının, kurbanın oturumunu kullanarak bir eylemi gerçekleştirmeye zorlanması gibi vektörler aracılığıyla ortaya çıkabilir. - -Bu bölümdeki gereksinimler değerlendirilirken "Kimlik Doğrulama" bölümündeki seviyeye özel yönergeler dikkate alınmalıdır. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **7.5.1** | E-posta adresi, telefon numarası, MFA yapılandırması veya hesap kurtarmada kullanılan diğer bilgiler gibi kimlik doğrulamayı etkileyebilecek hassas hesap özniteliklerinde değişiklik yapılmadan önce uygulamanın tam yeniden kimlik doğrulama gerektirdiği doğrulanmalıdır. | 2 | -| **7.5.2** | Kullanıcıların, (en az bir faktörle yeniden kimlik doğrulama yaptıktan sonra) mevcut tüm aktif oturumları görüntüleyebilmesi ve sonlandırabilmesinin mümkün olduğu doğrulanmalıdır. | 2 | -| **7.5.3** | Uygulamanın, son derece hassas işlemler veya operasyonlar gerçekleştirilmeden önce en az bir faktörle ek kimlik doğrulaması veya ikincil bir doğrulama gerektirdiği doğrulanmalıdır. | 3 | - -## V7.6 Birleşik Yeniden Kimlik Doğrulama - -Bu bölüm, Güvenen Taraf (Relying Party – RP) veya Kimlik Sağlayıcı (Identity Provider – IdP) kodu yazanlar için geçerlidir. Bu gereksinimler [NIST SP 800-63C Federation & Assertions](https://pages.nist.gov/800-63-4/sp800-63c.html) (Federasyon ve Beyanlar) rehberinden türetilmiştir. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **7.6.1** | Güvenen Taraf (RP) ile Kimlik Sağlayıcı (IdP) arasındaki oturum süresi ve oturum sonlandırma davranışlarının belgelenmiş olduğu ve, örneğin IdP kimlik doğrulama olayları arasında maksimum süreye ulaşıldığında yeniden kimlik doğrulamanın gerekli kılındığı doğrulanmalıdır. | 2 | -| **7.6.2** | Yeni bir oturum oluşturulmasının, kullanıcı onayı veya açık bir eylem gerektirdiği; kullanıcı etkileşimi olmaksızın yeni uygulama oturumlarının oluşturulmasının önlendiği doğrulanmalıdır. | 2 | - -## Referanslar - -Daha fazla bilgi için: - -* [OWASP Web Security Testing Guide: Session Management Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/06-Session_Management_Testing) -* [OWASP Session Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html) diff --git a/5.0/tr/0x17-V8-Authorization.md b/5.0/tr/0x17-V8-Authorization.md deleted file mode 100644 index fe8b46df88..0000000000 --- a/5.0/tr/0x17-V8-Authorization.md +++ /dev/null @@ -1,56 +0,0 @@ -# V8 Yetkilendirme - -## Kontrol Amacı - -Yetkilendirme, yalnızca izin verilen tüketicilere (kullanıcılar, sunucular ve diğer istemciler) erişim verilmesini sağlar. En Az Ayrıcalık İlkesi'ni (Principle of Least Privilege - POLP) uygulamak için doğrulanmış uygulamalar aşağıdaki üst düzey gereksinimleri karşılamalıdır: - -* Yetkilendirme kurallarını, karar alma faktörlerini ve çevresel bağlamları içerecek şekilde belgelendirin. -* Tüketiciler, yalnızca tanımlanmış haklarında izin verilen kaynaklara erişebilmelidir. - -## V8.1 Yetkilendirme Dokümantasyonu - -Kapsamlı yetkilendirme dokümantasyonu, güvenlik kararlarının tutarlı biçimde uygulanmasını, denetlenebilir olmasını ve kurumsal politikalarla uyumlu olmasını sağlamak açısından kritik öneme sahiptir. Bu, geliştiriciler, yöneticiler ve test uzmanları için güvenlik gereksinimlerini açık ve uygulanabilir hâle getirerek yetkisiz erişim riskini azaltır. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **8.1.1** | Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak işlev düzeyinde ve veriye özel erişim kısıtlamaları için kuralları tanımladığı doğrulanmalıdır. | 1 | -| **8.1.2** | Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak alan (field) düzeyinde erişim kısıtlamaları (hem okuma hem yazma) için kuralları tanımladığı doğrulanmalıdır. Bu kuralların, ilgili veri nesnesinin durum veya statü gibi diğer özniteliklerine bağlı olabileceği unutulmamalıdır. | 2 | -| **8.1.3** | Uygulamanın dokümantasyonunun, kimlik doğrulama ve yetkilendirme ile ilgili güvenlik kararlarının alınmasında kullanılan çevresel ve bağlamsal öznitelikleri (günün saati, kullanıcı konumu, IP adresi veya cihaz gibi) tanımladığı doğrulanmalıdır. | 3 | -| **8.1.4** | Kimlik doğrulama ve yetkilendirme dokümantasyonunun; işlev düzeyinde, veriye özel ve alan düzeyinde yetkilendirmenin yanı sıra çevresel ve bağlamsal faktörlerin karar almada nasıl kullanıldığını tanımladığı doğrulanmalıdır. Bu, değerlendirilen öznitelikleri, risk eşiklerini ve alınan aksiyonları (ör. izin ver, doğrulama iste, reddet, step-up kimlik doğrulama) içermelidir. | 3 | - -## V8.2 Genel Yetkilendirme Tasarımı - -İşlev, veri ve alan düzeyinde ayrıntılı yetkilendirme kontrollerinin uygulanması, tüketicilerin yalnızca kendilerine açıkça verilmiş izinlere sahip kaynaklara erişebilmesini sağlar. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **8.2.1** | Uygulamanın, işlev düzeyindeki erişimin yalnızca açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. | 1 | -| **8.2.2** | Uygulamanın, veriye özel erişimin yalnızca belirli veri öğelerine açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, doğrudan nesne referansı güvenlik açıkları (IDOR) ve bozuk nesne düzeyinde yetkilendirme (BOLA) risklerini azaltır. | 1 | -| **8.2.3** | Uygulamanın, alan (field) düzeyindeki erişimin yalnızca belirli alanlara açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, bozuk nesne özelliği düzeyinde yetkilendirme (BOPLA) risklerini azaltır. | 2 | -| **8.2.4** | Tüketicinin çevresel ve bağlamsal özniteliklerine (ör. günün saati, konum, IP adresi veya cihaz) dayalı uyarlanabilir güvenlik kontrollerinin, uygulama dokümantasyonunda tanımlandığı şekilde, kimlik doğrulama ve yetkilendirme kararları için uygulandığı doğrulanmalıdır. Bu kontroller, tüketici yeni bir oturum başlatmaya çalışırken ve mevcut bir oturum sırasında uygulanmalıdır. | 3 | - -## V8.3 İşlem Düzeyinde Yetkilendirme - -Yetkilendirme değişikliklerinin uygulamanın mimarisindeki uygun katmana anında yansıtılması, özellikle dinamik ortamlarda yetkisiz işlemleri önlemek açısından kritik öneme sahiptir. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **8.3.1** | Uygulamanın yetkilendirme kurallarını güvenilir bir servis katmanında uyguladığı ve istemci taraflı JavaScript gibi güvenilmeyen tüketiciler tarafından değiştirilebilecek kontrollerle yetinmediği doğrulanmalıdır. | 1 | -| **8.3.2** | Yetkilendirme kararlarının temelini oluşturan değerlerdeki değişikliklerin hemen uygulandığı doğrulanmalıdır. Değişikliklerin anında uygulanamadığı durumlarda (örneğin self-contained token içindeki verilere güveniliyorsa), tüketici artık yetkili olmadığı hâlde bir işlem gerçekleştirdiğinde uyarı verecek ve değişikliği geri alacak önlemler uygulanmalıdır. Bu alternatifin bilgi sızıntısını önlemeyeceği unutulmamalıdır. | 3 | -| **8.3.3** | Bir nesneye erişimin, herhangi bir aracı veya onun adına hareket eden bir servis yerine yalnızca erişimi başlatan öznenin (ör. tüketici) izinlerine dayandığı doğrulanmalıdır. Örneğin, bir tüketici kimlik doğrulama için bir self-contained token kullanarak bir web servis çağırırsa ve bu servis başka bir servisten veri talep ederse, ikinci servis izin kararlarını verirken birinci servisin makine-makine token'ı yerine tüketicinin token'ını kullanmalıdır. | 3 | - -## V8.4 Diğer Yetkilendirme Hususları - -Yetkilendirme ile ilgili ek hususlar, özellikle yönetici arayüzleri ve çok kiracılı (multi-tenant) ortamlar için, yetkisiz erişimi önlemeye yardımcı olur. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **8.4.1** | Multi-tenant uygulamaların, tüketici işlemlerinin izinli olmadıkları tenant'lar üzerinde asla etkili olmamasını sağlamak için tenant'lar arası kontroller kullandığı doğrulanmalıdır. | 2 | -| **8.4.2** | Yönetici arayüzlerine erişimin, sürekli tüketici kimlik doğrulaması, cihaz güvenlik durumu değerlendirmesi ve bağlamsal risk analizi dahil olmak üzere çok katmanlı güvenlik içerdiği doğrulanmalıdır. Yetkilendirme için yalnızca ağ konumu veya güvenilir uç noktalar yeterli olmamalıdır; ancak bu tür faktörler yetkisiz erişim olasılığını azaltabilir. | 3 | - -## Referanslar - -Daha fazla bilgi için: - -* [OWASP Web Security Testing Guide: Authorization](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/05-Authorization_Testing) -* [OWASP Authorization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html) diff --git a/5.0/tr/0x18-V9-Self-contained-Tokens.md b/5.0/tr/0x18-V9-Self-contained-Tokens.md deleted file mode 100644 index 2754157502..0000000000 --- a/5.0/tr/0x18-V9-Self-contained-Tokens.md +++ /dev/null @@ -1,36 +0,0 @@ -# V9 Kendi İçinde Taşıyıcı Token (Self-contained Token) - -## Kontrol Amacı - -Kendi içinde taşıyıcı token ya da self-contained token kavramı, ilk olarak 2012 tarihli RFC 6749 OAuth 2.0 standardında belirtilmiştir. Bu kavram, içeriğinde bir hizmetin güvenlik kararlarını almak için kullanacağı veri veya iddiaları (claim) taşıyan bir token'ı ifade eder. Bu, yalnızca bir tanımlayıcı içeren ve hizmetin veriyi yerel olarak aramasına yarayan basit token'lardan ayrıdır. Self-contained token'lara en yaygın örnekler JSON Web Tokens (JWT) ve SAML assertion'lardır. - -Self-contained token kullanımı, OAuth ve OIDC dışında bile oldukça yaygın hale gelmiştir. Aynı zamanda bu mekanizmanın güvenliği, token'ın bütünlüğünün doğrulanabilmesine ve belirli bir bağlam için geçerli olduğunun teyit edilmesine bağlıdır. Bu süreçte birçok güvenlik açığı ortaya çıkabilir ve bu bölüm, uygulamaların alması gereken önlemleri ayrıntılı şekilde açıklamaktadır. - -## V9.1 Token Kaynağı ve Bütünlüğü - -Bu bölüm, token'ın güvenilir bir tarafça üretildiğini ve üzerinde oynama yapılmadığını sağlamak için gereken gereksinimleri içerir. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **9.1.1** | Self-contained token'ların içerikleri kabul edilmeden önce, oynama (tampering) saldırılarına karşı dijital imza veya MAC ile doğrulama yapıldığı doğrulanmalıdır. | 1 | -| **9.1.2** | Belirli bir bağlam için yalnızca bir allowlist üzerinde bulunan algoritmaların self-contained token oluşturmak ve doğrulamak için kullanılabildiği doğrulanmalıdır. Bu allowlist, yalnızca simetrik ya da yalnızca asimetrik algoritmaları içermeli ve kesinlikle 'None' algoritmasını içermemelidir. Hem simetrik hem de asimetrik algoritmalar desteklenmek zorundaysa, anahtar karışıklığını (key confusion) önlemek için ek kontroller uygulanmalıdır. | 1 | -| **9.1.3** | Self-contained token'ları doğrulamak için kullanılan anahtar malzemesinin, token issuer için önceden yapılandırılmış güvenilir kaynaklardan alındığı doğrulanmalıdır. Bu, saldırganların güvenilmeyen kaynak ve anahtarları belirtmesini engeller. JWT ve diğer JWS yapılarında 'jku', 'x5u' ve 'jwk' gibi header'lar güvenilir kaynaklardan oluşan bir allowlist'e göre doğrulanmalıdır. | 1 | - -## V9.2 Token İçeriği - -Bir self-contained token içeriğine dayanarak güvenlik kararı alınmadan önce, token'ın geçerlilik süresi içinde sunulup sunulmadığı ve belirli bir hizmet tarafından belirli bir amaç için kullanıma uygun olup olmadığı doğrulanmalıdır. Bu, aynı issuer'dan gelen farklı token türlerinin farklı hizmetler arasında güvensiz şekilde yeniden kullanılmasını önlemeye yardımcı olur. - -OAuth ve OIDC'ye özgü gereksinimler ilgili bölümde yer almaktadır. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **9.2.1** | Token verisinde bir geçerlilik zaman aralığı (validity time span) varsa, yalnızca doğrulama zamanı bu zaman aralığı içerisindeyse token ve içeriği kabul edilmelidir. Örneğin, JWT'ler için 'nbf' ve 'exp' claim'leri doğrulanmalıdır. | 1 | -| **9.2.2** | Token'ı alan hizmetin, token içeriğini kabul etmeden önce bu token'ın doğru türde olduğunu ve sunulma amacına uygun olduğunu doğruladığı teyit edilmelidir. Örneğin, yalnızca erişim token'ları yetkilendirme kararları için, yalnızca ID Token'lar kullanıcı kimlik doğrulamasını kanıtlamak için kullanılabilir. | 2 | -| **9.2.3** | Hizmetin yalnızca kendisiyle kullanılması amaçlanan (audience) token'ları kabul ettiği doğrulanmalıdır. JWT'lerde bu, 'aud' claim'inin hizmet içinde tanımlı bir allowlist ile doğrulanması yoluyla sağlanabilir. | 2 | -| **9.2.4** | Eğer bir token issuer, farklı audience'lara token oluşturmak için aynı private key'i kullanıyorsa, oluşturulan token'ların hedef audience'ları benzersiz şekilde tanımlayan bir audience kısıtlaması içerdiği doğrulanmalıdır. Bu, bir token'ın farklı bir audience ile yeniden kullanılmasını önler. Audience tanımlayıcısı dinamik olarak sağlanıyorsa, token issuer bu audience'ları doğrulamalı ve audience taklitlerinin (impersonation) önüne geçmelidir. | 2 | - -## Referanslar - -Daha fazla bilgi için: - -* [OWASP JSON Web Token Cheat Sheet for Java Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_for_Java_Cheat_Sheet.html) (genel olarak yönlendirme için kullanışlı) diff --git a/5.0/tr/0x19-V10-OAuth-and-OIDC.md b/5.0/tr/0x19-V10-OAuth-and-OIDC.md deleted file mode 100644 index 4da598de62..0000000000 --- a/5.0/tr/0x19-V10-OAuth-and-OIDC.md +++ /dev/null @@ -1,169 +0,0 @@ -# V10 OAuth ve OIDC - -## Kontrol Amacı - -OAuth2 (bu bölümde kısaca OAuth olarak anılacaktır), yetki devri için endüstri standardı bir çerçevedir. Örneğin, OAuth kullanılarak bir istemci uygulama, kullanıcı tarafından yetkilendirildiği sürece, o kullanıcı adına API’lere (sunucu kaynaklarına) erişim sağlayabilir. - -OAuth tek başına kullanıcı kimlik doğrulaması amacıyla tasarlanmamıştır. OpenID Connect (OIDC) çerçevesi, OAuth üzerine bir kullanıcı kimliği katmanı ekleyerek bu eksikliği tamamlar. OIDC, standartlaştırılmış kullanıcı bilgileri, Single Sign-On (SSO) ve oturum yönetimi gibi özellikleri destekler. OIDC, OAuth'un bir uzantısı olduğundan, bu bölümdeki OAuth gereksinimleri aynı zamanda OIDC için de geçerlidir. - -OAuth çerçevesinde aşağıdaki roller tanımlanır: - -* OAuth istemcisi, sunucu kaynaklarına erişim sağlamaya çalışan uygulamadır (örneğin, verilen access token’ı kullanarak bir API çağrısı yapar). Genellikle bu, sunucu taraflı bir uygulamadır. - * Gizli istemci (confidential client), authorization server ile kimlik doğrulama sırasında kullandığı kimlik bilgilerini gizli tutabilecek kapasitede olan istemcidir. - * Genel istemci (public client), authorization server ile kimlik doğrulama sırasında kullandığı kimlik bilgilerini gizli tutamayacak durumdadır. Bu nedenle kendini yalnızca bir client_id ile tanıtır, client_id ve client_secret gibi bilgilerle kimlik doğrulaması yapmaz. -* OAuth kaynak sunucusu (resource server – RS), OAuth istemcilerine kaynakları sunan API’dir. -* OAuth yetkilendirme sunucusu (authorization server – AS), access token üreten sunucu uygulamasıdır. Bu token’lar sayesinde OAuth istemcisi, son kullanıcı adına veya kendi adına RS üzerindeki kaynaklara erişim sağlayabilir. AS genellikle ayrı bir uygulama olsa da, uygun görüldüğünde RS ile entegre olabilir. -* Kaynak sahibi (resource owner – RO), OAuth istemcilerinin kendi adına, kaynak sunucusu üzerinde kısıtlı erişim elde etmesine izin veren son kullanıcıdır. Yetkilendirme sürecine AS üzerinden katılım sağlar. - -OIDC çerçevesinde aşağıdaki roller tanımlanır: - -* Güvenen taraf (relying party – RP), son kullanıcının kimlik doğrulamasını OpenID Provider üzerinden gerçekleştirmek isteyen istemci uygulamadır. Aynı zamanda bir OAuth istemcisidir. -* OpenID Provider (OP), son kullanıcıyı kimlik doğrulama yeteneğine sahip olan ve RP'ye OIDC claim’lerini sağlayan bir OAuth yetkilendirme sunucusudur. OP çoğu zaman bir kimlik sağlayıcı (IdP) olur; ancak federasyon senaryolarında OP ve gerçek kimlik sağlayıcı farklı uygulamalar olabilir. - -OAuth ve OIDC başlangıçta üçüncü taraf uygulamalar için tasarlanmıştı. Ancak günümüzde ilk taraf uygulamalar tarafından da yaygın şekilde kullanılmaktadır. Bu kullanım senaryolarında, özellikle kimlik doğrulama ve oturum yönetimi amacıyla kullanıldığında protokol belirli bir karmaşıklık ekler ve bu durum bazı yeni güvenlik riskleri yaratabilir. - -OAuth ve OIDC birçok farklı uygulama tipiyle kullanılabilir; ancak ASVS ve bu bölümdeki gereksinimler özellikle web uygulamaları ve API’ler için tasarlanmıştır. - -OAuth ve OIDC, web teknolojilerinin üzerine kurulu mantıksal protokoller olduklarından, bu bölümdeki gereksinimler diğer bölümlerden bağımsız değerlendirilemez; genel güvenlik gereksinimleri geçerliliğini korur. - -Bu bölüm, ve üzerindeki spesifikasyonlarla uyumlu şekilde OAuth2 ve OIDC için güncel en iyi uygulamaları ele alır. RFC’ler olgun belgeler olarak görülse de, sık sık güncellenmektedir. Bu nedenle uygulamada, ilgili gereksinimlerin en güncel versiyonlarla uyumlu şekilde ele alınması önemlidir. Ayrıntılar için bölümün referans kısmına bakınız. - -Bu alanın karmaşıklığı göz önünde bulundurulduğunda, güvenli bir OAuth veya OIDC çözümünün, tanınmış ve endüstri standardı yetkilendirme sunucularını kullanması ve önerilen güvenlik yapılandırmalarını uygulaması son derece önemlidir. - -Bu bölümde kullanılan terimler, OAuth ve OIDC spesifikasyonlarındaki tanımlarla uyumludur. Ancak OIDC’ye özel gereksinimler dışında, genellikle OAuth terminolojisi tercih edilmiştir. - -Bu bölümde geçen "token" terimi, aşağıdaki anlamlarda kullanılmıştır: - -* Access token'ları sadece RS tarafından kullanılır. Bunlar ya introspection ile doğrulanan bir reference token olabilir ya da belirli bir anahtar malzemesiyle doğrulanan bir self-contained token olabilir. -* Refresh token'ları, yalnızca onu üreten authorization server tarafından kullanılabilir. -* OIDC ID Token'ları sadece authorization flow’u tetikleyen istemci tarafından kullanılabilir. - -Bu bölümdeki bazı gereksinimlerin risk seviyesi, istemcinin gizli istemci mi yoksa açık istemci mi olduğuna göre değişiklik gösterebilir. Güçlü istemci kimlik doğrulaması, birçok saldırı vektörünü etkisiz hale getirebildiği için, L1 uygulamalarında bazı gereksinimler gizli istemci kullanıldığında esnetilebilir. - -## V10.1 Genel OAuth ve OIDC Güvenliği - -Bu bölüm, OAuth veya OIDC kullanan tüm uygulamalara uygulanabilen genel mimari gereksinimleri kapsar. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **10.1.1** | Token'ların yalnızca kesinlikle ihtiyaç duyan bileşenlere gönderildiği doğrulanmalıdır. Örneğin, tarayıcı tabanlı JavaScript uygulamaları için bir backend-for-frontend modeli kullanıldığında, access ve refresh token'lara yalnızca backend'in erişebilmesi gerekir. | 2 | -| **10.1.2** | Authorization server'dan gelen değerler (örneğin authorization code veya ID Token gibi) yalnızca aynı user agent oturumu ve işlemi tarafından başlatılmış bir yetkilendirme akışının sonucuysa kabul edildiği doğrulanmalıdır. Bu, client tarafından oluşturulan secret’ların 'proof key for code exchange' (PKCE) ‘code_verifier’, ‘state’ veya OIDC ‘nonce’ gibi tahmin edilemez, işleme özgü ve hem client’a hem de işlem başlatılan user agent oturumuna güvenli bir şekilde bağlı olmasını gerektirir. | 2 | - -## V10.2 OAuth İstemcisi - -Bu gereksinimler, OAuth istemci uygulamaları için sorumlulukları detaylandırır. Client örneğin bir web sunucusu backend’i (genellikle Backend For Frontend olarak hareket eden), bir backend servis entegrasyonu veya bir frontend Single Page Application (SPA, yani tarayıcı tabanlı uygulama) olabilir. - -Genel olarak backend istemciler gizli istemci olarak, frontend istemciler ise açık istemci olarak değerlendirilir. Ancak, son kullanıcı cihazında çalışan native uygulamalar, 'OAuth dynamic client registration' kullanıldığında gizli olarak kabul edilebilir. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **10.2.1** | Code flow kullanılıyorsa, OAuth client’ın token taleplerini tetikleyen CSRF saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Bu genellikle PKCE kullanılarak veya authorization isteğinde gönderilen ‘state’ parametresinin kontrolü ile sağlanır. | 2 | -| **10.2.2** | OAuth istemcisi birden fazla AS ile etkileşime girebiliyorsa, mix-up saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Örneğin, authorization server’ın 'iss' parametresini döndürmesi zorunlu kılınabilir ve bu parametrenin hem authorization yanıtında hem de token yanıtında doğrulanması gerekir. | 2 | -| **10.2.3** | OAuth istemcisinin authorization server’a yaptığı taleplerde yalnızca gerekli scope’ları (veya diğer yetkilendirme parametrelerini) talep ettiği doğrulanmalıdır. | 3 | - -## V10.3 OAuth Kaynak Sunucusu (RS) - -ASVS ve bu bölüm bağlamında resource server (RS) bir API’dir. Güvenli erişim sağlamak için RS şunları yapmalıdır: - -* Access token’ı, token formatı ve ilgili protokol spesifikasyonlarına göre doğrulamalıdır; örneğin JWT doğrulaması veya OAuth token introspection. -* Geçerliyse, access token’dan alınan bilgiler ve verilmiş izinlere göre yetkilendirme kararları uygulamalıdır. Örneğin, resource server’ın client’ın (RO adına hareket eden) istenen kaynağa erişme yetkisine sahip olduğunu doğrulaması gerekir. - -Bu nedenle burada listelenen gereksinimler, OAuth veya OIDC’ye özeldir ve token doğrulaması yapıldıktan sonra, token içeriğine dayalı yetkilendirme gerçekleştirilmeden önce uygulanmalıdır. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **10.3.1** | RS'nin yalnızca bu servisle kullanılmak üzere tasarlanmış access token’ları kabul ettiği doğrulanmalıdır (audience kontrolü). Audience bilgisi yapılandırılmış token’larda (örneğin JWT içindeki ‘aud’ claim’i) yer alabilir veya token introspection endpoint aracılığıyla kontrol edilebilir. | 2 | -| **10.3.2** | RS'nin, access token’dan gelen claim’lere dayanarak yetki devri tanımına uygun şekilde yetkilendirme kararları uyguladığı doğrulanmalıdır. ‘sub’, ‘scope’ ve ‘authorization_details’ gibi claim’ler varsa, bu kararın parçası olmalıdır. | 2 | -| **10.3.3** | Erişim kontrolü kararında, access token’dan (JWT veya ilgili token introspection yanıtı) benzersiz bir kullanıcının tanımlanması gerekiyorsa, RS'nin başka kullanıcılara devredilemeyecek claim’ler ile kullanıcıyı tanımladığı doğrulanmalıdır. Genellikle bu, ‘iss’ ve ‘sub’ claim’lerinin birlikte kullanılması anlamına gelir. | 2 | -| **10.3.4** | RS'nin belirli bir kimlik doğrulama gücü, yöntemi veya güncelliği (recentness) gerektirmesi durumunda, sunulan access token’ın bu kısıtlamaları karşıladığını doğruladığı, örneğin, OIDC ‘acr’, ‘amr’ ve ‘auth_time’ claim’leri kullanılarak doğrulanmalıdır. | 2 | -| **10.3.5** | RS'nin, (yetkisiz taraflarca) çalınmış veya tekrar edilen access token’ların kullanımını önlemek için sender-constrained access token’lar kullandığı doğrulanmalıdır. Bu, OAuth 2 için Mutual TLS veya OAuth 2 Demonstration of Proof of Possession (DPoP) ile sağlanabilir. | 3 | - -## V10.4 OAuth Yetkilendirme Sunucusu (AS) - -Bu gereksinimler, OAuth authorization server'ların (yetkilendirme sunucuları) ve OpenID Provider'ların sorumluluklarını detaylandırır. - -İstemci kimlik doğrulaması için 'self_signed_tls_client_auth' yöntemi, [RFC 8705](https://datatracker.ietf.org/doc/html/rfc8705) [böüm 2.2'de](https://datatracker.ietf.org/doc/html/rfc8705#name-self-signed-certificate-mut) belirtilen ön koşullarla birlikte kullanılabilir. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **10.4.1** | AS'nin, istemciye özel önceden kaydedilmiş URI’lerden oluşan bir allowlist kullanarak redirect URI’leri tam dize karşılaştırması ile doğruladığı doğrulanmalıdır. | 1 | -| **10.4.2** | AS'nin, "authorization response" içinde "authorization code" döndürdüğü durumlarda, bu kodun yalnızca bir kez kullanılabildiği doğrulanmalıdır. Daha önce access token vermek için kullanılmış bir authorization code ile yapılan ikinci geçerli token isteği reddedilmeli ve ilgili tüm token’lar iptal edilmelidir. | 1 | -| **10.4.3** | Authorization code’un kısa ömürlü olduğu doğrulanmalıdır. L1 ve L2 uygulamalar için maksimum yaşam süresi 10 dakika, L3 uygulamalar için 1 dakikadır. | 1 | -| **10.4.4** | Belirli bir istemci için AS'nin yalnızca o istemcinin ihtiyaç duyduğu grant türlerine izin verdiği doğrulanmalıdır. "Token" (Implicit flow) ve "password" (Resource Owner Password Credentials flow) grant türlerinin artık kullanılmaması gerekir. | 1 | -| **10.4.5** | AS'nin, açık istemciler için refresh token replay saldırılarını azalttığı doğrulanmalıdır. Tercihen sender-constrained refresh token’lar (DPoP veya mutual TLS ile certificate-bound access token’lar) kullanılmalıdır. L1 ve L2 uygulamalar için refresh token rotation kullanılabilir. Rotation kullanılıyorsa, AS refresh token’ı kullanım sonrası geçersiz kılmalı ve geçersiz bir refresh token sunulması durumunda o yetkilendirme ile ilişkili tüm refresh token’ları iptal etmelidir. | 1 | -| **10.4.6** | Code grant kullanılıyorsa, AS'nin authorization code interception saldırılarına karşı koruma sağladığı doğrulanmalıdır. Yetkilendirme isteğinde geçerli bir "code_challenge" değeri zorunlu olmalı ve "code_challenge_method" olarak "plain" kabul edilmemelidir. Token isteğinde ise "code_verifier" parametresi doğrulanmalıdır. | 2 | -| **10.4.7** | AS'nin, kimlik doğrulaması yapılmamış dinamik istemci kaydını desteklemesi durumunda, kötü niyetli istemci uygulamalarına karşı riskleri azalttığı doğrulanmalıdır. Kayıtlı URI’ler gibi client metadata’sı doğrulanmalı, kullanıcı onayı alınmalı ve güvenilmeyen bir client uygulamasıyla yapılan yetkilendirme isteği işlenmeden önce kullanıcı uyarılmalıdır. | 2 | -| **10.4.8** | Refresh token’ların, sliding expiration kullanılsa bile mutlak bir sona erme süresine sahip olduğu doğrulanmalıdır. | 2 | -| **10.4.9** | Yetkili bir kullanıcı tarafından AS kullanıcı arayüzü üzerinden refresh token’ların ve reference access token’ların iptal edilebildiği doğrulanmalıdır. | 2 | -| **10.4.10** | Gizli istemcilerin token istekleri, pushed authorization request (PAR) ve token iptal istekleri gibi server’a yapılan backchannel isteklerinde kimliğinin kontrol edildiği doğrulanmalıdır. | 2 | -| **10.4.11** | AS yapılandırmasının, OAuth istemcisine yalnızca gerekli scope’ları atadığı doğrulanmalıdır. | 2 | -| **10.4.12** | Belirli bir client için, authorization server’ın yalnızca client’ın ihtiyaç duyduğu 'response_mode' değerine izin verdiği doğrulanmalıdır. Örneğin, bu değer ya beklenenlerle karşılaştırılarak doğrulanmalı ya da PAR veya JAR kullanılmalıdır. | 3 | -| **10.4.13** | "Code" grant türünün daima pushed authorization request (PAR) ile birlikte kullanıldığı doğrulanmalıdır. | 3 | -| **10.4.14** | AS'nin yalnızca sender-constrained (Proof-of-Possession) access token’lar ürettiği doğrulanmalıdır. Bu, mutual TLS ile certificate-bound access token ya da DPoP ile DPoP-bound access token olabilir. | 3 | -| **10.4.15** | Sunucu taraflı istemciler için (kullanıcı cihazında çalışmayan), AS'nin "authorization_details" parametresinin istemci backend'i tarafından sağlandığını ve kullanıcı tarafından değiştirilmediğini doğruladığı, örneğin pushed authorization request (PAR) or JWT-secured Authorization Request (JAR) zorunlu kılınarak doğrulanmalıdır. | 3 | -| **10.4.16** | Bir istemci gizli ise, AS'nin güçlü istemci kimlik doğrulama yöntemlerini zorunlu kıldığı doğrulanmalıdır. Bu yöntemler, public-key cryptography’ye dayalı ve replay saldırılarına karşı dayanıklı olmalı, örneğin mutual TLS ("tls_client_auth", "self_signed_tls_client_auth") veya private key JWT ("private_key_jwt") gibi. | 3 | - -## V10.5 OIDC İstemcisi - -"OIDC relying party", bir OAuth istemcisi olarak davrandığı için "OAuth İstemcisi" bölümündeki gereksinimler burada da geçerlidir. - -“Kimlik Doğrulama” başlığındaki “Kimlik Sağlayıcısı ile Kimlik Doğrulama” bölümü de ilgili genel gereksinimleri içerir. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **10.5.1** | İstemcinin (relying party olarak) ID Token replay saldırılarını azalttığı doğrulanmalıdır. Örneğin, ID Token’daki 'nonce' claim’inin, OpenID Provider’a gönderilen kimlik doğrulama isteğindeki 'nonce' değeriyle eşleştiği doğrulanmalıdır. | 2 | -| **10.5.2** | İstemcinin kullanıcıyı ID Token claim’lerinden (genellikle, başka kullanıcılarla yeniden atanamayan 'sub' claim’i) benzersiz şekilde tanımladığı doğrulanmalıdır. | 2 | -| **10.5.3** | İstemcinin, kötü niyetli bir AS'nin başka bir AS'yi taklit etmesini AS metadata’sı üzerinden reddettiği doğrulanmalıdır. AS metadata’sındaki issuer URL’si, istemci tarafından beklenen önceden yapılandırılmış issuer URL’siyle tam olarak eşleşmiyorsa, metadata reddedilmelidir. | 2 | -| **10.5.4** | İstemcinin, ID Token’ın kendisi için (audience) kullanılması amaçlandığını doğruladığı doğrulanmalıdır. Bu, token’daki 'aud' claim’inin istemcinin 'client_id' değeriyle eşit olup olmadığının kontrol edilmesiyle yapılır. | 2 | -| **10.5.5** | OIDC back-channel logout kullanıldığında, relying party’nin "forced logout" ve "logout" akışında "cross-JWT confusion" gibi saldırılara karşı koruma sağladığı doğrulanmalıdır. Client, logout token’ın 'logout+jwt' türünde olduğunu, 'event' claim’inin doğru üyeye sahip olduğunu ve 'nonce' claim’i içermediğini doğrulamalıdır. Ayrıca token için kısa bir sona erme süresi (örneğin 2 dakika) önerilir. | 2 | - -## V10.6 OpenID Provider - -OpenID Provider’lar, OAuth AS olarak davrandığı için “OAuth Yetkilendirme Sunucusu” bölümündeki gereksinimler burada da geçerlidir. - -ID Token flow (code flow değil) kullanılıyorsa, access token üretilmez ve OAuth AS için geçerli olan birçok gereksinim uygulanamaz. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **10.6.1** | OpenID Provider’ın yalnızca 'code', 'ciba', 'id_token' veya 'id_token code' response mode değerlerine izin verdiği doğrulanmalıdır. 'code' değeri, 'id_token code' (OIDC Hybrid flow) yerine tercih edilmelidir. 'token' (Implicit flow) kullanılmamalıdır. | 2 | -| **10.6.2** | OpenID Provider’ın forced logout yoluyla yapılan hizmet reddi saldırılarını önlediği doğrulanmalıdır. Bu, son kullanıcıdan açık onay alınarak veya varsa logout isteğinde (relying party tarafından başlatılan) bulunan parametrelerin, örneğin 'id_token_hint', doğrulanmasıyla yapılabilir. | 2 | - -## V10.7 Onay (Consent) Yönetimi - -Bu gereksinimler, kullanıcı onayının AS tarafından doğrulanmasını kapsar. Uygun kullanıcı onayı olmadan, kötü niyetli bir aktör spoofing veya sosyal mühendislik yoluyla kullanıcının adına yetki elde edebilir. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **10.7.1** | AS'nin her yetkilendirme isteği için kullanıcının onayını aldığı doğrulanmalıdır. İstemcinin kimliği garanti altına alınamıyorsa, AS daima kullanıcıdan açıkça onay istemelidir. | 2 | -| **10.7.2** | AS'nin kullanıcıdan onay istediğinde, neye onay verildiğini açık ve yeterli şekilde gösterdiği doğrulanmalıdır. Uygun olduğunda bu bilgiler, istenen yetkilendirmelerin doğasını (genellikle scope, resource server, RAR gibi detaylara dayalı), yetkilendirilmiş uygulamanın kimliğini ve bu yetkilendirmelerin süresini içermelidir. | 2 | -| **10.7.3** | Kullanıcının, AS üzerinden verdiği onayları görüntüleyebildiği, değiştirebildiği ve iptal edebildiği doğrulanmalıdır. | 2 | - -## Referanslar - -OAuth ile ilgili daha fazla bilgi için: - -* [oauth.net](https://oauth.net/) -* [OWASP OAuth 2.0 Protocol Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/OAuth2_Cheat_Sheet.html) - -ASVS içindeki OAuth ile ilgili gereksinimler için, yayımlanmış ve taslak durumundaki aşağıdaki RFC'ler kullanılmaktadır: - -* [RFC6749 The OAuth 2.0 Authorization Framework](https://datatracker.ietf.org/doc/html/rfc6749) -* [RFC6750 The OAuth 2.0 Authorization Framework: Bearer Token Usage](https://datatracker.ietf.org/doc/html/rfc6750) -* [RFC6819 OAuth 2.0 Threat Model and Security Considerations](https://datatracker.ietf.org/doc/html/rfc6819) -* [RFC7636 Proof Key for Code Exchange by OAuth Public Clients](https://datatracker.ietf.org/doc/html/rfc7636) -* [RFC7591 OAuth 2.0 Dynamic Client Registration Protocol](https://datatracker.ietf.org/doc/html/rfc7591) -* [RFC8628 OAuth 2.0 Device Authorization Grant](https://datatracker.ietf.org/doc/html/rfc8628) -* [RFC8707 Resource Indicators for OAuth 2.0](https://datatracker.ietf.org/doc/html/rfc8707) -* [RFC9068 JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens](https://datatracker.ietf.org/doc/html/rfc9068) -* [RFC9126 OAuth 2.0 Pushed Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9126) -* [RFC9207 OAuth 2.0 Authorization Server Issuer Identification](https://datatracker.ietf.org/doc/html/rfc9207) -* [RFC9396 OAuth 2.0 Rich Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9396) -* [RFC9449 OAuth 2.0 Demonstrating Proof of Possession (DPoP)](https://datatracker.ietf.org/doc/html/rfc9449) -* [RFC9700 Best Current Practice for OAuth 2.0 Security](https://datatracker.ietf.org/doc/html/rfc9700) -* [draft OAuth 2.0 for Browser-Based Applications](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-browser-based-apps) -* [draft The OAuth 2.1 Authorization Framework](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-12) - -OpenID Connect ile ilgili daha fazla bilgi için: - -* [OpenID Connect Core 1.0](https://openid.net/specs/openid-connect-core-1_0.html) -* [FAPI 2.0 Security Profile](https://openid.net/specs/fapi-security-profile-2_0-final.html) diff --git a/5.0/tr/0x20-V11-Cryptography.md b/5.0/tr/0x20-V11-Cryptography.md deleted file mode 100644 index df3e8138fa..0000000000 --- a/5.0/tr/0x20-V11-Cryptography.md +++ /dev/null @@ -1,107 +0,0 @@ -# V11 Kriptografi - -## Kontrol Amacı - -Bu bölümün amacı, kriptografinin genel kullanımı için en iyi uygulamaları tanımlamak, kriptografik ilkelere dair temel bir anlayış kazandırmak ve daha dayanıklı ve modern yaklaşımlara yönelimi teşvik etmektir. Bu doğrultuda aşağıdakileri teşvik eder: - -* Güvenli şekilde hata veren, gelişen tehditlere uyum sağlayan ve geleceğe yönelik sağlam kriptografik sistemlerin uygulanması, -* Hem güvenli hem de sektörün en iyi uygulamalarıyla uyumlu kriptografik mekanizmaların kullanılması, -* Uygun erişim kontrolleri ve denetimle birlikte güvenli bir kriptografik anahtar yönetim sisteminin sürdürülmesi, -* Kriptografik ortamın düzenli olarak değerlendirilerek yeni risklerin analiz edilmesi ve algoritmaların buna göre uyarlanması, -* Uygulamanın yaşam döngüsü boyunca tüm kriptografik varlıkların keşfedildiğinden ve güvence altına alındığından emin olmak için kriptografi kullanım alanlarının belirlenmesi ve yönetilmesi. - -Genel ilkeleri ve en iyi uygulamaları özetlemenin yanı sıra, bu belge Ek C - Kriptografi Standartları bölümünde gereksinimlerle ilgili daha teknik bilgiler de sunar. Bu bölüm, "onaylı" kabul edilen algoritmaları ve modları içerir. - -Kriptografinin sır yönetimi ya da iletişim güvenliği gibi başka bir sorunu çözmek için kullanıldığı gereksinimler, bu standardın başka bölümlerinde yer almaktadır. - -## V11.1 Kriptografik Envanter ve Dokümantasyon - -Veri varlıklarını sınıflandırmalarına uygun şekilde korumak için uygulamaların güçlü bir kriptografik mimari ile tasarlanması gerekir. Her şeyi şifrelemek kaynak israfına, hiçbir şeyi şifrelememek ise hukuki ihlallere yol açar. Genellikle mimari tasarım, tasarım sprintleri veya mimari zirveler sırasında bir denge kurulmalıdır. Kriptografiyi "doğaçlama" yapmak veya sonradan eklemek, güvenli biçimde uygulamak için her zaman daha maliyetli olacaktır. - -Tüm kriptografik varlıkların düzenli olarak keşfedildiğinden, envantere alındığından ve değerlendirildiğinden emin olunması önemlidir. Bunun nasıl yapılacağı hakkında daha fazla bilgi için ekteki bölüme bakınız. - -Kriptografik sistemlerin kuantum bilgisayarların olası yükselişine karşı geleceğe yönelik olarak dayanıklı hale getirilmesi de kritik önemdedir. Post-Kuantum Kriptografi (PQC), kuantum bilgisayar saldırılarına karşı güvenli kalacak şekilde tasarlanmış kriptografik algoritmaları ifade eder; bu tür bilgisayarların, RSA ve eliptik eğri kriptografisi (ECC) gibi yaygın algoritmaları kırması beklenmektedir. - -Onaylı PQC ilkelikleri ve standartlarıyla ilgili güncel bilgiler için ekteki bölüme bakınız. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **11.1.1** | Kriptografik anahtarların yönetimi için belgelenmiş bir politika ve NIST SP 800-57 gibi bir anahtar yönetim standardını izleyen bir kriptografik anahtar yaşam döngüsü tanımlandığı doğrulanmalıdır. Bu, anahtarların aşırı miktarda paylaşılmadığını (örneğin, paylaşılan sırlar için ikiden fazla tarafla veya özel anahtarlar için birden fazla tarafla) garanti altına almalıdır. | 2 | -| **11.1.2** | Tüm kriptografik anahtarlar, algoritmalar ve uygulama tarafından kullanılan sertifikaları içeren bir kriptografik envanterin oluşturulduğu, sürdürüldüğü ve düzenli olarak güncellendiği doğrulanmalıdır. Bu envanter ayrıca, sistemde anahtarların nerede kullanılabileceğini ve kullanılamayacağını, ve hangi veri türlerinin bu anahtarlarla korunup korunamayacağını da belgelemelidir. | 2 | -| **11.1.3** | Sistem içerisinde şifreleme, özetleme ve imzalama işlemleri dahil olmak üzere kriptografi kullanımının tüm örneklerini tespit etmek için kriptografik keşif mekanizmalarının kullanıldığı doğrulanmalıdır. | 3 | -| **11.1.4** | Kriptografik bir envanterin sürdürüldüğü doğrulanmalıdır. Bu envanter, gelecekteki tehditlere karşı tepki verebilmek amacıyla post-kuantum kriptografiye geçiş yolunu belirten belgelenmiş bir plan içermelidir. | 3 | - -## V11.2 Güvenli Kriptografi Uygulaması - -Bu bölüm, bir uygulama için temel kriptografik algoritmaların seçimi, uygulanması ve sürekli yönetimine yönelik gereksinimleri tanımlar. Amaç, yalnızca sağlam, sektör tarafından kabul görmüş kriptografik ilkeliklerin, güncel standartlara (örneğin NIST, ISO/IEC) ve en iyi uygulamalara uygun biçimde kullanılmasını sağlamaktır. Kuruluşlar, her kriptografik bileşenin peer-review uygulanmış kanıtlar ve pratik güvenlik testlerine dayalı olarak seçildiğinden emin olmalıdır. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **11.2.1** | Kriptografik işlemler için sektör tarafından doğrulanmış uygulamaların (kütüphaneler ve donanım hızlandırmalı uygulamalar dahil) kullanıldığı doğrulanmalıdır. | 2 | -| **11.2.2** | Uygulamanın, rastgele sayı üreticileri, kimliği doğrulanmış şifreleme, MAC veya özetleme algoritmaları, anahtar uzunlukları, turlar, şifreler ve modların herhangi bir zamanda yeniden yapılandırılabilir, yükseltilebilir veya değiştirilebilir olacağı şekilde kripto çevikliği (crypto agility) ile tasarlandığı doğrulanmalıdır. Aynı şekilde, anahtarların ve parolaların değiştirilebilmesi ve verilerin yeniden şifrelenebilmesi mümkün olmalıdır. Bu, onaylanmış PQC şemalarının yüksek güvenlikli uygulamaları yaygın olarak kullanılabilir hale geldiğinde sorunsuz geçişe olanak tanır. | 2 | -| **11.2.3** | Tüm kriptografik ilkeliklerin, algoritma, anahtar boyutu ve yapılandırmaya göre minimum 128 bit güvenlik sağladığı doğrulanmalıdır. Örneğin, 256-bit ECC anahtarı yaklaşık 128 bit güvenlik sağlarken, RSA için aynı güvenliği elde etmek 3072-bit anahtar gerektirir. | 2 | -| **11.2.4** | Tüm kriptografik işlemlerin sabit süreli (constant-time) olduğu, karşılaştırmalarda, hesaplamalarda veya geri dönüşlerde kısa devre (short-circuit) işlemleri yapılmadığı doğrulanmalıdır; bu, bilgi sızıntısını önlemek için gereklidir. | 3 | -| **11.2.5** | Tüm kriptografik modüllerin güvenli şekilde hata verdiği ve hataların, padding oracle saldırıları gibi zafiyetleri mümkün kılmayacak şekilde ele alındığı doğrulanmalıdır. | 3 | - -## V11.3 Şifreleme Algoritmaları - -AES ve CHACHA20 üzerine kurulu kimliği doğrulanmış şifreleme algoritmaları, modern kriptografik uygulamaların temelini oluşturur. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **11.3.1** | Güvensiz blok modlarının (örneğin, ECB) ve zayıf doldurma (padding) şemalarının (örneğin, PKCS#1 v1.5) kullanılmadığı doğrulanmalıdır. | 1 | -| **11.3.2** | Yalnızca AES ile GCM gibi onaylı şifreleme algoritmalarının ve modlarının kullanıldığı doğrulanmalıdır. | 1 | -| **11.3.3** | Şifrelenmiş verilerin yetkisiz değişikliklere karşı korunduğu doğrulanmalıdır. Tercihen bu koruma, onaylı bir kimliği doğrulanmış şifreleme yöntemi kullanılarak ya da onaylı bir şifreleme yöntemi ile onaylı bir MAC algoritmasının kombinasyonu ile sağlanmalıdır. | 2 | -| **11.3.4** | Sayılar, başlatma vektörleri (IV) ve diğer tek kullanımlık değerlerin, aynı şifreleme anahtarı ve veri öğesi çifti için birden fazla kez kullanılmadığı doğrulanmalıdır. Oluşturma yöntemi kullanılan algoritmaya uygun olmalıdır. | 3 | -| **11.3.5** | Şifreleme algoritması ve MAC algoritması kombinasyonlarının "encrypt-then-MAC" modunda çalıştığı doğrulanmalıdır. | 3 | - -## V11.4 Hashing ve Hash Tabanlı Fonksiyonlar - -Kriptografik hash'ler, dijital imzalar, HMAC, anahtar türetme fonksiyonları (KDF), rastgele bit üretimi ve parola saklama gibi çok çeşitli kriptografik protokollerde kullanılır. Kriptografik sistemin güvenliği, kullanılan hash fonksiyonlarının güvenliği ile doğrudan ilişkilidir. Bu bölüm, kriptografik işlemlerde güvenli hash fonksiyonlarının kullanımına dair gereksinimleri özetler. - -Parola saklama ve kriptografi ile ilgili ek için [OWASP Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#password-hashing-algorithms) belgesi de fayda ve rehberlik sağlar. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **11.4.1** | Dijital imzalar, HMAC, KDF ve rastgele bit üretimi gibi genel kriptografik kullanım senaryolarında yalnızca onaylı hash fonksiyonlarının kullanıldığı doğrulanmalıdır. MD5 gibi yasaklı hash fonksiyonları hiçbir kriptografik amaçla kullanılmamalıdır. | 1 | -| **11.4.2** | Parolaların, onaylı, hesaplama açısından yoğun ve mevcut rehberliğe göre yapılandırılmış bir anahtar türetme fonksiyonu (diğer adıyla parola hash'leme fonksiyonu) kullanılarak saklandığı doğrulanmalıdır. Ayarlar, güvenlik ve performans dengesini sağlayarak kaba kuvvet saldırılarını zorlaştırmalıdır. | 2 | -| **11.4.3** | Dijital imzalarda kullanılan hash fonksiyonlarının, veri bütünlüğü ve kimlik doğrulama amacıyla kullanıldığında çakışmaya karşı dayanıklı ve yeterli bit uzunluğuna sahip olduğu doğrulanmalıdır. Çakışma dayanıklılığı gerekiyorsa çıktı uzunluğu en az 256 bit olmalıdır. Sadece ikinci ön-görüntü (2nd pre-iamge) saldırılarına karşı dayanıklılık gerekiyorsa çıktı uzunluğu en az 128 bit olmalıdır. | 2 | -| **11.4.4** | Parolalardan gizli anahtarlar türetilirken, onaylı anahtar türetme fonksiyonlarının anahtar uzatma (key stretching) parametreleriyle birlikte kullanıldığı doğrulanmalıdır. Bu parametreler, kaba kuvvet saldırılarını önleyecek şekilde güvenlik ve performans dengesine sahip olmalıdır. | 2 | - -## V11.5 Rastgele Değerler - -Kriptografik olarak güvenli sözde rastgele sayı üretimini (Cryptographically secure Pseudo-random Number Generation - CSPRNG), doğru şekilde uygulamak son derece zordur. Genellikle, bir sistemdeki iyi entropi kaynakları aşırı kullanıldığında hızla tükenir. Düşük rastgelelik seviyesine sahip kaynaklar ise tahmin edilebilir anahtarlara ve sırların ortaya çıkmasına yol açabilir. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **11.5.1** | Tahmin edilemez olması amaçlanan tüm rastgele sayıların ve dizelerin, CSPRNG ile oluşturulduğu ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. UUID'lerin bu koşulu dikkate almadığını unutmayın. | 2 | -| **11.5.2** | Kullanılan rastgele sayı üretim mekanizmasının, yoğun talep altında dahi güvenli çalışacak şekilde tasarlandığı doğrulanmalıdır. | 3 | - -## V11.6 Açık Anahtar (Public Key) Kriptografisi - -Birden fazla taraf arasında ortak bir sır paylaşımının mümkün olmadığı ya da arzu edilmediği durumlarda açık anahtar kriptografisi kullanılır. - -Bu bağlamda, modern tehditlere karşı sistemin güvenliğini sağlamak için Diffie-Hellman ve Eliptik Eğri Diffie-Hellman (ECDH) gibi onaylı anahtar değişim mekanizmalarına ihtiyaç vardır. “Güvenli İletişim” bölümü, TLS için gereksinimleri sağlar; bu bölümdeki gereksinimler ise TLS dışındaki açık anahtar kriptografisi kullanım durumlarına yöneliktir. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **11.6.1** | Anahtar üretimi, tohumlama (seeding) ve dijital imza üretimi ve doğrulama için yalnızca onaylı kriptografik algoritmalar ve çalışma modlarının kullanıldığı doğrulanmalıdır. Anahtar üretim algoritmaları, bilinen saldırılara karşı savunmasız anahtarlar üretmemelidir. Örneğin, Fermat çarpanlama yöntemine karşı savunmasız RSA anahtarları oluşturulmamalıdır. | 2 | -| **11.6.2** | Anahtar değişimi için yalnızca onaylı kriptografik algoritmaların kullanıldığı doğrulanmalıdır (örneğin Diffie-Hellman). Kullanılan parametrelerin güvenli olması gerektiğine dikkat edilmelidir. Bu, anahtar kurulum sürecine yönelik saldırıları önleyecek ve araya girme (adversary-in-the-middle) ya da kriptografik kırılmaları engelleyecektir. | 3 | - -## V11.7 Kullanım Halindeki Verilerin Kriptografisi - -Veri işlenirken korunması çok önemlidir. Tam bellek şifreleme, veri iletiminde şifreleme ve verilerin kullanımdan hemen sonra mümkün olan en kısa sürede şifrelenmesi gibi teknikler önerilir. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **11.7.1** | Hassas verilerin kullanım sırasında korunmasını sağlamak amacıyla, yetkisiz kullanıcıların veya süreçlerin bu verilere erişmesini engelleyen tam bellek şifrelemesinin kullanıldığı doğrulanmalıdır. | 3 | -| **11.7.2** | Veri asgariyetinin sağlandığı, yani işleme sırasında mümkün olan en az miktarda verinin ortaya çıktığı ve verilerin kullanımdan hemen sonra veya mümkün olan en kısa sürede şifrelendiği doğrulanmalıdır. | 3 | - -## Referanslar - -Daha fazla bilgi için: - -* [OWASP Web Security Testing Guide: Testing for Weak Cryptography](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography) -* [OWASP Cryptographic Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html) -* [FIPS 140-3](https://csrc.nist.gov/pubs/fips/140-3/final) -* [NIST SP 800-57](https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final) diff --git a/5.0/tr/0x21-V12-Secure-Communication.md b/5.0/tr/0x21-V12-Secure-Communication.md deleted file mode 100644 index 859efc45ce..0000000000 --- a/5.0/tr/0x21-V12-Secure-Communication.md +++ /dev/null @@ -1,57 +0,0 @@ -# V12 Güvenli İletişim - -## Kontrol Amacı - -Bu bölüm, hem bir son kullanıcı istemcisi ile backend hizmeti arasında hem de iç sistemler ile backend hizmetleri arasındaki veri iletimini korumak için uygulanması gereken özel mekanizmalara ilişkin gereksinimleri içerir. - -Bu bölümde öne çıkan genel kavramlar şunlardır: - -* İletişimlerin dış sistemlerle şifreli, ideal olarak iç sistemlerde de şifreli olması. -* Şifreleme mekanizmalarının, tercih edilen algoritmalar ve şifreler dahil olmak üzere en güncel rehberliklere göre yapılandırılması. -* Yetkisiz taraflarca iletişimin engellenmediğinden emin olmak amacıyla imzalı sertifikaların kullanılması. - -Genel ilkelere ve en iyi uygulamalara ek olarak, ASVS ayrıca Ek C - Kriptografi Standartları bölümünde kriptografik güç hakkında daha derin teknik bilgiler sunar. - -## V12.1 Genel TLS Güvenlik Rehberi - -Bu bölüm, TLS iletişimini güvenli hale getirmek için başlangıç seviyesinde rehberlik sağlar. TLS yapılandırmasının güncel araçlarla düzenli olarak gözden geçirilmesi gerekir. - -Wildcard TLS sertifikalarının kullanımı doğası gereği güvensiz değildir, ancak aynı sertifikanın üretim, hazırlık (staging), geliştirme ve test gibi tüm ortamlarda kullanılması halinde sertifika güvenliğinin tehlikeye girmesi, bu ortamlarda çalışan uygulamaların da güvenlik postürünü olumsuz etkileyebilir. Mümkünse her ortam için ayrı TLS sertifikalarının kullanılması, bu sertifikaların güvenli bir şekilde yönetilmesi ve korunması gereklidir. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **12.1.1** | Yalnızca TLS protokolünün en güncel ve önerilen sürümlerinin (örneğin TLS 1.2 ve TLS 1.3) etkinleştirildiği ve en son sürümün varsayılan olarak tercih edildiği doğrulanmalıdır. | 1 | -| **12.1.2** | Yalnızca önerilen şifre takımlarının (cipher suite) etkinleştirildiği ve en güçlü şifre takımlarının tercih edildiği doğrulanmalıdır. Seviye 3 (L3) uygulamalar yalnızca ileri gizlilik (forward secrecy) sağlayan şifre takımlarını desteklemelidir. | 2 | -| **12.1.3** | Uygulamanın, mTLS istemci sertifikalarını kimlik doğrulama veya yetkilendirme amacıyla kullanmadan önce bu sertifikaların güvendiği sertifikalar arasında olduğunu doğruladığı kontrol edilmelidir. | 2 | -| **12.1.4** | Online Certificate Status Protocol (OCSP) Stapling gibi geçerli bir sertifika iptal kontrolü yönteminin etkinleştirildiği ve yapılandırıldığı doğrulanmalıdır. | 3 | -| **12.1.5** | TLS el sıkışma (handshake) sürecinde Server Name Indication (SNI) gibi hassas meta verilerin ifşa edilmesini önlemek için, uygulamanın TLS yapılandırmasında Encrypted Client Hello (ECH) özelliğinin etkinleştirildiği doğrulanmalıdır. | 3 | - -## V12.2 Dışa Açık Hizmetlerle HTTPS İletişimi - -Uygulamanın dışa açtığı tüm HTTP trafiğinin şifreli olarak iletildiğinden ve bu iletişimlerde herkese açık olarak güvenilen sertifikaların kullanıldığından emin olunmalıdır. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **12.2.1** | İstemci ile dışa açık, HTTP tabanlı hizmetler arasındaki tüm bağlantılarda TLS kullanıldığı ve bu bağlantıların güvensiz ya da şifrelenmemiş iletişime geri dönmediği doğrulanmalıdır. | 1 | -| **12.2.2** | Dışa açık hizmetlerin herkese açık olarak güvenilen TLS sertifikaları kullandığı doğrulanmalıdır. | 1 | - -## V12.3 Genel Servisler Arası İletişim Güvenliği - -Sunucu iletişimleri (hem iç hem dış) sadece HTTP ile sınırlı değildir. Diğer sistemlerle olan bağlantıların da güvenli olması gerekir ve ideal olarak TLS kullanılmalıdır. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **12.3.1** | Uygulamaya gelen ve uygulamadan çıkan tüm bağlantılarda izleme sistemleri, yönetim araçları, uzaktan erişim ve SSH, ara yazılımlar, veritabanları, ana sistemler (mainframe), iş ortağı sistemleri ya da dış API'ler dahil olmak üzere TLS gibi şifreli bir protokolün kullanıldığı ve güvensiz ya da şifrelenmemiş protokollere geri dönülmediği doğrulanmalıdır. | 2 | -| **12.3.2** | TLS istemcilerinin bir TLS sunucusu ile iletişime geçmeden önce alınan sertifikaları doğruladığı kontrol edilmelidir. | 2 | -| **12.3.3** | Uygulama içindeki HTTP tabanlı iç hizmetler arasında gerçekleşen tüm bağlantılarda TLS ya da uygun başka bir aktarım şifreleme mekanizmasının kullanıldığı ve güvensiz ya da şifrelenmemiş iletişime geri dönülmediği doğrulanmalıdır. | 2 | -| **12.3.4** | İç hizmetler arasındaki TLS bağlantılarında güvenilir sertifikaların kullanıldığı doğrulanmalıdır. İç sistemlerde oluşturulmuş ya da kendinden imzalı (self-signed) sertifikalar kullanılıyorsa, bu sertifikalara güvenen hizmetlerin yalnızca belirli dahili sertifika otoritelerine (CA) ve belirli kendinden imzalı sertifikalara güvenecek şekilde yapılandırıldıkları doğrulanmalıdır. | 2 | -| **12.3.5** | Sistem içindeki hizmetlerin birbiriyle iletişim kurarken her bir uç noktanın kimliğini doğrulamak için güçlü kimlik doğrulama yöntemlerinin kullanıldığı doğrulanmalıdır. Bu yöntemler arasında, açık anahtar altyapısı (public-key infrastructure) kullanan ve tekrar oynatma saldırılarına karşı dayanıklı olan TLS istemci kimlik doğrulaması gibi yöntemler yer almalıdır. Mikroservis mimarilerinde, sertifika yönetimini basitleştirmek ve güvenliği artırmak amacıyla bir servis ağı (service mesh) kullanılması değerlendirilmelidir. | 3 | - -## Referanslar - -Daha fazla bilgi için: - -* [OWASP - Transport Layer Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html) -* [Mozilla's Server Side TLS configuration guide](https://wiki.mozilla.org/Security/Server_Side_TLS) -* [Mozilla's tool to generate known good TLS configurations](https://ssl-config.mozilla.org/). -* [O-Saft - OWASP Project to validate TLS configuration](https://owasp.org/www-project-o-saft/) diff --git a/5.0/tr/0x22-V13-Configuration.md b/5.0/tr/0x22-V13-Configuration.md deleted file mode 100644 index 87f0ba8a7b..0000000000 --- a/5.0/tr/0x22-V13-Configuration.md +++ /dev/null @@ -1,68 +0,0 @@ -# V13 Konfigürasyon - -## Kontrol Amacı - -Uygulamanın varsayılan konfigürasyonu, İnternet üzerinde güvenli kullanım için uygun olmalıdır. - -Bu bölüm, geliştirme, derleme ve dağıtım aşamalarında uygulanması gereken çeşitli konfigürasyonlara dair rehberlik sağlar. - -Ele alınan konular veri sızıntısını önlemek, bileşenler arası iletişimi güvenli şekilde yönetmek ve gizli verileri korumayı içerir. - -## V13.1 Konfigürasyon Dokümantasyonu - -Bu bölüm, uygulamanın iç ve dış hizmetlerle nasıl iletişim kurduğunu açıklayan dokümantasyon gereksinimlerini ve hizmetlerin erişilemez olması durumunda erişilebilirliğin kaybını önlemek için kullanılabilecek teknikleri tanımlar. Ayrıca, gizli verilerle ilgili belgeleri de kapsar. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **13.1.1** | Uygulamanın tüm iletişim ihtiyaçlarının dokümante edildiği doğrulanmalıdır. Buna, uygulamanın bağımlı olduğu dış hizmetler ve son kullanıcının uygulamanın bağlantı kurmasını sağlayabileceği dış konumlar da dahil olmalıdır. | 2 | -| **13.1.2** | Uygulamanın kullandığı her bir hizmet için, dokümantasyonda eşzamanlı bağlantı sayısı (örn. bağlantı havuzu limitleri) ve bu sınır aşıldığında uygulamanın davranışı, geri dönüş veya kurtarma mekanizmaları da dahil olmak üzere hizmet reddi koşullarını önlemek için tanımlandığı doğrulanmalıdır. | 3 | -| **13.1.3** | Uygulamanın, kullandığı her bir dış sistem veya hizmet (örn. veritabanları, dosya tanıtıcıları, iş parçacıkları, HTTP bağlantıları) için kaynak yönetimi stratejilerini tanımladığı doğrulanmalıdır. Bu stratejiler, kaynak serbest bırakma prosedürlerini, zaman aşımı ayarlarını, hata durumlarını ve tekrar deneme mantığı uygulanmışsa sınırları, gecikmeleri ve geri çekilme (back-off) algoritmalarını içermelidir. Senkron HTTP istek–yanıt işlemleri için kısa zaman aşımı süreleri zorunlu tutulmalı ve tekrar eden denemeler devre dışı bırakılmalı ya da sıkı şekilde sınırlandırılmalıdır. | 3 | -| **13.1.4** | Uygulamanın, güvenlik açısından kritik olan gizli verileri tanımladığı ve kuruluşun tehdit modeli ve iş ihtiyaçlarına göre bu verilerin döndürülme (rotation) zamanlamasının belgelendiği doğrulanmalıdır. | 3 | - -## V13.2 Backend İletişim Konfigürasyonu - -Uygulamalar, API'ler, veritabanları veya diğer bileşenler gibi çok sayıda hizmetle etkileşime girer. Bu hizmetler, uygulamaya dâhil olarak kabul edilebilir ancak uygulamanın standart erişim kontrol mekanizmalarına dahil olmayabilir veya tamamen dış sistemler olabilir. Her iki durumda da, uygulamanın bu bileşenlerle güvenli şekilde iletişim kuracak şekilde yapılandırılması ve gerekiyorsa bu yapılandırmanın korunması gereklidir. - -Not: "Güvenli İletişim" bölümü, aktarım sırasında şifreleme için rehberlik sağlar. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **13.2.1** | Uygulamanın, standart kullanıcı oturum mekanizmasını desteklemeyen backend bileşenleri (örneğin API'ler, ara katmanlar, veri katmanları) arasında gerçekleşen iletişimlerin kimlik doğrulamasıyla korunduğu doğrulanmalıdır. Kimlik doğrulama; bireysel hizmet hesapları, kısa ömürlü token'lar ya da sertifika tabanlı kimlik doğrulama ile yapılmalıdır ve parola, API anahtarı ya da ayrıcalıklı erişime sahip paylaşımlı hesaplar gibi sabit kimlik bilgileri kullanılmamalıdır. | 2 | -| **13.2.2** | Uygulamanın backend bileşenleri arasında (yerel hizmetler, işletim sistemi hizmetleri, API'ler, ara katmanlar ve veri katmanları dahil) gerçekleştirilen iletişimlerin, yalnızca gerekli en az ayrıcalığa sahip hesaplarla yapıldığı doğrulanmalıdır. | 2 | -| **13.2.3** | Bir hizmet kimlik doğrulaması için bir kimlik bilgisi kullanılması gerekiyorsa, bu kimlik bilgisinin varsayılan bir değer (örneğin root/root veya admin/admin) olmadığının doğrulanması gereklidir. | 2 | -| **13.2.4** | Uygulamanın iletişim kurmasına izin verilen dış kaynaklar ya da sistemlerin, bir allowlist (izinli liste) ile tanımlandığı doğrulanmalıdır. Bu liste, uygulama katmanında, web sunucusunda, güvenlik duvarında veya farklı katmanların birleşiminde uygulanabilir. | 2 | -| **13.2.5** | Web veya uygulama sunucusunun, dış sistemlere veri veya dosya gönderimi veya yüklemesi yaparken sadece belirli kaynaklara izin verecek şekilde allowlist ile yapılandırıldığı doğrulanmalıdır. | 2 | -| **13.2.6** | Uygulamanın farklı hizmetlere bağlantı kurduğu durumlarda, bu bağlantılar için belgelenmiş yapılandırmaları (örn. maksimum eşzamanlı bağlantı, bağlantı limiti aşıldığında davranış, zaman aşımı, tekrar deneme stratejileri) takip ettiğinin doğrulanması gereklidir. | 3 | - -## V13.3 Gizli Bilgi Yönetimi - -Gizli bilgilerin (secret) yönetimi, uygulama tarafından kullanılan verilerin korunması açısından temel bir konfigürasyon görevidir. Kriptografi ile ilgili özel gereksinimler "Kriptografi" bölümünde yer almakla birlikte bu bölüm, gizli verilerin yönetimi ve işlenmesine odaklanır. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **13.3.1** | Parolalar, anahtar materyalleri, veritabanı ve üçüncü parti sistemlerle entegrasyon bilgileri, zaman tabanlı token'lar için tohum (seed) bilgileri, dahili gizli veriler ve API anahtarları gibi backend sırlarının güvenli bir şekilde oluşturulması, saklanması, erişim denetiminin sağlanması ve imha edilmesi için bir gizli bilgi yönetim çözümünün (örneğin key vault) kullanıldığı doğrulanmalıdır. Bu gizli bilgiler uygulama kaynak koduna dahil edilmemeli ve yapı çıktılarında yer almamalıdır. Seviye 3 uygulamalar için donanım destekli bir çözüm (örneğin HSM) gereklidir. | 2 | -| **13.3.2** | Gizli bilgilere erişimin en az ayrıcalık prensibine uygun şekilde yapılandırıldığı doğrulanmalıdır. | 2 | -| **13.3.3** | Tüm kriptografik işlemlerin, anahtar materyallerinin güvenli bir şekilde yönetilmesi ve dışarıya sızmasının engellenmesi amacıyla, izole edilmiş bir güvenlik modülü (örneğin vault ya da donanım güvenlik modülü) aracılığıyla gerçekleştirildiği doğrulanmalıdır. | 3 | -| **13.3.4** | Uygulamanın belgelerinde belirtildiği şekilde gizli bilgilerin süresinin dolacak şekilde yapılandırıldığı ve düzenli olarak döndürüldüğü doğrulanmalıdır. | 3 | - -## V13.4 İstenmeyen Bilgi Sızıntısı - -Üretim yapılandırmaları, gereksiz veri ifşasını önleyecek şekilde sertleştirilmiş (hardened) olmalıdır. Bu tür güvenlik açıkları genellikle tek başına büyük risk olarak değerlendirilmese de diğer açıklıklarla zincirlenerek sömürülebilir. Varsayılan olarak bu açıklıkların bulunmaması, uygulamaya yapılacak saldırıların zorluk seviyesini artırır. - -Örneğin, sunucu taraflı bileşenlerin sürüm bilgisini gizlemek, tüm bileşenlerin yamanması ihtiyacını ortadan kaldırmaz; dizin listelemeyi devre dışı bırakmak, yetkilendirme kontrolleri ihtiyacını ya da dosyaların herkese açık klasörden uzak tutulması gerekliliğini ortadan kaldırmaz. Ancak bunlar, saldırıların başarıya ulaşma olasılığını azaltır. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **13.4.1** | Uygulamanın .git veya .svn klasörleri gibi kaynak kontrolüyle ilgili metadata içermeyecek şekilde deploy edildiğini ya da bu klasörlerin hem dış erişime hem de uygulama erişimine kapalı olduğu doğrulanmalıdır. | 1 | -| **13.4.2** | Tüm bileşenler için üretim ortamlarında hata ayıklama (debug) modlarının devre dışı bırakıldığı doğrulanmalıdır. | 2 | -| **13.4.3** | Web sunucularının, açık şekilde istenmediği sürece dizin listelemesi (directory listing) özelliğini istemcilere sunmadığı doğrulanmalıdır. | 2 | -| **13.4.4** | HTTP TRACE metodunun üretim ortamlarında desteklenmediği, böylece potansiyel bilgi sızıntılarının önlendiği doğrulanmalıdır. | 2 | -| **13.4.5** | Belgeler (örneğin dahili API belgeleri) ve izleme uç noktalarının (monitoring endpoints) yalnızca açıkça belirtildiği durumlarda erişilebilir olduğu doğrulanmalıdır. | 2 | -| **13.4.6** | Uygulamanın arka uç bileşenlerinin ayrıntılı sürüm bilgilerini ifşa etmediği doğrulanmalıdır. | 3 | -| **13.4.7** | Web katmanının yalnızca belirli dosya uzantılarına sahip dosyaları sunacak şekilde yapılandırıldığı, bu sayede istem dışı bilgi, yapılandırma ya da kaynak kod sızıntılarının önlendiği doğrulanmalıdır. | 3 | - -## Referanslar - -Daha fazla bilgi için: - -* [OWASP Web Security Testing Guide: Configuration and Deployment Management Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing) diff --git a/5.0/tr/0x23-V14-Data-Protection.md b/5.0/tr/0x23-V14-Data-Protection.md deleted file mode 100644 index 7d88816343..0000000000 --- a/5.0/tr/0x23-V14-Data-Protection.md +++ /dev/null @@ -1,60 +0,0 @@ -# V14 Veri Koruma - -## Kontrol Amacı - -Uygulamalar, tüm kullanım senaryolarını ve kullanıcı davranışlarını önceden öngöremez. Bu nedenle, istemci cihazlarda hassas verilere yetkisiz erişimi sınırlamak için kontroller uygulanmalıdır. - -Bu bölüm, hangi verilerin korunması gerektiğini tanımlama, nasıl korunacağını belirleme ve uygulanması gereken özel mekanizmalar ile kaçınılması gereken hatalarla ilgili gereksinimleri içerir. - -Veri koruma ile ilgili bir diğer husus da toplu veri çıkarımı, değiştirme veya aşırı kullanımdır. Her sistemin gereksinimleri muhtemelen çok farklı olacaktır; bu nedenle, neyin "anormal" olduğunun belirlenmesi tehdit modeli ve iş riski dikkate alınarak yapılmalıdır. ASVS perspektifinden bakıldığında, bu tür sorunların tespiti "Güvenlik Günlüğü Tutma ve Hata Yönetimi" bölümünde, sınırlamaların belirlenmesi ise "Doğrulama ve İş Mantığı" bölümünde ele alınmaktadır. - -## V14.1 Veri Koruma Dokümantasyonu - -Verilerin korunabilmesi için temel ön koşullardan biri, hangi verilerin hassas olarak kabul edilmesi gerektiğinin kategorize edilmesidir. Hassasiyetin birkaç farklı düzeyi olabilir ve her düzey için uygulanması gereken kontroller farklılık gösterebilir. - -Verilerin saklanması, kullanımı ve iletimi konusunda uygulamaların uyması gereken çeşitli gizlilik düzenlemeleri ve yasalar bulunmaktadır. Bu bölüm artık bu tür yasal düzenlemeleri çoğaltmaya çalışmamakta, bunun yerine hassas verileri korumaya yönelik temel teknik hususlara odaklanmaktadır. Lütfen yerel yasa ve düzenlemelere başvurun ve gerektiğinde nitelikli bir gizlilik uzmanı veya avukata danışın. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **14.1.1** | Uygulama tarafından oluşturulan ve işlenen tüm hassas verilerin tanımlanıp, koruma seviyelerine göre sınıflandırıldığından emin olun. Bu, yalnızca kodlanmış (örneğin Base64 stringleri ya da JWT içindeki düz metin yükler gibi) ve bu nedenle kolayca çözülebilir verileri de içermelidir. Koruma seviyeleri, uygulamanın uymakla yükümlü olduğu veri koruma ve gizlilik düzenlemeleri ile standartlarını dikkate almalıdır. | 2 | -| **14.1.2** | Tüm hassas veri koruma seviyeleri için belgelenmiş bir koruma gereksinimleri seti tanımlandığından emin olun. Bu gereksinimler genel şifreleme, bütünlük doğrulama, saklama süresi, verinin nasıl günlüğe kaydedileceği, günlüklerdeki hassas verilere erişim kontrolleri, veritabanı düzeyinde şifreleme, gizlilik ve gizliliği artırıcı teknolojiler ile diğer gizlilik gereksinimlerini kapsamalıdır. | 2 | - -## V14.2 Genel Veri Koruması - -Bu bölüm, veri korumaya yönelik çeşitli pratik gereksinimleri içerir. Bunların çoğu, istenmeyen veri sızıntısı gibi belirli konulara yöneliktir. Ancak aynı zamanda her bir veri öğesi için gerekli olan koruma düzeyine göre koruma kontrollerinin uygulanmasına ilişkin genel bir gereksinim de bulunmaktadır. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **14.2.1** | Hassas verilerin yalnızca HTTP message body veya header alanlarında sunucuya gönderildiği ve URL ile sorgu parametrelerinin, API anahtarı veya session token’ı gibi hassas bilgiler içermediği doğrulanmalıdır. | 1 | -| **14.2.2** | Hassas verilerin, yük dengeleyiciler ve uygulama önbellekleri gibi sunucu bileşenlerinde önbelleğe alınmasının engellendiği veya kullanım sonrası bu verilerin güvenli biçimde temizlendiği doğrulanmalıdır. | 2 | -| **14.2.3** | Uygulama kontrolü dışında veri toplanmasını engellemek için, tanımlanmış hassas verilerin, kullanıcı izleyicileri gibi güvensiz taraflara gönderilmediği doğrulanmalıdır. | 2 | -| **14.2.4** | Hassas verilere yönelik şifreleme, bütünlük doğrulama, veri saklama, loglama yöntemi, loglardaki erişim kontrolleri, gizlilik teknolojileri gibi kontrollerin, söz konusu verinin belgelenmiş koruma seviyesinde tanımlandığı şekilde uygulandığı doğrulanmalıdır. | 2 | -| **14.2.5** | Önbellekleme mekanizmalarının yalnızca belirli içerik türüne sahip yanıtları önbelleğe alacak şekilde yapılandırıldığı ve hassas, dinamik içeriklerin önbelleğe alınmadığı doğrulanmalıdır. Web sunucusu, mevcut olmayan bir dosya talebinde geçerli ama farklı bir dosya döndürmek yerine 404 veya 302 cevabı vermelidir. Bu, Web Cache Deception saldırılarını önlemeye yardımcı olur. | 3 | -| **14.2.6** | Uygulamanın yalnızca işlevsellik için gerekli olan asgari hassas veriyi döndürdüğü doğrulanmalıdır. Örneğin, kredi kartı numarasının yalnızca bazı rakamlarının döndürülmesi; tam numaranın döndürülmesi gerekiyorsa, kullanıcı arayüzünde gizlenmiş (maskelenmiş) şekilde sunulması gerekir, aksi kullanıcı özel olarak görüntülemek istemedikçe gösterilmemelidir. | 3 | -| **14.2.7** | Hassas bilgilerin, veri saklama sınıflandırmasına tabi tutulduğu, geçerliliğini yitirmiş veya artık gerekli olmayan verilerin belirlenmiş bir zaman çizelgesiyle ya da gerektiğinde otomatik olarak silindiği doğrulanmalıdır. | 3 | -| **14.2.8** | Kullanıcı tarafından yüklenen dosyaların meta verilerinden hassas bilgilerin çıkarıldığı veya bu bilgilerin yalnızca kullanıcıdan açık onay alındığında saklandığı doğrulanmalıdır. | 3 | - -## V14.3 İstemci Tarafı Veri Koruması - -Bu bölüm, uygulamanın istemci veya kullanıcı aracısı tarafında verilerin belirli yollarla sızmasını önlemeye yönelik gereksinimleri içerir. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **14.3.1** | Kimliği doğrulanmış verilerin, istemci veya oturum sonlandığında istemci depolamasından (örneğin tarayıcı DOM’undan) temizlendiği doğrulanmalıdır. 'Clear-Site-Data' HTTP response header bu konuda yardımcı olabilir ancak istemci tarafı, sunucu bağlantısı mevcut olmadığında da temizlik işlemini yapabiliyor olmalıdır. | 1 | -| **14.3.2** | Uygulamanın, tarayıcılarda hassas verilerin önbelleğe alınmasını önlemek amacıyla yeterli anti-önbellekleme HTTP response header (örneğin Cache-Control: no-store) ayarladığı doğrulanmalıdır. | 2 | -| **14.3.3** | Tarayıcıda depolanan verilerin (örneğin localStorage, sessionStorage, IndexedDB veya çerezler) hassas veri içermediği, yalnızca session token’larının istisna olarak kabul edildiği doğrulanmalıdır. | 2 | - -## Referanslar - -Daha fazla bilgi için: - -* [Güvenlik ve önbelleğe alma karşıtı header field'ları kontrol etmek için Security Headers web sitesini kullanmayı değerlendirebilirsiniz](https://securityheaders.com/) -* [Mozilla'nın önbelleğe alma karşıtı header'larla ilgili dokümantasyonu](https://developer.mozilla.org/en-US/docs/Web/HTTP/Caching) -* [OWASP Secure Headers project](https://owasp.org/www-project-secure-headers/) -* [OWASP Privacy Risks Project](https://owasp.org/www-project-top-10-privacy-risks/) -* [OWASP User Privacy Protection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/User_Privacy_Protection_Cheat_Sheet.html) -* [Australian Privacy Principle 11 - Security of personal information](https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-11-app-11-security-of-personal-information) -* [European Union General Data Protection Regulation (GDPR) overview](https://www.edps.europa.eu/data-protection_en) -* [European Union Data Protection Supervisor - Internet Privacy Engineering Network](https://www.edps.europa.eu/data-protection/ipen-internet-privacy-engineering-network_en) -* ["Clear-Site-Data" header'ıyla ilgili bilgi](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Clear-Site-Data) -* [Web Cache Deception hakkında white paper](https://www.blackhat.com/docs/us-17/wednesday/us-17-Gil-Web-Cache-Deception-Attack-wp.pdf) diff --git a/5.0/tr/0x24-V15-Secure-Coding-and-Architecture.md b/5.0/tr/0x24-V15-Secure-Coding-and-Architecture.md deleted file mode 100644 index 2c1c963727..0000000000 --- a/5.0/tr/0x24-V15-Secure-Coding-and-Architecture.md +++ /dev/null @@ -1,77 +0,0 @@ -# V15 Güvenli Kodlama ve Mimari - -## Kontrol Amacı - -ASVS gereksinimlerinin birçoğu kimlik doğrulama veya yetkilendirme gibi belirli bir güvenlik alanına ya da loglama veya dosya işleme gibi belirli uygulama işlevlerine ilişkindir. - -Bu bölüm, uygulamalar tasarlanırken ve geliştirilirken dikkate alınması gereken genel güvenlik gereksinimlerini kapsar. Bu gereksinimler yalnızca temiz mimari ve kod kalitesine değil, aynı zamanda uygulama güvenliği için gerekli olan belirli mimari ve kodlama uygulamalarına da odaklanır. - -## V15.1 Güvenli Kodlama ve Mimari Dokümantasyonu - -Güvenli ve savunulabilir bir mimarinin oluşturulmasına yönelik birçok gereksinim, uygulamada kullanılan bileşenler ve belirli güvenlik kontrollerinin uygulanmasına ilişkin kararların açıkça belgelenmesine dayanır. - -Bu bölüm, “tehlikeli işlevsellik” içeren bileşenler veya “riskli bileşenler” olarak kabul edilen parçaların tanımlanması dahil olmak üzere, dokümantasyon gereksinimlerini açıklar. - -"Tehlikeli işlevsellik" içeren bir bileşen, güvenilmeyen verilerin serisizleştirmesini (deserialization) yapan, ham dosya veya ikili veri ayrıştırması gerçekleştiren, dinamik kod çalıştıran veya doğrudan bellekle etkileşen bir dahili ya da üçüncü taraf bileşen olabilir. Bu tür işlemlerdeki güvenlik açıkları, uygulamanın ve altında yatan altyapının ele geçirilmesine yol açabilecek yüksek risklidir. - -"Riskli bileşen", güvenlik kontrolleri eksik ya da zayıf şekilde uygulanmış bir üçüncü taraf (ekip içinde geliştirilmemiş) kütüphanedir. Örnekler arasında kötü şekilde sürdürülen, desteklenmeyen, ömrünün sonuna gelmiş veya ciddi güvenlik açıkları geçmişi olan bileşenler yer alır. - -Bu bölüm aynı zamanda üçüncü taraf bileşenlerdeki güvenlik açıklarının giderilmesi için uygun zaman çerçevelerinin tanımlanmasının önemini vurgular. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **15.1.1** | Güvenlik açığı içeren üçüncü taraf bileşen sürümleri ve genel olarak kütüphane güncellemeleri için, uygulama dokümantasyonunda risk bazlı düzeltme zamanlarının tanımlandığı doğrulanmalıdır. | 1 | -| **15.1.2** | Yazılım bileşen listesi (Software Bill of Materials - SBOM) gibi bir envanterin tutulduğu, kullanılan tüm üçüncü taraf kütüphanelerin önceden tanımlanmış, güvenilir ve düzenli olarak güncellenen depolardan alındığı doğrulanmalıdır. | 2 | -| **15.1.3** | Uygulama dokümantasyonunda zaman veya kaynak açısından yoğun işlevlerin tanımlandığı, bu işlevlerin aşırı kullanımı durumunda kullanılabilirlik kaybının nasıl önleneceği ve yanıt oluşturma süresinin istemci zaman aşımını aşmaması için hangi önlemlerin alındığı belirtilmelidir. Örnek savunmalar kuyruklama, eşzamansız işleme, kullanıcı başına ve uygulama genelinde paralel işlem sınırlarını içerebilir. | 2 | -| **15.1.4** | Uygulama dokümantasyonunda "riskli bileşenler" olarak değerlendirilen üçüncü taraf kütüphanelerin vurgulandığı doğrulanmalıdır. | 3 | -| **15.1.5** | Uygulama dokümantasyonunda "tehlikeli işlevsellik" içeren uygulama bölümlerinin açıkça belirtildiği doğrulanmalıdır. | 3 | - -## V15.2 Güvenlik Mimarisi ve Bağımlılıklar - -Bu bölüm riskli, güncel olmayan veya güvensiz bağımlılıkların ve bileşenlerin bağımlılık yönetimi yoluyla nasıl ele alınması gerektiğine dair gereksinimleri içerir. - -Ayrıca, “tehlikeli işlemler” veya “riskli bileşenlerin” (önceki bölümde tanımlandığı şekilde) kullanımının etkisini azaltmak ve kaynak yoğun işlevlerin aşırı kullanımından kaynaklı kullanılabilirlik kayıplarını önlemek amacıyla sandboxing, kapsülleme (encapsulation), konteynerleştirme ve ağ izolasyonu gibi mimari düzeydeki tekniklerin kullanımını da kapsar. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **15.2.1** | Uygulamanın yalnızca, belgelenmiş güncelleme ve düzeltme sürelerini aşmamış bileşenleri içerdiği doğrulanmalıdır. | 1 | -| **15.2.2** | Uygulamanın, belgelenmiş güvenlik kararları ve stratejilere dayanarak, zaman veya kaynak açısından yoğun işlevlerin neden olabileceği kullanılabilirlik kaybına karşı savunmalar uyguladığı doğrulanmalıdır. | 2 | -| **15.2.3** | Üretim ortamının yalnızca uygulamanın çalışması için gerekli işlevleri içerdiği ve test kodları, örnek kod parçaları veya geliştirme işlevleri gibi gereksiz işlevsellikleri açığa çıkarmadığı doğrulanmalıdır. | 2 | -| **15.2.4** | Üçüncü taraf bileşenlerin ve bunların tüm transitif bağımlılıklarının beklenen depolardan (iç kaynaklı ya da harici) alındığı ve bağımlılık karışıklığı (dependency confusion) saldırılarına açık olmadığı doğrulanmalıdır. | 3 | -| **15.2.5** | Uygulamanın, “tehlikeli işlevsellik” içeren veya “riskli bileşenler” kullanan bölümlerine ek korumalar uyguladığı doğrulanmalıdır. Bu korumalar sandbox, kapsülleme, konteynerleştirme veya ağ düzeyinde izolasyon gibi teknikler aracılığıyla, bir uygulama bölümünün ele geçirilmesi durumunda saldırganın diğer bölümlere sıçramasını geciktirmeyi veya engellemeyi amaçlamalıdır. | 3 | - -## V15.3 Savunmacı Kodlama - -Bu bölüm, belirli bir programlama dilinde güvensiz kodlama kalıplarının kullanılması sonucu oluşan tür oynama (type juggling), prototip zehirleme (prototype pollution) gibi güvenlik açıklarını kapsar. Bazıları tüm dillere uygun olmayabilirken, diğerleri dile özel düzeltmelere sahip olabilir ya da HTTP parametrelerinin işlenmesi gibi framework'e özgü davranışlarla ilişkilidir. Ayrıca uygulama güncellemelerinin kriptografik olarak doğrulanmamasıyla ilgili riskleri de ele alır. - -Ayrıca, veri öğelerini temsil etmek için nesnelerin kullanılması ve bu nesnelerin dış API’ler üzerinden alınması ve döndürülmesi durumunda ortaya çıkan riskleri de dikkate alır. Bu durumda, uygulama kullanıcı girdileriyle değiştirilmemesi gereken alanların değiştirilememesini (kitlesel atama – mass assignment) sağlamalı ve hangi alanların döndürüldüğü konusunda seçici olmalıdır. Alan erişimi bir kullanıcının izinlerine bağlıysa, bu durum "Authorization" bölümündeki domain düzeyinde erişim kontrolü gereksinimi bağlamında değerlendirilmelidir. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **15.3.1** | Uygulamanın yalnızca gerekli alanların bir alt kümesini veri nesnesinden döndürdüğü doğrulanmalıdır. Örneğin, bazı alanlara kullanıcıların erişmemesi gerektiğinden tüm veri nesnesi döndürülmemelidir. | 1 | -| **15.3.2** | Uygulama backend'i harici URL’lere çağrı yaptığında, yalnızca amaçlanan işlevsellik söz konusuysa yönlendirmeleri takip edecek şekilde yapılandırıldığının doğrulanması gerekir. | 2 | -| **15.3.3** | Uygulamanın, kitlesel atama saldırılarına karşı, her bir controller ve eylem için izin verilen alanları sınırlandırarak savunmalar sağladığı doğrulanmalıdır. Örneğin, bir alan değeri, bu işlemde değiştirilmesi amaçlanmadıysa eklenememeli veya güncellenememelidir. | 2 | -| **15.3.4** | Tüm proxy ve ara katman bileşenlerinin kullanıcının orijinal IP adresini, uç kullanıcı tarafından değiştirilemeyecek güvenilir veri alanları kullanarak doğru şekilde ilettiği ve uygulamanın ve web sunucusunun bu doğru değeri, loglama ve hız sınırlama gibi güvenlik kararları için kullandığı doğrulanmalıdır. Ayrıca, orijinal IP adresinin bile dinamik IP'ler, VPN'ler veya kurumsal güvenlik duvarları nedeniyle güvenilir olmayabileceği dikkate alınmalıdır. | 2 | -| **15.3.5** | Uygulamanın değişkenlerin doğru türde olduğunu açıkça doğruladığı ve sıkı eşitlik ve karşılaştırma işlemleri kullandığı doğrulanmalıdır. Bu, değişken türüyle ilgili varsayımlardan kaynaklanan tür oynama (type juggling) veya tür karışıklığı (type confusion) güvenlik açıklarını önlemek içindir. | 2 | -| **15.3.6** | JavaScript kodunun prototip zehirleme (prototype pollution) saldırılarını önleyecek şekilde yazıldığı, örneğin, nesne literal’leri yerine Set() veya Map() gibi yapılar kullanıldığı doğrulanmalıdır. | 2 | -| **15.3.7** | Uygulamanın, özellikle framework'ün istek parametrelerinin kaynağı (sorgu dizgisi, gövde parametreleri, çerezler veya başlık alanları) arasında ayrım yapmadığı durumlarda, HTTP parametre kirliliği (HTTP parameter pollution) saldırılarına karşı savunmalar uyguladığı doğrulanmalıdır. | 2 | - -## V15.4 Güvenli Eş Zamanlılık (Concurrency) - -Yarış durumları (race condition), kontrol anından kullanım anına (TOCTOU - time-of-check to time-of-use) açıkları, deadlock, livelock, iş parçacığı (thread) açlığı ve hatalı senkronizasyon gibi eş zamanlılık sorunları, öngörülemeyen davranışlara ve güvenlik risklerine yol açabilir. Bu bölüm, bu riskleri azaltmaya yardımcı olacak çeşitli teknikleri ve stratejileri içerir. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **15.4.1** | Çok iş parçacıklı kodda (örneğin cache'ler, dosyalar veya birden fazla iş parçacığı tarafından erişilen bellek içi nesneler gibi) paylaşılan nesnelere yalnızca thread-safe (iş parçacığı güvenli) türler ve kilitleme (lock) veya semaphore gibi senkronizasyon mekanizmaları kullanılarak erişildiği doğrulanmalıdır. Bu, yarış durumlarını ve veri bozulmasını önlemeye yöneliktir. | 3 | -| **15.4.2** | Bir kaynağın durumu üzerindeki kontroller (örneğin varlığı ya da izinleri gibi) ile bu kontrole bağlı eylemlerin tek bir atomik işlem olarak gerçekleştirildiği doğrulanmalıdır. Bu, TOCTOU (time-of-check to time-of-use) yarış durumlarını önlemeye yöneliktir. Bir dosyanın varlığının kontrol edilip ardından açılması veya bir kullanıcının erişiminin doğrulanıp ardından yetki verilmesi gibi işlemler buna örnektir. | 3 | -| **15.4.3** | Kilitlerin (locks) tutarlı biçimde kullanıldığı, iş parçacıklarının birbirini beklemesi ya da sonsuz döngüye girmesi (deadlock veya livelock) gibi durumların önlendiği doğrulanmalıdır. Ayrıca, kilitleme mantığı, kaynağı yöneten kod içinde kalmalı ve dış sınıflar veya dış kodlar tarafından istemeden veya kötü niyetli şekilde değiştirilememelidir. | 3 | -| **15.4.4** | Kaynak tahsis politikalarının, iş parçacığı açlığını önleyecek şekilde, kaynaklara adil erişimi sağladığı doğrulanmalıdır. Örneğin, thread pool (iş parçacığı havuzu) kullanımı, düşük öncelikli iş parçacıklarının da makul sürelerde çalışabilmesi için uygulanmalıdır. | 3 | - -## Referanslar - -Daha fazla bilgi için: - -* [OWASP Prototype Pollution Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html) -* [OWASP Mass Assignment Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html) -* [OWASP CycloneDX Bill of Materials Specification](https://owasp.org/www-project-cyclonedx/) -* [OWASP Web Security Testing Guide: Testing for HTTP Parameter Pollution](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/07-Input_Validation_Testing/04-Testing_for_HTTP_Parameter_Pollution) diff --git a/5.0/tr/0x25-V16-Security-Logging-and-Error-Handling.md b/5.0/tr/0x25-V16-Security-Logging-and-Error-Handling.md deleted file mode 100644 index 46d0624d56..0000000000 --- a/5.0/tr/0x25-V16-Security-Logging-and-Error-Handling.md +++ /dev/null @@ -1,84 +0,0 @@ -# V16 Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi - -## Kontrol Amacı - -Güvenlik logları hata ya da performans loglarından farklı olarak kimlik doğrulama kararları, erişim kontrol kararları ve giriş doğrulama ya da iş mantığı doğrulama gibi güvenlik kontrollerini aşma girişimleri gibi güvenlikle ilgili olayları kaydetmek için kullanılır. Bu logların amacı tespit, müdahale ve inceleme süreçlerini desteklemek için SIEM gibi analiz araçlarına uygun, yüksek sinyalli ve yapılandırılmış veri sağlamaktır. - -Loglar, yasal bir zorunluluk olmadıkça hassas kişisel verileri içermemeli ve kaydedilen tüm veriler yüksek değerli birer varlık olarak korunmalıdır. Loglama işlemleri gizliliği veya sistem güvenliğini tehlikeye atmamalıdır. Uygulamalar ayrıca, hata durumlarında gereksiz bilgi sızdırma veya kesinti olmaksızın güvenli şekilde başarısız olmalıdır. - -Detaylı uygulama rehberliği için referanslar bölümündeki OWASP Cheat Sheet dökümanlarına başvurulabilir. - -## V16.1 Güvenlik Loglaması Dokümantasyonu - -Bu bölüm, uygulama katmanları genelinde gerçekleştirilen loglamanın açık ve eksiksiz bir envanterini oluşturmayı amaçlar. Bu, etkili güvenlik izleme, olay müdahalesi ve uyumluluk için gereklidir. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **16.1.1** | Uygulamanın teknoloji yığını boyunca her katmanda hangi olayların loglandığını, log formatlarını, logların nereye yazıldığını, nasıl kullanıldığını, erişimin nasıl kontrol edildiğini ve logların ne kadar süre saklandığını belgeleyen bir envanterin mevcut olduğu doğrulanmalıdır. | 2 | - -## V16.2 Genel Loglama - -Bu bölüm, güvenlik loglarının tutarlı şekilde yapılandırılmasını ve beklenen meta verileri içermesini sağlamaya yönelik gereksinimleri kapsar. Amaç, logların makine tarafından okunabilir ve dağıtık sistemler ile araçlarda analiz edilebilir olmasını sağlamaktır. - -Güvenlik olayları çoğunlukla hassas veriler içerir. Bu tür verilerin dikkatsizce kaydedilmesi durumunda, loglar da hassas veri niteliği kazanır ve bu da şifreleme zorunluluğu, daha sıkı saklama politikaları ve denetimlerde açıklanma riski gibi sonuçlara yol açar. - -Bu nedenle yalnızca gerekli verilerin loglanması ve log verilerinin diğer hassas varlıklar gibi korunması kritik önemdedir. - -Aşağıdaki gereksinimler metadata'nın loglanması, senkronizasyon, biçim ve kontrol için temel gereksinimleri belirler. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **16.2.1** | Her bir log girdisinin, olayın ne zaman, nerede, kim tarafından ve ne olduğuna dair detaylı bir zaman çizelgesi oluşturulmasına olanak tanıyacak gerekli meta verileri içerdiği doğrulanmalıdır. | 2 | -| **16.2.2** | Tüm loglama bileşenlerinin zaman kaynaklarının senkronize olduğu ve güvenlik olayı meta verisindeki zaman damgalarının UTC kullanarak ya da açık zaman dilimi ofsetiyle belirtildiği doğrulanmalıdır. UTC kullanımı, özellikle yaz saati uygulamaları nedeniyle oluşabilecek karışıklıkları önlemek için tavsiye edilir. | 2 | -| **16.2.3** | Uygulamanın yalnızca log envanterinde belgelenmiş dosya ve hizmetlere log yazdığı ya da ilettiği doğrulanmalıdır. | 2 | -| **16.2.4** | Logların kullanılan log işleyici (log processor) tarafından okunabildiği ve ilişkilendirilebildiği doğrulanmalıdır. Tercihen yaygın bir log formatı kullanılmalıdır. | 2 | -| **16.2.5** | Hassas veriler loglanırken, uygulamanın veri koruma seviyesine uygun olarak loglama yaptığı doğrulanmalıdır. Örneğin kimlik bilgileri veya ödeme detayları gibi bazı verilerin loglanmasına izin verilmemelidir. Session token’ları gibi veriler ise yalnızca tamamen ya da kısmen maskelenmiş ya da hash’lenmiş olarak loglanmalıdır. | 2 | - -## V16.3 Güvenlik Olayları - -Bu bölüm, uygulama içerisinde güvenlikle ilgili olayların loglanmasına dair gereksinimleri tanımlar. Bu olayların yakalanması şüpheli davranışların tespiti, olay incelemelerinin desteklenmesi ve uyumluluk yükümlülüklerinin yerine getirilmesi açısından kritiktir. - -Buradaki olay türleri örnek niteliğindedir. Her uygulama, kendine özgü risk faktörleri ve operasyonel bağlama sahiptir. - -Not: ASVS, güvenlik olaylarının loglanmasını kapsam içine alır. Ancak SIEM kuralları veya izleme altyapısı gibi uyarı ve korelasyon sistemleri kapsam dışıdır. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **16.3.1** | Tüm kimlik doğrulama işlemlerinin (başarılı ve başarısız girişimler dahil) loglandığı doğrulanmalıdır. Kullanılan kimlik doğrulama türü veya faktörleri gibi ek meta veriler de toplanmalıdır. | 2 | -| **16.3.2** | Başarısız yetkilendirme girişimlerinin loglandığı doğrulanmalıdır. Seviye 3 uygulamalar için, tüm yetkilendirme kararlarının ve hassas verilere erişim olaylarının (verinin kendisi olmadan) loglandığı da doğrulanmalıdır. | 2 | -| **16.3.3** | Uygulamanın, belgelenmiş güvenlik olaylarını ve güvenlik kontrollerini aşma girişimlerini (girdi doğrulama, iş mantığı, otomasyon karşıtı kontroller vb.) logladığı doğrulanmalıdır. | 2 | -| **16.3.4** | Beklenmeyen hatalar ve güvenlik kontrolü başarısızlıkları (örneğin backend TLS hataları gibi) loglandığı doğrulanmalıdır. | 2 | - -## V16.4 Log Koruması - -Loglar, olay incelemeleri ve adli analizler için değerli kanıtlardır ve korunmaları gerekir. Kolayca silinebilen ya da değiştirilebilen loglar güvenilirliğini kaybeder. Ayrıca loglar, uygulamanın iç davranışları veya hassas meta veriler hakkında bilgi barındırabileceğinden saldırganlar için cazip hedeflerdir. - -Bu bölüm, logların yetkisiz erişimden, değiştirilmeden ve açıklanmaktan korunmasını ve güvenli, izole sistemlere aktarılmasını sağlamaya yönelik gereksinimleri tanımlar. - -| # | Description | Level | -| :---: | :--- | :---: | -| **16.4.1** | Tüm loglama bileşenlerinin, log enjeksiyonunu (log injection) önlemek amacıyla verileri uygun biçimde encode ettiği doğrulanmalıdır. | 2 | -| **16.4.2** | Logların yetkisiz erişime karşı korunduğu ve değiştirilemez olduğu doğrulanmalıdır. | 2 | -| **16.4.3** | Logların analiz, tespit, uyarı ve yükseltme amacıyla mantıksal olarak ayrı bir sisteme güvenli biçimde iletildiği doğrulanmalıdır. Böylece uygulama ihlal edilse bile logların tehlikeye girmesi önlenmiş olur. | 2 | - -## V16.5 Hata Yönetimi - -Bu bölüm, uygulamaların beklenmedik durumlarda güvenli şekilde başarısız olmasını ve hassas içsel detayları açıklamamasını sağlamak için gerekli gereksinimleri tanımlar. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **16.5.1** | Beklenmedik ya da güvenlikle ilgili bir hata oluştuğunda, tüketiciye genel bir mesaj döndürüldüğü ve yığın izleri (stack trace), sorgular, gizli anahtarlar, token’lar gibi hassas sistem içi verilerin açıklanmadığı doğrulanmalıdır. | 2 | -| **16.5.2** | Uygulamanın, dış kaynaklara erişim başarısız olduğunda bile güvenli şekilde çalışmaya devam ettiği doğrulanmalıdır. Örneğin, circuit breaker ya da graceful degradation gibi desenler kullanılmalıdır. | 2 | -| **16.5.3** | Uygulamanın hata durumlarında güvenli ve düzenli şekilde başarısız olduğu doğrulanmalıdır. Bu, örneğin doğrulama hatalarına rağmen işlemlerin işlenmesine yol açabilecek fail-open durumlarını önlemelidir. | 2 | -| **16.5.4** | Ele alınmamış tüm istisnaları yakalayacak şekilde tanımlanmış bir “son çare hata yöneticisi” bulunduğu doğrulanmalıdır. Bu, hem loglara gitmesi gereken hata detaylarının kaybolmaması hem de tüm uygulama sürecinin çökerek hizmet dışı kalmasının önlenmesi açısından önemlidir. | 3 | - -Not: Swift, Go ve birçok fonksiyonel dilde olduğu gibi bazı diller, istisnaları veya “son çare” hata yöneticilerini desteklemez. Bu durumda, geliştiriciler uygulamanın beklenmeyen veya güvenlikle ilgili olayları güvenli şekilde ele almasını sağlamak için dile veya çerçeveye uygun desenler kullanmalıdır. - -## Referanslar - -Daha fazla bilgi için: - -* [OWASP Web Security Testing Guide: Testing for Error Handling](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/README) -* [OWASP Authentication Cheat Sheet section about error messages](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#authentication-and-error-messages) -* [OWASP Logging Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html) -* [OWASP Application Logging Vocabulary Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Vocabulary_Cheat_Sheet.html) diff --git a/5.0/tr/0x26-V17-WebRTC.md b/5.0/tr/0x26-V17-WebRTC.md deleted file mode 100644 index 8706b284f4..0000000000 --- a/5.0/tr/0x26-V17-WebRTC.md +++ /dev/null @@ -1,75 +0,0 @@ -# V17 WebRTC - -## Kontrol Amacı - -Web Gerçek Zamanlı İletişim (WebRTC), modern uygulamalarda gerçek zamanlı ses, görüntü ve veri alışverişini mümkün kılar. Kullanım yaygınlaştıkça, WebRTC altyapısının güvenliğinin sağlanması kritik hâle gelir. Bu bölüm, WebRTC sistemlerini geliştiren, barındıran veya entegre eden paydaşlar için güvenlik gereksinimlerini tanımlar. - -WebRTC pazarı genel olarak üç kategoriye ayrılabilir: - -1. Ürün Geliştiriciler: WebRTC ürün ve çözümlerini geliştiren ve sağlayan özel veya açık kaynak tedarikçileri. Odak noktaları, başkaları tarafından da kullanılabilecek sağlam ve güvenli WebRTC teknolojileri geliştirmektir. - -2. Hizmet Olarak İletişim Platformları (Communication Platforms as a Service - CPaaS): WebRTC işlevlerini mümkün kılmak için API, SDK ve altyapı/platform sağlayan hizmet sağlayıcılarıdır. CPaaS sağlayıcıları, birinci kategorideki ürünleri kullanabilir veya kendi WebRTC yazılımlarını geliştirerek bu hizmetleri sunabilirler. - -3. Hizmet Sağlayıcılar: Ürün geliştiricilerden veya CPaaS sağlayıcılarından alınan ürünleri kullanan ya da kendi WebRTC çözümlerini geliştiren kuruluşlardır. Bu sağlayıcılar çevrim içi konferans, sağlık, online eğitim gibi alanlarda gerçek zamanlı iletişimin kritik olduğu uygulamalar geliştirirler. - -Bu bölümdeki güvenlik gereksinimleri, özellikle aşağıdaki gibi sistemleri kullanan Ürün Geliştiriciler, CPaaS’ler ve Hizmet Sağlayıcıları için geçerlidir: - -* WebRTC uygulamalarını oluşturmak için açık kaynak çözümler kullananlar, -* Altyapılarının bir parçası olarak ticari WebRTC ürünlerini kullananlar, -* Kendi WebRTC çözümlerini geliştiren ya da çeşitli bileşenleri birleştirerek entegre hizmet sunanlar. - -Not: Bu güvenlik gereksinimleri yalnızca CPaaS sağlayıcılarının sunduğu SDK ve API'leri doğrudan kullanan geliştiricileri kapsamaz. Bu tür durumlarda, güvenlikten büyük ölçüde CPaaS sağlayıcısı sorumlu olur ve ASVS gibi genel güvenlik standartları her zaman tam olarak geçerli olmayabilir. - -## V17.1 TURN Sunucusu - -Bu bölüm, kendi TURN (Traversal Using Relays around NAT) sunucusunu işleten sistemler için güvenlik gereksinimlerini tanımlar. TURN sunucuları, kısıtlayıcı ağ ortamlarında medya iletimini sağlamak için kullanılır, ancak yanlış yapılandırıldıklarında güvenlik riski oluşturabilirler. Bu gereksinimler, güvenli IP filtrelemesi ve kaynak tüketimine karşı korumaları ele alır. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **17.1.1** | TURN hizmetinin yalnızca özel amaçlar için ayrılmamış IP adreslerine (ör. iç ağlar, yayın adresleri, loopback) erişime izin verdiği doğrulanmalıdır. Bu gereksinim hem IPv4 hem de IPv6 adresleri için geçerlidir. | 2 | -| **17.1.2** | TURN hizmetinin, meşru kullanıcıların sunucuda çok sayıda bağlantı noktası açmaya çalışması durumunda kaynak tüketimi saldırılarına karşı dayanıklı olduğu doğrulanmalıdır. | 3 | - -## V17.2 Medya - -Bu gereksinimler yalnızca kendi WebRTC medya sunucularını (ör. SFU, MCU, kayıt sunucuları veya geçit sunucuları) barındıran sistemler için geçerlidir. Medya sunucuları, medya akışlarını işler ve dağıtır, bu da iletişim güvenliğini sağlamada kritik rol oynar. Medya akışlarını korumak dinlemeyi, kurcalamayı veya hizmet reddi (DoS) saldırılarını önlemek açısından önemlidir. - -Özellikle, hız sınırlama, zaman damgalarını doğrulama, gerçek zamanlı aralıkları eşleştirmek için senkronize saatler kullanma ve taşmayı önlemek ve uygun zamanlamayı korumak için arabellekleri (buffer) yönetme gibi flood saldırılarına karşı korumalar uygulamak gerekir. Belirli bir medya oturumu için paketler çok hızlı gelirse, fazla paketler düşürülmelidir. Girdi doğrulaması uygulayarak, tamsayı taşmalarını (integer overflow) güvenli bir şekilde ele alarak, arabellek taşmalarını (buffer overflow) önleyerek ve diğer sağlam hata işleme tekniklerini kullanarak sistemi hatalı biçimlendirilmiş paketlerden korumak da önemlidir. - -Sadece peer-to-peer medya iletişimi kullanan sistemler bu medya gereksinimlerinin kapsamı dışındadır. - -DTLS (Datagram Transport Layer Security) kullanımıyla ilgili gereksinimler burada yer alır. Kriptografik anahtarların yönetimi için bir politika oluşturulması "Kriptografi" bölümünde ele alınır. Onaylı şifreleme yöntemleri için ASVS’nin Kriptografi Ek’i veya NIST SP 800‑52 Rev. 2, BSI TR‑02102‑2 (2025‑01) gibi belgeler referans alınabilir. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **17.2.1** | DTLS sertifikası anahtarının, belgelenmiş kriptografik anahtar yönetim politikasına uygun şekilde yönetildiği ve korunduğu doğrulanmalıdır. | 2 | -| **17.2.2** | Medya sunucusunun onaylı DTLS şifre takımlarını (cipher suites) ve Güvenli Gerçek Zamanlı Aktarım Protokolü (Secure Real-time Transport Protocol - SRTP) için anahtarlar oluşturmaya yönelik DTLS Uzantısı için güvenli bir koruma profilini kullanacak ve destekleyecek şekilde yapılandırıldığı (DTLS-SRTP) doğrulanmalıdır. | 2 | -| **17.2.3** | Real-time Transport Protocol (RTP) injection saldırılarının bir hizmet reddi durumuna veya medya akışlarına ses veya video medyası eklenmesine yol açmasını önlemek için medya sunucusunda Güvenli SRTP kimlik doğrulamasının kontrol edildiği doğrulanmalıdır. | 2 | -| **17.2.4** | Verify that the media server is able to continue processing incoming media traffic when encountering malformed Secure Real-time Transport Protocol (SRTP) packets. | 2 | -| **17.2.5** | Medya sunucusunun, meşru kullanıcılardan gelen SRTP flood'ı sırasında gelen medya trafiğini işlemeye devam edebildiği doğrulanmalıdır. | 3 | -| **17.2.6** | Medya sunucusunun DTLS içinde yer alan "ClientHello" yarış durumu güvenlik açığına karşı savunmasız olmadığı, medya sunucusunun güvenlik açığına sahip olduğunun açıkça bilinip bilinmediği kontrol edilerek veya yarış koşulu testi gerçekleştirilerek doğrulanmalıdır. | 3 | -| **17.2.7** | Medya sunucusuna bağlı ses veya video kayıt mekanizmalarının, meşru kullanıcı kaynaklı SRTP flood'ı sırasında medya trafiğini işlemeye devam edebildiği doğrulanmalıdır. | 3 | -| **17.2.8** | DTLS sertifikasının, SDP (Session Description Protocol) fingerprint özelliği ile karşılaştırıldığı ve doğrulama başarısız olursa medya akışının sonlandırıldığı, medya akışının özgünlüğünü sağlamak için doğrulanmalıdır. | 3 | - -## V17.3 Sinyalizasyon - -Bu bölüm, kendi WebRTC sinyalizasyon sunucularını işleten sistemler için güvenlik gereksinimlerini tanımlar. Sinyalizasyon, peer-to-peer iletişimi koordine eder ve oturum kurulumunu veya kontrolünü bozabilecek saldırılara karşı dayanıklı olmalıdır. - -Sinyalizasyonun güvenli olması için sistemler bozuk girdileri zararsız biçimde işleyebilmeli ve yük altında erişilebilir kalmalıdır. - -| # | Açıklama | Seviye | -| :---: | :--- | :---: | -| **17.3.1** | Sinyalizasyon sunucusunun, flood saldırısı altında bile meşru sinyalizasyon mesajlarını işlemeye devam edebildiği doğrulanmalıdır. Bu, sinyalizasyon düzeyinde oran sınırlaması uygulanarak sağlanmalıdır. | 2 | -| **17.3.2** | Sinyalizasyon sunucusunun, hizmet reddine yol açabilecek şekilde yapılandırılmış bozuk sinyalizasyon mesajlarıyla karşılaştığında bile meşru mesajları işlemeye devam edebildiği doğrulanmalıdır. Bu, girdi doğrulaması, integer overflow ve buffer overflow'a karşı savunma ve sağlam hata işleme teknikleri ile sağlanmalıdır. | 2 | - -## Referanslar - -Daha fazla bilgi için: - -* WebRTC DTLS ClientHello DoS hakkında en iyi dokümantasyonlar: [Enable Security's blog post aimed at security professionals](https://www.enablesecurity.com/blog/novel-dos-vulnerability-affecting-webrtc-media-servers/) ve ilgili, [WebRTC geliştiricilerine yönelik white paper](https://www.enablesecurity.com/blog/webrtc-hello-race-conditions-paper/) -* [RFC 3550 - RTP: A Transport Protocol for Real-Time Applications](https://www.rfc-editor.org/rfc/rfc3550) -* [RFC 3711 - The Secure Real-time Transport Protocol (SRTP)](https://datatracker.ietf.org/doc/html/rfc3711) -* [RFC 5764 - Datagram Transport Layer Security (DTLS) Extension to Establish Keys for the Secure Real-time Transport Protocol (SRTP))](https://datatracker.ietf.org/doc/html/rfc5764) -* [RFC 8825 - Overview: Real-Time Protocols for Browser-Based Applications](https://www.rfc-editor.org/info/rfc8825) -* [RFC 8826 - Security Considerations for WebRTC](https://www.rfc-editor.org/info/rfc8826) -* [RFC 8827 - WebRTC Security Architecture](https://www.rfc-editor.org/info/rfc8827) -* [DTLS-SRTP Protection Profiles](https://www.iana.org/assignments/srtp-protection/srtp-protection.xhtml) diff --git a/5.0/tr/0x90-Appendix-A_Glossary.md b/5.0/tr/0x90-Appendix-A_Glossary.md deleted file mode 100644 index 1b1a1856f8..0000000000 --- a/5.0/tr/0x90-Appendix-A_Glossary.md +++ /dev/null @@ -1,88 +0,0 @@ -# Ek A: Sözlük - -* **Absolute Maximum Session Lifetime (Mutlak Maksimum Oturum Ömrü)** – NIST tarafından “Genel Zaman Aşımı” olarak da adlandırılan bu süre, kullanıcı etkileşiminden bağımsız olarak kimlik doğrulamasının ardından bir oturumun etkin kalabileceği maksimum süredir. Bu, oturum sona erme süresinin bir bileşenidir. -* **Allowlist (İzin Listesi)** – İzin verilen veri veya işlemlerin listesi, örneğin girdi doğrulaması yapmak için izin verilen karakterlerin listesi. -* **Anti-forgery token** – Bir veya daha fazla belirtecin bir istekte geçirildiği ve isteğin beklenen bir uç noktadan geldiğinden emin olmak için uygulama sunucusu tarafından doğrulandığı bir mekanizmadır. -* **Application Security (Uygulama Güvenliği)** – Uygulama düzeyinde güvenlik, örneğin altta yatan işletim sistemine veya bağlı ağlara odaklanmak yerine Açık Sistemler Ara Bağlantı Referans Modeli'nin (Open Systems Interconnection Reference Model - OSI Model) uygulama katmanını oluşturan bileşenlerin analizine odaklanır. -* **Application Security Verification (Uygulama Güvenliği Doğrulaması)** – Bir uygulamanın OWASP ASVS'ye göre teknik değerlendirmesidir. -* **Application Security Verification Report (Uygulama Güvenliği Doğrulaması Raporu)** – Belirli bir uygulama için doğrulayıcı tarafından üretilen genel sonuçları ve destekleyici analizi belgeleyen bir rapordur. -* **Authentication (Kimlik Doğrulama)** – Bir uygulama kullanıcısının iddia ettiği kimliğinin doğrulanmasıdır. -* **Automated Verification (Otomatik Doğrulama)** – Sorunları bulmak için güvenlik açığı imzalarını kullanan otomatik araçların (dinamik analiz araçları, statik analiz araçları veya her ikisi) kullanılmasıdır. -* **Black box testing** – Bir uygulamanın iç yapılarına veya işleyişine bakmadan işlevselliğini inceleyen bir yazılım testi yöntemidir. -* **Common Weakness Enumeration** (CWE) – Yaygın yazılım güvenlik zayıflıklarının topluluk tarafından geliştirilen bir listesi. Ortak bir dil, yazılım güvenlik araçları için bir ölçüm kriteri ve zayıflık tanımlama, azaltma ve önleme çabaları için bir temel olarak hizmet eder. -* **Component (Bileşen)** – Diğer bileşenlerle iletişim kuran ilişkili disk ve ağ arayüzlerine sahip bağımsız bir kod birimidir. -* **Credential Service Provider (Kimlik Bilgisi Hizmet Sağlayıcısı)** (CSP) – Kimlik Sağlayıcısı ( Identity Provider - IdP) olarak da adlandırılır. Diğer uygulamalar tarafından kimlik doğrulama kaynağı olarak kullanılabilecek bir kullanıcı verisi kaynağıdır. -* **Cross-Site Script Inclusion (Siteler Arası Komut Dosyası Ekleme)** (XSSI) - Bir web uygulamasının harici bir kaynaktan kötü amaçlı kod aldığı ve bu kodu kendi içeriğinin bir parçası olarak dahil ettiği Siteler Arası Komut Çalıştırma (XSS) saldırısının bir çeşididir. -* **Cross-Site Scripting (Siteler Arası Komut Çalıştırma)** (XSS) – Genellikle web uygulamalarında bulunan ve istemci tarafı komut dosyalarının içeriğe eklenmesine izin veren bir güvenlik açığıdır. -* **Cryptographic module (Kriptografik modül)** – Kriptografik algoritmalar uygulayan ve/veya kriptografik anahtarlar üreten donanım, yazılım ve/veya ürün yazılımıdır. -* **Cryptographically secure pseudo-random number generator (Kriptografik olarak güvenli sözde rastgele sayı üreteci)** (CSPRNG) - Kriptografide kullanıma uygun özelliklere sahip bir sözde rastgele sayı üreteci, kriptografik rastgele sayı üreteci (CRNG) olarak da adlandırılır. -* **Datagram Transport Layer Security (Datagram Taşıma Katmanı Güvenliği)** (DTLS) – Bir ağ bağlantısı üzerinden iletişim güvenliği sağlayan bir kriptografik protokoldür. TLS protokolüne dayanır ancak datagram odaklı protokolleri (genellikle UDP üzerinden) korumak için uyarlanmıştır. DTLS 1.3 için RFC 9147'de tanımlanmıştır. -* **Datagram Transport Layer Security Extension to Establish Keys for the Secure Real-time Transport Protocol (Güvenli Gerçek Zamanlı Aktarım Protokolü Anahtarlarını Oluşturmak için Datagram Aktarım Katmanı Güvenlik Uzantısı)** (DTLS-SRTP) – Bir SRTP oturumu için anahtar materyali oluşturmak üzere DTLS el sıkışmasını kullanmaya yönelik bir mekanizmadır. RFC 5764'te tanımlanmıştır. -* **Design Verification (Tasarım Doğrulama)** – Bir uygulamanın güvenlik mimarisinin teknik değerlendirmesidir. -* **Dynamic Application Security Testing (Dinamik Uygulama Güvenlik Testi)** (DAST) – Bir uygulamadaki güvenlik açığını gösteren koşulları, uygulamanın çalışır durumunda tespit etmek için tasarlanan teknolojilerdir. -* **Dynamic Verification (Dinamik Doğrulama)** – Bir uygulamanın çalışması sırasında sorunları tespit etmek için güvenlik açığı imzalarını kullanan otomatik araçların kullanımıdır. -* **Fast IDentity Online** (FIDO) – Biyometri, Güvenilir Platform Modülü (Trusted Platform Modules - TPM), USB güvenlik token’ları gibi çeşitli kimlik doğrulama yöntemlerinin kullanımına olanak tanıyan bir kimlik doğrulama standartları kümesidir. -* **Hardware Security Module (Donanım Güvenlik Modülü)** (HSM) – Kriptografik anahtarları ve diğer gizli verileri korumalı şekilde saklayan donanım bileşenidir. -* **Hibernate Query Language** (HQL) – Hibernate ORM kütüphanesi tarafından kullanılan, görünüm olarak SQL’e benzeyen bir sorgu (query) dilidir. -* **HTTP Strict Transport Security (HTTP Sıkı Taşıma Güvenliği)** (HSTS) – Tarayıcının yalnızca TLS üzerinden ve geçerli bir sertifika ile yanıt dönen alan adına bağlanmasını zorunlu kılan bir ilkedir. `Strict-Transport-Security` header field ile etkinleştirilir. -* **HyperText Transfer Protocol** (HTTP) – Dağıtık, işbirlikçi, çok ortamlı bilgi sistemleri için bir uygulama protokolüdür. Dünya Çapında Ağ (WWW) veri iletişiminin temelini oluşturur. -* **SSL/TLS üzerinden HyperText Transfer Protocol** (HTTPS) – HTTP iletişimini Taşıma Katmanı Güvenliği (TLS) ile şifreleyerek güvenli hale getirme yöntemidir. -* **Identity Provider (Kimlik Sağlayıcı)** (IdP) – NIST belgelerinde Kimlik Bilgisi Hizmet Sağlayıcısı (CSP) olarak da adlandırılır. Diğer uygulamalar için kimlik doğrulama kaynağı sağlayan bir varlıktır. -* **Inactivity Timeout (Etkin Olmama Zaman Aşımı)** – Bir oturumun, kullanıcı uygulama ile etkileşime girmediği sürede aktif kalabileceği süredir. Oturum zaman aşımının bir bileşenidir. -* **Input Validation (Girdi Doğrulama)** – RFC 7519 tarafından tanımlanan ve bir başlık (doğrulama yöntemini belirtir), bir gövde (iddiaları içerir) ve bir imza (gövdeyi doğrulamak için kullanılır) olmak üzere üç bölümden oluşan bir JSON veri nesnesidir. Kendi kendini içeren bir token (self-contained token) türüdür. -* **Local File Inclusion** (LFI) - Bir uygulamadaki savunmasız dosya dahil etme işlemlerinin sömürülmesiyle, sunucuda hâlihazırda bulunan yerel dosyaların dahil edilmesine yol açan saldırı türüdür. -* **Malicious Code (Kötü Amaçlı Kod)** – Uygulamanın geliştirme aşamasında uygulama sahibinin bilgisi dışında eklenen ve uygulamanın tasarlanan güvenlik politikasını aşmayı amaçlayan koddur. Virüs veya solucan gibi kötü amaçlı yazılımlardan (malware) farklıdır! -* **Malware (Kötü Amaçlı Yazılım)** – Uygulama çalışırken, kullanıcı veya yönetici farkında olmadan uygulamaya enjekte edilen çalıştırılabilir koddur. -* **Message authentication code (Mesaj Doğrulama Kodu)** (MAC) - Verinin bütünlüğünü ve özgünlüğünü sağlamak amacıyla bir MAC üretim algoritmasıyla hesaplanan kriptografik sağlama (checksum) değeridir. -* **Multi-factor authentication (Çok Faktörlü Kimlik Doğrulama)** (MFA) – İki veya daha fazla tekil faktörün bir arada kullanıldığı kimlik doğrulama yöntemidir. -* **Mutual TLS** (mTLS) – Bkz. TLS istemci kimlik doğrulaması. -* **Object-relational Mapping** (ORM) – İlişkisel (tablolu) bir veritabanının, uygulama içinde nesne tabanlı bir model üzerinden referans alınmasını ve sorgulanmasını sağlayan sistemdir. -* **One-time Password (Tek Kullanımlık Parola)** (OTP) – Sadece tek bir kullanım için benzersiz olarak üretilen paroladır. -* **Open Worldwide Application Security Project** (OWASP) – Uygulama yazılımlarının güvenliğini geliştirmeye odaklı, küresel ve açık bir topluluktur. Misyonu, uygulama güvenliğini “görünür” kılmak ve bireyler ile kurumların güvenlik risklerine dair bilinçli kararlar verebilmesini sağlamaktır. Bkz: [https://www.owasp.org/](https://www.owasp.org/). -* **Password-Based Key Derivation Function 2** (PBKDF2) – Bir giriş metninden (örn. parola) ve rastgele bir tuz (salt) değerinden güçlü bir kriptografik anahtar türeten, tek yönlü özel bir algoritmadır. Sonuç değeri özgün parola yerine saklandığında, parolanın çevrimdışı ortamda kırılmasını zorlaştırmak amacıyla kullanılır. -* **Public Key Infrastructure (Açık Anahtar Altyapısı)** (PKI) – Açık anahtarların ilgili varlıkların kimlikleriyle ilişkilendirilmesini sağlayan bir yapıdır. Bu ilişkilendirme, bir sertifika otoritesi (CA) tarafından gerçekleştirilen kayıt ve sertifika oluşturma süreciyle sağlanır. -* **Public Switched Telephone Network (Genel Anahtarlamalı Telefon Ağı)** (PSTN) – Sabit hatlı ve mobil telefonları içeren geleneksel telefon ağıdır. -* **Real-time Transport Protocol (Gerçek Zamanlı Taşıma Protokolü)** (RTP) ve **Real-time Transport Control Protocol (Gerçek Zamanlı Taşıma Denetim Protokolü)** (RTCP) – Multimedya akışlarını taşımak için birlikte kullanılan iki protokoldür. WebRTC yığını tarafından kullanılır. RFC 3550’de tanımlanmıştır. -* **Reference Token** – Sunucuda tutulan duruma veya meta veriye işaret eden veya onu tanımlayan, bazen rastgele veya opak token olarak da adlandırılan bir token türüdür. Kendi kendini içeren token’lardan farklı olarak, içeriğinde anlamlı bilgi taşımaz ve bağlam tamamen sunucu tarafından sağlanır. Genellikle bir oturum tanımlayıcısı içerir veya doğrudan bu tanımlayıcıyı temsil eder. -* **Relying Party** (RP) – Genellikle, kullanıcının ayrı bir kimlik sağlayıcı ile kimlik doğrulaması yaptığına güvenen bir uygulamadır. Bu uygulama, kullanıcıya ait olduğunu doğrulamak için kimlik sağlayıcı tarafından sağlanan bir token’a veya imzalı beyanlara dayanır. -* **Remote File Inclusion** (RFI) - Uygulamadaki zafiyet içeren dosya dahil etme işlemlerinin sömürülmesiyle, uzak sistemlerden dosya dahil edilmesine yol açan saldırı türüdür. -* **Scalable Vector Graphics** (SVG) – İki boyutlu vektör grafiklerini tanımlamak için kullanılan, XML tabanlı bir işaretleme dilidir. -* **Secure Real-time Transport Protocol (Güvenli Gerçek Zamanlı Taşıma Protokolü)** (SRTP) and **Secure Real-time Transport Control Protocol (Güvenli Gerçek Zamanlı Taşıma Denetim Protokolü)** (SRTCP) – RTP ve RTCP protokollerinin, mesaj şifreleme, kimlik doğrulama ve bütünlük koruması desteği sunan güvenli sürümleridir. RFC 3711’de tanımlanmıştır. -* **Security Architecture (Güvenlik Mimarisi)** – Uygulamanın tasarımına dair bir soyutlamadır. Güvenlik kontrollerinin nerede ve nasıl kullanıldığını, kullanıcı ve uygulama verilerinin nerede bulunduğunu ve hassasiyet seviyelerini tanımlar. -* **Security Assertion Markup Language** (SAML) – Kimlik sağlayıcı ile güvenen taraf arasında imzalı beyanların (genellikle XML nesneleri) iletilmesine dayalı, açık bir tek oturum açma (SSO) standardıdır. -* **Security Configuration (Güvenlik Yapılandırması)** – Uygulamanın çalışma zamanında, güvenlik kontrollerinin nasıl kullanılacağını etkileyen yapılandırma bilgileridir. -* **Security Control (Güvenlik Kontrolü)** – Bir güvenlik denetimi gerçekleştiren (örn. yetkilendirme kontrolü) ya da çağrıldığında güvenlikle ilgili bir etki oluşturan (örn. denetim kaydı üretme) işlev veya bileşendir. -* **Security information and event management** (SIEM) - Bir kuruluşun BT altyapısından gelen güvenlik verilerini toplayarak tehdit tespiti, uyumluluk ve olay yönetimi amacıyla analiz eden bir sistemdir. -* **Self-Contained Token (Kendi İçinde Taşıyıcı Token)** – Herhangi bir sunucu tarafı duruma veya harici saklamaya bağımlı olmayan, bir veya birden fazla niteliği içinde barındıran token’dır. Bu token’lar, içeriklerinin doğruluğunu ve bütünlüğünü sağlamak için dijital imza veya ileti doğrulama kodu (MAC) gibi kriptografik tekniklerle korunur. Örnekler: SAML beyanları, JWT. -* **Server-side Request Forgery** (SSRF) – Sunucudaki işlevselliğin suistimal edilerek iç kaynakların okunması veya güncellenmesi ile sonuçlanan saldırı türüdür. Saldırgan, sunucu üzerinde çalışacak olan URL’yi doğrudan sağlar ya da değiştirir. -* **Session Description Protocol** (SDP) – Multimedya oturumu kurulumunda kullanılan bir mesaj formatıdır (örneğin WebRTC'de kullanılır). RFC 4566’da tanımlanmıştır. -* **Session Identifier** veya **Session ID** – Backend'de saklanan durumlu bir oturumu tanımlayan anahtardır. İstemciye, doğrudan veya bir Referans Token içinde aktarılır. -* **Session Token** – Bu standartta, self-contained token kullanan ve durum barındırmayan oturum mekanizmalarında ya da reference token kullanan ve durum barındıran mekanizmalarda kullanılan token veya değeri ifade eden genel bir terimdir. -* **Session Traversal Utilities for NAT** (STUN) – Eşler arası iletişim kurmak amacıyla NAT geçişine yardımcı olan bir protokoldür. RFC 3489’da tanımlanmıştır. -* **Single-factor authenticator (Tek Faktörlü Kimlik Doğrulayıcı)** – Kullanıcının kimliğini doğrulamak için kullanılan mekanizmadır. Bu mekanizma ya bilinen bir şey (parolalar, PIN’ler), ya sahip olunan bir şey (OTP token’ları, akıllı kart gibi kriptografik cihazlar), ya da kullanıcıya özgü bir şey (biyometrik veriler, parmak izi, yüz taraması) olmalıdır. -* **Single Sign-on Authentication (Tek Oturum Açma)** (SSO) – Kullanıcının bir uygulamaya giriş yaptıktan sonra, ek bir kimlik doğrulama gerekmeksizin diğer uygulamalara da otomatik olarak giriş yapabilmesidir. Örneğin, Google hesabına giriş yapan bir kullanıcı, YouTube, Google Dokümanlar ve Gmail’e de otomatik olarak erişim sağlar. -* **Software bill of materials (Yazılım Bileşen Listesi)** (SBOM) - Bir yazılım uygulamasını oluşturmak veya birleştirmek için gerekli tüm bileşenlerin, modüllerin, kütüphanelerin, çatıların (framework) ve diğer kaynakların yapılandırılmış ve kapsamlı bir listesidir. -* **Software Composition Analysis** (SCA) – Uygulamanın bileşimini, bağımlılıklarını, kütüphanelerini ve paketlerini analiz ederek kullanılan belirli bileşen sürümlerindeki güvenlik açıklarını tespit etmeye yönelik teknolojiler bütünüdür. Kaynak kod analizi (SAST) ile karıştırılmamalıdır. -* **Software development lifecycle** (SDLC) – Yazılımın, ilk gereksinimlerden dağıtım ve bakıma kadar geçen süreçte adım adım geliştirilmesini tanımlayan modeldir. -* **SQL Injection** (SQLi) – Veri odaklı uygulamalara yönelik bir kod enjeksiyon tekniğidir. Kötü niyetli SQL ifadeleri bir giriş noktasına enjekte edilir. -* **Stateful Session Mechanism** – Oturum durumunun backend'de tutulduğu oturum yönetim biçimidir. Genellikle kriptografik olarak güvenli sahte rastgele sayı üreteci (CSPRNG) ile oluşturulmuş bir oturum token’ı son kullanıcıya verilir. -* **Stateless Session Mechanism** – Hizmet tarafından saklanmayan, oturum bilgilerini taşıyan kendi kendini içeren bir token’ın istemcilere iletildiği mekanizmadır. Gerçekte, hizmetin belirli güvenlik kontrollerini uygulayabilmesi için (örneğin JWT iptal listesi gibi) oturum bilgilerine kısmen erişmesi gerekebilir. -* **Static application security testing (Statik Uygulama Güvenlik Testi)** (SAST) – Uygulamanın kaynak kodunu, bayt kodunu ve ikili dosyalarını çalışmayan (non-running) durumda analiz ederek güvenlik açıklarını ortaya çıkaran teknolojiler bütünüdür. Uygulamayı "içeriden dışarı" analiz eder. -* **Threat Modeling (Tehdit Modelleme)** – Tehdit aktörleri, güvenlik bölgeleri, güvenlik kontrolleri ile teknik ve iş varlıklarını tanımlamak amacıyla gittikçe rafine edilen güvenlik mimarilerinin geliştirilmesini içeren bir tekniktir. -* **Time-of-check to time-of-use (Denetim Zamanı ile Kullanım Zamanı Arasındaki Süre)** (TOCTOU) – Bir kaynağın durumu uygulama tarafından kullanılmadan önce kontrol edilir, fakat bu durum kontrol ile kullanım arasında değişebilir. Bu da kontrolün geçersiz hale gelmesine ve yanlış işlemlerin gerçekleştirilmesine neden olabilir. -* **Time based One-time Passwords (Zamana Dayalı Tek Kullanımlık Parola)** (TOTPs) - Şifreyi üretmek için algoritmada mevcut zamanın kullanıldığı bir OTP üretim yöntemidir. -* **TLS client authentication (TLS İstemci Kimlik Doğrulaması)** veya **Mutual TLS (Karşılıklı TLS)** (mTLS) – Standart bir TLS bağlantısında istemci, sunucunun kimliğini sunucu sertifikası ile doğrular. TLS istemci kimlik doğrulamasında ise istemci de kendi özel anahtarı ve sertifikası ile kendi kimliğini sunucuya doğrulatır. -* **Transport Layer Security (Taşıma Katmanı Güvenliği)** (TLS) – Ağ üzerinden güvenli iletişim sağlamak için kullanılan kriptografik protokoller bütünüdür. -* **Traversal Using Relays around NAT (NAT Etrafında Aktarıcılar Kullanılarak Geçiş )** (TURN) – Eşler arası doğrudan bağlantılar kurulamadığında, bir TURN sunucusu aracılığıyla veri iletimi yapılmasını sağlayan STUN protokolünün bir uzantısıdır. RFC 8656’da tanımlanmıştır. -* **Trusted execution environment (Güvenli Yürütme Ortamı)** (TEE) - Sistemin geri kalanından izole bir işlem ortamında uygulamaların güvenli bir şekilde çalıştırılabildiği özel bir alan. -* **Trusted Platform Module (Güvenilir Platform Modülü)** (TPM) – Genellikle anakart gibi daha büyük donanımlara bağlı olan, sistemin “güven kökü (root of trust)” olarak görev yapan HSM türüdür. -* **Trusted Service Layer (Güvenilir Hizmet Katmanı)** – Mikro servis, sunucusuz API, sunucu tarafı, güvenli önyüklemeli istemci API’si, ortak veya harici API’ler gibi, bir güvenlik kontrolü uygulayan ve kötü niyetli kullanıcıların atlayamayacağı katmanlardır. -* **Uniform Resource Identifier** (URI)- Web sayfası, e-posta adresi veya konum gibi bir kaynağı tanımlayan benzersiz karakter dizisidir. -* **Uniform Resource Locator** (URL) – İnternette bir kaynağın konumunu belirten karakter dizisidir. -* **Universally Unique Identifier (Evrensel Benzersiz Tanımlayıcı)** (UUID) – Yazılımlarda kimlik belirleme amacıyla kullanılan benzersiz referans numarasıdır. -* **Verifier (Doğrulayıcı)** – Bir uygulamayı OWASP ASVS gereksinimlerine göre inceleyen kişi veya ekip. -* **Web Real-Time Communication** (WebRTC) – Web uygulamalarında genellikle görüntülü görüşme amacıyla kullanılan, multimedya akışlarını taşıyan protokol yığını ve web API’sidir. SRTP, SRTCP, DTLS, SDP ve STUN/TURN üzerine kuruludur. -* **WebSocket over TLS** (WSS) – WebSocket iletişimini TLS protokolü ile katmanlayarak güvenli hale getirme uygulamasıdır. -* **What You See Is What You Get** (WYSIWYG) – İçeriğin nasıl görüntüleneceğini doğrudan düzenleme sırasında gösteren zengin metin düzenleyicisidir. Kod görünümü yerine gerçek görünümü gösterir. -* **X.509 Certificate** – Uluslararası X.509 açık anahtar altyapısı (PKI) standardını kullanan ve bir açık anahtarın sertifikada yer alan kullanıcıya, bilgisayara veya hizmete ait olduğunu doğrulayan dijital sertifikadır. -* **XML eXternal Entity** (XXE) – Sistem tanımlayıcısı ile yerel veya uzak içeriğe erişebilen XML varlığı türüdür. Farklı enjeksiyon saldırılarına neden olabilir. diff --git a/5.0/tr/0x91-Appendix-B_References.md b/5.0/tr/0x91-Appendix-B_References.md deleted file mode 100644 index 125eda58aa..0000000000 --- a/5.0/tr/0x91-Appendix-B_References.md +++ /dev/null @@ -1,43 +0,0 @@ -# Ek B: Referanslar - -Aşağıdaki OWASP projeleri, bu standardın kullanıcıları/uygulayıcıları için yararlı olabilir: - -## OWASP Ana Projeleri - -1. OWASP Top 10 Project: [https://owasp.org/www-project-top-ten/](https://owasp.org/www-project-top-ten/) -2. OWASP Web Security Testing Guide: [https://owasp.org/www-project-web-security-testing-guide/](https://owasp.org/www-project-web-security-testing-guide/) -3. OWASP Proactive Controls: [https://owasp.org/www-project-proactive-controls/](https://owasp.org/www-project-proactive-controls/) -4. OWASP Software Assurance Maturity Model (SAMM): [https://owasp.org/www-project-samm/](https://owasp.org/www-project-samm/) -5. OWASP Secure Headers Project: [https://owasp.org/www-project-secure-headers/](https://owasp.org/www-project-secure-headers/) - -## OWASP Cheat Sheet Series Projesi - -[Bu proje](https://owasp.org/www-project-cheat-sheets/) ASVS'deki farklı konularla ilgili olacak birkaç cheat sheet'e sahiptir. - -ASVS ile ilgili bir haritalandırmaya buradan ulaşabilirsiniz: [https://cheatsheetseries.owasp.org/IndexASVS.html](https://cheatsheetseries.owasp.org/IndexASVS.html) - -## Mobil Güvenlikle İlgili Projeler - -1. OWASP Mobile Security Project: [https://owasp.org/www-project-mobile-security/](https://owasp.org/www-project-mobile-security/) -2. OWASP Mobile Top 10 Risks: [https://owasp.org/www-project-mobile-top-10/](https://owasp.org/www-project-mobile-top-10/) -3. OWASP Mobile Security Testing Guide and Mobile Application Security Verification Standard: [https://owasp.org/www-project-mobile-security-testing-guide/](https://owasp.org/www-project-mobile-security-testing-guide/) - -## OWASP Nesnelerin İnterneti (Internet of Things) İle İlgili Projeler - -1. OWASP Internet of Things Project: [https://owasp.org/www-project-internet-of-things/](https://owasp.org/www-project-internet-of-things/) - -## OWASP Serverless Projeleri - -1. OWASP Serverless Project: [https://owasp.org/www-project-serverless-top-10/](https://owasp.org/www-project-serverless-top-10/) - -## Diğerleri - -Benzer şekilde, aşağıdaki web siteleri de bu standardın kullanıcıları/uygulayıcıları için yararlı olabilir: - -1. SecLists Github: [https://github.com/danielmiessler/SecLists](https://github.com/danielmiessler/SecLists) -2. MITRE Common Weakness Enumeration: [https://cwe.mitre.org/](https://cwe.mitre.org/) -3. PCI Security Standards Council: [https://www.pcisecuritystandards.org/](https://www.pcisecuritystandards.org/) -4. PCI Data Security Standard (DSS) v3.2.1 Requirements and Security Assessment Procedures: [https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf](https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf) -5. PCI Software Security Framework - Secure Software Requirements and Assessment Procedures: [https://www.pcisecuritystandards.org/documents/PCI-Secure-Software-Standard-v1_0.pdf](https://www.pcisecuritystandards.org/documents/PCI-Secure-Software-Standard-v1_0.pdf) -6. PCI Secure Software Lifecycle (Secure SLC) Requirements and Assessment Procedures: [https://www.pcisecuritystandards.org/documents/PCI-Secure-SLC-Standard-v1_0.pdf](https://www.pcisecuritystandards.org/documents/PCI-Secure-SLC-Standard-v1_0.pdf) -7. OWASP ASVS 4.0 Testing Guide [https://github.com/BlazingWind/OWASP-ASVS-4.0-testing-guide](https://github.com/BlazingWind/OWASP-ASVS-4.0-testing-guide) diff --git a/5.0/tr/0x92-Appendix-C_Cryptography.md b/5.0/tr/0x92-Appendix-C_Cryptography.md deleted file mode 100644 index 4607b0d780..0000000000 --- a/5.0/tr/0x92-Appendix-C_Cryptography.md +++ /dev/null @@ -1,312 +0,0 @@ -# Ek C: Kriptografi Standartları - -“Kriptografi” bölümü sadece en iyi uygulamaları tanımlamanın ötesine geçmektedir. Kriptografi ilkelerinin daha iyi anlaşılmasını ve daha esnek, modern güvenlik yöntemlerinin benimsenmesini teşvik etmeyi amaçlamaktadır. Bu ek, “Kriptografi” bölümünde ana hatlarıyla belirtilen kapsayıcı standartları tamamlayan her bir gereklilikle ilgili ayrıntılı teknik bilgi sağlamaktadır. - -Bu ek, farklı kriptografik mekanizmalar için onay seviyesini tanımlar: - -* Onaylanmış (A) mekanizmalar uygulamalarda kullanılabilir. -* Eski (Legacy) mekanizmalar (L) uygulamalarda kullanılmamalıdır, ancak yine de yalnızca mevcut eski uygulamalar veya kodlarla uyumluluk için kullanılabilir. Bu tür mekanizmaların kullanımı şu anda kendi başına bir güvenlik açığı olarak kabul edilmese de, mümkün olan en kısa sürede daha güvenli ve geleceğe dönük mekanizmalarla değiştirilmelidir. -* İzin verilmeyen (Disallowed) mekanizmalar (D) şu anda bozuk kabul edildikleri veya yeterli güvenlik sağlamadıkları için kullanılmamalıdır. - -Bu liste, belirli bir uygulama bağlamında, aşağıdakiler de dahil olmak üzere çeşitli nedenlerle geçersiz kılınabilir: - -* kriptografi alanındaki yeni gelişmeler; -* yönetmeliklere uygunluk. - -## Kriptografik Envanter ve Dokümantasyon - -Bu bölüm V11.1 Kriptografik Envanter -ve Dokümantasyon için ek bilgi sağlamaktadır. - -Algoritmalar, anahtarlar ve sertifikalar gibi tüm kriptografik varlıkların düzenli olarak keşfedildiğinden, envanterinin çıkarıldığından ve değerlendirildiğinden emin olmak önemlidir. Seviye 3 için bu, bir uygulamada kriptografi kullanımını keşfetmek için statik ve dinamik tarama kullanımını içermelidir. SAST ve DAST gibi araçlar bu konuda yardımcı olabilir, ancak daha geniş bir kapsam elde etmek için özel araçlara ihtiyaç duyulması mümkündür. Ücretsiz araç örnekleri şunları içerir: - -* [CryptoMon - Network Cryptography Monitor - using eBPF, written in python](https://github.com/Santandersecurityresearch/CryptoMon) -* [Cryptobom Forge Tool: Generating Comprehensive CBOMs from CodeQL Outputs](https://github.com/Santandersecurityresearch/cryptobom-forge) - -## Kriptografik Parametrelerin Eşdeğer Güçleri - -Çeşitli kriptografik sistemler için göreceli güvenlik güçleri bu tabloda yer almaktadır: [NIST SP 800-57 Kısım 1, syf.71](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final) - -| Güvenlik Gücü | Simetrik Anahtar Algoritmaları | Sonlu Alan | Tamsayı Çarpanlarına Ayırma | Eliptik Eğri (Elliptic Curve) | -|--|--|--|--|--| -| <= 80 | 2TDEA | L = 1024
N = 160 | k = 1024 | f = 160-223 | -| 112 | 3TDEA | L = 2048
N = 224 | k = 2048 | f = 224-255 | -| 128 | AES-128 | L = 3072
N = 256 | k = 3072 | f = 256-383 | -| 192 | AES-192 | L = 7680
N = 384 | k = 7680 | f = 384-511 | -| 256 | AES-256 | L = 15360
N = 512 | k = 15360 | f = 512+ | - -Uygulama örnekleri şunlardır: - -* Sonlu Alan Kriptografisi (Finite Field Cryptography): DSA, FFDH, MQV -* Tamsayı Çarpanlarına Ayırma Kriptografisi (Integer Factorization Cryptography): RSA -* Eliptik Eğri Kriptografisi (Elliptic Curve Cryptography): ECDSA, EdDSA, ECDH, MQV - -Not: Bu bölümde kuantum bilgisayarlarının var olmadığı varsayılmaktadır. Eğer böyle bir bilgisayar var olsaydı, son 3 sütun için yapılan tahminler artık geçerli olmazdı. - -## Rastgele Değerler - -Bu bölümde V11.5 Rastgele Değerler -için ek bilgi sağlanmaktadır. - -| İsim | Sürüm/Referans | Notlar | Durum | -|:---|:----|:----|:-:| -| `/dev/random` | Linux 4.8+ [(Oct 2016)](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=818e607b57c94ade9824dad63a96c2ea6b21baf3), , iOS, Android ve diğer Linux tabanlı POSIX işletim sistemlerinde de bulunur. [RFC7539](https://datatracker.ietf.org/doc/html/rfc7539) temel alınmıştır. | ChaCha20 akışını kullanır. iOS [`SecRandomCopyBytes`](https://developer.apple.com/documentation/security/secrandomcopybytes(_:_:_:)?language=objc) ve Android [`Secure Random`](https://developer.android.com/reference/java/security/SecureRandom) içinde her biri için sağlanan doğru ayarlarla bulunur.| A | -| `/dev/urandom` | Linux çekirdeğinin rastgele veri sağlamak için özel dosyası | Donanım rastgeleliğinden gelen yüksek kaliteli, entropi kaynakları sağlar | A | -| `AES-CTR-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | [Windows CNG API `BCryptGenRandom`](https://learn.microsoft.com/en-us/windows/win32/api/bcrypt/nf-bcrypt-bcryptgenrandom) gibi yaygın uygulamalarda kullanıldığı gibi, [`BCRYPT_RNG_ALGORITHM`](https://learn.microsoft.com/en-us/windows/win32/seccng/cng-algorithm-identifiers) tarafından ayarlanır. | A | -| `HMAC-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | | A | -| `Hash-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | | A | -| `getentropy()` | [OpenBSD](https://man.openbsd.org/getentropy.2), [Linux glibc 2.25+](https://man7.org/linux/man-pages/man3/getentropy.3.html) ve [macOS 10.12+](https://support.apple.com/en-gb/guide/security/seca0c73a75b/web) sürümlerinde mevcuttur. | Doğrudan çekirdeğin entropi kaynağından basit ve minimal bir API ile güvenli rastgele baytlar sağlar. Daha moderndir ve eski API'lerle ilişkili tuzaklardan kaçınır. | A | - -HMAC-DRBG veya Hash-DRBG ile kullanılan temel hash fonksiyonu, bu kullanım için onaylanmış olmalıdır. - -## Şifre (Cipher) Algoritmaları - -Bu bölüm V11.3 Şifreleme Algoritmaları -için ek bilgi sağlar. - -Onaylanan şifre algoritmaları tercih sırasına göre listelenmiştir. - -| Simetrik Anahtar Algoritmaları | Referans | Durum | -| ------ | ------ |:-:| -| AES-256 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | A | -| Salsa20 | [Salsa 20 specification](https://cr.yp.to/snuffle/spec.pdf) | A | -| XChaCha20 | [XChaCha20 Draft](https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-xchacha-03) | A | -| XSalsa20 | [Extending the Salsa20 nonce](https://cr.yp.to/snuffle/xsalsa-20110204.pdf) | A | -| ChaCha20 | [RFC 8439](https://www.rfc-editor.org/info/rfc8439) | A | -| AES-192 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | A | -| AES-128 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | L | -| 2TDEA | | D | -| TDEA (3DES/3DEA) | | D | -| IDEA | | D | -| RC4 | | D | -| Blowfish| | D | -| ARC4 | | D | -| DES | | D | - -### AES Şifre Modları - -AES gibi blok şifreler farklı işlem modları ile kullanılabilir. Elektronik kod kitabı (Electronic codebook - ECB) gibi birçok işlem modu güvensizdir ve kullanılmamalıdır. Galois/Counter Modu (Galois/Counter Mode - GCM) ve şifre blok zincirleme mesaj kimlik doğrulama kodlu Sayaç (CCM) işlem modları, kimliği doğrulanmış şifreleme sağlar ve modern uygulamalarda kullanılmalıdır. - -Onaylanan modlar tercih sırasına göre listelenmiştir. - -| Mod | Kimliği Doğrulanmış | Referans | Durum | Kısıtlama | -|--|--|--|--|--| -| GCM | Evet | [NIST SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | | -| CCM | Evet | [NIST SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | | -| CBC | Hayır | [NIST SP 800-38A](https://csrc.nist.gov/pubs/sp/800/38/a/final) | L | | -| CCM-8 | Evet | | D | | -| ECB | Hayır | | D | | -| CFB | Hayır | | D | | -| OFB | Hayır | | D | | -| CTR | Hayır | | D | | - -Notlar: - -* Tüm şifrelenmiş mesajların kimliği doğrulanmalıdır. CBC modunun herhangi bir kullanımı için, mesajı doğrulamak üzere ilişkili bir karma MAC algoritması olmalıdır. Genel olarak bu, Encrypt-Then-Hash yönteminde uygulanmalıdır (ancak TLS 1.2 bunun yerine Hash-Then-Encrypt kullanır). Eğer bu garanti edilemiyorsa, CBC kullanılmamalıdır. MAC algoritması olmadan şifrelemeye izin verilen tek uygulama disk şifrelemedir. -* Eğer CBC kullanıldıysa, padding doğrulanmasının sabit zamanda gerçekleştirildiği garanti edilmelidir. -* CCM-8 kullanıldığında, MAC etiketi yalnızca 64 bit güvenliğe sahiptir. Bu, en az 128 bit güvenlik gerektiren gereksinim 6.2.9 ile uyumlu değildir. -* Disk şifrelemenin ASVS için kapsam dışı olduğu düşünülmektedir. Bu nedenle bu ekte disk şifreleme için onaylanmış herhangi bir yöntem listelenmemiştir. Bu kullanım için, kimlik doğrulama olmadan şifreleme genellikle kabul edilir ve XTS, XEX ve LRW modları tipik olarak kullanılır. - -### Anahtar Sarma (Key Wrapping) - -Kriptografik anahtar sarma (ve buna karşılık gelen anahtar açma), mevcut bir anahtarı ek bir şifreleme mekanizması kullanarak kapsülleyerek (yani sararak) koruma yöntemidir. Böylece orijinal anahtar, örneğin bir aktarım sırasında açıkça ortaya çıkmaz. Orijinal anahtarı korumak için kullanılan bu ek anahtar sarma anahtarı (wrap key) olarak adlandırılır. - -Bu işlem, güvenilmez olduğu düşünülen yerlerdeki anahtarları korumak veya hassas anahtarları güvenilmeyen ağlar üzerinden ya da uygulamalar içinde göndermek istendiğinde gerçekleştirilebilir. -Ancak, bir sarma/açma prosedürüne girişmeden önce orijinal anahtarın doğasını (örn. kimliği ve amacı) anlamaya ciddi önem verilmelidir, çünkü bunun hem kaynak hem de hedef sistemler/uygulamalar için güvenlik ve özellikle de bir anahtarın işlevinin (örn. imzalama) denetim izlerini ve uygun anahtar depolamayı içerebilecek uyumluluk açısından yansımaları olabilir. - -Özellikle, [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) uyarınca ve kuantum tehdidine karşı ileriye dönük hükümler göz önünde bulundurularak, anahtar sarma için AES-256 kullanılmalıdır. AES kullanan şifre modları tercih sırasına göre şunlardır: - -| Anahtar Sarma | Referans | Durum | -|--|--|--| -| KW | [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) | A | -| KWP | [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) | A | - -Kullanım durumu gerektiriyorsa AES-192 ve AES-128 kullanılabilir. Ancak bunun sebebi ve amacı, kuruluşun kriptografi envanterinde belgelenmelidir. - -### Kimlik Doğrulamalı Şifreleme - -Disk şifreleme haricinde, şifrelenmiş veriler bir çeşit kimliği doğrulanmış şifreleme (authenticated encryption - AE) şeması kullanılarak, genellikle ilişkili verilerle kimliği doğrulanmış şifreleme (authenticated encryption with associated data - AEAD) şeması kullanılarak yetkisiz değişikliklere karşı korunmalıdır. - -Uygulama tercihen onaylı bir AEAD şeması kullanmalıdır. Alternatif olarak onaylı bir şifreleme şeması ile onaylı bir MAC algoritmasını bir Encrypt-then-MAC yapısıyla birleştirebilir. - -MAC-then-encrypt'e eski uygulamalarla uyumluluk için hala izin verilmektedir. TLS v1.2'de eski şifre takımları ile kullanılır. - -| AEAD mekanizması | Referans | Durum | -|---|---------|:-:| -|AES-GCM | [SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | -|AES-CCM | [SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | -|ChaCha-Poly1305 | [RFC 7539](https://datatracker.ietf.org/doc/html/rfc7539) | A | -|AEGIS-256 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | -|AEGIS-128 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | -|AEGIS-128L| [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | -|Encrypt-then-MAC | | A | -|MAC-then-encrypt | | L | - -## Hash Fonksiyonları - -Bu bölümde V11.4 Hashing ve Hash Tabanlı Fonksiyonlar -için ek bilgiler sağlanmaktadır. - -### Genel Kullanım Durumları için Hash Fonksiyonları - -Aşağıdaki tabloda, dijital imzalar gibi genel kriptografik kullanım durumlarında onaylanan hash fonksiyonları listelenmektedir: - -* Onaylanan hash fonksiyonları güçlü çakışma (collision) direnci sağlar ve yüksek güvenlikli uygulamalar için uygundur. -* Bu algoritmalardan bazıları uygun kriptografik anahtar yönetimi ile kullanıldığında saldırılara karşı güçlü direnç sunar ve bu nedenle HMAC, KDF ve RBG işlevleri için ek olarak onaylanmıştır. -* 254 bitten daha az çıktıya sahip hash fonksiyonların çakışma direnci yetersizdir ve dijital imza veya çakışma direnci gerektiren diğer uygulamalar için kullanılmamalıdır. Diğer kullanımlar için, sadece eski sistemlerle uyumluluk ve doğrulama için kullanılabilirler, ancak yeni tasarımlarda kullanılmamalıdırlar. - -| Hash fonksiyonu | Referans | Durum | Kısıtlamalar | -| ------ | ----------- |:-:| ---------- | -| SHA3-512 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | -| SHA-512 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | -| SHA3-384 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | -| SHA-384 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | -| SHA3-256 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | -| SHA-512/256 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | -| SHA-256 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | -| SHAKE256 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | -| BLAKE2s | [BLAKE2: simpler, smaller, fast as MD5](https://eprint.iacr.org/2013/322) | A | | -| BLAKE2b | [BLAKE2: simpler, smaller, fast as MD5](https://eprint.iacr.org/2013/322) | A | | -| BLAKE3 | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | | -| SHA-224 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | L | HMAC, KDF, RBG, dijital imzalar için uygun değildir. | -| SHA-512/224 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | L | HMAC, KDF, RBG, dijital imzalar için uygun değildir. | -| SHA3-224 | [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | L | HMAC, KDF, RBG, dijital imzalar için uygun değildir. | -| SHA-1 | [RFC 3174](https://www.rfc-editor.org/info/rfc3174) & [RFC 6194](https://www.rfc-editor.org/info/rfc6194) | L | HMAC, KDF, RBG, dijital imzalar için uygun değildir. | -| CRC (herhangi bir uzunluk) | | D | | -| MD4 | [RFC 1320](https://www.rfc-editor.org/info/rfc1320) | D | | -| MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | | - -### Parola Saklama için Hash Fonksiyonları - -Güvenli parola hashleme için özel hash fonksiyonları kullanılmalıdır. Bu yavaş hash algoritmaları, parola kırmanın hesaplama zorluğunu artırarak kaba kuvvet ve sözlük saldırılarını azaltır. - -| KDF | Referans | Gerekli Parametreler | Durum | -| ---------- | --------- | ------------ |:-:| -| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1 | A | -| | | t = 2: m ≥ 19456 (19 MiB), p = 1 | A | -| | | t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | -| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8 | A | -| | | p = 2: N ≥ 2^16 (64 MiB), r = 8 | A | -| | | p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | -| bcrypt | [A Future-Adaptable Password Scheme](https://www.researchgate.net/publication/2519476_A_Future-Adaptable_Password_Scheme) | cost ≥ 10 | A | -| PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 210,000 | A | -| PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 600,000 | A | -| PBKDF2-HMAC-SHA-1 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 1,300,000 | L | - -Parola depolama için onaylı parola tabanlı anahtar türetme işlevleri kullanılabilir. - -## Anahtar Türetme İşlevleri (Key Derivation Functions - KDF) - -### Genel Anahtar Türetme Fonksiyonları - -| KDF | Referanslar | Durum | -| ---------------- | -------- |:-:| -| HKDF | [RFC 5869](https://www.rfc-editor.org/info/rfc5869) | A | -| TLS 1.2 PRF | [RFC 5248](https://www.rfc-editor.org/info/rfc5248) | L | -| MD5-based KDFs | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | -| SHA-1-based KDFs | [RFC 3174](https://www.rfc-editor.org/info/rfc3174) & [RFC 6194](https://www.rfc-editor.org/info/rfc6194) | D | - -### Parola Tabanlı Anahtar Türetme İşlevleri - -| KDF | Referans | Gerekli Parametreler | Durum | -| ---------- | --------- | ------------ |:-:| -| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1 | A | -| | | t = 2: m ≥ 19456 (19 MiB), p = 1 | A | -| | | t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | -| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8 | A | -| | | p = 2: N ≥ 2^16 (64 MiB), r = 8 | A | -| | | p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | -| PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 210,000 | A | -| PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 600,000 | A | -| PBKDF2-HMAC-SHA-1 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 1,300,000 | L | - -## Anahtar Değişim Mekanizmaları (Key Exchange Mechanisms - KEX) - -Bu bölümde V11.6 Açık Anahtar Kriptografisi -için ek bilgi sağlanmaktadır. - -### KEX Şemaları - -Tüm anahtar değişimi şemaları için 112 bit veya üzeri bir güvenlik gücü sağlanmalıdır ve bunların uygulanması aşağıdaki tablodaki parametre seçeneklerini takip etmelidir. - -| Şema | Etki Alanı Parametreleri | İleriye Yönelik Gizlilik | Durum | -|--|--|--|:-:| -| Finite Field Diffie-Hellman (FFDH) | L >= 3072 & N >= 256 | Evet | A | -| Elliptic Curve Diffie-Hellman (ECDH) | f >= 256-383 | Evet | A | -| Encrypted key transport with RSA-PKCS#1 v1.5 | | Hayır | D | - -Parametreler aşağıdaki gibidir: - -* k, RSA anahtarları için anahtar boyutudur. -* L açık anahtarın boyutu ve N sonlu alan kriptografisi için özel anahtarın boyutudur. -* f, ECC için anahtar boyutları aralığıdır. - -Herhangi bir yeni uygulama [NIST SP 800-56A](https://csrc.nist.gov/pubs/sp/800/56/a/r3/final) & [B](https://csrc.nist.gov/pubs/sp/800/56/b/r2/final) ve [NIST SP 800-77](https://csrc.nist.gov/pubs/sp/800/77/r1/final) ile uyumlu OLMAYAN herhangi bir şema kullanılmamalıdır. Özellikle, IKEv1 üretimde kullanılmamalıdır. - -### Diffie-Hellman Grupları - -Aşağıdaki gruplar Diffie-Hellman anahtar değişimi uygulamaları için onaylanmıştır. Güvenlik güçleri [NIST SP 800-56A](https://csrc.nist.gov/pubs/sp/800/56/a/r3/final), Ek D ve [NIST SP 800-57 Bölüm 1 Rev.5](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final)'de belgelenmiştir. - -| Group | Status | -|------------------|:------:| -| P-224, secp224r1 | A | -| P-256, secp256r1 | A | -| P-384, secp384r1 | A | -| P-521, secp521r1 | A | -| K-233, sect233k1 | A | -| K-283, sect283k1 | A | -| K-409, sect409k1 | A | -| K-571, sect571k1 | A | -| B-233, sect233r1 | A | -| B-283, sect283r1 | A | -| B-409, sect409r1 | A | -| B-571, sect571r1 | A | -| Curve448 | A | -| Curve25519 | A | -| MODP-2048 | A | -| MODP-3072 | A | -| MODP-4096 | A | -| MODP-6144 | A | -| MODP-8192 | A | -| ffdhe2048 | A | -| ffdhe3072 | A | -| ffdhe4096 | A | -| ffdhe6144 | A | -| ffdhe8192 | A | - -## Mesaj Kimlik Doğrulama Kodları (Message Authentication Codes - MAC) - -Mesaj Kimlik Doğrulama Kodları (MAC), bir mesajın bütünlüğünü ve gerçekliğini doğrulamak için kullanılan kriptografik yapılardır. Bir MAC, girdi olarak bir mesaj ve gizli bir anahtar alır ve sabit boyutlu bir etiket (MAC değeri) üretir. MAC'ler güvenli iletişim protokollerinde (örneğin TLS/SSL) taraflar arasında değiş tokuş edilen mesajların gerçek ve bozulmamış olmasını sağlamak için yaygın olarak kullanılır. - -| MAC Algoritması | Referans | Durum | -| ---------- | --------------- |:-:| -| HMAC-SHA-256 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | -| HMAC-SHA-384 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | -| HMAC-SHA-512 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | -| KMAC128 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | -| KMAC256 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | -| BLAKE3 (keyed_hash mode) | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | -| AES-CMAC | [RFC 4493](https://datatracker.ietf.org/doc/html/rfc4493) & [NIST SP 800-38B](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38b.pdf) | A | -| AES-GMAC | [NIST SP 800-38D](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf) | A | -| Poly1305-AES | [The Poly1305-AES message-authentication code](https://cr.yp.to/mac/poly1305-20050329.pdf) | A | -| HMAC-SHA-1 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | L | -| HMAC-MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | - -## Dijital İmzalar - -İmza şemaları [NIST SP 800-57 Bölüm 1](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final) uyarınca onaylanmış anahtar boyutlarını ve parametrelerini kullanmalıdır. - -| İmza Algoritması | Referans | Durum | -| ------------------------------ | --------------------------------------------- | :-: | -| EdDSA (Ed25519, Ed448) | [RFC 8032](https://www.rfc-editor.org/info/rfc8032) | A | -| XEdDSA (Curve25519, Curve448) | [XEdDSA](https://signal.org/docs/specifications/xeddsa/) | A | -| ECDSA (P-256, P-384, P-521) | [FIPS 186-4](https://csrc.nist.gov/pubs/fips/186-5/final) | A | -| RSA-RSSA-PSS | [RFC 8017](https://www.rfc-editor.org/info/rfc8017) | A | -| RSA-SSA-PKCS#1 v1.5 | [RFC 8017](https://www.rfc-editor.org/info/rfc8017) | D | -| DSA (any key size) | [FIPS 186-4](https://csrc.nist.gov/pubs/fips/186-4/final) | D | - -## Kuantum Sonrası Şifreleme Standartları - -Kuantum sonrası kriptografi (PQC) uygulamaları [FIPS-203](https://csrc.nist.gov/pubs/fips/203/ipd), [FIPS-204](https://csrc.nist.gov/pubs/fips/204/ipd) ve [FIPS-205](https://csrc.nist.gov/pubs/fips/205/ipd) standartlarını takip etmelidir. Şu anda, bu standartlar için çok fazla güçlendirilmiş kod örneği veya referans uygulaması mevcut değildir. Daha fazla ayrıntı için, [Kuantum sonrası şifreleme standartlarının ilk üçüne ilişkin NIST duyurusu (Ağustos 2024)](https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards) adresine bakın. - -Önerilen [mlkem768x25519](https://datatracker.ietf.org/doc/draft-kwiatkowski-tls-ecdhe-mlkem/03/) kuantum sonrası hibrit TLS anahtar anlaşma yöntemi [Firefox sürüm 132](https://www.mozilla.org/en-US/firefox/132.0/releasenotes/) ve [Chrome sürüm 131](https://security.googleblog.com/2024/09/a-new-path-for-kyber-on-web.html) gibi büyük tarayıcılar tarafından desteklenmektedir. Kriptografik test ortamlarında veya endüstri veya devlet onaylı kütüphanelerde mevcut olduğunda kullanılabilir. diff --git a/5.0/tr/0x93-Appendix-D_Recommendations.md b/5.0/tr/0x93-Appendix-D_Recommendations.md deleted file mode 100644 index a0e1924ee0..0000000000 --- a/5.0/tr/0x93-Appendix-D_Recommendations.md +++ /dev/null @@ -1,49 +0,0 @@ -# Ek D: Tavsiyeler - -## Giriş - -Uygulama Güvenliği Doğrulama Standardının (ASVS) 5.0 sürümü hazırlanırken, 5.0'da gereklilik olarak yer almaması gereken bir dizi mevcut ve yeni önerilen öğe olduğu anlaşıldı. Bunun nedeni, 5.0 tanımına göre ASVS kapsamında olmamaları veya alternatif olarak iyi bir fikir olmalarına rağmen zorunlu hale getirilemeyeceklerinin düşünülmesi olabilir. - -Tüm bu maddeleri tamamen kaybetmek istemediğimiz için bazıları bu ekte yer almaktadır. - -## Önerilen, kapsam dahilindeki mekanizmalar - -Aşağıdaki maddeler ASVS için kapsam dahilindedir. Bunlar zorunlu hale getirilmemelidir ancak güvenli bir uygulamanın parçası olarak dikkate alınmaları şiddetle tavsiye edilir. - -* Kullanıcıların daha güçlü bir parola belirlemesine yardımcı olmak için bir parola gücü ölçer sağlanmalıdır. -* Uygulamanın kök dizininde ya da .well-known dizininde, kullanıcıların güvenlik sorunları hakkında sahipleriyle iletişime geçebilecekleri bir bağlantı ya da e-posta adresini açıkça tanımlayan, herkese açık bir security.txt dosyası oluşturulmalıdır. -* İstemci tarafı girdi doğrulaması, güvenilir bir hizmet katmanında doğrulamaya ek olarak zorunlu kılınmalıdır. Çünkü bu, birisinin uygulamaya saldırmak amacıyla istemci tarafı kontrolleri atladığını keşfetmek için iyi bir fırsat sağlamaktadır. -* Bir robots.txt dosyası, X-Robots-Tag yanıt başlığı veya robots html meta etiketi kullanarak yanlışlıkla erişilebilen ve hassas sayfaların arama motorlarında görünmesi önlenmelidir. -* GraphQL kullanırken, yetkilendirmeyi her ayrı arayüzde ele almak zorunda kalmamak için yetkilendirme mantığı GraphQL veya çözümleyici katmanı yerine iş mantığı katmanında uygulanmalıdır. - -Referanslar: - -* [RFC bağlantısı da dahil olmak üzere security.txt hakkında daha fazla bilgi](https://securitytxt.org/) - -## Yazılım Güvenliği İlkeleri - -Aşağıdaki maddeler daha önce ASVS'de yer almaktaydı ancak tam olarak gereklilik değillerdir. Bunlar daha ziyade güvenlik kontrollerini uygularken göz önünde bulundurulması gereken ve takip edildiğinde daha sağlam kontrollere yol açacak ilkelerdir. Bunlar aşağıdakileri içerir: - -* Güvenlik kontrolleri merkezi, basit (tasarım ekonomisi), doğrulanabilir şekilde güvenli ve yeniden kullanılabilir olmalıdır. Bu sayede mükerrer, eksik veya etkisiz kontrollerden kaçınılabilir. -* Mümkün olan her yerde, kontrolleri sıfırdan uygulamaya güvenmek yerine daha önce yazılmış ve iyi incelenmiş güvenlik kontrolü uygulamaları kullanılmalıdır. -* İdeal olarak, korunan verilere ve kaynaklara erişmek için tek bir erişim kontrol mekanizması kullanılmalıdır. Kopyala yapıştır veya güvensiz alternatif yollardan kaçınmak için tüm istekler bu tek mekanizmadan geçmelidir. -* Öznitelik veya özellik tabanlı erişim kontrolü, kodun kullanıcının sadece rolü yerine bir özellik veya veri öğesi için yetkisini kontrol ettiği önerilen bir modeldir. İzinler yine de roller kullanılarak tahsis edilmelidir. - -## Yazılım Güvenliği Süreçleri - -ASVS 5.0'dan kaldırılan ancak hala iyi bir fikir olan bir dizi güvenlik süreci vardır. OWASP SAMM projesi bu süreçlerin nasıl etkili bir şekilde uygulanacağı konusunda iyi bir kaynak olabilir. Daha önce ASVS'de yer alan maddeler şunlardır: - -* Geliştirmenin tüm aşamalarında güvenliği ele alan güvenli bir yazılım geliştirme yaşam döngüsünün kullanıldığı doğrulanmalıdır. -* Tehditleri belirlemek, karşı önlemleri planlamak, uygun risk yanıtlarını kolaylaştırmak ve güvenlik testlerine rehberlik etmek için her tasarım değişikliği veya sprint planlaması için tehdit modellemesinin kullanıldığı doğrulanmalıdır. -* Tüm kullanıcı hikayelerinin ve özelliklerinin işlevsel güvenlik kısıtlamaları içerdiği doğrulanmalıdır. "Bir kullanıcı olarak profilimi görüntüleyebilmeli ve düzenleyebilmeliyim. Başkasının profilini görüntüleyememeli veya düzenleyememeliyim." gibi kısıtlamalar örnek olabilir. -* Tüm geliştiriciler ve test uzmanları için güvenli kodlama kontrol listesi, güvenlik gereksinimleri, kılavuz veya politikanın mevcut olduğu doğrulanmalıdır. -* Uygulama kaynak kodunun arka kapılardan, kötü amaçlı kodlardan (örn. salami saldırıları, mantık bombaları, saatli bombalar) ve belgelenmemiş veya gizli özelliklerden (örn. Easter eggs, güvensiz hata ayıklama araçları) arındırılmış olmasını sağlamak için devam eden bir sürecin var olduğu doğrulanmalıdır. Bu bölüme uymak, üçüncü taraf kütüphaneleri de dahil olmak üzere kaynak koduna tam erişim olmadan mümkün değildir ve bu nedenle muhtemelen yalnızca en yüksek düzeyde güvenlik gerektiren uygulamalar için uygundur. -* Konuşlandırılmış ortamlarda yapılandırma kaymasını tespit etmek ve buna yanıt vermek için mekanizmaların mevcut olduğu doğrulanmalıdır. Bu, değişmez altyapı, güvenli bir taban çizgisinden otomatik yeniden dağıtım veya mevcut durumu onaylanmış yapılandırmalarla karşılaştıran sapma tespit araçlarının kullanılmasını içerebilir. -* Tüm üçüncü taraf ürünlerde, kütüphanelerde, çerçevelerde ve hizmetlerde kendi önerilerine göre yapılandırma sağlamlaştırması yapıldığı doğrulanmalıdır. - -Referanslar: - -* [OWASP Threat Modeling Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html) -* [OWASP Threat modeling](https://owasp.org/www-community/Application_Threat_Modeling) -* [OWASP Software Assurance Maturity Model Project](https://owasp.org/www-project-samm/) -* [Microsoft SDL](https://www.microsoft.com/en-us/securityengineering/sdl/) diff --git a/5.0/tr/0x94-Appendix-E_Contributors.md b/5.0/tr/0x94-Appendix-E_Contributors.md deleted file mode 100644 index 2aeab65e98..0000000000 --- a/5.0/tr/0x94-Appendix-E_Contributors.md +++ /dev/null @@ -1,71 +0,0 @@ -# Ek E - Katkıda Bulunanlar - -ASVS 4.0.0'ın yayınlanmasından bu yana yorum yapan veya pull request açan aşağıdaki kişilerin katkılarını minnetle kabul ediyoruz. - -Herhangi bir hata fark ettiyseniz veya isminizin farklı görünmesini istiyorsanız, lütfen bize bildirin. - -| | | | | -|---|---|---|---| -| Johan Sydseter ([sydseter](https://github.com/sydseter)) | luis servin ([lfservin](https://github.com/lfservin)) | Oleksii Dovydkov ([oleksiidov](https://github.com/oleksiidov)) | IZUKA Masahiro ([maizuka](https://github.com/maizuka)) | -| James Sulinski ([jsulinski](https://github.com/jsulinski)) | Eli Saad ([ThunderSon](https://github.com/ThunderSon)) | [kkshitish9](https://github.com/kkshitish9) | Andrew van der Stock ([vanderaj](https://github.com/vanderaj)) | -| Rick M ([kingthorin](https://github.com/kingthorin)) | Bankde Eakasit ([Bankde](https://github.com/Bankde)) | Michael Gargiullo ([mgargiullo](https://github.com/mgargiullo)) | Raphael Dunant ([Racater](https://github.com/Racater)) | -| Cesar Kohl ([cesarkohl](https://github.com/cesarkohl)) | [inaz0](https://github.com/inaz0) | Joerg Bruenner ([JoergBruenner](https://github.com/JoergBruenner)) | David Deatherage ([securitydave](https://github.com/securitydave)) | -| John Carroll ([yosignals](https://github.com/yosignals)) | Jim Fenton ([jimfenton](https://github.com/jimfenton)) | Matteo Pace ([M4tteoP](https://github.com/M4tteoP)) | Sebastien gioria ([SPoint42](https://github.com/SPoint42)) | -| Steven van der Baan ([vdbaan](https://github.com/vdbaan)) | Jeremy Bonghwan Choi ([jeremychoi](https://github.com/jeremychoi)) | [craig-shony](https://github.com/craig-shony) | Riccardo Sirigu ([ricsirigu](https://github.com/ricsirigu)) | -| Tomasz Wrobel ([tw2as](https://github.com/tw2as)) | Alena Dubeshko ([belalena](https://github.com/belalena)) | Rafael Green ([RafaelGreen1](https://github.com/RafaelGreen1)) | [mjang-cobalt](https://github.com/mjang-cobalt) | -| [clallier94](https://github.com/clallier94) | Kevin W. Wall ([kwwall](https://github.com/kwwall)) | Jordan Sherman ([jsherm-fwdsec](https://github.com/jsherm-fwdsec) / [deleterepo](https://github.com/deleterepo)) | Ingo Rauner ([ingo-rauner](https://github.com/ingo-rauner)) | -| Dirk Wetter ([drwetter](https://github.com/drwetter)) | Moshe Zioni ([moshe-apiiro](https://github.com/moshe-apiiro)) | Patrick Dwyer ([coderpatros](https://github.com/coderpatros)) | David Clarke ([davidclarke-au](https://github.com/davidclarke-au)) | -| Takaharu Ogasa ([takaharuogasa](https://github.com/takaharuogasa)) | Arkadii Yakovets ([arkid15r](https://github.com/arkid15r)) | Motoyasu Saburi ([motoyasu-saburi](https://github.com/motoyasu-saburi)) | [leirn](https://github.com/leirn) | -| [wet-certitude](https://github.com/wet-certitude) | [timhemel](https://github.com/timhemel) | RL Thornton ([thornshadow99](https://github.com/thornshadow99)) | Thomas Bandt ([aspnetde](https://github.com/aspnetde)) | -| Roel Storms ([roelstorms](https://github.com/roelstorms)) | Jeroen Willemsen ([commjoen](https://github.com/commjoen)) | [anonymous-31](https://github.com/anonymous-31) | Kamran Saifullah ([deFr0ggy](https://github.com/deFr0ggy)) | -| Steve Springett ([stevespringett](https://github.com/stevespringett)) | Spyros ([northdpole](https://github.com/northdpole)) | Hans Herrera ([hansphp](https://github.com/hansphp)) | [Marx314](https://github.com/Marx314) | -| [CarlosAllendes](https://github.com/CarlosAllendes) | Yonah Russ ([yruss972](https://github.com/yruss972)) | Sander Maijers ([sanmai-NL](https://github.com/sanmai-NL)) | Luboš Bretschneider ([bretik](https://github.com/bretik)) | -| Eva Sarafianou ([esarafianou](https://github.com/esarafianou)) | Ata Seren [ataseren](https://github.com/ataseren) | Steve Thomas ([Sc00bz](https://github.com/Sc00bz)) | Dominique RIGHETTO ([righettod](https://github.com/righettod)) | -| Steven van der Baan ([svdb-ncc](https://github.com/svdb-ncc)) | Michael Vacarella ([Aif4thah](https://github.com/Aif4thah)) | Tonimir Kisasondi ([tkisason](https://github.com/tkisason)) | Stefan Streichsbier ([streichsbaer](https://github.com/streichsbaer)) | -| [hi-unc1e](https://github.com/hi-unc1e) | sb3k ([starbuck3000](https://github.com/starbuck3000)) | [mario-platt](https://github.com/mario-platt) | Devdatta Akhawe ([devd](https://github.com/devd)) | -| Michael Gissing ([scolytus](https://github.com/scolytus)) | Jet Anderson ([thatsjet](https://github.com/thatsjet)) | Dave Wichers ([davewichers](https://github.com/davewichers)) | Jonny Schnittger ([JonnySchnittger](https://github.com/JonnySchnittger)) | -| Silvia Väli ([silviavali](https://github.com/silviavali)) | [jackgates73](https://github.com/jackgates73) | [1songb1rd](https://github.com/1songb1rd) | Timur - ([timurozkul](https://github.com/timurozkul)) | -| Gareth Heyes ([hackvertor](https://github.com/hackvertor)) | [appills](https://github.com/appills) | [suvikaartinen](https://github.com/suvikaartinen) | chaals ([chaals](https://github.com/chaals)) | -| DanielPharos ([AtlasHackert](https://github.com/AtlasHackert)) | will Farrell ([willfarrell](https://github.com/willfarrell)) | Alina Vasiljeva ([avasiljeva](https://github.com/avasiljeva)) | Paul McCann ([ismisepaul](https://github.com/ismisepaul)) | -| Sage ([SajjadPourali](https://github.com/SajjadPourali)) | [rbsec](https://github.com/rbsec) | Benedikt Bauer ([mastacheata](https://github.com/mastacheata)) | James Jardine ([jamesjardine](https://github.com/jamesjardine)) | -| Mark Burnett ([m8urnett](https://github.com/m8urnett)) | [dschwarz91](https://github.com/dschwarz91) | Cyber-AppSec ([Cyber-AppSec](https://github.com/Cyber-AppSec)) | [Tib3rius](https://github.com/Tib3rius) | -| BitnessWise ([bitnesswise](https://github.com/bitnesswise)) | damienbod ([damienbod](https://github.com/damienbod)) | Jared Meit ([jmeit-fwdsec](https://github.com/jmeit-fwdsec)) | Stefan Seelmann ([sseelmann](https://github.com/sseelmann)) | -| Brendan O'Connor ([ussjoin](https://github.com/ussjoin)) | Andrei Titov ([andrettv](https://github.com/andrettv)) | Hans-Petter Fjeld ([atluxity](https://github.com/atluxity)) | [markehack](https://github.com/markehack) | -| Neil Madden ([NeilMadden](https://github.com/NeilMadden)) | Michael Geramb ([mgeramb](https://github.com/mgeramb)) | Osama Elnaggar ([ossie-git](https://github.com/ossie-git)) | [mackowski](https://github.com/mackowski) | -| Ravi Balla ([raviballa](https://github.com/raviballa)) | Hazana ([hazanasec](https://github.com/hazanasec)) | David Means ([dmeans82](https://github.com/dmeans82)) | Alexander Stein ([tohch4](https://github.com/tohch4)) | -| BaeSenseii ([baesenseii](https://github.com/baesenseii)) | Vincent De Schutter ([VincentDS](https://github.com/VincentDS)) | S Bani ([sbani](https://github.com/sbani)) | Mitsuaki Akiyama ([mak1yama](https://github.com/mak1yama)) | -| Christopher Loessl ([hashier](https://github.com/hashier)) | [victorxm](https://github.com/victorxm) | Michal Rada ([michalradacz](https://github.com/michalradacz)) | Veeresh Devireddy ([drveresh](https://github.com/drveresh)) | -| [MaknaSEO](https://github.com/MaknaSEO) | [darkzero2022](https://github.com/darkzero2022) | Liam ([LiamDobbelaere](https://github.com/LiamDobbelaere)) | Frank Denis ([jedisct1](https://github.com/jedisct1)) | -| Otto Sulin ([ottosulin](https://github.com/ottosulin)) | [carllaw6885](https://github.com/carllaw6885) | Anders Johan Holmefjord ([aholmis](https://github.com/aholmis)) | Richard Fritsch ([rfricz](https://github.com/rfricz)) | -| [mesutgungor](https://github.com/mesutgungor) | Scott Helme ([ScottHelme](https://github.com/ScottHelme)) | Carlo Reggiani ([carloreggiani](https://github.com/carloreggiani)) | Suyash Srivastava ([suyash5053](https://github.com/suyash5053)) | -| Mark Potter ([markonweb](https://github.com/markonweb)) | Arjan Lamers ([alamers](https://github.com/alamers)) | Gøran Breivik ([gobrtg](https://github.com/gobrtg)) | [flo-blg](https://github.com/flo-blg) | -| Guillaume Déflache ([guillaume-d](https://github.com/guillaume-d)) | Toufik Airane ([toufik-airane](https://github.com/toufik-airane)) | Keith Hoodlet ([securingdev](https://github.com/securingdev)) | Sinner ([SoftwareSinner](https://github.com/SoftwareSinner)) | -| [iloving](https://github.com/iloving) | Jeroen Beckers ([TheDauntless](https://github.com/TheDauntless)) | Joubin Jabbari ([joubin](https://github.com/joubin)) | yu fujioka ([fujiokayu](https://github.com/fujiokayu)) | -| execjosh ([execjosh](https://github.com/execjosh)) | Alicja Kario ([tomato42](https://github.com/tomato42)) | Sidney Ribeiro ([srjsoftware](https://github.com/srjsoftware)) | Gabriel Marquet ([Gby56](https://github.com/Gby56)) | -| Drew Schulz ([drschulz](https://github.com/drschulz)) | [bedirhan](https://github.com/bedirhan) | [muralito](https://github.com/muralito) | Ronnie Flathers ([ropnop](https://github.com/ropnop)) | -| Philippe De Ryck ([philippederyck](https://github.com/philippederyck)) | Malte ([mal33](https://github.com/mal33)) | [MazeOfThoughts](https://github.com/MazeOfThoughts) | Andreas Falk ([andifalk](https://github.com/andifalk)) | -| Javi ([javixeneize](https://github.com/javixeneize)) | Daniel Hahn ([averell23](https://github.com/averell23)) | [borislav-c](https://github.com/borislav-c) | Robin Wood ([digininja](https://github.com/digininja)) | -| [miro2ns](https://github.com/miro2ns) | Jan Dockx ([jandockx](https://github.com/jandockx)) | [vipinsaini434](https://github.com/vipinsaini434) | [priyanshukumar397](https://github.com/priyanshukumar397) | -| Nat Sakimura ([sakimura](https://github.com/sakimura)) | Benjamin Häublein ([BenjaminHae](https://github.com/BenjaminHae)) | [unknown-user-from](https://github.com/unknown-user-from) | Ali Ramazan TAŞDELEN ([alitasdln](https://github.com/alitasdln)) | -| Pedro Escaleira ([oEscal](https://github.com/oEscal)) | Josh ([josh-hemphill](https://github.com/josh-hemphill)) | Tim Würtele ([SECtim](https://github.com/SECtim)) | AviD ([avidouglen](https://github.com/avidouglen)) | -| SheHacksPurple ([shehackspurple](https://github.com/shehackspurple)) | [fcerullo-cycubix](https://github.com/fcerullo-cycubix) | Hector Eryx Paredes Camacho ([heryxpc](https://github.com/heryxpc)) | Irene Michlin ([irene221b](https://github.com/irene221b)) | -| Jonah Y-M ([TG-Techie](https://github.com/TG-Techie)) | Dhiraj Bahroos ([bahroos](https://github.com/bahroos)) | Jef Meijvis ([jefmeijvis](https://github.com/jefmeijvis)) | [IzmaDoesItbeta](https://github.com/IzmaDoesItbeta) | -| Abdessamad TEMMAR ([TmmmmmR](https://github.com/TmmmmmR)) | [sectroyer](https://github.com/sectroyer) | Soh Satoh ([sohsatoh](https://github.com/sohsatoh)) | [regoravalaz](https://github.com/regoravalaz) | -| james-t ([james-bitherder](https://github.com/james-bitherder)) | Aram Hovsepyan ([aramhovsepyan](https://github.com/aramhovsepyan)) | [JaimeGomezGarciaSan](https://github.com/JaimeGomezGarciaSan) | [ValdiGit01](https://github.com/ValdiGit01) | -| iwatachan ([ishowta](https://github.com/ishowta)) | Vinod Anandan ([VinodAnandan](https://github.com/VinodAnandan)) | Kevin Kien ([KevinKien](https://github.com/KevinKien)) | [paul-williamson-swoop](https://github.com/paul-williamson-swoop) | -| [endergzr](https://github.com/endergzr) | Radhwan Alshamamri ([Rado0z](https://github.com/Rado0z)) | Grant Ongers ([rewtd](https://github.com/rewtd)) | Cure53 ([cure53](https://github.com/cure53)) | -| [AliR2Linux](https://github.com/AliR2Linux) | Ads Dawson ([GangGreenTemperTatum](https://github.com/GangGreenTemperTatum)) | William Reyor ([BillReyor](https://github.com/BillReyor)) | gabe ([gcrow](https://github.com/gcrow)) | -| [mascotter](https://github.com/mascotter) | [luissaiz](https://github.com/luissaiz) | Suren Manukyan ([vx-sec](https://github.com/vx-sec)) | Piotr Gliźniewicz ([pglizniewicz](https://github.com/pglizniewicz)) | -| Tadeusz Wachowski ([tadeuszwachowski](https://github.com/tadeuszwachowski)) | Nasir aka Nate ([andesec](https://github.com/andesec)) | [settantasette](https://github.com/settantasette) | Lars Haulin ([LarsH](https://github.com/LarsH)) | -| Terence Eden ([edent](https://github.com/edent)) | [JasmineScholz](https://github.com/JasmineScholz) | Arun Sivadasan ([teavanist](https://github.com/teavanist)) | Yusuf GÜR ([yusuffgur](https://github.com/yusuffgur)) | -| Troy Marshall ([troymarshall](https://github.com/troymarshall)) | Tanner Prynn ([tprynn](https://github.com/tprynn)) | Nick K. ([nickific](https://github.com/nickific)) | [raoul361](https://github.com/raoul361) | -| Azeem Ilyas ([TheAxZim](https://github.com/TheAxZim)) | Evo Stamatov ([avioli](https://github.com/avioli)) | Tim Potter ([timpotter87](https://github.com/timpotter87)) | Gavin Ray ([GavinRay97](https://github.com/GavinRay97)) | -| monis ([demideus](https://github.com/demideus)) | Marcin Hoppe ([MarcinHoppe](https://github.com/MarcinHoppe)) | Grambulf ([ramshazar](https://github.com/ramshazar)) | Jordan Pike ([computersarebad](https://github.com/computersarebad)) | -| Jason Rogers ([jason-invision](https://github.com/jason-invision)) | Ben Hall ([benbhall](https://github.com/benbhall)) | JamesPoppyCock ([jamesly123](https://github.com/jamesly123)) | WhiteHackLabs ([whitehacklabs](https://github.com/whitehacklabs)) | -| Alex Gaynor ([alex](https://github.com/alex)) | Filip van Laenen ([filipvanlaenen](https://github.com/filipvanlaenen)) | [jeurgen](https://github.com/jeurgen) | [GraoMelo](https://github.com/GraoMelo) | -| Andreas Kurtz ([ay-kay](https://github.com/ay-kay)) | Tom Tervoort ([TomTervoort](https://github.com/TomTervoort)) | old man ([deveras](https://github.com/deveras)) | Marco Schnüriger ([marcortw](https://github.com/marcortw)) | -| [stiiin](https://github.com/stiiin) | infoseclearn ([teaminfoseclearn](https://github.com/teaminfoseclearn)) | [hljupkij](https://github.com/hljupkij) | Noe ([nmarher](https://github.com/nmarher)) | -| Lyz ([lyz-code](https://github.com/lyz-code)) | Martin Riedel ([mrtnrdl](https://github.com/mrtnrdl)) | KIM Jaesuck ([tcaesvk](https://github.com/tcaesvk)) | Barbara Schachner ([bschach](https://github.com/bschach)) | -| René Reuter ([AresSec](https://github.com/AresSec)) | [carhackpils](https://github.com/carhackpils) | Tyler ([tyler2cr](https://github.com/tyler2cr)) | Hugo ([hasousa](https://github.com/hasousa)) | -| Wouter Bloeyaert ([Someniak](https://github.com/Someniak)) | Mark de Rijk ([markderijkinfosec](https://github.com/markderijkinfosec)) | Ramin ([picohub](https://github.com/picohub)) | Philip D. Turner ([philipdturner](https://github.com/philipdturner)) | -| Will Chatham ([willc](https://github.com/willc)) | | | | diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 15c6dad99b..5e01bca608 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -113,14 +113,14 @@ If you are interested in creating a translation, here are some pointers for how * Spanish, see [#3238](https://github.com/OWASP/ASVS/issues/3238) * Panjabi, see[#3252](https://github.com/OWASP/ASVS/issues/3252) * v5.0.0 - * [Turkish](./5.0/tr/) - * [Russian](./5.0/ru/) - * [French](./5.0/fr/) + * [Turkish](https://github.com/OWASP/ASVS/raw/v5.0.0/5.0/tr/) + * [Russian](https://github.com/OWASP/ASVS/raw/v5.0.0/5.0/ru/) + * [French](https://github.com/OWASP/ASVS/raw/v5.0.0/5.0/fr/) * If the language you are interested in appears, it would be great if you could reach out to the translator to see if you can help them. * Often there is work to do in creating markdown files or updating the translation to keep it up to date with latest changes. -* We would request that you base your translation on the 5.0/en folder in the v5.0.0 branch as this is now static at the 5.0.0 version. +* We would request that you **specifically base your translation** on the 5.0/en folder from the **v5.0.0** branch as this is now static at the 5.0.0 version. * In order to start a translation, please start by forking the ASVS repository. -* Take a copy of the /en folder and rename it to the 2 character language code which will be used for the translation. +* Checkout the **v5.0.0** branch. take a copy of the /en folder and rename it to the 2 character language code which will be used for the translation. * You can then edit the markdown files to include your translation rather than the original English. * When you have completed the translation, please open a Pull Request against the v5.0.0 ASVS branch and one of the leaders will look at integrating it. * The leader will also use the relevant scripts to create the documents from the raw markdown (or you can if you want to save us some trouble). diff --git a/README.md b/README.md index ba2b4f29cf..4571b8e1ae 100644 --- a/README.md +++ b/README.md @@ -54,9 +54,9 @@ If you think you can help with translations, or indeed ensuring the current list Currently available translations: -* [OWASP Application Security Verification Standard 5.0.0 Turkish (PDF)](5.0/OWASP_Application_Security_Verification_Standard_5.0.0_tr.pdf) and [other formats](5.0/docs_tr). (Thanks to [Ata Seren](https://github.com/ataseren)) -* [OWASP Application Security Verification Standard 5.0.0 Russian (PDF)](5.0/OWASP_Application_Security_Verification_Standard_5.0.0_ru.pdf) and [other formats](5.0/docs_ru). (Thanks to [Khalina Daria](https://github.com/whitealisia), [Shnayder Eugenia](https://github.com/ZhenyaShnayder), [Smirnov Vyacheslav](https://github.com/Borgc), [Mukovkin Dmitry](https://github.com/shipko), [Nadezhda](https://github.com/yoshtvoumed), [Fomin Danil](https://github.com/EvtDanya), Sluzhevsky Anton, [Zolotarev Maxim](https://github.com/kibertard), [Gorky Kirill](https://github.com/ToxicSnail), [Nosenko Aleksei](https://github.com/avnosenko)) -* [OWASP Application Security Verification Standard 5.0.0 French (PDF)](5.0/OWASP_Application_Security_Verification_Standard_5.0.0_fr.pdf) and [other formats](5.0/docs_fr). (Thanks to [Cédric Lallier](https://github.com/clallier94), [Alexandre Joly](https://github.com/inaz0), [Michael Vacarella](https://github.com/Aif4thah), [Sebastien Gioria](https://github.com/SPoint42) and [Gabriel Corona](https://github.com/randomstuff)) +* [OWASP Application Security Verification Standard 5.0.0 Turkish (PDF)](https://github.com/OWASP/ASVS/raw/v5.0.0/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_tr.pdf) and [other formats](https://github.com/OWASP/ASVS/raw/v5.0.0/5.0/docs_tr). (Thanks to [Ata Seren](https://github.com/ataseren)) +* [OWASP Application Security Verification Standard 5.0.0 Russian (PDF)](https://github.com/OWASP/ASVS/raw/v5.0.0/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_ru.pdf) and [other formats](https://github.com/OWASP/ASVS/raw/v5.0.0/5.0/docs_ru). (Thanks to [Khalina Daria](https://github.com/whitealisia), [Shnayder Eugenia](https://github.com/ZhenyaShnayder), [Smirnov Vyacheslav](https://github.com/Borgc), [Mukovkin Dmitry](https://github.com/shipko), [Nadezhda](https://github.com/yoshtvoumed), [Fomin Danil](https://github.com/EvtDanya), Sluzhevsky Anton, [Zolotarev Maxim](https://github.com/kibertard), [Gorky Kirill](https://github.com/ToxicSnail), [Nosenko Aleksei](https://github.com/avnosenko)) +* [OWASP Application Security Verification Standard 5.0.0 French (PDF)](https://github.com/OWASP/ASVS/raw/v5.0.0/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_fr.pdf) and [other formats](https://github.com/OWASP/ASVS/raw/v5.0.0/5.0/docs_fr). (Thanks to [Cédric Lallier](https://github.com/clallier94), [Alexandre Joly](https://github.com/inaz0), [Michael Vacarella](https://github.com/Aif4thah), [Sebastien Gioria](https://github.com/SPoint42) and [Gabriel Corona](https://github.com/randomstuff)) Historic translations of the v4.x versions can be found in the [TRANSLATIONS.md file](4.0/TRANSLATIONS.md) in the 4.0 folder. From 03bcb31597d4d770789c1eb52917d2860383c983 Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Wed, 12 Nov 2025 21:39:50 +0200 Subject: [PATCH 66/93] Add Korean translation metadata changes (#3297) * Korean translation metadata changes * Fix link --- .github/workflows/config/local-custom.txt | 11 ++++++++++- 5.0/languages.txt | 2 +- CONTRIBUTING.md | 2 +- README.md | 1 + 4 files changed, 13 insertions(+), 3 deletions(-) diff --git a/.github/workflows/config/local-custom.txt b/.github/workflows/config/local-custom.txt index 896e092b9b..058b7bea73 100644 --- a/.github/workflows/config/local-custom.txt +++ b/.github/workflows/config/local-custom.txt @@ -112,4 +112,13 @@ Alexandre Joly Vacarella Sebastien -Gioria \ No newline at end of file +Gioria +Hyun +Yeong +Wook +Beom +Seung +Gyun +Youn +Hyun +Jeong \ No newline at end of file diff --git a/5.0/languages.txt b/5.0/languages.txt index 883d219491..9e3a1dd9d1 100644 --- a/5.0/languages.txt +++ b/5.0/languages.txt @@ -1 +1 @@ -en tr ru fr \ No newline at end of file +en tr ru fr ko \ No newline at end of file diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 5e01bca608..46272364f2 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -109,13 +109,13 @@ If you are interested in creating a translation, here are some pointers for how * Ukrainian, see [#3174](https://github.com/OWASP/ASVS/issues/3174) * Portuguese, see [#3182](https://github.com/OWASP/ASVS/issues/3182) * Simplified Chinese, see [#3191](https://github.com/OWASP/ASVS/issues/3191) - * Korean, see [#3204](https://github.com/OWASP/ASVS/issues/3204) * Spanish, see [#3238](https://github.com/OWASP/ASVS/issues/3238) * Panjabi, see[#3252](https://github.com/OWASP/ASVS/issues/3252) * v5.0.0 * [Turkish](https://github.com/OWASP/ASVS/raw/v5.0.0/5.0/tr/) * [Russian](https://github.com/OWASP/ASVS/raw/v5.0.0/5.0/ru/) * [French](https://github.com/OWASP/ASVS/raw/v5.0.0/5.0/fr/) + * [Korean](https://github.com/OWASP/ASVS/raw/v5.0.0/5.0/ko/) * If the language you are interested in appears, it would be great if you could reach out to the translator to see if you can help them. * Often there is work to do in creating markdown files or updating the translation to keep it up to date with latest changes. * We would request that you **specifically base your translation** on the 5.0/en folder from the **v5.0.0** branch as this is now static at the 5.0.0 version. diff --git a/README.md b/README.md index 4571b8e1ae..87c4582a4f 100644 --- a/README.md +++ b/README.md @@ -57,6 +57,7 @@ Currently available translations: * [OWASP Application Security Verification Standard 5.0.0 Turkish (PDF)](https://github.com/OWASP/ASVS/raw/v5.0.0/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_tr.pdf) and [other formats](https://github.com/OWASP/ASVS/raw/v5.0.0/5.0/docs_tr). (Thanks to [Ata Seren](https://github.com/ataseren)) * [OWASP Application Security Verification Standard 5.0.0 Russian (PDF)](https://github.com/OWASP/ASVS/raw/v5.0.0/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_ru.pdf) and [other formats](https://github.com/OWASP/ASVS/raw/v5.0.0/5.0/docs_ru). (Thanks to [Khalina Daria](https://github.com/whitealisia), [Shnayder Eugenia](https://github.com/ZhenyaShnayder), [Smirnov Vyacheslav](https://github.com/Borgc), [Mukovkin Dmitry](https://github.com/shipko), [Nadezhda](https://github.com/yoshtvoumed), [Fomin Danil](https://github.com/EvtDanya), Sluzhevsky Anton, [Zolotarev Maxim](https://github.com/kibertard), [Gorky Kirill](https://github.com/ToxicSnail), [Nosenko Aleksei](https://github.com/avnosenko)) * [OWASP Application Security Verification Standard 5.0.0 French (PDF)](https://github.com/OWASP/ASVS/raw/v5.0.0/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_fr.pdf) and [other formats](https://github.com/OWASP/ASVS/raw/v5.0.0/5.0/docs_fr). (Thanks to [Cédric Lallier](https://github.com/clallier94), [Alexandre Joly](https://github.com/inaz0), [Michael Vacarella](https://github.com/Aif4thah), [Sebastien Gioria](https://github.com/SPoint42) and [Gabriel Corona](https://github.com/randomstuff)) +* [OWASP Application Security Verification Standard 5.0.0 Korean (PDF)](https://github.com/OWASP/ASVS/raw/v5.0.0/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_ko.pdf) and [other formats](https://github.com/OWASP/ASVS/raw/v5.0.0/5.0/docs_ko). (Thanks to [박우현(Park WooHyun)](https://github.com/woohyun212), [김용환(Kim YongHwan)](https://github.com/prokyhsigma), [조예진(Jo YeJin)](https://github.com/yejinj), [이본영(Lee BonYeong)](https://github.com/FoO-511), [박재욱(Park JaeWook)](https://github.com/ffinguMac), [박준범(Park JunBeom)](https://github.com/blatter95), [차원제(Cha WonJe)](https://github.com/breakpack), [신승민(Shin SeungMin)](https://github.com/COKEPAIN), [이준서(Lee JunSeo)](https://github.com/typemnm), [박민균(Park MinGyun)](https://github.com/survey05), [윤현정(Youn HyunJung)](https://github.com/kimchiudon), [이지훈(Lee JiHun)](https://github.com/effortjh1112), [김어진(Kim EoJin)](https://github.com/rladjwls57), [오모세(O Moses)](https://github.com/wwwahtp), [정수진(Jeong SooJin)](https://github.com/zsxen), [이하린(Lee HaRin)](https://github.com/sari-harin), [양 진(Yang Jin)](https://github.com/yjiiny) and [정민석(Jung MinSuk)](https://github.com/j93es)) Historic translations of the v4.x versions can be found in the [TRANSLATIONS.md file](4.0/TRANSLATIONS.md) in the 4.0 folder. From bfe61bdeaedb3173206534e4078c9f85f253ff27 Mon Sep 17 00:00:00 2001 From: moehkass <38502759+moehkass@users.noreply.github.com> Date: Sun, 30 Nov 2025 19:38:54 +0200 Subject: [PATCH 67/93] Fix typo in ASVS structure explanation --- 5.0/en/0x03-What-is-the-ASVS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/5.0/en/0x03-What-is-the-ASVS.md b/5.0/en/0x03-What-is-the-ASVS.md index 6ef8a213ac..1c3af2f611 100644 --- a/5.0/en/0x03-What-is-the-ASVS.md +++ b/5.0/en/0x03-What-is-the-ASVS.md @@ -120,7 +120,7 @@ For example, an early-stage startup that is only collecting limited sensitive da The ASVS is made up of a total of around 350 requirements which are divided into 17 chapters, each of which is further divided into sections. -The aim of the chapter and section division is to simplify choosing or filtering out chapters and sections based on the what is relevant for the application. For example, for a machine-to-machine API, the requirements in chapter V3 related to web frontends will not be relevant. If there is no use of OAuth or WebRTC, then those chapters can be ignored as well. +The aim of the chapter and section division is to simplify choosing or filtering out chapters and sections based on what is relevant for the application. For example, for a machine-to-machine API, the requirements in chapter V3 related to web frontends will not be relevant. If there is no use of OAuth or WebRTC, then those chapters can be ignored as well. ### Release strategy From 583e2c8c8f4854bd7f57f8c65341dc5ad86a6e86 Mon Sep 17 00:00:00 2001 From: Andrey Andreev Date: Sun, 7 Dec 2025 22:59:27 +0200 Subject: [PATCH 68/93] Fix #3307: Single PCI Standards link + drop ASVS 4.0 testing guide --- 5.0/en/0x91-Appendix-B_References.md | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/5.0/en/0x91-Appendix-B_References.md b/5.0/en/0x91-Appendix-B_References.md index a0fdd1babb..4e989d6977 100644 --- a/5.0/en/0x91-Appendix-B_References.md +++ b/5.0/en/0x91-Appendix-B_References.md @@ -36,8 +36,4 @@ Similarly, the following websites are most likely to be useful to users/adopters 1. SecLists Github: [https://github.com/danielmiessler/SecLists](https://github.com/danielmiessler/SecLists) 2. MITRE Common Weakness Enumeration: [https://cwe.mitre.org/](https://cwe.mitre.org/) -3. PCI Security Standards Council: [https://www.pcisecuritystandards.org/](https://www.pcisecuritystandards.org/) -4. PCI Data Security Standard (DSS) v3.2.1 Requirements and Security Assessment Procedures: [https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf](https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf) -5. PCI Software Security Framework - Secure Software Requirements and Assessment Procedures: [https://www.pcisecuritystandards.org/documents/PCI-Secure-Software-Standard-v1_0.pdf](https://www.pcisecuritystandards.org/documents/PCI-Secure-Software-Standard-v1_0.pdf) -6. PCI Secure Software Lifecycle (Secure SLC) Requirements and Assessment Procedures: [https://www.pcisecuritystandards.org/documents/PCI-Secure-SLC-Standard-v1_0.pdf](https://www.pcisecuritystandards.org/documents/PCI-Secure-SLC-Standard-v1_0.pdf) -7. OWASP ASVS 4.0 Testing Guide [https://github.com/BlazingWind/OWASP-ASVS-4.0-testing-guide](https://github.com/BlazingWind/OWASP-ASVS-4.0-testing-guide) +3. PCI Security Standards: [https://www.pcisecuritystandards.org/standards/](https://www.pcisecuritystandards.org/standards/) From 428cc5dfbb91b6df411825bf9349de32ff42d607 Mon Sep 17 00:00:00 2001 From: tghosth Date: Sun, 7 Dec 2025 14:45:29 +0200 Subject: [PATCH 69/93] Fix link --- 5.0/en/0x93-Appendix-D_Recommendations.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/5.0/en/0x93-Appendix-D_Recommendations.md b/5.0/en/0x93-Appendix-D_Recommendations.md index fd387b5aaa..33fb030374 100644 --- a/5.0/en/0x93-Appendix-D_Recommendations.md +++ b/5.0/en/0x93-Appendix-D_Recommendations.md @@ -44,6 +44,6 @@ There are a number of security processes which were removed from ASVS 5.0 but ar References: * [OWASP Threat Modeling Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html) -* [OWASP Threat modeling](https://owasp.org/www-project-threat-model/) +* [OWASP Threat modeling](https://owasp.org/www-project-threat-modeling/) * [OWASP Software Assurance Maturity Model Project](https://owasp.org/www-project-samm/) * [Microsoft SDL](https://www.microsoft.com/en-us/securityengineering/sdl/) From d3e22ecef35720c9f38270c4de5d8f69bd375c2e Mon Sep 17 00:00:00 2001 From: Anand kushwaha Date: Sat, 31 Jan 2026 23:45:27 +0530 Subject: [PATCH 70/93] docs: use HTTPS for Creative Commons license link --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 87c4582a4f..94ce63e71c 100644 --- a/README.md +++ b/README.md @@ -9,7 +9,7 @@ This work is licensed under a [![CC BY-SA 4.0][cc-by-sa-image]][cc-by-sa] -[cc-by-sa]: http://creativecommons.org/licenses/by-sa/4.0/ +[cc-by-sa]: https://creativecommons.org/licenses/by-sa/4.0/ [cc-by-sa-image]: https://licensebuttons.net/l/by-sa/4.0/88x31.png [cc-by-sa-shield]: https://img.shields.io/badge/License-CC%20BY--SA%204.0-blue.svg From f3ad55db4adaca79458279735c55d132608562e6 Mon Sep 17 00:00:00 2001 From: Arne Babenhauserheide Date: Tue, 30 Dec 2025 13:21:56 +0100 Subject: [PATCH 71/93] =?UTF-8?q?Reduce=20duplication=20in=20=E2=80=9EWhat?= =?UTF-8?q?=20is=20the=20ASVS=E2=80=9C?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- 5.0/en/0x03-What-is-the-ASVS.md | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/5.0/en/0x03-What-is-the-ASVS.md b/5.0/en/0x03-What-is-the-ASVS.md index 1c3af2f611..3709ed0157 100644 --- a/5.0/en/0x03-What-is-the-ASVS.md +++ b/5.0/en/0x03-What-is-the-ASVS.md @@ -136,9 +136,13 @@ The above specifically relates to the requirements in the ASVS. Changes to surro Several of the points described above, such as documentation requirements and the levels mechanism, provide the ability to use the ASVS in a more flexible and organization-specific way. -Additionally, organizations are strongly encouraged to create an organization- or domain-specific fork that adjusts requirements based on the specific characteristics and risk levels of their applications. However, it is important to maintain traceability so that passing requirement 4.1.1 means the same across all versions. +Additionally, organizations are strongly encouraged to create an organization- or domain-specific fork. -Ideally, each organization should create its own tailored ASVS, omitting irrelevant sections (e.g., GraphQL, WebSockets, SOAP, if unused). An organization-specific ASVS version or supplement is also a good place to provide organization-specific implementation guidance, detailing libraries or resources to use when complying with requirements. +### Forking the ASVS + +Organizations can benefit from adopting ASVS by choosing one of the three levels or by creating a domain-specific fork that adjusts requirements per application risk level. This type of fork is encouraged, provided that it maintains traceability so that passing requirement 4.1.1 means the same across all versions. + +Ideally, each organization should create its own tailored ASVS, omitting irrelevant sections (e.g., GraphQL, Websockets, SOAP, if unused). Forking should start with ASVS Level 1 as a baseline, advancing to Levels 2 or 3 based on the application’s risk. ### How to Reference ASVS Requirements @@ -158,12 +162,6 @@ If identifiers are used without including the `v` element then they sho ASVS requirement lists are made available in CSV, JSON, and other formats which may be useful for reference or programmatic use. -### Forking the ASVS - -Organizations can benefit from adopting ASVS by choosing one of the three levels or by creating a domain-specific fork that adjusts requirements per application risk level. This type of fork is encouraged, provided that it maintains traceability so that passing requirement 4.1.1 means the same across all versions. - -Ideally, each organization should create its own tailored ASVS, omitting irrelevant sections (e.g., GraphQL, Websockets, SOAP, if unused). Forking should start with ASVS Level 1 as a baseline, advancing to Levels 2 or 3 based on the application’s risk. - ## Use cases for the ASVS The ASVS can be used to assess the security of an application and this is explored in more depth in the next chapter. However, several other potential uses for the ASVS (or a forked version) have been identified. From 0a8e38f1c450381c8c0385324e4cec0a80b40343 Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Thu, 19 Feb 2026 12:56:37 +0200 Subject: [PATCH 72/93] Replace deprecated URL checker action with direct invocation (#3332) * Replace deprecated URL checker action with maintained fork gaurav-nelson/github-action-markdown-link-check is explicitly deprecated and points to tcort/github-action-markdown-link-check as its successor. The new action is actively maintained by the upstream markdown-link-check package author and uses the same config file format. Co-Authored-By: Claude Opus 4.6 * Test: add intentionally broken link to verify URL checker This broken link should trigger a failure in the URL checker workflow, confirming the new action correctly detects dead links. This commit should be reverted before merging. Co-Authored-By: Claude Opus 4.6 * Debug: add verbose output and direct markdown-link-check test - Add a step that runs markdown-link-check directly (outside Docker) to see raw output and verify it detects the broken link - Disable quiet mode and enable verbose mode on the action step - This is a temporary debug commit to be reverted Co-Authored-By: Claude Opus 4.6 * Replace Docker-based action with direct markdown-link-check invocation The tcort/github-action-markdown-link-check Docker action has a known bug (#553) where markdown-link-check silently fails inside the container, reporting all links as good without checking anything. This replaces the action with direct npm installation and invocation of markdown-link-check, which works correctly on the runner. Also fixes the PR modified-files detection by using fetch-depth: 0 for proper git diff. Co-Authored-By: Claude Opus 4.6 * Remove intentionally broken test link The URL checker has been verified to correctly detect broken links. Removing the test link added for debugging. Co-Authored-By: Claude Opus 4.6 --------- Co-authored-by: Claude Opus 4.6 --- .github/workflows/url-checker.yml | 42 +++++++++++++++++++++---------- 1 file changed, 29 insertions(+), 13 deletions(-) diff --git a/.github/workflows/url-checker.yml b/.github/workflows/url-checker.yml index 2463ed8960..86e3bc34db 100644 --- a/.github/workflows/url-checker.yml +++ b/.github/workflows/url-checker.yml @@ -17,23 +17,39 @@ jobs: steps: - name: Checkout uses: actions/checkout@v4.2.2 + with: + fetch-depth: 0 + + - name: Install markdown-link-check + run: npm i -g markdown-link-check@3.14.2 - - name: Set options - id: options + - name: Determine files to check + id: files run: | if [[ "${{ github.event_name }}" == "pull_request" ]]; then - echo "check-modified-files-only=yes" >> $GITHUB_OUTPUT - echo "use-verbose-mode=yes" >> $GITHUB_OUTPUT + git diff --name-only --diff-filter=AM origin/${{ github.base_ref }} -- 5.0/ | grep '\.md$' > /tmp/files_to_check.txt || true + echo "mode=modified" >> $GITHUB_OUTPUT else - echo "check-modified-files-only=no" >> $GITHUB_OUTPUT - echo "use-verbose-mode=no" >> $GITHUB_OUTPUT + find 5.0 -name '*.md' -not -path './node_modules/*' > /tmp/files_to_check.txt + echo "mode=all" >> $GITHUB_OUTPUT fi + echo "Checking files (mode: $(cat $GITHUB_OUTPUT | grep mode | cut -d= -f2)):" + cat /tmp/files_to_check.txt - name: Check URLs - uses: gaurav-nelson/github-action-markdown-link-check@v1 - with: - check-modified-files-only: ${{ steps.options.outputs.check-modified-files-only }} - config-file: .github/workflows/config/url-checker-config.json - folder-path: '5.0' - use-quiet-mode: yes - use-verbose-mode: ${{ steps.options.outputs.use-verbose-mode }} + run: | + ERROR_FOUND=0 + while IFS= read -r file; do + if [ -n "$file" ]; then + markdown-link-check "$file" --config .github/workflows/config/url-checker-config.json -q || ERROR_FOUND=1 + fi + done < /tmp/files_to_check.txt + + if [ "$ERROR_FOUND" -eq 1 ]; then + echo "" + echo "ERROR: Dead links were found!" + exit 1 + else + echo "" + echo "All links are good!" + fi From ae1c93dea63c7d4373192e4d6da3b760bfcc7585 Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Mon, 23 Feb 2026 09:22:53 +0200 Subject: [PATCH 73/93] Enhance CONTRIBUTING.md with change control details (#3336) * Enhance CONTRIBUTING.md with change control details Added detailed change control and release process guidelines. * Fix spelling issue in CONTRIBUTING.md --- CONTRIBUTING.md | 93 +++++++++++++++++++++++++++++-------------------- 1 file changed, 55 insertions(+), 38 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 46272364f2..3aefb1c492 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -34,15 +34,65 @@ ASVS releases follow the pattern "Major.Minor.Patch" and the numbers provide inf The above specifically relates to the requirements in the ASVS. Changes to surrounding text and other content such as the appendices will not be considered to be a breaking change. -## How can I help? +### Change control + +In order to make it easier to track changes made on the bleeding edge version of ASVS and prepare new releases, we will follow the following conventions. + +We will make changes on the bleeding edge branch which would be acceptable for minor and patch releases however we will add tags which make clear whether the type of change is breaking or not for a patch. We will not currently make changes that would not be acceptable for a minor release. This basically means no new sections and not requirement moving. + +Tags will start with either: + +* `M` - The change is acceptable for a major release +* `I` - The change is acceptable for a minor release +* `P` - The change is acceptable for a patch release + +The following tags will be used, their meaning should be should be clear and they will be added to the start of the requirement description. + +* Patch tags: + * `[P:WEAKENED]` + * `[P:DELETED]` + * `[P:WORDING]` +* Minor tags: + * `[I:ADDED]` + * `[I:STRENGTHENED]` + * `[I:TRANSFORMED]` (This means the meaning has been entirely changed) + * `[I:MERGED_TO x.y.z ]` (ID defines where the requirement has gone) + * `[I:MERGED_FROM x.y.z, x.y.w]` (IDs define which requirements have been merged into the current one) + * `[I:SPLIT_TO x.y.z, x.y.w]` (IDs define where the requirement has been split to) + * `[I:SPLIT_FROM x.y.z]` (This is like an addition except that the ID defines where the requirement has been split from) +* Major tags (not to be used until we are not going to make any more minor or patch releases before a major release): + * `[M:MOVED_FROM x.y.z]` (ID defines where the requirement has come from) + * `[M:MOVED_TO x.y.z]` (ID defines where the requirement has gone) + +### Release process + +#### Patch release -We would be glad to receive feedback to help us to further enhance the ASVS. Note however that having had intensive efforts to get out the recent release, there may be some delays in responses. Be assured that all issues will eventually be reviewed. +When a patch release comes along, we do the following: -At this stage, we are most likely to immediately accept changes to surrounding text and other content such as the appendices which is not considered a breaking change for release purposes. +* Create a branch for the patch release +* Reverse all requirement changes in the patch branch which are not acceptable for a patch based on the tag on the requirement (guided by tags). +* Manually review the changes which are being reversed out to see if we want to cherry pick some non-breaking changes that were within a requirement which also has breaking changes. +* Remove all tagging from the patch branch and bring the tag details into a separate file representing the changes in this release to act as release notes. +* Remove tags from requirements in the bleeding edge branch for changes that went into the patch branch. Tags should be relative to the previous release. -The next ASVS release is likely to be a "patch" release containing changes which are considered "non-breaking". This means that requirements may be removed (for example, if they are duplicates or outdated) or made less stringent, but an application that complied with the previous release will comply with the patch release as well. We are open to integrating changes that satisfy this definition although we need to decide on a tracking mechanism, which may also lead to a delay. +#### Minor release -If you feel there are other important changes but they would be considered breaking for a patch release, you are welcome to open an issue but please note that the issue may not be progressed until we are considering a new minor or major release, for which there is currently no fixed timeline. +When a minor release comes along, we do the following: + +* Create a branch for the minor release +* Remove all tagging from the minor release branch and bring the tag details into a separate file representing the changes in this release to act as release notes. +* Remove tags from requirements in the bleeding edge branch. Tags should be relative to the previous release. + +#### Major release + +This will be more complicated and will be defined when we get there. + +## How can I help? + +We would be glad to receive feedback to help us to further enhance the ASVS. Whilst there may be some delays in responses, be assured that all issues will eventually be reviewed. + +We are most likely to immediately accept changes to surrounding text and other content such as the appendices which is not considered a breaking change for release purposes but we will also start integrating changes that would require a patch or minor release. For major changes such as moves, you are welcome to open an issue but please note that the issue may not be progressed until we are considering a new major release, for which there is currently no fixed timeline. ## Additional Details for Helping @@ -62,39 +112,6 @@ The mappings in the [mappings folder](https://github.com/OWASP/ASVS/tree/master/ If you are comfortable that your query has not been previously discussed, you can open an issue. Please try and include the ASVS requirement number and text you are talking about in the issue to save having to jump back and forth and please carry out all discussion in the associated issue and not in a PR discussion. - - ## Translations We are now keen to receive translations for v5.0.0 of ASVS! From 63eea77c287b48cb3e27bfac1dcad4580b7bd349 Mon Sep 17 00:00:00 2001 From: wittjoe1 <147606163+wittjoe1@users.noreply.github.com> Date: Thu, 26 Feb 2026 18:46:04 +0100 Subject: [PATCH 74/93] Update 0x92-Appendix-C_Cryptography.md fix linking from Req. 6.2.9 to 11.2.3 --- 5.0/en/0x92-Appendix-C_Cryptography.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/5.0/en/0x92-Appendix-C_Cryptography.md b/5.0/en/0x92-Appendix-C_Cryptography.md index 7581bf1377..a848b7d8cf 100644 --- a/5.0/en/0x92-Appendix-C_Cryptography.md +++ b/5.0/en/0x92-Appendix-C_Cryptography.md @@ -104,7 +104,7 @@ Notes: * All encrypted messages must be authenticated. For ANY use of CBC mode there MUST be an associated hashing MAC algorithm to validate the message. In general, this MUST be applied in the Encrypt-Then-Hash method (but TLS 1.2 uses Hash-Then-Encrypt instead). If this cannot be guaranteed, then CBC MUST NOT be used. The only application where encryption without a MAC algorithm is allowed is disk encryption. * If CBC is used, it shall be guaranteed that the verification of the padding is performed in constant time. -* When using CCM-8, the MAC tag only has 64 bits of security. This does not conform to requirement 6.2.9 which requires at least 128 bits of security. +* When using CCM-8, the MAC tag only has 64 bits of security. This does not conform to requirement 11.2.3 which requires at least 128 bits of security. * Disk encryption is considered out of scope for the ASVS. Therefore this appendix does not list any approved method for disk encryption. For this usage, encryption without authentication is usually accepted and the XTS, XEX and LRW modes are typically used. ### Key Wrapping From ae4ab5b261a72b63edd6a10b4e2d600ea6937e2b Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Mon, 2 Mar 2026 17:51:46 +0200 Subject: [PATCH 75/93] Retry status-0 URL check failures with curl (#3342) * Retry status-0 URL check failures with curl before failing The cr.yp.to links consistently fail with status 0 (connection failure) from GitHub Actions runners despite being valid URLs. - Increase markdown-link-check timeout from default 10s to 30s - Add a retry step that re-checks status-0 failures using curl with retries, so genuine dead links still fail but servers that don't respond to the Node.js HTTP client get a second chance Co-Authored-By: Claude Opus 4.6 * Fix pipefail: tee was swallowing markdown-link-check exit code Adding `| tee` to capture output caused the pipeline exit code to always be 0 (from tee), so link check failures were silently ignored. Adding `set -o pipefail` ensures the pipeline fails when markdown-link-check fails. Co-Authored-By: Claude Opus 4.6 * Use continue-on-error so curl retry can rescue the job The `if: failure()` approach ran the retry step but couldn't change the job outcome. Using `continue-on-error: true` with step ID lets the retry step determine the final pass/fail result. Co-Authored-By: Claude Opus 4.6 --------- Co-authored-by: Claude Opus 4.6 --- .../workflows/config/url-checker-config.json | 1 + .github/workflows/url-checker.yml | 51 ++++++++++++++++++- 2 files changed, 51 insertions(+), 1 deletion(-) diff --git a/.github/workflows/config/url-checker-config.json b/.github/workflows/config/url-checker-config.json index 6ccdec269c..d3c421dadf 100644 --- a/.github/workflows/config/url-checker-config.json +++ b/.github/workflows/config/url-checker-config.json @@ -20,6 +20,7 @@ ], "retryOn429": true, "aliveStatusCodes": [200, 403], + "timeout": "30s", "fallbackRetryDelay": "30s", "see": "https://github.com/tcort/markdown-link-check#config-file-format" } diff --git a/.github/workflows/url-checker.yml b/.github/workflows/url-checker.yml index 86e3bc34db..5e51d5ec65 100644 --- a/.github/workflows/url-checker.yml +++ b/.github/workflows/url-checker.yml @@ -37,11 +37,14 @@ jobs: cat /tmp/files_to_check.txt - name: Check URLs + id: linkcheck + continue-on-error: true run: | + set -o pipefail ERROR_FOUND=0 while IFS= read -r file; do if [ -n "$file" ]; then - markdown-link-check "$file" --config .github/workflows/config/url-checker-config.json -q || ERROR_FOUND=1 + markdown-link-check "$file" --config .github/workflows/config/url-checker-config.json -q 2>&1 | tee -a /tmp/link-check-output.txt || ERROR_FOUND=1 fi done < /tmp/files_to_check.txt @@ -53,3 +56,49 @@ jobs: echo "" echo "All links are good!" fi + + - name: Retry status-0 failures with curl + if: steps.linkcheck.outcome == 'failure' + run: | + echo "Retrying status-0 (connection failure) URLs with curl..." + DEAD_LINKS=0 + + # Extract URLs that failed with status 0 + grep -oP '\[✖\] \Khttps?://\S+(?= → Status: 0)' /tmp/link-check-output.txt > /tmp/status0-urls.txt || true + + if [ ! -s /tmp/status0-urls.txt ]; then + echo "No status-0 failures found to retry - all failures are genuine dead links." + exit 1 + fi + + # Check if there were non-status-0 failures too + NON_ZERO_FAILURES=$(grep '\[✖\]' /tmp/link-check-output.txt | grep -v 'Status: 0' | wc -l) + if [ "$NON_ZERO_FAILURES" -gt 0 ]; then + echo "Found $NON_ZERO_FAILURES non-connection failures (these are genuine dead links):" + grep '\[✖\]' /tmp/link-check-output.txt | grep -v 'Status: 0' + DEAD_LINKS=1 + fi + + echo "" + echo "Retrying $(wc -l < /tmp/status0-urls.txt) status-0 URL(s) with curl..." + echo "" + + while IFS= read -r url; do + if [ -n "$url" ]; then + HTTP_CODE=$(curl -sS -o /dev/null -w "%{http_code}" --max-time 30 --retry 2 --retry-delay 5 -L -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0" "$url" 2>/dev/null || echo "000") + if [ "$HTTP_CODE" -ge 200 ] && [ "$HTTP_CODE" -lt 400 ]; then + echo "[✓] $url → curl status: $HTTP_CODE (OK)" + else + echo "[✖] $url → curl status: $HTTP_CODE (FAILED)" + DEAD_LINKS=1 + fi + fi + done < /tmp/status0-urls.txt + + echo "" + if [ "$DEAD_LINKS" -eq 1 ]; then + echo "ERROR: Dead links confirmed after retry!" + exit 1 + else + echo "All status-0 URLs passed curl retry - links are alive!" + fi From a79c0184f0d5ade9dc4c9f4c0f22362e8136e4af Mon Sep 17 00:00:00 2001 From: Copilot <198982749+Copilot@users.noreply.github.com> Date: Tue, 17 Mar 2026 09:04:40 +0200 Subject: [PATCH 76/93] Remove Jim Manico as active Project Lead; add historical acknowledgement (#3348) * Initial plan * Remove Jim Manico as project leader, add acknowledgement of previous leadership (#3347) Co-authored-by: tghosth <13623828+tghosth@users.noreply.github.com> * Update Jim Manico acknowledgement to reflect full tenure as Project Lead (4.0 through early 5.0) Co-authored-by: tghosth <13623828+tghosth@users.noreply.github.com> * Clarify Jim Manico's full involvement in ASVS from version 1.0 Co-authored-by: tghosth <13623828+tghosth@users.noreply.github.com> * Extend Jim Manico acknowledgement through to after the release of ASVS 5.0 Co-authored-by: tghosth <13623828+tghosth@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: tghosth <13623828+tghosth@users.noreply.github.com> --- 5.0/en/0x01-Frontispiece.md | 9 ++++----- README.md | 2 +- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/5.0/en/0x01-Frontispiece.md b/5.0/en/0x01-Frontispiece.md index b6ad6346a2..6c63b4d983 100644 --- a/5.0/en/0x01-Frontispiece.md +++ b/5.0/en/0x01-Frontispiece.md @@ -18,10 +18,9 @@ For any reuse or distribution, you must clearly communicate the license terms of ## Project Leads -| | | -|---------------------- |----------------- | -| Elar Lang | Josh C Grossman | -| Jim Manico | Daniel Cuthbert | +| | | | +|---------------------- |----------------- |----------------- | +| Daniel Cuthbert | Elar Lang | Josh C Grossman | ## Working Group @@ -43,4 +42,4 @@ We have included a list of the other contributors in Appendix E. If a credit is missing from the 5.x credit list, please log a ticket at GitHub to be recognized in future 5.x updates. -The Application Security Verification Standard builds on the work of those involved in ASVS 1.0 (2008) through 4.0 (2019). Much of the structure and many of the verification items that remain in ASVS today were originally written by Andrew van der Stock, Mike Boberski, Jeff Williams, and Dave Wichers, among numerous other contributors. Thank you to everyone who has contributed in the past. For a comprehensive list of earlier contributors, please consult each prior version. +The Application Security Verification Standard builds on the work of those involved in ASVS 1.0 (2008) through 4.0 (2019). Much of the structure and many of the verification items that remain in ASVS today were originally written by Andrew van der Stock, Mike Boberski, Jeff Williams, and Dave Wichers, among numerous other contributors. We would also like to acknowledge Jim Manico for his significant and long-standing contributions to ASVS, starting as a Lead Author from version 1.0 (2009) and serving as a Project Lead from ASVS 4.0 through to after the release of ASVS 5.0. Thank you to everyone who has contributed in the past. For a comprehensive list of earlier contributors, please consult each prior version. diff --git a/README.md b/README.md index 94ce63e71c..92bc15daa5 100644 --- a/README.md +++ b/README.md @@ -31,7 +31,7 @@ We gratefully recognize the organizations who have supported the project either ## Project Leaders and Working Group -The project is led by the four project leaders [Daniel Cuthbert](https://github.com/danielcuthbert), [Jim Manico](https://github.com/jmanico), [Josh Grossman](https://github.com/tghosth), and [Elar Lang](https://github.com/elarlang). +The project is led by the three project leaders [Daniel Cuthbert](https://github.com/danielcuthbert), [Josh Grossman](https://github.com/tghosth), and [Elar Lang](https://github.com/elarlang). They are supported by the ASVS Working Group which consists of [Shanni Prutchi](https://github.com/EnigmaRosa), [Ralph Andalis](https://github.com/csfreak92), [Meghan Jacquot](https://github.com/meghanjacquot), [Iman Sharafaldin](https://github.com/ImanSharaf), [Ryan Armstrong](https://github.com/ryarmst), [Gabriel Corona](https://github.com/randomstuff), [Tobias Ahnoff](https://github.com/TobiasAhnoff), and [Eden Yardeni](https://github.com/cronchie). From 122d9e0969465a6041e16c806a0464b35deea444 Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Wed, 1 Jul 2026 07:34:47 +0300 Subject: [PATCH 77/93] Remove expired supporters (#3366) * Remove expired supporters Updated supporter logos and links in the SUPPORTERS.md file. * Remove commented-out supporter logos Removed commented-out supporter logos from the document. --- .github/workflows/spell-check.yml | 2 +- SUPPORTERS.md | 4 ---- 2 files changed, 1 insertion(+), 5 deletions(-) diff --git a/.github/workflows/spell-check.yml b/.github/workflows/spell-check.yml index e64367e18e..603db69120 100644 --- a/.github/workflows/spell-check.yml +++ b/.github/workflows/spell-check.yml @@ -58,7 +58,7 @@ jobs: exit 0 fi # Run cspell on all changed files; its exit code will control the workflow outcome - cspell --config .github/workflows/config/cspell.json "${files[@]}" + cspell --no-must-find-files --config .github/workflows/config/cspell.json "${files[@]}" - name: Run cspell on all markdown files (push to main or manual) if: github.event_name != 'pull_request' diff --git a/SUPPORTERS.md b/SUPPORTERS.md index 8cb1571137..08aa897a3a 100644 --- a/SUPPORTERS.md +++ b/SUPPORTERS.md @@ -42,10 +42,6 @@ Organizations who have donated $3,000 or more to the project via OWASP. Supporte Organizations who have donated $500 or more to the project via OWASP. Supporter will be listed in this section for 1 year from the date of the donation. - - -[](https://forwardsecurity.com/)     [](https://en.omegapoint.se/) - ## Associate supporters Organizations who have donated another amount to the project via OWASP. Supporter will be listed in this section for 1 year from the date of the donation. From 9668e23f9e49063095bb060623b73f93b8b3b80f Mon Sep 17 00:00:00 2001 From: Steve Springett Date: Thu, 16 Jul 2026 07:15:20 -0500 Subject: [PATCH 78/93] Corrections to CycloneDX Export (#3355) The existing CycloneDX export did not properly validate against the spec. This change corrects that and includes a few other minor improvements. Co-authored-by: Josh Grossman --- 5.0/tools/cyclonedx.py | 87 ++++++++++++++++++++++-------------------- 1 file changed, 45 insertions(+), 42 deletions(-) diff --git a/5.0/tools/cyclonedx.py b/5.0/tools/cyclonedx.py index 7cf944287a..e8b2737113 100644 --- a/5.0/tools/cyclonedx.py +++ b/5.0/tools/cyclonedx.py @@ -38,7 +38,7 @@ class CycloneDX: bom = {} bom['bomFormat'] = "CycloneDX" - bom['specVersion'] = "1.6" + bom['specVersion'] = "1.7" bom['serialNumber'] = "urn:uuid:" + str(uuid.uuid4()) bom['version'] = 1 bom['metadata'] = {} @@ -51,20 +51,20 @@ class CycloneDX: bom['metadata']['supplier'] = {} bom['metadata']['supplier']['name'] = "OWASP Foundation" bom['metadata']['supplier']['url'] = [ "https://owasp.org" ] - bom['declarations'] = {} - bom['declarations']['standards'] = [] - bom['declarations']['standards'].append({}) + bom['definitions'] = {} + bom['definitions']['standards'] = [] + bom['definitions']['standards'].append({}) def __init__(self, asvs_json_in): self.asvs = asvs_json_in asvs = json.loads(asvs_json_in) bom_ref = asvs["ShortName"] + "-" + asvs["Version"] - self.bom['declarations']['standards'][0]['bom-ref'] = bom_ref - self.bom['declarations']['standards'][0]['name'] = \ + self.bom['definitions']['standards'][0]['bom-ref'] = bom_ref + self.bom['definitions']['standards'][0]['name'] = \ asvs["Name"].replace('Project', '') + "(" + asvs["ShortName"] + ")" - self.bom['declarations']['standards'][0]['version'] = asvs["Version"] - self.bom['declarations']['standards'][0]['description'] = asvs["Description"] - self.bom['declarations']['standards'][0]['owner'] = asvs["Name"] + self.bom['definitions']['standards'][0]['version'] = asvs["Version"] + self.bom['definitions']['standards'][0]['description'] = asvs["Description"] + self.bom['definitions']['standards'][0]['owner'] = asvs["Name"] requirements = [] l1_requirements = [] @@ -89,41 +89,44 @@ def __init__(self, asvs_json_in): elif asvs_requirement['L'] == "3": l3_requirements.append(requirement['bom-ref']) - self.bom['declarations']['standards'][0]['requirements'] = requirements + self.bom['definitions']['standards'][0]['requirements'] = requirements - self.bom['declarations']['standards'][0]['levels'] = [] - self.bom['declarations']['standards'][0]['levels'].append({}) - self.bom['declarations']['standards'][0]['levels'][0] = {} - self.bom['declarations']['standards'][0]['levels'][0]['bom-ref'] = "level-1" - self.bom['declarations']['standards'][0]['levels'][0]['identifier'] = "Level 1" - self.bom['declarations']['standards'][0]['levels'][0]['description'] = "This level contains the minimum requirements to consider when securing an application and represents a critical starting point." - self.bom['declarations']['standards'][0]['levels'][0]['requirements'] = l1_requirements - self.bom['declarations']['standards'][0]['levels'].append({}) - self.bom['declarations']['standards'][0]['levels'][1] = {} - self.bom['declarations']['standards'][0]['levels'][1]['bom-ref'] = "level-2" - self.bom['declarations']['standards'][0]['levels'][1]['identifier'] = "Level 2" - self.bom['declarations']['standards'][0]['levels'][1]['description'] = "ASVS Level 2 requirements generally relate to either less common attacks or more complicated protections against common attacks. They may still be a first layer of defense, or they may require certain preconditions for the attack to be successful." - self.bom['declarations']['standards'][0]['levels'][1]['requirements'] = l2_requirements - self.bom['declarations']['standards'][0]['levels'].append({}) - self.bom['declarations']['standards'][0]['levels'][2] = {} - self.bom['declarations']['standards'][0]['levels'][2]['bom-ref'] = "level-3" - self.bom['declarations']['standards'][0]['levels'][2]['identifier'] = "Level 3" - self.bom['declarations']['standards'][0]['levels'][2]['description'] = "ASVS Level 3 should be the goal for applications looking to demonstrate the highest levels of security and requirements in this section are generally either defense-in-depth mechanisms or other useful but hard-to-implement controls." - self.bom['declarations']['standards'][0]['levels'][2]['requirements'] = l3_requirements + self.bom['definitions']['standards'][0]['levels'] = [] + self.bom['definitions']['standards'][0]['levels'].append({}) + self.bom['definitions']['standards'][0]['levels'][0] = {} + self.bom['definitions']['standards'][0]['levels'][0]['bom-ref'] = "level-1" + self.bom['definitions']['standards'][0]['levels'][0]['identifier'] = "Level 1" + self.bom['definitions']['standards'][0]['levels'][0]['title'] = "Level 1" + self.bom['definitions']['standards'][0]['levels'][0]['description'] = "This level contains the minimum requirements to consider when securing an application and represents a critical starting point." + self.bom['definitions']['standards'][0]['levels'][0]['requirements'] = l1_requirements + self.bom['definitions']['standards'][0]['levels'].append({}) + self.bom['definitions']['standards'][0]['levels'][1] = {} + self.bom['definitions']['standards'][0]['levels'][1]['bom-ref'] = "level-2" + self.bom['definitions']['standards'][0]['levels'][1]['identifier'] = "Level 2" + self.bom['definitions']['standards'][0]['levels'][1]['title'] = "Level 2" + self.bom['definitions']['standards'][0]['levels'][1]['description'] = "ASVS Level 2 requirements generally relate to either less common attacks or more complicated protections against common attacks. They may still be a first layer of defense, or they may require certain preconditions for the attack to be successful." + self.bom['definitions']['standards'][0]['levels'][1]['requirements'] = l2_requirements + self.bom['definitions']['standards'][0]['levels'].append({}) + self.bom['definitions']['standards'][0]['levels'][2] = {} + self.bom['definitions']['standards'][0]['levels'][2]['bom-ref'] = "level-3" + self.bom['definitions']['standards'][0]['levels'][2]['identifier'] = "Level 3" + self.bom['definitions']['standards'][0]['levels'][2]['title'] = "Level 3" + self.bom['definitions']['standards'][0]['levels'][2]['description'] = "ASVS Level 3 should be the goal for applications looking to demonstrate the highest levels of security and requirements in this section are generally either defense-in-depth mechanisms or other useful but hard-to-implement controls." + self.bom['definitions']['standards'][0]['levels'][2]['requirements'] = l3_requirements - self.bom['declarations']['standards'][0]['externalReferences'] = [] - self.bom['declarations']['standards'][0]['externalReferences'].append({}) - self.bom['declarations']['standards'][0]['externalReferences'][0]['type'] = 'website' - self.bom['declarations']['standards'][0]['externalReferences'][0]['url'] = 'https://owasp.org/asvs' - self.bom['declarations']['standards'][0]['externalReferences'].append({}) - self.bom['declarations']['standards'][0]['externalReferences'][1]['type'] = 'vcs' - self.bom['declarations']['standards'][0]['externalReferences'][1]['url'] = 'https://github.com/OWASP/ASVS' - self.bom['declarations']['standards'][0]['externalReferences'].append({}) - self.bom['declarations']['standards'][0]['externalReferences'][2]['type'] = 'issue-tracker' - self.bom['declarations']['standards'][0]['externalReferences'][2]['url'] = 'https://github.com/OWASP/ASVS/issues' - self.bom['declarations']['standards'][0]['externalReferences'].append({}) - self.bom['declarations']['standards'][0]['externalReferences'][3]['type'] = 'social' - self.bom['declarations']['standards'][0]['externalReferences'][3]['url'] = 'https://twitter.com/OWASP_ASVS' + self.bom['definitions']['standards'][0]['externalReferences'] = [] + self.bom['definitions']['standards'][0]['externalReferences'].append({}) + self.bom['definitions']['standards'][0]['externalReferences'][0]['type'] = 'website' + self.bom['definitions']['standards'][0]['externalReferences'][0]['url'] = 'https://owasp.org/asvs' + self.bom['definitions']['standards'][0]['externalReferences'].append({}) + self.bom['definitions']['standards'][0]['externalReferences'][1]['type'] = 'vcs' + self.bom['definitions']['standards'][0]['externalReferences'][1]['url'] = 'https://github.com/OWASP/ASVS' + self.bom['definitions']['standards'][0]['externalReferences'].append({}) + self.bom['definitions']['standards'][0]['externalReferences'][2]['type'] = 'issue-tracker' + self.bom['definitions']['standards'][0]['externalReferences'][2]['url'] = 'https://github.com/OWASP/ASVS/issues' + self.bom['definitions']['standards'][0]['externalReferences'].append({}) + self.bom['definitions']['standards'][0]['externalReferences'][3]['type'] = 'social' + self.bom['definitions']['standards'][0]['externalReferences'][3]['url'] = 'https://twitter.com/OWASP_ASVS' def convert_requirement(self, asvs_requirement, parent): requirement = {} From dcd53e39c46fa13f20fa9fd50d2aebec480eaf8c Mon Sep 17 00:00:00 2001 From: MaknaSEO Date: Thu, 16 Jul 2026 16:09:51 +0330 Subject: [PATCH 79/93] persian translation part 0x00 - 0x94 - Final (#3227) * Add files via upload * Add files via upload * Add files via upload * Add files via upload * Update 0x00-Header.yaml * Update 0x01-Frontispiece.md * Update 0x01-Frontispiece.md * Update 0x01-Frontispiece.md * Update 0x02-Preface.md * Update 0x03-What-is-the-ASVS.md * Update 0x04-Assessment_and_Certification.md * Update 0x05-For-Users-Of-4.0.md * Update 0x10-V1-Encoding-and-Sanitization.md * Update 0x11-V2-Validation-and-Business-Logic.md * Update 0x12-V3-Web-Frontend-Security.md * Update 0x12-V3-Web-Frontend-Security.md * Add files via upload * Update 0x15-V6-Authentication.md * Add files via upload * Update 0x14-V5-File-Handling.md * Update 0x16-V7-Session-Management.md * Update 0x17-V8-Authorization.md * Update 0x18-V9-Self-contained-Tokens.md * Update 0x19-V10-OAuth-and-OIDC.md * Update 0x19-V10-OAuth-and-OIDC.md * Update 0x19-V10-OAuth-and-OIDC.md * Update 0x19-V10-OAuth-and-OIDC.md * Update 0x20-V11-Cryptography.md * Update 0x00-Header.yaml * Update 0x01-Frontispiece.md * Update 0x02-Preface.md * Update 0x03-What-is-the-ASVS.md * Update 0x04-Assessment_and_Certification.md * Update 0x05-For-Users-Of-4.0.md * Update 0x10-V1-Encoding-and-Sanitization.md * Update 0x11-V2-Validation-and-Business-Logic.md * Update 0x12-V3-Web-Frontend-Security.md * Update 0x13-V4-API-and-Web-Service.md * Update 0x14-V5-File-Handling.md * Update 0x15-V6-Authentication.md * Update 0x15-V6-Authentication.md * Update 0x15-V6-Authentication.md * Update 0x15-V6-Authentication.md * Update 0x16-V7-Session-Management.md * Update 0x17-V8-Authorization.md * Update 0x18-V9-Self-contained-Tokens.md * Update 0x17-V8-Authorization.md * Update 0x16-V7-Session-Management.md * Update 0x19-V10-OAuth-and-OIDC.md * Update 0x20-V11-Cryptography.md * Update 0x21-V12-Secure-Communication.md * Update 0x22-V13-Configuration.md * Update 0x23-V14-Data-Protection.md * Update 0x24-V15-Secure-Coding-and-Architecture.md * Update 0x25-V16-Security-Logging-and-Error-Handling.md * Update 0x26-V17-WebRTC.md * Update 0x26-V17-WebRTC.md * Update 0x26-V17-WebRTC.md * Update 0x26-V17-WebRTC.md * Update 0x92-Appendix-C_Cryptography.md * Update 0x94-Appendix-E_Contributors.md * Delete 5.0/en directory * Delete 5.0/fa directory * Delete 5.0/mappings directory * Add files via upload --------- Co-authored-by: Josh Grossman --- 5.0/en/0x92-Appendix-C_Cryptography.md | 120 +++---- 5.0/en/0x94-Appendix-E_Contributors.md | 126 ++++---- 5.0/fa/0x00-Header.yaml | 16 + 5.0/fa/0x01-Frontispiece.md | 45 +++ 5.0/fa/0x02-Preface.md | 29 ++ 5.0/fa/0x03-What-is-the-ASVS.md | 195 +++++++++++ 5.0/fa/0x04-Assessment_and_Certification.md | 47 +++ 5.0/fa/0x05-For-Users-Of-4.0.md | 90 ++++++ 5.0/fa/0x10-V1-Encoding-and-Sanitization.md | 103 ++++++ .../0x11-V2-Validation-and-Business-Logic.md | 73 +++++ 5.0/fa/0x12-V3-Web-Frontend-Security.md | 101 ++++++ 5.0/fa/0x13-V4-API-and-Web-Service.md | 65 ++++ 5.0/fa/0x14-V5-File-Handling.md | 54 ++++ 5.0/fa/0x15-V6-Authentication.md | 164 ++++++++++ 5.0/fa/0x16-V7-Session-Management.md | 91 ++++++ 5.0/fa/0x17-V8-Authorization.md | 56 ++++ 5.0/fa/0x18-V9-Self-contained-Tokens.md | 36 +++ 5.0/fa/0x19-V10-OAuth-and-OIDC.md | 171 ++++++++++ 5.0/fa/0x20-V11-Cryptography.md | 107 ++++++ 5.0/fa/0x21-V12-Secure-Communication.md | 57 ++++ 5.0/fa/0x22-V13-Configuration.md | 68 ++++ 5.0/fa/0x23-V14-Data-Protection.md | 60 ++++ ...0x24-V15-Secure-Coding-and-Architecture.md | 77 +++++ ...V16-Security-Logging-and-Error-Handling.md | 84 +++++ 5.0/fa/0x26-V17-WebRTC.md | 73 +++++ 5.0/fa/0x90-Appendix-A_Glossary.md | 89 +++++ 5.0/fa/0x91-Appendix-B_References.md | 39 +++ 5.0/fa/0x92-Appendix-C_Cryptography.md | 306 ++++++++++++++++++ 5.0/fa/0x93-Appendix-D_Recommendations.md | 49 +++ 5.0/fa/0x94-Appendix-E_Contributors.md | 71 ++++ 5.0/mappings/nist.md | 108 +++---- 31 files changed, 2593 insertions(+), 177 deletions(-) create mode 100644 5.0/fa/0x00-Header.yaml create mode 100644 5.0/fa/0x01-Frontispiece.md create mode 100644 5.0/fa/0x02-Preface.md create mode 100644 5.0/fa/0x03-What-is-the-ASVS.md create mode 100644 5.0/fa/0x04-Assessment_and_Certification.md create mode 100644 5.0/fa/0x05-For-Users-Of-4.0.md create mode 100644 5.0/fa/0x10-V1-Encoding-and-Sanitization.md create mode 100644 5.0/fa/0x11-V2-Validation-and-Business-Logic.md create mode 100644 5.0/fa/0x12-V3-Web-Frontend-Security.md create mode 100644 5.0/fa/0x13-V4-API-and-Web-Service.md create mode 100644 5.0/fa/0x14-V5-File-Handling.md create mode 100644 5.0/fa/0x15-V6-Authentication.md create mode 100644 5.0/fa/0x16-V7-Session-Management.md create mode 100644 5.0/fa/0x17-V8-Authorization.md create mode 100644 5.0/fa/0x18-V9-Self-contained-Tokens.md create mode 100644 5.0/fa/0x19-V10-OAuth-and-OIDC.md create mode 100644 5.0/fa/0x20-V11-Cryptography.md create mode 100644 5.0/fa/0x21-V12-Secure-Communication.md create mode 100644 5.0/fa/0x22-V13-Configuration.md create mode 100644 5.0/fa/0x23-V14-Data-Protection.md create mode 100644 5.0/fa/0x24-V15-Secure-Coding-and-Architecture.md create mode 100644 5.0/fa/0x25-V16-Security-Logging-and-Error-Handling.md create mode 100644 5.0/fa/0x26-V17-WebRTC.md create mode 100644 5.0/fa/0x90-Appendix-A_Glossary.md create mode 100644 5.0/fa/0x91-Appendix-B_References.md create mode 100644 5.0/fa/0x92-Appendix-C_Cryptography.md create mode 100644 5.0/fa/0x93-Appendix-D_Recommendations.md create mode 100644 5.0/fa/0x94-Appendix-E_Contributors.md diff --git a/5.0/en/0x92-Appendix-C_Cryptography.md b/5.0/en/0x92-Appendix-C_Cryptography.md index a848b7d8cf..bc6c0aaee8 100644 --- a/5.0/en/0x92-Appendix-C_Cryptography.md +++ b/5.0/en/0x92-Appendix-C_Cryptography.md @@ -28,9 +28,9 @@ It is important to ensure that all cryptographic assets, such as algorithms, key The relative security strengths for various cryptographic systems are in this table (from [NIST SP 800-57 Part 1](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final), p.71): | Security Strength | Symmetric Key Algorithms | Finite Field | Integer Factorization | Elliptic Curve | -|--|--|--|--|--| +| -- | -- | -- | -- | -- | | <= 80 | 2TDEA | L = 1024
N = 160 | k = 1024 | f = 160-223 | -| 112 | 3TDEA | L = 2048
N = 224 | k = 2048 | f = 224-255 | +| 112 | 3TDEA | L = 2048
N = 224 | k = 2048 | f = 224-255 | | 128 | AES-128 | L = 3072
N = 256 | k = 3072 | f = 256-383 | | 192 | AES-192 | L = 7680
N = 384 | k = 7680 | f = 384-511 | | 256 | AES-256 | L = 15360
N = 512 | k = 15360 | f = 512+ | @@ -49,7 +49,7 @@ This section provides additional information for V11.5 Random Values. | Name | Version/Reference | Notes | Status | -|:---|:----|:----|:-:| +| :--- | :---- | :---- | :-: | | `/dev/random` | Linux 4.8+ [(Oct 2016)](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=818e607b57c94ade9824dad63a96c2ea6b21baf3), also found in iOS, Android, and other Linux-based POSIX operating systems. Based on [RFC7539](https://datatracker.ietf.org/doc/html/rfc7539) | Utilizing ChaCha20 stream. Found in iOS [`SecRandomCopyBytes`](https://developer.apple.com/documentation/security/secrandomcopybytes(_:_:_:)?language=objc) and Android [`Secure Random`](https://developer.android.com/reference/java/security/SecureRandom) with the correct settings provided to each. | A | | `/dev/urandom` | Linux kernel's special file for providing random data | Provides high-quality, entropy sources from hardware randomness | A | | `AES-CTR-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | As used in common implementations, such as [Windows CNG API `BCryptGenRandom`](https://learn.microsoft.com/en-us/windows/win32/api/bcrypt/nf-bcrypt-bcryptgenrandom) set by [`BCRYPT_RNG_ALGORITHM`](https://learn.microsoft.com/en-us/windows/win32/seccng/cng-algorithm-identifiers). | A | @@ -67,7 +67,7 @@ for V11.3 Encryption Algorithms. Approved cipher algorithms are listed in order of preference. | Symmetric Key Algorithms | Reference | Status | -| ------ | ------ |:-:| +| ------ | ------ | :-: | | AES-256 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | A | | Salsa20 | [Salsa 20 specification](https://cr.yp.to/snuffle/spec.pdf) | A | | XChaCha20 | [XChaCha20 Draft](https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-xchacha-03) | A | @@ -79,7 +79,7 @@ Approved cipher algorithms are listed in order of preference. | TDEA (3DES/3DEA) | | D | | IDEA | | D | | RC4 | | D | -| Blowfish| | D | +| Blowfish | | D | | ARC4 | | D | | DES | | D | @@ -90,7 +90,7 @@ Block ciphers, such as AES, can be used with different modes of operations. Many Approved modes are listed in order of preference. | Mode | Authenticated | Reference | Status | Restriction | -|--|--|--|:-:|--| +| -- | -- | -- | :-: | -- | | GCM | Yes | [NIST SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | | | CCM | Yes | [NIST SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | | | CBC | No | [NIST SP 800-38A](https://csrc.nist.gov/pubs/sp/800/38/a/final) | L | | @@ -117,7 +117,7 @@ However, serious consideration should be given to understanding the nature (e.g. Specifically, AES-256 MUST be used for key wrapping, following [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) and considering forward-looking provisions against the quantum threat. Cipher modes using AES are the following, in order of preference: | Key Wrapping | Reference | Status | -|--|--|:-:| +| -- | -- | :-: | | KW | [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) | A | | KWP | [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) | A | @@ -132,15 +132,15 @@ The application should preferably use an approved AEAD scheme. It might alternat MAC-then-encrypt is still allowed for compatibility with legacy applications. It is used in TLS v1.2 with old ciphers suites. | AEAD mechanism | Reference | Status | -|---|---------|:-:| -|AES-GCM | [SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | -|AES-CCM | [SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | -|ChaCha-Poly1305 | [RFC 7539](https://datatracker.ietf.org/doc/html/rfc7539) | A | -|AEGIS-256 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | -|AEGIS-128 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | -|AEGIS-128L| [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | -|Encrypt-then-MAC | | A | -|MAC-then-encrypt | | L | +| --- | --------- | :-: | +| AES-GCM | [SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | +| AES-CCM | [SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | +| ChaCha-Poly1305 | [RFC 7539](https://datatracker.ietf.org/doc/html/rfc7539) | A | +| AEGIS-256 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +| AEGIS-128 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +| AEGIS-128L | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +| Encrypt-then-MAC | | A | +| MAC-then-encrypt | | L | ## Hash Functions @@ -156,15 +156,15 @@ The following table lists hash functions approved in general cryptographic use c * Hash function with less than 254 bit of output have insufficient collision resistance and must not be used for digital signature or other applications requiring collision resistance. For other usages, they might be used for compatibility and verification ONLY with legacy systems but must not be used in new designs. | Hash function | Reference | Status | Restrictions | -| ------ | ----------- |:-:| ---------- | -| SHA3-512 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | -| SHA-512 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | -| SHA3-384 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | -| SHA-384 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | -| SHA3-256 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | -| SHA-512/256 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | -| SHA-256 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | -| SHAKE256 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| ------ | ----------- | :-: | ---------- | +| SHA3-512 | [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| SHA-512 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHA3-384 | [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| SHA-384 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHA3-256 | [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| SHA-512/256 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHA-256 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHAKE256 | [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | | BLAKE2s | [BLAKE2: simpler, smaller, fast as MD5](https://eprint.iacr.org/2013/322) | A | | | BLAKE2b | [BLAKE2: simpler, smaller, fast as MD5](https://eprint.iacr.org/2013/322) | A | | | BLAKE3 | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | | @@ -172,7 +172,7 @@ The following table lists hash functions approved in general cryptographic use c | SHA-512/224 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | L | Not suitable for HMAC, KDF, RBG, digital signatures | | SHA3-224 | [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | L | Not suitable for HMAC, KDF, RBG, digital signatures | | SHA-1 | [RFC 3174](https://www.rfc-editor.org/info/rfc3174) & [RFC 6194](https://www.rfc-editor.org/info/rfc6194) | L | Not suitable for HMAC, KDF, RBG, digital signatures | -| CRC (any length) | | D | | +| CRC (any length) | | D | | | MD4 | [RFC 1320](https://www.rfc-editor.org/info/rfc1320) | D | | | MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | | @@ -180,14 +180,14 @@ The following table lists hash functions approved in general cryptographic use c For secure password hashing, dedicated hash functions must be used. These slow-hashing algorithms mitigate brute-force and dictionary attacks by increasing the computational difficulty of password cracking. -| KDF | Reference | Required Parameters | Status | -| ---------- | --------- | ------------ |:-:| +| KDF | Reference | Required Parameters | Status | +| ---------- | --------- | ------------ | :-: | | argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1 | A | -| | | t = 2: m ≥ 19456 (19 MiB), p = 1 | A | -| | | t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | -| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8 | A | -| | | p = 2: N ≥ 2^16 (64 MiB), r = 8 | A | -| | | p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | +| | | t = 2: m ≥ 19456 (19 MiB), p = 1 | A | +| | | t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | +| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8 | A | +| | | p = 2: N ≥ 2^16 (64 MiB), r = 8 | A | +| | | p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | | bcrypt | [A Future-Adaptable Password Scheme](https://www.researchgate.net/publication/2519476_A_Future-Adaptable_Password_Scheme) | cost ≥ 10 | A | | PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 210,000 | A | | PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 600,000 | A | @@ -199,22 +199,22 @@ Approved password-based key derivations functions can be used for password stora ### General Key Derivation Functions -| KDF | Reference | Status | -| ---------------- | -------- |:-:| -| HKDF | [RFC 5869](https://www.rfc-editor.org/info/rfc5869) | A | -| TLS 1.2 PRF | [RFC 5248](https://www.rfc-editor.org/info/rfc5248) | L | -| MD5-based KDFs | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | +| KDF | Reference | Status | +| ---------------- | -------- |:-: | +| HKDF | [RFC 5869](https://www.rfc-editor.org/info/rfc5869) | A | +| TLS 1.2 PRF | [RFC 5248](https://www.rfc-editor.org/info/rfc5248) | L | +| MD5-based KDFs | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | | SHA-1-based KDFs | [RFC 3174](https://www.rfc-editor.org/info/rfc3174) & [RFC 6194](https://www.rfc-editor.org/info/rfc6194) | D | ### Password-based Key Derivation Functions -| KDF | Reference | Required Parameters | Status | -| ---------- | --------- | ------------ |:-:| -| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1 | A | -| | | t = 2: m ≥ 19456 (19 MiB), p = 1 | A | -| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8 | A | -| | | p = 2: N ≥ 2^16 (64 MiB), r = 8 | A | -| | | p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | +| KDF | Reference | Required Parameters | Status | +| ---------- | --------- | ------------ | :-: | +| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1 | A | +| | | t = 2: m ≥ 19456 (19 MiB), p = 1 | A | +| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8 | A | +| | | p = 2: N ≥ 2^16 (64 MiB), r = 8 | A | +| | | p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | | PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 210,000 | A | | PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 600,000 | A | | PBKDF2-HMAC-SHA-1 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 1,300,000 | L | @@ -228,8 +228,8 @@ for V11.6 Public Key Cryptography. A security strength of 112 bits or above MUST be ensured for all Key Exchange schemes, and their implementation MUST follow the parameter choices in the following table. -| Scheme | Domain Parameters | Forward Secrecy |Status | -|--|--|--|:-:| +| Scheme | Domain Parameters | Forward Secrecy | Status | +| -- | -- | -- | :-: | | Finite Field Diffie-Hellman (FFDH) | L >= 3072 & N >= 256 | Yes | A | | Elliptic Curve Diffie-Hellman (ECDH) | f >= 256-383 | Yes | A | | Encrypted key transport with RSA-PKCS#1 v1.5 | | No | D | @@ -277,19 +277,19 @@ The following groups are approved for implementations of Diffie-Hellman key exch Message Authentication Codes (MACs) are cryptographic constructs used to verify the integrity and authenticity of a message. A MAC takes a message and a secret key as inputs and produces a fixed-size tag (the MAC value). MACs are widely used in secure communication protocols (e.g., TLS/SSL) to ensure that messages exchanged between parties are authentic and intact. -| MAC Algorithm | Reference | Status | -| ---------- | --------------- |:-:| -| HMAC-SHA-256 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | -| HMAC-SHA-384 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | -| HMAC-SHA-512 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | -| KMAC128 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | -| KMAC256 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | -| BLAKE3 (keyed_hash mode) | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | -| AES-CMAC | [RFC 4493](https://datatracker.ietf.org/doc/html/rfc4493) & [NIST SP 800-38B](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38b.pdf) | A | -| AES-GMAC | [NIST SP 800-38D](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf) | A | -| Poly1305-AES | [The Poly1305-AES message-authentication code](https://cr.yp.to/mac/poly1305-20050329.pdf) | A | -| HMAC-SHA-1 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | L | -| HMAC-MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | +| MAC Algorithm | Reference | Status | +| ---------- | --------------- | :-: | +| HMAC-SHA-256 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| HMAC-SHA-384 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| HMAC-SHA-512 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| KMAC128 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | +| KMAC256 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | +| BLAKE3 (keyed_hash mode) | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | +| AES-CMAC | [RFC 4493](https://datatracker.ietf.org/doc/html/rfc4493) & [NIST SP 800-38B](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38b.pdf) | A | +| AES-GMAC | [NIST SP 800-38D](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf) | A | +| Poly1305-AES | [The Poly1305-AES message-authentication code](https://cr.yp.to/mac/poly1305-20050329.pdf) | A | +| HMAC-SHA-1 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | L | +| HMAC-MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | ## Digital Signatures diff --git a/5.0/en/0x94-Appendix-E_Contributors.md b/5.0/en/0x94-Appendix-E_Contributors.md index d03ead0e08..8e807bf9c7 100644 --- a/5.0/en/0x94-Appendix-E_Contributors.md +++ b/5.0/en/0x94-Appendix-E_Contributors.md @@ -5,67 +5,67 @@ We gratefully acknowledge the contributions of the following people who have com If you are aware of any mistakes or would like your name to appear differently, please let us know. | | | | | -|---|---|---|---| -| Johan Sydseter ([sydseter](https://github.com/sydseter)) | luis servin ([lfservin](https://github.com/lfservin)) | Oleksii Dovydkov ([oleksiidov](https://github.com/oleksiidov)) | IZUKA Masahiro ([maizuka](https://github.com/maizuka)) | -| James Sulinski ([jsulinski](https://github.com/jsulinski)) | Eli Saad ([ThunderSon](https://github.com/ThunderSon)) | [kkshitish9](https://github.com/kkshitish9) | Andrew van der Stock ([vanderaj](https://github.com/vanderaj)) | -| Rick M ([kingthorin](https://github.com/kingthorin)) | Bankde Eakasit ([Bankde](https://github.com/Bankde)) | Michael Gargiullo ([mgargiullo](https://github.com/mgargiullo)) | Raphael Dunant ([Racater](https://github.com/Racater)) | -| Cesar Kohl ([cesarkohl](https://github.com/cesarkohl)) | [inaz0](https://github.com/inaz0) | Joerg Bruenner ([JoergBruenner](https://github.com/JoergBruenner)) | David Deatherage ([securitydave](https://github.com/securitydave)) | -| John Carroll ([yosignals](https://github.com/yosignals)) | Jim Fenton ([jimfenton](https://github.com/jimfenton)) | Matteo Pace ([M4tteoP](https://github.com/M4tteoP)) | Sebastien gioria ([SPoint42](https://github.com/SPoint42)) | -| Steven van der Baan ([vdbaan](https://github.com/vdbaan)) | Jeremy Bonghwan Choi ([jeremychoi](https://github.com/jeremychoi)) | [craig-shony](https://github.com/craig-shony) | Riccardo Sirigu ([ricsirigu](https://github.com/ricsirigu)) | -| Tomasz Wrobel ([tw2as](https://github.com/tw2as)) | Alena Dubeshko ([belalena](https://github.com/belalena)) | Rafael Green ([RafaelGreen1](https://github.com/RafaelGreen1)) | [mjang-cobalt](https://github.com/mjang-cobalt) | -| [clallier94](https://github.com/clallier94) | Kevin W. Wall ([kwwall](https://github.com/kwwall)) | Jordan Sherman ([jsherm-fwdsec](https://github.com/jsherm-fwdsec) / [deleterepo](https://github.com/deleterepo)) | Ingo Rauner ([ingo-rauner](https://github.com/ingo-rauner)) | -| Dirk Wetter ([drwetter](https://github.com/drwetter)) | Moshe Zioni ([moshe-apiiro](https://github.com/moshe-apiiro)) | Patrick Dwyer ([coderpatros](https://github.com/coderpatros)) | David Clarke ([davidclarke-au](https://github.com/davidclarke-au)) | -| Takaharu Ogasa ([takaharuogasa](https://github.com/takaharuogasa)) | Arkadii Yakovets ([arkid15r](https://github.com/arkid15r)) | Motoyasu Saburi ([motoyasu-saburi](https://github.com/motoyasu-saburi)) | [leirn](https://github.com/leirn) | -| [wet-certitude](https://github.com/wet-certitude) | [timhemel](https://github.com/timhemel) | RL Thornton ([thornshadow99](https://github.com/thornshadow99)) | Thomas Bandt ([aspnetde](https://github.com/aspnetde)) | -| Roel Storms ([roelstorms](https://github.com/roelstorms)) | Jeroen Willemsen ([commjoen](https://github.com/commjoen)) | [anonymous-31](https://github.com/anonymous-31) | Kamran Saifullah ([deFr0ggy](https://github.com/deFr0ggy)) | -| Steve Springett ([stevespringett](https://github.com/stevespringett)) | Spyros ([northdpole](https://github.com/northdpole)) | Hans Herrera ([hansphp](https://github.com/hansphp)) | [Marx314](https://github.com/Marx314) | -| [CarlosAllendes](https://github.com/CarlosAllendes) | Yonah Russ ([yruss972](https://github.com/yruss972)) | Sander Maijers ([sanmai-NL](https://github.com/sanmai-NL)) | Luboš Bretschneider ([bretik](https://github.com/bretik)) | -| Eva Sarafianou ([esarafianou](https://github.com/esarafianou)) | Ata Seren [ataseren](https://github.com/ataseren) | Steve Thomas ([Sc00bz](https://github.com/Sc00bz)) | Dominique RIGHETTO ([righettod](https://github.com/righettod)) | -| Steven van der Baan ([svdb-ncc](https://github.com/svdb-ncc)) | Michael Vacarella ([Aif4thah](https://github.com/Aif4thah)) | Tonimir Kisasondi ([tkisason](https://github.com/tkisason)) | Stefan Streichsbier ([streichsbaer](https://github.com/streichsbaer)) | -| [hi-unc1e](https://github.com/hi-unc1e) | sb3k ([starbuck3000](https://github.com/starbuck3000)) | [mario-platt](https://github.com/mario-platt) | Devdatta Akhawe ([devd](https://github.com/devd)) | -| Michael Gissing ([scolytus](https://github.com/scolytus)) | Jet Anderson ([thatsjet](https://github.com/thatsjet)) | Dave Wichers ([davewichers](https://github.com/davewichers)) | Jonny Schnittger ([JonnySchnittger](https://github.com/JonnySchnittger)) | -| Silvia Väli ([silviavali](https://github.com/silviavali)) | [jackgates73](https://github.com/jackgates73) | [1songb1rd](https://github.com/1songb1rd) | Timur - ([timurozkul](https://github.com/timurozkul)) | -| Gareth Heyes ([hackvertor](https://github.com/hackvertor)) | [appills](https://github.com/appills) | [suvikaartinen](https://github.com/suvikaartinen) | chaals ([chaals](https://github.com/chaals)) | -| DanielPharos ([AtlasHackert](https://github.com/AtlasHackert)) | will Farrell ([willfarrell](https://github.com/willfarrell)) | Alina Vasiljeva ([avasiljeva](https://github.com/avasiljeva)) | Paul McCann ([ismisepaul](https://github.com/ismisepaul)) | -| Sage ([SajjadPourali](https://github.com/SajjadPourali)) | [rbsec](https://github.com/rbsec) | Benedikt Bauer ([mastacheata](https://github.com/mastacheata)) | James Jardine ([jamesjardine](https://github.com/jamesjardine)) | -| Mark Burnett ([m8urnett](https://github.com/m8urnett)) | [dschwarz91](https://github.com/dschwarz91) | Cyber-AppSec ([Cyber-AppSec](https://github.com/Cyber-AppSec)) | [Tib3rius](https://github.com/Tib3rius) | -| BitnessWise ([bitnesswise](https://github.com/bitnesswise)) | damienbod ([damienbod](https://github.com/damienbod)) | Jared Meit ([jmeit-fwdsec](https://github.com/jmeit-fwdsec)) | Stefan Seelmann ([sseelmann](https://github.com/sseelmann)) | -| Brendan O'Connor ([ussjoin](https://github.com/ussjoin)) | Andrei Titov ([andrettv](https://github.com/andrettv)) | Hans-Petter Fjeld ([atluxity](https://github.com/atluxity)) | [markehack](https://github.com/markehack) | -| Neil Madden ([NeilMadden](https://github.com/NeilMadden)) | Michael Geramb ([mgeramb](https://github.com/mgeramb)) | Osama Elnaggar ([ossie-git](https://github.com/ossie-git)) | [mackowski](https://github.com/mackowski) | -| Ravi Balla ([raviballa](https://github.com/raviballa)) | Hazana ([hazanasec](https://github.com/hazanasec)) | David Means ([dmeans82](https://github.com/dmeans82)) | Alexander Stein ([tohch4](https://github.com/tohch4)) | -| BaeSenseii ([baesenseii](https://github.com/baesenseii)) | Vincent De Schutter ([VincentDS](https://github.com/VincentDS)) | S Bani ([sbani](https://github.com/sbani)) | Mitsuaki Akiyama ([mak1yama](https://github.com/mak1yama)) | -| Christopher Loessl ([hashier](https://github.com/hashier)) | [victorxm](https://github.com/victorxm) | Michal Rada ([michalradacz](https://github.com/michalradacz)) | Veeresh Devireddy ([drveresh](https://github.com/drveresh)) | -| [MaknaSEO](https://github.com/MaknaSEO) | [darkzero2022](https://github.com/darkzero2022) | Liam ([LiamDobbelaere](https://github.com/LiamDobbelaere)) | Frank Denis ([jedisct1](https://github.com/jedisct1)) | -| Otto Sulin ([ottosulin](https://github.com/ottosulin)) | [carllaw6885](https://github.com/carllaw6885) | Anders Johan Holmefjord ([aholmis](https://github.com/aholmis)) | Richard Fritsch ([rfricz](https://github.com/rfricz)) | -| [mesutgungor](https://github.com/mesutgungor) | Scott Helme ([ScottHelme](https://github.com/ScottHelme)) | Carlo Reggiani ([carloreggiani](https://github.com/carloreggiani)) | Suyash Srivastava ([suyash5053](https://github.com/suyash5053)) | -| Mark Potter ([markonweb](https://github.com/markonweb)) | Arjan Lamers ([alamers](https://github.com/alamers)) | Gøran Breivik ([gobrtg](https://github.com/gobrtg)) | [flo-blg](https://github.com/flo-blg) | -| Guillaume Déflache ([guillaume-d](https://github.com/guillaume-d)) | Toufik Airane ([toufik-airane](https://github.com/toufik-airane)) | Keith Hoodlet ([securingdev](https://github.com/securingdev)) | Sinner ([SoftwareSinner](https://github.com/SoftwareSinner)) | -| [iloving](https://github.com/iloving) | Jeroen Beckers ([TheDauntless](https://github.com/TheDauntless)) | Joubin Jabbari ([joubin](https://github.com/joubin)) | yu fujioka ([fujiokayu](https://github.com/fujiokayu)) | -| execjosh ([execjosh](https://github.com/execjosh)) | Alicja Kario ([tomato42](https://github.com/tomato42)) | Sidney Ribeiro ([srjsoftware](https://github.com/srjsoftware)) | Gabriel Marquet ([Gby56](https://github.com/Gby56)) | -| Drew Schulz ([drschulz](https://github.com/drschulz)) | [bedirhan](https://github.com/bedirhan) | [muralito](https://github.com/muralito) | Ronnie Flathers ([ropnop](https://github.com/ropnop)) | -| Philippe De Ryck ([philippederyck](https://github.com/philippederyck)) | Malte ([mal33](https://github.com/mal33)) | [MazeOfThoughts](https://github.com/MazeOfThoughts) | Andreas Falk ([andifalk](https://github.com/andifalk)) | -| Javi ([javixeneize](https://github.com/javixeneize)) | Daniel Hahn ([averell23](https://github.com/averell23)) | [borislav-c](https://github.com/borislav-c) | Robin Wood ([digininja](https://github.com/digininja)) | -| [miro2ns](https://github.com/miro2ns) | Jan Dockx ([jandockx](https://github.com/jandockx)) | [vipinsaini434](https://github.com/vipinsaini434) | [priyanshukumar397](https://github.com/priyanshukumar397) | -| Nat Sakimura ([sakimura](https://github.com/sakimura)) | Benjamin Häublein ([BenjaminHae](https://github.com/BenjaminHae)) | [unknown-user-from](https://github.com/unknown-user-from) | Ali Ramazan TAŞDELEN ([alitasdln](https://github.com/alitasdln)) | -| Pedro Escaleira ([oEscal](https://github.com/oEscal)) | Josh ([josh-hemphill](https://github.com/josh-hemphill)) | Tim Würtele ([SECtim](https://github.com/SECtim)) | AviD ([avidouglen](https://github.com/avidouglen)) | -| SheHacksPurple ([shehackspurple](https://github.com/shehackspurple)) | [fcerullo-cycubix](https://github.com/fcerullo-cycubix) | Hector Eryx Paredes Camacho ([heryxpc](https://github.com/heryxpc)) | Irene Michlin ([irene221b](https://github.com/irene221b)) | -| Jonah Y-M ([TG-Techie](https://github.com/TG-Techie)) | Dhiraj Bahroos ([bahroos](https://github.com/bahroos)) | Jef Meijvis ([jefmeijvis](https://github.com/jefmeijvis)) | [IzmaDoesItbeta](https://github.com/IzmaDoesItbeta) | -| Abdessamad TEMMAR ([TmmmmmR](https://github.com/TmmmmmR)) | [sectroyer](https://github.com/sectroyer) | Soh Satoh ([sohsatoh](https://github.com/sohsatoh)) | [regoravalaz](https://github.com/regoravalaz) | -| james-t ([james-bitherder](https://github.com/james-bitherder)) | Aram Hovsepyan ([aramhovsepyan](https://github.com/aramhovsepyan)) | [JaimeGomezGarciaSan](https://github.com/JaimeGomezGarciaSan) | [ValdiGit01](https://github.com/ValdiGit01) | -| iwatachan ([ishowta](https://github.com/ishowta)) | Vinod Anandan ([VinodAnandan](https://github.com/VinodAnandan)) | Kevin Kien ([KevinKien](https://github.com/KevinKien)) | [paul-williamson-swoop](https://github.com/paul-williamson-swoop) | -| [endergzr](https://github.com/endergzr) | Radhwan Alshamamri ([Rado0z](https://github.com/Rado0z)) | Grant Ongers ([rewtd](https://github.com/rewtd)) | Cure53 ([cure53](https://github.com/cure53)) | -| [AliR2Linux](https://github.com/AliR2Linux) | Ads Dawson ([GangGreenTemperTatum](https://github.com/GangGreenTemperTatum)) | William Reyor ([BillReyor](https://github.com/BillReyor)) | gabe ([gcrow](https://github.com/gcrow)) | -| [mascotter](https://github.com/mascotter) | [luissaiz](https://github.com/luissaiz) | Suren Manukyan ([vx-sec](https://github.com/vx-sec)) | Piotr Gliźniewicz ([pglizniewicz](https://github.com/pglizniewicz)) | -| Tadeusz Wachowski ([tadeuszwachowski](https://github.com/tadeuszwachowski)) | Nasir aka Nate ([andesec](https://github.com/andesec)) | [settantasette](https://github.com/settantasette) | Lars Haulin ([LarsH](https://github.com/LarsH)) | -| Terence Eden ([edent](https://github.com/edent)) | [JasmineScholz](https://github.com/JasmineScholz) | Arun Sivadasan ([teavanist](https://github.com/teavanist)) | Yusuf GÜR ([yusuffgur](https://github.com/yusuffgur)) | -| Troy Marshall ([troymarshall](https://github.com/troymarshall)) | Tanner Prynn ([tprynn](https://github.com/tprynn)) | Nick K. ([nickific](https://github.com/nickific)) | [raoul361](https://github.com/raoul361) | -| Azeem Ilyas ([TheAxZim](https://github.com/TheAxZim)) | Evo Stamatov ([avioli](https://github.com/avioli)) | Tim Potter ([timpotter87](https://github.com/timpotter87)) | Gavin Ray ([GavinRay97](https://github.com/GavinRay97)) | -| monis ([demideus](https://github.com/demideus)) | Marcin Hoppe ([MarcinHoppe](https://github.com/MarcinHoppe)) | Grambulf ([ramshazar](https://github.com/ramshazar)) | Jordan Pike ([computersarebad](https://github.com/computersarebad)) | -| Jason Rogers ([jason-invision](https://github.com/jason-invision)) | Ben Hall ([benbhall](https://github.com/benbhall)) | JamesPoppyCock ([jamesly123](https://github.com/jamesly123)) | WhiteHackLabs ([whitehacklabs](https://github.com/whitehacklabs)) | -| Alex Gaynor ([alex](https://github.com/alex)) | Filip van Laenen ([filipvanlaenen](https://github.com/filipvanlaenen)) | [jeurgen](https://github.com/jeurgen) | [GraoMelo](https://github.com/GraoMelo) | -| Andreas Kurtz ([ay-kay](https://github.com/ay-kay)) | Tom Tervoort ([TomTervoort](https://github.com/TomTervoort)) | old man ([deveras](https://github.com/deveras)) | Marco Schnüriger ([marcortw](https://github.com/marcortw)) | -| [stiiin](https://github.com/stiiin) | infoseclearn ([teaminfoseclearn](https://github.com/teaminfoseclearn)) | [hljupkij](https://github.com/hljupkij) | Noe ([nmarher](https://github.com/nmarher)) | -| Lyz ([lyz-code](https://github.com/lyz-code)) | Martin Riedel ([mrtnrdl](https://github.com/mrtnrdl)) | KIM Jaesuck ([tcaesvk](https://github.com/tcaesvk)) | Barbara Schachner ([bschach](https://github.com/bschach)) | -| René Reuter ([AresSec](https://github.com/AresSec)) | [carhackpils](https://github.com/carhackpils) | Tyler ([tyler2cr](https://github.com/tyler2cr)) | Hugo ([hasousa](https://github.com/hasousa)) | -| Wouter Bloeyaert ([Someniak](https://github.com/Someniak)) | Mark de Rijk ([markderijkinfosec](https://github.com/markderijkinfosec)) | Ramin ([picohub](https://github.com/picohub)) | Philip D. Turner ([philipdturner](https://github.com/philipdturner)) | +| --- | --- | --- | --- | +| Johan Sydseter ([sydseter](https://github.com/sydseter)) | luis servin ([lfservin](https://github.com/lfservin)) | Oleksii Dovydkov ([oleksiidov](https://github.com/oleksiidov)) | IZUKA Masahiro ([maizuka](https://github.com/maizuka)) | +| James Sulinski ([jsulinski](https://github.com/jsulinski)) | Eli Saad ([ThunderSon](https://github.com/ThunderSon)) | [kkshitish9](https://github.com/kkshitish9) | Andrew van der Stock ([vanderaj](https://github.com/vanderaj)) | +| Rick M ([kingthorin](https://github.com/kingthorin)) | Bankde Eakasit ([Bankde](https://github.com/Bankde)) | Michael Gargiullo ([mgargiullo](https://github.com/mgargiullo)) | Raphael Dunant ([Racater](https://github.com/Racater)) | +| Cesar Kohl ([cesarkohl](https://github.com/cesarkohl)) | [inaz0](https://github.com/inaz0) | Joerg Bruenner ([JoergBruenner](https://github.com/JoergBruenner)) | David Deatherage ([securitydave](https://github.com/securitydave)) | +| John Carroll ([yosignals](https://github.com/yosignals)) | Jim Fenton ([jimfenton](https://github.com/jimfenton)) | Matteo Pace ([M4tteoP](https://github.com/M4tteoP)) | Sebastien gioria ([SPoint42](https://github.com/SPoint42)) | +| Steven van der Baan ([vdbaan](https://github.com/vdbaan)) | Jeremy Bonghwan Choi ([jeremychoi](https://github.com/jeremychoi)) | [craig-shony](https://github.com/craig-shony) | Riccardo Sirigu ([ricsirigu](https://github.com/ricsirigu)) | +| Tomasz Wrobel ([tw2as](https://github.com/tw2as)) | Alena Dubeshko ([belalena](https://github.com/belalena)) | Rafael Green ([RafaelGreen1](https://github.com/RafaelGreen1)) | [mjang-cobalt](https://github.com/mjang-cobalt) | +| [clallier94](https://github.com/clallier94) | Kevin W. Wall ([kwwall](https://github.com/kwwall)) | Jordan Sherman ([jsherm-fwdsec](https://github.com/jsherm-fwdsec) / [deleterepo](https://github.com/deleterepo)) | Ingo Rauner ([ingo-rauner](https://github.com/ingo-rauner)) | +| Dirk Wetter ([drwetter](https://github.com/drwetter)) | Moshe Zioni ([moshe-apiiro](https://github.com/moshe-apiiro)) | Patrick Dwyer ([coderpatros](https://github.com/coderpatros)) | David Clarke ([davidclarke-au](https://github.com/davidclarke-au)) | +| Takaharu Ogasa ([takaharuogasa](https://github.com/takaharuogasa)) | Arkadii Yakovets ([arkid15r](https://github.com/arkid15r)) | Motoyasu Saburi ([motoyasu-saburi](https://github.com/motoyasu-saburi)) | [leirn](https://github.com/leirn) | +| [wet-certitude](https://github.com/wet-certitude) | [timhemel](https://github.com/timhemel) | RL Thornton ([thornshadow99](https://github.com/thornshadow99)) | Thomas Bandt ([aspnetde](https://github.com/aspnetde)) | +| Roel Storms ([roelstorms](https://github.com/roelstorms)) | Jeroen Willemsen ([commjoen](https://github.com/commjoen)) | [anonymous-31](https://github.com/anonymous-31) | Kamran Saifullah ([deFr0ggy](https://github.com/deFr0ggy)) | +| Steve Springett ([stevespringett](https://github.com/stevespringett)) | Spyros ([northdpole](https://github.com/northdpole)) | Hans Herrera ([hansphp](https://github.com/hansphp)) | [Marx314](https://github.com/Marx314) | +| [CarlosAllendes](https://github.com/CarlosAllendes) | Yonah Russ ([yruss972](https://github.com/yruss972)) | Sander Maijers ([sanmai-NL](https://github.com/sanmai-NL)) | Luboš Bretschneider ([bretik](https://github.com/bretik)) | +| Eva Sarafianou ([esarafianou](https://github.com/esarafianou)) | Ata Seren [ataseren](https://github.com/ataseren) | Steve Thomas ([Sc00bz](https://github.com/Sc00bz)) | Dominique RIGHETTO ([righettod](https://github.com/righettod)) | +| Steven van der Baan ([svdb-ncc](https://github.com/svdb-ncc)) | Michael Vacarella ([Aif4thah](https://github.com/Aif4thah)) | Tonimir Kisasondi ([tkisason](https://github.com/tkisason)) | Stefan Streichsbier ([streichsbaer](https://github.com/streichsbaer)) | +| [hi-unc1e](https://github.com/hi-unc1e) | sb3k ([starbuck3000](https://github.com/starbuck3000)) | [mario-platt](https://github.com/mario-platt) | Devdatta Akhawe ([devd](https://github.com/devd)) | +| Michael Gissing ([scolytus](https://github.com/scolytus)) | Jet Anderson ([thatsjet](https://github.com/thatsjet)) | Dave Wichers ([davewichers](https://github.com/davewichers)) | Jonny Schnittger ([JonnySchnittger](https://github.com/JonnySchnittger)) | +| Silvia Väli ([silviavali](https://github.com/silviavali)) | [jackgates73](https://github.com/jackgates73) | [1songb1rd](https://github.com/1songb1rd) | Timur - ([timurozkul](https://github.com/timurozkul)) | +| Gareth Heyes ([hackvertor](https://github.com/hackvertor)) | [appills](https://github.com/appills) | [suvikaartinen](https://github.com/suvikaartinen) | chaals ([chaals](https://github.com/chaals)) | +| DanielPharos ([AtlasHackert](https://github.com/AtlasHackert)) | will Farrell ([willfarrell](https://github.com/willfarrell)) | Alina Vasiljeva ([avasiljeva](https://github.com/avasiljeva)) | Paul McCann ([ismisepaul](https://github.com/ismisepaul)) | +| Sage ([SajjadPourali](https://github.com/SajjadPourali)) | [rbsec](https://github.com/rbsec) | Benedikt Bauer ([mastacheata](https://github.com/mastacheata)) | James Jardine ([jamesjardine](https://github.com/jamesjardine)) | +| Mark Burnett ([m8urnett](https://github.com/m8urnett)) | [dschwarz91](https://github.com/dschwarz91) | Cyber-AppSec ([Cyber-AppSec](https://github.com/Cyber-AppSec)) | [Tib3rius](https://github.com/Tib3rius) | +| BitnessWise ([bitnesswise](https://github.com/bitnesswise)) | damienbod ([damienbod](https://github.com/damienbod)) | Jared Meit ([jmeit-fwdsec](https://github.com/jmeit-fwdsec)) | Stefan Seelmann ([sseelmann](https://github.com/sseelmann)) | +| Brendan O'Connor ([ussjoin](https://github.com/ussjoin)) | Andrei Titov ([andrettv](https://github.com/andrettv)) | Hans-Petter Fjeld ([atluxity](https://github.com/atluxity)) | [markehack](https://github.com/markehack) | +| Neil Madden ([NeilMadden](https://github.com/NeilMadden)) | Michael Geramb ([mgeramb](https://github.com/mgeramb)) | Osama Elnaggar ([ossie-git](https://github.com/ossie-git)) | [mackowski](https://github.com/mackowski) | +| Ravi Balla ([raviballa](https://github.com/raviballa)) | Hazana ([hazanasec](https://github.com/hazanasec)) | David Means ([dmeans82](https://github.com/dmeans82)) | Alexander Stein ([tohch4](https://github.com/tohch4)) | +| BaeSenseii ([baesenseii](https://github.com/baesenseii)) | Vincent De Schutter ([VincentDS](https://github.com/VincentDS)) | S Bani ([sbani](https://github.com/sbani)) | Mitsuaki Akiyama ([mak1yama](https://github.com/mak1yama)) | +| Christopher Loessl ([hashier](https://github.com/hashier)) | [victorxm](https://github.com/victorxm) | Michal Rada ([michalradacz](https://github.com/michalradacz)) | Veeresh Devireddy ([drveresh](https://github.com/drveresh)) | +| [MaknaSEO](https://github.com/MaknaSEO) | [darkzero2022](https://github.com/darkzero2022) | Liam ([LiamDobbelaere](https://github.com/LiamDobbelaere)) | Frank Denis ([jedisct1](https://github.com/jedisct1)) | +| Otto Sulin ([ottosulin](https://github.com/ottosulin)) | [carllaw6885](https://github.com/carllaw6885) | Anders Johan Holmefjord ([aholmis](https://github.com/aholmis)) | Richard Fritsch ([rfricz](https://github.com/rfricz)) | +| [mesutgungor](https://github.com/mesutgungor) | Scott Helme ([ScottHelme](https://github.com/ScottHelme)) | Carlo Reggiani ([carloreggiani](https://github.com/carloreggiani)) | Suyash Srivastava ([suyash5053](https://github.com/suyash5053)) | +| Mark Potter ([markonweb](https://github.com/markonweb)) | Arjan Lamers ([alamers](https://github.com/alamers)) | Gøran Breivik ([gobrtg](https://github.com/gobrtg)) | [flo-blg](https://github.com/flo-blg) | +| Guillaume Déflache ([guillaume-d](https://github.com/guillaume-d)) | Toufik Airane ([toufik-airane](https://github.com/toufik-airane)) | Keith Hoodlet ([securingdev](https://github.com/securingdev)) | Sinner ([SoftwareSinner](https://github.com/SoftwareSinner)) | +| [iloving](https://github.com/iloving) | Jeroen Beckers ([TheDauntless](https://github.com/TheDauntless)) | Joubin Jabbari ([joubin](https://github.com/joubin)) | yu fujioka ([fujiokayu](https://github.com/fujiokayu)) | +| execjosh ([execjosh](https://github.com/execjosh)) | Alicja Kario ([tomato42](https://github.com/tomato42)) | Sidney Ribeiro ([srjsoftware](https://github.com/srjsoftware)) | Gabriel Marquet ([Gby56](https://github.com/Gby56)) | +| Drew Schulz ([drschulz](https://github.com/drschulz)) | [bedirhan](https://github.com/bedirhan) | [muralito](https://github.com/muralito) | Ronnie Flathers ([ropnop](https://github.com/ropnop)) | +| Philippe De Ryck ([philippederyck](https://github.com/philippederyck)) | Malte ([mal33](https://github.com/mal33)) | [MazeOfThoughts](https://github.com/MazeOfThoughts) | Andreas Falk ([andifalk](https://github.com/andifalk)) | +| Javi ([javixeneize](https://github.com/javixeneize)) | Daniel Hahn ([averell23](https://github.com/averell23)) | [borislav-c](https://github.com/borislav-c) | Robin Wood ([digininja](https://github.com/digininja)) | +| [miro2ns](https://github.com/miro2ns) | Jan Dockx ([jandockx](https://github.com/jandockx)) | [vipinsaini434](https://github.com/vipinsaini434) | [priyanshukumar397](https://github.com/priyanshukumar397) | +| Nat Sakimura ([sakimura](https://github.com/sakimura)) | Benjamin Häublein ([BenjaminHae](https://github.com/BenjaminHae)) | [unknown-user-from](https://github.com/unknown-user-from) | Ali Ramazan TAŞDELEN ([alitasdln](https://github.com/alitasdln)) | +| Pedro Escaleira ([oEscal](https://github.com/oEscal)) | Josh ([josh-hemphill](https://github.com/josh-hemphill)) | Tim Würtele ([SECtim](https://github.com/SECtim)) | AviD ([avidouglen](https://github.com/avidouglen)) | +| SheHacksPurple ([shehackspurple](https://github.com/shehackspurple)) | [fcerullo-cycubix](https://github.com/fcerullo-cycubix) | Hector Eryx Paredes Camacho ([heryxpc](https://github.com/heryxpc)) | Irene Michlin ([irene221b](https://github.com/irene221b)) | +| Jonah Y-M ([TG-Techie](https://github.com/TG-Techie)) | Dhiraj Bahroos ([bahroos](https://github.com/bahroos)) | Jef Meijvis ([jefmeijvis](https://github.com/jefmeijvis)) | [IzmaDoesItbeta](https://github.com/IzmaDoesItbeta) | +| Abdessamad TEMMAR ([TmmmmmR](https://github.com/TmmmmmR)) | [sectroyer](https://github.com/sectroyer) | Soh Satoh ([sohsatoh](https://github.com/sohsatoh)) | [regoravalaz](https://github.com/regoravalaz) | +| james-t ([james-bitherder](https://github.com/james-bitherder)) | Aram Hovsepyan ([aramhovsepyan](https://github.com/aramhovsepyan)) | [JaimeGomezGarciaSan](https://github.com/JaimeGomezGarciaSan) | [ValdiGit01](https://github.com/ValdiGit01) | +| iwatachan ([ishowta](https://github.com/ishowta)) | Vinod Anandan ([VinodAnandan](https://github.com/VinodAnandan)) | Kevin Kien ([KevinKien](https://github.com/KevinKien)) | [paul-williamson-swoop](https://github.com/paul-williamson-swoop) | +| [endergzr](https://github.com/endergzr) | Radhwan Alshamamri ([Rado0z](https://github.com/Rado0z)) | Grant Ongers ([rewtd](https://github.com/rewtd)) | Cure53 ([cure53](https://github.com/cure53)) | +| [AliR2Linux](https://github.com/AliR2Linux) | Ads Dawson ([GangGreenTemperTatum](https://github.com/GangGreenTemperTatum)) | William Reyor ([BillReyor](https://github.com/BillReyor)) | gabe ([gcrow](https://github.com/gcrow)) | +| [mascotter](https://github.com/mascotter) | [luissaiz](https://github.com/luissaiz) | Suren Manukyan ([vx-sec](https://github.com/vx-sec)) | Piotr Gliźniewicz ([pglizniewicz](https://github.com/pglizniewicz)) | +| Tadeusz Wachowski ([tadeuszwachowski](https://github.com/tadeuszwachowski)) | Nasir aka Nate ([andesec](https://github.com/andesec)) | [settantasette](https://github.com/settantasette) | Lars Haulin ([LarsH](https://github.com/LarsH)) | +| Terence Eden ([edent](https://github.com/edent)) | [JasmineScholz](https://github.com/JasmineScholz) | Arun Sivadasan ([teavanist](https://github.com/teavanist)) | Yusuf GÜR ([yusuffgur](https://github.com/yusuffgur)) | +| Troy Marshall ([troymarshall](https://github.com/troymarshall)) | Tanner Prynn ([tprynn](https://github.com/tprynn)) | Nick K. ([nickific](https://github.com/nickific)) | [raoul361](https://github.com/raoul361) | +| Azeem Ilyas ([TheAxZim](https://github.com/TheAxZim)) | Evo Stamatov ([avioli](https://github.com/avioli)) | Tim Potter ([timpotter87](https://github.com/timpotter87)) | Gavin Ray ([GavinRay97](https://github.com/GavinRay97)) | +| monis ([demideus](https://github.com/demideus)) | Marcin Hoppe ([MarcinHoppe](https://github.com/MarcinHoppe)) | Grambulf ([ramshazar](https://github.com/ramshazar)) | Jordan Pike ([computersarebad](https://github.com/computersarebad)) | +| Jason Rogers ([jason-invision](https://github.com/jason-invision)) | Ben Hall ([benbhall](https://github.com/benbhall)) | JamesPoppyCock ([jamesly123](https://github.com/jamesly123)) | WhiteHackLabs ([whitehacklabs](https://github.com/whitehacklabs)) | +| Alex Gaynor ([alex](https://github.com/alex)) | Filip van Laenen ([filipvanlaenen](https://github.com/filipvanlaenen)) | [jeurgen](https://github.com/jeurgen) | [GraoMelo](https://github.com/GraoMelo) | +| Andreas Kurtz ([ay-kay](https://github.com/ay-kay)) | Tom Tervoort ([TomTervoort](https://github.com/TomTervoort)) | old man ([deveras](https://github.com/deveras)) | Marco Schnüriger ([marcortw](https://github.com/marcortw)) | +| [stiiin](https://github.com/stiiin) | infoseclearn ([teaminfoseclearn](https://github.com/teaminfoseclearn)) | [hljupkij](https://github.com/hljupkij) | Noe ([nmarher](https://github.com/nmarher)) | +| Lyz ([lyz-code](https://github.com/lyz-code)) | Martin Riedel ([mrtnrdl](https://github.com/mrtnrdl)) | KIM Jaesuck ([tcaesvk](https://github.com/tcaesvk)) | Barbara Schachner ([bschach](https://github.com/bschach)) | +| René Reuter ([AresSec](https://github.com/AresSec)) | [carhackpils](https://github.com/carhackpils) | Tyler ([tyler2cr](https://github.com/tyler2cr)) | Hugo ([hasousa](https://github.com/hasousa)) | +| Wouter Bloeyaert ([Someniak](https://github.com/Someniak)) | Mark de Rijk ([markderijkinfosec](https://github.com/markderijkinfosec)) | Ramin ([picohub](https://github.com/picohub)) | Philip D. Turner ([philipdturner](https://github.com/philipdturner)) | | Will Chatham ([willc](https://github.com/willc)) | | | | diff --git a/5.0/fa/0x00-Header.yaml b/5.0/fa/0x00-Header.yaml new file mode 100644 index 0000000000..309d2b6f5d --- /dev/null +++ b/5.0/fa/0x00-Header.yaml @@ -0,0 +1,16 @@ +--- + title: "Application Security Verification Standard" + subtitle: "Version 5.0.0" + date: May 2025 + titlepage: true + titlepage-rule-height: 0 + titlepage-logo: "images/owasp_logo_1c_notext.png" + table-use-row-colors: true + toc: true + toc-own-page: true + geometry: "left=2cm,right=2cm,top=3cm,bottom=3cm" + CJKmainfont: "Noto Sans CJK JP" + mainfont: "Source Serif 4" + sansfont: "Source Sans 3" +--- + diff --git a/5.0/fa/0x01-Frontispiece.md b/5.0/fa/0x01-Frontispiece.md new file mode 100644 index 0000000000..e69d800cbb --- /dev/null +++ b/5.0/fa/0x01-Frontispiece.md @@ -0,0 +1,45 @@ +# صفحه اصلی + +## درباره این استاندادر + +استاندارد تأیید امنیت نرم‌افزار (ASVS)، فهرستی از الزامات امنیتی برای نرم‌افزارهاست که معماران، توسعه‌دهندگان، آزمون‌گران، متخصصان امنیت، فروشندگان ابزار و مصرف‌کنندگان می‌توانند از آن برای تعریف، ساخت، آزمون و تأیید امنیت برنامه‌های نرم‌افزاری استفاده کنند. + +## کپی‌رایت و مجوز + +Version 5.0.0, May 2025 + +![license](../images/license.png) + +Copyright © 2008-2025 The OWASP Foundation. + +این سند تحت مجوز [Creative Commons Attribution-ShareAlike 4.0 International License](https://creativecommons.org/licenses/by-sa/4.0/) منتشر شده است. + +در هرگونه بازنشر یا توزیع، باید شرایط این مجوز را به‌روشنی به دیگران اعلام نمایید. + +## سرپرستان پروژه + +| | | | +|---------------------- |----------------- |----------------- | +| Daniel Cuthbert | Elar Lang | Josh C Grossman | + +## گروه کاری + +| | | | | +| -------------- | -------------- | ---------------- | -------------- | +| Tobias Ahnoff | Ralph Andalis | Ryan Armstrong | Gabriel Corona | +| Meghan Jacquot | Shanni Prutchi | Iman Sharafaldin | Eden Yardeni | + +## سایر همکاران اصلی + +| | | +| ----------------- | ------------ | +| Sjoerd Langkemper | Isaac Lewis | +| Mark Carney | Sandro Gauci | + +## مشارکت‌کنندگان و بازبین‌های دیگر + +فهرست سایر مشارکت‌کنندگان در ضمیمه E درج شده است. + +در صورتی که نام فردی در فهرست اعتبارهای نسخه x.5 ذکر نشده باشد، لطفاً با ثبت تیکت در گیت‌هاب، نسبت به شناساندن ایشان در به‌روزرسانی‌های آتی نسخه x.5 اقدام فرمایید. + +استاندارد ASVS بر پایه‌ی تلاش‌های افراد درگیر در نسخه‌های ۱.۰ (۲۰۰۸) تا ۴.۰ (۲۰۱۹) بنا شده است. بسیاری از ساختارها و اقلام تأییدی که امروزه در ASVS باقی مانده‌اند، در ابتدا توسط Andrew van der Stock، Mike Boberski، Jeff Williams و Dave Wichers نوشته شده‌اند، در کنار بسیاری دیگر از مشارکت‌کنندگان. از همه کسانی که در گذشته مشارکت داشته‌اند صمیمانه سپاسگزاریم. برای مشاهده فهرست کامل مشارکت‌کنندگان پیشین، لطفاً به هر نسخه‌ی قبلی مراجعه نمایید. diff --git a/5.0/fa/0x02-Preface.md b/5.0/fa/0x02-Preface.md new file mode 100644 index 0000000000..a37456d10f --- /dev/null +++ b/5.0/fa/0x02-Preface.md @@ -0,0 +1,29 @@ +# پیش‌گفتار + +به نسخه ۵.۰ استاندارد تأیید امنیت نرم‌افزار (ASVS) خوش آمدید. + +## مقدمه + +استاندارد ASVS که در سال ۲۰۰۸ و از طریق همکاری یک جامعه جهانی راه‌اندازی شد، ASVS مجموعه‌ای جامع از الزامات امنیتی برای طراحی، توسعه و آزمون برنامه‌ها و خدمات وب مدرن تعریف می‌کند. + +پس از انتشار نسخه ۴.۰ در سال ۲۰۱۹ و به‌روزرسانی جزئی آن (نسخه ۴.۰.۳) در سال ۲۰۲۱، نسخه ۵.۰ یک نقطه‌ی عطف مهم به شمار می‌آید—این نسخه برای هم‌راستایی با آخرین پیشرفت‌ها در حوزه‌ی امنیت نرم‌افزار، به‌روزرسانی و مدرن‌سازی شده است. + +نسخه ۵.۰ نتیجه‌ی مشارکت گسترده سرپرستان پروژه، اعضای گروه کاری و جامعه بزرگ OWASP در راستای به‌روزرسانی و ارتقای این استاندارد مهم است. + +## اصول کلیدی نسخه ۵.۰ + +این بازنگری عمده با چند اصل کلیدی طراحی و توسعه یافته است: + +* حوزه و تمرکز دقیق‌تر: این نسخه از استاندارد به‌گونه‌ای طراحی شده تا هم‌راستا با ارکان اصلی موجود در نام آن باشد: برنامه کاربردی، امنیت، تأیید و استاندارد. الزامات به‌گونه‌ای بازنویسی شده‌اند که پیشگیری از نقص‌های امنیتی را در اولویت قرار دهند، نه الزام به پیاده‌سازی‌های فنی خاص. متن الزامات به‌صورت خودتوضیحی نگاشته شده‌اند تا چرایی وجود هر مورد را روشن کنند. + +* پشتیبانی از تصمیمات مستند امنیتی: نسخه ۵.۰ الزامات جدیدی برای مستندسازی تصمیمات کلیدی امنیتی معرفی کرده است. این اقدام موجب افزایش قابلیت ردیابی شده و پیاده‌سازی‌های متناسب با زمینه (context) را پشتیبانی می‌کند، به سازمان‌ها اجازه می‌دهد تا موضع امنیتی خود را با نیازها و ریسک‌های خاص خود تطبیق دهند. + +* سطوح به‌روزشده :در حالی که مدل سه‌سطحی ASVS حفظ شده است، تعاریف سطح‌ها بازطراحی شده‌اند تا پذیرش آن ساده‌تر گردد. سطح ۱ به‌عنوان گام آغازین برای پذیرش ASVS طراحی شده و لایه‌ی نخست دفاعی را فراهم می‌آورد. سطح ۲ نمایانگر دیدی جامع از رویه‌های استاندارد امنیتی است. سطح ۳ به نیازهای پیشرفته و با تضمین بالا می‌پردازد. + +* محتوای بازآرایی‌شده و گسترش‌یافته: نسخه ۵.۰ شامل حدود ۳۵۰ الزام در قالب ۱۷ فصل است. فصل‌ها به‌منظور وضوح بیشتر و سهولت استفاده، بازسازمان‌دهی شده‌اند. نگاشتی دوسویه بین نسخه‌های ۴.۰ و ۵.۰ نیز ارائه شده تا فرآیند مهاجرت را تسهیل نماید. + +## چشم‌انداز آینده + +همان‌طور که تأمین امنیت یک نرم‌افزار هرگز نقطه‌ی پایان ندارد، ASVS نیز به‌عنوان یک استاندارد همواره در حال توسعه است. گرچه نسخه ۵.۰ یک انتشار عمده به‌شمار می‌آید، اما روند توسعه ادامه خواهد داشت. این نسخه، همزمان با فراهم‌سازی دسترسی جامعه وسیع‌تری به بهبودها و افزوده‌های صورت‌گرفته، بستری برای ارتقاهای آینده نیز فراهم می‌کند. از جمله این موارد، می‌توان به تلاش‌های جامعه‌محور برای ایجاد راهنمای پیاده‌سازی و تأیید بر پایه‌ی مجموعه الزامات اصلی اشاره کرد. + +ASVS 5.0 به‌منظور فراهم‌سازی یک پایه‌ی قابل‌اعتماد برای توسعه‌ی نرم‌افزار امن طراحی شده است. ما از جامعه دعوت می‌کنیم تا این استاندارد را بپذیرند، در آن مشارکت کنند و بر پایه‌ی آن، اقدامات بیشتری انجام دهند؛ تا به‌صورت جمعی، وضعیت امنیت برنامه‌های نرم‌افزاری را ارتقا دهیم. diff --git a/5.0/fa/0x03-What-is-the-ASVS.md b/5.0/fa/0x03-What-is-the-ASVS.md new file mode 100644 index 0000000000..2965181498 --- /dev/null +++ b/5.0/fa/0x03-What-is-the-ASVS.md @@ -0,0 +1,195 @@ +# ASVS چیست؟ + +استاندارد تأیید امنیت نرم‌افزار (ASVS) مجموعه‌ای از الزامات امنیتی برای برنامه‌ها و خدمات وب تعریف می‌کند و منبعی ارزشمند برای تمامی افرادی است که قصد دارند برنامه‌هایی ایمن طراحی، توسعه یا نگهداری کنند یا امنیت آن‌ها را ارزیابی نمایند. + +این فصل به جنبه‌های اساسی استفاده از ASVS ، از جمله دامنه کاربرد، ساختار سطوح اولویت‌بندی‌شده، و موارد اصلی استفاده از این استاندارد می‌پردازد. + +## دامنه ASVS + +دامنه استاندارد ASVS از نام آن الهام گرفته شده است: برنامه کاربردی(Application)، امنیت(Security)، تأیید(Verification) و استاندارد(Standard). این دامنه مشخص می‌کند که چه الزامی گنجانده یا مستثنی شده است و هدف اصلی آن، شناسایی اصول امنیتی‌ای است که باید محقق شوند. دامنه همچنین الزامات مستندسازی را نیز در بر می‌گیرد که پایه‌ای برای الزامات پیاده‌سازی محسوب می‌شود. + +برای مهاجمان، چیزی به نام «دامنه» معنا ندارد؛ بنابراین الزامات ASVS باید در کنار راهنماهایی برای سایر جنبه‌های چرخه عمر نرم‌افزار، مانند فرآیندهای CI/CD، میزبانی و عملیات اجرایی مورد ارزیابی قرار گیرد. + +### Application + +ASVS، "برنامه" را به‌عنوان محصول نرم‌افزاری در حال توسعه تعریف می‌کند که کنترل‌های امنیتی باید درون آن گنجانده شود. ASVS فعالیت‌های چرخه عمر توسعه یا نحوه ساخت برنامه از طریق فرآیند CI/CD را تجویز نمی‌کند، بلکه بر نتایج امنیتی مورد انتظار درون خود محصول تمرکز دارد. + +اجزایی مانند WAF،load balancer یا پراکسی‌ها که ترافیک HTTP را پردازش، اصلاح یا اعتبارسنجی می‌کنند، ممکن است به‌منظور خاصی بخشی از برنامه تلقی شوند، زیرا برخی کنترل‌های امنیتی مستقیماً به آن‌ها وابسته هستند یا از طریق آن‌ها پیاده‌سازی می‌شوند. این اجزا باید در الزاماتی که مرتبط با Response Cache، Rate Limite، یا کنترل ارتباطات ورودی و خروجی بر اساس مبدا و مقصد در نظر گرفته شوند. + +در مقابل، ASVS به‌طور کلی الزاماتی را که مستقیماً مرتبط با برنامه نیستند یا پیکربندی آن‌ها خارج از حوزه مسئولیت برنامه است، مستثنی می‌کند. به‌عنوان مثال، مسائل مرتبط با DNS معمولاً توسط تیم یا واحدی مجزا مدیریت می‌شود. + +به‌طور مشابه، اگرچه برنامه مسئول نحوه دریافت ورودی و تولید خروجی است، ولی اگر یک فرآیند خارجی با برنامه یا داده‌های آن تعامل داشته باشد، خارج از دامنه ASVS محسوب می‌شود. به‌عنوان نمونه، پشتیبان‌گیری از برنامه یا داده‌های آن، عموماً بر عهده یک فرآیند خارجی است و در کنترل برنامه یا توسعه‌دهندگان آن قرار ندارد. + +### امنیت + +هر الزام باید تأثیری قابل اندازه‌گیری بر امنیت داشته باشد. عدم وجود یک الزام باید منجر به ناامن‌تر شدن برنامه شود و پیاده‌سازی آن الزام باید احتمال وقوع یا تأثیر یک ریسک امنیتی را کاهش دهد. + +سایر ملاحظات مانند جنبه‌های عملکردی، سبک کدنویسی یا الزامات سیاستی خارج از دامنه ASVS هستند. + +### تأیید + +هر الزام باید قابل تأیید باشد و نتیجه تأیید باید منجر به تصمیم "موفق" یا "ناموفق" گردد. + +### استاندارد + +ASVS مجموعه‌ای از الزامات امنیتی است که برای انطباق با استاندارد باید پیاده‌سازی شوند. به همین دلیل، الزامات به تعریف هدف امنیتی‌ای محدود می‌شوند که باید محقق گردد. اطلاعات جانبی می‌تواند بر پایه ASVS ساخته شود یا از طریق نگاشت به آن متصل گردد. + +به‌طور خاص، OWASP دارای پروژه‌های متعددی است و ASVS به‌صورت آگاهانه از تکرار محتوای سایر پروژه‌ها اجتناب کرده است. به‌عنوان مثال، اگر توسعه‌دهنده‌ای بپرسد "چگونه باید فلان الزام را در فناوری خاص خود پیاده‌سازی کنم"، این سؤال در حوزه پروژه Cheat Sheet Series قرار می‌گیرد. اگر ارزیاب بپرسد "چگونه باید این الزام را در این محیط آزمون کنم"، پاسخ آن در پروژه Web Security Testing Guide یافت می‌شود + +در حالی که ASVS فقط برای استفاده متخصصان امنیت طراحی نشده، انتظار می‌رود که خواننده دانش فنی کافی برای درک محتوا یا توانایی جستجو درباره مفاهیم خاص را داشته باشد. + +### الزام (Requirement) + +واژه "الزام" در ASVS دقیقاً برای توصیف آن‌چه باید برای تأمین امنیت انجام شود به‌کار می‌رود. ASVS فقط شامل الزامات (must) است و توصیه‌ها (should) را به‌عنوان شرط اصلی شامل نمی‌شود. + +به‌عبارت دیگر، توصیه‌هایی که ممکن است فقط یکی از راه‌حل‌های ممکن یا ملاحظات سبک کدنویسی باشند، در تعریف "الزام" نمی‌گنجند. + +الزامات ASVS برای پاسخ‌گویی به اصول امنیتی خاص طراحی شده‌اند، بدون آن‌که به روش پیاده‌سازی یا فناوری خاصی وابسته باشند، و در عین حال به‌گونه‌ای نوشته شده‌اند که خودبه‌خود دلیل وجودشان را توضیح دهند. این بدین معناست که الزامات مبتنی بر یک روش تأیید یا پیاده‌سازی خاص نیستند. + +### تصمیمات امنیتی مستندشده + +در امنیت نرم‌افزار، طراحی و مشخص کردن سازوکارهای امنیتی به موقع منجر به پیاده‌سازی‌ای منسجم‌تر و قابل‌اعتمادتر در محصول نهایی یا ویژگی موردنظر می‌شود. + +علاوه بر این، برخی الزامات به‌گونه‌ای هستند که پیاده‌سازی آن‌ها بسیار خاص و وابسته به نیازهای هر برنامه است. برای مثال، کنترل مجوزها، اعتبارسنجی ورودی‌ها و کنترل‌های محافظتی بر روی سطوح مختلف داده‌های حساس. + +برای حل این موضوع، به‌جای بیان‌هایی کلی مثل "تمام داده‌ها باید رمزگذاری شوند" یا تلاش برای پوشش همه موارد ممکن در قالب یک الزام، الزامات مستندسازی در نظر گرفته شده‌اند که توسعه‌دهنده را ملزم می‌سازند نحوه پیاده‌سازی و پیکربندی این نوع کنترل‌ها را به‌صورت مستند ارائه دهد. این مستندات سپس می‌توانند از نظر تناسب مورد بازبینی قرار گرفته و پیاده‌سازی واقعی با مستندات مقایسه شود تا میزان انطباق بررسی گردد. + +این الزامات برای ثبت تصمیماتی طراحی شده‌اند که سازمان توسعه‌دهنده درباره نحوه پیاده‌سازی الزامات امنیتی اتخاذ کرده است. + +الزامات مستندسازی همواره در بخش اول هر فصل قرار دارند (هرچند همه فصل‌ها چنین الزامی ندارند) و همواره با یک الزام پیاده‌سازی مرتبط هستند، جایی که تصمیمات مستندسازی‌شده باید عملاً پیاده‌سازی شوند. نکته اینجاست که بررسی مستندات و بررسی پیاده‌سازی واقعی، دو فعالیت مستقل هستند. + +دو عامل اصلی برای گنجاندن این الزامات وجود دارد. اولین الزام این است که بسیاری از الزامات امنیتی شامل تعریف قوانین خاصی هستند. مانند انواع فایل‌هایی که مجاز به آپلود هستند، کنترل‌های کسب و کاری مورد نیاز، یا کاراکترهای مجاز برای یک فیلد خاص. این قوانین در هر برنامه متفاوت است، بنابراین ASVS نمی‌تواند به‌صورت امری آن‌ها را تعیین کند، و حتی Cheat sheet یا پاسخ مفصل هم در این موارد کمک نخواهد کرد. بدون مستند بودن این تصمیمات، تأیید پیاده‌سازی آن‌ها ممکن نخواهد بود. + +دومین عامل این است که توسعه دهندگان نرم‌افزار در انتخاب برخی الزامات آزادی عمل داشته باشند. برای مثال، در نسخه‌های پیشین ASVS، قواعد مربوط به پایان جلسه (session timeout) بسیار امری بودند. ولی بسیاری از برنامه‌ها، به‌ویژه برنامه‌های مشتری‌محور، قواعدی آسان‌گیرانه‌تر را ترجیح می‌دهند و از کنترل‌های جایگزین استفاده می‌کنند. به همین دلیل، الزامات مربوط به مستندسازی به‌صورت صریح اجازه‌ی چنین انعطافی را فراهم می‌کنند. + +بدیهی است که انتظار نمی‌رود توسعه‌دهندگان به‌صورت فردی این تصمیمات را بگیرند و مستند کنند، بلکه این وظیفه‌ی سازمان است که تصمیم‌گیری کرده، آن‌ها را مستند کرده و به توسعه‌دهندگان منتقل کند تا در کدنویسی لحاظ شوند. + +در توسعه نرم‌افزار، همان‌طور که برای طراحی ویژگی‌ها و ظاهر برنامه چارچوب‌ها، راهنماها و مؤلفه‌های مشخصی وجود دارد و انتظار می‌رود که توسعه‌دهندگان از آنها پیروی کنند، در مورد امنیت هم باید همین رویکرد وجود داشته باشد. یعنی امنیت نباید چیزی باشد که هر توسعه‌دهنده بنا به سلیقه خود تصمیم بگیرد، بلکه باید از استانداردها، ابزارها و طراحی‌های مشخصی تبعیت نماید. + +همچنین، نحوه مستندسازی نیز انعطاف‌پذیر است. تصمیمات امنیتی می‌توانند در قالب یک سند رسمی نوشته شده باشند که توسعه‌دهندگان به آن مراجعه می‌کنند، یا این تصمیمات می‌توانند به‌صورت کد در یک کتابخانه مشترک پیاده‌سازی شده باشند که استفاده از آن برای همه توسعه‌دهندگان الزامی است. در هر دو حالت، هدف نهایی محقق می‌شود. + +## سطوح تأیید امنیت برنامه‌های کاربردی + +ASVS سه سطح تأیید امنیت تعریف می‌کند که با افزایش سطح، عمق و پیچیدگی الزامات امنیتی نیز افزایش می‌یابد. هدف کلی این است که سازمان‌ها از سطح اول شروع کرده و مهم‌ترین دغدغه‌های امنیتی را برطرف کنند، و سپس متناسب با نیازهای سازمان و برنامه، به سطوح بالاتر حرکت کنند. در اسناد و متن الزامات، این سطوح با نمادهای L1، L2 و L3 نمایش داده می‌شوند. + +هر سطح از ASVS بیانگر الزامات امنیتی‌ای است که باید در آن سطح محقق شود؛ الزامات سطوح بالاتر به‌عنوان توصیه در نظر گرفته می‌شوند. + +به‌منظور جلوگیری از تکرار الزامات یا گنجاندن الزامات نامربوط در سطوح بالاتر، برخی الزامات فقط در یک سطح مشخص اعمال می‌شوند اما در سطوح بالاتر شرایط سخت‌گیرانه‌تری دارند. + +### ارزیابی سطوح + +سطوح ASVS بر پایه‌ی اولویت‌بندی الزامات و بر اساس تجربه‌ی پیاده‌سازی و آزمون آن‌ها تعیین شده‌اند. تمرکز اصلی بر مقایسه‌ی کاهش ریسک در برابر هزینه‌ی پیاده‌سازی الزام است. عامل کلیدی دیگر، سهولت در ورود و پذیرش استاندارد است. + +کاهش ریسک به میزان کاهش ریسک امنیتی در برنامه توجه دارد و عوامل سنتی مانند محرمانگی(Confidentiality)، یکپارچگی (Integrity)، دسترس‌پذیری (Availability)و همچنین لایه دفاع اولیه یا دفاع در عمق بودن الزام را در نظر می‌گیرد. + +بحث‌های دقیق درباره معیارها و تصمیم‌گیری سطح‌بندی منجر به توزیعی شده که در بیشتر موارد قابل اعتماد است، هرچند ممکن است برای همه موارد ۱۰۰٪ مناسب نباشد. در نتیجه، ممکن است سازمان‌ها تصمیم بگیرند برخی الزامات سطوح بالاتر را زودتر و بر اساس تحلیل ریسک خود در اولویت قرار دهند. + +انواع الزامات در هر سطح را می‌توان به‌صورت زیر توصیف کرد. + +### سطح ۱ + +این سطح حداقل الزامات برای ایمن‌سازی برنامه را شامل می‌شود و نقطه شروعی حیاتی محسوب می‌شود. حدود ۲۰٪ از کل الزامات ASVS در این سطح قرار دارد. هدف این سطح، داشتن کمترین تعداد الزامات برای سهولت در ورود و پذیرش استاندارد است. + +این الزامات عموماً حیاتی یا پایه‌ای هستند و اولین خط دفاعی در برابر حملات رایج محسوب می‌شوند، حملاتی که برای بهره‌برداری از آن‌ها به آسیب‌پذیری یا پیش‌شرط دیگری نیاز نیست. + +همچنین برخی الزامات مثل موارد مربوط به گذرواژه‌ها در سطح ۱ اهمیت بیشتری دارند، زیرا در سطوح بالاتر استفاده از احراز هویت چندمرحله‌ای مطرح می‌شود. + +سطح ۱ الزاماً از طریق آزمون نفوذ خارجی و بدون دسترسی به کد یا مستندات (مانند آزمون جعبه‌سیاه) قابل ارزیابی نیست، ولی تعداد کم‌تر الزامات آن فرآیند تأیید را ساده‌تر می‌کند. + +### سطح ۲ + +بیشتر برنامه‌ها باید به‌دنبال دستیابی به این سطح از امنیت باشند. حدود ۵۰٪ از الزامات ASVS در سطح ۲ هستند، و بنابراین یک برنامه باید حدود ۷۰٪ از الزامات ASVS (یعنی تمام الزامات L1 و (L2 را برای انطباق با این سطح پیاده‌سازی کند. + +این الزامات معمولاً به حملات کمتر رایج یا دفاع‌های پیچیده‌تر در برابر حملات رایج مرتبط هستند. ممکن است این الزامات همچنان دفاع اولیه باشند، یا برای بهره‌برداری نیاز به پیش‌شرط‌هایی داشته باشند. + +### سطح ۳ + +این سطح باید هدف برنامه‌هایی باشد که می‌خواهند بالاترین سطح امنیت را اثبات کنند و شامل حدود ۳۰٪ نهایی الزامات است. + +الزامات این سطح عمدتاً شامل مکانیزم‌های دفاع در عمق یا کنترل‌های پیچیده و دشوار برای پیاده‌سازی هستند. + +### کدام سطح را انتخاب کنیم + +سطوح اولویت‌بندی‌شده ASVS برای نشان دادن بلوغ امنیتی برنامه و سازمان طراحی شده‌اند. به‌جای آن‌که ASVS الزام کند که یک برنامه باید در چه سطحی باشد، این مسئولیت بر عهده‌ی سازمان است که با تحلیل ریسک، و با توجه به حساسیت برنامه و انتظارات کاربران، سطح مناسب را انتخاب کند. + +برای نمونه، یک استارتاپ نوپا که فقط مقدار محدودی از داده‌های حساس را جمع‌آوری می‌کند، ممکن است تصمیم بگیرد سطح ۱ را برای اهداف اولیه امنیتی انتخاب کند؛ اما یک بانک برای برنامه بانکی آنلاین خود، به‌سختی می‌تواند چیزی کمتر از سطح ۳ را به مشتریانش توجیه کند. + +## چگونه از ASVS استفاده کنیم + +### ساختار ASVS + +ASVS شامل حدود ۳۵۰ الزام امنیتی است که در قالب ۱۷ فصل دسته‌بندی شده‌اند. هر فصل نیز به بخش‌های کوچک‌تر تقسیم شده است. + +هدف از این تقسیم‌بندی فصل‌ها و بخش‌ها، ساده‌سازی انتخاب یا فیلتر کردن موارد مرتبط با برنامه‌ی خاص است. برای مثال، در یک API ماشین‌به‌ماشین، الزامات فصل V3 که مربوط به Frontend است، کاربردی نخواهد داشت. اگر از OAuth یا WebRTC استفاده نشده، آن فصل‌ها نیز می‌توانند نادیده گرفته شوند. + +### Release strategy + +انتشارهای ASVS از الگوی "Major.Minor.Patch" پیروی می‌کنند که این سه عدد، نوع تغییرات را نشان می‌دهند، در یک Major، عدد اول تغییر می‌کند، در Minor، عدد دوم تغییر می‌کند، و در Patch، عدد سوم تغییر می‌کند. + +* (Major release): بازسازمان‌دهی کامل؛ ممکن است تقریباً همه چیز از جمله شماره‌های الزامات تغییر کند. ارزیابی مجدد برای انطباق لازم است. مثال: 4.0.3 → 5.0.0 +* (Minor release): ممکن است الزامات جدیدی اضافه یا حذف شوند، اما شماره‌گذاری کلی حفظ می‌شود. ارزیابی مجدد لازم است، ولی ساده‌تر خواهد بود. مثال: 5.0.0 → 5.1.0 +* (Patch release): ممکن است الزامات تکراری یا منسوخ حذف شوند یا سخت‌گیری آن‌ها کاهش یابد، ولی برنامه‌ای که با نسخه قبلی انطباق داشته، با نسخه وصله‌شده نیز انطباق خواهد داشت.مثال: 5.0.0 → 5.0.1 + +نکته: آن‌چه در بالا آمد، صرفاً مربوط به الزامات ASVS است. تغییرات متنی در بخش‌های جانبی یا ضمائم، به‌عنوان تغییرات بنیادی در نظر گرفته نمی‌شوند. + +### انعطاف‌پذیری در استفاده از ASVS + +برخی از موارد پیش‌گفته، مانند الزامات مستندسازی و سازوکار سطوح، این امکان را فراهم می‌کنند که از ASVS به‌صورت انعطاف‌پذیرتر و متناسب با نیازهای هر سازمان استفاده شود. + +علاوه بر این، قویاً توصیه می‌شود که سازمان‌ها یک نسخه‌ شخصی‌سازی‌شده از ASVS ایجاد کنند که الزامات را با توجه به ویژگی‌ها و سطح ریسک برنامه‌های خود تنظیم نماید. با این حال، حفظ قابلیت رهگیری (traceability) الزامی است؛ به‌گونه‌ای که مثلاً گذراندن الزام 4.1.1 در تمام نسخه‌ها معنای یکسانی داشته باشد. + +در حالت ایده‌آل، هر سازمان باید نسخه اختصاصی ASVS خود را تهیه کند و بخش‌های نامربوط مانند GraphQL، WebSockets یا SOAP (در صورت عدم استفاده) را حذف نماید. چنین نسخه‌ای همچنین محل مناسبی برای افزودن راهنمایی‌های خاص سازمان، مانند کتابخانه‌ها یا منابع توصیه‌شده برای پیاده‌سازی الزامات، خواهد بود. + +### نحوه ارجاع به الزامات ASVS + +هر الزام دارای شناسه‌ای با قالب `.
.` است که هر بخش یک عدد می‌باشد. برای مثال :`1.11.3`. + +* مقدار `` نشان‌دهنده فصل الزام است؛ برای نمونه، تمام الزامات `1.#.#` متعلق به فصل "رمزگذاری و پاک‌سازی" هستند. +* مقدار `
` نشان‌دهنده بخش درون آن فصل است؛ مثلاً تمام الزامات.`1.2.#` در بخش "پیشگیری از تزریق" فصل رمزگذاری و پاک‌سازی قرار دارند. +* مقدار `` بیانگر شماره الزام خاص درون فصل و بخش است؛ مثلاً `1.2.5` که در نسخه 5.0.0 چنین تعریف شده است: + +> تأیید شود که برنامه از OS Command injection محافظت کند و فراخوانی‌های سیستم‌عامل از پرس‌وجوی پارامتری با Encoding مناسب استفاده نماید. + +از آنجا که شناسه‌ها ممکن است بین نسخه‌های مختلف تغییر کنند، توصیه می‌شود که در اسناد، گزارش‌ها یا ابزارها از قالب زیر استفاده شود: `v-.
.` که در آن version نشان دهنده برچسب نسخه ASVS می‌باشد. برای مثال: `v5.0.0-1.2.5` به‌صورت دقیق به الزام پنجم از بخش « Injection Prevention » در فصل « Encoding and Sanitization» در نسخه 5.0.0 اشاره دارد. (این قالب را می‌توان به‌صورت خلاصه‌شده به شکل `v-` نمایش داد.) + +نکته: حرف `v` پیش از شماره نسخه باید همواره با حروف کوچک نوشته شود. + +اگر شناسه‌ها بدون عنصر`v` استفاده شوند، باید فرض شود که به آخرین محتوای ASVS اشاره دارند. با گسترش و تغییر استاندارد، این کار مشکل‌ساز می‌شود؛ به همین دلیل توصیه می‌شود نویسندگان و توسعه‌دهندگان همواره نسخه را نیز ذکر کنند. + +فهرست الزامات ASVS در قالب‌هایی مانند CSV،JSON و سایر فرمت‌ها نیز برای ارجاع یا استفاده برنامه‌نویسی در دسترس است. + +### فورک کردن (Forking) ASVS + +سازمان‌ها می‌توانند با انتخاب یکی از سه سطح یا ایجاد نسخه‌ فورک‌شده‌ی دامنه‌محور، از مزایای ASVS بهره‌مند شوند. این نسخه‌ فورک‌شده می‌تواند الزامات را بر اساس سطح ریسک برنامه تنظیم کند. این اقدام تشویق می‌شود، مشروط بر آنکه قابلیت رهگیری حفظ شود (یعنی مثلاً الزام 4.1.1 در همه نسخه‌ها معنای یکسانی داشته باشد). + +در حالت ایده‌آل، هر سازمان باید نسخه‌ای متناسب با نیازهای خود از ASVS تهیه کند و بخش‌های غیرمرتبط (مانند GraphQL، Websockets، SOAP در صورتی که مورد استفاده قرار نمی‌گیرند) را حذف نماید. ایجاد نسخه‌ی اختصاصی (forking) باید با سطح ۱ ASVS به‌عنوان پایه آغاز شود و سپس بر اساس سطح ریسک برنامه، به سطوح ۲ یا ۳ ارتقاء یابد. + +## موارد استفاده از ASVS + +ASVS می‌تواند برای ارزیابی امنیت یک برنامه کاربردی مورد استفاده قرار گیرد. که این موضوع در فصل بعد با جزئیات بیشتری بررسی خواهد شد. با این حال، موارد استفاده‌ی دیگری نیز برای ASVS (یا نسخه‌های فورک‌شده آن) شناسایی شده‌اند. + +### به‌عنوان راهنمای دقیق معماری امنیتی + +یکی از رایج‌ترین کاربردهایASVS، استفاده از آن به‌عنوان مرجعی برای معماران امنیتی است. منابع محدودی برای نحوه طراحی معماری ایمن برای برنامه‌های مدرن وجود دارد ASVS می‌تواند خلأ موجود را با ارائه کنترل‌های مناسب برای چالش‌های رایج، مانند الگوهای حفاظت از داده‌ها یا استراتژی‌های اعتبارسنجی ورودی، پر کند. الزامات مربوط به معماری و مستندسازی در این زمینه به‌ویژه مفید خواهند بود. + +### به‌عنوان مرجع تخصصی برای برنامه‌نویسی امن + +ASVS می‌تواند به‌عنوان مبنایی برای تهیه مرجع برنامه‌نویسی امن در طول توسعه نرم‌افزار مورد استفاده قرار گیرد و به توسعه‌دهندگان کمک کند تا در حین ساخت نرم‌افزار، امنیت را به‌طور مستمر مدنظر داشته باشند. اگرچه ASVS می‌تواند پایه‌ی این مرجع باشد، اما توصیه می‌شود سازمان‌ها راهنمای اختصاصی خود را تهیه کنند—راهنمایی که شفاف، یکپارچه، و ترجیحاً با مشارکت مهندسان امنیت یا معماران امنیتی تدوین شده باشد.به‌عنوان مکمل این راهنما، به سازمان‌ها تاکید می‌شود تا در صورت امکان، سازوکارها و کتابخانه‌های امنیتی تأییدشده‌ای تهیه کنند که در راهنما معرفی شده و توسعه‌دهندگان در پروژه‌های خود از آن‌ها استفاده نمایند. + +### به‌عنوان راهنمای آزمون‌های واحد و یکپارچه‌سازی خودکار + +ASVS به‌گونه‌ای طراحی شده که بسیار قابل آزمون باشد. برخی از الزامات ماهیتی فنی دارند، در حالی‌که برخی دیگر (مانند الزامات معماری یا مستندسازی) نیاز به بررسی مستندات یا بازبینی معماری دارند. با طراحی آزمون‌های واحد و یکپارچه‌سازی که آسیب‌پذیری‌ها و سوءاستفاده‌های خاص مرتبط با الزامات قابل‌تأیید را بررسی و fuzz می‌کنند، می‌توان اطمینان یافت که این کنترل‌ها در هر نسخه از برنامه (build) به‌درستی عمل می‌کنند. برای نمونه، می‌توان تست‌های اضافی‌ای به مجموعه تست‌ها برای یک کنترلر ورود (login controller) افزود که پارامتر نام کاربری (username) را از نظر مواردی مثل نام‌های کاربری پیش‌فرض رایج، تشخیص وجود حساب (account enumeration)، حملات brute force، تزریق LDAP و SQL، و XSS بررسی کنند. به‌صورت مشابه، تست پارامتر رمز عبور (password) نیز باید شامل بررسی رمزهای رایج، طول رمز عبور، تزریق null byte، حذف پارامتر، XSS، و موارد دیگر باشد. + +### برای آموزش توسعه امن + +ASVS می‌تواند برای تعریف ویژگی‌های نرم‌افزار ایمن نیز مورد استفاده قرار گیرد. بسیاری از دوره‌های "برنامه‌نویسی امن" در واقع صرفاً دوره‌های هک اخلاقی هستند که نکاتی جزئی در مورد کدنویسی امن به آن‌ها اضافه شده است. و این لزوماً به بهبود مهارت توسعه‌دهندگان در نوشتن کد امن کمک نمی‌کند.در عوض، دوره‌های آموزش توسعه امن می‌توانند با محوریت ASVS و تمرکز قوی بر سازوکارهای مثبت و کاربردی آن طراحی شوند، نه صرفاً تمرکز بر فهرست Top 10 آسیب‌پذیری‌ها یا کارهایی که نباید انجام داد. ساختار ASVS همچنین یک چارچوب منطقی برای مرور گام‌به‌گام موضوعات مختلف مرتبط با ایمن‌سازی برنامه فراهم می‌کند. + +### به‌عنوان چارچوبی برای راهنمایی در خرید نرم‌افزار امن + +ASVS یک چارچوب عالی برای کمک به خرید نرم‌افزار امن یا خدمات توسعه اختصاصی امن است. خریدار می‌تواند به‌سادگی مشخص کند که نرم‌افزاری که قصد تهیه آن را دارد، باید مطابق با سطح X از ASVS توسعه یافته باشد و از فروشنده بخواهد اثبات کند که نرم‌افزار با آن سطح از استاندارد ASVS منطبق است. + +## کاربرد عملی ASVS + +تهدیدهای مختلف، انگیزه‌های متفاوتی دارند. برخی صنایع دارای دارایی‌های اطلاعاتی و فناوری منحصربه‌فرد، و همچنین الزامات انطباق قانونی خاصِ حوزه‌ی خود هستند. + +به سازمان‌ها تاکید می‌شود که با توجه به ماهیت کسب‌وکار خود، ویژگی‌های خاص ریسک‌های خود را عمیقاً بررسی کنند و بر اساس این تحلیل، سطح مناسب ASVS را که با نیازهای کسب‌وکارشان مطابقت دارد، تعیین نمایند. diff --git a/5.0/fa/0x04-Assessment_and_Certification.md b/5.0/fa/0x04-Assessment_and_Certification.md new file mode 100644 index 0000000000..f81b9138aa --- /dev/null +++ b/5.0/fa/0x04-Assessment_and_Certification.md @@ -0,0 +1,47 @@ +# ارزیابی و صدور گواهی + +## دیدگاه OWASP در مورد گواهی‌نامه‌ها و نشان‌های اعتماد ASVS + +OWASP به‌عنوان یک سازمان غیرانتفاعی و بی‌طرف از نظر تجاری، هیچ فروشنده، ارزیاب یا نرم‌افزاری را گواهی نمی‌کند. هرگونه ادعا مبنی بر گواهی‌بودن ASVS، ارائه نشان اعتماد یا تضمین انطباق با ASVS توسط اشخاص ثالث، به‌هیچ‌وجه تأیید رسمی OWASP نیست. از این‌رو، سازمان‌ها باید نسبت به چنین ادعاهایی با احتیاط عمل کنند. + +البته سازمان‌ها می‌توانند خدمات تضمین امنیت ارائه دهند، مشروط بر آن‌که ادعای دریافت گواهی رسمی از سوی OWASP نداشته باشند. + +## نحوه تأیید انطباق با ASVS + +ASVS به‌طور عامدانه جزئیات چگونگی ارزیابی انطباق در سطحی مانند یک راهنمای تست را تجویز نمی‌کند، اما تأکید بر برخی نکات کلیدی اهمیت دارد. + +### گزارش‌گیری ارزیابی + +گزارش‌های سنتی تست نفوذ تنها به ارائه "موارد استثناء" می‌پردازند و صرفاً شکست‌ها را فهرست می‌کنند. اما گزارش گواهی‌نامه ASVS باید شامل موارد دامنه ارزیابی(Scope)، خلاصه‌ای از تمام الزامات بررسی‌شده، الزامات دارای استثناء یا عدم انطباق و راهنمایی برای رفع مشکلات شناسایی‌شده. برخی الزامات ممکن است به‌دلایل فنی یا عملکردی، قابل اعمال نباشند (مثلاً مدیریت نشست در APIهای بدون وضعیت) که در این صورت، باید در گزارش ذکر شود. + +### دامنه ارزیابی + +سازمانی که یک نرم‌افزار را توسعه می‌دهد، معمولاً همه الزامات ASVS را پیاده‌سازی نمی‌کند، زیرا برخی الزامات ممکن است برای آن نرم‌افزار خاص نامربوط یا کم‌اهمیت باشند. بنابراین، ارزیاب باید دامنه بررسی را به‌روشنی مشخص کند؛ از جمله اینکه سازمان در پی دستیابی به کدام سطح (Level) است و کدام الزامات را شامل کرده است. این شفاف‌سازی باید بر اساس آن‌چه در گزارش گنجانده شده انجام گیرد، نه آن‌چه حذف شده است. همچنین ارزیاب باید نظر خود را در مورد دلایل مستند حذف یا پیاده‌سازی‌نشدن الزامات خاص ارائه دهد. + +این موضوع به مصرف‌کننده گزارش کمک می‌کند تا زمینه ارزیابی را بهتر درک کرده و در مورد میزان اعتماد به نرم‌افزار، تصمیم آگاهانه‌تری بگیرد. + +سازمان‌هایی که گواهی صادر می‌کنند می‌توانند روش‌های مختلفی برای آزمون انتخاب کنند، اما باید این روش‌ها را در گزارش خود به‌طور شفاف ذکر کنند و بهتر است این روش‌ها قابل تکرار باشند. بسته به نوع نرم‌افزار و نیازهای آن، ممکن است برای بررسی مواردی مانند اعتبارسنجی ورودی، از روش‌هایی مثل تست نفوذ دستی یا تحلیل کد منبع استفاده شود. + +### روش‌های ارزیابی + +تکنیک‌های مختلفی برای تأیید الزامات خاص ASVS ممکن است مورد نیاز باشند. علاوه بر تست نفوذ (با استفاده از اعتبارنامه‌های معتبر برای پوشش کامل برنامه)، تأیید الزامات ASVS ممکن است به دسترسی به مستندات، کد منبع، پیکربندی، و افراد درگیر در فرآیند توسعه نیاز داشته باشد؛ به‌ویژه برای تأیید الزامات سطح ۲ (L2) و سطح ۳ (L3) ارائه شواهد مستند و قوی از یافته‌ها با مستندسازی دقیق، از جمله اوراق کاری، تصاویر صفحه (اسکرین‌شات)، اسکریپت‌ها و لاگ‌های تست، یک رویه استاندارد محسوب می‌شود. اجرای صرف یک ابزار خودکار بدون انجام تست‌های دقیق، برای دریافت گواهینامه کافی نیست؛ چرا که هر الزام باید به‌طور قابل تأیید بررسی و آزموده شود. + +استفاده از ابزارهای خودکار برای تأیید الزامات ASVS همواره موضوعی مورد توجه بوده است. بنابراین، مهم است که نکاتی در مورد تست خودکار و تست جعبه سیاه (black box testing) روشن و شفاف بیان شوند. + +#### نقش ابزارهای خودکار امنیتی + +زمانی که ابزارهای خودکار تست امنیتی مانند DAST (تست امنیتی پویا) و SAST (تست امنیتی ایستا) به‌درستی در خط ساخت (build pipeline) پیاده‌سازی شوند، ممکن است بتوانند برخی از مشکلات امنیتی را شناسایی کنند که اصولاً نباید وجود داشته باشند. با این حال، اگر این ابزارها به‌دقت پیکربندی و تنظیم نشوند، پوشش لازم را فراهم نخواهند کرد و حجم زیاد هشدارهای نادرست (noise) باعث می‌شود مشکلات امنیتی واقعی قابل شناسایی و رفع نباشند. + +در حالی که این ابزارها ممکن است برخی از نیازمندی‌های فنی ساده‌تر مانند کدگذاری خروجی یا پاک‌سازی (sanitization) را پوشش دهند، نکته بسیار مهم این است که نمی‌توانند بسیاری از الزامات پیچیده‌تر ASVS (استاندارد تأیید امنیت نرم‌افزار) را، به‌ویژه آن‌هایی که به منطق تجاری یا کنترل دسترسی مربوط می‌شوند، به‌طور کامل بررسی کنند. + +برای نیازمندی‌هایی که ساده نیستند، همچنان می‌توان از خودکارسازی استفاده کرد، اما باید بررسی‌های خاص برای هر نرم‌افزار نوشته شود تا این الزامات پوشش داده شوند. این بررسی‌ها می‌توانند شبیه به تست‌های واحد (unit test) یا تست‌های یکپارچه‌سازی (integration test) باشند که ممکن است قبلاً در سازمان وجود داشته باشند. بنابراین ممکن است بتوان از زیرساخت فعلی تست خودکار برای نوشتن تست‌های مخصوص ASVS استفاده کرد. اگرچه انجام این کار در کوتاه‌مدت نیاز به سرمایه‌گذاری دارد، اما مزایای بلندمدت آن در امکان بررسی مستمر الزامات امنیتی ASVS بسیار قابل توجه خواهد بود. + +به طور خلاصه قابل تست بودن از طریق خودکارسازی به این معنا نیست که می‌توان صرفاً یک ابزار آماده را اجرا کرد. + +#### نقش تست نفوذ + +در نسخه 4.0، سطح L1 برای انجام تست نفوذ «جعبه سیاه» (بدون دسترسی به مستندات یا کد) بهینه‌سازی شده بود، اما حتی در آن نسخه نیز تأکید شده بود که این روش نباید به‌عنوان فعالیت اصلی تضمین امنیتی تلقی شود و باید از آن پرهیز کرد. + +تست‌ بدون دسترسی به اطلاعات تکمیلی، شیوه‌ای ناکارآمد و ضعیف برای ارزیابی امنیت است، چرا که فرصت بررسی کد منبع، شناسایی تهدیدها، کشف کنترل‌های ناقص و انجام تست جامع‌تر در زمان کمتر را از بین می‌برد. + +به‌طور جدی توصیه می‌شود که از روش‌های ترکیبی (Hybrid) برای تست نفوذ استفاده شود، یعنی تست‌هایی که با دسترسی کامل به مستندات، کد و توسعه‌دهندگان انجام می‌شوند؛ زیرا چنین سطحی از دسترسی برای ارزیابی دقیق بسیاری از الزامات ASVS ضروری خواهد بود. diff --git a/5.0/fa/0x05-For-Users-Of-4.0.md b/5.0/fa/0x05-For-Users-Of-4.0.md new file mode 100644 index 0000000000..096f0dd24f --- /dev/null +++ b/5.0/fa/0x05-For-Users-Of-4.0.md @@ -0,0 +1,90 @@ +# تغییرات نسبت به نسخه 4.x + +## مقدمه + +کاربرانی که با نسخه x.4 این استاندارد آشنایی دارند، ممکن است مرور تغییرات کلیدی معرفی‌شده در نسخه 5.0 را مفید بیابند؛ تغییراتی که شامل به‌روزرسانی‌هایی در محتوا، دامنه و فلسفه زیربنایی استاندارد هستند. + +از میان 286 الزام موجود در نسخه 4.0.3، تنها 11 مورد بدون تغییر باقی مانده‌اند و ۱۵ مورد صرفاً اصلاحات جزئی گرامری داشته‌اند که معنای آن‌ها را تغییر نداده است. در مجموع، 109 الزام (معادل 38%) در نسخه 5.0 دیگر به‌صورت الزامات جداگانه وجود ندارند؛ که از این میان، 50 مورد حذف شده‌اند، 28 مورد به‌عنوان موارد تکراری حذف شده‌اند و 31 مورد در الزامات دیگر ادغام شده‌اند. مابقی الزامات نیز به‌نوعی مورد بازنگری قرار گرفته‌اند. حتی الزامات تغییریافته‌ای که از لحاظ محتوایی تغییر زیادی نداشته‌اند نیز به‌دلیل بازآرایی یا بازساختاردهی، شناسه‌های متفاوتی دارند. + +برای تسهیل پذیرش نسخه 5.0، اسنادی برای نگاشت الزامات ارائه شده‌اند تا به کاربران کمک کنند نحوه تطابق الزامات نسخه x.4 با نسخه 5.0 را دنبال کنند. این نگاشت‌ها به نسخه انتشار خاصی وابسته نیستند و در صورت لزوم به‌روزرسانی یا شفاف‌سازی خواهند شد. + +## فلسفه الزامات + +### دامنه و تمرکز + +در نسخه x.4 الزامات متعددی گنجانده شده بودند که با دامنه مورد نظر این استاندارد هم‌راستا نبودند؛ این موارد حذف شده‌اند. همچنین، الزاماتی که با معیارهای دامنه نسخه 5.0 سازگار نبودند یا قابلیت ارزیابی نداشتند نیز کنار گذاشته شده‌اند. + +### تمرکز بر اهداف امنیتی به‌جای سازوکارها + +در نسخه 4.x بسیاری از الزامات بر سازوکارهای خاصی متمرکز بودند و نه بر اهداف زیربنایی امنیتی. در نسخه 5.0، تمرکز الزامات بر اهداف امنیتی است و تنها در مواردی که یک سازوکار خاص تنها راه‌حل عملی است، به آن اشاره شده یا به‌عنوان نمونه یا راهنمایی مکمل آورده شده است. + + این رویکرد به رسمیت می‌شناسد که روش‌های متعددی ممکن است برای رسیدن به یک هدف امنیتی وجود داشته باشند و از تجویزهای غیرضروری که می‌تواند انعطاف‌پذیری سازمان‌ها را محدود کند، اجتناب می‌کند. + +همچنین، الزامات مرتبط با یک دغدغه امنیتی واحد، در صورت لزوم با هم ادغام شده‌اند. + +### تصمیمات امنیتی مستند + +هرچند مفهوم تصمیمات امنیتی مستند ممکن است در نسخه 5.0 جدید به‌نظر برسد، در واقع ادامه و تکامل الزاماتی در نسخه 4.0 است که به تحلیل سیاست‌ها و مدل‌سازی تهدید اشاره داشتند. در گذشته، برخی الزامات به‌طور ضمنی نیازمند تحلیل برای پیاده‌سازی کنترل‌های امنیتی بودند، مانند تعیین اتصالات شبکه مجاز. + +به‌منظور اطمینان از در دسترس بودن اطلاعات لازم برای اجرا و ارزیابی، این انتظارات اکنون به‌طور صریح به‌عنوان الزامات مستندسازی تعریف شده‌اند تا شفاف، قابل اجرا و قابل ارزیابی باشند. + +## تغییرات ساختاری و فصل‌های جدید + +چند فصل در نسخه 5.0 محتوای کاملاً جدیدی را معرفی کرده‌اند: + +* OAuth وOIDC: با توجه به رواج گسترده این پروتکل‌ها برای واگذاری دسترسی و ورود یکپارچه (SSO)، الزامات اختصاصی برای این حوزه تعریف شده‌اند تا سناریوهای متنوعی که توسعه‌دهندگان ممکن است با آن‌ها مواجه شوند، پوشش داده شود. این حوزه ممکن است در آینده به استانداردی مستقل تبدیل شود(مشابه آنچه برای حوزه موبایل و IoT در نسخه‌های قبلی رخ داد). +* WebRTC: با توجه به رشد سریع این فناوری، ملاحظات و چالش‌های امنیتی خاص آن اکنون در بخشی اختصاصی پوشش داده شده‌اند. + +همچنین، تلاش شده ساختار فصل‌ها به‌گونه‌ای تنظیم شود که مجموعه‌های منسجم و مرتبطی از الزامات را در کنار هم قرار دهد. + +این بازسازمان‌دهی منجر به ایجاد فصل‌های جدیدی نیز شده است: + +* توکن‌های مستقل(Self-contained Tokens): که پیش‌تر زیرمجموعه مدیریت نشست بودند، اکنون به‌عنوان یک سازوکار مستقل شناخته می‌شوند و یکی از عناصر بنیادی در ارتباطات بدون وضعیت (stateless) مانند OAuth و OIDC به‌شمار می‌روند. به‌دلیل پیامدهای امنیتی خاص این نوع توکن‌ها، در نسخهx.5 یک فصل اختصاصی به آن‌ها اختصاص داده شده و برخی الزامات جدید نیز در این زمینه معرفی شده‌اند. +* امنیت فرانت‌اند وب: با توجه به پیچیدگی فزاینده برنامه‌های تحت مرورگر و معماری‌های مبتنی بر API، الزامات امنیتی فرانت‌اند به فصل مستقلی منتقل شده‌اند. +* کدنویسی و معماری ایمن: الزاماتی که به شیوه‌های کلی امنیت مربوط می‌شدند ولی در فصل‌های قبلی جای نمی‌گرفتند، در این بخش جمع‌آوری شده‌اند. + +سایر تغییرات ساختاری در نسخه 5.0 به‌منظور شفاف‌سازی مقصود اعمال شده‌اند. برای مثال، الزامات مربوط به اعتبارسنجی ورودی به‌جای قرارگیری در کنار پاک‌سازی و کدگذاری، در کنار منطق تجاری قرار داده شده‌اند تا نقش آن‌ها در اجرای قوانین تجاری را بهتر نشان دهند. + +فصل قبلی با عنوان معماری V1 به‌طور کامل حذف شده است. بخش ابتدایی آن شامل الزاماتی بود که خارج از محدوده موضوعی قرار داشتند، در حالی که بخش‌های بعدی به فصل‌های مرتبط منتقل شده‌اند و الزامات نیز در صورت لزوم بازنگری، شفاف‌سازی و حذف موارد تکراری شده‌اند. + +## حذف نگاشت مستقیم با استانداردهای دیگر + +نگاشت مستقیم با استانداردهای دیگر از متن اصلی استاندارد حذف شده است. هدف آن است که نگاشتی با پروژه OWASP CRE (Common Requirement Enumeration) ارائه شود که به‌نوبه خود ASVS را به طیفی از پروژه‌های OWASP و استانداردهای خارجی متصل کند. + +نگاشت مستقیم با CWE و NIST دیگر حفظ نمی‌شود، که در ادامه توضیح داده شده است. + +### کاهش وابستگی به دستورالعمل‌های هویت دیجیتال NIST + +دستورالعمل‌های هویت دیجیتال [Digital Identity Guidelines (SP 800-63)](https://pages.nist.gov/800-63-3/) مدت‌ها به‌عنوان مرجع برای کنترل‌های احراز هویت و مجوزدهی استفاده می‌شدند. در نسخه x.4 برخی فصل‌ها با ساختار و واژگان NIST هم‌راستا بودند. + +با آن‌که این دستورالعمل‌ها همچنان مرجع مهمی محسوب می‌شوند، این هم‌راستایی سختگیرانه چالش‌هایی ایجاد کرده بود؛ از جمله واژگان کمتر شناخته‌شده، تکرار الزامات مشابه، و نگاشت‌های ناقص. نسخه 5.0 از این رویکرد فاصله گرفته تا وضوح و ارتباط مؤثرتر را ارتقا دهد. + +### فاصله گرفتن از نگاشت CWE + +[Common Weakness Enumeration (CWE)](https://cwe.mitre.org/) طبقه‌بندی مفیدی از ضعف‌های امنیتی نرم‌افزار ارائه می‌دهد. با این حال، چالش‌هایی مانند CWEهایی که فقط شامل دسته‌بندی هستند، دشواری در نگاشت دقیق الزامات به یک CWE خاص، و نگاشت‌های نامشخص در نسخه x.4 باعث شد تصمیم گرفته شود که در نسخه 5.0 نگاشت مستقیم با CWE حذف شود. + +## بازنگری در تعریف سطوح (Levels) + +نسخه x.4 سطوح امنیتی را به‌صورت L1 ("حداقلی")، L2 ("استاندارد") و L3 ("پیشرفته") تعریف می‌کرد و تلویحاً بیان می‌کرد که تمام برنامه‌هایی که با داده‌های حساس سروکار دارند باید حداقل به سطح L2 برسند. + +نسخه 5.0 به چندین ایراد در این رویکرد پرداخته است که در پاراگراف‌های ذیل آمده است: + +از لحاظ عملی برخلاف نسخه x.4 که از علامت تیک (✔) برای نمایش سطح استفاده می‌کرد، نسخه x.5 از عدد ساده در تمام قالب‌های سند (شامل markdown، PDF، DOCX، CSV،JSON و XML) استفاده می‌کند. برای حفظ سازگاری با نسخه‌های قبلی، خروجی‌های قدیمی CSV،JSON و XML با علامت تیک نیز تولید می‌شوند. + +### ورود ساده‌تر به سطح اول + +بازخوردها نشان دادند که تعداد بالای الزامات سطح اول (120 مورد) و این‌که این سطح به‌عنوان حداقل اما ناکافی معرفی شده بود، موجب کاهش تمایل به استفاده می‌شد. نسخه ۵.۰ تلاش کرده این مانع را با تعریف سطح L1 حول الزامات لایه اول دفاعی کاهش دهد؛ نتیجه این کار الزامات کمتر و روشن‌تر در این سطح است. برای مقایسه عددی: در نسخه 4.0.3 تعداد 128 الزام L1 از مجموع 278(معادل 46%) وجود داشت، اما در نسخه 5.0.0 این تعداد به 70 الزام از مجموع 345 (معادل 20%) کاهش یافته است. + +### افسانه قابلیت آزمون‌پذیری + +در نسخه x.4 یکی از معیارهای اصلی انتخاب الزامات سطح 1، قابلیت ارزیابی آن‌ها از طریق تست نفوذ خارجی به‌صورت "جعبه سیاه" بود. اما این رویکرد با هدف واقعی سطح 1 (حداقل کنترل‌های امنیتی) همخوانی کامل نداشت. برخی کاربران معتقد بودند سطح 1 برای تأمین امنیت کافی نیست، و برخی دیگر آن را بیش از حد سخت برای آزمون تلقی می‌کردند. + + اتکا به قابلیت آزمون‌پذیری به‌عنوان معیار، رویکردی نسبی و گاه گمراه‌کننده است؛ چرا که آزمون‌پذیر بودن الزام لزوماً به معنای سهولت یا امکان خودکارسازی آزمون آن نیست. همچنین الزامات آسان‌تر برای آزمون لزوماً پراثرترین یا آسان‌ترین گزینه‌ها برای اجرا نیستند. + +بنابراین در نسخه 5.0، تصمیم‌گیری در مورد سطوح عمدتاً بر اساس کاهش ریسک انجام شده و میزان تلاش موردنیاز برای پیاده‌سازی نیز در نظر گرفته شده است. + +### فقط ریسک مطرح نیست + +استفاده از سطوح نسخه‌ای و مبتنی بر ریسک که الزام سطح خاصی را برای برنامه‌ها تجویز می‌کنند، در عمل بیش از حد خشک و انعطاف‌ناپذیر بوده است. در واقع، اولویت‌بندی و پیاده‌سازی کنترل‌های امنیتی به عوامل متعددی بستگی دارد، از جمله کاهش ریسک و میزان تلاش اجرایی. + + بنابراین توصیه می‌شود سازمان‌ها سطحی از ASVS را انتخاب کنند که متناسب با بلوغ امنیتی آن‌ها و پیامی که می‌خواهند به کاربران خود منتقل کنند، باشد. diff --git a/5.0/fa/0x10-V1-Encoding-and-Sanitization.md b/5.0/fa/0x10-V1-Encoding-and-Sanitization.md new file mode 100644 index 0000000000..91edbad85f --- /dev/null +++ b/5.0/fa/0x10-V1-Encoding-and-Sanitization.md @@ -0,0 +1,103 @@ +# V1 Encoding and Sanitization + +## هدف + +این فصل به ضعف‌های رایج امنیتی در برنامه‌های وب می‌پردازد که ناشی از پردازش ناامن داده‌های غیرقابل‌اعتماد است. چنین ضعف‌هایی ممکن است منجر به آسیب‌پذیری‌های فنی مختلفی شوند، در شرایطی که داده‌های غیرقابل‌اعتماد، مطابق با دستور زبان مفسر مربوطه تفسیر می‌شوند. + +در برنامه‌های وب مدرن، همواره بهترین کار استفاده از APIهای امن‌تر مانند parameterized queries، auto-escaping یا templating frameworks است. در غیر این صورت، اجرای دقیق و محتاطانه‌ی encoding، escaping یا sanitization برای امنیت برنامه حیاتی خواهد بود. + +اعتبارسنجی ورودی به‌عنوان مکانیزم «دفاع در عمق» عمل می‌کند و از ورود محتوای غیرمنتظره یا خطرناک جلوگیری می‌کند. با این حال، از آنجا که هدف اصلی آن تطابق محتوا با الزامات عملکردی و تجاری است، الزامات مرتبط با آن در فصل «اعتبارسنجی و منطق کسب‌وکار» آمده است. + +## V1.1 ساختار Encoding and Sanitization + +در بخش‌های زیر، الزامات مختص سورس کد یا مختص مفسر برای پردازش امن داده‌های ناامن به‌منظور جلوگیری از آسیب‌پذیری‌های امنیتی ارائه شده‌اند. این الزامات، ترتیب انجام این پردازش و محل مناسب اجرای آن را پوشش می‌دهند. همچنین، هدف آن‌ها این است که هنگام ذخیره‌سازی داده، محتوا در حالت اولیه خود باقی بماند و به‌صورت encoded یا escaped (مثلاً HTML encoding) ذخیره نشود تا از بروز مشکلات ناشی از رمزگذاری دوگانه (double encoding) جلوگیری شود. + +| # | Description | Level | +| :---: | :--- | :---: | +| **1.1.1** | ورودی فقط یک‌بار به فرم استاندارد decoded یا unescaped شود، و این تنها زمانی انجام شود که انتظار می‌رود داده واقعاً در آن قالب رمزگذاری‌شده دریافت شده باشد. این فرآیند باید قبل از هرگونه پردازش بعدی روی ورودی انجام شود، و به‌هیچ‌وجه نباید پس از اعتبارسنجی یا پاک‌سازی انجام گیرد. | 2 | +| **1.1.2** | برنامه فرآیند encode و escape خروجی را به‌عنوان آخرین مرحله انجام می‌دهد؛ به‌گونه‌ای که این عملیات یا دقیقاً پیش از استفاده داده در مفسر مربوطه انجام شود، یا اینکه خود مفسر به‌طور داخلی این کار را انجام دهد. | 2 | + +## V1.2 پیشگیری از تزریق + +encode و escape خروجی‌ها زمان دریافت ورودی‌های حساس که ممکن است منجر به تزریق شوند، برای امنیت برنامه حیاتی است. معمولاً این encode و escape خروجی ذخیره نمی‌شوند، بلکه صرفاً برای ایمن‌سازی نمایش در همان لحظه در مفسر استفاده می‌شوند. انجام زودهنگام این عملیات ممکن است باعث خرابی محتوا یا بی‌اثر شدن فرایند encoding و escaping شود. + +در بسیاری از موارد، کتابخانه‌های نرم‌افزاری توابع امن یا امن‌تری را برای انجام خودکار این کار ارائه می‌دهند، با این حال باید اطمینان حاصل شود که برای زمینه (context) موردنظر صحیح هستند. + +| # | Description | Level | +| :---: | :--- | :---: | +| **1.2.1** | encoding خروجی برای پاسخ HTTP، سند HTML یا سند XML با زمینه‌ای که داده در آن استفاده می‌شود باید متناسب باشد؛ برای مثال، در رمزگذاری کاراکترهای مربوط به عناصر HTML، صفات HTML، توضیحات HTML، CSS یا فیلدهای هدر HTTP به‌گونه‌ای عمل شود که ساختار پیام یا سند تغییر نکند. | 1 | +| **1.2.2** | هنگام ساخت پویا آدرس‌های URL، داده‌های غیرقابل‌اعتماد باید متناسب با زمینه استفاده‌شان رمزگذاری شوند (مثلاً URL Encoding یا base64url برای پارامترهای کوئری یا مسیر) همچنین اطمینان حاصل شود که فقط پروتکل‌های امن در URL مجاز باشند (برای نمونه، استفاده از JavaScript: یا data: ممنوع شود) | 1 | +| **1.2.3** | هنگام تولید پویا محتوای JavaScript (از جملهJSON)، از encoding یا escaping خروجی استفاده شود تا از تغییر ساختار پیام یا سند جلوگیری گردد (و از حملات تزریق JavaScript یا JSON پیشگیری شود). | 1 | +| **1.2.4** | در انتخاب داده یا اجرای کوئری‌های پایگاه داده (مانند SQL، HQL، NoSQL ...)، از parameterized queries، ORMها، یا Entity Framework استفاده شود یا به روش‌های دیگر، برنامه در برابر تزریق SQL و سایر حملات تزریقی پایگاه داده ایمن شده باشد. این موضوع هنگام نوشتن stored procedure‌ها نیز صدق می‌کند. | 1 | +| **1.2.5** | برنامه در برابر تزریق دستورات سیستم‌عامل (OS command injection) محافظت شده است و در فراخوانی‌های سیستم‌عامل، از کوئری‌های پارامتری‌شده سیستم‌عامل یا Encoding خروجی دستورات سیستم‌عاملی استفاده می‌شود. | 1 | +| **1.2.6** | برنامه در برابر آسیب‌پذیری‌های تزریق LDAP محافظت شده است، یا اینکه کنترل‌های امنیتی مشخصی برای جلوگیری از تزریق LDAP پیاده‌سازی شده‌اند. | 2 | +| **1.2.7** | برنامه در برابر حملات تزریقXPath، به‌وسیله‌ی استفاده از کوئری‌های پارامتری‌شده یا کوئری‌های از پیش‌کامپایل‌شده محافظت شده باشد. | 2 | +| **1.2.8** | پردازشگرهای LaTeX به‌صورت امن پیکربندی شده‌اند (برای نمونه با عدم استفاده از گزینه‌ی --shell-escape ) و از فهرست مجاز دستورات (allowlist) برای جلوگیری از حملات تزریق LaTeX استفاده شده است. | 2 | +| **1.2.9** | برنامه کاراکترهای ویژه در عبارات Regex را escape می‌کند (معمولاً با استفاده از \)، تا این کاراکترها به‌اشتباه به‌عنوان متاکاراکتر تفسیر نشوند. | 2 | +| **1.2.10** | برنامه در برابر حملات تزریق CSV و فرمول (Formula Injection) محافظت شده است. برنامه باید هنگام خروجی‌ گرفتن فایل‌های CSV، از قوانین escape تعیین‌شده در بخش‌های ۲.۶ و ۲.۷ استاندارد RFC 4180 پیروی کند. همچنین، هنگام خروجی گرفتن به فرمت CSV یا سایر فرمت‌های صفحه‌گسترده (مانند XLS، XLSX یا ODF)، اگر کاراکترهای ویژه‌ای مانند '='، '+'، '-'، '@'، \t (tab) و 0\ (Null character) در ابتدای مقدار یک فیلد قرار داشته باشند، باید با یک تک‌کوتیشن (') escape شوند. | 3 | + +نکته: استفاده از کوئری‌های پارامتری‌شده (Parameterized Queries) یا Escapingداده‌ها در SQL همیشه به‌تنهایی کافی نیست. بخش‌هایی از کوئری مثل نام جدول‌ها و ستون‌ها (از جمله نام ستون‌هایی که در دستور ORDER BY استفاده شده‌اند) را نمی‌توان با escape کردن امن کرد .اگر داده‌هایی که کاربر وارد کرده (حتی بعد از escape کردن) در این بخش‌ها استفاده شوند، ممکن است:کوئری به‌درستی اجرا نشود (خطای SQL بده)، یا باعث حمله‌ی SQL Injection شود. + +## V1.3 پاک‌سازی (Sanitization) + +ایده‌آل‌ترین روش محافظت در برابر استفاده از محتوای غیرقابل اعتماد در یک بستر ناامن، استفاده از encoding یا escaping متناسب با همان بستر است؛ روشی که معنای اصلی محتوای ناامن را حفظ می‌کند اما آن را برای استفاده در همان زمینه ایمن می‌سازد — همان‌طور که در بخش قبلی به‌تفصیل توضیح داده شد. + +اما اگر این امکان وجود نداشته باشد، باید از sanitization (پاک‌سازی) استفاده شود؛ یعنی حذف کاراکترها یا بخش‌هایی از محتوا که ممکن است خطرناک باشند. در برخی موارد، این کار ممکن است باعث تغییر معنای ورودی شود، اما از منظر امنیتی، چاره‌ای جز این وجود ندارد. + +| # | Description | Level | +| :---: | :--- | :---: | +| **1.3.1** | تمام ورودی‌های HTML غیرقابل اعتماد (مثلاً از طریق ویرایشگرهای WYSIWYG یا ابزارهای مشابه)، با استفاده از یک کتابخانه یا قابلیت امن و معتبر sanitization (پاک‌سازی) ‌شوند. | 1 | +| **1.3.2** | برنامه استفاده از تابعeval یا سایر قابلیت‌های اجرای پویا (dynamic) کد، مانند Spring Expression Language (SpEL)، اجتناب ‌کند. در مواردی که استفاده از این قابلیت‌ها اجتناب‌ناپذیر است، ورودی‌های کاربر که در اجرای کد گنجانده می‌شوند باید پیش از اجرا، به‌طور کامل پاک‌سازی (sanitized) شوند. | 1 | +| **1.3.3** | بخش‌های حائز اهمیت که احتمال وقوع حملات ناشی از ورودی‌های کاربر در آنها بالاست؛ باید پیشاپیش عملیاتSanitization جهت اقدامات ایمنی روی داده‌ها انجام شود؛ برای مثال، تنها کاراکترهایی که برای آن محتوا ایمن محسوب می‌شوند مجاز باشند، و ورودی‌های بیش‌از‌حد بلند نیز کوتاه (trim) شوند. | 2 | +| **1.3.4** | محتوای اسکریپت‌پذیر (scriptable) فایل‌های SVG که توسط کاربر ارائه می‌شود، مورد اعتبارسنجی یا پاک‌سازی (sanitization) قرار گرفته باشد تا فقط شامل تگ‌ها و ویژگی‌هایی (attributes) باشد که برای برنامه ایمن هستند؛ برای مثال، از درج اسکریپت‌ها و عناصر خطرناک مانند foreignObject جلوگیری شده باشد. | 2 | +| **1.3.5** | برنامه محتوای زبان‌های قالب‌نویسی یا اسکریپت‌پذیر ارائه‌شده توسط کاربر، مانند Markdown، CSS یا استایل‌شیت‌های XSL، BBCode یا موارد مشابه را پاک‌سازی (sanitize) کرده یا غیرفعال کرده باشد. | 2 | +| **1.3.6** | برنامه در برابر حملات جعل درخواست سمت سرور (SSRF) محافظت شده باشد؛ به این صورت که داده‌های غیرقابل اعتماد را در برابر یک لیست مجاز از پروتکل‌ها، دامنه‌ها، مسیرها و پورت‌ها اعتبارسنجی کرده و کاراکترهای بالقوه خطرناک را پیش از استفاده از داده برای فراخوانی سرویس دیگر پاک‌سازی (sanitize) می‌کند. | 2 | +| **1.3.7** | برنامه در برابر حملات تزریق قالب (Template Injection) محافظت شده باشد؛ به این صورت که ساخت قالب‌ها بر پایه داده‌های غیرقابل اعتماد مجاز نباشد. در صورتی که هیچ راه‌حل جایگزینی وجود نداشته باشد، هرگونه ورودی غیرقابل اعتماد که به‌صورت پویا در فرآیند ایجاد قالب وارد می‌شود، باید پیش از استفاده یا پاک‌سازی (sanitize) شود یا به‌صورت سخت‌گیرانه اعتبارسنجی (validate) گردد. | 2 | +| **1.3.8** | برنامه، ورودی غیرقابل اعتماد را پیش از استفاده در کوئری‌های Java Naming and Directory Interface (JNDI) به‌درستی پاک‌سازی (sanitize) می‌کند و همچنین اطمینان حاصل شود که پیکربندی JNDI به‌گونه‌ای امن انجام شده تا از بروز حملات تزریق JNDI جلوگیری شود. | 2 | +| **1.3.9** | برنامه، محتوا را پیش از ارسال به memcache پاک‌سازی (sanitize) می‌کند تا از حملات تزریق (injection attacks) جلوگیری شود. | 2 | +| **1.3.10** | رشته‌های قالب‌بندی (format strings) که ممکن است هنگام استفاده، به‌شکلی ناخواسته یا مخرب تفسیر شوند، پیش از پردازش پاک‌سازی (sanitize) شوند. | 2 | +| **1.3.11** | برنامه ورودی‌های کاربر را پیش از ارسال به سامانه‌های ایمیل (مانند SMTP یا IMAP) پاک‌سازی (sanitize) ‌کند تا از حملات تزریق در SMTP یا IMAP جلوگیری شود. | 2 | +| **1.3.12** | عبارات منظم (Regular Expressions) عاری از اجزایی هستند که باعث بازگشت‌پذیری نمایی (exponential backtracking) می‌شوند، و همچنین ورودی‌های غیرقابل اعتماد به‌درستی پاک‌سازی (sanitize) شوند تا از حملات ReDoS (انکار سرویس با استفاده از عبارات منظم) یا Runaway Regex جلوگیری گردد. | 3 | + +## V1.4 حافظه، رشته و کد بدون مدیریت (Memory, String, and Unmanaged Code) + +الزامات زیر به ریسک‌های ناشی از استفاده ناایمن از حافظه می‌پردازند، که معمولاً در شرایطی مطرح هستند که برنامه از زبان‌های سیستمی یا کدهای مدیریت‌نشده (unmanaged code) استفاده می‌کند. + +در برخی موارد، می‌توان با تنظیم پرچم‌های کامپایلر (compiler flags) به این هدف دست یافت؛ مانند فعال‌سازی محافظت‌ها و هشدارهای مربوط به سرریز بافر (buffer overflow)، تصادفی‌سازی پشته (stack randomization)، جلوگیری از اجرای داده‌ها (DEP)، و همچنین توقف فرایند ساخت (build) در صورت شناسایی عملیات ناایمن روی اشاره‌گرها، حافظه، رشته‌های قالب‌بندی، اعداد صحیح یا رشته‌های متنی. + +| # | Description | Level | +| :---: | :--- | :---: | +| **1.4.1** | برنامه از رشته‌های ایمن از نظر مدیریت حافظه، کپی حافظه‌ای ایمن‌تر و حساب‌گری ایمن‌تر روی اشاره‌گرها استفاده می‌کند تا از سرریز پشته (stack overflow)، سرریز بافر (buffer overflow) یا سرریز حافظه پویای (heap overflow) جلوگیری کرده یا آن‌ها را شناسایی کند. | 2 | +| **1.4.2** | از تکنیک‌های اعتبارسنجی علامت (sign validation)، محدوده (range validation) و ورودی (input validation) استفاده شده است تا از بروز سرریز عدد صحیح (integer overflow) جلوگیری شود. | 2 | +| **1.4.3** | حافظه و منابعی که به‌صورت پویا تخصیص داده شده‌اند، به‌درستی آزاد (release) می‌شوند و همچنین ارجاع‌ها یا اشاره‌گرها (pointers) به حافظه آزادشده حذف یا به null تنظیم می‌شوند تا از اشاره‌گرهای معلق (dangling pointers) و آسیب‌پذیری‌های استفاده پس از آزادسازی (use-after-free) جلوگیری شود. | 2 | + +## V1.5 سریال‌زدایی ایمن (Safe Deserialization) + +تبدیل داده‌ها از یک قالب ذخیره‌شده یا انتقال‌یافته به یک object واقعی برنامه)فرایند (deserialization در گذشته منبع بسیاری از آسیب‌پذیری‌های تزریق کد بوده است. بنابراین، انجام این فرایند باید با دقت و به‌صورت ایمن صورت گیرد تا از بروز چنین مشکلاتی جلوگیری شود. + +به‌ویژه، برخی از روش‌های deserialization طبق مستندات زبان‌های برنامه‌نویسی یا چارچوب‌ها به‌عنوان ناایمن شناخته شده‌اند و نمی‌توانند هنگام کار با داده‌های غیرقابل‌اعتماد به‌صورت ایمن استفاده شوند. برای هر مکانیزم مورداستفاده، باید بررسی دقیق و مسئولانه (due diligence) انجام شود. + +| # | Description | Level | +| :---: | :--- | :---: | +| **1.5.1** | برنامه، XML Parserها را به‌گونه‌ای پیکربندی کرده باشد که از تنظیمات محدودکننده استفاده کنند، و ویژگی‌های ناایمنی مانند resolve کردن موجودیت‌های خارجی (external entities) غیرفعال شده باشند تا از حملات XML External Entity (XXE) جلوگیری شود. | 1 | +| **1.5.2** | فرآیند deserialization داده‌های غیرقابل‌اعتماد، با اجرای مدیریت ایمن ورودی‌ها همراه باشد؛ برای مثال، استفاده از لیست مجاز (allowlist) انواع objectها یا محدود کردن انواع تعریف‌شده توسط کلاینت برای جلوگیری از حملات مرتبط با deserialization. همچنین، مکانیزم‌های deserialization که به‌طور صریح به‌عنوان ناایمن شناخته شده‌اند، نباید با داده‌های غیرقابل‌اعتماد مورد استفاده قرار گیرند. | 2 | +| **1.5.3** | Parser های مختلفی که در برنامه برای یک نوع داده مشخص استفاده می‌شوند (برای مثال: Parser های JSON، XML یا URL)، رفتار تحلیلی یکسانی دارند و از مکانیزم یکسانی برای encoding کاراکترها استفاده می‌کنند، تا از بروز مشکلاتی مانند آسیب‌پذیری در سازگاری JSON (JSON Interoperability) یا تفاوت در نحوه تحلیل URI یا مسیر فایل که ممکن است در حملات RFI یا SSRF سوءاستفاده شود، جلوگیری شود. | 3 | + +## References + +برای اطلاعات بیشتر، همچنین به منابع زیر مراجعه کنید: + +* [OWASP LDAP Injection Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html) +* [OWASP Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) +* [OWASP DOM Based Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html) +* [OWASP XML External Entity Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html) +* [OWASP Web Security Testing Guide: Client-Side Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/11-Client-side_Testing) +* [OWASP Java Encoding Project](https://owasp.org/owasp-java-encoder/) +* [DOMPurify - Client-side HTML Sanitization Library](https://github.com/cure53/DOMPurify) +* [RFC4180 - Common Format and MIME Type for Comma-Separated Values (CSV) Files](https://datatracker.ietf.org/doc/html/rfc4180#section-2) + +برای اطلاعات بیشتر، به‌ویژه در مورد مشکلات deserialization یا parsing، لطفاً مراجعه کنید به: + +* [OWASP Deserialization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) +* [An Exploration of JSON Interoperability Vulnerabilities](https://bishopfox.com/blog/json-interoperability-vulnerabilities) +* [Orange Tsai - A New Era of SSRF Exploiting URL Parser In Trending Programming Languages](https://www.blackhat.com/docs/us-17/thursday/us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf) diff --git a/5.0/fa/0x11-V2-Validation-and-Business-Logic.md b/5.0/fa/0x11-V2-Validation-and-Business-Logic.md new file mode 100644 index 0000000000..0164a70c97 --- /dev/null +++ b/5.0/fa/0x11-V2-Validation-and-Business-Logic.md @@ -0,0 +1,73 @@ +# V2 Validation and Business Logic + +## هدف + +یک برنامه مورد تائید باید الزامات سطح بالا را به شرح زیر برآورده سازد: + +* داده‌های دریافتی برنامه با الزامات تجاری یا عملکردی مطابقت داشته باشد. +* منطق تجاری (Business Logic) دارای جریان ترتیبی بوده، به‌صورت گام‌به‌گام پردازش ‌شود و قابل دور زدن نباشد. +* منطق تجاری شامل محدودیت‌ها و کنترل‌هایی برای شناسایی و جلوگیری از حملات خودکار است؛ مانند انتقال‌های مکرر با مبالغ کم یا اضافه‌کردن میلیون‌ها دوست به‌صورت تک‌تک. +* در طراحی و پیاده‌سازی جریان‌های منطق تجاری با ارزش بالا، سناریوهای سوءاستفاده و کاربران مخرب در نظر گرفته‌ شود و تدابیری نظیر محافظت در برابر جعل هویت (Spoofing)، دستکاری (Tampering)، افشای اطلاعات و ارتقای سطح دسترسی (Privilege Escalation) اتخاذ شده باشد. + +## V2.1 مستندات اعتبارسنجی و منطق کسب‌وکار ( Validation and Business Logic Documentation) + +مستندات اعتبارسنجی و منطق تجاری باید به‌روشنی محدودیت‌های منطق کسب و کار، قوانین اعتبارسنجی و سازگاری مناسب بین داده‌‌های ترکیب شده (از نظر مفهومی و متنی) را تعریف کنند، تا مشخص باشد چه مواردی باید در برنامه پیاده‌سازی شوند. + +| # | Description | Level | +| :---: | :--- | :---: | +| **2.1.1** | قوانین اعتبارسنجی ورودی‌های برنامه (مندرج در مستندات برنامه) ‌باید چگونگی بررسی صحت داده‌ها را مطابق با ساختار مورد انتظار مشخص نماید. این ساختار می‌تواند شامل فرمت‌های رایج داده مانند شماره کارت اعتباری، آدرس ایمیل، شماره تلفن یا یک قالب داده‌ای داخلی باشد. | 1 | +| **2.1.2** | قوانین اعتبارسنجی ورودی‌های برنامه (مندرج در مستندات برنامه) باید چگونگی بررسی سازگاری مناسب بین داده‌‌های ترکیب شده (از نظر مفهومی و متنی) را مشخص نماید؛ مانند تطبیق کدپستی با نام محله. | 2 | +| **2.1.3** | انتظارات مربوط به محدودیت‌ها و اعتبارسنجی‌های منطق کسب و کار مستند شده باشند؛ این مستندات باید شامل محدودیت‌ها در سطح هر کاربر و محدودیت‌های عمومی در سطح برنامه باشند. | 2 | + +## V2.2 اعتبارسنجی ورودی (Input Validation) + +کنترل‌های مؤثر در اعتبارسنجی ورودی، انتظارات کسب و کار یا عملکردی مرتبط با نوع داده‌ای که برنامه باید دریافت کند را اعمال می‌کنند. این کار منجر به کیفیت بهتر داده‌ها و کاهش دامنه حمله (Attack Surface) می‌شود. با این حال، اعتبارسنجی ورودی جایگزین استفاده از encoding ، پارامتری‌سازی یا پاک‌سازی داده‌ها هنگام استفاده از داده در سایر بخش‌های برنامه یا هنگام نمایش درخروجی نمی‌باشد. + +در این زمینه، «ورودی» می‌تواند از منابع متنوعی دریافت شود، از جمله: فیلدهای فرم HTML، درخواست‌های REST، پارامترهای URL، فیلدهای هدر HTTP،کوکی‌ها، فایل‌های ذخیره‌شده در دیسک، پایگاه‌های داده، APIهای خارجی. + +یک کنترل منطق کسب و کاری ممکن است بررسی کند که مقدار ورودی، عددی کمتر از 100 است.یک انتظار عملکردی ممکن است بررسی کند که یک عدد (که تعیین می‌کند یک حلقه چند بار اجرا شود تا پردازش بیش از حد و در نتیجه وضعیت انکار سرویس(DoS) اتفاق نیافتد) از یک آستانه‌ی خاص کمتر باشد. + +با اینکه اعتبارسنجی بر پایه Schema الزام صریح ندارد، ولی این روش می‌تواند مؤثرترین راهکار برای پوشش کامل اعتبارسنجی در APIهای HTTP یا سایر واسط‌هایی که از JSON یا XML استفاده می‌کنند باشد. + +نکات مهم درباره اعتبارسنجی بر اساس Schema: + +* "نسخه منتشرشده" از مشخصات JSON Schema Validation، برای استفاده در محیط تولید مناسب تلقی می‌شود، نه لزوما پایدار(Stable). هنگام استفاده از این نوع اعتبارسنجی، باید اطمینان حاصل شود که هیچ مغایرتی با الزامات زیر وجود ندارد. +* در صورت نیاز پس از رسمی و نهایی شدن استاندارد، تمامی کتابخانه‌های مورد استفاده برای JSON Schema Validationباید به‌صورت مستمر پایش و به‌روزرسانی شوند. +* اعتبارسنجی DTD نباید مورد استفاده قرار گیرد و ارزیابی DTD در فریم‌ورک‌ها باید غیرفعال شود، تا از حملات XXE مرتبط با DTD جلوگیری شود. + +| # | Description | Level | +| :---: | :--- | :---: | +| **2.2.1** | ورودی‌ها باید به‌منظور اعمال انتظارات کسب و کار یا عملکردی مرتبط با آن‌ها اعتبارسنجی ‌شوند.این اعتبارسنجی باید یکی از این دو روش زیر را داشته باشد، استفاده از اعتبارسنجی مثبت (Positive Validation) مبتنی بر فهرست مجاز از مقادیر، الگوها یا بازه‌های قابل قبول و تطبیق با ساختار مورد انتظار و محدودیت‌های منطقی، بر اساس قوانین از پیش تعریف‌شده. برای سطح 1 (L1)، تمرکز می‌تواند بر ورودی‌هایی باشد که در تصمیم‌گیری‌های خاص تجاری یا امنیتی استفاده می‌شوند. برای سطح 2 و بالاتر، این اعتبارسنجی باید شامل تمام ورودی‌ها باشد. | 1 | +| **2.2.2** | برنامه به‌گونه‌ای طراحی شود که اعتبارسنجی ورودی را در لایه‌ قابل اعتمادی از سرویس (Trusted Service Layer) اعمال کند. هرچند اعتبارسنجی سمت کلاینت (Client-side Validation) باعث بهبود تجربه کاربری می‌شود و توصیه می‌گردد، اما نباید به‌عنوان یک کنترل امنیتی اتکا شود. | 1 | +| **2.2.3** | برنامه باید اطمینان حاصل نماید که ترکیب داده‌های مربوطه با توجه به قوانین از پیش تعریف‌شده معقول و منطقی باشد. | 2 | + +## V2.3 امنیت منطق کسب‌وکار (Business Logic Security) + +این بخش به الزامات کلیدی می‌پردازد که هدف آن‌ها اطمینان از پیاده سازی صحیح منطق کسب و کاری برنامه است و برنامه در برابر حملات مربوط به کسب و کار، مصون است. + +| # | Description | Level | +| :---: | :--- | :---: | +| **2.3.1** | اطمینان حاصل شود که برنامه فقط جریان‌های منطق تجاری را برای همان کاربر و طبق ترتیب گام‌به‌گام از پیش تعیین شده و مورد انتظار پردازش می‌کند و امکان رد کردن مراحل (Skipping Steps) وجود ندارد. | 1 | +| **2.3.2** | اطمینان حاصل شود که محدودیت‌های منطق تجاری مطابق با مستندات برنامه پیاده‌سازی شده‌اند، تا از سوء‌استفاده از نقص‌های منطقی جلوگیری شود. | 2 | +| **2.3.3** | تراکنش‌های سطح منطق کسب‌وکار (business logic) باید به‌گونه‌ای استفاده شوند که یا یک عملیات منطق کسب‌وکار به‌طور کامل با موفقیت انجام شود، یا در صورت بروز خطا، به حالت صحیح قبلی بازگردد(rollback) شود. | 2 | +| **2.3.4** | در منطق کسب‌وکار (business logic)باید از مکانیزم‌های قفل‌گذاری (locking) استفاده شده باشد تا اطمینان حاصل شود که منابع محدود (مانند صندلی‌های سینما یا بازه‌های زمانی تحویل)، قابل رزرو دوباره (double-booked) از طریق دستکاری منطق برنامه نباشند. | 2 | +| **2.3.5** | اطمینان حاصل شود که جریان‌های منطق کسب و کاری با ارزش بالا نیازمند تایید چند کاربره (Multi-user Approval) هستند تا از اقدامات غیرمجاز یا تصادفی جلوگیری شود. این موارد می‌تواند شامل – اما نه محدود به – انتقال‌های مالی بزرگ، تایید قرارداد‌ها، دسترسی به اطلاعات طبقه‌بنده شده، یا غیرفعال‌سازی‌های ایمنی در محیط‌های تولید صنعتی باشد. | 3 | + +## V2.4 مقابله با خودکارسازی (Anti-automation) + +این بخش شامل کنترل‌های ضد خودکارسازی است تا تعاملات انسانی‌مانند الزامی شود و از درخواست‌های خودکار بیش‌ازحد جلوگیری گردد. + +| # | Description | Level | +| :---: | :--- | :---: | +| **2.4.1** | کنترل‌های ضد خودکارسازی (Anti-Automation) در سیستم پیاده‌سازی شده باشند تا از سوءاستفاده‌هایی مانند فراخوانی بیش از حد توابع برنامه جلوگیری شود؛ چرا که این نوع حملات می‌توانند منجر به استخراج غیرمجاز داده‌ها، تولید داده‌های زائد، مصرف کامل سهمیه‌ها، عبور از محدودیت‌های نرخ (Rate Limit)، ایجاد اختلال در سرویس (DoS) یا استفاده بیش از حد از منابع گران‌قیمت شوند. | 2 | +| **2.4.2** | بررسی کنید که جریان‌های منطق کسب‌وکار (Business Logic Flows) به گونه‌ای طراحی شده باشند که نیازمند زمان‌بندی واقعی انسان باشند، و از ارسال سریع و غیرطبیعی تراکنش‌ها (Transaction Submissions) جلوگیری کنند. | 3 | + +## References + +برای اطلاعات بیشتر، همچنین به منابع زیر مراجعه کنید: + +* [OWASP Web Security Testing Guide: Input Validation Testing](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/README.html) +* [OWASP Web Security Testing Guide: Business Logic Testing](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/10-Business_Logic_Testing/README) +* جلوگیری از خودکارسازی (Anti-automation) را می‌توان به روش‌های مختلفی انجام داد، از جمله با استفاده از [OWASP Automated Threats to Web Applications](https://owasp.org/www-project-automated-threats-to-web-applications/) +* [OWASP Input Validation Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html) +* [JSON Schema](https://json-schema.org/specification.html) diff --git a/5.0/fa/0x12-V3-Web-Frontend-Security.md b/5.0/fa/0x12-V3-Web-Frontend-Security.md new file mode 100644 index 0000000000..196b718d06 --- /dev/null +++ b/5.0/fa/0x12-V3-Web-Frontend-Security.md @@ -0,0 +1,101 @@ +# V3 امنیت رابط کاربری وب (Web Frontend Security) + +## هدف کنترلی + +این دسته از الزامات بر روی محافظت در برابر حملاتی تمرکز دارد که از طریق رابط وب (Web Frontend) برنامه اجرا می‌شوند. این الزامات برای راهکارهایی از نوع ماشین-به-ماشین (Machine-to-Machine) کاربردی ندارند. + +## V3.1 مستندسازی امنیت رابط کاربری وب ( Web Frontend Security Documentation) + +این بخش ویژگی‌های امنیتی مرورگر را که باید در مستندات برنامه مشخص شوند، توضیح می‌دهد. + +| # | Description | Level | +| :---: | :--- | :---: | +| **3.1.1** | در مستندات برنامه باید ویژگی‌های امنیتی مربوط به مرورگری که برنامه را اجرا میکند مشخص شده باشد (نظیر استفاده از HTTPS، پشتیبانی از HTTP Strict Transport Security (HSTS)، اجرای Content Security Policy (CSP) و سایر مکانیزم‌های امنیتی مرتبط با HTTP). همچنین در مستندات باید مشخص شود مرورگر در صورت عدم دسترسی به این ویژگی‌ها چه رفتاری باید داشته باشد. (برای مثال: نمایش هشدار به کاربر یا ممانعت از دسترسی به برنامه). | 3 | + +## V3.2 تفسیر ناخواسته محتوا (Unintended Content Interpretation) + +پردازش محتوا یا عملکرد مربوط به آن در یک شرایط زمینه‌‌ای نادرست می‌تواند منجر به اجرای یا نمایش محتوای مخرب برای کاربر شود. + +| # | Description | Level | +| :---: | :--- | :---: | +| **3.2.1** | کنترل‌های امنیتی متناسب با مرورگر‌ها در هنگام پردازش پاسخ‌های HTTP به منظور جلوگیری از پردازش محتوا یا عملکرد مربوط به آن در شرایط زمینه‌‌ای نادرست باید بکار‌گرفته شود. (برای مثال، زمانی که یک APIیا یک فایل بارگذاری‌شده توسط کاربر یا هر منبع دیگری به‌طور مستقیم درخواست می‌شود).کنترل‌های ممکن می‌توانند شامل این موارد باشند: عدم پردازش محتوا مگر در صورت وجود هدرهای متناسب با درخواست‌های HTTP (مانند ‎Sec-Fetch-*) به منظور اطمیان از صحیح بودن پردازش محتوا یا عملکرد مربوط به . استفاده از عبارت sandbox در هدر Content-Security-Policy یا استفاده از نوعattachment در هدر Content-Disposition . | 1 | +| **3.2.2** | اطمینان حاصل شود که محتوایی که برای نمایش به‌صورت متن طراحی شده نه برای پردازش به صورتHTML ، با استفاده از توابع امن نظیر CreateTextNode یا textContent به منظور جلوگیری از اجرای ناخواسته محتوایی مانند HTML یا JavaScript پردازش ‌شود. | 1 | +| **3.2.3** | برنامه هنگام استفاده از جاوااسکریپت سمت کاربر (Client-Side JavaScript)، با استفاده از اعلام متغیرها به‌صورت صریح، انجام بررسی نوع به‌صورت سخت‌گیرانه، اجتناب از ذخیره‌سازی متغیرهای سراسری بر روی شیء document، و پیاده‌سازی ایزولاسیون فضای نام (namespace isolation)، از وقوع DOM Clobbering جلوگیری می‌کند. | 3 | + +## V3.3 پیکربندی کوکی (Cookie Setup) + +این بخش الزامات مربوط به پیکربندی ایمن کوکی‌های حساس را تشریح می‌کند تا سطح بالاتری از اطمینان نسبت به این‌که آن‌ها توسط خود برنامه ایجاد شده‌اند فراهم شود و همچنین از نشت محتوای آن‌ها یا تغییر نامناسبشان جلوگیری گردد. + +| # | Description | Level | +| :---: | :--- | :---: | +| **3.3.1** | اطمینان حاصل شود که کوکی‌ها دارای ویژگی ‘Secure’ هستند. در صورتی که از پیشوند ‘__Host-’ برای نام کوکی استفاده نمی‌شود، باید پیشوند__Secure- در نام کوکی لحاظ شده باشد. | 1 | +| **3.3.2** | اطمینان حاصل شود که مقدار ویژگی SameSite برای هر کوکی، متناسب با هدف آن کوکی تنظیم شده باشد تا میزان آسیب‌پذیری در برابر حملات فریب سمت کلاینت نظیر CSRF کاهش یابد. | 2 | +| **3.3.3** | اطمینان حاصل شود که کوکی‌ها از پیشوند __Host- در نام خود استفاده می‌کنند، مگر در مواردی که کوکی به‌طور مشخص برای اشتراک‌گذاری بین چند دامنه (Hosts) طراحی شده باشد. | 2 | +| **3.3.4** | اطمینان حاصل شود که اگر مقدار کوکی (مثلاً توکن نشست) نباید برای اسکریپت‌های سمت کلاینت در دسترس باشد، ویژگی HttpOnly باید برای آن کوکی فعال شده باشد، و همچنین مقدار کوکی (مثلاً همان توکن نشست) تنها از طریق هدر Set-Cookie به کلاینت ارسال شود. | 2 | +| **3.3.5** | اطمینان حاصل شود که حداکثر مجموع نام و مقدار کوکی از ۴۰۹۶ بایت تجاوز نکند.کوکی‌هایی که بیش از این مقدار باشند توسط مرورگر ذخیره نخواهند شد، و بنابراین در درخواست‌ها ارسال نمی‌شوند؛ موضوعی که ممکن است باعث شود عملکردهایی از برنامه که به آن کوکی وابسته‌اند، غیرفعال یا مختل شوند. | 3 | + +## V3.4 هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers) + +این بخش مشخص می‌کند که کدام هدرهای امنیتی باید در پاسخ‌های HTTP تنظیم شوند، تا هنگام پردازش پاسخ توسط مرورگر، ویژگی‌ها و محدودیت‌های امنیتی مرورگر فعال گردند. + +| # | Description | Level | +| :---: | :--- | :---: | +| **3.4.1** | اطمینان حاصل شود که در تمامی پاسخ‌های HTTP، هدر Strict-Transport-Security وجود دارد تا سیاست HSTS (HTTP Strict Transport Security) اعمال شود. حداقل مقدار max-age باید برابر با یک سال باشد. برای برنامه‌های سطح 2 (L2) و بالاتر، این سیاست باید برای تمام زیردامنه‌ها (subdomains) نیز اعمال شود. | 1 | +| **3.4.2** | اطمینان حاصل شود که هدرAccess-Control-Allow-Origin مربوط به (CORS)، دارای یک مقدار ثابت و مشخص توسط برنامه باشد یا اگر هدر Origin در درخواست مورد استفاده قرار می گیرد باید با فهرستی از مبدأهای مورد اعتماد (Allowlist) اعتبارسنجی شود. در صورتی که استفاده از مقدار * در Access-Control-Allow-Origin تنظیم شده باشد، اطمینان حاصل شود که هیچ اطلاعات حساسی در پاسخ قرار ندارد. | 1 | +| **3.4.3** | اطمینان حاصل شود که تمامی پاسخ‌های HTTP شامل هدر Content-Security-Policy باشند تا ریسک اجرای اسکریپت‌های مخرب (مانند (JavaScript مخرب کاهش یابد. دستورهای object-src 'none' و base-uri 'none' الزامی هستند .برای برنامه‌های سطح 3 (L3)، باید سیاست CSP به‌صورت اختصاصی برای هر پاسخ(Per-response Policy) و مبتنی بر nonce یا hash تعریف شده باشد. | 2 | +| **3.4.4** | اطمینان حاصل شود که تمامی پاسخ‌ها شامل هدر X-Content-Type-Options: nosniff باشند، این (هدر) به مرورگرها دستور می‌دهد که برای پاسخ دریافتی از Content Sniffing یا حدس‌زدن نوع محتوا (MIME Type Guessing) استفاده نکنند و آن‌ها را ملزم می‌کند که نوع محتوای واقعی را دقیقاً مطابق مقدار هدر Content-Type در درخواست/پاسخ در نظر بگیرند.برای مثال، پاسخ به یک درخواست برای یک فایل استایل (CSS) تنها در صورتی پذیرفته می‌شود که مقدار Content-Type در پاسخ 'text/css' باشد.این کار همچنین امکان استفاده از قابلیت مسدودسازی خواندن منابع از مبدا متفاوت Cross-Origin Read Blocking یا (CORB) توسط مرورگر را فراهم می‌سازد. | 2 | +| **3.4.5** | برنامه باید (وب‌سایت یا اپلیکیشن) یک "Referrer Policy" (سیاست ارجاع) تنظیم کرده باشد تا از نشت اطلاعات حساس از طریق هدر HTTP به نام Referer به سرویس‌های شخص ثالث جلوگیری شود. این کار را می‌توان از طریق هدر پاسخ HTTP به نام Referrer-Policy یا با استفاده از ویژگی‌هایی در عناصر HTML انجام داد.اطلاعات حساس ممکن است شامل مسیر (Path) و داده‌های کوئری (Query) در آدرس URL باشد، و در مورد برنامه‌های داخلی و غیرعمومی، حتی نام میزبان (hostname) نیز می‌تواند جزو اطلاعات حساس محسوب شود. | 2 | +| **3.4.6** | برنامه باید از frame-ancestors در هدر Content-Security-Policy (CSP) برای تمام پاسخ‌های HTTP استفاده کند،تا به‌صورت پیش‌فرض، اجازه‌ی نمایش سایت در قالب iframe داده نشود، و فقط در صورت نیاز، نمایش منابع خاص (specific resources) در iframe مجاز باشد.به این نکته توجه کنید که هدر X-Frame-Options با اینکه هنوز توسط برخی مرورگرها پشتیبانی می‌شود، اما قدیمی (obsolete) است و نباید به آن تکیه کرد. | 2 | +| **3.4.7** | هدر Content-Security-Policy (CSP) باید شامل یک آدرس برای گزارش (Report violation) باشد. | 3 | +| **3.4.8** | تمام پاسخ‌های HTTP که باعث رندر (نمایش) یک سند می‌شوند مانند (پاسخ‌هایی با نوع محتوا (text/html باید شامل هدر Cross-Origin-Opener-Policy با دستور same-origin یا same-origin-allow-popups باشند (بنا به نیاز). این کار از حملاتی جلوگیری می‌کند که از دسترسی مشترک به اشیای Window سوءاستفاده می‌کنند، مانند حملات tabnabbing و frame counting. | 3 | + +## V3.5 تفکیک مبدا توسط مرورگر (Browser Origin Separation) + +وقتی یک درخواست برای انجام عملکرد حساس در سمت سرور پذیرفته می‌شود، برنامه باید اطمینان حاصل کند که این درخواست واقعاً از طرف خود برنامه یا یک منبع مورد اعتماد ارسال شده و توسط مهاجم جعل نشده است. + +عملکرد حساس در این زمینه می‌تواند شامل مواردی مانند ارسال فرم‌ها برای کاربران تأییدشده یا تأییدنشده (مثلاً درخواست احراز هویت)، عملیات تغییر وضعیت (state-changing operations)، یا عملکردهایی که منابع زیادی مصرف می‌کنند (مانند خروجی گرفتن از داده‌ها) باشد. + +مکانیزم‌های کلیدی برای محافظت در برابر چنین حملاتی شامل سیاست‌های امنیتی مرورگرها مانند Same Origin Policy برای جاوااسکریپت و همچنین منطق SameSite برای کوکی‌ها هستند. +یکی دیگر از روش‌های رایج برای محافظت، مکانیزم CORS preflight است. این مکانیزم به‌ویژه برای اندپوینت‌هایی که قرار است از یک مبدأ متفاوت فراخوانی شوند حیاتی است، اما حتی برای اندپوینت‌هایی که نباید از مبدأهای دیگر فراخوانی شوند نیز می‌تواند به‌عنوان یک لایه محافظتی مؤثر در برابر جعل درخواست Request Forgery عمل کند. + +| # | Description | Level | +| :---: | :--- | :---: | +| **3.5.1** | برنامه باید از مکانیزم Preflight در CORS برای جلوگیری از درخواست‌های cross-origin به عملکردهای حساس استفاده نمی‌کند، این درخواست‌ها به‌گونه‌ای اعتبارسنجی شوند که فقط از مبدأ اصلی برنامه ارسال شده باشند. این اعتبارسنجی می‌تواند با استفاده از توکن‌های (anti- forgery tokens) یا الزام به ارسال هدرهای HTTP اضافی انجام شود که در لیست هدرهای مجاز CORS (CORS-safelisted) قرار ندارند. این اقدام برای محافظت در برابر حملات جعل درخواست از طریق مرورگر، که با نام CSRF (Cross-Site Request Forgery) شناخته می‌شوند، ضروری است. | 1 | +| **3.5.2** | اگر برنامه برای جلوگیری از استفاده غیرمجاز cross-origin از عملکردهای حساس، به مکانیزم Preflight در CORS متکی است، باید امکان فراخوانی این عملکردها با درخواست‌هایی که باعث ایجاد Preflight نمی‌شوند، وجود نداشته باشد. برای تحقق این هدف ممکن است لازم باشد مقدار هدرهای Origin و Content-Type بررسی شوند یا از هدر اضافی استفاده شود که در لیست هدرهای مجاز CORS قرار ندارد. | 1 | +| **3.5.3** | برنامه باید درخواست‌های HTTP که به عملکردهای حساس از متدهای مناسب مانند POST، PUT، PATCH یا DELETE استفاده می‌کنند، و نه از متدهایی که در استاندارد HTTP به‌عنوان "ایمن" تعریف شده‌اند، مانند GET، HEAD یا .OPTIONS به عنوان جایگزین یا مکمل، می‌توان از بررسی سخت‌گیرانه هدرهای Sec-Fetch-* استفاده کرد تا اطمینان حاصل شود که درخواست از منبع نامناسبی مثل بارگذاری تصویر، ناوبری صفحه یا فراخوانی cross-origin ارسال نشده است. | 1 | +| **3.5.4** | برنامه‌های مجزا باید روی نام‌های دامنه (hostname) متفاوت میزبانی شده‌اند تا از محدودیت‌های ارائه‌شده توسط (Same-Origin Policy) بهره‌مند شوند. این شامل کنترل تعامل اسناد یا اسکریپت‌های بارگذاری‌شده از یک مبدأ با منابع مبدأ دیگر و اعمال محدودیت بر اساس دامنه برای کوکی‌ها می‌شود. | 2 | +| **3.5.5** | برنامه باید پیام‌های دریافت‌شده از طریق رابط postMessage در صورتی که مبدأ پیام مورد اعتماد نباشد یا ساختار پیام نامعتبر باشد، نادیده گرفته می‌شوند. | 2 | +| **3.5.6** | هیچ‌کجای برنامه از قابلیت JSONP استفاده نشود تا از حملات Cross-Site Script Inclusion (XSSI) جلوگیری شود. | 3 | +| **3.5.7** | داده‌هایی که نیاز به احراز هویت دارند، در پاسخ‌های مربوط به منابع اسکریپتی(مانند فایل‌های (JavaScript نباید قرار بگیرند تا از حملات XSSI جلوگیری شود. | 3 | +| **3.5.8** | اطمینان حاصل کنید که منابع احراز هویت‌شده (مانند تصاویر، ویدیوها، اسکریپت‌ها و سایر اسناد) فقط در مواقعی که هدف آن است، قابل بارگذاری یا جاسازی توسط کاربر باشند. این کار را می‌توان با اعتبارسنجی دقیق هدرهای HTTP مانند Sec-Fetch-* انجام داد تا اطمینان حاصل شود که درخواست از یک منبع غیرمجاز ارسال نشده است، یا با تنظیم هدر Cross-Origin-Resource-Policy برای محدود کردن دسترسی مرورگر به محتوا. | 3 | + +## V3.6 یکپارچگی منابع خارجی (External Resource Integrity) + +این بخش، راهنمایی‌هایی برای میزبانی ایمن محتوا در سایت‌های شخص ثالث (Third-party) ارائه می‌دهد. + +| # | Description | Level | +| :---: | :--- | :---: | +| **3.6.1** | منابع سمت کلاینت مانند کتابخانه‌های جاوااسکریپت، فایل‌های CSS، یا فونت‌های وب، تنها در صورتی به‌صورت خارجی (مثلاً از طریق شبکه تحویل محتوا - CDN) میزبانی شوند که آن منابع: استاتیک (تغییرناپذیر) باشند، نسخه‌گذاری‌شده (versioned) باشند و یکپارچگی آن‌ها با استفاده از Subresource Integrity (SRI) بررسی شود. اگر این موارد امکان‌پذیر نیست، باید برای هر منبع، یک تصمیم امنیتی مستند وجود داشته باشد که توجیه کند چرا این منبع به این شکل بارگذاری می‌شود. | 3 | + +## V3.7 سایر ملاحظات امنیتی مرورگر (Other Browser Security Considerations) + +این بخش شامل مجموعه‌ای از کنترل‌های امنیتی و ویژگی‌های امنیتی مدرن مرورگر است که برای افزایش امنیت در سمت کلاینت (مرورگر کاربر) توصیه می‌شوند. + +| # | Description | Level | +| :---: | :--- | :---: | +| **3.7.1** | برنامه صرفا باید از فناوری‌های سمت کلاینتی استفاده ‌کند که همچنان پشتیبانی می‌شوند و از نظر امنیتی قابل اعتماد هستند.مثال‌هایی از فناوری‌هایی که این الزام را برآورده نمی‌کنند عبارتند از NSAPI Plugins،Flash،Shockwave،ActiveX،Silverlight،NACL و Appletهای جاوا در سمت کلاینت | 2 | +| **3.7.2** | برنامه فقط زمانی کاربر را به دامنه‌ها یا hostnameهای دیگر (که تحت کنترل برنامه نیستند) به صورت خودکار هدایت می‌کند، که آن مقصد در یک فهرست مجاز (allowlist) قرار داشته باشد. | 2 | +| **3.7.3** | برنامه باید هنگام ریدایرکت کاربر به یک URL که خارج از کنترل برنامه است، یک پیام هشدار نشان می‌دهد و امکان لغو آن را به کاربر می‌دهد. | 3 | +| **3.7.4** | باید دامنه اصلی برنامه، مثلاً (site.tld) به فهرست preload عمومی HSTS اضافه شده باشد. | 3 | +| **3.7.5** | اگر مرورگر کاربر از ویژگی‌های امنیتی مورد انتظار برنامه پشتیبانی نمی‌کند، برنامه رفتار مناسبی داشته باشد، مثل هشدار دادن به کاربر یا مسدود کردن دسترسی. | 3 | + +## References + +برای اطلاعات بیشتر، همچنین به منابع زیر مراجعه کنید: + +* [Set-Cookie __Host- prefix details](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#cookie_prefixes) +* [OWASP Content Security Policy Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html) +* [OWASP Secure Headers Project](https://owasp.org/www-project-secure-headers/) +* [OWASP Cross-Site Request Forgery Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html) +* [HSTS Browser Preload List submission form](https://hstspreload.org/) +* [OWASP DOM Clobbering Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/DOM_Clobbering_Prevention_Cheat_Sheet.html) diff --git a/5.0/fa/0x13-V4-API-and-Web-Service.md b/5.0/fa/0x13-V4-API-and-Web-Service.md new file mode 100644 index 0000000000..e3a5f99a87 --- /dev/null +++ b/5.0/fa/0x13-V4-API-and-Web-Service.md @@ -0,0 +1,65 @@ +# V4 API and Web Service + +## هدف + +برخی ملاحظات امنیتی صرفا برای برنامه‌هایی که APIهایی را برای استفاده توسط مرورگرهای وب یا مصارف دیگر (معمولاً مبتنی بر GraphQl JSON ,XML, می باشند(ارائه می‌دهند، مطرح می‌شوند. این فصل شامل پیکربندی‌ها و مکانیزم‌های امنیتی مرتبطی است که باید به این نوع برنامه‌ها اعمال شوند. + +توجه کنید نگرانی‌های عمومی امنیتی مانند احراز هویت، مدیریت نشست و اعتبارسنجی ورودی‌ها که در فصل‌های دیگر مطرح شده‌اند، در مورد APIها نیز صدق می‌کنند. بنابراین این فصل نباید به ‌صورت جداگانه یا خارج از زمینه کلی استاندارد، بررسی یا آزموده شود. + +## V4.1 Generic Web Service Security + +این بخش به ملاحظات کلی امنیت سرویس‌های وب می‌پردازد و در نتیجه بر رعایت استانداردهای اولیه و اصول بهداشتی امنیتی در طراحی و پیاده‌سازی سرویس‌های وب تأکید دارد. + +| # | Description | Level | +| :---: | :--- | :---: | +| **4.1.1** | اطمینان حاصل شود که در هر پاسخ HTTP که شامل Body می باشد، هدر Content-Type وجود داشته باشد که نوع آن، با محتوای پاسخ دریافتی از سرور مطابقت داشته باشد. این هدر باید شامل پارامتر charset نیز باشد تا رمزگذاری کاراکتر ایمن (مانند UTF-8 یا ISO-8859-1) را مشخص کند. این مقادیر باید مطابق با استاندارد IANA Media Types باشند؛ برای مثال، انواعی مانند "text/، /+xml" و "/xml" را در بر می‌گیرند. | 1 | +| **4.1.2** | اطمینان حاصل شود که تنها نقاط پایانی که برای استفاده کاربر نهایی از طریق مرورگر طراحی شده‌اند (User-Facing Endpoints) به‌صورت خودکار از HTTP به HTTPS هدایت ‌شوند، سایر سرویس‌ها یا نقاط پایانی نباید (ریدایرکت شفاف، Transparent Redirect) داشته باشند. این اقدام برای جلوگیری از وضعیتی است که در آن یک کلاینت به اشتباه درخواست‌های رمزنگاری‌نشده (HTTP) ارسال می‌کند، اما چون این درخواست‌ها به‌طور خودکار به HTTPS ریدایرکت می‌شوند، نشت احتمالی داده‌های حساس پنهان خواهد ماند. | 2 | +| **4.1.3** | اطمینان حاصل شود که هدرهای HTTP که در برنامه استفاده می شود و توسط یک لایه واسطه، مانند یکload balancer ، یک پروکسی وب یا یک سرویس backend-for-frontend تنظیم شده است نمی‌تواند توسط کاربر نهایی بازنویسی شود. هدرهای نمونه ممکن است شامل X-Real-IP، X-Forwarded-* یا X-User-ID باشند. | 2 | +| **4.1.4** | اطمینان حاصل شود که فقط متدهای HTTP که صریحاً توسط برنامه یا API آن پشتیبانی می‌شوند (از جمله OPTIONS در درخواست‌های preflight) می‌توانند مورد استفاده قرار گیرند و متدهای استفاده نشده مسدود شوند. | 3 | +| **4.1.5** | اطمینان حاصل شود که برای درخواست‌ها یا تراکنش‌هایی که بسیار حساس هستند یا از چندین سامانه عبور می‌کنند، از امضاهای دیجیتال در سطح پیام استفاده شود تا اطمینان امنیتی بیشتری علاوه بر محافظت‌های سطح انتقال (مانند TLS) فراهم گردد. | 3 | + +## V4.2 HTTP Message Structure Validation + +این بخش به‌صورت دقیق مشخص می‌کند که ساختار و هدرهای درخواست HTTP باید چگونه اعتبارسنجی شوند تا از حملاتی مانند HTTP Request Smuggling، response splitting، header injection و denial of service از طریق یک پیام طولانی HTTP جلوگیری شود. + +این الزامات برای پردازش و تولید کلی پیام‌های HTTP اهمیت دارند، اما به‌ویژه هنگام تبدیل پیام‌های HTTP بین نسخه‌های مختلف HTTP مهم هستند. + +| # | Description | Level | +| :---: | :--- | :---: | +| **4.2.1** | اطمینان حاصل شود که تمامی اجزای برنامه )از جمله لود بالانسرها، فایروال‌ها و سرورهای اپلیکیشن( مرزهای پیام‌های HTTP ورودی را با استفاده از مکانیزم مناسب نسخه های HTTP تعیین می‌کنند تا از حملات HTTP request smuggling جلوگیری شود. در HTTP/1.x اگر هدر Transfer-Encoding وجود داشته باشد، هدر Content-Length باید مطابق RFC 2616 نادیده گرفته شود. در مقابل، هنگام استفاده از HTTP/2 یا HTTP/3، اگر هدر Content-Length وجود داشته باشد، گیرنده باید اطمینان حاصل کند که این مقادیر با طول فریم‌های DATA سازگار می‌باشد. | 2 | +| **4.2.2** | اطمینان حاصل شود که هنگام تولید پیام‌های HTTP، هدر Content-Length با طول محتوایی که توسط چارچوب‌بندی پروتکل HTTP تعیین می‌شود، تداخل نداشته باشد تا از حملات request smuggling جلوگیری شود. | 3 | +| **4.2.3** | اطمینان حاصل شود برنامه، پیام‌های HTTP/2 یا HTTP/3 با هدرهای connection-specific مانند Transfer-Encoding را به منظور جلوگیری از حملات response splitting یا header injection ارسال یا قبول نمی کند. | 3 | +| **4.2.4** | اطمینان حاصل شود برنامه تنها درخواست های HTTP/2 and HTTP/3 که هدرها و مقادیر آن شامل هیچ توالی CR (\r), LF (\n), CRLF (\r\n) نباشد را می پذیرد تا از حملات header injection جلوگیری کند. | 3 | +| **4.2.5** | اطمینان حاصل کنید که اگر برنامه (Frontend or Backend) اقدام به ساخت و ارسال درخواست‌های HTTP می کند از مکانیزم های validation ، sanitization یا سایر مکانیزم‌ها استفاده کند تا از ایجاد URIها (مانند فراخوانیAPI ) یا فیلدهای هدر درخواست HTTP (مانند Authorization یا( Cookie که بیش از حد مجاز، طولانی هستند، جلوگیری شود که منجر به عدم پذیرش درخواست توسط مولفه دریافت کننده(هر بخشی از زیرساخت یا سامانه که درخواست HTTP را دریافت و پردازش می‌کند) شود. عدم رعایت این موضوع می تواند باعث وقوع حمله Danial of Service شود، ارسال یک درخواست بیش از حد طولانی (مانند یک فیلد هدر کوکی طولانی) باعث می شود سرور همواره با وضعیت خطا پاسخ دهد. | 3 | + +## V4.3 GraphQL + +GraphQL به‌طور فزاینده‌ای در حال تبدیل شدن به روشی رایج برای توسعه‌ی کلاینت‌های داده‌محور است، که به‌صورت مستقیم به چندین سرویس مختلف در backend وابسته نیستند. این بخش به ملاحظات امنیتی ویژه مربوط به استفاده از GraphQL می‌پردازد. + +| # | Description | Level | +| :---: | :--- | :---: | +| **4.3.1** | اطمینان حاصل شود یکی از مکانیزم ها برای جلوگیری از حملات انکار سرویس (DoS) درلایه GraphQL یا لایه داده استفاده شده است. این مکانیزم‌ها عبارتند از استفاده از فهرست مجاز کوئری‌ها ( Query Allowlist)، محدودسازی عمق کوئری‌ها (Depth Limiting)،محدودسازی تعداد یا حجم داده(Amount Limiting) و تحلیل هزینه کوئری (Query Cost Analysis). این اقدامات، به منظور مقابله با درخواست های پیچیده، تو در تو یا کوئری‌های پرهزینه که می توانند موجب مصرف بیش از حد منابع و اختلال در سرویس دهی شوند ضروری است. | 2 | +| **4.3.2** | اطمینان حاصل شود که قابلیت Introspection در GraphQL در محیط تولید (Production) غیرفعال شده‌است، مگرAPI مبتنی بر GraphQL به‌صورت صریح برای استفاده توسط اشخاص یا سامانه های ثالث (Third Parties) طراحی شده باشد. | 2 | + +## V4.4 WebSocket + +WebSocket یک پروتکل ارتباطی است که امکان ارتباط دوطرفه هم‌زمان را از طریق یک اتصال TCP فراهم می‌کند. +این پروتکل در سال ۲۰۱۱ توسط IETF در قالب RFC 6455 استانداردسازی شد. اگرچه WebSocket برای کار کردن از طریق پورت‌های رایج HTTP یعنی پورت 443 (HTTPS) و پورت 80 (HTTP) طراحی شده، اما پروتکلی مجزا از HTTP محسوب می‌شود. + +این بخش به الزامات کلیدی امنیتی می‌پردازد که برای جلوگیری از حملاتی طراحی شده‌اند که از طریق این کانال ارتباطی بلادرنگ، به‌ویژه در حوزه‌های امنیت ارتباطات و مدیریت نشست انجام می‌گیرند. + +| # | Description | Level | +| :---: | :--- | :---: | +| **4.4.1** | اطمینان حاصل شود که تمامی ارتباطات WebSocket از طریق پروتکل TLS( WSS) برقرار می‌شوند. | 1 | +| **4.4.2** | اطمینان حاصل شود که در هنگام Handshake اولیه‌ی HTTP برای WebSocket، مقدار هدر Origin بررسی ‌شود و در صورتی که با لیستی از مبداهای مجاز (allowed origins) برای برنامه مطابقت داشته باشد، اتصال پذیرفته می‌شود. | 2 | +| **4.4.3** | اطمینان حاصل شود که در صورتی که امکان استفاده از مکانیزم استاندارد مدیریت نشست برنامه وجود نداشته باشد، از توکن‌های اختصاصی (Duplicated Tokens) برای این منظور استفاده شود که با الزامات امنیتی مدیریت نشست به طور کامل مطابقت داشته باشند. | 2 | +| **4.4.4** | اطمینان حاصل شود که توکن‌های اختصاصی مدیریت نشست WebSocket در هنگام انتقال از یک نشست HTTPS موجود به کانالWebSocket، از طریق نشست HTTPS احراز هویت‌شده قبلی، دریافت یا اعتبارسنجی می‌شوند. | 2 | + +## References + +برای اطلاعات بیشتر، همچنین به منابع زیر مراجعه کنید: + +* [OWASP REST Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html) +* Resources on GraphQL Authorization from [graphql.org](https://graphql.org/learn/authorization/) and [Apollo](https://www.apollographql.com/docs/apollo-server/security/authentication/#authorization-methods). +* [OWASP Web Security Testing Guide: GraphQL Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/12-API_Testing/01-Testing_GraphQL) +* [OWASP Web Security Testing Guide: Testing WebSockets](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/11-Client-side_Testing/10-Testing_WebSockets) diff --git a/5.0/fa/0x14-V5-File-Handling.md b/5.0/fa/0x14-V5-File-Handling.md new file mode 100644 index 0000000000..472810f7c1 --- /dev/null +++ b/5.0/fa/0x14-V5-File-Handling.md @@ -0,0 +1,54 @@ +# V5 File Handling + +## هدف + +استفاده از فایل‌ها می‌تواند انواع مختلفی از ریسک‌ها را برای برنامه ایجاد کند، از جمله حملات انکار سرویس (DOS)، دسترسی غیرمجاز به اطلاعات، پر شدن فضای ذخیره‌سازی. این فصل شامل مجموعه‌ای از الزامات امنیتی برای مقابله با این تهدیدات است. + +## V5.1 File Handling Documentation + +این بخش شامل الزاماتی است که بیان می‌کند ویژگی‌های مورد انتظار برای فایل‌هایی که توسط برنامه پذیرفته می‌شوند باید مستندسازی شوند. این مستندسازی پیش‌نیازی ضروری برای طراحی و بررسی کنترل‌های امنیتی مرتبط با بارگذاری فایل‌ها است. + +| # | Description | Level | +| :---: | :--- | :---: | +| **5.1.1** | مستندات نوع فایل‌های مجاز، پسوندهای مورد انتظار، و حداکثر اندازه هر فایل (شامل اندازه پس از استخراج) را برای هر قابلیت بارگذاری مشخص کرده باشد. همچنین، مستندات توضیح می‌دهند چگونه فایل‌ها برای دانلود و پردازش توسط کاربران نهایی ایمن‌سازی می‌شوند؛ برای مثال، رفتار برنامه هنگام شناسایی یک فایل مخرب چگونه خواهد بود. | 2 | + +## V5.2 File Upload and Content + +قابلیت بارگذاری فایل یکی از منابع اصلی ورود فایل‌های غیرقابل اعتماد به سامانه می‌باشد. این بخش الزامات لازم را برای اطمینان از این‌که وجود، حجم یا محتوای این فایل‌ها نمی‌تواند به برنامه آسیب برساند، تشریح می‌کند. + +| # | Description | Level | +| :---: | :--- | :---: | +| **5.2.1** | برنامه تنها فایل‌هایی با حجم مشخص، که قادر به پردازش آن است را می‌پذیرد تا از کاهش عملکرد یا حملات انکار سرویس (DoS) جلوگیری شود. | 1 | +| **5.2.2** | هنگام پذیرش فایل توسط برنامه، چه به صورت مستقیم و چه به صورت یک آرشیو مانند فایلzip پسوند فایل با پسوند مورد انتظار مطابقت داشته باشد و اعتبارسنجی محتوای فایل صورت گیرد تا تایید شود محتوای فایل با نوع تعریف‌شده توسط پسوند هم‌خوانی دارد. این فرآیند می تواند شامل موارد بررسی بایت‌های ابتدایی (magic bytes) فایل، انجام بازنویسی تصاویر برای حذف ساختارها و اطلاعات ناخواسته و استفاده از کتابخانه‌های تخصصی برای اعتبارسنجی کامل محتوای فایل باشد اما محدود به آنها نیست. در سطح L1، کافی است این بررسی‌ها فقط بر روی فایل‌هایی که در فرآیندهای تجاری یا امنیتی خاص استفاده می‌شوند متمرکز باشد. در سطح L2 و بالاتر، این فرآیند باید برای تمامی فایل‌های ورودی برنامه اجرا شود. | 1 | +| **5.2.3** | برنامه باید پیش از استخراج محتوای فایل‌های فشرده (مانند zip، gz، docx، odt)، آن‌ها را از نظر حداکثر اندازه مجاز پس از استخراج و همچنین حداکثر تعداد فایل‌های درون آن بررسی می‌کند. | 2 | +| **5.2.4** | برنامه فضای مشخصی برای اندازه فایل و تعداد فایل‌های مجاز برای هر کاربر اعمال می‌کند تا از این طریق، یک کاربر نتواند با بارگذاری تعداد زیادی فایل یا فایل‌های بیش از حد بزرگ، فضای ذخیره‌سازی را پر کند. | 3 | +| **5.2.5** | برنامه اجازه بارگذاری فایل‌های فشرده‌ که حاوی لینک های نمادین (symlinks) هستند را نمی‌دهد، مگر اینکه این رفتار به طور مشخص مورد نیاز باشد. در چنین شرایطی باید یک فهرست مجاز (allowlist) از مسیرها یا فایل‌هایی که می تواند برای آنها لینک نمادین ایجاد شود، اعمال و اعتبارسنجی گردد. | 3 | +| **5.2.6** | برنامه تصاویر بارگذاری‌شده با اندازه پیکسلی بزرگ‌تر از حد مجاز را رد کند تا از حملات pixel flood attacks جلوگیری شود. | 3 | + +## V5.3 File Storage + +این بخش شامل الزامات جلوگیری از اجرای غیرمجاز فایل‌ها پس از بارگذاری، شناسایی محتوای خطرناک و جلوگیری از استفاده از داده‌های غیرمعتبر برای کنترل مکان ذخیره‌سازی فایل‌ها است. + +| # | Description | Level | +| :---: | :--- | :---: | +| **5.3.1** | فایل هایی که از ورودی های غیرمعتبر بارگذاری‌ یا تولید می شوند و در پوشه های عمومی قرار می گیرند، هنگام دسترسی مستقیم از طریق یک درخواست HTTP، به عنوان کداجرایی سمت سرور اجرا نشوند. | 1 | +| **5.3.2** | هنگام ایجاد مسیرهای فایل برای عملیات مختلف، به جای استفاده از نام فایل‌های ارسال شده توسط کاربر، از داده‌های تولید شده داخلی یا منابع مورد اعتماد استفاده شود. و در صورتی که استفاده از نام فایل‌ها یا متادیتای ارسالی توسط کاربر ضروری باشد، می بایست validation و Sanitization اعمال شود. این کار برای جلوگیری از حملاتی مانند Path Traversal، Local or Remote File Inclusion(LFI, RFI) و Server-Side Request Forgery(SSRF) می‌باشد. | 1 | +| **5.3.3** | پردازش فایل‌های سمت سرور، مانند استخراج فایل‌های فشرده، اطلاعات مسیر ارائه شده توسط کاربر را نادیده می‌گیرد تا از آسیب‌پذیری‌هایی مانند zip slip جلوگیری شود. | 3 | + +## V5.4 File Download + +این بخش شامل الزامات برای کاهش ریسک‌ها هنگام ارائه فایل‌ها برای دانلود است، از جمله حملاتPath Traversal و حملات Injection می باشد. همچنین اطمینان حاصل می‌شود که فایل‌ها حاوی محتوای خطرناک نباشند. + +| # | Description | Level | +| :---: | :--- | :---: | +| **5.4.1** | برنامه نام فایل ارسال‌شده توسط کاربر را چه در قالب JSON، JSONP یا پارامتر URL، اعتبارسنجی می‌کند یا نادیده می‌گیرد، و در پاسخ HTTP، نام فایل را به‌طور صریح در فیلد Content-Disposition هدر مشخص می‌نماید. | 2 | +| **5.4.2** | نام‌های فایل‌های ارائه شده (مانند فیلدهای هدر پاسخ HTTP یا پیوست‌های ایمیل)، به‌درستی encoded یا sanitized شده‌اند (مطابق RFC 6266)، تا ساختار سند حفظ شده و از حملات تزریق جلوگیری شود. | 2 | +| **5.4.3** | فایل‌های دریافت شده از منابع غیرقابل اعتماد توسط آنتی ویروس اسکن شود تا از ارائه محتوای مخرب شناخته‌شده جلوگیری شود. | 2 | + +## References + +برای اطلاعات بیشتر، همچنین به منابع زیر مراجعه کنید: + +* [OWASP File Upload Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html) +* [Example of using symlinks for arbitrary file read](https://hackerone.com/reports/1439593) +* [Explanation of "Magic Bytes" from Wikipedia](https://en.wikipedia.org/wiki/List_of_file_signatures) diff --git a/5.0/fa/0x15-V6-Authentication.md b/5.0/fa/0x15-V6-Authentication.md new file mode 100644 index 0000000000..86f0eb167d --- /dev/null +++ b/5.0/fa/0x15-V6-Authentication.md @@ -0,0 +1,164 @@ +# V6 Authentication + +## Control Objective + +احراز هویت فرآیند تأیید یا اثبات اصالت یک فرد یا دستگاه می‌باشد. این فرآیند شامل بررسی صحت ادعاهای ارائه شده توسط یک شخص یا یک دستگاه بوده به‌گونه‌ای که در برابر جعل هویت مقاوم باشد و از بازیابی یا رهگیری گذرواژه‌ها جلوگیری کند. + +استاندارد [NIST SP 800-63](https://pages.nist.gov/800-63-3/) یک استاندارد مدرن و مبتنی بر شواهد است که برای سازمان‌های سراسر جهان ارزشمند محسوب می‌شود و برای سازمان‌های دولتی ایالات متحده و نهادهایی که با این سازمان‌ها تعامل دارند، اهمیت ویژه‌ای دارد. + +اگر چه بسیاری از الزامات مطرح شده در این فصل بر اساس بخش دوم این استاندارد (با عنوان NIST SP 800-63B تحت عنوان «راهنمای هویت دیجیتال – احراز هویت و مدیریت چرخه عمر») بنا شده اند، تمرکز این فصل بر تهدیدات رایج و ضعف‌های پر تکرار در احراز هویت می‌باشد. این فصل تلاشی برای پوشش جامع تمامی نکات استاندارد نمی‌کند. در مواردی که رعایت کامل استاندارد NIST SP 800-63 ضروری باشد، لطفاً به متن کامل این استاندارد مراجعه فرمایید. + +همچنین، ممکن است اصطلاحات به‌کاررفته درNIST SP 800-63 با اصطلاحات عمومی‌تر تفاوت داشته باشد؛ به همین دلیل، این فصل عمدتاً از واژگان رایج‌تر و قابل فهم‌تر استفاده می‌کند تا وضوح مطلب افزایش یابد. + +یکی از ویژگی‌های رایج در سامانه‌های پیشرفته‌تر، تطبیق‌پذیری مراحل احراز هویت با توجه به عوامل مختلف ریسک است. این ویژگی در فصل Authorization مورد بررسی قرار می‌گیرد، چرا که این مکانیزم‌ها باید در تصمیم‌گیری‌های مربوط به Authorization نیز لحاظ شوند. + +## V6.1 Authentication Documentation + +این بخش شامل الزامات مربوط به مستندسازی احراز هویت است که باید برای یک برنامه کاربردی نگهداری شود. این مستندسازی برای پیاده‌سازی و ارزیابی نحوه پیکربندی کنترل‌های مرتبط با احراز هویت از اهمیت بالایی برخوردار است. + +| # | Description | Level | +| :---: | :--- | :---: | +| **6.1.1** | مستندات برنامه، نحوه استفاده از کنترل هایی مانند محدودیت نرخ (Rate Limit)، مقابله با خودکارسازی (Anti-Automation) و پاسخ تطبیقی (Adaptive Response) را برای دفاع در برابر حملاتی مانند Credential Stuffing و حملات Password Brute Force به وضوح تعریف کرده باشد. مستندات باید به‌وضوح نحوه پیکربندی این کنترل‌ها را تشریح کرده و نشان دهند که چگونه از قفل شدن مخرب حساب‌های کاربری جلوگیری می‌شود. | 1 | +| **6.1.2** | یک لیست از کلمات خاص مرتبط با زمینه سازمانی‌ (Context-Specific) مستندسازی شود تا از بکارگیری آنها در رمزهای عبور جلوگیری شد. این فهرست می‌تواند شامل نام سازمان، نام محصول، شناسه سامانه، نام کد پروژه، نام دپارتمان یا نقش های سازمانی و موارد مشابه باشد. | 2 | +| **6.1.3** | در صورت وجود مسیرهای متعدد احراز هویت در برنامه کاربردی، تمامی این مسیرها به همراه کنترل‌های امنیتی و سطح قدرت احراز هویت مورد نیاز، مستندسازی شده‌اند. لازم است این کنترل‌ها به‌صورت یکسان و سازگار در تمامی مسیرهای احراز هویت اجرا شوند. | 2 | + +## V6.2 Password Security + +کلمات عبور، که توسط NIST SP 800-63 به عنوان "رمزهای به خاطر سپرده شده" (Memorized Secrets) شناخته می‌شوند، شامل کلمات عبور، عبارت‌های عبور، کدهای PIN، الگوهای بازگشایی (unlock Patterns)، انتخاب تصویر صحیح (مثلاً انتخاب بچه‌گربه صحیح از میان چند تصویر) هستند. این‌ها معمولاً به عنوان "چیزی که شما می‌دانید" در نظر گرفته می‌شوند و اغلب به عنوان یک مکانیزم احراز هویت تک‌عاملی استفاده می‌شوند. + +بر این اساس، این بخش شامل الزامات و توصیه‌هایی برای ایجاد و مدیریت امن کلمات عبور می‌باشد. بیشتر این الزامات در سطحL1 مطرح شده‌اند، چرا که در این سطح نقش کلیدی دارند. از سطح L2 به بعد، استفاده از احراز هویت چندعاملی الزامی می‌باشد، که در آن گذرواژه می‌تواند یکی از عوامل تشکیل‌دهنده باشد. + +الزامات این بخش عمدتا به بند [§ 5.1.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver) از راهنمایی‌های [NIST's Guidance](https://pages.nist.gov/800-63-3/sp800-63b.html) می‌باشد. + +| # | Description | Level | +| :---: | :--- | :---: | +| **6.2.1** | کلمات عبور تنظیم شده توسط کاربر حداقل ۸ کاراکتر طول داشته باشد. هرچند حداقل ۱۵ کاراکتر به شدت توصیه می‌شود. | 1 | +| **6.2.2** | کاربران قادر به تغییر گذرواژه خود باشند. | 1 | +| **6.2.3** | هنگام تغییر کلمه عبور، گذرواژه فعلی و گذرواژه جدید توسط کاربر تکمیل شود. | 1 | +| **6.2.4** | کلمات عبوری که در حین ثبت‌نام حساب کاربری یا تغییر کلمه عبور ارسال می شوند با یک فهرست در دسترس از حداقل ۳۰۰۰ کلمه عبور رایج که ( با سیاست‌های کلمه عبور برنامه (مانند حداقل طول) سازگاری دارند) بررسی شوند. | 1 | +| **6.2.5** | کلمات عبور با هر ترکیبی قابل استفاده باشند، بدون اینکه قوانینی برای محدودکردن نوع کاراکترهای مجاز وجود داشته باشد. نباید هیچ‌گونه الزامی برای تعداد حداقل کاراکترهای حروف بزرگ یا کوچک، اعداد یا کاراکترهای خاص وجود داشته باشد. | 1 | +| **6.2.6** | فیلدهای ورودی کلمه عبور از نوع "type=password" استفاده می‌کنند تا ورودی‌ها پنهان شوند. برنامه‌ها می‌توانند به کاربر این امکان را بدهند که موقتاً کلمه عبور کامل یا آخرین کاراکتر تایپ شده را مشاهده کند. | 1 | +| **6.2.7** | عملکرد "چسباندن" (paste)، ابزارهای کمکی گذرواژه مرورگر و مدیریت‌کننده‌های گذرواژه خارجی مجاز باشند. | 1 | +| **6.2.8** | برنامه کلمه عبور کاربر را دقیقاً همانطور که از کاربر دریافت شده است، بدون هیچ گونه تغییراتی مانند کوتاه‌سازی(truncation) یا تبدیل حروف بزرگ و کوچک (case transformation)، بررسی کند. | 1 | +| **6.2.9** | استفاده از گذرواژه‌هایی با حداقل طول ۶۴ کاراکتر مجاز باشد. | 2 | +| **6.2.10** | کلمه عبور کاربر تا زمانی که مشخص شود که به خطر افتاده است یا کاربر آن را تغییر دهد، معتبر باقی بماند. برنامه نباید الزام به تغییر دوره‌ای گذرواژه‌ها را داشته باشد. | 2 | +| **6.2.11** | فهرست مستند شده ای از کلمات خاص مرتبط با زمینه‌ سازمانی برای جلوگیری از ایجاد کلمات عبور آسان قابل حدس، مورد استفاده قرار گیرد. | 2 | +| **6.2.12** | کلمات عبور وارد شده در حین ثبت‌نام حساب کاربری یا تغییر کلمه عبور با مجموعه‌ای از کلمات عبور افشا شده بررسی ‌شوند. | 2 | + +## V6.3 General Authentication Security + +این بخش شامل الزامات عمومی برای امنیت مکانیزم‌های احراز هویت و همچنین تعیین انتظارات مربوط به سطوح مختلف امنیتی می‌باشد. در سطح L2، سامانه‌ها باید الزاماً از احراز هویت چندعاملی (MFA) استفاده کنند. در سطح L3، استفاده از احراز هویت مبتنی بر سخت‌افزار الزامی می‌باشد که باید درون یک محیط اجرای مورد اعتماد و قابل گواهی (Trusted Execution Environment – TEE) انجام شود. این می‌تواند شامل کلیدهای عبور وابسته به دستگاه (Device-Bound Passkeys)، احرازکننده‌های با سطح اطمینان بالا مطابق با استاندارد eIDAS (سطح LoA High)، احرازکننده‌های دارای سطح اطمینان AAL3 طبق استاندارد NIST، یا مکانیزم‌های معادل دیگر باشد. + +اگرچه این الزامات در مقایسه با بسیاری از چارچوب‌های دیگر، رویکردی سخت‌گیرانه نسبت به MFA دارند، اما این سخت‌گیری برای ارتقای سطح امنیت کاربران حیاتی می‌باشد. هرگونه تلاش برای کاهش این الزامات باید با یک برنامه شفاف و دقیق برای کاهش ریسک‌های مرتبط با احراز هویت همراه باشد، به‌طوری‌که راهنمایی‌ها و پژوهش‌های ارائه‌شده توسط NIST نیز در آن لحاظ شده باشد. + +توجه داشته باشید که در زمان انتشار این سند، استاندارد NIST SP 800-63 استفاده از ایمیل را به عنوان یک مکانیزم احراز هویت [قابل قبول نمی‌داند](https://pages.nist.gov/800-63-FAQ/#q-b11).([archived copy](https://web.archive.org/web/20250330115328/https://pages.nist.gov/800-63-FAQ/#q-b11)). + +الزامات این بخش به بخش‌های مختلفی از راهنمای [NIST's Guidance]([https://pages.nist.gov/800-63-3/sp800-63b.html) مربوط می‌شوند، از جمله بندهای [§ 4.2.1](https://pages.nist.gov/800-63-3/sp800-63b.html#421-permitted-authenticator-types)، [§ 4.3.1](https://pages.nist.gov/800-63-3/sp800-63b.html#431-permitted-authenticator-types)، [§ 5.2.2](https://pages.nist.gov/800-63-3/sp800-63b.html#522-rate-limiting-throttling) و [§ 6.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#-612-post-enrollment-binding). + +| # | Description | Level | +| :---: | :--- | :---: | +| **6.3.1** | کنترل‌های لازم برای جلوگیری از حملاتی مانند Credential Stuffing و password brute force طبق مستندات امنیتی برنامه پیاده‌سازی شوند. | 1 | +| **6.3.2** | حساب‌های کاربری پیش‌فرض (مانند "admin"، "root" یا "sa") در برنامه وجود نداشته باشند یا غیرفعال شده باشند. | 1 | +| **6.3.3** | برای دسترسی به برنامه، از یک مکانیزم احراز هویت چندعاملی (MFA) یا ترکیبی از مکانیزم‌های احراز هویت تک‌عاملی استفاده شود. برای سطح L3، حداقل یکی از عوامل احراز هویت باید مبتنی بر سخت‌افزار باشد در برابر حملات فیشینگ، مقاومت در برابر نفوذ و جعل هویت را فراهم کند، در حالی که با اقدام آگاهانه کاربر (مانند فشردن دکمه روی کلید سخت‌افزاری FIDO یا تلفن همراه) قصد کاربر برای احراز هویت را نیز تأیید نماید. هرگونه تسهیل یا تعدیل در این الزام، مستلزم ارائه دلایل مستند و مجموعه‌ای جامع از کنترل‌های جبرانی است. | 2 | +| **6.3.4** | تأیید کنید که در صورت وجود مسیرهای متعدد احراز هویت در برنامه، هیچ مسیر احراز هویتِ مستندسازی‌نشده‌ای وجود نداشته باشد و کنترل‌های امنیتی و سطح قدرت احراز هویت در تمامی مسیرها به‌صورت یکسان و سازگار اعمال شوند. | 2 | +| **6.3.5** | کاربران از تلاش‌های مشکوک برای احراز هویت (موفق یا ناموفق) مطلع ‌شوند. این اطلاع‌رسانی می‌تواند شامل تلاش برای احراز هویت از موقعیت مکانی یا کلاینت غیرمعمول، احراز هویت ناقص (تنها موفقیت یکی از عوامل)، تلاش برای احراز هویت پس از یک دوره طولانی عدم فعالیت، یا احراز هویت موفق پس از چندین تلاش ناموفق باشد. | 3 | +| **6.3.6** | ایمیل به‌عنوان مکانیزم احراز هویت، چه به‌صورت تک‌عاملی و چه به‌عنوان یکی از عوامل احراز هویت چندعاملی، استفاده نمی‌شود. | 3 | +| **6.3.7** | کاربران پس از به‌روزرسانی اطلاعات احراز هویت خود، مانند بازنشانی گذرواژه یا تغییر نام کاربری یا آدرس ایمیل، مطلع شوند. | 3 | +| **6.3.8** | با توجه به پیام‌های خطا، کدهای پاسخ HTTP یا تفاوت در زمان پاسخ‌دهی، نتوان کاربران معتبر را از طریق تلاش‌های ناموفق احراز هویت شناسایی کرد. همچنین، عملکردهای ثبت‌نام و بازیابی گذرواژه نیز باید از این نوع افشای اطلاعات محافظت شده باشند. | 3 | + +## V6.4 Authentication Factor Lifecycle and Recovery + +عوامل احراز هویت می‌توانند شامل کلمه عبور، توکن‌های نرم‌افزاری، توکن‌های سخت‌افزاری و دستگاه‌های بیومتریک باشند. مدیریت امن چرخه عمر این مکانیزم‌ها برای حفظ امنیت برنامه اهمیت بسیاری دارد و این بخش شامل الزامات مرتبط با این موضوع می‌باشد. + +الزامات این بخش عمدتاً مربوط به بندهای [§ 5.1.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver) و [§ 6.1.2.3](https://pages.nist.gov/800-63-3/sp800-63b.html#replacement) از راهنمای [NIST's Guidance](https://pages.nist.gov/800-63-3/sp800-63b.html) می‌باشد. + +| # | Description | Level | +| :---: | :--- | :---: | +| **6.4.1** | کلمه عبور اولیه یا کدهای فعال‌سازی تولید شده توسط سیستم، به‌صورت تصادفی و ایمن تولید ‌شوند، با سیاست فعلی رمز عبور مطابقت دارند، و پس از مدت زمان کوتاهی یا پس از اولین استفاده منقضی می‌شوند. این رمزهای اولیه نباید به عنوان رمز عبور بلندمدت مورد استفاده قرار گیرند. | 1 | +| **6.4.2** | راهنمای کلمه عبور یا احراز هویت مبتنی بر دانش (که به عنوان "سؤالات امنیتی" شناخته می‌شوند) در سیستم وجود ندارد. | 1 | +| **6.4.3** | فرآیند امنی برای بازنشانی کلمه عبور فراموش‌شده پیاده‌سازی شده است که هیچ‌یک از مکانیزم‌های احراز هویت چندعاملی فعال را دور نزند. | 2 | +| **6.4.4** | در صورت از دست رفتن یکی از عوامل احراز هویت چندعاملی، فرآیند اثبات هویت با همان سطحی که در زمان ثبت‌نام انجام شده است، اجرا شود. | 2 | +| **6.4.5** | دستورالعمل‌های تمدید مکانیزم‌های احراز هویت دارای تاریخ انقضا برای کاربران به موقع ارسال می‌شود تا پیش از انقضای مکانیزم فعلی فرصت کافی برای تمدید وجود داشته باشد، و در صورت لزوم، یادآورهای خودکار نیز تنظیم و ارسال شده باشند. | 3 | +| **6.4.6** | کاربران ادمین می‌توانند فرآیند بازنشانی کلمه عبور را برای کاربران عادی آغاز کنند، اما اجازه تغییر مستقیم یا انتخاب رمز عبور برای کاربر را ندارند. این کنترل برای جلوگیری از دسترسی ادمین به رمز عبور کاربران طراحی شده است. | 3 | + +## V6.5 General Multi-factor authentication requirements + +این بخش راهنمایی‌های کلی ارائه می‌دهد که برای انواع مختلف مکانیزم‌های احراز هویت چندعاملی (MFA) قابل استفاده است. مکانیزم‌های بررسی‌شده شامل موارد زیر هستند: + +* Lookup Secrets (فرایند یافتن یا بازیابی اطلاعات محرمانه) +* رمزهای عبور یک‌بار مصرف مبتنی بر زمان (TOTPs) +* مکانیزم‌های خارج از باند (Out-of-Band Mechanisms) + +Lookup Secret کدهایی هستند که به‌صورت از پیش تولیدشده ارائه می‌شوند و مشابه با کدهای مجوز تراکنش (TAN)، کدهای بازیابی حساب‌های شبکه‌های اجتماعی یا شبکه‌ای از مقادیر تصادفی می‌باشند. این نوع مکانیزم به‌عنوان "چیزی که در اختیار دارید" در نظر گرفته می‌شود، زیرا کدها عمداً غیرقابل حفظ‌کردن هستند و نیاز به ذخیره‌سازی دارند. + +رمزهای یکبار مصرف چندعاملی (Multi-factor TOTPs) مشابه رمزهای یکبار مصرف تک‌عاملی هستند، اما برای ایجاد رمز نهایی (OTP)، نیاز به وارد کردن کد PIN معتبر، بازکردن با بیومتریک، وارد کردن USB یا جفت‌سازی NFC، یا مقدار اضافی دیگری (مانند ماشین‌حساب‌های امضای تراکنش) دارند. + +جزئیات مربوط به مکانیزم‌های خارج از باند (Out-of-Band) در بخش بعدی ارائه خواهد شد. + +الزامات موجود در این بخش‌ها عمدتاً مربوط به بندهای [§ 5.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#-512-look-up-secrets)، [§ 5.1.3](https://pages.nist.gov/800-63-3/sp800-63b.html#-513-out-of-band-devices)، [§ 5.1.4.2](https://pages.nist.gov/800-63-3/sp800-63b.html#5142-single-factor-otp-verifiers)، [§ 5.1.5.2](https://pages.nist.gov/800-63-3/sp800-63b.html#5152-multi-factor-otp-verifiers)، [§ 5.2.1](https://pages.nist.gov/800-63-3/sp800-63b.html#521-physical-authenticators) و [§ 5.2.3](https://pages.nist.gov/800-63-3/sp800-63b.html#523-use-of-biometrics) از راهنمای [NIST's Guidance](https://pages.nist.gov/800-63-3/sp800-63b.html) می‌باشند. + +| # | Description | Level | +| :---: | :--- | :---: | +| **6.5.1** | Lookup Secrets درخواست‌ها یا کدهای احراز هویت خارج از باند (Out-of-Band) و رمزهای یکبار مصرف مبتنی بر زمان (TOTP) تنها یک‌بار قابل استفاده باشند و پس از استفاده موفق، مجدداً قابل استفاده نباشند. | 2 | +| **6.5.2** | در صورت ذخیره‌سازی Lookup Secrets در سمت Backend برنامه، اگر مقدار آنتروپی کمتر از ۱۱۲ بیت باشند (معادل ۱۹ کاراکتر تصادفی الفبایی-عددی یا ۳۴ رقم تصادفی)، باید با یک الگوریتم تایید شده برای ذخیره رمز عبور و با استفاده از یک Salt تصادفی ۳۲ بیتی هش شوند. در صورتی که آنتروپی کد ۱۱۲ بیت یا بیشتر باشد، می‌توان از یک تابع هش استاندارد برای ذخیره سازی استفاده کرد. | 2 | +| **6.5.3** | Lookup Secrets کدهای احراز هویت خارج از باند (out of band) و تولید رمزهای یکبار مصرف مبتنی بر زمان(TOTP) همگی با استفاده از یک تولیدکننده عدد شبه تصادفی ‌رمزنگاری‌شده (CSPRNG) تولید شده باشند تا از تولید مقادیر قابل پیش‌بینی جلوگیری شود. | 2 | +| **6.5.4** | Lookup Secrets و کدهای احراز هویت خارج از باند (out of band) حداقل دارای ۲۰ بیت آنتروپی باشند (معمولاً ۴ کاراکتر تصادفی الفبایی-عددی یا ۶ رقم تصادفی برای رسیدن به این میزان آنتروپی کافی است). | 2 | +| **6.5.5** | درخواست‌ها، کدها یا توکن‌های احراز هویت خارج از باند (Out-of-Band) و همچنین رمزهای عبور یک‌بار مصرف مبتنی بر زمان (TOTP) دارای طول عمر مشخص باشند. حداکثر طول عمر برای درخواست‌های خارج از باند باید ۱۰ دقیقه و برای TOTP حداکثر ۳۰ ثانیه باشد. | 2 | +| **6.5.6** | امکان لغو (Revoke) هر عامل احراز هویت، از جمله دستگاه‌های فیزیکی، در صورت سرقت یا مفقود شدن وجود داشته باشد. | 3 | +| **6.5.7** | مکانیزم‌های احراز هویت بیومتریک فقط به‌عنوان عامل دوم و در کنار یکی از عوامل «چیزی که در اختیار دارید» یا «چیزی که کاربر می داند» مورد استفاده قرار می‌گیرند. | 3 | +| **6.5.8** | اعتبارسنجی رمزهای یک‌بار مصرف مبتنی بر زمان (TOTP) بر اساس منبع زمانی از یک سرویس قابل اعتماد انجام می‌شود و نه بر اساس زمان ارائه‌شده توسط کلاینت یا منابع غیرقابل اعتماد. | 3 | + +## V6.6 Out-of-Band authentication mechanisms + +این نوع احراز هویت معمولاً شامل ارتباط سرور احراز هویت با یک دستگاه فیزیکی از طریق یک کانال ثانویه امن است. به‌عنوان مثال، ارسال Push Notifications به دستگاه‌های تلفن همراه. این نوع از مکانیزم احراز هویت به‌عنوان "چیزی که در اختیار دارید" در نظر گرفته می‌شود. + +مکانیزم‌های ناامن احراز هویت خارج از باند نظیر ایمیل و VOIP مجاز نیستند. همچنین، احراز هویت از طریق خطوط تلفن عمومی (PSTN) و پیامک (SMS) در حال حاضر توسط NIST به‌عنوان مکانیزم‌های”محدودشده” (["restricted" authentication mechanisms](https://pages.nist.gov/800-63-FAQ/#q-b01)) دسته‌بندی شده‌اند و باید به به تدریج با مکانیزم‌هایی مانند رمز یک‌بار مصرف مبتنی بر زمان ( مکانیزم‌های رمزنگاری‌شده یا روش‌های مشابه امن‌تر جایگزین شوند. استاندارد NIST SP 800-63B در بند [§ 5.1.3.3](https://pages.nist.gov/800-63-3/sp800-63b.html#-5133-authentication-using-the-public-switched-telephone-network) توصیه می‌کند که در صورت ضرورت پشتیبانی از احراز هویت خارج از باند تلفنی یا پیامکی، باید ریسک‌هایی مانند تعویض دستگاه، تغییر سیم‌کارت، انتقال شماره یا رفتارهای غیرعادی دیگر مدنظر قرار گیرد. هرچند این بخش از چارچوب ASVS الزام صریحی برای رعایت این موارد ندارد، اما عدم توجه به این ملاحظات امنیتی در یک اپلیکیشن حساس با سطح امنیتی L2 یا L3 باید به‌عنوان یک علامت هشدار جدی تلقی شود. + +توجه داشته باشید که NIST اخیراً راهنمایی‌هایی ارائه کرده است که استفاده از [Push Notifications](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#fig-3) را نامطلوب می‌داند. هرچند این بخش از ASVS به این موضوع اشاره نکرده است، آگاهی از خطرات ناشی از حمله Push Bombing اهمیت بالایی دارد. + +| # | Description | Level | +| :---: | :--- | :---: | +| **6.6.1** | مکانیزم‌های احراز هویت مبتنی بر شبکه تلفن عمومی (PSTN) برای ارسال رمزهای یک‌بار مصرف (OTP) از طریق تماس تلفنی یا پیامک تنها در صورتی که شماره تلفن قبلا اعتبارسنجی شده باشد، یا روش‌های جایگزین قوی‌تر (رمزهای عبور یکبار مصرف مبتنی بر زمان) در دسترس باشند ارائه می‌شوند و سرویس‌دهنده باید کاربران را از ریسک‌های امنیتی این روش‌ها مطلع سازد. برای اپلیکیشن‌های سطح L3، استفاده از تماس تلفنی و پیامک به‌عنوان گزینه، مجاز نیست. | 2 | +| **6.6.2** | درخواست‌ها، کدها یا توکن‌های احراز هویت خارج از باند (Out-of-Band) به درخواست احراز هویت اصلی که برای آن تولید شده‌اند متصل باشند و قابل استفاده برای درخواست‌های قبلی یا بعدی نباشند. | 2 | +| **6.6.3** | مکانیزم‌های احراز هویت خارج از باند (Out-of-Band) مبتنی بر کد، در برابر حملات brute force از طریق اعمال کنترل محدودیت نرخ (Rate Limiting) محافظت شوند. همچنین، استفاده از کدی با حداقل ۶۴ بیت آنتروپی (Entropy)مدنظر قرار گیرد. | 2 | +| **6.6.4** | در صورت استفاده از Push Notifications جهت احراز هویت چند عاملی، محدودیت نرخ (Rate Limiting) به منظور جلوگیری از حملات Push Bombing اعمال شده باشد. استفاده از تطبیق عدد Matching) Number) نیز می‌تواند به کاهش این ریسک کمک کند. | 3 | + +## V6.7 Cryptographic authentication mechanism + +مکانیزم‌های احراز هویت رمزنگاری‌شده شامل کارت‌های هوشمند یا کلیدهای FIDO هستند، که در آن‌ها کاربر باید دستگاه رمزنگاری را به رایانه متصل کرده یا با آن جفت کند تا فرآیند احراز هویت تکمیل شود. در این روش، سرور احراز هویت یک عدد تصادفی (Nonce) چالشی به دستگاه یا نرم‌افزار رمزنگاری ارسال می‌کند و دستگاه یا نرم‌افزار بر اساس کلید رمزنگاری securely ذخیره‌شده، پاسخی را محاسبه می‌کند. الزامات این بخش راهنمایی‌های خاص پیاده‌سازی این مکانیزم‌ها را ارائه می‌دهد و راهنمایی‌های مربوط به الگوریتم‌های رمزنگاری در فصل «رمزنگاری» آورده شده است. + +در مواردی که کلیدهای مشترک یا کلیدهای محرمانه برای احراز هویت رمزنگاری‌شده مورد استفاده قرار می‌گیرند، لازم است این کلیدها به همان روشی که سایر اسرار سیستمی مدیریت می‌شوند، نگهداری شوند. همان‌طور که در بخش «Secret Management» از فصل «Configuration» مستندسازی شده است. + +الزامات این بخش عمدتاً مربوط به بند [§ 5.1.7.2](https://pages.nist.gov/800-63-3/sp800-63b.html#sfcdv) از راهنمای [NIST's Guidance](https://pages.nist.gov/800-63-3/sp800-63b.html) می‌باشد. + +| # | Description | Level | +| :---: | :--- | :---: | +| **6.7.1** | گواهینامه‌های مورد استفاده برای تأیید ادعاهای احراز هویت رمزنگاری‌شده به گونه‌ای ذخیره شوند که از تغییر یا دستکاری آن‌ها محافظت شود. | 3 | +| **6.7.2** | مقدار چالش (Challenge Nonce) حداقل ۶۴ بیت طول داشته باشد و از نظر آماری یکتا باشد یا حداقل در طول عمر دستگاه رمزنگاری منحصر به فرد باقی بماند. | 3 | + +## V6.8 Authentication with an Identity Provider + +ارائه‌دهندگان هویت (Identity Providers یا IdPs) هویت فدرال شده برای کاربران فراهم می‌کنند. کاربران اغلب بیش از یک هویت با چندین ارائه‌دهنده هویت دارند، مانند هویت سازمانی که از طریق Azure AD، Okta، Ping Identity یا Google مدیریت می‌شود، یا هویت مصرف‌کننده که از طریق شبکه‌های اجتماعی مانند Facebook، Twitter، Google یا WeChat ایجاد می‌شود. این فهرست تأیید یا حمایت از این شرکت‌ها یا خدمات نیست، بلکه صرفاً تشویقی برای توسعه‌دهندگان است تا واقعیت وجود چندین هویت برای بسیاری از کاربران را در نظر بگیرند. سازمان‌ها باید با توجه به پروفایل ریسک و قدرت اثبات هویت ارائه‌دهنده هویت، به ادغام با هویت‌های موجود کاربران فکر کنند. به عنوان مثال، سازمان‌های دولتی به‌احتمال زیاد هویت شبکه‌های اجتماعی را به‌عنوان روش ورود به سیستم‌های حساس قبول نمی‌کنند، زیرا ایجاد هویت‌های جعلی یا موقت در این فضا ساده است، در حالی که شرکت‌های فعال در حوزه بازی‌های موبایل ممکن است برای افزایش تعداد بازیکنان فعال خود نیاز به ادغام با پلتفرم‌های اصلی شبکه‌های اجتماعی داشته باشند. + +استفاده امن از ارائه‌دهندگان هویت خارجی نیازمند پیکربندی و تأیید دقیق است تا از جعل هویت یا ادعاهای ساختگی جلوگیری شود. این بخش شامل الزامات لازم برای مقابله با این ریسک‌ها می‌باشد. + +| # | Description | Level | +| :---: | :--- | :---: | +| **6.8.1** | اگر برنامه از چند ارائه‌دهنده هویت (IdP) پشتیبانی می‌کند، امکان جعل هویت کاربر از طریق یک ارائه‌دهنده هویت دیگر وجود نداشته باشد (برای مثال، با استفاده از شناسه کاربری یکسان). مکانیسم استاندارد برای جلوگیری از این تهدید، این است که برنامه، کاربران را با استفاده از ترکیب شناسه IdP (به‌عنوان فضای نام یا (namespace و شناسه کاربر در آن، IdP ثبت و شناسایی کند. | 2 | +| **6.8.2** | وجود و یکپارچگی امضاهای دیجیتال بر روی تصدیق‌های (تقاضاها یا ادعاهای) احراز هویت برای مثال بر روی (توکن‌های JWT یا SAML assertions) همواره اعتبارسنجی می‌شود و هرگونه تصدیقی که فاقد امضا یا دارای امضای نامعتبر باشد، رد می‌گردد. | 2 | +| **6.8.3** | (تقاضاها یا ادعاهای) تصدیق‌های SAML به‌صورت منحصربه‌فرد پردازش شده و تنها یک‌بار در بازه‌ی اعتبار خود استفاده می‌شوند تا از حملات بازپخش (Replay Attacks) جلوگیری گردد. | 2 | +| **6.8.4** | اگر برنامه‌ای از یک ارائه‌دهنده هویت (IdP) جداگانه استفاده می‌کند و انتظار قدرت، روش‌ها یا تازگی احراز هویت خاصی را برای عملکردهای خاص دارد، برنامه این موضوع را با استفاده از اطلاعات برگردانده شده توسط IdP تأیید می‌کند. به عنوان مثال، اگر از OIDC استفاده شود، این کار می‌تواند با اعتبارسنجی ادعاهای (Claims) موجود در توکن شناسایی (ID Token) مانند «amr»، «acr» و «auth_time» (در صورت وجود) انجام شود. اگر ارائه‌دهنده هویت این اطلاعات را ارائه نکند، برنامه باید یک روش جایگزین مستندسازی‌شده داشته باشد که فرض می‌کند حداقل سطح احراز هویت استفاده شده است (مثلاً احراز هویت تک‌عاملی با نام کاربری و گذرواژه). | 2 | + +## References + +برای اطلاعات بیشتر، همچنین به منابع زیر مراجعه کنید: + +* [NIST SP 800-63 - Digital Identity Guidelines](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-3.pdf) +* [NIST SP 800-63B - Authentication and Lifecycle Management](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf) +* [NIST SP 800-63 FAQ](https://pages.nist.gov/800-63-FAQ/) +* [OWASP Web Security Testing Guide: Testing for Authentication](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/04-Authentication_Testing) +* [OWASP Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html) +* [OWASP Forgot Password Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html) +* [OWASP Choosing and Using Security Questions Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Choosing_and_Using_Security_Questions_Cheat_Sheet.html) +* [CISA Guidance on "Number Matching"](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implement-number-matching-in-mfa-applications-508c.pdf) +* [Details on the FIDO Alliance](https://fidoalliance.org/) diff --git a/5.0/fa/0x16-V7-Session-Management.md b/5.0/fa/0x16-V7-Session-Management.md new file mode 100644 index 0000000000..5a76e2e8df --- /dev/null +++ b/5.0/fa/0x16-V7-Session-Management.md @@ -0,0 +1,91 @@ +# V7 Session Management + +## هدف + +مکانیزم‌های مدیریت نشست (Session Management Mechanisms) به برنامه‌ها این امکان را می‌دهند که تعاملات کاربر و دستگاه را در طول زمان، حتی هنگام استفاده از پروتکل‌های stateless (مانند HTTP)، با یکدیگر مرتبط کنند. برنامه‌های مدرن ممکن است از چندین توکن نشست (Session Token) با ویژگی‌ها و اهداف متفاوت استفاده کنند. یک سیستم مدیریت نشست ایمن، سیستمی است که از به‌دست آوردن، استفاده یا سوءاستفاده مهاجم از نشست قربانی جلوگیری می‌کند. برنامه‌هایی که نشست‌ها را نگهداری می‌کنند باید اطمینان حاصل کنند که الزامات سطح‌بالای زیر در مدیریت نشست رعایت شده‌اند: + +* نشست‌ها برای هر کاربر(شخص) منحصر به فرد هستند و نمی‌توان آن‌ها را حدس زد یا به اشتراک گذاشت. +* نشست‌ها زمانی که دیگر مورد نیاز نیستند، باطل می‌شوند و در دوره‌های عدم فعالیت، منقضی می‌گردند. + +بسیاری از الزامات مطرح‌شده در این فصل به کنترل‌های انتخاب‌شده از [دستورالعمل‌های هویت دیجیتال NIST SP 800-63](https://pages.nist.gov/800-63-4/) مربوط می‌شوند و بر تهدیدات رایج و ضعف‌های متداول در احراز هویت که معمولاً مورد سوءاستفاده قرار می‌گیرند، تمرکز دارند. + +توجه داشته باشید که الزامات مربوط به جزئیات پیاده‌سازی خاصِ برخی از مکانیزم‌های مدیریت نشست را می‌توان در منابع دیگری یافت: + +* HTTP Cookie‌ها یک مکانیزم مشترک برای امن سازی توکن‌های نشست هستند. الزامات امنیتی خاصی برای کوکی‌ها در بخش "Web Frontend Security" قرار داده شده است. +* توکن های Self-contained به عنوان روشی برای نگهداری نشست‌ها بطور مکرر مورد استفاده قرار می‌گیرند. الزامات امنیتی خاصی در بخش "Self-contained Tokens" قرار داده شده است. + +## V7.1 Session Management Documentation + +هیچ الگوی واحدی که برای تمامی برنامه‌های کاربردی مناسب باشد، وجود ندارد. بنابراین، تعریف مرزها و محدودیت‌های عمومی که برای تمامی موارد مناسب باشد غیر ممکن است. یک تحلیل ریسک با تصمیمات امنیتی مستند شده مرتبط با مدیریت نشست باید به عنوان یک پیش نیاز برای پیاده سازی و ارزیابی انجام شود. این امر تضمین می‌کند که سیستم مدیریت نشست با الزامات خاص آن برنامه کاربردی طراحی شده است. + +فارغ از اینکه از مکانیزم نشست stateful یا stateless استفاده شود، تحلیل باید به‌صورت کامل و مستند انجام شود تا نشان دهد راه‌حل انتخاب‌شده توانایی برآورده‌کردن تمامی الزامات امنیتی مرتبط را دارد. همچنین باید تعامل با هرگونه مکانیزم ورود یکپارچه (Single Sign-On یا SSO) که در حال استفاده است، مورد توجه قرار گیرد. + +| # | Description | Level | +| :---: | :--- | :---: | +| **7.1.1** | بازه عدم فعالیت نشست کاربر و بیشینه طول عمر نشست قبل از احراز هویت مجدد، در ترکیب با سایر کنترل‌ها مستند و متناسب سازی شود. مستند سازی انجام شده باید شامل توجیه برای هر انحراف(نقض) از الزامات احراز هویت مجدد NIST SP 800-63B باشد. | 2 | +| **7.1.2** | در مستند باید تعداد نشست همزمان مجاز برای یک کاربر و همچنین رفتار و اعمال مناسب برای زمانی که این تعداد به حداکثر رسید مشخص شود. | 2 | +| **7.1.3** | تمام سیستم‌هایی که نشست‌های کاربر را به عنوان بخشی از یک اکوسیستم مدیریت هویت فدرال(مانند سیستم‌های (SSO ایجاد و مدیریت می‌کنند، باید در کنار سایر کنترل‌های مربوط به طول عمر نشست‌ها، خاتمه آن‌ها و هرگونه شرایط دیگری که نیاز به احراز هویت مجدد دارد، مستند شوند. | 2 | + +## V7.2 Fundamental Session Management Security + +این بخش الزامات موردنیاز نشست‌های امن را از طریق بررسی امنیت تولید و اعتبارسنجی توکن‌ها احصا می‌نماید. + +| # | Description | Level | +| :---: | :--- | :---: | +| **7.2.1** | برنامه کاربردی باید تمام بررسی‌های توکن نشست‌ را با استفاده از یک سرویس backend مطمئن انجام دهد. | 1 | +| **7.2.2** | برنامه کاربردی که از هر یک از توکن‌های Self-Contained یا reference که به صورت پویا برای مدیریت نشست تولید شده‌اند استفاده کند اما از از کلیدهای API ثابت و کلید‌ها استفاده نکند. | 1 | +| **7.2.3** | در صورتی که برای نمایش نشست کاربر از توکن‌های reference استفاده می شود، این توکن‌ها منحصر به فرد بوده و با استفاده از یک تولید کننده عدد شبه تصادفی امن رمزنگاری(CSPRNG) که دارای انتروپی حداقل128 بیتی است تولید شوند. | 1 | +| **7.2.4** | برنامه کاربردی در هنگام احراز هویت کاربر یک توکن نشست جدید تولید نماید که شامل احراز هویت مجدد و ابطال توکن نشست کنونی است. | 1 | + +## V7.3 Session Timeout + +مکانیزم های انقضای نشست به منظور به حداقل رساندن فرصت برای session hijacking و سایر روش‌های سواستفاده از نشست‌ها بکار می‌روند. + +| # | Description | Level | +| :---: | :--- | :---: | +| **7.3.1** | بر اساس تحلیل ریسک و تصمیمات امنیتی مستند شده، پس از گذشت مهلت زمانی عدم فعالیت، کاربر مجبور به احراز هویت مجدد گردد. | 2 | +| **7.3.2** | بر اساس تحلیل ریسک و تصمیمات امنیتی مستند شده، پس از گذشت بیشینه زمان مطلق طول عمر، کاربر مجبور به احراز هویت مجدد گردد. | 2 | + +## V7.4 Session Termination + +ابطال نشست ممکن است توسط خود برنامه کاربردی و یا در صورتی که مکانیزم SSO برای مدیریت نشست مورد استفاده قرار گرفته است، توسط SSO به جای برنامه صورت پذیرد. ممکن است لازم باشد هنگام بررسی الزامات این بخش، تصمیم گرفته شود که آیا ارائه‌دهنده‌ی SSO در محدوده‌ی این الزامات قرار گیرد یا خیر، زیرا برخی از این SSOها ممکن است توسط ارائه‌دهنده کنترل شوند. + +ابطال نشست باید منجر به الزام کاربر به احراز هویت مجدد گردد و در سراسر برنامه، ورود یکپارچه (Federated Login) و سایر بخش ها اثربخش باشد. + +برای مکانیزم های نشست stateful، ابطال عموما شامل نامعتبرسازی نشست در backendاست. در مواردی که توکن‌ها self-contained هستند، معیار‌های بیشتری به منظور ابطال یا بلاک کردن این توکن‌ها مورد نیاز هستند‌؛ در غیر این صورت این توکن‌ها تا زمان منقضی شدن بصورت معتبر باقی می‌مانند. + +| # | Description | Level | +| :---: | :--- | :---: | +| **7.4.1** | در مواقعی که فرآیند خاتمه نشست کاربر فعال می‌شود (مانند خروج کاربر یا انقضای نشست)، برنامه اجازه هیچ فعالیتی را به آن نشست نمی‌دهد. برای Reference tokens یا stateful session، این به معنی نامعتبرسازی اطلاعات نشست در برنامه Backend می‌باشد. برنامه‌هایی که از توکن‌های Self-contained استفاده می‌کنند نیاز به راه حل‌هایی نظیر نگهداری فهرستی از توکن‌های خاتمه‌یافته، عدم پذیرش توکن‌هایی که پیش از یک تاریخ و زمان مشخص برای هر کاربر تولید شده‌اند، یا چرخش کلید امضای مخصوص هر کاربر دارند. | 1 | +| **7.4.2** | برنامه کاربردی تمامی نشست‌های فعال را در زمانی که حساب کاربری غیرفعال یا حذف می‌شود را ابطال نماید. (مانند کارمندی که شرکت را ترک می‌کند) | 1 | +| **7.4.3** | برنامه کاربردی قابلیت ارائه گزینه ابطال تمامی نشست های فعال دیگر را پس از یک تغییر موفقیت آمیز یا حذف هریک از عوامل احراز هویت (نظیر تغییر پسورد از طریق ریست یا بازنشانی و در صورت وجود به روزرسانی تنظیمات MFA ) را داشته باشد. | 2 | +| **7.4.4** | تمامی صفحاتی که نیازمند احراز هویت هستند دارای دسترسی آسان و مشخص به فرآیند خروج باشند. | 2 | +| **7.4.5** | مدیران برنامه کاربردی قادر به ابطال نشست‌های فعال برای یک شخص یا تمامی کاربران باشند. | 2 | + +## V7.5 Defenses Against Session Abuse + +این بخش الزاماتی را برای کاهش ریسک‌های ناشی از نشست‌های فعال که می‌توانند از طریق وکتورهایی که متکی بر وجود نشست‌های کاربر فعال و قابلیت‌‌های آن‌ها هستند مورد سرقت و یا سوء استفاده قرار گیرند را ارایه می‌دهد. بطور مثال، با استفاده از اجرای محتوا‌های آلوده مرورگر احراز هویت شده قربانی را مجبور کنیم که یک عملی را با استفاده از نشست کاربر قربانی انجام دهد. + +توجه داشته باشید که راهنمای سطح‌محور موجود در فصل «احراز هویت» باید هنگام در نظر گرفتن الزامات این بخش مدنظر قرار گیرد. + +| # | Description | Level | +| :---: | :--- | :---: | +| **7.5.1** | برنامه کاربردی قبل از اعطای مجوز تغییر ویژگی‌های حساس حساب کاربری که بر روی احراز هویت تاثیر دارد نظیر آدرس ایمیل، شماره تلفن، تنظیمات MFA یا اطلاعات دیگر که در بازگردانی حساب کاربری مورد استفاده قرار می‌گیرند، به احراز هویت مجدد کامل نیاز دارد. | 2 | +| **7.5.2** | حساب‌های کاربری قادر به دیدن(پس از احراز هویت مجدد با حداقل یک عامل) و ابطال یک یا همه نشست‌های فعال باشد. | 2 | +| **7.5.3** | برنامه کاربردی قبل از اجرای تراکنش‌ها یا عملیات‌های حساس نیازمند احراز هویت مجدد با حداقل یک عامل یا صحت سنجی ثانویه باشد. | 3 | + +## V7.6 Federated Re-authentication + +این بخش مربوط به کسانی است که کد طرف اتکا (RP) یا ارائه دهنده هویت (IdP) را می‌نویسند. این الزامات از [NIST SP 800-63C](https://pages.nist.gov/800-63-4/sp800-63c.html) برای هویت اشتراکی و ادعاها گرفته شده است. + +| # | Description | Level | +| :---: | :--- | :---: | +| **7.6.1** | طول عمر و ابطال نشست بین RP و idp طبق سند- که نیازمند احرازهویت مجدد در زمان مورد نیاز مانند وقتی که بیشینه زمان بین رخداد احراز هویت idp رسیده باشد- انجام شود. | 2 | +| **7.6.2** | ساخت نشست‌ها نیاز به رضایت کاربر یا یک اقدام صریح دارد که بدین صورت از ایجاد نشست‌های جدید برنامه بدون تعامل کاربر جلوگیری می‌شود. | 2 | + +## References + +برای اطلاعات بیشتر، همچنین به منابع زیر مراجعه کنید: + +* [OWASP Web Security Testing Guide: Session Management Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/06-Session_Management_Testing) +* [OWASP Session Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html) diff --git a/5.0/fa/0x17-V8-Authorization.md b/5.0/fa/0x17-V8-Authorization.md new file mode 100644 index 0000000000..852690c2b5 --- /dev/null +++ b/5.0/fa/0x17-V8-Authorization.md @@ -0,0 +1,56 @@ +# V8 Authorization + +## هدف + +مجوز دسترسی، تضمین می‌کند که دسترسی‌ها فقط در اختیار مصرف کنندگان مجاز (کاربران،سرورها و سایر کلاینت‌ها) قرار گیرد. به منظور اعمال اصل حداقل دسترسی(POLP)، برنامه‌های کاربردی مورد تایید باید این الزامات سطح بالا را احصاء نمایند: + +* قوانین صدور مجوزها که شامل عوامل دخیل در تصمیم گیری و عوامل محیطی است را مستند سازی نمایید. +* دسترسی مصرف کنندگان به منابع باید بر اساس حقوق تعریف شده آن‌ها مجاز شمرده شود. + +## V8.1 Authorization Documentation + +مستند سازی جامع مجوزها به منظور اطمینان از اعمال پیوسته، قابلیت ممیزی(Auditable) و همسو بودن تصمیمات امنیتی با سیاست‌های سازمانی ضروری است و همچنین با شفاف سازی و اجرایی کردن الزامات امنیتی برای توسعه دهندگان، مدیران سیستم و آزمون‌گر‌های ریسک دسترسی غیر مجاز را کاهش می‌دهد. + +| # | Description | Level | +| :---: | :--- | :---: | +| **8.1.1** | مستند اعطای مجوز باید شامل قوانینی به منظور محدودسازی دسترسی در سطح عملکرد و دسترسی مبتنی بر داده بر اساس مجوزهای کاربران و ویژگی‌های منابع باشد. | 1 | +| **8.1.2** | مستند اعطای مجوز باید قوانینی را برای محدودیت‌های دسترسی در سطح Field بر اساس مجوزهای کاربران و ویژگی‌های منابع تعریف نماید(هر دو دسترسی خواندن و نوشتن). توجه داشته باشید که این قوانین ممکن است به مقادیر دیگر ویژگی‌های شیء داده ی مربوطه (Relevant Data Object) بستگی داشته باشند، مانند حالت (state) یا وضعیت (status). | 2 | +| **8.1.3** | مستند برنامه کاربردی باید ویژگی‌های محیطی و زمینه‌ای (شامل و نه محدود به زمان روز، مکان، آدرس IP یا دستگاه) که در برنامه کاربردی به منظور اتخاذ تصمیمات امنیتی (نظیر آن دسته از تصمیماتی که مربوط به احراز هویت و اعطای مجوز می باشد) را مشخص کند. | 3 | +| **8.1.4** | مستندات احراز هویت و اعطای مجوز، علاوه بر اعطای مجوز در سطح Field، سطح عملکرد و داده‌های خاص، چگونگی استفاده از عوامل محیطی و زمینه‌ای در اتخاذ تصمیمات را مشخص نماید. | 3 | + +## V8.2 General Authorization Design + +پیاده سازی کنترل‌های اعطای مجوز جزئیدر سطح عملکرد، داده و فیلدها، تضمین می‌کند که مصرف کنندگان فقط قادر به دسترسی به آن چیزی هستند که صریحا به آن‌ها دسترسی داده شده است. + +| # | Description | Level | +| :---: | :--- | :---: | +| **8.2.1** | برنامه کاربردی باید از محدود بودن دسترسی‌‌های در سطح عملکرد به مشتریانی که دارای دسترسی صریح هستند اطمینان حاصل نماید. | 1 | +| **8.2.2** | برنامه کاربردی باید از محدود بودن دسترسی‌‌های در سطح داده به مشتریانی که دارای دسترسی صریح به اقلام داده‌ای خاص هستند اطمینان حاصل نماید تا از این طریق خطر آسیب پذیری IDOR و broken object level authorization را کاهش دهد . | 1 | +| **8.2.3** | برنامه کاربردی دسترسی در سطح Field را با مجوزهای صریح به Field ها برای مصرف کنندگان جهت کاهش خطر broken object property level authorization (BOPLA) محدود کرده باشد. | 2 | +| **8.2.4** | کنترل‌های امنیتی تطبیقی که بر اساس ویژگی‌های محیطی و زمینه‌ای کاربر (مانند زمان روز، مکان، آدرس IP یا دستگاه) هستند، برای تصمیم‌گیری‌های احراز هویت (Authentication) و مجوزدهی (Authorization) طبق مستندات برنامه پیاده‌سازی شده‌اند. این کنترل‌ها باید هم در زمان تلاش کاربر برای شروع یک نشست (Session) جدید و هم در طول یک نشست فعال، اعمال شوند. | 3 | + +## V8.3 Operation Level Authorization + +اجرای فوری تغییرات در مجوز‌های دسترسی در لایه مناسب از معماری برنامه کاربردی به منظور جلوگیری از اقدامات غیرمجاز بویژه در محیط های پویا ضروری است. + +| # | Description | Level | +| :---: | :--- | :---: | +| **8.3.1** | برنامه کاربردی قوانین مجوزدهی را در یک لایه سرویس معتبر اعمال نموده و بر آن دسته از کنترل‌هایی که مصرف کنندگان نامعتبر قادر به دستکاری آن‌ها هستند متکی نباشد. (نظیر جاوا اسکریپت سمت کاربر) | 1 | +| **8.3.2** | در مواقعی که امکان اعمال فوری تغییرات وجود ندارد (مثلاً وقتی که سیستم برای تصمیم‌گیری در مجوزدهی از توکن‌های Self-Contained مثل JWT استفاده می‌کند که اطلاعات را داخل خود ذخیره کرده و تا زمان انقضا تغییر نمی‌کنند)، باید کنترل‌های جبرانی وجود داشته باشد. این کنترل‌ها باید بتوانند زمانی که کاربر عملی را انجام می‌دهد که دیگر مجاز به آن نیست، هشدار بدهند و تغییر را برگردانند. با این حال، توجه کنید که این راهکار جایگزین نمی‌تواند جلوی نشت اطلاعات را بگیرد. | 3 | +| **8.3.3** | دسترسی به یک object بر اساس مجوزهای کاربری شخص درخواست کننده(مثال: مصرف کننده) باشد نه بر اساس مجوز‌های یک واسطه یا سرویسی که به نمایندگی از او عمل می‌کند. بطور مثال، در صورتی که یک مصرف کننده یک وب سرویس را با استفاده از یک توکن self-contained برای احراز هویت فراخوانی می‌کند و سپس آن سرویس اطلاعات را از یک سرویس دیگر درخواست می‌کند، سرویس دوم باید همان توکن مصرف کننده را استفاده کند، نه یک توکن سرویس-به-سرویس (Machine-to-Machine token) که متعلق به سرویس اول است، تا تصمیمات مجوزدهی دقیقاً بر اساس مجوزهای کاربر گرفته شوند. | 3 | + +## V8.4 Other Authorization Considerations + +ملاحظات اضافه‌تری برای مجوزدهی ، بویژه برای درگاه‌های مدیریتی و محیط‌های چند کاربره(multi tenants) وجود دارد که برای جلوگیری از دسترسی غیر مجاز مفید هستند. + +| # | Description | Level | +| :---: | :--- | :---: | +| **8.4.1** | برنامه های کاربردی چند کاربره(multi tenants) از کنترل های cross-tenant به منظور تضمین این امر که عملیات‌های مصرف کنندگان هرگز کاربرانی (tenants) را که مجوز تعامل با آنها را ندارند را تحت تأثیر قرار نمی‌دهد. | 2 | +| **8.4.2** | دسترسی به درگاه‌های پیکربندی شامل چندین لایه امنیتی از قبیل تأیید مداوم هویت مصرف‌کننده، ارزیابی وضعیت امنیتی دستگاه و تحلیل ریسک زمینه‌ای باشد تا از این طریق اطمینان حاصل شود که موقعیت شبکه‌ای یا نقاط پایانی معتبر تنها عوامل برای مجوزدهی نیستند اگر چه که این عوامل احتمال دسترسی غیرمجاز را کاهش می‌دهند. | 3 | + +## References + +برای اطلاعات بیشتر، همچنین به منابع زیر مراجعه کنید: + +* [OWASP Web Security Testing Guide: Authorization](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/05-Authorization_Testing) +* [OWASP Authorization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html) diff --git a/5.0/fa/0x18-V9-Self-contained-Tokens.md b/5.0/fa/0x18-V9-Self-contained-Tokens.md new file mode 100644 index 0000000000..20fa897eee --- /dev/null +++ b/5.0/fa/0x18-V9-Self-contained-Tokens.md @@ -0,0 +1,36 @@ +# V9 Self-contained Tokens + +## هدف + +مفهوم توکن self-contained در RFC 6749 Oauth2 اصلی مربوط به سال 2012 ذکر شده است. این مفهوم به توکنی اشاره دارد که شامل داده یا Claim است که یک سرویس گیرنده برای تصمیم‌گیری‌های امنیتی به آنها متکی خواهد بود. از این رو باید آن‌ها را از توکن‌های ساده‌ای که فقط حاوی یک شناسه هستند که سرویس گیرنده از آن‌ها برای جستجوی داده بصورت محلی استفاده می‌کند متمایز دانست. رایج ترین مثال‌ها از توکن‌های self-contained ها، JSON Web Tokens (JWTs) وSAML assertion هستند. + +کاربرد توکن‌های self-contained حتی خارج از حوزه OAuth و OIDC بسیار فراگیر شده است. در همین زمان امنیت این مکانیزم بر قابلیت اعتبارسنجی یکپارچگی توکن و تضمین این مساله که این توکن برای یک زمینه خاص معتبر است استوار است. موانع زیادی(چالش‌ها) در این فرآیند وجود دارد و این بخش جزئیات ویژه‌ای از این مکانیزم‌ها را ارائه می‌دهد که برنامه‌ها باید به منظور جلوگیری از این چالش‌ها، ارائه دهند. + +## V9.1 Token source and integrity + +این بخش شامل الزاماتی است که تضمین می‌کند که توکن توسط بخش مطمئن(مورد اعتماد) تولید شده است و مورد دستکاری قرار نگرفته است. + +| # | Description | Level | +| :---: | :--- | :---: | +| **9.1.1** | قبل از پذیرش محتوای توکن‌ها، آن‌ها را با استفاده از امضای دیجیتال یا MAC به منظور حفاظت در مقابل دستکاری‌ها مورد اعتبارسنجی قرار داده شود. | 1 | +| **9.1.2** | فقط الگوریتم‌های موجود در لیست مجاز قادر به استفاده در ساخت و صحت سنجی توکن‌های self-contained در یک زمینه مشخص باشند. این لیست مجاز باید در حالت ایده آل شامل هم الگوریتم‌های متقارن و هم نامتقارن‌ها باشد و نباید شامل الگوریتم‌های NONE باشد. در صورتی که هر دو الگوریتم‌های متقارن و نانتقارن مورد نیاز باشند کنترل‌های بیشتری باید به منظور جلوگیری از سردرگمی کلید‌ها(key Confusion) بکار گرفته شود. | 1 | +| **9.1.3** | به منظور جلوگیری از مشخص نمودن منابع غیر مطمئن و کلید‌ها توسط مهاجمین، موارد کلیدی که در اعتبارسنجی توکن‌های self-contained مورد استفاده قرار می‌گیرند، از منابع از پیش پیکربندی شده مطمئنی که برای صادر کننده توکن است تعیین شود. برای JWTs و سایر ساختارهای JWS ، هدرهایی نظیر ‘jku’, ‘x5u’ و ‘jwk’ باید با یک لیست مجاز از منابع مطمئن مورد اعتبارسنجی قرار گیرند. | 1 | + +## V9.2 Token content + +قبل از اتخاذ تصمیمات امنیتی براساس محتوای توکن self-contained، ضروری است ابتدا بررسی شود که آیا توکن در دوره معتبر خود و برای هدفی که توسط سرویس گیرنده در جهت کاربرد آن در نظر گرفته و ارائه شده است. این موضوع به منظور جلوگیری از استفاده متقابل نا امن بین سرویس‌های مختلف یا با انواع توکن‌های مختلف از صادرکننده مشابه است. + +الزامات خاص برای OAuth و OIDC در این بخش مورد پوشش قرار گرفته شده‌اند. + +| # | Description | Level | +| :---: | :--- | :---: | +| **9.2.1** | اگر یک بازه زمانی معتبر در داده‌های توکن وجود داشته باشد، توکن و محتوای آن تنها در صورتی پذیرفته می‌شوند که زمان بررسی در این بازه زمانی معتبر باشد. به عنوان مثال، برای JWTها، ادعاهای 'nbf' و 'exp' باید تایید شوند. | 1 | +| **9.2.2** | سرویسی که یک توکن دریافت می‌کند قبل از پذیرش محتوای آن، از لحاظ درستی نوع بررسی نموده و برای هدف مشخص شده در نظر گیرد. بطور مثال، فقط توکن‌های access می‌توانند به منظور تصمیمات مجوزی و فقط توکن های ID می‌توانند به منظور اثبات هویت کاربر مورد پذیرش قرار گیرند. | 2 | +| **9.2.3** | یک سرویس فقط توکن‌هایی را بپذیرد که به منظور استفاده توسط آن سرویس هستند(audience).برای JWT ها،این امر می‌تواند از طریق اعتبارسنجی ادعای 'aud' با یک لیست مجاز تعریف شده در سرویس صورت پذیرد. | 2 | +| **9.2.4** | اگر صادر کننده توکن از کلید خصوصی مشابهی برای audienceهای متفاوت استفاده می‌کند، توکن‌های تولید شده دارای محدودیت مخاطبی باشند که بطور منحصر به فردی مخاطبین مورد نظر را مشخص می‌کند. این امر از استفاده مجدد توکن توسط مخاطب ناخواسته جلوگیری می‌کند. در صورتی که شناسه مخاطب به صورت پویا مشخص شده باشد، صادرکننده توکن باید این مخاطبین را به منظور اطمینان از عدم جعل هویت مخاطب مورد اعتبارسنجی قرار دهد. | 2 | + +## References + +برای اطلاعات بیشتر، همچنین به منابع زیر مراجعه کنید: + +* [OWASP JSON Web Token Cheat Sheet for Java Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_for_Java_Cheat_Sheet.html) (but has useful general guidance) diff --git a/5.0/fa/0x19-V10-OAuth-and-OIDC.md b/5.0/fa/0x19-V10-OAuth-and-OIDC.md new file mode 100644 index 0000000000..2351274fa3 --- /dev/null +++ b/5.0/fa/0x19-V10-OAuth-and-OIDC.md @@ -0,0 +1,171 @@ +# V10 OAuth and OIDC + +## هدف + +OAuth2 (که در این فصل با عنوان OAuth از آن یاد می‌شود) یک چارچوب استاندارد در صنعت برای واگذاری مجوز دسترسیauthorization) (delegated است. برای مثال، با استفاده از OAuth یک برنامه‌ی کاربری (Client Application) می‌تواند به نمایندگی از کاربر، به APIها (منابع سرور) دسترسی پیدا کند، مشروط بر اینکه کاربر، دسترسی مورد نیاز را به آن برنامه اعطا کرده باشد. + +به‌تنهایی، OAuth برای احراز هویت کاربر طراحی نشده است. چارچوب OpenID Connect (OIDC) با افزودن یک لایه‌ی هویت کاربر بر رویOAuth، آن را گسترش می‌دهد. OIDCامکاناتی مانند اطلاعات استاندارد هویت کاربر، ورود یکپارچه (Single Sign-On - SSO) و مدیریت نشست (Session Management) را پشتیبانی می‌کند.از آنجا که OIDC یک افزونه‌ی OAuth محسوب می‌شود، الزامات مربوط به OAuth در این فصل، شامل OIDC نیز می‌گردد. + +نقش‌های زیر در OAuth تعریف شده‌اند: + +* مشتری OAuth (OAuth Client) برنامه‌ای است که تلاش می‌کند به منابع سرور دسترسی پیدا کند (برای مثال، با فراخوانی یک API به کمک توکن دسترسی صادرشده) مشتری OAuth اغلب یک برنامه‌ی سمت سرور (Server-side Application) است. + * یک Confidential Client نوعی OAuth Client است که توانایی حفظ محرمانگی اعتبارنامه‌هایی (Credentials) را دارد که برای احراز هویت خود در برابر سرور مجوز (Authorization Server) استفاده می‌کند. + * یک Public Client توانایی حفظ محرمانگی اعتبارنامه‌ها (Credentials) برای احراز هویت در برابر Authorization Server را ندارد. بنابراین، به جای احراز هویت خود (برای مثال با استفاده از پارامترهای client_id و client_secret)، صرفاً خودش را شناسایی می‌کند (با استفاده از پارامتر client_id) +* OAuth Resource Server (RS) سروری است که از طریق API، منابع را در اختیار OAuth Clients قرار می‌دهد. +* OAuth Authorization Server (AS) یک برنامه‌ی سرور است که به OAuth Clients توکن‌های دسترسی (Access Tokens) صادر می‌کند. این توکن‌ها به OAuth Clients امکان می‌دهند تا به منابع موجود در RS دسترسی پیدا کنند؛ یا به نمایندگی از کاربر نهایی (End-User)، یا به نمایندگی از خود OAuth Client. معمولاً AS یک برنامه‌ی مجزا است، اما در صورت لزوم می‌تواند در یک RS مناسب نیز ادغام شود. +* Resource Owner (RO) همان کاربر نهایی (End-User) است که به OAuth Clients اجازه می‌دهد تا به نمایندگی از او، دسترسی محدودی به منابع موجود روی Resource Server داشته باشند. + Resource Owner با تعامل با Authorization Server، رضایت خود را برای این واگذاری مجوز دسترسی (Delegated Authorization) اعلام می‌کند. + +نقش‌های زیر در OIDC تعریف شده‌اند: + +* Relying Party (RP) برنامه‌ی کاربری (Client Application) است که از طریق OpenID Provider درخواست احراز هویت کاربر نهایی (End-User) را می‌دهد. این نقش در واقع همان نقش یک OAuth Client را بر عهده دارد. +* OpenID Provider (OP) یک OAuth AS است که توانایی احراز هویت کاربر نهایی (End-User) را دارد و اطلاعات هویتی (OIDC Claims) را در اختیار RP قرار می‌دهد.OP می‌تواند همان Identity Provider (IdP) باشد، اما در سناریوهای فدراسیونی (Federated Scenarios)، OP و Identity Provider (جایی که کاربر نهایی احراز هویت می‌شود) ممکن است دو برنامه‌ی سرور جداگانه باشند. + +OAuth و OIDC در ابتدا برای برنامه‌های سوم‌شخص (Third-Party Applications) طراحی شده بودند. +امروزه، این پروتکل‌ها به‌طور گسترده در برنامه‌های اول‌شخص (First-Party Applications) نیز مورد استفاده قرار می‌گیرند. با این حال، هنگام استفاده در سناریوهای اول‌شخص مانند احراز هویت (Authentication) و مدیریت نشست (Session Management) این پروتکل‌ها پیچیدگی‌هایی را به همراه می‌آورند که ممکن است چالش‌های امنیتی جدیدی ایجاد کنند. + +OAuth وOIDC را می‌توان در انواع مختلف برنامه‌ها به کار برد، اما تمرکز در ASVS و همچنین الزامات مطرح‌شده در این فصل، بر روی برنامه‌های وب (Web Applications) و رابط‌های برنامه‌نویسی کاربردی (APIs) است. + +از آنجا کهOAuth وOIDC را می‌توان به‌عنوان لایه‌ای منطقی بر بستر فناوری‌های وب در نظر گرفت، الزامات عمومی مطرح‌شده در فصل‌های دیگر همواره در اینجا نیز کاربرد دارند. بنابراین، این فصل را نمی‌توان به‌صورت جدا از بقیه‌ی محتوا در نظر گرفت. + +این فصل به بهترین شیوه‌های جاری (Best Current Practices) برای OAuth2 و OIDC می‌پردازد که با مشخصات منتشرشده در نشانی‌های و همسو هستند. حتی اگرچه RFCها به بلوغ رسیده محسوب می‌شوند، اما به‌طور مداوم به‌روزرسانی می‌شوند. بنابراین، هنگام به‌کارگیری الزامات این فصل، همسویی با آخرین نسخه‌ها بسیار اهمیت دارد. برای جزئیات بیشتر به بخش مراجع (References) مراجعه کنید. + +با توجه به پیچیدگی این حوزه، برای داشتن یک راهکار امن مبتنی بر OAuth یا OIDC بسیار ضروری است که از Authorization Serverهای شناخته‌شده و استاندارد در صنعت استفاده شود و پیکربندی‌های امنیتی توصیه‌شده به‌کار گرفته شوند. + +اصطلاحات به‌کاررفته در این فصل با RFCهای OAuth و مشخصات OIDC همسو هستند. با این حال، توجه داشته باشید که اصطلاحات OIDC تنها در مواردی استفاده می‌شوند که مربوط به الزامات خاص OIDC باشند؛ در غیر این صورت، از اصطلاحات OAuth استفاده خواهد شد. + +در زمینه‌ی OAuth و OIDC، اصطلاح توکن(Token) در این فصل اشاره دارد به: + +* Access Tokens، که فقط باید توسطRS مصرف شوند و می‌توانند یاReference Tokens باشند که با استفاده از Introspection اعتبارسنجی می‌شوند، یا Self-contained Tokens باشند که با استفاده از کلید رمزنگاری (Key Material ) اعتبارسنجی می‌شوند. +* Refresh Tokens، که فقط باید توسط Authorization Serverای مصرف شوند که توکن را صادر کرده است. +* OIDC ID Tokens، که فقط باید توسط Clientای مصرف شوند که جریان احراز مجوز (Authorization Flow) را آغاز کرده است. + +سطوح ریسک برای برخی از الزامات این فصل به این بستگی دارد که آیا Client یک Confidential Client است یا به‌عنوان یک Public Client در نظر گرفته می‌شود. از آنجا که استفاده از احراز هویت قوی Client بسیاری از بردارهای حمله را کاهش می‌دهد، برخی از الزامات ممکن است در هنگام استفاده از یک Confidential Client برای برنامه‌های L1 آسان‌تر در نظر گرفته شوند. + +## V10.1 Generic OAuth and OIDC Security + +این بخش الزامات معماری عمومی را پوشش می‌دهد که برای همه‌ی برنامه‌هایی که ازOAuth یا OIDC استفاده می‌کنند، اعمال می‌شوند. + +| # | Description | Level | +| :---: | :--- | :---: | +| **10.1.1** | توکن‌ها باید فقط به مؤلفه‌هایی ارسال شوند که به‌طور دقیق به آن‌ها نیاز دارند. برای مثال، هنگام استفاده از الگوی Backend-for-Frontend برای برنامه‌های JavaScript مبتنی بر مرورگر، Access Tokens و Refresh Tokens باید فقط برای Backend قابل دسترس باشند. | 2 | +| **10.1.2** | Client باید فقط مقادیری را از Authorization Server بپذیرد (مانند Authorization Code یاID Token ) که این مقادیر حاصل از یک Authorization Flow باشند که توسط همان نشست (Session) و تراکنش User Agent آغاز شده است. این موضوع مستلزم آن است که Secretهای تولیدشده توسط کلاینت مانند code_verifier در PKCE، یا مقادیر state و nonce در OIDC قابل حدس زدن نباشند، مخصوص همان تراکنش باشند، و به‌صورت امن هم به کلاینت و هم به نشست (Session) مرورگری که تراکنش در آن شروع شده، متصل شده باشند. | 2 | + +## V10.2 OAuth Client + +این الزامات مسئولیت‌هایی را که بر عهده برنامه‌های کلاینتِ OAuth است مشخص می‌کنند. کلاینت می‌تواند مثلاً یک بک‌اندِ وب‌سرور باشد (که اغلب به‌عنوان Backend For Frontend یا BFF عمل می‌کند) یک سرویس بک‌اندِ یکپارچه‌ساز، یا یک برنامه فرانت‌اند تک‌صفحه‌ای (SPA یا همان برنامه مبتنی بر مرورگر باشد. + +به‌طور کلی، Backend Clients به‌عنوانConfidential Clients وFrontend Clients به‌عنوانPublic Clients در نظر گرفته می‌شوند. با این حال، برنامه‌های Native که روی دستگاه کاربر نهایی اجرا می‌شوند می‌توانند در صورتی که ازOAuth Dynamic Client Registration استفاده کنند، به‌عنوانConfidential در نظر گرفته شوند. + +| # | Description | Level | +| :---: | :--- | :---: | +| **10.2.1** | درCode Flow، باید OAuth Client در برابر حملاتBrowser-based Request Forgery که معمولاً با عنوان Cross-Site Request Forgery (CSRF) شناخته می‌شوند و درخواست‌های توکن را ایجاد می‌کنند، محافظت داشته باشد. این محافظت باید با استفاده از قابلیت PKCE یا با بررسی پارامترstate که در درخواست احراز مجوز ارسال شده است. | 2 | +| **10.2.2** | اگر OAuth Client بتواند با بیش از یک Authorization Server تعامل داشته باشد، باید دارای سازوکاری برای دفاع در برابر Mix-up Attacks باشد. برای مثال، می‌تواند الزام کند که Authorization Server مقدار پارامتر ‘iss’ را برگرداند و این مقدار هم درAuthorization Response و هم درToken Response اعتبارسنجی شود. | 2 | +| **10.2.3** | OAuth Client باید فقطScopes (یا سایر پارامترهای مجوزدهی) مورد نیاز را در درخواست‌ها به Authorization Server درخواست کند. | 3 | + +## V10.3 OAuth Resource Server + +در زمینه‌ی ASVS و این فصل، Resource Server یک API است. برای فراهم‌کردن دسترسی ایمن، Resource Server باید: + +* Access Token را مطابق با فرمت توکن و مشخصات پروتکل مربوطه اعتبارسنجی کند، برای مثال با استفاده از JWT-validation یا OAuth Token Introspection. +* اگر Access Token معتبر باشد، تصمیمات مجوزدهی (Authorization Decisions) را بر اساس اطلاعات موجود در توکن و دسترسی‌های اعطا شده اعمال نماید. برای مثال، Resource Server باید بررسی کند که آیا Client (که به نمایندگی از RO عمل می‌کند) اجازه‌ی دسترسی به Resource درخواستی را دارد یا خیر. + +بنابراین، الزامات ذکرشده در اینجا مختص OAuth یا OIDC هستند و باید پس از اعتبارسنجی توکن و پیش از اعمال تصمیمات مجوزدهی بر اساس اطلاعات موجود در توکن انجام شوند. + +| # | Description | Level | +| :---: | :--- | :---: | +| **10.3.1** | Resource Server باید فقط Access Tokenهایی را بپذیرد که برای استفاده با همان سرویس در نظر گرفته شده‌اند(Audience). Audience می‌تواند در یک Access Token ساختاریافته (مانند مقدار aud در JWT) درج شده باشد، یا از طریق Token Introspection Endpoint بررسی شود. | 2 | +| **10.3.2** | Resource Server باید تصمیمات مجوزدهی (Authorization Decisions) را بر اساس Claims موجود در Access Token که واگذاری مجوز (Delegated Authorization) را تعریف می‌کنند، اعمال کند. اگر Claimsهایی مانند sub، scope و authorization_details موجود باشند، باید جزو فرآیند تصمیم‌گیری قرار گیرند. | 2 | +| **10.3.3** | اگر برای گرفتن یک تصمیم کنترل دسترسی، لازم است یک کاربرِ یکتا از داخل Access Token (چه JWT و چه پاسخ Token Introspection ) شناسایی شود، سرور منبع (Resource Server) کاربر را از روی Claimهایی شناسایی کند که قابل اختصاص‌دادن به کاربران دیگر نیستند. معمولاً این یعنی استفاده از ترکیب دو Claim یعنی 'iss' (صادرکننده توکن) و 'sub' (شناسه یکتای کاربر) | 2 | +| **10.3.4** | اگر Resource Server نیازمند قدرت، روش یا تازگی خاص احراز هویت باشد، بررسی کند که Access Token ارائه‌شده این محدودیت‌ها را برآورده می‌کند. برای مثال، در صورت وجود، از Claimsهای OIDC مانند acr، amr و auth_time به ترتیب استفاده شود. | 2 | +| **10.3.5** | تأیید کنید که Resource Server از استفاده از Access Tokenهای سرقت‌شده یا Replay توکن‌ها (توسط افراد غیرمجاز) جلوگیری کند، با الزام استفاده از Sender-Constrained Access Tokens، مانند Mutual TLS برای OAuth 2 یا OAuth2 Demonstration of Proof of Possession (DPoP). | 3 | + +## V10.4 OAuth Authorization Server + +این الزامات، مسئولیت‌های مربوط به OAuth Authorization Servers، شامل OpenID Providers را تشریح می‌کنند. + +برای Client Authentication، روش ‘self_signed_tls_client_auth’ مجاز است، همراه با پیش‌نیازهایی که در [بخش 2.2](https://datatracker.ietf.org/doc/html/rfc8705#name-self-signed-certificate-mut) از [RFC 8705](https://datatracker.ietf.org/doc/html/rfc8705) مشخص شده‌اند. + +| # | Description | Level | +| :---: | :--- | :---: | +| **10.4.1** | سرور احراز هویت باید آدرس‌های بازگشتی (Redirect URI) را بر اساس فهرست مجاز (Allowlist) از URIهای از پیش‌ثبت‌شده و مخصوص هر کلاینت، با استفاده از مقایسه دقیقِ رشته‌ای Comparison) (Exact String اعتبارسنجی می‌کند. | 1 | +| **10.4.2** | اگر Authorization Server کد احراز مجوز (Authorization Code) را در Authorization Response برمی‌گرداند، این کد فقط یک‌بار برای درخواست توکن باید قابل استفاده باشد. برای دومین درخواست معتبر با یک Authorization Code که قبلاً برای صدور Access Token استفاده شده است، Authorization Server باید درخواست توکن را رد کند و هر توکن صادرشده‌ی مرتبط با آن Authorization Code را باطل نماید. | 1 | +| **10.4.3** | تأیید کنید که Authorization Code دارای مدت زمان معتبر بودن محدود باشد. حداکثر طول عمر می‌تواند برای برنامه‌های کاربردی در سطوح L1 و L2 تا ۱۰ دقیقه و برای برنامه‌های کاربردی در سطح L3 تا ۱ دقیقه باشد. | 1 | +| **10.4.4** | برای یک Client مشخص، Authorization Server فقط استفاده از Grantهایی را مجاز بداند که آن Client به استفاده از آن‌ها نیاز دارد. توجه داشته باشید که Grantهای ‘token’ (Implicit Flow) و ‘password’ (Resource Owner Password Credentials Flow) دیگر نباید استفاده شوند. | 1 | +| **10.4.5** | Authorization Server باید حملات Refresh Token Replay را برای Public Clientها کاهش دهد، ترجیحاً با استفاده از Sender-Constrained Refresh Tokens، یعنی Demonstrating Proof of Possession (DPoP) یا Certificate-Bound Access Tokens با استفاده از Mutual TLS (mTLS). برای برنامه‌های L1 و L2، می‌توان از Refresh Token Rotation استفاده کرد. اگر Refresh Token Rotation به‌کار گرفته شود، Authorization Server باید پس از استفاده، Refresh Token را باطل کند و اگر یک Refresh Token که قبلاً استفاده و باطل شده ارائه شود، تمام Refresh Tokenهای مربوط به آن مجوز را ابطال نماید. | 1 | +| **10.4.6** | اگر از Code Grant استفاده شود، Authorization Server باید حملات Authorization Code Interception را با الزام به استفاده از Proof Key for Code Exchange (PKCE) کاهش دهد. برای Authorization Requestها، Authorization Server باید یک مقدار معتبر برای 'code_challenge' الزام کند و نباید مقدار 'code_challenge_method' از نوع 'plain' را بپذیرد. برای Token Request، باید اعتبارسنجی پارامتر 'code_verifier' الزامی باشد. | 2 | +| **10.4.7** | اگر Authorization Server از Unauthenticated Dynamic Client Registration پشتیبانی می‌کند، ریسک مربوط به Client Applicationهای مخرب را باید کاهش دهد. این کار باید شامل اعتبارسنجی Client Metadata (مانند هر Registered URI)، اطمینان از رضایت کاربر، و هشدار به کاربر پیش از پردازش یک Authorization Request با یک Client Application غیرقابل اعتماد باشد. | 2 | +| **10.4.8** | Refresh Tokenها باید دارای یک انقضای مطلق (Absolute Expiration) باشند، حتی اگر از Sliding Refresh Token Expiration استفاده شود. | 2 | +| **10.4.9** | Refresh Tokenها و Reference Access Tokenها باید توسط کاربر مجاز از طریق User Interface Authorization Server قابل ابطال باشند، تا ریسک Clientهای مخرب یا توکن‌های سرقت‌شده کاهش یابد. | 2 | +| **10.4.10** | Confidential Client باید برای درخواست‌های Backchannel بین Client و Authorization Server، مانند Token Requests، Pushed Authorization Requests (PAR) و Token Revocation Requests، احراز هویت شود. | 2 | +| **10.4.11** | پیکربندی Authorization Server باید فقط Scopes موردنیاز را به OAuth Client اختصاص دهد. | 2 | +| **10.4.12** | برای یک Client مشخص، Authorization Server فقط مقدار 'response_mode' را که این Client نیاز دارد، مجاز بداند. برای مثال، با اعتبارسنجی این مقدار توسط Authorization Server در برابر مقادیر مورد انتظار یا با استفاده از Pushed Authorization Request (PAR) یا JWT-secured Authorization Request (JAR). | 3 | +| **10.4.13** | Grant Type ‘code’ همواره همراه با Pushed Authorization Requests (PAR) باید استفاده شود. | 3 | +| **10.4.14** | Authorization Server باید فقط توکن‌های دسترسی از نوع وابسته به ارسال‌کننده (Proof-of-Possession) صادر می‌کند؛ چه به‌صورت توکن‌های دسترسی مبتنی بر گواهی از طریق TLS دوسویه (mTLS) و چه به‌صورت توکن‌های دسترسی وابسته به DPoP (Demonstration of Proof of Possession). | 3 | +| **10.4.15** | برای یک کلاینت سمت‌سرور (که روی دستگاه کاربر نهایی اجرا نمی‌شود)، سرور احراز هویت اطمینان حاصل می‌کند که مقدار پارامترِ authorization_details از بک‌اند کلاینت ارسال شده و کاربر در آن دستکاری نکرده است. به‌عنوان مثال، با الزام به استفاده از درخواست احراز هویت پوش‌شده (PAR) یا درخواست احراز هویت ایمن‌شده با JWT (JAR). | 3 | +| **10.4.16** | کلاینت باید از نوع Confidential Client باشد و سرور احراز هویت استفاده از روش‌های قدرتمند احراز هویت کلاینت ـ مبتنی بر رمزنگاری کلید عمومی و مقاوم در برابر حملات replay attacks ـ را الزامی کند؛ مانند TLS دوسویه (tls_client_auth ‎، ‎self_signed_tls_client_auth یا JWT مبتنی بر کلید خصوصی (private_key_jwt). | 3 | + +## V10.5 OIDC Client + +از آنجا که Relying Party در OIDC نقش یک کلاینت OAuth را هم ایفا می‌کند، الزامات بخش «OAuth Client» نیز در اینجا قابل اعمال هستند. + +همچنین توجه داشته باشید که بخش «Authentication with an Identity Provider» در فصل «Authentication» نیز شامل الزامات عمومی مرتبط و مهمی است. + +| # | Description | Level | +| :---: | :--- | :---: | +| **10.5.1** | Client به‌عنوان Relying Partyباید در برابر حملات بازپخش (Replay) توکن ID محافظت شده است. برای مثال، با بررسی اینکه مقدار claim مربوط به nonce در ID Token دقیقاً با مقدار **nonce**ای که در درخواست احراز هویت به OpenID Provider ارسال شده، یکسان باشد(که در OAuth 2 به آن authorization request ارسالی به authorization server گفته می‌شود). | 2 | +| **10.5.2** | Client باید کاربر را به‌صورت یکتا از ID Token Claims شناسایی کند، معمولاً از ‘sub’ Claim ، که قابل انتساب مجدد به کاربران دیگر نیست (در محدوده‌ی همان Identity Provider). | 2 | +| **10.5.3** | Client باید تلاش‌های یک Authorization Server مخرب برای جا زدن خود به‌جای یک Authorization Server دیگر از طریق متادیتای Authorization Server را رد می‌کند.کلاینت باید متادیتای Authorization Server را رد کند اگر مقدار issuer URL موجود در متادیتا دقیقاً با issuer URL از پیش پیکربندی‌شده و مورد انتظار کلاینت یکسان نباشد. | 2 | +| **10.5.4** | Client باید اعتبارسنجی کند ID Token برای استفاده توسط همان Client در نظر گرفته شده است (Audience)، با بررسی اینکه ‘aud’ Claim در توکن برابر با مقدار ‘client_id’ مربوط به Client باشد. | 2 | +| **10.5.5** | هنگام استفاده ازOIDC Back-Channel Logout، Relying Party از Denial of Service از طریق Forced Logout و Cross-JWT Confusion در جریان Logout باید جلوگیری کند. Client باید بررسی کند که Logout Token به درستی با مقدار typ آن برابر با logout+jwt باشد ، شامل ‘event’ Claim با نام عضو صحیح باشد و شامل ‘nonce’ Claim نباشد. همچنین توصیه می‌شود Expiration کوتاه باشد (مثلاً ۲ دقیقه). | 2 | + +## V10.6 OpenID Provider + +از آنجا که OpenID Providerها نقش Authorization Server در OAuth را نیز ایفا می‌کنند، الزامات بخش «OAuth Authorization Server» در اینجا نیز قابل اعمال هستند. + +توجه شود در صورتی که از ID Token Flow و نه Code Flow استفاده شود، Access Tokenای صادر نمی‌شود و در نتیجه بسیاری از الزامات مربوط به OAuth Authorization Server قابل اعمال نخواهند بود. + +| # | Description | Level | +| :---: | :--- | :---: | +| **10.6.1** | OpenID Provider باید فقط مقادیر 'code'، 'ciba'، 'id_token' یا 'id_token code' را برای Response Mode مجاز بداند. توجه داشته باشید که 'code' نسبت به 'id_token code' (که OIDC Hybrid Flow است) ترجیح داده می‌شود و 'token' (هر Implicit Flow) نباید استفاده شود. | 2 | +| **10.6.2** | OpenID Provider از Denial of Service از طریق Forced Logout جلوگیری کند. این کار با دریافت تأیید صریح از کاربر نهایی یا در صورت وجود، اعتبارسنجی پارامترها در Logout Request (که توسط Relying Party آغاز شده است)، مانند ‘id_token_hint’، انجام می‌شود. | 2 | + +## V10.7 Consent Management + +این الزامات، فرآیند تأیید رضایت (Consent) کاربر توسط Authorization Server را پوشش می‌دهند.در صورت نبودِ تأیید صحیح رضایت کاربر، یک مهاجم می‌تواند از طریق جعل (Spoofing) یا مهندسی اجتماعی (Social Engineering) به‌جای کاربر مجوزها (Permissions) را به دست آورد. + +| # | Description | Level | +| :---: | :--- | :---: | +| **10.7.1** | Authorization Server باید تضمین ‌کند کاربر برای هر درخواست مجوز (Authorization Request) رضایت خود را اعلام کرده است. در صورتی که هویت کلاینت قابل اطمینان نباشد، Authorization Server باید در همه موارد کاربر را به‌صورت صریح برای اعلام رضایت (Consent) راهنمایی و از او تأیید بگیرد. | 2 | +| **10.7.2** | زمانی که Authorization Server از کاربر درخواست رضایت (Consent) می‌کند باید اطلاعات کافی و شفافی درباره آنچه کاربر در حال تأیید آن است ارائه ‌دهد. در صورت لزوم، این اطلاعات باید شامل این موارد باشد: ماهیت مجوزهای درخواستی )معمولاً بر اساس scope، resource server و جزئیات مجوز در Rich Authorization Requests – RAR)، هویت برنامه یا اپلیکیشن دریافت‌کننده مجوز و مدت اعتبار این مجوزها. | 2 | +| **10.7.3** | کاربر باید بتواند رضایت‌هایی (Consents) را که از طریق Authorization Server صادر کرده است، مشاهده، ویرایش و لغو (Revoke) کند. | 2 | + +## References + +برای اطلاعات بیشتر دربارهٔ OAuth، لطفاً مشاهده کنید: + +* [oauth.net](https://oauth.net/) +* [OWASP OAuth 2.0 Protocol Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/OAuth2_Cheat_Sheet.html) + +برای الزامات مرتبط با OAuth در ASVS، از RFCهای منتشر شده و در وضعیت پیش‌نویس زیر استفاده می‌شود: + +* [RFC6749 The OAuth 2.0 Authorization Framework](https://datatracker.ietf.org/doc/html/rfc6749) +* [RFC6750 The OAuth 2.0 Authorization Framework: Bearer Token Usage](https://datatracker.ietf.org/doc/html/rfc6750) +* [RFC6819 OAuth 2.0 Threat Model and Security Considerations](https://datatracker.ietf.org/doc/html/rfc6819) +* [RFC7636 Proof Key for Code Exchange by OAuth Public Clients](https://datatracker.ietf.org/doc/html/rfc7636) +* [RFC7591 OAuth 2.0 Dynamic Client Registration Protocol](https://datatracker.ietf.org/doc/html/rfc7591) +* [RFC8628 OAuth 2.0 Device Authorization Grant](https://datatracker.ietf.org/doc/html/rfc8628) +* [RFC8707 Resource Indicators for OAuth 2.0](https://datatracker.ietf.org/doc/html/rfc8707) +* [RFC9068 JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens](https://datatracker.ietf.org/doc/html/rfc9068) +* [RFC9126 OAuth 2.0 Pushed Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9126) +* [RFC9207 OAuth 2.0 Authorization Server Issuer Identification](https://datatracker.ietf.org/doc/html/rfc9207) +* [RFC9396 OAuth 2.0 Rich Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9396) +* [RFC9449 OAuth 2.0 Demonstrating Proof of Possession (DPoP)](https://datatracker.ietf.org/doc/html/rfc9449) +* [RFC9700 Best Current Practice for OAuth 2.0 Security](https://datatracker.ietf.org/doc/html/rfc9700) +* [draft OAuth 2.0 for Browser-Based Applications](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-browser-based-apps) +* [draft The OAuth 2.1 Authorization Framework](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-12) + +برای اطلاعات بیشتر در مورد OpenID Connect، لطفاً به بخش زیر مراجعه کنید: + +* [OpenID Connect Core 1.0](https://openid.net/specs/openid-connect-core-1_0.html) +* [FAPI 2.0 Security Profile](https://openid.net/specs/fapi-security-profile-2_0-final.html) diff --git a/5.0/fa/0x20-V11-Cryptography.md b/5.0/fa/0x20-V11-Cryptography.md new file mode 100644 index 0000000000..587cada557 --- /dev/null +++ b/5.0/fa/0x20-V11-Cryptography.md @@ -0,0 +1,107 @@ +# V11 Cryptography + +## هدف + +هدف این فصل تعریف بهترین رویه‌ها برای استفاده عمومی از رمزنگاری است. همچنین به دنبال آن است که درک بنیادی از اصول رمزنگاری ایجاد کرده و تغییری به سمت رویکردهای مقاوم‌تر و مدرن‌تر را ترغیب کند. این فصل این موارد را تشویق(پیشنهاد) می‌کند: + +* پیاده‌سازی سیستم‌های رمزنگاری مقاوم که به‌طور ایمن دچار خطا شوند، با تهدیدات در حال تکامل سازگار شوند و آینده‌نگر باشند. +* به‌کارگیری سازوکارهای رمزنگاری که هم ایمن باشند و هم با بهترین رویه‌های صنعت همسو باشند. +* حفظ یک سیستم مدیریت کلیدهای رمزنگاری امن، همراه با کنترل‌های دسترسی مناسب و قابلیت ممیزی. +* ارزیابی منظم چشم‌انداز رمزنگاری به‌منظور شناسایی خطرات جدید و تطبیق الگوریتم‌ها بر اساس آن‌ها. +* کشف و مدیریت موارد استفاده‌ی رمزنگاری در طول چرخه‌ی عمر برنامه، به‌منظور اطمینان از ثبت و حفاظت تمامی دارایی‌های رمزنگاری. + +علاوه بر تشریح اصول عمومی و بهترین شیوه‌ها، این سند اطلاعات فنی عمیق‌تری درباره الزامات در پیوست C استانداردهای رمزنگاری ارائه می‌دهد. شامل الگوریتم‌ها و حالت‌هایی که برای اهداف الزامات این فصل «تأییدشده» محسوب می‌شوند. + +الزامات استفاده‌کننده از رمزنگاری برای حل مسائل دیگر، مانند مدیریت secrets یا امنیت ارتباطات ، در بخش‌های دیگر استاندارد بررسی خواهند شد. + +## V11.1 Cryptographic Inventory and Documentation + +برنامه‌ها باید با معماری رمزنگاری قدرتمند طراحی شوند تا از دارایی‌های داده مطابق با طبقه‌بندی آن‌ها محافظت شود. رمزگذاری همه‌چیز کاری پرهزینه و بیهوده است؛ در حالی‌که رمزگذاری نکردن هیچ‌چیز، از نظر قانونی سهل‌انگاری محسوب می‌شود. باید تعادلی برقرار شود، معمولاً در مرحله معماری یا طراحی سطح بالا، اسپرینت‌های طراحی یا آزمایش‌های معماری (architectural spikes). طراحی رمزنگاری به صورت لحظه‌ای یا اضافه کردن آن به سیستم پس از طراحی، به مراتب پرهزینه‌تر و دشوارتر از لحاظ امنیتی خواهد بود نسبت به حالتی که از ابتدا در طراحی لحاظ شده باشد. + +مهم است که اطمینان حاصل شود تمامی دارایی‌های رمزنگاری به‌طور منظم شناسایی، فهرست‌بندی و ارزیابی شوند. لطفاً برای کسب اطلاعات بیشتر درباره نحوه انجام این کار به پیوست مراجعه کنید. + +نیاز به آینده‌نگری در برابر ظهور اجتناب‌ناپذیر رایانش کوانتومی برای مقاوم‌سازی سیستم‌های رمزنگاری نیز حیاتی است. رمزنگاری پساکوانتومی (Post-Quantum Cryptography یا PQC) به الگوریتم‌های رمزنگاری‌ای اشاره دارد که برای مقاومت در برابر حملات رایانه‌های کوانتومی طراحی شده‌اند؛ رایانه‌هایی که انتظار می‌رود الگوریتم‌های پرکاربردی همچون RSA و رمزنگاری منحنی بیضوی (ECC) را بشکنند. + +لطفاً برای دریافت راهنمایی‌های کنونی درباره ابتداییات و استانداردهای تأییدشده در زمینه رمزنگاری پساکوانتومی (PQC)، به ضمیمه مراجعه کنید. + +| # | Description | Level | +| :---: | :--- | :---: | +| **11.1.1** | اطمینان حاصل کنید که یک سیاست مستند برای مدیریت کلیدهای رمزنگاری و چرخه‌عمر کلیدهای رمزنگاری وجود دارد که از یک استاندارد مدیریت کلید مانند NIST SP 800-57 پیروی می‌کند. این باید شامل اطمینان از این موضوع باشد که کلیدها بیش از حد به اشتراک گذاشته نشوند (برای مثال، در مورد Secrets مشترک با بیش از دو موجودیت و در مورد کلیدهای خصوصی با بیش از یک موجودیت). | 2 | +| **11.1.2** | فهرست اجزاء رمزنگاری باید تهیه و نگهداری ‌شود و به‌صورت منظم به‌روزرسانی گردد و شامل تمام کلیدهای رمزنگاری، الگوریتم‌ها و گواهی‌های دیجیتال مورد استفاده در برنامه باشد. این فهرست همچنین باید مشخص کند که کلیدها در کدام بخش‌های سیستم مجاز یا غیرمجاز به استفاده هستند و چه نوع داده‌هایی می‌توانند یا نمی‌توانند با این کلیدها محافظت شوند. | 2 | +| **11.1.3** | مکانیزم‌های کشف رمزنگاری برای شناسایی تمام موارد استفاده از رمزنگاری در سیستم باید استفاده ‌شود؛ از جمله رمزنگاری (encryption)، هش‌کردن (hashing) و عملیات امضای دیجیتال (signing). | 3 | +| **11.1.4** | فهرست اجزاء رمزنگاری باید تهیه ‌شود. این فهرست باید شامل یک برنامه مستند باشد که مسیر مهاجرت به استانداردهای جدید رمزنگاری (مانند رمزنگاری پساکوانتومی) را مشخص می‌کند تا امکان واکنش مناسب به تهدیدات آینده فراهم شود. | 3 | + +## V11.2 Secure Cryptography Implementation + +این بخش الزامات مربوط به انتخاب، پیاده‌سازی و مدیریت مستمر الگوریتم‌های اصلی رمزنگاری برای یک برنامه را تعریف می‌کند. هدف این است که تنها ابتداییات رمزنگاری (primitives) قدرتمند و مورد پذیرش صنعت، مطابق با استانداردهای فعلی (مانند NIST و ISO/IEC) و بهترین رویه‌ها به کار گرفته شوند. سازمان‌ها باید اطمینان حاصل کنند که هر جزء رمزنگاری بر اساس شواهد داوری‌شده توسط متخصصان (peer-reviewed) و آزمایش‌های عملی امنیتی انتخاب شده است. + +| # | Description | Level | +| :---: | :--- | :---: | +| **11.2.1** | برای عملیات رمزنگاری باید از پیاده‌سازی‌های مورد تأیید (شامل کتابخانه‌ها و پیاده‌سازی‌های سخت‌افزاری) استفاده شود. | 2 | +| **11.2.2** | برنامه با انعطاف‌پذیری رمزنگاری (crypto agility) باید طراحی شده باشد، به‌طوری که الگوریتم‌های تولید اعداد تصادفی، رمزنگاری احراز هویت‌شده، MAC یا هش، طول کلیدها، تعداد دورها، رمزها و حالت‌ها بتوانند در هر زمان مجدداً پیکربندی، ارتقاء یا تعویض شوند تا در برابر شکست‌های رمزنگاری محافظت شوند. به همین ترتیب، باید امکان جایگزینی کلیدها و رمزهای عبور و رمزگذاری مجدد داده‌ها نیز وجود داشته باشد. این امکان ارتقاء بدون وقفه به رمزنگاری پساکوانتومی (PQC) را فراهم می‌کند، زمانی که پیاده‌سازی‌های با اطمینان بالا از طرح‌ها یا استانداردهای تأییدشده PQC به‌طور گسترده در دسترس قرار گیرند. | 2 | +| **11.2.3** | تمام بدویات رمزنگاری (cryptographic primitives) بر اساس الگوریتم، اندازه کلید و پیکربندی، حداقل ۱۲۸ بیت سطح امنیتی را فراهم می‌کنند(2128)، برای مثال، یک کلید ECC با طول ۲۵۶ بیت تقریباً ۱۲۸ بیت امنیت ارائه می‌دهد، در حالی که برای رسیدن به همین سطح امنیت، الگوریتم RSA به کلید ۳۰۷۲ بیتی نیاز دارد. | 2 | +| **11.2.4** | تأیید کنید که تمامی عملیات رمزنگاری زمان ثابت (constant-time) باشند و هیچ عملیات «کوتاه‌شده» (short-circuit) در مقایسه‌ها، محاسبات یا بازگشت‌ها وجود نداشته باشد تا از نشت اطلاعات جلوگیری شود.( مهاجم می‌تواند از همین تفاوت‌های زمانی، از طریق Timing Side-Channel Attack، اطلاعات حساس را استخراج کند.) | 3 | +| **11.2.5** | تأیید کنید که تمامی ماژول‌های رمزنگاری به‌صورت امن دچار خطا (fail securely) شوند و خطاها به گونه‌ای مدیریت شوند که ایجاد آسیب‌پذیری‌هایی مانند حملات Padding Oracle را ممکن نکنند. | 3 | + +## V11.3 Encryption Algorithms + +الگوریتم‌های رمزنگاری احراز هویت‌شده (Authenticated Encryption) مبتنی بر AES و CHACHA20، زیربنای عملکردهای رمزنگاری مدرن را تشکیل می‌دهند. + +| # | Description | Level | +| :---: | :--- | :---: | +| **11.3.1** | از مد‌های بلاک ناامن (مانند ECB) و روش‌های Padding ضعیف (مانند PKCS#1 v1.5) نباید استفاده شود. | 1 | +| **11.3.2** | تنها رمزها و مد‌های تأییدشده، مانند AES با GCM باید استفاده شوند. | 1 | +| **11.3.3** | داده‌های رمزنگاری‌شده باید با استفاده از ترجیحاً یک روش رمزنگاری احراز هویت‌شده تأییدشده یا با ترکیب یک روش رمزنگاری تأییدشده با یک الگوریتم MAC تأییدشده در برابر تغییرات غیرمجاز محافظت شوند. | 2 | +| **11.3.4** | تأیید کنید که Nonceها، Initialization Vectorها و سایر اعداد یک‌بار مصرف برای بیش از یک جفت کلید رمزنگاری و عنصر داده استفاده نشوند. روش تولید آن‌ها باید متناسب با الگوریتم مورد استفاده باشد. | 3 | +| **11.3.5** | تأیید کنید که هر ترکیبی از یک الگوریتم رمزنگاری و یک الگوریتم MAC در حالت Encrypt-then-MAC عمل کند. | 3 | + +## V11.4 Hashing and Hash-based Functions + +توابع هش در انواع گسترده‌ای از پروتکل‌های رمزنگاری استفاده می‌شوند، مانند امضای دیجیتال، HMAC، توابع مشتق‌سازی کلید (KDF)، تولید بیت تصادفی و ذخیره‌سازی پسورد. امنیت سیستم رمزنگاری تنها به اندازه‌ی امنیت توابع هش پایه‌ای است که استفاده می‌شوند. این بخش الزامات استفاده از توابع هش امن در عملیات رمزنگاری را بیان می‌کند. + +برای ذخیره‌سازی رمزعبور، علاوه بر پیوست رمزنگاری، [OWASP Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#password-hashing-algorithms) نیز زمینه و راهنمایی مفیدی ارائه می‌دهد. + +| # | Description | Level | +| :---: | :--- | :---: | +| **11.4.1** | تأیید کنید که تنها توابع هش تأییدشده برای موارد استفاده عمومی رمزنگاری، از جمله امضاهای دیجیتال، HMAC، KDF و تولید بیت تصادفی استفاده شوند. توابع هش غیرمجاز، مانند MD5، نباید برای هیچ هدف رمزنگاری به‌کار گرفته شوند. | 1 | +| **11.4.2** | رمزعبورها با استفاده از یک تابع مشتق‌سازی کلید تأییدشده و پرهزینه محاسباتی (که به آن «تابع هش رمزعبور» نیز گفته می‌شود) ذخیره شوند، و تنظیمات پارامترها بر اساس راهنمایی‌های کنونی پیکربندی شده باشد. این تنظیمات باید تعادل بین امنیت و عملکرد برقرار کنند تا حملات Brute-force برای سطح امنیت مورد نیاز به‌طور کافی دشوار باشد. | 2 | +| **11.4.3** | توابع هش استفاده‌شده در امضاهای دیجیتال، باید به‌عنوان بخشی از احراز هویت داده یا یکپارچگی داده، در برابر collision مقاوم بوده و طول بیت مناسب داشته باشند. اگر مقاومت در برابر collision لازم باشد، طول خروجی باید حداقل 256 بیت باشد. اگر تنها مقاومت در برابر حملات Second Pre-image لازم باشد، طول خروجی باید حداقل 128 بیت باشد. | 2 | +| **11.4.4** | برنامه باید هنگام استخراج کلیدهای مخفی از پسوردها از توابع مشتق‌سازی کلید (KDF) تاییدشده با پارامترهای Key Stretching استفاده می‌کند. پارامترهای مورد استفاده باید تعادلی بین امنیت و عملکرد برقرار کنند تا از نفوذ حملات brute-force و به خطر افتادن کلید رمزنگاری تولیدشده جلوگیری شود. | 2 | + +## V11.5 Random Values + +تولید اعداد شبه‌تصادفی امن از نظر رمزنگاری (CSPRNG) بسیار دشوار است. به‌طور کلی، منابع خوب انتروپی در یک سیستم اگر بیش از حد استفاده شوند، سریعاً تخلیه می‌شوند، اما منابع با تصادفی‌بودن کمتر می‌توانند منجر به ایجاد کلیدها و secrets قابل پیش‌بینی شوند. + +| # | Description | Level | +| :---: | :--- | :---: | +| **11.5.1** | اعداد و رشته‌های تصادفی که قرار است قابل حدس نباشند، باید با استفاده از یک تولیدکننده اعداد شبه‌تصادفی امن رمزنگاری‌شده (CSPRNG) تولید شوند و حداقل 128 بیت انتروپی داشته باشند. توجه داشته باشید که UUIDها این شرط را رعایت نمی‌کنند. | 2 | +| **11.5.2** | مکانیزم تولید اعداد تصادفی مورد استفاده به‌گونه‌ای طراحی شده باشد که حتی تحت بار سنگین نیز به‌طور امن عمل کند. | 3 | + +## V11.6 Public Key Cryptography + +رمزنگاری کلید عمومی (Public Key Cryptography) زمانی استفاده می‌شود که امکان یا تمایل به اشتراک‌گذاری کلید مخفی (secret key) بین چندین طرف وجود نداشته باشد. + +به‌عنوان بخشی از این موضوع، نیاز به مکانیزم‌های تبادل کلید تأییدشده وجود دارد، مانند Diffie-Hellman و Elliptic Curve Diffie-Hellman (ECDH)، تا اطمینان حاصل شود که سیستم رمزنگاری در برابر تهدیدات مدرن امن باقی می‌ماند. فصل "ارتباط امن" الزامات مربوط به TLS را ارائه می‌دهد، بنابراین الزامات این بخش برای مواقعی در نظر گرفته شده است که رمزنگاری کلید عمومی در موارد استفاده‌ای به غیر از TLS به‌کار گرفته شود. + +| # | Description | Level | +| :---: | :--- | :---: | +| **11.6.1** | فقط الگوریتم‌های رمزنگاری و مدهای عملیاتی تأیید شده برای تولید کلید و مقداردهی اولیه، و همچنین برای تولید و تأیید امضاهای دیجیتال باید استفاده می‌شوند. الگوریتم‌های تولید کلید نباید کلیدهای ناامن تولید کنند که در برابر حملات شناخته شده آسیب‌پذیر باشند؛ به‌عنوان مثال، کلیدهای RSA که در برابر Fermat factorization آسیب‌پذیر هستند. | 2 | +| **11.6.2** | برای تبادل کلید از الگوریتم‌های رمزنگاری تأیید شده (مانند Diffie-Hellman) استفاده می‌شود و تمرکز بر این است که مکانیزم‌های تبادل کلید از پارامترهای امن بهره ببرند. این کار از حملات بر فرآیند برقراری کلید جلوگیری می‌کند و مانع حملات مرد میانی (MITM) یا شکست‌های رمزنگاری می‌شود. | 3 | + +## V11.7 In-Use Data Cryptography + +حفاظت از داده‌ها در حین پردازش اهمیت بالایی دارد. توصیه می‌شود از تکنیک‌هایی مانند رمزنگاری کامل حافظه، رمزنگاری داده‌ها در حال انتقال و اطمینان از رمزنگاری سریع داده‌ها پس از استفاده بهره گرفته شود. + +| # | Description | Level | +| :---: | :--- | :---: | +| **11.7.1** | رمزنگاری کامل حافظه (Full Memory Encryption) باید فعال باشد تا داده‌های حساس هنگام استفاده محافظت شوند و دسترسی کاربران یا فرآیندهای غیرمجاز به آن‌ها جلوگیری شود. | 3 | +| **11.7.2** | کاهش داده‌ها (data minimization) تضمین می‌کند که حداقل مقدار داده در حین پردازش افشا شود، و اطمینان حاصل شود که داده‌ها بلافاصله پس از استفاده یا در اولین فرصت ممکن رمزنگاری شوند. | 3 | + +## References + +برای اطلاعات بیشتر، همچنین به منابع زیر مراجعه کنید: + +* [OWASP Web Security Testing Guide: Testing for Weak Cryptography](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography) +* [OWASP Cryptographic Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html) +* [FIPS 140-3](https://csrc.nist.gov/pubs/fips/140-3/final) +* [NIST SP 800-57](https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final) diff --git a/5.0/fa/0x21-V12-Secure-Communication.md b/5.0/fa/0x21-V12-Secure-Communication.md new file mode 100644 index 0000000000..f993aa4231 --- /dev/null +++ b/5.0/fa/0x21-V12-Secure-Communication.md @@ -0,0 +1,57 @@ +# V12 Secure Communication + +## هدف + +این فصل شامل الزامات مربوط به مکانیزم‌های خاصی است که باید برای محافظت از داده‌ها در حین انتقال برقرار باشند، هم بین کلاینت کاربر نهایی و سرویس بک‌اند و هم بین سرویس‌های داخلی و بک‌اند. + +مفاهیم کلی که در این فصل ترویج می‌شوند عبارتند از: + +* اطمینان از اینکه ارتباطات به صورت خارجی رمزگذاری شده‌اند و در ایده‌آل حالت، به صورت داخلی نیز رمزگذاری شوند. +* پیکربندی مکانیزم‌های رمزگذاری با استفاده از آخرین دستورالعمل‌ها، شامل الگوریتم‌ها و رمزهای ترجیحی. +* استفاده از گواهی‌نامه‌های امضا شده برای اطمینان از اینکه ارتباطات توسط افراد غیرمجاز رهگیری نمی‌شوند. + +علاوه بر ارائه اصول کلی و بهترین شیوه‌ها، ASVS اطلاعات فنی عمیق‌تری درباره قدرت رمزنگاری نیز در ضمیمه C – استانداردهای رمزنگاری ارائه می‌دهد. + +## V12.1 General TLS Security Guidance + +این بخش راهنمایی اولیه در مورد نحوه‌ی ایمن‌سازی ارتباطات TLS را ارائه می‌دهد. ابزارهای به‌روز باید برای بازبینی پیکربندی TLS به‌صورت مستمر استفاده شوند. + +اگرچه استفاده از wildcard TLS ذاتاً ناامن نیست، اما در صورتی که یک گواهی که در تمامی محیط‌هایtest، development، staging و production به‌کار رفته است به خطر بیفتد، ممکن است وضعیت امنیتی تمامی برنامه‌های استفاده‌کننده از آن گواهی نیز دچار آسیب شود. در صورت امکان، باید از حفاظت مناسب، مدیریت صحیح و همچنین استفاده از گواهی‌های TLS مجزا در محیط‌های مختلف بهره گرفته شود. + +| # | Description | Level | +| :---: | :--- | :---: | +| **12.1.1** | جدیدترین نسخه‌های پیشنهادی پروتکل TLS فعال باشند، مانند TLS 1.2 و TLS 1.3 نسخه‌ی جدیدترین پروتکل TLS باید گزینه‌ی ترجیحی باشد. | 1 | +| **12.1.2** | تنها cipher suiteهای پیشنهادی فعال باشند و قوی‌ترین cipher suiteها به‌عنوان گزینه‌ی ترجیحی تنظیم شده باشند. برنامه‌های L3 باید تنها از cipher suiteهایی پشتیبانی کنند که Forward Secrecy را فراهم می‌کنند. | 2 | +| **12.1.3** | برنامه باید پیش از استفاده از هویت گواهی برای احراز هویت یا مجوزدهی، اعتبار و مورد اعتماد بودن گواهی‌های کلاینت در mTLS را بررسی و تأیید ‌کند. | 2 | +| **12.1.4** | لغو صحیح گواهی‌ها، مانند OCSP ، باید فعال و به‌درستی پیکربندی شده باشد. | 3 | +| **12.1.5** | Encrypted Client Hello (ECH) باید در تنظیمات TLS برنامه فعال باشد تا از افشای متادیتای حساس، مانند Server Name Indication (SNI)، در طول فرآیند Handshake TLS جلوگیری شود. | 3 | + +## V12.2 HTTPS Communication with External Facing Services + +تمام ترافیک HTTP به سمت سرویس‌های برون‌سازمانی (external-facing) که برنامه ارائه می‌دهد، به‌صورت رمزنگاری‌شده و با استفاده از گواهی‌های عمومیِ مورد اعتماد ارسال می‌شود. + +| # | Description | Level | +| :---: | :--- | :---: | +| **12.2.1** | برای تمام ارتباطات بین کلاینت و سرویس‌های مبتنی بر HTTP که در معرض دسترسی خارجی هستند، از TLS باید استفاده ‌شود و هیچ‌گونه بازگشت (fallback) به ارتباطات ناامن یا بدون رمزنگاری انجام نگیرد. | 1 | +| **12.2.2** | سرویس‌هایی که در معرض دسترسی خارجی قرار دارند از گواهی‌های TLS عمومی و مورد اعتماد استفاده می‌کنند. | 1 | + +## V12.3 General Service to Service Communication Security + +ارتباطات سرور (چه داخلی و چه خارجی) تنها شامل HTTP نمی‌باشد. ارتباطات به و از سایر سیستم‌ها نیز باید امن باشند، ترجیحاً با استفاده از TLS. + +| # | Description | Level | +| :---: | :--- | :---: | +| **12.3.1** | یک پروتکل رمزنگاری‌شده مانند TLS باید برای تمامی ارتباطات ورودی و خروجی به و از برنامه استفاده شود، از جمله سیستم‌های مانیتورینگ، ابزارهای مدیریت، دسترسی از راه دور و SSH، میان‌افزارها، پایگاه‌های داده، mainframes، سیستم‌های partner یا APIهای خارجی. سرور نباید به پروتکل‌های ناامن یا بدون رمزگذاری بازگردد. | 2 | +| **12.3.2** | کلاینت‌های TLS باید قبل از برقراری ارتباط با سرور TLS، گواهی‌های دریافتی را اعتبارسنجی کنند. | 2 | +| **12.3.3** | TLS یا دیگر مکانیزم‌های مناسب رمزگذاری انتقال باید برای تمامی ارتباطات بین سرویس‌های داخلی مبتنی بر HTTP درون برنامه استفاده شود و ارتباط به حالت‌های ناامن یا بدون رمزگذاری بازنگردد. | 2 | +| **12.3.4** | ارتباطات TLS بین سرویس‌های داخلی باید از گواهی‌های معتبر استفاده کنند. در صورتی که از گواهی‌های داخلی تولیدشده یا Self-Signed استفاده شود، سرویس مصرف‌کننده باید به‌گونه‌ای پیکربندی شود که تنها به CAهای داخلی مشخص و گواهی‌های Self-Signed خاص اعتماد کند. | 2 | +| **12.3.5** | سرویس‌هایی که درون یک سیستم با یکدیگر ارتباط دارند (ارتباطات درون‌سرویسی)، باید از احراز هویت قوی استفاده کنند تا هر نقطه انتهایی (endpoint) تأیید شود. روش‌های احراز هویت قوی، مانند احراز هویت کلاینت TLS، باید به‌کار گرفته شوند تا هویت تضمین شود (با استفاده از زیرساخت کلید عمومی (PKI) و مکانیزم‌هایی که در برابر حملات تکرار (replay attacks) مقاوم هستند). برای معماری‌های میکروسرویس، استفاده از سرویس مش برای ساده‌سازی مدیریت گواهی‌ها و افزایش امنیت در نظر گرفته شود | 3 | + +## References + +برای اطلاعات بیشتر، همچنین به منابع زیر مراجعه کنید: + +* [OWASP - Transport Layer Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html) +* [Mozilla's Server Side TLS configuration guide](https://wiki.mozilla.org/Security/Server_Side_TLS) +* [Mozilla's tool to generate known good TLS configurations](https://ssl-config.mozilla.org/). +* [O-Saft - OWASP Project to validate TLS configuration](https://owasp.org/www-project-o-saft/) diff --git a/5.0/fa/0x22-V13-Configuration.md b/5.0/fa/0x22-V13-Configuration.md new file mode 100644 index 0000000000..d8003e5aaf --- /dev/null +++ b/5.0/fa/0x22-V13-Configuration.md @@ -0,0 +1,68 @@ +# V13 Configuration + +## هدف + +پیکربندی پیش‌فرض برنامه برای استفاده در اینترنت باید امن باشد. + +این فصل راهنمایی‌هایی در مورد پیکربندی‌های مختلف لازم برای دستیابی به این هدف را ارائه می‌دهد، از جمله پیکربندی‌هایی که در طول توسعه، ساخت و استقرار اعمال می‌شوند. + +موضوعات پوشش داده‌شده شامل جلوگیری از نشت داده‌ها، مدیریت امن ارتباط بین اجزا و حفاظت از secrets است. + +## V13.1 Configuration Documentation + +این بخش الزامات مستندسازی را برای نحوه‌ی ارتباط برنامه با سرویس‌های داخلی و خارجی، و همچنین تکنیک‌هایی برای جلوگیری از کاهش دسترسی به دلیل عدم دسترسی به سرویس ارائه می‌دهد. همچنین به مستندسازی مرتبط با secrets نیز پرداخته می‌شود. + +| # | Description | Level | +| :---: | :--- | :---: | +| **13.1.1** | تمامی نیازهای ارتباطی برنامه باید به‌طور کامل مستندسازی شده باشند. این مستندسازی شامل سرویس‌های خارجی که برنامه به آن‌ها وابسته است و همچنین مواردی که کاربر نهایی جهت اتصال به سرویس خارجی مشخص می‌کند باید باشد. | 2 | +| **13.1.2** | برای هر سرویسی که برنامه استفاده می‌کند، مستندسازی باید شامل حداکثر تعداد ارتباطات همزمان (مثلاً محدودیت‌های Connection Pool) و نحوه‌ی رفتار برنامه هنگام رسیدن به این حد باشد، از جمله هر مکانیزم بازیابی یا جایگزین، تا از بروز شرایط Denial of Service جلوگیری شود. | 3 | +| **13.1.3** | مستندات برنامه باید استراتژی‌های مدیریت منابع را برای هر سیستم یا سرویس خارجی که استفاده می‌کند مشخص کرده باشد (مثلاً پایگاه‌های داده، هندل‌های فایل، رشته‌ها، اتصالات HTTP) این مستندسازی باید شامل این موارد باشد :رویه‌های آزادسازی منابع، تنظیمات تایم‌اوت، مدیریت خطاها، جایی که منطق Retry اعمال می‌شود، شامل محدودیت تعداد Retry، تأخیرها و الگوریتم‌هایBack-off. برای عملیات همزمان درخواست–پاسخ HTTP (Synchronous)، مستندات باید تایم‌اوت کوتاه را الزام کند و یا Retryها را غیرفعال کند یا به‌طور سختگیرانه محدود کند تا از تاخیرهای زنجیره‌ای و هدررفت منابع جلوگیری شود. | 3 | +| **13.1.4** | مستندسازی برنامه باید شامل secretهای حیاتی برای امنیت برنامه و همچنین برنامه‌ای برای چرخش آن‌ها باشد( بر اساس مدل تهدید سازمان و نیازهای کسب‌وکار). | 3 | + +## V13.2 Backend Communication Configuration + +برنامه‌ها با چندین سرویس از جمله APIها، پایگاه‌های داده یا سایر اجزا تعامل دارند. این سرویس‌ها ممکن است نسبت به برنامه اجزای داخلی محسوب شوند اما در مکانیزم‌های کنترل دسترسی استاندارد برنامه گنجانده نشده باشند، یا کاملاً خارجی باشند. در هر صورت، لازم است برنامه برای تعامل امن با این اجزا پیکربندی شود و در صورت نیاز، این پیکربندی نیز محافظت گردد. + +توجه: فصل "Secure Communication" راهنمایی‌هایی برای رمزگذاری در حین انتقال را ارائه می‌دهد. + +| # | Description | Level | +| :---: | :--- | :---: | +| **13.2.1** | رتباطات بین اجزای بک‌اند برنامه که از مکانیزم استاندارد نشست کاربران برنامه پشتیبانی نمی‌کنند، از جمله APIها، میان‌افزارها و لایه‌های داده، باید احراز هویت شده باشند. احراز هویت باید با استفاده از حساب‌های سرویس جداگانه، توکن‌های کوتاه‌مدت یا احراز هویت مبتنی بر گواهی انجام شود و نباید از اعتبارنامه‌های ثابت مانند رمز عبور، کلیدهای API یا حساب‌های مشترک با دسترسی‌های سطح بالا استفاده شود. | 2 | +| **13.2.2** | ارتباطات بین اجزای بک‌اند، از جمله سرویس‌های محلی یا سیستم‌عامل، APIها، میان‌افزارها و لایه‌های داده، با حساب‌هایی باید انجام شود که کمترین سطح دسترسی لازم را دارند. | 2 | +| **13.2.3** | اگر اعتبارنامه‌ای برای احراز هویت سرویس استفاده می‌شود، اعتبارنامه‌ای که توسط مصرف‌کننده استفاده می‌شود، اعتبارنامه پیش‌فرض نباشد (مثلاً root/root یا admin/admin). | 2 | +| **13.2.4** | یک allowlist برای تعیین منابع یا سیستم‌های خارجی که برنامه مجاز به ارتباط با آن‌ها است باید وجود داشته باشد (مثلاً برای درخواست‌های خروجی، بارگذاری داده یا دسترسی به فایل). این allowlist می‌تواند در لایه برنامه، وب‌سرور، فایروال یا ترکیبی از لایه‌های مختلف پیاده‌سازی شود. | 2 | +| **13.2.5** | وب‌سرور یا سرور برنامه با یک allowlist از منابع یا سیستم‌هایی که سرور می‌تواند به آن‌ها درخواست ارسال کند یا داده‌ها و فایل‌ها را بارگذاری کند پیکربندی شده باشد. | 2 | +| **13.2.6** | در مواقعی که برنامه به سرویس‌های جداگانه متصل می‌شود، پیکربندی مستندسازی‌شده برای هر اتصال رعایت شود، از جمله حداکثر ارتباطات همزمان، رفتار هنگام رسیدن به حداکثر ارتباط مجاز، زمان‌های Timeout اتصال و استراتژی‌های Retry. | 3 | + +## V13.3 Secret Management + +مدیریت secret یک وظیفه پیکربندی حیاتی است تا از حفاظت داده‌های مورد استفاده در برنامه اطمینان حاصل شود. الزامات خاص مربوط به رمزنگاری در فصل "Cryptography" قابل دسترسی است، اما این بخش بر مدیریت و نحوه‌ی برخورد با secret تمرکز دارد. + +| # | Description | Level | +| :---: | :--- | :---: | +| **13.3.1** | یک راهکار مدیریت secret، مانند Key Vault، برای ایجاد امن، ذخیره، کنترل دسترسی و از بین بردن secret بک‌اند استفاده شود. این secret می‌تواند شامل رمزعبورها، داده‌های رمز نگاری، اطلاعات حساس مربوط به اتصال به پایگاه داده و سیستم‌های شخص ثالث، کلیدها و seedهای توکن‌های زمان‌محور، سایر secretهای داخلی و کلیدهای API باشد. Secret نباید در کد منبع برنامه یا در build artifacts قرار گیرد. برای برنامه‌های L3، این باید شامل راهکاری مبتنی بر سخت‌افزار مانند HSM باشد. | 2 | +| **13.3.2** | دسترسی به دارایی‌های secret بر اساس اصل حداقل دسترسی (Least Privilege) رعایت شود. | 2 | +| **13.3.3** | تمام عملیات رمزنگاری باید با استفاده از یک ماژول امنیتی ایزوله (مانند Vault یا Hardware Security Module) انجام شود تا مواد کلیدی به‌طور امن مدیریت و محافظت شده و از افشای خارج از ماژول امنیتی جلوگیری شود. | 3 | +| **13.3.4** | secretها بر اساس مستندسازی برنامه طوری پیکربندی شوند که منقضی شده و چرخش داده شوند. | 3 | + +## V13.4 Unintended Information Leakage + +پیکربندی‌های production باید به‌گونه‌ای امن شوند که از افشای داده‌های غیرضروری جلوگیری شود. بسیاری از این مسائل به ندرت به‌عنوان ریسک‌های مهم ارزیابی می‌شوند، اما اغلب با سایر آسیب‌پذیری‌ها زنجیره‌ای می‌شوند. اگر این مسائل به‌صورت پیش‌فرض وجود نداشته باشند، سطح دشواری حمله به برنامه افزایش می‌یابد. + +به‌عنوان مثال، مخفی کردن نسخه‌ی اجزای سرور باعث حذف نیاز به به‌روزرسانی تمام اجزا نمی‌شود، و غیرفعال کردن نمایش فهرست پوشه‌ها نیاز به استفاده از کنترل‌های دسترسی یا نگهداری فایل‌ها دور از پوشه عمومی را از بین نمی‌برد، اما سطح دشواری حمله را افزایش می‌دهد. + +| # | Description | Level | +| :---: | :--- | :---: | +| **13.4.1** | برنامه باید به‌گونه‌ای مستقر شود که هیچ‌گونه متادیتای کنترل نسخه، از جمله پوشه‌های .git یا .svn، در دسترس نباشد یا به شکلی باشد که این پوشه‌ها نه از بیرون و نه توسط خود برنامه قابل دسترسی نباشند. | 1 | +| **13.4.2** | حالت‌های Debug برای تمام اجزا در محیط‌های production باید غیرفعال شده باشند تا از افشای قابلیت‌های دیباگ و نشت اطلاعات جلوگیری شود. | 2 | +| **13.4.3** | وب‌سرورها فهرست‌بندی دایرکتوری‌ها را به کاربر نهایی نباید نمایش دهند مگر اینکه به‌طور صریح مورد نظر باشد. | 2 | +| **13.4.4** | از متد HTTP TRACE در محیط‌های production نباید پشتیبانی شود تا از احتمال نشت اطلاعات جلوگیری شود. | 2 | +| **13.4.5** | مستندسازی‌ها (مانند مستندات APIهای داخلی) و نقاط پایش (Monitoring Endpoints) در دسترس نباشند مگر اینکه به‌طور صریح مورد نظر باشد. | 2 | +| **13.4.6** | تأیید کنید که برنامه اطلاعات نسخه دقیق اجزای backend را افشا نکند. | 3 | +| **13.4.7** | لایه وب باید به‌گونه‌ای پیکربندی شده باشد که فقط فایل‌هایی با پسوندهای مشخص را سرو کند تا از افشای تصادفی اطلاعات، پیکربندی و کد منبع جلوگیری شود. | 3 | + +## References + +برای اطلاعات بیشتر، همچنین به منابع زیر مراجعه کنید: + +* [OWASP Web Security Testing Guide: Configuration and Deployment Management Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing) diff --git a/5.0/fa/0x23-V14-Data-Protection.md b/5.0/fa/0x23-V14-Data-Protection.md new file mode 100644 index 0000000000..a37c3ca0b7 --- /dev/null +++ b/5.0/fa/0x23-V14-Data-Protection.md @@ -0,0 +1,60 @@ +# V14 Data Protection + +## هدف + +برنامه‌ها نمی‌توانند تمام الگوهای استفاده و رفتارهای کاربران را پیش‌بینی کنند، بنابراین باید کنترل‌هایی را پیاده‌سازی کنند تا از دسترسی غیرمجاز به داده‌های حساس روی دستگاه‌های کاربر جلوگیری شود. + +این فصل شامل الزاماتی است که چه داده‌هایی باید محافظت شوند، چگونه باید محافظت شوند، و همچنین مکانیزم‌های خاصی که باید پیاده‌سازی شوند یا اشتباهاتی که باید از آن‌ها اجتناب شود. + +یکی دیگر از مواردی که باید در حفاظت از داده‌ها در نظر گرفت، استخراج عمده، تغییر یا استفاده بیش از حد از داده‌ها است. الزامات هر سیستم احتمالاً بسیار متفاوت خواهند بود، بنابراین تعیین اینکه چه چیزی «غیرعادی» محسوب می‌شود باید بر اساس مدل تهدید و ریسک کسب‌وکار انجام گیرد. از دیدگاه ASVS، شناسایی این مسائل در فصل «Security Logging and Error Handling» بررسی می‌شود و تعیین محدودیت‌ها در فصل «Validation and Business Logic» مطرح شده است. + +## V14.1 Data Protection Documentation + +یکی از پیش‌نیازهای اصلی برای حفاظت از داده‌ها، دسته‌بندی داده‌هایی است که باید به‌عنوان داده حساس در نظر گرفته شوند. به‌احتمال زیاد چند سطح متفاوت از حساسیت وجود خواهد داشت و برای هر سطح، کنترل‌های لازم جهت حفاظت از داده‌ها متفاوت خواهد بود. + +مقررات و قوانین مختلفی در حوزه حریم خصوصی وجود دارند که بر نحوه ذخیره‌سازی، استفاده و انتقال داده‌های شخصی حساس توسط برنامه‌ها تأثیر می‌گذارند. این بخش دیگر تلاشی برای تکرار چنین قوانین یا مقرراتی در زمینه حفاظت از داده یا حریم خصوصی نمی‌کند، بلکه تمرکز آن بر ملاحظات فنی کلیدی برای حفاظت از داده‌های حساس است. لطفاً قوانین و مقررات محلی را بررسی کرده و در صورت نیاز با یک متخصص حریم خصوصی یا وکیل واجد شرایط مشورت کنید. + +| # | Description | Level | +| :---: | :--- | :---: | +| **14.1.1** | تمامی داده‌های حساس ایجادشده و پردازش‌شده توسط برنامه باید شناسایی شده و بر اساس سطوح حفاظتی طبقه‌بندی شده‌اند. این موضوع شامل داده‌هایی می‌شود که صرفاً کُدگذاری شده‌اند و به‌راحتی قابل بازیابی هستند، مانند رشته‌های Base64 یا محتوای متنی (plaintext) داخل یک JWT. سطوح حفاظتی باید الزامات قوانین و استانداردهای حفاظت از داده و حریم خصوصی که برنامه ملزم به رعایت آن‌هاست را در نظر بگیرند. | 2 | +| **14.1.2** | برای تمامی سطوح حفاظت از داده‌های حساس، مجموعه‌ای مستند از الزامات حفاظتی تعریف شده باشد. این الزامات باید شامل (اما محدود به آن نباشد) موارد زیر باشند: الزامات مرتبط با رمزنگاری کلی، بررسی صحت و یکپارچگی، دوره‌های نگهداری داده، نحوه ثبت داده‌ها در لاگ، کنترل‌های دسترسی به داده‌های حساس در لاگ‌ها، رمزنگاری در سطح پایگاه داده، الزامات مربوط به حریم خصوصی و فناوری‌های تقویت‌کننده حریم خصوصی مورد استفاده، و سایر الزامات مرتبط با محرمانگی. | 2 | + +## V14.2 General Data Protection + +این بخش شامل مجموعه‌ای از الزامات عملی برای حفاظت از داده‌ها می‌باشد. بیشتر این الزامات به مسائل خاصی مانند نشت ناخواسته داده‌ها مربوط می‌شوند، اما یک الزام کلی نیز وجود دارد که بر پیاده‌سازی کنترل‌های حفاظتی بر اساس سطح حفاظت موردنیاز برای هر داده تأکید دارد. + +| # | Description | Level | +| :---: | :--- | :---: | +| **14.2.1** | داده‌های حساس باید فقط در بدنه پیام HTTP یا فیلدهای هدر به سرور ارسال شوند، و اینکه URL و query string شامل اطلاعات حساس (مانند API key یا session token) نباشند. | 1 | +| **14.2.2** | برنامه باید از cache شدن داده‌های حساس در اجزای سرور مانند Load Balancer و Application Cache جلوگیری کند، یا اطمینان حاصل شود که داده‌ها پس از استفاده به‌طور ایمن پاک‌سازی می‌شوند. | 2 | +| **14.2.3** | داده‌های حساس تعریف‌شده به طرف‌های غیرقابل اعتماد (مانند User Trackers) نباید ارسال شوند تا از جمع‌آوری ناخواسته داده‌ها خارج از کنترل برنامه جلوگیری شود. | 2 | +| **14.2.4** | کنترل‌های مرتبط با داده‌های حساس شامل رمزنگاری، بررسی صحت و یکپارچگی، نگهداری، نحوه ثبت داده‌ها در لاگ، کنترل‌های دسترسی به داده‌های حساس در لاگ‌ها، حریم خصوصی و فناوری‌های مربوط به حریم خصوصی، مطابق با آنچه در مستندات برای سطح حفاظت مشخص هر داده تعریف شده است، پیاده‌سازی شوند. | 2 | +| **14.2.5** | مکانیزم‌های cache باید طوری پیکربندی شده باشند که تنها پاسخ‌هایی با نوع محتوای مورد انتظار برای آن منبع cache شوند و شامل محتوای حساس یا پویا نباشند. وب‌سرور باید هنگام دسترسی به فایل ناموجود، پاسخ 404 یا 302 برگرداند و نه فایل معتبر دیگر، تا از حملات Web Cache Deception جلوگیری شود. | 3 | +| **14.2.6** | برنامه باید تنها حداقل داده‌های حساس مورد نیاز برای عملکرد برنامه را بازگرداند. برای مثال، تنها برخی از ارقام شماره کارت اعتباری بازگردانده شود و نه شماره کامل. در صورتی که داده کامل لازم باشد، باید در رابط کاربری masked شود مگر اینکه کاربر به‌طور مشخص آن را مشاهده کند. | 3 | +| **14.2.7** | اطلاعات حساس باید تحت طبقه‌بندی دوره‌ای نگهداری داده قرار گرفته باشند، به‌گونه‌ای که داده‌های قدیمی یا غیرضروری به‌طور خودکار، در یک برنامه زمان‌بندی‌شده مشخص، یا براساس نیاز حذف شوند. | 3 | +| **14.2.8** | اطلاعات حساس باید از متادیتای فایل‌های ارسال‌شده توسط کاربر حذف شود، مگر اینکه ذخیره‌سازی آن با رضایت کاربر انجام شود. | 3 | + +## V14.3 Client-side Data Protection + +این بخش شامل الزامات جلوگیری از نشت داده‌ها به روش‌های خاص در سمت کلاینت یا سمت User Agent برنامه است. + +| # | Description | Level | +| :---: | :--- | :---: | +| **14.3.1** | داده‌های احراز هویت‌شده از حافظه کلاینت، مانند DOM مرورگر، پس از خروج کلاینت یا Session پاک شوند. فیلد هدر Clear-Site-Data در پاسخ سرور می‌تواند در این زمینه مفید باشد، اما کلاینت باید بتواند داده‌ها را حتی زمانی که اتصال به سرور در دسترس نیست در زمان پایان Session (خروج از آن) پاک کند. | 1 | +| **14.3.2** | برنامه باید هدرهای پاسخ HTTP، anti-cach مناسب (مانند Cache-Control: no-store) را تنظیم کند تا داده‌های حساس در مرورگرها cache نشوند. | 2 | +| **14.3.3** | برای اطلاعات بیشتر، همچنین به منابع زیر مراجعه کنید: | 2 | + +## References + +For more information, see also: + +* [Consider using the Security Headers website to check security and anti-caching header fields](https://securityheaders.com/) +* [Documentation about anti-caching headers by Mozilla](https://developer.mozilla.org/en-US/docs/Web/HTTP/Caching) +* [OWASP Secure Headers project](https://owasp.org/www-project-secure-headers/) +* [OWASP Privacy Risks Project](https://owasp.org/www-project-top-10-privacy-risks/) +* [OWASP User Privacy Protection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/User_Privacy_Protection_Cheat_Sheet.html) +* [Australian Privacy Principle 11 - Security of personal information](https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-11-app-11-security-of-personal-information) +* [European Union General Data Protection Regulation (GDPR) overview](https://www.edps.europa.eu/data-protection_en) +* [European Union Data Protection Supervisor - Internet Privacy Engineering Network](https://www.edps.europa.eu/data-protection/ipen-internet-privacy-engineering-network_en) +* [Information on the "Clear-Site-Data" header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Clear-Site-Data) +* [White paper on Web Cache Deception](https://www.blackhat.com/docs/us-17/wednesday/us-17-Gil-Web-Cache-Deception-Attack-wp.pdf) diff --git a/5.0/fa/0x24-V15-Secure-Coding-and-Architecture.md b/5.0/fa/0x24-V15-Secure-Coding-and-Architecture.md new file mode 100644 index 0000000000..8696a2fc6d --- /dev/null +++ b/5.0/fa/0x24-V15-Secure-Coding-and-Architecture.md @@ -0,0 +1,77 @@ +# V15 Secure Coding and Architecture + +## Control Objective + +بسیاری از الزامات ASVS یا به یک حوزه خاص امنیتی مانند احراز هویت یا مجوزدهی و یا به یک نوع خاص از کارکردهای نرم‌افزار مانند ثبت رخدادها یا مدیریت فایل مرتبط می‌باشند. + +این فصل الزامات کلی امنیتی که باید هنگام طراحی و توسعه نرم‌افزارها در نظر گرفته شوند را ارائه می‌دهد. این الزامات نه تنها بر معماری تمیز و کیفیت کد تمرکز دارند، بلکه شامل شیوه‌های خاص معماری و کدنویسی نیز می‌شوند که برای امنیت نرم‌افزار ضروری هستند. + +## V15.1 Secure Coding and Architecture Documentation + +بسیاری از الزامات مربوط به ایجاد یک معماری امن و قابل دفاع، به مستندسازی شفاف تصمیماتی بستگی دارند که در مورد پیاده‌سازی کنترل‌های امنیتی مشخص و مؤلفه‌های استفاده‌شده در نرم‌افزار اتخاذ می‌شوند. + +این بخش، الزامات مستندسازی را شرح می‌دهد، از جمله شناسایی مؤلفه‌هایی که دارای «عملکرد خطرناک» در نظر گرفته می‌شوند یا به عنوان «مؤلفه‌های پرریسک» شناخته می‌شوند. + +یک مؤلفه با «عملکرد خطرناک» ممکن است یک مؤلفه توسعه‌یافته داخلی یا شخص ثالث باشد که عملیات‌هایی مانند deserialization داده‌های غیرقابل‌اعتماد، پردازش داده‌های خام یا باینری، اجرای کد به‌صورت پویا، یا دستکاری مستقیم حافظه را انجام می‌دهد. آسیب‌پذیری‌ها در این نوع عملیات‌ها ریسک بالایی برای به خطر انداختن برنامه و احتمالاً افشای زیرساخت زیربنایی آن ایجاد می‌کنند. + +یک «مؤلفه پرریسک» یک کتابخانه شخص ثالث است (یعنی توسعه‌یافته داخلی نیست) که کنترل‌های امنیتی در فرآیند توسعه یا عملکرد آن وجود ندارد یا ضعیف پیاده‌سازی شده‌اند. نمونه‌ها شامل مؤلفه‌هایی هستند که به‌خوبی نگهداری نمی‌شوند، پشتیبانی نمی‌شوند، در مرحله end-of-life قرار دارند، یا سابقه‌ای از آسیب‌پذیری‌های جدی دارند. + +این بخش همچنین بر اهمیت تعیین بازه‌های زمانی مناسب برای رسیدگی به آسیب‌پذیری‌ها در مؤلفه‌های شخص ثالث تأکید می‌کند. + +| # | Description | Level | +| :---: | :--- | :---: | +| **15.1.1** | مستندات برنامه باید بازه‌های زمانی جهت برطرف سازی آسیب‌پذیری‌ نسخه‌های مؤلفه‌ شخص ثالث (بر اساس ریسک) و همچنین به‌روزرسانی کتابخانه‌ها را به طور کلی تعریف کرده باشد تا ریسک ناشی از این مؤلفه‌ها به حداقل برسد. | 1 | +| **15.1.2** | یک کاتالوگ دارایی مانند Software Bill of Materials (SBOM) باید برای تمامی کتابخانه‌های شخص ثالث مورد استفاده نگهداری شود. شامل تایید این که مؤلفه‌ها از مخازن از پیش تعیین‌شده، قابل اعتماد و به‌طور مستمر نگهداری‌شده تهیه شده‌اند. | 2 | +| **15.1.3** | مستندات برنامه باید شامل عملکردهایی که زمان‌بر یا پرمصرف(منابع سیستمی) هستند نیز باشد. این مورد باید شامل روش‌هایی برای جلوگیری از دست‌رفتن دسترس‌پذیری به دلیل استفاده بیش از حد از این عملکردها و همچنین جلوگیری از وضعیتی باشد که پردازش یک پاسخ طولانی‌تر از زمان انتظار مصرف‌کننده شود. تدابیر احتمالی می‌تواند شامل پردازش غیرهمزمان، استفاده از صف‌ها و محدود کردن فرآیندهای موازی برای هر کاربر و هر برنامه باشد. | 2 | +| **15.1.4** | مستندات برنامه باید کتابخانه‌های شخص ثالثی را که به‌عنوان «کامپوننت‌های پرخطر» شناخته می‌شوند، مشخص کرده باشد. | 3 | +| **15.1.5** | مستندات برنامه باید بخش‌هایی از برنامه را که به‌عنوان «عملکرد خطرناک» استفاده می‌شود، مشخص کرده باشد. | 3 | + +## V15.2 Security Architecture and Dependencies + +این بخش شامل الزامات مربوط به مدیریت وابستگی‌ها و کامپوننت‌ها می‌باشد تا اجزای پرخطر، قدیمی یا ناامن به‌طور مؤثر شناسایی، کنترل و اداره شوند. + +همچنین شامل استفاده از تکنیک‌های سطح معماری مانند sandboxing، encapsulation، containerization و ایزوله‌سازی شبکه می‌باشد تا تأثیر استفاده از «عملیات خطرناک» (Dangerous operations) یا «کامپوننت‌های پرخطر» (dangerous operations) (همان‌طور که در بخش قبلی تعریف شد) کاهش یابد و از کاهش دسترسی به دلیل استفاده بیش از حد از عملکردهای پرمصرف منابع جلوگیری شود. + +| # | Description | Level | +| :---: | :--- | :---: | +| **15.2.1** | برنامه باید تنها شامل کامپوننت‌هایی باشد که چارچوب‌های زمانی مستند‌شده برای به‌روزرسانی و رفع آسیب‌پذیری‌ها را نقض نکرده‌باشند. | 1 | +| **15.2.2** | برنامه باید بر اساس تصمیمات و استراتژی‌های امنیتی مستندسازی‌شده، تدابیری برای جلوگیری از کاهش دسترس‌پذیری ناشی از عملکردهایی که زمان‌بر یا پرمصرف منابع هستند، پیاده‌سازی کرده باشد. | 2 | +| **15.2.3** | محیط production تنها شامل عملکردهایی می‌باشد که برای اجرای برنامه ضروری هستند و هیچ قابلیت اضافی مانند کدهای تست، نمونه‌کدها و عملکردهای توسعه‌ای در دسترس نمی‌باشد. | 2 | +| **15.2.4** | کامپوننت‌های شخص ثالث و تمام وابستگی‌های انتقالی آن‌ها از مخزن مورد انتظار باید دریافت ‌شوند، چه داخلی و چه منبع خارجی، و ریسک حمله‌ی dependency confusion مدیریت شود. | 3 | +| **15.2.5** | برنامه باید محافظت‌های اضافی را در بخش‌هایی از برنامه که به‌عنوان «عملکرد خطرناک» مستند شده‌اند یا از کتابخانه‌های شخص ثالثی که به‌عنوان «کامپوننت‌های پرریسک» شناخته می‌شوند، پیاده‌سازی می‌کند. این می‌تواند شامل تکنیک‌هایی مانند sandboxing، encapsulation، containerization یا جداسازی در سطح شبکه باشد تا حمله‌کنندگان پس از نفوذ به یک بخش از برنامه، نتوانند به بخش‌های دیگر برنامه منتقل شوند و زمان لازم برای پیشروی آن‌ها افزایش یابد. | 3 | + +## V15.3 Defensive Coding + +این بخش انواع آسیب‌پذیری‌ها را پوشش می‌دهد، از جمله type juggling، prototype pollution و سایر مواردی که ناشی استفاده از الگوهای ناامن برنامه‌نویسی در یک زبان خاص هستند. برخی از این آسیب‌پذیری‌ها ممکن است برای همه زبان‌ها مرتبط نباشند، در حالی که برخی دیگر راه‌حل‌های خاص زبان دارند یا به نحوه مدیریت ویژگی‌هایی مانند پارامترهای HTTP توسط یک زبان یا فریم‌ورک خاص مربوط می‌شوند. همچنین، این بخش به خطر عدم اعتبارسنجی )رمزنگاری شده( به‌روزرسانی‌های برنامه نیز می‌پردازد. + +این بخش همچنین خطرات مرتبط با استفاده از Objects برای نمایش داده‌ها و پذیرش و بازگرداندن آن‌ها از طریق APIهای خارجی را مورد بررسی قرار می‌دهد. در این حالت، برنامه باید اطمینان حاصل کند که فیلدهای داده‌ای که نباید قابل ویرایش باشند توسط ورودی کاربر تغییر نمی‌کنند (mass assignment) و API به‌صورت انتخابی مشخص کند که کدام فیلدهای داده بازگردانده شوند. هر جایی که دسترسی به فیلدها به مجوزهای کاربر وابسته باشد، این موضوع باید در چارچوب الزامات کنترل دسترسی در سطح فیلدها در فصل Authorization در نظر گرفته شود. + +| # | Description | Level | +| :---: | :--- | :---: | +| **15.3.1** | برنامه باید تنها زیرمجموعه‌ای از فیلدهای مورد نیاز از یک data object را بازگرداند. به‌عنوان مثال، نباید کل data object بازگردانده شود، زیرا برخی فیلدهای منفرد نباید برای کاربران قابل دسترسی باشند. | 1 | +| **15.3.2** | در جایی که بک‌اند برنامه به URLهای خارجی فراخوانی می‌فرستد، طوری باید پیکربندی شده باشد که تنها در صورت نیاز و منظور مشخص، از تغییر مسیرها (redirects) پیروی کند. | 2 | +| **15.3.3** | برنامه باید دارای تدابیر مقابله‌ای برای محافظت در برابر حملات mass assignment باشد، به‌طوری که فیلدهای مجاز برای هر کنترلر و اکشن محدود شده باشند؛ به عنوان مثال، نباید بتوان مقداری برای فیلدی وارد یا به‌روزرسانی کرد که قرار نبوده بخشی از آن اکشن باشد. | 2 | +| **15.3.4** | تمام اجزای proxying و middleware باید آدرس IP اصلی کاربر را به‌درستی منتقل کنند، با استفاده از فیلدهای داده معتبر که توسط کاربر نهایی قابل دستکاری نباشند، و برنامه و وب‌سرور از این مقدار صحیح برای ثبت لاگ و تصمیم‌گیری‌های امنیتی مانند rate limiting استفاده کنند، با در نظر گرفتن اینکه حتی آدرس IP اصلی ممکن است به دلیل IPهای پویا، VPNها یا فایروال‌های سازمانی قابل اعتماد نباشد. | 2 | +| **15.3.5** | برنامه باید به‌طور صریح اطمینان حاصل کند که variables از نوع صحیح هستند و عملیات‌های مقایسه و comparator به‌صورت دقیق (strict) انجام می‌شوند. این اقدام برای جلوگیری از آسیب‌پذیری‌های type juggling یا type confusion است که ممکن است به دلیل فرضیات نادرست برنامه درباره نوع یک متغیر ایجاد شود. | 2 | +| **15.3.6** | کد JavaScript باید به‌گونه‌ای نوشته شده باشد که از prototype pollution جلوگیری کند، برای مثال با استفاده از Set() یا Map() به جای object literals. | 2 | +| **15.3.7** | برنامه باید دارای تدابیر محافظتی در برابر HTTP parameter pollution باشد، به‌ویژه اگر چارچوب برنامه تفاوتی بین منابع پارامترهای درخواست (رشته‌های query، پارامترهای body، کوکی‌ها یا فیلدهای هدر) قائل نشود. | 2 | + +## V15.4 Safe Concurrency + +مسائل همزمانی مانند race condition، آسیب‌پذیری‌های time-of-check to time-of-use (TOCTOU)، deadlock، livelock، thread starvation و همگام‌سازی نادرست می‌توانند منجر به رفتار غیرقابل پیش‌بینی و خطرات امنیتی شوند. این بخش شامل تکنیک‌ها و استراتژی‌های مختلفی است که به کاهش این ریسک‌ها کمک می‌کنند. + +| # | Description | Level | +| :---: | :--- | :---: | +| **15.4.1** | shared objects در کد multi-threaded (مانند cacheها، فایل‌ها، یا اشیائی که توسط multiple threads دسترسی پیدا می‌کنند) باید به‌صورت ایمن مورد استفاده قرار بگیرند، با استفاده از نوع‌های thread-safe و مکانیزم‌های همگام‌سازی مانند lock یا semaphore تا از race condition و تخریب داده جلوگیری شود. | 3 | +| **15.4.2** | بررسی وضعیت یک resource، مانند وجود آن یا دسترسی‌ها،و اقداماتی که به این وضعیت وابسته‌اند، به‌صورت یک عملیات واحد انجام شوند تا از race condition نوع time-of-check to time-of-use (TOCTOU) جلوگیری شود. برای مثال، بررسی اینکه یک فایل وجود دارد قبل از باز کردن آن، یا تأیید دسترسی یک کاربر قبل از اعطای آن. | 3 | +| **15.4.3** | باید از قفل‌ها (Locks) به طور یکنواخت استفاده شود تا از گیر کردن (Threads) جلوگیری شود، چه با انتظار برای یکدیگر و چه با تلاش بی‌پایان، و همچنین منطق قفل‌گذاری باید در همان کدی باقی بماند که مسئول مدیریت منبع است؛ این کار تضمین می‌کند که قفل‌ها نمی‌توانند به‌صورت ناخواسته یا خرابکارانه توسط کلاس‌ها یا کدهای بیرونی تغییر داده شوند. | 3 | +| **15.4.4** | تأیید کنید که سیاست‌های تخصیص resource از thread starvation جلوگیری می‌کنند، با اطمینان از دسترسی عادلانه به منابع، مانند استفاده از thread pools و اجازه دادن به threads با اولویت پایین‌تر تا در بازه زمانی منطقی پیشرفت کنند. | 3 | + +## References + +برای اطلاعات بیشتر، همچنین به منابع زیر مراجعه کنید: + +* [OWASP Prototype Pollution Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html) +* [OWASP Mass Assignment Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html) +* [OWASP CycloneDX Bill of Materials Specification](https://owasp.org/www-project-cyclonedx/) +* [OWASP Web Security Testing Guide: Testing for HTTP Parameter Pollution](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/07-Input_Validation_Testing/04-Testing_for_HTTP_Parameter_Pollution) diff --git a/5.0/fa/0x25-V16-Security-Logging-and-Error-Handling.md b/5.0/fa/0x25-V16-Security-Logging-and-Error-Handling.md new file mode 100644 index 0000000000..37e2a64713 --- /dev/null +++ b/5.0/fa/0x25-V16-Security-Logging-and-Error-Handling.md @@ -0,0 +1,84 @@ +# V16 Security Logging and Error Handling + +## هدف + +لاگ‌های امنیتی با لاگ‌های خطا یا لاگ‌های عملکرد متفاوت هستند و برای ثبت رویدادهای مرتبط با امنیت استفاده می‌شوند؛ مانند تصمیم‌های مربوط به احراز هویت، کنترل دسترسی، و تلاش‌ها برای دور زدن کنترل‌های امنیتی (مانند اعتبارسنجی ورودی یا اعتبارسنجی منطق تجاری).هدف آن‌ها پشتیبانی از تشخیص، پاسخ و بررسی است، از طریق ارائه داده‌های ساختاریافته و باکیفیت بالا برای ابزارهای تحلیلی مانند SIEM. + +لاگ‌ها نباید شامل داده‌های شخصی حساس باشند مگر در مواردی که قانون الزام کند. هر داده‌ای که لاگ می‌شود باید به‌عنوان یک دارایی بسیار باارزش محافظت شود. لاگ‌برداری نباید باعث به خطر افتادن حریم خصوصی یا امنیت سیستم شود. همچنین برنامه باید در شرایط خطا به‌صورت ایمن عمل کند و از افشای غیرضروری اطلاعات یا ایجاد اختلال جلوگیری کند. + +برای راهنمایی دقیق در مورد پیاده‌سازی، به OWASP Cheat Sheets در بخش منابع مراجعه کنید. + +## V16.1 Security Logging Documentation + +این بخش تضمین می‌کند که یک دارایی (Inventory) شفاف و کامل از لاگ‌گیری در سراسر stack برنامه وجود داشته باشد. این کار برای نظارت امنیتی مؤثر، پاسخ به حوادث و انطباق (Compliance) ضروری است. + +| # | Description | Level | +| :---: | :--- | :---: | +| **16.1.1** | فهرستی باید وجود داشته باشد که در آن ثبت وقایع (Logging) انجام‌شده در هر لایه از stack فناوری برنامه، رویدادهای ثبت‌شده، فرمت‌های لاگ، محل ذخیره‌سازی، نحوه استفاده، نحوه کنترل دسترسی به آن‌ها و مدت زمان نگهداری لاگ‌ها مستند شده است. | 2 | + +## V16.2 General Logging + +این بخش الزامات لازم را ارائه می‌دهد تا اطمینان حاصل شود که لاگ‌های امنیتی به‌صورت یکپارچه ساختاردهی شده‌اند و متادیتا مورد انتظار را در خود دارند. هدف این است که لاگ‌ها قابل‌خواندن توسط ماشین باشند و بتوان آن‌ها را در سیستم‌ها و ابزارهای توزیع‌شده تحلیل کرد. + +به‌طور طبیعی، رویدادهای امنیتی اغلب شامل داده‌های حساس هستند. اگر چنین داده‌ای بدون ملاحظه در لاگ‌ها ثبت شود، خود لاگ‌ها به‌عنوان داده‌های طبقه‌بندی‌شده محسوب می‌شوند و بنابراین مشمول الزامات رمزنگاری، سیاست‌های سخت‌گیرانه‌تر نگهداری و همچنین احتمال افشا در طول ممیزی‌ها خواهند بود. + +بنابراین، بسیار مهم است که فقط موارد ضروری در لاگ‌ها ثبت شوند و داده‌های لاگ با همان دقت و مراقبتی که برای سایر دارایی‌های حساس به‌کار می‌رود، مورد توجه قرار گیرند. + +الزامات زیر، نیازمندی‌های پایه‌ای مربوط به متادیتا در لاگ‌ها، همگام‌سازی، فرمت و کنترل را مشخص می‌کنند. + +| # | Description | Level | +| :---: | :--- | :---: | +| **16.2.1** | هر ورودی لاگ باید شامل متادیتای لازم (مانند زمان، مکان، چه کسی و چه چیزی) باشد تا امکان بررسی دقیق خط زمانی هنگام وقوع یک رویداد فراهم شود. | 2 | +| **16.2.2** | منابع زمانی برای تمام مؤلفه‌های لاگ با هم همگام‌سازی شده‌اند و مهر زمان (timestamp)‌ در متادیتای رویدادهای امنیتی از UTC استفاده ‌کند یا شامل یک اختلاف‌زمان (time zone offset) صریح باشد. استفاده از UTC توصیه می‌شود تا یکپارچگی در سراسر سیستم‌های توزیع‌شده تضمین شود و از بروز سردرگمی در زمان تغییر ساعت تابستانی جلوگیری گردد. | 2 | +| **16.2.3** | برنامه تنها لاگ‌ها را در فایل‌ها و سرویس‌هایی ذخیره یا ارسال می‌کند که در فهرست مستند لاگ‌ها ثبت شده‌اند. | 2 | +| **16.2.4** | لاگ‌ها باید توسط پردازشگر لاگی که در حال استفاده است خوانده و همبسته شوند، و ترجیحاً با استفاده از یک فرمت لاگ مشترک این کار انجام گیرد. | 2 | +| **16.2.5** | هنگام لاگ‌گیری از داده‌های حساس، برنامه باید لاگ گیری را بر اساس سطح حفاظت داده اعمال کند. برای مثال، ممکن است لاگ‌کردن برخی داده‌ها مانند اطلاعات ورود یا جزئیات پرداخت مجاز نباشد. داده‌های دیگر، مانند session token، تنها در صورتی باید لاگ شوند که به‌صورت hash یا masked، چه به‌طور کامل یا جزئی، ثبت شوند. | 2 | + +## V16.3 Security Events + +این بخش الزامات مربوط به لاگ‌برداری از رویدادهای مرتبط با امنیت در داخل برنامه را تعریف می‌کند. ثبت این رویدادها برای شناسایی رفتارهای مشکوک، پشتیبانی از تحقیقات، و انجام تعهدات مربوط به انطباق است. + +این بخش انواع رویدادهایی که باید لاگ شوند را مشخص می‌کند، اما سعی ندارد جزئیات کامل و جامعی ارائه دهد. هر برنامه دارای عوامل ریسک و زمینه عملیاتی منحصربه‌فرد خود است. + +توجه داشته باشید ASVS در حالی شامل لاگ‌گیری رویدادهای امنیتی در محدوده خود می‌شود که Alerting و Correlation (مثلاً قوانین SIEM یا زیرساخت‌های مانیتورینگ) خارج از محدوده در نظر گرفته شده و توسط سیستم‌های عملیاتی و نظارتی مدیریت می‌شوند. + +| # | Description | Level | +| :---: | :--- | :---: | +| **16.3.1** | تمام عملیات احراز هویت باید لاگ‌گیری ‌شوند، از جمله تلاش‌های موفق و ناموفق. همچنین باید متادیتای اضافی، مانند نوع احراز هویت یا عوامل استفاده‌شده، جمع‌آوری شود. | 2 | +| **16.3.2** | تلاش‌های ناموفق برای مجوزدهی (authorization) باید لاگ‌گیری ‌شوند. برای برنامه‌های L3، این باید شامل لاگ‌گیری تمام تصمیمات مجوزدهی باشد، از جمله ثبت زمانی که داده‌های حساس دسترسی پیدا می‌کنند، بدون آنکه خود داده‌های حساس ثبت شوند. | 2 | +| **16.3.3** | برنامه باید رویدادهای امنیتی تعریف‌شده در مستندات (ابتدای بخش) را لاگ‌ نماید و همچنین تلاش‌ها برای دور زدن کنترل‌های امنیتی، مانند اعتبارسنجی ورودی، منطق کسب‌وکار و ضد‌خودکارسازی، را نیز ثبت ‌کند. | 2 | +| **16.3.4** | برنامه باید خطاهای غیرمنتظره و شکست‌های کنترل‌های امنیتی، مانند شکست‌های TLS در بک اند را لاگ ‌کند. | 2 | + +## V16.4 Log Protection + +لاگ‌ها به عنوان آثار ارزشمند forensic محسوب می‌شوند و باید محافظت شوند. اگر لاگ‌ها به‌سادگی قابل تغییر یا حذف باشند، یکپارچگی خود را از دست می‌دهند و برای تحقیقات حادثه یا پرونده‌های حقوقی غیرقابل اعتماد می‌شوند. همچنین، لاگ‌ها ممکن است رفتار داخلی برنامه یا متادیتای حساس را فاش کنند و این موضوع آن‌ها را به هدف جذابی برای مهاجمان تبدیل می‌کند. + +این بخش الزامات را برای اطمینان از حفاظت لاگ‌ها در برابر دسترسی غیرمجاز، دستکاری و افشا تعریف می‌کند و همچنین تضمین می‌کند که لاگ‌ها به‌صورت ایمن منتقل و در سیستم‌های امن و ایزوله ذخیره شوند. + +| # | Description | Level | +| :---: | :--- | :---: | +| **16.4.1** | تمام مؤلفه‌های لاگ‌گیری باید داده‌ها را به‌طور مناسب رمزگذاری ‌کنند تا از حملات log injection جلوگیری شود. | 2 | +| **16.4.2** | لاگ‌ها باید در برابر دسترسی غیرمجاز محافظت شده و امکان تغییر آن‌ها وجود نداشته باشد. | 2 | +| **16.4.3** | لاگ‌ها به‌صورت امن باید به یک سیستم منطقی جداگانه برای تحلیل، تشخیص، هشدار و ارجاع منتقل شوند. هدف این است که در صورت نفوذ به برنامه، لاگ‌ها به خطر نیفتند. | 2 | + +## V16.5 Error Handling + +این بخش الزامات لازم را برای اطمینان از این که برنامه‌ها به‌صورت امن و بدون افشای جزئیات حساس داخلی دچار خطا می‌شوند، تعریف می‌کند. + +| # | Description | Level | +| :---: | :--- | :---: | +| **16.5.1** | هنگام بروز خطاهای غیرمنتظره یا حساس به امنیت، پیامی عمومی به کاربر باید بازگردانده ‌شود، به‌گونه‌ای که هیچ‌گونه اطلاعات حساس داخلی سیستم مانند stack trace، کوئری‌ها، کلیدها و توکن‌های محرمانه افشا نشود. | 2 | +| **16.5.2** | برنامه باید هنگام بروز خطا در دسترسی به منابع خارجی همچنان به‌صورت امن عمل نماید، برای مثال با استفاده از الگوهایی مانند circuit breaker یا کاهش تدریجی عملکرد (graceful degradation). | 2 | +| **16.5.3** | برنامه باید به‌صورت امن و کنترل‌شده دچار خطا ‌شود، حتی هنگام وقوع استثنا، و از شرایط fail-open جلوگیری نماید؛ برای مثال، از پردازش تراکنش در صورت بروز خطا در منطق اعتبارسنجی جلوگیری شود. | 2 | +| **16.5.4** | یک « last resort» باید تعریف شده باشد که تمامی unhandled exception را مدیریت کند. این کار هم برای جلوگیری از از دست رفتن جزئیات خطا که باید در فایل‌های لاگ ثبت شوند و هم برای اطمینان از این است که خطا باعث از کار افتادن کل فرآیند برنامه و در نتیجه از دست رفتن دسترسی نشود، ضروری است. | 3 | + +توجه: برخی زبان‌ها (از جمله Swift و Go و همچنین بسیاری از زبان‌های تابعی بر اساس رویه‌های متداول طراحی) از exceptions یا last resort پشتیبانی نمی‌کنند. در این موارد، معماران و توسعه‌دهندگان باید از یک الگو، زبان، یا روش سازگار با چارچوب کاری استفاده کنند تا اطمینان حاصل شود که برنامه‌ها می‌توانند رویدادهای استثنائی، غیرمنتظره یا مرتبط با امنیت را به‌صورت امن مدیریت کنند. + +## References + +برای اطلاعات بیشتر، همچنین به منابع زیر مراجعه کنید: + +* [OWASP Web Security Testing Guide: Testing for Error Handling](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/README) +* [OWASP Authentication Cheat Sheet section about error messages](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#authentication-and-error-messages) +* [OWASP Logging Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html) +* [OWASP Application Logging Vocabulary Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Vocabulary_Cheat_Sheet.html) diff --git a/5.0/fa/0x26-V17-WebRTC.md b/5.0/fa/0x26-V17-WebRTC.md new file mode 100644 index 0000000000..1833398ce9 --- /dev/null +++ b/5.0/fa/0x26-V17-WebRTC.md @@ -0,0 +1,73 @@ +# V17 WebRTC + +## هدف + +Web Real-Time Communication (WebRTC) امکان تبادل صوت، تصویر و داده به‌صورت لحظه‌ای در برنامه‌های مدرن را فراهم می‌کند. با افزایش پذیرش این فناوری، تأمین امنیت زیرساخت WebRTC اهمیت حیاتی پیدا می‌کند. این بخش الزامات امنیتی را برای ذی‌نفعانی ارائه می‌دهد که سیستم‌های WebRTC را توسعه، میزبانی یا یکپارچه می‌کنند + +صنعت WebRTC را می‌توان به‌طور کلی به سه بخش تقسیم کرد: + +1. توسعه‌دهندگان محصول: فروشندگان اختصاصی و متن‌باز که محصولات و راه‌حل‌های WebRTC را ایجاد و عرضه می‌کنند. تمرکز آن‌ها بر توسعه فناوری‌های قوی و امن WebRTC است که توسط دیگران قابل استفاده باشند. +2. ارائه‌دهندگان خدمات: سازمان‌هایی که از محصولات توسعه‌دهندگان یا ارائه‌دهندگان CPaaS استفاده می‌کنند یا راهکارهای WebRTC خود را توسعه می‌دهند. آن‌ها برنامه‌هایی را برای کنفرانس آنلاین، سلامت، آموزش الکترونیکی و سایر حوزه‌هایی که در آن‌ها ارتباط بلادرنگ حیاتی است، ایجاد و پیاده‌سازی می‌کنند. +3. ارائه‌دهندگان خدمات: سازمان‌هایی که از محصولات توسعه‌دهندگان یا ارائه‌دهندگان CPaaS استفاده می‌کنند یا خود راهکارهای WebRTC خود را توسعه می‌دهند. آن‌ها برنامه‌هایی برای کنفرانس‌های آنلاین، حوزه سلامت، آموزش الکترونیکی و سایر زمینه‌هایی که ارتباط بلادرنگ حیاتی است، ایجاد و پیاده‌سازی می‌کنند. + +نیازمندی‌های امنیتی مطرح شده در اینجا عمدتاً بر توسعه‌دهندگان محصول، ارائه‌دهندگان CPaaS و ارائه‌دهندگان خدمات متمرکز است که: + +* از راه‌حل‌های متن‌باز برای ساخت برنامه‌های WebRTC خود استفاده می‌کنند. +* از محصولات تجاری WebRTC به‌عنوان بخشی از زیرساخت خود استفاده می‌کنند. +* از راه‌حل‌های WebRTC که به‌صورت داخلی توسعه داده‌اند استفاده می‌کنند یا اجزای مختلف را در یک سرویس یکپارچه ترکیب می‌کنند. + +قابل توجه است که این الزامات امنیتی شامل توسعه‌دهندگانی نمی‌شود که صرفاً از SDKها و APIهای ارائه‌شده توسط ارائه‌دهندگان CPaaS استفاده می‌کنند. برای چنین توسعه‌دهندگانی، مسئولیت بیشتر مسائل امنیتی زیرساختی معمولاً بر عهده ارائه‌دهندگان CPaaS است و استاندارد امنیتی عمومی مانند ASVS ممکن است به‌طور کامل نیازهای آن‌ها را پوشش ندهد. + +## V17.1 TURN Server + +این بخش الزامات امنیتی را برای سیستم‌هایی که سرورهای TURN (Traversal Using Relays around NAT) خود را راه‌اندازی می‌کنند، تعریف می‌کند. سرورهای TURN در هدایت Media در محیط‌های شبکه‌ای محدود کمک می‌کنند، اما در صورت پیکربندی نادرست می‌توانند خطراتی ایجاد کنند. این کنترل‌ها بر فیلتر کردن امن آدرس‌ها و جلوگیری از تمام شدن منابع سیستم (resource exhaustion) تمرکز دارند. + +| # | Description | Level | +| :---: | :--- | :---: | +| **17.1.1** | سرویس Traversal Using Relays around NAT (TURN) باید تنها به آدرس‌های IP دسترسی دهد که برای اهداف ویژه رزرو نشده‌اند (مثلاً شبکه‌های داخلی، broadcast، loopback). توجه داشته باشید که این مورد هم برای آدرس‌های IPv4 و هم برای IPv6 صدق می‌کند. | 2 | +| **17.1.2** | سرویس Traversal Using Relays around NAT (TURN)، نباید به resource exhaustion آسیب‌پذیر باشد، حتی زمانی که کاربران قانونی تلاش کنند تعداد زیادی پورت روی سرور TURN باز کنند. | 3 | + +## V17.2 Media + +این الزامات فقط به سیستم‌هایی اعمال می‌شود که سرورهای رسانه‌ای WebRTC خود را میزبانی می‌کنند، مانند Selective Forwarding Units (SFU)، Multipoint Control Units (MCU)، سرورهای Recording یا سرورهای Gateway. سرورهای رسانه(Media) وظیفه پردازش و توزیع جریان‌های رسانه‌ای را بر عهده دارند و امنیت آن‌ها برای محافظت از ارتباطات بین همتاها حیاتی است. حفاظت از جریان‌های رسانه‌ای در برنامه‌های WebRTC از اهمیت بالایی برخوردار است تا از شنود، دستکاری و حملات محروم‌سازی از سرویس(denial-of-service) جلوگیری شود که می‌تواند حریم خصوصی کاربران و کیفیت ارتباط را به خطر بیندازد. + +به‌ویژه، لازم است تدابیری برای محافظت در برابر حملات flood مانند rate limiting، اعتبارسنجی timestamps، استفاده از ساعت‌های همگام برای تطبیق بازه‌های زمانی واقعی و مدیریت بافرها به‌منظور جلوگیری از overflow و حفظ زمان‌بندی مناسب، اعمال شود. اگر بسته‌های مربوط به یک جلسه رسانه‌ای خاص خیلی سریع برسند، بسته‌های اضافی باید حذف شوند. همچنین محافظت از سیستم در برابر بسته‌های خراب یا مخرب اهمیت دارد که با اعمال اعتبارسنجی ورودی، مدیریت ایمن سرریز عدد صحیح، جلوگیری از buffer overflows و استفاده از سایر تکنیک‌های مقاوم در برابر خطا، حاصل می‌شود. + +سیستم‌هایی که صرفاً بر ارتباط رسانه‌ای همتا‌به‌همتا بین مرورگرهای وب متکی هستند و سرورهای میانی رسانه‌ای در آن‌ها دخالتی ندارند، از این الزامات امنیتی خاص مرتبط با رسانه مستثنی هستند. + +این بخش به استفاده از Datagram Transport Layer Security (DTLS) در زمینه WebRTC اشاره دارد. الزامی مربوط به داشتن سیاست مستند برای مدیریت کلیدهای رمزنگاری در فصل «Cryptography» قابل یافت است. اطلاعات مربوط به روش‌های رمزنگاری تأییدشده را می‌توان یا در پیوست Cryptography استاندارد ASVS یا در اسنادی مانند NIST SP 800‑52 Rev. 2 و BSI TR‑02102‑2 (نسخه 2025-01) پیدا کرد. + +| # | Description | Level | +| :---: | :--- | :---: | +| **17.2.1** | کلید مربوط به گواهی Datagram Transport Layer Security (DTLS) بر اساس سیاست مستند مدیریت کلیدهای رمزنگاری مدیریت و محافظت می‌شود. | 2 | +| **17.2.2** | سرور Media طوری پیکربندی شده باشد که از مجموعه‌های رمزنگاری تاییدشده Datagram Transport Layer Security (DTLS) استفاده کند و از یک پروفایل محافظتی امن برای گسترش DTLS به منظور ایجاد کلیدها برای پروتکل Secure Real-time Transport Protocol (DTLS-SRTP) پشتیبانی نماید. | 2 | +| **17.2.3** | احراز هویت Secure Real-time Transport Protocol (SRTP) در سرور Media بررسی ‌شود تا از حملات تزریق Real-time Transport Protocol (RTP) جلوگیری شده و این حملات باعث بروز شرایط Denial of Service یا وارد شدن محتوای صوتی یا تصویری ناخواسته به جریان‌های رسانه‌ای نشوند. | 2 | +| **17.2.4** | سرور Media باید قادر باشد پردازش ترافیک رسانه‌ای ورودی را حتی هنگام مواجهه با بسته‌های Secure Real-time Transport Protocol (SRTP) ناقص یا خراب ادامه دهد. | 2 | +| **17.2.5** | سرور Media باید قادر باشد پردازش ترافیک رسانه‌ای ورودی را حتی در هنگام دریافت سیلی(flood) از بسته‌های Secure Real-time Transport Protocol (SRTP) از کاربران قانونی ادامه دهد. | 3 | +| **17.2.6** | سرور Media نسبت به آسیب‌پذیری "ClientHello Race Condition " در Datagram Transport Layer Security (DTLS) نباید آسیب‌پذیر نباشد، این کار می‌تواند با بررسی اینکه آیا سرور رسانه به‌صورت عمومی به عنوان آسیب‌پذیر شناخته شده است یا با انجام آزمون Race Condition انجام شود. | 3 | +| **17.2.7** | مکانیزم‌های ضبط صدا یا تصویر مرتبط با سرور رسانه در هنگام طوفان بسته‌ای (Flood) از پروتکل انتقال بلادرنگ امن (SRTP) توسط کاربران مجاز، باید قادر به ادامه پردازش ترافیک رسانه ورودی است. | 3 | +| **17.2.8** | گواهی‌نامه امنیت لایه انتقال دیتاگرام (DTLS) باید با ویژگی اثر انگشت (Fingerprint) پروتکل توصیف نشست (SDP) بررسی می‌شود و در صورت شکست در بررسی، جریان رسانه قطع می‌شود تا اصالت جریان رسانه تضمین گردد. | 3 | + +## V17.3 Signaling + +این بخش الزامات سیستم‌هایی را تعریف می‌کند که سرورهای سیگنالینگ WebRTC خود را اداره می‌کنند. سیگنالینگ وظیفه هماهنگی ارتباط peer-to-peer را دارد و باید در برابر حملاتی که می‌توانند بر ایجاد یا کنترل جلسات تأثیر بگذارند مقاوم باشد. + +برای اطمینان از سیگنالینگ ایمن، سیستم‌ها باید ورودی‌های ناقص یا مخدوش را به‌صورت امن مدیریت کنند و حتی تحت بار زیاد نیز در دسترس باقی بمانند. + +| # | Description | Level | +| :---: | :--- | :---: | +| **17.3.1** | سرور سیگنالینگ باید قادر باشد حتی در جریان flood attack، پیام‌های سیگنالینگ ورودی مشروع را پردازش کند. این باید با اعمال محدودیت نرخ (rate limiting) در سطح سیگنالینگ محقق شود. | 2 | +| **17.3.2** | سرور سیگنالینگ باید قادر باشد پیام‌های سیگنالینگ مشروع را حتی در مواجهه با پیام‌های سیگنالینگ ناقص یا مخرب که می‌توانند باعث ایجاد شرایط عدم دسترسی (Denial of Service) شوند، پردازش کند. این می‌تواند شامل اعمال اعتبارسنجی ورودی، مدیریت ایمن سرریز عدد صحیح (integer overflow)، جلوگیری از سرریز بافر (buffer overflow) و استفاده از دیگر تکنیک‌های مقاوم مدیریت خطا باشد. | 2 | + +## References + +برای اطلاعات بیشتر، همچنین به منابع زیر مراجعه کنید: + +* The WebRTC DTLS ClientHello DoS is best documented at [Enable Security's blog post aimed at security professionals](https://www.enablesecurity.com/blog/novel-dos-vulnerability-affecting-webrtc-media-servers/) and the associated [white paper aimed at WebRTC developers](https://www.enablesecurity.com/blog/webrtc-hello-race-conditions-paper/) +* [RFC 3550 - RTP: A Transport Protocol for Real-Time Applications](https://www.rfc-editor.org/rfc/rfc3550) +* [RFC 3711 - The Secure Real-time Transport Protocol (SRTP)](https://datatracker.ietf.org/doc/html/rfc3711) +* [RFC 5764 - Datagram Transport Layer Security (DTLS) Extension to Establish Keys for the Secure Real-time Transport Protocol (SRTP))](https://datatracker.ietf.org/doc/html/rfc5764) +* [RFC 8825 - Overview: Real-Time Protocols for Browser-Based Applications](https://www.rfc-editor.org/info/rfc8825) +* [RFC 8826 - Security Considerations for WebRTC](https://www.rfc-editor.org/info/rfc8826) +* [RFC 8827 - WebRTC Security Architecture](https://www.rfc-editor.org/info/rfc8827) +* [DTLS-SRTP Protection Profiles](https://www.iana.org/assignments/srtp-protection/srtp-protection.xhtml) diff --git a/5.0/fa/0x90-Appendix-A_Glossary.md b/5.0/fa/0x90-Appendix-A_Glossary.md new file mode 100644 index 0000000000..e67cb6bef4 --- /dev/null +++ b/5.0/fa/0x90-Appendix-A_Glossary.md @@ -0,0 +1,89 @@ +# Appendix A: Glossary + +* **Absolute Maximum Session Lifetime** – که توسط NIST با عنوان «مهلت زمانی کلی (Overall Timeout)» نیز شناخته می‌شود، حداکثر مدت زمانی است که یک نشست پس از احراز هویت می‌تواند فعال باقی بماند، صرف‌نظر از هرگونه تعامل کاربر. این مفهوم یکی از مؤلفه‌های انقضای نشست (Session Expiration) محسوب می‌شود. +* **Allowlist** – فهرستی از داده‌ها یا عملیات مجاز؛ برای مثال، فهرستی از کاراکترهایی که انجام اعتبارسنجی ورودی (Input Validation) بر اساس آن‌ها مجاز است. +* **Anti-forgery token** – مکانیزمی که در آن یک یا چند توکن همراه با درخواست ارسال شده و توسط سرور برنامه اعتبارسنجی می‌شوند تا اطمینان حاصل شود درخواست از یک نقطه انتهایی (Endpoint) مورد انتظار ارسال شده است. +* **Application Security** – امنیت در سطح برنامه بر تحلیل مؤلفه‌هایی تمرکز دارد که لایه کاربردی در مدل مرجع اتصال سیستم‌های باز (OSI) را تشکیل می‌دهند، نه بر اجزای زیربنایی مانند سیستم‌عامل یا شبکه‌های متصل. +* **Application Security Verification** – ارزیابی فنی یک برنامه کاربردی بر اساس استاندارد OWASP ASVS. +* **Application Security Verification Report** – گزارشی که نتایج کلی و تحلیل‌های پشتیبان تهیه‌شده توسط ارزیاب (Verifier) را برای یک برنامه کاربردی مشخص مستند می‌کند. +* **Authentication** – فرایند تأیید هویت ادعاشده کاربر یک برنامه کاربردی. +* **Automated Verification** – استفاده از ابزارهای خودکار (شامل ابزارهای تحلیل پویا، ابزارهای تحلیل ایستا، یا هر دو) که با تکیه بر امضاهای آسیب‌پذیری برای شناسایی مشکلات به کار می‌روند. +* **Black box testing** – روشی از آزمون نرم‌افزار که عملکرد یک برنامه را بررسی می‌کند بدون آن‌که به ساختارها یا عملکرد داخلی آن نگاه کند. +* **Common Weakness Enumeration** (CWE) – فهرستی که توسط جامعه توسعه‌دهندگان ایجاد شده و شامل نقاط ضعف رایج امنیت نرم‌افزار است. این فهرست به‌عنوان زبان مشترک، معیاری برای ابزارهای امنیت نرم‌افزار، و پایه‌ای برای شناسایی، کاهش و پیشگیری از نقاط ضعف عمل می‌کند. +* **Component** – یک واحد مستقل از کد است که دارای رابط‌های مرتبط با دیسک و شبکه می‌باشد و با سایر مولفه‌ها ارتباط برقرار می‌کند. +* **Credential Service Provider** (CSP) – که به آن ارائه‌دهنده هویت (Identity Provider - IdP) نیز گفته می‌شود، منبعی از داده‌های کاربری است که می‌تواند به‌عنوان منبع احراز هویت توسط سایر برنامه‌ها استفاده شود. +* **Cross-Site Script Inclusion** (XSSI) - گونه‌ای از حمله اسکریپت‌نویسی بین‌سایتی (XSS) که در آن یک برنامه وب کد مخرب را از یک منبع خارجی دریافت کرده و آن کد را به‌عنوان بخشی از محتوای خود وارد می‌کند. +* **Cross-Site Scripting** (XSS) – یک آسیب‌پذیری امنیتی معمول در برنامه‌های وب که امکان تزریق اسکریپت‌های سمت کاربر (Client-Side Scripts) به محتوا را فراهم می‌کند. +* **Cryptographic module** – سخت‌افزار، نرم‌افزار و/یا فریم‌ور که الگوریتم‌های رمزنگاری را اجرا کرده و/یا کلیدهای رمزنگاری تولید می‌کند. +* **Cryptographically secure pseudo-random number generator** (CSPRNG) - یک تولیدکننده اعداد شبه‌تصادفی با ویژگی‌هایی که آن را مناسب برای استفاده در رمزنگاری می‌کند؛ که گاهی به آن تولیدکننده اعداد تصادفی رمزنگاری (Cryptographic Random Number Generator - CRNG) نیز گفته می‌شود. +* **Datagram Transport Layer Security** (DTLS) – یک پروتکل رمزنگاری که امنیت ارتباطی را بر روی اتصال شبکه فراهم می‌کند. این پروتکل بر اساس TLS ساخته شده اما برای محافظت از پروتکل‌های مبتنی بر دیتاگرام (معمولاً روی UDP) تطبیق داده شده است. نسخه DTLS 1.3 در RFC 9147 تعریف شده است. +* **Datagram Transport Layer Security Extension to Establish Keys for the Secure Real-time Transport Protocol** (DTLS-SRTP) –مکانیزمی که از DTLS Handshake برای ایجاد مواد کلیدی (Key Material) جهت یک جلسه SRTP استفاده می‌کند. این افزونه در RFC 5764 تعریف شده است. +* **Design Verification** – ارزیابی فنی معماری امنیتی یک برنامه کاربردی. +* **Dynamic Application Security Testing** (DAST) – فناوری‌هایی که برای شناسایی شرایطی که نشان‌دهنده آسیب‌پذیری امنیتی در یک برنامه در حال اجرا هستند طراحی شده‌اند. +* **Dynamic Verification** – استفاده از ابزارهای خودکار که با تکیه بر امضاهای آسیب‌پذیری به شناسایی مشکلات در حین اجرای برنامه می‌پردازند. +* **Fast IDentity Online** (FIDO) – مجموعه‌ای از استانداردهای احراز هویت که امکان استفاده از روش‌های مختلف احراز هویت از جمله بیومتریک، ماژول‌های پلتفرم مورد اعتماد (TPM)، توکن‌های امنیتی USB و غیره را فراهم می‌کند. +* **Hardware Security Module** (HSM) – یک جزء سخت‌افزاری که کلیدهای رمزنگاری و سایر اسرار را به‌صورت محافظت‌شده ذخیره می‌کند. +* **Hibernate Query Language** (HQL) – یک زبان پرس‌وجو که از نظر ظاهری شبیه SQL است و توسط کتابخانه Hibernate ORM استفاده می‌شود. +* **HTTP Strict Transport Security** (HSTS) – سیاستی که مرورگر را مجبور می‌کند فقط از طریق TLS به دامنه‌ای که هدر HSTS را ارسال می‌کند متصل شود و تنها زمانی که گواهی‌نامه معتبر ارائه شده باشد. این سیاست با فیلد هدر پاسخ Strict-Transport-Security فعال می‌شود. +* **HyperText Transfer Protocol** (HTTP) – یک پروتکل برنامه‌ای برای سیستم‌های اطلاعاتی توزیع‌شده، مشارکتی و ابررسانه‌ای است. HTTP پایه و اساس ارتباط داده‌ها در شبکه جهانی وب محسوب می‌شود. +* **HyperText Transfer Protocol over SSL/TLS** (HTTPS) – روشی برای امن‌سازی ارتباط HTTP از طریق رمزنگاری آن با استفاده از TLS (Transport Layer Security). +* **Identity Provider** (IdP) – که در منابع NIST گاهی به آن ارائه‌دهنده خدمات اعتبارنامه (Credential Service Provider - CSP) نیز گفته می‌شود، موجودیتی است که منبع احراز هویت را برای سایر برنامه‌ها فراهم می‌کند. +* **Inactivity Timeout** – مدتی است که یک نشست می‌تواند در صورت عدم تعامل کاربر با برنامه فعال باقی بماند. این معیار یکی از مؤلفه‌های انقضای نشست (Session Expiration) است. +* **Input Validation** – استانداردسازی (Canonicalization) و اعتبارسنجی ورودی‌های کاربر غیرقابل اعتماد. +* **JSON Web Token** (JWT) – RFC 7519 یک استاندارد برای یک شیء داده JSON تعریف می‌کند که از یک بخش هدر تشکیل شده که نحوه اعتبارسنجی شیء را توضیح می‌دهد، یک بخش بدنه که شامل مجموعه‌ای از ادعاها است، و یک بخش امضا که شامل امضای دیجیتال است و می‌توان از آن برای اعتبارسنجی محتوای بخش بدنه استفاده کرد. این نوعی توکن خودکفا (self-contained token) است. +* **Local File Inclusion** (LFI) - حمله‌ای که از رویه‌های آسیب‌پذیر درج فایل در یک برنامه سوءاستفاده می‌کند و منجر به درج فایل‌های محلیِ موجود روی سرور می‌شود. +* **Malicious Code** – کدی که در طول توسعه یک برنامه بدون اطلاع مالک برنامه وارد شده و سیاست امنیتی مورد نظر برنامه را دور می‌زند. این با بدافزارهایی مانند ویروس یا کرم یکسان نیست! +* **Malware** – کد اجرایی که در حین اجرای برنامه و بدون اطلاع کاربر یا مدیر برنامه وارد می‌شود. +* **Message authentication code** (MAC) - یک چک‌سام رمزنگاری‌شده بر داده‌ها است که توسط الگوریتم تولید MAC محاسبه می‌شود و برای اطمینان از صحت و اصالت داده‌ها استفاده می‌شود. +* **Multi-factor authentication** (MFA) – احراز هویتی که شامل دو یا چند عامل از عوامل احراز هویت تکی است. +* **Mutual TLS** (mTLS) – مراجعه کنید به احراز هویت کلاینت TLS (TLS Client Authentication). +* **Object-relational Mapping** (ORM) – سیستمی که امکان ارجاع و پرس‌وجوی پایگاه داده‌های رابطه‌ای/جدولی را در یک برنامه کاربردی با استفاده از مدل شیء‌محور سازگار با برنامه فراهم می‌کند. +* **One-time Password** (OTP) – رمزی که به‌صورت منحصر به فرد تولید شده و فقط برای یک بار استفاده کاربرد دارد. +* **Open Worldwide Application Security Project** (OWASP) – یک جامعه جهانی، رایگان و باز است که بر بهبود امنیت نرم‌افزارهای کاربردی تمرکز دارد. مأموریت آن این است که امنیت برنامه‌های کاربردی را «قابل مشاهده» کند تا افراد و سازمان‌ها بتوانند تصمیمات آگاهانه‌ای در مورد ریسک‌های امنیتی برنامه‌های کاربردی بگیرند. برای اطلاعات بیشتر مشاهده شود : [https://www.owasp.org/](https://www.owasp.org/). +* **Password-Based Key Derivation Function 2** (PBKDF2) – یک الگوریتم یک‌طرفه ویژه است که برای ایجاد یک کلید رمزنگاری قوی از یک متن ورودی (مانند گذرواژه) و یک مقدار salt تصادفی اضافی استفاده می‌شود و بنابراین می‌توان از آن برای سخت‌تر کردن شکستن گذرواژه به‌صورت آفلاین استفاده کرد، اگر مقدار حاصل به‌جای گذرواژه اصلی ذخیره شود. +* **Public Key Infrastructure** (PKI) – ساختاری که کلیدهای عمومی را با هویت‌های مربوط به موجودیت‌ها پیوند می‌دهد. این پیوند از طریق فرآیند ثبت و صدور گواهی‌نامه توسط یک مرجع صدور گواهی (Certificate Authority - CA) برقرار می‌شود. +* **Public Switched Telephone Network** (PSTN) – شبکه تلفن سنتی که شامل تلفن‌های خط ثابت و تلفن‌های همراه می‌شود. +* **Real-time Transport Protocol** (RTP) and **Real-time Transport Control Protocol** (RTCP) – دو پروتکل که به‌صورت ترکیبی برای انتقال جریان‌های چندرسانه‌ای استفاده می‌شوند. این پروتکل‌ها توسط پشته WebRTC استفاده می‌شوند و در RFC 3550 تعریف شده‌اند. +* **Reference Token** – نوعی توکن که به‌عنوان اشاره‌گر یا شناسه‌ای برای وضعیت یا متاداده ذخیره‌شده روی سرور عمل می‌کند و گاهی به آن توکن‌های تصادفی (Random Tokens) یا توکن‌های مات (Opaque Tokens) نیز گفته می‌شود. برخلاف توکن‌های خودکفا (Self-Contained Tokens) که بخشی از داده‌های مرتبط خود را درون توکن جای می‌دهند، توکن‌های مرجع هیچ اطلاعات ذاتی‌ای ندارند و برای دریافت زمینه (Context) به سرور وابسته هستند. توکن مرجع یا یک شناسه نشست (Session Identifier) است یا شامل آن می‌باشد. +* **Relying Party** (RP) – معمولاً یک برنامه کاربردی است که بر احراز هویت کاربر توسط یک ارائه‌دهنده احراز هویت جداگانه متکی است. این برنامه بر نوعی توکن یا مجموعه‌ای از ادعاهای امضا شده ارائه‌شده توسط آن ارائه‌دهنده اعتماد می‌کند تا مطمئن شود کاربر همان کسی است که ادعا می‌کند. +* **Remote File Inclusion** (RFI) - حمله‌ای که از رویه‌های آسیب‌پذیر درج فایل در برنامه سوءاستفاده می‌کند و منجر به درج فایل‌های راه‌دور (Remote) می‌شود. +* **Scalable Vector Graphics** (SVG) – یک زبان نشانه‌گذاری مبتنی بر XML برای توصیف گرافیک‌های برداری دوبعدی. +* **Secure Real-time Transport Protocol** (SRTP) and **Secure Real-time Transport Control Protocol** (SRTCP) – یک پروفایل از پروتکل‌های RTP و RTCP که پشتیبانی از رمزنگاری پیام، احراز هویت و محافظت از صحت داده‌ها را فراهم می‌کند. این پروتکل‌ها در RFC 3711 تعریف شده‌اند. +* **Security Architecture** – یک انتزاع از طراحی برنامه کاربردی است که محل و نحوه استفاده از کنترل‌های امنیتی را شناسایی و توصیف می‌کند و همچنین مکان و حساسیت داده‌های کاربر و برنامه را مشخص می‌نماید. +* **Security Assertion Markup Language** (SAML) – یک استاندارد باز برای احراز هویت Single Sign-On است که بر اساس انتقال ادعاهای امضا شده (معمولاً اشیاء XML) بین ارائه‌دهنده هویت (Identity Provider) و Relying Party عمل می‌کند. +* **Security Configuration** – پیکربندی زمان اجرا یک برنامه که نحوه استفاده از کنترل‌های امنیتی را تحت تأثیر قرار می‌دهد. +* **Security Control** – یک عملکرد یا مؤلفه که یک بررسی امنیتی انجام می‌دهد (مثلاً بررسی دسترسی) یا هنگام فراخوانی منجر به اثر امنیتی می‌شود (مثلاً تولید یک رکورد حسابرسی). +* **Security information and event management** (SIEM) - سیستمی برای شناسایی تهدیدات، انطباق با مقررات و مدیریت رخدادهای امنیتی از طریق جمع‌آوری و تحلیل داده‌های مرتبط با امنیت از منابع مختلف در زیرساخت فناوری اطلاعات یک سازمان. +* **Self-Contained Token** – توکنی که یک یا چند ویژگی را در خود جای می‌دهد و به وضعیت سمت سرور یا سایر ذخیره‌سازی‌های خارجی متکی نیست. این توکن‌ها اصالت و صحت ویژگی‌های درون خود را تضمین می‌کنند و امکان تبادل امن و بدون حالت (Stateless) اطلاعات بین سیستم‌ها را فراهم می‌سازند. توکن‌های خودکفا معمولاً با تکنیک‌های رمزنگاری مانند امضاهای دیجیتال یا کدهای تأیید پیام (MAC) ایمن می‌شوند تا اصالت، صحت و در برخی موارد محرمانگی داده‌ها تضمین گردد. نمونه‌های رایج شامل ادعاهای SAML (SAML Assertions) و JWTها هستند. +* **Server-side Request Forgery** (SSRF) – حمله‌ای که از قابلیت‌های سرور برای خواندن یا به‌روزرسانی منابع داخلی سوءاستفاده می‌کند. مهاجم یک URL را ارائه یا تغییر می‌دهد که کدی که روی سرور اجرا می‌شود آن را خوانده یا داده‌ای به آن ارسال می‌کند. +* **Session Description Protocol** (SDP) – یک قالب پیام برای راه‌اندازی نشست‌های چندرسانه‌ای (به‌عنوان مثال در WebRTC استفاده می‌شود). این پروتکل در RFC 4566 تعریف شده است. +* **Session Identifier** or **Session ID** – یک کلید که یک نشست stateful ذخیره‌شده در سمت سرور را شناسایی می‌کند. این شناسه به‌صورت مستقیم یا درون یک «توکن مرجع» (Reference Token) بین سرور و کلاینت منتقل می‌شود. +* **Session Token** – اصطلاحی کلی که در این استاندارد برای اشاره به توکن یا مقدار مورد استفاده در مکانیزم‌های نشست stateless (که از توکن self-containedاستفاده می‌کنند) یا مکانیزم‌های نشست stateful (که از توکن مرجع استفاده می‌کنند) به کار می‌رود. +* **Session Traversal Utilities for NAT** (STUN) – یک پروتکل که برای کمک به عبور از NAT به منظور برقراری ارتباط‌های همتا به همتا (Peer-to-Peer) استفاده می‌شود. این پروتکل در RFC 3489 تعریف شده است. +* **Single-factor authenticator** – مکانیزمی برای بررسی احراز هویت کاربر که باید یکی از موارد زیر باشد: چیزی که می‌دانید (رمزهای عبور، عبارات عبور، PIN)، چیزی که هستید (بیومتریک، اثر انگشت، اسکن چهره) یا چیزی که در اختیار دارید (توکن‌های OTP، دستگاه رمزنگاری مانند کارت هوشمند). +* **Single Sign-on Authentication** (SSO) – زمانی رخ می‌دهد که کاربر وارد یک برنامه می‌شود و به‌صورت خودکار به برنامه‌های دیگر نیز وارد می‌شود بدون نیاز به احراز هویت مجدد. به‌عنوان مثال، وقتی کاربر وارد Google می‌شود، به‌طور خودکار وارد سایر سرویس‌های Google مانند YouTube، Google Docs و Gmail نیز می‌گردد. +* **Software bill of materials** (SBOM) - یک فهرست ساختاریافته و جامع از تمام مؤلفه‌ها، ماژول‌ها، کتابخانه‌ها، فریم‌ورک‌ها و سایر منابع مورد نیاز برای ساخت یا مونتاژ یک برنامه نرم‌افزاری است. +* **Software Composition Analysis** (SCA) – مجموعه‌ای از فناوری‌ها که برای تحلیل ترکیب برنامه، وابستگی‌ها، کتابخانه‌ها و بسته‌ها به‌منظور شناسایی آسیب‌پذیری‌های امنیتی نسخه‌های خاص مؤلفه‌های مورد استفاده طراحی شده است. این مفهوم با تحلیل کد منبع (SAST) اشتباه گرفته نشود. +* **Software development lifecycle** (SDLC) – فرایند گام‌به‌گام توسعه نرم‌افزار که از نیازمندی‌های اولیه تا استقرار و نگهداری پیش می‌رود. +* **SQL Injection** (SQLi) – یک تکنیک تزریق کد که برای حمله به برنامه‌های مبتنی بر داده استفاده می‌شود و در آن دستورات SQL مخرب به یک نقطه ورودی تزریق می‌گردند. +* **Stateful Session Mechanism** – در این مکانیزم، برنامه وضعیت نشست را در سمت سرور نگه می‌دارد که معمولاً با توکن نشست مطابقت دارد و این توکن با استفاده از تولیدکننده اعداد شبه‌تصادفی امن رمزنگاری (CSPRNG) ایجاد و به کاربر نهایی ارائه می‌شود. +* **Stateless Session Mechanism** – یک مکانیزم نشست stateless از یک self-contained token استفاده می‌کند که به کلاینت‌ها منتقل می‌شود و شامل اطلاعات نشست است که لزوماً در سرویس دریافت‌کننده ذخیره نمی‌شود و سپس آن سرویس توکن را اعتبارسنجی می‌کند. در عمل، یک سرویس نیاز دارد به دسترسی به برخی اطلاعات نشست (مانند فهرست لغو JWT) تا بتواند کنترل‌های امنیتی مورد نیاز را اعمال کند. +* **Static application security testing** (SAST) – مجموعه‌ای از فناوری‌ها که برای تحلیل کد منبع، بایت‌کد و باینری‌های برنامه به‌منظور شناسایی شرایط برنامه‌نویسی و طراحی که نشان‌دهنده آسیب‌پذیری‌های امنیتی هستند طراحی شده‌اند. راهکارهای SAST برنامه را از داخل به خارج و در حالت غیر اجرایی تحلیل می‌کنند. +* **Threat Modeling** – یک تکنیک که شامل توسعه معماری‌های امنیتی به‌طور پیوسته و دقیق‌تر برای شناسایی عاملان تهدید، مناطق امنیتی، کنترل‌های امنیتی و دارایی‌های فنی و تجاری مهم است. +* **Time-of-check to time-of-use** (TOCTOU) – وضعیتی که در آن یک برنامه وضعیت یک منبع را قبل از استفاده از آن بررسی می‌کند، اما وضعیت منبع می‌تواند بین زمان بررسی و استفاده تغییر کند. این می‌تواند نتایج بررسی را نامعتبر کند و باعث شود برنامه به دلیل عدم تطابق وضعیت اقدامات نامعتبر انجام دهد. +* **Time based One-time Passwords** (TOTPs) - روشی برای تولید OTP که در آن زمان فعلی بخشی از الگوریتم تولید رمز عبور محسوب می‌شود. +* **TLS client authentication**, also called **Mutual TLS** (mTLS) – در یک اتصال استاندارد TLS، کلاینت می‌تواند از گواهی ارائه‌شده توسط سرور برای اعتبارسنجی هویت سرور استفاده کند. زمانی که احراز هویت کلاینت TLS استفاده می‌شود، کلاینت نیز از کلید خصوصی و گواهی خود استفاده می‌کند تا سرور بتواند هویت کلاینت را اعتبارسنجی کند. +* **Transport Layer Security** (TLS) – پروتکل‌های رمزنگاری که امنیت ارتباطات را بر روی اتصال شبکه فراهم می‌کنند. +* **Traversal Using Relays around NAT** (TURN) – یک افزونه از پروتکل STUN که از یک سرور TURN به‌عنوان رله استفاده می‌کند زمانی که اتصال مستقیم همتا به همتا قابل برقراری نیست. این پروتکل در RFC 8656 تعریف شده است. +* **Trusted execution environment** (TEE) - یک محیط پردازشی ایزوله که در آن برنامه‌ها می‌توانند به‌طور امن اجرا شوند، بدون توجه به باقی سیستم. +* **Trusted Platform Module** (TPM) – نوعی HSM که معمولاً به یک جزء سخت‌افزاری بزرگ‌تر مانند مادربورد متصل است و به‌عنوان ریشه اعتماد (Root of Trust) برای آن سیستم عمل می‌کند. +* **Trusted Service Layer** – هر نقطه اجرای کنترل مورد اعتماد، مانند یک میکروسرویس، API بدون سرور (Serverless API)، سمت سرور، یک API مورد اعتماد روی دستگاه کلاینت که بوت امن دارد، APIهای شرکاء یا خارجی و غیره. مورد اعتماد به این معناست که نگرانی وجود ندارد که یک کاربر غیرمورد اعتماد بتواند لایه یا کنترل‌های پیاده‌سازی‌شده در آن لایه را دور بزند یا نادیده بگیرد. +* **Uniform Resource Identifier** (URI)- یک رشته‌ی یکتا از کاراکترها که یک منبع را شناسایی می‌کند، مانند یک صفحه وب، آدرس ایمیل یا مکان‌ها. +* **Uniform Resource Locator** (URL) – رشته‌ای که مکان یک منبع در اینترنت را مشخص می‌کند. +* **Universally Unique Identifier** (UUID) – یک شماره مرجع یکتا که به‌عنوان شناسه در نرم‌افزار استفاده می‌شود. +* **Verifier** – فرد یا تیمی که یک برنامه را بر اساس الزامات OWASP ASVS بررسی می‌کند. +* **Web Real-Time Communication** (WebRTC) – یک پشته پروتکل و API وب مرتبط که برای انتقال جریان‌های چندرسانه‌ای در برنامه‌های وب استفاده می‌شود، معمولاً در زمینه کنفرانس‌های ویدیویی. این پشته بر اساس SRTP، SRTCP، DTLS، SDP و STUN/TURN ساخته شده است. +* **WebSocket over TLS** (WSS) – روشی برای امن‌سازی ارتباط وب‌سوکت از طریق قرار دادن وب‌سوکت بر روی پروتکل TLS. +* **What You See Is What You Get** (WYSIWYG) – نوعی ویرایشگر محتوای غنی که نشان می‌دهد محتوا هنگام نمایش چگونه به‌نظر می‌رسد، به‌جای آن‌که کدهایی که برای نمایش محتوا استفاده می‌شوند را نشان دهد. +* **X.509 Certificate** – یک گواهی دیجیتال است که از استاندارد بین‌المللی پذیرفته‌شده X.509 در زیرساخت کلید عمومی (PKI) استفاده می‌کند تا تأیید کند کلید عمومی متعلق به هویت کاربر، کامپیوتر یا سرویس است که در گواهی ذکر شده است. +* **XML eXternal Entity** (XXE) – نوعی موجودیت XML که می‌تواند از طریق شناسه سیستم اعلام‌شده به محتوای محلی یا راه‌دور دسترسی پیدا کند. این می‌تواند منجر به انواع حملات تزریقی شود. diff --git a/5.0/fa/0x91-Appendix-B_References.md b/5.0/fa/0x91-Appendix-B_References.md new file mode 100644 index 0000000000..a205fe1d59 --- /dev/null +++ b/5.0/fa/0x91-Appendix-B_References.md @@ -0,0 +1,39 @@ +# Appendix B: References + +پروژه‌های زیر از OWASP به‌احتمال زیاد برای کاربران و استفاده‌کنندگان این استاندارد مفید خواهند بود: + +## OWASP Core Projects + +1. OWASP Top 10 Project: [https://owasp.org/www-project-top-ten/](https://owasp.org/www-project-top-ten/) +2. OWASP Web Security Testing Guide: [https://owasp.org/www-project-web-security-testing-guide/](https://owasp.org/www-project-web-security-testing-guide/) +3. OWASP Proactive Controls: [https://owasp.org/www-project-proactive-controls/](https://owasp.org/www-project-proactive-controls/) +4. OWASP Software Assurance Maturity Model (SAMM): [https://owasp.org/www-project-samm/](https://owasp.org/www-project-samm/) +5. OWASP Secure Headers Project: [https://owasp.org/www-project-secure-headers/](https://owasp.org/www-project-secure-headers/) + +## OWASP Cheat Sheet Series project + +[این پروژه](https://owasp.org/www-project-cheat-sheets/) دارای چندین برگه راهنما (Cheat Sheet) می‌باشد که برای موضوعات مختلف در ASVS مرتبط و کاربردی خواهند بود. + +نگاشتی به ASVS وجود دارد که می‌توان آن را در اینجا پیدا کرد: [https://cheatsheetseries.owasp.org/IndexASVS.html](https://cheatsheetseries.owasp.org/IndexASVS.html) + +## Mobile Security Related Projects + +1. OWASP Mobile Security Project: [https://owasp.org/www-project-mobile-security/](https://owasp.org/www-project-mobile-security/) +2. OWASP Mobile Top 10 Risks: [https://owasp.org/www-project-mobile-top-10/](https://owasp.org/www-project-mobile-top-10/) +3. OWASP Mobile Security Testing Guide and Mobile Application Security Verification Standard: [https://owasp.org/www-project-mobile-security-testing-guide/](https://owasp.org/www-project-mobile-security-testing-guide/) + +## OWASP Internet of Things related projects + +1. OWASP Internet of Things Project: [https://owasp.org/www-project-internet-of-things/](https://owasp.org/www-project-internet-of-things/) + +## OWASP Serverless projects + +1. OWASP Serverless Project: [https://owasp.org/www-project-serverless-top-10/](https://owasp.org/www-project-serverless-top-10/) + +## Others + +به‌طور مشابه، وب‌سایت‌های زیر به‌احتمال زیاد برای کاربران و استفاده‌کنندگان این استاندارد مفید خواهند بود. + +1. SecLists Github: https://github.com/danielmiessler/SecLists +2. MITRE Common Weakness Enumeration: https://cwe.mitre.org/ +3. PCI Security Standards: https://www.pcisecuritystandards.org/standards/ diff --git a/5.0/fa/0x92-Appendix-C_Cryptography.md b/5.0/fa/0x92-Appendix-C_Cryptography.md new file mode 100644 index 0000000000..fcbbc3b84f --- /dev/null +++ b/5.0/fa/0x92-Appendix-C_Cryptography.md @@ -0,0 +1,306 @@ +# Appendix C: Cryptography Standards + +فصل «رمزنگاری» فراتر از ارائه‌ی ساده‌ی بهترین رویه‌ها عمل می‌کند. این فصل با هدف افزایش درک اصول رمزنگاری و تشویق به به‌کارگیری روش‌های امنیتی مدرن‌تر و مقاوم‌تر تدوین شده است. این پیوست، اطلاعات فنی تفصیلی مربوط به هر یک از الزامات را ارائه می‌دهد و استانداردهای کلی مطرح‌شده در فصل «رمزنگاری» را تکمیل می‌کند. + +این پیوست سطح تأیید را برای مکانیزم‌های مختلف رمزنگاری تعریف می‌کند: + +* مکانیزم‌های تأییدشده (A) می‌توانند در برنامه‌ها استفاده شوند. +* مکانیزم‌های قدیمی (L) نباید در برنامه‌ها استفاده شوند، اما ممکن است فقط برای سازگاری با برنامه‌ها یا کدهای قدیمی موجود به کار روند. اگرچه استفاده از این مکانیزم‌ها در حال حاضر به خودی خود آسیب‌پذیری محسوب نمی‌شود، اما باید هرچه سریع‌تر با مکانیزم‌های امن‌تر و آینده‌نگر جایگزین شوند. +* مکانیزم‌های غیرمجاز (D) نباید استفاده شوند زیرا در حال حاضر شکسته محسوب می‌شوند یا امنیت کافی ارائه نمی‌کنند. + +این فهرست ممکن است در زمینه یک برنامه خاص به دلایل مختلف لغو شود، از جمله: + +* تحولات جدید در حوزه رمزنگاری؛ +* رعایت مقررات و قوانین. + +## Cryptographic Inventory and Documentation + +این بخش اطلاعات تکمیلی را برای V11.1 موجودی و مستندسازی رمزنگاری ارائه می‌دهد. + +مهم است که تمام دارایی‌های رمزنگاری، مانند الگوریتم‌ها، کلیدها و گواهی‌نامه‌ها، به‌طور منظم شناسایی، فهرست‌بندی و ارزیابی شوند. برای سطح 3، این باید شامل استفاده از اسکن ایستا و پویا برای شناسایی استفاده از رمزنگاری در یک برنامه باشد. ابزارهایی مانند SAST و DAST می‌توانند در این زمینه کمک کنند، اما ممکن است ابزارهای اختصاصی برای پوشش جامع‌تر مورد نیاز باشند. نمونه‌های رایگان از این ابزارها عبارتند از: + +* [CryptoMon - Network Cryptography Monitor - using eBPF, written in python](https://github.com/Santandersecurityresearch/CryptoMon) +* [Cryptobom Forge Tool: Generating Comprehensive CBOMs from CodeQL Outputs](https://github.com/Santandersecurityresearch/cryptobom-forge) + +## Equivalent Strengths of Cryptographic Parameters + +قدرت‌های امنیتی نسبی برای سیستم‌های مختلف رمزنگاری در این جدول آمده است (از [NIST SP 800-57 Part 1](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final), صفحه71): + +| Security Strength | Symmetric Key Algorithms | Finite Field | Integer Factorization | Elliptic Curve | +| -- | -- | -- | -- | -- | +| <= 80 | 2TDEA | L = 1024
N = 160 | k = 1024 | f = 160-223 | +| 112 | 3TDEA | L = 2048
N = 224 | k = 2048 | f = 224-255 | +| 128 | AES-128 | L = 3072
N = 256 | k = 3072 | f = 256-383 | +| 192 | AES-192 | L = 7680
N = 384 | k = 7680 | f = 384-511 | +| 256 | AES-256 | L = 15360
N = 512 | k = 15360 | f = 512+ | + +نمونه‌ای از برنامه‌ها: + +* رمزنگاری میدان محدود (Finite Field Cryptography): DSA، FFDH، MQV +* رمزنگاری تجزیه عدد صحیح (Integer Factorization Cryptography): RSA +* رمزنگاری منحنی بیضوی (Elliptic Curve Cryptography): ECDSA، EdDSA، ECDH، MQV + +توجه: این بخش فرض می‌کند که هیچ کامپیوتر کوانتومی وجود ندارد؛ اگر چنین کامپیوتری وجود داشته باشد، برآوردهای سه ستون آخر دیگر معتبر نخواهند بود. + +## Random Values + +این بخش اطلاعات تکمیلی برای 5 Random Values را ارائه می‌دهد. + +| Name | Version/Reference | Notes | Status | +| :--- | :---- | :---- | :-: | +| `/dev/random` | Linux 4.8+ [(Oct 2016)](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=818e607b57c94ade9824dad63a96c2ea6b21baf3), also found in iOS, Android, and other Linux-based POSIX operating systems. Based on [RFC7539](https://datatracker.ietf.org/doc/html/rfc7539) | Utilizing ChaCha20 stream. Found in iOS [`SecRandomCopyBytes`](https://developer.apple.com/documentation/security/secrandomcopybytes(_:_:_:)?language=objc) and Android [`Secure Random`](https://developer.android.com/reference/java/security/SecureRandom) with the correct settings provided to each. | A | +| `/dev/urandom` | Linux kernel's special file for providing random data | Provides high-quality, entropy sources from hardware randomness | A | +| `AES-CTR-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | As used in common implementations, such as [Windows CNG API `BCryptGenRandom`](https://learn.microsoft.com/en-us/windows/win32/api/bcrypt/nf-bcrypt-bcryptgenrandom) set by [`BCRYPT_RNG_ALGORITHM`](https://learn.microsoft.com/en-us/windows/win32/seccng/cng-algorithm-identifiers). | A | +| `HMAC-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | | A | +| `Hash-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | | A | +| `getentropy()` | [OpenBSD](https://man.openbsd.org/getentropy.2), available in [Linux glibc 2.25+](https://man7.org/linux/man-pages/man3/getentropy.3.html) and [macOS 10.12+](https://support.apple.com/en-gb/guide/security/seca0c73a75b/web) | Provides secure random bytes directly from the kernel's entropy source with a straightforward and minimal API. It’s more modern and avoids pitfalls associated with older APIs. | A | + +تابع هش زیربنایی که در HMAC-DRBG یا Hash-DRBG استفاده می‌شود، باید برای این کاربرد تأیید شده باشد. + +## Cipher Algorithms + +این بخش اطلاعات تکمیلی برای الگوریتم‌های رمزنگاری را ارائه می‌دهد. + +الگوریتم‌های رمزنگاری تأیید شده به ترتیب اولویت فهرست شده‌اند. + +| Symmetric Key Algorithms | Reference | Status | +| ------ | ------ | :-: | +| AES-256 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | A | +| Salsa20 | [Salsa 20 specification](https://cr.yp.to/snuffle/spec.pdf) | A | +| XChaCha20 | [XChaCha20 Draft](https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-xchacha-03) | A | +| XSalsa20 | [Extending the Salsa20 nonce](https://cr.yp.to/snuffle/xsalsa-20110204.pdf) | A | +| ChaCha20 | [RFC 8439](https://www.rfc-editor.org/info/rfc8439) | A | +| AES-192 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | A | +| AES-128 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | L | +| 2TDEA | | D | +| TDEA (3DES/3DEA) | | D | +| IDEA | | D | +| RC4 | | D | +| Blowfish | | D | +| ARC4 | | D | +| DES | | D | + +### AES Cipher Modes + +رمزنگاری‌های بلوکی، مانند AES، می‌توانند با حالت‌های مختلف عملیاتی استفاده شوند. بسیاری از حالت‌های عملیاتی، مانند Electronic Codebook (ECB)، ناامن هستند و نباید استفاده شوند. حالت‌های عملیاتی Galois/Counter Mode (GCM) و Counter with Cipher Block Chaining Message Authentication Code (CCM) رمزنگاری تأیید شده (Authenticated Encryption) ارائه می‌دهند و باید در برنامه‌های مدرن استفاده شوند. + +حالت‌های تأیید شده به ترتیب اولویت فهرست شده‌اند. + +| Mode | Authenticated | Reference | Status | Restriction | +| -- | -- | -- | :-: | -- | +| GCM | Yes | [NIST SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | | +| CCM | Yes | [NIST SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | | +| CBC | No | [NIST SP 800-38A](https://csrc.nist.gov/pubs/sp/800/38/a/final) | L | | +| CCM-8 | Yes | | D | | +| ECB | No | | D | | +| CFB | No | | D | | +| OFB | No | | D | | +| CTR | No | | D | | + +یادداشت‌ها: + +* تمام پیام‌های رمزنگاری‌شده باید احراز هویت شوند. برای هر استفاده‌ای از حالت CBC، حتماً باید یک الگوریتم هش MAC مرتبط برای اعتبارسنجی پیام وجود داشته باشد. به طور کلی، این باید با روش Encrypt-Then-Hash اعمال شود (اما TLS 1.2 به جای آن از روش Hash-Then-Encrypt استفاده می‌کند). اگر این تضمین امکان‌پذیر نباشد، نباید از CBC استفاده شود. تنها کاربردی که در آن رمزنگاری بدون الگوریتم MAC مجاز است، رمزنگاری دیسک است. +* اگر از حالت CBC استفاده شود، باید تضمین شود که بررسی پدینگ (Padding) در زمان ثابت انجام می‌شود. +* هنگام استفاده از CCM-8، برچسب MAC تنها ۶۴ بیت امنیت ارائه می‌دهد. این با الزامات بند ۶.۲.۹ که حداقل ۱۲۸ بیت امنیت را نیاز دارد، مطابقت ندارد. +* رمزنگاری دیسک خارج از محدوده ASVS در نظر گرفته شده است. بنابراین، این ضمیمه هیچ روش تأیید شده‌ای برای رمزنگاری دیسک فهرست نمی‌کند. برای این کاربرد، معمولاً رمزنگاری بدون احراز هویت پذیرفته می‌شود و حالت‌های XTS، XEX و LRW معمولاً استفاده می‌شوند. + +### Key Wrapping + +بسته‌بندی کلید رمزنگاری (و باز کردن بسته‌ی مربوطه) روشی برای محافظت از یک کلید موجود است که با محصور کردن (یعنی بسته‌بندی) آن و استفاده از یک مکانیزم رمزنگاری اضافی انجام می‌شود تا کلید اصلی به‌طور آشکار در معرض دید قرار نگیرد، مثلاً هنگام انتقال. کلید اضافی که برای محافظت از کلید اصلی استفاده می‌شود، کلید بسته‌بندی (wrap key) نامیده می‌شود. + +این عملیات ممکن است زمانی انجام شود که بخواهیم کلیدها را در مکان‌هایی که قابل اعتماد نیستند محافظت کنیم، یا کلیدهای حساس را از طریق شبکه‌های غیرقابل اعتماد یا درون برنامه‌ها ارسال کنیم. + با این حال، باید با دقت به ماهیت کلید اصلی (مانند هویت و هدف آن) قبل از انجام فرآیند بسته‌بندی/بازکردن بسته توجه شود، زیرا این می‌تواند برای سیستم‌ها یا برنامه‌های مبدأ و مقصد پیامدهایی در زمینه امنیت و به ویژه تطابق قانونی داشته باشد، که ممکن است شامل مسیرهای حسابرسی عملکرد کلید (مانند امضا) و همچنین ذخیره‌سازی مناسب کلید باشد. + +به‌طور مشخص، برای بسته‌بندی کلید باید از AES-256 استفاده شود، مطابق با [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) و با در نظر گرفتن تمهیدات آینده‌نگر در برابر تهدید کوانتومی. حالت‌های رمزنگاری استفاده‌شده با AES به ترتیب اولویت به شرح زیر هستند: + +| Key Wrapping | Reference | Status | +| -- | -- | :-: | +| KW | [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) | A | +| KWP | [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) | A | + +در صورتی که مورد استفاده نیاز داشته باشد، می‌توان از AES-192 و AES-128 نیز استفاده کرد، اما دلیل استفاده از آن‌ها باید در فهرست رمزنگاری موجود در سازمان مستندسازی شود. + +### Authenticated Encryption + +به استثنای رمزنگاری دیسک، داده‌های رمزنگاری‌شده باید در برابر تغییرات غیرمجاز با استفاده از نوعی از طرح رمزنگاری احراز هویت‌شده (AE) محافظت شوند، که معمولاً از طرح رمزنگاری احراز هویت‌شده با داده‌های مرتبط (AEAD) استفاده می‌شود. + +بهتر است برنامه از یک طرح AEAD تأیید شده استفاده کند. به طور جایگزین، می‌تواند یک طرح رمزنگاری تأیید شده و یک الگوریتم MAC تأیید شده را با ساختار Encrypt-then-MAC ترکیب کند. + +روش MAC-then-encrypt همچنان برای سازگاری با برنامه‌های قدیمی مجاز است. این روش در TLS نسخه ۱.۲ با مجموعه‌های رمزنگاری قدیمی استفاده می‌شود. + +| AEAD mechanism | Reference | Status | +| --- | --------- | :-: | +| AES-GCM | [SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | +| AES-CCM | [SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | +| ChaCha-Poly1305 | [RFC 7539](https://datatracker.ietf.org/doc/html/rfc7539) | A | +| AEGIS-256 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +| AEGIS-128 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +| AEGIS-128L | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +| Encrypt-then-MAC | | A | +| MAC-then-encrypt | | L | + +## Hash Functions + +این بخش اطلاعات تکمیلی در مورد هش کردن و توابع مبتنی بر هش را ارائه می‌دهد. + +### Hash Functions for General Use Cases + +جدول زیر توابع هش تأیید شده برای کاربردهای عمومی رمزنگاری، مانند امضاهای دیجیتال، را فهرست می‌کند: + +* توابع هش تأیید شده مقاومت بالایی در برابر برخورد (collision) دارند و برای برنامه‌های با امنیت بالا مناسب هستند. +* برخی از این الگوریتم‌ها وقتی همراه با مدیریت صحیح کلیدهای رمزنگاری استفاده شوند، مقاومت بالایی در برابر حملات ارائه می‌دهند و بنابراین برای توابع HMAC، KDF و RBG نیز تأیید شده‌اند. +* توابع هش با خروجی کمتر از ۲۵۴ بیت مقاومت کافی در برابر برخورد (collision) ندارند و نباید برای امضاهای دیجیتال یا سایر کاربردهایی که نیاز به مقاومت در برابر برخورد دارند، استفاده شوند. برای سایر کاربردها، ممکن است تنها برای سازگاری و اعتبارسنجی با سیستم‌های قدیمی استفاده شوند، اما نباید در طراحی‌های جدید به کار روند. + +| Hash function | Reference | Status | Restrictions | +| ------ | ----------- | :-: | ---------- | +| SHA3-512 | [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| SHA-512 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHA3-384 | [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| SHA-384 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHA3-256 | [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| SHA-512/256 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHA-256 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHAKE256 | [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| BLAKE2s | [BLAKE2: simpler, smaller, fast as MD5](https://eprint.iacr.org/2013/322) | A | | +| BLAKE2b | [BLAKE2: simpler, smaller, fast as MD5](https://eprint.iacr.org/2013/322) | A | | +| BLAKE3 | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | | +| SHA-224 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | L | Not suitable for HMAC, KDF, RBG, digital signatures | +| SHA-512/224 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | L | Not suitable for HMAC, KDF, RBG, digital signatures | +| SHA3-224 | [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | L | Not suitable for HMAC, KDF, RBG, digital signatures | +| SHA-1 | [RFC 3174](https://www.rfc-editor.org/info/rfc3174) & [RFC 6194](https://www.rfc-editor.org/info/rfc6194) | L | Not suitable for HMAC, KDF, RBG, digital signatures | +| CRC (any length) | | D | | +| MD4 | [RFC 1320](https://www.rfc-editor.org/info/rfc1320) | D | | +| MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | | + +### Hash Functions for Password Storage + +برای هش کردن امن گذرواژه‌ها، باید از توابع هش مخصوص استفاده شود. این الگوریتم‌های هش کند، با افزایش سختی محاسباتی شکستن گذرواژه، حملات جستجوی فراگیر (brute-force) و دیکشنری را کاهش می‌دهند. + +| KDF | Reference | Required Parameters | Status | +| ---------- | --------- | ------------ | :-: | +| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1 | A | +| | | t = 2: m ≥ 19456 (19 MiB), p = 1 | A | +| | | t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | +| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8 | A | +| | | p = 2: N ≥ 2^16 (64 MiB), r = 8 | A | +| | | p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | +| bcrypt | [A Future-Adaptable Password Scheme](https://www.researchgate.net/publication/2519476_A_Future-Adaptable_Password_Scheme) | cost ≥ 10 | A | +| PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 210, 000 | A | +| PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 600, 000 | A | +| PBKDF2-HMAC-SHA-1 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 1, 300, 000 | L | + +توابع استخراج کلید مبتنی بر گذرواژه (Password-Based Key Derivation Functions) تأیید شده می‌توانند برای ذخیره‌سازی گذرواژه استفاده شوند. + +## Key Derivation Functions (KDFs) + +### General Key Derivation Functions + +| KDF | Reference | Status | +| ---------------- | -------- |:-: | +| HKDF | [RFC 5869](https://www.rfc-editor.org/info/rfc5869) | A | +| TLS 1.2 PRF | [RFC 5248](https://www.rfc-editor.org/info/rfc5248) | L | +| MD5-based KDFs | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | +| SHA-1-based KDFs | [RFC 3174](https://www.rfc-editor.org/info/rfc3174) & [RFC 6194](https://www.rfc-editor.org/info/rfc6194) | D | + +### Password-based Key Derivation Functions + +| KDF | Reference | Required Parameters | Status | +| ---------- | --------- | ------------ | :-: | +| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1 | A | +| | | t = 2: m ≥ 19456 (19 MiB), p = 1 | A | +| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8 | A | +| | | p = 2: N ≥ 2^16 (64 MiB), r = 8 | A | +| | | p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | +| PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 210, 000 | A | +| PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 600, 000 | A | +| PBKDF2-HMAC-SHA-1 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 1, 300, 000 | L | + +## Key Exchange Mechanisms + +این بخش اطلاعات تکمیلی رمزنگاری کلید عمومی را ارائه می‌دهد. + +### KEX Schemes + +برای همه طرح‌های تبادل کلید باید قدرت امنیتی ۱۱۲ بیت یا بیشتر تضمین شود و پیاده‌سازی آن‌ها باید از انتخاب پارامترهای موجود در جدول زیر پیروی کند. + +| Scheme | Domain Parameters | Forward Secrecy | Status | +| -- | -- | -- | :-: | +| Finite Field Diffie-Hellman (FFDH) | L >= 3072 & N >= 256 | Yes | A | +| Elliptic Curve Diffie-Hellman (ECDH) | f >= 256-383 | Yes | A | +| Encrypted key transport with RSA-PKCS#1 v1.5 | | No | D | + +که پارامترهای زیر عبارتند از: + +* k اندازه کلید برای کلیدهای RSA است. +* L اندازه کلید عمومی و N اندازه کلید خصوصی برای رمزنگاری بر مبنای میدان محدود است. +* f محدوده اندازه‌های کلید برای ECC است. + +هیچ پیاده‌سازی جدیدی نباید از طرحی استفاده کند که با استانداردهای [NIST SP 800-56A & B](https://csrc.nist.gov/pubs/sp/800/56/a/r3/final) و [NIST SP 800-77](https://csrc.nist.gov/pubs/sp/800/77/r1/final) مطابقت نداشته باشد. به طور مشخص، IKEv1 نباید در محیط‌های تولیدی استفاده شود. + +### Diffie-Hellman groups + +گروه‌های زیر برای پیاده‌سازی Diffie-Hellman تأیید شده‌اند. قدرت‌های امنیتی در ضمیمه D استاندارد [NIST SP 800-56A](https://csrc.nist.gov/pubs/sp/800/56/a/r3/final) و [بخش 1 نسخه 5 استاندارد NIST SP 800-57](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final) مستند شده‌اند. + +| Group | Status | +|------------------|:------:| +| P-224, secp224r1 | A | +| P-256, secp256r1 | A | +| P-384, secp384r1 | A | +| P-521, secp521r1 | A | +| K-233, sect233k1 | A | +| K-283, sect283k1 | A | +| K-409, sect409k1 | A | +| K-571, sect571k1 | A | +| B-233, sect233r1 | A | +| B-283, sect283r1 | A | +| B-409, sect409r1 | A | +| B-571, sect571r1 | A | +| Curve448 | A | +| Curve25519 | A | +| MODP-2048 | A | +| MODP-3072 | A | +| MODP-4096 | A | +| MODP-6144 | A | +| MODP-8192 | A | +| ffdhe2048 | A | +| ffdhe3072 | A | +| ffdhe4096 | A | +| ffdhe6144 | A | +| ffdhe8192 | A | + +## Message Authentication Codes (MAC) + +کدهای احراز هویت پیام (MAC) سازه‌های رمزنگاری هستند که برای بررسی صحت و اصالت یک پیام استفاده می‌شوند. یک MAC یک پیام و یک کلید مخفی را به عنوان ورودی می‌گیرد و یک برچسب با اندازه ثابت (مقدار MAC) تولید می‌کند. MACها به طور گسترده در پروتکل‌های ارتباطی امن (مانند TLS/SSL) استفاده می‌شوند تا اطمینان حاصل شود که پیام‌های تبادل‌شده بین طرفین معتبر و دست‌نخورده هستند. + +| MAC Algorithm | Reference | Status | +| ---------- | --------------- | :-: | +| HMAC-SHA-256 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| HMAC-SHA-384 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| HMAC-SHA-512 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| KMAC128 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | +| KMAC256 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | +| BLAKE3 (keyed_hash mode) | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | +| AES-CMAC | [RFC 4493](https://datatracker.ietf.org/doc/html/rfc4493) & [NIST SP 800-38B](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38b.pdf) | A | +| AES-GMAC | [NIST SP 800-38D](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf) | A | +| Poly1305-AES | [The Poly1305-AES message-authentication code](https://cr.yp.to/mac/poly1305-20050329.pdf) | A | +| HMAC-SHA-1 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | L | +| HMAC-MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | + +## Digital Signatures + +طرح‌های امضا باید از اندازه‌ها و پارامترهای کلید تأیید شده مطابق با [NIST SP 800-57 بخش 1](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final) استفاده کنند. + +| Signature Algorithm | Reference | Status | +| ------------------------------ | --------------------------------------------- | :-: | +| EdDSA (Ed25519, Ed448) | [RFC 8032](https://www.rfc-editor.org/info/rfc8032) | A | +| XEdDSA (Curve25519, Curve448) | [XEdDSA](https://signal.org/docs/specifications/xeddsa/) | A | +| ECDSA (P-256, P-384, P-521) | [FIPS 186-4](https://csrc.nist.gov/pubs/fips/186-5/final) | A | +| RSA-RSSA-PSS | [RFC 8017](https://www.rfc-editor.org/info/rfc8017) | A | +| RSA-SSA-PKCS#1 v1.5 | [RFC 8017](https://www.rfc-editor.org/info/rfc8017) | D | +| DSA (any key size) | [FIPS 186-4](https://csrc.nist.gov/pubs/fips/186-4/final) | D | + +## Post-Quantum Encryption Standards + +پیاده‌سازی‌های رمزنگاری پساکوانتومی (PQC) باید از استانداردهای [FIPS-203](https://csrc.nist.gov/pubs/fips/203/ipd)، [FIPS-204](https://csrc.nist.gov/pubs/fips/204/ipd) و [FIPS-205](https://csrc.nist.gov/pubs/fips/205/ipd) پیروی کنند. در حال حاضر، نمونه‌های کد مقاوم یا پیاده‌سازی‌های مرجع زیادی برای این استانداردها در دسترس نیست. برای جزئیات بیشتر، به [اعلامیه NIST درباره سه استاندارد نهایی‌شده رمزنگاری پساکوانتومی (اوت ۲۰۲۴) مراجعه کنید.](https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards) + +روش پیشنهادی [mlkem768x25519](https://datatracker.ietf.org/doc/draft-kwiatkowski-tls-ecdhe-mlkem/03/) برای توافق کلید هیبریدی TLS پساکوانتومی توسط مرورگرهای اصلی مانند [Firefox نسخه ۱۳۲](https://www.mozilla.org/en-US/firefox/132.0/releasenotes/) و [Chrome نسخه ۱۳۱](https://security.googleblog.com/2024/09/a-new-path-for-kyber-on-web.html) پشتیبانی می‌شود. این روش می‌تواند در محیط‌های آزمایشی رمزنگاری یا زمانی که در کتابخانه‌های تأیید شده توسط صنعت یا دولت در دسترس است، استفاده شود. diff --git a/5.0/fa/0x93-Appendix-D_Recommendations.md b/5.0/fa/0x93-Appendix-D_Recommendations.md new file mode 100644 index 0000000000..9056d502ec --- /dev/null +++ b/5.0/fa/0x93-Appendix-D_Recommendations.md @@ -0,0 +1,49 @@ +# Appendix D: Recommendations + +## Introduction + +در حین آماده‌سازی نسخه ۵.۰ استاندارد اعتبارسنجی امنیت برنامه‌ها (ASVS)، مشخص شد که تعدادی از موارد موجود و همچنین موارد پیشنهادی جدید وجود دارند که نباید به‌عنوان الزام در نسخه ۵.۰ گنجانده شوند. این موضوع یا به این دلیل بود که مطابق تعریف نسخه ۵.۰ در محدوده ASVS قرار نمی‌گرفتند، یا به این خاطر که هرچند ایده‌های خوبی بودند، اما امکان الزام‌آور کردن آن‌ها وجود نداشت. + + برای این‌که همه‌ی این موارد به‌طور کامل از دست نروند، برخی از آن‌ها در این پیوست ثبت شده‌اند. + +## Recommended, in-scope mechanisms + +موارد زیر در محدوده ASVS قرار دارند. این موارد نباید الزام‌آور شوند، اما قویاً توصیه می‌شود که به‌عنوان بخشی از یک برنامه‌ی امن مورد توجه قرار گیرند. + +* باید ابزاری برای نمایش میزان قوی یا ضعیف بودن گذرواژه در اختیار کاربران قرار داده شود تا به آن‌ها در انتخاب یک گذرواژه امن‌تر کمک کند. +* یک فایل security.txt عمومی در ریشه سایت یا پوشه .well-known برنامه ایجاد کنید که به‌وضوح یک لینک یا آدرس ایمیل برای تماس افراد با مالکین در مورد مسائل امنیتی را مشخص کند. +* اعتبارسنجی ورودی‌ها در سمت کاربر باید علاوه بر اعتبارسنجی در لایه سرویس مورد اعتماد اعمال شود، زیرا این کار فرصت خوبی برای شناسایی زمانی فراهم می‌کند که کسی تلاش کرده است با عبور از کنترل‌های سمت کاربر به برنامه حمله کند. +* جلوگیری از دسترسی تصادفی و نمایش صفحات حساس در موتورهای جستجو با استفاده از فایل robots.txt، هدر پاسخ X-Robots-Tag یا تگ متای HTML robots. +* هنگام استفاده از GraphQL، منطق احراز هویت را در لایه منطق کسب‌وکار پیاده‌سازی کنید، نه در لایه GraphQL یا resolver، تا نیازی به مدیریت احراز هویت در هر رابط جداگانه نباشد. + +مرجع: + +* [More information on security.txt including a link to the RFC](https://securitytxt.org/) + +## Software Security principles + +موارد زیر قبلاً در ASVS ذکر شده بودند، اما در واقع الزام نیستند. در عوض، این‌ها اصولی هستند که هنگام پیاده‌سازی کنترل‌های امنیتی باید در نظر گرفته شوند و رعایت آن‌ها منجر به کنترل‌های مقاوم‌تر می‌شود. این موارد شامل: + +* کنترل‌های امنیتی باید متمرکز، ساده (اقتصادی در طراحی)، قابل‌اعتبارسنجی و قابل استفاده مجدد باشند. این رویکرد باید از تکراری، ناقص یا ناکارآمد بودن کنترل‌ها جلوگیری کند. +* هرجا ممکن است، به‌جای پیاده‌سازی کنترل‌ها از ابتدا، از پیاده‌سازی‌های قبلاً نوشته شده و به‌خوبی بررسی‌شده کنترل‌های امنیتی استفاده کنید. +* به‌طور ایده‌آل، باید از یک مکانیزم کنترل دسترسی واحد برای دسترسی به داده‌ها و منابع محافظت‌شده استفاده شود. تمام درخواست‌ها باید از طریق همین مکانیزم واحد عبور کنند تا از مسیرهای جایگزین ناامن یا کپی و چسباندن جلوگیری شود. +* کنترل دسترسی مبتنی بر ویژگی یا صفت، یک الگوی پیشنهادی است که در آن کد، مجوز کاربر را برای یک ویژگی یا مورد داده بررسی می‌کند، نه صرفاً نقش او. با این حال، تخصیص دسترسی‌ها همچنان باید از طریق نقش‌ها انجام شود. + +## Software Security processes + +تعدادی از فرآیندهای امنیتی وجود دارند که از ASVS نسخه ۵.۰ حذف شده‌اند اما همچنان ایده خوبی هستند. پروژه OWASP SAMM می‌تواند منبع مناسبی برای نحوه پیاده‌سازی مؤثر این فرآیندها باشد. مواردی که قبلاً در ASVS گنجانده شده بودند، شامل: + +* استفاده از چرخه عمر توسعه نرم‌افزار امن را که امنیت را در تمامی مراحل توسعه در نظر می‌گیرد، تأیید کنید. +* استفاده از مدل‌سازی تهدید برای هر تغییر طراحی یا برنامه‌ریزی اسپرینت را تأیید کنید تا تهدیدها شناسایی شوند، برنامه‌ای برای مقابله با آن‌ها تدوین شود، پاسخ‌های مناسب به ریسک تسهیل گردد و تست‌های امنیتی هدایت شوند. +* تأیید کنید که تمام داستان‌های کاربری و ویژگی‌ها شامل محدودیت‌های عملکردی امنیتی باشند، مانند: «به‌عنوان یک کاربر، باید قادر باشم پروفایل خود را مشاهده و ویرایش کنم. نباید قادر باشم پروفایل سایر کاربران را مشاهده یا ویرایش کنم. +* اطمینان حاصل کنید که یک چک‌لیست برنامه‌نویسی امن، الزامات امنیتی، راهنما یا سیاست امنیتی در دسترس تمام توسعه‌دهندگان و تست‌کنندگان قرار دارد. +* اطمینان حاصل کنید که یک فرآیند مستمر برای بررسی وجود دارد تا کد منبع برنامه عاری از درب‌های پشتی، کدهای مخرب (مثلاً حملات سالامی، بمب‌های منطقی، بمب‌های زمانی) و ویژگی‌های مستندسازی نشده یا مخفی (مثلاً Easter eggها، ابزارهای اشکال‌زدایی ناامن) باشد. رعایت این بخش بدون دسترسی کامل به کد منبع، شامل کتابخانه‌های شخص ثالث، امکان‌پذیر نیست و بنابراین احتمالاً فقط برای برنامه‌هایی مناسب است که به بالاترین سطوح امنیت نیاز دارند. +* اطمینان حاصل کنید که مکانیزم‌هایی برای شناسایی و پاسخ به تغییرات ناخواسته پیکربندی در محیط‌های مستقر شده وجود دارد. این ممکن است شامل استفاده از زیرساخت غیرقابل تغییر، بازاستقرار خودکار از یک پایه امن، یا ابزارهای شناسایی تغییر که وضعیت فعلی را با پیکربندی‌های تأیید شده مقایسه می‌کنند، باشد. +* اطمینان حاصل کنید که امن‌سازی پیکربندی روی تمام محصولات، کتابخانه‌ها، فریم‌ورک‌ها و سرویس‌های شخص ثالث طبق توصیه‌های هر یک انجام شده باشد. + +مراجع: + +* [OWASP Threat Modeling Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html) +* [OWASP Threat modeling](https://owasp.org/www-community/Application_Threat_Modeling) +* [OWASP Software Assurance Maturity Model Project](https://owasp.org/www-project-samm/) +* [Microsoft SDL](https://www.microsoft.com/en-us/securityengineering/sdl/) diff --git a/5.0/fa/0x94-Appendix-E_Contributors.md b/5.0/fa/0x94-Appendix-E_Contributors.md new file mode 100644 index 0000000000..2a847121ac --- /dev/null +++ b/5.0/fa/0x94-Appendix-E_Contributors.md @@ -0,0 +1,71 @@ +# Appendix E - Contributors + +ما با سپاسگزاری از مشارکت افراد زیر که از زمان انتشار نسخه ۴.۰.۰ ASVS نظر داده‌اند یا درخواست‌های ادغام (Pull Request) باز کرده‌اند، قدردانی می‌کنیم. + +اگر از وجود هرگونه خطایی آگاه هستید یا ترجیح می‌دهید نام شما به شکلی متفاوت نمایش داده شود، لطفاً به ما اطلاع دهید. + +| | | | | +| --- | --- | --- | --- | +| Johan Sydseter ([sydseter](https://github.com/sydseter)) | luis servin ([lfservin](https://github.com/lfservin)) | Oleksii Dovydkov ([oleksiidov](https://github.com/oleksiidov)) | IZUKA Masahiro ([maizuka](https://github.com/maizuka)) | +| James Sulinski ([jsulinski](https://github.com/jsulinski)) | Eli Saad ([ThunderSon](https://github.com/ThunderSon)) | [kkshitish9](https://github.com/kkshitish9) | Andrew van der Stock ([vanderaj](https://github.com/vanderaj)) | +| Rick M ([kingthorin](https://github.com/kingthorin)) | Bankde Eakasit ([Bankde](https://github.com/Bankde)) | Michael Gargiullo ([mgargiullo](https://github.com/mgargiullo)) | Raphael Dunant ([Racater](https://github.com/Racater)) | +| Cesar Kohl ([cesarkohl](https://github.com/cesarkohl)) | [inaz0](https://github.com/inaz0) | Joerg Bruenner ([JoergBruenner](https://github.com/JoergBruenner)) | David Deatherage ([securitydave](https://github.com/securitydave)) | +| John Carroll ([yosignals](https://github.com/yosignals)) | Jim Fenton ([jimfenton](https://github.com/jimfenton)) | Matteo Pace ([M4tteoP](https://github.com/M4tteoP)) | Sebastien gioria ([SPoint42](https://github.com/SPoint42)) | +| Steven van der Baan ([vdbaan](https://github.com/vdbaan)) | Jeremy Bonghwan Choi ([jeremychoi](https://github.com/jeremychoi)) | [craig-shony](https://github.com/craig-shony) | Riccardo Sirigu ([ricsirigu](https://github.com/ricsirigu)) | +| Tomasz Wrobel ([tw2as](https://github.com/tw2as)) | Alena Dubeshko ([belalena](https://github.com/belalena)) | Rafael Green ([RafaelGreen1](https://github.com/RafaelGreen1)) | [mjang-cobalt](https://github.com/mjang-cobalt) | +| [clallier94](https://github.com/clallier94) | Kevin W. Wall ([kwwall](https://github.com/kwwall)) | Jordan Sherman ([jsherm-fwdsec](https://github.com/jsherm-fwdsec) / [deleterepo](https://github.com/deleterepo)) | Ingo Rauner ([ingo-rauner](https://github.com/ingo-rauner)) | +| Dirk Wetter ([drwetter](https://github.com/drwetter)) | Moshe Zioni ([moshe-apiiro](https://github.com/moshe-apiiro)) | Patrick Dwyer ([coderpatros](https://github.com/coderpatros)) | David Clarke ([davidclarke-au](https://github.com/davidclarke-au)) | +| Takaharu Ogasa ([takaharuogasa](https://github.com/takaharuogasa)) | Arkadii Yakovets ([arkid15r](https://github.com/arkid15r)) | Motoyasu Saburi ([motoyasu-saburi](https://github.com/motoyasu-saburi)) | [leirn](https://github.com/leirn) | +| [wet-certitude](https://github.com/wet-certitude) | [timhemel](https://github.com/timhemel) | RL Thornton ([thornshadow99](https://github.com/thornshadow99)) | Thomas Bandt ([aspnetde](https://github.com/aspnetde)) | +| Roel Storms ([roelstorms](https://github.com/roelstorms)) | Jeroen Willemsen ([commjoen](https://github.com/commjoen)) | [anonymous-31](https://github.com/anonymous-31) | Kamran Saifullah ([deFr0ggy](https://github.com/deFr0ggy)) | +| Steve Springett ([stevespringett](https://github.com/stevespringett)) | Spyros ([northdpole](https://github.com/northdpole)) | Hans Herrera ([hansphp](https://github.com/hansphp)) | [Marx314](https://github.com/Marx314) | +| [CarlosAllendes](https://github.com/CarlosAllendes) | Yonah Russ ([yruss972](https://github.com/yruss972)) | Sander Maijers ([sanmai-NL](https://github.com/sanmai-NL)) | Luboš Bretschneider ([bretik](https://github.com/bretik)) | +| Eva Sarafianou ([esarafianou](https://github.com/esarafianou)) | Ata Seren [ataseren](https://github.com/ataseren) | Steve Thomas ([Sc00bz](https://github.com/Sc00bz)) | Dominique RIGHETTO ([righettod](https://github.com/righettod)) | +| Steven van der Baan ([svdb-ncc](https://github.com/svdb-ncc)) | Michael Vacarella ([Aif4thah](https://github.com/Aif4thah)) | Tonimir Kisasondi ([tkisason](https://github.com/tkisason)) | Stefan Streichsbier ([streichsbaer](https://github.com/streichsbaer)) | +| [hi-unc1e](https://github.com/hi-unc1e) | sb3k ([starbuck3000](https://github.com/starbuck3000)) | [mario-platt](https://github.com/mario-platt) | Devdatta Akhawe ([devd](https://github.com/devd)) | +| Michael Gissing ([scolytus](https://github.com/scolytus)) | Jet Anderson ([thatsjet](https://github.com/thatsjet)) | Dave Wichers ([davewichers](https://github.com/davewichers)) | Jonny Schnittger ([JonnySchnittger](https://github.com/JonnySchnittger)) | +| Silvia Väli ([silviavali](https://github.com/silviavali)) | [jackgates73](https://github.com/jackgates73) | [1songb1rd](https://github.com/1songb1rd) | Timur - ([timurozkul](https://github.com/timurozkul)) | +| Gareth Heyes ([hackvertor](https://github.com/hackvertor)) | [appills](https://github.com/appills) | [suvikaartinen](https://github.com/suvikaartinen) | chaals ([chaals](https://github.com/chaals)) | +| DanielPharos ([AtlasHackert](https://github.com/AtlasHackert)) | will Farrell ([willfarrell](https://github.com/willfarrell)) | Alina Vasiljeva ([avasiljeva](https://github.com/avasiljeva)) | Paul McCann ([ismisepaul](https://github.com/ismisepaul)) | +| Sage ([SajjadPourali](https://github.com/SajjadPourali)) | [rbsec](https://github.com/rbsec) | Benedikt Bauer ([mastacheata](https://github.com/mastacheata)) | James Jardine ([jamesjardine](https://github.com/jamesjardine)) | +| Mark Burnett ([m8urnett](https://github.com/m8urnett)) | [dschwarz91](https://github.com/dschwarz91) | Cyber-AppSec ([Cyber-AppSec](https://github.com/Cyber-AppSec)) | [Tib3rius](https://github.com/Tib3rius) | +| BitnessWise ([bitnesswise](https://github.com/bitnesswise)) | damienbod ([damienbod](https://github.com/damienbod)) | Jared Meit ([jmeit-fwdsec](https://github.com/jmeit-fwdsec)) | Stefan Seelmann ([sseelmann](https://github.com/sseelmann)) | +| Brendan O'Connor ([ussjoin](https://github.com/ussjoin)) | Andrei Titov ([andrettv](https://github.com/andrettv)) | Hans-Petter Fjeld ([atluxity](https://github.com/atluxity)) | [markehack](https://github.com/markehack) | +| Neil Madden ([NeilMadden](https://github.com/NeilMadden)) | Michael Geramb ([mgeramb](https://github.com/mgeramb)) | Osama Elnaggar ([ossie-git](https://github.com/ossie-git)) | [mackowski](https://github.com/mackowski) | +| Ravi Balla ([raviballa](https://github.com/raviballa)) | Hazana ([hazanasec](https://github.com/hazanasec)) | David Means ([dmeans82](https://github.com/dmeans82)) | Alexander Stein ([tohch4](https://github.com/tohch4)) | +| BaeSenseii ([baesenseii](https://github.com/baesenseii)) | Vincent De Schutter ([VincentDS](https://github.com/VincentDS)) | S Bani ([sbani](https://github.com/sbani)) | Mitsuaki Akiyama ([mak1yama](https://github.com/mak1yama)) | +| Christopher Loessl ([hashier](https://github.com/hashier)) | [victorxm](https://github.com/victorxm) | Michal Rada ([michalradacz](https://github.com/michalradacz)) | Veeresh Devireddy ([drveresh](https://github.com/drveresh)) | +| [MaknaSEO](https://github.com/MaknaSEO) | [darkzero2022](https://github.com/darkzero2022) | Liam ([LiamDobbelaere](https://github.com/LiamDobbelaere)) | Frank Denis ([jedisct1](https://github.com/jedisct1)) | +| Otto Sulin ([ottosulin](https://github.com/ottosulin)) | [carllaw6885](https://github.com/carllaw6885) | Anders Johan Holmefjord ([aholmis](https://github.com/aholmis)) | Richard Fritsch ([rfricz](https://github.com/rfricz)) | +| [mesutgungor](https://github.com/mesutgungor) | Scott Helme ([ScottHelme](https://github.com/ScottHelme)) | Carlo Reggiani ([carloreggiani](https://github.com/carloreggiani)) | Suyash Srivastava ([suyash5053](https://github.com/suyash5053)) | +| Mark Potter ([markonweb](https://github.com/markonweb)) | Arjan Lamers ([alamers](https://github.com/alamers)) | Gøran Breivik ([gobrtg](https://github.com/gobrtg)) | [flo-blg](https://github.com/flo-blg) | +| Guillaume Déflache ([guillaume-d](https://github.com/guillaume-d)) | Toufik Airane ([toufik-airane](https://github.com/toufik-airane)) | Keith Hoodlet ([securingdev](https://github.com/securingdev)) | Sinner ([SoftwareSinner](https://github.com/SoftwareSinner)) | +| [iloving](https://github.com/iloving) | Jeroen Beckers ([TheDauntless](https://github.com/TheDauntless)) | Joubin Jabbari ([joubin](https://github.com/joubin)) | yu fujioka ([fujiokayu](https://github.com/fujiokayu)) | +| execjosh ([execjosh](https://github.com/execjosh)) | Alicja Kario ([tomato42](https://github.com/tomato42)) | Sidney Ribeiro ([srjsoftware](https://github.com/srjsoftware)) | Gabriel Marquet ([Gby56](https://github.com/Gby56)) | +| Drew Schulz ([drschulz](https://github.com/drschulz)) | [bedirhan](https://github.com/bedirhan) | [muralito](https://github.com/muralito) | Ronnie Flathers ([ropnop](https://github.com/ropnop)) | +| Philippe De Ryck ([philippederyck](https://github.com/philippederyck)) | Malte ([mal33](https://github.com/mal33)) | [MazeOfThoughts](https://github.com/MazeOfThoughts) | Andreas Falk ([andifalk](https://github.com/andifalk)) | +| Javi ([javixeneize](https://github.com/javixeneize)) | Daniel Hahn ([averell23](https://github.com/averell23)) | [borislav-c](https://github.com/borislav-c) | Robin Wood ([digininja](https://github.com/digininja)) | +| [miro2ns](https://github.com/miro2ns) | Jan Dockx ([jandockx](https://github.com/jandockx)) | [vipinsaini434](https://github.com/vipinsaini434) | [priyanshukumar397](https://github.com/priyanshukumar397) | +| Nat Sakimura ([sakimura](https://github.com/sakimura)) | Benjamin Häublein ([BenjaminHae](https://github.com/BenjaminHae)) | [unknown-user-from](https://github.com/unknown-user-from) | Ali Ramazan TAŞDELEN ([alitasdln](https://github.com/alitasdln)) | +| Pedro Escaleira ([oEscal](https://github.com/oEscal)) | Josh ([josh-hemphill](https://github.com/josh-hemphill)) | Tim Würtele ([SECtim](https://github.com/SECtim)) | AviD ([avidouglen](https://github.com/avidouglen)) | +| SheHacksPurple ([shehackspurple](https://github.com/shehackspurple)) | [fcerullo-cycubix](https://github.com/fcerullo-cycubix) | Hector Eryx Paredes Camacho ([heryxpc](https://github.com/heryxpc)) | Irene Michlin ([irene221b](https://github.com/irene221b)) | +| Jonah Y-M ([TG-Techie](https://github.com/TG-Techie)) | Dhiraj Bahroos ([bahroos](https://github.com/bahroos)) | Jef Meijvis ([jefmeijvis](https://github.com/jefmeijvis)) | [IzmaDoesItbeta](https://github.com/IzmaDoesItbeta) | +| Abdessamad TEMMAR ([TmmmmmR](https://github.com/TmmmmmR)) | [sectroyer](https://github.com/sectroyer) | Soh Satoh ([sohsatoh](https://github.com/sohsatoh)) | [regoravalaz](https://github.com/regoravalaz) | +| james-t ([james-bitherder](https://github.com/james-bitherder)) | Aram Hovsepyan ([aramhovsepyan](https://github.com/aramhovsepyan)) | [JaimeGomezGarciaSan](https://github.com/JaimeGomezGarciaSan) | [ValdiGit01](https://github.com/ValdiGit01) | +| iwatachan ([ishowta](https://github.com/ishowta)) | Vinod Anandan ([VinodAnandan](https://github.com/VinodAnandan)) | Kevin Kien ([KevinKien](https://github.com/KevinKien)) | [paul-williamson-swoop](https://github.com/paul-williamson-swoop) | +| [endergzr](https://github.com/endergzr) | Radhwan Alshamamri ([Rado0z](https://github.com/Rado0z)) | Grant Ongers ([rewtd](https://github.com/rewtd)) | Cure53 ([cure53](https://github.com/cure53)) | +| [AliR2Linux](https://github.com/AliR2Linux) | Ads Dawson ([GangGreenTemperTatum](https://github.com/GangGreenTemperTatum)) | William Reyor ([BillReyor](https://github.com/BillReyor)) | gabe ([gcrow](https://github.com/gcrow)) | +| [mascotter](https://github.com/mascotter) | [luissaiz](https://github.com/luissaiz) | Suren Manukyan ([vx-sec](https://github.com/vx-sec)) | Piotr Gliźniewicz ([pglizniewicz](https://github.com/pglizniewicz)) | +| Tadeusz Wachowski ([tadeuszwachowski](https://github.com/tadeuszwachowski)) | Nasir aka Nate ([andesec](https://github.com/andesec)) | [settantasette](https://github.com/settantasette) | Lars Haulin ([LarsH](https://github.com/LarsH)) | +| Terence Eden ([edent](https://github.com/edent)) | [JasmineScholz](https://github.com/JasmineScholz) | Arun Sivadasan ([teavanist](https://github.com/teavanist)) | Yusuf GÜR ([yusuffgur](https://github.com/yusuffgur)) | +| Troy Marshall ([troymarshall](https://github.com/troymarshall)) | Tanner Prynn ([tprynn](https://github.com/tprynn)) | Nick K. ([nickific](https://github.com/nickific)) | [raoul361](https://github.com/raoul361) | +| Azeem Ilyas ([TheAxZim](https://github.com/TheAxZim)) | Evo Stamatov ([avioli](https://github.com/avioli)) | Tim Potter ([timpotter87](https://github.com/timpotter87)) | Gavin Ray ([GavinRay97](https://github.com/GavinRay97)) | +| monis ([demideus](https://github.com/demideus)) | Marcin Hoppe ([MarcinHoppe](https://github.com/MarcinHoppe)) | Grambulf ([ramshazar](https://github.com/ramshazar)) | Jordan Pike ([computersarebad](https://github.com/computersarebad)) | +| Jason Rogers ([jason-invision](https://github.com/jason-invision)) | Ben Hall ([benbhall](https://github.com/benbhall)) | JamesPoppyCock ([jamesly123](https://github.com/jamesly123)) | WhiteHackLabs ([whitehacklabs](https://github.com/whitehacklabs)) | +| Alex Gaynor ([alex](https://github.com/alex)) | Filip van Laenen ([filipvanlaenen](https://github.com/filipvanlaenen)) | [jeurgen](https://github.com/jeurgen) | [GraoMelo](https://github.com/GraoMelo) | +| Andreas Kurtz ([ay-kay](https://github.com/ay-kay)) | Tom Tervoort ([TomTervoort](https://github.com/TomTervoort)) | old man ([deveras](https://github.com/deveras)) | Marco Schnüriger ([marcortw](https://github.com/marcortw)) | +| [stiiin](https://github.com/stiiin) | infoseclearn ([teaminfoseclearn](https://github.com/teaminfoseclearn)) | [hljupkij](https://github.com/hljupkij) | Noe ([nmarher](https://github.com/nmarher)) | +| Lyz ([lyz-code](https://github.com/lyz-code)) | Martin Riedel ([mrtnrdl](https://github.com/mrtnrdl)) | KIM Jaesuck ([tcaesvk](https://github.com/tcaesvk)) | Barbara Schachner ([bschach](https://github.com/bschach)) | +| René Reuter ([AresSec](https://github.com/AresSec)) | [carhackpils](https://github.com/carhackpils) | Tyler ([tyler2cr](https://github.com/tyler2cr)) | Hugo ([hasousa](https://github.com/hasousa)) | +| Wouter Bloeyaert ([Someniak](https://github.com/Someniak)) | Mark de Rijk ([markderijkinfosec](https://github.com/markderijkinfosec)) | Ramin ([picohub](https://github.com/picohub)) | Philip D. Turner ([philipdturner](https://github.com/philipdturner)) | +| Will Chatham ([willc](https://github.com/willc)) | | | | diff --git a/5.0/mappings/nist.md b/5.0/mappings/nist.md index 1cfb69e4d2..e1e19ceaec 100644 --- a/5.0/mappings/nist.md +++ b/5.0/mappings/nist.md @@ -5,11 +5,11 @@ | **2.1.1** | 5.1.1.2 | | **2.1.2** | 5.1.1.2 | | **2.1.3** | 5.1.1.2 | -| **2.1.4** | | +| **2.1.4** | | | **2.1.5** | 5.1.1.2 | | **2.1.6** | 5.1.1.2 | | **2.1.7** | 5.1.1.2 | -| **2.1.8** | | +| **2.1.8** | | | **2.1.9** | 5.1.1.2 | | **2.1.10** | 5.1.1.2 | | **2.1.11** | 5.1.1.2 | @@ -17,31 +17,31 @@ | **2.1.13** | 5.1.1.2 | | **2.1.14** | 5.1.1.2 | | **2.2.1** | 5.2.2 | -| **2.2.2** | | +| **2.2.2** | | | **2.2.3** | 6.1.2 | | **2.2.4** | 4.3.1 | -| **2.2.5** | | -| **2.2.6** | | -| **2.2.7** | | -| **2.2.8** | | +| **2.2.5** | | +| **2.2.6** | | +| **2.2.7** | | +| **2.2.8** | | | **2.2.9** | 4.2.1 | -| **2.2.10** | | -| **2.2.11** | | +| **2.2.10** | | +| **2.2.11** | | | **2.3.1** | 5.1.1.2 / A.3 | -| **2.3.2** | | +| **2.3.2** | | | **2.3.3** | 6.1.4 | -| **2.3.4** | | -| **2.4.1** | | -| **2.4.2** | | -| **2.4.3** | | -| **2.4.4** | | -| **2.4.5** | | -| **2.4.6** | | -| **2.5.1** | | +| **2.3.4** | | +| **2.4.1** | | +| **2.4.2** | | +| **2.4.3** | | +| **2.4.4** | | +| **2.4.5** | | +| **2.4.6** | | +| **2.5.1** | | | **2.5.2** | 5.1.1.2 | -| **2.5.3** | | -| **2.5.4** | | -| **2.5.5** | | +| **2.5.3** | | +| **2.5.4** | | +| **2.5.5** | | | **2.5.6** | 5.1.1.2 | | **2.5.7** | 6.1.2.3 | | **2.6.1** | 5.1.2.2 | @@ -52,59 +52,59 @@ | **2.7.2** | 5.1.3.2 | | **2.7.3** | 5.1.3.2 | | **2.7.4** | 5.1.3.2 | -| **2.7.5** | | +| **2.7.5** | | | **2.7.6** | 5.1.3.2 | | **2.7.7** | 5.1.3.2 | -| **2.7.8** | | +| **2.7.8** | | | **2.8.1** | 5.1.4.2 / 5.1.5.2 | | **2.8.2** | 5.1.4.2 / 5.1.5.2 | | **2.8.3** | 5.1.4.2 / 5.1.5.2 | | **2.8.4** | 5.1.4.2 / 5.1.5.2 | -| **2.8.5** | | +| **2.8.5** | | | **2.8.6** | 5.2.1 | | **2.8.7** | 5.2.3 | | **2.8.8** | 5.1.4.2 / 5.1.5.2 | | **2.9.1** | 5.1.7.2 | | **2.9.2** | 5.1.7.2 | | **2.9.3** | 5.1.7.2 | -| **2.10.1** | | -| **2.10.2** | | -| **2.10.3** | | -| **2.10.4** | | -| **2.11.1** | | -| **2.11.2** | | -| **2.11.3** | | -| **3.1.1** | | -| **3.1.2** | | +| **2.10.1** | | +| **2.10.2** | | +| **2.10.3** | | +| **2.10.4** | | +| **2.11.1** | | +| **2.11.2** | | +| **2.11.3** | | +| **3.1.1** | | +| **3.1.2** | | | **3.1.3** | 7.1 | -| **3.1.4** | | +| **3.1.4** | | | **3.2.1** | 7.1 | -| **3.2.2** | | -| **3.2.3** | | -| **3.2.4** | | -| **3.2.5** | | -| **3.3.1** | | -| **3.3.2** | | -| **3.3.3** | | -| **3.3.4** | | +| **3.2.2** | | +| **3.2.3** | | +| **3.2.4** | | +| **3.2.5** | | +| **3.3.1** | | +| **3.3.2** | | +| **3.3.3** | | +| **3.3.4** | | | **3.3.5** | 7.2 | | **3.4.1** | 7.1.1 | | **3.4.2** | 7.1.1 | | **3.4.3** | 7.1.1 | | **3.4.4** | 7.1.1 | -| **3.4.5** | | +| **3.4.5** | | | **3.5.1** | 7.1.2 | -| **3.5.2** | | -| **3.5.3** | | -| **3.5.4** | | -| **3.5.5** | | -| **3.5.6** | | +| **3.5.2** | | +| **3.5.3** | | +| **3.5.4** | | +| **3.5.5** | | +| **3.5.6** | | | **3.6.1** | 7.2.1 | -| **3.6.2** | | -| **3.7.1** | | -| **3.7.2** | | +| **3.6.2** | | +| **3.7.1** | | +| **3.7.2** | | | **3.8.1** | 7.1 | -| **3.8.2** | | -| **3.8.3** | | -| **3.8.4** | | +| **3.8.2** | | +| **3.8.3** | | +| **3.8.4** | | | **3.8.5** | 7.1 | From c889fda7d53047df9d01ade27bac9dc6d60e1ccc Mon Sep 17 00:00:00 2001 From: tghosth Date: Thu, 16 Jul 2026 15:45:02 +0300 Subject: [PATCH 80/93] Revert unrelated changes from Persian translation branch --- .github/ISSUE_TEMPLATE/standard-asvs-issue.md | 12 + .../workflows/config/url-checker-config.json | 1 - .github/workflows/spell-check.yml | 2 +- .github/workflows/url-checker.yml | 91 +- 4.0/en/0x90-Appendix-A_Glossary.md | 2 +- ...ecurity_Verification_Standard_5.0.0_fr.pdf | Bin 0 -> 577938 bytes ...ecurity_Verification_Standard_5.0.0_ko.pdf | Bin 0 -> 602946 bytes ...ecurity_Verification_Standard_5.0.0_ru.pdf | Bin 0 -> 572381 bytes ...ecurity_Verification_Standard_5.0.0_tr.pdf | Bin 0 -> 544438 bytes ...ty_Verification_Standard_5.0.0_fr.cdx.json | 3057 +++++++ ...ecurity_Verification_Standard_5.0.0_fr.csv | 347 + ...curity_Verification_Standard_5.0.0_fr.docx | Bin 0 -> 225553 bytes ...y_Verification_Standard_5.0.0_fr.flat.json | 3109 +++++++ ...ication_Standard_5.0.0_fr.flat.legacy.json | 4489 ++++++++++ ...curity_Verification_Standard_5.0.0_fr.json | 2774 +++++++ ..._Verification_Standard_5.0.0_fr.legacy.csv | 347 + ...Verification_Standard_5.0.0_fr.legacy.json | 7259 +++++++++++++++++ ..._Verification_Standard_5.0.0_fr.legacy.xml | 1 + ...ecurity_Verification_Standard_5.0.0_fr.xml | 1 + 5.0/docs_fr/fr | 0 ...ty_Verification_Standard_5.0.0_ko.cdx.json | 3057 +++++++ ...ecurity_Verification_Standard_5.0.0_ko.csv | 347 + ...curity_Verification_Standard_5.0.0_ko.docx | Bin 0 -> 224281 bytes ...y_Verification_Standard_5.0.0_ko.flat.json | 3109 +++++++ ...ication_Standard_5.0.0_ko.flat.legacy.json | 4489 ++++++++++ ...curity_Verification_Standard_5.0.0_ko.json | 2774 +++++++ ..._Verification_Standard_5.0.0_ko.legacy.csv | 347 + ...Verification_Standard_5.0.0_ko.legacy.json | 7259 +++++++++++++++++ ..._Verification_Standard_5.0.0_ko.legacy.xml | 1 + ...ecurity_Verification_Standard_5.0.0_ko.xml | 1 + ...ty_Verification_Standard_5.0.0_ru.cdx.json | 3057 +++++++ ...ecurity_Verification_Standard_5.0.0_ru.csv | 347 + ...curity_Verification_Standard_5.0.0_ru.docx | Bin 0 -> 243966 bytes ...y_Verification_Standard_5.0.0_ru.flat.json | 3109 +++++++ ...ication_Standard_5.0.0_ru.flat.legacy.json | 4489 ++++++++++ ...curity_Verification_Standard_5.0.0_ru.json | 2774 +++++++ ..._Verification_Standard_5.0.0_ru.legacy.csv | 347 + ...Verification_Standard_5.0.0_ru.legacy.json | 7259 +++++++++++++++++ ..._Verification_Standard_5.0.0_ru.legacy.xml | 1 + ...ecurity_Verification_Standard_5.0.0_ru.xml | 1 + 5.0/docs_ru/ru | 0 ...ty_Verification_Standard_5.0.0_tr.cdx.json | 3029 +++++++ ...ecurity_Verification_Standard_5.0.0_tr.csv | 343 + ...curity_Verification_Standard_5.0.0_tr.docx | Bin 0 -> 223892 bytes ...y_Verification_Standard_5.0.0_tr.flat.json | 3073 +++++++ ...ication_Standard_5.0.0_tr.flat.legacy.json | 4437 ++++++++++ ...curity_Verification_Standard_5.0.0_tr.json | 2750 +++++++ ..._Verification_Standard_5.0.0_tr.legacy.csv | 343 + ...Verification_Standard_5.0.0_tr.legacy.json | 7183 ++++++++++++++++ ..._Verification_Standard_5.0.0_tr.legacy.xml | 1 + ...ecurity_Verification_Standard_5.0.0_tr.xml | 1 + 5.0/docs_tr/tr | 0 5.0/en/0x01-Frontispiece.md | 9 +- 5.0/en/0x03-What-is-the-ASVS.md | 20 +- 5.0/en/0x04-Assessment_and_Certification.md | 6 +- 5.0/en/0x21-V12-Secure-Communication.md | 2 +- 5.0/en/0x90-Appendix-A_Glossary.md | 4 +- 5.0/en/0x91-Appendix-B_References.md | 6 +- 5.0/en/0x92-Appendix-C_Cryptography.md | 132 +- 5.0/en/0x93-Appendix-D_Recommendations.md | 2 +- 5.0/en/0x94-Appendix-E_Contributors.md | 128 +- 5.0/fr/0x00-Header.yaml | 16 + 5.0/fr/0x01-Frontispiece.md | 46 + 5.0/fr/0x02-Preface.md | 29 + 5.0/fr/0x03-What-is-the-ASVS.md | 195 + 5.0/fr/0x04-Assessment_and_Certification.md | 47 + 5.0/fr/0x05-For-Users-Of-4.0.md | 90 + 5.0/fr/0x10-V1-Encoding-and-Sanitization.md | 103 + .../0x11-V2-Validation-and-Business-Logic.md | 73 + 5.0/fr/0x12-V3-Web-Frontend-Security.md | 100 + 5.0/fr/0x13-V4-API-and-Web-Service.md | 64 + 5.0/fr/0x14-V5-File-Handling.md | 54 + 5.0/fr/0x15-V6-Authentication.md | 166 + 5.0/fr/0x16-V7-Session-Management.md | 91 + 5.0/fr/0x17-V8-Authorization.md | 56 + 5.0/fr/0x18-V9-Self-contained-Tokens.md | 36 + 5.0/fr/0x19-V10-OAuth-and-OIDC.md | 169 + 5.0/fr/0x20-V11-Cryptography.md | 107 + 5.0/fr/0x21-V12-Secure-Communication.md | 57 + 5.0/fr/0x22-V13-Configuration.md | 68 + 5.0/fr/0x23-V14-Data-Protection.md | 60 + ...0x24-V15-Secure-Coding-and-Architecture.md | 77 + ...V16-Security-Logging-and-Error-Handling.md | 84 + 5.0/fr/0x26-V17-WebRTC.md | 75 + 5.0/fr/0x90-Appendix-A_Glossary.md | 89 + 5.0/fr/0x91-Appendix-B_References.md | 43 + 5.0/fr/0x92-Appendix-C_Cryptography.md | 312 + 5.0/fr/0x93-Appendix-D_Recommendations.md | 49 + 5.0/fr/0x94-Appendix-E_Contributors.md | 71 + 5.0/ko/0x00-Header.yaml | 16 + 5.0/ko/0x01-Frontispiece.md | 46 + 5.0/ko/0x02-Preface.md | 29 + 5.0/ko/0x03-What-is-the-ASVS.md | 195 + 5.0/ko/0x04-Assessment_and_Certification.md | 47 + 5.0/ko/0x05-For-Users-Of-4.0.md | 90 + 5.0/ko/0x10-V1-Encoding-and-Sanitization.md | 103 + .../0x11-V2-Validation-and-Business-Logic.md | 73 + 5.0/ko/0x12-V3-Web-Frontend-Security.md | 100 + 5.0/ko/0x13-V4-API-and-Web-Service.md | 64 + 5.0/ko/0x14-V5-File-Handling.md | 54 + 5.0/ko/0x15-V6-Authentication.md | 166 + 5.0/ko/0x16-V7-Session-Management.md | 91 + 5.0/ko/0x17-V8-Authorization.md | 56 + 5.0/ko/0x18-V9-Self-contained-Tokens.md | 36 + 5.0/ko/0x19-V10-OAuth-and-OIDC.md | 169 + 5.0/ko/0x20-V11-Cryptography.md | 107 + 5.0/ko/0x21-V12-Secure-Communication.md | 57 + 5.0/ko/0x22-V13-Configuration.md | 68 + 5.0/ko/0x23-V14-Data-Protection.md | 60 + ...0x24-V15-Secure-Coding-and-Architecture.md | 77 + ...V16-Security-Logging-and-Error-Handling.md | 84 + 5.0/ko/0x26-V17-WebRTC.md | 75 + 5.0/ko/0x90-Appendix-A_Glossary.md | 89 + 5.0/ko/0x91-Appendix-B_References.md | 43 + 5.0/ko/0x92-Appendix-C_Cryptography.md | 311 + 5.0/ko/0x93-Appendix-D_Recommendations.md | 49 + 5.0/ko/0x94-Appendix-E_Contributors.md | 71 + 5.0/mappings/README.md | 2 +- 5.0/mappings/nist.md | 108 +- 5.0/ru/0x00-Header.yaml | 15 + 5.0/ru/0x01-Frontispiece.md | 46 + 5.0/ru/0x02-Preface.md | 29 + 5.0/ru/0x03-What-is-the-ASVS.md | 195 + 5.0/ru/0x04-Assessment_and_Certification.md | 47 + 5.0/ru/0x05-For-Users-Of-4.0.md | 90 + 5.0/ru/0x10-V1-Encoding-and-Sanitization.md | 103 + .../0x11-V2-Validation-and-Business-Logic.md | 73 + 5.0/ru/0x12-V3-Web-Frontend-Security.md | 100 + 5.0/ru/0x13-V4-API-and-Web-Service.md | 64 + 5.0/ru/0x14-V5-File-Handling.md | 54 + 5.0/ru/0x15-V6-Authentication.md | 166 + 5.0/ru/0x16-V7-Session-Management.md | 91 + 5.0/ru/0x17-V8-Authorization.md | 56 + 5.0/ru/0x18-V9-Self-contained-Tokens.md | 36 + 5.0/ru/0x19-V10-OAuth-and-OIDC.md | 169 + 5.0/ru/0x20-V11-Cryptography.md | 107 + 5.0/ru/0x21-V12-Secure-Communication.md | 57 + 5.0/ru/0x22-V13-Configuration.md | 68 + 5.0/ru/0x23-V14-Data-Protection.md | 60 + ...0x24-V15-Secure-Coding-and-Architecture.md | 77 + ...V16-Security-Logging-and-Error-Handling.md | 84 + 5.0/ru/0x26-V17-WebRTC.md | 75 + 5.0/ru/0x90-Appendix-A_Glossary.md | 89 + 5.0/ru/0x91-Appendix-B_References.md | 43 + 5.0/ru/0x92-Appendix-C_Cryptography.md | 312 + 5.0/ru/0x93-Appendix-D_Recommendations.md | 49 + 5.0/ru/0x94-Appendix-E_Contributors.md | 71 + 5.0/tools/cyclonedx.py | 87 +- 5.0/tr/0x00-Header.yaml | 16 + 5.0/tr/0x01-Frontispiece.md | 46 + 5.0/tr/0x02-Preface.md | 29 + 5.0/tr/0x03-What-is-the-ASVS.md | 195 + 5.0/tr/0x04-Assessment_and_Certification.md | 47 + 5.0/tr/0x05-For-Users-Of-4.0.md | 90 + 5.0/tr/0x10-V1-Encoding-and-Sanitization.md | 104 + .../0x11-V2-Validation-and-Business-Logic.md | 73 + 5.0/tr/0x12-V3-Web-Frontend-Security.md | 101 + 5.0/tr/0x13-V4-API-and-Web-Service.md | 64 + 5.0/tr/0x14-V5-File-Handling.md | 54 + 5.0/tr/0x15-V6-Authentication.md | 166 + 5.0/tr/0x16-V7-Session-Management.md | 91 + 5.0/tr/0x17-V8-Authorization.md | 56 + 5.0/tr/0x18-V9-Self-contained-Tokens.md | 36 + 5.0/tr/0x19-V10-OAuth-and-OIDC.md | 169 + 5.0/tr/0x20-V11-Cryptography.md | 107 + 5.0/tr/0x21-V12-Secure-Communication.md | 57 + 5.0/tr/0x22-V13-Configuration.md | 68 + 5.0/tr/0x23-V14-Data-Protection.md | 60 + ...0x24-V15-Secure-Coding-and-Architecture.md | 77 + ...V16-Security-Logging-and-Error-Handling.md | 84 + 5.0/tr/0x26-V17-WebRTC.md | 75 + 5.0/tr/0x90-Appendix-A_Glossary.md | 88 + 5.0/tr/0x91-Appendix-B_References.md | 43 + 5.0/tr/0x92-Appendix-C_Cryptography.md | 312 + 5.0/tr/0x93-Appendix-D_Recommendations.md | 49 + 5.0/tr/0x94-Appendix-E_Contributors.md | 71 + COMPILING.md | 2 +- CONTRIBUTING.md | 106 +- README.md | 6 +- SUPPORTERS.md | 13 +- 180 files changed, 95361 insertions(+), 399 deletions(-) create mode 100644 5.0/OWASP_Application_Security_Verification_Standard_5.0.0_fr.pdf create mode 100644 5.0/OWASP_Application_Security_Verification_Standard_5.0.0_ko.pdf create mode 100644 5.0/OWASP_Application_Security_Verification_Standard_5.0.0_ru.pdf create mode 100644 5.0/OWASP_Application_Security_Verification_Standard_5.0.0_tr.pdf create mode 100644 5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.cdx.json create mode 100644 5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.csv create mode 100644 5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.docx create mode 100644 5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.flat.json create mode 100644 5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.flat.legacy.json create mode 100644 5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.json create mode 100644 5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.csv create mode 100644 5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.json create mode 100644 5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.xml create mode 100644 5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.xml create mode 100644 5.0/docs_fr/fr create mode 100644 5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.cdx.json create mode 100644 5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.csv create mode 100644 5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.docx create mode 100644 5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.flat.json create mode 100644 5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.flat.legacy.json create mode 100644 5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.json create mode 100644 5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.legacy.csv create mode 100644 5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.legacy.json create mode 100644 5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.legacy.xml create mode 100644 5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.xml create mode 100644 5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.cdx.json create mode 100644 5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.csv create mode 100644 5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.docx create mode 100644 5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.flat.json create mode 100644 5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.flat.legacy.json create mode 100644 5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.json create mode 100644 5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.csv create mode 100644 5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.json create mode 100644 5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.xml create mode 100644 5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.xml create mode 100644 5.0/docs_ru/ru create mode 100644 5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.cdx.json create mode 100644 5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.csv create mode 100644 5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.docx create mode 100644 5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.flat.json create mode 100644 5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.flat.legacy.json create mode 100644 5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.json create mode 100644 5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.csv create mode 100644 5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.json create mode 100644 5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.xml create mode 100644 5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.xml create mode 100644 5.0/docs_tr/tr create mode 100644 5.0/fr/0x00-Header.yaml create mode 100644 5.0/fr/0x01-Frontispiece.md create mode 100644 5.0/fr/0x02-Preface.md create mode 100644 5.0/fr/0x03-What-is-the-ASVS.md create mode 100644 5.0/fr/0x04-Assessment_and_Certification.md create mode 100644 5.0/fr/0x05-For-Users-Of-4.0.md create mode 100644 5.0/fr/0x10-V1-Encoding-and-Sanitization.md create mode 100644 5.0/fr/0x11-V2-Validation-and-Business-Logic.md create mode 100644 5.0/fr/0x12-V3-Web-Frontend-Security.md create mode 100644 5.0/fr/0x13-V4-API-and-Web-Service.md create mode 100644 5.0/fr/0x14-V5-File-Handling.md create mode 100644 5.0/fr/0x15-V6-Authentication.md create mode 100644 5.0/fr/0x16-V7-Session-Management.md create mode 100644 5.0/fr/0x17-V8-Authorization.md create mode 100644 5.0/fr/0x18-V9-Self-contained-Tokens.md create mode 100644 5.0/fr/0x19-V10-OAuth-and-OIDC.md create mode 100644 5.0/fr/0x20-V11-Cryptography.md create mode 100644 5.0/fr/0x21-V12-Secure-Communication.md create mode 100644 5.0/fr/0x22-V13-Configuration.md create mode 100644 5.0/fr/0x23-V14-Data-Protection.md create mode 100644 5.0/fr/0x24-V15-Secure-Coding-and-Architecture.md create mode 100644 5.0/fr/0x25-V16-Security-Logging-and-Error-Handling.md create mode 100644 5.0/fr/0x26-V17-WebRTC.md create mode 100644 5.0/fr/0x90-Appendix-A_Glossary.md create mode 100644 5.0/fr/0x91-Appendix-B_References.md create mode 100644 5.0/fr/0x92-Appendix-C_Cryptography.md create mode 100644 5.0/fr/0x93-Appendix-D_Recommendations.md create mode 100644 5.0/fr/0x94-Appendix-E_Contributors.md create mode 100644 5.0/ko/0x00-Header.yaml create mode 100644 5.0/ko/0x01-Frontispiece.md create mode 100644 5.0/ko/0x02-Preface.md create mode 100644 5.0/ko/0x03-What-is-the-ASVS.md create mode 100644 5.0/ko/0x04-Assessment_and_Certification.md create mode 100644 5.0/ko/0x05-For-Users-Of-4.0.md create mode 100644 5.0/ko/0x10-V1-Encoding-and-Sanitization.md create mode 100644 5.0/ko/0x11-V2-Validation-and-Business-Logic.md create mode 100644 5.0/ko/0x12-V3-Web-Frontend-Security.md create mode 100644 5.0/ko/0x13-V4-API-and-Web-Service.md create mode 100644 5.0/ko/0x14-V5-File-Handling.md create mode 100644 5.0/ko/0x15-V6-Authentication.md create mode 100644 5.0/ko/0x16-V7-Session-Management.md create mode 100644 5.0/ko/0x17-V8-Authorization.md create mode 100644 5.0/ko/0x18-V9-Self-contained-Tokens.md create mode 100644 5.0/ko/0x19-V10-OAuth-and-OIDC.md create mode 100644 5.0/ko/0x20-V11-Cryptography.md create mode 100644 5.0/ko/0x21-V12-Secure-Communication.md create mode 100644 5.0/ko/0x22-V13-Configuration.md create mode 100644 5.0/ko/0x23-V14-Data-Protection.md create mode 100644 5.0/ko/0x24-V15-Secure-Coding-and-Architecture.md create mode 100644 5.0/ko/0x25-V16-Security-Logging-and-Error-Handling.md create mode 100644 5.0/ko/0x26-V17-WebRTC.md create mode 100644 5.0/ko/0x90-Appendix-A_Glossary.md create mode 100644 5.0/ko/0x91-Appendix-B_References.md create mode 100644 5.0/ko/0x92-Appendix-C_Cryptography.md create mode 100644 5.0/ko/0x93-Appendix-D_Recommendations.md create mode 100644 5.0/ko/0x94-Appendix-E_Contributors.md create mode 100644 5.0/ru/0x00-Header.yaml create mode 100644 5.0/ru/0x01-Frontispiece.md create mode 100644 5.0/ru/0x02-Preface.md create mode 100644 5.0/ru/0x03-What-is-the-ASVS.md create mode 100644 5.0/ru/0x04-Assessment_and_Certification.md create mode 100644 5.0/ru/0x05-For-Users-Of-4.0.md create mode 100644 5.0/ru/0x10-V1-Encoding-and-Sanitization.md create mode 100644 5.0/ru/0x11-V2-Validation-and-Business-Logic.md create mode 100644 5.0/ru/0x12-V3-Web-Frontend-Security.md create mode 100644 5.0/ru/0x13-V4-API-and-Web-Service.md create mode 100644 5.0/ru/0x14-V5-File-Handling.md create mode 100644 5.0/ru/0x15-V6-Authentication.md create mode 100644 5.0/ru/0x16-V7-Session-Management.md create mode 100644 5.0/ru/0x17-V8-Authorization.md create mode 100644 5.0/ru/0x18-V9-Self-contained-Tokens.md create mode 100644 5.0/ru/0x19-V10-OAuth-and-OIDC.md create mode 100644 5.0/ru/0x20-V11-Cryptography.md create mode 100644 5.0/ru/0x21-V12-Secure-Communication.md create mode 100644 5.0/ru/0x22-V13-Configuration.md create mode 100644 5.0/ru/0x23-V14-Data-Protection.md create mode 100644 5.0/ru/0x24-V15-Secure-Coding-and-Architecture.md create mode 100644 5.0/ru/0x25-V16-Security-Logging-and-Error-Handling.md create mode 100644 5.0/ru/0x26-V17-WebRTC.md create mode 100644 5.0/ru/0x90-Appendix-A_Glossary.md create mode 100644 5.0/ru/0x91-Appendix-B_References.md create mode 100644 5.0/ru/0x92-Appendix-C_Cryptography.md create mode 100644 5.0/ru/0x93-Appendix-D_Recommendations.md create mode 100644 5.0/ru/0x94-Appendix-E_Contributors.md create mode 100644 5.0/tr/0x00-Header.yaml create mode 100644 5.0/tr/0x01-Frontispiece.md create mode 100644 5.0/tr/0x02-Preface.md create mode 100644 5.0/tr/0x03-What-is-the-ASVS.md create mode 100644 5.0/tr/0x04-Assessment_and_Certification.md create mode 100644 5.0/tr/0x05-For-Users-Of-4.0.md create mode 100644 5.0/tr/0x10-V1-Encoding-and-Sanitization.md create mode 100644 5.0/tr/0x11-V2-Validation-and-Business-Logic.md create mode 100644 5.0/tr/0x12-V3-Web-Frontend-Security.md create mode 100644 5.0/tr/0x13-V4-API-and-Web-Service.md create mode 100644 5.0/tr/0x14-V5-File-Handling.md create mode 100644 5.0/tr/0x15-V6-Authentication.md create mode 100644 5.0/tr/0x16-V7-Session-Management.md create mode 100644 5.0/tr/0x17-V8-Authorization.md create mode 100644 5.0/tr/0x18-V9-Self-contained-Tokens.md create mode 100644 5.0/tr/0x19-V10-OAuth-and-OIDC.md create mode 100644 5.0/tr/0x20-V11-Cryptography.md create mode 100644 5.0/tr/0x21-V12-Secure-Communication.md create mode 100644 5.0/tr/0x22-V13-Configuration.md create mode 100644 5.0/tr/0x23-V14-Data-Protection.md create mode 100644 5.0/tr/0x24-V15-Secure-Coding-and-Architecture.md create mode 100644 5.0/tr/0x25-V16-Security-Logging-and-Error-Handling.md create mode 100644 5.0/tr/0x26-V17-WebRTC.md create mode 100644 5.0/tr/0x90-Appendix-A_Glossary.md create mode 100644 5.0/tr/0x91-Appendix-B_References.md create mode 100644 5.0/tr/0x92-Appendix-C_Cryptography.md create mode 100644 5.0/tr/0x93-Appendix-D_Recommendations.md create mode 100644 5.0/tr/0x94-Appendix-E_Contributors.md diff --git a/.github/ISSUE_TEMPLATE/standard-asvs-issue.md b/.github/ISSUE_TEMPLATE/standard-asvs-issue.md index b518b93a6c..7608fd4391 100644 --- a/.github/ISSUE_TEMPLATE/standard-asvs-issue.md +++ b/.github/ISSUE_TEMPLATE/standard-asvs-issue.md @@ -7,6 +7,18 @@ assignees: '' --- M=7&h z!n3bJFFz|fvhatmBMjBD0ZF0MI~J-EE=TO$yMrSizNPxmo-h&QBmHJx_hvS3ZD zY2dzWz+eyX&nVhU>QJgV7D(={-LSuT(SQpfAPiA3VYz~G;Y&q2^qw^7!2lP>` zz8OFhrl0#H;A{eW8(6^?vxu1B?-i39(QE<8u_0!NHG1)7jYMDFbFjc-UoL!&y(`Wc zNRIAX1{lG`1d=YrlSM&ueEm$tV9eWY1|Z>gRD-4)N+x~Pmx-W&pr zV(JeZNDWkGP1fGrrzFT6N~LEUvy1GB<>=NJwuchrpF>} zF;8xuy>n)<;9I6~mS`!w7%q`f81BcMWt;p?ZY~*v%f8Y{BFl7C=SZ`0kHW8@qo_a* z20?;A?bBFnKJTPDtmLTbzcn4#ZjSD1ZCwV=h9Bd@=!|F4Z;`=;pe>xOJ+-Q)Qm?A) zi>t%%eP7ep$nb#F;9Q~S(*C(iY~`i+htB7)#l+%P$1Zr*y94`!(?c&}?-X z_@4yBf3<{XVr2YZ`L+L7FpT_s^rqK?yp?v@fx%my`c;8}PIEU@DWQ|2 zRbtODU_e9q&dNqcmv@Zk_aDK!YOgW6m91(AY$tR%J;BgDK{G!gH$6SNKJV(f>>Jz< zpZ7jmI<4Ep4d}G2HiJiB&pE2YtzHM0N%qI{Y{;Kc7mr+@A7CqLudi%4Kkh*>;VHYa z&sV}?h>$q8blh9mHKVt57-DaNlsqFf+?#FxX2|lKr4ONTB#35T?)J&P)i2ZZhzZpR zu)~IUdJWUWIytksi-fOM#F!#^L@0D0bknZ=ed?zY#}Cw5>O zzqkc%HuuGN`%um^l=(!jpPe|_itz(Jf+;sz-Jv+$K3;G67X>`$th2kYpq|wUo zSuooxGIH`X46S{{j|fr3D0kpX2`;qit;bfRq;wx%lHz_?&+5R( z4cpJl84`g=jSre;ehjsSFfSJ}@794X_M#Am5uAJ!VOn&$O7bQpHNZK8k5%>Qi*S};^QD~3RKx}Dx*kqOh_JsLhtLh@=is(usR$k!g zKecEsa6Xg{R#6LKbXq1q25rrs(oe}S!9_cz|1ji{n$72Wk1tU<5e@e&gJ7VwE%y3; zl6-iG30=6AwiNbHpZ#i^Vic}TcPI0uW5{dWy!l{}i(0yc6SCvT9OQ zHYr{b-#F813B#W@WwFG7PMOCxK~`!mG1R{5zOYJ-7*%63O@YAW!NJC9_iaV^C4p-J zz1KQLjdJ-XngeRdx&^8nqz>h))jngt_@+xDvl8ct6BF$cC3$q7s`m6d^H@Uk%mSD# zB^+Bx*;pwqpK-wB9rO2n0 zUF=<&rio$C$_6g{lcFy;t;R1pQg{(ZNveF2?g|h^Nkz#_6p5q?2-+66@0wa1T2g*wvsEZKkQA*%Dwie+D0k|_S zMF)PAOJ)^^-An0fUc zNbPW>{hGq&E@vD6j&_!R=6*3pTcLdk+V-G3FUv(EH~51(uOkZ8itLs;?0oWUkWCzC zmU}2rdQ`8-&I$7wE%i0$x#3t6{6(9j(rWPNYAF66)H`LfS{Laz*=1A1C>2A)Nj{VV z&E8&$7?)=LhA8b={(nWv;>}gm7;cJO?=YKr_ds0Fyh71%U(h7TY1=X{>_%(>tCiv5`8wZqwL-jI% z$aw{v+?ktR5IFcw_neTR!=2p~I1>EHFpjYQoNQW)aGxYkl`&>!$&pkG+>c7n4^J#;YYmGiI=ss(= zb4QNN9`Rtu*Ns^|fJ*DkWG|7U3r590Mgq}gMJ`X5pf`p_?Kye$C9ehMf>4PIaMP^hmY1!?mn#;6Gcvk5ZLJ(Az8ZugpawuLq)u@sX;mXq-8P|k zw=-+Da%ULN{1FpLdk8r$n2ho(eyCj(&RCFwVIF<)9-_(XHIrW7oXe*N-i4mglM~-` zu!uYo`I?ekQ;y0h1?4E94bUKtwmu0aRj}l#1@c}&T zH%`x#b}aU;Iw5#As`cWr$rx$Mxe6obc`m0yE@BiuGjn}voT;)9`Uqc8atH1{*8lG9 zG~gSQKPik6EETT2LNTOUR}S7NPALl(1BO%y$O>*Q;D9aj8pl*<|0AOwfvhd7OPRaS zTn>p&;V9w#QfsPS#P{hk#B}26Xg?tet~)cKk9NX2_;Q+-T@mmwn8=+oRjgNPTfS-o z!xd9gCx`B^)g@Y&?wUBcllJ?d@xWzq*DOw>n&x3pz;7ebb+6upl_N@_T`LA%8>+6_W_=Y zVtTG6#bB!gexV8>ZJFMA^WRWbP1D(6D+IH=DKo7&X}T*Z_7jpLNAF66?i?jButo+S z4n9iI*mm|Isyy8mX}lC*DFmI*$STWs>WT|326R8H0-I0)iDV8@5EP9;qmyZ>$9QV{uS%Be2FJ^=kjpOZ*0BXS9q`?Fc!@GDZ8)VQ7W>=w`%+6 znc?#_0oxBr2o?tK!462AT^X1jhzN_<=Ev*T9nUq(2Boy&I=+ij_!a59^T`lS_duJ% zXX+Jp6#FC5mGj4RLh#`O@-ilc2>WNhH8D(b?O_+@bpld%#j2`7o3}cl#{VMYXqUxn zinL|79-_p4&$#Xg_tV@a?r7z1bO}mmZ3r57JBh1@CQ*CuB}Nyl4;GM8u0h7y$zftm zF$f)Qntb!^e49>B_VYt@MR4zH#^0{s=r+fUK$zU;+YsSEtnm2zq3543Ob>1?6O?e| zoWQV~a8^qgTT5rk zQ+yg{CUNE@x-Hnz%u>?GFpH8q^fq9tGn~kPau7Nvr*G|n#sW4=w_iUj z&VyIQc1aYAs5wtnBd$nFQi!d10mVCH#Z|R;Zs=wxuR)aNJYMcKfbf8y-3stpPj+k~ zgo=3h3;I`f=S`9d1(dgE9kic;87&ad^g|;uvxL9NVLlNnu8&$3-ox?8B zgerrLv7Ob8&~gc-7`gUxbv{X+A=-BXmo$5-;kJC{cy(LaHHCjJ6co;G78c7f=dEb@ zEtyHszHf(z_pHvrpdUR*EHb^oACs84y{%q+4vf2fU+DoYOY~fRln@9OII_h6fNNN9 z{l2t7#}dzNx{TbvdsD)5t!OF>SoKLV>_{ZS6quk-)wyx*zchqU@M$?xQX01jIpV&< z`q4L@{>{c|CF*~96aae99V9F?WwTKFou1N1WpH;k;s_Pfc)kjO0%Yo+9=Lx{LH;_K zx?p|9KxNS@;ly-X1oE{uLaj{K0!p-pr=db;xs^N z1ton9l8ew{`Vvc}>v20r)>g`r@+%8Vkz)D0I-~F%LZ+8sC->Jcmg)b!lq07? zO$;ZECg4lm0I3$>gW*Ffaw!Ai-b{&(D|TAU=jSEVryX*xn_(Jrb7vmug;VTd|JK#dtpe!O zwKIgMFUai$XA&7VNk@#58Z%|8wu)cRnbIo+0c<(}d{8`_oIsmj3$dGWQW<^DELj3o ziiR&1p8vYDJPxgEHHcEk-JJtOi}fKHJ!iNd4}4}aI1r+OKdFcHb>djP zD&HFGxE2N1$?bP-wr?+5 z%@4$*Ck?%kwkthdrLUNP>dxE$p7Z4~;)$#+;?vLXT3=s!`&QMC2~M}d%O6HD$5jn$En#*AU*&@oM`7Yfx1GTTAUZXk}RiGRlAm ztI=3OZun4bA-@fZ$wx?kf5)Pg?I_J$zV7&jNQ5#7NISzUy1!*9ZQS(=-s%-gWA_HT zm#)#y#Uy*c>Q)HS2R_g>E5prSJ z!#Sf)6Ko?k**%kgt)8RjBKa>*4bL)clnhp=KzW340&!}R>C)a(%;yu#o$^$#Uwe1? z25fs?ITcg?R{3=G&J^BdL`Ay_L)?H0{0Z<40!F2AaTU-Wg~bxp{l>vYs6pIw!-a7d zw`umT8K>OPWs`U{a6s}k((@WslHwy78yfdwUzgE>!&Ykl3Sv5C z9qHGR6UIPv4v)M=vOeb9To+XiyMiFoI3`-kxP_BH5TJ`B@J!fWRiVnze3e_Csvwu6 zUSj!vY)hL^FRCbDXcfpM^Y(5=w+(`LZJQ+KiYa8rCR3rmPaT+n=7i*)q$$>e#@eCy zAyh>=ilGojSC@Nn0eYEEnt`8bgo9&Gr|bj?7oM=ldes`pWw3?ip&{zs(Ap|U7lZCq z8b3O@=~lLfvqbhs4Qq=s4Lq#a>)_ag_6B)%JHs=}gSoq{R@%RaVf^+aeqC_*q@-Uw zZd8}H_<3%RN>9CRM&)_DsabJEg{UaFdnX?UJ3@{W0~Vy!Avprq`kRN})#jN%P3djQ z(|5A9cDOI&8>DrY2k)v0w#_Mi%D(YZK}N>H;PxCC_f~bs528LK z?HSV;xIVc&^bySA<d`W*B4qK~(^>@f7lv8zw zu~gGby-13a=HYu1mh|j=5h8ptB>2aH*|(#3t40FB+N#gHMMWZkZqW~eV6U31$TEwO zb&Gzqh-eSlZgfA~%c(|ipKGvR>{Jw?*^`=%Lr;D}0wL{%*OaS>;GPSdwEZVCQ<*61 zPS$SgNt+-MR(SM!*N9Y(jhnzQo^S-c>=S)QD;M(3baIWX!yp1$OmowCZI>j{)w=`L zXh{uz*v}5y2W<0@Nr>L395P8Ji385MEX#$duxE@j?3s+sqGjaG8bSt5ChK|K0hU44 zAJ)&b(F$-folS&|4Va6XwmQ*5FQYw%SBY%edTggyeQfV-S8SHyzfZLlT#G)dU*7{a zf)b3BQdi-?b7H+blymv03*PtNg|(f5@K?xZD|p|~sQ`-N|6$l={;yzkOe{?Q z%TeE@_5Z=>9)X1#UP>t`c1wg;g-6L#Ro_6tT$B)8Jr&_gQa*)ph? z4;BNLULH>%Ww<}V$*5$O-Ht!c4r1)~R&L+CpT1sfOLBbX$aW_k;Y(~^7O>1n+j#u- z^ajs1u69hP1$6v!IP6k>OBA6`f0y~*6Dw}7uMyF{+XJFQl5fdfosbm!e_tlB3j6ND zVSLBvlWG);PIjU650QBBjH)fuyQhUtARa#4?g}>1pk@A$#dXSHlSO!r#_SQ>|Jv!} zLihH0kafCgc=^aEr*3m>f7mI`Fzis-BdiXfWm0hE)7V?V_N(z;zu?aLa(b*KO1*yE z4StvT@488`#@wIZ2ZfRP>tmlEJte+bKAzOJ?11z|0VW9U;QOgB)exHwG&^mqdqltk zy(QitYib;Z7od|I+YvE{N531Noo#ox?qMGk>}&Csx%bY? zh4pAG%v({FS`}{Cao4-3OKT_$4eToDUzO=r4J;CAc!*=%nD(+#t`AoHsQo= zLSTPg{-zC$U8pPoFr5l{gM`hY%gM%e@S2rN(b;BilVDW_T4$7fI^bvkwJ15>=Nf#x zA;zp1a9)|OlgL-?p^?usM(?-8h06N5WfM$d%(fNWau!rH40if!HnA}4X>}+bYsT~8 zf#6LM(uV=zE6c>fWPU+yEh=tlS?Z7ulc<-tTg7DE<%R2ZS~2oLypVAA-qxXGk?rpj zCcN*^QTm7??jtD$g-6JS*G@yOwD-#(?(dE>E}>D|MQtD(CyH*-{KfMNC`$>89xOvd zNJpK+5A(BiF0q%@e?JxTUK+w|R3=x2HJiIQ9;G&{<7G2}s$Y4PWG#lw`J?WP8AcIs z>z=9USy{iSF#_sVtnt|>IW{-9x6HM|z^Sa2Jc{T=hw(^n9TBF&vLw>JXRuo;uikL4 zMYsWYN}ng5Q~EP+`X!oAufV@qn%%f56@hxtt_q}lchm(wO`58YlOzGr*V-JY;Vh$6 zvfDD9%I$#G4c@J_dev4~o)W0FPfsuYGcudArWobK+4g4S?{Y>(Ddf{QqX zcP0LTI;d)&t z06Ltmm3ai3y)%ZAu{qpTeezN@Bf`&)qq?>_gi7hX%AIiBtsnW?$7D^H~O zjt5Q>L!BuTAPSBI;XSd_-F`*<(|M}#jb?H+f#VV{O&?xL%?nXWh^p;zeSvNvT)p^+{_X9^XMS({g8AoR1t zY`b<9g*ae1h5rnii6F(}Y6*MAG7=q;|ZRm0n zxLFj5_L_uH^Op+r50-8^_BBu0i%r7CpwC8Ydaj9lo`aO88%LuVaWiKa80jD-4W>fB z%n0f54a^da>9i05wf34Oi)3{PNsE$Xi7$?HUEO^a~eEiM`3EkDzQs-W-e; z41wJ=N(ao--)6Mbbu5aSQI~7uZ#H8Ijk9&k#|(b?_E0k0d~_2ZZ-b5VA#Gwu&X6i2 z7tZ%uSFuUA?#xj>vO)Z&pnOVCcavi-q6$ncbr_t2)p5#Fs*Tmi)n^v4-3CTU8Vw^= zY762fl|BOh$}kEZ!6{shH$rOkcDp=qTd&HG@`wfoh&eTda2+63vv@;Sb$+ zwT}{7V@|F6ZRHgb8Fs1e%*#7BAlqg0grKIdd-pt4Xx@@mDGwOp1STwfzMoIUB-ADZ zljBaFD;$;16B#3s24q@nwNIPc3L$+%dfrjVn9+gPl3JS#55&s{3_*Lp#f*l5H$Up9 zKoJ8_pp#%1xEm6Uxt!A^o7 zGv5RjT6yNQB}&@~0}KR&rjG7_AMK%?n2+3Ir}5G#79$@0gc4I(_dj3kFVdVA8R zs7$UyUTw&xrUImn-KXNIB~Vgi1=_au?TW^AzWaca&S=!8%5ddc|?1L)$Y^wT4tpfK+eSJQxT%YLH34^9C zhd-Bsl}k_3$|gLlNw1vuTIDeJ2wI|i{21tw*PWH?bWd;r=9&M{Ri z@oPdRs%{yuh>0ZRiRu6-a=(MRqFD+V9hXv| zI3{Cs@Nxc?MUk>uXKu&i z0iJ%_eCd2JwkZyr{Yt}gj%Cf*f2Kt84~6m~O%$h?ZafN}@D>6cNR5YMR5nD}Za5)r zJmApGt$g~DDiDiFD5T890AdGistnv8k?syAU>r{gc3_a~&QNi&YU#eXp8m@0CF8j+G zcjTb0q{_gndryH{lb$1ML!)B8LQ4>C#<#;`O_5RZl!uw>0 z%;2IRX1;#G!C!pdwEucB2BcH8tBttvRAz^SOj@o1ZBEN;G)Q~Q|2#pCIXB`Xu7o(t zZ5$9Sd_?y2Asg~%(}%@$zRDw})Kc9neDnQ|0Yp;-B*U=*8h&N3+5vteAbr5w3|QqE`ZLB7l&eEPn^=_Yq)Bhny8%_SN6Dl^s5y`gGIHXPecp4a`N z`~i^hZ*!eGOZPKG^}j>aKodhmD2G`X0&aN%@hv-7+zLo30dAiQlo&pcRMk4ELSj1S-dC>sGnTWZ~*s?A*MDQX^ z*4t$fBz~)TdWg0KqN%-ks*bw#^}K8p$L#-48 zsuo*9k`Y6}uGAq^utyQO<|P3i)s|zk5PDxpmjcD4!CUXY-LazwJmRW^E(&0e;Abvd zRror`BL0RC4y-C$m(>tyIuw$aFcg;0s*h_4E9j3!%99 zS^rPU@V{#bV*9@lK~vQit+3lK6rVuy!e44gcCo_#E`Ha=JRSKFhlAI}4XJC7Pm*8h z@x~)E(^`6VaT&-X`6S_=Vm?YCy5N7d{u6I->|5B3m;I|wWN0cY#wBJ=V_RByrW9?fHv>wZA*xnD5|2kJr?i_oK+ ztRaAn5d7Ra8dpt)L4RSs`?T4A{Vog$^7Z}pmYZkTg<`>48ZIHHg^@RRup1cL>fZmr z>F@3FvALG>`Ek~pSLgYxx%^e?d_Rn(_D1XDk8eE#eE)J*6js%AeqPJoUo%o*e=FmI zb@>^gLqca%&%rBU&5V|J-6&G$SSbY|5R=2s?{-k1PAh*(*IFf`jxVm@6)H`{SR<4gtIg;*N>v86lp#w8VP`s4XIW8z;3S92-?2b4jmiUETDy> zd#6AH6O@vfP+JB3*dq4;Psd&XJuv3NX{hOM^ZGuqz(9+gqW+MZ*xtP_H&NQphu z-GkLbIXCN@uY0xR1Y@9364Z$*s0zb@md-DRsjCT^)k1waJ4$GBXyIloBYYyH$%shY z26L-NhrQd%gQisqFRt&J(}` z0D?>r4fw9RUYFa}si@rJ1T%2#*j~aTmH`!m^_0QO^uChI4AXvvi>h5v5PSrr)t?el z+t^-*P4LOrZtvN^?l1y?6afaYK?FhV zAkNqV31?tnZF1W6CS&ZyUsHFBHxd5pgfJHa7bUq4 z#YGUoAZ)aU90=EZ-~h45v%IN@=WE!EenHYnzF;=gU@9K&Qz+VPKMF!0s&BX9CgXyQ znq2=Up+iltOV-djI~d%U6zkfk6UXyadev@t)SujGs{zQw(c{Hxx1^yO(~w=WEMAs6 zgyQ33`ZPvHl&M`^K(*tzR2ePFXfe|`?OmfH&0K8^6A)}sm!dSL`Y_IxPJQVhg>goX z{e}3~s6RzM{NZmjeL}sW>2M2%*=GQl97T1#JpK4yvMH46k?)*8mP0m1K zH#+!Mck{UiqT5XIc`YBDJn$zBNxF6b#=&EdP>3Dt$=JW&vDeo<{&Q1m_e)C|V1GZ6 zUgI4vPjd!qoZIYV>wP$Ov*Wt7A;D5-i|;HV_#M1gA97{26DM6q#l7QpmO_{_C&U$l z6h%`|OnE@-s2#koQu?9wpbUNjp3XQ%I$bMi(^%PVx4)YIjC_qTBMabu^Bep*qoeh8 zQrXBB5#;M;zsYm?`i__jOicKP1gJBj%S9Zm#66tG`b<%un25 ztAQYBw#uh)gGwrza~la;F(9$~Nt9Wpt8_t?lIT<`HdoTQdc8D66yTadK85c2gL|D3 zj#sVxvi$Zlp`FUOK-iVm1lI~tH}N_=dyh&qm+9wpS;Z8mL@Kr|Ip-m_mEE4>oy5Lv zgZ~iVSYH%z;RTP+a7~c3a@JMqQ|`Ko*)G3pcTkN} z1ev6D;^nt$37i%EI4KN9_{_7R>v&8F*9@Z`h?2Bv?qeWrbc!X0d10Fp!U98)?CDG{ zb$?E^l~E=Rb&b4nb}dfOJ)Ww1ga`-Jm7+zO)g{a^U}d~p!G%6iy)tcGCzFzs_CzTp z>2}KGX?}+|1(%ZD$9^Fo6a#%q;2Ry#+M>~-H%{}WLjEC=C}giBG#XXHr+qWE>~lfB z)Gx+Uf#xk*X7MyA8kF-tG=%Tm3P}^nlYLr4Ppp73H>^(cPoYxQkk}z11eAT^)AiCk zK|bYuHeWn)0Tk7{5K)=nq3J8vq!h}1?F-75OlPA`Wv-kCJkgqZ$5fB*4!M*|I#yM4 z3I#GA&j;^~sDmqUd?c=x+BXb_dHv!JVSpXOyhtBy88a5?k}HX?pde^K!|zUhkmj6m zK$~t}yt~YGC+tp=apJepgk!Io50#?Z-{COPF)`^StFramrs4+4`Wmo_5QKqMVG1Ut z#okRQ;D7R0^3>Qi8VfTe|J5_0Fd5K1 z9}}&+8-bZ=miBLswoZEq9yjqwVVYc8q_&(%#Sw2n4OcW8Z8o)iYAt70%!aORsy3G? z1__@X6L*RRm3>HID2;dH*&6N4vlsi3?wpO!skAgmS-cj!w72zH6raDINJ{_adWd8= zl+ez}S@thSYgyUnLLbm7A}!Qp;L+!vcg_Zn+Kyy4rw`k+S}kmLCW>9|HxfXd*5@C_#dw?3 zG{WmrZq?6)lP#`zqj8~dlYp6UjJAv!<`|Mp4g^`@3#_a9=h4{!OJOpNF0|HU%1snc zBVbhk4~vG%ls@Fr4VXpg?Df*!RnacWwJ7#>I%6xUM^(1jY#PrQY4hi1C#=E?wtzNx zgkGJ_p>mpmCZKe9go~#+T46LP**j(0_nSIA!fI1j98RJ3bbxcE_zzI>YQzgJ*iG*H z28wO&Y_3zTsF#SxTr!RB0v;cKl8hv}8@|DKGEgHmPcc@SH#(xonH@|3n_rLHINgia zD{GCaa>>?r%I5Rt?{oD@e?IdPk{a#!)fps+=L5*{RMy-?kH3!nZS?&xF1m?YvAN;? zunm(JFP0-T35a{t(IR6i$G0T5NA^(j`GyR_!qApGGYUUQ$?GqGd z|777QAj~cZg#W=1ZGfsj$|e0zgHM|eu{>~*!qe>~h)Bmzbv$`EA)k!LL=80c@5Lkn zHG(CZqi53>65arH=d^X@-Ydcf$c_ins+D0!)NjH^w)U1Kb_Z=eSq< z{TPTgcj4ytM$~6`VC4T{>>OeR3)6OcY}>YN+qP|^j&0klW81cE+qQA5XZKHf(8(Tu zvz@$p*3x(RIz{87;+v?wIwmO!4{n)+T-bXP3H2Knm{3=;#M2>+))_pNv(QC;mkL{e zc=GXfr>`B31R+Kor{0&KxgnGnCUSJ~agv{MaGZ=zvyXZ_l_7=t{rb2pC^GL;ji-r> zsgza5ALD7g8BnJVNp%e{?&x27i`_CXq#K${* zg#*%nD0>l7fbsU*NMsF`reB4(?6}o+UF;sn1&k_?DE+u7hygbrW{-@6C(vov{m0Jp z8PGnG*;>|EmMewiJGk}cECtfM#&d<^Us5_EU^FSMLyHD4xps{pa@`dyQ>DLff@Il! z$+AxF+6fLLu1g8;kEktVa^g$0R`MG~R~z8P2P&7DuJB)f8b$s^E2_uav*761`z7DE zc{;wcf;+`BB%a0+tr+)op0coOrYn$8$m@SW4om=IXD6@)d;e+*5tVIC9&XJ#rrC^l zK%lXZvJ3q^i~aJoNyoA$Y}QhAm67v53XbqD^?md@vLmT9Uat>N7e5o4T)`<#;zRCy z5**zXA4x;;j=7%&g@sz|=g)dpUiIn>Z`}1g$n`lC@ZkoLdwLXc24a(ur5U^^G@Lpd zen$zfQyMeD{&DVvW=U7t%ZJpRzM~_#8|n&vWTah9^feihdv9Uu>fStSf)T@*7)xg1GqpQl?!+HrEiR&nf4Y>5N|2MfutnbfFbt1JH4h637-C$1)%#3Z zLJns?O^2yd%=#yv$TR-E7A z-X}zUjHAJ$Iut^Q%H6B&+z|eW<8&#HSvx)CV39YE?aZB$gV`AQV(x3_c=~s9M1=H- zS%XjLMwG{zbTA}M11*K-{thu&p;#V7+roUW$hcx>{%N!r5PP*3$%V`nzU|$rP1j32) zm$hIr{;|*lF1CFOh%v||cSTE1h-0L?CO5#^<8UK5t_$q&{$8Z5y)5})qRZS7P&_f+ zfM@`*G`jJC0{f2@X~)sicN>Hkna1WUMFPYrswYwm*1U#b;Wtw)m^xo>PGq~^(&HZ4 zG6*?0XK>Pe?vQt5dL#~4vXP70L1p-ijEM3PSA70U;5j>%)w-57TyCx6+5 z3+}L491^f8$>YJG3n=sKw23}iLjR4!og3*P-MDS-qG(=T0YRL`U@(iQI({d`Pf~&C zshdU37Ot$@nJxe%br&1+cwf1O0?3Jo8BWXRWdxvM7vrD|TqFj;vGb+yl9GyrBe-ne z#-onH3}JccI%Z1cQRkcWq&1OUTZK*DbxUhA39*m0OZXT2@Nu0RIr)Q86<#2H2%sApOu7yKbCOV!J@;2 zI9L+-hKFYS!tGjvu-ImAcfu5tB#Gof-+YYd@Omy(l`Mw`RlZ9BqiYh@42dM=yWMyg zx#;2ur0YOiiGA5E*sI$$JEN=`uk(W{>YYj`FQucdB>i=ttfXZb!(wd@h~S)~gBC94 zw#`Zr0EaN-Zenuy;QP9xJ22($>~( z;L!vJsSs^X0Uaqk+L5=-sq!0LAs!KXqU2RY)E-sS=-3A3#pdb?#<{L0hJ+7~2RYwCm)?$xL_xe<=B z(6iY;&0odya`rG&;_XoQLel{N zNA+IS(=`SJ#!d~`Q^cHB=@!J_h1*?;?FGIQd#{Db z%!jP-7c#ctZ%KJ5^aql+QF74FZJa3XPi{NSdtIMXF6+PetQa-zxu?>LvV7Nns;BKL zkuVn4wNIOGjD0Fxt(>BZLGIKFjJGwe3h1q-tiKhfvUZBnS3A%d?XevY9uG1b)6rK; z8EcErGFu%{9!FZ`jdoB#Y_&<56|IP3Wf7I6#Ul9Kyutju#u-h}hdn1KDOEv}2N7*fSW zS;GXU3|CO1xNpYPt!I+odpj<4eu!(h8edZ@=|UkI95IAb{rx|3CNQ3}sw!)^73R_Q}xLxFcL=tua7u9a9wpiHZQyD*mMmlBX3J{tV%>xy`yuQGFXXNc`Tn> zeb)#iF|Y9z)(&N0Qe~i??%=jr>>EAN$1<4jRZ_PE8-4niI?08` zP?eSqKrQ*~t3e%ioRvy_b+CcT{$2_$Qq(rSq@>@NMiopKJ@OtpXF{a^`%3FKX*@GP zoO}|I3@&l18mbW*R96jo9wE?4%N)e*gG9)G*(x_zrrW|^gg@s9DF zs1m#S{G0xL9tIA=-OQC*P(D9hoZMV&Hdd(`eP_F|1AKYFbWIw_U1lrz=*nL?kh`G3 zDp1Fa7A0w?4jXw}zZxCW++0E$36wD`oHYKpEZ?Minc&TkL>9+7IRGUd#C0aa zE(FL!55(Rh?YSiO<0m%LaiC*Bi1Iymk6fk^LB_A@#YI-;`B@$%pQMhb`FZc_tW2Yh znJvm!(w_7k3I!w^iiU@2tuoYti+SX=zsqbD5QucwSGE8f=;_z06M#T;;wP4b*l(%U zYU3;^27SaLt4xY|Iv9W7h%X8J{--Bs@|QLBAW z{0Y^E+^M0pfsvfM51aw-#`7p<58nL=VkB|Nxke0QN{hhcl0W}X$_nfWd z;d;}q-2X@1|3)u4Cz}2*Jpg6)5prK7h0q^6&M$M>lc1^&W;@c_TE z{U;drw?JDn)-BE)e(t;f6b>o7)%YzNb)FdFMumeb38;y1LH z{vPX}Ia&Q?7MO2AH?sBVGXnaCi)%-IivOwx;!RpWoz3mvD>3~^+}?Z&`dPPpuR)*w zKh>RY33iXXE@xbbEN)j^&eq}6LgY8+-p7OTp%2d4?jI|EzulF3!u)(cFNs1(qov|) z5U{s}-FhOTlZ>%t>^>oO%}=m@jyF|=&p%&7Agq@j@~Q}BDZYMe6E3Ba5$|7n(|YN9 zU%KO2{eE7gpC92@*@>kjx85Tljnc)oOR1j$x&f<)EG+0b<|jY|9cI3n1bJ@s(Bh;X z;1glBtVr}LcVCTA{!%ACAZCsm$nszqTilS)TcqB@QX<3)l7ftfCnG@<>RA@aTuoH` z`rKZN@{dF?4+zSWTZgAkP8ibKCK^z)wcZ?C()5I_p?3AypS7cLe1^^Ks$ z+R#=JO%Y{To4WN!EKS~De@M?VwdjSZ`kHUhFv_TPp`i)`a9fca3ABb@~5}?L5{F7^TwhvVEFVC{_jrXU> zNFXoy8Ic`mg1uo`5`~T~Z|q2p=nIG+n2%0Gdw->3yR-qOzr6<3XBTnqmcpAm zg*y`X=!nH=$qlfDF_^|(o7&-VFI5$ein$#O&e+b%2(N&VX7bY2xgD@~CuyU5O$Gqr zR{jkwsE&jiT#$uTT>j^NbVuFcI(;VKQM=YZmf;P4&JqSmizm5a+3J9ZP(eo>LYz|( z(@nr$|Zis0os)|3|f?mLtl3K zk#kO(%L!FwHj4i9F(xbwf*e{TSIZcNwr!6g-2F<=nSe4xjPWp>^2f6X zbzg@<62qDWqCjntG*iT-fTory{S*{*?P-yTYg}e$7K+>^N+`4hi$i}{;R zGUvCNx{Dd~%YZLi8gNL+C)Bu$85S=a`%IU4k*gIJu{X^5uyCz4-xThd#7S#}A5RHH zn0MHC*c_uNr1#m4bdK-dXA=1AvMil#GC~=Su9o|LtWS5&U z>05Rzt4-D3S`ZTDIH)%s!W(oA#{3UrHia12O`jwMj7T(gL*+0ORITd zmX%!|%sIqJlwhg}z(e*Yu6cq_S!I0O+K0?7M8&yO)t6LR59;7h*B(qpw*^sKA5#^k zDV%dEHmdVhbrJqq+heS<#5zc$bJ+4w<4HA}KBf%iQq z%u;UL>C|(|OIQ$==1(hcN$$9aOI4J+gjg51a%uZ2PhQ4V7L&VBoWeLQjXNw%!r}bm z!6;VJ8V7NZ?I}{ZJKSp$g!KJbOobm0D*R#npQY;2uq(QE@&E2WS~%h+T}I~A$I%!X z;={EF4m>N>NokQPvunaZ8L-RPm7c5`MV~EpMXcOXn0gv))&OVjkDKvs)9a7$p*1Sd zKc)o}&#u%gW3=MdqSWRbtDkcEO+74hN=q-+uJ0=ua@)VECI1;?-GD2;C{z+s4pB}D z>6{>`X#<8*pdU6z3AMAWLOD@-)Zwa=&^Q9I5o+ zzq6XzE9j<$`RYyIQ=-y~kOtKyp!q_J{~)4a1yjCHB$e5!9;BtUXf%sj!n_h{ePOoSwqzAi_F0(#7_=Z~?_q%2R-2 z^|DCwTlWp&RbcmBb6gEW)gylq@9^wX7M7Gw(5~m3JY7L{hR=$ zze<6MZLw@#P(8HguHgaLVOzvS<;U^|_H8*l6QmU2Z`!0Jv{>{MJ#}N`t(?9+zoi@` zNMrh1iF8uhR@T3u@RPp5EA`!fE9w8YH2~}Xy^!hF8Ly#k{f~{{16-t$gGEwcj!3|U zfScSN-Q=%VCwG>+q5an<-Ha%kw$df6`&`n}fyQGw(e2YG2=b^O114j}I^$)@?CxDZ z{oBXx&G)T-NuKWtvcpMR(D@{rt^o7+G)Q1SO$q&^UrlyU7htc`9$S|)Ap6`tx3As; zb1c2v;?H3y{V{%V-qiKK;}~GuR_Nf7pNJuOq%bGbvN`x0e_C~KpTznb!#5^4T;Nf+ zpMCQm%_>I${_rDH1OD_~;R`hI`|8Q0**Xk5zJ-Cu&WP{PC@A8u*GYbIQe5Dg_=W@< z@0h_5Ix1SYo3^%3bMIgOxqEzlIL_oe|Uu54y9CnC3b-NnN$}VqhXmu5Xj$cDK6=`ifXXRhoJ40z*CVr$m z5fT&{j!=}`AaBUv_j7Y*&XN=d-|2h~WGVBHNK?6(%p6EIYfbk#8Cr3p50R~bj|31w z1OZXWMGmQL`q@tQW=Q=(@eLE(OrH_S@8HBRI#u0;Nwmdq!I9g1I>I{BDz@RCm2_8b4*1`*%m4d6Y7iK-0INA_faQS8ZfqFeo){B z5-<}wS2Nk>!dg=h9~s7eMZ)4M$`?h-W|ImLv(w>xgZ3&zrQ=;xNmrn^lVIks5Matfs!E)EX1lh zDa7_pME%GiAz)T#gRNGY4^)rzmE(CPMnp=SRT3tAA7DJ}V@e;A&GfAP#Z!sZ%DKI7 zNe@FTmy=nd{N+rhD=c(2)_W!l1U$@a7-@Stt=A=ApIYcl3uuO@!p+>pbdHmzDb*_# ze^*jjs~kHG+m%4`&T58|p{d;Ftx;Mjv8mj=1wz65tKkzdA1^mgNa$7=irpTNNSG5C zpuH5=>cY>Yt6+ObhQT(DtIhCLS}tNyO z$f6UcGjcg1=wKp$bvR~|cH6&y_ou@VvyyHwVm~fx`x=#3dajGDLxrWqj%oI#ZIyCV zG(TyF(_ZP&?-DVJauMDUCxeSGE5Rg~Y-Q z)|8wyqvJBHQHitbxR`OEKTH?Mx{S>d>Fx&FG|K17cmayrmtx}i3QaF@sX!$yA)Tc& zCAy)B%BcKcRsx|`OgnWGDlp;%reSDk&AtVdF`zkC7E$6@B<1vBG3tjR+tn;Xyvt=& z6^&%c6w!$r-C_mD#Jx%+q1ZPqqM~(7raOqOCipBx0S_3Ln4)JiN@H=%mWgGhj%JI@ zTY%%^3R3smPj(@0p7A7jiIr{x2yFPZ3B52%7q$I2reX1-r9_r{-;SQe=41$$eyCu@=iX5rX$(<%wS)|UwH!=5 z*oQHa5a!Ax7)geTPcEjdG$UaPlbE5+YpKW|!T?w|4ZGOsN{oe<&ms-f-rOeB)z-9X z#w55@_^jxy62f~meatMIb@U{djVffBu6lb3HTD3#7||kgaVC%=zK8AJ;R%1DZaoI* zR?ob=lBR{f6U}}m5f#awgWo)pVGYdj+8|F|3f{GSW0P~76cwQcU%)gs(ZjK53{lX@ zadbR|#kEqq_`0mSYGO|lQkvLb5o92rWm_V*Yy?WB5GR6$P_Tmh9a9H=&pBONlx&|s!$N$ze_EB349$c$w6v3_?(7q9JN?RQMI)TiByWzjpxhmQ1HNmq4j zqK0s>km_dUT0)7LS5cnme1`{xDH>$ug`-4P}(XUMUC^rtJkmO|xd(vv@pLQq&VOiy!#ISNK7iony#KMSpKB>2^!B zHvDt}s*|Uu(SL;M5Wvi)PJ@N%H#TfC9jTjOl_YuSD;Ci2djNJy|- zMr9aT2$7FztEAM*lSV3-D9%Q{)s}jm@_zq(^h{Y_S1osR{IeC-3_c2>RZtL-2$5E# z`e+J}5J#daB@0)Qs$`A?9Gy~rt#M=t5KSCaUqLOzGK!_pTXPwbIA;^+E7yc4Mac=r zJmT{u!z+i;6L(S60%ch?tk(|?ck^8*Gs^YkMQ6W;MP&yEY?4I8h3Xs1dDC1j33Vru58?e|Pi#-F8?U`q z=#w-H*n>6(FcX^1l2nVTuhwjJ2$m6suH|(BDyIzm&g+32m}svZDABZajcnwJz_9V> z92Surbc(_vf01TvKA~W84~#njG~u$h50F0R@r0aSWZxsZph)XBdMtYc7KO__!s=AF ziUi@fmfoYYSIP&52(@k3&}TLRQMHOZC>25X=Wi%^(@2qvJfbLHOS36rO7*5-MB_fd zq`HWqctP*(uXC-=V)}OroJ&*ga-uPaECf0U>(AZ1SOPbD3tH_H90y{g<~bFYVkjnH zZ4h$wdrqxy^VoS0nc}TM>VSY&s7)!pemik~b1Vz!x7D-~4~PI?yT=4HU^yR~Y4fUo z+!D-DYaj0g%8f^<+}heNFYe0VTtS?+bJqk(oqhYRd7@9o`$ zFc_a;bt>fB{S-Fc$c)UTbK+9=Bg)V_Tm7Q(QY-XFXIqWSm>ef~N+fd+y&jGjYxOS5 za#A}O8$t`b&GY448Dkqf@}aDz&8d@kleJXNtnF9;bQq4IjTa@Bz=)y&GMW*SV+75T zKsmkF=+Ix`dT}rN49fE7&yQGm%5`?wzB#(ntE^OtGV=!e35ce&f+2 z@F;Av-OT13XFf01)gOus-&+eqU~r#Mh?=-KbiO(^9Niwz-~8FQCv6sOefSt9W`*ZQ zKnEWvST-cZg4qT;b$biA1bo7(YNBQr)56(h#0Hu}7b$GV)@4eg6!3F@L%xatZORrs zY)XxSHZ(XjZYrz14Mv`A0 z06D4$LpH3h9^XYX5}qALL;0nc?m6aOWy z)=~h<82&#Y_+OuUg?#)jbevm#psOX%dK^S`)L~cB&0+I90eEv;>ew)wXV`li!-GK= z9BD8o=8W&8?3Xh*eo+r-v~L&-5F4AaEX-hDd~nPv8%^d7`YgK+1Ky>{JHp6zv*~v; z{Jn|QL`u@Q&*lpd;(?)p$-#6p*-(icm6U|b!m~5bPBaQY1M=O{R@eSx<#z_^Hj?a8 zJ+J5CI%t{_^(CB$N_^r`floKo(Ykx}v%)-FXFbApnxvtWZ&$6Le(UzFG7@X7wBbid zX=G?5DJMbL*z^RAwH%%W-;{2fIK1O=cw0uIy&w?qRn|46GeQjD$2|@ETD}gvhtj?u z+R&7iP-0*S^oa8S=|dx;$Nw}`$G9XF*~SwvGIot*5&84HfMnIpGOW+ZoE58ZXMkUA zWiFVLOPv}-l0sLi^d^v5t#9-CLsVjEI^4bvhsd-LnL-)F^C5T>LC#?;Mqz(howF_Z ze&?j~9T|7`eYFdsCQ=Kx0_90#`$OIr#;?j;-DAjGCr}68$~C6ZEcTT;k(YzsLAuKg zta_;boRsLHFU+q2^o~0@a>H(XY3+DvAng`&r z-9J&nU#zrHIPX*Yvtx)?z-f(H%J+{-i<=v~_1!69x+aBy;^_V;K@>eV1}EZu7f7XN z)rq!)9PB++Du~2v!!OEzEeQ^VPpmqsUJBy-=i(g&dY(t&M6Vh|6QBQHVB$>b2h%`kGrh% z!d4L;3r4MgxF8$^g=hKM`0gPFfo1i4Tlu*W2}31;u`z{vI!x;?GafoI2ax+m8qY+b zBgRti??-DdKx&pa{C{a3*;xn}2<(llpm=!b#Vl=HOr7Y(Yz$pYMNEzDO-$)!Ozq5F zEC`sHSsDNT3$kWy>00W47i6#MZ}1w3&lr;a`=SA40&bSKHD?2Scy5a{iL$@G&qWe3 zBcskYuz|?>)?z54O8EE%^1XR`B!_+uP8Ub11l}AzUufXI5q`hx|A3U6=l|k^kVOzo zedn8xE@0G6F60V8Xs#bGZ>yqGbL#QvkPD~s<$F+UesRCPON^Mm1Is0Te200G!p{kv zxhZN9bB~^(Urt!__xfCkP!d$LLD)m=t8cG@7TZi7MZ%UMAB3>JO`}${AjpWc2@XW5 zFAAloMCZ0R?_*OEuC>vv^6DqE851Z!-`BU~g+Tz81tw8zM_OaYlqF2ytz%o)h2A@a z@?V>+y0Fc&yYfQd_VT~Nu$+X4ue)+)n!(QVXF5b?~-Jk}rP!o%ipM@|jv{d7Ydxnn6hm2UQ zd?%T!ETq;!ngNM!zs^2E^xz5Y+^x-z3b`es8~xE7Z+lT|8EC$`-w|D9h__C?;l}>6 z-)^k$k&F^PRbW9iX^OPgj4(5b!?uwUq=jf}+vY$k!b~Aebi4Hj3LTG}0H%LE3r!u1Wn68fnQi1xc#&gcDy@JEgB< znDcn~Z0H-!aueBoALIaoF)30d*#somTZKfaKtriJ!P-QAVa9Kgj;452{v^bP8~@EPE+_)@ z8m8U0Q&YmgGKzJDY*}V3EXg-055ix~^pI8_OKu;9g!Y-Na&V-eNvD4y#1C(!mh^q? zWdn}r_!2lkmuv!hV}vkltaGM84;TIIbDJ4S*Etmv%xPJVHnk?_7-}Ps6(#Wf`;@8 zL`GCdm#&42baaa$u3p}GO2r5vf(t#X)Z*)aFCjraru825Pesc8)|@qaqTco?$-RIk ztt)a)|I1WG1BQ9B475o@xunw%+7lJ+18t6@3gd+~*-IChQ=)Z?D>8^y6-8YnXY4S$gj!c{BATv!FcYSVdp+BGot}rBSst6c}d)Y-# zWq$|0&+6@?S&@UC;EKzF5y~_4P8%iNfF^StS-&o>43r+`Ck@fyo1vb*bG!+|^Z051RO%P@>X7DgNVw;BI2~ z)eyF;_4Z!6@)+Ecn%j$#AkH~Fj;m?#D&TB~;{c`mZy7dq;36^1cIGo&x@k1JXGEpy z2X}t+%oJA#YaK89n;wfGY#8IudPJjCem21#n1v%gj4lxUOp*2 zb;l-@8{z8Po{DwrXilKvtoWHS$$bx=0>$ka`3q(l3a*jt09+H9b>Q_0W_#FdJog|c+uBhXz%uBd1BdP)A z2=+XydM8i>-b=?vLNkn(Ec?Stu!GZ~8JKl{DvA)KAiGx#A_`V!&Mh2W6K0?0^+IpD zh2yxQxNwTsbOek2k}2C{XppRO>T4LvnN!J^cJfh5_*+{$S}oZQ(Gdsw8_8b>&V7l0 z_Fnyi-^-WbRuxGhBI@eW=gXKTHU(?irEVVq0pHhvmt>%f zSyIT}1*IF|lFaFFS5Ymdl-w=rcdJh+?arhDc(cX@iV^&PRVJb$SH$WAv$gaupxt0x z_88gH8NhZFRW>UoA7(~NM{Yxc{v`derX=2GU#pzyqHxhPe;Pscs3rV!R1J;_LyOC!b@S7UnWFt*|jsqoA=R9$~gH!ZCM)-D^7a+KT%J9zX#TN+9- z(z>TuyJ=eAp4PY@SJsl2%2=5;kKaw2wq%W}TT&@_l^_5XcFH6-y1}5K{qqJD53iOq zCa9PDhiA+>`US!kE!fbKeywl{u`t)t)j|0W`N~4R2D8*3(SU=AaLIKIkIvMA+{_jJ zzhI@U39AZ6v@91tmh4D#FKPALP#w=@0y8$xahu2w0(Pgg$YdvaFYfnXie+d*;4AFB zW&&C=<&*xXZpUTb&!6?q8NPiw(wibsyw%vU;X4CH{pTr*6MJPS*UU*gwZvs?k)l|7 zt@BFo3{I7-va7pxdepT-`@T<~9h)xaom0wAzd9K*AEyhG#Vucg7Xh*09;O?8fTTt} zbIUq!*`?rg;csVNO3vI7s-=P1IdIq@INH1;SD@e)W+{(54PYDNJ}a}8E*OxD2K(_0vW7iLzxRyFx!fg4grtuQv#3Oj!7s%?qCL`4VQ!!JzJ zmzL&(CCH&H^emaQ)n(

7HlPpaO`u+!4r~77(Fq9>!4IJBE4vT!=7JR!6P5I7?!4 zjZVI`eq$kN-fA*?5a}h?#Z;!G8^ebK<}q^Dq8k;_f}Q(69yTSg4+B}9coO9~VCW-@ z3S$06(V-SOHh;UNvv7Ia@28>f)v+~UG*)70b{?!3Axbx&F$1wlVB2l({tQ!2j=k7b zFd|`*(oUP6?G9^8N;#qvpb=Ls=!1nz{a8Q^frbb*@Elba;$3I73yiaIV11KVc^y<3 zk2zoVcKYLt4F;`|?JTp#g4L{QLYyYwjrx#S{~V@ZJLTbSD`!^>$`K1vLgL#(602WU zxvvYez9?7jbl!}XwC{KPqS`Q-ku$9Cx~~H--1@_l#uo9K6uXT~uUDY2&aA63dWgf? z+H;^(2Q&vk^2Y66i)L#q6IH2<&R$dkWOG?}cD*KLypaiOT=u-;jnR3{lf7Z|r{nt} zs=RC)-m(y-e+3!dw2uSVu&vd(``B;w{6-BVe z0%2c=jcV5WwEa`?dXU=p%KjYMv`E z4xT=T$S!`3llGJ5V>Q@)eoyGX4t{?cKfW$cpB87WjFLGn)}GpB&`ZMe&5W`crb}l( zd-*6#5B|YPO_xUGC)QKS-?o20b88iUPiv^YobUaZbSC&SE<>R4AZS;iqu9f!2Y#j9 zm1+_rFV|w;xy^rHVJ)_a-lf17?w)kp-gJFWoQW{PA+#XDjSS&EG>MRIYSep(nUnoY zMkrs}iIZ(efvdNp+3T4!ZpQ)YL`iLzA} ze=9;^{{H;i%`Ih8P(Qr>%Kc{h>M9d<{CppxKRw3@WFZ!lkoXz~YM24MJAv{W*a~E7 z9IiskMK?$yWIwja(&yf3qsCD^$S2BbU68~ri+Rx|k$ zfF79o2NPf>Cs<6c`3ZS*0tyPvL!uo9n$e^SRBYSL;0@0;|<}HYeiUb z&bE6UpHqYJs~hV>*}scx*~K`T&IF5kTSO<2+B_ifVQ-5p7U6@?Zq6bV8rtB?FD=QVVe`9JV1qNvzbQl39UE?~H3nAI-{HLR&NC)Zy6C15p|^jW1|tLW`lqk6CN%A-cv=d*DIOE4J3 zB;ID0tAd%|{y@OpKaiXL)Q-TSCL@j0E1t{ZAsa%LJw(gCs7P*U9I!j)k-EKg1 zxP5b52@_&GW5zJ8>FahorH#eR&)^MJR6q!icioo6gTib9X~Z4I1^+fP0o=1Hm60d{`Dtb{;4J4|QgfK7v9D!F4$GLGQ+8SO zu$*!hIkTDlx{O+;^xtJw41(Xyg_@`J{U~EXaE~;0XWPqq{rPVshOhIic3+BQHbtelI zuHP3)jro(&Cbijyv8?neAksM}+S(mq^UVbrGJ+kz#h;fw1RSa~rEIIF%wms*cg%8ob*0hd2{YFg1Kh*`e5958g;^^Ae+h2;7s&mk;9CJCoc_d*yArwgxRothj7NpqrpoYbnemMQwk`$H(&0i!Sr~Khn!WRj3|*m zmYTscd5<%0qZQa)pTM)fu619RHy>k7uH17{?L}I(QqrMfb-slsy2UwXUjWC1c`SN! zcwEdTC{XG-;yGS4YWfh|0})S6dl&^kO9-6XyBvsZG>F@yHz&s?DwCHsr1a zqoz=ZuY4YBTmnmuGkN%5I|mcQXDC-cdJa?d-#d#}DvE46iU1|D?pne5ws;&jr0lR9 z^G~~oI4l57KHBjG!&`1Mq0^hGUpj$Z`U9y5p$l)AI#TION58BB=i3@b;Y&sH2Z!+p zlx;v_o~x@k8mU8Y0j;U|Hv`-7&O610H-~Cq#jBDyjGg>AsK~vZL4K*80i?^FWltWY zG4%X)-^WXWG#%AYk3v0je#e(E+I+F0Q5vM2gP|-l4Rc#zM!N{ZkC3DR$8&&zecBAtPl_?y zLY-+Cd-Zlq)Jq0Nb}RMmzN_MEVrUFzOF$sZ?=2y)tr6H2M)(af-WoIK-E@hjtHVca zIpf81`D+RI#mQ*wD-s*Or200t2Z(R( z15lW=(bw$dV6&PqZCU}B&a8ZXmv8WWg8!D|^FYnx+O1#gd#~4Z*7n@GySht|vqktw zp-aijSP_9>yF|>w5lEYcui(J$o=6{Jo-Wb7sDdRdaB)ofCd?q5s<2Pni8x89^}GyT zDTZtv2mw!7*~`!BC&QoMVW*M5gaG5+V8eRfgp!a(n7%|Tj`Brkk9W2ISbM-Xp)C$& z1xa|Id`t#r@S+tHOod7sk^T$+5&QD%ox%2noC7u`E<|q#Uk^OQb1Ls$P5A&ApmcgT zO6>m9a=E_S!HQmZ(v|ipMuYG!VA&e9T5at>xtg31OE4V|T!g~;C!(OmWf&#o{Sndn zjQ-l2cpak`DGY$|h|TGQd{k@@Y4jD%F7DQg<_pTyX=7&yZZPz+Erg2&Q3*Na5?}Gr zAXh^qo@V9>px(7wOfCtk$cIH-y&wFXPyRG0&0B-l!u)`)pB>YFFP0EoWL9`6RLhI{%YoQ)#JFaB;lP(sv4t1P%^IUcj6ymRR7YL}qK=oEXfsOCd?Wlr+7igONargLCo`FmA_CBbslw!P;Z4wO@vt>o2BmNq?=&X}xG^S%&%7=;`5T zft4;(E3B|}Uvzw8IwIaOMEv#&({eE7dUymBMjm4cWq42o`fBvZL z^YafZh%DKDX`fH2z2@VI^z?onDCL)PP`by@&gN?;mEp_o@r{G`ji~jr-}(LU_&7g( z2eE>p>N|gQ{P6c+n#d85uRB{j{mwHl?$Z&-L8ZvsO$mjbdiVPBrk_>u4w=m6<2#rv z5kHo{dH5S62hB@|9}iwiPUg$xSS}!a?BNi?;S^I#-?G9=FaOUAe(*ua`&Hq$LQR*B z#u$kv7gfxhY}qD(B`e><#3;23wg0@m|HY{25#s0bjrju&~?dT9Q zq}zM<4d!vM%jZU_vir*+OZN8u#Ge?SrSkRjIZijp;-%d4d-@c&X#ZI$%fNmAyX%L^ z^JPB|!x4~?eIIKr#xsHvSX;5bWJ7dFSd?T&NhF<+(EXHrfti;l5|BcE+-!P-jHjw) z*uZwdUF!O>Xq3Nz<>p@m#e4&1jc8wtbipan8^7~hu$`g!G-j2z^kPlB@z;~+RrYdF zyugN3Y8#VTXJ>@{ItI&f)>K{F{qPe~r25gaYGy^?>PnO$vtiN~%aNM+CfeU(io~Sp zN9Hn!?Oo`RxrFz)yu{_ruKTQZnoLNzj?HkO$#Z-S}9l0)Dx?uvQxUIMY8G+KA$ zgDx3w7}0702`Khq5vlBig-V)>Y?+INDk5}9`XB97XX7@#ulTrkO)&k~QCD;=Fj1w{ zae=IU55biaURXqFo(P&|RmcKb67@PW%qdk}VO40YDg}&tU3Dh|TWvA=~BfL>rsvICrAsRl^ zK?nk98sf)A$>MbLFGws40?m9QcJ`w((W;NUdtnm3l$+tX8W8h3-K0$M>ei^Kr-}UK zDq5oeW0YOLXNiezxB5DxQ9UxfLcU{?a^p}@Ge}GY+s$gUKbbN{fvmPrnZ9Z`urO@K zLgnU0-w$m2ELT2{{}v0F7C?`(LTic4ZfW(-4&Bsn;!fQ+@9E6XnwNf~}!1q?Plm+4%y7!sO=e*~b<& zD!VOvQqVeBXcH*0rlxD!X$?Gq7n5mCWWViIEfx*h?6UKLum@Z#%CrINx@;h1^!vZs_7Jm zXFS5xGb~vjyeeW*wGoCK{~G16%`4y@`qMRF?&b9(L~Vzcg*^vt?f9ai$8ltJM_sSx3l*!9G|B(6QE5e^@%fex~ zEezBrc92{#9%JjW@-p3?Z5WDfb*`S>}CvAgYm3O!X2K^Rk2FLu{{1xF*x!DUe z3s4r2js`9vz{S_3ELc`fWu8Q<<5I%Ph#XjO zhy;EtKbfN;{uVV8# z$nwv-o{lzm%6dj03jT0jXlv5khrD9+3`K5f1W9BbX-(ZuG*N`pgAOpQ>gvwptSb}S z(weOB_yrdcl|AgKt$RmrSnhKy;Audcrb@;(#JNnph|P^6B`vTlO${wF-%00ML@x#N z%Q)?eVp54F+KUwZ0y}v0Z8dUuvJl~`o>F)e^g+y3%!h^Rp8F}8eL z8s(r}Rgdbb7|NU!^=QkVLI-EchS-ADyS*fA0w~GyX?g4Nl$~8hU4@iq*>~H3%mLSVUq1OVK9HxOE&>63c5P#yrDgwmmtYBU0lFO?X9T%USKRBunbgm3|wyqOS=Ec8M2(hJJA?Y&h2t+a`Qj-Tdvb<jRi}ES*j-Exe-^+DDG=C>(U?26vJgu7w8RV zfXa$f>nW}XU%Tz|u#iw;60%r`W8T%*qtSI`R?;W|qhL8S#Cd2Jd4K=#@2U_bhP8+A=gP% zcZX|N!r)6EYCaC}eEqZd_MAtCv9aJmmHwguIgfMKdlMIx4xiBvCKS;*Jr{1P)x#o@ zw{b{&+DgNK6V@3g=`>XxV1#cUjC%?fKJ`2x`)+%uJJBP%sfPLAKgH((w$9VoxY|!q zh+;c%HZOkS8iZX19GP7h1JvH!5V)VI$uV&;@I@@h1K7s>1L3awbER=|`{VLXd-J30 zQvF-`x{ghY!SfaY46ezl{~9)6V=BSgZavOGhmzNso+PqiCyF=Fbdd$BR`bEgp@c<> z?T@;t^Tk0sQx?(AYz&X%x2&i3RV8&;E0#T2hkLuI+fuXg9f9+vN^t>=F?;Mis<1BA zAkN*eTkF1+>6IQwM-8nj>UCL-Bws?i+EP&6yY5poSThi@*_sDY*8mD`WL3hP$aA$zZbFZe|74Qa{>dSD*5u>~ z1LL;^3ac?x9oFmbmFIlzjg@0sPn!G2mho6S@$`Vr4QS|=I<7l|9O&$=qF`LSO%Rus zqy5Cs2-tk#zxnj{%#ks1SRj40GpW8gG^lfpw@FWB#zpNg>e3Xb?vvoj$?VL$anBJ2 zlv^x)?u^61zXBt}VA*V$R8A6(4-GB4 zzW*3NgZf!Dcr|DuUZ%zG?GL8EeZM*W8f`ra{coUdzgT~C)$`v#J>z$v&Z4_*^TVe& zF%&$uA-8;eudrK(D1x2Y&eD9f80PL&Qu)DHVB2t zy?$>HHIq$5JbtYl=}xXxqZCYDDU=0 zMMvyrg&GHVeA~W3Z~X6ZW;3HY73*26MX_*73kI8`ZO1*o zkFxCv8;yO!*lL%oQ~UL}pwr{Td2Vm=8Eh1)6}atHiM|fQ7?78Pl=%pPGaB^8fUnffFlBZ+2V9B_|A$(uMWZHPv`YNNuXzA zcu9;A#*n$FSmV>%At%y216R7)qBOtOD!L(kYY}u102X0v+fOW*DP!-A!!n|+?4H!C z*ti?lgA^1u>nVXl4x!vw_y^eV*s7xl9`af=dc8Ka3vE)Mop+GORsduwt*|!gRXG7H$L9zvC#;wx)JSK zNYq-e9rFl-YY&X7RQtOlDezh=hatGGaq~#|`b`8mv#Wz#4hE2iD$3+OD9eSg-oErz zO$0GF4t_O*tSU!ba$U}i7g2UtlvoHey{im+b-w^1JVl~ZV&ic%E=Qx6W{v{M>(Lns zB&;|+w%wB({TJ?-gkh-~iih6`Yy6JkSX*bRvaUIFaG zdP{Bu(FirLwxj@r8cG>Ayja&v3DSz-Cs;GvJl-`g;2ZGyvV7A`=y-(_*mahftTidY zFg_;O*H%Cq*boN}YA0T9nCtFV#|;3=S=w^VmvDQ>VoEPWX7`&f*-?*(oCT~M%$S;GcKauhFA2-p~<{8#_%tHcpVeYVd85GBH@RLrk zDaYX{y)Q$x;f=PFxgcRXkhn~58#=IM5&C5RX1 z*1d1i`XW5pl?@=^jE-Pgqp{0KKWHC_s^!8hQ=%P7b33MwD3OH!b=7B;?$VBsD5i^H zUd&D^0G#yhd9Jg|3@;EF=YZo(5UKIddUM1nUM{>b6`9)ehy5=QoqCF*xW1sts}~eyaBx%0EWwKH z+>{jaB;?`DVhAKj&Kh~7&&Ht$bQ%o*Dvw*Sh^{v`8kDk=1r9Ela|)vK#$WH)Y?DlTfwg5T!5W}v>0+!yss}t()j=%ln4nlC-0RE5DI0d%BRHIsr>17QS#)qpNpL1e zS&NRN38i)IXetFdJn?i~nLi*r;5{&B=5cW=-U$n2KhjCh<}Xu8Eq`KyP#zk5k@)-5 zZ*-o2@CE$TX-(N9H(!Q&4r8Diva?{w{<3x*hgL;=UAgg#Et;fWAENv!aEYrMC0J!Z zJIckKl-t#*^)r=v)fl;wCK{cCIMuSQKO-ODs z47l}bIu;IP;G~{ejyJ8J22HjAS!{UdAq75=Cm<5W{9!u^@2KB2x8Ci%xzJxM6Qe-t zaVUlejU(icpK9@Yu{hENq(myo>YtC{AdAiFzn8ayD$S+(JSjKcZeeb{!=zzp{+sWz zFwPwj-53Z8Zht+8m=XT-C}v!O;2cScjKy6e16(JuihBKbi>%o2odt1_&oys!wRR?aq8MbK4J~nVq?aRE z9J_8iwW*DQ(=ShQ9CAT?*H4!1^6_!L?U#DeS^qj93ii9O)H_KKTuLji$i0K_SszLE9rK$` zXgRJWQBz!}SQeBV-?flWA{kBroON02RSRK!Zg8Q>JA9U)3Ui%bMWb@W^Q9!d!;o%$=bli z$?ES&Wzg~G-0k<_B0GJHZd?)ZKku&OgpNL1!^?N4AHglg7~y(-vzwZy+>(8NEZ;XC zC)<05NkA5`XaY~M(MAPtMfPH_pZcS{Lv0b#AU62g{IRLRfnSE)=Pz1f@qM5&Y0VE> z%cD)%f{0)_H+V|idjqWZ(##lL8Y8Y~Z`8*gWZtWAemYvin%J5kbWqTy3BNQV3LZ-N zwj_R5@pYn1ve4gde_M6`Hn_c5Io%w)Q0^;J+&Vo0&~g45w|wmC->toL4YkiOI)&QM zdG~DHw=fxi-QArBS0kssp@q)A@o284lXFi!9L3v^6Eq;d)xRCV?zj=4)SGCn)@&cx zJs!&)I@g`@ER^WNNj6Dm$VFXB^NkO=_S|(_Zt6FlvuGI=qXx?xLyLV4%J^f_ z7M?+yr^z|o5JUq?nnVkNuPqZX?N>ZPwG%$TR4Q*imZT@WQ*KzK=GLCG0H;MB0y~BW zY9bor$n>(G^es(M>@=gB$#H^@%`Ph}jtw-( zv<%R54AA&|zdJrWyuc2EGK(rA_(J-d1MQ!=LhpOZHB524sX)vop{;opMOFG?G;IxG z7**7Z+0RHs%eZN}rj>Q+ZzjmK#5CpN{r$eHg6R8{A@-Mf^g~yII8s2LQmZR?^Udn* z#n=I=Fkw1huq-Lcs0#WD8>g@%Xa4Guwxri5#M(?nNTcDYgtF-j$*lW}wo<06c^q}U43__PJme=~y{-yYF0ZT-DGCOGpLUGO5WyC> zN!KGrszLxY#l|CZH?W7o9CuI1sLsA2WZv;5PF&L4bp$wbId5mMwkXf=jDzj8V_XS z)y@baI07Ch+d-ProADoEXhgs`S^<<3?exB@^f%&$K%`8joUpQFGuk@=OuQ11t`A;F z!Z$!^plkQHh1t9GZ9Bjp1?F18VFK8@zY!;d5L5IVO9uzulsLVhih3W?>TcROKL9eR z@!DqM71GU-KbT3>5UrDD?)jxlToA6fT)NPSKno`Za(tPk6?f-;O{R?iQO8=7m?0|C@LkkEW`hs#7HWY!E6nT>I z^et#Sy>0tR=3)kx@`3*at-@vslaMe8vaP>VtinSZ?RrdFNRc`KnpW2zfhM~wV+b6E z*O6vf43JiY!}M?jtDzP_0EI@0LHVN)Zw!10F>v<<+jSdimLPfvBaaFl;duYgc`*MV65-CT?wDH7!_&Fh6;q5fk#Ri&cCL;+-pzPB;sm&5^ zukx=qKm;p5PUIZYQMFYgOy^j;z4i~)SwGw2k;4eUj5G8}TCpW4GUZZYiDJ6}$1*n* zezsVZ6ci^W?r;fZ&aS?8WGHFn@E84JC&HidODuO(N9QK37{$c6molw%v7t17!|}wM zPA4jQ)JS0_z!6?YteMc6(b1VybR39?MCX!A>stX(;5pSNj`B2fh2>0aeKU;}-iq_$ zoFP_Aw)3$JT7qrgp|sfPr7=fGnM#rH+BP3SemQc-xdk>!c!2(~9_h>wc^_)adEpbC zio?^1+i$G=O0u62m10YvZq-h=t)5r4Ft`-4It6RUqw z1+t?L6$;3_OL|V2dX%FSkHyHm#vSrISm_XI%}LT!8>4E|=21%llDd&%W%8p70{P(( zV|I%1)fazy=50zXxvD#jMtN@^S~S<9 zhA>&j>C5@2l%1TATRWeHGP4U?8A&?JxHhkab|jCr=}>OarFeld-HlZqI{hc3KE|WQbNdylis_%5>n|P|vh1 zoV3n(uH0U|J$&SGu^d<# zmoP=9Sx$Jq8x8U-Xc>B|(2BVHYaD+x>)$-Eb^*u(7oO`yvV~+x3+@5me(E|{R-RGO zc)`0;xGOnl6Tm7>ds>l1jhw{T11L_~&=)@GD7x2{#91O5Mu_iOMqSZio~5nMO_uum zJOZmaW&Y#4jm<8|RGk3~bTrR?8m+mTJa1^Lh0!)M7<}9&j{`#0;W86)plchGI-Gp` zx^^D2b!TF~@-FHfi|&an&Yf$av*>kIX6Uf4Z_e~p<0Fe4jwIm-Rq^cgMgdxkHw|y5 zSc6M@P$8u_hwt#E{SYkbf6<0iYm1`upqddGRoNEz55k5FjG5OzhTeHI@ohmrRH9YF z`3Tsc*qhuv$t)=o9yvIBX^0%h+;xgIfVHbAhuF?7rf-4oQ9|+hpUZAwfHD}V5G!! zY4fp%Uj+?S8~6tDva=mC&$~)9<)QrX!OEoYiRqijC2kvJ zLc~87vzChwfLnkO3xcbHD(AECDr4Rz40f6F42^xrxs()nbFeW5a^20Lzk2tJJf_4* zTNY$)$XQM82j8*6Kd&KJoD6VG+HoctEm*ch$m;Opw z?;Mai@pV`3@qJt91&k_2o%#Q#W>yA<|6OY4VEI4G%m0BwAKLyaFFyjAsBJ>Byd&r_ z3D_h)(vJ0Sr8tb^n9x1EQ`*xiB+*W012Vnt=~}B7L^OLfTf7?wgdgyyRi#zkO}(96 znDX2a`+RqEejgdWKj=PzWVv7KzpIr%|LT~t1sE6%-rK$&q8;OI`gS<%&||dvxKD3! ze|m}?arnQrYklcn$z;b`w-ksB{wU5-MopFKfppnp1AwKUi#tQ7w#rVCz`rY5uD zK@7=0x#i#`BEZR$F4MvUJ285u7}@37U|jfk24?%rjTeK!ZEdc5r1E?Pv}{ym>~PiY|_r?zdX5)a_% zA3*hwL_l47pfmw|XTVaqr(q)yB2MWUhB}9L=bRM7GN{wYrbW-Xjx0i1dz0$&CJCMz zn`1b8S}SZPw~E3mcz_*M5;axe!b9gjE2bT(dW@S~QCJ{)A{XI>x5~zur9P!Me)JC3 zKC%DzKX_*Q^;+_s=@&4w`Un`FAN$f#G80D9ifLLZ9A9kn>cOg zPFm0C_t|mXsj7NhH*2uC%;lQMWMn9s#PSK0;D50o<-s^7Os*f?Nx^t=xQamD-6mYF zwX7M~Zvxg8c=Jx4VUT$is=YTgn5h_=>(gc>W%LC;&ykvFy46pLIj>X2e1l7OjtJ1)mP?_2 z{R&IvRKI?O13qQ*#N-?t_VkE@Is)E?Yo61hde$I^K#OIGVIbq`|9+5xiYETgjT{8 z`R;0VObh>BtdSz=AgBzC3o?{|pl3>!vVH(abg$4*Xc;68+jPa|eHpKmiwsWIi6RTA^nvBADPAf4$tm<5djo_wyz81sOTglZN^GW>=-2D)JPoWJ<{SS(N zF!z_;`|1t&fL0Dj21ArjUlZjDD)P75vBkd z%r0v=(`XZK+Ct~tm>=E6kuY;AHSu=J(c5zd7;g7{)$r4*EZcV~(3U`2z0(SYG&+il zLpuuqmffo^`F#XaP_Yp40^AYsk1&!xEITV>N6WQnp>AN;i;Qq=Qna4_;207F@Bb5%X$=7$vlTdMy;)~wylgXfDqiHdit(2fU)hG!{ zF^A!RGkX<@yO32@T|%(<>~A0cke6wm1#UTO(4s~t@RWS;r}UHhk`*p3=xFq0iO-i;PWC=R!P z_eOinuFtut0vs2@&CZ>TE5clo4M3EGoTu(;xN*SBc|*mjUHiMfVrD+-V^FM{$iUE^ zr)CEMARgJ?-^Kw?#l*$=c~OTCi~x>NNTee4uWWwWQDW{%a3O0YhcYX-?A zl)6eX7$@s9{Oi0^6c?KDD7^x-=Fo(n8A~qcZ<4Dd>D zXgN!2xyv8PJScHO+KcPpu`J^Aq9-SuKN2m7rsr5}Du86v-~Jq#ZmfG6Yw?{-4o*<+ zU{;txE0b(CcRoE20>`7c-CqiFJAAHR2Gpn7Li&2R^ovhM-FY%R%#YcZTwPuY3T+s2 zAUgn<3T}@__Ys3*(s=^_pBtYjlGt;IAXTuV<@e}MNnFkhB{Yq}vg8Q6pnL>vj%IUM zSIr%@>$fa)i9cYW;O2t!y=dqxR8BYkW#3+tkrY4PAgvsy*Xt!XCTk-52cm{sWYz)ds+<7PU_p~2A8BbUaq z%xum}J9ebVZL7fN6{u1j7;c$nK$<6?n));JzHZ7-Qtw^;V6d{1Q#>DV{#^h#=@fqUQ|6=kxsBmK&GJ?~84zB6(%>bOHX8OB+$MK8O zHuSa2l*hkO{rm|X?I@NX7JK)jK+vPUb!zo$2k8%!U#?!a(BEGzZ=VX^D7X);5 zD)LbOUigqLQtG{PIR|`=A93!hE4iii!M!tX2UyL`;Gm~FZH{?=UD%=XUY#0;P)-UO zWZ^}kCrL=8CRvx)I*YHYlGfhN&UX*R8KzxumW7L8%oR&7biH{%peHxZEv+0pJyP0<@ z2J#|*caf9M^&C`9Oqo`0S_PyzS*$Ua3woJ>XpB4DM;jW_t;}tEBqfK;3G;k&Mu&E@ zH9Jy^8UK8ZtRV?b8+QdCk{QpWnhM@B!%<=jY-x6<4=~X>vsBpZi!VKyNI`(Y0NKj-uy;)su(LC{Pt^ItieFU5@Q(UjTu%w+; z0uZV@K}|M=89-gyK_=kf&zsUaT!&5Ve25%|v*McmHgMrxYu}Bf-emuX4zvDNo&8`1 zl(hN7`2ul`yws#HFL6+MJbp#Fp~2m{0OE`%gbGQTnvG~@>M*jL$Ox)PQ$m$F5`5)W zO$nyhf&GzHZ%45acorIL*G7((4uA!f2#8#g8;ZYP$5uY5yf!SN;s@t;-CF- zxq*|XxtK3L`~T!=g)&^I>D~fbKN&#_ug%8D2~s0+v#0ahz(R7n_2R_yBKjj0lFNndlwqr zjQBW0{qF!Oj9opt5%jfrII}#!N5Y$Zm9XWxg$|Lj5ge_jQSlTH>z@EzFO(9&diF5= z*-F%b(CFHH7u5p#5Qdg^5<^4g$8)1L-Vn+FH7o{V$GWNJp5bWC=gyReYr>y{h5qoYwv6N!P^1=iRfJVI2p& z4W*?f8lSc61*;>So(=5s7wO(tXhmcxWDIc2wKP{GtYFWQa9BS~gEnR7`5cmryzRTh zts)Z2CCUhZg{Ij`!w{pHg=hu`q4GM6hvH}Qc6i7vNXkbj@gY>UWdkMowp3PFS|rKK z_f4B|YRuG)EaW_(vDz};XTEb$Z`>h7VJ}~j@d;SU{nIfW+rBAT$Z*OB+DqWk?iuf! zxLxJ9B!i$Q=}#8%0p@nyA72X3)HF3g<_O~-6NT>OPkBRBfaERG;wkqg^Iil?Gc_f6 zS0ZhWr2#j}f}{hb^KvdU8C$`pv;~rVdgGIZTT2iryL@odh1*M3`KSplR2M?Ksn}rC zrOCh~m&iqjHnG`kJbSFvq`;vPRV-{o&I)Bu-yTF%e(WY`;lesbkAkPA3b4{~SZc6= zx6M}(=*p6L8vPz-)^_TH7XQ!}l+#rQJmiHKQdi906m}ucDdV!A_gbIWHJIFIGpNJB zZUT-OlWiwQ^x;T1RgHv9duTKHv+3)%Gc)jVggcFYpI_4JV^*~iZIUQh>lfcgmxIBZ zX>AFU;>PR;xdFyn8f!>i$xgD%Osz*yn&yM^lG5oM^ywPlo$@Fn$uz18J><5cU*zs0 zME-M?#RY)~6uSKQ6YCLF{NUHxQRvN^>Jce&O_Ri%;WCv$#*ctU^WFtoi17f}9JTiF zHD8y7zh2IADahL%%8)#66+B&H^l{SKC1dIMH#h5utYXEA3} zo2-gN^S+XxC!$^!^wF~#PrO`Np*9U8X}uT1Y*K?7V2={T0FSm*GrC)Wz6VrHBT=S8 zQ&j1r8`^pr&0wWIY6AOkaGtUDtRz+9r*X&`;j;K-PniD41a!8#VvD$MRSOT6MUfIo z_JIl*l?GMK1qYJgYd)(c_?8B>;2c!L^f`@qGuf2*kz$w{QX{<+WL&4Zw&TtC2QX^R z1%7WZ0~xt?c3Co*L%A2keZsSjsdW;h9IS*YZ77=$+;COTEGhq)QG_F=9F@+7Z043U zg}eecY+Ac&(F0#N4D0a)+9i5Htc{6csVa5n^Ur3o7b7T0Qo*G@RTyS>1RutSChgkRPsPr9L9|8R5zhb8PsKLe``Xo; zW1Ljs7;v(9Tj$X^kcd@gFX9!q4|H@aDtnf}-zcvV0)UYlIXViJn9jb2R=&kMoa4qY z4$_{VdP*hI?HG~A-#lYHGIH!>?R63scs81`S#>%I*EC~FIlZE|oJ>;fl`=ZG*|gy; z6##0GZNFqH#PVMnNiOAAuoD=5Ju|2P!%61loQ~!{WPOvJ_2Z#Y|B!T6XNg|;2CVS> zR%EnvBURSq=j-O0Gb4(x?cIL0*!W1)F7y~XhU(VXq?}^;u92*X6GwL9ScfG`89hpT z)!gYbjd&gR6F0?&R88dF+88lDz)Z5%T00kL=yTdIWi>C#)g?FL7SmB8|5}mK6y?^_ z3p)LqJagZEolZEX$;a=fuPTmjpHK8Zz#+gK5&u&J{a^9lnb?{CuS@OK@1^!|;GyAO>o%K}1Anw~SvGxP}9w z0XvNS>)wWvqC}fJx1La=3|>|R)4gi!qz(BgMpb|q z-06kUk|be)_Wf~vJ-K}db_UCjW8@OQBwNZQN!Pmy+IP|Mv5r>lUWi-bEtFMVz*s?6 z*~oU1+Fi`0Q}Fr1a9(COB47CH*^Q4qI;l@kS%UAQ6!<4V(a=-?L?kM%%$jT5PM-B| zM3J7k$Ys|ikp{55&sm@_*#<@-i`E5+?m#+CF>?U{cg)Lb?^qTMUxi2)dk8MvaJ51u zNd!u$2@OvYShAbM70&%|+bZJTav-eSSkI%WLYQGQ)bT)kJdTgJaB%pug7tUT{)I${ zx2Hp3d^tx>iy1~gA%x=uWlKYL>Yd;IQ+Ony&Gf`OtX{iA)l7$m|er4ZplX!muLN`cQTS0) zkz$Z(1Y=Uc5n@=;0PVzcUv>}Af4m3LNWy@|I}oGd3{2usjf8=E0L%uj)_5r@-F|YU zmp~?%kS~S-MNr?#o9)^*eW8>-Cla~naKZ|bCTnTOvP;|p%9gXF3IXg5`URpQTyX2^ z)#7M6gDxDa@5V@ZEd2?xb%TNJmv5gn$h%>N&TEiX03Uou5C{jQwhe!&IVB{>3#gUg zdRqaiOPChQ2I1W3YO1Vh>7e;o{+ziL zI=D>YeLS5^dm1_`x_NQ%;H!H*+c-XV2ZvIxPEIUn`*Bain~)vgs*1}y;9a)~h}NS; z0zcRIWjaQu1&s#ZvB!B{TNA?B`;Td!{uSm8En`*Viz!Q%;Dam0HI@)=as%|4heCY= zepR%{(!bq9t>Hb4_a#8 zr`xMoBYf+n?uwzzdBB7~?_{>Z*})6v_N1nGhr3nlK2SMw>^zdan#6H_BVfpMrdOCk z)b5%EPc#144sW#C;B&_jmt1e10rF5z-6ntR@dCLATK zgG9UzT_1~H+>Ac^csMFo1bb0GCv(4)kYS{+*tNc44>!}j6@sI*vd;EtIx7coeMX9P zIjnns4r086Re<)OwfCsyd06KX|08E(j1(9Ikv=Xib}ZH=AEAipKkS#sFjS6(gC>{r zU{7@fVsF^8I&&|bg=HLRe;#AE#nGH_+t;7maNnl#@G zIVc?Mc0!^v7y~(cGK|Gl+Mg;oDlb)3J1EAxy9v8;mzJsU0O?Atirr%c2L>qg1(t9}U$woy0$EY}?|R-6b#5KXoGwjpRRDF% zHo?bJS;$6xogElk3rhFy!Lo3ZBIH20^!5B8l}a@mKP)Na+z7?lvHDe~YXw5$<=t3d z_321^gWDBOY|#)*(V=eIsXJFAI;O$cWj0wDW20*0%7#PS8uYKgU)&Q03d zpjP()&3|7t$W?aZ9GBvjga7&jT_7cE7Jlyj@YZVMy*R|1h&xsJQHcQxzZuH>Q(x6o{+X2>pg z!*is;WXg=HL{{OVW7R7_+rgDi0T%EBobgRNdZBfTxnKf1NDHCdR5qz_$)c{8$z{|9 zSl9*7h?bR}&UFHu`MOQyc}wylE_YiZ`3^&phi=g{FDtf3Gqq}QkY|inse_UqiUHeT zjZU6xvf0!tK*{>%1{e!VRh&{Dg7IZ}>s1gGZNi^dz17++xSx%N-KZR zYoLJ{(5#7oM`1y|HtX8=bU#E2X9C4RlX=3osOJRvOThEE(ym1JFz<)BMd22 z!@IGnE`xSta5En6$tlL)t@olVe&0l)7a0 zgKugF4zPpzQS+&;3G&KN9=}|~7z`mATedL?jgq#l&x72XP-7T#p~{d|yHg{vDul&k zo1azM`T-RmOV(Fndb9B4v7?)S-uB(R>(!2&)D92Wkz2LaX}4He#*TMYZu~ zqw;#inAXSL%#sj#{i}Nci7l+*%6G|9hU9iH_t2Tj=Mi#lu@hwmW%T9C!S0KN=jMuP zzM?EX_lnFgqra&hdN$#B&$>0ML=uwT<|(b?s97!uwP)W^n%swBe{U|+h->su>OPpG zdI1%5x4+)V-L!yXySyh3^Hg6=lbfuN;8Qn7P6Du90S$l^T5>jMfe2Ox8TEtJ~226&tlnuk(cF>0Am!V08dl=*w)^tkLCO23Lu(XXdnR2L9P65R*y5 z+wRHmpFMtZefXZdxP2gJ1R%|@z|dLQ0|{WD0v7-xhO2$ZrB4Fl2KLSuNcJp+Fh#hw zeQ<{}Tc*))J|XHNesv=FJt|)jlZK6%;t?dUo;xf28ty@zmD(&P&ew6x=Kv+ z!)w}|L^YGT?^;Rm=QPdU{b`|Xh3s+Sv{ZA3Im68>5PIk~PY(!ufO9q-L6nLPnOE?x zSF;<>$ukQ90*f;nfMZSro*2tQkD;W(AAToQzj_T?4ub+q1S2$&VM=M&9RS^s_2Jxk zqPrG*`Xx77k?5!mH=6RA!~4i8`1H-pXlAldKF$;p7q~USlt{e_JxR6)uv=S`%IBK| z+}bE`{S2M?(J+Z`#?Y;V12RFru81%;-I)til=^vQ`jva^yGm=@Ba5hx%04d7&g|mE z=&XOUW{&YZv!tHW#B<(C50b|KyL`gkd$LDdwod0S>!eyl#cf+k0Wt-4OwtE!IZ_8?L_%1C^eygD~ zhgBA|n0;Emip@ExMao8Suaa0gv@^}?UKpGtGpJM=@?bY>c}PJ`2mvY3%^ZT4oKOz? zIiI8hl9;1-({@MFE2)r^VuH{8X3PPk$kn~5-M}H?T*ma~*(Dz$x-fLGbN%xkex7Ml z67cKb+!~*|30h9gMf%3eTm5Nh*8juUIW>tAZELn{+qP}&vTfV8ZQHKeW$vZtn6p)r{NW zQ_w5>0L(N}rZg9_uDU~fe8foo;T*tw{1eH>`?|#JCE%t7#W`BkFy;-)$ltJm(;K^a zOuEA%4EH?{d@iDO*Z2hCr@t-@tGasNghO>L`YdFD)C#hse88z^VUk-c|)RW`>H!?AwLQEvEDTy)u;=}ba) zS5_Bx_~;&Y)j}~)0Z+`rDus}KFU7Se$;ni~s8lj?Yd~D`vNQ;zm8D)Pzg$QVKiE!O5~ zcZkRbZZ&9zCcR2NE5JUR%9k6rQJu1RU@Z%)Qjga)m*J{nbo=b~GeYrKM$Uj~3+MZ@dShD@69%CrdQ;PsoiEK! zAr46q!_&)%iAs?#e8S^z+I*arZ3B>~BCSue{?Rl$x^^(J=DQe(qVhgB73kwyZKmq+R zdoczSIfCkcrS#Ms@S{HAYVJ%G2#Vqd+=^R3`bLxvwj9Az8MFrxL1DQ|6cM2y9IQS9`N?CS7(qRa$`I57pVtcnkM=QDu(USUP>p*X`46R3IDhFem)`Ukb;jQHFYGkwiR3twMaYnXc^pczPCa(*&M;p zKT)8^3tG)K*JQoQ~qALAsY2_p<{4mBHwinS5$5s`_pLH41t!?xUI zg!}3tdQ$D>Wk8{w5qWkPiZ|bcuDQuDUTACiqhm2fW^@H=Ec5!&2&kxk$awf@RqqxM z+cawGrCTW+a;7@ScVE?=6WKu%ua}@sb@>Jd8>RaL>hC{xQ~U5eh`|hj&V@eUO8>EG zjmEph-8Q$~$hBwXhn-)Wf2Zr#a0<}c@34I*PBjpDbv@!&fGZzbS(9}EVcmG7?5d={ z_ir4b0{01vhe_mv(?zzrJuSD;es>Wf_c}w(o^Ayu$gpP!y&^vGe^wV^h5nM?( zdr&n;-KXeUl9wLOHi1-7!cQP{8k?0~YYtQUB~`KD@f#KfgOjm#gt#zn{9AAZi{T|X zrQViUTAfYPd5&q5Kzw2^r$U5)GsCzFe;89nb|>!mN@sO+xY}W`HuMqCK6I)$xka!8 zbMgaan=x5_0G^+XRJj9S1T{^mG#;tMx@h`4)W4~^zr!!LKZKEOj1~;I(7pX9w(Dqp zM>?D27peNQCXBWIb|n1teN_4b@Mgi4@SkS6|E{3L%<{i>=u4Utu@}M!TMww;fb2S7 zwv^*QkTrwX{g(()lY^$f(5tr}%02kD_zCBxwuqZzT<%ypI-; zYPP=5+8J{Hla`1IoL%|)8EspyZ|C)Eq9$zqBM*6RdGze&@>fRh`(uP8iD=>e3;B9{ zcyyr-Df@gs`&FvZlVgV`7ozb2lY=>v^6C6$OkoK`qK7{?i8V9zA%@fS$TCO1XtTt~ zKENly=v`9nwr+|sB+4qPIzu;v!^zMB88@$KW-OZTkf{+G1&lxdg&`EM33bn^q^kmt z{ph=TPV*R<31Gfhg7$^2SSdp*10Z`5LeM^~GM2Zy0c1j%qCr@vkg6>RFaUKKZLTr4 zT3EZ%MDW#QjAc-aKafs>Q2!b)?bxJ=AnUUs#8Ss>B0hO}5DP>oxmU+)G zgIK{%=TCF{N_Q90?Dy@KDF^|V_-2i7@2PID9n{i5wL%PVR}&0Q0nxz&wZ%lZNFQbORcR}`Tuu(2@xb2)Gh4W!{=@@$^fs2(wxxP%mveJkC z$^%?{rlq=E3Ye8q${uzbPSe{2C(XBX&a!}#L?%3BIFcIOB%4myOY)5PCQ!Y}9R;Uf=>KnhibE<}x$O^GeOK!jWs?5H{j0#j~> zlqyt5Pd_ohV6n1QL?v?3UHTG{$up9wS>LqP9YUdrM4p3Rw(FM1c>Ci~4#!kq^NP76 zUFDE|43&hE6qdEO03SJF7;-y%#)ME(prZrqr<%Kn zb%4Frq87Xhg;=`%8$fbB>Sn5}7w-KY;|^mNF7g)}@z~ zOqnf-b)J!vXrS%&jK^v-nCfd9`4H`93dVOp#Wq@XIzF>J^}>Q8i-%jESAd9l4nu|w ziHDf!yl_3gK6W;Ws?Ij7II}(|cDTXOWKhQB<~O>)9Gi?MUc(X1FF$mnTB7bYstR%` z*yZW!tJ$5q1&($sq1UMoQ-sU}pROS0Wk_?7Lm*k&e|iS9j+OawMu_c~*G%)gz#-6n zh)pozke8oeZFtjVV@y2YaXiywR$SHgfidpT}B3}H(u^iC=nirTt;R%34P zv67=9k6_Fe;wRPi(im7w%h@)KmMZ0ThJJw7;rQV@?nto3yQ!dsY(quY79|DJerJ^1 zd{z^B%-x@)46mYV1CrC#0MHqH;B}ftZvM(D$GMEB>|)!F~0yZqW5Qlq5S$B zCwidRzzCZoj?Ku0aZEq~L!MFzH-HA7c^hi2B0=Y!s7=+R#452fyhhIg)7@kj@GMS7 z-WgkdV`;znvbx%6apkyqC)Z}l39!)qhvJ6}xMPGYDi4YF|e5arBUrZG#GySjn11jE_&ls75SD}T4*BMNBzXNkh4DmzHH8l$}IhDP)x(RjoM_IhEb z4MzN7G0!@dqDUsk4Ps`zi#NKd`73|wRu7u=6Q$1AhGp_y*K%W=(7Ceh_2#a*i!FOu zv{Zd6-A0}|{R{nnC%ehCE)Jmqo7*m=U=wj7KBOz8To_c%clhG7|2VtJp$RF@8At9= z#0`F#osRyRt=_HFQTZ5I^#keYp7m(8c2btGn)V}P0lPsZYZE74r`^#&O6oxM@vA@g zqKZ&}(|NGxVl2%FB~OeB#Ul}x53l*O*s;W54TZ(>?z(0l^RcD#AY^4rN`t%em=R#8 z*wz{ynA=6LAHG0F(EBx@17b27M?cTuz1%anFz4E1>&D@pqDwhS7&Z`uLJ21&XSi{8 zl4^YWv(ux3dL*2Pi_bM28ZP-8(b!iA1i&B;rZTc;;TQRe(Q1fq-wgy$$CvBN)4cpX z>vsvEc84gaS(1ygFCzv-5$@}cGdOQ__Dz(B2}jPZGSy@CYhtZ7`B4wXJvfJ7(~ESq z<)yH&JaJe{PSRIvY(DP*_B{6McMG&Ch^kXIsn9XsMqv)YJJCniG>sgr3 zv`6E>u_>kVl(I#oL&)_@m*S@TY51e&l!B;B2KWZbz*lKdp_=QeYKvkh9-TYp@nF3@ ze6rBp%&}asU`oEjNG;!vGB|f02U-^mLxl}1R`qkKQg+N`!hfT(CJ~0kphHiwx9p`h zCg-$XYPK$^SM>9QEQnUk7@Of`3VJb!UXA@3sQC@F1kEF8ATt|G@8-{JAkX;B=Ww?d zdEC+FSH3SzS0l@sA!6kY9T;^1Fy1)%wJML>> zL;}?Tm}m(Ia4KV6&qpZWp?TOzN4__3vllRkS@N^8S`NlludJm!*{#U>v;n&fF;KH52F^-f7j~at`6+A|gRn zrQ5;#X?LVsl)0rw-#oFS8VN+@d3bmsL~# zln_w>6gfH>3=1b-d3__P=c{*57BUfjBh>k2E?NloHy^h&q&$3 zhl^aXQ_IbxP9gpL*w{g@213>z$)VjCULm66FBIUsLrnR2rP*;y!2dPA2|+LYCKXEp z*(ZKx1!M1CKkTBKQ!#6IUw-I*w0(I~hl3rqetup}9PhZ@L)CwCQ66Hv#B@O+yOmZP zw#u7-5a%V|csEFI_FR#_*RK#^BwZzC<7tt_IJu~Nyc#E>rphIuN?e?sEB@Y1QYoZF z&kNrJDv?B?UTR)Z$hVxU^K8W(7?*CPe(}CtoIu(3iIK(`o$nVZwo?t^n^5gtHnpne zko~}PsPozn1ZertSbl(U(437 z#71Yi+=hBdlFw}r1wJ&C@EMw|8jWM#lxTFS&{g2bx+%@uLQ0=w8VFAfghZrDoCpgM z(9xFqt>HKFOX7KO={!v;ZAb9d(@DIFi0Qj9+PwHCgS&B}S%<9@c4RUfGf!|w1wvhH zTXQ6ednWKZ^~)L*0+Aa4C1&zZ{E=R|3(_^oMk`D%Q%>2|L*K$USPf$ z?BD-lkM^)Qm<4x`i-dCc@;n5yflT7qxth4(NE zNA8H4aSuB17AL${56OhehdFSGUk@?saP(i#kDw-wcUR5dBt654TgN6r3%5omBw~ee z9ZYFtJSRg`^FDqI(nB{%PVS(th=wImD6@5UaBq)_=L3r?j03>&f7GFIG0MBolAU0@ z&!suFAI~=VnsP{NA1spGHz5w5UL?JtoLLA*DYYUTCTc5>=&|F#tvxR*=UO|wK!Drx zRQHd@5jLL{K?`}y>>_@Hf=Nr1IEqh@4dg^a*Up7MlJJ+AXwx^xf_RQV9N%)ggmZ*w z2{B_QS^jsOEVNd^F;)iHh0HLlG8YOY2bvuVJR%Ho=MS`?4ax=0_4;aWZk$cQV=Gyv ze=p$py$&|zn9D8=?G@X_W3b6&zF*}+O^%F>nIn>yqh?8fxOq5;RtfAp7ZuBtf?i}4 z#Ys!6&4gvuTgUk8fEk5JYxI&|JASwhxbSYaKgs-a-({_g#J(J>i1;^^f=||XwKJxcQYk+uITb@u(w0e!%-hP!gI!@ zjesbWzcW`j+Uces1(HJ*&2aU%7X>-!U#_nr=@ZB`LlJ9ZulzaH)>4hr-GH?nx}AMH zu({e|0V#80E=izNX@$_x+t0&vG$DSs5>mi4e<%51uN|VKjN&Hu$SOAU7W!V-r@7d$ z{D@VpsJ??R*-CLm+=={t_wT%J<<)l9Tg|!LC{a&UIL%Hr7lGel<8tOqpwi;ikTE9& zQo!aTTzwEJ6+f>S1(S^+SYcso-Z|#&YfVnilU`{%9Ns=?83H4)#yLgJhdwoEGm*D) zScYz5i^<@3Y03s#a6V1NE2Rga`CTZ}i6SU!XbU76UaP zkJ5U!O(-G8B3DVsqdO8Ys6;WfE53Pc`7l7k>zEk&)ymCTyfA|i3omIK1#L!rCQkBh z@pqLmzG|vR8i{&eE9h$c+(RNA)nS(VqLJqO z?V)$EB35Do;KM#}ZX54F?U8qpVR{gM7*o$`aZXG!bekNJ-S~jQlE(6UDR8teg}XSA z2qN=+4{`Ajd?t{Vn^R;#NERM`iIQ%H_mFPs)v2dDKP50R0vNsS>u@m~b|MPHfZ5cB zLzcotk+0{~5lgk#fvjPT6azVcsO7PWIYbezlVT@4!+PEBVz@7U6D<25lfwoY!Dq*@ z`zJ)z8fM_r-e8NqH*f}PQpO9eygU?|)sjE8Kd0kg^K0vUlzPri>VSSIv z5&8>NMMD|0do1@ZWnb>gKv(CzUOwC<`HKR1NW}Gx2raxc@402s?iT$j*k~`HapKpQW+MlJAI{mN%6BiT0OBXPH!@Qg? z3ykwud1t;IB4;&NWwr7!b|4gdGIDwl03%UlaNHOjh*?^#-5fMQ)Ac5j*RmT*15(KQ zb+`#(be5t(3h=hN;hD|NB`RyN!dEt|%NnKC>_)!B!jrr={w@_Os( zEY4^)rkhJ_!fjdtg-WO&N4`%ptlw@$wJ&^AuQqb-8oQ5;uo|!ASsQgXWWb=C;S|4w?^MR%$2Mc>XY?bcQ5B1xO&K?kdt3pZq0Q&fG)?9*?A*XVgY&m+;=C1Zv2e;)y0XdwM&>5;^5{Q$4mpjU z>Ee0&2#ggeRu9vO>b6+#p;T?aiy1cxJ_~I3I|Jcf`yjy8#V5L&zfaT%BD>B5;%ZcX zpe8hk)gPG((%3%A1U;HL+`$Ws|6!8`I7K1E~iQS`?B2G1S}D||{2o;H4R zO*A3RWV5nCMUbuGWCII2GJe8^i7Q8e+`T7i53+*VP>??=5SiKnGKLp~CExuxjB?v6 zX6KHjLfd=SYp32w)6E;Y98Y`+v>D8C$3fvlN|zF4!OwM!`%I(<^Fl5@H?a)=iUbHd zKy-h@_%9ohSD~=P#+ngxB}>#}cs5#J3c8=ZbCnSdX?0Ze*bwRayBfpM4Zo`&Xw#2X zX;f0SNLeA)lGIK4xoOf-@dZ5H41*)R&CvRpJW+r!zxQ!RI~G!I6Xl4wki;xwN0+s*9@^>)$i zKlr0>?LFeH>Q`}oTW$N5x%XDaoz*SG+cf_g>+A8J5kAaD?cIlv_xH!&MW8+YY>x|j z&%9B0Fq{r~;Bl;unJw&H(`p|kf7;b2zFcfI9!GL-HgwlNQ~@$lELo(29=y_csc zvf=P#eN6Ek22R6j38)q2h>(gmNVQqK23uSddJi9loTcl*Y)w+!4({8$Jyc&fh zFX!kuhvUvn8sC{lMUv3jlaj^_Xe{l9>Cuq~)uR#v_1%UWsF342GX7vE&rx}~Y7xm4$AI4iB4tEfTdyeI~fHov$x=_#<{JI3mm zyv2kp%oAqET#&&ez!0{_Q!(-AXtRf#d77qw(yx++%>GuDE zjqfTW5e~YHz_X!tMi|v5emI3MRBM+RgBK{MHjl#*bB8II;f8i3AA#N{2o|5BhAkVM z@(ABmsP&W6tP?srLLwQbk)$J+8AD)J>Gh!%2U1kIM;YTu?`MrM2pkKh+bH3h$_cKb zFcvcU7;X%2nKn+>+JH5jZz1VQaR{DbbH#D=^DPC91qnNjF|WIoF0#;2uj}J6n7RU3 z^1$||+GW9cBO_(V;^kDQFto?VBa5z6y+;gxRheNU6ac>`t7f5G2mx6WZDJ;qhnWx_ zG*jq=Ut1Q<46ZrIwx%mBKlQ&k_8SovqTX^fXs#b(eb-aK3@K9uulYlXY?}lF<_D85 zgr(8_4a_#6M{su(5GHCoxt0{DQVwZS(l}l|l=nyn#YQfTf%H&f;kcmEE{vF3s$eOh z*AFu|>Su?~;Ya+ldq_H$M=)UC0;g)NkUdd0md*e3TKxVVMvVMR5oXNtr#_SqBos`r zTgon!n)bS^ji?M802}->gq7XD2tXjU!ta?oN z!+U~H4gzRjW66mDiDyB@Ij9BOLgZ??^wa(GT!MczjJel4ZL4izNMJsRvphgXaGE-H z7H6WV1<9;>M*#N-pNJw$n6HjHFs8(r15R~TTU&qmkd%~c&YRW-sa}KpJbg&@G?8IW zn$-qa?%qn`oURC+!doy7?mehWQFxcY9wp69wcV382Q{|@DQnVLD8(|Mj>IS$L7r=* z7c#Uv`p|o$^j0Jag@R!%1jv{wTzOq6imxA!U{n*afJZNJcD6u!0t^aGy(v7JzIPsP z7do`uzAn64tF9*SK=TJ-q2pg0%+z0MFcSj0h=sCn=YI&S%EBhBI1}R_RZxIFInN@Dbz1Cbh)ECVxfWI-# znhiWLAUJILKS1425-|**yQO4U%ue=ns0^FTjpU+Pb@CJE5f}&TyZ!#5mZu_WB&IT? z1buQN8mH^yKHSb$ErJ~YyUH8GtQTS6hJogPoi?yuMCwHouRoh-QSbrPP@^yvxE?EY z^kXuasev<*yED_9T)Bl#fc~S=`Bw-B%>HU90SZtn79e1!ifwBidpG`0cIDsgkslkg*F8^{EJ0RcYSy>`jW<8_JEB z5kwE+P!R4sxJPj?aMoWpYX{Nr>3Ee=?ZbMq2)Fg}FXxKMnzT`-NPwHK&6myej#B_% zBa$%t-wUk>3zK)1Llwi?WrqiH)UTz@rkVZ1&U~ZWO1^e!Qi6l=+0?gq&07x6XAb^fr{b${>jd* z|8jB0o_!Zp3U~4=APaYjD_mYjjh)ge#$)s!{*sqf2$OqTin^Pw9FepPjQ&Hte~}f5 zVGEHjFBS|mE1xRr7gf60l_};-?c7aEq zAxk7`JWd*tlcRuF#!MDNWv9G%6>rZ;#{u;jq{`Jy4a}sXl3X{r zvRcx6mUtU8uV9ChyS5R?3~j2Gv=QRn=*%k1;@y2_31(Py3W&&=; z_r7j%_?$`(;_&(m*0sS9-IgK;2_IsclfGno$-?vb@-j4>0+nO3#rmlPB zr*sFMh#3`DUKcv0@laWwLptNSz~uS4NBM27>S8thdhI2Z=Ek)&P3ss6cCqMtT#Dd! zL!r`ySL{q{v4rj5yM>57j$OR9F*2kLqCj*L{|jnXqN{B7RtM;Xruq=~TqbT|F$WJR z{N>w$1!Z%d*NoYGv_g~&)=8-#o|wsE=W9M2x3AhL+e{@O*RVatt@WQ6h4%0FmLK4W zh2_rwG$#L7Ap~Yt*8gQ5*wW^Vqi#c-{-S;aA3X8_=m!DogyzutFbM^oDmxm)u0sCt zY0waM*Uya8144Y=fUsQ z_%RU&G*9?M+{qCYjMAn~uyOzRMBE6!Z8r21*=r2+^#XU=zD)Wf=l55y8BceAR>qI_ z@GseQPwo1ODkU4-vs*{Rl80a6jvh4(%A{;jZd1gXb7%z|^CCBt{$Q4I|JA_vHK8XJ z8HNMC&>hnq&srDQHAvui`DjdxD0IS&gr|r5l%I?$=5_|(uge@YeV5A-ZFQI&gU)46 zJiAqF{~G`Hn@(}0=Tm*F;5T~^^2>=m>M;q!IkwV1mC&XT>YtlKGryixrjcjm*lrkb|t3c!2 zaAFr(8lT%zTR>ZhSrzYHgDiWjyEG)|KCMrCz3W$!mDU@bDiNBDXst@4toc^ATDGP< zR;3{F5Bshg*;@mU)|fG0j^YDj=ZHrhY-KPx19Kk{omfbaO9A~yJXt4YPGQ{#g=OL| zr1(N7tRx}5*}8ZCDcXSjt3|3uma~E?oNNJ9NaNWU%%*B53M&_uwKtwXw&)^{AEIO$ ztfZCEI7>cpMim#QZ2Xh}*eAG6fxp9DL@+2>3?c(_4>7F*s{`rcw#;jL5sed39P&T9 z=21s9aa|j|;?IQiEa#|sHC4=b0X|5e8xjJ`Ud2vYWQA6ZPuDPSJ*$qwLGu#MHDdPo z=k{QE5}LJr5+Qw^(#Yz4iTq;5o3Z?XdZ9ZMlD^7mcm8<#%uAbRsMO1NZAN-oMvy9w zadi1cIAD#eB)bRyn6`0aOzTe}rt-@YlkkV|zkdyawE{SOV45iu4@PfVYbf~(vL3VL z-z7KTRPUk?i-KaV!};SXD$F}-N1khn6l#}17ARH$Q4mbBABdAi6LVQ3&|!snARz6d4Iz)gCgGLQctx@q~vdP*vysnsx)LGS{k#LVR>c7+kn z7L8)?!4ehtS2`!t=ga29nzstEUDTXs?E~MA=&}wDsDk4RtW0A@ivCl~24QB;Jd{xG?EHa7BRo$j7(Vo?QbC(;LvQx0JtB+lmLOr+&$ zRz6HM`U4dZ5)}SORUxfd{8YX0FI9Q#o~zNfGEu8n*R}9aOT4DI4`qn>Oq<4MS=3BO zb_9l}`wF7T1;gPubz)m|(GA??%mpT>;@@Q8Q8c`;CkcA;%Rn5re4fW;AxhdjI2j99 zGF{dO_>|R{)|lZbH!Nrt81muK{IX?l2PfCRmSO?h57fEkDJaXTEc=rDQDLS41D72= z2poH7qzw-YRN}l0)?o&GWzo{Ot60H0eVdgAcL$)l0~KQ~cBU-6gfk~{i`{?B)x;uV zuz!~0jRM#e?-Yy)`90`jAn2iS_cC^4MGibxt*b>YN8OSB5u3yOyrOK#*Y&N8ehp_d5_zD^fIYh)-A%0mYoSPQuca+R;!E?~O0imdva$`$=F}J=@U;Ftta@`bY-eV|w1G z;G*OUHtCXB{O;5`y{KguC>qd5GVpUoFIjmn-m129KoT>#a20=b*Lw`L^Eq5*S;3NK zRD>&Ge@ydoPpulLm#tiykevy;!gKdy3ZQ-KOkVM1SUUW$Lue8nhZ9kgKKd2h= z$eKsuOto!hvd<==#r=jV21IoaF_8jgF&fDm{_y|$!OP7H^x!g?)CNw&iChy4)Vzk= z%D;}O#&-uAw9V3$kM+r3MVbot2VAlR1TmnhB)Aae;F4e-Ick&JVlFHIk#mf;JNOjs z+y1W4LJSyne#lDxv#KQg7UtIoMQ*#`IS-(UUL8nGl8inLU?jNWHL}bskScSqtk2xb zI?v(e94fe8#H&fTuQ&F=BL-Y#%M7=l-6zi&waTvno$dJ$4z&JL19tq(17q~%FPBFB z{tlRU=DiFeRW4JAIGKysxWat?xWSF9v@PRC?0OQ|9W30g~zk-JZa#y(9q5lRo_CG z)23KTk{9}9bBOgv_Hj>R8xdtHBz`w(rG9KbxwWnp7MUk0do{L~j-j4a+(C3AN|z0{8O`F%kL_UV^{NtkRSRrhUtYX;v0T_Qsa&%*sx zA455f)yP#rr=@I1?6ixOC%8yt**gmrseoucY(c0WAA#U@duX^$|FK$*xs5Sb%PQA) zuc=ShWcfh*=~Btzx=N-q-p7xU0y~WhDEQ$Y)*Q&#H3C_T*AlaRiniJf6~(t^RYQj} zwOH8`aYA>_XEYWMGRu4ECsuUvky%mfp++@5O{R8T5&~CUuOQS}XRJMi^5nAOJDHX} zrfOsD4gSa1YECH6f1n1jECc8s5;AY2DpGyPPDNCS-HG~pVn^7QZ#b}Tj zFiX2oDLO~}uO)HgCYQ63TAoRTla^>{Mifa|CB!sZJ^y+XMHs)*ANGZ#ko#<|Dso-7pNYR>%?3x zbjC|msF4mgbqvvKQJNg=rEtpmB;jj9LYr8I5NVui5`unUfR$w8@)p-9#x2m#<1%9o zID^BZxDyKJy`gL_7e#neFepgH z0SU}| zq&tv$8ld$PI6eO#E;2qMRUDhI7{rd>*TN4#KD`9Ve>f*H|5wFBW+qm)|35+1r8O0M z_$#2fQ96Vs5dvT%NV%_@pOo~%w%Jkj8m(x2sdq|W=>7%(6!8ByQIm_;q_}p(f)ESA z*Zq2T^@6=={0h!qY3usj|F$t=x7W|#f6|k6)8p6i^*G@SOxgKp|IxgC%>YSz1)J=z zvDMx6{Y6H43O>pXIbUp7z6+@I&i(n5Qag5g7f1Q+28)kOf0TE5P}3NRTph>#H|qcu z_q%jJIk!aeU>9<4n$(+bReOeocWU4S;^D*nuIRH0Et^5MkW>bTJZdIBY>(v5w*5XK zIN_WZTDO}v79Tpr^mV4iZ#()K=r3fZNYfZ-sg#g38eFbG>j}7Tj}X@DLyHb{%FT|Q zpcnhrw;Wo%VCe6|XLz6`Exg_QY<;_YJO$)rKgMy)M%%9!{Ls0EclDmp0W0)QbZ2u)lC$N0(@p{AzhXL`@sOy~xh= zOw6quf40b8hI(cfhdkXOo3g)n?7rd1vD54=7D!y?JCW3&>HKSM1KJ6^MToHyUo}i3 zG{3~DaNTEcc!XwFI!hgpdQM1AXi@OSAIzwfI?$5lijO7A>_c7Xnn-~6I=f|`44a{p zEam-Ta|-L5z~DG*IM`^7z~4hP!0)C=eFnfsw&wag-T#$Si!m~E5$|TMf94@3B5+isIT5Y^R^w|Lb z+S}zM@SeagmBBOcq6Jen+MWvSQ$rL+q7l(4R+*hjZqH=O%6_T3akK=_aGl`2t{3op z18_r|?q+H>P!@hFe4YxlUVu5_HDbAod7hwx|j&#A(H)E|dO>dXL3O$76dbn3fkv3-11Bs}PJP}9B z(?Vawr!G9J|AsT6E@A+RWk)NpLBc&jleP0Q&hNvGkC3y`)olo2qXU}is% ztTC7&DRulBS)>c12|-R>FX|%*mSOAadg^^xT5u1#8gDGl+_=_nMpc(_pUR70Hl76@ z-IQ{TNnYw;2Rpfju4`x&8~`{NE?@8jkFEX3(8_Eny!qKSKf1?aDQ?eP%F z98wX9_JT#6vyI^s?z>J9D7Sb7|9(P1tJ$i4OYX6R3_$Y^`n%+}UeeHLQaH<-P{TC^ znh6xYwp z-h~a}QiKBDZqH|iW$?-Do#GYpVk8rRcknEI2w^(0A(Ypc3V6Kivu~Yikm^095s^@x zri(RHE?Ef#C@T!~Mt>4$Kn)B9v!zrHv@==ZTCU5M5l1PRI`7 z;kBTVpZr7!OGU5~PIl}>S8r%5!`C^33X8PKmcKEfi@8t`*QH1>dAGrB*NAl|#YOBQ zpF=wO?a77jmbMq*(#;_;d>Y{Q8NtPbrum=vtEK)ap1~b*E}?v@P*a4rbjfNPB~r2E z6>bjcmnNDYG1v%=CWd^-20nzr>|Eak0T-MAbX0W6dIqKq$r-3om=Bi#GzqU4w$f#| zJpc_fRDRbVTplj&YnWh@S=sktEXC}8NmCn#OrJ7+Yp)#{Xhf$YrKXpfYM?yI#ub;P zs3p{E*?LvW#6QtFcTpdI^0|ZM*aK>_8ydNUpD!RK@AKi^sgwaGBQ#hFaI^CHqi!I} znQTrP{fg`)fey}@<^3YTG*8D!MA9%btN7^!P41i=G+_e34*-&Wl`sgUIpzt2b+gH{ ztN<{Y8YM`Rif3@1K%tmxOn0O$imGB)N+Q|TPf0ZkWT7$sOT5=hLVnFBd4SM5RR`iq zo!2{dlCFdVo%Qhrz$$qt`~sS{<%Fy2m&ssh2mmY#z$2wRfR{N3EXEDVG9ZVrDd{0# zBU`c`4-3rso1V`;1CkRXi~qzbLgP{ZV_kF}s0i9tA|1`5>g<`GFU@qqU!OZ~lOkiZ zHglu)^$cv#lqT1Qf1hh+>`0C%!Z66}mL7peT3|X|?Z{=f->ipiY$Ifm;~O6XGrNLz z^khsZqq*vwo5s*@Q=drFLqYi?d(Y5lQ1CKu|EEDKIK>Wp3Ghg$%HUUa&I4c~w(Mke z7!x%n*Z)9sm1H4{cMP*f;i19g%V|;Ny^7lnkMHUj!ilo>M+k01y->q-v^6H>QMVrY zFWS1FSoQ82&lSctP7c;*?;2XBC1id0r{P?C>1ui&N4F~GTTW-A@+>Z8q;bIatur-Hvt5RcjFW>H?9=hOn?C(KSoQ2Fb{M0*r$kiY9zdefCsWSxnUZ@ehEZvJ9Q{ z>hDR(6QRykrQ_E3b(R#R0_*^_WO-AqxJ!wN(>1s?VMCKPOGd4iAcUr2l^0YECpa`k zBT_Lj858t%%S4aDXR)b=16+)6VLq7WGiAnrLJgYap17bGH2hPb@+Rb@cWE-Uen!G_<8Uk2)?-;31^2_6uY7wHh>0)=ya=_x@2DRTzb}OBTvnCeD)<{ zMRMp+=eD)^-K0LWapfW|?19E+V6d7scc%-;_ z;hr%Mfbz3XX{8rDPxVVJ>}7Se^^;|bieVHGN6#W+IV+#cIrRMQCI$}|;bmERMe|lS z)!w;u2>f;4i_x|w`JizK`bqPi2ujwxhs@qajq+GOd~|jHxNlZ|wbaErdX3OaVti@j z84}zvsMkyRpMn5$!&*l-b0gD-SOK?&6Bl-<*;w41Lg)RF2pY=hMf%` z2Q4eEkX$>^Ae#g^dKt7S`K;97yI!#g=3afyVPh7^Tc{M`7k9ig16&ThcMg>ev(VlD^!fRjcG>eA-r_%f7tPD(@d`Ki;!@mAaz4`+-XJ>YYAxtwKO~ z#pEyAw?5hl#$4cB-ETN@-7HphWs_SRGUfX zVtE^h+Q^a~RwSXhp8U0QG~QX#tG+`CJ+Vrg5j-p$=Gf`%<*Y=AXrD(0Rh9LG%af3O z@cQJp2?G#UjdLW93!mF-aWwOund#o!QiwSF7`m_-8gmS5nu&R_acVNd<+JMQh@VsD zc}@0N8OiQ9dN1**9|{7o(Dhwj>*cEJSTTE7+I~?jalKPYCO%Pwg;)RRb+!SemFKb* zefHX#_~=SstzE3!t|~y}qNXNk?WtK>O`(ZO^I2e=u%!QJ=4d&%-E#4iP#92f9z#HjY*SX05^E`9F-EV|%6T+GS(gwry8zyJFjR1r@tu+o;%1R&3k0 z&Cavm?xTD6u|MoTvDUcfIj=bgV|Z}ph5j@J2TX09am=9+FoLzIhd%cw>H*x*`7 zewDr3CBez}Y|)m;?EM^jyVC!9gp`_unfp(lKkWaN7KWSc-#&l-*}1t(AA!^cTcpWcw|+^)}^FZfkqvzMnuh$*(|9P#uxpV>&?@&%@0EU*adF0oj1oIAa9}U93lf}~V z8!l&K%ehT_V@$8;%h{E2hq0*o{-KZSE@<%#yl>(Y#@)|RViZGphr1=9-Py4kQS=OB z7?US8q`>}TAoiVIn?y(<=vxzndS@;fD@O8p>2yG96H@2B>fyWeZRaiq3HIyyaz$B3 z$?bFGsEcNZ)A0~3oamjfy?jL8xuM*5@5C2SHNQ)6duw4jeuFZRZBj23PL4c;Yh`l|jYs#eyAjIltLL ze;gkF8eX9)in;sy42n()trj+B?ISB{Yovs|x0ijFi9sN+4dTdWkxJwbMa+acn-nwF zPh;_kIR6%D7!3>BmzjyjyFnNu645%>V}b@eQ6i9Rd9eaJja9mq;ldjilLkS8xXmGv zmA>@s?o)ll-z^{%zF2M-i;LXytEOB0U6{Ky(#;#~UJcMQ+Jcs0=}dvqOP{2DgpsOKZS z`6rxa^zy{{n*7FbpCe^7`j`g5Aj(ZJVaMcSg>YIVm$jdWnmLi_{uaPpU(~YaaS8|= zU*H0;kT3x(ziUvv_HaaaM0EVd4DIzIrmA6Re<_RN)?{e+wR2Gkblg5V1ojXG&PI5& zO&4kL3NkGQ>v;|8r8(KHM#AC`vcHGyHRJ8g+kq(uBYJ0Nx#nu7s&x*`cX_t=l;MoR zg|erEsgLIVo`~^K*0vp^7?q9kGk%}mo60E^%@3WX9$)ccHk;L9VarJJavKdpnR74K zjwpXy;Vz zNtF%A>!Jj3WBBnpIK0d2X@7E|FKb;r$VTRPE34TeZ1--cJXsV}Rkj&&NoR-`Z85Jp zUp1qc14Y2vsjv76-PfNd_QmVV$C538--tt5|Zhg|^PS^-l zgV;ZA@v`-_N$yEQy>~`8%)G(Nb7}X#f3Z`;X5BH-$CZ+|G*q6oftOmvk-=2Y&S4rzJs^(QB{C0$sSlXU2aph~8 zLC};ni4JsKAK>(mNaR{${QO}G_k+d7n2J^#c3d-hGRGZI^TM31XIH-c#_376(vG?~ z?FIZLfu^A5ON+}X%qE+T%UOf@Y6(q<%3a<75P2E#9-h-T=+Wu4({0M^=_|6`MCTjz zaIAQ0xU)=Kf8klT+L@!-0H6;jYAr?1@;|5{YUfD5UAwGSNe>XX(d~L@s{8uk$our< zp~EJB&sq&kRWA#UHJSbu#v9_+M$HO}y;aI&`{3<-G1`7G+M7w}x{-6*CQ^&57Ib^m zu~SrQDRgdHmeo(~SwQ3|ry)0RmS7-a?V`m-57fC|&axe+@}%QBt4&v4YAXx7$QC*Z zn={LYKa+DM;n=8hy!kRb=``7Gl>g&;$fswIz_Du_8krO8+n?_#sd?kDM314i!CSSM?Du!3gnTT*p8(2JLLb-$7q=v{>) z#2Ju(6|{5-9Ng;vV|Crd*sxXB?r^T4fhDlBF>o{Y{-RBJf}eX}x}?*ZpB?L;>k40%#Z3u@EMCj@Z7%u2ZE zr{{Mt&i7BZ*?&1DGFmVon}-;NClw#Jq(Sgd`~^v?=mjR8Nl)VsT?CulE!AZ>DN69O z83kS+JB&>+&?xd2hoX33NRQ0}i>dCUV_s)F?IN7HGHR^kwDku~wmAi46aaNm>Lf5S zn_x4XB*Kd-qnYOW)oYnI8}i~dh@{wuE>yqqhI8pMmpnXRsu=k_|Z6S*r#cS>GqI)!nxVKnuzZ@YveQVM{VaiJHcHGzddDCF-= zND!YP=*l)dw!3Vshr3fZcm91)K*?H6Te_QSkO<|}8Z2TL{?RIJMBDcThicVUl+R$#q%es#A2UK^JkpQ#r_)gVPY=cIn#@JxIYVGK zra$P|$-LL4C@u8z?tNg1TXg2d^^irzXh`Ll)sF4DU4^uH8s1hOu+ihcF0R#apQ;eGNx=biI2X@VxqKDyyf_FDC^fNXhvAJFgR)m`z|Q}RfD54hILIV zZf0N{(p~BX{y6A0{EF8%YRtzWKy;h$fg zo$87iHAXcDt1)FXzp7v2@oClOdL&4&%*u4KMd}rV#d)$+vuNw17nVHXk-Q zY)pSrrq{oN)Kh`|)xs7TzED<3cEV_Ewu>%n>!Er&EI@29b5Yk05&0XJ%Li#8l3x|U z$f+(bIJ`4I<(qB&25+L8NN>X5-*|l?V6PCj1J;(t6g`j(KT8y^9K_41F@)gV$ENFb z-u;Wwe<=d>9JEY*NEag?#LS$#cpp)Umk98xkC(c7UH=%QK;CU+E?-Jjr?L0GIW@TU zVs*eTfhSfsZ!W_tZ|*{A9;2I+@6dBU(%~>i3iS8p4@%)5Y_b2Miei;747ehGHm>4x zjuP(~hfcO1oNA^P7Rbye%WDM$o2$rwovspt=D%;Z|ML*s@oREj=5fDC0KCgW92)%H zdfUnJ2(owMt=jK}(Ow~J@IQe(*M9}_TrB_AcU$;>pM}(Op|%_c1Fs3X$zL)I=R;Cw zco^E>zU_>Yh?N!b5-}6JKG-%&qFeL14rlx38023P%BIU{X&Rm1{~wO``ZtbG`F}V* z=gXr2?HT3k*VF+Vo4>s~=LE-<(L3pLYM?WyJF#na33hK>p+Scc$?oxI%Ufi7 znN1o^R3L5(ulbW#ZmXT)D+^*aVB#C(B|g(99EAm-OH7Rf()2}eFeq=_Q)pv};7p&$ zzCqscU89r+Ir@M>)1E@s)@TF*XQh zBH)li5eY+82Duc?vDCt(e*w-v2Ck$20r@P3MI?HPfpsl|_)My&V}V1c7Byr@H1rPidrWH?}>xST}dvb>QR|H&%j6s>9fOutZQeF zq14VOHtjJStV%}Udr@9W_>)S3gDg6q~Be5_hqHD%~VqA8J$vH&amN!5C3&a`C z7Bd2A<=ATQsLsn~`w-lGK`yV(#-O;ELKIe^^$Gxk#M4Bv#1KT{KZ4VU&uWQV!hd zhmZp?ZPrcHZa1SX>4P170oCAxM)NMfKZz=xcQfBgUA&TYl*=wJH=ae2eB@P0&n%2L z(zrIlkWq{5NmF1JB>_e&&f$HzxiTsPWQW!H4a+;RwxS-u7mI_~<(sv{Guz8sW!zfL$ zV{;7PBlQ(JD%oN!T``wk0%O9e%Sd9Hj9e zy{-#aOF~0FxA!dL1q$o+ViiXJrARtrw+ic+-LNK({YtM$JLNhCIiBTQ&{s_fjA-2; zYb04KB#k*DHiJXc9xu4Q0SOR{*!v_)e4|-IBu|>Y-_m?zbu>WZvvPNhA%}_hxq?Xd ze>KVZ(Mb<=rW`ax(_R%NgFSK~9Lfgg#lLuQKq{Fsf-PCXHm-S%y&$M#&@-fLcyS9` z%MmjsDjVRFQs)`KJA^-kSxA!baz7b_^s!X9fLS)GIeq-<^d(7M-^SO;jB})7p*K(B z!bNg{)3&owM?7c>f{#*2u#UKbuy^BA%(fw!M6w`^A&T9Pr%|kA5tierq;&o?^ITl; z4t@H>@&u5l(#el1_Dn(@J=w^twX8Of^w+p~V#lWur4>Bx%1ug}oEKXYqqr|VfA01d z1Ac6DS`R)KVcX6c0~8l7ZA7WaB^c!KXxQh1UJjF_cF&XH!2+c>{PSh;TufAn*H!+8 zpt~wr`zjNP6nHbiilHZ+br%dX+0%N%Jx9qVNldmo;IzQfA+A9vR!FOmWj-*sA$s)y zk34wTcp2rnu= zoA>_N9h0@Cxo+ldf^&qwK(ay?m^=pLOUn*6g6*|h+^225d`>r3C>V3!kh3Y@oq8fCs#7yAG-)b1GGAFLB75= z85I6x(PA^7QSG(dOJ8lc0Lfd$R_I@IQa$AuhwoZ-h6*yV*a)P3$yIF14^=TOkVTLsIK!*ALMm{!!#qRcV%C$mN1b z17ur5mx&Ca6YG@+jlYwD?7(2iP0eNp`{|DrM+Y1@GZ9*=lK23cvGp8>)p}&!#sx_X zbA2STE_9w+Yn9OUi7EqF$81v(iA?@sH4e=q@Wa=hY%7Kq%byPpofGZl_(Z7*dOY_; zI_29{ew~Fc?%M#q*-F&eU{m(DoYtxwL)qpj%*vJ7e)=!~c&6qNC`?y#T=;4}xKula z2r6_1e#gA$WnJk-cxC{NyxG)c)X0upfZ>Fr9Lmvdy+x^}vcdPa$(k|T8q;4Kk#(c4 zxzU-bDs3g}Di5LcKk~?9)1IlxchbX@neIrul#JbdyU^k(6JhL#9K(dAvxfwD+29u= z6-*wamF>K?V@WWgOAp-0WS~uy69Zm%*NdV$F|nI;Qx!EDX)=GaWeZG=4aNEJteXf> zgY*cG#e(=&J-1Yz3}2%zgg&UWQc%|tG~pX6spxCTY!lcEHpCY^CM zR}Hzls!9pBT8*8Itm>uzA}0}4nBZ3w2QxRHjFy&%Q}aG}Re_YK_itU>N^tOTLxX+B z!4UO3Z5FX`bBz<&L1l{Sm7&dVpUx}*$d+j%T^#xlFwxOf>EVzH=xglq&}%_LFoN8` z*d)BnCqs=W0Jh^@{!r*;t%pu@%KWsPXcZnq{@k8L*=~zGfe*=zXzB~h=orggvz+Y8 z|Aidzlrgw?)F)-lU$+{&gJpv0g_zY zW`L8^vW0UflXxP{8-lJ-&`4%-p4FLK=NoTUv zmVh0%s#@x3kY1Yff+Yg~`>y~&VB3#y5b*l_1?A^y4a6(GhBW{mAlCM+b}yR_;lSjC zhwIm8Z_~#QSyR%TaEnz)5VkBTeSD-Ae3}h9t85a)vc?JzT3>&TPz3}w!<_vA7B;z# zWk(Y&U%P3eqn8DRCkPcOsYJK*>Givnml9a_OG6KVjaN)R%n2$-Q_L%}LmAxex3f*Z zk1;=B{F2)6|3K4htp6QNbN>5;<@c`ASqt*_uF^fInTAgo+4MDuAj|&@D+RAN)s4`Z zalCw><%UUMR>hqyCr!}0hGc2}R^45jc|e;q|I z9()Jm<1b`|*FlSS(BHv$M1MC~yi>5M1|;lu7N<`qs+J6q{;?vCnlRPoJ1G67U2=`+8b>$%;eI3Ji6ia zTY@b{B#h68p{kJEw`$ac$ z)WrxCfdCT>IO3e@dBkIQ3$w*-FY4484j5r5erL;)=w(%7dy#hNY zJaMT-R?He@25ZlW(Q_m+O5hKO2)3%QVo##7D%8oSAQVs%E-`rYll6LC@Gv#qQt1nA z`cB>8lgxe#$Wi%U1isDXNYWSiEq9bV@cYTuSNs80(2gmZbhPOUwPXB#Vj59vdPf zz~W3yBN{-Fh>zOn3bSt%F$I-xK7A?(Lo-sHq>On^t>nhf2i9NX3xRm->)YWe7~@qlASgDgO3j?0JRm5v)*4sR zv86WT0Uy@wm|2q13}>6Q*ONo1em)w3P^$6)nP#sWafGSQtXM{&7L1cksi6k03?Arl zfTys?)R9C_E0;lmGSsDQcVmN)Nm~q;9_0?$ufa-!!>PzX&`>8*UQcRP^uArxAnrm4 zyuE{$!YFDe=3~pB8iR;h!QLzM2Jae#>%>sESa$j|XKq5fN10S-+%ifkPV@SBMNF4E z&Yj!C%@Y9sklLMoQSpqqL1pHHUDv?{n_DYU%q#psxH9`gdj_Vx}s{z1tT(4nbh@n()9!qVCZ@ZF5 zt~r>+u!DgEU&Z}M1)uRamiObD9vbO!J*<03l!gMn5l+g~^t&H81k;^?gjP~wCE8ewE zqSx3TBa#%;;I=%nb$mRzch>$5>p)e>Ao`AmLd2eyXF*|;peiOZ+8+X2)+cD|w46VD zIpqhBsl;j&liW2%x8Ql=DL0V4EP2$nRYP)FN+K(~ub;omNU{pf2471Z-=s{dokqA|{4RS+L9S?l1 z>1^51N-f7~v5#*9iRMd{#JQcr)>$GMPOLSCwV9C%4%*x*)Qgf;$d3N(ZKVeGjDx5!B>XI))H_+|)jYu`bEZ@z*?XD@c( zJ$^El9^iQ-6Jl!Tp7?7E*RZk)$Wc_^db9-16``3!+2Z|JDJejMk#=|KAXDZIO}R^h z_39HFZ1bylfD~ocf|_CZNt__j>o3|Z&LvzU*yeOU4SoY>@f?`bCV8>8vaq7kH7}TN zjw1>~21@N5C@B*a{~7=h#})z2YK8RTMX7QBkOZN0$jBLX$;4%Yr1t(H51+q-4X&PZ zXpKDJHlFLOn}BGy(NH35zd;ZVR*gt>YP_%!Evk&-?npEb9jf>6$3%yYF*P}PKKfCOs9~IDV)Ji`u>Wn zU@h+DH)WluJ3^`i+WyfILacM+N65NRTpjEH@kw<`Ua{ft@erRLd%?WLsOQ}eRcElW z1z7~%Xyf|KH>7y)xg^o1k?LZl8C;O*-DtE1nnd~%Wk5yw&18kKp5Ch1$@MHDLQ#!I zU}6?2KFa|)2h*xWFZUsn8>`8&KZ*R>uYxp;RV=3VIR?3fg{K(zBcUdKJBC@E+Qw4F z7$2uBG^=)HsVGGFSydoa{Ixd3T4xKe!inrv^P8w1f}?jPlQr7hvYzZ~(EuXc!dDCh z*&Ve6Hap~cZPxNFce&T>oqovWi~X(64QJe^eLi^g{V@LRg}_24SeLhaCs1qW^}(m( zMt=EI`GGQr7hmTCvP39jX1~by)PmSjX~*E3!c3*MpFNkJ0jaAn^t+%M#7d-V&J3AH1Xa z$VII$C*r{nQMP!OhJc48aWSK-6@IaS&7%iuf&fFjNK)%AP<6LC8{30f@cRqCN_-e{ zbHvuM^{A&C>&dyN6!;1%Xz-)K81SJ{(TBh)B{ZiD5UP=OoUY><9TZe4`BwZafL20f z{7Le()!3hc{FQjZ-|DVsM+0eJq6zvUPwVY(7PpfXfp{ZJDxTD$*8x5wWJgUSTb6;I zuNOtLT;NgWw0j)com$w08696iqtE=~S8bTy(KJFcA(5>^N0-$>O1_7ilb5){`<-e< z{c)L=#Nr;@IWtWy1D8-v%d~*~4~_P#+JL^!ExaFKoTuT9f61jOtfjjv(^(~PyVGb+ zu0;-0;$?vRedJ2YV7Y1A_TYt_>rHhct5&92o*L+eU08ujjVM%xt8gtIK_zO2chi)U z@u^n-oC6LxOgS97bw(;#4}UpfMA#Es=_`ETKiUk?KWOEZ2|`X~fd ziM+E}&Lw4)DT9Z+44C-G$#nQjcbujZGM47}p@%1{Oh7lYnpXV^Q861zsv37usK`@{ z&KF=P0Xfq#xBC}eikt7}a>v(u$rmW@=EZ-if%KwIMvH{3{ z;2XujE$w832-a15ltPm%Vz`mlC|` zDk~5^T(O`1ESvRdeV328gicCJru56WUhMB+eqH-}$SudSIRheuk0y;I7=+Y{(w8PZ z)-Or*={|dwaEXlx5wydj+auW*bxa0W5rq7aT~hpJeO|294HO)@yX}Q19lJWeodg7! zz+Hf+e-8}Vv(cf1prTTep4{8h;&QczuVDfrc03T{=7%{g&)qq6`|!+pUt~;?g6hq` zo9N<)C}<^)pT-vKD7+Q}!R7tB@>9<0EixU9K>+#yJHo6C-7sk>O$8-IQNyDj*H&U0 zBo0iljdI%3VLYS})Jdx2XDZgT<+y z^{inio^NnkxOE!D_sGI-y+b5G_5UL%Ye~o5gGE)D`=d%Hvr~>&hRPYn%j=`BxuKgS zMXTSR^O;o8L5m^G$&fr13`h7(ejB(RL!ljE_R#&?)rD_ly>3F;%%uV}Z zF)-l-^~optu^A`T&|ALiVD>6zrhgEfF}JU#)(Qkx-cOR*#0oIx+>KqH>$Ynm#VXX& zvy9bm^{DT1b#dkPksFMsU^E3ukQ`2r_4}L*mmRG(~()O~^XJTYe3ATGDujVlB-c#Y?+wk0X@E=8~S{Tho*6D|>*mVyRrF+aHs6lpc zt!o<^brAB!Dno1%iX&=L?5rBb zKNpU<=ZjDUBjm+VTm42YJV86k(I1k;e#E`oq1?;u6?h=KOHqvN|>N=QlZ>2Je zpC_GV?QQ16w>`4@2L9M?$l6eq1=@3@;9CjxFSSf!?*94A1 zxIBHM4UuxS%xTQ{c8BpJ&>P1gX5b;w5XH8j4{$*js6 zuuyScahr_JF{}=k?CTL;Xc!+t_ZBKf)=Cqx*;vzVC_1(V#B`75tJIm|svP%@9z&f4 zV;zmi49m(`l&K!y)-qdAz)8aa+H0zP%+vm8nLyaofI*S6-yaqdF5Vf!{T`_)4&0#k zI0!>LgYV08RLu$z9mKO@Xw7I<4z4R&Tw=F>%E-yeGI9FqMqZ+w>4|iMYm*IqQ*m%4 z(ZdVG_er25cHpoqi6Lc2f0Ph($Z2Fs$6o>c1!+q z-RBH5h>l!zYwfY>1rAxbQ3F)A%QE86GtFtY$qS>1>@%KWXin6X9ab~R437PRdd~{w z$eW(Wum?8TkilH`p1hz06#Lce4znvdJ6q{v(2E6>vrNaR-ZF5h6!dElkwrKE#z_3U zDWNBZBW=-W@!fTtu>J_qoA%5GSqY|~lVH6&h~@E@M%t&`#_b^s$~p>JOj`p-I^C^G znPyVDg&^2FlvPSgYHIYsXzq;#by2c*xISkDTkSN zT-%S#bFtGVX^Ej9mmGWsq~7TI{Tuv^J0QQI9?SVLR|86xNy4hu+#1)&cSoGwhJJGe zYYU#`QMJ{dS4N=wC~2;BGLft}WNJ3}whL8nX0eq#pHb5fwTW)kAB4_0OKYeWPAS0}U0wp;_qlt~V_f}$v1&_s%1pZNwu+61Pnp1NZ$yh%%=gkiwU}VEo zXI;2^Oc#gH@H~61$}sjutjn^lu%-5O&_C7k?T9NkwLNb=*pNR^Qqwrg*6WNv;@9BJ z#gy@#R0dhonRj=~{^Kc}?Z()ok~3$`3-hCcH5=97RIHQu8IGt4pB5hAa?SVFw6?yn zJlvqrU+KdC6N<9?luKt}Y<0<;0PNV4#AJPi&Kr)wbHVNU$NFz$&q9Z=S|&7vP!YpQ z+;WXhEzY2iI-yT5lc%HfqQDPbWIw$Vhhfn}E5}EaW?~O3=0DLn^NlD?fue^2W^bey zN6#|d6!flWS#@FTmN zB5yh9TNW7BH^ir{^P_!%ja9S{HEf3DyvKE~RJF*br$2jK7{8c-Hzp~sYEM7pvO|6Q zPV)mBy1Of}AJn~@PB~$sA40t3<;ayZ9=-eb*pnzSwK6$V`3-LB13Q`}PRqFlz0b;x zqPBoO?S5_-efWYtF#2%bB@IHc-Y7520XPq{e;HJXYx*l zVODn}(h|-73T*DD|4Qu@W0t1c_nRWh(t1gNShz{K`b6vs$w>K6A@P4FYG-Hux5~xD zKjZsN{}U3+)juOi8B9k4H346pkAHVA2>;I#r^yX{c{{uN;b6;g#rK(O*ejdIM8Qv% z$?+XB0XZQJzuvCxBL-ez?`SLIY-_88(03Nq;jks}Jb}x~j~rUxMEi*5e?`Qg-`dKc&|i_?5i!EStzsUb4p5HH zwR6Q_ThPuO*8>(;*Ijh8i#8owE}`fxUk%}SHL+WP(ED8L0R{zNfL)$X7yf}zfhOv@ z`bnRH93Qkwv5t(RYuX_%G9n=mR{qkd;0#@Oh;YlDJ+aD9R+gut zIRFU=hqI3BcZNJpicNqSObV~%XN;N0feXB?34az*qki%D7??8$lLH!~P+9%K+;9Am zo-q*e412v!B7od&gp0`SzD_S}^5QA(lpP;aT6e+p_G)w5phOB6QWskk0e;Tm);L5U zSU5lyL5(CcB?KvCWrf@^?2Ruz&7i(Y)Gbn^q_vponyZQLn0z?-T57TZ$%2{{b#>q= z4r_0&FboCfB8G^wS4P>P2s=H%-#|^X{K+{!Pg1LW@mmKR_&`AEP$puICCxeW2P{uZ zj(5ouvZ#9*Xb5j>i!&RB2rp5zKRbPc}&JC-?#hs=&TkP*QR0Lu2 z_m}E-wUu5u2!)|kxhQ(%Sc_%2OJv)VGq23P`|fGo_HZv>Wd6|oic|==aAp{(zYXId zYB7z1OttjKUUSU`Yrhg2zVf7KCZp2E@QT!c5q_ka6u4xj&y;8Eg-#D}O%*swqIVXV zMAx2qId*Ti<{SJFio2`vROd!b=0_f-Kt6P7T(qXK!`)3opzqmw{Cy>_Q#lr^VS_e~ zQ)f-Oprb`(7C$~h;JA-6sE*uRZR1uD)TBYM`sIFHS^Prfv&io^Zwe+ZauP8`1&H!r z(iOKnj9Pzojkm-EOH{X5DlO;w+@o?h&awt|I;JT`}|-M}!c zuq~UNe<4xJwpIZMz^MPmJ)FOJ1ubm>w~JtusU#>2A~-CjGPJJCciSCMjT&-`uvkFp z&%+kCz?X_m?OA&NRJy1Yb!T`My~RqDx%p9Si88KB!z=5D`2m@kfY;S`=L%lig&`^+ zaR;FUv~0iNvxw(uKTo#;I#{APDT38RE!nZx))(bsqPa(DtWg#6fG`?tjB>XCSxV=O zn=K!hWRe;I=`7^LRB-Gs1Q4hZKPmGz07rew6rUdRI6lqA+a^awR9$8E+ z7H)yS6Lg6;;M8o2G=tXyO$0|T){$;J*s#f5i^{&gks@3L{Rqtg(d4|1MF)p!ru`e| zRCJ?Cy+S!xPoOa4Rn0$C+lOW@Wya+Z>QS zI7q-OzG=4d=vG&=x6n^nyjG=ZWlI#f|M%0k^F%Lyyg2+U^KA~|8 zpGy-#W#_bG{CJG6T5xtNz{Z|z;5&t*k6ssnF)TkNqM~EAAt_!@D4fL>r*nyZ5s>`e zELRdHp{9si6WMjA!gGjt(VZZj^(-%&_rXT7hgUjTUw1qa{sp7OiW{t~}%au4(P zGRQpPtfdK8_s-fEOr<*LARiEyA|QOeO`MTj7jG{|THd~&W_pFbu|2}rACA)FCV7a* z2F=Piam#5>Qle?0q?$#2a;k=k^hobvK9nYR$)UwOMVXacX6G@t8&i;C%Wd6YOIgX| zxVLD0Y*XwwjDmcU=bEsL#-FPEv#5*@tr-dqdF8&lru*(|&+l{fe15QE2(skh7)~vt zqx&@+=1)rNUgp<+)W99ej5gcM8me7V8#YNxqAd`sU`QTP$-2Z3t2sFh+Gm``M!U%Y zg0$&`cyp@P59%>QcZ{j7HghLaVgNNqAt1>?g`!FlgLGxREG>GckQnA}<}cDNNN>{s zZ?oQ$`RiwlYPmVkLhiJ@1eB{GD`%-&qM}(4?+{!4FYIx9xiZO;s>4S?5(sW9iRw6# zm#^VtIFSXsB!_5VW=rBr^*2b;7y@Xu_`S?rZUpR%!4mm!udJS&w1z5vT_0usHS45W z+$E>M*h8Y++nhv>kQX5DABLWZbSwvSLVZvhUUAXIK$Pg zGbCa=bGxe~oPx1p)a7~+W@NN?cx9q5cY<0Ws6^L`+oaMKI*lb1@g(B1VwLzQpF2UX zk1j0@+)dTMy_2%(2z#O=3UJY_TV?-r;{M`N$m4S)BgV^Z81_p{TSO95cSW2Qwy$vC zq?68#;2iqAi`&pCTkQJ$5RpYZICiJooKA&YH0Isp;5fGqAB4uqL*_gR-#-q8L!9C0 zbg`d{zbwv5YKektI|CJ6XbrLQmOE6o?9Qx@!QXiNDfer&ZlAen#f2tJJfxp^!vCP2awTI3N)F;P z9goTsi|K~!x^Z#8Qm@te(BlMq%1WE(0%jj<>f?bRMzvThtL@lQ` zoWO6Yt{{)7JSqdsUcUi>4*4-*F=Jh%x&nsmJ$5nQ-_4!h&(5yrruKj`xi1YobVG2X zWSv<34RQyrc|Oj9o&UIRGvc+tOE7FB7(d7ODV*R9#kR+OPJs)I=12>qy~#=LKx$ob zLSeqKqI|`3CDMunziq=`k75fDnp8G3`Cx~}1nlwp-I9LM9di9chAjUg!wn3`o1ZDH zgoZ3S9VOvM1>sLml<4BmPiI?@|AU4~Ha;{rbXY7t{3-$l z)`IDpflo5M;}!)(K}d#aR0Lnz$Wy5Ygygu5^O9ZaepmxBQPv~}B}pc7PB3y06E^drflKOqx3R^;)DV8ZXuu<*tHcU3q)Hb6G5we<;sp!h1jutbM;8++SlH;f* zI~Ak#=W78#2HiqKV$;sQ(dXGeR|XIvjV77JlQI;B+34v+i{kU^ zR!S|*dY_ET+qj1kZRU^7^|TcaRxeN@_~@a%=YI`UfpFLJQ|c%h$kt1V)K&h}RoRzl z;z=Vaw(7K&9#gNdw^a>{m&G}{vHCpB6IU8t5A;N<;3)rN1JVY`TB*1ww> zot81&@&!#DB|`H=y{7Q{Ha=-g&dy@apt(Dp52;AhMqU^oPqTqjrU=zleNZ0iQSF4Nd6Y&f`fb9PMG6Q~ z9(QPk7b@%T1nqxNTQQ6%aW7w}26Bd~6h62WE&fS4gBM`1tG5i&jDj>xW^MR%UXwr> ziT8re?e<6Tw-*yKSguXbAE6{54Rrgu@L|L1LCef^Ip&HY4hm%iAotdN3tK;FVOlZf zj%euX+aRrE4*W{9cHAwY@+tE=m|`VH{v(|jbq?YRiNus1Yw$0&J=$v1eXZvw#ol_@e&8k{-BG7Gv404hD)@ z;Rwl?Qeb0U5;1>Ru)bXoS`r|Yat?_RN6!$95!CU9;TgF04oUXjEBU_uBk9WSEomH* zAS)U6FxzQ85u=8!B<~6pS;i|TXKaYE@@HR+Y%7CLY5}Csp>^9DpXtAVwam&(&(n%+ zr+wBT7a>2T_>sseM(!di$sIO)5XvC3QCtAyW4nYLMtsg;epx3ZJuESow8hm`xqj0+RIhSF~0s zPBU{}7`z_}-N-ctFA5Z0$5PmdKI*c^648lEUPWn+tvO1J6M+TtEZs@}?)mgE^mde@ zuZ=OvS)!?AaY_6kNPfBNIxrc1i+cF(Fx0jQ!jWjzU}QJ2ME58tMdMcLK^@EPQNsD^ zbf`v|LS~bo?B!NziLK|`ROTN+Yh0EQnm{Yrsgzwrr0On7@{FTzK#q)W;lQo_O?+}g z1&ef)&Gu4BPdnw70KT?Fp%xhvCCQRVP7|}Lxgy1(7BC>B>An-dk8LnKRFi4X_Lx=6 z2WV0heRR=BcTjg7P9>p|JaMg#D;kM}LWC{*@98*}HwIj(u7mx#NM2Yl8(PU)5oT@g zpb>j_W#HpmA-lM2vwaiGUj6wdj8Uqk|B_}`y^=DUShM1Np=Gv2kq-uT!o>XR^{{N? zFC?-3Nc&n=62Ucd3A{NuZl*DaH4ybO)T8w)3eVB!-8pA=4uKHTBpo%UDgXp5Wl9c)ZKH zB=ATo;x;38uFG1##Uy}~C&zFq+w27Jq?ZNAuarVMX_CnG7>WDPVv;y*sQTS;%DYO{ zindIg8YP00`I0Ozv=I|arg=(dY)UF4ZGket3yTJck0z_eQN?GYcY>$L#U^B#Du(;L z!wz<|Q=_LRY=XQj&48`BvT&{8F`MsUHYi~ccQ=*aR|kE}N~$6N2a*>h5cYL^_%bPc zoxwUzLN4KE+sU(Vj>3q4`d^om%#KfpXRJ0HB;seB9cs;+j{;>Nk0&43QLmeqL}=e0AW{87zgu2ml;*1-~*KfL`B1Sh4oVEXN4k-WeN`%aUR;LDk^^{ zn_)!4Ug|FTEL_pw+JVQ7*U~#m21gB?W#TuWvy&UDWizCE)AgQa5N?2-$?Lr$ofKkm zQk_l{yb?3uXJxcD6q&u{-#dQC@&JC13?Ut(01=JxLO*)<5|t{_LX6_Exnabu=wZ&0 z@^3zGW>=qNAfdynu5x+EB(~}(m7+>Zj#XG8F55UK>F!lqB0d~IxiX14poDMM>hD$X z#5#rlkt&!&7p90#$1&qyqwW4>EQmc8Rj=0U!?WN=O{}iYWnP@i?ANnE^yNlWs#@Re)7dP)ZmU{@Uxw{S!w59HG9)S+TBw`NRnLNtE2u) z%(hpeBh%>E<&r_0z<`gTKFPa34_Pp)#<7z%Ob^d(828C zS)_TnF7xpXyt6m+c&IQ%LUJM20P4ORVU6!c_ zTQj9?jJF6yZ0?@m{j|b5nWs0AdLzt+n5kKlL*#v1*OVMavH+M6=(4dj8F!@q=CQ{x zeHU3CxnPipOXT1DUg*H{f%CY81=K-s_K%H?dX>-^PEy@;Ae~!x0b>}a+8XyYL8t7w zMNpHC^_?Bpcp!6{5_O(Hpum=jI35%qP>}h!?qZ=U8&-}h*oN}sfttoiILx7~@B#Z? zR9TiS%bS`z>O$^7YVB_;c6K(ADaBmG9TMo=8C+*>fOBH%4<@+aIKc;6q#1Q0$b-QV zcUi-Hjr!9`kLytj$cwz$MkT<6qyY!$|6=T&qD76O<;-o{#@V)Q+qP|+XWO=I+qP}n zHgb|qcW(OLjFGp0tk?fx%{8mODs=Z$lh|08R-eTuQxG$pv&oXHF2*FZ`$x zhW-C)BL2S$V`pSx|4(*Ws`me0Q+fejh4_r7@BaVPls?gp4cMxgBx+1qKYZrz#40vd zUcHC}LhH3olB5X7hlUn$fAjVW-~WGj+B>%H8>rr|X7}&A(Z~7!jG5p~IS2WFVFwA7<9617d*LC*a(8Uy3 zBOea;pxjTRYG)-^mLq2!EiuV=J0f$>tysYWWFbm5>X1)X5JEu-Z*IJg7v(}4w6fei zR}H@06?F&r_8r>Pw*{&zSH_#d2xGmAOD z03t#^^2MmYbJJOcm;Qv$jO|*!=-v6P8xbE=Avr09K^n+XuODU5w#Z$oF$&+rFApA# z1cE>)Tpi^8KjF0Qr=J49k#InRHaRi?fvV<2!#1q6ITf0)^H>i}&u1WJxCp02cI5C0 zW&~$|Rj;~oF08lc;MdFUDzD!!5E9KwMjqRs)fe65pD^Uf%Yn?;&_lpi-2u(V^a#eaW{N23YIbX$?% zs=%0)*;Vbn#Izsgc7Gk?Z@)-qx9S)Z+vJ+A1*{l%pLHMnb`>T2XcoN*BIdx!-5waB zK|H#_%#BoU5HbeVw)Q_Xt*Jo7*k&5>?gmnoi=y)MqjUZuZnPNmq7jS0ELd-=xQSoOiD! zxaBi`ia2By*em-4y+4^|`k+(8tsbYKzrQ=eXI1n2p{djXg6R@gy<8MM>SGGoxk{Gi1(v%uMdF`ka zkh_LNo5($C7B?hMBC^606jU+lUT9*wc2K3-U>{(4HOx?GHJ-cJuDj9MXqNH`yomjx zkm?R5b$G7$X^lfGTNnxAan0M_XkM>xfEHI!khpw}8D7EEt;6CAT)MjWk@cQXeGhN$ z(NI(nQ|gqH`W{a)82+Ui0E+VdrAW0UT8puEiEG4;%8y`?@akfwg${ah1WH}P(n|G{ zjlvYHo&t=Othpm8S7!4b?FPE!NFEo3a?P$A?aXrV@RaNBo<%R2<l^H9odE9t8aF#iNZlOR|ge}B+ruD}?uzfPr(x|gn*UQO*y=gXaBTi|g#pA) zHi37T#}a(0h1u@Z2L@U>;Jrq|<+kzB@ylNcCsO8LB&bDuU!8bS$n3uuho#0$ptGUV zh0Y88`&+Z)WCnzS#WN(eE8mN*jNAv#tJQmo1n$T~DROs9zE}Frqt$13@*0gAtCP=z ziUH;u-A*$6+)dYX>e0B=4J|%LV#UL2eVXw}WRpmH6<{HXIUmJ02ll~4B={n5!mfXM zVV6x4`YBd?0aQ`~(5-WtQD`H2nW)*7*zuk1*0MLcQ(+<;vN4?c^>@OYs*#OiyjB6Nt|?O0Qj8 z<*R}fhr8j`bNExro`@7r(;X(DLyl{M#+^}X3z`?=cZlAdYTB>9JuYysaXOe*{Pu!2 ztXA+N_Ka3rio||L@Wc*o0_oZ0D)wPn4DmP_!FvrFqbAPjksgHVFQq3hkd`?%SOJA6 zpCu6u)%UcE%i`{;Gk=RGgiJ+xp>qBu!#eI#4W`XUEaBkaN=d31FAYO!F3*_fNT+3> zGcKC(f}uP>-YerMn!*T2m)oD8Z=Rr%wYLk~Bk~n8C88Sw#pcHC0n)1ZYoKnLMu`^= zQs2XsZRq1@ncvU~r0k1pr`-5jS&pNhDKwy@lAj70^GeCZedLH%n59y6w%3ttO1B;e z`bC+LHt>2k=G%%8g$rhQ2wAHVD>FQtBI(b1<+{90E>Q=NM75El%tHuxGR?m`=H$P? z_%5L#{&oxj;6FJ73o-6QI(E-x5r0r{I9IUDNiTxs9rAcJT)x2SdT*9i$?6XX4_OkD zkR5!`>$q}RYGa@9LNYo4Qazo)Af&eIO2l4;kHw*amHkU65Lbh=T#k;&8nkTR)R>(- ziXD?qQYppsr0u<*8gq87tX=hgBMzCrgTZDamvTx6D{){Oz;S~!%IJSX zufh6aWx)$3c-0-I!YAp`=W7r$T5$vdQ_v$gDOntQ{CH2lAgTqx!R z7f^Ig&fmOYMyed^d>Yn%+6OTnPv7BrPm&ExJsRB(>zp8f>*)U7h>xEMy(K_j+7sKW zT-|T=3r*>l7F>!f^PXpx6%2vop}Z<@66*&{T0|^ah{OVJD9ovSxiSkBb~bUO6SX#QHW4;4vNJZJlQyw6b2cYnVPyZ`HnG<_T6WlC4ZeK6h5)@+ z9DPqu-;Q+_i+pdcC`=C@%M7R9sey$}_y;)^KK? z6&012E6d9pV}fWKXM!5O8G@lfa$4%B_vcWj)Vx0X$b3SGuzW`GKsPMq@{;)hp~b&O6b0W$y zsnFRtx)FRt$k;9Pn69T#M%=j%!43)0@))zaI@Ho()!E#&ji=A@&4gk*}+rtDvpUs(XAp>&PQELN1h#CnS6YP`&X!k)H zoi&pIYVX6+(_@g>g|l_s#Vi3y^1AExPeVGhVr1u$*p8fmRIb~L+~x4S1HJ8EW2D6) z=|W+N4CgR#&Id^!{^6Vrp*37`=L#Vp?X$W&AZE}7bC!kr=emLV8lY+sPe}vXLh&ya zKz9fB98o7Pe;~O_Swi$VjF!YQjNS+6y&J}WC(-F+(Na~OfN)OU)0-8Q_q(B&z(^rd2iM6%AIXKF1%xdj=|0%@6v3n?q0FontrQUtvx%Bih0* z7VNi2br;hBc4*xX1iKa-t#rV`jXf5R22%v2 zF%+n$+y_D~?h;H0m8EJfvIlBRfI)oMs*l$vafTZV%FvWHLFqa8Ip-AB4l15_REsB1 z5_}IxI5!dJIe|{)0Xs`NDslBL3=*nw2SiT!$SeviR~XDe$6_H;4hA=f{I-}-FbKwr z2taberAg6Bpp|r>9$45%e3dQ;S7Z$R4JZQz_Ed^=4B3W^jpWIYum#dlFsz3RTJ$d@k{&?pAR{qph*Yo8x@5>TK~DHCClRF*>CdP^ z7C~;m4sE1$pL`r}-_Sc&F&hS8wRkuVc>{S1(Md`nb0dXbA;id9o`{8{&prVOL9|ec zP0~P;ng*WN-ff>j+#m+D8F@Srh~Nqgt${V}8Gu4oEug2}T~;CG-H}-8Fdqs1aq3G> zTnBYyI3i0-Y|JYlS{-ps01>nAkWUT}_oS>`x-1r#9PH^kYi=>8X>1`}SP>HmCWyCw zWI>K#Jj#5$v!gO~ywTAZNBl!D5`?3klDrZPg{1d`e8E@XT}j0snQ<8k1U-4B(xCU( zQ$DrY9lFemd&7Cy<^A>fK0CUN;mwOnTbHdW-xAvtzuF$&q3Y1(%L}{UkBiES%?pob zge>o^&{y);D}W+}GW*!dL+ekQUdp`j`&YP6EO*z~J=9kVOpA zw&-aC{%8+sJS^|Qk$U|>5W4pKc`IVy}9CN^loSfn5h`JHw<1Du8n845Up3rAcQmEr)357l>LQq z?WE_p4zr?AJ0k;C&yg@W?JLcWGnr~x2*)`BfI+jZTR{TGbOoFYvq9xXl5u5GpeHWc zr|B&oBj6K!EXkDeteY}+`9jv?hZLKJ&EWz7&G~Jj!-7Y}i zzK~(DDxEH{`?xssSzkq!ZoWYB^Sqfq*3Z|!8x%Yg25Y9*$co981<+Q6dC*2UEX9xU z75H^Od(T?Ez9n2hJLA21zyivgu^_Z5f9xjhAH>L|gE%(La~qOt8_Fy23XAGIZ8VIe z{vu)6)$6{mL40&oXVEayt^jW{ogZilcAeu$fM6L1l{W{s+5Wbl<(b*J#JbrXK4_?= zo9JqN^3=KTmLTlF1-YrCdNFFq8W_8f%QQX9RN3sC@Kk%9a^iT{;DNN!3avi)Bay^5AP~A zEwDQouB;qfNcJ?;u?_Y?4krMh+%Eh8G7fMIK4w9tfl5rVt(PM9nov*m<;B)%$);)h zgm8~78L9`@X3lg?_xD)Z0>I)Q1oJhHJ=>Za_WmFYB20T{uRl3hKiab!eoMK`F3n)a z>F+05V;+d4P|Y?xj!Q44+Yd#bG)&|3RbEQp3xAicf&P?fu~vSRWjp-j(e&_M;N5JAHrfS4buwL%GrR7qK(~|C zZ+<@f@OC7GL~e;Zo`p@OtV`w^C-UKR-Ai|EqSLt8QzYY^Io)a!`RwM_%Vv4Ibs;zJ z!RQa1YBqTEOTZJe%4Xy1_5O6vw#(D4;tv8XH(Qkor-G>M&tr*44w*#V%X_&g0{r+a z@>-JZ%kPhPvk^Yjw1DyG=~t&nY;+6y`C)x_@;rx=I!GbZ<-_5ePW+5I@}2CH*M!bk zJU|AV2!OP~R z%?oLw&%GbEOA!?uH|YG6izGe}9H;#@Sd)RsLOAI|msw~fT*kwbfsshQJ#G}n#Yn_( zq#J%fqfsosh%q!lm$f%X09!6+KgaZ0;~o;Uch!CoT;b3a>J6IHR!c7TMF_qm*X8+s zI_({dQbts6ilGV-o+$AuI-#%HnM{@D z`zS`NtO={nCQoPJYR8?u&HLnp8O(+$knX-2$y}lC&VJiWLR}qRUU%Q)?}~>4j(2Ft z_rpj;bjoOl;~Mcqru%fEEbFgA(Dri>JMsWpxXyE}sWpW?Ru9CeabKd>K*s2Gy&HxP zzhgsg`uWeQY?j1TDNT}GYIhlg911-y#I8~f`dyj~>T%WS1}#8q6B){;4#MEim+1mLeYaQqWTHDKLual8qDdTnT>#c10rrNQ;LWCB(E-a~7uGb`Sgo+G_>wcPV47tBi?n$8GM3#jE+QbRo~$ z48VwY$wktP-+jhB%l%jfu}fRQid?XFlDes%Bn3U7%cc{s7Ct~m8M^%Q2jgdYzvxvbb zy!8;BhL^neWU^Y7D(%*)kFNS@-x;{u)sjF?Bo~hhb)7>a7V1(4vvCZ$5mO=CxJV9a+h}hOZS?a5=t*rDn0M($^D#bHSP+YjD)2HKR;QOL2m8*;u!C2ka8T?~ zjb1#IlJ8wny=sGsp6nWvHTV;z^?`JprL_)AC#W}-!Q@d8+@Vs!++7x`#O(oNX2E1i{AN$b-Wpb@={+(z(lvAw=HOqI)gxRBeRF-J5i6d`S+Z#a)w$ zd5T9ARNi4;U=<)y?KASEm&G8R0xQ`xiQBDV4hRg5HC|ddG?ULu?IpqOE))&?8VFVF z!|8(&%#`#J+gGq)C08>c4O|ql7sC!7TUo7(mn}iCe^!Gx^Z{X~43$2Eg8p`@zaU&T zmT;GsE_H6#Q4VA9S=}<;G{z5H|QM-K7Ky=zz^EGE{=5y5^LnES6>-QC!J)JY%~hYmvCQZ za_?{2?!Z*KdIkdm(=lJsDnMLlU`YNY?qT%jn-Sm>t6BKeNts;{+41 zLYi~Z%U8N4`M+RhOee9WW=fW<&gWW89Iww;Wv6_1x~AnY+Ek~rOfK5aCqqF z^*p%hG)n87gU%uW_W$&7Z-ZM|zmP2+J}PvrP}x?9r`~JYsap(Qn{~MYUy6DBfVt_z@XqL0_@^6`0-z`+lNxVIj!HWox5fn^kdR3@H8Gi$}> z{BXJBZ1>3Yog$G@YY{uGFLX^g*=kRgB0ve$2hnYDp}rDBU*+9+l^q<86E*>ZJ>DGAu~&wx=6mw*VOlZa(wlLNs@Kk%j?GZvs5Rhn z^lXWA^i|wlyOig|ENvYhNNN*Km!cVViMFqI5xOekxw%-cszzTtSuvg~vuHcTwVnqY zAuv>g=OR2d8aXvLfE<%V^NY1#(V)}oSDnA_$v=b&G9$582LN02Gy3F&MMWK?rP{LQ z>bBsrqVS_{*;Zd!%uG-g>usqrFrct;zYw4efS3lXk%eCiygxQreEqua^aL!Bzw>pb z@{aHzL%vizO881+R=6D}4b+-z>jVi#%K@aBAl64e1N-eEezdU@*zno9>c0v4hB4JaEA)~7a+clHE`w=w*M1A`SbOB z7kZnn%Hy%zZG)DWXv^|$<)iBtNO!PD@?cGryt?+UBEL#pmS4p_2|2AwfUgFK(PSR<3C3VsdB*w;J{{r z@SCXW=T@JFQRLNBb_&}xb5&$~;O3+)o4H)K1G1C!*toCRkr013zg%J{gL^UVG6x>9%+3c4$ zUdU$nBYOp3P!L8e%4zncf5Ww5QJ!pLRJ`4($Yk1N{$o;)GcwLY)B z*X@w@oB^0!Y{eLoDt#8y2{89nFMvUZug?y+g3yi>FROFMZn&cGWyeLO!KiuS2`a_& zcr~jKS2*morcyDEsQQ9fJ@NEXGaY`-o*JX#R!t4J_98L==$Uad|9HN_YZNNH{e~9( zeI(Nod0p+4$W>c(67u@cH{YQ~N~J=9M`2P4*myc1~Nk{!;DUxLlyLG#V*frKsqUXBquxDyz%;acs&e%hd&QfEn^32IY z?W{@3pMTV{_RqBCQEnq13;TawgR-#w-zn^@Y|Q_$#%}pP1XfKO+!H474@Lqq0voeQ z+y+u_wPeYdGBl3ghQ?Ahkk8vn^{}Py4XD|Ki^M;3tBA<;%FvI$!IPGfvVrdpI={2* zym9#cw737fF?`=8X7fi7088Vyp2JqnEy(17Oj&-k{e0_4&XL94A{EW5mG6PD`o;R` z-RDH*+BclfYJH_SL*utEW-d_5ICFIi;AP#My`{z|1#_yD{AC)7m-^CP(>~?)$qt=G zJcU0$3C61|mQEv`Z;;I*mGa_mV3fepxz&C!EczGq)vKGalgc+e${z`KPPH?a2PtAUO(--1f?v<^(@u_5NCYY(7oG zag2(DBXC1v$x_P0W_gdH%+1UjvT16pA2qBFefNuk8bM>TO z6Zmm0e1Gu0)6wYT`#LHis8S%j*QG+(^M4Z7F~eDs5D#Cs#8T4rAbPf%;^!h?c$-?7 zxRuGUSnrsy9K)M}gu&XKN?)H+bL=7IWafXIA*(uINawJp;__HjsO(}?m^96|=D(gO zOkw#L;D&O)Lbk79vIB6gC` z(-%jg6JC+b>B&#(XpVX6RgP)aqu}g5#3}o6iVNC$N!!PGf>6;Kid$l`DC^-98JP#h z7C6>kOA&gJhof=uX7$LrjQkjfi-dO%;UYH9U|-)NFYR6vp`V-3r?wltq3TZ<0LQVq zzuFW21xeCh25MW%F66Ca`D2#f{^|P!QiD3DbzDf5uH$a5zL^-usTq?)$)8L8Tz!Lu zyMq@0JNZ!08F#mQY7dYT3uTcgo$gD8?F$PBaEE%-Gl49pbLNW2^GPW}%O zxKHNRY*Yc zQ$J#(D{}n%r{smTXLvX~1dg#ObN!h=a&2GnQgTXBEEi5ipLEycmMLS)VrD-Ou zZcW9{scV6eWp!UM{;b9P3viXP`Rnc%VlJ}Aan##4`P}>L73!_oo8}$=B)mCx_ zI@lCjh}zST`1FE2#zP@0&BEdpzT4TC7MDRwVvgN0j2gj0Y`_@5k|3P;uE%mDmX|Ae z0GA!VzaNi#C%0`3Y5dTo$bx377=KIbX&@aJE;xMtaKZ(=;V+MN8-1TY7SXc?k`XC* zL_L5g@XpVs?Kg;Zi;GvWj)eL;Y(U}TD3P?a@T!Vr8K?3`)-+3ML?DtK@1z%Oi)ZgO zY#H4EkD8cbr%ECS>w@o?p{Z8*%$!O~@a^jNawK!;v6Y(YT2RbVLd^DPF4N|n2N)Ng z+0UE*Ec}t1n#jPgZ#Ys&(r}Yw3NLWo+0c_P9TC>o%yoozVEfl<^ugprea9bAiTR?I zeCMb~ukONVRql*IHJRbq+sVu%#09NjRZ)YyRE-S8Rp;+`glWmp`Bm(q+>FRHbs2L} z-6$ThUI8pH&8S7RwdP41z$Ubih_e?#TmjDd?{*ib;>U;X>JwTuiE}<(wX8rq4mQX8 z;Rd@Yk-H9yI9V=E{+a@7NmW%;OMK46=|!##ct%Xa zHjGsoqRz3rtyy?Mg4Ba5q7Cr!pwfcV#!X0Ip!*l-oby>Y8s{-OpO{T1RP{1|H$KOn zp9FoGX!2yyIpL+vtX_q%f`$m+*zx!p>^YuSi-w^TQ@3%Z0h}dp8IRV)wHi|Qx_=mki#s?n(fL>s60*;H zJli%^y{`3ksaE5n@bre=gmb&lIFv_CEJULEXl4^~D+j#yhmV3~t*~=rr*ZoT;fQ#C zv)1N7pkVi*znEFC)r8O~THWcAY&H)-_!k}*ao2AAtS7H~SZ!g_iotvvP&MyXbXGfL zU0`*Di8+|YL|+VK1Mc|Bv#6nvF*@E)1?V^8)(~b-JIB(rH5GW9=;E`(bVY3CN56Eg z!%pAHaDrEJ?#TefpMP!_lp_k(Y3j@ZIG(R!DJ8bLid)s!K1nuQ2yL*_9@g~s^UyPr zC5w*-r}?C1*9$s;7wo<(_?+oWawV4*;f(F+4>r&kuc(LXNQ5|W7u({ke6=R7!6L61 zUFncpwT6nwcUlE9uQWy}rsfGw=jtKx(Izp5nmBk1E18)>E(ghB^fZq!u-TXkigoD1 zZr4870un!GOn2{HSABys|?FkR*&#!aK8#l?QpBfvAbDd`>@$7)TeE$i#C3{&nL>#ECIhml{;9!6IMRo$8x`bVMx5#|Ha_S z{vY)F|FcBT#K`o&6_9mnjmHqT!*+jC9e_&`SwaT;3*y1JgWcI&^c2QIx@NXW&E)3pB!10~aCza+ec-aTv9bxghv97Sd${pS@47~B`cBO7wP6Lk! zG!+FL>N~)`Y2p#{%BbB)V3gaEyT7}>f7i=f1o`=Wei}ES6UfY2t7d9H+MlET9r%|% z=+=FDi(Q2N`*Lj`I`Mj&IOkix_-h`T6}SJoOUg7mK#S$~d;2tdzKZ_B0YTEGHz6ve zyf(tdD$bi(5K>U*eLRwM*%&w=>C-L(UuvU>zG0yk4K6R_pj&;uPdt1-b*F#vYSiBF zH62pyk=9>>jtc7)ZRISHkX*~2K9-ERAQ+NUvM#=*KXN|70xzq28hN}Q=dm7vDXOut z@Gg(p!LZoHx#XISLZ;OKIf`oI)Ig2N>WMbtxwRK?++#sBiHn&UaWOCb(Y-OD)!MZl zL&LSR#4DAP+KGzacg)!(D!~rbt4{R& z43zRM226)rmB-Y(>>icGRBBcjmaLd*5ZbgdqH=FRtWkraDUcI0inLJ>l#LW(oi?w7 zhF8mEK~P?Q2Udv<0#<|K#+m#%`r19@`UoXfKhSAFDZTa~8;(wFf47NoAVhsJ9dlnG zr=mWV-g?fXw>NK`@Ie@=xP$dAyZA_R?BiX3?`fpjg*40Yc*mc;7m*v$a9;UoKoO)r zU!TbZ*N4EsT@oRF8UIgS!Z&rDMonU1v_}pG{UkvoDI;CY2a!=6G?y-R>6Rlx07mDJt!(=eO)wn9_> zHnTD`1y)FAM?pjQbN;2tI2I*(Pt-X}Wp^CxJAAnAF?9O0KnwhqrRM10eDuh(V9-O# zE3aqc5o;pw7K)Z!#VghPR;-Ky8ah}+yOke6j~Ab|aTr{mbcf|3N&_H-5$Ya;WCX+Q zf|G`CSxuhPS?|bQ0e<|_`OugJb|3_oOvs0m2D-aVZhG_QBvdpol~=<8;0|zP1%hQLkc2@`zU=?tMesax*>Mr zwiq7(H!Nd(tZ7Kt7n4tZ0D6{Hm4Gz*jmEY;kdhLUt0e-l6ti>3=p(11P3C1A04bym z2=c1BPvofL3lp!nl|&2wHAr{pYs5y2bX3D8V@rr$(8Ma@NHelRE={nbnP3blKJpA7 zR7gS849MyBs5uSAvyWb0$Mo&I`gUP=V3JgN3WZa4`w5=Jkg~aoE)O&iQ<3gThCLo@p>Oh9ZeL z4qx>-Hy0;o9|3gA!EU!wiwT@HQt!kN^=uHzqA$OzD(BAfh|P!S5&F28)+{KQj=?#8 zUDfQ*KaefPwMy?!K317N2Awm^WWcttWtq5dhhKQtpsOu;e0jVt$C)H`Ex z&?V8r%qoFwR3IU@XDaMg0X9)r@&{tkZKb0OFp&stGbpbir|Y4FpEk^`18q(nA622p zi64d2%)-268Qb4|Ww)H>f|j^PtxNX@tWGJ7Sy6t)8A&RZ;e$De@s9fY1qJ<9vSZXP zjO-j^`RvsTis}o8IYi~VS%5UMD4wWcNk=%Q1asuOfwunT78~i z!FPHThx4B&28su0>hGgaRZ56TjJ`}ldC(rwS z&fjY1zv%PY0?2!ie9UgWS%29Us$h6GE8uwhDyT^C-G~*HJxcCkcF0kKj&Md*HVQg zQnAJ8-PDy=8~r_glu>xeD-NyyPH3*oA^yyWN%vbZa6Lo*%l>u2G}|TLnE-Y5QO^3D zqQB;69jXqW0nKtc*3kkSaTaao)HN8Sq+skny=)9KH9+TLmQvH@7z|7wc>6mCE}8wU zdr~h`6NP2K@}@a~DIfgBIZB1|#}Yt}sD4L-s_0nY6F46l6c{YKsi*nE?MT>jr2vnF z&nz#2^N zRFk^y*s$e$;lK}hbAG1jJ^5(Jwot0oi@jD#jQBwK3FQjbr6 zaNIX4G73KZgVBhiGSC5GOeFfpJvi5s8NLPFGAW4ZBHOq37AmVFXR+zeGAHmIQ;Ju1 zH=sS%1!|!=JbqKkwg5(iU`OQ>1aU0brG;zHWTJWeb5vbicL}{X)=k3OJ{Z%?LlbI> zqfAYgo~df4N?HRxv$?s8x1f5t>I_s%i?${io+)cQP6iHGae)}L4mN(RH|9>!ykpzy zEst5X5O;=iO!c&hC4m@A240L}0NqDHmQy@%y!a zS8)6K8NWHrLm~x!^u=g4MO(Ga*+l)0mcdg4aL~+5u1#tj%evucqG8EDD%!&Ln}~HG zpl;<(wu8-xpM5a%{7i9Eu9a^nbNJu@!U@AyU{MV)zJNMlWhirL(uhioD(Gzv_)?=o zwO8I5+>DFM3x`x)H=moJPiOCAb@&GFwF* z9)zSqAIkE>D7!^>7+_k!0%2BE1C0zVToia!?1!86M`!h?D~NPXi%kvi*)U;bme@L~ zZ)!ke5mFt%esx1~Zq@^F8g3FayZasHOhr3=C zDC~e=7q0bkg;?YYo1OuO!E-VMc0wb?D{T=i#3` zX?8V`PsF%)RBrdex2P(F$GZ{vZ)-#Wd+Tm_=4B#Szl4SAqdXhCs*bkRB8#wnol(JF z(;)a2NCLN$Lewc*KiHGjkOKXn1)$r11gm8h?XtwJ7Z3`N#xnE_`|obwvRihV_5_DD zClbNuKT^PLb)JT`oSq0`ztN3Iuvy|-UL|vOLGev;G~9WX*rkMR0zYC^42!eGT#w&E zf0L14DDWX+AAv001NAkky0e|_Q&n~qTa5zES0PX~2}B-ff%Dn}evVIO|9uy(7_ofb zI)}AVzOn@2%VUbhyxwS&EBCJ-sV23$VhE3+mA3kIvC(wR@suv6@9=&BsgX=Nruior z#H?K`aps4*a?qsVtOH}v1rqwfH}XO^XbDl&$Q*aqn(_eRb<#h00=l*O#c3M~2Osx% zx$oYsx+?tAYrY$g+hP=i>VWw|o}KE_ptvN5mulK+)ar0Z8RdU%#2=u~EIN|M6X*+r zjCiOo()pqt|ARKy*a8v)U_x{|cU);Qjm8Rv+FDLwv))m3x=`Vo%+z5mg7$M!+;dpZ z42TZzo_?n|kMl3Feo{qCeVG2jZbYPJw?5^zfL?Cv%`FZ6s)yrB>V3+*s2jfV$9s>; ze&)4L4K5X#JX5dm2A7T%HoXc4xD_yrVPajpHYo;u9`%c}f;e(ErCF#P{0IGNbTHrSq5 zwKw=7RFd@se{>G&I-R^$n^V=NxTtI0j?itXUtbah{32>E#&MXr1CbqR>&OD~hy7IU zFWx?aFFuSYoT)3(%aGUIuVB5eQ@zgH+?^1n}8<8v5bgpIZ_g@Y zg}2>aSkIi%@rtL<-ND^Zy;tRtcJH4T=+AetJlI2K3&}4a%O-t@ckf`iI<-8Hrjb}R zN9IHk0da~$#%}k4?msycllUZ&olD|5c78>Mr3zER6WDNzWim*~h@s%)R0_sl0Vtw$ zz@#9sg)13QggO>Q+#Q%}zww@43^NY#^pd@D=w@Ptp&B2}ee~rHFG|1la9UK_0H!%P zjpL6D9txWLkbO4&vkmdL)ioauH%%DP=}b-&7v$&2H)|`G>$mMEQ;_s(z_`HhT(u>J z^=%3@`hTZPM`4sVEZ26_2UEm87t2Hz7685S{Hx(oTiG*nnJuN4vmh+c>oh(u&RDi1 zW-rT%X!%f|l>T4={RubrtU^j{n+Zxotwo|PNEtP;c{c^Avj!`nMgxuLBkG!%Da_JN zXzv<*CM>iNuppJOr<)yO3+C=ZWH7OiKX+vnHxnK@9VZpJ&$gLS3sXaoOY|OiD)eVI z>a5EOs%4gKCFL_{;2kdKb~6!jRy!+GHjsCYX@gw9&kBbjxx%OWLGi`;NC%#0VCb{4 z{A#fIX3~&7ltPu2kpOGO_)Xy&M%7SS&RNJvOSSl23``KzBqj!CrJfB)UMf_fElg%D zjK5=7Keuo;1uq^OhjV=fDNMk_B=Yb9>T-)GuUjX@mkq!8nBk9K+oi49Pw50l8oSEu z_pl??N!#>PcV(QVNo^m^dzw@X<|A=zQi=Yc)QL=F*&0L$wbU^J>;ilz{CfuDXrFy#7rVUC_Inohw#*MPbIq_Yr%h$Vn;H$DJgc`^D427mVfd zzdybZzfkiLV0gO`C8j}hLXw#ESgJcnKYS) zmR7rHwy$E(t-zqQ!XZc;hLyY+f?bqFM5bo028CH5l`L*HT=5HZF+$(pH_NM8Sj4z~ zoH6@CR?K*18$A!PKGJ=8TDb*DS6W86u*oKZ`Fz4_zZ9g1P4!S9yU984Jw-f7VHaal z%Fy{Z@;u0FfhaA+?4VJ4gIlj7!XPO&^)D(d?nxHb^%d{1Rs>)m$kEcg(!q_}ZF%f0T<|bTx)!T|G)eNg+2SvALq3td}E7kBe$UTp5Iih6FL4 z`#nf;uS!@kT6`oCmJyTzSN|UI2ZpP{Le$395~Sjeo{&b-Ch0Dr9imKBkQ&^deQ&nE z?Fg8CN(6dK*-2i4<^Y==yL4)JD#UGcBG7+`k?1PYOdzN$!s42X1Zkwzw1`hGbbb*T z?BfXTGtvr6Lv0GBvm%Hh`5(o(tLGJ#oom$1$;vsx-htm_<{yR}Gu-w{k|@JaWGpB+ zb_O$|0aILE?*fT!@Arow*vJ9S9j=`0wY%mvAj?x3brKf{2CKl9D0H#RFLXP`l{qae za37b8m4Ty`#uL1WCnCV`9BvxwL`Z?h!Hjz}pljSur0jPsRLxmse1%IJI!>T2sc5RFb{l1AMt0HN znwdpr5Bxvp2gR}hlLz9+5DT%#B+i$I)@~t>3@tmVhcWAX@1;d&) zP(@mb=X6%%jywi26Z}nn^-+I(=2o9}xbb2|BV)103$?K9egnerrK%l0M zlSR0huHVw)u96ehCAJ)%#0hRZ77*u^6OncrB1T;n9rqVjOKl;8;K1r`$c*IlRS{rJ zQ?R@7v=d456h>;7@M`6Q&poWLXzJ%3K$a0vV%TLE)eXOHLRpEL-rl#axN)0eR)y}k zeH&I@X3rIEA6FI2t=#O_{?EO8unR~4k=Q!VeUsg45#;+0POlOFQUhLYpd~5D%b7>m z!B?3%@0_J6^FutjCl%*G8BnJz&+%In+?j_ml>5!cxNrvwmYI?0zS5?$c~d@fF|UGo z)-dzTNKWwxU3T{D*RkLstIQuj4z~? zt4HI6zj5op#RSy*%+l|9=wc|7DPd;r|QLT($pSRK*u? zNw}w$KoL5y4A_`$;tr_h($EZ9Q~LVRt1vHxa_g1nvnT?LW#we6c_b1%yyW)&Db5a_^0|(`bBT`V{S-$KvM5z>`_z;;=*17(WXX)XH)exEX(W zxwj4`%~O)ziG3yo-*EIgXKh(c1C&A&RGg4u&SXPP3GYt54lsi{TCqDB9$gFl`fUNZXuMG?(r(-)!ek|j zO!Hj#y3EnU?)A7&? z{YV&hIrJoQ7B9W|9oz1Fo?5!7prO&55%M@0=0fpT-{9)1*)k4t~QOn$Z zAaZ0U^9>*}$P(k-2qS47>%=aztY3UR*Af z9>_`9rrrqX1l?_Tzyh(5vvY%*dby;ks;tZX0Hm1}v&OUdq51+@TtmaHZ8wXLwrYPN z1Yun8U~_0kb&5TW3}5tR38^q&09jcz1X}_)**} z0wHoH7neJ@itA>y9V=Te>F*E}tAI{>U)d}1|FR(YQeQRzhI=J|amtue+WlzX9C+T3 zA{ji;CFByTkw=Dz^_Orw{jFQ-h+bwXQ*aJ}XB+KRL)^H~gQAUyqX*Uko?R^joWGHp z%D$^xHOR}e9{QUiU-5M!j2$Gb=t;LoVy>c^ts`qUF%z%91#sB3Rv3-pqR~I>zK_Zi zOFI&|*S5#bKcUWDjaw99iAk+{K@NtQ2p-<-3c~})BiKI{?3_a&uXX(}s(XjsgDj*I z-%d21eu2yrCx!yRx>@P4Uwq`Hq$ZU#FOhRPB6~TfAn0Er{Rw#`Nx9@l@_ig*5znDo zO7zZKd9~?Pc^XjcDR)x}CbMs?o^8A}Xzb%BDx!_qA0YV>X$-bRT1J^ARd4E;NulW zkmOs3bR^c-289OB<1UPf^#^$P)yKn|5HDaA{u%N1s6Nx_vErovq-Y%YP{p|dJ+(7P zcNHeeOD^S3DveVMXoCmq#6#5CO7oH9J_jRXUi3Brc?6F5*rBC}-sHJsEupRo7GppO zc#rM$@0Cqg&4bHWL`%1?rREek*&o@B*JDEC)@5osfza!@i&Bi{lXvLT8_gau>&5hH z!!f%BNylOJ^CK)ODQn&R$OeLDp;`I|cz=_R0n&*GQezw1a%Ex9L>pE}iA%lD`bG=j z`ZO9$dni6q2*xD^X(p7+e`|>XJD%9Y)#F+_&!P#W3#8CbFD6r|)J0hsGtX}CIW|+0 zA#j2O+Bk2QdN6FPSXe>E3ajR4fe;3{5upPRMX@heUvdm2&lDJVXRGj`GCj93At|R| zsone+ggJr3z8!~+B2i8yW}1N;w0_kk&yl!Ypan6?cx^ykjEvS?Av}{@ZbUxFh1`fu z8~Xt_W)1#ZYJ*R`vo@XxF>#?OE)Uw2COmc=3ZGSd=o4f?abWb5AForLNtGLVl~k*H z&n%G>s#c=6Yfcub^@XZ$_-jq*K5#W1Qs233Q*t`yC+o?Jc(hJS<}CM_{a(}`wAtYZ z9rlG`fE|v7WCk*B6pBc7@Pm`^w;Q%e`Sk$&GS4?qU9E=`?~#q7siA6pAKP|{F;MTt zel?;dXj4_7m_tx3+lRQcidJ){E0jR$n+OO`c$tob7a$FV`JUB34CfVl4eDQ-Wf-rE zQHS+&Ck0)wlUha()z==~xlm=b1H3J{w61K(j6JbKDoLCxqm%}jse%LHws@^^*J(l5i+jCnPbxyS|0yNr2WI>mO4P+_?+fsEEPrcR(UNqF#EY zUO8ZI-aLZn>WV!~10Z=?!$qM5hmR-_JEUII`-%T<*8;$aebZu+`gZeaA-6i?W1~-& zWqcZH-g|8_+`QIcFQzwI6yLspGf*-u_vV<3GGxiCW=lc4Bf#^>BV@sM(B}vW;Ha#; zo^=&k;R2*t+4DME$yFBE-)#wDr$=v13vs+FBXK$8JnhEnBF+CzBW>;6JY()0sS7a^ zofg||63HU?D}daw@d>VBiv4DOj3?*EP=Kt!-8rNCV0)G;Sf>+a@;LrD*?{w$iEh+A z((pvgwXI);i~TCo?{Dw9I1gcm7t^uJ(5hVUbEp1B%Yt=KNs4QUZ--DBJ8D$4)Aluw z110c-l-0Pz={2H_>irq3kev7iZ{WwXh1UE>l!dxiGbFDk4tthO!aiHXkRCdjOWF~u zYl<}gSeb2H!MGLirfu)az6Vk+ctYStKR7XKNmKl;ijp=LuU1HomG4r!<9z8{FirYh zO*x-~8%2>WzuoVx^dA`sAeNx+K|<_XQfuy>2oBjXY?pVO!RP%$T?b; zx$>-AvD=4~=>sObNy4>l(?m4JzKsCcDVt|Cc5bX6J?mZuufpmU#(S{e{k_YTa6$M; z<+9=fnXi@5e#mz0vAH>u>GJ5vmf9Io#j5k{mzXrjMUz`Cm{5x*Xg8AUQezOI|QD z=l{%Z|J#wMeQZVCd8K>;GId9$1OnFrkpOZ|d%23FvzERn{Wo{k>+6wG5Q@IO(g896 z|J!I1g){S<6~{Al8-&sROAba2ZiSPzW&b<9`!?M7v#8_ejqm&BfdgU|%gxwrHzXP@ z9u9-J`r`B29`6Osw)cNi#tKT(oCjKTl;3cYpsb9}Fvq4Z z^5xK8^u>J~=IBxWmfa5ZJGtC8!xtw!dUx1m{}`)3$qI`BrpN=20|ss7Ke|A$ zzxqDI3pI2M3o=?IJNp_EN&NNseH)|}3t8J^nzZqj85$L5jv%MgW54Rvxg+9zSN19l zz5o0gK*=66^xGIhbNKUU7sM7ClN31ni~Ga*KlKJSJyRBxCxRqdBx;Wx_rWEvorzEzd6vLD2)z+Ce@^9dOR`Q9~WsN zX)2Zii(nJi3WPlYJSwGJWE4QK!}+{vd)j`m^73t_nkinL50mmm-J6ENtm!0<2mR`% zx{e~YcXzL;zLw9r&#HOc3SRB*bvA}xK!d#E6~-VF3%A&hmDd|QpB%ft&#*NFkO&7y z)_YwQhrB)X;mWRcIQzG8*rUTue7v}kgOF>2H71eeP+5Vq03e@8B>@;&7e+w5vT$CJ)x5Q-PDI{gp4n^ni9QCynGVC|BCZ`|Oq_#y2#eMeWpGxnlIvsXvCyQeMDH3?+9X9;zKcbXA+96PKqoq z&F6|EQJc3XMzje8C59@HWw4z}0T3rKl;6?&%Pfb~D11RrjDtF&DULV$27Dn50+N|6#IyFy7Lxy0Q5w=cD*#8^E&9Wu$GmphYCsY9DaoQI}jUh zoC_&Fx+`l@@Zk{xOeg!~4t}HMCuY4B+u+ve9CSuWbc()k$-Q+jSmfqBX88xnyJ?`R z_~-d0MdNg|Y*Bx@olFyUQX~LjnMK|&s3?K+F5I-vv z+@C-u4@E0kb4qx#16{So@C#S=Sq)BGQ^=RCO%)6xpsXrX@1GrJj0PH zl;Ix0UE4FU{&=pPLMUQiL9wMY?UUVTxmcZAjGZ~dbs?WJxU6}J%>;VgGP5FEv0l8T z$I%ituGFo^{ydg_jp8cNj0!bZWFYmyg*%!SXVAYPya<&h25rqlehGTSa{F!D!5fuurE1Dhood>I8> zQ;28XHgaQS&D;o|^1aH(Sly#riIq;-`r~=yg%qL9`z0xWw$)*UaN2saS~@wAS_%2# zMbW~)!<0asaTi$b5t9zR5|4mKin$n4UQL1bhE}}g$I=fw%>cq?08_a@4l~9EUfhbTEX<@R%Cz`5j%RafbClY1xB#gT- zA#rdZTCn6VP7BN1U4wL4FpqxemfMs0K2Y{FgIk?5N(Wt?ktFnte@%H0A*l|mtChuF zm|i#F9|nfFo58@;za<|O@fSv7r}j-(5&X_MS)H`cJxH)rr_!DFK}`WH!tE`-Ae5$1 z64Y^k(V|ci_TyhQ$T;y2>GPLoh;N&GLx2VTV}QJg_0mA7K)#G)UyJ6st67;pt&6J+ zz+cpy0jGgVd|Z{4t2eA&Q#rblyg6jCk+z!8t~2^;fU_AV(e;DSj&du_5h2C={e60b ziKN?k{hf?@oJPly45e-M3EP;13VE@MBeC6AwjYLxBjFk!{I z<5A}c>T0C#4p5j#ztHAL^!4=*GCx?`4j{N_WjfQo>RQKVgdqRD^pB-==v0fyXY>qX z+9@F>8O4{0Z}BO}XC|nsCz^%0PS&8rDEni{^jb}d_qL(G#2*#2I^3nhPXQpwt6YeL zIL8AEkf^_j;I*OHjy}8QY;3)oRsb5E>i#C9_TAR56xR%%5JsY9cK!sBk_5dOq<4N$@6<$DcR_NbMXFALgA6Dsq(?xi&4m`gEOniICBc)28 zf;8~+V+(8eq&=SUOEA~XuQ;tWvk3~qO86$0PDCIgEPU>}&&sNE;ifVo#zRv_uA9{q zwCwWV*70;mdHlwM!z0M9N=mHw#Ld-GdYWF}AmKgN9BNP5?mO!(YXb9T9#@IiJok^P z>wqtuImRK6I!dTy*_}=Jb4lw&UdxxM_$q(2}p^ z5a0vzl|SJ}t@lzSI?2ex&hGfZf{6lskC$lYM)3E|$iP-ciw9gCiczu(*7XHvv1 z^|Qb7an`d8Q40G?h3lw%Jmp^y{zNpCot2QG?ZKBvHA1-7UC4&V(tp)E*or_zIp&sw zZ$9FnxI7drs-3G z*Yy1or5RD`N$D7Iag0%M9;Na|I?P15uz$6*5c)pgWv0CM-T_+RjdDHIzzgIfT2LWlr@03Ufbt^Iv z0`EbiFz&jaTEghY_+#RxACwUV2X0(_adnt{FC}mFw7qe|;{D@nzcYcCBi+#WHRLZt zQ%+^4F@b_p-$|L?hRem#NZ5U{Ug^5T#v8p%|53|J(q7Hyg9jhhbsW9@q!aRTx$U%; zGImmiU555BNhqy>Ysq`%U-|gDUDPc52pG2vK)>j?*H&0;$Q;@b20o?t(Zb1IUF;PlP=<=9kVaP!w zM4l@CAw?yVyq1WkBY2g(&_(u$8drvR?$zP0>5C>!h5<>j8!7hh0iJ;t8B$&?ab5%_ zon61XN1Mk_dWFdTF1}x0^Mi~%E=kt#NSX|t?0kQAJJ?BW-upM%!rwlht6T+-Uza}< z+|1u~x$!1E-oGXbk5kdgci(-B{AGDu%=RjMb zSeVU*yh$@y>7a$AGFmbJBKuVxFpBnNkei&C3I510eGW8_NJ5bfae_L8!V3yD!E_-eWo6V`e%NHJ z=yeMr0K;}?^hZDrIulI_=-j@$=oiTy|04rme|r3|n61pj@E$uSz5x0iy*=a1=qkUo z*P~N|iQ&oXXIQqp*Ly$1H&XPo!d6;VHLj5~>=;KV$`>B*CYe2$eZ|x4u2|kdmuE6KE=w?k&E3QgqM{++HYQxnL9}4DnyVL&Fa}#(_`fej91hi2-s1ftSb-N#mbA1>% zDUORIHk}+KuebEb+s7=_O`H~djXE~#+Yk>zFlt>YfmeG)au}BGSN!Zk(ZF?wWaC!6 zP~auzCm$ERi+6JCd;rr*Mgtg4ojyRx&^mQfbspa`?U^6H{9w+cyr&c7w4MHgbUZtv zQg|~0)r_Bnj*>JCMVK^d6rw=@(miTH{dI$+{m15sGhLGPhNO*pthQRO`eEmfFDzn@ zW=W4u7N_dCi68c1TdgtH-+uo;#ZfDav`^9#5J=0Xmcg2Pt4Oredy!!%TffJ}?um<; zadmthe5Wq#GpbYmCMVV4Us%BIK0C;=FX6S;h295Gav$!dATo5csN8PfaO17*l$CUQQ1=$LlL?|^6IOHU3}1%;T^HDNB+6DurM);WiUhJ zhy#6(9I|lsd@?Y$MZF-+6tJ8B0KPY0iJ(gdHO`_ob`&#?`6SNK zoZ09;(3!TXm=Vkel;nr?975`S5suT}SHC36g+@}5E@4+%8@GY5-3rq62xn@=nKpDW zK=<9$nX$@OisUrQIt1X+eN$^(Y+!mPT|(a**^^4>Sp5?SAX8QeI>Njpj~h5rn!GM_Fz?z?H1o z5$TOcW*PUakm%p<=-?~yL%d-Ko7~B~-oZHbrn5qcf3rjoZD*6vBE?(1Xq$||s)pr5 z>&;07G3C2hU7g1clfZJ|9>(WE7{phM(T2n6(#JL%?yb6C=$ln^ne_v|>0 z)wh6!aWKPc8YTr&;fke02(J@o&m4U2gEmtAujJeFd3!SKV_05t6&aRfm`}xgz)#7@ z^)q%cs(@P4C~e=9jnAo8n{%&R*nR*a1eX6^Y@r=la{V=3g5zQWz%203b}gDGrO`m7)qSIsVgl!XjR zTuhx$Tu^n8AveMixodaN-PEim;WR$wUxaD6c(b4r0Ap~6P{HbQ?9p#i=PblU1DptS z(wR#J9gb9~#M40y8V<~u9rL(IbYhXTEooQnnW|t=G{?+>j9Iu~p^a)nvt=t2*A)0h zoDiPpF2p!YX8*GMFkds15xdPO9X#&+D?;e5QCe)x7BegzFhSzYW*dXDl9V2@yv*Rq z{LN;N(JtMOB(ebreaAHmJlVZ{cy&wINrPJtb4&l&QAIW1Y|c5+CN`fnJH`3w8RInh zAjel5j}))OFd$QeH5kj-lhaRmxX#0!-JeomwyC_*knzdy;V0Fh!JHR?V{nGerLsX? zda_Y~q{CEm1Wijd4cla?(Ve(EUql6yinojyHbjPMcvmkGYDqstv>x~X(Nz;ON9N?> z!^)-uNj5$+^-XyE(KE6ZdW~>tg$?!11>;vk!%O#w>qfdG{`+I z(bi#hCnuQ%<+%o(G{8-1qh}qe%Rober0pb?UPAua?4F;qSzUdk!kOU~0C@W`aY}xZ zn7;|feewVoUtshmn1y$EgC?lp8Q*J%0wEr= zAqfCV;@h??Bc@u{n$hoH{I8?;zFH0Bjid5n~bnJoQ2gJF22{5hRRN z9GlvAzQt6r3(Y9`tC~;r4X2RsLzzG5Hb~LT0G2PLIn$nj?;ok`5uL7I^B4*4vZD?p z)O{5|g){9Pmo!el!Zq1~xb4BaaA=LH<_y;Qk|go$aA{^)LhqFWj!xq`;n$vT7Yp@4 zI$WkgGGi6FU(e%JQ#x+qXqW-7x|?n zk#b+G?VtHdZ@BByQ;y~mYGy*?q}S)Jw*Ca_7=)XNcamF299A@f)r03~HTT+i4OBkL z^^aG?|M5(Qa$)%4RAxFERApgjEI3lHxk<}cog;b&IP_;eh&m(tEx|LR;@yLn3*yLk zr4E;S8e#>BbKcw%oMj<|J$g_2@r!6C=muUXV8f9TU7jj$jDVpO}3l;H7 zdzoKxh*c-J<47BRH8L2-`C$@iPt^N~i0j8t$eyTS&H|h-4T7xS?l!MHUH|OaKUI{^ zZQnE(ms#%x-Sz?2{z~_*-C zlS-G;8qNbo{JuZtAiz|tkee-aCy&06s~biMuTGLIW;@8Ln+*peaPf!GXing$xJ^K0 z)WWXyPp{#!8VnuB+B7hTPw8HXP_1e6ZIC)*W=x%2SN2zM0aqLpGA$^VYKF$8FZ;0O?HXGwv>+0bd3csSr#oFKI6;|syl<V^>bX!3CFddcndbLp3pP3r3-*@_7@Y^F(t^Z%hvoZX47Bq^RtJ0 zfcXmg7gfuF<_L=2y?^A5bMSs|g2QL`u3$+1HJ&9W6h&yxkw?IXBSzwvL^+mJ$p%O7 zCs+60#?nlq$USOiQs{*bYI`tiAPW!-KO*6Pfc6?&OpL!{iPY|nR0)AsBW%6^-j6^2iF?L#B$S)BA67fyBf`Z+C( zHryEh`i?tpJ5FQ&ik4!$)pdAUv7Ruii;rluh@vk%Z@UZIQ_?6x1__-IcP)yY7u=~~ zvOevx$}~@^G3mqcl+j%P#)j2vg0u1kUEOL*Cem{LDdqsR)qZzqIhejOVSHuUVs}Ji ze)@Pmy}4}LqcYH{T2UvDhNVzlVqz zENuuWF}EV%?!Zb_$~UGVv%tG`E$KG}|3TTu9Mg}@)fc6Vu zvZ_g9epJ|P+Ic(J#|yALraJv9{Nd4$lb7eGIA*}b^XgnZLaZ8ok+nHCuQW42Q6q3T zpL(dKY@5EXD|(OKU>mkJ&)#Tgltz~Po@N;L*N)W*5yM8lQDa)=xZfqLski_^r95W* zsoB18GP!m~$&yo|TZK{v_KWIPO_+{P=75=zbj0Z(1c!+BfE5fo^#l8y#ltqPcs`hT zOg?U4k&B?cQlR)L7xFF&MJDKy@KQP(PshNmm9*L9Ob|764nl_V^pgrEf~L?^-&Q+= z2yJ4uVIy`2{iZ0YrZnAK<>kDdV0f3NQhU%@r(l3>{0?godgIL_FfI53L^A$eT+;KV z{v>usmlDU3x_~sXJW!m;%z}xZ+)f+|k1Vz_@ItkFBj{bAT2*&Xpb+?6C|9SiMy0$sLvhQ=; zpmZP(>H<6P?}KUu!Ro%S?AqUO0Z z_}Rk48Z`w@#y?lrgmJ5zey302MSgTsS)l`m%XXJ+0tiSKn$kRs-b3fktY-@RUEbjf z!8LhS8GsF?0=gLXo0>ujk@=X%fzXgY6Q@BD{Grtq=Cy^Sg2eYul)CmoYX!c$3U4LU zb0_Q3Y`fWtY5Wv>+|CL{T7_i@AlG(x-hX>&NtBZI4XUkUxU36JKjSL%02%WW(x}8@ zsTj_kj)|%d*%pP+k^4>SR52&D9p~xtqcl3=JIFF*vYK?=%m(|PD?Eukxmp?fGE@QF zX?3IXN+$g>{6+3!L-!s^!RqH;Q5B55H20pcz*7OTfUNo4XsrHzq*bx7U+--ou@Jmf zua&7rJ;pO=()?6JlnRzTj_a=X7JiI z(NLF)EqwovhuC>}gmcJaPc{(D0xEOcg?6Du%-=N@=Z3C|t$3T_?T5G?pk9M)MGbea zeoOsY8?{!+Vw1)%`ZX&0xn+X+0W}wp@fx<0rWpqpF||QopKEKn$C`u%FRk~jM#692 zz%qPt?eH0#J-?8_91!W}sr>oMrlR&)zf4+UXy?U7K{JxlR#r0NU0DawC zHf#%RBHs$A#CZ1r4a!^NQjZMpgZybBA#G5aKjuZaJyY$xcDh9*Q9>slg#YM_=aGX@ z0vS>fxT@dfDg4R4&L6=!Q{;o6ZtC_qM?2lU2&Qyd!zp3hdmDI81opa;{A@|8V1wnl&(!<-56kk%BLR^OIPrbKBfAnI;!H zz+Bn45Po6$)7QUK4!M?fUk_Q-hkOOA_(yJ+Y|aiP!Jla!XTAt$$4XgG7ra&eq6)H& z!Ls@`dWU}{?Vx+HvWHFv&C^wPtp;VDPcpNhM=4U$Ft7cyxY=OiEJ0{@qjmqw4Pfp; zS--90_gG!tLiHx${T!D9%}XX&TCyMmq4S(H-b5=jl?&9Sx+DSZ4-~4Z*{+`aaM&~> zY)C?AWUB_JPRCn?f5-N&fV@hM|8;MFZGIMdo&)M7X85a|hpltzO_^*q2iw&GlZr~~ zDwJ&LR-?_%#T+yC5>59Cc?wZI^h@&8F z;7C&*HZ?4?vv)hJT%3-ToscSut@6`GTVrn@{q|-smgEqrty$H%yl}F?L^wOMY>9qu zZKh})r24u}fR-_=5HotH#QC>my^DF-TghBXl1e7vnI=t-rMPeMTi$P}vc+_?D3w9N z1(#~)b^~M&HP$OX1+V4+X4ngR2@6Z#9L}!a`{*yg0AU6Hf0AJWl&r*O`_oXnm1VV3bZpAyrw?}u1f1RB0_w7pZo~{Qu9)nvqK?jF^;N1Ki#3#^{ z3~{{uy&PTgDdxSCG7Ta`Tk1ubb_gBV_{X~T` z6<)vFL@7jz_s>85(){T9@Gh~@0EmK{V2bTVaT->PL#(Je9P!;$-G18^v!1OArW=z0 zM3)@qs?o_{g^bweYK;B80WnWA$#v%8s$T!1^{~8N ze-eQfu+*_vM}mEzC(*7s5ns2|E;=!<8F>$CHr%bonKOi#X}`J3U+kO>t_iqMDSoN6 zE0>cxi6|K_kjNcwnc!?-zbCx!tZmvGE&*=(9%g2ZRkg~uNs(c)f|FUsdVoJtI2JbM z&5f^|NVe*U967_JomP32YoB-7M{shEhq+f|g1 z^UQ)LF-Ma|@`HignzPrON?0TC5U8=7X`_-2s?gG!D%hGJxuW<&5=dqRC4&N17$@Nx zRoXC)@oYSiQ6OSrES!*m9~w%i4V?(L5Xn}LhRHUv@(#0Bh(wPB0X~1b&Yeljol!h+ zXVDCvusd&?9AyFbx7(UM<${yCTn5D3(CaL|M}C78F>tOUdG$*>9m*q$brwmY)s1M8 zh6h@bN5h*fYf0qLTyAZ}T75neFC+uQv=9a;#UEhP;qsVeZL5 zGp3G%nGsrB)GzI3g0LWzv6*<8nM$XsJ}hVv7B$z_u5jg5@?8x`Y`6NBjQ00&tgBLo zHoNp7S`+WQ5gJOm%0CVQFK`U%(>~vh2R_zm2C^2U1V^pc#U(BWtBg0g+3tpi0Q#1v zW?*C%>HE5Y01ybG7QSbp^Y+UNNfplS@*VIpg_Q?sH8*;c6!+L72PyaMhSm zwBOj(&ZkEhD5++(6nkte`mUe{Z+yZgF~;riIMI0ws{`2$hMb3TOiAK;aF|i zv`w-4k+K+RP+kkcZ&{Q#(&HPb8>cFJqq_<(V#Q5x0PzOq#O3VdD8IW069%u)QP`Aa z_40-_KHX*lnxm?Kwo4Ic}kXNz~-MRRigB zjF9>8O=g}!KEiTsasUa&!xudwVB~e-vNY+rojI-TIgdT$6hrDgdR5pD+E_Cn!80R`9R2TNIg~hUAV6P_N)!efJS)6pPZe2GMXyLUh<$Nc6s>$>wtA$mOn;;&)De?J(%)3EY2|zvfjF*od_sEsTR)&tE$5=;UlZnp z_{dHd6NRn5s*sB~HuZ1dFW|Yv{2D171#QKRNK0^ct6jrr&*o_wlsK`W2&2UZ)W_^+ zM|2m~PhV))Q*Z0|rRCtpD;J`O&BI0(vo&;<^KppJ_uRVRnYNQtG6My9N_ImxnLTt* zhr8rYd5$kxo2P>B0pdo>yr=z_p8Z9CnT*w|*k|`!h2we$(Z5bUl#FF;vi-A`MHQ8w zy-ST3Ho_OQ8B|zU=wb>$S#TygJ7^+q9;+jd#n|4P{YyNz)fh9Sel}5fzBPl`-=onc ztu=)WKCHO!~oW!N+qJr}PPg9Dch zp~}dyP5Q8Gh@YY(gkf;~eb4Rnol$!kx_YwF4QBA9v6F0gItxqJ2Y-a-I8j5uUd!_ z8wpnzu@|Thgbrd9T8D;CAVD91np1F)E8zP?j>c7+i8EMjPA3zVw_Q+H9294e$MP~urs_s;Hd+FMB*doo<-0YO)Qd&OD?Pb(EY zW1wLQ(}wZGWKRo>bcX^8eQ2YVMeK?*m=f%=^a3vMnUa22jE<_%4)&EPn!-&B+W7V? zq*-$vtR7RZ78a;>$%R%9eiRg47t!D)4Mj!O(z99fLMJa{h&OmRr-(OnL@(*J*PyBH zBEO@w=w!YP<2wsV#R+$qx@Hl&EI{O1R^B{W&60$eizXk-@Q+P+Xq zxBM*5;MiOJ4*&3W z*^Ik#+28UGwi%76ryH8CnOSw#=sNE+HE_-sjjpaMEtIpJ7 zp*>7uxZ#&_@ULuuy^BH1vJHI~Vhe(X+J zkWB8C;?(yWo9gYmz}^gvCP40jo)x@xy3507NZ^x5ZcyCDG>TKp<<@Re+q7oa=bg2< zqSyvL6J9Uv;-l)s#GbpD<+BIOOZ@7#@Ui=Kx8~1l@A-OHB(jncQb`W>Jf3RQQZ%I7 zeE#>gIu3oN;z2cB*Nyk(o9L+b_p{wExWu2eqW>hyIsU7l1S{+RLPv1MU5y~ld{e)H zw{D|<0-zy7#Dj1o^96_AJ^VXHk3^ zC7mRxrDAaV_yi&I51#gI-*?5G=kZS=7yVV5ERD1AG-5_nk&i|$eS2#7`jVqWMi<+q zEE>V5G(%_m+`aROIHmBuGI7;sf0J;d(pyMlr)wu}*4;_(ThBqflLes6l6-f$n%J8` z<q%l$m)(O};!5n=fqNf_D8Qi|1M&(b?eSaIO3Y@=ehz2t~K8UR(kfHkeWR)nH zuo3-!xxURlD$0aZe!f0OFHUb`*@z!$81LE1!VR$!pK6p`?kt^eq+v;V&tPTb+h8)Q~1e>DmBm(?ls0by*ijy@U z?xzGGqE&4{P)ytXLe<%5>?i(Jp+6e;i%x414`6o0ql(je&Drdc$axvfs^ICZn*8pK zJ5v(49X^?%--w=ts8_bPF3zILLyp8-dnUa!7L=cozYx3<^kQ00)#Sq78$?fiFz%#r zIKfhd32!i7bx+j4pKfo~45hEz6``hseIUW3grEJ}l?Y3EIarduX+I z@RA6}p(kLTPgEWrT8KvKr~AUwgOUt6bl4{ag*JV$aomgV-oGwFv?Akbc57(g7efIw+@-v>wOPy~wayH{?LlK^~z+)<5~ zq-~gZ;_Q?&IoZ4hDriuG{+<|)nm8WHzttL}8=mo{V0d4iVbP07ddw6w%43z4(Y%Sz zTpOoJSRg{cKWgkY+eoE)!+plo;hpelTQGtJv=#deRW_|23`5DL12YK+>c_hMquc%MSs4sB?S z0l3vrk$UMyg34Ug{!hDk3zZkS$mm)@uQ6(f!#VOyvfJpetg6$gI7{ywZCvxAk(bWfZJ z#c(>{F^**%lkciT2fCJnWOO~KwxleJnVSGLCvuh7U7D6FtWq*FaUgIiG`xYh#y$P* zhlwJ&|6=pys?idO&}biuEE1-!HcL#duX7KG6D_*CshR1Z?=6=j&vTZUF%l1s>DG-d5{8#4s$mB;@;(A7d~^eCmL+g#%HCi zV;o&Ncftt&=HJ3%40Ok@2ca6&WN+^u%+XR?F>a!*ik36pLsVBDJ^7hO?9=Gtg@gF|fOskXuTi_bubu!oH|kzg#e8(!<(olo+CnCq6C zGTO|`WA_sHyik~BX2}QzAgJ)=qH`mPn1 z*5(0r4rf`)y0M)$oUZ?{*6)~5&a==lQhcn)R7+M;e53;c9b--m zgb_Kn6z`_C5ehF94UJ|}y?^!bg07i4Xx^!Qep-E$+1b4A%q6{aqre;cIa&BEXSDr! zR`@tBy4HVVY@DGf>P5$_wdn(UK`1ACA~ddx6g^z4yBgb$DVAgIWlz%JibBp3HY;pu zZS!ip#Y5aJGT2cYAUg=HLorS%@R-DyI=>qXmyK>-R(k&o(baN)WfDG3I0euiizXj3 z_hBqe2PujhuvqMKO@$ea=8H&vzujOlZXo-RRGv`I(fS>pKwUj*PzyL=te{qDDwsox-N(+ zab)Mt-n7cj#14IZP0qFfxo%xgnm*}aOffRC=N*JEP^a3OVVVaQH3l2SI9OMc+2$AH zGw2f04n*J$7GeL{qPV7TFZId1C}bJr(?%a z>~q7bWT(YoWP+XHH?dtTO`-&BmhCCqwr$(CPuaF@+qP}n_9@%8ty^zTOvKDYf9SY>B6H_{R_-;d zF&;z2hS)u;dI%S0Vn>F5s@G?uXTwvI$pB`}k$M*R!Pv{U833J-PAS2z#n09 z^y-D^1YfQ%7Q0RA=GPqT^p4BBGr@wZ^Idc>%F?CWrR>vC8W=|?+mr(vXA`4p^h!La z+#{Pj(vLBa{c_up&^}}S&Iy-IG<9<@O!ZBD?LNRBe(1c^H+e@R1xA9x(mMGss8{FVyKWxK*wlZQN-(HyAlqDwGjaH27 zb9}(M{EM*H!2>6YH{m&1Yh0?}p&Re(pSc?4x+{PEm+R9UX{r(4R7Kwo6q*9hrgVKK zj4)-UUY!hm{$Q|FkIu#!v%%tl%<&2=sp!SAlRpO7;0m=5(?UK4;~xlgecMh-0#uq3 z_(bhys{>rMGCK-#;c58pFEErC)e#K8FEOq_E3dxS&nZ%~w5T>m7LSVc3E*&9L}E0Z zbSpp;Qs(OHZO`0Wj9?E~9&yH%7&xKID##wwXTFb;UYA$lVy$FU8*glr-)Q3+pWz&Xv)o7euMYa|7E(KsLcFx9DWVdu&FkDq;Hr-2Cr{qABHiQjl9BuyWI zjNIxDS~J$3)<@7z=mepIKoKZ?yMz&`FywCh25kDicU=%ER4>o^B#Ca?iPNgaT9u z1YknbKZcA1RJl&9A%H~!hv(E|^z#!i9f46C5b@4BORHV z(p^!7A=q&g;aXgR@@P^dpkULBtlHt$9C>}Rwk*m6O`EyRV&A8v8QF?c;-L<=3TW#? z9USc@Q}fV090cXA(B|JI!CUAU=_DYXcHUb&_Zuq@@;=KduRPNqHHPleT~Y`Q5Rb7=qB<|hsp@-J4Y#Ciat;UV01 z*3{Sb2662PRA!sVu}yNVdh-D32HjbuO`E{%jxUZ}GVl3d5z13V57xigtl%X2inn#( z5CMKdtO8O8#@zO0UcR5CB(&9)B$@`qiD>#}V>V_u+8&WGQKigrCOZ4U(x| z%Ci@6c{VF>6X)FuZ-Esj=pPG{xzARkE7@tAxe;@M&oq|WYgo+5EW!C`AUT69x>_45 zFXFy3R?!;BS5o#WCy$$3ozh3GS;LB(r#zn`*y1)hjYc%Jf7TPHnimFx$yb$v;)p9r zcOdvNB5b+dXEf9ecXWs0+hJ5>)~@^DDIA)$NES+INlj(kM-MZrABFv|nG}3Q)grKO zjqr*2VBF91RIK>ygvOn+JrYx!v2@IrrFMyu`g8kLzhQe)I1|Av)zWrJrSM70%XP;d zrxsPu37Ttn4swv`t5LR+ILVFE?h`JhmZZLx7qe7h99d`dn3WV!T%kh38pLybs<jHY=i!{BK;RsvO^g-b)cj92pve>o+-XTA6qD29sc3; z=8|!=HwEPvAOJ2fa36za%tNTdJ0pF=Q1&Al?X8YkZf(b9InNLt9yyLHQT%i12hCn> zt={g@zd6^_!5InaH@MxWxQskkalPb; ze0AK%O(~Syo%aQKd@nOCr|vQqzUu|fI-ku>&e@f+8g1U4UFc{7~~&=qU4@HU!L z1*57hv1#VoG~MS{XAG_zE^l33!D1O#F!h^8&uz5Sl{b479ld4wRQ5^>>ov}{UPx6J zuh3T-b|2KI%k)CpkX*%%gkt=7MaF4tJZEpl$aTfZ2wM@nrpOLtqTG71DsaLVaBOWw z7KCh;G1FsA3<_oF@=C_M(5P7U`>}=Gn>H+O>xll^!8oS*Z(Vk;6Hkdx3PW68iNc_& zM!VFAx>PmzY>0YAI+@G_H&ueX|5dFr_sOg{jNrUG8J)H?=c~*hF7-rX_1lCR$B|bW z&Jqdr&qv%NXj&S2XT3MNm7VmMUTSeP;lQU_!a3kp?y6Wn9=~tzGxU16=?RK$Fw;Ay z-)X6qt9G`nva8;u%p@qRJe6k$buU|UtuT{>FReCyA?PaNS63_78$LzB{zplWJ$$uC$?6ozVS^>rS#=*xy}iBv zo%inVEZc4!Uq3xvKQB^`LUSJhv)r%s-x_Gp{z*G@`swKn-5-6=vdswe0QnyDX>&RN z+~h61*!j?{xV^r*;>fk$D%>f)jrZsVA;>?aYhc5CWO3n$S3gTM1edBMc z3HK@tGzWg?)%h&ri)2BH5+=3{BC2l-xmP1ays=T`MP$<2ggkgMdw6gxK@9fwe%mN0 zGVN1|vqHtvWomy6qnzqz`E3iwMzM;(d_Nu9gq~hE28vug-U_e&>z^uTg%SEIqqpze zBfLpEPs*vL*&Sa}UEkOyfAebkJ1FtvKEnGaNbi0fe`rTmZaR?0bz=c=f_cV3w|!d~ z?v4pQDb|~LeD{v8@Ly~ai};9!ucU!ByejJLj@*4bGYU`K9|QxQfLu?Kf;z~-IF9iF zbnGYm-HoC9fY2|zP7aMgE3Q;63cS)EB+KaU>d}kyn&=xKJQU2-SziR~yi;88pB2wn z;Hw_nH*TEPp4$@)s90g%Mzw{#SWzVfWfF5(B=wA>dS0x+5N#vZrUTj5e5*_9Qu53bz%Ai*rSVfUy%^N-g)ZQ zhMeg3)m?L<%G{gNhC1ma6K>>Y&=fXH(k{iskDV-CHU6UJ^0@CzmLz|*>q~@p2y-qi zamABj3;j*TR(yOyF_-mzBzMF03HZYgVGtk$C~nebeM8CUVoN&a$bZ0Ofm|Xge*QO8 zS^P+q4Pv!hK`(1#ZK-;a;6OXZq6H&;Q05ffsT5%Y19yr3>SD@kbE9XV9L9)h?oH*7 z?N=pLN;gmIeoU!Ztvoa;8hgKYO(&1uusE~r}cr- zkoN4$Vv~JULfE~6cgXZq zAQH^1giNc8&Nv7J{=>yOG@Fm#F2^@0RP5%r3sLm`{6xVYNBk`H!FFcPFT=pA63%jMD&K`vW z4by(8MWX^E+B%oW(sI_NEAzu!NMHnHHxS>_2^Q@Q_%N*^Q&p?E%w8bcBUnZF#OKWt%_#;?NYmlok)ro@)BC9Moy<3YMK)AMge3i}^U=%$?eZW)cjCWQcwVhGZVB%bBLF$bNa_ll$mi8x6lBksO=Rulp}%O@ z5}YQ_B^Ct)*b>?4QsGF{0hl*O^@}q@O#@>8#n;?IqcJ4Q>ee2??3T95N$rI>9bFY6 z>!58SCc7iD3!o16ouOr8pX2OySP0V#_1Wb%$2<`thJt?1S8I76+wEs+6;C-P>n-9S zifU>JwiSlW82EUrR-_0nV+v{KWfyoGnwdZs1;~q6wd73S@#0rE-r^YaoOfy~IBKBS zO%qobURO$ICOFCurZXETx3U!eX6G}_^LI{LTPTIjLAy=)?|5pO zxM#zlwOmp7ytrlnOJd}% zu<;~5#Zi|wv%DlUM@YG*Lv0$l>!P&rBRdnHl9}rC*c-BqgxR;~VZhf7^ zYcW3kyo7K>NAR)!y7ijDf_D_(cD_aCgLlteJC`(-yB*s_#9@1`(_{9|qHyzhm6=+? zEKOwBolRIthb+}>2ujg1nv#(JJ~}soX|Sgqs;*!>8z+G~7dJO-<^gKn381BtlCfX5 zLu}X~>xV=mV{4D&COAlgiHU5E<`V;bGBin}-V^2C&+PVD^f(r!cJ!8K#nEKntMJ%O z0^oJio)YI4R@H}Hs*^WrF`g@-Tl9O8U{3~p()w#Fp>H_5FUW3<=G)N&mdSSBjGmvo zNHm7_JL`7}i8TgT2N!9p+g9v4iqJq$yf~ysGMU-ufqci#fR}x8_Lc>CG)}D)$#g>9 z=oogGl}o&`Hn1<};o<*bo_meeB6rrUdIA_j9#B;WXPJ`AQ7QdNQYB02A!VUR@Gb9h z)YBI`$}U_UQc%R!>4OLFlzP+SayPzuRiDQtntmG?u7vTS=ZX+K_TyPx-lor#ELQ^(rTZ{zJs)z{ z3BnYj1}zGzMss6H>Z4?lA`5r2;0g?UOSLeja%W$gCD{?)fd3p|J2@6$&nnMF)3U#u zoABkhf>JxVN_$yFSUVL3!75Ji1GN|i^VlC+KNf;vkLzyR=UeiX&u^Gtm?tsqEg{JB zKvUSbOKFsIU7YSAzxdx;Dj=X44?`!zm7ek$Cn`Oie&E&QyZ87v4=#%eP1du90VQ=$ zw+u%rGCA%TB^8R!J0~5S@pnW!{FC?fegrc>Qq*8F6q2_gp)WmG8>6AVClz)0=%wmZ z>&F0_SFK8g{qC@0|GrQC0c5I^hWl?aGvohALdVF=^nYdM?q7TIB{Tfi1In8}D=nXa zCgu|$MBJ)&8jiu-LUx@$h}En2r^{Qs6Qkn|I15kqP_hG$T=IqNk2Jl)2cC3*02ZLK z+Bj(a97)`Rl&}%3O-lO)k5{k1?(4xtNyz*QAJU%afCg z2^|j#9-pDN#vbJH)s_nVgO3Iqu5&m_MBw*5>BlC@_s6coV(=tn+TtKBxcsd3W} z@rbdS7R7u1_Ldfqh51Pn4)1^qavfh(K zEFdhX(y?M*x$TS~jqjcjmXm?`5#2z07}(ym`l^FtlDkl6`rsNBlNve?MwU>J8dyodGW2HkRk|KBof#~sUkG68G>BHx2g%+o~3=h|6 zDb{JU9Gx8=*K%8N7jNG}olF-}b`f5UpJhCFy&PW!D$=Zm0JKmPH@?tU8$WK1?TvT0UNycHI)zDG{y5lW~{ z&^ckUEKc+fB%TXhO|}Ye-CWe!^Ccl;VGs{G@ix(>R1sBz<)YYZXB(7xZ@N|$`sch4 zswAT|WTb9TbJD(VUpE~0)7V`|FXu>DT)s$cQhjzh(S_*(k7^6P5Wch`jylm@0>-FGyqxc#Jv~m^S1d34j z*XPl&mk_s#{>MZ_sA*QyE7&ImITQgtOE8KT4FJTTYG6Uk{?0lm6uurYVIxZ%GE*cTAIB31YNEaK87pefm*02wUVPuCUSHNXMqDUK9WoOj@ z9SQYqe6|st4APCG&=%|EOBAnJ-ayc}ar7(t8kPDFG#`RxQzL2 z9eR)5x!XATi3a|Ry4Yi%sU)Nl+F6p_`$zhEE^CI>3LC^=6c9+fj!mhaU7e0wto257FuBwg`$r^@MJcEa%7W98 zARViju~Ut+WrUzX9ce*rf$Dh-y9xnkm5tRj89BX-bQA$_9UvwQ%4XDEKKSjCuy44R z=fs^lW)mk};M_|Aw=Eo@VHN=7V2{ChonxO~kp;<^+;#$(G?tvhA$r3IA7SFCQ)p|o z-OO~t=B4QAtebc+Li<5|OP1K6hmzeDqhwxn0QMo8XaG@AHr7BL)c(GB(cxQ*qFHw_ z=kq6Qz#JHkLd#{cT2~&bJ)W~$Zk~%HDD8{kz_LrZ686TPEK)tDX?D~8R67di6x#+Z z!)QbTp3GzIU+b%Gp>r)xVm$>h z!LJkbUO>w#fKSiFAFoatgNpA8wUD)+N<%D zbh;k;pXpujw|`J5vJzzSKe$C&%BmgE_m|KQQ!bG}Kq#N^wQO8B@5<_r%1(gI?HHcG z?{P0)gkk&ZUQ#t7DTYN}1q~w5HY1&be^zDgj^B(}K0}aAw;B*hX(C>s1-mqU8XY_Y z?%AE4hZQr{oMT(5!Pnrirv^7e#6#pzx9^%~&QjPd(x~R49=On`rikhaFIi&=t?Gl0 zxw-w65zMZhx-jO2Z*9ONQ&L;0Pm6P8#mf4BXz3TguMs@KmM%9+M#WYbKTVdw_qJDdaoO8fyx)QSwd zJcz+$Pl56sSFqN{z*IJa*RZqL|Aru3 zM8h12rdTR_VlYbbckvkCMmkYE&wrdJUdi{R@LIabFR=Idy1T>DbZ`wXVh9*bR=uh3`$$zm z3+D_u!=N*pkpqX+8(Qy1p&P7POqi<`6%W`_IW{f*?D_H#6cINfE{NFUYZUe0uwD4s zc9E>aKI$Sj>ixM@_U&n6Sl#jReY^HeUO1@!@3P$g$g;)syE68F_Mc0?Lg9zD-~RJ= zP4&30EsXfzsgU2)pLUt~R(!BdlA{EUDXshWy&1}ggw$&z#LwHC7UKC~jb07zFV6m< zFTS*>w5iK9=Y#v!%W(|^g|QCem&HM(fii_-F{ko zod9kNjL!ZVwse2TRJWaf4O?_5v`3o9UxY>ASk^aaVQ{}?!Vk&U-x?c~m41}Z#7bZ9 zg6l?ae{D+5tMhzSN{-QA^ZhWEyPK>} ze7@x_=$7Wbbk?=^eBUFzy=tyvr7c6+`T&emqc?fC3-;>O@-sD#)TRbtSR)Yy!QZ9j z@a*Xr$I^bvWyvU>v&#+Rxz=agVc5G%O)Afm#wRh*z-6U&-M_-3rJVri2LP5N4M>lv za?&!f0lo2EZ|g?w*dz1>r7nO_n`)h#qkc2f`zueKowYizdprZe13fjF%Y{ErHO0C8 zSsCu_a-hTV&|PoGE0wc1nc5sn{3~LU`%i4B)`ZSgWc=XQ_X{1xEv|cR(JZ6J_i09Y zGEAVgs^qDA*vtf_MeXPl;#IHLXey-;VfIw>OAH`2T(pat?sj1nifSLD$1?5RO&EEbm1_=yC5{)k-~dTO$E867mchr7!YP$`bV0I1+=TAld9?l zE2!tF7RBlppw%Cp1aQGbn0K%UD98<7D8v=!R$o7}9iAYju};KpQ>+d+Im$F%|3 zgy-DI;+#%tFtiS%2T&iV)g%j>&Q~Ql2Wmw$Af|e?%-7Ty{41v3G4T&0e&hqr? z^L#fD{uEH3!alKKy|ac^eXX*C>S$C9wXon#8?DWOQ8ie5bmr7qll!wUK(&imMVT5! zlsG~trQnOXa5#m1z_2uM5!QOF+O3e}+oNK@p{rQ6JnYmr26caIT{U<=&Gh z+c$oOY;q+C+}q9v4y*H0E9A%n@$Vz|lEx<6($3}w3+7`{{=fpnW~o0hx^vjA*gq5W zwz|lUYqt1YOn3LA1u=NEiV0x2RMcJLP)WW%caZR~t~7QPYNg(*kqyjFwUjdQ5h5-L zJH%3G&tNn+r4d3>x>c`6%U*MyS5s2 zo7*Wb#ZN}HT7~4{&|she30j4oL_9x{fA?bPx`Ka+ywZ9#oaqGJ#P9S=D?RR8B7ac1 z=gRX&+R@x8gQ)ky*+5*DTFdmhcquR0IK#v$JSm2{)*zr@}e zOPxxPAj^qSGBnd6OcN^>fkVrXuHjk`roH7}F1}fJflClik4CR99^1Y|tN;=7JKfaU z+DDH6E9J7*V5t`l;FN=*+QD|CN%eh-K3G8{HHw5{Cma{gqQyB1+y-%@vUntMRjY!L zo61pX zY{Qtlkbl3re_Mo4M?dHq$q7>~0z>uV+E6`q50|3lWM2lV_sE1i+}1Mjtj5$1oui)% zsdV^8{j~y>p8-tfyEig%&OhLnG;+m#M6X=@^x3#J2`e9Kx4ob~xFmnOa*d+aRN1wA zYgNvy$VT|SYKv=xQbfT><-Pv6L`<|Ofr2a`xn{g`vBmz$V}W)d zuM3<^Vr4AjDHk_x8k4t^LV;JBYGdXptShzIa9SFB!`A^ zWQzp!vo*8;5`uBPs<9F(*5hspbJt%Z&8}0AkI@BGv@`BWqx4q%WP$4$9DXXWSbiss zU!H^{K*~7i#J+wt#rZkpUyFO*^4OJtF~jvd7j#4&Bm}a~1Gi}W%=Lss2)mlYS$D7Z z2&zz;Bm3QEoX}y*19>!BG91a6$v9LI!f4jv6*?IV^tIWW#yz+!5qi?5W`+N@<$ex@ zZS$KN+#zF(^kKjg%SPXPe-=V~8+!dpA$1#w`&&=oz?MLmlvD*NnaF_sIIL4uV+3Sn zovibS-;NF!;Q8UA`67}yj`U=+Yi{JGXY*|fv=rJIk1U%T zSp6i2$+|BjhXiher9b;$<53Do#NMTYdRBUlu_tCbON(W0lUO;o5@A)%Onp5QI|n=i z$6zv0F_*f3T7LXX!zFh)-%zQ*9@QQ&*w_6oyfb%);9P1fMZ7Czc^ZG9m1wVFNcMN- zJr*RL!#E}2_Co|V7-^1816i+t)i)7q3HzVP-E1ks3sU|hW^mWAfyW3D9_x*Dh8R$!EKZ=j$S{iI08XvtE(t!?z$X+WIpZ9Q&GY$vd0naTzFF%u3?B286hG%e*wlRxA zp6d?Lip5kGQhg(nBNEvx1~vykFu5}Ll3Y+oFe3vFz9iNUFKvz_5868F<+tam)xxEk zgK%^H*+muG+}unR{K}YTRaFqYt{H6%PLs46|HXl~&*3=_EGN9(fo1lGFc*-6#uIaU zR8z7@XT22WVUvqkB7gWkSR)`M%Uo<^bg~%iWVHGIobqP}Y^=FO8k|u;ht_)#{EgZl z15ZuI`mY63qdV?&9GL3+6UM#ZPUW<^VA1G3g6?CNjkq?V_MYxOr(B>r23 z)>xpGD69Q9WbvE~C#u!@FZ+A8K1;!cI5yh@UW{VsbXcN!oy~}Rg-=%$ei2CfZsE`Y zFTDiKMDZdi$Z;3?ETEl?i0c8%dEn|-AgDebYYJ|9Fw($a;eGnc% zJm=ZTKjN9;YkSq)O)a@FWZI9{uG(?Mo?8+rE~ti>te8*Oa=<(0n@}fTaZW!ls_`Y# zgL;!b5xB7%n49G@te2F8-!UoL_S>~Bm+!mx;*+vD!3DPIKu9j|MDrq5VFU537QUs$ z{xKeRY6TtpkapGJY!67sc|OFK2W#q;DO57X!4Ik)_N#PI zv};yF#2^cLzZwy^AA^ljY#$;zs#?;iihX-q%C7gTXFj4H^xww!Q)=JiYtojU zmCY%sfcC%pO8EapN&IJdmbmplny+&(4b&&pf2SgUHuzm+P0)I;)x!Y-Viar?4eSDtf@>z7D@HUnM zBN!$<_2J}ibMGX)(?t|{Bc!YfWZKQ9@~IJC<_M#6D1%PAX^mX@Y*s7mlL5k^vDW1EwzHg|MGl&y8GANj?#6K zCHa20(4S@Ne3O$IVT|thY9}#BbEW(I%-+Wyr7A!&9X-6{X6pLx7y&J4DC~j7P5G1T zKO{c`6arx!Q`e*hs9zNj1i|ZPn&n(|8sKJM;n85pl{b2MehT~tk}x>()G8@p3qOsr ze=~6(kBrV$^UsIDB>E2|VG-n1-1rMgWc+}geGT761^ywu&4QJsKhk3WWCMz9a_cG^ z>DctV0A#)kuP|2@E~K${rw7QgeHGa0**h6Hn0@HB`EY(hHeJpr$abP!efRg6-lGaE ztn7k@8=%6%x#SLT1bl0o=c)5GWr7fpfzFBz5G6k@qEjfO zZUoeU!z@m36_TzUzv_5Z#Y{s+FA(VR@%w|u>!=kSo~;W1U9p=b92;M@AYN>}8Y`rNohda&;TFp$Clo+zfar>|7$B`i`5_ey`K4Ev2udp z)$a+uPOe{OqN%_Rn}%FF9fy70#8T;16 z13p15`Eo4H5hMbC2oDDi={<+RU6qH5y$;M5=G)w%yR1@)jI@O}4Dv|kW)l|p0LuQ? zP20#9Q!CQQHo$^F(yyhC7l}k#22^7GLfBmDM2FWvGAPKmFDbzzor33|?L-phQx9Ua zCUQ{HvlN1Ip?opY7ERr5&&WSm09V;a?T0R@i`!Q3Dt=^`2K;wezEn+>!kDq*3_3*C z*MN_1ec%@e>vh<;7yG_Ka%lQ~3I?TGfjJFVR{H6LN=ozbG6+jU(w#}^kiWC+ds&L2 zE3dd(R4T_iakesWM~e4DttPq@h)5qE9PmsZ=YIPbUy}EDeG#uedAhkQJh%=7iv!D$ zU)hiqFpJG#S**e(=}3v43eVl9zDe|AgzJBVDTG|#RfF?KuH_}l?>t1Bf!w4~L?0Kg zd6n%!Dh%m@H0t{npr33MLZhicqh+r1jb5?mxt0zGMTI18%#4l~N6)m$^}h9q4hefn zyUCt-Wp1K9c38V>iGNI7w9b6ADMX$p^1m38@PrnloDou_2>4;vDih%J6hQ+)sV1+Zlg;FswCF~ltKYKuM7=5{MGs9&ZydYP}K z<+ZN{<7%?hp>!ms=lO@H@R@-zK`H8zu~?BHt^0|T{)bS{ zO2i#jI-k2eUJ0{+b3&?qKc>D>S7q#|S?(>_fQaiO*}&P>)4QI52ZlVb*T{1~3)KhLfj* zIYO&Rp7zEA>8j@Cd;W4x)JwN{BE6?`Xhb$fJjFZWp|;mfK?3wR5ZELxexC+$y>bFI z2hhc^C8^990FUn~8O`@eGF@O`dwWL=pe#!=I21pr;eVERC$mpdf~LM~QWup^L14|w zF&4Mk{*J6j|5R>B5&kgfL<322H``N&OMJw+Q#E|kY)i+h_A`Y2Wt8OKGW`Q2|A^*W zTOXqm=F}42JK>dJtuF|_V1Gny2EfJuo}+m?e%<*I=37z(F$f`KfrV}`w$ z*Gqj&b^acD4INK!Tt=+th!S-&Q_ZlZj=K8lLpT8?IIH!JHdhpe2&VXSWz`Z>)E+OC zkCsgT4}`TS?{UOxg6KkgD=%N*tJENoJ$9m5uYf)KQjEb?l2``r zb7c=Z3I0ww-9W~idNbX=aY|X(uJl-^Tbxg8Fp|C@1JcWZ4P5*2kXAa!+0v#QGAkZ% z2$#oak?lh)O^+8y+lqlsqhlE~5uY70DGb&>0eG^bou+>Bt??g4`qSLj8vV$wcu_nW zT{G=Yn|>S#30^c0-QP>2iWyR7dt@YvI2u>lR5S5D^NFr@Bx%cc##SlQQTxb$f!{k3 z7Ki{JSFim$CtMe-=35&CIl*gDP93>743FhX1@1rQA-Ml28iAn7pi2cfl?2+2{(z`3JO2uD}ui zA4STijsTP(?z8VF`7QL)zW6JsN^w`=v-k>})CT(RP_k5!R+f>tEg6?5;vG zyqnL6#2u4GnM$3d75WoXi89{dlub>#K<>FHug<^Vf@c6RO30E6i(cqPeoyzhEELu0 z^%fjz5L4ycz8!k3ou@jRucfSDRP2KWezKYO#o2sqXFmT$N%Z3sLi{(GndyHt0Fq+z{}Y_+1hoX~za$G$#I+8h7wlf;ygJ`;xcULZeh{ zz$1rpLHqyif@!}FcYiZ={XA{lFU&dsNK!Y~d2OUXi4TU;D7@CDf? z`QKfp5G-Z>wv{AMy)-CS!2PV9O}}@`W3*}uTSlB0nzVMEV5MD@^@<0h46~R2qu$T! zd%Yt1L`~VYl_nV=UBjr7pi|n9)&Xj_Be|I9*t%;dK>Fzs(kjAFLIo(tg2P@l3ZvvU zt)BI-Ue&VftJu=Buh1ju@CgB9VQrx}sFiaADpO zATnl2WMuh@82DUP?7x@#M!7Kwr#KvN--#XQ9*Ol&MHh$&kO3jelU;~lPmmbg6Ci{i zw67s40YG9}!}+AUj7SbTB@s}qNhkZTBSet)gzGE~!;tvZ#!HbFBD~0ASP~>Ri7{oW zFB$h6rDk1uSU+cGB;tW-;c-YxS1)ZvkP!k^jIWkjV_fdRqbOU-Y3N1K*EkGNm(an< z=%$oDqlQ_de3Z8pxJ3dtonUvm^Da=Plrg4r&1)Uvk+r*lh-~wNj^_J$w3sW$mgf)B z$Hy8l1*3II5qCN7e;bS>rUrkIMyRqIU|KfO>sFC5Xtsun&}r&9-)&wEZ?4=e2RDX< zrjsmIJD^6TtITn0z)3(Ujzl#@PH!oQE7&tVMs!nSHpjwg344NXe4Lqfs}X`gi9B(oBx6z z)@5wwP{f{{g91ru4i`qkR{FON5=AO_uHJ*|XpQG0)o`>tN=sQWc8M~a_J^2p+8bH< z4iETZ5Wm=(zD{Fh8hAD$>eRm(*9AN2BLSpgaif9 z&Prr%(;&jeQ);i$VN(nMT2l8+${XZ*_-a|tWy*WoqhCnP8l>IyF%0+gjWSs^;H-yF zP}%+0TX%ec*TVrKEa~5=geFRYu$Tv`(!TgyHj)xaDC!9*4NsfELvPxhgJv@rTRco^ zsY)RJf>5uw&~0fbkY_-g59xf~VtRC08DM88*W$37#qMi+7)R^e&1rzb`~&v>`#qfW zpB*zTuQmd$GZBVXyq#4hVGe@tdRk371HY2$qwB;RGzj6-#na%Az=6y56w<5x-;Ho>*ExK_w+!=^eB>WVZ?80*x{p-1 zO$9@Crw4?}13UW77X&W2b}J#0pCb6Z8JOsnQporh&I5#6M~kq-s@R*vzk-_@3q^9^ z#)za!MVu-6Ah_Z&mOKQf*V+mJr?c3S*R(Py--<+5WNcaf!w?!lD)k0ux9)oiMn-Ek znG2+stspA7?y=Q5$yy73J@Z2uO&FP*U>l3E8r9b5#HlP4D<{g_{R{=R(#4z6brxpI zBBKEpvXxFadLzr2Bda4HQMl})*<=kmL|El25YopPh)Si{>NOv){a$Ib4rc=Wz^=O? zX3A5BW(Imk`#C_?Nk*BsNt#a4)^gdhyKTT5#I$csW@+3z_!P8~-q-h#schM|Qr|}m zYMYffm*2aLL(C(|laj}kDiSczvz}_Ji18mh>!?kxp^K6Ix22JS(fB=b!SqskEmz=A z+&AA&RQ)-KW>?&54 zm(?KG_qac*xdd}u5FK;jI}#3oF`bKp_F4uM^21H+0HYx#s&Mb_Glq8jE%*M~9|t4j z+6C3Dqyv%=@mnT426-T?dV)OR=4~}1+*z|fkeF(Bx(Ax(b-JW5ai$&b$t}M2h?TcI zK(X6I`6GJhF!pWnN$ICjhZ<^k5c|?)E<4~^4GG+_20~( zvs89a&%I@!Bw&Z;!S-xhAmb9Lu>mD#F9w}50+q6>rCGunfk-R_4+{olz0(CA8_8>olA zO3qo>I&+Xz8t?(_+M~c{@?3=Z<3a$vbIVISw7Cq~-UaaHS6<9q$`VVssG;!cit!=h z2C#*tP7`5Dec=3KQf}+s{uSu>E*P8^@J-*7_uYy@0nXA@j+H)8XQ9x%`hMohYbQ&P zSM`OjeBSOGfhMUVQwTuBY_KcJbD$hehfu^gw~**-(}DsdHejdJUL&U6%1+XzzxUJ7 zD4qM-!s;&VR!tqD${XddYd?4Uopep7jJ6B8~y$E}=eS2)|?G=UC3AAKl?d;3h)JcV2w-C?*| zc-SI)RBURaew0U@)<;FV-6kH@bqsISCXa25@wfEUUI{)0)d!D8GaJ@sw0;`eqq)dd zew(bMVV@zCvj#lK1SeS_SHgmgN0P|Oc-^3~eitChMcB149c`F=Rx{b2Hs_5;W`Pig z2r!8Q*jbMsbIJLQXi(p=5G^WTK6{!cjHOiWvQ8&K6ho)j{!v{>$|%pnSHrFOa0=?d zR0^y9xZzIue z1k04#-xiRPyxc;}V)t_J91)GpRpRX7AZ3O(mM^&a+*jO9OR$>wcLKZQi2xCRhh{i5@-KjAsaGPyoBAS{w z10jlHw!q5Tf`?mCgOA#4_13a^20??cu}(=xvCgXKe*n5pStjq?vcB^<>M85Gd3c2W z>D01%>%op*;lIP&#mrCWryeRRaf0KM8kWwQH|j9br2s%<{%GQyg}}{*iO0}tgx_CN z0lKrV4>1|iP47(V^arT*0Kuc^V&d7KrxQD+!vJZEdWP+82A92fS|9C|1u_4}q?vXD zz%&vcY8=5dbcT*_T$nT}cDGpfOIVgk89nWZkvZQ^ah`1}gqD)lt8Nrs&aM0A&9Z$S zNo4QB+hBqX(@IySwmVpLGFCoaro3re`5c*qMAgasL@1vzb|@}qKet(B`uUo)jO#6P zfk6-*M77sm2gX>Rb-e*JUF#W5RTf6F{(`_q<@(0O*!b9?s&6>+P@MY0A_O?~am}QD zo4dA8YBP`4n@BPvI7O(!T$~V(Ir1~LJx00Wu*at<(FXQ=2-Kh4qYlr(0u0>x;NjiU-OEJq%e|S{ck~J zWXzTDnZdK_PUt95mKZ_H?rmv|eW=@vpJhQl+*?hpTP5bh>m^$ij4q3sa#U|M4OzsDT<) z25_(3xTcV|Xp#$QX7n>-Db2MADUs^E5hMr>3#**v^3&-P&3z@AO{{-n@iY_;9Ix>l zwtNL`!KKp5-IzM*o-D0WhEtm!P?r`C;Qph?vE%VQEXo&EopzdrpCXj1t!2^lYWW> z%Nq&%Bx`}LRQBx_>-R#Yq?wYoC;cO3>u%~`Jls?X!UU#MaIZ{qFN5ftEwnz_YCfvd zknh2AKnaj+2c5_0av`>_w5L61py^{y6(F4yQCn8#(MpfIam2P_l-iJma{Byjh>*?q zPwLCoKL{0}B$i56JjLe`Fz`Gx{kF7|HpFyC>_JJ*=Sa2vn(>>zE&E(f{E4NECC8ze z2&8zREDI)OGie0B3iKqmyd?ROTu&Wa?vl08qfvx_$b5|PIl$1;Qh#YnE>G3CD&~*S zOpn_&YGkddjCu){bYgZZH9SiA_KISx*jYq|47C?(&$CTXj+QohGE=1gY7ZFU+Rc{o zKTOg?cycccvQ0U$ry{(hUB%@c*q-J}5-q!lSU@&S2vRN-K@5~pcgF5zG!00`!aMIz z2y`!xMx>At1Nj;1QUe+0y$8d?=O3~%$_UW5#m1LSg`?xYQcix+D_@O->_sIot|V>i z0#)IxKRIlai{i;VzW)AO!)TPAZpjbMgv|5jLS1iU_XG3MG4)tio@qW@6uyiG4&L#z zDC{s-Y@llnVb}KrmcR{@=#wJl=fDpN!@TNSuqSWy@XHymUa1Q9LJ3O5QR=ZqIUSir zQAJEVtFUDk@^0%Z9;y790hVOPs&ro{W=!l8R508`ZT1ei4w~nsDB8`H>j$ZOpE{|ule$&Rw$86%~H9fJA4xVlE>zk_R+OV zxEWLOI}}yi8BHYcU7~ZB=py4hNu&H&3dVEHKXSy^{D1VO^fuPXs+#&v`PP>C3%b8< z)?k;Ot7u`$lQD}dMHY**)O?C(v@LWckgbyG6Np^JTt?yRY4p^~c(&YBz!BQU-t4E1 zni(8WMyju{4-;2j${i6+tHgFE5KE zt`!UKezT^)gqQT$1KKTZKfxSo%e-M?&3v#|jW;JxS4b_EtEv-o ziMq2YtEOFGz~Ks`QFS!p7D2cAZI`cl*uMsWC4{9fiVjVSnVXh0H{Qe{@0&Dvb+6)e zPvypnyqqL^UKDLL5|QIPI_u9Ft_%iy6H%#t5%Grvi6LtiSPvPu3sp~|vYSS=QSjrLURdXRerB}4fuEj-ErTcS`#`Do?+ zovd;Owuk8YHu#)eRir|VCD-<&lFa^(o#j6$}7JiQOaW@7FRJ3CAisGk>;rXQu>hTC}?fl)iYa>s%Fae|Hx zHJ)<{51-A%vOK2~o*Rk7h5HKVH8_GBa1tNrr3}fS;v*+bb&g><)3j_AhPbOt@9SeT zT%Vh`AW}0fGHfN7g|n`)%+f*l`#!c!_B~H6CVYr zDcfgffy*NQrNKsj|37K4|Kh$o30Lr_K&mkOp{uyzrrVt+PLn^O_j|n@+@6w!zR_kO zHt(ecKXi)h4;ThtAUbW+k~JgEg8yvLG zn{!NhW%pqVbCgFlO$-#i>54-w?<`!|SkEED1@z@`kmz`)I;`cS<55SIV`36(?m8$8 zpC-CqBe9WS&PTg~M?z3J3CH+ZTteAFa(S>jkyteG3_9!bX2&4|X1h*up*ki^LNvj5 zw5?5*xpEPD>*iLBc5s*>{xJziGU>*-Cy_s~2nNUb4wkBhdkNq|ApSM~}(1OPt zFC5!p6@l-|3i;OLCPdgji5>Fi;lV>+o($96lRod zeG743(-iG@vRh*q$~PI`KnXZ0>(f)hPDkAi$O!NcnUdJag*J6TD)w462m zWf#vuo9_xOVlkEqmQPWpqbL=cda*3gvsxL6Yd*6iO%hsBi>!xtk9VuK?5Xzjr&=^G zpE%S$RIbp6xEUS@hcBl>~-SvA>%HK2K4oZ2E* zPg2>4h5YF-`RMPB`O!ZwZ?f6)kW^e$Cn%K?v@lm+1OJkIeA4>k4({16En@X&5s@6+ zoC}CpVdeQl;lI72J-TQWTST^-T}(LxEw1Y83m-IH*R)*Iji8R|mwh8BKK9PyGpQbR zqnj)^q&hXTlD}NeS~i7d35LASbuc>1>d=t_Ao{nBf&SA%lmJbz(C+eqDrI|j3M)6Z zKnj$wF;OQvAHE?%O*fh|($~K_cHOJWnNC`gr5JSS7S(zFsK1XFc{D5H;@cc(xRMp$3C5T$t7q=B{=kNpe1Nxd0P zT}iDcAu8|Spi#AWbevTMFxxqAm1X>Y4@75JKFuJ)7NKm?;tu3T> zk~g|&r8e0%LMl&IlYTzu3AVI~sYo73QtBHZca}X&n|2ZGmy>2oxoxQ5?w}bvUfcTl74TeN31iJ{Vp=q+qP^z4E(D zPRWfJR~Y_ZJx~U6+L6O>#~wR)l}pAl(yGi6W$64^GTDQ(->0>>vQOCL6M-91_nH3}oFRAF(-?8uqND6(=>U=)%ZJ;#jF>1lQi?FW35GO?lsikScn89}hFuw}>N^^KQ|Ud!7tGdbSIuFzb@r4ky*am|yXp8lEFcCX$cCC#7rPgY?;UQX$Tp zK1o8hudP#c1NHY*$D*iB-Ch2}@qMuJy62R*q>BTO#OlXE9Lc&BL&|!1bIJy9C21*g zR>!~TV~q8W`QWaOd}kDI>2y9%Tcz^D#eC=M-gF%dqJ&g^e4dvLR$w5VlR^T?$7q>6 z_CFBgVXTf=O}KA^v2S_PzhxYQpg1a%!TWlbCQQyZlZ1k)`Frt@3U7N(q^;%iQ&%m~7qU(#0Wxx5xIZ}OTGdsnaP zR}V_;(=hhgZGNWfK)twpCW{}-W#DB^EM{->bJUQ^=-SslL66L3vt~0C-<{gkmdhQX)w`6{)2z-tA$nKWj^z zjUr-PRVMtYPY_r+5P3P-<9kxnu>2^cb^Iu+IMNx?p32QYj=^g20PisITwWH)%l9nhd~(8iD`YgH2m#3*UttX-`A%m;Ffr& z1q92oqk;Zv+kxL3-@poEn??V_nVOyHe{-g0Wn%k3QV`ugemBx~_#eO95}{SiHe%tP zXwW4{yFJT)&l~mAWS{GO$9ED4QpGCOJTiPem~Pwj85*dPNdyJD06kIRqk$&QF3ucG zgy{)8`{9QB7lNHHy#cxb?`w1+O?{zSJ@%71OmfbxP~%}~ldT`U+uWGvB(J=fn%tj|-w}hO%D9+SXIHeJYe(_EAx$z&oSFe;Ey;HK$Un$p z_vu4id^yqu#It?LPo3IuBa&h-(%h(0{=P;LvaPLJKQoKAF5rWwt+XfCKP=&afgc~m z>P8_KRBI$0Js2+D(GbT&>@1$2R5zSSm|s^LMG@y8H?XSxIY)u=qVadHZ>{3Gld+n& zZ@rU(8HS3d+$_T)w`r#EF6`2>CgE3AbU4~#3u4h~1sZ=HZ!-SOxjSNh8bl5`f@LPE z2pL-Br7w%$e;#+~J&%St{3@QZaSx^y=Ee}n?YY# ztrY31sOAHNdyu!fkM9xHVAhkRdrEUaZ#mg{4W0Mm3hU^wQPB7()GhOLom1lDN=qz4 z*06=Hz@BRo;iobNholff3oac$V}&HN*pD46yQeve*Rb1*KMw;SckCFRQF|EO7$kX_ za9N0BQkg}gvbNsRJaBhiTNN?+M&j#snA$K!k8gI!c*`#hhJl+BNG0O*XCH6)vIA|Ab?wh4;9qmBjF<_ z6HE`1imTEgzB??wauMA(>mH9BJ|1Hna1G|mmZ4gbzEqH)J?FHz6w50Bo>*3(H0ewENe=PMmz zcEc=f3N3f?Jk?k<*J~5*!6MjWe)DMNse2?cUO@qd)!^SY!&E@c2%vn6ozt|V_Nq%A zYQig)3KF}T)ICj%x~ZQ_2{Hgtg)c(#vyqSonPa#LnzfCzq@uL_i!Rx67;(^AYzYze z0J7%*K~h4bm3S^m1i;}{nXV{Lg*6{;u`)!f37Fe*>1I}sLEsHlg+-`_u5`f zeBrin_fbs{HXH=LqbM{hl!`h<%}z2}W+^(aCgA3%H66Ufw*aD`4Rm)U{p5dtj0*o0 z4WkZ%BxtgjruWMy3*otm^e|`7TG6D53wzgs1AzAbWkLzFX zH1I82#x?!o+{WHVxXXJ?Tr+`y3piWr)gou*xVWA$}2} z-3N<76Xos)lG3s09X{wV-q{g~f>ouGQg0wg0z|E;NbEXm9Sd)!SRW1|3pp^Mc} zE1&?)S9x7|*J7x$P1G^xb!$r(Wx~Ga>gzXXeuw!EqOV47(VXkW04i}AJ4u5=Iz&~o ze~%pmeWn7bCyS{-)3cS`)!DrM>f@R*(UGD*Q)I)g*(x}mB@@ic!KbMAP0zLHkJQwY zbyP7(lDN5A<4oS=v(r(`VS#sBl3-oW^|^6S|Me$1b$rFQ^}J+~Q?l7btPAsO1uXQS zGuV{JzIOlpE=NQEP!Z>h$kNrS}$ta-hNihYH+ zuDr8?h>-x`w`UhpKP2-S9bBuI_g0ii|4yWUOMJ?GVKe>3XU^!j7&XT=+%0Tx7~T{{ zHhKs&e9rxATD`8u`tL#2dMF(OdA>}EXB;LNOd7@st!+INUg1Ik_AZrYUKM@%Nn)4! zWP@#oBT)q?$FQe;0;nsMv%vmyReL~L=i+TGfp&l2(4txS)#y^>QjMOh$)g$205OuN zm8J%7JoQx-Eiw1+jAm}u&V(!9us8uBvp zvs;y;XQgvL53ma~AdC(irog?JVR?+Iw3REA@UNyP3^scXHm_(;>+Q-e$HfO0T>TFij7a;l=mxTsM}N(C{{$QB zDsMVx{N?ddR>kwfQ-m;mnhz9k?|(S)DAVKoL3)TP$`_ew_ip`ft|6lJ{m2ile?y@( z);CJSO-%$G?0Dk4+neb(*oB->g6f0=`wo^<5E%U$;7uuUL_<2nS!(y;nwK<`FyotE zullJV6bAA)oLxh2c1n_-3fm$gXfy5W0s$fdUr7`U;H(k{Nt2v4;I24|`Yp0uO3{V?}|e*_Jt6r;ImQv`HW`IhOVTD7oWNYkabpt=DK3>#F&#AABm zhcjdvE^A;@%6d1}GaP5#0R8Qc6~WoUrS*~fUgH1rUbr^geAE!s4enMmUt)}j8GJ@N>B z3w!BWI;=@y*q41Au{v84!l1C*8(?|cu0#L=M87nh2wYIEj??yE>oJ`Iso3WbVxCFe zQ)*!*6r3#|E2{lcm&aW=s3S4Xjj6sOL!o;QLK;EO41BFireEUhx7Q_<=z31u72Ox_ zxqwRb`cFv8yhL2Nl@(du)0VzQlW=aao25bg2TtZ4OAPH)1@9?e*MEY$c@^R_vklpFP`5I`>&zRBj z8y9zC^W9&Y4Z+g=l0Y2@414`y{arWg70I@0$+nR%Vw^DFGUj;n8|v>w#}!EX(1T-I#6t(b{Err(7R6 z82)JO1S?um52ldUcNBIVJv7@shv=zOewuMkz`iFIhJ;Zo!~b_PPIjj)hVaa?1w14k zsw}IX^!OPm1Dxdg+V5zPRdkJ=C4XC8OVDCM_4VcBr{fF{OjB(Zx_XK+_C`*^0*N`f zc|_V}*v|;q_;?Ik_^5;ZK~#5jbza2b# zA{7`p0N4+r66M#SB3P(dm}X`E&s8FINf;@XxmTW+;6)cBLGB(g8NTdCY$p()C@w3a zNp{3fhbo+-r8H8%DV@JacfhMcqydqJ1cpQmh9T0mAeEJgUir=c^jsV`5)EwpoU2es zU8KiA+te8h-bN(B&}%=r{R^{@MQJkUZ>|)r9K0}uQ#-eQvD3z&<#$hpzu-(kp;$$8 z{b=*;g1~MaPe8-ED<-=y+EPwPa8l>u35%{h7hTF-aGc$S?iKi2%gici@c>^iu7Zdl zpd7<=HXpkcSc_blR`Gn;!M3Ynor1J#>ZL0R*EJtWSg2bz>~7XD77G)$Wi=2 z(uoF;k-L!54lNntN%SPg(Y@WIfOnWFR>_vT%6=};_YfW#E9_JA?$EJ2__+*l^Sv2T z3Pd%CqNwRkJrQ#0wYiK~d>iE=VQ#L#BSU+Z0C^F-nP!cbp8-Zp*!H&lEB3kz@sUjI zv!wG4z7nX~izdKv;<>*f%fz75 z+0L$f+#Fok*lnPm)QsyV$`pB9B68d-uQ$M~7H7VdDZWfDOZlv z#z^zJl`Cm}OEKDf_noT?5}X#YDTJ8OwZ!Vk)Y5Tv*z4qmaw~_D-AdlBrrCtO4!iPH zNnXig0rNqKk%P=;9ou$EU-ZsUkd62W6g~uv zpfb*Hy(}wi~|6>4#S{i zxAQi~z?+HDX@sdx=4&02FB=lphv`zHOIUaUvaw=w)wkEruoK2@IeGE}$XM*fO3jV` zH4q8c(>I3ktj{+2N4U!E_oplQRrV+i6e98{?N_hh-eKq9_$qRU zL$Hx8$}uPwj!eu3Zckac-z}WX5+qMVT%EM1sYnP7FNY@m>#q)2K5vYhy&u|bMFk|YS%XUWMG|GRu@1-Q}aU_a|kLMSOK)}ItSM;oGdl=VDX6*939i zm(2XWg4T)acU!)CX#&k@B8aBQg(VuA)rG!wgPg#2;6Of!o{@Wa^G1;s@X$j%E!pxJ zS&K|`>yAwN~5f`Z=7ihK9QU+lxb zf$iq`Oh(EXrYIv#8ZBwIrG)eBr3>lU=em{N#3B_HDP#bE}ukhyeN*$F5MIuoZ zm1pit*X;@L17d@l_T+yoGxYe}kVO;>l0qKKDj>XWj{d5i=owe3b7=HQ=S$U0jwf05uUV#wI zi3oKWdB5Pa;XDLcHYZ_0Y@i%8AXqEj3U#g{0yGlOzynx^g+*SE6nepW$8xlUg+!6M zX(@Sh!Z5s*!|i=Nqi_-h%js?`IiU@@Cr%08b6hB6)OyAD9%NlE&CxjCnSa^KUdAgf zM|hpQieJm=wq6T`M>ypjR*ZfF_{MHW!d0+%f*a=YQ+s6r9OJRY_`{RZ0Navlwi>lk zH6}hszPIPqDB%nXft&Z!0eP~t<5jC(*1CjPiK%4*a^L&Dy^O9GiMq<7w^HHArY9S%Y{bpP+!X z9`B6%7a%yo?(H~VAeTW^!V=(kU?`%e$V_l$zFM}+DdJchxahy3kcjeo-is}X!r_6;2L5Sl?e-{c$ZyMH;BQMRC#;?r+o0xtP{QKEQyMboG;3aT{vPB3Ogh`}UbDDCuc`YZ6i^~% z9`x>oS<+Yt98u+SrzCYS;ksgz=fm@2`BPtF2^~@mXeL7;)lGebSl`F-sZFzK$6>`{ zkH8txHP$)*)19BgYt*7WX;y}#_(M^Xz)j}X!!NGE^adJUX^iB7>3>QV)bH}AZGb^BC(Etq?)!$jF`ZQt*8r zSV#v2^gk`VIsP}NSymRN{{tl1`a!Nq+mX9Jex4rgGqs^2og4MB205C(Oy3IAn7{A; zIQ;-0$0%f>vNjb2xb^c&RV-;_p$$DzM)?8!{n3$uPL2C!KfaCvfk0@^0GNV6xt&0O z$NQe7KgbN*|oF4-MM$OjuP45#fj<+IKILC z9US=XK~;4Bc@Zsr^LS>cE|Pxd^f@VwJ@_}p>vML|P*HHUiAhy3@U5Z~KtBU7XDd!A z7;1(z#$-9@MV-0Kz$yZj)PlW=8d!BXAO4-yq%8w_;(J%7oolg)#Bk%C zIk8UG$a1`w^pLDcAh-tt%XgYt7(`u4g?c*^0u7Xh9ggkhWe`cvJC-`|L_j{X*JF7$ zdZYWt!KfHvWfZrpFF;EROZqT>Nx5O+&x3`3b6sVJ`gq9|xrU@i#}upc;KlFFwV-Hx zNB2KA%j2huELWpmu8gw3CF{FwQupMRDUD44p5TZEQUHe zo&qJ;o+@ZMfh3KWPo!ryQQqAaqDDYpDHB=OiuFMXJquY&Yez>rST!w+ZlQ2nkN7$T z$KO9}5w=mV0aV1#grAPz3o+a_8N;a z7B#*s7upctM&xko=z~fqg?*(Q04Eg56Y^461<~GSGP1 z|BGSGQhz!q;!M^rU$8yRMTooemmykoV6dmUb3NM1+i8X9LJ3AcD#jC$p@5kB`S`^r zo9^wMA@A9Nh(t08`3$s<1ip;)U zStKvoK&Zf5W2vlB>%lQSgREN_X|ri%_WwNO>C@?^75Wb_88kP_sY*>tPq@R?T!=EL|(qC=ue zJJ>qBSKUh;#9-CsekC@sEAwsnIH8w+mM5B{RA#bV&T3qQA;ek?=Mr<;MY51_wTe`J zM2Z4=XHoH`e{Nep^m(OLzM9Z5107H%vBF5V2t*OrB(mr`hBfp zI1lU%dS4Z3;>X*3P2O#$K{Xd$#B4$%8_YmHtNcSBi0`vsoR1}@UYyF3&S(jsSYrqM9~A{n1?1-1Al?%P z<@sOOQJ4N&>B2mwS^7kC?MX($(s0Y5?zg+n`7JEl*{MtsC*1au{hNZjD*qlX48T}i z75t~BQ>U*KS6-k~ONJJ@($mTxIg$k6$=s+kCA}lm*f<5_1xgyJx4nTqd{d_Zbiz}f z7;z?qS^=D{d!b@GLk}`7M}1-~&Hvk|flDXmJl)oM;AEn?J=_sfZSq483!GN4Uh3!< z5}nM81PX(spShZ)0gRP#SI6JqwE}7=ofWr!n=o9m1g9S14z(H@=qnuW3q~t&w-cyV z?WadBhatoWxa=K>s<|O*W*@rV7(68VevS20FW^mwmDiwuZKYT%9APvxQdNM6ecd>Q z(MQU%C#xQ9K&FSFv>{k^9nBk#Gz=P;hEz*@dJCpggYu+FV$gYek@VRwEv_(M2<8-u z=hGz+uSUqChKMKLx?s=m7w2@~OQT92&e2oL!Y^9xPsuTu7|J{Sdo5a~;4uKxzO`Xw z0bFuRE{t@)f#lWFoGprbPYFT7O1}=@KHI*GdF`rf45{f;S|_}-TGP8=ct2D9qCuw> zlpySGYmejRVARIQUy(IP*XIbY%`RLU8I$DEsgGJny^fU*w69R=~yG}XbUtV>a>FZK~5b0`5QQhe*Kzqa2h7^;Eq!C2a8O6P2B zo3UD@kRJ*&p)#IyY@{bTmRp>YJgaMCt+kQ2vD7btO^1ThL+!BsR?!}9{q;{e4GSf5 zbaK=-H0~E@*>-~R$v1~;tRk6XmTdG#iic_h`ohC=@qm8W+@y8wOt+HOBejKk29m#_ zS`qIAEz_Vv*hD?~M1hlhczEh7ZXdttSnkAm^7)(!={|Q!wYzrSf!1n#2=DBv^nB zGzref%spu5|L4*9#GWM~-}>S(=X{A)N5d*Cwv1sA^KvRYmlJ!X1v;yUW!K;fPouBGRpODPZz1 zZ9DZ0TGTfd$*6ywnuM;!E`NE*duFV1>o1(Wez=p{NE|uaBlFsG_?kKv0tj3gPaDQ( z;RiV2)I(wI(%g4ytCAkX5wdWCd&Tij^S*Ul3OfTqyC+v8jBVO5a>?CgKQAauSq0~+ z_&LP&u18nzj^qM?%&w+h#Bu9=Cwg6t(&Qp0+*vne%Z&WJb`&73>^)7H@pmcl17Elp z8hN~gA8c~_xUQ%VlQUj>lBlipQ`$O{&CxTcchUI0bP!G#XnnnUG@`Li2fs5KeNc13 zd%mE8sML<;oGMVu-NuN7wcz&#a@}COea&Us@uRm~+4W)U+??y7+nP@z z%u@Jo>MJ+9*0M%O4QKMGm1r z0?Ov@4vO^hO|#7=HkRy7*OcPaDWmU7^=ZNZ`q^KAz1BQq6 z1s9%R^n~0`@!w`-KrJ9yQO>6vpxSBU(vz7`0atB>%t?+kK7W^vy+oSN&om8AL&!B{ zJi~-(z`_UQh{--@;3|WrN;D(gE;``_`C|yOLBk{Lr*U0;S83G|zeD7$GACQU;+w_k z3g0#E0{Hjio-r-6pkukb)-l!Kl-!b`B#h&;IGC#&VP|~7(%(&>t#^!+bc4D>3Uwwo zQ}tp*aLT7iFxSN+KDcK#5dX4L@|ftw6DO!-r+Gb(b=TCK)r`632hnyX=L)Ls+4q99vFN8e3Eqpof7K6!XNW+6i}I-4t(|J7?-g}z1W>k3-bG*F74E)N24ts*30&k zI`9apI*9>5Jb|orkOlcP0=+7P2-?I4+8sF(@jd~)3JJ!5*yr*1Nr)Hpv{e*q z8Ew%T{3BlM;AD{cN97&VM3?|(G+sW5r}0|FVa|K_uK+gioP`iCNq-n(u+RUf8N!8* z&U?vM0IWiClfO6hwfc3wkX)#sH&K&RiJEIG025Jn5LZ&({535?ZoEF%rS2qqspxnw zD&cacMO(cMqMy>cLwx-Sq=nF@==U@%zNe8cQ-?{);P%aPhsFZvS@VT9AkdJFGD{To z^jXfplukRBG=E4c$MO2U?b}%o9;jz#Rq8m{@t_BIB(V3ufShF4xh?}#g!_tJqT2Fi ziQ&&eHa2cZOd1l)#r?pse4W93p5ZXR?vH-(ox`Eq{Z{1q_Va=83tsre+30_oXSn}Y z^9&O^%m05nfAkZaIq3L*R4N);eow~b_R`)Ai!Fn}diaDQmA4B=ojuNRy%>#l$xk=dG4t^higiQ(QnY;N(>L<{L2smin z!k76W`J3t`Kj?8Qf~qqN4S4zf6ifwcRxOs4WD}*{zmJJUl)7QcFzR5$kLZFkx3m zLz==3<{g7i@&puxW4kL+3lGqh{+5Z-gpdI$--IHk>N4C*h7Zdc_&oE-?MI!y?HQgm z;)z2+_aUUs2Jv5HazZKNFKS$l9A3XPa2jzPr8mV(A~<^hshWAt{?eG|GjE- zH7WjH1l3LK((P+bJ z??!Ow)6OUc;>gKDbBCv@LQw9kQu%W3YVp@fcpy@`k)z;69>SKAkV6Dr#@G+;%c8 z7AcRD@{@ocVZU3ch@~--pSf;Q&0p%n3D>iTb+?RdP`;6(k&vvpf~~-8aEgWOY7R;$ zr_5hK8_)PGd1YZVQlJ-N>Imig!3nK>;WeYv+5quskjabpNd?D*rxdtn4`?LX+ms)tV8KPYc2c2-7EM7DQ|@Q z4yFG@M^eYMvL>ja5DSA6PLwd<_GgoiRwAcwv$)+PqbIfSW&m4S1>vFV)15UiwerFM z9G8tf+hK*4?gIP*T1u}=zP{xUCwmG!NjI4Fq~VAWGLOI(cXbL0b4EB;^tN1@QH{?Z zb0!Sj$8=t6b#prXOJfw|e48%y@*F|+- z$PDw^b>yUU@{liLsi(1{I8pNQ#EHzbYLBe_#l?0-@{(U7bhEUxQqF>o{S_8Kd4+YT*iBso z4b90Z9a@8fDa=1>N$aio>$!uJ>O-<_8IKKQkw@6~d_f_JgiB;Yy|knACy zMlfGMg-o-LAz=EswL-|twrj;~Vi5ZpTxx=9NNbZ^2fil0QY3T$A)1v_d%BC01h0l) zBcq`qzSwcK@Q$lgi!g@YG;EMj-ad%T;g%Jywf?DAYJwidT#c2xsN=|_=}=`BzWjHS zX}jxRd~{_wu>~Quk4?$hC)~wUeZ3yWmbLjW>oPP5zB<-1a#eD5oXNsg`5x~6bpjK& z=R{*@YmY>2w#7;!yR|<>8gj9I$L!n*(h~U|*SVWlf%*=N&?PF1%z<(1zmA#5&=1Hk z^ph^MPtzHxmLPjo{3HQ?iqs_5lUNsbP~DX+&pk#rvZo?wp=)bchob@?P258 zu}_EWd7ts-Pd_$WfJRN%N_gOV2JFk;$Q?e6LPQ-pvv4v)`%G;xC!8_(YaN?44cEsE4nI8mrLZ2*0y&i6r_ce4MyuEHYUuohmg-wCnQmV6uD1E`?VCr+Go8KsVq zynekR%Wpe?Fz?!r?*@ooXMP7QD(UOh(5LV_=phff@HYM~Bu!F+XpWcHsso6?vj!Ye9E0#uh1(=L)@Q6C%*)LSzxfVH&#`3YR(RlZ@3le%`k7 zBGGF3ySjgwD0bm94csuE+U%5vrO5dLANj}Xt~LE3m-;Y~`0aODZ^0r`Y7B-!Gya7y zOzTo94f0Y_egixrJ21cQn+0{AR)Z9QIQ>v&$kB<(rP#}Rm3SPR9S0VafbNo1t;O_| zG7z#Mwao(H=UeUJ^7B61$<jQcIT(P7e+Pg~IiDRRdjSlpQD#K`Fj6lUD>z+>|83cw#(2 zz5GiU$yXS#^+LqKYjh8K7Nv0YzfAkJI9D1)&k=Y1)8!b%@K#dgtft?6TSHWx2aIa> z?%V(qO+V*y&~VtkYugy_6)tG?(=%rvnu54h(n~iJQt8003`;Tb!+LUt^!9PHmF3M% zxd`b#&?B=e7l|Q8F9>P|n5J1n(&+SD79(W5Up-5SL&>l=mq%$FL_o)_XAKY*&oW=` z9y}EJxy*q--7?%;qq}T40~xii@t?L^Uhn!l2i(V%L zwG_Zujcic=YHup!&YGqG&@_i@j>%Qejzue}sM+d>l7hSv+Xr zox*8v(kG1WZV423K>iFu@R8TYIinW1*QFGY*y!Ux+>mfnwQVyAkmPFHcoZE;Y$@vV z>>6)A#e8~%!b=Im%}vTP=EJ#r@G_HAx>X5UOlz_JzWNPo^l8-zhim&8(*?dPR8$Qm z8<=LkZHVs{xb!qa>ceLQIq@{Lz-nTQh(ueGG1|xj4$#%*S=&v?^LfX!E=LW-+70r)FG0WGR|yT`8x)iS`u~`k<(pUAo_GiqIe650U{HH?mk8f}z(} z_cS_%S0;9Ie%c#SFH)xzJ{^oxAAs>o;9XO{kPf*G8Iy5k1Kf??O|Fh*lt~wa`BaY^ zTwC9B2LAhL>sXXG2~Ikc_t6jRxjN2>?hb7aa05y&(%$=y*!^MQ5Uj7)$7Kn7DSznF z)iQSO;nP0Egy5hKl&i1kYXnG;@4IG;{Ex49KpUImn_PW7`GU{44YDMXh5Osr_38C| z?YTxcb#3?OocHI^F*tE?&mTR16cB8g+}b7tb)I-)(T>|JBsv*oP$OE}`SRg!)diBq zuR_zpWbVnE0tz=ynM}I|)OvBnDky_qaLh@pIXvF~J{Uz2M`P^SDZBa0w66f8Hgs9M6?!*(7?> zZo|nAniSCVlIQd1fW-z^lNEas_f$P}aVEF}McG6%W3$fPzK zH0NUrq0NcYq&hC@>in79N?{#G^)K`Edo;aOX(Q#v@>6@VD7!yP`*=XC-6?UByeI?q zT2}vN04$ukdm*H%wS*&yih>Yo!BS{hTmYmJGcSJ=d@`g{Y$Q#geS{F?gq@LLr~FfzeimwahT+DEXx$BZ4li$&Gy|&g z8fDHXe3dmb+C^ygg#uG=(ovkUhay@XXP+$kP)?xNenjLc$gdOf#48WD5Mcjv+wLzw zDAQ@I!K-J9y(l-%5IP0=!sv>mtaH(bz8JbjxtBx$!fMR4l~jxCJa^Nlcpq^MiwYk) zRokj_j!V4YYjpBylp#dDXT(4kASek!u*(0Qi$SV#dzTJBgXy_48rtFR#f|!=xQEd{ zQm3f@IdDiZ3j?^VA5zqiFubXNLvbV`y$+Jjc%VAXMbl)HZvLT$cP4kddg4Usj3>VJ zIWh@kEV3R%&R8d5Y-q(oSZXL7a^YNL7yc`IxVE@?id%pBv{aQ`HF3O>wQ3#iPFy2N zoJ8(fxm?Scuza6oNp2^RkzAk$b~c8~4IZFzJY+`_?P~rVmNC%_HYBj9VXH!0^L$04 zY&}^;E_pM`S!Qh#e9 z`>7V`#xHO+uBB1y#G>B{iH5TXirbSAe6vDOY&lYD_kEod)j=MK*L#V8V~huIgQs72 z7vlyj>(ma_`yOAmTBN21?9GCv6JDv zhk9T9#4A=a<(qkBK=W_IuVpNHanuJr) zDS=kq;R@VwT?nkqdd>Y6*H&qxBrkAFbU_CKYuFr@pk#Xa99FdZ)h@!v%eOUJF?dRrU)T5Y0PO@#2sMv5L#wgFa(iLv5aqDFCb>76)ntSAH&-Qb(P^efK%BL%DY z?k5|^k)jFh%uYRLb=&usJrVO~K*>D{ONqswzOCChw|^xL<6MKNE%=%~tJbzO(dl~L zge5Z|oHm8t^+MnMu-7W5mUXuff6EAkP0Q+ew-Fv_I~6y@<+AQ~w&=~k*}O&x@t&QY zs4hI3M3!%gN$3up_(%i6foURm;OSqB@Di z%M`*X2IaAy;whEkZc3i1!%l?X#J917c9%r+NEx3kz4Eg6K4m)lsgpNMG~Xj+Z%6u} z`Zk=M5*wBb6_%H>t?x}oT-3J~;)Uyp!c0NZB1M!Mcm5oOh|zkR$Fk3-rrTipMf8pT zW9?ewvX*ZZG9%ae9q>7?Q; zhGIA*_K)ybz24FS3_wy+BnF><)G>pp-fnY(Y#*LuULUKj!8GLsFmLp^8Dl#~m9;C3 z`z*mPhL;<_T^6@%W5WR+oeN`?4yjA)5F3-xCb=wM(v8^VtpkkUq9?bICJ|{z@*!ur zgnGGTC$aj((a>!@L<(~HYj*%y-*YNCNgf)Q=mcCs-g4@1oK81fbjB z?HJdkTHomlB0Q`Y&~#Tu_r);+DQ8=LpFd<7*K3g2|27T(Zv*uIXu&rBECjI(|FmGK z-oO@We1JglfCs?68(DrzuoeqeZ!Mi_$>_9;_D5OzYcxNu|bfVf55r zhB0W+tv=2^?q0>(Zj{_V+5dfi8olm{b=tRh9=+b(s>^EECa#7=CF9h4Z+yF$Mvudo znGK~&T}$7`S$fg=s7Ss^Xn{5z z_CX42!)Yru5UdiFLRCRkNVHwZ0?RH!OAN)o{WG{Y{@iktW+T@-Tv1?LGCKsCaiXeW z$FAt6I|8}Fq!|x^T+{fJLTq9y>OwuuW%Tryj^cQAZ?k4Kl*U_iRE0ufeB@$4Lvyf) zAiX@|SOhJnNnHh!mcmvw-)9zYll}f!h`?lgVisqUD`JHLY9Fl6r2U3G^#(PPv2h+n zCU_4782?L}_XRoqP6nQH$UMb$Z(sIG=s0muzW?eqvkF_A={jnd!KI7Hq9lH=O&l2l zQ^6BeBTQV&hlI~U;XNe3Q|1n0x7&;mqQ;t2TgJq>+a3GPj&*|!y-=iX3VlWk3=yvo zM2(31rnTU=;i_IRK~}o8#KE~zA!383$x9JYSowWyD$UOo)G$_V_LsL%xQe*e+;?^vlgKeDO!&-|ixj2C&quP*reZ&~^V*t; z?*lmVT4bh4ES$v~y(N#M# z0NcFnK2KJ?-Sovfe+Z27uPAAD)?H%&Ub#PUroxD;+_wgrsY#ewb0>D}WY48bX$oOYl4OSmtpzoB2*S;QSG+FwH&2aW>(H$w*e_mVk2`2o z3dE9BB;7)jDDV33_MQ=$7hDr#D4D%vzfXIcM$1xr0rwRaW9ca{o~-9z<53mI7Y9dbHF-pXm!AH zRWY?udF4C8`v>hI>J6gF3uDop11ayUeP4$v{D^+&Q}Hd${uN)-FgbBh6-J<%Im}k^$k>|cFR>+8a3);NxpDGCpiG2OP zMF>gU?B2WHDr2uLMkFt1$_dFPni)6kOg6T+*XGz%aiyC${1JVwyEWL z3dO>WpmW;f%+e9lbGsqyn`oBR@c!9aTvFH(qA#}8<=I;)v5C~&CYFh0`+Z{q^Rk=#S)o}5^yUB$ihHtEUp*6?K*8q(N zowTMKq1`*!=Zl$K5$F!)TU|YW7lkz!Hc)6=Kd+h{DiH!lxkG zH}VeA3mGe>SNE)I8)Z4zRlJ7HCHpySZs)Aa873s?duLnUh-5pZYS5QGlBLl+b)w8Mf#I)3BlNN^qp+kvwmg6rH#a> zP)p!f_Ab{7un~Mml7MzuR-eEUskT4kjz$~oN$c95Db?c=NLL?p-8Hsv0 zmBI}^vHUB6`h0-`QO2O);As*%p@c8@uE_vR42rioA_UzbDKbpuUY=Q2wRLm!4e0Jp zQ{@T)&}He$My@AAU|}IW^<$VV#Sf=+w;aw&rQMS!fL%Eoi<~ZUrw!enXWwRqdrtcu zKesiFU!8O!qoC58Sk5Nx>)4el;;EyK^NS=>oGN`DO5ez z(R;JS+DRg3F|Wet5v}AiUs-_Qk-(d)!>dq9F>OJ6+`*O{a>W=hMuF6we%O z?U)Pf+_o$m^jyb^o>;u&8-6OP>HKR%X9${F31!kpO7mLt#%W1B=X;*jZSmB{XUhXD z&~$G4clF=M5baJkDC}#YRZ{s75Q^MJ#ZU@S^1BlO+ZV)Dggw1Qj8=!{Y@Ct;i`t$< zXc~x(Y!v=)C@*@+-UJEQp7IdU!c=o|m?9=J>PV96_cySBqQ1#?CYh+nAI&CCt&*Q> zZ*I)X7g2B%Ag9ehf(;ttEJ(>loo2(K)MeMWN6izmr8eu|FMmqx5iYpW71hgQP$!J+ zr+?;ndDGL=`>YOot7Vmg)pq*m`KlB?V06^nNPc*YpjCU9kQFVpLFQyDV`-&3_1fH= zu`G61l>NYGs9u|RQJdN8y4zra(^8$OD{~_{$yw=h@1KcuohewgZrVu*7gn<5d84E; zR!0)?Hbc%SLu^kP9OR0X>9=bt`9pC1HP)DCbGkDJ{ zaM_dgJyc452Ikfo_)!kESphU|a6--0`kWQ=o`j89Cy18v8UIu+VSu*N&^5qU+}u~< z*^HDn2CVO@A?fe_B%E;8HE$Z^C6U8Jw4n!)4I+UhvZ|*~{hfzpPKWQ9#x`E7URrtf zM?8q_|0AyANLKImWZYq36IZnYu%DrZA(H*aBq9=3bMr^lVV(uJ$e+^HW!r8LwP#Hk zHFAs1bb0p$ictsIph(PJ7W zaKL90(DZ~T3(grYdk-UxYR=rfN77fGJUB;NGtK~&6A`iyB+-myDRGX@XXNHz(&~0g zxFv8I-$fl+{0|(-?wWAVhw*qO5vKu{qoGqGmfg!rvgnc0Y<-u+G-@xOw2gKr-DY;* zruAkY-o_zYoH|1LFyAzOP{=lb#BAtJSY*Jp7lziUwiw7nsoLby;+@(xx2 zkRLlB_~zMjUcskM)8W4_^oevzwd-p|6yitCxc({rA>DqWt1KudUr=lU5vyeGtHgW# z+;1zCa4jvxPJ0Le37s^ETW)w_QAdqTU51e#wS)_EpHM2+dAuAAMj|cVzy^WEUezc^{oSjsYdvuq2StAM z)mt=JgfSkSU9-IrlDl~>u=y^~T|(fS@x!8YgqdGv&(=3hJcj}e5|P$x-RA%44?ukc zfpF|*!@LA@dAs^;&#_(UJ~=)4*P4|3KLAJ>g87)b!CwKEV8;7yE$o1Ro@IWnlhh{V?O z5yO6J11x5*VxyvTY>B032+9)^FM&n>22H3n|AY@=rh1J^=^A^BK~IeOLka;YNg5Cp z(ZnRB>-c{Vl(k~?v&aIc*?V$p^fzUo?>+&~)2{B}e;#w&RNDiEdvQ;h4i8@dEC?lk zO>vk>1oqoRsiJM!xh%&ym2%E|j!sAv1{NW-kyNNf&HpW!aG1%(28X|5V>sTcS5Rot z|9x}Eh7};qk7_4ruaqLXqp+%Ji&Y6p1&z6NH??a4hHvdD+FPOTitdoV@13BsSm_#p&obob2W48k-sv7ZJn^E}nS57GSUbZ7SEUtsjh$bQD zzU1zZW25dv61y{K%Xg0-Lci8K>|riRu9ey1talngf4v4Tk-C^1V0(!1zr*4}CMj@W zdos)@=NDEYyzwdSif;)bKGuWsiYf-TN(|!7DJSroPfF239#M+dn8U)<@9D-9D6@Ge zgvdk`h*7~yvdx({@-}7w!&$ZRH%GiBHk3=r^Cb?PUBjJ8?W~=JZG$uQlQrY!L}I=t z%0%!wMrYJ3$A{Mf!)kbjj1>>Ie1wb?D{G$uzzBW^D;R5NVF`oDm4*rdX*JdrUfj_O zN~w^vZ0C!1q2iq!Sc>G*KI;~ZweNA*lbB+?;)5u@X9B&_x$r?^yOD&DpXv&+&d5*~>%;l73}ng&Lb+UoGl#8&DK+2-T_V_mzXCf6=WMbm3U0Q93S0#cIrGy zKRQ#nV+iHAZ3mpvo)y&~k8y}aj*v}K=1Nvzq@kd8c$EkaSRsok_AU_$o`6&@DRjOX zVR&C1;)DIO&66;|t+mjHbm)X(7FL#`dhomzFB1!~mNb!Q3kdUWmPt7^W-J73Hs^%R zfT>aAZ%RZ>QWB)oAuhy}KcKjVO6!V*L<*LCp&7;BugWhjfoZ(#sq67wceD-JAf0N5 zBp;q{Px`)(*_H}z6SOe+8L!V;QCC_>k?<7ZEa~<@$>_K5-qvE4b%gE9eX_K21uKQp zy9!Wk$!-%>!}~R@Y9^z3D4C~Tq-M0Av0YPrmpfR(vr(^PXBFOb!$!OOD&7Pu7_r{< zPFVSM7Up=l88i9>T|G{<<@~dY^jXrb|JaM$WCf+@vf1}0p~@NK#&&bVVtR4@`{Q5? z?lj~uu*-Nz2>bP2iu}>wKm?uRNA@JkdrCfGY{{4M zRGgmRyvf7+_mw|As$i}c?zGxMQ2#w*v(O_+->S8kB2!Tfb!jvU)@$IoHJ-P7>+0kb zlwL4hBvx~Q^SI(|$g@F*_@Qg5p_IfRqUAn#xa_$!tUsD%(&iM`t(9)gBSwg?&?@`p zv9l0dAdxYYzCmGyqD)dN0gs0@V-_yRVyZI_eWubxUDiqw>&ad9&v_mBwI%@{#B45j z!q8#h11X@3mERt@u@~yY0m|sMx8RSX$6=L=M9T{;#&i3PhXaEJ?~&IigA~3Lrhsco zVL71g30J2#!?kX}16%av@RM;5#hGvuzi(9l9j#(%)%fafg-b?xqucQfXIboBq`TOe z@A?8B)hBK@#HMI0fOYBRmS5p>dCpf{QMT;oEk{xqFUOu|`jT7eiS zOFqPmS0IEqDSiY2LQdiWOC~%+k+!m;*I6v0b8gAwtkZOcYI|wHahde~cq$|0hN=ph zB)bUt4-Tl#UiYJp9V5U}l&x`J@Dj}ib2U03gXWwv6+26LlosAp$fES54cvjj5#tuu ziL-+Ih3^7;53i158*U%rAb!P}@Qn&?lw+Z@krv`oDG`ZG3rEV9Lo3E| zM5(N=DV+RYZXNs>61U!2qTWH(B&QN2`5mkYhI`1On?J`^Kv)YU{=uU<@aWVE{T zEUp9uQ=ffqgzrLlBi;iR#XFE{5-Qwt2^=F(=wY33(2a-IMr)-Xfrnc_SE$v~?rKUW zQwirBQBd;eC{cjv1n3n!SL)%7n?gr>zgJ|G@9YIFZ_gOQ8Thx#Ri~3b>!ylRrStCN z1~qbzDAJ2JQHGJEN2{A-rJ{rs69*>taw=X^HJ)cCCj7eQSR2=J zbyST`CHM8e<>tA|P?YR}9MM5bHAYz454qblL5&R4td9 zw4Sx~D7hr>{5IaQ7Qctdrwr4YrM8{=g96^iPPE^7xzEVY$e-33-&wkj;Ym89 zCLvhHZH_M>yGu$zPJe>uCd|L3;&XzYF456gw>0r<#X&p#9ah#BO7U1B>BcOfN7 z>WI;4^t^PSSzMvP_?ZwYkl<@GrP#1uT}96Z-xqI1aF+lFmLS@7pndliM*9Uy_j~2v z_pQ^*t{5AmB(96~i*_iE5I}Kja_Z5CIHespCF5%q;Y-cEsJ2WA~L`DW`8+;G0)`7qSqU6lXy6Sa3>! zn8e8%^k_)T{oC-XSHR~gN8a<>g|JV9?Sm#ao(Pryn_0X%qJh}=>-c7Q_m~c?;QpLJ zK!w0h%YvmKX<)!k8gU$!IJag2#u`l=#cIc+H$s6OGSKO&6>3kTdwfqp;!CJuHwk-m zdHA|qU8GD@QMb>C*&GF73=?0EjKMtR7KI8iUWg2IG&~6zhDg_6fW!Kil8ZEa_hkQEWNQ7GU;qbL7A0bdi4eGTmS8HU2@2&)+rV@A z#XGNGBC?UQft>nju}_bl%ZFnB-|-B-v5C#P*o4|r2IZDDdv*GEh#XY?2aHZKHTLm8 zHma()cE@^yLiKSv{d74N$x8?V8NC7c_N}&|y){_-5{o~0RGGyTu339R3A~`O!D7Hu zR0HKb)OSk;;2$#ngx<`^3+f>#13uM6!dg<63;Kj5N}WD2anbhB52-j>*F^!PMteM$wlcM-OQ;z;ARihBczEmZFeSeTSg}KFScWX-APf zYJdrdX!n}Zm-0`Gg0}+#K2_pan`BcZp#_N$f8k-PJTiVO&Il~yEaBPFO<-F8Y338| z)8vS<|KBmOp~7M?1TS)ZR?IKIKG4Kj0(0D`VHS)_7<&TOT#>}|1h8?X=pGR9TI5(! zpv-M-kvab#8aatHDTsuVauRq~ks-id5K~SU7ieWei481(icV+%smY%+cYUC>t*+}760-8wnI3yK z63-T&md7+2{~!)Z_l}S|uhKcywv2o?eU!li<`UYY2B;cpw2XLPh|Oo|`DjPvi6U($ z=`!Vbfm*?21^~67frg*Yx{{iAVh~I6JF8pEE8xW|VSTPxgsvJjgBL~mQBz4&3I;g#E~OyfGENJ&JqRTCv+A~v9~ zpkmIOA^jCIp0KFFYR=MLN)~2wU@RYFn|Q%~BUC)~Z8HZkAKv;>MLn#; zlY8yiEBk#z!8RONf9TP;zR-n zHR-6nO9Kgj9yei48>65c^^oS0-@k7#+oPMZoP4ecEkTmvz~Ptms@R8NbRT?O+5wPT zQ}fNui1vn_D9ZuBhE9PXjB6IU&yh5|jicql!GgL;QcemNa){*8{a%pxG)2T6F*weU zC#>%d4&`tGIC)0g{ecGV5a|MG4UR}5_>idOJS-JK`NLVpgT8G9i>^@`e5oSisvQ$jrB< zqnW3Lj>{3-mfA_?*^pwD{8*eB-+xW+6W3OK&O%iD$K+h!(4%nIy?kxS*q~l8N4)4k zgxx}CUbm9wD3BN^g||b;mw`;IUY&Nx>jKGpSowKuOGf!ZVEEG+xusnITx^1CSGbf> z7=1hV7r)T4Hrpn)y$OT}UK~Ltw*T%bKC>qeuH@cTv>$KBut&#V=eSyl%y^k$bM}<@ zyO-Zpl#3*qO1t&OC!tpbPXUzd`MJAhB+Q=bQW0UZsm86+c8=$T6L7Ql*->=vkumpZ z(3#<*s_rvuvT|qCzm;&tR%s5)XdJPleBO6;$6ab3#V@Fs5p0mjyf_JLMM@PG$qS#8 zCpSc8vrU@SHgyDj^6Xs)Bvi%M_Hz_$t7Dl*9DP5DbVk#mK+pv? z0S8GULH7>*99ly32{|0W9IFbt2aR6dIf1(4*Jt`PyPi`3;*&Ari8I`>h1G?5JBL6g zk9R-;cM?q1DBAl9%#myS@}c4s`69z#x>C8J&yUHiu%w3jE#7UR@?nm*sg!saVZ!s$=Pwe;|hFWIhHYTZAnw&Y1o!-5pdc(gm__ zaeJFx)dxtu6;bQPEU4^jj>CbP!#aS95(tM+D>^1F zZRnF%gaxQ38y4EV$EPs4ccp!gaF(e}3J%ja7CzPyewX+S^McprSU28)=Ho>$Csi=) zMIiR}OsOa{DWnxzFNFxgln$%R@&z7>Bd6SbZA+|7rn&iUz`4ClZ!*@Sa~JX)8p+CY z5<%r`)beM#m1awulKkmAJ^B@_+mK9j^7nfz))Od6ExZ^jP>OpX7y=x98Cl__Gsd)`8u68Xsa zSWvo6k;eHIG#Wl?K90`g^BIca+q>M|{w(14qX6QS>q$REFPZjf@0lRw_)!39O6Q&n z{KT#vU|+of3}4wWZG9I4``cFkhHg!28{eIVQyo+H)Q&un6gh?8AA!G2-9+~EkR?{7 z$7+LccCvB0x*)4FDRNKcvBkIBqx4R#>VF`F;RpW#AslDvALRRi5X$^t2;uRu9>xEp zuJR2+*4{7&AINCwK{(8A@6gw7H!$CK9%cCtU+)7&I!C7h8oxswK0elqnoRGB_mBPL z{BnJLs_fE!r74B(j!{4pBpHrNU$oSxvN@J`3~7by17+(y2d1wIx%FFnm>;UoXg z@Hr3xFfQoA=$#yYZazRqNW{cLk-ULCqq^GY7qloUC`J|^G#g1&w_*Rj+a6qsa6BP8 zPFl2QL>~<_8hp$$9}nF8>tm~4MVue!$uIWlNW)>1^mOpwGbB3Yw}sEbljuR`NJsIe z&cXqv=bS<>PI{&*>!zMklL0# zE{7HRaMz1?D$fVW_-|^i=BeOFYEDaWE@US-o&cxKNjXXzIbXy zQ7!M^6~5P3TT#lPSWt8?DfT(D3aXG;hzvFdp7p42RdQgL!}1HQ4}%)w(j2x&nOFwy zieG^J6f@4D_6Fxd^he=?tytthLvjgUgJEN%&J;54>4F0kHoZBUX7bHO{pw;^95kAX zAhU`PiTgx@kR~bWRVf^D=KXsMu6hcEeQ1P*cdUJc&@D2hlC0Xr1*bcDyN-SsF{?7PXwi$m?j7 z>rgR0Nj@PGd~mpuU=sh4sxyRaEZu?gSCcKJ?U9xG))tL~W`gM7iY4FHA;87t{}zY- zL-inn?{MDC%$#X)LAsN4c3Yh1fEl;m!#-e3kA=OhbRimrq=PDJ|4Ylcyjqr(cL#pM zTj~`&!kj7o`6O|C^LJBHDRn=*@DEDi6F{= zv9vej7}fH*0w54{oWRMt1Ch zjDzl@`g}ed7%b$zh5kBR)bIckq>@K~G>^-iPGDC*<=f>LsYrqw%^&WOY-;I)pm_IV zfp*4My$4{C>~r|YzzYwn(r+L!%-(8W4Ba(w4Wr}a*}fXcIh~484Q!dk&7M6``}nzI zv0i>PUG+znu%J3>(m%{p57`WPph`23;3}IpXBAOGS!W5YbYtyh>-l4^`s%X{s4K?v zxKsX1F}hhsN3TDOOe~S|mBhCcb{?#-hC%(DkI3>EVh56Gc*yI+6y`x01*>}NS)I%} zHDOEnIc9I0_T}FR2pqNnf4hC-<5UoTPK&b*37pcDm>M)Hf)yGabv2hvG%9b6T?of~c5gt0&9yWCU>XSM8G)BnxSLqm0%k6l9M5I8ynm}{Yw7p z%SOS{k|C-oCsxJ8P={c7AZ}>Ym`y@xZAPN)jC=55*vs%x=KvXmd4$s{++Ez$cIE8# z&r+kky6;L`V**t##6mxU1J4y0c=r`mwLdwj$V-!TrTIt>;wb}P zNctIAt3U%vIlYu5DKLYDfWZ&%g*Vd~+i?KvL8i92Oe@kkzBI3U1~4dz5VZ&RJOpsh zSgk2kuqZWqf5$tT;jTva=MbO)g67&XYlcb&5pwI;=Z8Ryd51bVJdgTcR$}p|@tr(5 zYopppASe!6r&v4)$zq0&hr7-GGV=U(+Swi<1c(!?-+$r%8n{z{6P3f?Uy8D-7=&mM zJGQKBSA#dF4QW2Mg4o_VF=K5(^czQX$h9Vv)g7$`n%MX4mU_&UoWsMFrxc@o z*n|p*#nNK5kZXz?;$4q$+_vP|8cdG_@q|@81!}*ZL^yMp|PN~oFo=jHLsJBksp3%j! zHMC7z@Z^2Y_e+YK&1pNR9TUo0;Q_b%`*nFO@xpJFR{9N$ zg-+e|U!q;k|5dch!pQy~AdqUD@fwQSMC`x5*;r}3%UT^OQ>FphFS6+92aeh8D z@<}j(Asw6!?>ncs&h=#%WgJw=3S52vgCu%XiHwTxJGRR|P+9xn`SKYyBlhiEED<2M zHJT&wKCCe-Rsnu!%Q3;v$~k#Sjm-lN7`s1^8A_1)@MckOh0WQq$3*fKN9Z26YW~#& z3V;F5@-ODwVf~dTI{)W7I$B;Y-2K&+(Jxv#^rn`eJ0}|c4=TAL`UpAtuhddZfb15r zW2@cESE9$>wy(8gnfJFthV#wSgTP*VCg9`qeRSg9xN~Uxo9lD`VV%86LUZ}!`&kbh z;X5jkNKR2s)@zuI#MTJ97vpDT@{G%u_|{~k<55u61ESaAG`*8Lm(o!8vbBna!l>Zl z&ZRonly1DeEwG_&EwGBZDj`@d0WD!`*n!#rP~~NeBuo6#NmwcpchHiNwND2i`mtf44&6wn%^h$l-JS_n>+9X=Zsis15?4SvD9ij2K?lPg>YHkCbTE-- zI5fhdF9bFJm(tVrp$%yE=7qe#p!Xc!Ebb-V&v6u{NXA%Ax3X-phm38%?^=(MkzrEY9_C^V**tgxwmSy zsTY6=3JhKJ0!wBYl>GCQgH36VDKOTgi*QKXG_?|fqz^_D%X!qmg;_gB0daFsvngKd zb(ET+rX&VY5W2EYtb_SH?)EkN`t?n6P`CcHvUXJ9>_n01;JHA1J+aZr-MCC*tRSvv zY4{uoke9whtS6;Hv^s|X^j$9h!Sx;Iww)=!=48f(Mrt}Z!#QFEQxJ`{V8|@?ZiN-$ zd@sQMlrxiTDD$M34LaJ7j1d)~Jn;7NjG>3NPVg|BCO`{^feAW1r4&Zya|k08OxI#{ zNzfkdGBO^hY%))j97b6B?IFlq74dw^GJ z0aPibr7=7n{f$gXYLs4t6>Iw3mS*D%ekhHo=AI57CB|Qpq$t*8r-igK?ydZo9 z&(jOcve3V|bivi5b4Wu^J z=-~aWzX$X|54on-=eV6Wff^*3uQE&)lP04(fT?_h@=8T$Y!vsAGsUuumK-o*AK0XG zN&^UvUv0Q`ZZsV7f4&27+G3o_Q`*7egGiY&u_CzL#)ZGfnk4&0jQCO?^?S#HGjV>kqs8m8phrDQ(OR%CwtHI-eRX&k$Qo$j&wt2jFyWFl%s z4h__xX0g7fgb`t6beu%mpr~1Hf`4|cU6<{QxV8|!r+I}pOB3eQA0&)SegU?GRl5mD zl`W!&Q>Fiz2aVUBaXBb(bV@zo-uEzH15$x`nSDS=?jPECLxW-V)Lw)lXHN!*l?^VX z4(luXa$91isF*p{BBV{udun_j*^!akEb58t`yr%JMht`RtHT5XN2Ajf(e@(M_DK2m zF2O3`#(V1zF7PtyU8ss2$GI6;#w9a6z@*m2`0P?mbdEql+fEJCgJni{e$BOli}-6s z&{W`Gc{0yS)uk$>Qh@kSCJvn(CH76gdfQ8B*A7({Trwnal2kYB)jC#KJX zs_V}7rlH!d2tY3)cNND=rNsUw*>J`U4XXZ|kvh$H^HmeQ#?=%T_ccB?k zplDKiIR`~qT3}B>d{atIzptB!S{fB~Yde!QsbJ2vQZq!vx%(rxFJA-QocgP|kIViK zW9QVE3BY9ObZk2v+qP{xdDF3N+qP}9W81cE+t{AD+S#3p?_X5aIrTigmAQ>TSb4?e z^kJ%f z$ifWLk&iw~g09%SQa)nEbtWAIovbyGonTKaUS`^|TlIOoibU{No+=$&5M0<)j$Als zPa#wqu{U3e4$Kek{Vlamjm*PlT6(f~UCrt_s5`l)^!TXW6ZSQxG~WbLZp?~_k?Zs@ zVzOLRLpTk+ram+<+@2z~CN1?RxF$i-6DJyU$T^6H%pA&!a z&!eum6;Q4ZxYJy>TjN1gJcymth=n791sUippM4zMw9}3a3i9*EYy^9Z519cB%h)k? zya!NBw4SHBJVXjg)%)jd**Jkvoxy(Dm1+E4XY986Amqq3)eqXtd0^bS_k@RFCRxjx z3vb%poxH3E$b^$$!?f@x+4WWqCQA23Yiq6FKr9hZIUY_!M@9+Q38i)Z9(#wkB?YK6 z7NStqSQcTQ+Ou$7wgBB9lT)0vbE~XuXPk=DmOmP7FQF0S=^Us|4kYuP4}`x-mS4(! zBsxJhmoM&p4rf9B_*N37H0o>M?u*Ko@>{nUK@PY`^Bq@~jRyV+LRV$2hF`K#Qn%$+ zA9$0s&$spuDdE%&U%AYns_-MX>;U?#ogP|YjW{SbX%R5z5}b~bPJ%67>T4vlppPOY zcbWoAxw_9YE(ISNAE^MmX*q-&`lLXw#=aM^{#|lROrNG6;Y}RaR~XMcZ#&T$p*f-5 z!_oX{m~n2@5g?r`Y^|i>g(v1#K3mA0&!n%cW^@gZml`vtU9pxmD*Rav=c%oGi~a-mo%}S*TGQ}r*t@b^Vc`k#pQRonyd86j+iuuCds5=L8`6j?Q_%m);-;?WRSuc>QGYfdCA%<~=$lrX?@?fnIgr>unoDVOcvv3(> zh}Ee>^Vu5h*l2AAH5sXpg*9`|H-`ZReCg1MLf+9Qu(`j=1`%BS*J1O87%L)oA1ytf zP!Q_q#Q)p!!115-LYP@uIR5Wm$QEEC=AYwd>xB9pLgeqOS%P1lDA0z0i`+Hcs1Wn{ zG})h3oFAW86ST4AvJ*Kyg4Q(Z@+B{{3;XjrtqEHgn$4fUp|GK<7|oW>pL6=p%b#!F z&hMv<`vG~6U(>%`>%2BnVa&+dGzAzmhVHNKW~fgHY#9}|uD7l>-#55V&aqo7K6d!sz8G}f zskK8XT(H>^f4JeZgINzv$`kEeyYBJG2ZpqB+}v5qzr2*{Lw&tJHVTRidy`YGka2dD zTO6Vt;#`@jU zJFgqLyuX&;Df%Y@Mf)C8ka6~Kw^qumH*LSigIwGf$}ub9(%l{q_|u0NtAk*)Kw>Cs zSv32G45wZYmyoTN8a7c#0%fV7~G@24KK3BZel!WaaIqh0t(!}XxN6A-(OyG z$3}JngMTe(>7#U*O{v+$$0t)SPKrHfrL%T-DgJTNobI<&NegpD-s?Cgane@G@>r~x z{+X?g?$VfgjqsYv$tXWm7Tun#nimwRmFk<(Kq1r^3mVKR0i1ckIa0^{7~XshafGPL zk#)A*8&*xW8l(9z*1ftN3DEY~PHanK__@*Zv(_47?Dnc94xn!0Zx@c&9h`Z4SYP;f z`$RAsE_3mktD-(9zQu2;cPFcDJ#wUF`b(CL)hug6T zd^ud0a9eHA5rRJx>j6jW-rH{;*0lUFcEq`9o5K5$Fgx(~o?e7V(ciZ=htSgCbWl{r zXtOB!V;5JTWdn;a_UexVEj~Y3G^ox8O)4p|tqi0RY>z3xs+*yLWS)3|gmvb`96C!$ z*+6{lF%i=vI#qGk6~tbZLO9K84SC;Dm10ldKxacb$D-QQg37^YaX<-aHI?+9Y>2OE zglnsUYL*msW9DYgJCLKEb}8pzgu@A3n2E2*zYtAoN6LI@4MrFrmi24|1m!kl+bLO; zf=lz-TWRFFcbbMKET5zuU?f#z3MBAEC7zc-CA@BX#-8!97;N*}Dqeb(-zx29x!sso z^J?Cyr~qkC6b3m|<-{66F%adq5*Ri=na((x?0rU5FyC8r%Siq5LqcNnS9XDK&vN#9 z22$+@qrNP%)(~j8kIJxZdN^q2u!zIhQ1z}7kDOd<>Xj(i&{7027;G~o|LZ=4_cjQ^ zzMM8QcaVRqD41Rr36G-o=Q<0B`mD>j4ld@D0ipa>h>$!a{nsA|*A<&dBl&`Pq_ZZ` zb=0fQheV5%V&~rzJhmBD5ea;j@h2)3;N*(c&AVmogkwbKCXfkY7nZhkXrZgWf$+UW z3Oc9%K?bGwja{G_6kKw{^ALFCOI$f@DB$xOf>QXTZt%CLx}2Hdn%!1zBxr*Xiu>am zD*zt-dv3W1GL#n-p@m=H5mNh@HAm+^+iib#J}aU29pmHfb;l!A`pKLh7nlo1O}#5w zNOuMSv4PMd4IyDBDK*SJP7km;X~}&S(*cpCQCog2@ogM@5Z~8O*RHb%ah+M1Vin|T z%tT4Sy(%FTmQCEF~v`KUF zIFnotHs1~#C%44nV)OlFp{(><=eUu_G(t+TVPe6+PI00%-;V;YE}6;YJrkT*)XP68 zCFn5(2L#v3#bMQsfnx1aC#js(8e zXt5IJ8fMI+#__f7Uh;Z%aPN zyKinAqh6Tc(`?^1;y&Fm1m&mCk=XXoeotF2?j|mwDW*w$yj+)z?mEK?O9$LG6QmgA zA&=al3=42KdOOL*kS}!>=R9X=kzcbvBJ;aSxD_@E>5GpyL>6~AOv?%k`+@z778Oz99!5Nj8R2w{h?~+jLSJXkAQ#w>$qAv-DE>lF8*p!;%}E>=q&=z z{LuD$QOs+d_dr>r$54m?|5_Tm%_O(AU9qFrpv`&|rXs}Lf5mSk9qWZx*#=8owoab;c_sY`(CIIYCFEzSg6H3{;pK~~ilsp&G)qZRfX zd*t@5AqG>a?`nou3&e%^!Q(_?QbK3!R+PAq&Ld*zNkRg3iJB|b+1u>TWad7@)<>t#coT6@Sl2r1FF@+ja1t~x;U(4h#1UYObO2OVyrSdOcH zj6^fcm($p@%(SYJh!ieYlS06q9gVdAxjy6I6;bh!cw9A+41&4z5w#Ldlo-_;PB)9X zkZ#0z5h~M)pt7Mzyk#!yVSUbxK{sVvs|sib;hAEjz-}bR3r%>}Y^1ldHaRfLP3V+z1&6?++r)I+7pgcK6 z>Sk};@k|WOdDzTdQ5^`1PU-XH;DRhV6oNw;Rm|`|)+#W(y&4e`)i`qzn@fS-fTC26 zJB;14vcj}W_{N0_DmWork7kxYm`HUvdY!htNDrQ&{ZB*a_+V8Qp#tZghll z%A00qCYQ6mU%7nz9j>XQnHh;9x74E{*Qr9kFvmxgfWm03zYyk--neFJ8|>^E!3MeM zJz>571yU6L=cGNI%z*(4Hbkp$z4SjS@0uN5nn0KR}?`PEzm#Y@3A zPJDs5ED9YmE;=B-i@CVB7!Ru$1ob4(yHky|YpdSSx@EMEmw&X+4L%Y+P2vsN;QxX#K5~IhiASn+@JPzk`A3k#zjOfmE zHu#ME#bbXMrU{(!LiJ~;60&i{9Vb#D*Avrygv1-1bWz_!)@++iCmW-Cn7lQC)~0Km zZ~{6zvZ+ z6YYDdgtJ&cCvS(QSk=foalU8clGC|u-iXlQ0&T_V;rkx7T-4uBKp>hRGvK^(w&4jez5NwgkaLKjGs2081P@{ z*+Ap^kNk&Fogu*Ca==Z6Cw&mh4CVq zKHGbR?(k_cXtgvAF7N*fGmq!%gU$EP0_*kS+6MHG8>z9~as>2`8;S9c8>zib|Km}J z`igXl17`6_Zfpm7_A|Uge}_GU@0oPH0_Pjlf!Z@a0&*}Z+lY(sUlv%7?_qnY%+mXV zT~N1^2!8w}06D*RPH7IvNz3)V_Th0pH{qmEFXAn zQ}7A#?fEf8+CW$B=M;yhmRNARzH>OXMg#*Hasf`Y2KJIsJc9T|EQBdlx23CqQ62s-3>o?^g1 zHDp;bVy%-FnVR53Pi|MwX|BDV0Os{VA9le|0cH&t`dE0s_)jyPb}hhfm{*Z0+(AO6 z*gx+Vht6yQNALuC)wu7U@rs*NIfa5IseXIn&XQV*6{{|V){_FXm;gSDG>+B{ce=kL zA<+$3IIEMj`cvPSUmO7u9nlL8+ALKt1<|x>i@&7Xx7PIUExc0jdx7f&-8vzf?s?pe zzDuq{fI#QG3dgvhCbc~>1~5IwKY|7}>U81hfIfel!K@jCOSc%M++I0i#raATV+ z{Md{nt(EcFG%=CwPdxyN^`!3LaYB%DL1Z>D`K9~=+Lvd=6tmCN`{g9>QN*Dh5pf#L zHefcEO$5HYy0{Kq3UwP|hd8BnQ*^d48lTDzvACt;Q?2}_6Dpty3^*M!@EEBQh6$kv z1j^bC&{>34#w0?TiQC7`Q7rr(TXy@e6VXIJETOPFVt zFFypwLTzfR>sT@63+j7!=7N|CbP`=^L4mGYq@@K{s-$_D%nqaRazvJnW)bTer_+V62v5W2Cv<27;51hd$f;Q zgnaDfvQ3(Jhn?oDXK>z8r_XvJ<$Ad!CR9_JQ+Dn7!c`ahVV>sG>^iW85A<8l9EOZ}0N9h#&0}#&3ZoeR5!`pRsDohISP8^P;H1BUQjZNVC z+`8tJPFR`E@Mfhf&%Rd|MO})0SZNYZN>MusRw1=(O$yZT7}={P)^>Mqz9NBsI-ibd zc^>SMisO;SpDwuGoAtaaGzw|!<(9-Y7i*GfHm9|R*<5VSru=5pK~h>h6Xs<+;6A z&zwBU!1Gq(=7t)!O>h)7Ubl|F;d=|?8Td<_cH>r}CI^h|z>2*g%>lzZJtS!<_fckd zd(IiJM-)W4AR1VS8hc3s85Be85pLw7LAI!Omib|nc|4vLb6}lUIm$3Tv^)_zi9~#} zt&=_1!^Y@MptkCnsW0-MwYiR|=mqt>Hr?+b6VupDv)4ght#E_9y+*q>tt_SNgh17Q z7~VMgYCCeyql6nz2p%U`$#0&od*(^d5o9&+4^| zX7RnEVORj$lvW;IuEoGZ9YKUGri_)UxjhM#avqjH0M?TO6%E47eCV79#nt$I`Zi&( zlj?FSG=G*KKN0nU%N6 zV-Hjk>Yi8!NHTOL|A*bQ!OVzKKg{oYUw!HX6P%`@P zpD`5jwV#--cbU3S&ZMBVF0uWtefOD=$Z-s)5m|xhb{PzRKAVqrbtmrxOFgg%frz#< z6ZsM<^%Q;Ok>TtH_nK{mGjn65DwXD@2XW2i|2*nJ14L;4|C1&=!++FdV&Y)>AAIsF zZRuL-7P##f^-26XqI25b+X4ZUypBdwb*DW?p6e3LL!0-PN(fR#>}cL+IAByty5sd6 zEJakwyE{eGH)sFgP~SR@`hOy-hlv&XyzRIx)DP+~+0>izK=01)^Ik^POQX?25; zNO_}9uXP@uX_bQ8nb;mWDGzV}*qBNE9c!YrFe($oO7G?qwXcs5_G@aa4qWn#E(Y0u zAsH(|Xb$#X=p&gz%*pRwdQyAn`FrwCdQl&?2}gjLTI};RyMf8?#r$o zxx1Y0HM=AyER`jeJ(Y&F&RiSB()*)Fvy_Pf=lSp6XyfR-jEqfz?JVgDFxVtNLh-Nm z)7ARL1tA$=Nl=T!Gy77x?4e8=X>N=Rhm2i6D>^%!hRV0<=&8t88ePV4ES;<+dDeDS zkz{kg7n37OG2mE_#)b4t*;g7*Y+f1{6M;sml=mX_gw`9*_K4h$S*Iu>X`J^ZQ8%Wg zVJ?5YadHH($eq@lb?GLaHZl%tH&TwXbJ;#V`!Im$Y|&6S*ADj5p{<^(kg zTALVhNW5e}Fjbzl4Gx~e>^>)X)fiR4cII_r>3btAx9YQHI<P` zPI%ma2LjwGAS7zK>`%aj)&TDHCh5sLR~`*v+9y_t4t6Ujj$W-7C~XZoT&{Kdh-;dJ z;s=vL@={bGcw02gPwyM@TQjzEW55eqiu9fhDV)V&xwNhx@*PigA)GkFo+!^Lf+xtB zkx@Y$NV!WK`5S*^$?PUvhRLsyS_BIASq?&iGCwAH=CDjoycD4OIM3xEds&qU3kj4c zT0;B=I{mMIM0`8bO`v>2!x0y@fPo`b*>Bjezjwww=TpdV-9d= zF#v1{YsSkSZ@*%4TbdsaV5z37SflyRRFGdmz`0=*1fR6vKJDu;U=pLqwfq*BF8}s_ zrnkTGNvUAq6BF3Bsgx{=b`v^vA2>XWA}e0As5CX2BO||Mg=&T=FKtNjxlM`a%eo)# z9y4@cd&it+k1Z~>@reu@KW-lgKHqs0U1mSY?E=QQ8k!&*lvqV5CxaqShU5N)FOuhl zs1FYMdw2eaCyUz`1FwIh?CSQ6NZh~JC;5{^bCH*n9Tka&6IS}%GyKFMd=q%&2303$ ztQq4t*yFMkmv58V3Ti9Ns_q@z6f1KCM>HhkNb)8VR1&`!$_W~vw@Q?-S#`snnZPp) z+D#xFg#)Mc?$nJ|QwKHX$|amut&npABeoH!LMqs)BuC)a=ERblp$Ce}s;t-{ zgS(_8HHx4=JG1dZT6iUr=DGc+Hq{a29rtz0LZ)W25GKrGKiF0SFVymI6ZlPqrM%a8 z{WsYX&~RkRvE`5KjUQ!+ROuEIx;p;gBu-tD4GH|#~ z^BOG2JWTi(UAw?0992zaUcAwQa*)xYsG9dEPjA$86AVvm{+(>zsXrNKy}nFy(Tj|q zE`VaX>)J851qcyms{hC=f$HjkfezkiVNp$}2=LPEHCJgY<|H)QY@nC-xx>HGMO$k7{B>R~dD``w~wKt6)8)c=?2Pm zP~2I-*fZ^F-$XiO*|Oxzj|qt^rA?tOKdmX&!~gj5PO89;18dD|)dIvLx5lX5rwHof z?sI!Qgf3D590Y93;$ysu#M0yQFRTm1qSK8l!`ZH_fxKM6IQPMwdv9!j?R2F@f_zd* zJt*}%c48|jgq8`m6_Ie;6p_+KCDx4vMRSP&JlkkxL=1jN-K!d43eEFQ5;xZN2Uaay z(vT(r0k{(1_OBC00l+SQbBMf)FhFXOirDT9Rj8|slhws!9ZxW;yj_V3l4P9=0w4?a zq?WQ+hs{V|$+V8Vn-9V% z1vajKf-5INr+phIj_fu zOy)w1YMUD}r1|;1!I;G8OyG!zXcMPo~kY+!7KpbU1C4SNzbe2 z8Chmn<3%3L!+4*Ofu0bU@Z#1-@xvOf8NxQJKGrC)5Z-K|L$Qay#HdZG-Kdpj^C_L_ zZ1ApGfRZ3F)WesM>E_kGbgjUo0o0|A0Jx{dshEPX*7*bs<;gV^G(sEtr$6fRN9VF( z$p56LcuJUoL!}m?8)lpR%!o~#*$;hyBb+MyaZQGS*e4Pk4oj`G6u`$r~0Mg z>zDgCn-RGKz9k5UgHhen`R6C#W6w&?JmabJmv$E()m&E$#{?thHwlJ?l z`0igOKab1r`~8n{9@Vh-zkpxZ8UCY!4+|61|M(8*0<^_^bRyk6p!)n`?nKbrBN9L+ z(24WKD7vjFW_gRK9lr=YgdHOkT}yF6qCsyaz00~_hj4!TBBJB@4v$R4Fa>$oyMNN| zyj^+yxtTi2_0jo$#c)K*0>c|TTJdOu9zb=)AWW~jzrVPfL6{D1hx+aVdwENgwnriR ziP^z-iyry0V?MjU{&8*(YT3M^N|wQ`ZmAqaD5a+IQLe94=or5m)EOjCef<%AZ$G)V zxDuX1~QzavFB;`aHqA*wwQrT+TC zpXv+v_VL?}fU2dpx1a$MApMM>uYPLhZH`?D8$3s4GOP-&V zO>CCHp78{Ws;JB4)(12|ByZ){7T4cqh=PGvA^cNBJG!2MhbdWqIWOSPx)rhh5Ky}x zF6kE6$=r`JoGpL?T+P86CeDh8rkru{KQ<7#d2_TP+7(4}z^v2~UKHB*IJTPLEykf! z*44<`g=)RFsVz{X@MWL9rkoIYbbiJ=)=>|YI%Ip6zXa#K7Mj(@wG`yvInyfvsUP)SWU?t!`PhLzhgX9^wa+#W!9iMaw$GNvl8|GC+Wpi4$FmC>+I;J?LtSCNNf$ zalAW{b!FVyY)*7i(K|4qz*qK)Zoa@4+F@^NYJ&`*aj8B0{xOTPJmbER`G_)|^(p;@ z1<9WvZ{i#buoPkm-b7yEvacdO8nc;x*v>+=c>&?ZVk3{D0G$C1cCmn+Bj*hT$Yfxj z@o#2Mg<{Ncn9%Vs7hqbs4g=N2~#7q2jQ>tuKyW0}AP#IZ?gH>Ye z2E}pP!6iPjPi!dENzFPznU9c~_hQ{?XF#xL-_MZ6qg+K^2jg0+3v8)IFApXK;rgn`MUK@`BQTo07g zGAC=|z=$w}*-!^S?=Cc-AsGi@bl9JDMvPa!R+testZpCq;Xn(DA9+<+Yd;jnqmKBL zCzCQ35MS;gT*e0U!bcZpJ9(;!h)0q=30}RGu&pbK_I3R$%PzG{#;E^dO*z?=j)Hnc zZcHLe;%A8WRvWg7DdQ^w_q)2k_=~m0Jr|51C9)xp;gzYdwF^rpfH$kB{N=tBqj@4m z+DExx*ty2=66ucgFDBki@PX**0*25mT5W+^rlV#mr)cUmW*x6zjX%H|^dRj-#N{^F zeRg?_YwQ7I1vp6cQ&fTkI!=2sOlH}?mQ1V$s>8(oYr@4NYRmM>&3nhiC z8Mt~HktCysf}gq+4})yg*uobU2Gds{wltn{MTDeq?fo(o+QiqyTPk5{^@n?;BjFQE zq@=#$p8h-aB3Gax9qpq^T-EqWA-@d_#neZnVAC*$%*8-2&SzntXAxvMD2!D{H(MXT z8Hq5TcNzY;v1AP8OoG@N#rv|CHm|zjb#YO{)91*i5iUuG;9GBGLR9gql4>}!{ zWVl;fCD)AU#XKDpz&ATPY#F{Pvb(V8=^66e8I3-RH3)ITngxO3lGe*WELQ<{u&s>4 zkn4Z=wof+}jl=w#RHF;oS)ZpY@|4}U0lR=ef`E%3BU89w+{hmZpps&jlpsA3F_}OO zyhf-+tp7v<{|N+A?W7D&Ey<=@%rNM`NLC|isAZYYFotzd$ZR-}j`rPX#I7L=Sh<86 zgKwp)(Le9EV!;ITqr4MTB#ALl%ZnOxl<=eWD)qts!WG9V*q3G>O8rZb!YBhOTfhVL zd)PN@W&ZcM>V#iBZgx5H%@gJ^$MAfdCbfWUDRn^E{qYG>K0vx-|4}c~z}XpvUG`po zR;!%pOU@fkp;EupaxEV#B6CdgZ>sp}q$OD+&yY#unS4E#2qYh2+-tC3Z0bGCHwZ}C z%kS(zvZK9OIfoyLi_Xhc_nOl?Ql68F4LV3dEKdPOl`66zE2jc5^c4nu>LQS|3%VSa z>HCK%ZGqv@7H|)ZF-GX^#>UOD-*5+ld=qpbjHUpk)U_it15k6)QxBpY9W9KO#80hp zG(jb1hy0J7Sb3LYzF(ob-qAyoPrEa&MB+um*=a&KVc-Rbz5|usk8Q^{R`v^S<75M* z^k% z+5H%f$)xW&xYIM=LsC&B!&|L#(Y3}Fgmx;N_QMfQ;rr4koMl>-Nh5R?I;SmK0OckV z(kN%CIMnPo%d|BvPhysoTiQb*6R4!pBTj{%4S`7D!bErkwC8{K5!eiA}ji3=ls=smTs4W+ps^SmnQn)~?(KoP;MT=Dpt#Kh6 zJQPfc!(|5EN*N&CF`6g-R6tSguH+?| zMU(T%(J!x)C)^Z&+pI9e39-r@a4pHb6rwdzcb-}L*q2N!I@ns$s^Gu-FYAmjLorTr zIcwxD+|n)|xx^ea)1cJL-O5OIgcr+}m=wk^??4)r+2-viMYdG-3hB~#FaD_X)$2`C z4#{R7w_g}=l7HuY5l|{5CQH##NU1(6*#DTDyrCoMY#Kh9JcHAzuk)P17n?Bu$(V$> zQK$u}S&X1FbGIUx^r4a?8jj5d%5oHL42tSWOdS!F*yD3Tet+d~S9!tGRFV!5QgN>P zM>cvu4pbK`=#P(fRR+R#Fb=hM@)Llk<->zDRF3R29>jVBW*QN~SE~DM28gFh-2y^n z3CIE}5$Sf&0<|d8!)K#Wi^@5b5Q|J|Z@9;5pbMj5UY~awFm192Lqa5`ezrjB$C1?D z%;80lbe}mauj8X!S4gq%ffLJ<93n!bTtwnZ2LF5B(R@L&S{3RLJTG{R2gJ58*%X!7 z!mnFE)qWrSbr)?Yw0`jMW1`l6NLOTcGer*EaytEcBgRv`WTk)LFOeqWE_~5F7r<@r zAeoefzDYftz>$|de*TG13E1Xu^stLE{OpIB?Rt!GvyS$dP`krsv#V@h^Uj`=dj8+p zY%v6tTh+!<8|f3DG7d>Pv+OOynU>P(b~ZCOQCnpF$+!Jwz#w{ejJl9zl~mqgIR0oItDwInVa zW|#e5R^{EdHq9Twsm9PKAeoshO6?Zs<-(jm;D(ti52}msU5)9@&%1w^hJ#+03lGcs?Sj+UF6}w*N+1r;;BQ&4W&|gy>;9>4aGx$wqtgqgQxq0Ut+fX zy;Jnjm%ld$HEZUjE!w&+(O&dEwcBpHgp-Pmmzel+dDK;fi&UB(_a*yx5`|E8V!;dw zDUr{Ph7Rapr)U&=mLXP@!VUl+CUcI#ucUnqOnLC3yoW>cn}rs6&zL}s z&3-Fs{N}Rgd$k+v-QrbIwbT9G2+C$b=S@Yn#A=;Fkas|JQ6t@D3IblXjIY$a7JHZF zfIK_M#r!kF{KVxkRBbKz^M!RYqMf}JSDEJC{(8lN4=ozN1N+E{aViWsI${$W44-6ToPU^ z(4^HiUxRWbBVGyLsZ6S?;bd%!&7u;X~7GKjbO{6+`YD zB56en|EO?fReTed(LS!}a3&%1Y?sfcPt(<%(q_lS5e9YSRE#xii6~_=vNw`KAi~40iSmV9@$&ef>)1M8J?yT+1 zeD3$&A{~xLH<&&GpRx}!tzwcEek0ZW4&_1%yvRt2`bBvuce6c9iky8m)zLB;&d7Yw zJ_!qYY1v^KXS+7wIX>_A&9|MH)2Vh~!fqP4obXWbQ5$-gxAPRulNh?TKRKbbP7@&# z638IQ1LiI5h}l5XU%s#x6n85x59vP9$zgsjB70?~m9{u7{R@XuspZ$p`~!wy%1qDCo-e1gJ@5Y#3^M*l6*LxB z*8k^-F&0DIhSc>z{RonL+zk`}56%Pbh0|&qf0N4cK>)_|DND7 z*PmOYRis>s|I(8i9QRK2kA8$SE}wrWx_sL>FcTMrfGQt({6aK>hPPZDhQyTYNfpZr3gk{-O zUgD>-rvr5&(s_s6Z(k2H{#=!_J$(Le4<;@;r8E&uf=rG4j`_jGu`$bx%_ngF9%J*@ z6Z{VDApRdmEhpIL$DL+jAEdJz-`pt2NVxXzuiAwjxt{L&86~>8Hsy>3WWzF)<%U}3 zc=aP*U6k~usSPa(EdN`r6KhmxNP2&n{fs|lkT`MS=F`!9<-uk2&{H?zNFqBw_lV8s z$p4<%zNn^}V1qtZAUIc7>PaWv%lK||%AUda{Pk~ZY1NZWMU~2KG2>7Pk^r0+jCU6J z#(cjelyy? zDx|b`gto@VO{(nkn_tr&%ad}$L~*rX43NEY#hB4_@b`>}>&=$C{;thlcQ}x1UPMGzjU#ij zjhd(iv2KJD4OjLju=Nq=!DYi)P^0AB3S$fgzi( zLqp|FM4?nB>WoN&uZh^O%$m$}tITIYCKXJIbxs%Iz!spRVzvW$Mqg9kLeFg3s-jj* zcoS$x1mBnuAgMR4zKYaMH4Fis0lSLHXhqY~U{)wlK{aFjtMT+fSnw~Xd>{Al-Lp5W z_6v~8R_dY)lnH7p)Ohu0J{oX!d+AFITIHs9>~l1XJVSXH$2am_nSpoWn_k+(u4`1W+^Y< zpmMvskY;2_!znUOB(l#(m6YtVc-QJzR4&>TApdMp+HM3@3#@U9y%qW6FS2VPgN)+< zzRDvd2%KFjkJtPlQ#?T?@0?Rl*%sm&_vz&?Xapk@#b^}9JO%dC}lagMxkOg!S*taPIbmxAW;+) zCAJFhHn={*Gk7mX#)8;>G^5VEMMS?({+#ZD;elqCOit<(62df0S|*n(kmQRN<%D9` zyRa;(l#CE*dBv@Ica`K*-Iq(_{Gv!G*^8iu5oFqegc2;t9($C1f<5RSgG#A01$w?D zl)ywbG%ApskaDf{`vR}#$mBWQT-lb~xa~|f80_8QzU+jcEW`>_ox>{zV`GtZWgsyZ zGi7C>&&P4G-9ryBG{|aC%ep1V)3@FrokeL*cicT zf|uJWU>_w6^u(;(FRX9ULDjRMvEuoj&iB1MY1;M-G=ZyoStb{Cvh%<+KQlsDSZpMR z-YQ>(ZW$3&NzfK)myfqfs&W%w;riE&9}4_|aKR`TJF5cbe90))>j8z{U+5EAQQ&Lz zDgrICpnjO0puUbb&-Z%I)tF@{(|&?Hn;*_FIlAd|{=|GorGv`Qd|sdQmpZDC;iwnO zKC$79a9#SauRR5USz!swZyUpt0Jx)4M%4OOOoYOIWD-sB*9hS$W@vrJJKP?x0U=n> z?MNH5Imp6(BIJ9_svMLwULEog(Dy;AV z%-Xb+;Jgv5Kb&NTvD4H!9X&(+xF}-Ik%@PRFAP65?sT4an;?_%=#{Zozj~?mc{BSo ze9~IC=jcYPB9kMP@rPnHl`Gu-dYfmcb761CPb2K%x+M_M1vG#Q2>-<^Gq==L0nwpX z)e?XZK5X-{c$rLhvY1osHk>)^m2<-O0@2&;4o4|QMp5pJxe1%a8hNK8$s_y&M2$5l z2c51_-A%t{OG7CFg-3FC17YTeKe=D6RlIX>Lj_+)7nK&rkkCmiyY4`<3U=kdrznr; zF;n78sc(+i;OG6TjNqa(CAcnimT0+u-pl04+C++IEX;ww8Ywvc|1kDWO`=2#*6prc zwr$(CciFaW+qP}nwr$(Ct*=hM+}jc7p(Fo5M&v_g&Nb&4;ku6;dMwDJa4}5ivp_$THllhjo{t0l}V;E9lW|Jk(GIUU>%oT~yB;R$na$-#h8(ul}t?(5C9 zYY@+eRuXwma4}sE1@A~v0Pzv|o-P@oAT-@1cc=n3V7_g|g)c(RMt+Be<}+A5ofJ3< zAp%;)!T(1`v0y=RQ{>mkO&+*`Lc!wlBr*J_UyY!;ouf77*kcP^pDgEivsqO_S6AR0 z4P^syof{ozg3I}DP1yBzr*kZ)^YroLfa0 znG1bbWJKJE12)2a8(e=;u&_Q_?Hu{N;$cMRMXI(XO1{&W_!x#ZOBE2Hz=#~p_(oW& z6cjVjj#;eKh1K#zY*IZophWY6RoL-z;EOuzO2R%9(jx|xO;Q(C`gX4P#2(QaqG}ic z2p$Itq-nBTzMUmR2o!ZjX5zUd{a>?&v2nknJWqBs^W=WahO+Z2{Q!gT=|SQ5+qmKa zse}rCNZ@;IeMyxxZdT-a5++}0J^Qr;*S5_7;0n<4Wv0O*2)}E-#xR zH6`}+kQC-xNJ*q@a``MxwIB63bp*3Qr9jiAM6c|QJhXVE6lWAA=Rz|#hFK<_g0gkR zRjY&dM%U5-?INRlUe@4FCAxp<`BmZhqTg9avj5DFvRo^qDY}#VMFKaG{~?(ck$XF5 z+~2KIl#?_(WCZd*w2%UivG8o^`MynC2cIPg2pL?@SH)qtw2m~MfhI5oMr}}xNtK5$ zyUF`zt&Pz0-E4CZ?Jed(R|YiJ|0!t})c^cmqDMgR3YI2i@>UtI*u56HlUzos>p@}C7K1btoA%sKJ8Q-Cfudh4D>!44+l)9gB7?eJOvFggn_Lr_ zD0J39tdEb}kWHXOSr|Co4OYbyY0B0CaiBY61y0jo14X>xBnl1(yc_fwWc(TpAN3K_ z9^9fnIS@vj;?W5s-TKHe49^>7<_EX=DrJrnETONNT=!OZLH52bMSEV8rF~>d8h)=s zs)MgkgS=`LnQ3A#hv^%(%oaE;0VFVDo8$4a#(8f;eOB|5@_2r#(t0V_sj2H0T55qX^i!_r^ zr-3Ko`^q=trp4I|&3;1axTWwae6&iH%T%tOoVXq?N7fkuIMSjFqh#wXl0L`LlzzgN zK#H?hyZ%b;Yn*~G0NXRiAfyVzWGT^52XLaj^t-*CM%W{UrCk|iU6V1ap}Yjxx!hK- z4J~+gbcu4G5ZXHghGs2+ajZD%9#v*u0tcWR5CTK#oP<+ajDR+;^a1*u33sg@B2>fo z@R-%xiNSHzh;7}f@w)ngQALh*X(C$k{ZXBA;&jfFG)5 zE8zi)C^$KoET_@DDbx9`J}qbA->U7hr`|k3mfF=lrcl()CJqC8cgrFPr2>*+4#xy$0SAfV4FX+n*HHCM=5^7U>!jwmAD(i!)~pS zX+xn#c3HP_dFHuGdYar-e6zIx{KgwW0F5ZQ_q3 zsr~EA$s<`!IxLbx_9T40kHru}@O? zW)QUX7J+i0j&P7TxUN;D&-ssE83LZbh#n#&NpX^^GT#w)m+T&oYuNVHKye{#;oI)x zX0iHcCo=VLnolh1%SY_eDDmh{E077;A51+`cJs|YS4U~3Ol(3gkLF}th({IDmT2v< zj~tnq_vSs)a#+<0pU~%Bk*8QLVS>%x+Vcu2;?v1)l}?sj3LKjs@J5jhOLAX<-buz< zBUU`;9!2le1eFAh-f(MGf86Etp%fPjr|_(3ZMF$oNcitqhI5OkoCwwYPDgLxQnSN{ zFr8iblxAS=dmKPh4M_19N{G9qOyu_dv@M-z9o;B0?CurV;#;gI`h*l5?n0N9H8CBL z+}($AdD-`@2l@Y)nO#?AAQSMTS=Q`qYWT5k>AIGgzJlWFmq9#2bVBYmj(F}4R#>wQ zuLZ}hm`(BV{2`o*z4A>cbMu(cYrte5xY?s=9+?J5rPS6DB|vi0N-u1|dPus%CClcs zSYM-`9Xa+cSK|i{FPk=k@g^*`8#U0KGlZUET{|_Iy(_?ekOg#kPa~C|xqB8=e&Uc--Ci-Nlxb6-FvHsYK@jT>MLfvD&xns35ykBS=Da#aDk3*`Dy$!BIKHB7 zP{J!38EIEgEPVE>Sc;&3XZ*^2l%zxZBkxXw)(SCIh z(`u31w>Z-2SrsJ|{klR*$<3iNcI6H%Y}4_sl2TzEmoZk7V8rF+mi0*yuu7eCH|^5w zeNi`Y)m5pZ9Y)NrVb5&g!PJxG^!avy`wfb+#gg>j;vlB~%Oa79j{Sc@Ynn7CrY~B5 zd*bBxfA3Dc0sN^T93dQ8PuGyO4u29H7t|)pYjng4$;6WrRv7~V0zT`g(-6jDRE{1u z#Il9nNoBONIwK@POKx-)f_h4Re$>3apGM9~a<0U}iNnccc(Y3y8Y57?iIxbmIKEnc zE(ih_Rmgw2G_pKF@hWB$FOM(SHUCM2tiB)8zB4?*ZQd@_%#ujmwP)(NGHXsBQ=}Dy z)5{|hSktmS3x9Sjt2NTHkM|r3-we86wQMRtB~wY~{7I%0j+l4pQi*t_RJtMQ1-$V0 zo)!jP+2xFaeSTg?#!g#B_2z$TEn%RND#2(((%T4jzue2uc%$9_;a+-wJO57@^vk`} z5qkf=7-MT$&At2Zk@?~Jx(CQ9(#&@#5&F%7`1}|CB|p{wJ|&F}>t2%HZ9{0)2d?HsK7_7Nsq0o<(X=>S^=!_x`kTr=Xm= zPH`i#Zr+h79h*39L%Na%_=tL(>hC8@RuB=6hj=k`jrFXArj5yH22dloAq1>b0W8NknOqGbAk=3T zN%&(@zVd?q-m{2iCN%1Bx_!~@u6Gn}TDV@#xZ~ehp-r^7XAD_`3qfmwo>4=*bIdf8 z&{7x6lCdVd+)@KvAX74UJ{90<2Fqzfn}k=NznbBxRFqe4M((@~RWo*8tYxJ*!u*H?EX8Rhwz`t+w{A>HrTeWFl^P) zR{4+4kRJ`)kMiDszs(`JF2%E}zZsCr!pIB{5CIv%Z1Rj2BZ$=>mMKJw+LZpBy-iY$ zlJPP@-X6j?_}-+NCrV)$9o+D{aPqg@51ae+HF!E}Sf!e0I)O!CFO5f9T=q$FTA#1B zlzYR+VHF`|L4v`bTkY-vZ4?$}L%G4xlO7|IgUPm};OKAuay_m5(KV`#^h)!$H zPHlVwDl572=oYkT;&d~U z;`?!Hc4#r_UB7B>t0B~&#kf9lr8^RCw7pXJk+U`%K~QN77CfGg)&b1e&{;*u*`~)> z719-g1lFU-rEy%l^)q+^qw*h=R4Ge3PUujCF>=NbgkSyo99FK_Cvtyj-Vwx64%`hH zFEY#LHAiYK?}bKa!&t@BsOetDtz{UI5I%RA)3plS4~1}{zefHEI{_S}&>PmwNvReW z+)`0_srKger)D3gCyt9U#7ri0SsQk8Xdv6krC(#{e@@}_qGD%WiIM} z;Ina=51!M0F~&K?5yTU{XjF*aC{BeeQjXw^HOk-wClP?|7fg@ zV03mtgED7Q?WW*;G3G6oyc?p6pKKOzcHK}bY+h+F9ZwZ*3z$bQ%Kc0BUS8r>H&#Rf08%|I1s~~SBa&ULV zCg%TCy|H%=D~}KcQpM5Y`C5Yc9umr4B5?Z5P1n-^zukUltZOT75WSY%4IT>Ix7$h! z5xbWqHpaq;2$H&~R3UNG?VOX%=t0rBE&XgA-cGx@log>xTMEowPgP=a9;Fn*?t8bj z5d`srm(-=BwKHLveGJy(2H}NtWM~$9E+%ngQP`I?&&Q+?GF+2_`m}fxrkus~jzN}& zHd`LFf_}=6r56bOM z`~f9K)N1RJ*&IqzR!WEtWO1of$nQ4AO@Be9uh|9dh@b|%FdS?Eo=Qwz`^6oC`xZoo zJVwG&+iUFZMeo5CebiV_0vTtcWGN;N6}(4Pm;*N#_&Wi?n7}C7DHYZ#EQLof*vVE^ zP=r_Y?vu!>+y&{?%U@A66zDPFqLCaCr-1yPY{?=nCKuAe#uuWafV?H!(gnP_j(N%G z*iqZ~1ylEmwJ3Z)uH!5FMNlc*UzOr)ptSCyS&gBe1@tF3V3Zh7v>JJM?n%IMN z1KVo=#$U^YAFiT#kyXt>1JkvH<;y$LmaRdU6z8pEl_zE2stBfOcTB`eg;4#gg7Pi* zn}PIcnZr%1DbpZD`NgSG=)L^;>dND2OEz~&BURIi*U-6Kg(4FtZ)xC^gxaiw$*q4k~O?w8mc9W7vzgjx#{kX#6^@aui_p8HQiCSx~cX3RJGR zYZ6s6KDz$iZosp{a!uSWS-O^^g~MAU@VPws!vVK+Q^^;?8TeeQd!;OF59Dk2zl#YCe61Ten!mVX&Mlj&OV( zr)3`SJ_eDjYQ=hWR{LoPaahaX7^-m(d#oBgD3zKfi*lT!^Zl)%Fi-+}2Hqp-bbKA{ zg+*<=(dk|`MVgiALn_^EYqAS)Wm=n?L%+zed@S-zK4hK6AXYSf@@oJd!LuJDUe7we zn1!yt{}@MHb5b%bYz*U~iM#<#G*@o>*9HE%6FRKfncHbQHXK|2MN304%zfYOwE8@6$kmds(mjwaX$>p$iV$3ood1%XK$c6I zXJe8isKUlbFc2U1gdFY~&>W#<>M2@81u4~eXXo#Y{38}Dacg^Ck@mFk{_>%z%b@j$DMVJi_qkF31vtam)+otaq(^>9(y7KI>i#KkmXnd_?4L|^ zqchkg>3Khqj!6!#Nq#R9p+MD(nO7tEA!nlXMKI2+`w>U0bA5$LGV}RF2a8c!Y217r zBmdI&)OyiF8O78hT?^GJGx5Hlcw_Wv zGJJGaj*MB>z|h1la;dULjY~yNq1$+7%9LYOW(s~6Wz{>yUvkQb-~M1&QRh??@sK)6 z&RcI(tr{)_b@;pKu37}yfCZA>S0#sicSzH8r>clGOy%@PB_fc-c?iYLYO5}7!#$i! zCkvo2Qx)B}>M$^hky=pD=kUwkS4c+(;F6WJJdg{}Qb(SMtX5jmjh{9q3)GBrsGix{g8Na-!3p4 z`G|W(?jL5WSNQORq4HtgCoDTfcGo+7b2X==qyp@}OJr;YYA)mzj=zn_VePkjbz4@L z6$0T)i`$=DaSyy)>6p5OL3K!9)_%jCrG#Jk1>Xy*%w|!g=A4-rx#&$`2cY}AIj zk|`}ibMK3^UyFcfZXquZRj8J*WQh&ru4=X`)It=VMRVpdrcA1U=^9e%MMLlaqy zjo5S~`LSbvpSv~MmiVV&N1AQN)`o?WykKI10->w7K?0dg^gv^w8_A}ydM!JNj^v9y zTD&qC^?Y2uDzV!Of6#?B+*(yK+MMd{PuWtS&pq{#XNRU#?8x;c#EaxI#ymefYsxDxEXP-GT81&Kc_@GTCdd{cJ!?9Bd>@leFPECj3ni3tWqJ9B=$h}{Ifv*- ze=r;*Ug(H$dJv=FzrhyH6}{OMM&=!r>9g@y*{e!%4I!GryLh&h6pJFzK|0=AL< zDdRk3f$#ZopI^2fuDJi&De1}acGJrNXx6h3sP;VH;J=PWw!H;b=HXSRH8T zxt78#7eh<89K7Y+AiXcDq`W!-6Z#}WF@`bj@2x2ffTBEWX$X-8`!s1SRf@>7wyxI>sZb`zKfvO49B(B8gXgd+wgx?oigC4w&KvAuo#6x2A|B=8Fbcqutmd7kg zR;7I^ZJi8=rQ1!D%n?k`ZCV{`5ZETb?BlYCE0SRim^GkFvPjyW7w)8?)=bZoiYpK; zz0R`O)X@O$C&@mQN(-Z$Ww1n_S$M2MkDO4xW^zXR)jKzv%}?|L@Bu`9lA|V_8XqU; zo^oFl@fY zW+)jckph*xL6~*0NG0Vo^;HuZYg_6Rn!pXu*DkO!BTh_&B5!l*~J5d=Y75fsZhR zJz;qQYZTSeG@J5N;gnclDXEOsRyV8?Ai<9Oy>G6QDj0^rTYlJEbVT|gJ*W&v0#)S- zvt&^9>E%UPP|>=yT#>RPx>9sNIKRA6aC=#_CDygsz)+4x`T^9bW-@)CJ)k*%&*`;f zxKz<(rHrJSS2`tP%6KASo0lVgU4XHWiQ8oB`#i8MURvB_H_6$o5g5xhabaw`kEQ3B za3P4@iJCD$R;id&u=NTKY61v{L@@msW3u}#-u>wIr~MUW z*7=^zq}WZ$2m;a%oqAR6c`>np^6n-UtI(2mLxYhX4d7-mdjU1aWa$Y}fvU_zS&ADe zvUNa;pWBUOkSNilM&t&VM6zV0BX|JQ?7@^oyu^L-M!U*6`QQr8ngc4J%qpp^(){Pj zB#wyN6^%p3v5;5yf@WezdM%c^f=h^vh8)OXx~RzXGq}moK0th|CqumE1ax?|;df!H!lcm&(Q)*C1lH{hv&?6wm@Os^FRmrWB;C=}EO`?^B)C-NsP z?n=%EZbf<-7}OP)vg_Vm2u0=78E7AM2zhppEk)Q zb*7U*q}$)-rv}j91gIb^y(6R(_cvM#MpxnCK_9_>kSntc^-&FMyjip>(EL>))&3J; zonoq`>Hcg6((zTnk|Flsleujj3i&^YoBO$w)%afvfBx3-44o3b~v5U{v4&K z4=;TKp)x{9SQ#|s2;I2hzxZQNJ4?iwicGxxJAv>AKSq}{C7$PuyTg;YOgZXM_kq?r zO9>1+xi!mbQYzY3uVftG>vW%Tu*V9P0MD@h*4wfJQyEArdB`@RVJIHT4!G#nGX7H_ zsOM0Me29+$tb}AVn(w2f$guUw7blO$lQMCNGxtX_Lc zWfqncy#)jMAU;Ojt5G&$eLA44?eJ65ND+raa9sYQL za-N(@$;6)hJYeGync%HvoHk`BGXG~)W^={fwE{u7{ODgYDcQqhrE#ss>|Sl1{|AR1 zr&|2YkQTvi_<~1yZWAao}*u<84bolc)iQ>tOYF4c%r3DHrGJYhMkwi zrK;s@YBmz|-fb!{nx*%$B;g1Q71a){LA?5=4?;q1ehZqtcM%V-;a^R`l@6Xo@e_p| zY7T~u;NYYmDsD6jY_fqKo<@(@kTRq1^U8VKjK$Ezw}J=fsJR6K&%wb znU?mR&v8o4*Q(^*94CmCZ*q6hQ&XN)s5~{*0YzvI!IxCQvtVx|N-pRwQ0w`8z)D*> zYWPj`jCQD7Z>zt-UP!n0SxTY8Qo?^~HX&4BuA2)@B*aItAn?f~2UMohO>eF}1Vx9D z6_PViUfJnR!hrZq?oE@^dHyk^Y!y2Ebgmk~425WmfyBc)2~*aYm28_w91G(134>|9 zajas$fuZ9zg}yq5_VSJdRYeGaWpssYzNE~wCjWkLASgvFv&Ysb67bgy@W%=gfqH3J z0zi7`s^IE;Z6{$`bjd2lnrw&7omiU-VwqM?i_UA~GIl=DfJ9k4lIJMCgl||0^ayp< zUcl)&gGBmFuB`v4=^{G=rq&)Z!uQDwlF*?+2!ga&;OzsJ!)4scf|hmjib0>`aWX}z zT(rB&bb?!0KY|o>uq#rK7B@QLat+F=eP26h47#*7??`^^A2NON^uC_aXMslE%`)s`Y;s z9gffe|4}*D5r2AHzYo*p3;k%sUAO60@~4|pYhaBCpqyhCtIBDI1fUL-ekI%>r5Y~5 z7AhciYy;Dw$Z80u`M}_nYA^3l{)tyD+Qevjv^@x8x2Vh^d=W~;P* z<2fv%2fU5ntsdgG0e&t*aC<;IS+O{e_DtZn{bv!TW)h)J?t8mzK%s1i@hXQUrNar- zcde66Rc_E^U@I9c?uDCxn(OU_nbVqSqFeNYW7*lR?%GSZc&hLimuM?^GO&t+&Te{zXC*O|As^Y_ye<0LH10Tqmi7s`pk#;z*72oT59AqGLl zlkMOsADU0&NBbgM2Bz2SF7=ghU(ebqF{Faqk#6|J^6M47KS^>I#6;wB#-ojszO&$2 zAR6|@B2ry4!egbArpQB{PqEWy{s_q)pa@^S!}7Ck$cYnML)!gT{e^kr%%9kJgP&qe zXCmPnT$eFyPFNL(3z_$vu*?up3Y!N;E%6O61=i}Xrgb9jRE>>(^q0U9RgU0VcD>@R zQ%+jYPGPfB9VB6&=5LID+nb!nPE^~{(*R(+)ZU$i1JnO9-rJQK_OkxjI?Ou zjWC?;GGk{3T9-!yp2&i{Xx6M(dLb{ovv`uF_ONpmfO!sau$uQkvk=6cH}UVKb6!E0(EPuwco9#iBQ&lyh3lC z2hX4Ja~%6iB%!J$UA~|C#t*L)E0#%<#%Agc&6c}JPm1$Md6kOjfM+wg#*Q}XZSs?D z^HgYpU&=rSK4@YFCxktoI=|-%oxf`)ga=tp-$bynI4!%yH$o1#?u)UduP&(BAL zGVTsKT76}h^NfpmDE>i}^34u{II{IlF}N(>tu(O8u}Q2DEmIIhK^EiH^*(#&La=yN z?*zz=s4{XrY7&``aS9i}>7;vm)b)!IFWNPcG4Hk)$N{A{qWALIH=iGr;IrZ?gtt|;&GGJcpl+nnqcE83jWUFw z6|13n0^g&U;ab3L?MXV=^fIU=^OS_L;HGYPlH^o@fX1K)IZSo_H2c1nMC*w$&5-(F>)OF~hW;l8 zj4$vfpapLnKAtKjNwvlAyG?-@7LAs08SdTW^_r3{NPhX;NMBpl{r+EHm(%h;ONOi? zM+lahvn!%9-DGXWSEFI_7h1wkTLuuX-W?HD+9@3|Ht+BIke|OSN7%;yCAeVtzYSs- z=~@1Fa4}I$*!CYL^Cw`-zeNq-Jz-x--%F4)t=OQOCd!OSedV_=Q37H)ili(17bc8g zn~fq=Vfm1dL>ZsVU7~$nHg-3A7Al_1Ztob}PwwvT2DhJ!mId0Lbi`2N&_5+M7iWNz z`GK5%n!V!-EgL=40>16OY>;p~J&@q2bZhQn@55aX&mab zxUsm>Ii;^D;aWlKO4gt%p)%VC7ZFcRQ@`FGSKPXvSe{P`oe56oR1Ud(=S&U>i(KPX zG52=w`y^7rLsF^EPEO0;J zl}pI@2X2Y*e}an&&O;RVpPvsgjSjS$)1M#iuZPDC$PcJmAPX5gX$i3I%ZIGx!-wzT zr)9#`VCIC=~*6G?gsP%x127_BZdEN*{vfT#32hha>wCib>h8nWZFQbgWN zBO?qKm2ZkktPBSa)mv_iF21B=)frb#1Nj1e`I!L(`V^d zwCWa0!9?r5AwBcScAW|zQyA!^$vyHM9+9@j)WkY)XWn)c;qKGF*N%C9<1>8cSWW?n zTN{vphm`+QG+{(z1%}Aq+?T}#@g2hH0H?0gM{iUpSLD82TA|!rU0E?Ds$zo1s`)_{ zG1h1cDZBRSELH_#{#M{aFjEcKT>v=aIQ}j`u=ZjRH~`fxH<&Lh_*l$#9jcobX`Rl$ zAd-X8?Vy0W@sxh2#Shvc_hS(!Jj^<8KRDT>G?^39&Z~s1TiH5o1KdWv`0U1c*CyHP z$b>3etWznX_fx{+0S?-n1J);a%*((6;4G2yPYE8dRKsNDEJJQB#!kTRn@qS*nIv>LxaQT4OT-7xVZ3g`$mz7LiP=U z(2If&8ilJ|oRO-Wfckz)=(ucZgR%E7-Q*RB&21w!2-@Lbe_HA?FGYC`uccJGJu@wj zAYO^czLWDcY=r-INxB3o1#M3F@n8dnIGfHqeyZIBa`^6bNWmq>Mu|TU*5+!)1Hfc zY|e;V#89vp_HSM4r9G1J4pX<5`-t6^>Q+YOC!!&K@uo>Zb~Dp?5r18-)^xUDX$xKD zE+9X17>OsAiTjRBe6ttFxVWnccHWBQ%LK@7#7aXTKkkaNd5hU=sJVz~Gv)UrCHQI; zK>DAwF(gpJ>e@1gMKv8L5huVo3DBM0U3U=Pi)ZlQDHAne4lyEzq+Pq$ikzqoMv0!i zkVJl&7w)H3yU&rqnNRGWpoaCg20GT8pkug2P@uM4RgErcvD`4~&o zTVf=O^8rOE4=$_}9O0}hUO7TJ+Kt%po$uHWr~H@B1kfHY5trQ;4*@#PIC;=cGihWo z$$ieE@j%F^0Ob!;bgxSrH6HT3fPq|Xv-ZM#bVM^+5symXC(V{97472VF4DyE z+$coeSCG8vjO@G=v{A>G&3*@+2w*mU##lqv=R#zdJ7&pH3!P0!&{%!N6Q@ zizH_a+kQOEB4VZ3RJqeG4S%cJ6Q`u9p(+D7wZ>nz4-XNH37~&v%KkS6#_hSR!cQqX zXJeg4xm56^xmD^tj5IxVol;<>r8TxdJ*~Z(Xu;T2rnIa!0gGhW0jNU5&TeUY2AQUKTCzHR3s%+m+7V22d_+7 zjwnR{Da0&Rd-`Rrx#gJq)!<9IBoAEI=nEo+VQgT>OPFM*T6c8Uu&zIh!ScB};Q4O@ zAr9xW!ZLD`Ymv(c9*KlbZ0mek>`y#;GqNC(zwZHkMX9-EYqT#xpf{MNr(6hfVBbgv zYKahy4Oo~^;^dn|A~iD}e*iE-KoW~|EhafTiM>uTTaTjRjp^ztLNT(4B86e59mh4K z0w(pSJ&)i6JDwccOFOhC?eKI!qjm2b2{jzXjd&QE@02uJn$@}ng$J&yuH=3zyG+S7OG-kl29g7j{;2R^Eem~K=LE3A z&v8)tu6-oi*~cGD`uR0G}AVSJ)l;bzY88C_Bk@tb%_^19}^;dD5Nkk{jPhD8hIhKzBIkPXGu)5D*J*Ex-eLuN8NA^_*h^$2XSD$IBpiAU9@M9k?3IT|`qPb+N}=gm22lcT7;mIUANR?u z1DLe27X$Z=6}lQLd;t&=CY-} zi#96s+2km?(lu=DyJ)r$;>KVh&N7S0r!>yPSu05Ni+S3jtiKu_K_L?Zy`s%AO``

y2)E>D-q^j z8DYGyC=XgFBO+IE>9F|t0lo!2fZk@Bn$4bbhR#ZwVA4i)Hu;5)C}@KyWvZmKqTZ8% zD6_po#-!7-at*U_TWaGKQ7%rGNMlX1sye%uXe%x9r)o*BDKQ0a!;$tiWZ$S78gkd7 zaVb*oEnD|4TlcZhZpyOM_}H#ENJZ4iHq3dbtR{XrK4r(g#0jXUWIhM%nBXl{@rksMWQW@sIZ69ix|GNQ5X0%MQgasQ~{_9!mrJyPKwFBrTvO z`Q@%2i*({hSiC49RX>uOVjldz6eqf1d=t;G)4g^2XXrIWM+DdssL|vLg!7D;XHNLe zoKbZzistX4pU z_6l>yC(Zr#Rz_p?@|6*&5HHwDZsSpHJOiTVd&xtG!MPh{DZP6Z#8nQ0N6KNo0UE466Y<@iW8(vn#w996dGB6OG0pXdd(U!l@-Uu< zG$?ei^z7*k#GU&sKg?pQ_!X4IvDt@kqz9FfDv=K z>_ZB}Q!bb4MK@cc2RSd;8E%l36ip_`Cpj!#)}ky_MnySpNvr~?I5amWjS(AIkm+(| z`h4aA;5BgKkNG888x+0no923X1(Kgpc=?ntjI=KL(_sIGT0^!QO#si`89V2FWk86c zk9cH^S35l!g6j+7EkYQIQsLE>akh@)F~JUYc9szWey3!7auv%G-aikyuT>Q#&<8fX zK(6w^*;$A<+LaahCY)+FDHIRRU?OSycDEzqOG}cqh+6Vh(tG2IL$FjgmBng)n78r$ z*64M1H*-Q-4ge8nEt-SVHYl<|vh2$v{XyM09xIq=m`c}VAIsxqYAAJ-LDoEdiT=+b zn^+9tm5qAGa;nI?u2uK&k{q8Aq8jU#HEf-<`6@dJpXO>a%Et-=egSRLlvDbj8q954 z3!fW`(PtD}a$*rc_n+bu;R^NuSrscj?ib3IW(^bOb)=@KhVh1kirAljxd#lmcXEc8 zJ|^?mc2RI215BIa(Gx!Cyu-dPa})G}L|j1n&axW>ZkNB#0Z}zLziKkfuauKzInHdv zDku3KRXLZhbI4e=@l~X+`0=45wi8o)qI=|r$<}egpynWY1}Z+_^gETDg@iguC^MWz zg126{4q`CkRTveuyPmvPXhcAV7EfD$Tv(%!vu2y*q+}Iy$4; z$Ow`OdHAwqFI+@(*%f|;4I^4N^2+<@Mnp(EF{mKHa0jkZT66C7aXlOBesanVT@1+P=4*HW=6 znGbeHYhren&pes**mb7CuCYbwMU}S`&qrf$ueK9@p6>uVlEr*~pVyRW4U>E<_%1J+XFtJ|=zugtpCe z{#!)ye;kRh{V$ool;;1(3=w8*MTEQ8?Pb~B==EaslueR%xWhU=++iKtMKEL_Hc~dw zWr8p-Y8`pj*VFdy>HQT6*w*dqN106PbbCX>e&c+5Z+U(njU3JRETHaAI>4sj#!P_z zdX2k$b#(`iM!s}Zruk|9<2C+|O5iVt7wk{Zi3!)|oAAgFPk&B$%)N~B8=U;0AI=15 z;qYA;)K7vQnNEoK*Dgrj5yp4-sA>z7Cw53Q{P4@&p30kAC7Ujm&^?DO7S%Pr%K*Rr z#rq*8b#TN?=k2{&-H)f7S>S&rBEn)bz7@9hu9ludd-AABsGu#itsAJ`-U8>ZE4Up< z6gfRQsgKe+-x}nG=&(CJ9b^Wn&I~?3GeB;YYk;wpVe)G;+!p1+^fv21(e+YJNzTvp}#0e0-J}UrP>X*DuEC*j9 z5st-?gx7Q#QjB}&npl$rZunlhyhBEB&J!o6j%dR^ZwR|O3c9pKq_fn(NALT zdKI4mS(X5Wh6H5K?VyYs0lNPtnnT(oD_#saU~tJyQ=tufe8Dr19(v7Wb2LiC!tud2 zYY6!BX1OX1K8N!Bt>-h=<=y&0V~jO^?N}kzU={LSevC6{fBe~zq_}z6x#zOB$>2>1 znn`l0Ix9sBb?$#12`Q><^j^#!-D>h=4#vo&o4G+7FlVLB^g3LQc@Y@J(7mkWc4Wjw z7rlrs;$jNSH1>e1y3!ebm<&Xv991IAbu{3|e;bHug9oUFC znG!*~{)U3QA^Pb-buRY$onZ#H6Pop|vf5%d3q+yzv{^8pnI@GB(6|>hG93UEcJK5C zxJeqmwbwT_`8}0wEv_I{(*&~u+uZcp}+NiHxp@Ds&R2~MtIr!NK$N>C2YnFQE=pdTCDS;t%# zLc19k9gteukJ;yhq$~0vd(}^AiF6`}q;g9vV+t#`O}$2qEcb~aBdtorBpT}8^Ul~b>3d~u(T|GXDFKr8{muQ zOdu}u0_tEP83Rj&&kN&a6KaI*WUB7K9u6MUC*H|WXi=!6kJd-s;5k5-BW1Q(b_Ro( zm*`M#Hp+i@e%NJU70_nznOGz2VLuyDWotf#H*f(oo(#)n3ij742d+N$Q%nLLsOS;{Es#&(FH*i(YNMV>0_Nr}lO7WHcY z3c_CQ{NeP=^+GemE>PFEie;kgu@8)g{Z}Tnh$N8F25fW)(0=(w&vrSf9Or$ZcM3%_ zJg`Y_R;*RBADK!+rL9ov>rtxPddtiKzXwLlt-S^Od&XEJDVKnqD(&I?{}_9xCQYDi zX}4_KuC6ZQE!(zj+qP}nUAAr8wz_QN>mBFf>>aT#)}NS>BWGqlm9MS=4hzC8xM;n4w#bb`T2* zEqr1kZ_F-=lZVJ47`EyQ^@-W!yKw(x;;aL_c!~3Psd|yIPP8K661k zkn?qLP1~Cxzwr8AD8}a+I8qzMYhl>uCS-4dyYpfFD~}?11v_mS*is5L1W(DK3?y&0 zSd`d~neKv%LJAQ6{+d}|W9Ndi0Pcngw~O$flXEn-`SeikvpCrPZwN9GT|4Yd7Y1#7 zyB*d+uK?1Uf=<1y>OtAP{Kt|*DWZ8#5?0XC(lZkOmXr$>riVGq|25j5E8;tPTgI7E zXY;_Fo7;Jm=uqD4bS=XnHH^1AR5prbQ(MMY%%(BQ99DWn80ZnOzJI6$=3jWqPqKqn zVibqK(znuG1Ci75(d+=&Frr(y1uzewKYDFAipt97Ltc#1y7VzuSBm15?m?DqUPuvU zJU}fT3bjqJWtM@R4A)3+-s-XA5c2$K(26bakOYfSS-vIfmr)6z;1J3@yRMV3+mHi| zmSds?L3{X)@4!V{Bu++s<-|f|4|43NQA$oC-t%E(b{Va|CL7c-w9D5|LLMi=fcU*1 zX&Au}L6VBcH26?+cUKMo|HUpO8J!QY9-t;hB^^3r8^Tn>&${m+)p7&jp!o4j`{a>g zgvY^#$e2Rd50c4gus*3t1WB-I1A77TE>}^^e`a;tOR8`q@U#7T#bTfNq0+Pn&xtYs!)JIAuerx1c%BhN+vXk zcnXWec!2q$+GYAzWKKo}GO(`}pe!@_W|TY9@*LdSWkr!zE?zZ34m{2=WUbk!kM z#Iy}-vIc_p9FFb0kjGRbw?kCT^Rab~(UN?B)RxXLuACxESn-H?=~4NT_^JyD3oW9! zG0^WA&9CvTUQ5&54i8UV{KZ5neJ=CfyTKlF42N+Soy1T$6-;)i!-vttz)4pnzRR zL@OEVaeQ2tShy`ONc!5dI9jZ4 zIE0x$;UW949>x0X?2i2zTq=yxofuR8>SQ!<4AIF+8h@*3r>#^%IF&>M^ei$ZCz73_ z_E&w}1H%%!2$_9c>(TQoYCLbXj;l@LT?F45l{8i?weIeS@5lDKH9aD^o2;lLRaYZm ze4J5WQ%!sGqi_Pu74V7U)Qy%rzu2kaSLj#-6=boTJn~9_43U=-F&1xAua2ahTN*I} z&FDRu*+bIYkI8)@&QoK#T&dMk?{gkWzJZ4H@XUX`rwYqJ^;QSvqRXYg7j{pLHc|dI z7nZ)9s*j{1=ok;Jk5FE*nFh@ne&+$TlO2s=J%8Tm^xf{xR#gvQ4GU-Tgs(TdZh(EC z@tM>=m{9F>P;i6)g?LIHhc(6bnhP^~B1X7q^^1M`E6Fl&syU!&+ebef!Q zO~PW$N-dP{AxD4-noL?vMoy9g!&vgwk}Zva9*{TMoOfv}hIRs-^_>`ic7s-CM=$@@ zA16E+(QxiH=DGH+LD)1;`HPqbHLlFUFlecbrb6r+b(uU+%AtFXhn8 zP2zReVQ=47FYVd{UyUrxty{%zY1<5g&<*&LjCkcK`j)@B(Db-eIX)hv%GsrkqdSRS zwdwg+fTg_eaFjWzWjTbz1V=`1N=n_^O)AHj&h@6()hz$5rUWICvKDbif>zYa3scgD z!y&0VyZTCH{m%|<0c61d!q!{izmIY?t)>BjnhapZcJ~&grH7Uw^(2xDGqO-u9&*Nt zsERTL!(zW)QSEn`_n@E8%4`z6AI49-V}#g=oPZ+7);LlkT`8{F5{Mp^aX8ez9Flz0 zzAu64w&YNazrWIoTI{`}#ic7R(E!ROJq`$5P(C**G)eatuLCGfXt73h*Jk|=gFH!s z*$Fo_7uatQZl4Wf$w52-yRAG3AA;~8H!qN4o;~z$>zc zgD;%a0aD1|-6k;JdYyZhTGQ~skKOO20lUlrZld!&aL`KM5t*p3`vPb?oYE#_2dOVu~d@C5dge6{!+FGpPJXmCM2FLU0$4j$n~1<002649$-j+zQeQ z6eLX_&=JXII$gHOm0G9U9&bADKgm4mS+r4uHYdWJ3cXQzBe117qTPV!Ivk@5hPct zyL7Kz3B$H}SZ@bmW&*Vn*dSNL9?~FV|8+zD`h^K2v;7DEfcd|QSTHd%0seQyVq0@E z_L3QC`vLtefR!%oFl^}@9EGSJ)HF=}(HVtxYuIG)=1?rfi0f~LGeD5kIVFo=lrF7O zmM3Zd0w@UXN59UpZUpu;Y%`7F)~M}!ZL8M{yXVUQj~|Af2abNyK2RaQ3G_FxC_Me5 zof#!CJ<%*mv6Nf+9*EI9*JrM|bm*ks$g2}{TCC9Hn65003R#o3Z2YfLWVl|2`1=rL z&3_z1z^VN76_GU+4=1H+t8W;Wv7a0Xs2+yCOoWW4AA9 z0=T52VUI6)gSCURkdJUgU5r9|67DzQ1`8&tp;a@s8e7Ff?o`^4CxwL5=X&#XGg1|| zF(-k~i;2|G&U94S3%?>$gLzQd(p{;ObRWpH2!5eoP}lb)N3;%w@vWY!%Y`fx56H&m z$H!M-?Oaeo4Z?v;cCGFy)+XRVQ{jiXsbKb+aW3*|*^L=!vhE=>Y@Gb)`EFrC+8PU9o{h# z9@k6e!qn0BY~imOxk0Jh)7R12`~4C z%TnSDl_5eJ$8@D+LVvLgs18I&p87vFZ7W+-HHJ3;qEDRdCjlUV;YHKlGNYZud_l~|Cc|f!u4J^h#!#Q7IszR8 zC@QRZ1UQ^$Mqy$-5N&5e;{l}-0JwQwCW8vEEUzZT!oO}#t>x=F%snUzmi%7B&6w!*+eNY zF3gCluozApf9pp^LiI9@v5r@z+wrG(IdIlHCH3K{I6?uQs{5bmFj>ox&gR5?EodnZ zN#)%07YUt9a)wj=)_0d_K)Nz*a2m~}56I$j(DvHliRTG*ojdgga$h>JuIsGD`_Tgjn(O#m`e5J0Y+< zfy;xuYL^r-7m?|Za~*@b;CF4^O-@f~hhI4(>1Q}a76F*ZQ_LJ?F=@gI8yX7E;X^zr z>g9mAWqouy2nJ(gj7W_j35I05--$1o`&+2%ODKFCvwKu*(kx`GZahmUnCP;&)V3pd z!))0yB(B6!q8cz4vSf{WoBGn1vw}*7b6^4%VI;1awA)UJ+D8=Hb)c;(qY;yZs%diS zDj=eGK+RCs9{#l!AeM)Z`>90B6~LAV$_%$aRi<#eA(ss7Vzm`fgWB^PYOm}GyP!ad z|CXs<420Lt>B8olwmh1Yy?}pj zmFzc6Go6^KtZFEg)WuyLGB%s;T*}Uh=#S$(uDCEyEQ z<>j7t9se+i(ID97yP#*v+V8*?Y_<%6TiYf9Z0?&GmUWg!KP)*h)LyNPsx^F=@wFS> zt|yqq+On9RQ~C<7H@!6S(NIReiSmeGw^Zz8Onjxd<5Ivj%nkBvrk11luzd0$M zXs}ua-JJOh?Fm}A`YF`DY}H(8NIc|k5Q3M!$72;6-~CUL=ysR89K@{o<~>`vvdpjC z%*v4qW{-U+<@kp3l{sKNE@Ax#M<*{eY;_4gj{?l~ynkG+dITYwY>)Iw=zqZ0 zrXzR*IL<4oyAzao7@;eF^XvhxO~aRSz~PhT=#W674vN>2#!IxP3g z7V=0t#bV1>8~^?zKL#+aV2&6@c*5QjOuo~Lyv~oj9(cb`3!J{_aWbr)>OoxTB7gx9 z*MN1H-AivTF6cGL$+mxlI~xWa!~X8u+suu0&w>e6oK=sv$8g@j@ieCvP<0wxU;lB; zq#Rw4Bs$tm5cN@lR1Ys&6?I^(J##c1UrHL`{W=|39gssQ2wfixJa>$L^8C{@B#F^w z404)R{@bWHaj>8F$K;+4PXFtahGCWl6rSu|G@drVaTT#+7l`8fZL>W1=zEi)1MSZ~ zpNgOX^V>g(!Z&+}hX3+?2D5n3PICJFs)V(`?h!TBs)Thq9x<@?F%^Up zs>u_&wh}IqS_bkUMnfa1F3Rr4xdZSa#4Q^43|}GN?CxgQ*Ei=~osnM|{Y39P?!^#g zYUCJK52A5zY#i5QHnYhT<04-nVQ!(ub*?HRyePt_HRiX#@iB~pSoKO>et$c%rnI>J zg?k&!X8b|toc=MwU66){?8!2(6~?K;u9=*i-LHt>=X;e*+1jJE$r-9zgWKK#9%+2b zv~rGa(k@8z@DZ6kSYOvrm-K3-8eI0R`-&3M@vt=!B=nw_3S*2A1}#i8X=P|(YUY@wZ}r2>&g9ASvTb(L>%~dYLcZMc4q2a?oPV^Y;Y}D_L>T8NkBG zzcCz0a?R4Gv+~6dz?`mZ{`p8MtdIOmiJE;rn5KFiO;&{BKc5@js1f+JTjt4s1_7 zKw%%S43R*CFyW%Quk)=}TXQF8l6ryl*C&Ke#pdZTb2w4^&Hd7%@eJY_8IDWo(m+ zeAmB~0n23~n#i+oL2f{*-R9D0x-us3KX7u?Ir4As7xjJ6+GlYI0CJ1yP3-jIYOnj8 zGx9M>Cv^hpt6PR~q5dVO6W|=}_eT;`L`UsEm0s2cB07RUEoP65(Z?WQJiCmCLikhh*VXg3Y9*cjf}+71mz-JG}x+tS6dO--dhx~f%Ebve}#GWF{+xr;p1rx zVEZar5<}hg+*7C<->MK8_69rLQ$l4U`r0SuE2zoc6NL+KdaGgzBxc=es;qVNm zWd8YiIt@zu*^!*Ig{vv9t3bMx_JvNWpe;h7n4pWo;c}~Yl6j908)lYfO|F|jujQh)M@ z6)gqqEQ{v}4;fw6o2#hiL zl^S6%fPrs*Js4?+4H+zDiw+&kQ)0mMZwH?a!Oo1){4Gj7>A_Aqj_c!fv#ZIc!JjaL zavDAUWPkZepr$Tsy&6uV)gA#+!5~f&Y7eE5`sR4q_x6VKj%Lq_ky0hUdIR|qnQ6Tf zhrO3S!vWRv;Vcs#m}KuJCTNT?X$_k-)XTo)?+qqa{WvQtXbAXHPYS^fy;9VuZarWE zS6-KgkP>K3R_=sgypvCz@2Y9vL5oQzeRz z-ZZDAnBn*lc#%HdwOonZ^Cvn{Nt*GjC1uj(x%%$LlGBvYhfrFx^1&zJB9=IRTkO&} z;Jt6G4JL3AjPxE`bn4pv(snt2@bQr^;N7af1&;?8b9478euy7*{(T%B(c4YIKMy8E zK|#!x+O6l5e0N~lv_Axf72;S*#>$;X6FrbuGH0x&Wc&h>>BsAhaYoO;?(OLUx%2`PVYfRR#F20m{t*T&4 zb;~s7irWZAfeWAoZF3VIlMuEby z5sS7@N1p|@)SD^Av^7}G?Kfo}tdTQk&E8Jnnm5d-rsrfcZeeU@F)x`-c#ZW-E)Sl zX$&6G`E3V}xz0YkKYdcXDVwK4VW@Pc>#Apa-t{(Nhxo)a)blRhiKuT{yFfqQ^}KwU)MH zTgN^&qb;OzLSJLkl!nHcE3}!%8AHzXh<=IJ)NCRyPd5(Rvv962K|vDP=Bx5fp;=mJ zxcPM8vY8&yTbI-PpQ&a`o#sk9<4658_|8T~^wH(-Xbtg04*fTy`sMV*M9I(AJ13=O zA){6KZorlAWIa!rbIll^j5UufN~)c9bYP#B9jgfPi5k7jmFR^JlA3m6-v3)f-RJ35 z%)s&I81Vq#d!6={%;D)SX zHvtS+t%+Za>FY-?LJg5}3N4yBQF{ZcHW^gQ56bnCxxRV&2j7I!s?sa$tet-!*!=b} zf8JM5zGev*<@he3*`2ofAM0f?=cFCE0{&&49`8O!Q=H=2_S6u(V{f$k;GI7&e|#5M zuJx`<2lFcZ%Izb18d{^`Nsu({FvFt;(f|G=<|a=TANbfq_B!6x&PJ~AB+fcp;^g+g zV)8An8VUpkgdb(t6JZ$VZ^nzO=hS+Onzp$k9sb=u_%bRb3Gws&bWvPj+?%k%SRTP7 z!?aTv!rS6;dXe+?Krt`)1xa!7GbJtT#&{EcNl}XzIR0Z#_-06y3Fu`}Y?YN8!TNP9Swl%VGifnhl zZdQ6Ch$sXSo~E*6sJ{N1adDKUgy)iH8_k@d!5>(dD->DuM`Lgp%1>n3hr<~H(U9(v z_P8q+obeZ&J?aJsCTJ};v6Ti*0MFZ=1>AvF{az7qq=#`&10D=^mB?>)kOeZ9U_M)5 zxA@}_%w<>c0f312JH6Fj^zvqXnWs*VFOA*tZ;uahBVH!zD&N3Or1!XYS^=#fv*1aX zsEeXb3s}xEh>QXiOxlWL}ExWTg>)8i``Efa|SGK_C_oM9qxvap8J) z*=^NRKb83S1NGZ~A0_DS&Q+~VG&Ea$t~Mkeay#oWbZUwe;x+wfp`d@^6`pf#IE-nv zPq=%m>q~!%{AiqxP^%O+k&Gs ze{w~+eOdDCwMy#4Bm;bIjoF?aMZI8VXXw>+)r7Li-+yeG33ZCHwEi`zM zHBRS9FTRieO`?$C0vTZk`pZp9*tg*vxvZQ!DvPWloCTSv;-J0oBnG!2W{&B@C&KtQ z!@6aFy96cFkj&8B@0wZaJg+7Ti>;mwi*pNffpBTlN?VPEwLttvFz@I)q=k&HpTG~?og?=>iIq&vmUYfW5HfzrJEIxnli&0~PM9AzwI{dcU8g9`528fPhPzsZf#fCX3mU7g*s1s;JX8IL36nA#r^3 zV01^ZN!Xwxy^Xj%J@NYmnAiYTC*^nLdnA;xh_3f%cTxB^qK-x-8xh4CSR+T$yH&=2 zFKp9*;YvwW7@x{cjO%mKtk}Sm>{Bhuxfms~WNw-<9;V~%NxgSrmSpf#BKti)w z%~DgR%uWp^6VH)!kiN}z^OuH_b!AP_!Nshj%=J@5MEP(pUbsMMC0Au7`tlCg82K4Jz z^Cig`8i69idHgH)QSI{S@?D zG9klL!MI9xFB;PLQ!%h{y>gGnmr`CDR%_FI+%ZSEI*FV7kc|dhN~nSJ_riAT+SHj# z;%u}oei7-Z*0`GS;|JRe=C*)0Y`1J=@_Z$_#o2eY_^v>0(v<1rdHOaq=MojijHJdJ zlqY3*24e+GOc*bO-gHhUfwlsdzmdSM02~#SZaWI}8^kDQV3-4q56~}!O!w*KW!TlpnL2O8;TdQZ z`6?94T9Aw2cZ}E^qt-q3>1(2+NYyVDr=Fnv=;!wUPl^;e{0pLBKp?j{5l3{yRSy%p z7mM-6?uq5J>DMs;(hRZI*C)R?qP;7QqE$6D}&YiSCR_7Q?^vd^x={ z+VbEwH1q6JGi9enqe-8d5X^=5(jkSaKlx<_m8$yYQ-KQIzBG08s>t_uS#v@@b%w#+~Xx{cQI?>DjTGzl^-i}^~Q@;kj(Tdbv(p#D`NYn zi2AQ8IKb~;!M1)9@o^U=rr!4W_v@4Y;Gl5*2N2V;qpIi_l*%*Si$d>FOrn=`p$ya_iBqzZzkn?6@nwgfh1 zj;7U2%2=&19@B?Pie3rs*K));YC@9|94*IRwyCCO;Ypqk!#0dLo z66a3bFPw+ro*o=OdGhl%vwoO+;g_Xho&WfEw(Rvev52w+`_){hZU<>7ez!^|y%osp zIh!23>8uNwo>cqQVQ}T0cT5^t2$_E<8R&qhAKH~2%W*k}eO?Dc4i|Nexb-x9-ufZc zzaeaa5E<}Z`ytcY9|$^Lh7ftvhW4U9SL{z%JO%z(Xa2d4Cyg6jyio*UeJ`(7A= zo8g`3*&j>Q`VFV-_4;dwIg2deKbp3-@#9ySp09>Zqk9SY z_$_`udA{!&a(x+x2&FGR9Ra3^S3R%1LrUXcrh4t-WH5hlrsu zLc%h&dJkQJ4g~pm@h!`5d^0lst;+q*Vll=VJ=~>WnU&U(82!ok=J@g~9ys~@7^R=y z&&y?Hs8*5rghuY$a?x7+B(CkSKz@;fw zq|#@csf=wyPwet{^5AaTp!Gpw_8=OKN2WAJfKsQ+^7vXUZkodcvCHL*F6;Ow^UO4v zBB6YU@eY58V46p)aJp4_BH4A#HZ53TH5~9&T!x*E9Q%Mvwj8IDCObPlqdF3q+V?;? z^cXR?(J%>}3_bYOtwt2A;4Ri#JCBSf`}GU}s~gcmFeE#gr_lZf zByu0g+gw{y2RYwCDLGT_m!-k-cU{x-z9$Wwj0Ru#qPr63%3 zS;((FIBf|r@l1X9CLqEqk+9R%_`6k-RgA9rw#z$G3VFIthN)D%9D!bC1(up$YpI*X z-oFY~F3Bs2M#GWZQcKZiCY^(^6d>dW?aIRh?AI+%AkX7Q84|g7R_#BJFt?66(03}0 z1|LTOH5*GhMAW$++HF+oss>~8ky+K$ZvQM-_SZeN#tBFZj~;diz5a* zK31Z8(lydVG5l2;@`5Vk|ICe?i;Dp@j7L&|)@P_r^b`^@u%fAaI1qOmO(Nwl*`GSF z#*RjCX+a8HEuzb9*0Q0DWL`e9cSfA%oiD*5)#4cmIf{vDhbGOW>9+pN_xE7|;stU)`AUw{=Nnv=H(B`X#(tn z12HWZkxI?ndNe!Y@}ud9em%4jTb;|jHZ|HBj!9Kh=b7rB>%Ssdl980hGD1VlhPT>w z%&lA7nlaRfAx)#HA{1S;1?dn)kP6)j8Hj{MuTmwnu^2I>=G&lILV7z|oK&uj^uoS- z)CVv2!Qy7#T^3{7L?TXs#rdb@q;5TMUyutxyTB4)J zA7Gz6BZ4bj{X*fDl`HUT--h%t-Hn5}(m@yCPiZZp@wHp7RL=p$OS&h?M?^34cb&(P zk+LG_M3&%koQQ-`APcDyiTUx8kaXUb#C#oSB%}CpIMvsk5G2k$REurXe3FRE!9UEw ztk~13Fj?gLs*}ONx+JOoc@?)8D1E=42F^G7Uupw;*N8bef(-;5{KbH-fjxlsrGlvl zQlkYvLoUhQVFrq`!1AKoI3q(RY3{m^5-d%%pQ9dN8E{&eAi6R@ za^AyXpGJAvsZitYR^0IqzEEl_k1I$Vq=_o5^?r1!Boj`fS;`@Zbke~;_Id=HrA<*&uvFlpg86$E8mxte)`}&S&>1y5?cCPYD9CB zF3-ki?{~|z4o1LZ`Fd38oMt#xk`anQu^lxbJX8!B* zz}IqX?$>F`a@?$Xx=SUPRuMAjM1882q8L;=BU)9m>aE#Z=}`37G8`Cv$4hy^d{fo~ zfxAk$cH(|AQJa|g^N77LFSJ)a{0|JfI(n#x6P{YOizSXR&BO)kYONi><5o7Hcu?gp;G8!+|~cu&BQcQi~ttw(S^5{KO6hblIja% z)0!##M~NQsgQbv(To`?Ka20EWWxCh$?#m2+e`YJD!A7s`8g;R!Y=dni)={yKTKlZR zX^Dee?uMtf*veOy>v8{Ui{hBpTu?L9@QV0p)WRX%USgqix2Ind@gpb(d zV#Ry{j#WB9JC^^tTKC~jD@{#Q^3N5k<(H~Qh3#>P{oc;|NTD7_Hrx`#RdC0e}4_u_oQ$-$JO}zv`BX~V7?ycc^mbU7>+JnWI(@+0a zfAEA#3>8TuWI_q__gtK=Rcjs)q(U$d)qz1y&B6T_ECc%gu6kZv2U*1|Ap!@f{60h|9yHMg)Qlu<=6Wy ze>j`mk6qk5dZC3^Ey z)B;h?Hx1f2!y9{(6E;Sm8{0a@nX%jB`#gTC30ZjCjj*>mdem!)|Alt*lM$>aj6-nq z^UvY!sVPTFiQDaAZr#PRAySMK)ZWWL1?5awWsPe>-2z2Y+>181NTgC{MKw|=Pa9!K zE+|PampPE;xUkOVz$L|D%*=G$?}fwCq^eLe`(~hgiiDts&d-0e(1$z}V~VCU%%C(D zPB*5!y{*$~aM_*b6S!hK$K(%2YJNWyH`6mjXa3=N@|~M?Fyv1U_#2FdZKQx{IAE~n z`OYdgX%w1*r4ld8RE3#C^#|OUGQ~dzlKOye=9l?U#=)R62YUSY(*<4gG%8q-V%7_+NCISM`Dw-cg%@-{5)Jpw_b{)R>j z|MiMb;^h+Co3w;BJH40d~LiDHx> z4hON&)N6q{P1!Q`I$q!+s2b!KmlI6N11xz+Y}ylZ>@Q@g}jPYWT8$*{WlHq z!F?$=_(?}7i@0$%uyE;j4gTM5+g5ZNcgdHVA+?i;z(Jx_nV{pb7R6-J%_7kn2!Ihr z0PoOxIyUNG1pq6PT^8dN?{7peV0=}U><}LysSl@bo~jAppi<6wboP8x^)&RkwrJmI z2SOwJv9^rIdl=;x^#&BoGCG5c0a2Wd8f}mIz6kPQQ|@*f(T4-WYH zcp>|&(7`c$`K${2@_USR1oHZ}@<{Y$<#PCe^$G~BSzwLFHcBC%9Dy#S0J?W3EA!y- zHS!b|CUW=k3GB2n6CNSub9nHRrD7dtD1xQx5a=XU9NwExZN~Q%6vy*DJdSz8EHORI z7g2`$+^d0B&h2sSs^@b7@)f7jmqwwpOxq%S{A4Ynlt^AF5eAiBsq*HWG1@f2LQGyO z_W*lJGNulYj}`;J8FI1&dvsl|sL+guv2G?m_zM2yUy_b2#KuAtIW_@aiybUtFxUEe z^Dp%`EQiP@CWQ28TS0Yx2k7>+v4oVJ$L4DpUSnYMj(kRxNRP>dj zE*OJs>eV9*4}hhc4;OdMVIeg!eWp|?LwIU7c=Jr2AoeXA(O&T`lg?o;6!^dhKA)8& zaz%yhVRAtIvkF+HIru8ll_SOwF{n$PE+!Stxq}v z=a@~0wwkQ|g@p5DI)nRoXi$liu2%JK>*G6srz^QHEUg|TpikjpnTZviXNxeU?P0`5 zYn8f&Bf0EQ;xZEhHPk(SxX&&*JtMv~}K;`+|3Hfk^-J|oU@&W6> zfoK)01m3%UZn^UBWPh^F2Ogzi@tt!0_{kV-&bUiXhgSM%98*{}*`79SCvZw5L<|uf zW3)lM0EdETmq^Wu$g=Q#;S+u&{xivvlF}PLb%z*}o#8lmRRVhlafZf!FIIn=x)oPM zsN|vcq3OaJB0n*X?tMp$l0co?COW}$)e6ctQRmf^cGKpJchysV-&65$oi94Nu!ZhL z+9<|4GCiR&wTH(jIt~Serq|di0N3TX6%lrw&>UqF!9-$6ktke#0U zpZo7xSg+)tUskXGFdBn$eDsj<15$`#gfD~07zHIf{wQ@7gK?XDvWkJcLEIAYbUu>c zX6g$ruf9c$*x#QX5qdZKvqQx1Wv%pg95khO1S&BXoU!jppRC{b4Vqw(ThozdE;07W0eiH~9#Dh006 zlVD6_2p+2Q$;Be|;yP)coK`C^hbwX%PMYb>X3{&e`Lc(+T{CEFeba`zhv)bM6Lf+Q zfrNBw?YG+>zTJ})R!gd|xP~KcE&~Da{TfKr^JuBYRDdEvHi$0tDBW|~$x2rMClh^0 zVk|B~OxMYn^{a9ekd@iEB--3AM#K2No+2Dr z5ThP^e85=X<9gV^R>PEA4g>@MER@+L8^|`Gq93U%+aW|7#Z9&+IvwX`nE*;c5ng}f z4;+cy0d7ncK#kpVQ&>AH}vm45@&dDn^rN zGqR)FS?YpxsG|(0vBr7?*1_O;B~pt$!yUfI@QHq^YH~`GRk;?t3mw0c*&g0)BZ0eG zN}dE5{HlS!`ZSzDXZR0^LroF#*0^Za8>YoKD!f?4n1<{z+`!<_!o<`!* z%wLql6CxRu#nrHuNS)UmR( z%iSPF8F9kwxw#wGxv_^Hc=luwQ}}ERLzCM_UPbLLbmMtzsU__oVkWKd?Npxzh3rrB z%!`UWCejy7L#N4xeMttVcp#E^A(OPWK43o?yF9%?R$5ez6Rb6`aP3T6@vMlM@3D}A zaQiXA={*vEHBJ=>U8jDbjy zE+YMw4%iCEf$0qZI8i}!eBIiH2Uvsy?;5+SU`XF)pNq!YoVMT4dA2k*lPSWGttaJo zKG{5aphr;|h3H*EsyBHwtg)z=TPyYb4N$_l3P9x@3yDB4ZU>cN@h`K=s!DQoDU^$n zLw_OG!7#)l2_-&KVP*)7Z($xewAS8Zo;m2UYx^Hanf~t&uj4Iawhr_fR^8(X7UYIT z=^t7b%^3MQ-$L2X@uQl#Bk}kIlg%ZF>K&n}U;c_0JCHT>e;`Q-B{F0jY5UovUJJ_# zwQDn8Z>vRez>$mf#GtCw*@vJjA=%ZUC;uN~=hU8Q)FA8FPCB-2+qP|+9h)87w)Mug z&5mu`$?k6-&0I4FbGDve@YJeRcNKJhg*!ax0h8UA@?M?tk)MmrKXyr=qK7<6=Jwwz zGvztKF`*kBKy3l76Ue!2012?4Cj)tdv#97m`;sjR8&K8hn?l2x_0@@yw`kYKDtI9)L8PZs#%` z-}p%gBkmL+LJFakV=QKOLWIZy%0t!p*U0k$Bm{WxQHNT-T%F?6qyZPL7M8rEy+Ax` zgAmw&tt!D4HItpT7`K^epl$ow6XZ(1nY5V6&Lm*L0(PRL$|K24KdpAc51G^ak3vQO zi5R<SORH{0(LSm&%^<>j1bSJOb4U*NAjPSjryT{*$i`5rU3iUeMA(Blc9N zVfpsfF{6irM2a6xq>1Z_`CgR9`QR`O+pJPkP#R5EXL)itORq4Af{fJ1=W*6THZA0A zrWj;}?Kw9c4NcLKj)y_4OnA*h@-D+NhUzT>zKq$fr)ZUxU`6xkLt;7SZ|r}?zl|p= zJE%w{h@Bab>T>u)Y!S8dm{plc5LeNfy8J9^7g}6R;g&(%=)gYAa{n%J>@4qM{#^Q1 zCqxZXR)kY$lSLejG zk27eB*`<=7nv~7MxPuOKTf6PPYv*F|3;l49Z_t{t+_*ploqeOKrbc$2QYNceb@((L zTTfFm*$oTcZqn}Cedug;iKt$S!pIV&p+EI8m{Ad<#u@-uzskvlBOUQIxNIpjE-#V+Fa?A*cu z+|V@yv5$7MgzO^_3swE%QLQ&lTBF!QZ)3S~*h)toP_n3t?4~J&OM5Ru=LL2$!X>{8 zyo8CbYNd^HY9_qudeP?81p< zP`aT(XSy=apY$hvX|}6CP+&j^*nUzm^t`cE!o)AcLG4m|H|tbu1s@TTq#Er<)&TbV zHLsTq`6G{tDqLzH0aSRS-_*7rihncKgvM5VmaB*B={D~Uv4_r|EbtvAd-ZQ1>*V;W zsAF%Ya@3t`Ug+B%I*ydyLcO7FL-+JSI{9VYJ>1XEV|*7>xK*#^7Ue4>6T^pR@|5k( zQ6FQLUeK#!B(%rMZq_S2H{zu;76R5!$5$0~=r9X5k1723I+qkGvCU;_O1O;>*Z%a4GfVy zxfRayOs10!&qOTys5=-_>~AsgoS}k5dQO2XtI0-4;PWSm84h?kSkJ3{ynqt~2dzHy zq%?8dKg1JIavK`CF?-a>tH&xd4d=cW{MFAw48l?Wpwq!N4EoD@s_vP5$cNPWsf*+H zIGBW<%{&>-v7)begl8Dx;uRs*?o%xX9^fvmV3TKo!s^4IUq8P7SXN!?4BmCDZ`Ok` z=Q#_hmx8a}6WfS`_#Q`)clev^Lpz`03L4|t9R56JgQ|Y;@8aX7q~C<(RT5n^tHptJ zs>E*jcY!9XFX`^Kdb$UWj}} z(WnGE?5Xi6-oaERwOCIIdp8GTK$Z(u@lfB33T{uqhhx{=yGUt}Am1jn(7UVv^;D;0 zymvAnI%)HE=o{lZ#WE$Ve)(y2VLfbEV+TcSsgZv8Q-S&OGOdgBC^LRn9oL zs-G_A)*z13Cv7)RP5?j3;;FMU4;BI1z{1VGRI+Ma*Yxwkif$k}Br)fG>I|WKu0W~q zmk`_;L$hv-swf;g+@wg&TQu;O#;Hy;XgZT<6)?Edj&fsYpHRZacmUBh&PWz`iH)}6 zXYTLeMPEIL1Rs=%a>Ed>Uqk^;xFD}uLFuC0Qs1w@hV4-zEC;zw_?cU+Wk}*E{ifV>5=mYscZiAoBc-2%>7~ z`!V^vG*6%WLb#sQ>#mx+(|jIiz- z6XuPQ>~CLGjg^$jshf@OGt~WJ2CZwx4Y_6bOSd0D!6W~$JC+cpiuAC!9mhS1&$p+& zhdhTtcY#;nCTZ^eTXuMg+lh0=042uEy{qRNz=|P5{w%gDZQgnxxX)W`?~aGufkMaY z=S7GBJ;U8U>dv%!Jfw6IdScLXc;5kCszkc-GMHvJ$^G-q(ozrhO}eZk@KHtoGhQHz z2YE`gx;BKRffm$(g!t{O<6bF!{x}CKZC3DOHG>-M`{B8+f2~-MXNk5#Zs(8g+I~7$ z8?nnO;=50HiUC``)Z|K|ZVBkDcQ|xlhyQSMMOhphBGLlBU1kcf-fK zL@E4)_bQ4&pc-;eyng_ayT$01{ka~*7GFTl#!jaCDfh6Y(3 z5BfSqx5Y`FhO?-UeHs6B#3~IVsU+cdsqs{KBAx|xt%uGt@LlM>i3-~h#e{nKx%?_Z zvP`Ad+{_09Xc$pz+O?)8*bQ>;8%AN)v(vDRYs^ifUkV z>_l6=4q?;=$+ZrYDGUt-PBTbSBo*+MgH;eQI?I=+7IN}P{nroW#UI(Pc5???UJ#`P zm|q)UkPMd)#EkkvmYP(~7NQ`dL0gK9dB|8|3gU)@!E%jF6g9R~K-Z?Q=P~%y`GrQL z$-#m+PeUE@@kA6(DDB9pmIcC+18bpxSW`e^8H~vB40LEZyl|jnyi)}~e2DDM7gAWr z-(ddGb0&PeAyrkD)&zp{WXq*fJFy=4d{LFKGssba(ve+Qy%~41g zze-EK?gkaj?YA=2zhb0D`N|`h47xOu15cUaY$sOi1Y*e9RusA1V02<5Ttd=(0Q$9# z4eW^>o=b{wsLDF?NyAf?obq+DF^v>Bpu(|l^Qy~R?x5DuP&uuk6Q!>5U8$O{iFQNVUpwtoD{u!wR96I= zD+C9mHa^aN91St%RVyXSq4wP|OHirGVQj0^A#kQ9Mo3jE$j*ts+(`T6M=>de_)NCd z+e?Ki+<4H+Vcp&;yMN3u?nKJ~92PgN!yDE_7VS8ERbQlt>%EP$rkl$`@%N)QV5pA0>3HG=OK6XWZPcjoEYxGoebrMsA4rgxjw%L> zp7^N!S(3riyd+IttEv6A8^tKDbu>N~=Ii9remfx5U3NpR0rskZy<=9h)%vPHq`55l z)Qmlkr!F#_(Z9Ca|81qT8y&gu(CfzmZNCEHb+3&pE`dmZDW+eC+{&qeExJ0P;7|3o zFQM~If1yNR4^r4Ru#aUG3gxty@HB)O%8AhQ^%fAtrY_TJLwDzsYzyl7;50fKnBTJH z#}|N*%=ykdy(NcJtX4DqTthbvac3v84su^vHSNQK{sKiq@hyiu<>BglU4RL zV1T}#H!pqt@nT|U`3vWEOx_eOERQxCP5AFnM9*>uxsADOg>ALAfHoNw^)1m#`)Ap> zdnOmqjp?+b(@LH#FI=t8kmsb&#d9UlD0}OYdMUa z>rBQbBg#1|^~u@;D+4Qj?8+H5krZ-luZfyO3(3(MbaR-e?01Ldox+-R=FeR(SvG{c+xnMO2`x_THZBJEi$;DbB_tg{@1ik{yGNUbh(eQ)h$1N_K(@s+W_fFF``E~&U>kks$4JIm5Kh0T$ zprHAh({@#x8SEpFTRg$nDHwaJ06R9Wh`&qgtILNiRvJcL`&YL=5s;ls293CGyFL_I z!rHP20d-2~JAiU6=u*0y`ov@|@|Z6QWf>QD@1a?#>VGgp6nM+#M7`v47(2^&%SWL% z0rS8mQaAE%@74e|JkA_xed$)l%R z>|AVoC${8b2^%VAmMnmc(&59J|F?y~Aj)AN2nLBULTorrdrK5B><3 zeb?3n$-~vAhH$bcKWDc${RGy|hJ zs@e@4fn%nx(EFUg46TbQxmaDeI)P%CsON1yx`jJgU%BpN#DB}Kk`=1~QZZx!%u-b)~l zdys6IJ1fLC!ta+Ho$u-IF6R5sbOEpyw<7RQ)iLzere)Hxdyx3 zW-27w;0NZ|&UyVLGd*c$jt^6*4-lHH8&RWUGut}eXecve-Bw11AD)mGJ%Z;ye##B@IUwuxU~O%aB@31 zYYjAm>(1!I9|lWF-i8H)Wr@pQ=I`T(U<~%%AGqOh1VvK*y4IVwz;|t6uex_N*lXIB z(!+cJ4h|s{cL#E}=P2>&J`m+Bri%LykyhCLx~NKUi`kFLRu4fn}<<-0P5i{f5PTYU9w*2f+RvHix_~Dk^!*o2OlQBPVN5KdmE5_CBc3x%Z z*d|2yJbS1JzkhlOgtl0|&D$p$Z2S4#AZ#|DhMeN$UU=Q08O;W0 zxv&I%mBWU3GY>iMVK~-4LB-8NJ4@WUF=G2ZYvA^i{w#8KC9pcHU^!r~4)N#*8&8-o zSoRS3{SG#fE`+54p-X2a_XeiO!9QQ2>nh9lpq|NHP0fyRhk<%%h#n~Bsey=&SjoR& zEtHFds1Tmw`^0s@Aj3KthD2SH%9q6k%U~4a`R7I{;8J8*ei;yJ!Hy;Vb;^-sQC3y6@5T5%+`!m!kt7)N zo^OIB7)$S@LpG0FYYLWaVsIEAOKk*GWtx7-(z-Mk!;G`?yZz{`aTnnx;aqEQVs9TU ziJnZt!>5}7vM+n(s}JmU%EJ3rM8V>-xB=%bX(V?@A@kvUG5tJ8@eN$pDQME=;*FXo zvmz?PI%124I06hcj_iR|hB`WnJaWgtW|Qr&wzldqIPd$OlN2Tu2s3D@lYP%25~NR9 zyLydk7j7N%$|Ql3MgMo!s+%HhSLx_+J!I1q#q^ia4#J^sttlpT0=B=UC5i6CWgM2&g#~zSTk8cf*(f1Mr)r*|1UQg# zbx8O^BI{ypwLm6Q-+-5!Nu8~wgj~*0Y)W>jP%e7}@b$7oCr{NsiWd3MZGY)a8U2w{ zNmQxPGc@c3*H{#7n3Dbz%1Cp!YRS@^?w~@1Ozd8;0ka@(^v5LgJ@})h9PsD zzu6BtP-#{b=EhjOD5K#RimipDGZCl)WlIyqP(%5kHn9VXC#s|rlRnQYEJ~gYUT)b4 zJWDK3_O_|ChyFk=VCc?0X{1Dct+%q4Zg3~+b0aapq7wx`7&pNEn@Ffrlec1t!zYS) zciV9$%NVT0x<*Vrtcsqm;xoObGJ2ee?nwer{#xGf1*;Up$PjXr-Z6CSstp=6%{(V^yfGN4+dr(t`7h;i`cXrdM_i<`cz1&$0=nofF1 zOZ=}25{f{l_UW(9EgJD-rlirQKg(B$zUdf@XEVnWol;Irl0;NWT4jhVSa#f&_15*Iw|lX0=c}mf1jcYbxfjTx6ZO7U z?0xYR$1Jo|i}!sa%ugT50BPZgz#OW8y4W z^@3G(BPP$hM zIjUVKIt1SiABcuxzju!Coz7Lgp3Xr!TcgqnWhoE`jg8voNbVVSY^aB|sBdZP2Pz?p z!%}b!33k!_aYILCb=SqCc_<$PGyRdU32$K()K-SAD=?xH{Cz-OsQF5}nn7I9{Xk}& zfk$!D>j;Vdv0S3YKJRDyr*)rSkO)Mz;e5|7+cB7CvYGBFhavQ8{ai<%h~fAIKDbQT z#S5^E@*Ab5SBydsS=J4sW*14{E>1nI@7DlH&X5Ces$YO%9-;Yb!|HJ zh@3e~-9yh49^Jbx0ZN;UXL{+tBtGtkkN5{#XRA89G?tTOxCYgjbr(m^prw>qKmfJ1 z{Y1Wwu)M%m{GisXIkP;QONH9fd7)k|7YBAr*`GsO9LW1x8F#3sr$=7eYu$=#j9>|* zY&$8aZR>IDkZ!73qPAByA`f>Y>Ybc|ffymEMeoP!#MfR_Y6f0zojWP*2K{u_Q7bX3 z(I!@%%O6fLDy{k8v7UM`1>7kX#$v5{vi9?Utp%<4PS8rGmQByu~ceU ziqJc!6?g?@DRFD}JfD0udIXUYnhlhBnod>sTw~r_y*3t!Y83Bll^#N~vJYoyUuZ1k z|Gr{?P}#`b?Rz?j(o8}9P22(xyB9ck<3A6stDHOPVFp_C6l zr?=5b(@{@Xk!7A>`~HE)FLrJ;>1+>z7U)8!jf+2X;Amca?E;Bc=0AsZ`5%RL{rm@l zf8pe2cqebWgTP-2&+)h|_}cDLK0kf86x1}o!TaLpvyUr+0fD$2l8d;8(*=NQbccO^d<;q>?#=V51Z3BcRAr+U8?~P6)q^f6hO(&Ct`m9 zEu*hLv`^3e?&jCPP~HwZUGk6Lb-JUv+YdS{*2vkr3dMiqnd_Iri^R)@GR)%9!^i0H zeN-B}ER`0lK%gPIEE#`X6Ra)I95ma3u$fvq04_`c`ysQ-M!ODOet=cvC=m%wDNWET z)Hz2sWDR~$b+<2o{JxBj(@4gc)-H39R2)L#VGKY3_H%D$5Q^^ z@{&>dzWsHu2+E&vEo+W)JS)nJHh_DyW3XLBtchm5bGlmVzh$-08;d=MqXh@ns1wrQ zsx|}Vjt71IFBl^MBXH-heQSA<2Y<)5H$%rxR1lH6f5Z_fh`>aEiEf3^)>HN@2iY-43UI?cpbenu4-;ZUHdV_AMzFMKq+~Gv z5{g4}59ix(RO=HnYbQ(bF=?%z_>qgm!y(Beo*?7J^iAo4s}|OF=QF!Cr?Zz=DLno{ z*hzaO9*hZTz@S~QhaY~{4L&CupsbXMzU$%(t?Z`RK*hJK&;F1jIP zuy`S{xti4<9V8silAKDPAu*em?^S(h!GbpCq1cCd`9cfaS5=j1q8LH{##+tiKG`jA z>MYwAaNm4i^*B*9edcy(YFA4OD?><9XUOn48JEfZKj=j8?01+?XG>)erA#m6SB=LB1E|*;@*@!An zFu{babTMeugz+(=I6vgzNIq#dT7^k%sP7Qo_tNE1#(*px>lfQEF}C!}UszQ1qFCmD zIdho{K@)1L=tOPHWPAy8t5Lu>k6t!uPS!+b^`nJzcYvJpWPIaD(~DHU&rCCYv26nU z2njSb5@(fOC|8CDgQehLH7o2~l~t(&NQmmgF%IZxqW6G}S*QjNdG6Ttul{Aua2-iF zht-8|l6=r?D%i+&aqQ8J^qX7LT^(98nT&rW(6YV8<_Nh{qM^2iaFw`bI>-CX)rv-( zg`{VAO6tWQSi|Dp`i`}4*-)C5aKlU=3#slyp+=ex&RaSvK;eH|& zK`gG*KhpGPMwY3q0Qr^P>8ysVEA1R_X9Dh7dukxv6QxXYa=C1^mz{AJzMu+L#K9cJ z-vp1qk3y*%A4oy}7q-i>f8gKF5Z^e>*MbLT6w8E|8org=(nZ|J=j+Pi2~D!-nNw^& z9J7{w!oJB^ye}h5;xfo zE>8c%b9g+8rfbCljNW;;nCL7haNh#5_rC8ar-;T#6UP^-H7YJMtcr3b4ecj(=;R(*(KaRgA zZC)NA7X#7sy-xK+()-IF$PlGp-F99~gn?)D-zeb$I z(El{z?9QSj%yl;D60@MpPI>fnK7KK)Bn%kT^}1<$0xP37LbH3y9qv(I#7y?*6g$6YVtJj%*K-+WBnDGDuEs9mH< zEdlihy>51%mV`g5pRvtDzqc^ByLO5mXsgCshBoMmx*1YeU;c5BB=4)NYs+|nHpnTw z5>>yB2s~j{>@YoZH(^K-$X?JJCz&ASoJixUI-Ie-QtqVX53va*y#&Y*>Af1D!(OAg(3L$)Lb^uYS3#BPxEndp**e!wZW7y6 zyJ;;COqQsTIYzY(*3MPo4NN>qCuJY`)Vyg*S}5Ve(O)!j1G6JQ9r!x%!hdP9)4T1R9a#3;Th^Z*1Cs-!tQy|5HElM)Xd7CrrIFw&ZbI-?!|*SIc( zxrG#DBF|6d-896s7-U36GB4tEpN-3dJdYut7f1vNjSgKM2D`XFD9hYR)B|?A zQ-X^Ss#w%DKp(bF7dUu5P`_8d(}`rN7Gq=s4qy<%J<*-R(?m(yF0+Twgu1e8em(ar zY%Oqtpn6D2DVZwk57AMc%SEDRj@X&WyH=3%iR4eIyFsh>^4@8!=PJsrra0AawT}9 zwMN#*`WEC0f4cc-Y9_$|X%=(ponz!LQz*NsWMt!7n@1CoC1rXa6EC%}KG{Z*1;m8W z*f+#N<4Ln9s8zmt9d>pUV95!pFYLIPQbiR3&Q9T1gW(|QZyBK%-|pL21R|hAw7N-$(u*4%*sFb=xF>EE}Mn7nxFcf*JUR#dFF}&Ll(@E-oB;a z|CVPKz!v*#sj;jh(hb88h-z)mDV3#vzg!HXxUd!89t%yWsch=e2vg8;h@uYIBq+tg zYWF0{##i0yz-xHz6dwH}aCyIc9a`B{f2d#4?Q^L7L0e~vUpkssgx}eG4R(re$U{b( z@!se=wy)-+XYJ!^?>ytdX5)@)utaZ0^m{(9b z0tQpL3wtsKNnvs6>M(T|D}^#2%6?}O72jCUz*tan9cApdK~2tds;yHgax5gmliDkw zo)}JuD`Z{)B}3JEiaaK!NktlM#vLn1)#I(lc6BrbK3;b98l`Gz$p0bJe~RXx3l|N% z3e#dX=5yjX%GT?z5zGtPP(Li&U4de;b6#~>;o)g%)z_x}if;u-%cqqUs-VXgEvf^T zoi171=sPfWJ6xDsRrTa9*1QG@k?F1(eC77cMR!eOm{0X&F;r{X@*J|DXT2)U35ahhRe}v@2PP~y2({Nd%h3~-%M6y zHxV;zr2J5h&Jy@+7UyGeE4e4i7SN&{7`7`61`&VyTn`qZn5o4?`iP6!uUlwx8v(kG ztl*(*CXEBk3&s*B*d=fmj!{LO&%m@!jWPk|PoBjvZEbD^7AKLfI@4e057r_e@3~tn zH8icypGTg*_p5ukHq#Lvr`b`-)hmlEHkt7ht4H7jCf_Qd9)hNGLD|ER)wuM=mj)or zu*>=AG{O{yKovYk%d?R>i(M@4OUR*OO&A>B!$rNl@6Ydu1{qnz2%XI|tC=%{xUG?^nW&kGgQ*#VteL%qt0f^D2Mhau1xT*+bX+#XQ~h=f z0xNwpJOztx(ke1!spK0Ev@KSDagB?ZOM@rG4>5_=14%X>uim_{F?1-#{%d3&SgQ~< z2SBs-@cX`RzPk>FYK{$v>4^p-YEY`SVZ!3w@>L9Y_$V~qDjzKFHU=mdkPhB7C^Bml z3!j-frO+lPA%Lq<5@?#h{PGp<$DsCHDHfIq$1Z`X!L?4NXC*jHp=tuafa_T1X&%7h z@!2?PIQQIYV~BGvS!!UKX`#XtxyVsRi!?)W9>TsHA9l%&X;UoT@X@CHO5yHTS(tRu!O4FTS3)~tJ z&~KzD-^(*^=4fL9f}q+5#eRH6vHMmBGrOH5jLL^+G@%Weuf7wj&tz+Wl5ZgYMTBIO z4E`RzQAAw`VZ|rTsvSQqVIZ33FHKo*0DUm+@8c{6m%!E{sl1OJTXRg}s5jASf|)2{ z0vwzbbf8xuDFuKiqBS#?Dk{b^bm}Xa?$!Rs?FO1KfJ)*pzDkQ1s&|22{lX;(&HE*7 zNLeBY1edFftqOzbP(oXakh#kB=b3Sz64<3Lp61u9?zDFxX7NC`_TD+rK9wEm#av{I z?JN)h_DHuOLP?Qn4%rU`FNUjzIM>P^R+uWHA&OZaB;}q}SO~l!HX|Y?@PQH~%^E&L zoS+k4o2Zt21Q5H@iuQKkb9LJ1udB6q&JfRzdI@wo9{6vHKqe|xe8XhUJCIlXc0uXF zG8ob$w>HqtP?R>v7p9!2{89jopwa?bb*YcALy&|w@R9^oBbYi=dJ(ne zBX__J8uqXoCMp!zGt^~u;ZQl4tTi|U$xcDqytRHB1(yy4O(mw?vGkPtpA7WAY7Y=| zvA#Bw2u+YqVQj<0d0uIvhLEz7p`JjMCRJ1K+uBrY%JC9y?P$a^LEr%tF=&5iBqeR~ zQIwKM;-3NyLr@>YUBwz&30RZD6v*(~KiGQ0G?-eCkRBwQx;AHADUJ;G{b(TmmQ%t} zDA&vA!py=0R#!~aT?Q9W*O8c7^_homeHN;@@qHF>bw$-Iv8zfWSkJu5V;Ox`kq+xf zzQtVtQG#FVpok3!S6UaIkn4bCU1SnqN=q7JKf_B60RDo?k->c9;%07a1PhWo(rz(sJ-(j=4?B;wT?f zf(E-1DXNO(dNnYT2qXic7k;z|0lN-4H)8K35oaHX@czNBT#wI9-Wb{G5t# zahGOAiOg~uB{!88*>FZs&XJZW-0eQy2>BC2yZ&TXJcqf4kvtyul1!U;Pco&j9Ihg;u;5{}(Hzhw=^Yy&y+-+4pHft~K{E1^n%^}lWvL4Y;A?c0?GH%#(bkF8cWq5~{!jIEZ@V7*^1Sgp!t&knS)W6lc~tB2 zsvU=2hXLt&@=tjW|47N`a@_K4=m6@sdUv(Htsjr}*W;kf_t%~=X6jd7rM2_?l8FC2 ztH_QkpcLauZi_)|BWLHQ!b|Vv3m)IinYRhgFsExbj$-svO&2ch;YYW&j*{X0+qi|3 z;o{A6V>&Eq@;ffzUW5h9&q?3#Tc`@sh)UEBC30WK+DPu5?+FcCL=b491qrxuFoUvD ztdLj|Ng(Xt#%cDU-t-C2Y%D$f!9K*^-hRSt^&7Q`&LMNL(Sclp@Xd~k^{bDGvo}*N ztCHY+(NksZ{^a=a(6T*ymi&p)27_Ys;zD7&y0*@gdUZGn(8BZ9Ua^zgb!wj`;=R2* z8MSdGDNceiR2U;AN@;G%Ed+dB{0r&wV0X>C&m!rC`C2|L2>FpGKPx17sx^TZ`(>-7 zCo5vOnqbJ&TaT_z{^Q)X<&s9TxJ1ZF=?2722ou|O1P1dQs5W%|tUb^^y`rvkT5tsE3fjAP>o|ORNz{>{jDfYsx*1dL+HU;hWQPO>H^GVv81gu9&s_@v~A4o3?+jH|l*g0&=GK{2WXNgEm#53T! zEi4cCWO5~F4>)gecDvdv&raJ8NZ~fEWC47Q#or4WhKuJ84%=O|`b$YsWgb)g0m+JZ z=(i?<9NG2WtF8(PowCQJx+bIT7}-G5`j`7x5#oVOo)zb~Y-XDwiLIor$AL>5z|Q=Xj1 z<7#dlW~F6odqOo7XV7oi8345Yvgq)^lg80C$&7uL5mH9Yo)C?!i)IX&RkeC6ujQpr zib--D2WywYp}?hPwACv?^JaK^>7L$><;%9v4Qx7wgy_@tcn#)Gu}mN|BA`XzrB~bh z%T%N7;InYox76meiLONn-TpcIPsb9L{^q35L;#(uIF8_O^Ez2+|Kd}MCW9dojoWZ|{E*buCW+qA>ZUM-6> zG3|z`_-J8ER6TNV;f*YQ!<1jGct1Sw0U~2fKIh{XzxjJ7g6`bH*E(M*bISHQoVTVh zeVpB-LK?ujdh0&E56f>XPNFU)ed=jepv(4RL|$3S1ih!GJ&#yqhuEDX+v0rwG5QAqa zGc%usEGS}O!^~cYKu7u4J^9WDM!p6>_Fi#28+WJAyj>vf;QKy&wZ>s7g42@d~t^C&o4U)&G%g2%wQXS?Y^Mk(cwI|ciFz%$au5k5>A|@rq%ifRgtt3da+O(B>l8ulEa~3~eUlr2S~(BXKc1#|(^q zw#fp9qbv0cnQvWmon8x$;8xs|uz;h+FdE-FROX}M_vu?sk~4PxgIiaNBor|Gb^1vf zpQAh{`D+NJ7(?+4DSgXfO~;UdzuuRv_~*c?J{zvaD{vNAWL+2m8u?US${@CMe*|TM6mKnM=+Z= zVid)Z0i*R3fqTkMx9|CcUkH+#DG0~Kf!+tQGb4xlLqbAfTbd*i9LIeXPpRYOx~U!z z@c^%eNTwB?xPKvFd(CacBK~*!Z9Y86T~p(Z`Uw!3K}^~Cm`Sv^8k=DP*q=$OpN9pD zx++$khj00Wq}Hw(8o#)CQ9YssqJcyUaR{-`biDz5$< z4tlE7f_bqid{`oj43x2MHg(4EZLYReZ-YPYSM}`yz_4|W_^IUvYs<{s@jF6a1m?v+1_|4*Iw>MT16Jm(Hy4bG3x$WTiYd?iXG@ zn`u=~s5*l*3Z8s+Wp`-Vzu=#=CTgcp14m}O8wYIejmx6lEEDzDGFx6xQhRu>(J6V} zgoa9Vk23%>L9rl$S={bV|_p5qv`lNMh%u(r{!?UnD8!d`?JJ=cs>!r5}O;H~Uhw-pLGvvA_1rPN*EcS#)S0NdZ z3m+f_Y4&V3zmUhKK7N#XbE<_pedl!BaOx&p?9b2!Sg$_HZOPHE=n(Yo$T>LOHZ|`z zP%64aLgrY$>N~-uQ(!$}))kVX@>faqv!z+D1MOOq)hkO2?2$N^sKeqMyvwh!HtszPrp*kTE)1XO;Nm|iN)MYOuk z9k+j^*Qp7#S04k0mpiSWK^Hrz31cQ8t|s(h%_$X~Fy%#My^pFndhnAGwhkwIN}E-1}FaX(H_vub+nK2wb^wzR=a znV95Hd4B#HTHIE_yhi!BIC9>$ZQKWlsnwycu{WTjaZ^Stqf}o}x3`t9G1CsKx-OY*#zP zI;uEf0A=0#IRu2McalI%?fFqP_cXgiGbfEk$D@FVwC59#KP7z8GluWfGRaFWZ&~ER4WR(zqP#$aFO^0JL>~2E?fm1DjnXq| zoSrjnh;{>q)cShsh**jW7N-Ck>tc{iIR@S1M*~ycIGbon_o!`rKU|C#6=26cS#X4O1%*J}~BvrWUK~-`)rgp-vh;P)! zwviM#S(`gU9k|vSFXc!bq*-V zb{o{<;<}ibbWe)H{z+T79C$%`RytCF@aU*Q+`L52%j&v$_u5`9NtKq8U!|b3Yv1r} z{s@}{j*SvJ570_{?m1}zhJK#1NFuMNLqs?{UK%~028@*)rqUj)D2 zY0$~07fPjYs~;=;v+N34IW1n3Dt_CiE;2j!5TIK+cp)O3qpC4k;f1LGYfqy%`GFV& z5kmnuHi?IH``uTu8zt6aFsLcgf*Fz_I}&m|mDMZ7OJWW%3hbEv&dvuDcK7jMxx547 zR%FfKH#>{!a51UjJYGX^B<8E4Rw{8^K|>BmG-%?8X+=s)9g4N3(1GY=ArCOG{dE z*b*C&Vew3{MJKt$S9!vA_nZ{2l}!rsG98KcuklUb+K!+aR%lNV)dOWV0gYTc%+#u~ zttEAHJatTLDX%(%Rc}e-NNW+QS*s3IW@qqOiL4c$I{ zj;i{gyQ07{5&kC^89vxF=Np}Re*D}LIg^|66T`*77P7J4ZjU=Vna-Byb{S4XJ?H0H z=Z)9lrB(7LPa7k=tWGPpzv7-IuS3k_`F2K09=8F>`~-gR6fC{RaQL`85yLE++07;? zWfLNT34b*1RqsM1d9Y*1UY~k8?o*Z1uHvAi{@8ZLJ^cKaN!CqmE zZpKM_QBcC{0iBdYp=j?ReA2`MF+`GtN`efb=2V*Dg?ciq_nSPGZm~!nRk|(UX z)&Mfn2QxEHO37x}g=&
JnRMciA)@Zw_sHn&U(Imf$@RQs6`d9G2`HPD&t_~b32 z3e;A~9TBQ_%v)N@)jzW*PjeAsESvrr(j|E2inkOJ6gztGo5qf;HEC~~?Ma;)Omg&@ zljf}wibp=~_;GC~m0`#7|BtbA2o?lbmvkT7wr$(CZQHhO+qP}n_UU8WoPIMg5pQDN z;_hoxo2nm~U%LMOdx*3&9?pAI|B0t&J;7s#XbAOXc@e}&6;q^r=Ro8bXTXw&_TUbk zMA*!Q#=|g=a01D*R=Biv8j#3ra)Cs z$RAQ+uz7>9Xt1g)x(tGX6kdnC|D@61tKY!jp_@jHE<6BKNAz#E!r+zTdy5wx2eG)c zdEfbW-agBYIv3A*T_L0Sbh^cdAupB=ibRLfKy!=sN~|*-qXJT#mqhSW;tpxY=L zD)L@LX-MqKep(%G%e?gyCvp;j{xZV3mB(Zs|A7BE2+EZCr_|<}5uM_`Sg>Thj=8&# zZ90b!c`RD_XJWO5*%A7$+w}9G4(#0nX!}};Uf!9XxZSy2Ve#&7i3Q=%;QhPvanS!c zg=A9Hc?d*Wm`<-Ll?Dc3;WGxt-M})u@Gy|ssm1HgzY`Ze4$lsefa;+vf0_# z{v-P;Gb7u7A6M`ETY(dG!1SJ~E#uXzE;j))dxO_^@!MuS(To?^s2wMATuTVT(L)Ai?ArZ$FJWF`JY|9MES0g^gUa2$eUlnt<~hH-Uq;4F2|Xxr=S8z* z%zN?z$jlO<_Gu8OP*P}u;rTP6dDr69z!B=5KQYJqP6n+#G-;&k|J%=zWJj1_7-Jw! zG+mCT{IjkSMyJh?*1};8+}|mc?q?)Ii2C>^dxYkENVl?4r+)6Vkq`| zhGKZcmD4e?wFpc;SR~7VY5&Xk*?z4{a+AF5)MMA$Bx}&AX+1E#ky)m;O_iB9MdqvD z&V!3ljGNVw=uOY+;c>#M*F9`|tA!@iq&{Iv@@PNBkU>mOG#lqxA=%1R)Pm1qj zh!I^zj{6%FEGYEa$)zizkQOVTsp_jfhL_r@U@eLaV8#*b5n)pDN+z7#lo;XnK_V;R zVW!wxA+!g6iCWeOAsU$*=g*YdM8}V7mThmDA$@t24*daf zuqT0--vzTsDPgXn2ML9)SjBB$Y-72hQy*$i3a!kGP5RqzT4l%N_zm=6vLWP~+xpoj zVGcgl8_U)ThKO?c^tKPS&hIE5e9}wJuy6p~J+lWAUP@W`m7K^(n>$uY7@(gbY0MJ8 zy4Pf+&Gdlt5&VxN7<73M-QW(;SM>o6SJ$rRJEdu!lwt+JBQ0C!F@lPJl+%T!|Aog7|t=zIC>hComcCYN`rN-Xhs`9Ktx<37C;`WYG82 zJSjtEaOA}=*~gZ^=CLt9hPMEV{w$!{vo+C)v9U?UDw)qzfTK7+^&!X&Ft0oYXw91r znE*kj5MIMaPByATIti}Vq~c;Jx^=}J(6E^{n!5hTd!|8hYIG<;v?C)al{!}vcU?Qi z-_uJ?DcuqF+vL(1fj!+l%v zYtBhKt{Lg&tb(Iv}w$oD8YHwBd=s|@F&bml!= z7X;}MDOQx12DBZft3J|W?W_?GPmM}@(!5F6(r1!mBeo_-n`2sXOo`|M<0srv`tF0n zqZ>Ws6j%qZ$JoNRxwOyuaLDqS<);xYRkhY7STysDD$v_K%l_~zR5+3@oNLTFIyds( zus_xbi6P|#ntNTzhvovrIajoBQrMT`n1|o+X8K_kl;OyFW6IdAhEHho#9$y&-@WbH zqD;erG|O(lOVxMt>Za4+44Rg(8nma;9PU_a&1!J9W3{oxgSF%{v@a|0J|Gj=yZD{D zmjlMh8V^!Yo~bb=LOiO1a4$*>0KF>n_o<>_)9qH^53BZ%>jJkm%(hH)^JJxn^x!t- zwPFv;ZOG*{;lXX>Nx62wko7l9&j)X-h~C@~W<=IUS%Ks_o-z(mumBl0)DR9Wr>ci+ z5#1AQHv}9LPpV}*j?&Hc93+2Ff|}%VrWrv{n`wWuuG+yuA%)G-Cv)Hq1Woquc53@l zfX}MX7}Beep0LN=_u>i$Gbr@g@LO%{vQ^R#Tq8=~^;)8#>nHl&I_Z}jQ12S#TvnZb_}sck?-2b z5)wR7@nN(;1>WAh0?0o=!nbB;JD~ryDlsNE#m?3dR^zl*v-pgdA1{~H+ZhuJ4(PHO zZfcD@0MbGsfj1~a&dU4L3Y<7LXxm`U8%a9u$p=NQax=@sm#aCB>e}Vt(TQP$8kz}r zl=u3_@h>rpZ0>3j&SWp&nc~@hi+6!3D+u3)plo?T4CoXcTQ}=WgOA1Hq*X_85yA4Q zx)Eycx#HyT&SS;Xi6Wr8cPh4`my6q83~H-Id{0@8lN!fh#$FEb>)p?gWhzqjOf`8} zi?`Ql5*Z|Eu*3B4S*4`%K{cm{kiaW0UIeb$K#IHw6$MJ)6?@n^jR8Gz$59;%dWl}q zeSa!zHdAj-2pe*i>9(z6$?sFFO*k9)ZrO^*w?|G2*kTPqms6GjeD6V$Im7O0NqyIa6S$S^(GdI28Niz(;}9G(q02_e#_IB*f{B zqa;zV3OZnX_6&>nHjD-kH%>fL5pKW_pi6_RN`&R+q&zTFgD~y#E8+>z>96v+N~@nv zhv5i~#G$#PYbox*Kf<3hO8VtrRw6KQ&)S4i%IrID!B9$KNzLEm_FR~nIwqtb^@5-v zC))MqSX8u0zuz(m{MiU|-zwO09;3h5Vl-SjZNKE)a>DsU;OJ15E+G<`cc$N1#{2}M@WIkQOW-G?BOtro*BX@vVdvoEmI zZv~xTerGN)11q_3uWC4(dh{~~Be!54LSOh9HN^S!j)#*vxA*hFH=?9Bg3 z1;_BO();ffT#M#Z;}$FQ|M6dd-|;w&Ma?p2oYP+KxOCo0?J!3fFYVEZ$N!gxvF1`* zv|)rwke&UHxIb<$9KHAlSkTbG2EI4C?4J2Pl+LfV&(8<1_lGrTJmL7Cp-=X!esGeV zKji%fcfLQDGLrIM@pg#Ca(RdbaHKm+uTHp0&LKS!dSac<*pq&apE#7!furBBi$e~= z3v42Vf+#5`0{~|eP&#Fzs{|2sj+z+6e8U4u?@YSt`pAXGDA*w)&>omj5prt@N{XTf z3{<+jICFZcloD^B->(8y`23cQ)LAmR>e`uwO^){X$FO8S+=7{JTc0walc%o&<@+;t zdM4u#60dupHZ}CR$De*-d|`EKiorE&czT^%cnYlGM$X8vtKc%Z^*|)t?1*u@;HNG) z=X&`7f)!`5%KF8a)l2sztkiq~Ob8Q$Pz^ zY!!|Z!W1wdDd0d>EaDbC#Inw#XSqb#EVvoo)t|D@d}fpo538AYAj*sAv-Lrsc77qY zz2h^8LZIQ{Z-WV)%#aAd_FhV19dqzdBh~0QHS+r-AK-NI%&HdE_AVUu* z=C6zN!Q1~ZjSZUa1PB|*pu1{p0xIT9iR`E)$jbGk3-sex56&P1QU(-!lxBW0ejFX8 zU4-hLlo_^uk^6y6iUOL6qhd5ev46fPy&l|VZwMLb_2&W&8niZv=|!(FDX%S*-H7Z# ztxw6fHm(tA#PPXMy)5^vdr^3SYx+ZFZ3vwQtGToshD5dDe(I#Za3IJQQt5mMF{9+L zEix;4@Qkkl+^dGxjqfiI8;GP{?KNZ&8HKQJJrZG3{L$acHrRZe;32bXQgh$}oIjdb zvI?J!v?Hlp^Ww?9DZpf^L>EcR8&td-{QJTk&aB|^ji1ZPhkI{C{jb<-T)zA!NR3TD zBqxc?8%SJa#%w+1Dq*fT#2YD+(k<6*ODQRQ6HPVstRvxJPv<#PB&(!YnrR%Y%D8WS zb=Ydkc2orhu|ltP>NjO=Y}DE?chQN<5Fv(I_%&o@Uep!cnz1$q2ehDS3H-~s+SaI$ zyfZFZb{V>^9{#|>ntLs7E|V=Uvw(W*Vcv0`5I^{*VeqxU#`gM5*IldNL{)YRJ`lcL z59Rs$i9{FRhMIbDD32E>iFvZdWl`9oa(L#iYJK4>81}(6$vr%JJ4d+()P<{(z1g@(cU9E(du4!YN2{?#s|iy_ z0Q*vUwK23rkd@NQjRbD-O}b+pnG??*Z#N@eTTVSQtJJA&xAG;$+)0qbRb+}#k<4%F zD!ThbW{wgTb@vKlnRP>1s->OQrnl3hblHuuMO?`%;T-S_{uO3AW!B&2r=3dYYMu6N zN*YiMkE%Hsc2O11ZYHHtWrJ>dbSVR>_`qC9>8GG6?2yAWYTaA_|Oq_^HVpR=M@{&|k-)0s%i&)o> z-5Kl_D^_F_9aWB#KVdVU4?2@Y(Zok%b26Laa4nK02)@2of{e_KRyT4;%31YqH6;YK zj|;(8xiSMK$`rGQe=-myc2*i`bCU;o6PJLd;<)J0mr?#3r{)D{#xjG2`x z2Tkd4S=7g7V^SifF-$x;3&~A*t7LRM*HER8m>jQv*7zG-PmbQ#3yZaMFESqsI2W3O zHMXduAj0L|s+7)BMkpgXJGi7F57?rKw& zr#k5FD43P$i0iavobt5V&cG>j@r?9DZ&bf*K|HPzzQjFX+Tph8}yq>*-oHQ{KK!G!!`+rS+kTy4cir-^T_L7!(27~oj|#OI5q z3C0Bx9@MVw?aTwtmNKg-?~<>O5_3^cpBkP8LoE#;(^q?$)}=i(1nph|%PDF@eGtp3 z={OgcP?E4#K7>FGPLAseRMkCO&q}Yz^+MVt7x?V-aC_De!@xMnJSJnMAa;2iN>8ib znD9=Yv0YVVU9;Zp`*ZuPY$A{xp-L1i8*tajN-}rc??L1&{-eK{iJsyA0a(;%P1OG1++9;ATz@D!z+$ZN+N3t9#=Bzc z#i$#ZUthEdLXBc$jZ`|^FY77gij%+bZXZ5~NMU}4j*gD3^mwIPcJ_bK+`sMae_sD9 zbT>=F9@QOwDb9lvVhGtSDPCHgzmzxca;QTFiVW@k0u13BZ$3w>uTzlo%;` z1i3DRn4tn_Hw{um)n$s7VdxYUqwcOwuU}4u@ZUbZ9}WwY^nFa`td&u`4DC)4BBuku zX&u}5Z_34(-?#f^!Q=1Oh>HE0C$pA#BkbN^Rtu|)d&s_DzmM0a%S6bg=jS@T&N@Hg z%|MJID2IOm=2RykR7V3ylPNy{m$1p?y} zBi?f%v?!TknuG;ihzU2{MA^a0`kDghs&(kLHjoOJ%@%-<@ z8mo+6a~5#MydepnX5@#99lqq8L@JzuZbgwpI z$C@6!yED6K*P%{QjipJzK6c8#Fu$r!3ivTmq<|q#W!H+F{*pK3d%}^WE|9e%PBF#Z z&vBbhRik>Z`zj^Ub~1YrHu~L#Az&aMe%Rwtb<22)?$K)eD-ve2{UzHNjp)b|Z&38s zkDA0qG-Aap>0&4-nqW%-kH9cQTK0T}h8O`pPx@WXFD`9oMSXU~#?oANy86ERe~MWMQVu1v zZ+l8X2y*pUXeje{+s3w5v7jLP!j%Q)9=eE8ApE|$$5UV7hEo}!ZMRZB@a_{MNeD3{ zIa=T>Noq$(2*WV`i4f1GmmMTxH9;Spkk^3iAWCwC9=`5LmylAS8H>H4?U~s?6 zN@p%8w%D8AG&m`-K!LwAoNy{n%9cHlvjTR6gURXFP-2^!W)&=Crml)yaF6 zCY~E7_$J?_*g-c9TL0#&>jF(-gX&7L(+(qz#o>HN*xjlvd#ueSUxlw=VtW8=q=T;9 z+v~A2i*+)u&4_a4M8G)ZSd>S*c_HCL?>ZK~sLuq4%8jjr+1RWQIjkJmlRKIW&(3*t zJ&UcDII5__K%_st<||`51aUqjPQ}TNZ50HoEu_CnMxG-gYj_uTP}}HB{{T9xMl_d* zEoiNIvg63}3Nw?CLf*$l@_(He z8;T7*jW)YH;aeKC2~MLd;-q^bo)S$+=b`&tlJ#0s6$eB}h%|xpF#gQH?Zr#=ITGUr zlPw+!Ym8ZyKZ4~S5|BP`2vP?xi^8070C=6oy?J6cSRACz!HzGm5W}yn=N#zPHi7n4 zNq(-|isF*FWd*NopKFQkeI!5V97$&&ieYql9XAyswL=o$8C%`xgZE0r`9B238r z8m?R~#rY={KhSoldFE#vJ>v)$IDOwZ4wXx}dq8325=4~VP?^dBhB5jX5l6!5{fr#kup;2#FFdUQVpA&fgIxgK#y8r~1gZ)yVA7K2mKO zf=fPD986kx0Rj1~fSDJpzcEmJRvZ3S1%A8j++p@1Ih`<4kB1Hy;?tA4Tj4NbcKS@S z0xBNA#5-mWZT3mAu``#v6Ukhp%!AJew}5T-EuVW3+zF&ZMY~ zTnjRdm~S6J3qx3B)4#VD{Ku`+L-}Hjch!+7i4A5HCJ5!q z$HCFN$4%8ee+ODQ&)|1&IenkC03Y3HtAD~)q+^a|x+XZ#KJ{)nPwjL|h(DOj(9F9L zFx39mlbTQFi1u0l>ZFIr#^mZL+0EIn82{oZIOpNVf)HvVZ_i1MyZ^5Ioh6@%!mbZB z?i#GHakQAmHb5LqH$@(6@|;h%62%sUx$@?dS~eUdj_mp{1oNlkIT?I_a{LCj-7;pYk@_aK?Ud@a!YPzT<#P1kb%gmCeKawfe;Hu=|GJ?p27KjSgB)Z9UPLw&_!sjpfpLB!yF! zT|s7M;?u=KqsNu@aL*##QQU@QNcw$s1XiP@*x{K21TU)&^O#{?8*8$LxpIf6A0vc{ zQDl z1`I_5`M*TFJR^$#O-uPW&S63}k+MbjV(+twU?L22dN*b7{PIOW!~KbfNlhu%>pOpQf$^i%rEI&p77C1xUfl{44?08v-@~teh*2p-azhZM{dS^cD?t_k7B46INq%=ys2G61@~BdGELP z>+oTUmyNWUT5ZNe2;3 zpEl64-!{`ml&27@?zyrs7^&&z%{T$l2&ZEW=Z&~+MJZz*bC_n#<<(>H7F1~$(Pne|5 zQya8PM<88m(ef{y^(^T;%C2>no{F~);oH<2aTGXB>q_eh%{ptc2xP)qHrVLCOxUfj zjGe{(ft~#cs)jGwYHyd__XD+Fd2~Rri@~b$u1K;%@;hl|)(sn@u|(rQ6Zj5+zuiX) z1~C_$iz^X3OH3b|O&=>!jpSX^Q=(axdJzQ}`o?QVIjp_p7&$#Xtb6LORcDsFwoFUO z#vq_}3-oC6Hbqunl7-i})i%nwm61$1%6~N9l-8MmhHK^5+&<1yw>hC1glbkgIjJ2N*lbC%7gdv( zMfN35hBX412Vy0=H(O%om~zgran9tKBatZ{uJ;Mx-5|=xbS-Vj0GBf#UTmL)kdMfbQWVeuhr8#zhIBH4Wa4;kqOwU z#@vVu)~NW)3EVS&i(Xk_{Rp$drfdHR7>0tg56g#BCAXy`m+B!FM>#i#R9!(|m*5vf zq!zeO*;;{^-ep3Wb2nVN)6G+L&{}Yf|DWn{`ScW6AWP-6RmD4!mJ3vG$H5npu4 zmFBc`(q$Q%a+YLW)ze{LlbrU}BnfV)R zEQBz}KVw>q(Lz3UUqZ&ML$q{TO9e<8PL^;xT-o{SvW(Nwbp>A8g;Wlo95iheoxq`Q zhX0bSr~3tUN;dpE_D-@TtF`bXk|0tAiueX?LNlIHcA?$$T|QdlJjhi$$KkQJxUd%2 z@rTj5;Q*X1^0OJE zRyS?TL4NnSFkroM|-(HG_)HgxH+YtHx<=<^;2^*Vh*wzwnlG6ro;M9E9gvLI@L6aMBHuKS&a5TuFut zRCz9kItn|h;ez+4%6|EB{W?!${=5ioVi`*4Y%x*+m9#sI3p3EW)(KUlQYlB z`sIN#Dtl$2Hegm-<5z-Aoi-9wkTayY{fFkM(a=&Y-k2_c z*jKiu`qM0*vb4#PdNfXQHo9<@tU0VX2niQlqnnF_$|-ax0%6AoGpP^%W4SJI>O4`j@Em=v}IZh!P}Dffp6zg~rPO zTKD@AL1hUc=p!}GckkQM8IPGeRF#*!b|k4-SP4~jk@Jt-Q>n}(UiRl7`>p8+Zq4Bd ziL@kOEOMpCgWd=nvQE$+zy*aW>S86AKkCaJIAN648AtQYa{}S(vMM!MY8}ah$&qIL z^VQfPHRK+uuZ~kw;j>&n7&#{BKO%^-WzDW}%S#-=bx>oaEF{I5XKu^9$m~sX23}Rs zcV1e@*)unovv%4yG5QRrE@G)oh&R`nu^Y~Ls&#FvwfY1>r{&PF%|s)U&J3WPg+wx? ztw1%B4K|1J05xQXp-KELYWKo1f)kyB;M^MBN?vs6yOg{D7ehHbT$P4*tYI@B+#)V8 zV%xRLykMr23PenBW|0^TbMe18)pZiyxm-vk`l-PYX89Uy@whPDA*>%70+XuviF*-O86N z#QoQ3z}Tzd!*)6nq&eSXxyF){LfadH2nV4$+&QGf*&rb-wiF8DC@2ryHj2THY zc;-c_vzp*8qi$$@bA}6ryM6k)vHkQi`_qmJZTYK@Ty?m>NqgmLQc#@OtBl}GtODiHJFpUg z3v*43w7Eay1zlMwpI}tSM)d5OJX;k*Za1hq1srW|h2){d7(rP>r~I6__Cbey&-t}Zz?7-eKG z;tt&v9Jav3%rsRUUNVsgZPZu>gOyS2nI!#EX;3u34*GNn@$7uD^N!3ZhFHi6J;#4W z0;Z%LRmM~b$DyH-J^SdfC3w4YRCAuztXL9mt>Ha%VG%~jD_T@m64?6Vz4ChbGB*uB znw^Kd&{K9_2e>W);ph%x=c~M;i=e?)7Pzz9PA5>fGF}B3UuX|dQ{q8?(Aq4j0JT+N za|q1JFv@VfCt(Uf5&`nZ&Kxsd2f$wlh7r`7CFgbKMR$4wjv6t|1i<{^ z`HJ6U5H$`uP0oxxQf|K@ooQCfWE9U{5GyfEvT*TkDvO4 z2DtYb&A#jTNL2svV_M%A+7E2P|B$E6!N~X@H8pHZ4F8V;0lO!bsiS62=?#RN>_V@9 zP{d!`-#N@0t@y5%$HH+$#pBzYSdx$==KB5>2Ni0|D58-3C+Xol4k=ssD<~<6%xvgj z==}5bZU6TEmv87&k58`e%Tg9U6(2C0cWnt{x-gh4K)Zi(>GWC;Ptd>9{|z4B+Y<$m zR)6vI?I(0j_zMoLsYmCqZx{Ek+KpqXq^yx8vHFI#|% z%sv%1B+($;*3j)kOShRn7CZ^%KFoS6SaxcFb5L2`pd1{b$z!bj@^R z$)MI|nP$SW8@S{OX5Iunw{LwpV6%=ErQ7OHy)yO(Km(~kgFwu}g; z7&=a%~DVW%ygkrIJjr&aM9iJkfytX`6nTZx(t#A>lNRd<5ye>wm=OK47(|0qR4# zRnC=!qhew5`vduz@`s9w1c#W(=-{o3>Xw}CbcNfbjx+iOLz=U>yBM&N?ewf?nktzW zc&sj1KeN+jK&eOjby;CpIVCn&g3v`PuL?++h_sTh-mV;hQz5+jE>vf1kn1XQMAt%( zc~q>lJCQU`_IO7ykso&24D)CpgisO}d7Y8x`aMl=hk{yks@_HsvWJ`~N++HzDhQq8 z$S|g|l_=tz=R3&$J^B$bLJsODd*&aztw^9nP(yr?AHKjgLTFtfM`FTw(AXxLlG7D#l4`FqwWSyGu@3V|k#UVG!nLnH^Z7AkpBc!S)8cN{l7BtI}_5%d*c8qLIA znW#ON+Ey+{8Ti1OAYoJcDql#oGx*}jd6*T?K$rY!=^5&D0@-b2Me;?O#<8r^4n?e% z&fa9%Ec{8zk+}hzDYd2(4yV&jxud|t3`wGq)3f9z9A5<_QGCq?r$>bCE#P%>CxXX0 zr?AyX^ZFRO(;&9rBEBxIF!3c#P?5ZF%h`#D(&J$}(i?Xm8!q2|>5GcwtoGG^&g4Zk zuG|aWG(n)J;C4frz;+x;5J#z#-C&Z^QX$_@{qz8mt(b*!pnQQZ{ZTV_{t-n4&(;v* zLN@(U6Gc>~(sJcP-@hY7?;PdXh*14D5Ok0w^Q^g5ULnOQplaS=K*c*WwYt72))inr zS)GURDIsDq0MW_DX&?4pryfR?5nxrg*1iX%eeLi~X>hHk_VK!gzlrFW>J$x_{6N)HM3@~+PJHb0Emkqr3Sd%e=wmud*E{For z^_LMGzC%Aw23WJ6b+jMHYxB4bpEAFs10E#at{c!mPI!cDcj8W(dbN_yO2Yi6Dopsn z`Jlmz5z`cOjzb(FQ5dw$h+D~6S}&8+8U@|{sjtyVP}!vIT^W27jjabh11D}xioLq` z(k77-!J#>Llyj$9_BZ~e0yA)y#nL8NrZAUKe3SzS5$3Z_(s^3%qlOhcrnxY>SU!Lo z<%|>ptQ>$gelGu4?i>wd-;MDh)JCJmN{a(a)bqUWT8;z-+5%$myaXn|&SU)IeAmu0 z-Kn#DW@rWbvjirvm;xLip6Tr2(2dN8)oNV-(~LE$wkbmH1m_ueknJZ(4)>(HE&BaM z;5nLgbt+Q`MSIIn(fVp3_yum~x*1Lopbnd=BW3_8uwae?4=v^;@oOKu#nPjcq|oy6 zf`+Dga$}DKTKi793Q|P^D2MchHqbdE3Zf_Bn4SVpu{NbImwKy5I8~dzQ)MM0vMK0e zC7bQd1Di~ll9r^QgtkQ(U9xsIQ`lRe`!DsMf`9nNxSn)xyE>miNmdbL`{|)z6hR3` zAhj*VLmnA&cSJ8UTm{pGMYzzewM3;EdBKz>L;w_d7`>?<*P_}oT!@$+bzYam_4Rvm zQzxkpk4{+A?yfJ7AJ}7I&{`_X(XQYu>fKMm4>yy7Yk1His~^j4G#d+JEB7*OeluGw z2YQzisLx29G=AF6;Jiy=rijgz=TRDg-Ui2@P6vj{cA76RObvjh&qNd2i=?pvZyc5d zu>L{zOcR)CCF0(>mZ}h+Yp;Gq=C4oG;@27%k* z_$(~DGg8$|Z_g&*^z2n?ORBObAHF>$XlKP#BY;Mg9?OEqGVIxc=Ge$ZN*{Nj?v3fP z0~pm?udgV!fAW*tZpRwm^&j^|%pI8X5&g(hsW2jpC5F7uEuTT^zNkH3#BHA#z~UV=Wn zqo7?KfE&qX6h%S0svAaX(;hR8AJ>$G4K{;Zh8Jeao zHeb7!&ot1;Er;52MiawBUk>S)&JXkg8vf-{C@0nhK14%57@3?_?K$Y!AOb-?vFuRz zo@gfOaCA$REKC7Pl2soQvlD~28=F%n+f zV;8Nn78YC$CU8kDW0y94OMd+jd|G7u2{N{Wmb*h!Y>CD5UPP_T#TZRQ7jDiuL|neD zGIq|XU?`}1>6Qc@3uh(bA1TURF5kG)d zz67!;)JJrI*JbVHlm#K!qwlpoc^sC$VJ3EPvMOEP=ICo(g=>ewHBg;2ZF7Mn7LM>9 zs#FbV&{XUCQCYcuO3oljH;T?}c5-kgmaCMP z+e|mGs$-A9FgmNWwv-Cks>rHipg{)3^Tz3}vn;eDjvMB=yNu_`U`Vc)vj6Z2wd`1- zl7py@`^YlwX#X0ytSDl05)guML#*qD=Yg(0TiBJi**4r$lrcU~nkmlSn4vfafps-t zj4&u+S;RhdZApt@J)qI8`gCuQykMrfT_MfhELuwe$|?0Y{+#xh2Dj#r6&6XIf<_w} zgp?Mz%ff4mR9-8%V7|_9aa}wMy5ynlG~u_2+~IO5!54+8Q-_y;c9|j67X|JKI>WnI z;PXCD6-TD7`)sAMqfFA#l=Ko;P3ur0^KvB$OmT`r_EJ(Ao!`fVxu0LoY<9CBqWp3u zztfC%&5+RNWQE8HMWdA&Xi_(3kszS>7YS;yctORrSJcm6OW_SS7hAg*W5Fbfxkj2{f+{bP zq*jc!fs)JVga1_+_|Z_z_JU29PIK9@O_q(A-dJ#)2~5GZXYp@+M^z_;GoEsw$2smQ ze`DqBmK*bW@kBb7L5UVd4lo$B4MDz)=?-R-Gi>PVBCYPE?)0tE0uFY~CMjwLD_EIB z^Emr8iuUEW-I4EI6R4W|uC?GBYs@@PeJJoTS?nLuwt|bH8*r8`$b^!`>$5Q6;1VDv z{DV9sk_l!tqTI78Oc2}rWP*hZ=xW-ZqZ3Rkk`M_aFqUXK-FPbc7eoYwS8CWRt@i+J z&v-spf|if>b?WsoAE%+O{A_qroRVut)v&h#gJ#*P~`*HOvF!tML<>Cnl?yK5Gs z#J-==XBN&!j~C%CiM@tapS4ogy4_9+B%DQQ#2Nm-UzZ<}Byn~KHMLpGNm#s*}oegYed>WhXYUeiuk zSkj)7Ax);#5eb@O>Znw<3kMoxcak<%yGrG-3fQ28rqz1rFJ332=5U23uJW-5SCSb9 zpec%q9eWy4by=LqRoG{jjGgKDdnsrVU;HI81s^DiHsceiwFu9OV_^xZer@0Thh-EF}{CG zn})NVmLj{gh41+6PcrpjiRAJ)Uu}qM%C6kt{3Fmif_8v*T9h%@>haLa^G-5*oQhLc zqOhwLhLIjmZ2;#3xZ2M$~^VK)sZe-134_n%xQ17P2{OdWiN1ezse%}@` zOIsP-?)UI0{Je0eM^0JS_kH{e!mEk?KdkHiGj}8t6D!Am?`&(dCt``l5PCkT-hgr@ zeE=}I(d&WVNWE-B;jT!h&@S5^lpgtcyMRbV2l+yC) z2FMWpWdX3Y-$8Nzw0Zt~woS?Lbwwo-P88GbrA}oz4vyO^Xp+~_?cMx(q$y@pCEhAd zsOOfbsvS>yx%=3y5pyrD9H&8XTlX&WLawpdIP02s^j16^dyn)}0ZEZ)S8kWtLiWD< zkCACys-}*)oMG1cPNMOBj(sSgO-G?eK%I^}U~JmBBz)O)KWKy}d=w$<<_Y!qWtBG$ z`t^N38pG1?O48NS7`2)C5!JqVg+=lCB2vM%RwG8`lZxJ zD?^r??gJ?)ll8!{RAh@_j85*6UI-7%tJn6GHss7m7U-}$uzDUYnN?X9*y7(lBrJ@m zHrk?W@jIQn9l7uuOchaDnThofsPquA$+u{#V$#Os^hvz2V-;6sUn`r0xUNu7mQF2c zyXJ>X=It}~Adusxj)r?ex4Md=O_o#{CcLJQK!6Mu{r+C2#YFirZ!U{qAV@rG0U(+Gakx&)ipX+il=+`}V5N*6yQ#AG4?`8unV^lC0WIEl<17 zL#6C@w}t}9rThXX{OXN!jC_iv&OBpC4*V$))U18+G37Ow*etoke!$(hs`m6u6G!K8 ztwzv?Og+?Z^g)V6c?yPAZG|;~qZd;6vZfauqyaY?RuhluV%l_reh_alF zim-3XB@*CzmcB*I#OQx{p7ByWjbrH(`=;zOg8olzFd7eB4lh}DswHltb<>jQkVTF7Qz=L343j?I% zwTbi3vZoXnkg%<|zJ~0?7(ozSDy9u(cR1A_SbM{<2p$)Q$S}6W#|W!3$RQO#9?bqH zU=*G@GL4iS5<#!wcM9}zq;V!oRS+m2r0y&j29*(!h}t_-g&Tk-Zb~qfH#`henhi8M z3@-;jCNfks7l4+s&Dse?N)7tp`bKM4jRw83OARCfHt%nsxV8Moi?`m2X9A{_HbTn2-CE6|g^SN^ zU|jT?QWiNzWh=7oh*OM8nDQvcM~D>ROFGw^t|Hr0th+rGF0d>=t4(g_X*fRpWjCuv zR(?R@PDGxaju%p`TW8GVdo6npM0>WaW^Jk z9@KLm^kJ1LOiI1>c@3u&aVW~?#vumx8v5<8M)6Zz7VknLj&2v)~K#ixy#6w zQapWMzClArEyz{%M!L;9+V11Hidv|zt^!^AKX-P-6_WW1hghoa)s#bi8948YK&$&K zzECi}s5LbZ;A3+%Y_ zq)QLl*f(lf(bXK^d{%r{V)RU9Q$?q=OX;)Kr^IWyyP;*9NS-o}CoZGgjya z07$;7$J~ztlz7AVS&wxqFaMO_E3*tC@Mh;u4O!1o+4T>UfS2c5F|um9$yCFjv2N)S zNc2DcY91iqxX9&p!tgKc^x*}de?$C3&>$orMTi;H$IQa4&tpzWwWn9F4Q9Af z)!8o%Q55jRsU~b)l?pwGLPOH!VypEgeF34-X`sMkrUEr}ew6a!7uk*R!;kCA@3PxW z9_9JJ7<;E?%K|mqHkWPNwr$(CZQHhO+qP}n&Sf*t+VxZwb?%MxGUhKBGop{Lx7H9?78L+%o(_628waAUh6EKZ_!lfD;tw%)CP0Thdc+2> z!`BO~Cb|EO+(6avyl0dZp{osgr`D(Y{{I7pVKN z`ZgIL=kIJuw2{EJiQ1-FTHigw-*fCo=BfE&H0PXHKCt9a(%5?YK($D^4uwd@TtJ$d z8oNQh^M|zP(YdHfu0h0<9u+~4TcTSQbG{Q} z%2AEyI7`n^!gm7i?&Q-%?6`99!dCMioZNv22L_jL0cXCgny?4Bc8YmC>)u#x-`{J~ z3Sy2+!x<(J=f38xc>#1JPV9TdG*8MM_>ipPKv z!u0R_;92S|J{x^g?P}|v?+y2A|Fb+1ewaI8fX^*kBNE zW=zRW)!*a7K&&K?qw%ejQeoSn_~}Gtu`v?YdvB23vz*DCc~=h%a1ID7yY@gF$%!7| zc6HmFFxi*iynXye&TsTcogaPlp9EZ8K_wg6X2~y#9P&8DwKuZw*5u7p7NF}U2?D0; zr@V4XKvw7veAF~yu2XOhCJkQn)I3$ec1fKIFJe!V@?eSAD3N=rtDRHUpW$_(!n`=X zP((hn*(rvyPG>0ln=fq}OnY+)R*$)`qM-_hH-gf+#*MtnyI6@R!c)bKvO@2c!`{7% zqZGF?E@;xxi9=eW|1uKx^(U3+57*SgK^?{vl)hUvvR;uONcN>bHt0h8$vB&{S&CO2 zDwQP9<;)}&_+r=Dk65UNT(ZL3gF2<)ACb-d&DM-1#u!()kcX|lplDrbAc79ey%d#ZTpH~)y(}Pcj@38`YmCouY0qn%Mz7xF+r+x%N zpQbcwVX#6xa|Gu~L*nfQjrsgn=r!>OWS+M?-qSuVxm-80YVWt7{G zo#u-Yo^wjuxdF)uui0EQ1~=o2VdmfFcFE+-y^6{3(%SUFu5*_(wcVPEom0{u27dHTvU~@um1;oIdAZ zVUx6&db2Ar*f)?=ST)<0IGu3=(w16}Kf`y+sIu2EycCD5cTIxeR67yQpSW7qRdC9(v=jB5ikEdv*V6gF5)H+#_&&Z9rmh?s~(IXuS9CPsX=>RbIC!u$J z3AHJf%8Hg>Si+iAEs;^x6T-veXp(zZWB()tU~UU)F!O>^4)61eo|WF(=?@fZ@jL$v zMZMDlceu;CNBuXvgf7xq>o9L9)5qtKQO;ti+DFRwA zrf8Es0l_8CY_A4NNc5w!<7a~>*0K8cehOUp3+7M+cnHF_7hT{8!kFq&*F7b+E9hF* z&2hCLYEV(sYm%4veu`h=k#p9TeY}*aotXqgl~?%KMI*7O)oj#C9U)H9#a$VWymt81arQ#&ooPqcKEmyl3Jz7P2NGPWY1%)`Mkw*hPouBq_$Pk}{!^5GqKCd>f zUl>;3;MHE$m7cHe&sS6j_$(mY;lrax2jnj@g+`E3|M2j5KZlnM%54*A{$HBSq}ly74XS`3@F{5-u1Q!#@N5UKSi{rqSa1r z|7rg?yxYixY`lDY)*a9N6a5c2#c*HsXMq7Sq0TK7K)pWjD{nlGZ3$nEB0ZQwx5mH4 z9G+o>*}EM33j#@lR!-PMkGXD=39OHj3eUSfAx`qb_uMr074P4;w40g|8D zr!c8Cc*s6g0_lPNuwyxAGc#R3HEe1HeKbJC!w^5%MKNHSVnQmRZpFEicH!L`)|%RB za=~Gw>3g3li-?`P+i58a$a5rk;c8~!qnNo7?X}Y50mLh$m71I@UiPb#%yX@}Ibn@* z1AXD;BNjRR7LK4pe-nyxn3$}Dd76@MMxug0GZ-UvN~ncoV;FR}=cS;!6?V(mo$djy zk8({hU=V_5vIWyjz@|j9m*A&IZk9ELkmDmb5cW(Qh_uB%GvZFwy zhLFlr0vgkEE-vS6q4qBZA!;Pqj}25eUQM(B=zZ{~P~TADPpzOw9<sKz#Z7ubw9j2FJ$OqJ3P8UifO>3W;`Xn+d>(KY13k_*OPPy&vVS2K1vUZ^?->SXfYx}f7-)u=K{2+u z0bf3OD+`toAU1gg;e-(Cw+O9kxam*68|+|t5{{&@;&;X5MB&0~B9JMd{390Bx)@g@ zjX&v-(ckLyf4ASYb+Sesm|*vJB7?`~w>rU&RA6GKE07@H{TuN3M~U6cwG`)UK7)26 zfLqZXqu`M%Aw4nzud8(B4pAWDq|%X)^2SFpaT9UQcXds{H<+nrbRthCe!8&{h@{gy zE>#z)d7RAK*vA^xjcSZFMA39@K><=jOpqc740WzXL(ROp@}P}|CuzGd5r#~53kl+F zKCl|)>UBGNOQ0Q0mXgq3uv7p6g^>RhByt@_jtZ8C=5^+t z+>26qTU}oC#3OkWAOg)5Uk#Ci5!t}@upL&*yMyVYct$#Q-1no3J;2s{t(coRQ+Ze8 zebu=&3|fCfczweXDV_DICKbD=++IngSAG&eU^cYHp5K2Goh%>7Wcg?Lqj)%twB^^e zqbW(@=FS>JW~~p}+>v>Vc-b9CR;(he9#?qK+*|om2tGkJ_(e+V_FjH6=(dayXiD_O zuGwTXz8w!|VS!U5cIM^clo&Kc} zWCZ3UX{sk@Eq_k2IXeX;yb;|}E-B9qn;vYC{+6a&thZ9bx1a1}&dFV9xW6$dEh89-pvTtMrm%Vv#t0Fbkt&<|%C?#_=Uf}&i7%=8u z%|njFHi+mc!b(XVE0L>sa^9k&2$cyiAfY7-+NQ&U)6Eci4CyfG9R23ddmUm4n#CD+4o`FWI_=pK`$5C_gUePp z`2eDAXe9s)Do?f?_AqEY9lX1X=Ld!@KyLR1D`q;7fT|FF4B-xpRT8vqb#M7r)Ut-G zuGMup`05gQx&F^sI8F4vpiK;tZa;3(UucE@p86}p#H9@@cm>dfH08I^A(=RH-$Kik zgf)H>r!;Qp3b13Sps_$9k6eJ+XB~Y=XxLuu_)oVtcIK$XOoaMzG%8XmBj)(btZ506 zFk{BhUbhr;HGL;BmbF|u1zEHzJ0)?h%G$dLRFmSgXNXrKO`Zgws(qW9F2nLZXg|v1 zBrIOUJgV!QRZJA!*TcX*K!j?tra^vyhe^31uZ^A^KW0-FuXw_^lFC5+SZ#DG#zA)<8kmIcjHr5V~b&;2+GAn3}3>;4Ss9R{>JDGYISrvDM%$ekaN^m4QfR(X9yQYi5r< z!)xG)I+c+*;%_3r^J@a?%LCqQ<+1Ah|d2C4d&BeJ-6HrZr z00FOJupL|ONRGq8tl-;XSk0bUF6 z!i#X}CFFN)#mWKr8)gEJ3{h4>GmSM2{($2YFfp4*lW7@&if1rkpqe*xTAiQ8w+^K=M;4#c^@Bp{sl(K2@g^}NVhp}PM1 zaTL92GAX`OiK*b0A&w@Y&0^ypa4svKQ{iK@aV?z?M6BQcOeT(tRq)&eL}Z*sa)hd?~c39>(12NBq#; zs6DT|e4;XO#A|UKaOQBbGejj|y1LmRs`{c*Y_TQ8p|6k)?jPwlu zzvEsUEG+*$p6=*KB^|XV^xoF(JG|n9+reYSMx1BduOH^UFKwCXT(}jdKSB#)r!g1GL_MBgm(qcCN(Cr+gkl3Su zGW#)Cj;E2cq4RLeg@>`fhBFH2T2=_Hb@pJNN6C}uZcP6%TH?o2>><7VvHuV4sW}JJZN|> z-I+c#AN3T{7$3Mryo)PDVPQDVYfK{(@Xv(N4Be1bKB*VVB(>e76Dm9aIl>=1GiERA zNoSfAMQ$>1qnH!}m>1fn6KXtP+EvzmKTKS*6a93cPTV$JMR9_efmugTb*U>|1|!8c zbOSj9Re)5bl92-MSmILH9yTW}Ga4f_U4}|PiT}2M=^~ck@egSPC%j_C#9)%7k+>?P z(6niL5f%SbF~JOiv1qY^Nhi7~lV};0KC6+BCt6bm;|6p(z&VKoh{m67E(^*qLy0Ox zpnfOlDPsY99V_P#+FGb4i6((NlJMN!5tp5l-TaR`PUAo9wd6U7!Z_r7)PxlHVJ|`5 z5#FiXky7psTZ;)E!|+Wh+z2SB{Hgf(FbrB1hzbK(8kmjB*rI<5MHt5kHW3rEL(^v- ziRtTs=viWm;h2-@7boBo!Ip|Ah7}>Al6&{Z>)xN3rcdceQG`|D-7yD+$-_}}09XYB zjDi6~1p_plLAD`-gUjg5p`{qLu>&g-k)b-NNXEy%ZrrBaKW@t^ zIjH+=x@7+Tj2?Wy@1^bS9#pwa_0j&TgWvOR`h{%APTY>n>}c`6ABeuc&wSBkzy0Xa zu6nhaN-x1$t?*LI9xL@;%1E$}7uQYHT`fCmGUflF)xJn+!}&3#CODJRq@Nr!r-yJ; zcH2~ce6sC*jjaWzIDr}gIL9jN16r7cmfsLlm3YfESDBFM<%9HTKqxUKqW&anTVdvR6d}~Uwpy*ZIlOH>T)*;B z?~S|;J&YNxkKEGI?dj_Jehs?)dwU!2y!J$3TbXyQzIL6e+-Q~R2J0)ddxcS&CC1=B zzyRr+WlRHvgK=#CqTW<3^M#1(bf3UiXBJgG4@`O+p7=H!c%MUDN{iNBjY$_|DC_0b z)HT>O=LmVnDwKsi*b_R(X^Rf*N>Gr61pW8)>|hDZ*?76)uS-KNc#+0mM=T;7tX4d* z4b%YaI14}E7b9L{n#O(_xXd{RpXqB*+-13*r)Ir_o3{7!bn53@hbjc!=HM53<+~9w zcEa!^^f$GN6T8r`Y{oTKPfGN?E>wgWyf49!VXm)P+IkQ^l(rhK!AJ$WRbqnm+Oq>M zmW3iyw3T%X(nCbrONqJa{8>s$gi#5MMgYf8lb&}U-y&;Y`HDcn*h%U=D`*|--4!>LB&vN z+^owk+3ogj9who z{EMVY3sTk?G>canMC+-DOPwzAU41ZVr`<^{@;T+`mb}yjD?7GS%VuFo z3L8kz7ZRLnNV>~_aF&u7`J>f=D*6FGbUu;hACO*S@E=%U?3%$(&lxe}85CEiv(kyi z5Bdi-muG>HRLnVTqv3suc!$r-mod~!_8gl;{-Ekq8=V{Vt*hevs6-LBu7tH~WNUWc z|2vz9K06|0y}G#&ZgpFLE7%COU7BMDbd!QQ3xz6O`iU{hzVd6zS_u#TZAWSZ3vchJ zDv4CUdzY_G7PIQC!$u7mp@a&3uH#jX$Oj=`&G6F3J`>=k%|CC+kki2vNNkD+4-z3d z$UARpErdcSnCfpde9N!6h`$*%yRU1>;xlxq$MPTfMh8o{KL=OEn+;WW?TB3A?0$(uF zW|(v)J3eb;>1{63>ui>OU(or2s=;W

O-`9szSA@&TU*GRo-p}V)-Y<37+G7fV z)I?WUlA=TuI{}h=jmv1^j)e=Wf>|bp{Cz0$(fe(F@>Dz7G6$Q3HMC+635c+K^~F*; zF<%Y#;Niil>UudHFF5`vUhFs~4p+p8Od(8Yq>^S(ZR0V@urMywtJ>?W>v(8b=+llq z3mt1$6(oZA8QTrJOAgB$1n;-wyo#4GiQ>H3W38sYd8|IzhHgNn96?}|(avaBG4@EY z$lYgp+o5v$D_Z9FLMzg%2-H*vB^WRlQdi)a1OT1YzTweP-8MLIJ}NewVPNN=HhD5^xjC}Qk5ZZ;#z1;8q_=k1;D<4X)c6Z{kE$@RDe()GEpKYUn}zjx(?VFXaS zXToJL%7NP68+d>Twc7J0HpdmNk&7@3{$lg=ufl$|W}(BmUn{1Bh-&hi&|ns5XFxJ0 z+-*dE3KeizA3706zE^CE54}(&Tq-9?ETyJO>WDTqK<(6WuDNhASrD;`d{i3yTK549 zlOer2BQ;UcA5x^Wn}D^(`kcdF`!+gL>yzbYX+mrglypus_vf=95|BIy2%UZf$PGh# z6fdx;CrXFWJq~>+VRh}a?QpQp1Q)PLAZ03eG!^a;7}BrYwnwAdKyR=f5X_ETN6Hd$ z&^;P?S<+eEd`tbS$Tmug6fs41w57{%#gN(baoHX?`+H-f#S)atM9{^URLES}F+DpSHbWU~N@^%x zEKHeTX0i#z5N#ISc58$dCwJxZiOnTxA6v#*2E}M`Fm3_H%+&0HR=HES*EX|6&0mD= zPnjk*R*{{59p}B@X}P1O)50}3@>h}-M!ckXV}g}?lAg^NTafNT9dyqlPRC!XR zS_mhLK5AA}UlCI@Ouv!nlf+u6`rrJ>dU(bf_5y|QR-$_b*3LaIbJs|xPKc*_D)Vuc zvQO-A_5uXrLuT`5ezKwNRWv4K>8i@#Zr=_9LMebO0@?_&>mmX%dd?zLY+Ss6>y1(c zLa{0Da5@y|J72bzWO|_?hFFNdnqaXxXG6F?))sXj2;`E6v)-GFMZ_64JK( zM4lxQoYVPney7l#F4u(+r^g6qlVU7;22PTcJlh>3?9vG26`d@_r44-1ve)1eKo58Y zLhmW@79*$ttzab;m+R>_$x4%=CMxj_2@K+7wUcH%np$T_p|uw$m3BiVeVUpV6R7qEG|n^Q4wP+GwUM!sGG>_J}VGgq{ayTv^sq!7S)TCzsPkG?1AQ|eWajmjAM z9qCh1<7Vh{b0!Y9MkB6fxdJ}Ak9t8-PNZ&x{6Lxp=WqtLeoj>#Ca0G{C($si7Jx9N z0?6t5xpqPzpf>d}+w#yyo__QQ|fo9SNVVCW3W9oCOCZfj1;Vp}G z{?>c0GJSAaFAJX?%?qPalq|x<8L}`$R`VD*!sl`_*sPB%83-A!%6%k{L|2>YuR>cm zW*gD3%G8;b;OF+$@R=4lP7aMcxVKyD)6rWf=+~tsLUSDfA)pfv4Lq+o=vh;eoBNSjmaAI5AhJPYXMn6@!#{jFWP_bVCI)EISF6$n4+% zfpgX4M?U*mQVvHX+BHnJGvi6~#sZFzT1%7?4r#-6jq4?(Y(}EOW9i?0)_VinrDzoB zj_QEUM1lYqR??z|>ouEi=Il=oobu47VpYA0$0&t6b=I>@Vf2qrc4*3me!UX3b=8@W^cN-NiWvv#uH>;nen4vpm(VHlF2lTj# zrekYr&q64;f;uv-MC?p~s#PdOtQr<7(t*x_mtBmtntNf-256z{Tr66ZSOXFv?LsN< z0}$->a>&8D`4mML?k2wGLN45H*I`5N9wACv=rD^bRIEe>+qywzUUyFfu0mW? zPHPsAqNORE*9mR@ORA^aq3k)8o{DQORjX7Wj~Cu$#-ug{ONM5%@ULI;ID+S)l@T-2 z+oJB13QG_r6=~Am(HB7!y(z}3R5G0+jpT|&i|#u0?eweG*f33r$#C2P7*d7 zDw;%-;1O7E&AT{gy8qdd+i^yKU=Yf|9rNTlVq)e_w;UAm*K3c1GtkBIB*DgD1Bl*$ zPWfzyK)U7;cz)(dN)vDD~+E8nJtNt^-pcClk-slr(!fcaTLWLTi*+_1)Acb+wJmS z(q*z#&&1ho;C7oKbA>*~kCer+qA5b{5ay|2%8Zlg+vN+r2|{DCD4Nt0!!b=MDI%}1 zk`zt!Nt?y&D4CIIQDI?jxWzMY zGixNpH(DO%Z*PvOKu$qBmEIp}h@7!(Wb~*)?GYrZll;zT66)d`wS3cl-VLX1Nd1|M zsl7F-jw`S@b-jj+*(P^Un}xmJetorJsq#&$m7cOemMh(*5BHOq{eF-Ev-+gh_*WmT z$yr9qqD2oDlVdDK8D11^XSyJodEs3C55@fD zOnrqfY=(4pL>h{;0)ds0Gr6hhq+3Uw-8z+2S%rE&z;Y zieEtsBh887RLFdAnMVN%(er!=Jcg31yw1nfJj)1LMsKpC+##j4N$J&IG7-cjXu`v^ zbf@msQ}@Vgq=ZKIA^@Pnp+@kp(bAZuYonfed?c1KrPFrN)@)+mEg8 zfmev=g9x}2(Un?3M)I>|F6t2oiaH^hDt{X8$v%#g;xV%s*gbOW;|l^&4>>DU&754l z&-v?0w-^KpbjjHXy{B?azB|zw#9f#rPxH>_QFoylR_XYq)FxGFq%P-ro|8+F=B?09 zh>W^lI@*(Nxu{%vz8JR&*;c7nxX#~KCx)&+OBKQ6XJ9W*?92x@uYMURu|f716;jJp zW4dW}Dzny2T;Ab2R2|7q8eM@&@f@DhvbOeoDhF>qU4=(U`yiM z`j?{gMa)h=D3R`Q4SaB2PEA>V3uh_a5zygVw?i7;tjq`SjC``))-b3PNd~DeAu@Xi zQ=0Ry4{g~k6i-wPr}yn^5AtaY?sfXJfxCXeVUAlO0ru$qO0c89t1gb3*y^g z$1HZ{WL9hI$qPz~(l!FFH&xjFlBRTn$3!HoN$Scz|9gk>XmjaOU+LPQoB*G~XP2ks ztKG@i+|G@2Xn40KsLOZxdO(>p*?Mf{q!wHWA@%LeR1@0I_72J1Sf;MnusIw$gYu+E zXrbh5?{ekh4yD~yk$J=-=~)(%yHeY?QE7u)0^7P=$jqjm;-r@Ddo1Kv#^R?Zi zJ*ilncRVKl@Y$1nu(m`T?deLHg_NOreE84H$^c#S^VW{S<8;zd`r25Qf}^pw^QyLWkHyjh z&yv<-`~p`+X2hp8UUkrV&T!hHVAJW_!?%WaYNKQ0S&Issw=lGI(Ev1SYID|H(dlE( zt2ZbWllo4zT!^cbvpVnF8>prv5jPuGZ6zn;^&u>@21VCWqAqlNc4DEovT}j!&{H;1 zdqZxyS>{9SX;01rkVPqwGPCL2p_&ACtU#aek)R71RiY}*mC#rJc6LYbWAbUcm+SUf zkcW1sdtZ_G(cUMxi4rzdey?e=eEw6eO{Fw|D>09_A);+*?~Z<VI}2728b?LXhF-=^3e-;eKq zHO0hPqhk1&I-Zbp(vjTsZ+=qp_(cBG6#JVi@AGpssC;+&(B~=`>+tsZ8r7PLQ8&5w zujA|S;VKid>H0oSZ#?f`Ofv|RsL`PsK&25fq23+_s{R1vgC8MZZw6|I7_USW0YDq(O$WfS;rEu&yey`&3TNno?|ZO*M^@ zjC6n{tQA_4V536myyz$%_EcOdD`BW3f{u6~V;xhOq1bMW%|AzO!qq7tBx=7ADYI}% zR$vfYz5&s<#&zbUUx7ot&r)F({h01B)z|~aD116H6U8FUl}TG#E7`_>75K2QlFFKL zT8*;1;66+cMUWpmKFum#`YH{(TieSE;i?Jvo>1jfb-?UL&_>zLtJX^hnv!WWshEkV zk(|Hf2f3t=3a(4`g?GC>>xsBY%E?utp%&0_v8m5cB~U5d3cUh#N5+HT~4U5EMkdtkrR$C{g1G zg4tV*;~U*AN)T!s(b>ds{j|m~6V<;{4zTyB!oQ_(c-uVlv9D|G;%aKzaxybs& z{L(6!^67yV+DodMXI0+SY=soW!m+34^p}SJT}N@4TM@yZxsB14_D2A zNyYB5zkKT*t*8RQf(ET3_X;?eOT2W-ybl8C$BO`e+8L`2Vlo9V6s14|z=om|$xGL6 zflq@}xYK*EP%XrV=<%}bfi2!ITjwikIIVlmggGR3@lbM8J;DV?64yPMt)y8p=8B>r zp%=iKn(i%*4+H|L^Tco$DM|hLHp+el!7v)OX9gxj>XZ^Q&)axE$e2W z6yJB%?Z|`!uAG2&npV;@1laC`L3CzRshN#5-AqaiMu~@DOyxsMcOK+zgE%w+4UbwFY z4;yUNumw+4x?@cub36ny)~W6rR~){0V<)n|ZU2@KUpJqMqmEpk;N>ONirTnY#ui&2 zNyVO_QhYPBP^v;)sb`zwIm@*qnXrEUG!X`3Pr>;2(F(38j-65C$im%{*!c++#FT*35Xz-|UZ!&{RQ>p_X^chrLQ5O_-Ag-L9v9RIHJO z?WfjL7AlC!07T12+J`p;N2>>R`TS~haBBlUeHCfc0=R^u+TWzbw6O{p3u!#f3IhiZoM_opY0mPlL zk$32(VPYAT(9U0lPGI#Q1p|Oy9@|nJEpLx3UPQ_I@r^r=M2{@`w?(kM5qd@+I z!h*~LIzc4Q&1nLN5=19i-YMS|C;CmO8j7=OPsBxik)G!{LDRU-;tIWD9;0v8XV+*L zWs1hsDXl5p@4^DFB$a?^hpvYGMDwA@o4Kv>ps3WVHjSjnIOnqXaOA3>kc#by-!vsJ z5R}O{acz$Vq*mu%JZm{sYMP%uO`eVwisisq;q2NgC;tk=c~rUtH^&6AJHipz_?jLzxO_G9ln>Ou8=vazeBP$dWI2dDijOIb??T6yUzK zcEAdxDU-B~n%2BFiwcok7Th%##?JINBH<#ZHL>}DMv`HM96J~QtX8GDz``|k0^|{5 zmOC8C%Zv|hb~1&sBaRV1mu6Nc#)|JSbvh5?I$1L_!nxM40_Njqu1o&Z_DVV!iSf+O(R%odN5&2n#&&n3fMy?HCn#X z`H;*9kD5wk@XkV`n%$<)SEoE*EV0K%&ShG~Q(zlHWv}u%_0z){V(INM-=uL>fOwzE z4e3o=i7FpXB&-#atS25G`wXT9LOuVG9=0_1u6j)20XS$UY zM3||h2$A-v(vuim`WOh^{HB)P&&|Fi9lU08>8UMaNn*8;!jXILotzttiYI`q&@I^O z9XxsC7r&eI^cSEQP!pyny9f{|?YM8K(73Oa3UM!pvInr5qS?9yFy@xJ zM|Nr;U8X*U&_r$16%3R(UvHH1g1@E~7)f}bY>Pcn!KNV_KVdt^YN*a{ir3k-vskqU z^>@i%vG_GM7YaKH)*Mc&Jva;+?>TufSScTe2m$rLxTa0RPoA6Ix^Vp};K@tX^4|zxEDq zNo2Cq%Bg9!BW64|$>EFHX+j$svo<2o{L_Bc(09iG7#CBZZSSB82Q0U@W1tvIv9;ZkV)gfRl{qJ6$6n)9QEjo(^DdS5ev9;zU<{@V>_PjmN=s;QfEgsvPwHPg#}We~xU|Xi3CT{nyC$8=N{q3zYe< zzz_q!O=6d3e89HrG?7D^_WiSf)v}^wr!p+ew{?m(^6(?UQ0J$;Kjet7UEQH!lC@9ws3<(F#G{`q3_0hr}}wf|36&CfV~0SpX4NW+`+^Rb700R0LAa=TA~Y7dCb zyZ@z&j^57fIJ_rZ_B8s^aB3}n^?$YSKKCR7nh&&3H z7WqGTwZEwKqSOe{!^LHTfg0+=ytN1sePz^miI}vx8IMj@N7*jOv*Yx?er&Ey&o~m#^|H7J-T1zd(L#;Kd1Mz zlQk9;)AL)rK4-jtSmr=Wnk~b1{-s4GLcQ9*Idzx+)sL7@H#$ligg$^;7iM1I;iVOjtf7iSB+1=&FSzJ}qq+6!IIU~vm6iqG{*ai!N& zy$&ZNacJiNGUhvWFsT(fvKS(**B}+0-`tcDqBF_wz=Ddxp9}CZZ?qn%6MO|mB;VAJ z@%qM;wkLiSPajsgf(S&7#t%%@kO)(-(ofgT?H+welvd*5dK&y~n+INx_!EE<_+L*K z1CD{XtTGo`-n6|j#&Sg?1 z;T>ZYB_wZ8U?UK3d7mn-YW)%C4f-l1` zOf)6|GR!&-^3wsVtXGR7us0Kf?>Y;rrxGy&^`{MO{uA}t z;wd54BPeJC+yYwixYK>a3{#?Q*mBppt*JHjwAx z4M42q{=l523j-e4Cbk(I$c`+*Zu-DdXqy5>sjPGN!)qHH($`p=RA#YLvJ7{5TaU#N z_xkoU#T%+puvA7%DtOxy$`Q2SLx~@Hlm?SaEqhQ!1_}WqeAj5PM}8-Ss}^`gVr=zB zrIJkZUs8Lgr~c**~@?;E(-=pCxw zrc}OQd$sPjbQlhn-0!t_2lw{rU4Q_OY*A(QpiZ^V?lcp@dDWb+%A9nR@}O-bAE2j8 zuse~SR#K0u4qm?>&zQt9?4Y&Ar$e^XbDyWtPNveKtO@YwGDX6+SN@&rE0*${cvxB{6-iW zc+o8*h!E0Zu*FRTuO|Kju`Eh}LsC)7%GruaZMYJNx&n-m_6if_V|hMZ5P2D%0}7F3 zNEknFX9JctV8uMHsF0X6@37l(8q`0JblJzY5fKgUJ3Ve2eY9Y?g(623E#U$`h`zk= z`-uqQdxK;~v*`aY_RTS(z|OjB+xG5R+qP}nws+6kHqP3%ZQHhO@4o%rzwXULUeYwp zv}u~@q-i@d--mqEXP4ZhikL3~)V(Jw8Wlk|kO*F?;P^Rgt7f##hG7ciK)KvNRUcrk6~MiH{+^ zF*@ED9p=kVfIqU8Da%=dx(sPgdY2+EZVbFc4E|P01WK~E@%VHuiunxPY`O&Lkb?NDEGgX!Xu1s}>2anu{DV@QG_I3bLpt8{v4gC~_eKUb@V zHZ+vj{_PU3Op+plD?#29^UV6aLRK?QlAr$TzR4Uc!-3w$qeE^s)b^O4?pOujN>OMD z0iaw+@`%!Iy>xN1bPrmaM^?}+QBkHX3m&Z0GP32!oJa1NjE@U6(QtjBmdt=Gvgs;L zW1==xM$FN}wh=ektHQc21(QZK!Ul=NrTSM~@IyUj7PN?KL8W^UW8f)tK_+w5UjcszA2XzJr6qP?G#3MJCpS~iG zr;+Z8Q^ceAq5yoD`lj-owlwEo`S9@=;OhT*<;C#Xxd`XTTs|3(Stk>0o(XY4WYrQEx=n)o&*nSsu#h*r^#y{n3~q1Xz0x_moX?Yt zao|yFPYJ?-IEQ=@XB-ou{sCbCQ9cs$Msvxe&nq*YI8GsoTfdErB_y-YIohZ26DbTP zI=3b0t}5)io?HSMQ(d+{q0qyOGyCw_U6k!}&@r;4V&3^rR_7J2=e=Z=)I*q9p5FX# z#t#kUX6DB1pJGT0r^sSVF(At*7gIfaeawX?%f{K4KQcI7>oX)5x_xEpH>u~TyaeGy zE)2@n6z-gSUSt0fQCc0LZ?WIjG=7sr36#oC?+5s|KEKNc-loIQ%xEVUULuRuicI^| zvbEn0x#v8{ro^wTUHGU*p@=;Nx>dotu0dEraf={tIaA&Kuqiy)_CWe1cKg`&!x8@( zVHkusevL4vhEfAraFTc<3<`vVtVAyQ;V7>e`>SZl^7dkSbs)}5h$`TuY_|t6v6w-| zlB74VD8kqPjG#aJuo=@^Et&T;@)rDj2(UTTKTjU^=p3dc3#q-}t!UEx&fl(1ROXNI%V@1sfzrX-f9ZI7`;Qb5M#fq?FT%IMW=;oF zoYW@E(j4u(UYQ-^nV$>dAtn%iH$;k;&{~z0j7v8vJ^B0GBfjcC6C1h? zoJ$aZC*!|12< z5!cvNB6i#%+JZ(VMn=Y0Vq^7aRAEn_Xta*zy{y09OMZZ@@sKnB56=&J_WwpY^?yxi zVPO0XNwu(cHgTjAwKi}z5jHWhGd7`!vNqDWo+dZtV{jHF%PZYbi(9*^o&(`Xv?-l&U;W z{X`nB>XuVPI<UWRJO(B@;o%VmEl(blQ_=k&8Yu7hQJ4LZ?!>7NTaPFk3==5<#HTCX5n~!aIGO3 zL7~T}M}>g4q5K6z12Y89Jw}MD#OP;)xlMC0S2pQQ+|`V;+$j#)$_ko|lhFe7J)S31@ijPG zJVlQf%G#hT;3cm*9Aq~Sa8FdjlOIP>>K_dP9b=1o3wbqEs1PK}x2(39;*VY5 zU@!H9zj9wb<8@{s0;BPjP@rA_kB%cxcKi$N_ibo}Tr8K{lab2O*3!tAOQ_sms`8GC zoO9Ew3_V3j)_J`e-*<5#KHaaEr61Z=cs}hf@2Btc*uAybuLAgAeh9YA>W!u!2NxGD z=gcpc`tlaFoQIG7K9%a%^X>Tw{LS)@q2h4TJkl1(7uP??mD7q5LDp|8_`a_#9_|x2 zItSwkk-%msNk~%Jn>X;Ht9QbYT(&zWULfoD8D4`ov~ZahX%m>&@ntx=rBSNwVY@n(~cOqeV=Kg(w^p*`$Z+ z4-QWpHOo)u*L%Ha!HL3(i&(GwWK!M0S}#M@rR)EcCC0`^$HBJEqs41OW~R5QDexZ3 zw=Qp z4oBHqM4p_kMg3{$#iXqB&CS@koIcL0%X^e3d@eGMWR&biQcA{fNnE|C$H-ZbQc$=L z^5xNVwyP)3&Fxi@h1LMML;%${Zv1q>zqAxZ!bC4qg)7DRvn88`XXP}w9YT|=Mc1qLl+ODS_l1NiP72SM z+pAeH*J{6=~FEkhE;usV9Z{Ba`uGRRk-W zoYf33+b*NsR_ucODggO!b+3iYt(KIG$9$CR``VVZ&fQx#`@N`Em#}~ruxX>2-24sT z`bW*ir(BcOj@wH0gjl%NZmjEEcpqW!=BLm4{$G62_~_R$#lILS#_WfLG8>o!v~}}~ zvDKJj%(8#KB;xMJ*q`B}rqa)sGg)uWWl-kDgV`G~*%K`!xw@=WS-poqU-HfXlu#_{Ey4J7-Y)8;o5^pdxpZvr3$kjJ`2WLGT*yhxYjMB1-12K zt&U$98X8`5JnCF-&Z|D&Y3)=+z8MS|tm}Q zhKqldRSu?4c~5>VZJ{seL8EJ7741laO(VQf+lrqYTc_Sk9HFlpqP{g(RhWDfRl6A# zT(l*PlYOgR>m^O}fz|cxwYq0-fa!=N+4iuO{0WXq%Gzu9TV~1&Rn{M#JQV7#UZ^3i z$*t<@Q;ig8o6MoM7&z88>2ba=hnA^BV?zg4XFTGK&BU%;>UKDHcco*I#i<9@if|5V z5Bp>NRaDLS**63u^Wd-hEv8h%+kTx|@%QtLPAz9s$nD8DbElo}`LFN!PiKx?CH}-d z@SpsTP^Amz*67kRp3QH8=O{-tXk}P ze8<$1_*&eC&bnoww{CXG1DlQQH4zIOr>UUEbq%{hmx5}7Ja&gh=pe{@o=+oEhJn&(3OS+CURufb%v1YK!Sn7EDG@q|RH?Vc7Jaa;JN7!%E8GvvV~Dx!&op^5&_n$*x~wP6yhM ziQ6&5G0hZt-fbS)&IxO)Xc}JAa?C2Q*Fh3mBy2kzX{n~er?JA}5HN2ean{Vr9%I1H zOhOQkv6gPvH!g;jycTkcCO3-!L{?sF0 zHqQ&n62~f)ROeKT|580xu#OFdiWLQGve2lR7iZ}@Ywp!T)Y~0psKF0Isw?UZKDb^@ z9$~4R!MC_L&ngMQ^jE^>M4rM&sl`^My%RH(>0i7fiUOjU<_D99soCR{%$r9~2NiGZ zL?QTL(4dWfHhz1AwGDFCuvEY>xs$%MX@vJKSCT|(tX^t`r_W>$toH&AR1xL`lJ|uD zv*el0g344o4mz@_MgU#@98j#6%6OEyf5yYDNpi>YH*NcF5sCuNtzdZLuv*K>@I||h zf^9QqYQ?j=gyF(|B!SbxlhMI??A;p|#q@smpCnPM2-Da0<4Kc7Do62g6E~5y7%K?y z?bh6{#I&Bl7B6a@0kyelCGquHT&q~na()Fxb|xe2^_8oQQb|;kgHk*gmbrA&qiOin z5zmWqq8@COGPvXs>Y=99&)^Z1r<*Xz>c=!ieXW z<%Q3xRWzNCiA=twilY(Q66K$%k7*m^l<3*Z6 z5?Y<5M3R`CL~ZQ6Vupy2=e1_VoJ*lOmo-D}Uqe6FAYHRR=Yz9xc?{uU7!YO1#gOWs zs{Q_?;WLO>evvW(dEn)1kShA)L?i$dk$wP*)IdP|bx!PuM>bn=k-2eRS1A=T4o(ZL zG}qQUhbl*SoA;h;m-yPQfj`XEnr+Xclff$#7Pq&cjBoeNl?r0>?A%6o4NOY22);2p z-@!}uSMvHBl^aLp9-A&tHi=4)ZztKhK8ZK3CUxUn|BUc7eEKqB^v1$pHR-U$;*BEF z`KMw}4N5q)n`rS;Y}*R0JI^!rJ$KrC4n|Jtk9)ygGN79ul8&|!?xe`N*6OUy?Gdre zk|Bvm#2cs|p1XD0E!(WZ$Xw=NK4RwEODbtw-ppq15sRQnFwg@Ns!a=2ng-f`Me_IxJUnU_%VqP;KzH>|OX6 z-@CzOw=MtOW&_@G=~_2(^|qHQ%qo_!4)cH5GE&;K<%A)40RnR8R2S~rNiJ-|t9$Au z_}b}699uv|iYF~3eFA0!wSzXV#M2DV!A-5{R-2)Ud(bGfJg?46{-eQOGX?Gp}~ zCA^%C<7S>-yR0bIP`nn9&S$rjknU&KR7;YQE1aOXyQlMjc`yyu3P&{wx0QY^-Ctqk zcYFl<3X1oZX}GlHyNmJe>Dey#{2Tg{@?=v-slA5x=N6V+tjH*!M~5-rZJH;*uG_~+ zNv(o5tm8WRf|u{H@>BWh9_=sX4?CSv3A=oLx+i=qg>87MaqTRL{WnX@n7;3|sf~U4f#5%z$SI^AS$aX5NM&P){5CmUQA!Lnz~LR{3iE+BqS7Bb zOCMl>mlOy>tICApluXRdr*p^m!~4`cXwN9zht7Lk{rFE)7q8bPbgN)#o0?=gB!Ji0!?y~xnW)yg= zKcBRs+so2jqI2Hg0h&Y*k`_ObhQMVVB=MRC^T}=(qziwvb1Hdy#qbRwE<7ABh0Fk21~2XQL|&CxmYHYOE8W3oQr zdP6X~2m2$Gp7!@t!1@$^R}enN?foJDq;!FuXKZT#^9;O#Pp4V@`?S_CNk#APu)(}tri%{I4w3MdO7YA?n!o2?&F!9`8KQTX7TjrTc;)od8FM{@6-2SF z6$mu%Akdn#*vbz*aXck_@><|3@>85_hPj-L5WF+Gkgyg;&*xm#K7eK z{6XZ_T<1Fwx>NPiGfbN_hVFV!Zlip@TNobsv@nyPSt7K#3TfHMQ8LQnts&!|Aau-xl!nAV@Bi@dve96MoDzFnT6?b+SF?&<7)Sd>No zW$`Os(A;816Rwiuo}iJzf!UYx@c->?w1@M52#EA1}2_vp)H+8&6Ne? zm%;AN&x{-iHYUv~k^!GI#+j`c()8%Hw8vCfAFsUKZ%vZSMo*Qa7M5c*TLqcHOvt~= z%uIGiFo277o@7-zCF<_Z)r5$*Eq%p|#~H^PysqVhMhtY>fPtu=GZY5!VT}||5Ul@4 zNgyn5KKBRavO$~@@REs3g56x@-@cGsnsh-a83-p)S&*<83F=%gpW0m|?WcC2YD4aT zJSai^UaoBMf<4G-Fwc=@U@!(kU8p1)HHb3<=6lvVs$UBa#$w9lO*bzjVZj@}3#iq!5e&e?+b%;-rvle;)ATJG0X-V2G%_IX@jSJ9BPo zqWvjwVu`p_Df#p>^Q}Aso}ccJJAfxkcqrU#rqU@(ZY(m790$?_fG29W2|!l{$^^*Z zWLX^+K{0V148lUZI#}3{$3H+MP3{U@CzuySu&QzdFy+&^L{HYf%c(L(nA#Nv0)Fuk zKL9TtSn=NNY(qQ0u5bWALgYOIf1iJy8v1r*ceQ}jFGJ|td_$pxdR&rHwlgtA&2Nc>G7yLjj8x~~ZK%ZHG2LHy~ zj{0?F4H83dWL=`1!*JFk;$ha#5OFi=3kciRe~sO5iFHNI!t7ubW&v zoBUnutid^_U#B-wYWyD62wt>TN^;R!$oUq%kbesz1diAVF)CK{olE-l=mg4y767M* z&tiBgdpg*B4115(5}nW1GTsu>?S%a`Qgyd?LcE?OUGYzDNLSMXZxr6sY)!bfOT5+z z&tbkLdv1ga`z7_YRCzSxk_p_v*=T*8mnU`TeWh_i=o!F5oN~EVJ(jNuQoB4&mUuRQ zT#KrsI6pwW8({nwpPlKecFl#8{+@}4^>J7aM4ne&uY;y?k}>`?q>{U$NB(jiqyKKo zbbyceOBOOVv+*TW3%x-!+oig68FmjR0(*M16rY~=hjMBmGf>Zvg8U<61lX|) zQJY|9ajpMxcsAkh%Irf2< z6nnbq+Vy*TZRcgvfxJ#+O@|)D^Z=g6Cn+fDH0IbD`yyV{M?T2UB($(*R@S1PN`--y zPYfjwGo4{X&Vi)Peng-M}V8y3cEa}b{m{n_5k^Dm|)U9-#f z1b0D{Pk6S=-}rN-eE$Cj-yI9<{|_7;13lCK!*|ER#>V#F;pnQgClZd>ZMQzCt{vAA zIf#M0{Sc8KfL-19t_G>gE9$uzH=pcHRlGi5hWk+MA`l8QISyn{kqh~EcjJJ_b&3?< z>a`Wi9M2?v?7Z`eatYC=D`EGf(3~Z@7Z+#AQ=4~*&d>>?&fezR3J6mhnQ@iTlS`(} zkE9HBXXm&7JCAJyMnu^L47{uPLkFHcKpH(x$XV>uO%_go2F3 zq+Q=YS6@0yNL8M*O#K(3JJ(2ztZx$`x=g0IuC?ncwGIv5q(axG($%b>SnEP$Ggm~N zR-n+8)W{#nsRYr@qKb)bK1Mmg8k(a5<6@iP&s`cyxI7Svo{95L3IirM9L9Z^~mp!+1sw51r10PKpZRYW7a zS|&>@s}}_nm|1_l5(8keF&q$g+Es^5A{Eti0TyHeuYp1~yrB&;x7FCnP_GoL!+6Cp za2zgdmHTp4`aWTgjDDh!3zBA4-I+oI8Mr<~uq@BgQDNC!>1rmIZ|!|7pJ7P`1lZH! z!dDTkZ#m#fKnTzz%xDkHBnmJ%4+i7Byq*k9ANLFl(n2p6PS@$Je zwK5!VRhrx%rJfvhG^K==RRDR?#66y$*kGwZ24;3jBy%-4`4v}2T)^E1OQ(UQW^mA2 zRJxv`R?3ac%8*~RU!HMWg+D6_5_bBJ{<2q}b?x82Vd2$8W_MgqhpT?j1`TVdIAuG3 zRe#1lfVw)xNt;tt?YK!@c@d4sZd+Xqy&KbPUDHOzOsI@FRqf)eG_kW%nGV-JfT5_U zA!GmLG*#vroglJm(p58kgaJUHf9?OI{Q!#uq39td^fKd`Eq&r5^bL0faSaFwdZBG+ zKoso*GFO3}`vRVWXpg}tAO_ovB0>Pwc5>sRNkOhJfGWa6_MIOS z5;nZ!AX92d2?~vFKE@$zqWp@@@8WvlJm9fkll5H?Dq#bf2od3weLvn0-u7DH;d{J& zzCQua@pwPoUqNVpzF#+1>~`?@_=_G6q14jO=3{))B|Mp|J$l#w3_3ue~iLj>i)0vrJyscw(78 zFYywspR*p=tpg_kLQT~QR!g?LCR6^fo>r&Dpsvh!;9j{+s#jF`bo>C=pW znu7c;QRjDlXb;oCU_Od!wC8!kun#zd9}sEgYD-Bs_zVmAwh;)Tply2Xk|;4PUv0J7F%_ zwsEoC#`grjtOrgaaB|=GOwQgf107;Ef;Sz+SR&Ttx}DsT@;B4yL}5);;V=rm?Df*s9$swMZrPjg6?H5U@ZP(CsOEaCVh0?Az3m^H&;Fn}{1 z?*3Xn2y-U_Nmy0cP42ImoDEb?dSoo#NNDi82`C~!8a@g@u#`L{LKhJt?g&$^^fq2{s}doh7LR6oWH#vpE7BCEXGgzSP4Z#w;C8 z1hS-&T9rE+6uZWqo2KFs6j(!bZRU!GCRb?7*oF~eX@quFO@fP#tyC7eG?<V%~}0#IPes>(Bjc3in75!BZT;iuH=; zp8K>#DomCb*1F=u_>>HMcv>bN5=6~WKQ{1=owntKzHI(nsa4?g-X-!so=xt!HP-vz z&|RCuJ>l&2Q=I8;9b}y2aEt;^?(8joNB0a|I2rRLs7n-CUGsY4by9lKr?{0Ej`S{+ z?hiviPlv_7wqvZdICx{fDs~8~Z94;$Ap2cNnYD)p7p}V#{jxd2xu%s)j*c$&8?M`0 z)ifnHYv){U-_C<#pi;JTNZ!KlPKE+YI6n-5{qAJ;3C;eTHmM8U|PW4x_;}6?;N=c43sUi9uq=e1K`b-^DEHS8YVL*PO{Th&*)Q-v7f(E z?nWi<}qmZ}F0#x{m$gK<$J%zvFYynYEsICEz>$)v(4ZB^8G3jYem_Yp;as3th_ z840nn(+q!A8b)-KJVb0M2v1%wqcIJbHLbwGEjE-!^1TO4%$IyfD9}vNt?#FsoGrwd z<#k49M?Mn87UT_J)%U zeLzOnT|72cxFyvG@&f^4sgf~$wMx77+w*G#1~s_4@8w{>!#!Wdl=gE5nE#_sJ#b?@ z59!g%hcp6@<4CB~8NQQSNkSL{(I5TIp ztWIHn92v*(w%y2NY1}pVX z?X#`Ju=(gXX3Y^BuDrB_em$|v-RH_+av5N5TzZHw73~;2M;~gH3n5uFzj}gbG%qUQ zOr!|2q`|f|zLsE#7Y(Tq4P827sE*1K{;SWUhZn`7{`LT?*S{l$NYJ+^fp;&)X%%@T z0!I5G2ZpSDU8%^xJk~ciP3zOerW zg~|b{kTT_LP+vx@91e^~(eV0`MNRbt8d{WdV#g)3W|royd3~0nt$u#CI*oQRp zu=4Nyd9YT@D=tQ!6b?*E#3$Jxy_AlT8u9A>c=TlojwF!dpokcg4tLDMhj9n5h4P`5 zV!5ttY<$62H(Oov^XqNE&DgPrmxtHe)BE-LH*+VOSMwbmu!QieK-J^@DN^_S^Y#Ar zXvECx&(m4YU+!-G!S;i!(_yKpc$=M^zurNLQ9oA$6E}30`>{D}HN>`V17G?o9isN_ z5cg=KOq?XArKb=Fb+{>`8e$voOVQFkiyRB6aY_U&aNTBrCT4(i;AjZmxHZ}`xVJ2z zrF$6lB>=2o*%H@^R%R>7wLU0ZzlG;$t~HXwYqI2I&(`=HMSt2a0BAPe%B3B;eT4f2 z7}`1;z!8VX6^dZS)DgggRmE|o{#=?Ww3zU`Ks=q(4-mX`kHh%{faTw_OLwH^UGoxg zIa&ivZ&jKNpslL_fEMU1_06&JR;^2C#k|E<9Tz<0j)~QlMK!qWfrQ%(;5F*)F~AE{ z&4bQn1v~P39;6=|cq`lQ1YPMifVWfD9njtn&0}+5>-t*1cle~@Q~g#YhBN}9YubTu4Q*RZQ*{Z7y!Ej0_%lw$RQk?Z z0dN>wK&zLgbJzPRI67zKM+6%vT7KBN(APA*Q_|4-9j=XTP7$ouxO}sx2Sru9y6fjx zI_ZOj$)Z5grW!FI z3Jug^nzII?I~zoTlN3&a!oa4d!(K&X~-wyK}~-zN)wKreiGw_KbeQq-I3&66U>Y^=W) zgW;Fb(Q0C+#amA^(2TU3VxR?SKT%6l`kzH6xh+smP#HYrp1iY<@ha4@o_jHcMw@=z z54RJ>(qxQev}(~fI(!hP27VzDs~8}(0p$i-#?lm(o>fEoVpqP6f(+(?#Wy4ok-xNN z*pQwAK%Q@9<-f-@7kte*CSlQUJ0|6B8c9*C>kPBue-upm)1X=a9?%q-1KOr2f*j## zozISUtTo8sp0DO#fCQQipVHKqgmcSvNj1#Fq&k5Y!n2ptj5V71fAFmdSJSJ&tN&H0pcWm` zUgEtt>I3M@Nda(OM_NGYkN7Zvf@=A{;+=N4o7ZU!k?kxru5Ws^Vhz5?T7615@Trrm zf+^kR$^fX`=E5#XLP<8--hb-Wr)j966+hWj=Lf3$vYe_{oIe17o*| z!E!-)8zH$qG;f{|W=J2xND(%Ko{aoZ(ML$yavO6YCRzY9%@PB7(WWefp^w6$+(0^G z?JXp&u`A1QGRxF8gbfwNtt`Yn!li4kmE%MO+-Pmlp~vE&+Ere~SSb@4cRRH*;h3kD%lAF}81@XX3Ke*qZVFAw@^mh-x0 zeIgME$-XcMJym)l0c_tJtr3Yrj3W_jzkgebJd}F}n05?#I@0zq{1;CBD)R*C-YDW^ z_*^6-yxZc#T&e>(jZX+3phZ=o{|MGR!;Eu~c4AkL5s0E2v^9G?jdwb_SQUK_qJ3+c zqBcCSH|F29gg@-B2?=V#E(4~)#?W+8=o`_ZTPle_GJT43wDq?h~*&rrjW=EIGq-lZr z8Q&lvCJu@HC_Y1SyS@{)y7hcu-S9HS@e&-R{W8njBV*UPhrq%)lWAB{=g3D^7qytr zX|YDH%53Y(!bG>-`4;{{3D@}`A1{k7Hm@=Z z7ueJZa0p&uV1Fi<*j&}xg=uBh3NRZ3f!oV?ki?iv#PnITn2*w8!Op4UH&+@FthR@p z=r9+>2bho6MLGt`y9N!nF^nyX00t>xg)okXKf=euU$Ud1bKZO#`ti4ubDaxBq*_3e*4V*PEG%jrD*0dTWl^5_4p9zbKum z z6kJkzd|#+)j)`iXjpEvCaV^UF69Ozwz;)n|5mmWAZa%f3ue!>ny_PJ|Pu!ZUl942&sc{vCNSFmI_1g_5 zgf}K{IG%brZV}Hhl*|ODY;B@CEd*Lwn~LMyI9}N~7eUo=Kdq`gl>DM!ST$@h9~8(a z0IaT6pwppQqa+&f;WxOCljt~rsd)dzA2=8xo` zJdiU+CW-$@$x&dw3PpthLlvwN0E|;8iT5*rSL&WiQJ&n{8m$bZEMErHvKt0Ss1)XJ z-y8kt0-8d>c`JU1NNf%IQ>hprff5y*{G{IJOaXeX>aVQQ7Xh%SJ#UNJIFNu1NmMSW z(#WDfWx{O`Uc760L>VT3COM0t48aJ5pz1YI1VB>9v{(+arKb=oSy>c#si=TUMSVt1 zJ+|5mC}_y4s5?|tP|vBTd*YXebmWq6TL`23h&t9uUMW5qI!ZbRBnYh_*9ag+r4;V~ zkxxb{gn*C&Fo!@BZwsT`Aeq3G0T3i3O_pVR1{y6`EX*#ZeO&F95N-Kdx5nN^$4ITt8bbpM%#a|%&tmO~8g@Jmy8#QJ{sJ>fz%?;9-hqHv36a3v6mqHzs1k4{ z(Ls3F4-+*a%*jM}8^eMrp3Q<%PLH5hgM*oZq&>C0zhf~CtrrP1LPw){?RxM8Nx@(0 zt`6yCVT4nWiiVfV||Kd zvxg|38;|QVDHvIV+#=7I3KAXQjz%YgZ8>9DA));-3Zw5%l$d^n8vctogdQ!F6fw0m ziloYb5DyjwK1akjhsp!?7M`;1u9{Ds>TkXX27h8OzDoHId95XZo$q+6*0u-?NM+c3pk?8!`L}G)BbmEsS5&_{DAdd7S-C(~!E*w~# z&C;S~Gg@|$$l6%Rct)OVE;xi*21&vka3FW6I`MjZ(|D^fIe9fc8++{(BU+WBPIRcK zQ5cOOO<)$HqJli-U|#YR>G#Ex;9x;{7fh{Ck&MDW(G0^pP}E3_hHaI;$_U-txtO+D z6+Ha+>!Rjop_4WB!LCQUS?~FY>@3vR1mE}P>2FJoi!a%`O2yBG+hibl($y-s0vK1% z&z0R@in9)XU+U8ia0S|eV|?LY>p$FKuWPc0F&c*$U$7%TwsmP_!kfFvz;p&7is}Pn7`*q@p}7*eb?5M*jeH`nM?1oIHv%lnO7`J} z;E5>IK&^QX_Vis@%v zM-KLGK@$#szy4Tn#nWd~myV9a!y3=6ZOXTtI>V&2AxP*@|6y~yc8l$V6#z_N1~}%% zzC1jQ9qMb&Ol6VU-D$XHcY3SapGqrg+0S-0bF~Cug*v=T-qfdB?&j%9II&Ou zunSC{#cv%EC3Hl|E*4N3KDVXce0lt4?3tr$eZD_EpN6EJj;4Kw!L`rY_Y33-Zt6{% zG{){J&w~WHX*=uNy8|ajZlfi&xSM60I>D6fG#U2dcE zBFxEG?jq1)pH=MFr{+QWgOXWazwamz{(rH~zzc9DnwvdbOXy>+TBF1w z#uMAl7Gi}G8C&G-{OWiao~W1aXA$u>U#mFTF(oV0@ulq}Uv*U-@b`_g{Tp2W0GGkf z+(uz9-_jZxiQvpVq_0XuLRg(1Ixk#}J!@V@TG%LdDi=O7!=G3W?5y7?C~_llsSQ$+ zb#JQma;!6DuE_5QS~k&^rX;=9^gS9+YyW0r9>N+;v%ra_M}003^<__iLX90f*IMZu zuKcYXjdHr6*2QaoIvWg0_B!lH6G~>r7)@%9i!OP$x6KB?E(cs@ToAwn-mT8IfX##d zx>=Fgj_Ij;{R#u^Ai8`{xRB{Nb?g7yc$71!(dI*bfnH$?q~|03D9XQ&rzT?Pq?t|` zL^aDXBWQSi_jR4koe_*B$m-omf%_$vea$pp^!{IromEg>QL}Dw2<{RfKyY_=3GVKY z;BLWXLvVL@cX!*ky99T4Htw67w|h?2f6uw^^I=uZT2)`q?jGYRn_F2WM{nz-n+LV) z$aR^5Vsck=)lA*)7pL?It{C^@4aw4HO-~k6m+p`s4-?P6EpP^2@pAFDepSqTN~YP9 z$dLPS#G*Y05rOGfseUM-{?zeM4!>mTk>~HeKp*S4fmi|vx0Yuon64p4IQT(XnbNvG5b zF4~6-Z9_~MH}CSp-5&)GtwXK{t~EW-dv(4JIgoxo{MRbZXxnk`?J`l0+J=NDpf|AP z9<;Y>i0kgVV4)!(Bz zhw5(bL=<`3XnS@{=o7lOcz*y|4-?5~%<2~K2H{`0R(AbVMf0XZ=q+qKZJ+T-4mMQj z4pGj_`+BvvkrQ}v9A&%XQmnIL+q! zcs@uG6&|gH=ZlM_oYS0wOSPctuJcDVQmfNxnb@O3z>~+2va=`~f3n1AwM~p=pZ$2k zjY(l=W~&`>v-DZdnVIYW%T2gPF!k`Kv7@sYnAW~shD#%*52=?^^wTptXq&bUM4@Y20(Z{tIV(R5nRq>#wr$KQe7di0v?h*3 z{gP)fKC+y9@9#=b6D76d(glJB8g}(61_;bFfenXl9~|tX#NN>+7~7YPM-Ps7HP0&o zm?fPv+MARjX{m~SzyEpCW$EqKl_Z4q=Y(t~TNZWy;%RQCu01B|y=68L^ogar;CWdCR}syWUYWWIK4QAW-Eu)hbJH^ebK{(5Uk!LDc6hFCAJ@P4i@i8Kg*SAns6 zV^$&gf;75H6McDpTjNI`UlNPZ(^dLF@(^tDtq*l%IrGaqdl6~ODJ(ZPUw$ztvRB*S zi;cH-r+{b9nV{x1Phza}TluR&(_|T`uw+)f!rn72J1~Wm<8zu*KIKZdHE> z1LdNnkSYZ3k?gl);j&e5;fw?-QCY4b1foGFo9S!8f?t&_;B<{?W2UE;S-Nlg$xY3? zhs9ST>*L4;=(h{F3|s`*vG_A%EnoJIY|lT$hW9-T-i=5=YSnaySE*khHM04Z+Y7^D zytiJ3iu8a#w?FHhEsv~ly0(np1@xcZwm)w(9faNgxkxn#Pgb*2pP6=Az75~8@IJ{n zD1Ym8*%TTuKbBmNUY>ZKZb$CvOgK26vwNoj@XKt?N|h2GESL8x*$2K2dMW zo$Hg8^M+V%lXAnUD)naOW8u(cl(pb(@*D0la{%w&rCm1Pd;F8$bD7 zzQ*GcD!k#a=xpy*$?X+pXb~}gQV|{NexjF}TJs0^Fv{c$PqNBBP7-;7_MW_946rEO z-4}=m?GVouenXfz9?tu1ac>g8*-K)hM^k|&+cVYBQ&$_A4#=k0#nVkhnYe$@*6q-f zcf;Qwt~6V(uXQzg^%IWzbo4jcL#7{!Ex!x+H&A&=eJ2{C1<@XMZsq^(bd%ovA=1mzo)p z^62>Ke-#N->+^9+_Yv714f#_5BD8V783z(5^G=l+#_RM&8}xWTbdl9I?%e0o2$a1g z>)Efvg(nZEk0b|^MPK+L|1f}jaiXI+TN>p1v7P~AG51jYsIy5k)JmiSe`63ZQ~o{E z3-OxfJ#otPhqF^rw9aWAdmnpDlwxt`E4A2+C&cFxI{u(tp z-?FmxL4k)Ai$CbX1`Z5EAHU<0} z1E;IFF8lUJt0+bjkLl6ci_MmU!0BNsywcNM6sA|dbfJ+P{$dTv<~ft)DDxvRto~c| zfB2`8g!XbeQ-f{nBQ-Aj{_b*=vzI8pRh_#Fx@!*GXeLHHDU18;cm)&F@QF!IDNWzw zes;`O_B+XOB9juo=C;Y8!wNH%ria@f@mlS3jE5|hh0`HJ4aIf)u>)NTYLB{=3bPYG zM$!bVC&ESdnb>fP+pB)8oE&z>1n7-aD4Q369 zw1^`;&CrE13W_vdio6!$EJjloN_xiH8}hf?%YCtYBWmYurE&+Dvt0OINUmSZMjokp5ROp*njai@VeFDhWkM`QD)o#jXvDk1 z6PlCx|Kah4gOmIJ(hC1yk1wpeT>sPK3mYr&T^0P$O@=VS7R$zd|m9#vcW? zjdR?AJ>(}jvUFob7F>2zq5xWoE zd60O#Q4Gg0+Ewbrd*tbeDnJz^oQaL+Dy{;IH~UnR9&tqRDy;#hgkwAu6u#80bfdAMiU#+Z#AD^vQt%67Ev zCvlxPmblVggf?wqSs73a+F69DGnI`=*|w5W)-j8YAIOg^rDo?C4ft z3~t9qeC#|*njK=E&?xD^2^y-D#vu_kk7c_3lEpkfQWT|V%Q=MHD#?)bjC!FcYDrFn zR$qS})>ttzYuvI=6wC@JOs2m5+t*jvx{HGgGJ8GenU`7!qX$hLS7d^SV-|U zpo@~R(ts3S;{qJ$qJ;K#zgFquU&>CPJe+f};p(=tn#33KG-Jg2wWX@u2)xXqITJI{ z;so51LSV09NLnGV2}nr?j&x(H4|z6-LRz`@{_JZ_kuuHGP?HT@h5$oHkyfLvml-XK zM!Ng1z>SIoqjAt%%8|5~W&PeziL+9`pDuS^6qxJ!@O%o0NH;g$7G8ze2)@AR( z2!%<52AQkJON+*VB|%doBt4%m%iDFVDsyo#o#2n_wCkgR8a+WxBaOO(e*vf>xcx2x7R|Y5ABzL_pVTGrl--f zAc^;%pL@c29^=d}7niATMCCp2Ccq7EIdH-C;W&v$g0AP1QUz73#RtUM*g3mk9>?m0 zkd>TIb+N~3?Tc3|8U5jHm9Tkj(1l-8?5%V~Dfq)W_bABiQJUlj^^2|Q^%KY=;jxM& zWBqr}Fq+G5QO^@4Ku__5vL~O_;3~4HV-9V>na<+fY%F#wvBl!W((eoCnOw-L8BNf0 z9PQLB9H7vheXsRd=vqqG`EG;d7jy(`#PI-T*tW?%b4W%L$pr0QeS6r=^gd|Kee$aY z?ARuxero#I`j4c(%-QPY=++#G=9^xoe+#^!0Hy$gYw5f_-YdGG3x|h3)=EHHs{_=f z!E#;)TrZ_-hCL@QCGRu06^2hBVl!H!-WeH^hvSEy_T>wtcT#ZaGo{byRb$8I^3{^k z?b^Dg*MymaZ?|r2x4pGu_2^cIYU;_V`i3T+qph8F4Vj!%UaQ?dh1MW#TZ=JCe{z+; zf(fC##d*c@{1616=rJNAzIVc-0;oc1_B&FOER2xefYYZK$&D$mfjuA(#MYyC#7+tTAYJpeGD6GGU!rZH(zXmPk+GYxTFW}uMXNFreDY>tea@$)ofFW>JQlif>7>_@>swsxMrCC9>NTXV z;vn}_$OX!6tnHq{ai872{juK`A`D^6$mN3czCiW)!N&3PDxx9t+-Hq`YtLl_Fcic6 zS@lS89O1RT42bz0nDyvfJTNk?`3i9V|m=WS#)51CSNaYJd`&rr%N@AFrZ8N#iuX|muZfj2av9qt5A2h-pWNNll`n}s7U_A27W&r_}m8s4ao7)%s zE3E~BcX)~A)LXkTN^g@L4zQ2W4FlEsszOel<#IpNcr(8O0=rh2%k;J{yf?J=bb#c~ zzxctd@b2x)npCgJJ%fZy7VA{Y(VyKjV7&w_@AS33DWQP)lMM^amp!g%(~f&Vi}!PO z`+#3pdVY9-n<)|f*(aX`t=%4WfY!_2iq<*P=ka^TD*POt??4ZSf^&h~OF{kSyRpB; z*^J3tv6J6!ZwvM)|3`#5w$J#RvWX4?WHZtzraGR}diP}CeUg>wzreMg~ z9ei-tr|4yf(2V$J2dl;k0BU7?o8|f76h4p=QZ6^;PqN`lpxMP$yrioOvscVi14GmG zZmU`TQ%>pj`EP^t+Y2GEQp}VjKBYr-vCYnjqv_bqqtHZRxd zSq}Gy{j*%UAF5&HvP$=5`i4zrgg1`Ty|7kGvxi2@g@Rng2LT}>-jYk{S&M$})?haOztU;9nJKhP|R?brTe&iVhqqW!NqhyB0j9BsJ<`f`lyCpv3b{9Ab2 zLa7%1uE3a_2e2=y7Or$&!uHM?W-`SK|4Tr@FD;<#%%y6(Y?Dv0L9r~*OaDi+(T}gV zS9vkn&+{Wo&R^OhmwduqT>i@Gl8-rl<#H+Phznv?Xa`Lo&RA<}AEtWgT}l=T+%RZ~PzQu)soQe-ls{u3Rw35VJXGv%=+~_EQL+@vP?sA;YpM?v z>=MCt%Rz?Y@~>2yKpyr6&$Pn??|O6T4p+C|z>HL2^NE4f@|Yh*we$N+Ru~rBZsqd{ z#XV?#4|8`gqWx5)-Y-oMhn~0PY35dS@|P)gTCt5$qjP1gSlX@Jqkzf25~%1e*{i-? zufzLk6&#`FZ5NB4dcqN~)+#TmDgAfk2E`sKpn@!+n0BUc6gMak?k5Y6$jQBD;j|ze z{Pa1f0zW2IU}I}HizpCUXvWvES0R{bZaVEP?x%Ki9lDyB1wAQ+7&YG>UH>RYKxR@4 zZxbGIi%Q5m*CDNV8?7Sie*T7qurgF1d{u68uaO>JQ{t)DQEcNHZ_& zmM_!~B=Vw-4oD72W=)CM_$7o5{XGtDa@!b=O*tr57M;{F%^EJ0Y@=e*Jv382{pP5M z?U?Y^Kq16Ll=CPOvc+27JMfFNRX z`j8*Mny*S%=4+TpvQkC|qrQQnlTkSd*|g7;lSPP|nd0DRQsr4J&sMb$0xO5Ta0=N1 z#p6;9ZFdNo39z&N^zZk>m^edyy}*n+QVsQ6fyXx?={lE{hihpY9u@F08SS0ZxgQfH zkd%jmX@7`kUpcmwzzOZoOkYv1dL3oEh*bH5{w+2@##$JWJlc(mV~}x0X@$YkjCd$I zqb0XZ^xyX0xj#gNrCC(nSH@V_A^vmI;PNf0?4U34;W8{HKjbl?;?o~PSR{XDn?j-_ zd0y?e#yj--vVeGMjZVlWl`SKfSnDvf>kq!h5i_6x5VEpsw?A)Y03U>I)L~_tSP*y1 z+W_!O?lxG2Gwq&q(?$Vw5~%pxJ+Gk)wGaq)2IrCcV(C8?J?Xuac^KVSULU*5UDD=u ze=7Xjwzqz~^ZESVvpN5x*|m_^XSQ$8Mw|IF~SgMnz4MnS*ZgY z1-Kgx^&BOBZuwdwIJ}>Hp*?5;1YGmcJgYXs?JEAH;?pO)-) zL?>i%bNiMlRyS{?N8#f?E)*UxWlF5bLPskALPQ$E$!W(u-dnPnIW}NFftyqJl1R$T znoGScvg@hR=clgLxckMJzb^`JB0J;94f$ak@-})-A7S!x*11C_h>A?PhbGR7&09B5 z-W`j-3x&?4Bg%o@@FUbm?&gzHW2NV=cf@gld|q_r!gYb?kpRhRb%hh}nT&?J<-`b!ciF9Lf@~N8<$SOOXmAhg z@~3|P@QDheJxC*<{%EN}Id7y|+TwbUyQOaNB=JyF8pqs9HFviSd1_3t3*Y`t+urcE ztCt4XDQY^_D{L##HxqlSf$ty%Xfk5ewRwR0?9$2mSK6qI?#nZi2L$|^Y-1(@L*K+tOXJ0LS`!Y~bsPiFKkoi+%-*F07Sj)B$+H<~MFxu1XF_ zZ_*f^?LF5=sdW#&#&Uv(KgNa5nY(_@cuqW8IlFF~=a}GUpR5#q@}WwudQo|eb2te1 zpl{sye6TUux0`7s4A(OVGmQberifxa;1UsUBzYUH$ zd7Y7Lp$>q%5HIcIek?or09L%Sc^-h&B+nWt&)4tcPsLWbcCq+n-xfak{cPE;`@3uU zR*@Wb`0~7n5WX?vcL2{{z#hesx37nDE7hC8%ga}}sixZ=o8(^kZBEWCqL4R2*rJ60H=4m6fwbS4o0QtAfs`)?Wm;a9;ng2Dv zaI^f^A(>=tnG^_X7>_Mu+XPYJ>+ozX~=QEMw z@HPe1A3AFjWY*W!6GVngP2KLUz?)q-7UIV3CtHUR#golci3?Y#2< z6llhNon6oOxFkMX^5F;$o4>Rq(;u7zK^Hmy4hYk|JlT@|bLwk5T+47TJCu7dY!IX2 zqT1Jn{G|R)tBkB(qubXyDLjDB%pBP})JD)!DP}bF+h&M_Q`XYTCfFKmt=@`{3dfng02)W8lZae8U?<1b>%VM>ycL}>#; z5DVG3eK1av&3CpS{C%>%vabb{ePxg9Ni05NPKYg8Dp%Ve32^Luk zb$TNDY!$nvLU@HA44mv0B{=kw&AbgX?1a1gRgyyA4Vsac`}XlQ@pDSzPkU zfeDzyG>w>*el!cJO=N`Wsb*Pbzi?DmT1P?X+jZz=3NUpT+Ewuwha1mmQ2{}gi&V?<^@sIb? z7X4KT-C-f2>?*MFD71rM*5v!Q)&I4*_5^t=N)gyZ)D#n=n}Ft!zhwn+xVI5eKZizt=LwpstB`*Gt*)|yi+K4-`s?oI ztq1&(``JH?T{wTY{rUNNH}m=N7@9ZXJ8yIKB?@>FbamRLJOAXlIkQiq{#k%^^VpaiO~99yiDQ1$95kt%)chn6Q}NTyNpF_sn7yyB{_?wB_lKV+|8W< zr$T*>C6N#ss7>BITmbS+ZqO{Mb5~<^bCs*X;ef0Mq*J+f?FXgTzX=CZB+1vS!e#?# zhe}V+yaJTejB4-c-=@@ZKnWIi-RrRLjaw6F^rx4;n*CUO0|`B=TD($9a(WH>e{uqV z1l=@x_b%fOFZFX8HVyDECy0@r{N4D|%d`L&CDOO+A(LOy;76hJ{V{Jr>Qrw&xX7V* zdT`Dfw6}3B@YEKk^hBf^43}!R!hNT{y|=lRLa03RZPCSGv1b+y--k`OiMe^?apOAW zmlL2<#OM<3-KFYe{lt*7*=xp#GGX%WLw@8U(K;L4S_v8ve62eFqllVD{Zdjc45EI2 ztx^E48c_sq?32@3Uw=43K3kl+3zLi}rx*Ow`2H=vH|lL1SLJhM++=>)5pFye6PnB& z>s;nS{$Ads^ZEu?EA85XyBz^-bH3=XKLcVM5rOCxN}*>jT~#y7PdoE^7@+vwOc~EU?ls}IW`B-#J`ldO^xJ4jk&*@w$=Od#*lOW4rANsR+y<#&P8MO zUCktWDnqcOR-Z%oxpkYHWG$_)4R%0ig-%%*#JVX$;|uIKPO zYFMrFLo;;D5%;N^4<`y0Emd>irgU$pPxZXpV`K+EHE>{AKWBNVneVuv#l9ZPdp>9O z%$b+lXG%jl`^j@=dy+Hr8pmZj(Vb$Qjr(#dUON~0QEu1b%sAp@H+#8~Id%MF{&*>s z8uIfaxKg!>M}A>9Z(MhWRkmM$eHc>k;ro(P%`7|LF|4E2GaoeG|Mh;+U3c~aG&t!aS)99h+HdlIs?K(t`P%F>`^_8V zd>FNIlhJno3GAxLJ?wlf75c}Vk9z!`4q8!;K-)wpk88EnQ|;i+vD079Z)rqs5Ak(! zuUAL8d=8Bce4k4h${QA*9X!lvcKnW3H-0*L0Gakb<(tr`weGk*G272`%yOCUJ<%S;Vp+njLQKZ1RK?i z`$t3kw8MvKN-~~_u{m71drUd)ce*a76ILTU+w0vv;xoR&upcN)wD$G?Dc*4X7irf2 zyA8$7@;{I-*jd^C8~LJJXCmTo6yqQHqNxc*(@gRJD+6x7ZwsG&rLj)XV@}N%2`#=e)66 zOW;E~J!laA7%L~q+ZFx##TZToL#+?lx?TG+FDDWj?#p>pNuLhGQXKqooi=u0nr942 zSMvttzaoAmSd@YK99^E50NS>f*At z;ACPpK?CR@3=(BADO4VM0sx0ACf+vME764&Woa@A3Ji{K39D;Tg<)#sSV)%AbL-6( z6Hn|j%r6dqtzcxUld!U3(=O%Ej2y4S?GUX|dkyJxtiwBJxfKwx3=19d2;KM1i<)#7 z@LyWZ+vw{Kh*TR+fWR8;wIv)<`PvjQ#1-nwnyiNJ1UCzT$JK}boFG+FXDg}NQ$=-ubd}WDBj1U^d*Y! z5e1V#BbBE>+B{4`_X;ycHi|AbRbql&ASNmAFl(x02V&$H>Q`8j`~+pNC<-HYSbGMh z22pWH3O$2rV4ks*m^tfAR9_Veax9LyUO43zMv!(Y>#q>LK2P*XV(n0?E9I!J{n4K= zyZEBe7FfiQ#M6m5#z5RVlwUy-B|kurEh*Y!^dymJEQlq~{^Z5_)+BN2Vw@bf+B`8y z?_wX{*>I0Vp{cO$xegG-gj`_OgAM|MOn1ge+gFb2xc8MO{J-l(l=wMHjvB8VA=|m6 z7pm_Rk`k|(8{?jojymEOH$Zz2r4SS0oQQIYl#TXESGNbw(vn@XN!45az%`NWn8aX^ zl7(Z_yWuhQDCvgB;Z>RtJe}V6sLL7(`?v9eX3S-I7@tbYw#$EkLVNE!prw|j6V?rcO6H5G@w{-ZT z2_MF_4>vLPVR0T0DS-jK7O5l`S)|b$pBJUAXUQY?RCBi3vtpO3`8C zXZPp8lU+*C_+zmbCn_dG#K&c74x3JXutK3^e=xGbjEf)@v<80wmO5@vU#n5Z-(LU zZm(MvRc9--b@3NTMbh6l$GwE!F!4I$T48NQPZ;WU;-8<*uao4#EUFUB^*;@03d9Sg5pi^t@8vD-1 z=i-}?BE$?QSmz--uR6ab*OY7oA^xpb}V39<*% zyr=fR_}$YMuHAjm$P^k)qqVO(xBv{_%OZVsVnBMk{2|@%alqI06>uid|m5)sKx7yXlof^yyz_44 zW^OS>2@&mGTLOT+p+QLlqC!e+Lviu-%!qGWF+-ey=5=5)8=B05zDkPDf&$-{xbNT<2yu ztDzCv6SiC2Izb$-yYrgG*L^-Mg{RLJHb(1fyIkCBE^d9*9c;B`%s<>}Rxjljc=PVc zR+Oe--?+}QZH1(>HF+X7@%PA@m1ZT(Qe6%QkE3s2bzf-gD&G~X(p0H6?TluHIGf%m zjnlJc^ppqI-0Y@>3#d|!ta5iW?H}rzJ!1<89}vLibLrU)js7aZdlTv-Xwmxef}P=<=zz|rxU{mQtI1i{7~_s1moXhQwmWZMdUb65>*cO1Y!7t6^Z*%p5P)&PD4l`3ufdOaU4&lvf6 z00sTPHw!a8#2*e@J%H!O0p`|R;q4yMg^->N@ZAd-_ElM>w9?rLSN^95#=L=t%97Up zh*flr?A8eJ;a#`N)nQAQY`}jkvk$^z@M1YY40R7mkVW z&}#0Ji)IVa|4p$XsIoMJ~ij$Wi67L0inBYK>xlFs$D%LFhs5lr%U zC#a`ClhRgC`9$_+?Msiq{PMu_aW)6cAcDA%4%L?tOw)^TqoB#}uZK`R?*P zo&_19nPSXbs}IKN8~u|pMJLq1Ue%0kGxSf!RV5bjL^>QpUS~<>Z})>h0tcsY-}ZIq zqWw)cRxT|8)&<-Albo8G((~Y_V?_0aj!5xLYf?p_G=Co7+id?b6!c??)y2}cZC1rF zo9~YboAu28ricGbX3hf_H$ki2ib8YAII=KA+eQdU@hoDDk!~&%r6iWEA1T})#81yag$lvqo%@{rQ*E)&hNNa z2Nc&z`=a!8RcI3xJOAbEPO3b^_HxPxo>XNoVzd7ADhbn83v!_OWq!kmJ@4t7J63(= zj2GDx0y>+$c6L+SZD`lDciXkAaeL8j-}3|XAowcO9xTN7vukqWu&v)^PW!a#B0fY- zjzDw#^{oMJF8BRbpUJG0PKi7}9BF|t@~uek2?K2=sQbCY3SR2P5Qds?cSX7Wx!@#2QnPJ>V&eT(=1LxTx|6MLDt+;x@^2p&8ug%7oif2FaS;g+ycoX3@G0|d9 ziA|x7!l`64`c-2y%;>8YTzjtl08VP(9NUSVUYy+om0$dHM_xHWf1c9gk{T6QKm zlipMDIJHPTRUuogZ1r}(StgU?15hyjpkMz&6nFO-S8cn_OHx?(EB_-`rT?b5^PS&G zW1&is$*_aATG&XP=DOn3oGh&W`>-4vD+k;EP^ED3aQwF> z@}_}7ECaV1@L1~^Gj6BJz-=|9K)P1M5mKzy&>8P=&(t0FhuD{KUQy6BEx@%?pkh?Af;y>1*YdERnp9c5jYZ7-S2o9yrw*#TtqUz>R4{b*=uq7(XrzyF0%?DPb;SuUde}jW3fbbTWponzttZo+PP8ha!rmme=1K zA{ptkKp8Em8)byV{al7U|0ig$Ie$(XdRMJz4x(@pIUbd(0>z30H0K; zIw`37v7~qBW$|)F3RidVf6El=AO(;$cw2qo3K!22=?EI|eVq!3&V_qho|89dYhp8; zx13&Ofzc_s&x|!HoD-1f=KVUAS;oDm;e|(e8fJJ+eiu-pAQ_0f)B+ha_vfUQ)U2Z@ z)PZZwgJo$d-Gh1aM+=5SUQZ(i%z6@E3@!p0d01}8PKgRd4p1aEPwH1MOfeLkaU8e7 zkkV;r|A}6JmYGcVJ#BP}&n!Az8H9|GTP z7YWX0QQA-8-;ps6RE)l`sx+Z!VC4Y%Pa55^`ifTp%=IUXkWOKf<-tn9cQ0fJ(vZD*Ce1n>Qr>@f9LDNB+)3|zOg9R@#8r$ z$Ltr3{on?zy&8S*bP3*jVIv_W?N3dTAD@%y2}~ z&E60$A6ZgJQ}Y{D%$jkCivxJbUxi$!@NwKQk1N;FLrWi?m$P%(J^j@Aw zGQp6tFS1flgc;d?+({u3@`5dK2IDrNsL08X(LwNA2qFjrP+?@eLSs}ysrp1&$Xfw0 zq&uX#*x_MEG6c+42o0$oGSK`ao8d)2fao88>R@~ZF)7-h9Og^!^`ZWNXj$-FeB zc86mgaLkRg+!@Fg@@Km#8@t|j>8F%vq*%53frjv`pp~+5mgykm`?Rq9+2wQR=ILEH zhBSI*g-PDJhJ7PS)s8`G-`C2(8q&vXIPai$#hAPBbfXHC`jiLy$;`}>N#tM0vCm#R z2!DhRgP)W>-zVJv5g0~#z_;tMMoi2`fY-z0o)7QAo|ngUrO*3?S|cEwDJ%BJ`{6>5 zpCaJpd0F`Vc74WZXgggA0DeC|JpN}oL;SosHe&u%0AP%U^nfpKg^kn>Bmll|mqyJS zaA&Re4#%=o_RtTSQ#_-e7N|A*jo7KZKkO%`d2fit8y>{0zHGT*CMJJ8_`yM+|9o2 zMF0l!FMJs$d*G?;=?|siL(i9eYOSLX_&5e`s(cyJKWo%mFW40S!X=q?%6XZJ45>#V zbrGvt(w3nA>U_4{D#big*2Rj<(w+(%s@GwGlHR~eg^S5e&#|J|+scMqHX+sV)QyJDMddsWQn`awHyTN~%dvg78y*%x>qxsg7q$HT#aGPu{Ezbv;wr*^W8+)s@#Ya~ z2UKN2Jd|b&9DSQ}M!)d=3*aVvq^v3R;;2xkE+jPbr+Ltzy~!k`iQ@8PIT@x)stdHn zn|QMdrNbC5`9z(uO=rH9y``;l%6cHG5z( zwrYC5cMN2Ggd#4CAg6NP00?H&i+e@?E6=YhTC9+R4Td4V)A4th*SoJM3uGQ zwnPm@E+=ZXMNzED1sfgOn%FY|{gb7$((0VVxXBgB6m$4UTdxr^I;`-4Wi1TCi=1^y z*Go@pm`;Y6S0h%MvENUSzkylih^_QOJBea63txWg3?6KXutwG#kan=e(R8WDwD3k+mV%BJaw3v9XRw(g2 z`u;V8X(##?gYlE-_;)I z)jXbsRXFhwY%)j(@%Ul70pwv!JM&27-m@Kz`L%_txW8Jc49&B;n(BaHaFXw)Nsk9B z%g;2}pQd*l8qaNSTV|||v_e}8A6K|)C62?`ndmr7EU;4gul_}wQ8c)!be$sVT)~3j zPhLT3o#Ea3wOnqe83A}>(E1SvCgb7?ngY$M8F2pQ_Zp%qO(DzV!NkHde-z?}<=g6} zf+FSH>_ywmC=*I^8mhL{=$-A5tkY2aDN7ckXeZKc_g`8jvs3x13=Hb!(x3*@8Csh( z+rF&ZKQ;^uX=|$1R~7xrbaUeotnbBYiOtFJFNCWb5-baU#>ve=c5eL9oyIOSrdfRn z)NFrjz;0Rg&gL|{n2EAy$BN(b`ab>&lX3>Fjh@yaZk$b_<514w&RK09Ro4r14@I7i z-ZH+JqeZg8U{Rr5bwTie$Lq}YaP;hszlv$k`zE<^`e1FSz6Rl6SeEi+# zM--h3>a8<8hb7zLRMd|^lK+z@c)WBa*rl-q@nJXjH8O@ciFSeAagl*^-aNocueeZ> z5aS;nixMHtj`nCio|#D>2o61_V^1D<;|y41 zKWzV-hcYk-V$vCAjsaq!5kj7O;*d~7)#29)U#Wwx>%sM!NvON0(yOuB(+UIb2ozl- zBg;o`LTf0b1rGKm{(dv$I^7TTt2rhdm_fk0x(E*zI#OAbKDshl?`?K!oH`2S?5mk< zR3^Gf8azR>NEDEZ7J9^sOwtnL#X_RpP7)i52U!4#H#-Bvi7HYxI=%GSt-a$aK|H7l znT%6h8d^?H9SFzqT8Pm=>%(Om!_l~je)mpkeF>W2WXid2C+5#mV{Oa9k2tK~#5chU zQbkuMffat(S_U5St@K%RWV3Ou`nFq*tzsK;LmBf^4KpI-A(~a$_m)jPGPCoWiA>?| z7#`!{&-$V?$O>xw71*jCqE++y_p_}ydE?S~XZ`!E2>}J6nP@Z;bDYNzjg|eDplJaS ziI={Us*DCR(>s=FT=28d$ws9~B%PJZuhyIw9&L3&+(w}|##0fGn zh9f~07)LFd+IqEJ=i_1IayOmrv6){|V3{oOU~FQl&bq1qQ}edR($<~VnyHChxwA3# zvh5UahFVtaq7!yhmbj$(dgvTn4}5Z=S6eD94kPU9NIMgqr`F}^aumI z@lGTdXaD$xeecCJoqc8t^Q0_ACfZCUgL4txd z+-fKByIVF}by9PvJkz`$4Sh<_VY@I#Zlsx6gAI{;)+f$Cx%Avtv{dt0M;|YsILAe> zLv+C4Kb9~?7MF*fif2?GIn8tbWjK{)F&FoMG-*+_dEE4rc7MY&pmQ{`Fm3{?=Ko72 z%3JfRY~SMP%z>xW*E233KA&VeOl?iq3+=Dt(MMJ}$4(?UA=a|i#MBNcA}e zC}uqTi#)DvHs3U3ZnBj|U9{SqLlXs7EAheftUo?A9`+q19G|VZH7pC#V|DujF~lT_ z^E5)GQbHr*7-%GyE(#AN7I)>sysSv;#6K)bgH3dT9hTF}mjJHzbvOkaf~_hl0hZnRrbBZ z?>F2Gt(_yLc{*5z)mWv-3RyxE0E-hVteSOmiK4&wgq`GX6}~U zTI;XQ4u6C7jgJ-36kBlYv6sR(+tU4!vEmG{m6M^ugVxW@GvnKq6R##}#`iVF^x=gK z2Upobqj+0KvxKZK<>m&r_)QlZAU!c{SJGvOAJp*x**=%eqndi0U>ruZ-LiB?2CNt( z?3h!cq_QK^mQ9eV+0BFNU1GbDw;*}W&&Cbh@R5p;GpbK(Of^TAR`)D!jl{mgUtfe_ znQ^0}+eeFhqhv0!D5_^ZTg)fUvNDW6!Fc%c!CcTBOYc~RjZoiK%zGP)Dm#C3AbaQ& zgOWU%;RT!-cYeybCy@|?AegDAU@i}`VFeVP@HQh`8wqlfAM1h5+}{#V|K7hI7OC-p ze$Dk;*HhsRO6!|;P2D$VD=0lGyr?vuX%KF1#9z}n&)^JV zm0`2!(=sm^<+ZL&JbUW@F!qf>mNiSeJu}_Ywr#t2Thq2}+cu_c+qR}{o4ak>w&wQv z?vHy;#CyLuv9$ME6>IOv%B-ra$|oP=YaQ%Oa$A$Mri;|NBad@qZ3;AcipG&jkDO1U z{wKS2Goac7HBE`GtYsR%HK13F3_}eChFis5A-T)*Z#!i$1&bjcl;4lOfi5%_1y13PJ(Y8U|%*E zKaoRrMuPM70$p*CA)N{-E^mc!DPsu8+B=86n!%Il{L7fG z5Q!NkHA}PMkV8-xl0Lyu#wvG{1+4J;`$EWnN$nk2&CZ#Q!oTCn9C%+Q4$w4h>4MLc zg=)zPspnM2P+BxnFeopmZ;r2bl79zj#uTKv$}>ad4bHX@(a8--rr_@&PG4|($^&?w8^U3F-o zsK*Ezb#l&FMF^D_TZ_b%WFq+k1eOPE_lXFd-JL#cBwzS~eq6^-1lE{4Mbae8+6nUuMvC`{Mgaw1h-b582G+wUFQ?x+WK4P(3 zWpn85R9b>~?#xS^4Lo*uE~FH7s9V00RSysDdF)d1_N%P)7pIfI(v>P~j`7?*GMr+cN+H-Xs*I$m}E07dzJ}*NK{_FZ%xz|P`vS0u{tNh&aFp$Wa(%Q)4e+ztHc4$yQ|TVANpV#!3K?lIP%~L~@m}KYNDek#bnvx+$~^}9 z7kk0MCJO4e1=U_#elkw-Ibdvh6Pam)mx88V4{r7zBA`gBw1P%WH@-UY&GJLZ}H1*MN= zVeOUI9s2eC=xw%!Q+-hzsB-xC&k5T>NF^ht#`B(pWZc^^{@scGL=MnJmHEs%xUyNj zDZ-I$mz`6h^Jr+Z$>YF{t5#%IFxDw}zr&MA<8q|Hd{d>J=WscoNqI(qC+f;PZOKcm z&IhpniFAi7kpU$-{ykovdfZb(thuI6EN^q4<(eK^7@$$xGf>wvuu6Jo_QwQ`(Z%r6 z)e6FU7`rTAwDa)!V?IN#Nx-6VKIWrvvY}ZSj_XH?;R3e>Dqx9zLPfF?o+SE}?^IHe z@Kc7mm`BXNpyXvr?T+cVXs)!4vdJp7lU(zMbkooBN>Swm)RlRlMn3)ug$nX0mIU#Y zB8L^lhEd0cdYh=K`LD?>@a6{8LU&>bqm3N9`OsTduYErd$u`$nipm6CN3Ej8GY%Kl zhs;Vuyt?4T<0)2Aj|}|7Y>9|(NUZdqbbE=ESAp_8hKWU5!LSr(@Ah*=3!nBFgO~-c za3C{FUwqH~XTu@Ha?_QtM4WI?CPk#02|sWf?dIz!FWPb57L5aBOuK$0Kds(hG*y?c z_>^t(-+iAB4!|0&qhPL6TUsDR94prR>+o_rZrk0Z)fMVB@ZSFSqXs(a20x`A!t2{& zPWLRhZkMd-o^LL=SB{K(xRZrKp@U=G)J3S%yHuf|77?yF(urK0Sctn&ISI-M%5Skj z459^+aHVW&1^o&!<2)i%lW?U{idm6bu_SyVW$!R0dQyd?II%`fBIWT=B~+r>rYf^QB*idHU(1vz`S+X>-H4!4~j`yCRG*>*dz_cbgpXd9M9N*7_ zvlKf)9>Sz6UrLJ#EkKp{=RwI5{T4aZocLmCiV-#u=5MhuKwSJcqJvE#3DodJPh|5T zVug7A!gGHy`zkR>vbaSFqCqzzurVUx5u!nPB4G@o$pNCYLNPc>B#H1qLZX)@EsX`IGC>m z&2kpSLyOmLnw$9|Kc9?u?7ORTbWNAYc?hAA`89u^@psLGtrvHuU$TcsqwgKNrh_we zC8OsSOmFEEQ)KncqvtkEZy6JCTtyQ)l=Yfp=P68F z#S__-36@O~(-!KGqh*$)$7>ru0BmK}YTv72V3>#lCZ-7htRpaROa%cG*8~9G5f}s} z;=l<6LV(B!3=&g8AoGhm*)RCJJ1FZFLt_{9G;bA?lB5+&V;9Y|4;7Q)q!mYF7wt4} zRg)P zT&zrW?mas;m|sy$y@2R5mNs)+sdaGL+92 zCA2)ZG@dY5Ul)Z9##CIwTN{$<9M{9*z_M+M;(<+Fs8Bd}kU{e$&26aF8{oSE)i)V2 zLf#&hnlq={ozJ;T&y#sl9+B_8D!83oN>8rJDP>OB$JNphg1lvyJ~=q`Xt>9pb`XM$ zWx->E{9-?Nl%VxXTi(|N?{}Ys)3+S-g*Df2->CX!@@(xZWBb34)2gibp{l@ES`cci zgg(X^5)5c+GeU7lIP!~o=Lar?$G~;$+7=xGM&y?-zEUoTo9)cDj07%KU<0*x?k24z zcmvX(*Vg6cLw?}Kda$p)6K<;S+2co=uCImUly8-zG{@ZsXHU%swuOD`3?bQ``8X^k`8yK=%O0% z7=`P^Z3#QE`CVPSd_^QNcb)LvCqzxms(x&-7Tpk|D5BFAf#2N}4;daOn4N zWs^JW3r(|71PD5td%e7!)0RfXPGzY?l`z3`)#aF&*jxzX2CR2V>H++NLtq5_?n1S1 z4e{>{{H)+S?E@LSp54)9_vgjVx&Hj!?=DZS>kgG8cINHyG(=&nz#6}U>kWLACxt7t z8oWXKCy-nAh#3g|DE*zApEZe|u)PJT7tTT=D6?5wA~!TQGjhW_9WAG!GWcQRm7ec7 z2^RaBE6T%rI+RbLp0qcQ3@OQ}?qcRTMo$QemhU(YB0M*8C820{X}oYpt%~04yEBcn zI?cO;QSy2U>jgjNSg7;?MSQz?o+xhc;Ieq(rqK+Rewg;fIKaRK9(6A#A&rP(;`#Zn zH2kiAOk?SZJS$P+NO_&$%RQUtnQ)F+sT-r0>ryq=AaYwIFX?32@N3_61oNm!Corj{ zP|@Z49h5m}mb44x4_GQ01lCO3GP~4X_V$GFOnAd{-t0^&<+@gdx-J>9Fi#m3DHQmJ zOW}y!tx#nrpLw#Mpsv!;=vpzVBS0Pva>$K0IR5@3$#AzOM_mULRU#2>ZidD^w?69n}XGUbU%H)D_p?XO`6A+{XdI+}> z>>$`dael(}55RDb9L_{jUt_qzaR0>nA^V%W2YDOv8r1DO_qS}2udg3d!Ws(b52M0u zzD{wty&RF1F3_7xy=yQ!pDlj_u;8^Dvp>5%+qAQ7Qc6%)G*QhxhfW0b2y~Ph(o4-m z!@sWad?TEozLGT_?sYo%Or^$&5Yr0Z+|YV12{qJ%&E7OQ3Cd}2`r~ezzfTkulbWzw zykZ4*6$lC{;YN&BfQUYCK;_nhgkf^h3f{ja!X}MHuAzX_TadWO! z&U!n|>ZlN!=|;=69|swCk}3N?a&x}XfRG|I!R6T=^W~y7Y>AR5F>~IG3;!N~2}&lE z@RkfA<}6DT0+9xzs0V=uJhyCA+9*9a|KY8&3Gwii{KI0lCBKInEId9Bd zY!)t;^XF>|e%13YZGnDbzZTy_Z`{Q`u@vKnl(MLENhBTH{<;NCFBD-0y)ZC036gwZ zCWl`u2IdgGqd3~S0unDx&P%;j<&QQd0nA61>n;b3Ij~)y6UoI_8ht@+09k;?l7UVw)mp zos5`u-)Hixc60D;r(l+)PK~42R?1BES!_kbFNi^X)%$}|^4^uZ%q(@sZrykHnhJ!D z6jvv{tC$>3cu|9OWG&Ps$4gw|gUtLn-Uv>B0+lP?er8=aAD!Z3#bYEcAvsE-T&3_LZ8nPV!bTF!u1_J?a&>lJePU{BLpNOMC(e~yw~Y{~8K*ySoY`(Vj4O!mAvOzf zloXQ$3L25oLOSnuT)jfoj-CBF{%xDTe&yb|udSIjt4%jA&PM@?BJtS%C$=N&6^b_` zD3Ogjn7*xUs|FbF$W~U*$K#i497?YGMq@@e(%WDnnA8MkQJ>c(9Cf@Y=g(TSjog@M z`>5)n;xq*;ckvNzyc47XmE|HybP_v%U$#CfG2-fm6%0^Kndc5J=_7bR>VK%dluUB| z(|S3+dgPQ)LCu#lXcuoR@AUYF~Ipse?GDP;Px6@@eWCUTd0L#uj)4nFSvMV#lRRWp_ZlUM& z?xRr%t{9=7SNLzbxa8)_D%r{seWGTV0xIeivkO!dskcT|->c~yH0SQRs>Wz$wdNky zo4nD~WKsNrO$u^5sdA&fL(%3=f1RLuQH_5dp$z;6N24(V3I7KCZQ4Ax(&q4(ziyE9 zuIGCmBNPu}M#(YXn%hVMlTj&n&BX{BO*^^*VcshLM$=OSnzuvI3@bW{9ZjE04=cL1 zb&c{`aJzFq;PEl-*tp~?-64l(omiQ2u92dh zY8S}d^@A>&9vq5jui1KM71};#gbA&gQ=U0^z zm_xmmJs;M5?Z=T+oCRa96)g^$XyHf79kh7WFM6a-aY>i$h*T#s)zT%*%1DCHHGkZY=BXn0V79}~sL4|UUrA&G46vd;%3H~IX?xX8oyWH{c zC_fAJa}KGZ11pw>J5OsaAeT=@@&OOHyId6VsEk$n)ra|JfQ@yNjx2#0W}nIvjcO;# zfOrC6#^Pjk^)TN|cC*l>j|h>^vT@_KSY({u9AJAI@qYK!oY*sS2v^ZAv;l?bIRw4% zLUjGjuH4`@T&%<3+^IW&M)&T)%fr71{X7Tphqi%y?@&O0#64Sh*7vj?7d#D4c#J)- zn|=H7uoD`bDNh}urvJ|CR@bZ%E{P)Uc^e@$ymtP(ALP9Udq_U)X9thz{d3Nu8ep5T6h2hLhzM$ zxR#50I7ewCfq$b!5KnCryq@zp6pKUyy7wCk^2wz~?KfE6Tj0bmqjUB((>lzskGwXf zkhuA%N)(t4=_I}>JM+Rp_Of(`Ovt~+n)k`L-Dn@0Gv90X1RdNsxQ{TB(H#)Zv|Xzf zOAN=j75J?OhCSf}fteR~Zwvw%qiw|edWZ(TGOZ!<8>3X^Z2<0*dRJvXi~XQV8T)AR zm#V9pX@4BZ#y*5O#=YuuDvZ~BP~{P5wQpG}V*XAVd0=%K>yF6I)#Eh+=8e~6EJcj4 zEbahnMi&(x10M;y#9CS#xPCP>Vn}edm`O^hShacM=r~ffltD;^Qvy;cWXC~UbgL78 z>uIpHiM01GXqYfRUeQoWh_(!Qb#p&*HU`t9yOo)3dRVL!DU||=F95LwX3d4zaoAh1 zZ~9U9tlF+|0=3wh|F7CoO>xNuqt$_Q*~x`HiGBG!2s09%;+kt`bl(*=@6IgOKUE#z z-|%MtOV$0S7pgro`LC)2*>0DOGfXLZR;2|)Y|}u8f9o&y{>_ZJ!52k%nrGW>Qhfi% z4?;I{lqBts#o6L#{p-Y&@>>ibnt`@Y2FJHh9qfIs|d-Vkq;KlSvL zS+3si#~7oa0Yz*0$0-?hYvZk9j>WkJ&vzT&CGl)5eR51NH0GizDZUT&u}I6-x7Sa~ zN2$8qSnA67%@vzwNDkTu(JyZ5fdJ|$C?wbEihqpB_ZkI(l1st!BUTj{3D-w6ffRgx z#3)L%yWFa>!~Ck+k#DGwtZ|DOb5IBxGgLx~W15Y2BES_RpN*T3wV3B6l<)LDO)A2q ziV{=ekrr!^41cJ5hixo=v*ek&qCfV$vx?Hn)Xagz4u!q8ErR9tv=Tk5xBL8tE|o<6 zk7EC~0NVe**jfHFMAkb|Iws>^7V{2;-(0SuKd~edPK5cV2;f-bD1SH`vm1bCqI^E4y)|j@HPM?sHnqF_aA8E>?`%=YzO1+eP9nUL3{XSBis5{1jDio2M)hJ zpy82eF)Hiy(U zBW5zcIHbon^FlPnA}vsf7r8M5wQ7Ef*inA5H9JJJNue|Y1<<6E+dkFN;qc}#JnGQA z-8YG!MO5y~g=*q|HCjdK?Fo@qP7wl2u{4M>%kzi@;IPOgjLztpn52GsLM8u{aFCS= zf`RlY){939JSF3Ws@BS196Hnb+x(3}h*5A$;#zqfBvDWd<#P@M#n%i(TuiABMqG@H zl8+)^i2$d73878KUcX3)at~qO(4k@kCt0$DgUV|HC$O^=^ksAK1PltrJeE2vkupEA zh2|-X2Wr1do6Ysou%uOHj_I2l`;C>oVeZ+5w@+06amVuqZ2kn>(?9AO)Bg+B{{QP5 z6YGD3V{6AsTlO=+1Ydoka=Jvu$IQ$MKv+Q*t*AA#(4L7duesZ23IAMsBzjn0(!ir?s;R*kv*gblNGeEa^4S9aZ5^M*KZ8I-oZRT47p^ z<&|oQAN&>a5wOr$>Rp7_*rgvcD`Z2FpYo{zvH`jQwgJ8YS_yO&oa!Ulc(cQn_3RQAJIY?wQ?&DIzFuH= z!>Q`N^7aKhC+s)bKgtyFU&)mDKgf8r<^D&eoo}kg%Zw7da6$YKm5@Je8?YrkS0-zd zCJJh!_Hb^mOxyE9AZe!OJnORSf*Yl%;a5rk`GW8Pv$H!^XygbUI7wu}kP499%9Igd zn(-{;Hb5_dk>isLg-0*eO(!kjPei<9jdFH17k6I>lcS${ou02@MjXj5@l~U0Y z_-|Loe@eB>4q*Ooga=?_{P*F4cD${vKLf(h)*a>RtTE$#cs^Mm=u1M2aU0AB2t)|+ zi~v>F^&0$Ts$*>8p=;;SNh1%}x)8Q@W8WvUbG8BXm<0OInup1KifFg;1~3T}dL^EYkrxa?Ju7U9v7c2M5l6OJw6S zMz4X%&E85{F~D7KYafq@EJ&2u7UmZ2lO2X4nd(fW^S&+^~Y95c&*4D_@UWG(yn5C*SaP&}?vM(%V(Lo4rtNKayq^mu)nNiYS=Sxq|oc%f4y>v3ZX0wz=cWtUWzdluz zh5NY17nUxw+|m6+B5=q}eYxaE*UI5+(0Ch|8Z*3lrgyb#uI(!7k-f-kCEdgl<;GbU zq)BPx?OP0;#{aAn-{SObU0GXtsjG4%xtP%QAV!x+W$i|io9Usu<=+0>t=vbF%Nky1 z_@WCRJgi_o?t2iS0U?D8iQ+U?EkqzqxOspY%qr2(@b3d85K!Ub0VrlW6uTH_<_Kqu z#>=hWYG1z(oaQdOqL>go)`8ZdlevY-U$hKTGSs3^_35PA1u%9D*cGR4lMc{|yJ4c^ z_C^@^r$BheBHC<%=fS6o6Oo@LKm}rv*f0dP1q#8%}-F{*~p>{Y&lUIpiNzf%U&p1pvc;8gZPiWdH-p;MNDqQ>`J2^kEyC zkeM|!(__er3y`(dr7x1O82;mN&Qm)N*6exEajNq$SiNgX`hxJ?sfub^P#OE;k0nrs z5a&iIgHLR_@s@Z-lcfl@@4Twv$~XW4Po-vSWv7-v)33UE*Zi{NZ9`>(&v0;cV~}Vh z?#|i%gqyXsOhYUlgy8+Ofa{8mLH+bG6uy5YWX?O2qt_@0)kz_<>SOR{R0xHbVmR`8 zrUi>jlhUz-V;@1-Ymz|Sg(_C=jO&)^Ij72LiBn;6Cug`p91?Bnp_F7XSllwwqyZ5o zBM)Fu3c8%5c>J%%(jv+5IBEskxi&Hn%UEldnuVntW@&Etz z(-;W=048R}{{_0m$i&3)9~OS$4e6z&>VC!Xw5iUVVZ!`IbP`={(h&8ypiwzvGa64L zslyzND|t(F#n{wAQcFk*-AjV78_Ve@kWMCNCLqdcE`{ZvXXQ?h;sd)@bH!5F5TkJX zV-8)TN$kpZs?(J@{s4jEUUl+NMKO4%>nAds05sO0u|k+zBZ zmXOjdA+|;sX}cN{oLQqj>E`?WYVZvXnB`-oI3;@hNh;vA2DedX+4fgzZ3~G>2Zk&d zPBw?vB7JPoi!1uOE-#a}Tg)DC6JE!Kn=f?M`+hmQVC%hSMHI4i&vJX1Pbg2yEgPc; z$ngy)_Te;PQ|ikb_H`|tM3TjenY|rHFKN1?itG+V~Ns1q9tZhXk?djr*GHtJ|&`tw)&u@!}f+{ zNAaF&mGzI#j__u;-}x|$%+R3E4&WZ;Mb)0#!-h~b{@@`c%y93u z!QNoasEsg_PFngR322=y1zme0n;w>SzFIU9STMsZUL+nf>lr6E3s}%jD-LVmZfs_v zB}ptrs*;L;bblh9*(2THF?WsOW?A5&ck^gFGBl9YI9_qmkXb_k;hAfnn_WJM@F(~! z#o0!VWL$-gtFww5_l;@;ePcd~msEO)?5U9MwX}yk5y`xk=;9*H=&s0{hX+eQZIia7 zCbFpLxhbM(esiw5g5LT(BeHl<&EmaSoFD`!J$6#d$V}>&Wuq@ANks~*Sl%v0kzUQn ztk(Zvfw>!7E`+hp%t)R~uKfxDAE^ZP<&ynmkq#k?#mu zDuKpO`s4FjmvC-?kpgQ(mbA)~B{3JSB#}TsdKJtq;abjQEjF^v7cMPGrU+a%S}k-c znUr9o`Aw*pWKOKg#!PsX%{J*YUYQVvt+Hb3JIA5u-98(9OTp>6?|92G!J=yz$}fmb zUNY1-w^t@kiYh&NvOhrb+9ySiMV(}>NR&0FXdeero;K;G+=ki`G0T&MX7X5kLdOu# znxtCnh{UwF_^pVSp9?ep_9%n^`s__lYgWxrB z-Bl*dMC4$MOy4B70q17|X9`0V(?*4ie)rV16QfAnb-dY101hPGG--QOsCO!9rI6x* z-R}B82f=-jtL&3XaTa9mm;-0CX(%EH2y{`_xiyZhj14_H1V^ia(Xk%7iA=jk@xG&? z!zx&#a`7F~8JqN!WV@&0p!pl#fs^rSmRh&H!$;sMMs)thh^DMg08>UT|nb4O4feUItvaiVrIYqO`_Bf>DrX ze7-XWL+#vY`G#+T=JC1YpI60?}k|@RL1|rp>6F4;5q!S^P68gCpw8na-3PAP= zcd^SDWc*ZBOLZo~DW|7)yf)&*rh3>tDxR|zZYIa|420}6=xtTe?E>meNA`;8D4#V#Yzo*HgHJd?os%z z#N~Fm{+sDH4pUeVygE9y0(6lMJo9?^`hnz|9~oiR5c_IJlv7C+531*sGG*Pm4;=Ga za>1xFRcC|z$ztunJ<2%cXjDQ9$qGRTy|}#~#lj?06_~i@4sqgVSwpR+@{Qw6UHsvxGl-BxEJfTdlnv>IyEn+N-Y_W7y7u0DJ=g`i8vl2QvY{9 zW_2D^cw`ucp}>GHZ35jSn5fy3Ghx93!je;7gP=5ST6IIv(-ZX%D+QCmMod&DeI@CV z(c)36R$OS#JsrzLOx<+K*&&S0pY@jL3!xS6?IyHAtzM>R-KGvSku1tKvdWW7a`3xNmg-k-ZdU5HPvwSNWR)~H84*msN& z&e}>C4OH3zh~8R8hdK7jcXJfeZOSug0aOq|!lLc5-Fz@8MV36g zidtAs;~Q4Y%nKg-Ta((UsIV~0DqqL$#7?(ktJOZE(`Bl3*i@l$p^#`gyIJ)8J)r=6Ws4+DTd5% zAQ>2NKUe`cKdtoHVV2Wd0=1TZm?0q?$Whscm0PcYlv%Sea*yR+z{Ci0Vc><>n7HAr zjvk)>U>H0!>S4}E_y(|&`FU=@eg<-G^7Vp#JB&XmI}CcscMH&F_(u`^ZydTXoINiF z)BIED0dV$R7*45ogSo_+^glPg<2IYZxFvQMC4g+@`)h;5Fc#f4+jQU#f5jI}lo9lE z^xBsOJ0b;eF)7L3u<`CTK-D2OmlFtf!#Xhst|`Y7X3Fyi+o82s0`51*w%A|Slw$L? z^88^w;29JI-P)m;0=d2lt%I#k!F0C2V2gH(f?>XL{i{$!99G}Io@FZX2VYkY2vgTs z%?(`(izB@KF&Ds+a#k&z^qe)gSvL2stsb~^hiM?|D%dpF!4?-S?6EOwAF?wI((XY`v;ou(kKtf9=HM265KSVjA22!~X42f)V z^e43yY6E0GLcX5W7q|(Fv(-AVmV=g1&6d0%@wrn*G&(HMd|B^F86$l6W+=Fr?D~jp za8Dv`=J?^cN2`8Itc3h>t>NYKW@=+*Mz1~|qjH%SGc>N-!9b&-BDWqh1$*`KiFymBME6@yrFO2-u)>6dw3I| zjA@=$TApqe2J!UJb#y!f4la{qgO4jcsD$6=buXF7NMel(+3v?cGB3(BDC?=@4)XdYf8zf9p3*HuH^n(@zREUg3 zoFV9dp?qj6sU&**hVJv4b@h7}KifTP&amk;s0vElw=QI5?58f2ocvfwYoWeSDG65L z3aSa<)FdKMkUu9RqdFEXU4`#%Go5h=ScFV;y ze8gs*(J$TWAirMJ2MeTo0u^ZCb8pDDkMI4~8dOlE-(hAzbj-Y);T@9wzu>Y>7v zxr;ZtHmHzF9nlGU2Xcgy=uThen+WzS7W_E6xC)FSgd88#BZvGaS^k%3$Fo02La$1_O6 z{FK%dk)I~ox^h1FzP58~7zJZe6=&sVf~AN)5{G|}dv;;vbv#;+9iqv_sj(AKJ38ac z^$y+r+zWrKWGyY7`Bw5>x0cWKz={?|fhHiHPdJ(R4_bIWL)3&lHV{YBQlEd|iUnJo zgLY|AU>`1r(_UOW$xhnk;Y~S0LH22-O`cR)URhnYmSYvqc5Q3TrNv9>GHi%?Dbd#A z%96*RqCAT#672x}@Q5-x{qwYVG&npy>(frZFtEKC7b(+ps>3H~oEKt+?V1y;mQsNgXEr`9G8e9W zFcN7>SUWwJn}_Z|ob$EG6VJlh#>V$4s|g&xz!QDbd2V}K`hK9VAcjZmco*1X$aB1g z8DrNfbxdyz;Hm{*up%=lBDiSDuzr3;4J<#> z1oWZ(Udy0I_mDI|lc*tn&Zv&}u9kdJ?ZajCw2}FJM)cQ>P|D<0Y$dNH_y!-B%@Yd> z8tb!-uA9%!?MB|KzyIs>#`Mcv9~Ki~$Hd}}``)EaCE)~{!n)rMS)x^;5UevISr%Ko zjw)h=Ejx`Cvx+imKW!zYYNCS+K%3sjy*A4Wm!${SAYYm)zW*Fi#5$@g;ATo zYcf<~Ww<bC;ff&hO-U@9j(+5Rylmr<+|r8 z(db99-a5~!j@jBOM-z)`^jnAG%b;j9{d>)8sKffvrV-`j(_8C=b|`<&7p@&CXrEq* z(SdfJ;7}BFl)wVXw0WA;{f-bgibx`!y$Xy@ZIPQVh3w?50-a8Qu$8VcgGp!HEi2S*mhgY8rf{NTkqB9qsq)2JNg}#b@F`8mE43vE7 z6uwAUxZon+lh#Bs&Q{P=vO(c}n75 z*IEH+@`e0V^>Tq(kWFYX%o4rR%Pi`NujEo&LZ@;-9&h`(rI^d&VsZnTO`UTlMo#M4 z2>iN{GmI;#Xg-^8F0Vpg*IH22x)?cqX}PQBj_e;O*k^rIC8T&zt|}|knYLLKtfO+5 z!Lwxx@eXC{B3EetmOBj`6Y3i9M&A))&jYQHjo@4-#b%DZ87*?s%AT?3y6Rlt4Ijz1 zso=Wg+#7Bjj(K`eiQ9ElyrQzz$7)TsY&C317~lJc?A2I@Rph`TkDou^TJQm$A3W#A zf%s1(35XUwaKa1(l6-8-4--s>PWS+fKy&29-)lkg^0#7m&s(O4!vzPS72U~Uq%Iq{*Go--tFN~`m)Sxb^L4mYtRS7(NOEu zR6yrtY9kAwE%d=%V}H;u$G!*>zTyNl>_smU6nP94>)4u_S5pxfFLmQLpyKqO8Mi)& zj}Uc^D3li8q)jCzbYxJmo`Y!Ab}bXnz%ODe>h)Ob2d%ZA;1R(9!hkVdb@EwF(UUH4BANFf)9!#miu$%eE*EFp-8_>@sR)h@7kv zZ_ufdd!A<^=SGSmfjXYyY#toY= z`4Z$VY;3qz;t7N~NJ-q^qpOfi9ykq<*KFB4kdw^sRH{os3qH$K(6JSM3szX;r$n*D zq-olJU3a(UdBCnXjyNzbdQMED&!mTY&C17s5V>6d(E44o5F|Mf^dqC#&%@#)v*Z{_ z4vr#v<2$m}M?e>l&yDoim24(R)ZMNMa)-C8ZS9($U{a?>MA$euXR!${E?MJn=g^Bv z{1_Q1(;Mu?g{Ge|Q#7CMX6SAaTONCN?Hd=!TtFgzjYZTqaR;+|fEQ=Zd7O4Xjl)yjL{Myw)pVXk;9$`~$8q_tq_Mmez^ULQn0iSb~ z(92@ySoheX&~v+bFlU;3B1bYfyH?SPxS^FNQ2Ez)eXhI&;{0ss`i!{f2M-Wp zN40}?C+^rXFZJ7(S-Um&6k#UJJ1fSsCjGqQ2V1aP3LYbd6HbIX#CrKU9`pLp<*3nb z-@-9e41pzR_#J9IEC#HYLONB!34}h`qaF_o6HdkP=QIF`dMNBEhSIR zo3m@4lBP#-o14U0Ny^Ge%1KEYsMCyWj6V5$^I~S*v#cbWIro%gaKl#=Iz7aYaxEHHEvp9EE8sekAV|#^cq5#LD$3ZqxQ?Sy3|f ze|$)$@4e9I>^`-nl+zUVzxT#lzpc8mj$RP<|D0DtJ;Yxy8cDXia_H4V!iiTPcFtu!V6!FMAl%P|^D|ELLfK59#+4(5cxUZ>*7> z-K{hTdSmm3-=87|Zw$wV=CoJe+3#amEF#pgM@~1NR9bhp@~u=?T{919tRYMeSEv${ z)^#U=f1I05!K=2w&3*NDW50}2BXX$$%gezJ8TlY?6KHrwnA727WTppN|3o}bgHwWYG_X>Bhe};l{pRG*x0P8 z&tcetZi$l?EQcOfb_bF5YqoG<4pt?X2Hu(|;_PGQj&8vmHa;vpT}qu%9j<8mItOIq zN8yOq2Y#6L755U9AJtToAnuS|LtX%yzM$SoOy1fRvBYh8yy zlCZIECtJUwA1`I1_`oGQnUb*_ylz5OpxRvllbi&L>YefnJn4##y<2WxReeSEK4@YE z)*IGK+f&5h)Wej7RDC`5UGkiruHz^GG6G1Hb~ho6j_0-?z{1)sJ$AF7D7O=0xCur7 ziK+R1)57*`gspnYR#Qt-clcfZ@dN(5)~{*3(?uC(k`JN&tNzE)T;Hok6v@fSahM$h znYa8_Ld$AO6$?i1*Sv3*cy0~{4O@Q`yN&xzqlN^DXs6(3e4jn!eWftvy1MkV+gou= zYEX0tGzY3cvttZECpIP>PQ9`HN$V7@mRT)KG8|tCl-sLO1{ds%gKs+M8 z*S~v0=N&(?BvsustE2`b13lkA4&kAzfSkYlYb_ZbBQPvyfn_jqTyH99DBItu zAbkQyJ9J8Vy8=FTvz|8Ho$4Df6SFt!z#1w3PVJLx;fwH=rlHkhDf7r8`9wZK*xKgd zZB9LvcW5uJT30mHw90s%DYWbDUL0t&$M^z*To~awxI`@YGfF*+wWwKUAd-Ygb+=16 z&*n%aCx@f}mZPIK;zdf|p&ljkjnGUTk7tu7El{5MlSv(;dqPzhmG&f*&gGq@l4t5f zNHy=jExQ;u{kAoscr*3+vrN1YmM-h_uMMs%FRz;&ld$-- ztEABww`jg;ZCofiNE+?$%qEib?xaS4`xFuu-o5{$F$U|~)le_D}jq)Y#hZtNtK>J%%MgRs!#q3TOv}4_7DMm z5m*AF!6JiPa04?({0qKy^NTa?(kec(_`{BJltAK5bua*Idm%QDN#0Lk1~;Nzi!P({ z57Ah+y7tAre&Zg*>$NBl9&U)-W1mcQ8SNG{g0~z`Ht>S*!p&eu#^dqNjB0n;lm(|1 zg9xf`D84EV6Gp=x)P4bm!2x(5SE#dl7H@NhjHxcS`$p3rp2}=tOJ|QmoHn7qBDx>? zelh7!**xtj8@&qM-OLyiu%Hsw_@3`K5Q%)GGsPT%s(&SWp@OraIU4lb)SytS&COO_ik_3<@k8bMB6Y!__RktXu82 zSnQ4j^4gk6ST<&*Ym2pqBfV%dcEK+#@Q=@|Zj{7=qkaTQUw{3F@V4-;VYX}APL`!nQ`3FPZnc+R#34zW@1L`$$s=-G z$wuZKrLB4tjB}ihmX6+cd`tYA+9%Os_Tu)16U{Z8cu}Z7^G>;!|;r*2t(6 zCF=xFs=H6sy$X`m?VYlCh_qrJL z7Nev0`XJa{c)&1Szw?C{_Z^yfKwcg`FAl7z0=0N48(yX-j zG|fx(FW|xoYR$((EM?>d!37Rf9 z%*lqCX_Gk2yxAlhW@ct)rVTT*!_3Ug%*@QpoLs(>PWtce*XcB_QcqX8r|lkFc2~Vu zD3Qu4n2vZSxI8m+Egic3D|mA1=!_gG{NB}0l#vIR6*>xQiYlGgiIpxJ_NTqNMmvVu z9F0z*%FdT3n=9FiZZPjJbe0B`BPQeTB08l4nq+rQCCYjR3r0s8!w7Zi64Yi&W7f&R z$r~1dho%PeXFsKoa18`4FhBkHnhLwfWVo(lMc6Y|79CC-p`5Q9vKH{R_G)zg;D{R3 zR<2s~vPBwq*6XG+oN0vD%8QHRj^ZQ~&k2yQ#5w8LI7X!6%k7T(OEkLHZd8{zxLBAN zl^5!HtSy2$&6FCBWr~Wa*?GIQ(JCvI)gmO^^U+t$}v zmxpyW)KVy`;n9czJUjBy5clla50h2ywx(i9hVQj5QH}E1R|d|Jx`@u-A~lo5ROREh zd&g}a;CmYj|89^cm~wn?Dn^WR_lWx!muQ`d3>G z?ON=M?3)e${8PHriJ)}1HoKJbSx$bubZXSm>(N_c#^h-l~sYa8sI7c{5i`%4u^y z^e1$O=nWshT1z>SN_o$8A;qqIZ1<9X&4@x`SIci!(+A1cnATI!XM6GoP<5_?I*b1b z>X5FkTOGIW>?|JJ6_Dfp`g!hcm@1m`0nUgQ-OniYOL-K20Z)gfQZo!McPoK>E$^?6 zn45Pwk^Ig|@pyeN03!4@W*)t&%;5B`sJ3!&6jmn(?-o9B0UfDnU~yiN9rG)Tyh2`H zKs#SfJ^YwT^dHPGN1A9^KPwnE!;fV+rNXA&E$#ItnTCPZ0c3S*Ph2_kc0;oI%HFEM z$SkOUuY$?W&dG}jC#Q*IW1W_>N)_Y1xh)>o?Q~{OON2qLh8knO#(-qJaZKU`uQiR+ zQ}ssw-h$_Gb|k#_Lr37;wn0x!MvbuZVdGaoO8*t(^TLCL^xe^5k3&_K+B5K_`kCLC z=9V{YlwR(OSLqJoo^m{xv!FbBC!<%GDTr4*dAjD=K@SQW`Be=4b}2+QVlC*c!qo>D zF)hAch1yh&Y4vxVf9M1HvS_+X%;U0$SpaQa;2r@sbRa7h zWm=&1cq|`l3T2wQFg;Y_I+i2{;ez12085*38+4Yuuv>%s5;kgUU~t+c?}|P&xf5Ye zU9?S?oNY!DwD=M44@7mk9A@DJ5VgGYl$OHn;fwRiKlS^wwpb#?ZKGIZy12!G(B?_%&`NGpij zuMN*-<|)|Cx3?kz_GN_W2b=BcJv!YYx>=?w|PaB!1S6xq@ zgHjWtlX!HO?FMXjOO$n1?u7g#I0&?_dgtGc#^0W0L&@}2DI0c=@$b^J_H^nY1I93_ z6tvOm-qsfln+6{_7rqx^8zx)UU8X(*a+e(2qTHY9d$>_$Em7-2m(N$ntuKQQ9v=A5 z_}Y{XTbXZ{TYYCU><*mK>&>5K+LhgrXM;|At#%vDnroWTt=bc3lO9A@MVILtm^}YX zp03VYmmFs9I6rO|J5DU_*;^6arjS215c^Q~LG(%6#1N5X)wYB$Mc$I}*?K?YO#L@8}^k##{B$vn~q+_0!@2CBpiLSeC_B2d2!c z!xO^caDXDaag))w*Ts+?qOmMRJ=*&5_br}eWW1F<-rZ9cw!R4xThrS_*zCuxu;0Ps zNrx0PY)3BSS!-FNaX;-V=Jvv#gn$Sa)9T;jgCeY|WE+D+-?JPT^qJQMOJzxAT^2Q* zOMpxt?xVv@_LzpB6sVnbMmN&7U(QW&cj$~Tx&!Re2!f<|B-Oc4S_9&Yt0#fEl#k}#iBZNe%aBJ*{n9%!WOZl&f>lA(q)BkUYF*? z#q_(~hR-F%jqRX0qYHI1V{W+p`>hG-*~Hj&{UX-s9HoChfoB+f~p*fHM5S zj_`<5G?&xE*A0PlPKj)i2ni*c=^*OwZ#Z6Zhe6^rS;WF22@7nkB*`Bxc{TspI^lqB z%0OH-`ybWFN|V4VOA~F*mgOm3#NAVnhA+J!s}*-z!v-1Uc|C2`FiIF#GAdU zoYjTnyjV0-7wi3?$FU^U-~stw8G}qxoO2?nOchqF)`!>cg+bYbL~xG9xk`W}Eo?_J zWzZje!^Al!7HR)d@b4g-V$bj4vmbBL^8d&md0N83BLeBl?-8gSAe`C$dGj1?#^89? zCE`y?w&U}!$M~}8v&x*|eetUlvd`w@`x4%`)n*LuY_i!s*K6I#2tiwr1arF2RvheUMU z?H={Zgk|-9;8_sQ*(`Iv1$6}5CJ$x~ZRyEVbbhI?Vm-7!!+&b;cx7R90lXon^LClL zU-5K4LgDLv9y{(mn4TFp;;e8F!lv0s)X%u9m1!2?hFh5Q&<#w-FSyQOtZ zUOJuDQ<&L3Qw|q3d>s#Nh+aW`$w?=I4Ims)6DGfp)Y^H$(s?FICI$JYN>N0mnl&$*6Sb5OFIPp6UG}gr+{Rlk8nwvF;CkEY~JR+W`}yUHQS;}3AaptX zXVANWj(SzLaH+%|SV)G1seMif^>OB!MbAnQ7bhG_hM3uX$26oc5gfvgU_OM|cJ~BB zUJ=0ltqs!?s6*uYQA0E|#5(N#AF033V014?Joa@Tajz+ST>=;`7UQk&@jx@&$JGRJ zdaQ6=FNEJ9f3NJ_%RS^XF^dmu_&#;ArwC4N+w1@dgIOX>+*ZoprrCxL_&`?-<-_3m={dW3DlSA zPw|}gG}n(YQdoJTP5YRrnuVMZMoe^O+dnfUNky7P7|o<@Kb4}K+$e{MO5w1T`9|&P zsF3LMx_O)m0-b0^)qu2FE+Yh#c2^=-EQZ|u9!c-sX;W*$Z1%2*II$|GM;xY18wA3* zbC-6~WnpXj7$3L{-mVaoUFsrjFA5E-@b`IZT8U9B>B1VAdgy~hslUq^ZLW6J)3SDP=` z>@%Zc<6rLZ(EDU*-E@{y9JTTdHsrlduvoSSJ2VA5UUIYU-AGyjIdzzbjv8h|frjvY4sS81q;v*^Nb2_0Br*Zq9o1TA}7CFU&z#YCn`? z?t(;LNDF3O|5#;xr*;^>U3g|_8epujI^bEVSXaq$@l=Da$gekFK%^c&S}3;*iC&$$ zi%J9WczG>5I$LXAv{qBjk-FA&0(#6p*d+~JeN$xKiM}dzjNJu|=iN?!IlS!in?jYy zii=wm(3NPE#zk`OuXhNR((2i0CUZ6f* z*7J^!GcYOw979PQTPm1^ zTW6ODG;uv{N?&sz%Bx^sB)?1Kx|H#HUL&%Kft=Z@w76ac(zW<5LE4n=;KE1X>!4i<=NX6%-}Xxs|IJ@7OpyPiOq zbYwRY)C|;fm#Y<`qH+JO(+Hn^M90o&++!Bgb^4Kh)7yMGePXzSTNRJ1e*aEu<>$1C zw`jkDD(TV<5xjmCzoe>LV9lfUI-*VMq-9oCSXgJ_aBvmgP?a3*!_F9kZ$XRK^w@M{ z!|n|JUmsoR_#niFA4azYHzRK1TN&aC4?ZjIj+rT~@rzHfb-^x{=N4p~`M@UE$3Dr4= zLvHBAxTnk2e3xpOS%<6}I=#u}HI7jG`VCd15ID}L+cC$R%X-JJ_TTRG*v`0OHdkK| zngKokEk=&z{|h7cf1wouzR?P&5#{~=En4BfAjkd}THzb3z{dLjKr67Z|L-Wg3r!DM z%_X<5O9K}-Ky+XrgtGu99T7nrwBK)4p89h-A{dyTqN9~oVr@JD`_Q38fUzW$r&-A_QEvR`wMobIh%|}}oLBCn%s>b~ z0OgJ3+IdHdhtHAc*30Hm+mpDxC`qnlYdV@a9^T5lW3t5;nXz^+IzBgV*~LfD6Eew& zf7#9O{r>!M;kZZ0{)W)X;n%i;UkaJbcsxjvj^TN~{A%%%|6Mw(T}gk~{v5n*(wCyg+*e*5ej~ ze$E?63_F6vEF}~^af=$BT%ZHc)?Tld)My8EQFVm3@J3K~O`Ld`a!(qYD_bY{5b+X; zHFwc&2!1t``(`$f@-&^I=0aayu+BihNsBp!roBA|U=9+zAQhC^P>EXBVSz6lRvc?`GTUq-o$CT;Q=gZ+lMxNwd z-rD<d|`;B#(~WNeplNq^Zgr6vS`< z)ig6Gt3j4KAZ4wp=ugEs8}awAjUg~Os23-f5pymgBF7eu87I$(VSZHBVje$Ih{RfG ztQu+v9tRP3ekx^*(fJA22tM&)i0*I}Yp>b#yTXql4+dlYtEiCc&zZrUXo8Su_;3|} z2y-QPzLkH1dVPgZ5iGpE@Va92CaP}D$S_ts*0>0!5yR_F>4$YXq`a%l#;T{I0`TSz zt9XtBxU@#ZH36>(gVkpOiaDou* z+hb%w9Dm}Vib<1v4_0F8Bx0s|h5TkIC?YV)*M)b#=IA4GzG>2MJY62|The6uwP&=450{EhpN zBg`G-CTxi;`ADbMy6Ev#h6H29NiF{H?=jzYe0cPIkRIl@;oZG>Zk|LcXxsX5WF}*> zcTRU~1m{kj5ZV?a zJiqEYA2qCq@8yu|jB;mv-)TKUxlz$eF?&Yi+U7u(PF zgaro$fJ#s2tFEUi+wjO<-7yg8n6h=-Lutb#-aOYnkNn2+?naiKUp@}fo?qS! zR-AutSFSC0jN{4}JRxkla#C5L1&g?5tZKcLtR zl9_8W*`F>wph{~oXc>7^ys035u`DZrd@XAQ`+9^YF>FojXI*h_2U#}Z$3B%ZO{XtCOR zSaQwzsfp-xVs%3+4|3Ole&Y*fu@*gnVsVG9(ScBjm^JgLSN`jqv05h>O-?UyG5et= z$#?n^n0_|*HZ9oedYyB&8#+%R1|covitDbDvjdtQ=Bz%jvg-_smD=+f+5)LH$8|_l z=S7~rs5{DB?oQNGfi1VF@b1xfq%@J+GF7&a6esHIv;(H1riK*sNVS&Atok{4wWkdaW#y#q(8$zMpCQk zPFw#)KPav`ZAtTSx>(pg^}w0QeHTpTPz$BD;iO4%Z;v?g9--FUa|n}$u~4+P8Gam9 zG!Fz72A=&vW~H+bmVR7v%15gw*wbncQwY}T!_~41X!l5~2NeaZTbzprhw8`$ETDQa zI*b(qPEBrb+xThSYJ?{|y(!3?lX5m!qYRjHCRNuG?o@XjMa@2GlH=A@X;`XEd9>59 zsgl@(JOQ%vV-AQ-nT(JT)ZdGTgVvDnYhx;KZsdQU4r_Z>;M_c2J*ES6TMd(*{QY8+ zo(446)>U@+)*j!}{Apc*iL@zH57}Ox9m(tKzv-5%?MwV4)URXHEp!SV>^c>Ba1N?E z`i7x8>xRMB_lDsb=F089mq->%bobXTFMX=R5?HDOI|E;64lXvK2-LR(V|`2NB!Ta* zxsl%yCx*HS-x6_i{sYT|2VRna05a-ZC|b0Lv-8&Jf}-r&uv$ac2Bs-nwBYfNoEcdL zF7%JVo5FMAL+pm+L5p67ufe=W12%k_0mq(b-N$H|4gX9Q10s%$CrM#4=Tz5Q$R05G zc4;P4Vk(*!0wO-xhLPb-q=vDq*@+FB!P>PXZZG#qC%uzlu-`T)49~L$#e1%?QJI1~ zB!{ssA+8?D-Lek8?OES;!jzbrt?0ymI}Q|v@c$7c*CXba^a?$vsj}Kx|7eQ(9?|Sg z(R7A{(H!Q`;07d}DP&Kj#%&Gt9LLcd9_nmmALdfNsaT7;k+6DPY-K}v3b7=z7gVyb zSv_=79J0~L+G5pW4uG?EzZMOiE7 zb(NpSRjUN-78U<%&yCfSv~;KUagqiGf%{WOAjOHuRn3$;&fwM3O=6jBP1n!oB;IM7 z4FCcIceeP5erXzhU*BvS9Qk`RD8^Qt%Z&2NT7nqv-r`Nn78oa)u&fzcyqrUATphsikY39nwp#)Rnwk({{f<>gH1N1kC$Di zk{oo6?6q0`u!|tW#AQwKb4-VtagtRwf^d|6Fl$)=cCwD@vAMO?M%vc-G`_|U$Mjqp z+y|zXZo7|~HD);Gg>lcf3lS*AvU0Yp3!b%dYGq+>*PWBF%hJ+I*pq9hx!Iaoe6Io- zI$-?YOu)sOTXdlx_il`YBnB99ubc@t1sW3SgAlxmZp3VM08PYBbs#E!8%G zQ!$v*#{6q-`qA)BmHU%2(wkvoK>lvmh>GsxpLlWD>+|tC7?_=aew3E@2l*x zPC)i3qhb%fM|oVSykyO=kcrukt+v!`kEE0QU+i!c;R)L#U8NCa^g~09UEO<0!&(O= z)PUi!3CSXqlKvoIt1DlVbxGwSO?hKv1y2K_SDtl)wWaySY8)*l2b|6Yp7(QT`)gXO zR)PA!a^tYfz_r&nYuLfC6~bJATV%(Vb!QX9NTDVVU_Q=^y<@a=`plX(4e;c z8vm?Ex}&aH5;vh!>2zzh$s(s{Z+?1Pa_K^(F6_MT4H&if2WhsYS(JGF@W5tlq20Qi zEUTcOAl@64A9&wlb40_mc3|v$r^hv*%DYjkxIt1w*NG{RtUo-1KeGS+pj_D&V#EZ; zLdp5?KHA@?7ifMsQ4@GH!x#a70w(408q^V~bfGlc*6~`n+!IJB+K^LuS{hgs6A!t+ z@AVufXnp%~7UxL(h^8zB z^caf0Sc`VF+^RG2SnBreFfcZCEzC18b~P;|W#O#7I-c<&jVH+r*7f(_WZE;Gnvg{k zPI4}isFwhrMg*kZ-C83zBzn@Q{UlXTC14a8pDsml4vZTPT_IGHVAIkrJglm-?jQ#c zJICPd7neJ#)`lhD?bIsKQ|6h9XqC{=GxM7WR;#+RuTQ7Vl>L&@g0s18y(PkYB0_Aa zALwckmEYG#Kas8G-;P~gD5nh17gao^b1YOVQ7&yrNq5~-)_xlnd>DjWv7G7sVK@*7 z87B0hG?o))UNN+^T+Hf54b~7Vu;p9S>T2O8_`#;*B;$3F-BH?J)4#VSt9dy(JgZ^8 z3dN3QHR`bFHcDe(N8RMk4r#vZ{n)#?bim2Ot~t`c+*a#cdyaCzeO?Jjeu1x{d%$(* zqF9=!%2QC7=~GY$Ui*{N*qBN1)>4$|eVAI5#f8~?)&n(_>2=-HrV1>*zQeh1HLL6D z$%N4gj2pL~%r#Z_)ujp+wr4n_aFJU0o0*(Mx1yMA>JSowP~4JD;jUvN^8M{RC+i?+ zvM)N7>KE6zD1(+<3XDO+hFTvtu3Z;;Su^O*C?i ztw+A!f^IanBYhb?xw=W6TsA&-w6%`1C%VJsUwoa|vL;wZ);mY7YK&>{cJ}D%CNpo5 zvOak&Woi*#o`kY8`m|!w&k3gq@JUR&_s?yW*B=b|*q>hhT71|g(P}!ol-HtnItw)^ zk7FI)-T_8^5vBKTN**75ENx6(dALk^T|f736=W!O4sD4U-nc-QKizc|iM}x%ugyxQ z$($YZ%@XqmJXPq_de=NJioBe`yilHd?F+gl&>ZFK$lZnAyzOiBTuXdLs8Wd(>9s`Q zBrUH0?weg27Azrk%8#0l<&qaU6~+I*Pqx|wUtMm)Jd|cN89!bPR5l_lpdx4e&w%_| zUgC=dcZ_zQ=^S4)cB67HW#@{eiQEb%r;-^Z%ua=q^Ql}4M^`s5B$E)%r6PQf4pGlt zl+}1c8s!-jR2hctCz}#TdY|9y5&B=}amRCuJnQ7F2<1jXpc36ipks<6_@Ff1BH+qq zDFhhHe>(1?K{ZY&O8)BNt`yKi1OJlG#)H=RIJ(Gf!?$X@TKF+jks-lZ7Lnc>fSSxa z-1@))rP>m}K#ybtZxgy(=5yMqtNl+CApGu%)uoo>k$8xz{NRQwDIC$|LtmBr zw7ThGG=-c_xj`}Ks>zYdP+-+i*xE{Z<6`!55W`OlxOQK&4{Ezn5>>A-R0}Q7_CRUs z`(7iusa-cQm;dN#1a&KyHb%l)<_%ds!2$nbn;C%?DaffucBjrK9Aa`v%*+~tPZrXq z8f(wSKCO?lgD3fJA*)iz9JYbdB$y;aD4PvmqAmZCdbIPaa9saP>1Hz@7r!o&vrvxj zKABH&Qv80U>=MsW?N7#VZ?R7|=KDpuiJ$u)ErujS5tTf#Guv79u3 z+aenn!Qg*4Ft#WdP8&J&z)l;g`=36W z|FpjT=+0MAs(h=WzyDEE-^wJoyI5nY`CG~KvdvcW}()R+uiTGve2C5JpLpx z9|wyR$Giy6J4D zJ3tV+b|T>YD>2^LKSP6;rGt#b3{{QCME`s84omB|^rT&hUH_5W99RST5}PKN1cncY znj60Qq(6OZ)hg>lSMC0sM2we!=sFPX$YDG6=>3M(kf-g>U>dS=x-IM8>OTvbN;b`< zoz*BB-!jZ4L``lx#tNvVd3%D*u7TXzT*#%xZ^A#uRcKr52kRqf#L!M^0O^<-ss(sJgW@rNYo zIb?iGXMT`LG9suWN9sNr+eXd=C+Ko@>uKx(v&~@MjAjvpKkPzlY6G)+E{C z^?bl5uY;S@95u7ys;oLitOcY6j$;#iz*L$*rm@%(s3kTTtm`L1v8_fUkAUrSB%l{0>5 zR7N9T&H)yg2$M-|@mw%sQQK=%*x4Q4q{2}@qo$?XjZBBHS&pQV+C2inm21lGfWrkz zhAZM7V=o+$XIN9qzq~1x=Y1m1E(*VS^#%qoqrWl=>bh+_hQ*|o)<8kaFmQLWy@pb>Qd?B_}m@{YF5vY=EjCpL8$A8iF+eTd+1k( zJd4acT*e#yF?%r98{kdDRB}g6=x7JsJpQ#BxK|vr9(mhpJ(M<76q$CZy zFGFpl;dZnSb`z-WYXiDhQTJ42ObM0*7=r-5r0`oKQQ;#S~>d4vLCsS_pSXMDG9?>Jl(FU)RX zNBV!qD;Dc6ao=%nr7M;N%g8HU9ucX^4<{<^fK^1bZ z3sl;2XLsf6UEHWPYo3%|SWZS;)6bPWpI?<(?@4a5?8V*<5*Nx~=6PHp=WN=Hb5S0@ ztrWN!noy@P;;eW!d z?G(07yXPtzd;n*2s`_U|%H(O#48HaB7u*)4I5t6T(t8)!aFu=;+95z4<&IoM8j`oM z30#(i!K;9oic4QB#x$2OS{lltfZ$J{lsW&J-nO9}wB40D2j$cCDp%vF9L>TyO*sQ; zTk4nr@&;t2x2z;h(mPYzQsgvHXGk=p2hQ$awtM}@p=u!tuZPnMU&OshLUt%Bvo z{j}!_!%21n#$ANupUR`-0!XK`q5^4jNNSCG!~Q7r&E*8sB#Vvo=(G4Hjs0u7lZB|& z-okoRos|-=)tf2{-Bo`BdF4u%5@zo7_|s!8ZAUc#-0Wjn1JK$gY}_cQPiY9*Pj{iZ zAfTRPK8RE)ZOg2YvXBA8DfYhTr)05lVP!^e$tjafY@Fgv()hw245Z($xOvJ zA~Pmb-mjq0e?F@H;zPc6_OKUif<$)Jz&6?T;-X?xLjP|bQ{Xh5=s`HE3)`90BJKh)tFBe!{4g*9_jt0rIbZ8mle$&Wmg-9Wu|U$Nl@Ntl000^L zt^$mB27OcE%W*Am{MxME>Ea(B+{e12#k@Ffq~=y5d!06VrBoYoM0CoFs^t5iMC2pB`qQj z_v=qo6T}lG8aNwGhFVFMD@lf8jS=*g4p7wySi!gk(BKS!pZ1o}{lvtSZ4#j1o!c=0 zz|S~xn4frp9H?FhDJ z+#Sm5LU6DA$5o?u=T;~BtVdhF_50WE3I{Xig@>mKcuq0wt2}Ow;H&-&L9UF6j`gL>@-XZuO1CtX53wqMu* zVcr3*lHfYQ;LwaJ40#N>;cdGOzk({J$1rcfJwf`e@k3gG0s+RC$!6B)f(XNm{8PzB zT~R-Eg5L0;w*)eGFjED=aU(FYy?x~&pLocGghhiApa&MD8Ci4hZ`I=S zQLl;~k{=0}B6|w+DjBWcq(dH2ZCN-az%E0FvkMshz;7|8 zickyH4Cd6wHsSIp%p;hf%nF}Inzu*AS5x=d`+i5+NlQ*|D>;T=ZAaE_Kf~=}s)q%M zedl02#e8#r{XAYgRg3zWsqt&xPReE$n>4_FA9ll+GEtNQ6^7qApRqDSwavL6Vz2+y zFZ29kxxr54ZTnvJ_B`~Qa1a}k{XuJSdUbgp-iH46=hH!#8y2WIXAf-&wMk=zg^#Rb=xvqkwIRbX z*Poo*T7K)$W*As5sDo|+2M6n)1bdxYS)4v&zXticKSRO5%B(X+I|W=V&zHBJTRv2_ zQd-JkX#RDuTd#N;$jGkRss$(82T@gucOQUDicwYz7Nkd=WeYQa@rS$qdDfCE_;iY} zkrg7j^~ahzqY)nB{~EakUR`9pfosu5SF+~S{M#K5k$$^63k#|t`T)xs0zOQG zQ9ItN;OF}rF89--n1A5tj-vz3F-6Rh6m{Z~lr-y&Dh~MZ6J-XMY_v2K^(wE|-SseS zol`t{c8-wNSkkM6i}E1DW{7ZuE>n6!8Pdc!p85n1;(2xBWqR`?TLo!5mnIrCbl=`g z%u4Lu*{^Hib7rI#U&14%&D-USe!ghkIgX$$*GHE<$ww%xDhdQ+ymaO7e5M_&dvHm% z^O2w4xO5g5n;MjA`*>XB2p;A*^yR{w*n4c*fdx#TShPUP3C@HndlIdGx^g;qHWNC& z!9SA9ekRF6tL!3&*s8H5iZ3!C4-yV&|Da~WiCD0<&?K|1Cg@Vv7P^*&|MB>mn4VVQ zTsNsdqjr##D9BY-WPcHz|5oa`?Fz86-<@D~vT+wt|(R-1BVU zWJ{>GP6x5RhQ*`Q;KY)t+R{*JJ~k?ZR~cGatW9_!PS!fA+E^}uP0(RzsC!jfd%djP zTp2aE+h?Mv3}i%!jt0ufxeeO#T&>OiZbNemRiV69I~@zWJm3R)vtY2++~7|6FadNu z?}ov#kzu^|I@?+r8C2kZe;_aN&@E`>aTNl?D0m?4c|hH-m@-v&X<=6|;wl1~?J#)y z=b0c0%Lv0+uFS{6v+vfG3+tp$*hM3yE)UARRU6pIaa+9E=%Y{k^JW_f{D$*L{2*id z-rvRp9epJB_pfVcCnk@Z(T||Q_$d;`p$BVD^bc8kG24kIW2 z4V-`i@&3y7K)1V0Ok-~%?a;27p)H@QJ&0<|Ife9@YCT;ETJ{xGExQY%@hDU9E6G`v z5^wt~tvjfFEv?O$GfF?M#DUg;PX?A$l!wfpCUiPkE%YI03&8y`hk8lT^D4aa7_^T* z#4sC(5Ya5?3Iyb@oKKlxA7b!&?_KX~ASAQUHBa((uaT#2glKSIF>LKGQZ+f(D-L#& z6L2-9QZ78tG^s3FS(|OCkHPET0S0>}pRb`GKv(D|v^3T19@8d>*shssUwKnIcOH6Z zlXtlOiNILgW3&c4d@>o6TI4=c)29=afB%CVXpH;DlxNbOa3CY?H~H;Jts;RW(& zWuKu};L%o}&!9+8P??$Hc9A(nV|tJeS(-hJFv)S=TdKB*KX~h9M?Hi=H})?q&!Qqp zta7-5w}=bcMOcYn6s%<|usWf?8J9MeDwIaT2Ud4y&t*vH3RX-E`YfA;D5&h9Kp&hI zg%oL&!)fu2;Q19W$}LYdp33_G@y8YC-dz&or#2{51F%i$(-uIV=ozLeUu{rFD8CQ% zcDFS2lV4sy6L2;moNSE@o#;lo2q+j7#*Z!DCyteAWTKGxWWK#90p#J1G~FV@NCfkYXdgYb-&@jt`%?w^{ zT#~*9^D;xv-b;B(b54G7&vBI$c1+eZ$9Rb}1ID8@GtGfNfN@TC8NxyTJ`#_TikSoH z(CWTiJF{{9K&+&9^fyNB13BCw5`3t~aKCuhUq+a# zdTl_uU=>5vyQ3{0UIf9_;LMT<9dV+EZk-{RL>+vFb)c_jx1ozg-`82p!AzQzkq|}X zO~mTsy4}2+Y94?+o2B@qxQhX^QqEPB%{fg??~(`ZC7yylYSaXgg}ZeJM; z3J?WLOA71xH{%@hrB zWm_7?oenSqTuR|{f3LgOgBj=yuO0U_59D1(aypdlZ2h}QRIt#@;|mO?i`z*GnDA5o!sy5tZ_CBZB_1BRen|rh3%^xpE&u2--tTpi@%g=V{j47KOTbU{@1El2cY9faO>(3l_ry&55soD)H6Dtldn&yjD z>y}y9f%P1SfMxW9K(im(y_AOsj>iwuLL6&B1U|zH+ZxguK17YW>j@!ALLkUM`ggeL zY%;muJ)xK%gjY55SOs*j8S>y+^KE+Lz&eT{K8F4D)C^_1I~?uCSq#TuNqsB zcdE$Ujd<~?m1$NTye5lk?OuN90tLY>{!WHE%(%)@(w6x=r71tBNhk>nPqg!>mQ66m zr$@vzf05xzkDiL9>-MdHcu2YDu5Rp_EBB0EPEGcOPOLgxny;Vs+Cyp7GQF8@EFxZi zviXGX-=4Gj`4J6k!Z=1jdBS;gXZ#L+BWo<1umJ^1imy88$KbqyT4ookTPX}%f^e22 zpBCLx^R*SKm0iY+<-Z2a(j67coaDI0JY6TU9Oi8H`?T7-Y{xk~Y+fc%}ZB zmIY^FVLTg2GbtI%O(*ELsO~GdV_Z}S<>KKmE=AVv+%i^NV-3n~&lTTm=tPdYT+15g zJ8_`dFC;t4A~L?--6Dbu6lq5}^4+VcrywK^`Rz@=(5SDyhJYeKG`%`%(Wc#N(J7Cj zN~=@zStTC*r}k)5lF45W%sbSx)jLV(++7WulP3;B6fdx|>|Ue9 zMPzC#i17aHU`62FH$d|Xed*|k>8f}Az|P&1_&!jo?KNi}ZpB-wo*tO zsU&2_TVA@AzYuc5_M`XOwySN>nwuecay8s~k40;(Jg=OXp*8&3-E?$v_{Uds5gs(b zF$$(z_N{N8{~Mg>HV4XI=41vD74z?F;(jd;lTC3in1{g3`M~JtwcNc!os!`R-0&Hu zW{76Q`@ydb1S#jsySs1T(mFP)|B|dvf8ddF0)~-~=4}nr3MLd+rz6rQp0e$(z0K_W zkHc_#MRi!XnKsj8-x$gWPVCgtR3Npx^4C4;+)5D~>ev$+_vr;jhcP!Oz zt1$-|db6Yz=mU7ZVGrWN-|@ ztUrRcZt6L9_JJxzULB9=GqvSH_$%@$e$W2(YucS}8kTKrOgNs*8G=$?3q>jA0M=g< zii{b-s>0H)Mp=JeJ?;?5m%mL|PZ?^OB*aJ=rv2kdO_H@W&MozNlyr0MVynfWNUzZ$ z$<57L+T)t2ri$bJ#pRIb_9qX^rWS{d+>?yLQA_jR{dpzuRy?hW)cXG7Y0+`6L^VJ; zPNY;+tB8AjqVsz4%~SL1qvApXb2~;=o@%P4UF8`pg7x`)VL2Fh7L?~?^beg}hA{PI z)%6iqOKcE0lD+pW8hi)XhOvI}ee>}8y1KR^!1TJ34($xhzP`Vh5z1(h#$Wcv`3Fa3 z$+7fSAf3*?se2Y9E(0rs6P%#Xl?!SquaD8i`4DYRd8joNx*(tr)K_K;;v#eT4}sa# zemho}`wlx+M3b$-p3;_<^Sdc(B+8qnIN^R_P3d zgd>6H(F(+tXjXAF@v`n1RGI`AIol2w2gV;c`=QdxB zt#zv&iLhA&Sf$Bt=X)(d_nm}o^$5-rGtv5LADua16ze>tWrK1AJ#drtap5lTtxA@? zT=XeHG18~nU~hDD5u-vNcdXN`@AAZlPhrP)tG$GdQCW>YmaN^6aA*r;Q%D!r`&^RC zsojBG71)8f^;sA|g&#urMg0JB@Ow$dmoAPHaJ2bve?oLmou>q#l+Q22Zwbvlz}1&2 zRA28scdB(k`+#1vBea#K>R@7G{;pwlVo1S^Mr+{uiI~;Khh;5^?_-$Fzi@RMK@peX z7i;_^+s!?Tbw>LkUt7V7VScTF%aQT-cTs=i0SmYEQ;y=lyl^PzL^_@UlsLL8u_X~( zh1T{7;*~Cu*khR}a(UDTh3`KG{W4BX;6h9@FKh16{8w;SYqA9R6%`uk&4)lI9iFV= z(IEYlU_wfZ$hD{Cr7ZVR+c~Kks5qn)!e+wvXCBx+lJ#ECP~;rx=B?i!f>-Yr%~35G z?NVqjj2`~@U*py+Oij2W&oBIY7@nx?eB6>36JdSNUOW8owh$^$H$XkIL zuGrV%`xg^K2Ers4ftb2m4=mvR2m~@-M6y>@jp%*+4T5=g+il`QYutkp5<}dpLlPN> z-)RPPbuDEb6>GpL7?porD%nigx+Nm08Mg&!7$T#N7%k#eb*pFiHkt3}3pKaZ(iL)} zQq&C+yxz4>Nu-ZM<2hbYkI?J73^uGW z@ILnXR|MY_LkD@C{d=@kkxfv^o(9^H?lpdWnBD6Me9Z)YhLL|n)84Dl-M5KpL%&)9 z@v4pW-s{jh{r!F7K1<0zL@-}z>_7US#Z7&jqB3zY2fqRzlL1jsFTqDT!46|tM4R?8 zKv)d){DF74PhTkm+OnLef6t)&GSNEW>KosQfljNvlT7jW(kvMbvFBZ--Y2Ct=3TWV zf=^l2@A?g1POLyv_#jw?1}_c-5umKm<4567FS;W+;l?8R2;6d+spR1Bg{zhpX zf{V$bI$k`ZJ*b7L6|E?*Qn#9=hf!@i03EyX!Bjx2{qtkr@?R!G zO0qy9GW8tJy~e7{o<(V0E%2M2`hUI?N%#DX(>keVMKuJ0@%xU^+FCqUOg1Q-w1?fN zDX53t7+|r1$N3C2Y-GQjacF5sBMnk)X3fvTec6v(aVR_#YS1qUkHtcRAD??e?~QU(xi@;;?v7^jK%N4*y#StGa$!44M{Z6Yp(amW zxU_U~iqScyF`a7z$oDd)C*dE+4Snl0Q{MIbz~76yVF3(9suvi9yG<7192TMJS&hMb zJFa_n56*9&OIE8sA2^k=ZXv(#OIv=C!@bIQFfqLnR}w~eFDQ(&VdLYOnd8QeIyToG zMYQM6WHv9!iy4V#wrzXN;Mmykz9)g$O#2T}uDLD_9`D0u*BxciA6Vf%ckt;}(2fNK z!`bGi%NTl|!89FK++cdG=(7?*664M5dLErVVDQhaM_%xPg$T<(DLbd;Xa$^%?d<&7 zA5hsm!DT-}j<-Rla)Mj5!my+57^gg6Ah>z&$nE52Ev4s=qHOTD4j)|+GvsC&VrM>& zTERa(@2_*UbGqTPP9Au4b?xJ5FdKg-q^epHk+PaW=3k|J&On_B-*p2>85{iWtz}3w z3u&Y#bO=kOOq8J9i*58?8zTHyuIk@Rs8YmmwG=?#D0#n_N5b@oKB3>EKFzD<(k_3W z4f)RM@JD{5+u_fcX^Z1WLsChgMLBEPKfO&GSFPCAQ58ef=u|e2eUrxJs2+8)79EF2 zW_?``QPE0cqJFUj=&UHW<`mnos>4HlIoi&h1$Jm{4!6ba0cvVxI2zjX?)o&&|&L9()j{Oys)k6Kd zhN}a7baXN}POw9YfckcsVwdGe%gF1yo-zu?LmOobDqdda+aAyQK6}KO1)T-8#h8PO ztK8@CC>hDRL(f=^2(FJW3jXp%ba9&_`C+^+jUX})ByGGBoC)7RcloP-utgaPGY5Si zzD0tZq3o$@fhHxx)Gkg2hrz?B7E+*2givScF@Q#g6wbO=9~FEM&qKFb=N-_bu6rKs z0RvdC9PWl@P)uVBA9n3fo=8c>R8b@lq(u{d7XlWdNVu1!Y|R0%RJM%eQCyj=g842O zqG*Be0NAi8Po#on;rj*l#jxhU9LP)nwwoGdjJEsQ@D!9DLNDOM(K>r!q+NCSm_%>( zaB2?=(lxZ_Loz_RSWmH_Fd*JU)h(n+lMH29(4ow|b5I_xaRppCh%2ByRPp3mE-Ft_ zCT^~DZ?8p=V4t47?b}MOG+*FUsf{L+*gl)lWQhW21#zedJ|2fTkV1Nl+1xXsw|gqB z-VD{r8XZImRx4LaT@5LswG`Sks&hD9ZOAYN3=)*WQ+GzMnYW)@&~uxT}p zE+EzYKHBv?+Dks=L&?wkG;|8Dv$N^-J~!9X)8iwQ6t+^u!NTG3naSE(TZR=gJh~8D zltP)J8GU{eOI5Bz3VWY8a#Kl0R&#dMWoUR%anpB~Ppf5%i`C&WnJP5MPBv0mxk^%e z5dpVu@Avzcf30OkaJ9+IH}n)>ms)6>zdqIQRGjXuE`Vg2pyd$qd=(l;Zc9z}Uj61O z;nz|{uIF}OAI)b8Rdqu-Huevj*n*%}Bi|Z|H6G3VMq#F8!tl8zRI|<;*WLPa`OsQT zXnk~-GZ~A|tnp&ITUADPPis;6<2YpZHT>|z)0AC-tzBD7vEicqmbtu%-z9A7ENpF0 zTf4((z)t`)7?5k0Zs);FBl*p@^yS#;O6x2u*BLv!zQ--In!l>JEn%+fL8=TRB|9IGQFH6yV>E|smc?XgIgtWP`(qh zDcgtd_b>SLtOS1!=#X?Lc@%Gpa1GdI$O|?3or5CJ{Who5ALLWVQO=+gKo zL?U=*uy4|_NSDV~M%xXx2f83Lt9(xbZ)`_q1B_phqk%95l-9pQXUqq^K;-xWDgbx` zFL4Pecfj7)A)a7M4rOsjYxX?Qe!&NCvtvQKfZF&41al~1WrIMgj-t^-YmwIaW(Lm7 z-t_HE!wj)oeiQf!gdd}~yL%rWJb(>?kQ#y~=zigl1jQ6dj0*{<`x83rk`MOZg0FL)Hq#QBG zeP6_HmwW}XW%=5y{Lccg{4xJd%4dH4@L}@!OZGpKpV`KIGd#V>tiG1%wf#HKSWNqo z$e+U6v62`pzl3UL7Ea513VtJtdjU%@?0Cyc*3J~!0>zB_H3ujq*EYH*pI{~z_~H( z6P>ZIQofLW%)h2Ta&My`U;>r;oqJUM)PiaD!tV0!!X(HxXg(@Wd4^%`{9Qs{-U;Pp z&1V$_rKExqoyMI5dpB9!l3=sYOs$zv8N6>%x5$NrAjyXtJ;+Y{@hDm|48 zbkwnO6oeG06(_%w3x0u)wVDOG#k~Ij{U1qzcawWDtRB&lc}p6sII4H=?5G9PBHdMH8Jzyce)#Ff_{~Eh1%GKkP5^$V)=Ze z9n`BMWm-?%7L(F*dW0`W|5`;NN8ibOL3;r$S(j9OF)IY&e53V5KPTRrzeIgOpNjS) zg7ju?gB=_`SO#kY5%Wx4!92MD!Ezv9i&px|sC*Oi_E!7NZ^qLSfQRKVsl*`7L!8_g zQNmQgWD0G}p{D2PW!MUIh)$m@hAmSL6IhNkzzYlb|co00oZ7B{wY_%Kw0#>_cz8Ia`9)q^~Uo^6V>Z$V}M z;WtIpoZMSS^LGZDA|*E6_oOT40FzU49y(uWNIvEGI|TR*=id=D;TdYU0oaDa;OLr> zdO|TRd~sxpaT5;rCj(y4Dsjhwp;gch#q{QHd>cnmcdlYxieYwPAu;G5O-fuX%Ac04 z@HBn8`2#el{ikbVbWZq@X@9k~^h4))IxtGNPJOz4R|T}JeM#fS6it-@=2H6)yhKuhGKVgRwuS4j*3poH?GE^8*<7W7)^oA&M{9N zvYZ@%q%nK0Cq$0hqBHr> zE4aFEn3N5Ilrc$jSOJf6jH=aDIrM zIDL7Vs8g?|WlFa)_;{nP#-B?!65bc&{8=aDa+5>qz7Z!4_Do9VQBH0Sl`6tu3pFY$h2ROootrp~cQ5n_v2-1@nNMTcW8pOo*XC zqQTNg4OfSw;^BU-aA7Hi zTR7S=_*j>Yjw>|;rO-9~ap{=ppsEZ0KrrFpCVM=4U^e;?(h3gByvW3SmOBczEt72Rrjx$=fk;SI#sx2sb=8bE{s|OXUBw@;=D&kR%A#9z+%F)T#hK0+!wk=sX z2{dRTwR*}#8^aJwzFO_pF(doxES#CAMDwxqQBH60gc{iegII*@4JJv*wHuV1B%SK* zO+*FX_6kjeFNov-0G{DJa&dEoPw8ND07F1jc)j2-9=I<+)aHP#6ak4qb(?(8r&-%u z%B{OgIcuz_{$0I~_xBmHU?wv72f%|AW)G4cj%uN$j5CjN z_eW?16uylM_E{YP(wW$jz;V*8r83gqd-NpKlPE&0%d3?NiV0JCyly4mkxv>bAK;}I zpY-0(hs()@t44Y}6scYDnp>9VOnWH5U?!Nw7+$P?g>G;2HCErfr7!s1j$;>`rZsKy zKJ)e+KgtotJ6Z`y_+#1>wP(L(;KwmXlc)7Vv83cdiTE`oe+EhPjF2-3kt2Ur5_wTh zHx0U`--BO4-g(x@_r^Yu`8gQ^)%q^?XzekU{5khP_57{&$lAbtf#WFnX~lrFqk8rE z@MDLZo=Q_fa%jyG(uEN7UNy*GNDWSW z-!T0RFg1m+vxYE>VK?;Jon^;d;c;I$(xZPo{`s%L_J3tbXJq+Lj?zm1FRDEk004a% z;D2@Gvi^rI`TsdA8Cd_vvqF?@td&$ScuVnHJ#RJEZ&qlgYPzEt4QlYUUcw^yFru!6 zOd)4EwqCbReRkqbee7mJ_)CEi1}08XR6KOy;I1!jFd^1AQv9>p^GM?m zoj^3iX-Uvv>n$Zx=(fX~DsQWD*`Ng)`^#Ec0DHB7-j1mDoOkj zN~9?_Siijiu6XZ6!a0L|_LM~Cbsww6xmN}5#Wigr4l@!KqNv>L&U#=JiEih;COR=Zb=neR?zcJhaR z_ouO+p60Od))ltRvkN-;Eloq|d`1QyZAQ9~WW|j3^(> z6FxvV1}@5232jBOuog{12hG;7PK6|^ac*EwH(?3Ak1)Y{T#z{kKfH(#+6v=Knj{V# z#E(3&8Z^ZZeZ0k+ZZx8Z5t^Mzojj4eA^uycja+0w8R08Y-1>cD>yoJ6jPSGD-iXKn zrA{w$C_`=dn@DiqyN|tr&;( zoMuP|0po`m>zapQ_V);sLw7Xkr#WPn?vP0;q|S59!K(VhDS}0osSC zfpw`Q2u7#8pG}mAcst^@tdrIIHi5p540sC%U(b_(gT}8ahEHn2Cym)D2M1odpPy@5m`He801@4r#u3ZhNqLZUCv1(PuS zMtakemd5L8eSqjWnUPOg#t5z z@#+OEpx+-9=g2Fhh*(x!!b-i`RSQxiN}sZD-1y+2e0hem0YdDN)S7@DTdt82Wo$Qy z*0^c+=`5xwrIFae&33g9i2i?Ku?Xb~;)u$^%6j+9z(2~X$MwyuXld5xWfEdl1{w## z6Up2eMN9%MTXN#5-suaf#)Uu<2vmqc+s93t{uI@^@XjJcfaSu0c55EDFRABBI`gX!2a-q(!oJPHEwyKM-Kf^YyvMkD~KgTi`E!bwJvMrQHr8g^CWnUDxuYk8y z#^6m>(VLWq1+2Ny8Oui2xOusFpt`e%AD1^+8SeT4pKcQdG(J=wpXXV#B(fz8aIiT! z>#sZgbu_+2HZoiB0J#)37<+-GWX7PX>CVJ}xJ?wM`lh&Xs7?!2FND#jkw*0g9MOEW z(~|T(VD4l8riisIRV{G7W_6G5-p{pw!}mo&1qk*mK(U#Vhx#oEqx_KogQX0-02q>J z47o=?B?w>eWE*iU6N8|8pxs^QPYdy@Qh%~nr2-6z2n5rpjh6#lojK>`?z>;DF@5yQ zJ>s;u^{HxU;q{OqZDP(Q8FnJGf-t~OS+e-*7~F2#`t4^eGFTiOU!Ts4)~+$#(8C57 zMkMrt)`K6uzM=0ZxNpSD6k(l^1|KNfD6kmQ#3KCj;nJZayj4TF}2EYL)J=)FnTQMw(%|AQHJs6to zSs}xC2h2F0IzqcUOw)m=@0shnv6V_8*kc&u2Jh*Q0)JzqDP!ZTcj*6n7gSX>si*aQ z>=jVz3-95dZ^W^?SFk#}E2OQ$aW1NDJ5OFX(0Ux>1gbpH@vVgS?Slcqjs2xIvjG~D%Y$3yl#2 z%b~{b^D9jXX~X~E3?7K%lpdsvs%8CVAR~UI=p_eJUXS32@xr$?1#XvJt4}kO^@{?j z$M8iJ8x?MSPi|!y9ptLjWhCl2-Wz;L*_M&Oh)a?rGO&k<5tz#3w}E@}3mJ(fOiR6; z8I!Tlb$l6M@vme9-ip)6fdy%$9Yz#a_wOA!5+Sf-9RmJqe3Lfc(vp>n&f7U~h}&&4 zf#x>)W;YSD#lmQ_An{W2M3+Lk;jO30W9jg!9wT=y-XH_8JvQX*TN_Q6WK=32($ zV6@YIynzgtbuq%t**=heG}fAoE%OTV3rbS@`HJpUJQ5jmfaC*X7#EDy5d53J24LG$ z=-*0z!=s$MkvHX(n_)+8GhHkj)6+1jGIsnPLVHoqtmHv?)!|b`lSz{(Iyr&y+n$#c zrfv%b{RNI85bYDXEo~VN_kcJjVl-z5L982AzldMGXKH_%kG#_VlA0`1ab8=ugrV5o z;8@;Sk9H`qBSwxiTG)a%Y2aXPIG1UwDtXD&1KePrknC<)38;4=FYTJ)9{%PoP6}+1 zClNH<+ssXO+=$j_S<={A5Vn;c|ofjXVj%x5k_S_^uozC;D*zvmkDqW;t9W zmrSeocZPYy$2&US1NLX;FfLCvTY5Eca;$t3NA6D|xl$>nHuBxG8^EgIH)ytEb#ecg z27+=k3ap7rOz->RRmNeKDsvIIn~8&*n-`yx=gs=(4GeB}rX9})S%~drLQ6o(b!VzQ z%HCuj{_fxd9Xx(^cEGav-QjQB`K8jXO@Br`pBH*N8v<3&8zmDVBq+)jOAq$Fm&k5# zH|nL=YAZB+;^)d7SI6XpQ&)JKHaBuT_K-ue|*CSl27TV zgz^nxTrD*oXWwE3VnHl1;FA*ZmDa!(16)#RO?E_dmG}ikn$6E}Ns_%yY1` zlA6?2gSSh>>)+;Fl!(DHBvo~G2D&Y4X;>{$u-aG49XG6NqzhV_HPnhI8k*S+CK&~cHBQc6NB{A`Dt?9}~ z$Py|*#h61FWPQ7(vvDG%gEvYvMZYerSX&yf!b(X4eI_>QvAz^CIu$%Nugg=5ukQMd ztzi7Rs)D`N|L`)lXRLo*zNy5=*$BxLvWvf^8zKwp@s44Ft0rEDeGVE4IB3irAxaHJ z5*anQ7A>zRS}QM<;O`OH^yLK_M#=w0WQ~Ev zLci4$i6Eu&VQf39Y7c$5*nWN_Q1cMY-+l7?yxBhCrDM#gb6u{yl=lyNV9tW++6-~5>dCTXA_sI zVzPj!)7ojJRs8So@4EKQ*2c9$qxK)JvFS;MHq-Y&B}?c)P80D7cueA{ugeeajOn#m z9SB3Am=&u&UcGu^tss13GKbz(#vYU9Ocx4o-eO{_3>#O~v)PqsfxK5Pf4RPQsJdUY&Rx4!cJ|LmD>19g3u4puN}cx`H-<5i74t@R zwhfyY6tSBi4p>iM`z3ieixw0rtvaMrPBvD(4@;=I^2|aem5K=kO(LoR1V`~NkLI#9 z^>eK4*}BhfK8JNqnG#8fh=P~Yt8EXeHuOzVO)4GHgi3!n-5DbSvqw>m%2lE6ZPMk7 z{F5rn{&Bn12>dfIpUWfMawjP`9I*V@OwfGC(;M1*cgcpW%Hp29jcOsbVmbdf9ss?Z zS5QFS$q5yODSbnndsMDZTn~A({-tx*wOYVJUKrm^pK>yoB_tR%25?Wh-i8>45T9~w zL;SldW;U3%Pc8@l!%PPi86n^$5Z+km1E|U#0ikIy7R*XJW2UQeyY#0{vKG9$=oPAS z1f|XllK$HC%xDwsc>i5w#B97U6_5#q)9hQ3D6Sh z`dPMiOVA^4?`n{(VwNCun{a2Oh)M#Ky^4Ti;ZI4oSxGTRkAHqz06*B`^Pq2F>hhz9 zxxRj7`_-RI*Xs`3U%Cr?&v3@=e_w!hq=yA8HPDO*`fj!&a```G5oSvV&Z% zkK*d$`Joy{GwUIlQu)y+YZWqNdfGBh;=65{B@Qbjf(1ruiybDdhzm(2x5`2zgTP*c zB#dM#4^(g9P65)3YM0u_6T%-ohi8FrHh{X(s8T~b(2hNPRK?8OA)!((KX6ybAZwV} z*GN6XVBiH{u&OOsS60l+Md6DV;KC-alg<@iVl$^*S#QBj$Mo`myq{S#wQVeXY)9kG z8#}i0UA%05>}fb!M;A{MZC5U=TRf%e%DEhhmb|PrsaP{$*;Fz*_%_;wN^|hjGAf!` zO{li@oz0;umjPb6HHyr1fTM(I^7|#w8`3nXji+v#Uk{z_^h2j+GM`jNByHp@Je5=m z&&yTcuUp;h`I@wzQD?w*O8e-!^C z9upD_pk!ujMlf$AzQUId6OQF&;e^oX7+VQ;svvoX+^7Y`(FZ=B#xbe;rjW|JCm9E?*7jId!6Hf6r{^VpWRRq3u9#=kfae2;# zSNEw0&;#(uArQTEtImUp1XbDm2qYv|{|I`k_u( zUh7&;T7O>x{Fw0*v9khPj9)&-0ep?In>i+|^^bOv<)V49_nK~j+ih#Hroo+BaJQYx zA$N2nUPDxOQ5eG-0A!^l5LxiY(rVK)+6=JS)ZMw)IOeMD$3J|b??TS&fu&C8n{$Hi z;fGsvH&Jhm@J7fVpD(Vzs8YaZNt5>PPxv)RkwFQoo>-BeYr#ed%NoQh#iOX&O1smKpXL{^w zq)-XW=Fz;&Z3CWLkZphu2ycH2%ie%`t;1Y5;Cf5!UWrd}FHeup{vK47m_3kY2H0kp zUyC^#^*k%Pjvr6YQUpqgv{p_n7d%{DE)_hpve~wDde>vy<+^;Ze!F}|!mX{a^K>a~ z;2F=YXjWaIuBKndB2FDw;B~k*+W7;#g86aYKu)J)X5FZ~n~j6XCyyPkezn+|Y`@EF z<~vybZ)I?g)M8ycvk$S4t2!)zGO3{^r)%fiWS$sg|`?Oj8=3>eds#4x#= zcW&Q`!qP44U2cUzG}SM?2uB54Vek1tMkeWhitWz*Ih)tq*+6 zqLtKD7m--q+pK3_^C`RYe!CbIEM-=Y`W2~mxo8s&G(kRIHm};W`_p8I6U!sa#ZW?L3KS?kY;QRxHHzYc21^2L5G@C znw1;cu02bLa1MB#E@~B4(xEn~l5w(H`-&OEvo@vqF`p^`16vx=K~|&fgq_Vb^*d)x zomG-rA+H+^-eX240&%6wU#w!ijp-kLw09q9Yhsk&B8N=RTO)4O#S!h!o^%Q6lg1}V zsIo!*8VdVMmpR2bW@@UluCBQ{IvksrPk20a?n{?E4NdOBp=wLedb`A>kI$Uh;6>iu zvY0nKp>8_z5%(3d<~FSdx*jwYZAo6sne~`H1e;`QQs0t+M8OjsfM?xf9||1TmxR6% zV==;kn!X~RE`Oncey9W(+3bR!akO?n(5}NUxjA=B{`$lr#F0|u9=b^EvM=}sR$wx%IS;pg9`!hn*OymFk!f%fZL%hdPp%x`Ba{0kYyf_bYy%X+`9OC%5PyTR z009=kMfEhhR5JXC?!T$M-|uXJ?8yEEeCtXah9~n0V=Es;rOuSu-S72_=rt_{J_oVq zomJ(zpQmc+W|rM@J23y^`2w*+dRaVU><_|{B=-7jc0X*%dPjR_EEx3x(u_`E-h6!* zWa#Zqk9q|U^}&0)Cb#5>5zWI}d=BSrf13QfpUTPq|V7xz9+ z2r>Kudq4&$-vzum{~Ix8Ws$=Zac~4x83V45?e;T6yMb@P3;q%{9AxeDCUJpV;TIkj zD3xVRON)aY}fr@iwEV2m~sat8-q`! zoX~|kw?h}fQHJx5?w=}fga}oQLEBdk!8mII)}n5pjsee#DoR~e{I0{N5PmG4%H{2@ z`m(Svf6*@zoccV$M@);LyUE)Q%&yCHAE+F$P17%}cd z57>L{{S?ljzWi+&IQ65xq8Tg7?2+gk_)=JcZbjU6R@pmx`dyI+yB5t8q(6k}g2W$; z6LL|LYDpwM@_hh$Zyux1MCKtPJBW4{@UDG>y!S&K8u4bh!1OjpQO;jVrwZje4#yHVpU@a|Dp&8Ebo z|B=6c^(2a{RMV1}z4eIsY1QHSEvpfu^ZKrgEJLYqR7sgAv6O#TVN^Ns z+spK~dR5VjsyM{1=~T(Qu@JF&vZehd< z!LwOZcY^1nZraxl=@!f)z}z8e5-9_YgRo(AJa~n?CSnQ5L)bw26J;LKg3=uq9MS?a z19=+Ug0s>^(3CPJw}Y}lN)%NlU|uONPqYV`xk*AE%qDu6II7W!G}2jQB8Xj>v*57u z((kVRQ8qVHruSjAL01!aUq(aK#E6wl8(BG|-~e@_+SWNFLlH`2*xMEn!y0jjpjOC$ z6o47krqKnt0=j0ci4%m{J9)zrZ3~29P5yMg4OVG*5dVilw$IY{#Aqz=s|=F0ke~@G zBo`m_ZwlBq9)IT?p80CNk2z|MNZ&=!B|~SIxus1Ex{Qz&-pNG*xGRomW1TO4lc>Hc z=#7apM338`IC_<~zXmiG2*e{wP%)5+!4pAMrl=Q93P9~&cTpKo;=2 zz`7d98U#yFPcD6L2+a_#)mPAf-Y;I?XM`s%KWeSN8rbZhLp!t72-?J&$06`$6mUYIiS9_67ET&NYA%&^=n__gjNMsen!tS+WrdoSK6lWZ#+#r(-i9Z7-s91c7U;TqN6~AyR=pA zh%buMGt3Zbc3hQb6jhtR35I!n=N;9?m~NGIX^x$AQ5^1y>og41h2FTv*>_E+9J2+w zOYpOVV15R`M?bI#WzV`5*IlBtpvg8voi!Ok_Ok<5D0gh5rYk-Mk^3@*1}pz?KJN%; zRRFS-eWGXuj#>tF-IA1U20oC_Px}0$Ym=rd9*^&9p!XwM|I=8@I8S}77cG8SjXOTe zcMGy+nxru_^Oyp>K0YwH4Y?q*xV~3{C$9{Ah4a`xH!g1Q{$9^@7@J2Yohdf(c@pkV z{m`2Hx>tyYeO6H);{=7?0rS&q2ed1rgz;>}8&qzW+1p|R=&`dtuuF9Vuab=0`4qI0 zUeNeA0rwl!D#HYYKeNUetuZdM`?Q9+_ku2+yuIj}VQV{}Cvjc|S7m$4OPU^;?z=kO zP}QD(^jQ|**^}0xty>t2_X20vCiZ3?T>iHlrufMl-p*}Xy1bg#RBNMB1^}9i(o*0U zy=uXl@$)s=iy!(V5RXDMtvsWjfwR?DS{Yv zNNwcRl{|Wdst06@GDbx<%;|bHchKdJt-}%suowh9%i4kSKnO{|NhqvUp;ZAEiShkp4aT(->u&W|GE}3 z5TJm%@5b$yZy z&;62kgpv9gYT-1Zs5O$h2L~4&S0WLO75jHQE2$sp6R7JosYct0*TDEqQ_L%a4XkpG2ogk}@)Btk^Dz zdfDP$FNu3nARkH#cRV^oAB%;J(!2JwMKnvB^^NxK-reT=*z!zQL6X9voSz&zrYx|p za8LJpz7g?a8p6a$5xJ+wa+}IAq-_XTA8${HhCGWT6@D6?5{zA+>7J`D)y3b2j5ow- z2)r-ij+_O7KajR2*d^U1XieIJ=sV#ZacvLb!rsU8;fdbt=+6dMjYF05*E;3a zIdZ9=5;z4nvmiGtH;(#XE!fSyumHGqJG@p^Tehu(%gz21l5%pPDJx6v2rDFbLsN)? zvosa;q~TqYLbrUS;iFS}bawU>i-a?mR-7*xw&waxt}t7)#k&dw^;jx-ut9{ivNQE& z-{eJ@Y$U7q#;k;~VB)X#cqjaS>KINllH|R<$v!KnAJEIz)jmdy8M} z>5X5a4tlkmP4#uv8T~&xB19%k-av*`OTh0XfBm zt1xpG1!gX1+8Vz1fZh-_3n4MO>>{}ifGz6oqf;@iX4;yDiOtlfGXmh=BMdGdom)0OZphP*p zyUCH!i3SD=xR@s`zY`$JVFeWnjF29K}G75>8mQ!u4CfUx3`9*ui=<4Jvk0T<%KyF!*B4q+b~5-BVg`oOXNNY;~vvC1>)6%xnDz85o8F?j~AJ zc2@bM$UFG@7fZ2>*-%f34hx!*6;1z+JMx{HJBYPy+?K)HTAvtLzYOtEoVr6k0fO5| z9Y=Y_djw~4YEsi`kna7#bM35iAcXmMr8OEcz4cPdLiNW-O_p38;F=G#uQO%K?}>yx z(8<~BGnt%|W|00G1Z>yy_+1G`Ds333JKI1%a!-{>rdYG36m+0O`ZKDy0mtDxMD7Pv z?hLpgVQIHq;2lwJj7>V@KeiblzaMg=e|Yf>l8za-jHM=UR1v3A1W=oDJ;~`0PIaU3 z6>C@URU|~srkqj#fEmNEyomcq4rs3)_s;xsMA@`K)eA<4#7c9<-XYLzM0t-5AoXfb z)A7jI_vLDh9#7{qd`5gB8~@+_b1vd3rXJHRtD>KARG3IH;TUVDwrm-3;oLUJB?c*! zsgf65lPv7{?t8EDeu&vX{zRLkoxQ$XDFIGJJqg#~j*G8vh}Nz4 zyty;--)sA&9t2>gi*6fpQVe3z*yCBOY4qBqyBLZy)eMb>V*s&WfNvPRp9_(X2RkTw z8q*~;x}A2I8;p9!Y-KU*XXM;0vxYQHiOt;OUI*&1%_`Q>^ zg+ZuY&A4d%&vy|-Rl zppc)XC-N7bUc%0j`!0*E}kN~R3B9*k?*=czU|;bKtvA* z+;uq*`G?(>jKmGL*eF*vHTBIfNsgPDbI8hTnqu`@k%e%~L%0uo-is>ViBfnF z0|^NIG+hp5#sKb1NI%Z{k-+}wLh{((n64jMk7`Z zvREc~pd12JuY#K5zl^Ut2iwJ;JF3#%8dYMn38+5T`ygkaCc0;}Jg{XT%GhfX&{z)v zC#g$DTQV}1^XTKT&wRl9ItSk2uVPXHx0-o3a4>ME3f^Z+$U)vCIdWO$j4ABu+@9=Vv>>FMKFae>Y^+=OQ&}ZAm#ih z*pw9yuO}J3$0hmE+DcQ;?iskibou{6P)|zhTS!z$PESyeEf8@>!$UMWO4l8LfR!=->2`7W9hRdTDEtbs+>d;ZA+JjaUySs8=C&$7CesLP zN$3Y}cF>p-#fisDMNL9x?)0DH?nbG2kh0NaPN_=WF%5+kauGRS*JY_d6(OrrfKf4I z!iA075BGGlzG)LwIPR%jtNl~0twKvZziynSdR}pMk@=A6SW@-`O;OEhr}PI)Ec1ln zHfI8-h2J5Z?=5>q4}@#c>!ff=qh`a}1tU;e8d3K2;=KAhVB~&#u`DvOe{<;o^`pzy{J01WG28#br{(9bUdW? zPA3E;`n&O@56j52?Xot!&~juMKLUHXt7vJifgZ=SHctb%ypta+}yu8!KA zteYAtEQ7X1)|tU$s*J0Cfv$(4x}JU0zw=uc>&^6GEDq7M+a8}5lt7-|GiuE&p& z^)nH+e(qg#Mo9^rsOXBn_?jM)pSqA3ZnOlwK8t&%{Y~CWO*6x{4in}q@`o0uE~(PJ zGh12;$!gJ=S7b*8Tt25g!q3C$Hh%0e#}~O3 z1|O<=sd}_Z&1o*XG?=S#c9{7wc|0%$Lwjcrz_l#ZI=KU}=^rnc=|D<7-SDzwjnY>K zmpA+SUY9$ot2Nv1zZI>O99n-c`Un*O+P@yNMjyMW)#Nf~wu`c#p0r7{>Y0ftcgdOw z2=xdR*p61%;8NkTg$r$Kh@@=kTjWPZ0X$Bwa%Sbq54MJ1xo`9l2P%3KwFp{_=gjZ+ zQF+$3x}4(B3%Opr=!D~hc5aWpk#o7;jC3sghf5y&VY-t<@OUvff011Jjpz0vs&uhHc732xdQS$PcP{hN{9HoQB9a%6rA~K$_7*x! z#sInBw%u*eS1%%yDiLz;-+9wvR}%5T{Q<{U%W4{`+Ef*DH&M`oUX9GO1FmIxHe0c) zx%{lOsJC?&lxOl7e;G9U?Y=O9T|aNe^u*ZR+VrAJQ#c~lGbME-@PMi7|Dw^qrcS{R z!<6VGkTG+q5s%Z!SYHNy@4=vY_w^|Nc=gXi@!}!9inWSOBr7Q7Z##4Y+wkz14+!9= zU#6k$92BnE(UkmbWgVqc$tL92tnIy2v$XgosvWzJutV!lc$I!=J;B62p=-ziDyXPOo6KM%9gJByqbT06sBCwqR!*DG9kk9(Fd3X zqpFSH9_2T3_+t#IDPIypsVo0NMZ(K&wl!~Acoa21c|eGg$4K>mwe}T2ZFb$d{i+{O zN(C*}qNTVK2+%^2;O-vWg9WFBwpf4?90Ih3LUDI1mJqzq1cF1*V8tCS{m;F3{&Vhs z&pC7F&U$BMXV05GdEeQx*0c6r4-E>XRdmjvRoB8_p}-btnq*V@GftbpkX+*!RR>3&q7ojt-#Essj><-vS`&fbjuxlpzN-Nf^pXc)A@XS~8*^n9 zbE@~(dzfjzRLR0=01=Xbl6rHIjC2K*^cnqpd&e;{9QinlYqA|Q^@FhV=nfG_Po0HR zUX)p1>rdn>%3_2La|shX%0@4PX`O92*m!W4Tg`?dL|5_P%e)70?Jr#xWQXD%fF@``>4HS&og=~BTB>+s7`IxO=8qo z@j+4xt$nlgk&k+^lN$Y8+{KS8V93s2Ap~YM(b6)qPrhti_a0|GW?<%i>O1w`wl-`h z^{7L=k1IIYY;5(W_)4vG+-ou- z&)U`$+OfT-dtI%?;WDqlNpYGl zZB(PP@LZFEf+bYrc@kkdE5PpYQ=)1FJ<19f_7$pWBc0n-J~Tk6a#YKf;I4ktlCjkthrhpBSY>P7b!(y^awxNq76 zsGhKTsRutY#e=N^H~3LU+4stuKRAtTj2HMVF!S7)q)1FzLE5tC)o--i@Zo)XQuf1> zXZIns#-Z_){ieW1uG{$Qt@m_93#ArwciMkILhnzBihWM4DH>^W`1|jknskdIvzrf{ ztrhR?k}t)#d8%tUy>NLuso8heWY6NZ;P{WfJ`264wVJ;@`}w7otcsQ!yPM87GkRMR z`o-(ZX`ceae3l6S9+1+5=?U15AJf`y4tx2$-EWR!i}=@HV$pIn209)Lb;?3dyWb09 z?RPL^%2~@Z(>pz*lvSVGgMq z>kRb5y3zuhdu`$sLy5u9v#KG`5|eVagyfW9usWQNNTcqWaP}2FA!=TRG@8kcJdMXL zbzxYsD_NuS0T1l9A^)Q)2e-PhpihO2nuTpk&J3J9QbOBn6@J|JXryI(_0S#Mb+tx? zWe5p7*{a+@t>Dixe|@rAGQmX^C$*lPJ?tc&kcy!$XFxpt=#-3c7@$iRd!-87_nmIU zI`s}_-g*#PLnbD8M2XD(`*R~usq}l{j<0f8M6hDK?{jmV7$l`qqAx4^7lpzu+UfLM z9n>@h>Fv{`V&=t9%9o0h3RSBv&@I(8r_T2}@^54CoTU%Z@ zM-`ek`Be{pi(@>Z$@!u;<(0v*7I9C@#ktv@_@&-V>vf)3*xZ-gevm%36CqgtoZv0; zUN+_2A$%4S-zX}rJq*4gwkiyN_%*6aU)Bu8>cK_!_dEHerTsyj^;+2vCHLUQ+x9UB zwE;=ker^s-7Tv^fTeEasNUq23E2%UFy1waJ8&r@)c&!D(X$V6=+x%jD>r*J*u0$Q+ zi3xIyf@+D@+!w41q1c_Ijk%}FxiE89FgvsF9B^NG3;VO`%e-?w=g)_;8*Z-go3Xp^ z>X}1@t1?c3ZC}0~azg28RO0QT8$tjZF7b=jt%99Wy3|*kiwgHiUZe*t7j_Y{nR4Dy zHt`RuPfBJDex0SS`Sf;(!K2GRy_kApz{q+C#aVKA*SyD)WD~u@AIqj1!i?OdCJa?7 zvZZ>$7tvqzSG7WsdXusNk#B&Z@4D-i7>vwj*JkV=PKm@#S}e&upWSqb<3N|-VkY~6{245T$#-hITVEbmJPP?SSsXg;NOt7b>0_V?%U-%ZvAjN*_IUpah4hyb1W`1 zTP}5nAY#O39+}2;lcLyhN_|V8a*k$y?73;59`vc34$sV9*p^hBhOQZ225qP^Fm5t= z5k_!M{!dPLnXX)pJvX7{{v1<=;vo>9%TI&t>aF!x*g|XgVA9ogH}07tLyq|fCfZ8| zg<2$E{c-*V@LdvR&CqcmBn035H1Gdh+3eOm!U^GY*F^I$(b8l30_=NY>o)S{kZ>eB zwxtgsfpX5+HOzW4?%G_Q>mQ}82B!v>MbKm+uZUtR+-4`D?XCi|4f2VE;;Yp>Etn;|(!&LCMWZ*X;}yIoZsaV=Ws1lMu3#J zQpgmMeSa3MX8b(-D!{%vGv!1ivox$(vo1O{Am(UY=v@nPg=Vw!;;#y`d?GqZVP~2t z-l(==hnr1ZP!5+pd~iyEaz4@h^yNEk!>oxrYwdQgdSpa1VI@gk}z;Llr-lN5>j94u!-;U=r`Tdmk5q@$_U$;BK^=aLUo3VVV)E^gCnfQ4 zSn8SOll#wW4)+N-;Hlz}BV6`H(~|aP&pOwpO|x7sN3dV!lEaj-6@RL%v<=KYUD9xI z;Oj@QZ?clg!Wns0qO5B?C{P@GaBMr=3Olu4d{lK5)<_Ce);0BUeS(U3P@qs3+ z!)HuDP+pm>wpo~S%QU7R(PekH0lYd1K^ks;;J2;2S;y}mdHCD=r{SASp^tm@3i#$8 zuWyEWd7q@;uRu-17puTti7hqf^zFwcB{v2n(j_O}Q2^CBgQ?Hdku%@Rzmrx)Y{)v2 zIm@0gALp$T`y9HS({~;CU=@TKn|7drt@kS0Y6TyB6P~$IH1PV|Snp$I&ldrmqxTGq z+~8{IWtvmDkETT^n&LP=O3x@@36#)9)mskZ7q2K4r^KZ}uuvT>+mnpW2wr@EQdyMW zNB89JT}PKj6$G%9(@Rsv0NWhz?Z)e+42xqK6E zpENn((F`l%$b-rk-8!r>9{Fi@As#qlxT)-IJpkY)u6rgtSm_md5+GaR#5NIQH=#C# zW)6uM=o)EEGmvTAZ>Z66zngr3>k*oAmoh60(G38t$~HPpH_x1>jh^E3R}ouh#T?uQ z(sE-izW;V`I{r$av&gLrx-CpP$*L=GLe-%`ha`A=yGz$1*DYjY^bK;|B`<4?O#P zk5-ha6t5iYG`__$FGuKj>l0)`TM&@o*p{shJqHU%y8;(BL{Y7$OP|)03~pgds?XnW zWNvpI?#a$}GaL$1Qp>tDDbf>%&lOWEkL=Ck6Mxj=>{y!kz+jiiUAku3XA-wp(*|Ywq8lQ*j}A zSCGoo$!{1FNuh!^P+@=crPG{)5E+>$R$lnTHU^lC5sk=Iks*Ig@=eE+TSTc$kFEVW z6FDS@25KPs2xDucBmG0^P1+Au(^8Le+isUG@>Iq-J>tKxw|_^>y%Z*YlRr%P+`pdk z;3gfd0l9Hmq~u_kxH9bbewAGgV_scVoT%NXajy2O(+j@SozVlY{fo7LixpdcZ&B-9 z1^~iz+7h){Z)LlY3Jkeqf7Q=h-%Z1K5c-W%yJ>el+SBAi@ejt-@8*sExVO!tZyQ}- zP5jks-qKQAXkA!`B??K9nPC)=bo3S| z=IQ!|G5mFN(tf3DM!u4N+@2u{jdTWA{QUiOUanKwxFyxcPm?0h8|^R<{jwp93RQT~ z$zrP_0EW{f^ru=Qt&L4;yO+ub>P-$scvige9ZX#TDE4~XPV4IKf+J6Kk!0Konr~%b zYVP?04iP^<(~Z#Vr|D)gtKWt571y$ZRrH();HMj-(msr;PTrNvtx7W{F!4AmTS_2n$!otwaLYM!Sd~8V zj7fF6`?Q$%=WUP4$7A2Ldru$xWtjO;2G=i>jVTkZ9N;2wZfT zX~SuonTHk`X7gW0TueiYdES*2b2kfY*vlK@ECj$ku;+pw`>6%MDiMA!xar9#zTz#S zNj_5D=cUdfx}9Oa_iSQ4I_hF3`suG=Kh1r2k&MT6u}}u~A}Z&D&=Rw93`wnjyB_a2 z;f`_3oOLPaW9EHcnk(aC9yH#=*g(iK_AVt52yClw1v{o+(NO^F6buiPb5seJrH@8)=J z_Pw=P_nX^ZGKQWV8iL808Y}TNjqQ4(sRMr}T-AU8+mdS+sx7eKeoy*WS5I1`(B z_99wm@30cratvwhpL@p%ca5hloEQyY&RDr};YUDwv8`l(S~SuET+NS5b>R}xqs7U0 zGXFzzTuLb?HVMLzCq_{3RLr!2A2g&x!_=_=iKYeUCWggp|tD!=Ct;Ul(YRT8J zT>uwg()ESTd7ZS#NPvJo<9UVZ-!+mkC zr#=2pMQkh`JwV*UYjL&bXM7H`!oO7jJUkW`d(iO-%T_~ZIY)u1J2Q18mFuoQM@Efz z{K$mrf~c%aQuXdCoZQmRl4j4Gjg-$`G*c{Y=Zo?K9(NvSxO{QFvflUi4~Cq29G)4_ zr?Xzs#4f%GvE@JS%vf8S-dM&ptu;Ycbq0qs>~r9JwlG-mT~#&iW8;tD&F$cE9_{me z6BFaF^hKQwx<_XRwI!*i&|V)kA?KFX2dF;Wi16uA!+>2a=~;GMaC3bVB7K^MN(Iv@ z023as(UvgRt57x?*GehlhlwD+opd=PT+Oz9gp2KcRvUM3YV&(t?bcwkOU6#+9vTnbwcK6pFjzr@yKi8)B(Lc@iKVd~* z7(O^3%9ovLYsxZf5gQ#v%7%FcLPQDkLD1`WFv?YJ`ROrDb2B^pn#=vv*wZPl z6mcTp;0s-G)t8;$`5sZon-i7~gN>#Co)htYMY-l#eZSzt-p9S2=u_bvjvCeU%y>b9{c+3VDR{J z2L$oMCrc36U$h)B=0e8c1foLMkvfNjhy1Ty`!=2|)3b9V7$75lu>3TTHtFF|dHkw8 zP4Q!c%;P&m_|OR*jVTf@t=Vscv(5Vy+!5iePa@nk-q1yflU-t0cuy(SX4`CgT4V3X z3FoYEtY+_%W+PSI97yPlz9MZSEK4_&T99{E)}ybU=gGBYKD=1|TFcArWt@FP?qyEH z3M?9Zl$bkf`^^5dMSk+$%<9=!I;9Nhn&bRP@tW{;#}96EfajhR=RZl1_FxA2+hn$? zGMeUxnHOxY7pU`8tlm7FFH3!cigilu>IbKW-eCSr$DaogB$_NJ1E=0RDxxQd)ay=% z%~1$Flo0~yCgZ2Avc$gp{#)Ke-R5TdTT?>igj_N65fD2>Sa~UcE+;*-yf0$K z?IO*0yBYSijHG=?X!$$%FaEyVh*fPAk&M*cyU1d&o%A_(=jDxTIjz$B8F!j0DFsz& zoI6P)M1ngxY+!TLRm1QXg2cpjx>a&HclC8*jO1UwGljRKDz>oq-kloNhguLyL<$w+ z3+}ug)9*YziIJjyVF;2aZw*@g@>gfU2)rVC&P=|Nz)q&wCgt$@hx1&V6cyKaimvQ% zxzq6D+9z=O*PBK^epm*P-Q96!iodI7`PZ%Rxi}4>_JXC>-P@!0fgFAj5`oVAuIN(m zmazO=%<+%yM_wqmi05O=!u?+tkrQ9lJ_#pzzuG!`NBMd(@x*p8S~bg!a(Cc>k!k9! z6P=sn%O)N~c85!P&3@zP*2dk0&Gs>u~%jU$~t8`lr(~s?rFPmW-OMql@m% z>4AK9-a)%Iwd~l|CP4O#iAhU{hevGk?}e>VZEE+RAi%|EdaJm{{`-{COFt*)GnhNi zA%__B&-Kyuc=Os{G^ObR{*Zt?jZ+iH+@^!LFzVh_(&E#GPVRfeTL(pJ-PfsE40(eC zt_~N@x6Ds}>c|EZOfS6a9etOlJUmJN*K-B-7r&_NcuQx@)tZ960{u?SoB**$udd$f zZO{;(V>WzFi^r~HuAJhsD6f={zYwjBdKPQs56fHTdtxHBU6#UW+kM)1x|f7jsnjke zOn)dn^j5!`%{f}a;5O(qQ=9hYl1>Qcig`><{ zPCUAAyD#9E)&|(ZKQ>Jbb$(%~f%Hg0PKxOk8Z%^A`p9KOy*@L-?zBi#vTW!PCuMG+ zk1Fiy>{f0oK@wiAJ-zdwze!BmaWJF`NE?#~p%~PIG`MVm*cW=`$WH=?d>w>x3ZmEp|JGHKu4?5%XeZCe0 z0s!BN91VDszex#tVI3E!&q2zN2+?cG4j_7e z79MtZ`eJp`@!@x1vXHh7Y(x<4Zj;7eAIR{F2}*6x|dzyW0g7Ct(WW2*;1wX z!&vcDdEoc4WQ+>u8H1ehFpf2H?>r&)pN&t>Svgy2z3&>hbtnR0{(hLs0 zm%@#cPd$%dI9(cZBMUM6wuzojwhuub0uDMQ4Nj!%hWNRn)vR5zpNl`QJ~Y(xdrw$Z zncxOAOn=y1{ahE|^EzW-xdHgyZzi^F>_T77cpQJQCtdNEV*J0r8pK5YDMiyium%Gy z8(Ut`8)Klgt);NFC7*zZt&pXVm?$6EN&w7n3$PKk0a%Jy3t3D3*LRrmYPq?25&y{m zs>KU(wRL;;XBWH{ueO7~%`<`PHhJ}p`JV|s6EOWx;(Q`}0s{XWrWBrn7SrnoGyWDW ztBh)aRzNEvT8@|wX9B32SPrj0>LzF9W6mn#qROX5Rd<~#DWz>)u$HD+Wr52) zz0-?dM+428q873uR$viJZ4t0%a0jI`TF-ev9rw`%7rTjjM~{ol#C+zvTwQaTjfQAWl#ii|25wkOQ|vqIIl!B3ri7 zQ}(nfwtNsRNYLB3798MXq2Oa>=VPhw13qH$Tsx^AVmR%e&8e9j$<5Ezg*Q~`r|-k7 z)db>vloMv)$M=KAQ!d7{Z^8Sk+SKY8?azEb%a}IBgdrAscz?L*i1nvjF#KdWL5PNH z4PkvLw<1KtvCg7%N@>YXc~}@HUVv{0SDD9rHV3Yd4|P}E&x;>kElF3Qru}$*bTu-`I3QO z!Yc^8ClvY~a&X}yP~*}|VG>|$}+Oc%m&rG1_0D47~` z0byg?*ODci0jeztP4MCz#?q~6BmCJ^XUi1o0{9~g*wqPyTbuf3AMV8jFMn@a`pL4c zms5R^iuD6wM|&MSOyD7JW`gU#sw+yVS6=Q~r6Ur%9s#;XfeF?ZE7Hn!Cxar&@Zyl; z@-{nG<%HtdBb5YC_!42S`IGfUKxFm7S1bj{=a3+DVpgdX#DV5%;2YrW8)L!gO2I1h zSs)vwyGHQo--Z*XVOUa-Pe#6jhiN50daHs})m2fX$Zb~-F1cDZik&p7W5MA+=A!A* zhb#feE70}R(1Q-Yk_C9FR~iRplfgH1Yeul)M)()f|6%YAh@MAE?{UxWq_CWgFNYot z^h;BMw!&Jr%9{iZ*>P0j-~5;WpR8v~v)R(%vY^9J^L$Y9VuW}&4s_U5>flt0bxYW2 zbIfM*gX0O;e4k8Q>DE`Kwv9IY##t(rSMx)ox%G=W@Qd&@hu!!^32&lgYmQ{K%BxxE zTC$C^p9mT~oxx_qx{`pMA<|9 z$}?Rj*+gI8QdbY`jkQq4E})7B#6fCTN)B%P>-A}iFq2fa>q63^iX{9`Az_j0`1eJZ z3f>i7RcVucU1)85L|a9a!3Hq4{br2ppNGJ!Lj2N&Qh*>2H8Yij>jO)w9z3e5e+v3_ z)||D=`Jlnfmut!VoW5y`!1Yu%7uGU3!n{N!!3Qo18gx_30|lUm2(cSK)HeEgHjt$o zgA5yJGtl7dN^TIccrJxy1&SYG!7>WK5z>0<39aycmby2iLXk;P#VmD5eTNZqcoD;= z#o!U(0GOVc7riM3RFz8T0!T;5ilxc|V4Z-_95Hwf;3F6ii%*!c3?G4}&6!3O{I7Xl zJRibl=ex)`x@C(py z!$88?&{hC2tm8su@crFojRe%c>{Ie<@voa?5KrHE>aDtcTU zc%_RbhJ1DH@^yJ4V$)m*0QdcOSL_p-dl0^G_ZQ(1F$H%P1&9#JoeKp4vb!^}v-$xz zN8CIr-2_@=I1s%Kh(Q_z+7K}SK=k<`hVGmrNE#xd8{R87!1_+^v@PnJv?rN#V@x`0 zOi%|?KVr_)GwRcf>yswyGbQR1n(8wG>Qm0@v+wzS3inM_I3|tTHDWn(v_z}C&HMr4Hx`Eu< zXwTZ{p4sSZ-9TN^{dji{3%ec|*OreMg86!2h^2$YlJR0$PsHLA#L~3Il19Zc1>w!D zL!)jIAu61KU+0`T5Zb?qNU~MpHn_ZXucr;S3S%9Td@rYcE*k` zFv-j^hE52gXFTT)L7!`N-nU&hAv>g$q5oVk|93%X6=z6>TMf@56IwoaYme&_Z*uif z;dUTd=Khn}-;e!>CaV+7Kk;H@JG6}Szw0}iBA4KoX1Yf7D<@Q^{mHW{>cG4MW#ibS zVm(xF_oI_uC+Ya}h0$Pe#y2B-^lYzwt3I`8P91lPzq%+ng8BV{rH-GAEQ>+k- zPAJTlok}3FC3t_yGRuH$Zuz&Q{T9%HyBo%b_F0%&ru!QOU0n2=_Dx|~}C4#c40ZW!U3c;Jpn z?!iMcWlGPqEWDZLo86dPzG(g};rJ8_5Ylw{yZ=jR8wsQs-Pi^{$PU@s^*z93IywmO ziN7>UV`xqZSs_(0^P{Zc1EfoRre|oZiM0^!HUdlt09=xj&Ydv+RRbPFM9625gqR;lp@~4G5wDi{}AMHKFXS5Yc zwF@@?P&O(nC|mP;=foXd(I)*px|~{B(3X76Pgd()63t$C27%yjmb=wazcQnBWNVIm z)K0ZVeOXpJ89~B#aONb zIkROlf2l&@3_yR6lsKeTA+3MZC`_1D?l_*?yw3?_R8BEj zo`V(Bn#N5Q&3sRBDk-_V_G99WYmhr7oVc|bHw@Y0!LOm?stTrXxf-lK)Pm{|E~-Jc z@IvjEY%=zvGs{)_q~9xsHs)CV!J&95%$QNe_d0jZI?p<69^sZ5#vmxHuIAc7L!O^7 zF#fIpE}QZb^lV76*a@`Tc8QZRN>i=5&I9xV@S~4c^~{Kb;50QCTq0Yoa~-&5o=M z-Z&ck3asf++;wC^y(Ke%+D?Q>U#*}wr3#Rfsky3Dm1PTmbRh8L15}quV*l(b2oCrBTI29u-Rus zo;7M(r~`(hdYj#28!Ed?e^=WnPW&K6o5t2&WJ^z?`lzuX$hg)HS~7~cMLl~c@A^|* zwk2hDH6MN&gH40!rqmsZT0TE<_6F60*^wvG3X*S0X!Z~d1PYjWQw7@-yw=o#73Lc$ z{s_EJqd#SdbSo00<#mWzU%i)ID^OICjHUKmFnh@CiO|n>GVMBk55aIP2q66!oVeVhDC#dV36{Q$5nH8duyG&2=|IyLhf;6-{Mz6j48 zMX+Frtw==%XAFp7MQh@2d#%_Ufv7ty8O6^!un4 zfZxNs3uR$rNFYF}lOvd2I;ZusuM~< zioGw*X-7+5kZ0T2TbjWkz>3_35VA#t>`NNyzV@iv2R+KugwtRbF_@$du3jy!9N|HQZZA=_tLx->UR=V8CV5^8Ehxy z8Q5&!KoZ6*76qOW(IQLTYu}cz@4ab?9WdlXtuApY5GI5iogTEn*|%V@nbj= zWTA4unLpoFdBx1gAF$?DO{*T+h-YzjSCDlkR+M018dtMLEe&;u!Ho^Ugp(zw`ovDR ze^u1dI0-;cG}d_usKDNpe#PC|3++b2<7~dut8QUYm^ zuhGtL}g^=K*-Sh}q*Bj6MdE2(5a56lLgySgGKR zF@#^Uu2F-;C)kiP#}fK9ps64$DasIG3BTfSA|k#d`mGP4GQRZRyuU z-M79AmgB^dfz>FWn+7$}NtolJ*CtLo7h~4NEzOm@R0oVs85IOAb^4IF2;JBWxPf=% zQIr#KFr242r*4nSsgJtgYu)jr&94L8ThfGPFbQ#Kt0yyYvtHhhrVw}5tX3_t0gR% z_ZVJwJaKkywsPEa(6~uAr>yhgGR4=ViW>CBxKi!}r%{6k`SXH5%3T z4>YRipOC=y%Kwc7dSbyqnu)ihxQH0sdsQ6F<(SC0ob?~`r(La$M6KODA8X*=WSr@E z()4(yp=!UKV7Qi*Y@=t!m zw}0 zxWIoHLV<)?dhh+R0X(je+R|+2&a42kDBC%qAUJ=JG2!Y^?le~(2zoSRzQ~tl{-W1c z;43*E6z*HgpJnpBg8<8ahWA4skDcvUzXozV9HK_H?ZxGjv{{KFtAcmjcJZ@&P%C|; zpz98~8T8Nws5=(7V{HPI6%AtsAa=MWUm&a85~$Uyy9MnNXoiY|(7vtCY<7ZK9LD`0 zV0K-}JCEuh!ulSPW4lhSHo!gaM2UvDruy)EG(%?ew!kLxA+2t0{d}6CSDBW;9rB^S zOqW=ZRf;>mw19s5Z;ud~^uHh<&wHo>kz;{<+0Ivw5^{%=>ef7Kc6hT%_`|ztt_A^@ zM`3Y>A6X5eC=8Ny4dasxqcH|yn>1I1dJ()io2cb25i1fA8_!y>a;42b;_#P}0y`F)~xn8vUP<1WzwZ4=-O28(U&wQGOAC NC^0LmoVq;m{{T*z*l+*< literal 0 HcmV?d00001 diff --git a/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_ko.pdf b/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_ko.pdf new file mode 100644 index 0000000000000000000000000000000000000000..ab95a1e79ad4c1245211f9ceec160be91213e38e GIT binary patch literal 602946 zcmZ5|bzD?m(6@nrpo9o0jkKh~(ku;%ERB?;LayG^;W`6~8E1KC^xLD%xKIZ{} zz+gOQ7bi1gTRe~PKWX7QlRdvAx`;)E0@>w_h;KS!(L6DFe}nm!B9;W!Jz}1i8yH$5 zL%AK+5rXGWU-oOQ1GsbZ)zO5H0Ew+^405kv5emZ$UH9XZv>YwpN6t2g9@)~DN;!Q zqLFq&&Yu4(giBi+{}mqsT0)JH@R4bNJjSX?VLG<(LbHZ+8$+WLifBBBkzbbOSZ%?u z=db|Mi=bld7v_&gK%j%NdOHsR%(Q2E<|p5NN;lP48{o0nW7fUVtC3yL(2ThxB9#4V z`0$y&gWg5q(`ib8A~Bn=)SP$ES#NzkW``L=$TY?8AVL$K)5lmxN!0O)n5O4#uvPs!1(xWqj+zMxg%k*1D9)mC#DsZD2;N(RouJjyn>6f>9Y47)wm>c8y8cH=PRE zTLQxyH-t^`2dEB7^2@$r^to||S^7xP2BVEc$j!2pvag6&hqkwXA+9RbLh|0JikI-uLJReCV1sZoL-m}vAf+Y^Q+`f!be46mH|mmC1Y?>D-Y zVqOZ%V`khSf|z2!xiN%w{TCZSC_^%aQD!i}luo%qh=~$oA`xWp-7k6I;sgH@X?C~` z20+XA%!1Fl(ZU*7#|qvy?h($Pe1 zxlQM-*AicJmnqOl{Z=u<=s(XWBD6#wtn50xgK;Mvzu=bW18rFVynx@c4}0EQ#yq9L zDBaQC&E~oC>{*K15XP=2S+!3+a2+LO-GRaTpg;SJr{4Kwdk5CLWv*xYwBoD#Pi^$L zF0cIYzxJb7?UVQEfO)tXmdJN7a~A>V#!}0n`X7@Mf5S?Skq=vAgu2|oeJqF@IDGSC zQHb$t<=t10BZ_}scIQO8jL3sH9|5=9%zQ|dg;n$f{MW00os-JGzASs+EqE7$sYJP{ zmZOFs6xIMQm|A*6?zsz!eXG-y{<`WdX5F|)QZUVnyhBEH{JF_kx;9ToxhV{uxG{s$ zFk4@((deT*jReEUa^HArOu!LQNrv$ig_!ftz3KlY&>KKYE`sqn9cvpz)SfI+C&a_} zL`pzM&D_dAcFLW^_9k#->16H797&q%whqC@3gIpx4+>J zC|Z1TH%{?ny;O3;c=wpTWHECChTtT^l_d58y2{69p4t4~qM5I4Xv^7w)+5iZ% zFe0)6I2o}F!0vPG@}44LdAD7@-5`sSfB=Qaacm+Zn?gg@rGc)IbO)D=# zPj3T4c{-zUO04>q-!Jp`sMB8h^DT5^$oa_0T4h{lzY1)M`-l84L(DZwFGU%#G%ZL6 zn()ETgI`?3Ei}o3MGrIXHNUt&iiro}ilS#gX=n~vqyt7Do+0$QFcY5rH240lhw+c~ zn+&30%O6it7_%`8amJ_*5F_53#>-$3FK@S9_Y{-md;1YFMjT58P)?nlwsw+K<<$e` z8(oek3U5Cc0<6yD=8B~HrY@t7mB)gsx{oO}Pk12x!sH!GW2*R!~y0Y`YC8? z>BM8wn4DFw!@G?i0gWhm(b9w@d4mae9)v1y8oG7~C?i@e5w|c2V-#B1wz;`Pm|jh= zq#0ukDE<8d#F?Lo@&%!V9={`|jN%UPv5l1~x`7?hk#KTR8-TPLn$ylY!Fw)qrJvp~ z=G@yV2@nVG%ZI5}xNU{TtFw^cTrb%646&R)ui8K_PP+gDrtmN#MbBE}-NI7dxLi*N zX?MxYr&rgui@&?we!d#$5AF0K8MD_@BIaM$;P!VWSWuBIuulsD z+Atc!HYGcG3GQ!J$jkGlKLbdDfJFfhPS8zT2>nk@}UWPMP7gs+TR4Xs_>u@E{t5o z@O~exgR#P}lUL?)>fcZM(dPr@D!^)8#lM}`WcECmA7Hsbk(#=3VH4re6=*JWmdpil>d z?7g@@H886R2ru}dz+a$l^Ff+^ZRX2HJrt<>r3`PxsI*f%G@cfw&2!>0!+1zR1MCRj zGga90b!an5`67;@1NSiS1xc0k5r?IBMd_xY)+q^r)Hf20vQO~i`DFXV{*i9CB;P&2 zlDW*+%kP8fVAv2~b)#9+qq?2}+t_8%$yLg**G_{q5n&i(aJO7d1BcOkZ_w~Bo`7r# z`-HuymtuMEZ0za2WMTBak-O+D^MtxzS;LRR3R8U6)Tay2e~&#xnhICkCg8XO?89m2 z22Aarb@^+}ab8FRh4BSt?)iKrt>}2wAe)yA6sWrrELrjlzyN9D!_+wu}SvxLAMAi=J0-Ve6=88p^vU%GkA_qt7kl!GpcygG_9ydMQ2|C z%})T|kRTH-a=-7`eD}d2%;QZw8KCJ0W{QxyUF@03#7OaF9AWV{oglVDLV*6HcZVFF z42Kq$C=}H)%W4Ca;Folcn+SX@L$kR4BAb+Lm^D_m8&E1>QRR1jxE1#Ix1~u2CN+W9 zzZ?KP)TE7bnA?c3VksF8hYdmltt<3_8bJ4wwv~^>^qZdgSN{6{XiN|Jp(e1_#>pAN zt8DEuwN}s=CfPm^?NNfBAsmh!>(47svX3Yi_2UmQDidJnApt+P&`T|;7lUV{0&mwc ze!2n0B0z)H{u$y+@*Ag)1j)}nH_(;a%p(J%AFfQS1;$&M0(DvPAeNJoZ?OX^I07|w6EXf_H1LM-FJi+7Os zk~FoQy|T{qUZduhEDyD%fKYi)y7uUy-o`C+fJyZ3#m%*G9rSGjK!1tU7qle6!icBA zC4SfgPraVvgkb}U%52h@IMl!TU99$fKPUJXVjZ6Z=!^m$5gUM4K4cD_q;X%J7u(wX z%GK4mmQTF4cBhwbE-b(wUhqiiQj7Cnf~T$( z1(Ha713JJ;tjWYc@u-B%&)Ol6#f8p%D=H}>Ff~>t!15(TEiilD9qiQbfD=a1F_#C( zo@3Bei@$JIjk_|qT;og9;{(0FuJx@9$s`>g&EFI^4wRI?Os7~}PGtb5uMRvdXTnm2 z*Ltuzq5RxVMPzeUA7Zu&T&nI=I<>&Jspfrzlb0j&uem_)c`&H|ezA;I=a$GPRFJ9} zsaujEQuer9_`W*!^B_Q+l$;YNeth#e&2s;5tuPs1x65%x_PR<703bReM(035R+Ye+ zy2|HCofmt`gkLSY6}C(89b+iAw9zrvxXj3W+)VBwhe1LMO5K)piWlYRpRN(VW9_aKe4|pflbV81{sv9wTUV} zcrCQ^K=c%|zXk_R@@y~ECd=q_o)l|3>#3l>eq4s;d|C0KsO#W^V_INidM)c8?T^R1 zE1YDkZ=N?y%{KGJmbIMBpZEzZb{_>m^?*r|^kl<~>85S5R}l9W(uw;C4RB&)WS8Nh zc#7QCAl-T`U=~*Jn*+DR0mME3jnXzv!M*q;?y+XS=E&e73sat+fD5%cb4* z^h*0i;=p~)$|-C9$kCa&Z_wrV_O$IoWZ|g%`bA@p1o?fs_I*cEW>} z*sEr9rdy#u8kCvY>wTWP6FQ^2uEGx5Uk_yw7EYhz-@EfQleu>VURcL@eptI_n*}>r z`_eumTzhwADx5Pb&(NueYUyMZIJZ%s?JY@KSe;j{A~`m#ALPq99NimuclJw-lU(;i zxfwZHW9frlX%$f&=pe?2R`}Qz!*T{T4znj^Kvre= z4|Rl`_7sbT^!1Qej0a*0cRp%^1f#nbZa4@n?#<+*`nzzc?Aodo>e zeLqsj1^dGp8BpDpe&WeD)+R$){h8c_6tlTH@I$)PNoJa!$F{$jPCQ&Z zGYBRp`N;W@5+CcgLcFT;SHNZ`O}IN1u$~&bY}lKlPy>6a;l4k0lo472NzPLo#jl{` zu}J4~K`6=xnn07?VIqkr7ykLegY{SQT({VW@Om67V``U=^d2MpP$>%FofFE z{IM41fe)UK1Oynd#kd%cc5^e}`+NL_IIop-Pn9As_2+ay`sv9=$Mzx;?sN zQ8ye|_=?yO$vPd^bKrf9aw*ybG}P#Qv|b_1=TtWRt1CtPw?2!i-CO?qbme0LPbvL# zI0(8tIYx!A);jrBA*CY115rKvZ`XohC*Q~?6cs?U<7P|qk_vY|2s+o37d_o1M{>R` z+%=Yr#ozW#nNq!B6|dF_TEMe5kGI4|kZzujH}&QK$n~=Df;nHB*Cib-YB-M%%?p3zz7f#4uG;C_mlb0%vW>|{|evW{4US{MM! zn+=xd*&pltb#%hmRiil$%Q1V zD_YF&Ts#B)sJcol@ZXvN;PJ( z`Ljg71^YlGUwU2+4XYIo}7WM3YjuSr!G{awQpN?jvWtxO> zLu$Fjqj&mv(FH*k(NKcZdUVnAEN(c=Yd}tU{at@Q)xN}S708+tpWB^BhRf!LL_aPk zixnn)-bngWsU7v5KFJzuXAJ>OkfuZEp8+#klzdC9nj+^@y_IO zW4b2=A~$f?@La8`ky85bJ?~QWJ&k}q>=P;h?@s6}Obuixeczf{01D=#I3T&9f|xUK zchqD&>URaofW7he_aJ8Whq~JDnyGNar!0v6t9DW8=?&B5TT7rpt6=mcE1u3CAo!M?6IlT^M^pLb!; zx|!;%XjzMib~^Fd%Iw}q#l(|MxiU8D{AIc_Jxc)uQOoC>{cf5WE14S3d@x#_r|Bxc z?u5j+A*hoYSZX%CdR+Wt1UOA@Z zPOp=;&*d)@m5JCsqYyHb=&|eR$jF$$CtP<1vEDDJiS%A8*pA11MoIK>cak=9}; z>F*_u!~E)|viPg=?`vPo|y6O$pC6oIOUho4nEppW@pDMtYa=s}Tr6-J^ zw$qo0DzL21Ny!GST1sHrUoG)F}myR4u=~AA1M@T_wv$kHX2Ryk^8W4 z^WfROBw;YL-XrmO2DiK##lc9*8?@ELpA~`aJ*G?41>arjcu#_wW<8;@vK7R{-M)>0 zyg|?3&y6AN(n;@Gf<>INVeR!>HMNaU>|JVOK)S zuI?18CW^K^pL^vv6#39Yv{>?73Ltau%qG$rd;s4DMoqRp488vbM1*<=Uh= z)q_lGE>6eeBaYL(`xH5m&PyORZiX(r^1ZCFo|s>E+-f=3lYMxP7De^T6<>2?N)gF% zSxaeqVH(jl#gZeIFD!QGbJ1kV)n16V1=c|QS=xM(BOr;`5=B`VZorgNKr_avd6Ok6piHMV`y9}jYwY=@I6q@!IZC-Bh-ko9c^t^sFdnSvVNE zJRrqga+c+^%Xihil=EXxY|udy>GMg!v;kWZ!jRtRIJG>Uhk$MG`5T0w>r1Z+?K=wk z>krt`*gMVF^O&Z_I+&-WFhjod^yqZ9}5cWH|Xx%Y0VCQP8RA0 z$E7sE%1StThB`ysy}5d2C?XhiATVh!&nls=75Pm43fjA8&6e{6$9arh8ieCKCH1Vf zlYC(|zB|&yu;arBmrqFU)+@(R-!HGcllCBMH2DqCbkB3Ut8RHbJ<)qd?(dIrB_YVx zGd7X)9BXjHRfEDp*@lmco>UV4?P4o4-gY!XSt&y!qzFsp^rr)z&jtiFq*Qh_#&@-s^RCv#<=X1!B>Ou9WZFD65ahnk6#K{>|3WUcSa3r zpe~H_M(5n`!!dVm{79(NRA8EpNDF$W+jQaL>rxFDHE`N|)JbAH3GUB6x8vMy6H`$v zJUQniHN;QWS7kP=dlB_M6D~9$*+aD~>%TMkQ$lnR~I{AHEW3A;d{v$gH`$Nm|=&lmQRIUcM}_xry#IBc+3 z*iMY$n7G}U4=ch}@gpCE1bvA9IbswD69Xr&I8#h3SEg&O>u>dJ9PHTXdAOhhy@L6* zidL&(EDzoveST#6O{~5-)mzER%YUnBz>2L<=)*?!*uBMz`0gKFWI6Rp_~mLxC(0Sh ze3Z1~_iQS}RH_Pv9)#DqXW)i2-XR|T!$dXUZ8lAM-@}h(`|?a6PuSIK`FZC_&Clgz zD>sN6h(;49aVp`bt*7F>3PF8)H|n*KCFatJ*FMM6E3nXPxKP+N&Z-5QsJNN)IF=V6Y%MgxjTeh z^VdZ2iA^I8jd{(JPl4x5*asQY$&2Ugyh5AoDcL0I8qSYKr@Y-B_p_i6gFz&GFo|to zFHq=F!hRP&E#fKTo%vf6`P^Z)y2qWU>%8+Px^GWk>9F$3FtzEVaAuLyU03R=$gj`M zcX4i(I<6dELlSg~4Z8gR!akOenhccT+O2eI9oL7ySmHB|@afosL1);Ylu8}J0d#JD zcoz+;ALMR8oZ;`w=dgq-FC}W1CrH6z7Aw#5Vjq=U{EIcJU;+RFkgR`9CzSIJfE=AbZFCKf4D|&@<8wp#EnXDjokUe zpLZWs5H&0EMaLO3OjZL-csa|SUwqUJ&OL?H1U4m}*$k?^!1#mRP^O+B}0u z-J6ea*Yi+UmK-ol6>&-Vpx$TwL09)aF2SeXN{IXwyWD&jlNhcA+M>X2Gcpug(J`gO z>S9}XpM1u750Zshna1$! zJpcZFqz>5}Pc!9Me8XAa@J5h?MMLK&PeR7p>`xz{htb6Dp0J}^AW;!_HrdyvSBtN@ zT@=1WyyJ&_jvGk2d$w_3Xxn%3CI8H(j#uiRW!YVjw`ZyC)TNhj!t3SWvz^pUChwU* zZm_U2+J0*)bZStp-`Sb)!-RJzlwh{ro1@uN+iJ+;y@I}GEdGwyVu%kRV@>v_kI=*W zHd~h?vOhMah$EhGUv}$LF2n0|8t!>UqATS3tF{d+$>eEZ%iIe8DLAa1^?@l;cpO)gv(V4ToQw)ee% z_6}Ay)y?$iOD^o<(ESgAwL)>JUB>3a++pJs;c?HJH;$zfM$Pf$6FxdR{+Ba}CkfjI zIw(8+D4p}#`JPrzkN5O17)4KBSn^&j2MQp--nTlIne&%#lume981H~oqx9AJj(+*n zQ=Z-ixx0VmaWp9u>akNm`&+IkzR1pBUe;oESdU{*Y(CkZkL~HT_n(Ldk1fO2WL;lB zK6(JznkDcNOp#eQAc_Vx{lQhN>fOu5ukO3&FKX`y@DV}ve$at^Vs#zA=FrQ8Uylgo;}sGd?Zv~uZ5>Xcfomf=1$B1| zlP_HcII?`T0)_V6GE?v>U-t zS9CJ_glJ6XsBcu*1CeOLH%Sq^ed2_|afi{zGbxaFUjq5^%}+;d`ISzDlO@k0<48!` zOHgsCBDSZZxy-w4h315#lN2H!w8dvcO&GIb12cNw0)_j5sVBSRo7fPtZe}dng)A9r zmQfP7cI%igNroocW_nNegQ3j+Q=y!_?YAQ1&pxJ*rj$rjc|)iMkUZM#r~{S)*m7yz zfit;af>ZB3wfUdDJC?B1nR?V}Uq$=^$Mnj)nP`IL_ZY3g`!#8ss9nCB?Zb3ge&i^{ z%X$RGYpS9q!q1$&KRF#f%f5q?e-%}(41MxVUlf9Rlf?S#%u#_#p>C;R%e@E6SmlbA zpA>wX2;l~_)SlkOs~}{ha+p2q%is1mGaJ&I~@N!9*}&3pNxx; z=T$CPYaIGcJLHE2gw^VZnkEEUHGyDXeXy}I(be|N3UyZ<`%_-~L)|dNd zscc?e`7v8cmPs6i$)~QA2$mc?C`BoU!c>Z?R7=LAz<8P$mhw^+g;ua%Ezd4F%l(?I zs~*9uOR=)*tSK6ZR*q|<{=j`vi^Qzc>n?YuEH|H4XTptDB+ZGWLFz4b@%Ew>neZ_? zNLG4JKCavwNk}`*3%QGrfND(p(GTbVdFnjaYp^14S?N{Dsn!CA^1?@mA*C0i)4-e3 z%oHD&ulG~nNUh{x4h`Oe4gRlTzx#e##;LL5Sybf;!+KPGz37rtUTJ~uGYF-O=XH!P zY}Ix+=sU}z&ezydRlDIW9J22^=#pBc<9nmwUT5rzBg>{5K(b%dLn;DIdW=24vvwSJ z?@~rN5XPz!G9u9|#jsGFRZ1Tfql?B!qkB^zEyBVJ)LRk@KjH8t?2Ch)Tj7#iT7&U4 z{PO0K6v-z*3Ld+r{M7a_H+Av)tQc!lQSm?-f&hzsP{fC5gYHL?+Nij{J3uSN2hKBh zfoSusk+>Ed6>E+>4{`fNis$VrrfG*HCCi%Kf^3W*b4!3oFsL!Nh1`g*tLRH4A*qXI zXZu-&^D+4kyclNw$xy(?@T<5$#ezY_+_32SNMm&3FdFH2tZLkq%Qo}m!=uI0h=y)8 zDW97mOw1x!GF}E6yt^CxcZ+3eiHsgpxl)HjI@Mbb-tJa(Q-2MqEMGodVRIN%SmFGA zi~qwTTm7pw?f1Or48iO6V5HU?e$!Ay+UH`!@JV`%os?Cqqj`PxuNmTEdYUFeCvJz= z8vZJ@s!H5LwmE2TLeyh#!?8Lfid@cPN5TXlzNojT*q zhbYDK`uh(Cb9%)EsKRB*d?3w(kMbIrzv9H5z0w6CWE?k7XAP~rpFPI!rTiGguPV^u zR+4YQ66TqyHA90CGkiCfj1BE?FSq)=+fxhV6rh+5XH*%{=1)uY=%4$@*(2GwJSfjpsw+?Wl4?mg-Ea6uB47*+wjg4%zi%R9!HSZXl4RLg|kXejjVUskn zhCz5!dRQ(LWfcPQBGCVk{L$|1Rx&j9sVejdmPty<8RG9P+5#aidzS zuFHs8!lZR{x6C=VmEdOFQgMeS@`Wh4KLo3>)8`#`14V46bNB}Fo=81|f zQq?$XKMaynD*NRQpbGqpVDPz&ev!G4CdhZc0ysq+DxB-WeoBP9PSPtb#8ht8wsGg6 zB}=T{K~CZfiAxo(f7%Y$k^Z#mrHZI3o1jymv0&1TXHD&(cDn-S^x-{s64y|7ds?-e zBJg?4Cetv`#!*(tT^)9+r7v)6iNS15`@48~v#!(p@Y_O^Zz%a%xz$KbChSektOWUr zS6Mff#(bPG*)u|y8EV#w(vS5}SZd2Yz0{NP#otH4q!mG@;rb~!Zn8H+ruviybR$!I zw)evjajNwE;dg{JNKg-Ll)&|6TRC6#P*LBeVGG@M>xEVoN(aVnCbUmBX!TYU_xUCT zQZwNlo>+EXD1cY>yB^TAbZGL9C<^E8t!Uf$8hscEfc6lS(YAFMgf0KsH^ur&q9L&8 zy#COE_R)E-1P}{#j$FUc-xT+_uoA28CvLpu+}!YR``8GDnI1N_$eyXm*usnzpZ!rA(d9UKrrr=`NM2$pDybM$Ug-(dx&V z5xxIzzF0NW_LRqt7ViE$ozUnvU!fag+*vR*8y4r!JH>993A;IMvR7#36w%gz4K-Z< z={0~`u&PQj{wv}FuRh)pN>pey`0V9R+`@2Z>HBK1_L2PhYtUN|g9dV<79_kX5;=Z+ zdxfBd8#j7K*!7Img?uT-1oZ@f@SY(k=fb>RT}bqJ zf-(F_%TswGhMQ!q<%W{t4i4$wM;BMmir^CsG9YC0)=eK?C8Rd?hoM*~-dmO0(-J5} zN0O_4Pc^SS-0MpfAc7js1V}auaFj-?(n?2iU@!CGlDE^EPLvPx ztX|0mRG{xJlTjKUu8y#;ayd0OxGQ`ec`ON1g%}n-2DtL!HLc%mA?Mnf$V{@03HzOC zeg^q+Tzc2oCplucmC`jc{(mwpPj7@m0J~&Bs)(Bh5^F{9ZezF@sq1a@?e5Zz&zde* zsnl-jmt$4;(b#_mB;AQ#P=!L>W(3%W;xb|R%m9AbFiFutftk#UYW^|Fdcujc|Rk2`Mrl7v^x6td})oBO0Qc>C$Nv7a25zt`Z4 zZVtUK_`4V*G@p5Q9K~Fx#zU}tZypz@6gVuFI z&O~fv$m;?DySvDY?V2>zZIvlWr^M#7i@$Kq@!MP@dt$DFm<_$9 zp{@!l2@>~e2q{?IBE~Uel0K(O1>gFgDGB4Og>{lE#WheU4Vivw62nelB=2|EuV9`R zzLkHG_Tk0gN7__81U}3;Yy4fY7XDdz%D@=N%2V^dZUhzs-U6b?##cCPB=++&UCYgo z_`76(eA`aHXL=E09Q}8qRaRo5mHwJ;&hU_4MLd$Ymie-g?#xMkd`S(EfPoPRCB(ia zT71HA{fRH5c-pKVchy0~@dy5lY=5N|=U&=OeJqM=fz6Kr21Nr8CPP-9qNiXWu!{ z?C@R51dQ((a*>P5PZp& zKu88CRA-0n1Sk}x0V=7f6w)`pa7=Z3?uCrnO7wU6AiB{xcQYT}6w6L47V|gI?g60* zFNKXb(jIv6Y?mG}N{&rFZhaGWX%4ygb?c_>_$4a2YQXlR*_!#$niY0@dSl3AzOpx0&{_?}S zn-6zo<6g=XyUq;2xA2PRi~3i~4S)1>^M8Mb>VMa7`009Hp~HE3Wml)bHJ4OYu2eQ1 z(jLqWDxNsXlK^XD{8az=rz&LHAhpn{0dK>j$Xu~P2j##1nzyJ!IL8|2?w31b@|&)- zxBgp%xiGmFs!Kby;!|Y)uwv}ByJpFyo*%2dE<_SkB4E9~EC=Mmf0hDU-ocaN0of4= zv&!Tvmj%m1d7r#8*a#^ZaF+Fd!UWh_g?W~bcG_;3IUgeR(-WLb2J;?*y(fBL^&&F= zCWcFcE;x<%4zsl&6UBGsaWd`W5DPCQT=`Qr@RM}ZdU8SWDv%9@ql~s=Bf#nL8|HLJ z1+ek1{cPCXBDn4A!SnBDVqxmTO+qO`m(e39s5N(v5j`1=8sh6x^w&35fW}JIbOZ^& zR|h9Vvg$&`1#g-riAN}PHB$ut4+hmx-J%`?>L1a{G59Uyg9ct}m!Njo-PBig9o38p z>)1>Hv@)O*^LZ5nU$sUS46K0^W@k;6*QALRyF84n9O>OgDM}HVQ5bhen>DDU_57ds z0Ccd$b5pu1<#QydocA9xG9YzU|1hYR zDr7=|CreX&ry^!LeXW#lW#M8kM|yM=ZNAGrX3yC~K)3J;YXkBGcF_2bb=NZ%o7xml zo-_w$pn(?eopI+O+`RiRtW-J$&4BoZKKDqqKb=|cO`d$#9sS1nY3$#yS7a=F zX$;Y|Y*GDITXXK~hhJ-Ne6>-+9j;e%GHaN0IXVd^w?svmP?*6BzS1k63gaHv} zRT6aETrpU*o9)M0?%{TR-lud+H!YQ06&B4$quXBnsPY|w$=keyb{wlRv3D0PU%7K!>@{1SgN z7gpWyyR8?`DL(~mMG|NU{Y8TaJ6I}{|N5QvUo;qO4;j_?qwmCh2|0YEVcRuJR~a~> zl5i%=b;dxNlvEjyG)hmk^J-$SvCxPplKYq19!>J`zAoXZ8}Fd?nve~w{m(QS27kzN zhY67!xk5q%x4dlFu=s7!fe+>XgROCTVX^RRCXL$oW0lHVRMk`mnc-Sc_POqFa!-41 z?qL((PS3}`dDSObi6*sI8@**Qr8?gJ$A%cpL*k6-QyXJGTpCqH9mp`n@P_Q_cZWbq zZ}Rvk*{|`FSKHY>6dy0~3EdS!{yH~m#+z>_bWr`BDuPH8>1OOm@ilM}I33$2o=r7m z=VDFL^87$pBn&mV+^cL!EWHp4_@B}l?aepVr=%TE1}%kEuk>{onz9e{UXglgwOAKr zICpMyh=|=i5R#?&eQsTMrnx=K_%AHZrx)tFze{5ni(%Ca4$tLr7V$5&q9PCjITTZ% zZ+3h7j+$8K?+dLu3c}|43;v4??^tF}$sD&bNoK38E4Ir`!Y|ryt*uh*DGS83wsWYoRwv@}mw0ZgFu!@gY{1L(qM8cfIiZo$K0W@4Envc&xBl2Id`E6t2 z!<6IyB52nqw#7NVMJ!qr@(|@x0$WH?!I^D+*4$%K+gBMWSQ9*VhJ`u<^Rbz z24oOC03@utbZ?v}zT>>xLpjumK9w+;uxJwK0SX!HYKf^_$CS|XEVoqfz0t(5_{r6O zHFC609{FIRmYH+-MrG4?TD=L2@dRW{Jp(c_UftW%_cygFP0Z-|moe9Le?-Jo3q$Iy zm(^jU`FD2y!^b!FhbJY#ud&9x5rr4T(m?U*>gVCBlnlMA;Vy;OW5=~C>wX8$(~Jw~ zYlX96YdsMsWDI*i4bbQ8dah;SCX-Sjn`?7cAsCK#BLCPeM9rn)eo}RO)C<#D;|{I{3BB7zS8E6T`?_=3TYX#?Xqa^P#q9DR2TG z&d!SQxbbGw{{ng@XGm!ECxC1g)Gzzx*oUbEsQ4MvY-+T7D1S=t*y*bi9-c-{e~p@h z7FWub@^5uEUzCjhx6|I7d^;1!hhpkYsZv1~-9edXa!QCD8?Z>On zz{Pc6L^;L}NAoFAj<$D!7sCE~m;Y19++xMrVZBD32gSxRc_GjO=5H~@is;wqK{TOc zZT5NdoUOkVe@#g6gBBaIFy-_J+TXiE5FDPl!rScHDjXJN{#vxt-F50OB;!vjH^;5{{_ zO>Iu*+1i!cNm!)EXW@K^x)<=L+F?fz%r|!iX*qZ{$8=B*U+Q0sWJ`N+UCG&c75uo< zq*MgxY5%-~0>4O_$bo_@?+Cs@Qf;F2^?o1|=y%J_GY`oA)t$SGG@ts*^l&YZ8u`l- zn(@G!Z&o`emX;OizLOUHsjH%L^E0Sj!_&~~f`e(mnYq}jJF9Dk_}p(3E9vHcf%;9} z$E8+8^E;y>r;E%TTh{EsW<+K!hFrG%s_w-OUDA1oe}SK@vZd;G_aet(#D86QlSx%K zfAKt|0!E**jDwnNz2bnY$lgKn0!!O%gYIx>(0-pldE>H(T-)HHZKb%ewnJyOEq1xP6-&G`RTc}^vI zh0^k0L9gl`{yOK{3+l4L=VIN|`M1q5XL=7$me#2XA{Es0LYiAEPVoyLS6IRFm-pv) zXBzRWX%Jw$@q(g__YFZ3)_;SbTYzLxOt>&^?_KcvlOd_IOH@hVttp3kp54}{>U%Af zIk8EC;@S;mRcTkLgtJHqOb`ISbI32Q?Pb+wNwvLYwSL<&i#ZGuDzwiW8N?81fNox2 zOPo70bMbfeTA0t6DVOvyPO%-&xY8w9PA|i|PHPQhtC*K70_RCtBwqj-v|Pc`o0Siv ztDj}t27Xn`RRgz{C*MTHyrH3dts`$={C~Z~-3^+HhUMEs@PZte*wwo3A-4Oth9dmr zO>6$E1%J;^-00XaXo`4@z@gyonE7Wbhkx}M%Psa@?Q*=sC8Z8bxR9*?Mn(3p+zLEu zwmp2DMBGP6Ua$L(yJwrSYtx)Y6GnuIMw@)*iU%py;KO^wC|L>#e9#LgIZ)aheeSmJ zuaS|O3+N4xyVlLe7CKw@6b&gGI((IoS16yC>DlU17?5~vb?y#;v@WD6rD3Nxbn{!| zSl=a9{os>b_0t|~n7a@vKH=vQp5_*ql;LAvOC-IK5W{heE^rpw=-p=@VU(e?>Kdnl zNcTt0{fxBg*=fF$k!pX^ySd`3bP5g=V;5L6ccqqA^7?%LZ`d>^-`IZEz}D_3HwP~u z%nX^1QiUiwBVHpm?avNg3Jxsn7g48{DY{&kc!{)>O8FCGumOs5zPSbPi~KF_R9nky zXHJQXQJ@q@`NT&?XQr(h4eb00to;U2`cPN!>_=V#!lQRnp! zEgi;zjV$1ojuXyuNA1k)8oc_*a}T4V!=WPt?#{WExV>su_HSS~r?9YnF<}_6Q zdbfAeZ~ZiX><`0Exo~HwB=9%=BC89#iC1r?EO+5f0{oC0Xr1nn(#)3Ty6j2r=|0=> z$^d0{OvoqP2ZAYDPzdqF+XeW@^IKz+k(@ea#Eo&JPUsl?!FCGF;_R|xylJE*v%NXtLtxzxx0T{v z6mRhNDLeF51>Do^3Oo~RJrhrpIi=g!&=J|M$@{J@Sa^GeLlb@B$VU`qRjSi5oeLvJ z9&F}cCVsHiErcsY{#U7wy`!}F zuVj%i#paM{cl$e}_^aWt<@(I!t=1!7=An&<%mUMZ3&bs(-G5oz;T+q!D>yO;=N(gQ z3W3?6QfV_`FJa54(>^P+XLA`n{Vd#utEvymIy1qyuj2_|tV`TI(zZpaLOu=at-g9L zpJYF+20HrnlKf>4-zYZ79cO(2JxR_6EA~vp(Jm~#$p2AOd4RzdS`bo_QN*?q1ri7`F1p%$NqPbD&ir; z`J(j$HS9;;X3a;bcR)cH9;=A>_pFwB^!d}7nNNK|OGLT{K1fI05c7^9)5;FF$yM;u zdsAHd4e8xFcrJAP-u6ELWPD=HfdA(p$Ez0jKyjk-yXl3`P*x7?E^ImUU40O=l-nv{ zN;GzSm;Cqtn6lIjJgXXXRC=T5i$)3>LZH#{`!*upq7 zyyCtBC``iRLMnO15ItDqP%R&Ulan`9bj6>n_y?5_Z~L+}y&Y`lt2CI8e5SU!GIdE+ z_rIZ|#JV@1(RlB;m5m1S(WT5T;bGN2o`(7)pS{??B7fq-+Vev{JNFr_$x_TQA}b}} zSz$&)Tnpk=W~C;lp_fPNa*_zMRyz$|5OT6=s$$}IL$1wYZ?~js!}TE>P`L}&{A@V( ze8d|esZh;WwJlV1AdE2Utp+bg{8#wc#PO7i(1rH~tAkT|!2jyi%)0la7?P^XbpDSa zPazvt@dhGl_&u@QG%2yg7c}SDZr<^~YMn9-^!iJ&MSWR>-91`2mqdg;B+^h%AV?Od zw=n>3yTuI0JiGMtmT3H6mQV@0kT{n&yi*2ZXSRIu9=JwXu*)}w3-MzU=PjRV9@y`{ zgy*gsh)^3wH)&J6gJ78EUF=S~z+h7J=f=fgP`CN~IM4w}%W*3soFU(%;YK9np96s=i&Spfp- zUrxXKxUzI5`cO_SzbqMAW~VFUqqB~S+CRRvsMDm@kd@iXv-1c%bGh+A6OtCuavh`D zu&9oKoC0*)3%v)>HPnm)FaOz@JgRf^L#vyDVOm+uS6wJL|EI4+(Y}gRTu2Rq7=JfpK)w!AY<$09u;yAJXN$6+jp}$AbbbejlDhvoA{bL*0HVtl{PaA=bDuh1XLi%U7T@)p1 zL9;_9YoQ3|Kohw%qCyV|wf1p#8^z6=U2lk0_8;%Rb-zhBx@J3IGU9H5UCnb=Dp)z&5 zE^U+~s0m5XxbC;z;u#~wZHMCV^7vtY=@GrT zEbMap91hXmKzg70lq`>YIoe zA8fp&d0J2=!R1)3B=_aa(mz3=YJTj{m>+%0U(45$-WxgAC_qmMn6;uOv2H$(>_M-p z^myy`9C(t~=XW4=h%ygW&$@j!EpdtoA$r`goyLEY;$U9F0?n84HSd+iaKAwRndOt@ zg6DgZdJUv=EP3P7eE#=3x9BpgcGF9(Kkwswxq*5YKr7)D&i?F_d{philTzN8yU3tD zxXb)rD1DXvsdU2FFAu(`RqAl{mqqXg@qbrvq{xYGp9?KpmCN8K>#YGqUp_K5gbIrX zOo<6x&^&|*{vbQxE73(eD1n3m_}%o$nLFZqF3sGYPIg&c-n4`-{c!!fb5yM0%3m(< zN^<9hi2n`X!O~`U`bA)dyGp22o(o~&&rzlVIEB+xlN}A@EKGaENk<#8LW9;(TxUkT zZCCoZ+yVY+x^jf2umhnEL?rn`Eo|@w1Eo;s@6#>+=3K3Mji#@+4*LHc6GhDMhEbX) z%v6YJBIjXYqjk4W_;kki`Q@-*Vo90&Hc9HLBx{SYm;BE_lDY>xEGG{m%HXtL0-wZn z$kW;;IXB%%FaB1+v(Sq1Liiba2f3deMVP|#B78$W?C$w8jtjvCJ)bRM zx0+y~^$nc#XcN@`yp=dMrT`n{R-u}GQ^g6>mtjBW$*CURdEH=9l+^j3A@7WeS(`x< zPd{P82A$k$WXrq4UQPY*C_qN07=C#TIDFx-D{X@IXKW)sZ2NNGbli!gi~+++ ztorenfxpn$$cbLdGcv?X_GalFXEVQDR*Jea$w%Wt&WBNt!14>}uK*te9I4($ltrms z+=12K8`PRovC3Ryeyk_cQY*kWE;M_mLvh8lD!px|VSwmAd+uc+@czE-3ab~}y3BQ) z3d4bI_v=r~^F#Mf6yc<}bCji%lj!b7NvOj=EyLy(zfoQsWjj0Ns&U-zn3+nGY6pL5 zF`gxhB~gifw@q@vM&2%r%7-uK+g-^nX8B&^T09*k%SKN${sVE!Z}0E~=lPnjU=58rZQ zuy{?1`^8Yj?=tqE&Zs}{D?&uHOoj~)*^7(i`5#6Gq)a6Hv`b;saXkV%3N9UZ|J!*B zwT~cikcCVMbY+TMT-nX_z~7g8uap-SNA@2_t`>>Ds3CY*o^tKFP>O(kaLP$Yw--hZ ze|D}M_XaU2-fBH@{uunQe%O+^4=>CK??#7B$UjD+?6DCU&vd?DL>2ly^&S?cd1H6< zpnWoC>Eyk)Uft6|%70@NxTp}@*jc`%ylP{>t_}bnIXH??12?avd7Bq4I)5>AT$KN( z=Td9gi9ufeFSi4*2ybeL$;lVbuv|$F;)QKzJ>b3fcP|bY8fiOQhVOL;TPv?BXARHS zW+@uqJT0t(2f2q7PCA@H**b;FI+W(HJo^j_{=?1HFxn6EC`*0zMP_UAYTsnIPsnZj zAc>UK3NBSG-J$Q*ed6*T@O#*x;PZIPA1Sx)4D?4V@%?&D%9I=jP-_r(!%fkf8Co4vzF<@J+{&MIZRbKSR@>pS@yTllBkD>?J{)~epCQ!f)>gP5 z;waVr(k>_oKL^<6C~4&GInsYH$jAGCgY)H$zKPReL65(04;RkQGHhU(s{juc0GpVA zYrH;*FRXneryu14$kgM7JXd%7@Jt?)ed|#tN#~8Hu$R=NASio1hGR^)8 zaJDOs?9h%DGr&hCckI+y{{gg3E$)1V1>0wtjEV90dOh6dl*ckUv7Z=d_Tug94#&ny z9<2q|5c|*S6Tn?Tlqyk82xm;bFeVr_)+M~4WrF)jlT6#dVGS%>pay$V703^^yOVi> zy1>~E@bNFuM){+O`n}N#v2~)7@Hk7-kXNmjOaqJ+>UgE%42TVF$otI>a~Hlq57rutTqdAZt%>ya&XG7X9-9+VIr1kZ#n+irF7?{~{W1^kEODy;a%hK}{CcLd-)AyvJ<{ptR^6Z8t{4APPe!n za|iPdVR_R%Ny)8xWzsWH#oFW6=qW&_zIvF5j5>So_z!@Jtk;LN^Se|aQ)Zcz$@(3; ziGc=ZLvK}Xee|1k?hIV=$Q+n^OSremWAxDwbL`cQzxX`DT3;%#0J zyDUxExXh$hPN=UTks|B;=@&DwccbAHSEPO=R|c2+pGi;j>*Ews?}TpXs!DaJ{fNw6 z4XM(e(}d3WzdG>er=h$OcPc0?cEV{&?G<(qM=bIL0vF$VdbeOaY$CWwp~xvU zOKO_-{e)z0ppP$`wSdM#J}+veH9tC$A>STc9I`eVj6*en30o+rVq*Dudy!w?!jqOB z`Qz2eAcl}#b%r13pmttCf`;+@1#u`*k?1RhJMPr zVMSj*wS#~AT;9O%eY4s}1oi8>jEa&l&;F2ib16{|a^Z_G!O7*$I6+`rtRXAw$z`yo z?vtAg$~Xwj%B;W^0ccskjY%Cy!}qp0?g65O;iBZk#2u+X)xfkU`-rzcO-Hu+J@1tk z|B@;;nV)i_Rf0^J8}CcxS&SINT&6OqZl&5qi-a6eY+;Txoau(PK-*gku}Rp*4!w6b z6dnr~7~3#1+E0itVJm=9KP+Ln@CIY-Mmm`^tUv zh>WJ#fe(r>J~s$ta$>^-f=~)g6LPcOMae+3^60~fqH&WJ%tLB2 zuU)@jlW|1)b)DE49hfy~jg+gx?m~6qa7Zyirs#^o(y~_;@?J~0-dQxOCHDn$0o-h{ z;N3BaO$+rD(EZ8jk2ucT-^LfVi)s@j8cZFkxg41$#MgaGDa+9?t!bv)s=^K>s2A8C zT55P%;Argx$yy-8Zi@})p+O#$z}?=ktof-(B3c;ELinPxEJ|r79Em)kaRb~bn$zRrI_T)~H8QznFgzt_n`A2!QeDMPMW&35w zVWFFFk+Y^pP+|L)#@jyuy(;7FJ3uk%J zw=BY{)&043A~E!bPLgASs0bqcr+T8DH+xZtf^Tv0c)q6Y>xbAxd5>-)4@%+u&Qu}> zzeqFu^5GbyswE8RwSts@{DZdIrvMIvR z3=MtdL1g?q&WFrgDB>e~{pzhT3|Rf-pg(#&vbQwM_Dr9DE)BKq_~aksUJ$J|t-gs( z@KZR!#$KBHmL=OK*~B6S2!bmx{&yg+VH1aiKxuLBfTz?A`lq9$mAS=939G8-xdmjm z91Oc2b1Wb}nHlo~_us?F3X3b)U8HYY3Fc6Q^HU4Wl!FfeyWc?RWqHofN?;~MtwRyQ zw%F%KS0NN}i7U)G7tVr5sXOSSAs6r=$Rsl9rD>fz&9^7~e)x|`>5^JJs6JbF){rUh zv_~CKvFYIAzP#1&NBf3*RJ*`^;X$*3)^Kl!TY8 z^&|Mt-tMa&ug6+Xl1ymA>JDdg=@g&vZHN>}bNofMt~(M-=$N|kLKFH<>`=nI`aP#% z^4>{ame}od+;VG-!}6cyGGf#Nu|1=|w;lN4@71JS3u3=8Rp1`Y^pMH>e6qYSx{oAA zCU>e7?6NhIKP;#m?BqV+adQn$t}*jr4o&x4m5+Fk#5r~ZN|2qcvnYlu%)w=fAW1h`sKKK z_u`cCD%0rI(`tPo3?x|>O1P?;;?X9y31F?AS^IU0V*ggFk7hl*b@7VrDTR<9^6gix zCC(a$)m|;Or60!`Il?x{uU4cgW}2>k(@zRLXiiW+RDtyEj#k|KAT*h|K&?`OurS#c zUnTeamTN8HC4&`NZv8VHvOP6y3|%BpVkr(< zrhU#Zco!_>Kl-yuAd^5%iBc0U-?<&CSX8DUmmL>h(N#TsYf=4kb$*Ueq{Osv~;=6lfM;R)?stJa)D%+5v!I1erE zBUVjlxWCX2|9i%rSiQ#H5UbKv;h$gV`+U1!X=>JYwEyxu-a}CLjE)Sg)-$?MuWo8x zF}Y3&J(Z#~c`bMeZkHTo7~XjAakg6Uou7dRtBn+<{f%KT4WjT2YB64@96~#A*P&1J zyi$d|R7}F*d@-Wk{)5qbV^fL9aj5Gt@cFr?iir{VB4e`~9tP1uTCm-z8}vI~>x!}w zO#3^-pv{`xGdZbLos}INB+R?2lu%$}&ZeqBe80*HU~B)k1_qN~iQIy8WsS6L$VKUp zf5k2J>L|sUdvd)(fz8Ff{wed3G4}TJ7V*;k8nPXvC$T3bY*Rl9;629sIIQIr-N{A?D1hkV&+nXI1_D5fgs-Fwd=Lzu)~l zP~7|2Lc14}$q-n)zK8|W{=sl|C^x7@K3h+lb4-n7Q{T#m&(&7@(Hl?JIcbjDutA-W zul_WH&y4R34YRDD{k~c2|J~}X`1agO&eFiHSwvjO$qyZ#Gt8~BOr|cqpX!bB(!dU7 zywq7P5Z7Si6ZzT&d)sS9X+(>KfN7wqre_gkJBzgtFS{G=CV-%}P}sS;>`5HF%r6_C zJ|)QJ>D&yu7tl8Q6DCtLGoE18RFDf7Kb~$Qx@BcIj39dbP+bwy$B>XYQ!cJ62X*O+uvO%fHK02{TWX=URqu8zT{?jWRemX`>9md zn0sfc&pgEi`D*W1NusJ2l#xrTL-<|C=DjtUz!__4>9_ZJir#*lGhd&e5sUd=n_>GV zn?^WPJ=;c1Z09O2JZ32mZg^~)QZ+hMC1uS+^;~~fx}Nc^=1bhL(EPiVGiTGs!AHfC z9ww?+z54O^B%CRmETUg|V}4{i=?<0P^!;h``l4Na-%8N)uIdvaj;?f?Y6x;la6{Kr zBu?EWKpE1oGulXGzZ&FNe=gm)b&%PSO0h}ug52}tA#UZY&2Zs1XbAiD!RiD|o0;;f zx~v{J)9xEJGFxKd{^yIwru_OYFPp6Dj0C%qV#to8FL)xlrQbh4^xzSpW_ZrK{lRVH z7bc?2JO1dN{Pua3y^(ZT`?>R1JiOgO705HDnvfl{w9F@B9y+kzE_-F)!Vc9z9t}37 zo7R5i?1o>Fv+u&&Igjx3q+Ujg=^v5nu03nG03tzTwWn2am-t_-K7t|U4|^QhmQrf~dQ0lY0iUoKu*)9-M}EQLRr9)^60JNqk6{faxC z_wm$ogmOXGFmSyfpSb<;V9#TL__v7Xhu+5(oLv-wFW)0+w01Sx%AV_ZeT{U}3gBif zuI_P2DlOiWIuaf7lG--!oa21t6T|$Kx2VdiIxk#Y8C*pIHP?*iGi}bd%hq}Q%KjGX zO<(m$5(D|?_p-JZfXivj$3WvyACUmy>h|qRc0r94&bTkFjQt6ag0h92oc3YqO{< zr33M+Iurkt`>Q)1{?Wr_y?G+>T3cG^V#Q;y^zv9v>|T8}>yx|Vw$GEv4Ua44O(I?H zmnm;okA7bKsuIiCE-+m5X3C?6t&1{pkf-X;&hOV>O^)|oGgkd^5PltGbc>M`QRW-J zCsCW~RDJnu=BB}`oS0PuAUcWADbvXdLgf5~^i{;4Wf_o_Zlqp6>0f$T;iS76#sQ zd#dXR1YgDWA@E|1^iO6~>v?lKu-q<>Az?kOg!0aOsez_od-S&OU>nO|+Mn6#UaenG z-|zJ~y_IX$%xRES!?=oPAIsD%3w&w6xoGirpN3t5|Myf-VT_#Ct7O*R=c~2@nM4ea6e`9Gv6f}8gG4@Sg4TI=UtUU3NLFlGsnw*=g(SWqB7Rf z3{&&$-+uSP$xQeV8!HSPYiiY%Z&f@DOHEh_Vum1*X6(jG zNR!f4kIdG*SrhRT(>lqIIn4U4q;V|FOk`qHnbEJk#SPH>Qc~#K(8Qx7Gkr(Luw0KNkMGtr@v-;-fG<)?_SX84CO?e#D&?% z`4~x1I&5dVE&GKHs9459pX#FhAy6`@c?OHiSjtPuI*5sOp8 z%LlhRwxI?mKkU`P!$=(>4$^pGRm${rfgGr|{k^EWYl z>5i$|9EEN6y_;Ql^%a*b7XIo!pM!r5x?`IXnvAw%%9}yvnD{l9#tPG|3-ojiF zlOMlXdz$6Fr11Cc9)(1X=|A$?A1AgPcS;cjKAe!>t@ujcyqJ8`<PI|R%wLLA~t<)S?eqrzi=fM|u-P##Lo%}L^g(Y@BnKtq>TS`CP|82O-*4p96i_p91xP45O*LZ56bnwDAa!hDn{Tt4T8B29_ zA|3MfHwGY&N-mK=d38CwiSqrg3q8wK23>uRAH!}ro;(x1+K-_bcB7;B8#O%JO(G}_ zZOhvbaXatb>@&B|OFqN*|C~){J58oEE!-&uzKTjuV>*)kqNeF3;^OO{2(I7dt*BXb z*OLu-B4k25gdeQ{QF?)b^7U82R9# z0Qc#SpqQmM0G1pg7cDVe#nQ?SkqN|f$6QL zn&KvXUz*b$$a5ub7T|rgZp%e2a339OCSyq69tc=VVY~to|Agb#L@P=u{uC116wkuj zwHm(g#rblA8-lhN;`6-Jc-d3iU9aJ!q=T= z&tm!!5aoXfCy#38U6#s5bTp3V~qQk@$Hv?B84NDT+8moKM#IXBZG40wLf*0egDvpPClG zYqiR`*IV}^xV*4AlE6TeX)73;y^@s>jO5L|m8*tm}p!kZ~WE-qodg1W~3 z0ey_3CJ+9TGlGk40t*6gEy+SY$r`kR`_5t{R0mp?1*TyG&^{~d zfoD;#VCRLt3)O{|5tN}}+gT_kR|dcwWXGS%i>J9sCIF6q#l!TINI?r=n7526GWqU0 znid$;+XH{~(+x_XydMg7(R7Rfp`;Ejod03_;r)aPV#Tu5BlP@D8IVRm_CaJggsW-; zs}?h~$CJO7%s&JUh-?OKG^bvVb~IO|H)1Tdk4Bbqpwvlx%RGY}$Ah6*T+OA5yiE)Z z`wmROVS%@BQ!mL=XWv@#!SO19AR<~{KZ(r~M-`cUd*s7PoKMLCDnPv`K+Qn@*$Yi` zO&m193d+E7aCyJ(E}gMxM8y!NGFQ=vS02Y_C^?!V!IQ@+g7;PGV@kqDZr;LfOZ!nb=&p&+0!Ua$dQLKuSXs|v= z#Kpiagu5dfr|$u#oKVvtDR0UZ5hW*z;G%k5;s z#zkDGP+`MN`f=V|P zdE?UnIL=w?4drw=4we<79el$3rlNa@&>P3d0=qEwU=_;U>7^m+0mB`%| z2XimW1Q%p-#loX^KyL->Ck))qf8EBTtHc#pUTnF2q;(iO32;t~bNu=pJDDtbW=*jT zk_?Ks42A*Vw#3j$FhmuoT`dVSq-H~nw&ic_gqk40O&2wyoeB;Tjg*1DLrhF!k)M22WS!jes2lLHl@@{=fOe1e-^ht{*fgaJ_O5{M)l+y|07~i| z{?zh|Xk{AAmLkX<3IyHw0UcK`1e_-*(&Nc8TmC3GORgRAAX|y- z-Oo?jgj4+~J^iqS%5*~+I|gYk7G3a0A`r!K zcEbLJXl=e4%I7T4?@4Yle!H#iS^Vk4QviSOXz7Y{J}h6z_?EU^m6ApkkU{603-DlK zgN$$M8(dpg`R2xBBOstf%EP23AnSwdDW@G)c#G18rjfP=1QLA_uZnUlRM_HWas{Wk z-)277wl%NL#P`$SCIQoJu$*i4YZ}F&mz-@|+xN<>y|u?A0d;lDvy11{IdPJz&|$HB z9AfjNN5T+VOUu39z(ZWj><7Xu0`tuPvdSm$S3 zRIWMGn8!4ywn8$@$L~kgfoK-lq3SBEIe>?`O;B{-f@G9!rZeo4D_>a-HIzU!ESMP| z%pHg2({!N?VYymu9}fUfQ(Kw>b_&bj$XX|j%7Z)WebAv5pc>R`wEwL5us|$WGn%{B z=G%6>J)Yb{Dd0gwl%a8EI5vHah=#RvO$*lMx$GY0g{V#&&O^YwP1BQ`>}6WTOb1~n z^lG}U!&M*bpUGyh0J_M_*WI%fvIp`qRb$b7?o|$^$7vCj{VAzzV8mLaM84< zd54h!w9g4%;1@3fSUjK6#9gj9&SK8qVujFN*#6(FPrqBN{WX6FZ_jA{RxPan^m?~3 zm^U48b=@^BykyUtEjK^A8qj(>%EX-i+*5Y>orRu-bM-$5_9m|Tjo-+qgGWQ+_)zO7 z&1a~*U3cc{oZE^OCsQ_;TP&ARiPZ|(1VU;eormF@@NxXJ9KV9oWv&IlnSj*E;t33U zM&*tIDjrxd3c!pdKcZylPILe+UB0PhW4wDapz+}NyjZit6r~anT?_k<`EB1cnu&ng zGdH-^obPv__7_Fp_Yua@cva=b@5V=y=iQqxvo$=cQ@?Wp$d(|{AM>h-RV}ES9WI9o z8Ekx0EKmb2A=yD!g+OB_LZprE=zf0h=M!0!)F2;MXkF-v(fD#j?lMBN^AVb^WHY-B z&P?lSJ=;-}*kJ;DF)*q@Z;X<xXW1kqm>_EF!JtE}hU0=x0!%5jF)Yy2lJn<~k)*L6 zofLm!=dC;jHbD9l>p^B7@x#U6>jY!<7iw2+qnIG~A$Z^EU9LZb1dVFiK*PmNZ{g{J zQ)KME9FUJA;@umhu__!Sdt{)UHfUUycIZm96?Dvt1zM`)sm2M=Z#69cL$EBbD%n%^>E~;3>6#5l+s|ok@`aBfT(Olw zSzbCR9FTYAxsWnqLvO3_=qvw<@!E4*5}XiFuoTs$>qye!gSRKT2VGfd7LrY8;4@6n z8DG!0T#iS$7ayr?Uc3qI!juDb1AD+8BlwxZR~aY6TZwPlo3#Q#rY1cl_JthBm0kxn zKYsX9IS}(a_az-*ZEKz&N*VjNvK~x_^>4i-Wwv8n_^Iy)`N(kkYUoxHU-3XR5GKo7oe``Ok z6@F&@mSxSPmxyBcMsS``(~o`^;@voFrVcTO4^@roKqXV`)Zses_QIXFi)BNZd`A-N zZdjn(PCu0nN^VaqGJ4{EX0mCGCIL~s{}Z$RGFy1RKLdr!ZKWnMsMJm{Ez9mV9f%4_ z7_&ayXt(eB2oF+{u`-Y!N%_f!5cI0>5@x;6^ZSxm9Go&}kgWl&mOlM(Blu3zs8iDD zT%ot%#*amWSh@S%HKl`aOi)3qQK~_QMqAVZtAfABtflTJe5bh^!L>R~I@T`9%k0H! z$QrRqk9+z1vLIQ8Ju&)&rsf&vWg+$-o2PGwb}O@RFhF%`>P<`^r#4#$Y(&1ae&)A! z=5`K1f@Fm=HvCdIGK-wY`{+#WPjJj|!@DdGVunNrK$fiWZK0hk-b7+hmsFiVLn|X5 z?l@5J{0j1Dz3bF@yl9kTtC4HJ@RkAP=VW$JLO}(Ga98BQTJ7X``CUt?w3EKU6bcoP zY@9m~XZmgt^udB_6yg?At(090?tCZkBS^Nmn6LIk=WEfhao3ckPRgN+4(>R$OdHUz zSwH;AF51j%XD)$wt2P}385~wRk19yKfw9=~CInfeDi&+z~!Ouq{(+Ht#e*Uo)nEsjy48dPd*Nu3+fgM zpEJC(mr7B|3<8lNjc}Cu(;7TLrnAyR*-FDYZK}~g#zRB>Au=YF1?IaLAU@y2I^D4O z^%+7CUG$6qr@U^J^MNA{h)~Jb?u)hZq@EhUgu<=NDM6)vh4yHmH67J69cwubC}@dK zj8Q0Pq}}iy2FSG(7<#erVLf`VD{ z28)3@u;VSj-}bPFu!Fiy=!i*xsVi*IZfp@3B)V54R!t^1f(4o;n$p=(YPG)!1qB0f zT*=IumKOk>fZl|i47eRE*y(8jf1W1S`)Y<8uRnP?bOUr*nK2dp>#1EsqY^1-iPmv8 zprqNJ{03-AqN1QHJH-POoMSgctK=g!7z+XgDWzxQ==h`@8pE(a!6p{=`{Z;tF+e`_ z+L>L&E>K$xQ2SF4VeK%+EnRQaALz`$J)J*qCaPZF1%cYL!w+2QT?s)o_{erQg;SY^ zV+WvDrejwh&Ia7sbwsgWHj{Cw@?^m{6Lte+I`w&Vdb~Ib4^*R~(*BxZ_s2s}a7W3Y zINd_L^X@i~agR#T>nWpF*I-blV5}JMiY@QqM@B2s<}*d@1SDv48n+f*`8xISEd911 zs9ROu!;o=REN@3z`8z&{udY?Pl4y&v$eT190|V5r&;rfGao6PRiv=!i2cIun>%;&% z0zcI{1~bR!+h+Qp9M%{h%PPd9a<$6hQW;Px~|5kk1wr zN~9z}-G%$sUL>3Ci(FC>1D1{;5TQJI;|sx1f-Ekl$I%}!K}$?9 z7$Cal)@k-3_gt}|$q` z)TD)$V|3>|)`uWaC%HtfD_c8NKX)r_zeg|&KL-mjOJ*5qu%wT;kCUqtKm_dL9V&eP|@ZZ7=P;nv;6V$-W8vb&>tp81%g@8d>*R!z3k~hz`Pk}z*!Vv}d%%2Mt#}_> zdANAFTUY_$EdLqrz|8QA}GYquOuiZ%*UrBDyl4^B*rfwCkFY~R?XSN)6Chz z3Plvv*6x4W3jTk#6<2V#GV^qChq<^o{xcOdM@KKfyiwI)1#Mw4C)CWs&e_w&!FFDGY@Yowa)R+e@aC_CVXNK5l7+c|n#x$`PJnt57X zWBljS1o$8jf&cMpKC?d;9Gq!CHezckFUdM~Thx8Kb89U9_O#%rRySS5xB405c;mK7 z`Jk0ITm7((HkqBBE@^3LZxA%#Y|pEL=zMF~r32W-0}5Y!2RkU5iie)}P+e^Xcq0VL zSVAtQhAMT^lmqEEadb_$KI?k7SI?fG6Q==c#|PM5QVSu({cpPO-i95gfo!?92*8NuCdCxk$6(Q={M@y#o9z80kNr$ zn5jPY*tv~o_m{9Z01`2g<)xsMi+U#pwkQ&?=$A<{v;)9uzXtl9-cUiRg_~!m7?exON-h_p5!|*!B^xpDu&HNTsQxk(92bYmK>V%M6}48_WZS+4OREz=6FHD{$Z zq9*T6IQ}T$A4oJ-_P0+%@0eZxQ2v#vCJ`(9#iyYcUm$XE*PT?sE@z`!=dpBo3jWKm zE+7-tj95)TWx`*~8h{Ac@5E~SHvZM%tBpiG@+KrRP+qy_xLbk5bNO{PW?vfFU+S(O zW7xs$zr{4|oNC+AQh}OEVx+qK${$`}u9K(OG6GxZO> z=-i6`tDI?HBJl-Z4t`=w?lE8w2?ayr*_x<#;|3*L-!*YQK|FDKpwSY3^4~_Qta2q> zGh%!r=4{te1<&{piEl>^zxbxhjSr;o2FgRFkVp8BIZfBeAF`k;x>+UrvRhd-WZ^{v z3JYjq@&+2pXs#8uEzTogMu9v=~@70|k6f!>xpGhJ^2v{94`)x(YDa zY;()C?y#6QfB6ykP4?_FaSo=g3>v`H(|%;;fghGW_Os|~xxqIf>yFIQIHFZAQx(xL zRM}YBDV9ngy(wj2nT;yn_sE{TVQ0*bLB{tBn{U*q`jrBQHb8l`UL7A#RN3v`quNNz zY#=m|VOe@@6D6$c_t`WpTc|@61Tp>&<-Nq*`pB9Db$7X>n@PYXD^Ol1=I#fJCScyl z^$k-4j_-i7p*GT@@>7IEEay}B$u*S6>s*g)AD6q#Qi6nn*ZnsQKs`uLdjlG#>!rJH z$fGuLLeyfcyDUx$6f`a$)sUgCLeEdQYXjN?+UTk!E)vg6rqnNTG&ZZ|tH90^P|DRt z61xdBjv`tdnXlPbQXR43aHmbKA=satxb~&dNx8%7AB5>fX{=i_u9<+b$>k(#I)Rsk z2K?$7(5P$`LZn&bW{DMT^|9__&|Ld48lb6?BSlvCZ3m3WYi8F~L!|F$8R*LkR1oQ- z4yn*i_Vj+Q#SOd~6M!1I&etK12DqHkX_gs$q2WL=-> ze=AO6Yc}|}Ip!6$-ym`@& zkn$zhPrLsBT?H6lppQ8s)e>g5c%4hTI&II~bg)PxuneHY9 zPdRV`3Y3TPA=0c|FxtnQH6aF_=ql5@BnQ87bL^8OUla{IzU~3Q42YChVJY2s75@fB zdInY?Yksj`*h5pd`p#=@lN|6zrfnv2zX%^fB?boyo$3eB$iT9WMubVBspr^7X(W6AH^E&fBE1Jq1xM z;Db9gFCe7&s6AH@s3I3z>Xw$~olR{s#7WhipVH`B%~YBLVl1k;Ph;IA(QLr^4p4+& z=N@yM&8Ysu)K{-8x&{j?X@17OH>0|ONvDU2A98W+sZfxtRnzi@*ha?GLLtVeJzEe+ zcc1Lo8H>DJtsmr20lC(_y=Lg*OIsVrC}E9jWsT8v9vX7VfaHKMjC8C2eK7e}gmR4r zTD9HoZnl6ZL2`wCy^g%qt*^muPs8I zF@QjZk3$zD2UZOPXmiJA&3$X1Ut{DZIiTnz(nxf!C-ZggH0?VjXMrE z26bui<2r!D9iR-Uj%<;L-RBs@XswW>c^7wW6)GeL(P0E%@M?qOw&L0PJFjbTNDd5p zZ{vTe3I;nQD%Z53sRd(o+`92zp7|blBHB``?jyRAPYln`H$R+>RY!Ijsm3yWJy)iu zVs-H4^^joP?WVEny5=hQ^7PN2ky}NPqztdsZ|HiJUr&f(Mc5rwa$gieD7q0=yVs!o ztm{^h#0(^gH$tn7Q+Xx8XaV*Uaw)-*%^H_jtok2?LITmFE0|h!q=|%fp2HghID)vg zF{*H^K++fQ0x>wiGjMBzdJeRz6Ed-~@2)(QT|R`e%rh&ZZQIn7 zJuxV=%9*IiyT+K}rCV0k&(AQU5On(y6a2A_pP<$?-W9ccRJp?rWch6DrY>p z9>&TXa?j&bm+symF(v4YLmQ4P2FU>jE@l-8{SBYk@IbV04W?sVSC6{EqxK3kq^lHb zdW?2OrnV#pN?4#YEG5vSvOgzU>QAa81`3K;rr}19BGG=co0D}tzGe5hvMAOs*X*~j z*@tKbsS>d+Zah05?hgaqPe->*NWr>b_@wki+9>J|5@f&mRT_Ny-MYp zeRMT(0@eki^D-l@7pS7?$OMhAm`!fYWSI_B?(8pry*67;$h{iuILij(bk723z(5&K z%8ePmV(+<8gE1F_mS72(N#iq~KX3Z^tcNx?X;&tQ;p*aI+iP#KhH)ky-6&F);PhuN zxh!SL?~@-_c91to)z{rPvM_ zU-n=kAWk5@sFBv_RGce7lV0!lAF%<}8a0|K?AKP6n?_A~@M-r;%BRrP`1s_4&Pi7!r|}Rkeu&)#Xx26RjKh!&7q}X%|LT+Z z3C**|x_NE=Er@LtI9pOE3+Q8oe`Ey#;t83L9Hv*vo4O`b8N{5DL5Hg$V4@e|MRd?a zOkwgauf85v!_Z;o5suFWM2Y?rm%z5#;CwzqLt|U~NaVvBg8=tde?il(nU+{H0ChWF zu=ryQ3@YdT$+k0{*a!Pc zOIF2ju~xMEu|Wgv3uwb`0<<(($zLQI0HS3KWR3moFSZ?XuuqlhN-UX7Y!8Gri&od( zf^+DL8CyN#29FWZ044DJIg?*!7Bm#Fb*}(q zN*GqzlzdQsnUYv*1y#qe{lgz+dR0OHBXWwPSU1bp(!sV>G0;TNx2}T+>>mKH@j6YG z%<{FI3YtNYyg=6PE9Bj1cex890RPJ~?_XUPa>CEF2(Dug8 zskN&!&tUmyo{7x&tL6GN77f(FAlD@*dH~ zE@Jx~M>)zC>m0z8E9iRo2en!YwNYbhrgrM*M59fIa?d&BR3xytkP`BK_!H z!GCf-D9KT#>hcLNCj+XygbyUBQ*Y0Agh#5z@v}yBOKVATMmKn zcVw5;G>ts(5Qg-@RH)iwz3Rwxr1^rQ^xp&dNYUrqkR$gc`$cWc6*4&;lOEtsp%LFb zk25@f>^zRjh4v-j>HU&6_gIm(_+;dt(|P?@Pmb7x^!hGz|DCJto9taPPPxAl%K%Kd z&RbDuQDkuAGSRdR@#Pel5e?PsVMMluPW;q>DPH6q&fy$@jd^Ivm2+r)u9_CJa?7D)c#8n;+HqFR@xyuaWkD89-f^@PtlFQ72%AIpKX~*5 zm)H3If{*{~G+!CVJ=Py>N-`!4EZp+-%F&7I`}Dt~yLu+&3TM1}-hUB|OlutQ2RI&A zZzZ%U14=p5R&j}`50R%`&MoABI_Ppr$D$}`PTdTP*mXVGPr2sVO}O-75d5EuvKuh` zH-<9Vo{-$Fl#j@VHs3ep>={+08&6yzwzB(o{=;XS;}Z~-(ut4fV7fP&=rspYgUjSf z&Q{I}zM)iUvScFu`lR~`jG1sS`uu!$>HtMj|FtmDSH5z4->er@S}DQik3xpuGgMEw zBdDE9S$l3M5Z~Bs!jjDH@!bmY|Cn?Gm|yfd9|BTCNGnM70T(q0x&HYM&N7t0WDiiu zJz0!;1$U8A`D`L8IpkwEx5Qbc^j}D*SvoL=unz~ha>#C=_G!11`hTqWR=Pc$wPW%q z{vgN?@b=Ki3iI~#gct|nzf@kIY<>v13JQiWCz4pGcY`}h-Zlhe1ik%ZGgeo--Ck2_ zOC8+zsN>%JRWZ*zb}+hpMPi$we}zCrwA^ANEPp|oCUbR006u41%NZ;SvwpONA*vg> zXhSa9_~e+SxQEnJXBP)eu4g{VSj<5_?@VQ<1oA)A$old27zaDvfn5!fI7nfHq2=~2 zN3;{MKg26H0Q`G~BLr6@*K{M<+&{)Wk`NiW@^#Cx$JFomNIR!3Ftw7bdB;sIj+Hqu zFsNwiK=R$&HH4>x??44h^UJnAKe6RK2O)y%y*>LgfKnc~{t~HsNCx%yLpTn%+GvlpCR&68+S98`QwI;XQc_JdVrEJvwMF)J1ep{RV51HuAL{DjvnmF);N30o=S_ z&x_COyiIv^;`0!W(&|`QPk1`!VnWKY>%o^62Yj>~As-Ds=oxa{i;aW!NHuQ#*^Evt} zt)!-lsR`i3W_&_OZ8@(?=*7)nFNDWw8N%TmXMnRx(w=YlIA5Xv&>qUp#HWA)pK;8v zo~JD>y%#?q~5ue9`2_b2l8`H&8r6n6L=&R2)9xk0@ zJiOj0Tu*G*2X!YgJL$M6Lw`p`6=tU)X7vcIKE0rQ-*L(ze$ly8k1;Wfj%ySkLq%Px zcmxP^d2O-$`At<)gZxfk=zmI^Y3=pj8}Nm?!;Cq8*+C_Px3&%EajN(kJ<2>*rD&ta?z(&i>9}3{roDrg;A?|M<}wQn0u}|90Gz-&QOoC}PFZbUI?!qrv@gq2Rv?>hYQ?OO{yT z9+J|8g8G5x)5rkd*CusUJYpS*zL)dAHU>2GDikv&(w4(Gm(9LP7oJ*93Z zNd8DIw=L^QD~{y5z)L$-E>V0eOWtVhPW!4op!cncw}-bUzuP#Nb#g0v59wYof1Plv zNIK`>3bAoOV(VAY_RpB1-P# z+`ZcHT)IbpWFR$V(#+S4h$6y(0dhm^%%F@ zXBywF>_a+=Y**J49_l}CO%Cro(1^Xo{`BNLeZO1Qqk{+Ac4uXu7X8Ar7Oh{Nw9P{n?IPEfn zIp59e#HBLIqc%8)I5X-9TI!VYlyh`F{YeK;wkx(AH7nlebK~pCZsY1}G-a|&f{9nZ z-d!;SR!*2I^b+9|o69gvV19enwIfTC)0gIR*h!upn|BwzU+1lxT{ACOxGQ^|5EaGF z&~HSQ^(it1doI_rFF;Yvb7XC`$IGKfWSg~QwN}W(( z>BeTo5_cNCo%VLGq#UmFDaR72vhNJ?2kg4?&9*#dyx`BFzd0j$1_TBmYJ9(6Kw`SK-`Ffl`y0(tL>^Dpak?81QPA{O6(y8R?DilxWr zWbw+!!OYIEAa?4r7}}74=u^#+4}6-Rm7Vzc++DQ+aRnd``B4BO-b>R=vX2*L3SN>e^_Ug4=`e16-~`E~D?ei$En ziYf~j_63(yYQ*_>l&4=QXqs*ps6Ll_`kl7PesE1^ zKlFS3T=S*AV<+>Iq@g+DR1MszZHsG z1@$OEzTt+I$y&D3^11;zKDp}!?9W0XLkqU&250@1bIvn8Vk(*xo|_hc<^OMheu_B!`3tm1I9X%24lTyx* zTMpvAD(nEp%H}gu#lVPN<9s>(9xg>V2Zh2D58bX(URm?~q!)dk>6DReCH@VcZR9SS#@FbJ8lDC@`pxw9mK!Nyh z4OzF&dFMryNvBG{;BkOv=C^&1lQ1B9>C=y4{Lk^Z88KtfCDNGDD0!XGXg)BUz`-u?2~X6hu9A9T&;?EhpL`F$iTH#joXdWmi$ zv9Hs~O@RXV;Rh}b=sI966JFFs=!pJ+;rT#zt(OF1N?0a);aDT7TmdCP6>I>zC!P_y zgu9Aq@<)p`P_j9iD`1?nGsc2K`~jE3=L~Hg+E@$Ku7fD5~_I%x*YB?P?TlqYJm3n=WIp4xftk zaH>qdAiIg3xK?4KxMt8o5RD%OTWxJFM8?i^gKg)gupUf$q6zH&zj1_4u7^LD;dde;dE+#jTU;t}N)x-yxBteQ#I+F#C8oUF6djcsDFe?Y}Kd(TsDK%N4?R)f~Sm3ad~ zLDL)&FMbNlGyy-flvJ+k$pHzR`s8?2!N?3$$S|WBz2@bu0f`@gdPb9MkdT+tWo%Gg z&jyJJeQ5ddY9~|QqTD0@A~2;NodP<7(e%zKkg0;X2ww0`LJuJzE9DN+2bcV};Gav1 zp~TKuwrVU9l&fFZe)>G&&5@!HKb!fIY?%W#Ruy0#vqS+>@&)+iWWWoSXNf)1AMXC) z9VFX01Q=;mcDnkx!Z#_dfs<5ye{e-3l4?C08YN-nYV?{2k+=M{$V%528VCr$Rzh8% z%T_$-JJtR#?Foq;!O0_8Fogo=%LZ^1b|*Sx#>l;mqkF-m5H(eMsEw!YD$tB0TLXcqXU(EGnbg4b(O+Y)y^Nh}mlpnAzReR#8u|3b>L*)vUqDAlvnC`b=KI$e?d^o}K{L+6bkWQ?%RFtK*B%h^CzW4n z{sYOQ_efo2(c0m`)#Bx!w!AGIm!%<|02sukEyspR89zG=e5w^jB%jZOkz6`>=7_(0 zFDj5gFX$sbR`BHAhpsa(;x|}JI2a&fS|y3(4N8C(=&Uc04|j67R0Cf@YO_IO(yZyS zN~g6hmookHO#al-PlEtii>)Yrl{*YZ zu^%P05dt){Dwd55tC!9^E$E8PX;$MH1itg53$}Cb4OKn`GCIF&GgHM}doI@Q(|6OAe(Lom;TM z-g-(Ju0$9Fa954CA)HP2p&V;?Wa#J3yZo~2ZY#}yZ8I`|IFlOH`%q)QHz807SLW-? zCMBv(rsOZ|Oq0fcOv_^x8p8u5udbreyh-`o3;C*7otTLZ;_Hb0qh#`Slnd{ z@ck!vpQqc{TNCy($ta#YS&_QHyhy+8DHvqev`RHY_70T6-1%m_EtmioOYFVTn zWawqiVs55+s6uiHqJw9C^A_Az7;;WedC3WM{?p0qt;r@-J_J`a!8pM=#uz0aN~>a) zvztF2x6lmI7=)dZ1(t%*X=drWVbt`48_7}^I7)xBxx|t*2ir-Bk6&O$E}`JKoEyqz zG1H(!%`G89xv~U0c2KnaLTTlcUux?{VY&%@pXm75rBXZY#uBqzjiFF7!X0LH+;jC4 zHVC^5;AFA8YB%bR(?0tYNA%D(A-Bk34yQ33g4ytBXx7bW2Z38my{Fxja<}!}7tWK9 zq3LhO5`{n-pDv+B*_j4b3KjZs`#p!kt2lF+)nVZ5t-%|=$cC~5U!OAxe-c4!1aUQE-5HH_j3~A|pf=ieDqwJztGuVj)ovodC+E+!Z zWD(5^q5$J^H#(I*{~c8${cp`K&bd~dw8G-LGAf@Wj1e=p`{8)hjK3kHuv;Sa$gFZD z3s^1ijj9oySq4TvZv9Ms0)R1Zl!}RJJUq>=`_l`GkHP-HyzqGsDrJ=(UM;5BQ@gv2C3p@`waMJ)`j{x8v?Tr&0q{2@x@ z6#Cr35FheIE5H62qzF{_H2ss}pL^6QaGy&vI*~V)8-os;80?r;ikJ+348>$QJT>$X zWC}ne-BeMfRS|ewvaNIs@=I2Y%NTMz^^a#pef4@t>v~o8Q_FlXW-q<-EkAWh=UWo; zRc+T2B<1Ha;~QFWgJ+SnDm_MFCPwj|VIObwLrz&a))?3+$E&5sSv5Mb%qY9_(Z~#z zq98>Nlco|*C&(L%*Rw6Qe6@cwmWT(VJ9F;uHZ?wEy-apHI*D5sr7@%8a?1K^!T3w# z^I^S9_bpEj9fuHPjxr9X*1~|HCzzbOyJ{5gf0E+`(E74lnaBe1^YK-Ka@@2kKsfKf z#({DJ#9-K#CJS}Ob|PL2?3F;VNi+LCn~@wF;dstfs#XHhSJdrmpQvWM1X!I0J9jf*mC~9#6Fap-l&cvFrpq+U_D~ zY|E+KPehV(>uMsqbrz(~85WGb5%7`V#a?_$o3tBT&pMYoCo-cNdK!26{mzB3I()}Y zwKY5B9)(TVN?0S}Sp6S1IGPOMv`y#;G0dCCuc3c{Dn0=4rI)|N*|6H1)R}8MgQHkj z6shmaYOGuQI|GFwV%gOW!)XOoY94x0zQ_Qlq}Q!)Q^&Ui-9b*5S)n{{*6Zp;Bg?xu ze*F9s_ySUMwbRN^X~#eNeWSkbv?fCQr6yr{l!Y`HT7>oLk{0Hve07KYGE$hB7O$^B z6EFZ($(AW+l(kSA-D|YbCkWDR1T%x~Yw#1OtGL!6ixF4K>#*+zBY6ZV!K#e5g`yvy zIjDR@Zv;D%IFM%fwyE|dm9(o0;Q37I22>fOh=aDroB5ipXD-?{6OA|vC^iK$uRyin zHNb&}k+pkMfKGuZefEC_!xsA*4Lo?%nsiZ)ND%B!E6cg5|%mF!~b9 zU$)tTuopldH0j$ZUy5^Y3Exxk3~O;$2G7r83oPIJnvK1MpTCDlatLsJ8APb90os^&AGI$iJ^9i6Ew&)e)J=IB-LIrBz^S&EKeIMk*Z!qmHlb>DC^nCKaDMz-%zOsYkL zve*neQGn+pb;T)NWM{q}9Nh0C4c`b3IvUC_mPiu6oY>ta)eU9%0?drmwwRvtapNM~ zzw#st28%c%5bADgyM(XC0JSFbPIc-Y!Q-Y->Gu6#7ifxIV;PpK!*x zL|9|ph&*3FIw{(v#XJV-V?r(<+^>5?iQ-6ZroMw^!v%qXD-cjltz@Y&(1zyIwt!0P zW3<(q4VNTU?1^h5Le8*B4GUl?H^{dyJoD0(F))1K)l=fC?$IdBF01=KroQp$wuR;d z(!&lUb@UhWm38LWZ#L8lMEpwI0@g?qES~?O&Vey!K;xaX8C7&10nPMBV9`Ej-eEx9 zaR*@36Vq5f;x~Z#+skwBc+OSpfNt4x%^$z9F10`ZGLZ(rv83+Df3(F)-o@_Vv?D3H zwylb^xeK)+_DD0H^zH*s)x{%h0E(oavx(VC{8aNLK(ow$#*}X^{1#!rsIn=n;SC1H zkiY`WhBcSh)oAzYq+F~AD1(F(`oiZZcp0Hd`O$<1ZR$>AzKy*wa^HNO%{%m;0tjUps6< zuVr@(x`F_p!&ofdItJ-pyx(*ebT(cO<~I7d%{BQ48iXSE&u}Rm_1#==4BgEHY%%J^n(PJFWR>=E-;ATN{B;8IUCtgN)%4;wyCs ztn|Y%d4nmV;1_FsR&yuO7AXivwG)qKv;0sK@!=Y0QRoiE*>IWG6L>jyPBTq8^GAOms$cE7!Z^Sn|X_6=xSfD39Okb`QfJ2Q|y z>2okW9TvMLN>qp_8C?5B;YUE-DD6xHJl-Y23Frq8KoD4^8vlhK;%N{+jN-2c_mciX529fS7hL4**qAczL zb6K%XL7Ro7*rd&kc0p{o@i#AFRa@ns8hsTo6fID|1*~iVH+GX$rSI?ZPPN%)!!G|) zLjw3MP9Q%6*UHzCPzN3pRZg*r3~Fzn8QTjJ`QkoY2A74sXma*HjM7yoOw>@M8;QlG zg4q?XnrIP3eb@HA9dO{PdoSxLTRGJc^_>ohzbXLDVHn}M^XBqw0Gq$iIyvh$o7&2!Eio)7awX)a;ix}C6q5^LXha-*A_tdS3WSqw}IaChGq2HV6iLk7fgKt(ANqHQ3~|f2_(Qj zewA&owaqQOf?-BZF|Wa=^#T9NWOrGA_3*!0_ZN}^uhD<7rUKP*6FYW0*$ zLN$PEEoK3RM{{wZpQuB?43R2}r#DRMmYI2wOgcz#R zr9kNrApU*|!|}NIA|%0?1{oIbCZ$@y&wzY1c6WM(@~u8$`hJ{$>uZ0&XE~+%T_L}( z!1#U8P5mc6C=VEMb9DlAo6~UFi)?Ft)1t)-K)ote5Tk4VH8#Mts67~wD;I+d+TucI z7f^a-T}^{OH^|3)0bFlU;8uU!qg({@l)$tepgvjbaB6{6Y}n(XrwMtb^$5gs`$_W?TFXFT&@h@h904XGh-9p+6p8Eqc-LNwpenEG0%< zV-|lo`=w%q7Z{uUJr%1$BhC{4WpXZ!VoHypQ4L=GDrA1!B*I`O@GR-Yci=YjkVkj71v1 z4SVQab1;hhGriH5z2%i{d-9f1`!{&i=*)Fyac__4!kNU5?d@Csb3%I{wrcIl&o=H; zV%ue%0}Bt|OUf1(9LuqCI^H-`W|c{Y4V7s;qfmQW1Rf?EgIolKn4*y*ev1 zX`TVgIC6+&9zKLO512k0bgYD7z9~;h-i=#w3N{>6VBY`Yv8v$3b&|c5V#>MaOwQ;l z*`c)>3bCsMLB?;&*w7dA@pVhBL8*S*s8gTYKGb!*Xj`Q}se49({WBL{*S|$6&}! zo9H#|HED2{1Gz3?69*Z0)xY^VX!hNS{B5cl7LctxHF93oTbU~C-7|;D<4*y}kGYt` zoNSM?K|JbJgK~lFixFU=gtpFWf85>~akZAW)@oUHL*E0Lt9m@7p2p=RsKBsh2P^nb z5g-Grt&0-dy)=>^)v@@4TL+nTe;I-1c^Dq1#_#?m+QNj`2jYaB<@`>JVv7i%5lC2{ zY)R_-RCE~u8wX zU}?Bt$ihHeEEA3`OiZGx7tnn7nKR^4e3+R%D2BaarmZSZ4nGqk%}|^gC}4d<=i_A; zU3q}N@Y)~iKVjbbS(y;B>t=Z%c0dE)Ag8 za(CNL_)`+&a)Im(LlWXQi@(l9d3E&RMwTtl-Zo(DcFjH*T_e4 zX&jRr@r$DSgsl&R?`*Y4s{@eQ;ef<-lBGLO~M5LclCI9rP z@oo}4K=Ja|F<5OH&U>pfuu{RJW}S8IvBs1AVtm}6dH`@+$E&wo3Vq{R>gHQ6&Q68> z%$BEWHdFy0Pt8rs1dm+-4ocx>9@_@BN@lwJ^Pk3MAfR~?XM?bzJ-Byx&JdN+&M+$Q ztn>IWqZ1k(b7yk8#(r@)J6T&9HuZ}kPZfVBk+wkwW06)sX*?r~mEBoNdK(NQOzSwz zlUnJ*T+g-lB7H7X|5fN9um-DOB~=kQ4Q>s0if7Arn9GJ1pG*hWb)0z>75T)^!UU+- zYVAb|i)fY!eN#S`Y-`xR?Kjp5DUF(>8n3odVDZoOjN2J_@F(fR#krs; zfT;@+&moN(%bg`k>>$9t|7zan&aAUzRJ%O40 zVS`*80GjzK0U;NM#Qv33Sl@$mV~nUKzbQEx1bp4B{}OEjObW}&?To)6 z@?U>IqX-lTv0~hu0W@!=F;oDeb@!M$u;K;%O8fMlHe~gZlniB6L6H_>1X5Z7-d+Y3 zpej+Zm5k{6E_|F*1^C+U2!@1!A9EDf<|1g<)6 z&IAEf7)2bnk%_z@USamQ#cFlA)LhSVJJp^+mZn2iAZ zD+aPz&BwA0KCXQW;P+cVPi#WBIougJVkff+;2N)z6to3(s~7W(o|x{hWk%iZ;Z&*b zfC^n@atPF;; z{fHE%x~2s66>99arcV$Upr{8IFVFz+NynwA6T>GyLeq4;3#SdqI6nabThXW#fuJj8 zac!bOGOL5k2NfLex{u>QQDUc$riQ;GFGp;dLjr;1t7cBO?O5xvYk=Zjn(B5g>ZsMv zbYt3(qWCEgw9gy_2Ok2`a6me)mw93kA_z7#U4+Eq_`{i8Xeg`!_JQl~Ar6U?;T9&=CIv?a@I9ez5b3OeT64 zUsLo73>)q)wEh(W_cNu9w!!-?WdWCVClbN|Xnm+@stu>WHvf=0g5D$%6g{!3`IZ@_ zdU+ zQ{Dmx18-oY54`Gx+EB0nD@gt$KH_|453VUYCCE*8hUPQt=1^C>c*~4)>@Iwl z`SJ3MaDj;MTh%aD+FE&-&3=Xl^PsNHScI70)oQ@^%i2SI^c+>)c_>jY zq0(uz0wRwq{kxcn`^+eGamtZp4{x3;O62=Y-~WimjhMJ!z3a#YLG;ONkt6aEz!kw< zg$kw|mtWS?_v7M$p*GjxX9-EnPKy5na=Jl`$Tu9Ba0@FEyR%<~ zf*@jddvKxd|HP&lHw8ZqN3FI){e4p5e@*$uA`^UYtbz>_WLwpku;zkyG%w&3q`v+N z!kalB{#S}`GLmHh%?hrC!vV>90|1U0U>2nIAJc#Po#*CMfNIqjF|G^H?gtHP`=)B$ z=kBkegF%wmg-Vh;q~TnCq5tW0P|nfzzadMqseJffYQg=)5`?Sk`Jw+x;as2%X8LlK z!AZ)=lxzh>+p%nps*Rl!+l~4jOKf|MGVc=zlfj>?E^7_}^np`+a*< zF5*3$`%S%z0$;76nds|8AI5h6ML z0p~(Rptg(#gdJvvv00%GbZg6k08|D#95)NV=-sXi+&yzQqDberW;yq}P+S#Gn07yc zB|5ak&@9gT?Xut5^H2|a@ac^^i^k&G2@&Iyys@E2wp({FJNWL?DH&x}vx>57H@0=4 z#@91&?~Gi3=G4&ANyk;@eIuKiJ;Aho?AIw7%RDpmZ)PXfY9@$ygjjeu!}NR0Ut(RA z9tmqG0aY@NFZ2oV#{|_x?nJKy#uCf@gPcB1KwA{8$g+7KPHXyb9xi{Xk(|FDE27D7 zoL_avk?z;h&oe>l-4W!b4&bu^v2+eO>#8;44#z-JsD4ap=OcE>`#_!$K5l1Imd}_j{?NNTbGND z$?ucb7;$1Zx}ZU-a=12i+n8Rad&4q9?rvZHcXaIZ;G{%qziHm41YM}oP|J!-)Zr55 zZAdLCwAd^1(Szr{N?;P``gT5x((|o7dBYfAq5cb8P7MDOB2!iDtweJai}uwdI)Y)k z&Fh!6tJ_P0GV?lO@h+IpTR1tEN`0gip1c5=|hPqrP5< zj*#|k&nvltFX!>3*%pG3x}EW|K3-rexM&4YV^%{3dOHKIPDe{%))F8n_bZcOD!TZl zYGGw!`;@ewZ>XN?wb~7gk4E+qyFjF$%>kWRz(>mvIh@~i~6<(cXlL*(B z>qQYCQ>;SBlLGb>PjJ#3 zosB!h9zvjiWBP>9W9d|4C$&w{rce=<(tx0v{;*U)S(}vrKYGN)&NzA^^UvvH65KY; z){y=WR0wLW8|7!Em@%FjhoWWx;7K|zNX*H|up=(u)-^~~1X>LU$7)N({95g6(;z}% z1%-)!bhm9{n0ve1yUBD8%)tFtGYTe4uh zm`5In)m2l!q9y~o0T!`Ny*bfSJySJ9MxTjRCDmXngk}Arqa8W(p8y(V#Ad_7SPm|p zwi7K*^isPeId3m4vR|{LzV~a9_ za`K!Ogo#bYue;2*=kA}((wT#t@&K< zR0;$e5Q6Vk&`f<{dPByfYwfN!K2L*Hh(7?4Tc-)N!U1x`dxB^R4B2xepejdXaN|UI ze%*wsv4+A#2GR3~TzT>Z2FK^(>yh;D@bDZhtJ#}(%8=_DFna(mNCcmycvbl11(^kJ zwaoN7YAhi$uU&!Qpo6axF20`2lb>I0qu1py^y=!VKtUvi&QU>^&xkMMQ!K@SRj z3=(`9Dq2yTjH(!|O8os|N?0BX^qcT-QggvI;wmT2z}+L>!851`=A1{QtdeH~@UvjF zz#hw?&=~;W!Ik!zCE{~6$kg?Dzm8+g45QEa;!s20tW$h)#I`G(D9#BBXbgZa4GcWx zMR5-3k$)Ga<1$($0M=4U)g$J|9|uE0Wzvy1*U5S~AO*gcmClR0J;qP&5}1a|$l*oR zuaQL@&oCX_wr-Sf3!Fn}U3CoUFj&?N~5$D!MlwW5k>A z5T$^)44mb|`xx=seDZH_Ggub!qUcUvf*@e2go&8x!L_uYZ{*Dg?w>N0&|=!<`$xaU zz$dDN7MX*|x(vXp6>SovHz3$03+V%ZQamdm!BdFG*W1n+6lw>sAV!k2q@92+ys9I9VZhWO~-<{oh**3l_KAUu#VuvX@eem zU_{SdUGf~#z_7syKRzzQ!B=E12P{A@n6$=ElfG!Olo8jCM*c_~kZ>6#BP9ZQIZv3Y zw4Wp&ySTHoDiu=;10S91$n_}Dw5SlXSn~8p*u;UatZ~LHwpEaq5?d=wWR8B1K~|7i z8vyk}!Q(NDr%#bjTtE^GQK`IJWr^!e(<0Mt3f!Y5m(&VSU``F`!v}&9JO;VFG3n$H zUHQTK1-JEH^2!0)pf86zDkMXWOeMSz3r2iRCGbJHm^xYY0JD}f;{)B7ButLxybK29 zj&8iL3*Uf|Cp`uBnL7Jwzr>A9Sx~3NOi?kNn68~}$T^Z644_lGBTGQpsaq07?&Uf6 zPwc@Q?f>N=MH%o-MAD0^;4_B*pXUe_<^TIJ!Uq=bO3n6ig~if( zX*UZZZw>n861M*##=NYs=*LOUg{yY8g(xK$?7JW{Q~H-Hccwj~nx|L)twhIq@BBW@ zo(k^Wyyn~d{quD0p4{yTi{G_(#wlS};y(~faMh(|!5>r1ac86gXvb1vSJF(nrMK=3 z${X|Mc3W1)d*vG@+${^3G;q=R-Oi(KWMDbjRBJjc4(P@gei);DM7JVaR*E=bpnY?t z-z--tuUL>hYw&mXHJ?(emK5nb15>cu=O)y>E>Oz|C6i=|Mh_F z|C_8bO48snkaR~+-`@Vdn*Z5r>?|{OJ)Eu?dl4Bwn}(g%jyj9>z7~EegxTO#_I#T2 z{yu8Sv}Y71~<}#u4#PcmpEI*<0J1%E#k+d&e@-MVI!A8-CeM#d|Ivnos<26g(2`Go5Sp7niNq7;n9sQX2w7| zt#pldy#*PkwQN!R`;m$RwZE+vy;V&GUi?(DugEVxV?*yK);c@+by@d8rJZC8h3S)} zB>|$-r*RYO(m|Bft51lOCTh94%OAu$0SWheXO{!cE3N+^ETcj{*!QanX!pU!m~H(^ zbPXESw2oWre|?3(Oa~C|v1Fw_i

yKbasGV(J$(WnCVGaPFX)x%aqcIciDE4*#64 z$E1h=cCB~@9z1ass+ zdeY2wl5Nv0b#KGo;#rN)?ct@VP087{sTPYvk)7-d=ZCGP4@E*^Pt;|;?(nnIEn_e7 zIUU!YB`a3fbV0Ya#7)27F_D`#_VvOECYOj-+Ep&~kmr*&G#_#;7l*}SzLdS0FLi&8 ziGSf}dTk*bwY^~C_uanyy<@9;q*`L0dK)7nHaJKiUTE$NqI1P;!36 z(ew6%W}xiCZ;rmX690*xGoR=9r0@kzw;xzYxirz=t*ii?#5V<)$G7_HM^23uy1-m^ z{D|9E2P*AvsXo1=AG;wRm-$0{^}2%R#8QI5`V;Q9w~Zp27QGc#YI^>u<$hZk;!X0-tR<)6;3g>u-?rtU}JlMarT# zL}TT1@`$+U)6W47+4Am1?ti_$G%!B>+@OJpkgBjY9H-CIoPIFMI2!jpJ9s31V4bSg zusrmV(37s@Qp`8=o|A!|$`NHU{3}Ys{6F@GzJ}-iJ-fa|*il8rDQ{RxJYNv=E~G6f zV7DKA$*m`;TT$ZhS2kX#*156_=HGvw+h_0^y0rTRjmg;_eG&cKT+KN}nWs`uWHVo1 ze|@%sN!8Ym=~U3E?Mj$avU(!+5(y~)<472`Qv%=I1LQ2HBr!Mw8CSmW;TI-R|>gaNP5*HoHKMlCSjrS4J+!+XkwNn9MAHLRCS3i>2& zWZS2_rP?yW;TNBv4~E3 z@39Ab{ZBuX{tEW3@ue63P7_mmJk&1M`>xRzac3slkh#CcSuY`N^IO=dZ7GrD5KS@UAy{9O;j z_i7JqF6DDlv5nHkFw37}I-#1XMnO0=GS6sPIyX|0@3=v>I!&*YfW4 zl2rw4lyzmKg!43o>Ow#|)wW7`|swrwXHI~&`!ZNGefuU@@BU;W>$nyNE*PMw+Vo_o4) ze;Q|4{@u=GMX1*(B8rZ!n_NdEp8{fK#HWF`+HaAYPh4HzUJh@g7LSKrsS~jIiI+MK zkKkWw757W6I#nO*(nHH&Javfk6s8CPScfdHZbZ~ykzWbP=kBTQ{!yz{M?m?1)auRU z;%{3n8Wk9No`fJ~jqSe<^pe<$Binf-_=Gw+I12S}%Jj%DzPfgt5E#Js`}=LSwCFCE z?;T9*zpHga1NKfgIjt%g5KixZxBhnSvW!Noh(LUlalIUzKtyu7;%2}Cb-`Mb0tDI!ryS=`hT}vV4lPLrj+c29mJILk4{_pzA(oho3CbcIAWan_FGSd? z3r%CJQ!8EeAkciC^~OIv%M%4rYZsQEv?1_>mrzQCJ`&!O_jP}?Mc7v_yR}tjKt1Zm zEowwRZ@^S=FX2-%`yF$R7a8+ci2DGU-7Pk)iKr8V0GEIgH)ehQR6WYmlG|dhzQ-)| zj@$tnYpZUy2%>tuhU<+ISgtlg&kWitW!#ZhDA~Os7;O#I>~W; zP?xi-?S#_Qj=r>KN~73_;gQIeK8c^DnjFPJe7V_6R9EU@+|cKxiVf1a8(d-gT?$2S ztm~3*%R12#3u)wBz4%BlcUFk9A0MWyX+2(X@Zc1Gr7>fVei%YvHB2agRFbd1#?V;q zw-rz?U#Z@e-d!$T*g0yT;R+YK^THIy$lvOp-IG`d0XQb+0_54#s*U*6W8*v!ze-mB zxvy+*{fe4hO_Gh_broNsI+ZABKnrtpDuR~!?)@FOu}+=NzH6c!B{9cx~22XD$yA$Y}PvDLnf*;$4etw&3hn!LW$i z7Xo0?AO!ZWM(NM6bp?N-)6(e|*a7!S`?(Ji*?BoA)omSJYc(5I1J7 zf1z*8gT$h*e0G(n2^Y&iN(+_Y6726)CcG*MC^WZ}c?*pOXm9?|W@9{(7GjN9d^F&E zI!u$Ela;sFOQZWdAB@p^SrxS-Iz?|ygt${99iHDHlWoxKe}Wd@Xow$PitZ1MbT#W* zfhIT3k6`oqCf1Z$5=S>u+)9$z82f4CVb$L+2ZL5k=0(oZc{(l@D=Y}47|;3_E&*GU z7n8NhWUYDaGZatuB@OZ3Pu6KO1H0oh^0Y&?JK!97rAoD|HDJr6AB6*_>T8t)cHGnk~t9MX^7 zVKHKBZ(7zG$q6IY`o%J5OczE)ofSd2M?17=4l>g)o=xG!C7hW>@lp`@z6LW8$X;;~xBQ=`7-IHY$R<>p+EfeQ_k zrUe0$T$+?9PrLG#W<)GYYD%;dd^=w8GQeU9+o)+cMVqC7J6het)b39hwWB5NnMPku zl$a}0K7UuHT5!#hY)n9Nz~cVYZJV=E0rj1>B;BeiHwj#BhAhXu`cdJCLv!T^wb+e? z;0x@DL{zUx*rF!SNT%}epS79nvR)LDvYd-x_*tZ`zzvqzv_m&u z#kA7q%TYYw!jeBe6)lG~vdgbYZVcJ5kLjH3j_^I6^2f*hG%JqQvQVVzw6mh!gcyA~ zU+MGKMo^6H8-hNA`1$?2K0&kL=c`FAn>&1jgF36BN z@Sz+aCxuD=!e{H3qjL9h=l^w=&U!e8N96Eb+h&JOZ{7o3o|atnh?Bc}{zlcbk+FBO}{J zw!Y)c{5WO)b$y23%%;sD@D?&~UKu7jcg1dw7f96Tx8l7M0?zv$ijll#pv$BwO(SlDtq|}k>5nXZ-*fW)q9-& z+=c%9kWASXlZH3d_RhY4UwOV+oDtpicKjRl2ukd~FkG1bXFe7N7S@0743M)qBSY%G zd`JEGo(uO0QDBOgxFXrX!_r&^30jog*~fK%>T=b^g6(Y8)gZxIo0qsafyHoZn1Ttx zwuxoR{x0C3C$O91B=aPR?p-*kI~m2t!@~EGhdtDQT;(P?4r)rq!AgLEG0i=|hnGLs znQsB28A145A_F5aI_uAHz}TQ2rWk3`DS|(}>=_iDIfWr}Q_Pp`o$p?vJb~j9L#;T& z5FVuwd%Bh3Lf&%>wGH-6ftE-(KpfnZFNYC@_fqHW-TERtd#%}5P~ZA&;!R?dG10|3 zf>Bh7Gx=%lZPPjTT4+koP*s~t#&~$PWXx}_vV){#z5bLix`7&I$GpoVS_%A?%~=W* zz6{38@0?W_J&x!cEbuJANASXcN8BLK$ZDGboJiz~EVG)=9t&8w=G*KT&O7(4Ibc#$ zrV2O_`e&(ict8G4+946Es7+K|4x1jDD72F%6QBOpH39b>rKsYX;NX3}EwfE9j_c2C z0b-AG%dKZ*8~)ec?Mzae3;JYvLoEV1(~EEHVp2Ko#0i=?+LUVPi`IV%?_&KC5JTD z2V|tWJfH^+8QWlW;OR#3o>%8%@f+U`@JN zP-GYQNC7ycl8x7Y)cG*BNAf!gD`)jJwsHyb04~Ga#j#LEp7!l+0BNa>e6U58A1iYH%!uw51a> z{HJDWQ@*)BcuO3UgKI$f=x$j&4S1&^vG~**;YH*mIh?@8+X&=JBb8>x+yp(0b zUV=Poyb(#Pzpb4mtVpm1a9X!(;q(&Dji8oP_w^R;?Mg|M))Ig?ySo=B>x>Yv0*gai zPMW>nQS32A?>yn|`|lZu3`_;$_K}WWO_hWb=WyOQqO&)WQfR|ZSpyixQb&VuF*^R_ z(f8M)1A?VFDg+iHYn>)=wPyzXiUzW>I5>Zvz0Y4?%4Ay$%T zxlO-1*umH}9DdvSxdJ90v@&NZ#bjj!7Q$X}$&az%5r97tSYWY3qWq!Vju5>cP}o{> zsdxB6v{3kMRatYbtrl(w^SB(wD&R~UdkN*i=sLC~lv`v`gVUMZ=j}IBT*~+c_O+FA)BS~ds%F?ZgbmsxKSdu{StjqxO_h*dwiRIulD9{c*yZgsc${G=40*>v zTs)mhjwoy;Xw&!gBJ(T&0NlA%+hPwjI)KC#|obs)s&`AG9sY zN^54raJT<7hHyrRg&P-{7wv3!)$6p+n3~&kiCp5)?F7$>B7=uQd=g~?%iN6Yoa4lb z<>GBm7*%vYjfZo!ltR-X@I>awY(U-syyHHh2DzjC23IBBSf=?z2i*yu>dcyKUeJ=q z#=P8vHWmiQWbgdq{$E6obf{KgRB}}UCO5r&%qZES^a9D;M58hAb^|_FJv1>1| zkKn1k%b0Xn%k&1IRfPYvXF$e|Ankk!s15sq;rOLzu~I1Be(Gwz8{);ruoT_@N!c#~C_ILujFy%yqhqxa91 zFGRPHNST(mad{^{Z!N)`F|lyM3a#)5yJp;ar0F;0)t$WX3$$8XcC_f#-3Bk}a0oqw z+Msx~&5=0Ig!PJQ`32`kDS}5K>E+FsRurQ@hY>fi+0tu5lY*;CVuyWvgmB#ZWBqUS zD;ZWeD5AGW78~>Ob#i{FI}hce>DFjB9R0-`IX^DbP$MfS75LNI6*g9vkm)aL zo_L#Aez5AyQ1mvJCjp6J(~12DNo>$U%)3lAEOw@1yYOJRcAPO3#?p-zxN&9hjVD!0 zVf7?jrX+TuSMdJ6%{0g*y@0oeQ_jh$Lv$yaVP zB^nYf=Nm*`;r%T6N-x19D|%IfqpqSgl|)H!KyIj|eV# zI#&u%r**a(^ki4DY|XOW!!sZEa*)&jBKvLk195p5{*`UhHi1j-8%>AkX*k`W6<1B$ zi4LSTgExBLtBRU_s^C>!@f;E*AWED+@CJ$>#?T#k~+>e-#Smj^yH8-J{|V6BCK!XI%a(2Fy%3=FrKz< z!)89EHt}6P@Nv6reim>JC7@P$$gZPM1g$v|V3vpp7Vwl|0JA?_Q=EU=TUcbTK3su@5wD_;Z3XfOVk%(OQJK#qS#;JG@t+%bD+B^hv2v^uh*(rjlzr#o#nvok&9H!|z2P zf8ghBIxkSI)7Psu?$}c+#)&DqV#xhWZMp$!DPa^{!%2$9O2o{%9(1t$NX%t~J2Si5 zv(#e_kNf3iJbcW1%8SOivQr*MuNLkwCef}I4#70BlFYI80Px^GZ6ZF_X{kzM$M`sS zv1*Q&oXpQGIZ(&vXX+8*I3FEt*bJ^T>tcu>+qWc3)}`~v)yqq$c1LIL5o=aG%2H6fV;+97twVS#oIE~{bubEvst zIQ>kin^`&+4icvx&gCwZ3w@hq1I7(u4G+0lQ3%gowIq|3HkHX5gl&?ocvj#Esbdpw z!xR54hY-HD_;b2iWI>Rr*an=d#p80SNOg!hhE^Ct&lkFZ3-tJ=4Ae*Nr^Mn2z8&l* zVZu-5(EY!4A%(lDG`I=(x%mFS!U~D|xeb8m2y2uiV#HZlD32<|BZ~6*2kjjv;D)-fCI3Ag@nmPG%As~gyd}uVsp zTr=<&NrtV%8Ykx<>^Ud{s=PD774z!Fv)P$6-Fh%^aLHmN${KGO?le)%@Yvc6LC%#}-skSHw*stQmK9oZSCy{yqBqppi)IRmQSO zS77kul{A`jo0bnb$l?GD8QWXoK zsg6aiDDMmf7)Jq4_8BJ?eer0u-z9I>uM-Rqs}J{6!FsGg z&HjiCj9of;bI*k9bUIzgFXL_BDmEqs( z^>OQ6R-~c-6El#_za`|`#BURRpn69TyQ9+@%yWOwRbV8hEG)H>Bas0GE6`NG6T!}h z@Jvq0vWflWC-5H(88jWLuy|v8*>>UV}&plUqs+Q~X{Rwh8SCPYE zO#ncmz+{2r7Herc@mjy-2=P0}QB(q$LNdYCfJYaQ(_Ro;{wt?@sv!KA33sm-HY5*9$^OC$Og;Y1XZM)+`d{C1lqM!feW= z2)mrl?;6i=iw+`GxmLLpRweN*@k&`Kil+Q_m=qBe*Oqsm3iOX2-t54M0iQGX)s!}s z-8O5Ykt)AizN5ooyyBH;cK^FZde2LHXQ84rHb?oTEKROXprXAfZ6yRy%U=<5SF`(2 zKFVrkAZ2>Y>LpBm`Q?;fLZry?c#pjM=y!7)Ze`wqO%4mV5s8$-!#5ti86t>En>_@9 zQqa-xDDmG=ZL8|k2HEN;jd)ziJBpNwGkQS46T7<6%1Cj5D0Bb<7a1VM-aNI91R$x+ zXu1`C@iQo{&C#KdFi@M*y0vXeIKxnOXG)kk#pgVQt-}h41u~BvAx!p%E{whVz1z$4 z$Kn2|V8Vtt!`1Cg+YM0`@Jd79=dK;n-p zx>yCWqC~FN0hvMa0mDg*f;U9>OfYC|b4?RylUW78!k)`Q17M;B-V{|0V-kqhx|H9m z*9z-Mp(4Kf*90mpm<|grv(1-)0BA;P+=%&A%N~vNQkIFrcqe73O1bj00^pC>*HYniovO1gs}puL2L>eTg10oEK&qa0o0 z#0(R165nm39qP_Ly|ns3{6*sL^0%B_O%bPMgTd#kH3OK`btz06$7j8iCidF{C8uW_ z0~bg`5xoaM5gceZ%ixPwIg``QLZQR$_ck-aT>)c zmHw>ea9v#cYAgAfN%N_#;@i&;+_w&M2L)zSI~>|E`Et z2txmy)Ol+*&9fZ;D693?3o~ zL;$1*5h4?f!JZe$pB%s(2agjrL|A#wAm>h=68}n~;-xJ%Ga0w5R86IopUgHg9$-_z zN%iex#=~bAEi|;wWNMj0aqZo*&7pY!pPZ-Js8_>+*f!f(7J4TxNyiUu5hQ@N9hdgc zBXX5|>Z)q?(YZnhwD*}T4gJ){MV>|^kBL7!T37mywLVNGjz!sl`TifW67-)z3}?!C zpY;8ty5d8WhV&yRamigv4Fi!Ws@KUK1A&!3#NGJ!cj@WuN=Vab31a}7ym^g>*t zt)4YmSLTT(Weu~B?gO2l)uT1*{MG{e;xW=NYm}qKzi>fbjd1NT-y*Qzd}xx9Q|uX% z_t)vvFB$=v$?X>TnBac`j%2(i2)yzIwj7%$Ak=l9SpMEPSJNcV*{vqi^2mm!!`njeDu1QgL(CxJ8Ex0z&|1tB;XVLzw28#8!tl zyMYajUb}(wLccd}JFfu=T*pdUOtjLGoh>#|6g;kLttsear*R=l3iie?;+Bt)I+)#X z8xK}{l2FE#RX)vSLk@YTMAqwuj71&2C$SF~X`Ms~9>+pM{AE~PH7{vC<;ap|Hbns^ zcQTcDck3)(A{0zs>1fDX99dV-9*w1YdFUGBtP%#6v3u`ED&9U#EFyi{NotZ^_p9%r`w0K$-yx}d z5SjDcXDvjXL-(LZoWi6S>`*-2fPguQB(OM$AXOfoMVXhi{(I8AQglebW1XO~Fs(zg z*Wn*gA`#Ud&GnpZBKJK;@-ZouYm28!Yq7&z5BCJ) zdMK(2Jffp45qZoJSylWXHH>w$$T9PJB`}$4&bVQ66anDZ4_W_ol?*+sFpAM?nFn(u zS5+rCYH|T8yQ}2J2+V{TC!@Xm=4JNglAWNpADOOz{# zs$3EPmM21>;+0b)=(8jOjNRIFkTpKQ)|gCm#iXxnasjw>N@Vo&+C^oqk%{pX;FjYP zJvAdt3whxfh*dj_^Q~R^;u|&z4c3B9PUg=?i7igA)CrwVEALM^Gh^TL*Scv3pG*gB zJ8-RJl%Pi{&y_@xO$X&+?mM82-#b&3ok<}Ip@1S{Yh?5xK;<-U^OTu-;Z!ItaKfoz z;sM0wOE%R=ISo-%T5*EJ%zyb9T$zYkgrWTMZ4S@=Yk_$>v}`$Um~GrH0CzB<{g4AF zK0GrgSTs%hFVBF9{L%beK2Uth14F$#_(*|(?L;MCBF>?*gN&hyr{JFKw_wR49HsQ# zA;!wvAx4g>dVB{xMKazrPlQ?ZX?*2ctQQ{iA{PP7lUlg=Q3ElPBpizzZRJ{dLSF6# zL7;q^DmIxT2aMlEJ_p*3*8kLe0jhFvg%S&eKO7;a9BSaQ&8NM4iMJ)b^2~?kw{1x zi8A~CYns7`P3(S#V%}b=LWC%UK`AQuA3R`nDidtXIx9(r$a;yKa$o~B^#N(qW)DR+ zG-qdolJT4{Z3#{61|>=bbUWlHeZS8@Pf*r71iWS_M~R%d4&hj-B??I*cP>?+XjVs8JjfKZokPuFMdLd8@NIYaRv5XWdR+{46LBcx z%f|Zv0P6|L_932#fu|J?^xSeOU$0AMH*w9+p4Z)Y^Ud~tVI!KqU+j8$S;yz~xcvxE z)_uQ=PoCU-JLTd1c+cK=+q=2B-rt|4=X*Kwcse-z{CG`I#_#fay?7rr`FuO!*?ixb zwE29wxo)fed^$L#S2KCP+25VKIx?Z}a(h0Xp6Z>{<@I_VKCj2WjP`!GxOMs3^*;Cr zCbKs?-u0*PxBlqvuA{Gq)6+56)08aM2pVA#0T-@GC_kR(DaHA~F*T@Y=8_X?c|tWp z*wjoVo1Z-;L}QFxbD@`Mro5n3!^iGD1vKE}*wZ%3S7^Rl+KwsCgGrEx8)*EDedpv- z!x_P#6+nf}`|ERHf2}j{&FHFK(k6}|3{pXZy6M-pO3O!^qgpKQa?t8q(~rJnN`4l0 z_rMQ)q}sXVY(64n<|eMRsyp&P4?eYe@hE2G0+6J;(XUP|_25ILCFGHj;ATFrg7j}>@V5AE zjW}l9;-E*>Yg}suj4Q5_vBnT)EkEsbb6cku`z5oph$6vh7XlX^y@g?$VuO2X`;zXT z53E4koxUBlNMz`=D9E=s&znqigQ2O~1agTKCMvOaR^jOTL6k2KrjWtFlc7O?WpJn& z3izW@BZp=xVX1i}<5V0g_@{r%9MZ;8<9e{+m;u8{+6P{CtcMx;7c@M?Zh1a#@&C<< zlMf^(`w^$!!^&);{-rAK^EVAPPJOYFzuAVc}rx#w7$4vancx9g0S#Iejx+XPU3xCzh zPGgDdcznJsw!lc7j)oHRS}Jtywa~Fp{!^D?MjccPX3D(av^=MLsJl9u+-DIk>mI3s z0*;QI#{x=qbS8lI4UTuXL`&u;^l!^y0*nT|y|aGf8VFrs7(Or0xRsh&9JB95uLOz_ zN?5wWVHvgRAhYYCs1e{Nc*JAKF}>NA!cv`9!U)XOT#AzYaea|^0^hs3i2UIw*vPoF z#3g^ZgF(-2g@FN(fRIc!V0?O>`<4m6zB0k5+1+Z&nbv*xh3q|JRsDCIhZGIqXclBB zA0-Tg;`*UC#Eai!pxbV!*K4_CpaOKyYD8==$0#mhR@7O2 z)on*f-H)2LGl{ZfL|8rOjO!1btD`Ha)@lmY${frDvHzKnWk z?s6J!S%#6b2gfR%DlyftL0x>_SDZDhk0VkWRTpYLeQ|i|C2eSqgUQ6YrYH4&^tB-3 za?KTtfWk(U8hta(u2v|Bz>7%y8_QZ<9ak_Vk|pfQDdnC_YHUk)^OM{sj;Jw7KM(J@ zS>U7~vyR~&oj-{%oKLb=n|s+YlV~QN$v?@G*D%hCJ~P;+s-1-OYA zf2dy&{J_Yr*lNr#=o!t8>v-syHi}rsbk(1TFT(*Sw8!Q+S_YS#*6sC@1UYJ}f}p!)^| zvcvILW2XZd*`xj&`%q#$bEyj+(nU9~xhVDZin8v)?vXUmE^KU^3mxBnGZ}@>)jV{N zG2zERqN2g_S7R3Q7}(0LQq`T!X{g{;jv|p#S?&AgbjGugBOdkDYL)~4B1<$Ke{1%l zL&ZiMS=j0&@yY0SZ~{;*@=K4m$Hdn61x|mx9-|ATcqrAa@%sb0yp%)sJJXzJ+oQbC z2npq{a8(SDoI*c;M?wYmZ9Y!#kq{|sC~KEgOw1+{BU0TjS7r3;;bdISykCs4v^rx3 zRD7K(AujOzgrvt_;9(LDU8}h^-CR$!uss(QwXf}0!wH?5SjB)~3x9P6Z(+csKsU6j zG~0F}Z4NXg$25Z&8Bkk`gzj)p{NzG;`JGJm66rl+A$?>uAY&*mZI+6I!Pipo^{R}4)M6W%`l0=k84he=~=PlU;jQA(e`>4k12==s}*s_v9>>g zZCnL)Vm;O}8ABS^=e`WKiIm`$M_HB1!@eO`R3rqjjl0mX;S$CLNJ0=(zY9nj zL$)_6*>L&ja`(waY_p&BUQ->8Z2G=68ncHn;)qerEn@1r(V=`Tc2wy`-wsxa*_`XV zR3SnOYHdg}!Ra>T;WO~>%aJuTLZf)UB&+oG4T0e*X+UgcPX zun?w#iN!jjz(FC^CG(#5(iaqq5ix59+}tlg5IofQ83PAsdrVWw-uJ ztxXBdsGC29C0C#Kfxp8WiNr;zgkSA3rK2U>0JI#)6(=v;(AK@*652!jv*0xluxPe$KN0a~vWI60+D&`zlsZj< zIk}@QoG1vzK&o;LE^yldcrgpUDNPk3)VlzgN>XZ*Jgx<)gwl0k~i%x^&6&oN?t z7SU&3D3CIME-`;PbJll>T|O3wCti%tQmX3P?BsW0tj|(LD3_b;Uly|eT-uKKW$7U0 zxqch_4HvULe~`&#QF%&}b6tr^;BqlNC;^7a(!Ux?Ol3IlpUIX?BreX~mQ%hHF#|fp z{6Jmz#v2UzNQIVokdE)a{~-d#1;}s4uj7IDHHLBl_$?X{wCI5rzEyLx3xQ9DPpr%#1gxj3%vJradz=qJG8m>TtBOcoIbd1KkFX?*ct z8}UTr;xAk*J3>mtN5y>Skr`c|pNMQb*1^JFl@~c$?BPw~M zS?_0}$MDl&y#qZ!~lVul1_QY7s!E$PIuxO;~@cYH(@TL;qtWsuxsr?Q-7>e zRD4SmJ?St00LXX&mRBi<17zzI zY2WJrdfY)ze>t5$%!Z6TT*bK`BD$CgPw&U1@Psz&GW&Obe=~a+TmR4A5diD|C`sZg zIDq}%dO*&##;x~Q;W{5F-@Yq|D0J~N{3}J`=Xm8&Ph7?S#t@{2>kLWpqP4+Rr47J> zOmNas2PWT8Sk{{nIAwoNVNPS7r#NZe71Wa)ysVq^Vv2L~#!QoquLAJi0q7uyV-1bM1oV~6O@}}=^jw*S_ZPLug$VjkP2J!M zjLN4|P5A_g@uvLv^cN332$x56-tt!6KFwtx`c{Jr+wbT`K-qOleogsgZL8U*V^Id> zvGNza^~Qc2M|&Vcq^Qypdu$-5CZ}AF?#6V*W6o>wB|-y9J?2{U~W9$SwN` z!FMm&d9cIWKSRes?ld3j)xw-blR|``l$C#XXlAVeP_LU9gz&R>Cu~a3jJa+2apPL3 z;$ic}$+x;cB!2#tz!`5pXT0MU0gkn5%I!gb$y$3=kNB*f1!C(IC%#5`K7y7`PeH^i zSYrDa`-L|%TI(Od4}b^NgfK#1qJ+(VQ)CLY*8dx#@Y~m*_$8cfYz_^UMBJ1uP*chl z|9VR=ru$v+1!c{~VsmAfCrk=e+T4{`i;N+ct(5)O#S9i1qen@h4X)WF!p%+0cBs5Q zrw-`f?D0Kzu|w#^jAHu)3LKX#J(0|*{frD#FO&#YCHFCC|Aw)Ms|SH6cGoU65XSIx zp<)<5_3p(ZZ(NIJCQpVib&qy;!s_CuzlW&!Kr9mD-!M%%oOe;t(7%;_tR!F24{0!c z)KFfpXdZxpn&}|W7fX$}hp~G`x?9nYY9+8I6YX^BxP&Z!ASxE&PG7{WKj*cN+BT~w zxJBDmkN+$%8NP=}^9vn*u zwk{aTP_hePw!kYCG4HQ)>kNhT_crC)3GQ7y;eFG{Kl;x62ir6b3g*wjcZD>qIQ;S; zYvRzU?hFOmN~LRjl3D9SjqXBgJ~~Icd_>em#u|2dheUVAMbaLf(ynjy)Z054zWPYh zT9CO;W5|g~yU;-%>OyAoO(69U^e7{6f4J3?3n71X7|A0*Cg=xmYjFQQxyZ+;5-ru) zxAuJxA#yNyQfs3`J6vhcF==bayj9ov*^JFu9CTR|vPe~vLvayV8AE;GXazY%N#C{eAB<+LkFtAZX;lZ(chICSdVJ>m4{JGvQU%3*M z2SpoSwBQX|v=v9ryj@3@mj33BhqeGk{fh)bxv1(BUl^N0!qz|O{*&q5Wv6LlY=s#` z$0yF2i)AKF;Ff413dXZkt8?K!T!2DPQm>5{f6zF;blCLbdQXeiBZQ9N6i}L_8EbB% zAQzmT4It(jljCf4aCI|Lmk$&elM5I-C0cuGP>!xn(p>zt;X`9=y{I|yg~MHeT(KxM zqIlLP0)%ThM-~<<4X4j)gp@}2;~tK^HrlE!5}Z&)78r8pf~v8T$w4$NQ)#)HFLvco z$fxVLz1BV(#5br2{ReM5yyfhTVD@0U4mF`LZ3q?SC8cJ_Xs>}j)jByi-Lw_A# zZH)le#-B`Da~KGPMwGkKk&MbMaFsSqgTf}uu;t+jApZb!HR2(irN#68F!{uv=HC(r z5iJ)1mmog0jUGt4s(?{#E8ZHyW*=1(wmV9aA1mP9i5+9BQMLk~j^dBIP}q%V;@j5~ z=HP$kyKycmR2R9*E7LA+H`26H@VUxwMN2^%c^cea+#InJd2~-CV6xNwIZSA7$3m3sTc7lgDHm z+DBCaRYf3c3pki0CyJOzg6=cl^3GrzoAn&bUA;0(MTRXXIC8nqX#r|%+1=;BXeTHO>WyiGgoBK! zE)%tj*i-7RWwc`Lc-*z3szjsvHnI&@QUu}Qz;f60E?}}PAgXWvEOs5;>46oi>wc8X zdYZkuWER~f<9~qL)-P=RSBm{V;vQ;Wzz5LKkzUEkz|qYXNH1ZfZvv$MWoG1P`UQXh z=*59%CZ>)AtgQ4xHkLN_O1AojKzd=IvzZ}K%wFG(UeL_ZK^|x?WMgG(V-2)+gkk@> zYG`8wl-IYna`-9-@gFA;u>bFs90(Zy88}&4e~rFwBySHiGBb3vu_yRSy!`KB7Z|pG zpO-lS@>M?z?t9K7{kg*t0mvWG+NS@H51tO6_?SS~f5j-~{|gXFSUY}EM*l^oA<)** zN#F9{@IsSbNZ(RXOz?}+U#4b`KzSQ8>#xXU4i*MxRsu!>Mmh#|4hB|jda*B;yS^rX z4gm9Y5PTil^fLO6_GYe{bj*wZCJq8R03(2vnShSr%c^1`pkrcTV__$tV`F4tWFw$s zWaMD{n(|fYf%)r81~$MyXJ7YVVbbR1)uvaH(RZ+b0kHlfTt)hS;aUH4x&9Xd`hQFC zOT_E0e$}J+??p(!2w-OW_fe%@(6*Y3Zge18XWwd(`$xPsB|_&q)$5E# ztE@QarG~6_&N3H`Gbb#Hyy$OVIL{pb@v^I_4YwIfc9!I|yCh9Ulu4wTO*9Iyk6z?G zXs?1uB>ZQWT#qqGq>@cEagxS6*r~ZWuxkz;#&?;nBGHmuU+%<>-%!p zJRj<_fh#L3YdS7e#D&x5ia6ckH*(9&sKSdvW>kp?HI4jFiTaZeQ| z$(t^L7wzDb!i^rhe0TVR;|OOtaCprD$97IUx3pD_QRT{=D&B8+%||r=>XCo^J@*?A z)EHz^lHje*Zwj29isN))BGJjZx_ST_%v#VzKysfM--<10h{F{|mOMcSjhIj_Y4a+I z7E~1{n4M0i5B<;3y1UjfX^!Zj@Ik{+QzHL*6}nz1%#P_A45(HuI*8pc(HK4nWKw); z&M8&8=#MSYBx0$afoqOnmyKZE92fC1JN99t@6kxP9_s2E+DX!Mv*s)n%_K|IAHgDM zYWOfTvEuI98y_1VsmG}UTRR2}7?C0Zt#^2OVf-Xpx6i4msp_1Wc&Jv)DYQkV%wcSG zC+AsC`Vf64SJPL~1Azlo53<4I+t;pszFRXhiU0|#_&sA=%%E-9XPClXBLMKYE=)2U z4MqemsyEGURy)8kOoSQ^wf?*5@oAM-fKU$-L|DC0=9oAQ#LpjoyZO7$>4telabnxR|tRD%)-0&;Q|0D(VrJ^bkPkM51EgX zpvXMd&6B71tvudco1DDI_N~3!SG2W(QT(SV(xQnPK!$XmB&tNo%6W`&(V!ur7Ls2= z2i_b|Z~p#JQ9=0&66ID4&gUohr@yKRDL8N@X!D!~-jqQ};>E!oZU>Y5wr6etS5ay- zVIuMPztXqz_4!@17LUPGRu9jJh5Be0HT`-BNDbajU-bKC#e&83g|a6#6*UYd7^xFR zXfj!2#Vd~rX+ua3b~`~b-~+y4O^#2%BO-vNZa+P6VCx8TPi3F7(CgSO;aVrBi~1{; z{$(}l14@pL+`!!UWFwb?)qa<5<@+Xh#EsQB$x)$dvD&EW2!iX&$@JrKT-k^!far%e z$e)~jjHbXq@HNCYTh7dofNnuOYisLIP{=T;Fo#=v7ImzrpQrn!Z8rSecn-208k!nn zL1KeqgP^|OVn7j9(&yAQD!G}Ix^-IcRYm4}-Ph=n$E_b*c+ly!&W?}h$|;!k)yz*V zX#f25B)HF&VMBL#)E9dVYWfa+&gx;}aaiDFzrluh>)Rg6ylqcdiork~&iFJ;s6iqj z#n|FA`4lP_636zAJtRK!uPS%Xkl~>ftuwv-uGX+I*a^=)=FfxUrb#7ai zErzwiz{7I(Xt$*aQMXF^`3Q;?KRky&C{mK0Q)#+6*FSf3^|$fBq6WoD6RuL8LYTY} z3qB`WoQqeNEVytU0`+Vy z9p?;cBjlvFpFeK|h+U0FZ@WC~g0GLs`QL^FBT?Pc$HI(K?GRh=Dj0QxPUbz*XqDP4LM z8=IPndX6eln#%v`CsaTU4HB{+(9^TMx*E~l*1*8P+4-lJj*iaY>b5fmVWy7DTdf!t z7B-0@prJj0x{fz5*45$fkHcU@{Ge)2Bl>UTY9k82J*9UZ(iIt1UEd9OFKD5xmw z_6}-@@&CLom2W?} zKK82aqU3#S9Pi*lKVE76QwyMzsfXoImW#%-R@B8PMo9=K@z6^zDU|?YCxDMJh zx9ReMyx=BBGdpWoC8u%yih#0@FUZNw1OhLiY)J9QR&6Dqo@+|l+Db}FssVtyx;kP( z1IqO6>J-^AN)LoTQnZu#W{ttf_-UhT4^aJ~@Yq79Vx{DJpkMDhJ;W!lX=9^JI|W(P zGM3gv(c&o1h5aUC$boTS5NB61$uqA0OUNm+Iz8 z(Hg-HY+FGEg8@wdfU#7z8`V9Rp>(;L^Ka7v&YvJPVr0q=OV1+^9Vk}}wDcRZ3u^ir zVf2yx8fr%PCwn(_b>owhcXxN}oGH@9t=!z9;^IG>nk?C>*dp&=FV+DCI#=CKTO%jb z_0TaeUf~mt&V|u0Wq)~q3~M|B99#3V!9F=D7_9?xJUN#r-k^jDZ?h;J<3T#UzWgys zd3jeZJVF&C@lv?78GrDbqr@FhNpcWZ)b#oWg%}w^QQGH|=Rrimh6CV;Jnv`6#$-D6 z^SY3mA+fNk^?rkj&#^SD+9n(%sM@p#ToQ5n;E*Aj88)wDgTX6=JKLL2B_)%kMa6=@W2zSX8qrIza&jd`wjUSPFQx1U=1r4kCSK(MXy$`w5np6EZ$yh~Zm2duAEV=y$SF|R@yBc*RZ!$_o zkMep!*A2Wp5iytgS8&4>1e^5c|Jg6d_kivHT|PlkClL7sGi-|EBc)(}8H_9dg9zX5 z;Va{KW6I<9SrRHJkzX}SC9kyXKnq@|GtojK+q2# zt0#CaK_TjF_xhniGlvno1)O80&Sbc&(|cD!CBv4%Za3CLIWOnqvDMjw?9cesUAlVO zzZ6=+e!YECy3jNwORF)Smvv45a6Tk+_N+-o|C?xNB>VsxOBSfeUGJ;Tr-tLauj#MX z8ej(QGc+Ga9y(n3ZUg}VfoQ)dTqu5ZzJ|>S2nj0qY#y&aBg(G`v9#UtYwsov#FW-! zIIxUDqZTEM9==2&4@vC6MUYSUK*RCHwCF2+i2b<%%vtC2mAYyF&%0qFPqD(;9S)?b zG(R6RkO?ukU^TFtkia_as(hsZcMn(-jH&7AeQ+Mgclmrg4b^u3%eW<^7MS{h(p)dN z=cns_5ZkQY7C3#`?6G|^=MEze%4hJKsVqlgS@AVu;1r(miqeU9D;gS;HV}|a( z+FGTGd6gxpc7hnfSn+V^@Nj5JueLVF_39kn0>NC5J=lX4X2`bqgO`PJ)tc^`q1EPX zsDy-D_BS^%nhB8xku19@Aec5cam)@yQS~6y`oRHt%Fh@mqEw5qT?!ErH1ne^Irr#j zW_MzoxvE142;@uaD{W%JAHA|8Rz|DA(8ypBuAm_W;K?w;043G+bf^^hxMnGf00zcz2Sh?$v z*V}7?zg45Q3w}Xfn4C|&7%9ui12VpV&*cVp2Z3L}4S3d028uc-J18__#QM?EHFWn* zXw=vkPnuo%^sa(s{S%Y^`NhRU0~id)thrh52v`_sR1equ{QNaC3>jZ(Z9WQnY)GP< zy;Ly@J3oJ?B||2nG{hoPsuZTRIP2)DM*xdEGu_L<%v{p^Zl6-`nd)eY(1_%~w^OMQ z5fL#0Q`>W6gdU`cb*Q|u10N^u97F{PN@NRkka>o)Os!lVYn)PU$kZVKU%%PHktD)F zjV4uHeUX_(iFOlG8}t0^?BewF^+U&kq&gj|Ttud?AzwN%Q;Qx8f%emiVQGww4G&;P zM@{eGx#0%QXyM?PxO+Ef+v!mp(L-|gjKlXXoEGF5x>i+I77!*2PyCEEhrR=%0Ccn&^for<=~ zZR~F!@U)<$tFtrkvN(kJUrzL)gP|%J_xsj453L9XyBqXs7AW8dl9DI=%1e)6-5|8D z&`|5VJdRag_}55#IBR?tq&A%$06-i@J)eLn7W^GNX@OK$ajeCFCbmq1t1e^d`r$1I z^MW83RG~17gwt(+AV?eNa)Q>7lnc7c=Y{RqAxlT7kfFJ?my1UVl(3QVZe5`y z5ucY!mA`|)eOr^M%klcP)d_L}ux^;h#@aT--eOP>rhH&z#=)sDDz&m0oREG3+BlKA zte~+H!KA@&30_oO4ctQ9qO$XHq2?Zsq|>#{7G^Xc-U0XI7OPpIBmxd8T;#+~*(gz$ z(&X1y1j!%)0l)j>g+a&r?cN?*(~uJmOT8SHS|tyuE@%e)t^Ns#Ps{u+*UM2>0w^7u zome7>7poP4o1+!#mBsS80{}wYlCIYpMIOZG9g~0f`C_B#468FNAfQEbIGrpJ(+)B= zRyaXsc^o5&vwjh#E#ik8G%HQY7@qv@owM^@Ks6Z|nFl);-XHFt-0C_8!*T2UjQ4xB zbpFgy+DwnVx2VfQfb`~Gr>&L&|vI?q?kFjtfBDeMRZFo z=q#YUhb}xf@DkDHHZq}q1B`aufUX`m9mWYRW@dM(bP<>>Blim~Nf&lQP*~vgs`;=d z&OR7mNPrU8(Dm2h&Z-DeLlm$*(}BGKWED>A8e+@8My#RI5;;Z*y}e2k)))oSF#kF_ z__8*Ukb|30spvePPjewy11UlclZ#uea`lLzT@LD`ixWDp;onjqZpP%bliez!ub=s1 zVtuEUw%3uh#o?Jl4o%@2u_6sJ17_9J#~*s3iG%`?5s`vWMGBbL(lcmk{{0iFHc(Ph zQdW)>`(b}@_mU5~E#U3uV2SeH)PXPj)k~@54~;}PFe%khYn>}cr^5|+(iFOOf*fuakQr< z32~*y?>lqprF;*Lp^KLGAQJ)G2ygsu*uU5Y$x|}_ddjd^q9qie;3Mn^;Q{q!!HVq% zD9qadw}T1B)GM_zCJs9^Oft1HA;S2bca+VOGb9G zSkC$F1nvI3lA^@>0hql7$T4!_#yX_HqHP^4?~YPfKG$+0e1dpm*GNIzicE z^R>;m1nkR~iY&pGFJk0)4|CJIX(WM>YmK%Xp|7Ntf{B}(XKqsO&UMX*6Ix>O?L;dI z#wwSpqx|t=r~%bGsmIh#B>U-62QyG;D9+hR@&nRnR}```-F9zpXB|a8>JZYBag4wc zF~G43u2+zBG9x$Bsda-`nKr$wr0_hLvv1qm%L~BC0mgT1%W)9Yl00!yC!6nR!HyMO zi_gcwp|7nSWtqRlACDwm3tT0 zWyWzcPSIle;a z=4FqiUgw-GOUBsv7*Gs$*6fG8zVNq)#2a5ef~us{B3&e+YM`?mLWbZPIYR`r2#JAl z)ehitaZ3q-2_r}8EZhZMZ)ob0@|VDGud|Ilr`K=>Sbtgc3l(R)@_3YuEz}s5Y^Q;j zwoF^j(G#C5Pl^;PLJZ}(kc^BO=2gK2?JB2U+y6B=ujAVn{M?>drRcYxwOur5v!*a` zFfahI5itcjVm5bsTQAp|-OSSp4mC`~hunqWf5a9vxi;Fnp>l>0-q-sLnH@=*c(P)! zjdGeoPcwkPishQvxLA=);q0{ZRKJTe|0a`Rq=dhV)*qMd-DGJ}PEJm7gq|n}aJ8U= zJ@uZRt%`ylF226LswU_v_0GprIo!Tp4i47?$%>cT-AvzKLe=JgaiU71^s#ItBm6|L zd*pkY4K`TGvZoR4k!WDr9$APE1c&_L^xT-EDVWH?eXtm=PV zE0qp|a|uIGqTkf`9n#@iyJj9;lbRBBKul6{2ljgG-3(i~1}I!6xN;Yuqz3nxM2bzg zF*l7e1}VdalU}3M%C+5s7UHZFqp=rVqkpHm&TXmjC02}f+%Gqpyr&7t$s8yh1_ZzE zx()x3z>3XVbmK0@qLHABz5v|A%S5cb%dCGcqU z(3AzJeJ)KW2_ovQIDLQ5{s(oJT+=+Ms)kcHp#yfMW(mY@@dRlDLn=&}iH4C9{x=TP zgo=tbEoyYH@O7@^*?}xm_XO5J3`l6;XQ0h;wcfYqY>&rOUS8hSL=}Bata#!YMhk#u ztOo&+Qa(Y>W}nqa6y54+9mW@*GZ|Y`CD*|2L*}*f834LLvvY?DM*$ObbXG}I9Kpde z_ssSD^8`IY1`<&>@Gol2-+ACQFQJ$qpPnR%F{Csx>+Yg3m|Zd^EneBf{33&r8#6v( z2n)zs;Ika%e7KtFRf)dH-Ah-OzyLxc`TykON$4g@CtKoNo;G&XYAoCe9_K;vdgHamOxsjhAvn^v7j zHohk*N#k4)dyTi@JdZGY)C!X|NqI69cc6W?p&~9-pM=*<47ZEFR!M&0B;=Okt0qKT@MlHBv<1In| z*GWzb3v*gJ+Jj1ouEByOLBg`8iXY`X`|M%f9es=Z{$J8;?7swadR4~RQN>*)( z9y&~CAgj3Vp&}qrjH=v^b>(lQ}*Vb0twD#*QZ_OG#G9XJl zyeWycg(ohSXjU&!@#D~-{>c&%8v&4*|SLB3Cuwt?TNT%$&VRyR;0m&DA8{ZG}D zpCoBcPEP<;|ASt;oCJc^1au^~r@@fxGB#g!xM}!nlXGmRkM$W|<5VQdd&FbX+ za{|`|SzxQhm-m)9Vf_7_55^Vk|Dd;AMV@;z1N+&K4WH9Bj1ZfO<_1H1-?KrsNhBbj*L#y z6xDLt!dx2g?85hH(|w!gjf2jXO%BVs|IyAmHFILPayxH$6h&IhE7|W0{H;KnvPz?U z-tlMxH$YNe9#MjT2!3p<`L}_x5y@wdhO*loNUU@Mt6a15u|fiBFEU5j(b18YmzUqo zxWOK_1GQC89FzxgzXOR!^FPLVl_GE`2YW;MK1g%4%B454a}M(QBWl9oYtaNGMCAF& zx|VMN%h}cke=Y|DXTbP6T8@??c|m{(f_nh&o@NisI=`a*Z7h|}r@mZ0f6=l$dWJ{E z)O9Z0r}Edt^&iB`x)O4jMcDL3volI6%3joYwuXy~DjbqPp$Lp~iO867@k?}z)#P(V zotz<^ao&LG&p^-!koL{EG~*C*@1qGFY z^GRP{pi7NGTmc5vzc%8uOWNosdMpIO0SO7&2&GuR5gJ-II~(}v2ZENLc+S3*Oazt~ zFact_wF)}H5HpT_6N*Mcn4ETY4Gtot0Z7L2t;TFMUjHoE)Wt<~_Zub<)pNXERpytTD;va)JGi~_Vh zJw3HKLJM_XcdSD?Sh)=On=}|u0;@Pudh4vHB+0R?>+9VvHo?Oo*%=ubIzJvgV=3Vs zJ_h#V=U2arGfC6Q@=^O-2<5VhLplCpI?5!D5M(kLd@j<}7zW(%ZmFy3s(o+n>$QMD z2=ez;rGZMM;Ys~xrI5 z@*)|Bk4s1>;CV}q1Im4Y_k9Ome?lkY~a8Qw~*_0#fWo9v%)Xle4T7AA1F)lYst1y98YtM=A0>-?yh0e5CeC z0ao_@h0=%W~n{(-Y>bxq3Oj9G>0@(3}aBCrPa)y(DdUV{5(S1{^ zH)6WwDt*M^L;?uqB&hJoHwWPp)k!Z+Vt)bEQ)iFmi~V+0Ro|r4vmALNl|pt|c@^Y9 zpG(G>82iH%b9)44xxBZ|dh7T8+J3RWw=X{*ej@S$4v!9l824ufj_lP$n#yf0~1(+$anEiG;ZQhwAyZyj1hG;!J(Zi)09r?uXvUF>nK5}pATKX| zF8+H+aU*hC_-|d3jYJ+ip603=;#R*M>a`mS4Da7#{GR$A@0Ng`;>H z2Pc68%$}tM=75OcN1%biuPPVhs#z|x(NX0JwFF|_#~sq1w)qPQdv5-po7>wKIoV?P zWCDe9lk#b|Xvrd{X+?SvV&RiSyQLLQQ!-rwn&|C}*iNy&!g6;FLf%UA; zvgYyoyJoC;p#fqoeY~SDDhR6wpr8ifdt*358XkI1!8u9R_0Y>Q8?b8O|Hgu)C^`qzd)v^eJ`EA7wAF@ z?0;IalVZT^V$E236|(R{Djq%lRi3$PS%fze|FIOvn!b87mpwu)i)N)ZQHUyZ@HN`uj&-}p#X=sEp>-0 z{3(8;KoMN&l?q2i)r&`M%j28fo9ZdXfueC>kSMXXrM9GJhPfMSYfJ=Ya2KHKTPM3F zYiC(;wq*sJ8{2nF&?OE;oW?@Q+9T;g)EgQ)pd`AV1VW2d==9n@gVNCoI&C6eoaUq* z%orpbilVqY-OnU>YNR0v#Tl(+Hh@XV&Z;_ua4+AEn8ahHr^{)Tf`5846U?wTVkpq* zhLWP2mM)aB@PPo%&uyLKLMv?)?Me`?{F2YCyO;r<|JqPf% zg&Vs15EnV*kKWHmSWosSg+A7BkE&Wm{z)Pw8L2EpnRF!6#t`G*V(KP4TVXm;0zM`OExhrdh(JT56Vj{}=!qua;q$yKVaI^EEKnSj|1T%?x ztI+q*@zwj4VwCY?_!ODX>dtl`n%NrC;{kKncNyc1SKO91HYyAx3|YC@k3&gr+dUN7 z0q$~yP_&@xos<4y#%%v|dqx66+z-L8dqw|8>ehsf(w{)64{+M!Z(Yj^Se%}%K$UY9 zrXlEb50eCm5Eg(cgtwXQ%oVwAQF*jvGsPpjJfoRjWIx$jK{tPai>p#jZt_sMcu)SG zX_ZvPAqv&5piw*FMec|iJ{gxNWSm6oJsq(Em1*_!2WY=0EheTqW?_H7LO8rMwufU3 z|1wA`X$wm0GyfH^_$o;5x0RLWRbOZ{Hd9h8sx1SA2RuVsRysI8h9bEyqas)1g!#LU zj}xnf8E((y@NJ1Cg{ukfY8n!z#i2hgXN|IcGMH^sxPu4S*2IFG3pXumR7A9#f}9t> zeu4q3xSJlhT8w!iiV6r#rCgj6BO^_Lx&=F0?!xRWCGXLJJ}=`%>1%I)nPHL3?RlzZ=!%ELs0XM9RJ%=ob|Un{GeYp&PhTm15(=(X zSpzaH8Jf#q@ zo{^D}hUrgJ2M34ktxj?ALGxs3($pw{(=x`6*{eHw1$i(IZJl+$k2M<)cJ&9G_o#m| zrteLNt}eUNMXo=9L}d&=B1=^Ae7XmHJ4Xrz&r7h5(ojl`WTFlk(_MW;3e}f?*GLNC z$q%)KwT(EL`ncdf2i_Ar$tfr#r4lh}x|*pwIH1oovCzgF(#hqLw41)u-q z7{8erq=QnFYLPnhLJH%2(@P72$0|ZE_ z#@u(MHgVJP*7Xz~N7~gI0smn){Yuh%9Ikdf+@w~m8m+dHy#(Jac}ir)t*97TS`r=I zRVR<28dPyq)~b`D*05nePuj#t8NNSQ*r>GoX0;O-7l1FVkpz5_s`+G%37EVq^CeHDFY|O^%MGBVBDr_oFn}3?()nmdP?)B}RFH8)y zEb`!tUk2YUMVhU&#iBs5@)@1@nRzY6c)Z32 z>&uI0PcOiKf9W)9_K+U{_|dDj0HKqleHL7(&Y*)3=YT&VoJ8;PX*L!~sko`?soz7| z!+JBxY*c*(ret{7bRIwFPwt;rPup4eUF}X%5+!QdDk^_xtsB?q13^x?qT;6I6ysy# z$IVzfw6!(XHWz>L%Eq}08T_lLaBZWnWmcN8&M8W5j%5c=+O}jrIyk^MIPUivPrQEj z$?wdmM9FVw->F##{Iq1(HoWNR={Y~A=l_0iEK>xEP(3{;ZH{gF{uk~rO?yek!OGn@ zx@t6wyzZC({#64jEq`~doY!)%h?*D!gXb)cZQa7z2ws7O^T5~mMKIJndMQ=f3hRnT z!WH=EL<@6LFS6OP?X#?mTps6B1WOn+)980H0&19m8sCqa(^Kn7b9C~Skj)LlhV?w} zN3F93456F1?XS4H1)0sMD_-wkm%H zekw65Pg70pmx{7AduGB((Auul_-@4bE)EecwDT;aypAM`m9=KMTK-_}R+sy>XK7>O z_wd==_V2V{f7t(h|2x+W2z`0U%+yYvjhJ2Q_V@qByYId(rlwwAnQ6zI`9T_SboIaJ zjSCX!QBO~4>6mK1ud0gR1{D@f1I_gGbPL1jHz)zw8y?=Q7N9fn(;jK#7qh&9dyPyn zd*;Y{YJxgW%LF%8hHlCDnDMbAS70c}GcT&FzpBtJ<sWB1 z7jBZ8?oYX!?cYEFbs)k6LB-#|z(RBRd0@a!G5?v1S_B`%1X)ENE_^yq@M|g*{u;T+ zBcAUTCYBl|MUU6rT8;J{^HjNNag3EMks}E4t4FM1N!$|g{x$WCO?6%}o~WX%8Y7zG z-jumON=-vuSwr3LeAWbz!QH(q$jKW%($6$&NiIAENrILjnMOPc3gqdG%RWvoUc^Hb zArX#C6*_Q08y(n~*x>!0M}+$$BPXNtH%U^jIlHbxSkR_DwM8>;-}p9<^U(2=uz3#O z3l!fGeBKwInyH^KXrr>fzrT*R_fUAQl(S~4uJyVDjK^QKav@HSkj>ra7kH+Q+X@4) z;+0g%vEe+QBvcr%JJ3gO1()x$VAr9nx%n!-Pkc#Z42Ubr#Q&8+F1CEHX9^Cb2Ckm;Jf1fFzv90@df4r^ zktn=xKAuoLb`KA~eL8JxJSz|JnUzWV>s|Sx5bFyDhF8#TywB)p6 zLyX<}g0fS)*Ot{IQ-AurMRpIx^R}&;6}3w9`4T#~2&UHUSGG@Od$5T!^8VE7xB0C0 z=qr)O#>VR98t8Q=OQ5@>08-LSVLuRdsNF#+k=in1ovL%622QD6U~(W z%-n2$dOzaq{+S`?`tYDqz96==37dF!cyQFlPZ&Nws<&zIA$dT`&O-8b|8d8R($d3X zQ&UwlIXXF;g{Yky<_Asjre`iUl!;sR{Z46hgWHmr-HWkHC=l1Lp6A#R6k#1d&9ilJ zI;AXhwnr$TC=Mhl=JL3X8MDr-ULX_lJwL8CAcd1zHoG^#PX>}c7gtpwT2bZLZy2%; z)*km^9vlYNA@x6m}vn0G0g)m07 zBLj>Du$a+iQ{=)#4f~m)FbTk2$FBv&OE_djyY)~SY11O+QmId`A_6?~w$C2I(nL@I zgz4CV*kGWnSLna;2b12)1()=3e$(QyXnVfAgbs>JvFy>W&Z=O()VCd))mJYa-amJc zJnAOI8U&b;x1}yFep?`2I2L%grD<@|#0Zsi)gYLFw!gbKd{z&gz`NrKyhkkA)6!CZ z+S;@@9i9?l&sIKQYDa~>pqL)W@^~V=rLt#yla8MxsiPqx+UdFMV$%!yh zK*Kw5QaAuJiBVRC4Dyt}54oz3rRHu#lc*6;*1jhuU1l6aQ@wVv+oP=CUA~vu(`OXV z6D9(88Pk7ahoF)8XXfU-{JW^)S|#`ES3s0SPUmq^|8<~%-krATkNjypzWQ6} z`r4>M!UjJ+zH=UrM2zH4h8a33hKgh%fWq}{wCmj^i5`?ICEz1uf`HyE7wX@ zH+vOR4c(;NXL#M~2I**vSe!Pmad~xq7K9TTyPdCq{+7QQ_(Jcn&(PA%qbv$^JFBnK zspaeRdP$>+Xlk}=3W%FU}#zN>OwRMb5{$1XT2p0)fo-~IU?LlSM0#*ly( z?(1mNlK6nJqrU#u7qt2*r~iM8j&S|&=*a(L!x%H`e`FwvwZ^Lt*ikm`Fkb>6TiyW+ zr;uP0wcwXXbrH#b5XsmZcAse4$EFJB+kEk2oswH}ocI-TXuZQ~z!A{CdUqCg^e{+} z=CSdgW0novpRTsU6a`mF;B3_Jw{9Ik=^F3BsX-MGf8P-;Yppl#tQ<%RDsoRQ9n$Fd zwo@Nh&$k?C;rYoHDmKIybiADXt<2L?XcpY|>vdK7hoLM%4Uc;vc8%IZZ6igKo|WVg z4um?aMjV?tr8UyM&OFJ@AA7yIC=kE+bVcET;(cG2zZKbgOYh~PvYmPVe7b(SJ~Ocb ztK9zhxVRhL;d~^==+;8tTuQYJi(paXEk*E)((bkpPo@m5GoqS++GSTW+U&%J1QmzQ zlem_gMHcmer5+QCXNihjMmt#-AGe8g^Q9&!g^uyg>FD#v%3emPzi2XTnk53n_q=#gB&IanmdWh>Tgas9`l3JxP_L=9V;_9)F zZ~LUSP6eQDrTa!}zM_KKjGGJ$%e^)gWEil?s6Lld6`mf`&h0^Xsal9ko#)zhq&SLz z@mc_Q5;ZNV*gRb$@k4Ay2((P+O1Y0iT?^Vh6R9d%GoRRt`^qIc1k?~h=3!{V<1al& z%V?!@%}nX)y|iuzJwjNCi+W+r$cnWGON=b{HjiHQ=aH{y1c)igiZ;1n(N~;n>EI-y zIt8Osu|YPywU$CDt)vpmyQcU5Ok*u+P=6@6RKiSMrzBl3=1V6RP;g8#L*Q*>be$wc zK!&AUrOj_T0Pqyt`djU}7VQG{j+h7%Fqd+T5fH*i+m0utMrY?}##94g)^N7dOWkK! zW9UUkmDKYjxRXpGiV&RDT;*IB$VC~C6n4=38){7^EJuve{4*$ObzOX1(R@4GmTSE) zTD_xj|A48Kl|7F5D(PCFvwBuwEdO2otGAP3#Gc$xfMvm*2Zm6DzEvhnyj#oZxmTx~ ztwHFZ;=wE@T8s>%DgznZ^q$}hI@;%@$PZTZBcuV-Evia3pR;3b0}aDEOkq;)V>~d< zCORSikBA*urb{3lzv`{EH4|~yjJ^*+5cV4Fm5olZFxM4}EJ;9wltn0BZTw8}=9R!R&bY#gUmtq;H4wMV^J?@s_5E?Tx$=TA zfysj>wB0nkW?YE2u(kWE9UWS}LJg-HwNVD1-cN-h=D1M@fLF3yqZ**s+qmGZE*ulu?uF@MQOX#UMN_^Szq}DmN1rrh1EYng=w@v}G zfs&FLYUZhOx0xmlw_GDres^FnOGNts6bk#Z|mG>c>lES zS}DNRu+@_Q$l$j^JO#v<{aWjMn~<5p(`WVm!QjIE#CQxQ)?TqM7$qLu z5}D8O%a-ief*_u41Y#p8-@%y77qP{Cdh|B&5EpsN+Gfo?iXtn zqkJYI2>af()q7PN&4dwT6+x4aO3w#K<11?u*gx&adHgTb=nP+q(7$L3zZrV$YE>_- z(2ZA-D|q2uY7$eVfsD~=SB}PK)Y_f;`ujoD7+sZVma%WhAAGpfYgpSEB9w+i$o5(3 zyt3x@&S^^{m6g}5?Yrh646N%bBgnH^-yv?eIIK~j&+6JtUe5t=_u5x)*_l@v%Qc&W z00+~?Vpr|;$JYr9UVIQAb%Ns6S)_ z(nmZcbnq^`rb!LC=_c*I-;dns5_SIAo*ROA9Kvx}QtvJyzl{@=u}w;KFuOvvQ&xQv zAu`8c#EL+|#hB^&JjcE_4`#(Uxg8%VdD!;#XB214CbBEpJ4VzH9au1=U(ilNVQ!ht z9$$;EKPIilgAOS{@V-R0Y@vo3(`Xcv>rEeF!P25ysI?NUdM>sq*G5s|Qd0>F;Gu>JJELy7#VH0E(z0 zBxIURzt+{PUjN6m4TeG1Lnj+SlYYhLr|IxBBEJp4uTlp(RS->k!Pkrau+c1+2K)Ni zO+R}7FI}H9IzSV9Y4Jl_$chf~=UM;Y^XgF(6XAXJR5@e0X`5_b1-w;cr{Bl^aGoRn z`J&t)hAensys83ZaXw27%UL>`N7Kdl+#>kn?q+G-U6j9k^`eu3|ND)L#Qy8J-7Q7< zx<7!Xcy#Aunlr)?ZuRV=+upzZ+oVM$p`7qGombs<~?QXUryRHbbR z5nW@0X*J?mi+fo+pUR#*bG|!jnOM(0ALX>qM@Hod*j#mnrYOI&zXOgSk7N~_whBwn z>uV(V(PNEcz~4o+uAz2(64eh(C z?wUtqNeC$-kocCrEL%dIW+nh(vkRc(-#mJl6P49fLMmo~&yL3Vl!QEq?4cwYZ7 zx!0mzlPD7`eO zi$e5BW6_Dyb(x2!ZcUoUqcZ0x%lWPlsT zr9Px2l)!3&!q?YBY4ni)mF-%=r3{~=t`2?)twy#$Vg5i$BAsC2+w^L^=*CZ!ulVxl z!GfT5SR;c_JibVT7{PO->?vyA{s`Y)*7v@S{0hzONAB{1tz!saSggAj+% z9y!iQRI+5hdeT%5tYHSh8f-mHAmMyRSdON!}l!_+)KY8N%_4M9bquPFon4H8T@kfS-G zZ!|OTS*ylt5lsh zO^u`QHSnSO$s}6{$VNs%25&UgGiJW4wMyImbOM+coO1p-Sq#do=80<5(Sd+}yN$2K~s2HLp9fz;B!VrbmnKZGIq0k;-FEL-6`((R;imbbhRI)`fq{ zr`b1=jydhFTY-`Zo{Al33tI+a_R|_dFbjoFUvhv8jXm1Oh;5kQxH%)o#tO8{z&1>1 zu*PG=oE+;>%(AxXWkAYMo?k6f8Fe5@e|}A8r+R7eHPJLtefCL2;pzFx z;V39{CePG(x+SBgJsb@1Q~&)}ITyp-8R05`=5UiH)kV)W ztpsK4tqY*GlTg?yOn{7T+AAs}lWk?akTfU3Thz6BRP8RylnS;j6~#Y3&R7JM0UB&; zP%MVM$>QN9j&$rvcNT#^sqyc(-|fDZPO53cqIrB|e<-SqyVPR|zk3e=sZx#U44*4MU|4!w!!xE}lf$v;u|Q zmPFr{TMvbz7&Au=8r}q9iQ#$svnym;uL%Up&2sSJjp$8z$BUX;-q`83x340cjxNQ4 z3n1c3AN)i=&J^V1no-yG+I9kc!X1udb(>|nhb1;NrA0zqDpzTh62nF0khwrPHw8BJ zE~H2oSbPF(bfcCv`EHscsI!$NvxQW41k7_GsOWNY+)7}H3pm4Fm8f(X+!8F#C@V&2 zn~bij45ejC4mOq-Wc*N3cH=PCSZ1$?v~oIRyuuEj&UKgS7D%{nY~pz7ZL-aRBAcic z)FA;A#N%ZX%SrE>X2!jrBiC+}MorF*e7w$}r#=nD;d>f=EJ$xz8E0boH!CX*O$ZiD z3Ls#VcSbpzr2%6hlI2529r3%DgTZ=0qQx|enghS^9X~ksgdsz}e}hO>RlPb-tAx6C zr`6UFk!xR#KS%~5B$`dFwc8^l|H7vSin=ksvM3P$;r09Y+vs!z)eRK@C->OAGyS<~ z*b-cUyF^!Ue@ZW#{m!CEX2|lwU8`%V&TQ8N5%y`}n#T_}`Rxu>U2WIubU?%sobFmZ zfUYW`w#*1go}X(X`Do|U-6^?8?7|K&5BrPMgvn6EpM^uIkGeO1@u=A}*O&*P3}!)| zo*pPac6zGDl;JCxK6P66zH!+^tvL11g<*|<_=X9I2Ly9)lUHbi=7o+5EiOQ7(~9V( z?O&LWDHYzdn=1=zCvTsFp8wXFYSem9n@Nhqho1P~M8L5L`5yn!KJP(NJtVcG?+4>L zc*k~Mx*)%9o?f{Ed9jr8{%~$wfCdm6j(Yi-9b>!<&X@KT(&)_>%c z(bmqUbByZj>!Gp!Gnqg3W<(`T+uUFVJ(k1hhA#;MAbjym zQVdSsO)kLroG7wigBe6ZU^&o_rLsO(zz7qQ9!Mewb*r}!tm%?zc#N3Cq5AmZV18u9 zOs~3%qy&r`J9Omq=XxCY!?;xRGRd`nDWM0ea~cEcl*TJ#F@IP-8X}t2Kcjc#!cCM_ z>at?Qjo8hLj=PuLy?c#qK@Y6ZJiaVLGTJ&ScU*5H{GpUb#X`*>rik-q>v{WRMfWY{dU(@2-owq$9N}yFbXb$v;e>O z1zj5g?5OqMjGV+Stt4`U`Q8|t&6`P`m+v3x=2ix=S?_Ve@g z;x7IhCp|ZNRH!0UZ~56Zx5p-PzL;;CCbxfRf8NzSuV~<$c}~f0uc6H^HJ@}}G8Rkb zE!*7)`!#VlQ!EE{-U#Im@IbYADN=_ z1bTjK@yFz7KA*j>(pNpybnE9z34S?d`7qo(3hqmJvR=PkH7CqrM5k|m!?xjz>8lr$ z#7mU%L_wi-H5+B9MT*xAbbL-U6I;-4i^Jf3!&l5fTK<+dR$1}cM-H|aUEZFsja*V2zCki_y zL9-n5`dOUw)^o`Eq1Tig<4c`>Lks1<&A~P-jAe)nc&Fb!7)mZ^i)bmk`JnV-?Q_YC znE?152PtL-{ldw#L594yQ#*UoYn5N7OX&Sa#gWXyrQ3BA=FGsn>xtMxiao8oXhD1! zgSPOK5;P%;KwPAQsJoXxT5%bP9*MX0Kl|4vGLMD9gZP4*;il~IJV1=63@xG2cBN}l zfy`xewOv~4)pRXubN^6*ZeIPX=%PlZ4fWOrt4RS^Tkcz?mve9zrDvxb^v;gHO@N=* zZR2et=uA{L>q84iS`t_$hYVP=j&246GUAYifTz;=$3LM0PLxufmTlNM)gwR!eB||^ z6iNO~jX|OaK@O_j2f1}}Ny^paJGxe4{6z2_POcuh51IeP*f})`7A{$|TwON1Y}>YN z+vu`w+qP}nwr$&!J%>A$tZRJ!$cOFc@RF4|}y&E2Xc8-|h@ljOCK-NVuMqNERhvrSLPXY1?9jctvWa{~Dho{KPK z?bzn~jys@tvNAGdF%{Q1Jsh5=FFSTP+u)0pE)o(Z5Vb3fMcrHenW3+%jXhd9y-zZw z!NkRipw6ho3A^lJd~kS@tY-*&$VSkDePPMSIxLtP}=jx=PT%GRAIYV3TG(Ns0$cGiIyyIW3b6Bc}##G zsiiG59nFqpdva}^qQp}}QAPRw@u?dVi4QLkQXlwM82^t<^_Rj_FM7WXykA^||8m4> zruPBY9Lpg7pjxQGXeCR@^78qbA^F5hLuE5~aOpGu1~V7Sxy4?LET7MY{cm%#`Y%@GAIGucsWNENh%5)r8Cu zq`1HjaMzr{hK|DPf+3GgV0NEkJ?auGc+M_MGP$!QK$H6HF>`o$l7mHkKxY5YtqV;8 zK`u>PA~`3i=vJjAS@X-D6J8VD@?eVB(!1kFkho)dZREK>aJWw(CfMP3_;{1&rtE zM{FKU@G=eapt358FclAIjlfuV*j_hs)s5)~`LYMooD&%q%;SwtYoAeFiQ@pc0&4N0 zgvLb(?V?3X%f%CZ56jDg+B$8|Kza)sFDEmxHqcYI(Xwp|UD|{Us-!I!n>KwR3J;-G z{j@Y<>eMjncuo8U)6Cxdbj$#_@Bnrrlf&wyI|s^5n*x_>h8M#b4V-xm?t9F9&ytgY z;uoS=8WGsHr>%I{Q1Mxk&i-B+9}h|RrxE$Cl~ef|c&G=4tHfj%LN%?ylU7gn#E?`l zU=iQ4!r?70ihs)J*{(wa@ly4W`&`*CF8^`nc1iDp=cC>tL&iUlp-T*<(h+^0NALnW zIHswcAoAw4LVmP+f|RgtR(1L^KU09i`638@_lD&hB+BWv`9PK+7v)f6Gnlm?(`XZy zX%Ula5tnHa-;sostI+k_qptvDDb>!C>9IqKbLA&F(QxHu)-q%dPbDY(1&^1@#Za1F zaJgfY?8^F5!6arS^`;fqk5`!}et0jWRBI{GFh$&uQaF=RINdbgEYs1xvlr0O4v%3P zuzkuV*N>8<%_^F4V!+2{KEBp|ui9v(D{@UVvUQwVdN-$0o|js zeQvl{Le-XhDOts;im|eMxsg*a zgFR4GZy*<^hD_H21JkfAsvgI_Og6T%?BTc}>Twvj;UM~^4Pn`l>6-%CXDQ(x!Ix&M zpJs=)eb=)C!t1PJgP>{=ZU-EYey&-9>-Uqv#9a(K44w;9d&W_B#kNl>ljId^DO>h} zNO{LZT;rqh$)0FBba&S4^!rXItAPrhr%@h_F)?-9!faUpaL(Y6p;#vcgY;P(a!Bj0 zV)x4xNP-ag-NbzU=}`v4fSF3izuiht0k9H{23uGQm}ji-_-%k&7@r57Mj|E1#~Uh5 zk18CLBC>o6A};4#p*<%5&8aJRDInFig$ZGCn^7m0twyiVp?B{R8KkPy-Y%8AkAZ=r z4s|5_;3kKcQ&5j?F`@4Pu}>dFjYkW&*a6f#5qX)FqMO$Dx9ehcd7jP~E1AJ)dl_*T z)oL&~!a5V0IweyOO~S%#z6l~oe>8&U&kKm1Y@+`tD~<^o!4jdjpcKAdvonv>3Sep^ zBrcTWFPh2dckzUkhqDnDhkBbQB=&_h1zv(YuhYo(%7JmFwL1K)ZvV~fd4vNT=FM^L zIn7I<2|NBMy-}Rr$CIv)MK`+ktZJ2Jxm&F=RYNrp%X>x5K~?=z}lFHElIT(6kyro zpWj36GacNfsc`8e($SxD2Gqa$)zgtJOq01fzy^!fR}KvolQk8yWzzAKMQ6(i$&c^H z3Ht3AOEg^~7M(LtfUilwM-YsYb?M1(KJpj7gpv;_!Y5mtaBkh()i--OCJnez_q_r) z4|NlB9UBXP*JNc-ax<$A(@FwZd$bp`m8ld(z{ppfb7vcmY$8*Z3Z8qQiEc!DNurlL zavblnKfyu}bgo(OQ8mWxS_MS9X`6EIN?DN9Al0R8>YXB<6T{{-XO1n`qOuU(29d zI`x@8j(ywZ+{U6dR5*ClIB?X6e=MMFD9!8~A1llJY$+!DK^LYAy>_;jm9Fq_n%dP@ zATkG!2l1#a6Td;{4v;c-VCYYSl-UQPELc*?)OHQ5;kg#JS3#%foR^MlAtetxx zly>XOCB;kpJ!%#JJsegWHtTsv#*u4iF({JU(gn^C=lQ`_?p>$OF|gNVH*D1lNCOH3tcX;t>- zeaIIY)2Ny8)4!x)$DIBU=KgkF4e8_k0C@3LD%Qeza?yI_{QfyvIMMay`u=QrCHq~o zxx5=kGJebORb2^}~x65#I+>MUOfsRaHEvHO9flLGfp3 zoi;T6>Ff7*H@H8&4)7Ie;pEA%kUY{DkP7^!=!VU3rnd{raFRJZc(6CyQCX~?ziel< z;inZ`S@!cBA1)GId(TfBQwWlP-$->}VsUEM_xH^~PRvesa!gko+&oKCeA=rv2-gj0vEp#8o|7sJL#Us}o z9rzAHb!4X7Zg(gRYlEr>{@$(>?n?j@x|H8m`m1*)eJZ>l6OwwqVb zg|lpMt`8Ky*@#6P z8CcnK1}Do6A;;E}iY+J~JkYe~kw0g|&_Dxq{%98zRc-iVUWsr>02ifIs-Nf~zvpAv z`_T~oZ3iz9k|#lF&x!VyjlEDvQ2un;&iQ+Gd;2~04`hI)xj)}DcbIVQP3n7l0EAuV z$OlHF1!2ZL!fqj)#Xa-Kd9(o{2lWO2r=~c_;|^OYCt+;i^lov;s#Z~^CJOISj3raF zWCp4%e$ad~oqY4(vfHOlJNvD>CUoE2`#I~YiO~RZ>|V;_Ze(95IKepmfKCn%HX9L* zCsuBW_Mpi?$jKs9y8l2_E*9oAPR$}pFC8GR&39IqE7T1po~@~F->q0qA^AIzsLCHE zvo-N|=rzB}QCJMtgIk9KMWJRrl#CtnI;>le-~gP1naCnTVyK0O`dLg)qQ!Df{!&+`)jt2Zh;%9PNwF3JVXH`Q5W{qWt(fG^=$*UqWA3}~;M4rZXs=C;hP9Oxh zhLmmOROFy=sm@}PSw{Hh$_316*Cr{&ice4w$oM4@qCFI_Kn9qDFMm~cvin#;L8Ro! zV~p^kO$`)2{d!)hryFT~r8-iZw&F~5tJKM-AA`BB9E`0~{(3MDa$p$@J^p3>p8rJT zBs!Y|Lg}|`vO#8qt=FC2!KA>Vrp*>6k;DTSH zI!xk#MdJsEr^8*?!RPdDzKbgMA!x3g;MxeY=6Z7dsOkyk1%eEV2&efre(fTt5S)#H zU2X9pO>?i6_~s(|Kt~x#j*yR`ssez(Uc)qHG1&*3qHOGMduU_cJXhllU1EHAJw)6z zl=s+vN~r#PYzgW9*-8UUnW5!6Y|>DHbX%0$zw zo_B1T4>(;GZrP2(XAfDZS`y@;1ckv=sBD3j+WEY3oc zi&wRP_U9YZQ&Ur+Rf=b$@(%-7IBUpoRyDFtMoYjK(Yr{rvx4*D4~}I(AQ7MI2M6zK zO>xK|nOd$8vzDQ*b*z;DW6>EQFXno2@6st^irDfp?)_Po$xSG}a6Q#TDlw?F{sUNt z+}9tMZfq0*ru|6}KTI2_21M{ZyIg11UqZW&msU?nj1RP5yZLhc%DPJTW^aAleUxsT z6Dt9mXGo-X$QDaFg+xugsfosrR}L+lrx+FDTPRJtBc;WN6^UUO*$x$AC51Sq)`zRMtI z2r^q{fN*Ct1sNMY9-V(a>r_P{7j;)X;_5-WUo0fP*@(z$d>SYn&%4sgYZ{o6QKD0G zc3+cX37@SC!eH**^M{DL^iYv4zFP--Pl8cLfcK}rtp<|qoNo7F>!Ss-^-pS0W%sVH zU1Vb?XuE;2^#<2@N;xvLAyu4>E-6U>DI3f-H88XKrWR=XarVYq_;50%j#UJe!m)R~ zsfo5|mweXThF1DgV6#di=cTZm;diab^!uUdxgpn?1(OgK?a^4YSAo04QLO7~P~(Zr zgzXeo4CRfVdte>^3pv0%3W#}!scpMWLB*k=5YEdp*Z60ckySP_V?Z8^$&TS9c9B$TO(NCym{ZXTT=>0B%>J&7sp z0ov@_K3a;7T0`LLyH|P_CkfKRUt;VahwZH$3i|p0;RLk^FW&9=S@)Au@fubM*ocCa z20WM9cxmbC4N#K5(p3luNv_jt`p;k5s1S8p;G3#;XQbN*cw^N(EBMnlH9wa%%ZXr* z?vwhL_LQ#a`_JR%v& zOmvL@r?XMTITn4{?)2d){KZF^2?xP+O~8kU$4TgdW`tixWV0Wn`t6kymtU@2WJ=iD zD);-6XPW(Sw-VyR_IZK}k0ZCPv|;!KMe|Ae{qqoW((~p0dEs*?nqd!lb?4#Z`Nky- z4u?yk+kf!#;M1K$Py4sJif+JRE5(%Nqy6Odf->>GYkK25Qrt(=L@j%k;tOm?bM%(# ze%9Ym?R4D4e5>Qb2MQVyF2B1aGuS%z5Z$)9?^G}uxUn_LHY-{d+n&Ov*tdql&-gbl_w60uyJD9 zO0>Mb9+}5-%OqGoq6pHlVzS*Cl1bde1GU8FjbcktW$Mq8H zA4-U5L6Kzg!(nJ-mNyg63So8;NlM1PI^PG#I0cnZS~LRf`$I2=u;+{g=>n{zv7%f} zvAS2Ic^Y<%RD-LG$4FJB;algqRtb({d5L zV-xfOngy{5P2!WwCC6K;A9PcN!G{{~n>#&NB1Q+Hmh3--85aWbBG5$MYCbQODgUH- z>9(Iy210~6)Y2z}(h=5=;_S&JhgD{;tGXA+D18pC#ZgSyqLs0jH_Zj8h>t;XEEy|X z>~~L5LzG<|e(n0#=+8PtQXZUku$AP z8`peTALNAKohzlk6h2f2z}C3H({8x^;+Mes0Ab&K`%>f)kUl zAqgDjK-2|Dmd<*%rC(pQUGur%NOPi4FyDr((63`}-=V7Psf{K;*)~H!_J9@|EhcA8 z=9Q;r$TQ%T8zuj)(1%zg-G&O1>M+5)%E_u@NSDlCHbG?;qZnY zxeKYdKW{Pb7F;T41~|im76^F5#CDl6u@IeBow;(?G03pv@ zeqs<7$#*U*&TIH22vlGrD0Vf zgig*eOdGVBCJH5IM^OnNtGXqHCqwkhX+ccu597A=0%@3uqrHNsw!bmm%xgCtnd~M4 z@duGm5T0S=4G`}?@`N{4?$#nHVA(gd{qU2M}ci8-R>U zHcVm5?QoZ2>_fCHR}%u>o*g$&s&W1m_9V+x3SitSU{F^J2rU#Cm{WEku;A>3iU>2l zNo6K-dd9yHDcw0vdu)q)aU)z>)6E03Cw87-v0>`#ev5Ro9aO#S31KpB6Dm^}66n`0 zOTuDBf%Fp1S}hSY!JUYIL#duc54jq;7fRJNicSaMbYQ(Pja{HxGC%~=cL_mw|CLhZ zO~Smnp9pLw?KWaSg!E1L^@nA!q!V?J&B>sS-L+<#X2Z@JUzx-3#PPFjU6 zAh)DwkLm7k4U65UDPWuIq$2C~{ENXs^xq_ORhrGr8EK6kep#+*{(t=_n4 zQ?+`PrOJhcpDYXKcr3ZlCzfmqpPx#zaChFi(lyPfixoVl3rt6Awx`;YL;eQ{O|-iH zqGtKYR1^$x*`q@Ic?Jy#Yl26}Ze7$7@vAcNk*W3b#)>?( zmIs(rZZ5hW&=NqVj!0jnYt5?4@I0QnAvYkCu8Fag)5o`@dBQ7 zasE#U2)&MP3_8B#Ew3YQ)GB~B8)O4|HHmb0PwZVFOiH_tI)vIc9$IS3U1wR#D&;7H zT@R|LEohH5HOE0qwA&mT6PjVho- z-rdiuLDU@T4|R~yqf6&xrw5pCWfn4H&}B0v7BXZ?2HliotJQV+c-i2s(fVQGDVcmb zp%jnFXeEL+jIhr+$%Rp2@rg@R3jmfKk4lqPgr!<%0L&OoXxmg1AShezai=gl z&zqtPBGU%ELb~W=cq0y|bAB!Aa zK(GL440tAtajZUNy7@-2iJCs4oLnF0Y}?ox_?42W2nrl|Fm&hbIs036;iAgSA$AU+ z1QC}WibIu7kXJI-)+@4YEuoYZiKb3VYwjV)Z`Kuqid0TY5eS56O7HdSt(yfbHTS6< ze*$qPcnr0fH5wjVYU)VM^)T}1J4R`sw8%2Txx%-*5N>iJxiv`a*ycoC+EBzKlWErh(WPLP8e_b7`PFaqRYqHnWK^=cRm` zu@IciulH#=u|CdFeY8~ZjVcvM&e~s2c?=`b8PLvoG2kvSWKY0Ox zocpz!o1%P&h6b`7-7Dx0RX&6QG$&#|4Od%b4?#~v57Vr)Pa4Fq%&jSLOS2s&5yGWB7e|dET)pFCFdCWo>1ZQG+j(nQ7%Ih2o zx68|0f9}TVVpWVdGblgvYZe@w$n6#UeOIG)BHg7q+u6kW97+1U*i<9M5NJ1Oy@75O zvt74tc&y~raD7Mtf6l9Z+XluZP2m$^0j435>*@3?A@RceoW3a%L#8tW{K-kl4hQJs zAy+HT)-LPB)$Imi(c2Ez)$Y%a5N-j^xiedDlEoRRkB95^^}B=Sl4Q`+kTxU@57t}v zJq>J&*wI-&#cWrG60XAKzcpw2B0jRBzVXlVa}P5@3R*hP-`{gd#=63c+N7Yv&J~um zdJzz@y1?HsQ(64rLv8;%%DY5N`4aWOY#A5vFs8@R?|6m$AH?lG1Qsz>kOYMNH@8JG zQzg?h;3hY%EcyIviFGH16%M-fz2Y|oSb+kRE%Tr?#3V}ofhV5232AEU$fNf2D7xm` z(aFjBR3} z{Ag0ig)g(zU+s@h&ia_EMKy30PyVpUI+Af97HFJGDS z)48$Z)zH|pK5`Ud@YqlaVv-1?M>%qzq5&U>A+OU~Vadj)Je+6>6K~oH!y^r4MwO6e zn*f#K;~c`p5_Ni)sD7hwaVH4VjhXuTp+zgD>)fgs+em)t)&+63_xN|txljw%^rtq@`9FWfeA`=bHw916}^pp2CO!&;+T8sx+9cwQ1V>y|`$0^c;S!GN zxx=I)+TYZd_2^vjqbZWgou~tX7)ywjr#BfhuDc|e@*%Com3xycxiY17MhzNVhx zYB&$oHOEOG-G3_ym7BLHn8mEOhN&y}6)$f{Fk34f`0{H^&niO?L{1;-grjvGFKw3T z?$#o2W87;-S^Ok-W!{6x(-OM{I3{JcuTC}ZW~PIdcLC#!_!_i{CM4H;(t;@~92uIC zbjw|f*!LJ3TO97yR!0qO?Yz!28#0f~D2F&zL3T3sw*iDD5xiTyw-4UidskWlvSM9N zSfPdieJf&1k*~2;Pqf)_B*;ZRvnPURX}DL6e;7pXoOR+dy9&6#l&+lQd>`HD8i%d^r(3}Pa-{zMv0er? zR>uGR(s-rOQT@=0aQ%Sn?N@N?4H&5iA_i2bd3fWGOh9g(K;1lkVfwF-NVEQ{Lmo&%PHuPjhYZ zjnB_3cqMQ{IeA5;9lq&6q5&AWElknky*0Au`Fqvf0!QjVddK_&&`%O?L~+~q`+>da z*Tc((k;8q0%F6p3={w+BaV8RkZa}?Lwmc}u7Miy9 zSp8X6Zc6$0{Xd0sHsy!rUdQe0r;Dwww#MXN*7$MjYHTZ9GnKP;n{3w7adZgEhghO9jnh&QId+C7|G0(_kfp>E{XMic ze#BGlJppB7uD-NQ#avx^bM|_ugkp5_Mkr3#vjwywokqKFoiMVR5bbz#u7oN{cxQF1 zSNicpAK>fdE?&QpXEDZjrJf>$Nglo4JSl~!;Eob(u+FlXC7ndJv0N}NtO9kUi|`_F z*I%`rrDUhZ1o7jmWWgJSEJS|0am)g$4ncmRo)fC2BS#oaL0TXjm}K zTierwqR>mE9o@9(!0cZBJ2kFKM^T6(QalV^`AtTH8BbBA4flP_?wa;V2GpkaZ&b#Sf-8I*gyds;hiY1_`BbJ8l zV%Rdba|(@@-*E@o>E|m(2WGiG!aYTZ-uc>mpEOPCjB54TY`Af@?zCn9Vf|Mac338W z{J%*`l3JBJ?~p&)aN9kr>ef26u#AyiC|p2Fyq1w(7}FY?yK8rJT$n4Dn^_iMB^4@j zlb*e+;99N@<;BUNUams8w6mLYpvwTem(@}xE%;Dkunxe;gQR1$dCOoRC_mH6MQ9xs zM%n?^xqT^aMNgA|449M0sa?B4Uj6-MMdkTo5q5EMht{mAeM{>M$zn#{I+9&IsS$ow zym)=-{zz_c{LzZYp!Nj>DJ5&T(U0`@`&M0gPO& z1YWcRT0&>RgE3P+-}fhsn=#M>f=n5{bUV? zS#35GHRpoLMFYn3>O~@-TD!c;#*OQ^`_pLipJZh#uQQP>yU*Kbw{kz~kFk z0n`)vIbAm@6-K%V>n>K2#)Ra+p+M)kpFtR)nZlz4;JYR&yn;A6(!_&UJx?lL))hhW zN<(u3m|UivhS&1-0Ow^o3Z%#!MrZ~lxNY&~+gNjF8*TXZMD{-1c2Yq8G*)jS`FTx3 zP9s6v#uz=(59~5CRPSLKxt8{EfwBVhZ```=117oxxi`Nhi*Kzv!aFSFX&NvH% zCPr>&wKYD75l8zzW?I6AG}C8M-w+OhcL|RiDH}B=+;`m!N8di)?ds+w0)M~pC|HZH z4TI&>LGSi$#d+y{JD$r>W^q}zf-2IK6i<$mG2D1X=v6gEXLWydCw%` zZMGGNH1xAk&}Ab2BqDtftj>;4Ll9=i&9588=Idv#+(7rNSDT=oe66dgdS3-UP2A^6 zjq;V6+`J2$rJ!ychx_-?s`@i1!6eo|ksN+l2T#n| z$EXZvg|P4&>ykF3pi|FMogm>jhkd|uKL-lLtA1ujfFwj{XSlEgUc`VOIdci*cgOy< zUSJ?LsIyT?vLXjN+UbDD9R?Va=Zq%%;Aw6WhKDH^`^So8UiSrybH30Riv^4r!i13& zb}mQ3*rKCo!atkCZqDl33+{0-sdR7?dYcqnhefqVMa`S=V^^TI@2s&Ots5COxEpN_ z*i4AwxH26&dMLRbHhYg)yL@VUo&YuQZSfzuq@pY!J92>$F$u+ta@@XR_)Q?3%@B=x z+nb;jubUH1x0%M3DlU^wb>2DN$|w5XuRvM&FI~M97je?Al8h91Z^Pntu?pR(<;%uWbF`ANrLU=$oKL_jb}7Y0sOB1qZmNP_f}nv$PA|A_y2>tCAWm zf{5Q-AW6jXk09)=**7Hqv9qAxg8nCQxg0Lrn}VZt-^IMh%EL%4p@?T6>h!6cE+NiU zd*G1Vnos@r8>5_!k-ZCrVEM=h&Ka^GeKwP0NjQDqnZ5wcOTzhn_+3h}i9+6gMkbNY zusZU-+*79f)2MMP3`(ia%TzCt^457q zT6%&AUnktkJ}&ys{V?&u_v;db%hb#HRyO!2fS8LmxO*@}T1_U)qLv^uO!eRu7W^tW zjnbLmnNK8Mt0lSKLnN(-*>&z2!1Amtoc9{kcUI}C{SXD;hv^32L@7_kMovy(u5Z}E zaH{sQl=bmq5IbkPRxW5&E2^s;?dC@`Yp+0R69aB@``eKOhj(T$D}*?oJ-IEEtOF1b zH^~EM;LMLq6My_4yz#C;J5ujZhw`~!okOlNy>e>SWAR3@U@Wh;xh@yybUp2uKEg}u zK$NQz#*$|>oL6aRZ5%FfBWh9lQucZ&xJF=Zh3+y@7SMo~#|P?xv2eUYO*W@*?4b1N zSe*AbOramw*=dFiI^#t~{)ONfOy-F{qR}pDpXW5h?ci;r^FMGqOigmAT_S&jpLS;p zq9F#FSTLGaF(Ba-f>?IG`$ozt!0A6pY0f=!{213KqpYHRw+u5Gz52PDD~cOGrq zJ1YvU-oZ_Ynavs!vFcr$ICj*dyvw$y@STYhT}l&O$P*q>r77cZ_e9ladPT9%cvkWS z72DFHrXu!TBu20)K1sggg`t-uqTERQXTpJ9g9Atq_nh@cMKJo)o=IcuW zy%;(vwk?mwWEXPhdH}a3pnjky$6<{%%#I zaA(h3;`WK%7Ao|!CFVopp~kDKx31TuF z_8i(V=Pep=mEZSPU+esjdJod5hR^riqtMmIhIOyT{uS?+n49h6$BL$yc_`@BOOK6D z&(}S>&#phO(1x5P!oF$CvD?E#c$iuoBLeJ^7jg5Q?vs}c?1|l==zI>t4|Q-KyS66; zA+=zH72eJef3nRgiv|zUjA;#_2%q&HOp|fq4WiwAHZid_v1~&W_SUG6aGUA%K}UDb z9Pw??gkHO&Hi`8*e#;CD0jL*^)7jxWT?&VzeN$We0|hk+cOxXDJUHhc26U3F#GncW z2uI6J6XN6)!*s1ROlnJdjr_T&WnpS(rWPwzg|MLnt3#3`zJhId;E56!sl*zpf;A)N zRm>5|LAt}p=6zv`&vry^DNT8qV?6( z2gSO3#1*7=g6RBJ3$3fKVaRI3#J2ZQljh$B*@}&A4&>_>j*VLZe+qP{I$N5KEND`% zyfAx1rZ1PYYZ+mOSpU^OmLCcvnCl0Q>Kt5pG$?XVkV9m|n<7qtmufBtbchc{x)03M zkXu$2)Kf+Biz4p_;CS!IKP9f|qsCeNfo48@0G&aQ-WISW>7aHKFWm5*NE zd6T$fE!7Q=$%&xzPfR3oMnd|{Wo5$BVDz0uLY>R>@0~^%!vdDqZlzzGqz0s+gB&_L zneDHRl{+HWH2n$jakQU*fd^#ARcpUwM{ymf9`~A)CuW}Q4^y(|^2`LMUHJ5SmX^5; ziRU~P1_U)jPddFsziO~a$DH0alD<9+|728{;scXWU@{%H$&JWCn!g~yL-MYCA1;Di z7a%l#A|nV;JFtPhV937L&_n;&1CR~60YYhswLgH|#A+Xo1YpvauF*jP6PZ zi3iX&t#xsMCUPv02z=Ion+WOODS6d*`j6-tr18PRJ#lPq3Zb)DKX|aak&+$F83PwU zH>9U^o&Ji!e7z~(0E}a307QY}-cnes5Ckl#1p`le2vTKIp|?wQn%}l3=9aS88Zu#+ zf(`m0a;8dw3UZ3H%yAiwGFI&_)b9&e*k|V3xRoac_FuVEG2B4tJD}hpe)xee>eRg` z?6m;5=vEKd2X#Gka!iqMFtY-{_1UkyYs3yiv)Fjk;#v>&>%3RHrLQ?>c}8TIS4r99 zC6|-C_rSf{>|yy!)s%Wp;^!0b^*0Nr!*JKz6HgwI?7W#(_PaQXVX^srXwg`C?rUde z*0ZGcgbg4>dA$NXC^8_S%wrNR|#sb{=jVBb-XIhQpxRxs@U^6SFBw@-h_?h=@>NZMnN zoUnHIXHTzb{IE~;5DO?T_{9F)S}mW&F0i3+rw5*UYWN@avF*Ac!MkMzZb2TpvP~}^ z5eJ7;f5$QtFYlV;6v@J$5^s_V+W&T+JGuLS4;2K~%1pEL3Et^fO(c;rOt%yUFq2=6 zNR>KNc7gr)16=%M)keP(JuzA!eS@%_YF{hPx|1J9v!SQ&S~+xFM#@=F)aho^;I%NE zD+Qy<#>{uok14bJ<2oh@ewk-q1~O`9{&ggv#nA?sil}XfVZIFo{Wg_x?3}YsS-1zqP%bDx_oX=Rht z*~QG(I_6^u&Ayi>gQJOH@TFt*3Tp;hdBhtmn2i%G8L;)9x^Cwp+-+G(50q+2W5fLc z{E`_*`VmL^QJmBbq~?LwWv8_<$)kw6EPKc68%B~U~Jav=j*>;H}Bu*5_ffj;j8P0&Vjb2 zYOUf2c@E5XyeS>z7=#NyaHWbxRJ0uf73ZSA1GW4i4=V(@%p(IK(9B|_+}Xi+Xb(zI zpjG-02eTymI~#Q~QP`t0h%@!X-WA=&_*Kex2S!Wk#(=frhq@5(|poz1QcBtjthAnfzJ|*(2 z51jr`BRYl&H!gZlvp0BmV>l^vHc4y^wo@wckI&4Dm`e=H}@qFLKwC zf0lf&4Baa1Evylzce{kFe(J|uOAhQ74|M}JeQQ2``R9fg)}Hy;cbIl~7m1Y(08&fa z9mf&|lOCS;0g;&&G&cSrNjeT;{(3kxt38Oh(rEMQiN?@~^WqPCZsQt8Sk*CVp^!J% z>oq%-^F3>_;#iJg=hZ&XZ_MlNn5 zv7hJJ*-ma|>>iI%F3ciggM*uH7N@%;84j&U)=wN)p%Q(P zt>SpAC6rd#N@Ex{sk0MoOS68lf$l~$d%h8oB;K6cbc=DR&VR{iex#YijgtfLr>iW) z0M4+c5c2{4mTU>ylex%A%GF+k61!e!o8l1Ntc+2Pjr2^vd*p>jT=CXp{fj_T;?BK> zghy%Py!j4djZL>iigt+_T9=$#SIN_mB4FT?xAc_(zA)D2Jnn2o=SO*+m#AWs&_0u*hB}n~{6AO)rz1%P#!vmM^l*5SZZLkta}+hw2~u za)BWS_YOl3{8dx{&qBHSI5^xG<|fp|{rQymmWz*c96QV#Mm{lw(~~g5%@i26WIK4w zaEpm4izWO7DUaftTp}YT=PIq2`&dsp(G}c;)zY(p5DZg{5Qo!Z$FFblXUaWQzzq}i z@Bc9NPEDEx+O}<4m3C$&Ds9`wm$q%&wr$(C%}U$0ZQoiq&ci-&_QQ&pF@L~(nr-wk zTA$Id?5)&EnoHJS7q&1IW%&^#t8!OgAaNsj;042%eV!b|ZEG_v_h69*^sKP{UCB>+ z{Nqf0Bsure{iSaL1&Un4rD~y!tuYUQAWwgmet_7a`CVYV5CiX7P&6!{dNaVig7amw7%ectI;Ovb z*bIe@!0;@FZs7pyX%j{C*magB-AkC3zl5vc9ky8C%VcL#aKw@;`T`;Mb`Mk}LTPO_ ztyR{d6w;%^?^%r#bHX|N<;I%|1`edH5!jXH zSPW4+QuhbdBd7#Z8w%pNULRgxYyF4GYg{GWbHC%=4Hqk8dWBSZ2PD0o-fWpn_!tZ3 zM5NgH^Ud!~*zZ8ihE~*xxC!fT4D`>Se~HTD=V0r`%@3-LG1PX-M(dSJC_Q_kjUHs! z^RxBahM~Q_M!l7cp~kVbhT!HgOmwBxQO}@u-E6#y+d}=hw#n zugZiSM$Pl@iWHIoHx)4ar(8j>yoG*%oLz9g99#?aw;%3R&q1;Kr^<9`FL?iav9|k< zDsw$yUhnp!*M@h5z^HWR$Nl5t>ZEo8{De6vL4=+>EY{O~@`BlS(|%cU)r3+lKvIi- zG!I{Dq=Gd+2xh6Cf;$D1%sfToqiw9ye3SI5pVPdp4a==*d8sQtt_=BVBs_|s2-vQe z(r{I!dZ~624rzr*8QoTfYg}l&Iu)&S&#HiDVq{h1`PWPI%Z$wZ7AJKh{<2~>xF%Ls z(@Dk~kv&`?jU@u!gs4{yKF}ktMeM5o)~zhFuxGLsV1-CFR8@zMw3JV-7@_DX`-%oWO^rnu@CUq27qGo_H{21``#XnzT zAXeD3E=my;#XjI=1)15-zy<`7mCAO2CBl>|D^a8=Mgf!^2ihJ3>tuXQd3mCN`q8r{ zT}_DFJJlK|sfMgN^FiIsS+a~!7oiP?(VD7#J^s!Hq9i&@YFPPPVAt6xw~{71S8SH5JH zNm+Gj8qsoglMN=EbZ+5NaE&@XBucJx^)Ff+2pE<-yaRK5$O!yDxJlt?(C`sp-Guss z2^ob`zpGPNifQf1To84>T;_UCUvs>pBQ)H+ne)-lIq$+M!v z<>K^uFRd)LPn?*3u8=^EXmH$*Kq1+h^Wn2Or^2*sC2lV=gA&yYCv#(2SB%=hi(Qsg z*X7MEyfXn(!Uz^zJ9fw@F$u27E{HzCB*f`+4Q^<4jo2Q?b5Sfxlbp7N_$vQ~>HMwh z)~8hbXVCimkmPf3B9FeodYJ=k0Tw#rcJ)w8{JR7M0ySkZ!^WX?_hG7wvD5ehRF1Oi zg})vxeq;*Q2K4SgO#1a+s+%Q=tCfNe>ynttcaxvr7}NH*gF~4jn;^1-WOr;6yoDM7 z&7+8`9z%AgnQ0i_8O!zu>}_+T>vqRCYf|kt_7j}ak4mj!#Yv*GA(eW9R)*ckF(P_N z`)7d7>X=vq9d!20O#8+3)0w)QfnC{vjw(@a2;rnl_B9_E+I$Lkdz&4jhGuj zU6}f#ihY2Cq04!~uM^QMjO-&P2-Vq;bbf2Qni@rfV~dNQhO>WkhDCXuR-nvkhy(37h*d7LQSQ!fP_x0)3X$10fHXWhvo zIT|3M&8}ZQd!Zrm*zQQk!{HwYq&w^bY#&KIX1;YTR`8uJjBEshsoyq zsm?IY9VdC z7!jgKd3j|I1E9dbvUqZ^n`xRhF^<}8eFzK&`_=-m!>^0$*>CSxrp z5y&47bdmVVC+KPCCl3c`TNb_qOwr%3IE31Ycyxmb`VZ1>o0O9?LJN&%RE{7wg1>45 ztaDxKXwJ%D6O0FhW4FRV-1B( zBfb(TvCwz!9su5M#$NN8(dniwy=U0`#MSZ-^61Xo(aV&kc1f3R2t%z+E!LG>4`LS| z8qYZod&3bC!9=kACo}*YR{tvll%X7pDp}X+{1XL^>~U7Rur&ue_LFDs$7Htbc}l>5 zn%4M-0`vGt5toDgsVcny_w03#7Vvl{n?C=e2YY;8B1()$X}t$jephj#4vu!yrb@3d zSzAKtk>J_lG-%`t<&Yl*RIVW1L1PjZvrS}kXSQBkz?d~?u^h5L6z@V`UO{P9(G4A< z)>t6G)~&Nser1)y8cfa6Uf#8#!*t9*k~*U2^w`HWTB9JJ2r{ zopvl}=x3xH<6kYsfVF^rL#<1!wFvmC>+da067GDr9y|NL9$Hf_Iwsier~F$Vpra$= z!xp8P*%Y(ll+8-pNQxlqXKU-|w8-Es0GY{3vF+#>=_r{T_js+}&Y=oH6PI~O1RAgJ zdIv(JZXq`>17 zq1_vh5Q_JULR$@6Jf4V$d%KKltE;N;yU_Ul%x|eBy$Z$W3juCA#}Yo^S*#88Wvscl zrf?%IOO>wBKpwMF7c_t6z5PpUSObO!ZHw6pZP(ws0D@DKt(G|>DCwDe_AIZI4O5=* z*+GId<}+2?8h?%+*hyhqekVQ`5s<`{{&SK6{B~l2_s%K??=KMHzC{w^9c@@no!ZLK z4JV#r?NQ6-^9i%ZA}5@Stxh8o_j0KucPNHHpmGnnp5p@VF=^UUi&##qBS(dbrh@YS zJcLRbcW?YEGe@n`nKaHW11kOW!*>2!f&TuCZAp~9o`nZt?*Eia1iE-%)-oF#>J9bN?)#}v{(yta$Cx2LS@HCrA2 z6aZtQLc|bB=7s4z8k>l%)<6RL52~B^e@5)ZaT){-Plparh98f2T?-KpRDVl5w&x`6@icQ=!z0dq^_EJ z{x;d1kwoJ^vn`Z&j5y z{lkhpQ@-D}7IueaaSqe_)%UIKOXv^XHNt4>OXwb??b3Sb$Dqo;(I3>}Z^L?R{FZaX z`KPPBFuIIngojjje6b54+-2&&edO4Xm3M`<2Fky8zRPhn% z_iNpavETPx5H3^f#czVY{Uedtp2+9VI%S=wL)3%=Zb2=Oo#IaBL?67(9@*15J2gDO z^QU@VyaVf}<9ZLCIMRQ(4=Y@+@G7rS4^uEt!3{rI#im+ywyV}mkslBvzK|Rt*>!65 zQcB490xGoJ2>@C3qVDc1MS-Ki1ho>evVx_V=C8=$iGSfVm*CKPL)GlUvQ!}kQNRlD37J!4l}poks3cEkve^_nV~$&WSJNn zQefq=YIdfQRIDv=IboX*8(b6v)_ojZ@ZD_zo|Q}SL*&vto5o!l^oIPF3q{;dEu|Ek zYdR#!Lnx6zSZo*Fuj2w>LRe_^aAm))GkW`>V*IK#hn|4Hn%h74RnhFy!`<)^wxlc0 z7G{ume`c?9X3=3Edz&pqPWW0qeZD_Ce?Sml8-WV<0~Qa%Ag$F&h0hp-=x2mkbiuaK#jsyLf0Nd<~lS2%E9*;VNZyV?Boyk!ph zenad*6vH)d9q-uf&it#Hpv(1rwg33ay|0Gj2zL1wt@3)|6$EA?1k&w28@_#bhr4Uo zTZJH{xM!wlwYX2*JrE^1OP8qDi1KrMh&&(pQl5)3M|oIT+4eFuE(R@j);xUZ8B zGb)*hgJ1oNR`~)4W%+zP-lL#b!uGB|+xB;;a}!URzh4jTg`eMUHV`$ZT7Mpi`gd<% zY+IGa<180x{r@5nv{)XxNYOrb}!-ydI%o&TdJ%zTa;4k*T|(7 z7*pF0p&ZBPZSistTqrVPvmj0^QsHRb$=+tk#=>|3GP(G7G7bCo$*P9;ZXx4U4U=v) z|84>|-GYq7936c(N~MpfvD~J)-^m?Y)OiI?Xw9X%T60-(f!QwL<5i+w%#BkvO;w$> z^Xc$TiO}z%8sc5~RqoTbP-mE_m}d&)r|vT?RMhSe(54Pdhi2+_bq9K6 z;lAF_c)nsjj5NV|KdcpzV-hUPq2iMLu)^fM;+m`pt6<0Dw9@+>(}UAVE;d=pp`yb3 zZ=wot`3z{;rs&r+_ESd7DW0#N8*Ltbi>cmyduNh756X7Hy-h1SaVYMwq?B{WQ|&B;Zz_s& zGqRGQGLYD0O2OnQ+){&kqKHL8rXQ%c4=0&jIc|$4dBC3i-HiR)Ap~=%dMzJXkgl71rFaYQ7$s1ja49^o(USg?F%E4c)-m!9* zZ=Tx@o}K4yNYYTY@XK^I7^Vh%>~#_PAnY`MAk*S5Dl3?6l`8}e<=x7K)tf^9zB`Rc z)O1yRi+Tbr0c`#oQ6roww5mlt)G0FgJDYLUO5YQUyT4iTn?(?U<3TUFPKHd#|{CZ!wd`92Y0 zn-#O&5M0HtjD()igp_xRyoQK@Nbt9i{N8dJ-+CK#rm@SlXR4 zjP$%WDz6E;n5Ogj#KSNsE?#iqmrCHd*WziedN)ABF+ROV)1$$o(lrD5ZvB#`%kZTS*(*(vG zpv;0~n@Z)5XAS6dhq6&gN4RGkqu$YDgf}C^=(i+~op3Tv1t;CQXb;%n?Di!pKMysJ zAwuNL;tPMM7|^-Cw=A$Zl(Y~A_?mh&H0%?@FhDhp3LHCwmo5{}CxwNfxET;2W(F>r zziogcotup);U+1{4_MIyLys~G3yjYaEms`J!mkZ&b~meN*&&KV0ym^TE;~SX+QS_5ZlXol6kr2epH7fYqkp`@+8|{N9lh^a zq4XLFHp5Fuz0=P=M^H}V4SA6C9AuA3W$WB;i@UNiZW>20dL}UQt0G~;4;*ZsV74IWzB2$k?i@8nU z!?)TIM?ZqlS@54J`0nCR9=;*EgqFn|^p%{5kS)tXS=m5e*#3kC{$)_+N>TRWUg$S= za8Mn!lZC)Vg0=?yLvE1aS%iXZUaIIR3Fc1)M@E+obv0 z-FOA4KAGF|59VFL^V#m#)0?{vp80#27Ygne)|#i}>B=qTBdm&Qbyh9)peQg{`S=u< zC&-FXKm!_?j1^!6glRx3G1^x(v+&F)=!mK~5}bU> zmx#@`l=*fvgXX*ngo=K^9f7xH&Q!qecl}iO0_5vakZQMU9Mm&H&sTcvr`Fx*TXPR1 z)V^9*R<9VePK-wc{uD<@Q6W4PS!mx#cEgXwoD*nk%aK(lnjx%3R#?Hwm;-oK(?B`+ z1~RdwM~U9YA3D>+LJngqj^Jve=IehI%|8d|iH@O4s>$>lf`pEnF+MSLWh_^w^qHe< z8xvqWRhX$JPQX0l>q1_G=+K7^6q2L2OqmA-=5}Q-Rpy#7j|+{{*@;O33&UX^iT)*} ze-`9fJ4jFW7t}s{oKsB0M6G(uBvsO@2_Q`sLy9~3y|T6_7$(;~P?{pCB-}Hupz=`7 z)Y)|2%V%e0aT5w7#V&z(KrPS>UK{GJCFy7wZm}Pp=L9iRiGtR5eaO65U6hWP z3vMv#@+QU+LEpp#YexHRvyVhGt;AEvyZu&IB9vP4fJ{%x1{Jlx2mZ7!Rjf705{F0sSIhMClKoO$T{wFC2nLiKE>tyhT9UIYk>@6Ev?&_4FJloU znyFijFgxJsW{53CpG^7GeNSk!b!Hhv9{a75yMi|1r!28lX`P4+xy>+a*Ox6^P1AN* zQcoS{)9zNu>vL2*5%`+HYjjpxsb7c6SmjI-=HmT)&eZ4bM)zUXUk4NzXA2BR1$1F! z=h}kkZ093}jn|T^4NRw+@TT{s-_#1>^K4&h6u9}zhE490%%l{r7`#FWQ!;{T>}ouu z$#%ohyAY{gfZc)K&)Fcaxa`i{>S4~G4uZM;-R-x1#-t`Tt&^~GsH`{z9C;Dp`|lI5Hk zI}yKK_BR4Sub_a&r=36arl;YH(q<6BY(mq;sk#Br?G6b20@=>;qgso~rrxDaWwrpV zzKD=G&{AKGA#%i;oLL1 z>kC)VA<1?WA*Pnj*pywCZwhmhNV0jh(lXSGXRYJSsD0mIvWzio^ zvO%XLH$25nbfb{uV2T}=i(;cq=Qx%f0q4(d%sP>8$@yj!CpoH0N0dhBo9hDf9oi)& zYgW|m;7ooksgg7t-}_lxANj!jk)+OJLvQut5n4QMsNZ=;~sJ zO(UF<(V{zx%B3At3g298sdCuW65udj^(|^wogW$qtMiQb0`JUHS)^zR&hSy>69ofR z7YfV}7NYmji|4iEb~Ms6>$)1H@%aly2RPRZk4RwPV07%dsq{RWX?=}=WWZaS8kd!^ zS;ZVm;$p%>5?P1F02Qb-^H*x*eI-?}sIT6ndQ;r(yW&4zWc2PnoyWKq(l10H$p04i zY7gcs)_})dl1sTcuVf;z2J(OQ<=^1T+rmFRjo=uu{HslN7{HF>)gUEvjLt?O%chMR zbn~mkveca3Jw5JI@%0l8LI5C}3jVU_*t=_BhozHYU>;bx=WE?@1FlA?lk9N1p`#7i z@?GWR0)3BlHd~90y4*;zyw(sw$bmS3z{Po+)m~-4_av=O1K8W7n3i@C z2syUlWW0#hJ3I7esVuxs>KNm?nnQ9%xv?6SD6KgbpBOI|WOR3kDJRpf$xR+2s`RV* zw*w4N`Zzy(PcX|bc-t^)aeXbqLPGl>vu?yU_c^qmhe~Nu$3KD#_nU@GJJ8i47&}vP z#7fQ5#k;%q+{-(J4~WlvU>|vC@-?&G>1%EDTo$@!HrpU8jRDF@h|Ti6uNSIItPFb( z!fr=(@Gv}z8WHUI@NVZ#V^_T)MJCaO7DQVrXe*Eh6FFNU*#kAG#mp7C+n)K+74Zic z4e zjDgR}0o|!edt4>Rudn?0+&}fEdjTn5f8P0KJm#SZY;lfTtt+uAuJTZ;7b>S;ikb&mg30W=`A&|Qd@FAXgD`fMWWjPd!fx@yt zEVaLs(RhFL**+wUJeF-Oe6^o2vy)BCFe_I*U^DGHwR=;WZ!8}klZ=M940uaf zXO?oD(s>v_gfV(NOBQ&#fxnw=j+htPt7e`!Vp@c^xc9_zMred2beU%YA48LB+u@dy z>>qZz9R#%9Csz2WrtIVDOXgy3l@ZC$g8SzcI%J!*{6oYffqF~94Z*BY^Mz75+^qVU z?m3*fDCJgjO23CbY)O&wmfCcJ4o$z z_v5EC9TFsYGB&aH{dLkn6*iI{W?TJZ0ZP{G1@95h!dO<0zf!?hl7X}P9y1dd&EAr* z_}xvy?T>9bR~IB&bjICEkI3r^rnm1RFAd`Z7$dNVkWoZiX_cKrNwWXS`BXWZHxkI7 z$l0q~$`xWws&l6@Fn`_SfCxemP&$n(^je&*!)32FAL-cJvpoibUjwhl(UWd@VgHi$n`&9(jhdO2tVZdC>I6>|-Yof`scf-DtuBP=s0L^{Hiz;4 z2Yrrr_uSd-gu<`p5Mty#Zn6IL{vD)7M*b{?olyK7E{;>?-8 z;tRVW%ihoCc}}YMn`(iIAk7HSjbocfQ?8S@GOMbLW)cMo7YKh>7wTsS+Zu`gTfI=+ zbwrLmZ5Ia)IKgqAUaRIjDZ2=dya$u@LNpY6v{hhK$XQ&9M(whT=18PuembT*P%slB zzxr1Z7b&)cXNdh5+kTrzv(73{lcS>%-1SiWyDqvnuE7Kr{??=O2KwBOc^6fGEOiKR zU(U!k%^7m8l9tIAR}228J{bYe3j+G&gKQ*(_hH6EXAYWNIO1z@3c1`8nf#jAydJp0 z8t|fs#Er#;h@pj$hUz9JRElj=bF@xnxZif~Ji(x7Fd_Y5!vQ|cqL=vl&t)f*PCH0R zLfwr_GRvYC7wH0%lulI!l}rxa7I70@JHQJ(X^Pdje)Ys8Tq&VM*52MSal8`AF#L~7 z$0()xQJByA$_az<-}dhOR?gG-t$7!$Ub-k=i0vhtrF>;y;jYz7F+}`d+=t`YFS9E1 zwDS-a!X=fM@zLP@iW1B8p`T-D5h$VxkI39bLq{_~L$BQaEXeqtrBre5gRnopn z6Obblr{H$=xep~Xxs(%lATGYzPh1GwkVFREJ! zYJ+|akujdJ^hU(4gIBwMzDDq!K7^Y0BE~%l=~H@4 z){OqU{)yo*FZ^@25x*q06Bg{pnr?=sIN|qEvLkm5ugW*uDOrwdK%ud?yAJ#7oAZZX zxZ4&%4~<8Q*KI9v^s^-Jm z-+o6KnSY=U24T%3=9_eh5j`^}7-B7Lp(YTzdmrv-$Z^q>6$X=gh$gbMausYRI_E4A zw!`+g(6l~9Xu=mS5e3w6pJ~m#PT>6NdAfopW~|@~Pq=W|+X#VN~@B1`*;buLRxS|pD z6B8{el~FWL?7{jNk7Htp-MYRCCLeNHXKczd2mo2EddoXb*D!Vg40|}UNQzQztod`5 znBG8@+Wgexl{~+yZD(5bJ~KeuzujaVbJA0cPKZ|==R`Ez}1JDA{WeV!qjw)ho zpePH%D0cBKmvIYTEUuFjWT*i7Eg)RwQ&Fd6*N0Q5p_3gC;I{16zp@LtXF(bqiur+1oTaO+EFW;*x z9Mv3Mo6wDj!*x^!XR>JmR2KV!O_ntJc6$!aPW@Wd{I28QBCInj9G2g?Fi(V$uw3Qk zh9~(8Uvw8*d?IskoR4+&k^{BQc%AqzaP89-k9GS zrkz$y3z3W@D=+lk^KPDp>6{XJFrg-5+0pq;X(8& zF{<}3{NV)n%;S|2JVlnjwdl_A?0+txBmbgpgRh==(HK)WTde5Ou1gri59aN2D^)H; zX@|9fD(UO*^jz0t159}aDxdNlsA%bHjI5W~L+etwvS!YgHYpC36EteOXi8rj8D?l% z!J4ru0bG99jbytUjA`Cpl?6K}oawWQ@{*m4lGJKmcNN$;gr(|CU1Ae4P$kqKichNE zPcqSXR_A6~mgqg&=5BoO^}-s_OLH9`Q;GC2MtMn`d-?9(|{)YoGo%sA2zapoW=&f$@Jr&G3Ih zLI6_t1KJxX+G~$^G3TFt@lA;L5cZ+*U|v`ZAAC(7ZbBl;N>hHb#YA;Hyq>g;`<(Wp zgVa!O%-0#-2G2vKPzC%4SF=~>@2`Wi2ZSBG-XBG;MFI#_{GFD6g$sdfZ~9w$iJo4X z-_Jd-?A5cZCk%8CtTYVP59nW`nUZJTc>gIj{LUERrfEn2_myjDk4dZ-Mt6F@u#WxZ zr{tuY+2wD|$=e4g?cfb3-}hj>*53yAOA+WpT>sttQ+;N>IW{ma_eLxN@z=yZ^b^$T>N>5 zzJ20cG_zD1kSqCkyJ;-+QHZ`y^xQXyaIc7>NVo=20=E))c>j)aBp14P*G%cu_Q?Xr$<4V5;oyi z9W;lJ0i!qvQfd!7PY9AO$siVAPM_-M?HW(xvovSM^g3jeg-{*o;TL>mz%M`2vJ^ec z5YrXTri#1DW)>qI7@54xcOu0^Jc|oTq|U=g)c?m^c}r}=lWDXn9y zacrV7uKi=*6wk3`p?J4CQs}Srb!B^;Cr-smVS43BJixUEVp1qV7nA^ND|^sen|{H}9iPd&pQFTnVylTB3m<>O4i99#JChh}6gqJfZCIdTQ_evO_$Pv?=Y4AVvw zWM+9ePPEB`&bz2=X&@xg9kJl%8tEV~Uao5%nSxZ-ELAvP|4V=FsoCu{bBO!+1}|?9 zSG4*0h%D)R zTsXsIzW2F9K7v&5JM#MxgvK>&_bmEt-*a>s6th!kKb9*y5RUoS!jK#`zjKki4Y!H- zuH`w^6lKeBe1wSvQJ`yHw_m0J0%)TY%yISTDwO90?4Boou3eNlD-rG-a|-o=|9nAD zK}A6THSffR+h*&i(KzCCD3~o4)B|u&TmPHWQ0ulA@XoQuk15m(7JNWKV9qScax!%s z)J}?fY8m1+>@SgfFp|>nJ)QVw>&8btw=_4M$o|}8?a2(;JjbT9u#SGEHra+ZAWGZm zp}@s>>~6scm_d^pH3(Ex!CxX=YCb9Ooo#>cXqh2R*(>hZZt)&nsvcP{C&LaRux>x+ zY`}K2neCw~mdF|Sx%1Xk9+81MH&{Gc+ouUzmKUlBuxrXB<*sA}kr%1>8>p))OV)QnJPS1bg zPp3)0s4=)bl=SA)yt@KKZ+GuE!&fQjsT=%eRLpxD+%6j<=+i)Hq4FMBib-?|T9Wt$wk%Is?@27Laft)87{FBw_>t~R_tZaysR!UCovJrR7lJ##7qasg` zzjj@_jBcye(|)<^E(aNUT}!r?^%5PxO8S3`y8^Jw!DEaWzf&^xrMC1519|=Ych&OH zzM~`X4JKX@2`8{-7l_TQQj_?VaY_RdOeh}Mt+zfV0e4t#_nJFa1mDiok0egQ*e-+nLD7j$y@IEE#uY<5*4>8u`#jM0j)UcnbUFC-Ca z0Y{e_SWmWx(GV7-1CFt*yiW25j2Gg9y}g>=m35D1E2|EkRo6b zi|YcX`8_9bq}>=z?8+{5Hnj6gpm_lwlgqbL zqaw;Ri-dmprAlp2U74986UXbIueY^GdyErRtwV7e9u$n4Pi^U5q){L z#4fT3BNjSUjpZ)2sR@d1KMa5^Z8Gu8Tm1%@=))H*a+Mvd4sM)>j&>Cj50Sr)y@nqY z#b<|QG|E-ucyARlA2K0DT!h%mRHYGkfbwxcLJm(WeSe=!R$#x(LRBXbevrbEmwB8Q z1)I7K$Oy|fp=h2k{E0qM*c4RMHNp0ke=_B2e{PxFCIA7&725xl@a=Uj{C#cz?vfee z28L72oscJ83t=QWXS-DPtQ&kbZt@r9TS>P^$ISV@h^CipJ3`QQq!hFCxhCs|IO~TO z!O^gsRs~tWd2rsli?2Z*$vl_T^4G%?O6>kwwP-tslKzBvXJ6Tl{MR*ZOSfGv@(iNZ z)I?^$JS~b^`3AaOMM`rV8D$8M5P#-Q`uY2hq87l) zU0J#`CySXiJa8`C(L`m-Rw82{SA$lI+wV}?f=$;Npwr?tg)Lv3a!Mx7ZxdFSlFC%7 zlO^?>A=N`>3Xfw}!GruqS5mlK0Eie?fLvoHffkg{{XWIRh)hy4BPz#~y-I=NkgWaD z2-2~Ss-aR;O-_Mnlq!y+X$9)2w&Ey*aE`YVPlm71r?eO0Y^W2(>gKCQs zPPZRM>ugDO;++A-`>AWybLeCW7ie*G7cYsPwM4!s?|~R6SdGmV++!43^I^q`fRO|1 z7iFt5z56$cXa6)rd)XTa<~p*}rTxol?)UC`DwzH7eG#O9J_;FGkR6Ay zTw0>qncv*q zfc1uw56Lh&Am6UGZ?9hjaNx6J{=5Ae1n9{#$Yi|m%inQ_&q=eig)5#n@mX@)%Z_6> z)bGM|AVEWKzXH$hN|a_+Gz5#<&;3s7_T1#3IQ+lsja=<^Pk4SA$>_i+POp98j~PSS ztpj&Gzlbq{{@fyXP+fhP! z{lZJEgig7z2*A`-Pt~H}XxE)V#!!eH(2+1ysEoQxkQcv6keUpVroLe{$DikHT0=I| z8ug`0dvvf)JX|MzXr8jiyKh}j7}_~LuH5=y%qKO`KLvO_^ZrJmz>eIfXqn`O*gJEQ zG}Z>ElA)stlPJH^!Nf)R9WTW^r;sL`7d9#_9D%X0NGAW?g&Rn?LR=W1CR%y`llVXZ zUrMa)sH+wxs(O*lm&(1SV+IY3i7R&U*w;zqOX5HfW1rc-Ik*OG>M*00I?Azn7qF|1 zBGQ8^bmk}V>WQ%%x_?=Tlks@2O}+A?4E@+lU<P+Fa5@Sx8=Al|UA$stU7hrg&aDWGnqG zh*RO6&QRNe2ZeTRlI>JZ3q>6Zzi-8@eNC%yLyWH6+%Ut^tH45ZKIFfaJ<65=vDL~+ z5qvO@+2x*>vhj%Vs`B!FURa`nCvy3#(gs9iOY6meTD{e_EC132FYdj_2(f(u~ z4+)|p?o4TyMAQC7v!A*-Qg>(EDo`f#j?{{*u?u-SGLPGeP`c3*8v@PeN#T+tQ2yFw zzN7wZsBGp)b^yG6UScMZCgE8p0Dd;b`7f9_002IXUkd|S{T;Moc zk*w_joqBc;wlcq?UcV!pTb^oGUB`q+@5)v%34?sJ&+maAm4JeYBF$fgE~b7vV8YSs zdSp_7E1{a+shw;F!c=QfF=Qc!**JEtMc7xQm`xsbRfE22a=LvaT!X7Q*zzLRyg=P2 z>NH2E{ z{Dgh$J(DQzG(a)|Qm7&y?bQ4{U23x9iW)`Is$gAtmj*hy#HxUqaHCe>-H)s(di&?R zg|gkW$o9$5%JbII5q_%=VD8;qP6Bn{%9s7n%x=L!oXs&*5ULWqq2SaJ9A#h zHPb~mV~}D{SdyX_XgC~+8kWUSr=J6M$10e=(==^&bKux_dPU>o} z`Y$Xc(X46d^ni#KRNnBALv?o(Kf4Wd;ChpkLCNJ z;T}irqKd`8x-%IBBju^ev~r5Yzv$gog>oJ=mCRV^XzB=AO+nv1m>PcVnbg$mzwmXI zah4`o@ICW(B&e=miv4#73^^TGm{Fc)U`~i&KVF`P${fmI@?i(jdv&jW_M1Bf_|C9@ObBXhZT*bsNS|&u4Iu`(K^(B^=hRM%gt;NlT{;LH~ zaGEfGUmY0=&Rfa?L<%sGC4V3wyxD*=tg^Jo4Jv39soZuhML#mfKd=pt#4MZG3!c1n z{Y_HwBh~3>xZWv(g(5GKNeVrIorG#wcQ6}X_N>58aapu(0_{t^-FWnfPR%ZHYg9ge zB;@E7#a)~@=3?EToG|>aiFC4qP)VL+sxdAypM~5|oo$@wQbADdB2m$ON8SDeUy0in zLk>yjcD5Oi&B6tfRWhy_R6^Y^Sk9{&$!{sWi#KKg%iTVf zlASdzLg9eWmw+)dC5PmSx|Vx%Z}iQgegVEC+odWdl!H zt_TRlbIlYcRo_pZyn?To06J6E(8fAIBoHt*a=ctVUBt{@C%mMW744>eAJMHohA*S$ zbbY3aqm+SuhH6BM#{YvtZngvci^rfq+){DaB@H25lbS_2_*f~9XDIP4KOR_so+doS zu@x1;Z2xUZVjqu66~|Qims}n{ASv%@ZL#4X1zP+1eb++H$T#vawI3 zZ%8X?B6fqzCAU#-_cTLE2)>cq6HU&@v(zzUT=R$>Ye&hbs?eQZSDty8T@G&Ly}WUXegxWkfnjnF8Ti$JBJ`q zq6OQQZQHhO+qQMfwr$(CZQHhe%jT_L?~l48-k?Vrk@Ji=JNMe_G>L8_Y(f`|eBs5% zYOtsTV!GU~>+jfHzh#SK#>w#{AQDT&Hm(mdaX!y7A^1BXJQo1*91!VuUL~K1u2~C!b z?=9qdnr_kSD-|xcC8STuq@S&H)HfKJf>Z)_DN37;R#87E8%+n1L^kiJ{L~bXHD@7t zgnwt~{I=$h-WKNIV8FLCno&q~?EezKm9B=0RK+aAJ(L4sNvkrHLv9fqdrrJ|j3r5_ z>aw_Lp($;2Ikv3VW;yF|1qxbV8yM36!~nq z=zb6P_&0lSRKeljp;cVWQSas5ElQg*(jz5IdmNL_a&5HIYYl1FaLdU%(OftV7%#3& zcg_J_;E{TYW;-wvKYmy9$WR=0^9*UtB(?rQ(e!9e8RsIB5K=|!VBTzN-Ykbn+j37M zJx7_1bWm>EBizZo1wxU|+6$A#c{{=*cML>nhln^xhoZ=KkjYa*Wq}ZD>8$eb^}NWX z?xu8%%Ki*!N+pk|KyijRMG;Yw;YpjyjwQ=Wub*Mya1<~c18P;o7_n`9OiGy}M6p*k zH#{#M=F6u~xXWKl49oPj-hXpFgv0pgk-)pymu;q@q=aVhd+=sH?<039s zq&a=cyYO8c@DF7YvvWMT54XK%4D;|BhA^5rxP7kQ8Np?b((o8d&8D{!O!$k-2$X%~ z>6^-STl09lMzIr?72mklNsg;(i(&TGI)+plyOg9pcy()9c;TcG$u;#R7Iz4h8&02Y zJ1dI0wu`lk91e#ht$&~7uL1UR)7o@OEPKqM<=d%a@eBol4eM&nq zR%Pz?JLrUdCkzbQ;7bmQrBI4Nsdh<@oSgjjG*nJ=@R&rnF%al>sc}>x#1k^cLQh~Z z7Zn-w#lAH&&aly9z8YLb-`Y+z&{&U&%7ecXm;u7#KK-MR20MTH)1n*K zDqLsF+M?63^U+K<7h!CUMhX*YY&8_lGPpI@%CFN(&dgsa2|ERwd*rSV;$u}ihDI<_ zUcx_s$Z6qGC=G~Q;z=yFMw*`M2pfv#E0|itqwWGUrbbi~IIXTdZq0M~UJPnQ6W$mK z^}J4guuyPsihfSyrAUV{x;nTJW)Ko~LQ9fb%a&TpX3C2NuG?dq$h^q7zTP{M5c*^~ zVArIs=uye?$>Ur(SWk!I>0Eh~PjZ=*w5<@8o$AaZrG{FU?Zy#R61DR0scJZ;5fUcj z41WX2cDipYvix%tw{cOCk+yF|E(!yR$#~a^LyZmwCpZVmYNNue&P+9Dr6#o^`Zqk_ z&!-^0N%lh7txCu|Z!d1qVi^YO9ZbH_S8Lj>IrA`MuMq&vXn{+Fb-LKQ=2*T+fPjre z5e@qH3^j#4nY^#Ygc*H`OKE4)j0GxUS0>1Jw7bX7f)XkV-!n@%U~X+C#_Iu%u4X}A z`bSsQGCsg#RyTQX`x!er_hc^r5(u0{ASQo6HEv&>95ilD%x%JWO=`d9V?p&hLPypy zsW;QgGT_L^dCrFCpAja9j%rL$RFZAh7KU@%Rk*Sn{8SMaY+oK}Bt(1m{^n!vfs&-~GAFfu(?g?Bq6}+VhFp zh$7lSR3c1xP;rGu9eoLPW(P-k)n)vVz0pc=x@>$oBFHydozsRF_Jhw(t~2;`jcxw> z!1P06?wx|duM%(IW!fozPXwtfO-^Wxj8%&=JV<^zddvpL~hd})XuYI%WYrM!#BxG zOSY8=H6|XcH#_tCwh84$KqhY5W7wx`c-Z|!dQ;GA>ry)!y*AIPo36)tVidmfy=1VE zTc*ZOfN|7EU$Re`f-rAIyo(~$sFD6m@9{m(jL?B0hkNs3@5OP2wnpHF45hdC%V&!h zsNA6Xv`5Pm%5i>4xnpr*9Un&&A{EjKSL!|ol6w26(4L&70giaFggHV{u=U`ZLwGA0 zmcMcA0*@G6$3=k-x6fnMR|Fjl>hZ&MPnRnM;`kYbAu?2)JFC+byat!-P<%RA82y_I zL1}B9E9Ii83MiYZHMd%dqLWJ2*9c6O?yV1=8X9(rj4@#$YmNay^T@@en_iJOPt2?9 z?Iq=cZ9ckQ`(AhkT|c|s`}gEmWcgYC-{R5#&3nti^uOX!i}qCP6Bpv{Bg!`rvNydp z)(jA2{5tOaEke|~|Po^(_v6>r>-j(mF#0zVi-?WEk5Y-Wqs!t+TrW!d#MMZ|;rXw>}SzbsK61V5GM$k(O3l z&-r(Cq;75W+D5>ADw&r-rAo=&^>u?uZJv*Af0vnm_p8mQN;R}7-dId2+M%_EFq(Wh zg7#W{G(KJc&+h({jYi~?Zmm3O`Tw~~D*pVtW_(XPI?@j!Nr(AGZXqaT8NGb|ogLN1 z>G#f|Z!f7xoyxWu#4{q+jyExkaFjPyEy#^=9wpn%)4A+gNzbyI3u<%(cdumT*DzP} zot&oHMEEL;*%1ImXb-7bPzEyepxUAH|LG&01v^{i+&Tr0sGS48?H)YET0F?A!JbX( zqM+?<5Gl~-xtXQeLM@?7s~F~y!0nN{dR&#?)jrP45rQbxD3)*lJuRq?=+acG{Df1} z{?6zn4HWmK@M*3h1zWcqRsuH#6R$o1T{( zzjDIz+r5R2VPoY_sEyfNJ8mb)ugZ~@EVYxG6_fVTGf$yxe_E;Mqa6pPrJ7PNnv?Es zeA#XrP5AC6a99g!AuGo4dLNycG0mAtlJm5MOCDJlM=hs4Nvn%|AEoku=f;>9EHtJS zdkx@?OJ5Jnk#Kv~{<%-<7WD#xXbWZH2?>WMmrKo=-W7e-V zAcwzc2be@K&$&nD-*s=WXY80NF9;GHsB#`h3nrik=>bJA3nuB_VBvID=*~Edzq;F9 z-4uyJJNHzDZOcc63@U6?dVLS`ezG0X8lfn78^MtAfhFWee?q!a|6h z#o+@T-)Ts~DuB)69# zDh~V| z`Bk3bJcjfk0cU`AOKBij5a;}{_~=GGigsgUC@KkLam}w26~uD>KY`bk0{j~2p@i@G zW+>a zfDi-=?QK*#Vtr&bZ@w4mVLI%0OcO1h5E+xic)zv-AxzrmgfL|CKn-3@et=^d(HSG5Tod@b6VjfvJfoVERxb>>8C$SNzu>+xp-rAr_)(RkR zR)v;DvOqwl#MQ=(*q~%ugKiS!P+07)Muh^E0o9TG%H{ z!)IiKaZ@eAg{y4iU@6G63EiIhI{yc-#-yV$k>ee)f4Bndxk6FbN+GVZ==H9)QefUA z=P|c8M3_#XLc{$6x7r~caVQ5?;O0%0frJ(z_#s!|D&jWV^wW^Lc=RCMXnN#2LMopG zEf#{8hw#ZhV4hSaxD4di4Tj%LX_JurPRb{AI_Bk`yPr&XG+A&{;fnxObYr?Pdx%-# z=SU;eL~f8h9;U3t4viqxCevP;P5U5O)F;JLn1$5;8f99?BWnafF`k^KFmah}H70cE zwm3oQrjopXwnYI4`Cw!DOj1S)>VBP#*uv$NCai&l4DpKpCt^but$7lw|4(U{551Jct9N# z09?~&7DFTjNiHlzV7!NAf^u`2WBgGxsh@_VCJrBnq&^L)C8;AIxc>Cp#FJq8Q|(-c zC&2S__B%&rfu&{y7%dZOoB1~#J_|Xjy^bV{*Wu{=lwuElY>STG8j>nTl$3(3FOxl7 zCB#w-g}ioaE_vG)>J|^xs{lpfx`u-OfWRhHWpXzfs*aV4t4VUOuI5eg7tJd(m?`R@ z8;af>gR)T8)J{TPKfNHeX55bY-jeA6o?lv)5Xqpt*D745V*DyHMz2b`0mExt7);vp zP?N8JuAffos{xg5vhJv-5|D9u&X(N!_n=#*C*eNNh@wF^DuZMZxxStcunYQ6DE$cg zoq((c3T6TZ;`>)G)7dcx*u88eL07_}RMVW5d!ezGeP#R>SOWy70O z0hFH&j+z_-l1IHItD1qCK}`qES7$|bU{|)UVuw13=&Bnj20Q0bT*@B0=?SkGX48GP ziYlH^oVrz7Y5HIR!`hrqYiHgDPGBN{5uB8lgsm%lBZgAPC=KAMnp83-fyCf+KDWr> z-jqEw1c**MbX&-fP5!!Pxch(t2t^Qd5a`V?ke5k7-YBEqBZcht#UMEuN-1TV9?+xc zAhQr&@N-$dtd`6~!*XlMh)QkZ-m2V7PEmSHRM%HC$%~{v$BruL$Z45mu0_O&g!Hy$ zN21`Qawy^pg@nelj#sf$1kz1DdE46tgR@FlUmKzj-D{-R(}`tMrA%{;zZu%u@)c4u zkx)&txD;Nb{H6PydQAsDof5Yveod#iAX42~R$Y=I^l!n9)kB~q zcH3Qar=+P%QZ(BZ@kt@Lhsyj_P-xp*SzcBVE#>Q`a+w;eAGyuQpPdUA^kU`3Pt!9g zynug0UdVr;AST<0|LLlp@kSF|QY04^+tMaw8;WC{!weHF{|vz~E&@D|=HeIqY@a5| z9i}l~(sX;49#@Id@nSxjp|F^V&(^TgosytJ%6nO$?!72H#Bq{jc+4qHKapdWJ;Bl- znS%6Wkhm&7vW%GogFRI=s&|wnqqpD6qr0tuo!c-zQGFc;xST_y-*1vXmi;?;;xqwMHaJZ^ulcR0A ze(O9_WrLeufsgdSfsW{O+BEm77##)Vp+z4orbOFITiDG7-1*BgO~xH?udj{2GvfeW z*1qI?jrlFubUWGo4!O9VJHM%jOZ0#^4QcAlWb(Oj6JZl|K?B>w?{?V%{opzk#YTFu zql~ttocdPFu2o*~szmODQm{{xS@1&Jyisxd=DbrnGEy zYb@B9n{)ewENtIAowa<~!0s5NmW%=~|0s2M+~&er5SEtUt;P(n3k98SVVwwreRFnoFD& z;8Q22A(3)h3rhd|bUGntOWK>nj(zcz^->M@grbo@YMkyLw4u(O-mlK{BC#$sme0$8 zooD^Q1~wpmxfM3h5QxOnYnw=o+S($YzuN%FqYk8p_Q=7|Na^4XlCpCk(+5ukv;E|) z&YDkKWgw8e-YV#I5?9iOVFrCRNN9_g5rX1Ibs;fy6KO%%+ULcIN2e#2rkho{wiD8( z=DD0AhQb~Wuy6+Qn+b~so|1H(y{8{WvgoCaO#o}lO6I3ZXMSy`FFUNHdw?o@orRP? zk+ejAhX%N$s+%(xn1QE^hJByJ4o~f4xsV{8%LTHw7v!+sHnCmU9P$M0XCIwP&0GD-q3zJG~ohN?~UGZ6wu`Bc6t?XdKcd5LW1iIA1_e^&67B($yo2c!5a3p3Dl($ z-qg0j0lWGTPU#aPS~==0?Wtk|M3DpfJ>d?ktmc00eS)KjoxG(1g&R2ZJZGEx)AujRol6?b+@5{5#n? zn)92AV>?FKJlcA3fAk24!{dYL4IXPd(Z7|RUWznkj;^2HYCdk9(T>HpD@cCz&}kzj z`(}+{pq;1s4t!-b(U|;|0)KApCBQ4W2s_On7yW01c|a8&_B+D-l`4OK9b7Pz6(bIH zJsw5=n7wE7EPecK+rr&A!;d3u&BXuts~tFSaJz?JkxaN&-uLtPTP&{qN`co{n$ zmd!0?9%v{6Hk$GfXB@Uo7PYQ;(^F>nj>8M;JDj=oFXxrKXxkr}0w4Kl+qF%@*!*v4 zbjo3nBYNrZcbCi+p9E$NMQ#B3vF+e(xE7Ir79h+X#ET=~_%glLATf_8u!-Z`K1N8t z3`HDU5}pvlk!m-{+oJAh$#fh9!Ug=`tp2`DlDMBDE1#-%UK4v7$Ks7yBLLp-ITE%+ zD@Bzya#mkam;dD|{2=~lLt%CRL&Mup#Pf?oV*tP?K=_zYTW&c^Qce!8B^TLJO?Tdu zCpmi>V{~aj_Rn{^>~RU4?-PBNg(MsCtfMEr6Ga94+_R8O8gOPYy{MYe3+WnUI(M{| zVUyo27^jze^`mH;{P{PFrc7A(rKntN|2g<;xz4OH%)pu^<$xh(__Tz_cgRGSg`ns* z*e_%Nacf-|WJG3I;uv<1{RJ$ryuOsAlTZ4C9U2$KyhS17Z1Kn^MR+h3w^x&EDfLG^ z@*WU`(DJC^+JZ#R9HQAV(jV}y$EX)nWy-CSl7$!rLFzkYj=6K~>yhAAivfqF0R}i@ z$fcd1c%Ao$D-v3!MB+)od|YZxl^gZ&BVsE@U%OtIz2T4pbhBX7$2ndwM^OXp|I}yBK3?b;cA576@ zS(lnCh)l`DZI75J+aS_pAXau1+fozsM%qF(BPcPOSlrPpD~V1lsi+oJMI&vM-4Y^^ zi(XeTP_BZOlJSn`EU3 zDFL5g^yv~%C4--cw3H#%AHQ6TJC#fT=o*wHB$8P;4vPa;d4B(vhA)nDT)@PW6Xg~! zUPQ!AlJQ>$?)h6LeLD~oBEpD#(Sa8&x5Rm`HQbMj=rq<+SR#oro74m+ZY{gHXhs$k z!y9$pvuW|QTgl#&rSzUe+IIUDIWXCL;Ao2w9)AB)eCH8 z>b-*VfyVM4bP7jsWlI~{WXI!?MaL~U3v#F=_tmH*p6ZN-99eybf&9C$*EW!)_KiDFCr6FW$kO-6ZjN4zx>n zxH;XXV=1Dop|=oQqO_SZ*iD7Vxv?iO^vw08N`OPLjI7^AqN%m1$|^iwG#PFh^2VB? zl{Moid)b14deNV(0Om@DKS1bNG9TE&fBLG#KT_%#Msl>5+*`7FiN(~TIZ%yvX>j5Y z4S7OAjfIH&gCKIYpU#zwe;32-U(CWuCDBvULtM(H$pW+iPJZ3Z%mPuGrk#ijg|C#? z%PifktIN}%GxGJS9G=(QQ4#AkQSb)AbE0T;=LWjEVia(rX^|;(ix7=0!Xc0 z_ni`-%kXW}p58Pe3Ec0sSQ7@*B^kFYy9{?`sh+*SKynSi8R zi4<5|kBP4d_^85chuznv>LU9N(G`wlb#tb4_t!+FLAeD5uuB(FVaz8XzDiGl73E%K z_;Sxkp-{SqdWRa?5|-)M@4IuJs9E-0H3-EcD@kjljAX-}4%;0=@VIo%K|1G)1{;^*S0@)$T7Y+UU}EyUZ@78&)hwLe(IBNA1i z0=vQ^2?Z4iyo$(cn#5={llZ%!UQ=e0;s-nPJewias4u{eE1qZlou zicvFpk{o$FQd(oZmv zPwLa%pKFOvDoGTMDMLT(u;^V&49KB0!{T4@48$Tou@F98wrxg)jLMXf!ixV@{c{$R z2T^Omw(q5;SF>ZeBL{l6%V@q=0w9EIuc*7SJ;+>%VSW>41$jUlMDeX7?6CI7YX+MN ziS-8P!OHv;r`r(rjJT)GDj?#8?%QPsD*S_@?^dC(1rQFmpzEsZ6(~)1-hzp)-og9Gx$FT@1AJ|e}y$=XF%EJ_V&RW0_CFS3y|1I5f zkrb!&t(&z`&P-7Wv)ne^MYoYfp9}C))bx!SVn{6bKB~^&YVvk6_-5xtIU=DFoVIah z)&heU^#QIiy;{FJbY8E<>WsYi;oAy=@&*GClAogjMoI@_%E0r{=_@uuhQ|Q`h*Jd< zkzKqA2fW2v%chYD>!2K83y8gIo%VCSjyUA6fGFp8AO2C{t~=*r(XJzuc(Mu8%p)Zf zLKq^Uv2dtX^gd{rjSyf!7d2rTyv)i-IVIp{8>Mz`kCB`f73a-4xq%!V^IzLLexDA^ zKlOtS#XKaV5M;iybdHrIrj4MfhI1nx-H)jXRGW%t4v~$?z~1mq$xY$?rQ<<$z%*Ko zD}gdI19t~edE@jl;m6-OLdB;8pRP<&6ZN6m*s!`%FHVGG)i*%ij_)y^xNUX*nT)8d z%uGmKk1Usbb@3f7R^J@YjZRbIbOLjtFwUW6f^9?r|3574;&gJ${z|*qWg)#ZDj%RD z$8jcy*-T}5_Hw@_(jq@EPUbdc-@k9cS#rTG@yMmgxUXu#oDkIPcO`7CyX%;su z_8x0fjPXmZSc}9~;)-%++JbPAMo-nzNjc(=O^Z=sgOi-NvgoVvi;F?l4NAA3&`F0A zrDffu7?d3j_UXN$vabZ}VA;Hv^HNt@%T3n}oTPlTTt2gsrO=~-iqXa${*l5-7`>&c zsyKR8GHV4!j6%-KX03tEv{+=x1-##ri< z9>>&XhN?dU1^asWZ`y7*7%YOIXaH?Jtfte!=SksM#ps_gkvkvv_Lxo)1g4AaFksQ) zdgn_T*DwL^NH1~ZE!~4L{#y(cloLnjLIa~+x>je@ou@X{<6}(g>PB7ijBp3QKSW=Z zd>q38$DdR#ZtfyOvV&)r&eTnZ+-xl(ytm0E^?{6(Y`H?$sMV^$U={X;X%CyLBRj;y zxAWNqV%-712X5)olj20m%G3phbc_IU+7V?Zh!6JCl90^BiXz;>nNZU?ihDq#huSg~RNS`aZgl}JARr+uzCFpKgACbvjLIj;}zFFNtzJQyX{sW{P` zr}QW308QzF9+U4cnvR*CIcnhwibNcHxNrFc{*9tV*O|c0XJ3VT(EdDgte@IKSnW^a z;rrtn|2O_ivVG2f3DJ!IH#IN|8}t9fb4Pyh+^bf^Up)5%T#QiD8z@Khiq^u{Qg zKUcjz0CqFB(aep!v%c#B^4py1cXmg6yHG1}ZyQdWzW>~tgpY)5(5{0b_lLBsmdu#2 zdh(IE<~^3LUR!FtSW)LkXO!wqb%?o0CE)FLODo<2xzWhcq1sTX^P4iC9Y@wlHkZ-6 z^<=?zP(O6a@h{=wN1(rLP7C>)89VbXa)-Y~$K;>OkJpRJMc`2RfIk%j-FP&*OIOZx zFIRcIDw@X>Lp2nb6tT$Ez?tqF{cSR?x^HUd2Gu3gyYyA-4x*^V^AN72~6HM7_ z*sjX$o-yO4a%3E%4BIdP7D74{l*O7_(%>_}pO9yDEs<*=7Ey5wdS-1E+8o3f3quVX zPGHpx^cC*`#5AIQ?VP!YF|=pik@{+fA#W-D-o);S( zo*HQ+38YFv)SgiKYhyHa&`YFrCz(Ky-qOfxY@_K3q0{K`Wh zK1xK47+xY5v`({`evo3K@deIg_UA~wi(~b)&&P)Ot{E$_Rik zeoE5Vymn--j4xJ?TA|?c@Agsf>PxjvT|nfU$4_3!eZ=4s{)hkIjuCqS&iDQqXUyWt(U3a3Y1s zCxoBY|ACDZ32^PILG`wBAwff^hrsv8C{3RA79bc)^wX@iU3fOf%He~6lollq6#bn; z6x=9P{E*P0O>J$VEpQ+B(_N23J{9)?dxf6U%DJ%{vn^Oi;$e z-=pp(+@s_pTCO6+lga}M9zYBt23*##!p223PmmWliku+@>Af(AoN^0WRTz9D|6beh z<@EguSSI8M-x%dRn>gk7$5blNbDBtF8_P5mPY<)Z9Pb8IQDI%X*0Mv4 z1p%jdv+`ELA(wfEs-^}22Q69Q_~SRiR+w+`JbVM{g`%Lzq&TMvMgr}J+UZpMHm=F-fVU+&c@6cZ`8@pVuOUbPs28jO}y8U zxe0}FkOr46E#D~byiu-{)El`K7H57^I}wBc^suRZud)JGgcwMM>CCaOfHlEaGdL=M z2cD(k9dY`DrsEPZu!{R%>iX*s<_83%Gny-$isLpZ!RwgBa5zu2+(Dv#we5Z zUJV%v>bFankMp)~0bbXZE#bOqo_X+-|6G%>=@n@1`frQ}=mjH+8@y;@HbEjTv~MxI z_9pd3I{JrDYG4F8Q-28M_o$KBZ-f)vOC?IwNgyql$$gewTEf(yr}3%`gmncxePxGz+FO93<{%bqD%o(uVI5@K0zsHW?8cMbrg%R4l!6=EILX%eF^0kbGKU%qk+7U6DLX7v{mgk z<~wPa&AmPe6DR{vJ!xkNmsf{VTU3YAq`$_W6Jk908)<}jq2-S49od&~86TfzgK?cf z%L8P;ji=T72;2!-;x$FZdbCgW7xC`;t;g1Mc@yiBp>k(SUURB5I3!>KOpRz$W|MP@is-Lz=c6*2tb zx7xk%PhG39Vb4K~l8_65|BNr6I7=Ps8$tltp{JnK=mN~=E=FW8etKvV^ZE+biKm0m|!A7 zqNTjQ+BV2qyx1HtxfOrM2GY3+qUY+Iz#;S(WYU|Ht%j2vHr71xsu3$btS?Dw-zM=i z^?0`^_=Nx%93pgk#wQ7UhVM%DeUUms8vfn~=AN6Sq~?ESmk;`!uB$n#m9b`hLHM+2 zx~QEmdQU-6YTa&bZNqVi+sx-*Z`NdOB7IPfOMwa8tk$}d>yuS<&9`6?tB|i_@3itn zfE6<)KXjeT<9$Y^+rgXEqxO{Zg9dFYW-R<@`$4&P=I~$0*POe}=Lrpy9&moOd?@F8 z%_iR_HC?~X=WTB5&F9T}ltL+#byQT&*kROn+FY;HW?HtZyoRH8dDsi$A7VV7=q8;l za(2kx)B&RS3-g^*p02nw3btN-OwqM^GX@J&;oO8_gkvGa2S{xzmN^&79U<}|qKd%v za)}NTG-Di|2&j3o1@>N1f^!9ozLF;aDuZSDRp~iV9+m`|`3fEkzEMFcfobg%{LOYv z0(!?fN`ITvzy{tj_mxD4_ddJhsqWo3bk>Ni%IkJ2_ud~Gipk<&?7kZAHP)Y>M8(6x`Qwb8#OG^^x zg)gO)9a)WU=HmunkL0bEt5!PZanTpsSt8XLd3yp(;riX^;gNR~Lw#|meeglZ64Ii( zPq@I7yn^W)s{&~wCFUnc`xJ-4{Dy6yr{Na(>%?Z| zc&DGZu$Kiot{sFj7+$a4Q%v(gCA8gC-Nnk)!x%lx@6;Pdr;~4PqP>bzr_Tr=eoP%E zpQjMYlxh~fE{Ugc!v(=>8gA4}rX#;VcpssNV%z^5y$NTn}cgJb}yr z+5;}mA&yj^d&@Tw6>&){q;g4ce|*n1JEQuJk1z2*+Jc;Ts+bN->ds!*4!?hIVLw3d z+r26OEzPn2pT?FP%nbiC&9!Jx)c$S%Pn!DzHsgTzKM?ho1Kx0Xa1}%&qI@CiIp2M{ zEsIQ|$Y}Hl+aH)yM;a*zRW6HsI(dceQg|Dq3)PQy9qyEVgSGvF$9po^~)b}0s+bdM?4e=VFAqzb&TBIZ)y-}}yrlt84DYQ!6hk+l{ zVuel3)UfhHo7HjybKYS;LlrS|bR{Sji8J^<{Mo33=sJ?~oGI zuMu>9LnOZDH#k}5Ccud*Gi++@8LH;=Sfl>(9k%gmX4&+Xnc3)yD(FAWg!lD8O3A38 zgtFgLQW`ES3+}h->gqVz2nK^KF|SzmLZ7R|Jm8w|=c4&+DU1M`Y6!|!a~;!5T}(xS zZ27>YhB>taXwjffhUkU(mt|5W|KKp@Sbh7oXC zTARGFaGP;{%YkOWjUSXURMI(0p?15k*ydFonZ^jR>xChEn`e3@PT&@h_H%m+^oQR* zxu4y@tQ53E(9diF#j7e;1FIItMAku~m{tW6x{KCQjUV|XjD{V0UMr9h@kyAMx`B4* zS#HtIjv9->h$lXO!8%69p#^IUSn5LVHv`~Aj42ZVy=9FV~vZ; zd*y-Pvfyg)d@@l;BfzgL$Ps`srk9pG(Lx(F_z zdMc{PUVm_KEG+)IsO-#!-EQY}rhwfYnIVB|T?(XGts#IOUjBLW4%Fu)U`MsrJRhff zx)lTP3n1tl7aI)>W60JT9#{sAS7tE+2+$6y>>NyRB*3s%tP1gp)-m>H&x5$rNnu!S z#y#_v{<8}T;h~;~V=sd+EhG-_Zw;M+#$zc1l{&19%ZzmwL5~)z|O85{o&`A!bqfyxW?tIywO&q$}1To#4$lcuG z!{mig=9+4)K3M@0ybVeNg9H-}WpMq-AxCJq1t>XDV;OQBiE#ySg9*%#*ci!;N(Tj{ z(mi3f6$!!l>k=lqJrn3BF_dFb32A0MhY@Pe=H=z-q-?gZjl|*B$hn>D!06XPF#$F* z-*}^A`gh5`Pq<<}Tlh(16+~8WN*fjZ>ld2?i&tJ-TY=wAK?z&Hsj>V zMnRCRx@26!1kRB4#n`=I;L`*yJ%?ael-14T$g#C`>dW|9O%L-%cLyqJYIibf?RR`7 z46~Q1I$LTLv<@j`jFNH8n;5dm+&W2XITGB$46N2^WnzLEKBc5@^(q4vpE=kSmdv6Y z#e<{jCj0lU876SgsTdImU_F-s4)mrO=$#1-yCbsD#|{i^OTN(bq%{M+eu8lmkOKEaX|bSlFM%@YkRKk<>B#SqvOS zi?Yivh7=( zFdMH2dZ%ZB-C!d-AanaSdgj$}cmH!_755I(Yy80~N4`(QfXVpl*pOv0&JdaaH$^ z?K~9tjm?PW;8?jz6oo%YU|+_78@^Ap-l@XAK4@`$35~u(f%0Fhh|sip!-+Zpmzbt2VlZF6GPhE{d&9Es?+UbSPY zWW@2`nk2q9w-YFZK`C=szgpJeoMfN;e%|UDo|Vnz9bOhh@QjMJ83cQ}=~kU;?3s`4 z@GxB}6s8^WhILBW2Zv1ZEft;~L|eT;O)_7B>yK*TV(C!i=_2hEOQ)Qq8SEFU-=?-z zo8Xfhm9i04h@{o-tPZgO!pE4{RuKC| z1Iq8`N~ZH-m=(~P1EkG|Koxq(SVwB9ANXUV6up_&FtgLHz2`(RCVZ}T7rM@oT;^a+ z=A?iNLQ`>rr4+i%2yfjYbA!{kGXIg(XhVkx< zYxz{IjE%5V%hlUYrA$I&zA#G?ZqjL|EoGo}2o~Gm%|()esL#`hLVk`-^exqTA54@L zNNWxtJo^zB3Ib*Z+Glv`iX4Gx%d+q>5uPly)UJorsgYVPEc2Bxi`zCJzBlY|jQCh( zDv8G_38omdbb^uRdOpv90$Pw2kA#tCa)5)VGIXZ9xP2VwucD^?(fJ3k<6r%jvyu2@ zW`WVd-%#<4X!E34K8_{?f5Fvo)0q(e4RRj}*&py@E3 zKuK>lMbprnVI}#Yr5e?fQ^%D&0N9+$9_7 z(4C1Ui3u-RM-D?0d>pA~W)3KLZ4wmajzKL)l^&8-n$9N#wDDjWq?+I&*KG-xMaGpr z(O7c+WYUTXRUyY^WH`L9=18;FAV!|cw4H49qhai(jZmnMA9ies5S)a;E5<8aLc>gs zBvyqKJ4B=;e5DN*%8+8esu*7zwo3;#021@>W2iRQC0!(Go zG!)hkVIcE|U@)TuH6Q1Ilef^RY8rf+@s@DRKw+YVIY}Pj&^9?#+pnJ~a1<}~4jl`2 zzEV97R_;-Nb~_u!yMS=>d!t6^3h%$t4iKPi5iAFPG7wm zu|ibNvM~H#BYR5keb}iblOniC2*z=kd1;X$`rS~%8*{+%HdN5*7sHesH$1pk$TLCDXXZVS~C0g z>$fq(0HQB^kp?@jv z;*o(%i@S{~4g~%POe4yEeOJ04i=*kb*n@W?o03Iz^-zLSnZL7T@k7(aJefV-%Z#n3 zT6Ol0lv_kxBbsBok`P-576%_S8XruXEY4-Gs~l!kv>n}`9cgOvdn>=w)Vbhja^ih` z@H#~|;*Y?<{ED)!ZiVcAlalz)T%aSQhsJq%Y->tWo!TK_$%4`ym&y<5z@J9fZx`%l ze@NraA|=4}h-(VF523A=GUc#^yEdkd`87?cUor={m!LO?EWIt5&+c?i2)epXz^2N*Qy5A0@T7V13Y7 zOM9WW|CPwqBJk9TF&L3zSLO|-9-qh2*MY&aHr&6aeXoqmGr;fmejWSa=TnCM2l33r z@L!2%R)+s2p1ZXtYY+cF@vQdt2LN3UBpoJxo1`1M5rL8^Ys$!sxi^ohhg7+B^9BUA zt=1%g2CYgihiV~hm+nbu55L>OZGM7oMDMHaZqNMf>+|L#%|4C)S5@zd2(&59{@$s? zX-(0WG>v7&zNfe*7S2sgR{|~I=Vd2(a)lOOMAomYyh6;An z?Q8wrAFxA#I+KPWB^(Kd77SZKD4ZY!B)jOoln?A-YVayCmlK&AzhSm|gdNjiyM+^Srq_<~vqxU} zSG{FEHbmna*Tc`9?qi-dMoS-b8hTr{jGgU5iCvrA()q5H7Io1_8?|Gpx(a%EnJFZ% z%E(|*@r1uCY}3rIjIEH_qf4O*JLaO&_-`j@Wu+p|1E_VSBAeQWK$W7%T6*inGgeL; z(<-uAm9ls^ot;o*XoVo@fm-R!6=jtcA-)fNN%`k92z40iCNIbuOpO8Hpm-8@&$#2= zFU&e~sHa4)OlKWC+abOVJy6vPL+p~eIfZf` z;MnCg0%|s@YT()q^8GG7@;;O3b~h_LB@#x{lGc8gh>8u*q^Bk@moVV(*l7wVA?y|rJ( zy0vJ@0y3I)u7j*W)-1M8s0(*>in)X{p2uPd|fF!G@KzYbXxr-dGOd4`(-7tVd&Pa%_9c83>RP#W$eVqf9 z)MVB$d4P;KzHt2&g=AgSeQQukfwvhc-mQPZX!lB}K`b?QZ+gJ_GB&1N`Z(88&j{BB zWJp7e-fWm3!&K*Cg`C`D1o||93FTTT|G6>*vXh4^Y!M)&jAW)${(*f& z&>y+=7%_=AoqU8)DG-`gNiN~)@2MIxONbTGY*^I z3TL8CVF(TILqc?FkKExDK=^wi5Wt3;WXWoKJ>>pKWY*L)8aj{7oV>OHpAat@eX86> zN1?gX=P?%|{QC)V;S8@%V15r)p?V0b-A=@8WZLt!!5$=i0i#xsTY%8or@ND; z1qHC61L-UiG4o7J9(c^={t_*k4ql?_FyZoGFalD-Z!_RqSXJ_XVK?=F(LyM0QCJ`v z;2IUl&_09$gf68|6xI;&*k1n6A<+3^u36W)KT+BN9 zK)Dv7O_-8FTr6`N7U2V}3tK#4Ie>+x+^i8S0AMNg?$7?+S`e%&Jtj)ISb=;`F@las zc8_aaWBx}l*8Hi~HcI6-lBNYJ@Am&n#3MN2-mhgON_CL#o({(dfRK2`3>=oHP)xa& zm12nu)g(5HK9f%|RdEXla6e3m=tG8oRZI`I1aYi7&GmO6ISWdGL3ER_5W=E`tAS6Q zqY#ApS=P#@r`I-09(l5GeU!*pl6EWo@|A;`K-%iL8O#FksPHWJ+K# z^AB@XAQt+{OP65%boEM0+}YRb)@cN(lOCEqvL^PsbyDcAdv-Hr`BiU3rcp1|hui@2iB7XRd;Z5%uiJSguj5I;!)eW9wDQYDb~5 zCYn!)=kTJ-2S%3kL*WC1i#z0#6Xz)BMS6=ja!&43J)!o#2E1?PV}o*Sc;YqMng@>J zYaSivz<>;OJi;YDqqhGY2&X+nPEnvu{gZQA&%w@xF-Bf)mK%h1ojw>=4*;0a55Zjo z2I`Nc&v-FMM2JXfmEuGY`gdR2YBO!|ASoD7WOmR&wH~cPSuR=4tb?=_!`iIy4*T#u zb25=Mugno*+u25}c+qy(7{V*3SIvYM3nV@76pn?zO=6xTKD))YH;TN*LUS3KSUwAvd_6PshD70o*a}OvfgA_lDMjj^rr@}ve(W1z zW$|Yg4V0NnLn673p%)2M9q54iQHQYvsHLI72T$&P>TT;shl~gXMI-PVWn!BmC zl>9h*bw_o`A+bPGkP>GSK+;S8l6nDlpS6iULZ{K_WmJF|d5&pix`lesB8~qLb%!IUKc~@OB`)S6~VQ55j*1yLj zD7Nb@1c8W>RZn^v(jobE35vx4>RI^t6!4`yb%friRm(NDMsf*?(Sn@l3Q{MQTuWH5 zzptrV<*lCaYskCn*X$w-8T=yJ(n<`zg4}7W`vsC%z6ShIAZhqMY!mGR(hrb-rpWn- z0X_C44;Bfy+8V~(rAxwPb@vQG-bh7F@vQ7)An`#8cp}jUIB@X08+-c_r)oIGghfGVRQY9Yvh#G)((2S&yYkLN#>OXmIm4NS+U1e*XyiJ8M*Z%y;U3DH(rR zeTK;pEXl94->k#+8>%OOf@XLnj#MPK;=N?RarZn5Jea66sXnYBb`r4nTg}<2KQN<_ zpyneX+N<{$_YInqagg#G3aYlUR~Zyp6p6~%?q#>})a40wBpVrziredKr2XmG-5Tql z)G+?wgM!6`So{O-=|UDwAN;s4qmf{w7f#7t^$MV#@yI5w8-<&Pgz8rt`;A4aNaT&iYytQT81pCOat7di@H8CB)hbA+=-tnK>N6=??<2yvp((sFfP2M zk@Df-SXkHtJVH6&GN{n!v`7|J{$1-n`a<*y?hdX+?kl~q`vfj)EBbghvlz;P$vUBR zct2~%#&oB21n6YUWqv^Tr^#+BCDH6AVL{tA)jI!J>&^C{)Ec>DiQlx&?|@Q`XBz68 zXALb3CG~ZepWs?a^a=t=MaK=c0k?F^Z&qy!{Er4DOZ6k@Y$3pbL-hjUAn z806VoRLhISPf^R^a~l6QIu>YT?SGPd%>R|-V`OIkzx~qbfAs6||4YB#z_SQ9zJXwM zL&Rf@&5Zvmrxp1>^sC%Gp`ulV{i_FB=sdB0Bvs;YrLt<6&)0_ne8lh4;ANP*V({Bo zZ~i{{*Z1l6BmFL(-%pmWh+#}@oc-mYsHWfoe=^#{`Doj_ejW3Ab3X0o_^hXFldH8J zZFjfDsorCAHFL%bwJhH>AK1^aKDzDq)ymV$t-aqUM?95ivf{l!Xf_0&5gJcuvXkc` zl6=Z83jeqO*tvQ|DX8CHz9g!~pO0%d(eL+5VFj3%``&-m@Dg7?$A;O+Yzm*>yQBR0 z{Jm*JTQ9G1d2sxG#_LiV)?)kgks=Cz5O%d=fl)&6QTna=UW-H83aEsww^i8eV22l) zsA%e}rU}Ou;)o2}bo`DsaGl-g#QBd4qjq))gL^3-2dV5N#~vS+d}DsezD0edoYdJ|B3^2jM~7M1OY0B! zhKI4#(2rD?7jB44dlsNg>uz5%+;fF7O)QbwO(@q~4y!fsf(Q?qt=15V2fA?BO!xd< zr?V`z%$XL7E=z;J6oI*@)*a3)YW-8*>`!*iejK|ed1E)S0&z7xKAq`{0#V1^vx$>E zQP1tNN?EH&(>nMq1Si<%ZXVKN&Z$o)1&9^Bv0e786b{Ds0j@AtITv93O%tr!*C3+J z)8}aWcjPnB^u7S&bbt_{hr(ZfX=xz&VIeVTg_Orw+pu3?@C??Q0SMY+1p!9Dizqg` z=F$)bSHuCAoPb$>tZCr##^|aTblYd5S9}Ld*1^Zdo$Aqho~mnx*{s^!FSfDGb0F$L z0sh=<_mNBckUE~Bwe-kGk1W3yIzFl`c|-dMrYR(#ryNRix%>jV^VJyFDNi=81(nI1 z8FQ+q8Knud-fBY2_OOn+E9&Ai_Q@6v_R3>qoi;g0x+d>AcOTJt^6a#!Nq0vUPvxua z5A}M&0ax88d&Ju8BGM+0#;IuM0|4wG8^c7K?O4yJioQb}HiWB*mwhhP&i#V@H=LWK zQqK2HS49mvgQA7g@|gx9Egr&22GEEUPB3=1WAgZ92Z38!PwNPt7wv=)ft+PYE7H^P zREVN^v@%Haef-?#6xcd!TRn&kK-}7=Dvebm8Rzw*)M9oh200?frdZbMFhG(T3HXRW zWl>K{lhYEZF>GkLWxBZ{G4l=~+G36wY+*k6nG66f-$E_2T-E4G)U??W5$bDgKkzsj z5~Xi_yk`XjuD}vWV-9fe zwB89!8@*+)RG;pqQY;{n7g{W9n!i$Cb zkYY5l4&{h&qWqNb&qjWJPGUuvzrJ=ulcIc2{YN7?0l%KsvC7^^kJ9g<9YRK|#MR0Toq23SW^7z8O7}-aKhB#X(9Hb4aO;J}*EmXA4Wh zS~9IE%3{5rH^yhKWd0lO3H+GCnQr;P9;-8nMWEsB1z077?*eo@;+O^^CR>Mx0lA56 z9kk;Rg3&?McXmE+(erc)woAGtQR#}W99%6wQ`?eXGuth2NJ?_+XY@pFO{8GzUPlKZ z*;$;?tZm4KVN!g<`L5w%2Rad9+?C7I#7^nh=oz~1`I0UQ6S<}qTg8;Jh{iPZPC}=j zCFkwAz(WBIz#`JSo$QOKy3EQJp(^))l=uuMFz)c3)}JV~u3;o#!wH*)AtWTo&lHUV zUXXY0P8~mansevNhNGZy-H}8?D^14b0aLun*Vi-W7ElLkb_47Da{CP zX48$3n9IfC-%3k@8y3bCa^I2;I1)qiy9xLB6XW+DMUNjdT`8@C12GozS}vdT9GP3r zy40-!C=Byio=aDTp;aq3a-e`X;dmL7znNl+*+9!S6t?GfnX+=c<996s;zI3xt6{PZ z<*xytY#bsN++~{7NEnL+@D-^cXNJII!FpB194E>xEfk#KLF}> zLa&HVskijr(NIJ}5n+$H8&9TL(dp;xc8AKvB&DR` zLQx&rt?~~!fJURVy`n<+k9+77sI$g{cwYyt2xs60Q!&X&8D{!a3=(i`oQ4|4mM+A6 zwwk__M|FwA;a5{JJsuu<(_ps+vXofmEokWgYBj+$ro97a8+$6Ia~ zjgq&UOn6=WG)GEr+cvB9!j}f^47Gc&#=NEDvE`6!njK=km~rO|g7$Efh4|BzOR_Lq zf50g>2S>i#f4q+P*Ja9 zHgMGY_{ivds8k(r;zDR!1=Bjm|BPpMbc;PrZx%2)=;lRqJ$q>8QY!cbUP3vA3DQ3un`Lw;>!A+%Cr-h}Vkh+7pOxO_hHry7MOS zxPb4E`}aYC3>$7P#qW#bA`eOISZ$_@ET2NR(jt!uFW;AEt@%LwvdGh}v*b_TQkCVF zyXNHA`kNtX$EO8%;uZ&dgHS~6qvB>zVP5KPBj=-!ROC^eHhO?P-q02ENsGh^&-$Qe zL-+hM{)e+fr+&_dwL}+`l2q@SCoR^js>9lG!Cu!!^{s&>h6l>;t8_4@iW>h_DNkNW zn&YoRAM~h$pU9~fdvMj4A*#3Tckx7+>d-aPtUq(@R*KcS-sqa11}^lb)5L686)A9L zTjH8>+#RWoL8|mYZ#PLu*WApV^@5F;+rL`J=F&Drd4TWh zyi3rEE2+d6=<-lpYqjDJEoz=O#C8QK1C9nzxpf2wSrfF+&v{e|#g)_~vG+;(B`MU=9mP8po$gU5setw_a zUEps2Lv7xPDp?rC08`!JCNCV$Q0n}nHoKr8y&--C*Z=g*_^=!g;n+Udt&wb4V{kWW8?S1ek^<7%6^7 zYB?!Gl^i6%4)}KF{CYCP^avzyJX!4qrbPqONWxM9!S|5}!3p?Miw?>QaAli?uz4=# zxuYgU;>)vgrAAFR?(kf3XDzcP1|2X9!_aGLoxxU|(N!gL6{H^u*Bg|ADO)60qs$-mF>Lj=bpI~De9SNr9~_|ObHZl++^83`@;I&sX_tG<`F?N`_}9ZSE=5UzzEkuRhyC*T>5)4Tx|qX&5^PWaAjkVqtrCU!aE zfFbYai_Fjm1IZPdAa7wVBcj0Hwc#wko~`}?TssEwuX@hmL?nCy?>`>bK_mlrHjI=X zsJ1B+uU1h8Seyhfa{}lblI>$H>LJ!MC19Xs8#%HR{}|2AK>DXZn0n8mwh*Q_8Xevo zBmyENxss9~QX#I^%PqmM{o2toOzzU%U|S2kaLmCeMCk7iM{p#x!zC|<4G7LqsR6zI zhV1IyBFD1Amz2g9;%1zW>(NBvx{BpQ)Naw%O&NmU;?Y0k*4oswNrG{?7*sLBO#ob8o~z^nn6KlMNMIW)s+2XE_P4PJQYNHo~b5~VNFpBA#HwtseADrD6K#Ooa+JI-ZT{nOCj3S@}xDxn*Fw%I#vGp&Bn!nWXR+wkelA+L*m7O%iI&jA z1Y{M&Z|u8iG{-?ecz!}n%2I01sKkgV2U9`ZfVzj8iaud&@+FXdlvp2v4DYLBR2$4t z6pgMJ2*0wl4w8ErN{~a3mEcBgYPTmb)J9Bc(udM0BW94&u_&)*Or%APAT3A>Ixq4i z%Kb{MSbKR^r86XWoXd+VP$rb0q9%lHC=QhKK2h=|6`sWfO&--y{e}pq&CG-`*Fz7lzat^hqxG6g?0~awj+6ag~af; zSFFZ@2EFR_#?D6mJ8K5%b2yOgZ=5qc@y-Y2P?4a8UvD0IL8p6-k8Z9P!Ur|8l??eQ z)Ms)6+=9vyOfZi=4MV6_30bgbyB_NWsnPFWg5I&Z*IMZgrERtkC=uiYRKM05n+uNX zug0KLJpj-Lp#OT3T84!1lH$vef{{7e;BRfo(Vqk^)6V{Rbs!q5dd0B3 z4_HyT4r^7gyB7qzR@mtx>J$wFzNP%gpt~-2xNWb@xhT1Ykbheh-<|qfX~7>;{k=_< zEp-p<6<@bnZv4|(a1T5bHi_r;52ujy8f0^0d_br8mzXHo@WVB9?%-D8w^uND)MImU zm94$;ckhQlDGi@xPhBV*4Uc~7=jQz&$a3a~zghR+o!F^}_Iv97Iv;<5`Qo_I--D9R z6_EWY_bZH60+uhALa7f<77svgkSDR)1*Q@tOeTxq#xlPgQcvCQqD4gGL+LT#U z_TcJGrXLf;Khcg3#)J!q-pDJpfflc5q!4WdGQgBLsXxuNCTA~m`HMO+C0+>KV#|Ca{&Ish|BWd-GO6c|6g=fjrRD=Kf0>tl=2Hmt)1Tg9v_GV_=rt% zHxP$JDqH%5!Fl|$j7=#~mY&y=Wvh`gQWVYl{i5h+(jMJc@lIa9@b6H3Su*{x`oHt? ze7!t6zYo_Br@imexn0cf4>fwV8}e$yQEW+YCl9vYtF|qF*7IwIIBQGjs^D8x?0aj; zg0(Z+I<&}pQ#t9Zry%`?H_d!>gmrsLYN?F9Roakzic{NB zI{y9lXM=f#M!2_>lne2CoaFIoU;VjxLZ3y&YBD}(L>qY4?PxIb z^q^-gHHB`CExLfvh-fJ(&$~(RxYaXHFRliBQ#H9$ceK>%|#uO>5OQ#6iiB$qt!qm6gTXYXnEX)iai-%wn&r za;n+^U^JGhHEPxx&tY?+(a?;vd&4JNL~C4+a5h3Hxi_@-OdKY2aCjeoY4$5R_-&A7cz-Bti z&79Zd^x9{4FnKa`(ZAQR0i881E74yckU;omAnA>w_rs2KD_ImnX;XC%#ree!Gq6uIJjE1o;BM>%EBS%SYxqG{zys zmZW$kHG#pb&^^7RTF7fc4`jFoZ$xA8o=OcRQp7a-vUuzd;HMR%2o)7MXjFU*Ckb3V zSN3c9^eL7I$Y>Ub1FxP(5F8@SkQA7;BL^7#+oOBYo!ZP-c@7moM%=OD*%oaj+!#mgjS>XcLI({9sCn20?tq> zDmdT(r=*^DofgpqJPa=I8v`C$2DD9(V)^FjsFYwuXhOx>xvPxvh|#Xae}U|xgC1|b zJ`JZseiXm#aY?!*hJ8cIzaqqPmB6H_4SPNYw&pJS@sTBf-6&}z(pzn-4>3Nf& zd`nT!2{lMn`%jEYQjFCB10cmm?mXeCfRr7x-EvCNMWw1*u8?Vl;5GseBn|RUV5Yef zV@~Vk&cYm(LFZED22>vriblE~oGDDmTfbLh-cG@;^2pjrRPHEo-R)rld-@o6dF7Ey)txakhXzZ^keTm>b8XnkQ=%>DhPpkOk{kB#TUt?~UsF#Hvrql_H`9jA*d zfTm6Z4VF9$8lhc~c8--db3$Hf#Ld-}-X(bO_pPfey1Xj^D+Y%(8C`PQ7ylMGZfA!5 zgwfY?gJMD`dBX5fsDEK+b?Sfk=ZdCl1mntr znmW8(6_|l>)}^b!bhTW>YfGnS8w~!1#27ssu=h!A223~r2rhZ>ZDN(82Fr`(F~EtE zwiontSoTK;fY7YBoJybOAcI*3K=CJz@DXuj8smBYs7P69B9WLf!N03jE~}k1$FJgj1oM7lROO@h2*nWeT!Nn|WnQ-OELhH+qp(qsBz8$n!=jTwIB>-v_^BQP|^_4?hS3mmPdVR!oHu zqaNgqtifZXvtJcKSzFlCDv^*qh1ae|mZZqtE8CsJcp)vUL7CeGGqJ@mih0V>o?=1_ zI|SWG5I5CU_`4`xOvE1WoYL-6my*}L#t z3;q2hBgx32D97ZgZEx+4vh88vv}|NjS#O6d;^u8r8RlABB4Q@ETyYT~&|bpqtWvd{ z7|(u$&$BB((e@8AccR>e+fp*wz~*)|@b`X5PZb7xBU+;oUB?XK(tpoINOP#u5bs9N zo3}eZA?tW2oNyKc%TYD$FAP~LMCEDY`ctcMID)Y4; zBEn!`tz-hd%7z*ltK$n&4z{gZ@l##M!8jni+u?*yVFiFNBz(r0aQ;+BozA+XX6q_z9vHpi%Rhf`b z;rP+V^YkGGB72@tC%cgob7q+%NTWZn4?z7j<-QDmlI`y#+2UCHr{&bYsQYk2@m+~? z5{FjdxH8nw5vgW2NmQJPTf#gLU}W(;kY-btd9hKAxHOFN!(VZ&RNdyPJX%MUh>do%=tK1X4bEMorX@TrvMp||2fm>+JnzVTvB*Ho3j&cs(YzS-vX z^v+22;}7CkTb-lIKPVx~#oUlUS$1#Vm}}M@Lj7#@?5wUjN>gO0I9PZqcMsBpZShjV z_Sq#XoZ3?&LyNA72#f>;mPKhf?%X}63zq>w0`MtK#is;BSLCjDS^7fsa$lnbPy+ zlrL~tbIq8S2p`tVobp3bAj7{I4~ZMCxVRi|yXkMsydQTaJagsW-*QXL%LkRYvDWl+ zDhhe*Dkk@N+%TySQ;9I94)IR7cPMFvTs%VoT@WxLtnNTOsd`QckJC@vNXlE$mmTI7??B_N7oG!k;oQy?S=Y#~rB61QQuN7A0bv>UB z7Jmz%AN*;;_9`JJ8ux=x#VBo87|9nl*W0-PhqBocEGH}En@`~;40X8C>{~{ZeC4%N z1)+=Aou)}xomXAuntAd*8h%w`D_?ryXcs7c`1`r-i(^}d4KnZ^zO<&4o1Oz`zok5w z6mD6QTNr810ukAltXm$*@)K~2Y<{LQ{>`YF{RNn~6muU3C~Nsvd(Uk^7<5iG&z(oG zeW0Be-@?-k3gu4ZgX2?IsBTlWWoGtff@N8KibLpop{yG-*(dB+op}?RKIX>=nnAUt zd-MY_OM2oVc7k$2sgX+91CY(y@0PQl4w)W-K9bQ+GECoDIloi`8pN*zq@onf+^fVL zzw!&y>e_yzB|>{YQ-74qEPUpN*WmWnRkZZBX&cjwEHEEa?Ipdl}AV6h}22Se7SbUt>t+K2GJNmI@~-QqNzW`;7pwKb*l>> zN%GEbqI0jafqv)F=eGp_>pU8nI;zPnrGU zFMErp&~CjgLi`v0sUwlDCX&zLQe8T3i)wfHLPjU2p8-1=B>j#==0AMA?Y!;v>HT`I zJ3&gHXVU3Oo6KU6adbyagruh5edMpx%xFK*af+I(7_zaE94@!FU)ZqLT1iZ~5qETC z?A$va(^a?BX(j#hx%%2`h{Kc8)EAT=(A+rH2|#TDGxPo->*N#lBs(jx=PPfLpRSiDFE40260(k-Atq!m z>$9&+_?k@TIgCCbrS_L2Ht*gM7q}zPlXH2 z{L?ohEOAvKQMwYAlNK#D(Xp1!c0ehsh0YzRAsdsV-CzPXXlOznjD0G!p$iz|>5I{A zKf}D&N;eUO>fNzqV=wzsjaJB1b)gcbXVpthFG*kJK=PQ#*r`D;MmqL7SG6Lsh2GT2d*?-8mP4lH^?jJ>LU5}LPu@&`xm{S@S?}MFK1>&wJ@PB( zGaU0yWAmN_=f%U}xm}MrFED_?DUDwgloecNEs%HHZ`L}-g$x^>TXUK_mDzM<0<6(4 zmaN5N7#9|2;Hu#IkFH22ui8jk5+Fa`MW8(?>PGD_`y1)DiX`Y8K)DN6`$JADR%NEH zz!G(%AXCdAt=de_Sg;Vq3d}aGR~Igrr2ZR6%btjO+VOQK09~WtX{yB1uu+AN>>(24 zN8f$+rWTi3Q_-guVr-PG#7eTdjb=}3rWRveUF^q=`B-z+=2gWRN7ze7(GRrswkV!0 z3&L&mt0PBytpJM_&Y>k*AN(m)e2xnre-L06hk+@yrZ&qE=JDfJ5~61KHWb2dd!I)i zFxZ*o?XLy7lCy&`>w#la&S!)lTar%>vL`g8kWtfljV&go@}>1*4asVue6C9A{(}ms zu((tx7MmD;VnVaF*&~Wam$}l=o zo=ngZ#!rhq#h_cKzR-%OeKDIPN*tx8inp#{!0AEsLLOwI={cBXb_=}WsyIJ&v%S2U z;+{!?k`STn7V|lo#5ov1}#dra}jgPeG!ul?93p{W? zttrdl^Np0Udotz)5Q&P!9owwpAfYYiEGQFWIxiMkmP#n@*of+|rT}nTgVyEQw5N+t z55Twy!tlmZgen8nY|YwgHuqXN>{#+6LoPAqwI(-|mV(k6?^O1jf6L$`7s}!i(0ZCr z%Rmdo(-z{s3X#tW=<#ya(c`KEGLr8s4MTlxD?g6radnH>0!#&!_F0gnkb=Fbe69v+ z#UhD9)^#k*03elM4hv0*93#?KGNWV%eWJN$BA2#`Y&t&?>q!=1p|UYG?G5NBVmyliva%^K z^8D2t^+#jzqFgE?Nb-;M>7uYA&<-@%5jDt9__{2C5O!<{QAWFO#ArXA^f2feY8o$S z5LZi+79KfSG~} zuGr>5CdO^3#7t=Us33FZ%}9H(#Ibp*bD-k@u#4Zd_U{vX06mXY*N{WqAZE(Ouf{Ys z>i3p(nXt>d$9>8x>X9&N`F{m3xU~^+)7J=o^O5H#C!nHnl5{CJ4iTwpg-x|tNs=OO zb6YPiQnOL&sy3CU9eGE!ZY<5@8HbYp4YmUM3BeI0<>6#_J0r9#NT|#hlC~Z1>4_2u zZt)g_l=eHqr-%X)k6lZ*Zqgj(P7@SAO+t>*K!3e6MYvwqula77H=KtVziX}bStA*U zTfPy9)W)7XBj=5`LUuXJEP#;Ao|2bvBrDRIPuTZtbe1e8A(jkB4S?DIR;M-wk@Zuw z?}s+DGSM}Tl!}I4)~=K%cj7T61g5IF3*jDPH0kLiix}R$EP5P`v_oycoJ5JWHo^{pjgiJ zr22}w>K(!IMpEE@Ptxnt>`sEkg>4Z)b{(6x7eph0U#=^<--Y zojsjY1Qo=LPb)>T%jUXWQ>y}co`|=BtGQw?Ax&C|PW3+wx3aStYQukz+?uB-(LNQ7 zR^U|>7|@SEs$UxlCc+s%)`a(9hxj7R$@m~&sIb<9aY^fCLr^-5%D?oIo`SbLb_qe( zB@ADtR+Tu6Rk?V7k;$&p_3Di&@a}}@^_RcSsQ4~?2cyQ?ez$&we{H7AxK$s+W8FR! zcMj#5Yg})-a}<3pqf=`0ZnQ_Mc&QevJyK5D>R|`5&XSs^_tJKM+;Fekj#(X)X7|(; zPV3@(6Pcy)U0Oa{qqTipcu>QYedP9@8E~p{7B@CW_uT^+YQaCZnM4ic@;1l(>AAp- zZ~`@9))yyR=uv=eBG)^plGLUr2@>(t@*{X}uNi!4IY~GfV+%95Hs4w2S!isS{}q0O zIApB)?$7vh0nQTFJUFK3$HkkJc+&n$#+!ye&x6(K%fvfd+AUo18rWs`Vs7Rx zrtpcmD5rv3irM>GcW5L{-xF}!IjK(`RLZgeJRMdiv}+>EzrH3M}Nf+hyjHHG>9jd44|e8 zmvRISNCK2Ju$@Ah%MACB%WeZ_bc5Ulo@$Dfc=|s|4dgdV+~HkGlgZ|js$B+9X9ANBZx2?3AvO#_P4vQ8_e767W?7oK|#o@pA%1&RpOX|I}T+)5W`Kmcs ziNz4-3QXSgd+Xc)4=$aww`_JY49A3Cz9_|FO>3wdu5mIukX^%?zo@764LZpxGpklF z4dtWV#BYVk_LzSHhL_#tKBvE)y=ozFZM+_>i>+79>!td_{6CDnV{>TXwyhh_*tTuk zwr!g;ww=t_wr$(CZQIGsKDTbwK6TfJ^&7@pqk8MTJ*|1?s9*=GwC}qKQoK29Jl*Gl4B*NE;wUZm{;ijA#M8(gzI7iI=W|8Tw z(~J%FlK4HrrN~Xvpkh#(2Dy#EHq;D@L4iSzj2IgTPUmMZ^^%9~G}Mp(T8IVfnxBQ> zs3d5n znk<%C|E(VYn8Z@~CIPilm(TFeL)#7vPmf%L-zjxh%kMvO8}TF-OR2=T?~Bnm0qatD@eIG<)Vd39x&$!`@?DRN}#AyeeRPNEFE(g@Ni zohOS9o+Fa2Ms%OgND{(``0_`SfebG)My+wR@YqT506Z8DRE=RybRiBc7CGW54quO7 zwv^lKUo}C*c{cECG^1c9igsKb`9GQ0`tFE+^gLpW@z(84M6}NC*-mhu0bRx|3sp&; zmJjK)cjcnZXfI(Lc_cp1dLJ%vW{uc|EZS+9A4ZF80D zZOYC~l?6K%t(Dxe9err8 z*~i{uVZGbeMCsvDRtgV-qOImSj;4s1gpsY-pPm5S*6EW@7t3p12@a0;a8zm@GnQmY z2pBW!{0UcY)mt)w?S0rRBX2gqDMisric!}oU!pIqx$JZF#N+f$c8G!^vqKL%k7J`6)MfMq)n z%ILTRMe(ksYH2+c9wic8+g6HY+ckHr_Yuk7WK~?n0kuC;`nSS-x>N-_z`Q0mw4F@} zoGn`(l(TYh+Vig1jRlfMBuH?%$T!no-__6u8XjU}B@^RN+YF07391geXV@b+OCc8g zJSSHwk$#0SVaT7(k=Xb@HPk?^C?P2Kus)q9D01hTD>!OCaj_{)a(T#&U$|E{1XOs3 zn9nvx!YC`9C2yK31A3mwrIbq5OtI&s8;0e>`D_bYaf$LWC3!?=#UM+=q)TDJ1nR*u z6u{jK^y0m#)y#^yH{-Y`w9)bzBeyEff#qL$XGtj74oh9rwZ0XKIaJckt;C%#F6MH*j5pxg54?W@lpH%}SyoV5Om zzOf+Ax$uYF( zM*hk7VdduW>4Id+w%_w199OA4fkg9HH63T&>~Sk}-UbB&jwNx8xm& zcU^7PW#O+4TQ!&$ zH)(NU$&ozT*ll!<4I^DKTqdWwICftNwnDlSQ%#Ks8p(}A1Zh;+yQPK4f!*yCr&`J< zdv(xfvCbk2Yqb1bSy55v#PjT)EE79zRYt=5 zNz#VYwZj*u2s#DUBNtE3-rfEcnsn00Uv~6=@^(|8dgwn7(5PsaU&r30UNKs+v zX{r^IN=%w3EV~NGKI$NB)R0m(dVD@n9`u!2-H$nB3JcRRpZ*0L>qptJ_1#VnL@#tG zqYFjA4WGc&{M$jx9)5p_T|ilS(W6axl-2v*NH!)5Imw|LPnF=($o_G98#%IzEs!qm z`u<+nyHmr=kkhR2xur@;IB3S|ZpJ1PhvXvJ2)5(RPz5#y$j~8YT8ljR( zl-g?8+!e3dqN~N!_O^0e;&fL=fbc@0Jyc%R(Hx^Vh;wn%xYJ%VbQnJ8`oYL_nO_sy zydU$QcgTeHaOO>9(@G^C8g=Z&S%6x(>gfa^+%_6^yB-@{9m11p!Bc5ny=39;vS(;# z{hV_4m9>IR&IAY}lls-OIouv815?}RhH zn#-w;sHNV7`_A%5o62W)ufR`UM5r6AllZLIw4b1@0Etz>)lt03$_5*f5ml0n;w)Bk z$1L6n+L56!Hs5)$xK~X@pljMrY_Hc|wBlv}FxoyQdy^2c9G7P&yjW0%mZmI7$%Kq5 zTlAfXPTAxB)D7=U&xDD{w3u{yGcNt8nBh%I@C}M={s6Y}b-YT@C@w<4K$Ek0D&Qpo zF1(pM-x0hv)wIR_5<}0>jLq-DknL>DxAN5~+EN3!hNjlRFR`nnt7Pzt5?y%FL{dLY zOIonT8hHyOD-yI0gtcMX4=qTqYfZ)9lr>aP9@bu76{Hvy<)9dSlNtBH5x-5sACXh)64tKK^WaI}Ph9gZ zKQjxb-KVBAtgx=cLe~%0IyCr$m?gWNzVixgyZU!ZRq$SW8-skO2&G6q2`d?(M+O1_ zfe$xPNVh=9;J1Gy_~@#th)6YjFNPnxLtT2|m=6^6FareAQ+G2=fZj2tp2(GgL`tiP z3M~0+qOOeE;#g7D8i3d$tz6#-Xd&dL6dSKqX@GwyeS%{$OMpG6@@M`CA5W+GGhX(q z2jgpOpL0zoSeNyd;TOxV45baVhhT}~R_g9l%SbHQO!^-nvH(T{Ip5Z4W)@j9%HOV) zsX_{&jE$%g`?*MFBP>u=8cB-y)fmH}4|}C^$vY-~+-Zw)j^Tp60RUuuK-Ob@Qre?X zX~Z+cQErv%V3Ct*^0%O$Rh(H8WD)l-=c}xm21FWlVp&YFi|<~uJy4RzyFVqjr_!Fc z$sxAr*cjqj{A2BvFY+u;>c?s3$d0oP1j)EsLxAJJs-&Rfd7#8+RcUP)WN2P`bwwTE zAdfRI`wrQfuO1n*ExBF@g)PiR!wTVbOB&waYYhjPC>&I2OP#Mnh^|YRi*+chA@D*K zrhn(0skU9WhniuPd6w5W$D9Ie2wuy`H&14zK8`+gCpvTLn|V9 zOcKJpbxdD&5CMTLZ{(3$_%$-)Da%Gk>U)X$sA(#{jdoZlj3g|lJ77bg#3xH&N~;X> z8mJV&mwq;iy=EI{)@J1;DbnE8I2-5g>PMfatA^3ag4!b>usOv}0)< zeqa3^1-O-Ak)TKPnzzQK`nSQZtRcR1^wXwIrl$!)QtYj>3%v>|6hG#AMa^d52tyZ4 z4pFZUNqw*RCS_1%=;DsI)_II{A6_nruM%FHyCZnf5fEUj`i)`HKqGZA>wp^Jfj3t- z+p2yc@mw423>+oR%c=;QlHmBe893f4G}g%C(60?J$OD_qnCACrsMJqQd}Bhj)Al;l z@BgI_Quu>s$0}kK+CuhN$4?YI!i*geRk`)oyuCaM$ggkiq{zd)Ms*7P@LGuqy%07u zVM`NJqpUda9U+0WymeFLB?7+ZS-xqFp@r% zo;Sz8=LqY;{*9|Lee?y5j&rA(Sr8UR{gF&w?XPp9Mld?`M3D}obaKypV;*?x*PeCK zK5mSV1caQUng!3Vi78U$tRh7i1~i;s_cbVUJ#phX7e((o#zoQRQykNpspRTQpp9~( z0@ZyEhW@%UHwwpA-Wo<0YLk1`Oh6|zXvqIAO07lj7<(l|>88TN{~{-W1E`q@{Rq@X zhZbjTmc$L58?bf)81n?{&t2Wp*uzb=mLF;FEl=7y+mhNXjl=LlYpFn2YTZH#!*J^G z{PgT`ln^rPfi-(AI-6jz3+7&2QyAOuR=w94afpBe?+5ee|CJHL@b>tB{Ru}igCy!CHj zfhAenQKg^Y+1EvX$k6efqq5|?e!Z>3oNmZz`xiu1B0YG{`C;v~8wpUH$;YEQBVSS> z_CKtx^{h&MfOf8>C+newRHyxX{Kkuy#9CZfanlWl{ z`y|mk8eiml?ib_`wr7{F4#Ves!A!gkISp2be|EkrN!5q>1Ol!GiCtv}TE{*Hjy1FF zc-0_DZ3-gFVp@B^6l`5@$b%G~?{F+u2`)IO$XvrEeZ8fN%b)QT{I4~aE4BPFi0RQ~ zhn0j*w=f)BskvGNAMz;W@;q3IpQ$~>*~o5Ue5}~@@{=z1ui`)wH{1~sPEx7o(8Ml# zFa6NYv!bC@2HB>2SKcJtoB?(`2coSzh0pY^su#+5D9Sdz*V9D_Sb*w>eiV%8$S3me(V3AVJZ$bY8$@|su7l$Dr3sfFm_W?E*_C6eYW1h)r)W5YH}eE zSNSVSVBPI{wqK+B_q$#b zzh|z>|EQ8~aS0}li#)Vf*x}W8c<2~zUUuA~0M^1+eJ|ZTqz49j%Zr&ESuy3eIdy4nkrVVSvMvy-G>GrlQmcL7P+~~Yy!zqg~{xD!ApM%aAz4ZZs7FKg}s2GRi zf(|t#0iK6;lVq)MnT+h6-J|IGvequ0CK~_egyu@N1K* zWmm`JPgS#$hXj2rZL9F(T!r)Sn2hzH)PPsenc9p@65s{}9kRn6QT|_*{AnZ=G3>|4n5zuI)LT9-nw<2}`+L>Kh)>lHfwr{t7f_O&~f&^Uq$N4QS#0s{v0IRZd*4Z2;Dmx~!3>fASZWWxJ6PUsLQ^*9t*(a*g_B~rxcr04v;!+WA)S) znS=#6I*P(ur`g9WbIJ;!NJ}Ck{OFgR*ywHdzacKShoEmw$-IGKex(g9piRyq0fh%u z4&arFDw}?(rkvr-#d#S6M6vE0me~D?%TiyKCy&3-im`cGa*PGi?&(A!A~#iGBl5ae z0eh%EK&1Uj3c_aKkg_J>p%7|cOn2rM<6#~MJB{JBAU~VVwW$D&)jwm3@zu2?_Mg#e z3A2BK`zhF+tbgoyi)_9FcxGact~aznkF4CGm*ZWNi%msa%x;G>>IeFr{M1?XfZK&u zREzFqPV4?sum!o&Q7%~-O`-sNpRz>%#@Rm}#8?Mez1|}H1f8f zsL+7Z$8#YnHRVclQ7!Jpi$qY#-xCEXLaT=}d4>f*47BxsyYdH#0Q$++WsNmg3OzPm4Yg~lpKGDj81As!<@9YWlJQ>nZRi=Zq?%m|2 zqR2|)S}(;GXL9CltDTl3BaQrkzhaTt&xEGgQdWiIXq%qw;;dqE{3lD6LJ_YXwvua5JM8N*LetCj7s7yG=J5dy@gW|$s)OEFr*ceYLS}f1NoZ9 zbCZtvLp;BX9WEe+AR^51-si@ypZelMMJ759E-BdL;Vznun1tHexk+{jn^4*wydQKb zUEy5iMN2_9;3v@j(P>-RqK^Zoa0Xk=r1-o_tX{$qU2;QPc*{B{RfYw23PwVqJhiyHkXo)jqL&%7>p@15?j-t5(EMj@HRl>(YZ zb_cJZvvizEq^C(vg{2qm65QZ+CJL>q+I3i@g@f?#8hja2gpcU8refBMmy9c?W6r8! zS91eTNU0j5A@;rf@sjZ&spVSvfx%$C7_M zxP~zUPp|yTNn#rB7`pF%)Lk9ufZb!ery>-?s3&3LCES`<&}}l)5X>=J8@)8Id7vF* z-8rsbb$!2Hwhgi*PGxHjZ?1g)SGDJ!98*0?5^OZIzjFvd7t8;Ay-+_`{W2eB)*#$e zn(}L~(~AdRP+Ym7MO@n?aTEk|tb8rUpJS?}IFo61C zM;}7@nbAlKgymY%bKU_cA|Xcb93=Sey#4nxuteT=vg*oLHh#Z*l>6-~U7nFl>mt3z z8bfmzf?1~uY33VOJ(sQa5{N_qvu2(%2nPiceTveQ1bjIhp~<|1d8u--PN-V_#SknJ ze;{f8!c-B?65^chkT84D?K+Eg|MR#U^+P_Cf1jJL-YFeeZs@RUenA!?V&OY^%Dbfk z>=5z5HXU!hF9-R1H{nRm?bS@dBFB_>%4sRnPT~9js_vW6%!b3KkUda53zQ0`Vf=?LerK%uA)#+q_aN}gosXj5bv zj9sEL)Cb^%?cQQ?>fVA{<%*^Q?w0r(nA!b;oC*F1;DO{7XuXV0y~J>9IkuCZRSh>P zQ3;z8QM=~Dw_XoW$tnMca?N4*UYFvmW0x>e$gApoUY%KW{mSjI`5?|k&Cp9@UMd3}5NmdBErFlts%{azi)O%Kb>$ z_lVI9TNM(M8bGNkNWD#6n6uPHUf!GwgyAi$eeca00ss@CL<*o6nv|+V1~oW7IZd&P zf0<6-V3PKNnvU(8rwC)37_emyDdBj;`jcrl23uWruH$!}`ZvDvL<{q5mY!2raI^lZ z_M!Sz9XTDXs_3fIQEI5g9Y|-wMmI{wnXE`U`3K2@Pn zh)!2XpL;?h1|3NN#aw@->R>arFiehg7qevw3Gxq=dlwx4S&*xmg+e)?HFp-VD7t9* z$asN{`sJGb1eD|4TBU2_CVSy&9I)caGUt4G{l!M%Ra=0Y8clDp#&CbzM?nr78Sjg7 z1y}5)`seUFzN>m-J9uQv)${F=>+ytYrR3d}UfmD&IL2R%{DwXi!Qr!6j`SvS2hu7f zZG*JtvN?<`FsCX#D-o5yI@7~U;DI8BknONc3bAAy=z93gy#?(|&J` zg}TW)jw;SGAmErw-98D(?r!4m&o>#Z4xePU_;&g{PT#2C!GC=EclffKeP3NZzH%m~ zmqCNpt`q0+1P zmm<-0tE5zmZKNsr8z4?zE2TTN?auH)Uyldz@m@z5E0F8JM#6N($clZQIdXUqxEr;} zBEuy~-N{27wR`1cpAv)61GYyrl%)pDhBGg;mMH#1$Y-#`#Eo$W)j^^VuMUML5v+fW z8T8roM!j*UDPhjK7b&m2R7KGnN2)*E5Y{9^Z#C@z01%n2%{zO_XEUid?Niwi%n|7U z_Rls-WA5IhIAGom)|ZU%wh$LiC>pV0y&gQ^a4OzHiiY(ki}^(kA*_P&vX@CQ`{n*w zsUyCNLC%qbFZ287J8LPb=WR7r(PEC=rF)!&WUE$3X)DtYw1hdg$^Q|OH85B9o?SvPWVs5ap<2(Rp57F9z`=-#rWw8cJ;DbyD-jdq4ZMr}g*QughMM z4&&708GbASncsE$f`tjaKsL%s zR82w!Unc=*_MgXwQ%KAHt?xAUNg#*sW|2N(9Pq=RzMgK4G4^cbe+hkb8#La@EJ2UZ zx8ISCc|OAIQwn??6UCXLdyiCmG3?e1G#3fhJqm^hJ(P8BAB@m0i@kr-`{zHyZ?PE$ zufBz$WAtrrdA)>{GbSvWbA?36Ad^dzkHf`bfn37{%euP?#D&U8FVLlP+^heJ6Hfbl zbWPB)IE~+2)cE@&=g{@AP6m2BPf^~E#j%7ag&e+rLdh-Lfy>`YUY+`R!7}pqVS*v= z3gc>zipN;VtD!kPID@fHN-Np}?$0>Vlh(FU+qP?GLUbQUmwSCD$h(`TiMXBie^QVo z8pl!nI>r>=>?rKT$_1Sjr>NRR&+fZd9j-J#x{rS3US zNn_gzWG5w^!UFoIbWKM3*C@?L+n<;aKseKTi{okQW%;cI?p+oFi1BQ24 zQ`$`EJ-Pu#Lvi@}y}5Y#i?&wJS0=1O%pP|##?5(K3wC2cS!5y zM829y;xX-k(}bF_L8R1ttdpCEo#JBPAoHZeV`#(GRCbjhsj#>J!Dl(gw zSJDD~ND#%{24pFP-Z zzsozIx4O@VDSR3S!b4Q5*>w+x3#ETi zZS4anni}OD(}h0k=^wEw^z}o3H>ep}nQ6tqM_hoIl~Yw)AUjw`IGK41AJ7%7#)*}2 zi5dL~iHYPdV(CaVKP-HudY6>Ket}>AM~))S1ana9@L9Vd5WHn!ds_jM zj@~#**H)*2M!iU>oZhmt&hoQq6o;luqqUEJ(0$0!`AA@I+Ky#u2`ruf73LD zoGN%0Sok2o?70&bm;sah5V4i9DUk3Gqiy7mX&>z+L@LVRNs`b>Tl8aGkDdtkQ11PW z;5NHxRV4OZbN@Tonm7xbf-q35*Muiy3lM9SG6x!rX@Nei1{-4u4tbm{Pa(xsw{$M@ zaPU{Tc8%k{U~?>JA2Z{>N{>^}Xa<#he8PQdWs6WRnR(5=gM6-wfd__ahlexDcu+Au zR!@w?qDq{771A7OFe3J$szTzUHs>Vx# zb(F%x^FK7fdFskkqvgJ(>lCS{;OMp9y@;8z47ncM@ULZRsLY6VK`mg&C5(yCcaO>a zVTZQshWY22z*kJ?k<#L3k_&AwJ7?F#h(KoL7BShmg4KT@;28;atz@Pj3$4F@OZluA z$7WanX>z9)31=`&y#WHlhrG9YaQ_l(K2#c!(ktOGS-RpZ$+|JZtamW1Xf7bZqAaDZ zy2Pv0R65Ipo}H*%3=j}n8QQ3Xrh^ELq-xArgbjz;LJwX z%|C^{e4*p21Yy1eGCWR|PrpV>0THq&78_$Q;q5@Ky?HHX)j8i!z^ceMNWRk*gc7Qv zF?GRR$BEtN=_8&UzrE264iqu1O!)VBbnk5=VZT_sLg_^*%ia8F9q? zLvLs|hP-dL=;^bxp^LV4J=wG9IM#ax3{t&h$FgH1(K79-cewfH^&$+upYdkv)7_a5 zx6uK&xn2AuH-G)HXa`q@CtLR8ydIKbp~X3}iGI}pX=fMkRSr4hdRqvsV*nkFcdE4a z&gy!S$qkKk=fSoDrxvf_L>^Vn`@T!1flPB0?nv7zTTL%P@h-yM%AO48bfDd zH~bHL=Io8*f+h3FL3<|7VErk=anoYoC@2ehaLoPbC(*O>gZ3ssiJO9te^CTDH_fOr z^xZ5uB|NA5CgGXl2_N|Qv}J^Df4}2qii`sk*sopDl^^b}$0zjro5M^_*$yBM?v`a` z=0;v*?2_C@j_-@!gV;ZU|0FwD{u|lB$o_vj*tRq~sxRANt{zYxfD2B)0AO7Z@Z0#? zGcsw#4aQW{Hwi87KQt0aw4O&B%=jYk*;5aAn#J9d=$IR#{3alrW zl;v;ng?O`~ix&1a_FwKb0z2W=rhPP0ZKvF`iz!BOPuy#`CEFJr^EnS^8b?yDuEIT@qo{Ka?s+vDTO z0r{70)bru+`eKWwNo8oq`=mvF=yx7y;TnO6=!c8IXW4y`WHkFMho&%5(Xhir8PBNb zS48D-pPBHaBv+qk7E7*Rma$w|& z7eNy$R#9`xBBPk%dOZ$M24rivM`C~yIa7G6O|%#AT1p0EpuA5X8aXg(h62^cmRBCH zj8a1`jvC2t_FicBO}bS6;#n%StJF2J@;c_!luWyGwh}7^9d?~}Mq+_0u^m?#&!lgq zmRkcxTZ{!wjdIYAVFO8-c3D0A6|W(_GEUZylu`@C2%qWy4T}Y$idF|y8YogIKSX$; zQ>1oxGjA_U>Rf9zCpu-T*rR{MvSAUJrtL61c#_8px}VFWwT!f(^(9H8PpQW|4Qr+^ ziRNHKBx*if73;(6&}%1-%t&^;^EZ zMVj}VZY0g9<}Hvx%z2>e4B1a(moF=_{hV?rv+q$uA3eYn!W6*q#&)F9Y zUBHm>HsO{}3(OT{KAH(vlu&8N-32)~@7dLdfIShLIyOTo;STB80g&e#fmTreB#?!1 zg-U?pBR6dZBX~+=us}YU((pelO1R@~pfR1^mMHE!fOJnL$Ji5`2MYlJe+RbCqVggn zR97K2j(`61$n4Z}s$4S;x`MV9TV~xZ<1xXqf;=t8P;HUwr?4i|Qc{#sE{tYM`Kbcl z%C!A#uQWLj*jjsj>EHyORM@>HWw>r#_V5JsBVQ`i@Oov~>DE<_ZiJf*_*f|j zIS@G}Q=3(cv}s-%d{vU7d9Au)b(4f+Z8U)d@{=0FB0-3@qjI|#Qzecd(-}u&Xnh`r zCpfwXXrtobygKX^trx?6HSt-74^}H5O@j29*3_q1a~P#E?{LIN=z!Y%9pzRR+-( z93OVmll5G7lau96HMhqmoIjzc#|?T)r6#R{DNfEm7D6KXy`Yemsay_qxz75d@2EU9 zA*nGg0NkmREJ|zRkM0MTOqBz(s~3WoGsi)OYt`o3QN@vPqvzB4KjSlijm`$sIxfqQ zhm1vH=2}gsLDPV<*as3{!>o9(4yOjs0+K3gxo!CR*k6Lp`AO0l5_8nJ%g~yeXFqGTE`f6g`weC9Ted*9w3-q}&A2 zu}q4s8kl#5u@{>;ZG*y*irjY@D2r z7k-82x_jDG0BD5T6ZLr~ILR_i@PzyUK5!KwmoYfJj zG$bg9j!r3YNV~Ttwd5Lnl0CS7&wI<&lWL@;rs?q=v3(RSr(`;qKGg50Nb&FK2G zDVinkeHwILg|uFoFGbcEtZm7J3l+Ogq~dU2!fRni^)U+qMrzY8-A$dwY12yJ>oLYTGTIZ>H2_SVL1(tv%RAndKnN*jGSL|BwSlt%&H-^ z7mjJU8AWNyP)+-xNfOI3jq_mu$1%+G(*#qPELhWi+9ZquNY9RVwq0Spc1xlVs|#dO zwdkg7$9HxH`Fl3JkoNyd2dy;FUIPUEKCN!ehpkNf(sk@$*>OFIvgI9v*mJ(;^?)NOX{eSpg)4q@P$;#bb`~-bY~B(kuwdFjgUIthT$* zZFveZb`h`QJqK71a0Y_@G6?Xv7z#v4r$;~h86E?#6$XY}tSR1p4{1Och9FI}93m`} zIE~GW=D+1v=4_DEfD@b4qd?8Du2T0R+`P3HCc`9GqfHBx1VLGn?b>~{h}1#g$CwvA zNp0Ex7^4oLuX##;YxbC8xM+!fZa-ylrY(YD;>83F#lwZ4_1558_5K5R497J>LwQ$4#^j0mdBNRm)tRjGto?j&z-(u+V*;te6-u!OexvGhh}{2aaq~ribRBSZYAgaE zlDM;vLF<(}eYXGXLQ7JDUCuN@y=-2SuyKC(kl3D>Q)AhE32(>AVTY+}hlIKT{RVJ< zEM{3EDD=;wn)44F##5d%xb5Z8-1Cs})#JE_iX10fFx+LgoBQ}KyuvdQR9DzX4Hv7A z&I)=V_?Q3JL;z&V;|PY=npL6biKImzl(%OD+1Z^nzgUUFi*pCd1#Zs9ne|p#Ay_y= zNdk?A64q0GhVv>()zz}9fA+Myti#Y}E=*zeQlMzi&G}kmrm`oioZ|eDMu1ZHC-($k zJ3PC}4AgoR+=4chJToL$e%l#N`o@(8(iD%HIn~nERhS(zTs){jc}Gu8f?fqdG4oBr zPNelsyEWgxMlOv_g_XdZ_?9G^Ud+2^Bh0^yl^Y%0ZnRf_5ka?IkI{nlr&_#!O6ryG zWn|>_5m7X+pKUDzA2bg6$xW{r{&I87aNp_~r54Gcm4H07^FeQ1)#>2|c5|H(`a_yNFJtUhB>_p0&TwEFRr2TPe$@?a^Hn+2?bozfoxy^-;`eMlT$YiA~bdZ}=^W`&VT z?_0Dx*d19L;oteRnOmNrjeha<`9fLg(d3`+*;)8j<$!)}=A@=+@GE75Y<@)@*9Nnbk;F%#*dw)MK z9AChtYe87a@V%+{gO9r|JY-z~Vcf#Ng8=iwX}V!SqHA72YSdtcxf=soOH#@ZjB>*g z<~C#h91=?p0Kk-?dG>)`no|9Cj7j$-d6lq3f_vF8o#`6M&cd6^0NmMdcujJEyMT^w6cn^?Qy42+)(Kxsz(t zARfqDm=dj|wahlXjzUM~*hoSNYTdj#WKJ>5{vwT&Mt8XP<=n8;(vGs9P#zl65MSd9 zuM%L{u6;?BFOBoiMAVK!oC`s^D%qKj>_o;$<7!{70vuEN zTlxCIih2HxqnMY4kFEK1h|;eoimFSqaDr=wZ4^&_dJg~cZ(s*VBQ7M-r}hIW)o31) zNC_O^)9|4~c62M;8%V(EUd{Sr+o(R+Bb6PfV56-aYXa|>)aJZ!^41QW#=f(92p-y&IhDneaQ!-vARM!8_qrBEh-H z!WDbEfWM1o>D1Aegx)ew=}s7xnR+>6IOHJWC9!;^J}d!|${ z7?9q|p@&?#+?UIV=(8$9ELYHc_4bMJ(pWdPlUk+^)wUsffR2@#TbD(9T!67IKk8Vg z)vUe$@SZBn*%j8QLa6U3H5V``Y0PS#OD4(D57JF4sr&!`E~PGsV*u$c4E zhX!dvt$<`!QAoc*qVn{&+mI(o)YJYGp-6beDwLSXt~K)zkcMp9)Ap!bTXt-2b1{%X zN|MWl7xm7U)tVhTDOr=CHAw-?!6c5$RPr21JxT{tV+;VCF?a*jR7YucxKU!v&q84J zk`--KFi$r#F1+yc<`-3Oh8q*7TfbNo$Lyb9xj}!CtwrIkaJk`4BpL70pKnJe+t$%2;uW@g3kLxIJAg3-{;>B+cAOT{;I8w_k^;Y8m zL4#(Dwo*`ljG*@(9f(6dz0JxrS9xe**+%pTVuE0Rwbia5Saw>;!C;1L@0ES<;Hd0C zK}{5`T4PP}de<6*-*_)EHopnIaZ$kI>IV;}7q4jNrQG4PFgjRNokPBL9}hiUZJn2x}PQo?7%C*U6M7G1g4flx&}|Vl=8$yuKDu+VeB27L<_fN&9ZIV_NrQC+qP}nwryLhY}>YN zTV4C!{&2cue>i_(M!Yjd=E(7+YQtHwrZ|T(TrhQ82146Q(R>!KSd)dLX<1dRjDiMl ztdk@xlp|H+ww#71Uz@Kf6`|&KXkX&`BRRvPtOO~vzZ@W>ka?vujY3liHZk%|2xa)B zu4JIi!Xf7g3OkfVYGdz8{M@+Bdbo@_GE+$PTzX7KX2P5oepgt`=_2{*lWce7HZheI zPN#Bn>G(7>wQgo1W>K+p>G;7X@YzrewHGiraTi1`hWyWNi&fcm)|bgy*{KG{9Z!CL zP;Pi!(>68Tj-pSh5e-^Z~~#+?)hcmX?c z5P?m=ZXxrM&=mO*@%Bnvb7=)D;8po#@&!bLA;WpF42U~4g;BHhmaGNb;-b%9EQK-J zq3P^TEc^vv-<7Vw(~xK>{sJosaULa$=)zI;6(wMh&L7*QnxpAKlw z@~w5&zPl2mZ~AzKy1QquoowqLr9o47C)iElFAI4D`1-e)6LXTJbfII{G_~wyW7}HO zjtjU-+zzzIl|*lDaE?a|3di>PPwG6-R^;BNHWE8cZP`x!@e!a^*sk1Wi`X^p#9P_8 zSufI)2ghm6)zXR7;?9QSGR;_z8bk-We`+uV=?WiC^`)GSTHxh!i=(=wWs-G!k1k+} z_fTy%z2U9lofvXYbUlyDGQ2`vL@$ymo?SF3gp_VAVokgF=v!_eXTj9$&c9LksS(0c zjrfKMlXbIdX5^w3a~QqIldTm&g=7zyzuhE3F|_^VxoLdp9Hktokfh>zJ|HTC+>2-; z${m;fR`&M1uB#7O$GslHzq-bkvFx(#C#YH~COQ>Fy2AKZo~ zM=ag|>vSchV9->kJX|n>fH%oMoDs1om$JY&J@^~Pqmo@l&Cw${s-H%YwOp;c8+c+P z@DI5)KyC~*CER%(PODow5{-ynH??&%lbVo!q}0*YzR%*|)NU@UBs%de=j%R^6WNOy z_Omr`S_UuJ2nG~66YFeAC}I5;P4i6atvx8|dHAt73L1{%UI%nbbKxj7>b-c6fRtp_ zHmS@MQnbNl3XjQJ39Ydjc~7G!QNM!H!lfM@Rho-srfX-e^`xyGHEg;63whG~TM)fe zRcoVH#*}CD|9)Gyr`|#&2!`8t>iE3?e?|IeD_g!_O zs*LL|W%5>cr$fEszsZ0<{~NoVnU(qfcQF22fgpjp{ea@`kHQK+UrQ6WD{)Ep2v=V> zLC3ZUYUSqLtr(~+GmhDg4cRpR#+@viea9(C_tPE*J;G~mf4^^~$D_4x%YFyV^W*mV zJV^7yUM$0%ASx-q;XrpR=rJA+e zNTD5jJT?^xofEUULKUrPm0|mzlusvkr30E9!Xr^N%>$huln3~USC@EeoyvwnfK2{ztZjTeXg}+j6Kee%iJ>4fim~^$x&^pF21V1%g5(Y z>cC!)xpiOE+}FNpej0j>W_LD6Hv#i!FN6Vbj%otO0W@<_QnGQEnbN2$TF4NI!eh?K zhmu@eighZDs(r@d@PBjw^rSwu21B*;uMRklQKeC{f90+9@nz~cpaMgLMvF@KW$^jvb+v?C zZEw>CR*&ivjY0`wuIuFbhk;8h>m_d=v#Cmi)?GA&2Bg<{k%Y#5<}Q(3G{m0PDPPG% z#mh=0ZBZ7zD!!040hw#Jz@7w&p93$=fikw;I2p9##OR!rd)C}XR%JN-=TChFsc=3v zbh3nA+JtPMA5epiKun4_^8J^i*aL9KQb9?xui2lgO2~0*I2cYB#7)d=jA_Qp8c8cx z+*6a~@#wePG>MKmg9PR|M_VEtRP@mW>Bw5I&(`k8Ns1jQ9=XunZiE^UiWL0pQ;6o&tVy(N^Ru|=?$|ZeURq#cRx`9Sjk+xw(ZM=l-ax7-$ z^I=5_hbCIm6A0mIY*88wDew0RkmrgR3I2j=S(C^|M@6vG6ws8)BD{E0jz_I$tHgBM zVACQ{)u9Idb@b!FCW4 zqg_2|0*8l&?$u(Q=2;7d3J?h}ry)k|8`Rr5$!=mvW)?2bwh7Z`V`=*Td-?N^ZuQKc;=s8@DFL?w=d z>Mnx}hsQs#fWZfuCT+8~#PnC46Har{F|xuTe)* zqp%i87m5vIp7@wv2QIUL#_I;T9grA0?!|hU*~samqsfpPSC-L*0MtB!?_DCm`VY`3 z;mrFzM{Zgy0q_yMS+;2v!3AIH2QDR4dxzC3Yy;Jx@%j|(09a=)^}hmQO`ttUSn!4;sSSa+tYan$My)=5!V$Z#*FpvDTJmPKie9L~wx z>v)yFNtpJZLATuXw2F+mco90Mbxi^z)Lc*D!~!8Dsku3cG5YCiZ`jTBA#t~AY&yJy zv@blYCy!pFDrH6R57A4CFyW47SL2s_8aLzGnQ9d>{c0Kq31-EUVAE3PFlqAfHFlVs z@`h)|H7h>13&Guonc6U+@@D23wBG7Zq(hj)R8)xgT-kRE`j9%3A&6+~Wok*&zLp7? z*U5?Q-#`wol(m=-#aSi$@^GdJMiSNBVK(7 z_VyAL0QaQSn6oDRa38!=wA=y8_56k#>ELBy{PG$%KQn_RAeO_lTHLtL1DnbvQ@87n zt2xKQ`c@`qkGOVP*A*g6YK2ZEXp7@1c=6^%+>*|;T$OiviA_A|N%;%l?sRE8R2AVt zq8Vu25$BCNS`{7?WGti*zK6?Ob3>j{!fg4IFyT`7*#quDY%&gz@TjuKoj3X4jXXm- zIOvr;;yhTw{+E1Wrv!U@Fx-xsMOVHN5zW9D*)VMWk(|cUlq6^hyW;#A&N$pv4$opQ zV|i*TtEq^QNLD}z+OgIQ#9cg(0E-{#$Im$1E6X|WxgZttyqEjNqrYzBy)}wqSJyzJ z6DBYmKKGjLGZG8LMo~W z$-QdeXqS%*>sqRBGA2r|?kbP-=pVb%<!F`*YY+?0T3)MhOdmTASACwQLrw-hVz+l*?uH2& zb~Tst5fl$L+gST#O>f@;;gIQ;UJ>_vD^XCVRh}Svwl^U!kFapn|D!c5TNfVmZ=%jv zM16y%ylGbSi?~NwhpUO&c|r+*%De(CA$=EbyvW;pw0VA(bF272FZ%^^J#X(?#*UJ zh%|B8R&E$zUAN~DuCLrS_U=|GK9|ho(T!9Di{dyP_9C;quY&~|JiRPsLJ|{s?8_C? z!G-FoYE>;Tg9?r-ICBR^-evnPVCZ}mut^9W|7*Wn{*&XVz-4Bv-FQ2Oj-chDy7lUw z2)-w0_Or=Ad!UI^qmF9Js$Gx@qNBrPLU^lrdmhTp-nKZX{GukQx_?2_HDB?^9=n!N5YITGc z=K?7GsSX5}L4|wpSVIn_Ix_z*-joMiR*uoofU%f#2uMDe_Dl}}05u{z_G@;J*VqiWmjEwg> zcmLD8!TdPktsLZH)=rqErgubDi$U6fRxi`zLz@5uTWUx13F)vJK>qdi6y71}wAv37 z0ev&frK0e<`Qg#82-9&HZXaVAY>B1^;VvQbo4@nBcRVL@&|xF|dCUk-D{n|tFM3b| z@Qw$LNB1-%sM>hbCy=t)ET#z)bDfnOnXW^3{~plXZQHC#Ttcg@RpwvUP>lnnlxi;) zQkg_vjQ$FHRi#}pL?Zg1*=3!CWz3j9OIAaZaKl*g+V6cxE?~IG!?fB&HeO0`FHS72 ztVLBL`XPSvjmn~FjIFp*c?!yD>Z~tn<1T9BFLi0vUdP{GEx^S91@T;uZ%R>klTt@e z+kHCuvGaxfE9H3EaK}wi7`2RsQ(o-`V_p$X;Ye|R=Em;9N5|)wb6rAP@2h$@SImLc zSpIv)Y~;>#?B3f&?-_Xnx(`EED>yRmjPA=Y`NaJ>gxuUUu`bfYl@a6F6Z{CHxfNWL z8&zHwCJb7|*z7?gpUrWf74QwwS%pkxBd)K5W|3n>>(VBhN37o^m~Lc@sVTeZdZ6lc zw-scSQ&U&|MU&r~_-PsM>VtpZ-xFPsuh)OGa41OqLxFXkiwZlnV4n;pIGGqjgm-+f zxxH9rc&vo^7ZcDM{9Hcb`S*Vw|9AjON@)4BD&_us(Q$Cj=e_LD^Sd4Lz^2{-M`}O9 z^WArGMsXDWp>DZa9E0Dw?)LrK@&z;=(Kz}q%8;Gmf29nW7+C)2f@n%}Du$#SvHOGa z9Fz(cq(`9=F6A=WOViUP1s>AqeV_YM=kq-Vf*^5{sIsF}^w~m55LH|N08!TqakfR* z_MYrEx0A!!kxhzcbDm!94%z4XN$LA+<0{sdv4sJ%y8mj!qeGI}-|kO2nfcO{=J$vu z7&3a5q>T$lH6wOM$x`n@O_jIg!#|VRC)F(NNjkUpqir-}t!7KF&xZ|Ndz?#UDSi-f zVDq{}SHR*t#vp_VK}Z^74>2l!L;Sq$pe*#yA_b8#@2|IwqbQBH3+sU0sVm-%q)n3B z7y3WeS4LcmJ3rlDU(XMY^od(Mz8`0|4}Z=zWrk0?A3B1@Bv+hwEMkCf1MtxTQUG_r zSvd|S3@D1v6P`4I{WViSB`dWOUjjDx0XAtj@YDg#bM!UKU5^8R(*~3pvl^Gblq{yq zt4s8b_I$6uw8jiKle182p1EJg&N7t~dqu&>A_ae%H+|<#; zMU+xH(YkgWwoE_m#~RbJ8l)L+u}BwcNiJH1G&fni#QgqkYM^)ZUl(DYNQ0;S^*=E6Bg3>7ah^b%B&CdAc7JDVbj}`B#_$^bZezbP6xY~IL{ z(1XLyhm#r&l%I)1(+wAHFXr=($$R8k?lKYu9GsvACgq<72n=>-fI|c9DT6V=8 zGoC#=TR$X4Q`Y2=h?&XO#D-%}(mI4Ox4H%}`I1b zK^VGf(pCdcJ8lI{hzOKFr+7vOu6QcZ#Q{_DZ~{hsDvAddbK5eN1PWOT3dmTVC)?md z8mI8sgnsHCE05+KU^NjpHLBG-PlPfF^uoozHjaWo7ZnQ<;{0&5FSkWN35j_u4fzQM z663#%bVDl;&c+MHImXd*qr6UVNyh`9rA}Nn)gWtzG6jNU#N9x-EIl&CHc81D_Q`^Q z#Y~Agtp_1?5NCmP7CZYW9=G|L1;mSafmQh6k`U&DZ|c+-%A^ID`w3NOS->juBG8Oj zdO^|=*or&YidmuNbZpa8*uvWubWp#bM zwqrR-Erm^L6OAe&OlGEHFI6Mrt6GdMpc5LPtMWl1gobJv7=zo6{njX_ z9$J1D?=);gTE8XO6Mf|P_8jxXBmdqn9j7%cmB9sCQEG%eu&{#_%S4Ho5h%SC0`^AGq9x393-L%i?+EMQa2Okkz1 zdV!d2l7~f;B0pL9$yg>MRjCKT7FkQpSuaA5twveP39EDK+ka#l(;LkuCXaN9F*7}6 zcltk>hhzVhG`cR4=dPN87U^wlNnT8@5}OEK46FN#2A_%*yv=U*Do?0g2*O(C*#|Mq zzvW;3IC<8vCLoO2WY}J(9F3enqqJ+s{~=hC!Z?$DT$9Dejx;Rti>ETu^LxswkiV`5 zGN&P+Mg>PKO*(%7vNH59s&8f=#J?A+Fp{$%3-0ix_-cl|8*Hem@5o8iVSgCT@SCO# zlvP67UL2fWNOL*TAR3ddvQ(vuFjXR733U8>$OXkQItP5S_)q7Gpn=b))yoUC`E zZxbHkyA0gzaO#Mpru{>A9C}nCK|UmhgUEi<#>vuq5OlAwEgsSd=Bml*KT3>zasW0| zJ!^-<)>wW(jk-T^Z|1`SE>99L-w1eVE=x%857cd@Cy4fWOeLw@VGLQX&wMmxYYuBx z0j{q8bQsl)A3L{^eoE(q(rNH+JQfE>Jdj~F%Yfiml+SJN4VK97N^B0Db*2Rk|5%w;RC*W%s$@sMEp8Q%YQE z>aoG3-@{ns2HcI)x4>!|&0XUR16K4@Na~(BT_jf~n`dbLnnm(h?1QF|_;+22V?Gn? z8Y6@`)?c$69Ul=CrHDUr+9tbKS7=TYqzFfyh3uspQs}6qb{sYxk{C#*nn0suRoZF$V^9xw6ouWQZmw~?HND^R5(zeEEryyDi1Fq5WT~Y=~~`OCyTqmm1`%b_j=EaM0HmvtYbq$#T+HtwLY zfRZRm3sR`Uaq5oPeT>7Jrt_D^#;~lX*=-&%%aRk@22)bRViN6mB2Jh2Z)2Uy@vyRO zfd2T8BIVV@{*u`Y6y}T?L(p^@)iIiK|@ZT5~75SwadS zO&tP+a`2}~(f=y@qg{qv#Pf&^Y&02(ppCc)%aGM~CmSmh}~+JecOKV_D8&$hu1VGvUjlRwXpgx>ON{{+co$_eIsU=+Fv(7V|wgo_Nq5|;^dw(EmyDg zC)DL~LMG#}P^$pq57hsLsXvn27^!mn~;6b(;*|-g;+{5r7Pb7(;+MM6+Xr|RV3|lN2Sz)w)3VDN6_58 zD4FMsEYri$`=gnVyUfOB{Hk8(Z?2Uf($in%C#?kgL^9~KdvZH@M{jX2>xK<2$ZqIC zMjfh4b?T~Q)1?FZAJOg&`k9U@JCm2=W#Y@wygB*a&0sHt=Y!9)~ z?8qE?oKj9h(wpu+oK*K+VQ1{?UJ@Tx>~AZ3irFhj1;T|RJ2+uTJGX5EW4`0|-r&)$ z;aDM1i(Lt-&-Z80WR7NhU+K$#=9d1OlwtqhNEs#;cEM4!<=W~#k`fN&`1wS4=z4y;yT&8Fc;@T#9*uuaS$`Ib*yNpzJD zVn5QYKQR6L`Vjm`wOz>lu_&denzMgbDUJLGRFs>9Hhy-d`F7IeCk_2<%=?jGNwvJB zMY~D2-e#GTs?mF^n&C~w1NMHuBCM&aCEeod{egWQsPvzl+xq{>xg7@l2Mqp)wqE(I zqzp8Wg-^FQ1O4-8n{3JK>+xzYT;yYegaC~5s~&F*I((-`=C^tQ`1ZxO#8;}vtB7dx z{o`XMbY>^K8EH9#`z{g)F=;0rpL+y0qZdAafN|Gjwtr(bIKRmx{;C$tAam_^BT~Tu zvUbc5(nSc3GLZ}qZ_s{uDwsmZzia=o_JwG(^ z;$dSPI~X24(p@tVWCa2LAh?* z6QTadIyGIw@uS+nK2NRE{V6uvbRNl%=g^+vvkngCZ<&-+Ob)ZU_~S*$rdNjE&ce`b z7%8`W3+_IY4DMhT#^xJA5dFN_8=Hz=$Sb~B;yJ~>cK|dG!L`I+-Y&NUkAA+*-Wq7X zN=;MOpTe;pKZy}~IDe_2v9Aro4`xu?|ILjWBd@pXP})D9c5L_DkMZ{@B$CVi1?#KH z1>AQ=`vg(g)nc%m@QQ;4<#5SJ`L}iFN z5IL3nNbSBEA}(}HD;rX+_KRDu6MNxFB8w>cr@St19~pxDxqk_PwY$x$u6W}#kB?kT z3kV>XK8P;jpbzPrPt*CafX4))BPYs)A?87#>%0x_iebps=45+L8Xc0tdkO3mwPDwy zx5`HGKZIlHD80}|wWuk_cK{@9E-9@Pj+~KAs2ICAAfU<_ULIStbAw|J}PB$RiPwss_X+DYQP5{=() znz3-@=HI6K;t-i|N~(!gA`q#eq4ZGjeY-kis6+|i^|C1Q2IP3v=-7J+=h*+!#p6~K z?7zSJ;KH~vP2DurQ20v8+OB=sR4RMCu0UtS(e~TkZde_>LZYLnteMCx--n2qjwNhv zP4cz?qX-B=u4|H}k7^gw?&5-Ws)<6*{8XgmZOSm?aLlN=@jNu`z@TKDiF@IJGyX%t zn_Pz;EI>%x9ogGQ22}(WY5Gq4U5dB{IxC=76mNOnsCCjDlk6TA6+o5&NVotIsw=dx zxNe@(ZPJyI@Hcc#WS3PcI??km-C>n3_aP5PFSW0lZXb?u7~Efv^AM2O-9tb-({>2$!Pj7*Zl2W5eu_)+d_!) z0G{Po&Hpz;h&;?)gAK-lkSx2%66$ER`KHxEbCF_vwwf&!(ug*CI~TN;4S8`q^Y5*2 z8BQkp(lIs3y+*3!rtm=rU%6wKr{BGc%M51gV^kD;zX$vvf}r(yW<+AaR8bzeDeOEh zBBth#d#yjQb^0sf^dbGr}U+nPvJjUmR9DZ0GWG4qot1W|~*v7(kMUEx>G z`-7e}N?z`*i-zAeyWk9o_{%@KLKr`+oFkfttaFt&qAjfC1wgBwKY`U26-M!-SplmA zR-2N(wIMy^-Xz+aHzz!oqNI2Z5_>G81bc(89y3jK=@!ff9piRHO;rb$_T6heiCwo~ zMynFy&KwKSd;1!igE*~46n{j;+5Ra*t#o+|VcVfMVuB+#a4hKa=`4#Wb349?If&s9 z7s@~DgEvncrEc6#DsuQFuUC+ z=K~XQdFTdTq1#t?C>YqQZ>wM*@4CK|H1#c+)uA}T6IP(;-?T{gFE>_(iD16DNE-sU ziMU>GTq@lLoND<28HZdL0u|YILnOpqN2m)op#9WWnyc7B8Mn4l^q-w{R*U0lw}1~7 zF4VYQ8KLlTl%MK%^0b$yg211eOUBzY%V`>OOv)sgPsXd^8NCv zf33XX9td~{oIwWu-t9BJ(dsT`w=P7U3krlksv#dbd+=NL7hQ43lKYqeT@JaAryHhd}OySu-UWSVs zK|QSRYJFb9?e~8PseggsGq0)a8hLDUJH+ykov8@@YUP;@ZoEA%rYtrEcV`gue}I`{ zWUU&3;Q|*n)V$^__(B)8pS<<5DY;Ylyin8QmdNQa`{&yG+Zt)6RUJ?~5;-jWYbR${ zpCI?X1s!_{IPw5ys(lnH%`A1CG(ivS?o zxMzXz${>7V@$gCq%-xjVl7RCl?-gp-tFXrouLN2om<|Zs^x;!w;s10@4jHb}E`9q> zR%ye3FHCBGOyqt;PcX+>{g=6qgYkbe_c8wte*bgs`%fFj<^PK?8lU?BWbyb7Mi6w6 zxS|{V-V*;-=o%&Nz*B~Mv|d(RcjFRZEVfP1pJwJ)vZ^FOeS>FGEXNi8nv-NhwHoVO}J=O}LxYxoR>$D|x=KlfDe$hp_ zM_%Nxm7llNt=FmF+-7=j1UF}j?|tF(e#1QUmRa3RI%bK9H?UvuLuCarHupe-sp9Q$ z=oAMq7P%REZS5gXu-#W7 zvuZvv9*`Zzr{n`hTB>U-zuZU$|D2S9*McOhRD~NHrzW?7(w~#L*gp?Au6^i$>)o97 z6eG4GG%!AiXl#&!tF~ul#M7drTf#oKHT>YW9?M7=zz3RCA@Q}Ey7wc(idOZ@EMrBA z1Q{M=>#daIz0Kv~b=1CnmQU#<21eA>J8apz?z98f#&_7OTG)kB*bm{K<3Si!dA8xf z&dR1fL)!AzPt-Xsx3p7fev!Ag@~4J&O{cm@T+&sydymnT@0ZU$^f99slAga+-2r%0 z12s21J;_}urA`K|S(>X}%EIf7QjKdZCAq~6nfAQH7?VaCA3yDjZZOA4vLiml(*6egKP{N#eiWA zSMJut8}sS+pf8cA+HX(gGa5y5k%`^uMgQDq$JDO<#V6OZuKPo=^S+C9|3(0?vf}l3qm%Sq*f;%lu!C=?ps?L(c8`}+Rq=J|of%Q&mcw`#_ zCe$48YI?ykoBT6{S9O#AFloB_=<1Ic@`+{@-z;;kN;joaB!7iTUSA4X!1f8?2h|`` zPO){Rq!P&ZEr0b9@}>8YYa{@D?g)A*byyo3KUJ21XsIpUp8~P8O!XL*UY`3G!)J0v zVMmjV5q{q=6;rrn<7@k}^1_Ydn z-S}8AFx8>%Radf6qu#m&b5?RZvtd1k4X^QX*!!+2Zc>|4#-EuUMSpft(AkHb+0k}7_U zR!}n|YT~zPU~XKl0knCPcd+=lWM|U?oPIpTe zuyB<2vE9c(aX2?0d4;z8B^*-XR6LV_`jt3(!CN+};VeWrKrEAhhKmKu6y90`aa&mk zOMP_}m~4XnWob%_cS)$2V40kRL8IF+;T=ZF*fmcX4g$W{x$`u?L5SJ$Wzn9$B@m~8 zf=rA-=_`18xgG#5NJPVd;C4m0adog3A5@nuX(Vl0MK+A$z!?@_;b|mQ8c8p|=?-5q zvUn?$#2g4$v_z3Pogosi4#-E;ufdv{&2YUCv#3(e!J+*$tg9H)j)BoU2^%7-F>wdR zu}(*yWETn;*(4W)l7Av;kcyRAf`fXA!uz&-l&}gX)rf99OV*=Q>cop*GSuQHqkXWt zjZ2|c_k|d66lRa)4kCkHk-b+srD_%=$yiMy>>+#spo4_4fK)MNjlgZyK2=%)MFZ1_ z$)`Vrk=$zG)++by!^`z;ORMM8EJT_F*EP6)b5-v!m8BsN>U&y)G{O__fI39NQ>kNk zFXUXpz`AzuETmO&o=OHx6{FWhY9K5ykaWqWbbi(aj=Y$wka!k)z5#G2{@x)qtX&Y7 zzX#rV$n-#*W+Ow3{f$*`Ozh_u5>5U}6XEW$?zEN^Mg^#z6x-?sbyjr&{c@VZ8jG&G zF&FiS7v#oKrfx@91-QNp39V4UW=#K7sqoVj9eZoS_j7M=;Em9Lfg*;jM&>2=hUQP! zPsGo2TTC};h)7T_u15Q=CXs>oU`wvo08g(}NNYiZhr8lexg=KASy`F81C=H9(Vj*t zXk8X2S&Lt-TxAO~>&nSRTBfnX*7&*iG2GS{)w>K^rX@8e);5`FRZFD(sP*-qm4mPN zMzI-&JZNAXSJp1`Nj=sUyQl#bsTT^Mq70v~SA)iX@LfdEwOCIHyytsDBPC!~#-7sd+X6W?nU%u{=0yo%s1~YbUaF9#L=@fWd;eN+4wgY>S$T1khlRLWmq0-Mvg=_q6&?rPyOB zfi9(d1q7Op)(X`(U>d_ool>t36aPBX)-`cYTp%3D1cx*ad{?8gT+jPSp9wPOEp`*~bg@Ff66LcI-FMF};#7;~h&{?3f(ZuL z8~U9&TX@{a_yD6YDSvq3K-u$*Hf1ZzTe|nu{Dv*S0G?GX!=NfL-}8CmyASjL#-4|; z_9?L5Dc(;gE5TN9{;sU^52CAK;a{LL!^dHWdvcRpXHJMhTZp@rIaGDULds`VvY;k3 zEIgBKsabQ-Cu~>&T%E!h1!$ok4?COKlZQaTX#H^km1(c8w5+VGmTsXaHxcXO8f35_ z>C+`7(cd)E5M4_`v!1vFMbW+HR~$Rfdfl2}8`6InJ`q2&V#$$kKvlFf#)vjUX( z(1rwBJ5Z(eZK(CS)8c#I$%YOyJHl-?b>nUP^7AzDHQP+^%JW=RR{eHUIWR7Dr1^xs zqj?Q9!}O12;LDa&E5RfEm#?Le38M?qWoCXn>1KDlHdV_%C{yl!mVHD=0`iC#Y>vC* zunQ^|lfD8PuLBm*3sB`r1Hx;u$YZuR2`+ps5ZM{L;=OkYaPA_;GtFA>a9OWDTb3Q! zae@U<jp88>r!@G7r6i)T4=%~;TCM?WhD+C+a&9#7evz24L=|7r1T0&+cCVR7@Fxno5JsEXjzKoV$??uR z?KM+)pDFgNl0~)!+Qp!L3e~X=c(jNw zn-!%oqLV3wY*LV(vyrNTj#9YA4-*NFK9>saG8%KkU>78kgV4Lvadx#u!O5f$We-Qf2-`~GtWXV9xC@>f>6eby-h2G z(t4y~M%59Hvp50&1ceP>hh^lC%z0;cZr%gTItxQwBl!G>adhV`#Q=kyjGnDuH&(4I zu#}9AdEvUe&1c=c0v*zP#C4IczVv9ywHV#VT34FhMD{hkppwx;Um=DRyxsY(mTfws zt|3W-9*pn8hEzApBDAo6g)r86al}`^p#|ZVU<6mVKocMNjK1fC{*R(D(|?ma|0}zj znfd=Kd#W|YVy?Ile{VWYKxJ;Z#Hw`&0FgL%uMr|w!`FHPd?^CScpBF`y?rwfw$IyJrvAE9TheGwLhkHu*m!LUP~Z6e z+>x(>t0+sVs2_+-hma1zDDC1&lz(kexShY(+?nH6=}%?OU%>e$=L#=q^!(UQ$oqbO z)URfJ9`FVhw^F$MtPBL#y&4^T<;M2#e1Eoi-3wj}wK*XnAhaB21$p2mw^ZKe_cBBG zV7)o>?6Dl6We2TkSGK-k`15CPSFEoeFRKK`E?M0r_iYe+cytu)zDDgz>9w8iSO|_C z{o%=n;cnK0&yf~i1jfEwwXU57->>m>X7X09{9Jc`Jx)A_W(lS>*3PEcYBgQ)98B2) zn~+`GysnRxi$583%ZdC{gdW``fX|_T){(?0TXyc(w%lw{H^`$8)lTWivIM7OC{j|? zG4;&1aSYdxfb4wfcJY~?ct@`iNg=$qFF(yQtI6$}H(c~8(H|2LQ7Rpm+JbIje>uaU z&=t#r(r4spP`Pts=!Y%a%AnR23j+qv?|bR#|z1SCdCB*QqJcZ%yYd& z4@_aLn7fP7&0b2#@;O3h^?*FMq4(wL`VIiAM8Daxs-H1JH$E_G=sL1$G9n@;nr-Rz zs(wr;#3*Mx7Px17m<5eWJKAxogml6iS-0wg4;h)mPO84J=$SyiJdmX^&tnQ&gO4sj zR|O%jlKokDuZ?bmW=|OMV+QsPTf~|y*agHR>V59HjD4n}t2TA#hIN|&c#zg+SZ)A_~g9&zZC3 zd{xA8SMqGZYTZs2%E{zM$!YBVXVB7WW~vRONv7GJH%6f+I>T~CKsejavoZ9J;D8jA zXz2Y|fy!ku1xvH7rP!(VOeK0sq&AG!_#lS?*P&4rsN2gew&=CjbIE9x_If6ldvPqtai~51-z(MjeN9d9HalxYFv=$3nt*IZTvWKj!Pf@DITJ?RvMG0PhoZ zHS*TE&iO7=8`~Z1T}_JGUoeDpt#oSki_1&G5X&mV%{<1&YnH0uQEE;ixD5e}ZyJXT zL;+&|yi;7bPNF}=kI7|d_358y6ehI>51$&Tqm zs_k5HuCN+*K`mjom3J8gN;;F%$vuY)3mh!QH({`9HwXZrxws+c53@gJ70bV^Z%$L8 z;9$loWwYApJ$wGP+5wDuF?&noT(pDjr<>yMKbh+@IzFe|!Tnv2xx40oaYe*!9 z*_*bm$VoMWSS%J!uByxB>r!87@4tPLQ$OTa6Ms7@yZHWYjuO6Smyt47I(7<^Sx^;I zdJ5SO;(K$jaSrO%f?@g!M=jfF$ejGBCS8Zp%fBZ!^u)}Y4rNsznkI7J2BQd;PL}=A zMmJy8Dj}Ls8#mZqaSUG4h$7votyHT_#aO+KO;ZOn#;*vcLo=K&npGRQqr-~`;WQL_ ze`MLi@mpVe(w=kA0H!nt>S(}&K{!R-QSQkp zlMovqz_6FQ@$dX?QJ`TWa!4!UTOIbwGBw8|RZcD}q1h{o|2V4k)&(N!nu+RGx@K^x)* zCJw5J)TgBXelWfYwY9MPrmfEYQGw^pY@y{w@8LeNWBAc(*SJrk)B?oHMzSFTzF7iA z9TzHP*RxFXgh$B%0Ol$pMXV|X74l{U1zeKle3SEjuD?#mAAzkJDRR9DnEKBmoG`g^ zjBfzM;Rr#CDD3e)0m$4T?M5nmb^W*i1|+}}GjGr=hm>pNsD!RS?Ytb*m68tFJB@GW z_I2Okf_@Xk+DHe8MG*vLyb}cA-Ui0A!mWQ+wAQ}!jK1*nldK9oX}tEGK|fzjQ=3zD zGOiTc+gDX&xndTAQyQ|2V3)K&b|FMeKW-bi&q|?xofMm47<^Lla#~Lm+wUXU0-9}* zz#NkO1DV`1ro3<01E?>kQj+A2>eHe*3CuWjR-}Tmo7Po|sOyXur6MXFWYGw8mlH_A zdC|VSbAp4`eG^!oPZV zo3h6(Xmxcen_Q*nEr7y(V+52?Gmo|%gz+m(4teBa z;CXC6k+j!Qh(O1x-A04-ocqYl&f6N9qv0(Z562!!d?o7$EeUScL~H=oGTW;~f@zCoL{TTWXHLj_vy&}C}XoVyqi9;qqtltVVls0+Xjp4ZM~1+h?cd=r@Y3n%$dilAKQv&C++yP@adL@r z#lof~yZC7OUf}p*nEr|l5KRI@j7o!9X^0hK?Wgmfk?Yn>$O_65J^c!^Ol)8r-Pp-$ zj)GgD-e-B`r~Abj;fR(VMbLxiH^AA=c)Ek?Rot^<2QEjzazXza`jr&{l+q_9WUNgV zB$LgDK-?8#wq;HS^kEN^coS3Y%YP?iw2^4xw1M*y#ceS-)SHa&+%oxH{bRKRYGltP zVA2CDSXS243~h|Yd1;`@s$BT*kBe~6UqFu(2MTq5S;1`AFGzY#7IbHH9wwZ85Gi5k zPO85yX&0l=0yBbYhe+WrBgUQ$zQiMdKySOqfW4I^eG0aMCKl4FDk$8}S;?V<{A8kM z!_S~NA8dQ%Pc_y(UhY2SOlpF-z&q3{T0Gvf=4l9;ZMG9OH08GTSxA7Wn1FANqGO&D z#@%VB3zj8mxk#YEj;SPA7aJ06PZhLUDpwBr)HMCZJGm%i3V=-vwk@LXUFf-eb7aOa zXRZ|7>(%RKK9m2OvsvK#Bl8UE)>MH`rfq_x`5i=Etx8dB^aT0(tYN`%~SU*_1sUW`hHuB|nN+Uz;KOFhP+wH@u z9g3f+I@vr7p3qdU?IJ=}IL^FDi1Bk_6{{{LzB_o$#-zHPj5>5qZ+g7xWHX6a)zRK8q%c{LAaQ34V%h+ z_H?NoaV?UosdXrrT_NOteJ_(lLQG^4A||3>%2FI-G_|a&`rR#NSuyrX?!w>M263}_ zqnZjb7BPu>)WBmy;^#>aiTC!T3W=e$K3`uG*Z*8uJ^9>jJUV=(UBb3qQW!`*Hz*cX zk^P~-XDp3F;&ciIu^dShGtDguFqG}fsHieb8^Fon9cU=EM&^7{u-*K3?(%^ntj^u{ z;z48JxlXrw8sF^Ww(m?H^iik<9YmVHFeY<%e{sfEZe2aUHsiTUUif5g!wFjZoxooP z#L(6m%3A_ zn?HLLz&?k*8%TX{`jVYa6Ns)GJ)C!xAf_sENwk_54UyhZsN7T;Eg>A|(jN!hblc~h z{WGmr=Hn9Hg`h*Y4($xYAVER?wn8LbwefixE^Of-32Wu%slw^pMYl@hj^>}6!>QBOtIby~fb8$2Y4uIm1@&g%F zW^`VZ)wUu!%jJE3iCLv@B^Y&22d??o|q)#)c3jBUr($UHE4Ii8v8d(33w>X>$I#FnwNsuWtL*SE5+ z$e=O+i<72`Y-P+qJ-O;Ovp+d@Ym9N%f!w5R^%Gu(i+B~~(I#jdR8fMe z3)i@|b#f~X}c&=c%lqlGj?07qaxc1zbS9Vlkx-xmwS`_zPiH-DY&4Byf7TY*K8%&H@)V-~CdMol$FLDSF{j zlIoS26_}`sP^{PT&P_bAakgdbdhE^s!>!dobeT7fVRq65@sxk7k3#}2Gi_oJ(qr~L zLA|1)lxm;$a9U^GU09;F^auO9!X`ij;$BmT@&c+_LU@JF8L;k>f+k2*-9ddgAK)H5 z#J=KVi73kbE=!t3ZHCu753twH2%15`$&WS#c5*_ZlJ1--VjN(jc>#VEwZP6C=4>i; z>1c~iL&VFjMShIS-#B7dlxI_97~BL{Gznd7wCb`iy8*T-I3`p;K$oz{!*mA#S$ zN<%UXkR031Ap6%+WWB5mT7poE)li!g6^@k9kmwO3x2+oY<;6ykhds>Tt&ku8K~ znptRKjT5_Im;$>jXq0`EE!u;%bEm7INsze6C28_eA2M!FH=NH#rjRYxKsBjk2%Foh zSkt6I;$_3Uw_h25UfD)FV{!W=#V6^~vTt>`Bt9kjZcI+%0yBdFXR$!viYFEIGfy>x zLLF0DPa;s3`U}(4&R;gXy7W<$zT3L2j}={OJfDr#7My<=1I>%MTz5S1R?!}$8kei# z+IRulGbpZ$k@61(yqYt@RTUoT{PKby^LPgalnDKkx5GoLL;>$=g&DFG$#O=gRWO|! zp!bdkc3&(0LR{QKpXdgw`{y|++XC?xuABd-27|EM(fPYWHUf{1g!(L&(5Re%36Ku3 z(ukvjMItYI9Js__ngbyVr@cy`HTLzw$42UkIsYn?ER!K250+d=+dwjMPLX8HlnUmY zN5M_&>MBacibrcEXE+2d1v1-+g2ey4!QuQic*KO zk=nJWx8Hq8riO=m8O3?I88o)->f_qBpb=nW21X)o;1}*qYqs=N6Gt#8C6(mGCW2e!MOwaC?~>oO0e@X?XqwSJHAWmbRHCW-^K8g6NFC^asv(P6cU+VO5{m0M5i% z^iA9|U)l8LVhzBAu0+eHQQq*8(9!(tS1#mhEX;81-L-%gQX`q| zGAN`d??WwOYR9LO2amsqNVF&XQ^|R9E}l9Mfn(p8Q@W{)F0ni&Zl@HDo?Ulw@9PYh z_njc_1NWhZ+aE0JKblI+NOwN-09LGj&X0^pxW^QsjxeF;qATt+{3!K*P0;nj3{><+ zeWpp`vqV-X(F;MfAQ6LhC`{?;CHi|CWGRV!?t9{*6lT>J~ zj_O9BtI z53Dh#XC1)dOS@DGQQ`Y)+&K_e)cz7OFNDP!1c)J3#kPgx%az@cqmwLSglS|cIs}*k`elPc^ehQ0TEr(K2s?KBpR;TmKX!UXI?SDB=}9jsrIAKk*UjUi=6~o1b?h z6`+DS+=MGRjLdr$WomK?^X_t6y)XCN|`TTe=Pbw z8lO6_*3}B$_@KNP${CI|lzsP&c&XvYm9H$CQzAr;@)5HH3mzlR7isEaW{Ug2oA5Rg z77_QW6)Ytci_RO6wrvmjlh2dvp2 z{a)SPwRH{_yd-56+0H)hyPHh3G7o2!=gCWmVX>X+6lF9q#ZW|Zo1X36;yc34{I;Pu zmGPE0SoV*g9A7@~@3WDg=ka$fm7OfFPe$EaeKZvZ@KFK!HUh)GKW}6wf~?sP>?<9y zz0)o(uST|lZc7JPW0%KjmiEWeG&0IO zuo1*gdg8-ALfH&ZzkUEY#1Z9yhgXwDr)t!aO4@b7_(_qqGkD0ltID+no~~ju%>&fi!I?z(_1Llcr%yg zwPH84b!vpS<=0`Kf^E^{IOSL-QlHr1?JJyaj`y_M&?XcJ^97q2OTVtUKOs5cM+b(< zPaFt`ey334ukHdy#A{Q(q$tg%Um<&sCA|hZ2Jp6m+ae}Aa?XV`_A(JVwddDT7EY$0 z1z|p}a52b|VrK~1%a1rN8oR!ma!)ScOS@!*>43aeDHA|y-VmBF{3Dbqdj~~l;5tbvn zLJ$CL@&%gZxrd$rM)O0?p8LRz2ZC9IS&<0?ZVX#gRYzw*7<@;{yrpmHPwor+jTkpM zcL>}^i|e~lrD1g&xnUq=Cur(-af%c(rGJ1)gjcCVoI!*7+yg$qV~ani$LI>NueBV5 zTXY!HU?jwsE0%rck5{bKC>Tj&3K5g%e?QAXr|DcqUybvPN2|LI!q1cG!|-y!jQ-(C zJn#6iap9Rp4>TKC|BID{^zCGsDGCiHn;0Ub!XrGIU1GUw2Krx~evzs8pop5xK7r%| zK{7EeYS%JQ9h^wvHgiyY|CCGi60elKF~*i6CiTZV(xMK=)Po-`h?3BupO zQ!+P#CcE7oB_EAa~|r^{*w)!)2Ib6I4FDk4o_o$Xd{@rd-G~A5Tg*KY%Ni{jyk#L;HU}; zMk;x)#@SsTu*OM%>C1`q_e~c0cSnkClpFbfH$i}DmZS`#`U~VYkfw{|>#0(6#jQ}! zQ|S$Am&+#&!DGIYmuh_r*ZIyREbHwxwsDk0Pq5xigqx zZ}EEJM*sO)-2QF~)hv`toHIbBU}V;_Ds-Ex8jGJZLgix4MvRu+hAm^^y+4Ki^~=w@ z8TBM|;vtmU;VD|_cjAJL(j@XPNa8KK3{7D@XmEyptu(|60A=x>4u}!@T*Hmc1wwDd zq4#FWp%{?bOE{0njVpvnU6S+}%?FdJd5esS@h>`-A^(%&-C$76{@<3HKHvXvlsNJ> zWkxwon%Ts3Uj5lJ2K6o`T|Z@lApS z>>t*^9cZX0XV_f;L>-NU_kf_9o+E;4NW&ewVjwEQs07XwR%&>`tpoCnrS$gouJJQ- z7)<|ux#nUx7^aO{I_(7hXKq`KM+f%eoA5kIe^PrVcZ)utb-F%*DyQDNg`Wz4udNiY zp&;JC#x;%9K_uPZ>{)DI>VP#S&YyAiu#WokT}?(S6P}Y+!UYJoj31>1U0G>HD1r4` zX$y(ZN8-RMyvHt!ra+lCiT0KbwAq*%%aSU@>)6yI^RUnv@d_;WJ@6gzxx{EOU9NH1 zYta0_8G6D*bel%Sno*Uv`Q76S*J@N7c&$xx#T{a@>o27Sgc}*C-Ib*#T)V^e`NlfvnS>D}{FE8D|bPvAu9B1FUp|4!&II@Td_HH6VU zt5pwJYz%`Q$F;1y`(V^6`gnq)qu={?T^UScmK{4!b+)A}&ubW&Y5G*gT5R7xKEfYy zb|g9+YCV2@H26y%dv?4d=tRq29A@$tu&Z1XI!{ZBCVJekj@t#6@+uiqNqZsjgpaVM zPXw;4ST%_9@`2?$rQSXagF7bwLmKGcxB`lEM_Gc^LxmvV)}m10qzL$V)8T#@y!3g> zTCM;6VPt^vl4SZJAjwpz3LI~m=C+hJ9h=D+lS%ZueW2yqa>K1TQ*3FdJ zRXUM~`lLWw&EP*NlI!S-@nXGAh!*h@P-Jw6&xWb$urVNFTkR7ZE*T_sV?|xMf+XT8 ztP^VE!ZL?lv5>C>6mR6RtUA$O%-+pTtI)RdCmoTJd9gm@IAsXF1m4u@I{0k>7rYy< zdgyW6s7;2Ya>ZesOU8dxMAeEZGy8u`XaeI0>{?veStrvGQpJh-J3)l}3b>JXj7U^`>9UzbwZn4L!}o zA{^CS*6={`ov@LJE#zsM8yVtmp(7GIgqngEsxUk`mpN_#ex=$8~Y1fcAt(dD2~#g@lY&(ryh%Iyt0}9n^UX@3|Rw zowpV=t$2(7Y~?zNT%5yX)cjSk>oPFmv+FGEZ)Tf<>Fl|?0IFJ2VR-+#ZR)9XZkOHT zwa!7bEpKP;$quIoRf)0W7Bi^k!8%Ja=5sUiOSwq!BX1 zNAN(gVe<3Qg!&|~!9Cy?2FV_&FO9%*g)X5z!BOBcZ;JX0_EEF=ngE#?kQLMoMMILX1&{i7#@eUkkL% zGIS4UvQ?v3{h_(vy%Lk%&SyS)mVUaHj6Z)FmWy`fP?3`0X#@LABi7EO?W+=NpI^Jj z;7n2R5AmuepC9n$R!4G^{Jw@yP%n7htlotQDsD^yc&Y+AsE!#=iCpP~;qKFTTSinl z+6zKdissK5R1MjAe;J)U=J%{sv6@%_X=OImEx_PieTr$W;J>b}cV4*;)#TzkIjBji zrkE6M-ww%@38BHi8Gi6bg>}}hdCeT32rKfS{76$bJ0ddF&qmEl7TL}7uCgCIwmaS7 z?e#9+gtbDoGaDBh57IVJ53|Zf;|4Gye2=k8W{uRW-0>swf0JxrWS5s@oA5{H7smYQ z6{k!HAdQZug?N^Ut`ioAkj~h)c+c8s6j)>OL$9ttrZg5_+kAUgg(HP}>e{kJ)Rd3Y z8QveH5wzQ0{>jj+G*8?(h2~y-zGKR?u)nrt7VnJ*lyGp!G-1ol7-R{X=_rl zXlA49G-x&evmCb+?&#rt;)N>bS~E+y*vw`Z#_aKv?~c!#D~8wtI2X^)8QZOq9d|1(tb&ccn*<039Tu;y1-Ur%ZK{AJ zznw&!th);4BtK53_?!a4+LS6i4WR|j`QkFnAK_)ORzynRa=VUH zo8#;fQsw2>OaY)NO#R7noZ3XZr|nyhO+-*fs}1l922I0aM3l3uaG ze4$C|P1Z|PP;gX2^vv!N|KG!B(>Mi_IFo^340{xQ^d5BBsbLlD#!#>BQU7=4E-X2Z zzsKgXiD@tNK20?PhRLckA&MG(0gvYj41lnc44o)%KrhF|dajLNTpq(!?jLnyG)Hc& zw$R{abzmjmZK~hUOt#_zmD>HJ=)T$eWV0476lSV^v=PdNHQRS$T5oj+( zS&!xJ6_C>HO1vSN)5ILJF`Vfs4ZW8$PD-HC(r->+yfx; z%FplXS7mB@(}&By$d#Qr1V`#W!|W*M5nNR1dQ37%_Dd_mCyT^HTLQU?!46i3<0_Te zN2q*Wx>P&Lr}d$OFW?1n?RLGGG$Ba`+D2tC%$3%a_%v~Zp=u1uIdqWw$LiOgWHWkT z{~nPBnBoCbniYhEpfzMx&&#CXyhIyr8gOMQB*}&N8hs`$Hd@*>&)>b!AzcN3u9DyZ z?Z65(ueZae)12v_XtXnee;z+Z@-Gu@*OmXA%*G(nk|u?xl=u3}Tce~$(ehybn6kI1 zT8ptu*T&zn*Aj(nrc9zz%Nw12@Ey$H&_5ckzd3QQ$P;!y73uObiex7 zr>s{5BZZjVKaFl@f6f(qX3oIN$jN=1Ru{4adNQ|;2yk!b{X)MAHw{@dSWQHyvtgE2 z(Ld3G!*U7KIg+@zT&sRwFX;`?lo)-EckV^L;stIB0-io7vKviDR4p0Xcu|k71f~?I zx(FK?lJ4W;jP0pMK>>AJCg$Q6w*g2VoN};%jEoL?J!f2K?<<4=BRCBf{4)ef?O%dxwr);ijh3*sr*tTMx#gfa($M!F*< za{=a!Cy3u=hBYO_Ti8u8i(BPPRzd5}%a7!##v&B7#LrZ)u$TuUP=LN%?6(O=wx9ID z=K(D427CN<0UUe>0~1}FN%Mi0YMW71qJs1UThitx>$Fa5_-e9PX>5XofI;pZO`}2M zMOZLfI@q1KsH~mvMy!>63)A}J-%`697s;W1J-S#z$)F!i(gYJMVy@Z{s#zj8S>S+! z+JrMg#u({+dH zc?~2fUI;}pAjNcxUN!MVXRq&{5s7LRQiIgD2J_zLs|xqKr=I%1^7k8-n8A}*j{P2$ zfzGBE=@4|9Kab7FVH3qDzataQW{KwavR(RzzC?MT2j=-0VQyCtxaJWKWjYli;tfG} z9W%#H5<~n}2a_ApyK?(2L9q^Wu?#L5sQDNpz`TwUwL%MXy6}otr{w_N3+F z<(?nVe3`(*LLSkX77o$C`kjU&gm3*A`u(nwxx}%nq}}hURuQ+h5%(3CeT$B%Z+BNh zF^J!m8@Jc|s$6NMfbjrZEWcM-_NIx&q#Ep~6CGjcn!lV@8kLi+rAa4y3FV_n!r91T zD=JZj<oj z&Jv7utTPU5S?DIg%W)|;sj((lX*9721g=Wka}qR_C#%evQ|~o9Aa9O9miX$ z$=^sC((;dZx12nraC97ZbdnIe{g_BNeGO--G-|W2Sl?r*zS$t`aI{(5Fqvs4+*&5F z)Wk=?%aWd|Pbd2Y@x8464yrk3H;q$*YMxSL{m)uC{C>EOsr!hM{Q!`95f&ar(&=R* z%ZMgmW^+r$R*F(FU1;fwi15$Kd%kg*kbIYSKEn@dj1LGtqNb^QquHEqzqdnIvF3*w zAj{5#97~t{Xs0{o5>!$BiSc`D@`|A-nJe3g<%CUVoErZq1i(NGLbHHp=s^zKm4Uc& z=ern%^Zb10O#Y;m(p)MQ(Nmby$S$GK5Vem26cDFUFC)#Oh5>imvi z;?1gx1xDJAc!)dBc!U zgAZ067t|GHlp@sUyi_ca07`UgZP2siX33U8imIjbm!z}KLTgl0)VWp)@>8JqTgqbh zfcyg8mqur|3Kr!PeO^!PStn>QtCtoZM}O+Eorb!5^@AK;Z`B)fB|_~@-h$`}U2D48 zMxEo#vw1vI!27_Hc|~lB&mbyh*J|iwZhz{sAw>6CRyRx5l z5srY1ilP{|`iPC*x34`QwF5Kd*}hj7J_b%CUl^68X6mCAcL`M=uQ-jjxzHtN6-#?) zgR!3t6oBZ~TcB7Gp;(`+!PZ9<4?7ep*BeCZD2_Y1t>z7{j?5EzySoHUc&*D@46Hc( zJudVudQOypSMXx^GG_(`j^4+-E)Z-AuC<<OY0H)6hZ{0~$A$Py^H`uMmEh<-!jJn@w=~TQ$ z^Wy~&#i=@Mqn(65vwPzPXdPL^q~Q0oneS?lc=~8^bR_k~JvbNsGR1ob8*k;~Z=B7Y z7&~yVoh^=Y;B~-^sqf1?qVc3YKG2aw0J(LzhSQ(De>KwAvf)Cb)#WuU^k2h=cAq~$ z4#Gp@jq~ zdMZoa$Yiah7t~rQlo6r4g^NExj{grS4flhTu5tTev3=azeJ-5*bY|==j95QNX~(v$ zB5c9dOy$7F^Czy)PbU9xmThSpCne2&z-0mkD50zI6>0Q6vp;>${^|Z zkJBzdsxRWmg%DnZi@Q-XK!w9q*va|4yYKOp9)m_`;2Du)hebmnN71jp(|WYouO6V|JF z@zJO5&@sPAM?aPUm2r6Sa*I|642lJ&K-Bu`-xM!^KiDP=Ug!v7_Dp%BWsSH-QAQ7x z)Pr*-w8YH%@(EFs2;)JO>?mmpVSJ()KIsHoV+$gGWa9uRK6&g~lZKY5gN<1-n)%jP zQ8C_}K7M+PRz=7K{R-GLsA z=!6K`EWqa7<_ovU5{}p54&78YWz6M~;2Z{C@0<3;Vhk_1z7mVLi%hS*mLG|Dw8v~3 zods+9QQC@d*jz_%BMb%JPaLtkqF7L@;_IDmt>+wXxC7p{X3VLcPr43z;B?%?y12|- z)Gv*JWei~Jbm*Y203c5w)vE+s_9QavMq&3$*HM8uiKxr}aKIjfBe4h+XF}?7PVf;Hou`PrQWZ_4De*+}>nA{(?w_c#~Sg zq!XLQiqrXtq+f$}`E4Rgq$Gc)e{v37=b)Vu7-| zbk%lAN&cm~nbFRl5BM6M?7%dyJ~gP=8B+P>Y3XulahPO3`%y*2Z9U*^Q+`9X}M_~abw zFn-f$_6o5hEbJjg!Ng6W`@aWSP33)xQ=RcdQQf(Dp1KEtGxC;n?X#I!T9IR5UKDA+ zo~<$&Pc|@AU3<wTHMGHhM@t?+`g2* z)Onxf7Bfapl>wEd!-^{6xGg6wwm3)+Byx3CNvh2T?W!8i1ak+y68BnVgIQVIN#QbQ z^dkpuh$OE3C zspOJZ3suQTCyCu~q~wxK9#D=828B*?%dq@uik*qI$+WB9@gjh@F3amhmBswoqSVLk zrX|JfKSdl`f3R_V>UUB|LGpOy;07}&HnqJ;vOx*dzNQDjXCo_DbmqPVy?4stu@b8N zsdW{95U9(V(MW0q>g-T(>G`+N3Xx_64V_tvM6aAsijN~09|sQ=QsZotxQzdDWi_TO z$k+$~^EryZaD0g+0`}NK|5m?cGMO~eOF87Af{K@V;%?I66oCo9UA6f@noNN$0WGwO zU?xq@kMG_+6mV&Qi?Yxv6>{P5{#(|VoJ)KrfEhx$&(8wuRvR>zM;UULB7$P$IeFpa zx0p|sNOotb#Tr$4_norALTLk;&7o`NAUQdr_MVZ`zy8vFdyg?izxB`y6G^$*lk4^4 zBv?;6k51{sW0$}q4bc=_PfcObi1>?mIo>RJ2EME{uGaI-#b3`#zpq1F{r^$P!L;_b zt?%Mx?`|3_D((!l!KiVbQ0(-#{RnROrk6H2F^`L$oXu8Oi*`)S8IBw1tXK$GkYfFK z%W}_wdmjZSc?XGaQnd&IuJNwc(d;BhZX3Pk`RT#$Uz)$0^(~#N1|1lkAKa~2Ae2y^sau2Podv|inWtAh>Tzn8+e~K!XX-6)%U={V%(=V`Y{#o+w#r=7 zOfC`&i`8aPBf*#iNe_p>Uo*HyGq@k5sQG8qAVy}=TJJ6+98CF+n@kpSpa|mfu$!tY zX+K;67~aF4kaJ-gzsipj%A`0rUp>+_Uq%~-im*o5k=3k(XIa{lO~)dsW~v4d#aDe+ zJLd6Lt;!(InI$)O7EAo>Ffzx3g{`u z?RYb(f>45Yinq~n_14^ARVMeC(uKb{dAvklP^U+SBKSP0CUnPDS<%={#4~Y{bauY` z$UwSsoX{5OOTqGL6RWcScyL#ogF*3^^7QCO+#Y~wljl_j=N_&=U0kaM#9QM?T~|oI zg4f{va(WU;4IoPGHQtcU2hd53Qr>`z07DQxFFX%%cjD<1|Ed!vb!gkiS&aQE#RNbz zDwx=0SR9`u-BM6~;$xw;ndYPaTZy!(Y1|e8>_2(QW)^}47xzm*mP391@784T=K9s_ zzQe@S_vZK4uULoQ(df-h0+{DjBFA;X5 zEm;i}R(?iM6*_5=DKB-;++ z!mV1ZXCmqvh0ndm+Jgl_thP(S1e$A>|GMuE)+cmpZa?*!Ya9HcMur^o93(%Q9zu#_ z0ziH_1m!Pn$2rAzT7NX%;|meLeU!Dl1pK9nt|PAuDQ0R>kQ1t%f@L+~R&L)4(67Y4 zM_|%?2c9k4l>WwyOV`U{_i*l%AwLYWk{HRb-MSlL1M{{qOKZZp)uUoA3AWH~ykzk+ zT4*b^a^^w^w*1PHQSX zaI8wJm{YGNLh3GJTq(kG=4pAV_NFxrYi%Kuu}f#H-DgTVx1Ie&lZcU%)01QRv!!uR zJ~RA=Z3~{=a6oEXa^MZ-&|gj_7BF8{3D1D*wqjnm->;n@NSGT%e^_2{359cZ1R8qA zk)2IZ1m_5eEl2(fDCr+D)x2u7ly?5OrX}cpj;T@YCtA5>m?*by;}K0f#n0zT=Al6( z)&X_fXlu=l8Sd2-R^uK~mg74Qbgl4o$xb|s?%s&_=aLy|ok;7k_;!4&=sMpTwA_sG ziaEds53foP>u_yr7_#Jy;EdKeEAGL5{4v{CvvgtYEfIMlj#XR{X%;Y~Te z`s`lV7Z$VI1`{z6dpr7byo~=jULM4End$MCHbuKL7@cK)+(FB2a+RjC#w$wodu_ed z$%Pg0ApQ0vim`O3d5;{cN*04DQc5@*{iIfuI$}!veH3M!`T@j0g&CtAC*vDzOQc3@PG>Y!O7F>y7(Lv-4 zC3d&|hh7BILKW;g8T8>(VUHjF&?1wi!%;~s=p};DFwFG=V)iV7qzUo5N77yH8zo4* zX{*%ons-Q{a?CtT-3k>BwnZU68T;%Y1L8=M6-`uK38TcFO%%{l)%9qd-$!INIX_T2C~T)8 zjtA&I@gct81is%NUPlO9zF!jCz)c$AS_ofVFhi)WZG@Q(j;==DRz}MIZ0ggt4OLN% zEUjkME9kkJUy;&j=_VKN?C;4Ze>F6Z2R=>Nif3m`F@wtnut<+ zc>mt|I(bSxQAxWJ`2IXOTk+jr55O)M8M+Z>V%V(p!cFI(1j~W)2lzcF1Eyc3;Hb#s ztpL$5#wO(I<0KR}?&&1~AU11HqYlX_V$M=sZLn7Q#T90KjmrlrW`}|_7?o*X3>Acs z69leQXoRSQi-PW0l`WKchpeArJ zvvOi~9}@VGwp_FE_VcX6^Yd}Z`?S`XMoR?yEvqQ$;u9J@9k}%D5i%pqpnTKeHW|;B zbFq~ZsScJU5cxR&}j~*_alV!lD zynYfFK5@okEY1#CwV>+{3!e97#}fyTH4sWz zFUY1Y1B}XcDCi4t&(AiNT&oamdhEUqYithA9&6Ia1oYC0-4%0+EH%Pv=2vNn4AE1U z>5T?`Wr1}X?A$kfjOJJA^|cxr+uG^HEP>UasL>3PgLo~waoV?Qn^cr1?PB{19!xRUr!wtvz15)b=#aPTHnpVO2*}X^f7B}(jbSoE%m5Gl!b5tbu-Z!qWeOqr zjg5TyCF^$)u8KI!ikLs5=KCvb?4q-njUwAl z89h)$LNWJ+`#}!0xsiREB#ZVI?Q1T}nra)SGwyA(6ok=uyvMn&`+_31Vq{88^{1005b@%m_RK-E~F6%XHv%yj{pcKGVb)Jq^z}-5t z*hjj`(lhbIzW1hazytf0AW+x+Bqj5Jd%+`2!XrfT4i>(NO1AC}aWM!;O%*R+bJ(-{ zn;gpfa=3?gt#AmReIs7`0vbu2Ms2}}+fe}1no6BpX(C*{LTzW;ARgY;P41<%JBHzx zc{s4UjT;mxH~<5dzwQ>KR2+tu>so0CB*!In@+TC6Oy^|G%h3rYIDrR}5)J%Z(w^!9 z1)!s8pX3azVCzR@)p~IW)Qykkp`eOWAdJHu%M&RK#tAj3s7O9anvo_((i|j+=L7gs#2D@jyqQS#2bH)3 zw_GC5B1MS;f0?{3=jMt_{Bs&3+#&5J7DK;>wXgS!>Uti^q%D_?ZoIc(EP&zq-~z#4 zDyB1Lx7#>qGu}52tzTR1xcSz^twTy#YX`!E1oo8bMiGdWm$(F-;6jn?1(_xG5nrrg zwk!f}VFRdQ+ykiUd=sWdcqg1_xxn4e8+}odm(Jot0-QH-k#%5(LNHC7LjDo;5e8%w zwn_ovp}#A#Gs`MGOy%AKqh3!?sSQOYH4=Z<`F@$^ft_I zIpQ)3>)bfkb`p4PtBnYduILJ7Fh5b?U+A(`rToj7?#xM6M4vr9p`KP>!j|!BQZo)@ z3D=6SRgsn4cO|n&olWL-wP#B9Rg>rW6ddRW)*1#EH6eDE;X(%|kq0N?T?NC}01iKf z==h`fD$=36tlv@F&K2M;cN4cb=+e>VLq{akDNsNixfsq4ql$TFK-Q(_zS#K(s`vx( zFtz7oj&3!>KVTU;hUxM#$Q3x`?HY%fR~J_-Da$VAe|0j7p-UXeW~IF-g@4gfOUk{5 zB~$+>PtG9RRXY(E`e9CBexg%O_0FhQ%KtUH4aRya# z^<}~wkPqEOUhRSPXV-L4G+adD3ZV~zUl@C1B8u$qNpgcghx$e#+`C&|_X>==+bZAH z>!~=ZcL>X>PaL}>I8mIa&S=)~orhEqKvqvdMLs|eW(xa8yZ7jh7 zxMY|bUSeuQAy0KwtK?Bv8hw)S15;?=0QYSLO!Ci0tq1} ztL##2;IINiK{C4b%iN?XI7|}9kZ@eI!cF1^qQj3>=0>HV0du&-@=*^2nZHh6-3P;f z7atl-VTdA?{Gr6~Sm4%sgPDbR#J?!;@V5wqmPvCM?@V__Z5OZ^^(Rck;e?#LFIS?4 zri)m7`F|LDr&!T~b=`K@wr$(CZQI5iwr$(S9JX!Sw#_qlZf0?I5zd?a-Z0t5;M>?O`ph#F!z*B=ibsO&zh3t=WL zm?0f0(%Yr&jX6VX1G26I@bhnKh_TmZD})^@8i33pEg)Ct@?e!LU^`=L*Kj0%?fykH zW#COPjs53JXZT4&)i+yUSX&#`;W)C+;ScPC(aC zYL--e?SrW$Y2=X=2k$AWCHJl5V$JB4f_tEdN8%n~X9?7yPM|Yeh6JY3_h~^?XRUx? z6D;UHj9de)8=7-yHu|ntbY4unO8iLZxb1^nMMj3dVbIxi!kNBI_?a2CB3 z*4s6Gs~C_Zc^*94IkULZpK2d?C8IvZJ|Ky*VLR+~?&$PzczF;v%aipW`LU}PIVmvP`Yz~hXl_?9 z$sx{6OYVwFF3uNC-luz3oQhWPu+|P#9YV{MOpdEa=2ZN5EiI$8uEqNz;oOH((SUAG zsfX?;1=8sm6RS_Cz;z(CMc0-E3uvx*k&EN3yCdrqMu_0 zuj}Qc3io7ztt|LA-z$s5!uqV?76&X0g!sk15D*K}PPt%XeZayBIpCV@m#Q#4qutc> zC^9U|CCh~flS;ItAF4x@Ufa|dd>lBKgD&1%P>j?xm_r}!JmoG|8Ok_antH{jC9N20 zpvOvPLZ>M8HN{f94O=b?t3ZX@Zh5ClKLwE~#WJeOR(C;Ey0o5o8A30v(IWmxj$dC< z^aGAAtql{rEBnc?N*z=_3s~NfJ-oZ8|BBWNYhV)V_+4pWUHS{_t>mV4?E*jkiO=?rL^CwqLHq(81VOsBXyV;5Mnesm4l>$ zNR@DDKwNI)6evsvP#Cb&2IQ%s3S2LpZqtJD=lunb?(4&K#QR&}prnkZEUU=}+4d&U z2P)o3yvsTpo*!0P*ztu*d|ZSMI+Kj;o$Q@wiP0@bZ^dqkuw8GEiZ9AQx5LUbMGE)V z4S7{U5c=dT;CT8li9sC^Gm->jc92TeV_QM51z!wlwj{H&((Ib54R{^pPx$rBN6Bl$ zbk$R=_}doX5 z@yt)HUGhnL1@>{sA>XZ7hT`z1USGoxDcJhXGmxHZHJ|HKw-o^%!hkk34;#WJrLCD4 zu;V0q`@&U9gG|j$jJXVB#@$0UscvVhZAx%4@Gf!hW(TN9i;l0ju)yv7ck_yr6L|oo zqlHZXW>&1R@QnLgw}*L{R1LeWmH#`BIU$UI^Y2nP5g?P3tBuIIZv`@9a*E|Ebk1wO z)Qwc}V_lyW*Sfsh&TG)L5l^dQjMOn*@&!!gdN<}IyPuZqE`ZWe>Wf+l=42^>U?54b z&h@qv(xFF?5o@k(DXXZzndV40aKq8aNGcx*EB_Nh&+V;pDCBsK}TwjRYbWtv+Hbn zf!9cj(RcxUGpelKQX3Aq+xO1MBiQ9A@!2Y6ReSfR>x9&o%*4bX+@G^xiwoIf!e|w( zz{rjy8qz69;q`;Ale31bBxPn64E!Wz)StM1JIf&SJa#f%7~r&)m)oYX?r&TH>kXJL zOBM%H`-Y3uXOgfo)&8bc+a`2%$Xv@$5UdgT+#aOhVcgb^Yi}nUiL2{e@S;O6N0JR^S5knkMw7GH`>*Y zZ~M~xzG--8t6^k4rl)yirKY!dMEyM8D1D@lx@vpJ>o2C4k*)^zK8#)%=`FDN{Jj3d z(eV8Pc2`!Qu|x5}lB(wey)ukc=gst$4LJ))scBjxUtdju~euHICGbzPj<*n9fl9#58LCmR z1UzDviFYD7XL5AZXrgN^@7fPXFc6omW-vK)U2|^2V1Or;NMk7kg z^hF&Z?7COC_d&gKKq&3W^aGl)nURLs{x}nuZ{ocG-cAOYFO#hZf%G$^W;4u8o7i%T zuV;h)CHdVV#_4=&zj-P@g1-9x>|Y-4pch)-v9qx}0^_&hgFy398dnF=SxWTG$gSSh z%Ted~XYO{NUEQfJRIb$vHs3H86tmD2vxg8saiysawAt)duGci*5;nFCH!fwNWJ)Ud ze_By-E=av_yYhcigX74KcHmS_1k~US@Zb$j1eZr^jFlY_Z7oY;CbpJx<#Hv;pNF*VvU0MQ53> z^4K34@UJBh11iQLLm@KAQbH5b(DR`Zx-JNlkg?W!kf*4TgC8vUg?~C+@Ged49b=j` z^=P~6w{S1R96P*M?Y3lK1RDUmqT)oUpY%&Kcwn&yp?i|%^wBSBCQ$=6-}h@z!twRN zO^O&m$Q6-Gx+LZRo`T)pu4=FM?nv_?!jJf+jX z5s(WhFoe)Xn@545UoWNzj^il^ABJjEN%7!G$^83c8Axb7rhtra9qs8w?QI8XzXIAV zw)ej;^&{(xrg@{fA5`@r+XrGe;}BWL>W3fi48eC0Ceeea1sIgEdrE7wn&d@>a;QKo|JrtcsD4$M9=4rii8pvls;ktB{Sr@Qwik zMb7!x%@;_WEXpxDPBSMQ* zi5-J1q?B(BSWQGdv*(^`6)Yyq-3AY~m%If=O$Sm6r#9Q8%ZQrHv4yI4^;p9?pp9WA zkAeYu)_ik*c<|z-@gx8bt}=7eaYlz7Vh^{~(?wkS;XRm#9x$+%xW4W6<^K9&7i;?y z&iF)lvwb21zE!lv<^toA=Ml8eQLE68XgZGwj`i#f*t4J#fReR+qO>;megVEovzQ&7 zH#+b4%uz4MlRc8bfuT{$9RtT3d<}qnz5mMPlsG_r@R1eJ>I5UcAlCp( z`MeJ1bWg33e9l4ueotA!zH}g=_HGRB+zOlOvNNpXkp{6d+9_VKFnZ_cZQxRB=Ni%2<`+A+mjtcDUa@nL3)1K z<#e0qkP3?zPtK|01#MB7FOTYnU1TJr;H_g)W=!}G{qehnw-CtZG5)cKN+NzRe=rk3 zIOz74O~ABh1Ik;>zW`yImWuLqA~zSBIL~W&3Tl- zaHb2IL>p8l#7*g_9aRqhF|n>BO5~HCXy{B*KYd~!UY`WeIL|mxl5Dlt$pa@j43-7SKE_lL=aGbFk))ah~eI_&ABFaxHTvA)lAyCJ@0h4G2?y%4OuE(^B` zgATe}1ZcnJ)LLP5P0ZhbeuC~t^-#PKhzzQxLZPW2sivIoZy&x z7lmm`4aR(LwY}_vj8Tf9@vt}iEhoVlBN{wy9z9lI93tLgz_~($4ebCZ+&db^TA(>n zc?ndSl1orKM?FpT%cf(D-G`$XB_VP*>}v%d;M;x~Z%>r^MHTQNNDuTJqMq~yC2s*K zue^36g~c@@j@bAp!FPfE*i0jkP-!w$Og?PiP%MX3d4SKh&uQ@_N4jy^-U4et zl03^kLd4B6Bd^@;@|PO)y6F%3#eZUtOgzn@+3BLH3i>!u;`SUkpn&X4R|zQ+R;nAo zdRq6cFqd%CbLO3jZ10_@30P^{3aT8s-YzF|IAq)Rsm!qgl9Uy(8JGEi>EOh;1w?Ae zFbJ_DDlj72rl2$;#n6VL5&CeD{3$R6Q4)iy8C@n!O(>Z+7!W{H0bz_miZL2ZCV&Lz zXlPZDci2l0vdmiRDo}!+ksYh;ZpvsMc?xjdr{j1P5;9bX6eSw&O@MSTn8Rs~Sh{4iHU)K1SCw$864lmoRu3lnDL!Oe!e2Z^nX6&TiQ8~Ct;jVIKm^vZqAPtQ zcJ6M1IN(J&JRif<8MMMP;QZJVsB%@p$ScVVVA5F%PWz|}lHRDi@q%3<)2PQ9wiZt}f z9H9H4uy<77m7I4VbYBh$tlB|nFp2V8k2kgowOR1eCD%0rGkjSYM5DJ0!=M6LZu&t4 zGVclFi(8q73C^DD{dM0aP0t4fPZ1O2&kMcKHj zCI*CUd;Q<}AR{@dmI8wu{LV^1xDz*3s1Xpuv_oD1UurWW-8g0IBo4b6q{TPS)9 zJ>b_kqfHyMZY{vf%+r60+0Y5#t6@5=+ePn0JR``30BrORIw>T~o<;LX(u)xJpSM88G`Li^J$ z#>@v^s{2a5Ghi9CaieUxoJAcEp6y*I{rD;JMehiUAi$L+6zD7P$&kVKqtN0j z4dM6v`+yj2<5Qg%tgpzcve4xD7TD5wVJNFf82@J5CyU* z{P)N@K+#y+?MaqO%MG74o%eIjew6?ggT_U4FQl~ltq8Pu{YU1R8E$^vI5Md2hH7{| zj2#`(B8{jXJ++&0zn$*lXsmd-UV%Bd0+rS6r84sT(JJto5My z2R%is2C6pf-yj#vAU(VniL}ML$V@bSi+fSXg_Wuy%+`r;HvO&CusiBj82UALkRyyY z18ojL8>qnawq}HEUgDtuL2BMjxy^Gp&oao=r%XphP#z^%D_;u^N+SYuJ{|#7>eH{ zFBpNK5fG_f3At6ouFV7{ z26M@X_5zr?i#mk4F4iDaSk7>�Bn(A>~60VRrpHsOr6bY$~&m8jKbns%hPmN9Jk? zh82dLg4BdY~v2MFV?945eD>nu2{)g)g*8dK$#K8W)^o`wE?X{O} z&9mxn;8XEDI)Hpw+I9n;qv)%bYC>STz z;uL2vGw)7mIC(@{puB?ncm(!3GSELl9y3I@&!=_D(HoDe(7?A($NadYlN>$2PKqN8 z*ZDoapAWB-vvHjai++BemX9CU*R<&?R$E_G{+xzk*PCN6{xWy4gyAr4cqEM*s74Z$ z)Z=0+{?XUGaEC`4TR$etWAo?3q07;B38}`G>cd9 zE@9C~7F}J>w?%*G930&J0Z+au^spH@5ST~1l3ahTl#P!_3>2{t8mSP5B$&!&MXtm| zh-hr_0M~}gF?Eq5AvmNEbQCYso2`WHxhU__clHc<5{(C=t<1=%SeQ}49HE&G)))6@ z3^LA}X0F<#G9X88k<`As7BJMsOXV49UqDcDI0Pf0;YVBnOvU6 zoFg)c0Z}P-SUG>cYN^J^Z-junp^utyAkmn06N&_%=NCuj!pjzlS&{#+7MyFC2HQ8p z?UYcF=R*RXvrR;-Xys_)Bs1UaKALZrjvk%1rB_pbg!++2!psR5o9R4TaE)!O8!#9l zgH5dVrP)L$5G|XC(p|7WB|6wiF|=WLlg@Mq#a`%TN>yY8}+Xu|N!5E)I{}Ez*|_*o+>qd+<@`#K z5J?oW+Xq3$HZoW07C8~2Rp-?loaoOp=t?>EikXzak^E{2khlxiMEavhwa?W#V&Ryn z1!3$y7BGF}vB<0a3Oq*FIpie2)u~d1|%O|%=pOX$}P*s$kW%{H4-kw`m(kMu4|QQU<#T@XJs0; zhA2-4#uwv7f+b7$($E{`j6Kh=&(M%4#SC9LuIb*b5Z{uyEj6>)ttH+RS@}ilGVNzc zk|i^bWF%GWBoy6iA{Ce-3hUp;@J#Q5xEwX{Av1g^wP_A>qLGOI;>O#t%W|}z-FZ>1 zsvWC0p z&#WxR#BAsS#F1O6L5^{`Tt$RS*|b-?i0C(!F0e^P>K8I+B;^(fs#)e9*O046*{5`N z?88e*5>R=@N2tW{cvHnHUFNy@S;T@Sk8sIAxnZ7u<{t|=mpuWdwS zT6r+E2E0!JSD|jsd(c2D`iJrB*MH-10txAX5JiQxPvcK=^+HRBe?RJ{?zmhvzUg-D zNN^DvO?NW$AN%yVKaYMh$}d5^sxZ7{JX3*aO3+akl>)4R(Xqm5YaLBq9*PrWgPHkyPxN=XItx(h> zXdu>jgzk?J%aAwfu0>jcKLfx=Zk3pOUeg&CCrn{qrV+Nb{wgPPwQr*GUkuVfD8%%m zLP2MxG_d^wF`kF)Pk?5oKZ^j zeql}!VtAn-TWJ(6p^fYGZ_G<5X2-mLZ6qsZRYRkLGEw%`s;q}#6pp2Do(WdSyRl`a zueIuVX*JJf$Eos$9)Cn#;%5pNw~JNBHn;_Yv&Wdt^OTT#*XOg9P6L3fDZ@1T+cwoK zfW|VSMdsQ^3|)tJ)UOg^OM*p!MWtL51hF7RPh@%V#HC7T?1dAfCo39M_}c4lF0s35 zQ-IRE0fchdEuU6uG9{gxCOb_c7Z)wmdy-G0dvjJy0Wk2jpvZlaYPnQ^rtVZRS5vrq zoWK>SuI^KKdm0ASU*2kGLp%Cf0yoE`4N_%oNKsuOCY>;$aGgS8Q#-|~P+C~1OVn}x zI$J5w9aD5SEmtV;1*vMu?J;ugE}wa#YHh7-s3!o;7w6vxOXW8Y*ig$4Q6A4r)ee6? zhNcA7f?D6}wDfJSx4DUP(1S3k*X$bz6m+>~pI<@U_{hJzs-n#!|FIUSti!wT)S7ypD)9emis`IEc)6su z5HFOnw6#Birq1EK6ive;w&_?9(KV^V7V$#zpK27fkXrUrnopnmY^0CsHmErHFi_cv zKxy8`;OQ!twDS~WRlq@qL(z}gEpVf?xlzvF&m%X_LK@0wOXNJ5g1?xYr5h#yT0T4- zC+Pj2fRP*BPt!Gz1mS{!>fIr3CiuMOD`XK{(dq|J#zW&%@~m+)f1mcH(=P>*AaRZJ zsa2(y0#MvQVxqMQ+(_j(jR?W9?m3c#&t^2xNp2a=azP#Ncj{gf*b5P1qruNsqt-eM zuSUTcLr&3~+}vt_Nbxol?j!6=f7UHAQ@W5%8eKgD>Og#HuVWY*XAy75K}ZNa?X#c+ zM7H$I(_H_iz=s>g**dm50}FMu);ov4EU?mtUp{@F6StvtrTbqCnAz-u^GwY{lyw%fdS3r!hT*BL^Ct|x_q9UHuaQ}O;@D$vK1 z6c7cfK{0R5!8@sYMOEeOvx#IP zJhU%dOtc47h*|+q;!W~y(c4@Qf}GbjfJhe&wME`=4DruP*flKH~nt8K0~Dx6AA2E9@5t zO$^ZLKZOal|7x6=k@0_piD|9Q*rN`_|KHpJ0EUcFProL&VGArlie?MN-tAjL$QACrQ;^*z4_=KRegdzU=QUus%@RRsh2XQueqC4r`k3Vxu z=3dV3;@y<{{r<^vfq8k^wUzcodiy8t;9y_R-@N_Z`f>c+bpFOUT1kRA0h=$y5Khre z^-jHzt5cGjZy$7yf;~T^?V^9wsaL<w`Jt}0? ztw`PDF5xvc#l2LnY+Odv4CWIW`(t`N`_QqjxqAxX3a7r2(lx{LudloRS8Bz4NU8R! zswq9XdAr96o7HMqR`G)EsB@{nSv`!xr%`qC%6vua($1kReD(x@J z=paUT_#a~ZVSi;Gi4`i-@cAwv>F7uX1!t%=g$wLD?clJClh>vc&g5YfZx?Lg*E^H( z9ed-IhKb^;RVzX==z9F_7O^N5SnT4Rz5oG1sGcT`hTbJuBMXJWbcqZD+aM~Fep;pS zBBf%3YD4cHGs$ySGsv+hRhix#0#4uIhm?>;#^BX z;$f-Jf3FW|cMeDCr`!v%Qx#3r)WP4xkIv zyrJ$}KWapd9i`a#z$43eM)V;qw@A8f3#>&_@-<-=bRn{tIq7s8N+j(tWd?-D6RwJr z^3t{zcdz+ICSJi8v;oO3^Hezk(4nXIV{B?>>`KXFL8v`nK z2U3byTvLKOt|JBAO7Z`b;eLRzY|#Zd*C&?E~^ z8a?9@wPg9{0l~ikNjNAl7dRkqSiz1DoE=ni6qsa~1Luy#-+lj%yv~Q#LR6}zGpnqX zItp+A6{b=E+67zZK%Oys|K;gGSj%e%4`QVbqLFf3R)U;nVjzL?#Vhdg^hJ9TEAX7Z zfX)WmUs?|^Gt;KziIS5W6=T2(iCHFx+j}lq9h0*fu)}JrT!4{UcykS zsoxZ*z$1+c8gO5eL4QlQ437d#ZoP${7Yz_)6x|0|z2~MwcB)>(iJn%8Cob6k0YXo* zY01Ur5!Z4?#7YYE3mIS{3T^5=*iG8x^ZPx%dvv2xI5w%lq*jSHR{&y0tJo|t&hgYw z;~F8bKpTOqohZzI^*TOx_or5=BV1}*-K%mc!d{2WIo0(0!>!SW=Vq*s;qJ30+v!r- zA?S3p@0a`QouD2dLuDWZ`0QWO(Ae3`r+_ioj&Mvo0hV&7dbMZqC?xX<|s1{hlErr{|Y32$kuWyj6^hISA?&gxY$jY5L-N(`{t5)k(x4 zfRwCNhjAyzP5~yk(WxNk2_`pZs3t2*p4b5;J|oE!RatC2Jbg^4(g%UCRT8e(U+9~R zKv-I#uZr=k(1!q^Hq^-7pem8v9hM?%no7qW{ z_F4LXgGxzS!+4$CGN?JfsZRl^d-3v+1?pBQWeaPkSFa_=LVkLfFwr{2%0?+<`FuYI z`^A;=Yqdqm42t{O$L#xXK}ms=R4JHq{EUfm(#$Rx3t=SFN2O6a{R<$pLR|_C*O5@6 zJm)Z7WY|_vo8OT`6+AyC(h+}2k)^m@zskA~@mf-&afi zIHuD%J;4g9c+#V~RN1Z8w^F+bru}1eR2l&%Z;2-DwlHDSNFYw?x%&8LrPTGvM8Nl9 zf5^Ip^B#RRzvXUUOlb_4?pq;egGI#_Q{J<8*|8qsP#ff&#I$b0svooXVsN z*2$jkdH8HisT58F!r9k;V(Cur60hCsJt2Bs^m8VfQ=%oA1mZGc9}K9sDSd;MyNU9i zx+t_DFwy7=DHAAs0bR(9@gR{tY&?uNh=AN5H^<{~cxgi3kXn7TXQ%|eUGg%GkTNV5 zVidqK{3B+(Y-QKD`zpCe*V1u4s;rVba+9_j|B2hd3LBnxs{XooxGX6ttQGg*an7rq zD&-|u_@qSS(DNklA$kS2KB<-K(m_7vOy|1=dwFnH9 z{w#XRk=RL-8wSyYa5oK?2y>`zEylnx(CVZi{=%Ym2H6)3J6?$BW^lF; z7+19?4Gssu9%Q!;?GG1FU_VBvQn`KypTD=0nX$qFXF)BT?N^jAHj_)PG8r13?s`Xeu)(T9<^A>jv%|*xN zWvdTtjy6=zcky*cyNJBf_5RA}wuU*}@KoFrV05d&u&+y+?|G6B0CIx3>s#*`utorp z6mAFB_k#St^^v5^sw6C(^mVU*6%FtHQO0sLe-Zqg>1FjvgoApu8OrrNqR6%Cgm9*6 z(dMB#eDgeFY6YdHSZxJ7!;PQ6KxMfz?=x|3a zuL;>NBY!oz;SUuH&F{85kM2X_ILP{ zVBMBm8c6YZv8qn!9mh)dP`M!oGyxw>go~z`L(K-4bBjk~`O@CMj+%}0yJ9{)v1^}h zui6AgB4KT_A2s<1AJCHl z&$qrh)Khbg{{S7V>?ZG^LWsFIIGXh+%T+bqevPA-H;CM)M;{GLY8Qej4iN?l0xsO& zMJ*7$e=X>S{LRJxrsOPjqg&dz_CKFNQDQ$W-3FFwPF#X1GXpoIwCvBo#TA?=`1}|| zUL$^XAFm+F>XmBb{vy7R+y_y<;Gu4Pu7vmUpo)Us-$P#)cFz119QvvyW`(AG={4)T z=KAR|eWSKX(QsjM<%tk!5 z@_)hCf>YD~r_k|V@otzn82&f!=Kl&EvPm?FqCi2AFl*=zf3Bxtz==q??qO?@e|xIl z7L1E;a@QfFhi%-XQ8cT$TrUK-eS0giiv2D^KSJps@a@joJMN&rzb^+*^L)4dJ!E)6 z4`AWi@jqPGRs%$^mxMTdycqwCZo;t9xzO$hJ5M;a(3RQjf7j-CNiQavGhC}@Gt6M{ z{0_8=YG>=l-u`~wt80asr4WtfyAuM-xx@*k4r|h8m1r~4$^h&bQKBZll ztC-gE|F&%@{(gOv5x9GO-mW1*N%s16Vx9&+&;6@1zPxVM#XTe2NkJNa$qABVL-ezs zqe?+bYN4MmwtiFX)cwuHUlgO*Wy@j`P|km_e?*cjk&p`J$!f!4cegC;WEGO~%U&25 zr97|nkls1soaP({F(FQ;9pdu+Z1T|V1KM<9&bV;<2+>!_9ud^3P4~LvrX9#UaW-W++>3;f4EA%+9VZ~ zflADEOl59i3}7#al#rypIs|L-U|v)S@CK)~^l1n}-U#hrp$DL3%L|vlJB0b32MK?^ zDC#E4P{DVbAV9GD`o2!vp8aJQNvU745%hf}m>U2)`JTW#16AclT*E#0AZ>Q&SCMR5 zA?FHH2>ruQmEDzQiUUHh;qaZB6kiIdw+%yU;O3=x+=`2%Tu$eq5BAyis{xJK5K{Pz>tXqeTOx9m7G@I_t6hbUA=Y ziLgzD?f&3kjtAM=9OY&4*Z&LIEbj>I>lBr8t%m*J6YduCe zk?Ivk!ieXQ{RgNouVafGMy%7(3B0K^A&`_;-B3@$$7d}C6W;wV%J-(KLD z4u#~3203=*50Y$^0L$eco^ARZa}s!FMA?dPZfVhhQzgVxQzuA$dBG;&3BjxM%kNqU zU{@jgiC~xU-W1KrG%NcaaZA(op?1@5aY(cG0Zp@SC7P+$70Md>*V2lesy*r;C@GIQ z6a#Kjr@NSIyn?bFWyUzp%My<1vhhl?W^fi@)F>WV(c&B7jgz~itg7%+uLm83V(-y7 z5kaa)yb18{oCuNrnK!~DWmWW{>ITU z$H<;q^U_6K%1E95%CuHjb`b88D@IV^9ZdU3!uh$q{QLk@dyGBmDT3v%uc#?MQSeA8 zLj0vek|n4o-t+TfkdQeuZOJHK%sgY4bTqUfSgv58jw6+ug9Nqyy>9ip%0y!$M=7I zc`&48!RfTh!!b(D~Oz+ zXHsx&>aPoT7zg6I7OdbKn8iPh^Hz*z+YNaaausW_xT3NRR4meJ9+~D63N;Lqb8IR; z5S$Fg|NL>DsCGFDhX0uD8B*&Eo7qr{C^@Sl$+hX@BsGSz*v3yRe-g8I^uPf&Y6i^V zR>V}nt3155j4C%Zr1JWuk%U=?P~i+zunwA?ZqMSp$FoYqS=jw2mY)0zd@9!AU3dpZ z&cOZX(yV5Kp7|WFRn5n?W!%}!o00l1h){dxXfa&uvMj+)GYdF%vAacy=xhVw0@_hv zc&wCs9dei;)r!w1s5#Wa0u4smuQYaC&lA+T0#vCV(-1c8qoSA`rM z6}kvxI;Z_SWB%ulev-|k zrkjACQtcF{d3Oad2MPK@ojFbY#NfW0?eJeHrLns?B^91E^ch1nX-81KqRY~+_05_n ze_&59#yUVaN7wdBreTu3Wj?V)=9k)%^@3q1Ju59#pb z=#vDGc$@aA9)JFok4cXlQ-mCn0sUhbsqGPmuPCaq_eI2V2 zZAg9BchaK|TgGhW($s^e87bbPeVf~j9w-cLL! zt=S(z63*N8+d&;@>s8)QwqH>N@0G?~EX(PKi*~cJuj>k_%Z*#6mILeDP7+>%_DlaG zl!_}4#D8L@Kpt8%-jM4QF0|)pE{K;#$)KaODQtdOD9Z6ab*WWI+miuFRV!-sOkTEf z6%NRpU;%Jw3z=g;Ti|G1{C_>s@D!5{_*8Q8aRt@zV+nhb6>8S;JgGGIC&3F+4~l}M z4NmhWUNUX;c_6kUM`jY(L%hXwegD6Lo zz;Zp{5ZXg^m&)lIB--cjdx{Qj%btO!1Fe+#RsK?WwV+KTpulA6~G`Dj3V=;S7@;7vA*VNar~L#`>CZcK_8+1HHZo(U!WSV^L3 zf!{=5)vEmAv;z~iDds;SEVe*Zo7l;P^9xADMTp@1G}Zbu0dY)6Tj3j;+G(R-d|YD@ zH%ZLrN#n*w&Q*dinp=J#Y1UK&7U#Yht9RexhkiUp_U13UWsu~Y%HaXM52g00a!zhp zlyz3s^fzpFw(ES40HUmgUN2TUZnxW;fYccaDG?$0uA5xF4|o6VVPF(p@V2}p-Yemw zWL4zj8U7b|;5E4EKb)S~{wo3q6YKw;|C!dBjJ<3_+&-m#0ycZ|1qek4OayGmDs~e@ zBO*0R(v)F)|IR)TF0@&{zG(*pL+?qYtkj^%t>jX@IA4{N!TB9JIy$m3;FCE=hxrPg z?ZxZ)ePaA~V{ZmEWr0~5$D;_sFcZ7zf?hc|vTPZehbZ zbG3_N+jn?f={vS??Bj8C5%>94pS(1XebKL#mUHC(Gfnb;;2+noy=A@f{Jkym>A?nC zpFsinIMDs<*CB^uq;@t#uUjwF7QGwpo-$Ts-kUZPQmnvG@Q+qKXBjQjKvR^@g(u#< z(`DeUjG2yl&-qCK7^k&S#|ZQwp(@3Me!3~=!YtAfI#ac=)rx5eB%)bGO5Nd&F~@2; zL0sJ8{iM!XFU}~`|F{UIu+SULlvQl5%gLsd8>P(@KrxZHk+D4$vLjZDQ9s3h7PqVFooT`D;OtYriW-cg@ zM{GK1bjn`{{M}mR8pCj|6<=vSbB9~ZCFVF=OVaG%m*sV7i2lJmSOzb7 z?9_CP6GaE-N-E82xQ;FrqE}L){>ZS5e>lyjjo46MbcfK}#f!whO za@;9eZX}C7nx*`KyF+VN!DUZt*B17GxXTM%+~^S#9r=TitDjbKNO!4$E`4lpj;G%t z*^Ngl^hzaWG715Uxhj%^AlZ^&!q(ABbsTywnruH=JcKP0ZLPNAyf}R1i70GmzD`o% zC3##pK;aTz0r&Twrq$U_K@F7=RYQ-_Ft$%?=|YPMA!@{^VtfEXFfUpd>EKFN76x)0 z#QZc9J$VR`*S69&C^xu@CnPoiO|NTYrewB5V!XJ)IGp4iB4HZu3EF}@e{lzL#|IpO zJLJeYEEOK`4L{yw5Es9(Qg(Dk6WTD>aH9i^zlR|YO3niK8oarzK zT5@&Ytkzb-Sqp#N<(Kx93A6yXP%ej-f%^gtLG9hH5G1I?V}$$lwDr$x69i*{>01waA;iM{S?O@4aeR#=NQk^ zwmcPr${{7^5;2#j2#+JiRVbLf^w2py^yPIy{q3WuxBuMUfI+7pnnfFgqlQg46>x(E zS&+f~qQAcenW8elk@W}A5%mezD^p{R${zRSYZk!WMihuwMlxa(eh=Plo z)cDR$_FVtN?`3nEyKN(gH|je~v`Q(hi#xw<^B^0u2I!WL|1@mez0iCJFC*gJeJzyF0>F1Bf?SkqIvIv%YU+{>#TOr_++vdLQ zdbv10J1_T3Z_ub6_dB?_gxqm4$VzhIK_p#w{;o859N3?vXE+$?t=_CG>Hi2rmdYH( z%{bbi>}ZobaPds>p(zU~Kl+GwdRRw8X)NfxMv{%e#7241$BhI5VeCMh1(vx5Jcbgl zo$?@&U4|rS>pFQDJ7(9ciajMbv=Lvk>xg7S)wQ=Ge<@7vUWu!Au9mi*&qrE^n zEiEO`JGR{VfLs-LzDJar zu?(`WvhXeW?@q+`@UeGx2Lny60OM6_Y%Y7BZVL~}GAVG+h5N`{mo7C#6{I||;**Vy zu%&OThs#f1dX@9Cvn`Ez(CrMp$k!5e29>;2YJ|IXSVELbE|rNbrtMraFnUG!bwWl5 zs7RGSNxjUZg=aHU>UtnPq=jf=9^lD{W$eUAXLp1#yh?f5KB3$Uixw|~`9C(m~-*p5UrZ;cq;C&+3 ze@;r01lDrvqAp}tIp$Pek5>q-S{r(S2F075thmQ^Ja6BRqxF&w6Yp?GrVX-18 z@UaFj6N`}fI8st4xj-@^MWE-wfDY@fP(5(VxLJS)jmc;JkH7$JU zW(#W#0sN*k?SR14cgW7#=U}@4nnNnbPij{z0;SgF*|!) zMI4MsUPUuMC5q$g^6I^JFCb&WYX+D+NG4CZK}WH=E1o6{?uT{krFMTU=myjVAq(d3 zapdd?+T|k2v}OrTk!eqsh*~J&h-USxyy*ed**5^c7toVXeC=xZu{v3vDU{wEUclqT1R)4H(NOXn|R3PZaH5WBkkbpw8BX(gnWfwor@ zmeCk4&l$~Ox}Z6tK;X0K(&j6j#YZXVdgtLA2kk8%fcchH>7W4bpkV7bvyXu z(mdzs_NS^XOX>6yD3{`~r7gbG46DdbRbcIXBQvH)9wRFg9j;UI^yBS1wyL~qJ}y;} zPOSS0ghVUfCF$E$W!TiyvwnYB2SGsG?{#K7OtjCP{@JF}d0mZZwvYfXT$VEOrq$F_ z_Iq*XCQl#7Fe{IAlwznAon_6EO7wP&^}lg;EDLuGFa|jP4VIsk`v3f9K>&;DN3s4V zVaf5o$$~I(GO+$%Gvxoju>1lxlR(Q2n2!P&2UwSN`c;+%6u-)H%I4v-{6LtY3yD;CeN)&GC!ePHm^^e(HVm3mWe0kN=O?$Jb))CjL)>eU2sR_qBM( zc8FQuwX6i$->&cQ9}kf^!~XhpIkp)}5!;0<7N4zR##m1+B@k8rknvE9?n3>SdI{S? z$^HKV_kQkGWO?3z+7|UOnDZ(LdOOUd!jIo8PvHmg3GQPN;QuFIK7Gs_-nEkJpOsVQ z`_IdGFT3a4oHxM~=a<~8{GWjNzyBup&Z-*=ZSMd4-slW(+Q&t`kOpX3*P0Qd20NWz za)#}p8k|Jovs#|Qk0GXFs(yd=u7Ea(;Qx3}0k%U$b#r-_2qL5=y8%OPFaj5ZFG64& zO1WCHQz9+;ohuKwaqCD$Bu~V4I>ic6K_p8K6aI`nEi|Tgs^riz2>YS=Kpm%}Tz4m> zKE!&4CgqA=!=Z{p^y8q*I*MprROM(HfN|=TOiij#L|7?>v?LZ6o0bh-PC)Z(tTQ;+ zK5|BQjf|HFYvCRu?dUU1H87CT5u%I?4Hpey*j_Ta;6@c;5 zi!%KqTsFq#KjAMRaM%u?t|G*V=9(UoH8N3*MKIlv?kT7%rKLyf>4g{NHfs; z204wdn5)z4qbZE$*$BELDJ@H;#hG$WVL;Aym8B!_4&dRYN)=*Ap+TD6?|2NA6g4*E z(go3`Bm&H~40@snyKXx`=nG{JfGkz83rM4NMc(p>@Cj$fQ#ACbA2jE39y~n&j;}4^ zyLK5Pg%{AMr%0A4Xk;dzBTL`)IcP`N?B5(PX&+vSeAq+7e2SFL0W#v-6%i;wP({8d zQ0P&1C~|t{aN7@Ov*Yd~LPNsnLJGgj!K8dCc~6l*3C#NllITD`S2^N=*z(qE3%I}v z7Y1GN3S>QQtrWPQa%1yS?ZX^{;U><1Mj&AtW#%%gA>u+}IDj%#{(6SBcv^!A2JMTg z$Rk1cviN510SbX%^?4pbDc(A(3R#@0Bz)T20Qq9khG+(wQp~f`TQa^elTb(&v@)OWKyssoqGi zfHtMT{!`nNgg1PpcaNBWauMldH;c1mt{Gf)b2iNvTOvJAHhg#{BssFb(9x|U%5WbS zt74OW_8QG5hlkvYA|K@}M<8l#hSSwc9^|mYyfJr_PyGlrYhj@j;>oFp0TN7*zkyzM zYmOk8V*4-$eE-f-Irj(B^aDtt)EO`{2I1X(Pof()+rdrUd`(0#*dLeGfaDJ({OyVr z22%-#x!hkH>}rgk8RAv>0q%06ml5-OssjACS6@Gwv+{O%#&KQ(uF-kKI~@DCe`*L( zXSG=sqr%6;-PF!oP~ni8s$0UqvlKE>U|mI}3C%+3M%=ljHSIz~bf=zs^N-c( zBQ_jUiy*gn;OujUmQ_X*pZhGX7O6W0n<#@np5NaFJD~R&k}`3ObSpB!J(z#!eIU?~ zt&2?Bi+OYZU0aD|x;i z4|bi`YBlPJ2+|$ta=WUIP`{m0Xjg%CjI_~KEQEX#b1@f-Iop<~9s*VV!O}hih_Mr} zF$~x%?Th;k^*JsfNT0pc`DDM1j$0bP4Ech#l>?1lN_m}dM!Io`6fUM6pvTv~MS%V# zts+31o8bSpSONT@xSawKwQCy{XwFl$?nE{^flUTH%MDyw4^Jr9>i$=IEeL0`s6367 z`KlzqSUDYM%4NX^?~9z8bG6oH;GMRpc5y&7{}vM9U>@=?VgL5v|rE)|1ZCpht# zdadO{b$DDolm1iHAq}HLxk;*bw3cn7=S$4WO!GyRt8|6MeagIGtJ`C zw}tW4ckvg98MU7VqZ@@^Z*4`l06(6j6UITQy`%!xDtoSkBv8RQVf~m5>s<%SUk)%u z6&K$fDUOpOedcWwXT>)z{jL&h4h0`DC!4} zeaEr_Rer~&`jXb9ZDppBF*J2Le7P?HCj&Me^#rJi$JB;(owZrOS@1e6In|@nqFV_n zL^U_*e1QGkWj9C|L;Lc36a`KIo!e%LD~@m|kiX#ySM7MzYtpkU=_598A)n84zOB{f z0+29&HtIQXxGT%4awEuN^S2nuD#K6m)hZ!vEwc!DstJiHj9(2dk;6`iK_y? zfajNAN5HQZzI8@Yf#a`xn9s=U(fbbYdL(A1dpa1~bqa&oMN_4`MRLX@A2GqBbkVg^ zgZWWD_pC-?Y^t(91F~px49qEH{$zVHLl@vqFKqY;qYHS!(e1&LQx5CNhc+lfin3m@ z0);b9`i!s&*~jbtvlVtX>FxrEWm~OvAJkT8B`Ux1PMX$izFQ2q37Q&;Al~eO#DRHz zV&A$6M)oY#yF%Ep;b6VQ8oXskdKIkpsWu0Nh1>Dd0_A(?D+{7u_m2Y+=lP&PNPm@o zzMvB7yV(UDPo_UZA z(>@jt)#5jE81l@8OOY32uh&?XUGi7@T&t*9KkWb|m+)C_t7eugz-M@`j@K@X+Qy|c zMv7DC^v1tk0sIN_H1+%l%V3E`|B@F{o2)9Vf{5?3fJQcTfx>)%W%&*{i1(rn8xpLd zqt^XL0i7ci-@)%^)`-MnWG@{ey=dZ#_Pq`WB@u_@vzaK4Qa#?i1wO4$y5az4-^J&$ zgP<+u3MhM}W@-O*O6%m0f-^#`<6)zSPP^f^1@ z|4N^;aWMQp`n=}wzl`5seg13wqU(W3{C||7@PxEqO3?am^D`1YB7t=B`bKol;WDxy za@c6OT-kKjuQvjFl;6?$;pEr&-5S|txP#{V@#^?@zWGZDVr=dEo3j5xyL~gjFueV% z&#St8GymPQQX-rGjka@GOgk{K!Aew&?QD9n#yMf3)V)2}`wu0E`;}GtkSz1yFn9NV zvVOnfaMT(3Ky;HsVMu%1FwA^LoT7;)KOS2bahor1*?+Cy)*m`;r@x2)S~FWxFl#Tq zd+q&uzdvX~){h@s_1Ri~2-kn@Ht&7+{513$-j7(uhXPbnsIAI8w6hKwqH zEYyc7qdLY27O&Yy9#j;$$rkaHN=J+(qw?QU2VmoRB$|x%wtaETmCbMvYUWSl)3<@% zAsuL9-OILgNq3v(I7bd;m~ar*Bki>qED#roF=&jNZu?IUG)d35Va>qX2f3~aC?#Sp=qZaLrIE%<6l}l!^ zRtv!+URFwt+>xfHypI!28feV?4!ho&uIMR}$PZf_5d5&h6&eX$_=z}^x}}(PMc3^! zfBP^ON~ZoalO6Lk@eg4U0uQ#+eH3GQ6ygQ$h4L4bR8rIdOFPryM=mzG)WKGFP*j;s zFi<=n5#eg{L40^aM-+XHmAVue#35Xuf0xYSXj-kY)8tg)IzO2HwFT6~M$6h5USm-A zb-yobHlHx6r`gF8G2w9n!A-O1af;UtQUd6}!E~uEjs9&nDNbYK{GC;f#`BUM=fHA5 zD+kJ4BMxB_Z0|nuJiub@&p_B1%hz zs5~sIN2eTu(P%BfNc8 z&;3rJpjRQ=;4We=R*yfn>#MSm+BJq5gEF5gX1Q_rgH0%5N2lJvf&-U^{d@=;bD5@T zE*X+_c|T!XGC^aYX30L3xZ8=)kDg(*%~udU%#PG2D5 z(-ZS$XId;i+Ow8;E#k+50`BO`_ksd%)zVu_s%)Eqh`{jL5EqF^i+3+Q#8_=4cVD2A zb!i~G`7P2t+>lQ{ESliSy3YhKdnu9%q*S*NnsD&VlRuOqBBneMyhXU(QM?sbPE(SR zjCzL?`^0xsd^hcZg0l)J<9BnMS5g*IvcgYTH_DYcXXQ9fhr%0FnWyd{9Mmo#S?ly- z;lf&Q%4gJ#wX>sVsGyhOKz6RNGBV*bIEv<`X~_@YUJn@PV)>~-@NpcYj+^oqEprNF zk9d|Gz_x2EY&lk7JLJF>&s}x8#v(t>9a73ke^GplOKYV z&$nijhA6?@w*m^SnF(Ny3Vk&T0}r!)?NHh|1&T(Dk2$*LC zmy($7HV0@J|w~Qa%RLl4w9nv##!n78! z-?1VV;2o42ulTJf_}P89mV-WXj0tN|MM)dYlOoj>s3|5fBSV}5;If&kd89iwrO^35 z-|Th(-dL|lA#U_kC@ADXIIn-ZcB}`!ga+_vv}%QjIcCfW@y=TACbw^Sj)}?z`O{!2 z&jP+Y3@vm5u-}j#$8F^|wcgqXG1;mb-*NQ08P?H8(>hggix5xU zbHMpI!NAS+B#_k&5eLjk_v8vv>_Ti&Ge${q$Lh2%w{Tv{^=PbrHf+B+>8HM`jwq?q z*bif(j7K(`dZP>R=C8cE+ws%xYq?dEZbcn==?vI1|HM8;vbx5#&^E9=ZFd_551?RP zmZ{^=c@4L-^P5AU|EuEG;Ti>I1rxC<-udJ;_CQUXp|M>U)%9OiD@RrtH*huaVF+VV z$|#ZO3qb0aAxiqZ8X3Y6>QVFCw*m%GDxa1lM!H4%S=DEBOf^mFfj&_pX6wz4QdjO} zrTSY~Wt3qypXweZYJsa!)WvLmj{2_w%oP1{i}ItultO;OJ+kDc=E{ePT07o6!L-qK zti!Y9_ZFsMma0rE(#|PH^sjVQ&X%S%#u|^{v@V+H?3t#JJ@`_mL0e`~Z`A^L5r%bn z!kyGivNOC8*BZTp9$`0B6yLGI(WZ0S`r&7Z0SuYCn2wF#n3K1_(I!rN{x}?|PX^Q| zb61r);xBaEa`~)t+^Q6#Q$OS)C%dL7>Eyc*HBSF^Y3>9olp$xEzxdX1<54Uh)B*V4 zkVBi(>u-Z=vDcn;v9YPY5kbYS-FBf}wRO@zJ!9>U@7hb1tuDk4XyI7&$j;c~y&Y$JJ-fIe4+uYUdFh17dwsTa z{l5o)0M2#U3jZhh`oF6hGO+z$Rl{Me_88`N#F=jtFTiF`{D8c^fbM|C=AS8tIg-pw zkKpa0+S}SOBmKpUc^e}b7TWu&PCm5H|85x`O;={RJ3`&3_=^t8zkNOIzo+82^8ZZl z9GFB$w&Fj#rMfK)>=tDdDYxPu>&F(@YR&zY45e$zHPoG(KRnfEcpti!3SfVv8s-11 zV`!|ng08;!xXb@9#<#8_tsp#sjcG%+UtB@Z8-g&U6v<=aE9q$o%-Z4^!Ab9K{5#!5 z`?8i_&xs|ccbg11xcl4PbX*>&*S{O{lnk5Y=ilsgZfh=o4O9E`V{9(mFW$2Gx5u+i z@0aQYwQ!q)Pdf^m(FY$yz-Z8;me`sPElfE~v{@-O%GLl)qps-;Q4qbTD6DPg!kPcb zbE&GNe-{LM6^KeqZakHPYS(TcI>Aft4w~P&xgE4bz|G8rNhm$6{B+u-!(e_uLdzU? zk}oMY z^jva%Wfm^_VMyL?rphxf?Iu*oqU%CeSfNStVPUFkgjB&Ogi9jE+?Xa>LuKC}uopc1 zE{J+0fwcd!m5HK$6i+ z*`|>mer7Ain4bU)d*Am5MMh}WM9i=5k7H&!^}Eur)TAVa?+Rm=KDeteOjCk!Ue;wN z;1v-Dbkndf!wv1~e2+L&!J-00O=k$gd%?nXvw3xt^LbXF-iZPRwAp2jsN^;celD>K zi%@)G(3TZ5T!L=>$gK<{cWHZ(e6~2IO-B^wL&D4;j!CqEfY}p7PY(IY*Ru#@Pn>-W za|nw3wvva(M9N^u0Q}-(ds5bH`KEFd(w6cH-eO5yHMHy^G~bdMINlt~1fQ5qRd^ zm3l>E;D$p{$>CwQm%xWF{f;`tX@V;mUc2`t^-Q(nL2rd=C-F ze_(U|o|F$5k5xI&a=4ninluss8SKxCN${I-vJie|Z7D)@BSV8_n^7uNf0}2XV4CzDV;{u*Lu2gB-8+pa?u*YGH zH^1Fy)sx4`wU^XSyg!B$k0rofJS68mFMy(%Hk**IK3DpQbZgP9)roC6;3gtCR#I6^ zYCO;;Fq&0S?mB3l!myS_vF%_)XiAr5db<%oejFn)$6grz5#LPMQ{Y)g2%=#CynV-o z1MivSQvRxWL%g+fYD(;d&m6E{SIHL%N5eC#f64|BTvy!E;h>_ELz_lD3+UKpLf~%a z+n@)T9K+m+QIJl+$kkL`U7~8<_3jRCNiIgYFUEvL8?AX9p~hMQvg< z|B+0z2$PSzP#svbeT`7qU?%&dtn5+eIG3k>0o2^HueMNb3?^l^U*{iM52?7fAq9{` z_9pA_9Ud64hlR0$saCojCJ5}Sebz@#Xuv$^U2L>pXo?L7Cu~13UkH0)&gBDGVMQaZ zW~|-!4C+DJT!Vs-ySoTf5JgpIR%|w101vL{UqC>58jFH}b3@(iA@kULO4|9c2}FNa zC!DpqPyG#z=#E)?yF%OoAFR(i^^$Ro5wm`!2WCub44^I zf)}nyk84yn3Ias%O+r?xvpaPxR?ZTZxgeST!6b(HR zc#YIK+Wc0B!HjTZbSl8V5DL1B;~Uf66OxDj(*qG*DPpZ zKtkRtldzC!?9gwQ)gPvC6hO~(Gycp8XA48sX^ZR_GR~Uca3h2cMO;3jJZBuZlRD^H zk^nZEO>gC82NbmJyZ{6Jk2{;Hxq4-)G{%?k=A*+5-*J8c5idE@%v7ScNW22)wsOQ6 z49>TKBn$5;ZMZCVLi3K=iSmKWiA0U{IXpv*aGw20WdBVkbG0L^NSM*4I0mjmq2R6R z$y6j@j1T1Rqaa6%gw?=3i43aHZLBG{q3*zCDIEYCHK#9Jv+e;!`_QX_(&^0ooWTT*IJs*VsIUn zeDtIU$K7Ypu*!~{ZHiDi%0zd&UaMOCLM0)n7siN*MBMjt5a(yEs`PU5pGnK)!t2m)Y&1t23MM%6K(vx{~g<*8Flgi1(K5 z3T45852nnAaH&A<_^e}!t}je(6v#K*3Bo!+;Xt?AnEjk^o3etcsw)q#v&Lhk3u}d$ z%`E3@)}esTA&?}%O(eck5iQ+Y1^TflEKjRkx+mCQ-a>}YjjkrThnDZHEG1ge7pI{2 zY*`Jxf@@M zBADEwwXDO zC#?j$38Iawa9XkIy~glV+5y1reQi^wh>jKe*;w7Oom#< zj;Scd&W+n6-2_6t(f2J5(z2enb zHh0hoqT0MN_jPTl2oP|4@@0v#&`>JYCP4u?k7^Rsa+R*>3u}fd9Rlj8VJq68UE#%x zep}&uY|95KKjK7Z;#MOkITaAM(u2UhV{fpAIIbIrEWX_5i@kHF3_G-=O+yw=8;e`b z-I_=-tog~Dbi?ws{pa>+k4Wlm(22>WVSs!lkI$%C7K4;~SMd6zAsyXWOm_cTUK!D< zsR2)CR-zb)9d3B6g+#d_DaQ8mw;54=U4=b?b|5mws@-dkQKmi)QoFQn4x>EX;hE7N z09wQsqgEf~W^;d@_$LI9mH&q)1jql1?C_gVVf=p_@R+MM*x%^$7jW^}Hvm>ML>x@q zHih>!gSo8%|FGVB~JUpd*ubk1r9XS~}xjFEoVPtP# zMDE^WZ`f_`uhIPh&-@?s;bNyG8nTL&x6zn6J%3+w#rickk{$$io1Y86bEd@P!GcTOf--V~3g6&Z9fp z1KqvWh2I~z@N_4ze2l*IK_=hdo5z1AUTcw+`!mm9xkyJjaDJF9t<&$R@PGV2UY{Nd zQOqt+_4#q({DuG90B8R%16+Rw2b>@nA12T&;PgM-LlYQEQ#Q?B7OJ`IaRWzm@28wa zUn&X>T5USbnggCnt8#SbK)@+ODlLX;SN>$56O&)?A;%Z_`Dr4{h%6LY{{}lD3pAmO z8WS9PzhLm(qWxx5ZuGAOUYz;oxM^`Z0I^HL3@K{gXuF?z<*U1uv$r<$WQucBMOiP{ z?jzmqyTJk)x)eU6dW8NGW7#>hFdfm3LOm*&!pFmfrUplE2S7^uK1o zt#eIr$_v-mdOO11h(b~9ZKRiD4zUjA8K9BZj2q{fWACS)!SLhoS_0!x4)%9ShVqIB z?`{R`M)Ym;%L6*%_3U6++C(xE_M`#`{UGhrJT+AGyGRY*Ry| zO4P5m9ESYrYR|0VlJSB8_Iy}mDZD9gJm5AhlLINyo*QCjiqWca0jNNSUdkYa9)K*b zw=~2IhZ385-E^ojOwzU)rav~I6a=QiHb}XO+VG)q36}b{@Hq`yPu|MT!w3DfqwD=l zzp-5E$zv-qCz3QV)#&2D*pMwIq_8vd3=VHnxt^5?A1Uf$hFV?AV}ivp_9dlUrWD^< z4XGW`zFoJfjJ=k`cB|&3VpIf^V+-X=ypSF4yAGIkI6DfKBDlDcZ$cKT92NBq0Dc4_ zX9F()X=|PXSvd9{dJF~egoHSAKjx`FsBz3644+ap@fn^DR~a@<#&Ueq!J};eMG$h? z4|`obnU~;Qpegg04g_@XOKDi~N`^=hkY9n!1Fhx*lUD)*j)iP?S3tXiCJTSOgAKkkH;&T0T#e1Ky0*t4IsZJ!>QiTKCXtQjolhObO%5~Xasm4_yT>N&}_Xn~ZZn?eeS|1i{!bDoGn z`Enc&r-)dl2G3R>DJTj1MF|MT#daI9#;6vSsOA4kRA} zE{zfFu^3CntR<25ArM0-TuC<^R+?10X|Sl!%VUy9iS2P$sbYc*mnRbpL2Cnx>C&lH z0{cTBopvYQu^A-FZN|yJY9dx9I#I?l?@rZ%F!{jp zfqTM+R)mK&2w59pGBw3C$%wk*0vV3_P^AU)zvV=c)6fbA*%wDW*T;Qq`=_SDtgwNL z@)=nrnpA*h5w*#vrbR;P%axQtH)%LjG51dO8PV*sJ)ZJkZ*FYY$^@>{j9^jZ5!PF^Wd(F>{X!wdj{lh zGt@Pm7U0N>N|$@B=;E^O+!Zq;w(Z$djaW4A=viaSX-xJ4VW}1aQbl`9M=4?T{EZdI z#d;0VbclTl)0Mi`zNs@ztg|}$MVhHF&qY=DJOhU?4*&1C%-w#%6we8^^j*Ysg6a~j zx=au!@t$6vn088OcbJI(T{F1nR=9U4dlNUZAIc@AO%IT<< z(XB&~OO^IeEMQ?U4RdO748$IMqCReCduIu?$Q$CaGF_T_t1EK1Yg~^C>q{KB0Pj0X zZOs9J8V=BZivCWf~|JKLwmHcTn?xEUyp-+-^BGidA!5#VWJmrs-^u|L)G7y?)y6vUkg2 z#09*Qhu@69c>2mAO87~C^|-~|cUSqA7J_)~rG~SEr$n^(1^6UwOka8~)VF2dM^rgS z6YAQxXPQP%RJNS4hVmR@wi64ef9WbHyNtV6pG!u#&%BqXahG>wbwWFW3JY+h!=Q#? z)$8SnFbY2Z6Z`fQu8;7RX~z{Y&Hs}&|6k3LvoN!;{9oE!XFTSrBYyioU~;7s9)J)nmO0x#?oD@d zkNkS}Z?qfPAHPuv#dIZ8ST-A;qe+^GqM-h8P-y#f5a z$6fi|pZm*~&!5OvuA#k)>s7bTO%9Jl`xRKW_RZSkTKlNjMX1#io)goZ64DaeodW;f z&ZM0a$89wHqgu z?Haghe>=1O5Gpslmt5NV`?Piv_xyF&KDd^2=U=TYB|O-_f7fVASVs2`ufJo0PM?d< zR>9HlcR&0;`$q>qP~?}>AB3L?-f9DEp;}Q_i)P5aLGnJmn_Bmgo}=`K28(aa{iD#6 zG30-pwdX z$>r=l@@=l6x*s9u=GEr%337ZFWDw1Q(E*ftq#D9V0N>3at3%yny!DWkT;M4*CxXw1 zGDjt=N46zQ50HKBlgsm~1@r6N|0(x@WC`*k=y*8u%#3-&v^kH=_25H}NDY_jPkP)WR-53d8H(f?f_puxCE*LBTIJw2rL@Z+HNk zQ{~5{%>0jtMn8Tu6Oxb^OB5ogkPyL6z#3HfUsKV%Du@I`{6x}&`CvZcj*@58F%(2Dz6SoZy|Hg@YLya~kl zKyl2`QzT;2M014W5(e1J+<3+#;`PKReX>)^+|EdPa~@Cev1)HZNE307!31lyP(sSH z)VM8ZKEkiIy$j2Cd&wjT9!YNXnI59S)Ifep4*F(LGZ!r7;u#sQW44miS zZOX5GMK+5d0N^NqIp|JWGp_Ac$p-H^{J z0YQJtA#K1{wXLOP&_(*F{b(&ZhcgEUfwfXGm?$JxI5tA1iNiFmxeV%Rjp^ZQ?E1C= zb56><_PEXl~uj=Ci9G&{kPo=ZQxnac<+sp=g0RnC@0U z6~=ceYrsoCWFn>wv_M+HX75i_W>;s0tLk6V5i>F_LKW70ulIh$JD`~&A0o`7og$dZ z4LyiFMKno{)>TT)JM-*WYmc%X)_l@AjlHM5_)!0PlUNKUKj_dGQ}^9wFHQuCgSNbI zL@=?}wUO^?q2 zeaJ%4peunwP&2^@Z|`MAkiIK1dzgLtUK>&)2^4>_cFWQu}5QNXLR785qVDV3wEWR`;^YnFE{G!HV>)1LSY$(M@tN^jpMR>LATA8i+GW zjZCeJT;ky=2-rpw3}Ws9V}IkVyiH+=-J{UwSploC@%d(e9>l$*?)3G#n}=QL zyv6b1f1KO`$FcwPVptM|ZQg`^1_$jwJ8VrP=>H>})#;5X*A4S}WZHJZh7z$7rv$Y+ zcOcoNMxr;kk5V_EV0FOxFIXA}U?BFyt_=Ed2+VVb1TQ?^TW8!s>(Q~(n}jvjj(XKG z65q+^nks1nvao|t9InkAZp|ESuX}t=GkS8$_IKOE#mfxj)NiFle5crm zaAH^~HVf5;DdD{m7Aql3+;+5{ey}eB9`O4s0k)?T`+_9PcA`)H!%`a5K5efuYU3gT-`N^PtiyMNYVO*-u#WVwgLAt&KuV zFyp%`F8h+#SuxK!A!kH?Ke6?F;t@gR$BF8ETZ>sq*^RX-&5-mJui7(lTxoRj7J9Mt zyhDt4#R;^vb#J7R$^8NcnkNh=0qtN!Fh)g%km@7L?_s-bG;Lpw#aVV}lzF-^O}-j} zGI1h9n<|d-X+`n@Bl?1{oRdo?(yMEELymg0NYnPwm`!Kz&F1?|>hninWd(3=kNckp zh+e_)yVsO&+B@mJ93RdQcchDT8bW62zDS(%V_5c>BMRfqi9~QLvZWl+l;RPpphLO| zh@hO((6}0ccyN`kD$ovdin_t?em9Q~*2-jk9&WKYn`7{yrKg2_cO3A{wYbi;C4jgp z0Z7|J0TK#L*{mLvs*TZ_&L%Olf&_xz(3L5QdjmzOtF}Zp)4T? zI2(?()v%8qe@(;Jdqw#hy^lve>K+8?mb!4x;$-JtD1Y^>{+Yv$;IU(28w?*QeBPr1 z&MxP!Iiw6ly{I)UyIUP1oU(>>Lxs-t=dI|hPJ7%7bwgsd;muTAbJCk?y2~NZRg@2< zD)i%GYP0=+f0{qKr-7jBUUa}F4Yub=9qQiiG=z0Ed?jqzy2GaT1fj6pwm}QtAqtES zp>Z3*eE#rqI(d}#=|he2_EB+X!2HKQQ`)xxDUS%ff zr_6V75aS;F?XDHX_KU^5vD8_e9B|wfe=OiydX@*U3&6b}E&7@C`|G3k*2Azu2-ClI z>didnuyJ=opkIbJ*!=O)SYdM~rT zuEtfPqa@IxQ71+7o$Gxg#pi7&yzMejCi`b5trFE*E@@eMT_R6E$l+RzY&vib^~%95 z!*qwkf2rdqCVBcL&W)xgRJ1!e<#vcd=ZInGkZ{U)`kLyq;`kZ<2${9r!xC0IvRIt&9tQ)T`$8HIesW#h1mdfvCAMloufwjZDm!bxOTl|Rp2Z0 zh~+Hjm{!6f_xZ0Q2OblD{FO2BL0i(c7a7-e0mVs#qFiI92Ru&w@h&-iRGgnd(+eDOKdLugu`~BGJK1pnJ#a=wWc+>#CZN#4 zO=EULe5r^EL`j{cpR;T4c68l|Xk$j2amVHORj-{# zAG|VU+hg?$=JTW3s=c_FtNA@}!U`|o70#s;m;}^|5(|8BlEtKtOCD{EBJkcz=W`F& z>eCkB%=q7?X2W~R;UYj-__zvu6!*N=E(s2G2qyMA_dHy!Uh`JRcL zk@0_DpEPTY*Ze=H&2w+)m+BOcLLx=mS#d2CIAW7# zB2zRrC~@;#o7ExlDz_Eb1DYo+-TKC6{tEj2efRh|824*FIJA{uuUxzub?u}gi-!3H zqTc@kQQtOJ4YhUiZQzvDk7?*;>>iG%4r;o8GD}^wqK{g+L%M=d?r6NL|Ah?Oz1_Xw z`-Qsbt5PINL!mc}L}4IZ07xWuQ(!jpC=FET8n+ z4iuf*{#X!$67GGqWW>8iRi{w@L6`Bj%E>!Y-fy zk551wEzpM~W0laqZsNI3%6ZOy_AGR2qIO#qpXKB}`cTU4V#hGu)5qnzH7~sk?Tq@m z@E$ULUq_t2{Y^%d#a|;RMHjXrOT7OftElfiE0_4R&7d;TE!f5@yIHAyQ2P1qQ~(wiJ~g?LbBairVG*6s~WxU`-Y(_5YIJ($YWAdNuEN{aT?1V|zL z9Wu&dAW_6gTUx!)eAa%cL#YMH{DD?SA_x5v>VWM7>~3nv90~O;-{PIAvnxl*bVeZ3 zjx8!_(RaVO2%$AVF`V8Ysgv)?mX0BWBZJ<+rw0XJIS zgNB`fx(=>+Xj=>@^jB0P_>XQ(T$P0W8d~dgR1P&gOXFV9BBiPAxc>2>;zntmzzvPu z5D^x3pFJnA&p<;-j0=KjV7oSSXPI6+lPv=Lb)=Fe31XAyG$oz45h~t#7v|u8EURY@ zD{)A)iiSI*=^byHjDTI#vk#eXvn&uI^XL(xCP{%`cP&?)vbhz&Xww|&Em(vvc$ks@ zsA-J1w(Nn%z<`D5-tiSbAIiacWy~zl$DT&EVHoQ8Rj20Bcuh7$g99`-CO7x~3g$;4 z1gWpTH`xWopX5qGUabrXxEWVisOtrP_hX@b6g?D%G>u}@fKLUi2Go8`idIEbS_1&E%-uD<}$;U?bt!wkWEX4=gHYkzg|7q`Iv z%7q9hIK=`k4X+7fNDa*rr(1vS@*EC`L+H)4pgPxDk$dnre#EX|QhA%0 z@?^V-`S(OX^A+!LF|CyX?)T3vG*mX5Xy_D|tZ^w#ZRxO42p*^!n{2Nyj%Uyo#Rmw_ zJ^zaXLwcflcY2|RU~71UaVo5kp7b!1(Xpm)E2L`CplDL&i|OHfItex#>I*rap%1AN z0^Kn%xMNgP{o_my#0N4z48mGY2V0l~FnI<6?FPa_wx|ysK}yvtlJv!Y*Yr&>3{A*N zS1|lxkh1F{!bv7v+URsYkZC8*Kg=ih8fGOxfSN{gWb%aROE$sbAL%waAlAmESqf53@Hd zqk=zJC-{503CXCYZ~Y(|{qA1`knV4c5rttxVn?A#^2Dtne0%A6mu%A`3n*I>R?3LG zC@}Er$$1b_VRXwpfb7o=CAsN)lsM$M$q^?#=q4XIgn-U41D=rE>!=h%igqF%gUD>Q0 z(uov3HrrteH~k@#0mt*5BqM+n1+l&wd>@9GvbQ1K~T zf!yw5!LcGBb^K0nsT{8hA16DiSCvLg&kqB6FWyGje;SB+HiKf>3kVRJKbcBmLh|a% zaa|4IyPz(3hEV$rImc%j5<;VCAyrS8__-<(k66kc#m9{y6Lbs$Dfhx@wl?E&DF8 zMpvRdYJUsl)`#gPvXpk9-p4Q{_wGDVh2y1|!HcyFry&W|r#txltUP$c4mrkhXyu&q zpcryV{wc$`=nAIa*MV1sl*0)3Z+|n`W8_(Y~8v zz~=U;il(7$F;15_K$({COi`rGe-jlWB?4UW1?z(d(VsPCx0fic9XHSS*arLEFHRoec&8mKH?C@qFYs0$6pihkd24pSb65(ChP$RAnpbw zqR~LFGX}3%V;lw?p3D=4rJ-qnhNBetnwcSyY}nvX>576A25ec=1v-xm<|V;-JH1Xr zQ)~jsD_hp6fPEZA@Rxo<}L=M<(Pg^hk zEp3=~D@*i{>x~*Glmn)Y9z8#P`uJr=)2usvGz|Pu9W3G7W*?SyQwN(HG3daw@E5?t<3R zjTpMi0QpU+8AZk3aLXJkIqCzlDFWAL-#h#b&4PP!w5M3U^~?NO6R-4-gChXxgNOYiOxM$aFM8b|~s+?eO5!#07Pd4%!)^TUh1L~jk&*9QSG^+$e;KR^_VaL*br zJic1opsC&8^ex|~9ZNt>D%!K`9?maS2?SaPZFdQfZ&ut5fzy2X4X4(jdMIzMGMG-k zUJC~*Y{bJblKpA3C(jff5OpaXRKSa$c_}%J?$O|%P^n`?K+TN)!gdSD_(F5)x6gag zWJQyOKIj%0=8QrZqj+ePc4Xk3d@J!&MHAppf>SP-%J{z^v#s0rr2=NTvtTX=*=MKm z0d4H#b#|?lGv#XR0C0ua-<+wSpZBap!0;r;i6+=cn>Co#2X4*~7f`9~hMT?&`m}AE zDR4@>Uf;jdY;}mk0jBGfEL`yT7C7V?fI{vc=w#kb?0sf;isg|U5@0a8JrUayyZ|VS zbsQ5(+R}f=3}Oou8ySdbyv1<9v&RB)6u3$gwU&=Ogp-C`ZSF_&9+1bLZrF55EE7;h zn}iw<0%xXNt$-b8i`Tmq!v%{iT1^#GM-$=>JI98dlJT$x_#p7$eJP8rg2?8v7-yk7KN0X+rG)DYXA+L z6uP?^6+C0S?{zv_R~~C0%($K&I)opY;AB6nTiVBWnjO{mTpj)>6)8h59fuJX0;sCI zKTGgvV16o17fr#ZOqjIYO^`h+Jg?h2Q0mzn0pXUC^F%Y7kT!)!)}SXYlSP50!epN{ zgfz^BY(+|z)$giUqrJMk+pEE{9?1e?Bh+@Hw?2P_jNU_BhFv~qe!}+&s_e`v&p<5J zcnhHaxL&=q+%h3Ct0~NFk@xg#_?L+^ymxLK9DK;;Y_X8q$IR*IU@&u0CIU!bE>xit zV^q}@#RhBCK75Sx@sFh<&ibP@W^zqU&1b)XBoFq~)C5&l^3hc#<_{PM{`Iz$_Wa5|lb ze19sVR_8bY&@U}616V+fMBUA8Jt@=~LDnKg(H)Hn>1l#b21aykKDsKHJ%=~Ngy^jZ z;sKHey%2)nUz9N6!MDLv6FP7NY&;!GzqyAYNQK7YYZRl^i)7ERJp}5M3E1hf$7Yc| zxBFHMFTZk1q2vyOz4oExUf=;^v5-C{!FGE34Fj*jJ!ubzgr0(1B;W3a-tNZ!^V@x` zxJ2|kTt4ntPGv28+`*(vM^lyjP>Lm^E6D<0x!P1gRjC`o?$4z->}C zDIi8C{o3SHJJPHd0uDcMZ#{Sg*#X0MmJuasvNFlf13>ufbBWN|#4e+rgyj}xXtg*` zlAH08uQE9EnjWm^<@my($=A36)#M^)QB}W0u5%4#xP){iqDe-&oFzELl3mDqS+jLR zjT7@n47xVrBjHowyuVfRTn47%Z|*gTzlMk333YQMiKxl}Us#`c9%i;1g~v8Y3WA0L z(2bYM_+w$FoBCFNS80{}vI0iHYU^B-Uw7{?9z{e+?hx}m7Zdg$;yQ%HEnHeo!i&RZkyjo@bT;Sf6UDGqeV2GK(?%9e_fuN=2vnIN&kfv`a#7b#IG&OVe>d)(*;D#WB`?4dRpUkgW(8L)JYT^Hp!t>vz$q0l4&-!Y!KjSR2F z0#%y@(PNB@vY!QAE!?HOW03ukxSAklCAr4uJ3 zYVjX9-`m8HM|x>hpSXiQTWIY@`e;2BoW7!qY`)8~-sT+L^=-ZQ$%`n!w2>=10wMD8?Qn4R77HX5O^kPf^Y1NZh)i z&Xpf_qMS;<&cficD3mHnV`}Be7%me7t~sYTR5JFB#4_%I9oTIiR>-uIU|Gb}E*!V# zvYE_uXcpA|G3*B772qW7{i{*AG8aF=YnqA5tk)FCH5%*|_NCWewhPi(Nec^)ayn}o zMn7o%^LdmuIP3Rk48k-TPvQ8Q9XJG@eX#~7Ar#@50BE0(`-TTv6J4Mvxe*qcxxp3# zL*u@Oy$uRVzw@T}h>|AC(}m_1$Vpw&ehN=jkv5wk36u)%r?h<*{S4NPA{}Hdgv}hS zsQVW?vdJ8&;r`Uys>NF=93aL$KR?z1X5QX7Kp#3omS>Z)d!LjUsOD8PezDKrl%?07-@c@1sZl z9M9?jMrpb!+s#_7+>CaJ;Js%f79R~+FPaxY0s{e|>Bhi{O%)7l);%D)hvHuCjgx!> zWmx+>x+bMuuf=hFTVmZvcA!k1eNsqsdrXHA=5HMuTm+bGS#sZh%w^#9NW~SR++cSj z=0WlrcWsqexdq}*%GeRVoO!gH6BO(3ur3~LNF?S@F^eZ5N@70h;i=Yz1=z}D#;ku| zftUrq(H;cSQF`$!;dOw}4H7m|{s1ACgxw^%OfUPzq7a(mNA$4zE8{bGRU+j9=wkPy zbREe)T!=yRPOreU0b+A765cPWWyHh017fjyiOd*qR{A?=1;g}}g$CQ=Kt?mr(AH`; zQ_*|AXx)x0*Y|pyMbvj8!55{%aNlAcyyR#FWn83yt84C0PeFIh?2Q;G7E(>$2U`4F z=wDt=d?{TK$@4#ja@B1%0W>XZbI-(FV>Mpx^L>V(T9qb}Em7^Wyu8TFvZK>&2O`Jq zgFlLu>j){pe3ZJa0k2zPo>&FMB!Jv%Qb6$}1VIPd)@KpD2)9q`4(if6w}-0o^2bm6IaD0@B@%f_Qwt0q8%dl%)sfKJiLy-X-P)HG?lL~_GJAyEcPBZ2W4|PzE^EIipe*k_vPR2Nd>yb1 zM&hFDnScl#|MpPRb7^937F882AA+p_{tF%NF>9t_|-4 zo!jB!OWYC7HQK#SrEIDU{HGNXWgz0Fo)k$E6GUOsely8+LH$#^>RBSkAqzLrE1bpxpOR#GfY2!RmP zqd61XRvnIpGKQRtRHfZxEQs7$h9;rXEZ%nm5Fi1Fyu5G4`B`b$jiY-K@&%Q|HyAWD z+MQ_}xIA51jE+R!m`k$*0y=c#sKq%-Jut8dFq}cZrCss*k9oYOtaahMdjiJRRO`I} zvewzm5+`rO{bF%u|Fv1%Nm3 zipx^N?eL2>kr82bFgjkMQE1R$i#$)09M38thyyw}-imA;R>2ZE$Ea===qY68Yls}> zvF&Isr7kKv$Irzoj4JG=WpNVDGAcsk7ht_f|1n}W9};^;l#z;< z&Z+X!AjBjjl~m6!CN0mUU=1MN8`XGu;B5UxAN~`c1nYr4(3c~LP2~*-O};B3<>XxY zF5PNWW@@6S#$90A~IDY(qG1oVm5Se^p>Ybq@pI|jaXKp8PzesNYK^!P)CdEeuD zHvC=D;(jait;ej+lAhYQSC{E|hMif}cU`XdxJ+6J7eDsv{x(0lF>hdf>sd3#9nKOd z=%(F}$0{J0?MO|&^;K*iU1*$kbf39v#yp&e~dKuaL(&qXnq;^#+$a<9X8F4uqeA4_XYv2!%j2Cg< zztWMYeA*RuenG4cM-_@m(M!UIt#y_sKKDLVr;&Cg(cgrn*kCBEET8$}3rICM2T1S? zCJvnL>*7oT@)iPOjf{+qFMO;seTk<_w0h z>o3}@%=`EfQ1|x_j+{TY-lKAz(z4`icKvIR9Jc9xJz{JhZ6&e~PlhLzRsv5McKkB;LF- zpo^&iO$Y2Gj8sfGfb&nf0RGxLF6M~Y@M0qN(Vdo)j(_XA%jD`dKi(V=J>#s!v|6T* zX)w|?Hs{&Orj#n{^>d$>6no3QvImwQe4D2as4539Q9yL0j~+o~Z+Pti&OjRf`C6H+ zELa@ZKB!L;#v#Bn+?R4T%Jk6PuPJmPtM9*EfP+9F;g>E26z~>N@0K>$tl75SDySU`ozwcoFtFe^WHSX?avyG z%RO19yKO;*P;>nCm|L8~=)C5!OokUYUzFlM({287i!#H&&OO|w21NIcPu;!Hpg>sG z)#f~)+(%*<%0%KEFP%*p2wMa<{Sq;8cUEy3$*H|V-)?3;Mf>mX z|Cq4;u56tDR}2q9U*z z-s-;}oKiTg&9yGAS4l!uvf6}cYVilsXHB;EDOGx)8(}M-Vy`bxNSl65BCCF1uT&!f zwbu7jPFUg+OdJ=4pfUXz8#RG@6KPbXmCC0=k#Zv^uz4oEV7c$_4{?i_DHnEW5}u`W zKh;VN$b(7l#hqU{@5f0i6<41@lj9B>&U%{ffQbWK zBJo(aJt#@bwrZgWM3q%KSZ9k#odc<32m3fuvl4XmnkApc>DtE{sxmwo&|q_0$|!ls zidV{xllqj|txj+J@L01};peZsn7p+g@70K_ZF<1i((;4H>Nx~eHW4#5Q)23YEzBmJ zQ>0ZON<}fa|P<^ z>63=lfTA-ib;9*knyIQsh7cpRbE9|G=|Nh{+|CfPXass`kjSMDS43^oMv~ps3KK#m zR*wc-(vIr|#O$@(;8JE26zSPu$o@pF4B17HSZRyv4+R}v#s;;vj374d+n zqfJ9f!E*+NR8%U|r_1;lFlq8G#PGLHOScgGt+a!=kf-EyBeceOivs$p*al5Pukp?V zojc;^YQtZ}M-DufQA8KIC-$RB%RY(Was+YI`H3MwvzgK0=QK`}Vr+%Tl^ZRqH+fqe ztHL-AX;k5g^12YvUwe*g0FGVxTiLok_yAvRi~{fA`^f_Q!9Y8j2t=h}_yU35(_e2k zNP57waRQ{Iz972a)IgMBOl{%bij)xKd64R~$b$gNJ@0G-L8_(kiID^(cwuT?F$-Nh1$Jyycse&~}cK}c?mLk3+=L15ByiE2fU(Kv0!C|p9=vFo#prRWopD|Nm7QuQcK!*!iL_P9R=-Q?;J}k;jvhd4akTED zv)upbLX*}{B63_Z1Oi=T^108em^IeOG~+5LQ^j1R$uLRM4^tq zT*)~g%|Y{*oK>b-z%AvHn7yN-k@KMWQpd;O%}r%$wtXASym4uB-9sn{-q}I>AkT<@ z0H-1Y@lJ1_SeI0`J)5O$m1ZGcnUBDZ1{Z_QqGLX;7b1P3+0ByqA}|Vavw5NQT?L4~ z{~n9%0>i5`B@q+$X6y-GLC_wAQ*FN$N)Hi90Rz6L2CFCZ#};82LZ#!s-eR~;2T>W1 z?Gs)~K3%0j-EgXxzT?IS?Z|hxOJMe|?Km;N0RzB@5~5=PBInY$qZfPY>haYmRgydB~-<-f%^e-iu*diS)J^Ks;Xy7n$)FXYil~jc?vZt@icd?{Sw&+JC z3WK5SVcZ1FW;|``Lg&Zdt)Ofd5{ZmaVl*_C5w~45qK@)}Tm_G%3^+d54T6;;=*V$l zpjvU{%_<-d7zgVtvn#IpAYA+-lQnua6&7roUgU!KH_t<(rHT5|XgLEF)4)hSx>VaB8T@E9&jWfpnBy3X$UOmM1g0?T;fl zu_U5f?hLeC>lufo(zrqk)k!g(%9PD4?X%kAEYB1EJhVLCj7*jzF$-6-RoedNw@B5S z6d~qqwHFSOuvFa;J)|%nS)@fG!gJ;#w>wVH9e^Xsp=>_qOz;!K(Phfy>Z)0#Yv$o z_wWI`DKHy%R)-`(Cf%&4>YHydolu-20T2caMLD%X_H%e2+uUL)LYoAX^9b$iH>=35 zgSls0W<=e<9cPigg-1)&cxZy^pI&m{Kv}t^rKu9;t)Y=x<8q|4^7{hg@&(z2EVc$^ z3C~-@_+ldZE75LWGAWw-6zZn{|3d0!R686GtOZF_aDCo>9zq{5k4S!}@FAS6iot7v z^4n&b*J+Y{?nt3qwdqXZ*+b$ueM>wCk184^8O(~8eC~=MHiM-H(~PR*3?3AmRqPn=`w2My{sa^hp4!Ch@xS_|d5e|~ zUskqfk_7pj1j)~nxTs$Y)yxW16yHs?^Y=p3W%DA%YP6c z*cmz61g?5q!8@ss(Sq%)KF&etC?xC>px3LHvG*%zxs2hfsHK>;d5Gv5_^8VF~XsF0+vgg1v3IdgMID?xl%Or$3n09dH@q#a+ zgg2OxaWs2n1hb^_p#H{C51Lm8b+t??)sid8yrIJo9^~lm(VflZE(`n2!^xeX+Jpjz zT@oG;ZZG<8lwWGG=)seDpf_@YnW^-xDaZznum4#!%@h%OG>sr)!k*F43aZ`%I%dNF_uUHyuU) zSn@=GZRgoAbwPA1L(6(;cmzpAngUl`x(p{_me=Gmtj%q)?JYcC8(u`wS4%%`OS#GLN=Tn1ySD`&!YU1T^YxGl*UErbA za0rPXxrRfQXR5k8rtg1APeZ)*GlPEEmo73wuT`R>!Bss&e0txu2qe2u@IJ+ycuh0@A}`c}TO zA^zt>R#rRFg$sE!j7HjRZ2<1+_OegJkNfhBqS$%2ASibG%Z+hA43z=_l+r;>+evNk zdPY22K0{{ntaCsaSs*h~6p45R#MU%H6P-diFC^{2gR?%hhuuCk&+o`Q5xf>PXwG?J zCIHrj?Wi=~>4#SX7tw@rY-1JnD1zqtyKqz2k%#Mg74Lmapf-1*Z3Tjl{Zs(N1m_nv zOtHFT=D4(Iy5F?}bS5dm0%%pfEJuOVU0Bx8x(VK~8tGKqpzuW`w|yf5hr*2z;!^IoA!oh@&IIUTQ}k>cjq00csTN8Y%y{d0n?G8OYP0{8)2`}L zKgf7UyZsO0P@dnG&d=k){b=uLl$oZ4-&+E$T0W+|7h)phA3DB$z8<1ehk<&1aBLy0 zLRJc5*w#wsV=5S>$iEY<4s}LN+w*K6EE2!Mp@XZuUzO!-zXr#{CbVZf&|vmc8oQ%xZu(nUz3)cramLskzjkt?bXWPF zpO5>O$=R1i`bO{X=f&d-JLXn>%}Uq%N`T{Fo08f;8{ozPb|3vo8VQ+%!slj5q`IeMIF+-Mhe#rc{#j#mb#2j0@|L2v@o_>_H?itpYKeqZeRC$`oVfX5Eqh22K@{B4;E}J)C*E8FAPMD>Wm6 zEsrFsf76WqtHElz%Fv)OdF)g;l({8@e0uf?6fS5H4QYCmC*r47CI|#lg5Y{aq(eeWgzV7MLt5 zB*3gHZ&RcW%rAq@uno>}BDU~XQB0pYC8^SxjPXMyu1>oDa+L!~dgFkhvJ|~jizg{Y z|b?TeJ^aE+1;K`*japMdCbfp zh1g45IM88WN4Gq7x0)kNl?~(CbC?FDv~-Yuwodev8#P68Y~u}CwjqNM)G|{c_#2h6 zRe#T&8E{5U?H9edvIiXm$VY{)p;Qiu%LT-gf+x z0eT6}gx*$=lrR=qGeB`1(uFb3{v9s7P8D(2{Xisj40tdZ5^GK}eIp=GZ!cW{+;o2;|{S z9UH|?FhFH80gS*^>@^2ri+#!OrR${p{ud#cQY=)^(E;j&jEOPd|B!!Tg&6n-vPG-MMK5n;SNp(|0{xzQPxp{!z`F56TVnV&p zH6|(Z2?O487@?ShVmc?u6XFo4*tpp*0Q!y{j42*c8F3#`nH#F0AjyYZ^MPKxx^LsC z>eSCH02)TUidiebEL^k6{g&V9KlA^FK5iptNw)ocznev8E$}d zgrT-_mS+`gZ=VrA3B*`nhv6`Wnv?@N9#S7L$}K+hMkJHS)Fo9)Jz*m~)=gMgnYieR zkyRk1V>b&g3MG{Tg3-$<;&iuPzjv&O;xe)rIbGkPuH^7;!SGJ!vv&$q%BXcWUxY1M z3_))4o3g=FNRyz+q*W6SG)L!}9i)c6{=aR|y`=PTDFHA`j8yT7D|<5+3-D($;!bd^ zy?8Oh;4Z`=wv1HbouI#p>1gW4$;Y52BzJTme9Ww0xFss9Y8fm2Kwi?7I=W%uIJ+d8 zo%;vppX0hC;~UXOTDX4Ve3zlV%&}ZMW{U7=l)#&&u4Co3Zpe;u146n?FBAtPkQsIi z#4%mGU_B%A>o~IqY|W=fpIRU39Vp8zHfwEMU1t0hjI-qE**O#I$Z<(CJ4E#OE{C-fw6_jWwTysObkyp}3gpm|Y(h-16)3xw0 zR(KcfW-%o|Ve@us+GvH!KipwiMbnn^>cVUx%ObzVBCCg@WKwEfugpex`cCVF3g8n* zQSmhrLCLZy0XJNaH!I~TsAk4FVyRG*k>Beuaaz{!bog6>6BGy|8u_<4?LYz_vrh&( z%Z{W8jv}mG*Ysr>%a)U@+?Zs~{#Y2oll9sY0Wg*Y7P8-daPY|#MLkb}I)7_Pt#o;& z^@0XTf)1~D|54=N-6O$!T~t(~_qaISP@wqmx%BvWXo?Yfe+mi;I{QYf85@xe>jFu0WbYSw5IWrXcQ3JqdOnNt%wo*z2ur|${x9nG3 z{#vUlf8V+>yuYndmuB^o95ExI!BBFamrH;S{f!Q0_f1Eojd9=C(m3N_Ub`DQ{!pV-OfK3(=yayUWo9tW`knP657henKKhqYo+cOqA< zp+T+k>y_9E;S8V8&Z$Od+>UT7aFl6u8sBCu&LX5XkIZM3UL)Bg@(GM45Ldv(r`9c2 zUuS%;sHEEpEMQbXxJ~)<_SguT2@3?% zsvi@>P7jt7)2s4j04wXCm`^p>38J6eT)_mH zCPr+aSkJVkgd}pxmpi9~AZLmBOz_UQrV4BBWRB-)9ZEObHDyCOe4pUa0R(x;f1au% z>1ya!?X_+l)~_D5@ogv1TdwvYYyB^kR6FE()O}&12?cw*54BiOh~++wK8x_qIzNp| zUC)p|jSovd54pCO7q+B%Wu1+=QzI4V@?cL#b9$^wH7FuNTlNY;xJe3{lGh}dJ4}0D zC~`Wd+>+=DZ8)St6|Rfg%MC7{+8cwKcw5tL{;-L^XlZtn2qqN&la z@3{mHbtr<{XnJ_L6*OAAX!7mu)4K!msN!K0xx?)$v+`~n+o5HMU5eza^y4d+($=y| z9)!eHlIPX0c@!`#YTzvOB0<3LwLq-YV{jtb1R3`)>7#5v_#p?6Qg>&~RVX-W!F z8`oKMOkH8ED6SkoE~_w$L`pM<@32z6?o|zdo485#4T}Fjp1-o`VJ{T`UpP(9*^s~jZ?J)OpO1L78qI^cp8DYh z=qP^}=ir=aPEs2Dp1SU=fl~b~hm!1w1az;28IAuLkKZ@itmx=BG(jMpcw{S$^uAHr{|b+{^c8tNLEAc=fkr1s*FxQJmK zv>&o^{=zeblY4+WVKew3Ce7{UG8N3A;(W&Z{V$N$d*fl}@eebBnzl|&uCc1dyA$+V zbg@%WqO^t-9p>GA<1pE(Q=eY(f{ds+I-peE1e{G1MhuQ9UDgWC_8WZPJWbT5?_Q7{`89~xq zfdjV!W>yMB%YxVH28mI^bcax85aA{h~lVHaJL1 zLcF5({q>E#{TvzEYO5y8zMQ)3@=bGQ<-!!bSBa#;hSxb@An?+kN0Ga*lgAS8&sEA( zZXsr-bNW8YHP_*UIzxT#y=s+iKp= ztzO~n%E13UDzVTr{&&<*Obq{b(Cy;?RX?eFBbz@G@iX$fCT;4(hm?u^2l$e-H;*zB zMIs~d$QB$~`?Z5+!>}H&R2FrzRnN};;1%9hb@M;ntgq0zuaNjZp6=iOpPTjbYSgha z$TV>S8v;yp(^vZEHN6OqNf-M{ztjOTiFLBg{LKS>#5;PhOIop5&7jVpVSAqHg8|xx ztTA}j@B5XiCdln*$_c(HJ~5QzLIFxM$cfhvDt4CM7l=nHOP=(&TPp-D>B2U~g0M9v zK%`#eUE4$S?xC9wGfK5(jkmE0n}lT_O@gPc=>7^scYTMMf+K%9rjqZiNX>xk;At&f>= zaOboj)zmU>he$C> z9i{g##=C21%rLmNNmOG0@!GU|^c@cj#tx&%X3-%dRkQx(SVE^s17Xve&S*ME3_~4x z>ROmORgJ;OVVpEnckAEi^i+(8?$c)L2M@RhEGV~fo`*#4Y5M%HH0Bh4l^0c1xO$%r zcyv7c!S`rJ`+l#4Nz762J||K7`BRJ%hyW>&4!l4o(tJt8Hb6x40GIkf+`X5k3j?>9 zWN1?}KB9u_I<5_T8(x^LAs`$d9n>J&2eMc4ozjBrso_$9iRs6aKzIp_cCu1^LF@9E zdyo+j53L09k^Xb=$8G&IVNlv(CvE&Yhg*DNORL3$IFfu6lfQUPt_+dDNbL z-X6z1|8{&DE!VK@sQYbRO|xQ-t1nMckbL@wC|gl)K$$yQ*>|AQ2}UZ}d0#Qzc=2`c zrdi#lNf=4sq;$@kyXSLiw#QHTKT$^<)jfeDnoNM#L>L#m7;5ZuPiVxT3pWh5WPDD4 zp@pK8p?DmG*;|t>;dl_8ya>Y$b%oGMw&AFgz9D)t5ymo#k0K4yf$Ev==jhuG!_o=2 z*n?Rn*%xQs!;dw2)%fAW@0}-_InV(Lv02z106i%hwPhPSfScPd`}LKjfSTyxV;U~O zK?x}(cq?Lg(@>jBtd$kRi3RyX8G01VI0hb=eehlfkhFXtys6=;6I(gcj>$a{ky*jQ z|ISjcO#wK7#vOOg0Q4JP9m-Mc-s3{0A5Eg%3isiGRt;a|OQh@-MUre{RjEEZs?2zi zAmbelKP}4AEaKGdGu8v;p(%*$HG#;&C16@O@Os&=QU>xYKLW?qTh=}P)rn8^z}EI| zP`+Nyw;RB)ZWATRBPNp$*6cuUJ8b{fTQWAlP!Y*=umk7>^%HyKA}9$@O(t>?+*F}@ zu6gZjVIdmMB8mwN$E#NdPYOrtcZM%!_)DEmgKR8>U(%%P`e!S5F#Rg21z#!!w!Ms6 zZ^+%JbCQjoD!M_}Qy0gOE%9kX&ytRcx~T#@{2n&d9hNHkM)!vF$q zzL~CiSo*X#-dI&98%*c!XSHjyH!9GCT?*wAWcnS&8oYIuUA^OnfgSuC6)sgriG@W| z&IhuYZ5G=|d${kcKZM`JF4X2!T{|Y-6^>*pAW7Cz_rj67s$b2fl;odnqu>Mvg!3ZArVRc4NQjYp6O}II5GU z6$;e-AN|=`jTIk=y^4zdgXv&+Ox@D?MkJ|ctzNYSbI{aFB^IOPxFrTJJCwlQ+gnPDFdX zVqwkYF|lc|{K&;^imvwakk-MY#-z9)j8XwwzzELVZn?o`^z$kG#bf}Pnnr&-4gF^-)-{2SNYi6kAs9lWV-d zjj^K+5ktYMI6xYvl(jWLccL*92oU+@aZm0p|NB1H$TxXpH~(EE?%Q0eUaUBtQ6_Z? zRSi=*Eq4ew%J81h3rFNphTb%k18{w-mXw2P<(bmZCDW))Er{KkI6id*mWq_w09)EN zLdE<^iKc1HU3I$hJ0~!Tg!>vq{?rx|@YH%LUU&1sB;e#p>-=L+3^XkLq(WHGzoVH{ zv@jV-WQ8uShbfVh3gJ;pK<0DGSDCOSMxJGy8l@$ML&uG`-Fttl1K@RxnrQSs7Q-Ar)&i zM*7dSL&Ms{f0Qm+0~1bDYw$@YkKSc z=o{;mQFKX-+Q~QThu^SAkFi!$ui8C2oEcsABBIHUG98jTA0enlQWC&vV0oEWNpDX> zcE1`6o5o^MOXxUZ2ZU!tYI{4e={=N}Nt21H8n2~F-MfohSx46`PRA{@=@REKyDCDZ zIdl3Fcbc#xUWKKf33E-|kb}#_+;WA6*Z)Ra9;;{W2isXk_(}S?jH;7xIrE|=&lxqwIGow>FLT!%%lbDy;sb$4-km&-fNYE6f zUmk2Vj_d}7uaAw^p#Saw-NDl45|`W;b-zGMpU?-w6y-Ghn~yG4rr=%KZJc`#IFSqz+}FJt*Jmrp*S;Ab*U!E!7nw+uYa;LuyQ5aT@C zCS1cRbCUtvkgvBHwL)Ga;x8|V6X&{sNvEH`nQJrY=43DmzbeKwsc$JSls38^6SF2ZzN*loc z2V>_DrAfdw>9TFxwr!hl+3vD!cGpH)4SRMvti*&MMH(yF~D6ybj850u{!=aVR}HGS+K`x+fR#srA=GBh++;+ z(!ERGgWL~uVKtQ(`$qLK4s5D|nMh7`+RX>1vM_PDbg=?YR65e8qqWVA0sRoWP#@WL zje*AnC>ROq#*MKme%x)l-Y400^jl*gQp>`$r=Y2`NlNXQd}>V8ED{PFax>^}L2GR~ zgWJ~|t-N&y2j`SZ1FR5zhGS0o9GtD49mTCkozo=6trImnK5L)e`A@Y|Ny0Z5NkFbc zgX9Ab2zxc}w9F{>Eh%6nc9!4%Q5Pg}jYNOl8t*TT5`W2h5w63Qs*ygdt3*T^zgrU` zRV!MZ3z>-bU;=Mk*ZtI!GyJEc#=OVO@>Uo)E9=`u{eEnRk1s&!suX;yqVJ>p10Spy zOxSnb*@wd{5AP-Yq<%~w#ytx&>s!%JWPm(%@lK>kFwZLmn!jjMJORGW8|KGBV9t=9OG1On|R zFWLne8dOLgD@5x(9iOj+%^eb>lX*7z#}XTo@2~K`Af&{mUjKzMVfk+<6Bc&P|0jYo z0{Gt%oG;KCslr^LB23^!;Kr<@n;^RC@TLhm^Z$S=yw;skDmV2qBpj66HX8}h#0dyg zTE03XLJtKSv^xHC!;$?0$MqYW>$~aw`(*NdXz+B9p|Qv)*m^8)39-!}!eVsvK>B^i zABcdxRj6kdr6aXz>$r4xPx0F`&Sn>-`~^(|H}N?(_sTnUlcFg!?tiJ0Ca04Q%;x`j z!l44M8Q`8HOgwChAPnji{)0!f*P+GgXZ(#&IQ@J|i0HoD=dXw5QI_`i>OZ37kujPj z%nI`QeQ#VXKXLY=`C&kmKZDAzx*{_QwP9;r3pw36Y2r~ zF)Mg^(J4nAmS4VcY|*(!aJ;Q8kT0>j+_g}&R=0Co>s*4k?CO-gQdm{aii%V-YF*7K zqw!+vh*Y3Qol3}8iraA*-nCLg&8@NHPuw-uo4T`)-(!1MRxET4r|9F|rQYr2MCT}Q z;RVg)3%0qeu){UQo`tkH=b?wy{@%4(swq{dbJ1N}whnq0FMHjp~}2+_hE{^0OMWS)=>}zdKepv5#Pua~!Irk*e1FdXHz^#i`Tu4VKE8A1$P$-jK2xqvN+f)YRaDdsC z@7eIQ{tMNNWVD>bBkF;HtIdJoDN16Sx9~(uBCLHyPGjH4=Kr$9p4qj;1(j%)4>Lc@ z{c25rv?2i6ZLX~?Ab%l~v=S0+D%8&3(t7wjd05^w>7PbUHZ??$Tz`N}eoN<0qxIwS zJF{2t_qX&RSDxE~gHJId_)rUH{HG$IMSJC_5^SM3jk-ai$NEDHeu-fWMuL6HwJ%5# zz+=o!3WnPZ#hgdvvMj>d(F@xI0cAj1BIzoTg%%rg#g`%>^*qF~xk=)v3cdID)kB0! z@|KVeMp*mEPft@CTc3pN4oyzS#*R?!j^Y_Ng$-1WOAKC=rUIwh)>hziW4*q>oy{1> zie9CeQ0^T6f?~P?#|;4>O|lw;jfRhs=7%b=;K)|pJva1E?$91OhqO< zbx>|HaT|~(6lxE^lXV3%S4jVCajzU}7r;p?GLxx~W|NjjnR5OWe3AGFMa6`QvC1z5 z1QhjP0cmwFFe!BUbT^GSHtISc$b%mDK2HAw*ZM*<)Qjk?8d3m5TkEO_5q>fR{Zx;{1h`igUk8yTSdn-&QBRjNQt`)=x)Ta z8C825TctN=+_*_-MwhY?+wx^xW@^<27g9$kbnNTC1B`Cn+`7U!v;Pc`!^n&+{@ewENr{4m||m0Yxcx zXcDfVO$%*7OHu*=xVDnfq-Go#$YvJg^s=(ZQy|hZ6jkmyD=1V2Wj1FlsC*N*FQ5GU z;r{Iyxf)Il1# zz>gaC0r?CH-5cBxwO!7sTN2Bmcf=(*CK7s$t^6(<56i8teK|v6-I8wh-s0_12Ct?% zu3GY9iD#kSrE=8`YRneg>=s=Md`m+iUBKr3zH22~He`4eKq)%1uJB2{L)(altMd&m zheqfx2tOd<`eJ3K%)`k`d^t?1_eBC4P?&9@c=r{*$eQwRRsIt2<$7+=6L#O2f>Z9$ zV)){0aBBX>PAVs|!9#eXIoq4a?=jwtqGqi=`7K#Q@AP1)%JI^Pf~L+gLMwwMDWDNV zh5PZB`cKl4m`~z?INZA!anUS3CzN<&hxAY#E#7;vm-x7C5 zW`uDaB1b^Idz&pZuvCnhZ|6=&H5F_L*=tbcXu|7cP-T6}Sz~v8^+XT+iP|Iq7jOP? zH3JuhX{%j%*uF_}#hwdT=#i76V?0+Xjqi2F_p?+@wuOGXCK_jKHmyQ@Xo|=?rQ=1dg`X0e}zexgC6sKy0HFpknz8_jarbW ze(1U)3yf9c!m%wDuZx@%peJx7u*Q~0r-ofQ-panfVGcoXMdh}5WelR`PNn#la7DQ* zB21ogh}nM#JF*y{U!kwdtJRpk)D(HJI{I=^6$O6BFOzM%G@X7u-gkcYpA6y@htTs4Jr>oHg?LYIrubXr{+?;v=59UQC1S(*4Kx@tx@YdOMk{aBcV~-W8{flg*}?eTgpF5`Jc==S%WF`ovso zEdq7l*rs9_FG}Krp+A=xU-snr>$fQ3p94-)>ru7GZOp6!hg5dxqM`pbs6E@PV1+J{ zI2{I^iZWg%J()DebM}O1ba^XPW$GW!>?h;+=Qf)jygT1<27A@TpnQ60 zPo<}Vf!BNgIOu(5N*>z()l|v(-`aPxuyOz2v4a}GMC?&Ja?gKY@-ipAK%qQX^^kXV zSH0K*Qpso0r%b(XulTe{l`7_LoG~IArR@+VzR1hhuUS3VZ%u7izqnUQmUTYiar^@3 z`g;G-+P1Fa{3F{s{{xcO>Fe2O{|`u>{vSxb?VIqnD{c$ej=s**-gnF7qDJ!X{fUZ~ z{pEr?;gOZjW9up4j=GPK;e`MB`Y>T=j z?EE&CZ3niJtqHYi>+vnUxa6}*%Utv-^>}|2%u=r-TwvZ5@$H6d zaE|mP?jsfyV$RLvHP**lJ|mkd9ens1l`@kOCrOZH;YKTF^`TAM!cn0(XN9qSWQ9n^ zQKM$)c~@mRoZT~y+g~|k1O)x@Z{N4m!W$vCOpkV-slh|_vpsp?K!ihMq`)6Zs1{3f z=H(Do-GBrcYNd_1{cmIu|C0RXE^&!4Erl!{i_|l|x^&y!@2JGqoV?l+*?h+1&89>?S$7^U z7A)B0uu*x_MV{LAn{YF27jjpcO?jW|W69B!1gHwrdkkP`-pDsuz}O{nz*7=&^@~0~ z!>A%w?N;H54F@E=;r2zl6YEoAOq509#_J6~o?+4V4mIsu^CcMZE`6|`s~*K%f`_#e zRh0EX8^T@v#&3e|u2Qq7ocSTkEW&B0bR=hTOTc)+lPj$X*XS(fW9BV&rPI81OfZrD zUd|Lv*1GK(Ka;U55hP%x3w*$@%W!h8HeIOPBrkgzioqgq~8gA449?OnG!uS2ARuDG)E${w%Oe6O_?%j42yk4HG{(q~C*-30#DZ8zs} z`KO<_IPZX7s0A+nc+8Vm-d6JQ>_!;U{1k|T_dLSRsOlR{ZGO&8(5evf2E`3&RvD|1 z%w&;sUs?ti!UF(H#&VlMaKRWxR3GJ32EEq*e${>w&#wHLeu=~r9{0suIwmLlI+h_I zzdiB1aTgnj^%VibKFC{Yx=a!Q+)2ef!~krifk*L@Vq8q^sxOodBR_K!m}b1J7em6F ze&&WvE=5I!5(Nsa?J_1usgdnof|WCBhydNHJxe5uGC*be2yIz0 zrlASC!tEMtO9TW_^~wqd1Ga_SFbBnml(?e<_f;Ir zoINOmWhCwqMvu>it7d~h8(5!Hn{_MvO=IZM_m(C^yjCr`oy(Mr+}RDc62G1;0G zNom3fe(4F^n(YGRi&c~Sh&CaVmutK>OdftKF`q7qL{C-ED-kiYMN*5Qe}u}oxIZF9 z8aPX(J27+#S~vNtHK5FX_Q3gA&G2Phv{&WJ*NRuC6xEw zd)wmbt$$B5!lSmgz9XKl+)n%sxY4+L7l(&0nnQByR0d*B9`A2K1vsg^51r-ar+GOv zUWpu<{n-d{5vs2Ds<_?000tcVo~aG3pqSjc<^-eHA{H@4G-49kQW2s_lGNz$v<45)$4%|! zV%VgChh>9eeRpU?&&$tlRv_jO@RBXK?oPR@<_zWQ>P32x<7rPje}@;>g*=pinHg`+ zmXs?CK7`@@l)N^E%D~u(7i**YZ&t1vUqZoawp5KhmjK}y80Yp&qu3Uz$CHhdMF*J= zkXwx-KeNe`=9lrF8xbXdOU8Jqx}^`?S!3%+RDf$f#-1UmWqkXdR@2)m14b4GrE$D& z#OEY?D7+_Wtad`cS3APtg)U8`nIWG&E{wk7C}Bf$*JM7U;--oN*n*tfW2{GYNd!Yr zRX08NzJ8>xgTRF|(qenTeiy>sBpP>xgCIkwXu&Yh3yeBzWhVa;0TQm_CHv*Wvl?`h zV0$V()1UGI15=zFKKi*^dD)(_3@7p))%VtItKPwgI9zut&lsVGGb zqSKCooGXcX8u0SO0~U8MDEE`I&T5Vun1}$b%RfIZYJ^^N7+{?MNH`)2pytm zr7b+DY4|uqCHUP#^E_kYTg!Y*4*KL1y8A%&cm`-xyjI(uyL3yRF}Oy03{eCc!6!su zd2pT@eYSp_dh}M0k=GNyak@p2KfXP-NFGO9^o`kLQQD3^>Ph$_HY)EzpCbFddUfecDeDv&D)5xpVQ9tHXsn=SC2}2Fzhf- z+KiK${79=>@!FN93u5O#Z0f;EF>cj)64pi!qn#~+Q5HY)n@D+>Tojd-8o_uRWLkSc z*mzBtCZGtrd|xIjH&s+6LrQsfT;^9m9*GsoQq^Ps!W{>k3?2H7NBrfEat+3BaF_C2dMf?)n07Q-YiN^7G#2zyf*fb{F zT>o+>zBe~!53`PkR>><8cD8rmrYl;}3tOm2Spic;DOIaFzheaqhhva@b}CnWI76YD zb!DVJn&TO9Y_V~K$+(|uVgTmdAG345c5gbwMse<>sz~Jm5zIu=$OI^-ac1?Ib;(A^ z5c8$-P^1sO(*!7@B*mMQZ}T!BZ4xRvU67+iQT{MFV4nGhF z59(};vV4`XjJt;XgN`S9HFx6G@n`{4N_JXWV>*sNNB>yE-U<1rDhc+q$;#1yvp~n^ zVlj+*u~aK3ePT!Ok_eQr1dW<9t^3VW zf)5IIBQGk}BWtK@_(Jkpsr3)74qao%%h~Q+s7F+$f<8sQg9kDOExHHWfwP0|xe4&# zBQM&GupylzHnRAe=~E%QoSF1-(r%(o3$`gY<+J1Vvxw?$*D8U!m#OlyT5)`(>-?BR z3Z{X98tH?v#HzH+5Hc>&@0Prl6cQ;U+zC1`Yoh|p)OU2GCfSO-`WW=>1{kDEHFIy$ zfRlY)66SusKfYmxbb@Tc22WaV1MrkehvRe;2BHgDHi?4+Gr5i)UAFfXi zkxGUh?=}-#*%+vj3S`VP(SK4R^=#e6r)witQjl-e-(lCJ7}hmuOlMv@i@_1r`z4ug zf;jF#cT*gjg)! zob{~a8@)SAg&7ltkl~z5uXiknaN|;Ea|{K-CM(vS;qHNr_Una>#&QLM&S13CC!@B1 zg9%+_2G@}M`}ERZ2I8^NQ*9=KVKGVla(3wx(ZP`8qAk;5^SH5HySxF)rFJX4R`r_3 z-jCfXAe3vE`pFxzH1bDH>y%TSXmEm;I{oC9-V^@C=g;pzzfPzSqBvl`UcU)N?1(nh zhG9zdp0!)}FsOW1P}^|=UCa8$<&#?d#m|q2106SWW;Z{7M>c-{P~|@V@1egyQN7BO z|Ap>h{cjcAvT`u}KNRSZe?Y7M?enR*`&V$=^M49%iB(iMGQ=AvZco(`lBu*Cw|se_ z%zbuBsT;Mbd0Z={_I_NGI0OG4%~WN%J3`&3`il-RdVC+=d?O0}>ie72GctgKZZDX+ zmDL>luS0HyD5vu~{pUr%D$BgtOz?x6(W>#+MDz-w{ba{0-|SSe{CBcM9t9z&@560V zqo0%P$J=L|pb0??O&C>Sab%2}=pC}kJf29zyC`(`)EDu&9&Sv*N>}`0j3&da^n=#_ z0$TmlZRMNPxBab_eF*M9-TO7#F#w?_`1kQ;ZL99J2=15f_i@_JnE%qcQ~l~waGx|k z*m>6OEJYHljaPk9;EVJv$Eco2g@p(3_6|GBo~ zax!Xf`W|5pSZTUsBva)iyt0SPf9yk@*VAKGsQ$;WMmL_WR#_mGm9CGovK2*@ z>O0t)o_W!;?X*g^Tjt@S7ei!rFLx&v;j86M?82p%Hmwh0JCYH1-ds(QkuEX&mW!2p zw4!#2^r@O8D!R;WH+FOBwNr3o0w%Z37T9mV5dRm4xW?idbvD|PC76*`4g`e4fxJKo zf7r|>@P?0X;^>?)VD?3ghgGW}v-5bfY7d2zYpqkxOMh+k93oTd&3~n4j)gv5tBhHV zc^>8uIYFuyDmI{HnUfdyLVv%4gN6UtLZ8J(agc}TLEqQuMXR1dU5{SXJ3mlYvt!zV zh`k+aljirl#Ua?+Cd`*p>glA)jL%kL0~+qG^QvsDsVQFIeBvk?1#9bVigXRW?0vWY z8yk6nbV-hJIeID!JxW_maOI?9Uv7ByY=mC%4}%#;Z@OF@P6O5B)O#w+@-q`M4x+V&@U z@96yz@cpr1(z`5t8t)J$NmELH|G}lNbuT1Pkhrj79`_fQ9$dL z+~VSqjr0^K@LXc5ez%?$SCawc!M8|+2^O;RPiLF`-59Z*EF#b*m^b~#I(WxyKcbe< zQ)GRA?Q=BcLhn%I2Q_aF!1DNBlz>)#t_l?x)bhHF2hIp;ush&Wz5L=5jQFH~mvK1f zB%5P-ZU88qVqcmfHvbbUB4QD_AWtUDP~nCF^MmHmwpB0V6m&_zA{TN`Cs%2X=clEN z;y&AJ7kO0Ge5LtTv$lS&;;*~+y|sRni>!t0%VKue%vMDA+zh47Ln!XD7P6BW9!M+h z@@$y2Y*sJ|;TG#k)3edmRVF10=&`XhapW+Jg?WUNV<^51lO&T|Va|!~7;%Mqs02?a zbxb1$i9vCFDEJ{WcU4OwsnrV)Nmw6I`S@<@k#<>AkbG_v1q_h8UM*7i* zjufGs-uV#5enH5Lo5*cdcO=qmNPU4FtPF{Vb>gA?@a zZ%9@GY#N~8ji=!->&t-C5*AhL*iZUHZyAJ5-Bc61ug1>5rSQcdcDJYn0sP06pWYkp z-@DZe4g&J@$*RtADo@^J+nIZwaC&*gb0bb9xpzT2!&kDf6N>a#%U}9eseONxZ7x(S z0`ZdZG@;3-m}i!(tSiAQo;b5IY^jz)@!(Oexm@AYMcVqwMU zW-DW(!W))pJaxBH?bf9?W7w8-Qz0dx%yf6q0_EydP4K}Vb-BX=&L#iCo%I0bpg>f? zBw+N7pZC|%0xQO7xL%E>^ULX$dktM(dqEA(UjBSqhwcm3qRk%q?(ju4o@NuY*x#cN z-r-8s%49hp3UQ4yq-&Z)M0t|@fDHexrm;TwE~3!RX+h`_GlIVydj`&j5m1eSf>Q0>+P3MyT_U1&l-bDu7iO z9G^H(a{M3}$VjMD(9e07P-+d{Q>o!ool6ZplJ3)=8Ku!qoqTJZ0=(0d4TqS5Pa7ox zBucBwc)v}HSHE+O9WB#ROrEZeeiNI3)mwBKjhE`;~~#U0!!ZQL1n9O|6TWP31FT|_-K7AmAV%gwVgmWp-M} zG{4!kVY;WHZnt$-c1PxAZk4<+&82%>v&?GfnEM=AZsd+8&t8aFzrmcD#DM#S-7LyV z&XZ32Ar=hUGB5sq5@E4IJEZxsx18g~2FW7@3!&VtG)6V}F$w38+dR5wgLA(3YH6I0 z@XkQXz8mwe6exmyd?Sx&R9ug{D89tr8BYhazwljg*g(Q~n15)$*;@GfZ|lUNtc1jv z=tsNus>x+wU59Koe5xYT%QXv%^Oey|Zl|2bm9fjs$w-TN90hvoJEhWfg>Qg2Lb>MY z`m{JKRG(IbMhCmj88GNh=kc@3IzQ>Ie}@6|c*A(OZ9BPiH&%uK1Olp3U-JbNGi6JQ z)KP+|xLeJNb88+;2Ha~KHv*B3H$d4gj9(+b~_KsF^)_Ci|W64OPtSY5Lc zk`=S#;8r8daaX%gz5 z`E|Fl+^^k7LHWy0$3Z&akna)MDq5|U^q$c-K=f9f+>kbX=OSrQ z+JKW*r-2a8>hT$MQQ)1BGz5%A1zq<6BQ}u(pzjKdk#396WpNg1q|`RG>^LBCI7t;W z1K^QOdMN4Uti?5hOe>bit>p#N;muvq?7G@q?szu!GfrKe2?C0ZH*Y(rt@TdTR&IX0 z@|(Z%YooN9D0{7}HM3=f=4ru+2@!3Gn=>Kx=mniwuO;D#%;;SJt4sKFNuhklO!uY$j*y5QS1H}TSiid4IH zdfM+@{iCaud1;(daQ6}qFDqgjj(`1*Dvo~a?9zA$UFj;Tx<&XNp7vYId-w=X!>8g| z*Uv54)>r%>Aum}zpjvdhZR}bse;(x0BHc4_hjsub?W1k0doxh|guL^2#C0Rg%`JK1 z>-9vM&fSv+dJMJG__b55KL6wPI)mwuiS{{VdpUFO`d88ns-;%({d*~X^n8J@)U91A zhWa=*C_r4a()j?Z0M*3%W}H*>_=|We!(Vsq`*!YKR?qjGuM=4myiEFit*e& z@R;)zfW0dK_yGPsB}?%RR7SOzl>Xo=mZ8XJNK0)Ja&37F5##L@{gZbUNDS;`X$gRs zd+nA16r7jYwblRZ#F(>J z@}aXdqIiUG+xK(RS9Vr%@?Qx{w*SsSjfIPyB($7)4@X{Tg&BGd@42;-;`$F74X_gE-s%)~Y%M_kY)M+Fcv+t$hA#W_J8M zwqp#|^Y{Pj>Hf+4N)Kt`viGjHxL>um}?;#jP%dOHmcn!cmfjMu#St!6zXtSMUW^y+`}y`DbSPWvBK zd9#w=^N&&i#YY-09)vYTkMBxmR#(g`#)>p71o_5iBOUAfK2w1OX}}Bm9^wIjo83_7 zdB8b1mppieEuv3VxDAQ+D=t5&@BsfJrO∈8Cxem?LdqL^m)Z%#@dbJ>mYnyTUk< zjZsnFJX@Aa2A`U!p_mxW#Y_OI!}g4R!<4w_3I#9AGCLD3KNFdhKB}At9~ME<4H%Pw z<v!bj&C79kRxjh8wv6qLs5e%s^qd&5Dmld%Q%Db-2j>x4(D}9<#DW49 zSFctb$qWrO{1{F|ruWs^P+rO< zvzhhCrp>7+-0z{sZgE&%@U5N9OH08G*0A zumn{{RI1_vabKZ-S|{X_bSoWmJ90_v9eor7hg&M9#jRV8av%e{ozVdSY2yw2{fe6;! zd91Pz@X7{hAN+DwjbQYJq=9XGhr6yFR^&dQ`9#(OvOvm|r8E2V})?V_-m=*&mSud3dq zjkUD%e3jrvd%3aDz}EZ+-Lq|DUc;amUx8L$5j0;*;&a)Cp2=5R+uLDY>5U7JLq;oS zWK#v}i}vpUq$`=Y&Q#I5+BrOhD-WD&Hu^toRE^HGfA6br#d_PEs~4NM&zY)Fsc&RJ zS%Wsfh1|9W#iB{`cpL7Tm9I$^ZFkM+J@QxdWHZHvNXi+h?#4qi8A%j$sB!Fnqjp0@ zH>+2AbV}MgE0P<)l%n_2D`^h-@+jTn+q_HVb0BUz@UWK(Cr4wz<5s)Y zy2M|$<4GBs;-p9DWrS`EO*$ZnbX;59FI~+IXA*WkP*F&IRqXK*;8cTfUm8xO;k1Qg z+ZC^KA-F*%nBIN@-F+)0Hjcbej=b)7=hj(~vYEZ*G+stNd+!|3Z=TKC4LDI>%$C^S z+{G7z`=fIi=(dSol`v6K2gx6M+3{vVT~RO@%hmwF$rGu7;zFDTkhYbJ8H7Uyn?#)R zKy6i;6`BN$j)Yy_pDYmLWLAn>lcMIh_X6*+;}OGge@tU`S|5xC1pSB5ML6J3k@XZ- zz*3n_7~mrCtkM)~mlpeE1xc3fcn}6ssBclA%W19B=91NT*9joUx0TUlGb0klipb%F zUlnH5EQYe-bdv0hQqEEm3_heRtX|MYvs2ti?}IermHnfWC#Ogr8{nGgY{(LN*f86 z@FCd;{|sR_2&4Wo{h zst$oRojAWnt0$4nQ3AsTKUVd7$S8~uH6`o#DssaHQ&_ULbSjqm9+;!!;&>;$MOrKTll5+Wt+cT7AlX$WE@gzD7ZG88E zPrtjR<6di^1RR38MqA9>wVPm@SKKiE*?!iE9Bq}&XYSeSALUUQ%45D5F=Br&n|RWP z93mf~u595H^;zoXeXyE~bxnoq`FZHbL78Y<>loJ(!UbZj6NT4uQaG*t~pF&`kz<&BuD3rFf|! z4n2x9;8|5HK+cGZX}%b%9*O9B-b&H97%cBQIzX=F(7-qej*0B*4SK4r+w18Th`XFd z{-i}Ag*(%FR9&mz%cQd_3wTgDi1cZu*oSj`EKc0dkB;beJ&dH2gu1BE(SJNz-1kAI5UoXY{h`atO{yK*^zxcDBXO^wZ*OJY({QXN&{}GPMDTFjJwzhfrRG}w zAq+`6?g=_XCbj8MSek827}GKI4Qky|#WWFEZhA*-ORWz1yV;1c%|9tqOc`>jcr`DA z*CqhX8Us2|_ z&)eYxQKpCs`QHp@%fWk}0>TUHcAy=V;l1pPINumaK;w!uH1soI$82*_n7vD2us==q z8wlP=P?=Wm*uKDuSVpd#w{ZnO)0MGmU|pmwABNMGI>HL@PIa& zCFI$!O@B=nqX`YpoRR6$Is+BXt;odezd-~0L}Q%Vg;WoRl9Oo$j29&5ih9|-T(}{K zX-}{_Z;^g~J-L34r;g|RS<{H%E*#zy88ywoq}-JOR8@=ytNuG0OpZm~6ZF62xobyH zlHq-HTUy$hZ9TzlH60xtT?Zahy6iUp(@JuG%jjR`SguJO1Q!Jm!6jFR?z+hR!M6mhn&-l0d z>uWu_{_r&}Pa&<(aZd&-cx<)~CPedQ-nY-0AfM{17)k@Q2NA$^SjE!3DsMJc5~u{w z2ra30deBdGLkiHCdXc0M0sw`T?oNk7FqKv0qeOUQ%XB%H(IQv#d^7g!?a`U&wxDD- z`>Ml;L;W#siGPZRW25T+YSnw_NlfOkK9_04P8^O$>8`X^nF9FRP)x-?w;%cL=A|K) zILzK01WG0%8cewB;xspVcqB4V>+qS)@M!F5{SLmtJ>sM?Nfgjj^t8eYlxL^mt*c%jyz0J=tJY9q(m;>&d{7-W=pR4R6WU(YYB`8=wZwe8ga1 z%&BI5SWSTnqh)X$SZOAW( z>{IaybtiSC2qG{CH*!A`&pr}SyJ?Fp>kYt4c0^V<*a=h9Ny#Xg_nhDCwp4@)*h^D% zMDb&$U)Z+^2`pK(~?1U_|m$nxR85;+wAtg@wAa zKS`Y3(kysjZ%V5dqk$a;(J0*3W$-)=`FL7zK4PDMM254y>nu17J_$tZoIrm#k4ul% zSalH}EftDp>A*-7Xw+%+3G}56!|uM72`JG~YowTDOW7WNJ>e2s^^)pD#-OGK&TIo^ z;4!m0&nw;$06) zgIH8qL0pI_R5J(3VK|Q9LW+Nc8%9li~wx`%?lw|^&d)nIWSKxd{Q2gcJ5P@ zSWumC5+iX-ZRA5si&8YQk_ypOJ$aJ=r;+7!QWXGe-(@o6`mocGf)c!M0Q!wi=gHOY z8JUU176RS2GBFIRQg?&d37Xc;3`*kS8Y&g@l5B7Kk`3R`!utlrPgx#~hn~KZOxYsn zCsJ*#$98|XzAKmbJv{Z%P3mdH_55C#fId1IUEx6`8^GPP=#`ZUD$j)sy=R3T3feKA zGmUH&jZ3ouX>v*t-h!)rlPDNo5@m>V1iH2mE2R7m>vhm_1NSRW3Yy~lH>F3(o$s{$ zW{oF=IufUYkmOU@@#tW2A7K3+TjLLo6WX*{Z(V$-J*O`_iSMn*ukB_ zw@1>nDRNyPBx{w@y0WHWin)|hQY=F4E|e9;mY6SOB#v9MnQ%|C1_t=hEDn9Z!y}8K z>x_))oN-8S<(b&3^{j;f^9XKn_$@!9gC#a~AsO8+5K-B~#0dfAHrId{< zq4&@C?tKI=rHQF!AYNu7cg~h-OW?w93Jz;SlDe5630;jKsfh-7nU|4dXPNMx{?}xu z6Vp?2zTb?d znoIgzicVZIpe1qkgP%NyLci{;JKkPnfm_C%;|h)cYSeD-{zJ)J+K+fow~JGi?CfNE zM75(?BhZMr4}}*(&m5uR|w}=7Vp?To!>2J$Wo0tni7T0tEGjv13wdfaD9KXFL8~U zKa?ZAoQG4(`tF82bN#|mZ&99C|H7(m>{48KPY!Nws;2VpISn~w;d@Wp0Ho_8VSDTA z0GMZmpx5h~hxc^-v>kCgvtpP=rU39$3iv%^h#0pLY<$cOW0 zgX2XCf&KTKi!9xdBfJEZ_y(^`A%0E8jA&B%!7rwLz65(K&(hFoIf0+xu}V zV&Fv3FVQc-@MdV7a$rcYTJuA%n7)?xoVsM$7TA)>)ymO{p)Fmv;j$sYvev9~G48n= zZuCdYSs(Jj%^<<4Dxn66ts$*$1F$(S*x;E=Rb!)}6=<3RGF($U7_I@o90H zdk*usR4|2DfJ-QXfgwPwRqBM%GQq6H8iqI%6>Cyn_0?sdl8V@f4=r-E!%J7Q`_+VG{ zt1`{szK%^py?Nzm9C7=^aNr5y9Ot-5rk;IKJ#Ux5uqEJ;S5PlX8R^Ar!(NpO1t7+; zJx=)LFn0-=COLg8*{WNQ4p3VpTO!y7heEe?(r`stK8#jPyIU_*G*f%Rw>9L({oZlX z*_G=Si6pPV+&6*2gEmC-H$5G9No7%`uvQf?4OG7O#LC!8P58t0z!tn%%+zL|24@$N zwu$BKAzUYFum5_m zv+IwaFuG7_Ss{M5NK*PyJ2LvJYeqwvXOA6W2kv|*fN24*nYw~lafF2%LYC;9Z~whY zNy|Mp8i-1MOB(#w(}{D>e%JIw;|OT&EBHj zy<@9<+yPEH-%$pSj6VD)%J^a_&V|6tK{Sk?c2n>;8RPd{9YWAF9eAtXu|J+^W%yuz*1Adjp{>ze*6 zuBQk2pD|d+ZkDj{fcWgTiI)PUbdn|5znt&B-iWm*(ako`iQjQGp^U0=E7hwIhu>`i zS{2VFWvLhHw|!F)MlFpdw*pxkUq#L^;tW@2Nbcb8r~SEnLOJFp2rP217_ zpzA~&!O-#T})+ zdGJ3&^xqPof=kbrL*Mp$zx=PVMtev z+~`b<3Vr3g-sY#bnK1lN)nzh=%gwv%wT|9MdHcz;|C{e@`9F04BFlcrn2_2Xw#wwQ zo@{5;Q|%i<*b9(vnzi=1%r$}f&SjasA~(+Ko;^rVTbm$fs*;q~&$W3r>Z+*!&+WBA zn*o74@~^I+_s2i?h`Tz_HZ$GtSs;JV6}I9M4uRG8A%*L)Ecq=1S2>L=Yr4kGSA@!0 zv-(w($vqh_`JjY0oeopr<1qr{RS54yAlE@@C7?~Fr)3B`48Fb4|Inu+R1S?61SGok@6Fh)zo8iVEbsp_gl+RhD%ub#;!;+0r5&xx|AR{VFBdn z=#J>t-L<7PCc0!_^NT_ra1pDz6EQc^@DE5Zr(5HtY)_5IwJD<0MFMr%l*8n;?0GDa z`;!K9<~i7k&eb$BrN*&Io$UkND9*)fFSnp3lXJ+3s3MC)CRSK$Hn#o2Ip2!kd=_F`TV1_48G_jH=-{T~c2ABZ_c9 ztUyR}aAD4Qj(2u1=XEUmhwH|xEvM(vKlVZy_K#ilaUbnsX|5Nw_BiRaq!kVj0G3ad z#QG@J1Jh=_T0ZTRp(5{RfFJ6uBu7@Zrlz)ppg}o@M~fqJFBl-_un-Hmho%doi(K?b z1`y|4yNj86wl9UnFKbUW`Mj59U_R$*3@Q~|%MEiSrx5Mjpbmt%?+T#U`;wY=HeeeX zQTS&piER6cX@N$>6j-CO%OQru6BA4s58(#abDGsxvw>U%Sxm$^Z;;*Mj~EQcbR@+z zyTxb{0dR?OE7sM87&0%auYMLY_^OI= z^*O{=n}-T#Udnd*e_qxW*#f5mn({Ar zoz60@vGqWRGBdVNekfj$!ZVA;`Ah}Kn`)R85`4zwcoDVaz8oH5LB9RX9+wv&PM>Y) z@O&xyKsV+(F_%BbqP|@JD7?nNgkT5J))WXN>D1Ztr+5Qd0_xlqwU%!1$SiZHVAAaA z4A691PlG6V(_wE&4Po9J^i(g=dSo|hOhp$5#8asSy~oS3qBMQ_hp zmyCoh3}QQ_Y$I2`!5)G~TWH<0cmQ{HM;H+LI9)f#PMh2)a|FA-xwCSdFqb_4***Wn zXII8f73&E9ty@5Y_fz-giuYwiKOjip&XXT~uZuC{1R3jf{_oeNs9o(R@m?#OxiQ!F zN~4f`zc0#ta;k6EME1=xb^b%xrn9k=Oon-r=ZD8dD@sr7KyQn#cX?-T_P1txaS&84 zNY-Np+G9tmipJ0iVA%3ton&b9rgWTjCjG>6; znv*sMb+yDEyK#{zXN%IphWxENil|d+%)5<*; zf7Kpr+@jqY;uV#;E!&HGdbydiOootN(1y-!gEMb!)51HJo{`HK@0_O(d`P8+2dEB+ zXu62&J_v4NGkq8p`w8#Y*anr#&1!SwJaN&V)9dIWkP4dFQ8F{AA-x^^193%M3(rdH z$AaTkoAIJ9*lBdJC&v7P^B7L%T!RvT+p~a%}hQP}JjRyyOMKtZuEk z=R;urT&1S~NU;}zPtQKOcK-P__j_}mz!~M7!$<4gdBKiSiCu32VL1co8=ZxPwz~Yh z2M51N2b6lYw!irCH;r{tOjK*~_f?(nTIM5qBqm^+D$n0>bFU_QWwnf(|`V}pTVw2$tH!?|1Y1OuUj5ej!l{#W&C&x`?FIdNg9qJiwJH>JmwTB8pM)cK1Q6ahu8hYWI0MB$`F>2YVWjMUliJeuQbvl(o(Xwp3W$xgV36a;8 zl?F9Vn@oK2!Sq^W-=nz4&dohLrd>HHY3SoDQ)>Zv-xSBT-}~e*z!R?fe^n^V@Un4ItDF}%>P%%_!=W?N?)J44f|K~cde@2_Ms2VSGcBHPo?;0t}b@| zye_px`dym7%yLr*cF*z~{#VC%ymedc^X~e7uX{lYVddKCwQ1{W1S;;Mq)lFIvzz4K zMXR?MZe5r2&1h>@Z=22v8P(x_Ws|#X_21XCc(AxmG;JnIHsIH(obt?zknw#=*Z)x|0_ z(eK!K?Vtwr3AKbY>nA>%*7| zZt>jLu$La5W;T_q#fI^!S*i)f{<`vs&n7Y22iyT0rc$e^y z2X=_qd2nk2Eg@NEKafWt1V{0{*#zq!j5mQcH{Y|`mbtwN3a|@9FSg6hwaM(XJgpI< z5r{mNr*kiy^VGb)pq2d{sp zLmp<)DW{YYT$rt7t|kz$WU5RXMW;ffr^L96Ff`mev`HnTi-O z7k5=wlLf6V3{((d95dAVYtP*13(^^vK#Oxz{fCKFlgxjgjr0JWg9QC1pilX4YGd2S z#=dPv9v2wJXnhleBWT6oTztY=80)8>j;)AxVToXXj>hw<#!QgR6PX6)yctYyiLH&& zMVxA-0xW;JfMq*bYAkDXb#5CD2iEV$8Z)H{eI4?wGOfVt!+54qUrC^^F0CF@KT60vY+P=prXGSq9OQ)3lV8tC&X%s(&*v zTdp~msAgW}5n^8OyBP31=n+M$dH%;y@pUf4a)JOgBmgRZ%JG8ck zgSs+c+j5pdW~eOx`@8kq!5A0FqHQk2a-&(8W2k!49Pf_&7fdmG^Y+q)`%r%Q*g-=Ubf4unSu&u&_>w<%^-yH<(|W=Pka zfi_044`;m=DSw$c*Avgwi!Iuwz~*uJJH=pb1}>z+s$lI*h7z<-Juv^^#+MlGd1<>u z1fC)9V4$XKz!=MbJ|+bX6s#+b$k&__ zJ>cQs*jrJI@B{#84`a+Ng=LFXNk~stWzH&@*V6f!A-GfyqnVA!_|Ghwjs0*-r|lfr z{sufxZRw8qs|ZyHSp?kBci-J?!m<`^@>2{>C2R%DWltvVdAtXp1)5B(o-x=kPXsTm z>1J*MxlBpOc21~y{fuviAqHE?PT*0wHXy%wou`3WB32%dCF9%r+f8O39x`KHJgh32 z*po+FWE9!dpEd^-i?$)f8H!km@xsKWMaQ^n74~686#`RzxKz!S6FALHBaap>Q*aC$ ziZUO1>KgDeSrgsFgQv;zOGNW&@rqt2Pn4M%XZ6DQD`>75N!94u`+W!4I$)j(o@Gf@ za|U*!z`&2vXRH};gUQV`4b+VgPYPi+W>jb*YT$4AR^^wo!0GilltuPA2@D$!8bwAf zre^EHFR^df6Tq8{d(0T;!j8p1@eI%TjWGA4Rkh8;^t3D{ORHA!hr_A^kV~Vm&Gl4E z!&-enj@&ijf&_LSOf_>mP-V~5Ya6{$s`cLJ=EDZK87fZ)Dr7P%St}6SQm$8g@6G)e zoa=?8CC9vgB9M$|VEq_=(OdXl0R@)Tu08kf-`? zPkS)uylgAH0dgF1qMCiPuU!@ZTK{~g{o}$bwdBmU0NQeqjfniY#PmMo#xq?c z3s(wU^nP$tV59P&#LL=2tUZO10ZZVQvJ?q81tePWRPf5pId7e)9J3PIn>^4$%7xuD z&}&KhJV-CE*~I#Tx%*ai1`4#{GEE#}nR&`;2IMOq_8O%tBEu9#@ZP1XdA?{YhM}dx zQu;1=Na{YdBuA-%q{D8`EQ7})HHX8rW_runT)p;0?&a37%Um0nP>R}D zZ#P=i?7FpSOk#~FWV)l1w(NYD{&$+#>GeB6UAE+}V%}c>bj|R`#rCC?=sL9a>p^2I zg|Sf4le#NPUau4aKIu+6biM=xjW>hmkVrHc8oD4+QZ#aw&sZ)R5o34>h0X~R8!UW# zcZd1`eOIB7d2({>uP}0K7$D5XJ4b*3>olhEM0LT7NYk+W9wY^~Q9(n8^e=_Dx2rQ? z`DLiiAfTE*F6a3{0|Lefr+TMj>z_8(>GPxsYa7$(ez+%-(RwFJU@7cF-5nXPtYKcD zjNHQth{IVLn8LZY!plN`bZkW0{N>lBr_7L;f(o#rsuGpSc2&~LTP71MO^LgvN-zFh zGjW?u^XiXn9AvwVL1A5{&rag3&4=B5WwsH}hv7HH8O&+S1#!Rbr$%*QpwVh*Jo`07 z8KB03gz;u*58CbE<1n;8i(eTkzxQ@VImF)zO^x7Lb2s;gkaAA7 zT=o`j{Chkt4nQ9E?fqPP11h9>*H?4cfQy^hNB3!!2s(xp5@8VJWtJ`hqI3Izg`0Ij zr+1Ff(Rwv@%|++E6hRU|h*f<~dOwiJ(k&0hPTVOfQ9m^;qS@)SIoSmnI!cF^pVrQe z3l`4Io7kT)lZsF;2R1WDOXsFjWTv*PB$6i?%z7{;=r-1?3O1f;eZI%5 z(v&TtJ$44`%5|7p=#hK>3WF*4TvwH(Fk^XlG&lNo|0S|#odGE+UY-_yL0ToyKDn@m zPCGmxya2UN_QJk&L~562hv*$`Ja}!|qYxO@ok)G84nic}>E!0c@nfsj1liw%b7*1n z$xP+435mRmP7R#|x80pzPz1QNNAzQ*%J6GpZb^$EB?A(gB(l+j)SA+2;QV_E-9jIr z-zQ94qHp{VO2wZf*N4S-XE8ZYsIY_25aoIc6qblD5{uv>zV#@9i3y8OGp(3FddwXj zMIp=?Vl*cmXhz9wxzBBT%x6B6It!Y~zO!=qA+!nRt47y5#gOX8b}4r`W=rvB>PJ_S4Bum`<-2XT=S_gwK)9S5W zZ5dj-}RmjY4d`MFqJ{Aw4!q|fV!x4dho z!D{gm`1$!`GVcdEVKheQzsaas|7RIBJIDXgR_Ut!mr+lDqkaR+HocKCvU**9c3)VQZe@8w?uPL?bz&d=`$cQ@!i5T4+k3IAIx;0b=}{f&S#i@@(cqqvWw z=zUmU?LOoQCx7yBdAg1I{D_ZE*0Y%QYb*T^;d#4D{~ulf>%L#7_tWFmO^x*RSidjF zxA&YAuzw&*^1eW0xGM%9e9qo~WtDsgMPNR9(54L)69~f039&^9y_;&NC`?D^*tE~$ zG;`WTdQ7^*#xYqXxs^crxv&xneW?luN}Ho%>JwO;ANr;|@Ja4kpmYHnJwTMl9ldCM z9Qwi_Px-XlOVYd)5C+Th$VQ7~ks>4WI5hM zJC+zGa~_xY8{H+4Jf{V%r*=^>Jd+6`5o|+TS)TPFpFbL#8dm@#a1on^;HrEM=rKEG z8?*-F0U#FiA@RZtixnj%Cm|6oU8EHlgN@~6ZPARTl#(yGxNl5eG5cqhhS0w9_`SJO zS5AJX%RoK-PokoECMcBTEfXYZJUX$a05{LiA`HWd!+243ev6i5PF4d`XmM^Qy;4C$ z)B>|iGUj@E2PmEXDOF<`fvCSTk0=rAo4s^jP+PS;WAPo`E+m>#>OOsi)zJfgl$us$ zu3PsDH^4G&QZsZo4zo0>ZG2k?E!8ZJs9JEhbc*Ho1DyTg0>QMIVmFG7|6QUuuv8x| zyOM&(RtfzbtGL>uXn@HrQ8;=6obEA2Q%r@dfJ1|VE`JCmi9BVEWEnu+0-fe0y}J>Z;LX3 zz_Zr2CPQo$%`ZBRrcc(PkS^k)A%lr^Xj0dN8dejcpa9YaO`F1FZLLcx-Ewg&qI~Ks zrHqwy(D;xhC>YVnz5vA8P`33Pqvj$-Q0Z?fDN+DcR=^Eu;i_W52Y4Eial#@TuhLqk zE$?LQP*AW@IZBy!d?`4V0vTAhzcoyhpOWkgLgK1Kg=c(B=Sw!-+0j4Q0O8xO5^|9U zKu|ADi$iejNrGkk?#6SIfN)=x*F?l_p*2W0jwg+H$B8AB1A|m}Qg}K(kWmUloa(~X z*b>&zH&bPGo=RHQNVd336=*FX<>la8fxPSu^%MY{V` znG?Y|dnGp1Yz(HccPRpsGSTflHuM0`*g&OAZU}#rh1j6bi4adt@D3@R=^15@foI2c zb3zjt#yHAXnLOBOJvE!E_X>a!A92a+hk!5C!B=Y#H5DMmU1G|J;TcLq!KZSD(LoBn1Y zuTs=XxEz$9L%d8`!4p);_WO;3Qkv``Qb`K~-)s?;fH}9nF@@e>Vpf-RdRS+kI(IlL zgJ^P^Qb#yJ-M!E^LmelD1&Sl2)WukQr+FADF~%CM1bFnub6cQe5Z8`UZgMZ zT?TNyixoT`r^49(Hh)33sR?o7NBME~NK9CMZ7oRD)x=3fif{b3gpLp~>!mlaht*FD z9P@oFL4GwoMJ`v*eEZ<)#kh32C!tT_r6kc3BL;fKZZ(|y?)5+^pamNe49IyfG zXa#SB2o;gYR<>>-FW**t{I7cVl}8p;KrRHLnP6V!i6$|ONemI%(mWwee-UDLQyp*W z3&#fY_~iR80M{(`IsSIiPW(y-FLXd?5wGy&fs)i8;fq?faxhlfp2wO)`e|Nn`M+~A z9keb?NsI<(cos`z0VNAiQdy3v@SsGU+=#1y-kndl{{Kcp-rXxTmfy-hQogQaA*c&@ zZ`q>9b~T$h%?F7LbJ5&_Bd`^z@2N~A9UHvYimRn9Th1sS&l^4XAJDnoo2)5-tnN!44;!8-pn6IiwyW2+LKnqd_{Rm0mewxZ zA`u?Gg1!|?V~3GN-Khi8CnuyL6T%M)#S&yWy%s#Po@E|5QJJS4{9T?P68`Ezl@88m9g#tJY7nED({J96!2V zZ^NEe9lX&r>!kOXAbiV@5i^p2KkrR(3AQ^BIw=z^r+4t zKZk1!(NeC)=1JI{VMo9M4X8cw^1c5S*#*-}A62u!wKRKS;~I=Ajtncdj#fIH?1=3+ zAU}v-H6meKS@x)u?KP|I&8A``ekvgo={XVf8V=q|N3|A?6-cM+9*iU+W~=P|x{O!`yw5!UNmD|Du0!!TZ`_J*$f| zQ9Be6N16wWm9)}Wb)Hyf5)FAMzq29@3_0a_{{smh0@?vs!3;)_8ja|wX^o(g-YMW0lIsfyT zHdgDnZBnK5(PX|Xz?n@}{@LrxK+cl2d~m3*55?S>aq+1Nt#CVe@t8aALuJl*&TkQ- zw<(KEPD_wVS+ZV0g3m{E!HOG<;tj7sC12skza7IkMRosCrbAhq@kMa-aX+g|a5K+q zU1wuMQXS3UB#$U5+s!Er_A(=GdW7n*+hV8fL(gq-Sli&*FjBx(1}omgx0cUUd4!f( z#`&SnYB3Gt(`ZPlU$frjku>5ziKOBGi%9Bpf6GlY7Eh6qEG>u4fVEyxOu~dQ85QI5 z`TQ@h|EbWLYuif-KUeh)2*}%etfSxc`*8g{)Z3zkG;`_nscM5i4o=uFZI;*F?VbK@ zpB*^{9g#{O)V9pcsVm`nd@tzfOS7nGYWP;m70MNke52k%zaG4@`uRF->l@@^s6vq> z3xU=+6or8-?`JJe{>P@dtC=Vpv@2;1-8b0)juqDBRCf5@tN!h0c73F1t;Gyjtk@D#Rfx zwYTlcDrR*gSBk@4k|X^R95*+LeE2g^l$#F}@gsMN5jL-Mc%*KzqX zZ4oA$JZF5g@|MIE4c_|AW`$`LNYIWP%b(@JaW}A1)(n^4K@=|N*@g;(Ni9|q3msgqBVJcSWR)D}# zc?Dxo?(=W^3apk68g%-O)x}i#5*FJQCocQGf~1`L8Ek@Q?Gbi9md2T3G55s76WumI zm@1i}2SWPJAeuQkfC5z~2Q8GE_t^04p>B~A)=mP>_mfpx3X&i-aaw{&=)T`y*JazY zy9hJM_A{~WFNiS^Gce&J#9lJQFzbi`W6-zM6(Mr13WY6v29=UeXJ8tnBc%;wn0E-d zb{-ZJEE#I-z|ig6x+ntG5r?`TV}N<0LWJ2;9<(G|&SLKB zUv0;#aoUQO#*5%{C-F$I+VTa`)WEX)5C-_L`INd? zB6DZud7EsTFg6vR5Wo6=Ww>l|`sKnvzP1f^uXqb{Fv&o=O{$-RRUq)g8$2XWQ04_K zDS1Vmhr?sHM8zR_COv{mPO%xKXBLC|TPLiFQ4_rA>eEtw0bBt4Wn;NT+9wfLW??5~ z^Kf;jI+X%t4b^0bD4UE{QxJ$L9Jz*@*{cP$?7b|Q!Lb1-@iQ;^@|*t@-z{sS#}2); z+Tiv_f!Ulr@-y5V%j6^APcn!=$C->W?OtL@^zE75l?U}Ec=viPBfnG`gNj(#mFu&g z3Vt(XQv6a`wgN!o+`0^3%1OCcf=Nm37wbfnn^^y z9H<2Jf&{}>(WgA4`>2CxP!zm~0-QTFds1xmVHk7farM6x^MMqrD|AOC0NDVvnM5dY zu8%lpHXt&Ud&%Dyoh1?$0BLE$elj2nT;PKa=4|o=%`MZEdGUxes3$^)#{NFT`D-iz*Bet8R-m@WX9 zh^OF=MjG?PTW-$b1tN~KZbaOzz$`E1BtA-Bt*v}oOGSb0Z=U)ZOx5tx_GPw2x zHm7L;F|Aim>4N7Y`8T|h$HuspD~)pAMO+;>WC#0k8SZ6&u%yipM5ljoCN?N@7zAa6 z(~6+W#coQ*7EKA=X9o8=gt06<3BVEufH9>Sz;_Ar5N4$2=Ika{dcQ)8I|61U8W%T= zwrr9ky!>mA_q*a?O=T?^qiq6wdW-2DmSYy@j1S$N7ao8N$_~E_&P^pMtXH)U$#Wggy6S70(C0Xu81anPSY9v9bI*fhGszIxA zh$ts$EKYR%3SPfyc23Y(OjLQSc~BW+4tU`%L>_%0eSZu45~OH=)X;uV2|_|QXt12H zI}-89S-{e){oCDKYJU}Y+D>_zV6jlbY(|2_nDdfqnIG&s$q=p8k~ttuDP?bqoovD`r2YHw*&?PTjP09^ws($ts8Z%~N}s z%^OVn<#3=tC7m`=!s{>=cQrsKxB@_T2&CSbU88Da?gVW88DFJH?olP&1C8deM`+`< z80od{O@ae)b~BwCOepy8JZu;`jIscwq}tY6dC*S-oF-}EuL3Jz?2o7Hp2D4*E(%9* z*|VgAKYDwtY17wEWq)rWTk#&A5H*lUEm*vK4UO>epOAS*{jcy6Q~8Q0s2xj;aw-$W z6NNyR>S12-=hNen9XygkFI2e0Az_{KW+8qyZ2M-gt)bR+7>21~=_fcsd4WdTj7S5B z+^k`Ph~ojx->Ci(flRccv=h)y90*u2vMc6dw=BRBZc7L_RA)RcI|n}Vf6*g){FB}j z+uy|FqyO4AVH8PPJ_(+IG|LJDE;BsHdJ*GfMSaBajio zw@3%bH(M}?h^A4{B}+BLu(7ed$Ib?rSUXyiOX(CbNBV;zM*<7Y*mm381khQkBC1h3 z4kBy|(geq%3zI^`HGoi1>e$F=8Rw9qpy-{8@pd6XXic*)o?hG&UeL!WJ+EwFFb1$yuqhon`m9wk@{&=xWZn^#(14+y*c*yUM-0a@ zK5`fr+t$+Y5a>BQ*99xKtv;V`2-kTO71yeV06Ug^Ai9@5rmI~|80$oW+K z)r?>5n=Z4@Q{#w@Kc4WewVTctXYTdkYP3H;ofUz0?M$T7y9xkzh&lYDLc!hVXPmBd zvu2w>#!7@eJqL+uj^jgJZPMJkf!XV2Y@~ah0bV^Tcv$l0Z5IkK3m2SkoTIQ@>lY^V zGjC|whX`*C^*SeufT;%szKG>RncSmrx2JQ*3Lp;AN*TJ2^oPX1eelCk8322jU!5 z@ICI6L5F0GF@NF9XmF0?*scOa@IC-fX?V0HnqCliUgEB?X+h#KdK?m+Y55PbK^I49 zgTX;=lE!v~*5=)i&~hcvSV(JF32k8k&`P9S+Axvqxbi{wh4|w{IQtGd1JdN2XgYA4 zte*q+-39S0(k&krNBOo@HS#rsX_YnhaKgO9jjU2f=Xw`c3F_=zcW1gL{N{@an1%U6 z>7wI|-gTl3Xn}#o#o#pPcXk#3!U=2&O31u2Fk;J9yzM$j4fnS=+vO-)fYjqK-l;8_ zsb4bTgJGaP@p0uSQ!Lg>ICF#yvY1Wex1;%w&Y@9(8@#7?BtCR!r`f?TXPlzS-K`K8 zyWObLg*v$y%zhVyayoam203O&rcq)!ZkN$PRj=Y{GL)|Cd7AoSz3ivr(r7zxW(9&Cf#uFDHot@pE~3>Ys-88q9w?O6QNcn!+@^F7WFV~M?581L z)5f8-og4{tC<|V_0^dGP1ab{zLI}HLW z`hozj%`9`LuzF89bk_Od-XpTKbF@G^dz{_xO5DB9`n}P2&{-Y*H**);|BQ&r%=%xO zQd*NUm;di2t%FM+z(5~HK5l-O#cb`_U}Ci`S5$_qUSBcEM5EEE>z{xD!9PgD|9Vni z624D<@7II$FhBQEsOVN-NB_1HP{90uFL&K;`F*;+-s?UN$ZLZ8yeHGBSCfoi28V}Y z+P$TJyGbkl0vXNEunprRvT>Ty_SFuiYh|Zp7hCQQS_?Ps?6Z4m1-FhL-96XY`31S? ztFn2VaMBeQXJkJUfYuIRX!U{wx#9J3^h$#|NjMmJ>+YdmdhMCi_IYz}Bli5dW)!=9 zJnZ(8ax=dDT#8~cTaa(Q{%Zd?ydV3fjz6vL`t5js6z}rr?S=t$^kX|xELzN>P4qxe38-OAcZ$*Kj?~Q$4PYtnqz^? z=L5I*m`BV)>So+0S2-lVcH4fs+@oYwv+8i2qlA~?MX=-jQ}#Mr5^IClNiK9=ph|Wj zoM^Pz?cuvSpNTKa?J?LyGm)P#ZyS*6rZpEMraTgz$BGUvPYi^oCXh0KCdG9}d$Dm2 zk59f0!of%f zMUD?8@@B69!BjWVbx%)-d_26d9abG=jLFz5Fv9uP8fERq{QmmykARH^WV{O4AEmq zl)RpIler$mag0pNk*v{^Z@pPbz%EVGXWul!aPkMLlfyDAKr3;~7LIDhCB9^jj$TPj z8y^ve3(k;Cj>-TK9h7uO$Tic>=5WI z>)1Tl&YIhFqOv_MK0cL1U1cD{H&GGZ_!d+Zeeg+FjX5a5EJ#3d%`{t*uaT5tctr)Kf>w;vSU~fe7G9%q43xk+r@HT3~6>5{{4Gpucl>^3D zfxr-9;2_~V%`K9Qgxd0rz(&n98_O8Q|jB4~PJF3z>$!hllM%n)&){xLKhCl_BV`nEkz%gPOTyPPe z^n%4a!)D;8sfQB41MM`3!gb75k>;sDOQA6)n7ED#bSKFM_VyqLvl)`S1J&kKYIMki z?MYB1iSbRRu}#V5KP@N3t=UA8w(fjYEVM|zTTT*vP!FVLfi6#{Nnej2?@@nr=f@nl z1&a4)84rxBzSvfszD2^vI0Fz9>+}ze?MOLTz_VnMDBlWo4onu2%~nD*%18y%jkQ3& z%i+OktB9uw;0cx$dh!PNqEUT2tUa0yzkZtzns5vl=k;@*@Ye|uHt^1Szl3s8%-UHw zH;~xcz+wotS|Zdg_bzXbO+%LpBLs=R79}O6#*ZvIkR$aUa9l>1kZ3?mhfwg9s0&i)bs&6QU^l>tz0~#&}wgHjF?HD z+PVZ_IN!ivEGc-REF#1)$>4yY;orbZ;;kPUXD=dL$JBs?un@ryf=Zp@e=%q0x)|yU zfLTS7$QB3%ZbmjXzC(diydRH?`@ry&+goN&@Lq23POzu2&k&i0wyV@^%_ye}%QdBq zx?7vzVGqR&mN0-B-s-}cDSD$MfH;5%ws4S;L{Xk23pF-SA~~x7`2*8fE;`uB)WABl+22nz4*`Ajhg=ymn&(U_w;6kQnlH$8n)jcWor*HJKhQJdipFB z6oj+29GM!^Qa7Dg++C0xS>?_q_h$r2{SlNF%{W*_4RO48TA$&F*%O5>`iuHp28rzFvg2g5+wj7dC(La3% zNTp37LrA!&Hy&l@S!rzvK%o*+miiIEfdDj&Sc4PR6?Jx2PyD%))Vs^n+zobc#>IpJN!oIQ7>B}01Mn4Y3YqQES2a{o<-AH-Arjvo#yFh{aZ$nBdHJDER!l}ZP9JYK zo*?9E;eK>pQfAEI7GF3q3hrD|B`_u_v53zeG>vg##wj^!Fh1^3&Z5gv8qxZLhPi?B zlX{>SR=+}zFJ$@*e4^)4dJ)EfEbA|6m6cCaL|WGpL=zFg1&jegyH#wpk4#r-KTPZL zYL7WKbkPc;^BkFdIS6eBEv%!$&!SphO}>doWvB&YtPMIio6qwlzrB$-`BxM*DGJHB zPj2C-aBJHvZd?{LCG`9{DG6l-;4E@~TuoaxA8Nx=TSX}#TS{ic1`=_OD7~_)#e3+& zRiyX5>{3U5TeAy~IDhyxU37@r^5||F(wm!Kd=%Vm#k8!ih2OnDArPkaeD2>Cy|vIz zR%`VOXLA9A^1FuD5JYWd>}(^2Ly`UZGWWh`4}8Qx>&9ljMSJ|>V;Giqc!mzM=5&nW z4o~A%&t@=5Qhixw@O67B$b}c=%oIL%YT&{Yu2&<->h;Y@YYy(Avu(C5^FteT*Q?&o6MqtCyWIahUokN={wEkz*~8w1Ue3@`$=Qbf4*?Sc1HG7q zqmwfMBPY{;d|Er3IMRz*8#tSYm>Ag^o6yUc*qS+;6R@&y{ud43wT_M*ws@mYUtgfV z-ixlj=f~%vA!5J7l@5LOP{UOhG!5ENIF=-G5{{`U$>`_hYj!Dx6yEX14lL!wcu@a} zeW}K>j!R`_SEm>@X9BX#lZb|IW&|8$o~xnCP+1no>D@Uw-#xQT;l5dRasMoff>c33 zSc#3vvw!wn1SFFkmWwraN=FJxQ3FPk#(t zju_JMlL)!l`}fe;P-srN47WKe*&gI6`H18TBH764%)wCbm{?|d@%){oVae+i-WHdx zB(fEZFZo$S%a;j*1v5I~pXyNt|KJE%D0cB^h2(tFgZr_0Nk>B^kP!WT$*uCFJdR^Q z11aP*iveJ`gd#Y*MsrK z`E;zHcLpw*?!$QVEgYaQ5`z_ixPc@=X|^R2^;k4dc-;d0DQAcPy$neS9PBAOWfI^m zG2k6ovm7S_d)82pL52=SGM?B98N~;wbP`ez&_V--4r3;d>AD3HQHY2E7%ECeYA~hp z;+a(flm!7E7%_24X-D2*NiLYe`*>VPytxN+(Qzxp8WCIXRKDSeVdTiI4F6sEKaC-~ z@`8_APlZGoL(WvR>&!n&nhj=CNeiL8K~SK8BTeaApzr+xqI`%%bpb%ck3RV*hq34W zJd_Mcq)@bR^DGDwCJ#J9WDN20u)v)1s`nZ&nT;q!zzOmzh9~88RMHtKOMmluG|z^~ zzTgog>l>0FXLL4Bmyfq|ppt6afE0hPscfx-1)xFWaMIqq^2vl&3 ztOz}+G<~I`BVuQTk{NJ|*Ab8uf6#hJL}M9Ps({iOeCyyOib$tjP~ zoaLxu@c~60>1Yu}xx{%xg(d)=+kycjY{@iQQVM&KRPHF2aVo2EIEh;QWp#z=39w#0 z_!9i-R}T4TB~d*WGS@6B4*KbMq2pd}kYL>R`bhBW1lq`Zm529X3) z^Y@IwR$)|P&obR(IHa##^AXLVrrn0j&`J8H86tnOi713M=7CD^h=b55`cVM80JJu^ z`>TSM0CgCJV#NlXVEn@blqgs=10<~8L41kjZE+J&lR`dO_SpgE2p*cHVpm}R)8*!3 zMKqDhASaS#z$+H#o6rs2VS?2)Lm&!BE|3an>ktbIbO7|f#0uZ-Q_W>;+6H;1bK+NiQS#DDeS}+)=UUe6OtFm0AJofa{ra%AV)_8T9%ID z{Al$0^p=kgj~j6(ilPn!etXPQ?I!CsZ;Eez{(RE>D){;YYsF2lAM24{RMk!Jr_D~1 zXWinR*8ME?+D_X2%<190K3kh_9REV(FZdmvsJ;E(4nUln6BWnfpdgC^FbMsEx_^zT z>3y%(S~L)AMkBH)+arP)jBCvqzX(R+ClnUe$2XCLkdul*Q*6dctS=zeo!jfWUl2jq zuWPCcQlFF{GnH@0MWj6ZWpn^66tqH1j$gXN5LNcXZ;l>9>ja+9pN14N+i3QWy$(uE zSOX#q4iSe^L2F)ya{|9?hu0KygnmNKbk!CYG(!ysdv@(AI!5Evx|da$qYa4w(0Ka# zN7LDFM(v;ejxRb2J6bc&SBb#Oj?YA+fl$xkO(+sS5^z6nk#DmYO$wwL5ZYib+^Q!XJ;zWMNr%C0#1rBkE2=SK^ z>27szNZ%Mm$DV#K|HjPxNg~*Q>mCy4rQZOIMzX(P2btAXL{@@mfj$*2FS>nCe$0oU z0gsR|kbfT&Fareo&qn!`myjWEq5;SeQP{+rGK_rF;OBR|k(h*aG)nkX{vIA3{wgep z&=RjqGG+&o80J9zd_RSGZEASW9Alt1q6@F zx*k0neULA{f2;6eRnG*q{=EaitPV7wY1hwu6OvXar=s>1kXusw5JAP3@7m*)*dtYs zv$(0ru)s-kDuffZ+U+J+&O2b!#eze%W9E3g6HKAGhE>~A&ct3hQ-^Xfi zonM~hS@dO%Z{zR#=a0kpx~bzVwb}RAutx*+=U=VVrrO%jlg8YZDABGf(aoHcM^jb$ z&rbTdU34Fn!8ZCffm=}Yff{BEKsqe0ffO1F`|y1yFrqq&j;eyU&DT->LN}f#?}5vg zUChFq*k2#FABIkE|HH2H$Aai5zB675$sN>(nmg|A(=6Y!Wr>mNd(@ciFaW+qP{RyLQ>OZQHhO+jiI66BB(p z=1j!-1<$AZiIr<*=H=F;&Mc&6CXD+hAEYHG86jGGcbq*_66euQN`bGIpa&Oyr7Pct z)YNIjmc{O*@^j?yMtX5(FYxiih3C;_g`aH0O{Hht(eI$*euynbPd10nPy54cAw|bW zgU;yz@+KYkj@5ye`k0M{{U*jU=gX2vNB65m0g`UYp!TWI>ciJ_5$5U9e3_*pPb1q0 z&B-5t^PH5^fSZl@&f>~|{$=WAM>eLSn>X$I>h!ds73g&Ss73n}EHS-=Y=5j1@I@pBoGnGn zTFM-!MNesaziu45#fho?h_fXeuVSLSG^GKpD;ZBQRV6eHDAXryM4v?YLTzXHHFmJU zl)Z-?4Wd^v(&`GP>6k?H_3#BbCQAA2F$8-V}^qICJQ zJ)P~Rk{8m>`LTEY3FI}iHg|Bk=)Lu9W@E|X!wK#3z{5-Rd)25ggT%f;=XadioP^{| zL4PyWeG5Q%D|Msc@fUaC4tdN}6EX#eUr0gs$rJolO798hU++8n zE_y6O2m2lGI(Ll~;Wu&-1qEs|;U#=E$2JLjk5d)sLlfl#g{U(rLl@P$*|&_|H4W98 z)T_P3OEW$TD4D`h8p&8Y3)A<-+$eFRFbQ8a>3zX-2+AY4&)V3bpc!_)(0i z5EcK0^!hi+f|T5M_b99kFSZjmzJwUah+#fCyx^Pyu|9riI$fUF zpPE}Q09sG+^Zj}^c{^$Er+Xq1r_FA>+9>vAp1@mBQOjZFi@_113X~PL-SI=wl8z^2ut9IHU`&YqL-!K+v?jeW^tLn^DIUyr?v&qw z8b&e00O==gWhtVo$mQ5>aY#ZW9+-F zO4gF{&8Do;wH+&`;4bX)59_hVv;EqycKgM68yD}Oct&fO88d!*3l)@Mzm69A!ZYj5 z3qfGIOaDU$3jyAG?|W&XU`31gGZmj5OL(6FmMpk<;gki$=p@2kr-}2&qFdIlw8B=S ze~HJgqk<*53hmrDt#!JAtY2*E!H)1wI_k;4r!mAO%yMb^qJVk=#0516T<0!X;xS8aI|*SAkIxw8N>8lXNvramAxJ= z>kgAHuhsF><5W0q??{kBnlLYdnLAQY2os@QkCG1H(;@DxZBi*sY(v>MQPAao>gn$)!AdB&?cMNgr$GXMvTt}zI(HJ zKX{luK*Ijf$F$fQ@eE_q+DQR_JQ)~(yhN~1$kPXIuy2zs?v5((QPggoZb4KicfaNB z7`0Wl*W)vOs83@ldhbm&u6|le^k0`Z@fDV%x$xegq89R>!8h!I%e+al$duCdH4mq@ zY2*H%qGbE)$T&%k0;9K|nB#^KzQh<`%IKtZPYTXHsj;<7?o1nQnWmYwOU`nyw1N{-!YlZ{$z zYKHEm=YZ1yY)bfHo`Vr@5>^E>VI&RH;D@*WkAJI!Cb|yG;!vkXB^yu3Lp9F7w<&If z<6GetR7R{K2_`je%~V)kwIh~4Glp5ly>8qUypz*7iD@(I+fMUI^TESo(%uiVVayy!&jQQSn}woj4pidM;^5n830HYuG$UKHSxxe*`Dydj%ajI>IjZFmhhq zO}Y=IP+s~pQQfRqY`V$D>p~Nw8#0Bs86R;;9|3ZY7l6!JSjUdJz@x_-ajPfraObZ< z@6ZT?R}hlC+m`M(w*vM@QmH^ipd|wm^gdK6ylzDHr7Go*ev0h`tP?c$!6a>vyh-McX*=m|hlxCnY6#97w`R zMpg?Wcn==${czZ6a~3U)7%j7NxZDKu-AhbPI548ID9_Xpox&oAgHgIS4KKx5XR!RJ z0v6mI5S~Q#WD%@he5k9VS8bb*RggjGq{AGs#9b4PG7&N4u!R}{^^LyNpn(>#aIR|V zxM!TX6&yV2q~E0lJ7pA1QGptff0=r=a9mh*{7|epecs{Jh2#{v2@JlL4O2jS8eO_vj#3(75;XJn*dV{cS}*>7#$!7 z|JqspIHa)k@_D^s8OA{1`x(!m%1tw%#KgFAH69`q#DOr{6BHG**RlVGo@^W~zpt%1 z2KF#yId6AEy=GP#F!6or!n#Xm;eSwOl)SWJFP8Q_q%?BOPYJVmyjw6<#JxPBzCzmf z0>zGd@pV}hKR|Q*WMTB2QgG8_)V}lR^3kj-E4N|$o^oFQ&hCssgM|Kz`(v!oc4kbo z7cX0Y?}us8Hb9>6BzN(!f?O<=sEwq4{Re9Mupy!E>9^kWu~mI;;uJ5@&fBnX!eq(@ z=R5mNc2pz5%t8Nx7yHW9_+v=|Wf*JQVPT}6wR&QLFr@TJjWh-Y3ROV2Krs7mu0dnD zTJ&bow>kb^n7Xu8%Uh(59uaXh-4sUsnOU7Cuo$buB1^H^i&zx@vG08#jljKLkf!Q%6KomSqcG~BghXtx z4m^UkQ2oi-W_TiSHX`975hV^w%y4Mz*)1BGv(Db$`d_F#obZkDFu?u2qtv^we|> z@S^uYIOL0LG42eH6oEuli_=UC(_i9OtDo`CHF8pTYfBtDU+- z722OsozyuBsv?3G?BEPPfBVJ8t-YeS)v zNNz@-o^s&=!EzT&28=^H2k*e^rs6ANlWp^#EA5_KKJ#6AuoswM2ZSX8_esht!G=yM z%l72KKFxpG8sw$}7^a~_*dPE+_o*^`kSt%UhlRFhoYw2HiTmmJWJC#0C;XxI^-+MZON6_mQsR0K+%}@VY=HV@1}^~zLxu? zo<2y2Y*F@I)M&i2e{#A@w^z1GRy_7N%(^MlkCfe)haj3BuqBrPT2;cWg=jFTGZ=Zs zn;3Mlw@8%R$YJvZyI0Z#n?CZHefUa7T-GzU2t7Nkj~wgJaPGN$1u8pR3~6lU1_EeD zNJ5=V<)hV89mmxy26v!Wzs2w$=p;PTM*hF+T^3fB|Fhox|KH#;(KFHi*Vsap=2-Rr z3lvsmhxgwT@s|Z&bGdgFKqDl1Cha=ie*6UrJJcRh!QXkc-X@X64H?3gfW1F{NMwV2 zAC6TdxH&-GCHf5n<=nkJO+4A{$o`g3@(hh(qRQ=zpHW{G2J=aU;1*(`*c ztW03Mo~`S9ro?pxCa2*n+yU8_}GfY1FM`q zQBlTNYw2{9sG`>~jwA%%Ju@0}-SI04nRBKAH{P=jom$^bi@}j`*t%stdvnY(T=x2# z>FFb+b68_cLSX$QmlXMMtW07z>scOYRbB2#S5(n9*cr?UEmD0HU_nFDQTLWYkoJ{W zq2|GHkq#4Nk6MJ3WfK5LEPWz_7{^AHves97hVF`)v+9;oP+;WZK1 zE7kx>UOP+Z?*ir%qQjX%m4g^J(jBTUsY4X_ASyB7PmPmmTQarG887XWp^N3WUZ9>Z z_0mDgP+}$8j##oVk~vWj#YDPda`aIhO42%Y7Kv0bLAa#)oEZtr_9?ZXhBv1$BFVvF z61JDtP@gXKXYB+9R$M4PJeQSG-YLL>TS8!HJ24fJ&&H~J8;?%p3J2h^^%z3X%yi(A ziS^MRbz0U!lWf3Lj=rD~?oJ2766MeEx2X77AGE;)6H0Z8P6Wi6OMDnj-iV{w-NuFl zO!I!xyRaQ{CQzJ^1B{t<_kFex41hbapQS3S0XGEw%FM>V6h@B^7?5QmDt=*Pp8@E> zdUlCq3le2XN(v7a`U{TWYFy6>T8)T!Gk7J|{Af9izED$z9U&`Ei8*-mO6DvS6s(U_ z#d8dubFb3b*zsIqna6YXRymC)22t`-7`Tt|<*rj9$5fXFdPDM>U~5v;J+-*UAemxC zhQms3euauGJLYiSq4_Po3!u6;ZInT=Zb3AT6oVVQ)naD;=GP(Cx-bb!m-SmF1#4x_`bC(T&LsZYU``O_E;`FS4fxkm|Q1;|` z0NC$F{z`;|h>J6qGQRM=F5kQ$tu$VIXuFP!?{RgKIP!LBd0mc)cBf-Qv;PWRXcL)m zHM{+-Y+>}4-qD|RVZC|Br-z8&?}>2yvffe(7=ebDC1^~IpHNOkmJiI|jP(a;GSI(O=A~iDM(7pL&zF9k9)}Pw~LEw?276Z@6AweQ#Ci`aU#F)*^y7 zS(cpbbKci9W8G=R9p}=4%`>hPE)(nFq1L>5R_-5WKeK6BBv*3>x)_5}om-FEa!lme zKq3w65#C22LLrcHsAT-mfmpwJMS5YqXeb&IF^cN(OYBq)zIyvHA9Yqxx&p2>dF0%9 zVA%taq2!)jKn*90r9?n>dW%CEMUS>IVKdNxZ62#@IVY9OwOY7A-Ryw|yqCD#(RU*$ z{z2EHhT5QAV)C}Quuq6oDH%xjlNd#MVF24T9_tis6Wc47^_&nZs(}8G4_X~RGwfe& z<#leDe6BO7D98=B+T_&naoUcnl95!yxJcSfoi~6*TAftjnpUBo%=;9)8dQ8#W@T#A zFOA!}M9kbRA7k>1=T#mLB>oO6jK(8WB_0wpO%}DM!@-9HIbOfMr&g{DeX@%7Ln&V# z1xXD5jtmO@=X9n>`y`r>;ix|rVm2KMR&sKQ=61<6$h*Z zrB$My69t4%EL=2*n6RC3MfE^wnN5i_6>3Z~aSfGUv+afl6n3Zgt$jw_=~6n<$#tnm zSM+LSit^c}&qUzf@KFcuP3X3r&uvy$>4CLZe>W6@Eh(^OyqJH2*{|hTNE4GfelC?> z;D5|D#inw}YJzswST3<&&pOt-YS;G`HoD^BJSqwFL`5OpLxG!La5VqCCYrHm_Hg=m zT;`9)?;1b(2T2Yt6BDi*usSO~b`N0of+TX>6QoWAI})}p`!;mT+YYKl`yVT2)H>_w za5_d$*l8lOIx>jMmEu>*ss828RzXpcaJt*5YmZ{dlxX4zJ)8{FUeAC+xD(v%waYZN z>{`R}YCwk*o7x^W+me&EiRPir49H^WzV_eH1y*_qhIAaf0P0sE+omK5O-jP#d1`HL zM6`3H=4PA9{}ohXp1=!h3MR;mja9V93W^)v=p;ib*#{Z~U4@~Ws3$J5F3;74>49r2 z`#c;biN%A72@BDSwj0$&AgmmnbQ#gUlB3iJcV*Jvp&OW_FCYx8{88xgfa>kGBl{2F^xaWkv{fVVd@Q^ z#x?WLwZ38r4)tBkoKWD`@#fxM*6@oMu-X$})=C@9XSrMEMtwKXue}857Lm(i?iJHH z9k-|ynYLJsM`v3a)vCUbWfi|fVHwg}9-~pSNbXYp5qD?DGuV{8W2{x_D4dzScoahh zvx)-zZ5p`l49`9_bHyfyf1tZ;g)Mir78P&J7HX(n{Y*a^K|@Lp9yHyq(`dObhKw0u zb?7z9c%&l!2NuTtFCaN3aQ^(jO=vDmSp)rVg~9jpHgXL3$LZv(md6x^!w&0&; z$aN%hE`;t)z%GrYbn2HI+Q_xq^y$i6v<74*X3n5uIa|BCO)gAjs7THGNX@rU@omO5 zuyt11X%{KP^ahLmNlW>I@y7p}F~Vw~gVhaoybNp?YL^+j4IwOkG- zSLn53S;L??Lckob)G|L)MTXLI_^qrbr2CGvau7EP*dY{tDUZCIe8;(ggK!YZmFgZ@ z{qV*Z&|tR|g`yJU6_ri2WkGLhK5fBfXRQ)O(V+BliN`Y#_u+G#lU@64FB4MVR&y(+ zGsfnuUfoe)V?V<_x3{2K0;GGv647TVE55FJIqLacdOSOelD71`V8`Ho9zI;ZPw0Jv zN6S0u{CDDj{eL75n3(@>D6CdnG;tf^(-Z0wa1!Ak?f_9NphD0?2~4@zIP@d)C>^n$ z8uZTiv?Q0OMgkbi`tUI#3^(q2x*nZFk=>k5b{7X$7+&pTy}4Ux-k)xd@3WDk7(a#- zdW@?6Be72HqCeuT5z0Z0=l4c$CnJKUnscljb2LtwXhsLvus*s;O?VHj!@20!Kd}s-Ab0$mU>V-{(zq1>$j^ z&Wvs8NjrJbAqJZJJ5!0BtgY${vy0Usa>Rt2J8%dCU&bt<6o`?&!%Ner*5Fo=eg2Gs?yme zm`u8V_rE$8l*rTyGH*Ce6_Ew=KFfxjm6P1GOs#??G!u=G)22WP4_x-`ktOOo5|jt| z zU0n1`RX3XyY7ZcZED@c+CYB`{3zichBX zjSe^BGSM5Zn!pGhv9}5nA4N3do3FIY5$YeLv0vb3;xcQFP-71k;rh z-@im|zBJ7^8SqRHng@lVN5Umg>W@U_GNRswU8v15RPr-+)K4hBoea^$kR3xece(st zBT-TH_pU<&#|fHw zE^frDl%M&mPFcF4#Y|2oBA2USpTUw_17i!-R&K{RQGh~70Te7n#q-WW(Hcm*skKK~ zG~_|-aJXf?_l>9OBBJU_!m&2R#dBihbMzszjApAc`g^Zj726O`<0aB%sq}B<=N7 z$91DU&oWu_#k*t|a6l?2lHUHuiQ9+=mi4vTb(4LVOX|39yL$+qHtuz$t3NczlYS%p z#7niY>J0k^E9@+DVYOZ|o^;~G8g*he#0wV!(<~@lyp&896z+Dm3*$UzMm7uiP_bu{ zyX0|Kn@D~t!_BnY#r*bS0mVWKnx?xw2gWaR95h_?Jt~PqW(*VD6j^dhC!kiLHu`Q; z@#Xr}JZveQ3xEt1xb=vOKvR%fVBvu#75O-iesV`7l#H_339}>u`Yru%67acPBgW_V zpN*F5c!Pvg<==H_P;inb72eK}(ny^2?Di-)v7$to%nklPb0F1Fqx1ruK1)5d<*p(- z@C=wN#Oc+Z-q*-YVv@#U-5z3~L;+H{F&Rt%dMG1~9S3$Dw3;$LOAOG!h?9;)T9L7~y`I-LKV7BA73qqxhvwM>?H4K9%`hTaaZqQvnsKAi%7{ zMk+ORoP`R01MWiZQ%LV9h$cU&Qr0-){AQO%o8(V zTq}Vxesezs%fe5`?-RGo`UJY$4##z&i591K_0ceYS~vIuky%@nTXWNy$YM<3A7}a>^wJzO&sg2(jxw1Y z|96MJf9&!Ke8lM}msq7as+P6$IV!dnZn?fm-Qn*%__r`m7h_zwCfCSQUPB1(a5&qu z$+5A?R=cZKw{d3efcsUpE@jc$X{aaT6Vao=NXts}*^BM-NM>n{bO*?fGb}p&MypLn zaiu)Js3FUVR@cTg{lNubBsTXBF1jvC6A$obrQ$675`>9AzJF`3Fq&HJbzQznhZKBp*j#;i9YErz?cNuGk_q*jWE@47ZKJ;QtE2I@P@d}uXf5KaT za8N2SHydALqiNDi5g12rlT3|*SFx6uNIZx^%vYXGk#3KuaU}oI9Bo#O&Op*HVN<^| zvG1OAssO?g-HKLtsr_JHKf|^ESnmq1GPiWYhlNo9azo6UB~ znUxfImiljeD_{{5+11CDmIPxRw*+?YblN31ajOp#>JKk1?+~8+CX^>|f$+_O2iQs; z(>>fgB|KOf{08z+LQE!hNfn=*)y-ZyO|k$|M$>cOml=@)XZ~CBL4YNI9-Ocju#O)q zLKbfI70?`$xjMm2ft!E(OWxk?@FgndcQpAu7{+CGU|)^DZ!vJtPKdW1pza68u1ciu zESCBqqQVphRaqbSdQPnKsd)#o@e>89RL8bwNRi@z;srylExD=7Cz~71+{q}KB`r^I z022%A=T}*zcCPD)`2@+Sseq4u-<`j-U9C4*7OXPyDG%~Q-Wu3Z&LFqz)73xVlCVhC zM>cHMpO^TS2H)5|ysa!k4v1$p$|RPZ_zHEIAcyaX7t=^F#i!Ypu^b5%N)NqG)&&K% z1Vh?)V_GY-#7aX^YpAR7+H;oh4+1U;iEfB0Yn87$%J)KSpn&WnotqU(lr-%ji$g+3 z%CE@GS4E4iqzWWO=&8~N3?3s>1!&VHbK4j9>01>P5mD|Q+0DxG2Br0)4>d)Yus;ev=Pz$M_Qn%(r)f$F{=ft?m0m<`veDi9?5XbpMO}I-`?>K6*SN z`nlo>l7Wt%^1b)?h1{wg8}7XqXL;q66dBWhX{CFQ^Mbt}@1WcGxRU7neBYUAgBM96 znkYBM0+I#Bl!8_f6lqs$?yF3xiKx+&13z{sF9hba=_Hibf4}}pEAOu-LVPfM}gf&UloFri1swasi~Gh<6Q|_CJ>wNerXms>is5 zDsqvM6c*k_>sY z+HMa$+2t7$cg!)@rxkVYbmRRKd*L=p9`wYpi>9@QLVX6b`r!H(n{Q~;2 zxU)p?ydd9g=SGZhIGx}v*Ab>8npZ5mJSG{yDaUYmNvuflr?w$js>a-k{HQUcj4egS zZpvlq7-;dv*XjG_$x~Bb*Gg4aTAJc^TH~B$WO~=+JnQDm44h>XBlp}YI!Zy7pvYgC zrNV$6(yYJy4fWWpq<2aCyWoR6I3Tcje1oc+96T(^BiMev-}pXEN}9g7QpbsO#&jBcG7v_W2CX3lZ@#KsZxo z_>AtC1Fn=6XQ)uRlX(-^=@+ZW;tZTr@P>w>;@iraciz4m#9nfw)e*jL;2R{tBbrc~ zB1ZA<9PvR=JZQA@jmR>Z%g))Ux9p;f^JLE6-3AhXNEHOpFK_K1;BO$6t&)RCmWN1k zT;QI!zeMS7B83S#yMB$eU0fe+ORW_CMEc=#W3&pW@goziVH95PJxyRQa{-QSh$3x- zOj|g*(cHPeh4#*`glXQZ)Qmhvd>`QS7n|IBpfS!r-m=hvE zqNSbos_^FrvH*Rf#_Wm_nfvC`j8N{`W(7e6dRm@_we}Sc1tr*vr!sq1C%6y=?mC71 zwH^yQE~eN=nyL38JNL0y!|WRH?wHt6at(TruO>jhoRMC~KZ6FAjI*vl0#z0%tEMaQ z(!a7GZTAcQ)OdiCwlMd;7zbG#bTr=>ed!lX8_P0l*>tgr`SzMf*1Ok@WR^fPx{82Nzy6VB&U$7*r!iA$6f9K~W+{7a8RD$rcO{d& z5ml9Ae3$=#N?fgj4L67UNby9$nZ-#~O4Z1!igSiV0F8tPJq? zqyq+9@Z(m)3$Bu+Xl~3Y7I41FLQ-oL@u);tlqM_6z`;Sc>kq}#0l7U(R&=%;3nMR8 z1c%ilwok^qPR(3g>awDPzSRzS6lC92jNx-+RMr}w|FDy(-{7@es!!4n!dZ$MmdC&u z9{*GCHaz!64y)VgqYzOJTgvIU-OFlK7hN_<~VkyKK0eaOKwa^=}bcJRSdWme*M zTzJG=SCkhWxilDBLS7)LM{w(-N_|A~su8&0newIPn_bsFix1e1%?t^ET7G8bk(z#_8RLEya~-guMm>$a}~Yw-vBOT4QDwkazUO4PT1qdi{~tKfOe zt0K4JWKgmj7OFT>$N)SwZoPX3EHh#Mjp-BSU~Gp_D_LYg({i2`B20bllC+XG1>zYp z5tiWXsFo?gzSJQ6g@O=WHYD6LHB95nDM9(Ik(I+n`kiR8PeKuJ0QuqUk*HL6arBwb z(z>G-%LQ2ZD<1AuMH*9<5T7#49g#cHrhHkQ{hlXG+p#=Z&Zg*J7~kTEY%%HMVWkJfn8k|d?CzRS zJ@LRADo)kcV;JOcyud0ivxix)CISa?UXFd^`X@%S?tB z$bs(P(BZ!eGXC#JhctYco|*S`hbX3^%Rb2aLA-@fi;)AzCMXN94wpq1t1AP0y9}X_ zgqVY+Q+fL%Pl=0e623|=R*Q>@zt6;K8l@r`kWK9S3z_L^)fb1!JOU~wR-MJ5WTz+a z3xD>wI~`LGCU-9B{cai3WMxH%qKmNw&xs9>@>+%ju+&z)K$Q!P+L``VSwrN*nKvl> zzT34c=#e;acpcEI?3WOKpV78>TUc_O z#3{Ay@JWe^q|Kz`CwH$|I<7KUS z3f288S%y~6kGidER@v>t43`9%>*xPm9QKX03@T4J=zOfCq_uYPe>yu7dEYy2BjE2V zrrK!Q&_0v+RM8*eo1fom@cckIYb(;q%g`V}bBg1s>;sr187@kgZf!nFhV1b4;cs{& zv(#RlzipGB-ydR1kj`H0TE$GNM?cn+MAH(bH~&(QK9)X=4ST=;yy($_`JwYHW;`i9liA zpV0o|Y9J7$!Br1E8Z2QkaHOcEBF;ePvy<*f;m8fs!~ITD+NuiaV!T;$3PA>e%zZIW6Dg)7J`CCsAx2*Wx85Fq8ad5L#64(>=x^)DhwzdG_ zWd~O--MXTgw^RXcU{Tnz8Tyucu>rH0>8dRQ%}l02RIz(%4u^-Q__WK#K2kFob7RyK zMgDjgT60b9)50<5u5~1jw}jRwRH4)rV54_RF1sY!RDvQwQWery4Arff@D^DQA=~`- z@-R&~9|}SaRXzj=C|FUoaO{J&)^7*1My3!Ss%G>Vhg25My=#NHO+D;jS?9u(H8;P~ zz|E?ZTseM~ERq)Cs9mF(iY19YjWfRnCqdSfD&cxsW}1wZe1BF`UNMhJ_-GRU*I(~$ zKgU)p-%fAt%N#}=LV$*I6L;Af`F8|*d!z1E9K@O8!a%Bf<+yoFlo?Vic{pJg!q~1$ zJ&f9BS7=!yqBgD4mgFybj!FEbZ46;7;_bCAhUi661ogN+a!FO-d5AZ{9}==b*kz41 zA+|zT^;v0xe<72M#_~40IVSY3_q5%-lOVMPO3y-(7jeUK_7embxYB_0WEa}1;_&y8 zmN9w0kt;PID^Dc!0(7QeLl+bj5Ao8ff#+kv)t%1sZ}W!3bAkb5cccaY%3;y_Loa3 z{?$uW)jIWik-+{WGOXO#{ERXr{-2Y5*K#l;Cy5v;d^wKcL+* z(y%pd7$cglp>N|`P}z<3;uqk2sKq6`9!Fk}`` z0x6;DGh#eP=Z0?1YwxDIf>)ot^uk2b`U4M-i&NEu2Vn`jrUCwY0ccC4yL?3&RJj0d zRl8e2PZJ3bLD>TpF1PW99&0f*h66T=)NKeM<``+_0lJg}B*am-``jqkR0Z8nb6?~R z*k^qUoj@b({UZ=S;>@_HzayF42)s3vJ1|rUfyskp{;(3FFxG{I;YEIG|%45*1$72jg3nEN;rDk2&jlMonmfz_Q|1Tt8sQh{w&CYaYp zDKb$exu-aC)Rh^CIZsyTSA=`9Z|w9Z_EhA235hfxy=?JuDy-ya@S(_;c}q0Q5WfYg z9M9Y;g&ho4)_$*)zWNglQS_q4nLJVhl-%>JQQ$&Y0rae){ugP}%ex>P?8*MB#3>!3 zt-)QotAX)IE$RdDJ)Nl_HbtuN+Ba`Lf-i0&34SP~a(%pX+1F9>Ke9E1r@%dTCoc}5CU)&+#6L-@7ScA8IR{qzthvo$)CV(}lVHJ^O975`rk5)+ z1CSO9?En@zkTI>zzOEI0TA{Il2%b1|-)qK$rU4QI;!yXB973Wam>wcbpY-S>4xEs9 z?}!EvekG0FSGLgr)FE?~N=BVwWmbz7Y;CJEzCxXZU1)jMXCVsq(4_HKVu1j=Rq{>= z+iS^xY;OnRnAxUr8J6A2Wx5^8D~ zx^2*3X(#eT0_2K0tkFGl(33k>VBD(bxtaOxmi4G+0Ha+eP+rJNj4;)fQ7+Rph#H!c z4bGt1M}!THJ^mHhSV~`ppWIs+01Lc6F|s~U5&0>Z_T0rPg`l1`Q-qBstr#({vo!lk zm893paN!{PGB*qKq8KFA32tAm9aL%hNyjHGif1K7Qy16YAuO5S88%U(+&nQlc9SyA zHIR8>KwY{H;$p4{J3s>w)HP%=>SZ)IE&@hb>6m#PA>J;U^zUJY?MWsV0ufCwnDAbr znaw0w%1QiX3@ymM=0;~BU^=P7fdA1&EU{~CF(hs;x<9UiZ?`RiAJa6D0lql1wZ;coi z=DYXfKXlSt(XS|n)aTKq1q-1Rd`_&ARV_=f1-EcW@IGTgF^!VubA<494TnsGjwZt7 zRG|BRWG>8wug%Akol0XlXY_M6uo5+$EinTAxIB#HKl~~Fmq@1NmoHuT7>GQ0*#|J4 z7u=Yqzz&rk66d7Ov4vlPMREdxL4!5p{}5WAEE;J}AAV&nfj#8fAG4L3lF(ezb>WZz& zYDmXk|K5jlp6J>&&#L9>zV6U6CtKZ`gCH!Skc`+wDsrsIFsW_!JO+|qm?fYdCZ|Dx zMtk+bK|t*;NJ9MM6VkBjBf}wUv1Ab{5sPb2hVf&A`E1c)2uLu!^!Mwg^XEv>l!U%!Y z1cB8IK@7}1-aqokwMq(uwd|69 zO^g{rc8^U73hY1bI=&d1hNtzYX7rpFm63|C>~-+NA-wTY=m1>#ey37ePL}}0X8^=k zNX83Av?aqUd5A9O=D@NT(kXh&hwAX}o=Y3q^RKf?7hfkgugm^fhA<;5VApepkm5Mo z*cd`5Dd63_k0WZ>_Tb=}vmxKpZO|9DNyU=t@zuan52%C-<_j+%6zkj{H{rk_`x=;d zxss4%7RIN0DxqbhUhi@rd~irf9YPSHwJO2t^0s3#VAmpiB)Q)oo*TGJ##ah*ZoiGN zpp1zW>>d=o)6m_w0U;wRpIuVlKHq@>{+VE2xOmpZx8XepYy3lLM(j>6$3++x+*dLs zM*Mt#Z$a`n3>VH$(OQuT@W6P(JkSAkBl08RbDWE~l_iynjMg07>4O^#64`@|5s^j0 z$k_2tm2{%lSm;(P@kEO$Uf;iPv-anjVpCi6kI7+ykPs7rYiai2lE|Or zJ^6)wU0YteGFq5dVO@usp;@jwuE(8TeDP~GGqyDQ>MoJ+;`Ca@F38VCYO682$>ms! zPQd5*{Alq3VCPWeU{Hx>3Xl)Z7WCb0BXEtjx)nQsSQ1@Oio z3AFUV?Th(J`n%~mPyTK8r%ePIj=YQW00|2v8FKLSlKvazuISBW(B zE0Hc*QMXR0K7mcy;ra8>0OP^xFAD!pV&m||iB?21k$OU?3m_`Qvza2Sv-6-Wr2W$s z5k1;(fB$f3t=GG?P>$~XvU8zr8hEp?>>o6%^-FEnvfV-RkwTC&nI$x z5YlK2)>fJ$diXdo>b+Caif^9&Na5_A3XV3K*8Tm6m(*g@-0Ac4Wo4%h&h&`-7T=tp ziu!?;A4)UGiPuLmS}u+k)Q2*PBk^xT(4y+2YB4UWTD{ir z!7t5+Pkp&nvX8hCwrCgn*@EPt^^^u#R>wDo)}w})z>`LYAR~YnO!C%HH338P9)fn5 z+m9~CW9#MN-eNklp~8LKYP4kL@b|kkktJ;NJfZ2iDAK2*N&DQ4_j5zB57-& z+@O$`2A7nMsJ+tYV>BYZ`b!_6jxaT{!GTBTtUQ4~4XZltPgjq^(f;J+Z%tU)<5hUbN z01fblJ2D2n%sk~28JYjBm|AJ8n&d^;+I_b=s)4tnxd4SeE$?nflhR=?7qeJaXrFi@ zfieCl{ZWp5Xjx0N2q}4B%T+(1Cw(NcUeG$yKV4~X6OF>pp{`R6seWeez^kH?i3@X3hbYN zh9d4eipXVBq-aW}N0g?ibw}`&wCy50_;r3FxoQ_#bs^pJ$ez?Oa>%xB-uKTu3CAV( z5JKc`Y_W^D3}LtaUkN<>{*WRLGn3q%sxjD34}?fgRvTJ$ecFljCE}pWnw1za^75GvDYmPwc*6khM6FR5^LViW zZG0y_c#mK;e!YX~-$SnSvWYeNxd?x;^fI(N@b(QLg;YmnrP)^O9W4u*bc)XKzHZW3 zwQZ{bByii;WG{(0guew%jJrdq^z{qY?Fs}`=g@Xt%h2Gf=YJ6F9fDPK1f&=0KW>cwFcY>1qEEG_}e-(J6EaPs8iRLO- zO=>f_%~^>3KO&!=DoG-!C*4#&S}FHZObxq!y+i&a*o|vi6yMMk=R2Nh&MWnkaaF)! zr&6~%|I@@FOC8gckJe>W1D-bh<5~mnTB&%D=EB!%O%N|w1%DQ@$*pAZT;g`a@X zfF`)TJORf>hNi+%O8AOe+OdCl!-kCgXU8ic)qpWlqdlC@mpeS;uN)${KY$$4JndJ1DM9FBmHb_P}5xUnOc(rd?^?cS0R5`Tdq%x3S(77^`l3-NHG$E-CA-Mjy>_Hsur6Ob{4WYw- zMs3+1hU0MEQOiU4yZI?wEmXhSS~a{?f@_QB{2c}_bL)t{#3p^#=JdVkaPB=@yvW5# zn|;&v>@Yi6e6X@nKEoV)Q)c0D0MK`b*Ei4A!KI_Z`T`3m?TRia_<4DlhK)JI1<2pne|wA1KylOQHq7{K~+ePqjK zvXceA(*ie>>19juqr)vEK&sZW2FeoIOAsyNenK@s^vuLx`g~TFmGJH@$<`!n`&Wx> zR%W~Hj2Jogw&;)q-XG&OVtXsE^Gc#RA~d9A-o2R-@h5kZ)6Jd1BAn`whf91iBUJj@NyY!v zfyWl7Maj9QKQzN0>d)xnmZn_H7P3;9H7rSI09yRw149d9b9t}Z;vec+>oIa(?jxcF zd2J^l;^d%&mtl8z|8gGa9Ss`k;`b?U69yOypYl@V5&lRwRhl%}n1EL1cM>!c+2avO z0p`~VE^%dvZ4UKL$uO|l@xN;yi>R31cit0(8S;F(1p%>IRoTHFJ?n#Cz0 z_3cOvYp!dfLU{!QKhOvzMFex>qBZI8x1h!L{H(Rj21T2#%SBsCaSLguFc}OA#S+F< zqaBi)3P@KcZ-u8Ccl=`y|}+|5UDp z{O`)O8P`1+JYk9Fk$+*q`x_1x38hkpvde(EvRSEc0^&e88njT_9_?x2L0$*3mqbIk zHtkcL{Q=th*W1ilp0D=rdzw83rMng_-{#2-$cb|&dX;o@8r~G&9va#u)Y>U?iHWTX zWWx+idmJ0q(HD1(jf1Z53dIUZN_5}im!*)VVHMur&j&SiaMP8_b3=QAyTZu|0F?I7 zRnMP#Ox~GqgZm|q^q~zmn^Kft)8FdQf1PV_UDz*kd$f}&*tCCl)FmZ{?)2z*MNt}) z_WpK!A3e5>JyM_(|La^!NeuB!a<)hOCB-oenWN^$I^GD2j^nJUh8=w1*63@m zpedMPe65dVngrP!K_Z1FgwoXdIWXX{QkQgJL4DUcmPO4OG))nkxsb7ozBIlkn?CnNR9CJlmH3bO(Mk%`q9TtSTc|Fz@~&z@k|+ zz(D+6-NNyS1LY^n`7}PFGPWdl3*~~m8 z2Try;do>J0?Mv8bkW1N?orZB%;nYFFo}qxUh0_1v?9%#zuStN0u1=+Om*pmaF&|uR zOsrV7Hz)?Zwy^AB_?24niKW#l|b}F+ehjP z!66=KtBE@bPI`PflzXt29th5&yL4HYRpa0kTPBaikGW~xoh?aS z-fSTvZc$qiiP}%-l&c?5@<_)lE=aqG`iEE_{g&@fLvd%!6QJMBKF91h<1TsHlTqic z_atSe^E@{z_|fiJ^7tYY;!K*q%g9X$LXIT%GZatjPR zWF3H$@99e_%VV16EKUxfN+jz|EFAJW2&4Tskl$&r-8~A4%a2wJ>M1L&6jETONhR7H zC6gi<(KT3Sa%TXNUHFQ4pFVWBA*F0E$HTF|@vUU=d5ybljCt6#EX~BRQWf(Vb`7^# z4E1(FJp?kNN<`S6g4&flU2cU{L>3m;ElDk(ih=E_%rMgTcEEJi;gmwbIEELQD`>#< zAENeC3dqVM6jRVaOyd(=AhUIAyIcbM=$&=>tKokcFT4;9Jv&d9xSBv27mMdc?kjBm z`ha)tV5E>ZDVMAqI(ib%ZBsfGACB?RM}=uSw?jn&7hs(-+SvWFpmp|cz( zEha=yZur@ZPEj<#hA=a2iCHEWvOE_6!`sAySNR zfG4NHswD(|SE>yNO^szi&{13WQXjOx3(m%hR1c}vdaacMVT6Qeoi3P75m&0Id+jN$ zQUcZ&JieqM1yuvGoV=J~`mA?0a{}t*yU1+=?_!|fCpK)=M%GF`@hqNnUd-G^7Xu2p zYV1M7Bq@sE#x@ybE3v@_9fs%!m*MA&sH4*3=(K*6zkg@+7cDo%hgK)J{oI@lP}&6GE5>d-xIbI37-pcJ;dmqcaed=` zF}P?1Mk6HpFlWr%&V!a6fGsBDph6e_0Ei~W}1{4MXNqVi}cHX9KW8H?;C27bj+PZ>B==v)@=Nef1(5Ig+8q*&Bwd>KI z_2_w47ox6yNiOm3fHI$*8&C^hVLr{tN3sL$PP1$U)$r(jnmc9(o0bVpPalp>z;hIv zKQJ@&EL_hOsi7-^_*6J(++rwS^9d!(P>tN&jHJsE^)bd-m=x}{e6(;axQ{#&SKE2! zEgn<~`!|DWI?FGg-6#)TeAnoYv*h6my=!`)XaHo;`I~?_Azegb`SDPZfG0J3CwOm| zTMkk9wq*=t2?ST(n>lb%I47N!ghd6!L9({|=E6uI^KJ|?b330G@Rs_Cyu;Vm7hPCh zpV0;cVeZ${o}sx+v0-jg*s2+;DiI7vTOuS+?uv5FjkuxpkF~jVKMCcOh(%b zN*R8{c^f`T1{uX|cRw680^GK`JVVaZxJ;k33UmPQS zr&OTp7xn1E96@yWV0tTbv(764XI6{)td zx*0H22QviHEIe0bcCKJbPlc-XxHSM{5c-fwkV&#fwu6j?rlTZvIRNy{$j`RULdl{8 z;L-Na7!XkzY@AyM6Zfq`cayAV*>PmZnF{r9>#;+sU7%)~Qu0@@jrw?-_D0MQS<1E0 z5sxYk53%aSu)7!Fr}+ghzpvc@s>v^SX>YDguZn0H0by?vJ$N;+x;+t-#jw7E@~70T zZL3McZ#|l|baE0T^(Kv325Rcrcj%mf7Ew{^^KjO=hL(<1VkPEk;+!|z^~ICr&VCoL z$w6Y)5Tp9dfS_F6A43z6X~DV1dsKFM1^mv93$WM`CU2W#+k*&}cGvF4)Aia)aB)!Z z6=V^AJ3H6gQL}Sm*K8`lP8MZlX!z#i^rK5rO~$fEP$dx}aJ&w%}cNTMn14_DC3#oRLJrVMuofpR#p**OIk;qd7Ud zXeCd#`34egkABt|iW_A%Z4$Sg8}=OGWU_aN31$@OVF7TH#fRi*WQ6O?6{fc{eAf}r zL7P^7a<8&h&@C{okBs{7Sgs2V-W>dQnih$tWUzJ2?Ae9Gen|T=01cv1j&c}!&o&+e zmt8rMPAm>SbI16f{a|1E^=)nQT+EP zhbmMcQk_<>J`e@|gWi||0Pv(+IN@&VEX%5#@E8xrxm_5IGv!unvCS!~yojDc`4}%T zT#O6keh(Rii*^y+KC|^yw^IpiZz33XcpbP;ObKpfcTov%;=9l;#TBYh6s?6;cE%S* z^L82l3Nb8U1nC2WgrAdFl?xCEhv2i+vqorxWQGkRE1`gw2#J9LMX&|XsZ>o?EuWrQ z%+)COFdLP}r|S&`!;=jU=E6O?8M`8j8(n*e$&2opk@b4BpKjY{T#2%=xYbYuaA7|| zG`k4VgPb)G<|kl9UgGr{USfzYkg2=Y&Asc^$uX2#ZIcQn!aARIkp`-h5ERD+9(|E2 z3uRlkQ1TOZbn=E3q#<@yelA77md@UwoP2mVTT8CB4BVkLHF&I!N7N^!aNh>W=OgY4 z;h=7M%dM}zElftC5M!AQe8_>bJjT6CQev_fzH~Z}lUh$oJ!5ARDARNogr1YQrCoiPr@8S8XaE^)Qu?u#sv%xsZah$Q?Fcn8B(((zR{<0K2>iI|Gn6q#-5(fiZFXp_gQ~> z5wl0{?;0k;es!7ZrPj|yng%w03u{i63hfD8KX&?1&34uZN$1sY$3AQ|w1xW9gZ|+c z1$?VU)L<_DvE(tNhJO0#SYhOxv1xEd&kAeQcYiDYg^^J2ULqybttV9|y0au{4RlUr z$qW4;EdEa-(J3Exk$w3Mc*2sUYusJu~vJxvW z-Skj5?V_8bwu+}k?KRR+>e|=C8Y5<(pcNTUTN zR$y#Wh~=g7S@QJOirZa>0=VD}`KG&0Ij6gR_+rxNX7%?VMf zm;<@BL{&Q0v0nh>`?N0XcF9{0k?}KBND}h>oH*qoYQCwGp!n_Y>-Q)sGm2Y0gC*Y; z!rY&eB|9n9>xt<_(Pu%;wpf5(o&Yz359+(O7biHOTyo>=s z_(~{k?p-zArFxpErFc2f#3TGGkabPvJtgmUU||p|X2Kp_>Z7e;4%k&7rp@i7eQaDx zit3_dXzn+*fPlT9YTDaJF_rWapXd3jN}%5HB;}(-y3ge#tArYv?b4Sd^iMz5&^2h1>*+wJMe#! zglUl@KBtJ+KSHV$dXshR|CPphxc{DP{Y&GX(yF_gJ|1gyYe%W(9}KG*2XuRB{(h?W z&r!vuu#c21dps1RULLr%5O^nB)IhU)WRIF!|k1F1cFxB+mGv zSZuICAhtdJ>wza;a#I0;VGWA)TXE1d6INqMrl#T|H#}p0a>y@*Ir$RE-9I$O`@0h1{l{{*=9n&gh>EciI;`>4nRQt!-#}qVXXXuZx%LlP-qRW0w^&!b25CoouzDqr)SP^6RlT8)}UMKp-CN$t9>d06B}Zs%a=X8Clp5-T^IIXBM)9SZT<=aNQc; z+Mkyl)Kr!JL9;YS>ol}0uGW^B9=q#Kp!yhDWhGL$oidGoZJ0-jlAS$-HBvsRp2+nO zRr_=BN8#Q&^7`-0^=B%I-UAaFWJ$)eQXI&MUrP|VJ3Y@-V&O&Wjl9k1bJ(Efi?lJi zy-XO_m>$OZMd0m%Hlwn`i@~Gr2&VqT`}SV3JoHVAAF~9F4`i=@*&ep1HOKtbu{_*9 zhLi=yNy?mZ*Rn|X=rWJwe`~WKO?CwXjS~*r$g1s+^xsq#$2So+Dt{a<)|H7o&l?h0 zm3R=zka!^bCi&)&InSeN1{U#)5FC;WFOub_9&nQ^BGFwCLb391c?Zb}|6R0JD0pa- zhWF`OROZ!Sujx(RQD z#2MfZ7<#K^vVA(jnO$GF5k@xVxmA$R+8~4m#?}y@tD3dennv$_pL>S7@h!7=>+3d9 zdu&yh)8hQ>x|0@;21GnvAVAPa=guO2Xb80h_VfAt76a;vv4GKdoZu;J7*QWw%+&+!;8(S ziA5hBQ_Ic&&E4-fdJ7tO!tHrNNMaWfN=g3RE5l5%s$!5o(HpQik zyr(xJCfT4yp@5nh&{5RGm40H(J1tio@(9TsWdmElG%avf%~A~iW_h`v4u&G zHpZ^tDl91D$vL=p0&6>{jqBv1D!L}9!sr~FTGn5Sy@Quvly2g~&Ex6nsN{7e_Hc#0 zK8cI|HP&8Hy?tuxXQ#c6axQi>$OY<0MgL4UJ+Mu(#0?E|_lGF#c5?Ki+dbh)Tqeh? z2k}+@@U0yl9VYl%0)X;MKT^$^1btSiK`aSB&%*^~=cfK!%cFcY6TL@@194Q<&{H|< z_N}+{2CTw*QO!|iF)UKERDn#pCaW}`^_0fbbU0IKM!=)psd5lG@q>13z~RDyorf{} z_?h?@*MlQgHG=MJ2GR9Lj%du1b69mh!H0BzkAgb|sc{>+-vT0f%s=KSZzSyuQpdZd zeY7(B_J!3FnL|0%2Y~M5Yo; zr+BdzG%!h-j&Dmgl2>2z(u76s6>n};sdH3?Xh)HCmJHl}%|8ghkb0NQTUN5`nJ9R# z&O7bi)8_ezsQMX8&l(RAYThd~xC3$A2YdGCuavSG_SMc>gs1uks{&4&2c|(ne<}1S zF){L@xt~+FV-X;PNhbOcx%W8d(jFXjm0*-eCA!FJ?OSlxmhe)$1?kc+Et?a6ZESenq%6ytJ~*c^ewXsVtVYg z0F0Crb%Yx&dUck0){fcUfRfqn-_7{9AM*hC2^&E&O=Hcqc$QMCo&7iV=QJ36TGkpc zQvu}%R~a1=GhW!-B&1hk%|kfNS%6p5!FrU&o#|JX<^?DDz|##!Pb35SHN^9T|H@`S=iU68XYD$Zm_91M5EoP zLqxL#5inW6v+p(qu)&c}`L|$GJWJ}DRFuz(!0x(?GQLH=Bz-s*mU46R;rUq}=7ciX*xq~MVp?q&4lzxEct{TMnvg~G`JCiOM^6luwCn!P?gp?9)qWATpmzRKT z`)mvMljEpaIB^w-xbU+W>i`J!DtNOvEfm}&?B+X$H5|ds8Ny#4cS1WKYA5l!FiO5r z1>m(iA8HG*9c6zS#n$*K{!U0nSU+6c62$7FD-KHLLdU2;p&@0=zG5JU{VJBm?yMkn zyQtDFA$;4wN~jlp;#8A$%%#wvAq5DlTt9$JB8O>ImIOO993VI_*F;fj(x@wf2%x+^ zbdQ|Jj)?k^c`G;;itPa1pz?Q~csG`m$ExQunsEP4>E&xy1{Wu~>*%pH#;!9e9-|tv z`jb)EB|)~MDOK~(al^bqqFmfp5h*-%v9bJhFSC}k{A^0*EK=t1ULY0@dkrJQ0p`yV{=i{LkS^F8+-Y7Ume^1Ql}Q`Y_n+fC-^W}TlKg%ff{ zX=&-BZqmi2Z!o2^`b__$JTR##9Bmv^%@Y3HcFB6xWj>?N+2Y~hSmh?td%u6jZ#UUF zdy?#X{xyxY>iV23ReOUyeo(uf^&ZI`xd1&gs`pgtvm+b~-)T(<0EAbZqGKV8Gs!ng zAc-~FkcXyY$YCDsM9%%b0fIaf$up2B2xLJk_;T{Br`QIdWe8#;o$m! zpVt{s;F-1F&6r2uvs6$~E4qE8Ly;x{bq)YL5k1HCJn{9Q% z;tUy10ni9NHG`@Qt0gzTp51Zw3j!P(641|iG#H)phq^Jo0svn#?iNEtDtIs}Sp?Pc^V|ChUN_tXCUK==A5n1xf@_jpQ01MtuPQ7nvo&&6R_YoBWlLY^fbS?kDd44$cQ zy(N^A%;|5|u^VJFxc`RWMYXbbVe|ccIjU=ho1qkm7kCf^%f3e!htd_2?C`df$fNY3 z`~?wm^8byu)I6tKnJfPXO8!3lvs?e$&HVRoPWrA=<;6dLu146&s>5Et_|p8ee_d9lCFK}@XlYVv+(j0mKGUHJ+30f2wvKJ#FT;Z_N?HM4YnT=0>XUXXB zerc~9e+R>KY-^bA)vjxgPA@6n@mn?}2`#@Qj-xcS6A#w-`TaF{dvXf}`Dd&kBGv9e1O$^eM|&-oH?$=K z;sWBSA)ZH5IhohQBL@}4*o;n4q1~N1!Ur(0-V=5FvnV`!f2e8>*tHcwINpjn*7GdI zhE5i!)b)4jyA5rM5=2bU>lNV+M8?fQQ@m3mf`r`Z!>8j|i-&@R@=|h912v?d4rGa% zH6f$ObZX`9#cAvF3J6m}`=5zm+;=g92~g|`{gK$}^^j-Mt?7n?jugiOe5PR|0ut)W zC$gnKK<~+5+6ibvb~b!BPrg3BSYnN;{qQd;40Z{0`w+mqzj4Z1kV7a1nf^R&)st^& zJQ@bU1&10wl~p4$b~~u)lx!-bIG#Lzt$rvgzH$2ijOQg5eGy$Bg(rjLY@$k6Bsw!u zsHwD1vo*f5(BI!q<5t_nLV6B;Bm>1`X+ct=kmAC4u`4RskNZFXQ?tDD!{e+lddoRe zLwF7yD3*$MXsw&F0Q4d_KZW_%MA)@wLI~k+JM`niG&G45$cJi zVAPOoYYLPxh0LILOWPKP+FID-V{7x0fge+`h$-3j=5%#8cUawa052C7#%Uy8W1Lj| zDZJ7~Hhy`m0|IMubNPH;kqaI)wqf*p+>*4qGnEsbi88m1ave_7Z8K>t@B&CjTzMOB z(H2N5dYQ{q%RcGqiQMNAm}LRHDc`%C=VZhTd7u&tmBXZ73%3?2>*{5jD z+W1-T8d^i|pGCniw~H*|r$1HJ5*@uIrGt|$5=hx0pQKsMQJVEK7x{BM<9xOgj20tV zkgPLkzkONw7rX%nn8Bp$AbM|&mTipZl#zCuIbN*Fv9TU4*8I4kkoQsG^A$FcTV434x}Rrn|}$A6&eRr#`~l=x|PHv31(h z`F__N#UX5uItlDlV598}g}LTD^~KR$GPa{GJn&qk`Z}`EAcI2ja+V!c35xvo(R6|6 zE1D@u5ibaJGdeHePNbhec+%OEX}X^wxb505m7aB=w9ozj&f_mWwP}aMMmc|0y;!94 z>!5k0{i)8@Q-eraAsv4dD~uB^)X6d*IS#%%WaY(sFe8?A(?Fl)jF*T)J6by=kIr?W zxy!j5;DC&-oUG{Cw3mC@&!jr3kQ8$&uWPNB@RW>1qQ{4v5VWppBL^{k&;U5;g@#Hj z_4ZtKIkCCRZPRa6*bfd0&{h$m@z-_+1j$xt^b;V24-%Io%fda;{UZ-Zjv*o?`)Q@w zA-v!^N>LAT=9Nr!;s(74=`|+w$fRvt#J0T{ALCsM?`8XXFL?rt=IZ)41*(Rm^>brb zyf4S8kD60ugV&)gYLpmDJtCQz^BSo`_(79=fgt=-D+P7{25b_yK$XHBn((he4~?$1 z;%itB#{ouWm5j_o)E%v3L&WGSsSzpN%k&u;c?IoNL4Pi_(-Fc{cE+Csuv63rnaB&Uc*#w@IUcjMHw~rpAD`i+=NDge|m!VJ(b!W6_ zW`%<}AdJ*3xEKs^DEDAvGS!mnOos~kSS{?>Zb166L}cq+;(pQ~T;DU?uSzx?0E1gf z5KXRn4muj0>Sk#~1h`|kX(VW|dP~&6kw++_X}(_;qkcH^CzV>pfBoLB(tX`~u6SOh z_U7xDL{WO$d~x&(IP2c7qM@u#J1^E~_7>`{9$$QS{?W=moeJFzc`Yx%t^7q z*^4$~FdyyAT98iw(aPP9JDpd5Zf3>i@SB{+2HjeMJ@Z>q=Owan+JbHU^SKsaEzzq$ z%*Xt-Px%63h}fDzrv9`+rPT~!Hd%6Gv~=PUCb$}dCf^h;k8Px(?ZJ6X1!C#9e1Q|2kS}~>fGPIe@O!srYr)ur zIl>6Umf?j#aXq6_Dt65E;NIBIrz#g;t)<8a#3g~=PNA=uHRs%?r8LQ7aN=X^c zQDrtvDi|AKg2)qlOpdAAm%NmtEB?409WwOa)x|fhIZQg{b?!b#uaO9&HDO+Q3 zq1$k00`gAAWHl@n!(x?>YiU_q4Xj4KR0)nX+upS=IDrOk54zXMz|A7qmPb9DNPqWQ z{eT`C%iyQJxf~i(v}m|VWp+Z3l6>b5;FN0ZT8VAja~TK6$~@Bslj22r+oAGrl#A4Y)^XTk|i)| zUt}3RsX+tXpEfgnjL$K6`!Nh5H3Rsnh2G<ibpkHPD&3dmZj6@Xp-Rc);KU$K2Vz znt~k8f|M!VirH=d)^0hh=BSQBFgXY9SyWLEzrs2LfJhE%`9;SewJ93tfx*xQ&~*eC z0>F-P^MRj#>Dv%%Gznd-yQj5XQ8vTvIbjh$L@2xdJ#6+U>BSo<8adXEk6Lz~=gTY8rr&TUrprL_oOG(@>2I*@~G`zZZZQ5O^G7!i>1yG;we z@_!@Q<+A$<#GFshtKFo{?!E9LCJM$T&lKrUpjNC=~l% zuq6EcmzhnqxlHi?k8@b*8ULfTfq|aszcZyXnjNv%orp6(C_lh5PI~?WAYj+v>|U?N zp}+}=+3%op5q^7R?GcOOJ3Mc)`r6Mo7LignE|uk5cWe$v?_{>JyV843yj;mt6MtgrR`mi6TvBMaUXbgO^gl$>W)cSOPFRxYt5K1zGMIuO@a7IJ5Mi;|4Uk2U1be$$jAoP^pRL0>J?q%>y)iY^{tK4~WMo*zYc zipy~(4jGqV!}2^LZDC3}>DARjF3>OmTaLI5*<#1qZ1gs7#xev1q%&7cDRWMCO}bZL zk)$UxEp$Q*o0CI|9_q<2V@k?KJ5apX+ila21J_7bDyj?=&P}=tW-*?P^zp1FNI4qY z3D;@Hixnq@mP;keu8LW#5wTs4^(^V5I_jh{0ba3Iel@ATM+n0_>6kaQBrGq*3Xmf*^=;~Ex$mQ~ z%1vb&r8>k8b5)gxFU7neA9G^EN))S91%ABaIa|Y-v}LVy1GXY1LZ9i0q>ekrw-9ishR!`%O;4=hCico~@&) zjb%u{j(OfOsoc`hfSGLx^`>1b)sx=3t$J?HP&Nbu4`g^4Liv)Gp6hHbh9EDW#B!Xj!qwvNb5UrPe+hEbSMh=vpgf0^$|7Jf$K> zPMTMxA)A~!7<6K5&yJ?gs0T5x%$c#asxvP@>l&W*kH)c61 zIm#MPNfc#J5@xH9BPctx+PD=Yww+bJ1iA#)&eUJHMDm{1DUq2DSo6YM1}NZTq?HVv zM9*X4qjek>JwU#TOLH@k-eBB0Sg(%A4@~?)B9ThxZKnOU0C}DUW1Cl40rET+b~e^z zbWQB`?Rw0)usN2=7b_kySSe`JTGL4@g+`WsuGQ=i^jumR3$-jLfkZj5~ zPU5z9krhp{873(|l}hCRSYJqU%=c%Ss|r3FUiO}-5K%mLRoJWSviCSr;zV;GABzJi~tzoLU0;}0+CTr|~j1q;FoOzK%hzWgHd3fYuOCg}?$7kmG8$3p-If!p?S zfsn)i(1qhW-<==!bQwMr6QoCe`~G;sf#~Ca(24xCf8t3i?g{ZQc{x`(6F%sA93)QV zDyjZISkLR-t7h+M^z#bDGXCUR6fd6;VmS_CJA|*jWx?wa!j<6lAu_CLg%oiO6K`s~ z6QW`hd+p2`!S*cH(!#ZO09rG|d|^__^VCDo(XL}DwtmtSA*D&i>9(eugp*bZ*fyi_ zu_I{ec0Z&X5K0~46u~p~3EvdPaSN&32i#T=Tj>iOia!LR5M1Mqcu`&~hQbjeeiZvB zvmu1w`vCLz-ZKZSU%-HAvEW@v%?ej62dJ=6pP*mEz>=1w_Jo|`zy~f_k43#ALri0l zMwRRISSW7OOvgsuK98r8q&4Wvf+$@uxby61hUhPsRE#L&fYvi7rjG(@h5j8W2;xOo zqz}EpR}d*R_Jn2fw~h(^fSKVw%wNdWrpr_Utq=hVGbsa%RtZUIC#L55PWG5n#>}Pu zh7*d>l@w1hm3sU@eFOL|wlLLA9tcFT?k)dlVzG3WL}UM9%s^l1FM#*5iZTZ=8gTYP zC3q@Jh?SV}CrDKcp`8WQLuL_6r(>x4PUn`C_DUwmp3Bm~$U`SDHkI-jqy#6XiK>}%mSjSdcqkNSyS zq&H=${B<~5_wL52;}p{{pvOzP(*%gmWV9O{xC^bNBSJ)Pq*TC76ir_>xLV%FAqw}i0Xh@?ul_wEzs!KVPD13&eQ)B= zCF?)LlL@y}+US!7cY}Jb3iA8mx*rzi81(i-0}g*Y&xr~I%Vq&D&rs)mnuDrVUNA&` z8yVJYtogj6A>eDuiS-K7-wxKzeQh=9tLJpcO<0EMYL`aUtYndoraib+Eo{!e56=cd z;vP|%!>X|I?w?1?Ot&15geujWKL>5%LY0G`ed^x2e5k%UeB+87^)hplyAamuFqCI+ zo&pAVh1-2?aYQh&;k(P`y-iMcEpeSV_m<}&emk3{XZm5;k3oqHCC z6;5yolZ+@UMw}*R%InaIe4paHX)e1IS#&He3QhA`GklpV>pKT2?GDYUy>z(EB1H5D zRg);Zl0SitKnW2}s;CCz3J!4|NygsX%b>bZPjD*dK|`bfOS)}jP%WqWv0cCzUvA4Q zi+95i6Svqv9&`Nu(L2hL4xYO$f2BxkJRPl8O=Hkdk7_bLovljaUf^O7bhjxV(^Fn^DY6@Ub7W4w88dFk5o|G7Lmtdw&ymV{coO-iDJXRT3 zRp{o#H3SORR$S#U+jFWdNaM`oD3Nxi2RNTIK5qPF5o*H#;UfM%YiWZW7z3I|;KhL~ zMJ+S6u)Qe95ESvLDH#S819$3G0n_Hru z=4NZvc0zmeyP=xsYLzRG%RGV5eY#Uv%QLLwNcMOiZq032J~f$s{QDX#e2HxNyo^^Q zo|XRK{yI{FVRpFJoLpYwxqHq4jZsu?!E2$m7$OGi0zC_S&ZVJ)iJJZF^b{3-_0r7! z9j{%L!=&Guq`dJz9vSZRv1TrYJAVTxcy5+iaqJrLo+M%8g#I#`ZTg^>acc~{BLr(5 zVHaFGt-4~6`siqlXHG}T*_A*f8)w1!HL95faCKkLaGEa@I(iQb^o-S>CaC&WYOS4H z!TtL8D}m#UdpVo^)r`f{)vBb^{F&B0O>x8Q6HWc?|bZxY3f{FJ++ zId&sUef$;l$UD5$32`H+?c5s`!gKAa(i2P9A4478&xy5nytpvV*7R0GzyBS3vKl$_IabE}0rk1~h8rpH6ZgDJ zLygka(e%OAbFZ&COMcK2a_7|3zDC%kXx#ElKN+dfWptHds}O;K?_e}?GZoIg@a!IQU;*7b9fq^}bxVWj-T{*uev%j)Htz(C`oUJunJ zx>)1;hF>aDZT_FOjQ=#8VEFG_MvdlF?QuKoKZnC5cx~YuF!?eeKO?_u(lhP&U}Cj3 zW7LI=FJH0nq^r)_kt;mripx|Zab(<(&}P~m-6i2cUMGkTByU7I?Fn1^J+$}l)5RCv z9wQQQ*&0|3}J)?Fq>g3f_+h?5>3vHc!O)$ywqN7W1%IWltke46L)MjPF zGZh`dT0G$|)Y`wcQ=h3eKff=oYv3x$1Y^ba1Qy-lcz&quf6>HlbFiI?EmU7j2upOY zWJ~ou#SvFk@2XxO4>zLUUtdI05x0*$ZbgJYzJFaCcA?Q=e}3;y^3wG3uE=zf|E!J% z1@f~eC=y?&#Lv3F8((mHPYar}e`u zx}FG~{u;5+MmKcRGSh)?)>e1KlZO^p=}P=@w=tp)rXPJ=B(A9iikKh_&K_gkw~w{0 zd{RCS(s^E0r*vwEJl!x6*N(ApD=ZQa$BJzkCrobnXWcwv_|wxVvU{WUyj|zBOByT1 z;kEeNc`x8|4TnE4t!tjv=@C^M^ZFv>w!#rag{rZoVa-9-oLNwEPU=i`aCU~*hwbY- z7OybK(G`~wR}LU>O>6l+$za?0zZg4*E>AHKjIAHM0|Va;TiXzg}zHkA;w@Qn%78f^+;ze+u<&zf*BwdUA<-)1BCFvdss|1 zrn|udW48}!CI`#5?BIveZx{GW=;Hp|Uhe8$bqTyd!Eykh1rb---)l)=48H|m_tmAj z){&RIM1BCA<3tt)NyGw((xUdu6z7o^}T_!S5lvYTCozO@Gu4faT;{cQT;ow zy0tbf`Ys1%xsRo8<2EFx+o(u z-AQB9(zZbnhX(3E8l)uaa@Zv#lM zgqFt^o}YIxmLRT4uJjg-PmLT;yrxkWyx@BWewte_<9XsP0Bw?vLY6+mKMyV)wJpw} zD#@VdMVv4AJ=uC7L_zg<1>T$#4&k|xxGxob#*Up#uuK4c_QUE^)~OL$`LeUTuYb{W z_1XV{sPL>D$xAf_4UeK_8{ff+SL)ov5FBvjGLyO2*q=eT@;pv;nnlj=tfN&4w#7*Z z{ikFZjnBp2{L6;qkJWIQ;F>SE+9X&kVYw&1X@1&P(yc=ns0$6uBd`FNbt`Dp8XUyaKCDO-TF#rom~}D1Trw5?WV6 z8-9%>F^2uuzK0SS#KB4T$p;*AgKrC8RgrEk`K1Rndu0ZXx~t!Fne{tU~E9(9eMOi@8^yms3VVSzas3v%Hr^I z;VvHu^nsxgtl}Pjc9)GrvUB#iKR)yqOU(2Crg6`{pFp`q{5ow-Wg{fMNAS+N;{$G0Z<@caC^ zhK9vK7qG@pv&Mi%5F8saMmL|?I)jNFbLR)~;Oi>0No8pTY^o0cc!~%U))2AbXQeS1 zL{%30Efqno2#Q*CDLzi6baTCrU0Cly8s($uOGKj#QRgJQVj8T*L?mcO_Qp-;e+7md z&$gD8(fWp~btZBvt>Eq69ymSOCTiJWb=z1UDW9v=9NRMCpT2@+zA=@TWwgsIC6hjk zkl~AspZn7xi_T4(zhaJRy%Lk-@nUXmm70HPEur1bh7AG#Sw`Z`WeWa;?wr!q`LgPyaDJ1f&{{h_TNxWjPf`{eKzWkVrY$eFVnwbECHQXYo_)xv^ zoMiWQxdfIR2jEiX^CO(o;RV8~9Hy!W;^`eyQRJDo>-T1CgOb|$vDUEHhQMbX zpYz7|M19Mi#d4hE3wP(C&n+1=+E{-$M`j)xqoLRL%sZ%Z?HOj1kY?#FMl1L#X^-p zONGz{NQGt>eRsh=EDgVQ2`np2>44?S%l^j_#aC!%8#=7OfEHM#ox@SH|05F1ft&2_ zQZ%z}AtSr+x_*0+&oZpa;G1NkI4WUP5t1niJzEe@&W-}j?xfQ;sg48>wq&l2@4gVFASpg*@$ z>miNnxYW!=zv^l{+HP@xW>4Bx?XViKvYD697O%a2>02X{!)w#JrY{51S!&HTbH z?VyV`KtgJM0T*G^nR}XbkEF5ZNuyi5cEJ5WQ|n#1 z6cpIk5vs(0=QVKSPIErZ-apfXMx_%~VYY1L%C+4{;Zc0Lh-cLpGTm2!W(&~WwQo_WwZ@ws1Hzd;ecyu!>=n&#bCX5O zByZ2o_w@Jx;Gw`+j8SP*3brQm9M4YCsrUm!6%;?+s7^~x>r@|J>-;|W>4-VF{zGD5 z{O@`R4mS4xn;5SDuZr^kmt@{t*uUAoJ7pBv_=r;6sv76J_kbu#GevWom${VTtfKk| z6-KO^1H`yU$ncOAPOyO`<7G0SfVy>D-~FPHE4>H1}?Z&(}C(Ej+vrfb^qT7$+>BM2ab!_wpo~yhkjfm^X!_#@#&_d=d$A0jBh1ZiG?w~j=7Cc)_wpa+!cB$W zuMf8O$oa@7EQY5|+{HUuf9ewd?CWnG3k-!p@d`+YeJ}M6eqhSu^n>xsK@g z3rC7OMmI6|xlL5X)WkpxeI6q`Dm8`l$O*iJAa$7c=lXM7TOMcnRshFYjKc!`xZ3YE zm9MCqU9jw0GTKyv?z|d)n9u?nBH=NW-7;fol9mWwqzAez!8H6d@u6q_xBcEYVl{H0$5{cz9Q z$og`*i4s0J6785BmJW?G zfdTAjiDaX7K4TIY%J~>O9wNg+2HT zb33?LPL%^`ierKuQDegNPJ^0w&t|q=6$l|PE2^k*77k(RP?Ps!uL6iX>;t(Hs7_C5 z&-SXjAvU?q<768%g~z)IOd2TnaI;ZXZ1auf4waCqFY_?HxNBQ(j?^r;ZvLgc=5{S( zEmm9~lHr;D&SA|4nZcg$mjc6BfH=NOIXNa%k)8N7A}eF^WxjOM`c6S|(PS(dQPj*4 zQltS@K(G)8L6q52P_Jyk$-ye=TwM3vL~?De}t=3W8{an{tif z!ncQ(p1W6@zDCH0(@p=a%E=!*#~&0ZY*qbFOcb&q2}fz5&U{48uXa^7@|~j&2S8Rj z^n<`y!--wc{=b9%1gePcpGZKjL8yU(B@p;3(T?SGFy&us-skcoEa?C}{4S<1(xF98 zAgbI=>Z>y+7hQrW?j*r3db;mR&x%UfaomeOQkys*g!>5u+m?TFUU5=Hu9HJ9=1B>9^Nze&hR@}qVq`XIvIs-FnttZYNC0_Dz&V^LhS zgqN30LCd`AeSl?8 zM}`3;pj8mEMoRQ(%MrE8a5H_t-Kz8oz-^%5Ky}8Pss+N>z*ncxLWLCNUg>6~xz-C| z!wpwT2{`k2ywtp1FRSIR?2rLH)QZ)pnKmUka)w&%(mZDk6EK9_KV9IO!nY~4Td1yv zJ)ZZyAJ?O};Ef3%Ty@+GIG(#i!xS|}tCg |GgUJFnm#gn&A^XNo&fWN~{wETqgO zhpYM$iw+o;XX}p7Y;iLy!}mjn?!biw$N+*qU%fn*0PqWK5$7WRmXI~X4hJQ72%1EH zFa?$0w%0Pv=wyL}MmJ`_B~;5It`E>5E#76Fm0V^kE-Lb1weVP4G-L)pEHTZG%#$KBqjGcHshaN@R&g)X=5sgz#lU z+@<_z+AkJ-JyymkHj0NEoQA_a$94@2`8p0svPOO}j#(@aVu-Rh8yOVAa~#oaqC~4i ztxD;NTGpZX<1Rr6Z_2L8kLHUP3x3>lGVW^k{5UP#DHZk7H`r~v*IYOjZS7$y>2i)Z zGMkgh;jZn=r|#Ks0pjv{%nM4nVn{Am?7$Z420#_*dX(xO4dqgEEjIeL<}{)Wyqig=(qPKijpYx z*7%5%S+)u3m;8;~*!s1cQ3N9l(v@d1&+L`rZ7)$8f_Ey<9^@T}P8r9HUI9b8yeBA6 zghwj){n#!|odE;HvcX+qVF|DAC3QGXRdlN%4@?XEOsIKgR#cr+N9^MtvPI}%$&eX- zl0KOIN1rbPmM{R7%7s4;n)k$ry&-4PkWYs`FtM@vDM$8N=IEwDQg2O!Bj zS!7}pb7FG>L~$GJKFi%oP%mOm=rD1c>v1|~n6~iFAW6N_)H+RY6}#p(8+Q{)dD#NS z1wKEiYNpONnZq=P*d^5+fcwpud%{ReDiaW;a2DfIf4qT7ZL4w?@#_dr&Ry(W&m={c zXxk^YT4OO}3{Fd+rf+8bD+prs5_>*(aF@ky(4OFKJ`SJ9jF~)Nu$#Ck}J) z%^N$6HSsr&s>UTiNPHc9xk4{iyX3BLEQT=G#%DJ2Ggw&^R1O0}z(OrHg`u>3u!A5KeILw#v8H-~hecBf^F zP5*b^ZkNlLjfL@P?{^Y_<{ofj^PJ&eWwIX`b(w;w3A9G9(c-z!ZDa+h^_Y=IS%w}+|!!4#5 zD0b3!I`gCwcIrEnziOKYf@Wukcqxfz+x zUUdmXLIR)U=}9{LCQTL>rMeG1gq?o;k=VzzYq)#+iHhDUFh|O11N0BFsgu%-LhPPd zQ=L2os!CKrg)Ffp9?NFTB4}gWO8gP>vKQdbm_tGt9jK61R?$Z;zgRUt2=TPiz~}gl z-CbW!?{D}N_BF!M`BnBU;LfzC`ZSJa^)afjQ-%mjM)Oep*W_;DEgqLbN2fxGyOV5D zKA!>os$+o@K)u$`eLtyDBe*w zUXI>lH-Lhel$v&%#Cg@cI=Tcd2@;YXcO1TTzv(L9$G;|W8-KYaU3JJZ-!d{#<3=QdQ_Oq5sAcZO1WTIRV$u+ArQSS@HaLI~z5d+|Mk zk?dNBXLC;$0?U%wLKg81`gQPz8#%Gq4qxYJ6>M@&6UhZH$Ix9js$DkMvmIv77d-v+nNf}9#HogXP(3+pc2 zwA!4a3|)5xX`JG(D34K>rS7mfg=0p9jx?g>a!kNXZ^X@P7&LYSN{HhRSw7K>HZ6p0 zk2V~065B}O2TGNw8H~5|f}#L`IX*p_ArQlOhcr>=z^|YYfkmR}Zg~8>L47Yn z05pJoQ11LxIz>o@NGAEOa%E;t>f0O<%{7t1%&x!_{$hS;MDGu2?v0}ZC3jphMl<=yRwtCGG^CIt2JU1$Pa`o~@%2IW4pD3)s zUJ{EJoy46^p>1+*>^;7q42o?iEdEZPG7ce${qna8pS1v&3&pNXOZ^-v-6Pjw{$s)_ zjCpl+u#?0T>P9MMkFxealI8}hh_=6;;*n|AloVeBtnhJ2FS)WNFIE+YpN2Z2bk+{l*3gGgl^2e0GxZ8I3QnIT?9T6g{E ziUyu@lQjP9b{eC^MWS~`P%$qZ&u8L3;kUOiQ9$8akbPHh$B}=JkfJg3;Lv%l&$cs& zx!nF6K6|5Twa=k4ukUByFSzul=07ED*8ghx$Hva`e-rkM_C)PfE8@RS?gLzFp9cWl z&47S0J}0RSx)FhtG0WY+?%}f{VtM{z9}W=au)|InMUzG?hfCF1&$sI=D)9G-G*cSJ zL*kw38w!?xsLyZL`{(KK;k55V8n2uA{h>&=b^~5*B#JEv?&QJf=XBHBM>F3h(kQ!3 z%M|}YrN^f)6Je*+p`yvs52(lj3E zR6&aNR&1awcZbzi3*1QKvGl3Ezb}G6sX(iddTQUtQ zD(=Syj%yL-?^qM2^;Y+fJ{a+zlM)mhyO)N=vdOOw8lJcc7G^sV-hmmO49@m}R|CBa z%^9Xc8RirnlbA2`=IEls4neL9W_fet{J8L4Nqo4^K%aP_a*IV~8=(vs$ZihtAz3kT z%vxDawidZ542$&jf$TEw(@+fE-HvsOTxa8+!mjz(Jr7b_8k%VqtT9ho(O}FKimFE! z!-l{{pUrp0-S&Pc|28Er=`V)+kS}rMR%mI@E zP+UBIGc#$gLfn?Ozk}2vy}tYM%ymT+*84soZdW9?GLd7ullAp5vs$(p-x79Bu4SzV(&<~-Xg?SEY*CU}?J)oP}W zR0aUq@%EAo)0mneZQ&JRNR6>FWDiAP=EItPDzq>EhOpzP6gJxcG`l=GuPzjjkBF$4 z0e5;#1DPFCrdu6@KLeGz-ghE+j*O{~7~x2jaV+O23x=ukLIuy7K+D+XFnVq(ki$@Y z^sEdlV#+iAr|ILv8xsExc3=r$ zVQYdjJbbdgjGuyt7UoM_P#6O84j-E18;K)sL3$&N;F^P96|c_+cEkQ7%Y;fQ-bN5v zCVr2#S#7S<%^1?g(I^Q-G2QPpeKsEIHZD!`pzrflgF+Nb$W#T86NaZexUC~!2@-Nc z@dq?irm1c&jzXlUw+_=Pa0p(mEqo+YNd2VB4Fuo8yEtj}!JABh$sT zMdbpi%+hJGEOzOaKOuZ2-8tFxtOWx}6PjKyPIJI87RNKY)_~=3?@;CJ5DHO%&PyI? z%?Y($ca6AScl_xWb@-M;d1U?3LBylzYg29<)IUzMtGeK1l+@84B z=gOv>=okQ!w3DiYmN*r)g!h}fM-dsfop47AQO3xAgdddPVYMfppdWO?H0nta^m4EMS$ksH)d>X zRe)0jz)kc3V5A)`uQ`pA*O0S08mmm^b#jBkbC20zBs>ize&IaVO9^alh1*A9JcD!` zN}kcn;4sAR9w65ba|(2rV8%CDC8MVRmx}*8=o|^sF}4eHr zcsSe*=GGaCw7K(1A}dmh7w+aV2}5@a3o~3Dh-CE2EdnRE)DVKB)Yjd@F|oO?2bJ>}X7(O`dqHzs}8y;6-1@6XTU&E>5I{zA~Jtu{f&MRDlSOsUvn){6-eRooS#qXeS(xJUSU zBh6?!v%>6hOA3#3j*_8H(>h#d&>4v29ZT%X%5gu4ZyQ#T|4rGoVezrT1E%AA*YDEV zm{{ha<&!>=z4oELAOcDdCJGM-Pb=n;2HkTxX^mShXro8+FbGs-x0$)v$iYrS#KLJe z-Iog>;msI^+Pk$QLB1Es9^JC=-^*>?ZtjNdE*tAtTkOpqFPu%({7J13tA?DzcW^^5 z9bvELbkIcghP(oI1gC%N~CJvP=ij$vZQ4)Jb!fia}s|+VQt` zCF2Kxy>{l6icCmYq-ihK$t9tm_=hDbw+mJ1MY{I>oiBDsGz_*Azr>7C_cg$3MI&4O zRh^UfZn|1QI|F2tTVj}zhm@Ho@9^;HZy!iFpoq)6rAv(3zbTXKi}0?E(~!>{gx`(o zGsp547+iXb=MqD+F=xTS`tR&D5m`dEzUmrl04mN_5x6NYmU{h5^#Xmd!s`q)whb0x zy7wqOgThZt2m#BoHln~-pd$Fd8p$sj4}$uah+CfdG^OJ9c7&TR_~CnM!07Pzh$<^} zB6nnZQG4(pJW+ev_cz1`xq-Id3_EWI|F#KY&>K4+1#j!(-!ohg1=D9n z!RkiaiziM&-Y5d7?XtePSFc61Jn(kaTMn>r5D7fn{L6yt$sb%Z|Va*v+qo2OjD3HvNm{TKLi-{wi!DDoV`)C$m53Jgj1=-o?LEN; zEU||Hew;7}-0sQjy65b8I*6|{Lv=6EZl<1F9DdW z&{SDiCY6C}f|u-za>)Lw$cK2C<()UZ*mls9{O{f>a&L>nqAIYgk(YWCrLs3C z4LgnC>CDa{-~Cb`2TtIH@BN%C5>WC^$*MEc7##mKjrherwo*&SK8A!99EKY_n!NIt zxIJScAyRi2MJ%(zw-wIbzT{(tOMp?Y8aTUrdTgcyU!v)bDO0I*v4o{r*{EHi`aL&u zth6~be;3w;%XwTwCH25jGip7va<@gj<&-bVC3{y=vomeA0~E=++J6X{QbpbSFiDgp zh^4VC{OsL*&}lXjyy~hFCz~@8BvR^Fr2^bQ#r9yTu;>eW&J`xUm76J-aDSZ$qr)m3 zRf_weF^I37dVcmKzQ3`b7D;5bv9Vc+P@W72z0dI-|m3h@~i_$JZ-FxK@f z6^-L>5R19(|T-$1Qdv8^Unrt{bhvl(lP_qpM^p%RKiILbk6?UND zW;=RY@8lV4PHFFirfkyAIZkNwK2TK@jBNh;vR|`BfwJt6t~Hs*tU0m~@V?qQl93-o zsP;1Jlg~MFIVlM}p1d`jAsb67RQNehxdk|HJ$e`1)}MH0|8Z}-1IdvpJz7!bVc;Gz z`NGL=om51(q5c)Ch(x+!!7S%J{4b-hEak)`0?s_9*=jH=Jq~V*#x_j$HlhIo1SYky zqD@WjxyNLwD=Mu^0|5XENM#WVz>`BOyS6_es_G;x<&uBZ!T#>QRvS4fgqT8V{C55x zLjKG=8$cKE4SVw+_&xmu&H4I^n0cAxv+}-WNPr>ZW=ntWMu70-!`1%jkDA=fk9YY{ z*lS9#7J@lN=1jtxzL4=>ar^+P5b6`~dV8Mw-mM4*cogsIVNYk-#tz;h9{+a6-Po=* zMks@3k2!oNI}?1g;;n3SpXy zt+AR*(PGx9;rc%WRHpxKG|Ke<6D_u}|401wzobEyAs@hKJ`f48ahpUp zXvcU8#q!<}!xrmE8ms^zs zTDF@SA!~mTqDb3$*Hr?F32B=uSwNqCI?i965Tb6^OrX)IAW%8-EOg?=s~=0O0s6TY9kiYT2C@gMQfQhdoJ#FVLlpihnY4E40*pnuB9 z54ELg=}7k&6b%Agtx=IKBLNk&A^%?{im2Hq+e^o1|FW%ANHLe0Yc9Lb%1 zzCm}RCO#UoPG+<3@!pQVWvl}q9NuGLiC`%)N+B9VRE*Akf-4M@RRgBa);$0aH&T@>-hsFtQ&&yEFuXq;VU-ZSOTy3PDQqPH?SCz&C>iliG|Bh(1{%@J^W zGiVg~(|(3<4Y?GQg4!7&T8Y-5!>ti9RI^!dR*|S^ENo=3|XwO$+(c^NzYw_m&N1> zn3K-ek=f+J56N7}DKQvJrVBZDuxP-3?9dRu3WNsMD8LL>gYIB_5B=eI7~sjUoMqaF zcVLN{og7tx9gxI!s$yg&s?oTY5qwX@=4JNB!hC4gr4*N(TC_<)Z}_L1F~doTyTHx} zXYqtq9ILDVO1gwQNjiU4Nylvz>En<)BtCu&ZT2Z3Rd?Jy_7vv}OA`X#G9 zpv+*7;@m-&$;@qVz32611`@t9?CHUXo5`7@t`@e+m_Y^(v8>>e?$M)B21?N1d-|UJ zsRzLO_7_s+Qw4S-GlQ-`I9*V&h7m zQ)Ec(6ApTwtOG={W@6r)MUr7)1F3Q#dkRo%*}2dP`W9?o`C>^VrX8XNTqDY6%MI5~ zaEu$00H%j#1;*=}qH#i0LehDpif~Hq_k|QkGlU6HW#TXoZFuUaMfM*~klDM zO{U78y~kLffaE!)(4iu#`*>A{bIhwP;5@}Q>H@60NRz?Tll5chPXuNY4ri|i3n+BR$-2g^v;frC!W>H06}f+AK1 z<(j6pyZIh8Zhs1zX*Z#y9ce*rm?|`oWd?-ITylJ<0T& zb_Vi#i^MMbyOy{uaR~D&7VdKmwB(jCZg8II>|Hy2NXG?XzzKg|W&4|3%IKV&l?TI& zN?TS{j|gPb-(n-h#<@{5!h_?}0wPVJ@wwic3W<l+4`>2Bd?1IXU)f;X!oOu$2o*oZhqV886JZ%iMZuJt*0v}NyIFlcI z`9^$Z0$rI-n;yHnRxgk6Z=gwgHG6B?s#RG}b30-aGU{piq}8p>;em{zfBEg%$ymSx z2=bTOnap`BQUjyzzVYMUZo&Pu=FMrW?WekP7!Dxg-Ey`c0NTe8PT98U=*Ok#$Tjam zIsffpjj4fiI455rHa%2*_}o8Q{;R*G-g6lC0kTl3FzMuzX>hr-!U;sD$SoD4`Uu(3 zL&wZ&HN_AdCe1@a>q=eb$gzy=#;#&oB-6M#f#?x0PJ1CXxxA!Lw_h!4uDTFN4B1^qcM}l4V|zWpX_6{zU!oX6)4Mn# zICL1r$qQ4wSoSKQCZmKyz0w)lb-)9J0}YU$BWp^M^jq|ol2Vxs(Xoy5uz9Y@aD%E*)`%p#UMBrAP6sz#uT}4~`}F$Dj$x*>)mF0CvK_^8vuDTdJR~|B z(pMDgbx+QHFpp6c39t4~>27_ut~?kxzl9)QBwEoYGs5otGR`%6?ezAN;VhN zTKeCWgY&oA4oZVxyOkzxUes4Gp(XYY1>LS5SurcYyS`hok{WE*C*d0ps@a8zUje6& z%#-Lelq>C%qbNtpUIRH`f*s^SIPhX;e%I7J3kwt7zwVx-)Bqa`t+O`zbA4x;Q!FNO z7;JZ_xgI0Z{7=o7__-$?3+_iZJkO#*(^o1HbU=C)g|%G6<{i||!waiBgbI%sZ2&?- zh_OP+{Z&Y7mxX8)XE5A$8ph!zNY(hZjXqb@0SQDOM4gHOkG}NZl|bg$4-4b=-O7hNx68_q9Sr}{Zs!o*){DqE0{g7m)*S1c>e!&vcypp*yV3c# zOe^K=+$zm~w!@VG??CNcdTr64ZuulJpMVsVj^R>qGzUF+;@Mhg@b3t_A7navjUn3X z-zZ&b){6ozvsrVw zuJNURvxJFxSSI>hSYRVJ?z@^8j?c`_vf|!Y@a|d9bvt7V31ebuUAtjamSMA-5i*&h zerrcM0%S~MM`8i2Yd5+}r$S_q3YkX4cZiSAfAdU@7~%+mE<)&Kt)D#M%9-Bs^vLZM z&^*iyS*UEha2>a!fJ%6#e#%T35j;MT9po5f4Mx$t^jO~zg4*A|5WI5XioJcnPUpbP zk>Z~E%0ijihtD+14*FknwbF4^dfpfSkH8?N*^4ItH7Lc;B#uuBD2_=LmNJ+r^t_h> zxaa#J8)D;jl&fkG~VowQ2PzoR3{|>}hHWX9-Ev9@ey_woY2?B3+n-f^gh2 zzGzxAF%F$PYdSnWFT}tD>L4Cv;Hc2{ax>#{(6yc2{A%qH2c$P+{_5*vbM^T;e||sS z{=kC#DSG}7@rU`pTEMb!vi^Sy*dCpU*sE@rolnXS(EsV@LUb`CfQ-$KZUSjYq#j0f z-BVWQG9(nKDnDG`!yFtGsZu#`bN9J{KM(QoKZFPPzY%A|VLYVXi@tENevp5DpU)rX z`uKjX`M<<-{}ptHt3US@-^Qw6^QMaf-d|e3rwv+t*7IryIIE5HRq$TxJ>MTJggleo z*HtbLHW`PFquF=b-qxdItXEU3zds-J>EL3j%4(X2BD0~CBQRC{oXJX?X^M9hQ)#2} zm-;YPcv5rNU-Vxc=2(}ze%m+YzCVXXjhydszgF6jNrAV1zxISOe46h+ZE?RpZ&Owu z*?(=wbGE=~Y$iGHH=cECs|tNPi>m%A!|gBIJzKng$ix+@hvj8CeXg4Mq7)HdZDSXb zwIYauvpiWSk*OkG@QzD=2Y|VcOi`0+M={p`n)zoK4QCYkRX5FWEGbO~(%v+5=BPDk z;+KH7`>Pol9Vjjn^{hx8(oV_Qp{Tm&az46cjPXvgiDM1Tbemn4h;Nvn6-xCgfSOTy z7NF8fhZ9=@v;o9$J6Z!fu2CLMI=e)!3;{l%NN+_jbjf`epSvn?0O2}kIVlHmekZr2 zsQW)%h&w4wom5vZLrp{h4(_Yuv9(j0>PzC19Wvj_)O?z^SVV@6pZnlHL^-(B^g?pt zVB@ZbUs*_jFPQ99QACT32Vq>?IU!zrq!hj!G*SPP=}wMQ%p!8zy0#2GMl$63&@$QU zrhrVb-P#LCJnfwe{6$DLnMz^k7wT^Sg)==xJKAm3?h1%ZaGQq0a*T4PD5gCmIt?*^l;$%vyhyrFC_Yi1bLqq_z-o!zTEnMl7_B zQnu{y0uRTArO*8P7~|DKc8II1C_vkc9YqM4%*u}?w~=DmhzXGYW+7EyWm}dcB@h9Y zBLj6d=6GIAe&N(@IY3Py#oDhH{v+0E9V7M(_E=^>4TYaTd?K=iPZpnhvL0`o;&)R$ z7@m3P_o;-JFUUP)BXz%TaE?Aq*2|21&JrxtZu|nzdz}nWLK93_;uFJIzCGlzl<5`{ zJO1=N%_D9x%2`s3Pp6&TfWli-03|$HmAfyg`SS&0BC7a<2ecTPLRzoKgzMWq3}1@s~c{D))Y^Y^wBsj1!aL~L$0*~r7QXuFs*9X zF6AIj>D70?K%l(}am9I3Ofe!cq&x+Z<bC zW0|Eu#DyvQ4Q$3asC4k;r#4E+SA;3t0*+JD{q&xMoB>cAh8=jhc79&W+fQXg&KF={ zK!lZD$z`?wi^Ny>6il|k^39-Wx&CX(Mza9*P>S=L+zB3*j=kZt*9Uv$MCKP5xGQej zh^hx`vl(@-P93yH3dSv1WZ5w3A6-k!I1yK4XO-;cOJ1(M_AQ4BZy*v=IhPMLW&gYr zXXd1?Dym6!(#i|2e@H!wnpR#o&t^1aKsOG>_ydyszZJj)N9QUetq9YWcI-V;#F}Ns zcWlsI;nnGtoaI%~g~ovPfyS2K2;xLw4nuvH6j&PUdH8yD%D1r@cgo!L1C)819cOs( z0se=+RG~1=weH0;l$aic1OwMRxpL3%U(uODEOW8v-87C^Ky8Y$y+BMDUk-L1tYR6I z9dBaOWtS9=D496NRN@6pTINKHFz)4!C{;Kic(2)%(0I1DM{y=%N2FVmQCZPYDLd2X z0q=o$k*VMh!7@zkLb_CzU%vd~n^D*7V0KM5rM_vjp`9aZJ#Yvuu@SCucn}AJc3HHI zTu@Z|EYabHq9PmsQ9OJN<6%?}vWCK_@9x>b;ojTiEeOE_0bg`u$IgF{rD&epm{_1d zp^<>jj^+YcHoLXD&_iVkG*M!SS>pI~c?z419-x}LCMsXkw*z}1e{uj$7ZBB8Zeag? zgU|raQfurp8Ef6OI-Sbxgqmbpkr7Kf#}|^vI)H6_r`wQA2eCfEEi83TLIYyL_Xa!IF*vO@G-N-+f%X82Kq>~< z7YZThVQcqGG+2(=^%E)vV-KkhLK=I9o!XFXPH#(x!x;&E()E?eb?lC{G6Z5BiY9j= z9A>XL1y>E~9e9MoV7LQH`PaDpp*UG%k9E81O7h?IF=H*+>pLA|(EVC6K6s|&2lawu z?9l+#huu!f?ZzegPG1&o&VU>Hy#j0)ALGvXmbdqC^mmxS*4c3p89Raz!zjFfqMqoV zL(Nq|)_Borw-}hmz*epT*_+N{DFE#ncwZPpHdWMp2*Ar#zvu9S@8V#t;KC5+#Cjq~ zRxtc$qd~H69PvP7QEn~S!t#ymKO-Q-@ceET4FEv(RA`lLGq)ciFBl{LtIA*i`Y4gk zq0$BzM>Mrx{R4z~yEf6zQzDn7A3y53jmWkwbiEq_T;UzoT}(YpGtm@5TX;}h zPpi)7kY=G71=L6wo#;}Op}hVPI< zfsTvDjPH7-lc3)bn&wK`I8}FU-Yy0*28lK_z7`dV3ROcl(!EiR5lVR7i8Jf#z=DSgBZ| za|}ramL$^(A9e(ZB3{6CAzHNr@wMEC0|QLxvQ$h4ZWHl&WdIN%%8~_+oXv*^r$6 z^pn(OeH^suxNsB*$h`0LI^LmwhF>FlLRFhSsJKppS{@E5a$V%U_4J?IbF)*6fy;2a zWXUI7^)O9PV*|KBY{`9P)1-Wi^VAW%bNSSvEM<7i=txd0Y{qhC%3S%z???uJ3LK}Z ze`T?15G_VdK}7?=o(3h~Rs%tJWE^_j9D9B+>u}=joz8`US_uMBdJGh2d9Cm&s}lTB z)`F<+yb=PFlUdTml+>WW8#K%S=_H5q|6}YNf&_~eWm~pw+qP|6UAAr8?6Pg!wr$&X z)$cp|FX9gFXrK8W>=PN8Yb84(zUeYUW^vKeWd)+o*$7}|vl9H+yDGTU0DHlXXR95GS=tfWk24JchR>Qx7~5v=Kx1Y_Vz$-rO7_E&tnm^X$!Y1}U5j6-2# zq<0umSDr^lRxfK`{w_KckW*nLRl)2;d8zU&F=cWtLrrN~ki|W*sNqd?rPujsWHD=q zSEW6)5R32KvwR?JL{Zlx&PuKf9q->AY})M)Ve6x)u!&<@py)uiWGI239)*KPNghi^ zA(|YK=1QhdlF(|<>z=e3^`ZH-bDQBl9l4hI{GR%sC~Rz)th+O9t~whaR(V~-C)>x1v?SYNEA zCtdt!>A-Zd_bvs?>4{8R<8WwSP>!J&u`Q%_4WuRyCp&FEso@17%C7M9&X>c{AG-|S&wGM(cfvT^SLnC-5AQerrW%<&J zOVuRF8uq>j>p+rqD9JLsR68rU5=s1m6eAHREyRgdAAit~bU#%nX>*gZdT184W*Ciq z*AXD!YCY^Pb(ykSd{_Sys*BS_S}_9DWq1F@P+eBjq%Y7`Ia4{ob91{#P#w>kJuT;) z`rAaJ;1{FORy&6P2Mc;FM5?Tx?2C8-KHxjW>)*3iT}AM)(fz9`jnzdOnKM`!{2YH| zb}~20`N+l&oU_Fc*kX8OS2Y|*;UG{x2>%FgmNx_1KbHiQ&4y?|mB1r2#T5uE_#KP* z3&MVw^Z4Gv!7tFnTt8yebDQdCzR^Z5*CpPv$T4@yW(O>jRvoZ8MU?5pq-zbDD(Z6$ znjO#sadwp@_O5)k7t~<>fVIR&r&&dCrItKPPVSoy6j?cRdX-U<-u`!gQ@7lI=#fhMmx|Pd9c-Q4K*<-#0d?25^t|Yn!%hf1y_eo2T8K^yX1* zLP6i}4_u|+UjCZe4x{5VOJA>~p)=hc>S4=g3e6m;%k>mh`5|JAIuUAM(?vbu&> z!gfp%?`n!XWVG?0kgstITYSD*J3hz8b-;1grbBT#-o01(p|yzay8TwQw|Z~5L`o#q4Pu700sMxH z$@qu=-a(O43}l!aQpC6dk8SN5(o=ry++*)l5O^ZQj7B+*tH+R(-qD(SaKmo)9?0AzQlBgk(k!KmSDdP$-I&Qjam0)X(5FsnR*oS0xMY}zU+pw;T& z>0qGcOVXGmVoY?F@`8QzxuIY{AQG2UO3x@V6dJkxshMSdm_bRX)R8@>f%{dN zb7?!}2Yew!Rbs8)4SG&1 zWw!)fP49a7nBG%LaVVpFkT^ZP6xO&EhTj_HP%B3`OsL(fyfcJi2Kg+0K-_FlN|}#SKe&K3CUwUPGN3 zhJmfVPOJNL9H#I5Ua9+dkyLlvuxz2ZNMa01DnOE+?jbom#p!A2*QgV#cZiU6t^RQC zVaI!A@l(;(98*so2Ll`3-DlQy0Lp(d zkH%`&F+fK5r-jE{-okGh;#lH0es2sPqQc>pCr1MH#-CcYP{pu3 zAmt9A27@knADc4^Z1GLvFZ6-Mly)yN$8d`@Y6uo8DW%py+N~*VlR-M0gui>5s{K2G zfIYm!r?G%an`ve;HL?xG4Jn;whYSxTO1N}RN@L72IYOM#>;kqCt*W9G@l2%{{= zXs-i|QXJsvlWGe1HOUo~H-n1Jr7;~(B2by@iDb`(fD5ApkDTgW z>_o;yu&AqD7;F2@RNLTdx_ky|qkyLTjJ;FC^3oc-_cC`$GU;tL>nGl|_tsUyb)O)s zcSf=GGl4a(y=Lh>2KZ1M z1n&7R)}T#v#&X#Fq$DVWww`{xL2>|*W55OK4*!tIv8+KtS9#EL+qgdO)?m3iNFHba zf9hXifUmG-NUg)8Oys=T>BOD z8CWxNR*M6-rg&E1GH=HS|EVP5viNK9vF*pX> zQZw=T!=>#Kpp`Nz?c$|Z5su?2iV<9u+KH~9#@Km~#eaaLqapivf(0OA{}hfetyOI? zcABDr><*bBdC3KU-<@`0Bj}@h4tG!lPli${UWq*+h666(jz)>DC&O#Jv2XsFyP~(V z_FF|*6)PHW0>--`58L^>UDK3c?@6-wpv1OG$hn$5mnz!ga!j4x&6^?!{sLZ#`Zf3A zB;A37V!c+%d4Yk>M!$xqHjBRoghK7F7?_&$XZk44EVPiSktjtZ$j(+~_-vaS{2WGu z>0f&16YnF;GTO^m?c*H!bk5ShF?*xwvJpg@ZE4|;q?#qlY)n)S(v&+7)Dqr5;0>uY zjo^Jn>F=X|G6~w8q27G;bzPp>&l)|{HcKVf9Qj#wpikD_hP&2E_LKus5!%gg&nnaOc8jnDCS@P1L58;m4)#^0~OP! zCEQOL+dgACY218GP`>C3GYN4?x7plm<--G!v3rNb@=V#&Z>1}Y@@tM3jtK8*mGjL; zEQ1|&J9Lh?Rn+h0H;k=TT-eP2k9c#{vnAoeo^5c4$&yeokw6yiZ_=^|HsXAqKufdl zuZ)UD2_?&~l|0Q*{VGRP(BeMWcY{sWPt=S>;z&}3k#9aI9I-FyxJC}A0KLkVi{RWB zO4MT{jOeMgP1Za{Y%pG6>L5*ZxbTPou6&rp6nyyNymdU;P&&zK_0$0g{z|b;%HDX%2Jp>s~>o4lD;0EGw zzinJpY3xj;M+Uc1>Nu|=3P-5EVIJog{)MQCgL0N8#h_ym>rG#SKZaxy?m5dVs3z6V+sXw;s~v3?tMVY zkaG!v8^S6rMVy>>yM5I4z z;_J&QRe{}F^ggzXH>PgK@K7VLi-gKvfZ=LKdDNhs1pF85G=D)#C1L-|^>wgAw=2@e z0bB{4gu7#ayVwGl+`NbyDVY;Zx-Rkk3N2W{LNh~p`T$IxG6X-Gp)^W(CH{1^70E6r zL6wWJ9Jq^HNZo5TPZ0Ez(t}6_`6JoK@dMvPvqp3IRe~rpxmgKfw9tjmx{#oC#Dw%{ zaIu_;Fl4xrd=r4@zZZce(I5O(HP@Q!)c=lvi3IUP#&0Vsc+) zMKaVxZ;A>O_;n-)XGyBkoEY#uM*w@$on6{$cEPoMi(k7B;i8Mz4e>LBJFqmu5dtDC zi&tI<1q@H0f4a|>N{zIE;Ag>^gPCH~(qhFahfIQBbKxYTZ}Uzmxq z8Y7RU*f4QgBq^RSE6JwCmz@A~X}?nSdfW5*?oQa@nWhLMW5x&Mb!Fxi1Mao6bKmhG zTTy!+mG7UAS)oX!)3q?8Zff@~Rx%;dw7HG_964MeYUJF!oZ7qw0+sxq0d&Xpr7DJtz&{~g#-6%T5rxEZ_1E}8mF$>5! z`-HL6MJ-vFFg{w5`PuSxrgD2qj01cxwyty9Q{Iydh4mk@J>R3#4f9CFW3uK6AXUkS zcsAcIe5lQh1 zewmDr1P-ExGq$uIA6mAtusOQ#xy@kVd9vQB5}bEq0hK|!Rfim3oy*uwb$C*(N7+5B zo6Igkp^15mzYIbr<|>1oi|Hn2G428{DKPEoTQPv;-RK_B9=qRuTDv{vpiyim#w0oc z(#f@ylZ7v{!CoB=nraw-#MH@5SX*!De+?SJ-X;9aw z^4{>SC}PQhp>2-{5oC8^q-tAZ=9YLmFW%*eD;)LH`{P(Rcvy1hkYchUy76OhtkwwY^Dlh5O9n;}D-d?09>t?xW+xQ4yif5@-g5#4+!69RCD4SL>e8m78T&Yu}Nc2g1Kf9&jGLv??p^D^3eXUHHQAXsk&EhB< zpA@HFV;ON;j{|U{){~_%con8=fYop&w}PU(K8@n9k}MfDv*NDn{zQJ4kIU_eaoe(^LbW9Q{kr2DxW=Jz6aug_`^v##h z1jr=|N;v|o^prRp^z0p;kvAZj>HL>HH11qw{WWQ}5-?CLmm1swg;wNY+%!2*$nXvC z4OSPaEn1tZ)mCENxAHEN-vX{=6Mb88Jfu~>0#|vzvzpI1gPI_h{dSpNb|yYB@ji_w zl*%0onLJ%rjO$x}qV)!AbMCasnmkJKTX|z5MR48iRK?y!q5>5{*DGMgUPnOvjHi@J|ol4}N$sx}I(qneaizH&G29^8vpZN=PKN^K`d$HpMkUq? zD9>1d(0ki0ifD{@d*)4H$O)yE`OPilI~U3??MsaVyQ_R>vU_S8I_{ht2iW(Rewgkc z>|pl>F2)+%uB*ef($+hagm(u+Vuy-0lE86%etL_{-X)YaMvs+io@7i%6|9-Bqa#YF zeqgY{1vE8tDBUTbsvi3}Pf&A;P%d+>7SLr*Mksi!*|(A<7j)>L7rKlNCcs#i!(fpW z1sqplDt>_;WBv68=mhu#hM8P@k0Fq&2$j6y{<~*{&wdsRA8u0olrmL6E&7##4OKmq z%(*8dTj3??iff+giiLAFXYNY5eR(lKS<@YD6Mj*6QY?!__S>I?WC_f6Jx9@AdmOsI zx9u)*deE&6$sHQf;0Z}|Qj6anpzTR+G~_1iuUSAnp9!RJlReV$dn+qWIwwDTV~jhm zm7B_7D|ox@e9i1f6zAq7lhDXvBV18cPzg(~IMf96@`4rE@+nT`@J*66#N1vF>Lft) z=;k)C-KSC=X^dSvK!>~BywTN(i=8@@ zmk=bU@&RkMa%t8rWL+A@EU=y(-C_W5AKk{&X^RR|*cQ@0gN?upxH$f_pps6ec_O&F zDjy4oX&qmta@``&g>rN|w6@uXqnzrV&AFQv0L2 z=ik5^ave5#dP(|#_kRnAqrii#)`dZv)bxMVtD@Xy24~vD8#?s$S|7E=WyynJFV=)} z(SI(bQS7)-c9lLtOrA#ei=P!jwXOik6zHZ0gn=j;3qxjQ=mhF1#&QULtIFxW8*^%b z;?x(aI`UaEE1hugy&Df-zEMX91;4}+NtF$HciU=~*->h2TQ3Si*I(bNOS7PT+aO6t z9mk~F?qf2X1C3}~*Qs$Hp+>#YbGKQ9U>KsKNVYfJ=8dKR_AjpZpQl#6rjiT$Dw~pw zM=C}#)w2#VaW!6vet3a0qNe3BO8y-}y*DGfgtC((<`z$EL~3OSExz z?_=LTah+1RNA%ctzo`JiS@E}&o7x)123lyHp1jN*Yp~PwLz#-;RwNQois;O6W+j*( zd_BeQ*+t?ac^y+l|W=#{WYV2A2vAS<5bXh%U@aawXClMAkQ~UK!r}?g5^UgKo==bzWbzuvh zCFvoSo67FRKlgAE+TEA*QG?$d&qCrRs6-17xa+)7P_kOML4}9RZ1ev9oi}sEh&uP1 zDMQu$Etr3Qto?n0rxC$y_-`TN|Fm;rWn%k33a(-u_E-`@*JqE&o<0&`=sZTS08&6t z=veW&G8N~x5v{HtUrfw&)OFSEsQ$c4rQo**AH?VTSNKnZz1;7y8{$%~l#lu^Sh_Fp zuixF$-rtwg!#}^gzDtx~>ij=f_`TLy|49*L|C1tK`uWxH&0ybW^3^h4PvU*w z{-Go@R^#F1W6jz$i}CrhfX0Xkz4z3$5m z?05aJdGH5cALf=X#>e{3Z@;&(_#cYn)K&cB^%g&=melvlZ&N7;#`||uT*4x9c=Gl4 z^Q|_n*H<=ovE$oV`pv&swi!*Yb3662;*585etDz3#Mu*`^7S*7Hdl)8vz;t+UnxX7 z&PRfknN*`=J|c-{sgXf;g-W;9DOrN1Kzj0JZ~Si-^R9Nxv$NeJ>0I};cuzxG!z4gd z<~#2r0}qD;h;DkTRAcZgD@sq(6=|HSA@Cgkk`eW$KDDou0FAFP>_{9Kl``MZn5`=V z%#^W9a+(J}QL#J-=F}eaU6=MbABkt3Al^C<6#e}0EYD~N{MbH((qNI6z)6IP=vdo_ zs9KZuar7>_fdp{}dT3Q6BHr+YSIzQBGeBn+G&~-ja7fd-JZD?WG^*ZH{Z>8L4$W}S ziR^m@Yp+mK5`3N_n=GB0r>k#TdT|ns43n?!U{4!sRN29@4ejL3-}xp?lpQ|CtBM@r z=2(3!>yI8Sw_C`{qzav?vX!yMt!-!$O!qh!@LScM)^yFCO#IKO*9Q$It8}TSZn%W& zrhwl-U#z6L79>R9_V}Ah1fS6$v^JF{BFPk~ImI?o7jmKbgGzpoLfz!Go|I*+XR6?APB?dxWhw ztEAJKY;~Ih@=+cABd_W0kXj{85?t;%=pH<=tw;;W-}}%0!fdfilkz)%qS3-bku`rp zZW;qsFPBXtIEjxH{rxFTd{p8}K&r#7Y4gvnKhdTN;5PjSb4Jks`M`7GLD_;rM#|UR z$EM{Z0MUVr^}eqpQNV)4*^9qo>SsBCs|UX{%(jR43M0#0#=0a;;ceHeMABU1jQ)T? z5OQs1_PD`{l_LwJ++s)HbhDzN;Kdh+JAJI=$TH7S@kRA^w@I;jWRfmB6XZw8K)!`{ zACUYwZ7+BS(Fl#z#)m|}YQ|eNly#R;(GiQR@z@22&<6dkOW^M)(De}KU@(%8Rr+aVK`FIy`P%vNoa8L^ z6xO{(ksItwaHsOaHO682W;eb#KwJiOs(bhjcLcay<8r9i+0#xWE-BLV~6 z!!lu|wa?{U?Cv31T#T6tK&A_L_RqfJxvH~RM(v%S~d@fu~wbgj-*@0%{iapt3Cy5>guJ@e4u zPJEj%U5x53Cg>l-1UQv+767d&#mJtBVB`Y}uY&X!$<^`E`UcraO&Re{7ASmP2h!WY z0XLFt$U6G-8rrbQ9{JG&K@`>wt(6vcKxZJkgI|mvIv;d^!5O^uEAz_Lq)Ktco|}drKToYC!RL`MMJt{lDbin z@kjjNrT#9Q#o_{A0YjGt39y{Y&d7s5eg8qWc5!))JiD*71=I<&U;O3eA05{Quzh9b zQcW9+zN*bCNM)o~3J2yLVmC1L6&IY&BTq+Zc}oAc%|$oqUCnI6Hq}xH#XbXNUV3|G zY39nW=6&#% zTYGrSnpddBNJ9CpVd|MR%2DY^>d#G-)N7{XEwn_E8Ps z^)4uC%wtg5+kWB1>&UZx;9X#F0;#J$^bJQrn?u~3r2IP>iUDUk%f;%nede$B_AWSw84$&zMSwj>GI;o3$q zWD`7-k&C158(&D%lK?pFRr#AKkSoiZvRoIGwZX%c4P~~mA%_j~$oH7DF4^z+IjFP+ z!z8CA9kKl8MkECtAUEHwnbP=KQcCSpgO){3Fkx=-kBTGk#IHmz=e z#SxM3=@YcTY2CeNoUlo-BMUiQu9by^ns(&ac4&x$VjBHUf9;hsI;*3!?IX%R2#qv6 z4rzl{WWkUOrRr1BpX;A2I0G2oLIvFJ;Hkva{r6zA#GnW~4mka3F1zTB$F*~m1o7j` zU&Oj`u2MJP>rFqR$&!kX2yk36jx?x4q|Z{IVD~H7Dt%k|(8j&t2A^Zc)fj36tFg7< zSAwg3di}n>Aq`RhPN#oV%XQ8Mlmnfrb~)w+Ile*xmxbP8=EgyVDdPqN%dDDgkjcyr zKA(A#eNeoT-^|+i4oJ3tQz4L}g{5}azAO&S*J9i1$%XmG2;8|4{W&@f31`L`FDm94 zUB^1EhEn7-^DY4du8ab+zU&cz|^ z!W_}IpmBLiYgMH`)nNf7hVn5?&Av7#2wrfYa1sE73kz(?Ra{O%VctXaVCik7j%riBMy{!S>TWeww-bD0KLsK zL?wQAm8$?oIZ`9(uGwo51xIvw|CR3=x`)#vB80n$zaNzCQuZghf!Pm|m!DHx*s*wc zE~*|80vQiy@B7^k9XML#k8_=rZ<-ubT7>VjeZ^BZz~Qp0301Wiu@{vhcaAXnEQAjn zJ|fdazNS7q&$u*bE_{DY7cbE%to*T9p#cT!0(v^4UTByT;+3+*?kT#Jep}0_5i}A_ zOYK6tSs9Br&k3_777R`utR#X4AbrOE7uQ$SXSMXq?RbxMZHpTMZM9E8AclO3oko%A z8bq#d+4>pmO{Z_qS6M{TFRbpNWE|y=5-#}%Y(l4omqx}&?tB4$|5LXYkJJLI8i`_pg3 zXN@0}T>+MCXtadc57H?ObY|chxoo>ZJ@@$jz(-JG-S&VH-9Q(i4;tosytA7=?v_95 z_N5!SWcc6{w%Xm6A$u{#yq=KO)LQR>Bl8AQnp?1vk9` z=Dswlz>3t4x8okek{2byg|MC^(gxfwmB}q1ZZLp@=Gh zLZ!DE<2#wYu+!a(=L}1Jw%V+9+xP?F{A9$%npi+yK{OCs(|2*DB(z7P*oPW>)nX;f zHx!v%{YhhrnXX_MIP|J0dCe%Gr)9_#vQ?xy>fcJHMJ&Rkkm2=}2XHx|sYJ`BifqCjoJ1>*N ziH>?t|h1lVAUue?5-PC>k9{}JPP4TwzQNQWgklT zTCXhDTQxG}uk{6^M#_@`*QAJ}!|^+ zECa=vGE%-1A6RLyq6$v&R@#i$PByNl0%im}Y-SFx@cn3@DeTKjV8!uTjN40k zs}AoD7F!?J>-nm(T+gwn9Ze7x=dkVv!NCL&q3tEq5C3@FE8D{;Mn7L90}E)?n@l9H~qJzx~<1S7y3&rSyp+J*&EMQrlvF66Z%o{ys(ks6K9njkf8tZn)_}a>K_?nSA4Q z!#z-=&D%D+E&O*4$I9eDm(r$phV26^D|8_V-s#l#w;=xf0C7$QF_rSJCDtpU?5f)r z9f%FR=uF6*_Sk=vX=<8f5>HIQ9fSd{3%1ezAbJMXsYT`=zeyl9>)9IqI{)pcYFfRi zJavKt)NuFa(1iFhkkqFDZlWp{SLCJwX^Yd+o5VqlJc#~oYksE6yvn>YDsLC0@@%Z6 zLK`{OGK^t_nq#PG#B1QwqUNkPY|it5;xIh90$H{yJ$M5XT2#e6?pYuCR`rTKD50C2 ze8OF_cgmICxgYaJe$R_ayplUZ^s{r1Rls1{BSsE1IDvlYMuFR!U9PVa0F(Bwq=lVx zRk`@KT{dr5T;I}$oNKLX%EC13^A6(~u_}M97_KdIq|qe*e#LpmSGacnYASJyFnOtZ z@bCZ-VD!RnByUvb-K}?W5lC@+cg=;dv;7`j^eDrpavLka$puhDqs7RP!;J-pn}-$B zlR;8f+5#Tv=UP6BTJ*u|bK7fM*y`ux4?1+*5P1z;YIOI(Qy3&XxlTOx`XDsr>dI@( zSDz=*#7VE;xsrhD(cG*J9=+sH@@qG!@?!##UEu`<<;fXBi}~}$+vL1kcGOa+6Q*u+ zxc;2{4OS}WN~ziY0r~)IXcXoVx6=Nk)rV_{Sd``Gujw zVj_Q6>Ti-$z(18{m1-l>hw=ul_O~p3EZ7oSl5dh92Mq>YN~zD#JDlNjB0(bZ6enfJ z3;e}pU$93xvK4ez%S0+a2c`aj z#E{t*d;H?9+zYC3QyR`4eWiWn3b++t9&mIa^T1!8IXi$k&+h9fPIsTaEEE4RadZ5n zhs;}cw=&+@&-dlX{VJ1h6EMAF=UKuto5+^tIxLz?f7~&}RXK63c;R~MA&+3sF?*3l zO6MOQEm%-qbevT`k1?_|oSd9ZjquE<$g+pw_E@W3*W!5A9}^g@sih)ipor1~a_RUI0HNaUnYg#Hi?y4OxCFI zdwD(}>rKY@Sy?Q*4r-vMM}2wSC3G*>K7(dE^Yfbc=_VkpWXux+H$23X<|6~R9Yy;u zp8G7glcC=B=@iYOhobp%k#U-AlMkZ zq%Veq6<^ES;aH{C+>^e*w}Nuyy}Ss>#Cqzu<*g*qB-W zZ#8oAAHC^6c;PSL>UbKyfKYV6M1XZ!M>jzs1I>6^cXn2zn!y$2!uho`yn|Lk54pWnFy)iC{?j-U10eAXC!MgIgo zF*h$p@1LhY23q$UStCtTn@z!O)7t)@VNv%^{{%jOwSKZj8GlunzEk+r(HD?f&wt|Z z{rXS$DoiO#G(6+OIF3}}p*%wwO}n{+c3pe4KfvOw{6AS-b?%ubUyVJg`G4BB6u*C7 zZTu4luX}BzEg0TjYuWJ+5tz<)e>=XfUnW;io$|23GQVLZv8Bd^I=4^6E8KIgXO=he zhuqUz-)uVl_9#7=5A}jRvmPOwO^yEP&|RE-hZEh%}wC%Hm?ja*f_mW zoV47qQYCYf&$jN?`Rts{LgJ5RSUMvt1jdUH7u(LWJ#bSx*3YO2A2GTHolINrET#Qp z!~kj~>qWlS#A_)(#rq(Yf=v5a^^$j6ex_+**rsEpq^g_xs6qzg4g503#GUkbTC%(MjUDSeF zt3BRc_akRLG8=u&~#a@FDjM2kX zZCcrA1B%R&EcD)f(18%DKT&wXw^4u_etch!8^XVS#uAI0aWdjZ(#+A%Pao>|+#@`J z*BB>08^%IS*WkVPO5=2bp|o9n0(8v@whXijQ za)r8yNSQj`7tO4`GRr0Aw@>(osPHw2{RP*&i3|pA|9f+7P2O4}Jg*0mW5Lx+m%Ixl z`*AGZ8$|pl!Da4}OS4{+b&2-ed66vN04mPCe2t8S?EBp+vriuB87>8+YLXVbGeGmhIW8Z09Hx#%x$o(}!!pXz;g*4|T00FvSIjJgj z!{xf83nbO^gJDcNok24#|3k1IbaqyoGf+||78{`;btIku!c67Dezf$H={YypfGVlh z)zMEMSk?_O!U`gk*=*;U4@|Ld7{7C~H2~qrny_$q`<6q$o+JK>_ZdIaSoIy1Ks7lFGIhRU-JmQ7_bH?4g`aHcfuQ1{#yvzrjhl#tp;a4-Yt;=Q;%}k#Y3>98D${v(aezbAV1F7(2!25m6$-5QXS2SLfpRh&u}>ZEO7G; z7*zD%QMiA&z8+zE&P3C5NfWk=CAg3*;UtnyX_KZ6F-v)iqLP3(0YIw!bm3L*F6ojTXEE_0+@&v0Ez1-h z*y5@8yg;g77}dqiN&CiuGnOvoVnH*HNED(`X9gR{D`XL*h?Eea?00&%K6sU4_Xi1S zuKh*tYzK2<_q3@H8=@24Rb?DESsfo{MD}DUq4>y^6U$-~j%J&5R+Z3Vpv~1Wd9n1C zIVzm3w_FLHJ293dBYfKZ6ltfhXmeK(_UV%#)Q#!uQ$%QllgZPwWenQ{6lCX~0B}9K z7x*@TpWc8sk6*VVcu(_LEJb|Ex?s(F-IH%IqQF`W8ER9e+HK}MqxuM&?u#6QaH$8-)5)bm`>mQ^b33HhAa|Oc37(qeJy;YbQ0ylAvU5kCM zlwPRd!#`caig#BSc{o)lJ9XV;(I8`$q5~vG+&U3oB`IN_nHL7$1nYw~qr+xLPQ$bE|A92sfZh$TgPUC6ES^cKsK(Wudaxb!S;zE-hoeFeh# zZN8KtrXu0(prnLk5!6u_dQ1fH7?7oT|1r2Bp&cAAXYWInN&LB`78p!$0FkI8gfoPN zqEwa+oBirr3^G957<&&EPHZAFKxdY3f>|NbnaUxLTKE0h#@seCE`t`FrB^RAJ8etP zW-`R$a0>!ozTrd5nX$`PNQ}jqBWifap1tq%xM(zk(@t%(4+;s8@^ESy$05eq3!A$? zi_V(aB2rbi%$|KkRTEE+@VOWB^g_530p7?IoUi4+yoQ;=AK#^NOY>^O&>^y;=YcHi zD+GaL?mg$n7RLKs?Nn5naev)r%iBm*%%Vj6HT+kJytwzX00DiDVQLeZ%8!kmJ!0^L zsFUXDodcJK*$vz&Fs_U5NEI+~zR4u}hD;~d9uwC7#1QUAMM$A`(l3qd)s)TE?4&ew zN0IO(o;xAY)5y74AK7Pnw`Gt?^0>yjZdxG4&6LuGlgoEnt8_`FMxe+$9BGe$_tlH} zZoWMsQ#v$T$HFbK{;S1OgOU%;yvKcB4F6D$VEd7UAZh2dy-nA))Y(ltoO*DrZ=~8# zuD5*oykw&I4}I8`tLEoo>m6L;7%4jss8aGbcFsxwc}et%yG?DxJJAts1qK5Nj7Hro zcsK&;GrU(hfCz+-f*2S1SHKv^Up@}w;(-VnrhyhFVPYY zN8*-@EIjJxE#h!3d{n7bY@^w1praKX`__iYg6lBG%RaN{;e{s~NKLp?>hCsb&P+QO z&<@&oRFuUqY2u6)LncaTG(w$DZ)9~~pztsYfE;i~W^VW(q24-k0^5?W9r(dOmibQq!P(W>oSA&+ zsbEx98DG`X+PTJnUF&}tC+lyul&^XhQ)SH$yN$&d0LArjhaPI{@iBp&1_0|>J~q_y zTWAmDL$iBzPn>I}-ysjxe^8FyIjK*#!ke_%m?0y%tQMH_ddl37p)uxH%%`(Fo*lvc z;@IGe%0jq)5H8_8H0u(+d6Tax(S!eTyZLOSx6v;8SzYNwjah@eR*!v190e|NYL#UM zt`@&dE@&clr}(&bT|T#T+*E4Re8-mfEfli^!oc=1Zc?g&~eA_3<7TV#YAOAmQV>7T{kgdDzK7XqMk425nX- zsswFl)o|6SXDsHE=}k?#oF4B+ZdUm*Sj;OF*<})}`kzuS`y%B^o2BWzn>~eQdg}J< z*?=k=5!HVjpW{AgAbz7WK*bk9=WmB4OGWUqNY*OCtC(4Hh$z06HoW%-(Y@-1HIFc> zxXv;m1$r~;kvg)v5f1J4L^sV~yU)5M^#OZ!rU{jael|=e5$VA0~h0c zJfKJ4%}VN`Y(D;;t=EwL0_(R)bPq#ji=+R?*gFMR8u!iGu`#i28!NVL+qP{@Y}=UF zwv&l%+n#)RtG=qe-`dZ?bGpv&TK(&P_tiAC@h3ABIusLl8OsDlrH-F;dVza>=&wR2 za2-Hrx8J@0-VXQuGa)VUt|R~IeZbBVl)onPpL7>=I9OLGD93}jFgPoLPtGmb^oO+3 z7_~CiT5FrM#sIxLB~E8I>oU=Hd8NJG*IXh#wzaX(aT2;_F8j4Nr%u2GEOl1^jjb8! zn-l8dHaW*8)qCe!?ZhruSt(ytXfj!_*yJ@PiEN6_T!S(ENXOBQfm92Yv*O~Rx*hD_ zm=B?~EIYYERz#RjeEhh@@}R}f&*4b3dZ$+wrku}2E3uhPy~4>cO-{(d1XSON^`lO# z@5JateB{Mt*x`RD5;F#DWkm- zWUu#Y??0FfD9bC)YR_2|#ng+`y8rac+Z?oixuI~x`tO?^O=Hhy_saI}NB8dE=yzV^ z`ECAt#qfQQp*geXAGo4t1+}vmVm3Uy8vTrm!+LDn?HosN%N^jfMk&qTb4(lYkr_lb zQ+Q-WaLcZ7zZ>_XRoYk!xx1Ss@E`R2MPr`pjYOejklu)|j&!n{&44(5M_n2op{@`C zdI*Uz7}QIpFP`A=^)_0DnsQ;!0kM6y;ZH4@>ge5B5C_+{<&GNQn{gNYbSFpl ziyqxX8!Yb*W9P@P4_iSz;J=q>KdiG%9?hd|Ya_vZ6%FZ1E@A!(AZAEFZ6}fxb5*z_ z-~D}UH{#TIm=(ddB|*fZ(j#dM(GhqLu~Y;(3xz}tV*pBa;zY7RMJ=>sM9)E-KDreJ z;T&9Mw0snn7D`7~QaP+#rU5y-!9)YV8)y>hArW6{ml$x}>N;TCVWMfGM7H%CEQ+9r z`k>D?&?#(z87zJlZE`9jOsHZ|?OpvXb}&e@CfjDlL3az?8F@{z{WjJ0D2SjK*-&qS z;t@gWm+&ROuL*KU9VdoBwf__qQp>*f*BMqZ%&}Xy3v2+>-?$%HGsDl)DBiPTTx)cU zN^35AD1M~>T^c68L2@piQ=@JMm|`+`%1mK4ek^8cii^`1cT6(`!rQEm4E|4|W|btU zn4c`D*6sp!JUA7^;#*hi7_GAld57w6)yKp(JznY`dXPM>CU9!FM6CyL5s%a0*4WVV zpAKisNk5EK@#k|*qV_4!*F-WknBwJT^MtNV!N`T*hn*&)Z|NkoHBu ztxNPD7}q}|6<+a8ECMv2kcHEoRkv)UBf`?=N4o-QGxQ20c|&%(sC zjAztn!v_Wthv^4QVHi`Ccj&)GGaG~I3l?S!f!U_9#k2slZrO*N;DR*z$;XW?0W=K8 zZImuXN)J?Q`SZcmi#$*4T1?T&Tl0SDK}px-p5Y_g3vDIMLC0HqZ&lV@2MwH}#KUDk ztTTP3)?qZ(Za;aehLq*S%9`EWU~Ti%t3!x%2>kd9_Rcu+1JM^GHhbp8T)nlE$S&kT z(LE^-)+r2>N%Z$iv(_+DvPRPRRku;^3{w!FemQf1ouilZ7{}@bZm12Oy%y~x%d-xw zdvQYBSGjvMEZrl5u*;eB1bcwx`6X#(C ztkwRw=zP&^Gw$|O9QP?oq5OakmDj;cy8pma!&tJzRkTd~r$|CFHMCm!pgi5L2hy`f zIrJ?ZXO|QVJ&sbgW`611lA0VV2iFkHA?r<4pl4{4Q|F09qn`VC(M7$z-=ABYW54O} z&gHpJeX!0sOMrm70$Y`%EU_*R`$sHn5S(y9$BG^WogucL&j#aNG|hwGNUzf{|D1uW zKww?N2Ehq@TZQ_vjGgAo+cRcKY0U%a3k@izC(-@ zXDV&PDqr;tRipcI?yrb$2w0owY`oZlKBQRwAu3tg3@7PSz!kPxSR2m7;J+qMGqJs} zu|2@xlTK5NM;IEnd22496qrhe*5OD-c(*#Eaw1Zv5v5`?mBk>?*7H%#kOUs@)qZ)Q zVjT`t$>jSRkq0}9z#?eMxPjrB_B-RXE9T%WGx|PO(z0BG*%+ZhDpUv@%{^WtQnDEu z5H1;0kX-?BDzA`5Ef}H{JYeG=^8`A;A&{Q7Hr$G&UL6w?O!I_5Hv-id5O%*jq$M=K zD#^6GutAn{?WZIP^a$(3+sJDQ`?M*(|J!pVk?WLPV{*Aqno^NC%nFI=FRdViUEUif z9XORdT|X#`oL!l(B~(L>O%4^dFt3243O%$5V-HoZ227Dk*>Y9pEZD|SC1i0P1~g~s zQI@6|Z1ya9SeN$bW?a@5QKq)=5GvNmm$!E*9>6HGyVlu$bMY5(s9)_%+_~!6 zPn=f5QE13?kql`enV6QfhT1%txSJky|5-*#TSv;}*;UPBQNm0MrR@o*rQYhh{O(fe zkNpJb<2`EsRf64#&dQtAAWQ-8DGueih>cZTm^9vp%yn&!>E8|es@+Fhi(57NC2Bu> z^%P{m<3gNv5Q1Y>yk){_=mkm`!YCoB54o(=y}l-P`&?-Exg1OAB8Cr@XPk*(@eR`~a_sU)+@X_nqD1COSt@0>lXJ*MoH zUXDSU@x=lJH(Q>{RJi;9c~SoAn@#JL%YgHd8_CUN-C;LpjM-SPGQ*FpJ~Fr zPoD&M6HjUUpBSHURPX;m{c-$P>W_t$`G2=2w8vvf+u^%EXzn4UQblS63K1YKfqif~ z?ZXi3$1!FN-}iSoBo(8`NE)0P=Ei0uLec5v<$wP4o6QZ~IMscg*gNf^U>^4tY`^TncAIh0h}5 z4ESQFG6yH=AN(2x9E{jnir-@{$68V%Zt{fD=4#i1^J+KvW{(UAqq125!FzvC(By z)+Sr3Us}A$R}(k>OSU5}39pRE`aR|4nZJIm;-yip6){hNp*(RFFi)IEa7GU+It!}^ zOBcp_eo>Q^?u}_(C&|!9w=QyCpTBh^hn*iQFRGPFc*ytuGi2}56#>ntyEPtPwyz0p!6+zJVGlcORfR%w5YJiPjcQ(c-1!2Wq8L9`g9z~ zfE>ZQpkeqH62JGl7u0OolDpLgJs=kodj^reIqas?L%E?OKV^)r=&@T}syjgZVjH(G zt=vJfit9kfscY2`r$d{O>ymdr2DaKUm3xwV>OeQ&O*d#07lm;t#uS8kWD1KvEe~av z#?#i#AI7?dHj9xO_X*9wM9iO;0j0%I1h(d_*Zoz}V3e3^OfFq-M_(^@fGN_`VJtEE zCnNMGA_phCDIiphP{HnIG3U}EZsN3KN9RQ{7=LFEZM49mMf0UMv^a=^`&*tW8-%Gq z@?M=$rj$vCgpi1U%QWOD!ei{HkTXYYIGKu!R}(pThA>1c0|FEb5Qy_^Jw?fAagrV^ z6xQz4Hm(>5JBt@PWv$}&YMT<;_QXR+0vRv|-n?tXQY^_ML>%1^?QE;!WSV=-d0}s|MkzIiIKJ7 z6cp`@R3hnz1|R$+%+L+f&TX;@+lXEcMA8Diu7lItKTc9F_`mx+Yp`(+Fs((}>u19B z_@0y`JmfwYppg?@JbwlU)Z+aQ&e}}kv5wC(#%BsC$0Qieq3{mebBw9oDtYrOuBFy6 z!?lFi5R=4sIdqhMJv$2jMu2nV5b23$0RWhIwu~nicqdQPoNQ4@cVz=O>IS<}RiEzw z3F1RDeA`7!pGrUb?j#AAL!`(>>0C@Pj-DfqOCi5qDg$yXWo^I!RzEdsJ+(R~OdLf^qk)GTRz$2;l z>5l`di%R3v8OPsqcUIW2Dr# zFgX`(W|hH_twv_s)&-N+*nu|Ls&7kR0N+*kibpEJ5k-l?jSYyrCCtD zKHXC~p$Qu6FQ(n$M=OF`dQ@Y_C`I>u(V+wHP%3(_d!{Sne5_QB@pLmH7$j~dIMj*D z>9%X>AjxQcQ-T%a;Dcq`%b|}qVn^Vd+x70;jw!id6ZztZ5($6GthSxbhyV*IxDnlV zU=oKHH65D@D9jzhi0QuE#6>MJS(EfFc0Vn0!e|ouP*bLxsG){3#aK71--qZQ9efrr zaBDkr<}3~(O%jX)8PJ8{3J%B4q=b3Bg=WIS+47wo1iN8SSaK6CP)$fLcN&u}w$WpC zf{0Ejz)-i@kbWgUO5}ywiqlRwQ<|Y~NDn)lve_g~jtljTeXoo_g)dTvt9-)2h ziLTWw1qul#h5liTDFqvuk$<Fu}1qh~1s46;v31>{gNbYf+AsraR86JimW z+ema33H-w~0~Ha6Vw=Q^ovcYt=wO0RU5OiV19R`sK?65M-aOt~s+BQRsy1pmfx?Cr z>$#BySZ{(snjI=AvpY$;9&YIK?taD}(tE=6Rf?O^I>YQyS!eHDl+sPD#Hu2CAB(JE zkd{LjC-1o~8J6iv6e-ODr}lpkMV+Q`s#pNW3|96d*zyJP@M>_xzVj%tZIq(RPl6w9 zxn#ZO-L?u9Y~X8vE%U|e)V$|&)A<#hqShX4!kG5+X8BIES2I@+4nPTK8 z9nFeSP##VliAls--c&s18pmqvn}d1fOhD)Ar(x;Tnzns0%PA?0uXJhHryevy9~T6* zQGP+MJVBq=eMf0hbG(rgK4RUp*KsUz!qI&=p!MH30-ECUt!pS^FDqdLzlfAqbegM^ zv11a0=KW_u7B>OmrVN%L^Axz4B?Luu11#vdnwO@FwxT|J(~h0eYF}9LwnC=*l~v4#zV__1m;L<68H3~2?V3MtzALa zrD4_RQVjNbz9s;5HKj`nE$!M3&MsI8)g-2gs-zUVp%Q@@XySn_fo~PyPZ(b;&O_v@ zXuvC!PExle;q|BDN~TFf-t*4u^N`E6e^w!I3m;-5FlzBi&;i;7+@)87F6&u1p`v=R z6Y__(h{)W+Ks}p^ShYV|TQo&l6{m^~+nm2aAerQIp;Z&1_r8vJACyYmne?w^t3Gph z?$#2I&UOgsj^&~Q(L~Y!ctc6mbW)U?N%&g1W2>%`qK&3rg7JP^aW{129Jr361*sRUsq72y%b6SQ-P>ws7RVD36Jrf7= zX;|!Z_2q#)AABEF)T0}_3oCS_c;*(cuVqg49$5$Z8D%upJANFb^(gZ`gVM*AE7eA5rP@CiRFXYpA z+Edbj1(aLhlJn86Fah-$T)1(b@k{1Qqc8{z^#TiQ{oitWO&JlL zr=~cc0wl=B=~$jPQ#w$!U_wH8<~shMr#CW24U2Xna5R?D8(Na&*e*Wtlb=(lHkhD?bOJ20PR-FCwnRwo|@%8%zK%!5KT z$WUxISCuRE= zI&pdW{lb?r#YA}4 z{`plZr}vpUXTZPiulwtTtRc5QUP$+<%TgssHu1^5^yg6!2xC?a(>unSHTOMof7Y7b zE>iUuY!Ad~%0};~F;rCX!v_y~ypNDpaE|?D>5TEs_@d$; zv@=}r9c1UD`j^rYd90Zyj7^- z_OZRO*Mc?i*L&GFs7a_!^nbY00RPpM#>~d@zW|xTTK^{nYWC^}^jq(LMm+5jJ7F7s zkuhaW5w9J-I7cx=GhelMlS9$_n2r-`R*zOF5BGdt5Yyv+4-Jn;HwL~rX!`dD=iR=I zZapFL)AxQSwS$>8!KD$LIiZD7UDN-#^hZad&#iH?8Epq^=jg39RCXh!Y*x2HCwy*}n`X+NpC57j#&}Z`n!AE?LRy-~x&f$75GOw0$++tEelQ)> zzX8dgyGCnwnv-l%JSznLJe!K0|1JhpZjbNtddNmOul?ICtTXN^x4$3mS0-ocF2I@V ze|^G6t+A@(>}=XR$T6SzY;>;PxTUNRgi(@r_2{@7D4lcB*DN@Sw}%?^uN!WffenS3 zrjn^DrpR@wO@~#*Tp+*7I4I@tP57#=X>Im7y(@#g)8E0?Egx+9hB;L*_*MGA4@xuk z5Fbp+=j8NtSO2n34`bR<8#CO@?AnM4ZWeJqKmA*KDZ+bQ;niiT79Hsq!gYRfH0{}+ zoqA(`&1kn_y!nW&?PGV5DdOX9Ji}yfj&p!c@U;kh8z!OOt$6&Jyr;Uu8BW0=Ls>3^ z&DlYvt#4s1G*?@ONs8OJoIU7}jYVmyU91!!Onbt&tWc)+rq^R5HhjNP`lW@s2ruauj*Mwm2fC$JQ7fq!j>*le3z+Bky<3AzBy z>!f=#0SyDMvBTk{PAhe*$~`A%M6${A%&34^hn4kqM6zA6vd5Xw48$L{YPHLcoA4@rX>1gXN;M`5=lzL9l@+zs*Rpme)>TTlLZ#xo|bTmsz zViCjcHx_CDHT4$6VjT~S&}+w)kPTwjc6%i~)G>|5h!N=$&60@gC`Oc8WIaO6nbZY~ zXcOSua=)fj278eBr%VxkQqIUc;&7uB+n|Aqwbxi0-v1py^-tW9R(w8$Z|+H z6bHneNtv_p>me;KY{MU=0BH)-*MwCa`k=oGp}3SE+jBZ+8;L%ZIh3>uwWkWto9Z6w zXC2(TjRC<*>I^svd!axW1~A`lL>B;+{L@Qs8LLzZw*oFK@tz>^-+7+yuB4{55tF65 zWw(QnT@t5&h=8LG`+oR53HL;610?OntDEM#n0C$yd6*UC_}`?tv;--D8Uv9gV8xh7 zMW2tLLn{)SQbTVKP4XT|)Dz3w9dVG{@@_xgbu0!2Zwv}=Cwet;dW1c{)3Q^{$B&x6 zvJUOukvd0D?UU3IRkZ8aCV4ZrF40o@XKELBGeQbltxAHs9|0Tj1*sQ5dN@&`9vs`< zXVMA~i!hA>yHBRxH*l#_idzv|HimAG(LLz2F9M$lA~YauSlh``B~^xJcCu`%@U-oV zmVBjyW-Bj1p~{Toz|34RLQ75MdoNF1%9jJU4HTx~O-0ou_5xNLp&G$a^UKGZ&oTjZ z!1*=QqGY;6hQPHR9d4}8~S2Fq#52d@dt~g+Mz4ubl^1GJFPAq32d%8wnlM?@f-#E(>rvP}hKEc>Fil*NeVPn0X=@SQ0>B_^TF zr}CXB)ibKk8hEizSD0q-RMd{JmL>Amy%LbNC9xUmrdUy9ND4`WV|yF}(20%g<(9k3 z<>J5fi~>`Rjx5k$o#=X{^+OJfOGUQ4lE9G^ z=1^zaNxoH^6@_6rH%he?bHOYQ8z*ZybPKvbGZW{Dt4`A8 z#eD_tacp-29fvKTmp&u@M)dDj5!L7k3wA(T|1C`$Oy5G&y}&XnqP!D?x@y;y+Ra}Y zPxW?+xW(E{96f)GBj3=Sr+db4D%*aR;Wn=s$!3?kc4@XrJ3tz5ZKMEacd0Faxy7#k zVA4|tcuI;aHG2WJbKM)QxUn~Nq_%DsNc)uKbK<yk!nsp?*ppz40v$O=Bs zOjQZwPl9EK6{(Le{1Rey(jR>~!A;*cI*)(tdN4G1R2HYl#YBCFb1y!ZppEE&2jK@! zxdk`tO<0qabJ?Z>jQO&*gpErbohyAR(384$In=i_J|#H@TXOKoFQ#AK-Vtt#XD0cN z*VRvDG~FR@*=pLfO6?X;xSwCkJvIJ;?bZfzUiTHDjy$GjdKy({64($jO6Rl;LP70G z$0#-4&58C&%S{9FM@}AS3y6%VDE1T~f zhID4!vR02y8`sLY3Ph4~MGn@IwT$DzQf>I;f3}6K&v8!c#v1TC2H!l~)Cm3(U}d~~ z28}#Eanw|v&Y4~E8rjRcEK9jsOoDNVBO@F~g!2*WfF4_v<#$VkH!o#Tc z2W8AfxX+$fH)4GuQYc)_f7-{F`X{k!A#IyRnsXZ5*7_kuw!m+{PeKBG4PlUfNxHc)+G`a0n%z%s+e(Y+~k#3DCNb7b=9q_nOx z=4U`T|73l%OV_#mJgjYGwriMl__!J6x5O)?7L5n?Ao{K5fe`_#CoBcnNiL>|;n=0I zDhxcQF33CMD7^qmSdJq=B%@x@=ML=8x_+TfL`lr`KWl0p@R*wYzWKNHS zp|NY zBJb~CIih?lz?}Qw1KVIf^mV)t<|w;lg;V66s&U<;&ec5$m?R+STP=fKPq+e}v`4X` zS|IAXnOmBG3FIUa4=D1pVWQ-anqL2}MV@~nevp{rRR{AfWFM6F(KkeO>fu^14?t2f zLf!=`N~k!t*fn{_w|#vHs!(D;Oo@u~By!8-V+qD&FM2>MGff-j>lq9%5}O%ne8!?c zTVrYAZr7?{dae)t#k~YERdd@U@W2W8gtQr?<3-%qkU>-S&aIcK?z{CFyy6_CoN}(w zv6-Kwq~USn01D;Ws|X;6k>aBku!WFB3UBlqvZqUD=NDRw(rkxUe!BaJ*PbH1BHstYK9=XKVx2G7oqSs;cd; zK|}T0gnsj48jUbAOfSObp6OK-)^i4%Pc*RQIw-QsQ+5*H;J&?GTda9IJ1YM1Rzc<_G#3f>5?WH;|0|G!M%zDh&`1q2*0+mzy7?!!XWH9?Ns04Y>`=TWbeSz|nETe8RbXBM+J3Uczrd)ky+FUohrW4iAjY~L>hi3hP_ zVf)ZvHjmck~57Ur7vvDi>(AY9s$(CH6R1`HZ$I z4FgD=tuY9e`uGjgwKZHWvmKf5-!|^~yqo#uMqjh>IyF1i5-un|?KMhad6-e6WsGKJ zSvG}mfdZ&1QJm6t%Jx)WLMWQS+T66tgrXZ`s;56No;vmHQRvTBp~zzwc6X)e5=aXh zrPMNtk6e$qn+eutmQZyElxdu-S_ccXW~tYoY>rbmMri3f!$R7{0e&$Y6^~=ZQV%zX?m1efAKz~+#?Ex!_HdqUoF)q#spF%<6|8>|6}r1V+Sp(%T;~5S^X9P!Ro@ z-y*5xuN&ivaGj2;`&K0ClO;$=T@sV#DG(7fBD?x?C-n@heN06fUx1}vV@mo^?K~Ne8u6} zs0bI?;GI1A+V(T^LHJ3qR3U!JOD*RYT*9cfh>^zY6nI&{Pne4^{@cc7DBrvlnTSfP zF{+8smHx?K>WJ0Ij%<~6en#P<2s{E@2efQ8tCTmWQ*2}Cm1U{Z+!hJ}X2URQg%wKV zsG(ZyHnw1kh_Kz-BU&+{vm>=2ZQQPLQReZ=K2r3Zb*%hrEPx-j{D#Ykl=-wRxAp5> zpd{U*^NVRn`1&mt97mTF%Z(sPo_64PmaTVp!tdsljZV)ieS~25q%*S4_HbDN`w*5q zFvWpJB=i9a*}lZvYM8CokIm>SzK^CY$XKJhm&Xs<_@t5$>m;_+0`(8y)I^OcrH0jF zpFr#Co{n^Mt;Qk|W6tze+ke9x*X1uOe!|$aHG3g&F#i8s;^wUKo7xp6vERZF3dj-@ zom!^8(`L0&zkdm>kci^w&tx~?4jW3b_4H|=d@!LYwc5yP?YBSRcQX2FiM!b4cUN4y zG}&1Bb8#5USaJ%$VCkUhSg+j4dyMGJ>g=zM3%59lDM)bAp?s%EK<&wuDvKHvgAKgh z!V{9#c8zu#IPU^Bd^-e3SU#E$d&m9W?7*TNw%{5?8^M#-RW-a$=ZYe zzdQXut{H|q5+N30r=%B#36YW#d&ck-d2gOqJSv&=irovTMVqNIvSu}PE|=V4}ns z&!#sNF93rpEYMZy+fp+j2d_N{y~Du#Vfn=+@kbv;+K+!2XbGZC_3KWWQr z<#pnu%L+LO(oqp>zGuvb;=5(`(V;>Fh4bYO#g@sBZTO{Eyq4ZPW@J{i?0%>S4CeT( zOIJ}2PTN(Ks-~Cf6hvnA*6HLLX#{&NU(sULSYwUOR~3FCWvg`VZdM$Of^2qw9ODvl zLxpF~+Dj4zEe6)NNZ{IE9s=fosq>2;)|zG`D!r)ea-|YHjaN`LCCFjKw)}iM!$jX) zO3X0H+dEZC2oqSndf>HZ-OnJSn|@)93y17|3w>RhxclhV9y{OrvmfX>T<2eSw;)cz z0)ji}L9OTcjkxkx+}E}wCQmoNvUTW^ttZV}#Wdt}D%0cW=eOya+?Rj+<;%mjx`@~8 z_YTX@@i({dXZiPcxw;2Mc5CpraGcVYe9m{LrOh7!;jP%w<OuEHo3W+SC;9%w~q%k5C zvRx`kpm3|p@$jb+$wOf#m9Mk`fyraHb+Vp4Ye+-ye`5nc5mILiM#VL|Zb$3@I(>i{ zJ5jo@{VaL}b^%@ZSWVG-Pdv6(R6B;GmRmg@w0S_m(y`UWfQbx60KseR$*i|*$DTO( z>;jF`yu9=yzJV0ZtArQi#`p|`!7@&BBMVQW7CE9k1MYp(n+l9LpK`3?!0BAGa2Ry_ zR*;_reG{Z_KbAABHUz$rcu*l3>Svhf1J+&f4)3SRKjz%~+(r=a)U zB3feU`sfVG-!du0=l6;Cxa}mlY;)eFIuydE;2Os@Jln6KKg-eO?vpd6ag&DN@hf~* zs`NlB1HnqL7xsHEH|Rd=A59NeYqE&~xkw2sWx|aG@nrALh^)jF-JKTSFjK*K6?!d( z9-~CvU>f=lBzh^Tq36Q1T7#@Lwe!+mhDMws1+OqY*mPYz11sdhimL69jFT19225i% z#NfcoOp;aSti=+>wHK*j?=8AzuMX2PZ zDF6YYS^Yrs|9FB=bfk~vmNUOg<3?@%d4*I9IJ%;!CVXw}f?P(skL2hw_jzb8Obq0i z90tX$f*I{8tRKwSuY}F)g4C|%83V3R4d1oU3q_gpM**i4jK_sX$SPw~!JEI4 zCN>IHoYgS8R0&N>xF{CzpIVz2F#Wy9N+@M`1fem;Z83Q$vqmjMj4F2`A>7<=2%gkX z^}a-NZvNS?XTvsx7Zl96Yu*_``0+=a+y`IVT^muHPDshho!!K4c;#~D0qA0pFLvJo zzYwOzV+DlEw!#MZYcY~=e94~9dY0_>jhxmf2GcRH@mpUTZ$GGHnr!w#liE~u1;2P4BXx2-zdWJFS^o@%A7;IK3S-=bp1Stkr`Ww4J5 z+eG;VBdFpgoQAugs?tw1hUy}aL*8;(6uz-G%0SY}>}Z`iNMOi^O{qD&Ovn``H49l) z+9k;Tja}NL)t20~qoW7nZNO6(jwJMk5OlA}w)GAqh4;+GC9RREZCUM`skq>HVZQTj zN=cBDe>q`QrNe82(Xm*TtR&`^LXURBse6fwP7<|J|Pz4 z>P3!_fVA1Exjw6FMMg(%YoB@Ll??=3F1es6LJ{rylIr64ISspk0OGfd!ZfYiqWE+z2{=?O7=GFd z5|b7c)!dE=V3XxOwrT)HkLYc>mdC(0C(k%GrBd`TC20LTtIEK+3bwVIwrI?OY4p_@ z^N3}DD9Qp$X)d-vBTm`%NNtDXx!onAQz^ZfE{MirW3{7R1nFxJX^W*<)`nW^zH1`3 znLClgwkpgh!jKFwvM!(?ArHGp%L8U4b)gPoI~iN)l5Y+6yuOCZ!6F@4{Ix5rCNgCq~r+0>9tA zT%Lwf`MBjSaU`(UzJo^XcVmVv^q8aM(EH}Fpx|@6fe24=0IXfA?YaUO4-}ViL1@c- zSWfl9b_zZ$hih3SbR4gka|S0Eosw5(viF7rawq?QL#?j$c`WE27QQy%tU!_VB6P%@M+qU}MA8q3x2TH`GPAv zrH7VYsnke23}ro4)&g4X(lgW&2fpA%@=fEoRDj9pGD#3|^ucPy(*{R>&K!?irwnNx zdiP6TI3!&BlTQ;ico(q^G$IS^^7EAs6gtXCd!Z?l9qSqGLvVwF&GZ>{!HrK;l;H}GY`SUq z&$Dv9+Hrxw)6=*G_1I56;`I||jD5Vt{TeBCT1RIaX6^}x^6Y#wq!j8|D5uAp`7~n) z?5Z%Le4$b<`>^0#ETBs^feNtv;%KcWcfYt&4O002JrLWYAN8TjG=YJTrc*+;At%6= zNOH0oEBLd;OD?t!lqst7Y%{ z={dF8;Lqxio!MYYh#z3QC856ztVI@^cF+*Ic6i3&c3^V#jM&8W8v5dIyq)(I^~Jso zPC|gdZYYZ&M$<^_e32dG^4!{1s~QMCYy-mNrALI0n8en!TOS}N$A0a2jpqq?ChF+pj%S*511kY4ge1;DdOy~Q!>JvQ2RZnZ*36y?{YP`FzAYY4k2re zZCjX~Fo~Cx3WwoyCVSUTLu}gZS$*k>^ZFmpnzU`_WS7G`f=w?XRLUKnc`e#L=$@J^ zI!KCz;{4U)>O)D{-G_sdjpw^KQ(SZ(mqt2pG7g-OdsUWsIG^w3^_{)twV-r9!a?4` zV`+46IY7t%-=IIR;i{M6f4Kgb+5VgBkC~N&_5Z&9uC&@~kJ^x?ztG+Tr5iPL0>g1I z|3EshyP1c9+PdsRn<0PqRE-t3ly&mBa$^_WX(2PHRv#@66n5xypR#@h)2GwF78{+9 z=v(Ykynn2eUF7w+{@i{SiB8MK*V@;1yQt@Lfr`7bFShTaqak+bmNsy{=_5QcGbc>k zT{|%^1jhU)&^0{pzL=%)#QdRgYi*2gJe%KdS9MJYic8dIU|sQ|bw(0H;B^Jfxi?}9 zXd~RWXms-e4+TFSxPA2sFiZ`#A()z+MI?+1X9{6QZ0rM2wFP)cYOr$yc~2C|Y&Td7@A!%|VPCy`Uc(tr_XJ zEbsoI?-CtV)YMWkU}lhWT3O?VYWd?%UYXSAS2yEmn(XG&r0`t+V;G7HHjT^zHkH`m zAhw9nG$}CboBLvSe=9G+(?VayCE^kqj4=S;r#}DS0j9eq)H{ZjQDAQ;k$=m5{fnZl zw(1OGioZtyjNJlBvs&7Fd6qeuzPuMDGNK)7hBS6s9s_R=8}jH?{DJ_IF)#sNq$ZHx zjpp<(2|7w+;1R`CR3US7-@mAug86EN?dE;NTwGo&!H8pq2$Uk$55bU8?af48EoyVU zafod_gRCq~UD7ER^bwBP>Q(S1~~ z7EC6vQTV&=(k%Wsigwc%$JxMD{0?8hZzn_Uz!IH@5&~v3jU-S)_}(Dh`QETv0%;{U79VN08?{1 zY=q-f5XJFafg~ZU%4WLH06OknSqq7G61 zBFC@jrB#EeajNbG8G9F{KqD#1B?+S2W88kO@#)Lxg#d$~FlzGbZ_10?F-)PX!?n>@ zUK|r-=5h;@)3S%vpU1C}?t6&IcF~x6^C32|G4#@owttv`R!I2!_kWyJZfBB)c$*9| zDbVmziBOfi_sxAsDDX92$u%$zZG$!dO;DQkfbUfnhv3O`VUe@ z5~(J?WOY0tSx|~vgJ=ElN2GUqT!sfGfmFq@aUe96QD%DlLbQNX>bkwsFo-ECJi~-T zxVGY{6tVMSQPJKor4Rvr4R#lP(JpsPukE7Qzq8`RX6P&;j9dVdLd*PXgGD9S{XPwC z9vPGmklnz!%CpGfAqmAB@)h+sB37rjI)H2Wp2lWSz?U& z?CRm>eN=-xZcns?Z8H#!MwrxNj(7+;=caf}D5UCh=67xSu#MHH+Z_fGBv!ANbxbAf z`CDj{vZYcLNj|PVxN-@7scOwxpler8D%QhK(-lMU=Z)dr3gdP>w z&o?fg!(_%XasJymi{_-Hx~6JINYsz&tz2QSUZJ9Ym=)3+lTcwWGnHT@9LP?x>36uY zZBBE#g)w?6nuWQfSlS=VLq%DT>{m6nxrW+;!*@WZPged8=IZNR;BHG00s3}RCm z4#j3C7S3~mqNlXYUiH+!dp?}ND@c==KZ<9vI9BjCZ~`t2aLa_K;o~fKurX`m??cgKp|gc=0xl^#8F4IbAu#P(GZ`D{p~E5Pgesy@P&izk#2 zu@|}yg}+q%l21mZgGTD9CHqK!rk;#_Z9#Mg?!i@RXYfVqQF9*9W3{%XwWatKexfug zaN+cb>@Cb)6Cb8k>$R4xtP|jwbU{7!;sl(EUNP3Bfs`R#zx}fJQHX^ugFAK0-beLk z@xyOnDZ5G|*c0Bx8f2?W&?9X9hN^L0w{62qPxYZ@ZwRqqh6?llW9*#TGmExu9VZpr zw)4fT*tTuktk||~+qP|0Y}=>SxjO4P`(oeBXZ(UW+UUK#tx;jQtG(3dFls4zcxWKA zRDr>>x(Kb+7?>5ermUF2;7)?Y7qjiMxd1s4cULMZ@n3D(RODHdBj$YEDY)$(jm#)! zW7KxmM>j2d;}CuHyr^KHI5!8UleM{3da91%}w+ixNr~?wSj*7 ziED?8i5>Z<@k{C!J9pEzghP9-y1y~vCCH4PT8<%?=Y&>S*}BOXR6e;vd+7q8Om;&A;e2+w4T)1>hItofe*m9X`9KC@X} zK^SUaU^vOM%jIkblf>z@DjJi>$hp%16{+>~Clrv$a^kpX$L`R9x1ip9XtSa^Y+lqsdLk`ye&R8={i^lhziytBe7CsJTSdsM!3Fb7h>n%C zO#E$n=ByG(dn|!5b?_DmBfbEYdw*!Xm};P5$c%YDRl2P-;;NoN6vcS1GAM-5@`NDO z$z2!nCSSo;8F^g<-eq@LCFh+ot7_g|BmWN&>~VhL)o2*ss#3UAg15-g0B!fVx}veV z+*LrNGIrk(7hT;jI*`(Nz(Cr$+40gMpXVb0LOkx8*OGpA4XXdmIZ_$BC1InpR5wf( zbJw*CNktWKBom+6&9MNqO4k^ITe`gVVRsin7b*2wSAC8Z39(1N-Zlag_526pMrKB^0Opo^#5X^yQ7DS1ZrF(%>U|m+A4ZQt#l? z$v>3w($j(Ee-L~u|2xkEfQ9Y91>e7MKO6GDsMJT$<9|`9z=M%M=@6!?iT_-(fPXI8 zN8%WwdP1F<~TY^a7Vc z{)kH3Cauct(Rj9T$(4yw+t=p<<2g`~^I;3-T-@Ja##30p$A0D{^3WaQKx7UNbppua zc%SQl_1FthVnxmlK}`9^4;Hp-anLV?NMq#gZ8Gm)l7)cBx6iA`>!&s!oUQ&qIdDGX zjm`-Dew)aXY^@-`PI@us(Va8=fwENm{l3h?5nJG&%+ib3-2^dW&Jb>Enxmcxbq(u?f`l+z$fveKc(rG~mWo>-Zx zKbgJQr42gg9CKWYWsPLEP)3pIKJFro)Fg^2R#=GEJ(?0bLPc|c?LBTDC&@R|<}dBy zmU2sYx@I8xj>kT}?mb9Mj*1V=Bg=j>Z0GXoF$A66o#w9WvN zX)xnIff1xpOi`Z`6qtjQf>XLI;241va*-r4+a(G|>^ziBJb5EmWAW^6Bh*1=ubx;| z<;^B1zg4XsVGVT6o+`Fcc?_4AcT(JiteJyvFiAcG!~P~>(_CI&yWeq3qQZ02tBl64 z<nUzwb02uZ;pSWL;$so3!D%;>-nS<3}Uuz_r8_vkAbNJ zaY7>D32&X5W3j}AqM!g3coDac0X@*kio>3dUWP`sBpP&fUn8=rK$()&-N5JzZ?6uYJG<{w@hS zqj2x5du?RO@#{nB;gw<<0&G#Ux)hY6KVEpI$`njWft$*mLxSs9d3rn>GiazXt!2W8 zzye4AAmzvq@*{{b_81^ zA#6>-TkfG9j1t2b54i(=aCh8lgh`z`eILBvjL_D31LGN7PRgk{Yjj0|Ak}ZFDF`H# zgmJ7rE(O=Nasxi~$OnT;RrTtTAu=~3moYCoc6kTgxO`otmbNVKkX$pw%5^IQ{c;7) znJq-664uT;$x$pdOBnTMeqhOGOK=g)B5cPK7a^@I5Kgbv1&lnZ6(1?SdNGna(7?Q@ zyaokDzR&v4%S}zmTsndiep|aeunuap>}&bHjt3nkOp3d2E7l2 zjm=+xcW=Cta(%Dt(*6yr3|w`0*giq33nq9in9|N2LK3QIM#iNIK+O^N&(K3X*=H;~!1LYS_`7K}c`v(j5>OhE>Sd#lS@3D~1@em(xeQT5G=9ex$E2WL!t)eP`%w{y9 z%0xkpzw$3PsAl9>XALFw<0^?5xo@O57dmGJwq6u2A?<@=w@~B#@1JPzTK5ILfhXC& z_7b&;a=!rFYz5CFa?^NDioVONDh0Emw?7BRlMYHaOL_KR4oWn*QT7BTn`h$Q+Wf8~ zqi~|?4!6%wsg6i1yxF}m|TZIzLM&G;?v zi=m(13fea%HSwN4f4YqrjORTT9YYs#FDbU27YF9Q^zQz?r#W1#5Hv3poa8?9s%8j+ zU=~z@Z!FVHjwW%bhT0(XGV^MLU%1tOFS%1~K%PAy{D1=!a9sZnB7z<8znU5`G5*)o z=s%>*WgFc8&08-<68Y^fNC#s4AJk?CTw^UIS;myHF@2Zd+(e5$b@S@livim<)g-(? z96teh`)fyF^bCQEgsTv*u?EMlFhuY4eRuKe#%^1VuX2WwEcjwa&<%7rE)yOMl&*vQ zC%03KReFgnW9O9-R`(155geO2_s;vQbW1t8IG5RvV|I|(E+>dpJ9ztgv&m(U29JskrICWye(7M!>uEk{M;NZ~2nB3aa1ZB6uc(9bo zLO!noqr$?hqT+sMFxwHtDs7=v4Rfq(rC@2AMXghyP%2U}ZY?}!gPwgB`b2DkzCLpp z#O3Un!!3=V2skmENTGw(`K{6B4m9+Vk;AC@U4if$Mk2LPNFWEWt{#Ho-S zHP=SvXqpy(tWfsw5DlOP(&-?_TIsa8O9~s&qdB?2#|q+|1D3dukf=KYM{*A^Ou>1Z zN6>!HbF~~%ihvvNm@mZpvUo9jb=_{!ze2lG9ji#j!0R2lFZ3zcoC%oZR48q_8ej#6 zg8M7P#7k*8wSHd$Qq?MGFbka*U=_%AdFeTYlJ+Uma z%bPkGFTV>`xvWs)nBkWrD2C$vQ-aLBF+BmK&j!zQ`kdqW@7wXpXB2ib z69F8G(Ud@c@^vB$nyf#mov<^0!rxmMrv<*_e&Jmu3W8B;smV?MDfuuuACMq|f%emn zh@+}23!~LTB%kP(ql}yjg$}-La8Q5od3&h2a#;OI*+gk z33(Q~(_cl}G5hlO0ypB`V-8f|X@LreV6gy-J~6-ZA2O1-iH_-YYO+mRsl>@yfp5` z&&-m~vyvruyFg1xbxecH>_AV_Zx;f;6MLX6ffGi?NrL4F6x|Q{A?u+dbCsS|gw=p` zM4V~zz6i^5hhGM$dT4mfZ;^RV5qk+#ql^L$)$0Vc8rxiWau1-3({pr)UQudpvG1vK z!9C2dvb(J(DKS)*4y_j3<(xZ-lf0(qJv1S%;s^$g6yBmJ4_}fNO3gG4uL(s%GOV^lF#;?G>_zhzs^Kd z1w@f%ao+EoeDeT0pM4r77<_fCL2OMJo+?sghzCMrrO}SA<#(?^ol%wrA>;DKwvZYl zou4r$2PsL!sibFLpZpx-9EK)sYxp-9_j%|-68fNND3BWP45K_w8LYUov~9+Brw!Sh z9i^*6r>zdx;Tnl+5?z9>|4bKa)6mCB<_ht@OSRj6C!aSdl_*up6YekmQiIT>ym@!5 zV7=nH^+3T)?4WKltk=8rWX#Efc3XcU21y+7HBy=`-BEjaYy8Q<@LKk3t^CTNG&ki9 z4S;LZ3ki_Y^+o>@Vc4ZVW`2#(Fjg6a@2L?D>gcOPGAOJjKt@Wrx<-O%GEp5P@b`b3 zqF|h3`uI&OzA7g@nQ0|2?^cv`_lZ=sw zt{AF8mEE!UzWDM4nXbe}_Y&hmw*EZr-@gFXzjZE69gu8Yj-mXO;;%G+ezuX9@dO_A}RM!#yE>HEpP(LvwToF@O^>YRY0J9k_|@1mc-SbLRM8p+ zc+*}DE=A`v3)Vz=x426>O*@9$lzdV4I@$9TWDMN_JCGz#xT9>hF!2Wdguf&(y5zNd z@66qNd3Ee+#4bIJUpA|y#mC8e^G)@?epcWjulWEhatCQ&YNZSs zc=|dFCgOXzS`9iPWh32ePotmta(F<#i(d5%Nx78Bv)`##!jMn7IUebg_%V!w+v;3U z4<9D-v|7$S@s;pN#uH;+V+?kNw$8)@GcMJ+qt!}(H5;BEjJv)Bi|!)tp6M8Tbr5l- zGQfM{C5KPC3o9PMM3r{A#EJIny|owU1z;rgKZqTU|CK?K3BdAS;ZOfp?6mx+T;>sU zx=!62-Ts~g$*i5^ABOvTv?QG!9%wO@MCinNCH%TMn2 z@2^i>0*<~=ccYp00dJ_Z04d%nbc}E;=sGn5FonFWb}MadOEqY3pxtZqB}~rlW{k)) zhtG@B=_@-84t>dS`fNfA`UFgpXx6tRoTTa?k%DOQ5h%?B^R*|WQ+f8Oj=v=q_BK?6 z@xW|f!&r=#I;?PGSdh#3bYbP<>eItRhh_kSXWucn6lS7Mx}f3EHeqJMHwe_B_zgk> zuyRv4VX{k>>8z0HAExIVbyGqaMgevVv$Xk=NLgim=C2m%GuA(N04itDG+3Q^i6P4y z!KMf4P@0vQ;G)$9ywFuni2Z3xx0AN=LzNT(Ow;1^#;9R*=v?pDQnewQD&F&9EZbmW z+v+YSDF>LR$tlI8f6#o4Mm%;P@vC?6>clZfD-6gXyLDk?+&fNA(PJBO*b9Y)g`7yC z{8$C`zB`Fr3HyQ!GE3bp8#9LQRNej_tT0n%UYC$?*sqt4Uy=>#`B(77y3H=Ym1&0^ zYaaO5zy3_N0!{UqL{iH4L)U=l`@E9@xt6@CrXlQeY2%Q3gas}3z=c^8iaGWxdVlOo z($gfgL7$s#dDwfbgtumKgOJUx_6p98+fh5+_YuK7236 zS{!rV&7^=`{FT zyfNLnrD0-Hlo{?;#S3{s0s@--56c3^r4%LfY{(`Nk%~`D%7oa_9MKB&*k7HX)&@K7Tp!b8P28t4VZ%%r)-e{B|Tx^Itc zrXB;E%~+ij-rSTbc1J2{E_g#aUf^oj*qKBV1~(t9%GR{|?n^sTS0}n89Sg*q3fG!~ zhe8|MK3fk<5a`b2vvqep|JYdk1%x&Nu ztYA`bXKw>ono$ggBgy^9$#sWus!cNZfP9sYHbluAiez}pe49Lr(|7q}K#G|k6*CEJ5elL>iGFR(MalZeD_%lP>NI@g z>eU)IR(o?m)0U~)Pzo!JGG9=Y)CBN^4GH54vd4OoO(q6pwJvMEg7wtz7*va{0{r0J zl2oJ^Gmz`6x7=u(ym=XeYb`6%HRO}`GC3axeNc{p<>-gH&8fJDWjt$}Fq~^=h6eq=FD0+mV|GC1LXs2L|&FJ4D46oRX(*BJ>HC5KV}(3 z(aJgRp<^)7JZCscU{zLvLA?`T8TJMB8%_4ddYq_e9~O5`Dyvx^?h#-YkJaWHoPUt% zOtzTGmcEhO+sA?1MyP5s@fc87yeLfkwf{M7KHk~+Lw8`) zN-Y69((=cusQzuqn_a+RP|=GXwoNqvfAYgGlP`02_9NK(A7Ee8A&}fIc-cOP z9AUu1Nk$O5TQhA?NobO`HnQzY-p3P%qD*KkhaNll}L@et-Bg|S^mx;0y)(AfH_Y)itH zpq78rp^aKM3Io;bX4Zp5FI;FQXDQM*;vY!b{8MKn$BqIM#!@L6rut3>{k-TwQzQ8E z%~*4x_#)r9YIiRq5wpP5cQ0!d>bT2J_RR?IYBrq_xC!r|>gU5kE)j5oRd06neN$|S z6Rgo#iI;wtDl~ZYW$6ggn7mKe7OD|XX^lRo4W5N&oo}!XrdEPYR6o>mu39@M+#E!~ z7`p{ZlYifcl?J($Ma>XO{M}iyE0J4!zI5>#>*-bnSI;7713jH!Mgx)>Y6lli;9W2D zXzfWtaG6dwUHL1Nff;{+aV|m&T~Bt)fAO-Pit5^q7@ZN@&O=yvtmS#0MN@TZAMzsN z4EGXig;690G+tmkLRQpVwOPjA*-hH0!7Wdi1P(>#4Q4@qCCZ4O+0J!3U9Fg)j4}Qy zCpqY6w=)%D051kuP*!^?=HRl(NcNOUL{a#(05v;iIRy-v-)n7Erb3|}{lHS+WW>+o zAIXc8pV8lxESATGSm)$|b4~wCkWCO|nr1L-kixC~`vx7WupV_}iik-S)tQSVdmHJf zt{9)IHp4j5*+SSz#F^;BDWAY#atV!^7**s=(8((otFDH*d9Oe5IWZzrJ%rlsE915> zK^muKXmKe@8}0FpsOc$4LvL#TPx)L(%47AO7?A~M!>CYA>)w&Q9UU4k#ATkIKnN?U zTrZJ4N+hX@1#9NZS+aToS;a%ec><4btD)PvN8sKgrE$2^vD{BIwke9rg_2I z#+NYP5G^oO5*KT#U93_Si3Hz|2BQX|8@v~eAY+*k<{oCZhgvgU;Nhxrh)HM{dZY|# z=g}%TV4U+@Y?E3Rp**)GSvm{)SC8GQBJUTHdh3YMBn5)m#$6({K{{pozfyu$hH;tg z^5?Mc2ZJrqLtPC*EVed94y;Sq zIx++?v9l4e)5T?`Nvn1|N|CB$A~ZBHzR^p)+({>s8H03g`K1&edWH_d##hecsfh}~ zjB7BBL`qf{cTr|*nI>(1=ldbZ4Br;ARA2Q-Et1IB|Jg^y_5%__FLPuHrD|A!PTG@T zkutbkl0rr6L||%S{6Gt73zx!5Lfsbw7?;s1j=IcP=Jw3_BFEGO0Km5lA|m$0I5jtY zN;CefX#eR4T7~4G*%F1feQ>;aLAYRmi9%Y5SHlaq#f|``%B$^3?EQ}KAE!#sV*Z)Y z$KLoU?|=S&EByiP^eQ9#|F2k%{~g81#LV~-sPsu=auRIi@j z&epd~lfOlE7>D{ym3&*6F+6PoM$Cawnpg`A4-hX(T!6+E6E+bkXGT#&l`ggm}vScP&&3Xw&3hI90sN_9;ONB{r;43}WyH&S z+DxS-ONwm;GCP%1XsXgDGHR;!x@XRkOx@$nf(*vwMo32-bFEF*Lj;A2C0Qq^V7MT( zcIsPZik-WltluThVfisd0!fwfDN61*;K12f%Rt}`-O#B3+o^6zNu=P4Dk2dqD=vZc zFfS%}YJX&FLi-Iw(Y-#DNt>56XZWiG7+QE8uyz?XGl20w7qfY02R*y#l?ni zF`Y?zx>hwA*iX?!HKVx`*B?ZBz#1uyCr+Jq9zvNO-+;J@ED1@EJ~+_5u0k=&sHdtj z!lFtxB^k0JW2R+wk~Q0Ph%Q-`OfK_SQSfrmPJ}|X7`Hgq3D5jbuNBOg(O$3iXadyVUf;BStDy# zttg|Om0yCB5s6Bg?wQX7&tV63BoW@pqDLLw3FQnFd@_E3;?sP|tr1{!))kk{l@ybO!pgyWa!j$0byA@+_(Nz#3xRS?tka67_OzgqVQ*_dik^RU2!{K}4ckS}nd=Oo z_R6HyNuA*jr_f`jqt($vhm{TIm#K{o^E36LiP3I^v+dehhW;at+=s8ZggnW$pv#~4vAD`uToXJ!?kHJTS2-v46p4{;g3dO^W zLnkc9$Stq_BIOk0#~ZN3kc(yghSuOfb;F(p)R*+)tnx&7g`hWG$|vTSHl0@)v8FNz z-*!(GQD%VC_G-Ya{6U0Gd>cAtbu>7Z*EoUmeNL#VMvd30D)u(9Nn|~xUU=^6kydG@ z%t`(s2_xiT=8e@EAAU2zb%mZAp{3|rGk(RBOy<&aO08-T!^b(qU%Q>t5wk3Gn$(-^ z;wnmBEPpjx?~9cc(@<@tSi4{dxH5FF_JNhKI8DKue72iOqV^umum03N9{Wz?nAO-&R!q|%o!r=#e6`GG&4Zb|TNcS2M?ETq+9=QFB@oQ) zgIV@}y~8Y${AqghC+CB41BeUfUA{mP-BVlopG$I4glFtQyVKhqv6QK(@qr#OGwQyp zF}M2*I4f*=gZk!&rZf*NcE}#`OMZDZ{R1 zBJIpsP)ERO4i80JxE@Ul`{z@+v0-#@ZSK2}<6*p@(~+l7Wy+xdw=Lwv;3vzz9W!~2 z!#I!2a|Yv5i`p2?=?~u`)o!!3KI2Ad2ewElEJ1+`-V-E}#9L5aU7MCMSv5Ji)MRri z%Mn^lsxLf^&`KDT-K)|xk*6rIbgm{yueB~}70NX!Lcy-cbI|HNT)Up~<*)BYMl!kO zgX*S_;fTQ|4vPCz`ZnU#&wOTjp4Z|Qrs8(0g7DU4Rn@#wTJc_=S@)*kv$^)wpIvZ1 z_X5A9qZx_|S zR#paQz^ioduX=j{G`4-OxnOqS+>$Wt7jUhjqT4g*VjjE4V5a!qAVH7Rxv=1f5H-d8 z;^pATin)!y6pv-m&E{=_+&j2N`Q4*v&K00J*T~o5^MwX5g`|Ft!Hfxf!2{}qw~FW? z+g=vX2PCx|`^RW{>Sv_b`E{pI(dz0k!!#P|u_x{(&^QTVpzIXmG^aX}y8UrYBYB+a zR`anV<`N*aoX9&>;Z(O2t{FEDc?tV+rvm|`x(5hdM`(m$3B8lV;@|CzBJ$oT4kB}J zl9U1UK(Rdm;66NM=vjMcT0wsl3Ra1QVTZN!z-0Yf>%*WQ{@$g|b7=S16)FM6GR!-T z$zm{a=`xBW4DAE_u^%61(8j^OlNk~Q{kmX8phMWjq?wQmLz0rbLsHExqPDz(Q-}<@ zMQP+f$>qnTeeDwysP1?HAro@hVM7WcLs~RE22cG2c-VuUhtDOj&-&!Iu#N0pQ6Jf9ViR zl~j+=-v^5x)S|W$6uiOoHpP`sB{;)1NKmLsonU6|*;;R5>sWGN;8o*5c;I+Sv_Xb> zJk@j^66{0oAr64p^Gx85QKa+u4X0Rhssa2hb1>hqJOLNf`j_VUsd*?r=)WOh-obC% zp$}VuuH}jH{OT|?)1;c_^pf)2`_z?}j9G(q3zEAS>W05jgHxEX38AS)nW%*M$t0BH zfRpDCG*20@?3IBY0!{VHfi}ue?|t}_4SNv2iVxRen*T7lLy+=I1u}wp2bvP{)@7!o zx8DiV74FxfR|jE1qN+yA9D#Zu-J>C%86r~&od+RMdP_VDke@jPotAqD$&I1lykID}2XI9K z)U6zM46A#^Y>_+M?4ODQ)<@XoAdTCla&#Vk;|(P>Nb&UNBK1BL)*&EfC=1|UVc>53 zd1Eef`*olpbedokZy50vSWLn>D@2A%{vE#+^TDXy(jXqiuJFqhK}hAq#AHN72*xFV z9l;dHmdhTDpq0%}$rPwTj+H0|)ANbMQ<_T2#Fr3&7eM#OdBu}t!#k2j_yxJq4&6zb zXFZYVB$bPTZ4)(>7rE|toyAg%_*A9jc?h(U78e@wh=L!ylwZeB0i;enDjNw zHRXrm>hrwsU~P!C+#$$+X=3yP*RO{A?D(e8?J88V`lY%_>#>ZrK6xg9lF{me^;+}E^IewaFLPKSIrn!g*g zv{BdEnk|-`hrS!`D7SnTw{!T_YtNV^dZsl;J~Tdko$%FO*A~(1wM0&?FWac>iCKTHUO&|Iz92*H zbviL$fuoNAeYq7kWml?nA}P9h!L1FJ{2pX2w^6G)+?-Y+y{fgnZ#D1j9_-4swm?Tm z=LZ+dqm^>rb0t4lBz#W-p&9$r!n*9N?`OkB-Q_uo*xEFCHPB{JP#M@#(11Pvc$v)B z=`J0%>^6%Z&dk}1sj%sS&j$@w8wwwA{K}r6x0BW7Nl(Ww*ucIxD3SSkU1QdQs ze^!&3a%R!n92|8RLQ80psV|Na2(*^BbyMPMdUTc^99!C~J2R`oU&;&#+3HqQC4qNA zbZw9qf=J?u)9JnDw_L9pM#NaFLo>8H(q~KwDgxH}mYXzTGVxsK{)S}XTC!>h+D)UU zg^4g*n^kFO8^rXD*X6ePuDaUg;3Nf^_lE}FNM0*9xlu=pzWMg5S}>f*Y$uyF=2P|d zpXSC84+M=RTQj<<7?b~KF%}&DiS+pG;iQAG9$<>R{ag&ativ3PD|_*={BqxG=Hw|x z7L6{xES*87QRK}Cdz#m!6>;=%|ghyb}Y+k0x`}FC;ox5v__RGwJexYrFK;suTL-8yn_2qv!YjJj~AL+liq}MglwNk>)~=i-i>o?~053 zvG3YevZI0UTHg0<_I3J#OhShP-_d39j_WHTj*7ayPU!H#KrArZ(g0IjowxoQP!&l7CLjlPPO)vylcu- zAiGIHeSNhntyOKgAh=gocC*LZi(8LH$A>Xfsc<c`G4Hg)00cOD#?rj&`pW47 z5uL}T{R61j_<=mNZpOR+fC*n0DR336cC39Mow6UmN3Dg6yiLf)r(&x zMfA#_-A*nLP8pL-QKnu}i?LDl7s2NpXVQfRSh)WB73cN%F)P$e?@C^&v|zitVw^7m zDK7anCzc7}1z5F+^jQ(%pl@Et+4QE{T*D4XlUScCSX85Dy=HtxtAdH%({|mKj>otVfj?xTz@u3A z7?SgPyNOsC!=SaqDXry^4tJBAqkTGmFhQPWN+S=7;@uXE%xB@qHs0ndfBmc zJixtcQyuHpa?+z~cdDzh=!Xmm>Gnh?vlBm_GngWDjI_pW&f0Z3VZwgo7R$Nm2(382_iG6gcroI+!6niX{ zx!OXMt5&dDdGM;dM?>NUTass#$3F%OD)OaTh#t*pY&W`DUq_dBo}nd5mMVM1X-Wf& zvD$Uu2F2+87m0|^B_f2I)=&NPD1FA*U=^CshH$W@e|}Ry1SuKn9D!dFF2hRZ7XrSf zdIU)`TBq@x1?wDOjlcf5)B*DnRF&kT1t;rkSIZR|w|Wg;nQ#KqP1G1TCeR)d;oN)$ z?9YF>s}MH*PEMGHp?fH~d3g(17o7S7I?41h(*cz^`Grh1kY9Xd$)>%lTlK7eF#m+|>Is>x2nQ1n^3dm>c~O9M)4#l?Lt<+xw950G<&q%(JyrP& zPzL*v*GQ|x%L;qWxKf#txGw7bp06u?VY|WC55--amQ$Hj7juC`RT`==t7#$|?ywAZ-+8UW9WyqKLFFWBF{ zNgG9V5u|wMzHxiu@g(67aM)3y92KtmadEmsZ^VYF;amv zxI$Rx-|WA0NR%c6RE+v~a&pNLO@_LYKd#YD*h}Q9?qsq0D6=h7Q<=K`*s}F6j!2y1L61IIKyWj;ULiN(dG5zV$ii$qWPU0w*_7 zo!pGCIgE+j7A{3n9hfb{xKi()uQ#KQxG!UL&qL*JGS*PU+ zx~z`$Wf5;l=ml>fn04H`Sev$K$7gb6Z(SKI&%O^=SmsdzI@EGb!M^O>(&nR9?fdul z@|>&P#aol!7qR;s}EPCxUQZ2bm)aL9JCA;%OijMNHU{#E#;`MqC z`~rNWmj%Bjk)0|R9t6qIqoqz~9{6{}dtrB?nS1Sv^EUqwh})XF9o)UPej!igV+?mJoF4HE9tdSB*UxmI}e6V&$T;EAzZOlMJB#2Ct zpPtgtYV>=Yj<#F?(g zL=s@CJPjA==lS;`_^IUMo>XTHj^a?=#Bvf8_yhBEkc@tc3Xpic{673n>C>hwkQ=xM zQ9A-7M9F{GKc6^IxB3GK5<1E;K%Pw;=H(h=9hYI@+)z?q1aE-A{5254d?jn14DuS) za|k(0D)8|Q$JSKw58!537*o^f8e!IWTuW7gLi<6`cLr|XrZ9Q>YTDdTp2QWbC>3mX zY{awGga+fqw|D7NZP+h40_54%FqXOQd`ID`j!4tE+F;0~uK^Lrn%t^uW216Z>5eKy zLSun;d!Lo3%}N0#>MgK=VgAi(_{>wICU#LbO^e?f<44xx?wmXt%tTnkFD8ko@w92M zxT4pST)KQLGqPI@!*i-%`_K1|F&=@uK1KAcuipD1TN?J93A&f@!L(6455xI zaH&U!4V~1xGBsA8y-B77yv9R~Jwba5%El_hd)_>39=lIZUA0nc_+-sZvr3wf*XGB} zjM6K|1snZt`#Y%*=57HebmASBRk(xAx5hx&9hB|!;mOfFmX)oBM@2k>85d@MgV2q; zI{U}n6)asE$aGOE&+wHa*TPLIyXxYD)ud+#fwfIhvXRe=I&@^0YyTeQTZxT_LgqNi z&>OT=e(N1#?|NA%{6J%YkfmrOq_t?TTet*VB*`=6@=teWMjZ8nY}IRTLDL5qtkb(& z+#Qr&My8c@&p$LdI&OyVTl9bW1fevCoR{mgAJ_RyUU|MAWabt$C#4DohE^TIb4eBW ze`zesgO>=$$XeOlW+j*o(5Z@8Lnz*61h zHoUNKxwEJi9yBkOv9?Zr0w(fF< z*0{8fR4dOOPG->ZGvkBDKT@i9$s(S<_mG+D9NSs193 zE`$w06S^}f!ogF)b5cITtSUdhH&nu9w2YIRcmSYGds^J*kgiJ~4rfw^Mt!88{; zTf6YuRAtk%^3BzU_ejB`7b`w`U3f?ZC`mp>%qd-}7Vpo2FIF4piqdBIPuL{hC|E!`zN0q59HFzXg>+cUBJ3S&OWp}^FsP9aT2Vx zi5Kg)GPK<|KZocseCPaUL9Z=~BX%bhwq*#vM*`;sQ6 z)_<(Cw9rZ5Xq8ax&7PVP9^UDEw|urHWoupffR=3b5=>R{VV$y`8zhc_+=mg5Vc1b` zm^AlioscCIbr2ikoNO`a_>Z$^epwiQ_RP8`9?zkBf?R1CEJu;Clw9!Wd?~|% zQ;f6JtP;Vtd*FS=!sbG<-Jv}%8B}`qM{(?(YwWCmrMt3H30Scrq}$!~gdfknNfcin z97wwgV(g89csO)1BLf&v$?q5*_ZMH%(ZU!x1q>nJjNC zUM5wq{>zn1?^2y;OA|yF=H!#d_dMq+*|f*?J2zlb!d3%p(#}$n<@(Gm%3!9V)H(6x z01p)MPNnfOM4bEB1I~5sh>7utu+XPEmfPP04iCzh`So@DZSXUurI*Uw}YlvXl| z0eOi{qMTxHI-`pEFh{R&$7%IZ4&nE4@~;b!GpyuXuq8D!#~(bP>Lj)Q{x;9f^gpU% zGBL6Im*7Lm|EXeLfK4DgqspI&_#69Qk)G?sha8VuGe&h}efqv7PPnF3UAWGbx6(`^ ziX?=EHPiWN?-|~~(T?jXQVY?hox54Tf%x_LaC{#>KAiT2NMQuF9Y1vF*206DEr47B z%plxWGE(tnBgDvW{#r(_UV6>n<}abEHVCowu&VpR}*U`T2e0 zoDL{V%S!`hj&-pgDa%7<{zY%{Ru2+O=k<@BIYgh?fsTgyCgo7wYxw@>(OKyFdC1tF z`1iQaN5X>M{p(|Rls)+B=^tO3pRVs0=LG!6EneRht>4@leehmeklp|c#)9eFN@L!h z^1hl`7&4=kktTr*2i81=CEKz?ZS{{bwiSRQuCzmCuZOd3tOBx)5_WZirmz%r+~JYWLy28SZvXzADGz zv*+s72PS~F2Wy9w{|ofy&I$l=b1HTmrZ`>*EK$TihZ3hdN^Yo0sm4z5N1TD4HX(^` zT6RrGUp-sAPk=Launw9i$LDZ0UiDTudxhJ;&FeBIHeG%zv*vuG`H#7qU6uIb{7aw0 z8R#H^ydJqN<&F7pz%pR-fOP+Wy z(*xEQ_B&9U0Otkn;Q(`UUAOcv95@TB@75@9oyV-Ke>8n(2jA63`px9uzrsZ( zo$FD!+mUv$`At~fO`o^a($PNwB|wQ2N^?7%=(W5;@)yZv97mB=!QNGq;X~uH&MM^9 zby04zwXVt*LUuFnK%s90T7KDKtSF}id!g=57E#o;X~R}s z3nOE#>kvF!^lFdJ8oYxsUiMYfmJ!IDF(T6Pf?;SWGX9~yu<88&>C{$3 zMwrnJH%&QCL}XQNWks_lY;6R0AjIWEDBc)(P9^t?yUF!NkR^o>zn-kWW@sg`aSHxH zD4-oa@0oA$QV1c)Iz@1=VQgCTYI530z9BU#t;MK8 z?|WL)kI9XLfgEnGqcu#2^EKmyw2sBS9jBrnVz{8;L?_a?tz?`2rjV5trv9Uqbr<$_ z9{3d8fk+%vMwq4J6XC-g`)hXA;K*4IWbp{b!&)HuC4#KJ6#>w zqB75W&!)#d3ag5pn?$A+wm)yRPsmQfO2a1_PTYpR3C8^GIM^u6=%Ov*@AGsylSb%RU zBFOcQ$Jk?*2ni!N4e)eC@86kZ@lQ3kk7CPM4zSN8NN*;~X6Fbj$^%A=^9NY?w?6eQ zVjg>T1sgl@m!CNG=5{5NmRQV~&N`%sJQV<}al>TYRr=NGrCH6rz(pOfr6i|8`igFCUDha|04^C_CD zd8SJ7o2oRbwCUnY4JSRti;N4H+#I4fM#tZ>loSrfEy{`C#Yd+N{tn7kF+d26r}1QQXlW`TInf-bg~Q!g8zF8; z1RwTVN7bh{mTvpWcE!f<-FPI4pcFi~g2)Ho5GQ0m(GSO~qzj&9Xv;=}mMgVYV1XeW zRO9@b;@b<<#I2^wTjs?{MI-r%C+Z@{Pc?F-(iufkT&E#;hRD|R`DiZ1$4_%( zDX`=T1+4=ZPRC%o)4ci3CkhRGR&=XYo_Pi^D5;$BBgD$_UE=_AH=f}cq%gHm`Ru2)$uwZLb;{wIw>jCmAi`6m+A3A%Vi#9VZGrFT1;gl(!RqeHnO8F$TP@i{Yz{Ao9RCpoi%Z7G7t5K0q~8%F zX_kcefNPaXSNDkD?QtzKa`YmN19%-I1(MR!kX=~FL2_!|6iMu~_^7t#XWszeE3PN+ z?gB0D=7W<-BwLu|3MrBgKz7xy%jQ_(tP`?oxe3rV{p8;AR8r%qz%8)4p^v1)No z$vLi@iqg6gJ`LCi%esQsYf8@P5B_0WEIV>1_hz~)k=~TVU1g|5HPR&AP648U48dhn z-w=?Ee>PTyVGY2KjKG9)_s239f4cB2ri%de)qXt71Dv4VvuSn}@39#Ycyk*NWsH4-v{;{n94o{W0~v{ zmfJc9_exb`iIOw-5#WkfKudp)yfdRznCE5ucv<8+Z3!*Lx5TP@H4GZ?WL{3gnS%#;Luq?s%&9lvy*wUWu*vzf-Sf&2i<$!FIxmv`zV zv@tU2oXB3|H~u_ni|;;cW$(eGC3@02uMU&aG`nTVT2@f1AaXc)lj}|hHPbDI9Z1z_ za_ZDAiPeb0tV=XAw zVmeJjO+2GvayS`;<)cKWyo+WrpKzT4w+ukUtafjz#sI`WYYCKwxtS?>dYXOx3x?YL6!Z0px; zSGC)Z%(P@&lxU?M5Q1W^Q2?F~pB@0gLZ`8A$1zek7tDZ(pDiy9A`n63&3B9~4;uZe z6B;;K&}Cy74D60xlGa3ZS}IaoYCM@M=kMq*fp5XI{ynrnx@USNS&ED7G`9i9O5MO2 z%3*8!xi$G)T#8={JF0FKn9Ot*xLP(|%yb?X%*{WJBFY)*VN3gkR1L=xBS>|J_2N+* zobpV4wPWtCA^J?`TL3mxq;P{%0#ZKjs~2F~R19tPs*V(@jyN8gM)a0N)fBeU?IYYy z`Q`|DSxJy6WGfGsXn z{RbQfQgPe&Q{v_;28}=-rzNrmLecQT(=Dt>@HWLE;_v5>riOq_O@g_Ej<@Zz#go0P zq9WV7N#&4`UKirH2$7B6j}YN_9!B5jBm8xf&m%{~<26yZ5mRPa9M#|bRU74Hw{ zSK?b{wSe=6uk==yY%duvw%^y{55OnWUxNP^V*Ow7r~iM#iHV)#ztp#Sw8mqZ_z?OY zkv#$|w09f~%(xg^LkFbJ42OAcQYX;&YrC{G`5p|r8T z20*?*9@&%c8$U&1{7QfPc)h>(SC3!)B-0$k=i}1!K8}GG;IVc4;o`rJSO2|UVlH$m zYz89LPV&}K+)m~Wo`%i7cS>*ehMMo5K%AnC4({G{z6V?FoX+}v{)4I!YU(s_Cb|=3 zI4al^SH8oX>9}6x`WJkR^u{EdN%U3~WKr}Z!e(@1u9i|-U^Rs$vm)6&NG7Gb9;EzZryg?r;ViD%kQFh^g-A{kw%{BL~!gfja75wb} z!u3U^q`%E)WCInz7gO>zKkSg7HZli;jR?HoNjk*z4Gf#!(1^z>)}v&KIWkNCP|C;? z=Jw>!H+%N3^DlZ1C;ydRyNzG#>+ZXgf2+kJ!nRe{gl|(K zlpsVXKD_MEDs@5hSnDmirD2Zmk?J1yC~J|eADPt8W_QF)3m8oz|6&JKIJa)kWt}vc zrp6)ip&mp5*AfEjg7iGcHZjxmTA0xCwo$9tBG)a);-3EUhzc*^W#L1`S3!ulH1v2F6c!DOG^6<7kboCn5%p>>BW5LX1tFX!`3-xF2l26608}ubNAp)|s z4o*uA#TBRJ07)&u9C@|Xd}WlD9Nglg(~}Hs&8pNgV~TX~O1xiw;ursEWMxT2;~Ftv z)@S@hz|Rvkt1XYx0QV7kmOB&_eI|Im1U~~H`Ez;sDED-TmN4v$F*lqMhL??xHn+lU z<(yOoP+j|*ODz?^MCPKkRiX(zVMSyK|BE0w88fRVx{SUak|Z`L7NB zJeo00(zU`8|MIq}m7Ifsb421VZ=J zCb@@fJB(cIDdH1ihkP}Yff|W51iwTha8aW@#TA$zz6o$z3I$i2~2&a;LD&6yIhIp^KP@j;8jUDtnapwiP-Xh>?V|K60Y?dXc z=9rc9mXpk3{+s54J?685(pz@KMzrn_5kV&77$C#r6=4p`>Kl8fQYO_3JYreP`B!|w zHydi*l(Pxm5=tWwIyPYu!!44CAU1~UW5hSzTo^?gO>XSYBYc2uS17Fa*mRxkccN}4 z6_Op^ZbS0471do>x+E-&_%fF}5@^VTjNpk_)fU!@7!8*cm7Sc2JvbqHld(=JvaBjQ zU=Ggk+FzQoj_?GG`!8rS7>lsAzheSvqn84n_a)8@4J9nWpaG>gCcdwy>us?%q=+0x z%pWZ$Ca4r36&nq^-4==GK9>8S2{0t+tQ!GYQHW6eoM12ZOsQ3e0$b5A6|N!GPFv96%y<1dC| z@m^#v)N-*)`+G#aTnk(DT#uQ1p2n{}_`Il8sys=Qr0J-}A|yiUI?I3VF);Y|NkK&T z?7?}50=Dk0!t8+;wXj{Gl{rwJXsBt;9VcWeRp;zkdW724Uy+{y(L&Cymr;vkD?DZ3 z2;1ada+CaM6pr*Z5vXk!G1Sb8HTdtnW8_2Az0w>Th0z_kfPm1uWZ1FHmKIQ$%RT>Q zY}1uh3VNO>-RiF8<=WX}2iB#A6u}x*86&zYz(~9yle%@81x4hS%Nr3maV(?1_T-hb zuy647@&%tOVoaCNM5#HnN_BW>cL+f_4 zxLe1fqYJhs!$e&%Uf(cF{H;HL8mYy7=)V0(toH_a>S4;pe#Ju#C3rw3i&WtGx{U&* z6a2|xAQs|$A2S#(Vwj?fAs}X@yh~b3DkaTF^wkgT46t;XLx##SgZ@)0262k~FF!=X zydW#oaDA}Shi{Myv36KWj>W;895RnosUK-i%-c(PTDiQwXq>ZEogQ1kPBD@4-~Lz= zHDf4Dm~ch@Cev?t_+LI?ZlR@?2E%6cgM|m8XOU@9`f`7zh;)Qa?_j)sH7yKt2pH(f zS=v_nb5e3@-Y7c$XewN5ZxuT&VY-oFEtFjzszu^ihrO~B+>^OWqQjCeL z+<&!{tuX>X$djE?(b3t}iI4ki&b;2NIK&0>nZXk)VK&rRYC8i=H(`UH7`uiAbBWZ( zEF$c_*4OkbR%~$zLa!cSGR~?>Q1q}4-67R&t_dQUDA8RZz!j`^4E*zV!Z0*lxLEEvey?3G$hLeUV%YEVzPp|w_DQrz9qk$wq5V@8UX`mX zkTk?5-G3tsg?&NpFn2;MADk*2YBEgYg`=LBdmF}g(UCEMfMrcFe_GR%{Q`+Gg}ZS# zPJv`6DB z8hOf6qX4*mI7wO5Ku-vjvWi~ZF>ys<;U2k?)U`u~JDso6T4T(088I-$r|p7p6f7CI zu&a?-#6y7=mbnpC`KLoo<5*drMgdQflpe>yw3KNQ4}f{jkipO|%#Lcq5U2&zB2U$eC{glDw%-SUx*`+v2Z${Xj!PssX5oaxT@$%k zy7?1pp~sIuptbDVFk0af8>rA+GcvT#c%+6$X(4P-iL)RK7^nX<&I*>yNaL<7X|x$M z0dPwTBT@>6fReuJ03F6Ids~s5tM?9>O`EeCPmCgwT^DPh zZjUQ+8L$z(wmxZww6|$ddZ7T}rF1QxT}YSl?h~=|v5&E73W;4@g-?>1_iE1SL^bG( z_*h^Z*O;`hbpY89*3;hwrus0twJF1Fl!4lauNCB zi97?_F_5BBr&Z+A7y(cOY$x|sHe4-KG`Er1?IRPcDx8kII!xP;_@b&wv2ryUUD!LJ zx&N*ekI^Uh6gpfTJye;ro$2=@`UaXEf(yyMgOSa{T*(FkSL3)!{gI?+pG^fm0=Nkm zO-zjz5p&4Q=tA|LU!zG?oSo5z4Rgmf5|+q#nChm~kN=kvVrz8h*kh#cEpr@QSJ8cB zbteG7ohHN`5fOKd(IIx#!HI~lql*&2G{hgve!wOu0K2NFy+XmMac)7bj`3mn91rUM zkmCs=^0OXN>q!x?r+Mq8auJJf>x#__371={c8mCFm*fZ6HlYp;yL{;O$a-ByU^S=Y zWq8D0q53`lg@^~%|K>A&0p^;C(lFjSOrx;<)fv~M-MTm=xzrwi2)P*P4vbV}3M~OF z`ITx$i?@y-V$EALvR*25uN+3$+kprlcC~vMA2izJEnr!B3qhKsT413={VGe{OF=Ts z@A&}pkWGfNvta@YwaMrOhjJ&h6Dv<&XgIF;9SNn9SG>frq zP?&vX*Ydt~#9c(4GG~l&Nmjy)k&HyeXzuxqa8RdWnICC|%VbN6`^YB*MNchC2U{@U zb@_mHx6WCse6wM1FLE1bj~_Q?LUl`5v7-mwKgH-f!02v_;isP=mhf6d&%Q3i(XItwqzM^9x#`o(4`6-PQUQ`T zSkn_RC0oJ_(6qlX;=PDnT|>`opGL06Pmb@s?9aez(~AzE5p?v6LAvP0V7*?oaGtB7 zy5}@c2Y(hWxq5ij@=uV8NRZD5jN`iGvdfO$6uD0vs6)ya67ak|?8c>{77Lj+h*6}Y zwhmMB!X_hGjFH zQ7uaG`gQbBGNuMPsB}wC!Z?wgUUpT;=+E&9KTzJ>ytEPwI?YPOJr7LlEaE-FK zJQNB0;5`njmKv*Ydslcb3L-B4fn{sUfK$PfCPEeac1QAes9p$>Tv4Rjz!5LVuo9$| z6xQ})iU;?~vyH5&)QK`wpeF~0g%}-K?mX(edKTo2f@L7U%}_>VYGu1x>9o3vp3NPJFz8p~J97WgsuEu#QQDKP4k#Fc z>^u?vfoluL^SgTvFowW+>U+18sq=eL;rsd5^#hdF7bW!n0B<(-|A{w+iG`8<|MsTT z{DL=e2Tacg)dQH~N-sbN_wP2*oy}D*2Jg^C)G58w{cToqIZf+CEG2Ux6O|x=BJ%T_ zI0arG-%!wBzI*$JeQSMQ?$X`85jy)Xv)A`Dyg0s}X>K4U&Ct=f=X>N(iW^)(MuX$S z(a*X#jSPnXuOzH3?wUjEE6y6xp4^3vI1BX^4U2zP*jwyfd-rs&4dREUU9ok3KW|)P z0lFMe+~CN?DJDB0b3i8cGihl@cNC>*{ch;KKkPPczt_X<;vO&2QR_OM+EOA+!|!HYFu4W0zs_0UP}dH z>&jU1qSUdy0ktFn^^l|e=FRnDKyiFN8LKE-a#xnb_u5!?GHdqER|rR*cDTh;GP%U2 zPf1V zI8FlKj2hCVBIz7UPC%UpYx5?sN)14GLrfO_Tr3MyRmNFF7`@^(;XWmdFw%q3W}@i6 z1q`NAq>U!85V)GJu#BUZof+FhtrGYG))jD#7jb(id(%{bB1z8LF_jqdTlml#J3m*I21xd1Wurnw0ij-0(L` zlDv&6DlH)Pdop<_NT9w|IAuP*``wpvgwkN?qU$Cb+3Mh7j$87F?esi>R7Z!0Qkyx3 zP6K_C!hKkZ1ZI4t6`=tXCh-XjS#*P01yI9hmT|kExf4WK7-;G4k1L4#3$mZST&&TE zcEBymTrH5&4|q##&%Y#Q&#n~&AK#v~Nzx87L)7n*$YJJ-YoGN>%I6;`cpzN3Lfhq= zq2=BRF01#3hz0V*)JbCSj2AtjLHg9EE5R(B-WMQK3gsUhA!Di?bn~s>4!;@`Gz?^hj zo+ZNst8qo2$PAo>b1X*8-*9-=^aUz=Axb_>p}10Zq9PS?7VIP1HG0CYX-=Kc(N7aU zr38m?wl|5s@_X}dGrHAH0vqOvoCEY4JjPWkXHL`zXS#+Q1`h@17b=NIQ9}r>Zb~tP zP9oF>t13&A28$rfNM<13nOXH7J3WB(&Vgni>KUgF<)U!k(fN`MfCy}y}(Ro-i*+nsj z_fiZlM3C5JgPlrQ{1@x6!Pd9TzTg%L;nmg6!^tn7f9NK<+WY=;rZ_a{{wf{e?+uZJ z2>j`x`;I1tVR)4T^!kay}shn zFX=WqeUX{th#`)&Th^>J;Ho<%m4VK4>p(#oaryZq2`%797E_*0?OizBgAj_uMaVXv661d zi3^q#&a6Lk5V@SL!hX~#8UftEfS$XDy+h6)#ICqxUvtm~daf52vm4GuE1=I5Tku3C z1p-^P77{avCn`D4_8*!Dr-B|}F$n7B9Y0<{GPJ;v{z}yt#BX*^La~}qE1ZBQAfR!H z7(dLpb~dWU1C!&42F4@86Q@W&fydIpi=jKXAr-|P)v^48s;{W9wOntSqmV)*2P`|f z*SctM7%bSua?f`(RSvU7!Gcm@#_N@?SsyZPEr1zDBzD6f8@a|R-|7;XOuMWn8uu;b zm^{?m89-@LI zj5!xg02nB&c|rB=k>oQTT-+_UKwm>7gj+$Je!Qm$8Id=kk86Y}(H-x+MzWW@`IM$+ zm_7LlL)&gV*zp01wk1?NrxgSo9vn@oC~d&<2vE-DU>|Y0 zGg||}Dqm0ekJk=US+KroVwbI4d5?C`T8x~L6X~$&XiONwn1q!y0SKf!s=MP~`t&3| z?~jIDDkN&!9G4s}rfaUzkSyOqz9jFx^>p8UCwJ?`LF2R}*sW)Xy=s35Wc>9Gx&X_DrU79AURZI z2!y1~-vJ-eKUg;!XTmd5sE%7_)vp4~{E)B$d7?I%M|+BE4Q&EIR?nr2+`gw6(7jc| z4q3xT5+m85)3|ldG=G>7#hEa-HA<^zFS$y6>2he$GADMm9m}k+fhTO*H=eetbExXi zlOtT4#)G9|(mA3Cg=b%f&1<(<=n7;7r>-8*t#;BD1szHFBWVSy3pzo^84)CO2GJ8B z^VlOlpsJl%e)l*XXDdaJQCIUiH0^-i61eW$^8U05rr3AM1fcDfN@6OpXi1__l4T4B zvY7b(?IZbP9_{B-XF+lT2{N5Tn3u~JH^0Y?>p0lETIZPCl}eRehDRhq%XA` zVl6D?YiMOGetA)bqXIzcNwhcusQyU9GUK(#+mK(|R@a!{MM~S>%y6%m)AaCGbOH0a z42hvf95R}CwgcH80`hDc7a*USWBZu9hlKb?so>~UT7*Ert*j9L4VO$mJ3=ltPd3cr zK+|=`xcHe@@RbQ)yi?s0@UBT3k{W;~7)j}GJjhfq31qU605$vL)Ww7HX@YD={o0=y z>##`!3-I0fV;JyBXDMp2Mn=ZlM9uS=kI@Y{RFutcx^;o!4%H&)Lvus@%#ItEX}V5a zf5Fs^s-tU83Q=VWYI0pF`G8t44R@WE6$YBYTKamG5~aeGo)=B*4-~g}hxC|sYa1B2 zjxBpBrB$UF&EX9bm+NoQrV@oUu?E9ZrB^gnv*K)(sN?!V+5M8_6AN(TwWxSt#B@G} zc^y_`{b5L>zWz`E@0bR(kRnN;4%} zQymfs;A1Z^rwa&SFX0^-m)VPMs)--? zye%aP2r4bUYJ*NEsZK(oH3xW9eDpS2bc5QqLmXtRH!BB<(JO7wuL{$KHk#zkkjoQw zR4`*_HNKnLzRwP8rFFWRzwRJKyIo+|RAxX}`Wn+Ec=uCa(QBhEraq`u8e z1BN5t4E-htD*nuC?9W0eU@=tQR79Dib(UnhxCIKZ{Sg;+b@!ujLtdvQqofvmfy1fBC0yYdtOHXSqT)-Hn=<8MwBPfT=p4U? z>6ArBMC9PYrDwCwvd?Srp(Rm(uM?p$liBZ55Bzov@iNXr6u2C$|xs>QQ zw#iv%#l91*g(qIWLtgN-okploAUjRkzT}(=yGoopU*2YY=3GFw3bkYeVa3K@&37m& zbvCo_!g1*`vgkr~pkRzU)!L~vcy_Y4vwlCtF&dis&wuQ?Vv{W`8in7Z{mK;z>q4HS z5US*(aKqS(Sx9@>8JC}<34tQSJLpYae7Xc>JK)E&wuujE;W~NzzDba=n)8+oaRQW# zo&^tAl99-}sYNE4Ic$$xDVVJz(yIwpt$o(i@=4eB4Zn4@z90CUtc2tfCUZ0Vosy_= zrV+lkKfF31o1ne)C`}IdNz0~wNeA$j)}$=k!Z+;BC<9?O??usKvgPriC)?`LlbfOK z{H;p(tk!{Q=w(D_!%?H_EGl92MUA;FmIV352nQ^>(Iy?!Gjg~}C@T8fhzGlg1Hq9R zhT6DouvaqjCbOqd?N+C-LVh-Dn{(3!Z2a4QK@IBT3z?X54zG~kOKp4OaZyc#HU*a0 zCu|;yrqk+4FzSWhvB52W(xbZxrTq z$CAEgIQegYkynn939-BB=Jq$)m|R$xp2!E)k>lmRu(9{YRlYAg8R9jO|BizkEKL6+ z9Asr=`7b!AJswNcf$)oiPr!v3TM)?3^!jjnn`=Hy-tm$dPWRX&Xg|F{TtO34iVRpV zEs~Xr^ytyY!-6{B?foH#eC_HE4Zo5vy1c$atiHX&wzSi}&-TxEyMG56s)KsI)oE0} zny(&zef^>1(MLTzxe7d}-dBs;m-i0d+>PqIs?@eB`jf-Q-fFpuhpN$S-rSY0y9r-v z!Ob!ayte;9!rCC^-}N#f_5W@A5>XFw>fQP?YWDWK5||2UA$~uw-@A9n#KVWb@b5Bi z8z<$IkM`I1MfX#s)fjzvxl1>JUYavi_v7?_dc3MeIkhy(=Sx8MgJll9sQElp=U=$e zNTjz@03{rNB%lnrz;LO83U-ziNDey_GCs=~DR#Jd5P^80A&4#SEx6U621k7l7gWr? zz$R^;cQ)9G3~1{BG-dDCVL8q2n9GiENs3nKfG{hyMFjT_4FQ)GWibojM`$(BIRZyM z+MSS=>p+aYGHGR^3ZQ{R$z4f&!=_cDkH{9l1o3W`%SxPTCj}zGP%#r%n+g-FwgJbtbHz z3@6;X8TZ+n+rABN6V~3@O;GWPEASS>T;z=?@}cv%*$__qn88+1j)5}xbhL9*G-L!W zEVBu6;0sSs#n_oUQ`c)HZl$HmawbtqMWhrtY^0mO@M%olZff(=Slx0^@uQ?fV;uE4Hdy(1 zx1zE+`bvaNg)R#F5Iip@aD3^75*mV(bMrLHu6Lc>tToD{cROgn?=v34m$1bR2euJ6ieedrRG>+xlq5RO&VNU&S9!PIe^?;n@rnT3+UT zi@a=w=)Uk5`ZeWMAbfTa_p^ZB-xX55d!H`4y2Dn5h%VKj{1pxA+uX z{cZ2-q0gZj7U!Kwqe=qfSNF>5502atcOXTu-<5w#jKYebAI~1ZHkM}~l%wj|yhg>s zlCK@^2FhoV6HBe6C7TG#G%Q%b#9XI*#<`l}2n@Dg848k^$Yv}s6%?*hiGDX7pvpS~ zWb0lbw6Ywd^YVL9gr_09-#sYrRLLt+05l3g4TXJ=P$K&rVQ$W^0mjsQ)DnmOO%8r4k zvto5I3=d0_?=TSQU=B0VwW5fn7kux(EW~ivF144F7Ga<2oYw;I!w=koeA#w zrmO-#Lw*X{NJ01CdLU8ap>ZD;1Tye6(#1EU>H#rMMv`*z*M_5)6@aBcMf;W=m7Mq| zH@!8jAq-Ma!BdteriWn+gn^YzIkG{B8KBRKphDh?8$b#IqLha!Uva?E1tX@DE}e~5 zVfxx#+f((=4WoRh+Ag2A571mpAGuAZEMnG})bP6yd<82t=TaDSwPU+eplG^} zFiE)B=UF1#I|GR?uLW4zAfQjdU#$_26*!lZ+AbAZU#9j8^6RfOq?Ro;_IulePLK#r zsQZEEw@fB$?i-A1NuE@1AcdQ#0-}Ih_MOk0)<{wTtwKs`ai)3Q_HRd+j^`s-St0k- zx+dr3U%vR-o#Oh$W4ZPk&;YSQ2~K;x5{SZx(^MfNKk`K_=~5qaVH20|+SY^68Ro1f ztWzf@ot+Jodk}|l8EiadSPhY^2o6{n{w2+o9#JE1RP-?&G;AWj!zkrLuROH zqOc(}r{_s2LBVMk&sa`4@J$|;+Ye?W561NWLJO!0W59L-JT!PV2^0sWG~yr3UlND`V~U>?!P#$O zRCDo`(d#@xfso8n!3iJkvoiwm%%4tNSin&_Hy+lyvZgzqZwlDuu)H=ZGvU7AR765) zYi$xgF96O(v3rgXSUq3|#4XQ%(Xf&pXiMK1K`Q4E49CfkIfQuP0`;+X80R>C2hHU- z5C86%{Cz-bY45Ej&ck_FHRzfo`s?)^%VGFXJrGl+B4_HPRza)E+&T@geu#mG3=Gak zZQpvtM70GPaOUbFk-kBXiQ!#ka<6T|8^KB1VOJhB#wa*J+ca*82dJY)9+Cualz0xx zP|kaq*gV`U@?!GBPVy}J1uoPUl@N?;ilf+BA=>c*R3dwtm3b&uA~^)p73rm7pi2m# zuQ;)1OLRy(aNQE5O60NIloJX=`NYN?zk;!Bp{N3JEiE>p3QH!I-1ZkStO;p)p?hGq z70CQN!?ow!*Vfp>2sS6=wJ4ZpNGYAk-74J<|OzIzf@O7_% z^N;i#JV$i#Oejr>(EIpw*?^?vN%l2kM6X!BIRvCWdH^ZUhlkW$b^s$5h)<%|aV^z` z(eu+Y{#0oRHnc>rZ!JzLFV>0a?-?AACmM*_=^kzwW#Q^~hh>&)dGIN~$T`kdAq3s6 z*^x%Q;_w-kzfaU6!XTw-*k8j!t&h3f_q?uZ0lx0BTqmZLpeFHlX{ps2piC-x37U0a z)2r&%IYmLLtyqtp@T51!!kbcXUNy z3#Lu+C^ouI68&UKimPP1-J(eM7UdZo&IZCnh(118cLi>{G#&7)1w;bWzgHHzS|F|> zbb045a`FJAeO^rkMo#k;61&0 zCq;rrf3ZT=P{t)8X3K_p9~-3Vy*N(qxO|#h8no|%aRq9m$9X2}ppZ@7QJ=q%A^~d( z@Nkp8x$4rgoxFk&TU&A&gp!BE(wYc#daQ8jduZi$0eEVbqCsVK2zMXTs9Y6VUtw5N+ zC~W7&^HB&uaoheP2|9mD=czdBbH=ml9X1$q=>-?%BH1&h5leuXAQmBiMJnbJf{H{d zmVD+pd6T-r-&;$lc|NrbAf;`pms+I&RCCGw@fAx5I%C=KZ#}DqAE-W_aFer;hYx9I z#~!WjspyrsA*vxduJ<5B@cvy;s~d&!QM_|8=>4PjY~K$rAPo4HNXIcBe+! z=m~6jZ+!2H)%_dRmkF9G1J>=uYgA0r?d)`v;Ho0wTPN@DiltU=2C~&(S>b9eHSL9D z(D+-Fv(5m?Sx2+i@)OihD=K2Rqc%(t@Y%rwYt(!P-!_oR;e@1PnEMZETpBDDo$-2|P zq%=RYa)PL7seKQ0qX+(?i8}9|&Rwj2wf#-@)V9TV`(Btr%V}rN=cQiC2*Ni)m1~sd zW9wmi&KLX&lIMe=CJoU{0NJ*R3aFsk86JEUMyF%QRKt)IY$A-DWov?fl@1;Gn2pyF zf=gg^1+XhCr9)#LPaz5XDMJ*dy#Ka}FHCG(_}s_QIcG3xw8y_Fs&mAWq|A<> z-!)U9%L!x!VwRS_^)uU8Hq`HLF8I-HdRUoZD}$Ns`#%2>(-Ic_@4U%C&-g#PKeDng z{8!+dtR><>*!hp(uaS1IR%GLE?$@>d3O?${ITPjwh_##dxNGwK#(1kpfs})T?AWn` zR!=8;(vQ}D{|$~-RlE9r>V5Ln?rkLR{=P2lcgwr|^IPu!@Fv}yw4)c`K!5mT+%ev& z$i*nq?nkRzmv>#9NY=C0^1};BbcgS5-X)>R_qjt`+^{E_Z{up&oGZiS;ma(Z-+)Uz zrCF{QI246NdJ}F3xRw1(9^1e@Mz0-wZiyhKqBh4?-rJk(EL?c=_nVQM*zr3b8fnjB z+Rrl0uV4Cfm-at-lkex_;dN3^uYz6)&+mij{k|`NmA*zr?h{IWNz?UclFK=O+@3I8 zQh?L6hw>m^0681V8-kJtDlX2<7iULF0Ui5ypt@NOFXUOnxVZ(L{_oeZl+{Q=M>9IL zO+#n@i(!^B$pst$3FIXvpFTE|q^>6{$6D6isx;baK<9}}Slg=iQ}*Ru)Ll|HDMvq3 zMOgg39EqIY&A}*R%5m8+5IJhuFnOw*H7V#mKchbJp{W|9=A{5*r8O%>zl_eKg0d6) zMi_r)V3k1H(BsJ^1=-5ieE?)#x+8GT1e@8$~P%%=uVwiY4kYS4#c^9rc~O7g(lwGdQpmNt-!Hor$L=UsG)AfAi14;RaI$W}Ei%G~QmVG2;vgmvJLyL*%x&xa1-UuDbDl zc~ONOY1qP~laXmH+EHthIcSg9Q#0uSG}d8qL&F2u4Z6ATAvL}gP-RBqh0%I;+MdFG zRJ2orHbi(o2)Fq_qusg;Z*~wBDfkn%dK~Aoy8|NP0^E|@WmOfl(UJS*O;;Dq-2(?Z zgqPkrwyxxjgp=Su`O{)@5A;eu2p!XUi>mG-rx=%}DwG^^#Jf!T3ryc;Fu`&MB2fuK zIOw=c#BQ%HEc?bw2zH9I&kGSu7K)z`ae)qiP7EkdMSz5qy%+2gKN)qi*f@(-Y&Z9r zh8q95{*Y@p@l{A>mX!61plb^;eY+bXfZx4*iE1CQuyDaR4OYq{HZr-@D2ro0h(|u9 zzbwe$*)fx04GU77-4MV1C3FiQxZt0TzQ|G)vIDG0!5=fpaD@>;wkq;{nl9bw6R@LZ zlgzlInGu`%0Q4y_+qpMV#IX&|gJmz^wsF3@D|Vuj&p(d@Z>b7O6Te#2 z6`JeBUUpx3Tg`;F90jsJ_K{de&yTqGXdz?A12y?1>AHK9-reB6-lNdj-*_m>-6VMf4i2Lr`K*X4ah7i8r_1z@rXA|s!(8=e6&TJDU1R5Et)aTn!h#8vP~jc-K7YiT zQ_jF5=H`gzrZ59P#-(peJe6n`isP_(P&^J;kF!GGU>%|Px<8g&uh{E*?>qRUQw-%p zqkBxf4r+J>k1`RW82KbU-0y!Bxs_@=iiv{l4Fpf9CP+2uM$s+fR?#&}UT^>kksViU zu-sBQ{L!n91$FT!N=Ss26WWT1>pwviU|*#0qIZf*hV}o&*g3{%5&(62I$$pzwvrDIO(NQf-n4sbmNWup#pciYb=1t5DH4y2f`OY-w>+2y8Ej(#7SH8=W@kfU zxE`V!dv-zm3|tBlpO_WVPx;f}5~)2WsZ#4^m+YimS7`mjt!03AB$@aFg*5?57)TpO zD`+`RU>)+{d!8MP)Qq!s5ZGx`I=1Cv%M0JP(0I3mD6m#Plujs4DQYWZb@lyg=aN>h zsm-v4jc;EN&Kh$VN>NNs7*6xJQsLMfGuwWSNFT}gLkF~eu$m@89mT8FJl1Mj=P#j< zsjEHqcQ`yD`1w#~(9&it6OAr(n*~2<^yOwcabT|qX-gi5CNdgk2tT!!!#t}`=Txb_ zlUm3Zmt)GGO<^zGLL({%2bgzR?Kw3d9A&=Nbb=Xmj_+7?1bv!8(LLW9auh{UDAdbu z9Cm?{e%V!Pwag&P4V6p+7VyxGIzZKPP)YnEryW4;(75YnzY{k#BkHIGm&WXgMI_Nb z95P^;QKbJqZet6^vA!D!SG2DHE7ERvNs%8^A z`g>g2{1nf{;NI33$Lpg&=nL#gs90oQlcRK!ScDM(1QIgErP%ki zEW58sZ!S_;-8_QpyoQlE`0fBIvMclUR-4|NH~TV^N%A2CE7b7NXjS5gt4uKm#QK#- z8RC+@0`14Ipi0N3 z&=Ditx-DA$)_nQxA}bBPgoYf7Qe#D=P;tc z>_wK4ess)$J(_b;{S`e~tC&Y4qU!Lp@?Nu{Uw?_28w$tg#5W(-%`>Ivuyc$%%NMM|6?1-(f#LF9Uf5F~uk0Avy%a9)BR1|dDPs|inGQ*~FZB`OuHMbA z?1}TNs|jljKT{57*uO2FVZV&+LMukovsbdz{$7zGi-L?p^rHE)LW|^bDHbk8+K@wVq9$3hBDhIi`nX4+tL91D_xhzfb&Lj8Y&NBedEwU$ipCEUg zu`uhT7|1Bedwi8lsfIxViNMSzge5Q&sd4uNC=2f~9lxo;7s8yyJ3R!SJ?J<3l8c8L zdsCRHDvdutG=HPVBO?1{Hrf;)_0{dvd;hW!P@jh`ZSufm;D{!M4shjv$-m+YTxqQT zE@kdKPuD~3SZ?h4#n*aptkOW%ez?^!3e1)$H?|!BaIT~dvPtLT1&>tG9#le(UDpPF!iLKtK9o)=i!LH^yGXpBgMi=_S$s~prlTX6}SN74!eZz zY0zRVsGC>j&1^w4vQhjjsCD?geE@(nXXZoV1=hy%UqFyd&R)Ls?4nv#Z<0A=1|W1j z#!Jd))t!&UxMEeJ=NWw5YSU&sacq!)cg45f)gV}d9^RD^U~$3vP#{(n=KU0iAZqA$ zZ*R+bfR4R|SePwbZLX7Aed|uC3K=__z)Qa1+B9Dt@2a85ruWcS%FK~B$6n1{+eO%y zncT)exe$$kODO2=FK~bKp-n=JNKNuYWLk`t{pGX3#h=@0+g815&kj za`+c>fnEA&6GJ>zch}YWx$jHqN^PAm0ZWZML}uF*=HtV$2RUM;N&~oVst8?2sb**5 z(t$cX8>%Netcgs|mG~%{!ELaMIAJO*L+Pk^>w(ULI5oHZAg$g6I3sr->1(iNIKzzy zQ>l|OL#WbAt~GJ$h-5TYjS?gJq*qw0H5T2=-9Ts)%;Xk9DsSI*+DxNPNai zyuPI{|LQ4-{37qFh|NyxhT%ZeK8G>va4aRZ1S4ZWe3c43GHUCr7{yq?yy6XC?f5~ECv0!tV1ZcIu+ z4f*A9c)FOV3VmhDN^Wu=q;NWUukPV==}=;kA~~22biDtePa4^0s=KmPmy0$7jp#d7 zwYd1PwuY^;`bT*U(@yL%K5!1}ETr79J0bBS&uu_WW7zqrl_6i1*V z!%|$Kq@GGh?4gV(A62LZcU$mY_W0 z?#xSgUvP&5AVlb0tUpInQW8s}Y4XkzxK%1I1X~NSI-mqvNN63wX-*e7`i1aRxBw74 zOIZL>%5n)C`eu&N3gS*KZv0^F#GlyEG&Lq#d$c$#?ILC}_Ll@)SryXa&{0bqYZfhq zej!{9Ax2s(s&<(LAIo8DOZ39iwWIAc64dgf`d?T*rXTGplUuZ3Xm&!93!EF&5r9JY zmRTbZOU&eBCCM-Pt-ya}h9#)+IO79td|iDutRNmNy@6FTVoNEgs*a-lAqu4>%%f$+Sj$vUnLH+A+a&OlYYKrFW#!_zm2XV45=fV18VyEhBfas0t^A?!2z$USL3US)ed#}y}SW0 z(~2*D``3;=Bmeg4*c~-ccOi`%ujgw-9P`xO4HMV>YLyL}o@4(T&I>r=Jg#3T11W@j zltTl9Euxz6!M20_xC-!nUG47yRvA2@!E578jqC~=E3hVo4HHfZM-LzBqKCCy$}UvP zFJdcGdIK*tHVc|LoK?P3RHCVaA*ZBjrEZxGdwP6)1UEe=JYLH8MU}g zgWUJT^wZmm01lWkTiSWJX`dEN;QYD1=z82>@N37;Lom7MHpA0zcN^x|^NyKQu2@e- zPn{|lRw66$l))_h30Tu4cMZw`%WVd4LUhH^2=Oe6qe?6V4EFAJEyjgx-vE@r1otoj z4Z3#Uv(~&F-%gzYaP~Xz2~LFRCZNi;ZLNlFvwQ8dTHm#(r3^?gY`+moK_Tj)_H?8& zlV_NI+5N@K8Y6${)BOP;Xs~^J{~W_mn+a&Zi`35MBWX{CVr!|Dtg1-tQ}%_wO!76jYC@_6?<`S`DKuBw3|G0JH@- z8X6P~vt%q>yloi4Y2G75P}t&i4(nNfnIz#%5QgGt2+ydNfDJ6|v5Lwl`<12<} z<#Ejj7y19(XuS`QxT!thHH9{S(a2<3(ZOa-rHx@cP<$5n-F5-i_J28n0cAO7JlF=8 z8Gy+W$Xgpc2==(=bj9W3x*u+^0cMKz8yE3{N*1zkw;2&CC&{>WUv5C;3d^LQg*t=m zd|ik8>J5{5=MJeRxVY8z*<$2?@x37?q*xDm#G3QC7T(Uj+Gqu;z;iQ<@>E9 z#x4X4X`u%*3S4_^I_~!FLfEAo)fulpmfXaaeRjo~aB9`vzfvLAX z@Ed!8Vn8S zSl6*hf{wYxrgcRr=SrQ|f@SSkaG$}G7z8IaH##mHZ6HA-@FLRDl7jX(H|49DN zq*cJe=$760cvY5Fw(yj-Y!<1+psq;b0#7xILUo7d#h;E`#dp0VYS~bRB*M*wZ;E)p z!rT-Y>1?Oo5!;{vL+n|Y8i$3P?RLbT2kX7NxCE_R%U3@B?`x%qb^tR2c|LiBM9k2_ zS7`7eNKWH}BZbA@7hu4>yS%ebf254ANdo`@iX$2D^e6a5X&BtRF^^^rDJ4 z%h2*}{{cnREajbsMW2lnBiKFC=Ons3?je8NU7ODeTT5?=3r$&vmV@g=ER)Av>5mi7 ztf3)C)hoq5h0COz$J%}~P;{+>nH~U`)>~I<|IIdCQQ)+dC32m!Y#u^5?0>d8SCLu= zvz3*Mk4`_=`5hSPn8VFRwjb(xD$1CYSQyOR?tr*ewBvS zaW{3s^W9i+y6t1~@enUpQeH$zxVgA$;B&_npcPQh@<)lO62X%k44#^gWGP?SX%Mh~ zOJ?TK&M($m+!=tTRRR3Q*S`*5U_^||K51PKK7diUYATTbwK-@9u)149W043Ok+Z_0 z>qIGrv10Mw?zqe@f5bX>RZ?CsuZ`Ba5gRVKAaYS4?_d`Aa7zBI9#&F2O(h3rhe=1x z0Q@_71Z0i}`I_*M`wvq802IG$T!(qM=I7|!dEa&39fup{nA1D?xI1tKHeMvsC-B%p zPB3pLg`5V3mM|_2c@91O@c^0<5*?c8Ofq*Ty?yh3=b|L-xos6I2l1hp>2E?@Nx0qG z&xTwV(fNsz@M9`@e^V371kt}ef(q_KSX}U#SKv6efzOGc=l)2Z$T7_jF~k~ zA=)cN0GNFO$&{_eDwZ`(--&2MAK@75^0g;!A3cRhf_av{%@doO@QB>!QRW~eGB-}J z`D|`tKr%U_-QUgeVbA|Nqi3#3zfjq<^f{wR)W^~f%h2ROf3cJ=>Sr#FLE=7p&24w5 zUB5t?%B;nTh_l5c7SS)$>7Y|MRVIQ4y+-Do8+|G=hjx1#nBkr6_aCBkf+P*_S<${k zaavuiq-J~U?Bj7JfmyF2%p~bBCh>Bc({ydw8Lp}ibAwwNHgKsXU(iCpYQ$OZwmm>^ z(ULyWz_K=MqAfbPBS#k)aIp270~#{4k^jbI+C!8akWPC3y%$V&BcVWB zzvv-3#3rti=XOJ-K5IwqHedhTLF-BBejsHxzJmWl;}1RrW3R?%Qm@DN+^*kyJGSnh z8PQX?QB9slE>1*rtH)+S@4?Van{DhIp|ha_!KRRJS;yOUKvtWvvDW#Od*Rg58s39CFg~Gs;%v(G^0Slm zm6WM%Z2y%ab%uz?_Cx#P46-4fr}r#Hf6mMA_c#I0yEo>`q?~#wpmwXsna{&p`m5n`C+nYww-B6E3A4{X7wf8+E=_rO828IaWn1Z8^3Ge}MQ^(_E4!uE;e0?b ztg}6JO#afiWDt}Kb(1@T;(m#)6ZSclTziqF721ZJ6HbcaXE}0t?%Z27<@l(xSuGF# z1D-0)Iq;vSrfXnl<5E+4Cz~pkf=VnT8UqoFRV|uXqxZWl{bgiIvar=ONyq34F~(oM#XzHMxEq#{GM|KBzx+#g}(w z$j)=zMRD9uzAKRU8`I0hkt|)?{!ooh<)`L#)|^iaCE}De=jmGc07^KE9I z4bmE5K;<8FX7DHO#GKn zi7HrT<^Sk)dtZEi(8Op?yjafO=xssJAA|K3j(}WD_9gV(&+!|9qdi?7JTZP-NNqt5}027Y1bI(fGbvY7#KwXXU9e zKC8}t@pLuTQxd>y>v+RGVP_iC;X9<_ZX9_0^U1^SIPXl>Z`5z=_YJ-ch?@D{x6pc` z|6lv(%*;&xf3rjE9RHI|ey!egJZ&fZ?m6urPz|wOaJC+(M7YFVG7n7CL&?>DHu;kj z{e)Me$!dt}X}FkvyKUQK;?XC>;-63B;0$ppynf;t{{##6*Ao1FI{xRA ze;H$;10C?mY*<(D`{WHII0!j|us*=Ax5QuWV{3Wu_L^JJU~6VxdwN?P>-n`u@maR& z&&@xUE8~@cuh}qV;mz!9{B~dPC*JqJv0SmKY%|&kDqsXT&zBTj0z=Obhsrc1#G{xI z-=Tu@FCT$Y*Y$$#nrZ}pJD4tW`~D=Pn_`cj_Zy}%%klos|9k#4KV5G_GqW%+=x>$x z!?^%a)>;*12&`UfCf?Vx#1aYPfF_JqVzO3UgHTvZcz|^rGCTGH`EO9DmTd57CcD^L*Z}Gy!T)#4@L>HFky7V zaY4syoUIppl_6A|(?VQTK3~6vV8EHwZlV)m)~q9`qIC)X)T75A)R&)< z!H04W86rsN-T{QfNDf!x(dl%1)ixyR4Z>2}r}K2O2|NG^ij+dD*f<9a#eI{!ZMCa% zHThADlObf#flMVm_C0g?fivO+)pVkoWSK2TdFENwFr|H*qOW(s1%&peNXh8>SN_}y zbQJKWqZW2667`|q8^P5jg7Py&}PNZXX=PSvl7>fk2y(E zUukDPX_(33dTT>I5$Hd1E7k;b;e!OFLdp8k37ZyW&JfMmZLKtwu=H5D5EJq)RDqkA zXIv~Vt3eRWgW|w+mBli8@<;)K zKSmoaUHb?Tt@|h?IVLEYslU5#kX6$Q2B2dv7|P>3PQOuPbe7yFF=@tQtf*NNRPLH~ zaibf42U&|TpI)qz?S8zU@zVHjeFW3GTBe-BKw%7b1lI4k{7(MmC`L2FX~(M)O2gNz zzYI!5>5N{h=FCG=M7O651mxf%6sN^wMK3y^Y5%IosBbMcuJJCLfZS#Zrc1ZYStl$qZYHHJZ))?Nn=aOoVO_o)UJW1s#aMNXfeskv5w}lJNqwSoRf&RT~UhBY7P!q z&w2%#9P4h#IK@k`CAIgpPYFEWP34vyQ%}ko{#|h!wz#Z_XeBFpz7#%VS7ns})sUT; zl&*e53FivLbkxz>pm#Nw`TBa_2Mp$T#a%-uY{)ZaJfuH{; zRck_Bn2Jxki9t1n1$d~RG?UtPJAKOW8UYs_#wdd1s&ni|FyV_3S{<&pv6+cpny_8u zf{FZ9!9;7|2}Ri1%e+-7#p_Xlbkox;3_Ab~P;vbe!>P8qeQw6iF*2G`$yYnnr;w zUujTsfXH1ZJ&2NMO2g*jpzsAL?4}bHMPoSiZmZCNe{<-nOb{ZhnzZ%>vjrCYd}o5` zP`AOY3cKw=oeS(WysdgTtCDd*KD;nIH3&010=trJS)2}@#uE?IPB-X0`k9}bv>pQ` zP2@xbarj6A7x8s(+O=bH#qD-)h6!)*LH(m;#o0S`1r|HZXj+;w+I`Q2suKMMNV2y9 zHTe{Zhr+0`Ba-GmbG&r`Sy9XqAlrcZj?RcjB_AYGIgUXxadzlKZz=?YznT=vbJoI@ zqG2RsuEzDuXQ@)GYnb^VdB;KO%Zkug&0#vps=GrITr-CBj5XqW=8*X6d8xP}B>3Yj zkYB?o=gVpo@4d7^bG7pPMc8yP8rtzh*DRbUtd&Y85eYwl70m5+DX@S$+^0XdO_lu>K!Ap7c zq$!M;6696xn!n0TQh0!27ePIUanIFXT(Jgk&udRxf!REOMZ%Sz|^tDE##$WmAb`fR4|l3 z-GqJYvD5k*o}dI)$e9+BgiU-L>*hgAJ%tqm`_!X30(q7G<3_>$uwkVQDqhZ*u{`*X zkNXFR0EBv1V1hV-mUF>^%D27$q1+wt^V&WbSDRwrP^3J71mxJZga#Y0&9IqS}2$R z`HUTE+iG9M*h@5N?>04gvBdI++K{*v39N06Sx~1=6z#M`00;(&6c3@GU2!CB-;JjF z(4d9d`ri8qN^s-aZ?5?3BOv%pJlP^t$RKC=Bq?=aUFv=5BhEgA>g&A8cEYh8{mPo= z><06@FmZobQX;m@(5VbBm}jX|GdNWTMNjv^C-)7~jZa?KEm0F)=jK0$*CRVjE#$Od`tpr+!jy1$w4R z8?2vqk*n^70?4xnQ0&Tqm}fE-LKRb~|lk=ZyN?h3Foj>P+iGs1&j4VmvgrFKFZ)_o2fnSh=z z#~kZK{8nG%zry(udnQN2#wK6~LE0RRL5G*lni+|P`1&T8cV!x*w6$>JPR1YMDGB;qrh&5XBb;mO<8loq@CHP`mOEr ze$OAxge`uhYy0JQ-B2jqTcGAzEWNA<(BDJ8b__&nBrIF=*5eAVGDj5ATIHMW4zklp zx9f-WNgEm#H0;()IspkQdiaX7t%cGCU#6?{MLRO#1eq1R?3;K_{RxrLMG5FG_sbcl zOeL}Oze0m(kgK&)q4l~dqc1zw-H^d@!STL-+>Msl=zs0vtMojmwjEgmg4ysi5)+f~G_-q!6B+#=& zF@aKUiK&&n69-!K9~Gbdu*-F1Izfg3`WJQ+g^kvwik^7u;ZpJJ7ql|kg(EjJ$JWk+ zwt9An6?V5Yplms?4{R%$$OA$n$LZL$sN#0T$y?7S-p2=&&MUfED=Yl!MOwi6QhX&) zLpHsZ=Rv*!4TM$v2FC-(B{$&gjOT=<7RXf8B?~pHFVYnJZz4?&vsK-1_+eMA1JSD1 zY-2x6Pz-0lG}FkI$~Trxf!Yxc$d~t$Tt1Hs&}=Ae3U}7?#v3&y%e(L0@_MUu+a}pT zJ%kn_{_9xHDs1$5`~zJcu+CcBAAV`g9AB`$Zk(1e7xj9b|AUCCZJG4HQH@NjEdOup ziiMel5 z5gl@9pcbzbyZ?!~7P@*u7_uh+g|y5y==CFccB+A4HAx>Ex+B>wY8;dPc`7thqN&MB zdfMMiUQV+kjU3X8W-nTPeJssQn9-(Ge^bcHRD%OTk62?>J~>RoG{saIHFLSWiDbPj zNjC{|0=2)$vYA`FtiCyrE^TZX=9MGCGQ;j?};@7J*bd3R&xJ zN2Vgof37|h{JYB2$u1dB^9a9ADU(dc@@iIQ6%^uYc+<3=GK?4a-s==Bu+>0gjxwj0 zhm>s6pm#Bg4O3$;r(`6poQ%7Lb{<#r4G-*}qM9Pa1;xUc zq$NDC10MXNXX%I*e&AmK7B7}xo*=WoEK|y?(w8-@GW~@znJ*z{*dYXKK*|K2=u4;R zFdD{3F<_Gm!y5*O{o~97nF*5YR0<+W5Q1m30`ChdTM=N9fYO0uri5w8prN>UE(1?U zxZ&M`ssh0~(osmdk`Pp_u|^0-fdDJTUEIO*1KGBC7)1CRLqQOqqo%}g_NEFtpwj84 z7>TBmG&3Z@8|?_9bPof2AXM@6wn41yHQd@2li5mbKr*r8W*d^DM=U_(U?0gOLkK9p z+MsM3fn@NWl!6wGf=588q`6JmdC`gWY}xtIiBq9t4%{KKv^K8bh#IBv;)r?Gu<50M z@D59POSVG5L6qnNoe?l~J0`sb&46T7C1;zM7Q{QYt;MVlj1^%Ee4hejjPq|OfKH*m zlBCt)wrwUC3x_?x{+%$7_8|;(c8*L43!5rjEQ4UWi7Mo-2i*4m_Ky2)-UjLv;_fNJ-CJ?BvXhiZ{(m~eE9wD&<|)gd%1qw z1>D~476yE5*yXn@H`oSKIBO`z=%y&#m9Boz+q>-lZRoxi1T5UHXWyw8lC`dI(PQm> zNfcX;hU3Dk&1)3GPhWlr?(WW>Ma(v`D^^+ca7I0wuJ+gzEsc-5ZR6Q{+$Zcdo5b1u znHp`gT4rA7P+*mqPc5^%4NkOc>(0J!+kG=9xyUJp7}Z~H8DuWBZF`iPwtCO_*){*p zkT(p^a&U|_Uwz@S2`12useW7F-|O}4@9f@oeUI3E8$ATrzdK^MYs;rESdM;YsJlRk zTA38%FFhG;IH)gWE6%HH>m9$~xfwjPJF;A3=idKpg z`vq57;g}grU$)-w6FTIj4B7PB$xFy8{z!D5KUvlizV|M;xL*DoFofvH;Ni6R##F!V z?w*yZ7bXzS4NXg#2rIw1s;{in+ZF3MbFcbev^n^1yaV3Oe|`%0|L))u-p5$l;I@RJ zh@uLY_*teVR;{gwHU1^hu|D1nG&85Gg(z+_nKt?C)#%IsjPL&3G)w?lOO{w&r9(c< zdiVSM&B4U+8{-Ea6K<*a0};6E5%GHGc{5*C=gF_8=+TRF`h;SK8cSEcv3q>xc)^iB z$7-ZBgTrY$Hk8%-{cyBUKMyLW-KmRwNy&dA&RsSU41RYwyL-0mzTCfGlh3?t-tlMv zvCDM@P2SRDKYmvhz~}3|Uz_%qV9)-lPnOO``FJD{G&t@>N?%FPtk3Uq$#=w}w`J48 zk;!66HQc(y+z}MYPCVPf$+0(ix}V^&wiTFA)K^|QvGS2 zv0l}G**9|?jl3d zuK(M!UfXedcXw4hj@$a+xUI#m=uPtmE2*Qv8Sy(|`@C*58iW0n(5BOIug>-%ZdH_c zpcZxyY}0~uDEqcY_c*WfIcI#6`Aw?mS3{4v;Qrgb-$(x} zKsy$DyJXx_Vmf?DvP}V9?_o{k-M+bd8;#is0t#Sb4keMnED!Vx`HxW)ge%scQG-9oMmya+Kt-Y%Kc4aXdwg zL+6)f4Zm;!xP#jt^!DubfIWV`7Yj1_-H!oOggAaa+%hEG$C&guAATSKH}QGsi7Ajq|QUy`*Hfy8KE^6*RkyNK4kQ4)lwTEQV%%_q8C}ZIC=9r4>X=`8#o{a#ga9tfz4N zx3^2XmlBBo`s?=3AL7_JWm-srY7PPhjvD!y;JAx=!10fKz)u6?u*BB0m%5|Vj=$2} z+xm~ahs0)+c@6p8UkHR-fj-Y|KVSC}cPb)@4!@Xgo3WtSYD4sK@YXLckH0Sc0qxtj z3Fpjbw!DW&9$jc3OCBb`NVX8{f?;>BuJP z3(F3H8;2d6wr#Juy47T}68%dYGBNZ9tpoID;tu3H4sG=w5&nMb9^X;c=B0x%1saO- zJ+LCk9%mV<4{vwt;}PxIhVxU}67g7!IvuBl+txL^81F~gh?0yy(#-Ki)C1GB?(dJw zF|T)Lzx{kp%Eoc^h1{Cd%8^|6<1W z{Iop)hr8QHpSIfvy^X+3_Uzh^M{7%g`h;s!v-b1R+7Pko^9O*ZK)?2T#QLf1hpW!O zb>o~oNzca>EB;~HXr1*9dMT{+tduEpLJp6J=I=IbZrQBFOS74vwnkm%I`A z0o=|I^OMyCPh>BvS^L&@A3j%c`WX1*(p6#Rc%08axI%B%9{UcQyW3s6BgG&o27wN~ z-im1N>6oS14(e-X>+QpbUIxnwFgl8}m-M$`?7kZ{9y|tAQg zrJtL?|MM)N`!z;$T*2xury#-i_gG8+_xEbRA%)0iF0Sz5X!avO=jm9OcD?7+E=ilfcYSf8h%=w$?MmF zP{Yx)*W3&h3A8*=Ey(#@urD_XZ9od-Y#gYkC)y@G zSp^MJc~|C_)UW-{;C1o(1-trb{@%ySci?RjILE_uBrs^sEAaB|0r)|H5S55w3?U=L zH4W)yDENDBT{W&C6KoNu__LD6&Em#sT3hyR?jd&=Insx~p|@r*y4AQ5fCYsvj*8%m zvQzB(%S`0NT;C6iBZj!f;rs66$Z`AqOI6xdu=$b`QAR0MpU>+szdLt}inPOiMArGi z`;Fw?ck$p}&o|{kEfwpA+s;ubBmKzimPe0wh*^?&);q9aZ zDc!Wwn535K5v1Gc@W?)g)8*B?;{V9cYjuPJQ> z1eC-G2_ID8=unkw`1lYF$gjnKHB2>6_7fmzZXsiYL{DS{ZxtQuQgxec3`ZoBqCio` z#i(h=4!SN0oqlG|=L7BJaWQDAfq(1Bh`5mRl8b(S^4y~~f>auNn7VhELS{^`%k2>k zAwYt$L<9whHB3ErR^A95v_Z9;^E#$weX{xk{m+SLwvWWW#fD)xsqkFM2L3`G8mge3 zoG5V50D=sm=oHSnV*(>^Ku7n0cwi616RM#d^D!~D*ReGX=(`Y;UmnOuH8*&{qJ@go7y0L^gyyw zSU$Xl^B7OA6!LW?-jB%tx(k8`dDA&C4D8bv88N-VYj_WS(^+wfVD4yz@$XuT)M>uu zbs+8!spzBAz)UoE;U+ZmLe7?<{8#ZU>j!HAMS4W|##y$RXy3L>%;bl6tZ=e(hFa)AnT$0sKr_!4eo1dQN5iKdj@$yi z@rVJ)@ri|q?7T36dzhYJLie(KKmaoZOcv}a#S0+Bv{VM5&EzF;Awn3wrSlla5jek^ zNoBAX^5U4lK2ulZ1w(UJX2R^oG0GwFf5(7oOkF!j%}tCnzCmQfhUdI1ozgzm#-4;69LEj|3{nMdkkdPdCDMA`K)T*Ig*V30=SFJMBa0QE4*n4j&te!Hu2QrBsUMYWcdu~)jwrK;et2| zA{|GC1D1@VoamSAB_M_DABb60{LCwi5&!6fdIFXO7J5Fy9Lu@K`_@2}Kfc`2C&6Anim*x*BrM1ApQ z7*aU@lDjj%VadlC-2YbHeRy(*gL=uKiI9+lC9k0WYs;%UwB`}irJOwAJSKFQcb%1m zVr>IHDN-N?+Lufu`LT?qb!|)>To4jdy|p3A>04>2cF~qbp`(>}pg}`<5Vky0tF1i2O6~7|=XF73oV3ejSzN7smTSvt z{tNZl@~?=cO-$)#yN!P?c8^UIqb1ktLq!ti?eTPc71l z#x#QX<#ecFc*=*7S<)@>W)NkYZIR?>O=`Fipfe^_4$c@f4lDCN3vc1 z%YmEL5e9mm;L+#b8g=Kl)9(l(rTTa8CcP;plTo`pCx9M~P0R`yK*c z6hdEza}e!QO2AO}lm7#l;LGrF0}bnO0&ShP{523vQ?L{^mCec#VI?m-L`ELX5*Cf3 z_u4`02%0XfWCX0%rr1nfO+HD=WyLLj&yUk`WhMGAOT=h?&F?p^hPmnBvjTd;J~bNm zsE;RyxPa$Oeb(feHG^RAlA6UZJ$EQ!{r*qBWJVP0*}th+(}QTtXQi1EUR_>jmag0t z6O*=d6_Rv3>pccu75^e9{z*qDtavS^#O6$rFsr>9C&Z0lS0H*195LX9x<{cQ(6ff3hL zh9>g@-#SbSA0ZSfZt`G&r`VRJbGv5s2w0SQQ#+7d@dD_?}?B2YI!qUO2D@kl##ix`B#Eimzb;yR1eu8ZHkgAh-WIAwLs8`8lh5|DZHx_h;<05Xsh*#3=&XAUgit5Hd(i`l}WM$@!U5;0GTi z1!m@d;h$h-XZyeLPcU%)Z~PPNEDZmXdQz9}L_JB1!`27&b;3b79^hZMU?F~kF!XJz z#?zW>>S)q<7ITi0pKTAMSh0KsU7s76F3f^E36mUe0%TQ}a$S4+bJ32`AB@;gFG6vP zSM)@N!Jk!wIeU6KF_w90f}G1_pT8-y_Vkn>Ec20SF+X=1si%3f`>bO5qQ|1z)pJ0C z*0T|>BX|6veqaoHu!#|PzjH`PaKK&aUI;k}t|JXS?BplH2;Ii=|LfWJQ( ziUEu9#*#4{0(W7U77ryP040~{M=@$(dn^ih!{dP9%^b=iTw_8ar=v`iVicpy&C{od z3Qcrr)LU4FPJ>vkp|3u6bgI18R?;zgr-*UtJ%@SL+QGjRaMotC**&qhXwBfH1I zn5)RB0EbJg=b`Eq+{uLaHTZB^-cisfii;70MK)EHVf69N_)3m5sK?JqWH7|a62vEV zKPFW5^Qg%?_7ZU6Jt1~5zJcVg?YgrFr5brk0S05Z#~2L=C;Cw%7mq1XU<>eu4|&B! zq#+ncBHmU&JPi#B%K&vj^5ug9T^3T_?}I#9Kp#l#CVWMXXh6Nj_JQOjj35~g?AKMF z4VDy0Mg{>$5n<>9L7Cu$_w9~(o(+MR3&M;OyCbuwBSOJB*ZCI+(=!wv@@9a{3`HEi zw#=g2~L|`Bi2=uHD^dJWq z3J~)22n+#|xLm~&OUQ(YZzAbR+ttue0vPuMi^xnva0jKdw=z`SJlvwaJtQMa-|roe zE!kxWl7iylWOHXhEEqM0w&=qQ^&bcp+=V(7y|teX!X>!ismw%SI4q0MLnqBM`sMUM zk|DBnC%%*jPoyX@2;ienv_~gS5v4^0b|S{vu)IastD7^x6w;HZ7e(@uf{1}=#>oZB zF#2;zzX_6+5`R!~ilc2oi)9Q!aRBQ^NIO~&VgW>ijo>Tk8k=TNtA_c!G zgCqEM5&%ju252qqDyjgYdqA zAbn#mmsp}~rVU65U@QUOU{R`HgWepAmR!C+*+DNj#37hS9~Q*KwJ45Z9jHGPWEMiW zcsg0Hs9jO2IVq`jFGC`r*&v+c7^fvuNHB8r-5`hvJ||K1yin=@s#hb#;3Xz1?CRgN zID;MtNiaEhRt#IQz5oZtD!a2INE3`S{_i{ZpYOBW+-~ph2l!mOiBx(1uh)P0)!(x} z_W0lTVLu!{4{S1q;B#57pXNK1T`bR7j~R6<`6~r4^uK}NJ(F(`yu?MNQ6RIB#81K7 z9FGaNsd(3tW=-Z9SCVlQG4seI5rvN+-}@B20X?r8o=0q1pBtqYC;SZ%P|&0z$zoN! zbG$`uNYiQQ_Cy=urGSnOgA1dZBkmc=C}t7Ahn9m20BtP$mPDT7Jg~Piv3EL|P1zYu ztE}LAtS)^d(P*E1TM|44Zoz~3P9h@9nI}tl*P%%jYeiNPlt*CW zf#N92;&ZZB6am$MlBIK;0Amwv4}>u_>_q%)Q-GMf{-^#?cnr?F((o9bkG#RNFT)4s z%?E^;uE2()CEzHX4A^+KD;u(Ddl#auEDE9aEWHT57_bZ=3}TOsF(F}pSj*rWqAj$s z>sU?+!}HaR(?S9PEGz&R1yryEV2I9z5emde zyhNu-Vi2ZR0~mstfnnxP@NH5&iDj7s5=Yqv??g^<6eJK<;V4KT{yZ&kq2Wa=DKsG( zTM;LP7N5ZP$B@*pOVv6qeOHLChlQr)CF|2)wWu*ywy@b~c2ZkQLuJd1* z8@iGMv$98Cg-LtTXEB3c~Js!gn-qxAz6Z!*rk~Z!( zENw&aD$9M6vo>%S#EF_lhM`5lE6spzOmPDHZNcU_4GfjXk1GRzjD7)4?mC$K7{$^KpdBf62=fMTY`^u&- z>NOsw%h*HnP(Ef#_Q2rm$wi34xlST6r|0EfnlK`e0rxv)!HE2q;mII9&&?K)&UI>2 zA|QbpnA01oOg0H!^m|1?5ic46jVm&4K@HwMS&huz6!85_o3QISro~4_3svl9ws~!) zpd2bZjpT6YrNPKKaHZI?anwaPRcz_IBX1W{ZI9x@Q8^Rwaj)k{9lF^;<+usZ`b0pB zm>44N^f{TA1fEHgK;&fNRA`nv6k-{C&j?H#L;8z;8QjT1<=Xgk4ygJX12|mM$##qX ztYjPxD8GY)GXyn*yc*{MioElOxL^AYg-Q%v<_Sf)dIo3zT5Rd&$SG~?ZG|!a0*K5xPs1tpg>^E_R;Ld-K_FO=oP{vRWNa^1q2@9dbW3Ljc zfZ@_(o+44xUj#-%qHd@Jtb~w5UMuP6-f-nCwg!|(TgSMlMbj$0co2G3I;I8T1{-zjw!av+?GrF=ONlr470+MZZ5VxtW?wgT_Lw#2-Cwfr3Y9jmZPT&fbEonfA_hQQu zAK~h=Bs9rFNfJw{WdYDjE*s)nSfJS6NR3M9@s?&B#6nJ3;ZU3iwv{$uj--^Ec{wqmmvQuQkP5CI#!pvnOQxu9a%ejKc`^} zDO5cybpK0_t(Ign1*H=`n4jUx)#%Q>fA;*Tqm;!mhoh8LMurv}OjIEpiEoz`wPOs( zF6W>miA6%BD9dsZ-12wmx36dSzd~Dh?H>C#2KVFhMOgb_F{Kv6(D=(||QE)iZpJWQb? z;oT9KzDrYxv@sC!USi?!#K38S{}9gWw)c0~Lk*VX)+2u3giHc$($1mZ$--4dW0g_3 zmK(>QASTgsnn>`!B37DpA+Ug4SRZN|buUtUO00caDnnW-qE5l>xHD$f&nClbIOI=x zr12hs?TBk|itNPa9kmAn(TR@J`vy_JSP&EA3e>S{8*AU3;2>F6UwH(B)rH*|B5_=7C$$=x|RR@{6 z?VtoGCTIxVG?+U8R1=!J#5|ANNebYCx@iSVQ$xM4X1u$(;0?3;!F#I?Z?Tl3%!@-h z;9YWA(jldBKHeTcribGbTG+a0AyXK3Cc`nsCYpddfTH=A%n+(-FhoFpePz^?aVx`0 z%+9*-FpDwGyde~Ky}bmwB-BFvi+I)8e=6nOeW^8P%A}M_G#jBKEYdoVE7W~5N>$rt z1N_;1sQy5uRP7J*`5Oibo+Td`<^l4y5qYzvMIH(fTIijl!{#yU?KPcc?)9Gt5I0E~GRdZnb|a;>6H zDS3+_8_}naNePFP5-vfHltmR%irIvWUjYs^CHb-Er$e5!)G!5Cn)ksHj?spQA|ZUrj~UL2P#!;l*-todgNchQu`^M5ginH zwNjoHNJ(mv@~R0YOERST)2V)&eCO~@bC@=`^W}>P#lIitec+FiR(P>7ujf8K(wp-) z{#ev5KQ88ND`7ROZXP_JeTebfoC;qRe^T=T@={|4pjVs7Y#J{*onJOjvn8BE=7d`n z;v9`#4u~YH{7ebr?kDp~l>JLM6YMt!8@mh=al6MRjhnp@>>mLednDK!l_~*;%*7+A ze0KX|b(VYD$fzgH%UU*6V-l=YqNXqPEQmwVB&>%*CkkgrXg6b zKj$JlpRm-VSl@KG=u~2Ja(0d z&|N`M9W8XnD(Xn>op03Ak51*<1xYw02`LbQ(@edvW)eH)jfpy(EqtgB+z*9YM*MgR0nN)H(WSHs{;M_oi0{_Om@Rd!@0k~~8X0cK zHP13bf6zR)0}!emufp^;5BzORPlVKlqD}o?kkXNC6~1i?3}^% z8R}s{T-_VMrUVb?F8{G=->#{ReMyQc%ggq9Nm7i5JtnCf3)?LuX^D@$)40bDbcaE? zbb_(%6ZbE*11}bDy%eA7E4tnzJoPz07Fp+7^KaVhLL^0GKl1yT$`+8v+n^+$C|$IV zg^;q?s)+@UnAFQGNOTS!mfjHW$82y)TnOwV&#<-EAE2cC{{iZ&0+^ooS@!C~WTMaj zuE|DV7RLXe&Fck{j=@_YIG~=PNrYNj3OtJ#szYu9|wZ?Y6olby~e5%zqC08xBGyu7-c~EdDYP z@U)&ik{Ws{0JQO-t(u3F2Dg!@_uK|z)Y4GVPN01|JWY?oKaKxro|Z7YweN~^aL0d` zF(}enEAB|gtBjS+;ihg*JXFUBkgO#yzUI^2=Q?KstK+FwVI1l4f)`A2F5yRZK%z@- zt#ubMzv$NdWAd%*-P>oe^Kk(y&@r7OrG0hi?hbr;%}|5ra-u%oLitNa^3XK5$|&HA ze*df|Arcau+OVr|Ma$eyG8f8*IBFd&JB_r_sV&PB7k=^)w*A7wG&H08WTg&|t6$ij zt9_$8nfP7%ZR0tp{*b2C)KG(eM^k3QU!XNB-qGM}CTY)B92|c+>8#7NZFE4$wxXlQ z=v%iE!ujd_eR1Xd{WP&-%kTTvnB{PvoswJAGE?f8lZwlzhRqZ<#V|jlwxD?m^J73R zqTVVnl)u)$HfUyiMkSK*-h=-lvozDkohyn~H%ic)d9bwq2L)IW3Mp~)TqO9Er2drp zWtJ3b7Ck(^8Us*le<)?uG2UWvXWa)MO(MBpK?6}pvIW9LuW?niUETw`rKm)|zAIbl zE*6LHi!)nmGtc@jcAof`b;8Yhh)TH$Bjvi4ue3dq?I)_T9o!x<+b`2jas3h)(5qRU z^|gC?Hr+;i=t;+k(TLM(k_M`k$v8Ub+YL(ca7zPQRpjnib8OEFU}c;k z_r-hx1w#%iLBB`63~v3SI9GCAn>#^&R^XKoNmC zPs&4ME45PuHCL2#4-C_}pmo06=Qo`i(_3m$1@5K5ZS=c}xHuP#(ECC~b0y_wP+BJN z>m;n+aZjwiuADPW+#vGUC9%+(EXH>CE$lz>GY1GzO#UJ8jQNw;PRJH0GFS_z4Lrv| z&mUn$`0dn^ljj5~L}AZ5dlRu(i;6$4UaCx8o`m)w4>wh~es{$u_MAP{gnxaxXvn3i z%p`a-r~hQ>TDFEQJ=}~YRWG&tJM-`W)cda5hUrz((TOUu;w0JE;5^&b>CluZZ{PQM z27k*eHKtdBtzMe$wm}=4_Q4oEGUDA5xy7M&a_>yD4)p6h_XcbKb7mdNeLo3OowgDE zX07Y|H*WbD7ex)SJcTFv!AGHT?$axL>hRdXPc%zY%hANP30&%y=ZXzObf0Z+ZWSaeL8J5$o}c=No%L7GnlcyX(IuomNJi-n*pYq z+5`K_jc_xQp=v)1)mH7zYuZg?tRmTm^eje6|37YNJ_O6nI?ac9KI8cfed?EETQzT< zaE+E>&t1J_e?N{2m`DCqc5@KMlXU%SKx z1FXUEKt{PmOgO+S1hoFl@y9L!z@ccuUvf|O^5l?^RtZ_m%?iFOB@%~FuYwu}PhKJr zq=NT)Ju~?A;)W{ua&Ur>Q|&Qrb@3f0k|%fjz-;EPepaVi)cV>wMRDOXcgaHFL)g;4 zL_PAZ7fYE6Oc8e6FW-53=>ER#@EGB+Y`fe83$L6-_}-;;;9_5ZYt%;*04+%8(M)Xj zLf++F+A9xvegJq# ziZXOBbukm?Z!^5U%*+sAANU+ z@Xxw+21mLkOYwiGdr(%cixhZv?!Hra|Bh1^b-qN&sE6wEx4TRc?N>r;8Slj50%}o18nSD()6OY(IlAT9~}iSRdz7|W|Yr6 zW7cU{uP8O1^mL}Yl zjk9#q(!E{OKGDOByk=x9kUAkp5~r&vuM6`0JHDSJ^0aH~3WQ}U*1+@SvfhKtbB}iA z-o_l<{gmLEza4E=5uIR+I7O>1Pyf@(Ka!SiTuq*P{x!5znfxV3$&A0mAf2|EFhQZ4 zg7Y)|0#W+`5je_LaASo1qg~F)gS2NRbInuThvdhe_jxQnr7gzd*|^<`=!BCo+3a=t zQPD9m{jH$KA95Y*9ub|u&Fc;xNzwFIeqt0#oqIO)Sxmsg7(zbOt<%t`fCXf9A=S@& zo6kdYXRC(r2MtVvj>=;8nGHL2(w!T9p`x!RQeV%m^j5L?@tacyGQ`pOm>E@E8xq6s zm7iV&T^n5;G_BikR!74(T{_L>X;O%gRP)`DCHn=v#)jt=bOC1!zS%?bs`4b82d+ z-I?Q8ic=?waYym=n_gQr4Z8rm(73T{D-#u9MmM!GfzIXWkFegh4OXW#86Ls~eY_*6 zSm_gZvOXxmPeywx&QW#Kr$Iivh%TK^*lW6MnxOg~!_355>GhGF7z3c!x`$+0$0&`T z{Ju~9-Ti9~#iJaFw8|qZQ5aUdaP;UxkI!AxBAVT%y>5ViMC}(9o)Xo=2d2}?!^>)P z*(YhtzY>8r6|$d*_{tPJBio|TmgO>UKo&ohj3>r*2I@>|;yC`#qW)e1`m~Zn~buDg1a3afmsnzCHeL7=cKW z#;{vQKmMdY)*tg0W^aC}!?}h3U#BV)GXu;2*{RCN$;tA+ajG&iF#S(KU)7pp2_!AB zzZ%5n7PwrZfdCR>6pz5JuX%|!A#hF6TYH+9>9%2fJ2!PHCaBa-o+i5OX^=*K0DXTX z32pktl*+KjVnk)I8~R1pl8AH`Ws@e=6WA0B9aPyE6Uj-}2DKz)(=#b)_U5Du_vI0l zP=hPHOC1sek7Z>7Dl2~F&NER!--%I*C4h};G?sdO>LrP4NmKlj;|u-OBN8*%{w_x> zMkRwP!BYQ0bhxF;>gOJjO2)~f>Ou|RfnHSWwPs-AD%L=|1`Y#1;?_9&dxxm7mDw|! z3EU(oFb)wcam)=a9;!{LPEP-6!3Y5%M+Fz7V5r)M-x-9jiUnR(VFp7}h6)xyg$*kK z;0>*zdDtDHDp_YvHL_#m*FU8h9fi0WwAfP9$BEZ68 zdK!MK!>Ry&pPw;GxT`9@P4q%J89te*MHD9RkJE)f$SN5JZY*Xbt$d~0K_Ew6E18f~ z`k=R4W(Jy}2=gxxDh?@D2w!84~CfkCc8a=CCFd^ghvYGqN8Q7%UvSUy>kgMgHj2)WRov2& zkpU){-Bi)5UJh=KMJ0kPl_)ru%`53~!9GZx*^;MlfO1t3u; zB?3TIe;0G_2pR56X2Mc91KT0$NaFTEmbw$c1<3D63|cmS4MjaX5`iP>ZBPd9-K|p9 zfTyxXz1bD7RAs}oYs!cNHLsS+vrFz~T-|=hH%!qKV&qa6%PQD9RKNmP%ZtmXRXPXA zVA94aYaTldEOIQKq!-9uOC$unN9suG?VD7C((9fO!QD^LtQ25UuU1o}OK+n3gW0xZ z6&U}Ul94y7E^z8gQLgUa+_XaVfuvrn5IJOTP$TAABx})fv9fL&pFPqURU|CFO`{k` z?MPDAGfXvlnPz2!b606H#cy6*E=EZ0C&R$K_rD(W!K|E|6o4vNbUf3jldeOMHc6!l zS3vZ<7SOe9g7T^}sz!UfbF5G;qp4P7{uT03i}$fGuI_iTFJq~4Fnxqb4~?Frfq~=mkn;5|f2Sj&sU z#A|OmLhod~odjN%vhjfs6u}ts8b+SIDc(==a zWh21QsoBn5!R7_@gO(A*w}TbLS*rz4@|x~XVW+SE?eY0~ z-?`Jx^{;|_~YxR^Q;i1h+ zzX>{-UAPs2)bhFq1*|StUX)p>Ml5gf)fBLy0$P<*Uk>gUq)we_u`g#-m zM)L$bgcYwWt;0sqp=(8O;@=HV5Tr49uzH24v5xU0t@FW9tNb76k+#k8@8*2wX zcEh$t9m*5Ygo%AaTv7Z053J#4@g{ca6eKyTBE60u(|A0WpVX`CF9)i#DXe|Vf`d{D z-pYITIR$Q58*W=r@*d+9CjcR?%u(olkB^y?vyYFS@2eZ^fmwyOVyk}Cn}dswm!7zs z>r*nz{;qo=dPnh*YM*}DW1)X9pISEk)wfhXdis|;a|3glDKbnCk(pen)h{s z-y~C>B8@VZIlX|ntkQYt#rc7Fj~jl3T^r;aMZtTzx96FC$N%(fKX@fm>NVIAzeDXK zr_Q-i@9@BXpP?KuamkuOsejnq#@?lxKFB}xp$(|Hs3aO^TZ#2!b=d9eL^&BOon zNUx!&X&;Aoc6(m(@{FhZB>tlNbdlhXz#q6L;$a;ciX$Vm|bn`Ccnh}_1W5y(w!C7FyUOG?k>^AkIR#CeTgR@%k2*Hz9psZ3oi%% zvb086@HH0U%@RfDcXFf1ehZ(tX!@Phr=R);dnbwO=iWN(Z^+Q{x-^PQXh_cY%KEwncfI-`*8O z{`0^T<7-;nvE#DClf}1Px^lsb`{gL*5=ggX})~?>jG1SPk zLHN0KX=?m%)gkSx@YQsYL-wB6UO}&(I@s-*_#U)Ixl!*c_~N9yoNJ|v36tndu8nEr zb+H*V|G1i*Gv;Hi;*gO^V!GXCc6LWBw zU&rr(pEX&QUGoHYk9s%bbOqBzh=!xvtfUQPU!|M*-sk#<7x63;d}FSw!)w5vzHSvh z^q@=B!>%=yUK)?f>0IhZ(48^eLN`YTXRloSN9s%t&-(d5Z8ICjqZ31d9W(0Qq5Q_G z;kj!s!24%>j9(7zl6K{Gvt|N#kZkr13=ke%El@ z>-9QcTCRQT)GZEtkM_5skI+kX_NSr!fC&q{*}-0dfv?tEQ8-?cD;st_bCCFDAA2qw zjtfraMbfeM9)X_2*%RthM)8C1;!GV!&3qT|j6^J}i}?wLkLX?M(e|3$b>qDx-35*} zcK!^vq1N?g-Ea*nFNJL5^yx$@n(76Ax{qlE?i*+|>FfP0y{cLrrQWgh&<_Az%IxR= zYR|y(e?b(%$jQe1zu7Y|F>?M-GP21U(#=N|uvg|NQU3nEy)5&dW7_F`+GnQUYnc^X z#~7JfXIU54v-;}^G(^P7BugxovP~;FLP|@BmKZzY6-eF|<(>zSzVEx4IU-beI50Yi z7JWn4oeO={dm6;$u-%xF+#rnwV^nm~4ppKFekX^iAR^CP^ zWkve{ccW zkY)aeB?ma>`#NVYxGd)dFjvT^{l!$}5bw9}1@AFXf#sjaSdx3T5le=%ru7ADln;Y! zJXiD0n8j`)0)4`S)D0-G?mIwWN$I zm+JwKwa^$1*QjWq6sC6~&n9950BL!d!ktKK&D%=365v!tNg!@2K}8}+T!V5KJW~=- zR@RJ_2!O0gOgJK=o&(m!(jGgfciRAGA>{_ZO#sM#SQG{0O;ZNymN_sGFm^H?trc81 zYe;2}>wzy4IU`g7OUSy9sT#0NFb}{Ch(OaBj6}?I7F+<(I+(QAtUe|y2}tdhj1U6S zJX-=78|hQPvWx<|iXF?QFd0AODx_JJgrR=|Dg?P}wt3&1Jq^28;~y8Z!>*+(1WCz? zB{tGRh-?7?q#;Qq%(i_Ix4d9w)P{g&+jN$QR_lMjv4D1CKjS+H`(h@k7T2~S8Q^7` z2*lfGzDY0|BwBh4w)+nmMS$@Gh;SbJ9QGzlH<)iImVFtUCzQOIX*IVq2*w_&4L5=q zkK-z6e$r8XqHqWLC3F$5el82by%%t2vKUXJZafrt0y$*z5(es53L z1GvfY^7b3`r+MUO$5-^;uTMv<KAdLo<8_wx-^4|l_3=D>;0%T;~s-XS;2)A^t6*+cfWNQ?Hn>(mp1 zo`G=ag5DdjWWCQ}i{}b_Hgk)6Y3|V+opWm{ID*riU8UPQg)t;Q*Xu7Uh3&IktZ#Z# zS7|PB*FLY;Tu_70=E5gV4%;8$)C67lCGZ#bp2M9b=rVkVyp@C}Dfm0suJ?X?;6B|S zpsx!;@7bN2+hJbsc@xN)X?$R1y7!!K3r)={BiqbE`{ol# z_mS@@?CJ;FpZRKcpssx1(~nRaiIrlGPq!{Z`e`M!OW$6-zs2l)QFOiE?WaAa{9>j1 zH@n9Gu@gPqtws;J6~?LZe|p3cv-x)|u3%+jcE4sbysnMzw1&6C+KNt*I&}H1 z>n=&SZ}aVRdY@TXQ;X@ZE=jeTfo&gJ@uqv2Cd77J3o^b2{g!-!VEwys{)~9Ourh6D zg1HWDzIWL7Npwd2(N<0)zF=~+&HG8#`slV$MPI#aw{Z^N(hxJ+V8e=9eCE5iN&-#6 zdtL(Y=^TI?f3_xDHRI~n;*Q$%XRQW*^KbIhfb7ht9tzN#b^h`pGhXNp4P189__31y z?no}+ZEP|%+&OJpF+KKNrSREW_4y}zy7O*$&?%T`J8QTmKk}vF6;Ok5&}hGGYP?WS zTjf)wTTFX>SI&p_uC>E1rATl9s11Uh-B~#jO|VYv$rGN6%8R$OP~9GYm+A>0ZD{kZ z54}?O>C3b8CS3)6P^@bs@W>a?!ylU@zt8^iqycvPZ{2UvR+{dT_{t&sRreA<`vAU} z`ihZ5{_$Wl)z!k-65eCR#6!8XR?ik+pNhNeqSj0= z_C}ZpqW*ChNuta;ct|KH?T$(oWW z)GdgcA1E$B7@UT!q3X>~&cM7^-hSf#)l{_#AW!Th8GmIC5jX*8=l4g$GENOWC6YW* zem%(io}3~$`0KS68cE*a*l4X()TC3A+=d0#aY5aBC)Ii zGZ_Rxpf*EMb&m2A3Y0tMpESbhS&84xmoxC%xmfV5x+8SqW8%xbz>9N#{R69D29UBb z7BPT;ji7H#U{vtzV1Ssj04nf*y)#At!bf#b2)a|kgeX1K;(ifyM22t~5qH7^!6!Nt z)boDSDd$xeCIoL{#!Dv{O@9{hni5NOt{IOr+GHw1VB{(SkU$cSKok|iKUBBa6Xr@0 z7yAkTamOayXoDBmf|0G8$+%+=ULbWRDZ5VYOh}5D>%(ua~uf^#GjTL>EkJb3r2$z#n~1ghN5C zIcyn&x`*NKZ%$?uKu71HQX86Fmmok`I^a)+LV#Ni2sn)dY%hox7?bQEsz5F0#DVZ( zfOejTBphchvk!z%09}UK3C6;9ePBo7ECAvQU6OGhW$?}kGstEY^6Cj_q3|X^+s9Md zDKr6`|0Ffh;m9h*Se^SjO1-AP*`Ov69cNOtc*FS6N;vKpz-fL@P3nti z!wOepP#3(Sd7ot0z$8{z1dYXL`;`go(-EEae@U+7V8YPK8eXE%U&XnEmf(4gQ8W%f zU&OTnwad#@xju+U0pEnH91R#Hz&XrI5}Tm@#PQLPqvobfy~C!3UsZ%K{S56MWCDsY zs3ZdKhgE@r`vij=M8!&P>I!p)AQ_^tJDh2^gU(0{?y_n6ySGmes<%s z(h8i#=i(ky>+w7h&zC4uB=`ICrv9a-$)8=GN)8 zt_o(z<%URmIur+8xX%UvcdmXY{<1`H`aVS)O<7D7heGQ{E zcW|6?JhV&lJoQAO?)ovo@ux~V-<-W$a3X^!jLD0&-!2LdBO{;s|wzfke=e)JPX^i*ZGO>Vq=Mmay`|S6#YefWwQutobnF`Ygqgm70T3^gGI0N z&g2~OulKGRkAKR)?5Qn1!0V-t-SVHR+!IVs(ii$r`ZOUUhFi&PZxgl2>KEQZ@(o^( z4utaCd~TpRHAQ{A-kQyLxc+L6t{De)_L=xs!hn38_p&C*_Pp-`^fugIg9tFIw3I z4i%HszP1mWOsEJu3k)68kxBY|xib@D+k>%dx^&)8E+mt7-}-dMffJL%eC946ReZK{ z%EnY4=}+3(V&g3x>yi52bTyG4F@`;QZj$BjXXSUA-B6E_6P?8#d7kBZ&$MTD6uz-Q3LNJges0{!W>I-A`4I zaaC2j7bK#dca9#FZ~YDIm#wtJ81fJHJHGahBl1hvkLvN9CGQT@?MKv2>0aJ->GzY6 z_P^=3XP74z&O_7tQ;!UsKW#{z>aOf>qDQ!W>C`t&FYQxKO*OmL4>}#E=%-ccmfpZW zgn);Dy@h4Mw?*}c6fd!La14I6`Sd%nQ*$|r=Uj`tdOaDt4cIZR|HM}Uy)lM}Va7b@uxI1mz~e$(<5}f0JJsV21*PnN%Fv2*rBRmHA>?M z&zLwGBvWN@GlQpf4$01%giCC&{mjL^;JL+jyj4|PI|I33^aMvxbwNo|)`cklI8>i3 z-8hQ-QWKTPfVK&hnEh7g-iXt9_V&guUC3C|yD`&53TlC&xR5!%PA3iKm!?tLZwUZE zppwMr`HV~s^U!#U*i6Kbz*V^hf{MtdiUq6pS1v?Au^{I$RxE{m|GGzdT|hj&fP0FWkURoRE_-Vb_b@%hLG zb^6lW1LBy-agb@M>5xKq$|WuYf|~wz!b9*j4>EorAH!25YD`S>wFBo7L%M=kp7lcN zdSOHPtG}n|)sp$KsO6{65LH#V9`|^N%L?~-CN1!pJxL)EC7iRlUaSLP?3H_>8td7d zu75!YOUJemW&YNeNt71=uOoUm?IB};+UP?ZD(a)T>ZOPB&Q4QK>V-?MJDLcm&(jej z7e+L!v_S)PD_#dpH58Eshzr##LN{2jx{|0)Spp}LO;vy-vci-mmIP_YsGCewae|gi zRRqFIr>n3@j;fWXPgm`S#^dQT6^#tQS*8ag(~oV2a|VrjnWD;K=SQs$#u6BU{AoPh z6o^e|%G}I+QV~po?rm!-`MKwX1uSYTkotO*5L?8!3dR*Y&LKukDS` zCj7l`shk5P-v!0@ZlA%|D`#G_G*^y)di-z zq29Xa-x7`ZZ+Dfw4~fZoj=6w6D<8IZ`lMu~%iME;)JV_HcLP=9EP#yne(H8+Y>0}W z?ET~Xhjs3W)dSKG*LT@*z=TimGly44KLn`m19R;+eFtZgaj)8rBlQ|v-EN_e8^B;Y zj8XUa8Eq$zs^$E8c;=z%+2(C;+rq~t_RYj=pt8H) zXr*>KVxoKp?{QSM8$*3!+$Pgw3J8X+(o0mYITh{seg1iQe|s9DWAx&q4BI`8`kl^$ zeDgWg+qBbL_fXk)i8JN0)2>=bvibefTE_>?^;0;N=)EWCMu`vn6v@Z8CugW*^mxl{ zCk>4FP9m$}j<<$pSoYAvmn7uV4Xoa&`-ThrG;7E+UK2sA)$7 z=tIKuhQp2axl8H+na47i9W?%o24D1s1g_A}0fX$O2O5@x%&8{_0cfMm#Dv4DPp$i* zdF0s?JvQ~0=98`;o@UvebBnKC{2Eaa-SPUC?AV+uhqVRT+3zU$YiN<#oTlgB^U29A z4TILb`jPmAyc#CO!L1Kps$Om1I2=w&c0GGu8L$GA~|gWso{~X!=v$r ze0)yrH&-%)3Ov)-SIDQ&T|bkMtX|~r(Xsu5(D&vI#@pVlP@l6=Z|8aZ*`-FN&RyQ+ z_fPSamG?PYJRHqyD!Wl%hkNx}PiGjpbHN%lZ<_9N`hyxQEiS`QeH*}$}w z`nFzMmbk#C(DIVleR570r)cU&3(5-fZusE?k{=jr@s86KO-wslT&3^p>Sq*C=w-r09;7MCiJNClX zsvT%Nv+Ig{|4glOH9hP-%z3nn25GK700>@Iy>tKoA#Can3wd?s=p z0hFd!LjQFf-b8!QK@?tT5<25jvwD$ms`vBELOMOMSFEzy#WZ{411T4MBNp5 z`}DZ9BAZ98rh~POo9#xwv0HE6GhR(vrleo}n>rF`ehzO?-x*vuK3m|6b+1KSws>HlwmZOn`eZ2uLoY1Y!I zJZf|Fo~^w#LJHHOOfEwD4NI7Mc!Wed?%jreXrQ$X0Um;xb`ACV+L~f*r?t^?nZsql ze&VK;V!5IHiuLZMRsJ|@q6=NYm|)gkaUL_}CBMHY{d==5Qt zk`?u4z4due-z=he$fX)8nVyQd02RK)2lfeZo=49hlwP<$X7HB&<@q?~!3#M71p%5A zbEEEa-5yMo?;nsy+`gaV81UxBSZ(G8#;_+S4^ZW{_M<>hk;=A202&UhOXZB$hkWeS zui-Vc){sP}mnSUmF^(W!LN<;hN3MyWa^^`^sw$D1Kb%6+zBL`_-j^N1MD;zVbELOc zE;`&*7@&lsg;h`AQwlCtt02H+!C>%9tdPrre6|N06xDwM##E{nVOp?FbOG$ zK=a@iHGcV5W{a4C92a3(^X$ammWNaXn&jVP9P!qn>?jXZrWo{gZVVBR7Rh-)FVuZ5 z-S-<-(5w#S_p$Z7_Vmw&J-xMH3xo7NOJup5-ie|E%|(g2=Y zp~js+0d09feiAe`MkK*n?NNzAt=hKxVJuoV69{w%R8BeV9Hwkn!aYgO8yid&00o|t zr8+)T;e;6FZ*}H=FM!Drq~xDj2XuX^ZomXBVxeVzA8ApNuwb5}T#{p4FPswzaHn~L z*uiA-6;Xe_tPm+De0v7%d}^}F5{8ThsdK$>&;r;H3eST<{cy)Fsan(GC8AuLA_h`~ z4zml`cuk?CF=tfe9O^X$I>%t$A6Hxq`eZQ{TWQeN`VrpMI_-cr$=yz724crqVf$z?fd4hMmGxP1jaA^F z4nnXZY!29?6^2ky@jwnqgpXXB&3m| zMGYt^abz}#Ykf(Op|CtX#(Z!<>aCx;KEa%`U{io9HTt?40#WLe;T$y+IwFCc9tEVu z1mfN}7GKJ6YA5KI%MsFtRlMHsiu+*rRsYC#X{tqh>-NYuZ0~lMZFE|yJfh5f0hD+@ z&{wLkF{kgxGdbU{$Pz*PzKf~ z@c0V%CC=U!2c^%Cge)LT9+P|CF$2KVy?5?r z{;R3&@9t>WYh_z!Ctf|RzU^_2pUvBl`^RRP)6WnblhNr0iR-$_82)m$JMEs9@XR}q zSJo#(_)jJih;p9`Km!%*=HEeXhM}C5(;sxp-~He#@YUH7uWiTbXTOc@XtzS4 z8ELG}naPn4^75llW|qqv!)9-aC|u`l0c@wRW$MVMS46`&FaET@kJVM!whyt-7GQVQ z!o%FG;}O4guoJqL_|v5t-Ev2A+w;?jc%u}Z%Rukh<|1(1k6CGchLMN@0m`|dXm+t=DCyvDZE z6GSybr_5tM&%5V&Ay+M}@DCgH^{v=6UwHI+;JGFCQs|ZG$5>B`tJT+-&&dF`hjZu0 zlYv(D79pPmx84p}=i5o=4e#gm>(K?elkxC;F5kiS4>b8Uc;6X&GCDfOdt&^6pKeXc z*D#&S_gTq%zmxlQP|El9aOV2`a+JC^$>jU_Rf_-J{`~#$dSA-N?c?+H;>^kEfBEh8 zwXnIYIEk#)JACoSps7mi1{th;d#7_e5Ay zx@7-HAmZh5=s%iLv&?)bJJECaFaNy4;0L} z_q8Kr;s#$&)tUEmL$0^1$rlQ{z5d@i{$%$QN=2dB_8x8JNTEu!Ls)X@SN0Wo)!87& z8&V@jS#fR;s*tdlB06>mbRdr9@sj`iQ374#CZQ76=V0rhqttbN%iy3ycocI6)3?SN zr~ODTyL=0r6Bh(6sKQ@mPE}3}((vExuOMDvx&X(#TTwGLPj=-f1UO8CG5jnZJsN2- znAx|W2*?2gO>SmON6CX=4BPN>M?U*X7ws@88ipFAzggCj7O@P6)_Cp@dy-TZ;Rll1 z><{q(C^wVeIS?&>=QBQ3)oI~Hslx3B^%ny6Vi$6&8Q2w<>=%2j-bjmoEfmOB0F2?{ zIpoM_;KOFrikWc8%P}wkg}WF!%O7oyY`r2X!zF||Pzu+L=)eQz5FKSIMj7iKE#RjB!-27jnbjK z(8HS!6sznk%PR4d$n^ntXNgTr)+maX5Jj4c0Q-XidNfi`YeuYX5_x`*}Y&oT(RDuyBxfE zu}o9kp<31%skXCfhO)qH z&3$Hg9N787uViMQ?e|&CBH@JaQ=pRAN!cDPq~}!{?~F^RGA6|$IDj0y;wKYAi}uV! z$=6GpzcpGa9+q5w;kf%@EH}0ilzG~slm>$5TI_;ZcKuMiMeH*kqh85xQfPsm&IJ>g=x?stH84E zNA~BvUqOSrHnY)|_v>vHO!HcBwD+5R$u(ya?RJ0aruA8$K&vyYh+}F@-f$jxca!n8 z`ARjzPXc(+Z<{9#I$~$%W%!D7-p+g;?!BTGn8_y{Uqg_@?9*8s{lIIJ#h>hZMjFY4t(#sejYmm(v+jPN_G=b zAx7b60v9Vym@78fBj3sM74*3#T_kw9Xm+d|lO?8kp`+!4Zy|wh;%X2#Ej~(3;(FT0 zl+>eQ6DC&l6M$t){wxY&D^FIl_R%lI7-W*wu03z+W}F%CDE!oXQktw4Y}_ka-5b;7 z%$55LG0{+lbup$SYL)!M3VFaY#Y0eGL5o04X{w4simZzpBOS?`I`H}7;@9x~5~f~- zz`ts;9?QVH?2ADqkj&KReZ|1c8^dxJ9h&_gp6coR#(OI6cgrSL2;^F|0@@VZZpOEB z-Si2-`?w@B8GgSu5w&XG0_@xaFpW!=oV^L9Sa20SlYb{Mqi%<`u{5%ixqr>rWCnJg z&SZfM!9QTdWIijqUwg&Ki;z?|tdI9yVA^o54La9^8h9B*_kR~&mxkGp&edY<{Hn`; zEx`8q#IW_7emBEE&LW~(BTSGN>w^i?@V5XveSrJ&mRmtvfV~#ysKC*B0y^g#LL$oB zoH~g!ShUP3bLN$sT@5CC!DN=~xK2d$hy(|jl^2p&8TSawhC82`VN5K#D6u8h_NM4) zClJ?B7EC(_&3z7ra0GO_&ZxllVZqEfxaQp+;k~lW3;B^DoBfo7?2f<@Tqh+@c7Cb* zJHV)moU?BI8mTq9ebs)WRamLj-0@cymN{NAWs{N`OZM?~JE{W-13`Q&+&CP z|3j#P5dTTT*yF>+MfZlZhjr|zG7=iwgck*&1h??1PC0iyWjJ$5M$H?*vf)p8Oxy#M zkiv@7+5XJRJ^E^VGB|18eeFB0-E>4XHwUbFg*&$Mi!&R{hZ|P2NNwT92LB&MAB{@7@R?DF~V8P{556~)f)(M9B~yty;3zx!*5T*qf%6N{r7c@2vOp(#JJK_fDe6&UQaDHpW`L zg_+16;ij>y9hdZW9D`jIov4PNJ*5ch^Btr?HmtZe=PO{VmcYuf%{$mQX8fyhr#uax zsmO$;aGf!4j_B@krtxNlfF-EROS&U%MXDHfEAA(zrZ(;21t!%*AKo zZI`WEUVagS^JHQX7XB4u8^d~;TY@x%Y8|w63e!$A{I#vh7yXP2o)o#J9#xE6OX+xa z%{I<*M~AIrPVSM55o+zu6ML=cyqtmGEDTo*&C0Z)5Uy-`L}K)4aw_C_wcm6AHjqQ3 zg8yN|hMD<)5st!0&(8RN3BhGy!#A!3 zSdwr}l0J@6fI13e4!>T|6YVFt=$B3r9pi0hRFkqhVl;?;+B{~citfWm`vAa@p7tez z6cauENW`*OTWhT?>jHb&?LytLVMJ(&59nf6lZ?3tRVZ>E0XjuG`yIt9@-m6|Ilcf2 zP2EwFjK6Fa2Xl7GY#3CpEx8&h-@ey)C=R-iyfb7V5U63TDdxfF&0KEdQoz@;m}Y9coGYh9*W6VDloxoDIqFR(DYA{r6e~>j((g*8yiw? zwHYWWCX%-2 zTv5y8b2U=&q) zg2xbkI3byHScdutaXtdOnt?Jl$CICSg*UIQ#*lrN80nP)O3egd{cGzC(X{NptLhI* zY3t~rCGD-1Efwt!m!qPjL1~BIv<5C5%XH*Nd)|z17c(L7mifPdV#7Ok+n%d_vEYVM ziK!4E<;@vC!x_`$%~v==acZs?6=jQdvXAYk)L<7oN|Vi_K*!wx|he{pUavx}=+ zCU%H#Hw2A=qErmVQN}qs0~bJu7iVOoK{VJPiQC!=iPJ)^1uwRRaqg-^KA;*$i1|#^ zs+htse;i^?>Bm$nQG1JZqm}(Cv$7;>p<+q1J;VHt(uvqhB(FCZ2TQ}RSl4{Lyo~h8l?r5qSvl^_OZ4n3pC5TI{nmH1@ zZKyR@Cm;Dpeh;`%G2d5^`fxdxH&9AAUKG13J=ehmvw@{7p&1Yku&Q*K*}COhoYA;E1Y$|w|2K@*9 zj!VUZ(6Z1;K*)H!6ek*tvutM8#ZjI;bFS8EjzjbuM|JN*YE->4J*$>?>ewEq^Cw44 zJLCsi_+M^}7>Fr`ZZ143wM5|~Z}PadQo%m$X;10)8byZ0tb?!uW#NGfH@7N6)$$z$ z?e>&vnpVpWvex00%rt84Dvp#;+J<-e^ZhP#D^99K%RherD?P`kqth8k;vlJ7MB>Mx z_`IJFldaz!pSLcao{cDVLnA{UZiRA1a-PmEI!c=D-61U0995CM%e|>fJxeEcgnHv^ z%h>Dqe4pXQU!$eIuYiSAx$lQoJzu?^?Pa^4qlJ$*-|+#*H$ESC3wpG@TRxx5l<-zx zZ)bG9TVJK;n%{5F8{a-wU@)JL2eH0Pz^B_lQ_D4HNFfCFpui}Qd_V&?0@QBzR@z>z ziwIHp{sLfRIQ|-HsVi9{rm=;xIcH_CT`65jlU&)?-bWR4eBXeLm35VJozIP<3!%Ut zvS&G#KAC$|3bvD#U2?f$sRh;rNN{=V+cmvk#q#9t~xp+<&YHrKP= zR#H|nKJkjCZKd$Nr&lWi+pxxz4Jr%1B5~T{lrxS+;=DU>fk5ZtiLbjcL{sY`M(qJNarHRH!NGm zfpDGJuSYxh;7W(>4F9&PPJy+)4{!IAn$+EujcK|zKx6*K07Y5g1Vq0aMY85PTu$Jt z0glG5_sLF9-~>U#1R&|4!o%AeLc{YFH%j{`g~K1o1~qBN#g`BRMQD> z5eb>Kw*5!ZnP}$w$`Z|<*q09C$M0D?p~t0MY|1=cz&tZ_S+GlQ;&l}|ZRFR;qZ;Ja zOIDJPo2g{T+Pw)^4kZf()n7QORxmygLihsar)wX6m=TqaxXAtz-ExDn$H&vh^p!`U z7yxH&fOM=Ub5k%ORPe13x*Ov8g;Q<_XZ<>O)-UtPD<9x|z%mmfKnWCM10w1IK^(I? zC~hJg7@*|=4I<``@Gi{#g`)K;P1*>QyQ`BX{4+ZLk1C$GDy49_0-j*&7_8mzfT`4 zM*k*GVHj-!jB-tN#^gtpM;?n4cu#B}p`V!jYlS`Pc)}{FAxQCbBK#Zl6hRxuUkNl* zA2{pga(0NbVbi30jkHj&+!@vZW11J9pG>3+N-z3YUo4w@!F%Es{#c$=LYY)zVfQRZ zFBN9oJJuX-T`6&YoVj9Xf;FSoK7UWn`DMjQ!~Iie`Vvh{pphPE06~^JU_ne+CHIf4 z-yl!hup@%b1cET0KP0rU$I^2Ft}{TIZPMhsgSMf}<-l!%ONVLpw@FDGFPWk9@@t8j z()p#5X^*p`DSqQx8@Fkuy6h*{?sBh5S%+_FweLIA_i{PO(aqkD!^uvB=Y5!`d+&5b zg;oNH9Bey5Jm%WQ`*2O@&g3(r)xB*CWXv6;%QM{YJSJIkAEG`0vo|iF8Bh@M5HX3N zkN0aTB9}=P*hwf-v3zJm?~X`>dCvUM087>dR1tM%O(x)hIPMaSdm$Y>jM%RtZpH^m zpZy05gL427+fynW(nHbm_A!V#>$+20-6o72nZn#}AZ$|bH%Ovz$OcH+m_+_l!%97c z9-~K4ZWyB@kK}eb#QcQQaWSdkyG>C_h|M@$su58o(VG$1Rl|7gjPqK~$v_=XH6wwK zIDE$@QI6x|(x*sHSb1y$(x;+>x5oFDO7O>C~&i*6shPWv$oDLE2#*(*Hv7PgR53T+0`lJ>^|IL7a}rYa}{ll$gul z>4gyJ+-fmfbLl@h896^tK-~tQDMga+{H|!Q^|7kt;^xrUb-~UPiIrC1H$b9zvSH9g zZCeRoyJ>ejD%ybg4V;^aB*1E$LDXf@m{3M|>jkH6?Ew*!*tcUxZs!-N;tjDQAUk8R zX-n(~fq|m`Y?*h(3htUcwJP8~zsAokDgdUv2A*X;4?>&uljCcCw^yw1OotoM<7OXo zhrN3(D5nE{Bf@OenfJUSmS3L#9|-~`I)qi*n@@%1g)ioU76pJgubmOhH#4s z2-n=aL2uP~FGvUfM3*HS=(!kwGEAU1iw8pt zXZrm2A~N1rJCFMkt|Czjp>GF5kV0r)h#NBP1`Ya$^;Co_ySs<9iKG{?;%3bV%N&N%JDk2lNNBZEu?u+A5uqDo( zpyw`Zh3`V}1?-7WE*wxjqp#2>uDX>k$T@dn@&Zlez~<10seU5aN3h%XUZ>DWF>kh` z#`f;MppCI|;0}wee{>mQMzYgZmhc>x=oJtQ|}a+x01sGkN%|Uddq& zXbmH5EWi}(H8OWj`oHKv8+G?n{O6lT9bgLGVm?hyhsM_VZJS=oznPZ{VlI%>J^xYl zi}pLM9^*k!!7$1J1=#ZHp6qwUac(=?BZ}#xsKq zF0=2=2}Cw4RO|5NnX!wg@0FeYdoQ*G3OXg{eLJ;#Ht5st!<0r}6lI2DdCHh4TcM&u zx~dhW=Ro>7S+w$l6+13&R(p$8FN|(D{%UyME>O3iUGyH#*)4uK%~TKJGR~2YduX-o zqIbk1$}a3ZBx~>va9rVqvLB!;yV+J@0q$aL=+i58Ip|>L1IDgSd&BK8i2_@vkmTrO zCaG6GBQvxu=#V<0@Ymm--LL42`Iq)y<&H2$f7oWZ>Lxo{{`NL}4=BwJw{}~<@!neA zAb{ibpAwfsmmEaK;cq5Bd92v&5V=Q)JhH901PjI0+ zLF~hRQA^69nK#~Oq1>9b*^aUg1p##L4Ydx~t8lyd;LkVRu zo2dTtubP5`vlm}o=BeNjj6(X*Q&M-Gpm4+b?8xH;##Z{rB!I6&#;9a}~r-=`h%=1{~Ku@ib%ujNup0y|>d z-OAmW*}2-{MM$X^Tk$*}w5BQ&-d<4gc2*9$dK9E|>YCxBe`G2&@N#r*XGiXAdl}9R z<`Fe#oR0qB$z3hGO+G)4T}`-m0Vam%IbFCSxCkm1d3)^HK@NG*kF=_ob8&%xroScw z2Hvi#y!PHayQk;7#PUgr6;>_pXov&+mEPc4D1`=IQdHa=qIM0#2*?7wj9*K^j zhS=BzG53^urB{mVB~J^z+dV$7pRJEiOJgM;a^KH8Z084jcCr0&lNvuW{tGsb+sBiZ z*{5{Sk4+aMnGGsto7|bEN8tsueVGjeMjNV;rf7tP7DDL_3VNIP?WQIEg=KmfEnHR` zo8_h@r3F=HnauRe5x5eWYZ)yzMjNn^rbn0sRSfCOyG&N)5{((=`!v=i`syMUn-;_M zps}X42n&`di{b_gmIe#VrKW<@M%EING-4xgn<-Th@2`haJ>O5jmDRi6cC-ISyNSyJ zAjG1|2J3GI>t+c@l?9@eW>(s9Ye{sgMXHEQr*2NwGt!wZ z6>CjOqb0cMj8}e#Gi?N+eB@OySNa#rT^sF^KWMkuFjwjKie3$gi1hcZr@0vmR7C15 zL9POCqL=Bb^|7CeVbnKy1|S^p2T(-yD;|OfUKlTo8^N6dK!PAZgh+xSV2DV9Ay9xw zf+MhxNJ8+#!%jjXV2DIQAy9xsLM^b5L_#k>giOMmKYZ-->yvw>scaige|GsH+b{kU z9Lg^41suvg4iW;&Ar1oq$}x@t0_txZI|P(doOmb!AYd$#h%SN~N=FpY5m zq;!h-@c*rHGxi#?I3Vs};_VVNFgzCB%9Y!W$!y&^uwf85jajjw(bxJjckeCt!gKJP zM28Y6$Z+a0Pw+2TQ@#xB|0vR{!b9(*q1YZZLL#|UpkQ42|Eh%48mx9EvEs=u{RZGD zF8%f>%nZ1vH85R4@SZs?eAd!>q(TQK%k6v7bDjs-kmsYvf)Ik*$j-sxIOiG-AMSp~Z0#qp_7T%kIW z6a6a>>q2)3C|GqzG+C~)Fv1v@TphywWxrr*9)8X*%#B)KdYiHUC!FMt_=?ITt~i{a zdsnlGN&l>&RVvCt0Uw;jV-juHEI7kkVL{%$-mLxUPWQ051AQ4hg4=0xLtrNykd4l9 z;agxJm8KZX?s@48C;M63hWo1z8PQ!=*h2)OJO~G8p>j~kmbw#VZ!Rb7_MT`{igQd5 zWdHQaN%83ci)j~n4;6n-?MMqzcnn5XhH(!CRD zeLeg|M~~-hlHB`q2zLp7CL18XX2Nmu^f>sGa4&lJic))tvF*<80*8Mr@}hAPmbsS< z{m=cGzDqf@!9_IJ(7qflTRF5wCDc<0oX=)VRn-<&0}d8*W|eN8r#R%m`a)K%@W&Wx zzyFZd!?-g}kMX=dx#Y5s)h&P5`f71BkvAc3l?!^l#gJcO9+X3FMnb|r$NlL{{4d3d zxxqDdA>+xrRB>T@i@1Vo<^*JcW=@)l3V{|cwe`A5FvexJmmIZ$t2%BcGOaqU8Lph} zllM47c9}3csatk}hddI27XP0%ZK?bqp5=CCFWux9Uu-15`Tqb=v$C`QpYS_T3u`A6 zM>@JEv0siZG(mhuoU>ew}4;*jBwZ3DOr}e3)hmW@x*Y?|;muLIN zE;M#_wDkVV!l0d)_3}FaLGj&3Jq;YM!f3-C9$b#UPe@iDiz=Q8wY;^yLWWu^7={{3KdVek6- z*uL#^<@W2%<;&xRj4zw_(zo+tNA9Hb^TX@I>E#%`bLD%}*WLZq`@0K&2X0}y)76nJ zap&O7!q?l~ZF3fWRPKFxi}|aIYxD8$WNX^T>n+kNhwPHq%j@HL@b$Q+NH@f%#enR5 z&Lf|jFq6DYFw#7S03K{C4^m}5B-JnVmk32|K^B2Am`1-;zZ4-8abtw3P-CJLd8#aJ zwsu*qqMimJyv@I=OlGMdBISH&XYzAI!R1=US8L(6CfTA0Yk}jq>WRjmQXHAeNa}9U z9vN|dk!XBRqTw1j2Bu(NU_U-wLeWWDUBDgQfS%5bF4S1CHfKGC)qqBT{HU^s>{Oo5 zzGQY!NjEb&*+mF5HZ~Q%rai~ZTM$1G3U02%uJ=2&7R=pPfcSr>}#Y%C`2Ua1V`zd4KY!rfu9!c z6Y`;l3u)r4rt>2>nXeuG-)6+{JfXTnl>8Cd>6S(n_XXP-N_Kw?E<*xLl;AZzM|jIvxY|+)Qj@v`L`%4 zIYdU}tXINJ9vi3C9OkGjGAHUG;HZfAJIaH3(CJ}k)-8hPww30L{yHc6Oeb^BgRmVF zC%NeKKY20dz6~{%!m&TXU$oqw29K3SttgZu?0B! z(0>9LMn&v6R3B56qymtJ4pqrk(q=}Suol+RX6`I094Cg;`bI!wyg@DYN2OBCg+^qp zFNKYenOXf=jBzouZ=8InrRS?kYa7luGi#8#k-HW3N_!?mudNSDY7;rnE{x?7gDb0q z0BcA?Gj?DyGqspQ3)_^u?eHBvvgcK`i4$AO?U|M5elW~sxw4um>O?lEDA~-5FZ&YC88RyLc~lo zr*l1ie7Yt&t7=nFf2jOk@sqvdPPN2#VKMrd?UHtOA{X2J{l=TSC--jmj-QUrqy1lZ z^mR32guJMdUE}lxO-0D0)?#iwZEw1^&(-U}XwE3z$-R%)f}G%+%n9Ir^4{V5K&>!! zVRBf~_Z#Gm5&z(S9QHW=H^Uwi{eL3@(3zKt45UZ+wcFWCG)gOV7hi!QT(%w%>MgIe zYLyXXn>T{+IOp5TspPTBA4F$LmL8?ItYY&p^kK&~22Qs8lg1@#@RFns+iBg+U??eN zLFpyAyDmr12lD-ohyItGQdZ=CcYmE|TD;xt+_dXn%gW>*>9l~9Cp|ng^#>;%mRN^? z9@eYAhAE>dy@3bzc8Cp}Mf<>3=c~y-_Ulg8e`&C_EljO$<^t2zcaJzqV9o*@<>@sE z`=J*6Q^6+3G+Z=Aul*Iize2g7JDUM&?3+H?EfD=R6KcVKC}qV-DWMb;_#-5^{^c~0 z<4QpM3s=tn7bbjCj5GX4Dni2$uh5OZpz}6Nn1dq+j~vWWq6O`>%9O_SYOzwm(Z$xC z*_yn?$eY7vcgcZkl?D0)e_bc_^?$NG2mSxb_Dl@_?VO@_hE{EMGh)ciJ=GJbN-zM| zD@mTjb0kHPq8h91Oh+7z8Fg)K9SZ&9-J^RpAVC>cF%s{RV>JiUv!^+C{jaaj_wnG? zLN8yB=i@$L?|PK&xfY-9X6F;|a_;y%cvQ;vEcbM9{g|nSZ(H>3`}lM;m{|I>k_x}m zZDn%w;sIyn!RF$1tzht3WV9t$J_tG~4;pnW5Bjx0*GzBG+MS5e zJd_NjX0ZjC62b8uoWm*X2{vL5j+BBQbs|mxEWzxmFIB0hDX2TDJID-kmNCbKdvc0; zY6^r?1k4l66Sh4>d$2LYEIR#)6*(I>8<&sE$Hj}m%fS@Rl+y~M%3ybLD0Q4x#>K+W z&M;QVLAKZdZieGQhSNKB1}_bhrIFm?&RE_b$I!HAT9}+`m5CFEbB)w2wL{2gj(1|<)ga5RFG3ae@?tXP0r2Si#qA9&n~D~>Cki;Sf9N_a9nCGQi5P!Q2lKIAZx z!;zNbreKXQP@1`=vb*Q1fejcXU!CBU!x7Cy1LF}zrAc|@+@>lrLzNkeDZGEaZmxa~ zbFguK{-4b7zAEa|j^$8w2{md4tER|}T_fgB>(xQQztWh38=T=yM&mf`EeSw7toR<6 z>!Hh`%Sg<|YEV;@J6-{kP!!k*FdF1e`n&|uEKVNu9ws(7lOxG1HEjh%5FM&s68EP( zpo%e-5Lsl6%McOujQbp%P%Zv|KXziOC0r8)(`Y2kpucW6io=Lj3RMso~r2s`+nXvj)`QKVi!=_xa$p+N1Qh%4^BNQryP(v$ulW`NtA){l~ zYI^)d6sA!K&mi8rV*_0$({Yr$-{B)~dij6>1Oo<2pbLVtfI=&U(9~wSJN>=>aliCF zweX0#r~Va$6@1m_E;C4}J3ATf$QM z_=Y=)>TXQlkCMbwp?FR-ICia2dr0b25ZO>rgR?`6VSQB%^b>FnwDj0{W+Of2I08CZ_E90@IP zP2mN~6p|LZYkf?t9Z?(7O?A!xSrZCm5)SQSdp4fwHUhB{A>;eAg#U&nZ zvXsi4>d8P{_yMu{tON4;%?DszO=n3PtGS@VRtNVv3un%15pv}`P-hAuK&L}J2D;RN zApQVNxco|5? zG!uPZKHHAUsaitX+Iq|qHTY%3^id!;EKs| zC+~@4Nna7x9M!ro1a_%T1kPEZcRDMsY9V}86c!to!^Nk}vRbXq#jwnhhVtiw4nnI~ zwl@XH&D(wA^fl_YWJ6_Ik_h)2VongKTNL=ENq-vvxGnG}0w(!f^FCdz`#} zcscGwS{vt6*loh+Q(i1y_FoLu?Wr;T)2kc~&G?&v%(91$ab$tChvSrDa!f0+J$vXf zD(&!~U*%3V9064J0HG>tqt9+1hj`C&A!h5JPl(%t#X3%!Esr|RaH(mRBQ>=%7!WU_2d zhrio-^OS_EaA?7x5PCjF81QqDWjz!A%+I$$p$LCLfcJBW1c$ z{vIoqZRvlg*u^R7>7r=X^-~dba{M0-=n@Y^CTym5Ek`5M!PF4C#dYcG=q_-_LC#hW z*2A%E!E0g1QtQ@wDDS5p&B)G>Q2-8njou00bMimra%J)2raiwN1L^@FZ-nO}^1A{^ zld(Kt3x#k90gm}`e>6B|hvd|#;Gp0rFt{fByl`S_9D|7;cdM@Z=S2}|k?<1rQXy-i zE51pYH7#U~(mzMT#-uqtvdb~vETAX_8%+Ex0V+~bUAs`ID0{5PmekpTJ9^|V;xg<- z67Tw)$W)QEnfHPgO8##P5%<&c8X+~;Ez}cn z)N^GR(GvyGu;Nzqim7BH=7wnb!GGJgO#EVX?-~pnLd8z!uHOL6InWhmFE_fXVI#j%9_>%5pn|!Oak5HnfXraCl6@ zrqdg~x@bpq-P=7tdZIm=c(JN+W!yaTMt1QRuPhOwLJ5YfS)XDs8{ftIl&i(=E#^u{ z?)nj6YHCQmGeSmkQ7D*2#>dI=Q*81Uz~APGHy(-a@u6S7l@Iezo-@?q2Ut;!Z)MlZ zFq!>jk=w%3g&*ao)lmq!^G)YKIc4%<`!UQI!Hu}zOL+BPYTz*# zn_<76TH|EmVtTI9@g4@nXo^IRow4PPgkD&y5u5+d>cT&A3XRcmc6p`*f&3Tym>e+L z0a3~b)#5F?VpV!aW4sPBKv;9El!@$5YPtewb$u6M0!xl)OO8em$^<#&L?)-hXRV zv%CINdHeAyw#t|D@oihG`>*nFYyZvbty|a?)A>z0pZ-36T*86hFM%7MMU3E&l^>n;?GH*j97Em~NuiGlkZ?5{I`~l8Sw8 zVqeZbKEHZ=Dd0ul{U+7!F5T9mgsP0Ve4f28W6$6Mu z>4bSDy58BBeup$ISJ^7!U4mz^74DLtz~%GA)*9`$I;$H9Wu;BH-6Vl( zxQMucJR_S-v^HIT37VYyxEgpj(oXLAZsF1 z$ulbcjHKZ@@&E(0hA@J?;{Ger79ay63R^;i#$kYQi_qyUcSUIuTrx`q^{54?*ELuT zmQNH@0#c@7h-Jn$aPQu^|3(Xjd~qI5uWz_-y-D>2c1>xoW?qgOVvmqS?D~3jVp9H( z>*v3q(EsNH|9`gp|84yw$o%KzBjolc0=tuX*lTG81ffa={w1=R=W3qRNUe-P*z>Gc zFS|`=gCBbK$eRp_$w%`FavOT+w<(+20N=SVIk=}&9pVVQRMayHX?e_m^lPGpF(fC!8=A{?~G9 z8}3CCHT)vxj(M233UKobNdtQUk?43hjj1UQOt71M#A!-}j0>c@oOn$#w=eRH-4OBk zFpOvJ!XTGxwLXO}IeSSk%0iOOAgamXDPTu~RP9|RcEIQIvE0w}NiDN)1Ai7fQNPORfSQaA%h1e!GG-k{BeH&!` z5CjN8x`BVHbgr|Zw3pL)uo~lNc;nu>?(f}lDVPQGR>y>siNpRE2!2JY%Kxa(e>n#J zFZ!_mZ}%}e3ELKd{P4lI-Vxo>6auE-Qv5+?gzDm27J{|WG39Yp4H=PL-p(UM=D@+W zTaG8}F&L$n%FEsKe9lV7YmpVI#UnNCXMn>1vCWM95e>8-;b$6Ik1O#Gt5L=n7aa~K3XYVgpE`g!N-)#5dMze*9v2I)_$E_=etRe)y4=3WBW9co=zsGkzcn}B@9UtF%g&)s z2Mfs%7*5xJ?6JzGr`wS#lgWbkLReb+d55fYT**ArZ+fg`S{Tq6xJo=-8+%{BlQkIw z!Mlj<&jpp$oLRO%8VI#Apxi6}3M-ttPFMMBy5e-TmpS3o|dA6c%1mHu%3zy;n zMG&kI$X$q)<}h18z%`H;QCrZP0%4lK4HEIm$w_C*1+o&u9ee!Q$;e@`MKHopQt)8} zml>$)$f)S|ukTTl`au)q!(9KpTLSWd=r>0)O{{=%kpvkuLA--MuLA-y4Ga?QL+K>J zWRF@FO9LP0+!REHw39cl6AUXkWWJ(=zeJ&s9ulD2fpDOa9%8N;a0;vJYB?J3lz9;1 zoiRBw=a~LclUuO$3f8i?;r%~q%l7~7ze>)APVRPp>4YSNMQv@I{==K47y7?gc^KK* znOOfjt|oPXX)CKCvGz!m@ku&{N0hBq%2(Vex%w zH*Q>IWUVaM_EapZ>3yBsR1_=cF7yatIs+j)XI@JpGy3jhqDZaCpFHuHI zR%YaB7Hs5kR(0f4DtgOjE>$lDE;TM)F7cHqEeBiJEpW0pT^u&`nM;j^JC4X*@Y*k2 zfh?j@Uo)HDEUcL;mC)YVE|l3fhR9&Dm|xXy?cp&x_Xo6B4-TTy>0-0SbR)4E%v9ZZ z82nhN{w$t+#y;x7bJ-jeX&f4wzRjjz?OM-dQ81CcyXNu`NVf;dY~`BV>=xGYWq$bf zyzh>fui2k$l^>4CY0_H{{5~6={`(?L+AmzI@N_zt=}OkP^OyXI& z^&AKMV~2^vq=FqJf>XCDg(3meSblSCJeYu$~+Cf8IRIxrm_FX#7V9W_@y z9=GSw%3f{ne?tT_9$6Myel448LG&ygt;d@4S4FkCT&_P@CZ7RTPxbV?zQ>-GR%i9( zx_sV0o-Z+0p=$Wr=buC~vAk`Dw%Oed=cey6Wo%oz%zMJmRTg;`yBFS_a-Z^^=ALF3 z)JkpTcH?{KynR3VpB~TA784hx7AF^`F(#RKC&_z;w;#He2_D5y>Zcyl!_(Cmp&Gmz zo-}$iN~-3nN;H5PR!ptOHd3ceKTU3Dds21czVSaLUMjC#IdB{Z9XXGk#?Mn0$xPK} z!m@@rq#Rm~vL-mP6B80s65|t-A1P0rW$k0KEGMe7H%VKCZoamz+d~~tuCc1Mn z2W>0TsyK~sQcTU}RPl0ma z+1p@b@esG%h)(bR7*KUgko&G)wStpgM0?(=Ig zL)f%8?+nxf>u?Ni2QGtcVSDGtTIVN3*W65zN=ZL6lUS}-p9C96rWZ2Vtbe>6JtNa; zbhKiu+_?te88`^*ljSO(tEZ~fntc{cgfj%=y3Q;kA~x^CR_)CzYhb}T)$KB;dV zYi*@>vA#E6J{x?SfApZsIQGu?PyH7`%|T^wlepV{_Pm8G;5ZnWoy=D1Vg_kpUh#Sy zg$EI+M7z-2os37yN(vFhEX8Iqv$;yX)0XNLjC?UxJ+=<-14ni<>AeOT!*xi1n9HAw zYDqg~b$Q=kk_40-N?EfrxToo_AJ0S1kxKA#`={TGM~>5bm|ka^rY=}6FRuL7Jx`Uh z7tLiqus^rX+94hdPliW7Mr&fL(|Q9H4F?7`pjPRcXd~30{sk;-=}2%r*cq zVz8G7&`vY8m7!ShHo+=)jS5(QkqQOA*D69__5H}K(B;m1^lRZn+rV>}qsXrIuNZWK z|A-%>7W&!zu-Eu%=HbSm3Ze`5yAY*}^MR+4s5FmT8W5IRTl&*ORe>#QRKjlf!*PQF zc?7c2EmrD*Xpr2^#eSa zt-N7)Ojx+33>UY|ayt;*pQ#MS_dpOeoERscxp!8)tk=s$MrmZVNPsw1`KjAU5@%=l z;Yyla-0Thh637NN0=|q~;LO8p=XoGMh5TbFK-uht=(?|sA|Cgof)<0G?aT8935l&)EJbi) zfvYyRAyn`IXE(MfNFrUK$m>LTkjsH><4ePN z<_Q2u``1Qkf;ac+ZgND%ggi{-kDu|6YUR;+5db@Mk>3n8V|rNoA;Rz?+JZm$+y!t1 zv%@(Z*b*CiXrYgcLl6b=t547jUmzH)F_3oq1`w*p7Ua;T$}pcYGUk_af*sipOc-m0JrM$WsE!`NSqo{> zw^>L2R1)@%7R{=h7mNe3*wEEX)p9PXjt^)evqAwJc5aJ0C=MG$tIIjCh8BrU^AnBn zjef3U7)85c?|3fFjdnoh$Tne66_bIF!IDONU!`Zp@S3#Y&%=7MEShhr*QSwRP)kBh z8K!h(=;KNNI^e!%BS0T;;P-d};P#Vd3U3~;E zoDH09q}n?L7232oa(_@0%u^mFtZkx5vE=`?nKEM8j?rz;dPXvnc4&Kxv+~T! zl2l_uFNHNmYVKc~+|%*+SB3WHov?>gEhUjYB4MziYgxV}T=UuRI3!`)w4ykr6tZTk zL%HOkxov~y@XJE6dz;KAmIZePVKHlP2e4#9{0~y%tMRCI5 z#j*f0Ke@nkLF*=+oc|KBVVNIHunKA4TGTT&U>(w;_v&* z3t+?QL9hb`-;{~6fNvWBM*;7%3b6V=T4S3-x&Ul%uNe$-%@&H6?;P756mx~B@~JQ#D*IOS z{3E_13C|10{JAx}bN}P9G>F!vOvQ5+y%a*GE>82U$cOCyTi&YFUI0<`_=>zSM#< zaVNTHaY@_*iXJpj4&sfQOpkFu6jvp-h^MHZ%Vx3fd7IZ9c7W{Tw%_`3Qfs6#>#Mm- z!mmV2|HK8|&S6=L2d)A&H@MooX$FQfAI{~l4(I%?lwG0DwRBmM1m~a+V+j)zEqgyn z^he(n?JiAuk@VJI{HC@!8-(|^{}ZMk(kywIXZGDzuvTMDwVqtYm1*gZ+94Dyi5J0M zyN6v2aL(XN3=8Qf$Ef)}@%|!4q~=nh9j;f_p$Ji6nPNH-*a?3DR`V9zUibSo(;-o( zTwYtIWq18OVAaLw)S|=f>~XKgpzfeugESL8^{)vB`is8-vvQ|szV$WKa?zo2Cf3#n z!lh@8*=b9Lm!=%=&8Li?<;pkBCSFDz)ad4iAqqE%bBp;Ikpp8B@#+sqMW5Yt_biml z>8;MUs2o~Gjnj9^)d%yuTh?K9wCH4D5a%2VdXyp^^F*aNBbk-mObJmPvphZ4h*Dna zaHK~>DK9e)kW8uV@vQ+XsGjI_?3^7_*$r0hI?vaz%vMR6GYnc@YUT?%hC5e&3tT!I z?iWbtIQu820-@Bc&TPI7(?zKP8f4L|wjBTOv@y3W5xf0{tZG>6fUIVI$B~jv9$BI& zB)|d?mFgj^-{pyE@CcZTj$d1JB#@2D6jU?lI2x(Q?vOV38=wLwzRo zh)ch2XMRjuXKa^Lp|z#AB0#hiedfvpo)uo*( zphdEyuVtfoZxT-HBJE&MS?NxKHLQdY2w_$2uqvchjPDFlIZBLb#aG5%|8E? z6571anSfQJ5d~K9^8lPaDXVvNT)lCHB5=3C@zWz}02Yib%gvWtiRW4VMJtWW=4@8X zp<&{J$;lD|Q-xKMM}C>@BD%OAB+Z*!L@A5ddc$zXM2YgLI-ww8E}u9^fvV&hoRrO1n3Pi zYMZ3uItOsG0#JQVyqs`)nh`-f$ILr7^s}4OvPwxgV7F&_W6-)OMj)%RynEIZ`#cj` zRdyg6*?XXYj#>e6lPxxnZu4+TtyN(G{;pOBqrR9Ekr)Ju8@g{|)WbyE?M{qW*EjQf zSrB``8xtiqDk7d<7>alwn%LPC`UAzkk8h*U)iL~m6 zAd~9XC=U|ahGH1&``W1}W#h+?Fvo3h6$sB37-xKm^RJF#1M?4VkLHJ;D@oq=I4bla z^01;0HBSMBnQ;lge^=Tn?G_4be5t^)kcH()?OY1Gm!&njTGOtjf3kx4j1t_jRp&u1 zqvm_ST#RQ5;;)yqE!MV3<;^r-JoM8C^M0jGy@nnQUlfcOe_lF7EL zD~0W-Gf;cwdu!k>lIpC1%g|K&|oa3T1lV4Cz$64FE&;-QcI%14H;e)q76Dcz&>;qj>j2sym7eXj| zE3EZl&+L?@; z&{r|5V`VKfP-vP2sihVqGjAItfkXh!|wmN~EKGGGYA^GQ)rW|85Kl^m}1YlC4 zH*_Cuh7s@Ypx+g&w2`IkQIEHhpyRS#K?#_(m?JAj_E)1UMpKpd9#b7jO_g763L118 zh_6AHM+2-Q+aCj#oynjXqhVw(do-TxL0qJCyhPDqTOtUQ4InXb2)2r9yhXK;dY*dN zC$>kjYVib_-|UUl5*^EA-l#Pf4YaPy=^GT5lG{IkCOx+lz=g(nG3E=GT z4{_@A?6Y4Gc z$TqPzL{wN^Qb|{by4^s6d6y`?*=)U=A5ZGU3i3lEs`X8%+BR69qDh%IgU}{)S=pmx zsT;tE`elGWZ3Amtkl87*%`vDeu+0_HDkOX;-P1@3#`bk|`2ZBaH<^3-;l%U6B67fw zU;+?}znGc>ff-M94wpWlMY)1>tdKY{Sk)u2Epum~g;vfpQ8~q`$JqUe?pYX3aSGQ} zG>T-l!}jE=o?qjj>&QHwjn7c=4bI+0?$bO!23eC9Pll+OZQXJS#T7Q$RsQc#7a58& z2I^hY_c3n)m18!OAyUb-H=;~>5eUcp??b+C``qsnzC+#zAgV+_aMp;@*1%m~W*1q~ z$xjS1tUfGKe?jYlfoKcjRR$QeVWkxxIA;Np>{&zI45w9jpCBod_#vd3ru`%&lXb^x z9-a(^NHM*13YccSc(<^v4q@2v=7TdpXdWvj2W3L@JbjQ)Q@S#-W7+f&K~?o(4g!~% z{1o?r9xe}DX-NqlARN+fD7GN9^o@9iG~o1$P##H<@N>YP^O`@QC#kk6(>-BX70`tV zDtHUSQQlN>=`V~|LQyp|V2m%dtPy+|Xr9W&M#`8M;3%1bj<@cL0Q*Ne2UJ+^kOwCAq<0~8mT zJi~!WqMDE?tXhPIBvXVh@+$PKA*F$@ZCS@5K6uG&RhdBx%(gK(Y02mW1)E@@XbU`4 zkh)W=KwidodIG>38ODOCApX?pn=y31dqc{fvt_5reLW_|2+JN7#S2=OsG1uC&kQmJ4YKIje6Cn& znw!^m9d>wRLW{sd^^!-+RdZ}U-02uyHbatn@VrSY73~7pig2oU78->5$q}=;4cy<3 z7PwjiG&7=f5MTeXc?-RGm{fMg11c$5)$JhHv2*5vdAD<+X zg-p^^cjLPmC*HgmyQo}aWF?)#~PeOY@bcKM{y<(1d)w2A%@D1Hn zAm{k9QOItdx{VmS_4!B6)Nrh-mE71|pziQQ7KV|C{ZS_4Ca9^4qg;s|OW-FB<%?{l z2nevlQW%x4z$~c;HD+>$z)fN$r!8EqbH5eeOMChQbut8q_2Xy5K6?zke{Yr$S z{LLAQDwn#C3YTiA2eBSyVn~<(9(eb0X84z(lPY1AY+^jHqanhJ^|Yh82_o@C|IQY0 zbK<-o*$v;8TfE_Vs8iy#P#a)%z(YFv>?2Gxu_vuJZ7vfMcvdtbmht0+qX;wOBb`D) zjtFC(+o#u4!__2C=1ty+O1Ag&E;p?|Db&0ytedK)J(wA@IHu~#*l9uF7NZHyKUZFy6t4rq%agq-$>5gx=tZI=bcsyl|Qu8Ese(UgP%tb5bKkFqws&w6;`rzq}CEab^$+6dbu?z5UVXWDSbmR@}ZcO>LX{~ScLMJ+T$j8uf7 z@nI0tEs}qIW?9F&r#`nOyGvubOZyehe-Pj7>Xbmp)Ub{IVu+0wm0tM-Qu)?jb5-1% z!D#tz{M8}T>_>$MLfp68;#e2C^A%H`kwT;pldHtLgXQ^mXY?SK*gT*uc$Jt2(w~`g zgaA}c!a0A|Ic|&!#zFvS5rCxnE*#v3X0u@l5~deC=E-sGZP{?_vL4NrI_Z=I^(w@kw)pH4j z4JMAwq6vnEem+Gf<(_n#f!1TO%_gQ^!&ya4dl2*@Le;l?E@Z{(Zyq$JaV(>_oI8;i zuuEi@eBZaCpU6+jv!Nq7d}T6PPp4YG2?&J3%3&Ver|m*Vq&SuRiV^)lQ$^dqhcXz@ zIsRIQAwf3~v11K^yAq(Df!ur|)nnFX3z;EB29vzzt*@Dixu#>|Xw8eD5rK1P{j*M87fej;otrxj9wTd5p7Ja5hk74XW<&M+0w2^HqI^fSTs@hw#7VEsyc;rbYO z!uRB{U2Vf2Ayh4+S8xQjXnm8=pOej%tXBt&?FdjuA|>peWW7F0~};NdLq z_APZYY8H2b+%92ikDBc{^(`jJp8zxa37dKZor-6{pAW)lzR{a`^)2R%Xt-q!`|+`? z50W=Qst>dY50q*uPn0RP5_-T?QGirJHQ%9#RZTA6ppOzc>$C1Zl{Ess!QI95FQ^JG z&(4w(7VaaLSj8QsdyRj*YU6;|0y3CIAY*`pRd1ml2nj1A**}}?gK*2c89;i87dQa4 zTN}C>3#ObYI##q|<9jgTAafJFVfFpLwHV>`NNw9GX@jC0vhN0S2x+mY>E_HfHy$SX z^=Zi4Eth$~Zq@G$1ho`pP4PqQVMD%9Aig6K|8fLd_l;Wt!4fI#!dAbspkD*7#F#Db zQJS;)_YKcf<@%%D9RWcC+-4l8~F3gFl<{Azh@BA2+g3`k$Vi~A#nzZK|>eg#X{SWPTa=(3t@1)itEuEva6ur zmR-Ml9}GX?g@sK<6UUS<*C9Xm-Wc-8UO@w4Z$2qe_(Mgp0~{Q*!jWUe|I!kyEpTO1;2Pe{H!b&J~_Q(f6q&X5Vz*xdK9*Br)~tj+sq z4}jrDc$&oqqWUg@qex$n5I{9^@)w0etb>Z)369oPiyH-!n$>LS6u6y#ppq%sP;_qW zdhS4n%AM@XfCd`^0ZJxKOh3^xYlpp1njjW!yrvJOhHJq=O{KU-IWi%xOgADu6klO) zk-qD;g15uB=qw0XmfzOL|8_G*05qQ?!UAi+bykssp8LUuGwkSic$gjvimuyYM zSV29~R9C4Q7GNcT z|HRuPX`xCYQ)A7sw%$)RGT>V4(^oiMRPLDXb+L-ojQaxN!0rs+&tk{>08fj&)=%D= ztU>hbM=&F^Rg}-U@@-~sCS3Gd`HEb4(E#HeSI!ju`s<@W=ZsWG<`SHf#hw@y!;mxr zc!b_wf)3OV@1H%MO7_)x->O5B&-HiS;44@%Gkji7L1i!LSxlagmc&GuA{Y2ivAw&@X zt%Sd6O~EX(8j1r`?FIk`q`iABFwIsHwP~aRnWz_`lu_T(g(q>*N9?>d7KK%PN!Y#| zvShE+VojrhC>XL$0M-xYNE1~67vQsQcGpY~Y>3JG%~mO|#Ywa8RT0H)mckU>A|Zu^L)%|NI7$WEmk&w9$8nfg#@*)=FQoya_KyuY_6#n8Aw18F~F>%fk#Tv5<ZimEHrF{3+enU~kt{aQH}3+zbL*uQpLPi+Jy z0~&jL_gce&oV8Su3G^~D`6A4r@hHFXhHpp_P}>w&ZIsjjmv`^qu)oVrP6U6ItH5!%bqUmfs< zL)-@Nq~=1*3%#l3$#!QswlkH13a*u!NvTf;`mWQxa-bH#T3YZo%u9o`- z(`HidWd5`(=EtYeTq9p~v8x}H+i3=M8z6+nYUi=V4DVppBcTjXOWA!134)G-j&LXsQ;aQ|x1BR*<%BFIzSi%1 zVGlYZUR|%*)#4XEge~aCG{h6{k%+Ng+^Szq91yCP&VCUDdX7-GpUO)* zd3Eu!pKd1$c!}SVafAC#&Y<2TfQ?wa}DEr%E}+ z)p2GTG#7HIAf{4zk3MuKvcqe*N(Ju(1@2(elCjKzR9dX;+i9NBu*agtqVNS{PNCsJ zK1gINcVTP);bcfgTq}^JPj?2Zf;W$>nmbnGl%mp{7EZ%|fft{yFCx7dE)38idm$1F z%*{usPBx+{g4gPoZIMb3gEF^(LU~;?^)@3~r2_u8peLSpLpU0T(~o#-{F5!QJY&Vp zCJ=*SR0c@472QXsjNyupyepnwO@?&~@S&vnNM@=*Lk5+G@4j{fGbd)Ai!t>&o!-(D z5rnemxJ)2mANy)gd;*Cy7>~Y#-3sUl{-*l%$ChIUyL_(zU|7;qt9S))hBUr9eeBg9 z87R9S>DfWA1Y>*7UpZ3{;)K1_+O~bR!4wn39s}tg6T+fc|68noUAis;f;L7wJgHQB zh))>p$vpT(4Ex0az>$mDa;@)pfdqgo@hBxZp)&4>lDJ)}_z0D_9ZzCshP9?@cFMJy zXOgc&5Wr2R+$ng}eu00)gl;iF_vC8%xV5Uov!I|jc6m-k^CJ|qlS>c0NnY5T4wgdS<<^V>3_^*uC*>Dke*x;Xpfe!8X&Lbp1 z-4rkD2Q>O5_`ENN`{Ibrzi2c-yA0!-{dGsXCsva#Q|`3W?zCctt#NA}G3`3Y#=fM_ zu~ubjehSR3@x;wio+}8!{7=v$6~)H8J)7lCHAKraslC0_H6hh66+?+tM#Ig6N6Wy& zJ}Y7??kR5%KB_GXbL|VkxATZ(4J0n5Bsr1Z!GG*=Xi3+Kk=-B@`w01kp`zyIrh@@L z42OhT+Fs@Jno-QG#p;`RUj0;80##Y-8C6d-=#pQXf5e)OhQE2V-;nGNpbvNq(C;%6 zjl%NhVPft$5JpF|gxsU==eI}C+c6Sq|IE*;ts+l-j-3mA@jIFJ>vMUm5tAhBQ#T;R#-(zPIjC3v3& z;W0DMW&=vr#fO*-^KC$eRZ5iE2IJvUOfrrun)%4*2l5~DPwNRi{^5%(dI)8;N>Ulh z#kQ)2ZwbRKvyH;j&5OMPz}jpWOx>(Y_tTTuVRa`9QoxRFLe|*HupA^V{wqHY;7v}m znluCHAS6M@YRpOvkyNRKt$9W#X=V5<-`)X=c8E_92To87$qrNyZ0`Omi?)VfHeTkY zeX$pqQ&bKMt-MOli%v}f*^qif>5<<<;Nv#9uaEWyzdzSCt(QgLmVgAR<{&sQsRJvE zF32fYhpeHe0cg-w@Ccm13ms)7ars&F>@EOHP%V_UVtc_@4K;a2hb^ZW%GHEB#j2ny zh$meXOFBURVO_NAO^taCKpBFi*}u9ET#(xUbWX$mlFspIQC@;yn-Va*+_dv--hKIR z#yOOGD4lyKYXS4S%0Q>Fl%d207nsKK!V%w`?aq7}RLTO#RGc;e&~x|wAPj8g+!Yvy z30^@J7Q(9dr((O_aSA0-jr|MeGhc!Vp|KHFSk(o^YNL|(1nhoqhocfFqakZULK;jJ zu?Y}`9_*5t2yE6;UGhm+G!E7_r8jL}{9sIWxtk60@oV3%*ZEB6qWtn573a2vHuqP) zO6;?PC%=}N5iuv&<_%}XZ+&u+tnnpH3s^HOXFxsO+kmWt!-M9zCqbH!4xFS;bm+%6 zOhfj>bhz(d_HD*W&-Ev2rs#~d#Oz^~6#Kfz2K~|{Sc+uk!#|_FDSDFyeiDi(EmCZL zd;O~NpsxbOM2LBKH*tl10l_4t_f8}RB&Z6YO*5Ws{Nv^ zB4GOIV@P{S6Z}-*e?N5l1kMm-jz&PZ3k=}D+e`zX+VVU}VGU_8M|wkij`Spwzbvnoh<-)-sfmA?QY=I!ni_FJH=&r7$B4mywD;sCn^`{Iw;?{hQ>j{G&@f|M zr7-M#N3t0m7K--&9*bgu#rHNGy6e`_gQY6qc8VHX8IYwFV57p)22T?^q#Z0ptXUne zgG+iJ=&lXABy@Yg&&mg?!Jz{NrfXU-7Ov7@PsKo~b@KSW-QCoy!)zDAk&v3;0=pU( zxcxJxOSS*_tUKrAbU1tp=kKdKUE~F%OLN2y8ITm?C2xvNL{Ijk6lr$|wTEY^Uj0=X zv>{2Lz~oe9-s8ABfYUi5l9V4?&~OG&m&h9R)yd+A=(abBU|eG0tB=Vx@F9VJeG~2i>rmx&p%oOveXwkAz#^bc<`lS{aQJ2dFm{8oiJZ3(v^p)P$0jrtuOV` z=!=YL+E|TOO{CQCb->lz6$IcI^_j+lweMM@^((1MDxuF#+^;3Yn2gy>x*`vU3Q=@8 zvQDZBHiNAkl5a*}U7)LMc^0-=IVW^juhP9WHDQpMd2RCFNGlhXQ3uKTt8@kOv12^! zn9P#~X^({c)%&WAT?!il`?KaKA>r_(y|Yg$LDO_lC+b=iBSW6{-G83i)wO5~-P=5K z^=^X+mAMzhn}pgO^~ye1(3wX)=bAj7)^bEilO~IlFUneFK=x!C|B3pw2|%%;(=jA{ z9zqFYke*1SLiZ}WY2t*Q_OMWo0&=hpYmLcloua!FWv93zA7Q_3*eB07sN7L zXdQ4RPaJB9V)1KX4ny+`SS42nEP9_)B~B$%U{b?;uWFQnYz{?wZ*T=so2Hd~nRY20 z84LIW)Q*e*n1epE;h7d&##iU`?XZC@3*}9Vna45jsV{*4)}L$ibivdH%CRkP?@t!{ zEL}Y-^9O*ojh?qb+XlF{Vcz|haK`r0;PZs_2+`q)=tf2S1p*?aH ziXC#tD+KhP*B<%^AMP3rnlpPGF^0HuAIJN%`EJyBU*%ipy|4Go&-@Mv8`w@t3*OR*M(oNU@+Rq=n{?}V8F+xLUza2ymIQmK z5YtA9)*e|N%zv6#4>@FY31(GtCM5`ZgvTJ(@dG3apIQ;6YB*+S5k4!zd!9A}=RxMx zCQwrBWiCSYi$r`*1@qQ<_iFS!4ck@_+j!@!*4q(zWI5$upB)c*Wmz{Ce^xFvC(CwX zEb%sVyzO1X+8o=ugbI1UEm$5=3Rps7n?lf|!{0-4$Q|irGY(vXy$aVE%03=2+v07N z{VAjKhoh*b*hq5;)gS=%POzeX&1yg)>DWK;xP^Ifisd8EV1e7GJKs$7z@LA#28)r<<(@?m(hF-$bve*gWEtu+CT-h)9igeulY%*n5TJx{{)z~(jkbBUG|UdP;1#80 zS*2P7mWT()>;MF^|D@U+{LN>m55`r-VZppgMfp>q=kR#Ai!RI7xmj&!L5ju65aKnz z{TARHT+<~(v#L<>814dH%U?NMpUf1Tls)iWJ?JWOez$&EH@GOJ5g6;6O7IS@!{HQ7 z+5~}jo{9i2JNkH=L%}%IIul+$HHH6M>D$7UOd=~Rr=CdA_h5UlmKa`(bMTVb_H8wL zQQ~K!0LnDVr;Aq6UjOPB;x%-4 zkQ@;RIRTLAln7VcO!=61c8R=^sX6xJ<>OMl#XoQlDQz_odQ-&&!wEZZb z8;V(nZIRS4^g#fO%#s2$xzFL|zr_LsZz|jFS%K zBTq%Zwh25u_t^W=kmrBQEAWTC*e{aPKV<#Sj$Aq$se~ACRdj{CaV$wWrl9qQLa%|0 zmvZm$2C0*Mdm=Y&#bTVjP6sS+Vq&HP>1I&BgH&;Sdr0=BDX($&$Y&+^j-={v*%V9&=1YgSV0T%$}G_cQ@>tC*rcJ_1xflaYb8w|<;Z zOT7p~B>d6+%#SC138u@thogb{0LsU`od6IE5dO8O;r{;7;hy&?BhpxtPiLb9fRNk>gH_G-Gs_TYd)T(CD;?tQfi~e8p=H&yEKMQPfp$Z>11EYGjms&&-3UC429dCSsL>Y#@Hfi_ zq9KoRTq|()2jO}-gjp?ni*UKmwZdidwbj;NvNDx|Il&za-89wQV3_-)EJlI zH;A<^UJD{X(yFWdwe25qkHoT@3elKR6Cw zXB|M!U%Umdou_nr2CEn^Z{NW@SNO-JMfIA4wfNs!WNLRb)RrA{c`EEbR@f*g!hW;mbsJRC zhs7KBh+8Zhq*kL}oNdwo&zADhcI*#;3;l1YEd5^u^Eel#Qzh@QKNBsW1 zy@U15vKp7RT9;YjFq0IUmp)FhMxowwd$C+s6y-5EF9XPCWWkURbXRM9qiDEx()sit zmE9}sx)s=T{VIoJ^wrh!v53-`Gy{Sa%!BApWa0pVEAAwLQ85>&JeuS9r;bcA1$0lS zbzu>JW{ph-ARg}pdOBi+lti_6fta@a5FK8B1L)t8Mk12LWZ{I8p)FzC&J+Ckj@))8 z!4Qk-2_6^DUg8Hu#l+yaa`o)axeZD(p;jK?MER=BE2XaLEbMcx;~)a=0hXZ=lxM3( zJ234u)PHe3-X2=)Rup9HlYj%msMYaOg>dY8EIOqPWCnW3;K*yM{ug8K6r)QQcI~dW zd$n!bwr$(CZQJgrZQHhO+qUiA>ui5J`Szc`4yuxxN!7uuIdk8YF~;@tqYN0M6;vfm z_kMe`-3}c!+m(o(C4^Q8nGh9Ni6pmNZ>%V@3q3KzygCIs0dJAw&!slYtTti@ri!ph zi&*xaM@E8sGb2t-QilYG5;2X*OO-SECJ_gux=n$wo8cPQD{u&^Q~^L-W(a0h@iFm zw3)m_PNy{4;WM*u4tvc7%Gq7CW|<2nHt(H3O(|h+)?m_V_mIk|(U=^fzSMg%qqf85 zV39s{K{qYe!3Gx0uOd%$%IntOaBjH8ZI2+1X1=V{LS~X*YdD$aYlH7%F=TAmdY_GW z4gpd?FQW$7zi<6(HK$tNVTFrgQI3gvBbj;stUBzRCUc{Eoa-MeoEXeUKAho&!*F?o zZ`e=4(-W_-)MQHBWMc`h5jY`LQbvWGuvnWko@eV_Tf~kaKUrtnD&WH%TP?M%zKyeQ z(<64Q-q)jM2vtMiN5s$b{-RdEq~F><*FH5ga6r%Us?Gb3POLrP*qr!MGRoVfR zMmF-xtf~=Q+XnQ=$`y$yrGNESiWROm;jlyw=#Y_#b@1;?4~6Xzm6N}`N8Pk~x%9c~ z?mJy}-|y2M+8_%+NEl_z4FMJheo>R-?2ZA-=y8o>N?H_TuA^3GCs0O)zE?+5Y{89# z#^bSf*k#V*8OeIUsSYcMo9=?H3l~l=W32_rj=HzU|1D4lG82{Ivc~>9%W?`aFzUh* znseX9$=Rl@jbh8$!87BQ9RlIDp1@!(8R2pfp*pd%upH9AUqdix>ffoe{S9K->|O7$ z%LUl(h@t+B$a&zQHnI-0yE-3#rKJrj^hhdS%#UJDKMbaYaBx#LV4Cr-|#juC3!P(m7ryvZ_ z7eR*|(pRaW4c4J5LxiM6eb)g5lZQ-sdA{ZTrU}C!<$2y*{r6pH zs&s#g;_@_cyj8eo($Ka?&Maz>%rB*8{$5Uzz*8}-`QJNs)5k=H35y^K^T~lZ-w*B% zfDinw+sLX2q?D!w0mhzivg5)w&>rQ<0{=(__xJZtx*}4*aW(lwVRl&7__PGC(`xYN zaVJo)T_8lJ!Crat@W+`-_KNGy9w;ZQa@fr`?2M?S7p3GN`jPlNEeNqu58j7;=7xyv z%|4YTvD`6(6<}amHfbc{4Pm~BkL7CpQ6oi6874IK%onUSUmriz6|-xHoU_?*>OOW! zPMnXe@YkP#$#W!{!}Wcl-3Wtpiwq7mk3f3E74aiYwfnj!!CBL8>}UtCE&F=`eC8Qy z%)sZeRqXU`b6XPaUBm%vQ_Lpz9%XVkB+!T6>Mp)o1zGoWtuVb|+tyeve7Rx5E1#h; zksU;PIj;Yc61_I?l_`Z)kKwT>!2>kra=`*Vo$OgU7Gj6LvloY0cV;45L(4Bnp+sdk zTeU@R(IET3E_Qof^*gTQeAod+u*(9Z#v~?<362#w5L=PG+_|^baWfdyla^ea|&D-TC}mzSs4KShDXqob@)R3@_cFRTR37%>CZ2 z(3mM4S&CpI_eY6Aee|f{HRCM5;mBeLJN02ho}ZsVVs@iMhHTcXOFQ=7aiMA-0}4c5 zw2C<}T=Dk(_tt4wy(&{E{=HaS#^$H$M+&R&@`?}JLU~Nd?eZ_r5u#>Dbi>c@F2*O+ ze9j}j&BcODuz$#6Q@^qdh_!3cVy4e} z1d{u!zr$6gyRE`m<@_mYtWlKmq3l(ifsP?Yvv;A&0HfZ&BDpTOFMqT0Ia@Ye;)n_;-WZajtxCo-*~mxHOjsGHd;6 zS)ni?`ez|Ved5n?^EXxcRX0~Nsk>T(x_Z>1nzzoTbIo9bp7hv%eeZHBLZs`#6{q@6 z@j?h45r1^SSD<5HAv`vN!n5t}s}YfOC@tb6dj6IXJnPuzXwX|uwY_(H#_+h`46NhX zX50l|3E^dCT)%n3)5YG1z5Mkv%aoRgcRZ1&bmX*na6P)7d0&W`-R-=ffsGv&!K&XT z1@?2TWk<6DkHM#egjV!p9=n2f;$IJWjkqPK5_W^C_~}FRPS)CU!Exv1fc1^{E#lsx zrYxIjBrk(p&N)d@W1bzhEP+og(mR31WAJ#H%U6okmF9LK9w&wk`@q8^0Ems(26xD# zeKvp<&r8wn9X*%+-N8(?H+gKqB9$ie>zUBmba;MT;-T6-M?+GE*%deOZ?O^C@Vawv zDJ`;?k4PP+b7_}%VL20$6!iZEt=Rrk8?{$xz1EFQ8)E{~yqSk&=j1&>=~bsqy@x}A zeq-;w!T)ql^SL{xuY@-5mv>d0j*o-vJ_E(031_{2u#a!pfE%ai$2OlWr&*jIhKE;W zca-35{T_YJ#EZe`{INP3hw~d6ZUy5_$Q+d6RJPYG{uqAZUMtRF8y9bH^Vs5Ck-)Jt zoohHy*52_rQIo`D>+GQdxCE-`6|*KTsSa_;vy{&gm2SlN^&K=56^na&zetW6WzyIzn$goEZcy;0 z*_zmGsGbX6U5n_S#ZR0x+l72=#>(yb$iAdL0Fq)ebW$_~4XR*B`hlo0RVaG}+Fh4V z?E4|oY&M{OXKPwuX!5*6s4j87{XwX<-R*Ik2vE(r+LYTtuPf^M&Y8VY#UnMctP*iCMjRd?N6L(x{qjWJr^H~6{P z>JQ?YRl57Mmz>zfgXpc7-x-oU(^NU2CC&??!rUpTctsW^@BY}IX36uDd@tc}oj3Qx zFZ7!4?X>1fXvkWF=)!2^9O>a8Vg8e81oaQ<(Lbb!sUA_oJPN9cJ#Yp4_1M!-AoD@L zE>n}5#9NvX#84ZBm-$1zg{Hws?N_Q?5KC}ip>WL}iQkI+Sx+}oc?*>LTz@&?n!`?#8pLfPjTr_14%d(>Soc^?gd-TzFG0eI zt5zSy84G?HtUHW91wBd^ZK{%o4@POmMY}(P&v=^yPin*9GQ(~TN8&vWIy$1Cj)(gI zu9+SsT-g?c!E9k|)9Rc1KNvFtXlzv*GIMlwUrTS>1aE&oBRaqlk_1Q_Y{^c8RT(`T zf`!&iaa7C&lR2erYCUUf$vtG!`5h}&qr^Vl2A1}a6D;iDAZBeqjbd1MrFq7=DPiru zOut=9joqN(*n9G;`Lb)l41%6B_3p^h0!ERYk3 zqoiU&f@7gsUB$Kh(2Vfe7ln8qfl76S5!#SFq>u)D&Yq>t>=v=>6h<3v*xVgftNo{s zkcu-Vi!RP28~zxvGzs;wr$7r6i8l0rcz^I^+&d4ciIulY2uyL4?J1xz_B zB~?DHD0RN%8cz`NZ{>~}$MGKKa<5l|#12=imw(u!RNrYv02VrkN8n-mf5*%2ebZ|pZ49}!m45|5=${uu zXg)-2c~VkmiPkM~#O;#PS@3j5NY2cRWO$c_qeqD;EBk(3u%{CzdM33v8OR|cK!_bW zW+-;8?qBLd9t}n97jqldfkHNtDg)tc#pv7>dH5ecBgP^4peahnt7z$}EsT1~QJ#G* zd&$-c1E%iIs1O<8f6aBc6hlh(>Cu(Ykh`H!cNJl4HJPK+f!qcoZFo)yYMtxLx?x)7*NC%w;_1LahF*NhF&AUMza*0a0-_}gn zP*T@#?#?@2JU69Xo1D2{8}~(g!UI+l1H;%WQ#cZh)&|^vNew3q%V69wf1D%*u85=B z^u7{6?FecsxmUFN)|cx7cP{v{2Vt}8s6xfwx8a(KkCf$6%-LgX-GpccA_!3)c`7+r#LtOU2I>fk~$H}fHZa()fiDXXq<@_5S8Ae;~ZZTb{qhT&X1qu z=S^E#Y|Sr-0iB7BSNlX@gY$V{nL;4~S027-VZnb0ogRi&^;D|-))AN}C|>=D3Uwib zuKYuxBq?hOMUBT>(_1mO>0W3Iv!A}czhAtwWaEuq>s-4WPA5s}OuOlt(oijqU&3mYk5+2yNkJ2_=jp#Y*N%=CK3EmERwo z@U3ZrZdX_HU~Y}N#?M_`Z8xKWNd+HIeQ}k1;XcJ&l%j{WGuv|wy6S!+6|n+V#?bqx z(eyT#?3VgOW48Fw3UeK3t~WzuTF^2*0I!>U0)Cy#V)+;){MX-`jY;)P8{yuKd zW8dUJD!_s0Z$U^^@4X&Y5CUce9u#CjH2jO%wAX>slz;HV=oMT@2j!J7F%Adn)3idE zD#eke*dxM_GB0If{2I^q{EtRm)JK{0K2Y1TOvPZ8d>Ahk@`v zcsZD1QX%~#9i%hkOGu21Hk3G>m(~9mb2^9o5rXN*PB%$dlq;CQK!Xtp22K|?LRuVlQoPtZ&vFIicIeQRmlaK`mz!gNBdsfhHZ6DaH%TNVG(rb`^KK$jN&=>+t zLVqHV1x4p@v>=Sk3G>r--2^zzafK4}?=EWQ$;!%g>1lU8-K6QdES(y*o)+S%ts#Yx z)tg6ba%uk&>o(?bJF7jj;DCSqxiT>am{G1XNva%zr2Rqmu1We8qfBCpba^Q97yHgW zy4Dss$s-sy4pu9y_nA$P_G+TCz_@naJRH8KVv9|!hz&i4`+ekdj#Srs>nXsThP3fQ z8+$Y2B(a05DT3LU=juZ0%6qSwX}ZV{tB;-oz!lT<1{XdQle=ITjD_Pp>Rja;ajNrl zgPyFO+1kUMabFW=1k8(tW2jSugrHzAM{Hv9ooVYcNH0VVk2}BA&-QKDV~Uy5G}fu@ zu@PI_!uHS@!>RAg){MP?O!CfMo?1Ke>~{j=(RiAJTsAuvw#v@}bQJ5>0t}q)M9er| zFfe6e#OuMIxKybT8!E>aI|kz5Nf5Xr{!TQBmW9Rz92>^SCsk@0#l(wBW$6BD6ET}g z4{6tnn!mO?!LSHs@~wh*^ZOMTu3;MX#|w3_y%0pC;~=0*c+&RlnZo(F`ggH^+Q@>% zhY96|pviZ8+Q3n!>6n99$#?2^;Qp*+%uD8z_Myif%r2%4_wx!Ek5yqeF=i|Lb)!qw zdjXsDoqIpU#;z&*-nm8Xtq;T@4|Ew|cK|7d|5P&96!7?Xs)xNXKPTWxR)5$e-`EM@ zDK}R*7IIaZ_nmq{65(RQ3ZsA)>8w*myavsu()7Z}r?wZ6uVKPz+N42IaYNRKQ&!no zCgBuki)d;eOFtgd6$W_Pvx}Vg;%(N+y8OfuI$J5*g3U>u3t}vIl<&gpfu)X+&}RQD zaSC@?5WAMoS!2RMtpw%XXnz z34t9MMW;={&9C6zXA&xSt>l+)lvNbENwJ6DN-Y@IH2N8`%}b9nHaXcN7n}oCy`em} z<{=Wu%kyx!6K3YeLs0R}<`{5UvIq1=8^gU}n9Stm|MnC73PJ_;GfowO__+Q>{qkOf zTp@IfHqN?uXtIai6wr8J-CHA0grhH3(K#>oMY3D!MF*EDQebwmR$xB;oQFA>`4Q4a zCB}oUh8J)6Tl880ir-3%!20Jr8&mzw34l_B4-YJL*q_awC00CiI6K?^x}}ea1v|P1 zpIk;}u{(PXph`RDEgK)$yMt!%gD;Ds5J70^#Q?(T#|j!WNCHAp*7SvUwL){1uKGlr zozfFlyfKs)2pXV$6}t2zN3dcA^VeV; ztJ2R)!9)rYBwMi-k%UR3%!&?3oB4Y{HCUeS35_s$v~)ma{yb;Hc3#{BdgY7WgF==p z=Sp7Uc>=4YpBI~w#08mdK3gno`d3s7Rli0+L=HJ3RHaViXh@b>dl=haxLpu=ME&B2 zIR5RabUDp$>oXqWq(TXoB)h`!c6qH4FMM>{zGF5(K=toQcHB7r-cg-L95UxtvR0|%gA}? zYgD0H4NiA0C$6i-&|_|m$|e%2)6pgz>?MCS!388JXw^~hV^ZEZ#8f-cN*tPz9_mZj zuXw!^i{$4&vrhq4wj=hsq;Kj_`i@ANKBS|E=oxTrkwD(*N2qi%l1uN1Lz|v2W=2`V z)(zNdT)UFhtSaJdLeCyBC3cvACMUQvVE`mVW#OcsqP` zjgTRdraSrlK)Uu*hPL%)H(_|BC3;*eOl2G@B&)@ay zY(Jhkp%vwVyVZYIAPJitv#J!DA53*98+UVl-HRRlRJxrt!N{VEa*{;B7Mof&Iq-t? zitULrcmF&x1Wb`()%cezy!C-ygeB1Ue$mwrh`s~m*z+cJpDB$+0|e@c9Zf>nJ`Sh# zeO@%jo8{|bgLEgE=n4#Sqm z*A0lTva`+@CJlE}xWzSoOEbP=RnMs(@6Z4)oddq47_ui-1lu^72A*TH1NikZO$-A& zf(CV@?APCMOQ&O#2eO z9MHrxlG4rfK{l;^%2Uhp<{f<&$Q}*Pj**-pYp9NT@NXMS9FDudvYvr+Rge~y_Kj#v z`!b~O8uzSe)u(P6zR#T(>f~J>SXh(#(Kmh>-6i0_hrEWq zHNe<|X-S0+oUZuUbkO&our1F*+Xv{MSZ931;qPHYs7gEU?uX-ykYfrnx zi?D=A8EOn>hS+Ax=WwPL@U|vA^Ep3ZW|DK~O!J%`d3f?#HVk;6SL9bwHE2X-X)Zmy zV$}VyNmxif=#{#eJaK-Qb2Wi*r)$5IuQ@ke`}_7$pjKNRFbgIEGNBzC6*Zzn?7B0;?Vp ztE>X6bh+`IaI+X@0F*`e0>+M{g%a^pe*v{~%Cd&h^M~wi?9%UOiKk@Kdd>03q-(d9 zU{P+OaTlDiO<6S)BP&j~hKvUSbgAuDTQlt#RV)LP6J8Ap+;YGKUswAjD8OVe)JtH? zTZyW)j`RF2cI*tagLW_WMWJA20_zf&AhJcUS#>TL%2=FE#t7#}(Ah&$ys(TTY3fOn z5}s3>7On?bD13>VlUHu-{S`Vy1s&0(G-TxuTh#jtTunAS`b^!XB49JiE>loB?TMS%`Q(Ld*W>1SqW_th z)l)q&bpQJzNatw)61(ZVjntih2l@g40T9A5Xi>A`dk^&OAz{Ayrkzk5Czw^|G+V;1 zcMbW5QAMwDkyhQ(6GkbZya!nstS?HjP&U0h^*zx>2dTYJD%JjIsvq?A=ui66tT!Qtq#IBOgg{H$dTrq4$e#59(uq?Y zD|1#5(AR13LEwy7%tTgf4<@N)pRXg$0{n z>a@9ID04^xR6NZ~R`;H)sZtK?(~6f5+APPJzP_NJJQuP!AbTi2B*V~>dTq!ajV9p6 zm9l~#p%fzCy1~>&Yole*i!EEQoN}+9;fvUq-WI$l{R=mh<<0<`BA`^*MZi;MNebgc z*}+@yT-onIU}_@7&}q9!qvjN`3eu4Fdwcxnc3zhTjjEp#tO2fkn4>`_9u;z?P-mwo z5R6ZMEoHg$mXg-NTq*E&xw;s28t#(qi497jdL7&jj#Q9Tqg5cF#KFZJp>aJ8;GhL2 z6};Y!Y_CbMPjw6S&qy(0ol|qCQZja81)6z2JyGA}wR`RQqC+CiJDu}Fq9mr=ALXKDw5mQQ|<$=kERpBte z{|CZG zM2RSqFHXjppz75Q_u1i4B1Ch|N`;Pyp_?xJsOsp=u>RLt7S*x9mg3Kh}V zNFggsM1%AhVDt+?U=%)WPe)gWLA!#qcBEE$Z^2SOPUax{wlxaWb_qoq9j6%#DBRv# zS}e7_D(Vax@phb~4@c70zm_j3t~wQV194r3)N*`(PagQP_SK;gI`lTLuCA;_e1F2p z^hP+rI>l1Xy2Bz-+f^katUd6{H;PIrEH!7H`qz#RAWzF5QZ5YTmung4-Q{oJ+D^QF3*3;mgFB;$zT=#5`RVAIcy2bo<-W> zfUa1b!~QOKPJ#@L5JfoKcfqDF6F*`m{Zsvhp^W$-?iRZD(MlY6{riO$mzOz|=I6Dl zEBNTFCWbYHFJ~;&T8OMulD%HJwx?3R@||KIcX9xk5vApSz;s+7B1C%=(f&5AK~xB~ zpxs4ra^N9yV8L1_eV6Yo$pG%ou3lSuH6g`3WZ5G|*!@$0%y=nrqC-9(K`JFWrzTwr zYn1JNt|A7Fadi$L=DHJ98RLSQ<^T_rz=|Ezf1ZdOk4Qu$BPn;EE!8wgyhO?`b2=jI zZQkF=pnatmOsT?q3V}-^@c|F}#_b}&@fmoS2%w_&=(OU@@0?`mZ)OAD{f85`;pkL0 zAA}ZfD6(O3wS=>o)RLo6Y-eP@awDTq=rMghyc`FS|qsw%ta8bF*Edm7X~0)zerW<8qdvt}LYPOg6|93d|< zj3;z^lO;SAr3Oc!{RW4Jl;Sq8$Gq_h1X|x>Gxt0$oJfH8f`0A>e1lg~2s%`sA6xjs zSntmnk%J;Q8Nx;iz{mV5A?HJ8Ac-JElzePg*}s%2AT)|Ib*v;M5-CPD)P@R_<%5Z7 zWb4HgUGmk68QRst0k8kz@OowdwD0*zBE%tG=mWBRG%U60umPSKvR<0<9R&$5%=P)D zbW-D}^`%LEi?RPDp8wHs!zwdu|KK=F*$0+#L_l z)mh7i)bWs#-41O`yz#Yr#2b;W^rMiUeIRGKiL^t}+YiZ3d#M;lpKkn|Tv>@wd1 z_!^Vg@LPj$1-XR9r?Z(H0G~9LNJnDWWECH1T-%>uS6e)ksg0xA)WZz_l?tbA6@8qy zshQS+E1IRQV8Cba{8n@?q1pwuag|*o7ZPg=O)Z+KLuQ5s@e?gZxFN0TCwB`iqmN^0 z`e$wu_nfB%T>~bM1^3JHUNb=KX~`aj47nhY(m2}byb3b({xZ(jLe#*dTvpuKgWvZ) zU+Ds^Msel@fII@0c`h%7vxio*Cln}cIrlHrS<)s_tg}-3=asP~*g_n{1i!~lGlTWF zw%FoP)J>h4%F}po!8xainI@Ru%X3SAVgw0ZLZK!_eujE^o?S|~V@fPmJXN7+7HLdy z1dPnD+P$*kT|NHzQd_^K0eMZ@(*gDqcRyRoALxf!40{vAaBH!G6uyuyEQ8S;M7xvm zfFBAMYIgMX8jFk7Q2r|2>vhHqrFACzlm4y9q~%m{~N+HL2j6LI!r5+6kFl_+3od9oUX-*yjMr- z)(eq%@9r^ZXIvpS5U#j=CZa{S?vH#n4(m>e}e~(#_Ww2tK zV4@+x$*}?-=g+sB;qU@$kjR>QMfS@*4#}j`&=431u9wc0EJ7?>Y>5jd_JWBWN-c?_ zlO<6Qo4IYrT@)-i}GY zLAm3}?o75G_DQi1c6DRft14uv{In8h@gkdTp+lVh!<)0$Mp-q{j|V%I1Un(2ZTUaO zsH@LcyjYWj`Zm;{h$(!BDrO0td!&G7P1C#5vJc4ROH&Vq6Ao;{AOp}#;XpQlWO(Xn zh=s~c>JTfbPvEHxaq88o8tPON`G3fezU1j@LEn}W(xk|}clq@o`AA*2tb==Rzd#`I z>UR%=(UjHdh$2WGYl1;JKH1Fe+uiTxv6VmC^?gA@xOF^$s~FJbfHScvPIyw`xZbQ| z)!h)M$13qJP;`3=O^ci`>hrlX z@v2DvgZ71h1_opnIUQZ!7>rPZ&IvB|;LG=z+BlG;U3w~)tab{OHNaadBk{Zx$R|-kl{LKIfE>@4 zTJ{GJ@_~SFSI8=n`nHcM<5G75`n*2DZ*RTOh(22t?<>W?K5vAzt2TCswe`l)SCdMH z=k4kG_k3ey1!2T=rsXgNdQ4;xPZpolXmZFgbF!BmaXKh-U3Rml*D|ze38zIF_37n^ zP<>hUz<@7gY=h2C;_<)#6vt`AW;BSw0+~Hmra>vTVC%7w9{Q-yeisxxfjyBI7p=c| z9T&~_ewP=mq&m+#FTX3xsH#b`tsx=KGg~u~+^)6;1lfYEeQ}N}(2sthEN(w`EHxrL zuzxhLna7a^Lj}G_l?1kmBPxNVDgFwQ2z6$RJs3;hx76?fc(7t zqtfgE>g^s<68+D&*AO%MkUaF6kJ!9cnS79?IhCi_JGH$!0phT-&s zI5lgYhdwi6M*JOD9U3IaVrbmZ{IG7Rw|^6Ja0vm@zsWaN56%0=^6(J;)h+wr4R zVgAq$lhb-@e=BQhFm>751KgV3pB1f2qQkkKu6-Q*J3sA_&}jQj2@_Fmx(-iBoX?2r zB6MhDu9jEJU7F#bVxbv%bat*|(+nF?sEmm++kEFY|D>B2!=z-$NHP4z16o+%6#$8T@zeetulOrw+MZc?LTV>F(= zLoL?+RiRC6-Za+bSk6KM`?!Q*bp8VLWLGee3B7GfSr_;+J4tBp0--oerC^^v+EQ9( z9uy)DA~x%bY96#3yvUiuFCt$$m65QNDAmVX`?p7FG!B;s#b)kaI?E8ugCvYK>!q|%r~bo6#cEsM&lAjVrR+cmxcysG8TKbfH%XrHIJ7rv08gX0rn>5j3qiedYipbR)2YMZ z4-=W`6r2|mQ`|L27|{h>7?m%ngB$ja-TPy5n>MyjIr7Srw(<^ zJTfzK!U2I#!quO!VGaRVJP2aQX{`&jo0IERT!P5EVOCRZ*<5l%eFfc zGBWZu*~z@AYqByhkeCck<_wTvwcG43{>(&t#muDL1A3tuJ(cPBBG$qXg(9+?oBw3t zgEnE){DDq2Kd}vpFq0F8iKGWO#k0U6;3_V%4T=Z0o(G66{jbLvw~B@FW<*C=`=P3xJ0^G0x?5*MKP; zmuR}hI*)i1mvb{`MF(b;2C-c#^nj}(k%1Z$C-aU?QPyR)v);<{NP?v#yuL~wV2(dz zZU~egl%K#5;F`-O*B00h!f_{Z*;At}%Ll$qGsSxP&@|Wc!!%nkCOO6!ltu-1Gam%P z8E@=x^!kLFs$hSOWdk9lPo)gC2SnBb{*J& zM$gw(Md;|F;v|$!m{zo)9c{U|&lBV}xfEzjAcgNmKYc9GgfC^OE74L+nZ4K!uyb#u?y3oh z@)jYjW1!|%0)wO#ck|rM!}a8=4_9u;*bf_Bv*q@53QjOoL`GEYD^e2tXEDpKr``A;OLt@UfVh^k_o%ze4-7n(JaE9A$GY< zN4!b9_)oyfU;`9AMWC~(YIP!hxq>gPVkvM-5$x-JGf%201}PH-1+=jJhIk`x_Z1NB z9jN+v-F}*G*D%osI#tTI`%a3^P4Ocz=lNjvRbqS!`x{F&q0Z-Pb9751{7ME%6Hw$ZLCsDyev`Txf#PG0{a#y){hpR zi1g`}N{{_(kBBpM>m?+L%2YtgSH)4TP;hU`R5TF}t^b^)I5pSpuq^l%;C%!+Qy@7y z9UdJml+5c@=3n8A)$40(nc_@|tIRVC(cEDbm-G``u3XvK2Y1PcugY27TVYmEkyI{0 zMeBLo7dUcD8_9yqQ-_v*HKMl?KfWy8=;B#d1>F0ue9b0{So8pD+JULqPSUA>sf6k0 z;K>HQ3`{2y6`d&XW&IZAdwH}p?rcRp-}J!&7vB z8VbRJeM7Ayj?^-4L;5i>Gk^qRm0sv48b6N}TU@Q?D*2ESp`29?EV$6GCKINZ$2z=n>-!IFa*Zq)-IH}9dU^)Umr#l00G@ts_jeFqGv+(L ztc!b(lysL_C<~3xcWX8XZ1k2RJ2}}^NG2AFvF1p3q9e?*A=)-a79v3SWHv_5*Qd)x zr2Tu=Jg1~M-Zz#$&MzEc4_)p@nI>WoT)u=kHGN!jY^mXo2HZOSy7{{Dy0=Dxb>&t3 zRrFQGRnJv()r_?1N|u|ddrR`T@yuJT9#c|R)Kfjpx4YPQrzD=v*(fE+Evb+5fS-+J z$%@4VGUyR&UJJ;(ZwSy*CW_3ju5qh-r@_NZjMj1Antu=tedgl5MifowaG0@= zB-Z2)g=1aQe^i@jV!le`y13sm^Ul=;B)lxqdp{oO3nMSykzG?IQ>=#z0wIAvlTYfi z#YK0kiul-mx0b*;E&70*P`Xx*te@Icvkl`7Q(hJFyWH7cYj@X~ldS9ZNyy=LrvoP5 zas)-GOiO7ZS6dbG8#@^r_YQY2Av-c_6Y`6emRi{B5z%Q_qANPTA3tub4ipgrFen9h z)Hg%>wU=5vl{J2;&B$Fvl*o&q659`-|6U4XMqXff<-a`c8sT|c&7}Oa+^_rv71G*k z_bCRtJ8(K|QV(;l*JtMV92;o3yv6g&*c)}`m+)Je{`&axJhcR@wAAig4V}atQ)LVw zaru&l9kTr=uqi+HT)v6WWXL7*-BE90g=KE4l@=?r%k7(&fByR)jZE|X|B66l|9=sP z|NnSPCPv2pi8{Pa;&B|phYl&O7AIq*=+bd4#D;Lw+7S7`W&sKyx?_~sfAHbL%{;!% zCj)^0`TrcifSncRCSgBGculD&RR^CT<2XQXLGVT@ZQ_t`;>Y_B)dAk3QZm+~#Frpp z4N5FLw@`RHv;z?xdnTm%S+j^0Q+8)}3&YCyjH9`VNt`)uGp_~1Bo$q$&7pAI%;y@# zU$XecsGBA&E3Q*1yrQa*j;1zJ$vFF>q|nke^Bo7wYj_Sb|LH@hm`}qGZdbK{-TL6t z7ESG`Hu&?DUt~yYS7TsFQOAW8rW@L*%3k&rKn-I~3Nc)}9>%Tq%lN2MHu8$T3(VI- zgDrg^3tO=5B6gBQMuWrwZ+GW~xL?i~o=Mx^38Uia!*^ps2_Lpf!Rq=lph+2&4Vy+c zE_NC|7;e1s|79ZB=>M-+&*x`GWhv{#-;?4gIf={2zE=X%kyBXLAO8MrI~@ zmj46Rl9ip6{(rvWTHDJRTg~J5X6mX2w{rBNIl+}Ajya)fw1!%0g($_i)>SRRW<7y= z-GB|wObu=lbP}QAkev=uTs#PoJs>n`AwG1};+!BrBOM+Ih@qC>(>+Nr!0`j@`dngh z^gMs5cy3Yrdz;IxSVzMV8~?P)*(@!4ck8xu_tV#H#1&suxZN4Ae2JB{z3^N2b)F-- z%b$wX=cdZ{O{wPA@tEsWcH7}=+0L0;KpCB2!uMjx+Pmb3 zYWJ5xVVI7g_wp}j1KnwtwDNlBX$R7y*{qsMg)KK80VNKf%cXNy+pG)He5@S&@s}~L zuW$dn`W^iI&1YY2ZtUzVDjcr^Sxzn?BP=!b4DHuhgcq;0^J8xxE>?MD5RWA5T4PZk z5N7?&6?!uhaA7;E%CfS^yszX0<=+b8xBz?mXrQ9nnu^*QZn>hKiBM-lzbT6=lw*dP z?8$E$?A1f;0)k;!uSiw8MTIN_NUAtT8R1Ht38c!@^;tE#+8g!KYF*Wyaozqk0$CMb z{If7~x*6CDc{|0PVO&$_SG>B<^WGH~dzv|;(~LZ-@!d&W-Ap9I*V<{RdJzwYZA|?d zJFe^gi1#P8N~5RN%6t}&9u^PEx};I%MDGp>F`^&^9lUn&_b@T(&m$NFr_@pF=#kh< zDKVlFMZ8~cRFnCqCWhnkas~=Z#W8R?q(XV>Gq&{EC8N>rk^?5oXw2U7kEe7fO9=`P zAyWtOxZyyEVq#?JrAh)N2po>uOj%%ja*qlV)h&v zs6eObEw~x6bZCtt<;&isn}?}kMA~>8sgV<)aeYMD=wdQ82Vo{-sOgy5dCWJ!h*(NA z@v_?(fJ|o|lG1jYqU?zfKcoj3P?k6VotO1f zr@f}G*7h4sEUW(L3#m^eXOd0p7YO--fVDOZd5Im?&wrfE>(7 z)UbO5oq$MwAwXC`Va)hG@7!`<3bq(U8u>0)@GGqfx?TQqln4Ts_YF&1Ff_lVu6?Ah ziTFj`nHPjAJx+Lkoc;=L#N4x?Mcg2;Y>mH5kn~!^G&;gM`GZ_wVh<3mVf^=5fC=w7 z)hzEQ(DSPO!BLc!vP7SLj7S~`Gm1>IL31ihi@Oq(if@0ZF{N^AR{7U*FBi7cav!f3>n?8hau2U}b&${3 z&fo8=2j}PBi|Fg{mGo`&cKY9-mXBvH`5F#y8BN@|xhFL$BE>MF^)bul36on>8dn{z zn;`}CrIztx_$zu>yF6FepSU(G*)m=H|93&&eRgGp1K?X9t zB|mwkSebw6BNe}%IaAWA`5@hiAnkZ*8vUBow?76V(|Vo*r5RMshUcw| zDRs~$I^{eGc6j5t_v&ohlY`ue%a~H?vj^9ethZ}je5-oXgcW+{;Y+a^qC_#}u&y0T zd#05ApRa->QTtJ+P=W)T%Q6q$M&`L;iCP=5`BJ3pJ0=Ueg*Md;g!{A(&FW&hOGZ!4 zWIfCpdbTEFO2l=GX8qw@yR;S4K$JH&o!Nloi%vcmsvMO{F3Im$+PJ_j680mQ*<<`(`W=Qj_+GX@2fMYlY2k4Y zf9M&;+(Q8V+2O$cbHIVEKHC+VK0VN9{~MXLl+aEBt3z|*`e>rIC@%Jo zEWeGCAZ@HEs17y`>dXC8mBCh9YJaHxG3YQD~Z8^CZ0 zTqksGzS8Gc`{I*qw){K?uuu-qocN*)o5uXpb}b<61Khh?4J0?%`{K1bmi*H`IUwvG zob-weof83>dp=MOAz-~7uF~5bLkW7mvjLf3FI1yzxcyRNw>ZD|h<_v0d!lWBYPr!f znOPWnP!wrhk7?DwWGdZa>-Fu>or-0JOi>cOrnf(*1w$A0fhrAVjPxW zpj_Y_i#&?l7GGGu#f;A?ii~%rSU>-~er<~yyBb5)d+PZrq@bgqW5cduYa?v}!PvLq zp3LyW)m&S9eR`J{?56ca2h~0Fe$}$Xg_n-?<;k#Rr~7_eRY%+0bjLl(cXrSDSbrQxs`-um69@PKL$`mR|QtC<(_@K=nCRPifuO-%RpWU zW9Zl31>5AXR-R@;`C(iG(FL-@0+Ykl*|{+#DS36G#hP-Y2&=T5tfrc#rWDa-)30?i z(DvGT5yPyEths^$AC-b9TIq-fytpCM3WLYUR?Gy}dn> zQ!B(0&2LW*#<@ejDzV*$&E3^Ty*gR*vh!oG)I_!MU&s5+`K(e$`7h}^x91<=U7#<>;wQ&+Zv8l-lv)-{QEd7>o#^eBbLi)+5Eay8ws z!BmWeMc*(&=hb#2Z8dK>x-Hs|9>LPW^%_bB%ij8e;V~b__24s_l6O;k33<6? zD<>LsXY?mG;xlX}hmZ$$o*Wrmi9SPR3OU08-hIwWDx+aQjv01Bzk8~95PNh?d)&+g z)vDSqr46$F(F)sgxDQLcHhpRR>fb+Y7z=A4R^8=-g5t_bAd!wMmt;k6?Sz9SZfYRg zjRx1|lhwxjO0Pa2$DTP|`Kp+@86^-G7+f{mdbCX5_-K&QYa%dHM_BGg&5Ss?WFK`02WgOF9jwG@j+GL_$>n)OHb z98GSK?wZnj5cUCw1ghFu6UnM|*>Eid`rPP8AL$jF!fit!8v-boNn)0&)3N2vH|lT2 zrIfS|_PqPELLGpd6KUm2W@4ccPXIB8<;UFWB*F4YC6z=IGSZb}Ce-^^Tlvp%p&?gQ z5li_+0HYC@Fv#KWIwy7Opx(1P%f&687Xi|9^gpF7dHEg1O~x%f`n5&olj^z)DrZl& z6{Yqkhv-?+U4|RuuED1aTR41crO*AC61J{7m^O!4BwfS zBfBq`8ok>WHHJU6_ct5QOUsuF>f4sQww$M;*dOp6HI$O81Dj>eUMyYz9x|gMv}Ihg zH`Zq^ExTsUvCEi0D^@?fE|cHhG(GzFva|d6PZ(vr9}{vuPZei?Z@drVI<7qq<2>D= z&+i_XPoHL|`6?LE+Q;ERf`7IE#Gzu@o>0}v{yxQ))cJIj#!Yia6w$0X#9@QUiJBW; z_T_bd57)Ld-3@=A-t|2cByppptjBcyXob`t*9RIs)d+4(l#%%Ub0Qvl>zlU{N zZUMd53z$+aEn9Vc9X{Y^Rz1)b)@L~)GEet_>UUf&C+5`L;80@HSI*Ehl)@JU8j7Nr zc=MF*MnWlJ+^VbF55gQ`E($U1BK=(GOG_Uv59IC&g}W?UlRu&~_WW5mvZ*@%=kg@W z-eJ++`CTV>%O_r!;tcIOm$rk5juqA7=nMM$$0n>H#PiD>9c6?mKV8%il$CXq^wUv{ z!wi_al|vVd8xp;EGTTNCXhOb!2Vzn9O6KSM(|U<*#og|CTn|v_nd2{BJUjok8??6f2F;(dd6&_?W^y+a4yo zyeHN{zAt4|d;D49NzWH;X7la5GkR`%uy_Bi;QFC-r=UMF{8YkRbS=!(oybgMbTpZs zOk-y>J)X?`>5+-H3mJNQ%<%aJ3HO!N;|y+5Bb}0GA$MEw_S=rUvpwMq|3Q+=cU_OP zGu1#0LskT$J)gtmqvfUN#HBNm>;Vd~`+JIIF6ZHvnT_10(v)3_lkRe&YVo zNn{JXHuNR8rwLAi2+wlTa@X4DYUh8m4SzWE^XM7`QL5k}w#R=e(~Vmdo;r^h6kg0F zz9I+3NoozUXlg)AiC2_7rznuPGDPg~*Ntt>OmD)K(BemGHmal`w~}1H%+t_R_?Pl- zl^nAcc0t%Yfyh|ixIo?@k~j$Kv3VCesGgXh zOl{ASWXdd&DS4$15dNUVZ7IL+wVq^oM2zW9JLxTM0QxByj>8O;9HxEF)|XJ)A|1 zxKX;rPFR;E!;YJ>%5Uv1{!Mj0ZkfWCvHl<5gcrcm;%5mc1dEZ zpE7u)q{N1A4-$<=VqH=A+&?36nRniARN1L?F%MkLXBDXhgUD!M_as&+*L0CONRiZW zovc=np%o);Rlr@HBW_g!7O6q(BBwiNN<5vPmro?i0)yfzo+)?|nZV#Urs}0`K&q{q zFPSMCNqj;yT~ZydN-Sa}SwT!gq-<NMk|CjZeRYVf?x9>pV%1KvJ_Wo}`OreFN1nGV(E@p^d82CS0v%_{27c#z0GtX(@l^1{q_M{T z+dRKj71eQmEpK4_+mmLg#G6kt8naUa!9K(HawE9BF#7~Z*8a{PrL*g>SOa;btK5_4 zqcP7zP=u?N@N7^2z%I7;fOwnW`QCXuRDVtUWGt60iQZOQ4OajmS?rMd$Q#UKjIkoF zCD}Ti@Le{>tQ}M4o8OI_&Qs1aU@S0yU##KYNoynS4uSC59)?pwEUF8CIsvFF78#lZ zqz0QdBQWjg=7GxYE+Qt4$1|gjW2W8ea)6=T@Cr0KzLIwY_!|Fav99!!vf||dP@j{8 z=vqAZhJH&0^*u>uwoj&UMelNV`Wp1s3UdoIWV{O!H&}agqsiX7 zDVc3VSbm`A4C7UI-qz>J=Aqam>l?b~s`o1BNdSmRuw@>3$^r8fIBTelufrT{dShrU z;*{83!yLm5r;+4dfB4D?@sre#gpWJWGH!a$6_ikLmkXv`rXZGXhWYe}DSU3Dmsz^O zL--u&m88!#-OY(JsFQtGM&AlyrmD6TiRGn#pAN(vn#|e7!3OM&b+XAMN`HD+`B9tJ ziWkVYb;%=r80jx3B^NKujng{Bx(xqKu&%ua=CQ-SgVr3h_znImM64AP!**@bVChoz zQ7z=T925`KJaMp-I~aFPa;jtZUD;n}_67rEeMB;vY^t;p`gR~jv|u7j*pY?)fCYgA z@xHC}d_ycoTci$;zXu%MRMgv+H7N~FV6P@;;Kyp;RVyQfw`Wwx4!A3Xc95<(aSQqN zt*k8&AJmZv-!k()oyMo5w*kA-NnUi)fHkYp?lQ*;vUOD2Hy%9GdmQ8pEWtZ#jqfo~ zT|iE1yA5Gs-S`})cnKpe0ES%cra_e|agpq^BXmEzpprVgB8>aL3LcPm;>TO}|4uS$ z+5z@$F+R)@EoDX|{=&;=AS1X#%_0~%K_@v1alz$sklu1eoO~H9-JZ(a{$#_x$S?N# z@b9hW!-Pj*5qJMY`}MoGUaF(xQW|YW@ko9yQz)8W4D>Jaw^O^;8jY z>xv<6=*072Y`Lr)y-u_A-VqUwE-+YdmX7Sa`6VRsGLapw4(LkfK zPzfTBxg3=;7zKZBCU5kysIj#j!I6g2A*7|Ud^{(9C1HAao*L(E8`B7~id z?7Y($4wE5lHn7oISz5-5H#C0yneJ@+s_lb>?PwsIjn<}?Xo&e_^#KANR0NHze@CCWYxwp>bQFM-G)J7o!DX? zPZM(&1@_!;xeO*U&0C{s*z0u&-k&|;s4Q>TaqQ(V&**RdDwqQ29 z5f(#W*J?%N6%vRvMnKJNg`6!obY;1YxkjY~MMpmvWi3kpC+5_~4BF2?z3w<=sf#rW zQ!Aq*iS|N)#)h02dfPIIfP-rv6Zs8GCvthoaLlqudvO8J$JN|$-DmbA9-*_o#FFOr zDL;K(NT@Q3**r;AM9j%H+rHY}RAP9+y=L^RW~BwDjn^`6QL=~3bB zM$0J-_txpg6HiIs38g0NN8vk)5-h=S%u@?gT+^F#Tu@F(;>PJ3F!*>l88sZ^1 zr~|Lq%jAxiTWvypnR-+rm2sD(=4ASK`?gPSH|NAj=|a6D(HYP)SQ6)zZPQL+v?af1 zXq7xdVgD}Q?+L1}_!ot@qIpT-lzZAE(0ZWQR44f(aByx zgl{e+8K(P_NOdC^Ikt0gs}sQ)(=AacC@v;%BJo|(+(U#9pmFt&DDHrjIUdi7D*mx) z+wM`79czmlX)@$)y^K0Vwol&a29f3elObdNZ}wBs*}&;{?V%ME7ZS0xaZ>ti(+U1R zOc^s9J0sKoq{^Z^!PJn|8=leonTqF(t%CUhhWyy|{t%MnN3hof=%XNkN>x<+g-3DR z)OMa?uU1DM;xj1*13*YM=c5CIHhXgOSniQ2@O;_+@ZR}4a_>#cu2xho>Hkp4kw@U< z%vUJ0c!~*&`isTlXj7BBTh^cfozCRG{aDL>DZx7?T#lrz;%W^F0O&2$)ZWGFCba}GAkL0 zz@*V)em)ER7>8$tdy?BhW_3`UvHw`gG3Iq_isey60PICQKcHk-#V7bw$-PbS9IF=W=K3 z7xdblZZx4 zE47u)Ufn=yKYeg@&^mkr$(0yKf-BvP=gw!pVellp25|xrUtXeKyk5FqazB1Eelvk9 z9)q+=#v)~r-P~;Vg26mXk+sZ5dNZfB?0R>jp!v$YP2rZzgczlyXUa1@%sg5Nt+;M- zH-oq5dj&L2frrQo^iLE%dI2NJ=>p6M^axA|^a->o%nCFs%nS4j%vcE30O0^wUh^&y z8x&1I#;lqdjT^*O(6j(;pX^^MXtZJo`hE<2l~tlk1RKnz;q>8k5wwEPx;XoKdw=^p z`y%?~))}`+w?4PAR7)=-Dmqk*9CTew`~`f+{$IZp9uwy2^X#LHCCUofWM37rWxvWk zb-{WOljv!TgeE*o{pI&cNA;5i8WZiY_H<`XO8g6%<*iCj^)q#Jb%EuE$`kdP`tf?a zNRzR(<~5r&oVDl%P2-m7>&z`~P9jgY=gmv$wa^Ax{$*!^=l2d`{L5 zq7JSPOV}~{v9g4NH5sl%p~?Y_6x`6 zqs!^Fga+OdwduRe40a~b>9_aUXZ@s5W!z;qwU4|7!J5!-xDxKnZ@T@x&Cp0(5pJz7 zx?}ubQ@);Km8qrU>PhXS4(gYc&ELu9XnV3fF*VA3e0J#`m{HF89 z^S1Ti{qXewc4#}Xlifq<>-wGd`KuEB5Ob0W3 zlY)%CE%iKABLg%eBsC;MB!eWiIF&%Eu9&-6Kr#F*t!z?g3d7ObG0eTzy|t|uI$s4E zl{9i;5Zpe;O^k~~2c9;Zb#P;!n_inKqHUk>F736mR$aeBphn=Q->-kSe=oQLY6dMC zg_*`exv}EZV6G^?LbxVE2W^g^Efv{uNI8N#0uz~*>>v5IidXfk!QI#X7ThI zyt_9_`==sUq3|QR;f6SK&3NlYLYhJruq4ce;!|Kjwi2%cg(}VpmI!4}0gKmy7CR&| z3E_&c_SZ6*uJ9)W`4>`7p5c)ZtycKXTw+-Xh0~l0tbU7KQs+Jd)n8#3?EA|xty!ek zK7-zjWhMAeCh;Ccg+9&-J-B5({)?%SbDzTuVVnA_BRzesy_%MoM z1?z?KMCM9j7%}+KvPiNpcUn?h6JiNth2c`^pz+0U;*6&ARa^LK=II%1uUVKaRD4}MM-vK(1>S(x$DqT(qk zg%i^A&ZuYQq+6e2Eg6NLtn=I{umAA5%M);T<8VOd8?evZvmY(^J&0qs7sPHt3unaU zNpoJC2z@@ne3kcm!hzjl{WgeZBY~%h{lke$Q6bW0190N?coDr)fqO{3H)6Xf#dk&u zb>Zf3n9hEH&Uix}W%2Q=#KYpCcSrpIjC#cxVq^XJjdl?j!UzLVWBF-EciD|@JsFHZ z(Bq{-I1=(4$LLrYtccNdqM>&LLU@S?Ibsp&jEqni=3}BZMMZds3*O`8IY&!rjUHJT ziUH6WL!#J4eVmAS{}J$J6BsrbT?#R<_(vU#w*E8PL}s`KMt=zj0*#*qMqCaIvL?_s zHu}_K_~uEQjh1rbBUvUyG8`?GFq)@f7?bj`koDmZC%G6s^fr>fW-w++Q;_Nh5^Lov zZYEZIi8GHLYt%Ga*ERC^o0ctP!bHM&oPfS&WP--v$eKnT7v@i7025Az-=H;GIc4Nx z%;1TTW+-`lN#Zy@wi#!1t&O;rEtHM_z%|zC#?V8O){{BuD~&2e1VvPDN2qQ_63G!S z3^qDrasNPY|KM2fhOe&0mkgXh>~SB-`$il|btRs>O){|_Z#-wT28PHSCzKR>#G7!G zGa7+czt5z8CZYhOVslt>>^9jF=ZqR zzUG*634`a^FowHllmoPuBJ*5B0A@AnPv^jg2lf#cXnrWi>p&KYl`ZiPIG)h_(2UjL zk%65h0c!$pgfrnlbu_&Ba8TW$9*NyOEfYgZMwOt1Hh~d)EN$fQ($0Y;CG$dJdMM%H zYxE84-W2NoM8_eIq^&ktt5T9?I5raGPyx)roU`qcj|P`e^*D~Q=0QcW}EabTKrSRp#rh3DQdHsu*EeF7)3k`AL8h6+Qwl- z;Chbgykgp6 zB|e;GY$%wRjcvT95RNs0J4O5p)R?FA{eU>XwL)!7Dh1L4paBKpaogbMugtNSzOzDW zI5HqPB%v^01X$cY(S0kUyH{i)aD2Rj!g@*~4w3A7JgMYZg225KnR~ia_7dsLbo@!u z*u&nTJA*rYSm&y&&iUv>!eLTGCnQM?Y{Clj=mq}a6Zw5Hs(V9lr!&6oNkWUP_!^ml z3Be6&oU6!vH<~-HERPd0E=xSz(V^krw^X6=kJx+9Lq)o`#&j(Z48d z`3mgiN|8$CT1nEJNmDZv86y-MI20Q~Nm&WwHl^d&iR0bv<37dX-~JNV<@;Dlo1jU7 z1><`G<>#nn zS_Mir&lD{n6t0*_ANa~$808+G%1;|}<#);TC4>jq6Z_Oa`%Nq3X3EeqD_u_RGr$?$5q%cn25D$qda{(`};>{Bc!s~?2K0ZcjzaZOj&w{<>&28z0Vw0heZHo_kWr~coGQm5L;>Fii%bP zWFih{usH1YvOe@fTWWOCu;|T4Wv4OD?{xR`rhiT#>GGG;243URUgJ>4 zMXxhmvmat&w1kPdx+wvi<9}qi^<++Yt3zkrT)aaayy?!#+y3r}78Defox(sh3MUt% z`u|k?Ba_~16fx6NvWzqX8dI^ZT1b2eB(TBHlJL#tKAlMy~)i zvwF-ez&vMQ=S^TE^zj%RAlsF$yn+&xdzl83kzXC)r@oiIT@W54lP@54TIeZL!!s=) zzg=pHED;dbUZX=|46p3SxU{`^Ckb=i>is<|0s(tfk{_eZs4nnRTCfe~?UeNta*HrD zTXgYvTve-eo(xhV0PIW7f~ktJAF8IW~VvOp?nzEG;hUU+!sk|Wv8jQN!Ot=JcowV1nwtSKDlSxiPU zfX*zUDwrpGz|C|M?sn_<-xW)5-0W~!ZVM-#b<%EMnb##I(yG&o-&*kw1#Om+v+7WA zZY#QOVPenJyaA-s+*Xpspzhe>Ui$2J#n3zshlPho%<3VU?!KoS-M83-CqK=P2>60jCmmmt0&Xv7)?h(=8>f z5~o~f1Cq_}^iG=v-KrA{9VAa4F>`~^T&%!c(6};xXe*%`%z_OF{9bN&RgokAV==>- zbS;#Do!=y>(&Owm1=>VH_oZ$jj#0^c+)#>;H^g|0*oFIpodqQXE=(;KoI}SEm}I6V zvQqy6RJ?$He3hLdDT?+c)3f~Eu2arcBLp#RY<>^aB;tV7t1AbPI)2Zm zs7IOAtaVfsb5Eo@JIV;zy?8~1RPKM0=~YPleuY=eCnkC>O{x%z36!Zv%0%IJRtx-v zO4VzAz_>X|D?D@G*SATm`vKCghXjSD&cWxaXxWq6S6NJ2*wNX^jGN4d($1yJu^l{J zqO6BVdV?EGc{!40e$HPp=hL0?&feF*B8S4!3!POg3K})zr#+m~I!MG=ITlLs#w}c> zybjXy;DlGT*y6)ox(EllFMG5od(`NFfqjZ<1m=t@3khk#8opdqef2XrO7@MUwe>8H zNNYP8nsy4QWGL9}Q~?z&z)Y}spWRnFj6+38%|+J~(4i~Bj7rDcsb36>Z4x98nzSe{ zL~T{XJTFAWk#K~5OzZ4@syb}}me^=V*ovu4 zS0ZOYurAS2Xh~)OJcU4A)paH=;{%m&8*OESaK(3F7!v%}Akf?ej&cgrb86NZnE#+zAmnOh|eW28ESTy<>B@&hElh4$bF}-`ZG7GdL#((0WXRb7NyEh_# zOvBwctU)I$dXNbDyoQJSO;#1c?%?Bxydd%KSnUaNX#n-WG-_asgb7o!FzQRCOar9S z!ut;5(7f~#CJ*b1mN@STF7=@l%0$r3S7pZaNYBN2P;QgY^WNt#Z0VYk{Q8k}iXQMV zhCh;$LMnQD?s1QP!EK=aV|*BPkd5&+xX2X9wdr|qcd5((&@@Q?sDK$j)-2}05yYq4 zzvbd5jJaoo>JlJ+S7fF%*YT_yH@+pFU9OL)?eJz!nXL)G743bd_-Vf@NWyLCbFSL4 zmL@7a>l&Nyl=e(#&?CD#-dSm&jJ%gn{lri<|AT@36W4KUJfZ7E)3Gawoq3jXB#<7| z6oXY<_}mo!LBCU?emCeaI=28smiZP5KC9e@R%}+*p`H1$E5KZ}FGd*An#bG;^P&o~ zp~RR~e$1T!8d!K?&oX9sy+5=77Jp@+C??G2P(cAy;LK^aXas0PaeDz1yP{MOiX68a zxv{6Lxtq==)w4E-aVO{>+_9rp)9_2=9&0&wzj@HPu=H4}@`g)+DEuPr1YbF?O~m}k ztU0^?>Gap@n z&l&uTE{7hK0^}r%(&l-1z>`~$i|)2t1@khWFOCZ^V{&H4vcGdx8`M7gvP7cTu5Sv9 z=#D{KyV{|iu=Qw&E!Z`9ZfgkZLjj5}{LymL_lRg%hN+(5JJRalEA_t!QdJ-aU5W!F z{Nbavnh-D0f>h=g@Rn&aBS>C9TvPe7N*zNZ1LT|#GPe#n6tFx3gsm;DN|w}Q`7%Pc z!B*~t%ntpC4S2dSk76={s(%(TT=MnLsYzM0cp?GpM0%-_W~*|hpA`_xN+D<^}_~8OXUlhW=B^u^qb-K$A0lYOctr)?G2T!6;&zgydwT8euE73>Tt8 zVa+KhS1X4p;nspm*~kgmRVxK>X;+Z35wg8yO5wR}Ai_9${!4|ic;58~)XJ!7l1}~7 zNJQ*-98l~%fd&mfE}^2I^tcAmcY>S08moKFNbywh2xR`kDpb9icq+D*pX zQ#_duGw`WBQoFxjHdSRaS}O_syB>d-&|P&ocdQ{XyqIs4LXfVU!rHlm$J-;pVHxza z+SUD#E4iNFhtlvjFDIVenXFFE;LFccdjQPd`{4gVrZ2)BDJ4jRwu5Z&f0ZBwel%qV z?P=CL<&>St((-Y$rW2qrE_}z!RLi~mgGt?(Uux|CzI|BDw9=+ocoEHh{@g&}o?9>1 z4cA3}dw=pk9`o;p(_$AKpszDWnMv=!DFh9ua17g-O z$1_iK;--EzO)(arB)s@xoSYp5UPAa2O8D$ysXp-`-n^O1ymhkT$XwIN3!Y?{Lvm(g zcMs{#5Yub;UaSbeU)+Vz#8I>~A5y_(zlGmw!;g$TUG)SPg?(rsFS*y*R1uIr)!j=N z#Ud(?v%gp`|2@9ITgV#l$r-iJ^nFIF7%|TP4FKl{ZfnQbIVDeGW>75`Dud9J6S=KX zdm+xUdCJTWwZS-pGgunFqHPS>bX?~zyX6*7{@6^$QFc@xGAEVyoW<6e;35UG-Jy;V!v-vw$x)aGRw|gw`(2vA+g);Qw4S36oaOHD z)6Jt;`tQ7Rrno5VgzrS8M}lNi57Xu}od-&zHC<&5_Z``?dxXU`m@5n&rCXhTJhPUg zZK)oT_JyCeM?ClY$2bv}wgkD~!^^X0-?(#pfa9qJI5e67$|h?KRVxvzhdZm_xvp`X zX+7I`k^B@RQfZ$5CApx*j3uV$ypP)UlQE=-LpoIRZ^fC&Xdmh!v4Gzii%z-!Twc6$ zeqq98^kO(Cbd!ND^4a~-{hza4hH68r2JrC?i`*^%FW^-Yyk(TQbSIQJ*|uJR%`r@; zB5?7?Kd)jI{(=ER6>vWPn4vhjKG$?PCf`O}`UtKlQa&V`7e&KYVnEqKpBv%xdeA>p zF}le{{S8j1W38YQPhbU#R`<2ElL-hyE^sz{XsQk=Y;#9HXVfVm?om>Q%>f^c#c3bI z{^`>UV}zhbK(V-r)FXpPFW>nmr+d8Fq&YznobuSkvT?hh2>8nV+;On5il>nI!t#BA zRzGO2PAVq@%5#Hx(8*1~-=v}5lQ$K201Th@Y5QG~b^C({roLVisD#wfrLJi79o!x6 z?z$w@u``>w(qOL%y&pKv_A1-Jin^OrbBcDNHEtL7v8`IxE6 zY7l)hlij!txvqzOw0!mGI!>Y0Q#KeKlFn|e4v1KnPd&8pD@U79i22MH_6RoGatpsB?mMfn5>tHpMr76tGCb_jaGRWhgp3& zA|Ca4LWA);t=Ou);vJkR%-ePz;vUo29BzfYxligmFLgH#1_p%9N{%1tE*zp$3T^ct zW1&mxG*h3{ZTV{hU#^A?@9Ge$=~)y5$yHpF){NSXyV4bfZNXlcAtkaPmgfjrmgwq1 zbU-f0Onyd#Ov?D&i75fQ1)8Kb$wGJa?{03UH%x8Ue}P-r@*VFQem8g5?9Akv#6Yne z%98GSpX~lvG}DgbD_+-#b&8DEb0xlTUinL2F6Ic)IHA~a&I*q`Jm>nR0a6H&?| z9Acx25gyON2_+k~3Fl~Q&d~2&ijmoBt}g2`l2KMYdZ@Mg$Ch_eP_;^-N~X-<3T7RR zaWFLnXev~!rH}2Q<03D(8Gs9qN!tL}*c9)`6NkdGzw?oYHU9JHvZ%%WfI+8u?SG)< zm>IFP%s;YRPpX-jnI0S=}x(qp|il3{c z^q!*dPAw64Rgu@$se)4xkT(TDW5*|y3u6>eDzyo!2txG&11K(kysrx3HMC*n7Xao{ zZ7EZeP%aIiqIOhoBd@qp*4r(-VBkr-Pd&D}mUOaVOO)S#4M^pRcu6Mc zO5*{6<<*mzI3}ldU=^=Rdi4s;sE)p+R(N^fU^eM?4D7~?hDtSB3)6>YTZlb}JZAD? zt1%=MsXV`+@YNcdqLlPfM)g#4NKyf3Vi}}LFwP}a6+qIIS7HE zkm6=nH9|C@JDc*%%tzHZ-v~d*dO0`n)2hWyfouE5br=<*vumY9amPyBJv1oL4uR-E z{A;?op3-#6Bl7|i7r)3KMa>ES^5Vv%rZl+d8x~j{PU4V7&bkxI)~@kE?gPRdPAb`Q zN4$>Zr^F-?x@8e(02Mh`9sd2dREiE-#{Et&lnAJ%C7G;WTIe-Kr7hqkVmk)@B2X%b z=OBe?2Oa?bS(XUEqBoFh6Q=p+e!CyS=Np?8@1|zNc4=PJTV5exd_G_ z24nlhsutD-Q+Jm8;ICSGqx-MH(z&X&p{ZkhTXZ2*as<9XP?A$X75915S8<1XG_Y zKO>dvG#!irSebE7Dknlak)(DnJ2DRDMXON4!ZL=Wm0r8`h{^76zb&@&N{qdL%-REo z!(3YXLDOe%mZmURbV)%ernTwo90W6lJK{2B=9c0g-pvAf_1vlVR8ez~u!;(&U$$#`U&NT7}mlB{J)qt=n<N{KEG*iv3vC4 z4m)0ejyPpYhXZj}^8h&;?rbk&7pZ>6%~fF|ZjlFQuU^)O^u@ziR}WLX@H~lwmcjsa z$K!-WiEAM9V}quhq#dILVD~GsV7_V@p%3K~YbExxw@p&$1uvW*ao!Yl(Fs29!UG0` zP;M*LSJ|05#VeL5KZ9)#9&gWT=Q4if(X`k&N!@WV!AmgFZ=&4(TF&BQqGxzqig}m)hVCPNS zg>y7Tif=Wsl1mJ2VvKo!*gey$%nD>zqfM$uNJ1egU4aQR=gm-Y$QAwduhqADv)-cj z*uq8fzUn=7Sy&5(sl?L<-~w|yHVxD1{ef+JbAtxqDLE~y2S z*2B4GiY&)E#eY(_i}ZFCbWPQP(?blcJZDN+XPb=%NHz*2n4^Dw<4z=-SYGgo9bysW z`4L%9Cb0Fy&yq^1${gMgN3k^Ic^nN)-x;55abOKN5;0B21S*45&|Ha{lL43Ywl(}C zyOPzrd8^k(kLp+eYn{UWk9hiap%#JGBDW2}0~0%PY92Cpx%1%es;}b#dbQXb^Jyn9nr|8jn{h?I`x6Dl zZn*73K4 z(A_et_M-Z_7(@EHmKO344971Fv*>k;(!EPZ5)pw;z8mG0-I*5l&Izm~aplI{2B2IM zq14639m(PAaAv?H6QBskel$o!L5%cEJ?QeLp#&niFa+I^W5R?)<_VptaL4aKO%}X^ zO@^PZ1_?A>l5{6WH{w?#9Xi*lP8{r4O8*|_Y+M0xWyv{QNgvFn$F9lyiWX>!IP@QO zX@I-k!l|?urv4!GH%y{U9+D+2s;70uu$oU46hhbql=wHs^D65HmLdP~e?8Fa1ue*j z1%xru?r@oN^ZkL|kI4=DHl3vv~4KWl0!rv+2RtpK&%$hdhfcK_T#*_&4{eaG139 zX+As<;a1)$CYH5gFZFZEY!mYydTyU=d#yUaTeMQoxa6#GwPPO-(3(w>0XRerNll_4 zpdRx_dy$Z3x2&J=bFd7ayrI_6Ji2NCEj!dVWR5PlomJrFga~700bjZId~BAqWWe$( zx1b1gfmr8j=8DtG+2rO?U4`$Z$?4g7;p-sl+v6x19z54{N4T*Q!O^S0a8T%`&w?m+ zg97JgBezkFdp4Zu1$Vw#tF#EY+iznjwS52MYpUn()*!JK{d-UFhg>JmX`!Nk=G0%aEg>)F z{ii$N0PF!m-XaiL5yM(P$dD6JNz&Vv1F$2ZQ^F8?L-uUQz_auci9u32m2_Agp)&}!@Bdkm63 zV2>(VsWUNOgXaOcfex_Q2y&N2B4@p)bK2B?k4*7#Fr?;2nbo6^@ohTf3lwZ%%Ae;` z`p46Iun18~C->t4es*WQ4S|{Pc^%tz7QeYhpb;4kAI1nyA+b z$#J6*)8JnIe6%ua`HZ|s9QGDlJ?NM2H(&C9xmOir=o8uW%P^kf%g)T#ebcGvWZI4m z7$oFCSVRA_owS?k#J}s*n$J=|Jc#-wLS#dF6b~YqG&rJB(Gx-{h$e5fo^$Ten&5o2CInp=e#Nkg(>CkmeJB5~4#_kH-27$462!;4#MZ6Kv zt&Yr_6GI<`B)8CU&PiSUd@`RM0Yk>2w`Y3!6>E1KfGygnSyx5pEfOmY#!C7k?!skG z0`(|`lO3^It|M&;+fj5`Pnghv!$b-w2a{|mjb&#nW{t=0h?d2n0_t3o9e_4M1h`tj-40iE=PZVK5bH}TbYCutLD1b zq>E@4L!zI>*#i-XGy5=g1jyQ{G<(Q!br#XV)eB1j1tlQ(g@(shja7RyjxxYgddY(G zd)DRABDP2vw98`nJ%cZYpr@om-_$bAkP&L_nH+1WV2;o}hXuV4q{@O=0CzKAB^iio zss)~(2Z)oMgAdklLBs;JkBa?oofX4KaS!r+H)nGT1O#L|tVZQm=mp8VH*H*kn&KyM z$MIv#E+lLIPm2b|-J_q8KFtq;DzElEtbI*`8ihdh+A_oM7P5xpH{s59!Ns0EBmAnn zF9Ib5-!_sV*@E(ek#H^~Dm?FQX`bT@8&fpR)kO}1PTmVB=zbyy0fI`=O@5 zz%<-$ky* zOv0`QmUqsh@jn1vK%&2X$MdP_g=e8YeuBnZ2v6@YC5{1NUTBr2`fQeVo4>OOGb^Iq z<=1?#91c9dW9MmT%UbUY+Jw3eZ zwlj24ASdv&R4RZ{tThaTkCT01982mTh*gBQhB`Y>LQ~dYXQ0uwqo}6~JY<0KOQ!0R z8TJ)J=fZEJ8L1G(_9wPnvI+0e!TO$R&bz=k%6sq2ap`uKT|r*&!Fj+cy?g%_c&o3>o833LCw z6N{OhjWeOI5q=aLOU=?U1oDfuQU#N96{ScvOYu}@DV|_aTN`-sa_IvOx5?Gzy*w${s&7mKw1HXjA8+j2b$t5$y%?d1Ydkco{c;5ILh7GXri37A0)uF6IQ z$04)ZS0*ikNaYL`Vv4Ai-_Br-GQ1T&7@r%^o*gF1^ZOC3uLSzSKAsjy8Bm03`m$Cy zN^ZhPo|Q|~x#jHnGZn%nBycYxmr|Bzzy&(Yn z@{R9}MQqt^W~qs&y&Z+5@+MCyl1hrrvoMO<%1t=-zOC}g&rWJW?d2wFsfi_xm*{u|r;02ul@TI92$< z36`m?&HQ+|9_ln02nJLQ1V>D%2GKOo1%6}OuYrb{zz~U`GK-SkBdCd7=!8P59!cGy zraTkzTNnD3)`VA_e7FrS8gc5TL#Rh@g6JJ}H7%B8(7i-&>@${w}IfRKan@=k+aSCIK&(lQxLp^ZmCcWyd`IH$t+<`G>+qahAFp4mf{61_x z2pYGQdi#0Qp-D9D6Zf-WZ+M{ICfe*O1 z&F6QDVQgIrW}emzG{S8?@{NxM)eBR+m~{_n^J_%;44GTor`3o(Y0h`A6dKAiOvs=y ze$02lG5@)VQD|cY1&GYYqDi+bVl$AyAPA%r^QBRoe03@>^SH8W$;N#cn9&CNg`VCq zw3-WSf?o|BjZm0$6@z^Jx%4ag=rv<5Mbd6>`8T!ZoDr57;4C7kmdbNlXlYrEMH6<@ zC9K_MrJ;ny1avnj&s76O1X8w84`$;=T%s$@ki^MfBt4=M z*h7hI`weOmI4Yo!?$S}L1_2pQk_*yu4aEkitIR`tnxQw!GHI;|@si&+cv=hx4e}AF zEA0{FxAZXVY>%Zdf&L)}@Ie;G4EfFz=_rhoEq$fqoxh=7TRj5!_X4y~@D8F?Mz&=TceQ4B2>X5|1k2NZYp`Xe9 z`gWM2pr5m8sfFhl`k_%YQF_DE1la2#+bOid{v#YQAdKxS9n+(`D`i5kVWdv^r>wGxUL02AT># z!ySPu$l|Sed05k>HbCSsWnfg55|D6}1OwO#69lL!IF^}=`J?k8B(Ezp?p$!bKx=j{ zv+U&QHE2o+x2Ai~*ugG40_>p*4A^)S8o8}b8n!BAb^jRWa%e2j8|dgO0+)M{mrvnZ z@$Rtr6J1^)-R(@b)PpEan;#k_=kjy8UZEX2j&|*EBTUTE9qKZdYwO>Za#LI{_A5D_ zntUqD`Dm}ZK}FMwPT$EmnsusY+JMp-7gC+Hru|fX#=qpL?ofqmf&^HOai}qW5WyhY zT831Bi!ZL2kk(N=mb>YjPQWO)RVh9z+C{gIafaS7Opt59a;d689xFRQKXxp_tNpsJ zE(~656)?-8D@KotxK!LPf`GeR@hHw)w0LvYDRL5zr7s-m?GU%pGr&}b-P1Q@Ln8ZVOn6~9O40el2?7E_3bjKLyC*YSs--8aGrOREA9r?E8 z*0gPh`eW`ueYpoFkG(;@R4VO&$?|i|b?bg9uAt=q-=y6gzFhYm1v z!xRnVajx?!>CVELV=AKB6LJuqF`j6`Ip z9IhN=$S^|&JE_3-;-c`{fW4U|vX2OZMC})7VL_mfZBemu)Q{z+HB@eoH&&y5BKW}< zgmj;+V=2P*%_>f0g`Q7y8l~QLAP$R zII%ege6L2|g+BYIP;6u2;t7f z6$H&XjrKw>U83{N5XY+XBc3K!c(I}$4-()SB2nmTVBTh@^5P}6GUec` z$)BwkkZwBa3>)Be_PP8o`2wJDw~;~fgVglgqaVdG05_-Cn z{cHe;5}>^9yxa_F_AqeRas=ui=2T|GTr}fcBmi#4(Z=8a^Xb(0OjOBUGIwq0SN$-&@XZ=DV~?>qsn7IjVdcHm`!U^ zyJ$Mt1%8KDYy-TEewolC6NU(mxgv}-!75~0;o4gkAB*uj8I6ZpnQHA)S_>q#)wdZh zXI|v)8rJVEL^wEb>9Ck_hz9+kk-*)mrM)F*Ug4gnZusL7UhKbQ$m%|LF#y`Kwc2F% zc>o;*2*I@;b%S9Sa=XLmq(`6fwQ&iS70hb;dhouR)$~Z}{7IgojEJMDn%DlEASayT zE+nqsljF83bIh`^m~fPenCD6YR1(w|YRL)bxrCJU`*JW&hA$Z%Gk&eJ)Pd7pPk`!z za@y^_A%L~;Pl98P>6$2*;gT7-8+v9g?tjHhD4c_106aV0`_gP_jQro7V{%w*Spx$xtq06iX3!}E6doh*NhGhSUf1En}Te+FnE*%?rb2a z(FbBrd!)z3iyj{|9}@RnN-vpi_IaZ%Ixek(K%Ta5{-bxtmt&zlw10W6P;7pkws#v~ z_bGMG*s=ZQ)T`I`@U?4chd;SZfX#e+dNzpDHmh%O&Y-7@)$$~%IWIe0;O^^{9We|* z1;?TaE1{vD)7BaiUrTmC1@#;Dn((UsHw9Ng7dkK*BUX>A*v&&7hN@6!YbEByu=(*BOPq#h!ZFQ>C96Et6ilxCW+8gi`!8px>H3IDj0})ztTC@Bc z-N^@B;qa6CKN6fwdL_rT`b>;0w+6S zA*acZZlDXH2h768(1fny18#B8iZ&i7!_exu&^MaxTn~se&}2?4!4>%^tM65n`X1?e zGVoh{f8%_&$+!B>MqUS5eXq*uJGf=Sz|4_~@sG{0+KiaP2Y$wEZ>CgUGp7}iJ8I3~ zi3u-KPoQe6XGi4(lJ*uIh|I7oi!tS@Td`NM5;%vtP={#h?E;hF5wM3e?S+>{;4}Ig z5llIj;vy#Kr3|CW2zbLH2G|JfvfK_v9sU3l;<{~6^9-oaB(Pti4{i=keKSNnS7x1PA~6! zBQ1exvVa*)jnXe|<;Ch|77mj#zX`q*iV8$MP%8=?LfcDzZUQM5Pae-YKX{Mo?xs zQ)L%M5>rJRSA?DXB2Pa_didmxT&IZI$etW~-$r@W+fMSND%n#ld0H}fIYxvjpyRX; zi`XfP85k_%DwHX}8&R3<|BM%-{oKFfMT5%3RCIDpMz9f7OpRCh2Gb|y1P2QV(YN9h z#}V9>TfWTjTkc9c-SWk?<|uL1Tu$aEaD75sbr|Z}F+Qxwq`TN<0_Wx5gxZI>Ug}qL zIwkE?w)4^McLR#U*@=x~?8HXj(y8pkh8RV;i-FHy>MnBfQ|Wgl#?`3vHq<@Mb4nYAyJT>DS^$0p zAM>CJJBLu_3*%urJ5*H`CGDs4(E+}QhSl_x^n{ns=fQf=(CztBY8M(!H5ha9AEWsI z_!U3zOKZ@b^mo*$)=Sih!!qSDuWbyigmsF2+i;cMmiN&Dap6A??MmaDqGkQi)Re+E8r}Yqtm5R6{{8|Ac)yX|4>%ltgLGI zdsP=)byr1JFhZwIA0m9zTU)bZN zt$FY>zK?-Sqw}S+UFagzXo_0?Ba9DZ8h{ZqVkh1454-UF5%LH5CK75b#{c*arV zfqz!$>Dt_=|6ZZJr56=d7owms{`OS{>R+R%GgM7EW_ zGV+awGmobq&D>)^HKI+>`FquxVA8%!ktV&koWrV_biz6>z6`9I(fKt)EhGJq@Rcp&CUY4wK$X{4q~|!}P)tw3vCs@FOfcV!?ed%yiOK0JFExL0^`T{) zwKD8RH{`O08A!9KWaOX&a)v{w-71##JhfX*o4a5LWgxVRQ!b`!i#0<+! zFi+H$A*Pta2S|UgN9%Vm=ILfeS)nW4FG}(3E236=V2v3YS{WjMOuAQKkJUJgMt8Q( zJnBqsVrXL*sEy&i<@*Ep2KsRi$_#Y<+eH7hGc633j`$5Zm zuz*%=w3>Etfd(jJFYAf-s4w3ewfG`hntRh_oV-S^&eMa^XF)#99@G09UZj+!Khgt9 z4i$3K(V#!gpk@oPc34zwIm8FUgGSUym!iI2V2}E`xvgU3?AlZnLz}t)!L{ab^rZDL z5@do*{Drh0rpiUZEbpX^ZRPc9cr5+G>J|3Xu5_*_MR?P`$`HpdqZq+Q`cFbB^W|wX z=6l7`kbpIEEl<;>5=cjv?e_`dsh`{({5aSl4N!_-0t!PSdCZ%RRik&?RCpH>6!-rA z&AkVidj18iVBbmq$tW6d{c~oh^lkkcMOb4m@U&bif^trK z!|0>d78og!yKw9p;k3C%+S5+zf^D&j8n#+~V8A+;*%vKJ(cUzKsnnG1lhOk@RB7u! zcl@6!X;7tg96OHSlJqB1Mg6DbNy3A4-1SEVkIWGw)H011y+1H_#y}sQdbJ$q~gpKPrmmOK}cj)Tn)Wcxoc11d_IQ}>)wpmfEkD6|w7x)hJ zC~govY^j`1j})opF_I6@-bjJ0MyTr&L5rYU)o{(UN5BgC91s$1IBN4oz4e9F4rj zz(K1#UK<}p?_mx`Q9FM%z5qLUV#Q(aWh|waL zfo~Hq^%kk|9W%tMyGS2-IXPcS=B$(baSv8uVO~LZCw^-{_N*|^Z?~E{U}4t53XBJ6 zbc@%D`{`6n8h2`oDv0~RmhQ}#&MSEJxB=YLMk7YX-eigw51P)wz%Kc3QH4;;Y=&36 zg!4Tg%V?(MmPoWc+BnVMsIH6I58r7X3fc-UB|WYIz(_NU}Gy09h}jv7694 z=?wy*rVt=>P((U5ir9UYsEB|HC@Lr_p(#xvbfkrvwk@=f&EA_v=!8&`x$C)+-^{ri zMBjVg&;Nb?A3q-?WcSRRIn&R~90zlT3JpjM+L4xdg9R{;PndroyaM^Wi?x^aish{J+k%6ZH6#M?sstG_Sr*b~Nl4W9 zNT1bDRDMS~=CD@m3|n6yK+4tSKky>(*<4*TZiBWvp%wt9gFY= zC*u#z1fOv>SZ6(9-E2Bw$s~=oN4hI>SlMOH<$Q5JT>Mv)00VC>UkBcl{&<_Yq5X^s zgf6)H54d`EF58c*4`QFn&YrQX2OE@(KLiTuQnprPYZb7mn_;}*GuTv(dhMclkM;As zZIeK8IQ_rxT*{A?~$ZEus@Z z&ivb~RmV?RYx3pKz?%YFSHD$Eb-J0<->M($yxQxU&eQI2QlNi)(*r zSA)E}OJw&I8SV@Eeb-ULT)f^+jmN*&pvoz}&iZ>Q@ytVw*TGUvj7w?|%TBVgJeGND zD7)d8YEaWq`$GgR$@(J~ErZe3Ly4@YYb62|D+FGW|Wh2Ri2g$QjQ)6edAl5c+m&qjY+uhzu z1&8i~vD#G5AG#;_<82pz1R(~i@C2vkvS0WK#>vXbSQf$t(GT9piXpa2>mkbltBvcF zZY4)yQeS(Govsp|)G1x?+wY>OeurH>E!5pY+vkHjWsTkrT}&0cQ{Wx2QE9?a_9xNo z&unPIB)ikmm(4@ZB9S#g;pYDsrt|sL1_@T^ME#2H(1R+}V5H;$J>WXEm9vD$7l#QL zv8uP;aHO5f-SBqHON1Zq)emuyPQTG(%s_81EE1L(>s*ln?sgDy!IsQmOf^J`-)!3hI=(4~21&>WB(~b@x<8 zbf&w?KeMBh)wH1~)r;4}d6n}Gl_BVvDx@l#<5jvF+hnOSRpnLkwIR7QmXm`a-XGDI z!y3L^#lKvIUw(;yIfC%6hws&R@g0GAv9_@+{td&{VPIGXEzX{}?tiiuv`7cTn_CO~ zSf5PRRtB$t9|WH}g%D~6uY71^afjwotz1o6r+?hX%@rYW8N9p#p5C@7*DwB~s86Ck z^@eUR&8!;0OVPn1^=WF(ZKUehVn}B_g{Ayrix{q-6*^kL$QkaS17=o#TJc%6F@h^@uBF7CpA#CwY{uD^|Sn>vPi-uLQQy z#jnWnUn(8(V_yHp-mRZXtL#eL3yrJK=}8ST!pK08H8&kz4zfloObUXjjY@Y zS(%MdTB59bQu7t_kkEyg3Lc8iBGgZTAaR(}yFlGvj-Y0!FihDT$GN(t$y|VZom)|W zTqa+a!A*u>+2b^PE?#nc{za*gWy^3{s9JG#RpqyzH5BxPqul5&mmj{N+bqQ{g+cl{;&gGm4U zKS|%j0Sk!q@Jc*u;UYbH^e8tk#j}@C_-oiCSm!#1qJJEN8QPg{S_;h-c@7NIE@?^8wbTzjUnYCl-0BNlZ%jC6={-ydqTPjnarwE;-x#Pyi&1Icfr`WC8 zC*-Zr$*A^(IU>J~#$#xNn`t@Z)mbyf2J{5oM09DN2Hmk627P_miP?LSHX6VKrkVw{ zH|r`+nZ9K49OG437AmZqGi~{^f%^Jjb_#a5xc#cK9+g*Zin1v}#lU~34dN`&$>K6j z%0$WI=tI|~>2!D(qpemJmreTR37dr8>gQI;RGoL*WkIw`S&}|pDLa`NMYdG44?}Ph z(HQ6aQ`)-mbI2*hGe2Koc|zKhQT)7vk0{-dv2zQA`k88&>*P!SW*AVvf2p+pFM>wZ zSd!(ksWPv^tevnjoS$yu5l|cIfstTrD<1Av-cG0;IO?V-_``*7rKaptT<1xJQgbYj zZgsy`3ZIw47|GSNY>-H6CsFuaf!<9SyL*Y3w0`+B#Ar$JaOSs&N?PY&gi2mU0jPvL-LSvq@{ywpbussI6D`+l(82@)?P-exf{0-84s=E|qV15C9fImmC6VPQ4#+__C6RJ? ziE2C~3T&KmlW$O<@Bw%D4esy>8oo+2{FG?e0(bb?-{HYO_K?NNy@`d~0N;R3yiRk1`JxSc`9;EQ z$7%_B5E1&x=q_qR(5|J?>pey_dZU<*>Hu^j`4l&Sl5@gYHj3_~4f323!(->*$s1yK z=Fx-}gHdfq6Iu}c#=KspgsuKNJ^o^DU);hMNRJ*C7*dGp&bQnFD8y@fdDcDWwg3Z z)Ms|+GW6+$1l!ZqcWg(Bjrif>p+~wJ@ZZxtPwakW+O(Mq#*Ll%^S*t%H=i`>2QNA4 zoJfNY@Z@;8@>D^6sO}Y6)d3;5bj6l(=hxLTuY9d!I>0e&SW5hCnjaLm%UmF3@sjBbm`2(EZ89vv z6W7w)^%=Ys)`xo3n^|tzDlHlp^{;%~?OKng{-vn4K|I=UJibIczNGDnqPj+=s{~bB zjM1sj)u|U%Gb*T+!bjcMQ}L|ZYukqTf&Y5&E;v?oEF7AoK%3XMVHDA2BNOEhZ+cVt zHg9u{Ged$6Mw;EFVi;8n9(Ec5DLH40=wRJZP6!Do4GE~<69ffiN33_)mBHYnE~J7+ z_6PHUYba9~FElYdv{spXtBPS<@!ewZqTClc>C@pOig3{h&t#v|2p$P+y877)a$H-u zr?eFkQbo3wjf1sf*9IOY_p0I(@+kt~ZTF}m zneBzE^x~`Rz*Tn8DhA$On}e%d<##_n;VNGUs!=^BvO`+Jit>XG@aXz0om=&VMmIwcCdi7D(^Nty9v9rqor-!(;963*+mksC%@ zpUg`;;cA2f&-@2A&Jo8P zxy8`jevL{W(Y#YGQe9V~tP|9U7$>++|CowLcv-m$mq~B5#mVz!eyrj$)*<2*&Q!aA0Lvng^aw2eyl_d zRr@HRblHhtWQ$~H7eOsX|BLNZs;%l;;^F=#m}9zX`Nj&KmTw8ndI>ra81z-IW+R{^ z;?gml`(9Nlo?%66q|z4WX1(#FOe5cWfUQYg-Xf~f_`5H zbEqGRk?hA|@S_mMIz+Lsw++9fLC}xTD(^&@e|9YR;7@P;lJCbt*Rha_iU9brfc;pZ z^U1Q&MBqafccRZ|2}V0SoI{+bd=IJ9;gArI+|v&>viXk_U-Mz3LaBxj%XR9vfq~?& zJE&GZ#nD&R|LII{&Jo!_brcK~dZ?>u24KCio6VPDx2}FFMDc1F>d&M}u-`+D`hexY z_sk2mqsdZhf&SWh$)#};70uUa>-ER=`U`9XyX`8Vuf^}4#_yhnwIOJfm$H`PJgTHI zhO<~+DcN=dw4h4K6WySNt5Q;5$7?08K(l}?xP$kt;A4gbxbs zd5p0@9RmvxtlEPoN(v+>;3d4!fn1U*trn;^|8^?vz8-ozw~18T^QZCva&%-&1|aGK zkQ84xkm4;F4zqP2G}PlV0rwteT?T1MR9@sFfQR(K>VunbS<01U;<`IUcAAnQxbSHm zxehLxc&eYHPxdPNK+r#nzRbykI{bVxO5z6+oMM{@j%_W%mHTQVHi9xk9z)KZFu4U^CSKeD1}uAjv~x9CF+4-o3i64@4v*|zZUSsgHD>wv_`jH+MwL>=)|wzkqmjYbh{ z-7sZKUtTJkK{H1&jQ7P8!pP_&d7ab-kLaf-k7zy~(R@0h?qvFI!z^||h70hK_P-fc zozFfS%rwIh&f>~+hsROya0SiJJJALXaC#~OxY<8~EPn*ScC{#z&F(c4d{qLYWse%? z8=_i{&Oy1*2krA@_LVYOQ1D1x=|3Mxv_cCrthZ2XxW)maWDiszi;!|ZvgOpe7ps(t z>aVi$t5Bahob*Gy(uqS{&(^?t!RHw(elDs8T-v~wUV}@op{4yrb(gH{qVOCejcmF@@YX6|y{Q6r1T@wvU>g^(5fp6% zxhi0TFxt>6U=2neNG*V#xFNGIr|aml7#VeC+ylK6;eJhCbiB)pe!L|-&$W`WR?t6i zVMLGMr& z3VJ(qIj7S*Fpg2k`=inwbc5!Zsd#Udq|K$*%Mc6i@uH1SWhkJsx?e>#QHfC!<5&pV zgAjqu@Pt*Y7h9!MmMGDpx*ylChQ)&Z4);o{A4fH(E%$97n{f4Y67+0XzXaXeFGO_= zt~e%+b;lLE3+!cDF;-h~lvv+`s_Wb^WYXW%;+wnV>27w#H@md>=4IYHoJ3l>scklG z;s=@1#0aJ;3<2HAps+!WM?mp$7&xv1gTST|pza!=Zd%P&Z3f|98_WR#`RDU=YJNSs z)Jla#T>*5LpQyZVQ44j*)_3x*nTsv=tg}t2Fdkuk>!8uJd@lBbsTIzx#D6i0A&!Ps zF^nPb?5Bdre;QA){WaL`qB;j*JIiQ}yOl>T7`oV8q01c%T^8`rrPiio^yZ-pH9g+2 zK%>H!Xsb(jYeh^$>~bqunF*_TdCTy2!QeHVm$!K4)jedMc`S{1I>0e|SZe$%9;0NL z3Zz{Wquj|*n=2PZH41T#ibH;11wjIvLWp+J5bZ9ido&^~!#@-G@SR#B(wjOe0)sT$ zyB1%`4x=waBZ?pN$0X{2tb%H#svldxMw7+b;|ZgYAxG1Az%XyDMJ-A-wTqmln5LBxK zx-Df***HAI>ogG&e;P(m{Sd06gFB)+su<7kIyEh@=j_VMec7`JBu!8|)E`67z}uqk zt5&{-m(?3|lr_rg2a=H-{}M9**| zJtXmEF^#*2Y(#abT{+s9EkaaZ#Y60Bh3VEgs8wWG;ea`k{s<%}&xo)BPi%!QR@o`4 z50nU0A@DQIQJ3-C{3~n@{1`9jkFXEe3iyCq@)H*Dwazv9-jH|7&`N@tvc43CD7!^i zf}*_ySMo#eTl_r*6U6N!Ym+|oeAdM zjIAt2WJO9T6=>b%NyButFQk*eDDh~|F;JWdLuo2-1~TpvXdkQgB@9uXh9HJ-$_g6X zRP8E$&}HjA(#ALBED2iD9^+(vQ6@sXKoHvz!~@w`tfR>4luJ-2=nqi3uqczctKswm zxC{ECY&OVK31=Q^xK3Y^sf0UCB3p<^3_>LEqXtC65UYk05+#}Zs_r?O?C1lxEw$EH z2|6s1rj-H0{vAP|A<*3rw6aZ!6!mtt7}rY2wSH%vaH&qQ>Hu2G4g+u{o9xtKFu=;y zTuK%Cu=ZV9{xb%JrIRa6h!m4kwMU%g7MFjpT-b@)pOOuG6uP%NU<^+2iX3y(x~ zAZ2H(GiVALd#_meDFLB+LrMY_kF$;_ryVsJKn-S{PwFdMK3xpW>^JQCQVm@FAiHyr zP~V2_r-j35VWp|4j--X}W}p~1W3t`Zx-VP8n!%_9UNMf~p@)#IqKmm-OI|Fb1p2MK za#OkaruF3~6j;ONYOiZS_Ix|#(A%&NM3=%s9o84DT(xnX6@@#QRIE%$z%a&}Yq%c& zRCtH$e-KlgP0Z?nTd2ieP;aDaS}clB1{+|lwywA4nlr2#&yc_uA;+8|j_HmZvxfEI zPUi|)D=R#pG!~IbyxB}0%mhh9y3M>wT#2@333Q27hY%-06@CT-)!$r7Wu3Li^q%!e ztx}Znq*|dW<8APg$n?mVdO__814R6YOVeaj;A)?6O%umvJ|t)v|4q}}%r7^WSiUu# zCezNk7d)wKZr8Y!jZW{ZK_k9IK%j#~{f(N=Z021I`DzewcQXD6^+ruGLe)vi%W>!e zp!T_0Q-P3g*Wgb}=qGdt{!%_SQTe>Y^Dt4Qe9$_~FqN6Vvs%pW(uB7kCFnrg?knkU zW;Y0ASK9csOgPWF^IXC3;E=yE1+{fdm)DRdn3a+mJB#NDvP@<<3$4LdB*%5xh+z}$ zB+5lRfSK12!<*S?XO=*RST%w6@ke$EeyWqK91whV*3J$vphtW?c)pK5)7fzk$$os+#m#| zk_gsiU^x1c48Q5r4N8)Tzfn@#sj1}s#nFQ!*I;!pwT)B2UI%MvY8if}gNj^v*X=%M zmsM7b3%pU6CSlY{UFjT({y_#TQWQ~1W!|_R8;wd^TjmxOM&HVSKXIuC8O)2;!XLfj z*q^YvJE>{*JqxCK72cIe^(v-{9DDvnONFUCp90JQ+!0Hb`tksCk+Ua4iPC`d(2@gQ z74SVAkBe4Q%i`E^_%@OvPWGcZ&=qo4V4yIC_ttA+=4-s^-_Mc^V|>YNrd)uGimfNc z@@k->D1ou4idai^45_=8^!G8I${6OSj?tkk4;CqiKZ&8YB3O8{>O+hCB;Bc1AL)MA z4Z@wjBUP2^e^L_v&iZ(2#P7l`k$1(LI ziKrOv+%2*{ad{VY1s8P%{!@}?!*PsZy%6W7Y!C+j@W?_`$GAR9WXmY7-vdJ%s9s^c z@C4Om+=oW>a2nZl906%m7FZWg?GTXA;i~;fI*@-!cg(jW0R9l$YXIAC$j70(;*RCAA+) zD$?=_(o!-PJ*Fj%E279;+v|TKBdP`XbFY=3Fwo>^l zLS3TM6m69Sx?n&reJulOi*(Ymlt%bgRAUf848@JBU2)@T)RL=p%4X`1JU}{;vI*I0 z9`C0m1uW3KnRJ>rQ%Cb=(n$duPyr8%ok{nWak~r5QWno7grG7loNMv5oCEj5!-chl zm!&wEqCf6tasEqGt6{lPJp|nzcX(G|$34LvV;6TFys2!ZUoPXn4AFj9%ia&s!Iw%s zjql=K%p1I)tyv-OJ8A~C6tv#XD>qk|Z`})WKVDk$&?D|4k?DH#MwvCmpO*+(h*ihoJXv3A6D}Z}7z6 z`9@3T2~X?PG74m=>wVX4Wd)MGB1QQ!N?pMx-TY#?Vui+d%tL*lm3^WF9>t$Y@7p27 zuJ7pvtw?1&g5&TAeG$=(d9ikazL^`PXQSNMP)}&b8nbpfeV3`Q4-UIN+E>uGoQfX} zK|~ViqYI|eM?>(VAv$#(3nSxlG6OXXYU;tLVRWco;;6`ktCu14DAYM$*eF3BPpOo_ zM(2kjixyaXM>c@@r5KJS-#a0L*BTAjYv6sMtBGBy$dd9FXxo(f$ zvHQON?w-Z{Yv$}jFS*U3Fz^DOfNBA(htO%2Y5LrC9*3hN0w0qSR$fFHqf3`IK)DQ? zoNGkpA+X>G^ui5K8xE$_?JbeAYW?^0C{C=Iy${j%I}{4u&@upYxbjJ{K2(N_g8m9$ z`8uw=Ri~a+Yp9>Snx2ArLEzbsD`xo2MlU9QBY}{+;pu**YhUf5rNu=a)5;vNbGu%QuqS%&G_o$VwP*?;6c=JLFUQ^^RYvmj7kGeDOV6J?3+QR;Q1+7(8km-Ur$MGO;I+i=`@+ewB4Dd4uRM5e9x zygcB}>;o>E($*_Anr@acgrx!0u4nyTe_S0s5Wb@ac%)SX8sniJWgdMRrv7^rgjY-OrALpA283{$0?rSY4LM-if3nj zo|fXd&Bh}^dJD`*tPn&5soiTQR@mL^@&Fe)2OslT;qTO=1xxA8LgIwm{Mkf$D9{}i zmB0c!G%N8yKj$5h4G>uGL>A3j4K!qrxN^dDcLy}~-yWRXyZq^+xM(x;Q0NI=1E8+} z3(WlXxIZ*|{HkCxxPt~G+6o7e!XM+xt_;jW;!dfV&aA@9ky#qdWt`M0hF!!O%mo*(__PezW?*JZS`nrlU^5 zT9~KR8(*b&m+B~2JWL&gZYAR3C8|q{>8;N@xO#?N+1!`Cj;qhosXot(tf|m(2 z8{NC7rHzL1w9)Xt(nfhaZG?{H7DX0WbD`U)%&}F;Q(FT4t(t)xB^w#W)dPVDFekjw^U=N`UpH0{X{B%$J5UNvOoAj7( zQIHQd@a-Pr+c^Zh&11fm)o;WF0-j-TPZs?ObuI>O1Ru+Z8vhfWpm{O`zPf{kWo%~c zs5l8-6=fna^v+VaBY8L{BQh+9%}#>Z>MwLHtgcGn`oB*nHjw$J7>+03J6Q_4-4KBK zUoQpU8-LV-(DOP%9K@3T_klqcD6zT2771$k!+neS!+l@Ma6yPwB&uziG!!PWt+KLR zP``gx>>)5i1Z&RPK5aOVOdH$%&_Aok<;1(Q4wy+lgn@txsv1`wZiONw-xj)a`dmic z-Uq%Eli&rmR)$hxf9oWeru{WmIY+OqaX7!o$_ARp`TaC9FQ^Nfv7o07`%x3wOGp#_ zCHmaFvHOlZLIb=lO!Fk%ltqFRR~;<95Xuit%deZ8lH2NQY<)Lv}F|yMX&%hn!W1PD0VZyR(Vp zeh0%r2Tui53D66p5*G(-k7Z+!(}yA|AC*+Xn+e6WCHl**iP=1r_QP8k+t4X>rAJ4g zt2(>b>Cmah6ivGiU{S2)0K@U&sNL`HfTsT2nR`x;@(I7A>@_)`1ihg{0QA$;coEX~ z!xH$|ev@l)Eyaf6&;d%Z-T0?MXJ0EtK`{HluKXaV?dFKgM`%9;S=D`fuxdHd*4*?s+(sG`tTvA~eDevJm84X*dDBMe6mB3@!Kdx?Oo)U|*w&>cI?2 zV4!zqpQRX9ZTBW=6t|%WqschKp|py<`Ni9>_;2ldCK;^=Dtpg^sSoZ2+@iv|&h^{0 zx%daKE8oELJcrNRlr^#Hw>p=C&#{q$PkW3&tp(-bx9)f41YJB6{Mb?CHX~J=-X*CA>K zPqb0>T%I$K#9H4Q1uFo>df3C=4hfy_tRD8nyR*q}ZGA8lwPUk@o5Ncv1A0vuHT;m%vD8p8rXpB=5FibDm~jrBuvN6t6w z916xQ5PbbCi2i4p2qC?|IB%y75BC?A2>#G5z{cyQDy>N{-B*dER;4sqZ-Nk*i&Wap z-j?C8px?pn!SABp#0->c%dx7c#dlx`tiKQoC+V%-W-PQ5i+Y{r!x%S!|M^q*{ZDrQ z|3R+#Fj4DSXbqBVFHgw*fWQ_|E)IqwJpBb!8P8I|22ZDr5%hZ@2@Z++3#`Xq(Du@k zMVDhCj~)#5Wj&cYi+qJoVBQR3(J8bwr%;8q?hiq)?4ZYeH?f|m>h<(!Xp*TiS1Pz@ zNrp5^Z9p3D$8zXvGma`lv~-*&-NiuTIG)^VOj==?(uM|Yd9z+otk2tqEyJMQIta`; zeaHWFR|p&lA#c)+eEg5BS2>Ev4uRdPFL32QDwUsMhUy%qY>A`%2fANrCW8J9jXTqz z50~|~lqrA#<#^^jx^rjn9s}d?KjGBfyG%IE##5T0UFnPI=`k;|cC3BujyBSHb%PFk|gUVhCs1wy!sC7MCX~aq-C{es@7*%(pYaLv- zEQYi2bzJ%sk;I#Yb!O3A%LQ+MfODts`Je6t0fWHEpI<;N7jX}CND`*1H_^M$s-KYA z*gDWXE=UEzSF9e#%a|`4$~Ej#;S5`8HUw*hOqL9A3a!DB#V8ED(Bk$ z2tfs>Z~LF=27$w%{o7PI7xNPfuK*9?$NTl>C(4&*2>SZJ<|{S|XX{dxE%EBluCbKh zLG4x!7*6#oBdDZpAjHw!$!7pPsuWnpYs);?I(AH{hhsbuary+MI}ur6Vcl5F z>zv4$5Lk#rKGO;O2Se~1TZzb-ETRTHIo~aVgd{wt@UmDbu1ud!?;+5Os`{0kBtf5E z!(Ymrsy@T!po!|v+6`ba|1$iH;y` zd_@(1aiCNv|FYtnvhP31@te<{W^XNJ{Q`-^(H3ZB8jAaiAFpR$w%Vh;7!p9<&{Vwdu7V2!uCXz^Z79Pc7 z-!c4xGKdnHclwt9neGrYoFtN1^amDR4(>FH@qo=8Ew{%}@X|8!>J+DujCC(G)@@lh z(q$;L-44OG&p;bA)_!2@25n!?LSr4VmGuV$^de)OWV)6s7f47Y(hsB^JdP@3Tm#-F zD2)jxPZk#L(h}`|g1`c_T4%bFmT33Z79@7;Pb};TN+Z`24OWY0fX?JrE0$;NFOn`r zR@G-7Rs6N(_1WqK7DPp?O)2pBuSKkn$9--Q^qDaV*TPL$SVuBU+mp#K1zaS<)Dip> z!SLF4)b5e%S@=T`NHF`EU~ECD#hn|=GI|2$sAA+cPf&Z()h3zD4jsUI6dKHN;C<%) zedc{yd*(Z&?D-MHqhH`dL4VE5{{TV%M7pqi=>RwsdE2zt-iV*?}3`Hpqnq=6QQnyzs z-CgUyw~M3SgPD7A#em;?Lt|(iP)WX%FU*!drUmsjt^2OK?Ceg3menHrO)Io~QPA)D zSUDnw3M?dy`LUq!+^Kd{?gn@NJsnE=+@GDy8W3_mt1V)g|c67CGAxBe&^=K6B7y+Qe>I+H>E3 zZ+9v2;heq55djB!q9FPb1EV$^i&8klv4r-4VYl{Li2998FDg0c?xaLg9zoX2qQly2R-*S6uJ|GNHJ1FTam`?AihySQQC-W2Q1-_QEB&zTL)YVaF80Wre@-y$-D z<$iWZa3RA+mD1CGufPxV7P^oY%&9SgUP#EVt7AgG_HJyDG%GbVjwd1FcAHF67S9B_ z!5n83Q9Ua0r_9~>PO9B-DD&^kA`((R-y~*OB)94 zP1UeI%dsxUur~3$I}9#{0VOcE)I%{TOTHc67b)c_gogv8pRn-jw(2kRlL63e_cdYv~`m8XjW-vWoFdwK9;AC=VA<9 zG7m$mX80|^XTQxIK9*rKJq6^6Iy%QDu%Df+MWz$Nr?5t$!wtO)rhsQz0O(@z-#Vor zD+(xGY2|x!E^jOI-x_fy_Ug2&d(SwwRBVenJD_qVrHY#zO+$9@pv)I4@0+>h`Iop6 z`c{G;r%M|W_odio9Lm9CoCQtqapnWxi!iYe=3ey8x5E)T zbkuq*VZU>!$ozY<7HljVcZ0RSfYkp6v_P#swkNb;{>A~Gl{r0FC)RmnkBG<-H=#3h z%Dq`(RJ@_Xf9}Ifw%#s;MmFR(U$X-WN}!F_hzTd1--#@!a|FhY`n!=31Z}G;Ko7oM zDp_0OV9zS^sOYGaQDNaJXUfaWXVB>~s891Nxz#eNqFAL!RJZUpyT7_L-{T=c&V}nX zFrG(n`y?3I0Pv9;LR=xTfR4Rc8`k<>FM5Bp<~p>7Hl41qK;t0KE0*Em5y`{DBa`wf zuUPYNQyvgRGeqg`>d$|6aNeYg1YY4hpN4MDwmrz%mS1KC(I(pv^b!ZWaxuANuhzkN zYzt&Ne-QOegIPf5NMzC$ccTdYopNYlq~H2zRlPi~LO3!$0yP9ehH z<$!UnQ{-;}Wk4EyM<&TcCg~A>7H_QD6>ZWk%2oy;fqj|pW0vwoma0IO8iFj99uuvx zR9UI{>=h%ukLZCBw)zuq_kENI{#Mth!-X6TojC=D6c$1g+clf7#qp~|nE1*1(rjd= z^$4p=G>S^A>S%&>rwm#_i>_q|Yp7?HX>?p{>gcfW)YGzLI*qW7XR~H%%o9%vWxJjf z%H~fBWwRl4HL25{6f%qI`!c+!(Q5|EYfT}vwB8_cKr=gdmgH$q)2bPW$oK!#rg6tD zL=}bT9j&B&E;2WbKFt=N`P=Bz!+oFm|2X=z-pw`o^e}(dXqu(85Cq#jLiQ&KW;dK2 zZ{BSX`~TsLf+1Q>(;9oJey*Xhx3=!d#@^J_hQ?lQ3>zAIoAOrfPyXK6`-YB6941)G zY|zA7&1u@pQB<zDfUpS76j?r)|<*Eru+MGW#{HjLM z1?V-^W2B_~X{A<476=n`w2zh+^>#A&vI#l|Ob|(u(%A%-j#{#LF+6L7X_wt|FT=Z+ zuksdO_|o~Y$h`Zb3pb99FJeC64NZ!`hn(#G(3~|f_VYY{FqD+>l+Zy#rd%aueDG?a z5pe(iwGFt|242>O=X}pzf;B~j#o*~`1O9>DG-(<|>e#nD3YtRGigG%a$V%1})$yg1 z=`pcmMkX@6eSAE3F^pK*KgjZBwIkKEMp%7*{R zBH^*Oq82TIRtw?{m~9aB0XNnLTI%?ZHrI~^U4vw-u^}?w{#`a+WK%KnUHL!D1{Vx{ z$;yA14I?h6$%g@d|KCK!p8Z%vjOh4ga(wOC8v0NE7^veO!%G%;_M*Gl4u>woB*_B~ zIQxqg4TlpMHIg4r&dqY85{HMw?yyM$BzzEF%UT37zh2rAU&kZ%1K%p}gdwYpFiHJL z`oqBIHQYG|UN-PJ=U!k}O#F8CQ+_+kr!uIYDAUCX^N8rkl#!7UDLEBo=G;o-IZqbQ zB@7+^r>euyo;JUJ5gM&ELK^#*tZa>C@3G-JaQj!Ui>w)c&8FZy2v%r%0U=zJlu(3m z)H#e+4G&LA!&URIT%lDj(5mDmw5cX9q3QJ^@c6+9!&!~&>=nzFvosy(-s@4!ng{k# zvuKh-H9h4umq$_~tyj;1hYj2deGBXsNr{nTE6MpdiuSm|JQ5Yh$jI>2oYFE=&J|;1 z{di%F5bU_7-jpzfkv1@AI@d zt>4^geQ3RB#oZN3N~A=)ds(bBjqVelIywRkk)wnRk=2t0c8x)$()>;|n(pS;3h%F_ z&5eC?ud6br{;^{LhU=f&*4T8HLii~L?UV}u3Z54?~SfK zbAv2U(Qsj5o%I1hJ})WZGQH?<)cKrvrC@Yi+^|vMVZ+WyQo-pew73~@WN`mfir`P} z4L>jHz&M^k)n}!=wl$myYPe1bM}x~=Ml>G06IzH{XF=VfkX>8eCgtyQ?OZKqswuMa z4q{;fpZqi!bkSC4yKh4*zA1+A%P>enb9^)tdeXCje}WnQ?8oQAc(QOB7(=bz_|qUy zpn|7x9U6SIbH=|T4Y$=uvA@uJOc&-h#jr2U{_Dy7EogWLoJf;i+>gPF``$6tw*rcA z1DPKv>*?ZuxN!fS-Zmm$P`7A~bu`DiP{aCZS)u+R$2mMN@GeB|fOFJ0(!l(~qassA zAWP;}l$-Ld7z;f)>xn2*p~!m8koDX-f1H+`Zn5lhVt$WzdtG8afe@>{D?U%@_70s{ z!~(kFXuAnooTmno4*d1ag>>^n4J3D(C@ zru5j@R21#h99cGM%YyvYdJ8p#Mh$9-KwSCJjA*RF}P>`E5h$2+Jb@=r9dtI(`Ta7m{gR3?j;PK}I-9>Yy> zS?S4~OQZ#xMv=DAmq(!Cc5~pKzBk@rZx$J!7dj&o9onQ)h4pTT8Y)0-0q*V!aVC4&2ALK#Q)1~!1K&kgjsAJ zo38t6+w$Lb1?>AY>!aTcFpFNqoWkA}N@pe?j{S!2zQ@q`>Zq{{jOXit{>Wl!{v(4tIxY*A1nSCpA@(cL_tg!jeZhK&`z%v`ZyW5C8G z>lbAj^pDs==q5gCZSbST=55FJ8sTjwa&zO)-aw+T&?wFRZpg7wb0{eaYTH zcfzBMOX||X!qDV|r{-5xneqv2h7z7Y9UkL^uQsgMxH;hGPd9zM!9c;t0_Z`2d*b?j z)jc`jjLYWj+4~6cr?NAY=AXVpam(>(Dck!8;;;MAu&O7_61NT(>l!mOH-BUGB?AGy z5gn;bgN=x9un`U(tY9qjYJckLYR*RMR{pqrU1q@gC7GZ6WPmX+NM!EpEqXKY$n=yg zeFM2U@zKl)eY3>6_1GRfj!u#?L-*e&nYgUTDjNh^R%v#GGIFWhlw`Y1$;gIfofN%m#amLo{gcUTi{Y~VrR*H#F!eC1MBmG%nKR&s`B$u-PSU2)7% zUCqmY1p`DF&w|)E7Xk!*y@A|y5dqPN=8VG#I+0XRIBSI}h=ZP&aoMz01KpIAkbXXz zCUu`U@^7jyr_ad$N%iIM4C70t3+KMHLWt!{5{2Uq7)TUOa8Os$QRirGtYcC~Mra-h zxs=bSgL&fd@zYZy@IOIoycY_z?$x&PjHKjPdU`4-W{<^Mx`&dFCE1xuUm`#V5n%m_ z4V#bv8$ad*cv?hn3M1@m*@veM+tNSqN$-ZfSyZs)FcRQh_LQt_=UUiggBeycs^KDd zzX){p>i?jI4{!0NOLd4K{|2W`>@uJqv&);gImYfnHle#gJ*eVSzU+ zz7SkCM5f6XW6JalVZ0(j`>Lr!28B(>@3afud%p1MerRX3c(U=VWfJoYsY``^9~pZ# zv{&5_px@WErrH4TWG$_1yg?7_6b=3UUaQ;~uU)d06kM{{@?c~>0xVB-Q0vby$KW!0 zb8m|C6A`+Uy^ua4`bAVeouhZ;o-O+oI^(|BIagzpO@P5)-8*?B;4W)&3JEotH5t>n z=e@BoaFJmsJqO5sR8yb0vYW>5tQuY*jj@zkD+*w?iFS*?M>rte(Z37>as>V!ZFpu% za@Z`~aQm<W^A79MGb@T`2(l`QC> zJwmF!Os}KX@z+sDRSPWEQyIlP)loV&TnTZZAafK3ta^C%PCzYdp2H>~5hXcFB3)Ou+msZ?-_oB&T}D5F7Ulu{JFedt|N(58_J)1 z4TTq${|cjxi_UV&eCl5!fZLjLd6fZoLoLkD-~$0RNV37J7I*WdtM;lQD^>J(z(!}Z zczcW#aY15>mKm%D@m+X~brM$aDUy8yuR)mfZQaW{R zpUgV4jvXv_Ywnw&qtWb%TC#0#77~9b_0kL@Tf&~@qpPRDQsLsBg9VNN2w`onv9Si$ zs=m9ZKMpTo=<{LLzQqRv5A9$1O_q_pz$?1O7T7E|3t&3eGyO_`lHm*KCm9tD%T}h) zyFYYE-LXA*kJc`!Pd~W#89YI-I%&yy>N)CL7%(iDWrljMAOh*9s% z7_sNsbMp=86Fy7I64BNRdS~XjU-lfz4ZtO8nNJ>@XuuD$mKe=E6c+8;yW~*dp?%B0 z+GT8qXSB#xW`VV6YeLFslGd0q59L|scDf0DsvkL3@KirYhf(ml6C)={1oVnW5LQl9KDkY0zd5H9{P!c(8L4oKplUBkW|UvlNjy@V3;yjNCn|%>=U^8#xI^J~nd4IH}W^TL`omj&z;~K6$m^#%&gPQ)mH` zQyVOx$7m=<9e^mdx|H`6uV=ym|W%!MwP`%Fs@8rhd@t=nk{Mv zJ|hs~Bxs)dP_t3A-~VLx(BfY~_G#2bswU>q|Dis^X8#WrUp~;mbiVLX0lZb<4!Yv| zGEJ%sDfNIG^hj|)uR$Tq?fMXmx&3bxf?I9R^UNP*uOfGH^3V}eA|pl|v{`b0uQak< zYKnN?@%eHzL6wx(l?kyw!>SkCz>T3O; zWy3v7&(0b(Dt&fLbo#C{XU=9J_?@bsc(MHR{ z;bS5qu8g5WuR4W6(wXGSuv5(6pf_ZX@T@rV(!`0QUW$wywf)$!Gutch=-C6Yu;laQ zrAF38qVnRF!IdkkR+WAC$yq-(j?+9IX&xM^yxc=fhtVTsr8ridMrA#wyh2+(%*=Op zTq?F#T)fKj8rz)cL+WCax^$6~KnFU>T3sDyWjYjrbH}ER7%_3`;6ao2=jI;Wf8K~j zqPgpJ5H(t@LjLN@o+)+~C#Z#jx+YINUhvs+n~|NeLylluX}dUdexE$dI(j z;gM;-7Z&Cpt}rTY(8yJvS-(I%O@cxdmltKQQ^n=iWowZ>bJ^4Eoh7U<0u8Z33o9Pc zw0w7RMjDmgaDcz;;T%InKo@1@qM#0c1--3a$z8f$PbLw)Zn;z43tcHZtH4eM2QQLqd4f>K09R65q!8+OH(#Kah5lo-X9n4TC@ z)Y!WejSWRbsavqZ!d|dotf-*QUC$-{Gv_X%Z~6Y``~T;CUJZ+TX3m^B)6SHPBgh|t z%61fpTiARFk`xbc7mB~V@q_dW&+;5iS)RQ-ehPEBTEcIy7CB^%sf2pbk)l0N0*i_d zyrpUDvAWQ(uc~RULtUu%hNd0eE2z^Lu4z*(g?CS@nzoA=1~b{U61WD7*tKH(E6(2H z(Zy&&zng2^WC`B4?jx1^PyB108_690Mdv!O`ngp)cWQXG&NY@Mt2%cF>D*TiYHx=l zOaK>qI^-PYqLIKwg!h>Xd!J`NIOg|(@54-HBYe!&aFFy=g6`7JTiQQLxFS~7uoH87 zLk&BD6W76Bss59F#0{er@>(8{`yBN{W#4eR8C=`BKyu( z&!n7yK~-w`mhoJ*T28XUWGR{JW%K`|UM~4Jy z2Saz0>_9HPMNZ)U{Et+F)7+c2W9^~2H=;iTnwLR)XvdnDu^~i=me2dqQ8f=CXS~@J zI;a;{(K5u-zoq7j61{h#fBV{(m&c&?O@)f8Ey>V0!)f_$ zn>T6sgw;NWw2UEI&U%ZM2URaW*PiKA8DANzM88Q@o}*N4;oLIi8(@Y(wQ%HdWZo#m z)h9VuM^V~d{b<#^;c0uWIcVNQRGBx^I8P_NHg6oz!TMO zW*JnQULGxRps8|WJJQTS>4>%fx9wZDtWH3!sCd)1kEyopvsBw&iMKg9^UK%_eWm(Q z>Rrsi1AgNwP74pOLffdK?Fx1Bpv`4C$i1p-RW8+6qTL;Gd+H0#q4^X3XiILASAXZb zreS`5VZ+edN-r)prE_n~v)bDlt$JHY+}m=QhbGSAbu7Sx;^y+lR~@B7I8#WEHE-s< zzCVy8wHg3_!0MBBeW1RWx379J&*Z`NK^?kxt9miN?L{p|pXEXFCC9uX$flO+|Fz?& z^2vz*@g+QWXwM#zL%Vj3yl|r=_d=-`U4+alkaiiDz9>NuUtCRx_2#XXKZ#Z|uNtw& zPdoF>tG}T!G_q%2-7>~>?-o9&d-w3n+qaBax4hab6GirynmxOa;@4$acMMle@SE8! zujoP{1QkMGo{JO@>1r;LKda4Zmj&=#BrEF8+CCC49qN25cSP^rkt4cyk33sYkbCx) zm+bviRHjPQWZP0zySk@LUIz;l>+ANVYc#GAIb|7EQ&bN6Gg}Gj#zJUXlz?!lJ?bO- z2#gP{@`nODqWngw5RblrX)K!tjTXtS8fA&RkP!1@by(fkNm6y8j!&^2v3G-l)Fdg3 zg_5Mubm}B(i?>9<{2sX27B-J9Jf{Jj<*PrQc&*5GS<)qB4HG=dU_Ng@aB+OjQon*yj?_-A3$^I5_KMxM&;Wo|} zK|f+3{-mrX32&6-jc;cnS3M+CD)R4Cx!t5~59HPcuer4Wa_bE>Z6bH5pTEkjQZeUN z1XqVT`CT%@UV?a`2>RNm7!=2=G+QFcOX#Usu_(Lf3E2Yw;E%xpGy#`6Dt`PK*-@aM z`a8>b$cmrlR~yeC>B$usD2GdKLNjmOV22elcwXoeqwNDR z6s9l@)kZk5zN}G{=c$M%XKq8y6lknVVfBieKOS>}O5(FygD=$^Yhb)tcyX5}g~m}U z6mQ-N#anh%`>iDAy)YpN2@E_vQ+~VSN@Z_(CmI|RX9-N~!fH`|`Cn1b6N@ZKPj!i% z^ZPyJO;>csd!UJ0SAP)3nFP>ei^>rRKBry<)DuHyI#{7`4b82{{5u!zKZ}tXqWmO* zQ7uQ!v;C&pRWR`b4XfR$IcqwZYKv+dD882XP?y}ZFuY=J5`jtT`sjsz8;mmwAef2#dTHV}SjXMoG<42)aFy@udSq z)3D>qaxQh=lj8$;4{aanp*>2z%KLdCZgVtD>}s!Q4}XzVRG9Qcm((Rcql!`6btGG5MKF`HBBsPA*Aso$+4 zlfhf2%vX~br}Ouy2?p3^zHg$YDckKwPkDhzt!eP1+BKy`i|WR>&z`;6H6=Q#DuF2{ zn|Do7n#zVMGR@T3Ib}S@EXi7^wze5qK8rAO|EtGys9nV=M$ReJDpw`b3nJ4J4d?t} z=oo!o2p?OZHX4d4wo^QnE(mHXal9vrBdZN%f^wld&7T}7u&8i`dab|bnW%f`vmWh* z2D*K$My7A+*i$*~tRWJ;Ed=QEz~7`6;2))l&jeth1)S*3|7BGt6-6z)e@TV+m7mDJ z}C@ILQTI5r11(?D{VZ5?WX4=tdfW+N}-<)5j`33VH3)e3|`YPXS0s@-|rZDdAF zbXB*J?5yI$(8Nm_B4_bgzzz^NRl{5ex!R+t7Ctfa%Dx+j+=Un`Z#kkl7V`*d=##-0 zu}c?~uPrbav8(E8t0Bcsb?HG!?|sGaL~@dUkrQy!Bb9H_%<*Sdp|U>2;|G&k3am$S zlsb*0JX0ge&)$Su$)HE6<5tWZ%SWF=vC}xS1q48QeFemtc$E(%nxEss`-|Z*PbGV! z)TeTijJ_jGm?gs!RI&o_%uT`1`q)|($9;5pVM2-u1uX%3+4`cl3IF9S$8IZ-B8DrHVv zDRH_RrFPl#xE81w#9HNep>pB~KJu2+q#>vHI6@-XYE7)DLL#@C;(u}^`cTg~_|^Qx zMBPC)(AI;jTAREQHvX^sc%q*-$5vNl%hk!s%cWOgr z1_&%*01II6^z}R)Q+ht<`97$RLQ0d_?$*fEEO*v`H#6v}x1xL!xN<&by2FLk^VBgA z7i76ha;n_kk2e)BFeN9I5@9PS{dbK9e@Xp#*>`fD$YxXTeCC0Oyo?7Aw#FiF)hO8` zNSuupm_s<~vRWw4B5x&SUE6n4x3~9&2x%6zad0^i^`cCF8oCe`*?CYu?=E72vY{9J z<}Ybwd8gb!97yUtLUET~HuY!Uk(Q4bNDYZ1SbYu3ix+lz(X%-VVT~d@&qbG=M|qJ1 zO;BDmC}B>IMyYbS1@wg$C@&@waidH{CaNSqP}r*&A~v0+OpizMQTc0JEr8nG?(j$P z6M#Pi3YE3tXZ(2lM1eKx!UR${oU02HpVH}t*u}>&Uo=hX;1wQC?-gg2RpNxV@;Q$8 zn()8M=Qu97CYogf)#=~xleA{JCs=5Zg)>h+aDfGaqLuxq2)_hQFV?VDh_D;${GR85 z2xz(snwMTc&2$01#TLHcx!?em!Ea~5Xim1${{g4Xe1gSoQy9cToY778dC`H_>|aBF zb}lc$|5$<(LZv8QBAdwq`!%cEur|F|_fPgjxP#9h;9)%ZIJGT!goF2DD&O?|owX@k z{iG%wFlw|%mAdSJsJ+ITRQHcK3Qc$b16>?_7_7y!f7!v0`zY|ooeyhuxx`@in!P?iRc0o1pWIST9#w63eWluqRV z5~|I8-`1R{f@|#4eBPP04rN_F+ZF8&?Kgo}*2xDa+k;mOv|qZDCh7dbTAM%ryC&>6 za;vPH@g8FFF3dLaa{myb`(WO|yd8YZhhfn`9dvcNDdV7<(A-v!AeF@$@Q47PPxjF9{>ED8uYAN0pz>42#~w0y6t6gIwAOfdM{Rfh4u3t3 z%DsZeFq)&`T@3vQjTpQG@$y7e!4zK^{;xeT&cE)7F|@iT#)ayh7(7RUvR>n%p$e*@ zz>dis{$KES^-qTe7yinHI*4Tm3qi9rDA$eN7j<-O0TQ$>(N+vWWV?tgq}`O>K@X=u z2!uRJu@v~Eun@1I&QRC*@sugyAE64U6Sg%a#k3jf&$g>#}?&9%u(V&=nfR%x3YC@PlixSp$ z_gl~NKsafnOSoaTk zIrcWtUpos9x^v6{^uf@4Auq`OlXWgfk@gK7HVBm;D--F8n&leosuixvE+!s+K5T;L zM&6R6_lxe-0P-Dlit)r{y2>?J>#p`*DBfG>DnHYmYQeAaA}%tvvNok?GIEYxs`%6T z&)#m#;U}^m)y5n{1>PdJIJ?vc`whJIK8EhEQ+59UYI{4C{aRY}MBSBb!3*ohFRZ5+ z0g1x0&a71!>%NT6)@KuVq^Fgh?FvnXfe%01?i=y4F1u3`k_;NUB|~%Wo51+?6=BG9 z14U?FGJEjgsxV_lM)3h2D8?%sCOdTySnn^|zS}|Hx;p#d>HW6nSkU*L_vsn8a*6y7 zAM|9u6}?&4CA;mn!l>SgaQm(3{u^smu(C|O72uVdmj_P~p_39SuEJvNvkKdnw9-Qu z`KhLBmmsEF;CUblYHTmQkaS&_GSE8m*+&OZ|B2f>UoF=E3S*3d@`tiS)IPgpo@h8`L^yFGuLvTG}md}|SQ5n6_(0HXygPQU5G@(lSyzhA+ zyh{7LqiUb-RoZ63cuZT_Y439Z~f_U+OU6fdVVTC{)g6zDUF*wn~C5 zQb1?KaM&-bZN=IKGT+5}BJt!nnVzJ!;o9dD>LJtPch=Urwp=9>irK!#2S&)F3FjnZ zAq3f^9jp}DMU<}>xqR)5^0hC;pO>hD63?U|heUcVh;@H`Acj+qPrY#Okg%SsyqV0w3X)eW)K}&8w(0DVj?{<+x5_D9oTJ zP8a4#QJfghlM&@-NWR@B~AT$Dd) z01=NL&*dIe=AB&G(?lH=zCtkej@1t8PG(!>+0;@Y&)$W)jKU}KI+&+eBhkQ&S0lpg z9r+)7uwg37Yu8Q`2ASlU6ah63l~|G<>yo=j1D?+&iS3cxu>u5?*s-cdQ;T}k%I)!< zPA~eBc8S0(Ds1$VmZ4FiSd_g~8fpP1XpaYIv<1w8f{eUtZ2@(y^<%XZKMk8=`3){VOm6l-!$sL;Gblm&WBCCl=kvP z)v2BOzJ@jGY(FF(g0Uu5AV$`H<+G~}$pMdj2Pcc%{1SSgZZOaS{VdR5@`veK+16KO zR(S!bMYl_2-n#+QDBhjLFe92^Etj&E1KN9rJo*gUlB!Ir-K(QMvas7G@vI zf-QNM5gqTs*n%5{>nscNp&@GNF>L5n?Sj$r$B-c^bs$-;BWNcL>xV8(6R4?SVd(R* z#;l1(JAXGDW!o%ZkJ3^N$(Buku z7Cf{#$yazZt3VEXsLbN2f-dc#Two8nh~Z~D3f)#SeRK!U$j7Up#dZC?b4K=l_}z{I zbN-kGwDk8pIqbrT16TjB=zi_BFX+OUi>LNp|E=hcpo9I>C!9!kZ)IHsJ<)@{chksy z36!@KIaqD|+j>X(p2~c@-t;6`ip(b#`~#Y$nvvr|{bqRjC62w6s^0{HiQNf<<{t}# zWBgmp_B=G`*6xgqT{*g4L(_+syjQ#<{p{`wyCN?Rz5U*yO!ww{2Njs~o1qzs*JdnV z?4mf4+E6riXvCh8_m3S?0AYnNLUMv=_ySSbOV3?-g1=lMDv1=$QF?_Td!c{!ahuQx z&w-|o%MJSDCKLM^Pi}(HV=}AVdbsCbgD)liW&HE9Zc9kgfV|0p!+T5pC4Mrsf_9-3(&`!{|$rcwWIZ{GjgTc$aX zz9vY?%SJyU!VPwlHJr_3>UY2&7W0_;7ZQz2zoxt=mxO*h24L8jSlZhP8|fk5}8TP1ymQ$no;0ALh*qJa#Mb?H4!Ogxdumesle)VZo%|Z zJd@Efw_Z-VuS@D-39p!wM596DiAZJOh+I3KPsAWx(RZtXxULqJed=q3T6+GBO3y#R z(;8%igXYuZdsd$oA1Qr}D0LYR$N{x80smBBwL7AIhIe0+0 z_ap@FfMy&&AxE1Fl}$vhR>jO-wL(V8Pv5R zz@5*aZoQ2)Ed1h=sk=fK6C5|uq4jrz6_(c# z@<%WQJ|tmLCU0TO(0R4OIgN5jzAb7WA^-Y?gWu-@(}W|{G~+#!V{RvAUEX_Bx35=L z#LZbrc$r*|hL*q3{|LTD=8Fy~>Qq>`N>uh(V5J(7J{`nXF%7lBj>x&6Rh$DGOo;{x z?GEBtI8)bHG*?&Hvc-1HF9Q5l3LX1(A?(Hmx zFlTBKcXdm&?SiN+*wT_yOIX(|v;}h>pB(Le`*8M^y*Ks;Wk=kcok$&Qj}9nXhgKw! zioREY8(1MKi!Cq@H?YtmZwO*>xPh@K<(iqm3#HtC;^8NfHedclp2p+%3wZqgm7w&8 zGLm_*;VAF~Rp7Ztdmbl&_bdrLf@D@l@+lvG9NGCU(`9-?Tkx@qynHV5P_~)jH}kDG zWZN?d1=}$AL<~i<69ro)3iA6R`<+FFLKK@P$tOwDZTh-e(0wGZ`Xq34lXy71=z8KK zT}s!Y0ncV9s)8=1a|LRyt#1oDKCr<=5-pNA;X^y@%XVqT1itnHfoZ#<6{er4uAQIs z2o1ra0p+vN2-B7_{n5_P(P!SJ$}%p>KoH>BHzM21qQfAXS$W&tdw4aO$hN9)1ryZy zVYhN&kuc9bR z@wJ9OpOc7WDo4?n)bSxW+m+2zE=TWiIZDWW%fiASjKxt`c0#BI-iv;))N~E)>b~?y zu!wN#w}Ys2q8ZGAM3Gg<*PtQ*??E%Pq`L|9xdZ>HAH5dTpt*Zjwk)#ciQ4>(ol}e_ zK$z{@w(ag|+jjS~ZBN^_jcMDqZQK90ZQI(}+?(9H$!4=pRWDUfC#j^qbAE@8ZZ#N+ z-p0z+R&1UfTKDgl&SuGD97)bBDITm*`nUb)heFU$HSn7g?4En^VS1!dVC24iWfz9s z2zR3@Ii|y|>6V<9dS!i-rt z9Lwb=5d{5>1|H(ZPLg%m&$Bkw(iTOSDtj#mwF$j4C*0P_djg91d2=X6so>U#$gSigXRHsDA%mxk+nWIpb22|lz?&KydXe!AC+6p)c zUa>xd!CZKX&&yRm`U&MlfCmyZ0}N3Y+00a-Tl|9>cikRWt|vG4u;m|ws2(C?S7he% zZo`H99u;+?=k;@51tdEmD6cG~x8+B3`=Z{mq_Oqn8yIwv$EEvfDVbe;1B9A5RrpEP%%R_Usp;oG&+aCC*G5M!h z{yr(jZv~I#bo$ibvJwDarPxXse-Jg4Ff6vQR3~fT0MMV}f;4l)$2x>4LhPN$ZECKz z&f7H?Xi9q&Ig-)arrb71gWb`i@F3>-*`{@CpI+8ls}8<+c}ts8;Nie^6V%d%;9 z(=n-${9X=g(l^<-^m5{1&Jo_PgX^q{(Iu zuxAFy=2S1>*+F$a$p5;}c$IH4Yt$2Hpg5DZJ2TKnkfuerJxI~RJs>5`V!q|blPq}N zC828!@oyblr##4uMlvr#mQS|#xA9OBb0I8vXD3l0SKP|<5U=ZzZY5pXAlA<1a=XxR zGv|d_XV?l=xoM2>z;@rof*!imk#%Fdh(Z2VVla5!>8bs*&NuYqKAwbdOAt+eNm9p8 z(=Fk$)axN2?K4xyzvHnj1Qs&!vR90=uwALSH<%IHxGnuN8GX?m!NykOKD0BWR|o+Q z&*fo1C|G~hhwH0GNiE)a^LLu)y^aa_v4+XAx}>{SU}5Hg7wgH}%uw7YpPp%m`ST1C zQt`06vC_-8{F?^LkSNi1kraMX-BHx0y}N-@9pqud@H)1fsfjn@Y#1usMA<#9lio#q zHmK9w7OX=k6m3jf`J`tpgIi3qOKwrmVsJ!!V3iGoco7OY(!0L!)~G-%70n1+@w*>b zv~16I=ac6ho{>G(kw`fQs!F3haDF#Ks~}Ep?h1Ej^E3Z2RW<$kro33LUqyk+@2f;y z(kFjpy}2`auBHE{0&2ZM&3#Mc_!`kIOs!K$I}U+uK~om+9IEzEZss+nw+xfDBDCSB z3_eY1^ssCqpUn2G;Ewlj(CXU*79nh+>oMB9`S?Te^6~vnXv>}Yv0`!gsV$saJTX%{ zcv$_O}xuW9wu><`|?V3nP%Dw1-dtaVt=K|2tYzan}oPt`av$fHbD2Wy7 z{=QWCEymn-7E{N~v0kqCH{C7BG`+rbu*GN+VE0u188@V_;ROY3;kklTb8NoEz}#FQ0D_pB%H1>8y5f( zeB$28kO1%0(8_oI&trVmSMF@dm;(C)=X`uth5#2J3e5S}G_O!9`GGh+BiLpp$<+>u z25WZC#=#{lxd*X{?nyV(l>rht8$;RU%R4W5>hXt3&3xiaLkxhF{m zd(4M4J^2>TzBUR1!UN)hPB|$4x1OpZYCRDe0Vi*>7mcGtXRXp>c8ANO>h&5+#LL~d zoR}1FJDu2J%VxCtR*ImbHa(BGgzY39BpDYm5<{J5b{gq}pfo!S9sjYDVT)ISJ zDQl2+!5kk}sM2mW#0WID>H?M7km$$k?gAC!Lx4k$9#n92iv?GOoNC!U2Xw5)HqlR> zDE)A}?fehCDl4@yB8v=r`#30>`Q*kuA28&`$LYigtkt$IljRxKvqApH2$JLuU*M9> zM&uI=06*3-!28qzwZ~u9)7%U3h&Z>>J+*b;Yd~vU&b>S%!=P+jvBr>&E-xnZUTDLi zeqM>_1z6n#0r6|mpypOV!S`9rycgDLq&ln4n?zdk^4rPp)pm5q6c|5EU4Lu5pS}*2 z`>-Dpsn#u;@xCX^XBQW>IGipHPN^Q;Qc;174GW`eMxROrYJKrlP|C%;{BiIHp=MXM z_nmX{D^2{Y)G*OnfCNxIkkOXxba2vG7`4R_I?!?T=i^nP@g3DUB1p$zn$O;!fKgpP zi;S93qYSs34ePva4Z}kh$t!nB2zN&HSs0hV4cj#dN9ylD){ej)rTvG21L}UDs(`SjczPT_3$oD}u;c4j#721@R!3IE?^aE&2sPU_Q9`hB)^ zE`uqe258!Jr)`dnUu=k{V;K+^a&Q4^A+0$@fr$v7 zRQcd77w+3MG75-xQH?H@Pgc^{9z}%nJ}sKYnF`prRm@9M$&LF5t8?<390Mz3D_l&L?ayd&C)H&-j@PpZ3QWO^u$#eD?*% zy$>X`V3_uS&%g3&5%~WQTiak&nY_f|v(=1F-D~QsuEFGDas{+TJ7OdFkjQ8fcDiPj zCfx0feBaOcK+okOYM_)g*4Y0JPICbOS)STKNzn|87*DPiD{O!_&V#1hr8jgcqQ&?e zA>rK^xF0e8%5gN~`3=wt1Xr_RYHC&#Itf4@=%|@!Cl^3WN^Gf(&}Ad`O`7SLH{oH` z_;IV}*9YV%;xt4Rw4||_4)3)*h!?Z@LPUe747x^GH&)mD=0Z3?(zA6aVLRdG>&kII z0))X-g%KOrZnq{H*v?g|M?53WX-S+?887f|lMn)`F2bNb(dd8OXrQJtK15M*Q}vs$ zaMq+cKAwRD{`?-YV}w-0Gvu)&dW~J^6EYAdpUZJm`p2UrUbXc+y5+fkNgiBxhb%1I zR1Tz!Ql{PXk(9V6mu83r=+8@8*voaPydFVBSRR94S+tRUeqD7FURw)mJDLtW zE-k39Y{F-+1c|ipYev8Xr49tTG_LIKH)Go10o~hTRwpr<90kux)MLcVyf< zFRQ>wD7!~LHbnF)MSeidPIu!a4oh5nYq_@*-6s!*i3;zyhXr)Xk#HVAm>V+PM7SFUsmggdOs71ai}h!`^GC+UXxGo z?=Q78khud#E%xrqOo^<*+N`AhsDs36GI?A4op~zK^^7O4r48t3h%66yCQ*d(O zLD*T6%V85i(-Je41aS;S)z&2S3>{O-2A3C!En&1pCGYzBN~F?D6R%Lwq|h*3RgdZ9 z!_zWvce-o0Pj%f)tXgc}(#n(;+gH>$_YtH?AeNz(p~BQl+Y~<>3r#lZ5t+adV{t+r z99F9;hL@fE?yd9&p(2&l`b0*6N5i=9S@76L;r z9oP%MNFX~0aYF@jU9+)OG&hBeYU)ByTDvudS5wlzlE3OfuXi|O{L!=Ld<6lq;b_oZ zCq5Qs?ar@?Iqs;-X^C_Wrz3jz%2M=zS)1^@^{!OAzr?ld>}~=HD+AWWP|?#;9^JJK zY766PxXl|bi?%c;bh)z=oQKNVVNW(ZY0cUB8_`_I^+ z*ykt{UJR0j3^R-tW{s;N2;43g_5!(#%f28xj}e`>2*GjfL9T~*L3n>5c~t`ST8V_u z=`7Hff@M+;jit6ZWl>*4>oOLbsv#DO&ai{>)Yun+B-ElZTIN*`(?P=}O_D32iS>w}HW_ZO<*ryg9A~jZ% zE*A`AADEjF2iq5%tPluT{nRCGw!4kQoUj5hH&(wFsTXOD{wc(rdKPM;!?4ZNJA-9P zMHr};E`cXbY#{Jv^&2hO6w1#2EtC$>cL5tTX{1)VWy#)mK!xR$b{7D1g(W+7jCxh7 zh8{#^I%6vjH*w7D!8LT(^32dWcE|TG_GB2^8?CUx$$C={ZTPK0=B3{K8?^g(EoQpV z40uo;_%{W9$t#cv-f$xljy#JX`G6Wp;M@_Z+N2lT#R+h;DhX$hv2fFjGB{SOb4{N> z&>N}`HXongm@<~ckrYLl4VDposcvo4#5Z2h_-Qd)V(G%`9@a5)kt&TnHi$~dk#~Jp z7MH#;(_#2&lqo{wUScI52%?Dz27WITzMB^@GRcgL)OcCq|Nn`z%~dyNIm3tZgf-Nf=0( zNbE%TGumqs$a`#gs3H2EbqKBOk&H)aS#T*V;C*C8JIAA%v7PoBE3Oa6)1T%uYtmO- z*p3bQMSlL#(()`kw2P*jn6MCfxrR}{j*xXJO*|tP8~K!q##;@@Wn3hHj!~cQgy%DB z0pyMAWz@-(rTn`?pUwEdYRqNV3{==PxLSPAH?quIRj>sH$F9b@U2Ge7D23>74X>dP zc;NJibL2BluvE*?g6$OCf2I%AIflRp%3&Iw+&ugbb0s`Q0)BS?#{mIw7qvfT*T+$C2nI zTntK- zHMIqyQ!Z3=-;IVOXK{9-?ih>$Z$H z4|BpGo+2DgYU&iLu7Pvc6yrAAsxfR+QH$F?&$xFpE6sJ#joE_vtlGOJ)3TFhl-OVk z?y7z^>RoFD9xp-|1q>OUS=j-LDtXRF!^Y}+rM+m#r42`rsY4(6uQMU^E*VB*w=`%^ z>@9%Z7kbGPeHrB<#(Hk^YudbQl<3uOSNLwVWlEVsKIrJAy-&jnQ8&f*7|6u}zv6#0vYsHXRJe{M(@T(JTU-e)#rpuI&e5-uL=v<{XKBcPDrD;X-#0T=`O{ z67NW&b{Ul!?ZXF<58L{1gkUuoQXYaP<=7E15JZ-*ATj2SpBz zq)7}R*;V7i(G;UV@ph3nurZ#H6EbsAEZ#n^)REE~H3%*10H||REGwNebq79h|xkDRv{cU3EKdPtN)ROQ-k4s?PwD9UDfQvy2wu6RRo653rJdt@$dHCeE0L?7_i@nedH^w&L(EST6Z zBE3r5dppSx4aKt`26ubvyyfcBeZ`;y2LRYuD}g(L`KL2I1u6{phT6Y!i`5~B1ypo& zf`yCBfNsEjyjITLvHhLHnjn9%a)~ChqrOpZ){|j zS9A!@?OaIQ7AxHMhHW{a?zA1hXh?QR_$(E&r<)Bzpv-Uzp#5hx3<2XZZ|i>AXOj-j z(I4=-AZE8PDe>C9C(wV?(M8o7bT6F8(lHLx83x8Pu2xJB;Qul>9wZzHUb@%^+2Fqt~PwIGpf&M8zp6hV#>B?Wz)3Sf}x2#g48{nxP*l zb;2>{JuxT49Mp@fg*C^RmnacC)Sp8lFisIU@xdy1EOc zOU{*0LdTDO=1vK;^BXP|v5cW%0`)DutZj_pZb<6Lg=?b2$k)jItcMxngnz6(^8zBf zx|{PJ!v(xri7V$!^toB~kCGA*%yfd@y@=x6y(+=2>h*-*G0f&zrZh#)0c_>x#)i0G zFHqAXed2CSSc)Dj$|mew4jPIEkf!HK^d)x&TtfzdQJh=yp9a}>axALa` zx3-F$QjOeEAC_W77YPyKiXhjP2Aj>cMNbAid9>GbUrhi|?2;9}k^A50#DLI3{^S;n z{JTI1zv98n#6vwUN-?SUG3FzZu|ppch5k^=03_k&ck4KBbroS1d)#j_dk6$u_<+jl zK&J{2^+6=y?wSHPks3ylAseyN&cb-gwMt_H~i5w zkw%su0->7U$cGuv{|2&p<9tDEVjDm9t|>#LW621SdhER=BbjCPmWxW|dsB)5?6r8p zb1U91S$H#&?*|H9LD(Z{n|a#E?wA9V*9cks;5MSC2oAW<0}8dlQxTOTwFJH5zry&L zsq{nnR6=2@X1Fo27!XnWwF`AiM4_j6`o*rv1!^-0Q((5;+vN)X+#gtlX=dr&21nMbY@qlhqr>MAji4kgJF#DHSVfZ)udtk7@5@0yLi=Ssa&?9vL+`ghx`5{*Chm<{-8dqi5doWo^Ge) z8G1zX75p4-REI|r*eKqqb4Jd10*0v$#kj>0rWeq0ykW|5I|aGN&D!iAv{;FR4LAH_ z)+Hj+)fHAv@hsv{E%fJ_KYr@E< z$r-Q>AHbKBOKb8(xkmEIPn4IPIIrWG=)~c{{EO6_D`Z73KB)C8uM|-mpmJGSb+~uy z^(?yW^&@`&f=tWC3Pqb?*{u(D;m#p^Kj^Mx$3*_bzm77N=ov&=-byQrAc`46XUaF2 z_v_>DN=dH-t2v@_?>cOL_)$`@#sEqSX{|SsYbHKQTIj=sA#z57?!Yrtl||sBpHaY~ zdsrm^6nS13vh*{N5tuGp*qC7>!7}msBUY68RBn`I#dpYaSLzROja5=-@;1qKGjSH7 zTK91nfx4_zYF(vN9RPanlNNcIC{mKuumRv?VD07}a4Sf9BC%a~S1-qwq zK=TsoI!dnX2sgM}`UN*)c4Z?E8)p2i@}wq0yD|~<5^iN@#vZf{NGqk}Q3yJCN7g2H6~o-gRJCC|5H%@ zZ#k0>N*&&`vjUjw6{iPk5lzzX6Ny0}J|`A=k(1Gr{kJTEx(&U!djbx=vk1VZo}_mFuuRMaYWi{zk^ zroQb%Zv6mu!(04}lDO}(>_M{5=~t~Ygd%%ne9Llso59Tr*>yDRGXfgwW(9Ww za@9AOsu!sn9SGCRmNLvN*6M>Q$L0GhJ`kxFD!-bR_M<+X9sBI>ZT8_SYZ=bXdJ4Jjjis z_1RpX(w5Ah3*_F3FPYN2pA;+PNE%za#XD6Z&@?_&H>k% z0%zW|v0ku?z`{R4%cgUHU!vd5{kvu2q#evQ82ub=K=|HVujp=?vXR`QCC?|P1Z~0J zAu~vk>s9g_=9r2D@Yl0P?7O4#J~@=FV5Z{Vr@0#s@syPdMEY9r$gkpdG(`0j(QWbL zJuMrus^hVw;(C*C`0F$rrK1#;%*VI7HPNwPEg|{N8j@Qu3CNHyr-!xAM_yTE!d)teb=GB*dZ>O1R3 zM$_rl=7Z%W=MV@}EW__5?_1j{YXS{24K95l~PF#KE6Z?I>n?jqY8hvBh{HfL?6rd-p~E<~Y+Zi(Pw(csee_ zK0{g#9YW$u+A1W-cj!q$E3>9!evpUZ4D{m<458!;UEWELoCB{;3XK?rYwZ1V4>~wW zIET~3gtt@LDf*E$ABWBDu3IT2SXX9RyaWCC`7n2*R~O1HD0B?Wg!fzWY6=}p>dXF< zH?82YrQ&!BATlEC>9rJR&`$=%6tuT%=QyzQZDUiJxAxp(&u#gpf{7|zOokv*OPZDh zb-UxK8cMWek8V(z;d5!>T6`Ix>_x|p;*f!Y|8=c0M8(DPp#w8tg!hd?1B!gvtsywm z&Ji5+&&y(<%r@~UzW#}#RtO_4?}l{Z0Cu zE6d|0NYd4Vk<1pJYQs7O(Vc!~$lraXgIaj_i)-Q-_uetBOea!k5ftKK-H++k-i9Ked;O+ zXhHcdAZI|+BdhGmVg%<+y!oLW8$SBhyOGdiuh&D;?6UmnOn8*nM{>zE`#3pfju3|90nGlRM0GFNXGx88C6w}wdRy0*U zcCnleyI{T_0|_SSQOr z%o66p71TF9wO<94?<0F)E=k}HYM{-w=q>b(JZg4k4m`idjTvDneQ5YD%th`}QI@q> z$5`X8Q@j|{N&YtfE-#v54A=>5>_plFIL2?Kfo?|IF@RoUI?uurxBZ^co-e?IiI8hV z?&Q>U>9x{%M(u2>m8r-QSJio&lse>`oxQs|y0-Fk3U93d%A;0j3zBo+#nu}dBF**4 zM4=X+V^TG0$?-`Gc(F+VW*mV_%y<=N=IQ&cWOy?AU&THOI1&Nc*6~+}?Y98b@kUjv zBdwR?;3(N!)suXOQ_|axhlWm~M&k_+qf>gvxD?^+?=1C){E5>#X~>JV5W?8nn#q!b zjcg&7(${*?YJ!{&Pn6+=KVKb38H7%DdC^m#K%s_k$l$VmZNm;<*n2qph3JsQ9x-7% zG;SVB9=?DRl_i(1kE20hUW>0blq-5e9XtUhsUA7xA?$9A*gKcAUK#ckD^E4Cas!?9 z>ov^9lzxFPvB2(fdSW%VbOYOw{#{(>E}*d_JN5Z#5=VzSbwZa7a?oyP`DPE(%zh?B z=F~bP-eo_UMZgX}_^?|vYejp0pKYBywKDU}9D9l*(V^Cpg(Xzo=J<1buq{3L62#(9 zs-ew#;3Q*BwC+5ifFb=^S#+TSF6J;i4hm;xX(d5hn#ES^x_jods>-(@NZV3~m_p*0 zas0Hqx!k)3Cswo_}y-z3&?iff(6=Oo7XvgJUnhhZ_#R zw6Eh2yH7$}ez4tYw`0@<++`I=3Z6;~EZM2g9gBINqhus)g%NoZdY7N(oKjka*s|>j06t`&G_i&8of|Npa>a}cH_(7;WWiF!T4yY zWQw>4<8&7{1L_^liJCk4j_1<^BGPi_?v3!((<;ZvkHt@-<12OENr$ zM^GL*2lcph_?YD*_I$C`H&Pie+dV_d_L)=s(k;%VH8;Q0P&hQp-~a_4x7YJ4aUy1x z7>~XeLxRsPzTSv9#uy>2)X&7jX~g1`VhqMVr!m+OK?Zg`=wYN!gj9GSiOgNegQar7I`TJ&mLUv2IK^~#oUg0J-#XK zP>Uw?##<5fXlBuC2FuzRBROl^w$J8xS%1+J132u^)7?^awVr(SjP)IHS z?S;g7%De51zPPA;s!RTpIR9VLgDMx6vAXu~svN(f*jO~NEWNCU(|CP)lJHAs2>3Nc z<&S6l#H{%E4CgKB%;#vt$s&j%HA}&a7K*$?6npi-4(>_dt7M>PH38A*Qqkk|aEAT! zzJIi)Qa#=azl|44ldIPhhclEMFJ3QPV)nGk-0$#>5?tx4wyj0E58#NG1bbM!1@Xw; zHtZbUJC=0^ks#Mav>`fj9v-%%4oo;Rj{-|$8h)z`G%@}8 zPfpw+2)0}ROPMptqs9?-AO{+@)tuPi5!`7~e3r;v?DsH0I1E{a z*$cr_%XKRY+taz+VJMs##)7p@t3S^{pIfoI-*7}2b~ZgM;H#78SM~eGv|Iz0{8a<1 zt6n;(rF?0<*kgsaLSJlNCy-%FjgdqOp-E=qV9h3~&dpK(W7qs9%g}L^K=NoC+Ga7b z=1m^SS6n1M-9175?PXG08nUt%c#P!C1b3#AXybJg-@t}5%ZLi?!#&2b^G$nC@90PX zJpkR*#|24z&UnlnN2%P4DCx&~hI&chj*XeaIGnW&H20RHTQRW32$od>^zDXqS;sb9 zCaFY5mxe^a_*8!2Xiz-k*C$alOHA1blQ-Z*?(-`Ot~5T8bbh z6f)@{;VKa~7P;gzdXyXk7Kh>EW?$c&S8OhCcjedxh|v|tdT*|S&hUvI@&Jy$-%v&g zyK7JzgU88GRQJK#;)r$rr^H}6jpz6c>w>4HCiG^If+AJwE{Bk|#c?9JCbUx+J`T<$ z+m%;6t~L_gPsa4|4#gQR1Yrp-L+OtNyS}8T^9E{1uGB^)vfLI_h$DXir`wbU`ml0& z=?jJjan_U3k@=!Hq=fR_V80tzl}90RO1i1Zd-yBvGcjQ*mHA0*D7|nEFQ)uE*0oKN z9pM4irZ(2~wA~iaCa&`r%CU|AUYK)R>yfYi?zUs_eJ))2%G2vnrmvZ~7bK>9h+BN@ z6^|eX+vU%q3!Q?Zs@1FiL6#B4{fvFwi#b1aNYXwPwMv;J=qV9642BVhdWnY0vMxu# zwb3vN=C%@;OuuaplbC`s5*7gq0_xzDc^=%~XR$$T8kV;4U2Ylifi!hA9|ThI3pqGx?oh z&sbm9Ww5oI`lxydZqF3|7anqLR(o?8@}O_RXfP&o#RY!P6rD)#MMxog6Zk&3FW21h zmWTNTiD49)Fu)?lG=`5v&(9%(>fu{JWxS9s<quxL0*_ejPU)uP#ZAU&nKwfoCC z3~{=IW#5Z?*uFArJW$e>ct$U@XZavHRr4jphOxA|e{sos)3KmAvS|iwVg;hd^KWhM zGgUJ~zKn(}re9jqu7QDCWOmDByVXjaG@o2SzSAeYNon=pnGxSrf%o0^cWKD8{a8P$ zXQ6VH=WUJbjtG^}0G877%lL}1BQQwB5A!nEdPU4EV)S}>>Z#Ev&Vl2KG7aVTuUS=w z*oJoJf;OXX{3?Z`3vsZ8scjlt0k8hjUj;D@C*0()C~b9fDHo+M(G)ElobnwWEj1zi&I)E`CIi*`*MIMdT3w6o6uZ`+Z|4=A)`+=B@jCThMfD2 zEdz)O>gad>bP8=fSbT#0>%ZmlS{PBqrots5RYu6Iw&E7WJKfn;mTQ|X+^Dj5TTL~0 z1Yf?b3qoh-DRE%f#baBy8{$&e@J|05NCdY{oToJG8IdPjYetBcdBN@T3J{+%oUL0a zOA&ab6_n+o`upq>Cai46!dqQwsT}_AJB^tVZ@xaNlsgR6LxPBgYH&~8E`8{l#CYc3l@&Wa@LRFv?Z3i4e&&k{^v2_ znTJkUMW$VxdHoam@i#m2tHA#7*niOSmI3l5rKECOb~eb18O+-`{O>9WO`ZNMXs*$+ zPcOE&Ini(YGtGpudfF2@*UIj!G-*rPmhfjsi_fxdYmSKLgeI!`$a5;{qwcPu3TI_k zpqPP+;ioL?aFVUsW#_tzyQ~(AJ2-n)eR| zXp`vxVx=;Ua@*`%=Q>?5y^8rkU&Euo`TYl*p8?J(0wF}m{8IEoFxpKM5Zq#@ z3zAWXbt5YbnF8~nLFv}jKRud?ihlwBDuF9BZ@G-49U}<#Y`$73umqJ5`b7tGd-+}W z0@NG#(~dhNdx&bZM**LEfG##N&1V;g>Hd;cr&U-{*GjF*Y;XIZZCAaChttxq|9aE3qty@j~)VgpF_6f8*A$OMd8B9@iBkF#@&cqqZ9DcfcC+OFIODg*pst&z8AT zhX?&i71pb$$S!}uG?9M26$8F3DUreu(@2#pQE&p``(fhwTNnIE?`D7HHtdl^-OatL zdV9SrjOdHWq2kd}y_9a<^rBQqMn=YjyJ2$q;C@V*FcDlEdqXq`Fj03w-v5$g0w&7CoT5VMG2=T z2AseMjMsVlaZL3Fec7!o?j<@XRm;_s-NQT5>=3rTLCkIx3$Cv}7O9JhQCVE_E#_6W z_np5o@O6~q^ZDhSBYUuJbD`t&OeFf;O}L|LQTy9GGKrZmQB7%7mT2h89twffF6l{c z>$DOv{F9QVAB=vCQ`NsGoHNNS*QJ(q=fXb=fe+akUQw99D2u@At9IXJu8I-U#E~;+ zn~NP-S`Y{Ft`1G31KJP7l;>6nM_^_lr`=uAm?GK(-DASCJ~wc@0H9q4=!|u<-je7V za$WEM1zBuKz%94pJap3EQ6Hh<=FzjPy74dWRJJSXe^9In2s*ih>*VBqh z)V<=603M@p8gi5l6SrpjvenqHV);Ijy)Hk(RwRLdf@y9WJU5<=yAL7@06JEQBJVPM z>lzc46?HeN>|V*cP^S9OD}A8sHS+tsLs79AAymFNo{g#Utzuf@x{>zWR2#v3+G^;h z)$>rNu?5A`8{@%f5XRY_n)BNK1vxsM=1Z4T!>nV|TS;QK<1MZ9C35_g$nX7Iy(#2@rwcB#MtJR7Cb@)lL14yH!Q_ei8eA7 zU91qAg8>;Ml_{qw5b^0Mqis`uQ=haA4`km0!p~XfusVUQPUgN|-4Ns^ajB)+ zGQ_*KJxy>&9^G%F+%eHpKW4VIDZB?|{(c7auqLsyOa2Kd;?z6vy4?Th&$T8%)KMNS?lRF_m)2|GDMmWe~Tpb~bTj5VtmTHW4-XV`pr_ zAY)={=4?*H%E`jd5A%P|y02fU@X3iV!L?`yGjq$sK`W2y1;mG>#~+YY#Buk)5Hk&o zFc}yhQs4oPzIoMxtB_%k`AHv=#R&Mdpc+J?zVhgF`wQnQP@=(v{Qt`jYR=3yNScu* zjsiRJ{k{RR4G$^MWom7@DOO zymFY(msk5iX{t?pU-yVzNmf{P*mzj8G!(lAlT~7ikrd?n%(?g|pZzY4@{I`D^Iu}5K6}CQ5P=Ah7-`{&TtO%@`#4xXEk`6NVgKM1L6Ey^9~L`x zEofAp@vR@Dvwo}cdN zSUKSj_~43}wI)N;nFl})l5hamskC(M zQqMISy(p4ZxNaT(u+bwXxRuZ}X)IB5(;sFVI?ctu)^EJ6yf3Q3ZAY9|BCl%qZ~~)v zq^kz3h`@9*Y@1F2;%H~v&o+TB&`8olZzV5+1Qnlv8&7??b=92N0ot!BQQM{aN}wqFx_ z(Y$Mq#&*}$YloHN*n@*kzR-2u~;1BQdg_9ib-_`(C9^ zz3E0+n;Cqon{)GX0YT|eO0qUK&AdME@z^OWfTAu?xUx89M+b;d7Y$09CoD&twH8#8yJ$LR<&gwZg{RcfA@fP{jjM|_XCG7^>Wv`EvZf|VPx#BQBq>~5F zk0}7rwPl&21!b9mmId)-P=Jf*jio$-W*n6!yX(-odfbx*mgKyAjSe5Hh2hQ%5-huc zKyk+O>4xz?xa@eDi{~+y%x-uYJ?Ey$be!0<4{xvi<@SB%G`COGw_=x#Q0>8lA28dI zt5-w(goB|}aDK||`f^O|c7J$(<4mEk%Lv=i>|s5E$*|wdBKc+_x<2AdMx}6u$tga3 zho->dC<=}Iqqoc{VfzJRsI`oMOsH$b(~Hy<)qZBaJ={U{IVKJ4KkP~If*{wZWl9d= zrXd}`|KR{aKX-XgTEIiUwbn{iC#E8Gr-T6Vnm(VlF|AazVJ@FWSvW^-UQ=y-?yxD7 zXyv2EMQ#Q9^}w*J_*ZQIVy&DPd#?e0a_cX6stb$4}lb)A0tc|Aq5)9n)$ zu2Xn2xnaOi48B*pnES>(3f+DD)w{KIsV}pVR-})_6y^Q|=JNXb-WNT;4yO4`B7q?i z({ofotC{XRqV@zRVSScjbI8T0<*9m2V|KiU|!h8g^h-bCoWo%>NebDGiOC)Eu zhK3)H36LGiWcB1E?7jcZAv!;zsKg=7%Rc_eSgGE?V40M7D>i3OV3_%f^567|N2}Y0 z2V1MNs>}EMOaryLZmU)d!viwitP!&|`eSbOH;4mh_eU9g84aeP(renJ(+P4tAot1KO zu6Fg?5AGqWh*61pKBtoE3EgT9us(Y7;aDZ5Oi(0b$oo^_)ehFc6EWce8_W^ zQRzAky16gJLZeXz8{OsI#BOlsuGctN@Qb4rZzi@j|6azaod!NxBVm2S#|N`kLyOgZ z+Vwv&*Vn6@nWyE9v$xsazZdD`SZiF#^>%r`w%pDWGS4I>7lJ6-FhbvWrfgLByVNXn ztp0uQyd)#%ubNw0;SyJx-1>4Udp#P7i{37Eg*t~+g5JK6*f&j6b$Zp6^icM3(WY;a zd0s^LA=@75T7G6J9Br9qrekKw0>M%$AfZD@KwLR(%xGHqU@jLRHPRaVn2s|lls^4w zoNZvcu)`ihu)XZ9IG%sLfzY9oxEi+7bkBD0;+j=&B`#`mp?Q=C+sjkkgV5E))mhYO zrA5pf6@8ES?v-C)v;ce1RcmjcbGgN;C1AZ{GM4dVR$p-bsfDn|(n}n~>PZ~ETj{4r zRi+&DNZ%iEO25JPRk8Su|H3K&lYD6X;-NUB=euWV%1$+L=nZ~!2E)=v@^VZYn1^xn z-N|w{SPr}@Z8yUlFPZ8#_%+V1?M9Rr)q|A%0^Se_5vh&Kuk_2O&GN$zwfX0Pr-5KK zL_C}3nRO@FnRp^D=~C=hs=o`$@_TcrtdT*#Q z3-yf>E6TcTAAh_o=L;CoI;;yg(}wHLchFQz@D66E$#`O*7)fU(;4qHQ(nkKcv` z+LVtfcZIM%t9(h?N<=EEDu=$fjw4a{k!+>#YRQpQS$ulRYq+o#!7zDc!1P_y@=uql zRTufSsKejUnqDjCh?cC&u*O1V^O7fv$J-_<6XUrU1kr?udc7IsO<=4=v5!$bp#sp( z)Dh>ibCI_*(Mr`7+XMuWWJ`sac&@voYmnVdy{OZ!?IhXIP+jT=FfcV-S5C`zI49ei z#3(Id#s++$dqd2Q5f!tappP3KdSZT z%`RwZ`U9Q9mA8n>b>eMm#bslHw>A%Yc>?lSH#pF$vTU7AD+}1A+bVQ(bc`Aen?(2Z zvb;(+cO~tvueKMh9lIsc_->WjA|G3VhsguPkw(iH^-)n>QKaEeYOM738v4@9_XwWP zErT-n({v?<#eZwdT>&TD{aWYqn`3tD*0|1S(=}|WuX?V&HYf9D#X>Y$SZ!P=45KRv zNcoPWC+t#Ku-)RN<4x*z)-804LbOv|Y^!O8`U}9Ul8Od*Wq#I97CKWz3zZ=ze-wo= z^7WHG!oT@qBO*+_PhfXyS|pAy@Pw>1a^ZZJ(Vr)@t$Zd>(+}H$bt|cat@XxMunfvV zXu?W{VK`$)i$%EpV3MfkKfpllAmIR`LZ;`AUhCP4S-3H$a7dOQy~{dxIpdzf$1mMx zZFZ0)T(xuoe&9esTDp!cMUvt`RiMn;b0B5al*y=afnh>rqpv%MFNK!(ntN>|vy`4S zIfRuHr{g`oipZi75wo<%-!45F*TbWEOTt(eof%i;A^yy)R9J1Aa7Dui_G-qi7udM9 zWFN}*2Mz`~0Hx2;YBALMzaPcbr>h;Jyb9^sCB)W^(2vocpj*u@f4ClNOz^;b4L6ta zwg(Z4D5z8(*8X;Wit}doN{9k?pJMaqBrEl|+dz6Er!|=po8671v@hN^VQP~QmHDdX zA>jSNK~owZ-FVSVS_g*JglGcI=35IREku=~M2(u90=gwX&LLDV8<$F&I*C6GrCX#& zru;Lh`IFn03i)QL9IsO>C~dw?LQru^F0R3)Efa0DsCDO|p0d>!(HPdsc2Z!vX4w|l zaCl?(hXEhLOZ$*kg4Jz!q8z41y`A~lpzR#NrWqaQZ^B*=Oi!LhfDx7o%vjDNnjjto zb4q)}`QHX;>o%_+(7tOhfFywVJ} zd=J32;feXG^ohKbL;W>BK!Ss((UjOqMCm!$$VEJQlyXUWnZ_l$c~G{QIMP+r!yr8% zWoOib6VG#Vo@l8#Zy3j(#Y=6D?Ie;0o1HYDS4{}w9QGT8Wkdp9q28#tS+#x3LG)8d zdR)loQ^@LE$fvk~IKjd$g`@=m{<^Yaos*}L7i)u~#o+!3-U$a<+e~)~(;OE%fVUxC z_n?~PZyhder14ZQnAgWtF9f_vj2g~GMAaH(ETus?-i15tgi#WL7L1IkCr&fM!?jGt zhUPX^_r%~vdDEe<$wC$*b7%M+g&CMYWUzbOVV#&JvKjj1%#>8-G&v}_fh#FIqP?qN zrKDU*=4A{UXXQn&HomL%(bTeO$;2<3Ityy`V|*FAbI5DE+vZ5RQJqtqyPydZf#byK z225~UaIQ=OBVf59qP~gJsw!fTM$V&!j|pXn=pWl#N&RRAepQv*tx&e4d@UuqB^LF^ zwP9W+3|=S?3_UR?{4?2(l8lz`+WP)USt{y}^mbzkT&d<4NXySEHd~o1`_R6x(xw(l z1~NsemgppCYCN`oVaJv+?HN9niyygtHci}#hRW(I3Ado|CIZ6L4cV0*v@V(~CxTs& zNOFo3b@QCg0e+(fk-7$|XCLuvo<-{)VglYL_B_vjhbfaV_bUAYGkc@`0%TC} zZ>1{1W5nXe3}XmEUU|1y0ywjlBi#A)#Gy*=v5`tHnE-Z5^_HImCUj-y-^Wb1aG^gy zCO4)F>2^hAeYae_W0$E%;rDC)jy!s` zmT{zbKpj<2%ojwK(L-D=bcPdOfnxx_%dQRsqPabNw;G&mkk;NdXi*J4t{8DC$$h>< zD_}XfFm}>m?SE8?-@vR~@SGOaHjR?lzNnp*kH7gYb82B+e;V8agfFMrHd= zf9L(nLUIisSN(c~8klj>)H4dOI`C+s z3X3pL>R=JaQ91$1?p70#;=IhB3-T(H$r)gC&(XdREa6xWj zH8Dx&=59noqXOufMBo@~Y0ALp40Qy*FvPk;m$*G&ZMMH=dmI&o{8*eV5Q$NId38IY za76kt*KKL7$+eBaN5a@^>8Y-Md|dP7W|9QxmZM@VIu^v~@#Cjqxy3wIoKlnZic?TEL1GQ$wsBp#x6oUFpVA z;X+nP_}FyHQUb)Nkj~&7!S$Gy`MSz@H@B6!$t^CMxOo`q=C{*N!=2g4 zaWKgYo5qr4Wh=Omjj&fWus58E)W^D`{U){HU18IY1}`0ORpWw}@Kks7uV^o7^fX3z zKMOD1alfr>OHW_cTa(uE2wprA+k#&ts*Fgve+8&psIUJJ#ebpSHcoJF^aQAwCOeaG!OZ24VmN#VIS z&LUp}+U^VI47jhweroJC7n2%R66?|iZ2kV+d8v+lfY7P4SDil^<<+^AZ34_{xXKn* zm5?(&(r1mjlQAP#n{sT~#x{%+SW9NM`k6B@p4dkZ@9}oku^s=N=3PR@Dt!~`Xdp&5 ze@f5L%nB7K8E7VbKuvwqTIo`5=g?Olo!i7FI*tD_R{q&SX2oTb-~V1z*ZU$u!??); ztU6}^4W-~F&jP>E2B+wKgXaw2;_iZPg`62}l>k}NDe%ST2uh$kd@e_TfbNO^U&7TV+gi?m z)R;QMH`hU2ci4&<@w*lc1!w*Z-C8AExauELR#U?o-5AJkDr;9Erqk0ph|5JtYU32% z=)8^R1AZr#CRd%MwW==!a$h==EEz%9viU`9rKMSt!i<3S4X-ND%AdAVyj>2}HC)eP ziF4vk_(!C<^dhGfqV#jV>Ff%=<(j^=fT#IXk=O8sk6iWSJI9rZ5~=4ii=#rX$3fa1 z!}KfK&Cb|=_`T=+nZh{45w?m{MdO%e&5~8B+1ts}jcWP`e~3eKYf{a1#bUla+-hc9ux{LOgTQsq>5Nx|Q)!>C`HxRqEnq(y zh9OY#w35LALOTfHA#-acSK-K+`l=lc33aIs`TD#udTws>lpm)Wnkzg7m&v#P*YBEs$U}4sZJq%vGB$cqGWOm1% zTG=n3I2zJCRW3ks#XRI_*`%vYWH%irEG}$6^-Q;|vYM;(|yluD( zUc^RLk9}@z9?!O!PY_)nK}UP5Jd1nk<)+1+g&gQYwJnXu@!u<+2|Hc~9LEY=jflgO zuWan;d@$f`zj!&yKjFpBA6wWUZ3#bkpk&G4-M*jt+-C%TS%2v~I5~qjPV{AGF1|dX zcW;BKDp@qEsQsBp`r8FNl5aNi<6yHs`M_hV@1;*sFsPD?&H>`$SDWb2zKV*uy%Ei>E2T~`ruFPZ_2*aoeWi}fVP692U@BCznbKI&YB+AW-I87 zrdiS%OBgUJ6TFQ?SAswHmgP9z==g)OCSpr{VZJIJn1eVWd8Xam;v2@ZTAsGqUeunJ zD)r{PYY(d?dZPxW#|ATV1o@2&C}5ehNcGA-qC$EZxYGz|14p#AAp#7-_@aUOe!rMz z_b4ho9jKn)*E#O}-r!)n4>+fx!P|EnV6qd;U^=k;vOTg6=u+kJ;?)Iom|4Q<)f(2<8Bw>XZ3b% zY7C)J5w$1YhJaeBK8@$SvN1{?Bi>4cgbDq1m^M@N{*Xr}4XJ)LI?W&a&t zmNZeqUnX2$0ud+@%1d0}v}|Ol8{x@d*(&4vgQ8dQIGk2@fn=CY!G#T+kW)tKt|ftKExnkKK1B z!m@T%9-Ue#oX~5_Pd7its#X`TK2#B1hCHiZLXX~nb>X91Lan@B?K*}>W|G-9j?YeA z#O4IDPldxNKKtXG%8Cg_wzGxODmG13se<$GXA)P7ctN%0&){{m_QLViohj9^#Wgam zl|RL(;T1I4IMAabU|yNz7P$5KVs}Y{jy3N{H6OEfjWBk4qr*-w9RO)aNIEPm&csQ4 z>@?11)5*HDG_9q|HWSrPcM>i@-m>yRRt*F9>RB_?1wBBA<*%hQj&4cDE3bxRAZ>x;u?K3-^ zYGg>0#8#yPQCfG5P4T8Z+;c4j{+(%s zZJ1L{)DOB*NOrRDvTf^guq9FLfOY{BrY+YS9sYX-@x9%{_) z=GV2IJmKq(*W&$A@>OP)fx)bS&8h^}4}1rXn)s)CJ3L@mr|#!q2hX$4u21Ijscjmi z_fq6&O2>hh?(VpU$G=|~V}+<*jk5Kh0Ct}D+orYxJV!LB`cq;CH$|YP$d=R#^mz>8 zAz<$83!Sg*X&Je85I;D=;!-^D&z=pu`5yr1CibEu!!kr@_ozHTyity4Vk{@j@Kh&2 z_U&&pzJS17dR`CmK@vs82h4$nk=`3XWSak%l=0BnhfY*N^J8YvjWw+bd(^dv9NEu( z{#e`>4w!vc6-Xb?5AmG?d4(eXu-Z@I{ICzy1*p92kniC97oUSZJMaqx0D<{mAvXO$ zD|liNqS`XTb{>9#YMCEVM9<$Z@4#1LwrBN8uL$q(m*;!&rKxYX%r?KukZ(sXmz+Pv z1KppK?p%`IUj&WnXJPU|Q!YE(P`OirotS4x2RquLQ+iTEJaS$5AgSHp-=EwI;H(Oz zT&4J>e5JEOIj`4-yif}0mbLChKCZ~I->~}2*&F10*eavBA7Sp8@Is6GrYum8cF7o5 z1`RQT=bZ;1`8O9X$?Qiu#+sb5^ARiZxrN^i&2O>Y-=BV&cqIhm68P@*e5EdhbXy6} z%KHy>ur7JDC-@K8&AUY2AWuiy#qnvTwx;;{d^;K(`r&4)iZmoh+>gki$X4wrb(g)3*$aXx7E-z0 zzCEruDZ{Kt4RJiQNSsbgtWnuezqKADNQ5-`q?ATTbfDlT6kP;6JTg>-&0F{?_y{RF zFEp{NvsU_Ngknvk7i^2=MKSOV{6&bLUa~Dq1B>|JCt_6xTAe!H)6a5AY7-^46Vo`J zdu{4mI5RX7EF8iXR2cVNYxC=%bU%cx#TX7DdVd|(hVP(~0Cf$_nRlO}F+^hE!zxb) z^7ZC3q#08*H3ilNdU$9SbxjF%pL~UFW}|0Y+uVp{=o{DOJg+`5z(Nq#CM=Ji zsI_xus8s%j#UcfV;Z^>)`dX1!XR`7C1t-#ZGU#xYpu_k?e#AbI%NFF(R zrImF99}}ZUo_WI)^EPE-O27`GCzp9QdjS$tbvoL~XoDrnG{+lhRRKb^02?((t=1kx zP|@6E26rvSbQbb$aD=Q8YV21JcBms8EfGrt2U+lvuoX4WeF4Y>2M%q|i|h<`U%0d=qbe4fDxFRWOVIF7Zazq%s=aTsOrk6KQg87Y0+;1VtU zFS=F)(8WcH7$pH097{n>^Q0-gbUbjnlxfprV*@pA?1FvQehHyG8>|D_nU*leHh7M@ zfC-^Swf=@GkW-mdX|aj^M_efVoYSxZ;qY%ZATAh5kB|`-7(4a7Bd=(G z{^YWtlqCQaTZy^!P59udusnzRHXu64M6W3aTqh%&6;x(0Drh6j3MaSLbyf7uke3{uc~_(h&E{#Lmf?@@{R zme-VRX~BK?Y?PNQQWG1i*Exd{bgYT}JvY9mhrM>%jVT4Wr{hHQOX(*84y<~gUSReS zn;_6t)7qBT#Q5uk200-^4h_(@#}96miSw<2E$6mnp?I6qM?*yUztSH}0^<^~9BK?=Hy3 zt|w@1SU=uco_ana6fO)X7@yhMr9{0Ebp&3C#8g0( z;U56anj$W>JRSdd%%>MUAn6Wwa4IrML{eL1=hMvfN#W;Mz0tQXy~oPpmM{1HB)eXY zohwnef{+ARTjWTg=e)V0;GYIRc_kP;2>fPAVstW|9Xx(HtSs z>QWkU%Qd?%(A6Jt9g|4(+g;z&km^pW#ycx6)HceF$3Ha6&NThj8-H39DrPDh_&m)V zyZ;I;w80&VyUkvwzU3Pp7i||19#DXCESEau#IPL$-=iKYi<>p|^%)zOf(P{z+AWKN z(`Rp;0C>Ye$R7~Fw7&%n zKr0l*@b+55ZoY3CqPz1(bl#uKGTu`%6UN(JH^zjh zQUK!!lDhr@ zktd9TG$z%PJr#{4*P*VC#0k6qvX(hyrtsSzV8vM-W~jy*F=paq1<1_a87oP|sgw}P zw^C~YmH2y^UXq3e2>@0b5lWAl?m8H=Ec=L;fZIvPS z>8`{)n&7EmPsPr^ZAazsNap7ED=!lIhSH8SnQ)|wD&Ed;KA^=Iy;7oMsM01RV>O79 z%newvyVVREq#LY&c(Uh`6F!D`rXUv&I+zku+FUGQU~}G$Unp4P3-qFS29T+3yaCxsg;^B6;xT15-{~4Kzf8IalF<7 z$#Ggz@Pe(iDXE-m5tvIZ!W|y>TGQ)=ZP3a#R)(sKoW@k#>M4>~@%YpMjstAA`0E_y ztdK(HZa1!G)-eZU&C!#GM`TLQ`P3%#W<*fSXX)bx{A?eEr8v!T#KcBUGCpxF=f7#9 zENo2j7(!3&1DZ2(P}N9y7&;|x zcFwQ^-wmCZfbT|5FhD3nCrDR>p`)maY>W)%Ixk=Asfnu}b!~92^syl>pCwWIGtL@S zGPArif2fq|NVBe-kAaO-5u{nO&c~8f%FzH7xmVi5V1;S(d?wD6F^oWOsu!wY?+g4; z?+aas*A-r{e;dr}N+;%Bofq_h(X-OX@Rdni>?XC5C63!lIcD)=OofD}Gf%H<1YxBy zpBA39YEnr#Vl3;=5WYwBB{+GOFik^0ttgO$E;aUB?dG~L5AE_|>nQ;pUL%PJnXz`# zvoe0sIcN+Y+s1kykGA%`r0~q1#Ir?Q)1Obdl1~MZrXlc$4bR0q%)v#z)p`|mT zt?-tX@@_>m9o_63!(=9E+Bs@OC}Q)@5!QGWD(khm%vYiXV=u_X5?I9UXL^5t=3?5D z>mf~j6NlW%_VF{5tWz+VNx#p@Vu<}zm}sAh|BcK5AWJGuw3?jivRQxEr%XDvz=+2^ zfogc~uEfZ7D$=j(vMYGfP04x?b`!&d3$%&`Gh-^OVh{F!G(R!cN%>rX^EnZ-U)W+V zD!=bo-a6|zVVAIdMy5~ae7b4qO_}O=me9q@|LoD{749@3K(`iYFONa;G$n`i3DFCs zH^RK-fu*27m5L$m#*C>D=X>v1qHetZlR9Ed{I-M*a z_Q=*z2S0#ef(l^Oa=M1xCDVeqk5lxYg4ZVPGU(&<8}zt__WR@2Rg8o{3mExRgvHlY zs93E-OIWQB-cSU&GV}bpG;qglkKT1Kr_X4B>fy*p07bEugOsV~#Hx+mwFY4rw8vza zw8yN?`PVS?ei8lzd{eFxM!P9uhAsW_=Elr#DB* z!T)-$N6w!-ZSGYWBU{d(3XP)yd&FMO375)#O5ffq{Y>*~Ks<9^fNjqe-uT4LKSrQc z862z61K#*2hCh%`_ImRpyr5eg9P3R7dt}BBp7=+f7i%2RMpXdZF8+>d;pygh4#%6% zzuI<50Nm#%CM6;f7_n5?XetgJ!ohKkH(F%qTQmvRmbovM^{64T>sAotT%k#LJ7!Zt^} zmAT{H_H%Rdl;4Nb^c25+ACx%39mpo?cq-rOuQ!Ed{0&;-hC; z+stZW+v?~s<@ZKLhe#*2j=QpDN}h=j63QKXD9v}8q?&ii3~VEC9H3bni~}o~3W$|% z@di>nbXu;V;SlCMaffv5sA2{1kI~UP(?$_u{UKrn)={k#X|jE z#rBom-p>M!o4mD)TrYqEar|{{968SpmlhYfEQ*_dqtf!dH|*dpnw#o9_gUo6pLTN( z`;NvYVC2Nc8s#`ft(f;rRSYiL8J_0%BVj|-fs+MENd=RFr%KOZa+&U>*Vdy~ySv6B z_e2xoet%z?BvpArUrj`M;f!?~BS6&{G39VVU%i@SxVdFCL5~Ki<0_`mhOQBPoWDwH zx}=;6rH`+>?g96aje5sjYS^(`GV20phmCzBrg3m$Nw2HF7m40xUkN@ZxBd5Oa=Lp@ z8MR#c)qWJRXX`iD_oZ~GsNLz)nIIySk3gE3hO9=luLgp4PhTDsQ|JCDR+S~ESw^%i zZNQ0sFu&_xcjajO6YQldl>2sr9o4({`*ByBP zb?Hg_os@*6J=b1u-x{T3u^Qu#Kpj5RpN5WNEp9?Fg@<*7b6b^VM(X3r5HHZO7vDRrTt$!1xFi`32_HAM;};2}n?X+$!Tz4ry4s zo3_q%;{izc^ZP}fhp~vg-1IayLz2r z<7D76fH;K}*N&o!xlW~MSLey&*RC)p!ey9zlW&`iDI|t&uDdN#N`)dJccd?umsfc- z-V9wJEaGu5l=yz^m#ln-S$Me9cu6SoBw8h^EhdJ!_k_=&9z*brY73g4q8nUddw$Hj zvWhbr^Mep37GO3oKEmepn)d^>zVP|xplff1#0Y{{nE08zbDYehUl)g0@Q? zGXSH_>il{A^+)nJhYovtoFwa#bvWnrn|X#PrfEZW#!$zeRCPMOL50WetT9ApNZ7( zLb%+X!PUa&s4DPM%)v2Y1~*65ll|r9R^V+PS z)%d9Ic0OBgz={;1R!P0SwlwcJ@kf(c7m;d$dSo2lO#NAnHD)mdP>p%x@9-z1OUn8Qk*2qEd0;!5zI zP8%MRrBGzXP0j`aX{O)?<4h{OZyt`}*Rcp5nWLkj&deV_maPyh5$okgLupBc z0k78rM>RB!0J}W=rn*wI5PB!l@FYdEHVoOlw2m;!<#cF*dc_Q|MNf2}ztl?_DhlcQ zEgUo++2dz3k*51dnv`@!-#pjm8><8R#n!vBZ?bRbAA~YjtErCBQG=J7sdW6)mLh1U zrqoyZ`l1<8&4r;CCgU(pSFplj3xvi(Y!Vx1pv@v@I)DA=^S5(3MVYQ(a+w~&zztI7 zvyB*02p-c|kak{VH;!codBC)v80M`}sL9*~UtX^OUUbr;q(5#Yd=__;JKv`@QJaVJf+~#9R+b6ab_V;0VvUs*HOD`hg}~k zUweuX#c3Iq$|7BgTO;KCUdZLQ`vgL^Y;HMJyWMm}d;>C~H7Ek*|S% z-l-P_b9KZs;=v0bx%Gj-iI1*wCo#$wM1?{Plv;0j1x4-rm>O0UwGAo9awGM2pIYQz zl_hnjR{TLH`#ytKTV`qGr`%%Ek+GR3QsS>Oh7#WN^TJd#Vhg<`vM4b}-IeWY7@KnKW!O&W4r>i<*X624Ivza&UQ6^zgVf zglTg@S-VfCDKq!o{+Cn2x2P+SlX_&itQgI9q*?GO>+@5TI6Tl(D|^ul{(wB;p-)jb*TAcD z(Om%`Jo}-1?^e)9rCk~)Gh>BjK?=Tr(-PW1GPq)u$OIR)Ph*ceUMP05Qi{t`r|KJM zL)aS6OeP^VlqIZY$(8^enOp##&dpXljF>>ldyp0N%fR{bZnnKf%BzWV7u{%|_0-@* zpdwAC`|<^@)sYF`)~=$gxDeQ2lj{R=WK(59OHHTp$yYOcNut_FC4F!80_|j!T#Mse za$5^uqUM2)e*d!kBp~J?$$Nr$h&G2A>z}-y{*DW}cusHARz-yFX}X}vzm%vRr=`JF z@0I`lA)xEvfL}eg=I&59g;5W=rgzIeye5@c86PN6B|CaaXSc3m$XoeBJozb_jN3xo z!m8NP7T@&`mk2CqwEl7gOdBPb)X=AvbY25~>Ve1KS{u6u28MC%7}eiMHmhV}%~^fH zp5n=a@ScjHhk89`8)qiv%k9B&M?74{Nla_>UT8Zfbl(4?k?UNYz7Kg=HTFcw* zuG9R|Lb0X2vtQdne)Opwb;s)h@~vaT->4I`NsJ8wmLaweFZpJDCH>q;4~5aGvBJ&F z-zB6%Fx%2GY4jhWl?bo)y{)Fl-{T$5C%LDJxztcIw6h4*@V_TZ_@2X2F6Zv=$-fRN z?rVJW!Y(nmF}|XY48L%hZe-9!M`@2-k(-&5f3CA;V#PmNw>M&)YSch6Fa@cGuLy-J zk?D}uAKV}IE{(fJ8ZsUIAx`6lD(b`8zCBX%9MGS0Av`8B6*hL;umsdODRv^GGL{Zz zYf%Pce`EBA21OJH( zoN>>u_?8qEH8mAA6^Y9IpH^pSOV+1<4RS+i()L(2!N=q9a7gfZsPl*yLn6cJ=d~CG zkt3X)^E|l;@mi}MNsneRl+$d}-5+L9TWaFf;*w*zwPyyubWVAz^BoyVhhtq`YcAkU zo6Q==j@N0JFyb9OVqEjgG`A?)+~ct24N=iMC2J@6LRCCM$=Pr(Bi-1%G0@Ig(Wot3 z=h``VsN5MCY~pr$0yMA#FFkY;`gKQW?PTf3D!eMxLIiqD{$*ZtRbFXE5Fad-qmk7x zD-9g5vamQXJ`SSf*`=f;Q$6I)E~}O#kJ`EMAxEddlq#X_T z0bLLFi)SE{*Wf{l>NCg_j;n!}a&JR1YuG`%fix*gQ{6-EE_u~&5bn|STq{9LgI@Q# zUwsjs-ZR&Zxd)MRr3SBja9$o=NqSug#|F1jlQPae2Kj`E-PI%;_?)d(4rYSlxwAPK zm8E~!9ec28vEf^Je&z6!R~YLwnt5@w4q7;^Z*Jj=U%w6DS5*sL@zQnXxJ&SC*#>8D z?8>aLV7iY^J>8lc{h)UH$&}_BlwmbqZ~Di5=usioJ!pN#f2^!5rkh#LOjpX)?hLTqDK9{5>TWo51H`A!Y1$1d~y-rPnFj$))&81J@|%q%*|>iREwvVQ=0b zczmL*X4nKQ=cSII=lTg!RfOZ8bE#`g!O>*mEmC~~W9>Gn6;X#z3<=9uONO&9Z#rc< z%v$^{;q&9}b%nF(0-PfoUI3{l-NJEQz$qv%{M={sySqVXmk@#fua~1-R zfdhpT)V*P*v@$uQ{o47NqP_EQ{padJvui<@mu6GGI2|I(I zzfX_=;VJ#ERE@pKfc$RGo7Os6#*=Mbbf4xji?p8AIZii<;hZ$1h(rw;dY+AxG}!D5 zEE@!#LyN5k(SqB*GLd&54|d(ED>%^4A>FJwZN4~OIhXbRVH^0%_odfAn*l1Xo_l!qi(8!=rGMZ2eE7;S zSDv$lZt}bJm~L7=B;27^TgstHqBLnIiyFjqL2!Hr2$ggwX<4geTxRWqy5`QWZPB}# zzRqW6?cH?kBvqa4bIrUuNdBxO@*`$gr*(9eRhQM=*ETg9%h#5+QfQpGl zj^A;>?}zcTim$W%b_NP$y75n*S#Q(?Vuk=Eq@()EA|PXd-QI@&f$-YBJhb%c3|f|tO&MC%PSt^s@RKLaZ9Ums|KfW^W)bBP805SuadL0YH6Zr{<{}iBAk639u+|6 zLN03UV#sAGWO#tjJsTq3WH6oV8!vd|h5g^EsHONyWZL$}XE-k4-K3tk>}g;mm$!?Y zv=fDjYSOlEWy!a5zLDEkToomzE%bQTR|jpF*3+DX?(UEaYjl&zz214p_sgpIJ2lLZ zBRBvL+|vEpd3no|mVW5wo_B>Tav+EC9^o-v@Pg!XOv~68^|$qQ$OZ%PpZHrD8_rtp zSI1giOBmK*?bZ5IBqL+}&yVdnv*kzhW2!K|&zGfpZWOa?cYB2I_>rxut|_DL)P;ml zcblZ~;Jbigz2Z8V)&rYA7SN=mk42BWakLo_7WR^)ovod^*ot>!@T{)$9a79LGEL4Z zBIW09Ems^WIOS37@=%e|k#}Qjm4LIpW@Po+LF{#vWu_g~KpaaP_N2>AmDOW4?|!@{ z;-rVof45FVzJ!DIm)0PuJtnY#sHQUFdlH;7SY~^lPf@CUKWpOa2DWbtcvvgb7oQG> zVd`69hN#Ab<&yF<42;jLx{0Ntv2+H)hO4nDBV!BTdLUNyOQ$*fCF|_BURM8{N~v0l z+r=nBGb?1|5}M>q(2z|N?f&@^GeVxa<#?;`gckKZD?bGV)jHq=yXL&ZeQ(0(v)1Ol zFXJHWz+z-ayc|Q%zUia+1$w!`7}}HMk2=Pni46svg*gSKE#V%{n`e|4_G2;m6-1h^ z9IQ^ssJ&tf#4e9S;9y9|E@>m=eTLQwdy~D9QDd|3Ge%fe7T_-4{7~RH*=gn7Y3qbv zdN8#A!Y-v0uqg@I{CC;htvoLiBy1W8cRb>Viv-Mx_l{eVVl`$j#{4i-; zwfTaP7Vzy*0Boh9k0+pUv;8IC+~fRO$J9NCRaIp|_4PhC6&m5_7I5bFD{%=OzFBNZ zRh<>>^F05El9HT$7O_e&_;9!vBC#t-oY7Sz_|r$>jo4RNIIH4gTaU|LpkX;Qgy_$2 z9}IwXhb2j4^G3m7a@ao~++j?1cFd-1Qb>cKMB$J&s~@r#es z_aM&ku^tOS(l>_vs=Di?{x;22dpAoC9h!Zx$l#N0KOHp6~3#0eMw&cBJNhXAyP3st^FFB4d z|KBctGP*bXC@V4>C9>UhD3#z~!2KbP-su7>jlvxb~W z=p)>**U+j}*SV*E?&t1$r#auzF9$CvZm0Y0+toYRETcBFpWj-)`pHLw2BeB5AOQ-R z+rsz)@9Onc!Jj48KVMmm=-%Dl(U=wPp^+GVWYX)0Cj!_&$NisSHHfqXG=ty^Q$C{o zqYn^ik!r&=PKCkPQ20Mv{h2}ZP-;UqM7xQ0WaemXkZO}IQt*-N(N`%uNq4N72<vPRo|+NW*Xwr$(CZM*xlZQHhW+O}=mf8RTAV($EL-@JJd6{}Y5`o65l zs)~%voh#RdB~Q%xT^rRns*6;cl{k72G({{gd^`f^rq(N?P&xs*B3v24lale0L<)KV z_>t+?RVeie1^E6KC9s;3_h(AR1umAyUxG+v4JJJdeexK;D-Ec)$NDq#3QvuSfl?#U z9wr5?j3wCLhFIYnmNEgv47b2Qtqtcgm^)1kAG$!X1G`OE1~iS=aBT2vFk18y>s>A6 zxz7h1xN4r5hDrtcD)%EsnDA2WWf-0O2=_x~Fld5Y;j^gf0JS0#{gJ-ahAU}0doh|% zP$1fY{a8SJ3|u`MaTERYH-q{mbhD)1IbGd|=)K*qLEJW4x|f}Z*R;d0j&wQ=xi$;w zkc(hPYln+c4}9nP*NS*2`!|gqYTar*=mpr%cMJ!yMge+3+|~^E)88=Z<4IWyYgq_3 zzB}vo>VU$T;@5Jx_Q|GWsMPq2eB z3^C0sMIe@hEiG))zy}TrP%HdnERIPj1jmm8zbd1SdCDCshdFntpU%&|ru*e-rfBxE zAUG~Ut;m#X?*oZQwc#Mq8H_!O0=dK+R`(#)Mjo_-gIti1ZgzlP;7486K(0u3;t2Qh z)Ndjp)#k8qlY&BTdR!se#SU`i7}ch|R~?@Ng=~B1Akuv--G}(?w&+y+z?K)_fNj?Z z2z1XQ55C?@mF!69_S@P&US=WvTv&1s(DRt`3(eL& zulG-jU_PS%pyU6b-L!fy)-zN;Acy>Or5g1Qqoer&yOy8N;?H7zvA($n3b6@nuij~K zU%d-GJio&or$t2WalDJXJ3ctJ=N{MiJGlNd)oFbVuSFbpe8VXwarm=sf?1HAkkfbV zy!9OLf&2>Phm(>6xD@G!ex!Kf%ij%o0@}z!$Qv2g5eB(l9;+Ixt^BuqPSI?8z$DRE zFq;th#XD}^9m7!ow1#Fr)CAZLHhtP}%JlXD+Uky} zgaiE3OC^ENd~h+ql5O%_b;<`~l01mym3UYW9A)g(H=d6D*(h|7ZN6Tu7yJE@#d9G)$v3>$vHD@-Q(vMPb zVl9HwU2@EkOT$KbGHSd>Xj&IBG237IxHan=;Oz^mWYA1^;01N&iQa7+SAcbzw(e*S z?G0K(jp>8Fns>&Oa53}E!q8dPO&|TpuwsNV=8n<~RJV4WbD&+BivEw~M(B3~{mr*n z_iJ#&WX;0af$Oa%RBJMxju`0^zjRzvkR$r0RqNXrGdqxt~MMC(5IAWLU_K-Xyc zYgL5WC+t8R&Z!OQOn&PsH)~N((tgR&^P)c!r3W$?SHx`3EfZMgsGclGAILen>_y`S z9KLm`ly@{EMRAxn3pZcN!gRb)`egl!kx#6g0+g;OtbNnlw#=5mOxhQU(yRlGoFm4} zK`aWo=bGAO{wd0NUeC1rB5$)>2($?KP4%P#90PgKh&U*Z?vci_DPR@4?S@VR6AvQvHfj>J#`!sZE zpa1IjFLgzo=(GKKYMhBNp+`X_WqU4RyG}>N3G&U{;V{iqbx<#93*zkwRz5j-VYp@+ z8o2;o@`)~Uc*hPLmfhze?A!x6z9CyKy26aS&37M^r-5p?H28+jW%RnB#|dUM>(Cx# zxL1iHr8Y3#_E)C##m_;PKDSH1@BDB#8M?1e&pdx4T8=(qMXbGLI<`r7EPS1VK6b-+ zJzkjBfO1c+@%uzi^6iBlaN_`NBWX=W@50F|Gd{9bKs-f z4hdIbZYGRO%VlwQoSUzHZGh`s=y|yfy?Lpks?EMZu(3+n^g%X zN%U*|FyXrpI}wPux>A)RiKa+n735rHdtolZGi9!_v7k!Wl8}*A-&=Y)(IG35BDczk z0Z!DmWG?sNHqKh2TOm~ba_o0@+VOLK4K~wW?)1qbPzCm}NYSq8sm$mA6>>y^qFHYy za_jP~L?=+91z!!ueG61{%Bd_wUeaxWq*6JX-}H;sj`gIK&qE_c;7&E5_oV<-6NhUm zKH!9gF<~T~9s{+L<0%FkNy<%@u@!MC5_xk*>kO0Tz$txHv)(Y92NTVlgZZlGVx9JB zT}!-i+*p&Q!YSAlXHh>R*TeeIMxU%BO#gW#l?$BDx*ho)0 zni_`XBv#8&%CW5_XFwBn-&(YuwPHF31I=otkMful%^U#ecDM`2}@ z*{|>pyC>O`+%QCeiMJ@n!uOs@2}k1hF8h9ULs*Q+cxrwmKz z5=2|Z=VudCoz*&UI?p<;+S6Ux-rS7Y@ZdvIPH!{fd#qWN_l_4ep6$mGC-1B=MSIt{ zhSQ3hj>H$Q>1k##g`DWAlqS;C>DL5G;XS_FDqVrt_Q%Bg+;f%oV{9P~jgxBTVG`)8 z#>*%DUF3)U?BPzj%u?v$uFv0~l{SDu|5mun`d`B3|GgGkmfQ^hpp!)a_un?j_Fql@ zrxu!?o{65}f6ziRGcvLMHz_oSxs#@9+Oy8+wRkeCdIqX^@yBp%el+|-e$!aUyzV|Zx4kCttI%xE zolQ@@t3jvLHAXm~4*~&_$BBhOpJ}Ly7Jv_ghauBk!Dr7 wLNGc-AAy4>AQ`rT-2 zn|=$dEo|&{Zs&1y0#C|83*E2b`;tO@Jpz9p0VZ6jq$XsgzneV}){f!lzM#v*5ZPnu ze-rrfi|C7_Xzjb^(YXlJXcUYon8N3~;5o4JCz`&Bw-~*}0<$kIFS5@a`>ViSIpTf% z#vYhPr0@qeG0n^JD@xx0rweT)13x50n&o`F3R5jYB}D03C%77%mVo1Sec2}!m6hn> z@k-rrHLg1aY8C^h(HX?8?6LFD7vg{E6u1(wQNxWK8A1vd<_;Jiy2m1I<=R3D51KSd zhzn%7W(p2A@pLW_gtl+fqQR|A1)(-i7kAz|;PtAY*Xs*3td>%D_O(^kCbWrZodByF zN4%&yZFOXuuI>Sa-$9P+A@K$MKv9Uu$2X`=&7_~Dyg^A|&7XVneeQieD~jYsmQ{K< z!99&Rj{Tza9TzQFZP`vo?D<1~bD`yn-UG=c`n$fh^OnudtS)sjj?P#+Ot}BHis3JT z97HPC#<}cClR%!}PLmd_t11ccO1yL(hO>(bi>mzDqT^`X+0d)hvzh6p!PiKHRJIu7 zuxklJc)JsW|GZ7;Z(Ex6c?1l46zGzIK>XOzcAs#w(MvMSL;OT!$6-4mTzUu+WZYT9 z&<8LV>Z{fJjTcns>oy2q1&-DmoK6?GsbUi1FpmL2y%8=VKjJ?ok^No0_9V&^`#D!3vjh#eKv)E$rMjBZFRUDuP#_iqm8^xNl*W% zCacZavRsO7r2V(X_-s=~>6K(2k5<|5HWV-_H)1O}R6V;PGxmGk)ICu4+S@X!3 zLb9HlxqPeEHd~VMDat-csjV9J~dItq^de_zRyuqC@8&pL~LN%P8r*>?l7I(VM zSNvOz@`wqLIKe!UYI*EX`ADerkSF5YRnN^uET$zcM{k3~yC5M}Mr%3bR<^W~UV5M^ z>MBH2G2JawHp>Da?NvIBxejgHE}x?hz4vz>m5x~Uc1dloGE83~m$@^Z&pjx78j zJf!CoOI9;*ih-YuoK9n~Agkz+b@NBPj|SO$+_DqMCDen;>7QxAg9$Y^a%xEHb+`p^FtN^P3#qz{)sEv6^zbr=7XaD2{k;4J#M zE~`Gv^U(37r>J{_?f2+mYb#SIc<+ez`8PifUJM@aB%FFRUY-s%#CrH>s%Ymf+oRjr z9afnB@P650ote|KgW%cCm6?+jJFbmb-Fi|Ex#6V#c}Gj<@b z>%+qaJ)N8Avj`0aP`C46;LLeF=285^Eh(X84mMbIx@KdB%eiCwzKJxB+lS6ai-%|d zk~^4|#^wq`X2Zv(eTZ*2H_hLQul-WpUhRl&HF2RPWmO1{OrgM%Oy##PD68ErJ7y~L zeZw%LjQ5j;-6Y$Fbf~UwEfVhL`YApy7lR=vPn(=tv1Su{h@hYjJg+}C&wq2G_98yu zhkqmH$hRag7>p4zQFZnnWhBn-46Go^Ac@bnKAxDH+B#Y%1hP7zvX4mIlqo`}R_&*9u&kX+EuXmQk~Efvo8A(|YDER5N0YP!lfNK8f`YV{C*HGK-D9?8 zI3PyW^BscHF5=!>m^3USihgcPib&32$SNtlijrROU~L~SUC^^>f4%7`n|Zx#hQ!Z3 zZ|5&Y@aXoMm8N2>c;_~rWEZ&aLh3fn9^hW%Xq!Cr<%}|&lpq->Z2Uc5Ho^91Ef-I* zsI~J4o34E*(-$~`c`4C-9n&~#c480ulN>Tpme_IIT+A#q&7)jPs~y0V4eZ_tW~Vql zlB6_s=cZMd6GcUHy}uRZb$!?h6&#nYP_VrZ*@DBdu;E12)>Gy@fop4i&2}HVedSibu}Y2;WpaWUr^EWJ;-xM* zTA-uWv9a@UtU-QyZxZya*G|yH_QAUa+s!Td4Ap@k^XD+>O6V?;E4~jkn4h%O(rXy9bIDVM=Y}7?3A# z-Hs~W_tG4fKobew;;`_`x{FTy5IuSlpChAiBz-gfPAHIlRs&7?g%k868aJ3Kb56l% zzfVSL0gs27L2v%(d?Lz{1nsY(R~5l#e$0mhcP$!Q5@j7#!?Cd`2WHiMK54wnGwdvn zrQ%8I2Z(Fb%(YC}QZ{8Bfh|I-9XMKm8k*r#<#|mu_A4z3j}puU!Q^9?z}}X-C@+KKf!e+yj{n|1{KWYIrwB%-yj+q%?16l z{4NxWDD5PK*MJMdFmU8bMEcj+ZFSTe_F9&Q%265UmPGx7{D|3ska?n z+o1%ghVPcG2ZLz))XPAc1ixB6H1dVm2Zl$(MH7-)ZfP7LW zrN!u%m?LgOl(@FgW{}e-j_!&h(q~&4wJ3-nB^bQT&>0Goz{plB_n4i!>Co-XYFh!4R1)MM|K{1pnCS4@(q$fKm9jlb5kWwPmg zO@rxT8Y)&lMy#X^QB85=%NGcpkVEhe2Ffj1vkfiUH;y@JCqq^?6vay==i7LGxM_H8 z-R`y$wV#Le9E;7Hd08{JNvQ2b$NKv(cB0N-xX+ZG3&&FdNFOYKk2e@zxtj(ljrd+@ z(qRL#k@?FlK4;hosgwZ^V6+Fc7pwOsj9NL_daJ=2dr2Lz^|{8^Vi_6v^d#~#%;3x! z#MC;Kr*d!cv>J8^Ym;)B~*B4PWuc`fr^{Ng?%VdQx|QQQxO z@Sqkg%Y`ZqaQ>!BQ`-q!DmT9}jolpRdaVbQj~?XnWxCVL+Y;Bk+6N8jl(o)0OLfS0 zQ5Wkx9?eT?)vyLP@E%XlDa@kv1}JCe>twoKV(#&>qok+kq~zg49baSO59Onh7^mk- zCT5!FM=bM*D^54F?QTKvXZao`L9ZrY9q^lr8ktOpou@-Z=@}-4K7Zt}9(;6hU2F<{C0gh)m^{l4O z39%-RM)FG+&rkfQGI2BVb@CHq-A2K$52~38J=fcFu6Ql1YsJe2)b^;aTuLlimMLk_ z_RbHPg3-frJE4ko#gY3!Qd0LVla|&y$cN4FCHn+>A0b0Z=49l9G!I1Y4l--(nQT(Y zhiE;0{%Hh?jo)~lXHgQvU+#{qGOi-UqZgHvS_afCE(ay9iAt+D74uu3wvi8%edaWG zN@MN7+b8|s{#HBacVA=?5(fGiQT(uqkq|jYSf7j1-fCH$YO%(YEXwGMdo7Sk@|$wT zwZ3wMPOR#`_3m*64P}v!5vG7&f-ZiIikW3HUO(2G*~wy)!|_5J!(P> zPiA|8+LYtkaA0&f7uZ!DM6eJ0w4gv5=A=_%s5huDe0&YjOHDJ*uMGR#n3*%MZq|@G zTlrWRiHd<G*o490-91kwm05;vS79U?&r>@VHbssvgEZ*2tTCWePfh}Rvm(N)r3tAl9 zDH4;$431?4F+)EUzwS~evp<#`DJzaOG^eYoGcBXQWT|Mfeu2f{>Tt;TUI}E~yt1pW z|Luw0c4z;d^E=@Rf7YH-++U1cT!luJvSx_;IdQPKzQlu zU!$P5&RC{}M{diq6Z`aBd-9isZ@qR1Gu&56rLB8SUpD8Qx|zMrv|58D>#?@?3vaf* zn2=phb{_Nmd>cO@exPqHAm^dAb$a$ZIpo5ajA`GzZC%GMvRu{rAh_KzIko+BVKp@l4kU^5nqI&RufgG9 zM4o8otmk;0Ria5LlGAlwZ7NEsA-he!9V}|!RG(}@AkWk9sd#|9ZC~Z$P0J(RE&f`! z^J~dqv(f34u>6#jhbRXTULla{=Fjo6t^mbi4cW(pB%F_8_4i%pL*s+Db#;2L7V=B- zhu&KS#iup0&7G`d&&&~nlqL?_eGWfoI3noifSBZ1Y{E)h(g)*$jFO0k+9i={EaEoA z_3C3};V)3Lo-=3)BHq9@)Y!<2Q1-?zrUjN#Spve!3W7tX5Wg|cQ+M4wv)nBi^7)rw zjYz8(JO%7OK_in&;nm%n~LBZud zm)@o$JbybWM0nY9`T#liTMoHup>j}vwiq;mXNhbJ^$Zfb0o3f?+iBd#avOzv`F%jS zD=U|+)x0I1J)aeNXncY`+Aj2rQWzKmjuFcFOd;Es<7&j0LXUuZ=XJHt{a;6nz#w313#Mv3`9Jcl?g{Y?m~4@zO*e z)9J3R7qLaN8|DqHpYdUPwC%AiUHSg1-9ad=!>9%z8}cCkGyA)dOv-T*_#_i(pbHWl zITa6PE3cPgApjgnEsE>K2XsoH;H4AD(GHcKf-dHY)E;!HmwPuK$WnhQ0kTq1|1KTq zxE!lo0(44HUM3HUYuT{`8La^RiV~V8f^ zh6o9*KxZ<(T_{VAwNDe=HlrPbI8G2-MYW;Z!a0zmK!z{o7a^>3ln3}kWbG`I(Z(Qd z69-HeCjhu6g!S9fKxH9Eadf#NohHsJkwY$Bxd<~Eq+HS*WWg^!^V(~Iwa{XKr#$pV zNMnf7kX$T7;xLlxDTsV=za#xhAW*#_dM2oQQveLVS!B1AS^1Zrgbqt;8$bc<0uQK@TaE!!vVR1yiHxpcoBA+y6Noj8VC0%`^8g+nVkPmu zmfzOzN-dMr17@UbBP=Sqhz2VcJE$m@;Sr#M?dl0PuqB1@DMsk!YtD)jkco@{Df$Aj z_EXA0sdi;G$)e4LA*=-@R;Y>bQZ3O`B8F?sc({C-1sG@Cfu33z$7dGk1<#tMrx0Om zO}2Fz*Leof-K^kQh*<0BD68Rqkb(@6PiUPYdao!K6#&x3U4#dD?i#wE^D;@mbX(x( z9W}cLSRe96%oF(P^xOPqYNfxmqh?&qZ}1EmN%05Alw`FznV)?@^Y z;Cfq7*RrUhe+=4p)}ftg2USTi^J=-4hP@h4qxd&L37uevxQk9io6(};h=)HR_qCr! z)Nf*liyg<@<-!-rct`tTXJ+?UuGRD{Nz^Z9(_l?{KxbayOX0|L>IT^|P1`qaq9*^w zaT{ch3Rrir`vBw?SX}}|jsVZN3WQsnRWZmqTvY3XDhK+;Pcs2e8nY01+QhHE{Az@y z>ujjU?RAZQ1wV8lIvsAvH@YMv+l9+8QFZBtT^G>e39vB)OZHBiz+v? z9UpkC?x3Oh0-uN`DgSqgQ-*)3+M?)e;N)&+Oe-iZBw}mhr1Zn-1pkKwDkCc!`@beo zqtu|(lor>v2q$omgp4`E8>}x!FVxb*O0fkgXM}`jB$%W@`N2ZYdnfF2b~*5BVv4V3ZhFjosN;F02g#%r&Wex^HK-t0K`xaEBtg{WQB*0^sE{vPZ6W18%nqI<`M`H5*Ks5{^Z^wq zlqirddU$6Z_XocP*|A2kc9Fs2FCJ$96oCtm>PF<2+lwHtCW@`a+ zC|OnVLFRh~dM0dvh|FhQ+$_hxKtquVnb%LojLbhISEq!P#7Ddqt`<46zp$^ea9PH5 z=1Wu-e+9uvQc9ZHsA=Ll;nVKj)ad6@EbRpDt@>1Xu?_o(SR%8*c)L`{o={Kvd317U z=HM}B{(WGaAS>N{-Z|A~JtnA_oju3qe7C@J<1(C#OWjW>9`CZ^2F|hu(WZTO*7=EE zRLaH*h^fY)ZWjM!iW!-|y24aBcJ%i^zhR+t1hh@d#KuOYo!|(dT6B9JrmD4q6C%`+ znpa|%y!}w#+zlZ*+I$FRr_OB7(z&%-}I;aTxZJFCXvkmatW;`xuod$LT$_Alg1lE5>=x424qb+e+ zhG)$+ZbxBvFkm6gMd0Qf1#=uCcWSwaEH=5Az=8BJCcPXAR(azY6I2gtg1T!#;K2|8 zXa9UgRVVppHvDeZ*6B9&^+6|C_Ejg`%t=wq=_Nr|P;`)}k8osf{aVK`S21_DU|d(y z-0o#J)d+HkJYdF|y8AJDt&GK8*qyNAj;7|5P33aNuY8}&(Z}JsJ)9Oi-da6XA1Fe( zmOeM|tZNGgmQe{^H&D2%mvS%FgQF2!=5P|avRWHMV6P*E+>=}ibPEaX-HpuC%uL06 z86-eI;Ab@=4e}S-f{%2ZuZN76BI9Ot4`qE{D39s(XaF|qP1hY-&1^57T^VamKj#F; z9r7QvBur~cW%IsAYXxvU>F}VO3z#Kn8xssf^M?G9gc3{Yp25S$V+;pomB@pm#%pTr1+=^0_3pK9XH1|`3e$=h z5kVqLoZW1DC!CSc9M&PlaWXX$+oVYrJK_~bizX*gw4Ho+-x2dP1vg*`GTgT`i>YrlqA>Mf1*P$PdW}j6x$<(lEr23r0mY+qM4 z;bc@R+{xp1Txi(-N1GAk$OHVb?m@zrU#D6xHuuVn&VSe%!=Z1lOsi?RNxQ_ zn@QZmy&a!a3WSsj6HFM}99Y$l-a!pi)XX5~b}X8@^4O8DPfP7)6)xwgyM$DUJEgsa zYQGnFP;z4Y4_z+Jmu z=PbvYjkZ)rnk>`!*AzFk@sXU>fgZPzGzkdffQnAyHc!VR%3yd-c*gK@DMi*RBUG;I z$A#**ziUR(adK(qs}S^%KTiDw!1TpsTmEj+#RjLcn0g#i-=`ligKm`X3R`Py(N9I- zth5HI^X#W?wy>suhnUf^7&#dmifhp+C7zZNFGN9yKHm^8mIG5l*@g!yC_5ONfYT~8 zB+DbQ_Qo`%-dEp}%VnY~iCyke0s?flu)IE)3}}+OJugKVLir+6)(XY$h~X^YANpzBTVPA@tMsf2EZ2pMkwrINpc~`(@Knt2%rRLktO@NJC+8v<3Q58>)+G#GMFY^vNW%Y~0nmp*(*LSL6Z(yI;%m*_ zZeXn^QDNU*TbY&Hd_UL|>dTm@4vD3_>LLMB`j!FO~4K zxgF4AMXc0*|0~Y@c{%PTmXgM}cF7WvC6YNUk!;DbS`RCBv2k1Th8)w!dtjJuUCb_D zbX;!m+#G7*XJo}*VZK=fm_U$~ij*S=NewHA)k}O#6=q?StcrrM&KG<_+iz%VBBCSY z;$&fUF~QGr_M%rpPGoO1F|Ui;WQs?OKK;Y8kHch@C``O(7ERuC6;T~c68@^^booM{ zemDh1luOj5rCUY8%zluloL0VamVTG+P~Ca~mZ+TNLWU7tQf2ukXwpc#>F~9aEQ_WD zym$63ohOnVUnxciI~q@R5X3AdHTFRchQnxvNvK|)ei#IM#B1xvg(>D9qBXR%AF6jl=81PExv@mOw=PuB%elU2iT&sx75*9XOT^FCzA4)Qq2t zA$vbvApHg6buJJ+WRJ~dvURU^?)&TH*!}{QNto#c=2&uZ(K#4=rMi62M~2KYfjewM z3^2@P=b6%P*VFFu3Or-%m6sf#`2L&BfA)x{SFl4&k~uSOAZ`$LPxb?G|F68mAQt%7 z&hiGVXsm4T1}<+-8@lz_AK3>zRLe@)x+mvgvseL%gZ9dbAj*9Af)t@odqOBZz z#WK*KGNWf)Fr(FjO=w&{eVuox+xGg2ElniVHYW&zZg-t?C&24zbn~ODv+J{FgBR)`rc}VcH9+Ske*39g*eLAeyHwSGLnV!Vhjb0!4z1H!^Ws3$<#j?d zhVN_oA*+B#Q>bWJLoZL+RYZ<=I56H+3p9{q=cQHQe9EidCNY%oW>8wSD(5 zcSz+sdhL&?A2rSFBA5N57mr8|(I}*gUa_bM<2C9RROwm&*abO@hE!&91rn4{l~p0S z_){wV*}*jTZVQ|1iH1AMcsXTFwGAF#zr&f`Gd{JK!XG35CAql6D$^4>-k>QbQnF=L z>7?i5(Ni<)pmsats5(j{r1Jf}zU~wiqJTp)|T^vbA>39;zSgXsWCT z2XLBRMc4GG`?P&ku}P-Ey1MpVrtQ?0|EQR%QqICK3+rN2jB?<3S!DNzJr0|Wb6hw| zexITb{)deX<5(+_sMt{f6&lz*3c{TgK-qI+7$?XI_WRMxQqgc*>nnXtI_mw zRb+6F_MR>kL`2;`3XxC6E-@lQFl&wD3I>NvvpR2?$al4_ZRi zpGSnuMaX+t!V=aNiuc`XXAB_AKDTjK6_ovl5%l7pe%~4&8QoHU5giVntw<$Bj}C+! zD2<Zq@;wuf@zIU zS50rrSYYe*(oC4Z~cdp1YEaS49W4euWd3 z$s&=c6IIn-Qdl)0-UYK4Y=%oU+IIz#AUFhz?L;&hW{PK+QBKfc7#%b-UxK)S=d8pY$kZUk8 zxJRv;C>CI*YOVWxt9O{EO8dkm8|`{k_OA65TMEnKVE)$8BXjC4LSBR%uAnaB?{s6L zVJ7BznYluA)dgQ3Lx4qrT)!qX_(ZlW@8$SB)Q`yLs_K#WJc(B)uPhHTrI4ifsg2CT zx6cI6$*w_i8~y2QEWA|ESXMYOTDIKTVx%i?IQ!KCcjcN+#U%UP^5F|;llaj5Z4wP<-xKOtd;4%n za9NI5F@=E=|2yTa+V0e$YA#kmmBFPcWf*cTwj*5}Be!CqG4DF}w5!ais<4_wA976j zS7n!zEH;C=;CWbK=)<1Ri9F{K|L-#eIQ5Jm31KjDGLVy@jYy{=r=}ws8?6$r%i_6OA$N8G0e+)P@EdFJCEKda z2x$B3c#IxE5fLBopdsN=&{n|!j|wk@v#9q97@)`np@#$IN_@*>&B~z<#;Gs*$oVJ( z%OwD$>GV?tX^ji7j=waW%t)uO!eALmkFhm7%_9S==R+!&s01sF1E^Q7DUC`am!E^* zRS}f)t7rqLd*dmWQnAkDcJgB^;+!<{vyo;|M~aDqfXmYwDZ3yNA}YgN1UsU?MZ)Gq zEG;kt#9Ijbf%R(?uP)mya}2ZcDA)jAX%zp3fg+;CNAzP=C;?W`$F31G&_pt6tVbb} z;MpWUn~e^t0LL1fWRpT@5fN~F()G&9FJKR0867HWnm{K5gQ%VM3|K# z#*e+L=ey@8#K4JUNNPh7Ll*m99@rQ?uP5TbX{s*k>^c?LGCI))y+wjx7gs~TKT>)_ z8i6P=h_VDE0Sew6K<*8StSW?1ihyJwoR@e<7ZRX+^%(EwAfW_)wB`?<$bZ?(m6~xg z)+I$>L38M%?*2J3Cd;Eg0|{00$AdP)ok$KEv7TbIv@lgxK^A2rR>!>7O&bibB)@PA z?=RsMd5*PQesqp_Wf_HDI0U8EA^+i7P{7T~Xi9#BoQ&{dJTklEC9(zbcs*4xhmdk% zN@VFv@k$v;nK$Lk?y&7sAt{MZYF?QHMw@%4&^p3I)5Z%uo- z^A%p-uejPU%&Wo?&n|t3B8#gQ z8X0LW)TW@VJ2TpP>owCR*;-jdk_Pxs`CCoSnZ71Rz*!qv@x z7g5^M=@v7=r5xyld-Lym+wX6r#8Nq@%_a*>N~r8P$D84ur49GzR2ta)MmG@w*UI%{ zMCg(I;3`)CSThE<2n*U+Gv2eX9(2N6N1H%3S5sI0l-IivbxVa58mFSOHSs?sr(Bv4 zxg~!uH1Rm{v=VyCa!j;U&J6cl#{!S;?|Bu$^rU;mbEAV`$`Mp!0M%lCfOc$ZY9nv7 zv(plS(-4l~5`{}I5G@uSDQwR&UTvLlZ1BuY_4G$2I&6X?d=Z2*X{k2AOyz)tk@+>96q8b}vnbEkgMuvT*05C%;}5NPxP zErf^J121U;1?&E9B%+i<-whCXtOpW_2yd<|lo}c42)`bG%_p9r zp6o*?fHgTsp!_$~8&xED%G4B?COp7V{>;mzk&AO}3L%Gq6Dl~b(RzKOZodASZ>Xy! zXc^~;sMMro5qdZuzckXK^4ua5)KKo&qB8OpdqJ6biOG~bZhcR_)(xrmAVjzgkOdBi z)WH_IK?-<(O`Q$K8FbT+g%ZIoO<41>nqwq!2^VP@1-TI?G@Bt~B(I5wpI@(a^$yX6 zhzzH_Z8bntuc^|^l9{R0k&0umiIZ_W$I&a$$VX5N!$+5tXj-n{ju?C*HNG2?h5D^2yJ zn_RJ~cNK$2dFuiTB@MPjyo%r%mu0hq^zmqeG9kx!9w%ekRLYXV!jxlJvzoBg`Oh!q zugY0Q07OI4nK(%`o`7US&cCjKX%$;Cen<>_<9uKKnU~qruyQG+dA=feUzVjeZP0Bg zzlJcrG_8(PI~P#c=GA0lqH=uL+e|+lES|O`@Ho{Egg6O3O_9+&;tZ=1qMqe%Z(1?G zis4#EqZeY87m}uF3glEgGgZ8_3es*8-23xb`lHL}V@-~2Y3)33)d1bzyc~NihR@8*?+Ftpxqx*x2me~{mst^pl(GF( z#jb6JK0&ej%laOwB$J%z`qNA^ccV3&^}66c>4c=Q&qReM&6MBod#|> zj$Xt0q>YKV(s^cSyeJJAl>P;M#2U51D$so6a~9+Uz&=7e$!jCXk?NG zp_#?}=Pj$`8ZHsZS@~_07>)V-Kd@&I5Pl9pGDV=qB~C~0b1FPw%%mmqPtYkZBuJSI zyzh*UxP%xEs*ZdLI)P0Pb!~DzC%9iMCsdyF@VR09mEsZX?m$VdzYzivN!LRa1H}@w3t^ObII|*8T6ak`MD1a&sPm<^_ z-_L<=(^(G~4AUfF3diYuo*o<&s((><%gV9UpD&=Ml(*6i1(VZA z+3QEhHoP!J$~L?)RWMfaOrB*{I95-!aUA~#LC<7lGqs!A$?RhfbObwwp87}N_$V{O z(PpZR{l62D<3CgAS&ST}PE#kDv+M8_J;cV9nqKu6*`s2#d~*?7h`5x-{q zH`gUN?oB8{FRr4Q%uXPjVvoHBur&((^G@$>tXmhaWm&Z6yWP+}sy zFYdbA?~BdF*U!riS>N`zQ&PZ1D1Z5(1&SQJoOpZVKEu(kp|cUofoGq>^`sAT-L@9w zju1oL1(%*}v%|7&O0^t=&PN}tnwH2>?zhjmVaCjDv2!C0zmETf!V& ztzRWjqu;c1WbZMkyo*q!z}`OmpP=_eb1BF)G(rK#roQg3p08hfXPYD6Z6D8%>*F~- zU$W2BF%5c+dRpJpvOMU@PTrpPudknrBRStGIuaI_@vZz{Bcug5-yctBM?=9b>roJI zDa+6A`nx)tIyzaOk5^~Y*Vo%x+kZJM_F0d4b-LOT-oGBcjytqz2VG5bczv@oV;9-q z=U=DyXxdh4mVA1e|1@)_4)xW8DZXBOe0@w_p5Kc9O`ek>80}KnQ5w!&DT@!pSZlw< zJTkac>!ek{O>{)K1VgqS5=|8PTc#3l=Ys&x5$qCLD_G(MEk27+<}!Ae5X8+HJWBq= zVq{yeLlD=kxOk9Y)cYpBV)aR+Hzm_nh=4SrY*bRpHZ)c9hK6wU*0qBWcKf2NcRc5C zt#o5)UsD(@Gt`Qtx~j@gK#LnF{fwt+0tuPfKVUJ=8tp<-pngRU?5*_hD2>Eekc!?X zG#{S6Eu0$QkUiK(UbvqM8l!RYk+GTN*#eN)N&T+P-f!I@*0jEV_L*2Z12Fq}DCmajr;~QW!r< z+al{#@N~2+!7q1`Xes}c4ScAom^RT)qWhlig&cI(QSWIpSq2x8<-onDMVel!f63g@ zw6J$hlqjj-WgL75FFBD4} zk&=~~qp~c)7eWvbzT9fEscXn@Fqa_E;iJT9#Q@0t<@%ad5acbD;^f7M zb;Snl*|mywBjA*>Asu2RtsyhRc>_zD61lCKwm}%}l*wnoqE6fqvkL^nonIlvb*|^V z2WtZ>!gPIuKyIxWYtdToF5W%0@}Kk$&H_7O=)O>Ut6t(EXE+)It_k9_&*U~~D`0vJ(#F}EBFQs% z6P5USg70)C1@zj}g**JLolFQrk;D3I+%NZkZU7> z$Ylf{ai(!L^U9i%E=cl}>qXyoLdY+c&}%@wC^nB%y=%S)A1)=pBQAm;HWizqD5KS61B__j)*bU{W@tOe5s|6M_2RUiT-9dg>VlDKqH zsPW#YF|)8}@IfvBW51S=pQuV;C}NOg^Er-ALWWJ8i16dI!WOUVWy=0-J*%)c&Z*yN z{+w_lm2?#6<3po86E6JT=sbgDnqGhtBk%uo_MK5pZr#?N<53jb!2(1uCWd8W&s*J&iKP`#LH z7SAg^{PsiV-Ik$;uKusMaQnakF+G|0DsR`>bi%_R(#5H^_Yb#o--U5_M8j{p z6JjND-kre2JqRcb;PE3|lDouvs5Hfwr{}G>{}lLoNfeXJs8c*gZhff_q(LeG}-G~O4e=L{H=C% z1;Ng`dEuAsy%MIqJ|<2l)+^%`-rCrPS)UfF}HU5r>J$kPqW5429v08u3XJL594e3$$XjpwfFsE<{_M= z>t;FCb=eOu$@fX`0OQ>4s}j1+AM@YP76HfC*bh$gl8P8Zsj>BMjL#S}8gaM$Lh&Q( zRjJbP9rjYsLhVQIJIR0Gv4jolxJ>9M_l~6l>DrM-y`-DMen}oc#>z6i~?dNFd^d88}HHr44Guj74gS^k8(7z3G zk9E!K)THooCtz>gWACT;wkIe~+^}>M!5ihyy}1`xds(z+!7DZXfekY`B6F%fxjXCP zU5^b|gsX46a@(ll7_FcePhKrY>6V$gE$7xPJVx@~N^q$+s<1AV zz7{#hzNc9R*@T0ad^l&Kx=EAjZJ%a5ORU2Ag6i{^|?qF@x#$*Jx}snFj()V2`K{ zdK=G#)imx!<@BSLSRaJdu9!z%e%_MaV|jg8SmkV`dRqG6epkrgM+ffcpzGfSLueQ)^@9*l7Le*D6x!*m*H(uW@&S+O# zBuE7U1_-HH`$h}f4w|a>SS>$kflr09u&*> zu4ft37KY^?ZWxx#i)G90nG1IpiTwKPz4KWLWVf)9a!t+l0p%MNcIV}ws^A?=3sS_- zx%V54v*BiKxq8Jp7%j( zu~@8${W_R>5Yl&-J|uQ{eG28vTG^RpwZm*|C&pp4gY~e}tj*=*0s^$xL_v)`##|EmmJ%yk)xCU$J<*~hh$Bddr5 zKQHO}k`22Fu49QG4b?lC8npVo&6#dmppt5R;rTeYz1S)(rP0dV8yj}uT$hh|uD)qc zTHoVrHa70;4Y9{QZj}5Oe41?cL{v%sMst|{nbhVyP+JOr+&xZ3Vf)9$&-14%-5$FS zeFUY%96+CgXr8br%={m{U*<=UN9=4`)|S{j)QzwFR&FQw+&(D%`1T+?ffm4=(P&5; z-FR7ipds!UDu!`>5`2pL3ZN(CDyV?zhOQS`lzjH*J;R%c-g~}}VlJGxrxC5bl&9AG z40w5_Og#3-=aa~Tzxa0+#!6s&y=N>=Pv?FKzwaYX4lR?izsy}o-3a9*0< z$d7a_ki7+N*qehTf#yF^&&r#vO|LG522+lO@<9ks?|YY~D=Ju;tTui4J@^55!M+4r+8O?%A8QH} zy0||zQ(y+G-gp&Os`5yBI^>KIHQ6R8Fo}Nc$MEscatc z&Mvd+mjkjsFaen{>{)lV)yW{Ta z!4a#GoY4P^0jebTUk2p;V}P0)IXQ!&53E!j6rFB5%F4+@lofB;D>>RJ%F5e2D&JCo zI6Bzhw7=z~{y(p<0UIF@FS%t84O}BI)WaEZ^p5$a6KeK&J!`|2Qsix_4dtuLw z!mj6qeU}S6Eem^Z7k2wW$-%qrFLwuPoT>{1O0Nl&$tIUdB$p{$m5N%GDUOv&kCmyZ zl!~a7$=8)i)|ILFmx}q9Deabmch@d#&K(KrdM()61SPM2$#zw1wOlniH*@ps+zBj0 z96QU8oq=HI{xV>I3}!DH%qSQfN;3?pzFEP(8P&eIKZD2=Vl?ap51-e`1W!Pto*ZZR z@Cv|wT-9WzZQrH6BuQd;0r9;n5xYoyEkF!QCcd*`pQ(|>7GD|f99gde(BR<48TFMp zllqk8dv#jK^r0=?-tju_C26lMvhStJ}J-*~bDM zHZ#U%yN2mAi)-sFG~169pk~_u1jC{dO4_^sm!AP9xUANmjWN?IY$%SADRaySAQ*DFaEnNSQ^Yz8)Li=ScwU2Y{Irr3Vyz8u zjlr?kBSB_Ek)t3eXIo={nqyfa+F3HwpOwha!dV1ZCn+S1SH`U{J#ZGEZGZf@x3~0RO2jA?W9r-=kjrc``GjOIMskEhF1qfQ8f%9d`}a2AS;xS z3-aoZRhXCX&01-jTL4wg6~OPZKT}k zi~un^eklMzzMp|T*95!l1p9cPvuyahwMZ}Pb|-27y1o{45|n623#LAUro=fw;^~mI z3%H(xm(r<08G&Xm`Z=4{NqV?eWtBu@NZbIfM?+9QH^rk1k_ms|jAQ2>Bv<$KU!L1` z>zlIfqX)?RghOW=4@6V9yqH>u(!=BV7-w?WO{v#@-~qVotu7G*TbGoX3kMb4D|k6s z(koEkrBgh;04iA76>*Go$q2RR_J*1!N4hNf6@8y``>EwI?d&mS8r0%G-ggCRO52*_ z80bn89M3eyU9SUO!WT+Z^*h#pcFNSoyAk+8_G&@}MZpAD=(I}N*vI8VsXJ>f>#14s zJ4eo4w@{JHDGIHmJ{B@4KWnJRJgHPvyS1^FFNe|8WzUK1{OYnX7z0rp5J^53A z(thJNYFlk}-4@513)az4+Nt@Kn$fr;+u8REU(Ly?a>v?{rt?-lA) zxjxFO7+{ov{7V1%h0+{rWD*V7&9M`>rDE@X1{`|MdjnLmorJ(G{jt?AK}#w(!>KJa z=60$;S3&;dXa%;W(YIZvYKdQGJUNgrzmpn<6tk~FD>n_xw_t{Nz0TYPDQEdmqExdg zuahjVVL8PyyPN&h^Y~|7(CBbMmM@eY4cfiCr63^+NOEkv9DO}oRAlg9$cI~MWb5DV z4b1^0Iv&^=Bn5x~$&LqWPm*F2FlJ`|AR=_LvHqYsPG9+2XQxZ@brTRCmvSyD3u@AN z(c9b9;SAMLnri1xbyB0kLqNGcp)V89NP9iU4P*o+Dd2jZC>ePA9oQr(#ZYuS$wLqE zIXLA7XK3Ht0dBT;hB+iX`le_k$$cb#c_i)1NKEQTqRmL$#7L^zNQByGXgxlKMeko7 z7~W#*O+*n&HMnkKYhDY+GM4!9eJUd)SYGH0@laW8^ps%dW5Mq4f-Ojlh~1xJNMQ$p zfr01QgQTF9Cxkk4wa5YGkTR4r@|FX*XNCltvmSV<%#@zfW&Ifx&#*?sRg;Ha5dE$> z=<~^{2mTvvJ%QB^6Mn~u1{7gu3ZH`h6KvBKYhwgz6O(KI0b8UB>IEFf%y-@ioL=B1 zR3-awOK*7!HPVBCKd%89cEA}PARU?Z6Pl*u$zkpSe^wesRjIU8sJ5R{r9_Z=bV<#w zq$I|kkK>mfH0Q$D!g0hpFM?@+W1>R)=jj~b>M5H^dLZYk5c`7A?`uM9vV`9fgf(T@ zZ+HVkvcbTUGj)(nn~Gfh+kaV_R`$~}+T>fKDDmil_EhXK?`Az`+0fA*C!SeRqQ!w& zYC+x%!kACjvm2wsoL)~|IA{Jw)FM3F;=PjvR%l%$9)8T!Q8cKhtFSr0ki1aXlvLRE zqp;;mVf&8T*Y|F%WVhxVH}b4oQ@mRn)eX;}ZWp{%sjRxL z1M?C!Ln;oxaL0`;q2__s@N+>0wv;pD9s1)v(&JqS{<$`vm8U5@b^O|Gz!j%}uK$+# zn((S^1FHWDK9lq{g4EhgYAzs=7fDV3W4>dDm$2U>*fO2Vx5XzyWLKm|(nfvXsZHXV z-ud25y@|KzaX#yn*e)#9WiQot7}e~<(&B#?)s||v_RXcQ*rnFKrRL%#^2$o zi^N3sXOAjBoP+|&Urw8%>`7o|MIB8ek z7*=nr-W)rMD^VU)aIM6~R<2uwiMGe6c3I=in-xL^k#3k-{_fFiZ!T1Kdw%24~*>M{Nz`62ynX@^riMnbc)|nn=7&o%Uk=WiX@HH}K`r6{gH=!a8`co7gXB zmFEBhA0DI_0s~+h4K{(zoSB@yQq(<&0>C{sZo+QkBFZjy%kFfR)LI*b#Q_58+}>xX z&T6_?+eKF>c+)AEt;4!=cIE`O|4Vp*r~?FxR4pmnjJuYU&Ar( zb^10TRgibz9S~+)Ge^kms{2>=hfc`McouzcT*ehn-}Z=IH8q^`wf*T-( zA40x2wKpMOVp^@>2kix~A+KN>l={AzH{T-z)>8d0naOVs{^6}T#{4^KJ&PKG*;Amf zV|&+I7Nlm&`5hkc)VoUDa<@=UZu8%XAx6t1sq`NfGz%5Q4Qh=?+(mU6Dn;S*$nIr~uRP;g@y@UtjO>Za2G)Apc6TZGpJ5 zi_7=inGVU%On$3OVb^Do$k|8OX-D6UP%o+F>K!ZKH_Lajx7C`BNuUzvBCn6_a+p;M zn~9i-QA40Z^|PL^zsi6(Zbayz8jWI;z!9^E!Qh7H7$)zb6d0hHwbC@ zO$5A%WlkvDau}S5QyVp#d|3ZpfT#(C>tm9-@`7-uEdmrs&{^`iv}YD8PY?97e}~uO@&Oe4h7?(?17$f@5yJSJBJYmwXI0A(UstK+ICZ*U&vqqJQgK-$q(FMsQ~_h|7iZ(lO{ zQ*J=U7d|@rLs_qxrI>63MTb1Ho3EM{ikY(|U+KD5wDyD{?m$b8Gc<00xO)Tf8%v$X z1%$r6pW9@~G?inP zE6i8W>mC>{%3EkCJ_{0m>YbHH}&Y zi0su0HMXLE{JsMm1Esn2RQaq~7o=0s@m8j;DDS0+T376xWtm}A@>VHzALEL$p3l&B zcPKu&UOW5&uDDitV`ZQIQNyuw0;Go44KfG9{dlPI2xyTudQbt$!iWWZFA&7H#@QdC zPgayu={YI(F7zRJ#@fp-iF;>)V?dUMa%tg?@}bCs^OXDRBX6Wf50SHHc_c;_r&_Sm z#qZy`j(V=v&VTTLa+4CDA|7RX+iz*q`fDw@%{V3-6ZEt}RqNTmbPx*z*Nq@#TjLEd z1s!zB3Y-@7vb0AAQ&+TZNgr(<#?;N4ds=IUTNM=1tuxUHA9Dy zuYU%ggm5{$1yC+bH*l)<{0Cl^_xxI>C9XRZp#UNW=Iv-xp{@5@y<--fuJh9#GUUDQ z=K^|8&V~ay+EBO1Nm8>=75Rh)c@sH&Vb`NlHBGg(<65SWvgRw!|#M{LlS4PR_C!YnTd*fAiiY?a(`WGBlAv8Xh z$O4n`B2u}}P>=uj*zB3LZp#!HvfYw;J|j4SRHj<|N_HWluJj9rCb5zzr^Q+2- z8_i@1%j3o+InvfQ5voEF@W8c{TWJ~X#yJ(Z?b$F@{MznAOu)3S^By^&ZJQ;HEkg$l z*&gn~v@M4VYOS3wpZ1IFMcj55EhcL6Q~C*(nUFeqpKufsc*y}76wR1~+1BP5@?G4i z4o+|UoC2&Nu$8u*52>K6y+sF@pB~SjEoHZdJMR#6n6(Yd39f*~{MHh&HLK1WWQ4FQ zKcVjbC_gHPWCSowJ*3bGBEGIR*}pbn7yXtdTP(tbjz+c-TWjB>Fl5O?Q-2w*NgYZ) zbhP@vN?J&mJqxkEoHj@q;niN3e<%9p!d@v$&0NVPo;8|TVv-7Z% zG@0i-in_WT0h;vE!;RAptSsSj5!oMGtaH1_eL3FYt4E20kEeVafKA8}Pa=ct|l3xGuEM^Nf zt(JhU5uJp)^xkso_Hm% z%u^CV?&BJH`q5eX3xlU5hx4m(t#zP(3m*fAbt&W@okKZF9)dq?fb0cHaD@;~@vDsp z2lc(%d!tMIsLPMI{x8yzbVxe>VSO?Gme`W_w0}kK0JprjYCHu{o{YN2Xd)RL;w_e_=?ATbDqDq;X zh8^FgBWlw@24l7PREfy;B!)uK+-zCA_!AV9=O z0uH)tn@q;PqM70xEA%VmUmkE$JrMC}b?PiRIG?_pRzIG=;IPqC=%2&;?>O31DodK- zd<{dkS*^wQbT2i`*=B8M$ap zW%QhTa@y=LTDWuU@wSAoN)Taot@>vtXmz&a9lI#qB`7o(M{1PbJ7+sdGtguDLnk$a z^cDx8lffkMXVRA0&$Y-0T+FQ#l>e@Vd%d*te2MmSa^_Z4R=O!C%PlIZX{g2h9|%LN ADF6Tf literal 0 HcmV?d00001 diff --git a/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_ru.pdf b/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_ru.pdf new file mode 100644 index 0000000000000000000000000000000000000000..84719af940f56e96e63e17499cbe1b9781da2bbc GIT binary patch literal 572381 zcmZ5|bzD?m(6@nrpo9o0jkKh~(ku;%ERB?;LayG^;W`6~8E1KC^xLD%xKIZ{} zz+gOQ7bi1gTRe~PKWX7QlRdvAx`;)E0@>w_h;KS!(L6DFe}nm!B9;W!Jz}1i8yH$5 zL%AK+5rXGWU-oOQ1GsbZ)zO5H0Ew+^405kv5emZ$UH9XZv>YwpN6t2g9@)~DN;!Q zqLFq&&Yu4(giBi+{}mqsT0)JH@R4bNJjSX?VLG<(LbHZ+8$+WLifBBBkzbbOSZ%?u z=db|Mi=bld7v_&gK%j%NdOHsR%(Q2E<|p5NN;lP48{o0nW7fUVtC3yL(2ThxB9#4V z`0$y&gWg5q(`ib8A~Bn=)SP$ES#NzkW``L=$TY?8AVL$K)5lmxN!0O)n5O4#uvPs!1(xWqj+zMxg%k*1D9)mC#DsZD2;N(RouJjyn>6f>9Y47)wm>c8y8cH=PRE zTLQxyH-t^`2dEB7^2@$r^to||S^7xP2BVEc$j!2pvag6&hqkwXA+9RbLh|0JikI-uLJReCV1sZoL-m}vAf+Y^Q+`f!be46mH|mmC1Y?>D-Y zVqOZ%V`khSf|z2!xiN%w{TCZSC_^%aQD!i}luo%qh=~$oA`xWp-7k6I;sgH@X?C~` z20+XA%!1Fl(ZU*7#|qvy?h($Pe1 zxlQM-*AicJmnqOl{Z=u<=s(XWBD6#wtn50xgK;Mvzu=bW18rFVynx@c4}0EQ#yq9L zDBaQC&E~oC>{*K15XP=2S+!3+a2+LO-GRaTpg;SJr{4Kwdk5CLWv*xYwBoD#Pi^$L zF0cIYzxJb7?UVQEfO)tXmdJN7a~A>V#!}0n`X7@Mf5S?Skq=vAgu2|oeJqF@IDGSC zQHb$t<=t10BZ_}scIQO8jL3sH9|5=9%zQ|dg;n$f{MW00os-JGzASs+EqE7$sYJP{ zmZOFs6xIMQm|A*6?zsz!eXG-y{<`WdX5F|)QZUVnyhBEH{JF_kx;9ToxhV{uxG{s$ zFk4@((deT*jReEUa^HArOu!LQNrv$ig_!ftz3KlY&>KKYE`sqn9cvpz)SfI+C&a_} zL`pzM&D_dAcFLW^_9k#->16H797&q%whqC@3gIpx4+>J zC|Z1TH%{?ny;O3;c=wpTWHECChTtT^l_d58y2{69p4t4~qM5I4Xv^7w)+5iZ% zFe0)6I2o}F!0vPG@}44LdAD7@-5`sSfB=Qaacm+Zn?gg@rGc)IbO)D=# zPj3T4c{-zUO04>q-!Jp`sMB8h^DT5^$oa_0T4h{lzY1)M`-l84L(DZwFGU%#G%ZL6 zn()ETgI`?3Ei}o3MGrIXHNUt&iiro}ilS#gX=n~vqyt7Do+0$QFcY5rH240lhw+c~ zn+&30%O6it7_%`8amJ_*5F_53#>-$3FK@S9_Y{-md;1YFMjT58P)?nlwsw+K<<$e` z8(oek3U5Cc0<6yD=8B~HrY@t7mB)gsx{oO}Pk12x!sH!GW2*R!~y0Y`YC8? z>BM8wn4DFw!@G?i0gWhm(b9w@d4mae9)v1y8oG7~C?i@e5w|c2V-#B1wz;`Pm|jh= zq#0ukDE<8d#F?Lo@&%!V9={`|jN%UPv5l1~x`7?hk#KTR8-TPLn$ylY!Fw)qrJvp~ z=G@yV2@nVG%ZI5}xNU{TtFw^cTrb%646&R)ui8K_PP+gDrtmN#MbBE}-NI7dxLi*N zX?MxYr&rgui@&?we!d#$5AF0K8MD_@BIaM$;P!VWSWuBIuulsD z+Atc!HYGcG3GQ!J$jkGlKLbdDfJFfhPS8zT2>nk@}UWPMP7gs+TR4Xs_>u@E{t5o z@O~exgR#P}lUL?)>fcZM(dPr@D!^)8#lM}`WcECmA7Hsbk(#=3VH4re6=*JWmdpil>d z?7g@@H886R2ru}dz+a$l^Ff+^ZRX2HJrt<>r3`PxsI*f%G@cfw&2!>0!+1zR1MCRj zGga90b!an5`67;@1NSiS1xc0k5r?IBMd_xY)+q^r)Hf20vQO~i`DFXV{*i9CB;P&2 zlDW*+%kP8fVAv2~b)#9+qq?2}+t_8%$yLg**G_{q5n&i(aJO7d1BcOkZ_w~Bo`7r# z`-HuymtuMEZ0za2WMTBak-O+D^MtxzS;LRR3R8U6)Tay2e~&#xnhICkCg8XO?89m2 z22Aarb@^+}ab8FRh4BSt?)iKrt>}2wAe)yA6sWrrELrjlzyN9D!_+wu}SvxLAMAi=J0-Ve6=88p^vU%GkA_qt7kl!GpcygG_9ydMQ2|C z%})T|kRTH-a=-7`eD}d2%;QZw8KCJ0W{QxyUF@03#7OaF9AWV{oglVDLV*6HcZVFF z42Kq$C=}H)%W4Ca;Folcn+SX@L$kR4BAb+Lm^D_m8&E1>QRR1jxE1#Ix1~u2CN+W9 zzZ?KP)TE7bnA?c3VksF8hYdmltt<3_8bJ4wwv~^>^qZdgSN{6{XiN|Jp(e1_#>pAN zt8DEuwN}s=CfPm^?NNfBAsmh!>(47svX3Yi_2UmQDidJnApt+P&`T|;7lUV{0&mwc ze!2n0B0z)H{u$y+@*Ag)1j)}nH_(;a%p(J%AFfQS1;$&M0(DvPAeNJoZ?OX^I07|w6EXf_H1LM-FJi+7Os zk~FoQy|T{qUZduhEDyD%fKYi)y7uUy-o`C+fJyZ3#m%*G9rSGjK!1tU7qle6!icBA zC4SfgPraVvgkb}U%52h@IMl!TU99$fKPUJXVjZ6Z=!^m$5gUM4K4cD_q;X%J7u(wX z%GK4mmQTF4cBhwbE-b(wUhqiiQj7Cnf~T$( z1(Ha713JJ;tjWYc@u-B%&)Ol6#f8p%D=H}>Ff~>t!15(TEiilD9qiQbfD=a1F_#C( zo@3Bei@$JIjk_|qT;og9;{(0FuJx@9$s`>g&EFI^4wRI?Os7~}PGtb5uMRvdXTnm2 z*Ltuzq5RxVMPzeUA7Zu&T&nI=I<>&Jspfrzlb0j&uem_)c`&H|ezA;I=a$GPRFJ9} zsaujEQuer9_`W*!^B_Q+l$;YNeth#e&2s;5tuPs1x65%x_PR<703bReM(035R+Ye+ zy2|HCofmt`gkLSY6}C(89b+iAw9zrvxXj3W+)VBwhe1LMO5K)piWlYRpRN(VW9_aKe4|pflbV81{sv9wTUV} zcrCQ^K=c%|zXk_R@@y~ECd=q_o)l|3>#3l>eq4s;d|C0KsO#W^V_INidM)c8?T^R1 zE1YDkZ=N?y%{KGJmbIMBpZEzZb{_>m^?*r|^kl<~>85S5R}l9W(uw;C4RB&)WS8Nh zc#7QCAl-T`U=~*Jn*+DR0mME3jnXzv!M*q;?y+XS=E&e73sat+fD5%cb4* z^h*0i;=p~)$|-C9$kCa&Z_wrV_O$IoWZ|g%`bA@p1o?fs_I*cEW>} z*sEr9rdy#u8kCvY>wTWP6FQ^2uEGx5Uk_yw7EYhz-@EfQleu>VURcL@eptI_n*}>r z`_eumTzhwADx5Pb&(NueYUyMZIJZ%s?JY@KSe;j{A~`m#ALPq99NimuclJw-lU(;i zxfwZHW9frlX%$f&=pe?2R`}Qz!*T{T4znj^Kvre= z4|Rl`_7sbT^!1Qej0a*0cRp%^1f#nbZa4@n?#<+*`nzzc?Aodo>e zeLqsj1^dGp8BpDpe&WeD)+R$){h8c_6tlTH@I$)PNoJa!$F{$jPCQ&Z zGYBRp`N;W@5+CcgLcFT;SHNZ`O}IN1u$~&bY}lKlPy>6a;l4k0lo472NzPLo#jl{` zu}J4~K`6=xnn07?VIqkr7ykLegY{SQT({VW@Om67V``U=^d2MpP$>%FofFE z{IM41fe)UK1Oynd#kd%cc5^e}`+NL_IIop-Pn9As_2+ay`sv9=$Mzx;?sN zQ8ye|_=?yO$vPd^bKrf9aw*ybG}P#Qv|b_1=TtWRt1CtPw?2!i-CO?qbme0LPbvL# zI0(8tIYx!A);jrBA*CY115rKvZ`XohC*Q~?6cs?U<7P|qk_vY|2s+o37d_o1M{>R` z+%=Yr#ozW#nNq!B6|dF_TEMe5kGI4|kZzujH}&QK$n~=Df;nHB*Cib-YB-M%%?p3zz7f#4uG;C_mlb0%vW>|{|evW{4US{MM! zn+=xd*&pltb#%hmRiil$%Q1V zD_YF&Ts#B)sJcol@ZXvN;PJ( z`Ljg71^YlGUwU2+4XYIo}7WM3YjuSr!G{awQpN?jvWtxO> zLu$Fjqj&mv(FH*k(NKcZdUVnAEN(c=Yd}tU{at@Q)xN}S708+tpWB^BhRf!LL_aPk zixnn)-bngWsU7v5KFJzuXAJ>OkfuZEp8+#klzdC9nj+^@y_IO zW4b2=A~$f?@La8`ky85bJ?~QWJ&k}q>=P;h?@s6}Obuixeczf{01D=#I3T&9f|xUK zchqD&>URaofW7he_aJ8Whq~JDnyGNar!0v6t9DW8=?&B5TT7rpt6=mcE1u3CAo!M?6IlT^M^pLb!; zx|!;%XjzMib~^Fd%Iw}q#l(|MxiU8D{AIc_Jxc)uQOoC>{cf5WE14S3d@x#_r|Bxc z?u5j+A*hoYSZX%CdR+Wt1UOA@Z zPOp=;&*d)@m5JCsqYyHb=&|eR$jF$$CtP<1vEDDJiS%A8*pA11MoIK>cak=9}; z>F*_u!~E)|viPg=?`vPo|y6O$pC6oIOUho4nEppW@pDMtYa=s}Tr6-J^ zw$qo0DzL21Ny!GST1sHrUoG)F}myR4u=~AA1M@T_wv$kHX2Ryk^8W4 z^WfROBw;YL-XrmO2DiK##lc9*8?@ELpA~`aJ*G?41>arjcu#_wW<8;@vK7R{-M)>0 zyg|?3&y6AN(n;@Gf<>INVeR!>HMNaU>|JVOK)S zuI?18CW^K^pL^vv6#39Yv{>?73Ltau%qG$rd;s4DMoqRp488vbM1*<=Uh= z)q_lGE>6eeBaYL(`xH5m&PyORZiX(r^1ZCFo|s>E+-f=3lYMxP7De^T6<>2?N)gF% zSxaeqVH(jl#gZeIFD!QGbJ1kV)n16V1=c|QS=xM(BOr;`5=B`VZorgNKr_avd6Ok6piHMV`y9}jYwY=@I6q@!IZC-Bh-ko9c^t^sFdnSvVNE zJRrqga+c+^%Xihil=EXxY|udy>GMg!v;kWZ!jRtRIJG>Uhk$MG`5T0w>r1Z+?K=wk z>krt`*gMVF^O&Z_I+&-WFhjod^yqZ9}5cWH|Xx%Y0VCQP8RA0 z$E7sE%1StThB`ysy}5d2C?XhiATVh!&nls=75Pm43fjA8&6e{6$9arh8ieCKCH1Vf zlYC(|zB|&yu;arBmrqFU)+@(R-!HGcllCBMH2DqCbkB3Ut8RHbJ<)qd?(dIrB_YVx zGd7X)9BXjHRfEDp*@lmco>UV4?P4o4-gY!XSt&y!qzFsp^rr)z&jtiFq*Qh_#&@-s^RCv#<=X1!B>Ou9WZFD65ahnk6#K{>|3WUcSa3r zpe~H_M(5n`!!dVm{79(NRA8EpNDF$W+jQaL>rxFDHE`N|)JbAH3GUB6x8vMy6H`$v zJUQniHN;QWS7kP=dlB_M6D~9$*+aD~>%TMkQ$lnR~I{AHEW3A;d{v$gH`$Nm|=&lmQRIUcM}_xry#IBc+3 z*iMY$n7G}U4=ch}@gpCE1bvA9IbswD69Xr&I8#h3SEg&O>u>dJ9PHTXdAOhhy@L6* zidL&(EDzoveST#6O{~5-)mzER%YUnBz>2L<=)*?!*uBMz`0gKFWI6Rp_~mLxC(0Sh ze3Z1~_iQS}RH_Pv9)#DqXW)i2-XR|T!$dXUZ8lAM-@}h(`|?a6PuSIK`FZC_&Clgz zD>sN6h(;49aVp`bt*7F>3PF8)H|n*KCFatJ*FMM6E3nXPxKP+N&Z-5QsJNN)IF=V6Y%MgxjTeh z^VdZ2iA^I8jd{(JPl4x5*asQY$&2Ugyh5AoDcL0I8qSYKr@Y-B_p_i6gFz&GFo|to zFHq=F!hRP&E#fKTo%vf6`P^Z)y2qWU>%8+Px^GWk>9F$3FtzEVaAuLyU03R=$gj`M zcX4i(I<6dELlSg~4Z8gR!akOenhccT+O2eI9oL7ySmHB|@afosL1);Ylu8}J0d#JD zcoz+;ALMR8oZ;`w=dgq-FC}W1CrH6z7Aw#5Vjq=U{EIcJU;+RFkgR`9CzSIJfE=AbZFCKf4D|&@<8wp#EnXDjokUe zpLZWs5H&0EMaLO3OjZL-csa|SUwqUJ&OL?H1U4m}*$k?^!1#mRP^O+B}0u z-J6ea*Yi+UmK-ol6>&-Vpx$TwL09)aF2SeXN{IXwyWD&jlNhcA+M>X2Gcpug(J`gO z>S9}XpM1u750Zshna1$! zJpcZFqz>5}Pc!9Me8XAa@J5h?MMLK&PeR7p>`xz{htb6Dp0J}^AW;!_HrdyvSBtN@ zT@=1WyyJ&_jvGk2d$w_3Xxn%3CI8H(j#uiRW!YVjw`ZyC)TNhj!t3SWvz^pUChwU* zZm_U2+J0*)bZStp-`Sb)!-RJzlwh{ro1@uN+iJ+;y@I}GEdGwyVu%kRV@>v_kI=*W zHd~h?vOhMah$EhGUv}$LF2n0|8t!>UqATS3tF{d+$>eEZ%iIe8DLAa1^?@l;cpO)gv(V4ToQw)ee% z_6}Ay)y?$iOD^o<(ESgAwL)>JUB>3a++pJs;c?HJH;$zfM$Pf$6FxdR{+Ba}CkfjI zIw(8+D4p}#`JPrzkN5O17)4KBSn^&j2MQp--nTlIne&%#lume981H~oqx9AJj(+*n zQ=Z-ixx0VmaWp9u>akNm`&+IkzR1pBUe;oESdU{*Y(CkZkL~HT_n(Ldk1fO2WL;lB zK6(JznkDcNOp#eQAc_Vx{lQhN>fOu5ukO3&FKX`y@DV}ve$at^Vs#zA=FrQ8Uylgo;}sGd?Zv~uZ5>Xcfomf=1$B1| zlP_HcII?`T0)_V6GE?v>U-t zS9CJ_glJ6XsBcu*1CeOLH%Sq^ed2_|afi{zGbxaFUjq5^%}+;d`ISzDlO@k0<48!` zOHgsCBDSZZxy-w4h315#lN2H!w8dvcO&GIb12cNw0)_j5sVBSRo7fPtZe}dng)A9r zmQfP7cI%igNroocW_nNegQ3j+Q=y!_?YAQ1&pxJ*rj$rjc|)iMkUZM#r~{S)*m7yz zfit;af>ZB3wfUdDJC?B1nR?V}Uq$=^$Mnj)nP`IL_ZY3g`!#8ss9nCB?Zb3ge&i^{ z%X$RGYpS9q!q1$&KRF#f%f5q?e-%}(41MxVUlf9Rlf?S#%u#_#p>C;R%e@E6SmlbA zpA>wX2;l~_)SlkOs~}{ha+p2q%is1mGaJ&I~@N!9*}&3pNxx; z=T$CPYaIGcJLHE2gw^VZnkEEUHGyDXeXy}I(be|N3UyZ<`%_-~L)|dNd zscc?e`7v8cmPs6i$)~QA2$mc?C`BoU!c>Z?R7=LAz<8P$mhw^+g;ua%Ezd4F%l(?I zs~*9uOR=)*tSK6ZR*q|<{=j`vi^Qzc>n?YuEH|H4XTptDB+ZGWLFz4b@%Ew>neZ_? zNLG4JKCavwNk}`*3%QGrfND(p(GTbVdFnjaYp^14S?N{Dsn!CA^1?@mA*C0i)4-e3 z%oHD&ulG~nNUh{x4h`Oe4gRlTzx#e##;LL5Sybf;!+KPGz37rtUTJ~uGYF-O=XH!P zY}Ix+=sU}z&ezydRlDIW9J22^=#pBc<9nmwUT5rzBg>{5K(b%dLn;DIdW=24vvwSJ z?@~rN5XPz!G9u9|#jsGFRZ1Tfql?B!qkB^zEyBVJ)LRk@KjH8t?2Ch)Tj7#iT7&U4 z{PO0K6v-z*3Ld+r{M7a_H+Av)tQc!lQSm?-f&hzsP{fC5gYHL?+Nij{J3uSN2hKBh zfoSusk+>Ed6>E+>4{`fNis$VrrfG*HCCi%Kf^3W*b4!3oFsL!Nh1`g*tLRH4A*qXI zXZu-&^D+4kyclNw$xy(?@T<5$#ezY_+_32SNMm&3FdFH2tZLkq%Qo}m!=uI0h=y)8 zDW97mOw1x!GF}E6yt^CxcZ+3eiHsgpxl)HjI@Mbb-tJa(Q-2MqEMGodVRIN%SmFGA zi~qwTTm7pw?f1Or48iO6V5HU?e$!Ay+UH`!@JV`%os?Cqqj`PxuNmTEdYUFeCvJz= z8vZJ@s!H5LwmE2TLeyh#!?8Lfid@cPN5TXlzNojT*q zhbYDK`uh(Cb9%)EsKRB*d?3w(kMbIrzv9H5z0w6CWE?k7XAP~rpFPI!rTiGguPV^u zR+4YQ66TqyHA90CGkiCfj1BE?FSq)=+fxhV6rh+5XH*%{=1)uY=%4$@*(2GwJSfjpsw+?Wl4?mg-Ea6uB47*+wjg4%zi%R9!HSZXl4RLg|kXejjVUskn zhCz5!dRQ(LWfcPQBGCVk{L$|1Rx&j9sVejdmPty<8RG9P+5#aidzS zuFHs8!lZR{x6C=VmEdOFQgMeS@`Wh4KLo3>)8`#`14V46bNB}Fo=81|f zQq?$XKMaynD*NRQpbGqpVDPz&ev!G4CdhZc0ysq+DxB-WeoBP9PSPtb#8ht8wsGg6 zB}=T{K~CZfiAxo(f7%Y$k^Z#mrHZI3o1jymv0&1TXHD&(cDn-S^x-{s64y|7ds?-e zBJg?4Cetv`#!*(tT^)9+r7v)6iNS15`@48~v#!(p@Y_O^Zz%a%xz$KbChSektOWUr zS6Mff#(bPG*)u|y8EV#w(vS5}SZd2Yz0{NP#otH4q!mG@;rb~!Zn8H+ruviybR$!I zw)evjajNwE;dg{JNKg-Ll)&|6TRC6#P*LBeVGG@M>xEVoN(aVnCbUmBX!TYU_xUCT zQZwNlo>+EXD1cY>yB^TAbZGL9C<^E8t!Uf$8hscEfc6lS(YAFMgf0KsH^ur&q9L&8 zy#COE_R)E-1P}{#j$FUc-xT+_uoA28CvLpu+}!YR``8GDnI1N_$eyXm*usnzpZ!rA(d9UKrrr=`NM2$pDybM$Ug-(dx&V z5xxIzzF0NW_LRqt7ViE$ozUnvU!fag+*vR*8y4r!JH>993A;IMvR7#36w%gz4K-Z< z={0~`u&PQj{wv}FuRh)pN>pey`0V9R+`@2Z>HBK1_L2PhYtUN|g9dV<79_kX5;=Z+ zdxfBd8#j7K*!7Img?uT-1oZ@f@SY(k=fb>RT}bqJ zf-(F_%TswGhMQ!q<%W{t4i4$wM;BMmir^CsG9YC0)=eK?C8Rd?hoM*~-dmO0(-J5} zN0O_4Pc^SS-0MpfAc7js1V}auaFj-?(n?2iU@!CGlDE^EPLvPx ztX|0mRG{xJlTjKUu8y#;ayd0OxGQ`ec`ON1g%}n-2DtL!HLc%mA?Mnf$V{@03HzOC zeg^q+Tzc2oCplucmC`jc{(mwpPj7@m0J~&Bs)(Bh5^F{9ZezF@sq1a@?e5Zz&zde* zsnl-jmt$4;(b#_mB;AQ#P=!L>W(3%W;xb|R%m9AbFiFutftk#UYW^|Fdcujc|Rk2`Mrl7v^x6td})oBO0Qc>C$Nv7a25zt`Z4 zZVtUK_`4V*G@p5Q9K~Fx#zU}tZypz@6gVuFI z&O~fv$m;?DySvDY?V2>zZIvlWr^M#7i@$Kq@!MP@dt$DFm<_$9 zp{@!l2@>~e2q{?IBE~Uel0K(O1>gFgDGB4Og>{lE#WheU4Vivw62nelB=2|EuV9`R zzLkHG_Tk0gN7__81U}3;Yy4fY7XDdz%D@=N%2V^dZUhzs-U6b?##cCPB=++&UCYgo z_`76(eA`aHXL=E09Q}8qRaRo5mHwJ;&hU_4MLd$Ymie-g?#xMkd`S(EfPoPRCB(ia zT71HA{fRH5c-pKVchy0~@dy5lY=5N|=U&=OeJqM=fz6Kr21Nr8CPP-9qNiXWu!{ z?C@R51dQ((a*>P5PZp& zKu88CRA-0n1Sk}x0V=7f6w)`pa7=Z3?uCrnO7wU6AiB{xcQYT}6w6L47V|gI?g60* zFNKXb(jIv6Y?mG}N{&rFZhaGWX%4ygb?c_>_$4a2YQXlR*_!#$niY0@dSl3AzOpx0&{_?}S zn-6zo<6g=XyUq;2xA2PRi~3i~4S)1>^M8Mb>VMa7`009Hp~HE3Wml)bHJ4OYu2eQ1 z(jLqWDxNsXlK^XD{8az=rz&LHAhpn{0dK>j$Xu~P2j##1nzyJ!IL8|2?w31b@|&)- zxBgp%xiGmFs!Kby;!|Y)uwv}ByJpFyo*%2dE<_SkB4E9~EC=Mmf0hDU-ocaN0of4= zv&!Tvmj%m1d7r#8*a#^ZaF+Fd!UWh_g?W~bcG_;3IUgeR(-WLb2J;?*y(fBL^&&F= zCWcFcE;x<%4zsl&6UBGsaWd`W5DPCQT=`Qr@RM}ZdU8SWDv%9@ql~s=Bf#nL8|HLJ z1+ek1{cPCXBDn4A!SnBDVqxmTO+qO`m(e39s5N(v5j`1=8sh6x^w&35fW}JIbOZ^& zR|h9Vvg$&`1#g-riAN}PHB$ut4+hmx-J%`?>L1a{G59Uyg9ct}m!Njo-PBig9o38p z>)1>Hv@)O*^LZ5nU$sUS46K0^W@k;6*QALRyF84n9O>OgDM}HVQ5bhen>DDU_57ds z0Ccd$b5pu1<#QydocA9xG9YzU|1hYR zDr7=|CreX&ry^!LeXW#lW#M8kM|yM=ZNAGrX3yC~K)3J;YXkBGcF_2bb=NZ%o7xml zo-_w$pn(?eopI+O+`RiRtW-J$&4BoZKKDqqKb=|cO`d$#9sS1nY3$#yS7a=F zX$;Y|Y*GDITXXK~hhJ-Ne6>-+9j;e%GHaN0IXVd^w?svmP?*6BzS1k63gaHv} zRT6aETrpU*o9)M0?%{TR-lud+H!YQ06&B4$quXBnsPY|w$=keyb{wlRv3D0PU%7K!>@{1SgN z7gpWyyR8?`DL(~mMG|NU{Y8TaJ6I}{|N5QvUo;qO4;j_?qwmCh2|0YEVcRuJR~a~> zl5i%=b;dxNlvEjyG)hmk^J-$SvCxPplKYq19!>J`zAoXZ8}Fd?nve~w{m(QS27kzN zhY67!xk5q%x4dlFu=s7!fe+>XgROCTVX^RRCXL$oW0lHVRMk`mnc-Sc_POqFa!-41 z?qL((PS3}`dDSObi6*sI8@**Qr8?gJ$A%cpL*k6-QyXJGTpCqH9mp`n@P_Q_cZWbq zZ}Rvk*{|`FSKHY>6dy0~3EdS!{yH~m#+z>_bWr`BDuPH8>1OOm@ilM}I33$2o=r7m z=VDFL^87$pBn&mV+^cL!EWHp4_@B}l?aepVr=%TE1}%kEuk>{onz9e{UXglgwOAKr zICpMyh=|=i5R#?&eQsTMrnx=K_%AHZrx)tFze{5ni(%Ca4$tLr7V$5&q9PCjITTZ% zZ+3h7j+$8K?+dLu3c}|43;v4??^tF}$sD&bNoK38E4Ir`!Y|ryt*uh*DGS83wsWYoRwv@}mw0ZgFu!@gY{1L(qM8cfIiZo$K0W@4Envc&xBl2Id`E6t2 z!<6IyB52nqw#7NVMJ!qr@(|@x0$WH?!I^D+*4$%K+gBMWSQ9*VhJ`u<^Rbz z24oOC03@utbZ?v}zT>>xLpjumK9w+;uxJwK0SX!HYKf^_$CS|XEVoqfz0t(5_{r6O zHFC609{FIRmYH+-MrG4?TD=L2@dRW{Jp(c_UftW%_cygFP0Z-|moe9Le?-Jo3q$Iy zm(^jU`FD2y!^b!FhbJY#ud&9x5rr4T(m?U*>gVCBlnlMA;Vy;OW5=~C>wX8$(~Jw~ zYlX96YdsMsWDI*i4bbQ8dah;SCX-Sjn`?7cAsCK#BLCPeM9rn)eo}RO)C<#D;|{I{3BB7zS8E6T`?_=3TYX#?Xqa^P#q9DR2TG z&d!SQxbbGw{{ng@XGm!ECxC1g)Gzzx*oUbEsQ4MvY-+T7D1S=t*y*bi9-c-{e~p@h z7FWub@^5uEUzCjhx6|I7d^;1!hhpkYsZv1~-9edXa!QCD8?Z>On zz{Pc6L^;L}NAoFAj<$D!7sCE~m;Y19++xMrVZBD32gSxRc_GjO=5H~@is;wqK{TOc zZT5NdoUOkVe@#g6gBBaIFy-_J+TXiE5FDPl!rScHDjXJN{#vxt-F50OB;!vjH^;5{{_ zO>Iu*+1i!cNm!)EXW@K^x)<=L+F?fz%r|!iX*qZ{$8=B*U+Q0sWJ`N+UCG&c75uo< zq*MgxY5%-~0>4O_$bo_@?+Cs@Qf;F2^?o1|=y%J_GY`oA)t$SGG@ts*^l&YZ8u`l- zn(@G!Z&o`emX;OizLOUHsjH%L^E0Sj!_&~~f`e(mnYq}jJF9Dk_}p(3E9vHcf%;9} z$E8+8^E;y>r;E%TTh{EsW<+K!hFrG%s_w-OUDA1oe}SK@vZd;G_aet(#D86QlSx%K zfAKt|0!E**jDwnNz2bnY$lgKn0!!O%gYIx>(0-pldE>H(T-)HHZKb%ewnJyOEq1xP6-&G`RTc}^vI zh0^k0L9gl`{yOK{3+l4L=VIN|`M1q5XL=7$me#2XA{Es0LYiAEPVoyLS6IRFm-pv) zXBzRWX%Jw$@q(g__YFZ3)_;SbTYzLxOt>&^?_KcvlOd_IOH@hVttp3kp54}{>U%Af zIk8EC;@S;mRcTkLgtJHqOb`ISbI32Q?Pb+wNwvLYwSL<&i#ZGuDzwiW8N?81fNox2 zOPo70bMbfeTA0t6DVOvyPO%-&xY8w9PA|i|PHPQhtC*K70_RCtBwqj-v|Pc`o0Siv ztDj}t27Xn`RRgz{C*MTHyrH3dts`$={C~Z~-3^+HhUMEs@PZte*wwo3A-4Oth9dmr zO>6$E1%J;^-00XaXo`4@z@gyonE7Wbhkx}M%Psa@?Q*=sC8Z8bxR9*?Mn(3p+zLEu zwmp2DMBGP6Ua$L(yJwrSYtx)Y6GnuIMw@)*iU%py;KO^wC|L>#e9#LgIZ)aheeSmJ zuaS|O3+N4xyVlLe7CKw@6b&gGI((IoS16yC>DlU17?5~vb?y#;v@WD6rD3Nxbn{!| zSl=a9{os>b_0t|~n7a@vKH=vQp5_*ql;LAvOC-IK5W{heE^rpw=-p=@VU(e?>Kdnl zNcTt0{fxBg*=fF$k!pX^ySd`3bP5g=V;5L6ccqqA^7?%LZ`d>^-`IZEz}D_3HwP~u z%nX^1QiUiwBVHpm?avNg3Jxsn7g48{DY{&kc!{)>O8FCGumOs5zPSbPi~KF_R9nky zXHJQXQJ@q@`NT&?XQr(h4eb00to;U2`cPN!>_=V#!lQRnp! zEgi;zjV$1ojuXyuNA1k)8oc_*a}T4V!=WPt?#{WExV>su_HSS~r?9YnF<}_6Q zdbfAeZ~ZiX><`0Exo~HwB=9%=BC89#iC1r?EO+5f0{oC0Xr1nn(#)3Ty6j2r=|0=> z$^d0{OvoqP2ZAYDPzdqF+XeW@^IKz+k(@ea#Eo&JPUsl?!FCGF;_R|xylJE*v%NXtLtxzxx0T{v z6mRhNDLeF51>Do^3Oo~RJrhrpIi=g!&=J|M$@{J@Sa^GeLlb@B$VU`qRjSi5oeLvJ z9&F}cCVsHiErcsY{#U7wy`!}F zuVj%i#paM{cl$e}_^aWt<@(I!t=1!7=An&<%mUMZ3&bs(-G5oz;T+q!D>yO;=N(gQ z3W3?6QfV_`FJa54(>^P+XLA`n{Vd#utEvymIy1qyuj2_|tV`TI(zZpaLOu=at-g9L zpJYF+20HrnlKf>4-zYZ79cO(2JxR_6EA~vp(Jm~#$p2AOd4RzdS`bo_QN*?q1ri7`F1p%$NqPbD&ir; z`J(j$HS9;;X3a;bcR)cH9;=A>_pFwB^!d}7nNNK|OGLT{K1fI05c7^9)5;FF$yM;u zdsAHd4e8xFcrJAP-u6ELWPD=HfdA(p$Ez0jKyjk-yXl3`P*x7?E^ImUU40O=l-nv{ zN;GzSm;Cqtn6lIjJgXXXRC=T5i$)3>LZH#{`!*upq7 zyyCtBC``iRLMnO15ItDqP%R&Ulan`9bj6>n_y?5_Z~L+}y&Y`lt2CI8e5SU!GIdE+ z_rIZ|#JV@1(RlB;m5m1S(WT5T;bGN2o`(7)pS{??B7fq-+Vev{JNFr_$x_TQA}b}} zSz$&)Tnpk=W~C;lp_fPNa*_zMRyz$|5OT6=s$$}IL$1wYZ?~js!}TE>P`L}&{A@V( ze8d|esZh;WwJlV1AdE2Utp+bg{8#wc#PO7i(1rH~tAkT|!2jyi%)0la7?P^XbpDSa zPazvt@dhGl_&u@QG%2yg7c}SDZr<^~YMn9-^!iJ&MSWR>-91`2mqdg;B+^h%AV?Od zw=n>3yTuI0JiGMtmT3H6mQV@0kT{n&yi*2ZXSRIu9=JwXu*)}w3-MzU=PjRV9@y`{ zgy*gsh)^3wH)&J6gJ78EUF=S~z+h7J=f=fgP`CN~IM4w}%W*3soFU(%;YK9np96s=i&Spfp- zUrxXKxUzI5`cO_SzbqMAW~VFUqqB~S+CRRvsMDm@kd@iXv-1c%bGh+A6OtCuavh`D zu&9oKoC0*)3%v)>HPnm)FaOz@JgRf^L#vyDVOm+uS6wJL|EI4+(Y}gRTu2Rq7=JfpK)w!AY<$09u;yAJXN$6+jp}$AbbbejlDhvoA{bL*0HVtl{PaA=bDuh1XLi%U7T@)p1 zL9;_9YoQ3|Kohw%qCyV|wf1p#8^z6=U2lk0_8;%Rb-zhBx@J3IGU9H5UCnb=Dp)z&5 zE^U+~s0m5XxbC;z;u#~wZHMCV^7vtY=@GrT zEbMap91hXmKzg70lq`>YIoe zA8fp&d0J2=!R1)3B=_aa(mz3=YJTj{m>+%0U(45$-WxgAC_qmMn6;uOv2H$(>_M-p z^myy`9C(t~=XW4=h%ygW&$@j!EpdtoA$r`goyLEY;$U9F0?n84HSd+iaKAwRndOt@ zg6DgZdJUv=EP3P7eE#=3x9BpgcGF9(Kkwswxq*5YKr7)D&i?F_d{philTzN8yU3tD zxXb)rD1DXvsdU2FFAu(`RqAl{mqqXg@qbrvq{xYGp9?KpmCN8K>#YGqUp_K5gbIrX zOo<6x&^&|*{vbQxE73(eD1n3m_}%o$nLFZqF3sGYPIg&c-n4`-{c!!fb5yM0%3m(< zN^<9hi2n`X!O~`U`bA)dyGp22o(o~&&rzlVIEB+xlN}A@EKGaENk<#8LW9;(TxUkT zZCCoZ+yVY+x^jf2umhnEL?rn`Eo|@w1Eo;s@6#>+=3K3Mji#@+4*LHc6GhDMhEbX) z%v6YJBIjXYqjk4W_;kki`Q@-*Vo90&Hc9HLBx{SYm;BE_lDY>xEGG{m%HXtL0-wZn z$kW;;IXB%%FaB1+v(Sq1Liiba2f3deMVP|#B78$W?C$w8jtjvCJ)bRM zx0+y~^$nc#XcN@`yp=dMrT`n{R-u}GQ^g6>mtjBW$*CURdEH=9l+^j3A@7WeS(`x< zPd{P82A$k$WXrq4UQPY*C_qN07=C#TIDFx-D{X@IXKW)sZ2NNGbli!gi~+++ ztorenfxpn$$cbLdGcv?X_GalFXEVQDR*Jea$w%Wt&WBNt!14>}uK*te9I4($ltrms z+=12K8`PRovC3Ryeyk_cQY*kWE;M_mLvh8lD!px|VSwmAd+uc+@czE-3ab~}y3BQ) z3d4bI_v=r~^F#Mf6yc<}bCji%lj!b7NvOj=EyLy(zfoQsWjj0Ns&U-zn3+nGY6pL5 zF`gxhB~gifw@q@vM&2%r%7-uK+g-^nX8B&^T09*k%SKN${sVE!Z}0E~=lPnjU=58rZQ zuy{?1`^8Yj?=tqE&Zs}{D?&uHOoj~)*^7(i`5#6Gq)a6Hv`b;saXkV%3N9UZ|J!*B zwT~cikcCVMbY+TMT-nX_z~7g8uap-SNA@2_t`>>Ds3CY*o^tKFP>O(kaLP$Yw--hZ ze|D}M_XaU2-fBH@{uunQe%O+^4=>CK??#7B$UjD+?6DCU&vd?DL>2ly^&S?cd1H6< zpnWoC>Eyk)Uft6|%70@NxTp}@*jc`%ylP{>t_}bnIXH??12?avd7Bq4I)5>AT$KN( z=Td9gi9ufeFSi4*2ybeL$;lVbuv|$F;)QKzJ>b3fcP|bY8fiOQhVOL;TPv?BXARHS zW+@uqJT0t(2f2q7PCA@H**b;FI+W(HJo^j_{=?1HFxn6EC`*0zMP_UAYTsnIPsnZj zAc>UK3NBSG-J$Q*ed6*T@O#*x;PZIPA1Sx)4D?4V@%?&D%9I=jP-_r(!%fkf8Co4vzF<@J+{&MIZRbKSR@>pS@yTllBkD>?J{)~epCQ!f)>gP5 z;waVr(k>_oKL^<6C~4&GInsYH$jAGCgY)H$zKPReL65(04;RkQGHhU(s{juc0GpVA zYrH;*FRXneryu14$kgM7JXd%7@Jt?)ed|#tN#~8Hu$R=NASio1hGR^)8 zaJDOs?9h%DGr&hCckI+y{{gg3E$)1V1>0wtjEV90dOh6dl*ckUv7Z=d_Tug94#&ny z9<2q|5c|*S6Tn?Tlqyk82xm;bFeVr_)+M~4WrF)jlT6#dVGS%>pay$V703^^yOVi> zy1>~E@bNFuM){+O`n}N#v2~)7@Hk7-kXNmjOaqJ+>UgE%42TVF$otI>a~Hlq57rutTqdAZt%>ya&XG7X9-9+VIr1kZ#n+irF7?{~{W1^kEODy;a%hK}{CcLd-)AyvJ<{ptR^6Z8t{4APPe!n za|iPdVR_R%Ny)8xWzsWH#oFW6=qW&_zIvF5j5>So_z!@Jtk;LN^Se|aQ)Zcz$@(3; ziGc=ZLvK}Xee|1k?hIV=$Q+n^OSremWAxDwbL`cQzxX`DT3;%#0J zyDUxExXh$hPN=UTks|B;=@&DwccbAHSEPO=R|c2+pGi;j>*Ews?}TpXs!DaJ{fNw6 z4XM(e(}d3WzdG>er=h$OcPc0?cEV{&?G<(qM=bIL0vF$VdbeOaY$CWwp~xvU zOKO_-{e)z0ppP$`wSdM#J}+veH9tC$A>STc9I`eVj6*en30o+rVq*Dudy!w?!jqOB z`Qz2eAcl}#b%r13pmttCf`;+@1#u`*k?1RhJMPr zVMSj*wS#~AT;9O%eY4s}1oi8>jEa&l&;F2ib16{|a^Z_G!O7*$I6+`rtRXAw$z`yo z?vtAg$~Xwj%B;W^0ccskjY%Cy!}qp0?g65O;iBZk#2u+X)xfkU`-rzcO-Hu+J@1tk z|B@;;nV)i_Rf0^J8}CcxS&SINT&6OqZl&5qi-a6eY+;Txoau(PK-*gku}Rp*4!w6b z6dnr~7~3#1+E0itVJm=9KP+Ln@CIY-Mmm`^tUv zh>WJ#fe(r>J~s$ta$>^-f=~)g6LPcOMae+3^60~fqH&WJ%tLB2 zuU)@jlW|1)b)DE49hfy~jg+gx?m~6qa7Zyirs#^o(y~_;@?J~0-dQxOCHDn$0o-h{ z;N3BaO$+rD(EZ8jk2ucT-^LfVi)s@j8cZFkxg41$#MgaGDa+9?t!bv)s=^K>s2A8C zT55P%;Argx$yy-8Zi@})p+O#$z}?=ktof-(B3c;ELinPxEJ|r79Em)kaRb~bn$zRrI_T)~H8QznFgzt_n`A2!QeDMPMW&35w zVWFFFk+Y^pP+|L)#@jyuy(;7FJ3uk%J zw=BY{)&043A~E!bPLgASs0bqcr+T8DH+xZtf^Tv0c)q6Y>xbAxd5>-)4@%+u&Qu}> zzeqFu^5GbyswE8RwSts@{DZdIrvMIvR z3=MtdL1g?q&WFrgDB>e~{pzhT3|Rf-pg(#&vbQwM_Dr9DE)BKq_~aksUJ$J|t-gs( z@KZR!#$KBHmL=OK*~B6S2!bmx{&yg+VH1aiKxuLBfTz?A`lq9$mAS=939G8-xdmjm z91Oc2b1Wb}nHlo~_us?F3X3b)U8HYY3Fc6Q^HU4Wl!FfeyWc?RWqHofN?;~MtwRyQ zw%F%KS0NN}i7U)G7tVr5sXOSSAs6r=$Rsl9rD>fz&9^7~e)x|`>5^JJs6JbF){rUh zv_~CKvFYIAzP#1&NBf3*RJ*`^;X$*3)^Kl!TY8 z^&|Mt-tMa&ug6+Xl1ymA>JDdg=@g&vZHN>}bNofMt~(M-=$N|kLKFH<>`=nI`aP#% z^4>{ame}od+;VG-!}6cyGGf#Nu|1=|w;lN4@71JS3u3=8Rp1`Y^pMH>e6qYSx{oAA zCU>e7?6NhIKP;#m?BqV+adQn$t}*jr4o&x4m5+Fk#5r~ZN|2qcvnYlu%)w=fAW1h`sKKK z_u`cCD%0rI(`tPo3?x|>O1P?;;?X9y31F?AS^IU0V*ggFk7hl*b@7VrDTR<9^6gix zCC(a$)m|;Or60!`Il?x{uU4cgW}2>k(@zRLXiiW+RDtyEj#k|KAT*h|K&?`OurS#c zUnTeamTN8HC4&`NZv8VHvOP6y3|%BpVkr(< zrhU#Zco!_>Kl-yuAd^5%iBc0U-?<&CSX8DUmmL>h(N#TsYf=4kb$*Ueq{Osv~;=6lfM;R)?stJa)D%+5v!I1erE zBUVjlxWCX2|9i%rSiQ#H5UbKv;h$gV`+U1!X=>JYwEyxu-a}CLjE)Sg)-$?MuWo8x zF}Y3&J(Z#~c`bMeZkHTo7~XjAakg6Uou7dRtBn+<{f%KT4WjT2YB64@96~#A*P&1J zyi$d|R7}F*d@-Wk{)5qbV^fL9aj5Gt@cFr?iir{VB4e`~9tP1uTCm-z8}vI~>x!}w zO#3^-pv{`xGdZbLos}INB+R?2lu%$}&ZeqBe80*HU~B)k1_qN~iQIy8WsS6L$VKUp zf5k2J>L|sUdvd)(fz8Ff{wed3G4}TJ7V*;k8nPXvC$T3bY*Rl9;629sIIQIr-N{A?D1hkV&+nXI1_D5fgs-Fwd=Lzu)~l zP~7|2Lc14}$q-n)zK8|W{=sl|C^x7@K3h+lb4-n7Q{T#m&(&7@(Hl?JIcbjDutA-W zul_WH&y4R34YRDD{k~c2|J~}X`1agO&eFiHSwvjO$qyZ#Gt8~BOr|cqpX!bB(!dU7 zywq7P5Z7Si6ZzT&d)sS9X+(>KfN7wqre_gkJBzgtFS{G=CV-%}P}sS;>`5HF%r6_C zJ|)QJ>D&yu7tl8Q6DCtLGoE18RFDf7Kb~$Qx@BcIj39dbP+bwy$B>XYQ!cJ62X*O+uvO%fHK02{TWX=URqu8zT{?jWRemX`>9md zn0sfc&pgEi`D*W1NusJ2l#xrTL-<|C=DjtUz!__4>9_ZJir#*lGhd&e5sUd=n_>GV zn?^WPJ=;c1Z09O2JZ32mZg^~)QZ+hMC1uS+^;~~fx}Nc^=1bhL(EPiVGiTGs!AHfC z9ww?+z54O^B%CRmETUg|V}4{i=?<0P^!;h``l4Na-%8N)uIdvaj;?f?Y6x;la6{Kr zBu?EWKpE1oGulXGzZ&FNe=gm)b&%PSO0h}ug52}tA#UZY&2Zs1XbAiD!RiD|o0;;f zx~v{J)9xEJGFxKd{^yIwru_OYFPp6Dj0C%qV#to8FL)xlrQbh4^xzSpW_ZrK{lRVH z7bc?2JO1dN{Pua3y^(ZT`?>R1JiOgO705HDnvfl{w9F@B9y+kzE_-F)!Vc9z9t}37 zo7R5i?1o>Fv+u&&Igjx3q+Ujg=^v5nu03nG03tzTwWn2am-t_-K7t|U4|^QhmQrf~dQ0lY0iUoKu*)9-M}EQLRr9)^60JNqk6{faxC z_wm$ogmOXGFmSyfpSb<;V9#TL__v7Xhu+5(oLv-wFW)0+w01Sx%AV_ZeT{U}3gBif zuI_P2DlOiWIuaf7lG--!oa21t6T|$Kx2VdiIxk#Y8C*pIHP?*iGi}bd%hq}Q%KjGX zO<(m$5(D|?_p-JZfXivj$3WvyACUmy>h|qRc0r94&bTkFjQt6ag0h92oc3YqO{< zr33M+Iurkt`>Q)1{?Wr_y?G+>T3cG^V#Q;y^zv9v>|T8}>yx|Vw$GEv4Ua44O(I?H zmnm;okA7bKsuIiCE-+m5X3C?6t&1{pkf-X;&hOV>O^)|oGgkd^5PltGbc>M`QRW-J zCsCW~RDJnu=BB}`oS0PuAUcWADbvXdLgf5~^i{;4Wf_o_Zlqp6>0f$T;iS76#sQ zd#dXR1YgDWA@E|1^iO6~>v?lKu-q<>Az?kOg!0aOsez_od-S&OU>nO|+Mn6#UaenG z-|zJ~y_IX$%xRES!?=oPAIsD%3w&w6xoGirpN3t5|Myf-VT_#Ct7O*R=c~2@nM4ea6e`9Gv6f}8gG4@Sg4TI=UtUU3NLFlGsnw*=g(SWqB7Rf z3{&&$-+uSP$xQeV8!HSPYiiY%Z&f@DOHEh_Vum1*X6(jG zNR!f4kIdG*SrhRT(>lqIIn4U4q;V|FOk`qHnbEJk#SPH>Qc~#K(8Qx7Gkr(Luw0KNkMGtr@v-;-fG<)?_SX84CO?e#D&?% z`4~x1I&5dVE&GKHs9459pX#FhAy6`@c?OHiSjtPuI*5sOp8 z%LlhRwxI?mKkU`P!$=(>4$^pGRm${rfgGr|{k^EWYl z>5i$|9EEN6y_;Ql^%a*b7XIo!pM!r5x?`IXnvAw%%9}yvnD{l9#tPG|3-ojiF zlOMlXdz$6Fr11Cc9)(1X=|A$?A1AgPcS;cjKAe!>t@ujcyqJ8`<PI|R%wLLA~t<)S?eqrzi=fM|u-P##Lo%}L^g(Y@BnKtq>TS`CP|82O-*4p96i_p91xP45O*LZ56bnwDAa!hDn{Tt4T8B29_ zA|3MfHwGY&N-mK=d38CwiSqrg3q8wK23>uRAH!}ro;(x1+K-_bcB7;B8#O%JO(G}_ zZOhvbaXatb>@&B|OFqN*|C~){J58oEE!-&uzKTjuV>*)kqNeF3;^OO{2(I7dt*BXb z*OLu-B4k25gdeQ{QF?)b^7U82R9# z0Qc#SpqQmM0G1pg7cDVe#nQ?SkqN|f$6QL zn&KvXUz*b$$a5ub7T|rgZp%e2a339OCSyq69tc=VVY~to|Agb#L@P=u{uC116wkuj zwHm(g#rblA8-lhN;`6-Jc-d3iU9aJ!q=T= z&tm!!5aoXfCy#38U6#s5bTp3V~qQk@$Hv?B84NDT+8moKM#IXBZG40wLf*0egDvpPClG zYqiR`*IV}^xV*4AlE6TeX)73;y^@s>jO5L|m8*tm}p!kZ~WE-qodg1W~3 z0ey_3CJ+9TGlGk40t*6gEy+SY$r`kR`_5t{R0mp?1*TyG&^{~d zfoD;#VCRLt3)O{|5tN}}+gT_kR|dcwWXGS%i>J9sCIF6q#l!TINI?r=n7526GWqU0 znid$;+XH{~(+x_XydMg7(R7Rfp`;Ejod03_;r)aPV#Tu5BlP@D8IVRm_CaJggsW-; zs}?h~$CJO7%s&JUh-?OKG^bvVb~IO|H)1Tdk4Bbqpwvlx%RGY}$Ah6*T+OA5yiE)Z z`wmROVS%@BQ!mL=XWv@#!SO19AR<~{KZ(r~M-`cUd*s7PoKMLCDnPv`K+Qn@*$Yi` zO&m193d+E7aCyJ(E}gMxM8y!NGFQ=vS02Y_C^?!V!IQ@+g7;PGV@kqDZr;LfOZ!nb=&p&+0!Ua$dQLKuSXs|v= z#Kpiagu5dfr|$u#oKVvtDR0UZ5hW*z;G%k5;s z#zkDGP+`MN`f=V|P zdE?UnIL=w?4drw=4we<79el$3rlNa@&>P3d0=qEwU=_;U>7^m+0mB`%| z2XimW1Q%p-#loX^KyL->Ck))qf8EBTtHc#pUTnF2q;(iO32;t~bNu=pJDDtbW=*jT zk_?Ks42A*Vw#3j$FhmuoT`dVSq-H~nw&ic_gqk40O&2wyoeB;Tjg*1DLrhF!k)M22WS!jes2lLHl@@{=fOe1e-^ht{*fgaJ_O5{M)l+y|07~i| z{?zh|Xk{AAmLkX<3IyHw0UcK`1e_-*(&Nc8TmC3GORgRAAX|y- z-Oo?jgj4+~J^iqS%5*~+I|gYk7G3a0A`r!K zcEbLJXl=e4%I7T4?@4Yle!H#iS^Vk4QviSOXz7Y{J}h6z_?EU^m6ApkkU{603-DlK zgN$$M8(dpg`R2xBBOstf%EP23AnSwdDW@G)c#G18rjfP=1QLA_uZnUlRM_HWas{Wk z-)277wl%NL#P`$SCIQoJu$*i4YZ}F&mz-@|+xN<>y|u?A0d;lDvy11{IdPJz&|$HB z9AfjNN5T+VOUu39z(ZWj><7Xu0`tuPvdSm$S3 zRIWMGn8!4ywn8$@$L~kgfoK-lq3SBEIe>?`O;B{-f@G9!rZeo4D_>a-HIzU!ESMP| z%pHg2({!N?VYymu9}fUfQ(Kw>b_&bj$XX|j%7Z)WebAv5pc>R`wEwL5us|$WGn%{B z=G%6>J)Yb{Dd0gwl%a8EI5vHah=#RvO$*lMx$GY0g{V#&&O^YwP1BQ`>}6WTOb1~n z^lG}U!&M*bpUGyh0J_M_*WI%fvIp`qRb$b7?o|$^$7vCj{VAzzV8mLaM84< zd54h!w9g4%;1@3fSUjK6#9gj9&SK8qVujFN*#6(FPrqBN{WX6FZ_jA{RxPan^m?~3 zm^U48b=@^BykyUtEjK^A8qj(>%EX-i+*5Y>orRu-bM-$5_9m|Tjo-+qgGWQ+_)zO7 z&1a~*U3cc{oZE^OCsQ_;TP&ARiPZ|(1VU;eormF@@NxXJ9KV9oWv&IlnSj*E;t33U zM&*tIDjrxd3c!pdKcZylPILe+UB0PhW4wDapz+}NyjZit6r~anT?_k<`EB1cnu&ng zGdH-^obPv__7_Fp_Yua@cva=b@5V=y=iQqxvo$=cQ@?Wp$d(|{AM>h-RV}ES9WI9o z8Ekx0EKmb2A=yD!g+OB_LZprE=zf0h=M!0!)F2;MXkF-v(fD#j?lMBN^AVb^WHY-B z&P?lSJ=;-}*kJ;DF)*q@Z;X<xXW1kqm>_EF!JtE}hU0=x0!%5jF)Yy2lJn<~k)*L6 zofLm!=dC;jHbD9l>p^B7@x#U6>jY!<7iw2+qnIG~A$Z^EU9LZb1dVFiK*PmNZ{g{J zQ)KME9FUJA;@umhu__!Sdt{)UHfUUycIZm96?Dvt1zM`)sm2M=Z#69cL$EBbD%n%^>E~;3>6#5l+s|ok@`aBfT(Olw zSzbCR9FTYAxsWnqLvO3_=qvw<@!E4*5}XiFuoTs$>qye!gSRKT2VGfd7LrY8;4@6n z8DG!0T#iS$7ayr?Uc3qI!juDb1AD+8BlwxZR~aY6TZwPlo3#Q#rY1cl_JthBm0kxn zKYsX9IS}(a_az-*ZEKz&N*VjNvK~x_^>4i-Wwv8n_^Iy)`N(kkYUoxHU-3XR5GKo7oe``Ok z6@F&@mSxSPmxyBcMsS``(~o`^;@voFrVcTO4^@roKqXV`)Zses_QIXFi)BNZd`A-N zZdjn(PCu0nN^VaqGJ4{EX0mCGCIL~s{}Z$RGFy1RKLdr!ZKWnMsMJm{Ez9mV9f%4_ z7_&ayXt(eB2oF+{u`-Y!N%_f!5cI0>5@x;6^ZSxm9Go&}kgWl&mOlM(Blu3zs8iDD zT%ot%#*amWSh@S%HKl`aOi)3qQK~_QMqAVZtAfABtflTJe5bh^!L>R~I@T`9%k0H! z$QrRqk9+z1vLIQ8Ju&)&rsf&vWg+$-o2PGwb}O@RFhF%`>P<`^r#4#$Y(&1ae&)A! z=5`K1f@Fm=HvCdIGK-wY`{+#WPjJj|!@DdGVunNrK$fiWZK0hk-b7+hmsFiVLn|X5 z?l@5J{0j1Dz3bF@yl9kTtC4HJ@RkAP=VW$JLO}(Ga98BQTJ7X``CUt?w3EKU6bcoP zY@9m~XZmgt^udB_6yg?At(090?tCZkBS^Nmn6LIk=WEfhao3ckPRgN+4(>R$OdHUz zSwH;AF51j%XD)$wt2P}385~wRk19yKfw9=~CInfeDi&+z~!Ouq{(+Ht#e*Uo)nEsjy48dPd*Nu3+fgM zpEJC(mr7B|3<8lNjc}Cu(;7TLrnAyR*-FDYZK}~g#zRB>Au=YF1?IaLAU@y2I^D4O z^%+7CUG$6qr@U^J^MNA{h)~Jb?u)hZq@EhUgu<=NDM6)vh4yHmH67J69cwubC}@dK zj8Q0Pq}}iy2FSG(7<#erVLf`VD{ z28)3@u;VSj-}bPFu!Fiy=!i*xsVi*IZfp@3B)V54R!t^1f(4o;n$p=(YPG)!1qB0f zT*=IumKOk>fZl|i47eRE*y(8jf1W1S`)Y<8uRnP?bOUr*nK2dp>#1EsqY^1-iPmv8 zprqNJ{03-AqN1QHJH-POoMSgctK=g!7z+XgDWzxQ==h`@8pE(a!6p{=`{Z;tF+e`_ z+L>L&E>K$xQ2SF4VeK%+EnRQaALz`$J)J*qCaPZF1%cYL!w+2QT?s)o_{erQg;SY^ zV+WvDrejwh&Ia7sbwsgWHj{Cw@?^m{6Lte+I`w&Vdb~Ib4^*R~(*BxZ_s2s}a7W3Y zINd_L^X@i~agR#T>nWpF*I-blV5}JMiY@QqM@B2s<}*d@1SDv48n+f*`8xISEd911 zs9ROu!;o=REN@3z`8z&{udY?Pl4y&v$eT190|V5r&;rfGao6PRiv=!i2cIun>%;&% z0zcI{1~bR!+h+Qp9M%{h%PPd9a<$6hQW;Px~|5kk1wr zN~9z}-G%$sUL>3Ci(FC>1D1{;5TQJI;|sx1f-Ekl$I%}!K}$?9 z7$Cal)@k-3_gt}|$q` z)TD)$V|3>|)`uWaC%HtfD_c8NKX)r_zeg|&KL-mjOJ*5qu%wT;kCUqtKm_dL9V&eP|@ZZ7=P;nv;6V$-W8vb&>tp81%g@8d>*R!z3k~hz`Pk}z*!Vv}d%%2Mt#}_> zdANAFTUY_$EdLqrz|8QA}GYquOuiZ%*UrBDyl4^B*rfwCkFY~R?XSN)6Chz z3Plvv*6x4W3jTk#6<2V#GV^qChq<^o{xcOdM@KKfyiwI)1#Mw4C)CWs&e_w&!FFDGY@Yowa)R+e@aC_CVXNK5l7+c|n#x$`PJnt57X zWBljS1o$8jf&cMpKC?d;9Gq!CHezckFUdM~Thx8Kb89U9_O#%rRySS5xB405c;mK7 z`Jk0ITm7((HkqBBE@^3LZxA%#Y|pEL=zMF~r32W-0}5Y!2RkU5iie)}P+e^Xcq0VL zSVAtQhAMT^lmqEEadb_$KI?k7SI?fG6Q==c#|PM5QVSu({cpPO-i95gfo!?92*8NuCdCxk$6(Q={M@y#o9z80kNr$ zn5jPY*tv~o_m{9Z01`2g<)xsMi+U#pwkQ&?=$A<{v;)9uzXtl9-cUiRg_~!m7?exON-h_p5!|*!B^xpDu&HNTsQxk(92bYmK>V%M6}48_WZS+4OREz=6FHD{$Z zq9*T6IQ}T$A4oJ-_P0+%@0eZxQ2v#vCJ`(9#iyYcUm$XE*PT?sE@z`!=dpBo3jWKm zE+7-tj95)TWx`*~8h{Ac@5E~SHvZM%tBpiG@+KrRP+qy_xLbk5bNO{PW?vfFU+S(O zW7xs$zr{4|oNC+AQh}OEVx+qK${$`}u9K(OG6GxZO> z=-i6`tDI?HBJl-Z4t`=w?lE8w2?ayr*_x<#;|3*L-!*YQK|FDKpwSY3^4~_Qta2q> zGh%!r=4{te1<&{piEl>^zxbxhjSr;o2FgRFkVp8BIZfBeAF`k;x>+UrvRhd-WZ^{v z3JYjq@&+2pXs#8uEzTogMu9v=~@70|k6f!>xpGhJ^2v{94`)x(YDa zY;()C?y#6QfB6ykP4?_FaSo=g3>v`H(|%;;fghGW_Os|~xxqIf>yFIQIHFZAQx(xL zRM}YBDV9ngy(wj2nT;yn_sE{TVQ0*bLB{tBn{U*q`jrBQHb8l`UL7A#RN3v`quNNz zY#=m|VOe@@6D6$c_t`WpTc|@61Tp>&<-Nq*`pB9Db$7X>n@PYXD^Ol1=I#fJCScyl z^$k-4j_-i7p*GT@@>7IEEay}B$u*S6>s*g)AD6q#Qi6nn*ZnsQKs`uLdjlG#>!rJH z$fGuLLeyfcyDUx$6f`a$)sUgCLeEdQYXjN?+UTk!E)vg6rqnNTG&ZZ|tH90^P|DRt z61xdBjv`tdnXlPbQXR43aHmbKA=satxb~&dNx8%7AB5>fX{=i_u9<+b$>k(#I)Rsk z2K?$7(5P$`LZn&bW{DMT^|9__&|Ld48lb6?BSlvCZ3m3WYi8F~L!|F$8R*LkR1oQ- z4yn*i_Vj+Q#SOd~6M!1I&etK12DqHkX_gs$q2WL=-> ze=AO6Yc}|}Ip!6$-ym`@& zkn$zhPrLsBT?H6lppQ8s)e>g5c%4hTI&II~bg)PxuneHY9 zPdRV`3Y3TPA=0c|FxtnQH6aF_=ql5@BnQ87bL^8OUla{IzU~3Q42YChVJY2s75@fB zdInY?Yksj`*h5pd`p#=@lN|6zrfnv2zX%^fB?boyo$3eB$iT9WMubVBspr^7X(W6AH^E&fBE1Jq1xM z;Db9gFCe7&s6AH@s3I3z>Xw$~olR{s#7WhipVH`B%~YBLVl1k;Ph;IA(QLr^4p4+& z=N@yM&8Ysu)K{-8x&{j?X@17OH>0|ONvDU2A98W+sZfxtRnzi@*ha?GLLtVeJzEe+ zcc1Lo8H>DJtsmr20lC(_y=Lg*OIsVrC}E9jWsT8v9vX7VfaHKMjC8C2eK7e}gmR4r zTD9HoZnl6ZL2`wCy^g%qt*^muPs8I zF@QjZk3$zD2UZOPXmiJA&3$X1Ut{DZIiTnz(nxf!C-ZggH0?VjXMrE z26bui<2r!D9iR-Uj%<;L-RBs@XswW>c^7wW6)GeL(P0E%@M?qOw&L0PJFjbTNDd5p zZ{vTe3I;nQD%Z53sRd(o+`92zp7|blBHB``?jyRAPYln`H$R+>RY!Ijsm3yWJy)iu zVs-H4^^joP?WVEny5=hQ^7PN2ky}NPqztdsZ|HiJUr&f(Mc5rwa$gieD7q0=yVs!o ztm{^h#0(^gH$tn7Q+Xx8XaV*Uaw)-*%^H_jtok2?LITmFE0|h!q=|%fp2HghID)vg zF{*H^K++fQ0x>wiGjMBzdJeRz6Ed-~@2)(QT|R`e%rh&ZZQIn7 zJuxV=%9*IiyT+K}rCV0k&(AQU5On(y6a2A_pP<$?-W9ccRJp?rWch6DrY>p z9>&TXa?j&bm+symF(v4YLmQ4P2FU>jE@l-8{SBYk@IbV04W?sVSC6{EqxK3kq^lHb zdW?2OrnV#pN?4#YEG5vSvOgzU>QAa81`3K;rr}19BGG=co0D}tzGe5hvMAOs*X*~j z*@tKbsS>d+Zah05?hgaqPe->*NWr>b_@wki+9>J|5@f&mRT_Ny-MYp zeRMT(0@eki^D-l@7pS7?$OMhAm`!fYWSI_B?(8pry*67;$h{iuILij(bk723z(5&K z%8ePmV(+<8gE1F_mS72(N#iq~KX3Z^tcNx?X;&tQ;p*aI+iP#KhH)ky-6&F);PhuN zxh!SL?~@-_c91to)z{rPvM_ zU-n=kAWk5@sFBv_RGce7lV0!lAF%<}8a0|K?AKP6n?_A~@M-r;%BRrP82j$1rh?|t8wec&Qly3=9hHuB2)#;IkglL$LrUl^^d?0> zK#D{`5euN8bPQ5OgaA^Mj+7uxl#b%>=7#S(zjNMu=e(Q0?%v(m+1c6I*(n<-4XVz^ z^pmn)htPt>rd(o1Zz`iqYkTl2eCUp^@dizX&8e3JZHm& zzlJ1!LUHf2Y+c`|2eFL;M@tN40e!6Sk1QZS96tMz!|WPqQP*TEgP4=k>vA^uPxV2( zhzgvFd6>G#W2n#BFnpAKjN|h`5rW^;Ww5ReIG)c?*O(SxBKa_;Ai({#U(m2?X2sWy zK;4c9Ec=(s^cd>d!sr8h(#aoqI%i@7)v_>t2cP^s4$}{OOFtPiaT^{G29W7WdkW?{jtPRaUY~WzW63Vy-4^0h5@)wZ?fJhlVNn=0vi*?r$Y*VGW8cQM*>wO`u z;vN850LZwDrq&^UFn9104$MomSk`*!nZF09w2`yM5{0S2eXyCx!8U` zbH^|Qrig@xJ=YoHto43BOfTkYJ(}w!^=a~O4gvUW3ZI2u>#ml zahGt>E@J0BdpXh;Fb)XXD1%>jL2L&s8v>3U(%_dB&h;qMQq)ILl`kf?dP{XD*7 z33!x!;ETC}Zp<7ak?wMEvMP{%KehSJU-{XPz?N@NF>XFugg}dj%@Me7g~qD(kv3@g z63S-AO=W52g~fnpX~*Q6V3yGebm8W(>9MJslJeilsyx!8#W(&`AgPp3!L5({BOKUT zSP6mfcVv^)GLJNH2t#_uB{gNYPt!*pch9{jv`FDv6wq$@j6R zQB>bNPtw15>^zCght?(Fd8d*l|3tBl*mUHdGX(?JBt|cW^!Y6H{9Sn0Ki#)(ns#qB zmL8aKU9_RhAzW}|2t63WTYqZ+EYBUHH>x(PFb<~ZT^SO-l26Z62DGwSrF#|;nj(yHUhi7v(>kfBx!`ghvXfZU>HDE&7b<+HGaAHa8$7?ibl@} z@3&!oj)Pw*Zf0V-V?vKCVak$gsFfS=miCh-_j`Z7f z?mzmDEof{#@9j4~%Ui~Nm*soAl8hNWGnagwa&*$h0p0KD?%rv+hjU)NtzSeUGa3i| z0QSe#+lg(;fKuM9O?*=N1H>5@&85Omhuuz@7$h0>>04nDd#(}#t5_)twZ@r z_W_lBi4x>%xQmR+XEPDWVQ;&I9~@Om{|gB$H%?|)q0f7*vBq9s-ZE{7)+lGLQpnq^;&gNQ= z+Z%Ensl$67wOm`jUM@0C9FDJC72lyBSjAHithZV5D_;=ishnLAfcLq!a(e5BIp5pE zsHz(|X+kbv^v<(La}TMb%qw1x_?jPeHi3^Wj9ou&7HTOL^+QDH9%&ewr#ktAF zvoHk&1QyR6O1`gOr}7l{8GOmyT-o05E4s4pAc%LpyKjFMP$~fDUp##uL9gCAjAeIA zjgRVfl(S4qyBWGAK0sNpNeS#2-<3zh<2fzdqXYLtT}1ZPZ?Y8YAl}#^6Oc^ogEJqf zfLr(KcyQTWLFCt_J`ZEbZBCT+hG(KLC8n)NZV5{M1aN)S6?CS-^lEE>$X7Z>L z4-m!-hHlKjAwNed7bm@*Yc|c%;ICbyujaHH*mpDc-nBag0uLgUgW8o)pfWeU&31#9gG7&I74p(R4qgaaFxou z6^$3mxMjY}i{^j!Lb!>1;hvVpj~W`UR+lh0CXEZ(>nT^~RZr_YnZ40Y=2}MXHvE=@ z;{|GrMpDbg+zfDHH9aM$wo=e7`0CcLS3;9C^x^Q%v%oneY0tO39IsJ-XpUs(64F3{ z&oE(J$K9Th*#{r-zp|FOxh1^3W8etH4A5a-G0;1$QFfk{-h$i4An31W16ItM7Ke(6 zclS#hTeL?pGV~ZQM9%drrM{GfcXTc|J_e1OEeH!&s?QU__>hdP&DoNfC#9RO=&Cgv zkA7$}9NlOXsv~q5g1VEaopgMZv7aM@3X{_?lX`@9zkc9>&m{RUpUA@L$LJUa$8|E0 zp`tFod<5`!du=oS`Atz;gZM`G(C@SkBGWgpF};D<8J>SD-@mto6fLjP)lZu9*@~tGMyy(!&qnNdG`K&0DDdwkTd+z3?0OvnA5Z z_X##gr__HH3Cayuw(>?f`p7Fbc{I5H^;E2ZGPJi9{5|1Yj3{vVyv^?FpgA^rDBl40 zlnP3e{GMKJTh^OV63Kg>hi0Z+yyQfVyvcf8$C^E$|Fw#zm#4R|$26E_dOLR?;a;?O z1An_%I`8l*p>a@r`&aSK&zRx8pj&)qS{iMcJd@q6Mx!)Yp8`yjr6)j(1y%J4?$5hr zPAL!et~I=n?p37== zt$FyUpw}oFCgxJwN#4KU=9#m2@qN+;b8lFJM{ZBp^$qJGkdZR1TeHE0gtepzpU#i7 zE^}yu9v&x7m2qyhp#`e5sMz3uR5dO zA=%@1q_3XIOo=?o;G$^#oP77{YnWERUuBDbM{Fpc!b5TlsOC%IRq}0P=!!`oj;Xxi* zlzI2Fs66ji9W6PFT32QDXo=ecWng@-k*;kpG>?hBUw31k@b>$U?~IC7FV4MLeC3nu zo2vWf1=*SN40TR)AXk`OmDh;O2LZ_S^8byGha$H03b zTQB%-eH5+#?LqJ6t)e0Bw%)zg%o)&B56Cb0uu%$);n^i}unwyinR3#n z6qtK3IkAM@#yd{?dsowrR{ND>2^6_;Lwx>wuDtUtj~UMUu^Vp9NuC9P0aS9isjfYZ zwB)x4+Y|dCg{29u=cPeqt*%`d5M9jd<6nD_3`Vi^ zdP|h7ejLi~3JYYTJcp(U@sB>;9C_cn`FYu?pD!#Aa(vfL_4`wamPL6<)?xE+Y~6t0 zWCeOf7W)VwJ1>&q-*POfO81ay%<)KNVMQG#jn}%~_>C|ye!RJBCjP6}?=&jk^0KjZ z==$JbbLC_U3^P;kR^MBq4eXJscXQ1vTzy@yR!bgKJDU#DbAo%oe?T2ud~6M*QH7^s zyBb{vmf1m7XK1oFU{Rj3H&BkOcT-Y`@XkG6;8Nts&L4;0(UT(-Y<&r!K3vfObT>SA zX>L5UT3#aioH)E;p^K0%^z<;Pz2!Ix!&EWRB7oP^Ap4$l2p{Yz50KlxEqQh|Hu;PPj zCfkwkn-^M@hK^lKPm_li2s1Ts*C%8^fh@R7xH`PoiC*WSw4F~IW>jtvLyCQ>&HSxU z(k7r!2J#ITtW4IrjfTe!$n(zMC}Mja5*b>wvoJL8r<`ZN_=vH1T4-UGA6EDs2I@`Z z0RM|SE-eoqDi33AH4{x-49^&pH-w-K>;I9JI=&1`;snFEmP{3CrI~T^>8R+bXz#Rg z`uuVb?=>L@FjlsZi6RC@=$_=w^Yd^i#yTiGJoUis8u`^9zUVWPeMYW!SHOca##*tH zT)JRr6;ux!=As0^;ot2uPhQMNmg%c%E&lnmSJ~Rlbd5L$D;wdG|^mpkG zf5LjdKCr!&3Z&MXKn53d8D+D=J^C}OrDjg*4R7-)WhruKPvD3qX{9@EHh@n5)_n!S zgLOph21nehDzh#X|Dlrr_1tg!UMC?yzR_}qdR#%$ z$~Il&|f)>l~p5<&pLSMXmIv)2HP7X z19S*?71iR47HuGBb+lB_4!a(0>M~F4!Vq_!H}7`Od$sK{zdzq%rgC!+Afy4{5=D~F zFg9IRMg`Y-!A20sShNQZkA)R5EG5lB5a=LWIcc6cb5O6|zehZVj&&=Z#dLxqap-0B zV}9VK2n5DrWDxE|aRCMT!%kM@9D8i+K3GpAh;ouu89trgbcE{FDB4Cp+;(odg2p&} zD$&QPGX8?>CU#=l4;#g_0+#}*ebJce3zmW;?94Y=cW(*lWAr{MCPO6{e<1=*QX1wu zyD*)rtaBW6&PBPg2otI&<8lRHC&K=1{;m_dkXn0nNp~@hNRp2I5e2~Fs~RGf47J>>@F$pB0>XboIl zG{P4(Ef8>Gr@>4U@IgsQ<-1A@ieuHMC!>l+=b%FRIj!h*uR9u$_yH*Av`7XCc{x3X z2GxyRkeJYelAo-0GWRLYKlU#IGltP=pd%PX=bQ$aDwvAlMeoJ+srY53+#&j4Q~wtI zb4fE6-<`-+jU|9`^$Y7y@25O@Qgq?xvMWiJIbd^50p>AJ;3pf&@25R z%s({@;Ab(-Cw97AOLGA zWsx3h$&k-X$G?oHM0NxRk6=bWWY~lwKk3J1Cv73RPCWUt_o6X6!txZ zSO@bLnI$XXX58(Lz{!K1g%^U5ff!{s%7RWeyego4pmyw=0G2^h3q|)p^^Q0M0x(_B zW3lJ~&(vcI2BJT@{Lh!2s9|IXI#Px{UwHCLD=?v%eVd>Y$U|z-Ys#Q<;h7uni!$`Z z^3E^RIOge=uwl|jWSq*i0&R1xzLa!rknDgU-5FGd%YD~jhU`DdaY z(d$zorqSd4%~+B(5SV%1EP|Cu57-$0HSxyF)cM_yrGHm~xI>9OpV?gdWXt9Q=n86; zrMo>Axq0jBx5BR)f6_Fy1j)Tf4nUz9bpm>EV4cC1SKXndJQ-Q3-TAZ-Pm5LIlX(?P64~FW&%C$UfZVXkP>zIevlx*G8 zB5nw{dsOx0Og%@pa=HHQzW&sA{hPcKeXwzu#zha#W~dnobp!u#@l1|M;d5Gk55mG$ z^ED3QV5+R+5hx*MbfyXCGdg6JKVe?oQ;qlmy#>lwczPKHCR&KldzFB4!UySxJuK&A zxC4I0d=%HA;-{ujv2LVayAuEALx(^^Qfl~(!rw39)As^zLVfb*+kl$^{#Kwu+e+rB zG0UA3#Y^j#1c~lpSNoQm2o(GVe)jd@y{R3Pt$SVJURb>3IYFo;#`)+x-XIbov2|+g zrcQu{gG<3B;)mO@A(r`|Nwxv>Mxw&zek-dwLC!2w!)87p+z1~?bIk5<#&;}shjj=)A_=X(U~wTmL^iE!m+byN0V9CnC~#p7zDa>QlEdl6 znoAckx1SNaD-{9(q^Qv}gtN*%kYfpt4E?;7!Y8}ow%YvHHY@wPGqF;gHznp<6BRP? z>SC?Mw0O1IjQsiCSz`Z>X}E1dW4M9TwKWuqC;4vR6Yz@MW}W`%rD);h+r%VK0JDxb z5q|{@eESKW=V>?h*M)q|vPz~UUZ!(CG5Jgc^5K_mAn*+gauP`Fuk5i&=lvO&oxAii zcwrR^MUnn^;T_nX3#{-rsegl8-N5Bn#4e@q@-JT^cpgyD*?<=HTI&y3_a)o$`98P) zq1v$>7i%k`ysr9&VhqhHA-724LSwl%_h~;n^EvNG*;~c8%-vznA@YIgdfslzAWRIT z(UyS5G(lcXaw@M(^Uv>T)qtG4g+`LwPQ=tGrY_V~g2(7+SAQi7Y)m^Ef#%nU9Md>0 z@h+zJNA-J%$6tDL{WBSY*=a>1YD6^n%%(}kbuR82`oEd-NDSMKhXXb0LiE_jP!~=W zuy4T0QC~pTAE>a3LDUFp@a4*)PnrB~4g$Y;*H31eA~7$72q?M_qq7GutX|iVzIc~fAX8vC6=f;*iMUo`~ov^2?hJ* z*iYgcC+>*&GS$31P>iEQjI*OaBAaW*hOv)t=c)AKyZnv_jZ_*@3p=E z!Xfb(8vaf!K@gpZ1vZvGTuY8Z`BJ0GTT!DTwVxHkKd%irq? z`rl@kNHI+}l;+EQw}KtlZoXE@NP;7S()J3k^=K?R84-B}rJg(>8aQ%D<_|h;(K9r2 zev*??Ixc(syTXws>O`N));MAplFS}&X3^pP{XYC-I z@lnw(T}JVMD8M+~O-^SnenZws|68|tNSw169l5D$$Joj9%5Nf`{z;X%GJTjMX* z1wWfS`)cyWHii!J@dYJ|6|v0|P{QDF`Q}V%!DH688IehVhr-57m$cE?y1xX6a>>|J z@CQiY($4E;K4^YN&HwDPlVKF%*;K z@XXjlfYF~S`Id?*jS7E#>5kF~$S+wnDPzq3%rAinIp$SK<9bc@Q_Es7dOx$Po{zG$ ztDcB_Rr~csN%@8BgoZZk&^ZK+O0P+nnMs0Y*vFd#kW*HUB?fld@!FG6Len6o*G%}Pg1-9%20MY8&M=?kWe)w$3>$8 zg!2q;9x69L42EfGvQlU0AmFsYR*7U=)bp*m45Ziy*E7b$RKmImp4PI9A0)LBE+zI0 ziWR`imaR$Hlw_5sYbPRnMBK*uMYIyc!Os~m&0B@4_)!yUoMQT3_2J zbhfzMm4qDRu4v<7L5q0AiKmz6(?zus=G&LF5+iaIN&aI@aQBx+rpG$dG#p{#Iar-* zbHDjxTTbVHA`q2ZS2Nk|b0BrjGNTPmfRA`Dwvy92#MR(>&bizmCDqeUfFsfAw|XC`)r5@xyfLmT}}zPi(X1tCPp zNHA2O_8){k$(AW+m9>zY+-#Q3}yn|*Wkln`|^5&ELu#dpwqqwjN}m@2R~)C zFBO0P%ueAgax>VG$br-=LFPJ_RWhzAfcrDC8Bk@ECI;FbZxw2_oxNn+OfcanBHQB6 zz6yN>j{y$U3@klc{Im)L>2v?>3{&D`GI;+{Tk<720+~M;gG(u*!3aho5CM7*3zYxL zK^uy%eA!_Q#GD6x(8OoA{71ZdOZdKuXIP87GPr-1SYdcuYc}_ne*PXN$|1nDJ}P-Y zy&JjSn+B&F0K-l>GWR9`JhU)z-fCZv`tsw2+pK{c>09#DdSk>U!0GnNpE;Xt>;KYk zn9Ct^D%Eb_VI!bVo%rqL4j8B{t^m*WzoN0-fuvEP*N26`Nz}rm#uD&F%0a^#TJJj} zN2sz-X{3Wb24XV{-FYS_GChRsugTwc(m?b4Px$8kz%HNWTj+pOb}y96aDH4c`n7JnqUkmOvE09GJZ()lFsi63l{Fw}g)4 zapN-FuR?+ujiEXw5Kv11dR&rJm_;K76JN}^A1YP=tPsKJ1)ma>}cPA6#87vv@XQm z5P#OWR7hjPgfw12Iyu^<#WDurZAL1<->ZE@j$}`5ri{a|Vgtdz6$mJYcB<3_XhZXE zUqUAJGuZ0Shf5Ma?2GA8g`8!T8sW!~Z<0=5IHn(0C&2K5*Ut!RddIymxvU*{oBJf7 z+LxLWi5EK%)zM!}S2vhqzh0zNAmCQpmoO$;VDaJ?b#}BRJqqWf!=R%32xz7|28;4O z`yLJIj=KPZzNp5=F~0#!Un@1=b8A-Xf^OMzt?$1vF7JN+Wh8chWlldx_-KofOu_78 zbt1{ScWjDvxE|_2?2%zQeWxGXRhN&k0mzbn&L`z6@lh<60?ji2=~KS>;nxTw29+%# zjXPjq3=u5AWL$G)LyhL3R?6kVAbFrrVt@Do84m+AC|~N(z%9LLl+++T$EKJY3Z}p% z+VG=#f|0>DLX%au1bl88g&{75AO5-^2!W%&oGsN3VggDz=p6vB?h*p!HyR5xKQP^_ zzYO6E&|fC(O0AklGNfx$$XXI_%m5#JC%$}NT!DbkH=aB9pZ43ONxl80#`yQ)`}uE+ z4Ryk%^jr2Opd$zXI*dgVF2o?*OAeY+KxgBPU@nuNJDk&hpiap0|BO6=BfnYdPoR33 zMvt4kvmUOFg(JIl804W&+l3mhvP$Ix-z@YU9Y+2O*>h2oCM3EtLMTXBLYzkHru8w7 zxB$@kFe{waAHGZ6_rZA)29pCs;jfIhm3zfotv#A{Xo$u9{4^@kRTG>0-qX!LuM&^e zN262Ci#@k_E(6WyYBJ#6`OHCa(KSzjO*2;RQI7P*kF#jS6`wxyf3GDkIi3II<^uu& zcjaDT>%y)r5-$R7Y^Hd+uo1SP=V4*%laRF%z-&vhpfx|zkke?1%KQgQdKVtDJl!x2 zovc;IO`KbcB193KPy`hcBq1Vu_5~@%8w?P>Oe;X}Zka&f)HH4pF$coHKfes6r0v*B z>aTtuIy*_S3-Bw*5u_h7`JCBQ_U;QMo__$K*H2Jux2+JxH2pq&doutk19D_y5HXyB zyiXhgDtxhwcfgcU@QJ-}PHQ*G79jvfb`Xw7v+_WT>ce%8;?P~PbHCzArVZr}oJQV6pi-*a3*DNb3#G3eSI zUShaO&0HWp>N^nI<)?Y%omTm`;f%7Oc|VLSB0r_72ifDv2)rc^j`ho$&^d+zw5P1+L}U>)2;WDx2868NO~ zBl41NFqak66u9+}7@M@U*&%=lH~s1*q-v}DQ=|VS3`qkNaRRH`z|Fm6Rq11ZJGU{|oQMl5fa{wA{1coX{q3s+>|h8}@`8-vw;RROw?Z9*Pp|$qNlp zl^^?H7?GwS@{5JUNM*cM2`5^yK{{u^50l!Ip0|Rk_l$k`GQ7$ch99T+ZqCx zaVk+{mrIe-5kUC;42I=)@u89gM;d5cvX`801wRY&(L~DZDtWyje)e9xU)vi$zgMVM=rw0xbC+4yeP=~VmVi1{ia-X}f$OY*YjH;~RlZyd zB5<1%m0Lvam2)iv{=%pb{RMEnO@>|jewTb1%u@o>dVsoA(WB)Zt2ATpn!lfXYG641 z4M}>tlIzjyPgBZN=&{`DRI3B+tiO3L_-OaPO{csWgBm46pF2DQOg80U8x=8J?n^*b zjE5r9>~;0s3mg2W*{C=H2cSJpqx6-X<5ehg3q&!a9>!<@}eIt31HO{O_4q6>2f&gfG(z8Dum1^o?q`vJp7~mpqs(0~`6>`6$JR zxu|__$$O?wrE}LwXyu${Z-cMHjQ#uATtnzqo=sJt9+kQrQs@B*a<}^K7 zx>Ga3?DPZ}6Y)L(0>-njjpmp=a3SM*4kM`qCdEJbj!cAI`jzugb3_8X<{_?{vdV6k z6a6>ePk|DDbqVNV4%}AD%VhSTRm@cKJi0-}fNReC6iQoohA{x68RkQcrEgWvIMC?P z!kP*sKX=-`bq;uV)G8@kQgkBE#_43^aG6auEhbc^@vOqTAYpizYz$%<6k>`tUNwo1 zf z`ZfVWY+a0A*IAbaS2>XH5;k?1m7@OD$3d$>Xu_u=md$rcXWt zBtPb(kMeRo&INL-S3Tt1Dh{AdeN!+)PK=hVb#UbKuv}UGreJbj<*G_joaXh9O*YaO zAFEi3=F4GB-pr1BHK>1ZzEeU4CQ9h&zVXBEpA}PUslT9>V>kRQfT^n2L+V+4L81x_ zV{y2O`xF5(u-b+Qp~Fif^-(ReAGmZ78TVGGP}~o~!_@fPzeHP^5&A)#5c3@02vMvN z{?z=58`CYx{hx}jP{Af-=1#I_*Oau+K6zY-4+iA*E&6ffV5*%{{9SDZB870mV!-J@ zszd5zI4V?En0&&G@^9unrHi203UE+#Qu_7GovQWqTn4SBC1}j2SD^O>9VBU|h}3;O z2TW{5a|N^mla#1p_%NNWoQRgxh|k?ea`%ag@gVw#|3sn%M-NRL4D0aN3s&(!E5RQW z4}2Q4Y1P1wkpV#~BQeozIObteGDRJ~*89&KA(s=vEbKus>=iR>Qz0?(T$DIMF-o9_ znkX&O6n=i6GgFubPa69D9vjbDlHOYf5t-uQW4 zjEe!haCss6g{<-n39KG2dY~L7JjQB71%e5cYG0Lc=cmltnq?$dsB&hOob<}YfGsN< z5nMOiN%T}51rY||oj^ZIQ7&>en7PP@?a5=ndom>&4$9J_L`&s&Sw-aN@e7mj^%p3c zKlnWTQGd}=f);qi=1+~@xf*1fslqbU1Vgtf1G+690scKv3rqYjHD_{~6rMcBKY=;s zJ^BMoxl{h78CPS>Q>F53ENv2(UwwKKF-7^(TYKsyaEgb+j-RLXW zmfJ|72Gm+oc6^0CB{QrP$=)<3B7Uo6Y%a>HvmZOUVtp>ijJ}8*qk1FA!u3XPNZF5I z8zNq#AH}4xjB- zPq`Qy1?DqrfvUyuOZa4ZenvL9?eepe3pI1wHmFrF(H0tfnwW!t7Kon<#Dw-@-{Uw! zRK~l)D8RkWA_qzJNgjbS1A7~bmCcpRWOpORCx_<4RIy&<-1H}!^=-+gKIm_zK)7~ z>T6{N)M>Z%A%ujr$^^eEpGfvTtfU8+e&$T+6lRvOz4Uousw^%F+$taY3R@H*2y4!J z(W^_fD&yWX4J|B9o>tk@lx1gd@2y&0oGvLm z<3a0umixuHJ-5I6mrQ#yoL>HIB>$Ub;xN*LRjKUWo2XC+NxE9LtFcR0Jw9{$v{(0Q zD??fupw@KxG1L05br~GqcNdx zbTEfEr}}>40Sst-HOa%z4{9sGgon20c=4rDyLjGKS7if-j*C~L4lKd(xCY9d1Mpps zIkysNfNe0ZEk9YxT)EKTD5ke;(_U%{m!H3lts7m%_N+d8tNlt*?7+#s-Qy-BR9v-c| zh`}I9j>Kr`7>&EsFrY^o1Dy}?Lok{KgF(O|rnU=eCDuuQU>FTvClx{wG)_7szj9+n zGd_ix{b7Y%8~}>x8lFln9)bBQsj#sR>BeXgEk1KnG6;CP*}!F*2AC9vh0j-%{TLaW ztCZoi;NZu;L%r}939_KwoBi zUiX34?%6<~ij?t#dmYvheqxinDvq(f?FuEyHloBXrnO7W4LshYgiJQTt2`|i18Uf< z%k)UqQQ4^};?V?{(S8YU{u6WSIGY1N*asiaADmfhi-a7m3vYZ)!OL z6_W{odreO=t9e_u!zXoa1AM+qsHrXJG>1JaN9bZQ16&hSk^{G)W_6;T(NnVn@0gH5 zy&Niaolv2xj2r>H^rvYO;scbQ4@gM@(20M2y1s!_;R#-jpp6Eq_@KGL$+pZzs6C?i ziIG8bbR3hyT+bY@zDkMt+Vlwm0~GgS6ZjhdUg`KWbwc>mM`)O?DR7#QEQ2W!*s4Z_ zFa%vGhjR-Bl35*OKB(Yi_dP5(k{mO8JTzRKyd0rr0RaS%j+%Krwi9h9t^4Mg?b zedOjrDhUqjP?xu)@;;xKroJG4%xtS!vRZex?HoadtblUm06W1I`i6w>D34Bj@crG_ zBr?&t_?V+sVVH1t!HqEp+|RUjnua^|Ce_Or!*< z6)^VMc4CO-F*#o+UWT-+0YMuRe5i&g2wq;4WS_$b(Dq?NOA%Y{^v!2CETN`2v6eaK z*gg0j)8mzYw}Tv@b%QawAwrx#OrOjBtn67)-85O>TWDE6do-D5(cO45!kdpOH{5d!aLx`9XBZiJ+R>ODtJ2%>j(iyVO$ z56%es8dNajxKde1H=w70PnJQee;ol$BH)w0kK9^^pTj3JIVt`Zi{^P4u?eR4FEW1fmx6`f6V_KbZIWA0M)9mVqBM?)ejoh z4$RehH1DmWfq5kQ1k}uE;`!ns5f z%=qORy_1xaImrr&vSZ#FSDVlj-HZAbOK5n8JP85SFe0j^{|fi0Q2%O3*+~`;;eSss z9`x^1xQO*~95nSU^N(GCMq;QNeH7dEm%UWWV)zSFvxj!&WoTKVRG7DxVhQZ-+JO0C z>BZ}Eq+x(pNQ4^3V}+)DM+HPrkgWU}#8lq&qspX2tPn^uPe!OJR*vT2A{pkUhBdwS z02>nCC<-B0ZiIK?r>rx&0`K6^nI5H4&^Z)=K2R9qT?FatjJ)6-)C1cnRZ^)sSY3p< z&Im&+_16p)hUzjH;dhznC*}n^QEe?t{7@O_aNH^aqj$Truy-xp2*O=oo8{b7ptvfm z5Y0gZb988_u|@oy`W4@E22cxo@am1YWm7So#E8jhp4iZ1+pRm89h~xPMn;*%;$_+O zn>)Ht&N%{M+ z!diT$g;jBmw7-7*JR7Lq6G5u#0A3pqOY4xg5!-Ylfnc9iM3O0eLImr?ljkyRw5+&w zwj3`tDu%9t##r#-*DBV-Ro&~R&6GHoRB__#Bvd*BUgK~-@3QJwHg_9A-Cf@FaMBVt zi`d`%o=_rv-*r)VjfCDwnoqk&-+KNfEycbETE%AbKbfzebkFwTm?YF62Z({E zE*D+1-xAjuu%b7+p-!suIJflL87njIz_LP8cCP$8-gbJiQo`@PY6X#lE>vl#=F7{J z;o_F<2yH2p=xfr}gX6k}XXNkxYLG+jS#M8TFs4^2{{mN%!vBQGRF&LOqCSpA8#9ZJ zpr38``X%k^R*9Efh5S3fPYD+v%}n$XQkEBWbJ(6Fan8sQ447@2+A!kY)pAPI0VIwZ zJ0Be(?bA_EdKFjB?Mb~O2q6`eRauw7za3n>N>yV~LjoF<1y`q~!82*|% zeA2ZsGO_(iIxn`@`NzVc)~;Yzv)!@!C+MOyk~ARuIv^zjW^Agtv2t=}JC5eOTcd<( zE`p`miJtu8CkV-&ccG%HIJml`&w$z|@fxql6k2Ec+5eu(A#E1`Tc2IF)R7km&RuysEh zVX=;CDJ5Q}PYl>#-Z~X~A%W>q6!_ouq#|%xtH5my?m0!BETte7F)(l4h_$22bbGXf zT_d&wP&b&jqT%)lS=S#8WBW-(`pjGTLJlXoYw^x_C@Kr!XQv6d8ePHf?nDsv6o+bM zM8lhv9@&cdO4Xd$A}R2RrqRyDTc^1=Iqa$Ip(O{j3u$d=bDYdjqi-f#gODc%>?xk& zpffoae}p-LKmjKV@u4R&DMTf7%u(i05r*6dubTPb3BR%q3m$%aiHn_S^i=krGbhBk zE;e6)^nc)`fYyddVNRL_!|6#VY6bwFW?}7k zhnEcONRkoUTZ+!lM>?`l*`KjH12wd`3om*#AAM_7K&s|c6-i0O^3teO-sAe!!W#A1 zs?4aIG^QmXLX+v6Zp)p8dlEUi3y@PD;4z8rGqWqTlmt|S zmc&4%K(G-$IOQev%ooPDBuu*3Q*>|z8Z3f*{#5z3T2L)4AV;_>fFeVaJV*Shas+xe z4y5PU7W5foEJUCeF`&wqCmmq0ye>W-$^VXyG-+5Y-o96cT;G7jeRxq4crC^2hfiOT zSnzhsT%V)H4@CC$s}LMi@HPCU))|qEhM40v;2u!qUuuDBsCeQ-YI7QFV+FPmx^f0&8QY7+-oo{*~^Ge7Pm7z!$riMX{v(!&8M@V=}}9%Rr2AE`+|1~w~? z2U)jH5^+Eycv%)0ubq!Mo+o+%tukt5l^Ul#QvDJ`ytrN(;?+r#0*kX_M$@Y3-F%D| zYr;X40^+l<)(`HX#oiT?-oeFSUCe`|J#!g?fT0i~pl65HGXlSo79+TR%8-J~8CUKd zzl(xbR0%FK1(S3cfJZypEKq+?pj#Hw2LPo)@cJ=#A!M3U2ni){>CTGk4_^MNO(I+( zXqi^zFiI#tO%iCt&@Q!8#tBg?B!=KuqEWd8z6YKp5gtX$j1Ec_L%x$DorW-u;KgY} z9{ONJPl_IC3>je9;FK>fr}5Bh5|;y3pchP9{!^ugSV`4#4NYJBuypeoe+U3x)qIh zNn&jP)C&bp#w?#XP1k zNj zA8_Uo57R2GS4xNu&w;D*EByLDKJR>Z1GUg|i3jaTUA$d!avb-vkLonax!PIs#~xAhWQ)XiUa>g!ve?DT z-#|cxwNT9dtWwA&2dy-Q;pX&_CDqi+W*0MMN?BSjWyqy>PB z(nW(KbvCL--N9^4QZxdQ?EG+T`aY^ zTU0&I{-!jKZHfH3tahjq`j_+FYtcW1_4_+p;)NPrFc=-E(OtsTG!0>C%CBgVGmhj z`WVzjL$0Kik6M|0ydJx@x=Ze}d-SJD#mwhlvrez)z~6#SBLVvN@BJN(h2-hp|67mP zXsO7JPqgUx_dfiR(!Tjj3_4bzqo!vc(}n8v{Fle!cXyfQ969$^PP`v$|NGZ})u%#x z?6~y{$yP!ja0SJ*J!0*-ukn_W*_{1X@53a5SynA zM0h!i-ltBJ7rtr|c#$u(rs&z@_uPr6>`t{ko*}a;e3PF&+HYx;COZ@!qJNrNGBU#6 z@^J<5ovyu_;dLKVoXE%Lw~H}_w&j7UmpeRbm?#6tV1n|e7GFu<>80SO4D6%L5lhV0 zD@zx%ANpKyXXT4$6}r6q`FMHoWC%AwBK{SH)HPh;(8n!f$_VMPn4e^S70%lpFwws) z#JN`r7fihv@VC@s&2;t4eYIzEu>Q*A)fHFDmZH-F8Dw38WA?e8E^*Djv~RR_e(Sc8 zuNkyN`&F7s${oHKv}{T%xiW*iczc>N?AqhxzGjgdF;XV-diF_#UgM2kgy@*5uQMY+ zq3O0UkLYXl-(;$*XnlS5IrHk^>Q`nrrpszAR64XPy`8SK(WQZx?^}50M2%!WS&xm# zP%Pp2LV3w#Ek!0&pjVlNNA$O}FB^Iv{i#x&>MGxdq&{@v#Z#Gm)_rbi?)*CsZo96x zWS_NfuHI@obH7M6aqWyubSbvJ=}o~8PG!mpySpDg+s$ja;b%_uoLdTaBnwrX&lfJP zdcISXRJ-Pv9pnFbjPkr$9A&MX#IFJU$4;x<+3y&h<1Q2g`ab)Kfi$4uy+9zhW*?I-UE+O&%g&pa1z|*o&9epYL@x zg{-HaG%)dGWn9K{D0U6zjTjbWj|8k=P@mAk%`bb&-;!Z={m?WF=HjV~sNg7=O)q{P zf6{59Pu5crXm@^G7|}&`0{p+4!>~c{zLJ36--Crr63 z{oF?DZA7^QCH}G=R~0io=kxKZ{By2gvD-G{wFG4q=jpf;0}|%xKc}-WPjszwN_zf2 zxtStfUDwL@~s~TGQtfT`k{+EiFZ6S?Vd)_J~D^TLp=) zI+gZ5HAfx9d~DAS+~#GYPvjiaBj2H4t<93RK$yze>Iw?(pR#>$hUV#g^N*4(LOwJx zX7A#p3O*noTNT#|oybb0wO6?I@A=yOAPLIWOhi+eNe@mMiCnb;AYyyqwP%;BOgL8gD)N}cg-{yl+R&~luS-%LGO}@`? z#lJ5xW?uhrsdLitV1~xfQt9M5#y3GZ{i!zO8hT~QVRqyiRssqJ3g(xC65LPyUimt1 z_)$A-9BIBC`;CX^4!dH0d{-}bLrQ_i2{pZ3FJaL-AMM{f`C;FLe!qAgXXCZ+|38$y z1B@_1v@STdZQHhO+qUib$F^Gw`hDW!v%C-kv1dv=KNAJ2%9+LbyvjdreM#CGTWJIGgcrb6`oJ5JXKDVvM~4ejjB%~ zT3K80`)z_G9ksn7*L!4u;ya?kTa>}D6!q$ss2xaszReCw9ADR<6AZp=1y&e;GBNs& z;try&8S#Acj!S9V=i*|HAVv=ajLC$KCNd+sUF_v_lwm8`lCVQG@`8O}*_+KjP1~1( z(65ARFL0H-aki&z&ax9yQ8G$w%z8$iyhf{;0yBuJa~g;MGh`AFzREs*S5tWywhx1p%mAsue`_;bU+!Vb^hzC zIp=xB_1DMsxMx{ZuTH^J0fkuRUX*IFg8M=x^lJtG8(3Qw(c!;C9!|FZEy%;l$o!wt z=ar6hTy+QH_KEr}_=w}1t>qAr5)x%+)fC-CVOFS(6S{j!Z{B?p)7+NBbvCo}Nj_qr z+28sqzLgD^Ue`It&!Cye8LZjtn^66`k)6BO+4Ik|*6UgSMO=sD_ONT)b3Fm(aa-`f z0K~10EB)W%9(3J6Jo2HFicefRLhv}VMNzFHZMiBQ#r}v&!9T%azBdp2BZRu4C*V9I zc>kQPl##~GNs-u<T1vKTN?}0~~F+agZLiQwTft?xg^E9%Mk} z+w{!!{7yU_={UfLfaNlSVqBnlp&bbmi5|iexfac*lG#v6GZsRGu$})RMJ&hx*(v`N zvVP7{--&zQ0J&H%P}OAATM2GV!V*^92(mo`6`+?WfFUN_7Xq3_N_JCJwPV%l=+b+j zdB{b{7|zn~`nEwug@kzrorU;L&z|e0JIscX-(D_y+U0!=d$Tulj+(g`#!4i(xoBbW zjD$IFYDtVRkv?|CCu*Qb!VC{5AL0=8&|vI(*04XeGyNhp)ZXD&8TYEW(CD6#cDZXKUdW^Z`y4WlM}4Y*r&O385(imW|p}$yOc__b?eMR?Fzj+?1|-t3c?b z56qDe$w%fiz4h*^EU;k0%56mp4G_}tob5^kRcCYl&TN;BVP&yhmhuF){9s|~*~uFI zkmvAe3btx9Wh#$8)~pSlxKV!NS7SPSz88v(3a>+v3=2 z4x}eCo&)-9OHCn$1Ka9wm#DFW+TTfEPiloji)PH}`UO6I9SZ3^ukzTt8%t>im0h~; z9=Xg$gJBs@@|>P6`}nMRc^^@tkiBj;SLWiC=3ykfFi3$EiK#qb!`EjzRlv$WIy{w= z|3J#wg!xNtcb!yCINH_x!LD@zoEk3qSaYm$c(`I5xn74f)!doOdQ)Jy_nequqp_(d`^kH7U z9u(ks3~Se#`j|8$&Xl|k5gT{4oa`HqnK~|Jx}cR6d7|griHeu_v`2sGGJyPGPno7l zmwUyDZwXztP-dg6=t4o2gWm=R*0bJ2Q~qj4T>*4p72$@Wqn_WZQfwfQJ|^+B-m@u{ zkN8SNL58m`g|hOO={3nBo^qMqZuSL7n7`yN`T;9;ZIfJfF`l;yDsJWOhOX zyjF4Z6qqlQmhvWMx~n^^Z4S-T0~{2#fGT`JV=}f z_;!c=qUI8!6)&x}&Y==7hbeo`afnzmG4*Qnbu@~fKkYKoCqsI?z1lJXvxukS0kiYd zzfk6{Vmz|IczU2Ec^^xLNWhgS!yL!no6wxlsjzzEyKNhw3?iRQkYIv6J~`=SEL1l_ zA?O;oH>o2;TEpe4%2r&1!ULZE$F079@tlE@KEhU-UZe4@71(fu;?`17tA*s%!c-bg zuG7P1K{LHqNkYrn8a=V~ZMJu_=(Rb@bj*AawC$)D_}D7&Rnc;fl2{&PW7{}jbbEh2r6+yS z#Wc;LH4*l$g>C?fv5as+l9{HcR|8dQO5yx&Q#+-CDoxZUT)YowhUP5c4&p##gTGo& zwAC{i^MG!0=KmqE7fN1>CneY@^DNyDtsU}EVdAOd14x09XCZ#74zj(}b1nn=W@v^afxGr;5mlf=BB5{sMl#Je-;yaTgU1vA$u~-Tfl!U_nHq&MdBAh1q)+#IZP2Dj|K!EM~pwba9(-HQ;iq z)!~2>+hB1COL`q9qM7NQxA5XDuBm0FTPmz7xemlErZi}vBdQ6PEK#e%`?W9L44qhW z*0N7{!F!acGC!SwroxY~Bk_!tY*k`jDPiIAu`g88_#@SE3gCr>gd-Z)I0aoFl8dDf zfgPXg=of*Kncc*Dn$DUF{DZ)^>L065g9ByxHK6ZOV;f)HI*YoXRy+%QZxo1_v|l z3ER0^#B7sTgng5-eNq{S{qGz&%L>-W7`ba#rx5|GK%B>4gW6w)dYOD^Cf0j+8YWSl z2j?d;^#CUL4WX{h^M$g4zg2yciJFeP{Y5zvdkd>?Tj#}yltG*+bdqjG-_WPN+>~Pu zo^e@wW5-A**Z*zt2hf*y(c-_uLPlox|1Dg|%*6IzaAEdjY&8dxz{>;br-0|Dp9Coy zt!pbwXH~_P1)6}6eFwVxQt!?l_=sR;SNv0LloUkbfPpy9K&(UhvG*Vrlz%m27vnnO zMdlto#~rtgzs{Avr`7jYmK6qREY~uR>@={lh{7U+T>A0!;*o!xii<8a<|Vo8FopIJ zyyhgur8u^nqd$+NzvM?B=*!O?dgpS9f3z^q;|l!W7}}(`g6ik8P8YBAs1NM=_Ua(n zen$D$lo}XUi4eNCj3R!dxVw9W>bPODy{LY@kdCm*+ehW1lgNgN`WWR+d7c*M%Z2R% zuFsz{{umSjK4O73NvBHFYes3>m1I|98{y3tn&hu1OJ(_oZ*Sq?#>zMDi*W>~-XE*t zWf9E;zn`_w*0&bnjc5f^ta2pBnGq^wv)|ZIQ}opi8cp|cCT#Il>{Sb-IBf?C$OtM> z&RWsQ#*S-MB@^n+Kf^yXphRvoz?O?8X)bahSY!eEQNh}hG$|Ss1kulel+UH&pW6-8 z>9rdaDMahl8>cDTQTS`;yNo-uSH)Ny-$_H3~KG*#=POiD6J7&aq*$rL8F+#jC=6(C5z{=lJjZd-`8C04ru5DIHDEM+*P*gQDzgG-NJgX^uB0?a_edt9>G?C? zgikyJ@vkT}L8H^QM3;%xn#r2iLJ!rgf;#l}5|y{Z{Mk_q5dk!Hd<7qC?-=h$9OLgh z&8SDB)^V))gmJEH1+^Rt&K~zy^w$V_8BE2B^73L$xM~~hLu50N7lLfYU<1*jWNuXyIQhYL( zM{Oiezu?~w3D{oK6LAHg^U6EsFiXnjxr9** zYE$9US&EwjdkT5XN5=(yci{*$n&9NBlbo*&anJRH_7bIlfR-<3ARViLnCiJy;MU}| zWsn97B0Dnqk#Ig>sWwYbUWA8zFidb4k7TZ!N|K?tHb3>A@ z2_<~(u$&l8LdJ8xFih_$vSfATRPAFpPSjv|XpNX_(2|V(S^IVYDj;DT_{X4~m@|@! z4hc%J;l_-;J6di_Jiwa1=XxY3vdyg%w6w>07W$Qs$#LWY+C=nF5hW(gQ!8%9IqfxW z;U&2X;$h|2f~I=^n6eGYTpV1Kt_fVJLchyi#GOOq!`h2k#jfDiK4_mRgETIB#{SaC zUM)MB{1Re&o05@p65jrka~!U_`LeiA5AVz4o&f%7qJrqKZMYcrWkN|YpV}K$6rJnq z_Kd%wJTg()%e#>*iLoQ81_%1OL35*73R(qCbsTYUL23v^5BX7_6}|4!G0v_jR0u^A z^P#yAc#9=DiR0vM-Xqw>fXU&R6P}0WXd6dGnr>F0h%4XuTpINUsvrMof`cffDuGqi zStpc}mx~^Kt5F4o{=@59X?~^EUICdX&_epnN9V)s59&Vx`AJu~JvLf7#6g>o)Zunl z<$AcXu^@SC$g&C@_H0*1Fz;W6pvZ|Z!_Q3M$WMW_MAs5AX2vgZOq`SrRPVsvnaOlVs6TlVvPh#aHc3_{NmY*Rw z(#9wQ2e=wc;RLwBGdUNf9VB`O7z{n~kyH_p8a{+Z-Lj#m%n+`=Fo&!?N3j|M&m$gP z;-ET~68V(@zy5Q(lvG|L{xh0A#qoY)b-#>t;a$y4)9 zDULkA3gEf?Qc#P-facp|3{va4Lru{Wtv4Uu0+wx~p`?{$y)~AbYTBa1X~@97?Wa){ zHPid-fNrhBkd@ZhXFsHe6}3`E8rr)a($8DU(LFGmjs!T0Y`Dd74f49))ove+eDj~n zLZ(oKXCzIVQ#o^%?@3=Jz>1Zu^b5{B+<6aKQbRP;dRWe=8fe`toMQbFR3=Abw@k@3 zOG+mE!aLoB`IhRdKx6Eg>AN@X`!xmBl+&BYMeFOEPddZ*`+0Mg3*%9i_}T&KW`2pf z5U|N8AcK9|`!$&FW6ks2ssxxeMEaHQLwWG>H%4xzjbcKr3)Lw9=Mqj04Dq!9y$woj zWALz}Bd^zIB4|)*l1;dO+PPS|%O5Ou^aF@Umb(`I2zu7w#CpmH7LWrkHN{8Zu!GpM ziPPh6@dce(c1TQ@V-muwT#%mb)FJ;A%dCIO#7fM9--i3d7>pjG51-I!YJ0uj3_Nsn zT6|ua@+$p5oVtIW>-+&c{29mp7vPHhKZ@f0e=@$mG~<8e8Fj{E57-d8PpBV(rycYG z2Eza(|7?PtX~zedXttZcIZxb_NhF|1M`fKmmg2^l5h&0~tJI&@v!N~dSZWCG@ms^# zN4pJm9N%NoeL{`uM?IIV9FOX&3{p7$t3P(N&`T!@%nWrLV6oTx;FnWry3%B_0GAzB z%}wDqH5V)BUU!K2co2Noo}t%q_=)OW%hCPZ^TL$>`atdGbZg_V*3`;v{p?OP$7oHKhKosi7za*KC&lFmbCTvLu(m9eB^gU~|Y?D-Rz zry69p3ccdx%fL{M6TnbSGPL<97M!Ik0K?4r?~1(bCOJ^5DYPlE`zwf0i34@c$OtvE zeMt0=Tl;{g%cKbBAb){IAs3}L%E&fOJ~l!zVKym4F>hrUs>0y+`{Z6R3036S}!G3XvTBQ7{4fdC7kI z=5icW@7ekyR|ch|_oKB3ml*b-`un#;ge&qjBC3L$aQ^(oh%9u_D2_693F>oWwkZ*D zYD89UU((^QN- zR#10WR0=Qgo_6@XkF@NcB+R$|v+>uY|9 zE=e!|gDO131w{TioFCcwS>Hh8TZTrLUwcb;*WfIQ404t3nYk5*$|DwK5#M)7a!}ZD z79d=L&cqD1qST=6Z5?ciXfhSYGfg!CR&rbL%Z)2V2tu&q2O%7(*UO#)UyE==NHd>f ziy|2=VoPCCJiqudVji*jT30JHtl&ZMuj zHh+k)T~GQ5bx&E!kP_#?c%xa{9RaXa?Nj;uT+~19@(dnvMA=UjV%CaMs0=&q@PF?> zqnM;&rCvj?AW;+qH9ZUp8enPv&=x|O#3-Y}70)b}l^ZCwq^-#{^-;Zy`SDOs;bzPp z@#N0g=ZwSm@N~H+x&%THN{_%gB281VT)M6I4y|1bbil=eI8=6X_CnIJcUAQb2r@_# zqi8+qyUm=^xRYc_3ita)h1Ix-5kZre>JB9ZBU*f*O?`feUGG!J&haKm^WTDBG*g`j zOv=|xKsz(rgcESauZ&>qL~=)R!^@Es6C`~$%#JC)ck%9Z+ zAa10=NN1xfqTv<#D%e8FyywRDimBYi^@-)ei9Wi@*R8V=v-T41&TFGXPlWOD9x1K- z8P|rS+ty({cTVTgGa08z4 z^x6-z9)*9s2&sKL4sfc`z0o+Qh^BgJ5-h`h3Z#1^H83~B7onUvt`kXThCh0*QKU@r zccrw%DkqV7wgW0+1S4L#7grTpw#nID;%{MYEXqYA=e9=I1x1xaLm;wPHQNJ8)p%C- zWt;4ze+P-pbs}RyQkfBUI=@X0E(k&{wOBu?vC?J%o`)GF<(W4L*Z{3ElA^gi2+Zb2juChPa zo3G$FKe{VEuW9lB@J-DXD5#u zwKnEE0yJ#<^t^t=%G;enbyk$@0D4d(lrOyQ-d&m4RbjSO$qO?;(K1+!f+&)HVEJ8sxpM1$7e4d}!66v9Yl$p`?XwX&~0WUZV<|yQVMjVWyC*UNL50cd^>~XJW6+sJwsa58MMcyRIe#W)D<7I`` zVG)$QXH?5W-n5EA?Ax9E^s|ZOB8_sA=NvRNnsHX)Ec@{K8VI}r!NUd>*I*r10mRp| zIr<)gwkPHKUD<#9S3|kagYY4vv0nru5Mw`x*D_h61KfohvE|K?F?AUbs}3` z#N@?i`PLfGdZq*Yn90y=e?S&5Aj_WaEQ3-&(?Ok_R)75uBL3O5r^`!!?}m2KcpKyD zbi#%zG)|>NwMNVhQObVoC(cqp%hIqIqc=@4?k8(U9|>K#6F@=U(-anyhTZ^LO>Gxg zynXa35JSPRn1X7iS1^R{mrh$;H0F5-y6Iu1=lF$rl9!3M|0#e~>FBd-(KbR|@bcp7*l=*_KM3b|3p%`0- zQ>SUbtSa4hUurVgc`bUdA67swATbFHK(R$f3{K%x8 z$@XB%>QtN+(%7oeG2PLO&S$c8`nI%O2zTNSSQ(9w@R&86#O(r%pr zS~`3oZ^aGt01vzMsFY^jv}eUq7(+E0wC`9yuq$2gk%>}gn9&reO>&yo0VKmWqd9$F zM@~Qzl2iZ^x8K@we+Un~1twfpwh9R^q$qH3f<cdq6dpmaD6Lu6_Af8m>_zC6u;e+&nQ50bN7^ZBR;|O zG$Z8oqJM)Ji^#z$cId6MK;&y94S{y$n-jRV?6G&iMv1oobm<=9suPvWMBmuHR0%%z zJ!hB4;*|LWQ_dNW5SOOrm@pf>+1D}m#Y|RsIsfpREuEZL1^i+vrY;beae?MyzUS#2LK645Fn8Y zj>H^t(FtAxxo{GEDr7_AYbL`FDdffoqHb;{F}_w$y`bNhLg6o<5>2QRZFZQU2xNSJ z$*a(64S$OH|B142DNq0Rd>-YfF-9tJ0~Qh!;?%wxUk5uRa{)_j93O6sq%P@KaIC4V<)`Q4J8S|iZ2L>G3z}(At%o=e;e)( z`E%ija7l&e8zZ^Cjl)~?NVrlD#Uv+{l`Ypv^k281c}XKThUfh32=V|>kk+{YO3KMH zvv>t!vg~!*MdE<)dr%8;bGEsXA8>ufPIegcgW8hPVm@eAK%(Aw4feA&s$Tk3gkmUN zJg5=*J6mK(1$_NB%fKCAbnqia^@fm97XXCUSXEnzox1Oj9}< zxfp9B7AN6!9XvI}M1U}q#KBhYsv$~H0CO9_8CtYn-1b3$N|eHW9*4_IT7^frA&@g2 zeiAv(=Z8P=gQ<&yqpAIH)I$+#hQTj^3o_|=d^pXaE7*yzcsY?KG>t&D?LeL!^MaYA zDa-iwpyB43kb7F^oqiBesN^rx@x6&7 zL5G55IJ)vw0qTGlHLne-t|>`cKAW{ehc&+0?|gSC)N8wLphM*@*b$h0*Jy;F87_R3|NL-t+_4WF7Rd*W&~$K||MA4VJs$f{n440~Ju zLnqJgCwhMX1ZY;c|BjRxng54LNX65^lwRJ*O4-GhUXFl?f#EkSz{%N#fRTfl?f)f0 zfQ5sy%9n6Q!wVaY9HsjUmGYb{J{id`95T0126w5_reW~%H7HSql} z8$;wut%hHt`6n<95ts6 z<0EwI)opwo1NflP0pBk9QGpMRQkK3|n7UK#s=1N;DP?e504m)1YA%d0H`s8)vMPfG zef|DSBWibbKq{i>upC&KxEuflv8CF=X~-|lnQb0buayTJJ}QiSG5E4;So{OBh7?+( z>6jhqZMl$qKoA0dnP7;+$-sthRav|CiE;kkCBw~qS{Qf$mYBoX&1%zgw58Qp<7tnc zs{a{Lcm(^z4cmq8>Q~+iYl+dhU2jzcXo$0Q@B#2tfteZGu=xCIQ-to9@2LQUbC<&q%KeT>xWsb~d z4=eH{{NYyL)4GjI3)v~EN*JB#21!b}vYL7iOEn@xy&9z;qy_8dzLGbG!ZC&mT~7zt zYD{n5n>tB-ptICxwh;>yYITk&7S07ySaof{UqYHx>XaBXY5->XQ1`x8<`otNBG08| zE{}DaHMk+2wZ$RTl@I>eGHK-q<9Txp=$H=2Hr)J7YfVdwAI+)BW(&A>zJe&keTO`c zBJVjra~E%pN@U$4RAqT9UzM{%!Gp&l5?-W5z+pABi6Z`GfY|K#As{-XeJ1ETB_gc7 zhC9b~i{C3R#vO8)Dqe3Jc3YOphp>T@vjanR+`6eCrb(^qH$9DxXIc(gbq)7#_31gS zZC0(ISs1T~dISBORA))DT8Mc9DHlP9$@c$yoUamR;D<9RN%>sOhE-E(Ik-Nk!b2{b?q0T6%jFLW-g(T#&M; zwi9Tz0i1tmb%5i+MJ+JN8}6|f5Bxp~ylo`u0mQp+b&RPQ=nJ(ohFojHveLn- zas+KAtg<1*y6@CUX09=2re4^e4Vz!spSSK##6Mk{RUe#rLVROkF;W-tP;4_wDX%+CJ$UY}7Z%eTPkY&Txu> zm=adfa-6}SZ4tzg8**fJ2VY`6pxAms!FGz;Qem&Tq&{Br{J@7`3-FAVwP*w~6pZ*S zuCHnRepbA&H&B49dCh1}C9Kp4tr*+_BWa4G-B~SK&=?NZhCisqN|Gz+CDG}I(I6B! ziID_`?Y0jEP#QH{5tGoO64^*3D;+pkMB*HRjGCu&8E8t^HB_D3B-lieGQu%JZcJh7 zFUOl|`sUPY#nKQ2#2xK%2~yC=I6eN15hj&OHZdr89ejk~0f+`D(SU`cI52sgTt1*x_vq7XoqG{+t4XOJfar!ZkZR7$)35lbU`VbOWD`{o37%jR$ z(8DE(kNlw=tGs8hlC=|e+QPJ`M;W2YSsd`v$!BG9B@8V5~F zItZ#TF%m#|H?Ge0BhZb2xs&&oD2eT^6BuaPaPt^lFtWAnkfsApc&UWMg+5Y~Q4J^? z{zHH@$Hxhkm3bpLzj4bMvW{?^>Rc&@5eyI#)C>0UCA38|4(rT90UI(&MqLv0XywH0 z-~4;2LfMF*Ui&DP>1UzzxW(-RXjRvQ)N}?#j(>wKswf}3Chi78n_HEdqD%17>Z)jyh80_8%K#~g-3~66{#`(ou2Zg-t6nzU%{%IC2mN9^xZh_s{ z21>~RU4Gv4@6N^D^(g8V~&(~eo1S2#sZNT)gCdG1;CS|gAYqFjx zPKCpatZ|DYASEXcI+LBgw*IC#Id=m=HpRhur2n+=6g43ARF+J|W*0u6M)6GxT}GSPq46e+pmB_cHe?GT#GkP+1v zS8+!cUkIT~wZ;<#gBjpQ9ii=kPSWO`BN#W19Ehs~L=FBm0%JLe8!4pBQ)P>QG~~N} z;*@J`e``T>pU&s2LD-g|`8tdhJ?uD3Cn$U%X&aCouPF#I#)O}^$xHF25NX~#p43na z^p{L;+-W8MQ56dv5L$%E?D%%n*{Gm8)1dOkLe$cy{9~DV14C z{}gbFlwri)gKN}ZFTSku_1!NjX@aD9y|7X6Dx82}O#@nm)8UJ;37bl_E-?W|MC>jK zj-Ki|p>!evG1Eu}_w&TvaLL`Lfz9cZ4&!;M&F%03SkzfOb23lO)R1xzEnclkLapN5 zal7Q${((u62DAp{8Mz>IS5F5lwvvFLp-0tWwHZ@@8;$ILP|?)VmhOW@4o~ml4p)`P z8%%p*uH|r(5*nu9>UEOA2@jkiR`q(+c#D;7*@yf@(K@b1+R>~uRcv3G88^7wG9W1O zdg^HP42jLf(iUFOg8Lw?5W&J%rIQ$}Z46E=bnGX@1X@yJ4{9{^Fu3%rLf)B48mphG zc7Do-Kv{V;z9J+RcNL>Kpr#_s46V77fjwcv5q{`qQeZkTJdU;DBWhv)ZXS3+IK6`&Tu0Wf`qG7s)@PWd_-a@C}{&Ouad8ZJA;B2K@M zY8Nr7&gRn1+8H0+YRVWg$G5IWD<$g6!+fSayz`KI74yDc#}W6Ay^DVi4$ z1Gl_#AvaWOrikIo1CztwpJJ{(_cW~fbQ1nTF8FoU$n#_x_==eXbx|>tB}zWu*+B+ zm0Y>oHRvIqkrx?CrLre-zEARx{BwclSc0R1K8&JP>%MEK_P$F-kEc+gL<(UL>hUIlGnLG zDUZqi&ia4%XOFDYhZS=Rpa0xPYkT+g8IxeChElhOCbA%%5#QZaNgKAUr zy&k!Lto+sVEYJ;WUJSh0EbY4wd?a}QVKohmF)I6tPkQ1)WV*1=d2BMdG)Xb~vMg}c zyk=A%6P{u&O^b>FWD!rvk$Cb+%ph0FZP%a!>j2Fw&gR580h7+rJl3W5(7~N$Yxnkp zL2=PJ?{L{xte5=qCh-h()k`uP-jcVJSho5s{Y#g9$?jQ`cFl>Zm3+-(SCNB|_Jz*I zGs=~+IMh~ET~3$Vxq1GO?EVQGrFy#XWk?cNWL@(?2|^j zm-CtS$ohdw?qTySxC!Tlo!DX?-{q@(9!mO}Up?|&xT(17wcjcKDiX%rAtZQg9b>+Y z0j+VL$35Z&canK2nc;i$+=(7HIKUFk@X%*DW~pTJQBhn|k=fUOny_$R)8LG9mXvV> z7lvA0OB91M&t;>E+mu$v&T%PcKgmwqm3%1Fl~HjxXW!Y*+mSpBd>vVRlalYm4aJ=f zhPS#+`PgH~g9*@lX&*!WDWer$al1kjFV+3HMX%_bdx?CD@BLlwX}q(jM|qdt`QY?- zP5Itmm*0StPE1!7jmbT&bp~CU2=&BpG$`k-c`@f+{!_wF%+Ybu_rh7Ln6>GAEBKuh z(dj-ew}dC=R=MN#K){VCnZi-2?0bHl&()sAz}_EM$n})b&2Fz!R(q&IuvEe4{z6zT zmvR?>9$YoZdpuY!_jJ|*FXmb~L0pL(Fu4xS5`C_cXUCn|G6=X&r)sEE_U^JV<4Uw# zsFK%H`vqspQ+?gFP+PX_w#_c;>WXy8l>!D=kHW4~n~h2=fmL%Ke!=6hLQ$*i+hcpe zrP(>wy*St=_w?3+y;8Ax=wbU8ZOFA!z7<#JWc^b1;CJM#<##LFG0V7fM_#D(nq2R4 z)fI17$eiGYKG-5glN|Km>Mn!*o`5r3i}$g^$d)=xq;7Q{AzQP=Ms{|y$;vIwFPP{> z)w*ov$MP&72KAremxqy^IFfFa`p3V?Q>&{k+eZ^}teybZB%R{;O_6^UCEtN7y>@0; zmsbr*^dH~Bt--mjj3?=W$KcWYoYK3&beDkf0^O_al6L>@HCTHuv*O*3mlU!l9AKV& zGjf?_%EtXxscqe@)StjL zr-I#oLeT-q02{E2-38H9>A16|jMUz~3UbkORp~Zbz2CQcLPGbfv=d41(~06J+U47C zcp-j+(5euLxp zEAX(8N@_=i59~9tLhy|6ol2yAk1_lzR#bS@xXY}Ppq6f{jdzUIO}j8NctTzHqBLI8T06a{PIkCUyB4>8 zs&Z)#UVrRyF$SBI-+q2vf6o1MS2`fHzy;D-v_@wbZ*(Wig0P3VLp6lN(lN2%NMvZU&rjyObv2OVgfN`OTqRy$FRO z6x@qvyZV&OR*Hb8G1UdcOHwFDi7V>HB%ytHryMyciOLl8McYQ-3uZhioTQ%6keJTo zXm~|2?b5_HUNo@|crA4{Ao|S_Vkb5B{*Lw5^RUykd=GIw8=Pe!N-O9aFzPkKcRi z1Qe)R)SqeOQuyd+Bd+1~WxPxUtp_(Qv)nPtUFqa9bwQEXfGh(s7{Q430?q{g3_>|1 z8!Ab!cgoN2nj4-D=C$A&ihzS7kbzJoO~Nypl6UO|apMrG+9v61(P2VGUg9|yG=>D} zsM$3dn~=y0Kld;c4e$mslVW1rA#!Aq^F1mL(vmj3Nuvi9<;v;{EC92h9*A*$HreGF zZ#qvvBd2xI$TW#C`6bH}fozwzC&4IKa(W=267tAZ)s;lj}BO0#b@$qua`d;w|{f ztNYeX>drvc+v#Sm6yr{pR3Gt@Z-^cCAtugcP@WMY(o-EL2!^@SJ|<$v_MF&hQH*Ri zLq^GAWlOQ1MY&kgQY2LXDr0C+bWRuJW$uQi8)vWh?PB*{=|mcn#m3E(agXv0(CCT7zpf)mct8TP%9W7vYC z(gMvAF9u3p0PP5SiL~6iX>!0QiUJ^OVdRCO_IpvQ$>1uKf>~=XKts>1d+Y?2F&xYa zb2}rDU&5Sl%M0tTyBI9uHQ~SfOaLhzAG8fd$E$lWZ7@iDlWS~x?BzZQ`CNfFj$)gDxI~pu zxbUX5AS!AT9 zHfL0zL;N!U^AWIG5ujnA%J(6Z3Q;Q64Al3W)7I171AltEfI^D2yaCn7)GQs1QljpD z$|W`f(3v)c|0u==xVph^0rtZRBF$Y;?`IDBIZ_+dkLY=A*4xZ%Ws9+J0^@Pf<~VHx`Nc@* z25h1)HXTFk9a3%?iSWN%wgZccSfGmk9R$+sV&fL=EUl(ZJv08}jxT4B!Dz-$;rE;ymzU)3)R&Iw-ZJ~_C-M5{0R zl>Y|u*3~}9u9Y&o&O<2Ug|$h#sOH#ykf=tsX4GN;09l8=<1KoD4@ypD3RTXla~v>W zuSa!SXzd@uGziD|2L#O>)X_eV^8)?4FVL>IrbmetHwc9(hB_;~^=XR!p=n445#AEf z8}wR5isleP4qzOjwiM;ic&M0^a*IUFa1iZC#nt|AW-qhs@O0wTQe8>>e8&41)_Rqr zp@n^oHZ&pPM{kI8GvfT7ZbSzA&#I)OBdZhL`)DN{wh>d7BPFGkAPt(N1rrZ>B`;Jd z5fxOa4fV5r4mR#(W$18g|F`d%dNi*}OA&sDs5WSB3QP9f(34IPt*QcIfvCM`{)Ui@ z*VA*a#@n{=V>C_+Te?i2pUcEGn`UC4%o)L*y3wmYwEu zY1u~XKr-%+(v>sr(xczs0?F`-HzH6;C$hZ!Hs+xi%Q`7YvLmHT{!n0nP9G4#Q06N8 zD}p#9ROcqapxu{OHwam=x@29Rbsy|=;<2|q&t`5x7WLJP2OUUVqHua^hcNiH(`7sZBtM3JoNVB}F;L1CPJ)xdXh5%<9~EqZS8)0zb{g7GBvR@cCmLNVB+KZe`c7V z*nfxrM+&N|8NlE4n=nB6FZ5T=rv!lQV)ZTmKQ25yeu*i;-v5=N{u37_Y3K4Q8U3%A z#=q8gS3{fsqzi3&VM7}waiL#H)h#StOcm@c?Oe3!I9VB3*a#R280i=|I2qV<>BS9g zZ4I@V=$N2>8^LeWrI$5yakBK#rek4bV&){EV`5}tVDRx%3e^G^@OCJ%!xc2N4Gj&5;$(NH6*Z6dk8}{&5MTknNu?+gTaM9L zKO*#R-17?>`g1wG9~*K^*VfiH^xSC3ie{~p@p~k16;|0WM3+S@X_Ap@tD=eIq0Ea2 z{;dx`sdE|>;qt~z8petiAcX~Sc|D$QiM-KqVHJ!@;yKj#w9g974K@+910`r4hR+Ch zGzl}NcDGJoJ{YC6vZN_S6#^Shq^xMQ;)Jp%M|T`s7bHp-SC-Q(3V>jFAbcH7Kx7EHK}(97V|eoKKhd+>0lYn*IF z;&3_%kvxj#b#xt=YHkPzy)J)7tcd#iwh39T*x{%l;|L4VpawODJ{a82*;*W!HXR12 z{YddR0Vy;JB3kYlb%xl_9q|-0ncl%0t}wT)F#TLN$q9#Fqb6XnD0yC*np(OkvJCT9 z?3K;rE3}_sVwk^);OOEdJ$1J}w?5N>>4Q6aMoc)-VnS{Aga(m<FMd3+*yPe zwrpwi#TIOlob{&{*)E1q{pQ!R*Rg{kgVm4nVUxQz?tuY2b92fpQnrZ)X7;$DyYMe? zMSUhLroj40=_pJ%F@%`D42OB$VCP6NS_F&+Fbm*WwN9`|FA7v-gGkndBpnnMYT$ms zzH6p2364K{AzEcrVR)3}0NVW|nwGNlf?!(m%uep{#$t*2hJJd-93=0r9}&UAyXj@= zUDlZ0>~`MZ*IsN<5G26Ey(#3%zsb^S;Gp58z^;lwCo4OgZ?OUW;*Aa~GN`rQ4f zb{n~%-k@!rIC7So@%6+F5g(WTa z>k@$>wh`ws>uDMsjnA%m`s|^N&$oMLcgu1e^P4VGERjefbEm*i&^>z@2${Bid`>3PPrs}k*h@@d^nUhg*gr23CSfR& zGp((xWi-W1n>0q3#St%Aby7qhPJXoC1^N#$805$Fi0}#TkEUs^N_Fe?CUs{}f&gw- z)Tc>R6PjRBRA126+(R5dNC@Nx^1D5ER(Noauz{VO-4{4?q)epKog=&Ek7um2!?N~2 zg1m%I@?2WlS`wiWLlQ&a0U&YU$ZDAjnp#!7tSUWvEkx>K3jv-R45^cLPc3}dj5_DQ z6NU;Z*2CXcXV&zsSl+}Bd2*cCPEUpsZ=nD%*b5FXbFbq<7soA5AdQ4%e3DH-M#|LNxlh44gv#wG5liEfba?i9%)EHvhMqn(M!VgM+I;U~eAD4&?&BeM3VP>kcx+ z(J`%c`GKS7oi4283S}ckAZ|N1_j+|Rs9W!>0dvFXztmLiIDJKBoqx7WJpvZsC@${Y zI!-1QF!ZkNoAM>_wm5`8T)jH%>B2Q_Q?Q=Ee34Z2Ezi8!O4fuTPHEukzdU2Qnk02m~oy?`vGptOecPg9o49SqnR1v=G;D zzS6xSWnwRO^Mc6r?x>0P825hd`uC?H-6I>}e5+I(9B#JwyfQL=$eB6$>UC*Vkygun z$_QEW;6H{K*xNWS7}fn%klj%*H$T4KnGq&NL4bM&6Oz)b6D1X^xuVqUrxyf+_b%G60dO{Nb~Rn|7xW

^dGEEe-7gO|mRa&@~oJa4j7QTA-=7cSlVPvZuX~k&&w_mXDsE-q8B4 zD-KDPp4)q!#E&0%<73hl6&2mDi!}t?&QyFf zIBx&|#|Yg40yHxIf~mRjGf;qJ9|sTbZ5P?s{_@?!Lc4<$1Gf8qkr6W$i%e<2mMHMC za$=V*BvtQiu_g>EbSQNAfJIZ!m;cB0vES!$7&1|4jkgIS$j`}C2EL~aC%(>3{#rd^ zkY@gy?QAL<>iUDDTG4J2pmgFEz}i-_5@SyG=#nlI3~$}+SkH6Ul&bwVn|LH~;d3u2 z&%tlHpM-wz@xz3yKcbWP%hvLd3e_tN>qYAe%gSJPdX;6LHM-vi+p)LWx8}f3d$Zh4 z%^Z&ovGpFkKAI4l#0JHvFOTMFQU$emTTr~OHsJ|NpcP}W4_T;(%$_d!TINb)nBDgu zw)x%?bBJeVv$|h0yFK;>VDFKHL5l@bE6U5eKC-S_HZFH}4c!sio~B;hc5akgF8MJRD$MBXT~&zB+a z^z`(M9oK=IX4YNakQZF!Xr^ZktK`%!U*S-8v3Xh989?AAlrf`T*4*0*@_tDq2Fm2m1BC(?fg$ zn=&@qw3C-fC2e6v6eWh@RM2lMiafYq`y2ocjfa;hEiKKYb?@L#AbnWXycOt2EWXS6 z@$upHbg5>R5Tzbu&$<k1=UETQPG%(>%}@C zPy4F-X=~)0U5EY);~6&L;8YOxQku^Vq+jFa=h&K`4f4)P!e||k<<7c9@d71`dz(e+ z7!TC;@!|WMkdt%e%q>_k5-W*Ilb(j(94TgxN|J@RqN>|BD9At`g3>;pI1eHmI_wWe zv5M)h6yBPQ|+2|B{Hy8;10Z%&-ZLx1_w? zWe_qy3?h8HyAQv&yNQPfNejp>X|iP8$Sy$CNChmg|CqHmWH6xX^Gu^!PF@zQ+{&ul z@4kSDK)@Ftt0!nKPCoK%_xhniBZ~pM1)O80&Um=1(`#2;Io*cdb~oBxDJSdWvDL|) zEN%SiE>$h1Jc)*|Uw5CBHY7#S!g7rJWnIHBj2Fp_Ept-A??8`5#$p-z+ikaCF)8KVt;M`bJpp6rEc2q^KO{P zL$qLahXbi9#n;;uWI_}!NEPfRIG|3eDpzs9%^lVlV`_SOADkQVT`m_-U8SAxGG+;> z1*U$WB-<12`RTeJIbeC73+4uSNlu9EgwhilQSY~+{lN&TD3}Gtdp(C?9)(BZXrVey zn1uLuo1s%)TdPDLPVkp7S}Y7YEDT!0v#rfxy*i60PaxZU5B6Y%39>Er;ANpq zrKbC4XtjA8DlYDp?aft`dP2BCIMa3t2&TnF{C9_AKk6xJ(OT*P5Xk@UbnfmshsmLS*_W*}C*T0A} zXt>1m=#z5ONRP-#YDslyKKplX_#-BQ%sA*e)M#*^2t`Fj7+-U)5UX;3W2Yx38Uc;| z3w#XAU}Y{to^P*lewK||&iHvbp|alfqNL0x56JlZ-j^F(9R$AqH{h8&=_qQPY@pDH z;p<07*U;TNA(3Na+$pwY)4TE(^-qj?=NA_b4PY=Fvu38fBVeJRkv+fW=jX4HVaRw( zYI9N8qJ!gQ?Iep(*!cK5E$A~4r63j=lO-{^gG-Tj%}m}p-PX66#+cl#83&s0W} z1VF||B4M(9AAScb|fJMeL0&OwxspoF(T2bpF#OI6F{u*NB6hfM7K z@%5U`9Z16MRjHHJ)E1eT6=^mhwJ^`m&Mr<*Uq7_XNvcz^%7mr+8gixLGc@V25NJLv z>6gY>S@8hhPGfZT9viOE4CeL@@w<0}Hl6N8;XNdG&p5pALMed`A!}8orT(EZ@Wjtp zbLcyuTBUL0pt`1}rr|^@xW;}LYfUml-u}pGV)hdIlc||RzR!lXDM(WT=4qj}>xd=O z6O)s@(;b90(`PDFm^4+MDpuqZwu1t(^j~=b=*Gr4tUaBI#4~vJes9fwUiT}^*V~=( z<5~ESb;?@Gx6yyR!BYYguFlTDOJfjXe>>8J42CGD-|t&xJ+vYm>~7GhnxlXtNJyOY zD=j^Ob%W5nLPM?da643e;a?-|;jHmqkXmxZ`>Obb?+C$Ksx@(rN8wzjrAsG?-I*as2%&wbdr-Xzo~4Lcb#<{}~@lJ$bG zSGwL`3!{m#d=7!d!iR^4Pz6HF;*Pie0w8Um%W;}RlFsPPpBFY`hs+%zf(B+*p3d$` zP(p@EyLAN;M7*BPRes;r)@@BD&d2N5mM6$@z`9`~Yb%>zJM%$Zn6iP98GFZq$mGf* za6-BXXrp+l(!9n>1mgzZC3q1rRd91L^UBW4g_?Ujl1`U48<m zFyRwhCBt|fO5@*O;Ut3u1bl9f7y2FVw|jeNO+$`2%=NNZs+HWNI-u$Bw|XZe-YxUH zzg~_q<3MRyZAIfjJXtIWTpcV?ugsUv?Ew&C7PP%qC~_d)@0fhU&lej_XIPz~{{Af@ z!>MHPn6{A7(L!<3%i|acob`(^ZQ(y$p;@St#_;5J@0^_O{Hw{x$lTd};iYl0bE#?T z567(YG2HLf()uw)j>nrGEV?sHOm5^U`~LhXDRa*Af$k5n%56t{rx@`(nG9PmNrx6K zxFqP<%Svo*KpslJ{4ML^L!fo!e6=9&p^2vSxci5{6Fd=Jv6!??Hj6_Hy%IECm_vpY zZv|R)M!pBzk>2lkK2(?8O5l`8fnkpn8#UpQx6XFuFWN~>Cz;X>F%!f%4GqRNNQ#+d z!x93IUP!ytg3b)ud+5x411}zBW-T3(?{B!{3UqPD=`f0OHZ{FVrVYnz8M$9@PPnig zg2Do?SILDvaq`9hLjn}Lgsi^~cUFaq7@&adnGEa=AS-iX*AQFe8?uB*iDwzc_4X=G zSYhNz!IXD&@MdlzAqO>~{-pJIKFx+;37`luNGxi#%+@7_c0Q<+DvIm8hJQPBdqZ|pyy&6BuCNg>nYuQiH1;^f|sx( zm>blG87sOUkZX(ze_;|2*?-+~51T2%-0X%*rE<__T(IBC*C~jav3#-F&dJD$eJNEz zT+1GOcQ-BY^nN$()yePbvo-bub)~eS;_N=1RWPf@`(+%NNMLJueSLQJ<}2F=Yn1%5 z@D8a^hK%fFv5a&3{jB@*N|F-q2VnLVAj`ms8*QKD%K-|NqW7n(%WIoKE+vH#WkcIC zoz7w3@dRa$)yF3N60k2PsZ+E2QyG$Aja8B@&nRvR|K*$)n;#RXB|Z@ z@(|L3VT`~6(chs8u2+C`GCe!Pv2}x3i6*tQxZpg9vv1qW(-XkS0mgf5!*LMUk~ncu zCzI=7&W06Li_go!p{J!4X_3niI31v}7txYV7b;JF{PBr6wOngGff6zxM(l7hF#L*4 zF7pEdO#0M9udUm;3|yE<>Nd*)raUnts=H0+D5Ws6`IS2h9Wwc+20Z@^x@2wqC0H8s z9F8F_&xZ_R(;n%pMI6km*eR(qD0sVIa3;g)j#gPjkT@{mfIg#ugzL9GH37N>boznL zujUT>NS`F)?XI>M#UMgJRW6b z4KYF`+iBpTDbFDSf zL+J5+O`sNZu&3U`qg6rR!`a8jN5vRjx!&n`DvQg<)877iAW`9RyPNU*PpH})Fp5`> zmpYb-V1SatybY=r7Q{DFtpz=Pj|maaqTpSy3L$obfoO9nAC1AI;Yf=-U4v0xgu7FhCn6QFw$$ZTG_T+&;p#5A~d$bYxI}vjdL3+eDM{-9k6Aiv~5SSLiz1;p{+$v3mk*;4er>z-NHx<6OIBV z@aU|P`rD0!d+zzyGy4g8xHKf9PC!2D-~4&tH4mYv0I#kDi4mj}G0X0v5SVQuCJkQc z!~7z>qAL?VVK6huTEMd`<$Rc`$yKqQ@ZC#S7ykf4Be_YwRs{(y#;)uryWq6lol1E! zTyo&E4-2dh2M-VYxa5j5c_IGFh7m_%S<8zDPE}{84?l_^{GgGco5nOqCI=c9W1{KV z1G}1`^OB=Hzz_ZOnnz*@m*1WPJi&H!<8U{#qs7 zsbHbx*gmxeJ4b~_e>hVQW9oyCGQw{Pjf~-v7vGCY=zKhjQBBhi6VleYQR2OKZ+@wU zhDJ@eBBLz4lb8|BqTAG7O@vgzVB>{$X+3M{_At&^cAiwwFFFrQ5V29)}lNZPr znq)AB1WFbyiXK`>v5=X~D*CGD_wiJQ-d`>*E^((O*&)*sr*A+7zt^Wfoi44dxGC+| zTV5J9x@17+Sa=f>EprcCERoD!pu)$Ye*Kwu1n^p+WSbY!0)l*>I%NaDQ>jLk8m(@i zST=!)6T4i+gpVY3*ghROXShU&$fN`dH3_Kl(?FsF1|gR-Zje!uT~i8En0r_&+Vw9T zU&Nq+x`~}Ccs1QCsp-tfo-);Dr(8Hx{WwHY4OJCYP@X~#H=-d7JtQoGhY4H8iC%E5 zSDr*F|MSj7`aF)jiFw?v7=;*AV!+QGvMaek73BHlLqdg(Q)VHxBTAW#!cE_D4 z{nrHPqI{{168;Zd89O@LGc`knbnB3JSYjXz&hZqWp zKK1F5zI;jY+FC)+k;@)RnKc}K-}UfV@&p4m(KN2?aNXCPxjrK%7DJzlMGYaipYpr` zqEJDN032!UgsGp)DGPHcz_SaVr%ktQ?l%rv8&+8?r~XG!=aN`@q#J?cuXcOcPHaV)aUPRH_bsJ+M> zrAJ3co}Qk*H{<$y*!EPGJuy)3$o=*t?#<;4^~#0dQ1*5PbbXL!Xq8KEqURjs^+!~M z!`C8lNQlVulXWfM11u*SZ~VC|44eU@>nK?oio^weA_%SlxO?h7Fss~(_P4QQTJQQY zwcJIEvZxtuWfPaVFz?FW6W3{omvzPDFpIFMi>7CkKPh`r=UE#rE~;=y0tCY`&c!4C zj*DHQo3AFGGiYZGX^->xPk#o0hJ&i_YVBR#J9rC}< zrcT}G`JBtOPCVbBn9k4FGZZ7H^yRb9@o9l*8>FRw!OX=azISUiJnQSHcmR?yPfsr` zE$z(A8W2N&Ee{V5Esl@^?bjWv;0~5w27FEG^e6#U97(-(mOmxPv8?LrT`xAl!ywrh z80b4c9zCKd;q5;L_G9N)C0OuCQ^|5s`f>6?rwIeMc?l<4jE|>y zT!Po2Nt{2{nwI^Zcue|OSy?RvJ;XdbOuti#3fe5upGY@PNrkf&NfTxu-<*#f$k7OL z(gc_6m~eo$FE1|=G5ENIg!~@24VuD zF75ESsS z5>WS!+cDa2YV}4`r%btzIE;uNp^O9-KJn%tY@#~hrAag&P(5|_Shm=2TUGTrM=$jbPUojnt%Jk{=kmN12{Z73}o1!9XPU6 zGhUKc%EU7eIsgBDCnOUrk2m#L!druuZg;l3QYSKo757qEJPY)^x(93n_l_^pWASLp6SL(n9 zkdA|}aCm&7HZUwCnAkSU!yAfWwRregY)ss<*+AGAj9y5Wl@vm(lul1&XEuP=k;R*G zBx9ye9udgNiJgo68B*AYm=-$U6Uo2%B?}t>R$Eq96~MZi%J!F$p22g&4h73M%qkQQ zc+c%kC)dJJG>wB3#{p)?+yZkzMDQa(U;cNMGji4JFVoRcr3%$JVx7kw(w?^Y3voLx zKK9M+ZS$;uqWENSC`~URFFUFKI`AW8$FgS~HD0(bLFJu(ZPZ7ya8eB)hW>;8MNc1J z6t^SLJ`WpE&*CIw7Q4S|%90b}FWS<_Gy0;8uzCOr3gIgxDPw}>n(cAc>;sM%cdO+{ zzu3g?TjS^Ii8Zplxryis@hPJL1gQ!j=>B}@4s^&9wFR^?ts05I@vt|!7}ZhHn+pC0 znV$B!bQ+E&g67}u!p%t_fwDDV|lJkVgUX|pciT`M91f@fWC1!83Cs_ zEIPthAx(My%_F;i0};DRf`m-S2LTx^5!B?P$EfqT)?}T^s4uP&U@sitKV6LUO-rzx zO*1qTODw@aXs&7sp52z;cD#3FwY%=lC!A*w|D|t9Ti-E=3>PKFA*V^o=)d%DBqYFX z^#&@dtEU9h%a=f7!onwD8|ZT5$tuuo)(?SkE-fxr$q_7Lbpu0^pwr1eXV$a;B<-b@ zzmjF`UNu1*1#zOpCp}UGy!MpVD=#)yoowlCVM(z@?EW0w0Xx+;7RzkfGC^;-7&))% z6!@S3hqoA^%W!`6r)PpcC`if&S}P|C~;0ysanaf%74v{tY)vGS*Xr&RF{&7uBj%BK>8o6aOU zB>1O$`2w+?3mZnOj2PMi7vZ&|&$~#AA|>2Z88Z(M>m)bZ~!0T*eYAs1_g2v zN*Z9I66fSGfVVBw(A9^y$RT(1em=r-vPUWSv4(q8)iP2pfs|mVybx*Jkw~4RI(Ez& zr@kPzLQRt=U4#`e=qf7=GyG)%i=fxkZ$g)sI48v z=F;#erHJhB_kJBF;C(ZQy=v<>QV!vnNK!+L?8%h9vQ`kaqGvBEtfVJYJ!(UmG&Kb` zI}Zwk_!SywDqe3H@*Xn2dcRVHGJXu7B>h?4*$zZAT|;_2U<%c9)}HZ<+0w#Bg@J@2 zD-->3D8Xg3haxk;RfZ6P7FfM=(m%}b&o9-Efq)SAL*VOP!S9i(HEyGX9SHRSPILS{ z*YX4wrT&xunROMaF5q|%lK_bj>W?ajx0&knD`MTe@@UC=id$xRMkBS*ZnCw4cK!kv zSGkPb_@Q#~p8P$-GNFn?1gc$Ly>`Nr+yOOgGA3ToD1q2(I(!8x!;<|6Xuk#xCZ-x@ zL4Ut|7`zm=yTf0;Wsp|V7L?X!zAIqSRiNx2OG}TdzK|$v#)N288+r(Lc>0vgRB%2F z1#%w-gR?6AQA= zTr@0^;Zd^kvYvc;ar!J`uDal=f6WR|ltHK~Wn&Z>7^w5q%-PVg7iMQcDIhJY)GP8Z zFB?(L$aV>k%o|px{_$^mA4==%6ZuEVf<%n+12Wc5>2x{Jcndf7jrR#l!p7bdx(0WA zb@0g@Hh^W8BfaO9HhZL-S(}AxlaMh9(cI*w%T^y@$JS?7#1f6TYyHDW;AR{0oD1l` zXC_ks#0DaHMSNb5s_N>Sj-Ll%^U|J_K6ZAO>E_v79;d1XE_g@`x`1jxwd?d}Cqh3w z0|cMl^p(OVp}=aDCAIv}PX@=FYWrW6^T2OnBqGXRh)P&7W>C<`280F$G(8=zNIGJn zxvLH|u=_#_Pcay*XJllgVfxd=-rjzDt5ZyD&@54kG&z$0w3MM^_UcYfUJi^yOMBh- zW6j!~P3-~aJ+fTde#d&wS(B%h^sFeOkM6q&?clV%A=Sbe*c`?>e3QCEgbmSpJ zs*AU9f!gw)8VNx>xuLeuwh>1YZ)g1HfO~=`S$X+{WFiI)7gIF{2WIND(}!~hU|(|4 zYvoRE7;7(W&^bFN4-Xq}u(iE?cy$IUT*$YogkQV4s=Bao!GL8TU#WSV&$I~%8F9Yv z5K9Tc>(O@);4h)__r5E+iHnA(uBYHQ!nW2BSdQKFJ3;qxxZ34#lS-v(wAxbU5`4G# zDV_G*g$PWPgs8t();7P(hGcHtT;6bpHf0{5S(YsuV zwRu7^Zn9ePca!$8-b^wZSzm!E5f(a~!^g?a#eVg)or&Mo?kFiDrCH;#@f^&*ekWqEluu+rjB*UEV<*NTX-5in@Z{Mg1djFsROSTGNKja>vo z&7qT2p{cN{cqCkbe~vddBlRSkE!{rLOwZSbi7w;o>rGml8EqhU%if1mu|qRmM+6@RoAu*Z~(1EXym~ zvy6w}^1x1v-G6EX@_NXo*X-u#Xk}u8apIC1X8I?|F1)IBMvdq@bx!~5K|hv|%WhLc{GTd$axfpny6M?v9}Br>}3WvHUzRV5^Y({EJE$AHx_~Sr0C3 zI!EAZDg^!-xzIh9_ZB9a3MNUH$IVKW<{k4?scLbIg*Bcd5b>)=v|&li0`dMe`HWR% zULuyLqO=+#isIgcDNj;WT}??{&G&rP7?94@y)3}V6E@P%IBP*JGzCe57AKKHJPHcr z?u_|&oLaPqhbT-U6q77?V2?IBuraa0^CyQ0_eXkGdgmXKgkCc?9r@6}O*<;{W}d$B zZEmNb<0m1rEZ!F=-Xr*&FJ4s>Um?&&B|kquZ7;8(uxv>ujbt6Gb$b~1eAO~RPWRx= z-RBp0#*W(xeXydHWQnoi9Pb2F7_d9gM=yEj?^>{HU)tP!727Aaq&^136=CH2N}!ll z)>G0`(o|E{o470^hi4QOj;B~QV#1A*k2=pylJk^12Uk;!>fXC$*k#{t6clN>F zG&*qb3WW-T@_c*qe2o*I-2`Y)GFsOd*rQ&2otyKkD5=|#oS9IJ%(i)Y=4R}Y66v&g z1Lul1y&h*a8NP=t8|kd(4EkLiLO+Xlv7^QHeGV6?&knvdW3CrlKG!pOhmr$VPrB|; zn|@!hUm!hfcH2l4UN;|4sP4Omhu=D#wl(gRhuCqkIUo-gfCkJ)av+~MXZz~G{jV9> zZz$*f>{S|a8qpz!Zao2+soiUf>XE6mJ}=?jL$RD~%Vq`5l3d=nj$Z^*>vk*Kr!qa* z#OXO{wR&ydt37&(;GfiZFU}TU&Z6+ELj^h)8;tcH&l0|F+$$Wv1;w$034x zFS7~X4Uvgv%GfhD+n?T#IJ?=?WnCT~l*<-Gmo{PJ&khfc+V}{==0|lm^*b~XEPDCvO|5LDc*F=WQQ_vOTYJ&W;eJEiRry4o47o2{pxv^ zEkPmH@zXqO7pG&=LT7upB8tL5yh1j&%a{?%yvhYKA@B3!Y6DUjnMJc(1N>wF>2pz4 z6{6+OEV~T@mciQNKFou|fSN4%W1g!H5stH^g>wrl?wf-|5M&r)7;_ftym_esqf*{? zux{qK*TP_i$aZ9a5kD3a+H8_+sE9#76BH%^xXbvpfLJkyj7YaGN+V55_*^p8=~cMD zN6z-yLuiUH3V<*bTL2pjl;sNjckW=qTbaO;9?l;cJZ3GAmzR)1F-hh$4q%+3?HaE1zSo=GP{j+i{s%b5%z551EyAF$P0?efeg0?!do(1`ZwwLNs>GoEUcBP^AXCm zfgc;R76cDp%PweP=|D|b03ABaS^CC74ztp!!0XCWNHH9Ek~DsZQ!Z8U5UuhPIxO_W z)s!h-CsbCLfdU%do|D2Jm_dxPDyW~M^j+ktK9-uh5sf29Kw0{p7&uHjG@Cy|n}w}yNIVwyh`0LJPVS;rNJF1nUV)I4bbXVG z`}Rm$>+w~7fy-;7G6^gE`1sCwED|x28yRNEq$nzqIX}v;Z=qf9E=km&YzYA`AtMCz zW|?6B=7mEJuM3=(i9xOa2Hd<$0G=P48o5Tbo{I->r;pD%z_!09OhiUL^(=aMn~I8# z+?P7F8PEi&-drk#(D}G#-NW0xog=vw8&V;PA@WHaYSHozt9Or6jHlnzRX(rN-Y8wi z)b0U~ZSQ|92S}t{lQ$A3=*RLbiBl`{H)Zq$)DG*J*?8tzD^S64+TRzyp!vLU4Q8I9 zMc70TG>dpQ`1gB$@_u&ld_D7eKc7I)(3~Ok-*M~o&{ph&hzl|G-@P9v0+!ECK&Gu{ zTpbEZWN?J`J*0R|PCQ-MOgnI_PhjPyj8mY;t90hx@d(FZE+dwqesqmpS26q)Qd~CU z<<-MOJrf_sF`30_(2T3gj9;JQ@`x}y;<>)95jxH~&>t^i@TFG#yF=>N zpYBGQ%74ih+mAeahj}T}tRe|H3mmTc_j9L7K)`Qa;o;p>k>jVp`|>+R^3dCK5WLWf z$>C?tZtQOJ9~qUM{mZYb9C@g2Y408ob+Jq%BBIjJF)mDY-G7bk9=vpfP_d<(Z2Me0 zyQdG7(Tq;SvnvlU`|DEn zQY}?MPo|&{ei@JyNtg3IL~|g4iIaq~0rmdMAj0nYa3k5<$zVkMLnO3U2wpQr!tVC$ zBoj6!b5lD~n(GNemMEQaP5H#aB7t`7Le)Qoe#iZ)>K=9uzA(yC8_jzoq1ta~`NDLH z^gw#N|7<^x07Jp4j0&H~bf1M@8yuyes?49~sVuJLGs{rbSmRw~#h0_5lc4LxFruj(Gso?G^VEBB zO%Qt5Vd_%}NDi(?kLt^-s?WJ;ysyvxqi??>__HLmd~Js#yHqX*#+q6#CID4F%=Lu` z2X_axy3sx=O>;~&C7ll)MIr#W*0_at!M~vE?x$Mp4Y2yZ2O6=k0xsGgeTOIcWO8yO z1<9b$QR(IW?G%Uj$~OLf?ydSed5NggL%h!%jc{PO9WzqD=ohjpCkRDNhm0s z4JUCZtdlWYFmOE{mtVg%Fv7MS2!~p>3IeMt-sQ_Y@}kQj`YP~#iyNBrc@a)*ojTn# zE{==x$09mg@b{Vl&5y={K@!&3q>nWe-&zPv-7XsxOm2s#9L+$CKDCFF1kjD$U9 zBkNMR$*I`dQ6~*8V^zsK8X0N5)#Nn{jy(G4$wiRc3FTs|hR6y8**z)er6YZA$^)jf zJPGrZ)gQdD=rSp&d>OLGY+zR*(`-q7m7pdfj#0+sfhn5_4ns7oe;^bT^Or&T^yvCJpUw(jd&_-i|!ltRL zb`U}#;upmhrO{3O1A?YM86=~Q1YqI7W#%wTL+r#KPyy!6@^G_1db#WG<`YK}pZ)6z zc=ipv8||IQJn-!(g3WN}AYnb$MKynTI%DW0R)-Yk8Qv6B2sZkUc7R6=Wx=P4!G&&c zUq!v6nlmeT_p*u?*~~J7qO(gOR_3`dOX0%S{N7HUvuI~7^Y72zLf2r4 zNR*+_bz`gV1+=vce|(oi)|*Ci17e#7O8#I-V+2xcA05TNdm z63@<9Du;c$6c)bI7Y%If0~)j=4XXs3N+x(mn#i3RtUulzR#qC4!B-5-OJrk^`#Iv0 zYWZrkuD z6Co>C(Z_)5AgJxQ%UAG+fL3)|47Jx$v&ZJ4yy0LLN>_*95>o=;UH9pe1$EV#{~o$t`^K6BzXqGFQzeSEw4`|cnJpvUWl@ay}@B>BT|s$s}hJd z`=AsT#qCL~(RN2;6*ShGTN)g-r~8w|5lwKchc|78yntxu8fm3o(g!#nv@5pskaPOv zDO-wz%@7p*Nky{dH}UQ=G_9N#e?qpovX#t!E4yS$BDmBQCI^D-;;8PN1O$O>f5Ywp+Oz9ppg!-u@&W9gB zwfZgq_m!)G0^na1Ta4C9J~j;|17E&)?xp8X)tIdHw>6i)FTj}TKj?US&8qk6T7g0e zFQ4XF9QR|4JllV1^C|szog<#Bvrf$s(#}7yL-!SAQ^T46LRN>Vgb@bats{Sd`{PCZ z{cqX;PUio6)%Jg}ooC}<`mb$3mDXg;0RZ*84Y&uRzsn(Inj!JGCFcC;1n+23MxnnK z^t88(tXWBeMd30%VOP5&O&>q_S`%A@`-y*_dn>>v$~q7?M2&bx^wL}N9e&vM`Qh^n z#1^n%r%b-T?n36gkf_+poh%K)-6Hz(ReAKy$(mZ`qiSzmP1WYJPOe#ph?Q;K)=g*G z{>y$Sm;Uc4m=VylmGWXuxL&!5SBZFdLqJs1*nu+F$Z@!P*C|wQ=h_3#;CY>`-P-WS zg_}2TW*fgyNS0n6{p?Roin-MZpT=xnz2 zoT%?Ky_LDBjO8j{!w%6SjknTKrt%3n`RZzwmpbZbi8_{D;Krb~!zgt4mxsqeUFw5D$1?1QOLr>Wd^6{#Y+Unplb1h&i4N{jy4tPAo=s z%0t7R{v_BPO_xbFYyC^?Vj;NqK<}Y42jz^zC_@C`{9Jneb{f)L8PBgK7Hw3pVM;Mp zxPzwjKPswqpl6)Qmxzz%j@lHd51_aFW>pmo;rZ5Mp1FOhYH2Ql=`gf;etCMG8uhtr zJc(H}X8@Lp=02PG8;va17kqAY?w|avNJH2{Y2PUoL8lIe)bZ-1W7DYnw&_f@4Efh; z5L@*^TL+t`@bTWd*IGw47hN;%rN#&RjCh<`cX1T+M|}b5*sMT#Derw}+C=-&RaW6C9`KlbokziHt|LQxdGkC=XMCcZ zIkHQdQxYn6H455La0>gegKJ6}YY&4s^YSI@`BSXJ!us9n8PNgoPSJ#G((6e3Uczf# zp)f;>z76whj1VeW_-mNh!EegV|8DPmG*B$zBS1dEWNpQh3cC1;G?jxI zUf~9dT1>7d%-LdR9Lfi(ZU?5~-%Mph+&wN`wRC6U*btAgv0u+ni{&#L13-v`0nqDB z#4yCyjfag6IzOD$k0M1C3*D3-(I#jR%Xax~3w!VLC*u#l$fY9IddXuYaLB(qGmwzD z+gwoTLzf5jRuGD-T+Kk}cwy4RK1JYq12fm()eFVYFFiiPpT&wf8k3@0$|~rQs^Jl@UC$UeI$8Xl2s|e+i0< z!N7C=*_4f>==_Bo6Dy&0QG(_%IryhyfK*=EY%@2&N%cn z>J)h-hmFXCA#jQQkW+*9r;e1>i@Zyn$sHKb`v-ZL)kZFl{4<{6#1I(j%pqo?SO+WLXpJOd!J5G$}o-;J4JHZmzAu z0)o*)=BPw}$xq@viz?dfR<75F2%MN_c((i=^~T*ME0~iBhF?r&AJ-`YXCBq3$WZ4q zNZA6X4hAK~j&Ezf3a>8Ak5J}O-_8#WmGD%NJ0MQOadS028sdIJC^Q;%eQYrQ{@WILQ~;arJ@T$HOi~ZT<6+Pj5oVyq8zCcn_|#tJw(7s)O|pN zJD3^e@w@H-v}uwAmHFO(*tqEw`F0=LmLc_qliRNu)5S$Yf)j(vk9x#V&x)=h{l-;4 zY!(To-8tvEIrtdy7h|*2tFHdwZ=9qbn+C~wD|V=IZC_o?$Y+tHqBO*Hr2ZPn7h18? zt!8u;reyOB!9EG#coAOFu-ZmFr;^{+agbp0TTRdo=@1{I@gkL2mvvsj!il)*q{_^E z*HXW#JYjK>i*I1$y8v;yl=BJbqF#9lTIUouPz+M?CFUeN1m--XVBLG{@bSldk{Chd9Zz-Bx_6mfY_vHR#F)S6pwNKZ0-Lr zc1}&AK+BSD+qP}nwryLxZQHhO+qP}ncJH1&F)#Nkq7mtgNpxU5H{lyQJD^ zCzfY=myd`o-M-UJT9R?0*dfB(QPF1JM zJQ6#XtMcy@TMKUyp1nH59bs=}vRemF8oJPj!D2m-zRP5I*vV?%x*XzO!Z2Y=F+9XL z%x4GDzlFwnqz6sbZgyxHpTGCuh&V;H7a9lc5J$bLbC*0En~oceeu*0T!eMm7IB(;d zZKA%H!A$4I!at7`@Q7lq9{VKvS9M60+9#B;k1LX>5WsTcr8>E#GG9ZJd z+iyJwa|a+Wu=pljZNIM@E|LkA+{8sCTYoL<)V;HT2+SzI+u>o|zC1(WlnAf&ZkH5L zB&loaW#pPx3tb0$=pG%NwmXfp6ir6ePKM7mu3=z`$7Tj{I00k+Verz!>$Y6ZB@TMBvHj=8uLU;MHryI=ltO{!itV>-vo5T z-{X;rsI0-6u&GyV?}xSbuNQ}(rL~hdzXo(lJ3$bSkIjGKE%sXNQ7Y`56;o?R_-+Mh zrff`lZ<6O_8Md7%O(+ka&-YR#UpvKQPpXzFy~U%3aPJ2lCtJ(DQGI7LGq|5}7cYTz zZHv6HB+`2ber&tcIIGiO7X5PYnNJzF&%EqmcGkD8SIe||wDWMq6yDjH9<1b?b${m8 zbWdFP(7QuJL;ZYzZj79_`O1z?4`(+tL%DCT{#_54f7^a^N}Ye5)hY9(T-~K*!R_k( zmGyRHN6ho-89}0-DXR9WhVRN=vP<$0BaoE!{Tq*;lVZH!Ne-v+W~2 zEA(tRB?CdKS&KMsc2HqhEkcp|K!r#N{(2X|l|k#F=*jTtWxAJaoaE|f;Ew*@&Z>Z& zZEEyFIqpF|-kd-q+|?xkA+etc3fqS5gtnr;5{Kr>$FkfZt{_UvC2@gQ)xNKq%xWxb z534r)n#E@KOpv6L!sajV6%hYO-eZ>ED`rotf^KVHp60^Lc(U!IXg18;jP=|wqrNq@ zk55m*q*Pjd#FP#)@jBUpA0-YfUdFLge161m7-G)#qJrzPCumYmJ1=c=)uy z3vkl51ZZBD6PtyxOT{I5qln`4L9-bhwI=s$K{VIe{xXOytrB!$qSH0VA}L)IWun= z)=&1$7+p694jxtY%7K8HBHv|$W7p4d&d7dO9A^m{Z@LuO1~!*%-J15qnw@M5%NOjw zVT2vczc|FPbFE+GiqknRqn3-8=!TEzTshPuH{4R%<529L$u3cc_ujtxj`Jxup5l@} zz@grtGRf!Q3J$1Pp9EJ)HX|1nvnw74GvT9Om{D65ynG`D{L{%1CeMxdHVm=Z&ya~a z3?ivSvV9U${aJ)ra9&!r%C<5A%7O@w8&D|RhIZNTmCHt5-`q%<}j zf7NCDM;c6Q|7!d?1I(;qqAkE&Jg@0@O&P<7^L&fR67LfIz9=C)J8wja)8#DA$lF4s z6C}Ylml?%OEr(*3Ar$4~{Z0-2A80Gs?tvS@1AUUWDcD956+ zTe}{yg`q5RnfCj!w)Zwina+tKdo{B!ST1rxm$$daoQ-JVYI~u2x4%4#oJ?)8=)=0AA;dzF9fHF7!4r^3c zgY*7$bD_%?85$<`++M7PJcX7LAoK6TOhhIQGmLaN0tPt#4{!iC0Y;6H#rzYO+#n%6 zE9T`nfk4EjnzQRb%W~j6-ls|6&X3LOs+^2)EKgxg0#4mOvIJqoZ6B04E3DGNhY!m3A8Kf}^*UjeylXPRLljwWV zjaf;>9tf)0KkH>H+o;b>LaiP`F;E7BXINCMaAC#82xEw-T3F7t+ z@#PiCU^9Psh8f6XX+7vLEp5qs<3?nI{Q#&+-Uks;)V_*87+e2B`tbxyP37J;VxV>T z_2YY#aeX||sH#dStz2a~>7S06Gos8cXGrL;e5KsN@Csa1Z;5>Q$`r7e9W%Dd)}{o^ zs^2Q>!~f-s+7qPO49img3ocP|QIXbv2rE?4PBtdmZZMt61{~BlbD*j-Z?;$5LP{0b z)izv-Kj;i$mi=H+U=UC}qa7m%1#arGm7m?{N0ZJyr3*(* zJe3PMZ3+7&DFnY%JMhNy4r9s6HlM}U0vt;?+alx%Q3#aQ0Fe4=A#6=aJ%GsEQETv! zDw3Jjl+25j(#v^4+n$AewYGxKSwA{}eKeAx_6)ltH+5DcTA*bm(W+#?48g=)AOAUf zM?#yLND-2fh&FW!6L~p z?pTg2v3Y7bE>_7#I4FyXmc|d)X}tg(7qCoVRdDXt_Zh34B;$`#=TNMeR(c01JXg+a1!307o&Y#5L9Nn|;N{dMJ=JkliT%8^jH=1F#_}2z-SDqC%1$dB zQTwe(O~e6yLy_(~99JI)ED#Kb6P9C370Cleqbfo}iSBEhKtKu4HxV?dGc?bw5&_y+ zRL%15tBoQnM2Y8@=CxlrQyZuP7%*g6F2hQXqRc=HRYS}utT7%mkbG6Afkg>Xx{)S2 zUL3rW#dO|4DevYvV9&{lMlPTIBtCrr*i@*xCW9*$#rP<^OEjgW;{Z$Saiq){hS)?f z-s!1oPpv2{wUEcDOwiH&@wU_}=wFilR*2J$1=ibPPhiwe76dRR3y`q~zguTliu6Hx-E)&GS_>0|#E@7+cEx!IBCu z-h?!GeWJK`&g2@40K6gflsr3p|^ z8lJT$zxp9S2|FUId4L;E&1Br=#}l%NAcqO#d1GXNV8#{)7Y%BX&!W=Fw>356@r$c0 zB3(y=&mLj2+KIphj12^+NfSLTMky+RFeChQNTwo;{i=NQ{iH2XG(G(IrDRC%7C)v{ zEj^yb3@2ZCzSHL&@pI_rAh8pE{BkT*t^J;=)b@QJ{M&2_w*RN$;lB%==HU2W{&0!b zMC?=h|MQ1y4&)FSydmN-3ECw8{%c@Ix1`G$I!^rO4?}AvQ*PY|3e##5MTx4ds6%u9 zFkVQW@bii?kHnvn%C_x2Md?4jYz_U?@t5ZLz9y+TDM`xnw_ZqpZB%ktGG7^#;=lRj zB=_jd%AI|oCF|~Nq>1~iQtka4*)txyI~I?>O{*#OrH-8Co(+2rj4l19);w2lL41Tg zdp7jfjM`>W?LKb*uR%ONHy`uQAm$i@ zy~`T#s73EAiw*Ppeg8VP(d)H%I$WImXp$@Iv`SI-(R^|l`cf6%>-*tIM&A2PH_Jlf z|EZg#oTd8x>*Gi`?c4DD#lOT~rXN=^^Uodm<@d$x{-(bO%Wcjn(k)z$+S5$k(-9$yu7AUMhGqK&g+7v0L%Q%f7E^ zog2hrTylp^AH>+ykdR8K8&zqp;waVh4+;h-6%%02E~zgN+1Z>-BKnj=_9nFP{2BJW zl3F#W-)jlLO&=NUlLkj%k6KOC@Cu>3m%@=mp;99X?qlz>GT(sy%$AAGG_NT{H4TBq3PQG&bE2Y|T?sR+h zBXBehyWhV9a5^A=?F~z8qG*0o)#d6^F8&*jem(%hzWOCFl}v&?vKqdfPT2TU$+x_I z7o8Zh&;kMCk(z1a=3fuUq&ANEwMn@B&VEFZ&ZJ!hvC9#;+~mZGe^Dq=Vt&LCN%O}D z;PSSV!LIw^u6$e9$;3mJG;(?kiWZ5rJ(U`Gk~fMLTciaVQ3uWg8$5Z`Y?lW-8PTS{ zyaCpv*QoB*vixQFeq1kNT3k_0nDS6`y+KZT#Uk*)M~6y+@ba9MzD*MJj2_zIQ#Oov zxt)Q8NH&@Y_Ry?r%$w6;SIYb&3)U}7y0*&_Pns*jFRJteF%q{nN%dyXIA1Mlf!GXocjZ*H z?;8wD$I+(cMxHEFBKKo_&k?A7j(=SL&hYj26KI_>6m$hh+_$46{|`fSk zjA3RIfkW%5UAb$_^tG{4Jm|s^b@jFG( z7RCq`s&dea!isa{W|*KRB zbJTs0SSU^ME*PFG_KKanmx%%XsFWah`hI9_0C{?AELv}}PEw9Rq^dnl(5(hu8lJ`e z+|v0|>KXUsZTcXJ2DPbln;IcRm&A|LOp5`0Lr_DDfm(Sad?}k@;eij)sl?S5r=PD% z*%@{;+8EcG-o!p{6W<0UW=YFT2GL~SOhVy<=OxyE~Jln$XPzh2(o`XC8 zE(vD_OnsTWkrt=}x!%J45a|j3nLo3Fh9%-T%VqCDTv#Zgam-FB%ug1b*K4K@u&Yj1 zxsuyFW^1IZVYb=Sb{EMa-)8q)FOM-GTPFx~99V}Iz=ue!-bsXyDjdF!I*QI@Q~4jLr>tdI1>(c}&Nba-g@Sx#er zt|jp8VEKb2NVg3m`p~YR9!Lp=Xld$~%{R0NQWJgn!mFd!oJeapoyCUXgo)=GfPRf> zJ%fLLUcrVs6eblQ`-WQznmsZ0Jif$n+72MbY#HQPa#O+^HLPOfJN3yu5leIt2NW6P zb}}G+E{`timH*bTJx*&5#kUw=D5t4FP%x3EpA}GdsM{@St+`W_QqN!w0cta&vQvPp zXYY&8ki+Go0ji{tx}6;U@TF)EQm7>Cm$Bz9STwM zn0WxmJs;Ezx3-S*-s0HJQPFx?M#>ao?sS~y?NqPq<4EO<0%xnAwaG^Uk&C7_kHz;_ zM{|q-#{iMr?P*1VXUE_9At6GKOG2eX0)5~Vv6u6{`Dm_+mAgGB-S4xT+6BHeC zu2d2*U5Ku(uk8smfY%1Q)HPILRkkC45hBXzcQD3wzc28yPGyM6Y82p}3P>5%tRGNG zhQ(w%KaWK0;JHnySKAlV!MsbsOdRuxvy=3x&2k|x|Fov*04>Vh{%UekZ`Mz>_pp@j ztgc3;Wm|P%C&5dal5%w6+k7+RBFn8WUXq4Yp*-g{bvhl51*`t2Ye=pDOsLWY zemhZbsnYu#Kvp}btsrCccHTMMFcUt4NBLo4TPVo)^QDuGh#EqnScqze60lSoT1nfD zgfP6F@0x0XHi}0o9~Plg2T^d7k6iMvdxD#JLFbTb;}aduQ_v0Hh!d4VW&Lw4%AI}N z$}xsp6(N`AlR~U4uj%LF%DINCH(M`W1hi3<(*~ikF!J*@S&Wok(9Kfk08!=4&=G(F zs)r+qLj`!Fe}zjs^3(DDr}4|22Y=XkDN@f|R1vSGPeFfU>!#NoK8xNm}ot^Q2Vj3k{(s4uWu)S~U@9@J_Z8QY;1^spb zyJ$Ju3&Pp!JB>&>4pV9{i!p9OQBIn|gL;1lu!{5ol>%i^?IYJKpihDoA zy?@-@e%d5dwo|ov8?f|m8`LQ`;=Wo#20rE`r3G_Nvuwj zJ^3f$na;5CUQol#Eup2iUa-*mZcTfci5~RTYN|V>8pdIJ+e5u}?B4%7hx$Id$_rXh z^wtwUC_KKV8ETQJaiFrd{@y zP&IZK#*25`YavhcF*{L^4MBkzF-M=|`IJfD&4$oCjxiIIA0?GfI;S_a+C5fExtf=# zGB$<2mrCMlWrtBo#w2jmnpWXMwx`}oMUaBPbP^?@AqnUH%{v@3CJtm@3!bKUvuc+q zTgkTum?SF4G`2*JKT@RrbuLdxfx%B2?Wvu6jO%&jiVZCsnFE4H5D-P>UnpdTtkM?& zGYKACR1;#WOtwgDeAzztoLWW_U-8Z;sh=2&g;w(*i0gS$(~NvlP;+9g8GH1ZVJ+4c zk6O7=A)QUPB4~Hz20r)KLB$sPSF*<>F+Nlh`w-e} z=Nu}4WYqKmrWUj7@hA7{i4vk(4kF1P1}qU)f_dEW58W~jVkIR8;bbQiOOMJ;O>7P8 z%^+mWjYJIwv+0U!ehHv{3FV`4Ggd~hKPIAQYlK}-y3%H8Hpyikntyp;K0K*&IaU_1t?MIBOBygIt0po1 zI@Ssn6`O4iS~L`~yN>q6f;QCx+O``Eh2x`7rYK%28_Qrn5r{5IPO-XkYXE_XL(Ab@ zp{|$JZRZsCL`Fg$q%y6QJ*l)gnWB|Ua}$iAr!O+f2&#(ufJ1K<(An<67k9(nb!^qq05L6Ws#EoBqzXol06(c0L=YNxbu5}S z_DNowS0fbv5GJE*v>M1DCZNM8uTd0f=!KX69ViVT!x+#V-YIZ&K?zO>9dEU%>%pfO zjp?iT4fchcmaw5w5fn7c#O4qi#`G|s#t|}Dp9dwCR0(+LRXv*&LZxtYy+K&p+Ah0B zvB+v3Ni?qHDy)JA6iJV|=OmN-<18=xH2pXr)GM9kfdLVWLxWfC{#m z=CxIr`3iiQ21a59wnOZ$X$2F1sny_%F#aMPD;A<4Hvi0~DNb%0a9+fOdqmgEb6-wM z2qXTx0>cps4~;NrH<~S=pCXmB+P`xb1~YD$7Ficf3k|h4Dy#HJYH74qp{MTWXV-I3 zE2?h*+1v76oSQ6bpT0=4ydm*c@saMk`oLVNG)iF#-OKIn5cQkY zFS}Ll2*X~33f%I(BS*vf_RRvJL|YpF82WBmR&A>X3vNM0u^t+NBEHE!7C^5}9>mGb zLpoDwwrv!pOf$igpMPBP)9P4RnysKk;&mDNcr>EE_DSYoOa?X@?SOO}}nL=fzrQ-imxIJ{R?+?~Kl9Me}j=SbkkvZMgc z>n0;*B%9#&=Iax*iee!lbiL@gVOrnT@3LGM1d>6&W?riMWqn-<+0$h`ik6lelM6yY z>Lw+P3~h2QwGw2w))dtC#M7 z6(Sx+xMO`LO`L3=kX}$>oRre=n)K9>-=k`feAR$H@sSgba6Int^B+Q5RWd7jR3P_TlE zR%;v8XFKJ0kBz~mNgpuv1n)gGEy!5j&k*~bW1=J*2hULN+=k@%828ZsRzS|u8oGq^ zE7QwIw#zue*l|5<1COZ}x_oQYgs!d)B~+EgyIfw*cVFo2$l9~;bl!@TE@vlQ-DNW` zq*{F5aN-e#j~;h&S&he@lXxN5os9-VLhOC z3|Lh&F1762U+KhdeDIPdML(jDVV>nROOZ&g$r@K*;0z#bBi@Ht2kPEdsOOcnAT}$Y zhAVFY2RP!+IoD4*&MT3n>7mm;^kgoY8N`@>h-AGwS;y(cc>;6vUBKd;)|Ob;4U4ylL4w-7I4%-`ECs4=!@;!^vbxKpE zSgGe#Sixo4EHgG3H#^!I`mt=`Q?+7Q)wU?uqm^J9GVp^#cdb9+tzKn%hA~gopv~Mh z`mQgza77O;bcDkbMgA+0mo<22XM=VuL zJWo_WvP_UJ6UqlcQP$xV2mggT{3`)tw7ICiR;9~Ha_E38f0sR=nBQ|7oeDbRdVpF( zwT@LTG{o1%rqNB2BT-Y#F}uhJ*}^+OPuj6J}qkab~=t}RGP7Saa4lC+~b55 zTJ-8e&DX=7@zQ0LkaW4I+94+;fWO!6b-VZ+Y~<~pTSNY(R&QeudQ^S3@jeoB*8`7j zEq*rR@Sqi|Oq15Qcyg1#$J_BE`VggV6fF?GgGyf)TNm}V*Y|rv--wp=`Ja^W|ER$E z{{zg-OdM?gQyJH2PsB2J!2Sc6zkyyQsAx(1?+N>5{I|hA>;>WIwo;@|8Oplf$=QO&`BjP6^YBGGu%c z!N;V7!Q-@jvc~one~$`pI;LMfuBg3zhAun^W1NgX-7b0pOm9ZeunZP+UcHaqmO9|* zmr}WGa~_+YFQINiP=N7!*4++C)|hKwTv%VSPHie2RayeRQ2OzOLfRya(6#;maszZ}0sMl{qS&KjMO3{vMw~^8Mc3*A3m_J8&bq zME(IQdDY0uux$nABYPa)ecJffdv`H9<`H;=Okiv7Qq~VWDB2pRr)6h%p zqYs^?+G*p{m=rP<>$cg|8_L47Y*|$~=1_n$v|=33B2}B*AjQ9Ya<2PM)Z<9l&3{-a z{4*-;D8XPUMYOqJnj5~t`vqByiS}>pka9ag zj2VZS4zG^bAyUh3grF{mu?(ZNBCkS11{vAfalrN>HUim|qBa&m((~wzDkhFBOpqUr zd+(R($z?Q!MJGoLuK4;v$fFbqHBu686TkzmS(2e$Uf@C4*E~jkl9Olo?b7k?zH4jL zBE47c3{_&w*d!GuWbrpUceAG~aSaf;Zsqe&X&NlQTYgFs7lq{?L;PFSDa8p%laq3B z`ZG~4CFeG|Svf&&zgw9Mx;#jae3MkuC5(z*;Q^ugRrFcFY_eP=-W%8I-@ zP@HHdyelj(Dl&`F$PHDypd=7n&nB48|!ct_H@8rgv^GPwe8|59w;ypbKoFW4;xds>NGkS++4Cw|%3N7lk@ZdKjs z_$=5Uu0gz0nc09Xl|P&SM8Vu>#h~-$#hOS$GHDrGhk9BNPAU(31WHWEAR0^?rbFoq z@ESOwB+#czm`|EnLO`(}&QS1V&=`B4q*c-dRh2NJ%G|da|GJ7eBl` zTo`Hm-0rD=@2KKrp-0lqyMPX^uD!HL>m1};sWX~+CQn=LmkzJmPt@GT<)`5ATqpKE zq&0gHn0f9ojxRa#vPEyloc9q}2Gqo3yw06WNl!=I2+J zLcV@3r{?4fC>ua=@t>#iY;mzoZa+Fvq9)Xctkz43zKF)MraNBz4FhoOl+jtpTqFa{ z*^c6{c5R3{LlD3mq>~L>J81N(x6d^YC$z>#Kj@!^TOaZrlu7p)+K}<+dQTR_-JA@U z-)=snV+cu9JLxiXW@3!%=C=?2GpKllM55a>jy|CZTIMlWc)vO#k?<}mPzSLQP)s%Z zE(gq*K4xD2=;BHQlZ0d-W!+u6jAtMOhPY-%h;^bzFek{!q&QG41+w5G5GyC^ZdxXHoJu-jE~5IP*Dpw%S83ijtM+DzwVy_up(b`foG4YR*?-5>H*G`Jetr?!N7yD zQfCaHsE3~&+Jc!~8P^Vt^&~0uDU?nZ9c=A~peW2}tyY&?VFeN-KkYdX?m01o88;G} zQIE||M{lT{D3f!%fJB^(eQas=#cDLDuQB1dUi`rPk45H(v z<7AFiEo;#W2wGsoWj1iv?87FXw0je%1*Giq9e|DfI2I&Q!et+0(;nJYx!pM%U|+Fwr?jTr}}%ZXputS>HL(O)k6>kcx<@ z*ortAb`U5wZm?g(Ugl9k534N;h=YO9Ok1pK7(B8QenW%&aFWmtR`&Dnt|9RIzO#$2t#IoRspnf37x!+ymG6m zg7XH(SQEZU0LFjCLjj4>{msIrB5S=gEyae7b48VX>BA| zZ+RrQ%0=Uu)fFH}1k0XBhF#7u`vst}&BR0)D&2rql4N)QUA<-FS@uNK8)AyhM?2zQ z^RweXAHe*ZAUyDu3W}H;71pfPJ6M!ksvK^1^c?K$m9f=nEAzL!#wZ>)AE`Td9>uef zmmMuWk=TCt7gK-Z4`0=6%ohZop!v&kURqagMK`)R&7YAv{~?|{Ar>B)a#KPEu==!p zZ0(=j0HIXH;FN?>K44qT7>xsmURX9wXHaAw?{e43vr=9YmnWr;zT!}79!=Fx-gQ(s z1I+_9j0^{$Ug5dbMt^Z_mw}}&MFJ2^z$#ek%$0{_YlUUPwla<2%~XKLtdgUxl8EWE z?mFt^GCk+>^`>gO1A$GmHvM4f9`+zW>T5-@jTnG4A8$kt1)OuUIKyJQLC6-F3^%$7 zkegjjc(u}ig}tDpFBFg}EPnfE0}!4GWefgk<$aZngMq5UkQ~}i+$-qFbZl~T?)(Tz zbA}7j${gvN6E4N~owO#+D1puKMjVL-+V^~UAp1iPgbWH=oa*xn1d~|-^`6@RGPzFz zXei`n6m0--fw131`1~x7v?5<|s#S75QD{XF=oz-B%W3e5Z@~KOoe3HHKPAk;)E>7; zyk9a>q4y@+qD?jr z%foeq*r+QPqY@jzs8rI==`MuVTDH+xtd$j(Sz1x_ldGnKWD*r9cW_GerAAV+rgl3R z|GGt3J-ph@O@l=Pk8#aPx$sXzxtNbm+gX`cT>XwkEX%Zo>zvN|ml--oeY0x|r*Ou@ zPF(VR6Kqjmbe^i3P16*Ue4uX}-BgaCY#TQj`e-{vR$umoF(k&zQ(WiWT5`H?@?^iz z{)SEZ?W}(a0y0cLHQmQ3GdmIMO@X}MOe^1cF5#bDF!;20g^<~*S|V_?odytv)FOKp zKr~a0qwMA_fF-VAlb)wHQT>a-^L}d8-h$kTLGuo%+f2pnt%QFC9p+L0JTTM-c2zgj z1@&Pb;3*d!#N{AEx}==-nkK0k$&~fo-AU@OwX1AuyZKQ;f*)}-aBV+U{^=G^v3hKd zg`K9of0z0TMHmC8y|*&U4l{L*b6_nBxNhdeH?$C4p1v9|=NY&c(p(yP<`W|q2!{Og zH#1S@Q~*o6PlilTt}=1ZOTfDFAf!@tlC4tBwDj|_3Vn*caHr&3YS<0coV>~))h}3N+4`?uhe54j9Vp#D&>y=`IN}`Uc+JM(PnYPWvtYb&v zHfS?bZPUA`35J8NaNB9QlH=n_X%VlR#=dHvkjdJXrlo?I>2Uz!tOt{U#7b{$)B!aM z*;iY&3W=A!|5fXkE#*J@>?e*jmGOJ)jfu6;%PTXb=y6`zR$~yzs6pRhjM2b5jQ2`J3xr zT_KDMxR0I|$L8YsQ%I-)a{j{0Oq_HZ?$c^V68x(JOcLLWn)>L~74NTJi@x1g*0M3f zWiiXICY2BCUsJ2!&#%3|KvlgXM*nFzV*Bsb2Auzk-f8)V{!@4SzsmTVg)cysZislu z_#FZ_bQ8n0s>TT#vy{C!5+#%pCDkn-WE~b8^$WoS@ngagua6@ldZM2s^g6oT5$o`@ zleg#nx{Evgt~vhS_V3549*I9OM3Yl-H;;rjs?dH3msB~O-|l~pl+V9@%uGJFv*)Wi zHojGNizV``DdJTA_GWA!zZNu4+B+V(N4*>A?pxdS75BZ6&6r+m ze>Poo4I0kOpkUT7C7tR#vHw8MNVkDIZ#mzl^4TWzgcshIU7fDzm}ne<6%Z|z~Vo6fnS$}HpKM_jr^?h?REB|~SIj%6SPx+0@{iRyG z+oK=tsDj1v`~7^jOzf4=S5EaE(5^2R4SIF`%K&b>;AA~?Qg^T^9G}NpU092(0{2qxw1W%y)W0mUjZX**YF26c}ra$6?@B(!+(r_2he;htrv22%1QV!bK5|7`mD-X@PT(zjE z&qBFnMd=(@Nye$cr(Fpa)jg9FqqxswV0M=qURl*L$IZ6^BBP$ym{1o6=A4eGKeFD7 zv_D}A1fXh#5X^zGIn<*Lt>IzFrvCPJfL%}{yE+m=-&E41W%gR$Q3OG;Erj#gDIJlI z)AC7N<@ctLHmxOBl4;`M;hm3uZ+E7hx2_NRvqe;;9=~vA;p(>?ZD44!BN@OAM>9N_ zE6_wCz7@pD7((FX$_9QRmOL9|-#|JZ@64_0(cf#Wcm$wfrjGOGo0P}RRKGQ`lDF^G zdyR#h%0+e)Hc7K-r(b0mA^2Vj#k~*OY^EeK)jH5Z<)XT|=5Uu(30Q}UvLgm*GqJA| z=~9edgN#AO+x%JrTeyh^;^4k4I^1C6v;>Zfd7HORf~pc!Hv(6DM)(RuCh)zuvquAa zk+9+7l-cSAxEie-IQR#(#aQg$`XRRV-IFClmeJ*?v1WIj;mKj!9{M&+KnvLS&v1pM zS5^Aa!h4WeZZIgIwtg|;5rWju^4qfb8{fJa9h6c{teOiw^@WhA3-Jan>Fq`m%HpWD zP=9DuQjsWLu#r>vVaFd7=&>4)Uzu48zeW`^yULHlXKT1=o)0)#Yr?@!P|l@>q{-x! z3p>eBfGI0Pj(l8Z(eyChY_AGr%uD^f6b)AnrIMvjSqr2TXW3BUrRr=8<@TGSPv<}T zap*F@#xvJg1JxX~4wvazWo1ECt}CixS!m32lTAWm+O0XoD0DmWwzgRPNVk(DHeGUw zW>ZP0=D5VxQ(g1K81Hs@lqy#T%QV~$upJyq{%LsVy>et=ujf>@w*UV6*(SO*6pzhd zGgfrlSqb=s!X7=nu64&6GKWAaDjBNwr@^7$) zyd|uddW>wHZFa(s;1=J3RDPnA!Ui(GLw&e=?Z^*kO+p)quCXDwnM&|q8w)fiioR2v2RG<`$AX;Nd{guoiHqrSpO9r)RU)!Z z@&VZXclf~+FmO_YWRmkN=XIgM9c1CT?@>twAGwL~(rYm?&-s=}ZCKzK0j65YS)6QKbyYp-5eg%iR`4jkR;iR_ zcwJ<=>)|D0pnA8(SS(;Lvk9F-q%gJ}9-FJz;uMtUicD45!a&ok+2`vXjPjfGgeG8nZmc4V39;GXQ)HONdaOpKKyuv^{yG?xp& zwnbXwLEDuXDjXTyhPTl7Wr2c~5OAlZWeYlREQW-rbJUuWF0jJwiRzJ}?IhOehD-t0c1w7$k`3Piu!{~>A-V@zfA<92HIZzf z(M}U*xJdH6CnzSzT}~g`QIX$%+!We>xcAfGY4P2P{#?AtdRj#FJ^U!AmklJ`ySL%o zh;eM>Nb>T#vQbIW{=C&-vAmMK( z-n)Lco8f)-GS}u98DN|qg>%JN5uH@rcoBalUbq^1?iBzaW`coOT)i0aUy`9&Yvl2c zf+c#t-@)=lJxSC5A=Rr<93hmfshth=1Qg>%WxK=?XxBP9Pn03WI0i|>y#P>x3`@_5 zqEtIN)-iPfJ`19A@;+j4vJFQ|z;XNLW-r`Wpwc50K-R(=_;hk>77l60T2M-YHGbPH_Wv28()11iX#fM4SS%r4&cU zsu!Jtpj^=Yk^+b876;SjvasilE z-s;+Y^523zLex185#kByJ~AZmTD)bU+j+Wqw~?M3st#Ss1$=ULl2C|h3*>qE#G_oe zo!KH|*xLFF^W;I;dyG~+4ca&nIx2N(t~&eoa@}y|PnQ1Pe#v_3&Zdw5pmW7S^a0iI z+DKLA&(R7I$7vSzp08Y;%Y40VW%~={-{(}twBy@u`z|)&4?BAqwSSy{;j=k|la!0+ zHsKtl8n=(4xf=szdk&iV5%5(%oiCG{rl8Lqe8d=44|KG1W6*sa70$7J|8ZRzAIFh` zMW~{QKCB>E*we7vso>g~&k||Z>q=5&DOjZ!A{`MKXe+9f>xq+^Lhjx>;AlX{6y#Aq zns_v@NQjsd9@K`fWU}}9j%*rf_B&-V;1fADQJ?5eso%?~1+>M#Ah`Ux2UOobJGeXZmDu-_%{~+0GdN^sW(7X&e`jg~=PTe&i->zJhsqlj_hvG6mIDz?tN(Q=<03g zOTVv7-?t?RC5<33yZ7xvdNT^mH}R4vC$snNw-c(THY(x4$4!WT+Gt6q*hIBt@43@9-q3zw1W>M!!C(T#y;Y>Rt7cJ4$E}R~lpIT>?hHS|{ z>9+Zd*k@54Be%?!!FJ73%eyV(RVH$jj3am9M$28k1S{> z21yv(+bRBqBDV8XWb=7t@YFW!$w|V;=e3`8d7a9PLU1ztv3)2`Dd!-l z5&7{JJ)rjPC~UaTKq00M3%8!9S)q~?Fiqb$QVp>= zdVYd*Yc=95m9mpf7LAnFS$K1?8A+faTd#Jmq!Pp_-j~FpJMd2&P1Gl&0}iuefsc`3 z?Gj{|wCc&zkZ&6Q!pb$N7R^MtEk_;~fp-NKqFFZa+G5^&+^=b5k@lGj3KPn#V!&HL zc7RVfA!C>|+09>9;*bS`5ci>Im>X2eC|3yb#D5x6g#80J@&4H#l73|&Y$NV`nsjg> zTnv~-5zuDw9`G|xQ$i=zg#_q*cS>>g&Sd4Qto!F!Q1`0@Mw)>pquPe$LXD+df)?(|vG7=#^l^9xtDrg2b`?+TLJQO~E3_4#37du}0`g^0&=ULsDv*jyYO zrADbtgoqpb{dq~|2JF>J__6V-+u`wOkxny$#uc=cW&M6XTiI+0{9A|#BFe|>W{sI} zM42Tsh1^cnAr*)t>$<9mVJ>@w4-Gz-cZ(5AC%P|D$2$!(;EwtaW^WA^XH~j{xfnUK ziDPeR<%a<5;@yVEzW3E`=;Kd0`;jP81aqisP9A!j>`*Gb)WUPQ(YZv$*eK`1bpyGJlNo**$COws)>T$xY7Zw!Q`VmUE4)9)&?lfEi^sF|)q4vpKNp zM(;$C!3YzC4-{U<_c*6kMH0#jG%5eXMD$iY=E)H0?O@P3X*^Ue5+ojR)Iy91s9b5| zNBNKp3^^xRnka2x8`XrDHlv8(%fMpMVK6P;l)K&^dz!jwu?`GHRvpMxTkE4qw71kT zSvIQlUXabY@&M5iPO%SfE)3p8FdE~l2GN=Ct7-30lbu(E-}6 zlg<%FVl<>Nk*u%61k|^b3ZCxRbPeyFB);gNIB2ai7gl(0hO=s z8KeJFp216DRXR(SCabPQ(WvtN;;@<@p>`p=N?|5I^&nDFbL!u3nq&|Woe;^vYG1&0 z+Zoe1>=XiqKhFqlVWjZPcS27pwjC54_gV@!!6%&6pJb<`(PE}~AAkB2S|;CP|A%R; z%tr1sUa1^|v_{-fe8h${Npiv*0tPQIe0pi1Ew=)NvqJH#s{GK$@~Fs_V7=Io_?EU# z2J(Too?#x2Tj2y^UX*FS*K-jfUZ2u6G7b?E2+@xdlLy8spLRmeT`OgP0qi7m$V!oD z8cSTRA&t76G{iHJ?>gBJNj*i+)+~pYjyTeDqpgNf90AEsaaHp)K4_L0Yi9Sa%b<~t zE~kTbCk6%VoT{!l+}Cq!^;o*eT_9{M zih`~RefbqlK@oI0mPlQ#fGl(M^s!AhaUiU>H9NnmO_V9wf4Kd0)4&ifdVZr-=F&>@ zivN`Jl*^t_CYM${!BH?Lzc7*F3kMrDT>0l%!-W5$X3ps|JY==hV+tnwvyDla0BdV) zUHdxQ6X##=^28L2Yf1&eBp@sXcHRP+)7ft(ys`UXb?D!O}hMP$Uoyj8n z9a5lWTe23O8<&xG<{g*uR@-?`DsD)T7ye|04($dU*`owx(|a#(`J>TN^IYc(nt%f0 zTr3pSTXKB-!0`=;m#OoV3s40jubd3)CG{T0U##$*!D<8lCzV#sLSbhq?TXVJ(=*X4AgD+&Ss(6J?$D*zo@AKv&J zovKOJ2Y`>KOC4_qXD*XUA>xxkAx+IPKmCk3`cQe9FZl|4YFMmW{f%RIyQ(FIoU_YL zSI1U|CtcoxI}`mb;?eL5vJ5oM6#E%iT}r_2XyXls6EtW0JAwCJCc}lLpoFIK z8RT4^`wG~$ijaok2>hznyKbN5ME6vjf6x9@+^We!=uUMC%d&7pi{)bJ*Vx`Np#dQX zcNQ@StR?(DRwpiE(vqzW%lHoElI1y87A-$QXxMcYFD}b4H>QqM3{QkG8o$*sg4~Mr z3fp)Q>$Js5EApeqA1wDV^163Y`1z#en{$sVv5>Bq;sIswaYt{-!XAA^6<_u?2sj5- z0pg|-NA%z~mTZ<|xNIISwWb4}yRy)$jt^5b4R8PNvp~;B!;9XvsN5~hBO$5A^mGZ} zE~gob2z$Qr4N_jEd)`=%{h4)Iv6I}P&<0XTu5ai=$8ONm>^C{BYW#2}6^$wk7H+Zi;dVpCxcyTacZU86h4hRG+=aZox_3E9?HgIoX15sKn4%e|3!*(G5<$W zoP*_mgnEj#C;nWtB5j?}Jc3s3WfB`&A{mkkx`%A)#fOsVteK)WjNc$=sgXvbnt8m4 z6%wr-7mj*os~kR_kW&00YYvwV_0rQAuL1@c{vmyT`*{ER8hM;>a8ERbCmuZ;Ve*sY zvDu^eYks!)cyM=dx-1VqQ!@ZNe+>YhBv&&-bA<`R5o#r)Ygaof~g=js@Dr0Gy6O?k2S+_`I$ zI{iuW$nYJVt0eZ05z$e% zUq8wZxTow7deF@u?!NJNQWz1imQeQRE1$a_SJa=3o-T#iD;zC+ydg9B$^GT&ZaKBqHI!4mN~%>tZR>kSP=- zrQ_`S&%_x$;bg~Vp7-3&F{=R4*Hi?^H%`F}V(ZDN@i5!rKhJ}e1ncB7-8U5z)RgvE zk|07=1#YD+r@Qx_!*t$xT?7z*8|O^?QgCA7GD{4${8zQj4%=olQhD3QUiGH_-_oiMFUOUw^D z9|d%_dGpAvpkIv|I=Ppf_GQY=zf4^TK>tKR8O3Oo>hAMYOK2y_`laY%nmC&FeJvFLpj1hYQG88W5HhqRc#!w}T#~ zz&N59Ns9K#a~xO=2N0V?WsHeWR>ONjJrww7CaE+VB?duul1Ca@-v$tE(&?`EvwU*` ziAh&((9JLof5?7XaJZgFS`ExohFA#nx{voh?3?pt?o4!!Ce|B#wj7{GBg?e0=?2+%9I~ zuP-3%UPxMqB6lhyARQlxr-EO|F8@g|mp zzD5hr0ga7?>NiD0CwZXnPkYde-FF3^siq!hhb~cu_}6#g*AQ(vh1*&?O>K}5L{`+M z30NWb6px$s9e3v#FflH*q8?3MCjp6$-b6`O9wWg(Q)i5iGG6ZBpc4x+eI%iSErErX zF_l#Q$T!BP@c5cvtUj$l9>(~n7Fg2TP+^|BkIfcdZ#F`R?@FL10kl7b39omNn)X^j z)}`4xL&kd8Jl_?kpxGZ1{*eZRo^^m+71a+Z|_n?Hh9zHW7MlqyUbiAa?vOny#h%$hp zE%WeZhA^l}%-d&%rgdxkCvj#Vpr)z5rI2+;$F3t*NwhsihGD%z!+}UQr zDxNH{YGb%)k*cvT(LaH`7TD(B%(q>?3ku4z7dWj8ndUW^NG5O)nUc_G(xR`@MhTu( zj8oxku=Xyll3kVlyz0c{>aZGlko>BvT<_({hiG7+>jtt-5Jd~*-NzU50j|WH z9YI$|z*_<97J_X4;N3@eY+S`4m&_wOPW6MBz4t0B2+1V*HM-|y;CDlJ*lmdBujQ$2 zG<^X6TCyJe&|R|nc@{&jDOVyA#bsZ-J0CHxe%+hSt@MXAzhh}pY5$>1bgM*GbYF|T z#e9;7V;n1IQYno8y%yk)$Bbd~c8ZBolYSRHf96PUR=cmkF^nK`w{})W)BPperGTOk zD%8JB4xv*KMOtoCFOcjRn2xoBK@8J9rN?leW&UgeWu0qCn0u5JwDfn;Zqn_qPg!TN z7?True3I;<@QG$zW`1$rl`Jt!73N(misjrIIv|o>z-&bSpNTp3K+cxNz zu6R=s?a+Aklv5tvp-PWfr1PKu3^goOpuLKi8r;7Kg#FW7Bw9k&nuv+?aUxIv@ z=4A;hFDdm|LR-QahQ2f12nf-bfqdwBiYXO4f@Tk1v(_k8(shpzSQPRqqcYCpk)}$q z5Ql6YV%xH#oO3$Oh|#<~eWF$8<|}VV+*hUy{CWb$sA!UCl%gTxe{4-ob{Rn$ZmUqz zBe+nPY!+E1rzZ8{%5ur6mfe?r@x~U>&7P^l#|vxlmr=Z?(br;94gkO z`gk^aFB$tyeSR#1Sd)nm}I75OE=)ksY8HsA?TxnyM{og)RUqx%8^W99gh@r$-D;i%}i@# zekPnexnRtuFWFesLS)fKi%e4-MJ^x0)SOJK<0t`Q`haF`CVkVs&{A}N==uRut5!(| z0pEYN6NDHqar(7R6oZ#$ZPch4EhOBy;d&9?7|z!$XyNbDS=oc6l(3ARLa3i!&{wX> zGV^u?u;opsLQQp@F;-Z`V=o@iz%IpJ&xa5^1EoRwsK)w81F&1wSUE?v4I%3ejC8WV z*WoXEJbwi3(O>HGXjMq==hI&8g>QY9XLPA$+Bs!D2 zg%R8r^t5vPC~S5lqsY5n*(R)#zB|1@ex#)ImB^;b5Gt0MZjw3({S>4YmffS(KSU1- zxRrxVtdv=Xwv9k68|kLptT<@IKA}aAoyjIuGq@>+S&~(LJpIeKmUr3;K01}rfkt~T z>>xBU2wbinW3P@3!8FpV1m4;Em=NG$SC6OmX14+cAr1XR9EUFfJ-u){n~?maVkTFY zof-U{sSn1aab>0bk8i|x;Tp#1i92NU23_6qS-Jm}WuKa$V*B4@FWY}2ds&z`IRC#{ z_Wy>he1a@Hrv2yQT+=;1r_;n>_K@p9^u@M)TV0!C)e8g!dFdN<=8 zc21us7aoKGC&Q0-XC3)wTT8%jtY=EwZHEre!2?F?c%@bB3Nji9ji6Lv{$a;m>WMKv zx_9l^nhuBmnw5Mk<~ga|gjoQJJB=fLIKn6y4(-bk9~} z8V9pWB+N6Jz4GQgmy_Gkh{?5qIg?T($h5-xUPqZ#Q-UVwzN_yuGi;tPL3P9x?;2DR z-h695vM&HfxR-Yvv#N@S#ROL0NmDSxVwboIxIK|QLBxpix7teA#juskg=~Yg8%k31 zK%|&MV{mFsSpeqTB{mhnnmzI(>HWgWAg4*kit4-3x+`9TCv0NIGc1GBy1t#hxDRqJ zNs~%tW#pjVT0%}gg=z{#)I?WN`h72>1SE9a3@K=(>T!dJ;ldSl=eOw8jh-!83F75Wo%W2iJ()EBo_yqF>{NGM_`>=Qb_DDXowTpPq`; za!C|TjOZx6`1Nw@-BUc1%#Uz{PrsIp`S7!jl2F9n@hHVSjWUmZbGF(a%#N@|W(WRal|0}_TXS0671UG_&RJTVfC5>u*0*Polsu-{@3a##2ZvJurS6~fcVhVdRzb+wp?_MorwcFmO}4bf-Mhk{ zMU%}2D~;iQ37VPJj@jzCcL^!d*=!BFCHr9TkKZk~L|qRbrfR9MZCzTuXN0@;BMgl; zo?_E%nNs5xdbNZEAMQq$8ntUyf3WN-y2rQH$vh=bpJ;xXo;erbSv6jejjjtR&@&m< zpJD#ue!TefE?5?U&Ckr(a#v;2==xH3b}d`zlfr(}Hd-jVe5#os65Zzpis(;cEWD+; z|6TmKe9=DgVTD_n!*A@*-6KK=4z8X~IvoG}i z(Q+x!^HuHx`g8=<*zXS`=kAwE+mJIH)$C&Pmgdz1J?B1V;oj`Sg#<3Wp-#L`Jtd*t z)wjCz#86yS<8wXdY+gM*&PIm}Y<--PM=8XW;b~gjh}#1ZaP-b(vs2;~VaLiQF;x7O zS;4`mojX^qO;-QJ$IHw6-aZch%{wWP3kJ1do6b3TR)|{a!ZL{rQ%U+xS|2xl5Y%`> zH?)GqX)lFskhT!MS|g;ah-X2CP`8{OJTB&koV-W9pg3?UnAT-RVHnVYn|2%yQ2C?U za}-<-d+bZo?!beo$=_^4uji$h_$3~Uym7>^JFRuEj~}miQ+Z7Rpgkf(Hy>zvGcV5U z{4p~mJOrykVWr)}k@iF|ECZ28L0q#YB1{)H+Pi-=j*Ooik3w%I+Z z)I{*)kFw3WrbzQ+k^LMFC>%>erAPe1x~@;qcwkM;c-;>?**Ctl^3#wc!-2S)jYB3E zn+gLahU+hR^MpQ{|eS|crvP0*?%wb6gc=7lv?<;7j5SV5@qN(;7Z+qGbMi7$PK z=;lnt1TToE-q|Z@Ua%?`{`s!0Sk!h0U0~GydquC*v4bcrW$5*0c@VoMrEt%8HvC8j zYdH+uz#9ID329fXM{uUy3A@Klio0gf;1%-ntvCRgbB{A+%qbdKFCEn)D8Vc^xG8OW*@FQP7eZhzlp@$GZ^xdwkY60i2a zcx^}(=1oVHE2|D|<(oa9UdE-PHx0;1F6NkDl3`Sv)oW>C?{i%=NK?T2Fi)l7^i9PO z=t+6a$r4naQA=eR(K2nyDczaX%wlLnW#D48;9Ulx(mYthipbeWG{$6V@EO60*9T!x zJDgZ@_39kZ$>a_IN=u+n8D`DVau}5ED|VB9vd$|`qKsL3kPf=OYvuj!)}-DIs4vUn zw%e<+FgeA@Ppl1ERV5GFl96-eZaag_)rMprv-BzRgbkOno?%w5C2!G=_um1^yLLkh z=mr3(ktW%4Ee($`4xmjnTEf^+!GuccZV28oY!?--G1OLi@T4P&$CR+5lH)t0L>*#D z#A_ylY`!8~0FgQiQh=oUKb3rqvke zu~~AxIT$bWqcO4OT|Cx=tV*@ZS@v}Ws%ujk8GV7q$(VKs* z5`vwB8sU(gS_O5pFN=(KA9@V|NSe`nH4cN}1Wy{unZTr@_63n5t+4YZ9Pt%8AQ(=W zm4y7FoWyW3IQrMxOtLL*SiRLOfeY<|94Lrp-?|nGENob^gj;_1Fq<1C7}8+^AFXTfdGC#+JqznKn&ujt?&Fs6cjm(bz;7>qOp? z@ho;P3TH5tOMqP)c5jn3E0ck6K+&-kDBux%yo3K1q;YbWwtGP)0W<<^IUsE55Ej0M zgD+v-9)W_VUA^f~b=gk2On5;tO5o?3_D5h;T|{IHQlMy#T@rtZu(n3vvTKt}>{Fy2 z7tqkmU$yYb1gIdmAXqNr>nvA=7i7U!-aiU;aUWAno^G06bg{uf>W4X7#Q_4pCYuH@ zG{#`(G4A@iaGRj?{s3-HEm~L8H%s}(GHtRD`J ziqRbdL@bme1NA&r1bc}ymA?CrpGumW;>bEg1n;Kf@eJcM)B3tEwp~yKHrCD=M%HQq zSS@cQO?l>8ZkXOOkzCEpN2z)1POzu+fzmhMaav0Z!SP`Ke$@O8NC9J`r2FQn*j)dHsQUMR^W_DK+IIi{ zgN23hKf=CBS!T^;T}h$^Cf z-~hZ^@`${zQX0oa*z&RbU(U)D8Q*_ZW=nUIBF7i?ObC}x%e@`kca{7UZ~L(<=ew@B(s&+1e-4)4 z3+O5(M?ZVO14^u4XB~cU0?ge9!7E}1KGPcQCD*XuuXiU&Y#F|Nru)c8n_|T^;!W<# zZrKkfVJlL7n*#qh4^_JUIU|#cdAxfZs30PA1hE+j99$?QY{^`K^6GNJnXmNACLKA}HX(??5TjND>x3S;-2!B}fV$U+pnny~su9QIL729!|Z&F=PCk zTv=`Q+=Z=zNudh0Z*W+pGy%i0*e3vQZcWpuvkGO&&#PKPyv$PJF*}J{WQK+h0Iy+mZf!dxe-l$Xw^{R~ueBVK?575TF z4}zvmN6GC;9YLsC;;&eKg@L}JasoIRirE~&wdD?}8!5`EKwd;D9919b3dNdU3`ZtjXJ9=N{4jgtJfj}5Xm0>mHiquVM!hu` z0&1dR(ox1J(32L!X}t;`XBkK zKO%tCEoOoo9*isMlU**6NuG5k_%|5*inG0)e6Am8#lVA&wX&ENBUGpcU>)Z{FctM_ zqX{?9FCDZpZ+>J(qOJi%`Z~#w_4dnFefA%M<`iB35N>E4)Jhr?yOS)f5Pb7AH( zVVcEw-F!rUyJTANt(*`ijRea`RoA0|NXPWA{4|Ws<=M(xqpuAO6)ms+cR1EY_;(>z z2(ONRz=_QEEL5&g3gVqQN^Mb?lS6FaOEP>UW`=y)<50gEYMa7*9ZktEAXaA1W^XW# zYrMvx^FIJ%?}ZpQHk&1CW?RYZByky6Xc~xjWe9zlZ589NuAC?J7W{e8>~OZ4sVu0r zP?oLH5s=&M`})P?^gTjyURUt0AVL>RK1w#H_+t&u5(z{Wj9h4v|x6v`=uGKqF z`RN+L$(@cA;?ss;KfXm)+1jQ-fvoM7cHm7n+unb%!cEBU!-z&lK?tqS=-F_dGJvxrS^^_>g$oAHGXsn&_cIm>v z%VOjV3Lu8!oCk^pi4!2jxJ2AF3gfd=jh{%j4_XW2J`dvrXpYyr85ni0uzy~%;vOIB z5W`C`y~~qc@jDI}Rmu?qU~w!rk`jTaYK7RLMoe5Na#Wcbes^3-U;F8aPcX9tebPwX z^cL!1D#DO9e-Fo@EU3@(Q5OuO2o^bp4if;Ti+ z=aY14o%7Z-Ayng47j|TXF<$>tDKw^K#%$&yngzQ--)a?t@18l=kI`86DBdpUSr_la3n$&bX&TPn3u8&4@8bl;i=69D_!Q_fyK zSgkRkyPtHMp$LTlHOo0Wsy7x>XLN{3xO$tI=@kgD4L?^+7EBTzO~ClnQrRT2?P;++ z1m~k#(J-2t*|1F9^(NcZB*WBe2viF@p;~5#@;pBE;Ztv>bMni z2XaZ(FWj0{4my_C$aPOY)npm?>0K}UBCX~sG@k%tK3SUJyG2(t*uz<&F|SR-tH$x= z*+uvZ&G%e}^|b91-}Jx9wCsMf3r%kFCkcPJ%SwTED98SV*flMoJT z&6$6D?fu?CH`UyO4bB6v^ERmCaW=aWVk)h1<+Pn4aBXl4u2(Sb9Yn5|uIkkq*4_G2 z=4LB?cBI?W5wVYp|E#2G!GjKDxvr4)$Ax2QDehjtDm;^7@1e= zrzGe<_Ta6a5!(-(&bcMfQp5qKdze$OC9DPsSkbxlpfJ=y+0~{myhrI;2B+LFt82-Y zsoR0{a(AG4~sJAaO3q0~S??G;4IrrvO@@ZJRRFYoHez}FUCF{$YHre9Zm(qbj&ncc?je{5;MD!05L zXy;ugE#zls+3i62Vnns(la#^q@0aK3HR|GMpL+zwEQ%0Jdum(a&IOn+`hM+7eNV*IUIW~uJ#vJmTf8?WSkzn9VqT+{Ea#h z{#Cm4L-=q*6pA)R)mIOl%bIs={tF*F$t#YJ`etwA^ZtA|^!}Q-`3G8gJpnIj zl>FI(HQs_axg8P07ky8HsDa-eGKmP^xH%izS$N8w`eN7#7xh z>?bJVmM(?g`Jw&)?$(_aFZnqCtv|VTEa8<(yp^V?|M#;KzJ-Eh!l@BzLm7`>$#3IyiY7G_FalWg%?U2GRc+YGdt)z-uLB>PJ zk)e$8^Q_&CO##Bf};J~iSr!uaxWl7;UDEsQ5a#kt?<8!!Y{Wo0}c+3JVb6WOoa0>9PO7MQLYg& zhP_)1Rdh-ltkx$rN7pb*%ut8K^OhRBS^$Yb`mEE)>_8gi+9ep0`*a>eA2iTFR!wMf zS{nIkT$onL3{A5U#Po@)%ZLlK04QT6aZ>)Ju3$n28b9{82SBba(g*jgHkq4~9Do_j z358Ov3zOI%S`{eJ8LU23D5`{fHltB1P;|ePhZ-j#E|N2r+V*LQMR_B|eNeB|$9No0~Dsk9j!nK+eSC+~z}{fhZtB9dZQ%&cTUn`ta-i=^Vie8g?MlKEkk zG_bCb*1_g1&FcP0MQjL{P30K|00K!|lmlvMXgO*oYv8qhs+$e*Umy7qmb3m2iUG*2 zqzB@Xnt`TWomI^tbYag%(oBYWqEl~z*xc40nk!CTapkbpQ|TT($NupC!bY9JN| z+SzU?E8z^u#21Z0m^)1_R_z5;5Yc!^09Je`B?&$+$a;1-xlI0LKIYPEFKZL!jRv#P zyDFL}JJHr44XJ}nvGlp5p!>&egJ{7Z9xj^99^F~5*9KS$M_jb- z@TaJdHpI#peJr<-6qZYng#2vA$ls%1a1@30HmW(oV)O5_1>?vyzY8)lgf!km=c4yO zo_Z1YNe3oBEp?SxCfR!_;7r#`1|ZhOKVJVf_w93$A=Q+SVxEJs$jNXQ8`srbJtY2Z zbMAnO!b3)d3-kV~aKmGi{^}K+2xOY?;NF>W*%y0ut~N?7w`@;zd8*0iN}dLB5sc^= z1Qq7b)<@}LW2mr4vqq<4(^=u9aVVr+V}Eh^}ft z<^YY~+$H^-A*v_Kf90dM4jABK9p{u3o1L(p-{F zQaMZ{@TD3B_1dY5^GbSCMy{^em8xP+(Prs}5QdgMd~bg&=8kPXEk>2hG=h zl3G}#mvS4X@mx9@vD$vW6z`=S(0GU;TE1`5hvtjTWU4`Q zlbFBjd#!iboaB)mda`>KJ5H&Ws%%qyEmY?n`jSEYv82h6gF{UWhSsmMvs*8PS_&v_ zc5<_eETCwH#%7C!@YmsJ{}Y6g4B=e7lVNcc>aW1LCsxQ#I?#x{F-+IfRLZY<8qJ~i zsLF#3rbk243(I7LjsBijV?Y2?h_} zj6sK@BlLl1My;-;g@56a4@e=W@REe*MnhYLLB~*MsfgTeMwV=79{_s2hmiUN`qvp=lD6X(-p=t+KatYVd4L>k{FxX1(Ugr?PNRHN`4;Z*^ zI34)K4c;r5hp(ltwA~y$mufu1UF*UN8P)Kdz=iPq_*=#ev8}1e${XY8?zpF7>N_q8 zxUoyLFqe~Va=wES69%>;fsuhr^*xycs!DlJ(`|n$CU)VfD{GtEk9GU%7I*{7Gcv#R(MhchUYO- zV2Kqv%TE;Z_a9cC4XV|bw0Iq$axVp@*#h?VSrH5bNKfcbpW9_{rju5;4TN|l1YwhL1 zI5V9j$b6aRNO<-6a`u)#b*TexC`rXlKLclC@6WFMySVBol~(^MNt$h6Ue_g~|Lu7)sWjaImRa&xi$E zyZx23Dy>;~B9Xek;zXm$TLcGI@9l0|Ki1G(6~s4mLo7#Z(+>)DZ^Fh4RvaY!=!pK% z&E+`YgMbwZ$_X{`8%55K?OOnF_irQj9|A)E(cJ$g-v2Y)4;R<}5byubSl1^=6%iFZ zvEeHsAxrNj`G2ucQ|XQpxn$|RzKCpyDjHk2@K_h?N$H1-=?v8F?nj37W#1ao4(X|m zjmFbPZjOc+j^1Cc|E&8*o4{EcYSIy5U|4*N?}}p<7^#`{PYM}wr@BbCj4T} zbwBAAbDz!S+89teou6LLZIU*^arC~FaZYqf5GFtamY?IC={PQGW;vEuJiNbluiXeI z{9M|E->xh*10DoH-MpK*(%x-4ja^RJOM3r ze_#71xc#j24*~Q)=%VM)EqYNnE(KB6$}yG+t1Eo;J0uZvq0wx=R;D8x(F`DT`UolmAVfN~zTR{y5%ns`?j61IMPU&8N7wb8f6HIzVf-;op7)-Fe2y*6n)TCUj2Zky) zKE@eg{(Yj990zUP2+qQ3w&t%VR2mrt3vn&RALn}arHQ3bI+7|A9Rh>dVcDHV-6W0s z1+$5jzhlEaHjo8Vj(N{#h5@roIy$)<9(cR(r)jtPO9RBYzC z4L-711;5xfGI2B-s(U>ZI<#_$mvs2^1UpOK=(@DB`c@Ys2!JKl&);D`0(&!tnws%s z&RkVSkyOgpX;NX+lS5mV#OwTYqXXx^=X2T=sz3qk#`P--6`}l@;@$bM5c;K$W!<5}~DCC0jEz zp8TK9m?uA@96Fl5?j|@pFq>Q92HN?B-k9(X&E=EQMZ6q}mHoL_9dv1dzDu=LKfQo1 zV4hr>xcG+JQkw@J8DeM)GmCZo--i54`ez~u$sDZemD8KyZZQ>AJu^k$8Dv9A=O0wqof7A1oL@wuZEmCg}^RGCS?6=R|Q@4{h zbTXTKMaCMvxuJZtb}$0Nl#g3B`H&KU;e4N&8deRF8nT9@&QTsSqpa1&L}6d19}7On8)8*==ejd z@wJqooMBe6{S~jA!tn){99Jhj@&jH+meRU`0cmW-&#k<3q10G2%%mY1XV4K{7btN~ zVTcaV3=Hiv=? z+Y-Xupt}Gxy!cMFOJ+Aiv#&@-6%L)$eG%h6-DWynD8WHv@%Qn~x6upsfhP@0m=J7+HUcz5de76>YJ8Zdl0E zDcB?)nsx&;&FUf+E)EO#=5%*6lP54I0D{frSVs7HlNCZV!$4rB^lf1; zI8E{m62q2>(Bd9H4HGr?j}Da=39|IovLI<@og7oT)(4UEfS}p!b~WE|i`ANTlUmo@ z9>cV`z(Kuzf=G}=wsquh8+Ty%?-SP0iT^U!q9))kj_nxGqOwA+9+3h%w{hpxQ`9E2 zE}<9(qqotW1(j9!TPtn~bA#{~p6BoHSWRuvuBQ|OR8e_uQa>=xl!={(b+Za8H!W_b z^qkY^#r0~+B{6O&5;?HgjA_CsGb>sXndE3A41XsUzq%I+awwRAigzVVEJ~6Mr~1I^ zEq%Yn?9xjtM2}{v&gzxj*jA^QELHxLNj=-q3F*wxr0kJ_!vn$?)A3DxGLm$#Q)o{4;3_?AG#2OMX8Py&wtzg83?=z z<-C2kW`UxRJEWIn^bs1vm2S|PiQjQC0;ZW%`07+x&%_}u=o zdJ^iz`{i$2_Gl1s7FCKH(@+!A&ZqBgHR|=ruIp}OiWbATA$}^Bm8fGAFtOFkRv8He zo8MyVyRItFtPF6UMO08(`$_XBl+qaL*Cj1HF006garm!cR5HeGi4o< zk;o{&PWU)TOsBeprocU6E^vi2fB z4h^f&xtIZ|UoAQvs{u`=IPoezrrd^GxeWBiUE+Dx-%Tj(wy@bUXsKW^YNRs}-7dLW z>e{ugk;7?IaC=^91pMSBBH#lrmgp8yIi%0MyzACA#*H`i;pH}C5GPK$>fLG}ReIwi z7x|D@>IvJ!Po!f>OIqf$u42wPlDQsjvWHSY9j=7D;weIKlf}y~-|MH`bqTc`w!!fZ zN;eZ>#gP3=hnIZWk*jH|7mm$i3!zarlh`84OU{ zPXsff8xPiguRT$If?aE#qP-3H^tHp+R$j5mnl)4?5b8-9d&-~1m*CHhZ&BATI$k`#RDB(*8X`?1g(etC_ent9}o39 znKhada1L>GO!rnR9T^M7JW`KA)D6@mP7RVoh?IZ6_{QuKEJKuBL|--B_Ol3PRZ=BT z9gD0=+-VO_vihZ+32%8eb8yM$2fm$u?ulUfh~FWI;Die%?h<v@kli zZQHhO+qP}Hd$(=dwr$(CZF9G+vy;@VN^a#t{==$w&1Yf^%D_M=S-@l*q;Pk&+KEE8r4pNhTp(xo+Wb=S4po%Jv(_GDnlyk4n7aHB5HC@;27 z^2i6%J}nGjHA;aEuLCMiAzcCOpO(FASfh74o8w6+)N7|^wg#SfUaJ|Z9^sdS)S}f3 z1;8Y}Sg+>#pW(8Es;MO#V1f};?~?S*jLqC4gkWeSu0fBX`aAet4Gzlk=PwdCf_kKL z=Qxc(syp1{P+M-3e1+R&OR5;x!;rkGTsG zsyY(m?krbCgMXXGpOm)qJ`?Aq87x=HdC@z}QYzEHXXK#)wuaZz7rm5-U|do?^*S$xRB5&RE-*h4LZc*WGB>!RUGvB6F&9t=+<1E=#19 z%3RyU#a*`)E^%K=Vd~)x!zc9l7A?Xil;N;1O`X=^+W1+16S6U*Q_fDes*Z{tw?6;) zy(7~ttsebvh5!EzUBt%vKMqG)v^rv++7V~JQ9J`IA4?%vP%!FYIkeyAV8Cfz{sUdK z(EF2EP1Pu&=rav(JU`FKbNO|dU%K}{&_yrW-uH8FpU?LHs_2Wl-}?VT7x`W0a-k(Tp(zEZdphi*GTfckqtKHpH?^Zs~BvY?GN1 z3SYOW?vw;Lj$6kK)SJ)F9Tpb$_xrwX;+%r7uE<`|(KX>ft5}U9rA_?H)?U{%_w(PC zi)Z20?UHENhMXS??|W4ET%YV{M^p~$e_TtyK23pd#){|)r3Y9LjueV^&PK^ZLl+zd zO$Z?{QSwoV@rfLdXp=FK%4BDqWSCOV(|BW92>6S(=4K#8+Sk;za~@Yr%pN);oaQA1lWWqsMlbj1tWS< z5R0jpS|#R$m$SJkvgOB&D4KM&I&iYs?C+nuxn8>!%XlNErKcN`=sd)q12V(Ns;v3# zJtAm8yifk%_3wz|#0*8SBoK4@(finY)_#ad2#5>mW?ZVE7A%SEWn$MlAGTy#^1si? zO@L;Q)}-4MlE5(WQ!ijLj1mBezrhsm$i<&#=GSq5y!{cP<~q z>GJJzS&%Uif+jE`M4`)GGMGi!+ew~46}|^W)M2gzewA&P=oJq*otixUZgX)Et%Xb! zvOtZ~X1th+9I*hwoNj(nFMYw5hO^w5CLevw$e5p<1_y?*qn>Kj(X#*$t=rZzFj{@e z#e@TBNHJTJ!JtyA*Acy&S0frmAUzu}MWd$XyZW-@ z4R^K(%iMUQ%njfU`+7Nbk^n_XU=2GIxl~>$@vCH#=>slT=}oD?547411@g;7A+8w< z3_*`+cG7Ec`!qh43W5%6MHxvUFj#G*l~rzuPF?}&r+dFr-bQ4xo`%dJu553au{fvz zXa*m@UDj=!6tB0}Oo9Lj!pQ?)9{25Q4%m zw-heS&@TZ-Yzxcz>9Htx^>neYxr&RqA=9q*)flq?OYY!Xt)L#vhTNNmU~BODJijWiiZ>C6pR9HSjc@~(vcLP2E(Uc9GsIVO=%gSkm|r+6=v-(d`TPC z){0?B#=Mr4Xuz-s`5fL?+z4AsH6=@t*MRx+-9G}_Pn~RWagT<%i>_RerrrvDWfBwM zWH#FS`tPHU!#S5cTXC6aJ!=gCmP=XM&fcpYTNTjVWqrP5tSC@Gj% z^pChS2|cFeQTouJl9#|F%WU-01~v|_Y)oVxY>5i$^fyl>RWbB_)Vpj#l2N*8HE_G~I00KaL(I#h7&hnn%x34v8Sxl{ zkZ6sV6yCpeydCE1)6vNOrBL_nWkb5P38lG53IT5rXdyR^0XxZ~0p;*WwK8_tWqz^} z87E)POIAJ$Os{)(Cl1I{O)G~(SKUTJu@Y8>FWc@)l;Z!8^T3I3ZzYumeM zaZoeU3;$~VL^AqCnB8{@M`+(=k2CNv>QD2yAciiJ^2r;VM68P`W-KAXIl-LNsPU+L z&;?!8$tVtZJgb8F%v^_ic0*7@ORIRo zUW+Y!5?BB_SB6LwEty??-vW;1eqc8WwMfscu5hkYc&qQI)pBHQNCdqcMe8m;WvdZi z3C5aN7m$smEEtg~91eTT!N^n1=&OaV!u=aoPC_2~d32VqE6bYEokEWF)tq4uFHuodb7ht3VYn$HbRA-X4qPquG}PxGI(*ziMi}F zFgS*jcH~Y0_()u)hg6KM>b`@FxGajTADlYQ@9*NDXaiavm!e^wyLiA`F%HMCloK57 zHF_f)kj*lXq?*sdpcD*`=k0l*z{yv74BhK0kV`$Z`<~(iLcu8Z!2^Bu1bZBMb1=>( zY9yZEYxSM4xIPa9@SjJw2T#_o!Qm9+lT}i&v3FVCMf`+q>k3pUq`MsXO~i`M zq~X(Zv*kNc=)#X9(ug!H*MO=-7aT%*;dG;(|c*qhO1tkAr)rdX+|yXv}XsxWeK zx3ilXrhASEXKr=ofc3$-6&CB~6;ZticQtxGNnt23-JlK)AP)ub`Yi&WnIa{;C8mTq zg+U)maPJTD*%P7=g`WDq7@|j>0O4AWDEAon7?K)7VO$PWZRuUa=%r2+jbPvOW$&2Z zyH+n6H77X&z5#`}OZr3pwNnaNFVZ<`~#+|su(_CuTFWW`;cs)1Qfhaoaxlhku{D3Ct_t9P;D);l#vUICBx9Gn%bs>PD|lNt&EO`~7q0 zk>YVvhhOGgILBY688#yKOYQv76u$RgSRbsuU$_6j`WRPEiMSXOWieEa4b2eJ*t;LK zFsw=Uc6Gd~(p@mefExZKN+bvQ8tE&`xZhZ~e*4Dbr>&LPTWSit@4EQoJsa^yZEhEd zI+S}sL+r*D0tF1)&K_ zYI{mN-=BouK3cjzbn&#{I;WGloezKCU!da54|5~NFe|ZsX0s+Ir@k`o{l=G(5=iXS z*a#?z!a>ri0@#}HUWO1sbpAwBkp%OJCwhfNJlkZwQ^l>#pi z3{q@68HE#SP$t(Iqlyze;diQOKz68Vp@xZP0gAWVWbWK?HiO|z9^q=NHUi9wTj9b? zQILcyO_oEZT>vub_tSO!+gZ3BH!aSVXz~#9@M6>J2Bo@Ox7TS_YwE9YC3);YZi2m$;gAw5b^^U+AI%XVB4$6W4*xhtWilE)jq{Zk zn<&z#Qp1iwi)M=S*k@ctM8Z_3mboZp$74dE6eMxF9xWEaw;?7Y?5<;q!>)y?Qe0St zW5Iy&-MI08rsqJY-*?p3ty5}Wp<^!6&&b{8wmn;1hqG{r5-8K-xmtGHY{3b4l8M_5 z1aZ+w>)_f$x!ZUH*sq0AE&LbB7y^!RdGLl*Z)R+mBSIhHMB(1RL(DvO#ejkW0*;bQ28Rym8l_oiuYk2ZIyNP}F5&#LN_ zM}HT3!Fq~gJ0GeVQ;l~rw86SsA?Q}uBVFf~>m31kGfBt>rVoM4ezOOAU15~+zKo|0 z^V+S<&QD~N=RR~&zIo}XK&$IxC$XeWoAVO$7-~Ww zEBHv;`$93pE(%LlV?w-<^O&5k=o*xieXz{1%|U*4d=|KRpQlRLl~dS_MsqrDS|T{G zsQE{c2A@k27WJ-D)H-E}B7V5x@FEv!fS?W9tsNOq80qIdxF*3N1}Xjc&_D|YOk(B3 zOt+^^YkZg4e;TO0Pb)bV;Spvmb+!;!UlDit3u!}~M2gz7rADLh74}2omV-ZUu~!vL z8J;Yn8cvRt2h+6Z7#zf>JLpPrL8S4)T%!fMe}_kp^+@&|%s}8q=ZDmM=?h0Wns5VW z$WFHQ7@FK%DUPx6#DZ^Ra~e~yl9&KSrjql0HCDvZ0%fJAvT$Z-LL{AYs7xNnWOy4h zo-h}y@T27>?#G)EdFIst7NqgxlsQ8LMC~MU{lO`e<14c{shOb=mcM@Q&!m;3N*cWSe4v?c1*dmnGNEiJOv)F~oAWQ1`9 z2>ghhF8#vA%`*+yt(FfAulHA*<&SGiK_@Iz7qsLNmMj)6=hb`LQFr!rNe3xXiBpSO z!kKXU1)mr)g=N;QcPa8}CAqz`mP^bpnP8B(0ZD;3R_rff+(Dzv!nKwvyKPl$A5$*+ zu${A!*?Z=63AG~jdaq*SnR(VBgZ&JEDz3{ni21&7e@Ep zl3**!jiQC}cQhrjo?9)) znhIB}DrSqVfI!NvuwQ_5nt~T3N!<|U;9&($hLWcn2uy8VYpQ+%CJhcK%s#Vd#`qqH z2{dhF(tP$??^i=P8Q#l%H9R1AQB=wH&WS3Z=CO{A)xH1*R|&Xrs35>;c#6vS5*i8y zD`}=#Ry8vXt7hegHI*zed@AW?S?5gT9Tt%r7r=~FZ0mwgaM6p!JV@)gSD_2Vlxh@OXg_r{J?W`H?AuXkxox7Ox#$kL$`DlavsZ-&}Z8D_| zUNp6V#?+H&%jjt7o{ST0kdaxn+co5ZTDwY6fuy#s77Z0m)7Rw z<5Gnzw=LQ`*$J?7uLEO?|vj1}$ zRSec9ipN-y*F?WBt~%Ym@o0H8txwITl8ad22VJ3wtxAF%-kp5xf^kb0Ap5 zYI7^&P^v=7z>Bm~V4G`jODzDchN5$6VM7Kou&GC@_{Wl<)wZnM3$LAejI{FK9YKK2 z{z^j2FNwvl|G)&qahs&Ox;Jiawa8`8DT(q~I=;c?TB4fYmsAMDHOewpApG? z-*7SYzZq?@UGH5Afml#SbSmuYoVA3EZ|jrJHa`*Ado=!}?sqb@JKIho4XM$zURTiR z>)5N|(NhWlconEU({Tgzxk}6i2}@t{`6vgZKRR^jKcbCFf@6E!oa;BbW*DjF@5%Qz zWljXF#KzF$8U66-U*&DKuDhRoxBfh8ClxU4efA` zU2e>pQrUt3&gk`ehasWq@lRFZdsA*Oa;KrXK&_*611kPb4QMPDa-Mo^xunr)IC(VRv8uS&93^-82REMFVC5 zc4R+qBk2xF{+2eS+kJebP$(6eaHcVj2*%=yqel|)C+2<0_sKgV-REU@XLdtBB9(6a zxgVgvf2Q;+QdT(Yetf((@2t(e!?Ok{r+{8M-rmC_Y!`W8$xH0Ru~Dy( zq0AM3nDq<2Q}1GKpNW}*t<NVqO;c9k1pySIdRl_!o)-TeZO3o zxGQHaDs)!=qK;1FYGm=lM|hrguN~6I&&j8A-ucHT%T@jQMW1Qj7tP`89@){h4SLMp zFYmX{$8*q5tkA!RL%~8p!ZMj)>UV{<-U)gi_B=HpCFxhmgK!4`<}4GjfZ&>kMXQL* z@RW*$Ww>FJ$b!%9&Sv#R>)WNS9mvb>KoCWH{Ijnnu-M;hdQ=oKaF+{1!Zx+YJBjP+ z&Qp)84JSGFG;ocfmU{ajaSmvC>W?>+GO&t8KGEm(Z?%O~<)@`cfTILIF-euy}HNg#iYok%;5eW1F#Y1`OFY|>$q3WbCW$+%NlVO8LYPg$o7FyhL0Jf6a6wO1IgtuFw@j&pi$ zK~Xbt+)5f5`tRJ73yz;4a;eZ~aOCdW<^`!4DX+nA+vk$4E(WdDphEknLGrqJX|1sH z6-xLro&mhxMc1my=$+J?n)y1Ij!jG%QfWE_@Md}OOa2t6d&J}pfa01lbi{MoY^Ig{l@z+7Aa-byy`A|lPC#^W%UF9X|U z6dO=N;2co$LFeo8)$PXs;{h&FYnV0WWh@B|8h(av-u6QN@T7F)Zfs)ZK!8p*6uXxk zZM3Ls)|v<(1qTLfTEim!#C=3%dQ>h!N59}%Fz-M0T$hrPqJq{~-c=1RyPeu7xadhv zc}!|Sz51t%qCY&f!dKWGERb;xR!%I-7vM6NaTCbwUt27FpD;ukj5kStumu;PY82bHqA($_C$y$HxNq7D*N zi!TnpZ)ciYhLy6;*@pPghBlPC15yvhT#(cLtB0csj+6;LL0&VB<_7-@#Bs8;Sh zooM`=zH#WO$U&g9lov0h7?v@XG~C@aDUzcz1`iwQEG*L4ngV@@^PK~3q!2* zAIT!W^ALlHKI-BbXTpV{GKBHH#ZO*YwrOhq{QPdw2Zj9#TFJ^O&FRtimaJx{!-~2e z87=P?BJLQ`cIY0dHeBhZdr=(cO zstT&Ni+cS)U6YVbXkwJMNJF}&*%p$9)C^|%M$=+!wdS8eeo(C9s3w28@62B2(QfKH zl2L35l%kT!Uy$|U3*2gWNdcDJ+a}jRr*6zQ9`hFV32}ve9ES}LYR1%A7FJzx#N=>A zvLgRWnWnKDYlJwZ-^M0A40l=Ly7?8W8eE>2Gzk3~IQTe9;!tuv5;*sWa)}|gi6M$x zVbq#7co?h&h+zo%^tpjEij(cuE-!hvtzw7t0vZ0nW4y83IWEI51TyHjp^FjjnsLfU zS1Uo#x#dCG$dW>cDGr?TU|K!{v?3CchCyD2Pp&F_UPa+kK=|Yl8$*(Kt<#kq?cT|I zmqf9l)G^j`goP4CDIZC#)t{q$pdGT zA#A<0!h`Wjp%PKW17M+5k$P&!jdom40kPQ!Yd#dcjOA7_fpj^cG%f5^@Br{A2kJBU z0>Y;?*6eOS&v~M(#BiHMn~LjFzwtEebMC`1oGYj3W^dGDtDtkJFxQT=l}Ftl6l++j zRVT)q%y@PbN%+`bY&G9-B60jYsS(ain`R?-me((5)h~n|{j@aa3)RF5g~avebVQr0 zSj{cMHuGtE){1c%Y_x0eym3aTk{&L6chWFnUzXP>7BE3WHth=?Fw@Lur>)!^K&Vwo z4*}BDpoENCRE1PSnqG?o13TXVEj;@$;hyS_N)k_)Tv>QFr#DqaFnEaa;9$OXl`nb9 z8=*FHnzEx)`C_e#e;5fa@)$>}OWurV0gOyZ+~|v?wbzB#hm&eD3n^2kF}j3%H+$vb znj;EYUQF#7;qOx{n0)74#$^MVRw%&ZNC_}j(P#V}%Vtah9(aLpsMnZ2gJ*#O;!|TD zIiLriIZnFSm@VndmY1NVbsC_evmAs9{V~m+ucH`vR3d{3AA{x6#wwrMY=46O;_Zn| zLY}PM^ZMT}jDi+}?7ikJWZq1MKhMw@DwS zi+T!PQg#nkpXOsI(*o(&%%rzkI>)dV{>jATfJi8L{i<_!e;C-!Xy6*Sk0EzN8HdBC zncjSb#kXjo0=jQ#nj3B38APoE#z4+9#@(?GtYp)Q!^bXtc{M_>KtfQGE1DwTt9ZX* zz9|e=n1i6!RX+}yfVLL_8*#(OQ$9`g7V3*F;?spIu;&&6b+YyakPs+oxc<9^9y)yL z7vHDLsU&ovx%BLzDS?sNTu~7He*f^I0c%l?#qcCwp}EbGxdE+W^Y7G(^(+Y-rn`ZQ zcG|r#;H~Qf+g6G5&TS+Jy{Yh>F-$+1zzB+T^%w&=u>l=Km|f6L0z(>mzHD;IU>mp0 zodN2C`SC%d#_EQgY93B0AHT`UK6!C&syN9pLa23i zeT6w}ga#@^2)Ntz1YBNBRfc!iEOsjm0Vj=D7wsL#_j0@WC%6ag&uAe=cYX=Z;=Cz7 z_K7-_uxB*E=>S>d_NhDl@-?qttns~)JbsRVV?>U=usP&~K@)g`EDuHD*H|$`h$rkno(Cf0)OLf)hII0=HtB+WPWI~pl?|@0h?0H($y;@lylaCG z`!`tH3jL=VpdtBv41KWpLWlc)UgQ6Ur@&AX{NE-L9RDZgDg*2PuTt-b1@8Dy>lfhj z10O&EFt8r*EL!fgeST_Zj(bqd*XOCCC|X=9i?K0*gw;JoW9@5X_7pz4ui-(Qes#OX z5&9W@+}==7U+7w2=qtaUuJ605K8H5X-J52gSPvcCX;R@|3wc=zl# z+-+~dL7u)}7X@bP++=-6y_4t3kD6zyzBEm60PLKM8T z)E*n|>d<;jv!M*Hs(arNebz*uP28PIXjV}>jB;?121VDVRKaT~1h$L)Wi{+n!Amgn!2En}DTQ*UeDh!q@)A@#>40v#Z zOYrr9=Pe^H?jL$Q{2oCAKL@I5!;Q{-ydrID%Rz13+!MmQN8H+VTItw1*sgTfD$BUg zP)t$tcql=RQl?E~htUI?S(teqqZBzRmSD*IB`YassiEM74b@KP=|-vGzkG#K7O#K6 z^DStvRxAL`z?gEfG!uzH;!Mm4(@_Ta+X&9{#b-`ORyg#*e5^U@nv0U%8yu)eGhB}d zAiMXvEtn>yn?GkMRkZ%3@_+!0M$*KX(I9e#>}L<}*-xzGB(LoNxphe;4wiWi`GgCOfMPDjOP*=|iG?e0*gmN~L*|F!73>y8b;@>1!s$NH1REN{jUjb1K+|&8UC0!0rBVlmrd>`f#$&o- zo4i*NgAQxswBCNM5Xi1!Q9;Qdnikh%(jabcqIVQU&lHa_PydW@TH8Q}tJWN6OJQh zx+b!Yd@31+!_akc`%_aqf|y6Oz>2D=SN`2_47P7zCm0eM4F}f|JWK}B^5iR&!hO^h z3MjRNN08xh7om#n#R*DHZ^(2o1t2Q#Aobc-b2;xzSLHSkst!CKj9W z8>1g2)6P;nhrz^u+ANn%Cd`=PC?X@00Z*WnQwvH6s0K6NDl1cQI=fBMXit__H3N@6 z5CkEHk$4R)0{hfv^OPjht{~vOzB$C226DZBvehuuNYVog7JDJJ*#Zx%NUv=-Z9hq1 z1dQzTa#vLwAos3`d zZLB^YtA&4ri{SYT1eYs0BT{h<l8^8d4t%=31bDDEq_PX5e#z+M; z&!CmT)Bm^y!kgRFTVrkb`qUGPcr++d#U;+@zAe7Y5ZCwsu9AVifP z8sJN8R$+U%M}|1&dM52i*ieGk()tCo z8w;Nf28|72K*w-xh-=R1N%Bl=`RzI!F&L{{vUSO4m3if3OWnrM39LWLqZaSZ2e{&H zVmvd)IaBvJed?h)?aG3vtMsXWb*E!TK4S)zyXm#&5GhqqOHK7ih^vB>a6VF9F1whck@ z^6;*_ua6;gCOv4pF4A#ZsK)Gq&5SFRo`&;_ggcJd&lU7Et4J_Tn(YIjFpxBr=g1jB z4L22T!$dOA4YmH}$P^n?sYS z^s#4}l=#tJBv+w7pC2{9EbEooRz@<_i8Htij!RoV?>C$c;{{_LC zV~AoqNND5lr;(K(-NCX}0c;`N2!feV!c4nBp{L{L%`-wKMW=n%wizs`S|3LI^@DVN z^nv(`8Uoeubo{Ry7PvT!h^3)q_7IbH0roQgX!O@byv3v=zrcfa4(skLp6!zmx%dfU zP+JLxklfci0*&PNOM8NU~zIkHzP2-L5^+Ln`6CNEHr+B^>YhnBLty4yuC_@UMO4NwY~DMw<@Qr;|=}y zT@ZBjg;b((+dHmcIYLU1Sq?qDt*zL~48vYsli?UucaC0x6*XbR(?IC7N3~S3zs^O5 z#f1DD0F2fKaDG=y^3P!K5^(j>HMa?7Ecn!k#Dx5xTW|Nj$~mV)NhL|p>?mu9OD`<= zi_m;Os}ATZ<zkTIyF11epjRSoc z-h))Oo|5sb&r7TH_MemKF1w`a!XcH*+!8MDi7VnARGZrC4@QRMHER~`f%75h@!NP% zN#BUO$LRQ6q4ylR(;r|7@_96BWlPj5o^xk+Id#x%2?ORIXz>u_)Oq&HP=OnLVP0fQ zC*m)T#iEC%@;QQY^rTptl9EiqID4(rNN(QXV52(28U$t@2TVu<5$&HR z65tYWjp_a;D5I6`k)-!b*@M?a2A6ET^%)2u(2X!wy;oTw^m%_Qq^J76kY-3@7&VMc zJBfQbyuJAFar?cBo1*Xgh*A?)QPlUfNvnDZQavb~$rpEezyDg3-T3rz<=Sae+*q06 z>!+RG4AyC zWLvJz!i^4~;w_nD<=?^^anWtd|jUC_BUoKD(%Yq8|?s(f)jXOV>(2?jz)b0tpN4l?0_hG-Du{r} zhNY+OS_e#COXUp~hD6Fo&$2yT0N>gg*|JgRtx8(;f)z6v_CZvgh+swO-J24DwbJi6 zg;wCOi5L6hSh0YmR@lWL?&x10NsNeOS$D=Zfl@K1juiJd*}jL-Widy}#6X0K-E{3H z!9J%Nq_S=uS(d*;xzR?IRCkXRUTx4y%=htG-ht}vzwr@NlMZ@;1ZuJ^-9)o#4jSUM z-w>4l>j-NGF;Ham)Y@G)=C7{aeE+iuAevGC>tEG;bA0qj!q9Oom!l>g4{=wtDjOPp4I};%{fZ5Yn;z$Ik3XqExW^p}+yQ2C1zkL_&KzGUCi`B)-QC zn%-_?xJO$um*;XTEnfwj*Zog#K#A-Oy8+Z({=h`+ijn`~*LBoTl@V!WLJ051owC~a z4XD7*I|ePJ8LCTm0H}capWq@$+n55gWW7dcRESb4Fs#6rB>~4fGaEs}zwihhH_Ur+ z3mYZ9l>>}kYekbJ?~*!Y3ekc&h#oNvI5+nGESRHk236 zo+j)2_2sTp1v%Ma8jY?N1#M!p#69*kBrt);4zr3&WP zq_KgA?cGLSQZETq7+P^(%e4g>JdL;GMM}O=-I>rK3SmsUZ;StIpf2SVz_ytB1Bn;y zapq;L!oGC!GEBBaqUEG{c|b$x*v7_?oVnbKQV~KPJ&crR~7lX?SFS~VPzTvHa`n4|TVL+t=J^8Wav3Z7$^Q;5 z){WbAEU1)os^2S}H@!>6=#MRl$%T1zA*sa^x! z?K=cYBb_DopNbE;-0+FPQud&$!*dvMGoTKmdTxC$k#_yGXbD`$F-!9OMVqmCdc;-$w_jcRk6!UoGLZycuUPDDeORdCssmN6$g zL_|FuBcM_ZH8~INi&w`$5EbnYpbe3mtOD!HD24>2S@B5jBX@@mOj<2Z3YTo##HbSs z?CRSlV=D&8JVNV$ShBBI0F}Gd8n;jaP<=O$dnM~~pzmp`2u68wz`d5oD`@k92bI9> zsxgI${XaSwP@i9eMBC&YD$Wv42y{9t#y=^RuQctkvo3lgY;%a2o)ru&TQ1eBT8Pyt zQc10FtX4-??2IvY8n%XIXc7g4mv)Ljnfc2a%uG8;J1R%!I`*0Q zFP-H>(v%25bKb9v9$C*cCTS;l@BlLx6v(DM2OFRGedcsaT1uUsGWwLVJS;R2y!1++ z>;@k^K;q0*$&J9p?sa6?+4;{fYH5RFx=9rxA;x3|8E}2_#$nryU}R^J4$;w)f|tj) z8FyC9HBsVHEy~2cn`(9sl~LiZD0D`}_S~hyQ-qUkqQz-iH*D?B+5XN%1#w|%!%Wu} zA#IdBa?J&K2ABFTdHQwhQv~;qhp2f_Nq5mqD|9WgErYRdzC0Fubg21a?TMRZ=WE$Zyu>a#wDW1~VN>eZ6T&IUA3Mrx zP?C2fEJEMg)M81qNPJjsV#yu_zA$f{au|jv{Q=5KZ09I&v~4zp26>H)={8-zeLNm5 z;5r6zD(c*m?MPA-Z!F=FPy@XTdkJqoqVykZ_&kDH7W>X%tzJCxvKF|Y-FBI?rXd|6 z5_gmG^KslS7AhF^amY2{8(tao#igg=igT=Q@9!fw7Akd{d?6VaBFY0qH8j@?KEY<1 z#kphjYU_=If^xv1wd7*Gadi=XaF9J(9YRGb!YP8{N6AO!zJ;ix2YZJRDf1MoKf-ko$ zjN!tb2|R#Wpvdlq^s;K`OU+HyorL?5*z;B|w6Rj50LjOLlhdW;@45h=l*_(h&6#cF z$R4ErjRPr0Jxj>osbn5TS)f|FvC4)NwgZo3FrC%g8`4F&3;a4%T$&q|S&WT?e0&(!W{51%-x@%!v1IiC+p+l!2(8kI$l5Eahw*@Z}f zac1NoU&^zFxknaf?7fZn(npYL5mXm)5lb%=G(NOxBssLsP(m|}G~WC1lYHLLMVzrh z*&eI&hFreorqH)b_R?54Tg*7VLXF#o!21s)j!r_j9yI@oV(-maH#mRgQ;7=Nz!vA2 zxrSSO%mTTPYsp2T;{hC1OFyRJEc9tZ5(8`%p@Rpxm=JJ^)&X_0rwB! zKHP(E^uV(UZq4+;xdwO~hJcdxQ%MmvOwMxvP5v2LerX@J1ZYrk;6=)}kOqJ3(tgo_ zz(=sMgIzZ+4mxi}l2e@~3P+~1NSeS%Bwc|WS%HjPkQwd_LYXgL*(XF!SF-J7jXZ

4Xvo)_Mu_h z@$XjB54KNDIRNwV+ApB~+kw*m7LNW;7$Rl{ z=KncT(VD7#{Lkg52O#pIE*gUILV+>?x1gV{!YGbb^Civc$~yfB^oYcp>|=2Udjs*+ z5F*M4;)BvtHwD}HQD#u-i}b~+xYa!pXR6M`zf%QQEn}Tj8u~x^i9Qk@|vGK(KuN+ zzvb%Ip<73FDC(zRBMP>sV4M}4lSB7#b2n;X)E4#7yn^5S+~+e8R?dl3!< z`1xTbFe78cD@U>>+tKZW(PjItzhD%?T)`NMVW`l{W2xO`Q6%gmNGg$H5wn@D4s_Yt zfroHyVy7x=xCPh@pTPw^iDVHw83?0(glwsMQbp()m_8cCW+qclleYgN-Ud@4125`z zHXUR-MbkJO+|JGAf@Wrk9Xp1iW;9_t*Q%bJt{e(kwKeVu5zNK2w(=JwF>OwMDk|RD zqd-dguabxs=6KXsHyxder2N!#q$5Sq^R$BNHkdY}^*-Brlqt3?XttHl!pEgf>%aI= zX0MtM-5!-8{V3c~R#rCi+i_EoqOIc5=VvO`URHPu22-Dv_RvL9(z!sfW|o2cTw7!@ ztR*h9-W8oq{Om3eSCoUZMQ;0`Mkd=W&1^4Im1|1iedAM>zr2_Y@J<*9><3UmuPGt@jvCpaGhltmv=9_L$)zk&WXi4Fbc)%C#>t$njf*tb zhd28h5yqzr*S6pq32he!E$60fZqmoW+LWk1hDu!H-rHde?fU!Bf9#3p5kuzM3S1v* z1@4q0gJ8!4xEGM;8~Dg|v~8jL80d{7Sgf2$N zFs%NehGi05lp``%k)UX}BDdn&B$qRV!epI~Yq&zxo-?OJDBRo2Lz zKW(u9M%3D{pwh)@Z%7CV5C{iq4U(RRL6UXmN#IXc3=g^ak`-a z4!6H`>qriz2XEeSFWfi{%&BzE9Hru#8_HQ7;P*bGLy$?rDlLPAGZ+(@dTzX=;)B-G z1q5eI5erB&?g4zYV|*K5*#loHEjsj}v7%raP^XvyU}Y>Fzl)c#5RD}xsPRvQ)B;98 zc`N{&9QiubH^vpF*F$ft@}xLafb@F5b%4L2#JSUKrPOzdfzTNw;g8=u|MiaxO*32m z?*i0#{qJ(Ah$S=Z1y9f26Co#U3vk(*@KvTvr!&?vMEPM|W~vv4JFX=414Tt@n?WU6 z?_v^-let4`4D#FMlGQ(eYw$>mS)8%`QB+@#IOGUp=oxkw1QQPBFQmn~q!9+)^DkvJz)&}VnPpGMxKQyj0GwVW!;74qu9 z35)fnYCxl(DOLZ(70F-|W7@<=sH+We6z>giXm&nMiUnz~H93c#sIBU2W(iZ_m$5>? z{f@9#CT({7qQ$uaF=H7cXpr)^mg;r5&4mTWM9?OJq`mlc(_DxRh{#cSXyh;ILLt!s zUWn3-{F&`;iLjfVus-HfT!?;fo$lSqz0Pu=IZy-2C>~sfL}VhLs5DUGvUl`&h$Sny zs#Ds-Reb=Pb|Hl=_rGy0#G@3(U~@SDSKVapbkMT2%cFp*Wc=453z3y^gFS%v#G;K{ zJ&;hJRRkcF!)#V8D2%vTe2zj)bEUlZ0<_QLYTbon`apC_GsE*tAPb zNk1Xbsd%op;&r&;iRt}VC#IO*v0+yzrb+5KuOr#gIiHfTkx4B2Gm6K5dhv@y~Fej;Byyd z$bTAWi@vL21NFo9L>RU@`#|qWkoO-33sJgwO;jZSsD{dU1PMM)yZl^;cw-SM4=P{IG7&?_ z)&yU+;f`-6bVNz&WC<)G7OIwa zyz^(l?iB;mgOgpCQla4KTj9F?;TuOUdnKVMJTjRY%kll_DKG{(OLpbb#a4l<-xYY1 z79uSyJNaf<->T44xIhQRx)2&kJYiFq*cPnce7SeiJ-D z)jjWW#qNCSZc9wW@qHRdct?l3c+aW$1EGS`>4hh^fP3hvvv&=aQ4DBB%?!kJ1WWG* zmq-+MR+4cRGgUWXpWyh{-Jt@&%DZ5o1|3sqs9IXLT^IZBdcsmoq|fDPJAH&+yxD$e>)O@6qaNQXBsG!6@b@|p4exB7o2_I znxBTUB9i>Clc9(9bqj-SC+uuHZx6LjzgdLc-Xm4@$i!axBjv;ifSY$y&js+ z-zvV|zOLzhfjPu>FaFbn@Za%@*f{?08Mx+T?EmMDyN*Z3Bh+_Cz{kMvl(?ZC8%Qj% zW{esq?Zr!c)=wzhxXy*7^*&C0Cr7<>xQI{Fqx&da;PZhzLG$kP^G$hczoWO!y}$e0 z^Y#7kh}D@B+%dvlG}p9K*el;;Y5$FN6052?yz0q`tOO$| zTPVql7JhMzi4EOCE-JgL6xM~k1SLT@AVIqRjN!HnZ>W=yPqb;AEFdw<%%EXY3GKlj z=NW@*^3_^Bwgjqrv*e}jGyyyXunO$2;cgY<7AANn6w-3Z9{fOwK~20(+XUz%byst< zgD_U^@muHNJ>DFzD%UJdx|B+^>uEVU^dbiK~# ziXsk{p15zJ{&bgKZdKuj#&?1=xg!8eHnUn}Or6IXM?MlqhVKWnn3i>BbKG{|0}Gk@ z3q*pQr0E<7lX{ka&=ibj*yRzobr>u~2VGooX!=QmRU+$=S!9jX#-JJFh)FM&-i|}% z*Ja{oNf`yr!{x9;ka6fF6AzEG+nNQW5XUHn^rk(_)fOhoO=QEyRZKv06vmA!O!h|m zOhJW#P*YVbGt7(J)+u8uP6r*<MVa<*&-`xc}ouNM=$sQWc{%pLqrgUaN{3wWG> zI4S76rFz-3%I7xMuwnl50Pml62Xvt5wIN%iw@!a*MUHi|QVuxgI2r=pX@A@s?0C`} zQ(4%(%aZg4D&1p!PQ7$c$8ZP<-w`&lW6d#7Thp<$FT*Y3kYkoV^} z+(Uep%}?)SoFhP^oIY0A$McO8$fiI#Gk*>J@JU3(tMEM_O;v$DNbwwqixfPD|70-6 z^~>=SCVxeVgM{%_uuuHB!D0i7%^H~SBwa_aSOmO#r>9 z#)9c4o`hh&rUXqU5ko}{MplXODT0wGxmlK04jUp#>(aoJjKY5$YRzcNWFLg^#xCy% z#3~=DYn$N1w-9jZ=dWEW4KIq`jotxH(hRTzMUL*>SR0P4qGYY(}TJ~bq?_9x!u zm;GxnOI*ZTNmojw>kXb8wpU@a>Y_s0s22PR=K*@#nf_y#g95|nk)B)X$Raoq4$1Rn zdTy2$2%_2p4#i}R*(!urCc{$jHT%# z%@Z}XRH-GV!*(-;Qa7*J-PSnJa%X08z~vokw6vH&E`x(1gSn5{fS=3)uh_B_C7k?8 z1=L&x&n|EX@S&=q-_A+voL-p7tVm$rcB>|Qa?FP{;(aD+1x~4Jk*PGT<3{4oW3qCX zl%m)|NJ*#K$P(YP-)&MHAZzpVLlfp?!T)-&1W~r-Fn)9rwRhT{05E?G+7AS(fI8O8 z3HLxJD|Auzb3bOjl&Bp{LS^++K;WHe#>t&C$p;GBwV=-<$wRNmZ$ln+L3<&}Rr64P zN}NW~C9V${;gl-ZHaA#I2rEa!FE)T$0Uak1B!PeO)cMssaTp6Y&p$zF9+y;$^DwDX zPM@DQ3P(*5!JI>*RF(V*PO>J>({hxjF{cVT(-+yf0L3IV-Z(!UZfRhMu@SE@RNuY< zehp!^VOb4vp;j8o>xE@@@T9Y3nKzHxBq%yIi^|Y@!;yq>^-vtbiKBm0iL)uX{0@!9 zFFM9jX#Y-WpB0`y64K}m&0j9B=KIk-l|*_q6Q~nso)^g2RI5%?e=}RYH-briUL@>j zVl~N&x82&r!J{%O#7#_WCEFzivcukR0QmWP`XI4iJff_x9b49eCN{z`B1B|j?NK|~O>w3j zP0KbBu}RG?i|a%g&xfYv?j=$>VRp&dJU{cQ2KU9bZfa*D_7RP)n%x?MYnba0py!2$ zF0h^R#Jq)(Yk;EqN?@PIoo)@xq6?A;-d8I3j&rbyKVM*d`sy;YZtK(mI-pOl;Onjs z=$k+$i1i~b;f0WyHjhBy@`DQE)aPR9c4>6}h%HKayi-|b|6q@+lmCJoc1(WZ5iIbG z9|-9@AcIitBu=%+gSJZcMrqSg!Y*4NHmRw_v_yLMgAT4nGb=EcZ|#2ig5~mXiy&PW zsNI!nC(XOyaii*xc_9myg_OVKbI~?fHdR(dC0FwRS)ehp;IXcw7@2oO91?tN0juOD ze)6nH&05d*v?{BFd z0gA;b^YJWIOfLk!X1{T(z$_9->$6X7*Pu~2V0}?@f;qEJLQF$T7MLYlw6`r1&M>^O zz^abw7vnw)6XkSIf(PsAXrFSA)x?G~%UP;N4mPW}h!`8a4_;$iVrTY&axSAPIeSPW zjD3pZ$-xNZ?Xs}!UgUCf5!CG+ETLx>)rF-^!uD-HN_7YcR$jUAu)^MpsfT@=$M?JM zM}5{*{~z))(|?6cVq|4w_}}Nm%Ua{HPb~;NrxZ^>e1kcJ^m7FMM)+)GPSB2Ls#5Jk z;GYMpf6@pwL=?KGkKoa5p8vKZTYXnV{yuFIlj8m$B_$;_=1%)+`oYrq{=+8W<@&v6 z|9q)2LC$c$8h&h*;SJCaZxa(EsmkWH`uWJQ*IS)kEOsZf5I_zxk{> zj6DcZV)#V_eIM+H*-YylzOi_>h@8bSua2yuxp$|YI}j+GeB3eYcLtk07b3yZpR2xZ z9k4wogq2yWa@(jmXu4+#dl8BZil<~eotEh1t5JioU}RQBXF&dFf|7D{xW?VeH?>Y zfET8}GQofQyY)d&asQj#;nQ-8sOeURXHFBDWE>6p9tJ;#q_BEH1FUEtDlEWpcPARs zXP8NH9{beeW!|tHns3CPQjLP zSU9OrNUiXn!n>3RdM%Och01dF1&LE9jRcXqil9+aW~krp>x+5QrKg5un?Asty2DC9sIIybCFy;Q^PzTMs`Sh6PJc9`p6-p`b?LiilCG|fd) zTC^NcLab=laQ2qDk}yoozCv|#06ztzOXy09j%*Ms39$gnQgM3mq3-*sqv1me%gIPz zp{SfB?VN%+&|XlcUw-2BfZfZiR+2UqH;k4WiX(m$9}f3|K1It&3td3&0Vg~&cpQ6y z4U}GDao-1Du%QLRlWjZD)nBGsIdMFy5HX~H~#(jpa8@X5H@dXCCM4}S?* zusrJGxD*aqn=~z~4uy3fN!s&asVWH0Gm!_z=OA{v2?ETx+Zs4+5l1`UMANB4zw2L% zjN9ucs;10cR&ALGQVAO6rA~GW7_MVGFg8<4n2o014~2KU(cif(!8LG)QWWNm8CEItmwEMJzj9eZ}*@7q~+X6O}n6{PN^vinGHMIH6{GqV zQB1go#!1v|2=pB}oii9*L$!2xDB${lyX3OBxy79Tw%`XF!0D)?%iPA(OOyu){v4R3T`%Oi3lG}}+Y zCkwF)PCw@n+<_AQs3l}%3}%RtG=_>OzbDoiRqt8$sNjPlx7nPO7Sl+u!aZ2WU^4zvIAXW>nO&XVpQNV=5LT%qv<(JRp5rB0DJ`!9&lf zW@nVU*}cq<79s3V54z!Rij5lYs1MCXvXN+nJ*-n)E`3B=g{7mknzPaxcnrq6zaZVo z>&{fO!2dc26PEbwX=pFHBPdc`d)3`gWxHY_SPj~g#wIBVoUlq5uHQ?w=Q|nz;E-XM|a*ngdSFmwkdZrjqtbU zRPL50OF|w=!3`ee=>jqGedZCdc8DtHcm-VZl!Neqk?uY$bOW`E3;nU~BFPYmqs6{m zqRGFoME#ePw;9O3P&d;dO{s5vtqZm&Upv@c6cap?m0Z_>d#xh&1C3FiDX zRgqXc9tt9sB@ILIwvzG*dUI#?Mv$LG70aT=uz*98DdNa4yotNKyUiexUb9J-WwWTf zx_9TJL2nw3SyomY_aEJP%br&i!WW_B!xv9BqoGuN7XI$xpY{>ag~K*JvCGz3s)5?)gSF0XL_#rKyi!)=fXp;S5mq6g<9j z&whyFe|15+oEp>kTrj?}>ta(r_}~rYaJJADaNySuXf0NlC9-10BWnQ{CIj2SB4plz zFqX6>Y&0f{iRzjj>8el_U+EBykl)jb;&75$Adc_C9^INKtOMw{S?n?MoOelAdx3>0 z%%2|SdeXA{@00>cc(9k?cB(^H%I`)Shc5BdqI#`SHWSAau&v~@*=s~F=)@$h2;@Jl z413@GTPo2O4mK?FGxC|X?EyF2VS}?t9fJJ(JYLQ0J#9o&p{_}5_xgc*)Dboy!49iz z(~IdGNdoY$$XIS&{;o?fnhr{gI(As%jle8Bv#thEP@R|yR(1f(T;YQ|5@6zp?2s;gXa7Wh;L&T(;rJd#D`yhFJt0 zn*!Z(dplmFawzhY)qST?TXEeyhbGjAWVwhsgSs-W{~^XC0`7o_$)tqc0J7;CbLr6a zPf1tEev`q(RiQRh341)M6do%<9eBl-Q!{m#C-o5}yr{g8ov+C7Y|Vtf)h$HJ0%~TB zZ1u_qh;8p5E8Mld#49_W81e3O&!L$KHO*Vm*(oeVVDj2r>u#*e^xt2rE-bXT%d!6b zWww7>F6sN9QfDkm{%?cUhw9$%Z=~uT%=9x{3C9W zkaaIu`bqZ@mqfw+^XuGoBp$WUIum zf0)GiC@}{|t60_#J$riq^R0tUE;Z1Y?yarQ6)eNs5_Ql)6%6CVNfH_;{fC`bW;Ve^ z;1dh%d}`837qqRJ_n=44?UbSIBo{I%;x%g z6Dc?Bud^R~7tFG4mpJ-&k5k-TgPTn_2yL~!NK1b%zmF9|nnP55uksj1kFHF0(LdaC zfJ;eMJe@VP1AUI4+Z2vp8 zZfkPIZLz}NJW@S@$L?zp+RG#0GsM%5y9h-3h+7;C*gm`pIkF$c7dm@&qHWSgH@`Fy za@@X~iVl_uz-;{@4U&h=bF#MYKg{pG?eY29)$n!0@ckHq^=BN)!q8pb5yL2XV+R`# zOzabV_etXoz7h6k72*LGCUwapR`t7_3(eF#541yog6i z`)yoki%5Xss$XWanxfutNYN-!%0~Ta?|Gs+T+h;V zdJbHc1yHbM?C(~UB{=-PjtXc^P8Bcg{=)dd^xC)?u=@G_%74FeT+yU6WZM1^BWDeX zw~TT<18OlfSYv*BlB}DP#)l*`HkAK!Y)P3*Pe=^FVUDwkI`8S<7h|*v_oS^Cb~L#7 zYcii|RMpbYaBrgQYSLG;9CK}--(6F_Cg=*dx-;gEO8_JsI3FK$1lH_hLRtxz;vj|6 zhq7i{+Yk~8lFH~OMunLD!!6x!m{;jUiONa%qMKxIMU-ioA$u&0ByMrNLEE{J$R?-o ze*?)K4T!4k33_C93*)DQNFu6rU_(|!D<0@lrAizo>O1Zc1X5($wIH51p0Ff;BZ|1< zYW8_F?keG&IpcK086WVS38lP+)kAP-E;_A?(?Ig4PC%<3tD`0#Jm_Uq5W+NtS5YoO z{H-Dqt3N0ze9Iy{=p0HRM>yi3CU|kBE}+zR!~XCc>^meVqqZ_xzZG0u_M^?79QONK zZG6I$)5TZNJzUg|9nOr8&Hs&UYVQhew!pc%M|M~3AorMrPCFG2eU&M1Fd5QLZCeUK zlKo2UIIQmqT)|OiEFHLOz5B@zYN@^aDn1w?CKXWh!Y4g1K4hA=E1WU$yZY!Qsn9tz zAQm){{j=z|wWZP{8%W$?k*u?hAqQiH*SxjogZ~uPb*mkiZYkSUi2r$F9;h??-S)sR z#Ea&H)_>IfE|oL&oL$4~L<3|~U{ymX$)Z)&`+<@|0tjF)4aFuMC}HLpOFh1!q42Ni zclBZ-y&*e)y>lPc6DwWTFA)PbylY#9@D>$siWUh93(tLfo-_OH!aAMw6HYdneVZIr83Sw)YUH;0TxL! zn@$}04Ar;G9UQmgK$&X zC6pI*P`HVXHpTI&N8r)kl9N5=yVe`UFs~pk-i3>ky{K!d80Zm%;pBTk95T}WsZVRR z;8Hf4!vCarF}TX|%>Dv0`Ygcn@zA_b8`Qb4rsI3vFMqR)Fqw@M4#~E>DdX}t#ZcT~ zNYopHWcX1B5^eIOa3Cw{pNpWy!l5kTF4LB3{DHVvUYR-tzUp)>#3mnq$^MzeSgp+{ zS%z8-RQMXcD`;|DIf61iI?c~RdIPyB&B&=6e(_-am~xchSj{&u@*uONT~!3{g2+nD zW$Jo_d%hH>YDwaiv~YaM;Jox85y}b8tw7~|eW9;nqKK2DGBmaRFZ9dVGmDQ2bVhEO0zPTii6}sAsk0cKZrRk8nU3FQo-0;kG ziT=HKby)GX)|E=rx8Lwij8IGwd5gn#Oo-wu=wE`mWVcW1Y zwGL$yWw4sMz7v%i6y?3PR=(eYkzdp($|M^5|G7YoJST>|JxKYlgRXh|q4J+(qdy-ccRRaE5G zI9$@SCJBNA7$*Dqi8_Nfb9>fJ(Yt%qmA;!b)_{Hb+Vm}pzMx0do7TZH-eTdMx=tHs z2QbCiazDjAaD@9oGO*0@`cqda4QwlEe#?pb(kTnhpW6g}gDEr4@S=`1qa$^MwHRk8 z!V(u`Br1j0bj4vfWBhLzIa?1jSRg}>J-i5U{=PeodP69;1KREb?Hn&3^bSp9^VVNP z>2H1@|xZ0t=)`oH53h3b>PNDU#zcMY=(@l)Nqyr^e zVE#jxdVD?YSt@W69lZPUO}R;^(J`A?c2EG(D9ib>f9Xxe*?d5))dWHL51~cBF~lX!$$$}KiHs( z%kvUImj0f@dMbHj@mO54=Z8yTlE0thgXIJ5lvMgnZ(mg2-pA_sPnq2!-mf7U#R-03 zb`Q>?$c6?qp9G6kS*hJ7A8&Avt{Tz4FMEO8KfQ}mjbfjV-U1bhA08>I2AyQ(8wu+_ z+~A*2p5N%}Tl?!uX1wy+sM^}M57})Z0*QYNQdD0mVk^}o_dZ!I45zr>Co$XHj%~+Q zp;24=)`-`k$N{m{=t_=Bk65uDJjz+8-UA+H?ytv9J+dMJZ{48(*8r5VUnE{_Pg%>Q z{p#I2zVte~i+d4q(<|Eu7nSp)^mJqfINK{d(!NfMnfE`m!FOpB*W-^(x#>f@gqG}T zmh3l?3y*}{gfg~k05c}X$Af}i)y7t-)DT5V8KtnNYVolmNBK1cqT!KrIKi8)bPaaW z-Omegong)f&1iU$syu1$Pz$z4R!7#6JCDPx{w|?LZ-4)g6I9anv8m!NTR~f~6_*Y> zh1ZC7S!-0)9Q}s&B!Z%T8fjT(B`h<_BicyN-3HK3o&-x)7RB=N2(IUYg!dDp6l7 z6FUE#epS|EiKqvZ!BF-ZZ4K-poO^*als;M|(Zq4f02uOzp7Rl(mx-Z1Y7HKx>uT8b zqw>Y9(0An9Q5y8Cf9JRlfY8nHcoGh;R!GEjqT|;k+`idArwb4Bir|t&;Dlp#(kpW@ z*uH6*rid3^=wI}uo2Us`&L(R$=8HeF#wM>!8?vS=h0@ydX-)~Emg0gsPurC3D$wt6 z{Fd!H3O1?h65wgFS`87Mx8N127=uGZ~Nd8|8FDO}90Bs9UnYJ1;CdC1?s; zC$EGj&=Y8GEPSW3D`~?n)ANNG7rk^Ch|{H)%}8gZE{}vWMHF4&qLWCJ52KJMXe1=J z@CVmMa4<7SyhNLID(xukDf{z%&QSE7r{@M`e`EtI5jQE*;;8BRmlym}BtG{um<7x# zC86rp)q~}FVzEj@PpA7bC5#Q<1Ol>+?Z&kkfd0-K3i0K9kHs>NYbuUO2oQ`)@qt3D zQWl$YaTRFJS5C(QRc7YU{1w=?12%MhiK3KYeWk!~wCBkX*^oRzvE2f;J-Y3S;TGLG z!$7|C8WW8f0|AiOAGJ4{*%E(`mkk7_g)x`#4_on#D7yfpZ>RW68X~7@GXIdYNphyJ zed~*7f3Qv6{GJ$JV&L9{()9LFJl8mZq+H3HVmR^Ao<*+I8s3w8P;#V97>9O#U1fZV zMb4aJ{EyN%Scfcl4JGT5+(U$t3n_(K*eXW5ZGhd*FryeIIv-%rORAv~@(CCE*IL*D zb3MPW#1Px6v|cS-S7UMgnGs&pqk*b?jpF3|;G3$&YJU(~!GH~T#8#!Fz)U(93Y<6q z(Gv-C8*Yjh7#-}$nj&F2xd5lOG%^U=Lm~chom65(Eze{;Bs9@ix2mAYP5?9=^$KNt z2e)`kp9yiOuDDAWjzB#n;_q+*l7Fp(_J_4fc|QdPyfi`$(>xf$u7ip%0D-e>Q@9|ICnqDJ0Kp*9vE+)fQsnuJO>FtZu} z5qkSgGqe)R^GcgEYacNrh(Bltz^EPJNu;Wi12WpxBaid>fVog^2G!*oIa13JE?Pz} z1nzrY{XD#rmzZg&^E?44#H~uXlU8>mnhlB0k-Ch4I*q}ko)&=VP7dJ-C1|Q#2HUVV z(CpIy));@FpIt+&&`xglCGAJH0HU@Cu6u3lx9{Im^Vpb<46p^7!EghMASkUI#Jry} zETbl?;ENVWCqL^8AOliZ>alJtz2)MkPlA*`7s%<%@+OP7T$uowZ6ELJ1oqpbpU-I} z5|o%Fh=nF~>QQTurIPh?U15;9v^NMKhDtR**-9q8RZ5>hM?8*ML6}sl6!2 zM6#^GaFOq)l{U?b`JuTKz8Q|!qg*@CVlF9NE*SP&T@=O8O;mC``zgjv%>pA26AKFx zk;|3-^jl|IT=~w(WNuN+@#m4jRq2xqzE;O1ZjK!zF-*Qf<8HzQ*!~1-)V#4*m1F?VR03!A5gv{mn}({>O}raL=rs1tKACaNuCn40?RyS z=n0QQi_z4s&+0CEF|_XaSkPBxVplNW_y5O$+Ftt50qdBm^;)n&U!)N2H!2JySye!264<& zSYWfXuiX&D{O0d)~uNRSesSNhGiumPqJ_y9>eHY za@+;f>T;hO2BxR{`f*<%rgF5sR6+M#$RhM}t$*d6{ac!l`zx3>ubmrqXI8@`Dbb^G zw9|uIlFbV)n5#^LVs64xfM`Jrf(s=ea^eF&04c;1%Cz*VxkP!Ze_%S8A{qYS~k$zEw~EuNWa;$2z~g z&FY*SaPRZxY&0cruP-jZ%_Od0p1xr!2BGi+_gr0`w@Uw;pGUkOXn*gUy8jTEnHl~Y z<{u*qJ;(npCXfFG=0jG*|5>M>Jm?Y5%@Ob;;f4<(}@ny=|pR^%u ze=g_*8$`b5#7nEMcklXn9bS0iG~cZbJF;BP2Wv4v-PAt9F0Wme81A=w4`PT9N+%l_+I<2zYI`&|GXo;f0&(V z(Hk+}d=VmJ3CDHN$(;dgni#LoeZELG?7)npDo*?@b-ZV*lg}d~!{VBPsA6CSr)9xq zK15x2!?ekuRmZXTS5E4$fJZXbvd(Kkmo|@ho|2^)WHbhT;d#~KjWEzE(w~=&XwB`q z7pb4KAZ+Vr+(Dnrwrg2NaUP^E$aP=Sj%3-vOZYf+J2~imxlpXC96uIX%zW(BB$5za z63vepTV0xID9wLOA(KtbFy?d6HX095J1{ui^=LitVs%%$Kl5wz`l70%7PxH*J?Q-g z?E&D42VaG=_6sBjCj9{PKqVs!$BWws;8Qs_3X1@ssI9lIA%OvR?d@EwU~QXJdH_ht zQ!1Ew$iLATu9#3_%1TCyk-o0#llJ>sDi`gUya06h2^9o^WJXI*_YEh6oPAR7bkl zSv_fyribHz{@WDlC!IR!NDJemm8>=DAt#o#2m6Bq(({U8f|1lYfgs?ctbHsMFid)e zi(-h*311%oBvz352b6F=6|(cLm;u$&St-{t7ExGb)gD2wM=KrAUDD_4dfuyJK{qCp zx``|9@`1f5HVU+(T)WJAQp^N(vrfIERq`{7X7T>rPGto z^-^bF;gdKRA(QB%9G(Rw$%g+ymZ6eQ)>;z5sYR@{>cYR#mS;qdg5FKRi;dzH1(*p7 z)wQAwF4EUFp8m_UAM%NK=Lh!o%|CoD-8`knO`G9n3OhzEXQ*divphYYGm~#ndBr!j zbb2Z^>1#+46tN5frNJvm=})i%@$Ws!BPe^?dv_R)(oVG&f;>_!LXGJp!@~tZ%F`5- z5PmS3?F7jfRxLJAs)A(5R{-w2z9${Sz{}8#9Bj7`tu;X8$3l$9=_IE16^C%!yFTO` zIcUEvQ+*|*{D^X1KmG09{OlI&bb)En!oemuNJB2U?_P3E5S)D(6#*(A1!KxUw8#c=jbj$6`o#iwA_ z>#5$GLve9E&%_2#MElc1XOwhTg&TwdJ&b3!@&+xukV-dLX`be-AFZ>k04&1i@iol~ z%w-xMU~kvX8YX$D#fim3JxK(-sx#XyIq_)@xFbe~kw?PaNe7lib$s3=*vk-Wsuv#X zz`RqDHZO=So%Z)+eB*SOtFFS(OJrBW{}%kxJ0|<%$R{T{Tg5ES1JSW<>~ z6=J#2Vv+#FCTSO#F?Wr^aY+n?pp!ASC+Q&t8y*+L&FZG*gwjsQYw1a$$5o2;S0$Gd znTNrqL^C2Oo@$_l-^A7tLc-=4iJGyf(W1J;x`YDy8D*X)qdbVIidbD$#nSLr zSqvNtCEQS0Zi7N-=aoPx&uO=IV>m!&<9Oq@Dsws8rHEM1hMsevxYcwCc&p?StIR4}F*IuLIoZNwk= z#v2)3H2&yznq9_2}x<*u(n@1c}C?d;Hta)o2xz6RQzV+zrC9{X%`#Cz4w|> z#s1f2Thu}^fm(GqnXN)*H>-rYwn~_#8PJ3pvBGc>oee?I!8#y7+V>fkf_L0z!FG^@ zTa83vkK2R`vrNHYQ=qtsg7w5|AOA1nanvw76J_oPJjm~apf$UEr_VLI{1Z9)$=%C- z`5&G)oB$1zQMr4j`cdnDdaAxQ%9|&CuZ|#}iM; zY((*69&nWYik&+i?lgOQ@!$?#!#_v<8ws~bFz_i~)+iw71qBu&^+svm=0B<{zB9YB zbUy5e!rzW$K1_iW7?W&2CXH^1&$u&Ut&HqM8GGMq68jf>j7j+^=paiT?=x4I-$7^> zhha1iloDKW463IObg@3kJ=i%<@BGpIC?PJxKo82=LG+Rxk*_TZNtOK$Q5`Ema0)J|(lb!uUj z!cVNy9=2}v6ZF;F35UCUNc~anB!PHitI>PHJ-_`BJDjqd*C>9vPJ)L|p`)XW5n*CK zDxAVQ?4@&@r+PElc^sUHEorJ{&BckXZ7xb_d-L{EjZbi9ID(#s@7eG+@;0U7t4pzy z+8?NLNC9!CD8qP8sty}CQmP93!(V4{C73!GgI&nmC2E1Nm~b?7@kaSKEq+EW=Oku3 z2XD6l6Gb__O%*l0-miKXLL~eDDHAgPcbSm!|0vX#|0&d&+hPAH)SrQLR(t?r;9%CE z*|oeF2L;sJQvNB_v)-O%B$9>8m3fw#e!-#ynr|H`(vfx_3 zMliJ1(DWkgd&}pJToDw5=?dz5J-+IA7i`Rb{dYYNFEBqd?>=H{@!Gxchn)2O@WH+U zjaOtva_g6wVK~9MJ!EE%+DcutjL*T=a6aH_AiSApI*^!fOgl)e$`pIlxOIJmhWYt@ z`6wa|nUO%Ck(AkO=|wF;m3{RL+$PjO$NBtzIJC*We_S$4-9A0_Hpse~-hE9LM`tuA zy?yPT=Pk~9Q8rTa`h6{N|Dc*bYFLRx=(T0zv<7?oF2dER5ixN=f0v|JyGo!6hO^6@ zAGQ(_L`4M+z)>kWM^^>N<>X{$5Ip#7N$b`W;#g=P8~y(ks;alDr zuu0C`4CA+QBY9ZbY+byA9bzY(^%ixUqQ;M7kBH*4zG09S6QDWU~iGSP8B$zLQ|AR-Or_?8~EFhznuJw**vEa;m7y zEvi=#+;lr>>=dRie^oG|%;%%Gs212$4%c=VNUgGeDFh8ouAJdH9O5J?XsSFo1kUE* z{#hEjnV^aO&5l+a2<#e8?g1D@ zQMe*6F<6YEVTozh0AH+uDet@@K!8AR0VcuJ%fMsGZes9LEOXDP5JV_%QpAr<1RtP7SZyvXfmvT~7|snN652QzwQh0vmRS{aNnWvVF%R1X%-&7$R!jit zxEPQW|Nk)dj!mKj>au3rwr$(CZQHhO+gRPJZQH%twr$&*-goYYIT1T1&M&Ah6;WAl zWI^6R2}7|0xKoc#s-wIiU8Q%~8YEB0~N5N9N(*y1@uB zM3zZe4kb@EyV0;kSnS1VD|yM|946FakM$z{Of9T(UR$nM4X2W0!<@+bn97 z=-HgbCk;)9nQEaSOJ`Wv;qN4P3sgYDqL7d!{-os~GNAK}x2Wd~(oIhjV*&yZp~FI~ zpr0$7bP>m;>LNb9EJqbBlK>jX z;|7;)?Si~f+BN|G@RZUz-A_|pj(-I+-%PeqT{25*Gl}t2RI6EiYG$?C?_r5)h;+EEmX4#_i`)d(sECSU+O#y6Wr5oG_&&G%g;}i5&FzGkoyh&2X7f4Qj7@Bydbf+$B z&7t-G^Z-s)<9x{mQ-EzVGeNw3@OxN4*fC7rt%`OpZo zfv;@H$_Anff`(1D2s*~LQz=`M)c-1LXhi+&!dCTqR=f7`sUdH=6QHy(F=&#|!vp;- zw*whruJnr2?!QQ`nsLFFQ1ygxL4Y7s_m-DiHJmleLLO~scdN^Na*!^bdrWV`!lbm0 zeX?09d(n_$R8UtBvX!J)Hl1dZ+@%*j;%h)m3m)Gj(ft+CV{}y6GL)U@QYGMUTKq>m zSFM$fnQpYa*?jy^LW|y35*vb@xR=Gu435kTyOMHpD~GRn@{HS-ra9qo1!^zcwtV|+ z+zmj-Tgu4LtranCEhEbV)+|9o5>-#Q0y1nqm$ojxWTwg)QO_5C8(dvS!FeCWB^eiI zW*|UX-i)dodFYzE-ID!*kdO!GU<+A`={f1^^q2RAhnzv#>mIM&$R$KGT$Ui>ZQ#m?wNNDL>K-kNPkfNcmrCAvX(Ey1Fwsm z=2lL%Jb=TQ)h<6AKWVQ%v_wg)$CM{dJ`%D>$;r5U`<Mh87f-S?g3h(8a6F z!9MM3ShE$V;LPL>os^D)9u66su5N~O@B5bF@YjHPflS zN@0v^6=*TEs4x25iaCD0e}b?@M1I_wbUJfo*Mfh%JNwh`I+1OZO955@?sF`{^?x=}$lFNa9=A0dFXE$j1{XN)sqaU3Of5$C*> zG=08P$h)W-GHYX=SG35AUW1ZFPaYzy*mm3+>pxB-hSl6Qj)s=GANy--bq}T4k0c*3 z8+P%h)bkIf6w~M8sK*}QLHXPdVIf8jz2)dQ!wGQRX;NCj%N}INN^+1C6kQZy^KU|0 zEqU@#L2Ko4lo1}_;Csd>ms(o)i;&hbiV0@2(P@?V(1Qv(0=RC%ox6n3JR(3f?U!@5 zdwiCngh|lw`l@MJ@?zhvpi{qHs&HPfm8`Xv);5j{e&h z98-{~j8r*Q6$}OgwmAhU7-sn1DADTGRUtUU-wMJDf-i~@u2p|`n4ROhmFwq~@AFok zor1D3#>yi&awEn5W4Jl%7q%HsX3(-qbn^M&KUbGdEiOz33w?sn(JA9gw5H3)Do>2OnXsFkXD zyu3rkVe{5UHS@XjMVB}Ap*EPo(Pi*PRbEiy^=rbQ8{LlO@#AN(H~a>FmW_eb2q*H) z1C-7b?K@R+>PAAYLXs@#Rt?-_Ox^@F%Ys#saY`Hs^n-$WOiCiym609;Cb*(rRHu`f z_RuNo?0tPQWkXeuVq-2Qdg@5j&W)>|^AVdkf6s35 zjy&_rG7C$CkUDRoXibZRVg~w(h!XZR%VXg^@L3RAk|#=b#gN)P2>c|uel5~2H|O@4 zhY6E3xg-*uicBqVw9uGp@YA58kuliww4r-W<$HJh&hosgLF*hu=kOw+Ob7=TFoLNK zIFyI8HJGHnP=neuk9ccCC7C>v~O#pK6DU{7~WQUfUi5Y`Z$y|?2c!9bA%U>*V0%1iT?IvWlj?k*8Z_% zEFh2}MpsyO86Z+w+2!p9%cOL{FkPHg#01`GEEr@GZ21K58OM-2kN&mo%7|y9Qphg0 zHHG;{M62B1@5JC$5c{lLV4rL&g(2G-XPA4_6*X2vDZrE0@V|Y2xk9weudAOd2!h%}q+zDeesBQSp>JE?5yZF+7v}V#|ry{PcU@b+?=G7@Q8v za-$PJTH#|16Lh5s9-O?KSef1v7x*}C90skeT^y+H$1^)7HXMsP8yiafV@UKdXwO&P zd|924CU}9I79*B=!yH&53s;=|DrCkC)^9VjG!5G;ikR>vi+9|*yofe^N~nnX`wPLx zqxrDRf0dY~ml><0WW??fK?EW3O+?dvTOt>-DZV*=_D8BsZbRTJ+^0BHMek~H|2nGW zKr3uhxJ}YG(mygW#XbXFFfLl*{AKtBYfxGfjj+MJ4>hev7uaMf{XeBblxgR(N$&%r z2jUg!i4^-+_3nITQuBk7k0FRZ97S)8EzFT=&)(mNmF3Q9RRdU2AsEVosT|P=# zDNr+4Dx15~q-HXy^(}@|GXp=>EO++%eao1tX;7!G0dKQWH^#NnS5Im{P}XGr$%3hF z9X%OZh!(tsg!!<_q<7o4#~)$@(8n+XO+_E&JVODDz06m_WbpND-TWY0sy$BH{jnlINF{`h1rm_N*t<>_HGj+wD z)4Sd{UX+Yy#Yd<;mrfshv1|L9W{B@_gRK4^wcH}rN4H?wxl>Ye=f@&ADz4ph zj?7O_c^5jd?yTLedsKI?xEEHx!jAXr(M02+)_RW^gfT1rm*(%%ux|NOH*cKlgobk9 z;p(Zg%#uPkzQ%q7e^d>xC*-Sma3?stvVZPoDfqneroz$rtYk^-x*eY}lWhWR;7Rsa zGnbNr(J&Y6=|71#6^8v>Y;-1{##x(P9eDogD_HH(RXe4(WvE<9z@=fjw7~RYX3OT} z`nc&e4P=SH^Q7SSGgdwz-;K=<#d2?w@%m+L}xnN<~q+@%oa4c)Cr$ObgZ|t~kwXC8S(4 z+HeS_E}!@D2bif67ltVhh1Ob!On6odYpV6o@j(NtFcf+-ev;CC)H^L+r2`ylprlmE zB(bIgUF_B*$SWzAwL!6Us*`O80dM)0AntxQ%5d9=YlL>|xzmH?mM5j@T_NRZPY2E% zw(d80Y^SODelvVe`qy&!m#LcjPx(?Ze!-<5>D^(-$b%eO69z{iB!4jF1L@kx1HW+H zG$g(NTR#P(mMS;omiFLQZy*OKZRllh7;S6I2H3>Ii~lEJ@z%b}e-WZ=|2q$xotfqT z>tSzcjm2HH!ET*Ue*zaT^8lc`BNA*0xaIyXPz*h#$a>9nkKKePQT#$ysnk`~`n~Bs z#<3)#1__VOUL<93z9YxR#@70LGSYVb?4h@PySDwjjr@*Ynjz(Y;{AIx&fos^uRA3r z$f|Pus(w5ip1gRQ13v!K2w(Uoeusi{oh>iR#COBx=Gh}jdXT-!$phT8n)ZqDLGNHI zUx05}6+1<5qc?ubkw{?-tOJ%uDp#4$H5U-P+;NPSzewyZKX}Yzqwa{YDO<>!NOV_v zwXB+QIC+qF(>dv5N8c457v}%{dQpTLF++(!CpFC@>Y-AuDm7#sY(4g(Syb=;=GZQO z^!@Qq<<{(7ev5pBLao;(&utqpk&i zv_0ep5c6o$sYWFUDBT%}Bpt2>UFSl%56`*2?*T4-_?e6A3#qLV#- zL>@dyhr&_ujA;sqw2#{SxO^echT>H*muxQ zG3z=lNWsyJ4eE_8Uc$M$S(St+2`;63=REEyO38v*9@D}|7@rC%W3`(lveChIvZe9UWupu`Wv2 z!zz2{62}ktb!{DS#&V*^KwLr&W;v7ax?N_dM29y4x3u`_cgk@hWMl{(99?j)r_r_W zpmj91hEDnZ1*43>?8KhoN!`y3JMw;zK_=yV5k`wq<@%(@2i$PkP$pJ*!qn1tU5;6E-pHiD&h6!jAvAmrvyB_wof z3^}dSHS2+JPomW)B6Ta?w+$wqMyf2*_R)UWb|)zXmon=IhPf1Zy%oy;!v?Zw{S?-mzlx1(JVewi z+MO)ZBlW&Lu+Ev8X z!OZ1s`i;4BG2WCHP}!Fo^alyKexRQV&sU|+1{J=>^k7Jc#JorK%qCKGam88y`Kgmy zSw$YFS7(RxVYS6QC&j8Ib0&wMF;Dwmr+`#fz)X_aZ5$Wb6)2fnTyv3Y$8;)-eV9W7 z;nJ3HgiMarXxDK{N;)=`gTN~Kutc2iyAV6^PI{EEqqO~z6;I>35K^m5aWxMuiN=!D zu-94xH*9eQS&&dG@3y3W{QDZj#O3Y_B}%b59zCt7($Hwm6UmW@wx86HsgMKSn~vA) zLLIAN*(j{AbphbqBgzV;dff5Hse`e{5^k-if5=sYm}t-BeP4V=NSU_FfaWh1CvoY8 zhE`&8;3^4d9Jjp(z)AjuRmG@S>GBK*=@8+|Ta%7=o!zKkgjjC-u3do6yz8* zb08_^nT8d^YY?K3EO?gt=Sv9Pdq;9$hGo@^AUGs&Nh3*3O=%rM$T;7f2l{^wzTsw4 z5DcYDTc1TWI6kfjC0Rbqu~CC*)a=Wo>MXJp9gdsVR&*D|(wy`H6eoT9r!|EGvAKJ8 z)~2RmV?VG zw7e@LH_q5FgA}#*jQ?r*I(2A|8&OZ}{^3+>wcdlrhSU!&Os+r}?n{Kxg$K+AYEo_| zgq(SgD-Hj9@^cxuInU{2c99x&e073ItepQG10*3Id+ zJeIQj<(Ji{5_VUe1jEIXrGpuEz|<2xu&i1S({k$S87$v(u#TB16L%Xl$&W0q!s)N4R?MT}{a2jok202Hm7+Xyz|*+F`w8F(@tpiifgy-tuvWF3SeK#(e@xypZRJ~A>H+Z4fca& zvo5C8fG*z}>U=%lxy6x7ZO0lB%kgS|F zX3oyfP`nQix?YmTJc|p*p5Iv`PEC3Gf}TubP(MP7R1>nYz7r&+!Apb<%(iVxI+jIy zXhc#hVb7twu;AEV5ob_G^Uw8)0e^)IKRR++Mv}9s1B+h&X{Q)XF=4^h)Mzb~br*71 z%I?1h!0d82x(ZPiS%*<{zlRs^aO3Z5x0!AW=}=!i-_ui9Iz@VUO0(OVrG_HqL)0iT z(+fq@Yyy@bxCTeF)d+|)UevxjZH-Sz$YwG%Y-Z{1f=b+2Yp;is!2qK9rWa2C3#LxZ z{OH_5OxE*^bb}WWZ@KyVt6deOfs`eDc8EQO2+6P`ABV-{LC(pgvTP@|--KB@C(W`C z!Sg3_)L~ZG^+~ytJ>ueFuh;Zy!%I_GA8x1y*<1(8pcqf!vGB<1y9}hRdML6SAp^xw zDG770GW#_uxUy{f{gpC?rfi$SjIg{d_PiQxlFRj|;rZszyO5UP)6J|~)H(P1cY4ho z77Es3D}e7NE04Oc%itdRQgT6*M`Wlx&=_VkEg6E*)GP0J zV4^nA`mABv_y=9D`jzCRA95iodmzG9OF9LDt&5>PJ+EeM#<{e7@!1!A=T5;q1_4}7 zrZS>Ll#uC-4t+0^zjG2Z-D&u7^BJCG@Ap|RqPFMye-pj`JCmM;`G0Vbs((fA!*6hN zM)?%9%AphjgAXJF)4)#foh>7nR=b@fJm>zMP*c?;v9Rlr-vUBu!lYhfLLHj*i*ro! zA3vujt0(#~smulb-B9nr)5dSIbmeiO_mX4?Mam%Xesn zT2?-UWD54K;ZBoK)0r_7JjaFJnr}XtZ}67q3T%Nbw`8bus>@sr<@+MbmDL>cxvk$< zxo&0z^`>BN&tLy1GbV2TfeQ+q)SR9v=RY3({d>d;)JyiH^Us@W8F|MK=M)!>+k55d z*bLG4&xlD*_Eq8C&rYd+seYcduAI{Ju*ipjR{Z1?Ax&Rbf}RF0y}R^FSsX&Ekq*MK zS*WIH*UkYdUFlKGjoq29T26a*n>yh+&wlqWS`w`w3gXB@dS}aL5=O_#JGNj?*Fl5tMhV z>@n89Ss-$si6z0KHlpz|(3F7|<21EZI%ovMCT)STM>YP1_JkMOjs$sVJ$rOwj1C@z zaMk|5xpAurrDnfqu!}`;Guy3^774Rqbm3moY#TOIi`2tBEVr6K8)N$+qvVXl$9iPK zvD7d#W|UDkJg5q7ahhbra-=(hd=zBh6;DGtNRKl7tm6!|#(xd#-J@17=%^T4my7@@( z{h9@nEhd>5t-lk=DCt8|!EMQq)0XJurpRm-^=k94P6g?lSaT9aO78bqrrZ&jHN#ze z!@Sz#fieh2rm;|%r3w{NQ&QY1R&ApHSPYA-$l_4kChtKqXU+RcZBW(7XdmqIk5!wN z8m33Dqj*dvF%zv}Aa=9Ul_k}c2E1C5f9FO;tuB&If{|h#FoRmkMN<&@k1dR-5DHwA=Yx6_zReiDUUK7 zkOAiV#D8`SwRBa-j!NT>b$GBxD(Rdx{OgZ!`DQLMR?*D^SiGTi&`aCX)16>7YOz9= zOrk*dqozQROUsZc*|sgwvVhslC^j1gUzbJ>?I@v!N2MB<6b)7;s?9$$D)5#_2a_o4 zQ&y64Si!)$g1ifzn}#Gi0!a85?>uDh@?la!RSOpLWL0G{Bc+-knQQ=Fu z7Dh&}i`WpnyvUqQVa^TXZO5=9LZ(PyEF;yyRB`mm7hcW*Hvl%lnXr)X9BlXCzT500 zW9A;5%qzt#nB)nW+B?;jJeFzX!&{*`Sfe8Af|I2rlVUrzH4BoEDlZd2M#?;RHsV@)E<18k zQO=wzUnG|2G{ibm4RG4_yZU!jT_7sKgsCQ?d{13%DI}YH^G;RsRkQ-8wP1V(ewR&p zZOivIS`lJu)S)~?QSD7Dwwc7`5>a9}i^|j1+=H>o@ZzlmEN%VLY?VxrVaWgB`Lhe_ zBUtRQRP+UZxE=t67R)=(QPT#k`LxVMzK5Xj2@>ALR4a&yc{Bue5ngY{So1@nY$uaT znlih;6ch-7#Du$O5RN+d6xfY>s#+pPeyH32@}#C86G$L1)+zqjliTd11lTLz5v0u!+=AU$32aGd|r3U2TAK~ z742?fu*vf09v8fN=~@SzP};Cs1FiCmA*Xu->&^qifgUGj915@vOS;AbPz9o%_d*c@ z(+bcdCCR%RNIsPVf^qX4o?Ndriab7D&kz zhtq7UMFoZJoA~HG98jmG#Sq2q+)m)o>lh3Fx~^oKlDj~%t_zk#JraEgZuJ1Nk;*n8 z?I~i7tW})Q!+b@$>&f@X8fkZUcsHI1-d{2~1zrGk!6lwuOKy=wOxpUfb z_Ywj|MkwEVt1<}stH^5@+DO6;@$2tmDA@~=ri-96g10}2Kk;^qS7*M^K{I4gpxyA* z_Up(lKs>nZ^>UZ%&oYgQq=C?~n%Q-q5DQBDjr{jRxqVV$zM^yN&^1*pNBU-cGTM1! z?X0!_9oGp2V2^FzBn{WO_M%R5;3U#2Uf^u8T4vRc>;{dQ<+We~FlKf#iRZ}~Q%Qnz z$VtVnplNFX_dPrmwA6Qo8AuJl;st&PIH8-lnt7A$>McH~qn&iw7INnwk)8V?%`(FP zoqVwm{BBrdkaIR`dGz)lVG8Mtm)P($iEFI8nH}))ry5`byyvITb;mfTv^P#hdNH4I z?su77n^+fHzJN}&^;ab6Hd$!i-)#INi|y1mw?iMtX=i@K^Osz%P6c@pI;WjcU4eb? zaoeF^>8gmvjuo__4ZU*HcF4Eay3p?@FERPf7PYN1;O<0-m_(luP%Kak!wjGlCA$O zWuJ~+@gwqhk{*wOd`Q)Gd3_fUZ27;9>_Dv2{x_N>8~gt%YRSa;KRopRL@f{55T?FR z-vdiLl|jI8G3wAATAoe9g6*0Q|6yN}efvJps41$*&j8|USQHyZo7Bgtr+er|UrxYZB;g-?NVhFF&dOWX#15u2buIn} zWqI=Mkab=2>@{Bde^8dnj#_Qm|3O)%@zbuU8zwzqw)*Ut@SS*3 zy31RE$)x5h`7V|M6`gfknon;O%ge}#Fz3?8N+czJ_8EObvN6x+m+9~6 zlDYE!C4ZrI;pB^Ia^Pu#{Qji1t;Jy2qU%+Xf(<%6t(Mp&xEo88t&>4t@^~`GldxE3 zM1}7Q497{7BXmuX=#Q}k7@vF|>jB!GJLd)!-E15U+7xHqQ)qCbgN>6NZN@TIerJqJ zjOjMiy}wpBzKnOyFUK%~Y}0hNF{=uO95J~r&XQYxXW8;X^E}dYoWPqqS7vvI=Kd}D zeUr_lx0#t=F8g?rb3B~R8x69$fg1l%{enMr7}k*1sR?nD;$#SCeSO))o`InF9Ux&MAk&O5QNop zK|oaRQL7w?ATs$ch^KJ6o+diVLqtfB2tlVXV+cg}@w=$8O znT@hTwGL!wBUvapvJI65Y_y@hB@K|#&Ahc5k`?CFcwHJAj#axBV=gvpFBxP4YZZFz zq)bzU==4^KpMtU{gk1zNIEJ8pgf{$#1pk1#t$@E`Vc82|6WL&wQGp5d_Hhk@hLKTC zf57@D&ZE2x_Rv8qt%7MfCMjb60WM;Mzk@a~m4)|FjM#xD>|+_rV1w$8YO8ea2Jh^8 z{%vAM;fgxXLTU!6HI&X0t2=E0cbm2!TT#ng1>dVs8l3s2$ZNvrY=sS+_3bqnwy7YB zQs8mnghkn-e_})vvFYu{hiDRX5n2TyfO9m0_Yy{rK6pZUr9}B1Dn_;zTtA;!P8$wj zyNUOnDJ~qFfJnIM++N$f*{b2(2&JUcbNqup?Y!TAA=UO7$wOmN=Nx`tS7rfE|mh zM{-bVBj%b7`HD((ffA9!_*Q1U%*Nk6KHIvurP!C5vab&_87M?Q>R5JV+u!JJS11h1 zXTUfcshV>;FmL^Nk5OVB%!$LuizLK_iZ%)gVHXfDm9jdBP2T!O!#O~Z(ltVSeF-*J zeEaDC3U~5}3?tj&hq&F%rX5YixN@X{54j&TcGo z>jz(|Q_$JkL6|HqR_g$gDxqhTZtg9Tl~0}vMvkeauhTCSbFX2=A%BK^5BNZ+XXxn( zspd~vG?aRTTMgi6`k&8enW0)9yT5qnLyo@4uJ^26F5RhPO!O#vG4o7~(ouiW^U&L- zkG5#HKiKvhKiEhd_E0Lg=>1^@kg-iER;JgiIJDD|2|@b>)$-&Chfp4c!SoO-+YzTo z|A;{u2dy{#;Y34y2XbSZ*_wV%G-CkC*eekAC>%6F$`cMR-P9#~6Wg?_@M#L=9?_HV zNjJt%&ve(z;|ijV6C%P58$jaC0%NfDh zY^m68FW=#0x9&ZfPp9GLYZn69&;q)4m}2$;4`t-$mmrClfD-|wbzz`P`dx|U8kj|2 z0TZ8*@;jM>X|eYP)9>5#-+XSY_x@N`#r>H7Pvvloy?qhRL09KqNb{&(_; z>3_^?{{P6QxugGAJ)z%FNu8hN*%FI=mtWCkHp?#rkFR_Vtl- ze6Q#Fd*S+h4#5O5&vawxweAtYC~v|FF&Q4+c6{CqENyJ4LUY)sRjTUCwxOu^?{&pF zN`zg=hKtvrmz%U9<2|eA+gCYvz|71zRH+x}?{~7n^d9ZCcj1vC9qGb{2U=&AE~(>M zj?(`wYqIK;r$2i5*h73b<_vIl*`H@^Wt zz(S|Y09n!rnVt0J*MQ840Q6ae=JnAIuTC!`kE0ZPa%;mt*r7oBnDa`5oz~`LPrD(P zbw19qO(7+`&@MtWwT9MOPGOmqaU8g$A)a@fOM=weH#%DSC^__H^U@9tx{M#aDm_-d zK=eUrW1Rb2{$c011Of|JW2#4_@b|oss3u|0#CdU;DFndzcQ%AFV|I$8G-6W?BG6i$ zfFTJJWmxd_m&Vw5i!fVKYEU*NVaBouIZyRZRkA`^avaJ*po8L%?kBAzBIMqIPAX(e zMHI*`2bYa@@J31YVP{1f@7z>D)$@7v9HgL+0%sW)UogydN*}GZD1^#6C}_KkN0cx( zlzSk=2=XD+#`3;7OAV>~&;t{kENMeT!$88mPlrC_pigTi+>n_CNQiYt9as}p#gTCW z5i548eMTX!v(hF!!m zfRT-g9x`*V6HR51OoL8wwC1b^oI+Popnr^91?!mzjm&nboam8=J-{@9D$Y$(4{Hgq zDpM+AD-BwQRWtX~4n<0=g_vkb>R>_aoLB-0LD1Btu!N#mPd>7c;?pwm(Z^`fS3 z<<&d^X;8VHNuJm}5h%Be@}lM?j}n?@W4Ibdo)r)@H9wNl|e#C%a zpK#RoISpx4rH+sFv8(6pIojeR_rLUMMu zUei!S+(>3X+maggh;AAV%S3paJ!*~^?X1#Cjo&Z-1(s8(TQaV!mxorJ!ez$l&>`7L zymW*bhcw@T^!%`x70JnuRwX}fArS3npc~n>HMn#*+Xav+io+?bM~!pPt5H(;Nzd%8 zm)`oS8MsQkQIp`Ape7Bnjx8)9ZBdCj$n^mg^^0L_o))@&_4||xQ`78%_qT?^k<7;$ zrz=H{TgyvJ12bhLNa!egUEk2y$7^|7u&QGAp!wrXn@21%tt1J!{ilH0+LI3dre!fIQp?h@J-0Q3$j=OgqBP13>G_vn*J7D&RQ=Y5 z+vbZlYO4%(D0aN*XCPE0@01~opZwWN;fLMx8{MEN=ftH35&?hz zJXj14khODv0?mlx{GC)@o-lO~so`VnsfC68)V@2lRqE1fjbfUem6mjI;3n^QW!P(0 z32P`#GLcS?kg4!Nz1cF~RynLlgd)Q3=)<*0QERg*A_lX0l7;E<*(%FSHT4ZuReu+1?c8+>4Jc8V~B&YZP|;Q7M4k%?T#aWbj+< z?8VJS<7Gd4$0>nI8Fq5TiR3nNn9NLoOrI9b)wt&CYc=b69yJ~5H{~tRw)izIkdE@z zExnyDR(9dk+DxSFGbt4t>*5TLtLEAoJ`@y*e2<1F1*r}k>qXrt9S8F_`dgtcZ4;Vq zX%1)d>q!aP`qrRi9kBmSUWVbQDz)5_CJU+6wyQD6(xD)9-6GkjByrB-hmo9VO_Gyp zLYK%4_rXhCr#sQ_uje|iKotv*6~)i(gz9c&!JiABW0e+v?2ZAQmhxKkLFCF671_b)*^L21>WC@-LsMp-)*x%FGmyI(qh!qEFw-`nz_l&!r~4ai1Nc?*&PC zEd%o}+hV*4mxm2|zuHZ7-#%KndOF`}6t4!C%<-Mtfq4<W8q%JN~F3G zuP`r8Lx(ftETC~w!MiBam<%TjotTX)VFz*`V~?o|Y`L@N61QHDOK+12a&NMCq)jQj z#>y~aL5=u&cI88HM$2icu3;lxbnZyv^%XHra!GvWBH1iHNhbk#HRRjh ze*|ATj*;>oNq_ThcAl#h2Mk>sB;H7(bCnm%OFD;D2U$0j<6d;?9pQ3e`aAwOF=7v% zvBRVjYmfuQTGdieE1Ls)JuLi0T9zqz@(#+6CU{F5pKy!d(o0?DF7ycuWKV{q-PV| zevFn8A)->a;X8Lxw$we?>xPhSPJ2n-6{P;M-9UO3lceHVz`cE0qM8a|un4_+#y>7d z#T}-cN;l2p`{elQftcF9nc*aPYZaa)Oy})3`0J_9gAxT*{)YUoeLqWnr-yXyBLl*u$uP2gL6!N4j`MnK>J6HP35h%9{S77m_o=!LOE$6dB*XK#=qd1 zA=;tuVs#$=g=|I9JJZP7C|(sb`m=S)(E^S$Xjr#5=HPP$w(~nMPtvYd{SzD}?99Hv zxb0B_0WyuU>v&o&u5pw$@zm)jl#}xFG2hcb$G1L)ifw2jT5*dMH7@V%5rWxFeU2NS zT}$V0@iuID4<;Wc*z;8bnwu~(o6(EhW_Sr|m05a>GHgoHa%@4=>QuQ@9nM9fl%pxy zpc3a6X+#i$frlUecbD1MP?BK4rrT3>p0Pphs7jqR9{OrL#w#cb@&hqTJM}IE7qeLO z_v5LOqRB}J(#AqJ^eHPd`YGJ;-R#nSxphXq9m|0HKK=XFwSCmGog}g-uMtr`iSQ^f zf|!1g)&+~Ef%ODdCcDUmy-;!zTI}?kzZ@10nP}Rj5E7cmsY?<;zYPs}_lG;Nl_69< z4e{uUY-N<`M^oU3KnHcj6b9Inek`d><>O8f6Vi}o*atOX_ZeV;bK%C-BpP+e z`4@QR3z%&}V0MqS62_2c)qS)XsTQ3-?O{<0sOKUD80mbQnQ9mVPBf9Yx??N4xMrhB zG+A^y^F#FjD@2m>O(AL{11B1VGN|l!UH`URGh|X_b?sSaS&o!*=T>;fsuX~%%Q@bY zD3*i>RY5)Ja2&-cW|?jenA5Y4A4`_B$mlym2KUXd6&Kuo!9?;iEp=2tRm@Y}oU{!p z9FoFoMcL7m_uFIAZ1Ar2opi5ja$qYFY@GM~#sCU?UdYAx0Kv(o84$us9(dO#A28Jj?Nfj9{@O&qDQ^LppJ1f(WI&- zQEghv0zz}`D3m($V%2gNJ74R_ASvGfIqTfZu7Azyr7B7a#|fBQ7D=H)Tfx@ZOu*c? zU!YK?z}6SG=E!WSwlSpEB?WZbJM*K|=uuu-)anyS17ZZjmQrpv4f8++Frqe>lT$yN zuSU*|U{)c`Bas%DB`py8R=GsiF4IPgPj!|fJz9kPR`N5Ik5&gljAtok&gm2$^jygq zAE0v27n}Ah8T3Q0e^`E67^{QY!xa7wDe;38sAAw~jSSJuL>PqAPt@7PVsRNLK!9iD zSmA@DSV7cSZ<==POmtiN>ahind#;E~{N6)MF4#6X_Nv!L!#b4#0>N$Ej)4thCgWsF zzto6tDzqYMSoSRa8%Ai3q-_Y{=kWIguhe~#t67kw!joEDM!eHIVo2qAhIJaIR*dLc zpEWU#4BTM;c6)lpu{q(;labNtq-&F}+G_bCATZd7%EH~H_e)NBMax)oIj!mC4QzD} zX8Aj*u_gC)xIpA{q-;r5P1mt{NbtDqT9x)VV6Aa#)h)mhNrl?9qDZUP zxdSGgaF3Xi)V3AS)I6PNzn)(5L3>%Ddwe`pVRqDCRZcIYrwx^2ce=KL#9v`Uw~~Mt z<9TCvl4h%l#bi{jxGa0@q2|n(#iI6K_*Q&*F`5<+WOhUqvf%#Qe}vH2i$Ox4N6_De z7T<Ac*3^yD&<;{V=&H?DTTo3O1Fi~++yby(Oqd-e~wKTbu-XmVtr zlAZa1DcZkA;d)Y(=We^F_33Too zxHTFZN?An`S)X6T;mp4y8r|Ev?BSv6E&oOw@OHXb{%7QAg?~Rb|KOx`@M)y=EZl!x zGKw>TptRMOOOo4qkG$OMZ1K_UV@C7zXif*&bk|XmDO8vxAMBCW;xBUQoM2F@gcRaAe3|*_F8|}Ibb?v6#$mwLhWsLmd$sv z$8eQYdc`Fhtq$D;ObO-RVWvMNIc>iA;Hv(Xv%#$=EIjDHqT?T$v$}Pe=u?y&WN>#i_Y%bS2pW?`qT(1aLwGzH z8y#YLSC$gnqTEdCF$kfw`8i&3;tKs^NI`VWl&9TN|IwgwN3bXeRe{-t~6tJy(-Q9^4N&YZgfd$ zo!5AZsu5cq6{kyzX~)AR5vEKHmB={PNXQA<6)$g+u4V$e=VX=ZNHFhO{?6%Q$q?kO zy)eliass-ue(seL77`}+gK*=^IAjuegsE(uRw6?Aw?xqry%0ax3LMV~Iq*nF$JUk7 zC^IUct(%V6eQ%^-VrDU`PXMO-2*iKbz!cf%gnGze<+P2x$>JdR+)WY6K_eDE+J?My z@cBjJQ<50;a*SzA_L4Jr~ZDjv$n1LU6Dsvpy2bWA{?s^@Qj1B1BpGY_3=T=@9QWO_h3ec7k7 z_16FYF!qj3qCid7W!biE-m-1mwr$_CZQHhO-?DAnntGyV-k6^05B(=jtdp60FWjhB zHX)TYp@WJ)R7x+!^Dfje&+(GBWeJ}kc&$Cn^8WX?W3*ZW0SsIc+-l19%1nwJ{FFMb zafK}V0PNX<^9A{}iexOSYKg|48==y$LtRoTp;+c9{1;I;vZY#4L`AE7iW^n@(jgt; zYph+B_xGu29ombu?K#f6GDtm0Iy~AYc6881H{dLUd_MnJC(E?qSb?VYSV6Qx1Hb-K zMcqcXu^kGTF;%D>7F@D~kxJnVu7SHwsk%d2LSUv>H0a56LhlKH@8zs7`23T}XXaL$ z_s`)Kogd)Hm8%)Y*28L7l{te6k*+g8BHvp@b9sZJ$#geg>W9{xW6EO<6YDLfwkSs& zG&q=IpmpRY>9j7itPmfnczJ~k2ST8O;2?=ukc;D62!&9(`=Ire#;bwdPXdN7;FsHO zBv;^#4fF`n=#jsR={n{~oFOmn=oeP!M+aI!UOflnjVJ>UJeUcWl+ZC1E#+_riuc3}|ej;#X1K2TE9Zbmjro=Ke})l3WCA#$gqPe_A^f z_)j&dDg4N+?zkKY{KyR9@sy5fqEQ?#B%^71vs7pQ{bV<{`QX}>tU*f3Q4Ia0TuU*f zq%&`)lf;W6`1tOl|5q$9P*k)g+cQDGCeO6?ev-BcF-~NIPm(BrrP&tOquC zJGeA^k%#ekDCZopC3Y!J?VR~gbl7|@l-e~|peqb{RmPo3o~2@3=(uGGvzf^I+2Iwo zb*zEpI1wN`8;nc_vvT9a3hTa-D=3?AG0rl9W4~SIVA+z=ZGnp~Spi^~(+E%cD6jqR zo^y5!~ zAYcbfF66&TyQ8Y32;p&0OmDUPkYk;Hd2@mB*Wr^DIH%YnGNu@JCQ5r zR4x#W2?m-4^iVBN+PTh!#k^?|c2eqPylrh7q9?D;9`aH=S}v`;ZGNS^;zbHRw}3W- z_xeH`QWt@GlIUXYZ^N71xj)|6;YqPo)OgM?t3_Qp&=f)TnE9xtJ1N;BZr9EWE>K zAp5G^d#C0$hxSLxlWq#mRTiGM4>(WJ&$)@&xE1}%sSct4Y#8W7p+v> zdp1PMRghavWz0i%(wL>(YFl2SWhnY!ov}+_(#Abi2ja3-dA`+I!1u-d?v3e`o{Yul zivOguPo%>Gcvdd;d!xjrJ6kBV&nRc~6}r^mXzLeWQVOWIm#G|y#9tkJLpChpO8YJ1 zaZ~Q>nwU@gfMU{zCIOM#a?6_G)zW2Wt5jE&XZ#cBI4$3DES<&^6CY9gULGa*GT(0R z`t%+LhiVYjK5{-%K zOXd|kye(_d&Esjr!Z5RP-9&H6y;Su$rh!8>O&P0$>px`~yBI~fg0_R1p_GC;vcW8g zobH6Ar&25$u*}`j+2o+V>|q3xgz%i}m|z3AB>1JQIU#+VR5Z z0lpg5^-HGlcaH^?s)y1ZaVNw1O=YkcxA(R&hGVCF{~*0VU1$5_V8>9b!RLPM)5sy} z@%im*4j#RSr+U~?`;6X%-?4>;MDP^Bt{<62&%!Vvre{B?liAyC9Ux2$N=(BgQFMkG?;9RhMXEsbOU<0wr&>oGCZeRZ z_NjN+Z{51oVk9aa`jC|a`*4kZv!^HE(Mj4VGKm*=-J$TZKJ5WAz@022md=kh!IkYW zMU1>BQ&}Z3p{AYS5<6PTt6HNt9+I>xp@TE5en&$)!DO_gtqO!CRF9cVVoXt~=zph75Y9kgE3mcp$Lf|fVk6a8eH)sek!{@YE3I|I8}cLBCrPOO#K=h_ zXdvF$`{vYgwlx# z{uZolw43$X=<|gVB{APy8d-PP%~*c)I)3!mqz&r{@qq-wE#rB1PgfCX<{fUT2-(83 z={VP2=i#o)9Lqut)6|s##*`v1nr^~l2c&VNs5mW>I@ogwquzF|OF>_X$=`g4REjBb zC&DuG4|(1$+>=h82e1dl1+WbsT{@nAwcxo1rd=9fT4km%%4nl9VYd96VPsq`U?bIs zA!seI>CP7aw@g@OVjoHV)<<8sP##~ek)19awI(BrdC1;%d%uWiCM=t4?9T3jv#3ef z{HLYqbJcC?F%~w*jrDe^>|NNtGf)O1P6@1iI1h8U5ktFGnk%M*W*IV9){F(}ZF%NW z^8my0P&4gsON6{!F$1({HwsIAh6=IQ9C%%-MkQyJG#;}PT4<4a0@PYvMaqOzRmMP2 z#ASNS<8v32TeW`V=l-vXB>sA}4clxkc!8eOix<`~P({zw4Z;FwpwG7pxp^gNZrZo= z8~yszWY>%k(5}b|Q-xSqr9R{u<@Evb+-cA~WtEwM{287y!pi9{&I_?ybd`Rpk>||t zYs;k;TM(ZAK^822Jld;cTH7UtqR=FWVpp|xarV+DU^qsDi)H}$Ei!@|+*3PL2Q**z z2kVHp-0Rs>IQxm?s|AYzo|tTCt~OTz2VVffv+QfS#N^%y@_NXgnb3xtpo&&I&Jm7I zvJFS9v>s&y+yo9wtr!1g%9JFtEDPzZjpF8rY1P_3JDm?I8mqu6dS83wid08y-e#lw z{4Rq~yPN9wzDzu)hRryh9aXU_I-uOO+fXv70p(~^^wHh&ob_a;!B|}NUnI8S25eRt zq`hS79Dn_J%eaPqe$!&W*7*op-^SvA;|y$ zQ?KEW!Yq9}Q4x-@i-7OM?|_52bAJCFs_gD~20|RVq}2jU{Sm7L9#74MPi;AJ<1+R% z0fb6yIjC|P_a>j=`l8pkdqxz?6m7*Wx}To(9+NT2vki-(i8C$uQnL@LkC2480QEC_ zGg3aRm#V*1to8qV>*3re=mGzx%P1?DdIwmP&o}mZeKVb4Qa(u*zqC8Hu*LNeeTp3T zuzufLvhm%Y4tJKm`5IAqgGuxq28RlKYtADilTUFlEsazLQ^gm*QL0 zl=($WwbnMA8$#+c3bvK(C049dhYu~uh1MWG5Z~#U-;{K7140C9|D{8YQLNrB6oY5B z*Rsg0BT{zuSszk{YD~XJ4{Y-~?EssmSS^k8R(+I^6PI)nnTo7oCsXg#l`re*a<1_h zo@L^z@vVTB-v(OPtgKmPFN>6NMs!#w8Vy@ zP*UQBo11mHE;SjpGVwFm(*4A4lKBAjrVvV}H!hKk7Bo4JbeDFT#+{o;WeIuEFexEq z2+)3Zke$VxnBp`~-URD3AJVczO#byeAaWYst{v++WFFoO8@FpLbbR6m{s%S`WsxPh zdU;g=x|k-c6Ns_&JtbGqipXI4pUdP8#0|2Ho9BrZ_^?6@yogPgg>B_*dnWocj0T*J zzujbA(0$04M5T`Tj-*%lF17|AKpoO3oB`#x#0w(e<48B7;yb^|Hvad+=;pSR=VN_E+*01&(B~{_s1ge8t3COk6 z5$Q@{aV`%l;7aTMRC=WBTLxeLaZ(7*lCfC){@r|pACe2-ULI_O7z^b3elxWh!g-kl zhb9TJMnesp;wVj&9ZIbyCu?%mWCy17?uN`46J2rN4GYb2f5l+=z+(q41zil_Wfafz z)mRw(*t>W!O92OwR}!vQ3ONhh@jI)YTCCv6Ggw?`x=cQvuDfv} z?L^p{iKde(@+aj+I(%{5WV^S?LR~|G;|xBuSYEPDPf+bzTPf_ghm4-k?Oang8){74 zd%;VYX+F>C(A5rN9tR!mi&hEvOg!2C$5~-gnQtE60(GWVx0zaFe4y(SzrN5a8vBLV zLusQ}puKcKmm0P{6ZEv3!P@-$3R%NWq2{zApCJEFXd>TcaeOCdKNLaUj1(+tzeI&c z<&@i|X*Aa>-HQdo()EA4e$IN84*`n)Cu05Io#(SM{kJ{q)-SO>w)_{d(mItwz&Jx7V2@3YZwBCa#yf_? zKa@ZQB0~``sn_eOWnu zJ)GPQ#(M5rJ5Sy1IpNZ2$0n@#N5*3_c=LYW^&dWQQeW3r8aOI6!r8q|rT5Yydy@`) zs03>rN5&C-BH6k&M)J|Pd1GJqeylJ$JpmfYyuM@g_LS}!5ao<;{>*=Ohb>fS^kePk ziTNHQZI8ou;f8G4uTl;E@ms2MRgVb6mwD2bNR9H+zUzS6JaLRxQ>)&~&Go}gdfacE zhh~$Mo!#^?E)K|I`kFkc$(eszF-WqVAM|U;xg7gE(E~G?DkI0_`|*1H zxP5RbPvQqQ~gdfKXUrFEx3De{8bYXQQ=Iav8)@cb<0 zJ|c3f;J)-)dFz-Gi0Di1y*m;!AwBr}YP1l!B%49idNFA?rS1$l{CsvWe&5z&4_>&? zdhzzM4vSjJXkbZd;MP zHGzZhE%)Bh&#)7KNX1x(-4Cv^5CXQfh1s(AJK85rY-hzmC`>iU$8Gvfm!$0;r_`I* zZ(uhHpjAOn7;Mi>Q8Wp0)Dr+YJkg_9<%BQwVtk#tox4@tTG3OH4bH;2MvGdXJzQL!57h@0Fk)~2MNeWy(_I&?w-K~L@Sq{eVw-wCB_wy7}zU! z7rOT#NVOH_Ewfb1h{k)y-*H#Oa3i)P(%o5pK@AAvV;`Cq1nde&iCV0O2k4O=)y2^KiJxu?nk?|y zb|;(lJx$d*L`X&2ejdueuX6CSifC`^;Sq~%(0GWosJ2ADTG0X}20Vs5aMxoa!*&gc zkfb9@4DDgY?3^ZYr|B&Om-H+3pFQpF2cEMUyiaQr0SAT1rB4VR)iv?|EypxKJBmB( zFW^ysjh4hvf$)+=a$R$WAR8p9l$;~hDeYB{PjChg9Mwtk-brCoV+5~!xnK+gr`fJr^ zn;M5NdZ%KRCh-@z5ezy&14EQMtp&v2{bD=G@;y(rz6=Kwwz)YnqW|AjpeYOxX7zJn zUyl7;j^zVVcw1!D<6Ik3+GZr-!>eY0+C$C&mgV7O-U4_n`t+tP>td>0yci%95xt7n zbVo4?X2Q7i#U7gK$qKSC(3=uSVjp;s*Hq2W5j{COhb7?Le$UTP0_Qtx1=74u9UI>PBA4*tYQa)9RttK#F8y_Isb`h?Zn0B z&Ux}6tZaSJ?_6?a1n~AuRMCmI{c{qjD^iU{Bm!8Bv&7=Qxj&~Ju|&A=&HUTi8KUuF zo$flf0KHKi&qzC7#69OoiHK!`Beo$G(!Q4^nl{BGK?1_$369y*EJ#H*kVd)Eb0bkU0Z=i4qcTRV{04m=Ob=;P|!fua*X+$s4 zS}UNLz><*MHF#3Ap}_d+}2?=zjEmM@Z)((JDdm4U;CJX}--JOndn2Qy~*g zA(@UFfJEig;a}7X^j*_HvbGM|Bg*`zG1#E4IcOeTjAd-~jMv)-5i`g(li|Q~MGs`| zoI{1){RyMj_hvq+X=9pNHuu@pwOfZ3Xs@{>-nBg5$PU*rHhwG0Xoqcu#MM$cda@)= zAXr$QP9iL?$s#k=>y?1>>cr133aOO;K^QQ(nriEv<2m7+n|rh`GC6bQP0EB%#G8w* zr`{h{EVq|yH)}KO*rSMUu*zUz4RV(^EBK`OrZ%%oO4`LJKI{&4(%P3Ez@_l_NXVn8qQMH2eue5iKaU{Sr5klQ_le|sRo!Z_$HR5J3l0$>$Bv!&dT+mF47yr#XN7_Ht(Y`SifRLs+Aj-{y3un~8=1oXwhiicd) zX7QI;EFkl{rNhclyZqWS!@jt~N(ej`RrlbN>rmlyFL*`W7ZCUhEyk_GM1+j7mX*!s z8pD3RyUU1|Yp#OAyPDS=oVbL~N;(+nlYZ3sCYB!AXQMoWu9Y-Pf!E5j3pF6|ZG3B9 zhs}Haedu_vKBF|;@$CC(e&q^NW8zj2IHV9M9yE~HQbf+W&PVFaM9VHv3320rpw&h! z7SCsuOIkke%UmS0>e5+5lc9U%fR|Sz@oHD&ql@Rnp(aWdcx55Ytpib-IuO;MLFJ4b zxfLt)!d@maJGa%(-FL=1$NW3ef5#Ptgk{KjEz@v(M##7^w8)_ok~g2HHABtIQP+ z#$CL^vdkRn6*XoNe08CIyd>v@=CPxPL~ps+F{eqs*lVw=0Xy2oD@fY6I3qPB zrNRT;YJ;Ozdil9~$Zoc?r{46QPoLc#A_yU4!@qpAP3nr{+V-UjZyA+^KHR9rWZLCi z<~%^BK&sPacQLl*L8GhU%yAfb^k{X`(@rbfeu#Dvwl@Qp6gp;Y&H|V&RMGOr^Es6y zyS(X{$=$3jAvW>%GRXelMR&IC2RH>f_39}m^_Nljwk|sV713wwlTc?7A}h(|2Hp3tES^VtSj4{8R4M7yZpb?vLrO*qEXqYrFMK=KqL|Uq*ZB1b1xJ zh!=dE1Z$5i9}2r93OPPaUK>SF2gj{aHC$Ve{-x zI>U^kaWd+#_EZH~)`s2XPsIDpJMf)B!-ZP7Wwo4f({9o3!j)0HpLMvfh+$f6-u6%y zId#wRxUzqKeBC6@h5P7|A0wSys*Fe-X$~uIFFVt^_e!OGth^|3B!AQ{R2kJR{8VIp z()^ymk{xVX2bS#oWPfvfb%io^dVU?0UZ2=u{%8A*^P0Kn6qn;qZ}$%RYMQzH9b}m$Z;W4Mi?wyd}4#_kXXk}zzsMImWIh8B?VE{In9~&4;m_w4VmJY zity)DcLQtVx zn+bocYzU~F(hx}E-!^e%*uWcq1tQ3i=?T$&89cZFT?5?iaG>5dQb!eIn~exl2!4t7 z$2wh5#ckjN4k!3GMfZla_d|#RTiX&qKsHfX!pjt?o?-sY)xHe*;dGId28YxwWe_3l!>T~u0AuuwK0v1;zWleP66=^E-8V%;}oWPLkGc20_tvZFIw}V zX%NhG5RK~kIqjv+`jGlk$2~3B&bWDe%)as&uVBxkhYUKx;0YIf!5)kVp5hAO|=oT5lv{ZO(~=4M`zaj()x(3XkW#KRMUKbs0+R5%&{I7 zWIg3MQ+@-NeNuB-e|$dS9@z5;YbH-U@VJyGK*FhY>2R=n@XaOoFjk`E2wxRIdM`kKcn~Pxo6ti2zXAf01QS%bL0U$5k=r58@)MB#~ zG!=9_SOL?p&>+SP z8KhkL6URE3^!%dfqb8UCN3u5JxU&16wQ`&lj{DQp#!DT08=er=uQKqxD@py#?87%V zDz!$_hiMwmnH)Q3ve7pmuHnE!z@9KBLN$AA`>Ker{goEMS}(Qe1Sfl4JX;J;*@Ag% zu?EI*m^lsu#aGfum<`MqC2OiMPe+#bIX(S4Ts|qKZuGY~-uC z_S@5%`HzU}uk4_}t}GKNmWu0oTZ%>L7&aP0*M3P=1{=j4J~{=|0oYo%t^Jq`vOW9l zx!$xqpafFSLX^0q#nLC*@g>oEc9pz1or7)~j;Cd9Np*dEAw>F%N+4UdllG6L^ZWWy z{=TmY8Z~FxtuxS(WU)Ab{a%k=ehZXqxg0ih4A+a2J&TYMs2-qz7NJH~KJ@9PWp+8v z^pG-;CI+1;*y!jgS~a^(aHUAhFidCHOvAEZ>yu#+Zq(gsrrmRq)PQw)G09##VtQ5= zT*V@7Le;Y>g<$p;$1=f==cdUx@{9ESym1X z@_QW-29@~n_naTrjd|grT`IksPKkR<3$f?mqrAONx_EK+%C8A;9P~LZ6cGt4{X%nr z^n3=<><8g2?{&bFsN;VhEgkuP6^nm$y%#oRt057An!*CZpjS=g#5VbnrfDOism1)r4lfVq{%^0KZ?6emA6! zs{OL#5}_KDd>qN<@rlm9taQ@7)eFz-x?Ob=>aLqnsqVczSZlS!WD)O*bTRX4^kp;Ri8F_@ps5 zFBalBR-r9^F69za>)O%x@a!Z*qVkkWS>A%8L-e`&$m9U&Kqa3 z;GG}9A44cJaL%>#vj<9b3{}fkuBEu#OZ0ZvmvO6@ma+~`$w!dcyZjvb?wMc@4Q+k$ zj+EU*i#&qXalzZ_;ihC$TRmTeW3idZLk)Y}E#X;nciRA?j7MQ7){V$EZM>Qnh%cGp zcd+(c0NuuGKg1!EpX;mXYTwAMjnA$DkSbTCO6Tl>PZI}QE@De-+{4!>kK+TqmgBh+ zUN6qvM*k7^wC~+ggk&kXhO9f`kblwK>5Bo}S7Y@S_FNs@O78M)GP~&<@ra<9J z&$$ur#bM$WBx>;(i__i1>_*N8KLe!9?O_i5C+6y)O-+$3r;M?s*|;SL zPqnHVo-8?I8pk9ApQ)2i?u}CPB}Dnz^dX+IcVq6&+M{R+$JzQR{;pB&9{DJ~-s#a( zt&1loJBbg#Cch8D{oXccq^a&&v9~EV(9U(jfacllyBS5e=H>8VM8?k z6B9H2uOh(A|6O1_{o8{#)PmT3Lj4F#>y!$?>T%CLW}(E z!Am*A#2Dc(v~6x%x<6Nm-@3uQN&7h1BIxK}^=;aEV0+mWbNgy&|M@EX*vsuWsA`?M zzc#wE)qY8U#YN{~EBJ8#I+;1-mW$~8uuRilEcz1TbvVABgoq9L>7x3Xa7I>q)%%=u zZFn8Lhr$2)kaMF&R&z7A`aHnI=QDEJL5#Jj?ri#?sncSiOao^1EM`Fek=P!*_;-nz zQ9aM*5i=VF>s0^{Q4{guFwLZLi?yx&NF~lwvw@ zGOROe?`LoR5gV(+GyHL*Lw{A)`9sPB%j2};cag-Z$CKryuv_OaF!h1j#;7K#GqtcoFHNpY%SRax2r zjMbS+!Zd4TXBeq-l)cYpmuVSu$9C;{o+s?1(*;zNnj0N~oO0 z1haB^Pl!A#gg`@1XEhoh3Yg;pNhU1h=(%EEpx0{P8mSW&T~$ejMi%i!H;6%62FF9N zTkZVv%8-0oCP{Deh=hHFcZJt)0@3!QmWf@4J0bNe$>AUe2?o5*Vyi?wP3&2#NFMN7 z4*R1;_0l_&n24yTH=tq)vh{sWV+I7jsQRVpln4`nK!jv#)QF2_4JFI>F$28EEzBih1f8XM4N1~T1i$K2q) zPM2QNS;%_+{SRGd!{?h<3&y>F0)JjB2Gy>e3%V5Sc_`Uf6MKe%bq94Jp;8GysQ-0^ zZ!%mi2GC<`3!e@`$dpp-ESvN@vjP|Zg;Jz2zTY{bR1ajer_jh-CrG>&(+N-U$Y${% z=x;z@n-kkxU`p&$H>y~<-{G@ceIcY>$lU6(5BMd{`^Yyi4cr-RJ6!cJZhX}{Uyu$= zRG*8ri>a@;9ha!{!H~((+Pk^1wX52 z?tH@49O!d{wYa^?T6#-b!FhDVI*4rYf0V$m2&XtEmmg6ZrShP%Oan;owQpaPfjMo* zes+d1g(4>ut&ihw$ph@qz}oO{&3PG}uXh7<7;Q?k_dbdWC4IX9TOlRx?YWqP2{wt{ zPN#*4kEJ=RP)D8fd4;!e6-!cSs75=lh>$&>#nSerkbvrMC!5ci&zCKNjIxsElt+kz z*l7rE=ug5Wa&pidq0}81`|ztgfAgdqp1@Tg>r2oK*;z^;KH>JZwDGbYH12LiRhyff zuPTpFYKhf}38LXsIv=%5syfj`2(-|epl;!(AQ4gt;nAxb$T#OBwC&}fENqw328E)j znnM8M2B0G9(iv?jkUFeu7fpq%?cdpKdkEswC;T%-YMkZDwgH(xm7XjlF%r^`;3rZ0 z@!rSt3<}x-B|z`I5#=s=)36YND%i9Qq#*n`St>4MxoTuFM1T-M8NJtb4M@j#+wjnk zu_y|k3$h5%iXTWTn0K#@M~gD?#Cb>yl$9ixxZ&r2{#Y+ObbWo=U$>3?b63KWB?)Y~A#h@6VHJF2NAbHaz zHlt(}Wg;fI|IoxHN&5=oj1efHg~X;O71c%@5f&qP=aM~dOq)bwg1nwj%NG)vCYhJV zLYlIfl39>wyHSA`ADNuy863@NMr#AD4WId;L=ba$-npKJ--J8s>M%=mD*G|fRBAzH z%i`2~V=a^YlpJBxEM!v*;}K7_dpoAu!l~DIFJ+=`WX}36#ac#qsX}Jj*4bg^9OEQ~ zKKXKy{gF}SvgtB1VG8QEURD?;x4Hgr)$bvnB8k6PKT~&koa#;l;uD!AlyTRxR*pEuXA}XM5C-R?1F7;AyBVMPFtG93zKu9H;p_%YhR*X2W ziQk)h4*y%+%uE#22qFBT!ECrtev1uokW4o!6kD39 zb`pg&*{6{+vUd)1c1^_A{+w784duQ6dgL(F*TYrr=b9OAymO@;@%_-i)#q;EpZ zw3yR+ND6$2KX9^~mIISLi1IroN{AV8vO1zA;-yrJ+*}abr{gaAVBn5{hhJqx3{K_X z({gUJu{&V>o+D?7_mAc$C>}09XLdi}`i4$5{}ZqM@2qhQEFAxz=<@Fj^S@*rSEsbl z6z+%wm;{{?p6JF3z9xwpQ`Yw%`4o}`#+`O5MhFCLx6M*16bbtWao2k*0&qazTIu3Jj(4&4 zne1sGYA|6R`lH#H%<}M_iDkr0rZiptbHLoBy^pE-9b#tqu$Xa-yBB@rCuDsjUjNn> z|7VvT1@`0tJ3%_VrV%1Gr@5!h>(;jHtVdGwyZgW5IQpm^EE_Zq{Yi4VFZ{dH3p3I_ zC!68>U#s-=iPMRv*4&KTUXgXjre*tme8t$r$0%<+3pV!5cx-a`i)O6u>;$?bMT!!* z*BbM&g}u0jgK!jVBQu2g{qd*)hOe5&$x)RmV%$i?g0d&@fLH=o;@0>=hLA}aVsyvQ z5g!zsIBZ@T2#)cgB5yoFTQP344s7EprF6)`Ch0osL1QaqB?Yv3QNrL&5r%D2%vvF% zX<38$JTq$2!ld#9GcvUzh6Q#VUX-pF$3GrUN~@BYCT?6~lt=Zc7y&)KY$sYi>Xyfh zTvSqhzm-&L{OquP_VnvuV$5Ki*E^6FQF+-UCDTl}(0tOM2fh#pj`!}Dnn1PJ=9TX z!zSn7OePARiq65vEiuqPDB_YUZuS?WowPl@=yf99DwA0snF^0VWMhlvHf^{&Q=g~+ z&Y_v!bh0R6<-JYWsVsH{6^I&YSvO_N$hEn2#i@nY=UQ3Y_PIq~;y&dH%*Vg>8_b9b zMMx5JgQK5D*ywCtOe|GJL{MdP^AP$ zg<(#}sVWCJ4wwUcl0zrxs`EfzptT7-0ye-Ka2Jt4vgB*z3{>fxR)$Ot7cy3cN@a(z zrlZp{1FqOU;@rrwr(?`bTb|Jd`MXH=`X}AT3cKFuCtdhRk`s~c{_Cq0X`%@C zZ%iaa26o?oq>b-`-Dyq9*~hRUydhEo<*Jy>O$a{HY*}42ADeSN=o}6oZtXeZjk^;A zBqemp<$iQTgsrLi`q4wJUSjqv#-6h%i^MUqZ+OE$dkJit3{5D^piw?VYl6V$1Z^0y zXNrbS>8L(jr-LoVoBu#9v@bz?#D3(VLTud3V+$9?RX}jPOnr z?`DlVD(tot!hQeT5Q3xHc6UBFKz5 z237%#1{yKe5K1~;d`~MG(MGWQb$gHJ*_&od zrnH>j$6@m7juBS(-FgQRKxFJzKN;u7GRgfP^V&-0w+v@X<~QHGVB4IyQOC8$N>4d^ z*)gf9mJQ-Fw-A*rQ`fwqk6%s4nbZW^R3nk8C?@88GFi zOx@NzW)JO5*j5}<&CWdcH0Le-C$?V+!$FZyuq{AeSArb@o6+d*6Qrtdul*lYV3!T= zpo09?3tQx=vPYAx?&JBj;cvZ)I5V1%e0JRuWnTJO?#R>$bviC>1esx)`X(@L)d)AL z9yTS_%r>gjeFvMY)+*sy5-jzM+{#ZAY8BtsGpIQWPZGhl`e7QVo9(hA+O)rnIZO9c ztC5;`VtN%v8|l9-k2&yi9WwELfnNbBm-Wx>( z+&7$@N5I+!7u9hF2+8GD<6K#T-;8-6jY?weABGn7p?{X>3lj#Ye*PI;vHc|E(R?;c zk7=&Rwn$V9k4`@O*y1>PT#5(|_TN8IptK>eqv_esTx1UD9oJTbTSk+sXsgkOJBQy* zmx6fI(Dzo^6?SO&y1&I5Ml}~c$ftVIj*cJRyhoZ7eO~RDd%v#s$IDR63bFZ>&u#gA z5BdS(iMYi7|EY!f56k~<%Ea{FqASyylmCZWj((}d{QpHQ@LZWwhNg)-@FEIGq#H}u z=Oe?z!L>TJJQN9>hxy!}yki1=d>rm9?&u?wFfTj1!}RuFW==noAGasHYXT7rVFaNs zE^XpmmV4mkqGyY@->)l~|5h%3u|Qk9FF-7AN%2S`-MAcC*h!`fiXkC=b@D9lRBnt zQuG^qtA{kNn47bf04;Rx84CC$N>8S)sEmPYvt?hei0RyW%tc{zyQwr389zujjjWFN zC(BS{sgv0WuG1hlI<)-yn~)q4O9N7le?eLmqG+UmYP)+Z+i$RO7GPotQ=x?) zw>qETX}yx-0uv3yEgU!PoH#=l^Ij|*HFvrW%8xO94ao;fE9q+<>j^fHCL*a*w!>CxeGz++YG4 z%4aPC^biMH|86aj4v)n4S%lcQ#ZOaMoR!P5Eig@sfnz3cvfNMz-Lh@}A%@5034Rj; z1z7@e9ELdq!OEK4_#T}w;Q%TE$QxgIn*8AK(bd;1uF@r52U(l0sktJZ}7g(

HLI65thiko@&2;IUu{sM@)YPLP)OxoONNi4KW``BviN;f{t^x^sSynA>Sd~Ln zu1E`Oom_ojPaVwvd{-Y$-MyKVjAzSVNx+~5I2@%4rN+v#9=(NQue{!n?flN+m6t90 zy+SPI>4BsSeq7IS2+8j-V>hz%tDJ_~V@tK!CeCS;)w7?s)Ay7kQs#R!z!=hGH%_%cc9D|1E8I|t`cmU7qU6HoB}$nQrnbDH5Sf%-lC-7 zuMFr(>_4Y3D3$R7lZt!c7M+UuvFC++=dG8Z)iu(Z#>KTQ&47KWeo~v<^N|hy&6)BJ znboTE4M25ot2A~1ikK@wPRTWA=~%~#fV7<%>kX1D2tohYeXO*zV;t-}_EcJSD~BDB zX}w?_loa~Ol(^Kd3)Q|FxWRT)NE1GGTIm3nZbV4(fGFrWAuj-(uNJ;}RU`a?h zBLP`RuRPBjVGBAzu7eu%rtVv{l3?4S_v2#I!DjR zZWppG3n56_a~ucWY#~rfAQS0?&r{jKLSs!bIUDl@=%>mgc6MpW7p&G^6_NYZ_hJ%5mrT z&g-|WF0tf;!j2>Da8EC3E)IcREqZ3@5_4TDV;2G(I;Un zAS<``g0;Py`Jx#e+`LFse18QAL$rwv;lyrb(C4*hH&Y`qNEoOhEze+b-UT|ht=$#q zr>-wUSze!$u|{u<;M_B=)HueHQ4`tDrK&>CrP28Om3wNj)B-tCw?X&biUiV;E~0^Rr*l5p{L5Tl>FtG&`_ESRLBb1y+$BD0bd z#330Y3`qyy^;f!h9h3wwF231A z*UJ^F__o$O_JzB$yIQruDG3OOGRP98oK<0V22>@?oSow&!hcNG`~oI-E|Bdn_5a1# zJ9UTFrro-+ZO+Wtb~0nzwr$(CZQHhHY}>Y-th}}Mx7Vt@>!AL@Xyf2%y>(po6)M+F zcFrAvy2lnfG$BdTQ<6%#n4Ilq!IkL{flbF-5lGT#wIpqLlXoHR){Aa|VBP&9|C2Qm z_3JnM%@lx~_^L`}zsFI$OqKXzRS~wpNo84)xyANk_R`E?!17FeJ}P@xq)(P=M3D+* zbFygmXl&iESrhy2Uo!^U(yCLpwKR!7+9dNJRjlnB;%L#iU*^66`n;rG)n|Aov3Nd0 zR+YF};94HI0is_UAbVQe___mDJZD|5ps$Gs+mFdA;5kpu&pO`^KBda}TmMPR{de#@ zR=R(?xlpCv@uTGs|8;XA?zI>K28F6tyLWXh0TWK$d^C)8CFA8;izvbnmDuTdLKB8b zUcwV4;*rg%aCiD21L|OBaYqZIgs#%3H)?z5WqS8xeE4Shf0SH|murIaLO;BG)Lhx_ z{#T7lo=wZDDBHF4$>ao!_Lv$Jn~g$y(cYuAe!{Di8EVepUp=@NU5$Gq%bxza$+^yw zZkny`-ODD&7~s)4)?U3`_1#)y7BR33#~KIgTk)Rbqq6n*j!O>bfCj00QaO|_M@wxf zp(%@vdp8xgtaaFFztNlPm>ziHpZW>dVgAtt)quyMdXnN63)_;Xw&B_P`S2lk(tXbV zwxAZh{;{BZ{$)X7`Fy*)9N)Y@nie!>e|`_!kh1#ZdX4a%&7O}cy!#qO;!C=v@w@9e z`NBfis^X(;#MyTDnS+{+Q9auq@~jcggsfRZnPjnQ0?KKq3>)GgFmtPP_OwuwGQHdt(FB| zIXGY^5)a-{ z>PteUhy)J9np1FV9=F6g>6F&KHE3&`AbRKMgN9aj!KsBFnb5Rj?wTOx8WF+h=9x3> z*EEKtKdwp;LQMicA!Q?7N_Bw)es3iqHc;gZODgQZQm~=d5z$0kR^UffSU^#5-CX^I ztxjm{Ru=$$^*fSK2umr{YYD+R9xyF;ZyvyfmF>#4L?sK7!8x;+;EHW09bAFUZ_XBe zkmcG8BdM`&8Z3MCT{{>SS{pOA_*FY&X<9weEo?M+?)Npb`FQ@D)KeQ1j=SZ&VzWa^ zIw`h<#b_4luj*BtW}?|pcPMp!TtOr=+o#UoOgV)dS&w2Z;0_@0RC&fe63DOe`chIS zC1yBreM%J5>sp9@mDF^mN|p8KVdi%&rcjT35p-Im+JDAV8Y;sIjrnse8MZ!g1 zVu;!7-R0gbNO&OlTF%PDgp2|Lk~f9mwDGy)IO-e0am5Vr`W2<=8x{pOh3kFl^r?o6fi$<$YQ^zT zNjX?RG#WElxtP+s3n?bXNySxc@Vr!v(@0WNJkV!lZ9WK^Fo;yKH`a6-8JVF*r3oGs zB=;=lo6LK;jo9MY^X9s0%poIxuB^(ZM*RmaUplvHlQ6NZ&#N~C3XF}` zpVJ0vEq-(?{UT0e_FdQ*%q(V2XQH>gtyB!phZCq4dFKu-JcBz5%z|lF08G=-!{Q9+ zIF{8gV|O320My$AG6`Y!yJgw+YVbFb4DAI}K!3QbB~T^Yn?mh3M=0SGJm63Qv8#oc zx~_-G8Vgz;gJi}Z)cGLY>9nuy#;P>XZu$FjiG*dl>M222L%Hc9UVQlu8*&Rv0v|(W z!!4PVk2~fj$i6LV>&C)Pc3i?Iox~hdr$pM|l^}2z0YPx^Fw?z}yLT_uN8Q?d1*8j# z(1;tkR)aU>YbiZ-KeGB)S+_Nh&!D(=G#U!8xLfFm`@-J@^X{!Z(9c=rO*S_SJ_%n` zWcPe|iqU)lcQS|-(RGPJ9?-S6dqd$}h`hR~t5kW!%TSeN?*6gWxhDT6SAi65YbVXW z7@3CO^Dm#1Oye2xxv-p_m@|psO>CeRaRUd!r;j%V*iYJJexLx%XFI$|Gr4i9)8oXu zZ1^_M_SO~NS}edw|3LEGSz-(gu&p;vs!k09Hp#0u5TL>1FgQSlMsQgyd)e6qn4Ylx zbFySr`FV+nt(@UoMKj@VQv~YdHYk$=To0pn>pfZR=$0Pr=nR)3qdG>~7m+Ql1EVZxC$ zfFvS>J+n91nzYq0>IEQ)Q4|ufcS)BleMI$2VJGXAmNFOl58tP5Qxwk5$4#!Zh&F!|I1 zvz&D6NY@4d&wWVz$Qh+M8exq8pa9-If*4a3x@?-LOcZ;O1g9G;z!^&nR8%N->X~pW zU=$Gp9F-J}m=L{)$);pAQIkG$<8}mxRgpGVhuVtKIkI?Une26ry;lAq)4U~MlBsu< zHt@0k0E>|jG(imf4X8P3z@UoA5Lskw81!mPUrahg{$+lLT=9+>4F+&Z3r#9mN){JjSg`Go zl}>_rl@tZDZ-bQSBy3wpX#CE(^b*-!#Sgy4oWNu-$%+d7gu3IH>XLcDGqRnzLwe|D zvB5-EvwBsErafLfi+deu5S z+L4932#<91~|1CWrkO%vF8ZF#DL%y^x@%di2L41RVow{fU(H{g*~D{YS+Se zG`G)RxD=J4Pf8S#qfZKDwOpiEZ;)%Beigrf&KxMh4y(|6VsmW@hWv2feh5@1qHj=@ zdl#GNtVAgK8-z8q+ObXF)@B_|rM(R_Zxk`OM96crr7vIJ(VXp(QNdjfm2j5RkWqK1 zasfT1<>q)y(K*Q;UZZmY!&R3MZtHe;aEO1Hk$?lK?O&WE^r?}5xbov4k|d=`kW(J~ zatD}sDb|U%L;_vO;d>l8owd~a5Za_$Q`}>`otV+OcLYHdG%g_m*%V(14Za_mR?}3E zCMfMFGutE|Fz4|z;$tsh+fw7j52v|HkE#D4Z0Y|y zKqB+M3)>$m^#5y8{u8a5F6jG?0<22Sb^MO7U!5XpNL~Hu!ig0MuG%{}Dap|F{kW9o zTx8*YIDS5ZE7C%mwzcKD-hzmX_IBzk!&TRt$)w|CTNf5dGw4Vq5f zi}0j@Nc9ZymbB05M)UfeQv)B_+cz;ecriw${JxB7;Y&JtN=7RFYP{pB>-cN$eK zn=zc1srKD!G_oOr-fBK`E;D0UqkhEe63_cQR_6!7Sn?0xr}yk743d-*x?HA@N!!EF zoICj*g0!3P$JbE1*Tf#Xn?swHfdx(A2n&_ROJ)8Y#a z;&sRncYsPTEg-5em_}nX>m<{|?}uMO+@e6xb*MDJsv0J*T3x^$v{uhm>F{Vgshpb2 z+EE#Z%38;2j29e>v;4;_LT^y7ZdA1($>XQPXCV80**HR1u#XU$(lo5p+Qg`?1*|o@ zlLAXm8z~+PcrznDDB!k9!3|29@r^8g35~4WMb1v)>#CY==BNxW4M;Es`1JOB@@AdG z5*|Mhgs5dLn=jE*n1xXIS__rBps9^i1KJO+8M-0ik~6Qi$*z1fYL>w#(#tUR4uWS8 zZA06C3C!;C5lvlTtnzRH{wiN6J=CmC#;MvgI!J(84BiECPBCMfpU*|!rhonCT!vv`OwWuW7iQDy}-a zRkHa`cwku}B{onHuZFf`?#_V^?6yp(xv?)u@Pl5N=CM6hkfczZBM%Ko>@IbJGLg)p zI?NI0yH>dTkzegt_%b2I^&e`W~Q`ccBcx zq|uYj_=efy7hzG92PCW7-9a&IcKUVdbL!^NOH9{alv?#D&#);cLC0Odl3D*y+CLVCtws7D%tA$f#mivh^xQp&M)8vo6R*M5 z>g)}F9F9(sVlA+-q+_ibjk|-9HqHVfmTCo7ax~wv5m*sTvKz8V%dZGcH5W0o3#cYz zwF6}>d^tawV$P|iIR=eFwpQ0}^du$ha{75{O!^pV)93m~rXc_qbc1k0@Cj6-kQ%Rm z$$eqaa#?dl_ZUSxacPL|%PlE;Vwe%w5kGiupSa|uJpBA3y>V|l*K}aNqC*J@f27Er zl#$56Ygg63>`cX7=((cI&D|X-U2<&%6A#Y;7(QTtusyYee zCx>hYfM*$wXY}8%zQVQ_SmPvk>G9ML@jO9Qv%GJqC6k3{0swtPXH~x^h_52Xq5p_h zm@Ob+G5!)1iXp-Dn;?JwPBC0S6D5|#;C7%|qwh7D14ctR#Ge^{@NJZ(>EC|^yqqlM zE7tPXE&9_(`3e{xbqD+$cuoR=wcE|i=PTz8H~Fv?1_~dvf-kBYx|{BJrceUOZ0yB! zzr5*WwF>i8!h+HEOJFBR+60R%p4x(GWoG|ZCIxGGmU%$XC9E}ir8QL}?YgUnd1J`L z<)cG->2#{ypG|nCX&btPy}HI?B7ro2o+A@$%$3zYS_GI3f8uRkgQ**234bbg3S{L1 z1L>X4DlYy?kcX}{`1Xv}6vg!DED7;M5X1orr`$%)$D9Xh3RZTYw5Bj5Bw{NE!^6swXgMf(LI(5Ohr&7kfV3FtmLk&nVz z$QqGZBA=3SvLou}?J=2F7h51S$S~TLTI3T?v)h6;f2{_c75-}Pmd;$&X(YltyLBJW z3JQEtcri@vzd^piq_&_T!Q||aMqkvMr`26Hp_85T>`DpzF1&Q!X6BX{;W;FuRZ}3W zp~N@s7|y)-{<9>n^m@~)#3O!Ceoc>5024HeuWG);g*tb>`{l0 zH_MSWI~4JOZ3kR%6LyJ6jx75m#Bt$CA0%~vsjw2`U^1rHGV#^EXB5Z+MF*x&ht7Dk z@-2o_`(;zZ;5cwWYed+cqTbalMgQG2eFYYBU&wOrTQ8a9HV<3r^+nd%b3{_gezZ%f zLW`AC8oqyCBMqq{F^H`_CUmw3%m_8R!A~i~1*c$B<|xB_F1L;6XSfvyl9s)YgD6qm z5eAVYMm6spW^}g>4?s@;@twR5KNUV(R${}mqANmqfmv=|RR8IH@;Y=b zS)!`o8SofgLRGzAP>p<#*M8t%ud43Iaz}g923|lbeDX{3uYR{Nx&@E>(vn}UfMezP zP&lQAPp4#uQ$oivx^^fLv!Z3r)K52Ne!t_>ZB6fHAD{d$Fbm?xHZ#+^fZxUItTwAX zv*Kr50C)0w8}djBPZ4p+xkuK1FH^<2$*>=7gDTLd39Wu3z!bpyZpPK$wOO}bjhcNW zAa6An<@c*-^qTEXBtp}alIyaQgSW@4&- zWa4B#?jMA_+wAty?%vmIK2GBe$nazU4xR*s{OCa%U18!40DBP1keFefYW_{@hG5&x zO4*8Rsm>rw!PaU8ccT5z;(f|{Aqq^NFxvOkdH8c&oBj9a8#R-e<%Olc!>sO}(?4=B zcKz*!epg$*#eK;PZsA1kujYPM``&rks{bSlYDQ3nn1hT$+`}TvJ_Wat=6>+9)E>t& zww4!Th>!P&(+oxEblGps_{_9Eorr}o$=&AQY1|sPDawGNPyVDi|e33DHJ&~v%ImmId;yPDQE7|?LYV3r1&f8>)AFj%y_JZ+~T5AlH zHXWT8lY*Z=MZJ&Y{^rz_R6PJ;6H^WJ9S&}fUIryy3X^1mnsKItDD#9_rs(XMH5p;ux69KG?Pl5J!K_~vo zdRpxXgo(Py!{fhkEVz$Ah!kf&L))VtK&hb#cpXihi_&g47X4(yox8!WNGFZoOu|$? zAq5?-yIkhnNV>33r@uUKLlz6k2U=AMa6AU-Be!HWs5hv;)rz^* z6?*a;MgJ{?d`6Qfl40;T0>hOBT9k*QW_l0W)5uyq@Nkub z8K&uNbz|+tNT70gbHm#Z=N-kk2YJVTzP8Yg7~J@o98=3ltb$~?ecKe-^WZiYfga* zWDwnp^%hNsYr)LLF~Icbp3k6LW#1|ZB*mwA1fYCJr1_o-xw0r^zc82*`()?A;!My| zky0Mks7K}1&BGja+4|&YJ-b@Wc1hr*P$`dSGTIsWxSp_RMnAFtt{dliD0~&#uT1G_ zLJL$UYEcTczUI#npp6Rz@?Srglzxkqi_dFVNS=lIjZr5$60a!v8)(f~=|~#dJqihB z;$qha#Ci~Vu>~G4ceW%^4BM`MjQ|a$4?Rf%XWG*lI}gpd-R&&<%f5t(oB>CG`e(=Q z7iC_}^bk~c29Tb%qqQvH@)Dff!!a)(r8#K%99y2T54$ZWpQ^8jd2QN%; zK)%??HXAHILn#*z%Hi3^X2SJkD2sDRk1cn~cg%{pa#bxDKS)2a(@ytn8#NWi<&}iZ zbH2{f+a()=mPyVh95bB?xwA{Bk)iGc%4uVC1X_q<^oa~0E0q5!EHD?O!QkdCKC9aQ znqps#fI>~1XBX73i9PG(1S1VQMpxLWH6;u5>r-6MFC!BL6oAA&c@aaoK|e2s;b1Xect1i*;53k*0Z{o*giT*)2j34 zZ!PF>&SDQnyWkq{S7=}!rafv!WF&Fflxhy`C9DPc)Uv>p-%)4Cv#Rt@vqX2Zi_|cW zZXgSzC+x0G6N8fG?We~e`#UdjYfVv?&mdLG21UbW*@(hckxw9rl;`a02ToMmYl|_^ z?To1S$xm1$SN|m2_zA-pwzzg$x5c!MfAVO2E-Z*B8TKH1xp7TC`mv|NN)$bBWAA-i zcHh$aNux+XDohU;GWKz@NbNfs!$0=j!v%0Ckc-r<#=&)#Kd1un`?6n36$Fu&Wl(sg z2AP*5l?Ft~31miidDsOa_fL}~09V>NKH$Q{We5_l4nC$i)xNhXLYEX~*|jrSn!~qB zDN?zUMmy1=w|k3C8|iTl(88H9s28lB>*x{!#kw0g2x;Tn=R0!E5R#(?-g|O!eK&Cj z&#w8(OZ!tZP1Ke>PEP}WE#HDb8BItbFEyt&shukQBbWVpVmc^O5^5)+lDUP#ET4i) zD;nH;{zufyZRR7Dk`+twiP>T94_I?1XtzUT`ZT zgr%}UY1?75OMF9H>2I~p6cHS(?IRkp*~?i+OQM3eY_y2?u|OMS3U;hi^_ma)D=R|) zu=N>~*V%QZpgJ1gDSWA2Mkzq#whh9etOM)OPbztIHvuJU8(B1x;)&SdEMss_3l?ls zOxV*%HhnCy#98mRRaowWleu~2=7>^pr6GY|ealQ(YRw&LRctyWvuSqJwHZ+C4t{NX zI^+u72Tev!K4Mmi&e%+uMJ67=wF{xB3bHuF?CnJu-u)kUQeALKxkMp|t#=cvY0=qF zV`-)ki>IP8<95{Vx32xm%DJ^8S_|r7-zr*6`?O5;0bW;>}V{ z+ooDTYSP8)n1Pm!tOJSS3aL_(Q1)w}zxk?V95Z1B@v@Ytho=Tq(_?bBf>cCC7LXw4 zN1K+{nkx1d;K(P~gT##=h?<)fz=={@Jy;Z?HD5okE3Y3TFni^J*$?yoKr`bbAL_jh zMXlwPIdRkQI;8^h^f2hN&~@LFe5wHUt?7+g*eJVfwWnTWL>Hu^(H_n2Ha+fUAWsa< zCNTF}YFUMFEb8Ob4eT5Cx%w_E4@fzFG57B0j26o(6cN$AgEe{iDx_&7ds&abS^9Tn zpR{E^_1YwLLaUtsYgq8gkG>XjkgPdBtlM1-s?eZ8!+ z)!ME(rOw--R;}#Ca;uaH8shx8LcIT8ydQfnMuFKg*td&wGSFVQ%;xQ9!Ug>q>|k}# zE&Ci_G8`nBjlDyELu01qwIm8G)t=0?{8GF%XPe1VVwMp;pUW)D8BcIpa`~i0J$m}{ z2D7G3wP}~a;==ZHf76+PUN}IdN@OycAZ|e|Lly1S_cs(eqp>}&KMSxQK23*}?M(i2 z0LB2v`HF2Oj-A!d#ox<4(!5mkYBlcX2kedVIHRpT zPvSI2?puEGuwg~O9#lAXBsh9b@xl{T!hl#3kI7c6myS#;G?m$CBD6_2y>oDI6Wfcc z4RyLIClBj0OpI}V)XneKx0NuD%tBoxL5I6|Gg=bL-QW81a70jsmGdkNOpeavb{nGr z&$=wx+7p=(=gRBjP1!GYV@xJftNg0^b=@Lrq~=z9f7?r74&tR^C5Kp%rWhFHgf%Pw zV1at4C0wdCGM{O3IagyxD$kGu`;7~ebO*7a)cQmFIMW45L~{Zvlm>Yn5L-K;*=070 zqDBUQzo6BT#9rm0f!3=7RRB5b0b~h6<7e>QoW$u55R#zS!I{~YN3 zQ*E|Z3$U|>4M_fJN~`WsOmz`dkwF-tW@g_br`ykjabHO@&ZX7uMB`LeC4fTNDlL77>aV$1K_LtsKyP0s*fValVG!Uf1zjj}IjGg8d3*-0 zWkJ~0uHS)%8YQT?8zv}jF7R{*%VX1oJ1KFIuDR!-Z>=3}iHEoDinJ~W*{u4GHO5fP zRtp1s9)6S!Zi=*_S&#+`Zefjt`C@6B-jQkHNl2bJLLql!N_;NNo#<-{Ff9|vM%TX5 z1?4A(NOE&6{9+k;PMIqEk$>aY7W-jEB2yZ?kaEShLE>>ARjHM|n{ zL_A9bI|*csIFzWWwH>wSfnw&k_NdOUY*CS~I7D`<*1(QS&_%ik7&%5%K7FFwv}GC6 z!5zD;R-rCJWH+7}1!(YflPgj4Dw=^jJEQD*X-4TpEU$Dkq7}&yUjrVH&wGGCmqpkC;CFjGyw)VVKI06r9LnydVO19fruwXbv;^>RQPIHRG z$Iv;4Exc=PzKQ=e(NaggW`?)%U`>M4f2Yn`nNEx)H6D04cs_^J0o=-_wZymq8_>W@ zzg;mDEXR7#9n+3nRYIibY~Am&M%}P3hlhYZe4;qIruVzN%oTqCcaOyv?s!9bxX#ga=Dy~@Hj}M&ps5=yyq&f$*(S=Xm;GD-AgWTQG?$y!>Bsti3@Es3_6kE zzq24-r@^ZWV5mSBWbm2)D{5M~yp0=U#!u17qK zH!&0Tj?elQdI>@DH8(-nAAPr6>Vm+;ksdxvUVO$bv%ArZtSYVBh3*4^Fw=Ofr$59v zzdev7l_}7eU47LWkjnyWbPi4|vzlgKl#}f_PUFWGu=KE=vzggQO}{?}V0Y|aPY|nZ z{w?6sn5e(KDnj#cC95EZO>lLXJvwm9oFs zd(4QrkPEs@+DHn3RDKiw*2sv*Qm`I-K+Xx&(SZN%%j_j}h@7ZUpw=2(oDU~r3J8N# zbFwMY!98X%NuB#lS-dv+!E^go$E;mxH>|(uIts$>d;TSo!{hv=l+~;+Ed;*ls%F)@ zUa|KZhxH7oPcn3o`gkgi-90$g9!#aXw4w3FLoCVmWSTGq1N-(wB?U#Lh@G;{+f`>U z``w42eP)YZk68%axrq9=phM$k{SF#01QGyXYZwThb@zxU)1P2(U^$gfK`MO^%PYqx zJa$8`=FXYpb@etJiUgCk=%7SJsD-iOc+pk`#5}(IBWtO8DZC7R<1sRG$oMg`FdEK{ zS9!6Hv~#i=Rdts;z7qxGbYrJJo`vi8*|O!v_DeqS+9=SrUXi8)a1qchD?;`2 z2}N_Wl&wp>?(X)8kYT;*LUyk-T?0Pcap*vU|mfFWRTBrtg zwZ4F?Go7{4^ zDd8H%t!)O9wmca$Z&q4GAkD(an{ipik0jfn$?!PXMRT^ATuD}oQIx?>u&+8Qv?%d^ z2pLNHMMPvXwk;@B+>uAG^=qcQlXiEuGIq96o8E9;<6STvo=wL~YM&g(XRr%5r9ml2 z$B0*2&DA5;kYnmzB}+EIO_2b$zq{#+*kSiT69a*}BdH5$Zf?tvNP8YAT6W>$u23PK z$-oz1-MBM-LFtl3!)UkDb=>A-z+?H(<+v7uU?ob1G@ z%a=*}p2)~sUwuoXVpG4DY$S}^&UdDpgP(?Lz5vNjxFi3QO#1I8E6mLQHd$HJ_&;fI z(TUYh8ce{;!0VjwKr@nmQQt61Wz6#WDGM*2NTt$Ieh!AL`Lbs8b9_2JBqY)O#R&m8 z#77_FkWPJ=gq5nNH!5f6W%=skUsGH9fSn0D(%@;UR)_%W|i+sTgC)qu1ZG8$ega&h|@Ev{RJ zILGc1CMu&h)6+e0>U|GUP$aCAnQc(daVFFf6xNhD5`U%%8h`e-dD%A~=e>y;6E``P zC2@8ypX0ezM#l1|&;R&;Jl7t2EOevI?Zcdp;6MJ~Digm4 z@v3Pt8@l`$o#bJE!yf?ydFgb^nm9`XL2w$DY^MF>iEI0&(rQawIqLNLKUF#~nSHet zb{2h&OO6|-(u{QzYI2`=?lv~THkv=8Nznn(-4LvJMjRu|S1du2lKrC@PJ^?k`c4wE zy=7pi_d|*x8c#AL;vLM`ao7R#-ffl1WZyKx)Gql^V3oqj0@{74$ubw)ap2$wT+MJc z>dIwTcX#3A@W6xp0sHALex|j10UI2Wl3y$qGiptc>MM32ZFIS!NYJ^(4;+WP-i#Ll z=TB>6;NKC6tNoj;*|HpSU`_!wo5XajI8xUa9JU_>`DuQ4afFXJS!{nU5)FVLnqEj3 zn&G)<2IMW-f3TgOjzI$vCZM!4v^`mFKXkyQCAV*8vRRJq?=={Na8Qw*`Cy-w6o6TQ zvw#aj7jp<)r{U&m?!G*zf!qud6@p}Tk{kr>t}+aMcdb$aC@=(|2x(VtS+dQbai6tN z{jOH4#xcXZ!3Ud6RDS_8698V1wxX+jMoqfUjGT^Rq*Om@=f>pf3wKT<`%?E_7SloW zB-0dUdK^{Gh$7a(?Y^VS2J|OB z7uJNdZF~?#U~|+=;a?_x9EveL)QY7jM6$KwL1`@U+kHld=x7kdmwkgCRnPk>dyNa0 z^3@>bY*F%m5KEf$;7-h>2&~W5@)z_%gBgu1!c(mu#Y_>P1fM*i;*o#4=7GS!kc{^9 z4}>>c>liadL_u**_}7!pF(>rE4Adr^0yUstwm^&15IAduSJYYbb!?m-Js_Wj2W|j`&~wYc^^EY6>4-gl`Uq| zB@9GhahQIBnkF-;enjDm38VXrDKO+4E7Fh{2&9v^TU>*gOelZnS$Eiz7sWyzml zTJA7#1IM>&D6f%8CEUlZj1@nH6j%HJzCW7Ik3y?30BPn7@c<30x3#4u#$uW~=}3s= zGKUM3T?l^_w%{k6Y|^K>7M5n0uN&PWP4Z!X=QsNKZS*nc7i6aZ%eCn)FjW(&9}GS5 zx|+l6$@1*c0-t2PpVWXF-L`uAMaL^?FK+nNG*5zPW z9{)D{3p2A#Zx)l@6k41g@>SKiSM*oDDCXO}=t9z%s?dtI6O*R{ zK6&CFdAF>|3s*-a@5=$Qu|^pr35GS=)WSBpRbRtVpfypkct0CPN5_i685s{$q=&V` zgou_K02r)P7Efx&nwT3ssi<>Wb`luAMZAL+lW}a*MV%vA8MNprG*AMkAt1b6VeNP%oijnLvk@et=5EwK`CqY7E&h9W>_R1GM7#c36pqz8 z`!nzofo@J$_yZ&fZIn>i6&$QWlkv_*s8Z_vQ;rn-~j;7u3-r%ka?B zCNH80r7clogX)DIN+3g9*8<_?ZNYCdn?aR%{!EjJ9(b|L^c3-^1J|a`I`N2t6&L`E zu8@zTkqsyMIN>~c5rC<&Ezilz=Gx>eE1)F(jkgFl0a!ix;iJy!Y8^7P5>Q^UJaw*` z0WSKaaWHv@|1QS;}9vZS>zXciAp2~ z%e?GTTI$J33$+(jkJS(j?*e&&2K(G5g4%x;etJYl@W_aidFGM)XC4!LL77eTR~jO6 z`{5Hci$RqhS|(Q==6Nde+nqiA{cw(3-**K@F-?0Xj z9-`nOQcbbUHnsDU)djipUd~A>LSlwnWd&M_HD?xv$O6D(n}uc4z~q79lPnPIOB$FE zV7ksNPa;mr2h!{SojTHQg8jsk_nr;NF48B>>gzBcZ?wC;t(WnA*L2{IQ z69{6{0`A~x!K2U=97IN#8{yjEex&g`e7(YdgTCp5+W#jF`QJ@t z7+Bf*VK)Tg`U4NzBoTyuY*=SKaWF>o}On~bpM{T-zUggqE(;$kek3) zD&mY90-nSfOpFtQ5*cU|USDV=MrMyvT-MEHcvHmZ6yKUPVfwtV=9C2pTfn{jPKhSBb zYQaP_vwng$RX61=(4=KyBQK$Xh6M%E_`g~P=axKtQxrQZZ3~)kK4TgTjRC!r=b?C2i*E27o86a;)-9tZp-QrvcgI zG--|8X6c<7aV+A-QIbxrnmhitC}aK-nye`_`)U3il-l~(Fcu&Q`B;m;qSB+VEkWs% z7^yE6uNzver`Mi-Ef|v}l}2S`N6Il`wWSII_^vK<-w_q+Etw<5+isLnvO4?OgIyo; zDX#f>Z_D~U0)crX$ZD5$hHU@l|FyN{S=Ll(JH0D^v;KIsyJ95(sQ?5XcvQQR?>@_v z#i>%RHG9*7>YGc4ilBlZJ9zbIVh@)hB}G=w+5v?k@5?)gO*KH#2``>%6n9-_bK&elW_S@{m? zG)&Y!s^cI$Yap8qR(W}rmPo}i#8Whc6*0EI`8r35pT-0?*;(5=d;#ezp{=lS=f@L7q2kWf#s*c^FDLC_H_G(yy6-PNoI|2K zaNTE8_UQ>WE;UFC!~{qN=K1UMMlK;~Vp%D0%?5)K?4;-Vv*Tkh={0tZ;$Zuwn4_h7 z9q2g!tD~nRsux5s7l3fEO-9}R{2fk;1jZFy7OCF~0Ef!n@VsZHxpeCj0X$GzT%GWU zRDQLU2jzJE{DZCPBmSP^Kv{FB{PSJSTx%pssxI0(pjH*+U+nGaMZZ-wXS+y_N7;$~ z)}eJlcvoKVJypA%aV`49Pz(~ANnb@IGoV=$3U9)Ikg2P56u|Ml-A|wm-)52)#iM+Hu!s78lm918K`axZ$ChWNt z&IG%axML8moZ-W>aVj8OX6iq`LEJC(&=J%y5nb)YU)G7)Z~isZMW0UY!p*Sj$NMUJ z^)pFJui&T;Sph+#aBCXO&cu!0&UXM$_7=T&=4z_Hrf}Nj@-N2n6Q?f}@oWNl>aIcu zG{B{0zS2$*oZTPMt7eQ5`M4_FL+<&DVElUsUG#+}>OqO$?8F%@^a$ezgtMA-LIv6% z66j5~n65y&QWVAl*94giMvjO*l21(@r>BlUCy!R&0bPgfan@xiu4MGKyXRgOY;NT< zLJ`hMNgyRf%%Y`!7A4ldP^nxSA2}lSR^+72oPNe~k0In>52YDm{!BV} zxs^9Juueu?jiB5clj34uv{YShF|~V%BOcQ9(&SC4=()cik!9FAbDK27#IabdS$xNB zJirUwT3-eJp36DO=aHlChMR$K?vT~g@jUA=EXv0dh~S6xyNl_b@t#grp<#Z z&=Sb5F>Sz|`i`!#=a;XWXufI%ltyEqK-;Z$jIiLCL?F-Xmz2~o^30S-)^;%>r-|wt znV*Z}@TmC~y2jLrySv8)|5;vA*4ribJ3J*gF=&e8E^ogn3vVU&rgB|Q&7coXODAm+{m#wmoU_mpzV8g2cK`u zBp?LsN}FAJ2ES(BxNWWg9*@iv{BwE$7&HeS<#(_49wbgS>Bb38pVBe3j!(5N+r$K3 z7Nu#`7Q4!fy7!)@pE{RMwJ&V@hXu1UR52VJep#`#s7-`loBTP4>5glv>n(AlERL59 zi?{h__i}Fd0kdqs3=R=MrK=tHA4%1FOzU1<^X`R4S#AR36lB~WW2Dq6&&SxXG8y_h zuGL6ek!&NW*X*-~xOYBT~^o5ob8CJBVInP)=neN{i)_opkISr>vjPTv}W_y;ICS$A7Y~T{ETp8KL$)WcF zZLnbuj4eHzti%>jJuOJ((}e9S2a&%>Jh}P#hr7J>tc`|yID>UcwqoFsdjdzEW(O0j ze;b{$>yQ-&MG!jPU*-?CL8gZ!Aw0v|GXRg;>(yCBW&o}f9F;vW4#W?lNWBTL=7n9w zI}y9=(j_V!_p9o^ahVX|#abkBBJu3At3t`(nKco2%}IXMt=>tuGt1{rAU zqjfk)KVffDKYbM@eq#DEF0YIK3ZT_E9E+Xl8rwuJM|APQT0nBKK}@lKhVRbCaYXHj zpT*B3TB$sTf2?ll?)Vf*Athzs&;Pn&;Nf_AsHgP#xcc@6WSIO9Vu|s;Gu&9&|E+CT z^?%JT4o^M-u$my~{vq34{TObVM$EY909J9*(C-8%m!i$;6jX2Atn_->6}>auv8Srqmr ztH8M?p67G`%=hb4%&3~IPGhd-($B!@W2te8XfX!0nsgIA%FE}?xlQKr>z!#m^W#Be zy@ZYOr)+n?pXycr@!2!qQ>+tRFp;PA{o(fV))iT0a-D_qQGA){h%&I8Z0BEq8N@Dh zVl#>3MWBUYV4KFWZzClT#~PBP5|td3?~`c4)Zi#>NfCLMF)yA0e3@82G95*3_pp`&pO&Greg0V?m3iY?W$74T-ua z^j0rgq_P<4g1--ITKOp3E1S`emp;_KMA)yGThcYSnN_}5A4t|3%) zl@&hrck^7CuG}Bk&0!)x3sUQ0w?H}zUTTV!COYgKF*|Xinb4kXUC-75&@qu9YOg%G z%tO06pp;x{7u30a)-aTpm%p<1VK8)4bn?1^@?eI{kRYD@xKFc!2#y`=f2!-t$1+#^ z_B{gCU~D|oFOIs{)^*(b}+r#S?1(TX{BUQ1I%8Sd;2X0JH zI4Df$T$~X#-Vt%ZENETeoq%ZQc=@1L>2o*I8Y4P#SI8HepBxmN_34$pd9&L{OnKbt z-ot`LoWkduZjUPSss@;t*t8(5!KORwIW>!FsBH&RGffKa59V+HGt4S5ixGGnW(Ir& zXT1pZPbW`SeWCq@ir8H_L4iZ7NNsjAa=L5gpU6QLNv7#LC?Phx2{IIFJ7)@vVO{Uk;R0$!C8=2--E7UUDqy8=#-;IzhjIE! zLOtz_XO)}=@}{yH7*N+Ns(1T;F*-imPIz|=kDHi=f&KAkb!|r6Xk!I>Keq^(ZDn8G zkSU08V0ya`nSEs!=@5YmQ|FO%A#5b)ywS4eFj*i=%67yLK`;w@fz*{9xC0V9)R(`4 z#Qp^O2K(Bg#@4Liy6k})wg!VRwf~bjiHlQsx{SLGJlMCs`(#|qV*?=-5Y#oLDT)NX zj@VRjELh*rq$3x2QmW{i)dkxYkLlyW2HTscJF=ZcHu3rXeK$kPYm^% z_Hwp_85U%;j57Fr8A;nlPJHV$dvBPnZ)NKDjUZ>o0+7MIcnST{ zMO4K!nGj8zq@+Jax?D??TqsegisIH^lJ;zfo%zZrgx@|?zO#)< z_ijD;7IbAl_q<2n{R~x~d^RLg_om2rmP>YcgqzGh_DFd^Qix6;r(X6!c+?S?qDOjL2oFfX{V{J~&(^yMXfC%IR4&+xS%%YL9|2DA6#1V47!%hWwZDez|GiLeU|=*vY!SIh5pxDO>vilX;` zudv!8Ii)>XTxQ9iXbFzz3pSUL{ob8$%L0BOp?H?PeT#+ z*#&=rNQ~J!|B|@O0+vhaBl~PI3&B?(3ZECEm3cIdOKT9rWSHnfBEqDXJK7eu^Nzxe zPUvYJod_Q-nqwiWq&W{r<>QkWsc(p>VUR918c1$>ZSmDAmtkOSj#3L3LkQ0cL{h8* ze6qs;>eF-Ezj#tx(HcuK;biL(d&XYa5{w_$<<7sk9>K&!fdrbns08h1-tG$y#sW35 zM8Fx-jT{m*-W7o?roe&qj_rR}Q_)?mC>Ob2TpJ2q!{=!5t87>fE}#x(%5&ki$Zewy z-^F!b@S8w3kzj)OU&0u(w)O#aE#}Xz+Dp&@;7vUXsBaQkV3k78?p!jSGzRC4q?yC3 zGOf06uo>`5rqK5`a!VHE& z!wk{~j!+#3DN3w}1d7onYpxY&5AS^+sb;klpODEtgu_b+h^!1ay9HUqq6e!<>K)go z2*hx!a)C1_d?FA=p~y7T0f!H4^#4RG(N>q>-OxQap3{WHUX+UQ9nv6p4taaFQJAAF zGYYD)XTwbfY;HFLDL^3#gWBDGr~KK;;?QUG9dZY}Xg}@cJlV}o0}t%|(tk!JbC|#j zSb0;Y;e?9P@)Suh6&90pqBFd~?0=1fzSe%VMI=0|)zBK1oTDAxj;asJ?rCILosSeQ z-xDKloqNfixKEptz@aMJ^A*Pps8M3fqr+t&x|}> zdYUc~|CH^}6$(D4PNH<*tCYFin54bhr|aHJ0`DDAZTvM>czo4Q(MIb~sVt|R%CO;M zn_X*ovh`=fDhkP){s3#$vO1N4CB;>N+tTZ5ug<`aO17fyVGu+hZrCG|w*-+L)Vv$J zRRxrz3Z`&F1;Q;dS5o_r*%!zxM(@k_mPa8C+8l1mO>qW4Wq0}h*@Olb=I*``9;(o> zCzE=vW%Vi%rItVz$bu(~+C8@H3}|%FcD-mI23lU`p*eHjfzl!+aMkZ``GIFYB`d7z!pXWAn#cj@=y%H_(DS!Dm+OZvv>lk>Q zn|s>U2r`YI|9CUqQ{XsR@;f1V1y{tMCpd(#nJyRE?X8cJrv0HTOANUbt_o{Eu>3*I z{pTb>KANgGP@O-GA51|2a^%{8u|g=s^Yn{gII0 z8lQ`-5xT*=yu|t-r2F4(r#R|3p@>DtEewnXCW{2hrAI}i+q(}UQrOSX(a}+rS!3SH ze=REB+W&lvJ}%ChB4&Hs3_sS(+5O)rA70!~my=8HZj=9qZTrUKbg-BM686m|w%+(% z*CqYYGieG;Z*c$j$-gignK*+_s8v^_cb=K%{U;o~S`SZk@uPNJTHsm4v}HCNi$00C z`)L~P@)u@qS*?X8oe&FqwuEQ#$RR$P2OSX!S+A`{pEQfSO`O}Fg8g2+pX?@}XAaOQ zk(rFFyWd)Wh@!*pp5~$tg2N3Tuk3O1ZLgg4+q$$LDhJ2N{_QTQ4GmM{K<^LVm)HA~ z=7k|*patx^Kr!49!|kasH(D%Kv%S&2q5w8-OW`$;96nPwWeu8s4D>9MHqdv^pw7TC zVbr7Ho=3n(&}CTY^uwL&vVrS2Rcyv#cAKgW(X^IN2b~1WbmnA{*><~RFUB9`n8c-AB(_7ZWKjIvGK{pMtNS=cM8SaF61N5#RAi&%jhyZ-MmZyy7Ojef__?1dar%NSXB^f+NX}AnJB% z;)o8=2$+9oLJcwds|Ky>&w=?I;){$H+>#EHSop40GQ@7OyK6{li<5Xvw&>Htz|4JI z+vc+BD|6dclwMnXfx7~fLFkYvs883jTZ*p=IktcFTacaG<}ab=h^zHDt1)2a(0_iOh_25$lL_8&!%n zJ}46XC=UWd;-2N*t2!b5y$Bxm(VPZzGDhORkpib!SLHRmJcTtTwIkN;-%nBxr+5U| z5T?<8|Lw`x_j@BDPE@i|V&jyUG(uB}yOY=;W+#u|CCBllww=%ypG;@O_In6f+{5Iq zCYH7BSerWi3yx?Nz{uU=3d(8KO3T$K$gDoBq{U~n6M6V)^ZjA;J(htY4e-FX9;D`0 zhx7_K8z)(ml=ZV-+;LiF+ZPj@YT=K}#aK0mH%t(i`tyVLrrY|(?U2cIYF$FZps9zr z8m_H%5`7a6{ALUwlEa{Iel!`_8Quea9rm6Z2?R~}vCsaDqAz;Y)W`3vbpl}OfYVT_ zUlqC6YJ(jTjslQDBXg!&)H_Z)N%*rA_gWcxiXx=1Kkn+*0XPtY{yW4h$3`F(t-75? zOL!!6EwUk{!|EiAG=)>`J0x9im*AkyYbywX+%dp(rF|mfbiN1lcLL*YnK`eX)-)CL`>yLPV;83k`p$UP+AOEY-t>Wl5#|UL9+2IINVhceP z|6<#igQZK6%XO=3{w0r)HC3y`1_UUpl7Zx*hHpu3ci@24Kaybvy)>BR=|4ZMBJP2Z668}_ar6tlquulFB!lZrVn zOlKy0(dCuo1N9R<}+N z)cr@^z7%Y!F8w>jBh)N7aI>y6Ufh0tIAz8;65P|O6KRG;XrJx^`U*3N$(SU3=@zpm z-4dD1BH+kj@fJd^s8dmi_G)7^X_@9_QbQ+eMO|i!uj7~_Dbor19|>*BjE={k#l4JX zM=MNpj}MUTim4jnzH$ds-zmY|NvTNp&>Nv|?n0ZbBTRB#Uulb%L1vs6BOWo?%6vRF z*z*^41c0@1@J~KSYMVQ;#ZS);%td?Wmrr+@$Rq=j#q=2pkq4ts%lBg_efb*NpQLu| z8Lnc6yd)>Z^b4qDFSCOfG#hD|xrI{M{&B#?t4ekxMP+vNeq!ns5!yKLGV&L6y z)BScfIWQ^pQ$#dR5;oR*otnA^3hMUmWYBm9qT810Ze|f9Y^XG?e zR$`%$aRSn%rYh^A%y4d)Ac4fNDP}@M*yBw5-*DJd1p&}Vf5;09oCp{ZqDFkbFqNtx z(Ebp9J~n1?Giizzh})*ubi=*H7kRswdeUwq*IzpHD=%~>$d7ZG#itumzCJRONX@DG zXD#m^2{cWy7cHSarz^fGuEDN^hFox>awzmBL9a=8pPr*Vxz&XNsqj2`5-IDlQCdF= zGM&#G{};lrc&=R5aIe1NJr|w78}XWkLSv(&*Ra)2E5C? z>soYisU=1T<#fBu!oC-JwUBT+KTUVB1t7YVh-|AbX{hzY7?u#uCELT|5!0NTpxT3) zo*NO1zytRa$7M{50HUPPEh`Z1NDwd(4O16$)yTlVRjCWralY^~g+^JWlx<_vQ{I(Y ze589%6mcI5wp&l|)PMpGhlOa&J2=zxt@<;1lE=imD;CT`F0@J@dICv_`vewB6v7kk zkHZDB_z+&5PpU=nm+CY|ov4biDVx1yz@ZKz0;^VwV}2Xk-FyfT2I9nrCQF|*X>8xV zB@aD8LMjG4>$okhVJid_6ywKH@O7!ImKH=J4J8!SK=RTx(Jz{&BGX{f>T!^VeAs^u zK<4J{ok3f@Iy}N8kj>%}Y<*hrP=0qMKQHb%4`nrRYDs%@wh;&&bs6B0#&E~9jk+eq zV%@)x>WG*6tiW;2BeC`?R(onvj+<6_&LfRL&bwA){IyZPgY7)|Ops)rFKPdKa;MS$ z`%@yXpmseM{fob?!l(fjAC0@KTuqJ0M&=kfxi%P32cj4V5^~3IvgVkpta3}(P2|sK6d@Kx3F#_(9{K}o=dmzDW?G?^}+KwHS>X~e{hcoqYH>B-EUS=_+rgbun z5H43ZSAazv=eyymu5W*FH;xp>YSuk!tu_+~2?!Z`oceZ0YZ^efNRB#>_i6c_IVh5% zEZt|+X$~E4l_JuG_M(FlFc9d?xJL}iOClt6Lt1?~mQRvV`jZjB8mduR%2o=J<)TYT zf9hLCfi2hF%Q22ICs|4Mw*0jI;{Eev=LZN z-U3*CxoS3209E)=nA*HtqXhU6N$LF|d*h5ITaMcF&Uv|^92at8aWqm>Q;VXr9?q8xdADw5n38y&8s@_W0*U^61TQ+aaOWq)ZoS@%Oy=%93@Z>4C zcaHc`Jufz?cPf2#u5&UVn9c;#=~L3Xcn$|wi+sWWc``}5{(tFTC{IJd9te zk7IP$Z7=Na$z2q5*AM5L?XxW>WZm)ek>~Awl=JuGZqEHCK+Xyk_IFn847lYtuz5D% z{@ZaeTKGRF_urZEplLvpS}sLvnCk$!AhGE-k#`9V^8Fu6axZ7dD<)UKSsEzss*{PCDAW9(sR1# zIBImViBXe@(d4Pq7SJ;rDtY8dlyr#y_8xDE^t z2VSK|Uaaq$hw4R{`_JIQB;%xtr;k?9w3pGh&!cRm?vDY3hI#%Xmq#Zoz11$;+Q;ER?eS}9a z?xGO?=|Ul(wse4)r?!r%a2$L9O%x(RiF(Bm6@J87ltg2eU+n{E1@(&A0}tYyl#W`X zb&5-onif5d%CPzsCUIKrtW)6nrEm~%tM3&nL`tmOR5P|U9+xmd=Rw>^VEdcBeQ|Yc zcZi&3Y&ZvIX)(IZthh3SlN|>P_vKB49=0y4c#}O;w;9O1mF8q;DD0?!>+SMh|J1`1 z&gnlVQ0Zy`98qoP2$9xzEF_n^86?wPUzQuV{hQsPHt%@U46LE0<_#&Ujm<DbjXIGn1E#GGhA{AjVY?`XF zMi0iIO#PxwsGR>=SXSfr?T2h6nnecu_vC47=;9BL=GfB;V$I>mdVyVAZKiuRdf1#y zx>wv4s(+B;4x4yv?<3S?+eTX0&8Cf}2WSTp#8wQ4WKF4I4NibNo?M6`pS$n9R;m6C-XW2 zk=PQ-1QhGK*(yiusNSgms54kdWgx*qGRgY3B~>k)G#~43Dy*O8K^m&-#hp~z547Z% zFPGh}4Tl2Zoa}8s=rsvLq=w$1-PYq(CwBnhn=fy{%mMC{1BViFMpQVy2Q$D6 zg21Ke(#k|hyJ{H=y|LX1PADK{T+hPUOb7p&&$&Xw?+R~Wrro-l&icT=g><3+tWUiz zMV7$zDE);x54#<-FJk{Qaj2sX=?1B(;#rZL2!;d~;jflD5=I>&3(10@k&oTgaROCG zECM#$jx2A8#Zq2UBO+=PY{!2~Ks-fzE|*F3wMBxC z(U;ud>P~7#@#TKupA{!<`(XTi&iSh=l?hT1;Kw5tPzq3Kg4DZiO0K4Q=4T3&h~UmM zu3lTA%uz67N7S!~-X8(+#y~5I#8nX@?!^w8^J6zqZrZg=~J1Dp-kTm40@P8l*Q_VN+HH zz^1bWoR+$c2yph=#1`&qZQ;PBDcbg2rFfB?*aXx{bVoz((Al<;L)ojA8e$NItcbbS z8ZkH$V(@8g0LFB~*T9_Aj;4O$<{V{9xMl%k`?DARZ?77kE6_*+Ee98PiUthAW#2; zj$-*=?cOla)Bm^XOSjf|>`@y+_s8$b>&rBW zI2eVbijEGGd0EQ%5n^-<9ijSSEt2%sPtbVeIOeD+n@#U)Xx`^T-r@({?q9wi8M(fU zL%6?oqmKa7#H~mWV4~8yx<8(W_ix(BuP+8|Tg!!mV(R`MFTA6q2)uZd&KkIak#|yO zSEylpS6c7r?{?qoX!3RrRglwi);sri^aw}wGkhC_OSVu~QXEYlr{iP_KY#V-U4yf0)uIzofJy7%lgNw??zFYA>co;o+osd6_w(V=>mV1;vhf?Tm$yFb(GF|4Om(*> zg8882KKzM14<>eVp-pBVJ!xc^6-gK=O+zmud(8r_8hWjjSpr*s(J)JhG3k%e56Y%4 z&tWa>K>^Akwg%C52e)y2)j>Qnxh2x*N--~GxgIk@n5TcmQSV3Y0~X~hrk?{Frz^Gx zKXYJyORb@@1#1}Ud(ZGIoXOj7{wH{NFB3cB4o|1vQU=yJrh6_NNW{b=g|vmeyfPOQ zO(JhrSBOnFXmF;8x*aXuK#&VL`Swj-Q~9*Sevy&^gYhRhRM%E4^GiJnqGJXqj4z@# z{bO6qv=s0o+mzj$NQaRI=`Fpyo;-rQOfAE$8qpV_CW9TTtLui{C}^Wc6vTVu z@EB5-`Q-cyj@=KGjtv>EqTyEi89(w2hZe*9SeRz$o}TpvQw|xYb#5UlsDbwOZ<1v5 z0P|`;7RfFRrB{lneD{EIKpsj7RsE3qcZg@qV}Jd}b?_+dKG&&X0(TQ$6x1#LL6aky z;nog3jwM;W&e$gB*gfyv<~qT;wc~3RsZkW-4D6Lv=X8;zy#o^^!z45R>d7z=?-E`TFfNHIl|gN8DYT1V z&UM7-Kh+5-L7S&`Gra~%VqhunW zx?E%s<-s4c0a3 ztp8JTOC&8Bg^U_}ge4Txh1gxv3hIG^;j0cSOE{(QTv}C>oyoW!D2H+YZy+>ig|PPy z_k&@Cy;Co7^dl*yJ*m4>A`z26fUDKWmq8^Klf!tfM{KsiJ5n;ao0?6mQ|aUjKVQ~VzJpE6YCu7Hw;ZKaRZ7IbJP`KaUaYo&kr!nt#@u6 z7kNHXOJtV8x<0cJh7~C1H}85belNmQRp2hx0+0b*l7~=Z=gbBfUu_lZkM{RH(#=CH z*(ETvykn>c2-GK#YGz6vhzd{h&l0SMIt&PGV7LXMmx2a0OPoE@QOkbSwI1Al3P|@2 zc3*P>(1ubCiD3G9-5#J+Y%`#IotA*saos)j?r(#S-4F{uBcMZ5(v1qH-!=qNTst+AnT_R#cKP}vIJ=s#@bk~d zXg?JL7iNp&Z%nyYJ2pTfMcsBd|DO$0jZb$!hhrI)vRe%ur;%fBU7gV7g3b4s(sYij z6pSj}pn}QznTL;5xCFN!UL5=`I(DSM8p0*`bc$I%U(23v)CtzUCefKQY-kAkU~o3G`Bd!#xcKTk&hl%9Q@)N?U+xmf%LGlOKmH#ydauF3iu) z+kyW%9WbYzi}}T!hM{wl{s7I~cjuCNc?TNS4K4Ri44@{iW0(>>)>-O~sG+Bvwnf^C zo0O4eL*$d;08jxhOPJb*7;jS9vi=J#9p;Xgr49yZ97-CfTdFk@m+)-55f{9fz4Zb31{z-CKqLD)xY>oIP{% za7!g{ID*fJJdOWNfC~fWN-?hJeTDRFS6jUA8vF?tgmyNPbwK-j0 zMtuthMzG}$iA9=joY$eF+G+j@wQ})%jO^SWsQ2pEs*ww z5hrnX_(gfj3Gwu8&;r_9`SFR^5kQJ@S zwtLk@$_{NE2gQ8u7KFAodz3z_Dg%ZmM6_I@7h++&PV=L{Lkw`<`I zYY-I`ZhUHEMSokD5VlazRZt!ZUui8dig;>e*KfFj)$5)xK9RJTN|S0;lfhW%lVOx& z?-@4!W{m8T#ArdY;Y{g?S<4*bE_xKR>PwvMxU6D=b@J(Syy?3n+8;{AOY~SH(?L(P zI;@9SJK7NeW?Wk4sE0k_Yh4Oxiw*9}3pHVFxw~=TKa@_Alach@vziDvl~TX`-clBd zQN=5{edarg&Xp%coEUb!nmbpd>Xwu*NmOFw!k+K48Gwf=aSgB=o+kKjLRF&@4&ST1 zI;#;LbBlSTEvjUwr4~6IC8}Fz)^$iN6Jvk$jWgy+MN{#>vN#&76YL@3=m@2g8g(& zkQI{+-AG1q{%8-U1fniJz+Ul2EN#D9LGS;Yy0o%;`PWyPR3e-(^QUEB+KHm6JH!<# zrbHj}WCgSAz1|J{0ez$@&YfyPI?kGw73v@=-NCrPD2IJ5FD_`Jy z{}y(fpgZ^q&OJ%|D3)y{^upuDH}O~(PwvFS4Yp&Vt18F25KqQ)$(DBamv`Zg-9~m% z73Hsh72$OPa>h^7Q72SV_H)}`*A$DqNuJi+xx3q0KN!tl-3oMKI+G#s8aL4_S>8r> z$F0Z}#r|TK7v@NLeG9DQ%RJ~;k&S(L_hJ{+lA57#-1}>#a(p)Fg{;5-;u_x`;_6y{ zt<_2x5FT6)&m{Vn4?&H9>FUAJ3{^r;?HV?Pd0Elj?Lq@YRon0xqL07_NC zIpGFP(*6UV^)ObG3UV+?foIqDOnp5H#n(|9j{md;qE?m&WjgpXPo_9J6;jiyX2ppH zR#1zpC@kW3mh)AihVU?n>l_Sx>MF{3ggrs)YvhwKBsM>cDIxXgx<-4CyZwL_V zD_|sbIqcbK2xikEj6klHz+F4#*iz19)2L>*F_&_W`fj>9o9rU}KN@=3C?lEq|E5tfy3kG^Y&fe57W~nlfn&7#%n;&RDX0rQqou63%(r zF_^Ky8WVf9U62*py{6ievtXs{9u&AvN&NF=Ukdd=7Z-ZsnO_ifsTTW7?M+=n8+Xt# zm2@8V>jw)I)Izo8|J+5>-vH7`$J^dkm3J5nUyN9U>DZAPMHZx|{p zN0}-C(gOJK&!g;N4pZk}wgT3mqww4K8AD!p{jnve#@|BP=zvI@d-j8IaEr|%o?d2A zeyWzFb$un4J`)U1SQ7*n@XesXU$-6(0ofY^hyO|(pOaVxP!sUOrfoq+8Gqq6?j7by z#JXi~Q=~(2LjojE6C4R&|M$3y!x9y9T=v!yky0jc{iCurHHpU#{bd$9P2E8GpPW7hTDf%b-iumeoq)@9FSt1x&BLrX#y`9!Oli3`e-#$cpJHs-EKgvCTiT?nAa zM}wI&29xUwtY(g5wcl2)vU>q*gaBN?WOiYhj$Dk677W3%sAzN)oUH_Ak(5kfJgf!{M4C25Oh~l2=>v zV;}l@bHashw&mT=o6<=Mb&b+FLT7fB1AMJR8?YFdgi^nKuNnEgzy8mPJs@1I$a zZ)$(?g6+CPK z2y3>BplOHiDWl~-DM@854jr-V0$>e=!sc_ftVRh+J`>zd;$Sh$+0pR>|$?}%-6qQ6We%RXw z&;`aP4;}I|B@b0a;sq&BxPE_6S?~z++O6C+eQ+5saEOVl>+19s?C*m`D_SSF(=b}N z2M4X*%}nAig+VuW=7op|NaUGCLM$=A>85|-bNpwtANr-#!tSY>h!FVkXJ3tM05{4Z zCA_>!`QRoM0-8#JHwVbBq)Ay#JJ-@$znt>Aw*_RDw7kbZ2hU!BOEektO`>=YI#Rug z_Lvl#_U0is9*A7!QB|es_pJZNHA#L;N0)||L?P9?K*Ty6};G%{_zr}pyCM&I)}&E9(g zI!Oht!m(~A8%2C@vMxe2(xVk|q$89bR#iI3qQ-AHDs^QUO~o&-v2?`TdOGnpU zHCc1r0-N(f^$Dzn@YLiV#6unraz=fffr4`twk^RVPWtwxh)AN)(2e)91x5}u`myFI zkKEoS{wCWiLoe|OPg+ZQ8<;-m{DFe^8NJ%e_R{Ms%lBza7Ed?^uz1Ru(+5TK1tRIM zw0QcJho`7VYXO3K`R}CpETTZg_m6R3kl%FnD>l24NvdvU-d89QQ#cwuHjW{zV5_25oYOJ_f-3U?kgdy)OK~tX1N|~$0m^{qVP;^ zb-J>B%p=CCr`aFu4aHvawl)uT=B z_vF9(Yt|pxoE=M*D zimJ`L8f|?hZkMe1(G1?(kH+#<5O5torSqd<7O_b{1@>052BaFu5`*2yh^jj$h z{zv3Yo4XA{tT*w&BC4~Urn64tixWah3d9|^4T+sPT+H~wl;n4FFaI>7$S!vFl@6s+ z;A<&ENkAB3+3a_KSk)3~Th!Mn?-JxHBR&Y{d$Q$O<5L^dVK||?s>(2?S&;f02vt?# zmvpJX`2$&()IIXWtK>u1HWN7&z*gAxwkx$(996YlMi{$_-|k^fjO=wcKr-G}cyU0? zU=@t<(~Te8tU`c>Q0&D@4j|ei%>IITb3A%sg;}G86-xOeaZwPN;zaUc&~*i_ZjY-Y z(EC2d`f4N+6Op1bL0{WfFn4h9hg25Nd=X$-W$46pmlw&3w>6*zVZWR``{76p8M#% zm_eHWM!PkoFBe-j89ufI`YMFPiNjR2A%}E=o>@`WkP7pNH=m6DtC7)Y6_iqVVb4@f zbM6N<#Os<%U84m6?krT) z2p?%2g3tZOCJo3zKa&4Lx0VL$#nog~L}#L+{_b9>t(7n~v` z$H6nt&UFd9$^oX#7yYz^da~?M;mS3UD3Itm)h!dN=5;)9JAf7+X=e>@uS=X4x}?TH zQ{h=%utvdI&is+Gw`yiZ*5Q0vE?>Tx1!t)6X{C;!;BDw#s`wLIXv%2I1AQw z&nybltBf$S_cGVbwQHtfo6uqomjOhB~1YE|v%L0<#x-6T$iSwYPc)$zX(9V?D zbPoB-nsd@|TVEW{;{>``&fX3jMl~3k{l3gXi;(9M{)S7}bk6p|3#K(0n5e_(0uy*K zJktdnn$N@{dls~88>+?G)^mjJuLD+;jmWd3?puPZ5Y6=#@v=aa1u9({s<`LNct|ya zKy}3|;9AbSrj`NmtdhjNl4Ugu9NqUo3t@g2j5zVI786_Oom=;PENREP>FGn1UEMO! z#FR?8^RV`VhpY*no4=23HO+KKFXgk|v02H!yYU4n-)oxf%(ECL_d5-~QV9&xtf#5p zL{iC`Z`A!X@mCr8C(ml0u6UFEqbBc3u4Q$I+Ub)DfZH1rBV*^M*?0=3u{6^4=BY-l zFcr#OAC?F)TIplm1e#?+nIqwqqb@_GT>R)xRcE7ZUqyJg|C%-RD%KrS@o~Yf$nz%) zu+l&-!7O=A--(N>s6KnkjG7bq?}O?m3W&@LZ=}1}@Wnifo9G^eT7@uFmC8T|kH9{ZQmSqp>lpsM2o@^HT((&&#YEs`56W%7frY(B(7$n>`tlqSC@5=an=AKTL; z`syjU2Oi-(VFzvY8kjcs&~h=#;!L%U&3Ikd<3LFp!8PdZY*%;ICrIP@x{9*LItg_{ zDYnZ4Q6N+6dPus9>A?jzzH2=WdljNP*eR96gnJ%!hrPP_LbhtFK-bTWd{S3V!D8%_ zdcs?1_5zx0?<$(bN%2z9DNiXUqe%Mn2R0h<)*aya-Yfk<)giHT8tD>Wo)X!1Ys}J6 zUzP=kh@yO}v-eM^5w1`!htAGm3!;V`$wqs}syi339~1#>n#N5-bqYk_&Lxfkjj03pqyTzTcJFl=)iz~L zhf=$??#)GbiUOHu6TT3qu=^xkFC!0~|G`kCtO_rF-5Fd~%)KicPHyEc7{0(whgit_ zXy{4Nm}%F8MmO%hCE+(MDH*4#@sL3$9t#feIB|2TDg6zd~Z442d|G6cAsIiWc0W_ zSo%*qA07s$0Mca6AwL6l4{n10;RX##i=A;#Bz+LNoIj*$yD?v8`*$lHL|S?|r;h&B z2~e7XE(GzGao5;`w9#JG5m!pJCUS8(tGsBlZmd`+a%_Y+^Cq!Gik>))mhn1uaPuw! zn#}jMyr|%}dHFZ&0gbvu3>EW^V_E7oRdba%9dD<*HP11tMt-G}fa`5A(}f)68dvig z_nZ}{dG7lxXsO1I3#_btGiCWlo#ZB$;U<6Oq{nHS;PcG{{F^7nKqCbk?m_0G?2e&& z>n*WrY&}0&>~(G#Ij(ZYJ9)71wAn|a>*4Ed1bZRCKX^JV?`;~`;tU_oTf@<|mUXw{ zAyV<{j?$&F{O`eSpR-a?${Ly6lWc05suaD1Tx<%9+(6*LE6s5a=IA z*FpW^QTPt_{V%SE+R-435Tib=2diq(nY;JTr^`!l&pBPl!)YzYR}FtyyD`Ao<8X#` zOLsB2q9%DPl$-H-WDi^z)8_Q;ozFAxrV~alyVAe0UgOQ-YX_ut);( zrP&cEu{GcOaURQZJ%!X)Z;O7MD_}rkTe_)kkk880w4dSFdet^_E#07WnXgem`Cb}> zL7N}I@o_2&d1YU3EnJ*Wro{d4Nxg4q1P^n)|4GFE??x2Zng09Y)c;coqxr8=n7_?$ zDeOO{t)kTW5VTj)u3Q2&YE<&lBGY1zsC@xd%#c`pZfWGze(Qhm?Bo5F{hjo(2I{^c zXnccDx7%N}yPFhQjpDm9@#)bTQ3%7|(J4HG_34iPpJ2KD`q$_RJ=^+Q zuIPns5gUy}479La+LAd5J3BCBOu#FiJiZ=IYj$pKtwi#g7PSq$d-3A9D!9u|A>jVY zwU){^m+_auh=Y)-VU4S>628G6UvEJH+>VSStdx-+92ISyoDg4$znRr|-EM64Rw9pE zqt$gFR*?Nivp69*vlh*rEU6a%7;?Q6mQ+t$6x(09z9Wk} zrlK;~B3XI;A2JVZ5Ekp6Xb`o8IZ)GV%tYvv0D+Be(NMD_bXv5P%mZb8R$3c*4Xi@z z@7P}DQS9~nMw0fJOW~*rd8fJBQIS&Z)xKn{q?Uz>X8t9(;RISz4&xNa`v=9gifOhp z{xOU1qa<%_=SVEzmW!2YD@($HRzAaG8O~ISXsa2kI%g|Vh=S%xv#tq_P8%g1u+k5$ z?(YS;YilI2;|~UEQ9VL~sLm*ifD`yEFvo@c-&7U|cEUE!t`(xo@hy_r)cj7A#Nz@R z(qm-fqgURDvPgny&a{+a7Sn67>X!&Dd@4bT%kH)~;&em5`8)3;L!>53RtjypHHdko zO9|E0xUAx&l>ohQ?nqYM{Ps{j^c1We+3)n<* z8M{pn*_DNC>U;wU!Tx325BpV2g2SIA&6ySNQ_S%|5I3blkYGzMf~Y1&uJXg`;U{Ph z#67(TY#yt@iKpg_)m4|A4@Sdw&6bf}Y=uA>JTA`2C%(_4Fo1le5Ol2KuzV8b2)K)y zSi&)8O%(;F$XCirCsPc`(EE&w30;&&A_X)Kz_@^$9Xjp|Y*n=}gc3LdWkwhz zebdOMvkSiPKM-zI(DDN9KwSiEa0}ez4@a9~>JFqrC;ArwKtM;yUX^iFv1DKmXG`}qE#)~R z|2DhKDGJX>2HmH)uio*_k_(ISB3!3~skMNG10;|{q${8jbtViv(|V3-#M);_jR8@p zurGnlQfe87X_y7hP&!@Xm$vzFq)_eracVEkF&IDAl>5?U3>(DjbP4X?rO5Cq=-d`+ z$1rQ69TTln(XMFZGyOpe`Z1&io+Q^q3F>|n} zapplgU>wY1wOT?{mHKE_Qr7rx`RybAPet-1lZ(1y+5Gqslez*hSkeX>wb|2og*Q&5 zd7%hs&;6k3NUhGCpjv+(ya~r}KD0$mwL?{`{-uQ0hPSCtv-AtVvHHys@_a za1+fX1Z43@hV<(F;GX_H)&A<&W?H>!c$)vlPiR~eDwI@nr;9M>eO}^MPteYBb9L;x+|ZYzNQ&o)e9G z)?i^P^QebAs%?UW!XLqdqktBOnoNy`Z($PJ?D$MW07nQbW%WegMaBsPzcfWrK-50@ z-4bwPe-CL?+-lay-78zOeaO=4AJFpOET*RwRn?H^RyoiRtKI?C`IDt1Nr|FrnxyUj ze~i6jcOU?pZCObwwr$(CZQHhO+qP}nR>ih$Yx1rh++Nck`d^#}XYV`e4Q-zJN=##S^|q zXJ4iWhODrTSt!i~oJXG>Gu3snnbI=gv+{fd2eZf^;U`(jWM=;h16xLf+Rv4$Jm{CA zWW~Xt5>jjpf9uX2VB?(Ac3Jhl*@U>Cz0^bp08BbUKTjdeCLFP2n@ zz2Lvy4V@&q2k2`(WJtAPg4>+fypo$ZbOB7gWVpL%DPM8STt@?QlSsm?Jq?G~e>o7kR_aJwuh=1j)x zORpK>kFzx{YE`+Wmo>+UTO*ASoYu!hYmMhuB7hCfNrh4V<1ZT>jvj3cE}nndcLqA& ziMt4xuARLJGe<=YNvwBQ)6B-@uu2!Q0@~FE>|88=v6$!Ym6Fo|DMwEJ61GNT3g#y@ zt87xvmv{p2dw0}+{+~*nYNW&;oYeZq?a>SFjk8+?!VV>x5 zbgME}O~uPImZ?_+Q++6C%PseS15gNbQX(nkBQX_X!LB5W)UfM5YE)Y=e7mIJOrtr` zLrE=Z_2f3RO4>1|KScTyicORer>kKc8tI7Rmv%I&aZK~V`OHjb?x&^tL{qvIUk~eQ zRN>o`n|S`GoD(!j1_Nh`=dFXR_Jwzs0+X&hZr9L+qGjq7lk?u-j*x}1$ma6TX*Ed7 zW=fP_Fwn8kb2+5+0LzWg0-J;Kaw0v|@Y8$rY%OkSWv8^@&QFoQ{4fkw^J{4I?F?-< z4AbPV4wO-=>py<@R^A5kuAFba%Y9^`zX?AgQ99Y5QdONl_o+VsVKque|3kQD`(JIy z8R^(q{!g6iv}Wh8ARd1D3;EqY{>|r4APm$hB%9`kNl2iIq{BY63*t}DTNyzlQt??% zI&)NH&v}YagW9a(aK_n6xGdG@K_YS@vyY39$0vf#Clb#Oht|)d;roH^F@tI%gp1HuQ0mw8 zVBl4J@5l@8UgK7qhpeG=mv`s}EEW#wKHG9=EX)qDRHY5Y+@HYZhGUf8@t02zjFvHtGyU)YYry6Jnc3b*CD_O0fm&0hPTK>)`wg#-6zsGH>iYv4ZA z;l&PUB9-aB2Bp6d47~K=k;o&*P7rKeW@T(6K`L%=HShLFjUQ|eFi~o`cIC*Pty%?H zmR6zk`a?tz?NxxTc_A87)eoJzx1CA1o%1F6%3BU18S;57;li~}L;%8GScM}1VHi(9 zE)g0(Noj;NtyZjxH%YR9cAiyN1Ll5X=lz_^}LypUP)hYU9aZ0$}C(W5Gi^$EeC*>du> zm4BYkzlVJq&|5dq2{MlE3X;##l-eWQ_7T~TtDM3B_j`Ei8*`h{%JtTlU)yw!?p_`oylWVpkhPMf18trm=0qZ0?XsWM1r%h zXCAN=bn%S(=@|KGvm+v47dI~e*a}1?lhC)}f=gCMCI^pPd5y>NqeRLrN$Xa1(yaDqJqFmH74Y2TGNJ%b|YIAk%vZ50{S?}d2L3TG%3U@ zGOn&X^tq%Umso(FpO~moLjYox#>5D9CpzUYQ>TAgaP(LhxUPtl|(6kMDTDMqz6NrFqv_LcAth_4!m)3YXCy)befjiGNTv#>| zJAgh(0#SODjmx9}B11?x1_8^0ztO~Mw;(=qH-=3pCJ*F>ZRq}GB3wc_Hze?%bK`n) zgogV;lJ~sE*)`yByf}3@K2lDqCKiE3VoQhT?66mvFM0*jLDm5G2!Ja=GrvL@8vOo& zTe_mSib-stnLd#DDt7nyERwJdKt0K`Ya9`hwh=Lm8uJ#xg;xX2p?1~55G=Tz>h+f&`o_(BE3?~ip!EL2JmVH;?K{!FXo>F5e*?we6J z_CcYylQ~--ST5UE+^hFf!9|**n%dGv&mpWorEedZ=E-O{!I0pINdA!;(jr0Kx8aVg znSHH0E#^1v=a`|CCTG%Fqrm$9#>H8jBx7#fway!}h^PvtmeR%4j2hbiL4BmJh1gTu z^Yf?)VwzIP#g)@*!5FY@dX;kkxs=;{PpC&=K>Y&!g;;zEWX%3)BNNF7+i0a>Jt}C`_WN1$j zeu;{ip@e@44S zJ}i3^W~bt1;TQEz(uwyt;W%{hC*-uhyPmk`sW@Z$E*w9;pJo{~P2Cud)4dBAt|i^~ z>lT_!&N-DCw|7Tv#3h!tlIWw$EEyn%xE`JA;wnO;{%5Qx9q)D%1!lg&{fpNVioc){ zMw(4|j#PFsc!Tq{zgcLOu9$_n1Pj^t6 z$PhLj6Pom_%(mbVq7YPsgoBr+#lgxdBd9G?uLaUDfW(by{}&QhbaRWdC@sfmLTp7` z7{n+&F0;?G7I$t8g^4MS!#$#Dt1mIO@H`!Mcb;`xG)vRh4*Sw?i&}uN9D$nw zDdNj3h~6x9xBqG*%~W`)j43fECpgDoK{u|^qBg0-g6Set;iA9bXdN7pZCK(?F0>e6 zB3}lIXw1-oSV`z?I9EqyOO9vjX>-G$*VPV4ayUu+}JUaY0( zOE1%C2B1)%Oko>}tA3wu?EA3FJ-!Lx}Y?f`QQT1V|Vm7PP}X9Of? zP>bX&aqkj(_E@*yu>Yqgy`E|of%3>8{lmlF4f(X&@$Q9VPD*qA&MxQ*IQ_8W&ln}b|&aJC^6)UWq2tn}6%x{qQQdEDNI4b30zNeh9y-o|dKphSyG zYihEOQSMl)Krd)G)2;nIEqC_4=2GCAsOYdZ5U%e@)-J3EzY8o^(LWf%Tt~bw+L5M0 zOR3wx)hR!UjHEdL)of@E4|D=x&pX&OQdL$x$P9VT&$_6_^@PU`MOyoP<_D2(t*nWb z%4Ogrr-(7qHf>fwyaYMnd*N>Nb1FL^v9z0wyh>8EpA!g`*>BD)#!MyKL!v`lRI2jQ z_+yXF2{X(ViI;Zi^u(-ttND9btV>DwtaUDxV%lIu&R(aV7!1K%Prljc+3NitnP%r& zanEbeO)o@wN5=8(PB$U~FIEe>de3NE=Mu^$EpPNJ+>y@znXT66bvbPXHvYl_Wqj;) z($#x#V&^IKqdlzL0m+?!;PSY3V~YXOKqaWnH*fNnm7I=hO*#hSV4b<1dLOBaN3eem z{q)?Sxs^P9H7+LAr@n&Ha=o-{UQ1ADajJJ&#O2}((` zB(on9r&{lF*PpUU>8itbHg~;vwz|*zOTG0`eIHrMjLo<)D@#}@-!7HdOAhW}Gv3c) zd?{Z{fHTo;qawr@^ctP01UURX!FuEWQ zkV39rUiVYozFazfp1fbrOgY8qLEsN>eV|~?MX5jWmdLU(wsU_x5IxjQ2oJvO1a3@P z&g5qlhCXRAbYkYUYO#jyal_g zyj0k#(xp=XIJwUP zU*9kNr@vn}g%0wLE-8D_O(F>s#<43PFUrR~zMj3!itRu2Q5;e(ue599u>{{=A9`7s zS4DR>KTtndK3_r2g>r^qh!EMy3dbDAlmnm8)4i)OmpIbJfyX23`s?b$fX!$!I) zr11Bb!xdytNnX9yG z@X2M1Wlf^QA>8H#cz*kZ|Ky8So|3ipas8Tyb-eW%};R74W#t>#X48Tqq~{Whp*Y0wKc?-L2}lDFT8v z%?CTK9PXALW~oP%XL7gWBQEt=42|SE65Z_Wmve=WzFho)W1+0 z0RKi`g85CLrUXzd9(USV$nM;}K@YLD5t&;Q!pfkP0c-VHR(2^vUVTQM?i)=@8m_^R zw=?oleLpth4wywlm?ty1B+Vx=D{~{an5Q(DH%-iSWMWA-I=hn6-G7d{z{eYnAi^b& zO;6j4Lq%cO2?362w5)}*9%GdR*9Fo-S0~8N!y1%`QQ=V}s1^*Z_=&Hs1C|&h(wy#{ zfaXV+D_OP=PlqlQGJ@sQ+~zpD?B#URrvhtc&U zf3IkG!2H{_MW5UBqzx?m9wqYNmNl<)TS(Rr*U9)bFAx<^Kk^#qqXhDnns6vpDP<8u zbqD^Ue6aHY8i>KHLEg!~QAXmyGP#crOj+tOP^6B}01a;dFEF4cuP{(5)|cVI8==6ntRZpGV3&ac9OFS#HfnZ)eD~m}MuRGklMOQ6bbfd7Ky{{uV4)*trlJzd#Tbg@9ps?kAO^ zh_ea`CF$fu#Xa}6wd1Qr()WFh0q5e^cmnZ2CMki4i>(s+0>dp)iK%k9`E$RXOtdC?C^(Jzf~a zD^gdPbT%4eUH*T3O5H<5e6uu_7Q(LoD&;;7vC2%y zqDo1I8G*Tojw1WH$pVDA@xurmWB&{>k|}R)pD_Zs1eGBcEx2NUtJ2nu?~w=BNj*@Pc%zoatRjeG)#5Ew!bXfa#5qKzp=S^@EXOyI8@&s7=s!_Z zMW)8&;0b2c+S_m2`_pY8)xL5KpE!rlQhZ_O=HB7_LR6v#tLV8}kaf7F(aj|3Nro_8 z!Yfx$_DmM;5bCq1&Y3SjZd76q$gntm+wW@SrPi7?o?U<~f77CGBxAWmUXxBQVzRFa z=%OW%_(po2b$@>H6lw{tUX+ToNXA|;V?;fn@3s0tHSnvA0eHN5!zEmrNovK+Wz^5u zYPtM^YSU|=u+}TM0=qPD$Nl)mS;RI~pK2kkD{7jnvO~OZgZF@gWca7SFqNSpY>3W- z3qR`s7u3wPR03`2%*6kRmUA4PU>QPI6p6jlfBnPbRyT^fjNk&x@?VfSrS9|&3h>Jo zd-6UTyWliV*4eni05M^6P z)qY+qx|YIk6~f`CkD7O)DcZhmVy(n&W~B^u}P8{E2} zXBAUYF~h8Ve4TP8CO(gqGiyi=8GvQ@I^IuC>ZG?OQZ{`HW)RC$VSP#y7oJgW2ow_zuE+} zjkK4^oo)(``w}pz9s+Xa5Lh$T^iuw3V{c9Xd4Q8Sd?w@+3drGyVK+=@53)~o;i%*z zd}pPB9|>P1PrkxPi7v>j@+M~qxdd0EMvX-!8NEYb1S#xPv1#i{^r-204QhV*Blij= zI_2CF3~5mmhvlk_?`$ovq=S*>BApYj5I~(QUQQY#f>*`MwAX-V%K}|b>zfa_{ImpP zr#@*~>q<&Dlh{3}tFjqDjStAk45>hKNpqo2H>ce5PP?V!seUB&==(6PoRmikIxr>K zkiFi^%)+AKa`z8Qf^oCld5ysUn^UP8f5wGuKOLyEDyXN7@+xPRCHi`^MiM1h&!JM_Jj7w^Vop>@j!W|Fosbcts#Yfk?f(g}x@ zwkpYcK9Z)#QquxoUI{EpDcLZ5Q=cMqQM5sUFBIavlJ+4`sS|2uQD0zfO;fbrg^xK`6EDn{DQEz8kK+UQL9N-6As~ zxdum$aWm0PNsNp6cr?F-Zgbc4c3zxId^dA3yL0_~O;=2)QD9d4WTj1NRn4wXC9whP3vwm5Q*{J_RQn5_g4XCZXV7H~uecP+T44B0%X+#UaE zY)5z6Qe94+xO47?PC1%rPi2eJ_1ymbWx`dYz`eDa1*)@rTW_c3^XE%lSDnK9b(}X1 zQxnr@nbC;{b}=M-K}&WSk(4hvblMGASDvKrTZt$EmQIMHrKcJJ-=8PiA0TZ0>eTSTt;z|2JVe_jE)HU7UVK>k|^7!(p( z9jaZ+vr!0;v*h{^<|WCuH|jWndeJI(2lv5na7_s@&$;_K{_m5#!TznRl#I-b2g}FV zHzn6Ac#W>iORtxd?|0^ZIo-Um7BcCi>{-FbgOV3UpKD!fmYwGSuS1V4RwBWDBZTeR zZvNwR+X;mcOkpiIazh097(R&n%K3&mxUsv6{C8tt10AdCS1 z7Y~xvl+68do9ZDuc+jMo;ZjBieN8ftBOd>{!16&M;jn)v_995a^Md>z?D7t-Z*CLd z9Xs%V@OZlL>kC1%K)IT0+x3|bqW!flFU~pnj&Ek#ePjB!=Hnq+=+1vh-GY067{46f z-?|_gkKRXRr)PHt*8|WC&-QHv>ebmAynN{tjVO+X)#jb^6AQ4}V|O78EpJixB7p&6%1ipFa#^@CE*h~F3oEI_y?xqRqX>AfBulzb?UYskb zbV;QhkF%itQJShW=lK}dz~|IW3J$7>5u1jFXChy=5?c( zv05cHPcJLsk^kvV9tQmp6GWFo;Uv($q9cmuj$ron)oBo z1sV@gAbJl4^NSY&h$Z-ovO%6aDrGXPg9*)ZuS$IeG-o0Z7D8&l`}>vQ3#7_y+5}hq@RQClmc|9`l+5U z5vVhdA#p$APSa_iVzP=$Rgh(5>=i;?e2-(Q)2OXBU3m_J_;7vxJ%+H4= zpQMs=BfeaKHYU6JJwx~=#fVySLtVamC#+X_ASytvSFuUlH z4AU81?)4i`=N89m_P&51W|#cm2e$qhJ6s@S4+3EEFTa-=#Nro|w<4IwGBw!8!d2^8 zR2+M#F)O9M`rC`d9lqyk-x_1o7khv3=2t2Dn;ru5*ona!j$Z|C=bea)cz{@H%5+&( zglAUWIy7}9Uc^fr^`hY%b;{VDbT1C0L0Ko>K;3!TgJs3#y zEX2^jzy44pAeP@KR;h6=4(N=yPtB9Dj*g8 zJpb=Gn(V!Aw6E7n+S?Z@bi#%GZ6R!798xHMFK=Adl(e}VAzXNIMp%a2XF`Py@a_^$ z+NI3VqBduj`Y5)9(OP_mz)O*D6SP@2v;I{;@X65E;Q+@0qd8wJ7KT|NBY+?wJ#vK1 ztX{Y&?t`n|4oiY$w3Q@%de?o_X*-Ai+z6gMA}E1qJ>$@=cWQ%uRRI5K&AkD3nK z6!)xk)jnmI^Ap9|{2{rE!jtM)ITf4bM439nD@ASZ-te^jj+d!kLQr(>G+E{#knP3X z{BTS_Ix+=h`=hLM9W{Sw!kUJiFaoOjOU7cmwp2PW>xVx-fI76MAgOv06LnI+vcCf9 z7`f^=11jS1Jb1AhKx4h#rG1bt=%}ZUS3=M|Z44$eI~xDKWr!BQuf*Ze07-*R66|>|E$rXb`9Cv+RO}*`@J$aL5%} zzDbCnF3HqpG6{TeTBHs2=dxfZRHvg-xV(F_6O-AucOK3{f}lrCm;;vHxsn;&7IL=5 z&{KZsAZbq}g7++xd|oW_9!lOY2`@WotT-H3yiH3oER|f}Z_<#?DbZ9!GS<8So*iXE zI%fZ93M$AED-d01O4zHgH_rRCZY4`6;+oh+wZDY8$b7T~Ek-v6v6Votn7t!YA9gNg_` zoUn<#XYQMGoKNigSv$JLzlp%>meyB-p!u$S6rE6vAlJ(Xept)GP%9Ni4ze3i0yX~% z__jLtUuN9pdqy_Pjd*>9Y{`78hXOm^qzoU7q6Aci1g}RHpCr&!^Ul)U-0P4471%J* z!05}`!UMVOI!1|OrDSLN1*hH&$R4IaL=S*uYc;RR-D}%q=5yVqm3)B@ zd;F94CT}j-``xk&BRg*$XiG^Cn(r*N#bwg)u0~H}@I6;fSbM08I>p8ckhLmS^M*AY zYn2oHO7~Offoi zn&~bP2Z%SVbEJH-;cFs~w(_8Zs@?CN*xo<9n)e7dWD^-jon|G+bJ zX@}tS>?eHS;yV}PH!s(UWzR$r86?GtpBkoVzPGh1k`jR}s(?Fkt!i5YxxexgCJb7h zCJ-3vu~F7#&om~JMX@W#ELF%~_@$)>GmZymT*R3}A4bXnci~xcFct@86$M}@Ms+6= zX=p+N5}|$6z>=LyhEM9th;`$gT_hfC1m0+j&|UETl>uk5^vH4L4&U=S|Cr`4fu@gF zQFxmRY~0!UI^q3--5VgL`Ts{oW;*)+Rb*sg{BL05W{lRD%Q5;D)mzYzmF+)6e*v99 z$vDr90|Mxa5VY+i9zQCsD=b7~Hn{csi9@Xvx1S$Bh)4l^9qujeX=d!7d^&k#MYPFE`e-r3!adQ5WTz|WQ#}7* zG9ULKZl2sz)PIL{Hs~=p%JdDg;*nx9?x^kIoxj4GlY^4L#X4ZTr#{zkY{dY@bf)vH zwUDS|=a%C#Y@R8zuxrD3iH;=9tKC{_!!Lrx+GPuIr$y@&iw*VjdABldhL^j-r&W-} zJ=um-fh=}p9DEV-QaR=LbAN!J`}%9NyFj~q+!-L{g?#>veG|@0kB~N$b0_FWET+d59ajJz|mf- z-v{tD#P!SLRHMyx)uw>%9{Zsy+j)*k!r2>gF`5B8CQ!qUfYsn-lTcW+CU}V(k9)w4 z%Oq!365QFeiwaAB9{jpy!1latydH+WdzEzQA5Tp6;DQNRDi1x)co_rA-SrvL6YuwZ z&ov@{2W2iy`yc>g9CCpar%7G=C!!}N3DjgU%~IpYCR_Iac!=bN+}rewe>3Lrqjl_F zne^KcKBm=c^Q`@v$FwU2U*S@9O1;K-)x8UzDz>U)32r2Q^foFi2!emoebR#(%0>e9 z1PDV-s_~)0q^54SUd=IY7kd0j5pUd72%D*FxA^!oy^5$%!-qocT;G?zX=Xt{ zyZR93iqC1aBhr~TxzWGB7RQm%h>$*!(Iu);i>F%Uh@XB1&A?SyH)fiZh-phoSr(Oi zX8iY5;N~Goir=^&1rokLK)p_oAe{kH)ddbAX|^cdRZhUz%Oxn80X8kMwjkcz;5DWr z30O#3&X-5H1uO>CYep62q{^TvvZ`&B&}3fVi5tE|zqe`;O)XaQ@=89S+t^00`EQO{ z6HAEE=fvL{kSLKqu21u$1XhHq0fWr~a_I7gel%3$4NA{=OM6>Ju(IpSia#6~`^T+( z;`b!|=(Mx@iJw{RwUzL;XqOWSYd&~xxt?HOF`;5vZ)c{w!)qA9IL<5_&k<$U5g;z# zv{NeXFdJbcvkH%NG1P=&6W z_3#5muYjxdsrJ3B?%Y(>h0;%3_wElxVFr<(lcOI`ptW!{m<(2e6_ZZY5?W>2 z;8Aw=1K~Br>x{;;iH@x6<2grr&Zrun=#>#G_G;L-Ip45BqZux8ys(`w)IosIB_sfm zKp|RJ9`wANYI4)Gzx{hT&dAi=D(w;=G3<}$EcK8@A25d*q&k&4TRfVQn&!;vdBWx7 zm!nXuts`JEQKk`uFZHbd$s|dVnKTWO6+zW&xy%7r0zjCg zcJS_?BHloq`=_jkBRh&pHHi%&#UgF(aR}m#Dn+Z0RQySeUfdwC#H(E1qh#2a@gi%I z`B+|R$Y{3LC{cz76zZ130{djzI1i|a!T0_v8X_0k-^G_!nF)aym=|#nz^bo5C?7?7 z{SSQ)=kZ;@0ZIGH8WL)i0g?W5rTT-k)X-J`D?f?FxeRsfj355I^3BY0SMt6cg-~ZN zY*gGqeNQb)?D554vl;#}ekMgMWf1bn^oV)$sw#>4D2^Y*`$jn0KKC_(2>?hpV|^$a zt!_6!xTl3jC8mo{Tr~5w5_Ugfys$p)Z(PUqlF}KQpa^6dC}dA?RwNud62d+p2rRXj zj8HVaq)#G`07FFPSY>_&zLsBX7lqq47%o1Zy)qth!U80#-Z7f_HX4a#<}Gy*)4 zD~{AmFcTbpH?@zJ4PUU33p%E0i25cv=aXvS=nPy$9G*xmXKgVeV%B7HXp7fyIZk8U}IL*X80o<5WnjEpzb!0No ztUlfCa{tIU}lQ>XXcB1*R(aRbq2{ zdNK84ZFm%#s1r+}IRbueKhnEsu;5o!Tplf#>Xa|;Y@|@hesw`DF}~(G>73+hK|M5h za*1B01rwdSQY_+?>6GAIDpVj|Q+8LB|Jo8Axo8!OxU0R^M9zyN78qrMqR@>GZ4(Fb)y_18En*+~Z$_Pmk3x8bcGYXMjS=rh z;=N{ttg3Th%l_q`_TIRB=QRXfamhBd+{WzyHJ8(D`Oh^25&L1lHC4^)w8(U=@wOlYOD6!{Q@Qf1in0)rPy*+jLY8OL zm%0=YIo5J&Y%J5DXz?>Z#6F?-y{4cm%N+L7e*To)Wf~crcX?3xB6s;%k&i_`1V8GIYbZf7vx-VasLHDcBt$@IUVaZ;bCyVgN5hO!uj(99k2m%L&Zk!aXg+F7JC?; zWJl)uNP>Mv6@7M!R^mn>UG3;Db7AGRe?$VqK)M_6&ducWs89mXEtwv2u~2r!aJ%-T zq`)amr$4g=fr)&!r1+QVPou?Ww%OPQCO9TG(Q~#z<&|}7-PH+cLgdF4Hd_s}PYg&W zdOW8_Z_D7y$V1TWuEe~P@o1Zc77N`z)E6wky#^3d-$oi-EmqErs3*{NolZk|s?v+= zi%NBP35K4*ANut}CyGE)F*SuRT^wl=5zpCMT%-`}>SCsq6YRlL(zGc$5}>$*)$EsS z%?9csYgOIWH)Miq*n{XmADWtS>U zp`<+vg_e-nW>cML;z?}>f}Ti6D_Hh0WdcJ@V`0VI!uAZ4Zc}1Dq&W&mDdO~xn;VA+ z@Nd_1wee$09$b&q2la6t{|0C{Ss!Fxt0hk{*N~a%G862o)ozXi>?pbnZr9D(Y&V_k zI+ytu@YYt&ax+|b4pcdHKA5hazzqzqF1Zd*bSBwv^F^stZW?mG{Ff6|0q-}Sr7Yc_ z_SGo2e7_cc{s7ZXJpWIL^nZnTW?*9cZ*aGz|HzhEV76veUqL12G*RSk3HT87T++|B z^iYgbxii}%jS_cYpGd6RJ1RO8@!HBREK+fhgmG{bFnrL5`u1|svaqtAtR4sNp>;n0 z=Kf&k?DRtKe3|{1E5mlf4*vgfWw>?zoJ=fTv6utQPCGQ8j|bHnAYkQOpy`g^dN1UU zJH<=<@@5Tr-#!OBifZ$}0CSxY-Z4JbZ{JgNX^TD4#FBb&ctCn4xvG9m8ThUpE9@(` z(%Om-tJX4GEXW=G3qos!WDGy%<6RJuS<7w3CnO6TE1EtY1cSai-|S|<=Z+9bnarjn zd$r1z$_nf}og9!&EzkD) z5cqy$jG#=RMT7Q&4U6pkyFG%=-Zc|RiH3Qn9M3{eq$x_WPoEgwsR+^9&Z@esBU~E! zhx5AlAG}-9j&Z|(U>`-+b6Kj*J&krClOz|*0p`_r9S@n=2I;K$v5<_$vBz<~5+M(99^0HWp1IrtG27KOyVw0$i`};lq$Xk<*)Nk%{Or|qy zBoz9M=Ys+u#2 z>VdNRWG#rcKByjE&h6=2D05OHvpR)jfU&N*vzk#hDi!GQYiY#Cv4XEag^&OUzLUca zzybwb?dN$wX1u67^Y;LH{==SB*K?@Zjz8L#QZ~=VsJ569h;rX&u8bBPCW__vRD2dk zoTBDww>Fw&ptD6VUoo}Dj~?_=k5sOp7qs3OT|%yYVpdF|EbkNlXJw{5CqGZ8v{l@- z-qO)P;nNhJKF1$s+7oI}svF-OD0XGCJ@d1-9HYvP^mTNYYi8#4a!aUB$AAaA!FkTA< z{tvKC3Pm*4)IZ;;1ks%YDxz37WOa5QYHdDyR*xWr_p?T` zFvJ&Z0@JPK=`nq~UM$g;t{~q1dTPEz>rs%u)o`CpWFB+j7LdN&(Mg#F>%}1sdU0x? zki~z=7b{B0khpS<;hCIQH3=JfS}6Wj6oZnLwjnOp4?K@;05`r~nYK^W*?5Jfn|j2z`(l5;u60|5@L+2+GSw*N&A{2E^nhh>!G~ z&4M?!Uj%cUH;)wM#V7`X$``F~9^Dq5D?Qvy=NK#Lov+cyEdY)VITc}N3qkxF8;Xrq)CMlH+!pyp=ps6e zI?Wg;VZ-=tx<^N8bdZF#mCUq!%VyHQ(lv3hODm0(dO=kqlIoX&c9H}Xfl{_eEMy}pF%gw0N|@bd zSuiH&AmZg8qYyoP(Hhe*B}TM=fOWi`k1yPI)G+HSjlr|jO<~5%s}^(ROMt!9484u| zj8A|-o5JWgIufqZKtVSL%+47%x9Ts$Qx60W!shVG*#|e95$@SYNd4lE5QUH6nhXu2VPAxm@;!QZU2!MAm!;o+NaEFXCj1V7xE;k ztJu1wh;62wQ;(ivF^McTYw)`nRcwK^czaQ-f-aAiCN7SV;IEIRlw?*viU=z1-uHm> z1{FSQfKLW>Rhop`((w+I4Dh2DBk!+>dk6UHxF^sC=W&ksD_D|?(G1+ZR7zspSr3c~ zQ_~ZKo(nCZ2I!?V4Q&FAd=6?3k`|{Cua3xyE>oJ)?1qYZ4oz_e`E}Wl zHv?7nDPC(8;wi<zGJC*F})oIym&otN- z><*<8>2eWh^4V`s-LORPLu|^8+$CGy{w@}KTmgb*|9*kGI|Af9q)fq@$lR7rO-)yh zuhAt*M~6oD(Ieb6iCetNB#bG7ezhkZ|FPvko^))|*<-lzDic#CB=>#rHGQ|!AY1|6 z5_{YdmwCRIb|>;a&Tu(ZX@lR8IzaZ+M9xT-$8-4IEw=)Ss4D3$`$KPB(igqyc6QM2 z_yp%ZLbG1C1_G_-mSAq^=L=+y?+#t*gwO5|P3Px44A~pcD)_WgNH+P3cZ-B?PYKqE2|>4+~#h-aHZOIM~KynHRJo0=JVQ_!l3WaiBal+;xYb;a6F$gm=oW5>g~x1ry)Q5^ z3G=b76hEHWhMz7#o3!{c+GmvN%xK+jREU_tykUyS&fZ)4(SLk4c^whIRrfQOu}QDa zi1Ks46`x$|EA`ze>0Tk1wnf2cJ2>M^-w1 za?1$1MKCnd${>M=_oA_OH}`ja7>OwG6t9HLW6WWzL*ju27S^T=G{uVTUvLG3v_OH~ zW&fI42cO}!JX-=n*Zi$MZVqj5iQEH$c7(LCDdp=!e);1i9_mt_{aOGKbq`td)O=s* zz^O$L-PzH*pv`dx-+d~uZ$#9k1oO+7$T}woHCRC$*C`rhzZ9nzFEAB0b*M8P7J-xl z3wAf-cTiy6+#k$vCpREL2DYzYH+I~Ps~Yh4GbBN6F9HC$^2vNX)r#B{vu+?g!CMZ3 z(;tAE4!yX!eb`WK^G!mn_SU(I3q9Ztjh9pXR3{shP3b>KD6g8qB(io@FzrotvEvci z`_(+Y&~T%q*X3x7%taai4#NQC(n%5alTBUp)-`q^VTUkGWm6-I$eRxqdu?>iffpOt zwZdb==NR80igf?NI?|O_8F>I!B-=t|t*Om%Q58u69_{5x@QEma0iYF^8in^TB|7k_ z`f4en`Vok*D3K3B)y@$}-C*>$J0)k9Hn5|NE*z(W?-m4T&)tShUL&YEE?W>`E;-5nYB8`d3ta|D+^yl%-N^HReVEgMek4Rrk*LSmX=FfUjgEazJHjG@r~#n?MG zXBuwn+8x`rZQC8&wr!(h+qT)UZQHh;^b==i?YHW!J*(!2^%w3Bca7^D$2iUqubJPH z@VWH1G{m(w<=F5%l#<*md+lt^B}c9$Y(9nls+H93tXqx%wpJ6G_p1;h6s3p>GQ#W1 zonp$ZmK%sLyG@ci`sIIfA~&P#d!1dCH=_Ips$b5<`P0CV3sN&!7c?0d9(m?`w^-t7GpH?_C{DH5b!Sn)C=!wUc0SQ6lMW_@y4 zG$4u^eG)=Wk^3Q`azEc{^F?QIKV0|r-+9o4k*|+qgj8B?^$C-g*3B~g4CfGPXAhH{ zRzqr;jw|q1mZvH8#_&s9u`?XY_H((ryLg|lp)4LOH8B#3$BVIfJfi1*J6HOm{i7)vfKXrKB2(%iwX6L>Nm&QP_8coi#`(wPkutWR1IUPSotfyt|^r z@gh|^p5MfllLLLJv`d98o$9J0y&{x`_!3C%jMn?K<*ur-!qz?BZA4s0wVQL{IA6!5 zdeup8>(Nw!@oonBHT%s*&eg7btpDP4a(#dN*aXBz;j)%= z+z~5c&m+wP#Ky~Kycic@zton0I}v=2%K#YsWJs_4dhG*=q`8;38Inbc>&ShPj+^hZ zYJ1r1|6i{V@X9##M|haR!*4fbw;O)<%K*Gzb597i?(+W$;JQEG29}?>t$>cL+O?i6 z4yrK0!kq3aq(%U$qvVI8)L6YkBZjaqh8d66HUfi<(ZapOJ?v`w^2AjDUl3wIWWbr{qAIqr|a>Xs6&K(djF$<#HpS6G6ARp`a@;)o1JsGY3 z0{Ag>4a&bOrqj*N=5+{sM;gPJMce&P_}1kxeW$W0|5rdP)f3|Lhar5ahM_XmDuq7( zX{jBY7BU^hqcX2v4~pmUo^G>!;)zRbsmhM+`oAr;9OyF!>)Rba-3pg(+Zv6Ev@mKe zKc?N*6wBBsRGEPloi3A&sD3GpaLnW&JTRtI!)RHmu7A@^H<85j1cVY7I(t|9#Qa)zKxHb)s`fjStT-g>e_8MnE zin;WlGLl~9Gr2Jt;zW)pP;qngOw>AqU01QYcz6nD6 zlSPmXVR8s1$aKL5(@g9X2}6X$Q~tAdy!WCKgS40?i4icPF`4c4D9P$~2|&rU*8|U> z|5!&Kz)Ph4ATG*>tHmt!7BH$aPL2$prxw*Q^!a$XIa(^1cp0x;LPkq{rKS&e8>f_I zr85R%nPU@s20G^`=9zktZ9vE4|u2TaBr8vC_w#^G79YiH53yg}2wb6j%!WE?NH{Gp&_nX_OM64@S96Y*kC~;v;N$r2)|c;-={sOKpVXK$^ic|o zit>L@%ghd<2J&8S1fRE@Y8Hg2{W&2^A)z=CAI_3}@TA^mlw532If&9S(%{($Td!81 zXKXJI%gx_5FYorgd#soJOtL0qXw}hHSNt7m(048~wftVo(%DQI&^`UQQ0s-@gBa$9IUAR zFkc00obb_ukbN>q3Tz1b>{kt*%FRB)5UNl^Ni8r-u>D0kKPYq zfUe-|-;#wr+DR3)`G+QmN`SA0tXNW0m|ETDptF$%7Vzc63nQ0fsa;d;TyEyI0oW^HwjO@y18$9sQx~+2Hh0>)4i7@bgMkf_c{Yv}#L>}tG zzGh9RUuH59wnF&sSWKl~$vu}6`wx>5z|fb4RgJky0s3$|9}sv_7C_FZR9EHW1R}4E z{JkPMWQG2_hT@oy2I2#INo#u$30IwF@F5h#^S|2vnuF8s zZHLP_1;kG2@{?Y2@kuuJhS-LXW|uDcy3@WjzM+5eN9lEpwIf-cD_m>N2*3De9~*iQ z&MXM2!>Hp{PH$jq~!5bgv8jjXXbIjp6ccq*Jx05dol1CqJ zLI)3Yq3+8v{kg`pS6Jmr;Wj#Ttq`bfz11na!O59da27F5^R0WEBg{6pZnNiE<6!qN zuqUU|6W7J9`b3$*&azcNkQC@sM#3rkNTiLCj7uzLbOM=%ZTFd-e#cCL@J5P^q&lvd ztWl0d%W}>_nZJYsX@plw9TsD4-aBM-YNOvm6NuVryzM%~vU>7#jExYK%#|sq`Mu4F z^SdHsMJ?dkA7rfOp@A%odT>%J0YT?y+%>@v;*2Gq<6?vcDkSI#qoOnUF1$QKc)-B2t-lcmSE_ zegePAlMTRT$biunrV$_pkxJyt0$+M99JkW_wBJolV)i38;B6mLU2 z*KiF>*rHfF4o{$Ev{@amA1rt0(-8)qigWn8NoO-35t#99=G9yi?}^z0YNd>4 zr>pHzjHCS*74#XB$LE?;*>zB z4BfG}sT^+><20h`m$6#}*^^Ffj5$bFsA&vSo@FHnk$O9_HBc3~vJh^BUb;JP5&QiT z=NOp&p76MJtH)weBLvyDVVmE~_XnirUA?A7l{~%jTgd{xj|e+1K>uxt$;AG@!s?ir znErEuny$TUgWCa6eE>U(ergHsi3Yg&-<0xo7Df%#cb?Op*uA}#kSZ18o}L!x4DSu7 z$I>d2iu#e3uzYa$<=+v&3L*55Iz|pYz_@(`&-UJI2>8PN`G~?1j8PQD>}lBtwPU4* z%@@D(dg=H)te!e%*6wqAoTzqlJ4Z89SgTdOSvdD?v>fwU5G!M_bjT+0)ku5D9AS8= zW?6I2y;KH-bYSG>LITakym0!g{$813e-uozbDd`E&Tz)cEz_NBnl83n>zML36J3G+|EH|r`lqa*9->|*_o}>W?v~kmr`8J3RJ&S9 zwT1zdK=De>4yLGCZ9=1i%euPUPY_f2<^TQw=rBOgR5=9WPx^49NVC0cWg}NAjZI`ZtltJ9s}qbQ zGU%#EAV06{?VZ$B6vsb>fX)nP6)`HXMc4?@5WUJiGbprQ5sCa^OGRkD?aK`8@{*7N z>=CzZo!rl4%Nh+XVD#dZyh?S)*7#`mhPVn=#Mm!jEd$UOpeYbWCA@!1UekUDsViEq zlmwDpOOV5x_AU~a$bynv8Dq7mYUVn>-t1V&pwPY`{433R{kQXR;w9NrAiMJ^T&kQo zopa2?x2Y?YCM)-qS75RGT2v5$6_g=-`V~G})R54OlFVWeisTfXI-3@;7OaeYi`n63i*Rh!qyiXQp7R%*Lu!FysEA0t zw;hmu0#N&qul{PT$#uUWb6G!cuxBJQc`Yi0tLaecT;_05waw&sylU*CKdEbCPokS? zeRfX`YRhUSd&5#BdO(eboKY=9U=K#6Gp5FJ(w6X*zW_Z%JVl-E_{-h2xvmm5yEVEhbg%D88&_Nk)@gun*uFoDvE!SQ8wMGVNR*E43>Y! z2BadiAcPwih~dIB8-p)GdWIpEN{HLTkGGUjYdSys=;Ze@=hZhs{WySU3!91yl30{` z^{RR<#K`M$7KgvB+V^E%+BRn1XmP8RPpLRFV|pGW-boi9mFk{6dl-!f?Ip-aSuRf2 zEESJFg-rgLcnsmb$D;G#g)kHVMiXg8gi21-2b>XnM+A7Wk;cSx)myG{+Ee;r$Hm`; zK5oobK-rvIktbYJX}9j$@(l&Yz4r%qCeC$ASX`Wn?x^O{v>0S^sp^(HjjJpol_4g> zwAdiX?1*nkAwZ4S5v<1b zXLx0G=wGCLZlbshDUo?wMWWbhyB=r3l-I6#Te2TL`*iJi`MX}}M-B9L!9nu9O|3Fp zSPvw{2jo1AHVWb^tztWCGUcOo$tr%{N=J%HA+a(hR+a@zi&xdk%3Uk{*4kk zwaZpoJ4@C_2BthH?3|q3MlGtvC6P~N%%Wc2m45rk+YO)Bh~{5H7%44#Sn!u!K^D0z zuZ(1pwbLZ=MzV*VU#8%Lo|t%+5Vmd{8np)8zAv%}b|B7HdE&)WPE0U3R-f~lJA>CA z90@XnxB{J;G$=Gu+Z23s>&H+i8F-+>W<7jd3rBAUvA^Ra_YM_V8)cuSrkgbl`Cy(! zdl`Xn#)hJneN)sSl5;KwO&C#l{w++r$?PW6DB=mao_ z$mtU}%f8Bf{@m-FBv`xS`|{hw{eIl>ea|@;eA4qc+ey0tEma?ICG`H=;NAQ6K)&?K zYt?sX6q5ODF+defc*luQFB$qM8YVuHq{6%fh44PV81tGaH~5J0F->yTy0#j6!osHS z1Ykrw>cRg5K1&8yC60G0m{WV4=qNcV zO3ro4g6GQ;roa2=tV#HpD`bLfIs@rLdtNJpD%<=+cfm1m4bXcVc9|Ua$F2Jz==@84 zW&9bq?)$8%xf=^r_j~7a>$457r1coE2$(+BH?%p6nfJLvDfjy|8ahjN4bx&~^4@Rw zhs@hNwD>16LREhCsIwTGKZtJ_j6}sTw%$`d6#@(}f9i>4rB!K&YoXKqR=mXP_eSkZ z&=#p{K5jNR&SB#3}9=}ZzLf{;iGmV{}eZ(C94o^dpyNwM4wG7L1uA=k!9k8Fr1 zhomw0-yWc8d&fVL4>7&>jj)%v=jEemaUMpKTUj0!n%Z(_PFGL`{>VUxgpp zmTsXR8J;|q_TfRrX!P!pgg0%^8ac_=3Xrz+w&b;BiM-9sU3XM8{p(~#?!BTr0QI|= z(t=$xXP(@xTD_J{VgM)EzDRNWp6ozXDBP6%tX#qpdT9Jw`f@>CG4eJT;J{Nss5L4b z)r1zd!a{6!Sw8=kYN~&13OiokBFu0<7*j$AkXf)S_Rn}?Rd;+=1GWh|fWn=yEH`PL zmUeNh?C?j53S5k(01JpApL`YOvr2l!E0nq&Nt$gja%UU+2uEm7zd}bkXbZGO`jami zGi(s_D((%Kipg6}_&Eg&4b4Bahq|?eMNF4%z6+3=P?NsKxnw)eAr)Nt3A#+BgAcu- zdKN`)<2{hcQNYEW?$9&86Np!05-8=6y&^umfRBg}8XA$$A-Q3jc+YO?+O_cuA>w=7 z^$6|sj@L47NSC z*kxdoHeH`#^7NtP3YJ-Rk_wx@(bVI$Gt#!KT42FMSGtUT=^z@;eBRX}n(KJ?Nv@$9 zVcb!z^wR~=bySd~uGdoDa~|y|Y|=xus~Lx+)S*cqHc>?fw2qml$T4TzoMOoGmterp zl6Ci8iOR_zBTsoWN2w0uE>>jH^yjlVH~Dvw~_za;ldlDQ!S zi})f<;=Y2B4?EIA=DPl)ZY3wRV1qjz0SzId$l03x|)VXpunOcZ|Zu!}NS^gXbI_ zf-$W31}La9;`S$dzyx^Lo+W3Yt(ri|haXxLYmtydYvTR_Z)DO^>l$1WO00?uwZ|BG z;dw#k7Vjk?v_b}H+Hy<5iXqy~}3G!w8#QwH3Yofvf4!PA?nsP_Mv0?tP@M~1ZEkYKYTNh0|MH)h0w#} z9R00Q8b=|0+hL_amwR4jkY`%+Bk#(DP&94O^v7$W&u}U^E^@Zu8v7bhk(s}&bsxlr zn0<=lLbA+pPskkob{lR8Boj0t49NV@9z;lz83HZN2P91p5s$S}rFp+nRKe;1t2g!1 z)1FykYOVUl7o2-i@^wgJ%-K@YL4>+g!Uh-Wz^PKPQ~l731CTTi#z9vY=l6WX8M9#Y{@oA`t zzhsIr54fAchVl|&0z$LGDzfb(-qlua7!Cwmi&QT2W=^n&PAy9|qgNy2mnO_*(gcc> z6Jl~9g<-b57?D~Kq+vX?sPlIaJ8z~OsoxQLF1Uu*-gD)F5Q50sePo^pq)bVtQ%7XV zcbE^1I&CaNkEeWL5R|f>U%3o5(yF8NkdM6h$}bqgkxEwULnwer(dyP6zk|m)KLuR4 zplI0;GHD3SUD@qVHwD0!8ijif@(N$R$YhI&)k4qA@S>n2idgy)5bzM?;0$cJ$QB0F z<~(@bFH8+Hg;)Glw%y>tR}l9zZ@ex zTJhrk1NNIJ#BcFQ(-}o!_KgZuXvLgO1^7+*g5RhGn&$(`Q2##Dgg@0;(qQxI>>OL?W_rrKUaXyMW$f{Y>y_sa zI(!&u2JQK_{vDnsB^6@Kp{6)3_EXGN9mef`5EzzW?ERP7hne|*HT$qK{b!|()_Ck= z8&c0H)f4cvgZ?j(uwO|)PFcnFLhz}y$BA51Iw#M{TT!T{lb;;Gpm41=k~)2{5tnCRQph}>Ki<#c zpaI@#v2@&Jhsn*4dmAzo+w9o44!+*$KWQEzFt!Bl89LWXAU3gk-vH__HY`c4b87FK z02lA+XLR@XblyPPt+W7DHm^sp8CaZf$MGU@!kSyCl#B3vhB4Ynj=Jov5{G=~Yj^dCY1^NQ;1PZmn|97dz5^ zb>R?77oiG(^$+u?_-hq`w zwmRTnAWD(V64)tkIF*iv8mq~|0jcRb8Wnr!O5gB^8ggZV->T;6G4%>kny8Z2(wndY zun~uov{-Sn#*K?PVXO64*dXxvxkx~K>ab*ksM5c+L#_8qWQvsv8SVj8WZF%K2DT`b zxj z?WB_p|Efo9IN#i>PnWd7gISr@+ztm!rdr)ccmFUyO(#No{B_&S*u{OYJLr*g&2om?9x> z@P%>YaPvYGZxQT0BS3*ce80|qdpOUhYlWw^Srj!SnfCwU!v~!!)Kgt~MeG zvbTAF%rt#=;`M0a)GSlYBV+fNJ96yl_wKVGW^oE;;ov%q&>%(td{ReY&2bnoWL}2$ zmS`J?VnV`YrBm?4bLIQ&1u4twqy{sKq!*tNd4!e31^VF9mFlvaM_;iE(xJ^V&o#lL6^k%&4}KOS*Ss2LB9=Q; z(-Q?vh*qCl2Zoh%K{HHH^Y=&n65N{Q$}S%6#Vz=?785^9d=~F z^1YH(_IGc>4)b5CMY?5VE?q*N zgy+CYePKB}qFGhWdivJd(jHVNeF?DdTPOYf`CTVkubyQvxLnQep0KV|#N%Cpq|l zD^IJv>>knq>02oi%W(CDb;6!&!5%BtMWSVtEfUZ%liJM_l(=x?O3fb^-DKVe*0U#{ z+ZPMVrBHB@Z0s__`!qKePf6oxOkiV@%!?jD^!@T;LosT0}`FO zp^aOApqtl8=P|^tIUH(t{8|fFM5R5W4!AWelV@+-=AX`%SN`X$Qj_V)gAn0dnF4wG zTAZot3V2ME!E>KXZ(ib3xx-2}?is#kSo*Qu-c|d%7mw-ASLxsKcQj>psG&FjwbjUo zh7+hz>Z`d6cbm-41kw=Rrrzp@0&6|5OzG__C`@dOxz?h+X(HyBUJk1APbm?Y&%{>O zvwJIfV0+ zXd;%c+c6Ox69&7#^OQg#IA+d9+JTDb@bo*=2_+&_NOYk7&hxSKA>bM_9q9AhawU_;eTvve{6+9<9r1lvnyVi67Gy-P?82r;!SRMgwtp}1&$jRq9iw9Mm8af(bAN>DO)?;K&?B4GH04T9?9-{i^E zT&ocZ^v6x4*WxWcDUaee4)^@qp5BA%FhZ0rjB9tUo`b7r9g3Z`mha6rOQEuw-=VPL zT!W$44PhO*Iz%@77B{24uQMa}4<5!*>eh%u$BorD0rD)kA8oQ=2#$6BdYvVnP7Ng2 z?zy;ti;2I(AwtWmEr&_~?%S>t5O34X7`%UD$V-p+LOmL%<=%6iwA&GC>xd&~rH<=x zrF4UAWto41eD`#R7_WX=`>;{7mz`Ug4O0gsxTNE@F4J^rsfy6!3wQRQcvjmv>L^E9 zMHrWQ?Y*zl6O1|Yia&mKPM_U9b1kvIc)ikgs6<+TL=+-LYiPzUI=zJVbRN#1Aq-L# zR09qATpszmxPKnYe}lb=^343V!R>#?rgQu!n_h!G9(&btpIbMF&@|u+gv|}=0DE*| zVkZPoS8*)ubJzI-P^Lv6Coai72jIf8Dn&_O)3AN=k4yIDWp`zEMLCBr{=?~d!K&4l z2lV>N{Q2z6DNZj6cY5P2&1z~y_e-=&m6IiS@4Xckz>i9B5XhdBZ(Mt##Gu;yf_;%H zIUOvfnv}In5nDKF`;F~k_sTTAyXQr}u;o}IT}SZbMKif5)=(Yepy{F3RHF%dAQ<%z z`Y|K-iBEpi)LPH&tO@o8-BDZx_0t7UXIgQF75~+*T;}vq2(Y$)mlyX(MhxV=3;YE6 z^osbf+o{Hgnn1p-#Ydm4_VfI(Bzxi$V7bDyb{ zsB=UVRpt=+y?kZHN9I>kN&$P@E{%O%ge>aklFc+2vdywO(+A#TP4QGp`cz-mmgMaJmKkTyb_G&!^TQoUWTQbq)_WCvSNQ7 zjce|&+`Vz`MgEyNFm!8;sMw)z#}cIP3~7GU60M2@AtMt!+^V)A?IA;^N!P$DKJKBn z{b`w>;T8iv%fwZcY;?LH)EbQ^O<}3%K#L-fWpziu((N4p{A$fUFB*Fgu{T z%y8bp#qet{t@T4;k$v zK^)@V+F6wVL;n<6sh+}hp*^wrxJvQa&5X$*39j3j{gM2PpCv{^HM;$RcIT+eR?^%8 ziEM0|iu(Tk7`ARcK>;|7x9QVfwIMvPoa?3 zIpa>zx)`gCw*4H#C3|k&UOj7Fnd9)yb2Ds%wVwv7lvGMXK(yZBBkUv{)5K2|jVXd9 z@R#x}qh*!)$yRB*ZG{xpoe81Qahu5RKPZ7s$G5AZP4%E1jt}$ITQ{VcTNyWRmWz1_!R1p4%BFROX-;-{bVb`l^Y!k*fz(s}3-~u8C8#HqU|nq#EG)HC zB9(sVK~hRGN67$f;j{)8LGZeuUZ+2g4vmD__NdgEYlxRJ`;^k08}|*F>*YgKp(&YU z#ma^%#;~FI#OF=17#)To8~Nj-;TY`i$IH{el><;SWN{i(Wf^9!c~Tl62-04&&|Fjh zD{U}7YuN+-mb%pdk3#29VWQze(T*@ta!@dnFk$Rsgy;ZB$wB^Z#Xzxt+(r(P4>^bk zdsrq_3!OvhR$2>2)1fTOEO7_bkm^k0M8MZTBoAZdzr_7rk(oq zZEji7cTXwO6X5Q}F(=e}Cg%x?ORL$Ngh@+^BVCGm|FbK{HB_08Eh5j&|moM%VYvCFC!CnY4y zxk-tq8^}W|17cdrn8W>=ca~$%`KAjpDLU(P+|VX|eq)gV4H87Lf$X-cWK>5A#<3qq zI+iUKTnHzTc4Ib>q~Ee_df<9mddQ$FQf=$Sa1UeYrn{p23Z89@x*B#C!LwE+C%Lat zZkk&b(gG>C6W|- zHIwt1+HX$nTlkg;S*ZR(TGn*0e!g;4q}I2TjO#LCbl zOFWeg7LE0n#MGQwn-+o3p2(NoY{mlBu6mU1hMsQ26`1!eL+>zt%tH(?4YQliX<*nJ zK@UWp^BxVKYZ?40iF@<5BPU9ym*u*|m%wghQRa3;meyvP|KhY@n~%pBHkW`_JDkz9 zQNB(}q2trsGTCM=0lwtw-U0V;ahxrv8n38qjl**sd*w~Oj!(|>X@l+(ap?PSi+w}5 zOfNe2op$EuB1f(%huwryd}HH-?Oqn}7`fHv&-ufK5nZg~3~?v0)Z(>=KDHEYE|tpX zx@%sRh6T5Rs~tTnvBattjSD?4$6HE9Ro#u~_19bS*MemB;I9fbV>FHQ&70BFo-4Ri zIn6qJ^SMC|)@9kx-d0^kmpeZywj?rx)t!Rz!IF%(TpY8r31=8uYs{!-t+iyU8ZH)& zbYDY%3<#i3+A@n`R4D{0=8mIZgR>#UL{4Pkmd0BH2Z`tvgl^Cm7#Wn#5rkAkQ*2UN zy^FlTp&2ttziz22dgF#Az>%agi382}@`^h_pLHGoDi9n{%+w)0$(dYvvo+aWYDw|} z22V98zQVN{EnX~pDY7U8EP?65Tb_~k)4Y8b1`j^Q;TP!h%sxTQNifTcN+8H>F7iYAr(!3s{Q3l|t~ekG#6>k^iS z^0Q!dvF~kID!lLhl+vOLmO{OJGB>IXxhGtYbD^F_+8q*#_%;fpFF+Sb zHv!miAz?RHoU;D_4YWJfw%Gc394z2znRzXkxO$XH8Z8sT+G5Q0lDj+<{d~*Lvln~a zB(4(@{CIphwCOF+w67&T0o2*KL1^v$J{`Q@8wX3TA_-3XLytV}R^L%-sa@XX{70H( z+mu#--iA6*VhJF94=z4M4u0=`O_vtge8pA5_DoE(nDX=^SB zWdUGm*&XHY*N=j|X&NRGzCQVfi7Jdd7ET*Z{y{HLftK42G%gv{?( zv$6d+Az0k62*cz-3%sl?hi^P^zrf4g&i7q`P=YVRACtzR94x{AHEHm}3o{!Y-`&5Q zrc`a(t^nU;9a}9o-p3iC}PYT1kRoU(`yP9Q;z$?F>CJ z^F4TUU?J_16FloN>G5&a=18_-22Y_Dvtx>6T||K{&4X1VSI}9jtp@~Y#)0M)$qRRj zi4NI@h9??N>E<78?wXF~=a;+n4iU(ng3a-#O*R`cj$Q)L>kA<|K2CNPqt5phu)~!d zBz4A6svdqLoefB!2&WCk*#xt~(xJ6GPGy;CO@ih){^gr2cBB-_kGYe`B@nU_)X>`# zGqNt_cSgO5OEuMeYIy9%g>qbWB?-!|a~Ri@T@?gZC4kE2zuQr`t(~`5_??R;5pUaa zHz2nn9DEFNeewp(!lo^nL}hm9q6fu(Qsd|rZ`BvZe=MNXDA|4_=w(ubdip7jb3$mi zlpB+~1rAh0QA+DWU0oYD&=;9>iNHlJ6Opx8{o;HGFcaZr55M?6uc7*8z;fv;gXd-4 zsCr9I0#sKy#k0KxyZ3XpH1)&L*}>FGfeQNc6x@`gd7mNUI>N#; zvaIjxno)q%kC6GoI?eN$81WmCEghkEF%5S29F0b?BWks2^dA~Y(Q7IVEU<&5>y|f?E)^u0QlXJ7jtwXoJ-Fr3 zoL+PsQ1wKZN7}|znX$82CTF4e1!RoqqHNR^iKJRg-YfEtc^yZH>qs5iPs)MI#=p~w z{!WG?y1~W!qL;cOxtE#iEu60y3AuoUnFlYBlyXZmvXQ)Zv@E_!f?^*JlSW>YQhoGDCzm#;#@xNwsJiXmX0?L^C&gp|)6zc92r4IVW_!ggaCbAk zqq4K3iVq3I#4?uhQc>j{e&JGQwMAGutQjF6hVw?^n>rejBQgur+`NOb-^n$rO*HA! zi@Jx10?!7H^V2BH3ygcgEb#2Fo!}w|%O6oFtHPG+fwFNPu1q!sW~5uG4wNoU;ni=F z@~^>0=k~AKRIgn5tzD^|hqOwkLvzs6>~x(z&@Dv|T322=n5;CRG$$2(u^p}3K3s9Z zuH^m)rXu!s`nSE$G!&d_2OUwU&gLtld8+OP__O_P?#UhEkmkxxVeW2+;4Yut(E? zF{O#tySOpz4655)qACV@5A3qml9EC--leld@^bK*_!b)5UAxMKo}JqI%*DVmP$ibL zCApfE#iuUUPS2&%O}o+7=6B?WzR+FIy##JQHrhhW>up=?5^@ctxz9+}rClg!6`*N9 zWn(9o-P=Mj2!u85Bcmg+nyodk8$ykJ!9=fMf6uTqbcj{BT%o8*;8l=ZurD_dHi!7e zp14NLI!@?}9X-d?;7-fdp4e7WhD;Dks3kSJsg`{kld}EjAeTRJzr1=FP8@`LJrgIu zNJLHBIWJM(<6gM7bozRa?4UbT-ey#6!xo-G7zj<6mH5sZYu6??==b~LG3}2g87^z+ zr@Atu*W10VfPn`~h=Va&#H% zXZg}}@MJuqFz~sw5ffbg;Bs!1TRiQO@8EG;P=TJrC6G#zYv5^h#E2`Q?{)bT;H#ptp_QDB^-t~o zk(52DB*ZEXwcVRcV6l$lw0+a}u{%NMr~kTQb$K974qyhl$hc7~hXL{YbIysXyZ6VL zcmlIrE5EA%xv#*U6U8*dNJ%b_AC2w8fxgg^v2NFqmOA0zd5~gq%k34zDg@dr+xFY$ zt@j%3CitWE%f}I>cp1@&#S`6){=rMeBaduxu9vr<{2T$C*uzq(U0*nniR6TBd@*n9 z>IFtzW{M=@wHP_^ye}2WY$~%-7q#gDj^`jpjczlyvAjzORZSo>M^vTIyVdYa)%I1f zWCsv)&V`#-(KO$9uoVlSB^aU#=W;z z;0>r|L;NwF)_(2bf<4rma_udvV(*%$^#1eW=t-rauo;Qux#{_mV?Y@GjL0q*{R_%7R!ejvUl z5VMz3NY*aMc-Z)D(x0Zczos-+JMLk_F6?L-xuk3osveV^K`qe0Q?rzDPL$-ye(?kO0Z?M`^)pZ2iOXbIy%rs_R z+2V;c$h07H*~N`2QEZF3qS{v(`4bZNQ9}T)4VxwA7T!W^vBleYrz;!<*RA6;K=ss@ z-~Pu24EO!@@oob5mjTm&-f>1(^`l&;D!FnKrIu{>7JBsS`B6dc`0J8XCVTs-m%5CQ z^yAC4VF!i-=k0U%Ja2J!Q!}`3Rlx7U&rjN!W5!&W$VS(YVDhb2MufrJh z{^<-1E$gk)h?iO?%6NzHbxC5?(R5fNd|quLzQbFm=l?Gjtxo=lMQwEYS~`8T$*P-u zc9$9&Z`U&7z=2-R4-AqTCw~7(?JnxgG*5Yu+5b+772s}a%o{E=XVjP5ER@JfJtwPr z-fDXCQCnNObQ8VBuKTd6f0k}k{gh`hXG|G4b#&>poUdIO{rUO$#Qg(JrI76)@g_Y5 zS3}7$44k@5k6@ZqLN0n17!lqy0bqK$6(Q#2w>;O>$(7M4;W*UB+Edx8LDL`{p`Z19 zO#RDpnF>=2$gxNg)r0&9^jvGcW*1YZ41y}8D!(F~uR<&q-tr?myE;8Hv!mz!^3^wk zYo-4+9Bo^Q4CGs?p>|EAzLiPurC)6uUXRUDMQV_i5GK36Etfl>#o6e<*8J>e(P4PO zjU-1mZ>Sw^g8plhY@=;A*qGG{ooQp7hbV^PTj&cI zPxGnrJ?_TF=69Lfyp%;a7`+yCL11PV_$pK@Wnsf&>uFQ2lj(#PQ4ZIG=_O#!tOT;3 zW1&I2wa((ww0KVzdkpD5c7q@$zs)TFk(v{C?$)=8{XL1a0H-&;0-+Fce`qvYs zqOgbi2CO#fYJqG$w1eqvhT2%5D8s&xz#AIq;f5+{v%nW#F#FXwr+;x5!CnhjS z4E@OIv=~!uW!Y2Kek0ZuB!Ufm>25*O*4R(pz2GS3%1%Bc;*PIUUaEy}jIN@`su36< zC2KaVVX%j*`Igumss8;ezPD`ULM>v`!LaL|9?NXs^3EqhaK#^pvi3k2W_nVMBzgrB z{QH?ypuDlc)5rA8^VEI%SU;h?O-1w9zuc;%3_o?TkSp#y39UJ+c&Fu8)VkBUJ8#-M zM(+UcK{uI#{s|}VlR<>r3Nm^i!<0+&0lu+-;bk&|Eg8e(W>K8fLfS>FNeczCHpxlY zZv)Em$9?q}hC@pl>6}iF)AqOyHkI_utS;YFPzA)qiA)fX|@NyQI`-&G@m@lSzr4Qii>E%y)eA}DEhyr3?ZvSdweo9N! zeuI%W;3WOGLjEQaiqa!R+3Pm)ertIg6MXJEx`8Owjw9GlzvMNm$J77A*gOAr7VzEL zwK=shb*Hwcwr$&XJ9Yc5ZQHhO+qUiY?R}E>g!}BlfWGCyh_qx`ll5tzC&z5FT3Xrt!)TLhhhZ&@Tw5Y$hd659RMRS6~BnVdOX57wvnT@4~RQ3-9 zc-QEFTnGb&m|ITEy#LQ7NZLb;UC23te;40SK;%AXad;xV_Nvj?#1rF8tH^g}i>ItO zan;xD?{>&5FHNJy28{cikc0BP+3<&?FlIm3bz%-hgKDAvq%0!Li zYDj;tyyt!~Abc>k5flDSk|fmK5K>QwjGA8kzVye9J*YpDqm3PbwL}Ic%DNUoQDitH0m$X{CvmDwGvmkG+ug*suA+ogFc{6ml!tFg z_s6f2r1?Frqoh_fcoNEsN(2`fb>-s;42KIly(n)&H{cT@ZamTWRk$fjdvj13o1>RG zn_)G3T(5p41p&G5(QZtvK9>LVh3FkmXt+J}BdNx)2m>DNTF-?CQx;j`;;_Ym%ukH_ z;u2U5n-#RA>%PuT9>D)`UqD6Ophy|CzTotFV@56Y~}63*m1nU z7jR$T*d25K!I!F6N{2_y$7u2$@RZ{lT%ZL9S?Qxv#G0>R$uz)J(RH|F?s7V5L{-Xb zkxT+^CZs^b?hA8>3U15Rhu9&zvdQykw*J)SBCnVuhq-y2Xel2?w%(A~OCFXcZM6wd z-JV;=CPMrf&#;%yerbjZ*%r*Hw6GPDD$FLD;R_W8aWrvZE5*u8{oYcnx#+8KdcBDD zt-4uS)s-u3IM>eJzugx{iV+T#Sro9sjgue*(*l zzGKe%t;W1QmujKKy2gVvx{K_*DP(4gJ8vB6Kzo4!V-7wI&A9j!v%Mhjs_`|bZ>VZj z(KaZPv*_n>!$~hy*f>MBfLNp!Ngcm)v9UZ>+S@pt9yi6Yei#~y<$;KDSkX-)&AusV zma;b`~<82+EY>mt2694(=6UaF+`3p7E zk%2s;z`*Ner*OyNuiObYjsv~zw=$BSCcn5T)wV>)I0o7}C?~xticer`6Hvct(ZDTx zk+5ToOu`O%(sb#XsG68uU2Dd<0_(bi4)cHB^@k9ALUsC1e2-wpB?f{En0|{xq(#M3 zqt_$W=IQP?JChwvUffAoTnm=2N>PNsVSAkA?9q%jMgGu5?|)Y8e~*~g-@FYa6j+4; zm(69#IfXF*-ztrCgf2C_E57g3@2bIQ)Bh=7{;&SGGchpySH2w7Y>i@SMV|UZ^#Fdn zGeNPtYjl3U4xc9Leu|e9l@`eI9nGu1_m;WMnauQN_;7#S7G6Ah*mHJI z^RJF-d%c#>X&gSA2Z|PXWoctMaNt;uu^HR7k-QnS?GH14W$Dffx6`HIjO|nNblpGH z#T>O#c6)tUnW?+l{{@xySm60N6@7N?Qe67Y>uKii+9B8cPzAq(ZFH%{hnS{bcyYLo zoeG~9W^bkme7QK%S23(jej=u>(_7h3#5_As&~^3dHcxp^CTMrqd*+h~kk04(EFPmo zp!)uP9}S{^nVtLo=KcJ9SjU;05`w3U6k^U8&9zG9CtUCQg0#arw7wD2Ik!=9kDD%O zXj}1eD`echgEAf;=IE}NiyzAuk@jE=XgHJDMXNmqcEF-+7P`X{w?Tm$VmZ1?J>_}nYz=a6y=_J1@cYDdEc*R&) zl()<-keMf^nu8CCrWLsn544C_0@$Yf!S9iRO+SPnbY%fu0;+T%0C3hm6spfLUb!;{c4CJm7zN6}sI=qGK`1&WdBg?@UF8DY9a6bD9kNnLCl6?$jKD6v{I6DR zHpGQ-K^rmE^4yQ~*j&V+!V>V171jJgwLP;v; zT8Pv#*<4pyf@75_yMV;;a|_eWtDg*B%^p+obF5KQ#%5zI_e|q~LM;Dc!bi?wN7x~q z@KWf?|Fev>kK%Cp@~vWgu0Te391=>)AkQ623*CM~0c2GW(Meih>iTu45!pJ&zz(5+ zF=FWQORt)cXhWG&D5x<&cMD%;DuyejgD=|s+kvwi2(-5&r9X43PHCvu-@PFq#+GsZ zN8V45sWmr0(&A>x2)h_dyOgt%W|;Lz7!5Mi?+syN6F~>{#!tv^1~T@LLs>>8NSeL} z^g#93govh=4@%P5TBRly|3%p2Z^ppB4H4MzTCTtBaHN0!W*xjk%=n(KvS7k-%Oi3P z36sz}E)1;C3y)i_E8H+6W1Ek+%utQ}>1BVSyo%N1ScmRJXAM_y6L7-$#H+_Jl zP7lkaHU>v4C#G8L#W)Il`5Mnn@Q++Pp@RdV%J*XFC;~uwi<>YF96!8;zj~%foFk^q zjSEvP5eLwWSze+@3kvQ|A-aDZQ-G5IP+; z9py1d#T@!YEqf}YQpz}*+pW<8-VB z^Y2?Ul?u!rR8~0u>s-$?R`)E4SeM+Q`N(XqTThl!k#qu}&RAqepFKmCGaeXdimK{GGA(`$6J~|gD15_IVF&V`&?PI z)F#g4Z05?u$8nQoY0gcxa=TxU!j+|@I6z_$ELS9qFFzH+#!Sr{kzxt-g5Xg?ehF^LyyBFtKTo&P~INr;$ z%jYFOweEedj+0u3&tHJ4T$zB+=p~NUzi8>D+`aPr-NHHkLPMurOlWrc48zixaLf|0IY@HgavhlC*=a;}R*Z^%zovx7 zVlgv%Jt##G)KplBgRs`d8NbW>GFM&b>*6^=Vw1=ZJ|Z zZiRUi_OBt=H+ z4QN_{Lr01=)5P`*j2K?Uo2{L?vJ-VCWl9-LtCW4Ha$an@ARDN#QSh1@n-kyoN6Cqo zf9`mO#9hm)hhe8BtTJcMDoi}BE_gj)>6fJy6o4*G)poif;>t*@adoJ;vcpzct)U!c zX^eb`QNz-jMBpRH|>f4qQg<%p)8}WEa|IRnEdCj^8tIl0qs(4 zIzLOKp7rCCcA(fF| zpX=yOHtSlgW(N^1U+ZGzwSXNYQJK2+qLZ^+ramsTq`CO@wkFZ?juqS^DPb@MeA@bE z=`*4o6Q$B*yJ(kS3ZT4z42+k`j(;a!qyAyLLjtsTZ(Po{%wwSXkqa4_>GYKvHOH%9t-;#9Uc9wfd1rBN3*Uof`Mi)1{*&=K!n5__LY1pT8Wus8TNZKbKDR)VFO@-Y3ei#qIA9sFpMnfykcg~)M zBbs=z*{;=anoF(Yu>0E5zURGJLr9OBi9vWq_#NiB-uV+&QH;hQcC7Jf@;D1@?c1rh zF-TxN%1E5c4mB_7Ht$vd7_ARAh(m>UFxSm7Xr0T`6^I;qd=G$gRt~q(V%06?W?2p9 z6T!SVhOOD#Knvc1@zTI6Rt{1{tNN#bwV~WsM4%TUDwkJUDKhHn#FTKBk%rr)y(5(W z)+T0Nj$ut$({0m6^k0-scqJUGc<@eZ&Fc<6zut@iBG%tn7v} zEeFNH|2^h8g{{{6ds+I+Qj@9W!zz6lL#7}LUnV$!IC!vR@gi-uwT#5$eWQbPB?)s5 zYq-q(MIqL0K3%Nn9p-VP;d)ald%^W%96)+5!b z9^U(hSTRS9&_4KC@P5u1A?!1Go|}&2vQJt?`*oJ;Pc`mX5%@nPU${@KHt$NI)|nTI z{eD!==ER|e-T&MgnHk_u!mtyhQ?KDN$779vQXRIJ%`vydmZxdHtg*0R-Qv}vLD}z8 z2SB}lw{NNzRK4z>&(G`A>-lK{F`Sq*MGdG^C-6V@P8oASJR>g=?IKirgXmq%eSn%D zX8eeu{$6%h=m5;$aiF10RtD?sV0U%yYs6g(m5v;@p4nD8bs$QBOU)1;K!!%S8%?5) z-p0QnG$t~KP*GZd@6JnqV4&}(kOP~OHFhMLGrjUhQlxm|*|@9L{R@UKT8ZM2%G=L< z42(MzF(@~Y{8BrY_dFcrHfZ%l$bg!#&R_Xolf9nxo0ncd*D9f%KMBNHYblH@Jyq-% z9SB=4Wa4PtEgVyS`OvxA?Q@y=&MGEfCT;{TI=0{B3EIEIez!t~aG(jx`IqL|BAi6^ z@e*5hL@~S_)R(s@-(tq;hkHyN*6ojv1Q>c+yIxSVKRx?soKpx=x8H)US=+PmW=;di zqWRk+*N_kCtld7%9w`LSQ=B{F+t+ws6XWrXCOQe%EV!n4^0{np??KEx>!rf7w|gGa(V}_BTk^!iVn} z=oz7R@mtfqDt(o!f~Vm~8vj5Fb#Z6HDC@OY5wt)7XCkDBOx0d@Cze!M7e5F}Kvc); z+-V9Qfx{_1PeW(cjYX?C(gn3n8FhXMv8S@cB`&|7s9ooPj%rywO46jr;)7nevZO4T zu#3T~xo%#2>#{KwsaUrlRfYblwbL&Fu!d*^B?kkw9@`t61 z5NaIT-8cfL$a#~?>|^3U|Fq}#-C^190{H{9Vpu@?ZP7B%O2n61UCORJed~X(W(*Te zNbjD?fc9EI>=*cJ@oe3s78+JY03vcC(|e`cbtP&&JER*9WC0osaPW+i z9KyzbWd=JuGJT)A_*v9l$_%z3ZC$C+H~EuXWt}kOgL^W zO*LKBjU@@IAZo2wu|$Q@begl*VA5FBkSq{-iw!M6sCe}6jA{nZ)8L#ASVLn6oR8wWQZ3VH>5 z<1$srZ3sv_2TAq6}^AHq1mU7xnek4zrDxruSVRhAzT~qc}dPNy$dK zCiE`u$%iZTR(0SHT~!dJtdpec{}^@E*st5cexowp!3?euwDA7#SKHKtAKv)+Rk6Llw7GMmE z1(b_0ct2O=BZZk+86&FA=Fnc%&sH0FFUBt~dNSRGhWdpBz zgvsuxa-xGH4QtHG3xn|$>cfMa#9@K<)4$7Jg??fliC1bLDT@Eo7%=0e?}wq&gpKaI zV4>F6UKu>-Ye(|5174!4vEhq3_0Q$4V|{iJ--V%=WJADA+sI{HoT}bNTpRqw$1vQ= z+kN$*$~zA9p*(V#?E-0DlX3vE+2Ms*x~Nf`YM6L_`YraEX!^5l)DjV}yoTVpRBViv zCHVPyS$s9UeK$zJ<9U5BnH?W)p`wqR?0Z)J^)iqr!QWwFkoajHrguvQoE%G z&|L~5mfG1H1P0mrnuotX&!sAoDey>s!lJkqm$gTrbSjuH-#tS?g=%{z*o~&MPmZ5u zGCOd(L&pC=g^S56jyWpWd{}4Y5y>i=ng_DMN4m{vU30*y-x}wse$VGlu0{Uh^^lol z2nJ~HHoU`h${f&6%(esb#2{whHqiE*NYRsCM1;1XT^ai}Q%>uet&z4Nw0Kk+Ya zApApAgdsg|z6}l}Op_hr93}$BD|nT~O*SWm?9C;CnEP3ktWeBW4m&X3*&aS z5tLioX23;3fCR7=>}S;GerBL9A?vTAvJx$Hs?v~*J)begLQyKL!q^}8W)@lp0k~l% zi#sf&ckF-uIm@04HS*@72YB)XyK-^!)*PEI!y~RO(WP10x=%35F{=ZwRej9$9Vm<}A`r2X;qE4tjgYFDS0n7$#?4#;n~$7^=)faYs= z4>hra*8jNlB(+p@oeF@-dB(VsZ=^HlZ`d!BiYlq30?NZ0L={NB{xi-*%5iBgy{ug1 zO{?1R798B|`{6zZvvQ0|kHKL|+m{Wy3{&{C=6#%1^@E*$z0^_{dwn_^j7^)osm8_| z;`)3unp>u(qJ4cGKP;afUs6pZP3!tt_E3wsCxl*c0 z98F|8Vibm~sR**s5I9f~7`em>PB3HrWaCXITSz}Tb*<1ug7$u$Y)OKg|v?A;9_X(YM;7>)SS=JymXVP;y5 zA}zWO^Gg!*iby0)67oY!ivFIwj(N$ua z<5YAWkgi2zm6{ywAzA%MNNObeFx-QtL3s)Bjpy!Pr1qJjH=x1?xQMwAgG4Dx6Wz$C z^fB3t^TO5;GkN@qX6l-NJOxbe3@d zpl%-@Rjr&@lONRpsGzF)hR?&%1?n(Y?~1BC(ph>n^EyKi-M2B@$){UR6b{uzT9!pw ze;4+|5Ct#+v#e>$rvxFEQ_2u|(-A4pZW=-7B5YuTPWW2X|XMR$d)Vmfs#(x2Kqa5#Z`2O4;=Z(!PsEy$*Q#l|Vxqub(k>r@1c$*2*YJ zKJg6pLhPG;xC?Xd7xw)E{EHyE4$e^HZA{m;1 z2u;8QC={UI^}=77MNA$Z9JGerV~TG_SB>>W+_FW}qgRHm$xoIvk;XzXYSkVFieYrd zx<6&qqNVgt5M$I(kvM8}3+nhOlYbDSg|YLF88;yQi?s2v{>>ZmH(}iDH-PDiXH^X8 z>DWJtFf5S64mCa0aE}g59E&`wKn3nb=h_9_j|CMKNh&z2_Jsyck41cEwkY1Wovq0l zpcw^f?$jq`-f8@H4>Eo6KuXu*JPr*^H209|&SAwJ`OdKf5mm-|1lYv8aHCBd;eo8; z<%iqWt6efi@RwEp^kvaQ&z`OKtW9vGVK4PJvlj@Tlkc${4G945DC6cI;0UDpar(tT zfQLIXlJktuURcJs^a1iFyYDLPO>j^ckh%Sq>WiJ>R#Hr{@1!F@qHv6N4O?p2T0l61 z3W)~Vkud#yu`|lMcy=6vt{KsZ9yWtQxLXHLph>~sz2CZYRXD_94Huxs}B70St8H(S_O>t75W=M@V)hfzvW|c9=1GR@EaPN%sre;$$oTodAv1ha* z7JddQY=YMQOGB^l?nvVV#6X-h<~Hf}86U_tg^*M3=Kp7IC-rQNgBSbE#1V_;g7$Pe zUuDPcYAJshQeGw7mWJN1J>^OtMEi&f_q*qnGAN3|v2a|@$DfA;X&*_i4T_3|@0x4H z^EjM`(`NH9W^_%7^l=2misIjp+USg*($e1eEc~;hN)kEhZMu_AB~EXu}P8AD0Du!>2Q0B zKaFcW$PaG0z=*zX;D#EV1lxm#X{K{58(Qs8^a-hjm1Ur_y~6#vrUud;{@T^Etxu#2-FY!B zqhawer(@VK$T~q7=~-zvQ0V=p4sjGzJ%`F}KtzG_Ln24Fcxe2!(AV3}d6ggGUa&BB zF9kUfO8r?CKF4y722X!6BSmT97D9}V=Pc5q#Bs?>Lfp#uA)HYvPcof?>J zVyw29Cy;kqR%=ImaWnLEm8tcY+y&djMy;mPWYCjU=sKKSpYJ9lxlhb}v{>eIC9Z@T zVw&1ED2MLd;F!ns=z8;rJ10LeBl?RVj@PLV!V2@fpMSC74e=g_hyL`pENnNqySatq>K_} zv`%qdmrIwuYS355=}idy+`E(AyYqcNnU?AKplZ6@FKANyN#Pz4g?tDs@LQNFVyNiEUI$-sViHJ4I|;OQj}0c@wk7v(hV! zmT`W#%KbCD-#uSL4N;4(Fppwv9) zESD=6TT*TvrQPL~a!%;6=9FgcY%s65-eePKs|hu&)bKAG{TGkoP&I{qz!3?;SzADK zMsYW;wJ0$12e~iHoJB;_IE9ns%@ZU@MZqy)+t4+pAy^^0Cf!0>Q5kuw!F+Uj7q`-w zVpCla*CR#*fJ`Jh;H?98;X{dv_Zi;ry>>Vid4Nx&)C$yJ84BZQ{^ZcJUY2EJr^59>j_0$J+}mKDsW3~M;|vY@N^&k!+fmA1l{m_9~F>06OM@e&F(G#Oybso!9afp z+fH|Dw{~obfV*YEC&yzuzd-%A`L%mr(HC<|TmaP_*z5D~8gd%T8+?n%U4*>A zGR3lcN2BYLaH>y4;mCuJ%@^KLfvucCBoDyt`XB?du`mxCT z{G%{z80N?{jeX+Syjx{s{P^ayKYD=r(r8p64O$Nz{+)S^bo}*Ty)1M1 z@!nJ5>hYr57;lW*{mn{YnBv0d`+a<~yt`~z-VfB1An;A7BD$OMObb2T>p%mKpJwSe zTrU{!wh>hqRsJ4X9x_xOc#cvAH902{G_ z4Qk3fKl#9KHbm*JmwnXKG-V&;v`HQbn_Rr8p}->PPTeA1uu?>5VFi(Iy_cy{sG+1L zO?_q%c~J3yKav=4zAuRZAgCa|30y|9204e$(QWTGC2aSNdv7C`LRF$>KnIi3S9*1l zC1?Si$*rD&xK?pklO1jc*fny3?hkxgMe}b;zQL!nFQS1>!i{CQeqzqP>#aSKYzt!} zIkHv|(n29~yIhU)Q|uqKEb^M_qUY0@?pJ#nYCvHitoxoMNp3xK+!%{f5Jo^5e07`E zzsJRQlR8D}#p`pY>K?M|6h=fQ8fu{+?0;DY=uZre^i{a zh5psSkjPFmK5jjp7za^SUs{LT34S}P5K`ySR474L2va!XKyrVR2)maT85bs(M@hzj z1qQDg9YES0BkWJnGK|Z+C@t(nv!%2-c;xew+ArL>k6jz8`UO>0eIgdaEtMnKrjgA? ziXMm!C8|0-^^%e)C!;|w1r@z%o;=aRp^vRr{@F$JL+T5XOYjL#gKnAmT?5p8q$zpP z-F>y&S!e_XZ=|UvSPv|r>i$OjoQw36C=yW~5nahzLFDBCD%-nSLfxsi$m+qe#TMx~ zAq_YQVsJo#SQKp`%O;>D+R`@BwXsc_E-y}QfAF6>@&SYs!X0-KMT6OPC6FG3nTcVF zQx3sISCuHtd)L)0vO+6ZVZSWfyk4)X!8%BX2#oo1^;shDdz((CxY^|;4uR;hlmkw& z;%s#oXs7J^iHl--0e6svJJQ6wzS`~=Dx!!NZRB4K9^;K0Y29)U&37e!Dd|4T1oWra z4u!=a*99ELMegejdgZn@u-l=*bHq68a^ z#fRZFQhNQ4$Z62IlIxDL@P@0~O3Dts2eNtwDB|)_2kgIaDOrX;btml2SHaCi^$h_D zxKoR-uQ~>uw8z+iICS``OxMk54KgT<`eswk%p}KUp~*x1Y>aFQsTt800@Z&(AR)xf zamjc__G8c+_7<6)`1S126$bGBJ<>5cVj~Z8Dx9TpD=;}}+bJTRl3|#g$A=t>53?{J z0&LXS-sJfwa42z{K3WLT;l1?vy!ICOGuZHS?n`owe#9QP2OQfZZ8yFP<>o%)w(ZT zF4cw|DKKkJC#%50_KBH&MW0vG4Yg~5(eFOk#fmV5STKM*g9I?a(Z_xb`kN( zvEz~4#!<$51KUgwkn@;wPrrU>x%lYt4yHDmAk&>{;EgV0YGau+YK(@UQ(b=gcWWqV zF}lpdG>-6(Fa?g{Sicj^>722`*P!FZ*hEE0^r+%9&%8bb?Oz1an7rhK+H5SR+n_8; z%{?d06zpJ#9ZHW%K4GTGxjG=OsPxZa(w0b7na$$6WI!7-wv)Q+svVp72NS2pyKR+%us< zPh`1IMT;S>#?e%|W`e8xkGT$QE0kX3xuHOzv`z1+8j`0zjseDbVa`ATj>XuZ zAR*0orp)%k1}<5Ta@aJyywMEil`_2vSo7GH7#1;DmAC}@(?!Jn6yzI~PbgkwC>Xb= z@DQ(RH&mgus{GV^S!`JV+U8SIqg!-InJQB%(_ZJ>(@BM6EMr8-Quh``Z_xfI%Smbl zjdPP1e^|3xy`E3h7{)`&u?k}CtRUynj=y`&^;&=kBkFe&T}lBrId`aRPByn03m7wb zcM!hFhU^5jOHo*B{(x3_v>{O&U8(K;?Zg zUvrri4(vIh#}C;T#gtZAPQSfGtcn+JIN zA#T@xdKGf669anWJ|=q2?}z$Wkp18TGMKI-Z8}|U#|0Mw&KM$)p6D=%$Z0UKF z5u$GJFH)MBvc#g>F^1&U%cuPCB$Q&=ZPSp|>wo)ff#p+wZVY{d)2od0wf)u^yDR>D zhhfb)-97{!YPk>i%DjDp8TZZq@-?>Y_L;I2pSIXKQ_cqhoKLl<%8s!JYN{Q%SAT2u z_`7RIy;lQ*0?JZ5!t^wlYfFSL(0MyiJ5NO(8rioKAvf?3?Rw-cIEjqA&9>eRk26ea2(4R zQ8)x+=r9Ii%2&n$$!>OinE*0#$f;`RJ9U#qw{va!MG=tCS@cjs1>Q*2>2meZ71s z$SuAz0>kRlzf=!V0|U2xrItK*O#-@ov%i==>vV-*-ag)sua0%itw}TLy>8#OlCWiF_-YLwKP z-8J^W>sL?Ki8V`i-iFh`wZtBapV_M0E=RT*4ZpC3Kyd>x^Z?5>C@hmY6mluuN#>gl z%r3#u1ssF}!0#r?P1Ur|dBV?VYmE(3>AZil5{bdKOQ<87L=T)nn(;}jJ@5W<8iktC zGsQEBkCBRtH;!2NEgSgpYT`P#;Y-7`BqUnl8J(w@z?Yz*u|Z+C1Tpn7;=a^5ec@2; zb^?j&H2dM?rH+q3p41${D<7zT#0p62wL(UT8mSZG$W`o_e?4r}knvG-Ba6qLCAB6K zz!NN$Ri-Y+rKD}VkqM=pf)9LMA%s|N_VWN5~ECLdMb{gYYz9O@04z&vpm zZVSsWVdL739b@9UsD#ecs&X1b^T`L!~j!XA?I+lUpB`QwZSNFp+E_h`a61FmP+kJsH^~H z4hu0leo8kNoVOgRqftNU$s_g&;_C_f1h0UQAMb+YIm`Lqv*w6~jV*-e_HJt;Lo@YP z*M6J0YIvE8MO&CD!77iui?u|}7FIleo(KW!59VJoDW9MS}}hKD*5z=?>udMpK0l2kX0 z47!AnZuKQt&!)+9S6yoS(?zq&1cuszrs1~5puij|>95JI)Idvda3FvK#sT}i!+xA5 zojKJ_&d<3$tI&_7t*x$yLAI`rBuq@-8DH7u;P11IBo}!PRQk5V@9x4NSC$a|hyoz8 zTuQ<%yx16e#orO+-3>?G?FF#vhywV@?~E3-;CqhUr26D8g}dfzk3cx#m(OuK3Y6PV zd)+O`(oa&vx0r<1#4(AYdVdnT(6&v8d$flxMLkvz(Yok_xFc8(SVLK5`{B%dFgg>} zw2k>}JgM=6&Y%&IFrWXG5Y;C^XmMC615wPmq$b663aiAM)!LVl9B|ulyok*ROt#y$ zSl~R>G{pPzX>FVkIx(j&7D`A2+qV|q+R23Oj(-`9Y!A?l2-2SsB3_|eOh0R^` ztnDJJEt|xmmkg3|!B<_SPXgqy;B~(62%QLzqLqZE!s>-8zj{oKBO)0(e#CDM%B>=Q z`A%I3PaG|Q1Ni_iiG%0u>uJ4zP8_N&T~Dc)nVn$|s;?W5q$}`h)tx-4uyLt+fq$U$ z=UvlPOg43!>_JT3$KHo!d|IZOooOrCF^!><#$0d0b-m09@TRe+GQ$^RCY8+lJ3#rO zc?b`)+}#RtzYiC#Y`m2RuHo$rWP6CLuM+L|Cp!m02$#f?o2i->HdQahIjJiHOcsvp zqa(70B)sIWC`6%h5kr6R-bsJ?Ntw0jrA&dSvQ?3p4hnyhV(@4S7n_pX_Z5@HjM6f8(1mz^p z-UM7wEAKs>!PacI8NJh)0#-6Eu4D;#s$5(ucvAK}KP#1rCI(q1bKOgu)FwcJ!BvGx zK}U6uG>Fj<5Ja;rZ!B6#LORj}=jVvh*0vRWrR?sI(AC#GlaQM_(mc3E?7V6c zJh%s@F|XX29xFhpnGT{+R^FtKgm)B=>^Zh69!?M5dEFn}+U;L z(%@{xAJA=nH5MmsVN(avOg-n}DH&RX)xcaV?@{DdG;B-z(6XX{hp=+zaziwSC@PtD z1;*6Jq7zonUDL;bUR9b2WQHK7l1?;DBWHuMMRi1;rRD8^x%~~EO~)>MiR126oVoX5 z!mcXL#q%}zD9xUnTZnwOAHkj)x(L(IQ1sls*pL+5+aQbfZdu8EFw@m{*YMNb-l)8A zy;N5@Mz5bRWoO+nRlM0YzV+oK1h97EX4$GZ<%s zO+>|Ee>gPow*jGFD%_;=_t21{+>S*vT!g?)u+vQ~)7r^o3G2 zNIRVWDcJq57&}Hb*8dVQ4Ql?#2v~o0O)H*&r|otD!4p8FfQ`_kcEKO*2#=9+kR-c* z?kbS{*a#$DTp{^B#w&xUmhOIJ1RigW1}Kl;D@HFy4ZoM9m-#-zvOkWS7jLr(<`MbI z!sPc#4CjX#I~jz*SWxx@&3U~yzV2lPU%lcc2r#4v|Hx8#8Iy~A+Be;zB5q?~*>H5) z_x@zxdM=I@dfoYDyYEHcBb4~-TXj5{?A-?zK70s+SM_7QG2dhQ3hq$~P;Mvc>x_Q3 z+bo;tXze+}aH#0ld_bM3Jo`s!`ZLTQhqV2;C|KG1jA=WkNVxCM7x%cn@@c4Qt(go? zhG(4y6%ym)Ro|*pH~rgHUvH~5N`mi|NJmqz`dfDL0a>kE}?P>q>rklnZCsf|+4jP?DFiRibQu>c-Ez z`eItXz`00FVALp@L{EMdkEQYn$LX^5jPc^bWzUBVi-2~~*T-}0B-`Oz`lPS=t=-p% z#5Yck!=eEqN_w!5Yj_Wnu4<#9*g@6GAtt7rL2mrVVr-fL?{m9Sqxa4b$}FPM1PwPL zr7;zMxfcQ)nlVhQo+jSCB$*0%27b&Ma{@850ySz@fNVOI(swMqH~1Q>W+g5dA=(mf z<#1X>h;&~azw1U_?aYR&3A*^sAYk)%4UA#`bu5;#E3pQwlCokH&H-p~(V9d+bms6C z2f2uXFH<$rm>SMD*sdR^8rf+`4|b%K9}CvOYn?RVLcq-`@Kxs^SWZQEJ^Z(3Xx4_{ z0OTg_b^}5VsGjo4B}2XK@7lgs4<_IBz)|6cU^5J8c87RL`JXku9q$q_Kel7`Pi{M0 z3^>sIa2Q&7bH}WO`=RNbB#tYIO$h4h+q*{U_N>&=-2B6X2yV}c^c}!7y&P>AT9ty_ z&xXAfA7~cz4uzk3gBVwjQ`t>a(kLm~|^=c$rr!SN_OAwUDV8a13tUDhX~MQPuoro_?aiNv9hF;X z&ZEC82xpM=)bl+BaTM$Sl3Bdt0(Ueo{xSS*jqoyksp*@k>X8H@7fucCCcgne>fYE^ ztE_>)%tq}o;TEZRW_EUgmyljaG`*=zpny4vL-p@FQ9?|eDQuxPaLOC3U63~`1E`)2 zwA-*7AvHlSRaO+Sd1~XNS_AFEx0lWb%~7!z2_DK^>auWug%C_0gvM=v=NL{QQA!R6 zZ7)C}aLkr%%)3|cZOAxWg8AY1hg5aw(}c2=;i|uPkeApRvCFtgC$=vP(1jJH zcCFyS5txBCijsx4-Z=u*4Z<7;0@-Fz6B}|>>KmVP1`(LC;2K!31cZGl2I+1DBE_YrQBY1+8PEripnRZzSvs%ST6erq>Tma;b~3n3n}`YMI5ABQ3yM z2LzVuCI|mcAlw0*5PWh{67~OM>>Q#*37{lfwtiW^Y}>YN+qP}nwr%^DZQHhMs(WTJ zJ=2Tc80qZ*hwDyWso8f;UCZx{~Y2ETe9iwoC2uW9|oNU_}{{J}le z_u4|ID`vk5D*InUpuiWuWs9ZJQ_id_S>r-wPo>W=WKlTDA)&P5b^OiEnSj$3<2aKN zM*aZDibTHi0ycu2Fe~#WsOY!cO?qOcS`yJyf53g9$ZLOz%mnCAMP#S?VTR8zFv64# zV*n~@Zi1y6tZBK&6RA@r3LMi=nr5pJ?p=Mop^LT7}$9<6;mu}M-N%dq;hn}5)7p!!zh#c9_7DcyBND;lKyam zXU7VNGX-TB^omFXd1hY^kN*Ybay*oHnz&E+>%A) zCLdHK8!m&E?Jd((CPCiYD&vOmo|Wj?ZLW`rw{VWf_b1vf{%C(3EtYKm20Y@D^9n-S zXJ|dHuY1Ybve`G=b=5n1?S2?$#_~Y8Oj${cGZy@hQK#Z@^4mq%nLb$tN*o1C3Ol4D za#sZS&)UsaTsRROKul+n+p1T8b51_~14m*90Jb6MsUMU&vs4~7^VygwX&y}0*g-l%{aRU<+(;SSm7D#qWc^m7ZHDYdvu6 zh|DiOYHx%?ufACOCknS11`7!jnu-F;NFw<7y)}{bw-_ z<5yFTx|1fDP3Y7QupYZfbBT83d;=jW$f>fA7>$@vs24R^CC;tL6##0|O6`@0}MT>qbVje}A?}|6JV_sMmr-TAwK||;&;HtrAnxwEiC4N34nN_gCGMm0>G3vj- z{>*q;$h=5ZF&(=6vGE$Qun$;x+^$wS8)uIvL>2* zg#kAfrKTl)sP7A9hc`dJO&a194IItEvw)MYnhIHSoiGvT32x_l{V@)u$F%w4oM9a# zzgr*b6`w3+@wr<2>-+Za2XO5jckRE?#Vr3b2rdiLe_>B7X^hnzwft|kS?VzrqT4J1 zpA{Y_=`Y)?Eig&C%Z}yk3pr95n`ry2yJasgKLv+2)F8SvBFiWHKi8cm+*3Re2&EUa zv$sfGKO9{@pVsetqO9cP1yL67Ez+b%LGceoO>#Q2J2pSBamQXdRRJ%@#p+l4^Q9U| zK`)qf;-xoJB{UP_SlK?mXfwpK(5DPu#UDzpi-Jq=n5XhLsVP;Q91;aCmVtv^&4nhH zdNE+wj%4PQM`IobS8SKDL6*dj{tf&qv4|30@75Y~@oCS^d(Q>;+>7+>`og{3oo^0x z;LA){x>U9kR1{vQ-vI1+*MQ^HP2@nm@0*LN%;&c=A_*AlSL>)bD&qHlqRr4?{?9Gg zKlLEmnH`_=?@!qb&0iar^GzJ%&*G-k4D}a~DDyqRB;B?deP^6|e)EWRMp!Qj+!PVE zflGqeT)hYwJv^L>*v{=shuePyV5v|kjrA`QqoG$_T5T(Xnp?J5n=jER3skp$*gksx ztgx9AGld-^H`Vb=>kNu48kxkA#nsDfkgpB?&n(qX#RPPbMGwZbNe9sfoY zolj~N&5F}Zbs;9JT4KpAg>1M-*PoFCyjGFNj06bHQ<5bc5-gI3!D!dOxYw~ao~2aA zMrIn7V&kRhGdUb~Lvc^Y1Du?tkSXN2A^9aXZWIXdb+GtmB4VjWc{)HIV(}h^$Co_yW)6jiO$^-)(27ng zSRA%8(benNbC*l6+pV+NoECjj0d;`THbqY6P)4ttfz(Ot>;nE)F83bTruZBT=cCc2 zr_8cJQb!Wa<|Stzfl*6PBcAAf@R=i5o37{3LiwhEH5>Y5L;3XeNL=Ttn2q)SUF{&yIuadW3 zHfJnRQxd@rlP?sWD?Ht7_BK_+mVatf^OeIZX|F30Q2eRx_!DKwV91~o0eigKqEgYv z;DU)k`q#>f))0tWJxEllL_E^1*1b*kyErTZA3Yv;8mtuCu4zj+HcL$3D725}un7}X zkVthAuc$flK-@OzQcDf0Ml@ho;JsxjGA?Xj-*|!YSjW76Up}W%MItmJm8iBcfYgYr|X##I@SiiA=O-Lmc7?bJ?QeeHlUdFzJ1^Tx$jwNvw-l>xHG@E8~$ zy5kM`j?+4*i1}?9zvqa&L;w=&yE9%gP)5WIcKth4oB<++ICp_PM6m{DFJ%&xqU7hC~eA381cO+=e&}v2Z_hs1bKHsldE)n8 zFd8W6i|COng@PQ`afO#f#)}Iqh_FDM&}_<5T0GsY38|#BvXIk;MfyY%rSyXt*Vh`t z${2d`JrYG9o#pnCetjI*!*^@ZOA0Q>2U>UO@?ix1RO7=z8m~_CFR3V2xzF{X@I;*n z9+X1emjZR|EX|#eoZa52WQ%Mc0T9(nW{#t&EJDzFPP5ii(b~mArq{I3MWb47&zRjH zlWh0ZbZ|16)$7hg_nV-|8f$d#iy3IlE~0W|M*q^Bx=9E!-&(5EDKEC;VkyT$nokv6 z8I@EO(gJe-aGD}V9lm{~WG14I*e6SR){g?Cqf@>IVh^zvto5t6!1X@R*DLCPZFN5S zR{oP7ZKAYsm|U{^AmBpJQ+(<;+HLOhom-kF{XkT+6WAY81gBQTB4njsMpX z{_GTb@XsQ>c^`t8=Jl8qH((ZmUy%zysexmK$Qoe4_(W_o%@Sdhw=9n=xeWH-Igu+p zBoW1IXRPvVDn5=IhP9!HCcbH)CK|GQOJN_+r^#D4H4CmuQbA9PQR#yRH4sC9rTIC7 zu&c8V$VGTe6jIGbC%R-{qVrGC?USP-0;}Qaav^Z9#y%C#_I}3@+i1~~=M1hWp(QZ+ z2}c@yiB4YY9$)BPBiPwJ^zz^g{AY{)jD?uU2v0zTkRi(EmLtO6Aq z=rq$oT8ZC@WuVDWl+~Pi>hD5sQF7>YqKmSGa&H`jN5>Eo6v8Z&m^uS2|S##G6 zPMQQUg|f0}#BC*$r=doz;2Z7_tYKnY8D1yYHiE0#tR)K$tg->^hAj(V?P!Vf?O)YA z&l(d?n7e?+Q_?_PwrE&@6tf@%@RrbWA^C2d2v#TQ&kR8$5!#$YmZ1j=OmsdT^`;>` zqJU?(%UMvV8fH{gh}&EaYKRFt+?WFHA_qifW#pa_nNf!NT1<2Rbpz?}sYO+dpH>`< z{_UxyayuIEabeh#a}OxGloM{MRkS>U<6wya;Q!Y@=>> zQgco!=S_*{d+TBu)*e(~KEFxOk|Ol->(7uPoUVsVrKNZbGD_mduC63n1MlAVU=G^l z+~&7fE9YJNUmFspQi2(!uP5Lh{*KG8TU+gMLBl*~gtz5MJ&oVcb(F2no13 zUKRf1njrNzi-1qMdvVsv4YC6NYUpG4qwd7K?y->@<-+v)JSzEygc7tT zb?$01?0nMk#v90Z}5FsXMz7toBq!z1?>Otf!5gc!T%|cH5uI}_(SLQAK={$q95wf z{>UWBV>-vNi_$h^^`g_}PI^d8i?t@P`iN#P-T0r!iz1TnpGBrYCQe#ZUTxq0klfq% zmFw@)+Ot^S`ox3*$=Z@yYYsBXrYurW0rs>Wn;$j_Z=T$!fsf-NovE>q*z+Qy?G<7c z{@1Sb+tD)s%mLaxec$`HUwO(Ca#HJ7O==udUkg2TvguWPt&b<{&8>sVD~Pk4C6y(3 z{kyW&8YK0Wiv4Gkx@f(SkF{-`<(UO_SX<*>d#otKU~|^PpWw)S(rJ5qJ5$>$BU1Qo z59DfYSJ2NUheHg8zOV)@lJlSdLiEkCy(q9# z?)D80gAvGBhL*dEC&LhDX+E{2q7%whgw&Do4P{T^yFkM>hb$84hHabe#(1r^o8aJe zuWiEkXvrky)2&U*t<+V{9l0xP?K0M=-7*YYT4QmI{nS#jMCGsv63ycV{i#O%G#XZS zQF{M|VH0D_isq3TnrSXoM`eokJ5E=xZtBObE_D5-u%Ed+zsK4z}BY)XzZ>ahHyEVp7Zf;?G7)AH&B@q+Mb?1~HAQ$Zbg zaHdm89+o9xk;S3L_Nt?sHM3rh5AUCfxkLzR93Hc~F1yn+Z0+~6K*day!kFRy8#{*B zzy~>OK3-vz5H0#lMN9+7Ji1Ib9sLxFN!a_C}oPT8KR&D0-FSkdIpv7_pNt?|%U_;I)&?q&Yw# zIPDWLRZOwwg&=_LS4Zs!kpRNW_{ui2p5@d9a75Y|_Iq;@Ghr!>uw8!qlScABl12rW z2cj3l?WZI#W#QmQE-oE8XzTHAo!yeE5ClYPVvBPWc9r;s5l+y-(VfIFRrto-V}X5a zwJ>$#Dkki{`Fb0UVG416&R-yA7vS!OSqRXzt7SZNUX(eB-wf=H3e&6_~A zA&Kk1GQqYeW&^=4Mhoi|rK&!bdT6#k2i`E0<~V!T-{{l7NVraL*!=Xk-!5p!OEmj& zRRN{Ao6hn6Qa%}+|c=GyW$MyBbrG zxQm$TX>6`Vhs)ziQ|J(Kzzd6lR%&2#Oj-SU?g4G z#f1Q7Q^Z~BZ`TR|O!f|8PO{tsF_cEC-*@|#!h@U?uz=^6&}85;I!Mx0zq+%KP0Ld0 zRE(M#f(rFcs2W~w3<3`lbTO>L^GY}<8!dKUVP8p4u-fcnm>O5wPMjLk!$;0tBlT8G z5(A0)){^}{r;Yo0hhcWHZRW@nd?zu*f@5lTojSFMj6W@Hk4EMzd+kR3Ji2S@{uMxD zn|I6rq&VS%^PyMGM)W~cDPzthVQmNUC3ET(Wvu{@MUV9(?jb3Z4275|_#zZu2*+)O zmtgiCTEHEb5#K>k=!|=kxXk>?sFfiiOBw)y8iEbSP*Fi6ekls8=5=cFf!0?u_HM&4 zP5VP2+s8JQ!6?$+gwCLSO2tOa#0$s!M7j?=so=}Xoe3LVU3twke~>oCdpSzdnfD)! zhEISF0`Ejm`$F(dH69ZCzX=Ism!-Mzz86uX+TEMc!;q1jt=tI=gvk5ClIt~5|M>!_ zdqT`}44_8)oYtYm)a4fKPFu3bqHv?CO!aK9EbWHd)m~0{nhairjQ(?`wO=E*DnqU1 z?FxyC&~-T-4WtWu-k~sFna!9={-*+|8tNLkW1n&6|EC24W}sX1K8D!bx=YRmIW50@ z;o23iCYyLUsbS;Sc5#z8a934^#Iao3_4Sk`-3^jIr&eoUlYcc?s#1v95H?4(aYx}} zCJ_uY6jP#jcnqk3hIwc#K1}& z!H^m}P-tplU7T66@~@7HhHF2k0PB%_xQPg3XF;}3GgB%C?WdReK|HeKom=+cO&bxz z$Tk8tZF5MRxPWWL!MAy4Ab-utmOz#newI2P8%+2_1|V)4XWqfxh~|(={tY+at?Gsi z8_`Nw5ebG)e~gHLjI16+_3*a201Sing{CaWJz1DlcmrKS5y8TNgm*$?*L|Udw-bGx z=yCIGpN*~t1vCc82z~$~)q#^Rh0b%e7_X8=BZ+$+QQP+?6LKwgvr*6;AVW|C5wl9V z-R8wVn+Gm6*DOD74BbLB3uHckfocyeGAP@Q>bsP!eBEhnYnl-0nu>lE(GW;$YyJ*? zYkU@;&~*Vuwx-jbB&tEdCE`G%nTe)+*;TbM!pXlW;ev>;k;Jojy;=fg%jGEabuB}E z^A9VFr26m#9>%Zu^kecQW9lS!xyG#jpswm&LrMhfj>zM)&m*;N#{DuqF8J_W^P832 zaE2>}Qsjv%Y|0QdjZf?$lFtwFm=X-ngCiI?LEa&ln@nQx+Q+_cNVF=O<)CkaB&BI_ zJ{$E@K^}j0#&|D^)RYL_EzaUbNS(D!@4Cy9;NhcI*P!WalvaYh^bVh?owYNzOTk4l z-oElWt|j|QO42#=NOIls76?EJ8%Z^Ayj_pvSNzgp2BEk--B(KEB4WBgHOo6AX|EHQ zE9A75@=-r!W`G9YYSZi61r88rFxZK^_zAXrT+hf7a4RiUi zX7QcHL?YT`kBqA~o%g%?jx%y^a$PF;3EhbKlLXE-K3C`7+rY!X5_>vy`l3Q;zSE0H zuaCOk<*MVQc{a)@c*P2I%+FXi*rljvv6zulIU$B`IR~;s(JL{{2=wIt(7V>4hC( z*B6!E@%`(A;j?~2pw;d3UH|qjx``Fk9AfJOL@jb_^}(>fqgN{;6NR&4N!<09kv2); zERCaRha!{Zy7YzA?0Sm$YC+{wfFs9pxCXf4L`b(TgL^d zlg)g3+|9oID^z%P0TRTT7pjYofCd%!uIcbL*bOR;Y@@F92!h0c=qTBvB9c?SnHj{rlwUrshgXJ>-NFDn-Y1eZ+O%lnj)1(Re zqg%OX035!3AkaOP!g_E&$(*9C&TTva1t3i?xX-c>qQ8CW6J(UI102LjhV2iy+0F+t z#Zb4m@dw>u{Pl?kyNQ4g)H}c@$&y$D8wD&>4R*YkAYNue`|a3TZV6?d0A(Wn(eXts z8SdIWgKX~-2^&G`Xk6Vk%y(eLprhgCEk=o2q5Xr5wj9_EsM*}48`|dbNoCWqS7O^f zFiq-Ay0bBAi6zW9ugGHu&dVFE&fLucjU$)j{pFzd79MJ^bbRp6<3d|;_%lc z#7$-EOp49}s5uoy5@mf;2)9G=o=Ub^Qy4^|c!@iNs*~|2@D-=f7WgoBROCCfz=IyX zokbrZG#X1-Ek~S~9WR{)4Jth~So1d@zT*>^ve#@{2(_yWa8*v$I}T!jF!83l(iLbh zS7M}_GV1apqE^FbfDI<@S*g2Cxlm1mG>6!HN-Ym8FTKZ0`uLILPKGByU&+cUVd0kr z0iXJ5`f*|4J}QdCC>##jw9qGpk=awX>x=G(@tquWAgfjeq=!ma9J6FTYJPb-{CCEv z;C7>O&rmzX_>P&5McT!T_1?qi{hbrnxIVuSH`th`@K0j7Vk7BsxyWXt={@;nlY_bD zg0pmVABGF+b|=j~dRX^PTnD$UCOCxUz%zL;&6QZgdtJN~YtW16t+2>GwM1cyUbxz! zt7C4tU16=6ghUv6eCR<>Vq+ue;m+)hyS>xg>Lg5~ckqqJQQMtBkk63tkp4!ucu~pb zj7Db@Po+zqqnu;P{R27YDgsBBKAUCJXW)T?P~@-5ie=X=RE(#Nq44d;tlW5}H99?N z&`6n=#0GCPp|6g2(q2g+XuKfgEbIHfn+TCuFK^(J_xdyOqZO9yf+n6s_`khPx*$>< zT_dVcT`-WQ^49%~Rq&dd2gQ~BvDEN}JPRIpa6QW2MC5YgmX#rA%`S^a*U^7U*w7T7 zmTVmEy0++96DUG0{W@aG6YAy9FuB!WvkzAekrqfG*Ph2_uO0+XYZ{N}Yt5mjixAHh z7~7ZqUDVMmCgiLaF51bPY=NguDR$GD8&KJxci@PVtNL3fhrS1X|M@@}2Cf?^o5_N% zhkTHZ9H{rlMLxyp@gL0137bd7`gQY(>l@m8Phx7i&auiP|C(3TA0)Kl@^*f)>!iZQ zQfcLj>ez%nlfts+A%_8`RwZOFy^<~(a{M|V)=F_Wy9>bb9SV!KWPJW5B6qjE)V<(uq*1bg>H7zO3wokxQ#98UC z_A?TUOGiW}kM0vy2;!l5$U*q8YObfq6+2>8)eQzi*x87dAc}Ag?}OpZ7}*eozF=V~ zwM5IoT?uNu`L&s9tdC!`b}O82Vm=hW>&PmJ(_=0#7L1%iJD9X{D~q7)hr8xmk458R zA5=Fd2pI2->u!}!2e2u{8z#YoQ=f1}nw4vw7`)dRKk2j007bP$;=^%d(i~Qz#M0~N z?`R!{D$xVMC30#dJX?Po(_+PyKdW#ZSD*q-t_`T`1E0dDlZC-4nY&*K2eY5JAK_ka zu=y0@D8gvu&^dak?)f*yb(5=92haxx?8d8eO( zS}t7Jk*`ZDW5>y>nZKkyKMO>qt!34+%_2NcAkYZ*NCb~@S{SGfHjrvuWua_y&07FJ z+bOd6$DcAqS9*hsI+tlWGKzka?DehEO3Zi+NcXsVbr1S!8W$jndV!6Bv2Q#Ml#4F-`HJ3XB(cYQ7W%uR$NS9VL?2cvnUFC3~fy-@#rbra>dKzr5MV$Y7qk zA#V4OG}0=|iEruddlGNV&+-tktZrQC@k}@r$yQ+I-+bN^&&e#-tFXnoTr=w}Qrr-V zh`BdzTs_~U*5oh^3NzcylY!RswO&aZL6RLPl4ZU7}kQT zokM+j>*EKog8EUP%;Cx#0v5T~mXU$cEz8b8M`D{rI!HRgMmqQl?qVP?;0aJH9sO5qvow)Rl)yf-pa`*hfPM0mtlmR1@gu5Hc@5Ap(FGkWc{t)b$`wd7S=8M46r+u(%57Ev!fyF;d3xbs67&ea=jR zM-{k|yt)I4N%+V;=5Az6ogca~OxjLB67p#@;Usv#ASOrz&aWV2CccjS{Yc6&Wibh8 zc_^S=IU-~QFS%&Q5!I`v80<YdPS4~G!bg~~;LqROzwHYQ{_I7RPX^bxHAxt(o)*zN^`wWE* zz2?8c1bOEO$Ve^?cPK!+Gi2Qv?cm6NL<1S)= zXk_E$;(v)<^Bf4MPx)e;mALx#d;eZ9;Uh>=@BjqAfK?Esvq2B@1{V`{3pu0}5=7@H z{2oFAU)#s8`&WLf^rqNu*Ph>>IjlV&eV_5q*w$toZQNhDc&pX=rpQg+>mIFqv^n>F z)_~>qkEjiHE)i$1AVjj&uS6V_h!- zhHHGg1aj~~#C*y>@8^|2>nv0r0Fj9TCIGd#Xs~!1;)-~`W$i^-;`XVraQvkOFoS@ES>gb!>237buVgbkf zZ1Qn~_WS3ct=$2r zJ<{zGgw;u#bO6TS_#yF;IaL`TlLUeTVForY`2|&jXV0dz%CKpa^+T#r5>`jyRz-nk zlf859Qf2hgL?Azk?ZS+%TFiz+yB8vAD?xK85So#&;RI$Y5FvK-Q&^I@;R0O`vq=_$ zGg%=*63@}1M$kkiEN&6{8-nlh{Ux#>OB~J<7a?K{AzKEPhl$kyL4UJD7n+1~K&W#Q z)kp_~9b`p9mEq|U^Ao&97Wc-so8&{r0`>BLI;!e zEAH>Z zRg4rBfzFmlbKC~W!Vm>G;b(=Cg_w;JKQ`SQGFT+A$+ET%xF%2mIT%OuO2!VI6B6Qt zhV@vW{rm|~%PIBQ;gwI40zBE!YGeB0{NvdEG8K6*{iUhfqowrksd4JxN@i?oE_xxZ zZtr1lZ`R{i#m7!VR`o@N?ew{Nr&`m5Ow+}I!}jF4v8wA)|3^Wk#H!hmbrrQ3|8bwA z%OCx|zPJr~Ic6y`bEd#{0`O;PWE-TYV9mJe_56EKX_TM^ zTvm}@J-^!Zp`I!$Jx$u=x3jkj?ZYj`O~&;Di~T(9acUI!k6WUEq44y#99Q?gz6IiWVy@VyOjAzvMos25 zt2g&nZgr;e4pry7Kh+55jW*irpo92dFk=Z*1KCr<>AZ`Z?V@G!iJ)s*z_F5D`Pk96wjTn(Ri~) z&i&x)}FVa z%DPV%7SAm@ktNr$_Zm1YjR{5CHL)ft!f%IM>k6lUvm*D%;prR!7^Gao4E#4?ZWV7Q z7Tcel9cU*5Ax1G-E;4kwA@VB|5VwX3ZQ#()do%@V>cY)NsCT0bF!UNgK?u*VDf$~ObxUQg3B?(KydwNGxe4-C#Uhc3;@D6a;Bxkcx;XQyk8@<&J2 zO;Hu-a9@3+$NHSK@snP=`l9f-H9vafQh(+iZvv?~E&8|UH)e>ZPW%?D)@eisy8Qhc zhaMhUGD{qzuH$u!C~ZGiRM_Z94UP1KlMw)AK(`*IZ#65gr1_6Sse!C;40m^pFL$s; zPEQ~A)4M+)ENFNp$q0D7C2kR#{RMtmV$BWT<3kHa7lw6j6szB?qZCW&28D^`jRZ)z zeZA?!^DY1@H`RJ6Hd(f_DFx(B7%?0Fh`jN=;bPX{?k8N1%~qm^4)2byBQe8G0lFk$ zQY07gLx}oc(!-WFfa!Y)KR(?lEpZD ziD(3gGLPXNKO@1PdrQ_7M9065BjtdDVT57nj~Tx$M<*JkKl$^< znx@^Q9zEHR<0chE;@Cg}6;Gok{RqZcA(xxi+~mbsETsmftK>$KUi^Ai%(?n-In`vZ zwd1>Z%uMS9$3(4jx5bK|rh1|l1294%YWUG19ljIMDB$r%i+a6IgzMCXi83w=)=S6^ z9kbN*vzf;b@pZ<5@zP)#4qcQn3;0o4Qh;(7OU0k8G|oin=?9J|5T|Q=5g6$Wq=USs!Y+Buu4oiH@^ASROj#f)v70Av1URYE#mw zH4-f79Z70^P^??ZOtzu>{?|Gf;#N;~(XgQDnm-46k8%TW@y)gBn~f_%08y7qeD=6k zHev9U%Jmg1ktL>4Um5mWHPAo{u)k|GNUsc#wq6BWWPg`fI1HRUOW$_ZRP$@jX4d1L zQ$B+R$%)}@vQysbD;w*Wg$^}UZ|%v<;p5X*UiDUQ-rk&wgvij7JQemT$B<+Es z+uI%$>lL&o2Ut>Pe$vCdG4Pd@d%eQh6?$me7HIlOu%=X9Bp#IS_Q0^#c= zqiP5r(N|cLkFJcR&1uR${Va5r0S@p_0l7=WU0_Ewj6Jg}b$E1E=1jS?*jugR9+5Kic40*}suL?hOvzQDI?_ijV-J~v|5Lj4;+{!J1 zk+a{L%bQG2JNty@wbZsDqE&N?R=a$4r~973GrC@L5hvEeEHL5hgMJyU$=4eA3_k}TJwm6d8a9q`e7QR@)8@NagX&46wHrfML zCBEVeQtSN~4)0vs?A%+yEqAtHV&6)%&%ktB^rT`uaM9m)rheECedn~PHNYFoSw1(9 zOZz&q3r;gO*@w=tz2c!}cu#2A5EHHSGNfje&y>i9fGQ*4QDH*L*KIk{*x$vzek!l; zpTQp8&UF-muqIhY>tQi|r%O(_5ChuOo^zO04xaG@@v=Nzf98r^hqd>lw-2|cSzV;t zzHpNb2e;(v5IB=E_$a29cTej-X%VzAw%e0hOF9}tg}S{P;%Fo8!Am6!KzhpRmD=YB@)AHbUHX|cg*!uG0Y1$s!cfpRH)_9z@0nS zm+9%mb7vaYvsKs>b)(6Qtc4okOIx7YHo)sdW%A8FN3zCd47OywWwfY{HXf@tS`&eY8j1dewH!M3=(^1d;fN(aI*hlP4+doKB(LwvvjO|iK*d7n z^;*@<^UiqS=;@vF&O3Hx4|G2Z{)|s`fhrPDVvkh4;G!8=iv*vx3O%n0Y>VV}$UH24 zo{s{O;!vsL#}ZT^4h4=9il9Fh_}5^{@Gm>WV#+L_F$_Oo(WVxo%Z8+`fgWF~*ED>_ z{()PI33o37+6{zCU0bjfe=C$v#53$X-~Q5M8Lm`J#UK6vUkh@~{QpZtX14z!7nFtR z|K@@&X-daFmi_5DQGJDP61>yr!+b+9Z&a|!oTMJ_ziM$D!*QW~`v9!)8*rIv<8G{s z)_HS=m*&4)Bn932n&&4S;61InyxjFX>3lnxy)|_E?)LmS>i&4pl?E?(84!HwabczF zMr;9I8^r5;`Nz8xlu;rt=vEsj7l|YN2|*ZktD|L+aQ9GQn0iN&9JMnv?eq9J%y95; z)faAtA;3qnNzf{%%zgUM9&faXhl|83g{cb1dEY+_$9S69N5OWLJANzPN;#gYOM0KX zp5SaIKV8*6#Xg#{M>YIHi^St2B-FS2r+R^+&r}&8HI9++wKYIv54nVxi?Qb>&dk@% zm!kCZyZ9p6wdBJ#KJiNU_2WbaUeGqHp!a9ttMKCtw7e20>l(@gMC<$SJWHe}2-<^Srf@`m`6CVHs9pC7b95h_Y4?Q`S3Gf)t{ZDAT<>fHHXVsrJ zDMC4-DqFXbTdsjZLC-W$lXsZ~SDpuiHmSvXdV#Dz$7IC#+6I)=d~+adWG;z=C!+`j z8jtg<&|wY(Ct(63`#(7HfY4E_!IDG5ZX!Q?8szgQ4ZHTY=0xu+G=p8lK{sB{_wbu(!i- z#qxw@bqKUY(D9_jk;ll^e07HKSw&EGwe0mb=J;xBnwB&W{z%usd2$E~m^;REetafN znWz3h$5MJG!^>}(v*1q3cbmGbeWr^ceC2jTYNOanOI|x>mdCKcTBe^$h64_D$zsLC zfYh*_ixQ|w%XK|O_$MEI%b<|<1BQ_NOz~zEy7Wl;1Xe}6MHkmh$i^nZBB;TFU#J;f zZatl1`4X1`YjOBYs{*jPy~w3-xL3GPKnR5LuA&r0k!;N z6tD9cK{5}ae%)Z))256fmV%5@tm<9<+vX&|WnvkGf8zEi%gsV-+H!u7qv~O{Al)Q} z$mk6uaV1n<{MTmzIu2WUPP8?L6~9CGg1^VTm&AY*uB#*ZNm10!De;=}wKL2*z@s|S z(uoPw6Rs`l4InAy3UORxPuSs}n<3X^k<`MN|W~}D#@nnvA;*RmWc%Rg5MvnY0Bq91uv#- z?!!Y~$?UiqOrp7gepBf_)b(_8jDe9%7S6o%(nbF=`tiWLQrpCuEPh8X6k=7y_dAm` ze@dJpp#+sGKMhb&kGN4LpfTvH86!w3^ve)wLvr@n2z-24kI}(A1$Q?dT$S?)I#V4t zh~*W_zjM$3CaFH_F1pIRkJV~~bE#?(zS8Q`Dc7_8r)eQO##C#{xIQe8uY(hn2wBD# zL+q=Lj_{O+w{&fp?^9#!mI@Z+5P)}%KlrVL7h_O?S17Y=#A*{8#9k%(b`BVEF>v0? zCr@jqVH$YqNnUG(h&2wsnrgaQ%PlcRTX}PEw3QiM-<2L(BNe#mx*R4Fwl2QzInr}p#~^m=C5OUqUq!HnrCL37YZ8M15RuBz~q=kf=41` z1!-avmai@X7Qgq{%4Tp3%vxA{oz3{B6&W+6VTo%y4)P}y1jw7e#oc&5K1-UO)IHh@ z2bHs02<&bYzSBXsaE+?w*8$Du;PfEk!Z#vy!wN;qX~&ibp=Ycv%dyjonWpC%gA9HN zoJO}kPfryG&nBVH=Vl|yO@k*!^U2ZpqM2^ctIm-jSkuE$liV?Pso)SLgd$`M4~>!U zA%L(yEyf?-D{Z^$QaT7HF~aMMyrL(w@8HM6?y$Wyb2S|Ry9@GA8ZQX)LB#jMP+bz# z;4nOj_ZQBVNDR8Of{Z5uPohX`YZBl=n|Gj!lI%l?0c(jU#o`|a!MO0&;C) zDuJDQ0)Ik|AKjUFlq)GG7nrk71a?*q^T&rY%MdaeL8Tc{z4Z}DSYlWrhxV`dXXZV; zZr7x$5QKp6K{uZqs4Ig(XJDd?+BjESO`T?d&+##7wlC#Vyn;g7xScNj&k_~7xm2FH z9LY6MaGB&$Mh`Ss165bk+G2}}v?)HhxGRN-z347+rbt-P5}WhQAUm5n+Iw9jf|i@1 zIe@a98MxXbgzF$@6ryE@yL<)Z{2# zUqdF#94iB7W&9i|hG-$L_cR@#|Cx zClW712GwYbmbU?aTL_}WCdr|L>3WdmcC6d?BpiJ8(O{+8=57vniNPwcx`#)KqK#n!RzEGC#y>vSJhwNq1h!jy0X_6balX9pFwE2j^q{^Yy z=K{Qu4Ha7)t*66fk8~`N7fmQ;XO!gmyNO7*Z-HHwnD+n0*gH077N~8TaXPkbCmq}9 z*y-?2(y?vZwr$(CZQHgp*>BBM%`@|S*gs*ds%^fpn>S4E?`Szn9!aLHq;w7n zpIjwuE6MummS{Jcl;#hWR8uA;+|a!1^<#qec}c5wtWRhF^qw98P zM`Bw!ZDkdG>6=vf(~x+<85@H^VR)bUBQdBWey4x-asu;eUb=v9PBVfApY}W*moI(E`$24;&ssUe<3n)~)u! z80?~AHgf-l72G;V$+T~gSeGjA(|mRu=GjWXbxGmjYH+dgmpmH7gjXu_WGY8-gY+gu z&?a1!uYZx-_E63;yOY^7iORkRU2x+6I$cOAvYWJ~y(?3sYW8K5q#q5w*1ac z^zB8J`t@`Er)h+U%+T|{$W>0J|0==A!Orpjma9J#$x#Pv$er&r51>@`#lKMRe)p{S zSU)XT?g&d#O&WUCFxLUumXRq7DIxX}eC`Qhe?%sc0Bjj2)m&e}P+Y416nayY4 zQHy?P6@N$;cC*K)X)#EaKS=$2pTOQ~7%$9?I(zlng|8!?05{M6Wf(^}P>C~~J^lS{ z=wMdW_#cz?ndvy~YmQ)s$2mQBy-2C~#kBrH9W_t~z+8Pq+>g!vvVmG*-??jSV({{L zpWJ&=!dIPdr(pj?-T!A+BUX89>4o-&bA01DJG`3R#+&Hu{z&>_ChvBuk4*KR&6EH$u=N)1~&rXdqBW3vRWFCN598GkO6dTLVkG(8PLEzV?}M6L}W@hb!AuQ9xPi}H{#1fnE4 zbduX8WGm4VSp-^tFEzy+hHq|h+W7d?i8P@bf@-a!e_xoYVupmi6! z#*OdsNJdJ!Lyx?k^>L!F8Qm_2&tsVv(Mb2|%>BY~0S?!;FbER{poJsM2w_Y9#tURx z#t?EyH@(#TbR2y4Js81eM#H~@WyV}ISMB6r-*S!?G7ai9SMam`hwtsYfnSiUmre3+ zonWvO1~`~8z<3}5-KRA`aiRK!MhQ6lDJbDA?0Qh6z~AUq3GWCgP-2GD#HkzbL}17xU{VQDzB02rfJY>Ce8VaC}oBqCavw!GIX3(Z$NsKw2w zFT^dtjSQs?GnO(PNqMvNR{2h*L^mNv-{m#Bcz19cD`9LP#*GGdG7(Ea})tolhE461tNAgZAG~!0$#yFoTkI+`oRn z{KDg=8h|D(GRRu^cLV(fh8MWj*Dc1vN|v-Vu&n`J78{n)_K#i@CbAFFQ{e8(6B*c= zDR!zRo4T^yM|e`^l7w)h(Kr74<~EK89(P#1&f!Jh_$;JZyJZ6JJ7LU91*|d$%)~rE zNE?mC+`u_Yn)qw2Oh8W`G0E!;Z(6&g+wqp5o72olMt!4Vi5RwqVpuo>lY~YVl^jG7 z&jo4tGD>PMZnJ8LqEmvGn;=QHPxexw@Qu_TUHqde+_2ReWo2vTdg=%Rkr|?n0pWK-KPgANXt~*E--_A zH5DXGiknJf`?kh5qoQD+8|@+zVXp){#U?`o`d>A3To21L?yBP5*hl8DOC%uV<|BD* z>uB;R-!pq!Sk)@I4NvKjD)x|3LvhWPrGI=YPc0Z!ZU8b6E)j1aqbv2k!|AWhVYs$` z;!9cz7K=+ptl?#_9uuAqqfl@Z`MWaK_JT^&Cp(7H5KDzeM#F!4FLh1x>`ta8U%R9Y zEU$-dxEDr9bY@P3*M)HNl@hAcAoR}8k>>``$>v$P3k16i-Kqy#4^oj9!WKlH^x(7l zH0q|PWCCmTWnC$Mxllb|-`1OwIlkKqm4PtC^=R4seaZ|b(FMkpL$QUJDU)v-cdiTb zIitwRaCq)fl+0L?&W1QsNp!=~a$#PC?L!SSG!k@8?Nx_zGv#xPD%S@aSqJe5AcK{C z-!CfTcqb$(%;WV9L37AFt!1J{AzM7H~s zTdkj1=mwnWNNfqj;04HX!O=Ul34@KnX_zfMxd91e;pd=d*y8Qv!YMxe-DML1JRj+qSuaBKOl+esMW+i@SX zz`~+s1D4@b+{Y~=zi94%32pA7beC7o=n<)CsodR?<;KVpNhE3UJOIL4@3?m!8h%B7^)1 z^=6x^{?^kF-|V(AhaFL}nMayH5_H zSErn>Q>JE#KmnRhWapgnvkcsbNP;A8Dnf)3ZFIMyfo3xut=!dIsIE^*Y(i6V z-E)sPoEqjYpXuSZM#{4FG#rO2?l8vQx<^B!#YlemB=db44#NN_1aqQ1<+0EZD@8Gdx|S_rz+0Crm(VX-^aJ_$*xJ^artQ% zHn!Ae3Z=cJElCdW+>!KAAIn@8oqvVxVX+G9B~Z!4Ds6Cxtesu1aK0;~ya56vV%LB~ zgak``=#`YsmRZetC`?O{M0D*{YnW^-P!Z7e3_sKegJ*KWdqVMFPN(~ieTAna*_R^D zwPVl$E2oj;=vcd5s*Vp2UZFcazQsO=6~)us%CM0CS*j`D={rQ|5P5EF4~|SOiOW+XI=SG2tm;Z~mEtX|4E+aOhhKUs%N`3t zd|GOp{NcF#0rCRaJ-SR{kYulTfOA7O9ZjI-9FU73=!~q<$4-&*aP|`9{{4E6@C|89H*xmAiE!5c zN`x~p{{DZ9@I{UBs0%ju&1uyaNR3%d^qG=DAZB2rWa(>&ddluP3G`7TFK^P=JgU_y z&CeEKKNy{MfSWw3tBbhni>JK5^!Ebd1EL42KJL->TsXn}meT903#+HAuV37%Htz+>o+3}}PSy8oo{Yj_S4?v`mp=@&b6ro_1e+%h ztWK}OE<{lye_|ur{h~pvRyNx#KN@_WmyPM;`BKN9Rl>8E^f2#eLuOEQ4qKw^%Dl~} zMXv1Ob9nubZ}I)w|F^9}|F=oDU(D(CHpF?SO@42;H{KWThXbytOWS{{MEB7=O~_N~ zd@tclddj|VI@=8>xRWE{j0Im};X7h8flF<)^8rAv3NGLT*Ld zuSe%jv5q}WYE%-H+iET1<5o-mXMNvsKRw=Yc*t`Oh@REiG&UcEXwlQxe09Z>uFuiz zXJ&zPeo_k#3(m^Gt&GOewNSA#j@AVP=4ntb+6eF{ank07YrQ@Ny z)(roV8eQ*4u`nc&<2gjD(6fC3k8Da7hD&$;Z}3?c_6I?Su_mg#d}JfOUKWwDVb2;X zkmk_%+@$58Wf$AWqBL{glq-uSC|c}NbrI`amEy$iCmM!pVWTBpKWWXG34UXmzC_9apPi23pWC| z1+=Af_0+^L_;5|K=S8XEdu2qh0{l?hXFT}GS}^l143U~@A<&m!cN3ZsL5w7 z{JIjYWS~OJO^lc&0n)T2k{`vXkMi1|JyzPuw*fOtiY?W+M&nM713F$3OI#k3LE>Ti zqS9!a!3w-yN-?7h-i)Adxw-a+38fl*^Nv0!gAGRz0e2*nsNLnqR8=AynV0-TyC(M{H52}N zk#F0aEQAiWB@Tgo4|g9FHz#jOp;iWjkyj#&Oen(baHh4eSrI=h9Fdtb*MwTx0UMEC zIFw;@#!98WlK@kW4^{)&yXi@uTKIw)_ezIjQ=@4u{>0y&>Q8Ra^5*OJ@ue0jS?frL z#IBpEt{L#OWadw4(e@WsOm%AYJM)oMq6s8o1S@aA-&r~5iP?BOb-!dTTS86k6#Tj( zqhXM2Pig#(DIrd(({H%0B)t1I*DX>FwYQfA;479{ao^gYrJyK^#}i$$izo0-`S!CM zpBmRktz5JAMlei^5zugrL!6k=kmmk)G@;^=gilbQAxn*Vs))2S=p}JwYRVv0{52MP zNH}!R0Y!Isp+&LK`!n5%GWWuU&7-i-gYF#p&_|v&S(fp*==#|*K*?I71&v3-Pv^pz ziV{tks4U2}zk8?DcAPj^pnR?blyY?{>CTnzK*pSktT!!x*<2sgom?SIb&r$mj_N5m zo^UM<6CwYVwR61zdX&O;(b)51-%@%5eJ`W`by=j0N4IAprQ_GlhwaKpM8~EV!D=gb z(&EEf{G3M&mKqB_5UIfdv6_5altDe!KF-_vM-2O35(3qG~wEdLI9U*A~Zxm0zjAA6U zX3{W)kNC39XjJLN0Yk4eV7){(%$aD71TZK|Fx`m&TJr%7k>-ZJ2|uxq1RLa*-_VTy zw{~nm$};za09tYLltwrv_D}bSi*ZNoPzsyjA38I zT6k6suflTSeW_>Came3m)mRceqiUeJciBiL*UAJ#n8FT<^Z=%CXRqM7zv)}!rzi{Ud!y5=8MuMXXVuT0K}v#{ zo3tHWXNsxOxOy$Rfy)GZgEm8{cb>8+WhMb-JK9xq^Q-Ie9O>-p%s6HDp5HuPwgm;7)DBW* zE6qe0kUW%0r8XnthuA}s%D4BN!+jZuW1Py#B3$P4N^{fw699>$_eF-zb4Kd^u$k}@9(>Ohv(HON?vU9 z*M`}+`!~-F@l8po>V@6k{6AatuKdvTg`eleN7LJVD}Gq{r#l$AE3~*+eA}k{HL4`z zMv$M022&H1FjR(GMR&LAu`yEV@d0>FKkWHc(CEznu;=eObu724^6*;d((Z|u5YVS| zS0~#Vbv4Y}t{jYOthQ4SV0CvKLBlh^WfeE@SMYJJ*tPc$xN84{o;UbG&u5@ok=u>Y zu>LF5s^~De@x!*rA2J%BDGAYRQt2k3ULln$!q|2kg?DHwTaEzTx~i0l1D~|@&}I-iZe!&@6We_Of*e+94eJJnY5wg9k{ex@-9b!5 zFtPBnFEX~2Y(4ZZiMaOBH+;1z$4rH}oFK=nQz5qRmm!P=KS5rD>9~z`$iOo)-DW?@ zpGv)Ul;H;lSY>@CxhYkXyRxGj&0z|Xf1;0@W5MI>CAWsF`_AJB9(QaI+TsojO99J1_{x zZlaUg9!{Q%l4w)Vm4}PT(6!l1<<05{-3Fkswb3|ehS?2L1_xT`;ss#aC^qkGM#scl z^_!~v@l$IqE#tWqByY(fmgKb~4QzNBNj z0TUAN=g!r1fXwk5>weTN(*T{wmDRVI<)fA|UC4moUwy@YKaHJViA*QL8XiX5DG9@l zA2X5+NxoQBwsU5#=vCfXY08@2`N|tTJNt`Vmu4%FLY4psA)=-Xa_D!EO^C)?Oxe$X zb>>#BR}BCg9&;xL2ZLE-DwH&-S;8FDoc$mmN&GU3P^DM=4fStJ^evUsl$?f$8hPF# z)o16v*>O!)leKf(TSsbj8?#0$k4hw?Bncx2EY0hE*1N!NN&^hmj z%?wU?oP6Q^QcV(C0v>bDq77KGuP8@CfoY}*m` z^@6}LHVnMe&3_oqMGZ(SoGV#jfq^wPRwUSh<=ETIBtihlt1f9Htf3>h)0y2iY@-^b zPV&@cn(bm{kH|FC`YuTw+fNcX-YCeU&E#L@_(p;ja=W(lT*+@Xv8wK7Wo0eKAKUGN<54m2yLhTqob8PaMPI4x^k?D}h` z_@Dd4H6l-_)tiwX))j|LW5Z#P-EjfNH(?LTjST(rZ}eo{oI40OSh0YH_zjRZik~ye zuHtYp-)E^y8`>6g_C_3}V2H80z??JLoOvt)i6S!0p=A+PFI%pM9uRit86Ux%2nh42 zNNySY5+~R*Zqfl<7i-l&pGz|9RymFe$kvJ^85Sr|zM4dUbT05z#`v##PpX0$Gb0E; ze^f=a>5iFWVQ5yGqD0pqr#%`X(JXCvs;miXOvRtcr+Gi>?ZfRJI-FVtWRIXRaJq4% zL3z1sr3fUWIKQ6xz7d<))Y0?|nZnYLCS=jrO7gkA0I5vZU_w@Zk$R|23@9|7FLB8L zT-D6EwKnD9U+=7k0Cgwx-096Owpm%&tP&-&hlYenN#x75B2OtXW7E2@_XE08&%k!1 z3}#rRr0tu@G;2Ibi4J@iII=_jqPzYBR~2&UgN;Px#=XW2ig=R zbmPImeKB^__#~LJ7X62Rla}lQroKhBrW-DEKRngp3GR(x-6$^4m2qct}%0b($e|2Px1D_ zV5D-TP;eL?f_!rxGvCh78abcr*AG z;o#%cAy2LnbnB-UkL5Q=7<+e#_QT^dYz3#Wk~Ja!M7Ez#d%uEOL;kw`|7$e1-~XK> z%*y#c9O1?PfX!Rrww|dzKx`eG!9Paw1h@s9=d%E_q8BTh4(QD3U0zhN2~;}B6yCp0 zYa=WA^^2`woxP3s?%0%Ya$AgpM+*mg2>>Ya851y4+%RcVVsLd1t)8 zPJ^ZUX6Wv#EN}1MNTGG-n@(2CWA}qVMskMvp^pli5|UlS9~fj<6cm=oM~ibMv|sl= zYfVd-Q;u4OVqm2l`c_|Exg+-`*YQEy=~P&)C2ZRpe{@$@>TwI^CN?6R4I;e{Rd0`^ z!+h{x|Gp14*88;lS|(}2Nl+sEm1T3SuCC47mT8-;*ACiu9#`2$00#P5%9^V751Kt7Vuy{JhX+B(DDmSYopW4XUX}c&JtB69p1d4Ff4Xz8XAkjC!!;|4 zGEOkK(@{G?=?e>n?A(v=*J9x7h0TL(NzK+jguzzHp<=_fa_QqmeDF>a2zqnvKu)?P z-wg%gs54|@G{%kjuq<;^-tTL|^yoVnha`aksRW8_`P&(!XH5fZO|ENg11z z^2_-~DcMiDU@NWl^%fV0<;Kj}W4yL|%L_JOL^rhc{oyl*P?)QbHpN&Do89k9V1izv7jjFNG zaeWi=AeZB~T*ew3(GvOR^)8Wdva^QB?|JyqLFl0^G+b|J`4O!~IA@NrWvF=3g@GJZ zhW$yOG;&2gVvNoV2Ve%f$Gn?r9Fi9K^_rHecR|Tiv#bXh2jXQiK7fq9BsjwxpkXs` zu|&`2tr%AjXgelMA9!XTW2R{qY$rBe2`CC zXB@WzHeqnXQU2^_gz3Jq&scEA z=rfBQ0gL~NCT97MEc-r)mY?CO-emk2FQs^1f_FA=+VVOg| zQfOgx9keTBt#u-?jD*Y3y3ZfX9oW1%q?BW>88mq=_KgIbYnvc_uyAZTEl>{3xyIi2 zemId_Ww-Y!Rs9a9(}j6+UBi8W>TTD!kAY-4-4n*0O(q#Ew}244q?~rmy4&Xq{#H#OPe*GXVltuzNT5?3ovEwC!&A~N>n2F0>r zG64#igq3*OQxBdBVd~J6ozw2JmPMoxM_@ z|C+QJ?>*9j!5wFM+2wu{x^-DzLpQ~K6iF*T>xm0|RQ7r2GIy@45R`X>QD7xhvL-~c zWg`QRSVa@FfYSx9Ck7h94v&Y#BgYf+*2N! zaV;(7mYux|b}gDT$>=NnxViio7KAQxSmYVvrbs`c7mz%9{QkGxVQ*Qp=mgyL=-btb zQ03T@#QuInzxLPBs#uSOvJ7{#TZvKc?q_^i^}(|N6uC@;BJDY@Aj4{ojzhOw9T_S_ z-sG@rJ>OtgiS>)mz2V@dI|}CZtK+_^Mz|DgTjauKt~4A7T^q2VRP#W$(;J#;!gpz? zJ}lkNdzH%sRPBs{Yn;~Dg>RJh&@lE~WxFWBovtSdqBC{n^!9hL2@-gadT4V&`_2z+ zTNMuFzH17z(UQI5MG#Xrb9W~W9>xhH>hF>D)J*`XUhte5ZI-f8 zz`sWmIG7d>Ma+@#kn>8JVY-eRvuO`spC-0R;wQx#VcUZ*_-AN|X___zjGIb3$VBvT z$m2~Y-)5WZniK6eiePRSe2nRdIu$@$zTO{V>FZ&4Gq8IxY>FB>JI6-%s96sXe!T$I zvO#1;C@gxq><;RGS&LSkN?GR2nXdAu$?Hm~xq9C8zFl2u*CFYBQs~b$_xCgAzK#T*zix&Lz@~)v2V+mXC^R`6dTK}mL&GgLSJs3<7b6Bnifw<1N4gu zXMi9CFT`3&ZKvRZa_b`=iP z8(3X#$x9g)-A{th4d*6*BZm-=RfIUq34dOFvt!)y<=OUq==pN5^O>`Vsj|@j&ZpHt zP?-i{DTX(3BXWUnvRfw zT-2Ed`e**5AT>@M#J{J1ZIF_*E_2!T+rp@8zU}`t*@NzMlZ=aghsoTOF(S)`C2|mh z>*DcrxfJ`%!w(TE!NJP2{;cOhmSbxpAqYD}8B{zlr-f3~0jp%bg$-_mF1AlX1zp&6 zmnWNl@cxOJCB1ky>b`a;oYP1QVyUu7OdNDUkIM~EvAm_IwHIAcqI}+zkLsrF4o5|n zQm*{hB0Uc`nPATGaBMz(6uY#(NM~t=#eW{R)D`FTEc>(~KV(Lk0aZfq1bJDw$zRRf z=zENGIZ8E8I`mp2@FzZZHXkIZ0v6Rvl4N0vgH}Qj2S8FF6#}et=e<9)Dh3Z^g-wyK z^Xz>*%#oQlpG3w9!F2rd#~4WCX>&&&Ll*^QiFXAemn?`Tz%=TLdzBO1gPAQ-6T9Vr z%5*W(&@|Y;#v0zwNx^>PF-X^dl-n9bI;j=5Zom%n<%~nc@_6)Hc9?}prj2}H7_d2@ z72+eqhQ#8L`a>bKsR3>e7v$fa#ZZ&a-)SwG8iN6@odvFt8WW@dZs-{P^W@9CTYW0(!5HOE<8SXgk^0n*eKRngXNC%#_^S} zqK|ovQ~ZPQDWdFmo!YND^5vi#VR>O8fdOFn7rMx!HnOH^;j2$1pG6LHj^iI3d7!K{ zY>TxnRq~DGvl7TPY);?ldq>FR1jcnykC-6(x&>%I{arBFDR$XNais#onZM?eS973kQ(j9MvI$=)7Zu^`6Ao>;h@fIen?(=AVC_CM+0>hq-$H_+HY z@E;E!!C!5>M)pZ&OeQ~Ht`UJF1Q^k%jw%sS6)6w_`mVuI48{_hGhpY>Ge{pLSJ5In zNo7K^Z{WS;PRml+c}*ENLuiue7JGAVVp+!M^_O zhkl|u@S8SZ4F0{YAG~SzVw6P>15-)SVWVb=YW1k3Ib?=KD#qkJqccR6n@mErvO^b0 zHeonNW@d2xB4;r`3EF-ayf&>-4=a}B3tuXAr6~4M9{WI@6qhg2O-oWK&UPNh7QgK; zwX6Wllo*Fy4n3^L0Z%|~bRS`Z8JJxHW0{k|^Yjor-t*-te3&B`V- zM+mUJh>dO(AK@TXg|Am~UUwBu1!_g4s7_hr5vHZFAjuR41?a{MB5nTyKP3&k1#9;9 z?W##MmM1>iHs2D^2+Ps;h`>E>avDE*RHhye6m9Ls8jv!ZtiMU(Wy14q3lb+%(g(TL zCtavf@)^k=z|NIQ^4JlSgdA8+Tj2$#)OwvOyinV<3I$IY^ty!P%58iaD7#%1P@S}I zKcpk4*48>&uJndR#Dj*+Q2m+|27z~TkiM~-*w^-q@k{fN;wD6RiumghOckh>r2HB-48e**6k;&%8fH?%zXslge;YZ5tHU?Gf2}7>E(V6$cap9BAZ@HI z1M0bMq?O2?rE>Ai%#QlC&xmF;IBN}O5l!vEgzCqI?S=LXU9gY&B5X%Zg`&Z4-HmZPs8gVMec)H zIfj~Bk|2hZf5|cw`$a$#%+GP)UYd-QOpT17EnTc){k5lEpNWs2T1Frk%h<0L)Vpb% zR}Da|wdvLnLfG|(l(LSMon0jjt1k@wZbcsjK0!AplZcJu_Y#_Q#3tU#3e`byH>s`j z`dfz{gKKb|UeOWUs_kG16S4B>CoKv~l{B-Rb#ns)01mkY12R4AuN81BVR`Xy({Z#T zyfkwR0;I*n;s@1#E+!FpGi-?4zvNYLy6lufyRHyBULTP(@Fonl9Tj-I`Pl~%TWOw& zmF;;rZ@(}%Oa0!3rOm>3@^sxfsZ zoS$jrQo!o|811}F$T;AT8pJoJCS@Vo$5eP3Q}d%}KyBx8XY zXSp+aRP>8t7Pa6681#+p?%&=gmakjRfn1dzn$5;Td51~Zv@qy$X|-fEIhL9 z#ir%Z^E+0=*Rg1+-fKnxQFU2&t$EKx)9i7&ZO{IGZ~iY{6YxEI=zw%GWAfc-Ei!tW(ml<4837T}%^|zswTJxZ|F!zK4zeW;Y>TKYjx>e|kF>P8$w_Pv4&hyx*tVqQz z6@Rc&FQYqDYJLgupMFo|eUXMarKD2`Tx>dC+W|f8dqOUjJqfCZU zdiV)Yo*OquE^ADb3x$*bA>QWL;LuGRI=A^@-OxZ225izt?h+f~VacH$uvp2H)Ax`_ zar}!4I}oIj#?Cg>KxEW6;->NiY;e%hAtuijT5*p|v{;P%MLL!rd!|&KG(2LWltu&D zS5{Ue;7Yhxl0Bk+l@=wBy0X1!rQQ2t2Ez!WJm#$RYS}SkI$jOga3F#iK6xmKt)lE+ z(MSjvzh#giHHt}bqo$AxEqf-VSTd;BqPMwqfcgysbrz3LF91=42p15N4BT4fx=2XS zS1JoE_p+4KEqQt>Aq#irGH~bOZJ}RZp<4%o$6SkvdP@bXkj|!WVzrb>teF{kuD20qYv4-WoP9QYP;xJ4})udDDblGOA6>dH<9Q z1G;JeuEhe*Bz7bg>};xi4<}v57FmpHznBv06#Ox(hTep|Wr$lnXu(3cs|ah2kz$ad z4%RZoxt)d5(mS2elq4mNs5JCo+K!xbhSn(O*B+_LXPZG$c=qhRbOVW8e+XZ6%&M5? z$$L}E7f<-yhC_V`{Tp2)--nVC^*3!{pLnPptF>#bH_M@gk-ESjHgN@rredm3!Qp;g z-g5%akCBIh*H9RfuV0{oOr7yem zm=pF2|6=F+)An0l;`@|}IE+{uWf+g*Ob zxS2R$#$Z9X2%=dm?V~z7Pv}uWDaRtz-DY*q**LY@rkmCCpqM32mo4COLmOZ^8wFdW zq0ipH&;%(6mp>iGwa=3fQwR}O%w~;_UI*E^L+TZoGM$E4zWFF{eT7fQkXpGvkrwacf z*BC+jieKk{&2WTfi2nebGfgAho?6^jSM}FFJztyOS~(WvnrqTSU}l>eUICUU zJ(F?Ii13o*{u7LsI8}vRQ7W-@B~X-L-IWp5j0flCkf&}$-`YEFT7Oo$pdDCy{76;? z@Z9G-6ukcg7rzQ>fbzX4v9>b1%#{kbe9U;Fy25By!Eqr*s-h#AYIpt218J5dA&HNck_+(hKJ#`d3`j7)-C&+j3#nWHBYb20zxOo4d4`uW|{f}$@Jp~d>2(h&HfgFjS z3F2nU?^+&70(sg~%TFH=(_6;*nO77Td_#~v6o&a2;-=cx4sdPwSIGDHri$|Ul^4lC z0;JVB=;oKuKQ7rVDfxndM7Ax;5!Xf(X@vKg z?BnGx1Nj@vbgU}f6|v{_)2!U9NsJR*h!sj8I}p>A*Ic-Q)}xo*cO4v~SZWxeJRS}= zmB&Y4`}|)(WXHyz|C`kM@9vIl%>QGhr%_|P>b?o-$K-whG2-Y5^Vt>kB^7Ws{RYei z(rK=;gny)Wcm*@}r<1;C>=$s%#M0g}Wt_7M%XZ8CHvRCYN}~!YIAWpe-VM*beRFjF zes4Yv&i(+?Aj{N!Ym%k789U?fRY070xcs`VZ~Ec30B~cRugiBG`Ks*XK;gb$pQ1(gUc66Yog`r9l@*PcP;sRC;Amtt26A63kK#-Wz0dqZ`1+=ju;wR!CDtImh#f4R!i z?C;|oJmNKKbKl|e`(v~ou!}ID3T|fnl04}I)^?)!4bCC>{hiHE(D6a9+z0kolzVvV zK(>DRXiQmXVGE*zI89I}PAjFc9dN7Bph>F@pUsOEstKY^{=IaSrCw>Pa@C|A!7pVV zW1f`c{06@O?@q_=72L@`Ggt>CKV@jw4(>BMhBGc@v)e1YJ$HyY&LWj{6eB=t7V6^q zS{WVUdR2216|b4PQG_EK#|s-4Et8S)CkuN7d4I6Zl6~JGcyM#2#MaRNEA045NEn|e4bZh`J3X7J}vcEF0-PR37r=1e=*bv1QWM`)!?m#R z*5cr<#3i^7ZowZ5^$(6-q&Z3RPq}D$y|(P6X1iW;$2VRSHMKzD-Zbsct4wV8=nucf z=Es_hP#6kAKG^Rq$kni!Ee=xPvP3zF$IOlRJ;L{_#6-)pGe0}8_V9l(_DU`L>5TP~Fj3L*9vT4Q!f|t54<*liuzJP^J8Nc3EwXwcW#oQs~=mOhg5bmSQ_e&gLQ zjVt)u<17gkc{i6v4T1Dy-UPT$qzNC2%3AH8yTH+gGh<(FAZqF+hfqV#P*dHWYEe=i zM`XU&Tl>SWbWy0xf7*%zEP|dsXd;#v#-SM3|e8IMe zR4s19OYXY(B3&XQmhj)SwS9e*GBsG_3QM3O6)+|nWCzI%-C@g6y-r$8ompN^JP+!j zRMJqqPxDm|&Nh{Q3_y-{v>p@acu21WKN$l`sM)XMV1;v*5lIHWHY4VeAU{n4pdz>; zN!8|-3!CyAm*sV_Bs`L0Kg{&lqr2JXkHo5UrmCA%UdJbB)0X|(k!bfZcS~5BSE|B+ zpxxUOq3eK6E!FG=*i?aI_|6A6YgJ0mzcN|AVjXp+^|IALt>>Eo`TJv^uu3($GV0D zAHX)>E`kq%3n}lxYJwB4vK2$MD)o=gTlDn|Nwqlq1Fdq;cn3Xmo9imu&_mMfw8wU1 z#8~3MUPtPKKtwI6?aHvbAcT}2Xlk$_qA6y=(QV^sA_`Vk76uyfy)JvT=U zm_6g*NC-ewmtm~uBrvUv2%*q~XbllzrE*Y|%qTh!3>`u8HQ3haHOF#$N18)63qoX)T{6qRK99nEv}lJ__L2VlU@j*pl( z{#Al!R2#*K-rV7);uGIggc<}6se*}eZob_KTGdyBf-*9 zjjYapOIMLb?8#h&EsXXG4hAQ0&OB|iOru$ouM^XfEqIX2Ai!#G8+Rl%DLDiNHz?Gb zV85d-I_0!?0cM4zN=%q1sDVxX@Z42A@N&!1;)Mro@EMRttC`nIHB#QK^0oC$=j!h2 znvAl4NR1*+mjpuWpZ3fJPLnOB~Sj~D}IjdD{5 zg)lnqioTpo9?tE-We(@m*n+ymQ$sd?z?t^7KD3oME1@)*BBjBUR9R+yY%33YG_Qbq zDzN^3e(>Zi1RVEV!J8i?LFDwGoi<-oJ5Y%BK1N%_et;OGBp0KO+JlA2JT1I_$rW$65km2oU{8{YogMA`}de9Fg1XX{BGeWDN+nD;EU<|kzm4sArB@t zib4zefDA(mN@}apyVk>3;ykgyY`h?zITM6lT?JT9a*{~##y;(RWZK;l?3=?~suGp2 zIFjX3JBlTo<7&{k5f^%2Zq|5JY|BbFW_{)ZEnQ&@)c#(mVa-K=L)C9D0CjOgFI*)-W)izt7cRA6MUD_N-wAY8LIE%oCbf&??V`YtN3| zf{jDf{&xDz{B~A|o28jUjRId|z@4djdjG{3DrmD+W3>&~7csldwQ5w-0;a_Y7x>d@ z@X{2}#28siW-NJn<)VFb8ii+gXyQi}_2YY4#1J@4e-9dKn3Z8&K|3UZ0_(M1$X=_+ zee0IXdCBtUs0#|AOR4d6NC$%wFL47eawAubTcikJXlEqw{`{$Y$l>S6_6K-~g*NoR z3DWyXI%(kU-Uz!$GV|(r<6HNa}iV ziLbOazm?Y6WKBYfdfd`;WR`*2Kx~lD#6Yz`SA(p6yAM#CPmqxwmlHnkKfa%lI7R4z z5Du@KA(4%Rs6KHPNwToHFTP$7-d)q8{qDa*JSNR|iqnd{?%B5~5i6PDGRKkgl)T~5 z1K9V0PbsuUA6VEI)KlQk&Ueo&JKYK|>~TfifPbJ@DB&zk0v$)QuaB}VJLmDrIb5_9 zTVzIT?3&qKvm(a%bRKl4O0$+*iyunnIae%sLrwnte12Z&Gl$Js!rP=|W&eF8SEOP} zUO|b`;-o|T_}Ee9Svo02?Mu@7}~|GZWC+8Y+_cs7z{d`HQZxk z9OBT?vR?NQxlc>&WQW@k%)cebq;hX!digxiI!HLO?8Kr}kDJajudl2KQU>Qj+ z3-&)35nU4G#(5xrV9kNLBUGyAIQp9K6PEN4fanf|wYVeLZoQJ;zq;28$f>g6)%mC( zRN^T1W5kEzcJf#n^U5fS{_@E2LV%6@7qjha@Ihe#q!BCSb+(u#u6Y$UIv2^Gl7XER@kC~B`|_}Js@Tq3%JMwbaJAgXz9Tx`}hS}XEVWjG|-#a+ya zq4NIhE~vYOH`8;o2?&?hyQKZ{Jq5}v?_bEFVU-#bNL$z)I-~dFuxcW)ct+}@tXo-a zzEYB+Lp+TuR>GO1kJb8B{0DH5{q#v*0lp);Hkt}_=!JZIE3^gs3n}#y;Q>pS$8cw> zt`*RZN?9G_Hko%}>x8V3k23pH@qmQoPz)axd82fxp!CjbVhlH#HIK@o5$e-4tUMJK zKoD~|$I$SY#&V#{;2qvSCl_HFAZ=4jv!W*@ayH|R6k=Az)=1^NhTM^7l-aJCQBol_ znS7kLhk;&|J1@{xc%)=5`Z2B@K{QJ-k(u=(OKj8v)SRG|92W1TP!%o_x+fA~*gjG?9p6>8Zm;vBb2kHII5` zwa66t>m1)M0*GMgxN2Ym6Vk352xaWqgNYVFw)3r{EbSqc9GXelal01& z7ZZQH+7#(}3NK3H|Ax+Hq2o5K38`jR|AuF-=8H78A~L1`Xxc@-s|mFltHghIsQ+~8 zm;BZIXG1DUih|FAiDzGXL+#jf@U*LPK?-@1J3|lYhF^F)!^Vd%VcomjuujPhr|ACF zkR3Ed%a(#5pXzB5-6N*~o*r2gQS(xofGhOgC{Rvxyed=Zx_i1PBdQN&ntckD$r8&Q zicojbK^c6yT>}?Xn6$T;wy=g_Ak>=OSP^tC^a!IU&ab2^4!0_$&qJmd1L@r!Xh@l< zLDV}#ChgI1M&qFadhf3MR^6xJ7}@(dxGOaf5W1ub8hSh`@ec~x|7|_g4g}O0-Fj{o zw97}@505Jdt$U3P`l?s3?!b*N`^qnEb%cwFa|< zn>>$JyB)@gWN8FpKKkizqw}}G z^Rtlh-vOI1;3sP+^|E?vs>4O63n` zr4JN&v*zLMgz|@UQ29xue>XAV`o-LMLRc$3n7OW;aATHe+Ah=qfQ>{-)E{mml}c8KF`XoRlbg9Zx9XANeBnIB74uzdL^RcT(tnOLo?W>T2~0$~ zd4$(-__xxERg&XCd`wLlTmN=DsnqRobKkW8))$LzD`Fk0ZaQ)7r+hl7J(ihmAdkb# z6&f}Yi`>CN)EVeBA#awz{5#uY(UJ<-NByNkZ{n1+hZPXEf#nRP%&ZJx+Sp5d^(kk$ znAOWZ@d_7ga-1=ZY(v&Mb(YPUtKDEbp@ApndvQGx5>J+|Oz?}BtA#FZRDJ}1L@QqT zLv)ywCfVTJ4DDAP;vY2cBfn064D|*Fs*r@m>#ASv`ZZ|nbAUNT6%kN?#Uf`AIqVBH zSUJL+AD8UKy`}BS-(JSd6sG(Fz(;Jdu=3se6io8qAWshR9VADl_$&0 z{A($>r(X@78WZiVSUPMu*PWU+#b`R%xC4x_l1gmh`1;lY`yOY9D8{Lz0Y2h^;Z?|( zSg4nRO=f;8+3T=6`i9kK-j1R@JyweFx)`z*mj)QGoch@jBUUBfy-c9XwsB_Iqaq$! z2TnpX_*;(@=8wv{8O*D$5x|ADaJ`A=&V&0&?g zMZUX>{a>VxK`H4A3lauKBwmU*eo@bj+TQ+1%6neH^6?q;)l^U~^7GO;q`jyQ8O z*;D7o3KBdtu&gYL0{f0fW;%yBSJ9&Bq!r=&ArYtpzq=onbo#fjLo!9Ol(2c*UT8#k zLArE;c7eLv%+%-*|ADJUnuf8$3dYznBUS3yij#Qvx%ve2g)lg@z+)M2nurHeJf{`T zJul+v0fnlAeZSK96fZ>E-3)qq;r%(p) z9_}k)DZcgS0IzcQHFWsX1?zxbu7SXPbKzA+DchcA<(VIP&wt87r(T8~Zu|_AD7=%kk$9 zv6jTzv;hX5f&3ULz1mPq)w6apwmm$h&McLZs<9IG`%7DpKLOQEg%5Gko-`w4v!;E_MY1_5`U&d}&8UIJ?m7eYYuXLxh#$uRTV7pH! z&Ot?&YY^$ng!~5iZCs8~4`+2E>7M(#51$Hy6UvG!Q_XvaW4|jqBo!5q$8Ly<(|vMR zg}3-vF?cbo$E-@9*jx|9Ufzm3zP~Kr_i`-^lhiHN9-XD}q!9$B2H6cVl8Vl)YDi!?-WW~an(1$ zXY=v>sDFJ9Y(No7N?1|j^&^&>7}K7~TGMysn=xXo=uJ(3TQMU|yTcDg@8AXX;w)j-SMq_d=;&D7fgCzIW5taP`$LB*WGx@L|MtTI{pF?f77aT@_Q z4dPP!&=-Y2RxWGHgmjcV5QgIYs*@9|RMdLQN&MB6CL+k8;uEx5Fp!x{a}$6o)sr9g zZ^R_Sr-ZtTjoit#nhxdR3iT;7)pAhP`b$ijXN{_q>YNUB2N_w&?$MEqtZ%`+dG`FL zyjCt$I6e%KU*^wWae=A5bupU=Al*A(;{3pLn}BtU`%enFoGh08C~l&6Unl$^7khpD zhO_vX%5(mwWb(=zpOVuaxu}mg{6QMNw$aE1qp9!mOceZ(pst(Mm0i-y28_bwphU7!N zzUgSRKnc`{FaUr)Y5Ob`a>!7WSRXtVXZx7o=B$qRlBW(iexL^~Gkj4b&Pl^lnJhwgf85_hfV%6;`PLF1MdAKSF zU&7^x39cEzyYsGRZ#;^l982Ivc{0YZi5ea5Cwb+%&>7&~yk^JtW-`|~y&kk<)K-9= z=3#r6kX5M>>I?DlJP-@_sO9Jgn@Z5=-$Cs~2o)_9salGI=sUv{n4fu<|M=+jBo74C!5~!&yx%> zH+JvDy8Dl0_plV+Bs*Fh-X%A%ZgtXBPJkQ8?BL=iUCz{afFqsh^kCCfRGvdthzy>7 z_X&Q-HBBUhvUY%cOhySwg{-}e1WuY2f@u<61>RLe7PsUssAmeI!vmk%G%H8uvY|AyTV;TyKkz`Tfawu=$W=EPy_7 zazF-lL<6b58q5^|x6uH+(M1^uH=}H8Av0f$)I$n?hL!1Xe(OVIYdYjghhJwOlmPN#1(QcL<&% zNqfA0G-2%T{l8W-NYG9uBII6O5fQj#&Wvmvx-oEeQ_m%@DPL))X09iW_)T6ZfA zbUNU@!S*gD_$#N0K>6rdPc{UTj>B1kgAf{+wLY>y#=t}vNl(;kyd#mD;N>oLDBNrC ztql1({dxB1nguI$XCjzU+p19Cej$2gq#_O2*SY4Hd$QbL%QiTvqhu3um>W7A=oLHG zVJ9lYG$&a;G$tPl`o;0C_ouye=8{hrm^SXCPRgjcUy7LdY3BJ>@MhoI{%vTo0&ba< zv}TqW9KKEeuglrKkpDz1Tg|?y+wkONV_9;=LRhjG2SV({d@&~s>j(SFg7Ac28?OBa zF(Mw`;}z>Fq?hC~Eyj>>F`ZGq5*}Miie$|L&&YW*YTv=ied} z8aQEToI&za$4%CgtarHNV77MMX3L+xK7~SH!hu`mdc$N1Xy4q_@D-}@tK+=Fh@EkH zTy82wYr%aT8jkIxM<%(apely&mnAz;!psZ*7P?BEm)~j{QD-vcAS-zqz7lu!+pggA z6ir(R4DJ-lbD-MoxTq#_N_zE~f+cdH6(P);4g5rk@;y2(x7E-EN)4$l;By%{*DhcK z;jR1Seb3sTE@o{k7$J&7`hwYkn=o5YC{4 z)fxvt+q}yQTg9euhCUswsi)rSAl_+PrRTbdzFr5N+56Y|O|QEe?amIu3uBicaShcm zW|ULf5nvtF^OMRoe-7DFTif9YYNt1Av^--T4+l%@ZP>?p$1hp;W6kt-SUs1o1k$w` zxj)@!oa7lZ$61BTOJwD2OV8$b$zz;R#LVF0IZgk*Bojbn>Ts5J4V*P@k9hPHYT;En zFC;Qzj)Nz0yhfAJyKzttsDpv)u=1nj=mXW~#i0x2AR+)epy5Ry&p`aCW7`sh!@3I; z%L=Cflrru-09G4~W*rTV31SC=!qX0#H9-I|J%%9YfhQCo_j9pZ+zk#1MwZd~vn zhd0E%1Qm*5yFL8}D;Sx|?zDixDSL$Tr+U9n7p+3L7}4xpHiq54kx!gW^qYX^*O~1P`1lnA(|_?- z8UHtbmHt1MhpIK(es|8{|6hN##9avl6AES(nqAA2aX_F_YxDo}R}-rUHHsETCNY7d zX>pyqITsgNB&4~&!^g(PG-gcrbb5xtbNBE5x_%#7zrV3DK~8hO7HX^OV_`LxN->lX;a6SICW8k%f?Njs)CoS$X>zWB;jY9WVIqCtrmBUovujE$Hj&YPx3=c zI0awk*-i!7h+F3mr@3W%I?DDB(-((#cMm4gu=CH)tJCc**LrALkfH2U%(|FypgSLM zrZ&4xQuGLR@-flCy2wWu_C;kxXjJHlN7sM4Hzh6Xr3VmUjrD0z~uN z+cacG)adnPtPxC=7p+H0I~>ePk6?BL^`j%w>52>|@%nuP(X@@r2xGoLRz?TPvU;7n zzGDRAy3jU4ko>ds>FGK5%yBKStd!?CM68wxV$K?*(R3Dw!tDTR1?R=56D_XssP@o* zDJasFQB&_NHz!EA4uFz1R~;WXsATR4ML~eoQA(c115%ThI35(oqV@r{^$h{VEf}-l zcd&9WW}A0(Tq-T#ZA&=*z)_8|26X~EgbZutGegro{9!H!^Cci0LM79LzJ|%L*m(DEy0=FD}R@qX5>{sv)+YjpgLuOI4QlgNa-lfQ!z-}O1XeXou1l@yM zQOHy_w?bX^G8^hjdlK>DVdw@HRYX{MrDHBc1}J1Puezxkz0`77?pbsxj32=l%@Ww{ z)v!e=s+G?f+pU1Ksc=vM+m|ErLeb+7JC`Yisk}8GSd+AP1F+{~*$)L+F{^=3@-h3? zygy2=67v#MBuxX#tn(?T(wr2fmM4xt4!yi2TpP%PNd^W}%C5H;b_t~BKGrn$ysR#> z9@44>2FAo+YjX!=q{y(%5Y8^EUtr&mCV5p)X>*xTBjxhfs1X5GDK%{vLQSy(;?G5K z5mR~vLsvhE%h*gLicODA0g*K9hzvhJtjeF|fhyMRS&S zu?fH+b+2~KtWn~EsgSjct1%BtSil5^noNHHiV{}^uVftV9kUKBc@XsZ18oqi1z*w@ zkBg?3`LtGi?*gcCE)tfT4MZ6JE*@KWB*+ zFv3RQ5ot`Ew7^dA0txz)@HaD`chd_A1d28>+Y9c^ViiV95r?A=_0pw@M97rhQMSmm=W?{^@LPvz>j`g|0+)(@kO!0D0wo-ULZ1r(YS9sBr&9 zHwuW=_<<_CIY_LtvYt$w%JbQuxgCW^-?aI>VJ#o*mNoO;B9@!m;ab|D^;C&FPEN~#&W+Gm8YHF=%-`K5MlfLQZ-FWbXr~U0F%U9=Z(kUo(1@xy zp?BzN&{b2_m&l0eMBPiRg^2K$ET7dkF@VD4#32hjR;gUkL~r19{uBG^h0Ry}sbP{* zaZ)Uw6g3$qYX`JwDi0L_qm}lFR;{(AW>SP&txVK1uP}9*_--`UxK7@9c&-*wJWwG6 z0cHs*&26tK-wZr3)6SDSp(okooAARdvC zb@FRXIHLt+L86a?o%X}-16|zhw-EeK@-W7OQ!F4wH!(U`_SXkE7;zOpj|5}wmw7yk zrf%Do2+fm~ZnmiaFl}v#?}H4_W;h-3)8xge4%>@SR`G(!!i2?(Mh&(!LH0ipuJS#S zr}^nTHf>$dH#0|xt?DxGeFLqV-{7!h zWbU#I;&0lxJZ~DnIeb5lc!7lm<^M%@Ffsg3)6Og${}D92`sJ%UHvi%Pe}jfZzkC&# zclch0-OQ^tP>#k$McTW*?$;-!&4?k9Egl|6NchiLy66l_RLeIDf>J(GUWV5ZGAdHb z&CXWy4;Z}j~%`eyzhLnX_FD`T;7lKf%g+l-kFKK`9)g@6 zXFGE@)bOhIvRJ?YhEcGR=4L{`RlE;bjq|Eh2(qqsMAhr^n~pRqzfb6z3#RPxnW5v zDHxuRTB-dOOLCO-h}gh0IxiXlr}g!&z{DiXt0i*mT<{{yLLn+&9go^8_(2O1Z|H}@@)x&n#ME*|ziv`v`-EPx!(aZDietFPL>-2IZ2Ll7QMXvnps5J)lbkZ>jD*+CfeWJOE>Y5Acu&Z0C_)&PWPV(`lmc#_#F z`3Ufcnt9tlh_GV*f7jF}5UAO~u%xKTz=eD+CFVL;NmLF|tJoXjx4{JmXBW z(Hw{mNmK1dOinQluaNl*oo=T*4@Qi=~|@huL2%off%!gFun> z^8w`^*A1b@(cJ+{s0AY?u@0#=i$=wdGX@Dbq2d-iuSx{BGUbrdhlca*04gOqPiC;2 z7tbY9p8*}1vl-Gu#{JH2-)>6%-n~^l01@uM)h%GMbWfq*!lBhPT4+p?K?;T=y#859 z3=szeTdno+#>q#A!63m;?=v!McoUj@@-M(-le|r!TN+p?WuH6>6|SUNa+drE0TKa8 zgm--SdLKGk6t;Ph!esYZ6!<`g$qSjnwiZQ0a4OQNcw7-Rg6cb*Q0i=Ltp+M;vJtd! z-YW&jqFsD@vm8S$gP8-Edun;xDzy;8w+5n0&kv)mq3< z&_Z?{O2d>ozW_W+?N~?kcrpubUDPeGB{c0}A>z~_bvV6cIIRd@v&7B0`g(0KesSQ~ zqk2HbVMiz9WZaQHi;QE)!h18m zn{Ahb8Lm&;`F_H;gg);!@n^y~%n2suEGX^6xpV}BQs=s&O;!j3*eKqldh(Zg+;Z*Eb^Sh=S5*wf$0%?9D z0rf=^noI6J31~6^mERB&AhGJW_5@$0l@zad;k*eu{=gXJu0kwH7NC3pfQiO+CDt)T zn*#4}Zf9f;ViSKv0_ba@7O8_dKS_?eQHP{0w*G!#9Y2 zq@bgLHqh}Y5hGLymk z{EU_*hYnPkCVME$q|I`kZdy7>m8nfal1=1gq;JaCZ--3DQ$p~}Dzp!4ql)+5fgEYE z4N-|zSS|dMk?I*Zm83ya)*EB!y60*t(vDBuf$p^(vMtTcW>O9h;oPW&4>Wvy+oogv zW9e+s&=phlJR&*k&f)d&OrtakE>tvL@_)QecHJhS=lwNIb4$34^51W-bot6VwwZ zhRe9D3KwyDxa16Qtu39FJT!ci>?)IjYW~titqw{#`r>}|h8N%+1W3yM9>f5nF&*U)gDvM_E9rI!BWMT>MW24d$~DOQ z^tRl&_{*O!t6a~y8PQV8)QQ-x_`)qbDs2bAF8BI%g5}VvwoN=64^%!hA9B}QJGh&J+0zTh}Z8$4q6r#so-Z83Z zeFxpTIu&PDJ@*pSZq&TDePKQ)?i_gA9+jfyW8}=C&7BHZmi36KW9C%?E?8x2gPmh- zDBpW3F`~$6(&7-4HJ6qc?)^N(dYb$p*5+V__Cq_uqsj^Zz6?85#dWXm#KxRIH)jE^5V?NAOgaIbP#0D+qLuUQMm7wLlXE3_ii4`+ld!o{~P+La+9*apLrmQR*p3J>zUg-g+EfmGyU* zK&Cy}mG)b*b7;?CokUhEI2X(m#SO0N_ECxL1|{vNb(keb4R@t2YhjIr`}6DjgBUby z1_ItDAuA)@lS+{)tNsCKge8ZLdh+YZTTSlm)0wbegXK%@(HJ6lM~}3eMM1S_=SS98 zHn&ANjCKSsHzRk4+gda!A?-CB(lA}%@FDvdREueT5HpRAonc&5!)|(jF&KI#B1l?M z7O{CnypEv=7>!IzqD=I@YnrpNQe8|rvZyiaX}TZs|6+s2!jj=D+1D`3SC}t=Ku{r6 z>P3I!C0x4u>J(kH3cC+D=vTsJ{8to+Gc8#UjqOm!C~B48k`njB5qV_Rd+rkRo>KUs38L;pHUl4n)KRbTaIY z68?>U@E*6(V?xuR&+eP{|IX~WL(T#MPvkWLh$m}g2oW7Q)3{`ki2wu%s25Za779vk z71#gzu@!V>{c^f7uFX&P|qX7oczV|9$A2Pc)vM?@*_2km${DuT!|x>vIp;7Lu8Y!S!GTP65%> zlE>h(KkZARD-ZsqqA@Oc;bD?!ewfv_A_a~a8AYbX-kX&9Jp(xnFBAiHEL6SW?RNEG z@c+Jtd+=CtFot19Uh~+3keNyNn6p0{jMZ=gT!|U-t?a$ePZ;0-cOxFxg>k+Q>mhXk z&=MVs>AAra#16;>`)A!9&Y&oY2-XEol0-9H_jALsw3=;2>!1;dEtOO!7-S;JmHomKj}7rHYrf0Y}wCaz0QQ{ za7ug(aX=&}2N z+g>*;y&*-1E$r|LY^mL;L=6F>Kf4b54+ceDDY&OeDvTxw?=r5EE4l((#1{0cS~7;V zrjm7QPraXG(Nd6VI!7-yS4gRLP_`Y)*9ZbqNK+m9R3*`&8E0iE#}jov#-F+NS7kp% z&sR%)083Z2Y=O+P9h6nd43@RXsQZj9+OctI{NwZ0trK%rBKH1mLy=gXeH_lFXu%_5 zsLQfi2v4j-B0KJ34#qOP68Gmt)`WjoY}70^0K{M1ZXoon;CjQ-dRJJ%7cNQL*uFW=}~mf0mAidRGGsn_~H#L-0d>x z$mD13(yJ@mI@D`!O&AO_k<|Izs|Vg8!3B`iCz@{oN2hbG>WLQA&kaSvkG_=xmPW#H zNk>L+Q!MYD?0i+f8N~>yVk|>IA8%j-mn0(lIc)}N(h@;o=%DkF8eK68cT+YP9Qy)xCzm zbHCp_FLA?pfYT%s`m}DGB!(&A8S0d1V;Qs*EKAeqgx2E%S{7;U2xIM>sxM}i+1gA2 zYj3K&II6^IlCqLV&)&NSHvE1%{pcd43nfV|OxeknZ4>SKC3I_u^nkUxyl2ZTJ1;-l zuf$(4DNn+TokHn-XIj>rW&57txN4A~cDq&yWi93oNZpD4DzoPm!W8;2r5AWh{#5uh zIi=<0q470&n-pwX7mHe^ou0eq3sm=GJ}#l4uO;;e32^m+%RYAgq_hQoiHZ^^Q+^_f zwaCDlIfg*u4o`9r;iqu8I%zuqU=tp2E9V%QxkQi65tfgC)m*?1Ai6x1-oAoHb;ta3 zCXVpD-gzTQ!P|YK_GY{xPh>7&9(=2INZRNB0)ml~78l3b#+zGR-MH#2*bV)UkfWz3 zoBEeQQb-~gen@RCHRQ_su_wQI$*p13$q-qjmm^B;%vNYjpi`fvTZ{LmN@)>7Rya1_ zAL1)A->Vakj1j4Uqk{FKhD+o}^Wm{K9u)m&Q%{Nk9t?fwZ=yJV>;vX5dWHI#h=<^%3>!LOS-Gw7Ee{3qZlI~nO9A55-VJ=QqA(Umc9j0$_$LL*AoS+H^)KpcWA;Je zke(>278l-_i|Jh7cf51gmBjxhd)WRb*~3QvAF^jjOD6WW$lLw9nF6PN)FP~(FXYF} zZ)^Ud`l!FANH;~$_IQ(u$8-oI;(oOy1%e`3!Yk9IyrQ#w$&(8d}yX4yp|fRSml$X`w|U~&#L8isUcO3Gj=TG5t1J1YFA#*gL*Uw-2 z>1dbb+pnGhzR=v?Pg0Hc&uh5%7tJ({m?doXC*c$OM7VUU+$)e6i^BnT@SSFKVm1?9 zlA?L$dg(7=nH2sHJ(uJ!Q6%1fCh&J;Q0&!H3p=9HObj&=q2S+BV05g(hSiQ}%rJVp zt=l}k%cE@l&%))^K;!UlbR2Xpr~}GtIZ(-f%puMOGdeSLr`f<(<2?N@*n0oJNZ8NJ zzuP^X+XGF|?mJ^&x-Vbc-l9+>yAM_FxgyiK|$xprd`>iGC(d@u8S*RL5V!SrSEx5m+DG_#? zpeozrH+A}6w!VXnL*+K`t;ErWRZ_t;VCS+R0s{AXNpE{-ou|_}N=HP9@_A`mqZ^4w zjN?4XFy^rH=&A@2wCH(+U^llM_S^XRIX@7jEevqh)$VaGy^9=+%{4ZHB&i1IoXbX_rFr2cb7fJZ^WraC@H#T!d&aY|@bUWj*3HWdvhUlw}f5D*3NG>e0 zlscaC2^JQ;>>$h?nr7OA1{z=NGMkEX6p`TV-ug5|sOAWi=NY4^QJROn`wix0s?=f= zp8aJCNm$Odr`BZ$P?KV~6r@y8Bw7wom7u{*B0WP6cK$hC+-M(0FfLnp41uF5`>#aF zIBF;N9!pjb5+bwwnz@$GoBDxkIK=6oG{)OS@M`cTOM%k&87w5N;gPa(VW#ZE$zAV~ z#3{ElX8#_|*3^(eCulh>!pg%Y07JkNtKZQI?f_&W$kHoUHB0~zaCXj_Qrg~27r-SC ztSLHbSVeenHBYsLRz>lLr>Qp>)#BKPK@M+ll%L+P!weCC#*naAL^2W0t{!4D;(^|| zfC>zf_y@@l#AJwmzx%pa5X|sa$O14Gx9OZ1Kit~pL|>))f@~3fE#Gn1s!dY#r0;w* zs;D(x5Y2EL&OkW*;6DZlSO^<{3Y{5MA}Tk?S=pV3L;2Nwng(;MmzLiP2^c@B`~CnXsND3j5}s#*lBb_@Ma1CkFEdS73|Yat zyOV9M5tb2ymV`)P%*dfkh#ltGp@jhEFWYSm{8b#H(f@qK5DTUPx6R6LlD_&XE5dW4 zXXbDea-Xx1f)oZ1oMlqwH(?vskB~#-U!)%S7cHjR>RSv1v}gc$28ZL*zSK)5 z^j2p$8utnd4zKK9$#o$;NXSix?+wrJ#3n2qS4HgqC3Ty}UP2}bb)1~gPhsedA@Zfb z9g{_4b3J$}30V-UNIvDi)`T87-P&lB8XU>t?RB#RK8J)_@wM=v5NzojLg@y&bX)>O?#%$`fv}X#jmpk)3LDmT-{S&jc!b3%hiMA$#`4>{t3_t( z!Q^8Ig#2bMMzX8juBdCI(PvoRwxNrnr$spd1BTp|VtUW{{W81Q-XfH*`;_aJ*O zSd4_r?Ld7Yw2kZ*r8yT!z$QaG_Ibg)Y}gs#9A(85xf_YAGkZDr z%+P66R_98=#@hW zCSYbiTjEGPnGLy&pc(>o$HVW3|6A1`jSHSwBH*QmJ9Cj##6j0irt89? zS-h!5UHjx|gI_v=|2r7QD76iw0~|LuP*xFafBK zIHt6t{sQbDQ}Ws9T`eh}0gv>_1`|?2`CJ_mnoRsaGKmD1Ii-*eaIM9;3h{(k&%C>t z!%O}7^6RzF{0c02(Ku1{7qt<-_Bf;y&@rXo6Zec&teUtbIhDO5Jgbr2Q?>~zwJ9Wd z8r*s+zu<(tG`)e2_hl@=eJEPRtiR3@lj}#~U{NLpFU_lMh5lXChODi&qc;bG`PtqG z3V{yxfyEgK1)>OHNM5om4qdFZ1;^PQc&P&A&~^tr5~7p4#Doq{|{sD z)FcR?C1Do3Y}>YN+g6utySi-Kwr$(CZJS$nV>eSs;Xeg8T9%?YfI=bBK?EVCn0AC{s@cReNnP#S6F%gm8u0mlaV8bNi@yAYB5p3N zRQL=M6VK0t3dry;x0?}IT`{58>flsc=!!O&Rc_fGqOAo%uLiypzIwX51xDsdxC@kA z_>ur;7QOagPt#2RHQoo@PCwvLao zDaju1$b8|$gMnkpLk25n&sf$1$6mynDxTvHmiB|jni9r^;{#}hEi<=Vp_!HcL|?LbNkOgjmOW1 z5lk%|`d?ay=`0mamTDHsCF9_WUoxc1@b{ySo2=81H6p19+t=JQ1vo^HZ&u|?zevD; z0%OB>W3GtXtM`wYftj6$O-Xjsw?o_U&{Cj`Y|UZNW`jc!X!>n4gkNyotY(UJy7D#) zEGRd&kqd7eso^EGA`W&{Z1&xY%d?ZV4Ci^BIt7+ij+J(AbBMPVNoAAQ&T4(b4Ra}+ z^lom)?+%4Zm~sl2c7(EPYjyoLog;zG5G$A_8HTM5@hG`n++CQ<`MqpWx^cp;Wzt_g z;$%#TDET>5h!w$gMdiL6nWX1(3gbF=d6=k)>7taRc3P(*qH;0S5}I>#sgU^&RMa}2hpsD%S^E;fqGQ4OmC}utx;f7%jtz^ZEI7f?ub9-t)6-$#=&mB|T z@gNU!w5PGzMd+8BR>@NxuFvGGhJiSpy9}1masSe|Kvi=fVSCDWgDIVX1hs*m{F95} z{3}~c2pD___2VE$n|n-p5gAf|Rv^O3h5Ptus$M~`0X*`zdyMx=WP(>&-68Ie&~8BC zO0d}`s`qXrDR3iwPL)Zg0c(@%3gpLyD@pm7oUkJE<5o{lv$hnITLD@CyFXxtqIsQr zfkd3K)K6WlCgz9;+DC3`k2p-Pakjyk06>btX!?JVtcEjH&#l_H1c=5-F;*@#;9Xo~ z8Wisu=-Y;_fQCZ9b*+sr~hpnSALi_pR28 zyaxl~Nk~QXwrSjkx#-}&D{FuljpxHWGm(2ysX7=$tF$Ee9@qYv5dCR|xGHUMGx-jK zLj6K@KSjLU;Iu*QF}q+-=(f0MgcTH#Yo5l~>pSw^S{?#lN5(aedk?Q7x*uKU$+g{C zwtw$lS{A97cH6(tt1AmxdlI2J%qrUsb1&TVuSAYlGEv=)4y{2<7=T^op|l>BQ`O@k zk_d{1iXCP))uU_UkSBs_V^$Nui_~}!#)4Ma2wFuJ1H)q}lJmKwX7*jv59ddOf)>FW zZ;$GUJwx2Tdi%Im@b zo^3P9Wrnng&gV0vUu_k+kvtv-bp??{cDuNN=+sdmOAmXgKIgnVjvJm^2b5ckyk+gB%nM*5P!eKOl zVN~6QXSY#ky!AYqG^`y|s1k zVek6=x{&2M9UpS}Vxa>m52>z|KROS14ZWU?P~!8SeUFgQ=RYebPTwASE8@|XYPPC> z@I&dDSeVg))>f5$YL_RLSEl@BOWiC8^w)O}#ERU+rBMtWeVDilYt`rLmz)VM%1xd! zG5%-^(BrYD{H4x%aq#4YpC)tf!Gw73QU)sovi*|)cRR3bmVZp<3i=qM@2v(i$e<}cOqmvkTdR+J_Qc^86SPM=d)ZyeoO!5zCQ zlzD5lvq-PtE?GktRY^)~GU*Dr+@eV6JXUPkG{H1X+i(OWcI$9MUKliPo{A5a7lEiXE3D zNIP^a5R`aaIkIg7Za1Pqb5LB|H>}C-xi8+nkML*{-HF`PGrZO$G!0_HCjCKA`q%)o zvU;(?J_PdbQ zf>i6JY>}hP{_Q;2gu)ZCVze*sRhuzG5$@@-fvS5=^kDD3w4$eSt>u1)A7SJw5}rv!FasD|xRg<9-XRg?etko|5T#%|vfv%~ffT<9AVWP~`cu_;2$Wk**L;N=unR zP*3rAF$Um`IOGJ9HsD;NI+?UlVh7F%b+dU~u@u)fh=U9xY^%x_ z;>E`(5GS=>v>SiI1*ShH$T3Wpc}-xvPt}b~cZ>N-)4{3HIWBqqf{%+fzhr!gwlb=0uEg?nkV*=_*C;^CKpArG0X%^W~>Dg|^=F(RR-xr#a?y%c`F;SWSZ`m;``~Rxs4r%@(|5#zS zXOvz+_s?me!0XX-Y3Ms-e{>ikR_jcebQ*t=f6fFXlF3Lv94UPQve-ZE^2ASfL`8cs z|KKKn4gydDSZp#kYd^2`J}>!xw!D8H3}5%ic`2O4YX7kz0QpE{2}RjuY4Q_ojSvEU8!uMrs%2pZYaD-8|mir!Cr^x`9T*w zBjx!_x-t?w_Wj`{Hx%WOc>U_xTiHvIQ{RAM;bi+atHFT1lC{`vt?@Os9ZWH7pjA_~ zAz~4xs_=#etP?O^e2RSLF6EKJdA{|ohnh()&3*u17A06f`*+c3&O&?Np)qV%j7R;`l)M2-fk#_ z?(|D6z%o(}bQ6IYbRBu~i!A8^>`gi`vsUOWdHv2yMs$1VG|+1id=D#B@N5!rAkElV zGI0ZuPgs2nX6B~J{vQ^buiFHi&C(=0K-AYlQ8MQIR5x%l<$oj07W$0yRir{Ub$G;= z5kB;4F0Lerr--om8UIX@A=hFAa{Zj=g>bCG=XubXbFuc~;4)(*WvczfOhruyFyFhT z8=1ckQdu3{p5w;f7?SQ%hq?wzMHpE;1+3h%KSMrtTz_aj$uv}_ws}(4eECv6$gvF+ z@>=w$4D+Udu9g>RA7KoqU9IqTf)#Yqo#*JWFuZ-7Qr2TYv|pQKu@6!rNfo92RKuY3 z#lb@jUX?klvDo`SlQBc2)gxOx8TXSfvw}5G_PgPLVC<*o8}9F3*9bX_6+YeQ?J>DN zAO#rE%|(1^+}tMBHPJxhawH5Pn&3tBSXSR?1r~U)?;4<#jiV=!6wZ{Nok^7-Ri|NN zX@i7+D5*zzD9aU-<>g%sST$Bu1d0Nmr{e#b2!@_e zQ4)m61?M}{;2TEVn1Lb!SREpbCfr(g2{EpKp286WJ;vMi>mzOuSpMnNmNmqZ%O3A2$LY`XVogCZ%9DXk<(BjblB9%&p&=ml_yTd$y{UjQ!#OEgQw&74Ow%GYs!S)@pWY1{riBUNn9f zZ=`E!^R4QS)*^_BZ_R8F>$#0Mg-m?5rVT8iWLyYtBLOEdUy2ZN*3WxY93PhH=p-Y; zn4gK?*vpPbf6d;0@@F(;L1`q0(y>e!07_$2NIu35if=-6pMr!NvK@Y-_%>xNkp}ew zQj;zAkM1AVp*}}-3aA>SC|OnI!SFSlt=5_YEw%vq!LSSJQE9n5sM7hsPYxEo-YUNV z{TKBTf*ikNaQOBP7FW-XaRxh=N(jGROVXt4P^I?GrQW~Ql1ArtISmGx0>-{0!N?X$ z0{9ij6izNOi~;F1;?nz&SGs$u2i^18c6wN8Yu=KD0QgYtE(vqowQMQA^K!+1m;Rn` zWHrX-==SagP2wzv-ZLLd3(zg8D}t$Na6X?n`?ui0AEz1kl9j8uk-*A`%3ScQY6c2g zPJK`V1alYw!jHz&C}&rMYkwD6l+qGtXeQmDN|O*{Sj~ zOzmb}N-vc|f?rLKNprBX_o!-hhM_wj3cZ?I=c#4lmnDYdk-E3Z3jpwSO^TO92bP~B z6pZEg{%C)FG9~)Gl{V$G>_*r*G=?kxyOYrY+cy0&$*jDgYeR=Q{uC^PA<_9XtTxgj z&zb|WY+*;^lCv-hUhGTBu&-)h7Z+PyON#N?TIw&_Enr5{;pn!I+$~`0eCLba>5gpB z{scFe9}uD7z&!aw^rpQJ2?EVK9SJVf$KM1z9C zMt0fGF%21$J7+por;~!h-R{R?b4@i(%tBT1&~9(QfkjpP*f|?~8#SCEot^cdGFnl+ zU)b6|t?f!WDkv*PRJJD3O_a@NBf-#)5?kZ%yLX7T3($rK(_vRl5dJc0b%a-M z=}0gd^#h(^OtN|phnM7%9_Uu5u#oswC6^P{#YAf^Ai#2vW=4oSctr;JF}}rgYp^f+ z<#_<2)gDO8T+g~n9OY7a?YewvtNMw3l{EO<%4~Hj%(V!0%-lFiYJN18VAH0Hrz{96 zEm4TWFjHa5d6#K)6Ehac$Vpt0y++9&5bF@Ik4LNC%H3iWiJ87YTLl?TrdLs1VHDhY zL5}$LuPkp1l%f)u22%Kn;67DB{?LsN;k10#TWpnBjM^RmwS7B6!rwxBQ2rw?k3z=r zfIbf$l5a*>Akodz!b^$jSZ6@dp(tGsknhebdsgq=2uL?Y138U~v7yAPxCFWFL2oCZ z?^v;a6Rz@f1srBpIcN1J?V$= z?d4V_^ESOVjbt}k8I3$AjME_>C5~KMnJZo#ifs{0u}#xZua=i{6{b}ol7zPH-1^Xn z2&Y6@o?`pa_;<@{-N!DR*WSC+w4iahRh^X!o63_f8vT^DsT9c(*k6_K~tLsFBOr-3NSSBkj7IPe?8=mxGHSMMk)t zxVf-m3g}dmqm9^>GYQ2Z#-XB*DLBBX2ig!)v2W7A_$L>a6ClcLoYm-0b_|!28+ppg zD9#TC1atTUB`1V#R?Z%wF22LO0SBBkF*{h~sk)sWxTKxj^^&WiSe2OJl3iWAmE5(f z`$_uuH|O^dBrBt=?cs@sB zkJX1OS+t8Eh}fm~52DyPDIv{Bo~G0Gj(V ztZ%GOV@8y3vpW!sFZd#6>8s;qZv$@IqFyV$PYdsc?E*3i#Fx!0xY~?-&b%px07aPhBc}TCB}3A zI;Gq~pm`XHbe5EGVc#QjOyw_{VEATKBCTwaEvIM5issp}m#duOt?X&}hHb*^(M`=UAfvGJ<~D*AW&pN z=^dS|92B0&$kG~lsauTa-DcmIQ6HweRL~I1EBi^LLP+wr(+*{;Rd8&HztgHYWYZ%) zw68MPJihLU-rijs9e&%5tCMn~OjIV+#!Gg}YdBM( zbgyL+)Cx>C3FUgStO29X>2a6C@v_`*351S$f|Hnj*J!e-wKLtRMt>GR?)5Pbh(Qwo ziTlxmqr9*yp_vebLQ!>3_ioHnQ!t-EnElO2!3o{qu_7h3uK`Egv=1W9&wOkbcxkhb zCpk6>C&HIK_v1iUlG}3e2zAx75D{x_CwEai_d^j`iofkFa^{wseE|lMaYWg7> zi9ly7E5ug*`Qij}I#U3sV%pmT6Up!+*t36yr|lE5@b8r-AWvDsn-EWvJLIp!#T9BD zh$o6{N)1*Hj^KW!zrkwu^kyzFep7FF*pj5_?U-1gvt8xdC*vBpTfm|T4 zM5Hm+uLik7`0t_N62rrJ?lCx4?a&@x1eF{jdgS$Ub`n zx;W|P6Nr@c->pdTMYYUSaX&D<-!QI%pCvK#@5UrGc}!pr*{-|=E9K6uJlAm{J8Z~0 z{mrr+OlBlu2djS>yt3Tv2W+z(kD{sIa<78$7x$ufShDTz2_l;*z+~C2F8wqYdOMl< z6!Kw|rH^HCZj9YwlAhY_r#QBRlLK9FEZQZ(=MC!+c^^VP!C6D2nLD5|TNmfQK;Q9- z2A(A7f5-W|Ss>;M>DyA%5}%s0;CXp@z=x!CY@2$OzH=uP8br&myV1T>=4xMkBnl!p z1`M{D1&ijnbJPMy-5e&)%ncLze?%sZMXs$dk9z06;&zHg#hL=p;n@@VhMRV=R$#;; zgiC-b@3STLz3fl-eePvFGIyQ_X^pJ|YEY7=@X+tol!lE`dkRa@k-kQdAQGZy>3l{{Ih5MQ7 z>%w3c0lZ9Nd8kc_7@mqz6I04juaYza2z9llLh8YZTS}845BA|8qq5e=8jj*;lqqiK z1b39Qh1a@yFaTQh1N1*U912wPr@`Aa#?p}D`|P0P40{Q)%D|v%w3ChY4ont|$XkpD z5G&zPWgFc3B;lZecqQS`!F#;p^K{?WNX3-Y8PP^4X8*K9BXthkB-$(NicT-pY}1|! z;UU_HTOOo;(S-GLE-720#!yi!JASlBQ zxR1RR=9$%_jk6UPQq0&6-|esAUI{ywE7>#=EiX4(g-o_&Gk6&omvqc1plqo?r(#7% za6kxTtuAds>+W76{RPLK!_Cyn2SNH&pPW0Gf@^BPX(;Emu^M@#^g>5j z(IO=&!Vu!zpE@aI78SnNtN0O&oD8OSW-pl&te-3I!YAjAUqF77lx-mU%T`7J1Tbx z7*M(07%75#B-wiu_2Kny{q_0S5>6cU?M79NWKTj61)hO;wkbSby*T;DImuUvkK7Y@ z^WgS0ygwli0@UeVdV8*nt{Dc)8Dj>K1aI^*e#kO>ycOJ43lFbv%tfP;>%AL+%pavs zR~)D3E-BSjFp-YVT_Dx$E(*Wa%-oqXHv12HD@7wD63{Rij0Rt8W zD0X+CIvzxPe`)-~j^pFjYoWqJMN=HULv!%C-jv`2Q)1)+g`U|$37Da-nlhu*IsV0Y zYM9TVLWRyJ2_-?^e7JZ3m1GncavCU_zx0H>8*%JH5{Q{A-=saCz&T$%2e_my9h?c6 zCJ$&j5ChTF?&=~mx3|vx;{$P^u$$R&WcZK6(N$%={=H1K8dZ!q8B7$1^KBLqze9^K zu!N@}Z6|F9u!Lxt^a8yQTtTMH@%T?Yc@J!M&KE*}`)HW<~v=ZAsmG9U4r+)8wfteCIS z&}u2G2Nw`*hoOx9LhJNY8n9w`rZVO2Qo9_$Oe z^sC-xr78`BWgszCij6yIddB|kaawz~CMseLDaLvXJ!cB!-G>5Z`2*nE5@R(9T z@N`4H8cCvZREpVAiP6odM)66*VMH~T+CktUpo39~!JVp~I3#d@L@Yhcxg$)n!&>|$ ziZ$zp#2aGb(vq0lZ&^3JOEif@8#*BN2R{!8AK8Wgrgyd<7+LfJ~=M_ zjmFcDkL4Q>GD(k#^u-6K{6S&u$H9cws3OPCKY+-nuwO5C?qG8l} z60fJ6XRf@ii#rx|ZLj~M0(6WC7l-9e+W}+T*H4Y=gWoy~9v{8t9?|!JAQB$#j1GhT zi1;nO1viccFkkJ8h&zI3?Qz5Uiter6=o*3xP*~vK{{(?LeGJy0{)@aznSLg zcDzyPnr{2yLb4ttY&Rn@wuuNPWZz<*6&44jIuGrx>%n1!oUTVaD^5NN9XcgTC2p!; zylLM|1@^M!8Gf|N?z;F|X3N`?u!=;(z;6b^A)#Yv76#iH(NP-d&>qF3(H~_|pmDUh zPF8+Cryk$OhD|0Ac;B7k*A{#U16?)28{2eMSOI$yXmPKSy*?8PA(k5uyQyEKyu_DU z4G0t;r43=%PaYA2HoR?zUCVjrW@T-fXG>nm5Q!9x4j%GCkG7pFM_$eya6o>*1c6;c zE=u6W+S%v3mfIn1rTmJHI}owb_yt2_h-`nckrXzfjy+m+9)93)BV!QEWyV``-_k3A zPna9+#GMg<(zXR}7-3tVdwU!k72Sh#PM#Q1mRMlaFf)usu_{*H8(-;1iCR%Glhium zoNA5KyhTl5lTFQs+d&CSRZF&}{yZ=aQ>=p~o~ZL|pYJZEA?Trxo6f`vpz+WQ)k-Rs z4D?d}Jc($}C<>EFjC{E(eNDWebKAKn|X(R(D)*wV%QZE;4%Ln8bSK{thB8 zUh*z~t%4s{j9Y0@l%gKI;j60=5q~i>yK9*K?%%HpwE}E28bkxWW=VoqV};@t3G73M zrRA2%tF%t~t!VB!ylZ2qkE|l1 z*M?O1RfktZS;86^5B5q5Q@YfdXheA`x0=y4%lQra`4&Sj+Z*xInK+mB;#9BWXXtt3HV%{v*e>pp#e5|(T>W%htQNgoR1(B zKrtBJO&P~XoejCLS{eDw6;>E&MN$nHC*BWU>5NWpXVxNIMcI)?+Bkek)d*Ssu{~&b zVfnXCh^;rp;uvvW8)_^yrE^M(;Z>+_dqK7L0fBYhXfA&SNCln(VCn-(?U-a#n|`Zq z*X8zA!t)rwV!GSnRV*%f+2!%Ga{E%mGS5`j>vIO5(X>#GYaWqiT3OVneY0JKlStFy zf=5rW{w|d|nCGXsOEt!F+(>)ag+K;r1uxh)8k*3-f@M(F$Mle}cY!1Ada-304?Y69+eOi4#CjD7(Tl>t3n%=FF}MdT>_sk@3VbSY^JUh8E6b zn-TD=K52g&k`9o8{CjV`58ltR8ol*TG%uoh<)&HXHqz3)z&j z#l1uA>vl;>Ea>Q$;{J(LMMbGWI*)!y$#dy!nrf#^qFPPGmyyk2Z98T&wqQW8bBG?D za-8}#TH4DRsS>BFC~|fgpE%OJiB6B7!{aMjO2TtUu4tKJO?6F*3lZfqm)4!FLO178 zRscuP5g$GKKcRQb<88sr2<-GT3)BWgi3Bwit$LCK-1_f=UoP365 z&yyB)B?;0VIV){MC11)wRtd>eHK83Fzikos#}n~Yu_RCUc^j;QhI91S3BK&wfM04$ zvxG)*brGDq7#l4qT>Sv2lH$Q7(j*VT?iEj?x5mXkUB|+K`eX z&#HvV*io)c7GgAQir?aP_T+?iuz|Y#j*F>ea6b8+SiWDUegMOBB{u(y3}gMj$uM?~ z|0Tn^v?O9KT7S1@)L!8lgSkX{ZwdHK{5DD5Tkyf8k{!mdNmD+*Vw++`XslZnAaEZW z>%xcD)%C`_-@fwcD1R1G%xD=3^`%qZT0VDEygm(GzYk(2Ee zUODh4WICv3gYREuV@yfuBAFM8y9E{IDQu|G+9(hmfuM6nsCcun*BT; zEXsO)e=)8yzfbg3WbNnPf7zm;_3w&Fz5H~3KHXoSRoZ~@v`e8{i<=A2J#pF=tuL7K z6vBH57A;McJK);3pUO}q*kYf`o6BI5t7$NebKl45nLLqaWKkxnIr1iZ-JJi`53wco>RB%*2e0u_YHk?5+&7Yruc;uTLNGJYTEMo~~E~Ft0Tu zWyqtH3%5a`C(mpsPpuHDPBv1~n=hDwEgQh{NDOoz&X_a43Qug@XJnDWve)pS1te8{ z&i)n`3v&{EW<<&&G7A@aRe+Ub$3)5jZDOekSeYARc!K6wj5d8_RBhFJqPHsJqqU(no`*9tHWCOmC4Uy%HcTiM8tcy!m z=r-q{Swg=N4Q>`!KW1tyBtPaMoWB4%ujjh+q4Qt z=KI2?GryfKWVF5)8dXzfPa6?8mN|cy@wBU(<8r}3S^`` z{zw|R_gV;eOT0^4er0SHza?j8OG$ga5Ow$)KA0}l}T!Yf(pxu z!qzBkLvkPiq$vjqymPAIr;*F5m$7*`G^vy?%@YN1P{6OGmbZ(;KXx2V0fPrzS*krb z1@EogWa1K{<{DKSRfv|q3Hz%-r95|{B~ORn-T~Pr9aK^dA}&f1W<@C9TEgO?T`=HIXfJIbk+*gQF!d39EKoHV zqa40&oxpB^>^BX~;5_KW`8U)O=6F!Gdwsm4oc!M@62Xgtw$dbJ%yD9|7D^d?{bb=? zKXO)X7e>Z-FO|AgpKJk1!!8GuO|gZKol)76_%b!#WmCg#m^AgcPYF^(1Vp|!2 z$cc6o9g9xqQG-%CT-BHU3t?RG&EcZ4&sV=<`ZT23xS&bN>@0`aeGAGAL4z4ws-C-= zbws!RrwS_eNwEj78 zar(I{T?>uF-`$9BaJ_)q_^gYi#aCW(f86}|)m_N+n;z+=jJ;aMQ3M)+)59`c%Uv`NW=OMj``cdR8R6h?$Wa?X29$%=BrA1C_XSNC zIml*8^q!Y&JI#NVYMe6xAP4BfUFJ=O84tQuSB&7)(%LK!ofITVkp%jM9s65h`6Tx0 zPlO5hYQ5xfuYlSfV6y(z89i(ty}b9v=#rMpAGa6g{@!JWzN4c?H!}{D6$Vk>eQ>MD7`Iu zb?6Xbk(c?6x}D8j$?4C$s0}FYMJVVa-Knx4|N6PGiKwM|BxrmPH>J zn*%)b#$gA*g4+6nvjYYn-L^J1fu)u{CAfLJZ}XC1!C@Aa;o+Uwr8DP5j_`epiKCc(>Gik;Uuz{UX{-%kgf%c}7wFHhKSB6onD(bAMGd zBR{)z=cM@@zKvx&Y=n& zr-F;4@%yFG;4;uD0)wLPAh5hUtu*WP%UK+?caO#crY8;kV+#`M`&EMdJdAD1sXDCc zR#!1hnVf@Zjn)}*6^i$?=^xr21LlXG;q!+jZ}h9JA<4l88!O%jTzC&Hdhv=F}CmJlUWiNX*5;l`N~ zHBhG&g*^s9RJ@Y>p5D^UH!cU6bZP?5zLY>{GDg^nK86S_-GM4W3SugXigaocm_F(C zj0no!5)*>`5fH+>!sxYN@Zw!x*Wr_v&mu_CjWtC9HqI|J9gOU@X51kF)IU9`-0Leu!nnS{=0ZgJ#P2X_wHkeO`Ud`U4v9U_C)^YSfYOALDGYh}Fgs3U3$P*qAf9UQo#c z*?!1jEIq|KOHQv1$fz(0JEi&Jof&d(6A};{)_i7cIFmU(s(a2d%F0heAI(SI%Q2tM zj(Qes5uW}hIX@Uas{fMLdw%EJ>J6`s@bdn4#1`ni@bZJKihI=sa=k-8e%8=rz6gaL zsjVD=DatC1(Z6|J`sg+NB*Z{_EaoZuYKJb0+KGgWW!Wm3xEBrTM&ia4yM_Jha zS4n;A7kTpkk3bIC{f<50CH+dPugP;J3=HkDn=bWPyzThHY&AWgiV_l3BGE{uNc`D2)gB(7 z`O5?9kZ&hgOr z&^o>+L15|-n+s4h+I29-3Wh0S>poCsb8S1=x^%8m(%9{lwcK>N zqqa(O{j;<4XY_{vM?#XS{ODty$W9!om6i@V$_F>&SA`farZ%tnGmuGQBX=1H9AdpR zCS1G*j?=%l24c;C%TUlNm#~XE5=@o&Oi+*4WlS$aR3Wp8g0b)@ROL!H7I%_-qwz&yR zs(&IQLcW(ri0T!9JODnSo;)-Nn-?y(#V}1@;D-@bn^vOc;!FgVss6@Px7bi(vAnz{ zC;i{;@Z%q5&z;m|w*>z&05bikUhEq%ssY(S_|I@Ok5_Aq)RKkDzbJF9P^`vWbhpr*^cc(WtC) zpm+Z6R?=j7>67HmoQ>^OfJQXy?Lr`9DWA&xgqgeU0NQHUn?h>&`yB*Su+TJEo#pKH zQ0nHiQMn{+x_E*}Tfu9MpNr zsIVs(Q;FiRD;fp$A&cHBfsst%Mp*vss3ipt+36%nX^l$0AcY9_Bwd6QLjtt_nefyYH%6Qx2DrKUt7O$k$UFXs%W@<6pE!#eFd`o3hfW{G+P zZ+N+BxbPK-qXlygX-(uYp_S~mKQ(ZO0b2DTv9yNLf|q>bTreEeHl%(PIII1uzfZg!mpSHPYCL&PO#xr>YdsZgwgp6d8kE^ zZ!IZ}&DJX7CjLt`3J%5d@TzXqbh_vqjvXrA2G2{8Z-%rL9k3 zV3{PPzwiGr?nx@rd%++)QH_6gkAmk1@y~(i0O8Y75FbcW>bk}hL=np5&F#;{1r>%s zUX2lmDads(2+Tj<%f#I^Xg}dq40J?>b_hPTe_0N;k70Jbnb(~ zP*mg1qcOY6OH{iwEc5$ACV8je@T6N-CGymLRwg{c;DZEl@QB3Zn7^2ylV^K zZ3&^I{e;F^tTO9dipDp<8{CE$iU);RVhw5ER+Y;**cwSVR*8#c9Y%o|W5miSH8|dl zZNUp%8DZ%~{r({yCX!=Na;yX#DvqD^zaDiaDjoB|zMFn~t~h+N`QQCvi5VZC%3H7; z%GwTNISQb?*aY-m2%a8o!M=ZKVg!7OTp3U2Lcv&4E=F?LggXZZ%hqreaZ_{(V>zi! ze!j^N){-y*!5n&5%&!`WWuTI7j51hGy>M@aeXDf2pFA9-a(5x9Ib0)qyeeLU@%|}E z&PuYqUx8b>b(7S8oj2miL4nS3CK{Z*y5<-dK6F()otaoReg07%e*mj}s%hUepx~LMq5b`y;t9_LK)t0$%)dnsFf{8Vz{An-~l=5>>zFcrZM@hcQvg ztIJm>0CwH?A*^TDW6#6a&tw!!`VDflGN9gj8IFRsq7$g;t?xSt_M8 zaL#Qm^mhua$*5B@gu#@7UVY-%L;wSJ^4tKxe7?^V&I9ENOoENcinv>vB`lTbN)v9- zTU#`>inc$MFe|3;ZMczPck;Q3LA>K3yG4_onIXdR<)|efVQ$E|Wm%c#->`6!z`tZ>A8lhu@jU8s9*J^fFHR{$v$#4uBZjc82rO`1U_M(n!T zU?N{?Cr()`18A3_O-F=)MlF_9CWvzrLydIOV2GG*{t>;WV6l^k=HC)x)4*hRB-AyN zQ0I$Wh^GFmn@9h7|XF^k$4=_x~h+u8%>wcX)ftw?-GAn%o z47W3QV~j7zsV+MrCG?c1!^v-bXAcQ+VxH$z+jw^_T%Ak>}fs zUa;ezJAK3fqfN7|+V6e5&qKZ+PVJvZ!`B17$KJKm)PsQ-?^b&rNmdx`$j#8bkq10i zQoI-qd*3aXgp73O)*~j<@AkD<@xTwAAhqL+-~JAwu1iAzUNg&9@Qd2dno0F_T@^$O z-mTlzl#m#A%YXViU4Ax8mHEG~j~c_9{aKwQD~1guEE~pV$2FYexFQI*OR@GOs2o%F zaw|H8?ly3(oP+~>zMszW^A)!7x^1}}JdUn(npE-kBgcG}?X=v@Uk@=#Tt^o*1LRpt z1HKVi#c^*pJ<#K+3R)05KRln_uWzdpX5%Ned~r2D5Z(_8mO)%S_8gkLdDjm}oV{~V zlV)T)y5aWotY?DY2qhFcpH*gNKnH&H0V3fs1X!($tL1SRg*(oyYuZCx@fyg6B2{?O zUXKf;52{|ul6&q038HlcOqri}p0;?y3^x8T{Tat5L#5Psk+(>D0hyg5UFaLNEs)N{ zv|UE)6M0?FUKi}1-)?_S^gr9k#KKohvz{*IDOhC_DEdiQDyYsv+mh~FRFyexGq8i< zX;C#eHYC8f7`p2aeWk+rkPfc0a;c*exWd4J?#vG8%D|F5d+$}S1*@LPt^F_n4GUW4 z#TonH>A(l_U-7AcWYumC(7Bd@&IlyrH@(OZ`Z`zA70kdiYrfFd+#*XCbNms67OT`V z(1C%?{?tNihAT7)K%o|yiO@+Zf#f@akIeWq4od^M65&$=+)^oy$huZ`fOmGg$9d4a zhct;2Emc7Fm+%CEzbih1vuK`4zLuJ2g81@yB;sy4L0^+gMgU7bC_v(s*SUHJfnYiD z|5@^bB z1h1KHbQz!vktRfam^%8KfOiXIUz|5 zGh>P+y?ES&=?{}-`#18;Kbays`8X|2oq;7e192%7s9*z1IBf@T>~lm;1X^`{GOKnz zKg<&HAK|rZBJdCaiJNVu1^))U3;Oo7(cQRi8QRRAh9pMe*dMYiOkkIQ`fOB5bi?Kv zUjuxe>_6_#MvM=4V_^s9PR9dNO!h88E+3qeq!KA*GeNFe=K(_>QKd4C$i2J9aLMY1 z&*Hv}6uHC*)a`;yLh;SenZRr!F!(Pt)EvO|fYMqcv|Y<`YjKdso~3@NVu6(U_y&J! zuTUl-n$bQpINRZSAjbpj84Zp6ZkKjr#SOo9I&)kZzeb^5aA1{z*e0mW=c%5mlKxOZsX>C7-JjNTa}{36K5|1>|h88Arlp`fk#-oSC7^O4$l z0~tt5doZka=h>VkNx4OM`~C^{ zLPZV)XRh8rPE%vft6PBgojcya+qhyBj+fq^Ypi%;Mj{al@f;cU$ zK`oPhQjm?2((|R@xp0zFbAj@bs&hn^UJ)hu?Q*tZ-$OuKcTPK|U5swPCDEo<@)+Et z-!wJ`sf-rTBO_^BGjunhMTXY%i1_yA*x2Z!5G@ z^OzfzK^cs}kvlNzHd*s7R>X{w37fAqTkgcu6O*p_7rqc=>JjgSAV>z@R)*~ZXVXRz z@>+MvY!jZ+e$FkYdKq#bEuNR3mpvzHLh%?ukv}oS&Vf8v&+XGI*auS`czP+M)t{Sg zdj&#kyUJ;21*zvG9m%79#2xo{zcl|)k|g}b4X?Hn+f^?&BEPnaCa-D&Py99`b|)qe zHUwQqO%uGpe1%1+FC(3KtPCpx4p8>TCEky+ou6TGGj>R%JX2lLIZtb@%|RKW?bn#=KjSyOKTwyt10}^)6JE$PPgfH zxO}e+`eiJ=4p}DWC~P}zmo+Z?BRidu?!+X)dc7l^iT%k|0&asP1EVi!-%u2uMuATx zAALQAwSe;+sfull#v+iNI^~~;uddyS4XuCSAfdZ!^_~vtB%G&B8lGSG7{Fpq+)NxOM`o3!2LGKzk0fk+q* z?c~a{<2)dbo`URp_Pz;XV z7U=K@fGdcu1CMGe&mTC)c}! z%f1JA{=*dUYtGrB_mgm#%{@_H&jn5BkGTHIBAhKGF6wOc(h8`G!AATdOho~niQp)m z24R{>J?KtNyx!hO6EBo+rv&ZW>Tb6KI>2Yq7-lmE0jq8N;$X5?j~QA<$Pn}@B(B<< zEaUe7>$Yk?oX!abjeLOMzVJ3zsyTXBO+Nx}K6qBF7t|NXO>+X0VJ7Yl z*cI1?jEKV0Dgf>npfiUk+6-Ly%yLr-iXE)UWlNBRo^r@gvSVgF)m?cpYzxnkGIdcr zllSeh%0LYOoVDAvf>MZe=jz!nRlxB&v?Jp*?wCFV{j)*zW{UhBk^X9;X0dT}CsSjc zpj%*4+)9^%oAn8x?C|vl`vWALE(Y;mV4juXe+BcbO!WUZ%wMv={KEVvP}ST9%IvMa zubA&8!$Joi$`OSJOM=iZ&5OW_6Bw;MiPQK)>U3x&OU5nYyAi?u=T`ikgC@)#xm-5} zy`u9Oh5LEev-OsvGr-%;8n8QQM;csX^$HhE&I7~Gpm%iZ^l?L~k}^>l#A}mWp)^CH z8LnpQqg~=E5qu#PB618{X820Xb!iOBTe;$hp560qkQMYDX=T;=>&IT%jk*EoSa zs3CT&Fu^wR6>hnoX4Wj5d33dGE;P=7nEG53Tq__$_-;Jxf{4f*ZY_EsSzud%%*2k{ zJE_41t?GOiK1za2XKb*|5wZ}Hw^RGFlR6O^Z2o!YXjI_&`8^hsFn(%ZGBI5Ld>hR! zGcc0Be*6sh1m|SeHlv2K|90_5S>#TU%lfBq$H59qDifkSqK)r|)VU#16 zHFwolKw3VHr;O^OTjGDRA~sljR53q?s`jiCdwbZ^Yr5MomOEsbHqnlrVhl;eRJ!O# z=NIG!)vcEPowjOjPEy~jD_%Xj zoQVIf4AFDs*e${vfLi^cjYeNqXXCyWRx-%SKXO;}R739q?wyhQ7dnsGW|>FwTUq9y z($#tYlA^9BT1v>Z!QuAU(7lg0&L}y2CZ&>cXL52K61iAr7~Oc{?gn=>rw2F@eiAK8 z@7GmhSx*RAg`-cEA-uC~$71&fjXYt30@a67HO(o;L_M12ufP6*7^5}(ytYXO z>F+Mo-`PF^Tr9SS0g?mfXtR>L);(#Ux=A&@@0hL@)&owSLf!d*#}G8+gLP=-_qfnL z5ew4C+YJuODq(B@E86rse=vH6lE1IRM<{?|boD*kyPg#X-kLm9Yi#Qj+VhP(2{Edg z8Y~!FqbFAh0ro?A;RU*sh<$YaSb_&eG`EC15Od7lOOJ<4fcUO~fkaYlA#$7oYDv^U zfREPtiwS}(qJAvdMm*`adWHE`7`knEnl`QI${ie>{Y8Zdq4?}U6!$g2Em~554haRK zIr&ZDHf^f$z)5muO>=rLt%2xxH;H;4i9kiA~I~ahj7SLJ2%?i^I zb4v=mkjm)>!HjN1(%!N`bo(H48MJPxGZx1GpE4+I z((;BVLajTKDjR%t3MI_fhXjilOx8x0bIHpouQC43Vl9YYf<{#~R>Raf48$Hz&uxfL zWHgmv5io7nIh*bL{JzYYmLYGv8;<*LN_8oc^!oucAD$c_vvC%#DTgs5N&p_kF(Gkt z5kmIF80ORYj0GFSeG2FIt#iseE)Dk;?U&OmZOV26ygUWkVd!Qs?kzF2Y|K@!eSc$g zqxvYH`B@)<9X7P{#HvG;vbAcxN&K^!bEq$+V5#hy6fLt?eu0@N;>wYvGZR8Ic#$oe zdr3Rj^cUBzQpfQ(C;@}mqMt*~T{?fclts7`n{wjKnPhH0tTYJo z5Z;zuG!pp|)3ak00hxnm6o7lC3zhBe`s`aHO4!R&uV^1SzUnh8{? zB`sFK;pPNG5rmlso_6oV(R>}EqjG4YE|6BbB^wmuEH*h6@Nq?Xu)J&f+*7EY<4sf9 z6&j-FLPU{pJOt%nAcj8Jdt8Gc<=@%l-!hZVWU85vI1P2T4dBifOE&EE_?t{;X@KK> zU(h;k;X>w>ZXE(eBZ7#V1*^N~VNht9p7Ut96q}H|6@>w^T(4;xVr9deJ6$ z23U3NGvF?}2u8sLbA%Eb?lxGfl5BQoUmli})>02lT&lqGUyIys?TQt0=Hr7;J3EXz z33P|%3b;(f6kj!EWZZ!HYp=Ji?{XUvgSs1tZgw}|#UqUKYDF`koVF15 zyplEk_zdjDmDV6mANW^tO)-waDVlUjTSu@WL^ z1eZ;0dP>_;5L5`WKct|Gm)NX3b(pbEj2-4h3BXMOZ@F;$E4?t}QDu_HI=H=84JLUC ztS*#rTT7t~Hvfn?eLIJt*-%x^$g_b0eoj|biVq?A@|}*6?F}O*=cEC$e78ucTuX>8 zYZ3$QcOD#$Nb8Sw+^|iOZ0`xEf3|m<=vGAHy}g&D|5DNz|5@CKa56z9rHK)$Wp~tM zp;z|LG!?If4pTRs+IAaH#e!8uu}6q~Z!WsA!9B=QGwe0=%*TzRLj2jI1%p>aJQ3PC z*#|Ls69G#rTzix`D0BWa9s_t1V_^W^xtVYkf85jgWTs+M!ST;n->QW+(mbdc%Sr8P zqL&y=(b`@&zH~((i71Ky3zYQMZEak5wD2Pf?2gmMM&eUS^}mfd(r+A4?aeCFp+RAu ztiBL;Qk9wgu6B*M(U+Hvs?}<|11eJyaS47|p03%6wi&WOvB7{IFeh^{4#7-9yRs$J zSOO{ZhcFaHf$-1>xX`{b0h7?F>M0Iw?_kAJ*nq;)G@9V~*8 zkrNx$rNl~w-MI@%jB^_ygoJf#1!MLZg;mL5`q~4%memUMOKtsjf$TUc6HMD>Mww1< zhsp~Yi*0B3w~;S4^#kZOL5|H6uR!~cT0D$f6|4?!0fOax>TcMMZirTC3#LaVZV~;^ zjOSl9H;hpkvpl?$=lTK~yc~VX=M&;~)cNIC>mYv)*aV=leIgE!h0JlVwCTP5zq_X$ zA3EK^zq_YU{){78Xx+_w1W*c|SpP9~?_J!@P^!FqNI|y#hkSP;eUMoD_PV9>#NJP& zK4h#>%L;uCc%4~8XqSn3-fvJ_mosKpW>?;iIaz4SI&eh`yJ2X6W)MP_Sg}oerDM2G z&T|%-y>Z&7>Nbi!Sz9yydEg1{%V{5!R6BGXY$-8)UR>A&DED^D0XW1t z9FuG^J5Vc7TvKXFbj}bwew|&&N}qji^d@FZ-ijnIjIw=xJN*y$etzZb;SSKA$fE|p zNm|Up5;);Sv$G2Ax1qJkp;U9SItOI|(TYnLJH@?)f zv5#~}gg2-W1{_JYqYpnb69>$;rnu-+hTp(InLIim30zT?1;>k)z&RY_Gffsdi0A)MacRZk z3Q#1n#`SQuneYX8EcGde(%bOY^LDv@Ys19TykISFcbado%fcpJ;J3$C{ zlGt=1hsjq}r-nd5a(5Ao|C>cgq@C~By`eWx2~8g|B5JNMv)&g}23?NRrv(E9C&lKn zsuL()b6MPkea=O}0D&doSMKV0CyWas4qyb-+7%Z>CvNT>fEk0gXcerRa7V!psmlG^ z`h8bcujhOF3?-v5V3UCojd)0-faGAys$EXej@{l!W>*M^g4BZ)p~C%RC#$n7vK#T! z>dfQz)e2RkEo#2^51&db2+huu7Qw_H{hZ9;a8ktjFKBAKBli#@*G6?p664+^_Dy$` z2npE@9H2|0uukW`N@B?v?f~m}W<6y^1Oq_doj#PouA3s@MTs-@pg@Eej}^hYbyo?W zyTNXJ6deQsQ82TTbuF4jF4efTWC2TX2GFBoo&??YX5S*u8VejD`<0-@{5v~haSbQp z{lujxL#-8d*wKs~O4SqTzu*W^N9VkTj4!(35Cyr)>5&dL*I>FZTNO^yo5l-TM&Z4` zU~B4=ax`-#^A%2$b)>tmS)K@}!PLf{x*VOa8HA+@9X!%k9~yF01+PP6;fc#1`W zL)={U@Q1Chf_%~9t8=h*i}R6(g=Wh7>dV+Ww{B&Cy<-QV91PY*6R~&~E!MM`k2yWh|(t#>1%<(%Hx$J4R+50m4Wd(}K zthR;1`Sl-BnD~h|q`~2Y-$kPce0>W^fv-YnM5;k9xi|uXDr@wKzzJg#b)H?}y+j@h z+a63N6^o7s0w!qswaKh%j427pcWo#ACIH1eS&?_kLDeNV=0f_h%~VX0-7phZ@b5o7 zv5B(x@JjC3t2s~#d6ZQ-LM8WTM?8BYx%_C8ARRy}_lcPFE9d@Ge`z39C>KXE7NBs&BUpjFh0Lk^)Xr|z* z&XSDlGaH_k$IQePudy>LN=f1vY|0duzz(BSiI_7IDf>iYEED&iR12XU4tP|B_1AmL zqjbgjPY3p72rj~b6dV2{-;O>0;NPxr%2h!EI4Y8sx0cl}6iuQl(t%VEL)M&c=-w|u z#|;F`m~TI*Ukrnf7sRWv_|-#c@FBZ9Y7;pT#r_$@2HK;Lm9~&??k|t)^CF^M0EsXU z2Q&yWpDpi|tl*kEUUC8I5klMm%>?sa;<0nz$MUMRC8r7CbPA7?=*(~NDZ zNDM+=GJ`}80hw(VR0qa0P6FIguWyn!E2jkdN<`;nz1o%|_8km1coE|wo?;&A(_V7W z@OHSgA^Rlw?Xs+^K(?M9Xk2eo%il6ACbcELVvLBB$GP^NYzw(`P0%Y=kClmzwy)m# z5D|+d%>Y7^ky$sxadclJ)pSqe=nI;DJp4eh+;PQMwRe!~NmcvZMcR=!+SF-X)Cs2X z&d_E8b&BTRYg|?nV`d1sHY!w_Hh?ddhn*Eh=YV;MhCO-02Nc&cvR6g?%W>?~3E)M& ziCAjU^rBK(DA#dLgDCF|M&+cs;;ZiRM+ZjI=mX41rA-WAu5EqFks8~XLTc(<{N$|P z1;^0DbL{H|!KlIn&QlellnM2ac1a0|Iu&Y8~>w16+C(#dVG-2sAGC zlv}LC+vVDFmWhT?v@35BCuZeu7gY>u6ESP_L!8(I*nnX`^+@<2`Wx8rhQYSB$k)6n3HR`iw7xVKRIUe>5%OGQEUH+<( zG2DZpfS&Jvx6jA)+7-+TSRo44izew>VDhe(jrnpF{?*lIu2ykJ1>zinJdip^e>;7= z8(e#!DBc|y59$oj zVe*gqoUksp{J=`& z{18X5aJ|+~l>W_V!~6KP(tg|a84f4f_t)D?pDA9>%0JEg%q+vtQpJkc@eha<{};96CZCVaLxr{< z_DBv8&d-|ru^2$_A9}Q3B^%S%_s#9h-V3d*Rt!Tbz&}g_D6sa;WNyU~C;8~PHt)Px z{dt0|0V2e$K-t>?LktM=FhG7Z{Km0Ec!WZLRO-Z#3m6s22-~3AgfU73t+KtUytQn$ z=nKO)V&!!=zd7mvyhWguqq;_CYED2$v-)(qe9Z?zx0F{+R(jyhl|uY@40?)-9zOZ* zTdnwhiyUEyv%>=XRl0>pBydVyKzOP3F(ZybbjkttIsv77&~?H%1Tjh#Up^C*?iNrw ziZWjL27YpVZ6ASMD?aLgWYs!Jw<(|?VDI%u##z0j31qV{hTLmWnD~^>$|1_+a5=!Q zw;!KRXNK2+R5H*qk(z)LPpP<+M{pw3a_Q zjqVvXG&RHEAy9kySFKvWyp2xWc>}7m+uE(yT?(l|j8 zG6l&W60n6M2&NVx}yAP``k>gxXdu;Lx&%VHsv&Lb?%%$$MBpwQH-5o zijad8JF6@IaH>R-77rD?sm!6>oW(4~H0ZvL{TMl%(dm1eNmg}`z?qFayUD&USwHhs zEzq+7WF@US-~Y@{zIJK`;4wmI=lU!(9;;0+XF5@r@A+p+bNGPfElo+Dh|zzECI6HV zi&0HN+~(f$P>%mOMdu4n#6r9{_W-`A2p!O++)B~vlXG?0aXeERj}=@7czVAfowa5-X?`hSo+dIi?avfLp=92h z`aJhahwY?|6a8~tuiMdt_&QEF`9F?*Jc)a$Cd7DL*iOsH+Ag3%%WW14jpL@j6#V4O zneDUc@~a)QG$u%~Two~()0WPmIhu6)YpPfk~QV1Xpj*%EL_eOJPmwZtcJzlcmp3}ASL|Xje0CB(=O3OH-KXv z^q_S9qbl#&V%{gBZQ!?p92*_i2uZPTDrI z&f?M^-;MFO2u$nTSo*CB(%dt4(l5%&yv$o;XGYa#IaH5YH?1V9r@F{7keAWSn>V@RWn9&huo7w~ZK z9453}c4-uf*EKX{5gK$<5RSltM0ANy_l9ZxQ4?Cbv}Z=4Aozh zn6*(WqQmD0ivWKRDdwFi*i_<`q0D6Jm1}$r^Usl@$aOPWkj{b~@YtMO)zHhQq$k&r zCb&how|lpy%viI$&my2*xL%S`Jhn-~kZra~d6Bq+nqxBsW9A~0BYf^vU{6(*wd6$o zpLCJoiyUOde2RJfU^wkE7vrERc2*tQ2VIk(g*|-Bq6D{6xPeB_$qIUzdAbawLO$$L zNsp`$Geh)rGR662y4N&t=4Ep>9JX<*3!>@qkHH!bZFWYOJ@xrWZJ!*3M69A4%~FZE z{DxyFLfQQwYjwt#VXy1~zfzZb6hea@Z7u_=S|qVB+O^3h7Atj@l6fW2TI_xQ<4704 zIi*soYNnx|nMmXT&=6Iqif6K~dpDudq4{-Rg}J#3TLO}DhW|tgdt|Te@+1teMl#?uF%V_S|9Qk{#g~n$hrUDR^{i0H{ zt8w0vwLF4(iw#t__rw6M=~w>|Ib$demK1}}(q-70%E! z6Xr7k?94?1$!N9Zs6WT{&;k1X87p(+)`lN#^O{$g&n?xyQTX~F*GFRT z^f%qFe8|CT+fi(bTh4~Xc0n$g@wckX)UEb5^Xq!&FCpmYINP043&}wnxFBw`_?}bn z1N2J3bxm!=)nfjtbV^s|mJ=|}7tW>7hWfpWo3<$68lt`~x2QIQiPd|NlMw0{+~l23 zgo4=5jeCyA&xd>apD)@UPz|IonEwX)%>Sz-2n*}~odl_VY=+)``Mri8oYFwD-RA$p z#Or7@QE{Ztu4^zu87r>Q(IN{=G>Vxi;=3K_IdP>5%O8!wC7-(8_@7vJUw9t|tF*Q2 z=Q-}@X^oEaOHVf}@23`QW>hpgPp8d5)P)=ar!BobVerdI&vt6(j>*uM7o%jg`SKoN z4*SE4Q+SNvYiHT*xF@1~piTdTwe#)JyD09!2dqyOql(RcV%;~luW=b6(XQ4PpG99L z09)m1zgmX5hRC*HnS1IkoDAx+H4*_vpB1@hvT$EsXml0*xCN{h#~s1+6Zen~LWa+e zuM$478Xn3ndp-yE=cLZ;j=#=*ge2i`+=` zC!)QZAE+NJ@9$o7k38WM61ep$QF<6J7N=>quP*8Szi;Em8-)c%hd~f8)Z~ojscuQr ztdwgf$s^;YFp%zZgLhx7fWuD+?>F)-qoSQ?bl1fX7kz&w=-e0()gQs7STs!N!lz*S z?0dfTRk>_K80g%>?oLot(%ptKr}K2;@%L?{)o#j6G7<)YF3IaAN zld)3qWm4q{PsXICQhx)yw4Zwcwsoi5QYu2mO2Wm+V8y6fsFdLti)5g3N?Ii=fK>fW z){!|=)&r3^3fO$}1{2O841|B8*gRt@bu~S?T6iO>TB>Q&gEXLC+NX(1YJ$PtcPo7%v#5hc0_%k2utpUNA8OA{iK?b2>83ud-vPQ%xC&-{W1U9? z^K()!NfGZ8MDXwQN#za1H7%fiOqpAiQx1fgC{M@zy&V&r;WA~|LP=HgaUv<5GZ}_K z{Rkk36;Idaud|tuyzRvSa`o(KZT}vtJLJ=F>VeHmVSbfCa_CQDbe;g%EJKjWu=3dDRHG;I zCW$Zwt(Qm}XIhG8qG1w;&=CfP){CO{P>JONdnY63V+tWHgh!DwGX%(wj#z3|3?ByL z=WAwuoSH}%|Mo<=m-os}M5LbCI0nXk>VBT}u#QMx$vnT^5EE|4vwxTPHD7f%Pg^m( zbwa9?$_d{}QKdn}0mT9fxXv);H!bFxe)8@>D zh8`{w9tg1F;s0=grCmA+-WB6&{Q(oTH_T-<56+)qs@J@UaA<$$8 zqMECl&KvzSbI{)QLs@UjfuUuxXBB;!s zxy9T8!1PQb*1Pn-zSyZCa1zQJD=nA3b)1xbONwzUi&DZ@aG@!x#b#HRcyCv_coewF zff-5z2UEL6&n?^-py9}V78c%8da#N$>nR`-j@)EE@Z7PbPXK=q%`*!tz=|(TfqP(d z#bc(g|2Rk0H>y@P#su~c5I=hR54Qm^r2bCglRnR3|4uc3E&{3+vgxfDBIux!yn-h1}QX0$RPPmIW zaa6*^ADU!DYf%)>Y+n7@-bYJC?}VtM78n&$%7n+=$iyo;j*qGNvf_TPeMfcNA#8G* z&iuD091AT1e5!mqxxzquECt;PE?RptHt!7v2Yj|k){5!rOp#ga_YpvpPh=)8U2sSB zC!UE~Lv29~ky)Sw9FYBc-3 zz)!}!-E{5 zaY^}1iNXmyoR~o0!dxe~;?I@l^#nWrGwvunO^3`hJjRcA9MQj*5#8EaUN*5+bS~n8 zE$(W2=fbT6b8H_@`|xT2r|^uam$887y@Yyh@gtLO)ZLhRT%%xL_vTm;J zTfQQ<&T=nje-dF;Byx5g{}L%5sR$FJ$kGaB-Wm005y4g;Wj&wTa-Z6Lb#iTNk0H=l zvIIDC;i-}veEjvYIq_^UFcW=6c})}i^tHG)h21?JJ$$w9N&e}-m-BE0yE)Opnv-E< z&|~Ca#b;zk<%?VK&`c{e;IU|1PNPA_e`1aW`{?_AYMXv|olPl^I9KspJo5cuOPCTt zX%!MKofN3}l&9y{1~5`6)RTn)YmawZ)4#`Z9de2L?^NH9*_%R`#J$Shci3SZ>eF@% zHl>DNh%7&n;Bjs`Q%PtqYh#`TcZea))T#wfvdp6|)+AxVn8>f@c2GkErq31Xd5B00 z?(4!=Jb2SYYSuE--3!^td7de#O-^WNK6YL%sjOOe156XysPa?gD|f4_$bcx{rTbO- z{wS^Fy4u6UtW*}T=V3NA&k~{)F#s+vu!q~pHW|JqswrJdg!LFK5Gw$PmR2+RWy&#Y z8hw5C0bgB~l197SJQO4}>}VVFP%yLGKW~U?yttsXNJ<>k1eqPsvb)LJX^)M&2DpRy zP)kzF_^|tI4K%3M$;0Aa<@7Z?mg!pOqH>je-K&O~^fP5b| zw$p3t<3F688Fiac^5?~?*g!mLXarGY!|Uc|Zf8zNT|Lz0KBSu(4t6}u&GtPp@~!jp zr1D~~Kx|$JFwuR!U5mJ%A$H*6?Ok{s!G7rzWbt>bku80x`JnEnGcvrCGqa;NPNQ!h zET}Zd(C!tKU4g61$JG2u(1=gSBPSReyC#(P^4d73fuccrFy`L^+LC4726yjoUOuV7 zjd$!7Ye-!P!ljE$*e8pF=#f!V-8lMYC1a&r9cBAQ7k66}DR};V(D?>sc1Vc$Z`8{6 zzoORvUw(P4`mz=JfAY&mrpdra=J0rCcpcK$G^6<-oEeY#9tk@!AmIc@dBGp^U^t(e zNA*PE2lzvrpB$rngFg1R=C?GF3TW3ogP^=a7djOmIlmc>?;#lZNWQ=9p40vE91 zqRiqY!8Iei)BHL$sDuYzcKkEP`U@g%aRk5F5nlPT2mN`?T@bzF*i=G>7vVZ_}VPq%5+t2sgnP*b>Z+{ICJ#Gb*UUo%>fXQ1_hrwST@BI2Brxy|p+d<09K0l68`T@o2D4-Q zwfITbwHa>X)g;g#*;4OMWB_(?-9-PgRL8xi@Q9QVz3t1Opr8RFm7H3F8AU?daC)Jn zG&%`XJ9%1n+cV=DBmMTD1d!`WG^6UN#5O>LIBP`~MT=4miNWpI2`SD;76V+fs>e6` zdA@AFGK8+(;NZ1m@P$@Ellg>%oOxOmTfK)QRRPfkpUal?X*dL6x~4nP5CVn#zByJy zM#i<`NVp}eck&eQr5p~V<`3W$I>`>v*nfa6hKW|h-IcP^80@+Ku!}fdlqKJ!I@2wK zrvM|Mq<+$MpblFsVNoIF3zn-a*lu$li(kkb$6M8Svod1H<QmUKkMEi*GJ^8e z`V+ucf-LN7yq_NVbFSneF04*7Vj?J{NGi41W{S`_HCh5L7y>qHY5r+~ZWet7itU%X zQH0{WVLDTj=d_DTiCFPGjd)lUtW@kWAQr?ZcV(uLV|8TD1A~G~ApMJ~x&_cAecm$O zo_jh6O3Zs)c<5KgHToVr91=<*24hxcLx7CZX#zZlrhY*Y@{Y=a2SeqTDd131+HcGv z`iK|et2bjm`vF1`S+dR2(HcBp)%TMHTIQQSJu=Mnnqu`C6^AR1wdu)!T`+KA!~09r z#G5oCnD`I?*Ktp=xXfc?G@=C*vr^T z=PqYFZ-TsmyrO{GW_=8*mPnw50z6h34`N2t zUaf$ynzI zoOksXl)uyDK58y7yq12T?#B`R{U9c0WRfCl%;nZHgHE_}r))BchSo90YfyamCF-J# zN9muG#&$UJ)zr{4<7+G4c){6SL3os=`Jncj+9$8bwm1T%N;PG{eE^^mIE$|a7;%Xo zQisd`U9pXA#EQz$T51r#Ynl@Xr>j8KUzemr>YCK12(3jbr6$EY4g9%M9%!gSQHht= z5;)i72$UP6W8;LlYMt;}_#upCEwe8!mhtO!_C~rN&7Kkw;0+Y1ht-O<7zjbxOZ-J1Bfn8N1q#yvg+Og zcv%paV3CIGW#Nz%fv!terVUMjP=yY~y^n)%u_IF1yYo45eQ3_OSaT9J4Ub9^kj&`L z0#%gxFvIBu>Z3I4m3ulN@!nzD{Ta*Q6>1H}SCaP^7UvYL&q%(0f8b2(m*BaX*&tEX zZ73aCWNslx8zh$E@48{33@uwSJ!%A?->K@sfmt^>#5*#bL{j~bEHush zRAj#hTB6Zr)zj*9+^mMOiy5Bk-^}0JS@?p#`6eiFa8KSI&9QzfT;D8lEn-EEgu9!+ zYq;?Uf@ycJ3^PQxq*l9Mdn`UXCVWKzFogsTi%I@)3MmPZb(BK)I_1muFVG;S#Mo!6 zAjo29bdf4#*m#H8m1M1`ieC#2Y9GFc+mSX|e$~5ATVke&F_q;d)Cun6^uCv{OJf9P~ooZ&FeD>ine+ZV*qx4-*riRAU8wu zPS@|E9W&hhFlw1u`oVazE<-EkPsr$<73E}_8AlDQt_nxr4A)d*1}2F*bU?_?c@*Kp zVuJ*m{}HsCme))ZUly4K5HO<2l`|pBklBp5wHiPu{&e@DPTRF9DKz4wlEBxzZU|Oz zG8tMsdd#vW$Amw3FWnndPbBJKzG#W>0BWc%9XsRYY-SSdMCrPam<&{HDQRA}8i&F@ zSeMZ{bqP7`?81i-^CzsK_u{PjI`H_rOblW8jL8~v5E*+J^9i#^Wr9bSk_~E&=tlwK z4hNpSF;EmxS>-`ID{qofo+#*z3pPf>0WzpPLZc1j;t`jv{_*8~hMIwI=$V=lH>Tl& zzp`poS9(_QZ0l4wyxnCRtK#x~GKP9llLk2R-3URKq4uRs5bF|+>RQz`RZ{W_h7)|I zh@i+gQEYb=%!rNPcqe>fv0>2r)?$}C#^L%ixC|aRge7=Bz9->biN$+r%Z6=s@kgg? z9jHlryq7Mr2iTp$Y5-CNQo(6wWtWxmyTHr@$FhWi1M9OGj>?yPT``w)1t>u+AbMt@ zUJbd1W4>34@fRo(rWz-di>QMUGH?;Ciix&J7J9bjiZcvmxwul~qMP=&1EPV@^trV5 zL~8l0yVv_g=#!3c{d=+bI*X?Rm`> zC>`5Z;f0hSqA6%wwbx2pH3yb3kW5EfkLd~0uVh@Ag=#nT#R;a?4M7hAp*@wA%L?|f zw@CV(g7K3~T31+T=$`H$CN${F2aME+%mx$mZHN_!qI-q`r-_#eNrxVvog~DqA1q;P z63$Pp!$T2(ogcJFhk`67?;o$%o!bZZq`9Pv6x@s&A8LzauOywr#um)W0K6#9rsDi~lO`@+LDPXFl(I#u)88pX*!pof5u$ z!@_R()lVB|;O~(*8Je2PeHw#&kH1HM|K(T{3drFg5xc>gOG&qm39|~a!4+R?9P~FH zg`86-CpSt+&?zE4q>XseX?SWgwti+hv_(s6QrYDDX|B%{j7>QR|(^d<0z6H9yUP$V)IdpqVv_e zE?YfE$Ke0A*na;GSJMb#`UvE#Ul`|r$>-6=XhoeTM8y>bYo*oJ&>=;pyf7DQfV zocO}ms~0pGmVjUqI`~s__`qg>scb?tCKi0=CeKf}j>cJe9Ftb8!Pt5!* z>-^BiO7K(hI2Ii?N0Hr#6cMMV)|3NJY`T!(e0%T85acciN9&Ce!;QE)E{6*DPW=?7BU1TCI#rIoM$YaF51}>Z7{#ps7z3VQB|4Qxba8h zHHYLAXYnq@c=rUyOhtNIH^7x8HjzzSaIHkN97hUbE!Jr0A30K3S%xbocon1By0W+8 zUp(oSf=l`F_7Ud|;~rRM72_5>0^Zg{?6UW$8KadTd6o+EuSmHR$ROGd1C@5k5)+wr znOMAyT^qyb=BOhCv$xRMNDTk(`Qe-Yapvdw?%>NWR1xY_Y4os3X!Y zvQ3L9I?nq5Dknueapt3JnL@=i|%Psv(tt=AyS=5WlvV^Yyv~$YEAn%GvaqVmP2}43+0$Cf}#)Z zPr^fGi7F`Xcb`x|)I7Zu6_ld%0Z>?57zD?^+Eedmqa4X~e>4vJ-OsbC9>c)*e~R-^ zR^W*ij=VOLcot2P$9l6>?;NEjm-dN`Gkwj9_au6|0%r6ar2>xYXu!2ZE*+ zH36cSZail!5b{Kh4&mF{IXPAj9#*%Q{&Re zh&w4y6`dDQaa`4afwmgIjY=DlqD;+t4O_Ly=Bmq$+ov9oCfmnFtA-r@RWuLwQM(tn z8d^4LEC{HG(t+-@t5SYsK_U6ptP8@|cy$UVRcpQ(-q(uAT;j5hRZ-emNhGf76?~p( zFS^3Ls=OqD*0oOYJSs_EzEe4i?A4M_5^&H)vb*XHG*o6yvDw>BN!mCSaz{mbb6;Z~ zZ&QcIwL2CfOsalNj-ijcNkRHkF{phs8|qH0(v}TM(hAax@-fwl2`q zmMY{Tmrm31QX(AOL-1YdQ6bQD?P=FDb|us?QBlv)_fHhVDk^2@l@lvF>K_HOX_{3< zYio@v$~hf|-lKAnn-GM-sBdl!%(2m&cA2g;_DQ%zNAhNePU=ooH9v%IUZlJVrST-zL?$Xh^)GhxUN7wOOcwMCkdEq*w z8QblSH9u5?#3SuecN$<=o(XI%+@E!zbNr0+85SM~nFOJ{Z^3hQG`X4@%z?qoQrn_k zFe%TtM%Sr$#JFx>NFzvSrZx`iZRW|t=ZNj}|CV@mjGwATWO;c-++Bq5h&2D@;eMFK z_!c!*t%pRx+)|DrohjQY`!i{O7)G^QxAou{=W1b!qhG%niYMO8cF% zXV2UsXIf@4(~s;?CPxKdQ?W+oIC%x59Xu%thDAIGI#HJ)jug5#Dr!nCC>^M0tpUnr zdcZM!E!V|njrB4iGoAq)v8b=8=1YoD2b(godoB|@t?2R7CUI%h(ibNp7GRe>c&r&` z%Zt$R4ea>~d+>jY zP5<4cK8;bFTo5UQ{&jlqGC0L7}mGWTo( z2-as*ha@sJAeg`0KQ9U{uUuWQuf615oz!xD&nr~zchJ3!?{Bt_h*l7cWB`c}rB($P z8=8RQI~wf`l@6Hskk41KST*vQA8Q49E6*p};Ia5VLlTsGi=hw!eP}-N_+08%Me^~%t$8_PY?>niN6N2=XoG!P7 zx6tN?fmI|ZQib$2vh{jCDM~R0k?AGHXqLj(aMu5x6i3f%Sn!g$@1Bh|1b1+PQv%(N{P;jBw z`K*l~zY*n*vP|F-s81w}Ta0UqW`TF$5rG>eFKT@%?$D zvjsXQW!xjpk5yhY;c`qCMyTigDUwh~f;?N6+*~jgxYfN!GM}=Z_4N``U{0Z3Xk#wt7p{g9eE81IqLDYM-+aiXe4DI}hxx30`=(?;ePDMV<2y@cduwvu5txwUaAnG6f!43)=U9L@>UG!D#-V;4t( zcC_v1bM?Cyqq}<=83eDEJ4MhoSH83SJ%n~9)-k4%Xdg0_`UB}VeD1z~RNDT?rYQO7 zx>qT|X-pwJ^vPt;Dd9qSO+}hwp@LkMA0fh7dbCT;BLYwDw1SD^;u>E!%qb|sij63( z1QHWWhDz{K2uibzUm_4+-tdw2rJ8;Tw=N;A|h zk41KP3CAM8(*7F=Apw(mOI(lQdHfD1j(O`Nx)@3Ox(gzC5&T=R8_}ewEE`#OyL$#~ zCv2c;TB##k@%j-~JUw)NdC#d35deqRH*2Lb>f9D^K6oj(9xtXWY803V`PM(3?BDe_nqy zxD>(LSzX(e{q|Mjg9-=%ga8bx(~~B+h`YKE0&b*(0e(%1MyE!pOUtwefUdPnk3t_g zOm!!fEG0&p4?H#;2T97L8M=0V#X&wr(<&J&=xM1YF5BNOeEM1tY5$%Tw2M0k>D=62 zSxP%PHJDU?7{Ar?Gdskiy>9uoF8{H@BNbuRIbqg2>KgeCLkK`!0fI$uC;Zgm7^}R5 zbkSOlra@fvraBzS5zh8{xU%=ZfRRB9+G1ByB|d~J0Ug0Az~ z2eR?%A`w;(VKKp_<2+Jb6knB(iJC6)q4$(nJ*xwr8v6eBEqs3ZoufahzCWyUZ`%sh z+fR%Y=v{v*tKbvlsII36@APjU!wtBMh7Y7CPfh~fS)D{owTFn>dKoA9KUQaxk!p+7 zQpt~2AAY67&~}tnH-*`Vz6IVx0^bCZht2J|Dp0 z!;xedsu_Vt5=I-;*+G8jX=qIMb%lniPjAZAEMDQ-@^IsKIo^({=3B2F2HwYbKKgA# zAS4}BdxT9$tYYi4Cd!)^t4@{u=mVYz@|WO9dQetn^8}4w{y}F5si8k%l8K?R9V&ya z=<{z!8#-C?1wR_(hbib-yIxj7jClwC#2h=b+HS(VROsOrzWet>;d6-^>7O7Qn!joQ;=WkE zH(Te{fA6LLKsR#iHU9rOm7U?g8t*YPF#nJ7-j&wW^u-UFYewl6tl(S^9nqb!w^6|D z%DbbFc7O1?M5i&+<13z0vcQpdrqKuqxJ48Pp$sgvi|%q|aauy^{*OcfHwZ@k;5+0!Xh z=CC{hr2%M7VNB|6sRNN*w6fc|J-I{(ZeW z%u@fIDa+Gd%t{aHL9a^AiP%7n@#2~RS^vJcu+O=Fd-12@&)D-d$-zC?d$9{_PDxkT zyU`2vMd0sZzDSTT7?5DR8Ci5YT{pVwXttsK_0VipY3q=qW{AT!8PviLV?+{H}W+xRmd#blfPehs)BcjsxK7t{i-VffG^6(RgLYX)|DeDf-J9gE?rIr&l>kHYHsP=9HpQ+I=M zEIQ}$oQej$o+Uo(2cheg!(`S3B{eJtzC9rDW)MlcXhAxP7&FUc{&n%C5_Wp3XczZ$ zB;#}pM!U@_BmL6S2v6j$-y8}1rh~-=7jNgpW2LN(X8unr(lAERAwoWQLhjz~&DfKd z@YvR&VOD|8ujC^CFbMNF7*;Bz8E}Zd15qdV(TSztZN`0^Ji9*8c!#Xg&2`|P)b6*K zpwm^WZdeGv?<^cdu+U9|T9g#{?RrVq#e=s-6%cJ`y^P(__v10T7)_1NDahNb7W^{I zlHm2i6{g*;)eC?`Ojg7KklzJaghVq&?s-}8FeSU$2)Q`f9vCAq+xB$ z3VcGK?JzNzgoobom1l?Z_M>AL`%1!+H|a70Igw`Eh#Pl9&hDgxTv>%CxM*VJb1Ck~ zz|5_bue(NV=YO3NGC^)3j4|}GgDM|MT=?v;30Q)&M=9-9Kc&;=+ZE%7S-C1c(!%1; z4Ft#lGePDXplf~56P>D%0*52zY%L#EHI(8uJ3|iPf`yx6P8^~{o!Ggh%>%sXaZ}}G z-}gtnk-)6^ZlF_?vyF9uKn9VJX$Rw(ZkvTX?AWF z{D;rOPW6jNgCs63F9p?p75@#Fcc=q&B0E9uada^i`nouQ+67X1_>u(@dk-ujN(7(S zHcNxGZ=8?I%&R3lI}3$5B#rW*M5kkKi{GPaZI#y;8a^<}klQz`g1~Tg33&-z0|TYS zSqN9N4U)?#TzS^9Y|qGsg!j^KX7h$u{TllW9R#bLD0%CQdExm6vzpij2|hJp#2ArsFe%1_mbW+j>cM zNvXGe3GFoe23Y2PsYmb=*YXk@POSK8>(Qn|7WdvLQHwGs!8KE4K`KaC*M8yROe;~- zIhlSMOIl2f7NW`gRo&KiJj!%k;p4Q4hu|}b+ZrfG_DnSJj`Y+!&MNNFae+ATww>i7 z^MTs=%lfMAuatQo^zScMyd=}jWRt2t^M>4UMzb=zZyMZ+5)Pxr6L~NOv!0Jnem1jvvGJSfp+nYJUAk~W}-aCc8WB~v0?2;?V>npp?I$x0SRt^ zdZ3&ha&k~W(J-?Xw0w3l6E5;)97KvP8rRk9NK|RkAAb5_&WsNdaS6pwY6DlW@-Tx| zDH3m*Rz@%?#q{MLJN$jJJsE;j&+B@J3DvCA6XrIPbGp!i#`{tc1J8>FZql(&xt_tu zS79+?0!b~mlR zBBhK_?KT=fV?O`BkA5lrBTnxMXehowiR$-QeM0kH7$={P>f=P3fE-|ZmkOqCK@ z4`OkxAF=uRR<(O|iClU|P}8GrvBIOd4q8L=-M}cc-o=IQ@p{9i4l<>aCTJnVHi5RR z(5AgO@cL3+w6KFFz4TfY4>Lrfh&R zg4c)?mzS}u2zcq!>Dl?aXmpOl?+43_1F<#x&9*wH&X{uWrwsem(b|4QHCr)=wz}>O z3Gmb92RdyC_e`B`K83!S?AdaX40BdJ~Uw#Xg|KkXc$X z1UFjrQ`%;h))9;9okEphLJff#VDlA;hd~4DaehJ|3+)LZx-DDZfRv1|-i>v$Ontn2 zs2*WuW-Zc*=Z|D=?Sm)jUFmRAEtk5|&bpg9 zY`u9SPpTeziQ(nzl{H6DNO1A{ghVQKwz+P+Tl}b9GX%^Fr{)OxT5gw`Hn9xE9v!%G zb|}_DeW`axipYK+moJ5*$EWa5u_-zGS^aO4SWM0h?8hXx=p`1}yiamG^sjf==xv*p zc~}D28m$^xJrbKbqZ*E!-)rCB%F$iqM5xxC^uI$F$zZnVy*!ZPY^pGlE85^+1(oWp z8$UXmPwMp#js<&k|Fsg!Mqb|VOg*i@?uD4KolC3*1p zkqkf;jFvKQ&M#aAU7}?!S!+v{>$uAN8{+Lt=5_pspYn%UyV9O^wxVyG0hci<1*$ZJ zKgHn64KI$g7*`g}wM^H5Z;wgE*xa3uAs&@o?3;A^NC5{T#7^H>#j1K$xO)=9!@cdL6r^ zkVUGr2A%C81+lv)&3UxTV(nZ^T{*Gi1XjTm^^V&M8-MA&n`(u;;tcIQW04ZUy#aNh zzRfEI0>!&Vpr`{k9enXmk44RI)&Ky!isVI82*XUW>hozqjq@Dd=((Y;K`-)pLZ_Oh zx^3a}vaO8-YbrU6{B4LY3wIs+hIIM$G-)nQu+nx*%cB@zA>#4Dq{_ajP{)~z5QiuV zjAwTWc7fWg$~NwcB>JX=A?`2qYC& zCmi6ViAKBq;!9~d46-26Y~ijP$|}XNp1yh_C-R1iTKbYo-eL5iDX~T2-66n87jFKz46H0@u!-tFS(tPp9ZX)=9GpB zua8zK!j)OYe$iBAV0t(2w}XPKMzw6}2X>NAdqqv`d$~#*KT0RllZQ*w*wcWzl5bh` z1M3393^(8M^NS;I&ALvW-48zA)92(mIqtZ-O}m>1hxnoz-aSt?mhHHKZw-bm)Rz6S zd40WVllKNre0Jk2=bH-vRJrh4@N%nN3Y&K^ zu%Bebc@+Q1bdxTsy<3yLXsLg23G}86kZv#ITPcpg_tq1>-QVu0>*F8IbZiL*^l{?5$g0*}>CLZ7;`c~MI`vG;gy!jJFn zu4M44K$a9oHEAU5)RrSAkrk&uGbC8`(M_KPz3y=7Sn)N-S>By_+4sz&@NS`r}<+k!PZ{ZRN@w=%k^R<=yPzq_nG>V~B;pJA$iFy&j?R zhT4_vnp~+^#{+(zzjA`+yHR3f=mTCxqf}(Kse)lSZkc6jp~gi)=;Cr~N~LxOl$^l2 zs<}f0^Taw137JfjI>F%IA6k~ZTUEH1Q_JE!CrCz5o)>|q5l1tJ+R&?ap;ciHJ;=r2 zPD1VvYHZEBXwyV!K33ICl@@&D^aaW28}OC3R9wdOl3|HKo~Kn`Lju3|`X9UH%Lkqmusk=BV% zUcOkx1CZ@53rws&m_eGBM(l`^uUe(sNBoK`c!wcm%QI!5F+$3|LC2HvrN$|w7=U7(h!voQBL z9;X5eel{grKq^S=PZJg#s~WF@mQFwSJ?P6$$Xd`ZdHbIrYFnWWgn)_E=8tzoq(s2E zgJZ=*{qP3nHq!lHz?{QsWq={q>me0vSGScZtO;g^Ix z5L_&w`4IH^Xmz^Z_Aezt)7gBiGw}I`JZ@_&1Z(e+&{+tWe`Dt1&JUOrGuBbd!jM)| zQx#ZE!B@iyp&f{}0;T7=MJbra5)2|Cx?-mM2T#YR&CZ38y#Yft-MnCXJfh9>)+v7I zSnc);aI(sZs-F0f%nhuER<~cY1I@@4&8-BOHP1{;?(+yUq03)7;2}0XsYBYH$~Rz< z>mTFibYVjwN>#?hq9idpTY4#{^H5`?D2lLRbk$&pNcgTyhq>{IPBNG=l=V3_;jF$@zQS{hU)XCAl!YdRag zU$oNT@uafeAxr5DNSL?*L8o9v_LM$M1;TTAgXJr8eiTnn1L>=mEp5~q9PVf%;w**4 zlNXr28==$`k77jQYeAgB(?MTEh+9zD73;)~5qo*?1=7g7Z6=UFc{Jw`XRS$|EnABe zIyWe+pwiZ|JZ^afZf%2dEBb-nEY9B|%NFpP%jBMiQT9Cb@$BlM*M`h!76bmi<meu{Aeb-4ggIf?>ku{@0YWz$ zuEc++@uh`ZgtBq<42PBtk`!K%YWL87ZTN?ErQ0-(Aw>s?7xb4hiWQ}x%^||AIh4)o ziA5X)1-IhJTkn;Jn(uWSJ1p*9nFwyu{g%U!#@=43VNM&)^U=Eu*C$!vq1(P$QcL(0Nq-rWN-At3Qn@^F?1A)> zc(P!thMpq+%IUeXil6+Z5oN$BqakTNd=gQyfqKv9tHl@fkd>OXm#>o_`>}>;^d-ypXEylu&)U1dcwk|8MS{>4oV|$r_Y1Kud|I^;_z!?x?T|8h zt{^F{xO7kT8ItgMe`^&mk``8E0Y#<;j^&n9q%bj$5qM+@WrsS5+1)Nd3_To0krp;8 z@jQ$l;%Nl|Mfqt6raSlK7a=1Pj`;LDPIYg`r(>Smr^S8w57Qa%$9Uc#7YtUUMcP^G zt#|>X&CO+HQZto~`olb1AGZ%#l9 z(>BYwSI`*1)#(#1FzYd&Koc0x7&3TFMs77^ zZmPs|vlFA{+v(sl#H#A~zJi5;30xaNXT_nC2D-$u#r(pJxRV1TFkbOz%9B-|hLWcO zV((Ow20~V~2j>Hka-|xB!%OCO}QNz0+of0hKZ%XTG@( z>|4at93t7na~VZZf&I^jpog*o6&y$J%i_T`u* z7Qd2bpp|j$9y3RP7e45e&F~EE7x{5+8P(znhExaM%?t(;o(3yB6s@=&J@FF`qvL?! zFGn{M$)nzxvcv32mJ}f++G43<(?wv0?2B)1M>9w_^e2)&YccJD5g3YbGJhg$s3*D z`^~shVm{8YN3XQQk~wx3vaO!Nu+!dIqE>t!u1?PPm+&59!HMrB7ZNNH`%A^9dloiz zfGMj0_?o7#I9*x}V>o>82vZAhcXC*g`?Z#%I^KZ~3Iw5}JKoEC&~MD?d8qf;Djr$& zf*kxz;g0WTrI!=Cr=aYglll9wtxyOQp?D2o)pXm2lO_=~M*$c{rO}u-W&bR(BHHYSm>AwN>cJdWM!hRn{ znXez0oUEyjwGN>Pt~IL{%Gdq4T{x>W?*@>x`FFMPH^AHhpm{8B45Q3a&c8?@s-H8{0=rfBecysMRGbYmRQ^&a2x% zz^6%fb}Q8po=9#zGzb|;HgNj^*9w11AOSE8U6*oy6D~D$Jt`G(Ie)Tf+CUxs`=xm` zFigP{=HOJ{)`p02V*dDnKlsKu(iJ*z%kL?C@?QjywGn(^hx{#PL10%0OE!Zc;QO~SfFHB@TC1?*HDJF8{nPij zTZ-nzlr!IB>n6J`j{emggVptTEjRHr2EWQj^gD7V0e0hnrE=39#nOdh`&OE(bMEyE zH1ZDtd05X94hZtj$Zc~F|0n+6DjJ1$jzGFU6jkt~uKMCxx%Pp42L7ywqI;WjcUVu{ zbpLK?AY`sa4sK|kLuWt-}E$@rU15MX~0K+G)veAU&R6GRQl=-vhqDcg9Er|J#qre+O4) z;o$tgTQ*le5^B;Gq^=K|dkE^G-Hcz@E)4oGvofwbumt7xOfGfs^Fuv$OqisBlf@Ms zCKli%u#WW+Lu8l}k-?XHsleb!-+jA>yOjhK{FD5lAvXgL3&&q8D|;P1nZSdm!J&ID zc=Y;WWSc;azi2{NMtXFE+PA8)`@Nck=-w^&|Fi}`-k9{0WAWE;xwh#RCETU1uIcf9 z)lQxnUGj&TwFLnB>e$$J{(4Lg9Eik?yx*qXYRosjm&b!+KT=xJ-z9oVY&op*!fC1C zqHlv+{81$JY5K8HCuTjjmb_3e{8*^Fek{~IdcK&A(3eis45=Ju)w_ECDJa`(^)r{g z;Mrg9=pq~??exGF-X~&xYaJenA$9-bF}M1|O!fYqyO%ok)%mkXreg`Rlj z*0VuZn~NburxP)_z`-FHXwLMp!faah-dUVybbUn6_~-E4jkMA#j%k7@v#bA#m}Y3Q z3I&^pM?^VUGg14D`xI>eJ}*r;`0H6Ft{I`_&n!OKZXLNy|BGhJ7mtT#)byI9j$tDo zNexnKv*3I?*>7>@aE@=+pdh7S+CnI%+4gQc08Ysqdk4^dB*a8Q@3*upYrH({myZ5aY?VRjAiEh5 zMl(2FD=fswI_uit^)7vadEsI%Dy{W>Z-zLPR(mH&MXkgGZiuPj7<+5v5_@)oi+?~n zt#f99y)TLr_0{A3 zL_pdy8={2?g(|-x{BVz?2rd^Ih$-BW!GV`<=|$c<%0}PzFUl$+Y#W-6V8MoHqE*4z z7rBU_r4&*2(@@_}m>R!^ph)xa;Rc3&7YaZ>`l9SZAo5~lXe#-ZU8Pd!VFC69A(dYw zU~)oufBQ=SA|WenCJvGd^}+1HdC8w|$9`#d`him04bm$aoY_dxgJa()&!*54VZaKw zom^Igq*8ARMzg*B;y_q+dR-`nr(j441b0AHxjxdtYV9tU|Hdm*o$pkH*Q#K5$Yz`l zcbRm$EVFPS_m98pKLN3~3m!88H61 zkr(5hq>?n9Ig~TwZ@QKFL-5N=!-*H?Ic?x8XUL7 z*w|O=S=0YMtg*DH62B24V5#mbaM%T0)H%DAq;X9PN4eZf@^--0-=1hyyGG64BAOOW z>1uTo%@Uzh7iEwwj}y*deiy35yZtdS2-l&r0OsRg4%=HQ2#k7c5nlN7AiKo6&V^+Z&*j z+zwgTA91n@`$c%|rI)+rw!iKjLy})Utme(X8hXmOR^oi&R7o3@CwxDM!aaFy&Im3%KA91Ue#3mrOd zt9@me0Gy{~yw*GqG{CBU5++Ai*ksyg7-%>l3@!g*Ejs6biZ9Gu5<*F)I~ z^vD0Q9bDi(sEXCcD*nYCo^(v%2*bv0B+ z#>0&~-o0YH`?xCRu4^{Y7zt}ri%&mV8mG@G4BxJCKD=A6jfdZ@h@G2#hj*ayw-^fZWzp3 z1~s4WpbPDd5kAKOCie`j=Dz+E3Wka>l2EOD^P>?5MqXC6za7z8#JJdJ&WA;$?3Aip4vux z!s|ODFoaJE{~fwVh z(eyVk0S}Dr#HCA9(OMRK)u+oe)<;P7x(@q2FvPGoBGap3njFzOkvkh^8x~&PWYwgz zTL12mz}K9FA)$iGA&J^6t;-+f7hE?Oou&REJ-#0g#&EU2G4<&kr>Cg1aaOR4&mBXp%3dm{ef~XO zi*uJYJDj^~R{xNCX1V@7V{&RZ2czgh$?rl7!=7!|<9MvV;Pyf6c<6(b6 zaB{YzP%f87BQf)O=7?L>J@T9ACs@k7t#F}#w$ofw#1|OJ1C_b|&=i?{>X^#yTdpe% z85Ubx`_$P3Pv9@xB-bwAyBuV~8HwIozV<|Q`)C|8vPU(x328h>a@t=xO*jJ3lynXW43|DCpa zi!;9Z1=daikvE8sjQvaGxf5NSkYk~>z0#Kj2wuy)4sQY);o2TS)EIg7CfF5f?N6(c zJ*~AmM5p@N`pTdK2B6Fte>B))?*-1Q#2+dn-hE>a`{Ya)|CotunRD zO%6sLd!e6QOgCp8_tjP?WD7vTDb0+u&~S^Mzvoll*=P_Gm0@@S*{q1Q&Vev!wf=P0 zxXamFU>aN*QlhZ)V*3c9%){V%R1S#>^8qW{h_aNCl*195Kk?;hQYfwhe|OE+Kfx_i z8L;%aVQuj|z_au+qz9VIG39>xZhn8ae({U$GoEjCE^^!R7SrGO4=84c~$4wwb;~F6=fXhoNJ}nGrDx*G|1?Jpk_v`QtmzxMsP}WcRP5zI_3cH|H(Det9^%poR|h9b99h z#;fG2GKim_#}ZABeaCRv^}6D|i9be^pWD7rubVx7t;|(Ci#X`{QHX`H$f^?t#iSQU>O8j-=~2`aN{idWpjPU1YWD1v*sJ$X&;{ z%?965iv19FWk&6GfDounz*z@JAK_t#%j45w?uuwr& z5fak0Au)?t+8Gl(TVTN5sf)*-5S%VKn3e{`LQ^6x4-Y=LQ)EZUgCG3C(I;sI0@)_r z+-nC>)wA1pTsUal9W(!#?0^#>5>&a*wulopgcA%WO`rey%b}#ax@9kSN%tkZ$>F%R zwa*uMDhb*=q2=|>U6F}v|fb0P3E^ng1tLx3o!r!);}r~*a5cI_JS07;hZ#EI8cgjE;2 zg>g#Fcj$dbtPvGxbBZEt*b4-T!A5^qNebVJ-evJZXwJ`aqe7@v#9pyHPdt47Laj`T zoBe{(izStiY^k>J_Amn2VS8(kd1#@yC8NyABD`0tpby5@_f*H6D7GK*s~?oeM z^dP@-)KdG;guzpGlGu5T2(_^Crtj6kdwrwZkU0?|aNwIjl<~x+C3_Rn z2W-)z&i=4KXKA`*EYF##umhh-+pMc)Q^u5jNb9pB?&+C|ls%3py|51s-RIunT0Gr+ zr&V$i3zfs@A06Rx*Gsc?S&2;JEIp*#b@LU#JOIvq5n!Up62E?37mjw2N3ISKj7V+gWh!m5l4xH6f1~TGu{iDUN=R3!vJT? zApR=7h2r*@aa*;3UwupdvM}lM0-2RbSD9i~VQIp2CWR_o;6p@HF); zKAP53;r0TGvRmcXB5<=n;0o|YwGoW9R)9Y0zx9<+w9)%sZjcuHg)$I_?nr-9hHR4F z*%&#IUYuc~3Cp8rcJ=eU1?h45a-FJXCyToFhnhCCierk6Ki>Vz8`VUKD|d2<_B_!> zW8L$r5z0K>bj&Bpe98LK75lJ#SpljR%Ss}FROwTVbtcd3K0^%aA`H|vS<)`Mu<$R1 z*f`y%ZZN`Q7)`hxKN8{hm60u`yUvNOvCi-jm*O9i21VK@-eEWhQA4!sSzV=M4hUnP ziSrO1y{+mGnQ*n#L_osHPNVVDCC~ji@2KA)sC&=OMH%wI z5J4F5$|xp6X_G+_`j%LG4Vm-jAh0xF#Kzs!H zvPhlmCoV;Ls>MUR0Fr(MyQLt%AZHSUJ&&fzo-bJeSulKE7A`5C$;Ehv#2CGsuv1&@ z9-MHLdf%TnKNSy6SBz9azn@uihB2{6hMi}e^>>+gqOOpMXji;Y?x_+%wV(Ycb#HcG zq5`N+VwF7Dz1u=7+jL10XVaa<(CHUORKWTu=}nx%$GbW2j)5bEG#AOA z&_q}_-J(<*Z~%vq)^VX2gJDfAzr^G93{1z=TNW|y!EgiaMLnig42=V< zc8K!%mfZ}&4Gn&9D#H2fm-m$BQl%PIbq+xhBacQq2Hx_RyQu?DO>im7B*t{?Tz ztCJS4UaDE}h*2$`ta8_V%Qo=)Fv2F?jXKG&Zat()EL$qEJ`*-Ibiu*#Y+ZaNO-~RCL#UJNMKGU1;t^ z{iU`l|5=Y7%ZPz)DIS8CDHpVLJ0;M2?6l`4XXzp6az6QTfdRHvNIL<`xqaNUdVtoN zL*5^>z~RJi2*|HNq`-zfSZw}#!r00^7Z&L1^2IE9!2YUeo+35)C{ zsWQ1}@K&ly%YNCmF4JD$MLl^QXU}k3_*`yMH_eq@w4!^t)tPD!WCQpFx8L%$Gaq0( zMlB&d|K4j7=gwX`WkVw=%+#=Y&dZjP$0vBZs&BvPq;~lKd3wq{e#b5p7}b{gE_>Za ziu?X^V49|5GynYfS(Ws8--yv#iG)2)N@*U%)IYm-z*AFs7u}W{C*xXiLlr9iXS7`- zAN$B;LECcvX@-oQzVrLcMXPuw7p*(;eoKSg;s0UmoVEl3v?QChot3t2+qP}nwr$(C zZQHhORZiWRm!7rmLw`n`vttLsX0=(72qvJX?*2?lQrKuiwcUCI%0&~iGvK2`7&L96 z)7e|9sr_GQ;$V==RoWhB&tuV8;}He)M8w1}|GIELzDI3(V~#50hqS@nQ7_gh8{|{Ta;W0DnTk4<+j+M z7%ynEG{1pRI;_xzj;gfOyqmru z>hfBa+!?KLo>&306A+uVGI=hyTCw%fhhPfxLlG$46*{%cAvks-Wv$`QH%%H2{hn+- zW1i4EudacLxjo{6p{aZH5IB`IK)H0XFl?@GJmv7|asC@Ms0JDbcOQaN%Mg{`mr$#9 zvR=VQktje?=O}QySV;(y9|IwP~#susu_FG&YwUd7pki;ZI7A@nEUJ#t<03ah5&j> zLqH>-X$=OPrm*+iA-YWvn4IT6Mxj>>g*dWK#U|=sL|orMPBBu|q}?OhG}J8;qg4|$ z)zMAxLI4noWHp#4V)PfPz!;1^f;g0%L_Pfe=j2e*S|~RI@h74E*oZ+k>e8Fz{sYnj z{=Nr;u;jz!i;Likjc^;2tp};z#$~|Z3(6|9q0ckHE~QCXGgLD=r&bUOt>mF!@Z{QT z-?_4rh~FzQ_#kUp44_}>1$5xzR?RWBi}3(x^xBEm*ruKN6Sj*CCL@zVP!1G}7K%mQ zTT0(OtVlWq(Hp*yU{4MgI?^C|_bul{@9P4Or39U%%%NdBo&2YyL&u6H-bx!YWr=&~N}b?cdX zc3u2>lpX3-aQVJ#Ph|CWFJtxa5M;%ALAAv=?0-diGfhnCvNZx1r*-pBVU){tw^v=P z-J&+(p0|CjStauu-@YlZov;kT{lYpVg~(c@bltbyP%^GWN^Hy;4OW(}{|QA1<`aF9$r5A#lBtmq{&; z;?Bvh-hokJy_A`;l@&5c4C<(Gt|;efId1MfNNX>K(Xozr<5Ing2(v^HM$`(@Qp*X` zE=zqKu7c?O*cpf~w~{w&&2Uv8k z1pLEPO90DSa#GIHb|2_m5u&324H9EscaD-h8ESJKsvag|+uEYG0SP6`Nz#eP7hkC9 z4aI+(psxNP7%{Z@w6eFCEO6a#WB65hvL&UoseXj;k!~9{{{k?in|NW`A55{ASrHZu z0OQMSVLpVFn!AldwW5_bKn?Cs!>r;X(;ny!1NAiP8n1i%Qwq`wT$TZ`3y<}d1)z~0 zS+hPEMfJ!vIxTN)2n86eI>ldm!{RpvNHBV5)#$T&%>J^nRwlkA+Aae+c1(!P{q=VH z#&GsQf^U*egeoSXEH+vv8k=(-BWsiKIc&{{xg~Gag&1Efq`n+6cDbP$7bB0eM5j*^hV1KF!RTXqlscqp(HL5`GZ3q)MqbLI;Mt%tZhl-1rm zO_)7ocL`vz+_e``X8lV{soMb#>xe3;h~GrXfFaFYKU!#FjP;brfQ_5C7sfU~y@>sg(Ul7X>utDy&ZZ4*P7YjA+T=unpDA7!hOMmIKA-7ZaI8F< z!v&n7zNoo`P$7%LVXeI@o5?AdRI19@#vDz|q_E4VdM=-wXc+V{&JqxzDG1zN#3GZAX z^i9k&e8*$v<*!(SYE6>(DgglPf}C-~of-@Lm)?hXo{g*$-s@;Vqt8;pScDC)7dzCd z6h0Lgl1(CE3Y{N>H{+1I`O^vsxB!Y;5KqoM-81-U|7dd%vQkw0B`jcgCj%!(`-uDq zu>aE2^e8MELhrl-%Zvamkh{EJ@qh>JARPZvHb&&bq{f+Q8O1xG4_+eaEehFjxT#qd zWLcgx(78E(ol|N%K`D(Q9M$$nCsE`z2SBxp;aKd?w!P3*>6gXi-` zBgoLIM|m|FVr%;W_j-yQ=W7Ox<4+G`-5fmDJ-c@tuM9`43AYwr$S9ZRC38Pu;r`fU z$j>^RFY@`GqbbMni8i+~AAdAqhJrM=n)9KADTG#f2DegZ)8Z*1vCm|D8Q=(76f4Fq zXc!O)1wL`?KvKli_RWReqr1t(^18lVJSv- zgMuAjBqxRi8p#Y`(dLV>s7s0~jQiLhEhg^Uotm)-l6MK*D4oGD696Zn6YYvxFSD{@ zyW;Fi*bcL4io)~jB@Muu5<`(ts**y*^fF(pAE?l9QOem;ql5qnX_@?eh$X_d2dl&K zPKz)rHuSl^*PE!D6ivFpcbQBd2#d$hDhV4v;QZ-d&BqTSzkJjY+&W7P;74Iks}(9w zIPSMwi_8w>zpAW9^6ylxO?pP#hcAe3Jy(#Co>nJ?j|}kMdQoD0$xJDmi`z<5fAGeb z(OaZ*N71tm8eM1bT(U6{R}CUoWy0;#Ql{^maMXMkG;b@U57QW%WX#`5h^l9>hUguT z=X%d8*{Dz@G}#4Y+`&r&2UQ(;B~ZC(W&uE7O&b(qps;hnA7D@}k3F# zVQ5}N3I*2%Li#isdATS|RRO*oqH%j%Qhn>9eA2w_BNKxUV3+s*gh^IO!Q-%#IT5{* z;F=R*$N^<8Zc?S^Q-E6UwLZoy1N z66;Jmq&x<7E3ty;!$!g4E{o##OaRJ}3z5S%`%413guT}N_}L&`yO87wj%r?tj)#%h zX)P}`((!l&dX9c}fbSyP>K=SCf~qRCyR@m2W1j_MFT1?U4ymWMSz5e8XF&n zSZ7AzLN$>QqUPcrs57JkEYK2Ou8}~RDP5B9qM{j3_ovpX%1kUihFhwRWrCeJ3<4t1 zvP`K2RMdd%gnxbygpO?Hj>LA^1ekw=MrFXD1hbzio)}K%e$4AAuDt+X$urHhEH#yr zuI`C6$aYfKz4WqapMAx1I3g1)XGsle1+k0ndaPV;hmAl*AVD&Qq+ITJrU zVbh`AWoa%O>#Z)UCiho<_B0fQhD?r(fc_F6sHOWD(TV zdC^1&$Y*MDq#=iuypH@tAIrZ);NgZBe4S%p`BCeupAiQ)%ZRi@eGi8Ue5ks?ERC79 zE?eOSCUTEV&$mJwwTU@avS~3LE;Y9LY?xrZ5N7iNNp_P3An`1y=Yuwlwls=7L__m# zg##2u4M0C$*wkPD?u$Iv0M36Wn+b*3v(9<9lLvg?|o+uL-zYe~*mhP5C( zk#SiD5Vj-D;RZWP!F)}MM&wuxM%-$&sA`W34L2M#q#mgI5}eLVuCZVONC?o8M*pQ; z@x6!c_ddD}chi;hc{EUK?y{8Qf)}?){}et{e@&RLFOV$WI9bE8Unh~0sc7iP@m2IVOR_SZn7DCD+QJTVNc0GN0c3v_|EYn$!n_aaK&D}v6L;Yy3biJ8PzpN- z_7vR|BA9Auh5>hLt|fw6g%j(RLGJq)<7s`jsa8*pE^AuD3?~sBKMAe-Vn2S}1D$Ab z6ItKlgH`+o8`TBPf9?G}(i=ahZ2E7Z^?#-GVPgOPpG`g5Q?XB-|Jkm21afdm0|n7Q zF^6_md)`CUIW}}#YGSYI^(E0Io>XO&FqMY^B5S=ZEH6;=yjotBwS>A;p`^vkyX@q3WWqo_6l;SB|4dvD2n^i^ebS7WgH^aU9mEtp4 zOfuo0T2?=8i$KqiL@24xN2Zgy?Rl8Ng2&jfiTB{FNL?uaw^IbK+4PdC&CaV9Rnr28BBWZjDS}&EZM9w6Ie9O->VOZIfuXRJ~S;h7q@Ua z=KxqfpkVq0ra-; z?x|iBSz?q*ZoI-8#fp|t6tCxo)za%!;6FXOX2tM;@m?Iq3~vhI&LL$Mokbua3!3B$ zz}MJQ6LTd8oslm9bTw#H(N@HAiK$gNw8d-&~*dY!Tza zM|DdaL@k0FXly#%5s1tMbr{+jAPtOSCV@Al2hJg`gy&-{Lv302MGX*;x*ZEvu3g-a zyna_8JVW?x76UUI(YWchFH~D_@U0~l%3`j2V)_#lOjJ2uuKNM%6ieH7(k*=#j4QI3 zmq|GDeJACO1)wi*4wD>`Yjb44%??Djf+vllO|74|rHnp08#7dI=vvQlHBy}a*6H2u zA7%nd_T+O$<-@DsOs^dI*M5Ag^p>nOFC@L40*|b&c#Ab@T=f=g)W0&#h~D%SZ?t#B z`)x42927S+?8}J}QLLg`3)6z9MOhC~bAK6*We>PVD09t0i&}Jmrr1!NE96-GQP)2} zizzK>zaOT~GC`~4$)aRgh0@Tj@g9409AnC!;E&;C?stqhSeV2@<6E!a2f`I@g(ITP zLXGknIAjL&#Rv-x%Opb{f(`|rjfRP5^sB0f<`3ynNaUHBhlvdnjbL+u5iuYIJ6FyT zp!?~h(tK7x6_Zy#Q7K_YCbAP!`qmQ14-a(Bo#_G~VZ|n4h3D*E2FxneXh&~SGSqKA z=a7~SiD{*NRXrOmuOpBZr2S(`m5y+Jz&x^sZS-ieXmQp*gbX&)_+Zg|*Qo>?0xw_p z2uMfxR#jeuSW^d<@P)G+YuQNZ6S&!EiiR)98Q=(}FpH%=?4D~gqDo#s_ea(;`Bp7x z>>%MK39gB~(O4ujhHE;ilT6i{NR?mLJDkj*SGg#kt&HCu?XQe2(+1neH9C`dG~njg zg!wNn1c<1=>-CxyaA?etg4sT?Ttj1c3eeMASvaj|FoWOR$UAGDGIyez@isZr46QHz zk&aBfgFcHQ@hq;%%de-`;Y6+u#p_Xt`WP2Q738u>H z>|IJ8cz?s-#HX{4PqwC8?iNz(ORKhZB9|9o&NDj+Ac&Xu>ywo6PLscf*El)QO7~g? zx9|t5El_d9j1p4b3$~oosWVt;h-(X#F}{|#YEOJJ%)odEwyM8kZeraQ*AJBrH{vYc zt}~Fz2IwB9of?3fxuU`6vDxZZ=T&$}G_KmAE8`*Z8?%Tc42~5G3zkq_w-{U*<(zyc z-Bq(c=|8=YU=CN;sxNrLL`=0|_^$4bi_MV7+k_=}n#}qt+Ov%{$ZjTT5_|Op?4^3U z!WwmD`rBmWR93zrjl-sYqgfEiN=jH7ggAatPS(r&P1bhdiMZ)B3F927*|m=5j!<+V{GDyVu!wZyhd+)nesRGkx~r+Ml|3}!McoBi_(p~* zxo|*WEz3t?2(t&J2NB1KnpW!VThHsk4e`6P64|(5klvsE_%mV%LX3R6TRsqBj7?e= zZ@QrzPlODGeqGc61*88yO<9?V2H_YiKL3$5d4QFj0SgKWFNDTrT&J*5R# z4HeDXydHsxzj}#KYu}V`8v7tiU=8qrl6vbEpfr~VT?Y47W??w!CZtF%F$@6KY>tD# zyP6-NkJ1WT-XuL%0AHJ4(`peM+91)-*0;4ID3VHweIgqtx1tR33K|#xt{U}GTEz#a z$wQsR7!OP9(Il@%D{RV`)(LnBk$fNsKTS9t;|VX7+)eSJ_(E(ZmZJUwhF$2iA#*Aj z7xR}#&shLp1SiY$blW((pzgqvo6_vTK~qKQC%^~A}|F$Ed3+rhsmKhJ-Of)h}}q25jj{PKyBi2 z#ogZhK)VS)E2M_ZqSSgN6Gev8^FXr>Le%S)?VymXd^!})_IB@3nmSQ-S`ZoH!7Z~W zsT6G&D)_3bg5Gp4t-W~vmntm)RtxV1xpLJu+h1pqj153?+NJcv@#axloB`p?;L-R+ zb>vodX`3QH6@2vrlkkq2UGk-60QyRe6ScF{XZ2cC0vy6^;>AM*OB1~!I8)Fv=q4aq zU5tq^d0{gp=joO>f`A4z+*I{Q&kze43?aXtl_N^bB78ivpL;Lpw}In}JtLU4ZiamD#!XC+AHtQpb9K|!)zt6M(T z>Lpwg#o@S$Ynf8>TOq$VX_O|5p^8!oL1+f?vD}L}WS`4J8vBDvPUoHUC&KCR=pQ#nx@MjF!mL8 zf;t}rxFB_+M?%pA^6FD;Yh({P@k65mYvEYdc(lz0%ADrLAA|6KQ#8&Rd>uowm6s!h zWSTG|FKL?2G}i&1**4UR@k1JniaU1adIQh$#H4F7F9Vhhb*IJ$`kwT#`YAI-_+`(! zw&7_j0Cy>!n{$T965FSMQzw)RA9q(Gd(vs1ndicgqBpW+_dplak?%XZudv;YiD|r^ z8GI|>So76VwttJq-ofU|9D4v$8g@$}5l2K^x!Yt)*cyy-^Id;PP1BJ;VuXx~qhXwp z@58(T6MP$2dreIBXyMN@49QFCm}Uy*&D-5`vl^Z)Py0^Z^YgZ`U&AKLMFWW-7scar zw!L~H*lu>k38~Q#MP~i*Gbu;ey_5EHl+cHmtK|Qbkx_AuBHVE)Z zdi{Q8xy4%*^g`)wHZ{Q;G~qyG_u*D_GA#p2oTQuvn6Up4(bR zY1%4`<0-YE2)2cT6L~Oi=l5wtj-qn8S--}U*mT&NNG|8~?FBNKSW_f!*Q3d6Vv_`W$mWMxE?kWOkxk zN!}Ovme%$gs{|M`N|u~RjDE!W+g71cQk;+^+Lf#YI0F#HI0W}9nsF0R<$Om&+q_U+ z+LY-mKVj>ui+w5FlF&~t2)z$~3ANpZHxlWBiu>v3Hr zU;}Lxt%YceT_vEu+P#IG*~*fX5qL`2@Bfsi<%%HbfM4=P-U$#ZtS;J%*%P%n$bT`+ zEz`{S2Y6&>%p)t+ApQm+5YFHXdqca`vTX14oU-n+EKV(=bwS-_0QoOZN7YR`+YRV= z5hPH4y)q|R(3RVV?gmVslV0&bj=Hg6GPc-BoCdp%6?318k1FfU8zRT-Rrt{eD9TVu zWX0@uVE5!MiKJ|Cr9Gp|Xv@F<}k|VE$ z(IpjUWI%qiHe!$<&qoK){aqW;&CFK&_l=Y>(rFWH&te+6nX)3g4658wY}=c{(a|7#FXeJ_Q;&;>~c8Mlq^ zf^Mugq4;MIQ2qEJ&=@gHDBN!SA~nZIwMi@-uT(0-y=aMEHE;%EH)dCwso4ZPS^o zMsfJXc~+;~xhrky$n$R`kFLU@9qijcXP>b}@6f78(rLm+=kqgEkFLb)k9cY?L9cbU zDtmQDCO7!?bG}#Yg`{4-$E|CaZI^ z9iAT_CQjPiReO88<16J*h-!=}rJa>G&Ao40#~mFX+*?KWuWzPv`prdOvz#x|!;>A^ z(YCQ!Ox{0UbL?Ub-BoLng553BDN``rVb%c=m6w*gmEx|wn9A2x1qN;v35`=SfU;3g z3u9AYiSu*~O)p?d{+k$B@5f`^(RR3y72&brWvWXLf@fkQdsb9>(o-G0gJ#IrpxM8> z2;r^j`9UZ19m!)=(0Z+DM$NHzRzWZXY5h{5Z@tRxB5jL>&3;~GWS8=|!?_90HM4|z zkhG0uhiiu*29?ileIjqrI0ouNVg`j6vfOigq2E?(>JC0TcCOKTl~<0(V2sB% zQvwSnAB{F+7<}4kjMpub3$9c%T@bYj0UD>tpFBr|j&BP|4-0DjsB*DMB!dAc_rbat zm^~gOEp`ZqT4Rto9bN0a8K;0cbo-`lXHSqRS=(ZmQUZ8CU*V|vkQKIc;g)ZQ^(Obc z&8F{JL{q@JnpSYxM)EI7U5z*KiA+@Hnp#$s>rQ5;bq>F%eR>8Tibi^)%f`BEp-~Ox z=^V;bIJ5}z3%iDG$khHxX$>UJoP&x6`(f^QFmL(0gu1e}3F?5zfZa}z35M<>`zffx zsKp_ell9ulW2uW~+Jf(ihpDr+gDzzO@hlTm3s^xaP=V_6V9hogE8)a9H?o6(bp5&x1^V3le9{)k#S(nc6~ zR!p)WcONrT#QgNRGRNeXg)TyiZb6~rSo9>-1LW}oo)CU3Xm(%-f~b?87Ys*NAaBtAit7{O zTn@$84Y`FElp2jN7G|$Khco-hNkN@bl$1KfIR+F72DyREND)i+o(W350dsoy#6Nae zU%H2|{;C%Wsgq6FD&={#2mE#yW+Fw5*yNvXW9z z)&?K;=Wwm8yoM3hCQ^-BS!ze}Lh17`pt@uC#uG@I*)FyoPB8P5_0X#0Nj@su1(fx| z%hi@9U2Wi+9Saz39LR7!Pbq;+K;iA(i>}N5x_6k3=ZA{lf7(07CbXJ6M~EO@$|ia4 zNa$74P+RYC>{S@072DzaTP`*Ns1V3;+)~1KfC)v6zL}qjbAG`58L==xhtwBr(*)-% z;PVY~v;9E%bVlaNux;=t5mee@AmsqqEia-l0FSQoJA;EQrJ+;}ORDS+oiS?-?Shjh zMr*Djws5;Nn4Pf#5ke+C2_bPX`PD>tfzDascn#-SVDvIPu(rKQy-jMKe$X__`+@xR zoi5M4@!piaVNmo|9jVC5rpYvCy-aD|NV2<3bCV+$5^>l|#K-0~Dc%9&`Te7y0=lk~ zHJ&vCLJsI(sGN5W*&98>kLhud7%Wzdy{}eF(mF2ztZ(rPt;tN5z3Anim*b!Gl%Ph+ z#C8=JMPs=1u~y*$6Z5@5;;ogN(oCEWH0%tY3M+%)PCa}B1_uZ#8*;@ivo&`+mgI|F z;N46FS;H?EQ6^iTc(t*5Btn;F0fC3`pS`5Q8mLnpr+m!Y%(ib@VqZbjEC%NvRmie0 zN~)-#!7m0snc%Ndf5dLe$gsK=g;+;)UTpIEJ#&`>s|@ZFT~q9BxRt+HCMVHM%FAYS9jeaCItbITLx=r&??1~X!Qdlj*%A=BZf4E=lXkz3^R(QA5C_Z zYi`a|4*Ky*!ph8urM;nYkPQ0-=YLJUY5VNNBl4)zGw9Ra7Y*D_UW0`Zv9{H!0h)q2~*F+>N;I3=3qG_%S zU7s!!)GA)09h=aufzXp<1d&x4aG+&#Ou`V0cta56yPKSd+T=XG4X#}#5)T3_JTrX; zNPc;U3Wc?H!~5ALBbrqYwA8i50Qde{n)V_$?GY|1-f{-JMr(6)#}ltj%Z5j>=^CAhexP<(7M$I64#Zo&S0HEPL-5$Q4-=;46^4`D`5Q~cZ4qnJk z9J|TPM{ov_#gS&guC*#s{+;VuX&vA?QphPDAs{S=b$PpBR#y;LlACw;(tgFS4XUN{W|I9eU)~i+RsYD{05KU3;I& zNj0>UXd}#lCE|yk(05Y1WAzIia7JDP1_rZ}aqt1UL&!Ld>Mb(F2Q{MSW*AcTx+s*y zYi3Cq1xm7@5J1r}TT9Arv2*OU5|2c_csqyAB&ZruN;ww`ul@m6ub)fY;!262CSMhqViC-^$X4B6&_yBxz~ z$mGQ$GT)-$vjSl`F6xbD#d8_|EY&N>Dfqng_F8$afHxB?5S~|B+hLz}h_s$xqkF;J z@Ir!;#-GZ0RM}1hnEb_2%?3+!a)Tid;hiqZ>oEge75Lki=V|^pg~Aig$Zz)N^;zH} z9(sJ1RIm?~#52(d1grNp<8{=a5k5tCWBrI~hcIjNIfMMM$2afB<<^ZG7N=0@Mw%_g z4I)0J;_)(RU1*6Z%jJo2JZf&Bt*gPrdB?hw+^4Vyd(%RqbX?^gBfZj1eh{gw|ah(-UlKapmgS*!#g+O-`f zHQy$TTtk=pS6)(;k|7&siuZlsxFWH!h6{F)JMcP*YFnp{;T8lJ#PsrK84e{^VWwm= znPTCRA*CFhQxmYP^0lFw9jwV2Q)0V!`^`K-jYNpMR&@0k)zs2U5v6}EHpMgK98brj zoXE8?6+=399{Cm^OVZqD-P>gD(37<`UU6)A`B_`!eP-utjcVoKW^a5INF%ctp0l2h z!(DftrgkzBw)>~GoBsrRV!xMCcIGpNulJvTc^3#vyY#TZsO5SAL0yk5j{{E^=4!=a zKN;ClS!aZ>DXhy+!%O}%z_DHVgkZMZM9C-VFa;Q`YX_h;`b;HO(y8~A>qTRhoK+81 z;mqD-9mO-ZDLb3_B>OyJ@yy%>^?%c_3u273NQ!S>QFLb+sNZGJwvqYF3?s1V{%9V{ ze`@d3Jbh2w@1-pnB<{vkeFB&OI4Vi4DVmbIf*6Nov2?6_d?puDFYyj^AKs-75p4am z-TQcRP3>i{R5&L0SEF%;{1BXTb4+rlR10GtM;=xEX{t!g&ISsGR#u9jJHo84HV&bB zo2^@nVLhXzpa0!PJynDVUXC}QQyvPV&1h?)K0FV<%H^kZ-`{0I=8UcpK^-kc`<=3w z1Ww3sFD(#Vw-qhGS%pGVh1XL#QQ9-6XS`l|9jO)=~Vx7kJK(!ZyK#_h% zcDBizg_mHlgVmpq;t(R+?YVZI3i3!`E7`0 zei+0)c7s3ky&(x$Fq}%)*dmNb9pos(+cF{?cA&Ee0jvG(0Jme1edA!bczf?Px~Mxe zfJ?e_fiy6@qwQAnZM!!iL6I{8$8Dv?9q3&K9Noe*d_Uatxn|i`XQ058HLE*e&QgR; z|NAER_ZPYl&+#`;@X&Y|WhCdP3E|W7`&aPuP4D*^{OvyP^1q!4{&!qB8$12~^m)wu z3rpRCw5x-9=bm=~`XZ8{ZH6_XFK4{(qqGFubb+@|(gCKJgauGB`fl zUv@~Jj_ereyDH>Q+gVn>WHXAzFP?rmNtVB{Pws%qGA;rmkXb@)|9;??+cZ5|`8eVV&nqrZ zma>es4kK?W2mczKo^d#^zuymSK?@dN-LhFyTxN5OxtFynk|!s*x@z9PiSuuBe7Lzv z9=|{J=NQ)qdoS7Fgo|%`aHAa~U^08ZF7IClX>77u|L|`&ab_9@u)>a8$eibr8xZRZ zY*}s}J&UkKkF&iKoo1uzv5+v}F=v{w=15NzdqbD85JW>JRy?M~(bckXt&l+%)W_D? zug)F7o^gFRF(Nb*9$SCyx+PzSR;TWw_)lsdPqoA9r!}k3^EqDli^VaPp2bFGe>5>< z5nJQA%@f|XCdLva={hcI>GHZK#9Y06SYKTyy9}+VrombE2T)SkIauGI(??&|>w>VA zm~4HaPiyF-$rre(1^S4P2u2RZoY4i#ps?^G=P$$SLmkW$zj}fUyM2ja8uhlUqbupX z77xjC5vmvcr}%4Wj4fg85xhggn8^MJ2Z!F+0$WSgrGFWO9V_X(YuG(O7)>672t3iB75n#L;z=9Qan^R{> z{b(SoA$z72KGY05-E@+#OdVtONC`Tqra~jWqwokO2R0PutZsfhVA%u~0_#z~G;vI> zOQ*Y9+0v>vgN#0>i?tkTwb&&xj)iUB8(o6@%UeWn|Bfka7* z)cYiW0RAH}M1HE65$tXGS^mELP{WV3wNYbfpwT-&x4}h=Eexzid*{6&D~>dCSuCJQ z3MFLT**KxdAPkN!zm$4)B{3_*!d#iny@3sPOPP!!M&GgtzEV;(wDszU6zi11?talM|*$uV6FmmCF7;{Z) z+szJ2!AExwrulp%EkEnf3>16q8kRGwSWuSI2hh!xmq-0U?GpnUkAU+w*g@t^Yr#m{ z&MNRY?a;o_mr(qN)Glvi3%%PEA_&ugbV?`CK|OeYtGaZ7Nu+c z_0hr^`NrBTKLy^QL)L{eaHM&b4fWI->iUJ4j7vxmlc=yFX3NOkhm*+H@JcQ@HDUL( z%$=9{vZa*4$wt*PG;kPI+i62JvAg(ZK5~ze&}N-rk<%mA%L5XVmtbz;1Ymy9y3I7g zgUXVmqwFr)%)-LuBp8n> zf2j5EYsa-4oC(QH9*5RqGmX`e=TpjKD5ek{v>UA9d{df=cIjQm)VXq>ug*`zYz!g-eKP;avbEvXe z1_Sr99I2>mikqw)30c6(d5>|S$&F4CU`#m@1@m!=$q=yQJ`bbQE+dL?@P1$tYvG_k zjzat%G>CURZs!tRx70;4uqYRIrDzi01w;(Ji}<}9?xn><)MS`Y^Wl!JkkNDPhl8`k z>jMtjZzV9Pl!1Z$RiXk;pOWN`=>XLQf7@0h4`P#sHb2e(It?8r^D)IqbdnH-GutZ+~w#CDPeNEcC8~+uhmzhtz0&Ew&yUR#6ViP^&Cl)q&!NW3ICMs1F1HZExd z%Iy86x}%WVVJh#pFljx;$39?;{fQXXo#f%{M)KBc`}UXkGHq?BnG%a4(D7Y88_=rN z>n@-ir$SP{DIe!UtYGG!q7oS7(SbSy=ruAh5e$U4vwX;DN$WOZpLx^)S3-R>s2r5Y z2j2t#KMhcU1aB0o6nWXGLq@%b<{{&|nD%LV(0&Yfedbyds;!jdH^% zZloEfWoSw5dmLDjxm`9m#F*#D<8G$7pn7=vYJmV|+qnQvpkVhucOkosEZmre*=~(X z^##?c*9v66RGMs$t(6iCBsQVnXZ|*$}GKmsr<<37kmysUAg!{(z(uQq7$J>gj9n)IdH0qe}y^IO}|^e z-R+~4T?uC!=UQGW977DYJu0`URa=!me$T*q)8xuBdaatCT4`*h7x?QnrP+RFP`V_l zt*nD6II^~BD+gSW8TgODfKCHe%4c$qzx4ghg{qKZQWoo4Q>WK&Kk6+tpzW^pjk>S! z8G-3suOMmm2@p*`18K~MUCFp*kdTdmT(SDfYaY}SjYiD6WpIv)Rv%2v^Dkj(%3hUd z*bDE!<5>(|4A=p%BwHAn7%RED{q*A$&!$>KE2h9@Bl_DTLB)>x68h_+yyHIw^rF^l zrB2B3ejJC^avQ1sf#!S@CvH4v`x5%?g+Ud_J(~ep^0Ol2ah8~Q%RuTK>H2P+89s$kW2JZ0`4vQF!t02PxRufy zx|Ooe-~Bi`ppSo@Z*Y&Nc%}ZD@I5}{-Vx>rOsghe^sNb!F}`($nd@&3o%S75)e$7g=Xh^LS-$`C|pJu)WjPrvYnSzg!P*yj+_tCYEuCy z01h>;qtqKnNMUWA4bDUXxnI+>CxJb^>(qPYE)?9xrd*ZR9wQFS5yuIKs-oq~ z$|lS>YMPuU4H_mX_S14#`X|-UIn>ERNA%yK4dxC*5B0!bVqHI@fmJQAKxlZn&jo=uZm`s5^*7UazDpDd^pj~uL$se!#CO)wj=UrQR zPA%YgaZPJJ-GUv_X8uHybLnEbcSL+x`D0DBz4cyWr9({c#Co5j_L`i@M-OY!`BQp;Yrwh@`b!Kx z|KhEdP9X87t86uT#{tovqU)OGpW`J1=z~VqKf6b{$VRssFT^KYoTsc9Ob->Z z5B5V|zVd5Bn<#&`l9+^5j$X9Q#1?)wM_q@21Zo?f%1*wz7QexpJ$bJ;dY)q1H*%9TC5R0E1ilkm?b9v?-@3$Q( z+86Sqd|KA8OsLA|ksh2;%8{`BTrho)+YDX%H>>}U_*q)q$`t&DbUhx4=K@^su1)d@EfjTj!i*6r}3Cy&Gn9y9i)d) zXz@&K;(;)lTxq~3OI~Nj!{qiedOcIAo%?MHA{ZpkiLaZd97Vah6j_R^F_MKP!-ne& z1_KmVkbZGksZXlZL`pIR3u~$&F>f{E>$b!J$7_ud7Q?R66;AFH^5u^Lnk_>z`h6FR z4j+}QmN1?zb@c8Vw?Sc2Q8}HSSrNU^mYBET88Q9IK=G}BEkKNu&n5h9oCd2e&+!m@ zNfSYb%meWFohQ<9niZh`X$PV4~8Tq!Y@aoG8YO&bm2cwGvn-Dj5`^R$|qNo^m;%1)>>PUn{EWM3~h z3+xr;+v$j0p?!N~IA7?KD9hIdx7*sDR`;uyY>eLbUIGm@1{E5~(ZRWkp|uhc2FY93 zj~eNgpN8YJB(+57h96A@-^{PW#QWbVyuZLOpu^_>EeiiHX>$&i{~3i_v^#34J78yi zP=A2is(k=yDgRZZ?OE@qV8DA;h;#J`e|t$1lF3sl+dM|SVs2|!B^9;dD!e{_h~)@> zlE~_0cSlHumtNYQ_wO!Vu5N$m_+AnNmEpDd`9S;d z)`^zB%|QCFRn6d?P>Oi=g*}R&%wPw`w+hC%R|En z;`wQNoS-B0`MojD*0P>||KTh1%k}jL*ixij=upyJLNe-Sv1@2(a?DZ!cJ1DQ5;?Jv z@`~(O8DTM;L{QL&TDlbnD_(CsLBq}9@1~pvcqAJDOw^0-R(Xt;C&wnBcSW=stQX%9 zPI=gZ5CHBs1fI|z4zcaxl^dmyLwSX>1}}wzh4d~shea13ZndD7QSRuH6wuf*!9GDU&zSuOp^Gjt5%CWXOewDCzcJmLJ-Gz6T99q3U4x^Q zj06KVBJ|ig|1g@OgkCsUMhSzV2R_Y8-zpnGT4j{BSlMd9={0KvjfO`H$2yUaT~-WP zTq(oPlC|QuTH9k>)prOWu1GD7vDIR(8`vDma82hK(nUmw-MH^G;-B0)RrE0>>Q0d> z-ru+rx-qeDg)DG0UF*WDA|b6oPmIb5W5gjag`5cAiB29bOJA8)8D|6sVl!cic8y{N zr?BnZ4MKn!o%hS#_<(D#}-(qS=NaeGzScvbNjDWMuC7HrL$`cm9I zQgo8pp8bQpkm9F3GSDm*xA~py1Ukkl3+u0(fEoEL=?~3TiGIPRpl+GE21M`qWw&Ki zzuW0Hl+hx(Dib$^&4dPmWYH*saS~&rj74BA6M%&hK}Ic?AYrsT^)p%Mc?5v;<7p1f zyF8p_kfg>?;9+O6ILBhChtUM4BvfLTIT(o+wOe9$xkRjjallZ$$8x6DP!yW>iwOLC zP#jsI+m&3A8KEIxIiWkL?=;RQD5T|Di*hKla3WsXQZ zE+;_&#S+84+;vW)NT6!moq1yB@T#DSFQu$UWJ&H={nm)Gbu8Kj!4HGLy>663&Xi6F=d8~Q0fI?-FmYsg=Nt$PYQWwpy-%m z##z4$R|M2b@&+~vx5k{q#&8oA7>@OVL~bXUZ0?-^!lv(9J`=Co-EsmMh?T5T!C{nB zHcGwVYDTj!1y?1Pvu*OfqSmfpdLf5@b;Q5*ypab4<`~hltQZ$=Bnq_5%#^*N9G>BB zhv2iucao66^IX=U$fxVRDqTmH8J(que^+5IyIlJ;TiVJ0$-B#U%Q!a}Q@lly5kp)| zc?qm-M@0o+9P;kIbZbp&FcM5L4>e=f;@0%N&!{TE^HQGlF9Pgy{Ug3osC&V2=XrDnF)Igf12~m6({4w-tGRyn`U1{!E7cJGplGNoVEIEO5-2r zt8so->@k{wZegLytEe)ZIO)L72Wh8Q%GOC)6;`$kw{gCkar238mQzuLVNFQ}KzNDk zCp9LR=VFF>wv-a0)oSw`1tK(uyUyYbo{;Jo)yhrXmsJ?jn1@8g*&<3V<6tm=E>L}u z*r4|`0wz|)m|_7`)65i&?KPjT`)BysscnUw+#j)>%9v{Ok;b9(PQcoAOX%r(d3N(3-tC0I{nLI0*d8yoNUboxlEqw3b9enK7GI8hWu%|yR1pHVb<(_eNu z8^C&weL4jBNfLFBBDGyTNsA|SKGP%f_PPExi>(`O3h)mZyETbuOAWCw-Pa&a9V(@C zonW>^@C4E^ayn?Uxw@AKbHsEHseHy*wAEAs{1>yOgEOG|!owH<$K>UE$9+LuKjDBa z%;3XGt>MICb4-sZpFN@amg!#Cm+{W6$}=KVE6+MP=R28ohlKZ1g^C$%q0jEvdj%tb zMV7%HH``9_k9s@v&?XJh*{SKRZwyk4TKVR-J5QLm%Ax^~PupIW>&bQANGVC;#S`Aup6{lP?)zTqYFYf;HmidYjFB;pP6JS6Yn9#brGd%wO%(G^isNAAn7BkAZ;uEcW*gdz z^$-`(M#SJUCM=fT{1tc(Th2g-v+W^E1oqJ|_Zvj8hQWe*e-w}YDTTq@&p^kV-vhg0 zID}RHHz0|}e5kuoD63NhkH4BzbHcn)SPisMh>NiULkZ;xdXNO@!;iJ|aW0({h)@Jb zB4E%CjL*}(;0~w>ZBb1E2Rh5khl&mGK6Z2qhQ>O8AE?oEqDJr3igz#yGnV4v#LZyH zMF%_X2YJ11_#Crig-~4}7?b#C)9x(q*#MO1(qWcSUzQn%YJ@&z0PDnDpe`5XN2Xe| za%Xgs`R|$&#;iKE7OZa?rRg_m(?gl|CCls|FiGWRDe68$z1l2P7SB{qbzNF05=z28 za8!w*u@zFkH~s)bIVW&a0AjOZ@)Ov(2$XgGOYe5lca)Alfl@BKg8wikC8V1hpj;a8R9t8}Uh~vYhlDYNDoRnIVEgDcVc1&Grk;L>HSuF-{A zgN+1K8CVWE(z`4=O~Kb0=K=6330r)`Bpq@U-q6L=qV1&h*Qj>nTB!h#O_sBJ<#Xv> z(?39^+n+}&3lt;J+hf9+Ho%%5<0LdTS&c8c445(+DYau-vBH2yuI4ZGs}m)n-N*3# zn<`-RhOv^ed9MRa|JzF7r>3z1jKYZhR~c3xHZ;b_h(AO+Og{65yb|Ew&ESSrnw(xupuk8A^V8q>sI8Ya?)j!H3)WcBcMwh8v5w03Kuv zSK4oyiT7b8iXtv;6|g24VzzOS*(|#I)oVjj6e0WltYX7j(j|qhv6&;^Y>BZTN06uR zCj3qdx0^HnONyD76E&2Ob6IigcPQ?Y)mb9!DQxL1QT`8@X-hNbOo|}f!fhMuwCdS-PhO$!oo+*66$V?QbjNkuZ~*WC=Y4~2@PjVyj{t@Uj4Xp#paIEz10APd4<$ZD1dh1G zqNuv!^T%_JJoOX|NNCX9IhSYB?1_Wi`z|?xF+X>-#zfunk0RFdTSM*XZIh6GKTFNc4V0;%=Pr16>9YS8VCZdYDn^#4O5yc%pI&@kZ!TJHP_$B>3aUMa z-g>yKt^)4SfC5jZ2Ib4C2>S-XH{JKhf=1B2Ed}YfGGWmQGu`hb<=l*UxIbBCfP$7f z9ClvzXgTgXTt88?ZmF~!4|sC(ozrR=FOGGTS4CJMD)obB;)B-!;ohFZ&|xtxMA%%$ z5Gu3;9it1AKj_dLJXr0%R!mU6%fE_NPg^Y)>wDo8~dJ|XW07ftz#2;LAKTC zyzSt;zvp@z_Ahc#=Hqb;g=*Ue#s$qhGa6~)EsQh#?UUZ%H+`qjmwM8s8Jxl$zJb+7 zVTEn}K*rM74kn`YeM5=+viu0+9DLCK`DKO+#+&??^v&`=(_(WnF#q4_dr7Bl`l222 z`T@lckb098C^YhS5$z%V*z8IVQAs&H+|QhJ>C2VPL}okivDNbDxB(kA@0a!*{{xu$CCNfK#m{pr<20F zYg(@Kg_PpMrEv!TsY=!BkKFC(;Y`$o=y78`*`Fln5zcw^8E(JHqu(%})!ZSl6_2lf zc9&gw63Vg?b9S^~E=d z-Axa6^42-;Z8Q9zt~xhoW~zOYrK9E1XVpP*l@?}sH{ZfV?6309_2<*rJ@@tNWx?R! zQ2vMZg9VQ2>u2NFdG|Ut|MSE7b@2EC@3sZ!CWb>xGv+yudHS)Mt_PBL;zX1Bp+?JOE>l+a=yopfN#q{qnf^Qi)bQG_A!u6!06FNo%fQ z!Hr&NE4=o9w|)$gCU1idxeOQHyqw0o-<^MxGFzYlttSp%if1#eql#-6Y?#7zM%Ie! zd)bt^vG(A+I``=InKdBkj?{ywp-(NqN?1%$*;9J7m6$6cCy^XG$k;gwS2|GL=H}Q> z!;uMsJJEwXQ3+5DCRsh5Rte-{0hDNtpbpTtvz{n|S6##!ZpErZxFkkNRgt}AslGJY z4VHl0=3ov^djL2!5e4M1HCmz}P7sW~U8YWx^}78P0E&ow0&Bg^4U`5furDK;k%O`Y zuqmRp!|iGPDiz}*n14vtJkSO?`Ks4n1+kUmD$n44t$bA@su3~qzj|}aKB7DS!0@99 zFB~lz$rQ50Q3_SMS(u!zE)~8#QWFJ3E>VY7@%&2FAvmm!-~+8Zdk!nHjy}1A^D5Lx zWztN-0nIPwCcu+JG7A$M?1ES!%zQn0Qa}+be*&Y)D5yY+Qwf)Q7@p(yQPZ38mR@F6 zDYP;|E@sA1$hzlEYeg)L4*IhERGRPxU4m`2=IuCw)(x-p`6%;4QYT(vL7XgG!8>w@ zNP-&a%ZVLuj=~tcPIi3&S>?vtI2a;<{M0olD<8vf3cG$vuq^8?w35js*DJ2c1RJsxK){09jh}(Y+I;o1U zIF(cNY?4O$R~++Gv=8#RjiW3+X6wQd2mSHAU*5qyI&i(YEdC@X)}MqXvlZa5x=L=( z+b%0D4$8why(P+kK_?v2GJ7T60ly0xSDrBM*8aA5>hrXZ;q&73Cmee0J%9W2WR@TE z4K0~P5=ZOS$3kdnR|jem+5$-CP}7w{uaLf?%BGjVEZ~ZrVAM=#jy9o5%OHh`Za!&= z(n1aW3fZP)@L+8TY?f5PP7MuCRu87sR5qU1?V7nr7Pbn}F-Hy{P@K6Ap5D%aVqMk; z6eKTn-r(jXRbK3vghOiiSwU7LAaDoQOAqdYBabr>>;#}BQB3LwO;dUa1g?#=Ms2ia z3ZVvYyco!S+wF`cIupBmAOlA6rs$~Ud6UG8s(iGDtb}jVaN1+k8aZ9^een8%S?E5F z&F*IiE4H?0ld2~WTxsRv5XIyHuH0GB!bygl!%tvHlEuSdzt3m z149WYRQ3(y4X)L?k#44gxsf=r9p}BlVJe4l_G2;pNP~vz`8m~0lpfvslL|}9B6ME@ z9;7{NLsKlPFDb;5rB9WsxG$j43)-iJ`WkeVVcByc)TOm_4NT}Pw0pL*RpE(YMa_0| zWSc3tg%4m5oGBirJB#J~8m#nZn2RQbt66=kn3zz~Af`}hd!@tO$nH{pulJTnZdT6| zd0hLy@qMt;C4BB6{FDWaQEy|c$>D=mSwN&YLJT*qqW8;6*#k?uQ@t)eDN~y0pK%DnH^KGoq?SF`t!S$mI?CD z-7mu^tSwB0+;*fk73lfe<-xnm&QD+E}@j5i+r57nZC8#R-Gi+u^uon)<{TSvAlpi&VjH*1mW3Q9tDcYRWMX zr1@51^faRPakmXk63g-nl_Jeud5n!!G4x;FJ`9EptI%Spd30IVunL+Y+PYN@CFuFJ zeemO3Z@cdcTg+79u7VFTtL&GX8bpVtLM&Jm`9;k?8LTrVEm7fY9GIvhqi&YFcxZQ^_`^3FT4!gR5rS1dwaezbGHXaZXyH;5h2C7Zzgo?{|zEWl1PB z*76BtcIJybdR)udYDeaGlr*M-Lxz;vnl-%jpJ>VFUv^oty|_to^)gMT({h5u4_n->n>!%if!Hrp?cwq**j*~3{Qv)55v zaS66YN`Pa+v`7;d;RdmG+fslPQ(=Be8EB7i6&WcYOgL-7_J|8|dPfJ{9-Css<*LO) zRdB4+G_qXnuIGqCTz}B{6`#w!L!Pw^_Jci4D6n>94Y)5t14B>)3BvCzsG~rw0R|m) z=ZH)s7Lmso39!0Lm$1^UaIId)?s{azPpnH&()z%CdT%4DGqaci&8-oxp0ECuJ$xB2 zBB=SR+gGyMq`_gLvg-%FF;=sAmwpga$WT-BB)Ac#_K|He0b9+=a@szuAwjV&@?%KH zz?B6w957B?H|Ii;pGyn#Zs~x!x6Q0s5!MbgSoLLku~!tt1o}a=&g&!3;Ab|)TaQ<`1N>S zRJn12^b&&dFTBHOAnFj``ei(>ASHD}Di!VOJ*buV%=&ofX=+G*CiaR|Yk=(YW``wW z(^@{KIAh6cW9jG}nIz#SV2pQj;33aJ#((sIJlF|eb0O*5+F{TAp)3HX`dJd1* zt6Fz;L(HA9)|KGTf-itE(i>D)StNCt-jM1l^DWCWkbPKrE$UOSa;KQNxM4;F=(24? za@i)9{wC2`w4z6@HbaR44t{?*r9`-oO#yq@>OL$pXNp*WpGSB$_T*y>a8WrVQt@f4 z8OgsSlF!Rci&{ZN!YtlU-Bc^wszuTGC^8af|7Fb$<28iE{$67tFPFzS%zHil^^k({qiaGwVV?j3m;k7 z`q>kf=KSczq#Yd=Dsx}&!elG}vxs0xe9`>LY283S1Sp`OEQ5k*Qh;6Y=OeF>l0~@XNr8S1Hhyr}8^=ch1OMPI^0@(P#f|5hwVO z+#*YYMK+v+>pCq@WAyX(u&%<{X9tfAK5hac+e3wGzHTIxX#CGdSt4;|<|I>SmyZCu zoCs)cUk>DV;yB{q(Td z#5L5dF-W?&)?KAC))iehp>g`fPv@55US5&_Hm>pC;~gM2h)K)rmNd^HM2HaqV%1Zx zqT2}9IzVxioo`-@9;mh3tLM4)_HTsXk@4!Tdy(>z8hbMYM!Qd9j*8I@7AT>r&5{(` z9c))es^SUwtAl}jGxzX*SSryw1pZZPf&h=TE4c~+!Z@=6w_iR1W-zDWVLm;Nrgs@wT6A#nrhX$o$N;+!=9YvMmuTS5(fPp|LD5fC zndT49c(izBVj+j00%|jL+1tKw(;qAr<4uG=lVv}rl~t%|91+PZ=(0#BN9L&*b@Cu3TH|p``4Cakb23hkR< zi71=vv-RhK$AiUUK20yc#8f!TVb~1o#>weSv2|FEfrL*P9rRK2mRx_8fr{=;*=t^bqFO}i$ zHf#JTZr~RW9`>{3{EG+w`SD};4<7verzh+Wo}c$YQ?X8ga~Ml0>9BzF_F&Rc%fS@) zzdb!p!{9RPQ^zq^Ywv(^bBWBz%vD~+?SBu71KBj5`?_O=Nv$nOK_9Xf@187zr1^+S z(1bpENeCrbi%Ugu-5vpLGCE?InDCwuINIg zw$se2*6%jvuNh?23!##QyFFF%Le{GopN_mI*Pgak(zz~b=ZSpvPXRwFdhY9PHjez# z9u!S7xe6O=$UNNiW+>#?Xt@aD$)vTO&*f=Bahp=~f5M|!sgC8SXyiiY#kZDh4&#Hj z)T*gQbVyyi9S@62$;Qg%Dq9>@*hJ%4;38G53?O=2stJL-HB$OQ0WAMEEu482)f&lR zfMoaw6_M}J)HX$ONfR^SY+cYikl~m%MWs>sI!Y4!`V^gQtgTYzICgm;eH@9p+~m`g zzv+Q};vz=~jMii{pYvocwCa6aFCl23?F1HqT`k;ozh<7V=3jh>E?u0YIb+QXfD=32 z)dG5TU_N3Wtek@p@2x-~#>qz!_KBL_fG|Bq+!F*p;;~DGLp$))2o7Uz3AWNi7j85c zq~YsxQiAlSM|@7als_g!9`FRmGZOC9;y7V>h4vhi&%p77jqN` z3)W>0Z`zVWUra^%ePkgh}_&ZG5K8KhhQAz^E?HS=&^jKeqTEIL;RaxPS zKHJDyBYBYaigv>k<8CXV?C=2lWS5YP}r| zQ~;P70IzCE?G_+bd9k&Q)JiywXD+QiZn2SuR9 z>@9jtS3L(YF+DQx#sDXu>B8;K27EH$>G|%p;SDhB?L=c5ti2X(QY{1Wf*ae_`|aRj zP_pkE4(5=*69J}0S}1(xSPhg%lqA5E-lE}!e7k~F3;-uIP{-Qgvyl5tzS_aWVunIL zViNpZ{j_v)!z0_KNgRvONG%?ja!e?;U3+6Itj$7s2ZG02mtH0H#*P+?|AHyv|nE z_4F-Rb$%p3&^GY;8bgp?I+uZh^nfVjBT&$lH^jvpmas?yF+U>L0w{DU9sv+ht51J% zNWO>xX($hcqFCrt;ZzyUk<{aF=V)ms6{oP;JqNN;(m)=1@ZD&Mrs>4>xGn-#;WYh$ zn5d*<713WqdMDQ^-}sI;@RYwRW0+>+yuywTqohx6^?hA?iOXy<=kegAy_#96Nf6@Z zV3@ST(Y5uMiONgXB({W@bPr6=ivZKi(MZw8W$EQ6#PJh=do=aIJ>#H8nK~!&ROQ;S7Njanh|`Maz_B7?p?;^CusnPkqkUT z-`Np^f~9?}%X4K0%D8L*a4$Ypzc{Y(A@Vq91mhh~`EbyU#?e<}LQ*IugULz;R^#^f zH?->@M)Wn0?`cJ&&3<3g@gxjdOW>Z_f|`>&(Gvi~SUL~D{YnLX0Z<=kl#3?2gQ$QQ z9c=qN3M~bh;-(MDgX<)R^O14U6_Y(tCm$I=%}OuPjkc^JFdC6w*$y0Tc1XYZgO!8; z80$DBlZezY_2X}g=pcb7y{^~9$s|(6<4Dty7q%;i0H+sfb-k$~m~-#$S$ZOC3SVnR zjHxLT^G%)ni+x94r38g5PiJF;E8$*i>(ozGET@y7!x?c5(?pl| zTUfEX9HDn-2Gsa%Kq%w1UD%Nbthv*mH+<>B#PcfBmV}vtSo^bD6~hFrKgohreq;^; zbq!`W$lfS6FvNF{fJ2c|z~SpivgDk!bJ70KmzGEsYvTGW<@1Yuq;@(bq0O^i+~elp z&8xnTPg6c_&E~fi5pKDB5FA3S}^t79ZMo^lxkk33XsV2ruPvd`K&2~knkET zpprsOZVfDj9jl8;u!91-;$B#X`}^#M0X611v}cqFRuG$!u>rui0$2%{qR(!f14Yrn z-6bf=$=wAg#UQ(nB@8bb4-7e_Roajf(E=RJ6r3vg!HwuF)&Y%VC2)~&%!QtlDXV1H zR{TzF9Woff-(Mh8mH*U$dx&jGm3LJmn%^@Vos)OE+!B{V7Vpwq+>(~Gi@Af;p^V5> zP=#^`dO;$ksAvxP8rL@0;;P())0$GdO5@nY8=Gs_=Bg`7+>nB;d=&*N$uGK|*|5aC zJ8-nwW8T{KIOm9VH@44yAP2`E@*tWV9~SvTd^T`OI`;)DqKcZ}H{1Zy-2cFI%ZWq7 z?{B4{Nt&bj`Q_4{RXmwV=vq-`yeHO;BS#ruYO9jwHlt}&Mxa`|zfTu(_)IQpxO2#Q zdhl^-@G4LtAYKU3M@VZ`nJ-r2?>$C z?%0bj#%v2d#UH}f*QzNfJHNQXc-x|j5{rw5_bFmO5sSq8TkxmAC&GO2Ro12CBE5xz zR+Blx(R>7+4nDwF_oz2mQD_Re z>y)oN4|!7gm5^Ho{~sEl_8BYchq4wCaXSjx>SKaQB;nxR#gr==Z%i1B&@l6V7-5yZ zS0?#O5irBk}OTD zqhqK4Y+79&WKKX4RC&BaZX$nnrwj zO|W|60Zw>n#AIU!_9bmb{RLGD)-Y+x1yOPu5;&1Zw8W+Ae2!HXu{g8N--fnhlbvFn z!4F2YY6_MVP{~R9GO8chZ!K}JYRXGC%2Px)ytDF2@rR~8)iWS8{&s?;pT8!KIif7? z+;$6boY_W>(iJD-{EK(sFx4nsrB#7PM4dh4flB}AE}XD6%!$ne;q|FSZ0Z;u-LDNZ zs%5qxlhA|e1Ly#2cglDmGdNx9n=#1>ZxyOW6_marwp^6AIreUfC0y7y$-Ob?H2P>X z*{a%U_keCD5@|5U^QVBL!kg7x{|t^;G0$n${h=&gJF@=UON(<%-;%MA@zhCXh46}7 zyuESD`etLYSz%M#iYmc8sYr+epYn4sWOZoK$gS^>C z59lveTe=*ppm7H6n{*CKT<>16db2f~Dhtmt$B*mH}0aLZ>^*oLHl%7oI*ivxPx!E)H6D`8mV-j!Pwpg28Z7$&I6?-mhY641!M=iQOl-e(+k(s4v;cNY7Ik{Yo z;6r=u73~M~nvo0pKkxjjJph6KB`LD~kM^}p49sl*_rCT>Ya;fN4eo#Q#fk}^n*2l2 z0h!SMZpnI~n<&D2vn7c(jNQPCN;MpMwN@-d4Z{G9oHI#A91_ajd%YU>0-o~Y1mXq8 zSw#=LxxepW>;81N|Ge^j9^~2yC?FES-Ap(Ll)?l9HVf5;y-d{F8^n%`5pAKvo3$iK zOJ^aR^2Pmrk1mGD63_Bt>ew8B8{9IN1$-D%C2lD!JbDFPQ~kl=TrCs0l;KHg zOZvFyl()9|AVYs0j;vmUwwUagJLarOMDne2#nTw@6K699812)uL}%szY@~N-R*Y~} zhquK)W|_w2&>ymlfLB>oDzU8(L1CF&0dNFb1F?XMoejzi>d&bTp3@8z?l(wplAaMN zpxX^G1n|Q9*0Owb5t1f{5tIubf!;N3D>oRCZ5Qh~VjFQ}a$tvR=yEsCi*Fkv zXYx%Ze^+Td7Hv2_kH7|BEQBJok%L&DZ9cpZS;-nCVYnB~RFsn%;e2Qm5q^%}VQrH% z=W5g&bv)c|=#?gOt5S>XYf48bhRKU+Ql4moXpY4}?>MfVe#mRO8}fXJnzn9B(uU!2 znfQwj?goBHPU#B%T&k;g@b!3+~}$tY{&IyOU3#H%u? z1YtfERt9>7R?d`hf@thS^d7)@tRE80)Nq{MW4kU&U|))E)!|H9^VBVhYPKbDB5)3| zE@5-DJW*FufOB=z%1WElH7ez`p;&Y24CEeiPYPH2Wt^_&By@V&!L+IvwXc0BCMGfK z@CG=xOyGkrw^U-2=&*T~a1g{?`jmz~RBqx+Std313C9hwIu2vz~m zWHWxwE-Qk|rhJfqPlPxSAAdpFV3wjzRP53R*GAXz5)Cu+piNSWAe5NnsuMY;d$P@| zsq8sdvilX2eBuUZ5&kO{${UtkSB1d(W}kR)wJY9n%!X^% zvs#ST#;cQTZl&wY(tD7Uu9oK5l@ARh%Q@}HXW(R&8?QUrI*-jjW@QC=o(^h6Q8*>2 z4-Ko^3LUM&F(tPzU9+(}<3X2D$5xy<`MlrU-iq$B8BFVhj{9HF+5T)>+-HOAgV%0p zy=Arrg`KmY2j#UUTTKm@U6`pPVmoics|aS}9psa4q;|qzSmr{sMZ|@}MRT9p80f3!`j6_v%)!hdR!79YksfbDdX6cDdQ=~Zy{0%w z75ybBf5^&(YgVO}SxY2C18(}&^@xbo31`erkejeZzM?m$(gTU2!w5IXlfAdovAg=I-~~-5Fa)N(5blHfI`XQs0Y!<#&s3zFKu{)4WwUosS(} zxM@6y2EN8MFUZ!>5{xT8x7Y!8p|V=)CQh?#2GJJ)%q=2bH=U57wUv$5l%U|MCT~9AZY!K1_?!}PV#pUusmThI5e+)cpI2CpUx~RUYFj>mee=DMR+92S>juRykjgr z@avfLX&|eo|2wF2oYf(~qy9@9G1OXcE&hOk_!yb#aH4wAmk)|4!k5 zK3l)f=FDFl)xR(MJzpUME?HU`|GS}Di1}IOUTHPpanE{S1sO4)cc-K^(Y!7+kxD6R ztlTb^0quF2u}wTs)W)^@^4xuo`s!=A+Ws++{by{R2)+{RN+@CEJ%fj&PANUHiQD09 zeB(Lgr{y}c<`ZWv79~0@kI5W$9l&vrS)B@;itba%H2gH4wg?2GlabpYeS~S50ZwaZ zORXEp$*g^@l?h5s8dQ7mb?^q_rBgwtp~=NO-=-E)6o?wYs3!voxOg99=#lYiSS^3` zvd{scX01Mt!+@HoAU{Ok+gf;;m}5V#>J=^JHJ^nb1bNo+Us!FC;ku|!?oi}K;TBsG zrJ07T6XnKx4oMK6kOR$_W*3(_#i4|4Y>Wr~=CeN1Y!eT*jq5##XI`VcK;$|4W<~^R`ccnA+4X^O_e9(gC zS+;tm@?o+R6UvGJ^lo(9(ezYT9E01T zmD3sSad(gH8i6)Jab*~2J?1L7_C}i9nlhF3h2+IBl4|;0J6Ph7DiFh51)=^*pb}Ri zEyVVEQT{^D@x>C$8HjlIz(G4fw(8h|(wE(C)9g+o`)roiz%549AKngN*dXWke`X#w zIwM?V8GWcJ5)^-xw#wSGJ#s%=NU&Z5hhv+EH;!%k8Gulnm+3PagRhnGz~gL1WjyB9 zAPP!0{YA}$S}o19MP%Q0(j66o=IZ~} zd(K6ZHUYUZMve;$U>=0hnis_{G6b_#%++vo1|HRBIiAQKB{2SRM#rBK8j-I5JCsMg zT)&3OB*;sp^=U8(`=x2!Oi89}J5skkKPm;UX?v$!L+en)hoA^yYJZD?#~6ukkT0Kp z!_$CPRxS|Z6v0yfg@+5Zn8J^#&bPE=+^0+td>7iU!DrjyYg&Jur}AZ@S(nO;i;_&G zBGi}js-u72Nn(Yk=^=~c6;>G`gqo;6w%D#n%&y3mahK-|Xbz6-wG$YVYn)O(RS&3h z`u#H@4<7VmgdKqVm+&v+Xo+P_J$UsR>-ug=7nkV?=~mL6zN}XcJ(p%rcIjiy*+!P~ zM)+mZ>Z1#vb)*vJhzH{s4|KW9U`y^M3Iq584d`f zu!&TvclPK<_C9>JER6$y@8AU~5Sy&_N|II!{&Zee6;qO6Zm+JIO}kRql5-OKExR`N z@EK)ad-Txnu8Ou^)T(ZI`*QWYMYGXC_7X@P3WK>hUeyju`6rFP<-67fLA}ByKhG_t zt^P{H{`b8+L7Hb}GF)A-14-*>q8ekH|PRQJ{3422kE@rj=5BVpHI2Yux>J z6*3rey}mjP>gE41r9C>?3lVQv_Le(>b7L7-$}(>}oHw}ba*YA^ z)KUkBc`z{kUr3hUa2o;x++&Mr5pmia>Q&ro*@qt%1-s6*C}*7lkU|)4@hZbTMSrZ&hN( z3ZkC!k4WltDjn6_Dp01=jJPK6JH3#-G8~ZdK~~itR)~Fly=o95xyu7+JhW-Yl;v-m6>Bb$szgj01ayl~rDQ zg|e6-Uu1<-9saIY<+3{0XG#UZmb^W?ZSh1le6El~AzDTd!ECoO?66jddz2SERoxlJ zlYJ?F;z5%vK3&X-Mr@Ir{=*GI;&}CPCuI|$9?z-(X~CFx&h6g8>)JipgJ}Hn<17W! zps5rdc?+PVN$KCk1E@B*bQPCzN)xa@4GSgDNcT-;h&P%weZb*;g2wXD_$%c!NB`~S+nw?AClYd_l!fi*0*LPUQM4Zl z(iV=;w-^ ze)i!?7Uz9s>_i?XElOW>d?AJUw`LV*cKIChIdT4OjetURq=)A9K)4uJz!~rvZ!vB9 zx49!H@*+?-&ZRgo`Rp+TbEcKlTF*hcJ%zGLL!9p@5I0hHZr~x`y2wF4v@9JDLloU? za=PoTSDmpNQ&QYW*K~8pe&Tun8l6eneBmo^*|Ev5?O#xr2QC<{OnZl*^>=l0dRLiF zqcKjV*VB5*nqcffLeOTL`e0y=4Yd$4y7;U(?y6c;Mc7l#W4>!~i<#?aU{v>eL-$~0 zNFJWlWO6;Uh}O8H!1eKyig}!X`g2r6d-(-&gqpJ8n!cLu#*lMtgP}l-sBQTd@(exd zAYE%8_fIJQHG#M9OPFY_iKM5SsQpG8;7V2Xq(~Gh-V)x|^yd^9Yj)wq$r|dybzj#2 z9pu{O93(mIj1FAJUbZ;5h1Pk8VmIIi`47;polICKq4mgWwx(wi7$=K%&t1Bf#fj6F zCw6YZl)7K;nQ#43vR%!ItMegpON{)+y(ISU870w)haQ5t*FDWGc=ir2$G-=@JA>pH zQ3dfBQGef!n5+XjU6a=v)(y;&1G0umqmP=R^Nnk@p?~csA>lQLEsqincldqDA2U54@ByZV`Tu2R z=lGw^?EjxXz8Y&R_OkUVr}h@UiP#E#woKUH#DA0QOgmn<&E_PLb5iI2BcH?G z*P8%-oXrScoIg2<*}sWNP8{XUU0}@E4HkRT)4FhcOw$L zm*3b^r5%eHVck+sf7QwHf&Zlge!qU?p+?S7qR>fC^AL2Rm!nGUwe3Dhy+B%A>+{P! zCExVG7eZ~r{7`#27547*z^<>)c?|XZaDO_#K7lvIh{Ob{)SwZ`&()IPc4p0A7$mznWbRP5_DSlnJ4qa~2ivXi&SIPT*P$Qr zQYFGkmGpV~kLM(hTG&mME>vjw(#z09k>)I@Y#(_K^ujxMrpYAd)b~fov_od|v{Vtb z_LuJ1b-T>6ndD&{_g(^MB=Ur=C}a&p%__C2OpM0S)QQR|4yZp4lTj}-rLKbsRKOYk z%og>CRByJyF%sWuX{&(zAyo{uV!|ZiP3Zee7g(1|*80If1kE?dS{ug>J(oL>HOah& zaiF2u!kL#heXj0NBNKoY|CC@Ec?b6gaA5Nd;=v#;y-G!_heJsdQUX?ZB;(}fl6c;9 zO)~9_#%+2}Ne7g4XCh7QqFTLqp8It({*e2vG>!jy!n4JvRyx8mi!AIoTx_wfhq$(Q zKNg(mT3CKyXIv3`>no;RBy zdi*0%u*?imH*@-wh2u3#O#{Tn}_GqrONGKy>RPPKJ zR>2S%!l8!XeBJy^9_p~G&SBr{WtZxuZ=_56RecuMll{rkKcmx-6IG!FPb#LeXh53O zTSfxOrNzLMpkPHB}_ja00GD-xARg@9ye%PT9$fWrn?W+mZPDa@K-3U{87 zi%=0{^tod@B2as;*tL_CMLIe|H)Y%&^vO=O|q!o6;h7xIs1*1B91te<#xA|>!lTo-C7RlpB<~Si_2i7H7#OQrn42XP7OT z

8=4UVV~tSC(-HaZ8DF1(vT^xY^gycXgL1s|Uvn{h!^+nO`D4y8w>9zvEd!6=%S ztm!0c#z!tEg;BhSy?^etU@8y}#GDn*0VFE4Oy`JU+xC4Y{qhi}u^%vpp=-^9So&O8 z7eB#6x2W!0d@^}Q1Vb&RE5#!}q^X`XiI+}d`Io∋tDel7Fi|acw5X`jHN;6pWwi zBFygnAsx9-mdyvtf^M%>1bd}uAsmH+YcJv zsZn!tWx-8PYr)y%*~Yr@y`*6wv{;Q~q?yjOqGXKh4n^yKG4>8Yq6BP{ZreC*+qO^J zwr$(CZQHhO+qP|Y-!pULMtl?V$Bl1OyV}&IGV;yLXT^JutDMzt_{58<#VW$C1EJx9MzUhz<34Nk z1Spgdmd3u?hj@uOcS+Bv0L#i^bIV7tP<+7j2-{BWY#p>bwFDPqKjg4! z$Pl#;!Z0fUooGE!x6Pb_(XS3NbcT`#SA=_PrmW^;mhGEDxWTI#rN~@@lNIPLVWUXB zr_&1g3X(@cV0^)9g1)zb-!O5?t#E^<)w0-1y>m*K_1cFDbEl|Xv3w^r0w;0 zK#+iF>)yt-l8=qbh6W-e-?MB&0NC7 z1-{}U;FdE17dI5RYtYurSGmB+0!b>Op;TwZG z8dfT3ImFkEJFECZ6vg;~BorqvsjGDvlUF>Ba1WUc%lSP5eg1iEJWSS<+TvH?gJ+ z1t&}6rqKjtF>2{Erb-#DB_W+NZ&C%+^E>wDn?#iNk(EF^)b@ipe{Yoi-EM`SogM45 zk|R%*YF_=LN0G^GH=7>IPd^{FtXRsku|9j4o&zL5UxY^yB}ChrOpGliXFk9&tI`6a zRhA38yda#>@ZR<=g5UZ|U1bjf&trlUz1SoToySlZi~~;{ zQe<@klDz(idrMCqzu&?algCy7vyq7&tfrZ?`!I;Jj$^S(9Xe7T$6g8=#kvcV_t@{D z?;@$^-&nYh7*mozE5)N|K3-J0Wc+eH(Qay8D%2}k(mBAsPPK+J=Muehm+y^K-YsWO z7&+ECo;eW*nru;(pA?IjXq_aBc&%oVeiO0->LCqy- zK0q`;Z!%u)jBs_gB4pJ;t@&oa$<1Qn71PjQc5nW*6A`QZh6&bk&2A(pWkK`BaxQ9i2vXdJ@0GX^!5JZ4t zNDCYkD46n86x~IhU%CUZu%4y6)O*j(=7;azV}$roraxrj8)dWOLNI3{VbSlWOm-jdgnxRD^~u z zSk&#(1t_R{0OaK=8AWyB zJ}2U>WGAdl!R>?Ov>9j5)P9sP=V!wsr0`_tl%iR<}=BudpiB9JRF4&pn;!W zT4Q4AajD#y7DB0$hK z&lh(njV_>mMfcW%}AStiJ1@Pm_cK;TjtuREojE~6rycbfHBE#|aQ z_M)=?U~cVfF|FQZXwq<1H3P&GxMOBvZ&ZT$GDBA)hm@WuLKn2AV^~60@YNDaB z3`pweSd!H*DW6CAO5mxZ%gW@;nO2fN0ay&tQ`(A^X${)=GAX?k;|>sE>C8Y3MP`G2 zD89ODREiBmpSp_Xh-=rw%0&exJJOQ7|AyrtquHnVtcl+Cz6z2bn<%tB9%#W^0PFA^ zSGRcAe`ocrvmJZ>iyS${`|vKe*q$T-I@*&pA$_!3?p&I1^x)iCgTb7{+z!vyRUY9I z2idHLgYt&fjb-n&AzdDq%DrqICO7cqR@_8H9Koq{7FmP#{3i3XmQ#J;E3n-L!y@hM zH>*2GV?4B=TY(E) z@NRIs?NbRU*s6+QDFxNJgnKa<`DyO#kuIhHC@R6V_ z1JjUfQc`i4cSq9}x<#p=Jl5qfRIq7z%W6vPEk`H1NO@q*5MPrfbj3Bkl@DF|AHnsL zOUReCyIz!Ur>Gjd!}v+u){A`GA2R5n)OveH_)qv?{uFKNB?YhbD}t{2qmnZ%o;GFJ zqRxS#=$a+a-QpD3;tf%zYc?bs)8}hS=%5kQz7b4dQP1U75UBKJ)q^&Ue7S>%JgaEsl#Zd z*%=;q5~6g%F%;&%nnaU6Pz^)PvmG+-UNaI){;x49Q>YHMQ7y^LScFNpk&V<=Elsq@ z!pnvd+7>4t3V0EcrW%>HIFpFxOAR$x_D>iZIo+eF7x{937r|D$P~YFkNXTNR5Gh=4 zZ;t0@@KUN~dc9up8ZUIM{s&FN@L%yh85x)v{!`QZe|fxF)i-d7LU0mwzCu*M1b{}# zh0cCzE#()hgyHVYFCX%VB$Cy_N^S0S7)+Z<4>@Fbad9KqT`(rIFDAhzK^XC9bM{|< z6yC$f-O5+^+d*F6hroHtbEA+~V|Mh~teC+12@tL>-JkE0ZDySQJx|DuX}hO(vlx*> zPu%i}lLw&o$$P!*X_|INPEwn++2XX%-23!cupKk2v1KIHTw^y%8IIH~&2yPS8RNBs2YN5hgKV|>FN_X%?MVmqLxr74n#(LQpVFAn->zRvfY5_T zxZufzN72NciY3ZYlZ<V0P1M!o&3yZblqe%GNVEMtYp100j?B4@bqY~wd54DF~W@g45SPWR3mL@0%|UO^2_)$()r_lb?avf_hF?C z`$Gmu{n0FQB>8sQ<96ydowi{k4+<30Q?W-YmYksscdd%LnP^BhuWHnD)yN^RtPwoG z&ch>+W|8BDi4J^rouM)@k70iyAJxh#E2XQoIsP|Ox_dWRtBqW(!4VQ8>4nOHq=)kK zxz`(kCSzkgxPu%OZ-fN*p5?-s1AUwJVik35XXz=~N;__R7@-ypl#9p9+3nNUE2F3f zTopRtK?00mRB9j65{*UA3{R0LWEd4NVoENFz#5Z#Mw342Qp%prJzo$nomz1nj4U-a z#l!%}?c&Yohd+@vc2fBm3)jBFq6m{pPAOl|1;0g3C=)G6H4Ne$rW)rG%OmlX$WpJl zXSP)4DS<2#F<|0=pgQ0)a7$y!5AL&>PJTT3PyUCfwd8(~Nf z?k_^jnCQUmRQLe`=o6``$*ryJ$XXC`(p4 z*Pt@wN>Lz%2VXP^Q*1irCUzXeAaqL_sx0FMIuv^IH;Yy?PlOH!#3Va$)sDuiMSv~e zRu8?NzsuC9(zj}HePgeJ8dY<*Bwe>Q4Op_`U#^=2Z(H!x`9Brls6`(cu&_HB%+w>E zwllfQn^9|05fs4kKkUEvu=5O6uC8 zc&2OTU#GFutON3GZ9;aVaWegdF}?jwSW)$PHUAcAVr%C4yXN5jnQ>y8gqsCq>v9tb zzcRPzEw4_rvVj&u!3wbBH#*8#SP0csQpSa$y?=)B%@sqDd^$^2>AFg-t746lee3On zTF=UJ%h;6}Qi0{}$HKyy(AibMIKv+7+WJj-=)@;=DdI8B+!<|5nmXT{;Q(JZveME3 zn;PG4m2ylX?P=rPiCmEIQza0jwIdN@{}-a?yCj?C(^d}b7G(&Hl?xnFwCWRF`|^P{ zlxxJ2o@aQS2R-;n2fdTU7ohMT?OjcVWhNyOUXU1giwIA)>jzO1OK9|jFv!^ zRh?*Leck4c)UD>-3?z^$ouh7mTm6xk5abVyh)(Kf12Q+MbV=_K78d{)%=gF2Xn3ys zGf1DOec6xZC0BzW@Yas+ML-3p!5lI|Vi(sww9-M0sLBZUV|N=v7}3N8tL1P#p!1kY zzQUJcz;G^8=u!y~9f0Sg&P)81kSN@&Xg}eBAWS#_liF^C?OYK=MtrMv1Hp~t8neer z^LixW7&h~U?Lc#sCO{$z(xs!&X!71oJ-W#ddSzO^rO z7(t|k_<34n_TITe-Js`$2F=t5lgd!aYB_Dji6k7#l88Ruxm!dFSzHtu^5Q!$bxd*v z6>*yUel!4gEf3OJ@0U$+Vm&1Ze3~VBXr~Hv~mu~t=Mv@C||xZ z%pV{V9Gf}F#TVyFhJ16(W9C;ayJT>SV(Y0tR`d~{YG`!5MC6Fb&+QUeI_vOvak6cS zu8Y~YBl9oilTKWY<_a-uZ?ul(xszHA^cQ1ekSc2?BUCR`Hw7)8OnLq0T`*2%lFMjD ze84*i-SMD4A5a(%Bpk%;VEbU&k5nEzj_y(N{pc?bEFFl1H|vaUA9;p3B~vE+IQ3Zz%Ly)^ z9okNmG3U*^mT^i>AwbvI zF(+leO;+MMziBsrs#V&CPF|gwFYaY8j=m>(e}GWr)sO!tjl%k0`7Z2?jQ^=osAzE70Ee_q@Go8!6kzuQ6?Bgo1OIQ#7c3icCL! z5|aV`9vv+oX=e#$+4T1J(b;|9+WmfxJ}u6=BpAdHPMjNN?i6J=-z6$FI$3vPW$KWXQFW9O_{0Vohv-z9E zAe&AOfVd9Ue#2cAL{)oQ6fjLkD);JB(XPFRPRm|{bg8jjE5>V7L_u!NrfMrWQ8d;L zTd-4&YR4#C=&#S0BO~V8DGPlnyD1%G4_Xb1)Uk8$Wyq`WN%QZU8#!6eFV8e57}vM@ z(UB=&uWx3QV(eE|#MQ)et!_uIFY%f~%Zkz-*o_C=0+Sowq*!l15epCm zn4g7-2(bxqdt4t|ym_qt3$4_`^n^$bu2^;2wSSG+0X=n$Og17rAVgE19(t-9qH7hV z)WPVf2$wU8W@R=(nH542m*z@}GglsdA^3##GDsbPyfp*`FwX46NjyWQb-KI?&_X3y zve6~c4NXzLFcLzx8uA5n{4D;R%z?^OMJjvrm6An_jLWa-*=K*(Xl6nql!M2kNz6RG zJ3VD{?vGmOHHWf;zDt#)0D4f{DwNQNJQ4WC~l;{3Z1WCBIYj zSLE&4JRlzTmp{CHc%A<;i~KgyarZnYjh7#V*{M(sP#Xo|;vEY$JY3U;oqy z@Bz$iux-%LXzeOrry^O-0aps7sxQttmN(0?BAOt1Pp34K2TRISQLq#(xvZPU(lhiX zT;~6<-&B}l0N5Jy!9^HRv~I3K7lTlAY)jyvP2~c1vSmIVIF~zbS5J>|tlv)Xk`n1^ z<|pY{D^Z<*p1<#)SccoBQIwbXeF&rw|7hqj>aa|P;=_L^=%8bJH5Bz>9yl7{Z*~lh zD4Y+4xSehU{E?BYz3Y0r8guF*Y@_;`fwnn*t%Eq&wytsbOmG=Yn>~JjV=~Ezsh}B` zgiR$o+|)Lak*onV=EGxmKq;$c(9ud5M0ts(iU)tw#z_FV1Q<|Lutu2qgeeN1)Jz^b z(2s8~f!u3gkCrQ9T+*CFu;kxZGZlJ~4uBDZ!RQ?ZTi#5ykV~_^@|>Yn{HO+gTs$IV za_aC8l)fzRi*~Mb9)?OG^))9di<)^O2G_1)dRBw`wD%q4zRDP586Tjs=@KKPFXxEV z5MQ`!i|1^c*U5IBL~o=b$~V1$8Ga4KAWmbDMMbj_H9Bwh2D>BS96CBo5Sb|PeGa~= zpqr@FzPDoRVapLHa$N#-Q|5*`cW4xf+)~-#L#-hKOy0ph&+|$El;qWL?zk!>`}ofd5#&iZ=xYSL_<%;B#O;4Ut=c5LZeFBPIq z3oSQQ#>jA%GJ|McEV2Ehmk(%+C0K>*QV$$XO&2!zW^$2c^*z$!=DtXLuy30QzXzsg zd5C36y4w>ZfJ>;@_ruAtG?uF#47+Yusdth0nqS1k8m4Z`e9stZp@PSxx{jS!GoNm2 z73Z?M14)G-vWd$#fygRG@x?qBn`PA(89}XW#(v#XagetQ7s#kSBDjE=VqG8e{)aX0 z2?Z21cGl5SzLOG+9>AF^y$JRw0eym9^nJZUZj^jiJ|Cc(8M}i6MQ}e2MC{zze9iD! zYa2~ARbDXX!xli7sLRscIp1Q$N?D&Q>2ueioyClmw`kGHq0g})A$zJd_7X*C?x5QLwKM`#xKMcx+tFHvQ@V*;G+|+LajUAQbyyq@SXsw-&9a&M-r2U8% z1o*VVC|55y2i_INO_fufT`uT+G?GWxYE9G+f$>h=#u=ml(5LwqJgFWe8;g4xETCr% z2JkH>qFdBPi`3RCN>%%Iql900z4e}N#{umGbss3f2Ga*PUD8A4&88hFy}XSTda8%N z#6DELRnr4_^~0IGEE8+3tLTT!5HN3~#$d9)Gegj$+))+`yKd407DzC}(ua!q&BU3E zVQY@9@|cjM1=$X@1#V6>>s)UHRlP>_@k%j8kUg7-6O=gHKw-#l2qw-DjM)9>sWErK zJvKt!55IYhs-c4_V=cE~TE(5G41+}*_gyn*ZiVhu8>JhCJSA(m+cpWdc+dTJb_uK> zRaJ~7S6Eak4aa|5Os+FF#Yu7R4Vo2!Re~}DKBH>Ts5*d4SAZE1Rde4~AC=%rvSZ{F zUZNvr)AFj-1`+loApG+WrswFC`>=v0e$&ZtSOiZ3`pU|9u?$%s4gBFf6)We}xHdV` zwip3a1PfPb`n9SlbET72Mp{6lW+L5tYdHmk(PfI)FZ(HH#bV*(FlmIERZ9Fg23n{w zQ`h~0K4xh~t)#Q`Ik_#$yL0tn-3^~xw8wC2b0q>yfp?u!0e#k$OXMKjw>%uI&xLQ# z-)*c5t;H$)$^BRp=eV2Qy27Q(NUrNjRL@wG>BWRq}h+hzLlLerMBCFciTNxY=wpd?TIvs4la$ zBN%BXIM|OY@U%ksElQi*2q$zlr^V5hPQ#i5837tqO1w!R%_~y>fu`cFW5z7FRkJvc z7Hb4m%nudc(?cJdRJWfr0@nPlCRhvL#!VaQ-U*DqhZj+(- zmSQc&&~!;1-r)*D^`s+dU$RsX;Mk`{EsJ-H;?Ji`@m%DuQrZ5jfwYh`nO0rBJ+iki z!^f||e~_f;bV%_|2>&ZRw{WwcY@V@^3L`)g?8Puzrg@6``3$V@=>ItO8V~p&c;pC)m{vk zu49$y^vk4o-bu@)*f?@}a_>Ceg?RWb*U+^lnHVV+nj1~fYX*r|@n4gs_xJsXI*d;3 z&%bD%uG5D~u?ofVB1|q8cP-}X&;6$$ck*d%X@AL?>~Dn!RA4}_FGssQwpY{FE3d3C z_xG27i+>qGv6#@Mv5EIZiOnRT-Ox>e8gqHnAtE=`oJOCm*lt+t(w)FS$fd!csRcQpHNj4>;Bh`c<75&{t<%?w!YRd4;kNdsw(om4^988%}Ear=dc; zS_p?E_J35)w9uj4)+l302*ydgGYPbp21vyU;~1 zCm4)Ytc)zN$WO%%8>kA^<&2j_85K+3Ra7jKAw&Ybl=`$+0I`It(|Clhs91m~u>lOX z8X4h+?ii|KjdQ$u(+8r{Cx!m)cG9jEa z?L8+d9zN&y@BB|qogTa-w+Y6 zO%W<)^oJzJ2(0v=IgI#pfxy$b$INeshb^V0@Xj=X;zBwvfr3f<+}*x33-V9VsEK!z z9WLmww;2kLx<(MO2>TsjMuxclReI#-T5O05ukIfQ$~EgX$?P^qN`}@fPxQ-EI$mer zpA;q=Zns;b3GbB|7>1N0u4R9oOP>VmOL_Qtvy(H*r58jx<+)9WWgxhQ5Fv_1iTH59 zX03`+8(}paeFv00p?gOC4&?;u#tAg?qz~6)c0XiK1~3-4&h#Ws*ij3%(KD z&<;X6;6TcY-?*+EyJpTc>{nKi(tZ%4siLT^YuhN-JS={gh8;x0J=g~Iu^W8ojx1}+ z=ThlIogbk^27L$Pk0XlcsdFP23P{3!xJxJFiRAt?Aaffk z_)A)1uNgCjI9ZEdO;6@L&nzdXTq@a6v<_u(d2vaKWf`m0oxHLFS}6J)P0xA}D+%PK zTKW!0Cc>$6YswF3631j4ajhFI2*yHcmK8+>J(kKVKypqub5PDL0;hdK#V8udV0dlg zCn9{fa@RHpJa=&Oo7!YT7!m2Z#2aZF|REiw!%Mf zCbtMZw>(v#1BT@`WWwJxSkkrtged2Xb=ICS4g8YBBctPtc-X3;sY)Tz5mOpUe_C4` zsVU_%U=i}Sk{syBo}2Bm)z5Y^5a_g3xd>fvT=pVNSH;I{LT-!M(9R-CDt*jiqNVpu z1WYrmP`ONcCR!td-z~~{tGe_RSgj=#&3g=oDEs|UJ;%Xc={3>!G-9$di4+2>h+VQU zJ`-gIV&|IU&uS=b@svQV&~+SNd7kxqEVB-(P-Rj!BI&pVbM_uH-}5&bw3u(8vu3_) zA-e9~+HWZu)|J=$P2?>THbi|)N)tO&96Vo_7*SU78YDSTd2!qOf5ZvA6NR0f9g{N8 z;jp4u6gS0a;5=7a!$og5gEohyc|y!w#qx>8ni-UXfs$aI2Ot!V^nsis-2-9kCaeA$ zE{7s)RHQ03N!#EZI-RdxkrsT!Y;gZ|NM#=Vx96c^U(*TG*?flT9xv)&;1SAJJDnvp z7IjAJKJs-qXShT<{1sq<%kf@<$#Y<+D>tAQZh?m&E;4O>03JcLW8rwI^tq|lR)H~Z zRKI%tVq+SF>Ev48$i72wg%so=%@+z_B&~pfKC$)hJ5ra8<=Im;>SayK8dG~A&&+PS z1aKgQ-?_%t$gnQrTDgx9EgL2fCOC~x2mc7b)FO=TTo)yjI?q?^6SZ&=y%2R-w2v=^ zlGW7Mxiz=7CPF5nu^m`AV#(|wVjX#Cj7xIJr%m9`H-4{sljs7j0-ajbIphE_wnMMF zJilyxgPoHMWyAgI1OY~JV`Kx`jW$4Nu5|WNsDE9k60N1R(JhVcaq;Tf2wYg%+57>@D-5<`xO6tq?hwHj7<+p0`;xdB*C3Ei)H}y4RZ@$?$4d^s9@NMf* zrOP*;lW5`tgnipSCv@8j%4tMYzYQJ$l<^8Q;~?oN;iWV#>dzH!#xu1fWV6&&o~S&$ zNkH3F`;i%7ZtDg7YDwMP??k8DIIi>a1nd=s?oHc+h|-&CbB)CiHk`P8UD!r#WIWIt zlV%tW6oZ&q;L#DI-5<6R@tO9(0e2rtYF^zi$tp*t_+a>Ld=mD>mgnmis1DNh4Z`&) zAH9k{-Ce@t>HvEy?I~${8J=ORiWPH6J&!r%Gzrz0{I0#E%=rMACV6Z z4nuoaZ-Uh>Ds1&jwV89H-iINjp=H^fjt3`R%0b$ zz+*j_4bY4H(u!wky( zU}R!o`%fFVTVuTDstxx4osJ310M&9sz&FS5l)0fD8#pG&d@Arv+=VBRPqeg4zH~n9 zpY5ScED*zmO9<5kM`!;D?2qWjoXx^J(Y4zn>-uqY{GELLS0_0KWPjWmyz7QVo0D?j z^3&5By6gVBjGQ#bMA`FZ(yFmo+D8!CbJNwvM%;H-+)utIEQ06_O8q`N4|SG_-T%g@ zbq0AxF_%WqF>{+a@<%Yzh)o?a<+oZcD}WJdO5#|(BkopS<@LGv`J%Z4D`~b!*X3gbZ_&>c z{eZ;noEL^NX{PcCf_nV79sf=I9i42~U z0j-o0=N6png&w(Z+RK3-&G#DNkw_U38fmFizBa}I>L_7UY}eD(v8OrPH#fjA#7tEZ z|5<~k3I_~QttV!o3b(~H?3^I34nlaKN)u4&zQ3W~^*MhqcXc7)M;|oR!IUUS&L1S!i?Idma^CB%N883Le zPUv6OL`b9}FnfysZDCCF-D62;X zf)jq*sThS1l1+SxjA{2X;gz(_KCt30_me(kO$#%Ynp=t{$qFizd`=oJSGy zS`DFBrPYEad6J(Fy1C;Y$IhLPuIQ1#NvS(FLAWPvoi(>OBA)gm&zce(=@n?q_2l&Q zoe#zTeAHuAR?cr_iFRzhGaO+!1ESXM_ygj9m3ml?wa8dKek9&dP-zDs)NsZ=!rC~u zCVM9k?ZT6h$IkA|pSPhugAvS0j*m!j7+W=PVQFL4nnw*vyr~^QH6mwZ&re%l+Gn#x zrPmvF3p5`a&%^UHn2je|3a--j3xb)RHkdKkXSX5b@+v9*MEw%er2)}CKzeH!`YYR4LTQ7!{~_B zhRq%Qb1Hxwb5($66?7Pjrvfu0ii^b%V9O2YoM~v{#eUjCMHw-}hb%k%z+!UN=694X z-jqJHR|6)G)D`2bD4mpBKs&?INT)d})ML*)jOFvy3$J7(UE>=Zw-4zv0_s@#@|Cdc z3kL8%ICz&)PIAjY=|0je4&}qXJ@;9uDEc)NdvgpHYQkj&aFiyFyq+E;l^+_1;+=w7 zQ=^44D`>p$HWLa-ycGTx;}=-T_-=>TZ)&_OcBeXRE?1?GdgdS=E`w@HT||bD#@oE< zN2b1g4n7eC*ObZj6WRKa21)4qWHCt~pmGkwig6II4qA|Xokv8Gaf}4-vxhf7ZU}j+ z`E0}6HqD*%<-s~@n^7;Ho|msO^y|GA=hs>CM~s`(o|@;9*N|) zCZ4}6zCMfYP)(NIfLpkJQOhMeeGz#P;r&Uz@ogQgZ{GIpgxAb*wuZmB;oIsruMB8) zZAM6pf?l^iTAZ8YdY5po!hR|bATTGpCSxhZ{`nyYwNopESjBPZyC(pbz;q2K+f3=% z4&MMa%I3kHkHLV=)-X47)$+>-y!jpT(D`v^>qp>MdeIX&rTExv)pE31Q@sjb`ezFZ75LI z*%HHX?q8j&R&?m5hj8SsJWgqk`;+FYtjF6=0g75@mY;rn@K=r5jT9E!k7R35;1X!o zuNcA;k-EFe7ecLJjI6&Q@r|ht`8gXjQY9<@702&*Wkr^H!Tt-UuOV|!unv8)YZ=dP z7=TFu$DibN{eY;>NPjkEw80f zWPM2bS}0AahnT8;`X9o>GKd7KE-kCzK{Ollt%Xv%Npu;_jKE;A{kb8g?&YrWPd5J@ zjYBfW_dR{ujt%R*qD7c(@4kNs)1t|sJyjO<>^jxsP>2~95|G{0ljqy;_>c6=wj*B1$3?st=rr9B^PExyehX_VNzo4y~1csv?^yi*dnC!orMjEC3j z9+$PhzY2`a{1Yh19E#o`@ox7G3hmQ(s>^nJ%LDKGoyqH`qHfCWB@;^IX6*dePyWx; zzT?|yXv^v2IABj{-u0PGj?VxjbI<6IaEOm=Ohs1A2~5K@+)k(Qsc0P~zm}7(avD|u5`n!&4 zWWWl8Vf@6A{HRxy63!@I;aIn7?KzDl+q;?kAJe{pj`aUOInx2PS*-SlpUuAEz4TB{Tp#g5Nj~GH6hQE8@n+w zV3bBvPm>tL1!XfTi?c3L5o&YVP(^VNSy6m!UeqiKtICp(xm4@paDK8#i7FCnBekR7 zjc>|XN8GUoa~@2_1_A(AB;Y6@D8#5plRWZ|TUtvvlc;gsH`q%lHy=^IBXrh06}$=4 zOa*amUzNb$!$k2RWxo*Z+LjJ4fRq|D`SLF{@EdU)&y#wZx?ojf&If$B>P%itR#$7Q zO1USc+xS(-dPzFy!PXB?1ArLcw_OFP2(sWIyG z6XKIu=#-z0(kJc+&WoRR3Xe$_1~dfU|%MH>Z^~NpR=T(;a;CKufg1 zCpjh84(=#lGO4SEyOo2VS&@9c+wI7QXYug2?x_-okvqczLp14~{DCj#KebnizxgHZ zO)Hd!{?Tw&ZI+ZxRXsOB(K8dEozniB;YNXv+Rk64kKd#-t9yVu1Si`wt8IP}alINV zp{`k0!0n6UHS`<7IUOzzZL7Vtb6@AXx$m!P<_;i5*qSCNnP+1@-1kRJndG^KL8t`bI94h5kk;wY zQpa&d4XSd$1ViIoJYh}58k=5mQ~I6o4Vb=0jXWj2&GnXfL#I}t%HA@u=l-)8L$`Mw zZz=VvZNqD=0W9pBY1goUKQxB6OX2msw6cMX^yk5Kl7`)u?f%bX`IYHexG}q!shzMc z8kfpJT~SlZ1)ujyBA`JN9Gqda;)KIO(#A@(Ic2xXkxaIz!rw4~S)$3e11RG0$q5cyh`e+fb9?W*%@QrWg8`#bG_H&OJ5 zy{*^0Qf+{89OW&eNHd{TcD} zw~w{nw4FYy`5sl(v1}3)stLt<{3wa1pnuR@bA1vnh0VK-5s{HIyN@uNy|mwC=kqT* zZKcE^LOx4)m84jJ9V=HUmq7-T)jLA!GUM|A8%Tcp93;Xk=6Fv=#Adu46*1}7K+zJU zK!nQWOXa8T*WsD{{Um{scvpiq<(Y#@|69j-JEFTIn1BKq%d34#An4V^6F`6@0UdoL ztraLNX~oe2>{%xl3n$2<&9wyhq4%fZQ05j89j?$dG?r1UU7-4)^{KRDH+5kniT$`~ zDe>{iKj^F*KE-}8YjH+n0g?K<#l^d9WZD@_`egfL^+IYY>j2OoZUQz%fo5D#QF@m) z0?tJ>q`7ngaaN39reo>gg_TF@z&#bz>6{qk8QVbGz{7K|fIevT?(AMecxTY*E zD~7@KdpW^PWBSIkOy)ft*TlKXUL$)c4Up}=ndq#>-syd8GX{Zq?er6|a;81cK4W9d zshnKc<2udvl;Q*)jk`DRkD7N4yo&i}@N9GAu6G8pwZaW24GiyNlt%~AF~TVb3xFrp ze(+YSn0s6D!>~6}e{j$O=e7>7}~6C-HaX$pYH5*7uTK>y*}j z*sxx};eSo-x0Boju6-l%o?D-MDiHn3U6-&^H~+gER^63gcA#xT&(E=%wOZGYa?{Wi zqDXB^HFsj{nRiVs(UU@Sk3Enp`2L(T7Y~X|+$krM*d%#++g47O8hi2G%F$fk2Jgy? zRNr;L{Gd!ycsc|=M$f{;FB&M%S)H1`@DnL@;D}j1d}<{lqMX}^_(Og-3ceZPkA%); zcrgvHG1`kPzIq<8cXhFt*aJuvzVx#Lh?EmG z;k9g{k5ao0ZmF>btB&OQ+=J&eW!^DtEjTg1?YMW1E|%FLk!5y;wA%Te(fz1_!Bp7Xnce|0n2k|Df1?z3df4U8M7+3LL#u}oirn)` zbX5#yAbSG_%-4bj4{~h1&OO!^HVLVdi;?0UKv4YKWTL{x-g)1y`lK!2AOL+gnY}pd zK`pV}t6Nlj+vp>Y-nsXlcUx$p$AI7$@I2%je-j_sn|xdrk)ANKFD6L}*xg5&NIwD& zwQ-mihzbL7045R`0vj23M8c4i3o?q_z1pzZI~BDtaSBhcd{ovS%Z#E!;Aisq8NftR z>vw5v5;-sAx`1(uP(b!U&8@(81&|$n^E;6rZd7IQYXDSKZEb7S=>Gof&eqkqwly0qNC%sbF)G>Y?pG=)&uHfY9h5Ktt~U@FH3svFSKB zLtzTV^-+LUg;~yDpeK&Fao~1w|Ktq*Fce|fCqQg~-yLNhc6qMR|yacpWjd!A3Km6Oe6p#^d2_~NjaE^ioBzDzOYi0 zmM(o!#E!|&5IH6zxd~tgw!X<7hG?F7!w_&<#gV@+z_C(U_hU)U0m+Q9PWf;T}%`hqpl@c)OgckI$E+PW0LBk^Gj!fGI6RN+vO=@YvpXAF_uPxe~X07WO+5$&3+QK}=Tk zQ~(ecLxt3d5kP<+@DuB=t?kcWK(s(enFHLtvV6-oSyUb5EpkgLkiRGl-58yt&X`-M zA|i}e$q8c+>>UU}v@FLxqS=cU*TDmm1FYtU`4^y3&9H^2z(Pilb;}= zTt$=Aybt;CmUdG}B)^*+zQ(EoZ05Ll2Hq-m+Z{T)*A_>7`sR(s4536LRKS9sv}1TI zVT#&!hb;jM;MbMIdNW?TVW$P~ORSr_CpcOmZ+$BI z{QGHH)cs!ZDg9RA-PZkV}bY%6$F8m@TKSp z5*`I6^H^v~O!R!!eml;*8E<*|$oF>D%wC~SCD5nm*YmL|xaY2rZ^Knm_su_JSN0K% z^ZUyB*bg2P)rI>K)kTss$&kIMC#YEP&|TjzeRugZ`kOXGw!~nac{g_ceYbJ+RV*`P#ldIY zaVPKkWcOL$p$mKEp-xL@NASlTS_5Oywhrue1XB~z4;Qu#?8)X{u*N%FUZr2;ooQG2 zRb&jtc*!|wy*o49Y#Cv{vx^Qxy>xcBK~$f}gi0n|^;vikDH!r~D7>~xKxV8}s>~z@ zdzRJy`KS@UVh#7XG)f7b4mGj@2U^wb$#sv%S zLshoNqQmgBy}i1Fd+ClcUZ_YmEJUyKc0xjv&|;NYjlBWD?6~%A&6cZ9P_` z@W=7<`DqNkbvWEqgovd98C~JS=c2JYcL9edGkYh<1A+|=bbmJfPKv=@Sqz4HKyXr4 z`|-97AeaQL1>%?$5QgWZC+Q!`FC1bwHjd!}mYe2V)}xiPI&3Yn%sDK?Q7~^5-z{&ZQbG+|%3dbW`f9 zB}R(7!`7rY$XIAn$dtILB2S+Nh3k?z>sFO@3h!Zt7($~5CnsbgF~s+Mnk7xo(m|8n zom{qOY@%;f`L##~HKkTHAthkFm)<4t&xn5@sgKyF+#WRG0db)1l(F_uJVZsT=s~;t4bv7$T^=OgRcCWjJ8dZ|V=qjsicT?OW zCg&e3xp=Aq2s}ZhjK@}m3Xf)Uy{@ah1qo|Sqbr0ofM3im4w&_wALIVxyo9Qbys+E8 zTr*|~A!-S^5@ND@)T&Zo#E9kom==@jPhV6}%b5x5dV^d7>Tcsm?H&Z0!{IO`22pbj zEags?4!1;EO{~)md(L6d#xp&k-_q1tCVC=&GN#UC&{!0D^K%wqYIN_6Fc}0L8xSMU z*5I{Lu(&|b2t*Fyd!+j_ADOdKcdUq>iJkdcvgi(5kCaF3*WW&=Ds$NJK#SgJD(lDL zunPwjO~HF=-+ey|Zp=?)-M;ym$u07<+XlWPvUY0$Q@P6*>6>!Lw#xE5ezQxA4pq*w zL(1-4A5jp(cNLmCa0fm8K52CJ>pBfD_uDGB2kffqy2~KC6|5hAqmDu=v7<7s5&USNqq z$nA8fzUz%AuuNoz1V*asjxj9&8V2^4%t@Z5GV;7XGYR15(b3?eotOV)-Dg}Y4XAod zhzhQuPbml!lLr?A+0T}I>1?UAlp(&$Z&VX@8N$^CO)%LpxRkBM zh-9f()2ryYMN>Tvf*eLYHQ`3hwJJoAzwH|We!t1;#UjhTfEl&>d=zI+Z0A%HGdiRf zG`H1h(b4)hoYddA3^n*5Q$t1lWjryla-opbunbML9#+jrbD~Dt8zh10u-56Qbw9`a zhTF2K1P%6s*)=g5smc2nT407ZD)B7QpNQyCT6tIZJwx zB$ky~vw{SqW#G72m!ZPHo%*q!9&yJz$pfMkJMaki-0t%NnkMS;L0XiloD~Sagb7_q zxR2lU72*V})o}1pN9#aLcJJ%!)}ir(X6IlsbBIECDl<&4>(@=V-s^8dhul1$`*!xf zjPdi_lE~Z{#Y{tr_kgVqVh!j&M$NV^#KwkmcW4k)!{F&^ArP)L2=+qbMsSrIX5##R za-PlrJYnsWH%mLA-pGi5c7`qsHSl|dZ%dQ8n-3@CJp5z=$?H&C7Ci*!p>zA^gsL^6 zAmnGI!)8oB2@643X)CaiGzXnC-L*~2ERyR1r{J}}7rc-wNDwSufMq0{068CAlk zs=;d8U0imxut58opbXACdeJHb%Ll?2O})k&c&)FRrv7S4;D0>FF>y4pk@Ov`k%{Cd z@{-g|tY_0IG@EF}f>(P% zU*SRdh+iiT3mL^zyk5e`LlUdi_XTHyp4h{SqMUIe#GK_JsmZ}&l9OE3W{VP}$h(=( z%z^jt<}!VK>U_tzT##=t)B3)Vr4)V=>1A@(gNu|!Z#Sp=-*n6-9VR7X>gABH_-5|e739M2cvr2 zFU+$#mE|&*R`96r$IYlXbF3hG#fZQQP06FW{ks?jrV7$1E*LT~fX*qc0EY;@%}X3j zvCX)dVP5pR$dtd0=A_~H+^4Ox*K0igs;2U-QC|<~6B-+8k?Myh^P93l!wXAJH;qJF z_5!sjTTR)%;*h+(=CfR_bSZu9PZ|;>H$L8|M|M0o9Lh%)?L``VS1NXvq;_*Gd0bkF zn~p&sm8uB{m-jn4_iqJS^aoE}-CW)htG3GK=`4fUKCZ^pL^nq-PZ;6vm!0UJ-kba3?zsl4fpZ@LjN&#<3w;_WZ! zgmqQcc{+l_9egJ9!`4-c)bz;UjjrdUPAOa(@z`=fNHH7JV&PN^Y$`Ha3`VPmY};}k z9(8|JqS3rhU#SY3sefson;C+X4JFyA&ca(tf5yHN27K@TEO9 zKm_h(4>oT~lDh`pBXEpC(`M(3To$9`3D;%46lkpfmN`Z&Kj|iQT~`NZX8U1oY47(dpsS&6yc-ZUHYHV+LJiuPO)H zny;>8U1b-sg@L*%>Cu*)gWNJbz;HHnKF;8i1*985&0Yfkmi*V6s**Dl_Wt`ql$;A;DOFXA&uQmLmaHuNb_1Gd zHJ}(MWpq5fNv$Aw*mbhuo8qe!?w+WZf9=zc-`%JxSS}JaOvl|l6x`(x~d|7N+PVlF~ zShM7~5^R;sNu;>!^$%8h<}ChrW>kG$tW^qYYk0{U9Xy-q2@Dfa(5ZvBN|W9#7_@bT zRqgA3Kw)u3==6bMIhtxUD&N{cAyq8eZPP#DdA)Hi%!rgK+SL8&T0#ZYU!fBV4*?Gf zuC6^`&m1m%0tAX>@Dgr(1(*HjYyIU*7xr*XR?TCi-QBc#i!PWP7HRrGJ+K{+q5?=S z`r$9{TaBmQ&w37wJ-#n+V6!be?-@c7M zDJfe52+)P=A#)^l7TbNNyEpG3N=%ezH^oya^urIAkNw8tWMKy94B2|i0-;5hba6KE zJ`lv0mkU{)8tT7u)rGV5_nV%Kl9hy2Y;F%Q4sL3|Q=WU$)FL;B?Yv*mOUFcgG;ekb zS-fn^HiwDQKk4KQjlHKaV-T4PCPNS-*r8Q@y2IYobnY2xHyF-+8O_#o z?%3D6qxeLRJR{^&rFdPX<2_vrQ}2 z|L2=F2M6naQ{iXiWc}av3_4;i*buKC(B6TWars0I@`(hT0$kYF=p+m$lrlE=OU7=R&IC0D0wiO2M#G}!oS!0@N&Uy@YVPbmdrun-zcY+^raYIA!>;7J+fO^t|IwG4oi`kT()7ndl0g2(u zkw-oL{`6dsd;9D%oNsD>Ygrv*irLx0HiccNmg)Ji^R@5RQ!*^U?eQu1{XVcnS#NUlbB~c zvJ8P+59rOU58)L4M2LtPjv3I#!J|7S4h@h{naSf%qrlM3|BE_e=roKg(`_~T#I!qj zzeF=BE{qPj%?ucXOu8Ni&iQ%w#KI9LIFSqd8tXz;cL?XZMuubCk2}40*LaA5e-pgiD5Oh?0h{ zW3xwOe41BQkyD0(3|=_yXSz61^6wW2DYfRRK)>)sxC}FT&ecn#!obv|Av{|d zV!w{V>S&*&RIT^Q>?Q>&dw%mE)gqUIOkpyv*r)5yTtwU`cFZbxRgyIoVoEk> zUI+NtXdSpSD>g5T+C@;OTG!~C~!3H*%l6{oBoG5iDGX2hg zR$bOr)5uU=4KJJrZC6TxdB-l*1ePBv_2_rODv&*7Ou-+=RDnoSH*OC`WYWW}P`bWB zBeE4sieS&op;DN4W)5Pgxm_JTvPA}H>~23Q7*t41k>g@FDY!4tOE-x^W(7;K$f-Ap zg2~-+0g2G;wKXRm?`$Q3 z)BkFK&p>D2_dtUX#=SsQtUu3C5!(tI)b%jFU=YNTFOWbiGRIhyYcl%$Y$D>8 zx_~6DG9rH^@BzscTO9ssqA#;NmRRt;U-_ZW%$GVn{yZl(Aa^1{AQGFWXu2BaoUoOHpdLOP{kOy?a! zI-`HC#v?DCW8z`UoS0%7sN3RxPJe$*gxAnk$=Q$<919ulJBfAamQzFchYH9FWGQ+_>mV*_d~ZZ zKN#menw7*LYr@UbU97Y1Z3Q0ta#kO$Xbl}%Ou0}Z4y`{Q`7@8gv^<*sBwQ?y;CPBh zxC@vW-!C$v&Lh!%%5R9q}?$FdI4 zgCL@~ir~_Yi$ zIFGhut4}j57H_r84iC_%5#l140=pY;C$F`uyt^Bn))Tv3H9+>91VR9i7cy^n{alIL zILphwmMd9<5D>6B$M^CN`gaCbJA}C?|8Yw@h5E~&?_o@{IO#h$0`!z{^ExyxCA#|A zRyv;r6mhAkg89JUlp$Dx@a~O8GxbdCvc8%Kx7Y zjsHjP`yZI#I8u2SY2Kcwzoh>f>DiV6I-NRarb)cb@k>|{g{E6u`<5$nUr4QPJ%yq- z{`}V0oS^wBfeVP6u!N7y)+aaIr^HGv!pqH0$BpkTUK(FI=+?))Ztu%7ES>=ZaL3C= z&rVc!$sF)js=?(}bPjn!8p3tH%7=B3n=>V?03yX3UvM~xS* zD}Sd4Ko`6%UfJV!;d|!msZ)&b^!_$7HN)>=d)fssbu1d9Gx&fM*4!@Ts^8jOjWPj? z{Mt2631wu~^=%Bzh2Ui2*bpYJm2|B~owJt_rKmcCdrdY$v`y@;Z?0rD`w-S0o=Yj9 z)zV@~P>Y5^QfaCT!7=@P)HK+hI@u58^M`f?=V$h6B(jR*biAAD4TbfwC^#A&_i?&S z4Th^;**W)@&3Ee3OHlm?SibnXW5j9)q$r#l;Rg}h^_G)dR}K+uy!n$*3>3);(pFG= zLv>hThQHx zNv`3W(Hle!IJB_z`+{_t*7`6EHip*CfR#-AmO zm!+xw9Z3Q+l$}L^xn(t8$I{BVB`gQ;Hc`nuLE_FzfTD>Wl`thLK_2ra3RSA8e1nda zI53Iv;tK}WzskrSWr6lQtaXp3ahTAs3+u|Xy%rQzl1;idLCV&*4p)FWHrk)k6dkpZ zcQ#CrjX|NvSM2#U)|LH-m#i7MnuI;v>2x*P zM>nYI9AC3c<$b2Y-O=P9M?(7-TPs@OlL#Tw*=U~v zfjLz+r-I@ty5B=e+p3o@3RT5{-R#_{)%a8v%`$78gWFs^|Ek45wJi0g6z_H}%AwzZ z`=er~V|W!Dya82N;VB8&d0VR-j%)Gc4(jfL%!Bqk1 z750{`b_sUt?0j{7#A;-?m*5k+(6F;gd^^(Bsi$A}&=oPkq52qJ_g@Ty*^5{zCn)>g zg%?^Ezp5c>*h;bRvL7R;yOgAD&WenQN6(V)M=>kxyZf4FgZZ3}>Uc?IjE&Z$LtOkq zn5Cmg216SJd?Bt`%-O^WypsG<7DB4ZV_6;wF21h#1e5#VALwH#*n{TD>O8?TADGow z!AINr2!@*K8$c~x>Jkmsxg;5ZBfG-psfFE*nwLHs3+pVFx^a(Ui93MiZxEHTjr5of zu}Qk_c>h63%qw0{G^gGO&pOYd!+iRstLRhTcqb8_OM|qBF0d-nV@+@{1`jO3X;{wZd2BTHE-$ZF{a(J~2@0RbUwBRo zDX9xu0lDQ&?nZsqYf8a>W?Lq@;^5lmN5R# zihIKBkC`_>9KZ3!Y!?|tDxN~49A2L0-Bu{INh##yP=V}tR%}FT7}696bN6Vw>a~dF z=-`k*?k&}g67CaO>6pKN&oIy$pEuux2Cs`X2SwpSi6XGtg@HrVwKd$3>lbpQ7}tpk z&2#0(8#HO*=K!MIX}eWFRl{mumXEfL@!LavI;tTpMU5uTwr-bf5k7)tMNkrz-Gf|U z_P%dKT~#@s84r-ndi}EmzE4K#-e<+06cvu2jPEHP_h3z>j$}1iZ*8nW`ncOw4EEvZ zrKF8Y@a78^P$P9K^cNe8m6#NWrq11o6I6Odx}z`r&Q{se9H_zLt++(BB>ot6g@69- zt12YfQi^z*efiG@pIiKikMipYdNAaQ0qA-ix6z%;PnD$c+uIuki#QPBJw{{i zx&Q6j3ZI$vLsKk-oBqciPbl)tI_g}szRXy6=&p!M(47AD-3jsbGfrUGe^IrNVSStP z+kpe|^p+cX`C1v8`;m|5`fpV(wl-sN9SRBpk2mTO^yfQps=!P@Pm`^vAiT)z==lhN z%s>Xqa`(eruBQdPhCgvb*2Wi>i#cRzLS%Sn33ai+KMX}xpFJkm;Hb+*PA z{J)ooy672*rAgTZkdQPHLf4%WFC`1!=*Qe2G^7DTl0i=_n#Vc8hY-zk^&b8EI|S{2 z>)$s|7dy?1`Q(1v^&LNtu|L4o;{LY(XQtx(@1zrq%$&^s>%w1?=2*-D8)DZ9^&`lX z3K}3U|Nm2{1z}L8P8uF3?8u{G*fyIYTnPrr(vqmg)@~D%0`$2r{eS8n7CkUj!?(_0 z^j`;$awFeUW3NwkY{K%0L@xP;ui>iacezPIV%lRL^l$PI!nO%l3PE_&w#R=zL+T*> z)+OS^k7haBkx1N(AO0JAH0&@QHvc_ndOFux+AT*%Fn*+bMF(Pdh0~_NSHe_vCi^Gf zg-d=0_fVqe!H^#RVZT2{z576)?I^dFH}Tf9mAiG~ zv#hAW9=c%C#|2Sp1k34ukmeS%o@GN&1g#@OXKvtTlq4q3X9PWUH`!uD=WP>o)Aabv z6M6O>a3e@LdXi$D;2HVtrq-=l2-KgH!pxp!sq*0XXdp1kOV1I-^T21Ch2h3L#z!tj zRmd{y8lJ?I-Z7W@nBx>;UB){f_ZyBq>QhHIY%C(vKFx)heB5z)mg&ryfGPsMO<$IQ znb(pcHXqi25t9bu&q?zBpYu3TQ_yk4(CZF9q>0T%g$^ z1|VB3xtdYg!HT6qN-bGt3eO{<&1|W%1va7&3ZbD_H6WxWBI8uZi{dG*{DOg{AC~WDqa5*z zB&aG{6CwXHBO;YDpBLNHVF+^hLMI*tIf=n6Ez5|cBP4W75EcjEwj`#+n95KA^RWhx z9DH$MG79_ss9}zwiH!jZ%r>D8FlC;=haeOx3YVhg?HO{AO3Lz;;5hvUV7;yTNzmX^}jF`hn zBH2TrKax_)G$W1a7K|EzMxI)&zz%cB{`OmvI0l)ihig|^rgua(HCAZsguj^58_Z#$ z$#i5Uz>WXX6C|Tb3dwBQ<{m|_*6TM4SQy{Oo*JMzjviBrQU5z#tv5;3Q$sQ6#=q2? z$;z)8*Ig{^BOf-CX&Eve@1bw<;a|c_W(Gb1k->#tl{+^cKi4@lfAwuKN{vIVj^&wvD||YZgkike zEuEz&qypC&UnaZx;n^N$MN=jsI)Gp}_J9w)?lU_|Zh?V6*zh<)%sZk4)tOxEx+(vc zgx*zBe2l^uR2m(Gpz$L+x%Mj*f5^CkUPg0eTLEQ$2*p<|r}t@q?wyTM`tF zY>$kvtb&+oEWBeQZ@#wA-H||j3pKoBs#2f*+S{WyH57t*9QBBM?2W(xHOOn<<1TO7 z>zU-cm?`|FvZ?qm7Z373AkjCmsQ<&c&Gg?vYgt)2{?~K6OM7Daq7`oY`3@s7nq`1yYS zF!+C6L3)HamCID64%xTuCm(PYmpk1#>*bq%1i>+V@IRIRaRuG%fFESl2|nEX!2jU- z`q;W+0tGXk5=1Y>b0Qg!PU6I}i5;YMq#UCcW07W%6mT4y{bk)fqTgM(q2{Z6#K{%! z9P#d%N?rdNmNowE1i&~-=ke*^^U(@dyovDIs7z3jb1xTBk_wXbtZq5^_O2I`!1|;4 zC<;Iqt<5t3Oln%wIQ*64Lrix)-JOuzQe&fD1Do=hq?@|Q&Krxf)0b0bnN~_w1g|M2 z(4COP|8*HgQKe|Y5c2BMhrzF0xG$G|3oP1FjF2$?SvV^?OX+3q=63%@Map>bmaSQo zZ4dh=4J@++oZ@e|4rQenAgXEY);?F99y*bM6yrf8@*u=^m1;Rd5p!(y84jIP^KV@O zs*@7*5)#^b0Lr*n^A9R?eSAW9RuvrYqjgclr=>FK&~$eiCsVt%zeQ27tu{X1^p*0P z#na%prW$)E(b0|<1{0m3Om}r4f9+N!vSs1+e!65K3dAmI+>3WSB&mE^0-5k=GT1S4 zZYe3?u(ocJ`G6>njjTC&+-Cb6rp2Yrf0|-)R_~3Ha_VpFy@pNnkbI^@4AM21|#seSXLN{NAc75xHP zP#h=6us2x;X?Il70Aw2}lAGuUv9OWx(e2HH8l;UT^`PA{yVKrz>uaNRm@4egzZX@j zow@JC`V=>cZ0ab!-2;l$M(r7iXPvPXZ&u0ISg}eZQ0k=*dtVUKt;%z>j@0eg_!7|c zCQ2O`vK*lR^rV|}kP}gzvhAArI&{r%R41cgzRVE)A#VAaw@Y!=976_6UM2(T-$Ey` zoFycuNf~0To?i#4*Czz!$e@PRl*M__@HguQ9u`upr;GE87{Rd$>S0yT#~Nm#M&&9Qkn@R6+H6Wv2jXU^!?oGg>f}{F=t^6riYB@L~RXf9##IQjX1I6n7oS|I5}vp*D+DCw*x+y+_9$^GmUY{k7_V4GZgCP!DaWHD1Ut? zMoU1|M&Gev8Ab?*A(oYXT+&xr-|xV-$-KKR8rI}^zUQwSYP$Tn`{nMb9=>P{edUqq zq!7aX+qlEA?Q*HXpcVj&0cQg+ybx1Zf2&~HL+L6dW}kur*}h7c`i`&Mac`E)0&vh{ zuTODqTz~V#x@y5#CWL{dETD!9lXw+Rg^H^8MfNtZ|VRa8p_Dh$R!{S$-=|R1F`U!zCK8AC`Gb_1ZWJm{f2IE$U7 z^oNRaIP&6Id=U_4=Sf8`R@;~ABjTd^WUcn{cnWqMv;X7Aw)9&SFl!QCXW9- zME=vK{|9+>4zWI`jXrxz)NA5@Np_|i7jm(;X7VpY{&O=WBv7o?oL}RBVsyK$c`A70 zE1gf=VE8EB%Ig=j4aSvl>i)AIMCR_jyZ*I_A(MxE91MZV^`maWqqHz$w3>z&tvzPwz0G8NweN% zyc4Hi`}wZceiGnvmbrU>YvZob!ci2!y>*cl`)RUM&gs^n)G~E!=kOxIonZ88etO)L zV4`&(_A)igML@mt57pYk_wDA0zKTK1kji<2k-bg5LRIYP)9YIJp=!L7%O`iFa^0g( zmTBhqCZDXFh5Gq@wJ((RY4i5dL;utId9QQ+Uhs5?dm0wUg~(paf^tVU9SOGAsy+DB zUKwT%^3vEjbiYAAY>abs4K0$Q^nJ8j?+{{o9J>NnvkD#{$m-khh=0S7KLBve0uv4<4o0k-gqdBE{j0W?xZKq3O2B%FDv6?MBFKLYZEH9(o zzVUz+ZLi2I*-P_@9o@;Q%Mc3K#+R~$O9fUFWG}|;+=LETqY>1Ve7XOlrle{Wuu#Xl zhxVuK{;|6Yg-!erJWWzn?DZUNQ@M5)v+z%2js#`JSg?eW5*1xzKP$b52MATtbR}GW zRP%$PY?|4{hv3rz6qdojSctuXqYu-mjbokNEX~XU{FuBQ+fKevE<%NER-hvY^R>1b zQRYx$%|vEox4Zg^2<#uAo?Tz_nG7ju6%@AxZ8ee1o;*M<#&Yj7av3cj#l{;kOU4$tZwY8e=CCYGYHAEi1*RnA#Rar~Z}~CZfT+sWgQV27T93-H}WI4SA@rr+ivu*fo6F z59f|>I?8Dk)UvVxLu-ayXWQBp!;T-JAh=~;?&-o2P_4@cEaBy=HCH*0P3}IJL3*ygN@7jj4Np3Vw*I0DW`f>1 zs|=aw1=HwV|7Cop)d!~gMPAV9=E(#Wsrss%KB(UG^s9SKEC`X^5d9A$l@up?S?oQH zS|y}3Ct48$9&5}ca8WAdE*SaD>E4tFYiR8LM@Jvh7wuahk`2ftqcvLk1H0&@FA0d8kD$PTeZM9dvFYu?Fwrgeq)E>2Cq zyuWMcs?wZm?$H%xnpTwX=;xc=ePJZ9{@FaNJJ2HblGdJArydpdW;naL>lKuIYEJDk zZJoG6XKu;Hnp!ORRSavpq2W=MUU%i)_f4Y43#+qIkm-^pNjl(ZZEgk@`MC2@3BRA0 z`-8&^OZFk$20I=0w1sbk-N$o;KbfHAQ8D~5C%)qR&bl(G8d-fu^cK4SR%z8{-zaGU zFF!keeC}`Jm2esYZqAq1AY8K3=SsMcN%6*RH5|-6bYvK?HP#c;wbUo~QXWZv5I8x? zbriyj>*|i*fu4ry1JI2}jRulOI(w+nc&Hr@k%1`iX^BbbC`^#&V;*NP&?jLB!~nsX z^`NQ=gd!U5s8Z@tuZk1Mn|Bf1BjA{Tn>DQEHm4~$pJubLp4gL$lotBU=q4mRlUMIK zxv64{5%iy@0^O0-8?>uMM9pRhXoNX<12XUBq6$*(KBdU$=7CG1_z8mIDLt>Bxq;yr zg?{u=%u`jYbupLIWt0w1-!smmE(9c^T`!0I&uC>k>GX%{s(`xqU@47*J+Sql)kjV; zK)TH#tQ?5LKcJIMx~JjeZe%7J+R5}^E$F8Hl-b{A8IN3I777%`983!fCyVI@ zZH)9bOQ+LnP>~v_&#Wwx50e#8p!XnK51HV^3C*NeYW@%4a(%TON%he{HX-EHcOm-* zR-1Y-9xlqvZ}%k;m3P30e2WBe$~1TFp$e3}>j4zn%|Pj?ZU$9Z#CfzAblqWOnAB5i zMcY|BRg$$zjD0M2wsMz3JTQ|AO-1kwD#J8W9yMI6mCD&Pzc04%y>2zA8yHnHM4=~_ z!KuW?2~u^q_870^&X*YHf@P~H#G;>QCLY4y^-4tjkEtrOkNU3^O3jE- z=XeT_Hn3YIa@FC)Q?$!2?v;d+E>SHtgUYVnpr6%6M6~tH>U6h|a**!aT=~#q1l`Pg zO8*$!40HjEdHY&YlpMABf-u%Xwd8?WMDl+ATFu??>z56uEj!eiqs1X0yA;AMx81_U zRV&0cL6H~fvyX?%$Os0YmX*>L##7-y z<6<(Flgx`?Agc7$`wJAMFewn_eJDkjGFdKV{scNDzHrNq^7g|x-Af+&3Pr%1_%ImP z%|sqsZre|4UT+T6<-hEZYC2aepelDB=njk}nDb1}g0A`l6RC1YW`kRG%R8>d6DCHF zs&+O_UGO>7ZS8nLXpz%ck1FGyaVcz(t9oGTgX@I_*XRRnEO+*;xS%Q}`ZYCZ&xZ%9 z6@kEsgn>f24%Tu=YoCEG%N~Prkh8ncufHZg;a>(a6rLXzb$T_{2lFdL%5_zK%8INJ zBLpF=w6DU0f=~`$yX>p@7_&lB`I@gTl1vLO0{(a(MTxFae8fMXY1W%hSJn#1dAb?+ zTjm4;Nb@_ot|8$WLKq%V@04t8ijhS?Pf@&lJ*v50UzCGakLrGnZ@#yd1yL)_!?8Y6 zwpz9+(7AATjR+Opv(Q(}mJ21>tpBzF}m)p~us|`7Cn1G`MHH9n6HVF8a&$7v-@m@b<SfDe`fX8%Z2+;rjNMp?e~G|lgS_r58V=59fZLJNM%ag_}Bx6P{NCp z#>DSrpvT}55`gx=falNxYA^>MS+)LCtkXhoY)Fw=XMTH?PqjqW)B0}&eP96#$ok7A zGN^!MLwlnh7Do-2vT{_vg@1}k@~>j5yA^Lc8D*z4Za($r!5|ej(KDWzhtq=~#(2jx z*@ur9)>y_Lv`p~DrghZ{WPlTOXRgrHtp5P?dva^# z&fE0J^LGHc4D)ElFO-pw@ykl;u`|M~<8(XKc8x8=c3}|I4%>%@`&mbU%F@}xoW%m} z=<_=44y~imTUD4A<{Psq+-lP&Yy^risgF&;93L`TGJ9b@H0&`mi8ITL1KDr7CcEIs zjIXW(VA8<{-yLiBv6{b&P0fzxj>kb~w90hl`s~*uX@M%8!=Se4c@?Y&G89u9k)S(M_^3kBc&9N78#r0`fUS^?(%Pf|WpGyDJ zFK~zj_MD0(h`64)pxf0CBt@$>01aENw2Wp)yRCi>CvdMG{%l;Bu0i9`6!{QjNN!Am zVv=RGy7NF`R>)-#Zn^oP?A~WdxUyPk&j3`mNX4|%H z+qP|-wr$(CZQHhO+jjS9d(KQU$$Yspll!}pN+ngP?04_ySqo$wOrmZ4CJ-f+rep$5 z>*RH442F|fvGoKS1Og6Z0*Mo6_H)4L{hNrM=x1W8oURBu2tMt-?d_2M;p6P~rwl)h z|HqJC2}TgavK)inopo zwnHyP?Lrz0=N6EU#>qqG=**qg&BE5BR=N)V-gEQPswgK-;;cIADzBY9`gs{}ejbkM(2I!Q#c(5_lbhTy zZBr~!mEZpyvZj5KJZ|&eN1>RekeNhVA3zmE-@^iV`2FR>%PE_sx);K52&_7Cu-O7>XSWy=&o| zhA7Oz2#j+ABUn=PrNrJ5DI|^Z8h}a6_tX>CsR@*>j7}#7$|k6bxYaNp~T?HfXlzA+~K4&=D~!ig-8# zH3I%gMqBI5S3+O%BxxTwGur;^uY64b?N5NhwyX-Psy?65f|Veqne^(sLWk{N!7u?B zDA~H&3TF>UJ8(qz9P@`dt+>{vYXMad6eHXas?-WKW_Q^aV8p%^(4omgQUg(^%3qlU zuH9HZA|0_ZlM$uC5Egygt5A4DN=$G0fhud8$c_&==Ynk0i;p@S8UuL=tsHReP$gYb`X4s5)O=vCBVw%?R!Z=1CKT(NzS;wf~{sOjZBN!A`VeZA6j zv~_rzB!0yrarRlY&PZ-eX9MIPs%4})2%gHIa8I-p23-f%l+!FP0Isa+@Qa+;*J|Ej zL3;lZs&*MI5oU5Ib|3?>)*vrIWTpb9(gLA$x(<`V21Z6Y!i7;)EbeHaLs(|9ob(!o zCFWh#ZZh}Sa$e#ereV-&6mi)&_Zdzlh9)}VQVu6q2Id|oNPOlvNC-JO;3XuB{^KR5 zQ-KVc1Esg`T3Oxv*;SkO?&N?o%-c$WFP1ye+6DdQAY58S;O1-9T<_NL1g(c35;_ zDOr1Su$nv5qPogdZlEQt!PFE+9tp%tD5%Piz6I4+IDMPKfP7kWb9qyV{>#hY@*&XO z<-sN+_?0a|9}gVE=fHd>aRPb+<+lUpb2*DvA}DTOpx4_r^QUgJKqC3Fe_~DAmYD*KAFPthG`5A4+406%hz7;qv1H9kyS4tq! z7m(11*fYg7iZtmnRKc?7!a$mXsP>SCaoc3r<$>S~jC4`dnQhvJS|T`)NnHs59Usc; zWhN!iUPZI%fy}tLdz*+tb=M0}tNaP%%u{iSFRRV6uqjo{20>@Rx;>(8w2iXJUlGfd z{$b@Ina5yDI3-^b*k+O#HHD>T1TcaIPHNXq(}6D150N%cB$9*%NSY30v%{T0GuF)5 zI^0Voycjr%v%L)*DN*>C3;W;)&+KB!vofGKGTwEYUD%LMrIp<^7_Kr@H#d+Gx66i5 z{^$pmg7A*0q*{`ca|VlUlMEv*qg3`QYTo=$9j=mkceiyOKR6 z^|SQ|c;Fviu%<3vl9-_lU*XZDEqQOrI#bKbAh>EWN+CO=5YC{9#4cdd+1$f?S(SdL zqlV+i7Eq*%kYVFZsX)P@$4*;N$v19XWZ^`hm$zD?o`E_W_o^fn)qXQWrSU+Ak19(M zi^^6O^=u|pr?#k6>>T%^#~SknWC-W$HGyiRbS!i%>1-9Cnb`hviw663$n1D9y+qFj zj9xhsAA*zpHH$Bj)k?_Csg76hN6D=!sO(rd&0>Jbj9d0t#rdGs%Wo9EurmxreA_N< zc+?xYlIg;P7dEgH2B@#u6*xorV|HAU)}_AFZsfM)Upma$Vt%!H99TPX6)9gacERZY z0ZWa1H|UEPswqP07teh9IfmO>6S2ckBRt;^X%9$XRw{IvmKET3v@aMd$^!&q3jBXq zSNV)p#gxW3H#t4vd4*~Iu|Z|4nO)iDljG0j)mVEhOTcbc)U+t6kzq&gYnMZKHlszn zl6&8hCJL+eXImc}{~e8fO=CaQ`qx6(uj%UcB1K@P?LjGLV%pG{LCMAhOws-@eQ&1S zrNIeB0LL^SfQuFWBiNi-ZB6f0vdX<)R#q*%+JBRRJIs*@TCCsu6Si#l=K2c zj!Llz`^4d~JUS&w=C9`L;<04{dUpy4K?92optS~@8UJ^_QXeIWT?&?$yreOSl}P`$ zMqjWGGi8#C*rRf`4CajEaB4!@PjZMQ?4wt8E~viYIV{SP;>rSv4!g^?m^Loc(4 z!lyy4M#u9hG+y4!k5$H`pN5U+n7LG2c&JJ^D{+!NaAYO9twpL%1Do5pcIQe71T)yx zPI{Dx8J-e}*#bo;IoDYu=V}n{6K>-08tP;5Q@$E(!0HA_$BRY+&#YsFdVY@SFevaM z)74tebwtoBjmfO0L$j28bxFujZzF%KV!IQ+wZ{1STs(jQSGdXf<`#4PdHPv@Gzt4= zLnoPVmsNuaTPmFx6p4jOl+ranm4uGmy!;~Gi$}ypG&7C?=m1)2ItUSs9$kC%!dEAw#^SyX7DmW2s zUGy3Kcv2VmK5ht6Q9T2&XE2^B-$bsjT2*h1KXntBHQeo;*3}rvFlkriC;PB$S@?7AB~)Xx-q*jx=Uh~b z5R$)?<-MNYeuD15&+xy1X6jHR|ChBr8{>bcG0M!u{GZb2|06&1aBd6vzwqw#x9|d$B!j^7NBRWsaj-u zc69KZxY4Zdl6cv25qQ<=-P1>P_SNJ!u_m_TZFA0_lS|BmGfv1jc(t$zF68R&`I2p& zrk`u2V}IiU}=Xdu!^ z&g8jptCp$CKDq}TMjl1eI)2|?6y&{sd@^k!eLtEmEizEQery~Gr};ELzJD+Fmg?xu zwXQfr7y#v+q!Qf0AkQo1QWKCY;b?LzVSDeAxp2E<#FHs>3&14d8YT=&OoWnH=sV6J5k zm?^c&A>nFyxsy9cv6eR&qZwB&o@}tcFLwXlR2OBz;dP6FXSV6|<&NPIlW#tz0K-}Q zxvqv_L~Z$J#Dei6)boHdjAcz4StlZl1s!ON2{4VG%?_=U(jH#hpN1A$WuLEQ*MpAK zFoM$=L3BcQkPT?BZbLJTa_X4ZI8rCfB6}x+3BonT9u9jCWPj+F{fc^z@CbZ5{3g!; z;#`XwY?m``ZT+VPK82hK5cN{)dI<;;ujCQwfY??&mdMBezlfxG@g&pjRnTf_NYQSE z3I?HhP3|;VLV#}7B3plr$oSE!|_g0Ye9s*bNn#cCL??)F7S_`VL6V8y?r#xrnYd0b1}$YzxNC%rj&|r~ zW-5lMde^H|=#^4f2bT7B7P@VA-(%AZRg=brur9Mk@O_9URbACLES|lwvDNmp?BRX| zK>6p*>haOW>I#wZ-{be6>tT>M)uk-QfCYRbQttdo61=2xQy&sf1*+r(W5dtDMBcIt zS$Aw|cV^5H`sGQNgYjAR&J7;3K~GFZ}ChM$(K? zhMZ{+`8xNg`-;I-U)ir6gJ! z(Pn~HqEb^kPkDW-q|m}M;2of%q1QS9J^j2mVB9pDxhTqSy);}~v z6P67d%N|XmC9sDL|7=_+bA;FQn0AgDQSHfA2~0@0zh?T>>3ysJEDRow|vekx>)>1iBFKu2X z5Ccm~Ur45a>7L>XE=B;y+vdkIY`(wX?5}`5tI(aLFhm8WAbC5M_>>(f(r%5~6HuWD zVCy!Yu?20L?kr}DVVfYn7AT_e+Z}hnCx(U!P7C_N-v|N<8oAR4whLfAoA>xmsGpft z=;zftr7(0IxTUrb8|~h)e*|6@L!XpEc7EYPY~(kV{N|0icaN)fgB3C$X3=bdQ8m=a z;P-6{5dValq`*K1@ejTkLYxY=!5%QY>4_vQo=tg;Cl_qT z%{j(V_~Y#vkX#3H6OW12O^~gP?!V<2E?u92MytLTKfi1A-0Z&ur%%N<-2mlDd;2)r z^G)o>KehoMXHXe;jzP@r$18)+C&>@lUD*e117>N=<@~5G_t;qYf2rL|m|(q0FKQ8> z=moB@Ch2xu5FgvTeV-&JkK{w)=-xSLo=Z5u=72F4<_!<94yQ%kXo~>=6?2onrRl=M z)~HSER0>!^_DF}9PxwRGnLJ)`3q}D`^S}7Qm&7J!UEPCPl(}sR!7-LNGLAbUlDj+`d!v|wLsDCVF6!exRxd~-TZw|>N*gP7s7~|EARFM zTINA?O{JO#65iQ;_*@h@eU8XgZl<%CP1#a!7-~Z5Zh52NwEr@Ys6L;nsgXYOBl_xg}jtU}L15m8EyPq-Y8x*uS#*k}kDG zfS%J*%93ME}5aGuS)HF3CyujcVPRzJw+5*Y0ULup=hkVAPS~15= zuY~?6<5Zq)1`-NS)&K}_IiAKQRSTIPAoyALaqDTsc>S~Jq(FHmITwkj49L>FpA_Os znaM%V`!AAEclqGrU}a+3Lz5S!RRuvY5OW9yp$bv~;a2mnc<$l`0>FBt);M2Q2r`#f z1ot{MP>`qWMAqrJDOclpkqsHaQx^ATIu7K+_)7<^s@~i;myVL6E3<;fhgMCTny9Z3rCXD~T ztdjd|lE4zP@-do1u+>zGHm@?v+2_Y$9ws%XLZ48@xkp^h?wKn<22yZDE#rKm^HiKF z;y4{BMh}{Kp4&r*mrH4?2c+;^frBC%_3c?+2ex~L4&M4!RzXcbaXP3KAGqYe8Ck4> zaPziyIg)ivBKq~#F$bo2<$1(*1`)4DpYVWdlICuI-{;l>%kYSWGl|CI+j!rIn6YJT5s+oYPg{_uf^aSUOVMt&BWnoX zI;%3nB%m>L;f;i(k-v%`HW1~=UXsC~#=I;{`1D@@fB{t1?~Ik^2`rCRYXuE48Y{_BHw@WNVwqjrGP6yt=YNATzUr@ zPSoZl{{GY*!$m1F3jk`!KGuBqrC`tX{oK$4^qO(~*D;5YftmTgHRrG~{0GpzMSCKa zx$S@YxSxQA?DhNu-~bJQJ2>C%1mQ9j-RK?$I*y-pwj*g?n6O%bg>Aoik*fYwpH!8& zeBO}R;`|`9liSULoeteRs<%HdcmMQs{G5#4%<*Sr?bF;7*z&J#WiiM&xFIJ(Qrq$8 z{(7HXKD1i_uB|w>oOeaojp*37)A8*jK73amiQn2OO}wSO9oWO4z)zX^V)Oq()}7Ej zd41HzwBet;n0j``M^ISlP2iybedw z{5A*IUTVyGX+OH8c;rnLX#*b|=<)x!E_3`xuTjrJiq2m@c&}3p-p4#(EpGL z1Vmq^*11sx7_oXP=XT^bv2d(qOSg}QI6YvJ4w|GuoaITXX!9jDcc|Pus_I@TnKYA@ zqB0M{G!Hk5ONYC+TzrX1g`X1a8da zzKNqMZfrGK3lt(8spUR6%Htnr7<-=3izMRAjxkvX?Myk2LS`5H_h1ZhWb-&GiEuay zxsSiTWUQBfaScT?Cu^p(g!VajTxpzb7az$^QzV4YsG)>KkR(wQE}v+^WwDzefYLG~R`a`DtTgkB?+Hg}C{__Ik$=d4)ECki-gTDJUK0TN= zzOqxMgV;Tw6($Busml!QB?FTK(;0Ns)NQmk$ppt3I=7Cw^xR8fXmKdnLYZw%o zkq&A%)*6#L_&vI4@lcwLqG*SIMc`;o?l_%c;^25=L%X-0K#(5lDE%amh03W%W=X-`%inCr5Td5LS-=(%x- zlR7I1-I9WO}c>3KXMZr9S_s@?%QVCxte& z+^XT*Rj!*XBf>f@Rq53_OxHo_r2Q}sh#IqygF?&O9&-sGKF>sTe_R&Xhs?~PV_0>M zCp7(=xuWBI*_!JSa#`AK21T(tu6(#t-cc*;F5j<4c36cjMdIv114QU7v<$WpHLI&2 z;)OET(q#gCQ1W%M&Cvr8-?)+A3~5TzAlhzlKB#BLVcbzpwl5ZhS;dYa)BvDQ0kJ#- zxN;bP9{?ZUEH;A?eT)UO_rg&Y1{-6jQsAw}lA+SRE`?*ZitNwH9G@)I3*adbLWnKO z(&!pn%+L|*->A($uXm?>ukW%8k5Vbi?Qg-ioop=jR+$bPzq+p_U)hd5Lcg+s@CqYd z)aE?oCFqF@v|ZqBSV0PGbQkG~xo7~N5w>Pa@CkEsc~ zEY|&^`j}^HC6amK`)8xu!p522|3a3->=RT2>Cu1Y3MW&JO#%}t&urmFsi&nrdmB>Y^MOnx{58a zaW4{#^-L_nTj5_$P@#YzA>#Y^k$^NBgf#^`&_36L7s?RRv&qT}A2;PjE?*f%M&>h zww;;Ys!K_-u!hBjCdEA921-Y}KeFaDaJCL0X9Kszm3sq`4c9wu<*h-94I05T!zRaP z(0ZDP1MM^9;<8Oc^{I7<%|uX&assS?S1Yo(bm#q)i0AQ4PS=_fPljHWyj2Pr=p`hL(N2tZ80Z z7m?aC(v-6XQW0B)MvmsvECOr^Rh;ZdJSE;0 z`iLS6qfmsO63^8{|IDAu%gjH8f}rdwm@A;f#o!CirX5{V+8h#(?lrTEi}lDsAa2HA z4+AnIF0_RN&mrx2hX+?_Sc^r(Z|9wsI-e;jf~P(~r?DR5V8xoUas4N|qI_sqT;mRnO@gz?KXqJoz*qkvi-aZ_vc?LRx6axNBn42AB^%l}8;tO*lr}N(Xq&?LsG)KSPV!6Zmh*P3jf&2lgH=qD&kl`^PMq&= z#3&dC%hlsqb!9|)mQcHqpp{~=k8}thG_(Qi3o~}nAqe8osp}IrS*6rmadlgA!34(l zcm`7a_CcV&NN9R365)`NeO^LRYfxf3l>(M7d=Vs~6YHNVj&_nBag51Ut@%=P1Zy0+N32`YjA*a&ap<`2Ut+)$smRP0b6u+yrbP=CjNCFVUbp7hkx!Q zSV=wJJ96i&uP>|r6cQN4!KcQX(22iFDjGWDCr>(SScM!sd~EO^EU*u~AJHwzq|n3h ziM+;V!gLgxI}Y3n`I*!^X9MGiVSJ3*Tzcl5Ij-Vix>MDH^y>+49cvBsnzFxt`@w%= zO$bhO*2|pvbXf!{fb-5xdJ$lYqmT3gn#Z^q?dhAlR63AApX_TQo0u&pqr_>}S$8rC z7Y|AgN*_>YwI%yTfc!vd4&*{nT0Fc_f zlCnkZN2^YQvd8U5gPEaer`4Kz@0La=v3Tj)UQatla+vKqS0qIqWnfX~yr= zhPX%M4?EV(&~n&iaMy6weOK2tIYOFg#!TzcrcFm81uWM4$m5SM4FzwExypDbyJiVd zHhl^t3%x4hJ&_=`&*&&n%**;r9RjFg^I7`LQ_lr(mB#E)vb%NX9D5-Y69JJ=5uhkO zWHi2^KwdmPC8%YKY2IdyjgeD2+PL5ugTOkdK27*#anx=i=iNiDv-}wLk2B&g(Ka&h z=?wq#XcZqUm3kkS;vwxy#(PyH0(V**dT`9iC7et&J-1Ywb=u4&L@o}Ul9}4)jKgrf#u2u2Nkgqy8Ia}vXy@V z{TIg3b37Nvre3{74y+QFwjd*HsBEwy8qbmc^8Z97 z0F&CctT0n+hX@G0$;_l`xnN;}3TwGn((VoAGVKsw7BtBqIBE2lWCrXc_ux2$8csLC zA{@=1dqeS-(p1sYMSnN5>#fEXJdZu)!XtyD+Hujsn7YN2b^Wu;ozMX2(4v zNye4J*uFd7WNo+kG{uu9NJGzGSH=9VRO!KcXr_Cg%Ey1tfgfjBEXK zUn|r)Xm*qAN_*j}YwTeF6GW#`N+Nn!Zr|PfO(VBeb-Rgl5TX%n01ixY?fZ3z>V|zt zFZgapMVLUg|r5Q*?lE+$%QJaSh9Od$TL)($w4)()Eso(z2=9|K7V%r{$wH_V#xex zK>?Hjs!uVrqGLoTZLnK=Bt7)RlAAXnY41@7Me!*dY=~Gym6MJ{6)je2d`W&NZ881D zRIS3`yxXKuK}aaLw*E^X`XrWRxKN5x0U`7ZXipIot^fQHe2vl&%4R+|p86V`d$)ba z%Z0j$L3>#!eKd>70V#d7T6-)?NCS>rS|bD8P60kfT}1&jwf~5;@*hY}&kLw3R#tBV z*q?_;^i+|H1sg3aPjS@PBXr$~K}qU``H-btJ|+bA;nNgq?Tass^X&!hUWz4J7Ln*# z^x*vETr3QZpoAv`y@37!c>t*5DdohV_CPzW!$hV`o%t`BDQB`e2l|EpGEnmBjhPzZQv5p~3>e%Y(ed#FPRO zLY^VH2iQU-1}^PkiJ5#OyvanE!relcN_bBy6yP(2F39t!NY49dfjBTMIYkvq zwDy=3`6S&Ko|M{`*w$)LdA5L$0!w9i2c1YqGBb(Z|I(PIL8W9nXBeQ6AtiYO@g>g1 zAvlBaiQ1r<=OKs1(%MI83Y-55z(AVPhd~L_79Ux}E8SuU0D?g$vG-3iTQl6Mgv+T?5RecZat3G0W^2y)0Z2@PSFA zB=P_)$)gMTP80~;<+A^-rheW9^epKsvmEg{Lhi3~~0elYG0d^xQierL&l3GWh_y zQKv|$_wVehU)W+`PdjApj-*R-7!!yx3f6k_k^F{*Bu6&&tGl2HJ>(9*%f%}Ek3%qGS$BBy4Y`| zTEl|0vLmtmJF?~9fT?e!wIMwd$_!$+6565!;jwgrgFgc#Ykr@nS$%EG}3Zzu>SOkD^m=*wzTUuACLE?v zJl3MPI4Ln`UTP|np0g9kF`p+4iW$7RRYR~!xT%(BioF(qjnWJ@D%8zmOkQ}p7-R(G zgcsBGNjeF(v4bjejFOuO*G*9(F;$s_4;XY2Q+AMUEH`@C8W)?UjO7BKQxySRtOmH+ zu1!xzc$r@!QSvi#1iuS^wSEK=5P#3?L-N+BkHKXK>l=0%q@Ige8I~LE1DTH(+k~%D z#{_A(AED|RF))MMiFJXqA)xsmzI#PZr7sPD?(e1Y}$0xW_-Gay(B`PqWD!4 z3EwGYEYgd{F`80@jjcG%=d)j@{3p=0lvdZDo~ldiR6@-Z1xIS=mqKyyAkIZxoGve+Nwkt0VySrE=Ue3A})3r zNmsN)CKDJc(enolFMl_oI%`6AEJjvu4Bl_#?|wdCEg6UHZC=OPZ_{+#HSvV_hiyA5 zhxn*mx3}l^uM!U}yP+^r2dm23Kd6WHf(c=C{@fXjRdQ^TLvJ--o!D|L8=Gi)v4%mJ zltkW{n`}~^j;yUloHme&x+_9klB~1`rB^BR@z-2h;)Yh*e4OO@cK^#o^oai*N3YcO zq52zz82hczYP=Yp^?Fp+4tsTWvh(?*=6AdDP@;a;Yt2{3S1%3HDPgl;g4#)D@%MAn zbhF`%7+bUa)zicJ$}E7zijb3CTk_W3Ys@3dCWB_rgK-$h8 z4>KY5Q39{nPdryhk}-{(Nwd;gZ@2;g&uKCX`T{hCsr>p@N~}sBsZ&#FV%MnAm0e{K z>GX+6r6z-V=`T=|iZi*zqGh0vKUpu^WbdYs@ez+8QAk>6U*`_IL(|2OBN!UjGz{%R za^`|zHcF(0TN6iHbCd=KBasV){p^aTSX9R#F~H(sY7qT4P6?;_)Yt$zop{R^zE}ke zv1vbQiD0ym9p~kTbP=3S@yX#;xpXj?)R)z=j?x{e`qX8+hmIr86nee9W^#{4%Sqrr zFi1kAfrvhaAlWzNR8|p7USV^r#jx($Bq|dEcNK__Y?e19>5+0@cw7VK$1<2&MOwEE z;7MVW3yjY-`m1Uf{|eED&@-bg+8CPM*B&Ly&_#XtOs5xLqOjhRusPemshYW`!G0fw z*=o)_WXW)LdHXxcC6x&{%y^nBSnE*ps`VaebyJJfEQ@X%KI&T;HPq*G`L1e2K^W<3 zhK>&InGY|u{y8nMCqSC`HWlrR$Kx7A3~5O$6p_0bzp4`s($5;ruOkT8<)Qampvo|s zo?bY_YwQQKZ4oR<3{cuogmV!~uY?JYNQb`n#Zwu7t*jO+x4`_SHMXjArv9YM1K_D5{<(E5E21LWEeGT zo6*Jd@50|ToiKji&yJnpPRrIlAMw0zS8;sbN&s{~%DW5#Jk-QjB*ktttjC8nS3>&r z0~s`h{h^8h3c5YqI3tteHg(<%KzhJ*4pD8!5L<;B5z`Q#>rHR~&8GwVbjsYudnBB? zNJrS?sS^Fs)A2+2l}@YA7hj23z}fd@y%`d=t;&e`Jkzdg_GcW{LPnw-DB`8Xl0ww3 zy4)Zcs@m_z(m3Jk+I|{&>2M$ck-~9@)9~VPkhFLGl~;z&vC52OK^o$h#{T-tX0Cz^ zqRzZF8I1&Z4XrUBJ=Lt22a{CM@S5;&kA#du$f+Fx%P<8Wo|~bm>>>vDVWn<>B{?P{ zF*ER&`MiB41e2L%8Lm|GWDHdz4I%-D?Ni{FtJ~#$O}877B?duqEWSle!;{HH1O_fVEDNp_Y7$ulzN14m^Or0RLaTC-rN?@ZLkMYKSMzKRY)qd~Hs`HN zm9?AcJe_#TMpe=#;!jcnhKy;MqDUQmi{litz&nstp8oF96g#@)TxS>D&-t6Jo#I%! zeHRc$%zrqKQzIyZ@U_tU(X{t`!lU1Da;d0{p>t{)$b+TSi0k^F^-vk{G&cu_h@ENyafyTKNSfnNkf2Y%DFbBS>!w6gN$W>{J9cJ|cEN(MWsrc)= zUTs!jG-sQwab%%Ba12APi{9HcLguHFWpX$pcM1HKLs)?z6~rPZgs%?|JbJA33>B%^ zmef)aGn*qZIa;pQS9Qu;qkPxc=9=Q?h=fI6c;!Y{xuo144X!F(^jub6Sk#-N)|-R4 zli2#!L&-5sXJLTH&F?Upb6s!$Xl65E-Z-LODU6X#ANC+(B>a+E=-3+f1%D!3{azYc z4_lw&EKs_`O9o|N?;H@aY>jm4gm}6uvIb)}r@@5wlZ^PLb6QyChCoRrFp}vQDO^#x z>h{&jVIMw~?Zir$pkCw|myBo7@$mv~MJX38D|ArTI-E|&UKQ+(+}5}IZ4yvqUS*+9 z3vDs5FX+uO88Lab$W~W;pvK)yA7E*63x-!k8#Gre^*2b|Ig0IWxh{k#KW5;Z)3Eg$ zHt#U@t#_7j$T%?zMo%S{*Jg5{Sez9UxG;%GVmjbzQfv|7R8?A?#j@7~FQIKGCJ;(Y z@XTFsYieI$gx21inc5GCJ?l~7nu3Rklx+5Qxp41x8T%TCxtiw*`)NKIghV@+x)Te4 zsv9!aZvd_~TxM>F)JacC1qxpgx5^AVr#1CM{x@DmHb?xQeJRs7R&|HLNkO z3ScsV;#UdN;TiT+OT$c%teist=HqVE*<$^sv)&}XJKHQ(36!*os3j33;+i`b74ow_ ztj|a@7Sqp6t+Ehd2EN+-^D4ZBYw7{hkYo{u({Ocu4Q)uyUEn0A6*eS{ot0sSov^To zLn~%1j)p}t8TPVFpPU|Irzs&8mWN=s>6xFD>QUwxn#%9&-Q|;eu}Q&xgYYL4JKCIo zcx)ZtLJ>=GTjoFpGA$vtz|h$d&LmLE*qKmv3$|;fp+;|71*$M{^HCoO6f51C5(#>@ zJ=)|<$Nb~ymcz-qXddN@Ubbi>iqzRz-8I4oy|eRXZ^gx$%|R?c zBs6mpM(CqiqAa?2(S6j=-R;uru2c({gqQ$bU!=9HpO(9xk0nfj_UCCydyT}*xg9+P zh&9DB*+AFy$-0UTZpHU@jjp}g6IE8$*a&~s4qwl$4%kFd4eFo81xSW^oE^R9IPOWBkW=r}> z-o-WnSNH-m<#{!iJnLt+67xsDLuQ;^;mPZ_k4oR_L8J1jiAz8;XC9^-*(7JKf3+EemMJU|D^5rXgPy%m z!WX$2DJx=*h41xjO@)Y!D?7~39b<-b@d?Vvf~UZE+o-h_I8A*r zeb|=^euXzHIjSaNq6N7oV`qnEXED74b9cjPqm)Ad4asXJ(do{|XQpOAM~nj{PYC%! z>5&BwFhe>45t}dJRq^8tE;03%1SpGGsrXyF?(Y%U?zWWKbE2iWlAb~wB%M9D@_D%% z8nk5JiHfYckpw$TMl-+a&rvGl*#Kr+Y>KrPQ_Z-d`S}Cba14JDI$?2M(;y4*aueiq zrekguayw6%so{tN;$6+>H(oX%gR^{lyr6c(=}$jgOLZ2p(n@x^IxN!mN?=FsV#m7X z;>*MaN{ILujvS$H*DOmqEfYC(BRtI-ERfI}Ae^FXRAFVWKgr*A=@Er1P-Lc3H!x$f z?8^JQqQ+WJ{j(gRkf1 ze17NEm>WMcO2rW^48u)LFG5V026p)5F3D3Dk|=CvAz_7mJ``Z*^a_KNu4`=tz4VF>Dn5g!&bJlbnGQDD0$s-4ziFOezRSY`-H=fNI>;-r2{d$brJ!Y4H4-%R*HcPM9E1gtZ z6XbtmbfxB=urIYjb5vZ6>n7lD%d2vD@70=@k%YR;I&~?aTUZ5lgKj($+E)7VcB6!_ z1p0dZY>V290U@NlgRa2|XUQ$UlSmYS(<}xsWagHcvM`%aiCE@1#VMa7aPw_6vN*YP z=_ftC0TcfXg6?YNQ&~!)gazeQuPr;p;>?+wd%nKyvOKhdr6*)?K}}c0vgn$muNS_S zA9`7~CbudpGD80Mt)MQUrHdSw;C7IaJ0PmvhyB4nCBKYLmKqkP;yvPE_DG1%zd3Z( z@kg&UU6na^lY;*+aANS$J+Q9k^2x!g z;9~sXnDQd&?z@{vaNba3GTQ`y^m?!i<8pmgdn47r(mZhthB6iQ(wqs>?wqJD8RUkT zDb`PY16%Cs=UKk#PQ_oa#l4=m`hdL(`1l@O-N zj(Qf4->IHy1{2p zPbXRAMI&N*CVPqf9zVs(rL?~K?L%r!K78)ydF+-i zJLC6f?gT$=FIU{4wD;%7>h;WTXuZE#&H0`>AHYH~ls*pzB%OW!8$S%6KU$;~D7~Lj z7j|D01uD}RsxKMscQ~Rt4II-$PoQp*F=|en I(tghdPj;9x;*L|Cnj>Z?%J>@3V z>&J3n4J%{LL4PRt#X`Wn+C;v!6kyukufuYNgNayPaJc655Ye0r=pGdk#NuGP%<2tB z;e&A7YSAokOj2iH1n@=D%KOS%9ux05Aa4U=zx;4j&JM(WOrXkuxOjZKEdiS1#vo^V zS4Gq7lz#)bQT91N_$8=8M$%0JLl0r1!pN~p1SB#;9C#fuOa>zsH^(>jpSyoJtBDQaLVl=L`_fqf3V6uZC6! z4Yup!45|!u3A#*0CyY4C1LGUsMljj#qkBR8uE@y+1+Xmx~9&l>Y1LYu9-f4&iAvOF8S}4|J4o>4GeSC?*4!hQ58~*M9J@F znw17jl`R(hkX{r1xLjtczQ{IEb|NjMI?@_NAxNxr4i#o7N}5e6M4?%3yjPG<8HnVB zb4z!TVdmP5%~w^lRxQJ?r&f@-A`$aN`>Jei=mM;=2G5kjHg00(Tpv+M z6T*-Q3p*G`13;;gEw_TZoH0f{xEw8$8@v10qLE&i3JMU_&oQPtjNPcC3_3!h!ks~C z3PKlO%^?C_y7Zm5bB=XimEGN3Kr-n)*1ESg501^0Y@HefQ}xv|S7- z7W~&Ga}p?2ZO(Jx=rr<-1e-g7Mbl8HpIc;rjEi=R%m=PhrxBv%npT0Zr}FHV>!2^7 z7&tJ`iOyy=mld`EDY15Z(x(Jm#2{IB$q?B$#y2RWa>yX0R*MMiFolW$r9t;W0YQLp z!Dh!uCSe}?4Tvz>`uJ07HKLJ16Lrpym@merPtg+*#;+RsoQ7}bT!w?m^)16%=i7Na3pI!YG{H6o<&^9*DlCpBv3=+AIC?Bv*h_U*fXg-6@H3frKi=|1IhxhgTT44IQG~}_6mC*tZ+Xu#3GHD{-5qp5sBy? z^yTCGs-N0NfmO^~?E&>{&z>>MjX(Agg%-)VXjvCFh%mOA|2kPbQk`H8fiV82r5c$^ zrL)m(8295l(&v+liUeNdY8>T)!r#hOjGzXnH?a!4z&J?cuyq(T4h9h>B)itGh9zlv zRhrVlJ`F#MStCrZO$TC!55;CdGm;L$a0+f~N};c;!ybpgj5BWpeUlV^N)zL9qmZ5n zMwA2uBv3zJ#9akcB!HfZ3m`H9GPFU(dsmJjO`?Lm2A?%?iq!6>MAl=qjD}aUgdm{- zq5p`s*&u-9olzuE+a=8?EwhU~IFoE{4PiVl)0Ieu|hg?#2R|drkuG|3j+iH3i+%uEtVc}+4o$ro_29cUsIL-;Y10{+elXQr5s zNPSple*_mlh0ySxM6ex-TVDL-gn++f-RiUWe4rDkdP4pnAMY!C^M(4Z=7E56Bpsf* zg)Gy3xgf1nJH?*I4Dz6bn(wKu1&?==cYx|;dsNA**JA+1QnGPvA3dw-8K*2=*DLk6>vkTekbnb>wwTR`PViBdcCuM)44c z1m~-e`oR1`OHzWse|gmNMzl^hjY}nBL_}G7km$7eTk}H~L^ICFe{t8|g^J31JTgZ; zddeu~+SyJtrA!56?;&LWZ5cx!ZAS{aZAx4^v}r{03W~C-rDkn`#HXrZDM>sY=R>un zd>}E9?3|_WclWS|0|Srw5KGk|Qm`UwiRz{uMUsVgt);>{Oq&V&rMwf03G|0a6^|d0 z=W~~gwG->?u0I+=?CPjen6P!+qT#KWD0DH}?^Hq$r} z0}pkb(7$UX$~uCb#t%w~$^~phW7)%kjUNtJO@DjG_T?vm%amK4)>hb5)%Q?M7Tz-) zFR|NqxhwXm;~@_(?o92*OuE9<0ov#fOiP3p4>Il@+C`O1PX#`+VWM7e9n^ zp`9tmQfRCbW3TzL%5n#Rz%D3$UYavf78J$9-KuF&_P_O;pp-RhM&U?=*$3n4bq&<5 zGP}!$m8^)Zg-01rTY=ckF7h*`y@RI-3Xnt!$$Beqd zVM88b0!mZE&PyK0yH}}8+7zbQ!O;swYM>APE+}+el61$;F%`FRWO%EknFQdRu?F(7 zVaeICsR;zO%*Fq_Z%7FV`%V%@>4g91d~i*SxI)D=m~SMdVN{J9wj|yHUw}={?AZ$D3BXyc8@pMvVQDLpY~yrPiIS=WTDO|4#J9 zob1A!MWmk&Mg7e=wMkR0Ov!%bjjGNznK{o1oh3ys3I@sHbhN#JMag^s#tAeBddo7K z>1?UD9H*595vC{ua?WJtzYeJJdxRWD#R^Uv2iwa0&CHVKF?kbREXE|%iGzinPufrCkc$~&L6iu8Rh1ujwh@??wV4BQR&Fzuf+ z65L=K_>D-`EkA@q!6W_NpZkT`#6oB?hwa=dO=r_wgfnpJKl7?PwEJ;M?cN%dkBV}L zYw>D(KTrQ{X6{D)Pm4y*|1V8477ifC|H=KR`L5?VY(wpSr@e!YGIyj@918~Z2HCNF zp1%3fsC+lX$+4iVh1sZUqA>A=zU^8=cL)_%p~_~Y_i!)Fh> z>+93)-(vhG@xMZczKp*_|0(Bzwgj|y2O1g~ShxkGvwApVN(IKLtL6L{eJ z^OgeDPhah2>{CP%bsLuW$vtmJvu7cG@7~~Bl}s`3wiD3xF~;bhS_dtx*mHin@X|PD zx~wNgboWdDTbJyETwrnZU^VyDrV7DeursbpLS6K0+2ve%!fE3m^QubnU6<(fiihay z@t}@_Ldi$H(6RCGf$+m3Rr?5o2wvad^eg0LOW@xcUzyXt%aLODx2Ik&`Lv%OpQ~BS zVOEsi2$26&^R&9tOf8*X_qz0cam+!LHWv;FfM80>2={a?FxJM!c;CYtAxI)E!=MdSA;xb?DE+boa_g6tIG@A-^3^)f5a zCNA!=3xVDbApa%NErE<@(}l*MV=^l!Q%v9b2uq;So*T?`K~}cFg?jD(9E1oAoC)$D zVoBg73>`E6)gQ1hgZxArEO}Y(ZUo%B&*)|r%DqxTl3C{R*2tEAd$vhiYHL~!Ht*Ni z?{!3Ng5O?Q2b>VzOIoVv1uYtG3qJd^Ufm8`?h}Kh3qs%S1^diR%9P&lS}4mZ{-K`;x2={V@Ox-IW=)A5j5pV7gv?d zGFeWH793V(s%E0L`oYSwFfHBjMnq%f0a=Ik^lP|_eAPG_n(7RTj|1W`k?(Z~s`xI( zTc9)Wtgi!c%!ed?>gRd{qZinf{UYT8GQ5r98$JHFk75MM z={2;n{W?{Qb7HFn8IP&KoD5eF#e1q-b%29}=*=Oe@kRZ*MMFK$2||P{@$1k6r1N+q zf=3|vX>#3E@Q93llvDovMM!$QGYMv+FvfJhs33+zm-?p4D`v9U>3*clzEWeVEU4;` z7|uw(q$igy0)M<5TI*m9euO?^RHL%})4GgSlA;3LSgd>e2; zVXql2GdYddp+x!y@N#*UD+~{45ntdLdxc}VUN!Fipvw$ug^>9ASwafEr*a}o36j%_ zr0qqKGILe!S*hPIDt8$LJ9)(`6SqJ*6ozCpkYsF6@+^ClkkB~cApv@;p*;I??*)jV z5@cV_nqDOrDuJLXq2tP3o7iEOvP=KzUHKH4L3sZ%z6%uE$SmVfTsxADxAp><$<6Q3 zg@|p3pUK3{asll2s11n?G)k+8)-oidjq_EX;_9rL?)c~ZO2rCiS`1yGKqZIzew0B+ z>!T6~f$%k$@)mNU{|YjzVVIi;<_m&Kk~#=K8d%|{wAe`(W^2w*Un+2aNX7pPF7>)X5l=N+lBpbOz(>SafSRn-aK zIcGDN25G31NY5m9o6hZ*e1N+tUQJ1=_y+C@QPS&kASU{<`hM=h6fvfT1k{s+bxkUE z2#Bz3idE%tEQeEh(k^@LL@OU+$%XXbBO9f@@TEAoPy$Ex6}6@ zJ^)siM@d2)y@jCUSB zvzcPEOq0mEP6yL^n55l?ad3}_$T4uBMcy-nc07K5mv`v0(0`V?5KWgc5WXhy677PF zb`e(S4}&%a+4dCekj3@}sk&%4G_Whk)~GeDR4!3Ye4=fIUfLWFXE&yn6?=9YHc&y= zeTp0TX%;`JuOJMKLI4_f#$JEhfJKISNtoXYk4vRDc}l)1V~-~PzKbuYol@IwYoTr3^zE>$Ic zk33}TIqI4wKw*jkX=`&6^JH#iX z-KbA(UhNuWu2YY>aNY|X+RCoPL1PVkoW}6E4?%aBkE-xbOqW(DF&yt5yHN$4V-(mbGcja@qSuD=TKXE6F1UTns@%}| zNg<_%h}mkh1<|*ej%-i^laF}_olv=`y>f6!PNak@l*A(vE~-4IewOF6W@WaX|4s#@ zE%D^FctZwhA?on*8&`7;8RydlD>7b>Emdm+r%jUMV+AQEO2CQ#oxG zg|-u}vE^JcQm%+5lz{y`q=_NTPuQ+X_LHCJ*TiBt;X^3p5NbIK!TTJ{odb8HYGF@V zJ23}P07jsP#TybB5|-~|PXwf*&TxLJ`Gx1oFmrUno~t^-dt5os#yiWbhv;F-y*jmO z|D=-ql|YjJ^b_keAQk3o&yH(V;Vts)nI8ded9A_evOG6M)96JJ&$fGTg`w{m6J<9| z+$QcVqKzru8Wqms_%FoW`axx2*DvBW0@x>GX`6$c&VV{e2+!&8XL)ujq!35t@cSo? zE!f*^sp2;kQ3H{W>JyuYYcWQMQ;eROr*M&bHiWP4d74-nZv3E9H$_efFfY{zXO$|l|c|)n~ez7$6bf=2TmdZEIxbI1sQ$+ax z+Lw)DM=q_Nw`Gm~Jk`f3PEB&_HeNNPfwgU0ROV4z>Rzf5=)%}+ooUb_HA<-EDEg}! zu{J|}m9W1|pdLjkz0mMIUfrKBDN0Q9zNz3s=e}|Ypl*06N9BITJfU`NS~(5`MqXx3(l^J$_XGAlFRibyt>9Tsn;+=A6PFo{6e7P&$k(_O*s% z^CMsBcrkk5N7y#|`OugV)Ekdde2d5JjwbCq2dVWsjWj4|jnlh0k#EaZ!KRw?Y*hrU z2&t5WSd>ASDB`#n)2q{3<;nOd>vSm9J>9b;=mwXIFbT_?b@;8XA^m8=<`S%})o{J6 zFG#Tg^YE=S6ZpisvleHKOpIacwxk3zZ1y7@b0SeQWW}pIC?qf;YFRpN=NR58>PeR+ zChhN(1oPe&)f1=5Qd(g6j9RsWVHNX_UX*t)c1Sh^w_iSO?Gb?U?bvlSHS?_J2eClZt1*NVro{L4jf4HF298633k z3GkEl81=aQ`6N#70U#9^N;7WRW_=@LHAMU^FOZ6u2y7L6*hzncMey}mO;kms z;DmU4>?jmL|8!RscQVzn_75&V+z8|5<%L}gU&1PFmz%F{D^X^a)p5`%S{Zp|>K=4jfgtq&NA@*7Qy+XfjUbj-yYCsA`+ ztp~1-ERh5x_TW$3CSyHsq87l7qy3ta8RMMJ2+t?#!-53BU^I9d?qhcT28s_Lrrj_~ zvS6_~JbvJB(%RX-8=_X!lELl9d>z2^7*@hBw#i3F<%xY_J?Jzg=kZ>J%JoB_yqOBn z#;y3g=r2Xr)GW$r9xZ*Y`s0yG;dwIg@SV8ztv&*R>1ZuKp4=$(!lc(TKZM=!wGkuGE&naA4M-pz z16e%h&gp}p*n*(y+kg0m?1@$0d#(r`SeIx&*zVI$kyz>aWDa=rp1n-?2#4NE`EX4I z64U+i!QbhfYo5wCSkT5Vo8|STo+SH0Wdp7kc9l4OrbUVCG2eWryPxAVURP%3;JIG8 z&x|LR#1|R#vFPTbM(ebFkU5HZ&;N@hz94yTcGZBgM$%V4(MikMJnTlfS)C&EUU-!v z-XUS->!ZV_jM*BZ68fy0&5;6&`OuIrr#!4KPibk zu?0+SjNC{s>dGD#bYOxhCk8bsWJWk27m|b~O*|*0e@qtipT5Ub(3KOj5>JN(#Cawb zjxz1A3K{GC-x^3a4Qi3QWV-Zdjh`vr_z?S5CAduptHONS7Dp9v5B&WoA+B@iG5A~s zw}JGQN!jyx6kg`d#SsZ0o(i1DQdFEZE131R-h!jPzm(px#PdCH8)! z)WU)Or48Tp3J-iHPwKE!i-K0{;Glh}K0O55nC9Xp{cLn&xU9AMns8nfxvD|H9nTN~ zggCzw-<|+nM*B! z8+SL)ToX@$BN0~qGxTB~IHWpGyFmF1=E5IHr_5_W3=0%#9eJ>|CO2d6v>}AC>MVhF zg-n`TYcJ{mJB7sIJBhl?^&z(xUsW{grVe^xU$H4<@Y6{`DEmG8#;EA^6xKzZKi5&s zDUwQQR@+J!VF!8I{S=1N`s#_o0Emg(0Y;PH8KnwXqZZp*7&%s@cQ6HuKz3t6526aC zA_<2%sw!fVZN(ZLCkIf6l7l<8{E7i%+iH8bK;r+!434o^W>v&#yqdY*M9$)g}oXiQVp%1y8xsD8h!Few8 zWG4)P_oJM=`tITtnl~JC$wQ(ccrl#(s&>Jzu?gP4hm=R{(~DL{UEHUZdtI}FuQZ@$U~L>t)}Ub3s8tVlC!TMxnqW>G);QF@ltCykwX)k(MY9{% z;(uV~EZ=dP{2V?oxMIHvt|lI1?Q>o9oh^kB;a~;Z@7@EB4H|p-==~0%fWPX%}snK>o@U>H&zKR zl|-d`^7fZ7C3Uj6pvj26|JQRN4^aYD*}RhshPv^9R3LLrVYTuwki(b4FRKpAJVc1B zlak51&EDQc>zDNE^qG#cef~Tytv(?5`y%7aEU0|%BuG#>HyLbVUW^Zo>e4L=8!C0< zKp<#SwMe@ec%CV@HqUrtcg@*aNH66-n0uH#aSN2Crjtf=+-l>~ecJ7?DN$PtIRp`s zQX-5CaCO-Illolkwc;+BB<(AU$${vDktanM6qTRZW=WLt4#7W~eMyjpSlKd}7?OC9 zXm}d6@?80FaF^?|X~V-Tvo+jo)Mh%!oPVi&FGR(o?A?+lP&uY8ju55Gj?~R}M{Vb~ z_{ONPcQr4k`iGF+$b1+PXN5tT-%CFjEA$tBVFmRc6j_S^T;eN3JS#;U%rD|ajT?c= zX1K3lop4avkZ@Ax|DG2JUn&@|H7YpRQ4woBgJirciwz0-?b zGs7mN(z4SH5~mCmFIRq&pwgdaqP$;QAT?-)zKQidFgMc~$>x|_;H1`x4}#THgMoAS z5nD@Gd|_$K#&k@wm9qEw!e3KedGS;3|?OI@Xw!*PA^FHGm2i5K{5#+42_mnNalolYb+mBqsk{SJ=df zAQH2^x^w=<3P!(mJLJRSTr$mzVK1%5L*?(!RL3p<2NI~b%sZErqeL7WMb_5 zxhH^v>3aV^e2kg6{tp=7|FxVK$jtu#EazqVZ(-+YJv)a3@uV-m-XP*e=yda5cVaA1 zz_>Z{uZwMCb9>}A5@O4Y7S1%uz@&=?|IcL=(@A<|WdLVDG97u$J2@CBDeJa;E)0|d9*T{lI&d}JRK;{m)G@JuW!aS67 z(1~WhbJH4^k9xT*#JDqea_Fe~fT=RgSIBfR9PeLdE7o`)fL)(Gsp$f~;tzIJ&_ZE2 z<3D&Yrll!|T&dKT{hdo0ziA9jnU8qmZA*io4i?Ptk`~7-w3$(uO|^rik^p2tK`m5( z{64z0`G&WjhFPg$Zt6@7On#xPc}ke=g!u>)Uel1~AXy$RvLpo16zskl9xTHXpj7j~ zOS;P@Q>$if*MII}PFN+DH3gNH&F&N$DoP$h2I8&8Ijnq^z%}@eW(dK@$wunDy{kvY zVo-k#|66AeBjD{uO1ApT>cz`N&ghsELaRS6}+ULU{ya8Ii8>KJ5`H` zu0&1CvD#S%aG1foO$9d$ZzMl(pCE}5g=v23S^z$~a6W)%3xQ9=yXX!EHHBYK57)w4 zrrBUPYbB2UuR|X~zwh67+Az+OEmfTUWG-PnC1mhPWQ;1E0D{_CUt?2fQ%q4=Yq7}* z-+XE=+XPjI(5v++uu^EC@>Rol9;J)*8rWk@t^JWOhwq7cNJIDwPb-D&K@2!KOigESD)~s!xZ}5kLY|rASXYd=p0d^>4-$w@4?`Cv!$`q5rc{6 zqykx@!XAL*VbJ@mAvyyPKT`~AhAIm8S~Hi(sd=Rk8u|trng_t3tLDBR#zQHaIruxa zR*-7MD{FB)H4-hJAazLtFo4u_F91XucP+m(fn2RO6dZDNC?ErFuA$VDTuSglylM== z6Fz?3FFHUgt`JYq3jAOJ6n>2rg?lWw9-oUHk*gFB4EzV2pG+w!A`%1M0vOp|0~B<* z5|g%NAORRRJ6dB)JoHPt$Ojup6dkxuUz=<|4(@MXJkrWN$22UdeuIBrpSPYWdc9Ve zZtkB({*8lG24}~6Z=EfjH5~@<((F+?wY~3xG6K5)o*)02?r%EO`FHrafBO1d%l%t< zcYnFgICXz7y;S3s_%uu%I$3J3Ux!IwUHXR7$=5>-! zG#lf3vt;Ie>6w8)KQ^)LzMfF)wn2wi;ewva1x_eC&CZ*dk94>#Hf2>rB4#cf=0qv< zt0oJyOe6UlMm5d8pA(<<)vw+0p}twHGVrT*8r1!J9gJTkuA1#UcR#=DdF%P+sQ&xA zx614dv5aU{lt zL@cqV9Ez)VdVM7GXy8u#>+;L5eN+B|{jQA4cCnq6$J@+VXD78PJn~4~cVRC_MVY;q zUm!L9@o#0t*{{|6kU|t?or&2yFfHnJJWOR(kjySBbKdib(aI`y+KMEQim~|$b5|Po zp`;LfYOW$%fieWMk-06mM>jQoeR@C(mQj%p2P4%^Het)=TaW$Ou?km13k<%QGuKf= zV^K?Or#gGxm6ff11#5j+60L|C4^r}!wnSNO&LU*yrrYh!D_bRXGMNa`OA^DOL14|O zmkP&bl4?b2uC~@Je#sYCW&V2mrpu%Ay6vy`@XwA5RmZv!aeggDId(_Mae?*Ryu3lX z*Y6K9E^$GK{>+i5QKW)#Om=YP#4FBwE$NQ#>a>Cx8=@_^b5fGIh}y};)MZw9sjqeI z(`IF7$N9$N(p}0}#l~cLd2wUj&0^Zj2d)C-gzV(yL;IrvXxEd& zrdT^3e)i9l*t4V~b!p3Z8Ar6vNm1f|012r_K9`rWwRC}+5Ki!X z#NNbTPoK5&Q&aN|)Q5qLa`sVKx9hKkLnmnq<7%lmc!Zj5SW#WL`{T2->uy@~lf#2< zjo0i|*2eZ7V{8m~m`5Flbt7|D0CQRDYb>=^gPM)1;d^6$7606n)-b~%!fe*SSuGKo zR{IebAF1Z$zj8?(xNAKEf@NUJ>_7n*SBZ+YlzsE04zZP{djeMri_3$}s`zDNElLY4 zO#e0k4$?!o=NvNL{{5JTbo z9FxOkRRkNHM*12k)H|Nq&j3I%cNbq%`YiM=XRyNz6^#a z-Zmxy3q98zwGbK%}@=IQiNf zugotUNc&Hty`yGlrBhgTn(_CsEm6}qpV_O^HZSQVI?L8L+R3>ed4#G*3yuNfGK$IM z@}sW9%3+7q%-MV3M3rhx;`Sm=7t57|2x{u&w}3{x>%FrcTQamExJ87Ihb146MV3=< zhgTs@6~pRgOZx_Y^XXz#{|OXB^DP&*-dC}%IKF6Xuzb+EUA=Y0!lw*J4}CFdYNhX= z9mR-JG7-<5*@*4;yB2!=Qh6hcRc7T~*o@t1uA1TOvWvwl_KL#W6Gei)h0sG@d-Hm% z_gdz<)#r`jg>nxq#gfw8|W#VhcCTIDaV*gsOvFU(hwXbkH73R z)TT$RyDK{4kL-JM4>P6Lx^8|XtHKvLOH*@yHoqo2Qa2Z-@c*`l2IuMn`^lGN7K;g~4Ynzb`cHbMdL{wwb3t9lM~b zG6t?Ao-{l0+Fog2W&T_#gZlyuhv2Yu8r5rBJt-^hnx59;a#(d$@gGq8lk47+Gr`Z$5ws84S1m+bO?IF1fPL=Txw^i(de*xGnRARqQ(|#R+OI;q zFIs7ywYdv2YtQ6`im55`aUGxDVrh-LV&8JU*JhQe)NDIiQLzeOhrV|7Wel3k$!>78 zIvW=8)u0S77f&-nj-dvN%0m8oTur1s;ug05Bm7Buk@cmz&(LU3bZ)oBZt-4PGK*N^-T1t|tvWreq)rlv zuGiH9kg*SXfvZ{kfUtd}OJd)|!6UQwu#Tm3aa+nwdyMneQ$L!1vb|@mMJ0qRTwkZv zP+Qmn3umwU>=iyp{7#SQb$|H+Il8L)ZC!cnbIw}gALqjBjeb*Ry|bk;{n}$CxA9=@ zx4W&}^ZabREYG6_Ju}CC*%Kr_`L`*YE3VBmVNuWSOtUt~CoU zIb|6NoSt1CZ;8uV;j#z4&Kj($%8SyyDF~YW8#6VU;c5y$Ook8(TMAv@ z4F{q#g+)hpk}_5#Y90X>#Ptp4_Q_S#x0yC@6KDJd2-sTt&!q6V~r93A~&1PE|;b1wtEGetvEC zE%4IQX^ZM=VemVa_b24p__Z8*&7TR|+sWI!Ioshqmd41vj7;9pmq8zi%Ik978}d4Z z(8uJ2;4e9m-}95Nu2P;MsYC7b4|ZMbDBSbY33NtQBL$}0yWK)z6cIg+`b9)3df#~+ z$a=V&9-AxIYn=TB4;Ccz`RisJ^_2ih&D-Ljqf_p6OsO_VZv-<>be7lr0;klhqmcu$ z-ROjj?w{Emw?F>xZ*HyEnGYv1iFSQ*2USr9pzN%6^l?OHkPjM2d`&?#+*i~BX9b`C z^tV2~wGX$RRvr8-u{DU@C@9`{x;E9$bus*3FW-pUcqDhwl{GJztNU$!bulpQ0fB|v zz4WAZpVB-%B1Ye$x>B+crou+T0CYU`vkQH|)zOGIuFo8K3LQYXfdKGFYr&6%J{o8h zj~o`FoDZ8i2HBuWng(Gkox5gTjl6yF_s#8{_FoUGZ~i~mBBR~#K5b3;uz1p4~ceNfWj&FMBiSv%_nAi9c z+6|>m1Qr=f^{`EH7u3l{DLSvS^w^&7&oy@7)}Z$bur39!$u`ObiUdD#2E?38O)_K}66eCcoBV4P zTk@v8SrankjRbT%Nz1{i@7v!~L8WNgix&-H|A53rhN+Ack`X+KH-!k{Pela_RTYIa z40-`etso!kEVpGmAejl-;bJNsQst$RC1|r$-Sat7gjP^Nx1&8_FK(mxZVE(z7=J~= zxlh#PT&nUn9YbhO)iEXdw5N(2f=}kAJg*g@%co66;^Rw8i-3vJV+h$C1o&3rK)Yj> zW;}BiOr)%6)s_I*TgXb-I&CD8p}tvAq~Lzj8BgTT83*)PgEhOO+}K`AbRqBiGuaOn+2bG*%iH`loo#as&4buR5fzY6S%1 zOO7%u-i6y4FCMBVn|N-wN{I)EXX-xap=%U$!m7n>#GY`x947C%=qTP;8FfC?oiCC{ zlB1}0{O$alVjeCMI*2T#vehK6tdIN{a1!Da*dcP6a+NLPo zx5s5R0N-1k4jq-n#Dq<7s?->?fpw8ZkWTIaA;EF@+IqB0+|sO2{XM4jAH|a2ZV$;? zS+Qu$Ee(=vQ_lUV(cyU9GTiOr(wuO#mAPfX@O?%>tag(Ly|yJ#4xYX#-8>XaTQ*r3 zo<4UL_EIRSVM`|>@mrEiTlQWEp8l;7%D8B&6IO7pMFAm%n$nnyBn=RR6cM`rtlH0m z$Q{d-7sZu#H_tosH=aTGdZf7m{NYF7An02{-yVoBCwzExXe2(_Wqx780O*NG6f}r5 zI%nYzm+v==UGQvja!ObbO^(D=AWCOoNQxRQ38R;dIVmypv8H)S_-06&rjaf=bccr? zsVORAsq|6n=7V-Mn6IW6!5P8w*O{M~ek49s=o*GzS&#srEC`api7Yw9AJg#Mr%xVm za}E&?af@K&0;|7PX-zIJY7PSmf^sKGS)m1_%MODX zTisy=Xy$e4sX|>ZSE)spi{dVCl%;;wiRT?;){kDxFWKE+`(&{i69znI=>0};wr171 zxuAAQVmq^JJjCGD7IC>q=O(#WOmV@gN95W@)yqW0=0c?=vtmnQK=o=PlLdIX#Xv{d z*NjHw8!o;vld48h)Gd&nSR&5jk_Dm3odZeBlbVRgNHflF%-Bf`6d-B}K_9K0{$=fd z_UUqK%PXr0jZmRO(`cWKv$7O8nR1@0P0iyKvZ#a6aPSr9N?=&7=x*P`q&~pyTO$4= z4k1vn5FgjpZ^vEWV*iZX(>IuqLq^O~^-Cc>1kZNw)VW1ufKG ze7VM;bZ*HLCfb;7BFpMb_!V%LTq!nctNwj#T4rA{7ru?1%fp2yiFE?=sRWwv!QrU? znDJK7Ng3q)K`V)NGvQV0wd5EFwbct&Aa8>U!EGQix>L*+P&ACaoRxTF+BsF$SVNlFNQkY@1lDdD3Iap$Chm`^;!ijB7^$@-&V^D&Mi zj;WDH@d}GZ>VG%*(a&HR0@{#&i2 z+y6sMoQ;+Je{WF#-(%uT|F4)h2NUqWA>@wqrsK%lfA+jnpHbnKtKD%(3eLf=-Sle+ zgHmG%KL`Xd;FZbi(O({~50xHC|u#&P1q z__V%8V?CT0oX9ehf92vR{4in8K-WS@E|02$z+&DdL7Q9MoNnQ{rVr}2@q*zZ{WrR2A-g~OJ?Wl$#;C#rcpyQyqvexjoI>n(S3{P@DY#Jx zSlYa2p-#I>c{ifF^B{W4hx`eDv7RX`GjU?mS<0F4ScUZWk&PP#X$Lh)l$Bpco8t2N+Q&n}#)vJ5EOJoDgUpoR z=aROBVM@cQP(!lYfdC_6NfJ2SQptrOh%r;N3#$naP9W9@PP*bi8ZfOMVrguJTu$~z zkXA&>p*{~Fn+-;T>hYE_)I3A?dM(4%zNA~n;JwAlBM~rqa(w9 zx^W*w1Yvz0E~nyHh`!8z_|4jd3yw9BSR-TRt#o za}VGK?G4Y#X$$wHXgPsIF%??fMc9w@fzc1@jE-&`lD>}~Q6FNfqKU#`WV8qYNVX*u zW(<%P55Y!nwM9;|!}bO>#xqRkm0|=yL|E19pp!PR3#dm%q%E!yQ@JCox^Pe&plCZO$yhbfnSOww1{Zh2HnNGKF7$a1O$gQltK>-MHPg=dLFYCm)N%UpEeCQ8TQxNiF2F zz&Q^I-SV;?j(m>iZo|yj`v`P&x9pG6QDlR!F)R6@;2XYD)`10>W6ciL#Ru_JhQL-r z7ZBE$+EwsK6r|OMS}hhE8!tm_FHydFc)mjY`g7FBT}C3Z4G=t4n}MhXj#3b6lX%Jc zlS@?C1acxWG(7RbiEyR`a5NIH3s6{6FJ#F>`OK^Our^#xDk!Yzz~KdvQ7EjeOLVmu zvfW~$85qura27Cm?l2a1$4VY{F!{5+n1Ez2&i^>&W#vX4mC1M@V^M=HDma*eQYs`u z`dql(G?qBOOGwy4pVw5v(<{QsVg32YVLPN=k*47(quG=ia#X9SG2K(+QRQOKB`dAb z>nHgNVb_j`<{`-MfQ8hnHs;Gg|7BcQ2hRkxyaJsbcmU?Nv)iO1=JvP8oLZrKc?&v; zJ3vQ>?EE0GuUtL@OqT=0PhA`xlLGb6yuX#(o} zp>zoJtxQ!cGfjrh=uczda8ymb%w!c4PkBk4Vl9yf^I2l!Vk*hVT)gaXEC(Mpn25UD zuS4T5T&ASRI@LlsP_{R6xkFm{$gy-cP2ihj_121OBBvNPwuNgXzc+b9dx_9XC%gY^ zq>XHQAyzGfIx%Bd@UEi~8ykdNTiLswj#rCL2#I>g<>|>hP)lq9-1J7yERRHrM zPu(C(j{)39Z#aqq%h?{w^`3E&J~VViN=UfS^d{W+vT6 z)LhlQP`49H^ccRU2$G5z-v*H1oZKBE_XA_bas_MhbStdCxbKY~3v3Z{i}xd!*p=fc z(Uv9oawS#C2oEwcVbZ^&Jj$Dre1(#BWRDS~-#v7Lbo}v-v9vDM2$itM`%bIB3caZa zhsZF$IEVb1bBdGrha{xAdj?2~8J$^G^Xg|} z^#|R`CbJe|O%YEO;iYZOvAs4-4Sr$_^iCdkPTat{PdN@AamRGUZ-MoYqVWnIk&(;A zz{+F1;9Yu9rqWZ_>ZKx%dK)JdJuT@?8(b;vO&J`b?Rk#3`{#7h27f<6DZ1AgXg43Z zBuxb)yWlVHMM7(Ac`OwgGsx86K>!21(SQx{W_9@Tbd#}%08%B2MY1T-)G1)$v{Hoz zy4aKv_xGTQ#~&i#$oTT*)A=EmI8KY)wfW;2WJBsnYZmEgzEg1!rBm7XZa_sED|9E%Xw2M~^NF z^&epFW6;_6ubMtG0Od*svbbYO18xjBPDr{=kOMVsNAgO(lYzx7brualp2WHeQ*>n9 zti41MM>3y!At^TQPDO%V(!&`sK)Y3Ytf>`8>$V?tG?hB-^Xf;gDwoJA5%|AY`^uQi zf~Y-Yad(GZ+}&LkSe(V(-Q8t@#ogWA-Q`6VcXwXg-Swq>ZTh3_m$pfpOipso+_`5m z$t2G`@|=GuqM<)-wcv?DehJVJ8vSY(Qk)ktsaOCqd>1d8$^X@_5lRYY97KT#`QUj+U8$^cL4_R1-7&)OP-i@J9QoIwHO^k!Ox`fH0dxI$E`|zhJ`E?gula6Q^887YqxeH`V z$?zmrAme-UXChYmVkS;lh~|SBk~VL$X{BC;0pXzeP!^=irtQ+vuZ>yOJW-CAj650GO;Fz z@!g!`p~xC>tcg9NT5C*=f+=%uhrP$R*N6R}SI3 z|CJmXW0PZrKW(#>lMoSrpm4@|Sm~t3Zvd-{g7E&dV>rPT?c6Pa9x^EtzXk^raN+d3<&lvt(pfH=v?VWIVHGN z3<8f8eTR0jYnI<#LPD|wy`k~#VmpH;F28&Z8D7xPdJt^sdFt2@VT{y}{mv@Tf6Y6_ zzG~E~Z^*XtJX^WcBma`UNa2Ca>jfa?lfG28rBCTp6QxyR@?`dbg26aQ@*gEi%jFREqfv549wb^}Fnmb=SjjloKsD z6)gc&xpD-&)vxRXzsY&oGalIaFi1m@Rq6y@aVQR{?1Dfo)ROtl7P2k|?J^y(VkhvV zF(}0dbwd=sF|x{}swm8D3OX_K+RFhB#3EgdFSTd z#)UhHLZTo9K#_`vS^{}-e`5kU1r(Q*+nnk~8H%JOW(>KMk~F^~fpoArg{L&Ujg*JH zyLNJ2%ZfG4r_$GGmz6%L=zg?JpDfg+wM+}I@BD^ zNn)LreoVsJZe;dF@>niauuBp&q&&*^_I4dfXiz!~z(iT8q<1kpnTQMi7WgLn4{wKo z8WJ1wHy-NNvEG@ZYH_MleSg=ADPyu;kJbs#yo|sYfO+1ec+Pnwu2JdaYrPIs4+{EJ zw1zO^q;&C7oWXz0$$KdOaqnN}*v>xlBnWn&FbUMugzKV7&KdY2qed%G^#e%J)vrzR zyh(j+Oo^f5aMzz1n2EE6xq^T|77b-^Sx*Qb9@9QWK|wDNK@pVQsqw zj*WunHVMnuHq=~x(KIxUfnB>S>olDy!{bN_!qSMVMTp}BbBQ~Ta5Rva3a9m)(iqjw z%?2QvIo%X#@GC`BVMcx*gj8qf5ps95{Dz_w|D}lex)5AN$eQKY_0T;}uB{J6lj28C zi7Df9T8xWEkLm#m0@sBYL=)^h)V*Y4BO>6$@q(e1y-&q;xf1l>|EmH|6xn;b`wZA937!I`<&z#z;#t#}8^{ZdH&N$0SXn&HD(XT#H{4QUC=y)oF$#+J&2mQ)~z7Z#6y+BHC(=K25S4`n-db99S%I}cPZ8l}; zuNDMPOZVi^u#=20_xPq$xM|GLew(2Z6%&C+sf|xol{r3c`pMx-bhzo0I3ME82CY#c z(;h<^n@+&Z3NLy1hm3~0L0KK^NM&=D!x#)eyWR2NL9chTbdi2By}7pfoYUA+^juN3 zJEk`*p9oJ^J1EALr&Ys2Ff9;`Czn@gH0Bo?+9gOHTOMb`K^$q%Hk!UXxbMtz-JX); zk85DLkrfyfmby&lL?8X~(*%?sP&wgUI7_05Bgsm`AJXEf4rH8W&+6=%P2sCdTUz znd9Mnel~xn&jjSK&$^=A3FS1&H)ZAZ+5CYJ(jj^HZ~eT|$dE-#U3LMB=}IP6%YqT} zT)MI$!Zj*)k|Q$4J4MUEH^O@&%}?W`l<4D+IYClh=S=U_x6LHD-1ktUEH)nnXLCVa?` z5=&2U^!|6zj1m8nI`%1C|Ho6O?{5CS4nh3Bd^=ivvQ0@n+KX%MUm}BFtrIE)@zclU zrijO7;y+nUOB{kiS_*AnII1*Ti&>cyX`)%U4OJyST>s;2tNTP4%}ekJ{l@UwpkZ)I zWUOHXV{aNcxWP5jptHhqpoz)`qGsVLd3WWBMrfnUyMO)Rm1QWT*N6-&np&w3a|~v_ zr00bY)s76~pIOoR2McS#%)^V5IprIBeY5|8i zUips?6Xi8l1i76Ghgj)+o%W8E%U>TPWGD5#q3s!XI{!${ zgxL26aQYy{$l@6%F4=Hi)G5qpm(@$nNc>lkC{AfX7F91*$vG!a0Jo;Wh@3)fLAF3z z(9bM~ot_u%@O>}BU<;2u0v&?@58N$ zN=rE$w}suOz8u%S-Tp#qEY^+@MzXz#usn|Nh}d(p)6-lCZ)uLa4sS`+^)}v+fn8qk zcIa$Mi?ym)%7Cq^c=SsIpYD?lXjz=={WbzUqg+w?@ZW^ST0r^u^yWV5WZ3bx?tRrN zW08nZrn~;VcI+Fr{&6`eeWV1s$M!F|llCD-*-W@BMtw9qPz{;ySQ+n-Ujc_H)JMO0 zaO`Ac+OQ!MtadTy)EmEk+~{ANcydk$f^#)eK-OvqwVr*7<_%4|(Y7=T(jK=#AL3zX zQ@@y_aa5D}WqYiG*{>J~`!^!5V!;7-h0Yw+7Nuy0y#Ir0v4gQWBAuHJW)U z&l$I}jz_Dzx+gu}5z3yE$K;OhFm`4#xAKQ6aOnY@lmKQvE@=j<1+DuftSJtz{N^ZC z)kg0$t>W$$3Aa6?3A+x23ATQzu?seLRx7!j80G?3`zqpLPe(+z2R@^v{#~1GPgBkb z*w@91oTU?{LR|-o8<1z?vn3YS#q3ROWusfF{cT(XBLE8%+SeJ;ZgB?N?lsy?Z;&-p zc2Phv=NftFG_U?%gYG&nokS+FyM*KF zRCRZc{QxNP8x4$qsoJ15W7rETEzz?|Ie;VmIwk`pR+(Qw@5bo)Uh(H(5^?7d9Qhp| zttF41tlY~s(Ji}O3KUSR+j-x4I-vC+IZ8s5=MO)S;f$tz$zCj?a~;6m2r@E$8W4 zbtsRusVF=gUeH`zeN^rQSvynq5aCYn+e*re=lHE5H%?!$h`WyI5UTyRdL%Y0fcQsxBS*l^J zBx8M3%?vsJxMheNBoVhpiW-C9wf3@AAovJ<6r9LePv#=HtKLw1fQs#H+4EmCc9k`f zWVsR)b6G1G6HI6E!4vecRI8b?8^GUr9ogzg@=t-Uc0F`ZCX$@a2zOmp(_ZF;Kf?lW zSHJYG@$wn%|9)%ke66lwvpuV^?~Y3(5OcR<4ZEPs<84$YkvgJGQ{mj?Ia#p_{((Ud zyymO}=zDB3YN)Zi4#bdf)6HKgikXqy2h)JIBj`rut}^ ztgo99=y7NQeb~;^mxG1YvTWCtVviN{uM=g-HT+1yva##caH}sH4>>qqYD>R9$h1@*mUFY@! znB5oZ*TY{1ZoJZHa)ggf>RYZjp&m)P2c%|3=FyU^K91gjAOQY+k_e2FZ>=}FPYuHf zb|S~voUP+){M6ko4rh0|MZl;(&4w;NJbusNR(282nLlhgj^Dk!0lscB5V$2iZ*SQb z`iQhi`~CT`c{Wvh^Kqrm4f;j{4A*L%`hoJhny;IEy-M@xy1p!3pOs+EFRt&g+KJnj zID3cc4#Gg7!e_1t(}WH8n&1VV%tHgP@pV_iRqy`xqf`OtFZlU!doPsBq~DXpl3A9tp{Z|me3c9=i zU1It``x{hk%RzJJXVslRxtoQ@(e-@1#xxJp_Z9=RRTBi~WUcmNy5F9;4m zwLRi38=BYsZlJ$%^_$U_vUkv3(cff$Q&n0B_S|S%i%eSRsCU^6- zeF^LCOtk9)P)jtcVD3i=lMZO#T@k>;h?c6eJ$?`h(Di$!I~odo+fRjn&lFLyu?L$P z*Jo7FpVkLCwfjIRk}&-e46~!UzPVc-N6CFTx%!&04HoXm7A_|CyY8r5Mu8CY z{d~Wv#i4w>-9sS(fO69$4(N;;Kep}%m+$6HEreTdOl(;pby`^Skb~`;19FQO?SQmu z_E($$zDTauoLoX88z6)q41vKd$WimG6Za&+Ls_b^Jj<(eE)hEX>zCcNQ)AJS z%LSES`}vLj*xI%VuXo+8mgmDNM>aa8ZFgMW_!9QmJRu3hLPR4xe_%KKa$K1tOs=^Z zgo5L0NHI)BhMhPXzkpuMZikU-Fx9)A>I5!nQk>t15}Nx{$0!g^PAhzHc^U4CjwujnCXaYL7&A`G`Nl#ETh8ezNfz`HUAUh%PANS@M z&CMtyVMr|^jz&t+8bG=KO#x|)5Bx+&cFk+kRZD=eLvNQMX$m1X5YK{|LobKol88d3 zjUw+;jI_e8ID)9s@ETjJf}(sWM-WxfiB{nd3H^m0zK=$?1LuC9H0~unmXI^~j1!JeNP0omqDnx^+fpM8> zFsP(U4Gd92p0sBeyU{~Rkg{27o}vz!N!|T)0_RGHYusx(DBY+bv%x@pE)P|VUVq4_ zX#b8r?FPm#i<(dwe;Z~JMst{om|0PejTykIk|;~6J|MhiAodS$G^sK^Bkbp8bg@_& z(qbAS<6xsvIL){MR$`Q_8&ibW(H4JWP(-uTvnu$E3TK>+3A-IBN02b=p*qI1RM$rE zV?r*gc?dhYix_z)#-r&^^gN1?dQH52f?tRX%x5W*QB?@H-y#-?ej&PzU+@ywFUWck z*PE0FncGWdm?cO~e5YhH*QXgR2{VZ_Wk(;aqoNWf_tfySN;g>vLMck8&mH~pEs}p_ z8ft_i);$H>+c12C7iS+BaTu0{StiV3J=a8t@L?msTW5J$|E_Nq%8;Amgp*;&^zE)P zKHa35da}+vhky+|aNY<#NPpjIsKM6jlG_8~M|$HZhQaqyjJTjZt3)aT5t`DKN<6zh zM-Q|B{oxv%pb3rbpH`Ge)@-n2jkU;jP*60XdOP#pW9Kyd`tESJ%E%sx?+e?QqkYZDEJZp?8us_22wQ|4kw?xivl1;)%PGki z7F~)ozcfM$9nKTd4qStL>Q33<2zDX}dVDr&7eOlHEyH6iVeu|fZ{Jwr$0{kEE_daiaPxlVb*YEf5{++o1)ECgnz|LJ~uHW<9g%AqR zNO7Nw+|>SaB&aiT({P(-;lc5*N2&xj(#emMbm`@SUP(KW(?>2?CI=#1Mhz5n)J}3W z-N^5V;@KOErd|b%@tyA{wf-N@aiJF7tWHGb1TNW!q+UUC|hqju17!hq#Z)fog^ zXvyjCOR`JS_#+6Ho>OkpY6K6~Z4>i=Zic_;5wkE7Lwy9>zGVxqTn_bDWDXPB3HJ9E z#dM%+4|q4*zE23HvcNzi<|)1Gfz_(>7DZ^Ok|N_Aubn4;Qpr~<=UrZtnxFN$^0OqgBgxg} zw02Xq2!`yM)n$8Sd}M7kt2cC*;u?OHRpMNhQ5KR6b{ae=(riPkZc zqIyU=N~dWJRAs8JMmUB6OcCOXiGiJq?W^B{hiNna840>-WJ+SXp$uXgWjGaQu?ER4 z(mGJRAjhBGc&Ku0am+f=);c&lK5kgi6!NQS%B{&Ozev4?N@u-Xn6Q-6bdGAruwgD~ zE<=ARp6$9M<4`8rK8uT^Vowg?TN(Mw6YA`4vwXTMspINW^MwCUXe3UEWnV2_z~`

3Q*QSFkHMx&;9sjMxDo~1j67$`?_%R6(q94fhl-T!1p-g%*mln@F%%cFql8tcxI zK5&jIuWG(>c-1!Q{=vlIUZUvt>@2K0A4mK5eHJTtU@H~vqM&*DgeT3>TR^^&mI|!u*V_%+6X-U@2KupmR!E`W?sFB6V(NN$_X) z3|#b#281&Cvt8YHWQm>q$_)j=gDy1`H=m)qZDonw8a8xR#X~%63facL!&-M2x1)yH zsiVn)OI^Z`xj_%MK!tUzRI*C8p%Roj!b7uy8F2PQMHjimzwK-Zhc+rdjJ z{1q_KTv1|b4I9I{aZXTBVB_wq9j1As?8&drT9>&Zd*a?D7Ou)syODC~EV~8p#Xhch z{M^5lo}ziiueE!pwc!d;#A`8W849r6!2!_mJimeTj z<5txo`~Is5@Nl|L6xl$@a4p^MDLqO%_;v+B6VNdFba8QM;h@D+>U4bcaMwgV%y!A- zrR*scGO4#NVgJOp%ogpE~ro!-cb3Y7Ja}K=8-wIP< z4qNi1V9yPsrtBN+k=debs|~3CtB+%R**c8rTGOLj@gZPimSeNR-CXC`VE7^1=J*^^ zI6oSFMD@ncFLuztb9nbwhmYjEZ^4a~I%RaEy2MZ3_!pMT;p`=EL4}g9v~_nN z#i9+U%?scvz=cplybvB8VVa)K71aNB*q<%hZE$e9HmMnEYPv{8m?d`(0^MK=k`SbK zTe;jTmfBQk&Jb1Am9M(y@F~x`PAm>U(gX|Wj5t2KI4E_kjVDs7N48&|M1A|_m5v(_ z37ssgWg~^v0-T6&ZN?PRf<}m3Ax3ux3isu`bF)@@PVzPKXpQ^h+USO7RJ&~zR(wR# zoYA^hSaGl)u}Wz3XiW9}%teR>kfUDkZ0ZU;-A?L_^GqZ!-EscI>q*Pp4n2e5X??-1 zy2h8^9%RQ6e2$6gQS(4c+}jRxHW4W3BAZX-&$W9T&r~)%UD>^ScidGkH~*c}S?K9j zko38>7Tn?Gd+Vpt$-bvfqbZCgR@r00L7U(CTwB#@)5!*9etfI@jO%CiJZ86z88#v5 zrGVejV{x1jifnmoKZpNJ8^a}-=-cRLp=avgC};TE;@&Ywfl9r#A3oh$iyl=fx7W(= zgEU>0aKqS`BQ`2UEECK5ys(YBI;1@DjyJ5%Qw_)NFPAje5Ac-;V2tQ*#(0ps!H5K+m|Xp}%ZYCMVP83A$YmCG(cx zSh#OSQXk?#?0f?bY}!vhz0>oaSJNvc-|TP7GxHx|?$|b7M=zp{VA(Y!Qql}?L}5U~ z5TrPJr{-UrGMHqGsT%jzwAB{RJh@|&d=LBk*T|lYfhzW^(m!4$tCsi~zI3EXdT=_K z2GXTRa+?8ybVKvGqw$i<(rn%aW-l5Z*Iq>!k1B5ffw-q1LuP0E7yGqkf03*YYK zpH;mdyf(nMgLa%88^cygx2M@NUUy|=Byu#47cZoRE{dPZYtm4mYLf-o%^cE2<;5~g zt@^R5Q zS68Pe1hl#_vM3@B*->Z?_h-TB(0*sP*?X{F)(Ee}xQ8oik!lLWT7U57mf-SjS_No+ zA|G5wODKE90E69Ny?G0??W>pewI*|9S%`YHKP2ilMa2xX`(G zt5fBr^0$2c+~~GFyPKUn1=$O8Oh7xhznxgN;u5PN+r&d|`>y2rcYfTDe|9k;9tTo_ zJI17QZw+-U)i+)6tB#~GslP-VnG|bt`Cl_;k?8zOAtBN1f9X$_ru$Q-=SQiyXONRE zoE1qO_0xy73pH3vL~r!v{RXr=z}D<_Aa`Pf0H=4xjv(>UNL7aQ}+NP)H1J90iXB{drvhAQ86+M zzWHW;OS5+T+@X@SMJp@4s~Yg#@oZh_>|z>pV&w(CAa>+-;TtWZi3CHwX9dvI;INpY zo-8$z-MrK#P(yhr&W<)iCO|GXa!s7LM#a>TfnSZ&%Z~ti$YROF5TfFz-wbH-x0fujM&?=Lq5_ShwPy91nutsgUa2T z1oq`V*84dh<4+Pl~{^I!3ayM+!T#w;0Gs z%~g^mO>L@h3ET7%(2usM>Pb2<+@m+%8nEMM6OZ{>b?=*0wLwQNbzK1>(l~)zw9)32 zRO}a;D|Nq}*@UR0_c=Y!i*3x98wd1ZPN(;ehi?`kqgwn5b1QQny)YB4ZuD-fB6H`b zo1EtgO$N>bW}U{58oBqx!M6qXs_H*$Xpx2KNFf|t@cFOgI})qOj@h^BOrE^PS350r z=~E{>!z=a$Wv7P#f11aPG6;q;)3+%3!#)jz~w%EsSh%VRRe`EFG`6IPtp6 zFxn-Y+|9?&ru9F3{@pe$?&%8rwiHZZdg=q*fek3o!U#VP4k)5L)R&oMv~kOVL~x_H z5MH`Bx*UCfdJLW>)iBj_o2zGf{vFwqDZ_X0A)1jf-(iB<@LV$7B^(&il0TPY!ZMr`_7TdRW7s12A+<67KrtsoxorQ!HgxWbpPSuMH2$h~ zQ7pZe%gHbO!aerWpxqaWTxjH$E&E-TLLWFbJij2%_!LV{VyOHn?eZSpEqC?c!VDnH z?GreB6fY&YdODu-F609_UM=5W8PrZV`R0Lwr>}I^1wZzb-iBJ<39cUP+B?w6x8AoN zuUWj4SC?&loxr?v7lD0|Map>tuOd%r?d~gy#9C(# zylXoiC-tcA11_p!tEtp+D#z+~7oLXp^on=*R*^}%XrlmJ@<9b)LN2?hCL43r3oz7C z`g^?3udi!~j@3=I440<6)2>67Bc3MLeDi$+8U4>qm%U87J325Q*4o^X^LSJP2#wB4 zL_WzId(v-X@y^QWfSMkrY@wB!p88;)ho(Bc9x9NN1KxsroBnSAi<5n$$7aXXa<+ZN zAj0N#l!|xbMmM%wZRE@Xhr;nJ-2<8mo>u4UuY6ae_v0tz)Jo;(a~_!f#u^9PyIK*o ze&=9^x2I!Qme;MjmY8m5-zDsp`8VRRR)mv>9;hmMpCGL4Gfb>Un7vf*^vXBaWrNPH zKRS`|bnyYZYLDkjCyS3qx&BO{!!y&TXkLGOQ*~qi1bB68`Z0|@P&X6ewSCwS$h%#G zX|L%$5mVRB`9ZypUHK-&N}lTkmFY-^+Og))>jR@}Q)(~CNP;OxmJWDdq#`!F+I_`6 z*~nikfbDkp`YE}g4>N46Osqob>%&w0)VE@XpZkv|x%@pnf|F*CbcPg zF?es-&uLa&Ya{^};X~5|AEFra;R3&OHIy|H6H1843E6P@PZLnwYpyyi z-5vRJuhyZ#lMx}2#NJgwP|0!LIqN6<*zxZZcXq$!y+|YboTbNfx? zrrw()U1-rfz)4jnxi;|AA^VP}uV30pt5c%}6A&*f}b9Yv!s@QT7eaS2Q4xyp#ALPH>l5 zz{G?v0%%!u%`&r~!%WLjtaEFUdY?Y)>Nvio7cL@}BKTSw=v&JGhd zR7Q~><*6u%B*)p2@Q1RqQ2&t;4}|_;z4I5`YO+_PjY-isuO`+!+U1`s!Mhk);x3jH z#esHnsU&=!y}=4{yBFEhjRDuio!R@_nnpsToz`Dg(XSBm+W;fTTxDu?uhhCJMaR`9E^&7jX^fDn@5FuImjb|d>%+4i_9t(?3HJscY- z4Sj~t7Bs3!S?yfF;>rfj&_>WtX3GpjE-u%YBQRsjavVrFAF(p6>M&@H5h|7}KAJ$B z3Do=nkp)e$X$35aKF<lo`z+%LRmCi`!I|K!HmN~5kmrr zM{+A%rUS_9{4-OzEa!Eu^c($1`XX|;UOGcrzgC8Xh6_0+bYJ1`Wb|iFo6B+gzbH2a zK|MT5Up1IJScRNVM7U@*0S*~6T-af7KFT7Za$y=U^s=R2`4BW{+R@2!K*DBQ31C-& zV5#Neb2Xc`1Gq4`#daXicJwb%guyyw^xts9`>-W&2y=mO9GA1S6lKLC6tfjuLcQP= zh&1Y)ecl+#MuYmui7XfidCl`32w74;15(p1=&@cy9#Z6xJI$~NBPZi6Ld;`CxTPEI z%ubG|p`>0|1VgqY-gZeBr;W6>;Z{W><3C_Qo&)$%uM_M`9EV71Mn7foAwnvQw(9;R zdWzLClTspy2g))hEG&O{#p-G?64{seSVogx4B&pa;l^7chTpQtAW0#okeI+o=!dCB zX>{~LJ*O?=mi>vVZGa#{KpXFe3qekXfXfaOf8QoQbN3@NBI1BdAie2@Vn(GS#`@Ed zt{ME--!!?1WFO}b9e2R0+s~0I--#i0wI2i%r%gR9l~aj@Ke)g1kF#_VE@_8G|=yJ z8L(q)7@-5t|9wM5yq_|8 zR;s@ocjv|Q97);WeBh7szwD7-bzAtfkepC^PKhm=3O0gq0q_1iaqxFDyoTz3SYOI` zxPKD(S$^^}VHXQNhYplRfmZ$08GhtmKrZ5d?G+1geO9dm`ME%g>pe3AhG2BHZ`47n zTpRnPzDrCKpWF|vl^=65G0GtP+?e~9qZ7`mdvy=`n(J|VihIkR)GeXu)}^r^FTw(f z>El@Id*N9bH)p0PEg8l;85g4ruDI-FQ1?*?h}x?3-6IJmT5nUCjziwlyXsQKzoqtc z(Z7;H?}Tl2Ci;{^;Nhqc)cWkB9*gaLqEH!oYr|iAY){2gBG8$dB2)$_krc6(24J|x#xE>dM>%?&9cO8;5@Gc>GaMkcHU~f6Y0G1Z#Q5r z>%DzXuwG8j=Veh1n%a#@-;uHb0gm}Kq=J=iEposKEUmhIc$#} z$1B~3tAiIcVvEjNkfc6u>LzFgtH=JiZC#)9S&}h(KKhF+q3=fd*6wiFk9jBcSxnzx zyuEAPi~-x~ObC_h3Pa(JYhk9Io}@!nER-8BQPVShQ76iz;_^= zs3%URoMUNiwg2k))%ugawhQYRqqWO*(er}tRa!u8Pkw`Vq0qMSML61CmjY;8bJRd@ zJK7^;cQH70^x?S4aEkJ_XTtv01z351pzB^AHJt${e)^rjYgZTpKdb3_+MSU;&k5|# z>FyRa!2G0~r{2^vh}{W^l9)yayi^QlPwi`np=~J9Nt2 z*IY)OrV)WpcX?X?QG^*Zg( z{>5i~hJ(ZAo+MiGx4?_m)*Rq#o98s{k@dX9);Yr3fU)uEnBMv-`uAy!9$W7yA3*)( ztFDA6cL(NH?tX)N7yPNvtZU=PTd=GDSyPYOx%ZqZylHmC0?P#?0U7VF}rgS->e(bWj#=lmBK z-TK03w7MSC(vnpVOfj|{ZMmpko#X7{xOeYbeSq0o4|nd4y3?;*9wQtNmdIu5{DfJp zu+#d_Fb@y&{|C&&{l8!yigKiEZ>)NVs2P}*5XqLed*s*qiMOY2m8Bq@e`J-=>Efh+ zLF%Lx7O8al1*=R9sclbm=Lw{a58Hx%$z$S>&3jZ1gt99q>NH+hl@GL+EAc+bAp=Bw zwAp-4<>RUihO_tRX9ui~jQ6aNrAuvyLgICMczhIN2k?*7Zk|}gEp!b|R5glw!CvCu zq*hLlo(xK@4%59DKw_z@oQ_D5xFNoN(j+T!sg+@ z^pZl1ou$OefG_OT_J4*XM1&y)qYWBB^-$zCW_~AmR-L#p=XM1-(i~vxXbp}8bX%!} z*_E;L@_G;yYFfB7_JNC3i`LLgJ@B(bHPd00hI$5iK5L zRY)1aZcFVGtc>_?;tOR7D;u$LD<@QgDXZz)2G~+dwCb*=DMH@v$ z9o7CE*8n#w;-Yt6kVCHQsql#bi$8n|gFWXk@Y`6}+;miEeNSZ^M*9DC^la-Fb8s z+q1Ofl4{+_NC$i_ZDS2{yvx@c&PlNf=-?LDE!gjfxP4vs!^K;HC`7;ge~GBQzsce=ls?y z)2|G|adW|&bEsL53vup_LAOdZ>IbvvT@ryl$K==&VXl{B z_~eei=#B9$#4N0xh8zVM`B;3Ae;|$|s+Xn&maN2yxvjA@AWn~wt3*hewa~P#AoajA zw|w)Up27+crA-Pfpe(>SVV$W*M}GbeX8GX|&OGwt=WK-j4_9{P`)W~4RVU2A&>I~* zYWUP|eBXGnOzM7t4D`pB0ic(w&v%>@3QUG`nX(nY=hL#jKWGm{bT9IIT;n>tWiRITUvEM0#s8c3?-ezv|wRQp`o{S3|lkde%Mw$uUe!C>W_7TUw$MKghW`<<%2`?dc0I3Pf# z%8B8Zz5Ob)s_V36x)q)_ zu24eX?%6gQi|eLc=tgQ@dEOu{FG9z-BFSMs{?URTvjG4`)07?`rebRjuP9 z(^Ln}^h3r|o#T=Y>ufgsBfy7Lymr0Iv?KgTC;PEa^uyi0xF$Ie+o4fj`<=CX?LUhb zc?oB^d^VO_uG0%w-NcmPe_q?b1LH$EL2b2Y2CjD`PQYli7U$DjpiIp{6(GkL*s?*l zsI2=uy>kHT-v!t->`raox!Mt1POIy-R4=5=Ot*Hw!lrvaDt+oEd3pKS=~)Z@c;5TD zr1*m0DPH&Y*o#5cP`I6K|XGF?)h3H%LSdkLlF zzIpvFy(SdNM8sh2#(y>((=`#8#lnJ6uqXB6Bd~QBY5kFv+W83Io4ai!D+xU-A{dccIjEb1w`k={&)`Lz7cZ4qEz6I zQI5S`hdht;FJbeHByl3C!?}SS*Z=5YYHJ=~JltDYKk_`*1yK2c4cJ(}$rKK;%3r=l zhb|PYbJ^Ob#u^jnKA1bc`joHm2+CdUxh-_;4{K|`W(H>zP)Me99KD7jK{Tg zrMU5C4zu3b)$$j&uFF@P3)t!^LN zy~zH6oNs6D+{5B7`U0_qD*aQhCYN9)DM>zTZoZr)K`14lRUujrhgI`WuA*g|DFSbC z=ie_;$XPxrC_97O2QW|N%cd1RURBGkb?a1Inwy1uJ{sCoTmt@dp709V##kV@=I&|ZvJJHFPqDSZSCN1e-D$sWL-bYvm;;I4|l-gFYPZ}7edgmeG0Nb3-fHA z{DfQ^u+jNXkq*oMJJMlg`Ja%EZo*|5lJ7Ka7erv(UjqV9Y1U*S*#m~RX`cITl9iRq zlZtX;K?FE*q7O%z7Qg+%v=qqCa4o_`E1)=v&m=A7Af!(tg z)PkJjzt>haelRG@3M?Q#%)U|W@zzu7zXgE7G zlBn`A+8mVq*l!?fP%;n@&GxP<6G>uJ{+9 z7o>VVbUQ594vK0V{3JOS6&CPkAl-(ha4&>VF;a}E)V@QFjl;G%Tn1Zz7fQiW=pfHw!xfBkz6To%vtvr+s?eEC=V)yDgMvWsQp-pEA%%zP|;Z+C@ zHHTF^*+U#6>c`qbuR6X&PPNQGVU?|to}oUV$rsJ5RJxl|u9cC+J`QN@AIyExc9mTJjG z3UBaLLz{S;-Y$O8wL)}VHM3xA{FJaVRCU6DI26@W28(*sA2z% zwuzLg?_gC0YJzQru0z9An5s#j)M(?CgrV@zjzO1GYyGQH16v zrY~bFGDK@7fa0H(zF4>7xmTgsv{Jr; z0OWA6; z`5+9E=~!aUcnH(Bvl-Xwv*9Oi;~CfUEnEgXEByFudEP9R^uGG=vb?(7+|;)^y{!_IKmlFVcx-J= z1AYTJJsuYXuMe9%8FK5BYCn9Yt-W?t-q_v@S~R@QFnj>V-2N$7%3fWI_A)@&>2$xV zDVX>B7oR8rsjKxMKuK;&aVuAJ=k1c+_*=GL<_FTFW=3cA%fG6Qq+tv{0NtniWbVH= zo4Ra$)_3ik7nW$oliXOVw{!LzM`gj^f+=tIkE;K2{jY6(t@Tw>R)eOMQ=bQHSl9Wc zwY?90v#VQn@~GEJK|VeGpJ+^td*xkQE`V!)`isewtzw2p+YGL^QFLIZU&xMx+0$n0 z&bJ#w`@?{jgVpYkQ_jk>=(qUnk77RR;;O=CoyN}Z-KT#QY%Xa$)4Lx}zuhZbr80Qy zWsFb0Et=45dAo2=7~f3TmyWjB4eB$$P3*P;=<9fHPP)6Wu39*k-(JRM>2ew~AwC{& z8+L^CyBXvGl${+Op9|hVauVvshZfWJExGG(1&7O^^5?)!<&#%g=y{LQneNW)q)cD$nncR;hKN4De}o+yP#emuq^w z-#SbBV_{>fYZAZhy2M%McGuS&Pu7*GeR~VOolBPzdeBNWm+&@clr?=>>9m8da=A-& z2if~}>E}el@^n=lT!`)~EGVs@F&!S9?Zl>|=fXBc=Sn$)jgu=5lJ48;_LnZt9}TT% zH92R}#>a}4)|ne-ciVje@t*Cx>r-s&!(#*3ce>{4tJzeW>#LTToY_Pt`)w^~{D-CW zt79VN60{thA`qNZ0<|k zK7RvXT)X(ZychCj;RvKnUTHS1Vak=$%EFQ3crvbb^v5F;$C4q6iz7#JG21M-|<~!6mk?`<`#p=l7wkl4Je5d z$pk3coX3Jb!li^RPT7*bv+jwF8fn(dLGf_;a$u8XE^XkF{o%oB>Sm2f)()Ui0s)`` zB7i3Ok0pW2*T~8p@5-vN^F3X-@yxtB6x-wqxQh3Le2)F^F{!|FK{2V9SYJIwM<`dA zUZe4b8PpZ8$zkZP_j<$|b4o6Y9hcZic#9@2DiSk?A2Q4sA@cT#%uYm&!PrHK0yUEb zk#*9oeDOOH{_c|cO-3-%gc zTCAmU_XjDe2jAg6mnd@dWrg&d@(LoT?oCq`i(C^DXjGbfBu$7Y>2?rzk zmWbGsc@HiI=L?}N`qla4!fO*i>WKFIUUCe`QV!<^4Wj~*rgZ12Cp*9oY2+ty^(cfF zs%&O99I?P}>`HzBP!EsOeuoJc^e#J#EnQaqgdT^&^b0&vz z;GCsUz*TLRXmOw7A=__aoP?$W6S}b{9ugzfH~03h0XjJp4fBHvJZUo8$CXjr_m-;H zA7{$9?^gF`9i>$(_0Tux;t$X6dn5habYK>4FR{2qhk=<59;>eNaqI3FB7EpehdF$I zg)UT!u=wuw^8KhqYvbSvbiqe zX?+~H?!SBE_fT}?;Dw#OJQwg_<<%_ClGr=|UmIHIT~^?|Ppal(hJGrH)A??LxWh}<8(2-vBWSyA!i!mLqv2J=9m5;#Jsr(n z_V&=a`De3G5IgZ(T{dQeC*;aA&yQiX)y z+AZNbkuYlADX*uxHC}=}<9h3Q!R-uVq17#W>GAsWU?gaVcXxGI}?0H8!aA@rO};$mZrqD*~~zxTa|?Eikvk4mD59 zJe-wBp3cR|gwatm)2tlhy}Ub}xNJv5a+a;F11oCw=%vlJxqmz7qosZ|C$^dF0Z#yV zw;E^0%_2(I?-WRtMaj$0La?3LrnWcnCXTPOsqfRy_JiU%t!AsOHmw$JoyB|-=*7mT zoXG2mgs%-n!g*SLV%2Vx4QwVH%N;?D@P9ho1XLDa_CYVH*``8mfrg^x zO){As^8=iAhZ3jJYBn=TN%3*4o}h7> zW9MtVXV%W$p6t{QZM3FWZSUSpW6J0{bpOJX$`=>-NnUpAja>(F#jM)fz05P@XRRmC zisaL@IRcCCskzG-AIy-h{hN{MlYsua6owyIkM4ZeO2a8G=>Z=VzL{uc!UX z(ao&1&B-Vgw?@=I`Dd@_>(ruvpWUN*Ggi%$k9W`KaeH5*i+a32PjBa8yFK6UpPnDb zmtnJczIFq*J3T({_uFZkWwno$UKdZTn?F4>wcoSwCjt!+y)@tgkUwyK8Q?RKZ)q7P zXnoufJz|L%o}(DerQ&2p~v7RWL#P_S`^cy#bicXJ%w zV*MCY&uYDv&sJRWi0#r*C@Ps07sWbLbKz`<#BRI}-zq)U+kPllJHV5bcT|nn&JuYY zH1nkCqS`Rpa+H{sX%%X(jw;=XdFH;J!t3ew+M3+2y47Y)=6*lDshK~9t(}!{%}#`v znMAm&Q<5_8U=_q%RTw1n=9Z$Bb!T15-?rnSzIyNmWOlhz(q5)@*zGi$cMYiM9$Hmm z@157#3ePn4j?Ud$Ljup1kl^K6!7c{5eVy2~9#zqLXrg9?|0OY(m6d_%pZc)dJUW$E?2fl@zkH>E z#+S_`0uAu3#dQVM6Tg7VKAr*sOu$V|(>_0y#}lg+wM<;{dd&0fQcbT>t`;?O9mSx>m?UjGnM10v}Rk(7Ir(P(PKsEN{O1{HYa^76-FG@9d`Yk~1$ z!hBh76&g+T9>7x`d)1*=K03Wpr1{qz7zVmHr=V6!_fb`%TKN=Hb*~{%>tqa_2uJL{cdYU6s-{5S=4TK(4() zA~>dM9!jrwwv@;mJL=X;oR+?;BhE9pH;|w*if5+)EzBgFF_&T!KujX!fyAT}K&->X zCQ8Uz~CQJ!2*6m5@V7@ z3;^Z<$QTHZXQhCK5Ui*M!(@+NViywv!JZZ*e*b$V6$yr6&s@~dMNqlELw1jFEXSz_ zrE_3z?Fs!^q&2Z5q{Jji--}_#oRIH{Dk3;Mqn(I&7Dn%iDtc4Vj@QHl4a65RSoROv zBN?deH?<|jhFu9jB!%riGDCC*3D}ci*Hm`_CRi4zt=$LiFaN}hMfFB?O{T#yOeHn$ ziVY=)BwyxC{Ec;x9vh$z0VO6C*#`THk&`{WTOx(z{r4#){BD55c*m|js0NCe!EoZH z$u4gipArc-m~*du$>5kWRtwT%^!W<(W9$60gn?t#pVT_0&7g{Su)<9ITn6&3k2>Cf zdJn5h)SHxBPn->Ld=QMl+ z&TNcC!+8&%-WjlAOM-8Z7_z0Fs1uO?B!u!W8fX*G0}y7b#X>Z1WJh<6ml||uxzGjW zE@O`23#ta8JZ>ikloDWn9Wm}cKocykB2q>`z=2rI@$L?z1rm8dKlSpnLf#&j8<-Ge z6xKDwD>GdD0sM4x9wN)19pY~SPn<`OnBY&PrI6btc?|5}k1v?XQq~>JQ~V~*Ct#rH z_@v(OE>Y~M9KSO4xHAq=1IwqWkBp|(T>xIc1FYbK5)DPOiC7K???$~}0DDKD2wPt7 z1JVSG>hbp%7S%%O^+wAR!HfUffb|~2V|!-gh&_MN0m3WFMdWS&aioxzAx&ryj144b zI1OfdXDgwkMy6BF{l zN1sboZ<>8Gf~cL91T|Ns-k^S`-9U=MlnxebZvKt^2L1Y13e{MlPl_?YJ))?;V%uD5 zt|Mt0+#Bkc%MT{QENI#=xMc{e!O~pVek0>4Jq#0*b9H;1tprdUa~ zow~!EIGgZfuVh53No^9I&--IhuJ`Nhd2salP>6#W9u9}i5%9R}5I$)R8ySaOqrG*ys7Xc7EvkDS;p_R zlxD@N1i986QpWg!3*LZ~6cw~cjjjCh5M07jwlmZGL+hxv0a6SZ7oOiR%ThjGdT-3v~FVl47}F7=B*lB7u&Z! z;f^~L4^hD>x+gvAZx~r}(V!51&=lb9=~XmbJCv7abSPOtgG4foi74@U{EMKd?8<;; zo7Utk#ENhR!DGm-xfWG(^WhdM$Nz2)S9?)sFez z)<+8od9k6&_aQ^1N>Yh8366=L-#tz?pDWZ@H6EXTyjD%EH`!x~%nonNTPRfSQ?h=l z3LUWGGZlQGrrHzB>EhjNG3ipZw>H)~>zJ^b7toq-}Nr)EioV*ifX}WzuEX z419x)pY@}$(rT!ySNpkIeXvcd1oiR99nC#()V_Gne!`cS_XipF&Ug8X;{mjSVXCe z+CnKR?%7Kp!3@yeMsn*k9#PLK$cDKcnd~&kZ3V{2Gq!=+awuO^OGE4j$i-|)sHNuD zUX3egZx#z!F&wzNIRNQ#0oA9`p#iVSLAqE~yFJ4uk$FEsmWqkx4}+9aV>8^8Qo$d{ zMpFfllvqRRx9E#k=-0RmYF>F0aDBvM42F_nA&2AdU?5rHnS?G!mil834njY*QZ+Sc z)<8nVgky*KZ4rPoB)clqMI>842QnOG+i#I2P9@LNk?o1dEof4{=7HDrT(~L zUt}m}$Rsw@>zCCPrw65wfU{QrHXaTTNr%gwf^_>dY+#KodEr0y8O`+>y^-wwCY1*^ z;BMggrBE{`AdaZIFlYeL-LO~{sa@FX>E|Lr9!~qK^=N|U6YCB)_|Gl>&&X*3b?@9G z|BF3LTgvXFQ$Z=_{r29Z+ePE*!|mq#t^O=X2a^-^hW$CQ<|5Z-qoz(Q#nKTr(=EU{ z?CtUFC=|_?=)J>8Ai0A@z53753zdksN1iX+C0B~%HJgm~=u|yhf08VD;WDB~#S#RS zrxuila7Y}_)Hp}#r0pvnlnYW)Ee%>`yFOMenps2Fv^7uU#E=biR(FRpw&fG$s32@@ zu3CF0m@P8AD$69FFMLonrx80Fa&8E@Z*pn*^Jk(G*+ftn3(In=#KWOCl5+ zams>qBi**%(<$x==fep6Q z0z09X=I1hvW78;Bn-$%rl@Xi*9hO*{?l*dYV8*cdZdsNaOD$D#;G8NcL_64heZq=m zFk<62r3mD)Wacv8_ye*)R1$m*_2Wg5c-t~}mpN)a$Kx3vWIBN+%k+`xp^%SaY@0IO zV3MKgLmQX3oIJ{BuTnVSa>TTLQ@;gt%0O*8W-lAW346-h}iNiG#6 zo5X2_yhe^g;bc~7A8cUy=lwT_6I!e47g2-*Cei|rAOFku~9m}{r6 zDOWXYe{eRP2XkL!o>Dw^onSVF_mnR>Bvth(VD&9RfKWT# z03i2mNEkUO5B|}lWrt)qsUwiaKY9LLB2iP_H@!q6tu;}D-2$A=VHRH7kW4EXlskWl zc#_Lk}D`00!A3kQGI*X}RPJuADCu%W*& zOllE?YaqH!zAwsUDJ`1|X;ppJrr7z!#i2%kVQ=^7r8vwVX3WmBjJ&TjR>>cHw8H<3xL zYj8|3ed8b?DMIKk`j&xpM{^Ww<~MA#tZdm{{89~pEttSUK%)RL2xN%R?T%fN68OaJ zYVzmxoivTF(_tNEbLuuoI%r#dW^OZXch*dw2(zsivMe}MKJ~!tzQAl|D92Z9YHy49 z#gqy#)FWYvF$bM^B@u3yo;Ofx!*#gD;$u0N9x5eR=>bA$&B6@+=l=YSoGRS30g{kV zTDtTTz6ybkW*naug(+fJ&?1}zYW@gUAcxJWp%oT!C{_sjOivvV{X!6!r0+9Qe}`?t z3XQaEry(P$C84MiLsmLUNb-}tBEOX3C{fHOm>11IDyh?(7FoH983n(fry@m6hYRyE zEAHPEf@_-$b@q*nzbPd%9Dg>-Hw-wsPb=5l`ahN`oYgonGla! z?jp%mmfoE3p0s?sl(*8eUUE0-=`S+x0S5vfb7Kf1p9})wx%sV{cE3o&$I9)fqg!iS zb@pzhdW8jP*%BqP0fX+3!smc| zG8%4bKbw3p1WlLw1JCbw%;eCUNeIu6lQ-e5yTHLn+h2II@$krFt^4I2YDcq23UTqt zLTbAHYeb_V)Ux<$Wc$_4?Ki_1Dp4)4*_9CIwnR%R16Oxe_eEQIybxIw(dSj+Kv1m2uf4WfdXB3PPo_&Td-ICS1- zJdK8pxxa6s!75=LFZSBg&^<*##@)?PHO|yZ^rKUf-;-A=uHHBpsuEeFVJ~Y&ZGbv5 z=MO+wq(+Al;Eg#D=JYaS_e(-d?qE?UaFF%#V%w1~#iA}?>3FNolp_q_bO%8kPsVdV zYXwFm#^}SU2SFHHDA=U;<|sE@E#-gJY7R3e72gcp8-y*~8vgPa z*T?V%7Rj_InW3CmmhsNp#kzDKYV_=}>fzMMCN6{&Ge>=I6cyFK0$C{4fZ^0pOo~Sf zh(($U1-#ZRQR@0#gZC883eLIg>ey+OW6z)TVe`Z#uyO5|Vk5FDnKoT$Wm{~ubq)Wa z>5HZlB)gif$3(`p+mIU_>5(h*&f7B-uO)^U7euGE_2wJ@=S3OKSlF=-k)xuRLC^ev z*g?ASZ(6Lh*G?ACj~hfdzbK^m$*OcF$O7v~QT2~{Etw>Fo&Yg9BqD1;vn3LuTkM#( z^F4~9s9>awdUdYwgk0oYax^#@z?dg}AWIU!fX@`0_%FM@6VAGYN<&a>5KTqt$?THm zBz`_FneKaDD(W->&rf`c8k3pDo+%GeiSbhNKNirPTC_LRo4Hq@hm94hw3tnL7t}!TFtyEgv5AS9`62S0sk`R5|Gh56AbcPW7RBNR{8FJmL^<9keZOa5fCWaB07{e! zN@UB3Zh+|jF`+;7;MmXj3O1oZZ%Ar(V<|Uh3yHkjED`jvvzNCPlj_zur`WWXv+_XL z7wMZqjB4G+E&=1zRc&hZv5mC9(N>ZHl->V5)C0f0?^}`~={E`e<{4NAFjOKDxOQ77 zQ7MT40fE;%#O8%Es+e(*V2{-APM{}8k9s9u{ff)v-{oF|=Nw8G*YfQlZZ0;mKxs;i z!<6czGt+UNxTp-FrY(JrGt5~^!Og$=IUaH^RPu6tfrv>ypYet?5mCynyS>w69XqDgwWGH|HtWTQImMjvw#N(c8v&OBL;3UV49zIp%D8>4(y0MFRBLJYTimI3+%62#Pcb-M$< zZSxLMTm7E7OK>oV2nGYQ0FuV0hT@58vLofyWYz$u0wWMe0dLrn^D-(ndqz5!F?%BT zgFu*_-svt4%mkEMFgB87LE|dr(z2-ZJ8$l?Lx4kRog|hxa z?}{zS$q2!b9H$(_xFWQ*NVOIMx(|4kaJF1Y0&wD|&PUR!2i!;kw)2^q&Nk078mzgf zzZ$Dlu9&cVZ|Ro7PUtx9?V@Gygl$8)A`MVwfWK0sR!RC zHIU%TMR^aALiu40hP@~he%(}E_N|c9|D(Uam?18gqEt$Lo&5@W1 zj7rtVHWLy}eHBaLRDs)oKEuASyyOzj5F`HX65d=WMCM~NrnAZPOQbIcfZZw@ylBLI zR40E}Kmb#@w~sV)oAe^CCP0IIjgIBm*Y(Rt0NW}b{I6s|~WyLcme!G5L>fo}jfQr&qT#El~KfJqgY?w2^X<<%)IK<9X2R=fh4X?e|yUODJAfgG-{ZS#O9)2Icq=rO~eqcr=Xr; z>JaYD+++ikIC{-?%;Yy}(ZscS%1p);QrG8K=VRR~AS3^e;I$n3W7~V4T+Kr-EO$rB z#zPg802XTq%cH#>kcUy%6YPk?0$9VfPNJ(y^7mbwkLIHNl6=r(cUOzRQ+2wcK2MBa zzPS3QakPrtL_gq|kzpRc5H&pNONYuNSp$(R4+P{cVD=%1ZNGf&oLt^ILDc%}({=UIhvvR9Mi zJo{;}9CY89aW8^V2|wlxozDX{+GAfmc{JEy^^0k75dx73-v|6Lg4W_|`2kk}%R%}N zks~$+rvDf8H#`0RC33{X!T4{er)4djT5JwmpV`{qqr`nRB9Tkr^z`)N@!Z7fFs7&1 z1Mn@Uo(z2ha3`LDN4sIvI4)|HQf@~hT|<2$)9SGtI~TN>6|x7DA?ITq_~1qRt#sN?J$S` zG2(++_!F@%Ih>i+K+!26%^X7;s3B>zQ_|o@=;c(Y^i#LtrkRA%Pp{-yK%AbVy{~_^ z4n~&Qqq!7<1YB)8Ev{SFQy5TOcZuIc!bnmWqhGi^v7%M$V#7DPuY^b|O$k5sl{Os)k-8|0ESNE;M7-8E%Q zFWp$*+Mu_d5@|VI#3h#6k#WG)rAgs69?E3ZKqph2EuEGQLwIZS+pxqMp;Vdn0IvAC zA+&3FN)Un{~;wXvbQ6 zEt+}9jg%@wX9z}?AUrM*F%YOeYlhrl_@Y=s)zI z*N~S60BGol_V*$}&cYU?{B#-LRRbuj9BC!~y7dk@-h4Q6jq>mhLuBwIJI$xab zvQ(#D2CJ%LOFD!qqs!7<_?F6bvzny66sAM9d5-zrY>CT}Oiav(v0XWr*>qS$Vobu# z{ajISrAY~oWHOIOp?gUrIq=uUuqZn(%bGmUc5vxp9x!MA*Yo(fJ@a#?zyMNys@E^NgS81v@mPhSVDXJcgD@VL4e0qP> zID<}W+bFx*SopcYQW#ao_0n+k@=}ZBV6uK~q908_7qM=|hZWrdZgs^hr!{e%Cfx?N zp-f|%W=RC~40TkTZe(Znx9*F2dm8rR&>`59t#H)pLy91AFI85elO>5i)Hv%*@yZ~t-X2Ia+(@~m1*z#F&$rjNciXxz z(VTuGU+sQWrp8zVSq+#sB|5i@yMIyRCtgX{wRYcMlX7}HpO<_+pU?ZpZ-=XTJ>K7^ zd{WXsPtVs`csoDupKn%DTm#RCS$Mua-*$4OV}9K}AMinzPmtRlFL-m+us%yxt*Wkw zZW_`hI$I`5U3`0foay+5yv!*tFDA;hm!|bQE+4IWzCP;6KH^uiUZPVhy zXt#e6`uc6zY>XZ($Ud!z81^*5ej?gnT;~RyAIjT}tZX)wwGzAvwskakcXhm)aK|-V zRAfQrWt4Z8@1WDru~$D*;$T;C;R^hQDdE-mwE@cW&;&C93)eyQe*eCm(25pBQO8%1 z-8)YHkf~sc)A|{!kZXVd(e&fG=k^2G(>LjNkjieyExA>WX9 z7V~hkl9s6)S?Ydqv+Mc!e4AWNYe92xY5V??!fOGR$Ey8#Jw8nCHsFnF# z8j}0h<+^AoIzAIokx9@}R2-IsC3#EUQD_{NgzeuA3fL0nkL*rES#2!a!Dv801(orGK@(?)$OFgtAz*{o_#xne z&-fwWgJ1a}5P~5DptwPEf#3@f*Cg|)0%}19kkF;_sRJ587Le4X@@WEEK@O18rSfS5 zIzb+g)}-?30(zGqxZ(7P9?k($4FItI!~w6FEs_a>;0FT;!r+4d3Zmc#15)}_1UQC+ z1k3Y>g9hvKhl2&%^Z#=HpQCwJ$LC?-3RIOzeOjL-Xc^`o#-DWr_kSzfQs;pIVzaG< z0cy3kM-Lu3v@=39;4MMzb;EVY+xXbpA$#HNd^zuyyMiE&<{y9{#`cN?zy?7Q#W#?? zi^j-h7-ljyyvyh}1IyF!oB`ziUlYUI^dCku8AIPp>+N+PGN1AM9(>BCO;T%ME#2r!6JZj?7#s|VITgm@GGLwarU_- zsSt2Lb3-u6ON94uxUq1;abf@SEm8-Rz07T~8!j+!Mg!4QlQ~v398zfw?aW{mOOON7er%?3Jk&_%zah@X-6A2=qFXyl(53mieb z`2stc;eQpTD)>iW1g8-M<1PU1P$cP7FHT8ZkoUQKP)LRin_@FwhEH)4HpY%s5iwr= z_A$D(ek8TjMHL;r#=4He^#V88VD!2ozIP7)N>FB^74~V^0N@~YT5~AEw2(f63Mgs1`RU8A}N)) zn_R>e4Ow3Ff`CkC2b#_Dmt`uXmg8#2q};)gSIS`ZmR zCoEn}6d`NOp2Ja5@3AHj&kUy@i}v?B0u|d${0G=;?boPopb?!!*}##D!9x!Hga39@ z)Tmk~fmpKlLaV`$J zM2=~-iLomVe6*z5b5dxdNi~=*=qf#}6?AR8AFr$)du@tmPh5=w=IDgG2_S_qV z^LP9+nV6fyxcr&{4silIIcyj|i1dhMKO+ z-tR`9Y+uuutp_AFI?OG2iR>8!7xf+Ut{XpdZYee93(mFlnx)}3C3s9KT8uMeE%nov zxC?aV8jrmsLpbUv#PizeD;q|op4<1nFAn#|5KA;!bu;c{w0BgDhN4G_kH0a79B}+#FYDCNw8IFaHoCb zr))w7m8;#a&eq6nEfK?V@tR+&8ovm%9CBnFfCUiyf32>eZ2CktiBGOK)8_2RwW-xC zDYP$}do=l7SjuASdu|p4Gvv$Ia-BW33_=F;9th=!u1I96pW-r=%7keZQe@kRmLRD0 zEABZ2%d!7b)r~!rWDAdgL1avzhHf|HN3({im?~NdE`?=ggJlKm5D1v;KpZPt?NN*~F1f)Y`z=MA+o7;UCEn@iNW9GV2DTWOd5AT!!cY{id%bvD zlUvMIKu6iRPF@?jSH?-U&dW?6gUljeJX|Ur%yTSiN&s8~?F*^#RaKF`g0Hj}UCmcV zGS&fGw zHXM7R7l3wnXQmx-=0?_TMO%(yEMcZB!`RELe+I)N`6LE=NeJXie;cBr4_A8MQ9_R z6PzEGllu`O6C0r^NJepd5)}L-&y}dOX@`WDI*CKbcnv?*$d#Q}A%Yr-kAvc-V9jU4 zK+Kzrhg~AhemLX6TyRoVe4smDMbxL=R%>g=U~ocX;d;4R*Gdk4<(X%>I`2Qi1}z*@ z|EIBK`v?Efe;->W`hVMb(V5q=3Zh2=+w<}hq2&_2->kt8Tu$X!Q#GBeSv)!m#uQqL z`u@mplBC0wcR%o$9(9PSs8VKQcrgc47#zx!l>k1Z#{#?pvMIyn({Dgt)OkhaS&h~5 zcKjOl(!cq*XZvCAT|uvG#~l0v-}IQ0_2E3JB6Eltpjmew9jj;tW}_h_eS7$L#d->-ob$!t-76xg8I1$~-9Fi~$$4hIi*HEgdY#VU`X*C`P* z@=Fr2q|2c}W>GwUC6~-q5aRz%{LLw{Olg$7PaSLq)|?=cqT^z7^J<$d*+}yhO}VM11yai2tM<%1^a~0IapvHv)3*WA@a=WH}5?3&)D<Lg5B4$>otyu3$h zlqTvI1&^!w!5`)sF>x|u6=VuBZCtM)oAQXOmKYrMIb5m4eQjR{{Jy)*kt;wlb zuB1KEj{6&-p`2!kilfz3p0H|STdq@#IRPPXWT02K_g|z`qT-!wb?%!7Um3ViVC7km zR@buUHz6by-d!i!iA>KZ`%Ci2%OMhzQ6(_?>FVH{*O1jHr~U98@f_dr)$h z1mpsDgKU6I0NDWB0Hp-91W@uho%71&Rd;fYk{WGcb@lG#yb%ZH*`G#w}e!1p^oAjeXoSR z1hv;mP<8_I#%zTpu*&1C8|S4AC7V^ttrcRb?~yi`OE6g=4?I7zWSj) zypFzUjL92gcja7k_w9Ek8%Mjrmtj&3{vXGJ`TxWo{`*)kv;6xUmn3I(NRKdl`;Efs zsuB4kc_B#OH9~h zGf4u+bJc?b9&I;rW3t{&A+x;3j!f~@PHq}~c)0~5FDvQy>r3xySnr?NvTIj+q0FuC zgu~;a`_@~#%cbA4aBH8gI3gxTGToiIWE?hI2J)3E#md}xm$ON|6PWx# z7WoB=TESErh?OZ$Iewoi^XpK1TFo)UWT)!hK~dk7IS@g+NExan-YvbArit~!T&`BN zpxvI%Ln7mZI%eeUjIYkc4Yp-N^~za{eDMB9e_;E6@rQp;Q>y&od+GxR=<{#v{*P6% z|DP)VcRkF2&&0;W@qgp0W?<%E`L|T4Yad8=Y_SY;6*swA^P7)cg*Z(oam<+5dGUss zd7JHqW1&N(2a;V^>vcysvQTV)2XVs;1RxMrEL&irECggELv{WAZhP-OAUi#XeN%(o zgKacdG;z_}+KZcc@l+xGeXqC|kCE!{&WqZLpPJqZPo!W(K~86|`rn?;T@}yLKSK`W z9$+=&Ib>$RE;ALa_`zTHDz_Y*KIUR6H@3m)1i{ho=RvJEkUbB}w?xLd{J%ZSZ*R(V z_Itlp*bp$ifi_leLjnu!E}8E>fw~5LPZ;q67{P?`J&98Y%1>) zy}5!m#owb?rrXWmYtG@m3VJ<#3evsr2rBjPx%Kq^0H~ke@->jt8qdE+zFH8>conylRL=jdo?rO|V&bIh)Fa-I%atEHZ6x=D^*hyZkyx|+1tE2W`_ z2G}+fY=0wAbQ?SG$@T)|uX&7z+Q^fc&aVyKOp%b8p80EYPpTT@=pY++RW(*hiQYkW z245}LQ=_drQ-s3m@NjuGc+U!xPyP+(vB~{^jD2HpFHaO@UXmBvwr$(CZQHi}i<1}I zw)0}!da-S9{vWn#w{~l5tEa1R``+oQ`7kv-_nZUNaD5SyfQubmz+zyI4Y`;;262zX zrhpPm^eQ>}Ba3Pk4v8_C_+j?J9O%yd-+4`_<+U(H>b z7*_pisNj%g8JW1(l4UcpK^Y2SlZAa`g=1nTfMoe(#r|4BO_X#5V6iGtyj~g98IilR zVKRq>nOfFaY8b<2o@Wb+7U2$&b!cpi>3DyH?5$_m>DX1~S=x^53M4vk73_jB*9g zgnl^;PV3W5lxaCAP3VYfChJ)EAIQY9o2$80W7yVS`FIsAUz?ecgAUb0Xx^sS#O1B0 z$)y%QqkXfR>8*qgI(TV&k!4;(Msy*bvnbC@)jINmiY7>S7gn~RmumGSOY&W zM41}pbf59d;n5(Qvc|?Fi9R@253B8(^3k5=zv{qyPQdYTQR7wAeDPyjuyD9OIc(cBAABk41x2yNwCG2sh+Fx}<&h?a@Cq4cPwx5A17{ z7x)9+IhF|WqBe4ucyon{Du?}!cW|$P_3)nR;v^#=Pohl*E#g>=!_|>clu};M z9!YNI(Ku+MMgp2rd|H0qv%OQ+CaZP;?yoiPCjic0jS`T-@8TrA{c||7c#zxZaM&q(QQ@muPj1mmL__hBZAxjimhHe zS7S#_)RsAN0YOt%DBqv70!Ya6UK)Bgs#PJk#KGi;%*ctXJS3mA_K5L6rz8M1XhH2F z+QIEHnw{oNU2@5$Bs0<)Yp1ky)&3%=C7qRI_U(O!1DxO(cO8*h+-$C%&9HW zaloI|3=tGVDtJK<6vDs3N;_)QPXGvrWFmDp>TyNU#({)Q6b%S@DyRTc!j^z^t$S5X z+Ujf6_t89&Xj@N2Br_68^SO@5kXc}4u6#W@6bRi0ssE0#w=6OAvzm(ZUeut7ZEX@{#H^^Kt6G{3(AvMWGx*FvXwaEkX$e;DH z^VNp7i&@@@XS(d;^=lcnR$C(aH2gwTK;!X4edX#P`z> z&VC!f0LcWf-b$yZR{ai0jX}=h16oGJ0j?tF09_SufT&~i!!$BP7eEFwgfiVrt5<1( zBq+CG?jHbM7rLQnO8KW~f!$v?>&9dT50qpg11tkzgscmWkqpQNHD?9tgn;|yhKvJz zLC67`UgF{k(v&tYn&+EL2YgxTf_MT{94!D&sSC;_a!NF7DD{)*8xW&?2gM_m+h7S~ z59osfibu>}D3$Zzf^)8pVI~d)Jq8`>XPTC@*v!0kP34(z_I*TBN^wX+QD>w7C`FiDX6J5y4 zV@3_ttAJ*f=%@rpO#sMJX_CRCTC`@hnT8D8FAcEzg^2$2wFnF_`(vQLg%FsqRB%`g zXsFi}5?Vs34oq06OR!^MU~@xkBK4xY!y3-l{zO{CDJhPJe~E`$ZFl0rTN%;yc-uTZ zM&kT;wl}l9FBasFuSQ04OD4P)fBE;qR_dU6&dUXuha2kn0LLS68Bi<>gh^>}9o;l% zH6`f1;C`G2Jvt(qn4+Fyz=x%jdeiqY4^Y7^XOX8PR;yXhY0;p?hq8N6+nkxOAVo&; z%&aG}AxeB_yjGJ1&-9)0_Imq$y}FNl@r8kFX<5OMpTiwqnND|e-PgGPLLFexgN`v5 z)KdvkD?X2|iwZ=<1l=zyL7XVKWcZk5*yHHRRzIOf1m>&VunToNO3>OXTt0PK^=uB_ z_5jE(FPEMX6+o~)@O=bd1)q9o3Tr>t_gwNmvNpSR@3*!z#W5cPcVDs&kWJ67EHf*{ z?WoX+g=`Lrh+>$eYj|WxGQ<<$TS=^(3aI1p4lwD#guo*HmJ5`z!zMG4bNpA;T8J2< z1J_tD5$m&B%EUpfLJE+msOiBwaV{rDtPeTHbt6Yu`L}nw_|ooreyzXJL(Q^hiLn2P zstra|Jss%!mfwoc^)k)cY&3i*XLr8p+O*p2h#e6%ZVhoz{QEqrL>l^lSUZUXKYS_= zByLV>LdBh)ccC4!^of~(i;B5+K~f8T?Mar?x4+Lhno;pDYvZ8a4DkkM!$#DM?C z8eYh+aKRZi?}si4JQl4k6QHJAf?R^wQeV&<6}P=XBz6nIkqn3M55FaD-|2lJVq-kM zYI}bQzt*^TM_*hXp9h@3s~N^|_XF&r6%bETR@aPb2VQjBzdz>U^G4h^Z>cWhPb#oo zRAamrbVby?>PXqm+JVZVv4PeoOpiZ_F7_wm<+; zP5)!Yu$!UINaG#Ut(Ph(jueKn%gysV0FCZ9n)Uv9t)Jb0wAtK6GbcS;x_8dZe)G7? zx#!h1^>-v))gtQ^E#Ek2XDRzhm>u06}<^uy58>0fQ%{vXpLM1E_L` z9kg5%KVJz|PJ=f6uOvHY zX-aUaUA=aTaN*I>LOTZO6e>Ozd`dXkFmj2}oa8RK4-6Nz(5Mw>6~a}nlv-1N#{lFv zg0ls}k`-csbAlsBSng_NGm4|A*<}v-b`jlP+hQv0pClahK@f0yu*~22oB`5$*{?rZ znuQLxt-ak6SH08s!oF*vQVWFCGgTCn=uW>#8;U4M4Uz^?G?482t8oY7{bq^MIZ|%@ zfP~26*#FMXgoY87bN}&!W1IhF@OfI2oAe^*dmwj%h%C}H?!xI2Z~;w~pvo7fImr_B zO2g*>hRk*=ogFxwScalkF8>b}`56vwo15_S5)1P*NV@ka`yIZ^*X3dN^L?lNsU`!L z8xDWF-dHToaA{HO!X)k&twB0&DPigXul~`t9V=!;wTMtxkt%6iWSozRzvW}(_I5@N zYo&a#c1MQu9BrX6cSTS9%9U)YvLAT*^RHem6v6CMH^x4PG8ASU<|1HdaJP2mK0fZ> zL2a=j%wT)J1~$iIFdi^MqjZ0CRS^JL0U{v|gbSpA6C^-cwv)#3Etn?QD)(nz+jA31 zX5ofzp=n&*oV6{VhY>yE$To62x;s24zn@y-!WRBx3aF=@Kj0T-J)Rl42`I5dNo90^ zO`RrO19)797*z@lZH}plygMfiSs$C04g1i+o8$Ty+QgD2Uu`F0gN;L1d}p?q&;@Y zE)oCp?@zk$F!94Sot*aqSQRP;2bN5On&=X`v?4{DYaU&0A~Pzal(DGC{8Wkio~t9_ zLt-Iy3Z?c6A6;qr1w-Egvjz?oBnmhUQDawo)lU&!QJ2mM^$U0~TGA_5-bZaL$Su5t zKd=WSV)-r!gQ{KGW^_1eMwM9Qgbh-1q$NUdb9W!6ADt61uW{UZ-C~~C;M?MsdcZwn zM)NprqTF{eSg=~KMK)+Q08ClI$^1r;-yS?pE57KNSXf%yZmnM*?>9M{+U(EI_QT{( z@jcf(gWEg6v63e{0v4c26P;g1EX)MK;!$Qcf)GZzUz?raF?Pu2F4!wPAEpkE_KVjw z;r?w}apwlVB2e?}11IVE8d1(MFodC;q7XnyGiA^}RyNfv>8l;tF5&AuD5%ZoVn<34d_A$k zINRwrM-a`!@?5&Wr`2gGc^katYT?UpEG zG}>Af6WS0HazVC0>bSlzz;mEx5v9twnCWYBre4w4C_nm0HMYuZ84k~+S9^kt>lQ6p zDTsGLI5#W05D0cQaYpfI6D~@EWkn!~BpMVN|T_wFKy-Zq~ zRxN#SupHf8flc1(@^<&UJzxK3;$E<`VT_RFdis=^X`y_}<$E64yw6)9;Zv5c4( zXZ-^FHlKoX<~QydL6MIdQnxJl6R1|d9lFKu2FN%NURrw7e3$kblX2412KLz{B5&$5 zsd6(6xA#X55p_83gLl2oe+V*S!FXge*e#ZKXtJhAq>^gesi?m`H&ThGHqOVfct3D3 z8d}pF#j9JOIyLl*{m-kd<(gi%gz^2FD~G9b8oULRb$vg17vmy({2<=;`r|t1E&0{@ zD?$_*g-O1{Q>Ix6mx>Z2vLGZNY9Bb=8I%- zov5gqK(U(EBW%zDr2KzHauQ zS}|K9!~7Goi>B4Fs<(jgLwk zZ!8S>ce}Zjz?n*;!eo_TjcO$Z@`KEZ1`FHw_AHSQrCP9n9Oh}2mu*O+Y+xu5 zqRSK#6>Wt-uNMn0X%e{7U7U~LTt40)Xy)2Ecx-|bJnty3M%6ZL30^g`UuDxxvIj#| zs1WSbZ}de>cOs*0X<1Y;Ufh~vn&kpIv#qhDi%*5ni{ChGDx}geO}N0i2uWvzT%{bc z&@myTHC-fCJo}zsk28n9)A^IdCWKLlH``QQKXZh3ro&R*j@Xmy*=z99m6~r<=bpFy{){%=J z>2YwT52540rIak0tdb3PLv)LhX$EHAdyU1Ql>0aOR z<~@fB{(YO%Jv4OLuZ~x~ds;G~iH7}M_y2Rxjj0vL#DI+4d@*?e?rtoo5FFh@CQ?d!QGg!%nbOmlMygj_n zKhe2<*K=w|YnyYu?^;(wGmirjW;^8?9YF;c1SR^3G0P%uQ)w8;rK5(`}o z8AH5DcLGvHNjk%d$;rh{Nju5=qD|@6Mh#)nec)7NcNRfd)em z))SYlH8pM_?Z7}8NnTr&rR*$(c(|(+D>X6^-{Tir+2swqA0GaC0$pAKv<1~4a9b>?nQG$aK9>J zJ!_Y}?`O%Ln|?R@zuGD-))sYqO5A5o9k%!tlZfi52OES>>r1oJp;NXsuZ@ltsaNR1 zJmSee0O;a{YMui+HwjKcPW8FP^a~IHOi7q>!aUqpT!YHBycJ8!14qNOE|4rK!La#+ zBJb%}h>*F|xhuj6+r~zs19Gia+Z4O+Fnatwe9wcIwDAEP_Ubw5+qT~aPq{BxZU6Kn zT@w@-SAhY5zz_{TAahj~=@LjD>TA}6G;_N42oCEv4#g?p4-+%AoI`>>vhd~Hf^`$-^V zH*QE;R2ZSVzrYYii&o!KloE!Pa?iuz`>{P|%ks9mxZ|C!v8`_|&a()~=?&g4foPA% z4OJo`g0@HdJb^XUN%)by6W?4EH({c6WQ3o*${?_oC<`FB;*LtfRB90Db?XK%ol%_z zuF18?TA!91C}1~fZK{P2sTD!02prXdVY4t*35SrXVlM!F3z2LfDX$tpaQb^?uAItk z*+OJS{cha0ncHKJ!MqvT70#$7 z0Pnt1*5=Kb=HY!Myb5?nZ7+*`H}G4Y>s}9Z$whajg0HF(t#fhelbO^NmFFgKNb+@C zLILe5LaBj_b{$`?9x_>!-e|R&YPi%^lp#$i*Iv8OI_IyNJNSAk0rv=#f>NNOfmo6s%H|E-DG<%Yd7I5 z(3Pj_(XnjlIsT|G8UHk49X>i2C1&_CR1zrO{G6paG@iVmPp3Aw`UK1PyFq(1@WJ&9wQ%)j$^Rf}k?phoQKBF@?l2`56B`4YOMm zPW!LY!>2nutHW3hv_7QWO64na6_v#R|Jz09&gWW|nE{A~J!#CRYn>ysQ=w54d$qF> z9ykuno}`luo9<_Xc=}9&u7CoB*!yTAloL-%g_LL#KUigYEHy!S3kXsnRsL+zXY;cm?Na!VW`ULbZm6-fz#C;vT%#E!VFPUH5EG|1X&<_sWe8_5Iez*4F29 zau)aL>Ft{BIziv}i;L_`$gZAF`OwdbnyV{2x@Tlnd_Zj%Io#c&gd63E4sS-~Xcc^z zJky0_S#?34Rbp1_O2vV(%4tk`B4z_gajo!F-sa8b%F!^)43Ds!z!=_LD!K(9@P3Nm zw;LC_QNtu*IYeYB1NC*17zz2c>cau98XVgk-5r*_D1~UFp3}?8=rP*M<+O*zi^PI3 zY;|Dz>E8*OwAEHezn)4w7-5xZ;=bWkJg;qBxiocro6EUpkk@B8z3wJczHb$ou|0kNIyT-rE0_Qk{qB=Ey|d!J z;@h?0TW=|!-sy2)h&;`SS;vtHp=agSFI_O)0&#+f(a(sBlm#bTW`j0SVX`Sl+Z*L_jnVEZ-*v7CX zt(w=X-Lz@pDpjT8Y?Pdms8W^_s1$gXLBIH(udJqUiZKc35Ia_`rriQ&g$LskIT#dcZPs^|w| z<%jKxm_+4@t48SdS=fRYfTP}_Q+g_{!Q`@|nRghy#ukWF*D*bR(fzH;@y~9_(k0a* zR_~ae`*>U1o=#6{vCCiF?_{o~3rD3n>zgX&e#qAFP4s#6{o+xGehCu`b!M@EtkK_$ zL0Ms;dd%cfw9&|X@mp4GSfey(1NFs@z-nJ4q(s<2K7v&WFz=!3m#VV;P3%8MFqfC7 z@T_21<1LGe_S&d)(j?q&=eot(xGj0DR_;WG4R-flLAIr&XvGOAs87BSsb*it)a3^14T z#@=h5<%DBAteizRVU`ULGo5QGTKece!fJkHTd8_Wn2@?4+7VVdbZdoXt&S-(E1DrIfb-7%R=x2Nj~tmgUwR6V zvZneQeq6Ey7VB3n=MHZsTp!pTn1z{Z$1z{WRygX5V?jrFP4im4(%Yy)dwDMzrVu36 zh1MD>vt$w-UZaXCoIoq6C7!gB%Eh-{(OkxvWV$4Nt!AkqcfP=Cqw(9HQ?2^%3g3l2 zM3vQx!?aJDz0IUP6G_)G?_Y;eezv2|%09YUZ~tm7FaPQ&T|=?7ZGGv$<)dwG_Gdkx z%e%v@*ERFQ7ttp)LcbL1CoxyiogIa^@ycRj7p_W*k;BZP{X4ji$<2WSRy7|kclLTy z%UXoDDgmh&pHx2ZQ;fR5Lpv(NqrJpRvg}h8tB1xC*AY5A@wJn?3nODOf^W&ssChG7 zZ>hQ{!yl0MG?VcMELO^1gmRDJ^@03okM>Ve| z%lX>V*X2>FxaYsE6KV>mt_3t{o63NvXGx_GWmKYVizm z*Sid$42@tBm?ic}dtXa-`NTWdiMfagOnvJ2q1>@8c6UF!L62La^uet`60+Q+JptB_ zSIVt;ZOZR0de}#)>gOFVy;p-Ebp9&2@^ z9oGHi+z{!hwWW!Yt;%=djwsP4#l|MlmJgm-0B>G1=J(R_QsCHXk{%XM?k~33Fqkiv zCOPpGjLghGFqQ8v(ZnXYaa$~!x^s@r9t;WTLbSO^?^>?)QN0=YSWc)I@2f~#8o00o z{5ig99_sg}>SdXk^>|E_0rAXLEFs|Um90pIadFi60vm9fWNkvS)5f+E6SIOENpg{Y z`bjWY03GWXf#Zz5WL@E%xW{Z|?!AKC`!{}`^VcNoTZRYOs&4tMLaQ17HNj0av~+X% zNMCu$yNKCW;~Ku2ea-6Zc`^A<%)XxC(rx4;^AyGR_OyI}9PUBUNOAQg0ugpBkMEE+ zt0>yx(g2p%%@``9OZ&cb+M%NaEkQ+Tf>t(Bsxm1tx}E7;?L~3t>L&TV?m?(Ts*lJRcF&tvaDYb7RDP>Kh`HF>mEILCmamIrnIl`)5 zkPl5-Yt=-GhOpFdpj`L5mt1F|&337kUtg6K&HLlF^69FhrN=0J`DH=2zfMFL!{(p* zFGVQ)SMy2Qw|%i+t}QmZ9VO*jgX2EiU1x-z!3%!IMt}N9t_pzJCPMI+LPJ{C(O)00 zu$-m@5M4VZKR|Al5>q;%{oby3+M+~hGD+6PVe5xw4Ui?YBVfC+(X~<6migaZ?fu(nkYKT6r3Nn&{wSY^&b)^9^A= z_bhg$)dT#4jl>8MDQth>OI!(VD;o*+8yDP(wXybR@tl%>hO@mY2@0GSyC~JqXZr&e z=e>jWy~po*N^FL^+`Jj0^t)rW;fcCg)`QqT!z)e@u0y}sA3zD`htDm=fK}5-NWmf-#=Wx@9*_y9Uii?+Se1f zekSZa%0a#s>yP%(J+amR2$E1A%hX+wbxn z3Ppy_#v^{dx*nD6I@-#*)=jDVaolFIhuEFo?n{W8X}|ctWj@)%z!oYEO~*Uxqo~Qq zlMgOa35$q&JCz8>r;`85eq}T4trt1RH4IF{>u97t5eD$q^$Zj}tC@{5El=QUlJU_;@;$`?2^)`6?J%hH# zK^VO3dYqvL9LiATs@@c7cF2BGje^eDR~-qaNSBh zihZ{hj&#|#^KYtRQP?hkS5Ipi#Q7rg^_O?^zYPsk!)PSy(9Pp{{k4`P9jT^n2mZ(%7l$4u-j&^5ti8JGZ!~5ZY`(3cL`X^&kzcBt6 zydK2kU2R0skLCt5k$OMMg98a9rZ`i%yr^-x3QeZa-F4e~-quJ0YWuv~NlEV0Z&mVH z2}^d6$#wz=F=?s6pq{XxSlI)2Tq9rKq87V}WAO{z-6#zb#@YHOlqyLI+ZX+evNNF9 zPnx4KT+}IIpWp80%BWHLJ-M$C2la?e^wq2Za6bo5AW2VwlIQ~uQhvVu*@|QsZ_$Wu zQ6^2TN$d>3(HM!v*VI+v6#LJBT)H=+F9?`D*pY|=EF#;ByYkV|j>X?yyyM)3hk*{W z`iA<%R~Ep{p!)_*7(&3o{l@*m(Qs2)7DvVV@y+Oil zU|r$5VS#Srfn^&s%p`7E>vMg>NNHe_jg1+AXYLH#TpmMFdS7yO@=xSjN8ag4sn*H}u; zPm#JM-mbMR@dDr4ju0-({}p;cJ441Aa-SJ!q5F;4hz`imO9^~nnMv)=54e)^@W+KY zl5)0cykInfk9)NFfv<4yc0fFyAH3VOjQ}9hz|Y=r^Y4m>*K5uwqAR6Wke5 zSthC?xb#h&z-RpK^sld0K=2X}4v~2QJO8)(qrI46o7XN>|6#}kSQ>Nc;s(X5 z^*;27BDD^rQ*X`HdD+Db-!?);AF{vF!qUMMk=ITjo@no2vj@K)sJ`ii3^sFr7hsG@ z-+1dn>k0UMrwyYu?H%};IYoJ?+DqXPRyD5nh`*pleJ7vM%FQx|u0!L2o3{3Hu}AU! zw{H1W9bKjSz;oRfG+4FayaQa%40bhp@Bd!>0kta}hFL6EtbXG!l*)fj9T(hXb{N_F zTNii?^sKi{whg!K`OK!Zx>AuQv?e$wN|S3<@6o?AtHZ0+tLfLZY_?kHH;kVo-v!@S za2Q8o_P655arB*hrfzXZ{J8-4c*mT_?7CX&+2=9mmMhd(TF<^${`ZTYOaAg+e21Px zom1X(=FeM4??wD4{P*bZe7oP7-=v4w7@k`@pZ@dDQ-SaVZ*<{jkPig&g}P-Bj0u`M z!B^pTwOEf4AEon%ULf|Q{Fw)%-u(yaxJWU-;Kmt(#}%Vt8iB3>hH%xPIiwn)UUTs# z>EiE>GCy4P@iP;3V4kmD4jJ1@em2SEDQMqFa)1>9@mgNIK)dcMDLp!t;0@n z-T@fGYgH@T@*m$^Rx)3mHR1C`o0ykX^{WuDN=>#nC5Deh4n5kLZ7iis!Vm{^PX#!I4 zQ_@Mb9|LTvQ}bYqQR-DD7=nXRVVNe0T1~~mIGcu?{m=BC z0293RmXr411pR*jYyS(-OYn2UFRTBel>Rr_EBfR631#~;`SWN;mup9%F4zoA@QrF4 zat(9Efj_d%d;9z{ebH)4B_T7trq)kas(2yPX+B^+aD_}SI%}@6wRi{kApL9SJC0X> zoIp+#pCtROfKSwb{C>|?0(C*Xa3tH45;t5M9xIZ5 zd;(t{8#6rNJh&nbdx2SjK3yt!WjqXg;o^Q?ulAbr)2(!iU-=U3Z0yXZ$_vsLZSmYl za`4L2z2 zHRKn23(29Y=AZ&Rr(iGpK$5(OQt>L4Ci4mB&nUj!A$dx00gdO+kmu)?{yUYN9UHNz zy(h>mC4p=6YRmkGHKy!?*K{X}ame(K@{LN{@nh!D(+lj)PwA?@L|_^pBug5_-!GJp zj_%Z06wOIe6D)#eH$b>e*aqR>zFC6FhDuUArv-yH(>weaU+Jt7P>3fNz@ zZ++jyw@31EZ2pSXh42GAS^?IGFVJTJ&3_S_KrYEx^13a+dc+lxD}t_RKFI{UpyYrr zK~E4CQ}Q{Q(na5a{OJX(^Pf0$MrI{nI-#Y!e%&)HLRo-%afpZ^Y+B$*$pbCRHEG|V z@cr86_=hVd(jmDB$qJsIOA@0Qt0Z8{Ji88iSO|pLqO3)#Xxft!!VNXUTgw=hFtQ^+ z$q%=QkQqu^coo`!IsR<;Pga0cL0$O#Phcgb3(z`J46g&f=tx=Ux>wX~_=%3x2A>rA zD%FEqjFc}s?k+|QA<$8d>D#)vCFvcx{P}LAg>d2*hk){fw#vYOz8aT9qtY@oXm z6x;&hv*LwFKZfz_9ccDcXTDAVYH`T>+ocKE7L-Tl9G3<0ZL0ra8yE=@4YKV0S#rRoA_eh0uiU$og0774Cq)y!me?46>KvU{T2l+i zLE(w+Ufjta4{dNFOfh~eaDC$CZNXwTInoBiJlDKA#kwrlhxXvF+%E1u{S`r7cw25L zQsA?ocZgL1{%XQHl@)1PCs2T=J%SYk+^Kgf4ZfuDAbp(DS-kQ(DfK4!lVkFDmO@Tm z*HsD5*DV&BfS7oy#)#v(8M(n_emd~dj$y(JWSjhinq#t(N5r^NeXOWIfMyTjF!aQ& z-VZA;sp-=2EObG^t@2`GP>VE^BtF{{S4;Lol8rehZP!lfe*XB>bVl0AiR#=~g)4DO zCNR!j`OHl@ibOlJ1m!yH#rXq%DwJhhJ?Kl4{u`7yrf z+j-FD9!!I01RQz2un708*h#M)7?wiPL=&AxYc+yD7hN804{ow8s2~T@%IaGz~MaV`k8XMfS#E0cx1hFc6tWT=9BUbEYA{oXeXT0QS zrN}<4dDi`?>@YX>@c|}FFpJ!hatiiG9=0I5!-(s^Hq=Tf@>@;vAL(_|Xrj;Mh@*w|K z`MXN(1E(@x?f6)V^WIfO zBC$IE6ETvlKf4{X4mK2-8~Bde|K5*b}=D+-fSvq zQ=Gc44F6HRFV^l?X0J%%;VW}Y6R-latRhQFWLXt+uSZXa)g3uJHp==NOFzmxTkgBb z0=An?$=WW=exJ$P>Mc5^?Ie==xy|U~NQWSl%3UUaUH5dsE9YM5Xf0d_Z>c$z%qLQjlfE!#wLgfnbhBW)0r5#9tD!rL zYI0ig{Ng)e^W*Og#op(7EutEprE)e8uQ{l2Sn^-;U2%HX2&NLmA9TIm@MAua?Vx~pCMqolvi*yi@Ku}=G8~|}7B0-Ue1n5|U&00M&cU;;kCAVXPX6=5gd#hVFD)klM zqT%8t!I?w+ux#A~+1|>U+B~s5^UFV0OVQ-y8)ZO*@dHa3GzxUfU z9?nQ4S@JniD)v(tJM-%H3R`?;qAg5(I%n?Lhwz31k$Py!!^O#GZ!~Q3JtCQ}Agk&Y z*&XNeSXY0BbUYf_6b1)dI!?{+_1zu`l|S~Cc4QXdXgkF|_XW9r9w(c{+4@Dju2+B* zJId>@wB)=K?1O%vecCxa$6PMro zRZwnspPrd2+!xu@2Ilje@7q6W06M zMe`c$y>a78vVC3U$;Oa)3Vy_`ZWF9|LeSZJvVCJbbJ#Kbs_(R^&vIS zdL>!B-6g&!0-Ku$%+^Q);*Y1kj>_dSJtrjOu`w9pK7PHDkV!;h4@8VnFyZI2Xbg|L zg^wjj3?E^=+bSS$C#21@vbzzQ2y@}#1C+%KNOGzbh{}-{yrq9M!30P+t*k(f>8PTB z*-HGY7H7QakJ>cbRKQvOqC;!^8iq*%+cS=g#w&pc)ap|?mvJYVKFr9G5J7r*P~7Tb zGO$twr(3SOkgy>!TQ_#>EmtE0vyTm4Wyf8a3jE~~Dq!2264pQPM147$_#vA@N(g62`fa4(+cw)h!pt?Zl9qEKuiMLCwp`<;$QF4Ys@OV z+deqt!P-ShvvnZ>V91imsHI6rKqI|TTrmEP^jbih%@0(|2$78&71(saFkG+Ql7=tYd87a0EnG|4P%2}-F+99gmR zsV*Q1*R9Feivt)S1VZNcR*H^?O(t(o7IC{<^HI9@Cd(XCv z$zYAL6p&jKcl--jdE&naf7H*}8E9jDmpO8SQYO8T>WaYMp7Y!t>(n3&qssaMdWpzf z^-N+SE!shniAY=6?T)YwdCiUpJ{w?*bTsh&^2;Is(NGjPaL({3Mlqzyq0?OV`>s7u zZ4)5aTdt2K>DbDt5<0 z?;myY;d-cb@%*r>Be~}W`2K2t`M#=xd_Oc{-(MQRo^Fr5ehke&3$TH`Iwe+Ne?`z@ zEh|2(I*5dzMAro#+Zgw4Dwx~#d2L1%&lc7q$P%wv-Td_vhQe>{p~T%&iQ^q+p5D~> z)4=FX6IU==4MXQJBgOIu*sF223v-hubM=v_-X?7+^f~F6vz}g@J9c@I?C7Yar4OIM z!1J?SBeDAN=tv;AwR_vfmt2YD31YOBK;)o&5&Hp859!}J?!p4E7`&AP4mN%Tom-LG z@Mh?Z1GZJ#$U~5fFlRN2NjVMFpA0}p{VAC6%0_9w^SKdIcmJOGdaOgH7JIm-EaYXR z{=CbdtIi_TH7O)RJ0Bcjk-2Yc7;4qxQ}&4W9xZr=eIqAx8q>5t?9X4YtmpsEo()r zNB+8_Q%6jgcE+UkEBkE#%MzVBz}};06_b?;;|P6P{L{N&>ju08z5*MYo*Ff_CfsZD+lodvg4#&RB4EkUB!NF+f9s z=>m~`q-Kw}Kn-tphb}RN&yHMya85t6DVQW}tRL~GMU-pAHAr4?U>LUK z;25{$z(DsB4UB{A=HQ}x*gN?YqL1Sv`00eqMi)Znql=S=>fvMu#cvz~b5LrTLEHqR zT>xk8$)Q&>XqDElNM$mk9k8@QVv$)+8##^OtZax%PjZ+G^6kSxJKb^jiz8*V5|Fn| z1ZDlRn{}JMeNV7}yz{0R9lLHOApd4ClM0I0NI>2+7nF10w`iTZeJ}g5ga6q1%>?DX z2!8B4^#tVUEd=B*9{-F=JQ`Uqd!jQ7hHvIVn9?CuGNu`ob=e*0x;0n!&p88Y$IX1C zE0YD=ljZHKAb$fMUu$^6g%vgb2VY+uQ%CfuN%7*vi?+DCySuwXad)>{ibHWO?rs-% zFYfN{?rs;BU$WV^$$PuWBqy0U^Cjn>Gn4ZfF-ZkYL3Bb-iZdcL0&m5a8vncu+w_p| zvQhKL1sHvQ&BCtM6-QeX`wd&q`SJO&eW~iMG_Rl>iIb7t~0Al-Jog zhTUUK4B&j~ylIlp_a2l=@vz?1OvVG@x3I0dC{AuVm82vKTSq-5@-w|?X+T>2mk2ru zloW-})8vr8_ME%7k=f=RC4bKA>iCg(6SlFAy#_2dyFl<*R~fvpv{{*XdT6lQj;5C~ z&D~v}a-wGsI*C9$oBE1ZHl?h7AwD6>OZ6$4rk+Alvx(H}XYg_V`f1DAy@u7*;lP2` z53#}cy{&}YutKG|RtYtDIdW%eoeHDvLAVN9#-jJ^-1SvbJukZ%8dJs62Lko6&aPGy z&ODbNvT7+U7^-tAN4*=9$KNWSgaiK6Eow!8k+RAQ5OXsKf~@RXI9KgwQ)U)z%#r#; z#kKrp(3RVLk~6LF$ko$DT(jJFeb_N}3vYKF@9pA;24>h`IQN`(kDs(qT4eqH`T`4q zL>~SI=CHtObjilz30>v+_ENLkqB5HNo{JKDE8(j(hWwT4)$(*54$ecW3z5lWURYu; zlCH`kcZ*a5=9whiFrGO#umPzl5=xcB$O;kB+NsW}@zFDABQ0Fl!hcDlQJ}1KlO`5R|{d#<9M?w~9(O64`^o)Tlnim<~~(^~Q{g_ z0WQzRx^~k|V%FEEfPgpzzs9*y6Jg|`OpEPel@)@O#Be1{3+ghJo>)4+b}F6Lo0~qU z-r3B!#mwY{?Hm;iYthD~gSx&`v~YV#m15SyoKr2{+5%>c_D-Wf1Dx_@{OcyK1>mDa zgCa7LLc?jlJi}y&A4qhUJXqdL>Tr446{L1H#kk(7TaPuJbPr*tUT^lE5Bi!8>-5U& z4s5Sy*qdx3E!859k=yqjdxJrY#m)6DplC_~INJ1r)}xh+s}g9e2Zy z0wzq&GOWxzTJnlbkcbNT0iAR7Y)ZcGi<|gKVYu3`O=w>H3Mz2IIiWDYU%F`5%Y)Rc z7>rb)XFjAZP>=A`=dU+_3}q=o}gsf91<1S!I{I zX+&rgyI}nJu<x0LZdMuva-_!5<@Lu{F2~B&8+2t88eYD>EREv5H ztWI~q=1pIvQNz?%$Im9!W6FTXVxpnm zx%|nkt-yOMm%J)=Z?3#LV~+W>9wNF#^7nbLQyCzyZFsuC&&vzOAAz)QJQvj82&o+p zPl_hhrhiYGd3l%ewD=`Vjrh5rFR%c@+qaZN2kn~aauEXgZKuEFAQlRmm& z;P|^k(mTZBYZjt>z)II;1T}ndc;#sS+La)>@4$YSutAR+ahOFo>mVp_n>?XJ&z<_pbOf zjGol|&qMnm+=t&m(UHHai)+_8+y~+3u5;a%bf?OSd}AXn_>SJ?M@{oV=ym@Di2CSK z780Pvxx<;a*?rJ zyi#_d=ZaDWXYVL*jSuK7?JNaG+`d1)?R}Ibd|OtS5=|7}O%z7haQ!q}PJd)((Cq-s z5{`NweECujpsl#$`jDFSjDxL9^^LKfO8W3R2Z`dAB-Zbm&{vPa6%xj9W;Kd3X9egF z1$}RfZ~94|$m^r;dOLCvG=b*Suj!sgjOub;@65?BJpSW5%SZT)?ufEVvT|`+|$AVaW zX~tKkblrS84&(uedEicYJR=A~{7ys5(s zXU7|&NnDbU*UtZ3s@Q@BnY)sSd)kIH{j&Tgkm>_-_~I0JdB(l3gIDq-ra9)Iz{`AA zXo8b$BKKmAcveGEFuuLXV2InT9yFx`T2&9M>ApKz)MS(3)6j=(+x znsJ-B=CGSvSaODj%c?*1#g&T<)J3H3^ia4Z@R!g#Gh zl0|)Vn>&F;6ZF-R*?ZOS^E)B`z&;e~Nq~YerQ2b#6-!B5j`$9{Yvqq|)&xkHMY4%J zaByqiGMl=m#twlswXdx4(}F&O6A{eXIeJ^kw4a=D1@)r^`9PX;7md@;OxKT&KKqeJ zB$=~Z>dBHm1MBNIr5zHQ8*^zrxz~A&stJhaR=jYn4DaZUYJ-g|aVYQ}qZ*O~vBGt2YCK^E_G zVp4$@iG!>^9rMkCCM~n?Y5IS_UW59EbhD{H?>$0&zTBDpAF%NRTrXW6(oe*C^-r8* z_s=JV`JZ62v#mcJWH)1RJL%cv)wClwhn2)mItt4!2o(mk6 zX@NfN8t$m2f=f=;3L6cj6_r_!psgV}Ow^*Mb-CT5(cU_|lvbD|Eu#K*Xt8~X14B9S z%5u;Z(n%TXH~EjViZ1M+hy70c?rQ#uTyL_dP&t3Ab8XF)qP;Qf<}t~z${1)U#&{>P zW*==`*w9DK5J~WEw%A=I-SHe;KJJ6(_QJZB{yQE1G`Q6=QDOQU-Y(A+Gf$vP{E8*i z#A^RC#ATrso+Y#;q{%7u@9#~sPE*8Cczs7!daAD2kIHwhfj49lZY#(r7BW3lP;F|cWP6(K7WKip{!k?2|D3HXv|1R4Fl%K|MQ=`~PA3MQTcykU`xiGPRIcjlkA+clZQ#Be;c z2U(cqjs$)lLk(kf^E1ObH5T?HWyoDh6G-FFj&eus&HSAO9Y^bWPu?<~gCpr=#(Wg@ z_!xNFEo=;IM517Bu!2us$-{k^;NcBwY&AY;wwji@eeAivpcwlckjLXpTvbf;(@RdR zjqHw}l%LOVa7H-`vmw>ST|(^fZoJchG#@s$Cekb_tl5b;8!L;4kSO;;!vT> zb9rE)-&v}iK*Cw^-68Dzx4r4au!r!LcK%?#?-*@jD&`9}8`@exh0%Ftn$ryghue}* zLsU#8A0NYwKbVDw?vs3VxMj(YZbxL$V52;!_gTEW86CpK@wo{K>rXt>rLpMed@_5= zG^h_ra@Kh`C)D$t&{f|JN^#ShBP@rM=zmYIT=YPw%G9|l;vlo0w~AAyouxDA;+=6= zH74(vJ=$r_ja2vAX{yY6i+7q@u>J{BJ)P;%$zO;$;xJgO!$G6^RiN16tnl5oF)w@}`gwKumL@bGP^W3*Pq}Gj z7OPT)g@7_1s~uyZ)E>7OI4f~w6ZD2sdQI|S<$vewH-imYL=c+1x5f4Y=?O?QTKi2^ zem5bUL6o;T|M3%YgaVXY#iZoSC>HEC{zpa2(*;YHc7DOiYtibLmwW!!ApZ(%_|Lyu zI%CUb>X&ARA%_Q*rlWkxqqNT9e;&+R!VpkDLd5xe4%*#J3~%(T(4R4T{Sp?c&bvK* zRst6nUB_WsK|@6n+uvx7PaEP-`N_&SW4MyrorL>vW({y=4J&j4ZOVrZKwP@Xd#bBG zBu@V143kdFFCee&;2f>h+g4Z6I;!S-V>_qIhv6Yxs6mt~q*3*i&VoN|llyY;YJ@ol zt&Skx8DH$FRm~D)(D4iCT+;P(!>c*}a=|+#A{zIYdrDG0#~FrBiRx!O2~(Ew8OGNH?T`CC(+GlX zrGw(*i|{}n82S{8CR^M&*rYO%*sXSIT9RS%JIlV`OK^K<+Ahg^A1icO=KQZhDxm-9@M-ZY z#xfwcK-Gg{ohpB$U8X>8fQ%?0od^&l`#8DE* zM=U`NX*nmEaqsIBWZD5Q^$ST_4_6(aQVG*ATzaUwrR?JIeHA|{q*+nj*r?_%>E*oMjOyL_CRLz2t)OQIp7p%2Fo|Cgz_ z)F+#vxW|v{m?O>UMT5YfIR5opxsBaaJQ3*3PH_fRvk3h5fZx-nyESSo+nl3*#(=Vr zXDWQp zJ_5ZN{BBAjJ80q^_z&aimEXQwN*1>t;xb62-lNxz^qSqmBj~{RtzrS4lf!OwK5Ndl zyw0lbEh1{~5vD|~&j2>rV?93*K)?MF@MJXjT<$>|bIl_pja+-J#e~Kd! zg%^1PK&ZrF5ocnBCuAx{$;kR+>*Unp#=!^=pO?Y@ZKgljFukq%>!*Hj(SF_8PEl&b z@mFY!QV4tn-tT=#DQTQo(dN-Ux2c}kfGl#ZUw4%y5+6Jwi&Qi;dvItvQ;T8IZ&(o1 z#UY(82EAElt(+8X6O$L6bzweqNW|Ta1o*JiF+j9RIQWRuZ#wCK7SAWt1KvmT!d&C+ z>e?0}Qw+Kx3Lwo;2!=f000b0NK!GgW&h)X6Ser!`AB*?8o_i}2S>jNmEvU=LLLMpC zi>wR^xLl#c>Xj^GXw>E{Hbp$@c8kEDd5fJrcllIMfS+Q(QZ9hZc#MB`E zE^v*qR(o6L2<3+p)5B(kS}5VW2F!y!+OPJ&8C)AgMcGjuBm~g9DX}5Ze6nyFQbj)j zd(1r7vv1%Vv;qF=E1Vbm--Z9Y;e_UhpiR8Bs->ccJT3YXHanl!i-W8mr zB}nYRtPVh2sEmYycn&6=bs6p|>c3JcMJny4ZREZQ{(Sa2RL|~UuCc^v4E$A2;BbzM z7StG{uBcIbpxXaufDM)#?@PM_j6AF@eZ(-fvF4xg<}Y-8V+fGMCB#*h8}k}Q!iV2M zt`-{KnPlYUvw#KuiCJ>P5>;8WS0)eLDfJ-9A2(%cm^QmO0y&dE-|7EdZ&M{7m=_iA5U&1MQ}72S&A zNHun!i!E)+Xir>aK3W^cq+qskU?>`(0CY@(sedN5tfu)$Kq(IqvoEJtVriov#?eJp zv-zAC?Jgd@&ry*@E~r!P{`Q>x6PX@Imo>MEnY=nZCLb(_%#*({f6-}UKL(0!t;-a3+hCSpH6%2;C>J?v1?ulb68jw!nIx-71u_~K@sOFV znLdD0{P$710|xr{qgTX61ya%*;aSOIBDJKN)4bFd+8dAC+N7bRe9#{-2)(gTV1Oas zyZLjIJ$;uAd@04m`wg9nUGoFq-|s|{zI&qHaPHX8WZq)1e$O&@m!`H~ukQJxt31h| zRBdgcNQ@=f_>ftm&RdN3fHkWZ-(l!m&(bzD7yKT1Jw1nK6^F07pW&{bLQ$bY&7^|g zm^hYHUQDqs&De0Hqbx+q+>#AiUVt@#J!p5z(Q!&8%n;zAgN#F2pGf3H;k3B|DjQP~ z!K(Tmx)*LTN=vtl&9wG&ZxRo)HxJ;Oan5$(s>kLrxAWr#@AX>*U3=*JUz9);3n?|U zAI1Z%qul_mG-pI{k|WZ0xhhg&$ka!HnLj?=xKx&|bxkU`BO$2*sy>mR6})I^dYY&n zLkcC^lZ(@Zvb{oMJ1ejEX@sVkohE#e5UEr-m4mOar*(~DYP1@WAVMIUpyu~7s}tSF z#95MrBfF4DDEk^=fKmY_Eg#X}DywaN9oa4<=db9fkndO(+$Lzp@ctEM&@5tj-MacI zF%JwuuvMy89sId_mV6ByyH;-Dj4X2@1Pu$OhUuCY#2)!=wDLu;Ox#Mr`y%!&S)T6OUr?n@_=JjNk)Ef;kQU*x zuf4k}2RFg)?ahZo%)Qv^8P6coOF$j_XEh15Gl^pwg(&M0Ryuv_*Jbt{r zolUy~8E)cSvW8a9^aNSD4sKEEj;%DTYvG$#U4RQTQBvudo_QMrMh~azSLGkp{A&TR zf@d~&q;os!PlNhvwolSjoz~_cpRuZ|cxjfI_-Y>pkEmYma>m$9Qfe^n67gZ)ofK?9 z+>acs@n70U$9>oKoA)wA-Q4SV@LIp%JWVbv!)lT}Psnf#g9Jj`VMQCC!2o1S5t%}r z3a5)@f4?sQ9&n8w+G89Bt0b^60zSVdqxXF^SY`eHVHk-zstR6VAFQoxObE)^w}GyA zs@O>8P+z#vwwlwr+`Mzx(3CRbKco)8)yvCA(C+BCQpikmv_^FJKqRaaMC_1Ov^l+P z`Z3ZCz9Z*B8EM?5R9C&sDZrm1Xze)tB1|6&+Pv>AfZDRkuQo_`aJ|tP#G#mbW5n(j zeiiS3TWCe8dnN*m_y{5;;1=yofl}M}9#z($TJHji{*}VYxPyZE7JzaUJiRN_6goEt zJ>{P&hq6EOc1K@>){)HSZmqPfNlXpnz z*I<}X>l_U8feE~N8s9OU%q}P>P5V(qL7Qo{8jnq#$S2HbV(!sHdYb3M9sI?npw7-M zA*tg+2Ntf|DxJUO#l;6-qiA@Lnuls&v@dMf#Qn{ck@e{YgGJ69RX7+;U_P&U7w}`Pd%PR)ysnsoUYgSacz%Icy5L87M{}f3J6+qmP37St6G7CfaBM-It z`_&bJq(=h`W%o@%MW#vM+#C)Yv@DBtn}|8;$ggNLUUjrUJ* zv|`9>EiKpdXxopB+oaE@a7AxU>IW=*Na@x+oLD}>HuGcC6Ds`vr2Gr@m((8iT%xIg zi>d=*IIC(uo*NniBJJ6b zwteTi4E}qz&J(RSK7Z)$ok)c|Qno~(@gqx9;)m?XdQF{zga-`d%^TWFBQ!DK?+N1M z%w!|driPe36hl_+Xthk*3^gTp3*Bh$MF1ObQpV;Cft z`yeeH$DU_jJX*f$r_Ik+4^7~>{{8oGgP%C~<1}?j0;?<>oAKwz6a0E7Z!_E!rM|?T-;2Da`Ga`G& zs@fAJ-FK|i+#WU;bMMdUy(adQomL~=ZsyE* z?u`8!WG6WEFQv3;sam3bJq8w{M;XidyG_~T?N8`#y%4jiNm);)(a-7~AbOpAv1Gt) z+IroGYediS^UZ;+aeI+JO}G`5PjDw{eYg-OXbzu{z|QFbEr(~$cso#yqiFX+ z_eedYX@uKn09rtJNAO+dRzFmSaYP;a-x+a!IX@U{D~tEeH~NPnHtjdRG?>N&BOZDi%HCPRHDCr zyw7%{O_vZp4MO5dU#)Yygd?LvT}dR4S@ks0{jgr~(t-s<`}&Wi@Z;k|B|o@(<6~=w(?%l$7#u!NFp81Q zS6eY~+!3Dk>kbGqTtn#?L+9g$aPW!9N1yJ)CveaNV)yk2NB7iweQ+&5O8&HRyJ|(n z^$PNKCUBqde%km$^$sqQ&kSDCYwCliukJFC*nLM2KRhBy7Bcd7u=@u{Sd;=gi}yGIFu2ub10I9+i=`{`*eM?jLs=Ua63``dC^G?mV)#xXwyay!ver;O*F`T!CWc*cNYsERQnV~~c zC+jSWYJuEb%C(o4W$RD?2+8oOpMPnqF1cK)b~O|Oj^m?n+&fOIyt>lPKyUh= zuYb%2;**)85xtdo{W*2tc6MjaT?IMmQmBb@@c`OUAQkv9yLrd;TBUko;8OevQV;<1 z^pFMLnO#dUuy0O#^~kNewo!oFLWieV3Z&dgr@z}hQPkodJ=`8Xj3Ap5Jaxfi7Pc;o z#{Se_haT@%meows<;OG;9;FL>dl9%@yU*b2FT=>(2E4nT2=?v?Vhc{d`pfxJ_-Ayt zJNsd4_ zQ9pEwb0S8M2@x6L><+C;2Y!j>_Id*Vh*Pd}8&gC?|Ibjs=`IuCNEX9JcvSIOhz)UR&JIHFn_6b7KkJ zy;8>wG|ZcT%6nir;(Izb6#q?!?i!EZZP~h=rRo|K`xn)tpjuj(_M67bC#3M4g`Eai zQyQQqA-)upFC;2B<01dhsUiTNOdMYN()^B-^dcMrcKnzWjwwv^;tt`{V7;b6zi40C zdDNv7$nHN=lEM;bQ9F)>8#{p5I3`}wUywcMdg_0ctzh6y*JOh=XILt1JB=$xlEphaIgrA2=!xWvA_yd{(Tw&E+Oi0F50z$sY^i{)qGt|(@Oerh zBln0my!$aBfARY+h@koLU~X0__%BzNkx?fss$k~m_B+doHkpKAcddB@RVTyR9A*f3 z`9+H^J*xl2N#S<72i59d&mdWGfTf<0td0>H^o^yE)eExTCfst$#t-A~CQ4JBy6G$j z<1Q}gng%14x$HlP9_hyT^kzfFaffC$!E+YJ!PIjK zg1@hsbGWoHtSCO-$J<+Cx_V~xT=lmC@K?5-VJmlStn0t~W%?5ihDb>v=?jTf@Uqo7 z7(w=}31jGT_p*#ql1xCUWzc1XT_Jn_!~>?Ak<`gJDCzX6)X6c#hX+zPjOl}@fbh_; z4Sc_165;#st~SU;oR+>N+aUP{)Tf5v=laD_uQ=23ILx!)A~Df+ldJ4~HgECO;OH)aS36N?~{fqha6$48MKRk0vpr z)#eiSW53b>%tSg3l^5=0i>bk-wRPfdAZ75I0hBorE#EcllM`9l5mi394se5-9!mzM zL0O-M$l+RJup;^&dt5Xc4RgsIN~werNr}Q|c)XM@Q=DU({`!{~PR;ea+mba6`S|xF zTB}*Aj7BDreT8;&^S^V6>icsqt~s5Pz-lWj6kX`xk-q|62AT%=(Tyche-~9xN0Uok zL%c2Kl=I@GM$f$|-LDe~orj9U04_>y&3Wc6?1CdJ#QHIV9ae+E@kbTgk={OxctjhE zi%kxmFHe_3jrZpE2qal0|n9f=M)~ z$X$`%zHzNdC*!0}3CcjgG)~zHTkS#n!2sdwE8HXz63?0UdG~m+yx%z@DBnUxCap9l zweuH5HOQ9I1#c?@Is!KXy8d-Qd91tPq&swt*yMG6;i&!ggqxE#gnClJU zAHBp5|F~mx>$vprvKzC=|L!@7$Ue!hc?+3-DDYPR;_?_y))7i;0oyu>&rlRO$8b8z zb6qmw?mIN3GBVF*)(4G_iDb>urOG3it>H$X00Y`r02WLGh$aLL1LmWPwg<8|l4;uO zz`rY@{iPh$wq~w}#v$>&HGrF6nhqRl^J!I_bZ1Us$nM;i=THz0ChRoruTn&`v+B=e%VH;A; z$tf4}5|9f6f}WfQN**ZtlQFt_=Ot%Fx|@_x7Zpx)d-@wXJ;4c0%_#k#TI!>`w9Q_4 z_DW(mSI%Ug3t`5{nU~EUrqTHBfPX4YrJNr`4Da&$43=j{l_eh6v4XCL7k9@EY!0J2 zRSg6BYFGUOBFzhUjyv>O$?>-ufAWoTQ#;e9OaqMNzEoFsnIQDLt;CuyG-h)ru#qlzxkSFLrs+9O*$;S z9+5DxL*x8BbP(9mhkCGp8Z)H}*lBIf174B^g5hx7T<($G@#LKO4C*JuPkbRfCM4=g zC6)IH!BR5Hy2t;3t`2fjpPe2gpH&UVsu59tTN@{c*h~H*WNsYRrqTnQ+H&bGSY|M! zcmrbpVKB~e8>?g2jqfko>{9@lttS^sQ@F)@lz>uxlz3;KUglJM21{g#uH8EL=byvl zH57$;6#KGAo&r$|!B3R|L=@^P-YBKhHcPsiBL&{DdcJ!z*1mlDJ;`OtRO!Z?vLe2@ z!S{nk+0%vrg6f0blGQup0T%m+e_|viR4nzd^Tq7pOG72j&zFCDIEvb?;1z_8h12qkf>=D;3v{8yYxGJVxN(Y zlk%v*vm)#zo1X1wpE3McG0hdhK?@!2fx9#7 zPCsLIrS$S`fI!x%#6BvP7UwZ&Y&T!s1|c00UI(q)I=${uluq0KU9w4&Rn6$T{0qzT zxKKs6B|xl}=Pg}8H8r6|yN6r~FcOd0EbbIFgnmOL?y6i>)l%8r*os4FI-SNB@84*G zzvFo|T2nUInX<8^;j|1Yv4mVO(b#{8_44TdI9~1Cz@I5IohgfZe|_vB*t1Umg+haU zxcAH1paS-SrH&5Zms z3Wwu>!L|&Nhb$M;9_gQaN0_eQzbM6tmR1$6#cz6rh%sL-LaQ&0Y(5VHaENeqD>={( zH~Fa1L7i@%_uW-+2D6Ea(5q%5@X37MK=F5iwh{iv?gZRoQsU&Mpj!9Lm7M65DM)RM z>OUKPG4B+^)FaDH)Yf7AM%ZO0)QP52Us-<3pc5S<1fw%CPh_U08H8qKWTYA-cbS@x zddb;O&LOdYHmi%HxgAcu*|?jr&P7-QMOmLm8xIT-Wmc7TrI!bun zi!ZqwanhgGp1C&vT~35Me0lBe(bGYs7Bb)M&v%2*+4w8t&Lo2(inR_{A zhpGD(zmTCpnZyO#1_kv6X=Cvif9xjsg?zWW41IW-YJ(Ue=4E%O6l-cXdrDF;N`{gd zGJ*Jz!pa-n3if)L_|t0jRr+>3U$BcSO_~nQ1>Km!S*y1ttLIU%9xxq^232Vyjtf9u)ow?ymqAB$`A zi^HM}N_8ih>}Z;QS!}L2RS!AUKzsJe)&B-~`JpeTC`~%(mcE?nSV*>-)3(#OCk1_l z%zSyydP@%$DsF1%XoJtT%gFy)iD-@_qF@ikdjZ!3(Lt!%WC zuwQDuANX~lTN&)(=@EB{Y8?Xx3vV?Wl*HP=2j4XSLBBE?)^xO&(Wj3|=z;n^FJ7-T zdXQD~?t-wwvkMjXq9v^$I`#F4X_)5&BQtDWF zcuib2ED@@V1Y!^?m(R{0`XEsnjv9Q>oOmEOv(1BKJ-*Wv66kKGcM+unRpJz8e|dU} zB+W29H#(OvFFHHwH+4~;*M3HmEgMz@H#x~+!I~fZ7;wb2M9-0Jvh}9_A{uLATVtH6 zuWCNT`_}&vtvX+{>e)JC$J~!kYx_O@ABhSTW@_2XuY~Dg&WcMp5U6xhNq>Dl^)nzm z&hT|U$;Et(qFje87QTmkBT=Oi4QTmyz{Mwx*Z39+Tx?2GSBJj<(iP+!9hbdB@J6u( z;jFTSSaMNMqG166^dGi0N09@eXeWGijivV?8Y=!_PyA5osS7+Gj^*{lxd*O!Cpa4o z@6(oN;wmTu&6=-!8v`j-1{A}=gx>{U8ZG2Y`1B4KeK8&se~&V6STS}u!ROERD<96| z>V4=!)3mPoyb^sBggV8%HoF0kLiM|5>1>OT3yR=)aP=hgJzahx5zw+iq^{92Q~O5_ z@~gYk@Pr|*O;uO-#BMr-A?yt6EdTUb*)cpd<4bsl`qbY=BB4De1i}GkZhJF>A3Md~ z6)s-G9*=vEm>P(D2WHA5i^HmS%^-u-epi%>(rlqRBA%vzpE?U;9heXDQEB-ijHE7- zfX}@@vXXhfA-s+j*n3eGIMVWfPF&Yc)Zq&tOAWSbZIFRh9gSmzd-llQBWxjQGJy*h zDo2GmVhC0AS<0(CPb3L|4HKkjuWKLZOV6pJ)W>u&-zwXZS{afmq*6I_G2J`7y4Y+x zxlobv8n(puuZC3X@CIWQ)4G;q%%vlF&eH1pv45`ypxRr}JyrizRuVNylu*4K&RxAP zd~H#+LoeIcP*-oP;K7qqW5)XCV-;aR9OEu$J3gmTnZ!A-Wfx+d7ESr*I3i4tAbu=c zyUa$ml117@8Ni?v_AwwV`A6^bkAI<5y8Dtk4Y3(sI6IfJtPyseDd*_rg-|`*h0^|Q)efjw+X<4ea$5c9^ORrvIctb zskzk?XuKWM>HtP&P!v9#!?aKhGUl^ z$z85e`}!kxJ`f6bxGN!1Q`cg!c5ELAaOfyi3^==p>FSPQJ-HZN$4q4}(!l7l2&1;e009?I@5SESH#8yK#y zl^fFHoAMv%)kY;nJ*!1|laUdSrYSt)4(Tljyp=|4hXypN0Kk3ap6LLAMht<{)%?B$ zm%gq|M9H_bkq;|Ek+K`GzC2O+TCUZJ$gV+oPp;L)QEaxyKsWXGmc4XzMKRxgY4Tc^ z$+OKk<-|FKP&Fguks=oIT2xM3r5u+a60SW)w1`6vyA=98TVD~?j5@^hV}mVy)0PP= z=f?fC0dsO&;xr=|89fI}=~XoEG?y3gtVb#@QAYP^E~Fp#!&Cs@4n=2sj(;5u3k>Ft zzk{Fm$vZquN8r+wAC9s2Eck#g#tp=equSdfsqLl98Em_%qGR8#BgLFKaDRGFAVLw{ z(_TNBDiD;%5P3%TpThSO0oKD%AGfmCW@XQ@FzSYis*GltaW!L!8IidT1iN$QJ` z^NMRjwx`C%;7nxz|DF&p3y2fR2lCVHuW1NC3csqUQwS}lf4HQ-J_=osUWul7jIkgg zv`Z60!EDyBVZIPcP-RwD*~hN}Id{Brkgf1SL}ppLEKIf%BFlf625oLCCb(C%7x{}e3b)*z|Kff7_+cOA) z!GQ_}y1AWuD$6E<+8~qB`5B&2Gyf z%K8BRxOBhLNn);EK)tTC)M`Wf>53|zuk<6Ov&OGA0xS`}MXv2hObE*zyQblSWYLj0 z2^+y;D4J1HgKrPM<(2iX=`mFq#Xt|0JWOzHRachv=qyzopo%Tu@i1x1e=c)^f%->76!3cX(RD$MZ7x8HQX%kWB=^NNg zMkre*_;|LI3JgK8*u4S$DyX8Im4uL=S)JW@h3&_GhphT*Lx4s|5cO4Y`<>{hcTjd) zN?F+Z&&-TsZ-Xus`K5r2w4t2z5i2zYVNU%KJXWqt;#a_>1gjeK{;%xZHKEdEqR@Ai zkq}qJ%{=}ByB&S_MT%dK|G;*Mq0!x7!{W6g1)2z*67(b1+^*kTf+6}}9GR9;w;NW2 zzb;*dg4OPru_OUS?MH;TucS24Tz%8GiCEF<^(kdS93#>0zdzb-b8(1|RYoKeo=T~+x7;@=R)qVrm?2ntV{N+JPP`IY5?gRSaRZ)%d?3X=f&qXLdyidky9aw+t zkZB&yr@)cSkKrt)<&-mlCVi6QpnPl8pm40@Wr^dPy0RHt!__yuyq8}einFM5!xDs% zgKgKV8W$_4bar<>WUGb`gEo0f00ZIc&GPc>5Afy3uAQKhVTeh$$^Acrz{edQOJw$e zOijOu{mBo34_#&lNBfrV&Y~HHA_n3BoQa=ZdxQm+D~iir9PJc;%71LHJeHtm=>Wz}CD$kEY1{;fQCTJ1Ca=-8Xx^mF(VYYBlMKi^^u4R@ptSRCRosOh zO3q-sv;;^u$ptn2Q{QslIG*!wEHL9g+|u7M8pl7xSFHfIjgOb+K3gT{IN7b>2f^kJ z_q!rnrH!Jugfd;XnAY!&p>wD}_nwE~8GIQB+K!I9${8OSfX0jEaYA9&JLA&Eyd}GW zJZ>X%?YiUIIer=(TNl*|ip_fg{k%rj)B=PqqwV9Cye9JMdp~{E=qathroe6z{{csH zv;2w2(c?dNR$Gsrhq1%ekCbzmz*QylucQ$5@$UHl;_aP+L<^KG(XwsVDcklb+qP}nwr!oVZQHhOTXVW&I_~Z1 z`|f-5^CEYwoskhc_g{Wwu9eAX!eQp#f8KKaO1C~;&ugT(T5io{Wx6)>Ec3zpfgNKq zLK5Sd-Ke;K=>*5A%JsrgW7mE4Ih*W~ec>^jZFl3qwqm8wovNXVQAqmLY!5VKVe7Kdh z=M)c+CB$ZLU4Sy|d%Q__k$-)vX$axulWK)FfAi5>OH*R#G_|cc>*VmPtvNsfLeUD_ zt{TCPZ1xMM|!)Vv6_9?es6mRmJ!(j+}xuxoJW^_j6-qu z5l@=U#3y-@TC<~s(=6;qi(Y^46GHJUX?nbb^bD33Fxstvc>c__Z?2X;>#PeXpW&;Qr zA{LOYl78)rGFTbpC{-soSGagYR{v=ZKvnKzk=Az5oE^XuR6l2uwK@cGgr;PDtF5H)(+f zm>?$@TGH`cGAOA>%(g&MS+h4m@~#Lvw!h+B0I10}Ia&lHG9jkZE?%ubrfXr;a^U$b zGqUOoZ34H+x!VGx26+QFE+D}+AO@umuOkRCsz73`L42@XM;>meQ}$ID`@=8BXwRiu zZGqK--DBoSx-bYAuL4XNnj||{fkY=Wt%VBdwM&pB)Hb1$;N@|Z*l<2ZUpG>sH@mDr zD$A&hb>b=-AR3PBQi&b0E;GX}O?F)e7`t*w?Hm^Y%y0T1oIzb(`qR=vH}c^h+{rL2 z0>q4ov~B`VI#l)U&$u&4L{)s4dUFH7Y8Um-_SRAYPqKSU2+}NNX1{Ru))DqbDa~L7 zr&qu^nWd&3^GX75H=s{&>19J8T*3ERAY;1deK|)_H%)4qkhU(1hxb-NRd0FRE@5$e z)x!7E>$CNG5_hN14@hTYuYyi69-wTVZC^8qFG29KJEi`f$~9e1#0h#B*IF zym9vWSpwyOY~2?9)OAV!nGoRmNEaRR@3Gwd{DryK+HH6ADp_dy_B30qbDWvUyTpY5 zh4MW1lzSZiHZO}|8I{XT3rF_838{bg126#>)%q{>E*$^RyC^yvIJw&y(+P?TiP+jW zDgE{71^=Dyg@KiWmlw*>$-!9P8p>@wT1it5Srvn~gCMh=;}K*xsZ4oH^MZWGZ!rS`>;Z)kl~QLfJ(vMOhM?2NB}!)$TnhBa1;*^=c?XK|VuiGR zn1!>W{OQ?lrx`3-o=k+Wlpx;2%eU{FkDs59A0t7(Fo@p>LYut&C~&vU_1W%kBUfi1 z(#Q8m+xhgKa|>c8K^{qBzj(qEl+3h)*kH?#%TH`h8(p$VHL7HRH@K_a(~=;1Ke@GH z@hK-Pj<}mdI41VMKIKOGlxkBzK=OX0kb~R+k(q%B>Scrx*N1rvQOFBw5p>ZPoI{EksIzlopK0ra)lE6Mg%_aba_b-wvN4+w0oQ2~Y=mO%HZm3# z`{*mM6U0%-0st5#a7gp|9g|>q*a{W*>I@)+G7AuWFMtDrCI_m~3v$P8KMdV*c($W^ zWALZL$WT@4q!GQ|;iE9I;R;0}n`77`RK8s!=1*r8Q|M|MgSdagj=2dFwAv9Z?2KL( zg>1w4R7GCtm4Y^%JvgSaYY`_Jrl)C?Qj*gYdJ>lxe_Nqzb6~{%x4)2ia#78%cMl~6 zAf&a-RJx{ZBwku+j~^@RpQV{@^Kd?U&98ZR-k-IgPEyAbypmDPBIO{XQ~9s(ZIcmB zu6JMQQ$G8PwBpK5C9kIa_HV7LHLpIWT6W&?%z7oA`L7wcc}sh?8oh8>Ntq8~-IhVF z0ODLjWC}p!gzFDfZ?PD*K(`7*f7iEH;8ilczss7jhyj7!5Icdk0Y>;qN&#(dDNX@g z`ygIHKcxW-SoU{CK3Bk;Uh|$A$=BdlC}+p>o_x|udlg|M?gYDl_>APr@rS8yp~0*n zD4&P|S>N>ofPM^SnS4ff1qGSR78H!5WB4<_?6QGc7|5sK)j_+*^JpZ!S%zTN+ZV+g zL-^15lj#^ocSFaZtc>MEE__oRg&+w87wnJ!bjaZvbr^lQcs1+Q&KtL}^PO3Ti4IB(3B zvGBuNWL;t7U)`KV$@|gImRUScdgdw%eJpz3BSVmBr{hs+h_+d1{(>R+rY7YX)*je2 z#t*eXYZyMmtKw5Qf{ao;UWU=z0e(WSy#vF*B=%+e&cU7$-x`_wfc-)I`5kMai9Id& zO2X@v(+uW*{^z4{3*QSwKlehQ*WM31AK&Z?vGb5MHtFDw#vOsqeb!lKjZr3kCtSE8 z@~8-7^XfVdyI+3B8iRsmq=3D-U7mMd40bOXcCT{G!|JADh;-ml7FzlnRAlqP?q8KV z4*GwTyMLn?Wd7%}W~rBlD#ir>Kz9mQ@-K5T{eQ~I^v^jfeq<@!0025!1@Ql6O6Gs0 z{4W(E0}~?y>%XbStbav{|NM(9PDne=qx7F2;)_R;i+h4GPU^8{qp{^DqqTOg9U1D4 zIza&gu5P4_@Yt*%Vi2gUkl6$U4Ylz)Ir7G0aNKoJtY%!OVpv6}BeNDw@<|kzjd_Jp zIKcbPou3{uP1gLP$?M5$I1iuqo15Wt1|slhde%oy0aV@Kuj97(wYzXWrP#h#GKeuWu%QdQNPnTeyjIJA053cxFoP%EE8)vtV zi;dbWah3|&AsBh647z%}@Q-K+QI+d8%a%0!%jSvaO)@=V-FK#mvP+Jp?Nm9Hrz%@b z3`tW~+&{|Zzw%o5?=NRLqWldB`$%@R{h3R_PFu{KJbLIrf+DSu!c$zX_@QN6gd{Sw zhQY)H{PpM&?Dq3e4IL$2Ju6@h1q*UELb1U~x&Oq3@DPRk3Dj&;<-!CL)r=WN3jf1S z3rQzj;Ow}s=N`GCp_`ojx7)!yrXf(j8Xv^q!z^=Tru~haXmCx~XsnJKqvr=DQ`5r1 zpYc0Mqy)HKZ5iHSFx9rl+45?&F6FkF(mr+W9KuFlaDd;sczKqDHdn>f$9^WoGK4ZR z;`>fQ`3n^pS@Z(+-jMAgs+aZXi*=U=eGT9W>VUPs)hzf#%ETE%6KrJo-G8N_)nFy{ zJ>)v=;5*w6LmV$Mm)mD4e02_FxNln#S&{8A$Y_p8T=McB<5tK{7y!NTJP%YYf8O{@ z;}mhScajnh`nZTKC}5^@ShlID zP0rGl9S1GaXxuFZ7j9aYHgN5={J2JoRZVlo0%qSIuupgWxRBhw6%V`x=GXA!>)t0^ z3|`z#Lz+oPj21gS8`Crwt(AZ~$Do@$Y7h5Kye@81;G((#`CZ-i@g8c7BoTNOQ8Yqs zTsN50Sw#+CKRBI0*lZAOGS>`rDo|at!d)h(W-k+WxEu94XuuR9LLnIbUV=F1-aWf@ zJ6H5!4iXQ~a&ClVFtm8_b%hL3g0b2<)=K$XK6 zfL#ZKx3?yRG6dQpd_wjrEZ?su$r^X=;Vva_b(&%EYjeFn$SZ(|bjU$#EskXTV(KRu zTA39_mPNv=EQV81I!L;a%j1?^Q!Ouu;ogNtf%~7HR03Q`&>?WcGTdObFUvv(q6Gl( z1=(iUy$$oFB@SR;7EM3E7J9<0@j4YNXi<-LuG^nJ*flZuO$?K+?f6sYfqJD0;BBm* z-VsB1TvAFzv9wE{A;=7`CAKF)5LY3_G42?4<{+7hYqb#ua{g(bYQa5`#eeCpSJ0bW z!28Xrb>VT@j^CNDd~MrV2*1YS#RN8Ct^?f!KTptZ@ma#z)K%aIL|Ksq4ayhL3HwZk z;%}Q*`|W46#9?>k;Iv!D zL&%!QpKj8b{AJW84yHD4t`>0?I|E{x;JHNLw>`HM=B!-VH{EY4NBAjA0)JmVlCXN& zy38~M5$HCUQ^LCo;Qp`_!^_)X=r+jB&YQ5}k~&uXl=2R!sp5B`j>_NX<&*=hp)WW2 zt9!Lg%bmJ7IOlc5mPzyXU^h1E$6NF%BD zn6VlxOKYBc-n3&X(c6X)!Bpj1f9Xb(e`yQ#G!~Id$~R^AHrTI8?X8C)6Ne7Xotsti zs!=c2In)%LF1pn<1)Um&&ej)L8hNjMIq8sbvXHODnbW8jg=x~|h)mf9N_{x?Ie^#Q zfFbG12k3Ynr*4;K^)Ol@GFr!WlX!d?>@s^;{x$eOS`7$>N?1svIGFarg0l!J%CG5s zB{DeIY8HCyc9KvnO{^~RB_}zpR}Fn#L=Dd17sd3ITyi^It+B~$(llKig zJ9ur^Ooi}5_N9jRzqwrCue7DOo{+U@03nH|cV{L7`AOKKd&J&S2o=2V?}_6cD;=f7 zg3oD3>j_D!qp#B(M-r z)2t}|yLsV~v3_meyF=vtv0h7EoS)_;ql$bcPo?w-Pqcc#!kKk&{M@2ZJ%ZZOki})C z)w?by|1LH9J}bas1C}+C`vWgtC<&Xi-Y^c$%-Tf9&kHQM8}AUl`4Xnyqm1=Xc0{E@ zvAkKLh_bINnm_7*Zw7tjV>MszOUyb~*12pwL)XG}rGB-78k>B`bwW#d+)|d*;zSYq zW%z>dwfht28g*cI_7?11)pmd7H}5h_Q>qNz-a)D|M8lb%#i>pd+w~0;EXd#+V4)^8 z;1))|vA6T`I$?#qsE$*2i!X)7wj5q5%zLe&p~D1;Fqj~*$Q!Vh6whtRuT?dmB;|Pa zBA5Ga>P2tb{K3m`-d~YL{iz`P2l}Q(wMT1S_EWhZV2`Z|T%+EFtXSzg zt1WCg3ZFcn`j4Mn4s@~5J%Chz1Kx;QFs<6G|qI$(9W`jlh=)~ZIqcPt2Q(aXNOT~W6I*U)#jU5%AD;u zvP)wbU{@v$OZs*h6OI_+VkhP>EIh`xEhmCaP&4Z86Cxs!GXk5GB2{`USlaLUfvfEr zc5GPZRWjvc%8CUAdV7)DV=&Z%$n_rNNm5N4TSOX`)qC`*RZ6HNl@?)wsk@Oh z*?U?E#w;|oX*44qd4*e+mRggCVQH$Ubbiz7g!rRQpl2y0#{Y&8RPY(^Rd}GgabmOT z<-OJdxR7MQ<9YUIxGGcdB4Y{P;Cb$omP|>~-g~0FqIhtME|haEcLEsh+yMlXIaZD9 zm^8oqYyczhD?n5S1@t$QB8W;qrBfoj>{vg3ShHeb*}km*oL=b`@XNo>H=k#fD9#Of<|Rm3pYf~jG&ua!aQ}b?62Pxs^g&(O$sJBq@OEM zF0c}eZ}24>x_Tc;bq;5GaKQn}f6fHScQCb?vhQ$I*tB%t=G&m|QYlvTi`@dy zO@0OiE9qSvvuCdXE8K?n*=W~6_Ar2ahi3p!;N{&EDed>s z`c>!LQ38{^Rb6dzdD4odrKO<``4pOZ0Mt5LP@#m}04Oa&SzZdWK}i|vJ)J+*G4*%2 zRiDHd8Vh~$4IEIp&*KSEK zkXS34ztMQUiCUbc|CW(FxGsX0%st$D(xEM?b0 zu~@pGVZx4XFzEK$X#3@k3vPmTkc&Vxm*gZ$kP@!zDsO9*$qP>4=qcLNRKfO*! zF(bF)3i8FKz?on-$M`w!#DXVUh&jJck;RBES!6V=$L6ws%;g7!iN|^o6+432+I=i$ zpYov4`96^>vvtK9O*_9Z;l;dmLgtgq2&Cfhf-VI$fNCk9GyC=qG2GqIxd1(q$n?G; zN_d?zI?bC<7e($_)q^#rD_hZADaWnXkWT&}!Ky^vJ-{;p(}rXvw5QB(wJC}oZ93w9_cHk0m6!Hh-Q>0JRysQpI=iL4j(MI* z$u;F_Lo9Es4Yt*vE4qisxx;wEOdU?~WLmx(Rj-lM&r+%feGXc=aE!I*^~O z#6s8e5gfMEL+^f{s0DtbtraA<^NmY_xidRPLbsps zk``tviTEH%8Q`~B3!vW_NYNAePb@d< zOKGe4Yw>1yF2NZZ8-K5cDDAn_WrqlWSyE{Wvo0IJw@&{w)~u~)&(mXXpVG>vaIH@o zrw)G%+dK%VYr6MapyY5#-C9NaSL57&i%H{he?TC6A8{bA4G^>xsufXC)xS5B zKjV|nF0EUH0>d)heTk0X567}Lp{7}3hm2>;^x)WCZfDduzzbnFgY$Yi-A`lY>zFhP zbZLDcJ~5(PQK7C%3_GpAG83W9+GH9t&oTZQP;rdc{CiRCIAc)OhGYoyr5fL1h9U}> zs@SP!Nzsuf?5=*&^XUBZf5&J8|VJ^-D%^pT#XLU7-cLq?K*}eW0EeZFY;bUoqU0o?-I?x#%U7udLmpl-k7&}%mY2|9RwPtSL~#zq16fP52>?6jil zB^8?1L952=0;${GJ5YPLJecTzS53a<-aXtOUA-bau&1vW@}(Fafw(@q%ng39J=7r* zF!Tn`GoP^Jp?%M)+$)@LxrGBMsm8H(r@1B{7jL8Q&7B#Qa7Z3|`1FFGqb`>`78 zx{G~Fmo7j$OwC{QQ9!PWf^dbhMe+`BFXScW)$;0ox1qjV39BAj??X(H^eE0t!$IS& zd7ijU{#7hRcoB!2utn{uikET|=d1kf87y8WY@fW(KSY--re3v~&t2^$_U6(|-NE;< zE?X^I{lm6mJC=;B;VONkmF=iK9nH~lyqWFjI~~YT;)wTy-|7Rra)IvMl^w~uoGhC| zp7)0@q<$8TSo`lSq=FyFvXP-#1BRqeauHK;{6Zg$c;0Z9mOMoPd?Mgy2yd`4yUICDZa z-~t5Z1TnN-=&K6hpnwlDtWMQzMox}`&+M>}19Va99}4=MlJNI*%#mY-`fy|jNZMTi zR_e4qFH8iAs64yPVmzAYR{^!{4f-&{ew5^`fLBD?(dBvHb^)7c=$+tHX2`?;P9wpX z3?>I{@YG+yz+yuO?2KZ#l#+*7FavrATm-OW0-yr;DBpuB;LK}*Jod~_b$58u0(h0o zJ#c;LZ+)}fXQ;`-D0+yj6)Ei}SYpgD|#WJG@mSXDF%)7@gVMhaq#B`CVT-anTPB9CJ0@D+E?7tuY?Ly?-*PrgI zM3#ziH!-CMifqXyaYA^G7A#6bV%Kg; zMme&9oJO)yHD&;&iJ!u0V(eeh8Hbeh%y>Yt5Y?XjD^qr~{N-BZ|GUz)t9b#7#Z;~t z?WWx1xsM07f~a=`MqB+U7%_q^oOS*i>2A+?UL7P&D8y4QX4E~t|6Z<2s^5by>qbL# zOmxBw+}iysI>2ilt=CbsQIwk=@?`2)3Cb&e-6wIfMudbB^5gs8{bTrkDN%{LYu>k8 zzy~hpqC)L|JqT;~S5+=;0&kzH;B^yttdM48l~Ft(Ppvrk8isu$Px7b8B$sWxl0M#N zxpd@lo`8}VUuxJ)evyt9wGl!dCK2!0OJ>EdDgVJ20WJ!)Av}pa>SW_}Ru!JmmN4~k z=((%&cjCwAxdz8Yd@}v(yxpZi4fhPU9qo3ADi7Y2DQ2K)(Dr^!o1k+yx+qeLP4jKI zUC)qp@O)NWTw14;Sd~J|6E_McLE9(`bGD-w!F&^=M)(=?YJ%Q0^l>X4;k*8bL{EB>an!Y_YUU(#uGm*- z1O)~B`%*$6Mp*tWriSc-;5OP_qn}vCC?|iRL8UC{Y}I($*aKH(UAMmOo&La?`sTAE z2@uG1<)u5?-*waNIn#CW!*}AF<5$~A3TKD z@R0J%fvg18m(`~x*~TTw0|W<7b#NpkR06mlpa?HUfljong)rv^Hkr33ECFo%5D>9X zLAZ8Nv{|-1CYi#pm_Q&9At}-O0d945iY(g230FeRi&zBk5#x|6((QlBx9({V1)w*;-%SZ>=8qvH@lv0$zr<&Gtgo5h z8Y9sxsbw^$>!cb#H86zV6Riu-g`^86RF+j7Di%}>7r-mMt8Az3vhOmdbTTC}!I`v8 zb?TdHw+yhYJS|oBD`!kiH`Z3GS}Gbp=6Hv`@sqL)%J7e0BTK?t`bafZej0K-Np+*jS^wtOK;tdz0giO2U0o9vP+oFpmq(Dv!mUYLG$tokWlX>bsLgs7a2 zvOi)nuj4mW0Z^n6{05EXRs3jc)!=~WylQh)gM>f+pT7e zDr#}jR?4Cj+u!|s^v&iT)lziq`hFE)(6oTdkvn0=3yexuN_ZXw6CA8@E*ei% z)FJ4+KhBTqM}gBUQVM%>hqUdfODqh%VdtyOqk~zGl{iVRK~s|Q8qPtuR_mgM49$Z` zm;Nn)KhU!NOQwY{nA>c(`8xDgeyj4(v=|`!G32aV96WTq(8We%IIBW6K1a)`C!D`Q z8n2~U1LM(|Ei}(mw7pMm8!GW#)?#vX{H?n^;4b|+zOB3Nia4rt=nee9w%>)^L}92@ z`wY0@_j<<~DvdKn8Z8{5fyC23K*jV?51vtSx`Ai*aqEH>cnSI0!%p<6OmGBlF8E7Z zLS5{fm|Fc0a5O1{sZQ!p1}x(7RRvs3Rf7tqOk%r&QxmiG{hdS2sMYRGr5Kb5a=d-- zY68h(on3y7a|JEs{2nmU&P3#mxlKqr-#ThBIjGpMjpc23K3INw=Vm<%yJbye~))Cyk_a!0p|Glti+7Yyq7yT zxfw*=DBHy)$luYb^-7)YA6Zl#e+BHY(eg^cZ8%2A9hv`Ldj${84+Cd<(~_^M-;KeR zFu7cXT=z3J(GaHWz;bnf1kJgC#4;3Z~(LYsaAsSwIAS( zo0L$m-E0DQ?)fDdrv1GEW$3L+6! zkZBwiNl&Os&IXydRr6FV`iL&#WWvPus6{ci}Ff`A4Na}G8=x}64+*&g# zPmdpUS)l^AjFsy&yE4`b0NF0cY?C4vK*~S|rAN2=LP>@*(2)LV{E$8%Rr5XZ^o02G zY4D$S{2(LEgeN*6K$*#PNJW6(OII{_YP(Y>C*#hwL~||8M1^Y7$Tw4Qbz)|7%@d~r z1sgqvUBUo1My@yr)c3-{CvV`m$}2ryEo!Tn+CIZx0L#?Og5|*bVSh{AA5N-g##15d z#eI#ftzU#lNeL=HjN1H!q3I`jt)(a0fS~fx6GjV|sg+8TS4`8DSz%FWN^|K{fp_-! za0Q2l_2Gt)ec)4qRvonEj)4`;QdulKP?xM?97k%5gyAlT9@A?!=vj=5D!nXqe=~Yt zLzPQbHCW21HfnmLMYh5yXA&5B&SR(|=Z=ZiD>W!QGc&>wU7WgWGlUXK2Cp&9El6Ti zZmMLTplm3jtca+trl_DWgp$1G7hfW&2&luDXAd>MQF;%OZ{|tKv+_|K3hUpCO&!JFr=-^VPqNBPX^2a@37F z2+j@kry)H5JndccPst#L4{9n164%@IHkkFrWDK7O4MboY1=qYDu%G5-N)CzeLh^KI z>t|D737&gQq4;EBe6+tm)_0G5>CLxR2_2knD6h{)lRTXAh>H-FOy2KMmH@gbed z3iFP+>c+IzqerOXYXQnckNB_8dZRG!o_m;fjV)~!ft{xA3wrA-vAuY0$q~3+TCCRh?H{)j*laewc3T5uC^S}2 zdf0S+INv@u;chpBONqmsnQ?z*)`3P9FMmi5)k#i9jwp!7L$cO~{S&?y%qG{wjbg5Z zO~&2M306?L9$qPwvm#&j{(Ptf)t<*5qJ>Q%G9z)j3&X1nyx`v(IL#2Wkep(UekFT3 zja$R#E+>1anM}fyo@TT9E&k@P!#Zd-rTKYI|MCe(%ny67W~vc+HZnPV6O00b^! z^e{v4dSH?J%#hUL(PA6zVIP?g8vi~|mb}?&t9K`<50?J4*>sJxY=}UrK*;$z<4*%m zNx1p&2OLW+t*&n@RZ&P;KtT?M*9X^%G0k$XdvR`jo8Qu|a`LoS#LPAPHmLQ}eZ>K0 zg4<5j{XO8R1!ib&?Bez34`T&;sy~aGT%@YI7#gS{*n*5$VorKtyiv+vi*rALou9+D zz8;w$u%0O(K5Y00;l_aRcv#qObz07M^R*4L`)^mNCrN1AJNrwfYen5_Tn8;wvN1VR zC%q3DEKS~#3J30wiXr-|FD7pqPO#9Ah)GQMtybAPhii&EnVlv}Huuf;pWT$bgAQA3 zCpO3j`h$%ebm;340Kr84X`XY->bv~b(3;eFWh*1z@kwYIg<4bEu8|bu#=J$DWEo9! z;jjCZZjmp)!-iDRT9*FmAHFVxXT-JDAxaO7^V})>O3vT=eIl$Og`@8=hX;?IRlZjz zS3$Xh-9B7dvs4Jrfa1}->|g6Xj->&`V72tMFXUvj>6rvJ5cxbUf5fkO0HG~HjTa?A)$MffEa<7V5ohO z)~0t)afxM1No0RLk}l5fzDU+VMs-^m6J9ZvmJ1xUD%n4DCyxI zz^-S9Yu|Sx=f*4^fO(itY1n;hk$<9w+HVaSizP6W8;j4S z#XV(TR&p1GhEWQN0t&^q4pcCQqd5zv#sxWjeOdj7FO)0=Q@#=&e@|r1e6kzI60@^U zp7mCb$0n5$oQN4uw&F%gnTrdMVoTR=OqIogQ>5fS@b8?dAi=|$aIe1v^Rx%9NDMt1At9*w%s!*^ zAo_5@2F9#4k%(?I3G&kNtkyQKp6~8$J4|>H47vIIS}ZMt;q<`udU`GqZHZNh4QSe{ z^^e$Bs#W*;=v989WqwVKaovgET=PPXtc||#X{lwkPOL8OE+p+BY(a2#-7%Rsd!Y+@ z6}C8>vmoUbNk>mGZF&d`iB7;^3z?2n8gfN%xxU>#I&*R}JX*u(Ca0n?PiQ1%rckz! ze!aJK>7`Edyy+8E%$hl>vDgW$!E+>9!q9jb+ z05C8ru6GzGf=-?x_G$PDM6+AA{HS5*58>g(0lQ^a9;yz${|Zg3mQ9~q(BQ&U(9N$p zfSnQLmzZM~Zr zRb-D37dKp6TtGIr?1ay`XPv%$ioUgQb;QorY4gchV-`+<6v2&~o2Ja5w^ufOdCtrU z3AH0h3W;vKn0v^vg+tA{p`#_F@nV`f{~K=9>?90iyU*LVn;oFgaYC>Z`w#rw(N=_Z zJwLWLrf^0mf}0aP+MEy?^mM!^_n)wndyAoa&p1DDhYFN~6Q0_q5Li4t*qH%=0aw=$ z+b%zJ0?h;9w>2E=hFe(>es*m9THQw3ibI{UAlPK#Wa9efNBLDLQ)`pcDp;oX3kj&G zn*BcoNZ6S=TXO~T0mA_iuG^)x>0>N2Z=tWgfYQ2h2>-Id#r_Xk@&7aXneqQ%KkLQK z(#vdq*FNtIiteoA05ArDr~a$#4F4o0`48;~oveX{qLVe9%r6GU|2UuG;OO*=fq{kX z-*A|jSy}#D7p+QD+i^pr-g`&aU$jF(r{JXFBV|I_#VL_poojowZQZlYD~@KpLbLuf z;jrp;=jM!`O^iP%<$fKKMNrS~Pszz+Iv72S)aH}6_WBb~PrrLMq9*e-Pa|klWvqb!uUq*LDyjVSGls%S`4} zajPYdc`HwJ^;=H?!vkTl5xQ6LQjAuy{Ta zmT|B?PtsmU#%^W;HcA}Trix-6SmhOHq8zk__yg8^gtwz+R9fI-Mn2kZ43zC)@0HxS zL1k-#J$ao@IKkki2_o)b!1LxoTswK`kKxfg14*`g)2}@Vn`v;|0^;)|+%j9AfFFg} zx-w1VIuGPPS$^0foOYDJX$ugl@^`|*6b1qTz-{iqcuTF!_OAkR1n{Tgg=Ce&B%_4n@GkS;|Na6#x~BOOWr$;LLC!4>Vj->S+la z@$tpVl)mBl0ieD%1pzLUqzw;adANbOMMED;qb6*fDo81^T4n805kltQ_Qh3LxnP33 z$k9-bxl5?grll;;N>a=X&;E6kL`yo>&;{Z)hKA82ycL*&QRH73MPM}ITL9OE>!UR5 zEU)Xv(KyQ?7A)pYWyL_<%F)HF#>#;dr@iv!ACJCXw%PeS1TCN z;+~-=`f;31W`Z^iQILNY2WX(+W_Ib)qBN3B?3RBA*8q)zFwG4q1UB6G1YX7^^G_`0 z;_>NxHg~Ukb$hjR_sJTK!rHz$Mm3@a5nF zm1J~$e2IZ}oPn=2UQ z4$X19_NxLWMj#lr44*4~k2Y2PMmjM3s%wMfWwk&JZjvzxgVa&O%sB_SfeAtdams-huH8shi$ZV-2fL8bPROWb zrNUcCE3L?^(CcyF(tAvtScO^sd|gLBTvsUqKhxc@1P2lzc`sp5cPj81_I7UGF8VcQ zA0F1CHKoKTOKMjXSF>b787cZ(1&#dyO7T{i;H@yuU8EY^Ou5X2G@6%Kp<|#z+0q#xOMImAU!prgqH~U+RBk z_!xzP1B-9ctwFbxr8FhJlw}mIZ|sP4~q-Am@(&SXA(Jnu9OKn;qSipb@0x$VW5V)&9w}mUjY4ulAzHPG3_|ZP~?#B%i z9BKq$++44wUS&iDzEWGYBK2{YVXjiWAf%c8$01v*IyGlcrte~J*BDCY=7tS#zW&+H z^fB`Y)8%E&y};Jp$Ml6Wdn?8XjXK*HG`s3_A%Ci-)g0+F1@aQkT8VT5l2cNdGxBBH za8YnkWq6us38;xF{z6LjkH|C~XG@fn;@jkx>TB+1rO(A*v7R_9iXvU+?zGg|BvrQa zW?dDv6&3Wxcz<(!?SFS?SXwWSeAAD7a}HCr{(R2pXNhX6ud1LmCkI;_>;IQq0b9Mk zd)b^K4X`SdCLOf)zhTX8)edYe8_wn1=V4h-+T8_=D}o{OwLYBgA26X~cxY#Mn8EiK%l0kTx8Z%7{<0^itz8vIgC&e&4`@Od#921 zg&4d58H`i^nfwPJz0e>t`kv5_E=)w8b#`4#}5dWNC9AkP`_;PK01kNB@uS{$HVPQ$uQd z=urDIKdW|6-Ge#>FOs4$P2iuPc*NkWPR)ZFkDSzmF)Y11^Q=oi2T~_oM_gx2heD@J zN56)hk>h`wgWcioXkUCF5x6K^3=R$l`+o-J;tPpJyx9cVv*3!!)@5u%CEg?Aq^A$> zbma5BrRGLZ{sWS{q{c>)HZ{k(lK&HMI5->}4i87y;v0xeMW5BO#_nK$xIa1+A4&9|0o*oD2j|1{(WUqbB304q7_GknMy~&9_3ZzLf%CY}CjM`D z`f%XE$&r2@Ka@eRE?LvTykW9W=pt$v2MyGsAN{`ua!v=Q!_(2Zcpj^e$&t>(yA)#$0=#DY_O81LkSLNMYb8E8@muhIUa_q;G zimKFCPJL5&NY%>9o|k)zW3&%n)AwZa-fQAeX2Zq9lb$P7#0qWu;YrP)OJcw=nnkk#S5jxTyV z=K=bZ%`;2-E%dU?Gz9(kB-3K(N2F*K%JqTS2+qJ z+I~5DA57;BQ;CY?>NtLSAXfY!3&Ar6_Q88b@i_@ClkD*TUID)veY3al67J%V+$ech?2s{&R1i}HptFQDul5!mJu1kVC=&?-{14R@3Xw` z@jn0E$9Y`$ANO&bpX>a5KKFH22#@lP=w1 zZ@M1H6!6l;vpz5k9<0nA$tcRo?l-m2b?u+6mhpS&^znyH(0*4icbYiU?Shm)tqWl} z!DRInzDE;lS;Bc?5epTks7ID;6+ZR2HZ33gjKlggNO*l#+&yp*W?N8IsWN};X01e1 z5mYTidX!&ta}Jtzaozk~M)!ka2_Aurqz7ZXeS&xQB0@(x4VojKr=@~hsz1J_e|ZOT z^{1Z59ETz8-M3eTJPxRnXc@J-*E4 z^m$Wa*r)vX@L_OAR(j4h5i+-0X(M4I4hsw3wGM*yeVY~M9>&vuYdE^FSh7f`-8EwI#^SHa zQ=Ou+Cr>}Ed_nD4NiL7A(e3$kDoPz7-!@;vip;iH_rDMfg-1VkQhwt()Qnm)#TW4U z=$k-Z*r(F3vV861tk&#k^Ls_y};cdia%-n*V^&U z#!^r0YT4I!LscDWFE8e6x`TPnEl^o@ z+;AQuQqD0C`LQw;pFf4_%Nf|>boXc*PchgehG|Ae!eOU-tMh)@7mUL-G@EC81df7$ z4<7L(pwIV#ODZM;8TJg2yP+JnsjQ#OgNsgKJiqhte(qkS}I$u_lDE{!Y_i zUNmhRD43ql*B(l9JUc$+Y@!J`*BHqBirft65$MM8v1kS!vE1kQ&Yb9sH@U4aJuHA1 zFuUKDf!Nb`C~50$=1+cvP@p$_a5(EWY~MaNa%aBOteGx#leo;vcf?%GqffNfNf>nBV}4a})styJE`_0uFxhc^T!YQ2LX?_3i%k=-*jY$?q84Q zp75u)xtrb_fK+n~H(izbg>t6mri?)St^r#o zyW2xv?Yp6a>Ib<2L!pBK%o-{{W^DfXMxa8la@G=CS<%#G{i|dfyVP}=AutdHWG386 zWUx|^TsU~koG`k0l{|rg37DQt{LKBOv;enZQW=i(-TTNHE5oH-!wtgT0}+YYFZ;n4MVEwfQ|@Lbnfr?w_bBB0 z0z15Y4&Yb9Q1i|rgWXeLy458$Lo8!1;ywBTr}IrW!tEbjedtT?mgIi){X)}NE{WNt zdihJPKs2hf^C~Z+FDfmGNc0Y1NJF$64t|hoSo@7di`n=YDBWhSy;X`Zn&)7_L84D? zHsOSHfv;CPgbT4?CV_Pc0h%lrsKu4l(uk87k$nLne9{ZLUtED5bAAWMa$zX(bq0q% zu`lrxq$~Jd+Yp|u1^X`v2c(M{z50h-l_YwNKKDbQ*Y@T1UYqbZm=&U$!~|Nf4Nur2 z(MI-~U`X?qgQ_*_CWz|oPJ)qrevuJp8b9-P>9P)n2}i$4;d>z(a5a8)B!X{9AF*15 z-TiOjvtDYLAolO!+~|K+cO?JYYL}dd|MdFm?`MXs=0Q2FwTSC`GjZtQ>?&2-h_EKx z=%=R!*L~fN_$KGFt)u)Ver75jPP{)7&)K`Z=Jw+=|8%jE0gDU67tosa$Y?e%)_de# zag*%H)^sty0l$lJRBa-BIuc`dgfhC4zNfTuCY7U;!6>t$TVQl0L#LK=23jf0e=<3K z$EGOtsGr}5%}8!CJAY!*mDM0cwgc{(*(FqqIR(v$$O>tv9(B}$xbMmR0BcA3WLjlh z$7#zBf_qx0$079?9`~(FIgFwPGK1OPIVrceU2^Gvfw&Fi#=)Y(Gp-!{A%t8~rwB#WbV7HI|O3 zj8T8p`^d$)et`1XdSq4zji&ByT+T5Rd~c8!KMK7fmj5*OiIF?mJ1gHO_kelQmAM~C z2uC_+HVf^h)GeBT-s@-h=FT%u3FQfmf;(EhGZ`~3V~&y)a(;;Rmk#z`MzhwLqLNc~ z^K|ifl-0`_f7MNystS`ofS}LuM!41*u7@e&MdMO+IZx|X)X|&|YZ(s~Bh{Sj9&Sz! z@h#U)XY_=8Mepo-QztJsJkhV6MK_*xHu4q0M9EM!h~3GDs$ZG)o24561rJ;kiKTT* zx7UaH?B%MGF)J;C@3<#W3^{fJQ|@+S)}ZDG&(mAJp@|==etIoW&##B{pf%j4$8+lW zsB-`m$)Zj7PfyM$;G9{JVTbvyRt!1$ydHJnq3&bXaaLlqndwo@&o!|X<9(KX`Uy(e z63bD$Jq!&=F{znG$DWT%?Y?;`1qhxgC2I;cyUxyqO)V?;KOq9bA+xVL>QK_2D7j5E z|4eb#ay%5VJGFeH--v+xJR<@Vnx2P;`^>IUeAanvw#=0N1C@u|9aJ#tp8xKCPwcoB z#zIl9iH!33nJ5*=6AX#*A#eX-NohTF^j;DU^_WeVm=SulTno)d`eiz0h~fk=5o=N2 z_>|KM=)AR0=8BMXxvf(a(ujgoI9AHms2kgYBYCq1`@`o zw3+WVC9GQG8Vfx?t@a*yy^MmMluj12_lFVA4pu>lw~m}EJ8BGqF^no_>NTSKa!9_|KXPr>dL0k>HozK8Sx_EP!55O{@EO(P!6c7_ zop{UT7B`T*y;O?y((4tGpRZHVS2*v%fpMWp10i={LH)84Q(Ym04Nd)48EKe+I!_AW z{_T|2{sR!V$w-_EJv)>}grJlA@-CR$9Liwa=ZP_&uU}CZpPdT3gL}PqlV?P`)l68xk2cDpF@~%w1hKEfR45n8z>2Bj<;3q5>Xiw7RU8afcX~i{Q>q zyyh?9ws`vo256V^(EqNKJU-iT(y#xQ?G>|s@Wf`h_{=WZONM_pCHOI2D_`4rVu=Id zKgxpYB6h#d_Rt#$yYAcPgXRrhkeW^Gvx;ejvTXLrNhspESN}9^5N!2Kx3IJ!)Wb{= zwHW;e1ZTKt1wyZ@F{G{xVF~8_|9}u2c zT{9jMygKDqO_+fRj}v$vo8Vt;ZA-ReSq`s{(MDmUCtsblA}iN6w+BMb(*fm_L@iF0 z)FxtBPU}=gB94#oo^-sE45()X6V`-}Y`mOrRKnbsg*lPHH8vK)#9&;F7|`Uu@(;^A zd0iE9DF`Dqd7~8)yb-Nl%ejxynB=5T41J2`8qd6E0*M#75@}@tMgFYJ7y&MqFZ?-E zx>P# z%EGf%eKv6BpnupFxR>Uv%-2H*p)pyytCo7hD$#vg0@<@0a#4Co_)CiAwwT4D;+Hg~ zZ4rF;ObFf9lKK|}%eH_rVBta|u?C@9eo9px-*2EyJ-6?6{?m_HwW0y)MFJ;+^EZ(%E4{?HC`k#qY zn!LXVl`o0hDeOA?0C0CR8|n+qPU8mi%bRta+{2Z9hF)J;aJGwi2<2W`dTtjj4!u!@ zQAFR|mEoUQgiFY1y-xVEe{#~4J`pVsI_#jC0q$Us^gI<|PJSD)$9+m>`io9DY1{j} z2|ZTsA`R`q^1cF&FRaTWqzfIWKvaIVb=u~2KjI_Zw%;E$;z2#W7{){94SzLum@@tc z9lI>t-rcmUTG7ym_;e&s1aA~>CPtXLN6Ny4^dJgEZ|SZ%Az7|u$FB#bCVgvQcK6Yi zcPhN{(2K-7Zy&8LJUWf1^N{R`K-8%4T9zY6gr~HqRGCiH7@xy9M>?nQPGKjNR=RQ* z=nAV2yl~o3aGDNza-xF#U8>08l}e_cskmcWrCG$g#-p3mPF|fx%S{zcHEt3662v=m z1??%8W?roiQA7A1y2DrFVIld&9~4cBO@8M6zDT~4g1v;x`z>H;#NDqa(JNW6QHW0> zR)}p&pb)iy{PcY6!;tr6=rs)Lk zA#p4_;j)#Emn7Nvu}KIg|Ig#3W7+YKS=Gf2%@ECw-_`=tYPNni?b`*a_$BsQ2%&NFE zESGN<@lX(@?SJRlk0Qk%T}Roe0NU~d$N1*onh)@9(Ij_bXJ^E0es1?}$c^f{6fMzy zqc5p`{r0$)^@yj{dB01>jH+DlEObr^s1{DfzSrdepQ0^LTER(*)DKwh!nH&OQ?qN! zV=Pa1{^T{jU$-g}t=x#w$^FYKz*{RLsZJ(S?G0RZekbvmm9MNpm>l{gjpcCvv5hUM zB7F8m4wMH4nFP$Fd;O?MP~5vcF$QNDvsCL^t#2$EzhQ|jn@(>k^G)Ebl@BUX1gfS7 zV)5WqyYEB2&Dn`l^+AQ>lv=jxB}p6DoVs2rT48^*JrE-$M1kI7zP~)a>FdB)iI?4{B~<(d|zNH^@POA zSJEK8-*dM7t6bIq&|LNEeoEIOmr3Og3C*$Fuc$Kpa)!$LJX5zC5|I~{(vl&PdBg-O9^lxQ1G*bzC zh>fVJN%va$YC~+jaj`}cfZEUIXUw=kdF4l5J*VIu4q_zus(TUK*j^F9UDa!DrM1pM zOb$scQUH)osMJCz5&RmJBxvF?uXv`J3g1KShxJMxqC$3^L-58d+GDuJ0HUsfx~V zN!*5PmmAxR226~!q{G#1OGxg@M5(N}DWS3&wvKe^CG#t>HNwQflGQX?tLS%M$!`jv zA)*`c#3Ed!gm7Yyb+&O;Z3J^w=ctu|mlXLjZZ{4&4{KbXilQ;@QozCLX~v{cw!4V_efGne8l9yiPaX$SrAb4%F)T@9= zZ$S*FK`o^j4cQ3W{-#G0ORCyy9en83!wdK4vi1 zwjYKs{hYbc#-bb}?J=h8e`RP<_qim03}Cncn^wQ6)fUDbM*_#&&CBsoH978ywH~T+ zM?+%?T)8!;kE)%8;MlS5HU~vjs&s#^vIuD2N6Gq#dnZi0r8+5!;O4^Rnm04d%_zm2 z9mIFIYiq`}tmIPXyP?YD=Qw*qKdx_{Pa+t|AOelWFg*A83SOIxH}M>^w_U9p-_9kk z`xeR~kLgmsDJ&)RcGX*$VwYrqS`G#%(qA;|YT9it#^uWoXs620#NM3($zpb~M`+~u zE{+E(?=_xhy#9E;MA5EWJS5g45B6;=ib&~+c;1#5@(SQtS@xii%m9-s{kU0dSpn0` zORFnn@l16_Sd=*QM)|ADxv`?OUC*0jOEOg zkU@V(8b%^){FI;7++6o;Godh(8};4O@FO0s;53Ui@$sWmR#=~I0kZmC=K3TtRFpB3 zbP+Ws(Tr&D9H8@jVzTpcYs|`Wi%Wc)1~m;zjjmpR;h;a8QB8(%Rxjahp9=74s{Wiu z*NAMh-_JI+Q-3%X!spt(QF@#K{p4|7%8~tPyrl=qrQc0rGWfO=sesybzT(%7_}b-y zDsZZm#_Qjq)`G%qzbs71?{x?P>Z6`tP_MT+GcqNruYbbZSdLD=g7X))hH5riTPCFu zX=Z!e$t#Y6tO@krC=nk;4objN z0ectNY|t<7^nmAj2r;^TPhHTC2*zr3EK zH)rtjGsz4U0NHJYX=VjtV6O-lEoxFH`rI=McBMpYb2s2|o^SB6u2+c_QNqNnyQ#~y zU=D)m#CL!8dWs`$gxQ)jEgwaz^IQJ3yDg=1&53wGwYAJ1*Bf0KtREa352V_#3Fwh zkp&N6tP2#FhSf3bcFj#rs9Llri35pc_|z*Oa&riB!=W=dg^b%Lq4jqcx*zxsOc;iiIG0M(LqW* z!+$=j%+s&7<}nT|;8E<*KL7AgzE8og>RRJp1JggflTE$j7R!}6|CrVZC^X%x6IIav ztorP%bj9TvsKkxq+09}%MNGj8-?OYjw|&o>i(tcUj@%a?ctRKy{iK-O3*6p#IUrZ2 zJkO@@;Zm9f-knA0$hZErQMJ3KhOr06IRd+!_10qTqS+ zk$SuKfb-ecMo;9R(lg4nX9@Hgp@W0Fu)@JwQ{4Hrg7X;xx>g7eBQ|J~zSY@1r3*R9 z8Mb%XJF9<$5W%u4m*zRvWANt4;%HLGfBy7Y38thjS8As zIm-5mu|-`49$COZ(w)CVz+yt_`cG%V*{fu_ls%)>g6jtqdz?!&m9@?gpn12LWO<*q vZ|C1JbT)n%Fz}p(9yZ$We;=0(2!uQj40-<4jX@Cvk^#vx2n*|)=rQ~+M6nN6 literal 0 HcmV?d00001 diff --git a/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_tr.pdf b/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_tr.pdf new file mode 100644 index 0000000000000000000000000000000000000000..b636034524f3afae696f7b7c921bdf96897a4ef9 GIT binary patch literal 544438 zcmZ5|bzD?m(6@nrpo9o0jkKh~(ku;%ERB?;LayG^;W`6~8E1KC^xLD%xKIZ{} zz+gOQ7bi1gTRe~PKWX7QlRdvAx`;)E0@>w_h;KS!(L6DFe}nm!B9;W!Jz}1i8yH$5 zL%AK+5rXGWU-oOQ1GsbZ)zO5H0Ew+^405kv5emZ$UH9XZv>YwpN6t2g9@)~DN;!Q zqLFq&&Yu4(giBi+{}mqsT0)JH@R4bNJjSX?VLG<(LbHZ+8$+WLifBBBkzbbOSZ%?u z=db|Mi=bld7v_&gK%j%NdOHsR%(Q2E<|p5NN;lP48{o0nW7fUVtC3yL(2ThxB9#4V z`0$y&gWg5q(`ib8A~Bn=)SP$ES#NzkW``L=$TY?8AVL$K)5lmxN!0O)n5O4#uvPs!1(xWqj+zMxg%k*1D9)mC#DsZD2;N(RouJjyn>6f>9Y47)wm>c8y8cH=PRE zTLQxyH-t^`2dEB7^2@$r^to||S^7xP2BVEc$j!2pvag6&hqkwXA+9RbLh|0JikI-uLJReCV1sZoL-m}vAf+Y^Q+`f!be46mH|mmC1Y?>D-Y zVqOZ%V`khSf|z2!xiN%w{TCZSC_^%aQD!i}luo%qh=~$oA`xWp-7k6I;sgH@X?C~` z20+XA%!1Fl(ZU*7#|qvy?h($Pe1 zxlQM-*AicJmnqOl{Z=u<=s(XWBD6#wtn50xgK;Mvzu=bW18rFVynx@c4}0EQ#yq9L zDBaQC&E~oC>{*K15XP=2S+!3+a2+LO-GRaTpg;SJr{4Kwdk5CLWv*xYwBoD#Pi^$L zF0cIYzxJb7?UVQEfO)tXmdJN7a~A>V#!}0n`X7@Mf5S?Skq=vAgu2|oeJqF@IDGSC zQHb$t<=t10BZ_}scIQO8jL3sH9|5=9%zQ|dg;n$f{MW00os-JGzASs+EqE7$sYJP{ zmZOFs6xIMQm|A*6?zsz!eXG-y{<`WdX5F|)QZUVnyhBEH{JF_kx;9ToxhV{uxG{s$ zFk4@((deT*jReEUa^HArOu!LQNrv$ig_!ftz3KlY&>KKYE`sqn9cvpz)SfI+C&a_} zL`pzM&D_dAcFLW^_9k#->16H797&q%whqC@3gIpx4+>J zC|Z1TH%{?ny;O3;c=wpTWHECChTtT^l_d58y2{69p4t4~qM5I4Xv^7w)+5iZ% zFe0)6I2o}F!0vPG@}44LdAD7@-5`sSfB=Qaacm+Zn?gg@rGc)IbO)D=# zPj3T4c{-zUO04>q-!Jp`sMB8h^DT5^$oa_0T4h{lzY1)M`-l84L(DZwFGU%#G%ZL6 zn()ETgI`?3Ei}o3MGrIXHNUt&iiro}ilS#gX=n~vqyt7Do+0$QFcY5rH240lhw+c~ zn+&30%O6it7_%`8amJ_*5F_53#>-$3FK@S9_Y{-md;1YFMjT58P)?nlwsw+K<<$e` z8(oek3U5Cc0<6yD=8B~HrY@t7mB)gsx{oO}Pk12x!sH!GW2*R!~y0Y`YC8? z>BM8wn4DFw!@G?i0gWhm(b9w@d4mae9)v1y8oG7~C?i@e5w|c2V-#B1wz;`Pm|jh= zq#0ukDE<8d#F?Lo@&%!V9={`|jN%UPv5l1~x`7?hk#KTR8-TPLn$ylY!Fw)qrJvp~ z=G@yV2@nVG%ZI5}xNU{TtFw^cTrb%646&R)ui8K_PP+gDrtmN#MbBE}-NI7dxLi*N zX?MxYr&rgui@&?we!d#$5AF0K8MD_@BIaM$;P!VWSWuBIuulsD z+Atc!HYGcG3GQ!J$jkGlKLbdDfJFfhPS8zT2>nk@}UWPMP7gs+TR4Xs_>u@E{t5o z@O~exgR#P}lUL?)>fcZM(dPr@D!^)8#lM}`WcECmA7Hsbk(#=3VH4re6=*JWmdpil>d z?7g@@H886R2ru}dz+a$l^Ff+^ZRX2HJrt<>r3`PxsI*f%G@cfw&2!>0!+1zR1MCRj zGga90b!an5`67;@1NSiS1xc0k5r?IBMd_xY)+q^r)Hf20vQO~i`DFXV{*i9CB;P&2 zlDW*+%kP8fVAv2~b)#9+qq?2}+t_8%$yLg**G_{q5n&i(aJO7d1BcOkZ_w~Bo`7r# z`-HuymtuMEZ0za2WMTBak-O+D^MtxzS;LRR3R8U6)Tay2e~&#xnhICkCg8XO?89m2 z22Aarb@^+}ab8FRh4BSt?)iKrt>}2wAe)yA6sWrrELrjlzyN9D!_+wu}SvxLAMAi=J0-Ve6=88p^vU%GkA_qt7kl!GpcygG_9ydMQ2|C z%})T|kRTH-a=-7`eD}d2%;QZw8KCJ0W{QxyUF@03#7OaF9AWV{oglVDLV*6HcZVFF z42Kq$C=}H)%W4Ca;Folcn+SX@L$kR4BAb+Lm^D_m8&E1>QRR1jxE1#Ix1~u2CN+W9 zzZ?KP)TE7bnA?c3VksF8hYdmltt<3_8bJ4wwv~^>^qZdgSN{6{XiN|Jp(e1_#>pAN zt8DEuwN}s=CfPm^?NNfBAsmh!>(47svX3Yi_2UmQDidJnApt+P&`T|;7lUV{0&mwc ze!2n0B0z)H{u$y+@*Ag)1j)}nH_(;a%p(J%AFfQS1;$&M0(DvPAeNJoZ?OX^I07|w6EXf_H1LM-FJi+7Os zk~FoQy|T{qUZduhEDyD%fKYi)y7uUy-o`C+fJyZ3#m%*G9rSGjK!1tU7qle6!icBA zC4SfgPraVvgkb}U%52h@IMl!TU99$fKPUJXVjZ6Z=!^m$5gUM4K4cD_q;X%J7u(wX z%GK4mmQTF4cBhwbE-b(wUhqiiQj7Cnf~T$( z1(Ha713JJ;tjWYc@u-B%&)Ol6#f8p%D=H}>Ff~>t!15(TEiilD9qiQbfD=a1F_#C( zo@3Bei@$JIjk_|qT;og9;{(0FuJx@9$s`>g&EFI^4wRI?Os7~}PGtb5uMRvdXTnm2 z*Ltuzq5RxVMPzeUA7Zu&T&nI=I<>&Jspfrzlb0j&uem_)c`&H|ezA;I=a$GPRFJ9} zsaujEQuer9_`W*!^B_Q+l$;YNeth#e&2s;5tuPs1x65%x_PR<703bReM(035R+Ye+ zy2|HCofmt`gkLSY6}C(89b+iAw9zrvxXj3W+)VBwhe1LMO5K)piWlYRpRN(VW9_aKe4|pflbV81{sv9wTUV} zcrCQ^K=c%|zXk_R@@y~ECd=q_o)l|3>#3l>eq4s;d|C0KsO#W^V_INidM)c8?T^R1 zE1YDkZ=N?y%{KGJmbIMBpZEzZb{_>m^?*r|^kl<~>85S5R}l9W(uw;C4RB&)WS8Nh zc#7QCAl-T`U=~*Jn*+DR0mME3jnXzv!M*q;?y+XS=E&e73sat+fD5%cb4* z^h*0i;=p~)$|-C9$kCa&Z_wrV_O$IoWZ|g%`bA@p1o?fs_I*cEW>} z*sEr9rdy#u8kCvY>wTWP6FQ^2uEGx5Uk_yw7EYhz-@EfQleu>VURcL@eptI_n*}>r z`_eumTzhwADx5Pb&(NueYUyMZIJZ%s?JY@KSe;j{A~`m#ALPq99NimuclJw-lU(;i zxfwZHW9frlX%$f&=pe?2R`}Qz!*T{T4znj^Kvre= z4|Rl`_7sbT^!1Qej0a*0cRp%^1f#nbZa4@n?#<+*`nzzc?Aodo>e zeLqsj1^dGp8BpDpe&WeD)+R$){h8c_6tlTH@I$)PNoJa!$F{$jPCQ&Z zGYBRp`N;W@5+CcgLcFT;SHNZ`O}IN1u$~&bY}lKlPy>6a;l4k0lo472NzPLo#jl{` zu}J4~K`6=xnn07?VIqkr7ykLegY{SQT({VW@Om67V``U=^d2MpP$>%FofFE z{IM41fe)UK1Oynd#kd%cc5^e}`+NL_IIop-Pn9As_2+ay`sv9=$Mzx;?sN zQ8ye|_=?yO$vPd^bKrf9aw*ybG}P#Qv|b_1=TtWRt1CtPw?2!i-CO?qbme0LPbvL# zI0(8tIYx!A);jrBA*CY115rKvZ`XohC*Q~?6cs?U<7P|qk_vY|2s+o37d_o1M{>R` z+%=Yr#ozW#nNq!B6|dF_TEMe5kGI4|kZzujH}&QK$n~=Df;nHB*Cib-YB-M%%?p3zz7f#4uG;C_mlb0%vW>|{|evW{4US{MM! zn+=xd*&pltb#%hmRiil$%Q1V zD_YF&Ts#B)sJcol@ZXvN;PJ( z`Ljg71^YlGUwU2+4XYIo}7WM3YjuSr!G{awQpN?jvWtxO> zLu$Fjqj&mv(FH*k(NKcZdUVnAEN(c=Yd}tU{at@Q)xN}S708+tpWB^BhRf!LL_aPk zixnn)-bngWsU7v5KFJzuXAJ>OkfuZEp8+#klzdC9nj+^@y_IO zW4b2=A~$f?@La8`ky85bJ?~QWJ&k}q>=P;h?@s6}Obuixeczf{01D=#I3T&9f|xUK zchqD&>URaofW7he_aJ8Whq~JDnyGNar!0v6t9DW8=?&B5TT7rpt6=mcE1u3CAo!M?6IlT^M^pLb!; zx|!;%XjzMib~^Fd%Iw}q#l(|MxiU8D{AIc_Jxc)uQOoC>{cf5WE14S3d@x#_r|Bxc z?u5j+A*hoYSZX%CdR+Wt1UOA@Z zPOp=;&*d)@m5JCsqYyHb=&|eR$jF$$CtP<1vEDDJiS%A8*pA11MoIK>cak=9}; z>F*_u!~E)|viPg=?`vPo|y6O$pC6oIOUho4nEppW@pDMtYa=s}Tr6-J^ zw$qo0DzL21Ny!GST1sHrUoG)F}myR4u=~AA1M@T_wv$kHX2Ryk^8W4 z^WfROBw;YL-XrmO2DiK##lc9*8?@ELpA~`aJ*G?41>arjcu#_wW<8;@vK7R{-M)>0 zyg|?3&y6AN(n;@Gf<>INVeR!>HMNaU>|JVOK)S zuI?18CW^K^pL^vv6#39Yv{>?73Ltau%qG$rd;s4DMoqRp488vbM1*<=Uh= z)q_lGE>6eeBaYL(`xH5m&PyORZiX(r^1ZCFo|s>E+-f=3lYMxP7De^T6<>2?N)gF% zSxaeqVH(jl#gZeIFD!QGbJ1kV)n16V1=c|QS=xM(BOr;`5=B`VZorgNKr_avd6Ok6piHMV`y9}jYwY=@I6q@!IZC-Bh-ko9c^t^sFdnSvVNE zJRrqga+c+^%Xihil=EXxY|udy>GMg!v;kWZ!jRtRIJG>Uhk$MG`5T0w>r1Z+?K=wk z>krt`*gMVF^O&Z_I+&-WFhjod^yqZ9}5cWH|Xx%Y0VCQP8RA0 z$E7sE%1StThB`ysy}5d2C?XhiATVh!&nls=75Pm43fjA8&6e{6$9arh8ieCKCH1Vf zlYC(|zB|&yu;arBmrqFU)+@(R-!HGcllCBMH2DqCbkB3Ut8RHbJ<)qd?(dIrB_YVx zGd7X)9BXjHRfEDp*@lmco>UV4?P4o4-gY!XSt&y!qzFsp^rr)z&jtiFq*Qh_#&@-s^RCv#<=X1!B>Ou9WZFD65ahnk6#K{>|3WUcSa3r zpe~H_M(5n`!!dVm{79(NRA8EpNDF$W+jQaL>rxFDHE`N|)JbAH3GUB6x8vMy6H`$v zJUQniHN;QWS7kP=dlB_M6D~9$*+aD~>%TMkQ$lnR~I{AHEW3A;d{v$gH`$Nm|=&lmQRIUcM}_xry#IBc+3 z*iMY$n7G}U4=ch}@gpCE1bvA9IbswD69Xr&I8#h3SEg&O>u>dJ9PHTXdAOhhy@L6* zidL&(EDzoveST#6O{~5-)mzER%YUnBz>2L<=)*?!*uBMz`0gKFWI6Rp_~mLxC(0Sh ze3Z1~_iQS}RH_Pv9)#DqXW)i2-XR|T!$dXUZ8lAM-@}h(`|?a6PuSIK`FZC_&Clgz zD>sN6h(;49aVp`bt*7F>3PF8)H|n*KCFatJ*FMM6E3nXPxKP+N&Z-5QsJNN)IF=V6Y%MgxjTeh z^VdZ2iA^I8jd{(JPl4x5*asQY$&2Ugyh5AoDcL0I8qSYKr@Y-B_p_i6gFz&GFo|to zFHq=F!hRP&E#fKTo%vf6`P^Z)y2qWU>%8+Px^GWk>9F$3FtzEVaAuLyU03R=$gj`M zcX4i(I<6dELlSg~4Z8gR!akOenhccT+O2eI9oL7ySmHB|@afosL1);Ylu8}J0d#JD zcoz+;ALMR8oZ;`w=dgq-FC}W1CrH6z7Aw#5Vjq=U{EIcJU;+RFkgR`9CzSIJfE=AbZFCKf4D|&@<8wp#EnXDjokUe zpLZWs5H&0EMaLO3OjZL-csa|SUwqUJ&OL?H1U4m}*$k?^!1#mRP^O+B}0u z-J6ea*Yi+UmK-ol6>&-Vpx$TwL09)aF2SeXN{IXwyWD&jlNhcA+M>X2Gcpug(J`gO z>S9}XpM1u750Zshna1$! zJpcZFqz>5}Pc!9Me8XAa@J5h?MMLK&PeR7p>`xz{htb6Dp0J}^AW;!_HrdyvSBtN@ zT@=1WyyJ&_jvGk2d$w_3Xxn%3CI8H(j#uiRW!YVjw`ZyC)TNhj!t3SWvz^pUChwU* zZm_U2+J0*)bZStp-`Sb)!-RJzlwh{ro1@uN+iJ+;y@I}GEdGwyVu%kRV@>v_kI=*W zHd~h?vOhMah$EhGUv}$LF2n0|8t!>UqATS3tF{d+$>eEZ%iIe8DLAa1^?@l;cpO)gv(V4ToQw)ee% z_6}Ay)y?$iOD^o<(ESgAwL)>JUB>3a++pJs;c?HJH;$zfM$Pf$6FxdR{+Ba}CkfjI zIw(8+D4p}#`JPrzkN5O17)4KBSn^&j2MQp--nTlIne&%#lume981H~oqx9AJj(+*n zQ=Z-ixx0VmaWp9u>akNm`&+IkzR1pBUe;oESdU{*Y(CkZkL~HT_n(Ldk1fO2WL;lB zK6(JznkDcNOp#eQAc_Vx{lQhN>fOu5ukO3&FKX`y@DV}ve$at^Vs#zA=FrQ8Uylgo;}sGd?Zv~uZ5>Xcfomf=1$B1| zlP_HcII?`T0)_V6GE?v>U-t zS9CJ_glJ6XsBcu*1CeOLH%Sq^ed2_|afi{zGbxaFUjq5^%}+;d`ISzDlO@k0<48!` zOHgsCBDSZZxy-w4h315#lN2H!w8dvcO&GIb12cNw0)_j5sVBSRo7fPtZe}dng)A9r zmQfP7cI%igNroocW_nNegQ3j+Q=y!_?YAQ1&pxJ*rj$rjc|)iMkUZM#r~{S)*m7yz zfit;af>ZB3wfUdDJC?B1nR?V}Uq$=^$Mnj)nP`IL_ZY3g`!#8ss9nCB?Zb3ge&i^{ z%X$RGYpS9q!q1$&KRF#f%f5q?e-%}(41MxVUlf9Rlf?S#%u#_#p>C;R%e@E6SmlbA zpA>wX2;l~_)SlkOs~}{ha+p2q%is1mGaJ&I~@N!9*}&3pNxx; z=T$CPYaIGcJLHE2gw^VZnkEEUHGyDXeXy}I(be|N3UyZ<`%_-~L)|dNd zscc?e`7v8cmPs6i$)~QA2$mc?C`BoU!c>Z?R7=LAz<8P$mhw^+g;ua%Ezd4F%l(?I zs~*9uOR=)*tSK6ZR*q|<{=j`vi^Qzc>n?YuEH|H4XTptDB+ZGWLFz4b@%Ew>neZ_? zNLG4JKCavwNk}`*3%QGrfND(p(GTbVdFnjaYp^14S?N{Dsn!CA^1?@mA*C0i)4-e3 z%oHD&ulG~nNUh{x4h`Oe4gRlTzx#e##;LL5Sybf;!+KPGz37rtUTJ~uGYF-O=XH!P zY}Ix+=sU}z&ezydRlDIW9J22^=#pBc<9nmwUT5rzBg>{5K(b%dLn;DIdW=24vvwSJ z?@~rN5XPz!G9u9|#jsGFRZ1Tfql?B!qkB^zEyBVJ)LRk@KjH8t?2Ch)Tj7#iT7&U4 z{PO0K6v-z*3Ld+r{M7a_H+Av)tQc!lQSm?-f&hzsP{fC5gYHL?+Nij{J3uSN2hKBh zfoSusk+>Ed6>E+>4{`fNis$VrrfG*HCCi%Kf^3W*b4!3oFsL!Nh1`g*tLRH4A*qXI zXZu-&^D+4kyclNw$xy(?@T<5$#ezY_+_32SNMm&3FdFH2tZLkq%Qo}m!=uI0h=y)8 zDW97mOw1x!GF}E6yt^CxcZ+3eiHsgpxl)HjI@Mbb-tJa(Q-2MqEMGodVRIN%SmFGA zi~qwTTm7pw?f1Or48iO6V5HU?e$!Ay+UH`!@JV`%os?Cqqj`PxuNmTEdYUFeCvJz= z8vZJ@s!H5LwmE2TLeyh#!?8Lfid@cPN5TXlzNojT*q zhbYDK`uh(Cb9%)EsKRB*d?3w(kMbIrzv9H5z0w6CWE?k7XAP~rpFPI!rTiGguPV^u zR+4YQ66TqyHA90CGkiCfj1BE?FSq)=+fxhV6rh+5XH*%{=1)uY=%4$@*(2GwJSfjpsw+?Wl4?mg-Ea6uB47*+wjg4%zi%R9!HSZXl4RLg|kXejjVUskn zhCz5!dRQ(LWfcPQBGCVk{L$|1Rx&j9sVejdmPty<8RG9P+5#aidzS zuFHs8!lZR{x6C=VmEdOFQgMeS@`Wh4KLo3>)8`#`14V46bNB}Fo=81|f zQq?$XKMaynD*NRQpbGqpVDPz&ev!G4CdhZc0ysq+DxB-WeoBP9PSPtb#8ht8wsGg6 zB}=T{K~CZfiAxo(f7%Y$k^Z#mrHZI3o1jymv0&1TXHD&(cDn-S^x-{s64y|7ds?-e zBJg?4Cetv`#!*(tT^)9+r7v)6iNS15`@48~v#!(p@Y_O^Zz%a%xz$KbChSektOWUr zS6Mff#(bPG*)u|y8EV#w(vS5}SZd2Yz0{NP#otH4q!mG@;rb~!Zn8H+ruviybR$!I zw)evjajNwE;dg{JNKg-Ll)&|6TRC6#P*LBeVGG@M>xEVoN(aVnCbUmBX!TYU_xUCT zQZwNlo>+EXD1cY>yB^TAbZGL9C<^E8t!Uf$8hscEfc6lS(YAFMgf0KsH^ur&q9L&8 zy#COE_R)E-1P}{#j$FUc-xT+_uoA28CvLpu+}!YR``8GDnI1N_$eyXm*usnzpZ!rA(d9UKrrr=`NM2$pDybM$Ug-(dx&V z5xxIzzF0NW_LRqt7ViE$ozUnvU!fag+*vR*8y4r!JH>993A;IMvR7#36w%gz4K-Z< z={0~`u&PQj{wv}FuRh)pN>pey`0V9R+`@2Z>HBK1_L2PhYtUN|g9dV<79_kX5;=Z+ zdxfBd8#j7K*!7Img?uT-1oZ@f@SY(k=fb>RT}bqJ zf-(F_%TswGhMQ!q<%W{t4i4$wM;BMmir^CsG9YC0)=eK?C8Rd?hoM*~-dmO0(-J5} zN0O_4Pc^SS-0MpfAc7js1V}auaFj-?(n?2iU@!CGlDE^EPLvPx ztX|0mRG{xJlTjKUu8y#;ayd0OxGQ`ec`ON1g%}n-2DtL!HLc%mA?Mnf$V{@03HzOC zeg^q+Tzc2oCplucmC`jc{(mwpPj7@m0J~&Bs)(Bh5^F{9ZezF@sq1a@?e5Zz&zde* zsnl-jmt$4;(b#_mB;AQ#P=!L>W(3%W;xb|R%m9AbFiFutftk#UYW^|Fdcujc|Rk2`Mrl7v^x6td})oBO0Qc>C$Nv7a25zt`Z4 zZVtUK_`4V*G@p5Q9K~Fx#zU}tZypz@6gVuFI z&O~fv$m;?DySvDY?V2>zZIvlWr^M#7i@$Kq@!MP@dt$DFm<_$9 zp{@!l2@>~e2q{?IBE~Uel0K(O1>gFgDGB4Og>{lE#WheU4Vivw62nelB=2|EuV9`R zzLkHG_Tk0gN7__81U}3;Yy4fY7XDdz%D@=N%2V^dZUhzs-U6b?##cCPB=++&UCYgo z_`76(eA`aHXL=E09Q}8qRaRo5mHwJ;&hU_4MLd$Ymie-g?#xMkd`S(EfPoPRCB(ia zT71HA{fRH5c-pKVchy0~@dy5lY=5N|=U&=OeJqM=fz6Kr21Nr8CPP-9qNiXWu!{ z?C@R51dQ((a*>P5PZp& zKu88CRA-0n1Sk}x0V=7f6w)`pa7=Z3?uCrnO7wU6AiB{xcQYT}6w6L47V|gI?g60* zFNKXb(jIv6Y?mG}N{&rFZhaGWX%4ygb?c_>_$4a2YQXlR*_!#$niY0@dSl3AzOpx0&{_?}S zn-6zo<6g=XyUq;2xA2PRi~3i~4S)1>^M8Mb>VMa7`009Hp~HE3Wml)bHJ4OYu2eQ1 z(jLqWDxNsXlK^XD{8az=rz&LHAhpn{0dK>j$Xu~P2j##1nzyJ!IL8|2?w31b@|&)- zxBgp%xiGmFs!Kby;!|Y)uwv}ByJpFyo*%2dE<_SkB4E9~EC=Mmf0hDU-ocaN0of4= zv&!Tvmj%m1d7r#8*a#^ZaF+Fd!UWh_g?W~bcG_;3IUgeR(-WLb2J;?*y(fBL^&&F= zCWcFcE;x<%4zsl&6UBGsaWd`W5DPCQT=`Qr@RM}ZdU8SWDv%9@ql~s=Bf#nL8|HLJ z1+ek1{cPCXBDn4A!SnBDVqxmTO+qO`m(e39s5N(v5j`1=8sh6x^w&35fW}JIbOZ^& zR|h9Vvg$&`1#g-riAN}PHB$ut4+hmx-J%`?>L1a{G59Uyg9ct}m!Njo-PBig9o38p z>)1>Hv@)O*^LZ5nU$sUS46K0^W@k;6*QALRyF84n9O>OgDM}HVQ5bhen>DDU_57ds z0Ccd$b5pu1<#QydocA9xG9YzU|1hYR zDr7=|CreX&ry^!LeXW#lW#M8kM|yM=ZNAGrX3yC~K)3J;YXkBGcF_2bb=NZ%o7xml zo-_w$pn(?eopI+O+`RiRtW-J$&4BoZKKDqqKb=|cO`d$#9sS1nY3$#yS7a=F zX$;Y|Y*GDITXXK~hhJ-Ne6>-+9j;e%GHaN0IXVd^w?svmP?*6BzS1k63gaHv} zRT6aETrpU*o9)M0?%{TR-lud+H!YQ06&B4$quXBnsPY|w$=keyb{wlRv3D0PU%7K!>@{1SgN z7gpWyyR8?`DL(~mMG|NU{Y8TaJ6I}{|N5QvUo;qO4;j_?qwmCh2|0YEVcRuJR~a~> zl5i%=b;dxNlvEjyG)hmk^J-$SvCxPplKYq19!>J`zAoXZ8}Fd?nve~w{m(QS27kzN zhY67!xk5q%x4dlFu=s7!fe+>XgROCTVX^RRCXL$oW0lHVRMk`mnc-Sc_POqFa!-41 z?qL((PS3}`dDSObi6*sI8@**Qr8?gJ$A%cpL*k6-QyXJGTpCqH9mp`n@P_Q_cZWbq zZ}Rvk*{|`FSKHY>6dy0~3EdS!{yH~m#+z>_bWr`BDuPH8>1OOm@ilM}I33$2o=r7m z=VDFL^87$pBn&mV+^cL!EWHp4_@B}l?aepVr=%TE1}%kEuk>{onz9e{UXglgwOAKr zICpMyh=|=i5R#?&eQsTMrnx=K_%AHZrx)tFze{5ni(%Ca4$tLr7V$5&q9PCjITTZ% zZ+3h7j+$8K?+dLu3c}|43;v4??^tF}$sD&bNoK38E4Ir`!Y|ryt*uh*DGS83wsWYoRwv@}mw0ZgFu!@gY{1L(qM8cfIiZo$K0W@4Envc&xBl2Id`E6t2 z!<6IyB52nqw#7NVMJ!qr@(|@x0$WH?!I^D+*4$%K+gBMWSQ9*VhJ`u<^Rbz z24oOC03@utbZ?v}zT>>xLpjumK9w+;uxJwK0SX!HYKf^_$CS|XEVoqfz0t(5_{r6O zHFC609{FIRmYH+-MrG4?TD=L2@dRW{Jp(c_UftW%_cygFP0Z-|moe9Le?-Jo3q$Iy zm(^jU`FD2y!^b!FhbJY#ud&9x5rr4T(m?U*>gVCBlnlMA;Vy;OW5=~C>wX8$(~Jw~ zYlX96YdsMsWDI*i4bbQ8dah;SCX-Sjn`?7cAsCK#BLCPeM9rn)eo}RO)C<#D;|{I{3BB7zS8E6T`?_=3TYX#?Xqa^P#q9DR2TG z&d!SQxbbGw{{ng@XGm!ECxC1g)Gzzx*oUbEsQ4MvY-+T7D1S=t*y*bi9-c-{e~p@h z7FWub@^5uEUzCjhx6|I7d^;1!hhpkYsZv1~-9edXa!QCD8?Z>On zz{Pc6L^;L}NAoFAj<$D!7sCE~m;Y19++xMrVZBD32gSxRc_GjO=5H~@is;wqK{TOc zZT5NdoUOkVe@#g6gBBaIFy-_J+TXiE5FDPl!rScHDjXJN{#vxt-F50OB;!vjH^;5{{_ zO>Iu*+1i!cNm!)EXW@K^x)<=L+F?fz%r|!iX*qZ{$8=B*U+Q0sWJ`N+UCG&c75uo< zq*MgxY5%-~0>4O_$bo_@?+Cs@Qf;F2^?o1|=y%J_GY`oA)t$SGG@ts*^l&YZ8u`l- zn(@G!Z&o`emX;OizLOUHsjH%L^E0Sj!_&~~f`e(mnYq}jJF9Dk_}p(3E9vHcf%;9} z$E8+8^E;y>r;E%TTh{EsW<+K!hFrG%s_w-OUDA1oe}SK@vZd;G_aet(#D86QlSx%K zfAKt|0!E**jDwnNz2bnY$lgKn0!!O%gYIx>(0-pldE>H(T-)HHZKb%ewnJyOEq1xP6-&G`RTc}^vI zh0^k0L9gl`{yOK{3+l4L=VIN|`M1q5XL=7$me#2XA{Es0LYiAEPVoyLS6IRFm-pv) zXBzRWX%Jw$@q(g__YFZ3)_;SbTYzLxOt>&^?_KcvlOd_IOH@hVttp3kp54}{>U%Af zIk8EC;@S;mRcTkLgtJHqOb`ISbI32Q?Pb+wNwvLYwSL<&i#ZGuDzwiW8N?81fNox2 zOPo70bMbfeTA0t6DVOvyPO%-&xY8w9PA|i|PHPQhtC*K70_RCtBwqj-v|Pc`o0Siv ztDj}t27Xn`RRgz{C*MTHyrH3dts`$={C~Z~-3^+HhUMEs@PZte*wwo3A-4Oth9dmr zO>6$E1%J;^-00XaXo`4@z@gyonE7Wbhkx}M%Psa@?Q*=sC8Z8bxR9*?Mn(3p+zLEu zwmp2DMBGP6Ua$L(yJwrSYtx)Y6GnuIMw@)*iU%py;KO^wC|L>#e9#LgIZ)aheeSmJ zuaS|O3+N4xyVlLe7CKw@6b&gGI((IoS16yC>DlU17?5~vb?y#;v@WD6rD3Nxbn{!| zSl=a9{os>b_0t|~n7a@vKH=vQp5_*ql;LAvOC-IK5W{heE^rpw=-p=@VU(e?>Kdnl zNcTt0{fxBg*=fF$k!pX^ySd`3bP5g=V;5L6ccqqA^7?%LZ`d>^-`IZEz}D_3HwP~u z%nX^1QiUiwBVHpm?avNg3Jxsn7g48{DY{&kc!{)>O8FCGumOs5zPSbPi~KF_R9nky zXHJQXQJ@q@`NT&?XQr(h4eb00to;U2`cPN!>_=V#!lQRnp! zEgi;zjV$1ojuXyuNA1k)8oc_*a}T4V!=WPt?#{WExV>su_HSS~r?9YnF<}_6Q zdbfAeZ~ZiX><`0Exo~HwB=9%=BC89#iC1r?EO+5f0{oC0Xr1nn(#)3Ty6j2r=|0=> z$^d0{OvoqP2ZAYDPzdqF+XeW@^IKz+k(@ea#Eo&JPUsl?!FCGF;_R|xylJE*v%NXtLtxzxx0T{v z6mRhNDLeF51>Do^3Oo~RJrhrpIi=g!&=J|M$@{J@Sa^GeLlb@B$VU`qRjSi5oeLvJ z9&F}cCVsHiErcsY{#U7wy`!}F zuVj%i#paM{cl$e}_^aWt<@(I!t=1!7=An&<%mUMZ3&bs(-G5oz;T+q!D>yO;=N(gQ z3W3?6QfV_`FJa54(>^P+XLA`n{Vd#utEvymIy1qyuj2_|tV`TI(zZpaLOu=at-g9L zpJYF+20HrnlKf>4-zYZ79cO(2JxR_6EA~vp(Jm~#$p2AOd4RzdS`bo_QN*?q1ri7`F1p%$NqPbD&ir; z`J(j$HS9;;X3a;bcR)cH9;=A>_pFwB^!d}7nNNK|OGLT{K1fI05c7^9)5;FF$yM;u zdsAHd4e8xFcrJAP-u6ELWPD=HfdA(p$Ez0jKyjk-yXl3`P*x7?E^ImUU40O=l-nv{ zN;GzSm;Cqtn6lIjJgXXXRC=T5i$)3>LZH#{`!*upq7 zyyCtBC``iRLMnO15ItDqP%R&Ulan`9bj6>n_y?5_Z~L+}y&Y`lt2CI8e5SU!GIdE+ z_rIZ|#JV@1(RlB;m5m1S(WT5T;bGN2o`(7)pS{??B7fq-+Vev{JNFr_$x_TQA}b}} zSz$&)Tnpk=W~C;lp_fPNa*_zMRyz$|5OT6=s$$}IL$1wYZ?~js!}TE>P`L}&{A@V( ze8d|esZh;WwJlV1AdE2Utp+bg{8#wc#PO7i(1rH~tAkT|!2jyi%)0la7?P^XbpDSa zPazvt@dhGl_&u@QG%2yg7c}SDZr<^~YMn9-^!iJ&MSWR>-91`2mqdg;B+^h%AV?Od zw=n>3yTuI0JiGMtmT3H6mQV@0kT{n&yi*2ZXSRIu9=JwXu*)}w3-MzU=PjRV9@y`{ zgy*gsh)^3wH)&J6gJ78EUF=S~z+h7J=f=fgP`CN~IM4w}%W*3soFU(%;YK9np96s=i&Spfp- zUrxXKxUzI5`cO_SzbqMAW~VFUqqB~S+CRRvsMDm@kd@iXv-1c%bGh+A6OtCuavh`D zu&9oKoC0*)3%v)>HPnm)FaOz@JgRf^L#vyDVOm+uS6wJL|EI4+(Y}gRTu2Rq7=JfpK)w!AY<$09u;yAJXN$6+jp}$AbbbejlDhvoA{bL*0HVtl{PaA=bDuh1XLi%U7T@)p1 zL9;_9YoQ3|Kohw%qCyV|wf1p#8^z6=U2lk0_8;%Rb-zhBx@J3IGU9H5UCnb=Dp)z&5 zE^U+~s0m5XxbC;z;u#~wZHMCV^7vtY=@GrT zEbMap91hXmKzg70lq`>YIoe zA8fp&d0J2=!R1)3B=_aa(mz3=YJTj{m>+%0U(45$-WxgAC_qmMn6;uOv2H$(>_M-p z^myy`9C(t~=XW4=h%ygW&$@j!EpdtoA$r`goyLEY;$U9F0?n84HSd+iaKAwRndOt@ zg6DgZdJUv=EP3P7eE#=3x9BpgcGF9(Kkwswxq*5YKr7)D&i?F_d{philTzN8yU3tD zxXb)rD1DXvsdU2FFAu(`RqAl{mqqXg@qbrvq{xYGp9?KpmCN8K>#YGqUp_K5gbIrX zOo<6x&^&|*{vbQxE73(eD1n3m_}%o$nLFZqF3sGYPIg&c-n4`-{c!!fb5yM0%3m(< zN^<9hi2n`X!O~`U`bA)dyGp22o(o~&&rzlVIEB+xlN}A@EKGaENk<#8LW9;(TxUkT zZCCoZ+yVY+x^jf2umhnEL?rn`Eo|@w1Eo;s@6#>+=3K3Mji#@+4*LHc6GhDMhEbX) z%v6YJBIjXYqjk4W_;kki`Q@-*Vo90&Hc9HLBx{SYm;BE_lDY>xEGG{m%HXtL0-wZn z$kW;;IXB%%FaB1+v(Sq1Liiba2f3deMVP|#B78$W?C$w8jtjvCJ)bRM zx0+y~^$nc#XcN@`yp=dMrT`n{R-u}GQ^g6>mtjBW$*CURdEH=9l+^j3A@7WeS(`x< zPd{P82A$k$WXrq4UQPY*C_qN07=C#TIDFx-D{X@IXKW)sZ2NNGbli!gi~+++ ztorenfxpn$$cbLdGcv?X_GalFXEVQDR*Jea$w%Wt&WBNt!14>}uK*te9I4($ltrms z+=12K8`PRovC3Ryeyk_cQY*kWE;M_mLvh8lD!px|VSwmAd+uc+@czE-3ab~}y3BQ) z3d4bI_v=r~^F#Mf6yc<}bCji%lj!b7NvOj=EyLy(zfoQsWjj0Ns&U-zn3+nGY6pL5 zF`gxhB~gifw@q@vM&2%r%7-uK+g-^nX8B&^T09*k%SKN${sVE!Z}0E~=lPnjU=58rZQ zuy{?1`^8Yj?=tqE&Zs}{D?&uHOoj~)*^7(i`5#6Gq)a6Hv`b;saXkV%3N9UZ|J!*B zwT~cikcCVMbY+TMT-nX_z~7g8uap-SNA@2_t`>>Ds3CY*o^tKFP>O(kaLP$Yw--hZ ze|D}M_XaU2-fBH@{uunQe%O+^4=>CK??#7B$UjD+?6DCU&vd?DL>2ly^&S?cd1H6< zpnWoC>Eyk)Uft6|%70@NxTp}@*jc`%ylP{>t_}bnIXH??12?avd7Bq4I)5>AT$KN( z=Td9gi9ufeFSi4*2ybeL$;lVbuv|$F;)QKzJ>b3fcP|bY8fiOQhVOL;TPv?BXARHS zW+@uqJT0t(2f2q7PCA@H**b;FI+W(HJo^j_{=?1HFxn6EC`*0zMP_UAYTsnIPsnZj zAc>UK3NBSG-J$Q*ed6*T@O#*x;PZIPA1Sx)4D?4V@%?&D%9I=jP-_r(!%fkf8Co4vzF<@J+{&MIZRbKSR@>pS@yTllBkD>?J{)~epCQ!f)>gP5 z;waVr(k>_oKL^<6C~4&GInsYH$jAGCgY)H$zKPReL65(04;RkQGHhU(s{juc0GpVA zYrH;*FRXneryu14$kgM7JXd%7@Jt?)ed|#tN#~8Hu$R=NASio1hGR^)8 zaJDOs?9h%DGr&hCckI+y{{gg3E$)1V1>0wtjEV90dOh6dl*ckUv7Z=d_Tug94#&ny z9<2q|5c|*S6Tn?Tlqyk82xm;bFeVr_)+M~4WrF)jlT6#dVGS%>pay$V703^^yOVi> zy1>~E@bNFuM){+O`n}N#v2~)7@Hk7-kXNmjOaqJ+>UgE%42TVF$otI>a~Hlq57rutTqdAZt%>ya&XG7X9-9+VIr1kZ#n+irF7?{~{W1^kEODy;a%hK}{CcLd-)AyvJ<{ptR^6Z8t{4APPe!n za|iPdVR_R%Ny)8xWzsWH#oFW6=qW&_zIvF5j5>So_z!@Jtk;LN^Se|aQ)Zcz$@(3; ziGc=ZLvK}Xee|1k?hIV=$Q+n^OSremWAxDwbL`cQzxX`DT3;%#0J zyDUxExXh$hPN=UTks|B;=@&DwccbAHSEPO=R|c2+pGi;j>*Ews?}TpXs!DaJ{fNw6 z4XM(e(}d3WzdG>er=h$OcPc0?cEV{&?G<(qM=bIL0vF$VdbeOaY$CWwp~xvU zOKO_-{e)z0ppP$`wSdM#J}+veH9tC$A>STc9I`eVj6*en30o+rVq*Dudy!w?!jqOB z`Qz2eAcl}#b%r13pmttCf`;+@1#u`*k?1RhJMPr zVMSj*wS#~AT;9O%eY4s}1oi8>jEa&l&;F2ib16{|a^Z_G!O7*$I6+`rtRXAw$z`yo z?vtAg$~Xwj%B;W^0ccskjY%Cy!}qp0?g65O;iBZk#2u+X)xfkU`-rzcO-Hu+J@1tk z|B@;;nV)i_Rf0^J8}CcxS&SINT&6OqZl&5qi-a6eY+;Txoau(PK-*gku}Rp*4!w6b z6dnr~7~3#1+E0itVJm=9KP+Ln@CIY-Mmm`^tUv zh>WJ#fe(r>J~s$ta$>^-f=~)g6LPcOMae+3^60~fqH&WJ%tLB2 zuU)@jlW|1)b)DE49hfy~jg+gx?m~6qa7Zyirs#^o(y~_;@?J~0-dQxOCHDn$0o-h{ z;N3BaO$+rD(EZ8jk2ucT-^LfVi)s@j8cZFkxg41$#MgaGDa+9?t!bv)s=^K>s2A8C zT55P%;Argx$yy-8Zi@})p+O#$z}?=ktof-(B3c;ELinPxEJ|r79Em)kaRb~bn$zRrI_T)~H8QznFgzt_n`A2!QeDMPMW&35w zVWFFFk+Y^pP+|L)#@jyuy(;7FJ3uk%J zw=BY{)&043A~E!bPLgASs0bqcr+T8DH+xZtf^Tv0c)q6Y>xbAxd5>-)4@%+u&Qu}> zzeqFu^5GbyswE8RwSts@{DZdIrvMIvR z3=MtdL1g?q&WFrgDB>e~{pzhT3|Rf-pg(#&vbQwM_Dr9DE)BKq_~aksUJ$J|t-gs( z@KZR!#$KBHmL=OK*~B6S2!bmx{&yg+VH1aiKxuLBfTz?A`lq9$mAS=939G8-xdmjm z91Oc2b1Wb}nHlo~_us?F3X3b)U8HYY3Fc6Q^HU4Wl!FfeyWc?RWqHofN?;~MtwRyQ zw%F%KS0NN}i7U)G7tVr5sXOSSAs6r=$Rsl9rD>fz&9^7~e)x|`>5^JJs6JbF){rUh zv_~CKvFYIAzP#1&NBf3*RJ*`^;X$*3)^Kl!TY8 z^&|Mt-tMa&ug6+Xl1ymA>JDdg=@g&vZHN>}bNofMt~(M-=$N|kLKFH<>`=nI`aP#% z^4>{ame}od+;VG-!}6cyGGf#Nu|1=|w;lN4@71JS3u3=8Rp1`Y^pMH>e6qYSx{oAA zCU>e7?6NhIKP;#m?BqV+adQn$t}*jr4o&x4m5+Fk#5r~ZN|2qcvnYlu%)w=fAW1h`sKKK z_u`cCD%0rI(`tPo3?x|>O1P?;;?X9y31F?AS^IU0V*ggFk7hl*b@7VrDTR<9^6gix zCC(a$)m|;Or60!`Il?x{uU4cgW}2>k(@zRLXiiW+RDtyEj#k|KAT*h|K&?`OurS#c zUnTeamTN8HC4&`NZv8VHvOP6y3|%BpVkr(< zrhU#Zco!_>Kl-yuAd^5%iBc0U-?<&CSX8DUmmL>h(N#TsYf=4kb$*Ueq{Osv~;=6lfM;R)?stJa)D%+5v!I1erE zBUVjlxWCX2|9i%rSiQ#H5UbKv;h$gV`+U1!X=>JYwEyxu-a}CLjE)Sg)-$?MuWo8x zF}Y3&J(Z#~c`bMeZkHTo7~XjAakg6Uou7dRtBn+<{f%KT4WjT2YB64@96~#A*P&1J zyi$d|R7}F*d@-Wk{)5qbV^fL9aj5Gt@cFr?iir{VB4e`~9tP1uTCm-z8}vI~>x!}w zO#3^-pv{`xGdZbLos}INB+R?2lu%$}&ZeqBe80*HU~B)k1_qN~iQIy8WsS6L$VKUp zf5k2J>L|sUdvd)(fz8Ff{wed3G4}TJ7V*;k8nPXvC$T3bY*Rl9;629sIIQIr-N{A?D1hkV&+nXI1_D5fgs-Fwd=Lzu)~l zP~7|2Lc14}$q-n)zK8|W{=sl|C^x7@K3h+lb4-n7Q{T#m&(&7@(Hl?JIcbjDutA-W zul_WH&y4R34YRDD{k~c2|J~}X`1agO&eFiHSwvjO$qyZ#Gt8~BOr|cqpX!bB(!dU7 zywq7P5Z7Si6ZzT&d)sS9X+(>KfN7wqre_gkJBzgtFS{G=CV-%}P}sS;>`5HF%r6_C zJ|)QJ>D&yu7tl8Q6DCtLGoE18RFDf7Kb~$Qx@BcIj39dbP+bwy$B>XYQ!cJ62X*O+uvO%fHK02{TWX=URqu8zT{?jWRemX`>9md zn0sfc&pgEi`D*W1NusJ2l#xrTL-<|C=DjtUz!__4>9_ZJir#*lGhd&e5sUd=n_>GV zn?^WPJ=;c1Z09O2JZ32mZg^~)QZ+hMC1uS+^;~~fx}Nc^=1bhL(EPiVGiTGs!AHfC z9ww?+z54O^B%CRmETUg|V}4{i=?<0P^!;h``l4Na-%8N)uIdvaj;?f?Y6x;la6{Kr zBu?EWKpE1oGulXGzZ&FNe=gm)b&%PSO0h}ug52}tA#UZY&2Zs1XbAiD!RiD|o0;;f zx~v{J)9xEJGFxKd{^yIwru_OYFPp6Dj0C%qV#to8FL)xlrQbh4^xzSpW_ZrK{lRVH z7bc?2JO1dN{Pua3y^(ZT`?>R1JiOgO705HDnvfl{w9F@B9y+kzE_-F)!Vc9z9t}37 zo7R5i?1o>Fv+u&&Igjx3q+Ujg=^v5nu03nG03tzTwWn2am-t_-K7t|U4|^QhmQrf~dQ0lY0iUoKu*)9-M}EQLRr9)^60JNqk6{faxC z_wm$ogmOXGFmSyfpSb<;V9#TL__v7Xhu+5(oLv-wFW)0+w01Sx%AV_ZeT{U}3gBif zuI_P2DlOiWIuaf7lG--!oa21t6T|$Kx2VdiIxk#Y8C*pIHP?*iGi}bd%hq}Q%KjGX zO<(m$5(D|?_p-JZfXivj$3WvyACUmy>h|qRc0r94&bTkFjQt6ag0h92oc3YqO{< zr33M+Iurkt`>Q)1{?Wr_y?G+>T3cG^V#Q;y^zv9v>|T8}>yx|Vw$GEv4Ua44O(I?H zmnm;okA7bKsuIiCE-+m5X3C?6t&1{pkf-X;&hOV>O^)|oGgkd^5PltGbc>M`QRW-J zCsCW~RDJnu=BB}`oS0PuAUcWADbvXdLgf5~^i{;4Wf_o_Zlqp6>0f$T;iS76#sQ zd#dXR1YgDWA@E|1^iO6~>v?lKu-q<>Az?kOg!0aOsez_od-S&OU>nO|+Mn6#UaenG z-|zJ~y_IX$%xRES!?=oPAIsD%3w&w6xoGirpN3t5|Myf-VT_#Ct7O*R=c~2@nM4ea6e`9Gv6f}8gG4@Sg4TI=UtUU3NLFlGsnw*=g(SWqB7Rf z3{&&$-+uSP$xQeV8!HSPYiiY%Z&f@DOHEh_Vum1*X6(jG zNR!f4kIdG*SrhRT(>lqIIn4U4q;V|FOk`qHnbEJk#SPH>Qc~#K(8Qx7Gkr(Luw0KNkMGtr@v-;-fG<)?_SX84CO?e#D&?% z`4~x1I&5dVE&GKHs9459pX#FhAy6`@c?OHiSjtPuI*5sOp8 z%LlhRwxI?mKkU`P!$=(>4$^pGRm${rfgGr|{k^EWYl z>5i$|9EEN6y_;Ql^%a*b7XIo!pM!r5x?`IXnvAw%%9}yvnD{l9#tPG|3-ojiF zlOMlXdz$6Fr11Cc9)(1X=|A$?A1AgPcS;cjKAe!>t@ujcyqJ8`<PI|R%wLLA~t<)S?eqrzi=fM|u-P##Lo%}L^g(Y@BnKtq>TS`CP|82O-*4p96i_p91xP45O*LZ56bnwDAa!hDn{Tt4T8B29_ zA|3MfHwGY&N-mK=d38CwiSqrg3q8wK23>uRAH!}ro;(x1+K-_bcB7;B8#O%JO(G}_ zZOhvbaXatb>@&B|OFqN*|C~){J58oEE!-&uzKTjuV>*)kqNeF3;^OO{2(I7dt*BXb z*OLu-B4k25gdeQ{QF?)b^7U82R9# z0Qc#SpqQmM0G1pg7cDVe#nQ?SkqN|f$6QL zn&KvXUz*b$$a5ub7T|rgZp%e2a339OCSyq69tc=VVY~to|Agb#L@P=u{uC116wkuj zwHm(g#rblA8-lhN;`6-Jc-d3iU9aJ!q=T= z&tm!!5aoXfCy#38U6#s5bTp3V~qQk@$Hv?B84NDT+8moKM#IXBZG40wLf*0egDvpPClG zYqiR`*IV}^xV*4AlE6TeX)73;y^@s>jO5L|m8*tm}p!kZ~WE-qodg1W~3 z0ey_3CJ+9TGlGk40t*6gEy+SY$r`kR`_5t{R0mp?1*TyG&^{~d zfoD;#VCRLt3)O{|5tN}}+gT_kR|dcwWXGS%i>J9sCIF6q#l!TINI?r=n7526GWqU0 znid$;+XH{~(+x_XydMg7(R7Rfp`;Ejod03_;r)aPV#Tu5BlP@D8IVRm_CaJggsW-; zs}?h~$CJO7%s&JUh-?OKG^bvVb~IO|H)1Tdk4Bbqpwvlx%RGY}$Ah6*T+OA5yiE)Z z`wmROVS%@BQ!mL=XWv@#!SO19AR<~{KZ(r~M-`cUd*s7PoKMLCDnPv`K+Qn@*$Yi` zO&m193d+E7aCyJ(E}gMxM8y!NGFQ=vS02Y_C^?!V!IQ@+g7;PGV@kqDZr;LfOZ!nb=&p&+0!Ua$dQLKuSXs|v= z#Kpiagu5dfr|$u#oKVvtDR0UZ5hW*z;G%k5;s z#zkDGP+`MN`f=V|P zdE?UnIL=w?4drw=4we<79el$3rlNa@&>P3d0=qEwU=_;U>7^m+0mB`%| z2XimW1Q%p-#loX^KyL->Ck))qf8EBTtHc#pUTnF2q;(iO32;t~bNu=pJDDtbW=*jT zk_?Ks42A*Vw#3j$FhmuoT`dVSq-H~nw&ic_gqk40O&2wyoeB;Tjg*1DLrhF!k)M22WS!jes2lLHl@@{=fOe1e-^ht{*fgaJ_O5{M)l+y|07~i| z{?zh|Xk{AAmLkX<3IyHw0UcK`1e_-*(&Nc8TmC3GORgRAAX|y- z-Oo?jgj4+~J^iqS%5*~+I|gYk7G3a0A`r!K zcEbLJXl=e4%I7T4?@4Yle!H#iS^Vk4QviSOXz7Y{J}h6z_?EU^m6ApkkU{603-DlK zgN$$M8(dpg`R2xBBOstf%EP23AnSwdDW@G)c#G18rjfP=1QLA_uZnUlRM_HWas{Wk z-)277wl%NL#P`$SCIQoJu$*i4YZ}F&mz-@|+xN<>y|u?A0d;lDvy11{IdPJz&|$HB z9AfjNN5T+VOUu39z(ZWj><7Xu0`tuPvdSm$S3 zRIWMGn8!4ywn8$@$L~kgfoK-lq3SBEIe>?`O;B{-f@G9!rZeo4D_>a-HIzU!ESMP| z%pHg2({!N?VYymu9}fUfQ(Kw>b_&bj$XX|j%7Z)WebAv5pc>R`wEwL5us|$WGn%{B z=G%6>J)Yb{Dd0gwl%a8EI5vHah=#RvO$*lMx$GY0g{V#&&O^YwP1BQ`>}6WTOb1~n z^lG}U!&M*bpUGyh0J_M_*WI%fvIp`qRb$b7?o|$^$7vCj{VAzzV8mLaM84< zd54h!w9g4%;1@3fSUjK6#9gj9&SK8qVujFN*#6(FPrqBN{WX6FZ_jA{RxPan^m?~3 zm^U48b=@^BykyUtEjK^A8qj(>%EX-i+*5Y>orRu-bM-$5_9m|Tjo-+qgGWQ+_)zO7 z&1a~*U3cc{oZE^OCsQ_;TP&ARiPZ|(1VU;eormF@@NxXJ9KV9oWv&IlnSj*E;t33U zM&*tIDjrxd3c!pdKcZylPILe+UB0PhW4wDapz+}NyjZit6r~anT?_k<`EB1cnu&ng zGdH-^obPv__7_Fp_Yua@cva=b@5V=y=iQqxvo$=cQ@?Wp$d(|{AM>h-RV}ES9WI9o z8Ekx0EKmb2A=yD!g+OB_LZprE=zf0h=M!0!)F2;MXkF-v(fD#j?lMBN^AVb^WHY-B z&P?lSJ=;-}*kJ;DF)*q@Z;X<xXW1kqm>_EF!JtE}hU0=x0!%5jF)Yy2lJn<~k)*L6 zofLm!=dC;jHbD9l>p^B7@x#U6>jY!<7iw2+qnIG~A$Z^EU9LZb1dVFiK*PmNZ{g{J zQ)KME9FUJA;@umhu__!Sdt{)UHfUUycIZm96?Dvt1zM`)sm2M=Z#69cL$EBbD%n%^>E~;3>6#5l+s|ok@`aBfT(Olw zSzbCR9FTYAxsWnqLvO3_=qvw<@!E4*5}XiFuoTs$>qye!gSRKT2VGfd7LrY8;4@6n z8DG!0T#iS$7ayr?Uc3qI!juDb1AD+8BlwxZR~aY6TZwPlo3#Q#rY1cl_JthBm0kxn zKYsX9IS}(a_az-*ZEKz&N*VjNvK~x_^>4i-Wwv8n_^Iy)`N(kkYUoxHU-3XR5GKo7oe``Ok z6@F&@mSxSPmxyBcMsS``(~o`^;@voFrVcTO4^@roKqXV`)Zses_QIXFi)BNZd`A-N zZdjn(PCu0nN^VaqGJ4{EX0mCGCIL~s{}Z$RGFy1RKLdr!ZKWnMsMJm{Ez9mV9f%4_ z7_&ayXt(eB2oF+{u`-Y!N%_f!5cI0>5@x;6^ZSxm9Go&}kgWl&mOlM(Blu3zs8iDD zT%ot%#*amWSh@S%HKl`aOi)3qQK~_QMqAVZtAfABtflTJe5bh^!L>R~I@T`9%k0H! z$QrRqk9+z1vLIQ8Ju&)&rsf&vWg+$-o2PGwb}O@RFhF%`>P<`^r#4#$Y(&1ae&)A! z=5`K1f@Fm=HvCdIGK-wY`{+#WPjJj|!@DdGVunNrK$fiWZK0hk-b7+hmsFiVLn|X5 z?l@5J{0j1Dz3bF@yl9kTtC4HJ@RkAP=VW$JLO}(Ga98BQTJ7X``CUt?w3EKU6bcoP zY@9m~XZmgt^udB_6yg?At(090?tCZkBS^Nmn6LIk=WEfhao3ckPRgN+4(>R$OdHUz zSwH;AF51j%XD)$wt2P}385~wRk19yKfw9=~CInfeDi&+z~!Ouq{(+Ht#e*Uo)nEsjy48dPd*Nu3+fgM zpEJC(mr7B|3<8lNjc}Cu(;7TLrnAyR*-FDYZK}~g#zRB>Au=YF1?IaLAU@y2I^D4O z^%+7CUG$6qr@U^J^MNA{h)~Jb?u)hZq@EhUgu<=NDM6)vh4yHmH67J69cwubC}@dK zj8Q0Pq}}iy2FSG(7<#erVLf`VD{ z28)3@u;VSj-}bPFu!Fiy=!i*xsVi*IZfp@3B)V54R!t^1f(4o;n$p=(YPG)!1qB0f zT*=IumKOk>fZl|i47eRE*y(8jf1W1S`)Y<8uRnP?bOUr*nK2dp>#1EsqY^1-iPmv8 zprqNJ{03-AqN1QHJH-POoMSgctK=g!7z+XgDWzxQ==h`@8pE(a!6p{=`{Z;tF+e`_ z+L>L&E>K$xQ2SF4VeK%+EnRQaALz`$J)J*qCaPZF1%cYL!w+2QT?s)o_{erQg;SY^ zV+WvDrejwh&Ia7sbwsgWHj{Cw@?^m{6Lte+I`w&Vdb~Ib4^*R~(*BxZ_s2s}a7W3Y zINd_L^X@i~agR#T>nWpF*I-blV5}JMiY@QqM@B2s<}*d@1SDv48n+f*`8xISEd911 zs9ROu!;o=REN@3z`8z&{udY?Pl4y&v$eT190|V5r&;rfGao6PRiv=!i2cIun>%;&% z0zcI{1~bR!+h+Qp9M%{h%PPd9a<$6hQW;Px~|5kk1wr zN~9z}-G%$sUL>3Ci(FC>1D1{;5TQJI;|sx1f-Ekl$I%}!K}$?9 z7$Cal)@k-3_gt}|$q` z)TD)$V|3>|)`uWaC%HtfD_c8NKX)r_zeg|&KL-mjOJ*5qu%wT;kCUqtKm_dL9V&eP|@ZZ7=P;nv;6V$-W8vb&>tp81%g@8d>*R!z3k~hz`Pk}z*!Vv}d%%2Mt#}_> zdANAFTUY_$EdLqrz|8QA}GYquOuiZ%*UrBDyl4^B*rfwCkFY~R?XSN)6Chz z3Plvv*6x4W3jTk#6<2V#GV^qChq<^o{xcOdM@KKfyiwI)1#Mw4C)CWs&e_w&!FFDGY@Yowa)R+e@aC_CVXNK5l7+c|n#x$`PJnt57X zWBljS1o$8jf&cMpKC?d;9Gq!CHezckFUdM~Thx8Kb89U9_O#%rRySS5xB405c;mK7 z`Jk0ITm7((HkqBBE@^3LZxA%#Y|pEL=zMF~r32W-0}5Y!2RkU5iie)}P+e^Xcq0VL zSVAtQhAMT^lmqEEadb_$KI?k7SI?fG6Q==c#|PM5QVSu({cpPO-i95gfo!?92*8NuCdCxk$6(Q={M@y#o9z80kNr$ zn5jPY*tv~o_m{9Z01`2g<)xsMi+U#pwkQ&?=$A<{v;)9uzXtl9-cUiRg_~!m7?exON-h_p5!|*!B^xpDu&HNTsQxk(92bYmK>V%M6}48_WZS+4OREz=6FHD{$Z zq9*T6IQ}T$A4oJ-_P0+%@0eZxQ2v#vCJ`(9#iyYcUm$XE*PT?sE@z`!=dpBo3jWKm zE+7-tj95)TWx`*~8h{Ac@5E~SHvZM%tBpiG@+KrRP+qy_xLbk5bNO{PW?vfFU+S(O zW7xs$zr{4|oNC+AQh}OEVx+qK${$`}u9K(OG6GxZO> z=-i6`tDI?HBJl-Z4t`=w?lE8w2?ayr*_x<#;|3*L-!*YQK|FDKpwSY3^4~_Qta2q> zGh%!r=4{te1<&{piEl>^zxbxhjSr;o2FgRFkVp8BIZfBeAF`k;x>+UrvRhd-WZ^{v z3JYjq@&+2pXs#8uEzTogMu9v=~@70|k6f!>xpGhJ^2v{94`)x(YDa zY;()C?y#6QfB6ykP4?_FaSo=g3>v`H(|%;;fghGW_Os|~xxqIf>yFIQIHFZAQx(xL zRM}YBDV9ngy(wj2nT;yn_sE{TVQ0*bLB{tBn{U*q`jrBQHb8l`UL7A#RN3v`quNNz zY#=m|VOe@@6D6$c_t`WpTc|@61Tp>&<-Nq*`pB9Db$7X>n@PYXD^Ol1=I#fJCScyl z^$k-4j_-i7p*GT@@>7IEEay}B$u*S6>s*g)AD6q#Qi6nn*ZnsQKs`uLdjlG#>!rJH z$fGuLLeyfcyDUx$6f`a$)sUgCLeEdQYXjN?+UTk!E)vg6rqnNTG&ZZ|tH90^P|DRt z61xdBjv`tdnXlPbQXR43aHmbKA=satxb~&dNx8%7AB5>fX{=i_u9<+b$>k(#I)Rsk z2K?$7(5P$`LZn&bW{DMT^|9__&|Ld48lb6?BSlvCZ3m3WYi8F~L!|F$8R*LkR1oQ- z4yn*i_Vj+Q#SOd~6M!1I&etK12DqHkX_gs$q2WL=-> ze=AO6Yc}|}Ip!6$-ym`@& zkn$zhPrLsBT?H6lppQ8s)e>g5c%4hTI&II~bg)PxuneHY9 zPdRV`3Y3TPA=0c|FxtnQH6aF_=ql5@BnQ87bL^8OUla{IzU~3Q42YChVJY2s75@fB zdInY?Yksj`*h5pd`p#=@lN|6zrfnv2zX%^fB?boyo$3eB$iT9WMubVBspr^7X(W6AH^E&fBE1Jq1xM z;Db9gFCe7&s6AH@s3I3z>Xw$~olR{s#7WhipVH`B%~YBLVl1k;Ph;IA(QLr^4p4+& z=N@yM&8Ysu)K{-8x&{j?X@17OH>0|ONvDU2A98W+sZfxtRnzi@*ha?GLLtVeJzEe+ zcc1Lo8H>DJtsmr20lC(_y=Lg*OIsVrC}E9jWsT8v9vX7VfaHKMjC8C2eK7e}gmR4r zTD9HoZnl6ZL2`wCy^g%qt*^muPs8I zF@QjZk3$zD2UZOPXmiJA&3$X1Ut{DZIiTnz(nxf!C-ZggH0?VjXMrE z26bui<2r!D9iR-Uj%<;L-RBs@XswW>c^7wW6)GeL(P0E%@M?qOw&L0PJFjbTNDd5p zZ{vTe3I;nQD%Z53sRd(o+`92zp7|blBHB``?jyRAPYln`H$R+>RY!Ijsm3yWJy)iu zVs-H4^^joP?WVEny5=hQ^7PN2ky}NPqztdsZ|HiJUr&f(Mc5rwa$gieD7q0=yVs!o ztm{^h#0(^gH$tn7Q+Xx8XaV*Uaw)-*%^H_jtok2?LITmFE0|h!q=|%fp2HghID)vg zF{*H^K++fQ0x>wiGjMBzdJeRz6Ed-~@2)(QT|R`e%rh&ZZQIn7 zJuxV=%9*IiyT+K}rCV0k&(AQU5On(y6a2A_pP<$?-W9ccRJp?rWch6DrY>p z9>&TXa?j&bm+symF(v4YLmQ4P2FU>jE@l-8{SBYk@IbV04W?sVSC6{EqxK3kq^lHb zdW?2OrnV#pN?4#YEG5vSvOgzU>QAa81`3K;rr}19BGG=co0D}tzGe5hvMAOs*X*~j z*@tKbsS>d+Zah05?hgaqPe->*NWr>b_@wki+9>J|5@f&mRT_Ny-MYp zeRMT(0@eki^D-l@7pS7?$OMhAm`!fYWSI_B?(8pry*67;$h{iuILij(bk723z(5&K z%8ePmV(+<8gE1F_mS72(N#iq~KX3Z^tcNx?X;&tQ;p*aI+iP#KhH)ky-6&F);PhuN zxh!SL?~@-_c91to)z{rPvM_ zU-n=kAWk5@sFBv_RGce7lV0!lAF%<}8a0|K?AKP6n?_A~@M-r;%BRrP7<=<@D5EcM{2eolb;y!+EZIwT*%^^Ndr{V+NF~eI$=H{& zgpe#FN?I&YL^NehmO)5%Sw^;$UFrMIJ3gQ1^E|)b_j$grzveFIo_p@O=bn3(OGXRX z_K0y@-fJJ)u=qO{Sh4G>7}MHLVk||u!h~9jfcWA%G(L}qcnLu4E=aqk(`y=rVm!-T zf9|g#g`Y6IyKEcR*4~2HMuM{?hq8b^R>UVZ5Fmk=S!6%GLfOa7I1udjE+Y zh!-(|6VV09JA8)v-1UP8nTI$&>lY*WOVos>hK9y9`I5^sh8>p3q@f*bW?@^e3;A_V5=&_rKfH0_>=O_F2 zbYd^;D;-4@!^har?ZpK4w=Q6eJBiTJ;G}<%X#j|oGEy}5Q@_}^Ex|sO>dP?{GO^zm z(J5S6eGAT^H+pR4kRzPp5RPFeKw*vj5Rycz^%zW0NQfe{UdV<;l>=zO=g*ma+q0md zfX%!4AXCC{s^*k~`pcB$YBQ)hhV31EFV(LM{IAF?TTKVsRz^b;!QAu&57<8d zLF-kTJcZ@oa4G2oM(_byzpqesquu2WhzP&}MQ2F@&mv;W0^knvmr|7G+BClH4_x;pDo(~5zU6e6R3T9A%-@52Y=x5!P5`-g6jWGKTfflEn z`p>MQ`BQfITo#V3Zsndnq?X2&97K4!`qYe{AsL>$%d!g8Up7mQ6-(_#uyb2ryp+x| zE(vXK+?+Ro) z!cccf=k0E9z2_`L+v1%3nRA6)4*sB5-au_M*c)ja`?xR|^TAwg`<(KmM$JBXsD>|y zIV8fD!3F#$=L6E5rRvU~A(omdBGT<`2;-r;GYn{ z#@tc}gueraw2pa%fqfXt8~Z}t7UxwAh^Ek@*{E^c*Iv3iPfXA&0y4)j$x)PHSf21DvT|GX0KBUKIq4V$Do8HNuRnwGv z%Q1|=l*_ygO%_!K4?Yt^S07(Sg&o#X&mKZ%Yw5*L^_vq!-{bAI0bKM0YwnzbbK2E( zC~tkH5a9qp+NVL>d!&~~7Me+%7oDuW6(`D~ls+bH$pymzWVK-OcbB-u!u?_8_DH%j zMnu0g^HW@cDzQ^zldWTCsNyFqc?Lf40^YKIvT(omXNw=qV=fD^VjmvG$iS-os7bIn zRNwug@A!ueAI^IF%}(=|a^7Y8-l8IB#>mQ}Sf?75xVFdeJF25=QlVhRtLwuTv52&W zem{WoQT1j*vnrsHGi?)>nEC)E<*dDs_j$j=F&&4dqCIgV?Dme!@jm#fM<7v%Y^#JDw8D>@t%`z%PclmDy`h7~e4$Lol8H9k;5I!BKexI8Lgk1N08*d#d zP_hfCD_gbEfUoYla#`Z^-u1Ib%_AL{sN!FX}#HBAN^JMP!+kp3}<}ya>f~@Z? zVaVzRZn}_5=e=_*Qrtr7XtIj~C)YBIG8S`C&)ZWu;6PqCt-LQ^muav=EbMBa#EBFXfOv*NF$DSR@{`ispf-ct9 zVGm`@Wa!EY>N5CG-6J_hJQ14?@fziAOK74^$x7 z8YP2+s)e3qL~I;vh494QJ_yYlPGWP2?t3LtTIk(!u=jiP3SD{f^fb#RwF9^UgtD$o zrI>7?=mMN;=^9NBbpA1*E=6L@`P>lSzSX&3&g*6*2UQaBq>H4pmHu!h^IvE zwRoIF+70t!;eQ*wQWzjm9xq9cytojMv$J3rIR4%1(*TL6Z zT+cCI>7;d>&CLKucGF|R8cPp5gkRqH^-^Sl>nrTLun5bRPrmB@?6L3QgNd*$sqkG>Y+BCSb*?ZLzP6 zdUL;|q3QH6PL2@=hRC^`q|ukL@Q%s`=f|XVy$NOEg6tj(CWfSKtWOtDJuX>)$xyA` zaPUK$>Aj{T2A6lMG+v_;kC*7=Qnjp4eA?1f!_&T=G9k!uOk*}4>INiY-K^5R%j4A}w*O*GRqJK)U>dC}yugi1E{4|yWD6n% z{lY4!3y(45oWNs!O*_TjrVG8~)jp|2>p9OGhS0^ z%^E}6MZwLeXzuGgjqvw*Wma3sE8dpqb2;y8gMWRGQZZ8^ok0T1pMz$8C)|^GvRIb& zKFJ2{nEbCiUbX)6M$Rx-54?PxPmA|oXZZ>!L%TkJe~$&`Z$EVI-sE(#*Zw-ZuUL=p zkO@kV{+?Q9TiTUY9KnB&ityf25MHi?1uM(=?cEax;4u<(5D1 zNxWGoo3np~)X*=v`Kxg2XY}As&h4cBwOj@~~oEG#ILXq-duJ>07Q^qJP-sEt}5gc7B?eyZp5cOHB*(Tt!_y z!lTel>$91CKu?wJ;&RMg^ZU)oq3!!xF*iA$9-n9EbImH+zfE}Q^p*N^ALr3xcu$7L zjakI7u-7mZF8V^sQU1T+;h8mm{(a&aYgbsjdv<5owKeMjkde}?KV*Ul2`h2Wl3}S&~}F%=iNU4{=%(S57#WNS>`X?k@qA< zMshIrnNVkaj!402=X&(|D{Hun`Mq6QsnmSLPX#>Dq+xkxkk=`@bT)vnyn1Ci@QM@m z4Vp7yEZeRO>vVwZlLKsr9D20&hLN-g+^nR)e4k;*QnU2W)@ zPVEa_nv=R4uhySc9&Pwh7v_^zB*Ve=cvwmaJb9iBd()%;+Vt9GjGyD`s(h%Ox454b z!JRB>GXG_>-{tPfh}hr{awGGxq{mJhTD^PMx?$Nb7%Escz7RQs$}aGk&?-KHa%iG>&I!hF(Z8v1O^}#vXfmp z8|dLTNSkB3A$dF-Paak+AAb;!J|4Ps`I1?fxUqA-;;k136}5VHVL((NtB-%}UJ@9^ z(&c@;c=^*nW_ws52hAxgU5J0wiN=Wg-i^;nkNtdZxtHa;a;(=MDP9`sC0&Ql_1y48 zTxSQm#O8ZQAUn@f5npr7tIKv$Y0dD-WZ=c^$BkFoU-=C&F@L(gZ6^7v%kKmx*Yc9_ z>Cn~w{>F;&CKzt&;cI>Gfc`&Nq!RNV=KYZiJa**p(-liC{&!!TU+116q){s1f7E-GhU>8Vb9Uds=IwObXw zSnrEel~yp^OK!*1+XnC9QdLSi=3Dvd&lTQw^F9CE7x~Oas1A!XVFCcNhvlt?L;K|) zUD7!Yd|y4+sW5bCXL*t|I7gbQLAX4o0v^hPr-Y0Bd)=s2J{sHEltE_IdI_||=i2n& zO2y4W`cxp_@W4vtt()oiT!9?#+_ij;XCV=x`CD@Xvwo^M2Fyjwg_9z4(}J+P?=Vnr zf&+rjZ#g#=6sQj3ZM73joDHQ6%IZU~hHw8-l{mZzOXLQ_xE4&6>1A07im8~Wi74-s zGRE985bqTcdoWfukA*rKM(P;n&+&72F2vg_6&!oudKG@v;K81jXZT0{SgA$B&~AG)dtY*-MFtr zda#PBUE_*+eVTcZ4T?WTUGn9dwxiY*{{|O0yH#KEeRB0R$>RLOWB!|@#7{kv{ue}JV_UMB zz4Ac=MRLX)eLyfpiLO3WpPH_(=vnpdIavYC0|{%Dfv6YIJzfws=}ME)c&AZ%(MoM1L6%X3SZPt^K zmMA0O{BZ#A@M{~Q1?AD{2g*9B?@pZ1kFS)z^QHUz)Ny8C=$g&d_t`q)+i+NJa75_2 zAN1>qz3q;!N>spiUvP0i*8y9p$l@8Kp4fL7fgfboI%y!fgmtn9fiscG6;u&Y!})V~ z5SXA#xQn=sK$LhroZZ1v>2%n&C{yQI@(_lEv-~+XJKt+;miqnq7Cn)jy$2x;02ine zeFpKVdU9%nwsSVZK-&C8@bZ{f4#U&X?FE4j!lk3;$y0l8HG6l+*U+yW$|rGcphz5e zQT<2|xGn~Pu^8${I8vX(fc~(f+X;eVDaf-y3o5f z&>>!Sk;@s@av>M>M#jR*4+4tEH;NgWr=Sqd_>`;{HphOC`~el`>|GCqenlz(R}ESN zm*3eMJf8K1&iLCtrYHP6i@>X_nL_ z`|-{nz5$AjLy(D1ZM&n7JA8xc8aPSy5BpcNBB?Jh$XV{Aee5P9er9C0DBRF{!E4Dz;ptK)PWp}JSdW_QBG^z(o3eix%2(@uhl3Ag? z*qMj7H-Da9ycBN6+u{Hm-P@XbE({rnF?Pdj*i^$SLaKWjhrS755j3?>cl1?nNkSk1 z)44Nj7MXq~v!zFBn3;kORH5o~k6-Ep#y4_ql5_+4C>^>?nbgibb>)9v zialS}_Jx+fI@uI9NSTS8W0_8%ZMM~y;`TL)9T22DliFaJZ_0@9w<4=iPsG#iI~3%f zin~XxPK207jS4p6Db_$>>RF>0UM@9YZS>dJD=$;0H$N8sT@K<6C66q%zVg|Y!w1k4 z)+tSOeI$1M#>lt45v@Nd+B(8;FNy!MwjLXN%+zh)|M`swGT9&#Mt12C zSZ@E_efa_f^ngC{Bl%C>f9yEs>!U@2ti@g!zrvG@k)&(NTa^rk+QG_n+-*DuDo(Y|B5H~^ z?&**Z1j0S!TR2PS!HsO5zuQ%xd#-&`bYu)R4%0gC&fN%g!(cp#pXQ~qO!A)53%Zl$ zHX5&Tktb7W9f!h*uwv6qxSukhGyF-jnjRYD3hV|bUlFOL)VL@SQr8s{#*rALA68H% zz;p|&#eI_0MGDf=saZELu3V0L^|4i`J~27mGw=5c#N@re>(H2jxi;WoK)eyC)V!2F zY|M7+Na4cj1!1y#*yUo=brc5SNt~|Qzc;akv30A<+X;)4J|ztG#5o=S_qA_6~_o zxH4aBF)3MXHl=uWdzw7{BRXE2&}d#Dd1VEI;Y+$3_!xX5w^6q@Y9UH=@g_OR6Tq#a zj>KKY0^fdu_j&sD-Bl4^vy9@&<1bRVADeWOfqeX>7YKXEoW;hvb?VRhG7oPD27`k@?i12>$~*bP6AF_G8e7lnr3csW|8^8bTw!DPCrZn zq|t_u)+9+$LwX{oRQu2GN%erNyLm>^n~vnvD3*526_We#aC>hB8|>@pC=^yuE8?rx ziQ{jgYkyR~hj{#jH_tzl0hpam6skr{OTcWBVqE9ptzrC|u878QY`NRhV$MZ<{S@lV ztp<(_I6CMH$@>H4R?(;$VJ(4ddF(Nh-;F_FjrZH}bW=3$xd;iv@Nsy0@3~b~9R=LS z^fGv51|H6o&^xSjv8Ln#1d3pzv3U~=?#i)>LyQMd-}~h7mXDR@7-o8WmQS2hCu^vsio=4HsY0=E;4$=(3mPG(U>u?^bAffb7f*R1O( z%}Qy6K4j=+$zo}weV|5m31Wh0e)HuADGfTMr&MqO?f>*Ldupq2`)!TeZ9dI(E=>eZpyF@Goy_M`33YdOy?ibI7E&-H9P(H=9DCWW-n& zP5g7sW9N}}XTizhb~LWn9;JKsIgaG6Yes32!xBzwJP13_tEE#rqZN`fYQQ6ay^(geY`Z+W3y6P_iW;-gQx}a zdUad&ig0p)rp3cyC{(gDht$tnNw2j*-ZsCg(v2cE~avr6{a} z?4eU>NN{-I7-q=jN`{${QCywEhxWikq5i~sWF#NG%|S3ElVmEb_)dRt79aYR*@|GH z9$0Pibj0M9Z8QVq;|ofX$mf_PVMM{{3e1?&gV(H0GcuC^1)|0a7fxgGb$?0rWzsRn z5D(CzCotOkgZ!wM%>ssFkRtHH``teofw`h)!F${~QHgvpJXlQF#6a7u%I(SEM^H?b z{ZnIiA!dJM(hW6rIyJ$!C0i;-AiregxSTQPQ@?l?^jEJ6I+v^RpPS}`vAgN*Zv|*d z+TW6quWY%NAgwr;8DHOwA2@}gQ|mGbGc$?z2>W!s4|2*Xutmd8I9z>vlufH0$AY#q zh(cws76vN2o4qUHa)i9G1by3L>#DsQF(d*Q-I;T5=Uu}Cw#yW^qoc&R!Za3iTuy1< z8!-OT)F71_7>7A7(Q!9yZ8tj!owLv@kA)AR38{r~lJctz4i}$dWpZ_SW6MrG0 zS6Jd9qIA)kf=zKoS?cKol#iI}*IqH5cuBB24W@k~PaS@aG7~$E1GI|;E4ITt%$@6u1bnqa z*zCXIrdk^9a}UENY$eYjAb7)F%s>W|adr;62W7ne{X zq_lWLC0hS}s7k(6HKVi%ZgRKbydhDDZatUJOEX+C+uwvlAQl~1)H zn0W=N1+M}2v`lQB8-nyoB-vB{9Sm3OW72=Ws5$9^0*T5WjKQT5(_#iA5y$|&2ZhRh zWnm2^m%ePV2jb3xK4|i{UG^i+ttot0%_FSIO%*&pi>+|{A8OWj7k>U8B+DVdS?Zk&Z^MxB*KP3pE|kj#TFQ-Evbaa^uMgN*@~u9W7LO*ASl$rCC8A6`Km#KS~~CB zB8HHe$Fx#G9|O6Yh2AWSBh?v{{IBufw^Bg!{7=OCZr`?m_G{>ZQ+dyLBbek7a#Ftc zKwPFt3tnu2o5&|{k-OqmE^x4T1_$?f%Oci;0}qEXjvL_S0JEVr;}yIKpUEO z%K|#Fm&sOtHe8xqu`8jA3^~azGbD(EuTySc1ePCH#=!7_s;8utGl!$FIIrw^oBPCL zS{51;$PYV^)zM!pSJqf!M$XeHkqFBz3pf)Uuz3E9CMVXC5kqj)Wm3~C0vZ_(!D75m zzQ=;P<2JygFRrzA$Zr74NQL%$UhQf<&@Ef0^Zhr@`OVM2%;W*^tf_nPpKNi`cW~Qy z-3Y3VEt^7Jo&sHnJf#|b09De@*~DxW0qXe@pi%BWV=6WljNCS2Qri&G zx&;Qtkih~h#x&Q~e}*0-(BCZe$1t5N z!-rkoSPxdmAkZDUOp4H;Eg}t9*ky8oZx;Fv_Cx=L>@lxR7ZO!*TO>&IxFns8obSBJcL``bRg;G3$Yl+RjjDM9tedg(4s)f>f11WBFZuMC|ErR|;CS|zs}BeS zJe9jdt@GM9D7*-`a+nes!iG44o`r?2jziW;0Jka4hSmN=2dC2!m-`QvjLv*iIeKAQ zx*5w3>jc*(Wr!jKk=sZ#NJ3QR^m9s#Hy9v%iC&20-864oE$8reXzyx-hk?pN+-uOZfDqC_q6Re7 zw`U-GQg<)|Jr1`jMpC+6GO+rY%9n_~TR`DjmNagxi_*w$Jg3Z*ztTj~^Yyq#Jmjj2 z>xRhsd-!JiS$qX6D6zd~RN3(lVI&uTB^iO;#l0CX_lkyk_SO<5K8AP_X7%^^M z1TXFYb6Iik0yhfCu}K^2twOkP(-AKbbz9Y+TD>n|XgVOD8(7{1uJ0tN%ii1Jn`*Jm zhF$)pfdUAdTtHq1zL~!*p%y$QDjj2#88u!*GrlN7;*a}y8C({Q!pYhHFiJ;(2uVws zemDl73T9VSy`w{t3|(4xx50rc?^e{oo4GWRb?x?vz&#`V4|~+)QNg~ob2hdIkOgVx7FT4v6Uy~1Mx@W;Xb{hV!VnX?3*kd@c9oUeo)W=yAh?6eD^9(T+ zpL$?8v3CRT^LgY*Wui_oH&(e`HmlDMm;5d@X9@GxBc|X*c%?6lIB3ZM6o$2;-^k-` zgGn28XQ{9vU>5+)DS=nWg`hCOudIOZul!(!Z#{#@b?d0rfnpcnFPQoQV6GJqBb69% z6DUAn{3`J#q4MD}pNqh)WA$EonjVrDMW-$^W0c{~;f5`?W7BWv;UxXuDsPpTKdeAQ zYW0+JLN$PIE@lOWMsx9@pJ_tC43SE!r`OGDm!6WXiMY6L-T2Uh*5}`P`gk;L4FTLJ zQXJjxoUd{KkbXaf;dz~Xkka5x1C5J!l2WY@CqX_MyEDBEe``pbz8B}${K^mTUP`Hc zUm)NkIDQXwQ~!w%dvpO+}FbXoBy28>E73=G}ogs!&KN)`%=L8yDWTzGLFY>0jP|2 zS4NvvRo^|gCU}Aa$qm>8J@Q0{$%?wA4h@S?z%d}@F@hmzji@AIR-W}p*26#Oeo`|7 zE*WRMFzm>sxDZGzI#RrVvln}n5LWukVpE|0W%%4Q;W!8K)bMM1%%_8^g)i$rt5;)8 zWyDFVED{y7UtTQp0b{ejr()D-C0OIXOwOfIP3bc>Xb?(=6i7UZV6qHs=yzMu9V6EK zmYoGlld4&?X+*vijIdcc{z3W{2XJCHN&QdBSD=2G&wEYJNpjV;8{?r~b8$cG-Q$H@ zHDj!fkAbgZ-g`j6Xa>H)9Jd2*WJ2eD1X5^R^0V*ISlESMSq0id$H8YFVykH??Y6nG ze{=nmXoy!9fOgivO^uv%R(E>kbQO;SPb3qeG3RqAeV!C^08Ts1hZfKHK{ahpt5XMW zD%vnICBZ$h;8BZ38TkcT>Gl^|mTQ~jYgm*z~HCk1l zt>1&=TIHPr3JyL<%NOS#$+2-f+AvsZlSz*Ym1{Vu^d?9Y5hfpvS_FldvW-_wg2U*u z)3^G}xBl)X_TXEcLj7!y8=vu`frcP~>Ue~)8lRN9cBh6Vi-hZp_F_b=L1at&-FTM%uo<50*4J!%1Ji6s`b2fvc zIx912o)O11e1KvZIzTk`n->i@l*6zis#DT;;(j;=8xJV4?0s=xQS#zG&heOP%BkyQ z&S;hV;A#z(_*J41(}*fA^yPef?T_ZbRNpQ1iSCw(@11zyk`YR*H#_rcV`yo}TzIItd`{Ub!1JET=x$tca zhT1qEwW_-+3+{3t*EwurKjV((h>yKaZ*0VGbM-L)Y}Kh@1NmF3)M4+R*-svQ3P^v- z#UA8jyPpc=)vPSw-Y5*9O@8%o3Qmret+jU$aJO7q{HA1bR_%&fVyyPHPw#AG&p%SL z6wg(_nY@}F^{UtW=yab>&A@1B&Ra>@;9#nqW8B@-Ok@fXL?wU|fyjN@ zBm^c@PZU1pO7l1Up2~SpYz5dWJF5J8>W2JKHIqhfX$czh8I>5lK?h07F*0?lW`MDc zD4u{8V4Mb1h!|whQxMaU8S=SXq;Q|S8TX=o_>U!6aCOqf!tnNwykO-IbmIL%@gSfz zol*__80r(YGLjI_MBoY%lc?(ib>4S#gnGx@9{fP2vC+DBv`7x$;gLeN6(GNy*)?M_|fOd zkGJP7kJAG$Is9p{TUUZ?)797p-odaRQ~|vv_W=LS$hif<7ur)<@01=tB0h#WcxDCC7iG5zTW?h5L-RVepBuqvSZ{s^X@6w}Ho>*N{CXYCm9}~eEI7b>`fZ})@FM^xsrR$8r$k4ttWfMgt$L-0N}bt&}_OC`r75Ot52B( z2Q{vn{h_+W;0wffYHnI4cGZt&i(t0UT9Qw?BsOK#l@lQWL;I*)Gx+|>V()tx_UXRRa!pWbVeR0zx^ZWZ7_^D zt!F<^ZgmFcqTSkq^1e*-SE-H27OaMoR!8R4yVl1R&z5bolnyRFnGUXPJ6RPO@x<54 z45&NZ+=CJk)hQJoQ9Y96y8!L(9KIP<#^%q+*DOk9Jo>Tbp$pqMiSMY^~SC*@A> zbdvY^=tW+Cw=d}zsR(CsZ=wZXEt02^BC3wGdvBsf8zk*w*`mQITlq-p<_WKkDl0>J zI-u5N3yZ^b;jJ^K_<+Fhn3n>~SgCVA2JJ`vZ;mr*;GWR}4y7Xlu&AB6_EZ6e1LfPy z98=#~dzrq>H)e@Fo5=pQQ57a-RQdEIMzkabsO-J0i_A^KkBZ}(4T(Mso(=Im!~I$O zS=ILw_FzE6%W*zIK~P%(#@tVPj22!fv5VvX;G$|^-+KN^NUM1uyVXy7F17t>2KVsa5YZ~tKBc{C19 zaU@2`Mr+-rg#n$iIOu*z9Dvc)8}tJf(Y5VRFNrqBJ;NyQIjIoppi#;t`K2o>miY<>HS;s7u#SBXf4I27)$w9?uxq#I+!bOg*P$spkCW__3F>R~cCHUVF8&O>BuuF!I7i;%1xmH5Uo2$G=XI==vUh34|E|bmt^GNmHCCIk;9PE3h?zX zssWXW%FPr+*LD!&Tx!7AJ_j%)1pHVcxi=O;yPm$*EamF!{ep$A{(}sV&;?KsKdbjZ zXZvIzP)W)7AykF6h96mnSH?2GZN5xHv5ly3O6Y9U@&b?6X&{pg@G?io*?<;y;}RoU zeOP{Cf_yarrcS>=H2#UcahS~kVC=3EVISq<%n*lQJR}^Vyug%^<@4m`fH$oI3CUst z5ULm{W;Ji?7R0#jO+dhR0W+}y-RAHo6-ezYW`Ik)T2kO9)U8h3BWhy0?+pt&sEbRj zt_>=5ky9XnkN&(Hhxh>F=L1rb1hf&WPQ0zBG*S(5agR?Zfg`#|HR2* zxmpiNVSdJ(sJTpo8+rE`0s|Cw;o}AC0e;!I6irh2#3yK)E_V=gAsGe}Ah2bva#0An zN*4D91|+j4$b3-2(T;m~UNjsxeK<8jtfB&`X$}PhP_CLeowj4mN3H?NyJ_lMx#+`I zKhsU=LJH%jK+xWE5FA1XNW*^FxE_{?0f->D&~#BUixUoJa-pGcM&SS1W$26Sxm)Dw zPALfvYt>Y=M0%f1NYR{=JY=@z40)Yfn|2N$LzY9ia)6!i5@UV*cZ_=*G5G#=6@^R; z&OYXtWf(5pO?d4q1ny@_3tj!KxA1&!-F6g&1JL|H$6Oadg=_pScL@ERWMI_9iq2aW zw2C_;TFsdf(;=(7$BhNq;j26aI4vj<48cX)-nk9A1%PD>Asyv76p$ZCe`q=?W`Cf= z`3Qa!91OgHkw5UN6MCMC6<9_I9P$y@Gqb3PpD@tYzT?K2|7JgG2O=u2%9ua2dp?!lh@)RSlAFjvw{^4lBojqi_7u+pc+Jz7$c!3?0G1Qn^ng47q>vLwr zQ7t#lN4kD(#LZy!!&zI0(SUvl9O{-iWF^EU|A=S>3l!ZL9dA+Wh5k{UoK#LclSFt7>yn0L?{ z(xBZoLk`QNp>#;)JDbMDhuR4sB|OFhZbI#X@Z*g2ERKD;%56j?N|8%(in9;rqvxR{ z{e*JI(H9VTTo~R*PuyccV~SG_EqesZTrm=VH$z_$uPZ5WuX@LU8-nPa*`z??CxR=2 zy$TgfIV@GwG4!2LA|}aUHAjX(lL+{w?xHtV5vPbrERM?m1vy35u<1OhjklRumuL7^t~c z1>wySkN7LYKN-QgfMEmI!hWA@y#WA+3@{5)_mBC%y>{(6HK1DkWwgrzwEIEB+Mc;a zr}n*7OfX0iyHIILhcvwNFU&u^HuxM}-)o8_o61A{r4iaoEJ3=s7!3YT3g-e{F!PtI zjE*vn<`gR^#*TGkRAWqAd?)f-45|Jp`X~fc%ZRL+{>$4zV*b@ovXd+d5Py#_@Ad9d zJ49!1^I(RW;uYxj&Qsy8YgsdT_i>;R z4dM`TWky72L7F)+#xW$(Mpi_UO&kU*V#Wl#G_$M9>9zm%=m^FXK2Z1yMXwWDsCK3wCZw}$~@;H}G9 z&+PZ{YfO0Y>mAS_l{wrSXIhvm(r>{sLhfu`{&#rnbm3)0-;C%4!9f?QEY$MFC7N(a z%NEpW8H{)p<>(>sTqQCKc8nNg!9Ctyq-+?|D>Q$B%ZcHCLgXroZ>i88#-e>Si@MD? z-Qx92*2T4gD7_5%cYvSAoqe>^u?uKAlpWVzcB4ZyTG|ZG7_B;eYbd8K$tbEIefApDE*r_^8|AH+nqxY> z#)#K<1?d%~!3cfw2kP<*VksB(k5Q}LzY0kMV9tm*z;^bfNG=tVaVmuiK8lbyI-U-( zSw}XNkRQ`02W+rz9E&*@&vGFW{NMGIB5+%)A#4rqIYu5Wp{5iuv2J+A*dfzhix%)J zD`N=Ew#`fln}vaw^<7!NbjU5qS~XazKlS&f00NqiGt9jZ`ZT^5lR$A-}0N_bFK2Y4z#JDZa|K>GFRRo%ih)3Q$7WZww_$Cb^ z1WrhV^ykdh`Dm7&&el!}odYuPzm+W=C{q#~@8^b~}HODF`N-Cb8POah|&#xx-$VXPC zMrD*aEr^ibnZD|<+?u<0JWFp5a>@gICQ&_RRz|popb3Zkr43i0VEcczxBnR>0_CB_ z(NHN6Y(xyc^MZEj3-fCVCLODHbO{f&*n|cAk-4=xP%Av3K)Nf0p~6x;M}q1KBt};* zw8z&Cs2XQ1LShs%K;|k^E--k0XCL>Ze+LKJbZi!{->X8dZ@}U{B0mv)mZGZQ$x8|g z-fWubanSmK%Di?3f`bXZO1$u4N-V8D`mhgp2ITvfSYYbQANx@HoB;b+fqg_gDF;0$ z^sy-LWvD1+2@0y>bZYVUis7(_tk7@bgGrqQm)lplX#4LR@(zJfO(@3znX*Ee4IsdZ zJq`9)3Wd%9fB>$v_biE!t3{!%_lGq+TV@zT&KLU{%4VJ7S0J@q;X-pwSV3a|{Apm| zDIc1vU!U^3ARV94ED5kZhN~YkKjA1C3M!Y5y0J#l!vPuay{vRTbkLXprAt5>J|l+@ zUAIaRaXg5SM|sesB*f@g|S*8{7=mg?wmwsY?(99JL4uJ3X+P7C1uLjNtw$MGG&cUA}kt zTO53%N_dean4-%7e5a$#0`>caI^-dJ08q&TpC5A*L8mx|P*4K5?zFgm|D}=B6v8Ed zmT6@!qxiBD6oEz#?b0}A93QzvVF*DLI<*_%@4%xJ!ei)Ju|dfa=r=Ny+YrtHd^l~u zT_23-xpRgxhcqy3aKe|L+jyXg!sUP!=mnG2`f1i1MUgTRx>2a_iT#q!qZFh>K`-Yq zOSRVHlw%ivicamt)I$F!r&>xq8Z<2`MK6{-Jrp)^;45of(TgoFC`*ZZBSK<{`hZ2f zps+Ro>V-l_qZg%4P)=Mx8Vpe>zf)ZFfb|QmYdw^e19U-O4o_rAh60631aDTX#Hw1r{W5V)is}JoE$PGuxc!hcJDl?p z7?3-<{?aad9Y&e-6xe6#RMlRID}}P4PK%wQWvKMyI&fo~#`Ut9&BG5o(jN2nmD_`i=4-naVf*^FU)w|!y*K4SPS8}T8& zU#zB@ z3oMMz$Njd-$$R$6(|v>OckORq^RD)zS=XtovPH!`kQP2U97pqBnM4+?Oxh-7vV>#Y zPU$t@Xlg8Czj3t0Q;OYfj5|8_h8X9g6gQONs}n(@2G#YSMkg8f`ADAE23z+-Bk2LAWf}IDC;^iJD>dSBjT|=l1Q8CWiN@IxvjGj!@4iOilkn( z^)-z(n7m}F-mK!<{cCKZZ(HH1T4!X*YFaH)XFw%Tn_l&bB*W`4RUwV=k6RN}xgJd*`hT zU;jlCO6kvst;_#4A1{ml!nVx3x~9rsD5&`B^Y@Vp-R-yF(?cE8lk(4VEw&Gq1T&BI z|J*oOo8F%OygNi|n0)YW<#!_UKcoH_m`dLm>0<7xe8Oun=L*{2e4^7=KYvL#s$M7$ zpFZw)E0cEG<#}jE8&l%KL{OT4rs{L20jY|O5w5w<9;3f~%umCLo-G>vTJUq#njgzw z6I;Ar=sProQ5^F1I!d52XH|T7uRKjFwN>c_nf(FNLgpCV1 z8{#x^K1*RAW_mmM&Wb2;oI4-&`I#HlwO=wyNvZ{bt?$gL7tROYd|+8{`oZzl>5i9Mp5F&dqdsn_6gmFaQ?b6;?T4A-ixta>WL)c3c7&w1Xz zJh>Na#$6rrEx>q!`6;@xh%SVcv$=1eNP$cLZWdjGd&g=6Z{nRJ@7iWw32W(h8)*d~ zJEmN%rGMRYd1mJrWPO{TS9+|Z@=5G-3qSFI-$VN=bLazn%DY zcb|bci0RkiL_Tus*`ltNynLA#+hwkMW4T#e(~i?smUp>OdV73$5+(C5wHiPSwco?X0{ht_MJw5VU%5Ij1R@dss#Gty;zqLfCTXj5_Zud<|( z^<3ZMt7xs$LE}{l5nuWgW_J z(7G>4^)cEr(%WnP%-O59GM>_6#TMUrb+^Btugf_Z;%SK6m)psIKH|&s(D3-^F!Prqcshe{FkyS2r(@~Od0r|(R+R` zqgRgmt1#TB`DionCu{!g^~bS#Bi#>dVyFMSb+yJ7dXP zr!OU)p30TVKl}N%oMXOkXwQiAcl@05^S3!-C(CUHV}Gu< zBz4abs!Nc4S8kd%(z<&X5Bp~Ma*yrw6O~_tUYR_%eUY@l!b5c-HGS*clI-@yy$&A7 zKl^c2aAn17u-fL3*J4ja1Wi<@9=RyMtQVf$l788JbUVtEHQlg0x9H}x#gjw5^438= z;MUeiYsLi9nP*n%?v8)zr@NcqyYnWBjC6Aj>q(9>eZ9n8SwELt*&xQ4_=;EVQ{t5; zyj63G)Skh*%jHLOA8jOP_Muu7MO}_iL_lYrbtoGU87wfFpCGQ?P{q*yR8E&c3FCvTY-mFxk?iCb!6OSg$ z_&DIi*M922N2lICKB+~mA@a!SrI@5}uCb|;-MmwItINOYqtW8|b{wuHH)|L^Rho+P z{Lx=H*`Ijk%UN-*%l9!R7B}VGZ{8~P+z%*!S$eHH*X~}Ygv;PxFPCuSt z&9T3_VzJ1_@)lOA!Ml_d>vYjA>eICGrdcL>COBLt|H41t(ia!j^@iVRs`6n!^23F8u55Kh57`|5nMbKl^6hm2_pO zy<~LG%KR#IQQIl&E!RcOuxsN|k;kNe7)tGyBD@o~JTCrC%`BFp|V|qUIZ`Aa-ce#9eK&7tWdHQ|tSL#{SMZgRs$szEHY}Kzozqf-j8S zGhA#jO62;xkoDtCb63#>g=fV-8kM4pO|#%LE71}=@}Ila`MM>3pA+T6>cM>`DE%Jh z-Hw8}C%4SKk{K-(G%~QbbnWyf>LIVF4N`9exzdRBR!s~Vfr7Y?2N^Y4p;Gmdth@WL zysZzW-54NE@(SrL{;B-EkWRu42CYBy3f{8vS=@DmTTpm*1|i--w>4>r0OVbT>_H1Wz8T(qd)M-G*xH>prT?H_UN-|6+cmSM=~=SYkQ?F72R71WP6e; z-PjbSf!UDG?;??hp-v9OMI({*vV;P;k3y_c8CA-B1x;S{R~Z{lZ#T2P)_Fg{W8 z7N(9%(tJx35r!jMCAH_&nNCNOA7G5E=p%?>-n19C3HLhf)obkI&m-W9ZV;Gl?yLk)YG@ezA9tyOSIo%mdfy2gl#$E_}cHP^!vAQ{L<`~s%@I;;>FQ;dc?{!VT6GvE25#}khtL4Mu zZQrdCDhgb`RScAVzZ6Sc`Q_o|DpoRJj#MPG1fCW&r!|xcP6-s#@T(iqT>XXGKbkk5 z$O=&408EYWSE-y=!TPO z3*CIq)ZWFb#yqdQ`o%$3l;?PJg52^GlX4$HpxBLrbFWs3PB*;pPG67oxM- zaN#*{F1zkaIztQ(KzLYaa@%FKWLBTdf@pN@hqZm+wlWDGhro4!OiCwFQi^dW^Hh?3Kuvdb4mH zQ39pkNn}K;=&z35XqB@bUDrUuEknLmB=P0eDj4JFe8(LfYfl;%;eI>&UmDX9r`Yhn zwO-2{T1)$b2dc1oy2HUo`~#6kf(XZ6Ocvl0CeDSB#`frRq(SQCVF-mx+V>N>P$8_w znQ-nBJ`V$`!MNmPJdvx500rfOOvIGf414N5y=uCQN_VbD6$Hgm+}rp%I6Y777Nghd zTJ6S#v8EO(exsga@J?3dF|-^T zC>{1YA~i6Q6i}=SFAyQP6S$G}hPk!5(C3Q*80c10c^&xKmw(D864Wb3D_LF}nM5ka zwrB%yef{$Q0W!h{Z24-gRQ<5C4ab2?XT7PGXhpwQ=B+7xBFrD%=j9_yOXYO>i!6AX zEHh{T^G;0qql#^$2)TmFGT^_rJzY4A9@Mrn(Bd%O_CuWhqM_2{VmCSDc2xOM+%((J zYYdiG$)t{?0a64E)23KdaF-T%$|UVKo4XbVY=S)JQz#oowcr-0-585k8rJ)D;{Y21uP|7o!34 zex`_f27RBRA?^e8HME1i8Y zi>cNs_+Y0uzh%6xNNC<2tCOy@_&*$r^l{y>Nx`s{6}z~lDWq`zNZ7#&e2(hBz9nl2@Y~V9Hb>7=rBn2a~va{KarFLV)bm4E>zfr4Z^8ZA8(eDSJ zN-jNAqS}YgCcrO_D$?6&nN}#>3sN9UsrtpkzQTPQI#ML@J7olqonXnm&%l!|dzJ{C zivN@O9$G}&8jF3^1>lLckJ1FXSG#1#q!q!gSsq#uf?n>!%%OEx8 zlp{}8#MJW5THG(ofF#kr?9}l(n8BgQLOKh+T+XdG1w``LKlzyHpP5%^2QCC84F?f3 zZHOqj)IwVhu!~iuO{*ld&oJFt|J8Un>l$pkydXX~`kn@il&%S>JyyY_1~_)K{w=V` zK@Lia%Ma2gaU=4qE|?94dWA$L1C2pOdnGA?KqFKoe&|WZr_KFfpb-%IX_W^0rR{UB zIyRoj@W-*&LVnaBMhds${5zTSBSBUy7+NlVP~<%zYMqm8=ND(ftGx++S%-i>&RG?+ zMuR(rUh{@cv=vTXhLZYnIWCG6gQ3<&3-qBQ%F)}?@99=U-e<5~8eruH$&^L^9pCZ< zVqybo81ZT+fg+c7pxZvueqK*W#gfh(`Ez3bo~5(oss-y&f>yiPBY>W$WgU?iwXl-R z9*Vhu#ILWhFP7q!W8klQ{)H~>o`3wDoAGNrk z@o92W7Pw32g#z8jg5;a|(x?Fw?CrjIe-&licXYIE!?Gqa1DXgeA7ocbm!7{9wSbW3 z^CZ{#wGBf?ra`3sLbkQB-t?)-;CS3{AuceS2@eKzJU*3y>50;}gRo|3R4jnFw2zx+ zTlgoPh;8m#6BaNHvd16=0rFDqPfGI^7Fh1o7m?Y$DZuJK-z8%-#AepPJT4LW@}lie zXiFD#S@ip1?{tTJ>W>diQ>MpwsXlx=Uv6E~5r;REG5J$qfV>M$n7c zuG!S<>9#dRu1Y2hW;}b@^QdgS{9S|0xR&v==8G}MY1%vsY6jYxNq|tW+CrYZ>2@z# z8+e!bWlC&AFVWS8sb6Tl4N}VGx`Ol|$g6@nT1*%)5V^m`&r{LOB=dG_IrJUefKx!^g`oohK>c7a2;|H zg6&MCRMSrCBxL5f#(^mqlmu@(>Th2CUehL~Ea=3a}hZl<=GoJYCwY zNq*MB6f;G#K1SifuIT8!N5$IQacKDFze2<6y-ja+zZ1-OuNME5FNF3i0Y~2UwaWOo z%t9cmoTKq3psBWhJUq1x)EgKM=7H%un072LYy&f3eJ{LNaHNHKFn#12*!|Wc;^Wg! zJ@56#jcgNz|3RZTAJlsJ6EYV)E~NO<7pW5|o5u+(NQ$qS7R6FlHOi&IL6#?~!$pHd z<6@U<_)U3qb+ly2u5-4*FWUg0Ewd7d98TpD!a7X~LZ!i^KmmV) zDCNT#xH%KQcFPO1_N43du4mlcLE*h)h|?CA#_yqD8Iq>ZLTsEoQvva7;a^wnWE|+XoTkwna?JKKKBnSydqQ?^YIT#&O~mzG7OAM0t5pyRjG^p zZiPeuhVV5LJrt{UMG21GL!wC=qwoNdRo@r*f655hQ--EGN< zJBUtBLThHx4e}RXk^1PAxP$;~$mW~XtCxoy5_hPn7ajJTcmUP{P+~V2DGkhjr;h9P zVF1h;( zfM5uwK}OlWf|2H~U z!_ic)H!*^lt|^S3nu~w>0mz(6z5LD3ifM2eH-eXsJ@ovBFOii7BeEbbG~7L!H)or< z&cih8YP?J*V(k_kOxRFVn>cyo361Pj$>@pO`6gq7{HQ`V45KFdaU{_#L8`k zLY6X7M0yay?&ZHRZ;49J3tNd6ohf_Gh|1uKy$2DkGH+M$tP^tnaL0q03GF>6a{QAlc zKdJ5bEs&mstgun?40;d0ASq5fvU{zYT9s}R}BMxs_{)mGZB4mTC?VPhXUVX2ihjb%3ylcreKtFpXU$Ojb zu@Eit&u5NlpSn&V1esD4Oz?UA6(5Da?2)4f1wIQsY`)DT;^|tdx z@95wxB@|a|?Pd-!?Ppw!lPbd&LF9xGEy#I(<1?{1$4Hp$3X-fdwY`AJE~1NnXc;SAiQ2haF^R+U-r}a&XdQaro_mPOyQY#R z-e2)Jof%2WydfK*tC*Y%KI^rPE5NJ|CMa0zio7@Vs{CMJtQlm4QRs3YlwgXyN8)B1 zp62QempRn4mEBhbzBjDGuQwfK8(=`Zs9Mb{W&jbEmy%K(O~3Lj9Hdok=WC-@=VerS zZbd7GjxbhGNvs1)XmdK4*tv_diibtjk~s&!udp*-({GLqV)WN+l(MuDTCQo>&orW& zvcYmnvPO@G&pdB3Voiz|26mL%rLS4KGFp%sLA2p+R#R;?zaf`;3H}j?l2(@lreX^F zvB#Rk9I?aDKp3nH-%yh09h=vyytHDl)s0uXlj(CO7muGvRZT+J>4{3RCLE&SQOrel zDf@0DgA1_cX~}#!|5zX9&J-69h;6JUaeUuCLag@XW|CfYf+(d*(x~|lmYNNCs8PlI zN(FQVf@Om2=K~_h;LwswW~4-C&Qk+eRpsAX^kHI!Jk>fT+6Ctgo-X`_d!PmHnLH#( z!dM*{azu&H_)n3d&GQdPMXk>I)2Wz42anI@*QSSb4#G5q&;Q{pEFp%doSkXw; zdwJOq(YnI*^A9M3tCn&oj=g(c^Up3|B?tzsi zh7Bf$1f>ysP>(;#Qb^G;z{f<;-WB5T4knw>{V}jx6+d5U4G8yFes0|+h5dS`zO=fj zI{aP4ZMGgt*!U4^dVca?1*j4$N#4+mZzdgC!IU~Yp+GAA`_io}rnU*jewP*MDF=~X zWUX9L1RKtzH{bcUkep2QH>Ro~6)@CX6>>Sld`hN{g`i4gq{>HRe#Jp(lPaTIN*yk_ zHpt(`PsKW_4KaCWcb3$^x`QpVz-7d8X_AvmkU{GK_ewb zyQAj*dtEb@t%tegbIJS0!t?bl(kEy)F@WaZU=z-Nk+b`6un7yxzbIY0t(<3!+MG3` z2tIy=0sU|=H^Jc=r||Rrq}kpOd2kJpa>kwtLOofGREMF?OXy z&wcQF3%GL{|HTI6c-}WwDcyhZ94v5cef3Q$HOAlkT%a*bbz$lJ{P|dQv54Re7HPSv zpYY{1bBgN6ltk=hYb=)tp{fyu!IW&JJ(Tv+Rd{y4PRT6>KQ_>Py^inPZrL=+yr`?z z?(hKZ4tDx^0taA!_{sJylIg~QdQDH}Y)0q@I72=MdEJmIFA!+#}{bSuQ7;9OfKEopnE^7hi49;^zBWA817$5b$?5o}lpOev>f zqXrhX-iC$d`Sf;n%f>l&Jbx5+rQFChBl1Na`if{&`0XA!tDLNb+-R;Z=w-spOldzW zHGRT-d}gACvJov!;h)yzP_PmK-eAN8Wv$L+Q?JYm{{ESqn=E%_%jMW%CAQL$98G6) zx9RC(?y!gjj9DO@AzLiwV8X5p-FHjg<`4P?Ya*V4&*Z@gT5FIH7)H%eL5k5WApOMS zYN#v;%f#JqB}X@Xg_7rQSlYQSPdQ$ovw`l7b42%Uea`#Y55(xr2{ep7-JAlwkuFpP z!(9ov0Wx{BrNJr4R<+>_34lsn-o5!n*Pdvy&?`2S3{rPQ7|?*C(XbG|?w3WWMS&|vJv<=iK^&RaSsD>$baQ~L- zB~{D;b6viz0kdICWwV%;v)Zc!ls*zkWSA3^0b*+GMenq~p0t$Guq}-t5HhC)sc&$1E!VSpov28n9W8@%vUU+fxCRTBgIg zmX3_~EZigSca&YGJIMmOTIw1Ldk{4yH$^!6O73e8NvAKbYdD9}+;@UN{=-V+9Sqn(R$ zvl)%cr*NdM9xc?dQL@IFJDlj5m!B8wFso2aLIDPK}y)?!(Zuc|g zo>_obp(opMNK(SKcvqqqV6a{7AilW2!*Cx6ymF2G^1(^sH6;}BCQMYuvD<`}_@U&r z=9NcFp~RwRe$~1Jqh~b(o2K+GF0{?A+aSn^i(ZEN-Q7lA2f5Q9ezg9EOpLk!>Jr1fd((Nq0;mD;uwiAPglJqR*uqBx!>gV1dBAWFp?~S-QtqKAO#TI3-A= zc8Rzqf%Sc@u?qA@PAaMc0*8=`bOzPBayGu@hjRPxBe3~^0~IhmiacUlR*@hy3I2E}_K#Z1){QfN$RD#tIvJxeF4 zA^)_S*CBy_0_($4AM*;~Z(;d)S!7T6mYxXX%vVa{`kLs$f3Q;{3n0m+n=?y{H*9}7 z)C)R1{=hMb8UYv!!x*XRVJ$@je*=lX7YweWnD28X40s!f{#JJHdcXIwT=BODv6g4C zut`PXuVQ9RH{S%;iEgc4+R4NNEWF!< z+h9!uD`Ri2BX86cM}-+P=?Mc4$8hy_A7r0x#cEcHDao4mtNp^J-knD%c7+J9r*bYq zqM%vIe{RNU&CakYcp%iD6lT=@!l!y7VG7E=tS9ympJP}TmZ@}MqpWmA1a}K2u1G}# zSiZ{d`+w%JLjUO^Gw*eoxnhhc!$Ed1aqz$g27xX zB2xWa-_t6TFuI#P0=8T#!)@a{I>x>6(%M1Ui3*}LpL4NW`{R%;`lVBHa^VR4U59Wo-KVA_>~>(x>DP6~ zItb*r;KQvjiYCrA#Sf!pTZJq(eMx9=N%#PaMVsSl#|QHn*D$G`sxe=OrSxn@R5$!Q zJ!?-A`k%q#ED_Zzh#0b~xH~^yQUpNkH3Qo;UD)U)%iXyGY4{QBcp zwD8CGcKUB%OtAG3t!+nV5sWw0mqo7jYVYrgOsh_3qH>o;@i>OaZf}XAgo?cA=O>;J z7=r?TEPl)nFrSw0a`0a9d~{@4`?^>7e8{SGrR^e?E>^Dio5U|-e8mcttBN~yIiY4H zqP0qJx0{5wKJlBJ!F-6KqaH%7pIoU5y7+9k=G^>mIfPrMH}~G6o|N#rUMf08UU+~P z=d;sFn?YI@-;_D2TDN)m@wit?lvd6;!z!O&?_;E3emTTZ`*ZSc4Cw9el$tp^wuYte`cRdo=AV8QF|S=C5nTL z@zRnSwc@2ZrNgH7H)m{!RPIswA@#l*7i--7<0@AnD(w^M!<;h4;|QdH$k*LAL5?CI{QAK=}BDe9C<7sAHx&Gx$LT=^s}jL3!^*=_`3PDAQp<8}izj}+?xGM9s# z3{-FdeBh`4fSO0Sj;1VTvrzSgT{hmn0=#oGlcVnTD{NoQ8#pupC`tu*Ckec)#k}wc zTZWAP06!U!24r==q!7oZ%#aquqMLf_@YQx}teZ8X=tw*K=v1QVj5XSi3aN{S-T>ul)>A)LpY{tT|DIKcG)OeuBNrmi>6Ld?kgWK#misrT?~zF9-@ zHy7CxntXE$%{{gC42<{w1GBPw9N2JrFxunT}^^8CKiOjMLF*)4xjl3S^ z0-EcNE^u`I7KO`AWq!$`{|#&rdVMwns%-szrU#STCds8_?)8^<2ja?)Qw^~8R+n6_ zg$o7tE(^5{>#bXmlB33>lT*r8oR0O_~`)KU`rVsVD{6vyng%N6FFa)?w~PYq#-~{H+*2!9_Fu ztD^V(Kv}S$JrQhV zODRzURJkoL)>&JuB`5;@qZG~$7A~ETsY8*0^32){Op(Ndc3B%^Lho!0h)Y0ldFYZ& zhb$I^iL9!7Ldg&kugyeKj;AKm!%Rj$jp@oRROz6#_{?#$3LtAucL7jHX`_rU0OGKETyBOE}tzAcm zgcIjZ6~+feTU7a*_P#M1EV`2LMy5-GOB3~{;gn73oS&#S*tsffstcfSJ(P5XpdGy( zklFuvJtiGp5dv?#bWlA$Yv2ADihRW~cucyeS5O>oLiO(Kkk-}4xgMIY<20CMRzNZ1 zou8C)8Jiqa1k_Si7JLk!B3-vtoAoZVG`Vc0+nYoUYuq3QX^J8r4c5r5Fe$-fj z>M7rfZSlW+(<0VuQ3w`DFl>2wgckdSVz_|<{qyfX@rat*^iPNDe&9rjmW-Ow4@sEQ zr4n}PV6rNTuv1M#XHQ)JsW8mdax=`pGPdXJowAuxuo4YjoLe+;sIME7YBr?}1-AG< zhdXdB>xF@O2GUe*vzjp-KI6NqZdZ~OO4{B9#PGHaA7<_Bn8}rk`erSrtk8WwQD8Ns zIG-pUY2f8NCh=&2FhNaK{>6zG&tqNLj@^M3@`f`ux<4k1Ad@P|x;paA>d9U@0^fpR zY%Z27zwH9!P%uDNiNe-{(v0v-@OknqO!&+VM@q1)y-Ze1T$)E{wNGI=AYmfw?TRV- z_1L&)R!3H`h!Oko;y#)tPNwVSeOW11WufxZ*cbBZmdWtK!e10>fN1axY225{vGx6n zJyZu>zW;BWAguq3J*4bzXUrsTV4>t>%_K+60swq*(;Xb0h`)Hy9RCeX9mvWI_*ZJt zypB$pRTF~uWz|xQHIWznFcC|lAio42HIST!A&3`vTv$-}n0yDh;=9?vYibgI1b=5t z2eall$XeG_!7w^{6Mu%ncS3Tj{*Ej#cV$Arevo^A)IdZ#Xm+l^SA^FgfElrZSR#Vh zFIzj1yNk@K-GFF5i@3ldiioDXexM&Q(oPhDTe`!?nB?!G(0R?RJk6~;ZS}L6C|<_P z{8S;^qdtPRKYD=HQ{Z>r2wO~uG#+Ds--1qbh!!QdEtrZRKXBcm-#c3C+PJsy1Pm!e zYc6I&>#CeUcC0meLi$?Ywi(?ar-U&!e-|_J38@J<#GI2Jawvx8y|o=e=q+ak+eBY7 zh0Q3$m%ocT$7)xSO9*7ct#b4VddLZ2CRyua=s5AOG6{~q8bXWU$r&*>i|L2lHW?JC zhx>8R=QtUzo7TLERCQF+f`|pYxVI}qvqiL3h(6sWSReF7^FDeSBB5_J`XQh&j7q(z z4>gkhrjBs`9H8Umr5?kUb4fAi;IuGf$N=pxoS%MoN#w<_hO zVE6QDb8z7(A0WqqK9_czRk}YrwOaIc$1xu?@x=ylei)dHPmxWZYf|wgFeqPG7sRfN zC2b~xCyV+U{XBtUuJX)&E+U>Ic`Ag_RNAc92#;e0K(IRY!y*y-0V3UuJ{JLR0(Av& zNHA5oglk1$UH@MG_Sf7Hrh&szDx6)@RHs_R901iA9j~?!)7gkC-CU-&(JeIRJnGNh zde49&RWGVp(uK)GA#5&}JOz0cM^XRnR{_4Knc^e1D2tN<;v5Gq8=O|$^lCCf;WmA4 z$F`TS5C4K5%>DSf=iJ)bq*#T#V>0I%PeY(Tg`)!ASwB~bl5XNca#X4k)z|k;@(67R z$NL=ALvw=9Mz-$KromgelBCnm>{yCPG*wxE{gvE*J;3azb`tL06ej70n+R#`H~E*+ zxK}W7AK;i5w=hEJ=iQYGDJ|G+;VeKRWi7x)QqCg{Qp3IMIn|(Qs)LP2oAkR+sl+Nu z-;S0$Z8C;E$0ad`B9(@M>d(jp2Nm^&k7Lip1&4b6$pyz<(2fYdz==|Ru%OMnnCHM@ zsVMqd$c#~yUTo=wsTTOfyVVpWh^uA5lx4l?P7~V$M@T8CxWf~$o^=PG|^rAPE)RjO zfgZx%hSwU`W87RJIr52#=LY3F7}g&L9P&gR?(fM=saybipPM_9smx&44fmH@qK>!M zvZ|+Z@lVn0xx*NNkArcw><*9D=h;Cbucy1^vd_Q$i@wjRWsgiumpZ!qFFTp8KK?uc zua}*=eC@9<_vv2=4L+~?S{<+Ni&dZ3cN^)pA1^2AlNzS)JIC$v_Q%EYzFsf0Bxc*L z@?zV8?7@AI~sUJnPyfj>X+ZoJ+P?yG*i!!CLUxMn~8fP^q>C!dw-7bKF7I3=tPp6D*mml60Givyn4?nDZ;fmEp10Mb8^B5HwLSXB#U z8c6MgZ9)gQ0RI6D14W@d^jmeH?3N@p@y+(x}5=S-;Jp=O65?dGi4QaVRZ#|am7nBBVxlxt5 zCQd3&O+6iB7O5;8yVWmNkZDBrNSd7Pnp3`SUutZ+=>QaZN{lKn!!=A9YH@~cFN83y z$9UMGuVL^gWOKU zGi{XIm>w7Q8W`kkc3BkNnXXs7O%Tp}Ry93rN1z-o%y8%r+?0c|?$z;cTZA&$a3{4~ z_^WjRa-qii#CAxSGUdIrnPYItk=ku^MZx&sgxvx2dSn?H+FLqY%SbPoTr;9@n5i%x zBLF%Tk8W7jk#8L+3hGxlV zXJua_mQHdc zwJ(^WeY!AX(MPK9&tg}kO*w8s%V5gL^c<4%?2wxI)_trjrWbe3Gq6G0@UN^Ej zR8mayx1O9HWns~YoI3#gl>FU^$`so=N7_2Msf6E#}s(|b9tmQjSG zt;KGbQ^Ly%XUN)eoZ@unV5#p3El6+EJxFyINDN5Ch)X(fDGVS&0muz)@mji9=%N?JxV#<3&=NP;Gd#Hp-&F6mo4vJ=YzXC=K#k^f8rH zB-yWP0aE1e*qy)9Zu*hU4o+^I*J2kGGw+8Mjz#!1Peq^4a+!b4>@F?u27Ig~ zLwrNzE$W^ojtpUt4>=i)j3#+B)tKSZ1h+%cO3$!X{5J-M)Ji*0gMhnRyX0YI|2lC; zBp=Y#Y#v#Rgy}iytl!3W@<=XpAU>J5>>14R7!8r&4cK*HH)<2Z7{r5KT5+{Dyf2e} z81Eai!Eu5n$}Qr7$5<=T%aT#WW-CNL@?lk8H%Q||qelM3H2;8{Nk4sFJJLx`t#mgQ zvmQ*6GZnkc6J0q^!&340P!-6=Y9B=nZ=$2)hUZ^iE%`6TMyB#UX-0r-CMMs>X4!*qa_rR_N3L!#(NM3`VGzaYyW|5isWHy!HO5%ux7RXl z(v&snfs9QyRy~{VA*tj)JA-^*)OmJYr69-pk#!7zQ!aPZJS-p{yf$Wib7YqIs_$UE zKH!L^H^%L4I|!T36Nw*waoob#oKjhz7CBB3rvui}dXyPOpdJ<-c}~EF+B-mBC~bt} zAlRtsF}}2kBH{>nrgrfoxN6jW$nSlHRW#g0>-ffzhrD$l2a{x+0;g6qVw?nQb`_I2 zg+#~Ab(ZCUqQBjVn~tOH4E<_iykuj$-v~Y*JCO{olzgPd;IEbXzU63aAzz+Q6qivV z#V^SD=FE#UNR{Gz26y0}2!R5js>tUO;E^|$*51-X{okggOZzCCw>98U8-1K1USz^X zJ6Dg+xL-2%uU&rSS{QEZo5O`xSSHHv$r1>?V%(1rtXx^9-@Do@>A(&Q=r5!KPbRpI zzHU9BzQ&3mWn*KXKl~{k_z^TDAN8Z1?%BMw|51oua<6#c&qmZ+-`x-YALe_-D{i7b zy4N?_H@A!uSIJOohJ=eVE@H?ccu_*_-;iV$*EI+ko9TNsqJOl1J4_XaoxaUc z;}oMCRbm$r7hWpAy28AG+)kdE9jy-+fDs1qB@zvey$PJ#%k>~`*LfH+KS4HUcgNSL|&Hh_rIX5v=N48G|9#>*Vl zZANwpvlmL0NFrSj=>O)Nou}-os(ct-_xsD};80a?y4!q3J!nWKTE*G*$Y+fRHu&p< zmfaFVfd(FPk%$rBnnRMnVB+zhc$(Fyz|;*uqSISauPZYP5QfDfFXO&_FoP_DRCgfV zYVsJDr=eHjT+Bv>z!9~uu9`qWNU}f7XbsRZ4Q#=0*`}Po$`r8+R(U{9jAOAddWW_( z_cmSkNpKJ%CXtM~4S9Q*y7-Vja=nv0wzxi4ieAi~id@{{ILhzyUpjyfsSvVuJKm<+ zYV22YPpl*Or0fUFzIq>GtvSG{?QffWtuDnVcZhio=D$jern}Go98g7g0o0lY`Ccf7 zdYa-K(jIw`96BU>lW(o%QdWvtjQX`;2PpZwr&{ee5)pu)W&QIz03XyI<$siHHzsO; zeyl8p&%YO*pl~f%CgkT`lu6bno%Czjk7{z&i?^2-URJuxs=yKgz`-hc!+uc-=lG9Vx7Q$xd9j`qJXGuh`$>euWK& zW5?c}pA1^lU`wvwel^7X#k-W08#N)kG-r-~+`Y;w`Urd6 zOSDk>r&0ee(XYpPZ11+~tg+ykJY@$n9q2jXI89MLLP7T+wt)DSgmh2UHDx+wohAp)+78V ztK?)lvHfQ{$WJV0xhdIJUvy~flxcz6VE9oD&3CzwLd%h7XiP)fo_6IoK4KXW-cDgi z^9uOHUo{*>j$FP8zpCEOzqGM8SQKnJV)c(-UG>3dopx=1;7n^e{Y+g%%Q_Y;J3xfk@mI!;*F{_paxSXlp)bL3om zIQom(+J5+z#BZX$1_Si^BDM}ONNfh+ul#Zt#y?2hl()x_ZZw`ga(a}33n3oG>^Hcs zaj|&f?&`V*`=2>i_?=rwojcc${m;dR+k-#vK)#40`fh}w1ZI>i1cCs7fgAt(b01e~ z`<`2}1yhd(^xMR>)gyA{cJt!4DOTr25W3qxDOVg%Q^*dzQ$wL4Zq$fdJzVv%xxoWv zDQ~AGF59;EAhaJ;1INBz?2(ColsfRa!t6g6Z*2on5uZupz|7s=GXC^o#)jb7^cNkj zq5aLc<}AAXw)4el?HHbS_}~T{XA*u?Xg5Ue-lqtCg;5foU$VDjwjcMo0s!Jt+Xd{7 zL4C}ZIyk{X5#v5k{E-kE72`0+hxS*Td1#v=TfgVxJ_Cq$-s@_#ABupcL#Qk1$&g4< zgWH50m`96##H@?QDM3DICclemf`RfVvc>Io_7^O*6EHg0FLTVT$;rT0yCtpsHf^r1 z<^g7$(Zng^?W=mbu5*%jd^52nN>O1QT2hfm^<>bGL%ge<(k)?e$O20(F``BJqH9>$ zH3(?M(kL@7#80ar>+`^W zLx21JCrNcdb)RS~>Tbw@A&d~E1%&-8>MAIH$5{8F+w3{Nu|O7k)kbQk9VH0T3yzgJ zgNPvFX3-bhS*XzK3m)oIRhz3}d-I)~Jv9i0X!Pd=kXk-EESQ$nIk|y$lP*sbVXm8V zM&-vsxL3Y2DMa6Mp4TTfoH5@K^>s{+9BdK%U9QbcqS?v~IcT^1f@MH~wVwM$RtpcU zih0PwS>%UoNk?Hii=|d$NV#x zw^=Pp@BQ-2J;3dRnGG$_mE=�z|aIpiqRd1XIVK&!1g5*Lx-A2AB_L6y#t)iTRx(8?j?yi3MpGWLeZY5s)P&r9BbvBqh}-9$&B=@tycRZ8o2FbOtRhE(`ou>?cU!huGKR& z23GS|Dy`={qAw-_{U3q>rWYa3ia$$FjxrXSl)z${Tt#ZqL#uI>t>yza1dT!8#~k_n zfQ95ds9zWbAh~Zt%0xq3628g-xtY>hFiupo#PLsB08CrL5yCF-WD#?xrq_4*pjl-=d~490vjQTwT+)1unr4-@M-n57MXd+Rm@we-$#C&0)N zrZUA6P6zcd_4hcT?=a`zR8aI`F+v+^!$T?LFgE(tF{x%RUk%X;QW!X|YXZ@nY6(G; zfRUr_TpPb6Pr2vMeh*)hbx;4w%P0{e6(^5xcWIs~*P)RR-U%7vz|ai3$M|{5p-#<^ zdIi|jkAn-!Pn=P@J7pt%lcl%*eo?Cu67?W8KRU}lLf0w>{McC{KTgNxNLm|$C{|*- zYj};;jB<<4luWt!xe$RX%L~QY=!=aY5mu_F`IDg`Nc{jy1S(tJGY|rm4oMju6Put^gOi`uAXg!=O zj~af}_N%-OS&yaH`R@CE2%gR|1D;%0b;T9@0l$CU@%R^AQ$gJaOu@ACW}u zRfC>}Qk#%BF_cjt`2uKr)8_9PAecPWlzArz_N@7Ct-KdKjfN;S9Q)sO>-16Ay=)Km zY+l~hx5bO{du+X}TN;z?V?SBn;#=I~ijUTxKxY8C{gEfK-koRujnWNu=RPAjiq`gWGE3L$E~4yAGNl*_Yy`d;cDR>bCqM(3k^~e_^;gJphyh%| z-8lpvI)5&e9lVt9b16*ID;oZLLa&4sFS9pg^&`)ZL?2*=zl(nU8}P&aF9nSLBW$Gp z6*n?AbYfC+HgNhUj3jBTZ)(h>W^UwU_7y*3VUjR5H#Ku2W@l#-v9+>wP_olEG-eVt zb}=_J7I)BhXA(Ada#S#O5V5tkv$Zj{af0RiYBjVqGFH%cuy*_^lk~rzK+O67-N})d z`JWwUYn!jVuZ|QPjE&3ua$vvcP_A#9x~ZldQgz zgSnd)BaoTpE8B{Zh50MjpO_KA%*Dz|%*e{d@dZ>FIhfg)IfxmVnYoz1PGRN*0KX0b zI9UGq^wkF&s}4WE4wI6szM~~9%YPVGk?H@@uK&hB|GfpjO#B~f!I7Bt|6oC8w*StA z#LO%}j{jWLz#GO+YtfzYoAwz<4Qk(r_oig{T!%)j(P*VL7nAg$_0C!5qDkh2Wsx`2 z?F;w0BTItZYFhnm#*)1iRn0DWqY+Iqg;pc|54cBfs&0%|VPtZ_vrC@GSY!&RM*4Uu zlO4RY+#I+y$B*03&BymojV{STMKG{;xnf5b7sO6S&WuR;N`Z4Y8|0Y5GFrO2x;g|g zvfGogs)xG=dT=aoP=9q&Ny>!gLp0X+@SoRidHHp{IUHUOb=k%%D=TZduC!!@(-w;O zT@p9)%RqF|MGo!r>A zZQHhOC!6=v)>iFS?fik6s+sAh`=HO>_9?^{y`)x_6zQ0JV8f}T6}48JVD{A5u4CJx zc)key*Fu zqyxv8$*(~+&r4HNOE*P^Zo!JRvgOxG^&KXPs(}wh6EESZyZycWoqm=+w7YM_fDtV! z*#3xT5Gg>i`|y^Yp03H2g@!4k<{e}0wiVhA>1emi#?I}|ch{VW$YwRh(p z7_d7(uf!y2n|Nquj~TiL{RUOkZ^C4HRv#%9g$gAK6VspJu%H|494Sf-gVF$GaduIy z6D-_^02bLGoHZ#y1BQkecu;WQnrTdk;g4L1R2fwm9wjk|^f-m2rDVM*kd{2Vn|rdk zRARoVpWZnS%EN&b5iGQqUY6dSt(Q542NjaPCqaWaA+cp3E7nVZFlbaaaQyG(1F#E9 zlq}Y8bq27MZ7o*gc}GspJ+y<6J4 zkQjlBG#RmEEmMX}{}ifZsj4N6DY4KI;Z_oL;bUJ;h|i!Ph?vlVWyuQLW!J0orwjEO zLJCftY1(|3p-&ZHl0*qmr-$LxfxY>ArrQ_|nn=+^eD%!T0z(1!?3FXnw2hNXV&MVW z745)20#c*Ti+96;1@SO(L*bkmZ6z(EX-4X#ahfc)c!{dhBHD103grwoY;CIJhM3$tn_*gtGITlnPNdoWut5+1Ex|FY+mMG zCxtGK+wAZU0i6*ndya%<7!1@=jIU#aS|pOvjII7NuMzU$iG1`QoxWjPXPGZ2hld!l zV7pMF-&NBWw|9E6;0O?R|Ec@DoFQbAMe~vM^%?6KHeK5$OhMv>N|^2bA9ppke}{&K z*3QoQ@(6dy7WwQO8mgFg;X#g1sIAKn9X%g(AthGH8c_ln zrfSFOD=6vwvt{Vzw*W?Pap%%;GO>W5b?w-aD}lDfz{7I&>a?c`*R)MRdjZBu99zU6 z7A?)mt+Loz99%rT9c?7n^5*6zx4W}K1PCx-uRwy5 znsp*XqBS>Ungg@~Kp+|yP0IlRfD%w?)w#L3<>mFAo%#8lo$c-8He-fq*ag7o0Zknp z9k65vi;F7i>g-qt_8eV$`W6n7=ChE&M6Imzbnc5}L3Wy&Yl%5uDuRlDvq+LRS)9q? z+Nld3?}uk|d2?&&njGLmke|Wr(=!vynKB#L*wj?ii&V)nR6)0B5W%%H2uOjZ-rk)x zHSnJHMn*=iu4q1bdV0efd#)ISS$b}tb>di9*d$7ni;(tSQJ=t^D4{3(KL;ZQyfqt9 z=o8~o6%`dd?@KkfT+S4{R2U!4&1|DIhcMvqIE$v{#;<4mga;Vd*dKfFzV_Fj9v0f2 zL@1Cwk4yBZsc6KCgSPmA&y|yVG$E;aA4@f1V4=gIBZo|ydcJ&EwjTp*7wn z^Z?{jsdT(An@+r4U3|5A1OP33cRSe>RFw6H$F(9oglAHT+s)Rt5|t?PGRN06nLyYZ zW+!@{d!`f}8Z2Uw1ck4CfZT@~G~{@GpYbDj%vjM$d}ZtTaD{3WhV>%#g=J-syM0PB zuj)OYLmlYb9ozFj=Y3i3re==EN9cObUSCbHO`=1hl-I`#RH*`5Jgo@cH(StnCEyCN z=toSH!)7nnysh)4F^uj9PdmIHi8%zbb6GuanLQr+gOHDKLV(2rsTJkr-CtQZt((_- zdxq{X?Jv`BZo79%Z76MDVJ$dm@5^O7FD}o0%6kYoUz;bpnBdPh>g6i_)Kc}3Y>F~b z*jDm7C`AZyVffw%bFbGS(6qF)^qseXTV~eX-k?{UBuJ(g4QnKnER9rpS!&Tr;sV*V@|bABUN6_GW(iShLH5ksfq6szP0h_l68~JuA2|#p%T%2H znB=ju0@R2QE7~u=j)HU|+|W|dY|bsJ=&6O$L=32@7~-7n-__MkOievJJg~4QN&aew zIYUH6S(}fbDhzybMdilFU$pb zXCCT;A#_dzYWw)`{!PfqxpC$as2Givz@$n~!)b{WwMQh(f?ZY7 z?H>}LqYXjmSV&v|5DFdfhr;)GoEsmP>e9>UhHn8yL#x*P11LJr*sx|3cNnK^-QjW?n4VEmef{skAfeKN&M| zOx(JQtl*`dk(uLn%{j}s4!~HVSkdxlr`vCbPsw-DD&AHx7)%&2w4%Jip=9O&bhj<5 zIzPckNotK};qG?yz8tD>U4nZp@0H z-4DRy2IUv&)eO^!-KFDV2>zSB5riAS;R;gC~)9} zxi4fWp!@qmy;@dI2B_T1s@(6f03Vm%7YD63Xg*FZ@?!7ysX{%A4!sqaZMDvLq`S*& zPfRJ@hSqj3+Fdax>+8AA$(=ZD;^rY$HKja>3U5I7fQULIMZv;yoa=2v-7ky>&Wt5< zO5X1-3LFl{pVER6EMm{=rt78QB2kGh#_#)K1m8oXU~ZQUt}4aX+Z13@1S&`c=q@;*POB1mgvC!ix({#1|Aj$F7Dah?yymv z#hu5W?Y<9rxXJ+99((w2G5FwJ;@wSXxR1||70mgjQkv$0fwbhLl0UlPL^r)rbS`auq z(93Ln2YD(yA?{}@j?Fg(*jsn*l<)WkIhjUfF`ElvdT^zjF?LRB{(pl zZNMRhS@u$uGFh|dIl9|b=slJ&`yqcK{WeQZPDo_@+k7C*1YRmR($uK0;89MC!?Ev5VDKi=4FtHkrG$BJFO6iXW zR#{JNFo%1aG%Dr@z%b(Crvr-1&psW7 z^jvR3%F~A3j9GJGVPT2--wj5(-am_DiLty6fyF{cM@L`%ig?nz*RhKhT21>*QTp3YT%_I!`+O(xDK8@HCH@Ns8#Bly-< zHoIQ4Zh3J!lEj`=A!16UDt~>kJyA= zF6}lDWB#%Bn5Xw>Epo--P;g;Fr?!fQ@j7J28b9HLL%6uSZqHZxouBvn`$$d0ju?#f zGH5E5Ttqs6>CpFjr-a_E3ws=I$C+_})XcUb@c^Dombk7CmWVgzE0^}oAfgu3eO3sv z0N$Udyd$qyn@tyJU7`N|t->Rz#PO)MpwZESaZ)Q2C<*NKOAzhhSgznqlu6^*vU?9s zP7nUo#KgqzEF9QroUELx+WI3g8@zOn`?b`543QJ@riV-Jbdyt?c}l+Im-Zfx^AIAl0fdpWwjDrE23^+dHzQGOfT1tJRNF|4PiQ`VH13svhYC@3f@Mu=e99X`C}0`Bm6x!PMGd^UCB2>$eu zDfofI;SEknbQakhp?d49X+aJ9o(-WB&r#?EOZdcsPfD4|UpsITJ21Gqh9)(>!QjtG zaUa>H&U?2yw$nZvxLa%?f5*q0q~1B$Q4j{ZP~h}mIQNl#2K}Xul5{5)0@@5~{7s&@ z+5yN>F#CB)H(#d06C&lo>kQ@s^kGDc9%#-rMufgHi3c6HZGD8y6lQF3L!?kXY&R}A z=;G}XK+IUV+Uj7ZXGg!5tRSdm4Ssl-;eYvjnDOf3bM@IC$3k2!ZK$|-OlKCzs_}lC zfXCRtyiSYRN^ z-bRQ8YPcs1TA6CIzrVYIARBoEYC$)SYXR%;PzBY;Pc)UDo#EKFNuWrTT3TFi8N}Yd ztN1;7FCPG!^Wnkr4?zBOBXm3pu8W^nobicM{@G@ z4LiM3Ydwh&GAK&ma5^~h4o@PD1p*{>ZlTxS<6H(TgfDrYWdTv1m=V>}u5+AH7}@g9 zm4ytNOs)>iH;XJ$8-ERy#yF2*h{^pW4coL&G-nY9F(-OXtYL6QaDhn3;Tm26%2TIhDo+c2h&PmG_5K+c(B$?6FTT6=ln z$cB>_mzbvtg;x!Bm4Qg%-omE~0T#m1(yiGxJ73+CfuKUjkU0r7iu74OjMqXF*Ao4ArkL4a8s3P$vAl6aO6l3p@oYeycQ4>GeEq{86(|f z)ob~^C+2kie1E)lWK_xf9%Swm4q30u4IT~-f^3FQLynrx-{05EwEb)0Y6Auv!RLYR zhVeUQ4xCya>)TYifC=mG`yH7b2%ESv|DqdaHHDm~pPf~#)I`Tb3uOrYOG!=ky}Iyg zG9H18%U`nkx_0X!PLXhQbd16CK!Aa&1sv+F_wZ=W6a z+jEIQhGzj_%E^%c>l0j5>sF=MlF}{fHEtD3Mu0g4LCBErYJ88VF|AxOj&F%f@H;`K z$T$P~-1qNBEM5HNuH#%d^AM7QdW|DQCS4ht#^?eSA;XAnk!oey?*R)iR*R5W3U86$ zZZ|J&C~(A94R_tHH=Dd>@JNX5$?OODe;#@a(g-05g?4y69IdRNXn@fvsi?M_tl0-E zm5LI`k$%T$I(qsMalyuVN7d$hMR%TfgnEn7|*mWC8@;$gx%z49v@lK5cf#b%@V3= z*mdGMAy;db0c@8};WkkuLKW#L>Byk}V1P|3DQQt5M)e8aW;wn!JV3Y(_HD1p!Gan7`0B$1>BGj&4Lu>Tszg$Vv$|=-mRQ#M=7CYw)#by7 zAOJmNWay?o1CYsv#7UoMdhx`ns%jOTQXNk`u`e!8>690Ji@oWz05f;o29Y`So39#k zsCBWaBq~v#fZam?wTH7_NpmhxC^3FOsm{t);V}@-&`Y2CzHMDS7j~sszu+ zwiwei{W2kHs~aQO|McdQY-niIgeo%H=J$J_VmCK8qoSrdtQ6}W%3J2AOP8tMc@}g+ zJ`M8w9Qom8VF`9f9yfUdeWOYSqDvrS(jx7p1{DpN-KwIkdi|V8rR(ExadC+|H^~l} z5kLPpllOan`P1dn)`pqVal7rMUZYEV#uy82La1f#fr%!Z*>@)Yb);W^;T>^yD_^q1 z18V_7azL4~iPNQ6qe6*PH&`r_z`%}Pu57|fm^xyg4xckpB8YENf`*uMrc7=i-U$Jd z%N{pGFTtuQi7Lc3q807>mxecD$Ux1+P6fD{=AFoNc648fVyjCw9ISoTUawvyQb&bU}du;0&3KNio*T% z_0Cv477Z0OUDnLXzGdU}}5B&IVw-*&4H_dP+}#OEgugnNvs{w;I} zX6gbbA74!FT9dW8gM&j1sd&HI%xHhU1W9eJfamCSFPZc@2A}Uncq~bR0gFf)XLh*m z`|fVT5a2y;g{K8aS>o0-jWaEu9pM`=kXmlGTLq(dn$cGQY zISBPgxesKOThZ|`o=ojsU#6P7WKkA1%cW%EG9Tt$sWEw*276ssOaie4nYv_pK}Js2 zhq%DpaCKFMK^Pzqj&dm$@pnS>8rgg;@sdtEYgl`N+kfUe05BY&V=E@bD40bH7D0~! zsh(Cp_Lh<^Y_jll3hcK|9O-E31fGF`fhA#l)70nbP@oW00D%pxk2>xVHTnvl2mr8w zf`T@J$=7d&gw)N=1$_GgAmzqivMeX!1I7DK0@!S?0Z!8Xoj|_}K_bLUOu4uP1`tqd zmK#sN*ITq|AQ;M<;kASR*VWXe`?`>Gz21fG8x+&^{eFR9#E`yn@jWraA8iA-{4bcX zxWxBiy@q>Z;~cx0aNN_=OG`^TGqVQ3&|k~L!$XTLq(J+9*DAP^iNk=mNsSgEpo%T2 zug;QOoCM9PzTWj}3pfmvg^rH4>+9Jgnhe_hYw#d;VNIL~n<$ky7qQpP8B2Lcl}R!^5;~I=7(R68VK_ z>zqg^TY)HH7WBjU#DN3}Hz!SC*^U9@%=Yc=O*{q%6AzEijc_D?e(U$>6oz^(nim`l$~ z*G&;O8#c=n$;$J3zR+lx37VN@-ehO+_`)^H@|P zuoPrr2|RmpRz_JE?~DvQTUy+#RWy0{;GU@jLDX5Tgv;qVcxG=%LPkag?CYnlj(&)u zVEfbEMHV$=!LYo%@-RQ4si6vC@h?65?9@X1o~i#H8iPSQ$9AmYa-(M^$r=qx^pYv* zP@GJ|8*pJ(;}64mJeG5_TR#oP&_!xq!vJg@A0YFiQY^!0l>uO@q^evx0qmJ+ad>TD2mqV;bXBm`N(1eVqY+J zB~?~Z2(nr_Go78;09Z#HZ_1X8nm%=mD=RB{Df(wveluc5@N!=`|BgcjG61NytgI@4 zc`udaFFh@t=cXM3ns1m@DE8SSmp6@UD_hYF21XnkkR4+y#34Q|R)D^oMwK&s)f|WE z*qCC4N*saC^Da?u`@)r&9VajA*3OQ3);|#(;y8q+w~)8p)PJ2g5i;Z1bB^k7oY#PI zP8^%{kxc9qBS)eCz&U7X_Li|Nq`?<&7lwj5l0RcgL z1tp|SkX*ApE?RtmVdL(#9BG%DSbb~!Ts_f7ceb`*T|vI3)z1K`0&si2pLzlv@RuGyrC1e6F2-gXO{b4!$i|h)^K*&}J<>3mADp<&U596=xq> zm!M7q7Z5OORxl?a6u!x>!N3y)H7A&up(CTlsmJNMUjkgbjV$aT?vee}BKMhIYm?~C zG+<~2TMChJxGKQ!98O1pNso$-ag>QtUNyL74(>o=_Xy$O@pwT%qs4=oeDvsbp4XeK zQ|a}^)C25=0{mx+;eKHWri&T676S2Q2oTLRO@WL1^83!u&a4jCy@iC!?2*5;t!W#( z29e<+1Q;Y#Nf`sz{*8FJm~Gx?N@{8;!L)KE;HZ$$3Frp8T-Y-5G+Xt5$Xrp$2 z4j<0CR5zE(Y}zvc?>Xt&Z|dZE!J3cmTkDQid6Rs{&V(=}S1TOkm9L()EKctB?y9Hh z1`8+70)+{*EVRTu(#>3%+Wv;426Z=g|MFzF#2t*QPBu)7DZPnsq&3=Vs}4G1wn{s~~jFDy-x)nemhgc~(iw>E*3`*K7QxU*Q93Mv}XAa%I! z`EYHm&#k>J{o)Vl=DrHr+EFYn4bPGa@cw?Ew_*I=cSGoFwtl1KAfAbYH3aaU4B4ye z1yQSd_98-xdVd{S^_C%@Arotlt3?PCC(ub!-_>0mXGo^& zaLQtzxs;C7619D-|lIZRZe|cAaO(?AhZLhpHXGJ%GGJh;BJ#P9# zqR{CRq7iLqLENEfQ!-P5c~Rs^eCXsk8Yj&@wY?pg%uO+Sr$+9J#YtU^G1pSyP|c70 zFxhJq^%8+>n!@befwm_XWt=&wm?FcYWaMN#dG+G-nM7T6fmQyR6(A@9P*%#sDA3VS z=Bb*qAZ0Jk%>j~vT2`r5U=crsb`vpcKqWlFZ zgcM?i1dMC|s1N|t)1iu_A{JY^>i`3LuC%Zff`NKRM@JiGzD?}y?RU1jL`8?p5+#X} zBl*rt={o0b9%SWYf!MUPH+;X=t=(BvpD;cn%cV>{n_yj>_ht%Ru+H#HX|W=Tm2$j$ zhJ3n4^M)>q(T-CPN(`kUkLXfeyoCx>SN_z93t-C*w}-ZmI+}Pp=m?J z=su5ByBuv%C|8YDTS{L8?-jqqGhkL!j4m$=kL{_Fgp&^`IVft@Nl>U+vs@-@p(Kqw z9xiTH+Ww;2;X-P(f1~&0S|Ns8YfB}9oHg_OQw5M4!u%7*tlh!tHA@Eighm%nPe&&& zalEZfC+darRxT>6E6!V3O|a`xp^onq&G zB3mEnP^l71O;4k2+L(i`uh(`h;>#$W^Tn5kjSEZLaU!aZ?6g*k@;b8XTc$;suAM!Z zahr>ZNKZuo#G3VXTAez6wH3aAib^_ai#r=T3tJm2OBXM1XXW|S>NWfDPt7<{Yc|aS zrwIp)m|$Ijhrv$%X+rGypRy^|<_XD|$*Re}P1@5&3*lU3eFds`Sm;a+FFPwI>&?qf zCQf&Uql8$oik6a6{+w0gI!yq;IY(s7jEsD2bnJvFQ>T`e+WOWKE4Orvi-3N4MTJW{ zO)Z1MtW{QFa!WJ|aKerS%kkkM%Hhd?=S2MNr+02wRwY7i2g`2FMl-7gitF-vjy?R;8xhiaI zbQUykeq!Sq#*F)ZROjTi3@r<_${Tgp>M&wC6SGseNnV!w%bPi(y zfn*Z(NsLPY;a}tPRdarBHD!iO(i*(AY0$8de2VaH*Rr8P)g(jJ<$kyS z^Zxx}dzn&8Q}wL9^NFT|O!57Y^L06ts+WYIQTHK&eVypP8esqN1UsXvLBdcN)09Co!=X zKCy>^j|uKH2P&&A&S+_+UZ#>el)c^Uw&PLK*!bIgwzQX@=N*jreIDR%*fxi}y=7!* zCC-J=|v+#N>APha0$ zedTp<&{jV8m4iYE2gMj(Ne?P)CWrrLIt2O_zR*3E=N=-O0wPJ5+s#Ua>J#-`v1)0Y zi8-Dv5ca26q+waq0`~De`GQ$_K|B_}qO=+%iuBQhAx}a@O;u4%)%SAFxH+A(XN8}g zJ8X1-e$IkKa2k{lDNa0vU<~k#t1IT;Novs&Hmne#U`(>Wp*_;r;O68e_n#bmOsw>* z^sYaI34LZPI&z_bTXq!YE!_PRJ6uk~Coh6#Sv+rGJjc*EKRhZXzJh>_ihh26+FoA6 zVc8N+>d87*8}<QT9Io=6~5I_%r&t7uQzqMe` zzO<#~CbnO6S#A6bQ<$FjCxLWENl#HvQBze(Z}Pf~A@vD<+o^}73dL3H0cI{MY=w6AlmKE+Om z&Yy8}Hd6uFNDSsP=Iq=&x&JjI)&O%J$X=r&p%NLU>(S$vp5D8)s2-h8>-Q4cI}**= zv22moEXn1G>*TZar(-0niwv07ntK;SKn7xNJUB>0mav3*bT2Q`% z$K!c@UTc60BerO9Yk-~#AbKsTs)Ds7&$8PzU>d4D=|??03aH7FJK?_R6lS|vUc9uh z;<`Ib1b~MifG}sG%v+EgG%Dr!1nOaodoK*8i|l}JHsV8LK$=UE2^BUNU;snK1$LRZ zD*2o=7_$cFF*2DNi zh0Unt@%9!nBr3tUPqQ|sg!)$Beq>r-y?pfe+DZ7V6Bn)TZ%WdhytMQyfplhDa1 z#7GgrQ_xWXp+B?v)3fQlcH{`$6N~FLYQd6{lFVvj-RgLBj*mW9`Gl$!8S;i;awyH^ z0rQc}lKu-ieiQyC{s?KM>U@QAZsNoStp`Cv*Rl#&SUOPR6@Z71u$O+YkwC0=$@92! z7m|(yo+eEkVU$Z&JVh&$gNKElx|%Y?>x9Y((UF2f+q09}pJfmrtO@AnDE=0?s;}ji z9$4eZQ9!2t7kV8A3|JH04w3ug%s<^e*Z*cNNM9$7`5w||(xQjK;dp1~=RN(p$z$5Y z59(I|6ot+gFcHf;5da@AwZF$xcCi!r1RPH>AoSW3|KhYIweQ*c)uvNDXX>vq<8S3+ zSE*(8Wn;2%FaQWf0v3o15A8E<0?z?V$@M6^HP8i*fqdX9?B*_6g*5cL#nr#Pq!-S>fQZJ%cb|@%lNPH<%Tbi3d)mlmgVY;5zt$TTTc5)=PV?!!LP=vn; zLM>W9A@v?Him~;3yUWK{j5tzxCBpHZQ?n&D2BTU$i^zxXk{;7NA9Vt?wS>&iTh=)| zyT0?n@Qhq9R{{UX-VFXAciN?E>g13W2Do0-S83Psba}p|P=+_P*f#k`)j^^#(G+)g zZ=XC=xh%=+93rFVofgem{EF|={v$}DN>Cf-)5LrqYg!f^G;+|>+x`JpJ!kj(->f5S z|7{)lzt__^mP7z2jNm?Y|(GCr?mFO%%m{UJ}BTY~xX|ol* zW)&v#MeCQn2qlgCgzC(fW@7}%Ke(qdeZ=-MpA}NSrY9{OfsT&`G zDFEeQYZh|ol>)Jw20Pdaq}+;b8wNY@33&&68Z9{vW6_IH`NjzP4xkxjK{C?FhFB2k zi2;S$OE9^nYG0j;=F034@vi{L{7O=ud8=V3v`QoJ&>^ibe>}fz8K`n~S+sIX$xnz# zr~UKIJW)%g8Gc%0%*W6Q>&i5A#{O7NatASh5m)c5 zf$g!_6Bq)7T-GDO+yCJ{o>Bh324Z{@7Q=FR3$!l9>lV0M5vv}#^M<4d3m^y9dVc|P zPIutTefW?EX$;ofcUEZBc-GcjoShg`(H<&h+_&dfPp&fch<$SC4p$xkyy39MW%?LG zdpD!IR$=1gwXC_)>U1Yqm!o}>?J#z)gj_`5~x6k4>4|LkIDrU{c-np!7T?G`%frBEQn^2n|jX+lN#MG`L zsK6uim4#(RPYk#VRw)UCQp+Ru?fLO81jlR%cfFzbM`$mm`*p~N@yji!x?x0y(Ei4l zU>r&q%$7aUmQ^c*Q$^O*r*YizRiniKS ztX2P}kLrxZJ2f{SiyZz^z{yM)LUPfC>}G}QIl|zBjK%dgV@(=3@XpgRVXK> zLQ^TFJ`^cRCQ+-@pNPY2|Cl~OCoG?~Az7J(ItQ8j?N9g}=N?Y}*@bNRkWakxfY3Lp zZkvZz2y(>onEL||5vg`jRD`fm-EG15bobpZ^x#&EpN|+n&C%97>Yj<4VyJKk&cfI@ zfpSGe?y|BYhB){>@hdl8?WPjb=i;U5Yg2L%ND(#2%PZFz^IJbQC}yL|Lg|h5w45iV zut#<;fTE%~CI(`+q2MmzWL0NMhPa$aKmkZJ=_jI2gyX2fMfkH)T_rnpoWI~f_-QIjUQCcmfbEVKI?25^9IqBWxjHJf+1YUo~!K0(L3FX4v%X#Zd$p zb-1Zm(c*5BoUlm)SF06uUQF6pj;QRNGLAUXeHVU1^}-Itlaj@wT~9- zWU~qTtRBPU=HN2Gt-BwJih+Y4*3LkHGI#l^9*krU&}f)(U2{Wmqv0kOOkjU*O09@L zY(!oLjZFQov!KMRuTlF z4x1>g=h=Y~4`1upBJXsGCfIoSrX{Z#(SgtXq_f5j(SZjePVRh`TEB?5bbr2PDgL+l zm0qXIamg}PUuh1+uu75_B3R!LHndt1aUvdb8%#x=0KbelQw$_URpV>s;t%))-7v%j z0!%b({{h`}lz)?kq02zp4-@=EGe(V48>D$4!@OfkE3v{}Jww%iNRy+to;{Bd6!0ua ztXS!(Jajby1a80FE%wn;ld!lh=^xsfTE41j=PRn&5E##~z&1PVF%#0oBkYBJJfR~b z^}j5bw1f(O_!e?Jxh2($M3KFU7swQtOR&DT>P~^ha?g$9#bPpz^sQM0MSzCjYIVW% z5ergg;n^s2xiRRHJ#-6Qm#_CIh7rMa4AxkzbQHhq_6u4oXt!V~hhFl|x*_uk|nP&P# zQK0ZM$h4sUW<9v)(bW6bsu$r+wS6yF%Pa(c)Oj;p`5#yU3?idinRxDux)J6!1EL00 zi7`1>MU?GJZ}vh*^ehKsb)a9d_KU0rZg08}E@p4AWp0U?wh1TLxYF|?M82=qQk$a; z?ge&VdM-J1FbSI$p($*qV~O<3;Hv9Zu!?)Nw07FP=Wgt>)#vFq?n z*sG4{M2EY0yAI3m?&_{P5n-`}1ip@gmRv32z+h?DoGM?*G4BJa*Rqv4?$2OE&hQ6}J0D{SbbT z`dqu0APi^=)N{ktP86Ow(Vc#4;JV1K=beCZJcU`(RemVS19t;SRO!=Q;_Yz*QjY2; zNO`tocL8bP>|*6}x8(C>;`)8%WdWYQ9l4aW45Z}c$r-E#163{;{r3IQ_iH6nX_sE? zsG<&Cw_59Dhf03{bez{)SH}bAVy1zOYp1M~;1IA(2IQXxSrHTCk0vO>MAIaLY3PI- z{_EqobYTH%@3Ncc)eW<)hInzcdk59*#nH}LM z-w5rGPtygt3Xz`||00#HA2%(TsM|ZeH7gC(&W~sPHa#6y=g-VpPD##-3fhd{&#PtY zSJ!Ol5T|x{kfijemrH2p*0jkz*u8Y^r-_b1&zVf$ASp?QIy5EH_|gO1#`}DC(^WZk zg+z#|WNv*hg2n=Y*<#iCM*)BE-l3rB$Hwwbd34-#&T=HIbh(sy)oxp34KfEhFw_@ z6(N`9C#0Rx_^3-aJh(VOC~J^s{tR?`Y)xh%UtDwGBVW7|JhF`Umofb1vIx>B5lZXZ=q8`_(pk= zKEIHm1{aG5?^~ylF^zqQa{UE|=E#of3{A(WFS@t|U}2Lt>Pf7ss%C-dLJ2m+$`&h| z(*SkIvjNtSy<>uBS_2z9i2r;E@Ya_p(&bU=tBN^)T+=E%A_H^{^@M8mk_Tw*1DArD z^ZeCXe??c2ZZHog$dmZ~Xl!68S^zp8>*`BF8qW~jo-C}M3@rvK-5;+1ZfY0S^Q&)e zkbb<)*JV-7&1nDU(IwBWIUzL6M!!LDy``(jzvQDB0HhLQjfN6RcVJAYGI!MEfGuP2~Jj4*nBx}ZhU~ zO>808c3JKbXgS90ucC3ea;qS-A2uE|z)(v+hXvrMV>O29vC6thi9?8_6(U>fLV%_?V6ILW<{Cu$dlN`a4X4PJPgDP*nzgVcn8YKFKRDph!S{ z^o@5P;2sKdyBizqs1Ws*k5G6V1xUR+GOrl1vsQi>Nsit8lE}7U2zU|utZ=4O;z}?6 zxJ`oeY8*r{?8CvzqGr3bpL>Yf2G@_ky_>RsjTTXfp9L^0#L2mLZaOlOml#qhGtWbV z)a9ST`%JlQ0MSE#tP9LOZeO;o8KoH*VR*p`HWP?YyY>COoT=wNfkMO&V&3iDw9wNZ zKrep`^^viYFRt=I-L29agGw@%)bOH6S1}AZ_;oEwr(yFNpCIGl+RtLfYsP`*=&-f{iU??On?Vjl$17$aQm3$ zFYY=6+T!5hag~$Ib?Wb0_#BJfR_iLNOdl3aw0w=DM`?AhXO&{urLvha?c|0!Cy7PI z1~>{s;cCIU?D_8-{_8MUEiK$|>AhL|1E^V1z2^z2(uK^W)4CJdP#_| z+4uahve4MSh-S6_)>AI%OqPxQB-xI76H!=KASRj_;48)zDnQG8q}HW~a9n@a@F$-9 z!{h1uX2ION;V6brtC~M1S+wh7Yl)OcjYsl(D#%tcFK+`+oEch1OX7rk9^Kahs(xm0Vv<6zc-VMT!m{(q`Qj4 zRNGYpke-Vu{TTlEz<09|XpG^~Yy%Q$>gr<|G_Z*imqyf#I-=is6hNc$@>~RyqcqjW z|HN?!3#?%PYr~#GEKQMZ*3eWF+SAUUGE;-=n1KYnuHOzaN$Mv?8y190u-e zzG@{VI<6|6MTzNn>Txbg&U=I6_HNb*9O8Qa; ze5OMP=LphWWMzvaQoC{bd(}$r03y8FxzjxxB_L2;tbYWMAgjEK1ULgTwNg?fvM~tjAC(7c zzBQiVj6w1}=cNgd#CAq>esblAtK&_xvOa1Xc;|SY;t7h@vd6T|BJDAYR?2(n=oVB>e#kz+qUthqmFG`9dvBl zwr$%sCf_wDv*+3e`yZ^sTJ==j1xE{kypcYK-=B&0n+b(GB$frv0kar9&`r1B**|kJe?@k6wGVYI zH@3LH1W|J<6;VYD6&V1r$+{%JZ&E(1&k4i7f|`BxdCF#grwvqr-W0wB;Jxl@RuzL@ zlg_O^6(*f@2N$m~x-9Oh;Q2lgtzmvlqGO1}dQXB=rzf`kKPdG2O$R&t~o_)mvI82>;{8Pq)2Kd2R&!OX1ki zFdPG!%^QbY^0Hf80J0JT{4UVh$N5I??da{^;0rRU#FOj42w@J^|Hb8E{{OjLgF53e z7fr~U$24z{;^wzR@jbbi5XPXZT&?Ydk?B@cnSYEN?%s*C)J)?&8WuQejC7wH1}yj# ze$_d2Z|)TB`2sQ@>~Q*b`Y+FyUv`dPuD8pl3A#6ZUPdz_w`9@f*<9QzYo zVl;dyO9s)x`L2eajT{vcOTS`wEI+Va2)@Zhlo|U!CtGcOxN*a#66IRTUVaUSNvqyy zDwftqD0I3r1>dEwWMvZ--l4xiMD}DHfeIN)st*kB!s?H{8<%FnY ztYjpmM1)Is`j3{M4rr!9I%$tcbyX5?qD5Ypa+TJUhE=OUl}*N&TH71cpdV47KRwSM z$iC6p^9Cfpw&`jKvY8jeisVXBj`DE4)u-&Z55IlT~2s>RCrNYf1K9!zIUo=pR;3XK3lq-SSYn1(RjTm00*=1%dmT- zM6{>JtiTEmN4)8Pr$szbnvR7d1wv$VmH4Zq0jYR#jQmDo3&m^9L_$>#)F7tEGB8%a@Gmc)Q#C_LV&9qjfHW>QrAJ; zW^=01V8e9t&4v z>z=u=V8kSnx@_lA}Hlp3S0}yGBy@Y-7PSiAs#$yMgE|CTsPIY z;<&=KMB%DSau@X61aZiaKt808(sor^F6M92$I^QSmV||Z7U2{E0V2%Ee1n6Vl#jp% z>t^3h1;VINUiwfQ5El3Ouw*n&^IZQ4bq6~J9bB`wB~6#723xN()~nPU5v|w~sb)7p z01V7{eu0`qu~Q)Ay3UBQ({$np)}O0n=%L0F{)%IYOL)Ia|g5=_Jh;>p?OOHNL0RKw3^mi zJsXNaKmF=SzOdC9y%TG3`U39v!=r)^wF$D0cyMOl=WxBpos@!mwEv|e#x(+HBJEd& z0d`CAnY%D3B3sDs#-3gW{^l7Go7{tr(q(1BPVM@J)p)^i|GVmZ^c#ZN!?2yV ze3d;k8kTNlfF`Z@b#-PEMSq3FkpB4n73oM*WbEa_JTaolap;)?efM`89n7WE1H^ zYqqPYlJyN8su>;6$d=KSeAhdqmTSYF61@aJ(sc<^sz#!^HqbFRWHGJN-@^0(K91Q> z4xXgO6*)YU?akhtG2DgzM927)GZb##w3l)FQ8gd+W!g4Ep44ie&m|QZ?BemGrgZw94DXHj@z{)3 zZp8s=S_@^bbYBu>diGL?)xA%{gFA23u`d{!d|Tc(sF-WKGIdd@!yCMOw=NOl06oD#drj8KXk zN~_~FyjUW0S;6rc_u?2tcHtN8MhM6CvWlYM+Fp@8W_%pKjzYqfEgBatCatZF8hl{{ z>MKVh4nw3%q@qm%C&F4172c)#&j=$CTZKHHHTSyAFK>teW2M+-8&_;RfQT%TY@=C} zvSm%o8pM&w*aC4{u!YOr5;l!VCw%4QYv)Hc@GoY7TTL*XM@GFTS+bHx?(sIb{rzVq z+KHB8(r6A~Rw=ajKm{l9 znYq^9a-=%X*3_2fSE_~nB8DDK(n}^ zHl?YFVRlJ^jHZRBuC16+knetxy8{W~!KNgK7wdND%rq5CeTXck8p*O-%lX<+opPMV zX|Bia5=WJFBF({FSz9G%x`DwjHHANmZ0(S(gn4GyXu^KNfav2Re2u+)J_32N-0wuY zS>sdonLP6?A4ts>TyISECMK!%bDy^m?Ax5TknQ)F zx6lR5cof;4{8~Rr(V_h+EI>Fv@*hgH;+AfBNIT@u01p7ttM5U~6`En91DKEYMNK>i zb{OD0up8O9AN;dBzV&Eadqw*-;^bZJF&1^~RA;a$Kz4wpUmpIt;H`m0hb*MuquVp3 zs7JLqd@Q$cgA}&&@`NFBelD9c(9-IavV+$Kn{Xp)oN4NA3}TcS?!cMR20zc`*TKh< zs_yM0(1`5W;}z?j#Sr`IW~eXzWU}i(HC+f+@-RxmQdq4^a%&HjdKK3|+vMYcWbh$D zaa8yBSI@?_Z<(%)J)B(EH7jkE4z>3gQo9KiyC1dw7tNu(8#~YVDb9)tCg95l+~rJ8 zKAp}!rqHbPf=<}?ci!=>b@X#!x4pSYvKY8ZOcGa?5<4|m!h zhwza3Az1#b#tvujvVeU(s;ggte+kK!D9r5IB#6S^%OopkGoOd6NtOfa=`k;MdOo2o z^bAZvb54kKwTGc@cNy>;qq*$`*G=wB_S^pAHY_nnaD&dLOAf=I|ASB|#f6jt>~HH0~Yh_H`IkhT@YT8fJ3`dP9QB&+csA@UM&@ck~26GhAEl~x{Xg{bbOR5jN5Ff z>Xz_N_dbwz2;VzM2nA7}@V4i>dm$BKop;9{5QiajQ+LQbLdhBfuj+OU=?hOeWhCzZ z2X^Kfw&Tf-+IOaLfUViU*6qTwWo=KU<}}vJ9S|AjG4{2B3^DWd#Ey;CLDmM%uP3nZ z78>V}s2&LNsxxwT@^T#a@jCt^;&1ZGBL16*=lGvQJO>x&{};MgsWTcw(u&;q{=>pf z?$46S%?-f0lR1q%W~BK3ii?6`9w9B9I1|o~FGNcP)5UvxT&}bF(hr9&S8bLU9?6&5W~d|2p2!!OUM8!TiMqG>nRv%RCham|$g< z_ui4edkXvZ?YUPu67%^?`<(Z-SgFVx6DBF<70S`vw1~r|M*+)%jNYm$d*`1 z28srHm~_m)7%<{tS?G5i#n(A;bsN>!ZQ&kv39NuVx6an-(vv!IGChDw4wpgQOe=2H z5)*cJ`3tjiKX2~!!`pB7wlJ{UFco+1O0Yo-_G+1Mf8gEKd!E=PReX|q{h%M3G~`?h zJ6>NROG#@9pUY&-3w(_f>m4jUV7d?AtEvH<(pLFYVoly0Wgp5B^%nHY4pxO=lyyh5 zNNB+KZ zpdw}9TNkksCe3uu$S?CWOgoq}@fhhwD z-%#63n~`Yp8-wQ!wyO%kK<;l^Xk&4!NKn_5b@(9?eIm7Fn53A;4uli?};|W`8?&n()x`uI9F8yyZ zfj3m1Fwc)0KT(Iis9`I_!v%%6DQ6c*t+TgaMro!qIVC5q$!B>&g3@b=fugm?bjJ79I~0Psu=rNkTQE zS&e;qV#<8TXNZUZxQ?4t7YiPRyt6U{k7}Y-j02bA%tl=Gzc*9%|ARy&JYIO=o)PpKA45=a&)ot{T z0uV{^+asuS5WZLa*x!>}(jwLHQ;Ph7^$=+Yi5?YIw5~6#pO7|l&-yI_QgQTr^8lgr z_du?9gpOH`1TT~;4nh11ft%IdOZ>Kw2H@~m+tA5j(+g;5*Si-Cf zDUeutPaZ1hS&$dm5$_(^r{mw3Y$#wU?ld$b!d^8g1YO=h>@ex*z2ZJSCq`&Bs0iUU zC!z!eKBV|<%MhEwwv9ch4DXV_a=Tk- z>=_e8KDn$+l;TOy#=N3+sKndG9u8EC@Cy;P_* zg}j=esQLhR9CAXc<2k6pHpYp1B-_g2I7eJF@q>A0WIek0nj=4`HQ1iYVk%)j!2=8qf@v?{AHoB;t@#&|aYJ>Mf9wqP$L zcm*{)GrM^llj^&}nwJY95`NC0!iKLP`&}jceR0YJnkKbwz~{t z*a#w1N)4px?0|blPb^Iq48$@CWs=8!{^gxhmuAicpKkn`5P^b==oOJ#-&%`~Cl4=o zp+}5tsSX8uhg9H}9FSdWlw)s{*Ua+;oG1*;C~B|niEei@7SY=+ATzwDB`rP}zHkfW z-9$0&XNRRi&83X?y!9-jzQuq{yL#LIqvc(NHTdhcRME7SA802tw8cvqOO~shYt#`K zpKT2Fv~=!vS!brltW=+!Ge1=uQDrXfb0@fFpc^i((aS+aqo7s^Br}FTQrhJn~cI~GbD07i;LTBYS3#lF_ej9$-Z8DsL zY!3W^-rV|jRxX}=lit}3`x&fl%DDYN5Qop9(ZAm)yUt6m7PVlsx@L+5PXBrfV>hxD zOgImAw|Yr@0ny}Z)l?GcAb;C@r}uE0N;qdecf$PBG2O!8!yf!4QdJjg-Hy>$?y*w- z1k@xJ(|jN88hI1LdxfL%I$^6b4BoL%=e@Z6(Fg=WTr?$WN2^f0n zn=POOIsCa0!VR0Ih`Vy|0j{Kw{LD1Xq9i$&SJn>C8<-`iHqOsChRI?v^*!S!(p(oL zZ@^f;XNQ*l6+3J69`uq|v!$l&)L`pCWe`8iSX-ZCY5!YE5F|2cclETFe$UP)tm6%m zdF0p3#9w4pf0*Iz4pTob@?1#OnRni7i%3}-zH6Oc@`BeHgYVo@AV1ZPUb7{PyS3}w zqa`}fl%dhdr>f&$Gts@PDDP;Il}SC$*c%cBj%k&#*)-XRKYDf>&7e{u1?Bvryjo zF4Cxnnx}XhhS?dOm^f=j5+ey?q=Q=dt{`);q0!{_rtmAC){9 z^I#sjSYEmH=Ih7)NST*FHI|am&1~*v2VcoIKBP-gegYeo%~-!GbiK!BAS23b^l{Prtv>SGhHhX z_%FCWa4+nDZ8(B5X=wxAP_EZ!Ic5xqbXh7j`}|o&szjTLYw*%>0!(kE*PJdeCun{; zCcQ47X~eIL?{Ayu*JFZI10OvGZ8|A3@7G$rt%o*Ebow>gwaoF@b%Cwqxi4$AuZAn@ zv0|oIhh%|%wbbjk^R|@X+OJphiqUOVRqg|bQs;%0T4(7(ldtQfrCP5P{H6!Z`({Kh zkA14SS-7=DH*=fo`xTFKOqc%Z%sKP+AFSUt{nP+0W+oZXx{8~o+0{Rz%tEUxkKy!( zVZQJ0fN2Fi$k*{$kehlxJ4Q z8+@->m2{B?QBP>F_~F2_XRRVchee8})K}zXk5?w?BL?dJm5OmC(oHj%%b_9IU(kph zdz_5Mys&MuVJoBy9#Tyh+xEmKQlv*_DQZmL(b_CN=RvB07tT=LX>;vr zMWh~?@0HX^Hh>Or7lmJnBQG1LnYms`eGb6jdwU6tzOs#fTHJD{3L~DPmN<2gJFYRm z?6Nct`xun##U^go)^DV;<4`=;d5}S92}IU#q?{>z)P}NccVZ<)Ck+OkrieAyPE8Yp zj2p_8V3Nt)F#6c=wEtRoW;$_XUBj)8v3K;aTf((iI!{^TL~vNtfA;U7&gf&36w-9{ zF+SkWz{rHSy{F&H7cpxg*R0bWo7r5KqeKWrqKbxx2^9nFn~F6qevE)q#)2yr8gs7= zgj+Opj*_XfYDi<{R2>n=<_%Kv;~IXk)ZC>N9aKk)~KrFhjl{;zK&tVkKJa#?uui z0t7blBlI$Yaq?H)qi#*bDb*)zIC?vn!{$NED;YtT%gtViwn(KiZ=* zNY5x?j>tQ^LR`aAWhtQ{i^#_moed?Eg_$OKXc`dool=A=NVCX9JQ zsLvOyDTzeVA6bm0|I4PZHb~yEf??^`8at2*{5ySa4c%$FhDg4{A2#QUjtup$0LXH_ zo<~tO;5s#SI-<-UPetAP->SN1?n|Y+bP0`N;1VfY!Gy%bHM?O}K!`d_1d^>QDX-(v zg(k@qtSYFVc1AA3G>aE2*RcOyVlnGx&q<$1h!VCWBiG0mk@;=HrQleV$hKo<>6AS* za=^fIToN2kGLNYH5&!%cl)ZlCZ_9(fFU|qMlICN-;>~^t%=~C}h{4QnyF*sXq0W6#;)`5QBi)S`k7H={NLm$If23v_o) zvGdlsOMH!rkOcv+z6x$)lO^hI&ZF24{uO6>-ZO27V&Tv@ezL<|(9^0^2FNBy< z-jp$=W!&>A|%BhEvC_64}_QZzj96n=bi zHJbBqg9yW3P4uk<=QoYRCD6KIF!5k2VMJhDu(w}89PdogR7;;yk`0iYy>DuG2u@s& zg&drlshfsUB60IPC7P&tzT%8ZT`_?g8qIXY)9MARbz}6KdG@XR;@r)aV;~56t|dt` zF-%;B&4!y0$C@I_>^W7lyqcq8(KD71r*S%DHckqBpQ5*qxG*#O%jDpMr;eIgojbgejJ z(lsQIB>hmf6YOkUUzKB$?$jn(iD3zYj;@9lZ`ALy(Bj6Kz2q7)6h=ShVAO5Vh$YCw zGVaZ|`ASZ_CTV;9p?} zb~{bPJSg4M4GknwIFE;1SK|7B3vTQyu=|lH!s<%Iw{d5OzG}yN68gEd26=}ZU5xa0 zZa=%s#(Ja#iXV=ZZslRpMW$TgxJeQr!4evo0XFCXAkJ*5+c_baVEH0eCfeYIb&Zk+ zu3&NMkAii<>cE806kv#xHXdU&5`)!3?a1&1Vr@gZnbD)f`~B?{W4an;2#KIOjJdA9 zb;j09FDx?vY|4p~tv6=&6x&Q1_tqlh@)%Pi@2-Ngr}hw2p7>&1jj$Mx44ttI`U6;+m3CBNGOvel z+mCL%qUpV*>Iyp|;q{Lc#rh)JD(|^q{f&R~`wPVfb%H_5`L)0_J*4~Prn(vo4}S6h zR&MmK2N$z@Fo%xIY=LxS3>q8j@s4z)+U{%-3=@WLLtWlM8H@L!@2(W~*gKn5FfoQ1 zoxdK8%PI*;I2m~p&MhIWejCiW6tma!wG489kNv`XqN8TXYr)5tt+!!a4M22p8MWU& zTBTFQk`8ge`zXX4d_I+hid1Tcb=e26G$hc#tM#|zsog!Ol_}T?bKuTHJ(Qx?;*x*T ze5j{RfQLwo0I+pAjzEgL9Ck*!LMFq_W_j>A&Yg8T{sRPIg_BXl{|An?_{CagP4e$8xXnRF>mKV0Xb~X@}|=Amz&=|j4ArD6W<2@truSX*wl6DcG9JVYdvRgbP4RHH>)YsG;)+r03o9s)>0;PSvS`pDCZr2NUZ2#WD_b`TCZWP|sj;t@kn zN2K5U&}XEjF&{>&+;7K&z3qAPP=QYr-234jF6C_Ga>>#Fj(@WO(%n{yG!_VH)yN4tw&p6pXk85pBj5-OlDYG{?hte0R6? zhQ4P73>N19NSRma^2DCEAz$6od_XSk%Ai4G(Swiz&*>dF z3&C7#ODF1VQ2Pp?9rqH6jm~*E0t|IfMt6C;v16X@hQ$n2--;RXTch~(MLN7bv*|zh zKEJ2W?isr2eZSTLvu8MJ3#kV8ha!j?<0$^4b=nTPXf4|;{u zw^gazZ|D59sUlx*Mio-ss)`=6hy!N1L;mBrEpW2mS##X9Ipa|6QCM@;kow+tD2_JZ zmv=w6t9L7VzGYFq+vAFc^y}}h$Jj^~qT4}ogr27bFx4VtoTgUZj1c*j1RvScZ%i+r zGu}}HU%TJQ{NF9Qc5wZNz7vbLWpmft3{&stNVH#H*M~W&+wvpi$S%=LNRR0@f~~i( z)9DI5C@&+j+E1hdFC)zYQPT=oJ4MvIED=S6(^Qf0q9=yww9?=p<9R`&w9`pdFTtfE zTTATFliJOI_!6%jkpWObhS@sHBx#T*4HnTlZuNr)7kQ@vWLfCZLK<`- zri**-*b!ACx^^5A3?qZd^3B=C*VFYiHC`#=akQ>#pY-*L0MYo3Ftrl{ z1TJ#ctM;b?pc=MVJnx$=qZn!F$opL2_7q~gUx; z3++D!eUh~-y}W|#rxD-wO;iO;hv_9P%<#&Te~s~R!!c=}GnEszMbN1Gp7GKz_!-2_ z5;+9FK>9&+Tba9iSQr9Rs{?emhcv*BqhM)AR|0C7lhidd#ZuN0PTsMj;}Dc0;a zBdO4qNJ)^ijC5$Zd({Z{bb_DGy!7)2Lqa`N<@5bow8{|AW<(Dt36FWZ2ROSylftPWXBVn zaDt@b!S5jYqerKNU8<)TM-X}RZma{Y7^1u*cZ=nrTvam_v`qMh*50>>5(}@b=M4JPR z`mCDFw_lqnL>*9WXZ1W=0cp`VOuOMRLyCfA^R<|?h+6 zBZ~7^?x#Xs7jbd?L1-92l665Qc)g_XAA z!%#+PT%#o>3ozby-My`Up`a`!>wD#Nj)NoQ${cEpK0txLpi^%B4(sPA*N{|dURf7= z2cn#`*On-ej0}EUXz|td1l3KpGhrT%G39XIDsed_3bUJ{GtY%=ik$Vps_nRxK#0pN z7vas!ng6}oS9&C2(*b1Rfpiwq2mCJx?}Am9qCP_l%WE)HZ6GNfX#~L9xHT-y-paPO ziLHWEZvhY7qL@^p0x2{{)%r|4EmG6|57WbXu4gYD6@V>WsEQ?JmhPUo^qR%&5S#uN zZ~X!h*JxdziXM{*NPQu@9N&f4k%adri6u)LVU40=q)tcc>m zYHHp3AXXIq{x?!atX1`&F`^tnNqm^I6=0jMRfv#vMMq5~OqqyIfDkymBxiM&EuDwI zJFAY_nMs5f+J|Xt2Sq^D5nnej!{|xhvKUO%)FDvpb~=awu){lxYCo<`{eEfPKLD~G zRq9<*TB;Zu36x5-3A4wGQl1GU-ix^sLZDgib*zX|WcjyYLRL$Y)=~eN5Y17KLmQ@Q z(>kL{zHZ%#sh|xw$c`KsuR=GzX8Ac{n{O!5Gne)_vLg`YFAD)FuQhfGS>gpOIL!`~rSXg)Ih0S9VJyjN&aLfPS%In+_s)+`xC8pk3U8Zip+o$7m^YDCp8rA2Uj8!Nu!s{F0(n zQY(5u3{fROk!4f5L-N4r&LM=c0m>rd)bg|`Q0-VVoOAtkw|#E=o?HW)hqu7m&&9@f zZnfyigj=y>nwEo%MsVhR>nRx0>E4?BikdP-s$(uDhf}+HpAH|A9%Qe~xuTYX@3QE!5 z)udXUP{)?jEWYwGMHQEiN+$BM!R{&+g^y=h+Wy}EQvvy_*ta+mJz?hAsGgGo<{xtW zqHeZ!S(~S08#gP=SMWaJU+fS1za>R^Dszhm`9VX% zui^I@Bb@pbY)si!e_+2VdG|uy8@BleH@#RmmYjUIr!8wEhd~JlA|-fPRyg_Uy=*(? z@h|r9f&AsvGk8meGEZA|limO5Z8tvZXEd>^dt*+!gqlHiB*#uh!q%M6NwqyI z_xkukI`3|Q8ssh+dfPD1v`DK_AVA8i5*~+>{6m571%sBoMh|Set#v;o@5aw(&^E|| zt@YqDuQ@9l>S16oG6|#dNMrMVFD4d+$>*0_4==>c=SWbt# zU(%Y0##-$OETr~yp@F{syJCtdZMOl3 zJKLg@s2H_sFOawK^2@n$pYr!KQ_T2bvIe0qP5kSV3@`QAvOby#yfUbxVT4=kkgBAv z{FBN}OPdKu$`MO7VL(7cXOm{v*yk-ZK5CV12vgaR(`L`2xG?&93?I6EIW=_P_Eoqb zCP@{z91(CXIr8P&T#e(Kb5^}wmLJzm$okWLjmz7~g@h847!p-X^1spzwI(_H<)US{u2Bo}DSKO2nZO{`! zM4&w%Pv|bxzXP9t=4AA|%+3y;9=2|Oe_!HxTPs6rXk@$1XmLoy)@h3)_}0q|XR_P| zzVS2Ga^d@wx$<@UPo9VeP6~4b{PJZ&DdxlTpH%pj6FCpv{plm-kL>j?P;2a;(zO`u zU*AKox5I_GfP9at5&II+&%I5Zp|$L^^rpc}Dg#7bGfiE@zQ4IJ+|@WB5BpaOmDEgb z35L8t)#Z%Wk6JyZo{J)X@|FPw2m_d;PoB5I7pPJvm<*2T`e@4M{2Dqr^bYuHzngnw zS=vu<*-AQj6H(ZiOYj45o&EJS7xKyljK~X9ZuZD3f%6YBY(SCbZI1-E zFIdrS)O6o5kOpVpRIyL@%>thUfz>x9|LqI)KT$ZCIk^7gN>iyL6?@K((luQ@Lr~Kv zr|TDj2ucb%K_|H#z~#KIPCrUi{Q6T*5UXn$Nyv^4g>YtgL!e*d^G2zvC2&jtnXJ^@jG!XXU9iF__VUJZ2P ze|^LAcf0Ez98b$t6-{>+YjL;BeoyPNvD|lmXCy7%8Baj~Z{qL3vfEo%54+qybPYzwR z9BY0oig@MI%`K3&y`0h=kID-Wrm9{_Le-w2rYeoFSWJhH2gl$9>`wWk1Q~qMG;eFz z3qU~^l~~{v-LwuK$BwKaTbU4XF|nA~>`g(9y4T)>Qs{BRvo~AF3n5^Z=8J-*LC`?N zHP5`fN-7U4$TT}_wKmk4O7_Lj07f{wzui}2IDKFR;uPInN@P`y?AIY!fPwmIiNJ8hY zQF6KUz@QCo-N)|utYf~aahY-lO%kZ6$$j~^0fBBrR5$?(pOf<*>NQZh2c^-}DH)Ly zr3RD2qIyIn15-}M`b_P<&Q)VMj6iBUh^%ifmwU7bK#&*+1cj*%r%yndZWSyEZc&9x}xTv^7_zwTp$$`G<(mCm3M)-tUf@hv2X4M?pVWpr*|hbUq|FR5c`fo2K<9${MF#cGGenzuT{FP>wlyO8>me% zw7vWG=#64~BhNVr@YB0hqePWcHt6%^TM!G`6QnTMQ2PsV4r7$(B1RqnQuT6Lmlk0h zQ5e1`4CZOUVfdvUa?H)4n3ppeq8AXAw;pZ^O6f`T(DccEs%+xy*ooKXoZPbKD7{im z9Yx;bz!b3E%M@^|JGR{L+<8Y#rYIqQP|rt*?wE!lE&l0w1S{3HTnn)iL>&0nN++Wv z)EN@xajQ#8uMx#pnk%zKuMl{Uc_#BR%Suo~zDfF(oJbC_(Qxn}V+8edd>-jDKQd)5 z_!+@N>d2i$WI5W*TU2?9wGBc+RO$v{5uv|=j<)E1XVP==T3J61Z7#v~L7#R*$MUyH z!`l!%S;F|NOW5_2MDE%VoqAu{$>K?-@H_Y!$3x*-+|Fu-b5&sqyTLQfx-y2OcpRjR zJW&_lqJf(zu)P&dxQD+B&(f+IUb2lTRiZ+Tq@zUw?jA(RIn!=o(eGLpC^;>z3wMX8 zUL;6paRN~=u6o(A7B4i&sEx}rm0HIs2ZnouC~#}=C|p(h zqC150K9IT%o-x+1LsffW$8keKt7tI=bM|B_iockL5z+u9{5vyC;askb^3aiFw^9}M zx;OGLyHM>gQ68E{4F%RGoFsR=T*(Oiyu21FP#{2Iah-;a$b51&$ldczJw~)v^&3Af zWsYBRA<8}Rgrli@{2Lf6ZFHJge5EX#nx-vR(#;_wU79VDxaOWNpZpqrddOx1Pi#^_ zU$liK(G=W(5AUIR1J;8meP2UO zD`P3TiW+)p3VWq^5`|&Bh~c{bNWb(y3NWW^lkydnawi0Io?x=$k%R1+Q!E-2zb6M1 z+FsR!@{WynT)Y|pl?F462(lb!_0X&$#=wzb(y2ms+UR5?3jIp^cN*rDN{-S78$ww} zK-wemZ-zQ@?s21TgClGL?WVfmkT56YHGEhcbPZNQtsURlIZoi^;8~Le)=LdPG+fL^;0pC7K6XK;%t@C(S#ecT7k%ny$+#70v?0^h5y<==&vSjCj%hG znlKIy`MX)^&cqJUa1m_n-=IL{)J)clEX$#V&bbH>WzBZ79LsL321H)=C0h^@22{iB zS;DCIP^51S2XX7gd=U@)hf?4`-AsQmN!!92{nK+E9umvrT<-C#)UFF2PwjA94PG#* z{tAU&s})<Lh{pin`9FP*z@_Z@?*-58*$b`y+;g$fI5!eF4wcrUeLTijZ9Qe@iEvN?q`&k?6}Z~oPz$(vq8M;+kyMOc zE9*_B`D9?odLR@QH-w0Q{x7CifLjR#2iP3IRcLw~YR}_?$T<8itdS?fnjg-}9$wnK z>*YElX~I>Nx!fK3@Qwbi3gIw(X~R3r%~o8jExT3OOvKHwKc@Pt;asil;5Ybp?pYui z*&E^2)?X38kEwO=c9;9L6NAxs%G{&w88y=Gnntw@w`;}@d#yaBm&D|Lb|fsUcbu>u z40)BDj-UMI4?74Pt7H*p-~{rz7@1a>)Y8#5&tEeAh0WueEZsMGw16gGj@QL-u_2^b z(s~JuTE4UDyz5d_NLP$?evNJ3CKGufbS(p?4cIq6GHzWNLi9u=%*sy3oZ^?&(Cx{s z42be7b-s^W(K^opp??w!<^@)lj_(U;2KSI}!b1`%l-B5*?>@wa zIn1CzaBAJBOZk^s8g!m^Xno)ht(&PEwf^hV9Zk1#9E)o&ZzFPWY#2<>%vM6aO1EE& zi&s_JinSE<@n8QtXN59$h+K1Zy1jex9h{(@qJ_(*7j;mtR$>BhEYqp_zAuSHwl)9z z6|CyR`bARubieHT3CiR=>;K=x^8ZG);bi%b9zdhcxcx=T|6AtO?r)atIT7=d^}B$$ zr60+=w4WrePgC;|AT5ueDcIRl^Cd?JM84=c zFn`huIIwp&54Gi&KJay4}FVEp3bvO&RB&+cW>Ta=G!7axyF(E zs_1;;FQ@3pEP(oM2C1%JZeM@5U>)Y`Iwt|uP-F|5{U!3B{J$E&p8VZc)VILyE7AQA z*JeAJn(w=Vmiv$At3&)*TiDAx0p|XOap%zXx6|wKVKc)CIZ9*DPPhkr-6F9vuCqGg zh?weCa!>Kk&?^m4l96DI78N4}eL-6=h>j^8P895%=o;S`K@hfqwW@|bUFU2{h?q`7 z6S7Aw9g+{_1+QacazolAXm+K$sQsaiNotE5s~~n7-rQByuUp@O;;V!KbYGT5#zLKX zql7r~x%p4oJFtu_^vnunQ4+_+NMpvGaqOc2VZD+i0e zaHO6%6H3Sx*X&Jw3)>-u@~ls{42#EcT2%^S20b>foEn4 za{Q(nY7K@hB=6WAJ+#;M6CDi9yJWi=$22IM;F+i6SMXoh%-Q$#4>ulTj zcXdMtv@2910*LJDBKB5!R#t&9hB~5QMe%51=`#y9Ob0L`GmS}~<-7B!96YY=kmZH7 z$fA8IhN-PEEJjd4expO78k-l+SQM{fvdtgtfzYB5uNlw&q0o6IB#9Wg?bKVuylZ0i zxRoa!?Nzfw_(LfqdnnB$g%s^)5^Of+P0<<9!UDv2fTa!hlV8jiY-du)4vd z9B{O9-qRC*HCw0+;4Cm|<qLgF&>l!j0K6ks~@Dz$1^IPccvZJ%A+{JDO8ris=QhMOd!f2_S-?n zXFKZ(GZRyAFJK($CSvOGTxNW^?T=`kzxo8gyI=7W`?;O!qBQOXdKRAbeJv0`NA!y$ z%;1sIN_J|$s*~a668A+g(^^C_GMmRX{l9aID;NQir^)jP-ujwoMY$ThY+M&;E;*3; z$8QGadd}o!6=1G}BOQ_<9a>$FxXtgj#pKa(v)W!LhRttIU6~pvYyO|ne{hQn^m@bU|8h; zGz>sbYSXUNDhK;~+NPE*PXP5E9^L83MJre#^zz?@ErK80eU{?Sa4lhEg!;GA#ZR?$ z-4v5u6&J1!uE;I{!Udl{{G=zhDZYtZ)}^$WOlT9`nKp2h^P1{Nak&`CiwU zgA2AQIP4_eM|3VT0yy1DJ#G^h%xU1|>e?_}I&o^|ePuqwikw`v2m0X8miJ8*bz4yG zI-#go#xa3mjr$!iPiBev!UlCR}R|G1i8#oS6af!#K`J!1h zWoNmtOoJRRlo=9dHg_?~cws>T-dQ&ZH0l27U+RsihX*s%W!pUyjR1p&BD8-k?u1ES zlQHPSfaT&5Am#}2a_t=1AHAn&kfJ4!fXzSFsGI+@e)Fd7hc;RD;$vqd#7f;726^3i zqW#!N4F#O+RC-&ia)r3l83a?dLyDiA<8%rLRG66DAKShZhN^}jp>bs;%ImOIutaJz z6lZWcO?q3TQl%}?oTlWYkCmCxbuCg~iMo0Bi5gPYfg&d(piuoDa9E7?ISROR3DHyF zl*|{mLVJ{((|!(Msgmd~jagw)C1f^9RNPl%!w}e^v+Mk0yPz5g*A**=j>XGD?8bR8 ze>V|{*nY3Y{W>lYg71Zl89!6J0 zfFi37{zM7ht0V##%yE_!$aCP?mF(u$f%!JA9zsM%PySbDxq6#3Elw=$74eyNk+{TM zOHRMtI_J9DOf7z^=44rb&9pv60B>x}=#4+Mm}oZ$J41#+l30P=K}`bdMb#4dDme8c z=eNE`7@2%T_ZmZkzN>5` zcU9@*-xF;5`mS1&Wb;gIc#+{NR#-hmD}sJxyi+Re94qtvOP@d`{5tV4THzLLr)Hiy zUwM0KM*3cYi<1LQzXe+9Eati^MY@2p)f2)2m@& zvoN_}IQ^y7iqzhkAXaoYtUljc>d;&g?&Nd=dqMJqrPJp0_6FqcUh8K5r5b4YzRqYR zBZ-qby|rl7j)N2S3!CM2^?J8|?@3D@*ogKmuVhZER`0Y1S+cCB=xO$pj=UX*L1-8#!6C~-{ z{CqzzM=l^78SnwKbG`S-3ql7iP739p1$Zi6!M}VCo`q6Ge;#bqDxW_tMbeSCkNK!q z@QJs69UFF_(O|cKKObJF=IGAGAyBSCLrE1Q*}+@9YsFe>%98)V;3y?u-4@TGm6J(& zxbJMzJG-@%sPC&}Zk?j;NyazJOLf)O$~QPFgbfVlAa!wtcFR2?Jg8Xxlr2ONDL$`^ zEu+ghl;E9?BJ^}CZqTlk+?36%*N-@>B2xYD$yO{47HAaErv#6}M64E71w7?5q!cnu zc;Ik2%Rm*&w4pfQNGf(N{zcEF2Ho8N^&D?0^SVw0mOF^kGtk$F7VTMFEkQ}0bZu7k zsB3MtuqzEK0Z*6RU!m)n@g-TH&Gm+lOX7`q!TM7$XT7T>WcABg!{Sgq7g7wHrErKL zV1ts&&4XDBDxeSIyAAYHt!lb}@dET3o2nT;Hiz&4=9Sy#L6!wK+!1>@&w4JJGflGx zPyM8kDpN)Mjg5K41>dy?r*% z2NK{Wh+3Ps;FiSqwJZiw+I}(IN4DzXZn&S)1@i&CGZ0+Jl%9@W!M1J!O?)-eb`@?X z6V?^`OYBnm9N{faG#RX=+m+r)lE>M|UL~WH%3=aZ0>EMqb zg;U8>+NsiOP)m7GHMdx~>oSq8*MO!*biNK?{@qL|Z8vmi(JTpT6q;xVT2|ivXgef4 zWhwjGKqZ5nZ1dGgUCBDLv969coyU(obuJy#^aL05V!Um0;+S)*!WixNm|$TZu#s^Y z?NHWrSq0k``-GQcN6<0RX>XnCRBf&$_>!;-s_GIf;7kGE&^95W^57})<%WUfD{QMH z)Qt^;ncyC)6G8S(;ua6eQ&LbPiVq^h(l}q!b87gz=0=2&Nf=wGRr(}cM<1|d$^?Kb zhMnJ-Wp&fo??G(kjXzWXr&@(6&J_Xtu0UgDX>|)5o90o?2{QG8f(IC^=3b}wfG{qo z@r>1~b_WNegMQ5Fu4dyZuUSH#!w50Sjj@ko(=8=^+{-9UA7P=ZY((A&%nCu<6L;8e zxayRy@fgW-Ezb$Z%~Xq0!?;-pBN$rZQoLdHG#de01Ilg~8j+Qxg5;vWi+SiY3pHE1tUma`c*^5SX9U%o6=cheKZ zyHBH?IgJ4x(?RNzT>B2T?Et2&+P-r?H8db~@3sdiB9Da@6d#Q(N0zxql3j(uq^M4i zTbqd4f|S?tToGCd4GwKV{-DS7jcaqAlS&z|j8b)>f!H!f(vT1hOX$!L0UfggA1FR; zm#D9QKkI6+E%Q0Ef=iNM+bTi2=n#`+l){-Xp^4phGM*}F>&SaEDpQGlE6o7lET7nw zcfl5dTW+9RMO8rCZhEoIO9c8=` zGl7yZeRzsMMKh8iUnYZrpFS7I`^qzi1|oC+*2Oz@jPGO#@(`9|F_eDf!#D)5VnqHR zruPolyvMxaQo{+vjkPTK@*m2KkqSG`It`DyL+bZTcW55}ijBaL-sPYi(J9b9*OHSr zG_A=f;nXcfQmemEKrRv`h84VqmH3ScHhK3qiUf>{sDyTZw%N2qWAHB7563ub-Wzzu z=@&MGw)jxl4}d$3?L{AC45jFlighfRCwNrs%5!klZA5xMPLNr4F$E4j$fSKzp{_5A zl%x6tEuLIAL-3VECz-ev1FgI$d!(!|q;cDCA)r{d)GQVPy)GR)3h4Y8)r4$rO%P(w zDB+W8!2g!bB&|5W^O#CS)ZzAzOJcW{nx{}!Yk6iQ^)KD;Z>Zebhcf8oofljKxfjx9 zS!=W6vO(i;GPcP(9OCM#!XYZ9LDBsz_;0n7$OqwSpi zk#T>W2%@(U!7_v!`qt^p*As8ifNlEY4Mpri?`RhH-lC3>uxv|?=+sfW?((esiHkF6 z9_K6=rq}Hxuj>>jnz)^sH}02=0TCZLC=9nntEQ|=S+ zs(a}2y>sN{eoCV2^sc>n(#NGEm4iW|gzIj#Np1jn=Xt?uNRYq@U

fydaIF^D|8!OB>dB3raKmE!yPnxP+q zGRm~>a||E!JWr;~!#z@uNs42HUWu!|#$35ZC<*s{$q^^|H61KVyP4x?bGWlAB<7L* z6Kn0N(^yg_VJtzQ3H^_6Cj7uSTex1Y&&usGv}S0cLCf1z&2fMpF8Yi|iUwk-3gJs^?&+ z{>gz4)`2PebIYA@KaYAFBtMoy#>f6)$K(m=XXt$Dy_w?Nqkuvu zIM45gkT@G8D^95K+6Ryme+4Bf$hZqiv;mnRn;-52EAo-IsoR4_-@67Pj9;~#o2Y8x zsy$5HaMV@w67~QP?jQ&1*diO*KHJp?QFpP05JC~UK^z#RH#pyWaofKXgt!CK9$D&f z`-0C)LD^Jwn(!?>qk^n-smrnZX6bV>ey)ODSZ66Qql$#3)!4>q- zZ^`J#KAy5sB4FTq7fh5y8a9C6L5W;mJv!6G`YKOO(e$Twg&a8DwkZ{==Us<@uKG;a zsiH*>gL*b(tm(e#(H`~^$L{#`{HWh`_2wJ@(hG}Mbk4P{k|UB>$0E!9m8-4K7QZVe z-GmOstmCW{-|+rWh?$uQy-5)t7)8YbxqEoiP*v(Cdu|%W_P{V_C*my)QI}Cw^2}&$ zTq_|A-lkvf?TNG6p2YQLalv_+N80l7#tf;aw)*ivwE~sg}yUhNa^u7(Ta)-pjW3>z*|jjyu$iO(QL5E6a;I z)wC?8oUHsE$L_sWc4}RIl4~f|Httw!3VSZ^*@j=8AsB|ks)LKKh1?f-m91%Al26BR z!)D0fV@MSZnRn(K{^G2rrxhvhr(_`IKW4Y1sOc1Zbg6YV_IzEj&egE}J|{^b#?(eV z|Igq^|30BIcG+F(x_#!4I`u}#e=+T;s{rnHc zPw@bBADKw4!5=Raunp8h^U;OEV@&GsPvg)1_@Ig?7M^$*&ZUVQ=#Q}ZE*g)+lQ@3( z1f`|?85p^Yax>5zJbr9*KeW65-Oakx^V9bIFzNNr41}_OZ_ur!mlJ)5K7-8e{c`_# zEJbebQnE(C^ZQ4T^4>ai_8i5j{f8h$1?BC9R}{(*txyn$J?v8fkm@W& zC2dJRYy;o+NhKKEfzW?s>RCN)uv6cZ;5omncPzFH79oOKKLcm<->P-c#PAjczAxDG9F~q`_U@CAVcZNixAWJC(L$Cc2oIQIY*fab>=R z)lCzq11q#n+osdp8oln8j=RMEoi?(|I*vC*hjuq*d@qT;UZ@HF6rO z5J4(~9mmnLQC95YSJp%WhpVoB+(yI4FUZOO2)L~ncrrs$0lRn_+Igzd6hKb=77p*v zXqr9=Vs!FsH08x-Dwv9Gww#5Y2;xH4+Uf>zrI#Z1IVz|_fLEs(0<-{O1ND+c&s)CE z1bYM@5&En(2ZUSTluK=X@{LKeF8$EGii59cO#;d%(NqP{_3j0Z*6CoGVSbKqn@?Sl ziG{hO${^&xOo6p9?pLcJIt%Ss8aEzel^wSzk?H@IQp2)Y<6g*Ja!TsG{NmQDnX*Zi z`IYM&b<@s{fo_j>_G5A1rFEa<>MrBEv&=1;2?DTaqI%*L5B5FWLcc9ap3qvCW277v zq~oT$Am*0X^94>|CC(@;>we%ayd$;Yrt)y6(VVrMsrO)c&w6mva{ioP52y@_<%(&C zGTFNp#iR%F_C&l%<=JLL9gNa`^@jkV$om?s!bn9)Cz%mE)DR0kRFhE1fZguO9?Awm3;_&*b_LR2tIQN5I4(=k-{o9FVh~;f>s1uwzN>LFyQGY z+$!H#F?N!69M4O{FS@LDjRQc#>%2b#=Muc-H1)z79bT^H&~U-Ly<^`6uv+|%VtYd+%m%0)7P>k{ zkjD}hXl%@Ne4Wja>U?jyHVcp_G}T^*^D&5MbVk&8+0isOF{gFSn#~EYzM@po6*-Nf zGvN=uVF`K|CX2W@GjKWu7*dE0Run1}0gbO{8w75FHWh}f$H#On(?Z;P0Tc8nDz(a5 zAI>h*P{}Q^kF~ZZd;!N3yY9Aeb4QPR!9l|+n}FmYta5>*dg6jD&?;D^Qjtg~(j44@ z^8hjlg#dI{?AQ1bg7(Ee!o& zTH=PoPtO2^44lD%Q~wvlmF6ZGe5QnwF2kfHoHhZtOhv+xRoevk6-0;p8I{-w7u=*T zjG#i>X>C(seTF2q6XhL+3kJBb_pq*IdIbIGkQWnr9~agDei=FB{px8<_4FF|Q=R+7 zsOJ+_@jM@l{iZfc#am_^**w&fHA0`Me@uFP`vi6EQq5#&Wfg@(D=XUxTnZ|3S&Up? z{&Bcw>x>SH(et-HIxWRG0C!E1geNEC}eVn-{j zaBpl_f(XDYm4+wfq9FnrXi>ZPYDEoCxGrWF8|>H-deZZqm6f7V54Jd<8@ls6ZGiMO zF;kPQmx&?3)2GQvXbl$#;9W{vC-Cla${D5%Ue?cCXFy(!n-9|n85)k$lwW+igtS{| zDU#hP;N7ccC^5HD;xi)SkFIak^777SkP`AC9cn&gCd>L$D)7gy z5cizPSE!g?BmoBlvYlQ0!8V3Xg@*Q46E)&3+Dl?EVxZb;F9uhlW(hAM-FLt*V7cD2 z2!&PzK&Cp5*c^Oen@*0Ne`@QACKo-SXpdc)K9AN+y7jQR9)*llWPVP5V8FdAiDKs( zCmw5vPobGHA4J0}iBz{cxeajYIr|Vrdoqm`9Ky2`+}y>@lM={S+)m52>y^9@v6~?e z=cdGADwe)!dJ~aH8@6QK<1Yzj(JWXB2(mdK62T}}v~jkMzEpkwvIy2>BFjA~xOLTl zz{W8li`Rw7QBz?5t4MYF#O`iVVLmU5Qk62JYnhF05Q(#-+?9~jM0?PH9yQwXVlBM_ z0jhig?r;tCa)e44w0urr8Mhli8VRH8wG`|{UsozVqVXc8M^S{8DsuF46qV%6?|K=u zwdj{qaCywR6fCpfGFgWgG4A!qh2L6#4Bp#Y_7L>`?K*|zGFG5}&;NrTl{&7-O;wxv zsQ4y>Oqh?9Z4Mq5h1f4 z^%wFZ7HykUv|`2uI?)k_?Xh2MLTtHw8Q-H#R6>1v(tBEQP89ALf{RKV_Wi1ZdXh{0 zMsKn0g07mTq|P-J{&QpaeB57HwH?LDz18A1Xs5-2E2knv@_BeM*j8C{qx!>6Z?aOt ze#yd+B+Vy!s&C&{yzLB;z8PB#9M79tv_&>jz_v`D;js5j0yDuJhYamRch<3vxY%QH zZdmg&uYS<*ge)ZNAWqu8%?jpNmPjOKLW)Lp+IU5>P53f~;4yQm%ymZx`*kkW{`Z9a z*4ylup`@xQJ%v12QQQ>Y&G1267@?|Q-w zD-RXbyx@FW!VhT!+|jiU6DuQ2y^O{PhB-}xdP0yn|INLmuR~klXE)Z;nnf+#3cp&v^n71eJu34ZR6+X z`K&1ebtET0RdZh_|9M&G_YTY^@JHqU9hsQu|95y5BP+-MeT?e)?|4-PvHbji|CqlW z@axQ7L1l6FKk~Kg{hI&-I!H>gA~$rwygc~;F`5ULh^|lXNuHkPsjJeqsP2O80GnR)7N9^(s0Ff!E|9qyLbENu{QZdt!lB%MJwdpq>i#QOe!q-UF3rS@&Gbh`>9#%Tr@ib~@9w=~itzW% zbzJ4+>$~wU`sx(k^ootb`KKM)>31Vo)b6j_`|EKUnsHLNrXdV*HeJaJm*Q2O-Kxi) zJ4cejyM$?QFG?wgWq7B-J9> zt$UYb;zL2?7S#O+#PdzmPen1DFN2jZi@6Mxg|e^~W2EZPd3lfd+~g#Z%Xx&(J$kjq z_0iu;1P!8WHkxX?2!Pv%*-64a=)5VQH!_@(3x@MfN@n^cgVX|=o4Q=Nb1%~^Rn*6J zzsoplhU|9-yCC_HRItDKUpU~v6+2U?LX?Zm#VfCkW6E#1uhqrKCM}xwWgjDKhgZVu zi9FS})z;(jl!IJzOd+hVD(PBZb}h7xtXtI{U}k&Y+%)9h5nF|DBFD77k)`F|fjt{9Z8gJk;n!^ksbXGm@nRH88)CsAZlh{O#y ze6Y_%S>_@rmD+8Jm2;1ZEEcbN;MKvrp>9c7m7MINt#X`6&B#S!s4o&_{J)rsF+}*g z;L+KW%KQJg4DAib-A|i!Z{1?S1M-%p+`RSB*@Fb(0MG z&tN%Xgn7zOBZ@DAWii7jnX?5rf9gI(T7)-;>(*gmz2ZEZ;e`Me89k8gDB%-KHj5Nt z10mT2f+>+pDBBPk?`e<&G+69I#3CsD%q`(xBmQzo&>*_SmtVljmJbX^^084JyNc-W zWSh`0k1sSvQ>`i>fdo|$cUHd9Zs|FMG|%N5r=xF!^#nogZRp3}yUe$vMZ8NyF1RBg zz>4&@=oXQx4iSA!^^!T>Ymk$mUR_5N(hIZ0@*n`Or`#WgK3g<8`)JfNrKPQJWlL~i zC3>@?2?9RA*mG& z41N5qBX!1YofC_Te^4^Uyf0xR=JbhgAd?g! zA7IqUO||s3G`C4YTgAix&eyX(0wVV}qyrRtIas`{y7T~xq9LwOy7AIjrwBDgkb({? zk1k8a17#%i-TJ{CTGavT5u4qc$U+~nen7%EgVrtY4gGKV@m=u=cx>Boo=Qt;eNv;D zDr)D!sNJ|?>2{J1n=hpYUDMw)&z>Ym+e64sManLD^|eTR5c8EC4TsYgb|-R-vop>` zx)bRGh0@#CQr|QR5#7cGcj9&f2=K`JWp07}aQw51BQ@;_!#)4$jn|*#ngl`Em}YMf zc67lEqXLZ3!KPA2MjuK7Mo(n5U>M~+y0}Ip*`GnuWyjlXXjuOEI-vYJXEc%gM9(-- zQ#Ar3{9zs(S_x0oLF%lKhP>?Ywnop^%y^@_KQ+l^+)eYip1#;wIsy)q<<5cemf9`u z^^$o&piempCju9GFoJ#OG^%0i2T0jkOmQ5NYLFK+((Z6oP;J#*^SKTb>2@q}$>JQS zXf(*Zuz{K|RjHo8CQ3CM9DUtsk0e&s{D__3DkS}jS)7(oJ z-gm)PPon|&!%PseqOP$`1jSl|y=#2`GE-c$Yi&D<)_+MLv901XmIdwiYoX?z7=Oo? ztxixU4v0+#gXrp@SxLJLxyO+J7UbJCaO~@;9GSkZvEWDIo95iXC{3lh8Lvz#$oB02 z1w;ang_)R9reQY1lzA%pgaxt4v6p4*rTD(6djx2|t~1mP<*!*sZA!p{w%D9=9Hj4G ziUvU3MOfSgMx-|Qp5M>o^hQ(;W+zW6iS3`@Fn$-h7wsw?3Qe*v+HO^<_rYD?XzuT4 zs}vYXQN-1`(Y@MOT}I^G6fIL}OME5NKE@@w&i%7=jCGfsO%VJ38yeN=m)$BjT3?3xy^ak4pWi@bG>mIp((-qfKg zH=y7KKt}yrfTQOl=?6-Tl~YuXi*9vHwDSjBR8G^yo>8RDWg~;Jm5JMtg7r)(Mj{34 z6hx3SG}=R8jQ?YYTbgK-ux$T~TZvu}O)Odsn|&A1W~PlF?Nj0JpZETU%Q2c)!TmOg z4mhQoWQqe+#;P_G8a`txokPh2n4#(joAexZ=`8Nj#ucNFj4|dYJ(55Pa4*bGI4%R- zBF4^I^Fu1wSxL6mW0;r|nAxEEB{&O+1+3ni8PD6|Q0dNp}o$?h5GZL5aP6MdwCD+nLU; z*4>Ag1wCjlEhEsc*a_?F=e9H031*a@?8+$M-()<@5ImUs^#)RkFvn5I3g`Rd2QK8g zGY7}_pDf)|vI@cp`GP!mW7T@6Rd{VAR_ZfU$8kUYyfBiFeEofcW_t>7%2qfnXt;O#H! zvah@g%ghR-24{O)b0c{HW3}gKwVlgDB(zi!*FsRIYkj1f2f?TYV>D5=5$Xm5=7ba9 zLQU;nPX0aKb3!2XpA@2(2UbtY-eh$gamq{0F>uUMS|g=6m!vvi0=(T19%XW$b!D{! zLA*Niifp1xZD%(TcbuJ&P#K;lwtZQ-6>H4<+6D;aSjj$!KU~WXZ;-X+3uEqz*JPG; z7YJudQD>+y$6Og!*mpiNMgj3kG1HzVxts(KrB~R;9PfP^a#?JGi{Wfr?g4y*XJ3rY zu6T8d7@k^D)KTcWOE))YP0w)Mv^6RR+R^hI!rAa=SiXZZ{qF*2lrz179EF!t}jSu z@MJhEUDp1Zi^Ttp!(?BMSjNr`E=BXd7K&P93582PT+TUIANsrL%$%+vRDL6k_D#75 z661DZo8`Pw+((hlnQMfOa8*C^0q!3kMUH0COMJ#qHmmaVjwRngQlU;_! zVq|`+MG6npD>v$aZJcMMP?Uvb(z~UgkGc*&YT5g_>2&`{vNHc zxE8GueY{CXy=|(4Q>I&2FbiXiIE{4hxv&kMNeF^=6H@s4LkeKByq!gx;_`N=F%p_$ z`z49#HjI4ZeJTT&STEh4szS3{ zb}aU&X8Ad%_wzzlrcVL-Kg~k_D`o57DD>YV;w_s0Rblr8Ty#gm>n}^JYrm-aPy0pP4ds%Z zM<4BZ>zto2dCdXceu%RJzc>n=uJba0wH!D9B)iZc>(V^?bAVl9o7k6I*k#&u)YtQ) ze3kRJO{UA;)Kg!f3R~3M=h}oi7oG0m?XUE2x-W;WO=^_Y&+lsNcovq#wsI;W&}12{e~ueN=RF#_l+m#&s@o^E6( zLn*Gi2-c|vDj`B!lXgt^UO8+XuZ~v`4$*j692nyYKLEj^UP*Q3@ZaQn%v~}(1<;L? zeBXR+tYJfMkhPkDp!iWU*y?xFe?>gNgKMWI54)cGzylRiRo1zdw9ZJ(P;A`cfOTbI z2)~5Q1tkRZKw)A7BvMmW4MNO0`YR~{Z2pXGL$n?gV3QXNgaUbsM|SiC-=^s40Gt|+ z_ESRFx+N87W4fsh`6DJB0$1VYwp>*t^6ks8%<__S>XSX>lKkWodr|($$>cQE{6sL* zQb3oWHkXkx1~hV;f;HaalCTtWTf`Y2X$n9kp^;8cg)FpJ-LD+8M=ywkX;#@Vv*q1V{~rPanDHBDtsye1Gr zOGD2kuS%78Zw*oIpq$;x=8GHVwg5!4nP`d8-F>Zs5zKpm0Seo!v0*HqB%Bif2Ox&U z4ubh5-SB}d@W6O1UJ~O3rc{Hb{XPGf|lhZ_0GD6*xk2Zo+9XPZoW`?mP>C;*A3Wge+b`I3EGVFq zhU~WkrY5^f=T}*GjZsZ;Mg#}6f>N77D-u|4u_H5f6cV>GaAeAstDA{%-TNvNk9QgM z$R{*;oxb$B_7nzkphmdwt5f)$JdRV><#RzrI)T#)-lqV84krW4K1r`n+d(629MX&z zalcZ~!I@@!W5$>jgWNq0fNY|>|B)*SSypGW)rXNOj>#(}m}nOnyXl!#Z($8jlA@U< z<{C}cNu~?y;GCw^^7JSE{&p)@Y~oE%AW>t?y_`(3aO|EaQA&35>Lv%G*>^U>(+~W4fRG!(+~1?oZ`S7Ov5Iqz<$L>OwxVl9Ux)8@T6&%QIcjAfu6 zvG&Oi>J@?PAaeh5zq(UtDO08)F40b+fb?=VtQdm7f_EX z9(IaVh;B8O?ql}%4W&O{xypSwZgW!WZfZXopz*-S{YyeeDAeQfvz$cUrXkXQ&tLif zaNw1*V=ejLM0XQrcLLyJGCjq_?q%bUX4a z*?_b?8nLC$9CVFBp!B7t}xx?yX6jn%?4n*yH2GICK@dY%a{nxHtgjniJ` zztEBTI6essj}JqSmTE{#zS1ikozG7jTzv@!p$7#|pqJgM|GX}xrxO);)GF5qHQ6P! zL#)rdF0_ow9$-sQUV!evv1uW3!-@4jIci) z#d_^=5~=|TgBU%6fyYx(A<7c%+Gy!$X-B3ysH`NLRTpS7t`olQ1(eZJR$9zi2d~xJ z=amBY()R{0Qi&C}h#QBwR5_F5nk4SmIF?H@Qn7fDl@_W1%rB@wy(NYvHgRP3VjLs|+AklS3HYoK{)H3pTc1tLC zJ+XX!q50g9goC`bj5O|jBt2%mEQo#Vfn{1Yd-VR1A#7>B(zdvtMD3E@eI8n}R>!qR zol$l}))gpyypUDQ*Peqr^Uo|30gSd2mSa0EVL7B)f?~9}>+gka38_FIZUsA=4rNOhb)R`RK=RY? zusgm>rsr8W2Bs2qd}%?8jql|^#bVWJ%RHA%Dbc$nr?R>1NUmtc=B#p&&`B-sq)`C3 z&vH}^*SDr+@$B_FDoyx2YTSOM=|9Pij0Ke{&JN|k>(c0$z8#5!WXG;GR;V>53BHxAvfJLr}ekd^dUvWi+RHeC#1@hKz1qMtGd zn8TZqJzlAiN6u@2veV81ied8*VKb^)@2uXuLv0D4kG8o`32rNe%lzLyPcCIQf^Iu` z$5!5d{(dlHXCULYAq#VXddfN{gEu?1sqEJ0mBalYiAP9~Y1PBy~L@XaPT8PE3!lVkSx=^8k1$2`itIf(g~t)*pmX~Xd{ zqH}*uM!cox`}8|6N`c^Bgbc3#e)vBded7Px=zsm&=dTd0%NWQ*Jt8tLq zB+kyY3VKEsLb6vIfpl4A%YShx9AJq^G(V)u=7)e5QB&Ex8i>S&LNIrf@^bAUFU8~N z{q1#h5|I&J1Z|_lQUGt9!e12Uw_9{M-HqbwC3AOiuFc@f&>D$;#S%KGXE0RW1L5~c;JPCten z-5{z$l+up7Xm%RF|u5Tov_&LLf0-7gp>Tt0Rv1(Xv@5K`@`)6lAY+?#C5J zTL|LmJbz$7o&J7}W$DKo>f|D}(9t05C0B2zVWJPmv@5CL%JOKh- zWx4RLp>94q=tIg~i<*h{ZhUe2P5bPXndZD@V0ZX7X!qALU{OMq^W?ZM7o9=#0}0TPOAN{fULd?nCj_@(~Wn8ciQTz)B@s>MLM^HYhY% zC0G-D@Al63-Xta82w z;#}f}&p2i}g|`yS>_zqd<{kzCTYf_zLJUle1pTy_sea5PqLAb>!LhvvY3D-ZvLAyc zx^Jje!al!90K7bi=}+mLgNqRj6OaBX?IY~Jwu$c#@W%AUpMxO%3 zqOg*!qgbP5V1W$2v;ehv=W3$RrYI9MzWL9FbxD{`_4Vcnh)Ra6XzCD%If(3_(TigL z`wD-ZMf569A~-!02T2_~AE~hKA4kMj0)`Qf24Zv9i~BRyn2Ap~1pGL?g3;%#XG~wU za)po|Xa>_{_)LKK^?D-g6wlu%(`r7VkG>&npLslC+r9rm#?Z8w3WY)$H1VxWJG5*| zMb!z@oks9eSvvs_i3OaJ5|**h@D>iqH5aYS6P>9F1IZ1GFUbdec{bNeS@*7_8l&g? zD5YJaz%aE&{4OSO*4)W~y=)<{h_DHNbu}BGwKoH6mU2;Opi6C1zLIMen9gZVP&b&L&J~f-G)z-xiB+wD3<T=7( z5E~5jZbB}F$WkClOh@k84x{OK6$KirDa&dZCEGB2;kO7soV7JV32?>{7Do^VA4u89 zqpIsS7O`$^d`382{`#1tjNpu2)utj3|F7Q~T;20;j%^z{L?fDA$uIiQ2w_rUgk1Pa zi2Kl2H+4CqY11brers`aLUmq)GPci{_WmkB3X|0}VgXUq@k+l#B&4}u0-#~~%z~X5 z#d14!j&O0I^pamo>BGOL+>~0IciYn&pW(17t1{Av6zo z9gckx@O+?d=-iwe>=EbCy1DE^BN+s3S;;pm$3X6VxhxKv=B`r6xqL|)JB)rcfnK5J zA;1F%-vGana;fRm?%s>5%y7>OO<%MAkc)3ve21HTnzt|40N3(ZzgVeBazEX;kVxBZ z(5SKo)DH)IJAp0m9Ka?HrTg9rQ}vAqxT1BQV2j-d*cQ1E&~S3R79Zs(t6B`(5IbP? zR&3jL^2N4o8x`Be%YWZ% z+&9K;-2Q2wvG+N1&2?b2g~Y0tH&L$X@?+r-8cFuWUUY$lvs$Wp@xY=6wc#x+3z4>O zW)dQMy~29{Y9hvVpiIUt_h?;QxzE!PlbA7zZNC!c+AzUgPg5%|&5OqP<@lannO0Zs zHqcu?OmT${DB;Y9Y=Vs|h}H>Qc}EBv_q}lf>tEWU1(WaIi0~I+SD(#~@qGIFnr^|m z#WjQXjGJ6IlTJ!bg)*~8O+ZvGMo zBRm@^x=P(*zd-E*LA|2t@I=qqN0=ad)-qyEaNvz9>rqtSEe32+rthlnSrZdY6-}X3 z~ipU8;QmQ)>|3`DE;WF3Sqo%an#ZpY*dZRDHtvqOZGq6b0-_pfcZ$|@i@6^ zH-0pUcN4}i3Hwy{$Gi&XER^meN5nb5P-~~$ z!>m?fU<7iAf65?cXyz`)UH6JW_(p5NG*=LT@z_)$e=R7GL@+^?uwb0q6<>Z{E1`y9 zee*Qqy3DD-pw6|2;A!}*l0!*jy{$Nq6G&6YOmAkzfopIG@M0BuBQ1k7qGGjehxVjB zdHw-B0UFcTws6t9yf{4r_d4Ah;{!Ps2_p)evTWp7g%QOFe2Y#vllfv497y3SMEF;I zfji25-DC4|${vM{cLi@u#FOU)%tLLdn=!vck}J4%=83-xid0$R*XAoVg)d5ZhTcO< zd0ecr@vx92goVqBU<)%NZ+AgX!OAAJe!D-fJsYoQY(NQA$Uo*5D*4%S$JrBs$}%h6 ztFdHB2aMMVO>MKvou;X$!dh6qucU{ONT0XDqO~bI%8*(@Dz>9t~DIrG?Vm2(C%|xY0}Aa zqHf%Bu7@E^HbppH_InJ`dbC{(Nt1ZMjEv|`6CkJC?_^ef{#vlI&DA?L@DCQsZrfmN zLOk@UQI2;Pl8ywf&~q6%djvqq#J#3zwRdE-*y-hH_n+^zq}g){5R^rOw^I>*m+x9cIlS4VhnG7D0B8 ziN2uU_r^CcYT}m9|FjeR@03>D-0c4ybgKSI-P5-GM``r{YJI;(1}q#2)a-xpLpO|y z;FNcTV?O$XcHcs@MhAd$bv0#zVeLWV*Iew0?jHMiH# zdvDLN0}4H>foQTw!UO`%14=*5)^2gu@s&K@n_oUCA^;2eeYMO68I9t7i=VfBx&^ma zkLI7ZeZp9o$`?6zV!a=uRV0eRFUH^p;}2F5nOwjreD-$j?FRVu_Be`>1Gv>4Ytz!P zlYLv$e<&x4qV?(T*O!q#D#F(SQbinl@@b&!Q$bd@DBhJ%lotI&% zHJThO_I*iN6F*3==C(nA&}`I}jS3UljUI(i?4WVdd(7539$5$NY-pg@o!3{g&))re zIA?(Ww8otg77`3fc6?$@OM7>H5>IlWtO|o9oJTJC(fnTOTHCqY7bAV0l7&QnY$(l= zG)rTdQ3h)sUi(yn_L=p1V|K1%=ruWN^sg(w+DhTW=v-A$JfgK+XRKFh3%pp$wHUY@ z1%&R5h93vz2bN;OISgD1?Jad4{2}ET2*;wkxM`hh+SP$a5rsj_oUl!Cj#QYV_! z(f09Qer!dUrwZfB&q&#^U}nO}9n&jQMLMR=>JSQViNh$8yTqPE!`XV#A`0L^Bc&VJ zf@6gX=83LhWgzDTwnB5I;aF={J4=P}oRI=7UiqCSHx9Y2zDmJW3}0gMiX=L4@Y~uP z2U#{sM6h;az(eVcWRCj`*DsY&j7Y6I%IkOJV@ z>{MvFD^;Db4XLlrI5^PEJTP8r-zg!cxYA(-Q}Ql5GEQ<#MiHC(t{4KBdB*w?Jghr( ziq}(2H>gN<8ZUHQL2K!Ji7j=!1unRzs^$>VVCx!{@ZWImuwpy)ar ziVJ;qFCjs3I*{DNYK4vIc)My?qmbyztI+8ERZCh&KS${3q+)(vU?)_JP7Lc%)z*rY zxvB^_QqRarIkyLmVub~9!3qGi-FokCOLPf&I>Ojs1Zjq0R8c2J)crgbNxfzfqY}vs zuyzW>_;OksW}ud@>9be5EVIjcbq1HxCRhkE+c~lId!LDEXhZxn7TOUOkStp6RQjAJ@`e~8H_nF*;-8P7DHhv584lMDw#sl2E^ zLif*_i+q)*F&;f^Z@@m4cDRl~_;!}&+$!I6Z7iD8Ct)i5uSK%UfHu6YCjj2@o+W5_ z8|LvO(m&dqbS-4+YLi>^wxhzz!HvZe{(mBTGi5PQqA zKGj(&P?rH6q-0N=PANqX&Z0sM9S@|Z5|%5!;MBjqJV9DOEX-Al2)6Af7BjAnNVJbE zMD$99iViBuuo{DJP||w{i*sU9$;tnWqpzKyw%L+7mdL{>^C)SD#7WjgW?1mr7run; zL``VIHqIK=7lM71LsA&EiiLP1GRwrAHe82u*MTi-^4w@EeK7*^Rh{lqOR)?DC6+P? z`O5HGH;|pri-pJMjp&C=UhSH)hSsxHz{l6P^#vvbQG8}w@vagS8WsJ{kc=9tk)G~2 zrY$Ausr3=aSMp2b5M`q7Qk3%4$~RWVdIvO-!%lb`PaSA_a>DVM3pl`8xR294X_N8- zTkYS-Ils8N9G*ac6NlV`P6+ZhR4D`uyFc}2EbyTZ{X-P+ZL3e4%hDUuq8M(4C<8S( z@GXF4^pT-pRj?VigzPRIf5f_rW-<%VF7jBORVCpQwWAoUa{p8&Wu4h}1F5&^Mspby zHW2&s8YgTQ7|Va3AQwK%IntiPopAebfkOEv%v53mYPMBd`6s_W3Ptig$0a=iw4zBI zCGhMz)eOvq8@JX&y&i)gR-L{-3aCvI#02M-s9U1&3N+=}0T1fdX5~S3+b43QQc}IY zavw-rUkxko9z59JYA&9`?AMy5tMt-tbgIHwXQ~z7Nf^wQe-U&dnJL0fego4I?WG;o zm_i8O)evz!E@}N{rz^{O&*m+?zhcahkwn zrn_Eee`cy#5@F}8fTpVycoULpVEy@)hHqYsDia1@iJmBI8043z1H05yj7RV{%&ugq zzPa5l!=?RWHP>=!J=VgkdxMi7Ec81wm);wAsY*|n0Zzzk-W}!4c4BQv$12Y>vip7* zZ%Khkjpo98PNIoon!{q=dWgetkc#!*+RLlpVGeqlFsP!U9K)ptBd<8;as8Zn(Sa}g zhNoZGMKj290asUq+4-m)fe;UYQtAbdcOLs4Xc{M=sokwlnaNcT;p?Gu1qtYYe`XfW3e4TBPbI8}Z|;pnx} z`h!Y*vrT4wMg&-~9_Bd&RqGNe{9n;YQc5P;hs&|7qkYPMU8f1oQ(3+qUq2+S{uTg=@30TFwBrSI(y89h05kc9bq78){Nb`rn`b z2oseA#>FL}d+!E8&9QZ)G|fHPIed1d?w-QFdv@Qb|4{n9*U_rAe{oOoxbuFtNV%ko zcYd3&OiwM_bbik~%$&CT>^Sn)2z~!90tZ|K6TFSU$NhC(M%`i?QMF1OA6r35A}Rkm zE1TF7T}xvrA#qI52_$>02yYg^G{uCjNN#Janl#{3yP}qQbfp!^&wKX?9Jhd5iMBI} zX7GhySuIj%Sp@XVQ{~g`)5>wWt^*%AU$|zIpYg=wj~jQr3xWF1wbu4WR;epkrOXxD2=TQ~0Z zV&DwG2v~)Ns!Yqo4peJt=c{3?xeo+$u6F;@m-5{ea!FNhhFZ*>xhn*c)7{b}^tQON z=_*Y>9Ft6LuUQOMZkUICC7n7-b+yd6^?%rmZGV$MarekTH}+{vGySqHgQnR6~c~Hh+0EKg(iA0QTzWfeY=-gZ@O=!xxa`R020GfXu_4xSAb*|aKHg@^Z z6J8QunK}@JJ@nB9S<&HzeiLej52Tw`C z^Z<$-lxOOHuk_om-9jb_7f-dhqfQw-X&!C6oMRKAqSHDHpUn9O(m7k#MGnrx!ovPy zQe^Ij`?t;ngEBf+Wmj)ff`Z!l{ zHt>~*fPxR=2t;FH11ohKwxeEJRX5QMd6Yaj4lvfEbUKMy;tUQ`Aman7Oj?Ntv{`!l zwqHMD%`X8x$e%ZQmaiw76Bo`tkQ5UZMIzj=XtTl{p=0&$H}1RL{<^3ZqnL#sAE@fy!k$8#i>7qjK%E>LXui7K-5 z&CRW(!NKI9l(B*l`a#c#mQiqZl5^!HFzi;|2^4X>B7bLI{$(`#B6qnX%tTseV>V4% zhX*JrH6-KDf?Rs<$4$&1Ps0Wv^C4JCMKBo;m&?_}JQCa_ZS7OzOgY}DUQVgj1~7IP zs(H(i>-|fxI7>mj0GYTR;t5WO+B9dtOcfyFH=JxL;ep$fmM1R79D{t8Wqj)o8H)r` zGhK%CBV--PcGfNtQix@U)yZ zKXEdckn#*h)u<6hm05-G+TEOF{>_;@$a-5Xs~`54uq=_a($ET-oneFP3ry6lh;dC| z#-&cU&w_GT4F{T#lr)`Ef&h4w3(%NpEz%G?tUuj_|4aPL@YntZKw4Vc+AR{aNWCHc z35-^CCd5mU^K5xq;*P!P+jjpHl| zb}$tuumjTw@h)@T&Ma;Z__+cAKJ2V|ESriSH&rLA&C6TuD$gn5uf@=w^~&K9HrW~v zY2H@0MJnw1jTei^AMO5OR8=zV5jJ!hUWvdPg(Y7`z%i#i5``sKF{XV&ZSPtsnauJ_ zOG;38t~jJ4fck>4Qh=Xp#Ar1Bo{0}mJ9y4pm61{~=Es{P?H}g=DY38e-rrY^{g?gZ ziN6*Dxe9cLJLF%XYS!>(|DUvNEq8*+Fpmp=#aagz6COwsva{f26R!Gl`FzvHa3o3H z4`92m1!rVlJc7KBF5Su!lrF)2J)mY!N-aY*=v>}ny3!cXVE8sZV$vSh(+N*&561=sRH_ zm=xv87Uj;<-4~3fV$p1^8~*OBs}*p=^aM0!aU}6b?a|X=51m-wGzfU1!39m=k}i`R z8#x~ZcNctt(zeG!K+g}y&}2AY@PdHdO^tfdIv>{heO)l?>PK+}xwcC)r-n5={7V)o zi>$lvMVQ9Jz~Xu`SQ6ktM`DiyGr4arL-O?XJB~a|1MTII zRFTLsoh1+H#VsEf3kj)k>j<*?Rbe6bIBm={9?+eRjSXddktRp+_+TlCSL?Oq_W7Y#Nn zAvf@q^(#7AgZT;$a{z%pCFiH|>!H zO@%O0PPBSlY=Q;r0ZP#H>sm!0TpEpd`@NyLZ1(l7N^}RK14oX$Q*gNsi@+;QIvMN?;;37SX8k_z0g_zuuIr+5#{ zc+bg+>3!Q6)jw~M>FBvvCo%ji@-|dL3F9ca0iW9{V)Wl}<|UZbSzcjf#bV=D-mjrMH0IKskV zpA>PIkCOCa7UGpJ^R;;O{4@*&mgjuUxdTgxLm@ki)mf%kN@MHJ1l6>lP@mX;UMtM; z>8qt#Am*+uZ%x8kG4g#`2dodVslq`o|CJ=nfPntT4s7krsT{rx}fFaJB5>j&rh@B7Pt{am#D#~1to z3YdEbX6uBCgO1xGa>F#;v)A~4WgH1oGD$LKsl1q&m}aSuc`tlLtEqyFcO>(I9=B)v zdb%P%-QV&0|LOkrdHy($onY))k3^G2Q_}afO|5K<#P}jvBFS$5aQ`?Lg*vs@E-K~V zOwN@lo+07?lsme-R|k@86%u4}ly7ww!8`Vz@#WX| zADHXw>0eys!^eI73D(77PjaO%^6CHW;s_kR{%-rYzuWkOJrRW`vu{r{@p3~eM%?eHN6{xgJ+&9!RW=7 zrOK;FDZGMjyf~GsXBPWLdWZ0k&U+XWuqT}4HXAPkZYhzX<;y8^qB&Ee&baQb>^kI?-*zAI8l$ zitcQ-aTz~NWw9t7m{Is+9WSiXEq2Gf#8M~Vs3}!k8|c025~+oMOKj7}hIvKwej7h* zwB*M5@{P1&e+42WN`Pn;Uz1uc>|=xAgzohBwfzkW zyM2=J(Tc9ahBw1Z#ILq|j(Q@TW+Diq$t8oi#ZGi(v)v`)aPz1m`jJQD;~kLi(RdT% zWa_bLJ0*7Y>K0ewzHU+AoTsxehY{A0zuRTvy~7p*DabvN3_a)&l>)Mbg~2}jB=b`Y zitQmjgDWgEj!(TQENy;YSOGweGYoK)_Y|if>2cZ|UP`#f?SANcE9Jt}?XaS95M+xV z#?5a}%*4u<{P#u(tXnYjbCYNS3JCHpMw5?jj!&))JzCyZ5+)d!I19 zFoKzydH03V=wWDys#R@|7DZsd1!8I&EdiMob8WVa@q>MLBQ^w{Cgwb@FlD#6@o=@l zkSopTI^q(LbLC6;EAXWry^91!f|N;=RU1hfhNr|)osF>#&;dCEQ+-wW5K322#QpoRG40dKgE z7lHH7d0G_e@7-`hpSU1G0r(?5gSFcE=L5ZKop6~@$zP%v$w}T^q}15?JVfl0aMwD9 z=hfj5+<+yyLUuD?$_91KXfHkQf&4>PkWDZFUL_J6MSCau;Nm2cH?EMD=->$6dk;_u z)##Uc6nmQ+03#K#a@ane>TwI&@y< zFR8vI5fB;>0Z@A~!TZ~K-*f1om9aeA-?=r!-n5)laF~t=rh36V$@$cC`tj-ZiC_!gLfEnYM_%1R9oSRR-SWGg$csi+zV2DY#XX}R_h)X@sPl!=|9Qe z^5-)LC5GJtO zsI*n2rfamz70xYWO7x#^F&)nM%nvA=OQqh$aw zywex`7*~0pfr-{?FOvQaopSMAgd!DcV^ez|~w2qlxx?>?;%_0dKi$q<{KT}+Dtf2316trTK=!LT^6 zuma~^oE-Mn0@s@=n~$Ej9L1eS<;(MScF7PJU4J1PH9tEjr4w!j>LM9}LfBPLCM+xa z`BXArRJmCzgIl;j#1N94zzDPZ^6yrdYQ0iCH+H6-JA8C*nG4qdr55#8Qn|pYdulvp zyj<}Z`-j&qF_O$3BLvRW`A`;^vnan!8<#a9(j=`_mOtyEh%?{?)$E6EVoK3euLI!- zP@h_wC&cj zalE~*NTvlH(!q4#4MYo~AyQIo9a{%d-0MLtOnjst$M{07YRDKtTi0s3V`8p@1N+eM z?l#9nR{C#Jw=Z$Jt&n z%@jofj#CRRX(|HBJYKkKDDnyctajpcpZ_5V4ySU7R~O5c;kQ`OQUmr|h5-{R&=$jo zQ3sKEIYCHxY>4S zzxZ8!PrgMA?*UztZ_{5s3W*|Oa^+4Agkc@^cwnE66~II~P4+|Wqz%XQ3$2^NqNY%3 zAw@B^oaALRr^M6?@JB>M-hT}${kliB=x{s{v3KQbgQ}6oo4NUyAJmTGleqTukmn(Z zzmuqimF+{TBiv`&F2{DI*A_pWLvy{m+JHnSS)>1$t07afJ~lLhoEtXEv!MRts%Gev zhA;5c-Bs^xX!4W_z0Dlh(OeBpdga32apNNBjkXV+J`_!>v5T=}!$Qz+i}$&giPRpM zqQ!5rNnIBVEJa_gTmJPpCqx6r&99&QDlPrh_4_rRGL(d0lw`&87`V!eoa9qIJj_2% zr%U#VhIV6o7GNY@a2oVnfVFX(gWa(UUWlMt`_|5Pq0c+Se`zox+$Lqxg9-WB#+3#q zpgt7HLaLx44ZV~XCCU@iVR!Mh6d8NOu9F+$ov@_vo)jk_>ftjX(Uhv9XYt+&cvAd% z%jS-sH*a3x@p`e7vZe!<_}wfVb67uo^TAX5utC^Zw!AX*sGZH{faU1B{HHGA`7-ks z51rFcr+S^b3DHpt(GanHJIDdLp5tW#-Le-0`-Cxa3u~e2mkcZ2ZTKhf>?PGMfc2B> ziMs!$(bZpc-$})PKNp(rxPpNF+gSWqPUrpkiv>ZQ+vo9PF{_;CDyvK}ue=;vZq%@c zar=dR$jSKvW5C+(s&*{8bViS63g1`bsY2eMx(YOr+?@O{9R@jcGMFpm=?py+$>|=T zWl!2tvBMq(0QMS{q=vOE?m{rka$%_o>+Wb&6V&ma#$3x*mW2yp|Ge3NJ=^Vv-Qzu< zV|iSeUGkRkLoEr4b6nTze~o6F(Q2}+=FOTE@yD;pa_#Cd(r;MkfVn4@AnK55!}$c3 z+SXz*R2%=;5SWupoe#7dztd6zoiWmfR3s~6_-tTcI!|;eZ4(xGZly(=?E~spvgR1m zL>ZK#cvClDWDiJNUNo(eJI~OYvA0>xJ!~Imm`k5XfZ~hi(A(hhP5)*yL5cAK9cZtY zKm^7j!1ydmuj0UkcHge#bDGuRmdP=t^ySl9srvV8aw5u|0b&!X?ZSqO&3(Dhdlmpn zmUBg_`3%m-CtrzBx$5b-P!kDFkW3C&7klMh_gdg;t&z=mbA;4*$Ciybpkw%qRDZm( zz5YJd)Z$ODm$E>FOb=b|fn8AJSr@=Bs~1YtVOlPWuXllvP5fs@q$B4>)5GvdGm)kp zF>?NB>WNi50Vn66oiV8+C3nwiW{KDPS%czgY3KR!pSr8;G-b;{lWu_UHL#Kie(J`z z*6tE*9n{!2OKrF3*NFea$0g%8sBurC&i}MU{jc~hR%Yh^PjprNlZjz#f$u)1egiM5 z@&ShMfkMI^of_K=!1FAr^bSXyCa)osCL@fkB)ciFG(L(W5ne z66Tk6xNc;$hIZRW@`PJ2owvzfquM1Y!VR~N*@M_~NAN0)=zN*or9GD+VdNU%LpT%1 zv)?VubqB>{qy^HkDcetrAzfEX=m`Mnye9i&{jilsVPdsjQ7tw_ZNPRx8SDnJB{jkq z1Fa>CMkC4+FaKg8R3m)`MZ)e@fvuQ7r-=-qtRGXPvn68h?FU)sf)`0B#je+S+!3!{ zjS>ZFYbkXV>(IqGN?ik5Mian05Zg^TA%V)JwVlnNRkzC6KNWyV>5InWtH4oNat0Y(}qR zo%a==Jj`URPt*nY4}J9ALySt zNCqBWp20)YL7z+bi|*}spc=`%;89DNVN$Xw*+)EG*!JSg;pNPFlE7BN9K5jl0w#SW z&~1@_DTCwP1(MjMV}Skb8)^w7+FAR{#pi}^Er-Es6qP^?LUqJG5XEXM%-O_2M>zXVnVFmk8RH7&P35_M3o+Gwv(% z4oJ+)yMK*Zl5H;&?wP`$#m>CWqJ?ve2fO8;ialuOsDKh$zOTH$G$KFwjH{G3cM?^t zQ!wc=gjtdz|6kIe+Wx3T1zI6Wp6{H28=SJjJ;x@~I#h3i zPWnLi^Nm1XFU3M1gHr(8R`XRDRG}WG7gYw~3F#UUO__<*^z^6_{ul_C<0O}wGgmTP zXjHhsC`goCBwgE#dmJfL97h`CG?me?eoPKIkMS>OkSS*r$zy0F$zx5B1~ZYq5wt6_ z@(PCNp4$hkWPPGVM(Cc|q;MozzGq?I)LhcuxRcl?(^Oq!`t&sJ(u-h3NFZYJJM}h9 zWZDxg%B_^wFk&Spc6cvVZ3bwB=(8cVPUbqHDczC3ws^@c0Ybg{EUwgEM)4Sk{}A^o zcvC0jVcg=Df%hkadgm3!xsjXP_Dc`nH3x}xs#h1(!3%%fDkeJAO25@fnNiiPmDX9w z)Ug|tGtNC=c8uk{1sjrKSS<^5a`ii?Gb_%^tZb$mk_}(U3b0v}wP4|C-DFS13{UN0 z3`AMvG!^;W*repAvIsk$^(@b9TabR1Gy6^~@42M>D($?vU?h^`C@$D@DBCEtxQHhz z`;*o{-p5lbyF6e?CE)1UFpN8ET^g|<28v}%R!9tXa9E$Mh;AC=AVw}VTmZhNbZo%y zpMoCsf7X`mg%q_n=mKiVhf5nb(>BhD?T#9zgF{mAX;+Y%L>*1$ciF4K?b=my1-X?> zQATAM5QtcZiUdIAPqzNI$EzT)5riuAL*Z0@cqU*T!(sZ+amo6OCg0-98+AwRHw&f!%L;Zn+KNcM`O#s=2DgtLGa)HkMi1Q8=4cEr_;` zOh&TDSC~PZf#2kJ8se0YDw0^FCu2VYkWI5sx9!4}62Luju!yrvo?s~Ef#d@wHCG23 z$1WC1V9Y4XY86JCc0YRy)}WG!JJx7yDK4D4>q`^2#5I76`|usmP60G|ASS``tYUh4 zWnvSyNOg;+H+H8s5jOTTK?--^jA*yc4Bf9sxDvfw`>TxrHpbl#MOsB(N%f<(;*;IB z+_c~1fyJj>4{aTB?87Zvi$MX8Tt2idK;`xsNJ@8LFAd^MiWc0>@J@iPr55=3L)sZi z?mbBKBOJaJ2%5jd9>}N?O6kPXf7=8*9&tq25oFD}hEzWL z?lz)H)MPOllO4_fN=06mId}Gg$LQ@%ND1T z$5qE-0#+h@hKoEtS4<7_`9z}c4ngV>RJg{0A!L|k8uJ@hhRQe9!iAlMZg45qKUYUw z8IPGyY)?QyVy{>#>v8fyE0SBS0Lut z-1|d6+l@=@U?4paul6J_VacI=3>yclPJ>62J*=>PV-w5y8WxSwq8mobFizrR)!MCi zpxgpKJfFLt=<&8L#ZKAZPR)Ge1^=1;)Jk(89x;JIrmA$_v<}XEJ;MofhsTW>LtQiA zfP%&m>Sl=K{uKG?+wX(L<7FoW=49x6mp9EWKu@I1f}pFmo#SX|1$~P@;h)k9NTueg zPRTMdSu4$qBvPr`{NzV9pcu*H(I>{JraLDYmYxP4`z}!>tWhOBAqS}=Tbmq%mcFg6 zhL&JW1csLjtWUnVoATVM%Neb2y|Ii1b*BRE2z5-RZDfE2VoCS2!I3T8>qCmLm*bww z*i~IPh+ntiG0gGGHg=kmYE<5YH4sX>ZSv?fpC+&?sMABTdYX~;s>S1qbgr|k| zUzJ!_=b*`zlvK6uEq_jl3Q)>Whi)zO%xpEu0|$OpshD1s)m%S9ogN_*CBvNZX=&4G zh!x*$VzvY~C&di$*XW@81PyeLCGX1!LAa5mhNQto$f=1taV2G`DIMER{3cjL8I5$V zHH}5&6rUJs^bIyrbxbMO@yJOd?oXTo1yiH-Q?0K*5)!Dez3d-8izy+$MNLr5-5uA3Zd2&CmkL9@-zh5#8a_U!B;=ry*?Hk};8dKPl;z|@ zj0!^$-drG&&z&NV$WDOIsU&!k|iDK z*dO++`&i=yQFFit7>*Fc6k^map&OjLbz@$aB{W_3%eNIRQaqyGw5J;k@pG}H4bA4W zLWcj7`8GV*&%55Zet2eD!JsG9-=KfSA@kTkuq4-a8P%e}B1eJn+t^*tU|dxi9j$^Ps2?kCxPI7O=iph!>1>*a*)C#v;6=VA?9yQEX>zdrVpy& zw#b=QkzsTm@AiQc(AXOZ~AGDvS-Y|Qh^9YVj{Bu9Tn7Dpn3So-ww z+JIx5;c}x>5X#$k6yNT<`@~YYucx|+rMnN4jAA#>H^$#f({$cnKFY(B>(VbDxu>}c zHH@PaNbFwMFpuG(Q{t=&U9`FKH%Yg_TMP-3+&7X*sz=qpM(BNQ59kh!#6B7ba0T*{ za1H%o;IB!SWa9$1dMU@3cU%lGtjpjWeo5#-X(QD+`+w&hN!7%sqvc2#c^S0&wFv!D zb52w;Q{}o#)q8Lwdj&N+DT67G0nKP^x!9=b9cp* zUDqba;vplXA`&{pU$B%nkSyfe?ATKQ$NH_98Zs{HsFL^ed)jz_A)od}Dwc8(@U2nQ z3VUZbb!Ty%Xe(>JGcVjz!ftF!siy!$~BPOZ4G6HWkm!c$kQBaH_KY zVY)SGraGTM^H<^d?V1K{w_WveR9Y`}_DS6EE-<8O zMX}PY6a)0$+Yt048g0SpV>M94i3V*;#UNbQI=^8hD=;A=&~ly&6MkjApIY#~YSHc$ zTEL^44=|C0g$7DTf2%cMkXc6+E-?{N^yAK?Nf7Z-uutI;=TqUj#1qf`1^&!>Pp4Ho zeI9v$Jnmh>R2xA8kWSr>epE6li~BQMr`(1`8rwG$r!_~U4Vo(%kW$XWM-6Q#9-e_% z!}#!RTC0!0Qas!O{VF;*#F}Vi`;|HK62*ZwW@50WSg1|@MvnxxKiUw$MaL60_{XQA z-7^cIj)1l8|XpV7u5|0GiS% z7V|Q1D&+R}N7ae@9i&O565xq@bgtsm+3v@+M@O%f9<~r5rJ;%eZCMBn&XQee7#!lB zZJBlk+e3^+jxX8Pa*(d1^&*2-+DgFgy!`kZmmnnCg`D(#WP}6o@E5(`DO}l<)1{iM z06EnphC9b!c>O4o#A?l!T8M5BW{@MM>~%e;kAec*zT>Af+s7Cw4`0Y3U))dDP}-Ti zi>WHyZ9p>{y&+h}-WFSgM`#9$^$$i$BIVzftYJ^%^uOwkc62(hG#H_LGs&=B{1@^&gdO|Xi`!= zp{k()<>lgSeu=uT1U=C%!uwl+ko(x*FUClNchbLcDOmP#QN-KpDJ2b8V<@SSADvqG zI`=tH0$oAct%00b&1M)kDEVsNz4qlIK`%M|r(gWFWz17eG&@^j>bO6MXsO2!&Jm;v z(e7=S0SO}6TQo%XE|h;NfutOjoH^1F)9j?1PB!xl*Y#~kS{T3_(IyrFN7c#H9I~8# zk*^F`Px7B3IFTy+>nkPZbKMi)w9HQtrgt4QU|9*kbc`UO>*8Zc34({Jg!e||%HpKM zm+0+My8-y4Xi_@uK7JCn9j{XXT5|eZS{gi+b z!BnfuwKH5z!ro5Ky}iYYq{&~q&yq>3KFd0}rE+ydS}M}8t~iz|GnO`ggjjW|dDdO6 z!|a?WXzRe%jH>?DtMqrvs$~1@<|yunQzGFY%I6j6U_HW5Gbq7$MRpkO-exXmmta8p9d&grN;% zFKE~ltlU*7V_^P@|KXvD7&uxng2Jmqw_fF^!$0tKABA!fma|^aTHVCsTRSF5ZNXdZ zx}?rY)r3ICkNo<%+u6XIA}FVlG?rZX8In4yhMR)IB7X>(*ql$&*}(CrFC0 zkX5b|8S|6-X_%pbW;7?)NP`+NVC2r02X?qJtiIP*s=SAb>dl}s@bM5kE|u}A`JjdQ zr;b}&>}9;qNf&SsMs}3U<`Bp^n3aLJ&DFpta9g=myOzP&4DvvXXr|Dizs=Xl2=4%G z_>1OLzxM9c7%*9D@6$~GErh83-k0!FuTM`^Uv{4ON{;|`90xc#y`|?N_iF0rXnlo$ zuBG_=Al#`i_F3MzG-tg;VLhsMO7Fnn=7@n~;YU{n(h7XXW zHz}J)cNsWz6xx9EU*1nZ)qAjQ(FNB4vaGS|F11_o9e_@Zo2o=b z4$Dc>`@5?AH@jGAnGTQZya=VIZ7S^C?w%xIg*^|2SY2pbnsLDkvv^mqr5f4Ll%GG`W^^Z(w8 zOp2r!0tnFc4>jB`(x>61{KpvVhgncY=>_#R=S}~Nf|szbC6x9mGy@g*wN$tZIjk## zFgna--{s~sKWR9Uii0m}N7+yk?4jP1;twSJK}Y-jwDi~e_L!d7RHup98K{b(OsV&?)~Ea44xyz;d?SAf7Ur=I@wQM=D2IKyS%vrAb1`n|aGd8pb!c>g+s@Lb zFsUBq*1?P`Xzo|o;@age&8{96meQ4WB!TK`0qcO8}+y+f>W zwmh5KFAFV-MA_v$T?=l+za&Y$*Mjl8ou**bXnOX$!LBJJO^8tbdljd z=MT-Q5$RrpWSH-?fXY%c#!%2xGefEzG4d%&Htmc+PZV5;4U*0?5eK7*u z&s0>G{i)ZHYCHO+wAXD?-d)u`lBG50$`@J9%MPy8nXc=@ABY=99YeeSHVdzh*tCo? zJHDkzi`}o>aH)M%x!-W}`_y?Z3`LP@6K3R{s(M+z+Nh=MzZ*}C!7~Ga=ks(zh7Xs& zUVp}7$i3~-^#5rrX8+$rGFZ5|nEyM{w4^&`|L~u&nEC<4TvJ!P_eAus>EBI?Tl&$y z%aq?^c;*ZqpJ>koV)R|^7#}x`E!qVUL)zVM5qCHDK>vracL)+K>auRr#!cI{?VGl3 z+qP}nwvC&%ZQC~f{Hk83UR0xcr@c?aju~suH3smAFTEOr+QI5+NNw)zApGk??$R9{ z-azh83Ha`$J@~)~cbC6O!UiA+Fi}YC#=mV2aL0J;SOx7MJ}Ccxj@;|euQRvKbKj5X zKEKwOT{2#WIye6Zw!a;7JBOdquZ8Trr?KB~XE(F2XH41M$)au5WPVUP;q5-Lh69^W z&XRbha0We}9|t#qh(zbY1z`J+ugJxNT)#vz-H2A1Gx1xFy%|+*9Ris9m00QO}asS(}J)!rr*r(3o-D-g+$8Pj#} zDzvS-x&1E%`pS_qWCEeI5~sb+0!jolhn$3n$rO~JOwj=t4f!6dBsPD^rm(vEymIxs zg0;YQrYv_RXHY2$;nJLGr;=+-Pqa1>6SoES8H9qYTla(C^$Ld(!#`H}EJx_46&N^D zoEdscLhQy3LlHA(^)AK*e|YCD=gtb0J=of;qwv3+S>O5XQZ+Bq@3gRSLrY{Jkmv#< za8#AYv`6arX9xZ5q;WxSV2HwqMVCdmQ_Q#eyYBuzKCo}D`xRJooL`#7e&ar&kRDdF z+cg0V1i6^s9aDf*IvFGSpQtrvydxXPU@!@_JVlLn^>rzhe`27elE{+4d%>=hn|N2M z-?o`>a2}C?NTYov*DKw!7l^l8Dt7I;G4kF%7;JgA zbFRwUaXEQ0mkle$GVb`t>Q?fYbY_g*2qzDkSdHAc`I0ClwL4GLJkW0P8ef&EqZmoO zA$ZHQJ@A$q)=0mL)1pXESTbVxdL1{D1CWkd+Fzy(`7rUC+0Y&5;Jz=-7=1hwbb06H zQ{r9`mq?C)vz0VF_WIO)ferdwFW-R)nQZ*4G~zE~c2ub; zbfRQm538ZC77LV>9C#6YPsUTF(xXG&?o?|84`W+Cgv;6tL~~^9-XJvLCWsIv9Kx+v zd74Y#A%ESyCIs@h_T?(=&8SI$Dsr{b_xUrF>I zB(DJ;g=azV;0byLn1{YZjD{YgERyK zXxLsRP#x5(IiTA3t7+c9NRl`dcihL$%;YDXhm1X+=aX(#2 zH0C(Z8Qgm+aFGR@e1zDWA98j#ktex)P0=vSCOHi)_xb@t#0I|HVOmfYx# zrZO{oOxTJO0W)4GA#E4Tyot;7WUU?(s&B}=k_ExJB@?WIAdQ@{|q`6Y*4+>Slf5l zBE)Qx)qoA zgm8LL_d2B$q!kI|4F|lYT?$sJ@(vUB9x16Hc)BeoAu1XIkoJ5sVW5~gB=tv28U*n< zr<;+@0c$1TCfMyPT?*&&lF>^~0K8msRYIF4+DSn&OWwY}Lzm!y+gk_xTJLQakG6If z4@x!#be)}XHlY?4ghO1^5$IS2)GLbJEr1kl4zlZX-XsieJM-d>L-K*SN0lfH(>FGa zU6*F?^NH6Ag_Mahb|%p}!V%nGT&_VP{q}`Xa#uj6chC@O8;XMns;3OSvZx2i%CX;X zcbxu6=YzcC@3%ml=2J+O%__AwC;L%iGgP0S6Aiy~$)j#xOw*gW2pO%Hfq)?>mq)pm z`tRHL#soKN7_r|EbjqxacV$y6BcbX96QZ;%1d&tS3-JxeN$e@Yb9qr z$~%}K@UiM8gOLVvm?eD7R{UN^?mJTTg!0sDHU>aZADEYTacSQ= zf|DPN(n^=*pc*c>E0qpy!Bs`qAf)%|h#V16k&~X;6m(XTcU=Hxy0soi-4%KzZ=m5F zeH2r)>%(F@iuj8M6^<(WALn3e{)7FD)+3$ohcx}A9iuXH@PU@M%UkxO6#X=sfKcl^ zthW-{TT8kq`WGSr`)B88Sv=Wm73&vGrRRS7I@%`v^JZk_?~Ys{e|S%VB7n$mh2%)( z2;Nb)(C2-yLY=y+iL^#`$0)2ZHY&%OkKdwzqeoZ{aw=I0ysc41Y5-kZtnkhR<7K`} z+wuV;UG>1%Hz|4^c0+~8o$R(zI-*wa z!5`Wb8Qg_vOYXL9d7wPLZ{faB_9}hT^%t1*#}d)&Pgc<5{m9sRN0B_(i9`wLF-w!h z={8ay>Afe*ic|t7G@a`?OWan1JVVL(RoUNcV#X&%a|qFzbc-`&U-7rvJYOic9os-P z_KcdSY}i?w>!z+SW9FHgS5LDk6jL^4qbW65yN2IIVFc^Sn!-Vv`5>-RT%#Tp?8m!^ zzw-T~*uQTMPCj>9nP-7jq~#u!yU$>`no1ja$;?c2Lkz0EpMo zS(7j{B0UIX2}OjvIjzwx3TZENzVoSUhdn0gUm9SaB{*S!c)g*a-ZpP%t^0w$i$CGo z5swKjbJK4EmPesnvWY?w_@XOy zRvxMg&H?dC23`tg`o;dScY)S+hvfC`*!F#7`1-I@A`meLO&1#L?UuMu7K~MdS*$!T z@?PsoP^8`DSIHU)rCPk(=~t;~^h)zDg<>=3V1=z1Gb{})!09}f?^XBd>^ z*cO7y*_5`s0(w*94&lohz)%0q+26k9;jOhD8a zWuCgFWZtqPc3<0lNUq6cbomYYiq-Q^EBcE*IUzsB)gAJ^H@aYkSL{=mzCW(7C$|s4 zmcW0bw`a(`7fZvCguW7d7D>*?Y7xDb%iJ{l@^Ij14m(;CBL*e}#^=!K33v^vOcug(hk4M-saU+-~>H_DF)S!icJb*=;J zgU)2pwvu~lx#8zEr6qHtm@!ZK#KdLARn*-9C^e`88?LdowcE`XG!^eN979*{rS`7a zS6FKQw7|Ra1J7b}%I-g6*QN1^n~o*JT_4WP;R7b)MDaBF$ z0S_}YhMccD@Q62@>GGYmbQ8=l0z{&5V8CnlZ#O%*mn7UQxC`(CAnt<#p>D=mIvnF) znJt({qXwp+O3zn$;Cjf*M%G^Dl6AS}P!YitcWiB6s5Qe9FKuZA3X_^MctwXw?r1oZ zJ@?^y?awLbD7b-4$OzG!Ks@m&PSvYFJKBewH{o(z6S=nv^aoKcNw4kthyUI~GoA=; zWzMi?KL1SiCUc+BZFW>abJJo8xYk62W_HI2xRV)!govrF_{T?wZM=;TqKWO3FPQBf zZ)bt|O{)pu@@bbPOi}oOr*UBTT;*}f*1}=s5L#TVIHij-s0B1$%(=|ESfm(7phAQ} zP?t1@D>U4+G|*UVr_hA^rL;k%S+OY|C)t)5W1@Hj1hI_Pp~8>L6Gq%Mm8mcfbT44t z0lC@wq)5+qaC)AKiL5Jk;9xvzBn<01bYPRQpLyd;Lhc#)vf(-*Ca|$&uC?>C8fr`Z z_;i^5Vz?tN*LZ6!FuB_t?~DMG(kZ=bP(=9}vP>99gL5KXP0#S}vapbL!wK1&lwYku zQvCvd6^&?@5pc?4o#8e zB4?br5++D1F2pv+7Xqp7luq!bpgFH+$5IhPVe790^m%7Hs?bkF1T=g$Gh;9EF;KbC zFEkOC2Igmj^|D&Wd*}*^rM_uX=yTq$DLaRX*9jIwZx@5!5G*{*dNy`alY!?^}umZouc5n7eWIT|f(N zJf)S&TY7P>{lhV2`g{U4?y=6!3=)kNvV25@k;)t&pU0!)6eW%;Gq?hZ- z5A_gT3tU%UW~|skojW$6H(Zbup(hE2ZIhksI6bV0weoPU zz{C~{7$l{b6C>*Rxq{IW)<0?F^BP??)a`B6*~Ggl#b0FdW&Imim7ZniIAxpz>M9aM z5YdpH2_Ci3qhg>PE^ew8V@yV@ogF24-Lm}bz#k4Qc{~s`>6)1OB5a+e?Zqts4Hmou z6JIC};srdCv{Y-oJP`15EAT49@1Ec*7Sgf5A5q75@6X+EDp!71)vqL7^nP4GIzvw> z9SUx);w>j^RW+(3b6^B`RroCRs!{v4T|%;xTKoG|%R+n#9ECW^(J zg5?s|+!1w9#@oO9o~PMM(bF16+*Pj*G-g-qHOAGT(i>8jFT|zy&JGgzPt+XN08X8O z*)n8i9~3r?ig(TAZ#o2m+3_xhH`}hvYgB(*nN2#w0eco;+6*?qSmc%sjwl zymcL(xb#(4(ATB8);WZ%p1Vx$Mv?bm6I<8SEX-!H`YOVyT3Rcw)Raf3 zuvCu67S5+`ZCuiGuSpJZ6!Pp)p*d#rFO`hT(!*ScsB8BcIKin#mRSC%61=X=^}I3N zCuFFr9`U;7V3q zMcCjtwSzb7>Zhw#s*+5T{e#tROAO#eWi3Gln*Y#LhR7iFyoe&F%Mhe(=WYxtIVNOK z4VyntO1zHp$Z(OQb{M(tsMCnxMh^E>BF_E3T+V$xn`tbxaBipqJswJ~@iAI_gUhiZ z#%7KINTI>%l)1!BbIDICrR8J2m? zZa6tu-qF9H1oO90m3HkkINHqwXP1eAB&y53_V9Le$RAg)MJ!(^xKq4dgLb>6HOBvu zLOF%E|Mcg-T7$_0+`L-eIdkgBD4FBz6)int$4c)U=K#F8em&u_l?g{+2jIgIZGHDW zT+s3T{!O3@vZ><#O9EwL_`fAk=Ko&_VAp>p7uE7>LapH2pW|48tWcKY~-{`zsyz+buh0KX9wfiY_Kdx2=jJB4I(8!B&~sebvy$3{&v zKj-aWT%hXZpYO**(ctA1VK>5xsQTyf0w6aNg$EPCrKcj$ zrgAQ`-?G^>ReO^ZoG#v`^)71aUH4{2rP!`sI0O@raAo0SZRuiJw0D$|s}?dGV4RjF zJAWohMx5`_zWEhVB$==DqOW`XbJQ!VF%Gc7z^ym?kL*#G{y77Owp8)n14%BrJ@e4b z^|V%SHsb-pBHJ;#ZmNE|tdmw5(aXx<@T~w^`Y`U;-lpV8NQ<;FLI()5Lte{n)8}ie z_$0UG$#TN2;hQRT5^PXDv`uet{g^&&QG!stiR`)^s9m%=4LIUgFA7HkAk~88onNN1KL> ze?Hz5bX?0;(Q=M__`)n~wB&u~3KIpSd=N-_l6Je-pph{EksBDV+2_z~qlvlUTm zht%uO3>=Xj;6ERO82%D8CldQ?k-8wE2aN4phu;xE`iiiMV6v1(k)9r(D2Xw$oEvwu zQ_Z#_cvP-TM{ZEZM6HVMR>!1n)A_n0pUsYhakH*6vnR-9?%x# z7zy~}+&Iy3oR~&yk+VvwR%@x7fNHTh6sI>j9QaGNOfPHxXNdAr&i%EjJ#aEIGTPOA zGMZ&ana!OD2k-j=`KWEKgYOCIn)>py7(hnmgKL-h>{gZRU7X+n`F?qZ|u!!V=$7B;gHFE&(egBqBAFgvP@me1VjDXcZr_QHU4VYyps%zXf*MC2=NNPX;z6h&$48KZOidz& z&mov`Y~FntLXBff^KIB;nCsAYJoTZhc0}#_2|beb)*|Xk>rof}7PzdAbiaHa;AVwJui>VGycoNG!Vx{RujYO2Viu0C{-Fx-A5vMO^ zM|_SWOd1tzQ&2}{2*e+tKhH3>TrRkqv^U+AcraOX?7?gX+@W4H725!iwU@=zJ@#-w z>8kgeJGJb4(b0chDP>Kn%REZ%A|1a8o0DJ5HAq*KugKkbbi)6@9r)E&C|G_~<;7c~ z<6a}@DAkg^g?wmG?EA(B8lpDpR8!bolpCZ>vTG%u4UA7AeMJ9!*`snk#_-*V- z3I;$xF$?e^Z1Su3j%#PgrFhQtq$mD}F59H`PImIZ&$f&pZwy1vUI)RG%J<`F;9xK% zG0c)sn62NiL}_yGTQx~#4eess);@ZL3{5UNQ?!O|(gfc&t(eC2xd3c_-2ThsLzW^q zvre~BoZzS}E~PY)tiLKDt+il+W)c*%O{Ft%Qf~=&l_U>4Z6+0*trg_K4Z}u4RE)2q z86C6tGll0l!!CGc?^}E8FDHRd7*FBVlv!Ne@f6^GaM^Wdp^^!DKB9r&}ntf?NP9%`k>R9mt4M z!OB7*m$Wa+<8Sf4i9*o9AHZ_Djq@QyY8rlun~-v(H!(8)drfhhg?O<-%CFN~Iz3nj z_Bh`)!x^(QZhrdqtT0fKW}CU>+B%D`Qn6T6`=z@NV>UmJW$S)BWU4y$ne26BEOU)y zEUTU`kYg^F!W&^Nmtw8`r8EmbYMz9k>R8iMLQ7$+aoNl_oG<_O*Poy(a^#k#CC;Oe z(mKV3eckx=KZ1fX9F}dY4^KSV-TMfcpYAR4cxZu{{JrSF4h~8iRE|YVIHsmE=2zXp z!5FUk@>%s#va~J|+9Gk_cXHEi*b{lkhee5*Buc&WTHjgQ8~yds85Y6x7DT0+5u;)0R*nlR&{)n6~(6qhfo-z=71OF&oaBJ9s^p6mYzH%1Z< zrG1wQ$?YY#b@vvQE~+$V8}ikFR&JwsYwF_Mi(&DQQK?O)jM4FB6{TsP zvv-13XpM*d{pFg#MgyrO7j4(hJ3Fv@9lWo{IL?Ry)K@yKwZX_V6|A~DPgLPPe>wyh zXi2&U3SE?it?~^lAv+eRlj9#92*0eX70+w z+%7W2_l{D0HVva$aU?d;L-X5z#DSB6k&Qv|`}{Lg&!zdFLJG!&_m z`o{??@TrsyV)6}_xFAdrK96*o`wADT&_{bG{_vAO2Z1PoEH+u2w@-=x?gD>4R<7Sm zXZB)!=YUNM4P)SQH|!2Pk|yD_qBg_!9N$L34L2tf-YS(EAyf%IO^<6`j`z5JGMw9Z zhGN+Wf`5idhpX{+`-R|;28hu}-}#2vbNg8)%^S*gVEE{WyJs0C=LC$eS+mm zYc5bHy6Cq>0RV2#qZuum>i#a)H6R!auQv`Z1<#nBa9GfU90j>s`)K{0~3{eW7AV^mgPSz zmb!*f94Q5!xHr7-MrQ}N86ZEkStQ;@xMfSUQ+kMPPJ?oc&jP(2et;3BJ*E{bF3I^PrDEhX6V>BOb^_K~h~J-nX!*y18L{$$(#nC=Qo9P~;@6V(%>sf|OS4BEgTq zJk`ZHMb2Cyzlj7)LzLsFPn^7zkfQYv*j(vV)Y5#4&)eg{D$IxlxIDSqqENjT(>B$T zV2r{I`h!GjvEWy|N#sS~ep=Z9u?lHPO|&IA`&;rCC@Ih>>5oR8&!9 zS|FBq=4Vfm1;dVmj{?3OIZTRQ7$z71)OGl}e?pFmpc^1>5&-XvXMTQ`TUY{vxDl3i zwvMwGOFnz^k56OMeKpI zrPra)NbA^cnPz@vTcQlwiH!M1h^(%Ihg%|hk}=U&)}G){sw)OEv^*!DHq0h5jU(L8 ze7i+uUQ$=z&T<7p!gzq|UDqMD+`ygbORwJe-v#gqZD zLRgo>FF=1uS#(!9AzqFEPTOt2n+pRG94OG>WO3<%8B`~} zT309B%^W#egJjPML&KFJWv?ZbFje}+jX?;ig8&at`uk%8erZMbul=BCHA;0%SHq^+ zln_*rS7lB7Ger*u8J0>~$sFTs>+L&SlNcJ_v4bpeO-A0Te=EB?W8qyg{j|)HT*O>g zVsL%sWo*t{hNr1_w;AR2o{Azt%=GQ~Pn(Y?(>3DX+*_7oX|p3ke7q?1bl+1df`ir{ zW1JS1ni|S%A>v-T!V&Smf_^)xd8cyFr5D~5TDrew*f|YFvBbptrgElr%4{kojcUww zbl3cX7hlP1q_{`tGXZk7`*qiSoe<4jjR(18U&Zf@prVyw{@of5X$zt2M=^&H(d(? zRB_SU1G^SrAQs+$^(0Nd>zBv7(h8Ww5Ths1QHC`?T0E0F%bCQ1;Vz~Ox(5`ab&3Md z=tbf#Gl*C;d5tkZQs=(vtSmm5)PF%p*Z4rsXAkqs(M1Q)0TjsLj%o=A8H-ZAI`b=e zIH_FEaUw1db}B58M@MSc*L?yu)zY_bk40;xhGl4U2Xtqejh}>*J^|Y+xreJ#(k)#G z%speAy%r_EY|%e{{i2W(5+0=_znf={5ozO|C6kAY<Mr*Ejb864E=CD;ElK!rxvO|i#2r$wVzu+$yF0d2qH zdV*F6d76MU-+B*DK&?=ml4$IPUSqBci+wgb;@<3Xf?ISla+rS>sbr8jQtk=uE+Ey* zQcq~7O(`oZ!?r(cQArZ67AaECFudH7_&WGk`yjJT`|7}M6}|29 zF9$ww^X?RY3pdqMYHETiRBe^uM;tD4#9Wf2*NmrgYIx!Ua4d64=A%6YPO@Z)R=l#3 z2vlm1rTQ(K_HXoxbA3QA8KwR_&i;n{Qz%XH^%_}`#^uKm4=Ie?w(c}qU01DRx-Ijj z_bECVym`@4RO>q(Np@FMQ507D378VCVhk!oRDjx=U7mVIe$0zlmgkBpP6n`oueI_F6JQBy?*o~we}Drf^7 z@CMrREj=|U^hz=178hdjwXk``JGWPHu_5=DJadsaOt|HA^!_3^gdGt{_vplDNbzO8 z@aY+j_(FPWarKF22dFdTL_^FCymxX{>dE)@PiI7xsDsUpJVLg+vhb6CMi6koLm;}l zN7OCXpF1N%>z|OYv&jj<=TYr!ap&KbOx!Mo26eC(Nm4|8>>bKM(#$2tIC$g9xl)vE z3A==%Yj&c8vR}wsh1NM6h}u*a3{kB5Y~xH^-tw7eg9v~>mpD*knCITj_VDBd&>t&g znQkHgP9~tD%3B7xa5^O*c<$(U4*xBw;N%ezzwY&Q2(>>+He0;iBhg>qKn;}tOg#?E zpvyH=TEL@ow$0xU$k!rM*K!9hVyO3|ovBWyT$**YVW;M(G7YcEkH0TR6{qQA+B7_5A{44uXPdCRW4F=zg~o4Fa6Fm{Lj00dJ4>~`rFPqE zJFbz_p0@4oirecYH}JSUyz}NI$ErrYNY0VzUjFZ>CW+xIO#i6(zS#p%-YN%wPX2`| zh@B2Hhv;tJB`)_SvL zC1S^jACX~)j~~Qj@!w-(m1CXkq3qsYDY%~r-`~yc-;WGmZ*(pR1~G)=Xa7xbe-*D# z=VbBb{yf$Z&hMyp`;0e?&ftYA3|-tTR2kMS_=;8dpq_oVjdwaJ7}F~fTE{Rb;U2!TC^To29bso*kU>#Y*ci8s^?R!*Bv_$j5L;`^ZUe1|&gms! zm@Aq=zgTw5c1U3gT%~Y@yN(qp$?H^UXrzy$wV?^8M*(PcW%$*IsGOt~>@lBw7y#U1 zFi>6W{K3mrE34v0CDbMqRkc*eRSps6e6a|-_aG){j*ok-O0kWIiTDU3jpm%w$}F3m zUBao!z2dm060j_*=T^nKC-ZF_(gckPJ5eEDDQH{hZyozC_7r^eGDv_Xiy`z=zy}n_ zTFa#1ROkO5ZPdaU)10eqrcFOyam#D-p~&;Px_~V}Y?n(Z;WNh9%1VYM-VyK{x8yl3 zrxrp-J03khgazvaZHqc^#>p|bUd?^zk;li=>%G3jw*1~L?cg=v(Q_ADVXNzaP< z`DxX4!Sw+)j89x_TQ^faoksQ{&v@rYz8KCH`qE~Z|FW+mM4omP0<6+g#dfc?hXpef0F1R~ji%0Zx)Mvf} zJqTA!xuBL5vy>58tu4Tdcp9;nOBbwYLrM{2_CB0>b!k<8v}_W!u7G5jk>%fP3h19K z!XyzbD%*$M&f~BMs-tX=lj$bq2ydb?6PD=JZji7+6&C_o8didaex$7Y$UkncB`y7r zP#3^7k=!`v$qnpan+9og)qYL>O)k}5jg=CNviZan6J{yP_ICW zt%q~ypb?4p8*W!og|93Fi5=AP%51xTVk0?Q5JGf;C7!d@#Rr5>IM`Wt0R2Nqm1yWa zhd)R|M?AK{lG3YNZdL(uDHM3}E2!eCfCkW|NWix$j=PVforx1}=F?f%AzpdAv6TO% z3$KG9*fs>ssipPcat-%E>gEOu+btm5=_rUx7G(SJAjcqkE}MnK_Z56e{WmOgPvB~RFSs8x^|V?qp>wFw zk3*v~{sAE_N*{JhYkwSy|KWQv5k$_n_YuUUUFaaz#g@;LNQ!#)fq<#XNCA<>VMm3I z>(j=Xh#6z#zgGh1FG>z`?_-))$s>jtN|*qqkv-sXmH#VxO%{88UUwz2W-tU!_q#8m9#5v zV=MQkzsWpeRNS7#g(hCY*$h97cI5nmp-5E|g4snM1v9u6+Kt-mr`L{Mb<-^_LObKm zdQ%(&r2kJUqb&RsTB{){q~V0YIKK4@p;R`WItn1j2fLpGUCgrLn8%h^QVmy!Lf7pP4i5mqubajB0xmp|`a5QvoM$|dS95!HhHPR9 zlW>JG9BO3!iKrpSAStU$2FV2X87nb=kF~c0QKM_ta+dciENv67>E}fj{gPCjRr|dAjKps8EngRg7Jz9x`=G#fze1hMBc9>hj&1NKBXwoNL%r1q=OSB-`L<`ZmMcka`3 zv#MD>XKxIWa*~-YH)C<1M142p&W?84tCj!3c%Dkv9B)I|3hrQmE_ zWag~QGuDly`K)q#bBugtCSNu+8A1nPPjGQz!E?)*ZU;=*urVAG!#{o&ZoYZIHz-#AChpRQ+_ip&xN5PUtCY z)-U+*#~dNZ&c&0XGKF9;N_EhmTwS0;B4Lu!S<>3lEmg@^>+iX35PC^Dh-xw5owBd5 zm_os_?eYe~l_zRWZktz*87^T0)}u#gc&>No=vg&N4#Ux3BsqdA`?BDOz>ne<**0)Z zFM*$rfk7o~*`M){blHr-ft^X7c_d`Vt1XvKKq^5H+24W3U8;X5LbV@JP2IO@1$Fyq zjF0mSfoTs+YY*KwB|xnoJ%B4vghT;ko^GqO*Q=>(WB$1LkA2D5r?eE)`brsbt3u)= zbNzr@@lXpm!YW`1vi&xC!)6(Kc_eM#az#f3^L%h_b9#||Oq-JE zZ1F+!qrkBISO0DNs>xXLFwI=a+A#mhjH=KZL?j{>DY%OJcO!aotHte}D zPu31#tU{N;o;$W-xSD1erX_~OE7!(Tmi{5ZmiOCflz3%P!dyun*>&{W5rR{BBJV8Y zmD9&DSJCIpwrJ`*H9;b%SMpiS4-WuCuO;uZ;NM;|`k)Rt%1^b=|^{SI{%IE*&(_gvhSozo*{Rh4GH>&L?BHz!t_Rpu```L+cf&m=i=-CKs z_n7f=zqG>Ce8t(w0UjGcQMV;R?fRy22PMi6>fQM@qjzfV3(3~=+YDQ=@+WCm9Bt2^ zdH!(Vg}gYh;aCKPcPD8gC(Qam+Z(qR`4k9IDzU`e@@n2#$BAl^bAMenf+d%qlm8^t zw^1}44uB0LDme^MvDIJ05S+F>$y?9x44D?6QO+S9A6&b{%1)^|_&=#13N7cxupQsb zsOE=#7N4J&$CtB}6UKzZq(%n$UqW|$8wZH&Uk8J^J43$tr*Be0019FmGFFh?zb5Rw zLLndU25w#sz;~lF{ns{~BN7iSX&g0TR?YZW#_=HFmRO~7p-`(ta<=ppe51 z^5DC{)#Ezd2TOaRy-nhvD{UvjrQ-Y70_w8n92HpP668Up>Y!!C)scPI6+HtJbCiDP ze`VHYQmn{!f-OfE2rmfz&9j(ukHoif#y0cZ_cKsm!HV(%B(dx6`@G(dhS#v9DVf>q zwu{gSC3dDQAjzGJ?RfiMWi8cOY6SLS>zWcJy;0pOtB2*|gPI)Apy#5^fWpcCMK_GO z#5$gWCI=-^A`eN7*H#0K_06gr6ch}1Pl#qsh7W?~%j*y33|0sef8WoGT^j4>WrMWu zX;O6?`{4pVc8TkL;cW$$pA*tpn{8rU-_FsG__Y|5LT-XqS7Gt+hZL3JvvDZ}H6UnA z%w;6UP9&7ccuwYIl1IH)3V`B~W7a8FPsRCWw}?fjpp#LZ+Y0zz4D2T;csXiYAyyko zSV{&i_{px8i;{0pbFPLK{KZa$6UpjqVk@AhX^MZ>*x%*ZvE5l5G~FogbJvJKi>I=7 z!tmIQkBhfA+Da}TWPw=RDX(kZrxBKaB>3rma+{4v1cb|b$@SdsJL+9=xp1eQ z2Vj~52!tsfCE!9RgeE7MhoZ7G_odJJ-ABbTPPs}M)@Z3T+2x13Rk!RJ=D91|j(;=sS#t11zse`CZnV%w@j$_r{tfdpty6 zyU!kl&ABB3ya$y>UvT$gGqGUeEK$Da;nHQ1|XC2q8z zzAFh(AXA)h!h?%gOo5Q_>OK2`j=O%{&C)eIqj(Nd~lR>@am73@920zSCSK&g`QC-^R;lepfPoVPzh*f z2P?9tf<;DhXH@cN6SpAY)SnTt`P^XE>6!Hqy1!U3r}N$Y25+!;fRDs5r2I5PF0zEm zjOzTm<^kTyKxPRIlp+h7hzz!&+a!&%K=H|`j*l9$42%OrB=Xhsn#A zF8P;HPEXmJL`&C3!ZO5=GA$b9yyqlV?EmU4mB}ViSHf9oQ6EJsAe$2^x=RTN_gsUW zs+V}lfZ`=9Ct&f;iNra;ExQmU`WGD7P(Mmz3A={lbR^fYzAMlHnhHYA|Y6oYMF zd8-F~JrpbzQ$jo_SPN2OCwE1*hVWE2U*Ne3aS{OqXEk@JNcgu`3T~+3=pu`pYq<1V z`HeOj^|9P{FkXhMtOE%*>Ms7B;VskNYxg+Nkl(h|8u8|G{Yzg0mflPQnb!WDsDo)88jPJ6wPdzegK6B;OA*nyJVp37q9*?cD{qFfQo4=f0I@k7n*0Yebv0_T zKh-qoAJv;6k5QESzTiWDVZWW&ewidB_E#Bjo2iF_8eCfD+nxD{s4rnHu_cxqP4SA@iUJi`zW z&$#iE@gc&|W%Z{_Gb3BC@YEc%6Dr%d-~x1y^&xpx5}rE9WSXAO?@OsOZU2JHSr5Zz z$(#GIhLzcaZiOmvHji6KXS}c66}Zm+*2SBi@$y=VF_-kjyaixf;@~OCM*|PllPRyQ zrD9N}_z%9b8B_ob$TfyS2p%%V?PAQEmB-pp!erUjJiiIG^Vo391+>y_Jc^`bm9JO~ zJl~sofMmQ;%h5xtZbq$dk)yDK4(b3rYBxst$sfmTkCw7ci&(TP*!Ah{VvME;U%jyK zJ;sFsK_4|435q!Vg=}2h*s(xwApsTTAVZDi=VV%Ymyfw}>Z@z%!!YfPt%K@oJLO01 zhBv;Mot??bL2PdoAMw(RO)Daz>I`8o^56`j#uC0|^9u~D3`2Q~<#Gaps^USGwfxKPBj<49jj6mgrdqF z(9BD9>vtTScPQyVkUe_d@ras#Y9i))udgsm!&EAZ;neug3hO%4>w4S0)6@hCxE=D; zcx?P*w*#3ZrsygW7*#h^BN;C(%X{run`WBGDuo_vkt$AWg%_R}*)>ThG5JGsa(Hr< zG?xTD6KGGx15DLRt8VU>$=O+E3jL#nDyq6D*uZ7qi{p6*(#SZ?&RB{=E!@#(nsU@h zxT+l@26F+NI6I8z*JesPbStgA&Vct{6NJ({HHE_9Xq({`xa@x~!=G*s<@_`EDUQT& zs(5JcmjnAGqTF?w3j#Mw{oqRiYYBj|M}2M^l|O)-Tpj9G$0~`=F6qa@9kH#w8bU|x zBLuN=1b(;Rba--hpLsJe@J78+=3OZtr#CnSXE1eAcIlvaf%7`x zBGdF!B!gd5eJJL0^7*XGtNZU}RjyC5fYIQsgaUx(Z#dluGCo~y#z#UpzK{A>_P-Wv zXlyr^^_*!Am4{trs(5T+LqbN}2Obu>G$9eX|6#RtmGus z{!xG%@_t@{?HcWqTe@5Oe~i6TcWB|Zw3}qcwr$&-v2EM7ZQHhO+nBL!+dSD{YX|$Z zb+N9-Kj?4oqpF@dptWaLU*21`Ct!|(3!|5t@(C&)>7|YPq+aQd8Wpo6vH=Jp7cuKy z4!P9my7I53`<1;bN$;je)g7i zb%v!8j}F>LMQJ`QBL@zP@k8nEhv-Eg#N2+drIBmU&Ed1zdvEAY)%)qyvVNMGd-GjJ zd0h8f74V+xHjx@=@5DS1|8Y(8Vr6o}C7d{@q)WOr=f~q2B6*Tg6YXl*oWoO*{$6Fq zu90>1yR^$zM%audGlOZ1Q*^%8_npp~T_x^6{9$ML?}!}CjI95Q$f5C@(rZEZ^+-Sd z8LShFK=$XSgJuV9Xk_ZdkGwupVZ9sJetl8&LRK##kA9!gBI+O3a;|(MUw%+RDcvDW zBmNHjJz~`9Q2DxlBItYudVOtk_`0Nhzc#r2k##)MwwKR9O!A8}|3cJRcy#_eC`;6# z(cG0!3kR1fysGanXybc@zD#24(A^zG&O`Q&3kM7W@=679Gf3U*6Mkbr)CHNQWaBiqeBa$^cEyiW9;LYQ(NtDLokhR@8_b|7Y{ot{DW1Ssi(S$em}#Gh^@v= zi!+J}HS9?sbDPOCGNddn`5f=J8g{b;te$sV!8M0JyLyt2#CKw+mnwA*^jQhMpp|OJvgZ>uJopkLv*8xOjr%RpGh zQZLbC!y)IrUtzC6W}o63pWx=!p%@Ppc(b4$1S#5Wt4vXMEno@Cglu5(7zpLlT&JY& z)W3`7Y+fINObu%j&d5QCNEDxRDDF(B4^@~ut0BLd(Oiel zA{$CWQcYj>%mvxyLu!R!j@$xkh80pB(((^uf`QQdPJ0~TIco>?)1G8_DtP`#FMifs zLI%d4=-CKGpS(&|Xs+rb5D5+lXwH3SMAb1Qm8)D-jnFe2x5qU~pP&U1B~U}6oBSVS zrXZ?Ia{L8cpj6a%o)LZggi77gSa_*rb{+G~Rg)lkmI2A05ez-YQ>f@k4Jd@@5Klve zLzCp$vfE0N5TtZw#>T_!SO`Ub;RG>p*Q4~ zm1DZ6!W~GMF#=;VyLCJS=F{vW2IjEIOq_oni91M`^cY|Ol518$=Z18n1Lj^e*}{^r zL+J{Rd+A-82>VFvMtDB5;V@VllHMw!!Tkd?)RW;HTcT>Ilam;JJ{);k-087%A9 zIGK3K76`GJ%Fu?I&MXhJnr~Y?746;)DKA=XM+XXS(VE+8`Eyr<%qh}!c^%~ghusbt z;42E#CM<(R=M*FI>efD6g89)>JVZjUma>^)b4L~%9qJB+JfuH9e-&-~OH>R(jx7C3 zbWEINa{P`BK=P=#VVGIW_E4KoVE35*CW;Z|x&PgOH)CxgkVjJ`B(D9jZepmEjANw3 zw>fytRh(QsbP18ubKy);4uh%PVC+i!GYn!CnPpWF`cV{N^8!_FIoM{fpEOZCxT*PI zYq#Lo=ctrGGgb;^))Rl!29C0$rCuK@F}tI6QPDG+io04az&wd&QG2C?K$`sCi(&mV zWxFnU;!p&$OXj3o6{XUFQ?9B=VMw9;p4R;}0%@7D{F^;{YM&cNy?mTsCr0HW&|zRd zbbCN)FkuXz-Q|Bgu#V@tOWz%6+m+Yo<4W0NTaQqn!ICQDy`**=k0-cQDB;?x=M{@^ zdkJRAuoCx|tWVmL*|A-P0=WYSHUkQ)Ua>KVG_NmdO5eqzp<#3HlOx+aI)Agb=FIP>{5$LHdhkYPB^YnnVIlC)TrjuECMra`q9)zm>1EGCmYtPpJsba8x_F>r-ax zqXvzZS2LE2o>05n<;v}}dw$|n0lqiagD>FeBe}k1q@H4E4|~ijaK)6)ps9OY-ntH; zuf>LQ$}`6*Hi|C7C)Z#jRTu6J*r65E(W=+(QKB}6ZV*rHiW}+zewRbbjNvFl35wm- z_PCclxcm>ZEBo2f?@#FONngOe?Z(Rgu)wi0|2H8w1}3)uy}+q;)@-uEUp=6_1I}Uh zK%i3s4S~*cv}?y1yhunOp~)of{F|~9i~nfr?BS2-Q@fDZ=l++zC%4cFK^py|7hw`X zP?=P^Qv15g^!?q|@%_r^{d!0?OL+mkFv&Z;o4jNXREVE;X8d(kxD1b4d1tX@aB2bl zU44g%mgniF&CMh8d16)7&y~$Aq!lL)FBBKV2(kaq+)qd~p^kX(?wVM3#e{ID5g=wK z{mU)3Lmw|&FAjz(sRcsy(XD&giqrBeW$L~l+JVPgOxgY~U5`2<~cSen|Y zUcF+Q*ue32c9XJH#=PyDtpz?oM)l$=(<`I9J@UJ<9bp%&=?Be}XDNb=quxZ*+6#6c zVW$lNO1!rM0q)eM?ro9{UuFwvS*~}P)$x#nPAFb@-clM+9q8!7$3lKmhtoYvqZ+|r zaX(K{irHiss)*(9qg~d<9?@rV1j)+<(lUoO0i47ngc4JI`lAYI6cBfGsly4Rcny*s zR_|SFaS1ryN{*qVS9c|+F%W6LA>+ifOD;!nXN@1~jD>Mz&;a~Gr$a!n&3U2X#eHnI zhe?hn0@PSm49-5uGb$E0ws|Avo+peSV1qpRe>enGGW3@;Se8Gk&2>OPh}K)lcsx;I z`YuJ_Zu|`6jQHXxzYQONpYfk+kJidtt}H{;chgvH5TrH__B0SJ(r1aI#K~c%BM<>w zcQoT>$mKJ|=Z<5%1*I0drKHpw{qWX%(bv@&Izp*9K3Eo}lhrP&t{DEv4kc@6+3Ycc zHj!l^l;Juf0!_gX7aHT!!n>;x3?0M6@S>e6cdNjC1<4L>qW<^vvg&W+Q zL4#CxiQkON(Ums`Ny4Bt4jV0a?u3MTELV%rnNor9!v6f+zl{v`#&AGP4wSIZh;!~T zZ%7bZ*e);%9v_nEbKS`$3fAJcA9H1Sn_h0i2XNn!Y0w5*8~Pp*8l-mcqj3fBtyw_1 zLKptqY}k)BXU}%W_Mq49VS(eUHgG`!x-`|ly&BkA{bUq<`V-x8#$_V#s6(P{O1^nm zR8P%L(@;*|f?^fb?jh%*dtC=;z=vN$3_G9wAl!S)I$0Eck3ARnTLSz&*QfAZ$q&ugN;6{=rV z_P~nw3^wNDd>7)FzCCxqi4`}4`)x(m3O4*hJrgI-3D1&5JY9NyNm5$9&7BTt;raE= zmNlb>W{bUuP`6FT7GuwF7hN&(axy7+W7WVn;=gGP#xh1EFHC_zDTL_MD$fpI_TklP z$t90iYg93S^ic7%WtSbIRj3~k!hq==08Y_JpR`B50&#w3U$$U9=m3%2P zm@gbX1)?hBtObN71HbtWbaKbO65>y^s{n)cw`D;uyKK+!OKLVvckf?^(ThrL#}S)~QtIlPtDxByI=!9bI`o}rP#iT~2hT$%OIu43Eo zN2YiL-mtuWo(S0DIJHqgdra0B5_5upP0$!Wsb}$Zak-UuTiE(>^|-p{eLZmfU`vGo zt?0R?z2q8QIMhE257p=ep%RoxH+OT@CGYPImjKnh+(H_|4ojON_3&K9xt z!oD|zSo@DFbG7MloWJ>uCkml=OnqKL<>(|*ZV=s)wl8*O;T+^Yl&zQg=hG`$qo?t2Sw2%Y$zze zT5%2db$X~0>hO4#00y{?LF0(9JE%F`Ej07pIDIKMj~(8>LwXC#`DjJiU+1J(#|KG8 z^f8hjZuV|5x=IKl&+xdI+~XiyuYK=9`lO$ZSymF|r<+AOuevZ>^H!6<27g+vC<6jhLmiuS*U_ z7FA;C)=ztV4pq8!|0Mzjw zO74-y=+)G}4bWvV!~M~yjbSaSIK9v9jwq+>91#yzF9CY>sX>UYMOtMZ4i?meeq??^ zGl3vQOh^Z&*$$l4=Vp1L0+da1;U*<9yAPgdg9i7BXV|l3SqIw0K7UsQTMrIaKPfOI z4@!Y;e)w+=tn~K`C_1$-iR&4Nf+}o1~|}8=JASXI4aoYoAUN{ zfnLdN^@OuI1L)`tDd?|)nN6yH#hi@dVtnj~%bMeZ1sF6kr{Y4B+!)Dhavaz;Ib;59 z41c}rhmW&Jo1wF-i#-;WVl6O{O%utwqYS;|<^4s`HZyS5sK;_^vj$Z+nNXiLd=5jq z!q2|yQ;Ld}-JDo6s;Ede3b2-)Th8bI(sM}lv!|6=4aQZ6D&p+7?7syutf`ZLVWtco zlW7!FXc#MRXIj%FSUEy8K+|VfR5&zGzRjaOzG*nlv#ObxEm&URZ9_aIzDWgx8JV}#1B6%ibMf2@?lZI+z)yTG~$~z#Z z8uV%i;!rU^D?5(u)f_MB)Uwq*kiO!WwIIEy zOkCXku<4e`-U*J7$H#AdbSu2NE>G;2tZ9Uy;pad~eyC*!r3Rr8Wzh#aum1-jC^57W z?PEql?P!M<^JfWEEly!M>`o;@<=0uTh~w|1fP%jbq(%f zm5#7CZzyyNIq?}y>)J|pOpKJ=o_3^;r3B?5{~Tc|NBjVSYCSR&58;VPvvDSI zzF5Kxv^IzSV!zFFAC~Nv+N|WHqIy9Qc@hFl`vja#C!)*vR8Qpf08MDO-z4h{2pstEgo(clpMLr9BN_%w~L2EMN!a7a3_V^+h?y=qxD<090 zqx+$O=q!edYw^z7PkaVP8k*RsGv(v)ApyrbcQSeQe(~_QSD5}6l8#5}--i<*QIZo< z9zf*6!~05Nk{%k#S;b?(UWC{ViS`!I9_}_O67Ijd3lNm~>?{&?kN!~qIM5J&Ug)CO zl>bA0pp2q-dP&HsF^2H92AREM+q}48X1nZ`x9r#=+3orK`ur%eC)GkG=-Wud(iA81 zYsJth&ezm{&|!V=x_d&|C+_9Z6=u=xl@@qgllnnb%8qmTah_j>WU6%f`S*D8_{JSs zcl0n?dj0H~h84uXDI3GQ29lK4e{?pjmGcOdm2G3fZ>x!PfogVRr8B$S*=-50ap7`vHV&w@N8|K!a5)-k z9}N}oSF+A6Lwp}t1?u3ds0k(F_Ps~?13_hHph7SWp(bSB4s--Sha7e#TaZF$rQ>AO z`cHL`!ox?@g%|9MV#v#gIDKRYud7}hdR(@z-Dd{w#{eMjjQd_IdAEP!Nq`2q=&T=# znU{ukv0d5t)WViV`Q%FzC4*#`tVw3_&74UJ0c`|=7EruO^XQ#kx+|gl69U$ysPO8V z|62)KHJyw zZNp)I(^Z%sO-V1!d%4UMznz%giaJCRfEy#Cq4r<*Zd&HZdA8?e$tbGCSKda>9-|@5 z1EwKfT?|G-LF3qE@^tEU#dWV5{CaNX(}4v~;mQY*i9DWm|3=-skZt59-<1=l<%h0booP^_K1OB4qxQKErjS^+-9UiXn=FpMH8Z6ZDondc67fF3{+KG%zBH{id!yxbAILN z#9fc0&vw#(U9%5^J$Ur}1N=){S2D(}4@m(El>62PJ!y**ut`=J!lExKYO*X@D#a_) zz`qvikddYJ6n6;!=5hh4=xC`XdR1YZZt{!I(1dE8$vkUWgK_q()HV9OmG#=BR#Y`F z!B38QNWFFFA$GSTN!Z$9Ko$q7&Lkz)U{^QZzHh49BWP?eHQUp1TcnIMRD@zv@_|w% z*`2QrHNIMF>OK=nPFbdVbrMK(c0WfTWCvNtP|Ld8%XxRTQPT*>_->E*JtdK7eRWb& zb5W|c5V|x{vQ%lJrAn(t_$CT{r768CduAal|AVWuBl+QCsmuKVDtgRv;*&FSa7+4H zd@mJEc2Y9T%GpwA;`h+tyqsK!9=vhPUnnA}BIuIHftIff|r^WYkkCz_jf%~5xp8qb{P0#ed!9yC8H5;t(zYovj z9|LwTq_*3FzestVO|Gg=d!E+L3)BhHzP*ADuSrIeGEhz6*gE5c99g63OhmG}WNGZb zirO!A=wDXucJFSq?CYB$%l9j%_iGv1?vx|k!Uf}WUizU6P=8<8+0*?7)QO%vbAtExq zQRssirxd7`eF;N2wgW#9@(?E1#Q1p8hmGi1mbA|eG-3Is3dgR368h7Tn$Q?mh@>bz z)>$N)?c{bnu{JPY(&3AdW%4Hdb)-GzNc2HL)H2*Iej3r^2yDfR|6;4IhIbxp~GDUv^VJn3KdAjxkyBZ?4#*8 z$br@oF%?9(pchB{C&r>DRw@M?`+z3imfW(LG@$q+2W`DpsG~yD27|%?u-L0_smquw z(6lzAMh7;D`$IH#+NP^manIA`r&#Su8jSWayRoG1b%aAt0tgiP!fHXsM7xg|nK;;J z7(dK_x;Ykx2MTB2086|D?~son(ynV1kc@3EEloqZjadRQJ&zjayiDuso=Y+sn-X0m zGUDg_YE#i6&D0W$+(;77Db>zI0Nh(wuf(J2SFn|7&^?1ln0SH{=Y&DY+Fg5@vks$j z;zH%|%OGIQR-$Vn0kz2jUPSKB*u(IJ=8qW2E;JpMxvX<}gn|;cEt+yL!EEC6jN$i8 z!&Q4S*+?H!OvybDCjc3ujKLZx8Kw8d7~Wf>1*|ca#)>dwc#If_oY0D`HmcUijA&!B z60gEHspgTUD3s4Z8ruDj`kka@djI1NZmx~D?{sZk5c*0SqEv!J!~sk1V~D-+NC97L z>J8;PUc3$YJIuW}L)hrjk(tl7UOjoDT=MYwA8M6iXUTje$0HAK3Of{gKax~a%13IJ z=Z+9ViV8xOXH6C_0tQCTYT2)#sKAqkQxn*B|2zb}b#4h=D}|z-9!jGgRrtI~|1MS0 zDfoR6I2a%`+PlGaTgs}%&hc;q`cPwmJ|bZ#euHr!8dz5vB28(7xXg3q<^;%BjpW+D z_4x0a{39oirXfQO5 z_X2t7JJkgy{Q7=|f$q(jsX-0_meCl6z%H2x>6qYw$ZOy{XMMI9iR}IXzh)>o!Zm6b zkc%XgILz_W)64C@cLcZ@>4isUTfWVvuv&NIFyQ^xzVdb|BRVg4JMk2HuWH&z^zvF{ z#2NNv5xUDIX)!fhxISl}NVIQ=$on~+k1nOryf%7}JvGr5xX6n!5ni*X=TyD|QK|E^ z0pePlb1sF;vq>C;kF`ixVAZ9rJ5{B$X~Ul8JcES?>uJ??Xnz$NmE)ROj@DcaOt4Om zV`cmCxFEcy$p;4Fl43;f&dpaGfMA7Hr6KO;$87eohz(;I9mvDGEVc@6-+UqjRu$N_ z3UR8S7TZ)CxYciO-?%Ejd{A;^K7QT%lDY@+W)DEa-X)h#?Rt5WHXai8v7Vavkq!(^SW2m^bJ<1ylbSiQL2D`RALf$cv>NtN>f@ z+x?Om|D+&cd1zvhK_if-&mzbA00QpOy#K z|LSUG{ojt9YPI$lVm9dCRKe39lE_6EYEF7Rx?QWQacHpL>Yh8$&T!wIBq43(rG*7+ z!`Z?P;yX95B6jagy@W@w#KG}3e6O?`-Lrnv_pfFwUyn?m&tWNi;W)sOR_BaEwH z=#_m0gK~!6$@RFjwL`eA_0Q=e?8kX`ABOeu$HWE&ljipqY;`g>e%@>iKO^% z69ooeaXHit@JX=G3bzhE&HclMc4f-l2C>qu$$P2B5`_4RE}3;Tz0Td&&ce+?>KEm} z@{Vn8=*I6l0zY!vz&>xlM84Obd=ya`op3q@4G(hTp8(bL(x~|2ls~Ta-HPKEz;H z5EXd_IOUh;B#CNe$Ql>Y3A8|0PyI*jd$sp5phIh^EqD=zpIi&YZ8!d@RLDtIp!h$qswe8zCJ9TibxMAY27YAS&X6}G?5y5=SYK;NynjiffN5`EW z$@a%4p98{yGS$Aj>tCZ}ofQ|ji*QEht)kKQMDkVKI0T1Bkz5-9IKaJ zX_*@Bl)@6cS%oJ(jnu^N{Dx^s?pa$ZgQmu%tr=xyx6Q2|%5_M?JO_%m>TIX5|j>jl}D9lDNg?BvOYxl_%XU$`5OZ3 zG?^X&0M^jpn|6IoW{JB#%aZ>_m=G#*}&)!@+`M)G};#3@y>E0aEI> zvXeCR?JxXYOr^n02byax|frexJ(@t`Y50MPbwA4+r8`l{la)u>O z?L!r^Pd0!%-70ofzZ-unC_>_IUs;H}4`RW19=|C(x%5utcSrUyW4ui~pcP4gAPoz( z$9soesA5>Au27p37qr0i%#Y^=Bk*6%s-i^j;mSX`5Q90a+3GG*-OA{G*+GE7 z=rG79tszh`n&sE#&!I+jiQ_mLva4&yNNddaERAfk|H&)@Jp7n-GOCC>qj|RYJpUrYboNcJ;smXOS?%DV>}MwCB82+`a44?!Dse zLaunWiFxxhm%aUA@_9elOX(MY{+}MG{|d^$z{JAw|CO?)f2FL=|5wV==re!?nFr`D z-qM^Kyj-0r<{(b(@)4I$FdlDg+<26u?!w$a6!szJQ$W@Izr`$34pIA$065w zkQfvJU6F7+>b@~bpA=Cwebd0+77L&DIqKautlk1w_tlL&tCeVRidQGa?8Z^;$xhG` z)4l;bAggS36-f;MYhua%Jj)I63Q8?jEL~iXms?My1x7EV`Tph5OT@33b<+#}D`qv0 zzxYP-4VB7AJU+dD9qc`0jsJ>SGy^PM>o;KDRrQm1(J49)|RU3W{OU;dkL|82h z9_(+jv#-IX(IS2e*+7wS5x>^?;V{Fv<$wDdlr6Z+s{k1Ii-dS4d1*ssvrBOI|{I~90IbDgFR5iuJFaER};8X^|( zAa)<}nENV*fz!9Co2t;7TP0eps?|g2$Idx-+>Kbtt%8)!B~}z2z{)8|dIGJYL^o>G zGyX2hh!MNR`G@E{g{^zxYy{m4Ch?82PJy_5nf#dWq6eSD=b`9i4?47u1qE5&VTiZ} zQW+dZAUlDkh=BA6WIe|Y^-3MRFh}?Wh^8}Q*uxEt1wWism=*2 z8zPQ2ggWF4#)O8r+6ODCJ$8Dxcdet|yup+y-2>F1Yg{>Zdc4b^lo_`IH9_g0jIVys z`X?fmk8HvtJnu#s%hKmOlY3tbRU3;b8aCc9C#}7qYqlaSuJ49egWn!e_tg)MJ4W!X zmDZ!zy9~cBiG86Rfq7zJNWc2u8y@3lM|j&G8munOLDVPVD(EG=+SMl2xIfj;Qe5&M zmju>(DyF?!9&HNTXChY77@rZCNzL?h-DY%REIDOdFs!=!n`dVPmq1H-h3WlGbyEvo zEi9rhi)=Cfs7K~#xk0yDEj=rMu8JOrE`|uVY?xV&kn=0Q6j)GX!N;H&`9sIVsT?ZW zM}kuym)VNM>&XxnW}Op5p%oRyiHvtXoa?S3c~g-~G2sYhz&`m#e4j%kCF$Layl-2k z&XL91(5+|O=Y)=)MN_lF@2Q28ZwU!+e9Vt4SPhb|1 zYT}&Rj9R(hp$sR#^?Fw73t+2Zm-`>4GW&lOMrQc`)$I(ckN-|(`0oEP@)xKNS z!()w2k8cKGcZe#`-u3q!z9?>@i8Jy10rQ_zkt9k`j#aMJsV}uflFIt-H?m_~XSgUi zseRmK^8V)3^7YB!^-@5xJ8la+GtV`Vld@w1WSnK^srL0c#QxQ=wS%>0brH_EN-Nd- zb_O2`J`J&YX2|2N+m7^3K~BH~Fi*ia_~LjI{;2sr5e4DppI)c@kJ#nf3^aE8D|YRe z+pKyPE<1HP_Wi;Z&Q`<=NVI?n;I|Gmn-WC+IxX}{2(~sMZnC~}k6z#m5chIx7i84# zkdkI8FYtjV53+ChW*03>smEXc#6Zuz`8{!x@T9*-x@1W`Q#LZTymhXJ~^^V6?`pqBm%^g&^`q0o8BH{~xWZ2<}(w3aSQM8bP6( z?b+uhTH)Fup{Fpu@bqBxo6HKi{-OVPrLSTj`XzWo3YEkIEF@5zkUE8=6&t1}Mv;YJ|b}MGx2&|H~e|u&$-$v%wVW52~|msNS%bU?>?cn_-{velIhQ=@efB zk8@Nks;&q}ZT01|`N{ZRJSli_AXPyK0yhhpI1)A<^YGw<-C>eG)LeCj#p$pKM_ca0 z-*dLb@{+nSE@>Z5Mp_uMXVls1ISl<4qq&XgKBe5TFkw4P~j} z>|WrP!YY*5b~_gr8^BbnJd*AAYy*C&1;#C^4ZjK#6g<{&Vpq?23X>2qX>jpF#qQa}kCj0^ zKzxlkagCiid7%M9WV4|Y*_y*JB9lmj;en`;NEy}h7dr=g&(S_)`Bm%z)aBn}qu}4O zF@xUVS&9UNnUkE2t^!NfLye;qC_F@M9?+IS7ME;?un8hQYZHanK9*I+3WOgf{D>ak zS|&EdAMjTO$~(tx^EAWlnffklmjc{@g2pam!nw}m1+wU6q~s66vxr&VJ7ERFwK9=e z1#%v6$Sj(kTcw=x^Gp=30bgX})e!zL2DmDWLhZc#W{oCnPa=mrqv2sDxy?axyCfwD z>T?O0ss%r%x`PWc1-svaulvIcGLK>TpO19~bAu}FIShviMZ1Bc9;qbf4ho0c{S**^ zM+2(nx?#u`Es|lwEV}z1kqhCvMEf%lBFCquKVsSSaeErFLyA>SFH`++fa-2_Bo#$Q zQ4<~$&x9M=mY180NtF0*6+^L)uCb6kpqnE0=%gcB>?&zhG;rYKD%PK`G_J^L`@amD zo#W^d@N{HCHrq94?5tUaYvtC%5^;KG;)SoUSRR{UL*Z*295CnFDfg@I?HEBdkJ!$7 zoQa_wXBnm^R;fSb<@B9)XwwVXxd^!M{Q&Fh&J`ft2mE1c4%~Nvp4lo;upoXKi}gEh zVL$yej45fxF5acYwVcJmzo6}VYW*7q7Of15^_$VH$vcRNlKD8fP5g12nuD+FS3zK>{Cq?!aU`lNW0l%cQ_0d|Fb7fz>Z}Jc zTav;TpKdifdT^fDtrWT)>Z zdDX#4FlQy5kLZ)QAT~eO{#RMw~4*CH`g;8x+5=O4}TsTNQ;4rc%81N4J(4ecM zz`YWMikt(z>ueD;X)~Yk6Tej?5u30Bh%o%rG%!#X3et$qQ#J*l&_5yk6I%bAeT5OK zm)fnasd&I>aR1hDn~y&hg{lyZj6qxbD19BfZOH-;GsmN|5BqKCjCI{s_Q@lP3p2?F zXGH_-pFM}Y(vF_R@R3f11i>OGJa`JYJKZG?*nQnE^u`P{cmJoC>A#AYF|gDBFB`_N zx^(RCz0m!l`U5DFyiw>^JdeX8$bx+&=>M*HBKR}MQ%iDlP3m2Z_AY-P3)DNBH#&akdh2WSbGr1RX38o zjAHcQMKyyElKS(2fXBw+1>rh|QRr&C4IiLex39DT6(yQIOSu9a)7fUf@J#V+M_5z< zrO>(E9}66y(1)8|BIRP#iBfG>jIp-PHCrnHm>w%fn4RLh08EGWKw{BkP9RIctp1Rs zCtWifbfg8QK=*HHqA_Z}b~0rv&;kPfTS4xH!@JsN5EuvzruL9uj{>xxdz3Pb))R@0 zKuSl<%p=6_CvE^MX8OuWO$1GpSw5PYb3j?JgXrwieEo2da4xN(_Zpsml)r2%^f7)u6 zOwa(Mp1O(8uDA@_iC&$195eXvnQ*PO5bt9ODw-n;yBFSnFz?d#JYJlm4n3j=Ss$^8 zVfds2q~Vh1VND4kE1T+#W~l6BuagoLWHpBC1z)xNqO#>@H7qxLglj^!Y4S(6-~+;W zjxvb9Z(0V|-eeC~FA{cjjiSYhQ-tLMrlkgPbPRpGYF5x}Kd?2j(KaB(A*{kiYx$sI z%&k=Uo<2-60krFOB;t0F-e8{;Ln;P_6NFWW*JxaRcI%BTGAYjOy@_=9f;~zPF-~R% ziYwxSj}V923LWT9#4b)4`eFGA3px+fIg%!$X#(g7xWtq2ibxEDo3<%9ju^f6vIkj{ zH9;*u%o;QjW5Km-<<6Faq}8$lheSc!Vgx$MpGX2lN}O%vo#orxIena5dC!5cDlR?V z34g?cY8?5DoEx3BThctoU`-+Md=^96F)A~jgkRYr<9HWB)%e79-Z-16T{|i&eX8IQ zKu<=-++3`40{s;ugWP~PZS;IkPEexdai zZ4z3qZT@jzOgECJFA$L&Njdma5a-(eT02K3N~!N>HU(y`o1QVRyk1}C z!+x&XSqt-G-H3dEmQ6g=I8W)iU4qTpx12-C2Suf-zbIxn=1`pKf#h+9Jbv4Kj%gyu z;Icg_{a_|+QOd2CY4LbnHG%pR^6y1h&`BT=qm$dd68!N1Q+Z&MbbeNUFyY_WDJ7ke z@O!i~dN67}nVVe} z87_T?TE6S8ET(3q2rKz*%?06u{rp84obDSPQEue89N>D4#qG_z_ma8TZ(<%4Y8zRg zob8hH(|x@YN%vAJi6ib^Q?mN`bhb>|B(U9|hX{1#{_0c?9*}zwF|!Pj z_~-&G^Rk60ILg=0kqz?cHbmh*uE9Ru`+*G!lPF$=!~4!{H$FWry0_>-8FbK#Z!qte zXUeB;CnLP#LjDN0X??AYl;%5A%E=J%6Bpv?EDI+WPX{Y%|7tJu%FXMGr0Z^C@R4?2 z#PG+e|l8^yLMIj|LtweR`35G zKY926cpL47)e}hY$MXMn{>m3@OA4Z}$eHYCj#3y^YI{=qJ-QdR8zeWal z+Qj~gLt0kd>S52ol{cU_wk};SAMCSdBeKX|DQ5Zuza%ms*{MW@oUor6fFZAGrV{SK zgIX%S?iG^xImq49Z0+S2a;y}Ua;_gO=+&e9m5tiKMuaQIe2|IfsY0`GraUVqxZ!d* z9f%sZPhYwfthl(`9oTBh7284f;?vNd3gwfz-J9A#DE&wK{hc3ZU+7-z;;8)ZpYP(g zH`^4L!WWq!O=On<^CQHrs|(LgWzx zDE$tjKbd=#M8lkofZL(tH7)7jOBfCTvs~5@auXr~odQUZ?g9xA9OMI2NQ-%6FL3Gj z_J)#9@v^I43uam(g6P$Bdr7p{)bS)W1uMgu;Q>PCv9_wgL(|$*%15c#cj}a9 z_8B8dR;6L%2P*_+d$uSNEqol!t*|zc@IQNhpV1$_9Uab z?PpzY7?ax6Mp!gxp|N}VE=pX%5YC=k=#&7EuMpI#B2$ zQqEZASzGPEK$7D~s;q((MDBQN;9NG@@PYl_dZto|ehdd6Y3a*W$qaCkOJnlD)h*Nfto}wsOAnuHpHVdEx-F2r%Gb?V>sQxK5hN3d0jZFX2#$_MbMFja0InvG8?C5>#<4qCuZwBvM8E%VO&P5*rS zRAl&tJUcRuK>!r&cGEdRK(d?vn3G~cQ_!JPjd~_q*`&9?z`g~TWPTduP9R+XA4ZOe z8O~dyj>HTaF^VrvkI2rw+6`Wy*#BRQonx0ET)Jc{RcYI{ZQHghZQHhOo0Yb0+qTWg zx9`lX={5bKe?`QJ^X!N;2-&tk@jnRT`UmeDC0c~L2sI3ATq>{%Rj5~~um1ECyPs}Z zIi2FmV)kuUM=hdU(ufo`7AYr0eoLVVS`r`_c2``L&>0qZg7Te`=b5ZpQEBDXv7QIb z?H%grP+8Q>eZo}7f=My&P!t*!Sd{O!l~eiX#>(VOtI-+it5IezLh1}m(hS7-HUp8T zhhOcxzEPQ8L6Az}bD)%m5*hmXZ+c$*09u|b9JRz5G!pm?>9A$e-`oXo>`$Yu{)*Y{ z5mJ}z$##J~2x#Miv@adddt7P`1}tYdkwwaDmOtam7jEUn1yw7B11a-V?c^iF);K0_4X|Z>V;8&<3znEFZq^*= z)MrEXC#*Vs06!;ZrBFZ`vZ@HnD%E(qjotNmw|L1pD%-5Ws94?>k_7Bx;1% z8iMj-#aA!1|6bIsOzA6gG1OAsQuSKgLqh*%!%fK{LO)-``s?VWFz%?WFO>tU?G!sH zDz|>;xGd_dKvm}lSziTA>!|K2=+jJ-3`KD}|3EgQl=5nppUE0lS4C(+fTVWZXyODj z1hy*>M%%9_<0G~y37Sltu|9ZrnvARpJR1V*Qz*FP+MSIQKfw!23#m0 z`V7xJpH>su)hN7O_5uaEvw|Z)7cNWl@&(4TlqdpU&Iq)O;$#o830gg-qrPflWrn_M z?!HrWZ%39IQ8bfX%1?1_KN@crW$C1ZFJ4YiMN{NY)j+&PU)dJ$X@Zhqkl_V2z!HE{ zqb$($fL^PgCq)5H75hijbv%LO_WYvjbxUrD_6?5@SEBS26h{gatI#R|%jnRk$f0u& z8<`{Jrix46IH%Y@;OjcAs$u@m4Zx4PFqv)1zYvwAbtP z6vv-v#;ln~;6o<|KsG#Pon6m+O}H1b^~?nTpOalY950sJ+CJ~QJ~3}%(f`40u>V&> zn)FO;|Muh8srG-e%xdFp^^Xq@nB{n97sk7icKiyV4QzqC>uVt!2y!(8*x5%@ zEp6%B*<_yHIz!nt1)Vuf(^_{(gg!4_px&+qJaB(~K9wyl6742?_?1SAGKZl0D-B(D zut;(Xyc$x6mWf9Y;cj?7Pj&ny$qu-Mt%hx>3JvIb^m;#rI+Po$iefxkjSNlf?Zf5Z34Ke)hVln=+#`iF6KfW zqi_*s9_;MT3_VC)0)7yVRE}zX+f(!{mNc&Aa!=z@=cSvmJq;{M@VEFISK1Ss_|DuO z+)Tt8V{Li{T`u6wtEK_QtZOH8#&$KP>0r`b z3_0rn78Fg-3e+06$|)dL*PSw#B9bamic_JD-6@;_=))1gu;1U7vj( zQSgSnnScr!a?~r>8!@3IElF`k6~Csi-5`*#%2o%uT=rW7g%#IIEsfK;e}*gQ9zg;$#V$cBrQVk;2REzG z1V^tja>iXpK3a{_vQ83!MTM+a6i=Q&DI6T-0$=K5Yz-4=cL3C~%(amWPi}5ma+C#9 zPI3d(MF70Bf&Bhx)P}iKgpi`4c5zSjU}!$5xe!TLStd(W#aLNJ^FgqaX`Z}AS*rux zY1WoUXIU_fZ#1CTX8ahy6nq&CDe)dbUY&TEj(sS$%gSbPlrBwrBweexsMFun5#Zck zuzu9wVmv%X(@9_?f)f0W=!#i}5l);a@yuQJzbe&Ys$2jQ(!+wlw0g2Z73!%QlkFD` z8$hR4^JbI>>|C$qiT9{CEa`@hCPrx{W~uFkClTZ4AzB+ZWa5AY%Ca4Tl*9?jWBA11 z_A&XWz681>1EQGgSWX?jGoJ1WH{Ov#|TpARXO-kNc zt6+*5IWX~hX0S1=<1>dXlb~3jpniI)G6qV0)IYrmS2+gjXINPi7w5Ejap5r0jKjJC~21R)JukbFp(M zTg$;kaFe^isg`vYjR|i&rA}d!TS7_{y8$Q?G%!vW+;*`@6sk7RWalw(a6_3^P|0Mo z-W}IUY0K$(k@{=w8J^G5k7RX*G4X?(LCjo?WnPF4df(XABbTAEX$3t&*0VF{p@@bOiD#MCNoaPsh6uS-mah@37?JG^AFUlE!oKwaxmAujnD2GuCbm09F~$y72ogXc|U3T z+Sb!|i%X?Kwd8vAarXvdAU0Axju7sOK6>)Fb#O*fsel*nK1_?4i73`za3(3FG^juEQnS6Sez=Iz%TJjE+%5 zX9u=@M<-_~kMYbzPi@+QkJ-kfxug zH|c%IAIialXW@r(p!uO3QojEgRsNwIQ0c=`Wg-kY(x?c??=j?)%R=zj!H$=TzIQ$=+Y}IuCPpR}N&r&$2lW+@RWE znhE|4B6jp982dzRs6MoDGS99$U{N?tfR7TXGgA=JfAasxgbE4dqV&?`dBq_f&K)b> zaSlNHMiSUvrRxDKNBXBzSpp`%giaf59QBK~yFO6t2H0nsjJ01h@0FjX$prYLYXbqz zSaCXsc{(rKa1O%vWZg|eqA zahHoQ0RlJP3$+(vT^l=H1sGuP_&2ORM$akYiWj+C3UcQ+@Z{dlk@&iPhwWot3nGLLJ-?)^_=ZP-j5&0=DMiRXu zD@M4(oFJwfLD-`se)O8VVHY0$z*TS>3Nx=}1&+q3okb1iUIqrBB|1yLIRO;UgmM(- zPO(=IH!MPcnFtfcT=qBd2ne3Qr;q0lA6T5c2(P8)Xy3wO zSBc7dsrMU3JP9rQN;@O|6ScG*z&!u(`I{*dfI>A?-<*k|fuB{A2!p;O^o!J;y&zds z3}Aiot#_GOF24n&3YqAUj6A+hiHL6eaD)RG+t9*xdfpyWUyqmo^^bVFJ1|3kx)Bg+ z!?&C*T+I=_gdQY}-gG&hDBGTdNbIc(K)qMvpXm0CY-%8EOymGalWO6k(V-mITtgi$ z=dLV>(LX#fAh{OG0^WYXd~Iut{7IFmg;F%+*!||sybA$W4NujnIpe#1;0rEhsdup6 zDd~Fwei-1im7{_V;Sw8IRcW?VTjT0#iI!M;j2;GKhKcHT3F4^%L@lyCj4ORY-3crN zzi7=(jgcO}+^qGEXh>f}%sgejtC1jR&M%XQ$oRbhQU8`(3h@i9mqewTlL{azL%2yy z8@R`y*;4KsE3Q27-Rm8awi@BA?!8m;o>I+k#5kEnFIER~kHVq*=EWtWf+}A?<_O#A z6>2bpL)d{o$%#2zv2V*aOw9M<^B^$_e8^9-7UeQ7P3m3Fz2w!5w*Xy*n8)w^^)DPv z`YPK|5Q(=SbnopXu`mi*HyU)MqK*y2xsPoFC%JPdvDdVhc+bUPhT9?SldJocvnv;! zp%tX^CO$!+FAIle7IRO?Zp!It^%kgtOPEkao`(LCjv*;hPG!$a^eno*FGN?~MUdVA5DM8opmiBHr>8ct`zH=0CE>+CS`ma8S8`P7 zq(qC|$gm1)WFlH71NwIPK&q}?-ks!g$>cIO`HCoTWVPO%B^}lgokJl?gC!gZ-gQ*Q zXQnBLT+jfYk*DT*l)81lj5r$1guU?>s+72$ z&#)qS7~-LPo$s}|8xMhYPIToTt_Cj7TLp_;{?`wV+y=;{GoX>wV3wn)s&mdjKHI`* z5HAS12RcSqHE&Zl0_uTUWMR{ zj^s+0$sM!fC$Dl!F(&pyJ(_3@MZKOG8OG$!q!g)tNqV5yKowLQ0`t`uMj<|9{wB(1 z<+j)cj5Gper#qc-7j~gZ+UTWj72V)!oOPx6b#cN$0%6jS|ic1{1|}LttYeJlSIvkV82DAY|e36r+TUW!5j(t$bh|%+15b% z7`affb=qH?P!x6$e?E3)ZusHE=)hj_LU9KHw9omIF5l(WbiY9vQ#WrcbuZK z;j}qJnM^9sMJT`{;R|h$kPSv!)gpjbco9ZUBw-4fMOXt1qbb<}0HW{B23UWFqndWt zxdm%pKUMpZ7p-;9X8>p&K|6jIJlz^;8KCq8_7W!=VcY@~q(0&JAxeqUd#x6G1uiz% z{z!jl#SooiES)ds+in{uYrgyvcegbr*=V8Twy~DWkvw0-76+4!9S^8EkB%_FxP$L( zJ98FuHUkf&jN#SKtK0Ky3}ma=4@{&PF877|w!pT9 zDQo{(&pk1}haCaZsy$Kr8J66i<*vb3G}kAH zf(ycgur>Sbn}|ytZ!{&$!^s^ESP89WiIF~{xQjpqQ`dUIkjr|hBw&W*emx3&~E58WE=mL%r* zlQMDrhd`OQSM5Nv0@UESN(E^zP77@WvycW-x9En;Zvhw(U#o1A?NP3dVGxjUDvNQ8 z5;>rIViq;x2>WoMES&);A`9qs3-ii$zbS+(qg9vq6Ti#3A#Gjww)id(YmMQHCii5& z*HDOi6|0oQ$&j%L(7e*uJ!Z^uKARf@Qz3#7qqXq`$sniX>U*(|icl`2NX6{hHBTAS zSGfImv}HiDk4Y_wz&R$ZN9oH}3C>XidfXNzcgo8Nruj+A6vR1;#BMOnDWhE#wcpPH z*KqkIUorh1=nbgqBvB^f+|NRYM|$U|O}U?)&Gg+&Sqq~JXBpey7zdQ-yiLabEu0hd z!ecEK$(YIa(yS8jSuJx%A*ep1Xv&7kq*7@WFojs=C>!Q0ql6{=qQ_i{FhfI)=v*18 z@;RWJzkXx#R~E4*m6D6}Ow7n2L?N1CmSevK)gmftr>r)iP$XF#sQ5m_S=3>jM$G2S z?nL&HX%|FBnGtatE}PqAE)GDg2v883iLjC>{ePhP6c0aCYwc)N8Hjawy0&(gJk{f7 zjlcYU;C+XY_m@%omF!C+TSmFm%X4;CIBYyOe4W!ex0M+&TPWoyQ)T;Lo`5FgY?HB} zi-i8ELkmQ~*E=}+ShUa8HDV^ze^L8si}J-)VNO1BwK<@P8k*K*gpL$OfmE^+R^+CZ zC%`%4_Tp`JDvP9tuJ!#p|NQxYS*43(H?>*w+X8Y3#s|1_{P%*`Z#l5TkQ56tZood5$UR5*<(w} zxB$HtxV?jMYw~9-95}*g?PzNe#~F&@{eZN!^D-C#?bBCdSRsgnt0on!<*AvThYI``=a&_&Y6EiX#fO))6WpblB7nvbso2t`A3v; zIK+FYuEHhY1%&AN$&D=wDB~O(X$lD)#-aDDe^kkcv2+Kp&@i+Zbn^|Fw%iMkOK_HR z6`8I`iIQ^@J#oCl@9JC3s{?(S4P38pXHPz2Oj-|VeoIz>-8d@qOQ+aLslsNl+&?2v zhdDSepb)4f7kBEVHM~LRh~nOEi%*=S$RoOS>L{0(vDhT~{#-rPP&_WuG1xIH5>zsL zLa)WNma@tsTKoYt@(nE!|IO!6=ZbzvQsdRf zBB!U5ohbq<@l~S6!zCR7YXfZ<*t-PFJf+k%EtLvDx|&B+ASJ12sspZWxSLsTCt)$1=*0rH5Q>9!lq^u7D6 z_W&>SUp!sciw;&+i!mxHEvCv22TMy#Sz$yo_CBCtcgaQb3R6&i$R?&BZ)LKXTbVmc zZ;qD46b3JHl`YR4SRxKl$S2zOR#Q~q!e_B%v`5RN1n+QSu+OW4b`a7dc?$B<(B7bY zB~dk*93>$jn=psd=K=b=OaDGca-HJJ5CtQ2BlIZpKnQmzKm@Lg4OfSAOr=0$ns4V; zaEgV$Hs;qUwMukBp4h%6cYL5+=^MIUJ55=rWFK%ZTAN+*vl6;g2CoL(q4>Llkd zo$LV(1d6@QT1?7T{xHomu+U-rylpO`kX*L1OZEcBA{92erx4Id6$BCEY-WjyMP62Y zQMCkx1>WDn!ub{5_o@U!60{j{A<*XDMhZ(h&qlJCT3_3AM;pX#I**!-b;-4p<4MkUh@?}#Y>K5I;w&wDY=DW6_A%wp`QlIC%qa!K# z-_6+81)%XpM>GIcEqL$V_YMC%QMSreODFj^l!w)k$g+ENwl_{DsT8HFo$%yiE@oeU z-GZ2vtgUHn#YZ7f4~A=nWiV;*QlQnm^R~_Q>_UF=MVv9Pa0IDeR*8lK;xG6MpY||0 zv7q6s0L?gO>rx})idd1=Yb+7kVgwv6bR-EBu-7GWIYqgSA$;Ep+sk`hz=i;*_M-X(zywXb7i&duird?gP61x9XI8a9(xy@T<*KFZPY50G5+ z0`ai>vf%fjdVQAR1roLOg?&pJ>y9;Xu?X0t%Evs8kflWQ(xM=B{M@+&*}zG-RmdgC zj{>nm!0reIfd|tXi|a_T1hy8qw>Tmw1ETYOZ)IblIA;xbtSJ+9z9^*9bXDlMMeLGK zOvnK`JYEk7VaWaEvRBdHFoBfqaBCFuc?U+d+Z`@&&N;8V1;2!7izR<-= z3~BwFG$un^Xl3I@wE1uW{8wR;Zn?|VfQWR**;Q<{Qw$s9bbnV7a%*QQH1|Sp zx1Pu{Dv%~zToy?>$6!4DQF2W3Bjp_h@x5q7+dyCqA^b-d9Y=B?2DK2(C>&* zI{JtMo8luQS(h=!na1K*zOjqn#j-_{@d;#ad2di&^s1HG*3$!hNej?NYf~|oOY5f# z7lh@Hamitccyp0mCr5L7#QEED-JItdk&(rKFf+q-_y`J9FmkSS6bw>lBsr<-(&j*_T7{+7 z-SV_C^>jt##OUt#DtL7~x6aL6J?JrCvt9~_*KYQde^d8p)Vf^6Dl*R@2UnXNE*7xT zWA2pDtD~n}HYrO!E5si>o+fE~r`4a5JmGuIT=_gSOGoB{0DnO|KHggCboZ@9Blk) z7CQLfa~+elFC;T3K>)*i&N9ZRhO=J8Mu@ar86V!^hJVE*&Ps;S9!?|(A_f(&^NY7h z|FzWdGlxwkklE$k58AzR&D(x1yItJ1ne@4 zP_w3`)J75HBiZo=S?KZ7w(`Jsz$+_3*^$8SKMX)G4V<1zGROq)BLW!cD9z}Yu77(a zA#0*Tu%!tg<^8jTjbql&!N5F!Nx@&0;^XuFZm7hk#Y7nkZk^R^e$o z^#PU+^XD**DpvHGRMe>(C)9{)nrG%4Z4->A&IiR9#tn~0Z z9HuAU_?99t(HMOu>SvD}C^#jEx%#s({FHvwZCZuhUa%AM88SC{ z6W$v)IB{_Pi9|n9nyS^gL_iVkZ|*F5%Li`4US=v_g*W+1^C|{rd7A|skMMl7Xs9Ce zD(7j=p4+87VP3?}#%ZWFJgSc0xIeNiVCzWtkpp!5qz^Mp3L>CS;Glp2?3x6;c+KAo`*JIt8<82-nC$LVi`X*Vb3Rjnga@|7nqU{kPEX#HPro>Q~Ih_jnSee;i zD_~r6l*ys4^SK?VOHs`%`XC7E<}p_jsloVFu)$2BR7Ku%p=sp2Z?3}FP|Qe5GSU>& zJjVvQZK!oKCxggqZzvHSpp*HXem_X{rVW!(MX2VP=V>wCLf4uiEE`GvB)t0Vq$Ph+ zs~5P80rKxPOJ*XyKtTp^Av3rbic;Q|F_LmAyEswK&Z+m7%F**XCh4J_u&Sz5Rfv=T zY&yuHnX_BvPGjSQ z2xW>2N)m{J%2>!b<)S3Xq3!m$4O(pFs*uA%DLdy}(8PmP8q*f$&R6KAP8kXoe}wEw z-Vxk2!1%P|cLL-45(AY5lQfEL8S5r+Zwx3q$EqZp>$8S_XcgxQ)?CEV#y!|@Ba!M;(erv6ZNFi`7*aSUuC80Qm#3ER$*w0 z<&?6;EG~=PWf2mA@#ld&oAt}~*WV+1!Cv~c4ZRzm;*v-m-`O0oq8#=2z^WRv-^X*n zd6Wv0g6C?BI87jj8_gi>^Tb6VZV!zcbR96nM?0eRn>H~lz-qi7IS&1o{nym3^L^(# zAxh(DNfx#Wx-qAub-(CUHieIAYeo`@if#;RjKI!b!Nnx?s{7eGdr7llky^w&?S<~~ zkeRn22`x~FyCqtCt!+170JpCTkG{&TT7y~Z;o=YxAm!^S2?q@$tmAdeqr3M3hsGYsRq=7ptG0 z3zxWi?()OUtK0JE;ECa6h*OnpX!o^=Cn}y*(2QkLPTrJ@EPGLseTE|0+~0}HG3T42qQ2!gSBN7fs#5!fBGFvSaPE=WQ%r@ zRxs4g14nbcBjd76>Ub?rg;!7<9`3apUoDRBEB2=5d3G26s z?dG%4uFjDtI5{g zh7@Imks0oJ9j6gevF{AvA+O5>HlLn`AAc$|G`-)*dQvvON(1XiIR<{7xlU~JVUbCn z_-cz+>4#ve2-vRlHMGZ4S1;p%qG1D9D?W(TClM$VQqz|w;@L5gH?N?1LmImsX)-zi zV8z}9DehtKwD`}uT-jW2l;EGDF&`&WE-@MBH9oJr2-_T6|H=LRcfFFVO#fCQ->E4c zbKU~qb^Oo0MgN{m&ka7GvF`@Ssb*|IJM|>7Lu%{6bqHrfgyCupJlDx+d<&ArXZeWE zmzrMQ6)sgewTAkii@V2mkK2fLZ_F#7Pc`p1bsD~~B9!D9t5#p4%rg))fWhRL;qK~0 z|2Dg`E3J*xZpI^TMVDpPo9P>;gs(<$UfM{;XCY{iOANJbcm>hz(YNR;1f-sq_Um3R z*wgH*)5`)W{b%D}@Lhkayj=|Xmk=JsVlY9PHorb^pM~l6U;3~?_wG(G${e}zXy#d+ zw3nF>H&k7`2H!~o`M;k2jxTzC8{ltXw0<<(DkGj{`{)KL2w`Mrf7gFFygFe8mD+#q zrySkN^0L5@gW!AsW}?lQzI+sC=^?cdh_ruY!c$8dLKsj{C9L06)rJf6TU-2zTbuWv zStZNQL^<5T>wwtE7Xcm(7%&%xG|8#VYDr?1MCA*Fb3Hwk9@hMW%=8^H`<|j74GGkj z>4=562|J8B2W3F^*l*Wvy%ru26wH*~bw8ng-wkX(QUJiINR2OHKEnqO^ zcZcT$%Qdyi7L9yBCeW{u99M-H^L6>dCPy2~tUif*Dp}4Z$Z;fo10lTgscHI(v1@tL7mQ4+9nB*8HER3!%qE2${f{0bogjeORsw~U`W`ura=u70 zYb=H|2>M-l%#yGxGdIR&Bqo*$*=SJgZhcL`7Dx!(LaTzE{04*Naw{6PwZe9#kVQ5- zHc8YL_)gJlP^NNsGXxsjl*sE2gOw&rKz@4D#q3f-R62ENsn6^rS1_3{jToiC+(L4bbJJz`7=@3l_ z*eo(x2vK;uETgwwjdw`(rHHWo19Ei|GyLzv`I9HU3x&q~zu zKN$5}oSd_8lMr0`ut^xqJelysl!0N!Y9D=ua?(V(^ploS{6vBV#kXv*-RQNeEqs;2 z`)eip?l3X?VxUR~ln3ngWbX=LT!;$>0@?T%$a}Tz7^3aAG+~aL7)IQ=DtP7v4>4s% zf$H}NojBnhi~*n`a|Rt_a#b+$hK-8flcgEE_(*^x7IsJU#$NO*{Xj<#cAJlh}H1Y%P~BD(J&xpgO^S({DjGRFXB) z&8Cr#Y=?-UWj1Q=5HV)GS8?9Wko=TzT-z$rI|y%q(dE{BnrZtKbNXqr`ff?rrD3CJ z|Dfw-W>`vKroWC2_K3L;s~!XKB{0%5G70b;1as^&hM|1s!*JMG4#!<Ig4?u02 zy^TalZE7@@rP@9P0dT>7MUzh3E!| zl;rl>ddhxu&(#V{rdt<;&)%(;s322_4(Zi^zQ!{5f-9xrGgG+)(FKX? z!2?HB7Ey=oBtMSb_F{y;`X&9>o&$c$8?SoGl5Cwz#B!_n)diQZhCXka6@1D6z#?(iODoO<)=jbrs0d znqCDlJpGYizXJ`a!`BZqkC>Z0a2}DH!%^@TK!Y+gU;$-VIds7txQbio43x^yF?mq+7i&)q0$<+(5LjY<|N^-?_?(f9?(Nwo ziYPy|naDpcuXrB@lJ33$6nPSR{3X8{;mA>?rUPEfDLw4r`qwy7CIbxr z$=CRTm%jSJXk)z3Bg^Vkc?Re204peRz`~A2`GrTj^k-zv3QTdC-BWSZE=iX+G^ji# ztXzUMqCQ1GW>ea$Ijt>@NVFC8Rs%O&#ozBx2U~+^8RE9z3eV;W6m$Bx)zS8NRcsPr zatO2_%2FJlKEs&LW>A$xTE!aTQB^S~7_CgFaJeqMTtN>n&gGN0^QDspb@6Bn#r||g z_c{|4Txlq{ko=E@6qf9F6G6O*WELk@eWF}NF4Tty_;guo!9ALV(!h3(uLS~H(poSf zSygI|<&9-I$R~3GG#TgInS!jjRzNJUb7_)TE79M3J+QI3lLaj4U?*hS_{RM>fYYHB zi$IDpndT7Q?nXM2zsL(Fh5HR1|GqmivYDA>e}xKK=%|51*E{$N!dupbxus6vDlz8A z&Ztjf&r`KyvC|^UletNDYlFhLIF-Qes#$_*HI-;P`Pf?3Vq}tsZhp1~@GhqA5R-@9 ziApnp{sEps;#KF}ctOQMog}lX96TZGUVG(?x%xWS{Q|`or`P>Y{`bGCMrB}T{5StQ zsW};a&;s3cO#T5_giO3z=PQB@XoxyumCyykuGBc*Y6#o@(>+Hd&s#{XSpf|Hm zlj2Pl{_zs00NV{qC-x2dyW%$|JAM1^KI``$>i2!kQ3!3Bx{@Bbhn(1OV^((wf1?*4|YkpOXs}X-yCSn9-XE& z09x6exrtq%I}Cz~+mCU^{_FkUo;&w2cCpqg`zqd2%W6aXHUXYhV zh}&4(+K8ZwuQ7-H(E&XzdxCqYcGht%0|PIs}gEeK1aOj ze|iq= zYzbsi;V&MHDcKL?PKy3=0ig(tLgOi1@?y5Zb|8vYf0iNMaG5|XZ-D(krjsEBgI0o5 zsj*@&y2U9~QVVmUG|%)N^=7Q|BRP`8@N{Havc_i~IS4Z2V%7zXnC zea{%mgtJi$y-+wplXl%Ec^s9QFN(<|!M57t`bP#}c|#L3a?E`A{3P~J)^|pa*!#+i zbH}j{IQGzCZCao>9d0ekR}6t}=3Jor4goHP^Pu#~wrPX;Q8z72P~OALmGUT)HCtM# zspV&w?}BOg4mw3|BvwH8kswUxA5?-*_H>BuE17>H7(plIgmel0gVxo zJ7~1;Wa#pcIR+;bgH*4w)zIGd85|Gk^BdjMXt~yMc@z%->3w@eV6)TDuGMFZi#O#eKIyO#W zFV&qi2+ohrBdeXMtz-{7(^UNcQcAAmLcDGwNzv>Xgk8A z+6G6~C)@Xc=dy<&2@zr=HwjID>emxF9kntpbz^Gblyc4}IOvh*qNrOYlXoVzt5&zd z(`f!--L#+OW*uz8<=`GofdbS_!!8sFYrc9pYuuRzmI_OnDV6AmLKaz3PSD(fsWl;U zy+8)b;-DsJsgG{Lbsx|%gxD^IxK&K}pG0;U8Oa#}L3@p?yI+9zy5sXO6_R<0B@{2H zRI)eX^q(F^c@2q!`ywEj-lZ2a3D@z%mIAZ&b@0OzfBYBuo%Q1b~Mh58a4xm#alJY<&r6D?C$+mP#hR@%4&2*0+XTDJCb%5*{@|OwUxVttuz1dvc zb;kdpeY9lT61ZfvwVyd)`?dHx9odlNW;Kd39rBCbi5Uv7&rIGN?S_xj84RzJDX*HA zy0_{oQ-#fFHPM)z_0X+_t}IqLC|sEcT4JS#sx;ve{LE@=GRi#qK$+rWEv}iod`W^` z{}XckM5}sRa#aIKgse^xmbyHv`SO;F~WfcSKKJ~pY)vb5Xq7?*8;WWT{%$4%46D1 zh#C>AeWygc(JF^OdBf@x-YLNV=h3*39N_QMw)F{F9CjaQsts8PsAYlTxzXPUjDHYI?^Ek={6<+gEvV9+}Dk;3H3J?{MHrpRQa z)9rA8RR-xI_)l81Uu?vfPQAPYm3^e2KF?;dG%lKHG*9?OlT@E`S4hy@RY7_8iK(EY zW?9=Mu1ThNtxK;avWZLyB9JWBp;oHfVD{`4g2_8O)IL#{Gp3asA&$>8F{hZYg%wAB zEsoa@P4RSRuOiPql>6|qN`TNWvep;4l+Y5g0kmmVHs}bD4xe7-)RR(8?LMC53L800 zw3E)u(?8o(qh0GRbVcU*8{Qe3t!N1f1GSQBM)m6^g)zfM9=2^59xMaiv7RE4Z-($d zjAP_kS;|Nt=9_}pc&XHO7Op-?ECL>okUTa?jUl@IZc=Kv!y6YqP&0D&ct#>R%^Lj! zg}B+QmyRcDWGTRjS$qh&-hSZ~t_~9hTaV6T-&OES#s%hZPE%NB(-8E{zW)fpOpUSS zND3?+xDJVWUMn4m$|y8(R%OYiQju?6;&imJE** zTls}?TJcTz9^+`&xXgvNVsPU$f_rmH&a%EbxRJ;Gxi~qM-$>`picrG3oZVZE`~+M0 z=o`|KIb3~S^T~A^w)Oil3Tj2+O)Eag6hgsuDdC}9odn1omHvEfPRzz=!1|%)HDP5;_ zuB!Y|l0(WY{!&t$Te6c7YS#7%%! z!Y@y+!?69+x_28AY$mSg=8dw?HmDSK5^OG{&2wT~IoZM=N%}8Q$-V z)%OdNX7I8S6jTZmNos-uL-dryS5H%hnP}6}e@o8cdGTgp+0vDd0XTt>Z15w}GU{A= zjSq|0D+KOv8j)z=P4W<0#Wp|UnR3P_SMjOR$9vHfDM~}<_u2muMS)OCGO$8(Qvj{sU&lzDa({6 zabcxo2j{D$q>cLEbW=Kk`S$Z-=&mQOci;AnW*d&D#+B8U8_^~!DF8y-hj!|m^So$T z1r9kfb1dmikK9NSpOR4(wb@ImMbt=dNIE>#P?cmkRS175anM!##2|Yy!1F3)(moXzo zLJ#|&(~cdaWVCJPe^rWxzCJHTG)Cx@(Qx@B(1El<0-n@6*s8}ikv++Eb!O43v%l#F+a*huiBJdH(#lwzjwPT%P@1o=wMkr*@qszEm86#o1dy+8%o zDQo9G)4o8Uh+~aG2b>gaNksNdM-2Zy2<=pGVS+ztfDN{N7+bTZ7E^Ms#;NDgRt9t` zc7aH`1B}j%@p8doTuZ-61?cS*2NWQ8CVM2PVt1}J_)k&HZ3$t7{OQP*4IX)oTh91w2%~&hn#-fU851ukPzcHz#F)1nwXo+Y$3zMoU zpYt|OrV7;qDQeEOxZ)G5X9Sg9+hh<6VOG`W9*3jPgfR-?>8K}#8)u!TSFbK}Wop)b z`9thLoCLrwZIvehSQwjaKpI{<*Hb~k6F4fdWJB;^=t`7HY}$_WET?qP-<3UYSJKxe4%1 z6~XwcpJ;NI4*?g`Jk=WU?Aa>v3QU(NIbkeaMQMt${-_cAOQ2~R8Hwl_yosTDSM<<0_U0k@Eu`rH=i!zQ=WJlrbc%=Y>Bx)n zF>LfE(N&q)kN_*hjc)c<(iiv_F>S|M2IZZbZd^MuE$Gx%dfB%^EY9-OYD4QT&9?T8fy z>r}Khj!(EY5r(o@2=U}uH^4H^CL7k+Kw1r#t?Mxn?Z}ASn|;YM)oGexF6>HVPzxsl z9VZU4#teNc{ClhJT3UA)gexwJs~oQ8r<1ke{LEtU0#?8o8{nr^i67UmyRRLVuXA7l zSNhqqAeHGcAc`tw#}(i2du<~t#rXh3=DyrqQ%yB+djtHEZZL&a!JVC-O-i#qMqKh zMP5`6@^Vr+zr({XFRGSxB3EHZ*<-zT2W+-m=r2$Si3Ml#Z1;fnq0cYOKNyzlbOuv}&$7i`w^=wBv3Jzrd$fiC7N1p0Nj$h?E^8VNa z%!I*-#N|S(w^)5mW`WDq^4l?ieaMII#4VP+N7IBv_kDjEsIg@o4SyV?^ICAc-_U*i zybv&z@qS8X9gl8kIQ^NZt<~NquxyiP_b1spMRpIb4KdI&qzj_2Yi_8^LgwIc6L?BEojI2D7+wSD34|gx-EdP9_^q!^@SR-Ya*TYCNQ}D zK%1{_f*`1IZ-sF}_|aU+V5S+}{w&CFNxR3+RF(lcd(YjZ4Prc}|HE~urL`bec$M;+ znWY3z=pf{C2IIEB{$-MC6#5tk$hig{0oT#XcTlIvQT~(x2c=lk_N81KDmG3ezS`V= zb!opPp7-yC*ekET*)Um1ch6kmGnPMq*B{jjJ1AxfaJ)d8ZOTVH14%#Cqth)z|8rJz zkx~e?B_RhJ7|^u0XAc4f7WWmE+K+c*V{G0Rtl+l@CQ0z8MHrVUqxeJhf`1G0F#g+VPc!r=jNMM({^6w;60y~RCUI6}z;y47o7P7m8k zj!p@_ZymB2qH*AvbDE4^P_hpYX>Zxt)B8w7;_kG@zH&x`glf@k$6y7&P7-?EB{If+Hxk_M`o58QpFK^pQnNqGiFx$$em*z&E&d-6pBbx1f`{3T$H zH49zu``(Xjjtf>#9GV^wZ6{oJ%Pq1;$U?8h?fiMm1EfJ^vKyOuf@8ynkw=lx-zP z5x7Yw1HFq{sJMfvTY@h!19RYkY}24h)WvuYxsYboAdQJ}9errHd1)iZE(;3B0{!A- zy4N{9edg6Km5SYmgIvOvp$b`d-`s?GUJnISSwLwUP%Yz?RlItL+_c_F!v%pcA)L8l z3T&>u5aQr=5|k6q=oSUP3#neK7RRf~vFw~>#8p?oyV}pE0FN|O^{M$#`W73k90~-D z<}UG|a0Fx%F~a)+g6G>^JKM7tj8sp0Bfb z@-5kiRfQC$UVz_HqUkw%>1(IZR^au>6-Umjdc+)7qJ11`#cKM*ScR^TA&u+{~eCR(Yk7`*dj%&9?91GiBfa!zOb*YlW zHz(&h7G(vO7fv=NgLf7cNB}?Zf?Ht5gDrkXb9gMAi3C7xJ1ppjM)6MM-A5;x?z&uT zl+a{o`M2kr?Yot#%1Ma;g`9)@>qRIPDG3}5AxL7-_>F;^t5>kX3Dht&^h=2l*T73C z!ac%erZ1utg@3&sN1|+ZG_&Kv*i3J3ZrUA#&8(*{9dmfpZ#j0J<^QYNGlZ$d)sib- zoXe4_0ar+_U+L#|C9*%a2OjST)WTK7GkFlQ42Va)g}E#lD$C?|t}Cw|YkX@Dha^TK zL%q}o5>7+ZQ315>O6syEktQePOkO#l+;&G%f&LXsXynrtVup`@!I*3X2_KUk{^W8 zI|5&{%^;QL+p$$5t8k-8KZ^G~IEBiXReujdb!I&Dd+DLLZc;omvcT_Z(i6(54?9+{H1XhHMxyJoGI^_*5%95 z5Yp06&G`XWL(zqh{VBN<3k3ux-mduo^zxU^mIq32PsUH7!gEuU`k|jwLHE_~+(*f6 zad=DeD!4FQ7b|iJuZj;NG@Jw$fx9vtJ3Ef0%|K3E@J}QlrHfD*tc9{&MZ`8$gqh)p zKX%l6X=E6|8lhfsi`1F-fDOSTZ){}J3eH>6&8y6^@+#Sk8xJw-!GLAa^`>D-J=efLRXm zM+h{)GH70xE;_*RjXc0^l|A6@@V3jtkG`#Jw~%g+Mml)2@drBUB6YzCkKN(Rv^oMi z%nDNVh4FgEHDf*kY^zJt#e|GY$54Yx`l{!H>V5ncyKkbgRjIKjXNx2OeV}s3s|NC4 zk2J?r?Ht)W`o301Lm#5isPRpdN6p~)_Ip{3=AMvOo3;nvyrE0bzY+K@Kqf;4Auf1t zw==j1QGpMqa=&Rqu+=sBMc0mOn~#i$1X=ok+@CdJ>-Mh+=x(3yJzXT@q>leGNHG5o zt0s&b|EK0_Npm9lk_~QaM)eh3f>@#+PoMw|FdksdxY#v7UCDKAjU>W|xrcu-Bi=Zr z;(c4#Zf@l&ge05@9-i{)@dN~U#Fqh+5%Vh5dEo^Ab=UOs&D!y6&-?vE_5mc5^IFeC zw*-1p%7NKWFL&tC=Vu1{B)2C1K)Jl)R+aG9HCojX)E7QyWsSdiZzUoY=%)2Z?-uw3 zThQVZn{x-j7X`fb`&?6O$6&Za)5C*asI?1GAjs9A>ZZ+Q~4wc_plWU#Q|;jt(G*DSOB!$?`R zW@X&|qCFx+SRs)T8CxPDrf+;lQMjv~*PZbZ-XNU}oFm|8O2o7Z(!x z7PSp;fL6q0Q!r1=3CF`EC-=ICkD^xy)Jj;7FeaUCYF;5W1MuC5rTG9XZvh*-W|e1U zO;c)b=Y6ht$vh-afarWx6uFv5N^tb-rGSDDXBTGf7FN z$c2BlKsHkXv3P&NT0d{qjjNQ$D@kcO%pYEfBse?2Z<=$|syY<{!EtXe0ta@wR-~n+ zp3X1^nPm}B=i9Cv+74lp00uTzUPa@=T#5=;{inJ)|FkAN_Jv$<1?w-`VEdaUie^di z)W8M~u?mn|w%$qW2j?-T%qXGMDDxn$(A=)(<3J+Cgt;jjmZ@=Rs!~C0*6=9=e0l=oY?Vq6{RbM6%Z9Li5jbVy zfPohHFbjjWr_}*7z0Vf|pvAzeiWVD-$>av!mwaA>s69)it^UzB+F(?g%vH0!hor$bw%Fz~tfug)V(F8rBhrU50Pvlla5-U$!tXr?r0qAEb3A6V1aYT-L|gA$O0>F-LXhg!a@1!r3jC4>u17PHY8Ra7?gOJT)UW-G=dn{k?Gol?3vx zygnW9(};`QjUp(tHONKt8DgsfZ`$_!W32k7Fk2e!NRJ$tWW|hg{proGhoc^uNJ~zC z48)%1geJj$fKj{n4Bsl+!9#wz`mJt6ovv4qob}}zp zg^=9ic}7?p#ld7(ov4vQ-o>~nd^Y|;vEC5fOpAdNSd=f(@9zw~3R4qT_#ZlFG?(G8 z6{eh10#QV>ta2$!Z7g!`{E9~uQC5eYiMY6gs9+5(R&OGDY&;^joZr-3*@!5JQ$t1b zA`Ke9mMdHQax|Rg%8GTRccbdkwLkFA<$%oxE=Web(BF|Q>8C1BKFt{BH8k#z2ME!- z{&sTcV*A-WKR>?OLP8v0q8t1Y)`5Cet$2&tsJJU~9QRix%IG_OBlM`l0cou_H{=&% zscgipHfsh>elB+oyKKL_pD$Wj@aYCau=KGJa%~=uqVa-0hDe5*>yfEpqOoOOd!2=+ z?<6K!w5ui9Hj!qpY)fc3=37SQ<80cKHc^W7B_+m9+r*6X`>r$n3TliB@dI(|Ok(*>~hrbl_= zL0V2hSDc~fXxi8YZ~Dc7>?7+9=}g;%(7T!yW~R)pcKkI#TEFE5UmQREAoGAxGZKc1 zQ~SFOvXIs6?;eakOfF#9zi)HXI{;2Ax<7Zm5DsIp|7~#lAExA({(pm;WX(l0;`aZd zavt51B68g33t;7TG`gxf?HP)1u|yap{0GZP5`tvB#>Z|J4y~(RFE;&<0q!2G3x+}R z9iXo?aN3#rY4?MP{~4O&dsFTE#`gJE;{rh0`N-g<83L`Acf|1zX?O9~`uij#aku(E zXP^qG|8)ksa0{}7f2n|tDS3U$Z|vvh6vwy&#Rmg|g$eM&2*oD`EVhFscEb2A3X8~| z)Cclw07`vIS3S9AVlO9`rrD@MT6BG1Z0vv)kR?WlK$1Kk#+MEv#;(HD?9T?N_;2{< zc((fpW*&yvhA2#}=>E!(jY4+9l|%{ezEAo%$S(`ezWE3EgL9r6AXNE$f9l%4SSMlo zH3rCg{-Gg9TD^Z3YU|ZFkryM5Sdxlxljczr5oN58?1YypDIB)PhHl284)!G=!&Onl zfFVomrqd8v;L)&CtCM*4cL+>lFT+9@!kA`dJE^@ybx|+IVbh_#WfIJVQ6)1JbZx4% z)5Xg2QQOkLL10?O6Y8L=M|wob{2N9;2?r`C!_OQhO$p^AS%^IP$ovY^feQ~; zJ!(k#-6MIz8g`J@?2log9gDDespwsZ%SS`}{|+B!YB2eVxCY*4AB4)0*{?u*8TDOt z=74}n+8c+F?FQCoH}=;3Q}O5a2@$-9!$04rq5(V3-Z^0UwGhvgQB`8^n7N-q#Vix? zL|Vp)lSIwIyat#IrUI|Mfb8llDdw%S3JQ|QKL4?awCaf2zvXr=#Q@GPc4f@1MHJtf z+KKbB+`9J5Lf8}y8@|XNZ>2b~)IKbOY}-3}NvKNO*;>YPvz9%bynVLWm?IwQ%paB7 z|I1SOR>rq9^N?RTC|qYkES;KgjY(0CWfKZcmQeBlI?Sx7-zRtYcLTP1yjz_dr5a!@ zNZ;gm$(w}qFS)#dX&?5a`(VS27dcMYyQa9$!%{((fn0}NjxWLU&8QFRoFMz_x@Rkv$tLcwE2!G#QY%6;E1d~$_#S9)fjfX zk7cKtf|!g~aoVV*p1B;4=>x7X;mO~uH7(+vO!;DOlV(ts_q@b`WJ?aX;e+8|%@pel zcew!Mut11e42pV2YeCEBf=yVptV>P7(be| zZqu<2vkuV;7h~X7@!KSKYXpkI zL0UV4&x%>31#N(eTxB)euU4RuCuzCFFAhsC5A{XWDShGvg`o!zOXU5gSde-P!G< zP;E5^DNF|Q-TzWBhe~(dFPT(cs|{Ny#f6PCUAQLFGf>8qL!?Vy>5Jbn7ORl?+i!SJQgCb@J*ya%9Vh%(0)^*qw< zc^WOC4e!|+(RBjy?T4L-vRBRDOTSgh_W07IOtw>E8wJr@@EaNLd$mP`8%!g#-t&UN zcErpoN!!X|@1$GKvWD(W6-D~y3-wvNeZoF>t|kojzo!+}>P+&q9fre=mcmG>ttJ`k zDbYBa%h;(8(+O5Bm80TY$~ksbVtO!&)(wJgi&xI2o4yZY1a{sMxX9!dYYatRJ#YgW zq;ULbSJ;p@P+@B9Y)~eVp6JQO)F-85!`V`EY=HLPQuli^vS*v^^pd1xyf)cLEyF_+s~sH8I*LWLD`F8|Gyl@f(^j!@;ceUQOg=*IhxMH3{n0H7!q+F>8J}5?u&c*wE|K<%i$di&$Gh(Etw;ztewC@g$Rmon*OmyZ?}Ru#NSQsR-Yhyc^iKDG0A|v84hr z=~W@je*xIJ#kX=g6MwxrRVnDJ^%f`5J>U8*@swhJzja?TbX!lmxzCGcCdjQ7Rm>0Y zY5JV#IaMdqaqywP?iodeNdw2rB5%wrbtamvtfjINe?9G&F~|&uchDJ5T2n70#%=so zy7pvLDtG>5H*$CEJR+XmOOm!4S-sVIuYr^uQJ;VT*xYv0eX+`t!nWFOUdOsEikyU0 z8DJP*8!S`r)N%>Wz4y!V<%T~ginvOmyLoxZ&_UJ@-LYP>W}{nQfZwthREF~8F8+qD zyO^8K=QoSXDn#;fEWK>;rs7I2>@PWCVfwcs$+y6X=Fn(+W(aj>MR!Xz9gxy*a9^2J z%g|K&aXlQql*&@kvfxHjG7g5Hze;tRj%stNP*mFot zxh5a2lK|e&1x8V{^l~^C5;79cRy(#4=)=vMrw4$ROD2l2LAI6YV44|CA2lKx+fEye zcZh#|i1&<(|G3$K(VCY%UWJx5qFpQ&pr(?6h%3R(#%i4sQl#mbj+A^g2EU!ll~>09 z11RRoKJs4M81%8j`7;UkZS%e64-ek2iY=^SsXuZ&Xyo&F4;F~a8qZ}Sei5Jaw@h$> zTt)F&M|Q1W?BxME14d>)e3xl<%>yPN4QA2A4OSrL`SU#u7>h15p%_#uv{yzS$oBqw z)`K5E6zFN%T4Z>E@OIA1<4}v6MVY0BO`X#HpqI>>b9oY{NVwmF3QnPi)7J11c{xj1 zWjTvZzbMwVpe5ri)v#&ldci>$p5aEUDVlhUv|eI@*f!{4K3J4 zlWSaeM2%}gy7%`3SyJRq>q-9*93d>_fvjn?SZ_YJ+TZsTJdJ(WYQRZLCLIEP@Ob#b-*DHL_s2o}HY#Dn6Y z`1kWsY{l!Rp+1#c!)J@b5+h#EPq&$6+8tE)kLlaV{l%S?6voQePmC^E)Q&*90b)4k z5pI&nCKz;I0S7Mo`GXHK;Z?ftRQ+ftXq%n+!8GR#Q`i?@xYj3mlH|T>(kOH^fw8~& z@3*dC!qXs;OOg*_rCxP9whWTGp;e@@zkZiccp!=u?fh|kkltS9-sr2kcpNW7MzoI+ z=SG^%FoA3u*L>PB^ajjVC(1&r&nM8)Hbs3vwOZRxpxj&qQ)-TpoTmwhJV0tb!_h#; zrdYi8YnZITkK)J(J2WE`R!cmb0L%QCU~LPXECtvGWKS!h;(>`P*>Bsj4JW^L0ObqH zk!lz!RyIl6mA_6FN0$32bL!XOT3r_>Y5hZ_PZ!5U+IUz-J8qt8pjPBIDtpQ!Mzotg zien_FQ*?5da4OtNkup0;S%-WoJyW?VQF?B!uUa~;xz+G@7;Zdzee|NE9I!OJ=mhQYod@kBMVB0%gB07^-x5e2pltkwkrJaM0f`1EtWhqp{fnK!lORlx6*P|r0&jV`P=G16 z{5Ht0sYWZPNu$;6COMv_8LDB~pA=ZaY5u%Pu3^&7b;|_`BzV~5e2f< zxaOgBjg`(!-k}e+MARagVDmtLuZ*|HrUpu}@#06bDWynm(3uRzPiFgx?856)0O4vh zKvW9}kx;Su!e^mbp$@7+6%BokxCr?rqf9|2Q33^e_~-FL$ALiLJ1$OPo+OfjQs#W2 ztN`-A?yN!A!3q{ji5~-g?`lhTR2?Nlr_uqclAiA=+JQ$9&gdFc%E>AZdNH32bsMyrn$Y?%=`o0Qgx@ z9{5;xogfu*frFv28?CUM%=ur>tG|i@{{lg-3Faa45Vqn;K(!{P!qc;Z(b5warNp_5 ziKvH*(PAvbYN~I0F;QFOfMd^ish7>uStToz2(08m$Zb&aRcAl~$f|v+LN#OEL^GXL zXtuOugAj(oYstx3TFJoNEa90R&`#)7BA67VzR@)Nem$BthDgTZi#BubfAUwov`Xd4 zp)Uv^N%7V?_u{&OdciDkG#SD!VJwoZNpr5Iprx)$#L;Lvt60$9>*cGq{%Y|u8&}U4W)Y;L8zki^4{#zH;ewx`b?Fu zLS%HsAhP5*$}|-|*$c9AM6X@1bs+G@?Yx}j*==X$gyeg%53eV9N)`8-ejM4qw!j37 zHWcB%ytc)c?OnmSi+Io|vIFi~S_AQPh!FNx~1wk$^ zPR`4TsPY-*s55o2-I%HLUjD-?Sxvo6=r`1fzh*Y~l2oy5OWMqkVKXkMIo=KC7zl?g z)gg@((i9<3LMrJ{Mhq*L8vn#^O~Y^o~juw4+MJ%lDo^J~(7*;jvmvf0j5f zb38w%S>dR{9>PO!P|6;GVWD$sKtF$XwcFnh zK}eT3)`r*UDYhkkHfBC%?O z?0OEOUBcvoTo=zmx2MQb!XLBXjJGI*En5AL4VAv6ud4ZtC+!1Wl&gKJA2pjoGEpkj z8>ua62uGxdo#j@rXj4{U3r+&?bv$N;A$UAKci(-c2AvosKF|LozPjr@iT3?c? z+w6l98iX409##(5@EdUS&F5V@Tkx2l^q{j>M1Q5<#OzA5r4t<|8s)fS`77~&33$e| zkDaYNXb%pH!OMcKy;rzMJZ9ehJW*u#^QU({x29~P=iAhc2?oKZQ{~xM3Dok7pwd4_ z5qO;Z!?o|PLUN>S{!BB!iJfyfDkNjA&1V|Q@y9%0RIJRUTka@N7ZirykuE4HdYHWN zyy_hF6XPKGcD<(kq4>utl=br(KS_glUDoPlY^!i-3mTT};{8%xzogB*_R3$e0WY}V z$eYRG9wBOpYLsLNn>4w_33^izGOO4$FVF3DF`FCwF@>MNtS$?e`?SZnkZI{~JcCut z3$WQG9zD|OpcC5_a<^+I7v>>)8-DHspBR_!j!Km*?#f^220U&y;IBwL4Wz|tz*NPn z$W|TvfS+6MtU(DS)o6(=cq!xaqGzB1d5k~MRbMV&({=wjev>ypiJZe8t!{Rkjn*Rz z@Rv4MqETRJE0oI8bi|~j+Sq^*GO2I^P_Cgy9K9|KSLk9(!h+I(yE~|>1MyQ_>>iGDZF6WqtX5%+T?3<%F5ID9ye}l#%$0dSc(!e=dhSnt2;dy zbq+9unj7VCd*bABT5pMM3ovqFhXY_-O{;7K- z6$jTw2J-l>7|TqOr6XKm^eB9ua@to~?ltPS0a(a{F!KYrogmbKFVOPT~vP)um} z^UC1;9gObN*W+ug^Yh90_4vT!hw=w3mG75qWs+BvAplux@!tA%kddf2qp@GXW{Rqt z)c=B{yM?)L`pPqNS1)V(i<iF14}2v^1V0cWoNVe)H_FKK2G zT}}azd6!&YdE#JScgeNf-_iZqn)&&By)a4??J`>w(8<=SPkaSAG#=Kxn=6_GNdf)g zd$>TIC-8k+U83sx=7YrjAGI(zH`hIzQIa|4+=wI&X`I`6sB#wqP z$cDxL1x~uzS-G{(%hql=QFjiUG$GkMt5ZspHA>;myDBSF*&cdRQq_B^#Ns`xs5KIK zU`es~IW~tjJ}@{o#49(*F4Nf^ZO#AZjI8U?RzF__f!6N3aC#A89-RP`XXh#dAQFf` zRuMQzKUW5ndKP2cUXz5yC9BZ-;ledl`UhSe*iISA#w;vF)4i*O6d!#`Y%kL~-rQD> z-I~dTlH`W&svz|B7RN(mSoY@yJ}45U>Ujr?5}wA213} zTV1=6pST_Eg%_E+4cc8Y?CdS6E|yLyDI{EkmE}~jCZkml^APd+{0$;NL87Uaj1TsH z*CX3?=b(0@;FO=sUh-$ICO|t8$`8c~X8e0(;qsC>JtnGlfMAvv9c4WwFe7J0MVV-V zg&8y$m3GDaY`nAIeqj#GSn)2skvq{hnm|)E(H~YI(Pu@{L{bl)x>14TSeL3PBvkb7 zCDx=N6LTwVuXm1Zm`sM?T9!8%2j>D02ZMD6-H!m@%9Jv)6ObSBd$|%qQh(v>%pt%D~1s zyXofpG1@w}4f3rZE$J~!CI|Lh^Y8RYCt=U$u>(jR2{a2MKUi!{L#OR`R(nbA9Dr3( z!^9V(j{Eph-EP-m`YdxJgp~+%qHP`NJ*!vO7S2bVYo`x@ym%M^if+<)Ok$t+HEF=N z5D8B}Itb8YjOg|^2Sr;E1C>adbsRY6Mdqx_zV?MQ?myt<*w)rX(4)wS=KVn>{eK3X z_6NiS9TlsPMyIo%_8vn5zdMx`+zjH=yaZl z+&YGzFH)lB&)K5gIpDT=3Jm?;CPl^rI<-T9`MA=V(>gn2F5v-bN87CHaINc*Tx_0K zOt`_-SMoW$H8G+xzNo}XRz3(qhe*lB86Jd16)6eL3HS~0hl^4^f7dm$Vzi|R?P53N zxI`NLhM4&4tUi@6>$RNGugVITAlednopiQ2n9a>>UM4Kn7Ji8>t->%B7}NxtvXx*B zwt{+E)z5!y<1mlm_Lj-#s57#cRMGHB38TXR5BnHpagm8me?{1WjA?blBwgVG?>-BQ zX6j1Jg;cKBPi07jfgkE*O6@>=q?vOz!flti{%#=hE-18bEzc^d@+x$Vggto)JV_S< z>cQy8QMSm6YJJ6Pc30%T+>z1=2T4N_Tx_FNlx$FhNNU>aVtSx)-j5p%V0^~`r8dFd z+^aPm%yJs9I;_#rGz{8apR=>-s+Aax^vg=iG&r!w%Z=L8k_@zLso7Tys!`@Ol49jb z8XzXo`?=K~synfM9R@&_79EsP@P?a6^c7u+N${Fq66>GaD^MFx5aKC4jYrBVcG9Ty z5Naf!P{efB@t!L1tb<~eG9S^DnFDm2sGxF<9aZpPmN_)@xJb;vkY03`CS5X@v!h0cT8K5ACAO0JlqPK)wtIK=*5?ii?E~~S)ei`Y7eFJno#b*jv~0dNoz?3f zQ7$;8s1%M?c<3-r#taw_`ZnG7W4eXm#yu#bbj8uUq%)I8MB50opCHBwV$jko?+$kB;qUe%JZPwUp{88@St{W)mFdP))i`-14HqAzGunPz(X^Oa1PTQFI~M^=GQkoZ zI(L!2Ikum><*0q)vUw6xBqR5qBOx~1D=#vbXdVUn1C8u72u_LOrr~{;uk36D9X|eu zxe^y?uP@zoNfCVF+=SC=_4mfaMPqWghJ>F8FfLZRh~g$lSfmRJtCR^=RgG2W)Oih` zB{~Sjw(2bOtF1k*IeR6e1$5J-nmANoAVB0Fx2$!qdV$~c$i_b|00+dTYhXH~Xx%g5c(X-tFM^F)_|-A8 zqZ9SM7P>b~)XiMmrcOoKBS1gn@8S!rx_yC^ac|zdu>-N~-tnq&D6C+11Cfb_$j>c} z9jXxCWlER}x=j(%m|EAXAJ zKe}(YWja>~mk3=71&w8Hgp<*pc&=lXQJxwl=PvCQCH*k)cj`jvvwR5WD9(9ftudas z)}mP{W6}h-9z=jXB$UbkdUJ*5@CR?5A!fuBDRF3=mJNRDT(a}IrwG;8E`ko@aHF~7 zX`Hv`6f#^cZ+u@`0n$|dObsLpm#$@eF)z{##CRW4!RH<8#k89L?uK3R{1|Ke#{E$& zwB8dQJ+}igrM2?_CBDv+^uX`;_isc!Ri6z23DBf7%IqX=E2v}4ljfHKhJ}=^^rlPc z(MbdiGAc>4H5I5u|D*)+vh5j`2X!x^B1_31oi9#Hk%+vxBkkV~|2fs#KR^jsOKnu+ zM}u{^>OltCgaG2>9;_SMQYUizs9ih})Fh>r(cLYH@q1GCX1Ef6@o-DEy|m(UvwVpZ zlFw~NJ!V-cfGsz-TgzB(>qxk(xHi}Saf^x3bi~fN-mDTeh_AK~ z1tz(1Qj?)Ar!&yVnTBGfi6ZUy56G(vBrm$C>mie(u8N=aT!*GK3m3mSMs{;J^ikz1 z-$89Wak)3o7;Dgqf$OZsPO2D)+kpk|7E%#|d!p+(%lbm-NqdR?!+XL`Z~uTALP1{O zOboUsZfIqVkd;<(<^Gbs>>Anb!O>K^cni^TvkrYQuoQsR-7I*1JKvUKlwWKI_xbZ6 zq2H89Zorq<48EuDbUkVA=kvZ!i2gzG+vFkTGrt8g0Q?3og5dC*?D3Kdao;^4_5(Kr zpz$mn@L}my=pjyK`DX0x2-9|rtg-X)iIk0&DbsFG;yJk&1->NMAbI&$)UlWJ!27v~ z#}B*noa;ERyd&Fi($RV>2(&?6&E}!;2f*&9hQX%HJLz2uOcBiVHsv7Thygz_U z_$`p-ER-J1Pqja3f6=f~u=W7?g0q<}V={X^Gqm~kw?I+UcGl&mp!D5!3TDSR@G$6x zsUMFJLj(8ws4mU00E>6s9ASG=S4vQoeEZA%YK$^0v+&}3z9w4BZO zW{}7BOTsU-oH+TZo1Kx#0ad1V^L{@OlCD-H@0Cv}4^=4a*72NEiu>v$ zs_bQGk+d@Oj)eU~J|Mv-4~~fgkn9}BFO)cy}9_;Q{&_=c1x}!6hkAGKrnsu!V zy3~8eq|CpB`Q|e3_o`ZnqX4h!QKAlVQ1g3(AXtUJ4SjzRTTQ~m$l;mMsnt0?3~q=n zJJ;F)^&|H*N4Nv3K18;aIf%Knk85W@nX>Fuk?>}`Ht#&x!)l`~hoMt1wzuaIQI;nM z?6gTCoe#~jTM&J4;731nX1(VkW_WlbyyiTMX3Pp4rqt#hjDBp6e>E*DtQf9}3#27BGGKWV+C|!L z>dPezS<0nm`{Ikqt>f$o6QOmDgd~w3?j>3EjZnh>X4WZy-)k&0rX{O9RPYr%+ZitI z#;4rtT5!U>HoJ&J^S%rTPTtNwuLMtW=6cHviUC7Z~{vDfi$48 zfe_RX{(+D^HuFj$U0o9Le1CJyd{{zppLfeIuA30*6fy1YTj|&v zQtkR0)@`I6g(_5O ziZhe6D5MZG3&7L>iZMOAwjX6?+m3PcGcqi`1%#^k0``u}w<9=e3>{43l8Uv`|ej}71T;z3O4 zIam%J0~3mNO01?yK4AQtPn@Qp`Kg8s`wouLPnOUaV3P9xF!oMewuar7W!ScD+umW@ zwr$(CZQDC++qP}(iZ4%9%gk!$;{1Vi@m{Pp=X}QK9hhY@*%^Z3Hmm!hqx?$zkW+RI zn!`la!ycDtq#Bsqgoq+5Q z`fqwT?Jm!LCBDYlam9^u^KM>BU|{DI$G2qyse{sFLGDC1vNBoEY-k}MY4Wd2cZA*1 z+`}0ujjtTmHJC_Xv;TS0&1Xqe)QW*wtScF-=}w^ad9)SYe1zj@%A>8+3Z6|Cj!B!K zjch51ebjpbtgpF91QN=m)G}FhkW^*Ub4sNaM-r&wN(-h&>sO25d*j8TYhRJmCt95h zM4!6`0|a@+h&QWCcE_~z_Z(F}+ekxk_G;ApB&Tc1XWFed9@371EgR7LpYVf&6ke62acZ%y5N^m!kRNCL-?~9e)D*Xj zcNc1YOjaP-c6i12$n8+mwp0Mjvii(zMFUJN1d$7q@7A&)UDz-Jey$wOJyp+ikYu_e zRhxZA3b&hl#@J?3>#G+I%7*xGwLV_JOy<>+kg%}>twZcP1y@?UlTJ*Rx8^aYv^MYc zTXkBuaWq47@QQsf_d_yfenN@jW8Y;{x`Vb)aZ2ezL&6;k^|*X^eab(5#eq8no`}Ho z+|^DnQ$~#p(WIL8f_}Q9L3S0;;GzOL_CKQFZLl;h`m>&pnVAh`m@^`7C(f zl3;cBbeR(~whxAERQv3xK%_;IkAa?R3M?f;Fsj%%l}h7URapW-M0Su(>m*`SE~*6d z`>rm~fFw67RaK*~xX)gFk!w5Ijm9(yDCEXXpW?2}oca2$4wMpOK*vhtulS(sOr+M1 zXiUq~?E=?p<^;*+(VTZU@2f_$^TE|6-3<|u69yQ09B(vXh;RgPIfuZ{fO|7XIBhd9 zW0aG*94$N#F-lU%iTF&WvZra&iahMyrBc#hJWUznvmA{x^>By71;pwa4@jI9H#|+u zFggqX)diDjaIfB(KryD%0@`gA?et&>-8d7L)Y%N~ED8PjodwDA8*l?uq&9kHO*S`+ zolwvZXKVu}LRrvh#5k^|XH_Io8l_OmH&Zh;(*q6G!@y1+@?ZvOA`t zoN1JEvWT6+s7=Vc8oNn_I9E@b-10qcvkgcpp)c3QNW7W;okZZ?s2{o-poPtE5q7h| zwqO+(T!)T(Yj@3EtRL51BGUq+%cWKrWhhD9abkBK3{7J36ZwlsFVclGL6F*|kmI08 zJ2$}gDC5^dmscdOOs7dy(^k#R=hu<6k=~S%g#F+us6)|I2{pU5Vj+KbXYyl6t=gnd zNugCfc|Igp6`d-xs1AjTCgYW)pzCx(#S>AhcHuN#p-3e{av&xjj-d;BtScFXGR@u$ z_R#E>)PJtqK$bh7qXb6s$^cH5lD+5_bUA>gd+ZiumXwW}n?bwRpiUaf?rm?FbuONa z`aroHKAUjeP`nzm!khm!iv+?8Dg{lQTn7l;X5s@?82e6I?=MXjJk{OCovcNl=13du zS+mF4AOfN=IoNc;Of@Gu?SH-|VbzrE2AD`r&^USz7@d@~RPVd}bJETA687h6IQj$3 zEy!joZ@%OBLRq*13XKP0te?U4YRl3%mjqZ=H0`fo0PGM2HEh7|k9pft+1%g;w>x&q zy7(GCd=s4WWvSaZ(_E(}@xjDhry4qj zFOj$o0~hq?uC0L~l+JxJAyFkd-?j;S5aLE{waAH=T?CWmA~X@sfB0KGDY==nbZ;rC z-oLA+@ty@A@o+NE^x`8V_J#>HhH;DkH}YB{tE8WJA3;gk=J`jzffJ3y3k*LuqEYf~ ziRtd*eHMB4RkZJF$HSKcnNiB+&im}eFMm@L+u(ZvT3xLZOO7=vy&r$B!18rSiVKYt zXNngW+;hD@dFGPH+TIZ&l0vlGyq5$PGb~aJmiBg~&kR48AZs=IY-Rj4+gcrJ3ja}r zyvn(LVLD6Jx#|+&EtgHKYpCb8tqbRV7~Cq*&OR%xoNeNh7dKXX{gsV_t@xUqzPXOh z<<4*06+Z4!Hm=7g?jdh{2_1a3+kD8X58`ROqpl#( zNy_jnP%Zz4FjYyLJtvTr!2GZ66$zot993^ z`peU81>U?&Sn28Sc5+RMvFiO3_eMV{#ATq06W0)ODTcPVowduPjh;{s2dRjE$5z-} zO^#YZ*X69=2fq-S@8N&5udp%x&)z5gZ^FT}mPFnE3NHP}g0SBM0RO*(OZ9ox+Du^? zQa`@!DC0yTHaDy3`S+TwG>OB8%W74nyJTz%|Kemq~3{ot;4g9Ezcf+gA{+wOXo6ZTjy?U%2u)*fv zY2W+7Zb`=c=MN2x2?Grtmwv#Bz$UH-Da98=Y7-{zqkvvLf>-zFmRTo{M)qOVE=zlQb(f4N zTV>G?S`D_~=d&(pDU*VF@6)f;PrA3-jIi_T`}_3d^47psG&#}z0ULRUDX4VTZ3A>A ztTuwxw|j4hA}f7>Gj0=w?nhO9cu|m!UO!KR@m>d(j~gn!B5P)oxEFS5+VC?lsv7giwCW(mr&3D&zS5q?Sw8m zIhG-%ZNv;ZjwL!p_@2s41Lbe@C;wYFOsQ!shi;i`m{Jouu5{7YzFtwhkElq5+1Q{# zM}PBx(~2J#nOv$z)sGo$7xTBmQE^V5)WB@KPT6T)OvM+3?KG;as5P{f8FMIEZvaIl zZh7ATt)=tD9+NhxjzoNGAZuD^W4X$)2cSP>lyJ4zz`!;UbM^HDs~iyp!5!wAZ6CA! z#YscD`uG?4HT>}LVKT(bDbQ$MeH)V+30WWK6_wLMj0oXuQ!_<^hs->%gQ3mc5X~b2 z@Q;}>XZCn_cH>&lw1bP(R-YiP3GFB!kT`%k*FeT7`Vh@aI&~%Ibml+e)@OF&fo+b* z!m5E~1WK}L$md>0!U(0s+d2zQP^%dP+b6VY+FN-tN=Dxa>Gb*qC9+ovs}>nAVq&cc zIxY-s$E0FLPP7dG|8*L?{j4@k%#}u#iNaL|Desd69B7?VQ<2=juKpwP#7SYJJC{c3 z>G~;cwAGC4gU`OJgKQW!U%BiMpop66504O`hYu=Qc%92T$=ioSj~vjNM?7k}_|6b> zR6alsJO&D<^_0J=?;b-5RDgRHU&CiDMHlP|6ueKSjjtSh0jfkru=GI5rX{E8y8ay8 zoqJ|=$BdL>niLbH5S`b~n-fJ5_IHfUdWUhNF{e`;wNdlHF z<9Y%%fm^8~*iyng9m^(V&mPzZ$!SqA&7?dT3tYD(L8?Pf%F+n01L(BnRNRaC$6Uo- zmTRfqDNP~tph$5nyFnVorwG{TcxJASq z9ZB24)#2KSL|6ge%(}L$71K&?@a11xfDbA?R8RdUGS8BZ*-vy(e;s0N0Eg!4Rfv^7 zY>%gL82OjCC6Sz(#^5b@=w3A+JSt=2UGMI;9qtiq+ruY^YJP!uQg;{*X>EFL2$>NE z4Z;V8`9g$4+V~^T z)ZQ`0n~zMXUz0fN{bYJ$eucDOyW4XDwnGqRM?{QujTNP|`;=)Syb7(@%6KPv$trI?1bi>aKW+BKVZ>MudH9K5>^jBgHe zBD|tBSU?wIpeuZ+yCg%s`A7}5Pt_N=dh#Fd{4`Hb{e)BoYPeo?q7Pvy%4xR`O+^fg z2WHfQ&7JZ}DNBfy+o^EjxA#rV7VEP+1vY19?9B=v?cj?<0pvbF zk!xIaInP$d2o zE*wO+)REoofdgIUsD!sPDXA=7R?CU z_G5Y5^)SQx96)&iFxxhA{X9R=5D~)WaCuh+&tCE^Q`yLeRXLPIb^R|mO#Ngl*Gh)c zGpV1iiDOk#`bf6**Q(-#UV70W&YI5+y>psP5WZ-}L*H&nwRUJr06&&G<)LM+%)r+I zR@_i$KTYi=!MI))WK$5hfiu20td*N};`;A5~_*hyERE z9}G^Q8=HiFiQ?r8obXCe3X&-)GiyeA;6iU+Hj6^=VDoK-jlZu^loKUj)v-?aSa)sH zU>iG^r}9-5NXo155{q2s@~@EErGi;N{mBJ2qK+cdtV7|5o_9G55ssvXm1Vlym;}7K zAo05nl`@o-SE;&wR!h4GyDI61=4t2Zsc9h-YhvnH&LB}c26zk-Bpb=9O&$}%caL|i z_A$?~=pAiu^Reyqb(F#DR3&^Lav$fuP?|j}i1M)vF;Y;RV7X0z|}Z-ISkI1{#v*#r=fHA6FkE0*3&=zG_#LJv|p zglWxdwJ#MUPz@KdQep^YA7dYwQH*KUjG^2DAxu6hGA5^dnZ$#qwx3&gD-bdnR+vBb zraSMYH@FvOuH(}lSt|OG#4q)*u#UpZ2^61crm^Nyq}fp9qFT!+v24e^v-7w1KqFyV zH}qMtUfCDeJX}9=%qvjlMP=EE)xELd8a1q+nC?DGcC+@Ex^UnA?mAi>F7MuaOy>Q7 zI|kYl|98VY%l~MYXJ`KZl~pHWf0btc-{ZqD_}m?l0F!`g(i7d-fUVTJF&guKjJCH# zBIA~By97bddTk~R%GIM4;FF8L#4?UyY(=MpKx)9#jN8Ox2|6%ggHuYK$=AjdU`W~eI zP6pX}5Ecb`M_)qTlyLgrU3!Gyk(m733%>;Q;7u=}^1B@M%UAK=wrYjgN4q1!<#XPx zUrus81$qQh_~xP15t5p~R%tJ48r`{sz1H0`;_fX%_}9CSTIKuqYJ`N@={dhhWvIi~ z*W|B0xGClQvA3*Oj^D0=K}Xl`v*P_Ns|?mU7nRf(aGVB1h)>S~zh31RGqUITAIu2K zFJ{F07c-)Rm=YeToksE>%!t8%VMdn!3o`;TJt#dLi9XJ^&OMmJuBFzOtmu4sE=jI+ z!ouB5cKek^ae6I+gGc!1-;UWMD}98?%VoY=O#H2Df45Ov^&K*-|5F;=YcwQ~6FM%ZHXTLlO^EaQBU! zgd2k+m)gp1UM?v|9G-$K5r*yuqew!h4$1H=8s%Wee(>L{FTfw0eR{BH=4>U@RfU97YSg5c>y80P|inxZM$3wQe z&GMI)EoafHrxQc)pBy3dM{_k?F6k4On0hRylD8Yn`ob{KBR&E)R&(wT%HK8K>r zJ`G|q%Zp1znHnmoT;|o9sxjOZYx-hq}g8Q5@z3nE1= zbfQt|-nN~{KcGQhN~eZF!plxbeoTQEQ5URn9k6Z!^V)Gb`K$%D{~XFf#XSyP*O|WA ziay%VatM@FG#LS&wdhj?T3#h#P$MYz-s%N( zu1JBUG`IN17}KqwK(nS^1P&<$d(hVc)4NS>w;<#4Ad(Ucm^r1#gCD0Ra}o5+cCtg_AwJjX1*~P7_g-^M0|R<@4q%jO?gu5;eP3EiyPkSLD|Xa>+(jqyp;d46)De@ig5 zfxhvO&T=R8w;A|W+u<*fmP?!Q&EBr(qxQS9y|8~s2ZLhya*V6OAg0t zOrj0~+6_h)?AJVj$}c`@t&m5cvgy6dKPnMcMbO$JtL=02bn;oYqVDhm)o8Y*wCT!N4v_?J&Cs0v3 zplI676bqxNllCVhC4wG3QxA2=@mw+ZC9bA);LwaX?*m{3_66Ou(_N!w*YVY)| zm2m&MqI;x4MQ5$DjA_=$$d1^+=4n+YINJbs|%{nouK{%4>{{LA)e zo%v^}N{pyTbAmuwH6P054--8QQYT z&urpmYD?b5L2h-x=af~i_lC`I(#q@DHPH?)XksSm4alh4aBGZK9+G(y_oDEX!u`e) zGemg?#T}nj3rKieyz>$-ZXtMGnE5p&v4j{L{>LGlX!$ZZ>eo&7%dirhd6tA;YvWIS zk&DDeh9k*W;zr9--QX2|!#c(y&|AcQ_1T}wok~kMjk7qE6r_{EEGY{Ush_iO@8T@N7 zK{?q%R!v*WJ>y&SGb5PqHUq*r@)Fub0j39Q@{%}oFp~-r3ybrWNpUBHb%d!0@fM0H z>B~&&3xglB)8#JIbSS75!)h9h@37TDdU{1*$iqfl@zZ`0X{K;DG9a z9MYnc=1z_<+qqrBKvg)-pJGs)U8a~Hf>qjaOV5k(AvP068T|B7npE91SoP`(LD0E# zt1*HaqXjyZ1r8`Hf1gPr%cjTGvyUYbLSEbrhhkZ!Ytp$uXh@tn>pT1}%XF(eCZnUi z{ZDWB;KW{$I^?7cMKfCzt+AZuFcb)Pg>4fzQ7n(su` zCcE>>2t)a1YqKVj;uCwe=K82V2xg;S^JbZmzv)}oof6i8vgBhepvgsxs3syy3N><0 zh1gWMnVEBCN{TQY=@!hDYqV@6S#d6y)ScS#8I?s)o`zDrt}JZG^y67FF&T1}YdXG< z55jBfWK9ib-|BnkyJ1ZuS2Nj270pJdAOBjMFu!DifiKiv-@7l9^2Nqw56H~M;vm6W z4QJXm`q9@>FXV>--$Suhi1(hq%@OWQ^b0|a2kk8BuGBlNIoJy|Xz8CTNi+u{OEd#@ zBng)t*OAUU++RvKtNRf}&?&IewF6>qF3%UIw&KKQR;O+HE2tHdEl?(u?XeHth}NHG$%jBFvBWdZ(Jnv}9E!TS=kakyugmHH6b z{xVu7=tJ|f^AH?2^HO!9_h3>ax}4t^X5gnfU-SOm=|K`QhW$5#FZ=%}b;HEL$@G8L zZ?}K(dY5cSzj(bf@TvMYlz`CR&<#M-r1ULV(^+fHx-{Cjsjpw8@jc~4>Q#>*lJ-*y zZItofOXY-2-yHpeH+V8?GAo>{ZRdATyRTrse;PWyetA8g3UYlJhj68@CR_ogiJOoh zz{I7mm%Te2;7+MHb&5G5y-)#poVwSTUvBN$Exo*9apb>a?;$gI6g&q%f_Xmvul(Ul z2}l1$jbG>k5v$i{Zre(Cz@`R(>WeJ(fqMp4N@^*khYn}R@#pn(mz>lzIZ7B(_~ngO zF@l(&@f?4+fL#-k&-TqNVpR?z>FchCa@qOY#c*NT^FuGS(gdgX9}}ffdM>HYzuTwT z^HbnX!NPPWC&d}0BgsZ#opl`c^u)?(7|F!BuF{rKaoS1=Ix17*{75z zk#C|PzF>91<`Y)<6JJHR$X+{JJ)iTku@?Agbmr11;lw)R_>q~grKrU>Kruf>OBU)yoIz+JXc%OJ;SHsDeT+uTDhC&? z^0wg*#W08w-{nt^MOBlsh;=zLG;ezawIN1!WMt`(b5vy2C^CB+YY}l45l*a+ zE&4;ZG#T=hcUGcbP^Qkqb`J+ur8SRX7EKE2btgBIfy_W1S`52k6B zYq2eY8It|p8ZuarG4EzniGWSe&mV-%(BBCM9BbGVv{!o)^IHiPvR-7_WP>~9A9*@NW698eC+rVakCnZXx zFGPVE9>lQiA8B2V85AZCH{D?6EWeM=ZwXZ1iodLc z0>hIb{4JIvULZrD zsNz7NmjcTKV>yk%8FlHKT8cj8h<dWf!PF$GCF>e;_mALG_hxEDx|uN3_tajvZFNlduzrqn$)$}K9VN%1rgIXhcs=6~ zlYo4?-}mv1v8So*#h*)~^^uPC-kv%xym3LowS@}=TqqJ|`(U^=!7x>rW=`QSK(e9m z*zgM)M=}%aQ)*457&q^DX8E0+WTTbhJ*7@aHyTvP3ve*N5RNXggV+M|!ISl8VSS7O zGC^3ZO^&?A5cjGBwAlvTV?@r^^`pnZ>|-yusiR)MuO;vAX*V2y3p?qOWB-9wm_AjV zFz+fGo@!39k(xY%5%toFT>=JCFU?|T{u8{&aIW*l>3m)ku-Q<|q#|O`1w}@o;Ka_* zL~r`fog~eh9DUXEP_NGA7M*nFxi9>aTf0ydS)glQ(KJ*nqx8&ZeVpHxO-lQRU7N-E z@I@wHto{NfKQu!+;d{uL_p@gDj$G!!lx7lTlCF#BHgV0Px#{0smf{eQthuv#+KT?)g+o`_`j>Pt>fbu5EBmz4{gm+R!bFgRcU7GONnsS?=zvI-NyP zEGL=_@(dG|RGOaRx#5z-R%Ep{I3$sAYzyXFxuP4XfWZr-uFAaP*lom)I?{~=>H^*- z4}nv*GTiPlrAeCQ1}$07k;vr}h)|OiHoU5na|oZJ<`ppI@mPa5MKf{vPN{TWy^T{) zYqwvL%w{I|=@2YWg3=Wk5a+ zN@lY{i=Vh_^>*qWKJv^7Fs)Y%%DPwU?=(laYZ3&R#wAhZLCsD8D#ux{`L6p3a5B3! zySM|0fS&C?K-4-dy5=+7xD{l#XE*)xm5h#;G}hFusa7V=AdY|4t(?44ryVAVz)wrS z+EgCr|1PJ}?ntHq(^(V=%vq{jU{$x;5uX;U+D3KB>S>@ovkfYS+~#M_9IhA_qdn73 z{3@M5Wf`gSwutPjrke3luO~&w$8lRo9qlIBsC7o4qc4d@dJs~ve7lIuC|Gk$9B*FX zE4dti+m3f6;Y1>&$8RhCj<5j(ed92{<26oSXu>b;+>zW(Xu^&!ul(TJoxo??y z2W;zj!5K{1xNi*}42VO|^617?nelG+*mmB8`z6#|?FCH0o+A63Y!`sd&|{7(_~u)2 zi7&h%eQ+*80rRbSRm>gy6iFVB&3|CPzDH~KQ?$htDua4kUVdxO3@pD4Ll=gSk(cV2 z)K!?jf$ zD{x9L#y!rF`)R}ZDfnWbj9<=umW|;MtKKA!J8RkjQ`Ji6s8!=vR~&+Qx0s!Ch3Q=@ zl?KqOWcpt@TLgOWLbLl^XnDaa4yGjhvh9 z*EdF5ShWoxbOVJUTg(pZhqju*>3;oa0bdmJ`;(G_lRft@f(1=a zfG2~clW|(+T=uN2VEb&WGJfURj1u9w(~vhVeY|apx={-~cW?@O)O%>%zj%rCB^3|4 zg%u1D&tj8*I@p!kqNZ%=J-bPd51+FTAhta!R}1r494(d^dX;*tF2~J~(jdz|aoKR% zQcwQ^wwtflwt_pG@bBJ|&!|d#jq-DmCYuEQ%6NA9cWzC@8-mNbsi?~qCe?gGBpP!O ztKsOTdsWcz_420-r}2cA^;bN=%d9>z!rd{_CQtR(A1u(l(m6&Ch5hC1uib%GB~z3B$KNM~bh0Mae(sN3@W^)__(R>4Trcx62dfAi3wy7HH{ruJ|VP!@ODoWu< z3A~uIMXhGnv**?DtHjQHOg&$DV_p6Ec-;Mg2Wk+d|8GWe4yOOfEt;8u^Zz2^{3i&1 z)cRky=$boHKL04)Ut^r{sj;gd+ICxs^+Cwr@!K+S)dZ2q3)R`^YmgE3Hqr!|l}F_U zmT#VMi9SC^M@vVxDL&~u{{9&Jz1?2dReqn0pSLuVL_;{DvGYkbog*fzeX^-yRB@{q*}G&UZrLz@%`|K|(kX|Dxj; zMy+rP4#Poxx9@I>Xnv_U@npP8T0U@2lQpCl0sQQQ%dX$2X}z+d9(z$>a7Wh>tV)o? z#yh6osG+s(iQP4Kx6FFCOfnCr^kLd1m$Qr2L3+PL?AlI^zS}%9qw8+>nBIT9-##A> z{FBy`zlr*}uP@RW+EWuo?}wygAs;ZYX611Ue z7{@gez`nS)=8LdsW|jl3RwGJ0IPP1LLYe7Z`Go!+q}d(WM(%13bNW~Q6x~7@8<$N2 zeLgWQQr=3AjiQOfs3k#Mwwn&nq;7$@dQKz7}FgkuA;utsaGeT+jZEuWSw4dXkySR z)>TmiSCQilq0l3_p$-!Z;9gay3LtqTkFpfZxIG1SM6OWsk(&^pl%Uns!davHV#B z_|!qA7A76dAVvmeK-9($^=F{QBs(+%FCgd|+jLz~gFi@iZelNhRCc$*flAs;O^T+& z1%M5rw0~}T0xjogIO|fs;?=D~$0SlZ{8{At!{#)!6+PJc6&MxIyhl6&4| za){*gox_Z-M&O;etF2%}JJFhn=s{rY*TaW|h}+H)YL0$xa4V>2zOt^#y4HwxWFm!P zLE1}PFe=RwGBG#~3}Lzx!u;l@vl{ze7UDz9mAtO%O-|yph~jzX>XTg`T&^HYjeAVx zP**BW)REMPsu?~CP2w`lT`pjeDP(CdPo3@6EwGRO9)7hNn!D_ZN10R$!~nV?b|8FW zkr4;pqR*EOkA9{Ac&V9~KyQb*3Jsp+9rN5v)g7-2_FOK7}XeWm0Mk&S2p{6Si_ z882qkXnT_Ku8Y4-_eUd`HvxORaB-RCPokkHiw9*AfgLx$yF|j@qv2xQKu}X!1e2{) z6DJf}-o-&TT9%G86#^y~B>?&AL?`D-8h{TXCKY&o;kw5{OQ_^Q0z#7FGu=WBG_4bC zFp2<1Co>;UO2+Gi7Cm1Ch^QBH9T}i0e^1C88BVQnc(J1_$sZe>&M*c@RML^pgU!3) zN@if#im@=UQ4Awfn|@qsR%)AZY_0S@(>vImT7vZA9=4}7>g|LZO9Y*&V!5{9+ItJ> z&clx(mHgA<*ZzBz@VfX6QsSC;cHXEL{co{hg49Md^4z!Yucz)^v7hv2>SjBVe4#$e z>g8<}RkTM!^kngJn%kj^_3kM=M%bu#K!`^S%N9+C1}+;YlC)m~45eW$$zBB;@57AS zT?@o-f;MY8AtfM;z%R_+A+pHa`pIjaV?xA`136Dx|Wm{|X`o ziR6Ip&mXGV93bRi7G224g?r4Kw+)zP_dp*c`8@}js$}v%7@zz0BXKJ1Jn>+ZJHvfs zHEli+oD}^g?)T3C^+#w!x1ks6tB`nauv#ptz2_m+Fkh1N-uk5;2P1VS+@V=MZKAh) zNQ&H&w;WEhC{B$iorbbK@4k%WMbmXOC;HV$mZ2b}%Y;-{M}T4}IrZHWD}VaiDY_!X z50y4tPTWmLaVd8h#4AO$keubT;3wOxm@sGha0ZhmkOOT|Z%f)aBQovs7>L)(8BVA#zv11_zo+!@ z`54{Sz?yVDk@7*tWL-Mde04EJxw=V#BeC4i+i&6*&M9M1!5$CzW(yvF+pW)3SJ8n> zy{4(Zp%=ul@q)3oiU4Ma#E>pX4eOjxg;+xvK14P+l8KL7u5|0_RWXv~YgOFm^9_M9x_Kzvg*N%IQbIo#ZrN1;JcBNipn#iJs`ZFBLT zPY$(aZjW5Jf+(q2r^A)}MQ;j2W%xxRB`egKn00>@#fvdz^Qv7FxN6>I%q~Isn9lU- zIgBkA+Kv(eCj9w3Oz`x%m5^BfyGaB3Yxa#vx@CfUD;!+D1ycTKQo}nEE75>+Pxr_3 zrHHVDTLSkQxwa(gbs+6`Syp3m;WS?=XWBo*xFI?-1jwos>PWf4h;{eva4WDHr`L4M;q+Pgf7qyOn=K8GcxR_4J;S{^c4WvJv z4yfmbh{W?C1ZQt=#elO}UzWG(sajOVdd!sV*X=8)R&>)1hG`eMGs(ZiDiDsFsi&&Q z&i1dpUNpW+9z;GYPs`es$Ku?T_g}CTpTxRVB69P)`J{51(dnCxJS-}b2K`Y##gY6SU~3gE$(3HbHDvFeRZ$muFVNb znf|x<^*!A@Au_JvfpBu*pP-M5X4-roy*i7g{yNEJQ-0}I%r21aA*pR8hK922JT#1Pv4QjGSJnc~y_fs)oGo)I$L9KU-hBhT6TV`60xKF~ zxJ#Wy4$Lks%bY8?T1bhGt#<1bac868Ai22Wo(CgP+zntwxDXjqaj=>BQn8-_aCqO5 zq+K&g-huP!{5K`cj5%Wzdt{QC9B}uOj_tD6P>y6xDQs)zav_OYnP28b`b7RaUXy8~$%w|fj zo9}rxIL8))2CUcWZSSsH3PudIW9J*kMTsG76ZctO5{1>j(0n)LWg626xX3+>h)kK6 z2CC+QFPrD_n)ZQxGD zW~=@@M&A{-)G~)3;J3CO+pU@H0Ouj?51cW^79Y4W!*ee^#^&!Da;kNiD3;0SV^^Z~ zo_V*fWvIYoINNw_OG2};nH_2**K3_W81avM1}|l)-1*#8c30mk95tR#{d|CEAa4jxn?D-L|TwXEH9-KPvs#7Y^bfFg4Wtu4>%=jCXvvvX;<&U3kwrr_64F zAno`xQ5IxaC=OzwPXl3jEB7=3u z-nBL{nL74jGp?Vh+F9a7+Mkd%gUVe6GU2n4_QpwlWaqqKEk`qBQ@3dFJ%6VS-WaE2 zv=)D;!*$S;-#A1iFZav9ZGLq5Lnyp$XzKP(rOpg4S9}ZRy@v-h>){L`PEQ>~9P$5n zc(}v3_GVQm-PWTKzDBv`;T`j7#)P_}cP&-{1BSDOT}}$UlCO2x0mIp#-%(fJi?UiR zB{If>^&Vhmyty_@=|a!nSd@wAw>_6nb>;o&uhL9f<8la;9bd@^4m5hVj+JiuC3reW zJ}v8Xy4>klx_#fn{{!8@N5S~-){Fmn=inB4*vgd%eH4# zku76*imVquQRNr7xshu33Ic&;t0P6EQGHrr`2KV$kt_T`E~lH*9VHcBHmkP~leciH z*L9iKlk@Y2?v-d5K{T=0cI}+%IzNzCtXZt|A1AeTaQscBNT;Qf%6p~qhgNY_@5Gmm zudYoG?nIthiOL6AU_9Snghzo0;K%%Q@X|O$#n4|VwKJZ<;&0LR?<(m*5o$5z?9xhZ zS;z4Tvdd^)R=j1`&*P?^oM^}pdJYG`CNi~rhN$?OsV^(6jsvNO*5WC0EqJv7 zhvcfBTvTj-?vGN(1$siyKS!n+S~l~qpWDS$00mI}h6qb*r}{vx+nV z-mKi4C+Mq?o7BBU_Zl=iUA-e2Z<>2W)=<5+I&Qj zhXuzLq?9K5m!9Grx8MDO@qg_X<10pGw^ZX}IWuh6%;NbbJ%D%B#I??40)#LzjdU-bgV3(tX?X~;)6uVMR?uj18{5%_4!q|h=188Y9d);uheTN5n1MXQMlsYT8IUdxt1*ftUTIjf zhDeWH*r$ScM6O<1`Wzfbg20#}JX21TSG{KzW%`9h)a3(VbLZhzXH>QbOK&&jF-h3- z4JZ`O#&AQi2)hlomLP=XP4qeMn8JHSi4I{(xp73Th*6JT%vI{0RS%~M#40XS=iTUw6Zlzz z-3a=USL8S9JF5B6y9=uA5G6YO;&u~2y;&19g>`=^kz%RAr_C9qXud01VXffm3|J)M zG}xZk3P&d;yN=iBJ=j$&ftRSjO*TQk1V$cSIwNF|p{IWEfgzM9X&(oxZ0K#{IG{Kq zE9drrYv6SBU3uqp#Rccij}anlWX~l)CF+N2oJ6%8%pl-h`o#6&g$m^kI4r=k$o5>@ zZd6uDW0}H& z|G2>Q2^B$rYSC5Tk;9ils|ZX7VPP$GX*N0p$Hp7z9*1zBGv<~2WzFUX1uiJt!)^2C zwW4?1Z+YvF07o=rB%hBEaz&q6 zaS3=cQBO@MEr>*qt1s9T(uk|MYvVuxxm_i*FakLgZa7%&Sp=&2T;O?6hxTWBS^ulH za)IgA&3ywkKvF-e9$usG5^MY^MRS2>H{+c0I8WteVv(K7Yhs$pi?mD?zj=7%ty82@ zLj@_{w?voJyglC#4h~h@fao9ZI%dLckLK<`1IAmk{ui_ow1Y*x!uZRwl5II)5o35RMk;>#trY1+F5K7&WpbZ|=NHN@9Y<~q zG_d8{5ARJ;euL#WIQy-zo<|p0Haf@?U}U68NK=Dv15tN1-5nAuzZ50~OBD3UHb;!F z{}z5*@%>dbQT6u*T?xw0-;}Lzh6YFo`Uo4I&9gg0cVR*GY&CFKyPilz^($mtWm5|b zhlXR^04NrvDd>6LU{Z*f{$V6PmgTJcHb}xPddz4Xm3eHH>5<|^d)wU!?2^Q&U#*+Ql=TTj^X%Wn+3MGbl zEw#VpKODad`^!a!12*MTo}k;EAmdZ#22hDPlTEb@ZR2hZW(|7@X8rvuPSk`g3fpei zRI`ZSV)mB&16|ch$jS=y>A=9<^0-+vAf7kLC}J=#tp@OFqLh{TM({XDv#(}pcrE%7!m zg(Y|sx5?oSEjFUW36q8f2d|j8=HdZu-OEQ@P+x=; z1;|7r`K}>Wbk3EgVcb|^o_5jUWAJZUg-pntv9(8dPGWY}I&|?! z2)%V|#S$Svgk&nkJ2qtFv%VC75n_`C3r~DLmPWJ5g0lD2TT6RnM}eIIxx`Faa%K}2 z+AdkS{)0pSP1DI1(Vn)%iW|p$wrhH%2-JQqgPUon2T|oiTmr_eJl5rpb&ghbxyHv` zVB8%ThAnlz+)4Cya&|ySH`wImILb8cdOtNc9NX5B7E|b>U69hkse)T~+asA{t}eYnW@6@*dWa(o2*3b-2f zf7Gy&5c{BBfqfD|H(rG&|9kbB0f`U48Asz-SDamGyl@F)wxjpUJCmF#mBV;8l~AVb zf`-Ll*vk#Xsq2^Ci#>fGcW5Vfc8RMq{C$Zj2Z+-VPeE3GnAowP6Aj8?BG$l9zl>r= zv0)_DR^PR4m1UTwRSj_5>4(bxFvYyRyP~?DBCaHL8jRo~Lq!G_wYmnY-;>=e$rCYg z;n#_@t%yly<-P4^hZ`OV=H)SqV1*vlLyO_?GG!(q_Tfs;7BvcGdPFMKp`fae+>J0k z_k#;kUMm~JB}YG3ExN%K0*1-wCZp$ndnNdM$Wp=Py^JF5`Cip79KYWF4L{-}7})>I z@Wb`rl~Qpq{SU}c_y1@Uy`aliiUG>_KXIpW`_2E9i6-qP>=c@=n`!Lo>OQ%p=>a68 zd3lSM7jIEym%c)znxtrCVsrQdTsZul1$u331-cY|KGU)Tk!9%q6Y~d^;#@{y1c{cr zef-&>1a~`K((7nv2{4=blHXR_?GFf_?R;vJdwm|^bjd3($lu1OCV;ZaCougId?BF> zyw?y2{yo`oH|Bsa9}KZj5cxCQGLGZJv2@0k`|FbDhgn&0Xmh`tTQ;8T3egQdB)S;__tCHVGV-^G zs*(sJ78v8>M6CA+by*Q1Ut*hih|lcG!SV~^G^V#yT^Z6WDpYAJjDt1^e!eZsEEW_9 zM1d&FxRjgF;n|Y0JHL^_U{oQ>jXxmCkL2w3^oy^Kd*i2-P)%)Q;z^Nu1{ zCuRfut@*$Ae}N!Ufty2dTNvJ8q~67Hsd#F&!y&*N8_mh+6MEOu_s|!5_r1$n>sdq3D zPTg1Ipv>&d{EkMtzy~oCb!7i)khO8p+(cwJiOhab<~|@RLfQ*?i*wgNs!Qmw_S0t< zidw0R9*J{oj1pPTl*5R&q|#p3C%KAjT8CvrJ+*>hdT$@fPa?P}{w;aUP&Ra>MEMw! z;PNi1yB&Z+{8=4_gPM^B;KXh|$9oRCBPz{_G#bYLj$beX6f}tcWN zHA-#CS0OS<@z^un)+)2`vIo7HI#K1ufK$ebV2g5w=*f8uP`gjhAzhCU?22!na&c~H zmOTpnw^Wmo8vTjix~^uH+$!o8cOUwDB<6B8{;lsNjYMa4CfAWCbFF8w4T#PyOFpVf zvJYz`TtI}(p`CI8PIntcZ(vki+)quUTfYE7RoQ3CXsa>MHtTUksZsC6t2dvUeEwWv;&pw>!04 z5CL%6l(AS9S2`bmB}=0}*k%0b{~A@in~4<(y><-{q!Wg3N)v{XXZC}C6OuM$dK{fJ zfEjt?lZF!MYAHw^KJlnhCfI8s7f}bN6Utj1-@ckT7EZV+fHDFi6ta zOj3r~jvN-J<+&qHxkN}~JWzi*wsoH@>>`bVKOL6MVydQw{2oYpCBNAsh#AxjX0RI}C}vO=^pfeKJ9*FmxOo+-Npx`!F)90j+W4%98Q<80xP6T zV&Bw--!MP&f+q`eMg`6(=jRi1$NIt@8-s(-G$lspbZOy`jc_!B;;p^FKoG1n@+gpM zwsAd8_iNe9F#U|+zBIY5p^!vRBg?Hq>+Ew?T|}a(D2WgbloEE%DG5$BCb308Qq}uj zCP+4$DXCfkDQeclUtUETFJobsn>~W`CGrKQ=ROF!lgs{P=hB0e#=G_(YgMYZx-G*? z${tWHqAsgTH*b2W`E>XT?!4Fc?nl*TKRymTJ@Mwdfp=z_lA*V()TTYF!YeETX{7{* zn~;7pFZwo81?&S`&8+N9jk6S97n(f_JY4fG-ss`8+VT><<#rJ<_;Kzq!lvQjux{HA zMuJn6p8vYsuhjL-?#{tAyh~24@Perm_QD7^Ilb|y{v<)UNB*1OG!0ZYj~egs#6|2* zn*78!Td^Wcf1hv+)V*-tb*721g{yB`0aXvO6Ndy3W&MRWUjxtHPJ%}6o1?gj(9B# zozE(TYp+kb@~cI5HZw7y9E@j{TB}@^@;A5`gB>l9TWDpOaNa%|vx|}wktx$r0N=~K zEjn4CA++9BE)N=Tim9Wd;J%pQ5D8(>tSM8K^-uzCzub?679d1!hJ(mOkFA0bMENh$X#&< zglq|Lsojb3kH79KGmDNuj`OB@u(M~8(NfY!s{8jZwfiL-metPVz+k7RRc+9Kf&a#L zeH^T43yrX%G}>~Urcm>7FcZ8{5Qh}#eV-7A))wIHx;Ujo-521eY9AM+ z81VH*5CGgEH~RAb*SKtqEdNb@h?(nuf;6Xb#{b>2-sjfMA!rWz0b~CkF3m0a(Vo3b zhberLjK2VBRWz+KfbOFkC?vw)UPjk?*XP|2kRR(@%fyL*|!QEz62-)NS8Uf-Qd$tL+?o^oI;$C$?RR(e}Yo7@A zGgmI8MU+#w&wLU-O&d#)eMv;Z=AvDb>G(5YzS(QW=TcRvy?k9hKh9$ z8WDJL2tpTT4+HTZPhG*OReadjf^s5(x%LJ)&DAkuoqF-fu$x+HXeQHL!g`y=P)$Yg zdci{~+o5_Ln0!hLg_`xAwZ?7%^?WCvZ5OIk?01czA)ks-LTA2)mK%@LM3rJsZ+PufyWK);Tc75@+ zclx@L!u#G%3;wEnJAx`ViKfkhV~qiH1{jVBK#hO;WemRZNo8@{5YapV_u-kYxdl*V z{^S^~XWZa@#-l4;du- z{pz2v2JI^s)x><34`)mK-<;}vO=WU67{Z_}jIgb4PbuxhUeKl{&wg6ws%baTt?zc4 znfadN5Z%$No#STfAA^?Wpu^pR-;$zI^G3@qkD9d36Nm0tA6pE@fLCyTYP!hbz9N?D zH#xTAaAk?SL*a$O7V=0l32!Yr+WXeqjEnW{9Q@HU4cG*3q$hO=(*Z{Fn%C zIiTZ1Zm4~@ucWb<@<3{2<=LHMi&3c$-Yd%8Dhhi%1X34!bx?TIi?ZEr^09+z1VVz9 zX=-AceM!J4TD@4+*9eA*A_X~37Y8#gJ8%^-5PL^Lo~ao z2bPDm>PMT;3Io*z|46H-w^b@{Hsmd`F|4DJIL$f%#alS+rJe@dQES^D!xVtl_@|=VgXs0NJko}b zRZ_VMXt1@(0v$HUjJ~&ZSqc9H`HU86!LL9M-4J>cAfpdK#A}9Q&bI|}nPpq9x?g29 zjK`Cyl*cK|j5Pzu)vm4OcyJz!tLts`qPN15@*pNZ4KmozeUPhl+&dNXTA%>d3!#Y! zHSI=T&EQ(88q4LRdg#w$J9d9WoyMJGo7s)xb&7SSOCbx?x8P;C#JV#(h2K)>o^K~r zMvZJ5I5#r1z%yjyGgE5K9HyUo$Q;rajn&DYl5l0qS-3E9A9KXI_{ESbPZah_WxDj} zy({Jfvns2r5e~xiazGXFQ%tG5cJW5s=g>K(5w=)}&m=sN%D4gZ5J^Q2^Ior*Ita-G z8u}fjL4Grz(sMS-xXJCW@-z{*)nwCa)R`E13p9(Fl%hUMVxLyuUyc=8CeFF4sxvebXvnv-KSFpPo zJXYPQwI+YS3aN^YK_=+}ZS2wiy@#_Wza+l+p>>*-F*hGvrKYAh5(MZAY2NBp-1a`` z*M)^oxszGxn1+h#*puR~AR5L2Oyg3Mwk~^N&-RA(2D>rR`h~K>h*();oeQ|{VqQ0R zrrf=RgU_f=zfj~MEW6Wm_}f@=4)3G=A4PQqY^JiS{J#Snt@`cO)12fH2o2g_ z8o>P^KQ&urqDxZamIBmng>V15FU-f#iC1K_w}BnVDl}!KZs$py9hhFZb{Fd%vi8pv zZWfQ44g8Aia$lB^LW>wwN-KDs5|+XhFlq72CfM@OlL`#b*uiK7wWve2QSj(*bLt?q5G>FA)wH?C~_0|Lea>HgQ6%38zr z@DK7k!i0h6#hdeu@VfC4JATtJx2Xn3?6yH>6aE^rDE0tfBl^dNZ}LIAoq$SK+$8e@ zkDWP}A&dNm_*(qUmfg%;WQo#mxWo~aBelVB%>=K#$XMJ1cFvb(8|H^m1-re1vQqYu zs6dG#7Tw~%@4IASPfqoATh6Q061(#2StQaKD3eZkGmG{*iTqDZ*p5XvY>G%rMQz}` z*3`6`E|@F$$Cmgb16qx8+f!W(ICZc6nLeel$23Ch;Q9XRriANSuwe@JANvN~74T=o zu#h4uolTu=TKaDU_($5*s3xPWGBz34)7uXx=PqxYEEl^N(A7D5H+iai+W7@D&Q?vD7%P@fpE1G!5|i^g zq(8FXaiPJ=shz+=?da|$l0H%s-ZEIruy^jS+-B-f?fIZb#*P*J0b>zLYV^- zXgt#)1T%6^gq;G)_Q?+CGO4Pe1rR*H+-D|+qyvNR({uJLB;UzB*KYOAW*yF8`lCo* zBfPMLZc7ZLUsNKxv$%PcA^$i@2?g5w;QLXW6y%**}BE#NQ%(1g@aCgceiZ}KNnc$9tV zRn*a+@Ys^bTui_dc<{$abVf}uH+D_z9>WvZhWBZejOSNT;|VZVkq#{!7G^DSWEQ`%>XHfO% zd&|FWOYI~&DiHF*8jpjr8<*^*_U=kvEd(Don z6nB}92Z^^~11*!+kTn!4i=J|p#FyK_(5NF09}2!`iGGVe9q(RE$)Y-sCALk~4v z?MlW-IT#yw=p+<3g|$9Zy?JD1HJGKGDis&=wtlQ0C=+rSh8xmAiU#1W(GVtzUb(PR zOe1XMiQ|40eHIjF(FJ2v&~ijD1|^GkBrswpQ9?FyM)5E4@#63vEM^(v8077Z%}#l* z5)|uBI5>)A%Uan_LdIXoXs@+KYg4Q2qE`@J>CJ1&O12blJ=MY%*=hbt$Z9;%jc*d}`>9Ggd7=MI zmW~hezHRyL0(UFMJw(GR&@F`mG#iD;tfD{PPL+#M9`eJzw4&86+t_pJhG15mgWdN5 zI$)Pu84D$K5|JHVO)BOT%N0XNA9%ta%oPiV|BKS4`n>Url--|CT$DyCxE0llXUB7( zX-0zjTnYTZccG?854IYT^wYqdskndJ&`y|xz`;+5Km-_FTDjC)3flk@uQsjNO?Dh@ zhQ&{egd{Qbq6BZ_&$F`F=D0gq4W|3!T^i6ZmINR1@j+nT%x!iErq0nBrmG^>Yp#R} zsfCX{VPE-jywuhawgGgx)D)~6AIB8xom2&`;|58luh^tQ^dT>!<0R zW3gd=iiZmC6H?o35#{G&hZ%ESx(8whz>XfTr1 zu{I!PX+O%2u<#AsmW@wMhAexEO)*5(HN+hf+w!so`hpZ)EsNj5MmZW9DWv+cpfb{y zXiILlRb|{^Pcq7AZg{7F%JNsK{?MR;pwOr9i6&ZWHhQaCo9mC2xtVX3@!u^Zxm*W> z@6Qm|z@pQrZKiq9>`$f?dUD33p$9cyWXmQ^-rQ=ORySXa><{|DCVe1_MWC5k1>l(? z+>Dbu`n_seiwS#j#XOMge;*ad44U0-&dWP9uY1`^#fSl>!XyE|_iFLPn{E;6r; z+rQF9WJS7~HxQ9Ws#MWs*Ge|uuLDGdB&h9;a342bQpS?(O3svHXW3tZ0sd{5@cxLw z2=iT$_R@(TXIhEWP#2n#ABtXadPl(&+s4+4!iZb>%2h1eF`$+c;@aKy_Tx<(k7)e( zAN+1%(I=lzLf%l@MZ#G*D@!bv3KU{6VBYo6C!U!A8s}PaaxKEI4xC;cdr(sL*-^eR zq!ssyt?Ot8;PsX1l?z;0UV!v?!W_}lsi2Iu=0Y=_qdx+DuLn~oIogv2ZliK8@2}@h z&Ln{FQYVlH9=`z^k<+_>b@$_~W@t8CjKKns4R%$Gl78Ti146~RU})`p)Ab>uRE0*F zQE9culG8Qbnx>s~8OB!$BYdfj@Hh)_e6Et8S}UpH{u+^lGcLtoQqcFX(4=qmxm&*n za8<^01Zj_n*!<)@d~4x3(hq@-diHRq1O?_D^n+ZRJjW)ha!K)}+ve4!f9C04PP*%*lsEFWWBn$90}6R{-5H*rln}3t)P$ zyTxmtP8_3io}Q-ycOHg~ivan_)|#5%-c@29FCLuucnK#$q^(~qzP81G+5?`>(%+JU zJ4b2U>lRP~y>mjIxmo~s^1a^{M}S1?6;vY6oo1@D$ErY5s5u@~SPnf2!ygf0+`}3( z!SFO|;f@pHG>%C~GM-SKf8Jp|S731+t#&1;!GOjG zU1d+vj}=<{q0aI&a(MVCAeAmut-QGCF&Tu2jp<<1tAP|tjEG1!fA>O0i3l*xJZ9CI z&CcTw2*wcTn+;%}z1=D6{hpQ$W|{3y-&s8;hE?&+4K*E@IRE;t2tvREcZbdKJ%bX+gxMcpc~UHh2vXqi^wEf$vWRl1{u#ead&R*3_#0mEZ5n5ZPGbg*hgV9bHA813wZo%e>#l*#Sv)wr(7>umnbAJ2Fp?J0y&QCgS;heIeyAYbG_lt?*4Cey2CqMYq@x zx%!^C*c^FpP{Qlwkqoxk*4sHX4!MK`jwFWI%1L zjWtr!vAzon_;X^%!fr}SBQEHy{FJxu!l*ejnhc_z94Q73pN5MSi>hgZL&!$rnee83 z;?H;WF|InA1e;Ratu0O5)^~^E9T+DNCFd~>_gTiYayBHS9T1lqq;4D8#DYooN<0-z z(*79_Wg1T#iWj+T99+P_?7vwkYaqeZsZA9knOVfdS0~oFBrc$e6RaqMHxq|iXUCC> zhP^ZGM5~ZYQx_z#YZ|8IVHX^q>NW$_Um1Y4ukGs@)f%kYXJJ0E^H3F{Dkv+=*hjEi z3evX`I(EY6QpDfUKyU|EgvMW+etQLcno+cqf35TURF0a5>MVkWoGGK6S427tHXeO? z4OPH5EAD3VSuuY0(6a=K_;jZZG^JuIqN~$~DR@6Fj9i*Cq3<&)0c;l|I^XBYrh#gK zXGr`>5B1=-UNP(UE8hd&z_dNZ)uTx4lt!1F@i~;+)N#qH{8W|s2s0BbG8T)!KaRQ8 z{ItJE)Yoc;7|+`ze1c4f4E_!ft+LDL9E{^z`x=X`nsnCHj1wg#WsiII($l?$$sd=FG3x%&yYLjtl6YjB!fWx*$r5#7ij}g4h0UF?s zk4XdHXl}ocLXvfwc~r~>l3_!wO=%1(vU>GfED)z)Zs-I$(Q5`odNj?Kzv)n8k5*v| zTWssmZ*hP#$FS|gY6DoVgT03$1*xF_I}4Sm8!kj>ww>eYB>_MO4^QK zOQ~8$N|XhzaQU-X%Chz5U$H%b?)`lcY}+(dgg=#irGSp*!WzrO6dp52)6#i#K4=WL zymF(*OoyW#1g%mO1oI+pBN`za_d(`8B_)x^IH#3*iVd3Boe)<3RFTsooAdtD-#1sn z=NP6hZD9&*V(BdseT+uu&BJ3H+2_S{uH;BF#b%i`IZ+;jrvzMfr_L2Tz>bLQZ8V~m zRF7!Eg5+WW^@U5Z&+i)umG`Z2KVO(hNE76-A$1!yXPIW@ecN1K7VQyT4eGJpn#mLv zuePF#Ow*O6q_i1pVlLDaPB;#?CKyvO;a)Hhs&qv{LEK_FGC8|*PdGdk zio&+qvecMjr}7G?6tfEL$Qr_(w8<|hZTZ!X6+K_;suK3a$DJ+?qsUCbaX(i9#rvd) zr`r8mX~L*KhP&eCbXvB?JLeE4XyYV+5HnN(M<33SRX+c6VQHT)iUN^T#~KRWkOp`+wR zh@-i2CR1H28IGEz1EEf1TLSddAZ=Isck1iSzB7UVqy-6DV+8nLesOV#+Re|s&5N3Z z#&GN^8c+6N#7281WItnEFyJIr(8=}i5i?IuwfJM{*wap>rc9&PZnk;`fi|FEWVMPQLRsUVL_6F;}^j7u(wOZhaJjHZ47D&!#WVI%?pAU4+`mkTzoi@{)W69~Cs zYC76I0npa*GD7oe(b^N+ZkN)MYJl%Gh((KqdXu}}HVEUD(wz$*in`%UiCvn-iW{rJ zm$YShZB8uyY+a^zZU zN?=@|)mPf1KdXuD;J`HNv2v_9djMsV;uctb0KB5_++;5?I!+?3q=M1_=<=uI((#Zv z2D^S;{)=AKbDp~x!ZWaKhV90-ow7guwbGqMp$ETtP6C;wi&tX-2PI5G0n?0_CMBIx zXDI4Z=}7(a70siOadDVawJ0mF+hN^^IK}OLt2;d3vOB3IulwhqQh=P>uDBTUcMyD& zxp#oQoy+)iTdx|C*Hcw9#kn@pR~tgmp7lADBYW8*-? z5g^91b7q?UZ1nYWvv#v}gtjk{m`Pf$!{F~4F)y|rlVyQ`&&eO)4*XcyIW;XSf7W2E#IZyVsPj zho;*Gkq%UwOxP6IDF*XdVb*Wqs&ZAM_D{XPnEBl^_~9kj=J)NXtUc_oAmi8|B#9Tq zT`EuH78@WA^6Dzb=X%jF;(+nTr%ENX8>{cg;$l8`v|)c9#;vFh;n#)J_h~{ez4%)> z1|D1BWRgcR^Isrcb8GC*9V_zot;1a&{kq?fZ;uIjHK~_%F?0QOlL3|LIlu2e7-AaK ztMwOO0vG}e{CDDsZNEM?6}DG*7uE<@mhbu%^1~oU!x=o@f3;@Whj}#gst?rQrxYen zOfC@#R8=asCnoSzjNNDn-CWhw&qqr;Fph)GSR#3y8XcRHRhb)9>kXxN$Z!zGGWnjn zTFlizq5t`LJUg7`9hC}Fbn+-fK8z^Gs0ximILz!jKW_VYz)ZpBR#0|&xpvkrg5b-C z*sCPlDkRe<(`QI%JvuDJqRMWPW4@L{o#sWU*>o^D6wlIUr2>7NKV$vPe>u|v*e&Wb zf9W)%kdGS=YGT7=1$Msotm6$E9o^CqdKWJe*UNa>Vt_~?onG%+PLR!C1FoJNOy{u8 zyIwN8-A&^4AeyX>aU^Z5-hOC9ZYfv6Wwn{uE0mtC4sP!AQPd+@C2}Zd zx>6PjOQltO)7YrF+!1Y=^SZ@6zM;H6oY_mnEl{#XTMosx)31F*KWWvz*?eL@`@7Re z93{e))pd$^8ryN9;w6o>?`9b_@vop0cUHw5jfnlqgZ#SX=0if@v1WH(d?ZL`1m~S>`RR0)3Os$4hfVD_s4UZIsAZnKLc3&d zV+l(hI1Kpn2O!f;@!Z45Y2;)6tIQMQ=O|rW(l<+a@w?=sK)BG|z=g)^<8((0ooOf5 zLCN;$%XZqA{Xik0y(XcsJI-J_LO)Hwj8$$4C zIGx$tj0t8?%>VPUrErzdI}~&6X*Zd!`63PfWj37NLg{ z^`s1M#oINJk_BpN?#d&qj61T(ypIEbn1oFMWzc!hyP30 zv{{&+R!Z9}E=SwwoCtwR+H;CVY%+LwEVE98v!lNjt)5%8C>Op-(KXhk6TytuTB0Nm zI-@TJd}YX?@{=@_aRelc&MiGM5_6Xm*XZk_N>r0 zc7NC_=PoRrYyly~2M1w=hh3&*MY`5DX z;mWi4W@a}fp{bTN$vmDXnzcOlk?0rA=^%NnD zLT)L1f1cq=_)rkY7up9r*9bw<4`U;gJY5^5tdiP} zf}tS3ed69)>IL~7ZIqA(sZ8j{u*CgkmH3M8zLzkOlkh;*n{GEoA4; z0J$uxYlsI@UpHLBVdgyyg158j=!YXkt zlWuUlf4oZ7g1i%@%!9iPQ?gQ)t3lSl+qE;P@jCs{?mmKwWFJnbKz{b10?!%7? zguSamDS_p=W?v!ex z1_6V-X2p2fNIku4CGBHKiST_!JGc#47>4} zX2JYMJNF^QQN8+wTY*y6^Kt@=r5Wp%H~WK~yZ{i}1jDbOo1KyJy1$s=$f|f~oOHYK z-y2hrhE}2Ob7LCmz&C6Z`_et7yuj_BPyWdAAGB8{G2L-X(yNtBMoHZ-y`0IX&;X40 z4AG`sEue2zm;yA!7 zwhFDq%gVlX_qIvo3KQ7+55>@=+j!ASCKdg6%p!4-6eQ1z1lzDLu+J zpFf0M)h#%_v#R06 zVHHU9X&VM?XT>8J6FQ@@74EB*Duxg|)o6B~DZV&os>%JjkHfPeWo)_5|QvUX`|f+(u~t!{2_t`&$J^7;q}8G;9v+WofEmvQ`X+V6HE& ze$smaS$(-3F{Fd1H%R_htRMePy#U`l|JSk{!Dvd7|D1~f(=f3qaK8(gJK;N4F-n$P=hY-d~hZtr>{D}pFI?oh8V;wly zuHnzIit=m)N&n2zZo74|*Zh#1es)jEU%3p}4akUvF2{(&raTxgxk8o@L}KZV7D@Yq zyoLVxLA#1Dmh|u8RQ|*Dxgc{x@O+7BKMNmx5hOXuujOBU-7fZ)85q>V*-H;$Zrr#n z*lfO`ZRwQ7&x=2*0ZTX6%Ei2r+BC=)IC7^~Rh-zCR<4-$nA58wVW-O}$|gd-8dsT` zoUXh0veod{6^rbj-5LmZwCw^Qgfwm1p&7WLO+ZzQeHN;m>i8*wNAKD5)r^&Lm8l)T zEF^amMamCqFO~87bKbo1akCvUY3x|jtEUfM)_eOO_7Z0&=oKI2UDG~?o#ro-`a?ur z=f3hR2nbHt=%GV}3A*-b!&s73gbzF-agnB;>@rrA${Jjx!X{i7$uy1B!eCzK#s@sr zj=i%uqVjgJZbp41a2EUbW~RDx+*a7-J#F4|*kmW%*Nl+4JVwxc*g&HNdxmG{41vEy zgrhMeS5BCgjRlcg{Z`6?<`A|k{jzi+G^CRR%bnWabReaF`vGnRcc^`9yeQ7?TG4PF z#DOz)JS?@gw|>KN2y4(`5kh(!jZbv-=_CNdk6kjkLp`Js#-eWH(puMfvwB#jhz>iyBC&Nz&&w7I6(kKjn{qs>S2Kx{VPTie z#^os&MR71ZDi%zJuHaLYkOpFJzN6|*KpS%@ zhskd`PTi^*f56_xo__&lpM5ouNRbRjX-JZAJa&^eRJUJt3F?xiI!7N14lPMG6YqGB zAc;87%_BUKvy?U)7hd1Wm^9T2R|j#~22J4tDZuOqG`*Z{>$Ps5x#ay>N|nW}-h z#9>eT>9=(<`i41c-7RCaZ4MYF2KJ*knQ(0}`j3>K@$Y(r~!nnEMx8seN5;gwYd7aAT8Ayf*No zCq;iRxZS(#&03VJ4U|vTFhv%|#W1){*Ir9obR_<^(nB;H&L-xpKrxt-_O>=gpYG7- zwZx?YFVgt-vu}@;**$JQ6U*JdWyUx|Rhz&_ul92xT)m5of%?7#h$r0dx6ysJ+;M~B z!-(6(IWDkXds?ymAsW(b4`bt9zg9ttP^?VVq&d(Jxx-9w6|7$hh0h}!RjFug#Pyv- zROHBVU%cZqo7eFK2EgtWju1Fio|?(u{O&-|t}$2t5dRgtpcLGUx`s6yT=zRAXhszh zrl5!i7Kqn|GP$8f=VWcu&7mH)i2XrX{FM7gOWAqpaZ<}3MT@N~y5nR4ZY|a1gpq>? zv#CmF{)-v_6&RV@9;OOh${nBJ4C?teOcWq1?bmlOod)fR>7OFRo zJNg5}yj2yu;v#0VGDaQKCF;^K;8U3R?4guyqbkjv!;|xS-2Q!lT<5U-Bwgdh9nqkM zeu7?MXZ`F#Dyf!mVu2Y@+N1GJEV8T~!ncT&PaPTtcPXowelHxwW)B!{O&yQA;(^YM z=ob8m^(b_^Gcd;V-P1@K71J808Oq2Q5wIpsjo!TIJ~4EJ+?3mpZfj&^RM6C6a6IFg z;k%){0-F1mUjsdtUn)TjTI|5rOB2wI4o z?>^jCJoV!`$S2r8JS2YoT1&6gW1VZ%;;Lvo`(WDdA*IjUxZmj*kc>F z9&K;`SC`85@4F=Uk@!t;3A)WhL9{1d(R|J&#lpC4^u4=!^UK+06KHW7Yxd1~h!ebU zpOIRNw{#L6l*a-zitB|x2wi`AgSt$xlQuiN!W~EzrTrP(r**qLm1VZhNP?8y=nM$= zR*FRRSymX6isN4Paz=4q&*)y)$MbNqp5$d&44?%r)%mU zC-@it?k~UkrZ+#`r1*D#O1XrgPsyCIR(r%X?*8~JyTY4W1=)d{Ens?LeWSdw>cu0z&@#fMAe(Oo`Aqlm*a6mZ-ek2~20 zR_uAao~sXVJ5akt83p1GlJ<>$@|B?($RneLfKMAblLprpN%(FEB-zWzQkKClg|WW^ zXq}#9;K;)M?sNEfd3dp_20!-#&=h%Q|BI|*{_o1OnVJ3vgzQ>JCV_+vvFDNI9bu^b z(^@C`JrIn>3G^hK(-dG&?`X*I={GUky6s+;ga?r-R<$mly+*%!Se3@|$h zVe*=J;F8_f6LCp;UGL7I5X<5#!4`(pYj`CJg>p@5LUE9n546F54Qp>9>Fe>UsI58d z{2FM$ZzT2EMHeR(P_EH1go0QPRQ*?->J#vesUWe+GI0Awb?5HQYcUjy+w7dZ@t7hQLgC2IGo#`IIwt7opY4n1{LRCmK*r>maZBcCAtvE_ zlJTg48iAQX<^PAVbJ`LFTDEMZZC2X0ZQHhO+qP}nwr$&XrP!4G9>qG!6tr`3+n6RCOq7ckE3IA-;VRjrXP@CuM|&H1A<8M3{Gi8jSQ)t6ogNl zDE|C+m?9v1!Aw>E>clu|A;QIsx7|%sY2_>t(Jk{4&a`-?jKN=bVRUBYUn=rR6Tr+< zC53HSxD*jsFDl-UH?llMKl^+;1K<*RPp?8SDUFM> zm9uCb#0O${-I0+^dUMQBq4gE}o~Z$HG-;U8f$ClsTOd*BwR7aYOg9%p=;?xgE@&#G z3?!KTevv$ORaw@9aH>7b)TZ`?C+>cCY^lVlW5K1p4|V2QwaMyc`X`&ubzMsFJl-L^ zNKODeN!SUAK^Xe@*dALDxcJl%3&UShF!2``?4?`#3^0-));(T<;yE>(YGNU z%2kux8~9(Afi^zSzdA3e$L4<~VN(yMEI!H48bgx%Bi*63`|zRQFkSqv5P{+GOTn!g z$K@dan*@+cN(l`|eIXZQwyuTT#c<7LF^dNKy9ceOl!-R1I1>GYuH0JLmV@ToJ*XKd zB?-V&2F*v1w(TmCwTq`upi{7hh}JHIhupxa0vN;Moceg%Lq|N*N{3o>%j=m7 za}z$^gbT&{%<^r7F*P_g!A!7w)Db6^1z3VSgusWg?E*?l-eWkV!1K}>T>;16h(|-){LLX0o_cWNb$wj_hmzYl48plt?I#>T(F8G)8LCv`Xj^I|2~ZH&&Ybn#&Wu% zcpgN6R~5&+PlMOkqoC+tQrZPxD$1L=_PxMn&AHKa%9$xgY8-Jf7cms=z zKr6~Pp(zr0o+CZU+4MWpOJeC`iP6JX+{6PEWY#KQwq(nPW*G3|TOXSG$?OEx84hQN zcnMKLC~NCdc2UJFu9zsvS%BaMi~$YKGh^`r-Hvjga-vL@UGL_h%Ka_AILW9lmr4XA z#?zw3WTFX;rIb5o8RAl~&%o0o4DNKt@k=6WwFE>q#;G2rR0XeW8JFbYbTJH%NuoU5 zvLOK|YA;m;q#BA1DL!VBSdo;OZ@yK_&HKX$#J)QGOV8na7sdHtJUTz?81qC{FIh1f z*piqzG2&kNa-I9|xFCRt+w&S&KhU~@B{b9GF@mAct{z=}84A!shJ9F;oZKY{(=-xT6DgL4VjO|ARgjXXvQZP{=cD(=G==6Y$QmmM2hJGhsl- z^cs`Rld8??na%4JlQv!b^v!wu;|3>4q1$JWk_rI$=|Ik>tpVLe&N{`U+mtcx76Iw! zl09{WmP}_>#2Qh3Su#(~VdU#?I;XpeKt6ELSFTzPGbxm43Rv8boxO%Yp}nQ7Q4bPa z?d*qFXRrzg43X@N8C&~Z`~=j?bk3$`Tdt!fZw2ng3&JktLT=|E22YFUDwchXaBogL z)qZ7_G%j$i9@9FITp4jvK#oFJ0B*QP*7QPh#<39H_C&Dj{e|9+2IOWQr4(37?~8df zRQFo(+mux9f7}a2KTeGX?`PYHEG`kGQrPv_z4Hj0_LuCmYR2*HD-nG1osMRybxk$v z*0o)6*fy56Hjh2sEYtN-7@s$_qqVeN_#+;@Lh@G!u4)$|BBak%?<1L5Y+0yXG7KHn zROw@9rx^mp0@i9x?W1~_AW8%morm+`?RlxEtZ*CMXql>N*v<}W+|r34pZKinRm~9- z!(0k>&tS(n2yQ}|qYIglf2dQAQ>iXG=5#>9j9-`$JB;2%T7vZS{ZimQM>za2NrkaCg0(_>p(rbh^%)II3f8$B< zVh)OSc|PY@hYznu7Z37YA}Am-6F9|Sg`u8xwPg?u7I$-=IMt;bxDaxOzRjoLM z)BOU${#M%fPhsc3lM6HbZ|Kmn#$?PD3+%6B?G;P{;R#jl&cIK~?<(PZTMu>F+LI+w zxMBSEf1pFh7d;RRZD*Ghsnqhw?rvfh@6G|?9lmttEat}H^^2plHzRO2x4fN~ySpW~ z-}t0?Lkdufn=ISEapws*%FkeN^P!frIL}08J2^7_jneRj(OH!{@CO#R@&7`H+zhkY zZI|TcZU8QIgB}Zf$KTPmfAh|W?ic1(FaCC`Xh&xf`PDo$-hi!DWp8J_zGbk+!fG_& z=813b7aN30mQLFupB9dGVbTpu*yLkuhw3U55|_%$3qtKJJm}l^wOr-f`=wADv%`D0 znKIHv&kqAcaTpWV|Ff)>evt_!_vZSV^?aX<{wAKjz+FEiAPkt?+a{!|Ut?wA_D2>1 zwX_nXAr)2P=AEWIN+f1`wYc!b805g@FK(uatQTe=vk!}!;EGGkN~Ou{d3+;W)4kCN zKnUDFHRlF8#Rk*U)FyVxDbXeyv>@y523l|Zz~$r86S-oxe73diG^2=f>pC0@ifcv$ ze}kDSR#qLBpv81;hiJ-gnJ4bEwvxWil!ml3ux)AG(;gkJhTv>qYEO&1xX>uXUr|O@ zO8QgT4#qs<%rn5*uVkhs;V}lsza0y&oxtHK7bKq9dPLavrBg^i2)0gAQ8oYcuLiLo|EIw0E zo8k*pQcX|Z1qq)M0xj5ri2K0f#Hn%dDi9{aWc&ezPRXw&xV|9PidMW#WT`6E$WvCz zzTe~uY+EHrUq4v2dS7f)RmrF^qro(}USkacNg)TgK=;9q?TTXutT)23jTV#QA;iR$ z;!>wh_aB*<33C>KG5TkOVgTbD@RItlxeKE};pamO3&x`gY&6E5##J9)BMS_q#yv{! z5#IT8`Y;Sim&*R0jvd|(CdU_)i(7vR0YJkq<^>ww#Fzj)_L@TRZyl33getYPWb23! zT^wp!9}DS~*ff3c7$+p^L_u*B0%&5T-~hp-x0RVF{l^>o<6Sj%5;IE3k;YUTJ3 z)HzwXRFQyDDv*d|T0Gg&)YwK?w8iZJvvBws4IUsTEx{1vjKnD5v$XlF`ph63tzMi< zq8K)P=nQO;q)>v-63t7QQ+6`YqOeJJElA`=U@^=8fumYI)V(SLre7IWr_+|_v{AiIfD&JjJ<@UsGM^j z$aVDNVUpGKb;p`$NOC3p`*~lzQ+(S+K@#g#Jlhv~*=iuuKl-2FCTYhbT1)f`#V1-w zH2MlraxaBPLhb&(nx)qYE|XRG0}VXg+Y8R+l|3|>c4F1aDAAbvMo6X&&F75-8WA!r zXp++0OFZ}Ilb>u3NJEv60F*O}x)Kv1=39P*)xq971d)MJ;>Yoz=Y%>rKp%9mVdhie zHL+{&esCsJTNHrGuv45tHD0hdSa4FirYV53$S@WhFzG6yMbWRycF@;+M0=8qZ^_>D z()fCOfe8DyFwm>67B_ZrjF0CkYhvg(8j(MO0)f|UQn-hs3lhL>X^+hVd^1S(AXi;7 zN;%jiyYCsdt>YhNXe~N?bR=Q>EdptCLX2%OdIE@*?r^mbGM;2EN8G@zn&>)M`u86B zORwS@pT(cPz)frG9}W76$0tp+Fjto5>u&7Zlk|13?P)58UeeyaqFJ(AB18#qOlaty z^rKL=2D7>~@C3Y>AjucY?jv{a9rob6<@#FWR4#!MpsVUWss%J$?35sxj~f{cgU8eQ z#nZ)mqBTaV14U(Bm@OmBIO%t>2I7jMl+Tu~Cz^)Vu@7wxUl;)C{9Bz47C7W5kUf3W zXRT!3%4O~T?S-H9N}{so8#n^6)TF#;Rff&d^(>eVITq0l9TgLxPG;82N^#+|&hh8~ z34JUf$KyPPBG~?dqGm40&dekE-m?odNkSbtR)s+>x(GDF5ChcC8Gx#t-raVe$p^Oh z_m~=y)|j$zY(pOs#R)O$h8g52#|^+@{?y*sMv$f`fKoh%GtX7z%icoYX@_R3{BI&C zGqOjO3UsU`V{a6{n_tsaBo%y+_zkT1qH9VB%M@zTD$@ZN#ubsaytf)gQ~BC?*p_B4 zHT>?5g7Z#mETovL$1Z0WmmS5mQ*EC+djZ!uHoo{+R)1)Gdva!#{Q0TJ9Y5p(ro~Lxphvfx>LlR z#vDeTNg_T7k$gjz|(!C{p4@ zO>n*BlX$13yRJHbL;;dM@XFo| zrjd%eS(EL-kear_MP@fV1U-sfEEi#P#%ubC5rYMEhjTc?8w2fhLCa#M+0SeP}Hsn5k%RTmA(`D z_~)01>snmG)%Q|Y?+Zq*c78QMuo~9*Qit!7{tXN~FE$LJRPU^K0|%nTy+%_&EY|+6 zV23B1&^JB#cH`apzIvBtlptfmzWK!*0eiZBo!kBZJ#RRb{HNUZ-}N9^8UELiT(!pd z3}Gum&nfvkh)`o261)>QJm%Q+_*MWGQS(OX>t6fOlj1KivL3DcC!GGZblHk#SffW{ z>^v5NB>YG3!Qz1?0>1S0cI^)8`>VzM`{{o`I)LN_QFPv#B~WVl#kqVCb{6j}KbI85 zZJ8;rOD81@isYZv_vf~8JNxd9J}9zOxTrd^tz9yRhvVxxP{Yqk5%3EHxhZ_g^pLY@}9mkKeiHxr?=%>Oq#iKd;7a zUpXhB`qlf1x_ps;a-?-NM?hKxTnXH;YLo9+kW0vlA6T5Hb}=fI5RM)QP}>Qq#{vV9 zV4KTgKogbrRG0`Pai~-&*V#VwZvkC-thW8=e%bhnlM$^19O&P(jkTEnFwj5*@||et z!EJw=VMDSiP@$5(zS5H!#rAcC!40m9!vsHoNne9ND3&7JUSkhkv)+TJ5R3|Lw-nkO z=tNUpgjR9Q_GCtkh$&Qj{mmL$^yNmmk%hZPt5c z%|&#WvKd%w!ev8gy}4kHD_h=1Roq0!IW{@hl&0rJKA27LR25&Pxz~(ENHZqh8Yvlx z_r8?HXBs1@Ek3-V+Pi`)^8zbQgyk6ylOG1F+ToN$q0C>R`0eNtH6mC>LkMtcQOw%J z%sn@g+983g-Q>#^#y9Ha3}pz;t()=1VrOh$1H@rTS=O8ha|>LGi)d zk6zzL#+|PPINPt{>9eDSF=Ltz2{bEedzfXm)2v=pIXIX{rO|qp|-79Oll<1 zgyp1dqGaw#y3fR~bjLXK&UX!D8;5nElj*?|s1CCJP&#o;;TE9Us*GRc}63hI!$xumvockU}MPzv)|*SL9bH(I!GoV-1-8j?`+2ktYjFY!t9i z%|3Hrncfhm2kNk&I&+H=m;O+rcffzL%~SME=5uFS9;!AFH%icOs9K5g&E1@t10>Ac{f#O) zV_tEkb{>BPA92u`bTlbJDa1iq4Sw$?UufbSqPzw5LThbt^8!k{{-c57sm^s7g?SK% zAb9jS4t`&l@TMq65<%*u{2ZS&6NCx7$p$K z)nM(|mGO=iU$U@xjcCaue>JS7&eafqLarg9rU_Jp?_H=@RLlrJn9Q!a%GUV2U;Ue5 z0b)`voe$YdbE76wc%H4wMI?)ni0H^|L{>!H^t@i?h>N|~B;*Ck#pr;6ps!7U!ppMY zNLx{_nhV)t>vojqS+(tO6t@YH2!%7?YoI^8BpoIFnyd&?Bkg&tMH91(3jZ}eIuKxd zku2}Ak3i-J9Oii2M4G201=FX`>}8K;%lI+`ngLY~0IcS+7SCTHL+0ihsy9&W%@9-M zLW<9()E>Qdq9!#(3qmTScYHNS%SgmxKrAsuE=06d=bwE0v4>ND*O^E|RVs2)xeKuY zSBrop*Mwuy*kA7yj_NSa>n%a)mXk2BoH*w%CpF?A!ZZX+28y>qLv9mAlw4Z{fI(rkhdNDOGx0QH0c?rq8oewKE z>s*!zXLcNr!>jJ-z`?j^9@B`emDPD7*+vyo82?qJkmjzRV$mi04sfur1|BierFI_W z?$QMSHk7F9%8iYr9qDtsc`>}cy6z>mR%r z%UUYRnMorRo^q^&7S&nChJ=5RFEVUson@Rj77|cZY}N+7N4ha;UT#_yQMt25D2w0sb`ouLfJja$B774W=1yjxkWoM`?>^u9U6%#4VMFdD(yqeUdox;RJ965C9^zVTEX zoXtsume{^?8M(v3=UEak@am5q+ovKNfW%N z!50mKfb1DOOZaf}wo_o!rFsnSl^^*M0oL&;D=UL8Q z*P4T@zL%ZMifkSuAyIZFXE-xh-hbESt^Mg^T$Nubyn&Z}e5S%N&* zDNYY#jNdIu!?Zl2;QQ5*y5krh}u(GMKm|J;`xvm&ocO5nubU82lI802}NthlhdYUH(G5GpV;1L zLG$^Z!|lb}rS3NvbI3{je+avb|CM!?ft8;9|1bS6YyQ7OxBsEZIO_Td;DDlI-c9Fp zz<8BiC7m$vtfjtvLEP}iZ!~ORVk}oENf^o)N%WVs-!S{Ta(Cy1+ukYUTPx5~A-Asz zy`lB%3y@DzxM&lv4nJ>Sq2dlu9te5i!I(n%=izn(c?Y2N2Tcx@k__nx=cOx#R_Vj`T+5#ai% zy#0UKE&)D^%=MrXl2(K12GqPfm(?ypsp->w@ynz?`3MCzjfG?)^l>BWF~pb%?-;o&n6B)XY{5 zRv?p@NG~6%bE83{GP&b&`>7c2SG=HrQ2s?^LcyLkQuU$Rh+n z#rpukkr*_=d@mm52x&u&l~uKa15FzQR8La-Sq_V4iHc<+DPA1r9)*(QO~( z^!3eu|HwPG3f&dZL&j;zAEx9Z=}b_mWSy^lhaLC2xOrbEr7PVXM7{_0UP36PIv4w?wsJQkv8N!AUfI4V_?~(u>(NdlNoy6AyD^hNAF2! zNmU53=u4DM>OH-{z_KFf6c7NIZfp$2OCJn5?f|`N4LYxlfSAti6kgmIaqHwTaMkl( z%gv7+={iJ9=jlN)SsNKwpvFxyBmLA4sX=r<3_jDgQGh$DD|n zLr#M$iwiW9r9?)aL73Sx%HMLT05L_=Hy~FJcEzP|n7@F6CVzdaNEXz-ZdwQQoiv?T zq0*$$dI`c*sfo7pyk4Q9u_;EF+Uzp>ardEeldh*HIkYoXk(dc*ne;z|Go%LM*>vH;wy^>{Mh!AvJm(xHVw4u;>3_dcYk)@6(KQKVu#bS<(R@SGa1m>VS)KfekL~RDD_7Sb zITm}$SW|;qL$t+y5%we|tI!#W0jGX!%*?*xH%vgYLpeF4+37si^7J8Rs+`UN76kmQ zWxC0>(V71I6mjdU%~gZZ8<}@)YZp}(g2`#+3vg{7RC@wmDz1eNzqaPd0wMHVI}9qg z9(r4t`0=YkHku1Jo0n+Y0YA3(m~bpR2ONE?V!Z83J8ksFS-ujmcNMvUJIKfcAq=HO zkKnJ3sT_QPj4)i5j{8Mx)8Hp!elJ)~K$jQ_s~GtGw`r0jqXz?f!t_Awqf`Z>5fk%R z_kJj6FuMC)G7@0e@qWyHagG7fxl86LBj}^+6_>tV1@7}r_Qoszed@QI5U(qqD3o11 zbGPv-K1D1NfA-eJr?A?C9ziF8oG#)drQmdm2Wp_na2zH-g>?=d;v``=)^h#y(F$7E zSg5(Bl*m~^0b&Op!-Lj4Djs45Mu}`^UiRfz|7-3j!tAo1*%jWT=nLGG3(z3+g-4Ip zHf$mr@Mi&S$t}V=1ZK7}w1|j6qpHTXiSJ~27Y%;9tEF`piSm2QCVWMfQ|K>kG)AM3s(x%eV4nXMbdLN1j5< z7Ni^(A9w;Tr%33XLJx=$F)fq3aZ9sK27 z0WGQ2RJYzizfy`sb}LQt1UC6T~a zwH_t)R4n-0TBi3aoi3018O{6Y)^`8xr56qf16$S0gW13` zMQjZCTTZRgAX-5Sx;+olI`JCNnPiOOs5J}(wfH93S|+!kM#s^a6%or2hV{3W!g4B5Iga0gkyypM<3#G8 zuPz(9BRYB>w1X&b`%?<@N$)f;%P&eqPj(bygIgyOicx}0CU++q2I$^&McJ%Ku3twi zwUdyeYkchAEaI#6(`v+uNZ8TSub8!#f1x$@gO_)8Pw!60l-pi6$nhE7LT=XC!ZX#d z81ZWzyW7Y^)K>gW!ZiYfl<*?5SYZ}O#<||lZB@?SQ%7T591uP3d&AxWd)lvbdFBf# zEX>Y$3P$F3P7uyn44F8Wrj94UNGW5~P2~IUbDf|gko^(sjK4?*4v&SU7)eQGBZYzs z2t#?FK9gJL{?M?z9Hjjy1j_ZvJEng?1%V{{7a(Mdv9e^0?#N zzO&|DyGlk*(GGwnMew^FSIDm7o%dr`J@~R3>(|Oz)oTzH+a(p-X|Mz*XPgRz`4dt7~|D{`rpa22lQ|l>1*X6B+5~ z{+Iu!`4??N+5Z2~HdVi0@pE?sd?tQZB<-DeP_CU6nNtQPzy2SbBq4ESn$7IJfmLld zZgCu(golR@Kq$B$y?TTC5ysQh+TDR@-GNix#g|-PD&DUuw7n@uxXD=Sc0ZGZO%Pxp z!W7&WUoSh@6AJg&lnaW3R``8eoStix17fIiT6H@nc@1{^npB$pL5ZF8CEQGA`}nD!g|K68NcLB`xGM(1o2M_7nmShs zp&qpypr#X2i$!PalbFey!%$T8FX!ew>p7Hkqf8BxQ28a@9@3& zUU+w=R$r$h>>dJnh1N#u4YZ~RQiwt36B8{Q$Bfa;kG@Ky;} zgH*9dA25ofc!n*mbr!u~5$|cCa^YR)iAl*}%Mw-?i~!SBeVWIy>95*1T#=RirULD$ zZjYYYP(Rf?=`CR&vC*qMEMDJY0R0PTCtkt(Wrc=|to+(`tsqXKG>m1>`l>*Rg5pVAG{WoW%^=T%=Pab-x5;I`3jg?$^+TTl&#QYi>y=6+%?C|{Gy&U13?-lg` z11{GUrKO)ZrTp@i%+Ej&d*|x2Sbkc?xyU?ZyXoFjxkQ-G=D`SwGLi_R;c=P8rd4Xq znb5Dy!@U+mC2o*J`cMH+MlAqtx(8V}l$EJTFf>fZyh?NDmB0^AZ$3T~6wMgt@20>Z zo!xHRAaa9&rmBwB0d^i*1p7JE0_9|t->E+jc^8(}oV75@MR&47j5tz=M0X{S@6-6p zqpUk<2R(42e!~qiEo5CS;wYX(v)(jr&}jgGz2)i&M_#)hCq{a@(*yF+OVt*=@t)>d z_Nk!Lh12?LorSsHK1-{lhA*jy&6y6fpp8muygZ6wb*-;~Xg`xu$+=!cIwJHRFlavM zo00{VqUlb$*{ewKbnFF2BRxFC){*DNahDDIo?K7-Xy4KGz!ra3-_2Fm!AUM00mlqb zFUfLtxNp^Nj&Yu*j5!=pX&VyEa>?Hkr>H&OnTpogMz~IKgOFTy!Zkt4a}G{+Y(|!B zw)VW}(g}akhtK&vC`f;6gc6<2qPTKD*-zc z+N?tTJcgXIN=1M6MmYvnG9AS>0~kEVTg%P1DcfQt{5Ov>x?#{QUMcc!DG*UoqG!+3 zAJ7x7Ni)*<;8SPb-XU0(%KKwh){0KBc@U+EeTG=Eu7H;Use-2<%`ykta#^U#d6NRz zfMzzW%%U;_=|YYJI;wi3<#ml2BX^QMTK`G#T2GEop$T)DR)`w4KeQQ66s^yU9^r+9 zfb@*VT+=N&L5Nb32{8cbZH_5SPD&bW2G%&OD+f>BQ&KpmuCxPyj15L^h8N7v_?!ul zWjq-ccVT01{8JD}Co7^!bpvlpL_la)c;KP-fe-6FGn>I*k0XyT>~~oWF?)e*nTR9n z0R)Z;G{s~O6-pNIc)_;E`ev5o{lT8z1+^uS#G-5y*_8vEc9(Q*$|*#(@vF;zT+LC4 zsxWYyM#3|_`IBW%Urs`v9UDX4XNnAL<4J4RBG?}_Ebu&Ngvhh2@rd*v88LVBZ zinN4L@i7nGlOfYgCFe|0I*zk{g#k6{iL`AuldjX%a(`co{!Y zj70+@RTQ=ui`eH3V+;G(JJSA%j}T`n%-F6Fh};XL;q`wK7PMy@O10$UgOm_Lq5Xhc zJqZ0Iz`r-17!Og{g<$`@fwuT4ZNemF9wH~Y1f#rfjqZbb46(;Ve4Cev%4$~9QNlL4 zq@;9xw`)Slt}otDGcY%=Tp>8FdE*GtB4utNi52Asg$VUqwIr%6(h=Ks$K7-bRDAlo z-H#Bu_&N*Z4hbQP_=PkvSqfi#SV-JrH`ZQ}8&$Q-tEo<1>0vV?2f+hP&zQ}P4f1EOBOhb#D9Vgx-Hqsq@y|0xh)8FvL09j{L9RRWw& zvi0mhyg+Y#Vqe1cU}w&3c^uK^Br9bz z$XXF1B2vYp;hC$6rtnCUcS=A9(x@0FgFc@SK?G~bBfPtW``>{;G}d!Q>pUmhQ85DChdxxBQqY=)dDPYZYLp6ImNJ4m0w63*6{#^{GDwG zpHod5n$!kB-6SOCqL>j9B4x-ukPMS{K;$7(Sm8%#8SL4vxnYcCVc8hSazFC*kjG5f z0gJxP$#wuhBFy$DzUlrZ$Zob~O^hVjZ5(Nm0Ed-0fwA$#EvT6635C96Hj!gY!69q` zH<-iFg?c^z2uuqS?dn+X=%#%vSV?F?2`9iLrz($p4#D1o>mKM?UfS*;FDy+YU-L9Z z=AfDV7Ej6qR)q2PX$-D3pyUkJXDmAjuXN{8Um~t|KyhJA5ax7fczzK1I!b}47UGrS znnD=MfndmKo#`l!HQ}tu(B`9yVnvuq9bZR$${cJ8{9eSQ#`4WAb>DuAsSd1;J6^?8 z2%|@^$nt{_5$2)YB6O2l%Ha0+Rb8Aj-=z#Or2n#>pc>)?w!jo|Igl$NbMY!8@}iJK z0X(a&$B0?Q0Q8a*#R;eu2NuX7>l{JZO{*niGRo0QEH6*pPBHU*4ncZdL}Q0!uGj+u z?yzRE8preUtI#&6lA9qCf@ve9PnxHuyQend(7tRCs7ZjH5WfxNZi>Hr)#@3dZQ-wT zM~b`RBm`ULJW3bG_(BnD#QsqyyHfzB6SLvAjB){S>dm1)uSU)Vrc*jke?ID!#RgL3 zAM0mMl%|G+lWdw{Qh@4!1du|&{p`Rs^e!KKmY7>Y3nvTOPnhl7ux#Q0~N`c+(-B9 zR!l)tO@&}&I9~X~9b0EHv7Ubd`t>7!qWjZBK~0A+K}}&{X2Qnz%$Dd&DO3-(rO|5V zUpq*5I!VjBE@c#!+ubZGn>^NAPWD{koty8jZYib$6C!^3gSVF7-FO4{^JU#+25X24 z8tnB==3Uu~KYuS}#u6KL>Cd+sQ>3EuGhel{>QW;!+hYp}>f} zg^?OGkS#(;9GMoE{JrH6amcQ+~EUSH{z={f(fbY)*Xc=jCNp3{q4%PME_P#Y7wr(C@s znd6lW-cAqe=&Rr0__=OL1#Y3LIN6XwY{GEFo$ z&AGmlu(94Sbr%j#!&x&Ib)3_5);DJvk30k5S-0eAyddJoM1jr8fG9|{mjn&x2 z_@l7>Q>Nl^TPLugTSYSU%eLLnRq8mm9O%>L83FXzfp~6Ps;gkde-mM5O?YYH8uE5T z(Oiq6WzbOdsysVquMuAF&{rIUO)*rT56sc>Ukx^j)xwEN&9e{vQ3MihtK`0=N^MCr z{)89RBW)C1d9zMFkF64K=5gsJ;2t=&2#S@DF}$sSMeUZ2rm6p0xSSu-7%(n~F!CPr zq^bXkQxu*wlc1%ich9DgHcsd;^~3$y3Q<1MWQK}Dnqgry<~j7UvAYnc-Uu(TuT3)y^Qd0Z4ik>7`&Sd+7%zkUI!yhh2J?V+QI(B6P8IJ+2)?rlF6%sTO$T; zlQ%q?$wbBSa z*W`DYBMjzxZ70DoN=xVOi}5bhRbRy%7r&vTG0+{iJRFIipB*{J zFB*}l42ub)-~94S2|p4>WwWg_<&=`}HK;ollgKn%mdu><543F=vLoUWyrOfxcJV$N ze~weLz$$)(6MxRxTscbPY}tJ6SM#>&l*ZN@WPu+?5)TIT70-XW<5DCX&L)N>m=M2` zDas5|el$Zsa+XV1cj7356T`+qxh*6GeypjCn{iUWM6wB#%zAXj#IwVbp+c$C<7?X2 zBnj)e&OdXWx~gaN z_(N$y6x8}B$oojPYCL!`5A6spOkvE8M&l2vwMC52C+JSf;VJMrxI%y=+#V}61q$`U z?uaHR{ZyAqA_9RR;Y55|H!4zGa^MMMKxxU>cC`{fN7Q^MEI{;h*(a2^dj-%O&O22h zs|CX%l<~w#>g0;q=O~~P;hXffb#EuNsb&}wp;B57?Z=@_^nA=bD>aWau=2skdnuD# z8ziXBb^df6u>|2qVR_+Q2U1uflNzYO3#q^V#O^~AL?vcT0XXvQ|9H z99~f|I$ru(vE9e?N2QfckH01$@0gTyh8WLQ8@qa7Ko5)`&M-DGo3k)TM<46A==t45>&aDYSlPK4v(&VH>+YITt+3n z+Iwnjx;rU^{WD1AbHXpcSwg|uMGt~^MI~9KE(392U33-D8}gcoB;LCqt2wu z4WD*h-vgbp^_yyB*23z^m3#IMXET=y(bIzd2T3?iA%&|K zZc5noPK%`uc%|ia3Ct~sG=K`7zAz{|Y>G279){!c;qvGW(-P~l@*Pi3H2nApQH`f+ zxvwn#JgOMk(+;}SNdx_v<(HAflS&jd2>-kNt_*~PlA`)TA5&X*n>Y}?zl~Ni@G?#Q zpBNnhkqLYqQjypk=r-2d2|P$JS&nD8SMQzI6}iAucve$k6>CkZ&VC9fxG&_4CmiM= zGJeWu>3^Gyu>{fXXEHk;GAu7P*wFiAW`iNN(F1|CI6iZOzt0hj=0z3%DXLGHhI?tp z7H23kjB%io&ep+s{`FLn;a}U&hR#~I%Ht;!L%@g|IA@bIzMoxp1(ACe_rsLe7MFC! zMY3H(*jS3+y9ZQR|3MdS=3~`H+WN>~jvq7f!2$1`-1z$bblafYva?B5aLQ9*s12%@ zg*#yT!X9zvluVApl73A`xuiB>D1OgNC9Gj;2J?tNM`XEi;@75qg?)@6m2=77XmCZk ztzl!zZ+JDY`1NHKrDdJd?OR^^pZmdkG-gfCU*gK*assms*rIRQY^ou66|T+JUUNo; zvUn2Rfn=QFcJj+2SE=!=&K9?qmEdnSpKNJLj(0o&ozV=7+pgn^wiTyL%C`LX^XzZ( z+VhTdu|pLptq<~^FYhz$TQlRFNC9kY8E=F$H9{53J4f$i@kZHY0skH zRJ2c3Q5qynh-ERH&Bse(hzBp?2Dd1a-L=HXSwa44X*^z(=y0J(^#h+?C?82DWA37Z zQrx`~#j(35j`Az6Uxr(3z`FExcaOr7PMC4HE^G6y)hgepu$w!!BUZ{N**2crUNF#_ z-rQA0CQd%29bGbQ{*~=QaC(1IAwOckCEj_8H$NB%82UzF|xc zb#NrMj2j_xH`)7vRzdmsB7-h=Fz$3ONXTZlR|Mul9GsDNy z-|Ff6LA3+ATSb>P%WZVe)k(*~mb{Hy`*yCAyImt1H{hW^O;#tjLWD#b4|=`_%kmFR z4--d5e@CUO(smWtOt&4s*s(Co80*$UtE{B{-qpOdq{4!yH?hHPB&|K7zik~4d?A$& zi0l#-*moe}4s6Qx=5m|My$SBaahuVQYZ_jk4+GaBTVF|oi{W(!WjLn(4IL4}=qfI#=+P`}4AKflYkIzuPD#t-K5J%SZ*HD_e8w{VJsM|{7)-Ow< z7x7Ad|Ia|8t;cWMgt=2&-*?*l7*>h@H1Pd*4NNw=|8>bft=SoK)rK(rh4Suy((sDx z&kqLL1;wW6$uP)2+jKO9c}4Q=jix@FszW`k1vDb8>nus2e#@bJ1lFd(8`+TmD?OrK)GC|6C<3Z4_v=j~6~eR1 zpTwNx=n28=xsf}}bSI7mJ`=kEaK z3B6sn63n{3xIwUm*x!mp7r{fjy)Yx}`l8dl|D(xz3W#a)n}-(50M{qN(fj?wY{mh@ z3vm46gUCozNvM@GPFZ5Ucg-Ho5&DNW->Fg?9`JuSd&lNb0B%Wl$F^2jxqC;scT%5n<#L|*vtB7Dh z#qcH3>L+@5Fbme7gR~a$Z!DPeylEQYnM);5B7q(6ns3Y7D4;oGS7cUELtJMJEezmG%ar@63G9QwVM#`uW%|LOjbVysL)^D$Scsf{u z#!XqxPyWOd>?A{^$BKR#hA7gG*~oa42m~V|$tRs8WoMO=`QbHjHc2pKdB9gJH(~&% zId1hhZ1W0p_R31z>|Lgh=-LoU5Z9+POgWuR!If50hzFOvtysjUN-D^ciCkIL6_nN1 zRE8u*LuHAn^4mpU*P;8M?PwS$5ZaA5c;u?j-aKe3oFXQb4#6WfPM(1Hv~cDWr``pc z8Y5WD?L`63V{?K$2)WvV;)C0N4LU(1)Ea0@FE8}fM*&gwYM4=yMgnG&J(OFPh1>x# zF!0zK*yFTBv?0+`)+i=ctr$%XCPiE^=Ro|bHWGCeBk}}!B)vm>Csj}`lkjHYUbf|& zp$seFL~8cL%=9@J(D>up3#Bd&Rir5%_~ngy(31;kVm!1Kl7zQ0Cc4lUuzhM;-CbYX zQH4?ijFgot9|}qoR5rrEmAdZa2zG?cC==m%+lG#+rw9o9b*}DjeVH<{Khku`g7>cdHr=@dmbT#6k(Wa#Yx(F!S%+A(-hPgB%6e!`vs# znc5?B2>wqZdga8VOc4W^ara zYcDiusl=dsl7prZ)RTbwe^2fDocVsjU1-3qWVF_HkbN08m|JW*mebm-K3xo-96)V? zU#xp15hPa#c&Jl42|+1a*Q^AK2a1qpmj5D7LFK!o`UGFMp5pFz4X0?{yss3tj~#$_ z{w#h?W?7&h=gSx2(3cV7?SYori=u1815DkGF;7W#gwoRDJFqGq&;zE54jf9FKG?{rD#;=(ML#hzV0*=FCZP@hE|=cTFr;&` zYMyF|pzF$i%ILe2E)7_7*C1$;0}3*h91L55#_cL!_@cv|-g)6$E5Hp0osqlH`PELP z$QOlEX=?~CVIM9?vwjAqHwn!Lh|vnFG;eMptX$lSa>L{utZmxf3xoy2cNz_79Jn+o zUbAzekraW8(ZXiaWL%W7kf3{@$<@uWd~#mfPj$5R0vIv0Rb&8{-58FUpSVg#d&hU? zLdY&!T+z22PDv`ATPhY1TQ6^eMG+gMWCiTF2+q335AVT|n_2s;WCT7&aL@pwV1&i+ z>D~&lg`#+b@zxKvO|{hvw&arrYb%)ev3n#?STH-(Tw>d{DD%9}b9GkDslk%= zC%VZOoBYs^zD-dv-dG(m#71s_?Gw;j#`(QMto7*?Y$4n%xi%}NFaK;B#ms;>i4IC8 zK6>tznqC)eQEf*g;yU!dzEMwQU5p%zlVYwTtiKxkt>b|2RY9a8bl)L9sw(K|vF=Qv zqZj6?&kAL>h5jK5wFZ|SuDnuJ2mb*NBj3$}6Q+meZ<>_j%*3CME|y|&1j-oU_3t4b z&b8_0rZ99P!(gZ7+ry9Hq;YNshHP4WdQ@j13~e_CQ=)MLud`cMo07fQ=ruwZ(EZ*# z|FNMj2~kF?;X0DnXf1_wk~f%mrlcp;fh(;NY<(yZ^bNj=fpBrAYrb&SSqfZyC4yLb69acT?2 z1s!|-g9juuFi(5wsO8hyj%Q>-OlzH^TE8D=eL})hLVkD^)q`a+rlxhr`qe&z!q9%D zJ-=OnTFVJ0xO=b)y}|nVX%cc@bFMKXQ!x~5ceUf3wH#G@h>k8w9auV%Kt$`V?a2Aw z$xx<}_e*L8F;b`1yg>$dckq3es=@g))rQvO(-_@u9H`U9rOkzND_pfiXA!eWaxde@ z));P!zQuTk9mguetpr0# zPS-CAItyo{4Q12!uPBUz-p0*o;cSfs(%CY-8t_I|K`|c)_pfVCispFw*WI8kP}GTg zTR>VjvV#&@_=H9VhyCSueN%(asH`Y5W%7&|>t_+13y~I>%f^s1`+CSs6E2RWRb2g@ z?)xZ0YQ7$h0fZS5a7M_y{mv+z4uz2}t8S8Z^#vgtE070N zvxDC%Wa2cebd+U(E28i~twKa$xMEXCQ3QcNtorGJ+oh%|xHpPvG|kzmoycw?vv=;e zqSxnv7^pQSahdA3?z~dW-tRT6y2Ho%Z$Fb^Y?5+L4dhV9i>Og8egO5A1`7Y3cxL+_A#gbu{x9+TI|o*K)c&8JsV|@s zgy&{|Q5ryF&~e+u9T1JB9uu=9YR0TDU-F1Vignt}Wj9oSK+zVv^_3_>xCx=e`3V+5_k@rVFM-D7B+tqtxsgKl^);SKD7 z>CZDV(@xjerml-~pIlP&Pd<11emv+cg*(iX`E_%%AE+BZj!Z_?8qS4@28;%0&3b+L zFOKAP-AXiTe{laxLYMqX=-VI6Xs5y0%-$cTx68ZBPPF}tQ@TE8J-;ZQp!$`&8N2)u z@LU(Yn`WSDw(W>{Bd?m^HY3zXMM@f_u&3%s$>W%8GQ@<<#lR(Z=fMKhlokC#$gL*P z;vBHaWl7Zu+-jY@-)aCB{3v>_bLZlODlpjePsQuEDdu4*KlxS;mOlbP@BjtD@6xQw zAEy5-&C)H+sUylx9|%)R+6PkuxO4wv2T!Y|&p)(NeSAGdA#b-Cxp*+Mb3IskOlM<; zrdh9_ikT+>iyDTv$v5gAb!s9@Mr~$SIvVHrBlnX!T0TG3rxauwB7!AUty0}^#7Fk9 zp7FdEo?{|5OrP+XCx%QXzt7G1fR$lU4iF8N+D9vWFV4?OMBydbwHoked6ry8?c$;t zV};Z+6i0D06<4gE2TUoL5=+)Y16@iAD5;o7;!z*zwTecr3Fd;xar0K3fS8$xib^>P ztn+(_AsdxAb!oHb60lc>eD zj|m_)=+JAEm=lHOq6(+NYzdPikVTFN+rgCSn!7(`$^?o@$yCJnub{THBwCAnTl5^@ zjLE$Hw}gF7XEEGlIce949yK@^-bA4)xAWDeAJV)YVsGhOo3E6$16r5#=KIBp-brs! z&nY}E4h*0;&nT(s^S%g_y!2Y!Z3@EcYC<-IplX^bozk>$s1T+Sjt{?s=0;yb9~%f> zFE%RYQSpe2YvB@nzkaLl&gT3w=y@jf8*Pj4B_DE-LaL?%nsxrFk7RO$R-uz8O^db z1KDt4J3ni|jh}xL5`Ku-1$ycNW?KO=Zuh9NXb{HjJ-ZKxRZ8M)t8?h|?+PzD`Q}7} zisws4F^C};{%eSZF?aP^(Yq7)STaIQ4c-nMTt7` zTBmDy(ya7yJX#%DYSSToM^YwuQi6j^|dOIKwYR129-1_@tgNqkmDrd?=(?wnj z3hL2sKG2lUfWQ?!GM%EhVSI6kU~3570~XDk zQhBlw)O(uGaE0pLpc$Ggp;zcPU!46?lv?1?zj$TM@k3!iOi?r1PCApC8UY7i z#?wi*D<5g|x0*cg{{8*S#B>P2vSF(Qtka+^i}l7mlFX~?XEe6+OEb!3+8Qtm^q%`h z41;1YCaHas)~FZN%-Q2rEFQSr`SNhVR@wLvVOt>2)8aED&kI9Hz=OS=B;Z+&4c8~4 z`$DH?7IQSb1&J~Yrr|p`|>=1b7;PNTzH6LkSL; z5ghS>Y|%{?821b^X1evfBBnU^suQfpdcSq`BNFbAX|2+lln(QaKLY5NbcB9rsVM;+ ziix9HAA&=Hw&~XQc9O5XU0sVRK%)n|7Y`H_l?j&%UYp0U7z^%pquWa@n=xINrgj_| z*<<7+`Eo|is)0^rq_E*5`LPirS&lcFe}b%hnG9Ug>o;B@t7Ll>{<0{F|9rb6`^+=M zwL4-(D$L-h<(L$D)n*>oPw}5Fr~p=#2*=C&=;pp)3+tz!9ToZ(KrB14p-WJVs&6L? zL_<~;cfd`J@_Owy!^rxN(-kaVis~A!`31`*NuhcuCCH0sq{;t9eOob(U?)m)jB5m- zcMGufDKf>ic}^jNF3-{qx%^grf6|hH(XEMmho6y(p&=Qf;Cw+=Qbs$53OTS;RV0Ru+29(WJ}&ojZSQ}R0f&tP;Xhn{GgY;H}H z`y}}zpGW&lp@+Wn5UQM8@1A`Q3^>Y6uTQ(ISN4r*gW-4NqKk>AU0&_s<6-e=<<0r1 z6~VtwZ@1h6v+507ln!>5lc`#4Jx*jz>Xp>X5A|W9)_d)5p)%cy%eFZuS zo+)5q7tHnCb|n^EElQcLp_`I?r5d^M#ayov@yjG?t-mf5d}*4|GrBdBHhCJilt&H1 zC4&TH#cUh}spd7$J@Q58H6!@G5^mT2xaUe51EOWR!3^3&^rg6vl+WD*F#%8bU!Z=W2}%KpXG<%$K{8&h*Hd84}DWbv6|@qcqY_b zviVfrVb68Iviu=&49@N0%T-%F3)oy1YX>&ExTibPGnlX;A+NLFtH3FpBtSS=x>3I5 z{suLUW*&bD7qX`v7(&)?_Qv+doP#dM4!Hj3hW@Clvm?S=`|e&1_a zd2dTOu6daL+fp;K}2pWy0)kD3~<7#^#b*T@`))LLe3vAsW&(VT-`|Df;QD}E?6i2hcsCB<{REf(&iOEAfoq9pip9Xzf__0^z;dg zH1hwE2JPMk*uFk*FWwG6pN3`~0VSzh=zHiEA&B>t<@&+NS$lTB|A|tRGnKg?9ZYQ{ zFnG({m(T9)42@}Y#>Mz~7-sKtS(2M`4|GBi=$_Fw-UxmnA@{czbp>`&5%+ct%h|o7 zx?aNKf4Nyx>>jSwH;Zl`Y=!`8&HQ-$m>^E&>#=*{bK~X&rMQCxk2#kelsI)GX`6n1 zf{#(X3HW;MK3Q^p^CH;BWPeZTE(afc?vfTDCxni@_R0Qa_ST6J{7(HnYCXQdv9ZEa zi155YuruUW?JtsD!>lCLhR?h6ma;p50Xo& z1=$nW!y@dP;Tq$pGJCxYG$DCEoXms36A1r1yHA>F8>Te>el2>%`|!#}hYxKEk{w1n zLmL4fp}WuEe>{)#(DW?ZFeNFlK!iy+695_jvhN7t?=)c6O?9S@>)GWNh*+sqAB*9C z9Oik<UMidzz+`e7jYxX**4t2e~I6D8Gsq{x%Vrn)kVNj5q}%6p$kcBE>bJ^A*5DxEtt zuFXmYHq1>49*En?nHgo{jbp1_Ef~p2}MYZg`s7)z%vD-076b((|d+DQm@3m zWd2qqo2)O?B-1++EEmfhTnVY(A;9TR8vp)B0NNR^|2puDp82=ulZuLs3*Vo($fvrt zsi9f;j)6D~%&>)uO3Vz3c||55craBht_iuHItvleJ{<4(d&F==-AaleQq>jb1xxyP zO_tR0A$QuMjj{`b$X5YUdba^|OS9b2N@HO@oJ?OEN!=N|{NKzqq$L^G7jT{;-v@+_ zritjKQOxv}#^<=?#Z1wh{Bk}|rUn~bS`CV3>QF>HhnW;N$fFtHKSyvv zNi|At9RS{XrKL3HxgC(|9@(PQ#(=azr0DhELYHM; z7!LZrHEbg<=e1`|Xi%Ifvp^k0!7xoU{+H);xH{h;D;!bx@sa@&U?r%^q4O*lAS81;%X2FQPZQfkNv(lLcCT>PNDp@y_(*Id*Ik1X)N)a(~ z;Oz!0HR6$GoYtdL=n@ufAxmAyW&d8}fHb28g4AxB*x(YxTrXy_V7a917~+>G=`unj zi>Hni$UJP0m3Kcmsquh*c(+m_xm{qS#CUL}i0NfnL4MSre$1Q_cu(zNFaXG{WoUYh znZ9YWhlKW)9AV879xjCemU>sdM6=*QWRM|R_l$6IFZx%^N^^nbJ(kg@5M@XuTCI_D zcMDM}AhIOd5;l}Of$A~y3hQcjAOTmVySPZR558D|vR%aoo6iZQn{;epf!y&`cEpU` z&)=yaV)N)G0IK9k=IoP}8^Q*GMjEbVsH|K|&@ z=~>enNDr~e^tmasEF_VGC>K_>l(93p`+h^z+o|kWu_-W2A@2`(e?uqf%tI@7#xpGN z9E-i9X?;B~u#(8noS+r{h}N$Z{X8*{H32$R6KxT`5kVb zuQQM=@8Fi;jqV9CM{NMdK3HNx^I8}DHmPB{(M>bwd}G~(fSWb8r2x!NLL}@<{?PT= zOMa0H4Kp@)8*XJPE^D#~i{e!@MT$J8rka+&v|?pRm?5LZF)|zzVqbS>-oKoD7=Y5e zC8fvFA=Kfu{xJ9)8)*l5brl9;AoLQOD&T{mi-8dC|tykTWC&;w0RqKK3Uf5 z*IN8%3tuRTE+qJwp?wk9iZ;dE=Kq3g>_Qf7u1PgjHo`Im8^F$Aaqs9BU3rz-$mSwk zK5eHYT)f~SU%M_G-nhUyZ_g_I2%2Lmg`{y&IMe6T1I1g{IX2X~L)U1k>eiRltTcwE z8Rs-C+NzPKO>;{qH>p6^Di&>xW`F(yNkHy2j|z6tjo;LpRxnN}jyr?icBiqNnSGmB zD;DWJdmgKfnAS>!Z8ute`OaF|hQYb+u)3jJ??&e%b5y*ZZH1Qx!QhF6m47hGJ#L5h zEZ=;uHUnBHDX`g=QP{gbm*cp+S=*VCNU>E)w;ehZ?KcdS`Mg?YL3A6V)U-*(erZ|U zQWMVBLs(}Wl~V#|WF_k;50#iZ25n2gnH3RbZqrF}jy6s}W>LD#`LWmgaIGH9Hh%ys zg!)NZQ$5BK}p$ddRz;rm_tevAi>u z37rpHJ@<+}Q0nUzKjG0zVtIjiy6K6^yq1g+_d8<1>5`#ezNreY=O(Cj2<9x4LH_|h zN?aaD>{pbnVced472WkluXO_`)~ncNY~a?AAm)$rW^Uzv`Fgq5y>!clm!@sJz>{Cf z`Zt9?!uDKP(R{}Y6+)qUhrG&Pq3URon4tNrJp5@k@m%@~y-K+)!S&IKpdq~CW{iaXon`iEFb<;!DTP7$mO&4l-{StvSc?4A_kJ&D!?_`Az8Yv6f`k_Q?cm5taRzR9Fh$ zf7T`aj+_h~zW&JmWczCLg_M82#^q(z^>w)cB`7Y@_5C3Ob^a~4mtE`koJFF?Tyqd< zX5#;@oaB+VeYa6lqM|xx6ooIPqP~raB7|rrYX;d<+QVS(tKk~gs4`2vOl(2SbZ2z_ zAq*}r!@Y$rwZ-xoLlgJbKH!E4b{M=yNc{}pbSgW)09%!iEzFpcp2&nBAzI)-b>4D<_L zE!~S@>dOroxsL+QbAV*6=1wzkAHiO)$@%*X$QM((_?oD7S0xS;Y3d)DL+6ybji?+B z+9Gk01fAyv^GF_ux45Sc0s=ujNa8;Tf-V-t_$GirYJ)g_AYZK|f_XWA>4ek;r0?r>#k+Ba8Y8*`4e|KuZ;97Xq6-U@Cp{|> zgv#m3?2W>l)7v4!KkZu+0x%y45&kSP$9DS=|0?Aw2VMOBB6#zwuTlN!Ar7)9@qX75;_JGRWwaDs`~VNddWJIQnSjcqHWdH0VLi?a6A71NqY&{ ziRmmivKk~un_tur=Dy@gos4vilh1HRmW>cps!`o3+EF^!IZdjROY^J z|LOQGdi6j74aU>8hmb&K;9S6s;33e43+8SE;Qvx}*Wj>Yr? zL~aALo|MH0gxmUi;l`$8+RAdUoAHZeSxP=`5v^i&-sUvXh>!$mI&=es%yu(^nBBO- zw4Dds#9+`hsfrcZTrid zMBE1}wA{>zYAufC5>MVF^&P;t7_+!)C*p&JgWBGgTG(Qm573$|RdoXoP-t#PQXB@* zGZt=b*$_EBNh!X6+o2~SL^gndUNe-*8|&)ZrzD|4h2d&O-A>S4AXe)mHT>k=$RkIB z<7)~f2f`bRGNU8{Xm&tt z640TfL6|6>4ev_#j-7k@TSta|AjavJ6U(k_19TMGD56}Kt?rzpM|T-;IMS{b#AyV> z65-hkTMBRsJjH@9okPMy+{}?$tL+4GX2WZPa>fOhfOD_tpugRrjnL6u0pNEHNa+Psa)^Do zX=EiiAM}noX3b2&a1eXZB-6H4ZYyoL!v#Na!!)^abfgg*lV&jPklMl|0NobS3MIoF zgjB5~ZupE}8=h!k1WyoPe^R*f_MJl>j5E<8QXWz=F^nC-8P~qM%J2Rs109%sQ&OAyPrTIZMIK!&YaZO?aRt|1i5X&JBZokdRJ zEgZZOwd4^EtTRm|=*dV7^hr(uM>RsHmlG&Oyzk0F$A1KWy5Y`z0(;qSx{G&HRJ6)xH9Bl_; zqXxZi(R&XVN<{tF6`@Zex>jbP1eGTAT@q|0e6q|q+v1iI^v>w%P${T)ZbH6B_QYUy z1uMY{zM_DQ>SljUS-J2l1e)cW4XeC1*mE3jY@FJRx|Qi1{n61d-E;eFF^R}VIa=L` z_;dQTdF~dJIjbWMu}~}-<0%Gq@WF}7(QXcJV~*+asYoj6Cp`u^6lsoKk_6(I@;>Fg z2Dw&0n!Z?)B18%UAsa_--;p++GM(pPcvoV-^!^z6X68>A#g?i6Zv5c1@3Jz1m+Ud_ zT$q8ovMXQF%x)Vi6nBbzrviV1M2vW5me@$F&3mP=L8Z+Msl+Gowd5skWelWF(AtJ) zELg}jrn?{b0n?(08epPti-D0Ev(~qRH4K#pEt>O!{_eO^42IcS!;V=_Tz8L+mj*8@ z(UJn>cD2&kSjsapNJ-wRfyd;+BSv^KrgmIgLW?EzT{3S5NR6AMqcthwJ2il$8k>L^ zfmX}4v-%85!f(zXP`%C@ap zumeSFR5RvaQX4QRMwyGMl^=r`sUzznHyokUwpnHCe%CCtGK{X2d4o)?>c|F1g-ViZ z(}rbS7wZ9&D?1y3S8#<;=cDj~g;yDXh)+6tPo}x#5g|z?tW#97`Ni7o7xDbjZeNx; zA{e5~@Arq8F-poP_*KnxuOJj*kIPqZAae?F9go!r5MD}jv_^W6;^f=~2Ck+m%HhbSX@yF^#T~LSW zuvkI(iVo4;&t|htp=%s~G+n~PI+CRX)r7u05fxe|-FUgtNs^dn>cV93dm2`_?;2;US*rI{MxSZu1 zhH!um2u2rgA2!-huc5$$DcP#0(9$Xd-t>Do%YwYCP5V}CfGeT2TT**@G#z!Go<4Au zl+-491mSkvw~7}jhUBnnAp2_q)$MB(uQ=9FcE3#Y=n68|!6OBLld#Wv)+YrumU$PJ zH*iGege&d%>-V_ZTj}w`ucgVx(X2`gMWezBky@Ntll-PQ<8)|N4E5 ze!`T5iW6=hqe%~&q1_gG8XWmWj!(i;0Q-dS6AgPM@i`CQ5dj(S2;l9o>9|sLZT_+* zNp!2ZJMI85My8WKO2ET#^X_GBHGRs-?D8tPrW3WE4yT%#O@rw|=7c(yF*Ac13QKzJzMq|ae1w09{Bqux z%9b8$VuCKVpVRpM;hpWH8UJ@u{eQIa%tX)je?7STCp9PP`rlBXa8D@nU#Z@~@5+{; z6EE@~DA3l(G-)56WMMAJrpism5oi!@Ta^xFBq1Cep02Ns{{9;rDix{~x0CPt7YN-~ zFyGHw&-ec3!zbT42>avK(1VQ@ZGOg)E5Ja1`0?hoon3ZNhh%J>qK=3=3ZUQVn`IsR z&d{k!*d*<@CxYT0*A2V+mp>dE;5NGL!@lU(FBd3e)jkZ`&D{G{R?Y4h;d=*(f21#> z<{M`oWv8d}TGe zmy?fnS{KRsoQlJeJWh%f0p8z~|8egl;p!}4@V$G&tg~@B9V1cxr2|F!FHj`Q^CZsE z;;N8&!^>lE+blzo+tNZZu7w$DGT#&yW`V~26*5-Hi^onO*pbZ90a^J#D} z$v}b2sb^y>$!K$Y8jOK%bW<-u;q2x|30;0hO8d9RRJDSsQ}2L+P_(ooLf_5#Rns1x zK|`889~0%yd1rW;c$c)K8_TG9zJc+rX=LZP=}tcgX2iTI#XZTg>BPFaLh{%IW;aoK zl_ida2EiwfR(E?iR-mngwf}It+<>n>v(jO@rS2x?&}UwzhIajrGXE|n;=5!{8r|pS z&y_fJ;t<7z@~s`PQq1Qe>Xz0(Ou(x*8(7!)n=oyJi--&gmOTJ1RCCB`v-Uh~CX85t zPNC{+f;kPSGr;cE1y18Oig+h*z(U3D!8!8RGtmhzkGdS#0l0kNC^nrAvhfe!;+oPkaL$vT!ITMi3hFDFzP%*t30n zBHI#idKw{eu(RkL?It^>90d>+S(vVtmK3iDYXRY;ExsP&7VN;*tr17H&eu$pI3Zi6 z|B#%vkrr1nfDu&0Lyr@J*d%;SV3AsL2i7|=JE&$i=En<^;YOe`-w7WKG`D_Z+)9(M3EK}uFcbhMEhx=2mLAe{n&7+WM~TBwn#=x!~%{|yPYRZk2Jo>Wd^TN zm`y893`8}rpphl4Iv$5xrZ^JjBer57x?>2)Xbrl=ji#bIbV&wDoUt2z$GQb%+25n$ zj~59yFAFW2<&zA&_*WAkYk*x7+?9t2?}sq=5m|(zZUB=dGM*W?gRQ9cbXAq~ub5Mn zTbj{_J;MQ%Cl!GEjcsoB%QIF=`!K%6U5-D`ByX zfCJ+Ft(Zz-oqh=Hv)Jc~4IhkOlV172&Qn? zr9S-r+7i_!s=ki{6g_8)|Rlk8H@QvYY42;Dp zL4P2maI=+V)Rb`jXo2;@ESu-EyQekyP~2RUWt~fTm~LrJ;JK-)$s8&y&E9-=2m6oS zvr-W0-(@PenYOzJw3*!^Sq+UrQ70^QKS$p+AZ}RB<&Fn0Ddte=f}z~3&QAqYPGYYw zZ>(jOc&^8ElPh`6qwX)6Bsrc1Su>?>)`BnMOqmOuh0YLuV_ z6$@udpqyDpDFD((FjrbMA4@&bnid=TQv)yGcyAiS`rAbR<+tfb1@&WIJpt0&6>?!H z#KEQWle;#+mCXk0@l47Wm48Ha!6YzK)6kGwveRtsvQ>}&OZ1!bg(;fcxRv99eo-2- zBA7^%VIL{eLlM4c7MYQf5PGZMIDSJNW!^KJd&ZDn!TuKi5+EgNFE=HgthYj+k~jF% zHj-<&DfJO%i+rM=|1Lz@Ek-q4##m4k1^V<1-A1UUlv5hYF(A>u065zG4Fc)-xp_-0V~6q0?q3HO+c( z2BO=WVw)Uff=7%}KP$lPccVmH*pGiQ8ev7L#5i^p-H^~HQqXZh-~x9XNK-XPj|m0I^= z`WQNh1W|+tJXjc;lHGK9T&fF}!>Zv#!?9#GP4OErx2?Dku{)pdy(KheYux?hJ&J{2 zMP}K)I-he%<6F?&S>AME%yO5a&VJgGXTb)#Pi7-FS)v|UuBdt166@G@@W9(`I9?7z z6||6YH_dUrumaA9*?#RoELKX4;gqJ}9D|2pfFd)36f?&6W-_1AUsim%RYBVz>^D`& zZ7TDXQNoU7j{mkvLwnV>FgK~ksfEvmurNaPg;-x!DZ5F{M ztC%g4Kmkoj7-rhtPLHmsnx^5me)&t?JZ-+We%JfK$TXzm$ZKcyicPeC3gwGX0C2RK zn3L%{vg9`=Yy3SbX3meBN+(t|S#0o_o%emT54i5batCEQa+}ci^vZY=q~L0Cws~X@ax<>71D*k zq3fEzg3fwmKji}f>W0sqwRv`4OCN28rl=h1rE#$Z=)fQIFO1c!7T_qs=j7J5iq41D zY#MFm<$9wrvMHRAH9|%Cm`=l-q$pX)h^CKw`IOu8M|&bmT{9x$@f@snOwvQuh=Wf4 z&_~p6$=H;ydrIeKQE`~?GQ7Pv4b*xn}^ z*y+@5v%w%O@13vAK!+DBNGX5ZRR0krx7Wjw$^+W-u%P!lxj_akR<6sVv&z>z)*x7? zoSY6lB^@k?E3|ecZoH<~)%&3S<|1goDsP$Ypx6A# zz3tH%kY!hVtdxbRs{`&J-7O9nL9CZmYJ*>UBrPUSVCAcB8by5rIc}u5XV1 z!5bVY73qJx#K#wi-G98qhPI!3-uD+84}e*&SNcxcIbf!QEg3v?bo$QikNY9^l!{}w zqzlSECGhvm{jZha{g0K{{4Xm(_G=}u_lAPv@u1<}@9@9LVfO}ExCw@kF!{D0w!J(; zcD;bg-*VJ1UfJ2Gd*olg9QN^3FZp(VI4Sn!=@41sQ^!t;Nq7M)G7QLhIZxSsga5o) z=YRg}6LGg)nkAQYNJ%^A=X@ensSaOXlf}^n8xvpeyNkPJd2LPfO1|GOO0V~A^lbDs zDqQa%#7_EI=jXCNf!C#2C)B)jAWa)2CEx@Hj3sfqC@K-n36t3>#xK?QyjRdn<|0qb z|79c`PXD)&sLt8{+g0-a7>V=u8U6F#Cbw+IjW2#4N)(+kMyD*vQ0U)ZWZohRO`I%KTpfTO}!*7kc%I(sDrY&F8JQ@0PXsU z$OOaN(ZncIXNC_Jx7-l^b>Xo5HxN>&PNc8VMao;R-Tu_H!CZG3*(@BCJd#S&4thh9 z`WhEd6J2b$H%<1b)D)2j+G*Y2kCi(YX;7SW-8MCINt0sS6Hv79_5ii%Ztg77=5j9` z&;aDKUAgt(&DdJ@U*cmTC{6?H`8r8oN<=H-vs*QZTfEfPjz*@X`B8{};)~^EMAn zSP|BKVt%QAxVZp|iAerf9N4T>$!NBB13F#4NvQ6z|bL$-zkHP9_Jb*2tuy)hRRFTa)85ZPXNO zS)z)?W?Pn;gEW%5aNOdBQ>ObnVHO&8ZA$c%L2b!_*mI(s?y{hy3H=l}Hq*ira1mP4|GDSdKI`wL>X+zIucB35_5QCqKzba*{(}4y#~#? zIyg5aGS;m|OYKB#Dd2O`!M*HQWyp$5GLqJaS#eXQz7Ef7A-IbgB-1Z2?_LuylZqh7 zK;~0Jlx(8fAHgVS!8~tMz=TJF)FxcHr~Wq|8YV})ZB*MP8PWtcyXcW7&KChPNsZd6 z@m8a@WB_lv<-MPZ5caLyFL%L*a0ZfM+z1y)rqb0VgrDZv^UYO6>Ne>U%|L-%DR{$! zMIB8qM^~%za@*~7eBb}wsro2%XtEYd5#3%wLhYOh28LyUC^V^gehWy!=wGVe8gbZs zpGD3Q*u*}Gv&K=nQn8uZulx4XUzu<^e_tE{%oG#|DY@6<+H=G*pOCA{97xkwrDT=7 zI;PJySRs}rc?u5%C)BBpx1SDSt9vZh-dt5Lgg=32P%RK{hDQ0P8xBA&?VTmmF3R&7 zIsZGz>c9-579nIzj12MHn892o?`733WYtD6Z0iq(O`6@(BnVr5@j&|{mhs1tk;_;g zx>*W=|E*Mc5)vo24QEqLnrxugRcs<|56lOzjN;oVHRUfnk$8hs35epl!~-{Ek3l~v zI;=TQ#iQqDHubK@k+KA!U_A9K=R#T6tZNT6Hc&jC$Stdq|CX`UtDltvP*I$oL13F~ z4o-&Wor7O~+9g{C%4jw1XkJVuB2mGpc4I`P^QC#vf_^aAkKcMhGHOoFrS0?k3T2sl z2r;ZgJj*Zw)+~4VA#%eLc^e{8qb>H{i|uV zCwZ$fd?S8P@h8kmT2K_8lU~)_%d+Qw-m7^KEcT{EhRuF$sc&2q83YMF#26-$;ni^0 zL`um|xXFLNY(=Iq%qvJwm8(b{hhhkBVLt!$BHIQ)L`>hh=j!%Noi2t{3U}3WB15g= zYL*FIAcaWY4i(jjgAOCzElReEY}pI0*87^_rPhb1ZD&dk4ZY}9oU@rfHL*B8Fc_Q4 zeV3`xB4B8JK|xV;7w0$bYa))(9pN3Po6A2`i&qXt1xz|{n-N=O))@z0Q~j2FIqiv= zEK=J!Mi92wySSKUFr2*sRR{hB2PPOA2KjTLkC@af9O z=Xgifj{!(lesk6rR3GD3cs(_oH8KW)O=ZS>2s zo9Fhk5&u-S7%I$~ zf14m0v?WGECLjOU6g*=QO#=hnfl}C>(R0hVgN!jix+%qJTKD~#DjE=t>NGStTRo?X zUyb9meeLAQ*G(TY=cDDo8C$u`9vA1Zdk?Xs%zU_oj!X1(G5BurioUpjZ>5DDsgZLD zZWca}Jt#1>3-}`_@ss1oBh-}67AF(nitrf>z!3CwJuy#0>DZ=ulkPy%^MFcD!I-(5 zABR&y>Yp+{-`Xm)y^I(%@KhpkU>Yr9-c0t=%r-i6Y9qxP)^!@Z1cs$MC$$nM$Ac8S zC#4RDS{t{5^k(M86KmsrM4`VGrU&6Qv_5V1nWol1(;*0JXE`Wt$PLZDwq(a^t}fPY zz*Mn7AnuRSz!hgZIrYjcJK(<0*w<)d3lqIJQYJ~A-N{`e)i2vwB0CZlk+0h+_(-GF^_oQ$~QaA87s?u8TyI5HKl%^Tb%lJBQp46vMleAQ|in4~5- zfNnVQSqTXQCPJpd&V^9>dpS4y}09?Z;!GZhi%ygKQOSU_z9oqVowcM&*V>B7b z?hqG%ogfxIl0Q^3A&P%Qa{mIWAD4!Kp`YI)Vb7pPDCJ8`Ug(gxUWR}tFD}36w5gtp zaVTablFtYLX)Ht=HjO|s)>^H7tu|eGcA8BApQpyLdS5-;!2kbNf zOeWBD2!do3Vw)7#jva8CgcoBRBw7*RGYfz$1<{2ak%t@^G7MBnD(HgDD~_m7+C**I z0Dw~s^bxx{MG0irpdzJ_0J8&~r)C^CXCzn;ZK|}t8|MJd;AnyyBN3aHK_Tm@KFMjH zSKK2j&ZBgslad%#JOgwpMzg+g(gL?J;{e+)TojBVNAocbz>XN6Dj6brw5J`G+4vmw z=g8F~%N0cpqP7t)LwmZ|20&SJh+9I}s3eC(S=j(rbV5lX7m$<|beWScHVBd_xS`>A z5_A%HRj1?F12^xqfdJz`uTB!(pst%#7iVN!P*OvJ7)0-Zdm7wtXgWc>A5OB~02Q5js^nv04=@d-Ar4Inp7^dkwA+Fb*A#1!j`hrr@KFm%N_qhN*U&5? zFb$B&Xh0iF2Rwt2X5PFQ9~Bk@Y|T)PC!Y)Gs~~k~B@GHrWFKNOEPg10N&%VJip4_K zFTEUXKvDARj=P!lt?x_(fqOau1Zs*5C|fh4cIvrOx?JS&aqt(EpVM7$arpn z8QBPKDlx~j@{uBPuzF5OTHIIaDg*ZHoZ}APt_I$)Xr8qAx%8j$i+knMSR2ir=s;oAMYMf@ju)=c~F%Nr^ zJMOilO0n3VP4<0z@bNzo?<`pZXAN<2Vo(+iA}jQQkXHJzC*gk=tH~~?(Ai(6Wc_|W zAD+Wqb@}vaHVb&T@?pO&MVq{|{kGi3TwmECk7$1N{JcY?<0siq^vN!=?I-!u=BCKi z`*>&hzYBbK()PY<`SYKjeJnOtejzM6en&^@?q2tT5KSyGga|91lTiR+{`R2mfAsl3 z&iG$rp>YR|U?56}or8GT0u>+)Tmhr-1BrqjpwI@QFAwip0OB?hYqSOoTMOi%^DQ(> z3!+vU0ofX?m!K-Nc9BP=J{T7UjDX_8L`3}2KLJQ?cEhiac|)^HjL7=YM`6)JkVGup z0;eJF4HZLZJ`kLF4cOk^3nadKjvSx^N^Tdm>t~ z8W_512FAtS6P|Nn<@%G?kxjoMn9zKL%67OA4Q>uFqEMdl`Y{_CR`!w8Y1_x~T0rqD zcs0mC0E$wTOpr!}kiz~Ug8|e%_>*Ud(8O9uFn0&Aks=N$C{!K1fyUzdArggW%?+Cn z7otp`^TS@nk%)azA?y(!&41d!`Q_j0$z`j>X<+*Fj{%^5a>IK>`eo(z;5p2SBVz-5 z6JtCH&PGiI#br9eQ<;d>fdG>wVn|y`!PywGWSZe6#I!WX?;r{#h98JdZSiAAls*GY zhx<}2Zm0>;kRVo?Bt(0R!7=oH$KV(aMGqeApmZRuu<%FpL^k78=z&ZrI#>uPAIyr; zCa#B0nu+sPv>?T#7$iKK1`;&93nnuxF>6Ha>No~y;cEbsA^-F4=9nawHYx~K5w<& z+CBJ_M^jfV{tX|Wu6K{0P)4uE3(nu~8yk$(@87hO?y9PSj`F|PP8+pe3vOj6g_&zr zy*E=E;e~ZlXV(u{)+Mp~r?{)S4$dHml?q{79$1$Mx58aMVjXPhC~ueXP5BIzwLZPm z+`PYVravQ1?OTtgrQKQQqsK8lgX$pn=)n&J3%IiHrs!w2&+OYfpNC8ObDi{RTMJKH zlJ1?;eY2GACD&^nV)SaV{1Hnpg)vHKyC`N=yTmEJliHUMHy&JBAn;=C_~kjA80TA& z0(;FezjGUPWu4m1eFWjxIA_4l>a+W`Pv)+?Pp)eL>09oqeY1K~vH6qed%S*}zP%ro zM{TnDZqK4UlSAa)R$jwX!yENFHk|kc1#|C^L1T_$lmo{0*F;~qt{4`)=bOFxc&x&_ zyjkuuUKVO)`Jp**K@~`&6bBJFh4QISh6JxW@q6;-s`~iyzg{j+ni`apN)Xw>w0R&_ zA>^YtU~2x~KO;})p9ME+D@GqE5U}`s;Owc@5LD)l$JdIq$#(-c7;Usvx4S*mtGd#H zRJ$upK#B97;5bnQHxs@i=bp|w>E8-7Xs(vgealVfN6%P@BB}S>o!x#PUe3N1D)%M} z0H1|pv1|H$ULS8=xA}4P@F;v_vjk_xqoP3$RBh~6|G1ut&hjWPR(nQkP9VgC{Mn!p zmM{n6r!7>EvKa?AK4ge>srgp7u%t&M6~1={pjjcLjC5m}-Aom|!JKehU=JPGm3h_2 zHdpd2FOG>~9=pG!nB7-$r)r|_XH2DZPY@Ql4+mJy42QOMiJAwpJP4$!kAJNezKT9b z-eaXO$f7yOGr|&Hlb6jko`;+X?JvRXuyg7N_D@FMja1!Nsx?`F&)5r9yqS3QVRt(o#6y-oL$p!?o7He1Ds?X;(pCv!}pqFhH^3wR94W`UMb9ZX%7(Nty zLiQlMuy9MaI7ftS41kMF+-k}jK#W=g%5znP#Q=;})BpMw2tm>=Jddq}&*YC>_F6@a zjle&59a^fR^5>z5i`V6$%J0>o+a{~NXRFgkrK^UUQs>o0t?Bk~ov!V7F4bz$ar!CN z$jv#!H1P3ZCIYllQk?#96zu5pEGRHqt&q_F8aLM`QD}U7>9$v6)wxB#wq))bv%CkiqexcC ztQ*`eh46hLXjlI$+*SR@KKdYLtJ{~cIg?-oZO`v`p??*shTi@4zKmH&^qZByfZiFR zyJ=ADR7?DzFw-M{UlK1Uu@ideBujpb|YxD-h3xJQNDawZ{ue}_d zr5}5alW`lWvK<8Z+t|NYao;v}QR-D0Xq|TWmPd_p!A){WSk-YMu&uK&Sg++da1DBF~?U+OCgcPkuO} z>enDsj!hyPm1<^%!71R439q1&O7)>tL9dNLF#q;7KTUE_X#y7CftX@pgzn36iyb%N z-&#)I5uut3L*$K>Ed%piH{S-E56>Fwd?1cq><(X)Tc&_hIi< zjRGgYBy_dEjTnSQ+%Y9y|G0=TXD-#$WF zy)(p7s{Y!h4B(gC5_+-d^6y}du#KX+=q71M?7*miA?mb#f*XU%LiE{i;LRcW2fUxE zkH5|#NK5AJr8j)m`s)Pc3^ajHftY9g7(!(3J(6y#@VqW-g*9=^dc@`X7Sd{5B^2GQ z0gF(cxqrW^+=Fj;dVVM6X7zY^y?RvdU-9G_3X&#r=kKfW!^BV=|0e!es@Kf<>Df4? zUQ}wQLZHlT-Z)h`PNi{e{A)BZk)A3v$W%^8O{RUVXI8J-8Y%1vdhznM`^SiBxGTD! ztelFB1}^qNHcX1QIZ&ms{&4MP5h7OyTz3e~G(v@_7J3WVnq$*;dVD>+yIo46rVpLt zOAPY&y_L+k78yhg`etA158c1aN_f9kWGAhWjG~BNf6=P+(_c?nL&uZ*b<_XmFNe(W zVt6)P2t3wiJ`x;jHkFszuQrzx?^p@VjxcUE)kl|X3EgZC@Jx-lU02RtR8}=%>rz=K zNt^j7k&Bv0^+^deE$?z5F4n$oT%>xeb=$5!J2pl3yrGwd5wGOQ$V<%ka_XuA^9&<0 zQVG*YW!9|{! z6Bh?h9g=SFl%s3F!|>0k|J$4wi!kdy$iSX=vY9jC2UJFoeu})*nSdaox|?Z z-etxbb&__Ju7JW<{<7Xp;>K8IgIF@U!A|B*+R%yMxKBgv1s@~~4er!xzTP_Y(Y49w z?mN-8>JlY5-<~*{M_>^3=0mxbWIXDacJy7Cw%_Ex(6Fs-s1JL0zp1Zxn7k+qkJMNm zkz_4HwGVd%^j*qfab4R>*v&xBt80LCkh>Z%JaTE^(TADg9T!RWw$vd!a;Z(=WiUD8 z$n!lr(4n>C*7~N1Q?sd0AR~l?=O4jNo9n8BfHe!g#J+S)C3DrdG>m%eoqgDCp31^D z(?&@$E(@v(Rq#?S_4g+IQJq;+Z%lMVWtvokvC+H~a*pfU=vZKUml_ieT)dF29&eRi zEVo8;o;Hm>aIlG@w8QU0nSL_SP(r_a+$hXM|L!u&$Y%s?&|AK2a#KaG^72@7vlq8M zEHt>?IClOrLfp1~CMe&etvsZ z@uIsKnQ8%Zp9^Kyt5cCsXAK!_{FwOpG(3AEh&GUqvyNXaj){r13H)&N+^viN0eJ+I z;M`?DL}Zq)9GardO`+`L=i&FDiPMju?%Ytx8w@eO;I2wS&NW>`Kv3c^U^Q_!82Cbd zYK13k{ZPUK|5*;E{JF144L)5@xoL1NcG@mq4R^PzSCkzh~%cX`4F+m;9P-QvM#=% z9V@E0;gW6;l02ccebp|H@ON5mb+Ijl$SbpdILq4lou*--`s01>u3Ln@?n-%GAr{}k z@>p8ecyo>|;pC~4uM)u{jraO;@==OpN~2{`9c|X3cWm2Wn{+JOrnU-*chx^=yEu>GNU zRfe-Kr3Af*IY2JIP1|As@p*NBPujDrpA6p(3xA4#Yw9FUV8S|~OWw+ML=9>p*ZfgQ z*)Ws_wumn7y7$Ou99ObB&V%1>)_Z|^AFPMva< z{1CI29dWDVWA8T*R(_M0`DKCmE z4B)@f@X6)fii@_ly`@DCcHY``rv%m8I4zL0j+pa&zuQPHY=YqfQO~EPI)&wC<*3A9 z*~UkA>dI~dHFIg?=|@~JpoI6t%H(qZLNveC{-rhL>Tir@T7@S*8i3jLo@&MEA3@&~ zFu(@`{7Q@q>)Xd09G{}^J|4Ef)n_Mb@xCwH;Ztv^GglUB{L66tz@5~7ZnFd!aB&Qw za#?Ws7Sx?l6_Y7d<-W^$<)=`DrHndF%{sTe&!QX}2&m-Y;EMAVs}8IaSP9cK@E^6Z+G++i|(Qm7!?t8+iV=I*qfO`uQRWN zAHWGmtnkQvsL@r&4l68-G?5h!#wy8QN~KRYCQF^#CTMx`k}%`MUoI72EcJ-${BByK z07BPy>jsZ0@)}%uYXAVcTMSOgPLItTwfQ_i*z=CpcPUq4AgeaaOc_xJ4TfJF&R#VU zH$%0TcuKFkp%Xvtjc` zOj$XY|3|xpEdOw6J}74wCsRXPD38q*?TNUjR>a=FlutmiP3_1SPlN(C{p{S%&`xKT zlD+HTpGj-*ZA8&pohw#b_4mepu_S1k)hAV4yPUA2hMo^8&?MShbtdAf6amaHKCwLyQ(zyG5Fw069}*b;DByOFSQI9uGY5BS`LWKBJ#9c0FY?nDzG+zJxn&JI zb2y{kpV!AvK}hstqF|7Rm$#G-7?gxI%y6*9ifWKH%CGImXXr(e-;eE7Dm{PPj3+tx z-zue+nD9@1FjJT%xwOyxaDRCIYIDQVpRYGv_fPE{?2OeYIX}P&91SL3zH@X9>Kz7i z;2xA|tMpK!5Q(i6zMiT=B+bM}6_Nk&1&G{3GWA5oV5qYDS+qo!cr2{cdZeEww=`GX zTb)3qDTUhf@@S3!yTUZf_no1}5wTxnes+Z0Y{dZN=pZ$1I;6xuJIs?(Y42UpKn9%6 zB_Th!+rK?_BWBbfTAxYZ-gxWD@f5{;73)}*3pGPIKI8JKMn<9eB2#)6lZT4wai-1f zPH=Q^Yyl8T=dFf9F{U);ycEUo8#DH>GS=?0rBR-GZ8W(5FMgyY3-l}CD_Q#ivcGA z;2WMo;6pk+bCQB!L`PJ`e(Tp+o6>GM4344}FUdAm&=@c1Vtp!>QRBp6v$LY*mcjsG zFT&>_0@~pXjUlEi&yJDs08N2s;en+o6L)KLTJBRCs{l-&)fzEK(*i?OytpGJcSs}}>$fyt&HRiBAGITHunF)@R(S2H~**Wgw>QRw53kx_zM7fRnJ^Uc>6 zB5HK8SD~1!M#TNn@4Za zF83z>Ec}s%^Igwl4Ac4=N}xOspmz_bwe#(lHsN=#`F0yGjH_S`(~iU5$DGzKRa z=2Y=dqT07jDs=dFg#=1y-;9|G+w|3VAnGy4Uf!cjDk)cVx~pVfDdlI8jK_aZM`}#1 zq#|f-!W9z*PdhsKL>~=Gj}MTOLrtNo0Scg61pfU@gUN}?Z3&15D)8^+Cx_X57^R^= z9xR4cktD6Rqdf4*A+^-7k;^lPR1zaC-F1+GkzP!3U;~CwX$dj>Nvu`2X9dk$B@d_u z6)DjUP9cFv`epSvfXbGw!DgW69$k;Q5P9jhGKFX|TA-NfYQ;=YHaMtnMS^nWG#m(o zCmnoW{OIs7`u229@}TeMVWX^%U2F-`QTIt`;Wn1%X-~4dsIlwVy3{S{W;M->9HTQc zsb!RqA)DjUJ+8&e6C~h|ytwIKvS1c@Vyam^OL*k5tIl=ZhzwqqrB=vfQ z6zM+#5ArV&&7frk@_uR`{hcs#70f+MRyE@@;%BHD4XZ!?P`e=v<2GcnNy?;w?6hMJZj%$2u;%ncwhE!MMIFAyqB`%Btj6 zeogX+zZ#4-qtQVOHpQt1EK}7nnzgQcORp5?r0kTj00orFX7LTyP?nXs?0h`-g(rEN zXm@H+GCN9ooX?IeTGvH<*)SV&YeF8{@>*F2*Lyv2O0Sq<#7j_ol+hdN8RDQdjDSm$ zi_~{W@h}`zi55OPE-I)Q)Y^^|&2}To&zs|2i_Tl)PA*hsJ3o=9L?^m;U*%(0u!s8N zX54=x-cqOF9&+4@@AE_0y(j;-&xM>Zou#18hSY)s-Q z=>;wtj%KMqh>MU*ssk;T&IoxK;9Y$dQDsw>343>YN!NC-+l$gx;x8HxSq+`&>bk{V zl`yb`AQ6OxNHWhSdR7c%ZiE6`XF!C?=b04BR@i?_7u zt}wzy+^Y}BV1;)t8f439Of<7@YMhgH&JvW=&yx%O(qK<=GnD2rbBZP5$_mAzvweP& z3I1h$t)sIBE}6;UjZEy8qFt5o>>7KG_9_pFw8RhT%qC>%N+wKQ(RPaQ1@fJ{HDT>U z8%r}$raM()juF1>=aw!cL`$g9M;KG@xT25jLT`XmZJvw~022SOn}`fFq^A_ajj z`INi5{)TSJ&c~6!unD43Gl4!fXWB?)G}8av2#UxV9Pg$9lFOgZZB->s6FdN?$AJF zk}mN3^oMWr{W5suIo$sXzYY2t^}myK|HGhVX3qaA>uR(m(tNSo2O-U0>tov z*1?>dAM6C-n2XZr?+1F1Z^KPg6Gfw}o}XawPM@2HOEjj`vCTi6laeETkB^s+Z8Cf_ z_~V46#Cm|xJaL#bOnSSUWRA!5Q{fwDZ=c3o$fBKjC%l7#SiFu{%$|N>(g20<6 zY>CUS_~oTI*SG%L=PoO}=k6C`rp1eS8 z83A_HtRZfhG}n#jo2t$wUnKK7wvlOOlZ!{8g373t5P5EFRt2zQJS9;j7ecM@I&JWI z{5x2aZN+JAZlMgDRwk;oU7TE_=!Z{$RljFZYT0K(cV{hO%&HO6(b_Chc_g0FkZ>ML znl>18>ycA)P@dASnBXq}nWCE#Gywt!gzhNfv3VQUgm1}Q2`Eion zAqhO1M+lK8#s+A>8|?BqW-UCThN&^ZqciE3TE|8m8G&VB-U6Z$Fb$lpPYii3L?r* zG)$=L%3^Jwx>Fbt&>*@8YhxM%;m`m&6iAvWVK^3bg{n^$ntqK)$?d^q)0mcGkOn)u z+mU5umnvcIj4P3XfXo(Aaug99iqN6mJX*^K3{POxm9h<=y5?Nkw>r z8-|O>r!0{i*OjRCh64x=h}3q22~pZYMJc!-ETM?HEWA0q!&_+IjuV}2??@DSz=6Ge*oB%0nqk{m*uvXdu9w31f;Fk`AWP0X* z7CEUkdLeOyR1JVgPaUEsmQHEXF8)*nu;LzK1_$kU`k*bNyU>oawFeti)t8I03`gP; zJT|2##|+#le9B}?qKJS#>U+Wj#osL@7Nqd^i1DIR|$Z;v_mA_jNy z45I zuePgq<9CiH8gU8r4RQ~ZZ&3orS^**It^-VzDbZNhwZseS@`~%mBnaBF-q(lBB7hWx z8w0{8X!WQgtDsi+nA`j*$=)&2oBuUCC6|th4UW8OlxprkBSk}L)}%PIg>gmM^bdp3 zA}S)X@OPXBESwtll?D?dMap?0a?u*JBO-efBfk?l8#`Yi6qHdCV z3QMI}el38iI%)hMj&N&Ha0h&K~N?NX1Ut+|q;|n5Ad+ z%u(*RYNn@R8>3hjlxoY+MVn;Du4o9Sw8lG#>}_zMUYi0<9Q0;bFBY-S`bdW1t{bCa zX8t|v4qMcsEP*i`2sH%lY0A2vh&ZqDz|W%+JBYdlRJEXzl7o)fn}orjvnbU(kDQ-l zZfF45300Nsi@U!wz+FqY_RI1Ej1jNSwmv;&?XdNg%39{V zp(S`M5~)IA&YJAYgU6=db*`uHk~k~aAS%^HU%0he@HH#Dntc!Dj569zixU3h&=!r! z#NE>qfIB!RMle^+H>$0%R{*^i@w)qW2}3sDA!e&?wCauF>SMsD;a2|^TA7t3K^-mt zIs_vLCRPn8rKyOwT?rTJ`9WAM;7u&jeH2kcER}77_i=IUWBKv=fYfOcQ!~TK*_M&U z3+J*oqXYnCkP9@jU+g&h#`w@M{?_5VI$GjT@eJKzSTi1!^0=h8Ma`Ttm0=Z*VL;Eo@V8VrVbDm5^cF7km;n_b5j`8oGRgDWqe_; zZ@ALvIPfMcY@>-+`x~X@c(#f@sdSA)diGnZMCh`n73M%xK_#T|WKZP#5}k}UV4Lk9 zH*5;DII|?v6gF`TiDv$IlyLA(Pab6;RGW%na!#6+GuF(bCI|%AD6`u7y0Eq7k>;~s zwMP+Uo_;s{us%SpdD|>ZkCUCdC`t$ z_1&%qwX{)S)Jmk<*O`ozPXh#rP7Cr=(X*Xc#IQbLk75m!r56C~9o7tHpKBN6k6EAJsPuM$Bs)4;JV8FY1~4a<`|q z^kY_(oVo_vvGW_RY+Zo=T&fR{JiNAtTu(N8%zwFs^MKeBA8Sqr`OhmXesZ&3Ji7W& z#6%?m6ZnE;>77*^S2Z!2vqJKtfSnLk&b98i^nc{it^TajB`BAtFxJn4NLZ4-mwM;rJ)unc4`#ZxU0aed_5wza7j` zMJrZzegPn3TE(E-w0b`($NfKijgX&z8z$~1EX1p`d;K2a{qFnxZEN{`<@|r5voJ{G zxY&GamqICt$}=&@WggF+f5yN|Wb{Fw)d}l(bU0uAmHk=O(QY=@R71zuemoC?KDn(Z znSX%Mu^P7-Seyz9ekCU}VAtk_LeM7nb{>{G;0|8I448V4ti5kP&8YL1bL`b8-@Ly6 z{?#X+s7a5$Lz0*(lFllzA6R4>D(gK@5;tla`R!eNo;4!p_rH;9(eclZa8Q%|tx#eO z`S_Q=T*0cScKqot@1O7IE5z=nG|Z`;l8jDq_DlpT3v{0pFa0X7@kKV-CBb|~zf0$^ zpkCUrE;OY#;*1tsWOEN(X@M>yVk$zYbOXMkd43ORk6dK=R{s4jFz)YVR$1}Z*bGuo zY;mfCZhm|3J8d0}d@g8cL-XWv;BQjRPuz!Gc?^GRZObJMY8V)dlj1l>CA^7b3gqW~ zR={JkooTCQRI6WWs+Dg0EbrW(0i~LBFYfseYV~J)&?$?=I6yzME_Z9Mv8d+1RnS72 z)@wP)bTa2$?oFCql8-ZXXZ*%`m-on8J)9fb%NC5l>9CdEp-s7jNCHce!6Kw&;^|#+ zeuk~y;RU=P+DhmS+ zNic#Z>Zm6F^l*?vm!Og%&4{tP!>Sil)&lz>>iYYCg6{kv&POAbkc8AlGY(Ti0#x%1 zAhd?k$yVQA=k{@>R!4i2Ln0&6^;Q{7C;P3E%In^aWUjAU75e5-)nry1q0kh-C~@(2 zxgDyw?k&up_vGE#yb7si}W+kR~7yyQ& zfF}Y_L=qE&P}2@6wzd(or$ie|r4~rF3As>&Fm%s6kNvITQo#8|26$1>0f`oO<}b=n zPV$F(1ni*Z0B<2vQ4|6Kg^WB4#MAqODX)1(k;D##76a0+d+h;AL_J^;$MFfokJ^JuW2+yQ^~~~bs(N&O)yiL(a>NVr@Y`i5o-&G%g+v^DghV2$OxmEr zHX2%v4zBij98|@w&7>*ZnX^@Y5 zmP)6)Qv#22^KHykK_~sGuq%KP*eG84;BZ`2rs#}hS7SXeT~HZ=a+tuH@OW}~YYiNA zLq{qOVL}6vP9tM);>xG^Dw9VS`+mWs9Vo4)`=R(f1TL^xUZM!7toR43E#Bnz_6e*Z z#974IZ4=Cc5-`=b!Q`v5G}{nzvc*QFR>dHTlG$`ykRy>tVZNqbTqIp!8uu9nb(s!zHK&b+B-yVJbS=QWnHvvo=bqF|7 ztTlNvjmp~AoB*P9|IdE#pg6oV0|kKGs)oKv*?a*dm}mxy>I9-_*@w-j6=9QL8m3;| zhi&LYQ9{=mDw!Umrb!ks@(TKfX2SkUEfk=_Gss(n?-Hlrzmf01WNWmRSMvjIh3==X zJ1@r;Yt(&?p>Z_?*lgnEkPqq~id5!BdbdS}j9o*~0wn0yO)pO~YI-ha=nr`_jG`L~ z@pT@G?*^#75{w=(R&$%5W_8sorBMh@u`pML$4Y(>t`QA}W{^D*hu5$v>r3`~`j}>g zcIhMQGa>l%(gTrJ&(-WNTBNMQny~CRQ$@kR#5P8FStYJ#{Sp2GAXOk+3ZyO{=Usha zOo7hl({N?47O$tq*)xCRdjX1f>U2sQ?Ujs}Y3#InAezm%%m;B$n0xOe!?UmB*Ku&d z5=ZM|*Lp+~tJybk)Wfk)Bh{Riw4v7MRi+O$vYDK&pv>;--EyHV@?tT2ZW+w ze0Y7qZ!muMOUmIkN~1cN|7H6tV8X_d7kwoA=RiYbKEeSES8md{)ftZzmfo1Y1nvZK z$U}KNEzh+D%ma_K>36|s7Ck)qOM0gjjVDQ1AhAtnC~R~<0;v8sLm*vuyz-v0WEL$9 zQqC#5Jfz52P_5VBt>OlxsWa+|%T zdiauNk~+C$p3=I?JmBe%#8*9ko4#xk#;O&q(9+Tdh8T;&g3?X3cPg=_?HF8=1G?^a zRS3Pv#eiG?ZkXMc*dkZcu~um9ln?3r8SDnFCDV0OhGmAgUozNV$l|uU%sBHvZ#^#$ zy6It*cK}Q;)mr)M?2(n}nnu|8e_^~hQONOeTtjFr1dHSh9BQu5CAI~q_(MKc$tCg6 zrF)8jqTD`Wh+r!pE((9S6g@rCkf==~Pk@vTAI^>eMNDBBKYkxU3Ll6iL*)q4#QFC@ z3e$oxEcIwjt*IhghL9ts;yD5}N?)xgv1e{)wC0CC?t+(CKbJ4QeP5SU3xcxa;USJ& zvA`|gnop357Tr<;W^pWKB_cz1uj`&Gz5#if3hCJmR#kHf6Ax=Bu=t+WpBFbGgU^_@ zDFw^}^eCa>Ip@|P+>)DbDUs0AeOn~91t%ZQ@^@f5m7*+;diEg1s!h(?t@n0b^e=T_ z%7&TETy}Z+vC<7bF6;g^RnOLEs{VHh@_#tmXJ`Je9`Jug`$udDJ^zUfR%@pZI1mmn z3D_n(*G>rDNpg~e%ar!x-;SbDN+I1^LIwejr_n5o8d0xfd%1fR06+X$5Nr~p=Emag z{ym}damwdc8^hlXyY){3CM_aOgR`GR!Mf*KW5o0_t0GHFlo#f zp>`q1#Y`y53y(P^WW8L%JqMD2JNRX%h(TzZ7D84lN*uR$2-z89(d-S#r3G$Cv%Z&9 zBhO!xV^p!Q$1_@lsoW)eqfx!{YO@MC{e=%j^cRK zAKg$kVki(Rv)K|AYAb+OznqKs^v~dVs&sMUM=C?#D^Gs)m$jOz&;0S0)ncSGolzG) z2trC<{@5qlwDP%HoftjNoC#)n>eGzvGZnu@yC;xuYlsD8useh`4$TGXR=(3DbV7(B25Xep2x`FasO`9E4sCtw2q0Nk<$(Iobqqb?I4x}dYP zWBX={fs#Lz7e+0bD!HPyEqK!`7-dmd`Pen|>jF#tmx60mi$c9+&n(v_bC7^{gXf9p zP1Y%R^1idR%Y6WjiHn)P%v}}3>w{zCEPVR1NS>Hwu~YqnU$V$btl9v!z?eHr$GZL=dAvvk~2s zlQYA^aXh1{0lj@ZvGDkWEOso>`PR)+v`e}rx@j|UG2Q_)w$M(<5QXoOz3t3clihq= z?C=kZgpY05XsD~Fpon1}`$kIXusKEu9LBujGHQ}t%F*n#Z6r*%0O$KaM z54p(%-AtBGUR{ksokC%1f;dG?w|(zAH;{|;y7AvgBg4MSzf@Bs(4%28 z_c3e`bWD^aP^Jn>VP&wY$vi^1)+(!yL0Z%A4NI)I;7{sWFbvHp{5s;Z z4~VKN-&SN(+}89P;||O30XKK(6LhHry~n4O#yzO8qOoD(QMn$((!GehbWL-R9GdG4 zlnXBr8wtiTC+bbG2a&X>pJVw{ zm!*p<_RmRA9vqEXWx|E^U%!D{;qX3ILWxU1c%nJs!-uvGg8Bw^VkBw--r?!pOss^% z1jl^iM|~&6d+)j}=p1{o6*@^;!>q^fORgJqZ4?>ED``QgNwR z8lIH3RPh!x!x%keGUq*v`NMTYQ`ZILc%rVl%eHsvRm?lON@0(l9U06(SGg(>H6`r{ zyylalBD_oRUS7J44Sb3xxTKB*jsTAo&i&wu94^%he-8{MwGzlPH2zVGzaGnr zS7k3$*!?ezQCd7AYSYTBPDd@)qYkF=gwQS%2r5bVxrgdlrhOE8q{kJRO1_geZmUKJ z97X#)WJ|iC^)~%hNOXnFCW~#!_=I-FNk5rW5ENVdU!&91+zD9E2{cvQ)v|w|o86<- zJcL_L(CCmEjG*xl^VGuXO=rza3sy(v$EHKY9w)rgLf{8neS?SkkYxMGd_6{%MD3yY z&i2A%K`@-!*C2>CF8Ax-F17%Ks%r117N`WPYJEqb^m4prb#5{P22 z+|gudgBdr(T+RviY?7GfGuxTax>K97~Lw~#RUNB>~ z7EM|6R`?LG*RctOm23f_-ufbkkQ_xYpk$`fcw+*dU30P$7iOF|R3uw4gtoB5_zbXT zllp{klYOcH_QNhg?_`aVJmzdi)Wt}On*r(D%1qTG@x6NXz^YY5u-jC#AjRiYgetMkzb4Z&P-$7GhviY__9;ijk&c~2Bb&^hW^&Q^(zbyjdLmjg zNv{BNe2q7tGu+Kxp!)a*Ve0zA;ny#=EgRnlF0#~G)l@ZC6XR6mVKFuFGmEM+GOG|e zpr>?yg(H)$hbK6lw~P`TjkJ+O6Y=?#xQ6P0VUT_Y7%B`K^*H!_zJl2O2Iu(M z*7$w!{eH_F0Vunl7<}}@p<{%mECERSD-S-u+U%8rdaNSVZELA?QU`C5>XuLk?cdtt z4qBu2>7}T@NOMCV_3sJ@kHZQQ;bHHMNdln%nTG$1v3F{(EnwF)gB9DhZQHhO+qP}n zwr$(CR_v@eov*68yQ+I1?4$7m=D4o;jz@PGD$#f6NtYAGAYKdrDX)^1Ppr?-CM3&Q zUe%u#-JkETxgZ7D=RyTw3r|N0MMEg@CFnZCC6c&5Z6JJj=bmBf6L@`imMOJ;u!3G} zus^h#Il;qwebA$t44gTB{{yc4*otN_^*cSw!uNynYxTs2y7>aqU`tnfbuPiy>o`+w z2Vb`!F8xhZOjdNr+#E9#QK6(c?leZ(AfgJ7$w5J_3D*pQAhnl4MNq>PwN-62|0P9$ z{D%|)Xb^p%H0S18dV}RP1}p0AGwi`B?l@>8n}=a@+FE+a1F>ddE6kRl#553tBGbd; z+0THgG3^cuw=j`dvGy;?qK!2!7ug2I1!XT1%KtDU&iLYv#w$&lH@TZ?ot`!$neEDI z@RsTg`!a4=V}dP-y@ALR9Ym6<+`7YJLXGYFq6t>pJ5#0!h{+Jw@lIHsgJ41wQhR&jm9?D4i3wO&4kwSI>)sPo@X$mBC$U z`9s!$J-YFnoIG(SRB-|ag(rzJO%n2f#=uOA#cy#4zg#rwS=4pwJQ{UsLm~^)B1BBjceRZ3M$!^a4in1h<@T9R4n`zyO z0~5OT04r6232cmy^m7-c3Y%&B+)8Tx78Hmty{t6&0mkNPWW%oDqo45Rx9RZKZ_bWh zkzkiH+QPJ6Qrx?o>@y_28~TzW8RTRncm}VZx|=93fn7vvWN9|v`!vBDCK@X$Vb1ws zf~y-ApR9(EuwRHgK`Od+GvxMk2^e{-?}UxAesOCB*=~5Tb3A1x+I#3MoE-)ixbeZE zBqXJ>MTe!UXWnACTsk6q7~0@>cYgmPhaIdk8G$K6V!#89q3CXDHEgXZ z+a|0own(1Fsz~c2nOzbD_>biox11X7z8C}IBuFfiWft#CtlF^6-2!`hkC@Qp07{~m z&U}3$m+S`CfEe6#-E!#@Wwct=BhvUE>fV$^?Dh^u=FX+zohd}P@Y*xXxv89KpIV3P z2AyO<6n4dcPjY19fngrKHSXxjV21iREMv>lLj26r%x$^b_T-_1=vrQrf8LT1T#R{? z%{Lb&qyw6QCOL{RC=-n93F4$3qWdh+pl;?Zsg!ljP=y(So#)sqRKRrv2{h4ElYNZG zabFaF?3bu*RsS_6opBGYaa$H%;t^2vRvPmpv|=f0;kuem3?_moc@;#OD*5+CFHh4D z+WD{4r=p$xaoClx~ zN$I0B(ci{at^U{}5qd{FCnRMVhZB-iu)8rHd-oaYvGeT;Q#8?YDgjQKuSp4I=n_dM ztWE@=-#lj!0>>hqI4Xh-_TyX1X-#raw4tG>L61WK-JF_kXudwQ_`!F#>TU# znOw8~p1I|59L|j_6>EYRh%fA8R#({m7+2ZEsUI)7^YgH zwzkKemQAi_7@tbD$^oGJ_ox``oE42(Td zW?ms2bn0_ARXt?rc&u|HbsK^`wjo6tJ8j$ACkILOf@}-A>MDi_R=9RQJbLx3qj>Z~ zfG2Rv(dfP7sV^eNiQ+r2l6{f(V<_?{YaU5#p%E8+ykchaGHy!I&3nmyWuBGXp?23T zxO@w!Nfa)5m#2bW?{5q3_^s`HPhE3+QFraF9nND9;MB&5faEn>KoVZoYorb_WXgr5 z_a(6Qe%YCtEb>Gw;k+!YyV(j%ueuYKJ~vnH2&_OecVk6vGbNuS>c`GIn3S2tQrMLy zS{M0b`|G#zc&Em@1)P%R=-k^{FX32ga{nO2UYxNdw~u#!te|2~xZqCL7#OwmpqEqx zt~g1w>KRjyf|P>E2Gq!<86pp29Ab~y!?mfWc5j{dQ+`#c_xJXsT^5;rIy*NON~;VH zNgVPUH=UZ9S&UxXdGNJmG3o8aW*bv%ENscVXj%T^eWWU#9pf45Szazv{Z)3r5p+G5 zVKRIq*ztU61hLu=zzcVs01wBjDf{sCeN#^10B!ulF|1}QX{xIXdYv_?Waa`l4W%$g z8cUUI)~v6xI?LmMW6BYJT}5Bx2Uv!)QtOU2753|cwogw(8)g6GT*DQ0BA=oaPqug& z@nVP2S4^zZk(iAvTWZ7lLyx`oJn|tXNO)N!F`v4|eBdm$f(U*d=JZ&MJCMM*a5qo> z!fwY>e%qE}cREs*ZyJvpF=eAO2%9YXUI7#zBJ_*w6Yut-=gtdwe_#Li%O&0wymcYc z0RD^`#&5P2TUf*~;)olm08>mVCDqKYseWmR9g>TnB7+&+?639b&Xr5smr~eNadCYA z&t}0k=W9^d&HLl+H?Zd!*!lned}O8n?-|Z)EdReI&~ZCL&&RJ^D8bZ@M1DNr&*N`r z^l#>l0Br(o&fxTLk1Z`6zk)<*MF*7I+?Xl}v10v5B%bAqbAWh>FTFdnJBo1l{9X$4 zmBQz{rQ`d2>uIcS9ilj#aq!6|gH}Hz)fb4Qzv6uB5f4u>u*))|c2irWmolYy%K2Gs zyzjuF#e+ThKY7u2lAu3%xZxgz`@`H6rxE8y#QfuH+(KsWAlh%X}e&>$>3z8|;r$ch9Lqht}wuO>PaGfeqSnD{bFXJ1L%XU-qX*SL~JzCW+! zE1kbw5II4)zQRf_LZtirGNPRZL1X%Uc)omoE9Q~*pKn`oLvwo%oA}i%Ux#S(g#Ndw zWeN8nS|wZv-kEhNcdW_<f5ZYBD$TLCL zGm?$Qdv~;mXTX=B!3?ElIAX5qaX~$0Al9DSq`bh&oChz}d1j3nUBy-ewj>-`+rq5( z0M=KsJ9m?co08Eo&e*ZWe>e6LyTolKT*gfni$bq>>8dZMP1Lb?Uvwp`=r&}g#EIc_ zE-vS#wlHn)4AV*I9EmV19VH5SU$HwbAvE{kQP#zc7kiKPo(WPc7C45s+tg`!?-LInA*sOj+{zo`efEM?FQ3vf~*Uw$_;lqK({c{ zZ#qYAJcc-GY&qY zZr~3`8Hw=PL9;Uq5D*ayU5)GW(apJMmo7f)(t?`YxtVB*L9fI^Fh7vUSX~k%VbYp2 z(qNC*Uyj!SNLZYpNvL39>pwt9aj4$LD+)cd=J1vOrimT-ha4N%j!4sh?lbaQ?vp1T zlANA%5QiqNaGo^Y7k-EJ(6BpOG)0HkQ|+)%x8^aJ6p|f9OSD!2ya!Gin-2@><3$k3 zO=15MLQm8bxYSF+;*k{Q<}>y_Awt1UI2BQzT+YPa|<%grj|<6pcELHWPs^JXC1UosGs|rA}|6J;W-RIt`*zk zl<-Omgue+41)KPrQhW+4k2^DEF!IK`cFJV{ zrF)2R)kwh~!Krhr`YCHwl2tp_Sqlu35VE5m4b4J$RtB}e9tF;em#2y!JCVJYY{vDL zN@n|bjX-=gd9@aK7;Tf@%4~@4c?88_$#|S-ZWGE8+XK?pc#8D;ogZ1~?iKB7I*MGy zX%BJ|s(F#YWM2d*1krwAB7}ge{x}1V5q#R=KrNc_+z1Q2mg4V;{-h%>Rsy+EJ}-oW z$+?jtj~ncI@3xUDPKUC%8Q_Jj3CM$h1O1csycTpqg9ai9!ll#vBB+&~jmWsutl8dt zXZP5gZRt^t9vop=cLw#b~9AU%gprU2{qLsJlqUVXkpPpkiuQUU!$6HE3CKy=Hc$FS+kmz)l|bIYEA2- z=?+J}TKhAR$as(ZOJJOM&F^byZFq!%<^Kd&FG*^PMy16?EMcAi>VtCHqKm-1!jRqumlW3II83!rIv8xm6srpEkq zPMZlxR~RX#)6B&-oXD9Y#QM7&Ig;Lqf(@7aEdc(D)f_K+$yIsQ>z2d5056}7nK%zXd{dhrg1oJ7>p!&KVtrQ~%+s!(+2IZe` zmLoM`!_)ipuJI7`ibF0>r{^AY?gxNprBM@FMj~`Fq9hlqTlAX7WG-ueWdm`*&Dwnd z8uV!aK1JTnJ1;I~gxWSi751fU%GA687-$i$rY^G#g?Zg)|MnYCDafljip=-1DeR{F zTH2{wc02@!X^xR)E|vv(7xXy~TUfH>73mbaZHi+VV>Eh6H4iehi7@AE16EXJOx@05 z*$uYS;uLmS`YVWYs>&p;eJM4X21H&J;+oOUY|U-KwJ-Yaw`p7tuk+;D-GXIY@lGTq ze8h_G5n25Dfvjf)q9$i0ic3|WW=)7sjiNP?3nn|Mt=zpew>!1H^bKr)9f<6D(733& z38o;dor9(>5s4^Kb3n?B`(DRoW5QYLu(A+(9ahMF_@HVai50*jI(AGZOnMmn=dW{f zGHwO}s&DRmQ-=nQc(YT2ip5A{^NjLv5ZP#Q5Z#?~7dlb6L(d_R*a9b{4 zvf;ISAUC_1A#3iJPD((_d1+WLV}3!BjM-(OeZFtn?=wi;-fkZ^tT+GsN)XaNH)|F@ zg-_|@Xa1JIF~Ir)fND$sVyX^xGhhQXisRGcaO(TjsNVwF%P%Pc$rE?p_1SMqSly| zO|rM;h~Zm^d|PY8m561?E|-(H2OwM=DBC(H=4=A&%Lufw!N~3JpSY8lZxh~YJ-ve1 z$-mt^w|_r&Zj1tYdE5Vaj=ieTthp%$FovX3Vay!^>(%Fc32qkbDPTRaQFD!qA za&ZE8a(I4Q($&(b%so5xx%~tqGT-E7&&@RlGz!8$cJYm^YfNtb0adE~hbc_&eDz}+ z8v1mg=b+u4NQeT$Ggw#<)OVt;BQeb6BQF1_}=Ngz9Rv7_y2Bpp6T+I@_snw@I~SQOXplV`>C6qk;nm6W%A>snrE;x$D zxV80oQfT`vPx(vCEpO%?ZPvdC^E_Nr3e>Fm`Fz_jP7>)cJNn0xp%o&U0pKw8Mk=Ls zBWq+zt<+zsZ8r0zx+!5r2DSa5L&;#zn$DZ zXlh{$b7Ay8fi&Iit=||I?ds7wQFaf!Yl5?Q7(^&iVk?9^RW(Y)<1Z66jN_W|WnNU( zmkSxOq?H4xEQAxer?qR0Pp+bxptwEUoPh_?hvIU@K*iv4dXIpZdU=mHc;IvFz2rD{#zMLr2U#JenB;Y8!+o`{p>v)WQ# z?ag|KA)=Q7AzNUZilw3Iy6aboB*|&i7+I5}&SVCp2fO3TMG%13;BDk=T66a*G|0~( zq`Q-z9te7Rmoto1^83N@Be&JOdGx#lOtRTjr_>5C)$&f{nys(~#ale~gXYiOj!B5s zQz`@)`n?Ycf@CbBUV^mAM>C`}y~92FBUl*Vn)dLFx94XVG!b3(wQ5LZJo3z(J=A^T z`q5NbLdLDup;ThG7W3Zr2&z~z>fNmVSK`Ui;RfR-%F*Dr!u#;MS(v}M#?i+TB>@q- zaX7WBY2T&OlQm1h#GZr60W6+S9$#(Xr_Z$wFOnfkPC0BIgHx3fFSFF| zr{@w9#>5voWV#&*v8%aJ=}rvRMW$`hmBsqPb9a@T`j&~pFBg+F{w-z>GR&&vNz-x& zkv+C6OUQJeE0im-FxATOg2;$qa4TLw&leqfg(s8q^}L80)AS4pzcD8(O}^x_-oHSb zwhEP=H|Ciq-YDK#-zccCHN^!~3va01hgUJ}oZLK!I!!}{>R5LPDxhG8)uLlHfrA0~ z$iWk{f|kE6EYDTDI78GR+~t1)P%tq=g~x*ifq!=y+D!;9L9!9TB}ZV`Ijp4kyvC>^ zp#|}^LvYoYq!ff~dACZX!Qs>MSV(%Op<6MI7qk5FulQKUJH!?x0kL}YPzc0z3o1e$ zM#cnv*#L)Fzqw-%6WED}LpwuA)WC2O#N($5KtTy$(4v4cN^{Fop^uM*6&I}U*g%~O z;+~piB262)>OCMp4L0Dx`n9o(AR{)M98+epP%QTshPo~pC=nI{Y4r2E?tOy!APk5e zg4l4{Vb<49Yq?X8I3IZd-_)^HEQWX}&T!g%a1>sBFjop8b;OCQso&#qZWa$`Gd)?N z|1Ds|cRdE%o!{0+p~SM@vQfRN59#{s%d4Fx%HH$U<6E2;W?Yr-FN9oJDREC(k2yA6 zabK#s_cZ#kl~VFRZATbcVsK_aRALaUpBqrRBQzRb{VNHw4*1a#Ew4u0b>+@ah|xkA z5d7z->BE)&(oPN!`RF2@T;jhW+nzrh)`W`6_R}hTS)r}up-tAV&{*Nr_-1~_E0>or z$gwrPggda8Y4+qY$cFmp*Hl1PN-ycF%xrgm+z9uc`_a4Pp^Jv~h+X25tW#4~>pO~< z(({haG2*!og$TXeKIcPGKLh8Fty9&|hGDkg$~H6sf?(6MGG(3V(jr=5IN5)%f8-H*4bA&WI5U1rc||QiYrS z?{q8a^WYF{&Oa|rCNGW4-T#O7n4G8^7RD(WNp`?voS_NaHZH=7w)Oed!W3SUV6fz5 zh6#X2sRk=#sJgaAUZHBP5tKGE#M`T*7c{j#g^G@~-n$91F@!KEf5#2=nb-S!9e~C* z9Gn$ehzBZRRiMLHY7<`i1-eh67^IpBJ`{d!gqmw;ama8q?w@lR&^4NXYx!BAbP-3r$?sL;z5H1#;zX4@#Pj4Z%x-- z2)xtV1e`n%Rad_&XAR7${IhJ0?UWWPG-=nZ%gmG3mp^(n_&$*&vP_Pt=_PCQe{n=z znM$VTY3+vF_>)gAyr63gi6~zB)V2%`q<|R6ne+R?_<4~O0uj{zaNDJ;lfb$qbvwv5ISb9C$wZl}Ayw6ke=xnCD>o=x~ zQ3u}F7Y^egzn8|Rtzld?D-ul+(ZEL%-5O8a`@9V}Ublc~wS1{U`ZcS?JWuK-;2z4& zKyy*rN5lN?Ok2Oib}!2H8oXw>TxH zYii=UknE)tbzL<~7`$qTKAZ8}!j{Nzm|tSOV9YNet<2h_O}+&fKIIMF(O1FkCUAyu z@CGA1CHp@Cc(P(dycs^1EJofWj=mH0|83Th$|VbCP%J;W8BoLE@~DTdKxJa<(fbb3 z>cI(aqal}XM+~zi>1Rf=Q=q*pk|wON%xyR)THF#IUgB_lHXn9ple3T3x+vC_~t^I=#c7yu&#^*0nxw?eEXF^TJ|q z#`38#PY%+fJ}mgs)f%9gTg%Y((JO5I&4Wp0>+S26k4zGZ9gye~DYs^wlCIwgyj z&wF@&ed;`8E({JJ`ksz}6h=@WOVW9xrBWCYJE^aaAZv0dTyK|SHyv4Ux|W;+?^%+;pys zup)SS1g-iS0Ydh-3jcQ1{*08Zv`FvY|qo6mWycPIaQZa|HCsX_L9kTcI? zOU|oAz$`vdJmMU-sMP3N(#Z|5!lrvRB4w@6g&C<5>>=%`%-`E6ObZe9LB~`}1!GMkZ)FV3C(gTtRfZsKJ37 ztVnEYjcX4pV)FOTU4S#YduCJf30upmnI8BS{<@jQcnf~#jkesvI@yN4u;P`SzR~g) zPXUe|R{su%j}`$sdVj7=sz?7HT-jm+GET@uut~yds2=*_lmnishU`P4dz8{LP$V?Z^z!*ffF}bFiJ?3Wb$X=U`&Ixs#%}9YR@8Hes+d zsqT*1I}f1vI=fXtFykeUV0^b;ix}6)ZOiAhR5tdKof1<0;%5V+8qgf6zv&4tGzW9W zI{Bhcb~N)o_reg7Z}nmyBbm?anZvHpF(u(AWkEJWix*D z$iAdO{t$BW72DZqO`_;sJbTgytJ#GRI?nGwu;|rTRpd^q6gaG6Qw;#MG5VyMpd$ZaG)H*Uf@+i(B1rHDv3I&s zTS;&5$nQC!@JTJ-R;w0eWypwu-QXAeLUS=_53>|ZmaJ_CxTu8NOHkQlmvFxC)@JLW zAxm$6bqIw*lfN|v+GX%}IaMqlb|WgBtU7_84L^zUaV3=>}7|pc8 zE!tJ$Wf{YD2NW-8!;YW~quhGPkYBIMm7m(GNH(1rPSi%*gK1T;M1x5;4TBr>LeQpA z9CQYp!^O6%&dG9Vf!d}_K{hncZZMgJk6v29OwOHW^v@bruTO`ozv3@Rhv+%U^H%00 zlSG<(lx3v>!^*6nXu7Mp1keGWQQfk=VJCsUe_E+|tVyvG$JA_aVUEw&($-H(3rkWu z>BI|*!8j!Sx1t8)xqM@9?LoSgk9r&e0jAV__zR=7pb3oS^_{K9US;0*8!N#ohu<0nOVs)_sgr_!pe56xJPB2D zRooHNboT9b)|Oz2TXo5S?LoS+t||)6>3nj+wC%;xLsv0dvF|upUW4;IT_}on8Vbl= zNdsut*B*cWIfQ%DxV8|_EBh@07ws*9TSOAxcrEfBA{fFp3`JA}a(d1d$HvtSPvppz z&c6=5w4+1*Zx{8%y~H`tc>49R$U<{pH$^+fOk-g6JQu>AGgb*(Ez8ePAT6n@dbUly z?-=9T#ay*1GyT#RFhbUKhDjH}67KjuNdXU`oglnsNK_7!0#$eichK{&2-)?>@phB; z@~i^tdEC60Pe@du`<&x~Xs;cvj}_zAe706*U45SJx{^7@<^JCUO-wjX7MeN>W4G3* zu6+!1tJr;pr&}H~vo#?&In8<^7)#}KYgZcCT#@p}9U6h<-c^RKqWL;h*VU>DDQ55| zYn?&v&7@1h1^RYJjMF4W>?`mFp3+v&^*qC&G*MLLkwanJp>ZYYmRvGrC#$;ZD?lFB zm6y!n>tTCeeH(z(2bYJa@JH&mYj_8bgiqf|rsFoc2GAReMcj0z>)GlUsk<#f3h6mi=2yxmwa)z?&oHz=3veu#uadNp^ZG)b!8skvhA-Cq#&H%5?PB;^+xtD zLl~7PhEY=*GESRMOetKn{@n72xo9uX z=2F_MGtI?fsxk?7GEur~8+z=;8WWCQR!&>$cbirpH5_yn(k?cbiP0pt`((=OhRiLG zRYF_p8uOh+SEUM2ccZ8WH^i1n0~~J%YHO&zA$e$8aF`H-4M(-LMOR16Vh1QLKFpww zkm{XMR~FVYJfd{!1*MH)5E=5DfRCjvd&}F+uJPE+hh^yxQS1e@d9rh~USi4yHYm{0 zdFGX5E|=8yOL7Xs1U-Awg_C!FIV5mdt+76c7N_?R#L~jeKY?O$hkNhl*Dr%ljleK< zb?{vaa^b)=gJ&o&Yud)X`A-N09?oy7LSTwA3HChLB`gxts>tL#*QYYsEj|m+N6pa* z7Q%xfC&I7KvL9fDti}H#)5*&4-|O%&vi*Nd`CkYqE9}l0)hBQX0*MA({z4Rhg#Q)e zxlX*u3XK=56WWBSuU|Qs$z-Zd?M?3lbYSFGBZ&gBi@W$6tRFPJ_$M4_8K_y%ox$q^ z3YPESULWh)?Ov$gCp+wal*rIFkM@4@W@q4EB@)K&-=1#qpO612ksd1dmB`;T_ZPYZ zyF+Pf46GkdXCf9MZi`a(uY%z?1+^uM1bDiqqv+e==V38nzt^I^=!cDPtr3} zPS{wd|GA)ZNXp-y|Fz|T6>(pP6oEcG94D6y_dgbt=)isjt2;y)eC4n?Jz*^q@5p*1>}j@Z1;^6AD_N2P?aW z&(A;v#yx{5H4I5F#@Zy9z|}EwcRl6gT6w|7I2B{n4kT5%Ne9NPa^GFDh$?)kc*aE- zp6J#-J+a1({0@XEJNhN7K4;z0qWOM3Q(RG5#=v0OjhfxSVU8jqkcx5?XA~1zxrIie zc$9KRQBhG3%ZV=jQL;j&BFPYo&c~4pN&ek^SKvd#5{AX7;ysD8#y8n*vN$i9c%3nG zNuLwdZ#qL)Y;^zVA7{j~!da=FM`@r%U>7w|rKf@*Qd8V-xHouAc{3NE4Rp&);u%WV ziu}Z#fvA?z$6q&uH?mXX4~jJ(x-J09UL%1Hlu^lI+yHOp*34nn}E&op+Vj@ng`wBsF^=y_iHg0ssAIpsSSVZFgid31=r%Ybk;A9I?(Z;#)@*2bO?R#8I?t@&{^!%3{YtYBKogpLE+7~+XjvsUPY zPzX10XnuKXZ6qsAa-t`Uj$0|D*;{sQP` zTc&VyCe8JNwY`bwA>4uwgD@8W$|QKLpfJQ?kb)f!)f9QarJs7D5tNrHa2~Rt0@}~t zTL~jS!)BOSyfL4twn4;&Bb+w`Dogw;9SCRcbw)kTP<>yE+MN#V;=?tH`Z{+nC|S*S0K9| zLsojo7qKwxR*Ds=uHwsCXGloyE`iV~gWtE4GxeV=qEwavgduC2IPKhbD2AeFMgLNc zRNP4W9HA~ygx%o_eilsX_Jk}jo^nvbuIl=jL#p&6G2oH3`Yf|g z0k1lIqJ!uN4b;}?@SoRWTZ~C7oCSPcr1YsoE zuQ^~9mnN#^$NX;xe@s-%8AKLaCm<`%ks1YyN&uFnC7>Ks{GrdCHOs~5;B&o>&A+3Y zEbaNwpD~S7`^u!9RH1TIz7U6H~oB+jc6QdamB6RWo9hx%a;HU;X_k`b}c%eP=+ zvc&JDT_b12CeUfel6=fq>!;8wgV_;YP?S}*dZ)LHg^IgIBrAN82>~WnTR&J$0Pn!V zkE$5%dpZLJv<^eKwDoA;EADFALgywM3Rc)o8@>ncMa^iHq|TOVU-L>yP6!`IGMW>5hmAE%A3BNTgt0l`*$?@4t3}u ziFcRJ_|AK?cMO3m4EFr^goYdOFW~qwHufXk>u|cd;?eg?sz7cmNREr5>n}3{MUcj~ zgGIsHQL^BX?_!x>b zfn`OINXYDCnD=poFlXczYGYmW=4lhTE|aETd;^gI=#CJDnoHvljI(|~ne5^kNXL_^ zf@tGGGXW@#9a)E3O1$n$DF=b4_1Lq(mvpImq<7Z-gpx?d3#WzRm*m>f$c~-$Vh&x` zm5By9)!WlSY0Khl??FR%m&)$f#&Hwv9~cN*b;z@iD{y63ePTGT%dzl&0tes@=VRxa zps+a-oMcT;X{e!g85+4CDgdU~K~CwOY|sN3A7dvWqn%~X_G_~nw6fxU_?ft_^7B_C zx6bc}9Y4S)$54s?LULsM?@5k~tpA5;JEHl&5z`T#QRmA={HOnKVtVC+HDgpq)~7FV zLL&J_tr!`<{lR6UwF0tUSh44uQGiIPU%h*aJDN!N)bl^)JE>0Jt?i%Bj?bqi9sWpi zBI>+LM~yKW}k}n`)CzD<{>rTIF||rJXzizM*I9M|*NUImzF-lHUL$ z?{9!{{(lA-84>Z1y>bg4p|f&nnLVwfhKo@8lie(@Z;@=&#Y%0T+9l;L-}3VObfO_8 zXgMVS+Q@FlO)>%7XFe@5Jn2%-}qv_e6pg+Z+y{BMi~;N zV^>1>W*l1E|w2^oD%xCD$3^M{nZh?T4(eDh?l*pHN8{ ze{|D~j2oZC% zE%o7Cl5T8@g3hvAK2}k z^wy8hViolNSWs_7Id|0MlbGAFPVJWKOTMhL%hn_#&Kaw4>HZENyJDBLk&N6xKmQbp zHw<*t5+Zh9HSM}^WY#&4AS!YA!hsNr`g1XjVLD>a_tp1d+BTt^1c|r@)2SPK!f{yb-Vp?Ek^2-7ii$4c6|u zf>5zkc6LbBj|CES0WjB+ZJFitvGAJw1!f)9@+>@2Z~gh}6;B+DVMjua^${E4X_A~F zBdLxD zBmc5dyuDklG$=WMq>yhE92XXR71q+Hu+NT2P|j!!_$W$3ffQKsvl&yp2MHihD*Hzp zbLZyTIXQT0ALb>?P*Lg$rPM?W`g8jik)+s>vivT}_3L}f)AZxyHkE<|D<_fT1vgZd zqOF}FCGi(IElEQlexPndGYBbxG|%T1co@Key;L8LpZ3mn#3-Q|kW$Vevp>eMfQ!`QG@EUTpw zra|b`@yzmWts1RkjQdhLAQgt`A##FNm1wB)2(3P2GvB7M`yF}ZE6c1mJ8rs``3H_t zhufdo=TG$RjUj zStM0CdYG1}oP0(_lI*%N&%8*BLnVSUs|@sj3INF~uTg;=_aKz&r+oLEsl1`9<$QEk z&1mNh?Ly$#n!7;&gQ8g73w1q2)yTNw+BC59vT14aMs#538ND?sOwb=-Z>?yPHDfXu zNuqzNQ@2wrZ@=dj4TRElt<<*#YliW?=_Jq8++$k=VO|M(D!2eG^ViGD$bd$hM*q}s z&Q$B>NIh%dEpFki!p_uE+`*Qp1C!Kswd8heJ8>J6LLrMKBogx-+K%x_*QOz4P|vO+ zI#sqtBwCdh_8GYeghQtH*#_?^@)9gAPV}Pnv&w-6%3s~kjJKvj0@5MQQ^Md5NHe>O zQ$nNRk;rfT0)u_$I;P>c^Mt z9K6Ws!*(V@ocx4~g^I3y=Ltj>wpyvau-~;Q4e?1=4%eE)E*J-Yfs_{v@p=f$z?JW8 zo|M^T#iWA)fynvg$Q#GQmwO_iVkUCQL%QtWF*sul6Rv>hYW^7T@ZtiobDK=8fm8cX zQp8s;?-napSaqY>-t$uajH0qTb{byd$Y1R?>_;Ug_(T z&0y6Qjh&AV{vC!_bOxeEri3s1o`)kT^LdAKvh3zz%fHr}2G|jhH;)eIu$}dSY`8#> zc7AbwKK-3}*~V50lLz88UJJl#U9(bIQX1)s6Ju6O@=)nE&^ZaEs>D zZ?FyKe+o+Bo*F=qE#UFc@jJvlP>tnYHvh|(U5G*?nR49`D^j?=3?q&tgoC4y>64>( z_<<|ckZy9A?mYiu``JhP`Ix(TPs97owUv_XPdk7u#o2TQm?q94frE-l^QHRjaDY9= zZ|jwKhTEeI{>*&2`0}@h{R@MQv-x}^ExvQxc1-^Qqh${MU$cS~u=+zR&G7{xFK%<6 z&J;rJMF{*OZiZF2K6~{of;4ZgNBFH{eSV)lii4g#;&lPcJiVk8KL2S5=e?I&;X>qA z{q&SwVhziFzaPn0xqtZ>E^6?6)tS4PZtwlDQW&MTGVcAjy`Mc@_M(|i-s1H!xA_J4 z23XXXpRvVH4@!5AkzE6Ph_Fr1_VyrKud-5zfFqPq=y<{K1_dJe&+FH64jEr8}MdoX)DC(wC&*eEuw6qHzMv{4u)y8e$)n0YLI~u?2|a zI3p!O|3}xO#38?gciH?b=@LWcvCxbr>;#|uFRmPrWrc{!o z>T$oE;Xac|b%dtXa_BR^&@@IOWdAqid-lWU75q!H{OX>Y!|KkP>Fn%U?V;f2Re=GP z-r=vl3!MLlZZ?R?Uy}g)f70Xz^3;T0oz@Fa^4_^wCIyds;3@_s?Q5L|f?Ug+tiv^; z!eK;Xx<%;_350?id{lN&aaqwZ?bG!c2a9ciE#l-Jz8@hXfh4_8JAW#cq@oH@RE%e4 zP?Sl=SP$kZPv(R4mKswTDdaD<>1w$(2Lkop$KlC@Q1xRrp$B7=ap1{jT#Jv3*Pq96 zdv#nYHe_L&sVb$Dy$Dk0!8McHa$(|$lwBh6;hyQ$k5YzLgIE|f9_I)hlILJQFZ-{i z)J)>BtE)i5J@jSh+y~9z7069Xs^ZH{S)ts2Ybd6+y96(oCg%e>7W#_rpD{gCOzvZ_ znFGydYTctNc7VI9Oxrz0A`<|KU1_Y1ZsUfsQyol7>$|JlqXe=OasGC$A)Ie#u@frx zu?a-shk2DblJEneFP+F>@9Af#e#F!9-T=JR5&Jb4JY8)?`rjJe@e-QEQU)eN%~V&B zh=PwTfa}ODt=H)01`uWgaR07v!PCrtC@|8%~MtnZg5xe*zh;PJC(}m^tJ^3g@i2Ih6fOtVaaE8 z5z6|xp!4LI1sGEWq;i|=OvL{JJ#xTOiwx8g*i>p#HjuvE3IOQ6yOYn?U^m!Q4l@b@ z3yF|7qQ@>~<8WN=-=8gZC#!Ri_M4$(I#|&AdQ;w|NQ+1g;R|;sSNK0U$oJ(|fal3@ zFy)OjUQ<;-Mut^PMtBb?mn7Uu5i|*e<{`6!MMGUXjT8r+^3mzfWB}_57i@Y#z>>V2 zf~yGq9j6EymF)%scBgyj2W*Qi!Gl%P$)dcE*|)OnsPVuh6N%8N5FfO2it0c_Scxap; z2&;~!;o5Qt7n5&`?7nAS%SLrq>q;uMZBaXC3{9T zdJ5w%tg0dbCtbb;&QcFN!6tdEGIPn><8iv`Ajm0UwXtk6P`kRmI#l=-j1*vxRcigl zh>+VYxq}s=L3UPsuJLG104eWPp+czWv`vJRAFf5cC+ugBk zJL#xnJL%YVI<{>m72CFLRczbl$#?#>&iekd-oZP`pavP#Xs^2Wb8S%->jj5)yxyxR zPcwUQ*rHydaA*#6UpB_T(bp?)rhpE#x{8a%?wpm$hU~U?&F;Y_cc4 zn~&4pGsuJtmVk_*z>oQSyoUJDF{ec`6h}EKrR+D{8nN=UwA^?x7FY^z6lcCMAr@U7 zNc1gv5ZHy6GScj>l21X0nAlss)*m*4UyCZ8e0`}VuGD;Rnq)syV5Vv0 zNy%BzPwL>|$qR09q;!z^z!<2=-ql0-X-QkAq@z1-@mRn^M=`AYy38*eXVh|AomM%E zXUcNwEKbG?+1@sVb^9x2R3Cl+HZz6kBHCP={dBt;p=9kZ$LJ?})v&H{eoF>{=`8X+ zD}$!UnQJZ+qmR%$bE7zYwEeMjF4Y z!0(0*eAQnnqXlx^DhFIH1CHqPLO{oo6FYl;C_BAYg&$-nSU3kd>24;gBh*pt$>how z3m!@^y(F>R0IHHO_Z56IMA-d67d6w|MgY5H&}C0O&DqPC+%li)FC z&?$#3J^SQiak~zGa+T9|U$)RBYO0DW=b229?$*ZV`hzuQrhSfB^*38NzqIkNB=AAd zWd29>KZQH?|IUnNWcuIXZc=MJ{+tzl;|}A+k3IQfz#gc~Py$xA3|gPB?j(oGUgL|< z9rK<{a3X7R2414CxNQxa~qqIOUxtlt)w&I87|t!sPqMc|vBD2;ch84!{N;MS;TwNpiv(}R5U~AphguqKu5QKRg)onjzdflqfLxJvxd5W!!oVdz1X zif>wtP866?#CoZrm~;)-S}7fWkhhGT$mUnx4BdRos93)%Q7?BmWp_BZ zfWcUZp5@-6bdsC~6aJ-r^&rDBBnpDo!u>Oqblx4CyqA+-1cA{>}mB+ej{;zW1z;Z0C{!*-8dtH%V+VaT3IZm3fho1D=PJVwf44 zz%faT1ftbb!H6@Lk`Px+lp~)Wz|~x`PLGV1ANH#K?&_QRqpBPgizuekm8$nBoFx`@`c{b{1oBk5?RSVdibIyu55k{1LHYS;FjoX9T&1|s;N-Hn z2%u~19WZ#$OyZShzM}4rfIEzvZV@;#w_P0f5Y&sq$fZud{pd>g)d&1#Njk~8y~f`4 zF`{tj^#v2k-+~Gv$`TBW!Wg}Y=7~omsgoUByst`QvYk=&vWU6DXo&L1rx%Cf9F2Jp zIyLYYmAcQ4FzM=gt5A^wO%&4->}CkP?beZBU{cn0nP))ygi}K)ZSi&>VJ7nVn|({A z4vs}Dp3$ex_*fr*7wtc|BApcwtlC;-#nMLEG5k*GjxCh5a1P$llX3_~Dti!3ePS@l ztlnM*?=1lAsbX!0J@nZQIUbocsJ0lag5DqJ86nev(wC|X@Mnr?2b3prGi%2>@Cm_# z09#CX8HL+^BAd;~fRSe|zg9I_dK*_fv7oEKn;EPbCMQ}~fj@XXdm??IhfmHKft9h& zgUMdYu`%c4_;*15rD|=!_LI;*sXF^a$npEQfZ?BZp`$y)m)#R$z@T@_wwpyum{(^wH%HZye?zzL%jo^6Nb7kGH0QXJ7wutM z8Mg`Xqr$Qd>x~lr5oNm!0@Z1JU{*N4cqXgIxg(}5=v2;V5 zm-22`Pq0mItZ0%kNfaLzJIy*xEvVypjIW@2iN?TWgn*@RS#(RRq1HKgeCHf`G(D{cx&Sv|1?zo^B9~{_$TGI}^N~}g1j=4Is&L!{!?W?N#NO>!y zg{8f+qa6|<IGnMr4QT})5T@R_byg+5`T$m}eBKwaHCcR1GwXUNkI z8RL*CPt9c-$kw(XR&C`Qp8` z*}ag9St&L{k>86_NQA*!AM;uC=qr5H|Ra2 zWfSF?f#8sdCEM;nXN-HQ^{RY6$~saH39_E_k2v9~H?bgw68KAqanU!*IV*7GLXLnXUOsIG-)P@y)`gKT7R@%S3}6?U#;bv4&l_t#WakSFUY)3G2}*wXu_!%@bOkEr+RD?NPaZio@ro_98mO z2^*s`kJHv}TqY+N<&&DS9pQf{TcPhSyqOy}>=7eDN=yZ&9rfoa?@8C8ivCZnFVe?Rx`I zCkb{-v}K9|%V#`h4c)f={vodcwmT5b0g>UEQ@*cZlHmi3NvcXA+~-^1(bQ9X8Xa{N^dOBNmjVP?frHQVIBIn`(_XWXML@~V!0n{;xBT+%i6MUV~p2HhQl?8r> zvCc{x@g$klT8CC5xxp|nG-z2*9eIV({MOeYfTLch02ThSEYx|*Ad!@uY)l=4vC=<0 zDqrgZzGd9x5;V56Ke3Q4>NX2GcjYH&T;E7Z;slsDE6(2jMi%HMrq)w2aV;{UpAfR7 z3h__i7|R2W`GTsb8;W~pc_{vjb~Lnf8^%a zt+b)n{aU4(7kYq|v=Vtb$4Y5fx%8bHQ*Tvd&wB)M)9mTNP%izAw%d8T7-}r~ASrkL z$M0i@Gf&?I5>;FOQPPEe=EFCE$qtYqoJUecV5b7O!f`JN<|@)RrqlNKoc0?{qOAO( z__OF;dyQ;Y`1W5^fn{NkLqdaSdJKN`b>;Et9*+L)`K>l9+Vy7~$8%#FqKb)EavJCm zb5!FXJ5wr3wt+g0X5xliN=9-=Q=C>)0@kc`Uf>8r*v>C`rIl$n{?zio2h&tJ(~!Jg z$U#ej$GI@fVCdBQtbO7-GD~NXGhppX6v!nI!}4C7EkNB5YeB5L7#Qt}ei+_#*-DJP zd=dZ~A!vavi1rd5P@sXR_7dC4GdHtg=g;j+X-LM3=42!bB4~ExAp_MvgdLMQyQuZyKHq}=> zkrzOdYJPu5o}vNLcGEB{?XW;?LT>M}7sCuFg!&}MKqi*p(w-j7>@yFl4ykoUV}gK_ zkoa+0ed^eQeb6@<_M9Vzi7QG27bIW8#h|Sp_8Uaclc4*)g0u~y-JV+;Sst$!fT`{f z)*B-UNtP#$pu8s|%D~m`a91Myip16ake_nsIfd`SRhH8aRo3oJW-fNiXfBXbozcMZ z8klJ#sa=}Thn$wgS3dru0<@D{j`~2G87PAZ#@LcFjQQ~4SpNyR?aj>vBKAq;7*2EV zcR;_oVF21tE-qL~MT*vs9HF{KDmRL7d!9R*%4!S}jO8zHa@!(h9e}pqcdRJG7J5j3 zTy!PkSaKKDn$y9)K33K=3DU+$3&%5CqoiD7L8qO(ds$kZQbcowSF2Z2sn3zyj5!yp%q`W*#J!02 zd>MCGUjwtj)>AaUiLI}MCc9|34nBW1oE^dmnz4Dd!gxI~9_EiBTvlLCmhfh(Bcq?7 z3?*Gw>~ZUJk=vaeWRnM@?0Jx6*ldjE{iqag-P@rj;(<7VM;@s=VAH9t>?yXZ$KlE@ zT3ci@l5o|+2q}J=nthxzVqGF#SPiA2a|Yr9r+!pp!Z;$qZ4*oJD!Z1Q!S3!vG)k03 z(E+qQBjZ3(tX|G`$Zq<}fPx^YmR?n#+JHbnLH-84l#@RvhUJ>!o}dvqXfE$g<&HrdkmwEV-_`pU68z>|sDYS_^7q}Ieoxt>`kE+Zb_ zOLp&R9Hz02o9l-9BKXXIssOo>YIrX}q(cOK35?mb++fh+t}!q^>jx1SWTzc+&8N^d z%VVD|geGj;ttOSSY?1GD=)ZlO7RqkC zCF}GB@3kf0M)c`ftr{yzUm|eTmu;EjAd$r-$qg~jbP}Rh-k@RlIn42E;=;nTr_8&c ztm;tRw6bxUkWU9W7RJ@2EPNwjHWQZje@u7lNxfaX>=zWNBoL%ZZMDz@oR8P-m^NQCKtkw(nr-D zBL?JjGAcVuZOCcmqozS7;@8(?X5ELkJd$%84nD|2m}t?gcBb(uEVg)z4PkHLT+mhxr zb2WgF=}*rd>99606lxYE-XFX0!(6_BsIWMQ(zGkDxYAwSt@4}}CAD1RUmTm2<8bAY z1ig5hHDt}0m#%b4gn2BqdfW9>a7HSkOE-u`ZTQvDpfa7Mgu=<_Ol{s$AH{=e41-Ct ztLbLXm(3TWfyJIneeGH?PC3YH1KD2sMRzs}_??(&KqqQ87blV#yO6 z`UYZ)1R>R%;HZlmu{ar@Ycxkrlm?7u8Y4m@3Eq?V3eb!kxKCdJzl@*p;}ZD#z8Yl) z7%QaM6IP@(r;lp>9)i!Rz+p3)`7#w#FLuKZGEM^Tc)&xf)wKR&EhTIPmilR;(V!YZZz&)9e_YH1ot~0Z@ozaT30sqse(tu*PfmO?F*OJbTk|y9g`@ zaQtVB=f?#fRH)r^^WMSr45Z4#UJOOXTl&jrw&c9agw*Tbiq2p`YKyJ_V@Aa{(`wV5 zJz){^eC^K~^!#enUVLZ+h~-zpsaOp=WF*X?TYNmjvs>n}tT;&w)BtczI9|p=WZ|=N z(wqb=hO_I3`)Lr1rj<1ZaCg#Ws`?^#a3SV`(n;c)|roa%fFL3>zD-Mp~@fkb@@CU?rHXd!u z=<87p<&9u7uNS9uRoRwwzixGvrmi^tLuzLE@6O}wod1`hy`d>pP1F2sXsb;S)KH(& zZTCcgnEPJNZEDX3U8J3SQ!p8yAE$zn3%phU#{?O>9iCxBKFV+cf%v)mGw=lIFTGof zTl#S1;$eo9LAjGVz{XvO?Y!=n2}SHT4LslM+~$j+`3jQ=Qe0$v*Ueu5{tw8^_wByC zD^q{a&Clx+`GgDu50`S^-4rwnZJEWdO9dzJKzR;jnf^%=kbnw#AL4UA)tsy$Y)x5* zyR!dCz0J^kyE3;@7t1wyZ~JZ$K5T7$@?&Ad>p0E**3SN0mRJh4V0>6qdgjm4Yb^l~ z^V-aXzujwAs+_x9k~sc#e&1cB!eI3JIc}7R#%}ihxpe}VpMFyav;_FPvwD8e#r#i= z5USf36OsIZbf-wCx3D7+EUmdipULl-*a%I4Nz((7;zWx^W042ZBQ@v^%UJP){=WDS=| zJ0;bltCoOQ5~b1}O$vPdXWr^aRqE^@GzcehFQ9SEPwJAex_e#g{ICXdhKzqSO{#*EGh=PrKn2^1EGrFaY?2fQm&S#;_!W*a zRR4@v=He;4MrNu(Iw6Z%QhU*@T_+xa?{3E`lhwTT2X3`=w#T$?e;_mQ@$zr|Z%S=* zIIx!Z70)Pzcnou6$bW_!v?kI9u>D4F@2k(8@vOq!ogOx>%HrEl2qIJZk|8UZ1pGLS z1(^32Sn`Mzg+3;t({6s$(Ooh+E4AwGDyw* zGuxLr`GL))^$a=<1(JBG17GKF6N!r4r1e=Uo zBI$2|5RF%M+n=QF@usjl`4!}E1Y9@HZS+BPjiTODZ;UCv4L+t!$;0Nt-F)=A@>Slv{fnGQIaQa-%%1g?^Qmg$}L^(Dji6VnRHJSORfY4 z7JHU;hsa5ERNtNuZq?tZ8S@|uS?)3jl+}S2wfkZuG zx(hhc$T}+*c{-{GM0zH+CRIe4*oB->7j3iga!&THtcGbKE&bw>Pd8mQiWb(^Bd^0k zXC8XLHI^W((QBR9evi$^cgG|DqXX!D=xyPTtl#igTr>pWt!1`Y6q_z~4 zDV~$|T9cKIkW^c0`I+)K&3 z2+4krC1Z)%X1DPUqDmGruCeZl$B}C%nstB_wWnH(^LuDQnB#jW9^@IZ?5~Pry}vgv z%f%DFXAgzCAGHm$8-9+2UX?WJSE^yg(<{e~(d|?$pggBj%3CCJ5nP!c+yA6DBdmQ) z7B%e1T=+f7OHTu`+eT`00B1z5p!Tn0?J7u(S&UoAeCssH?2K!%(WIhm?>y8VKGfRE zW0kWg&J%0rCAn@_(46nsdXs>LDzK#PH2}G;F*-ZDfLYSzY(rdeuk7C4?H;P`k=KChmB(tlM zn8%x5Je<58_ca#$@c@W)Uu)6O!JALz0!av$y;_0G(9gdEvpfekjeos=c&Y(cW|=1_n|F z%R)(5Gjh_pHkZ{Wyu;^H$aOvs!jd|h*X)x{p2?t;-SkQrB{}P)^}j6EsSTI&pTYP7 z@@oDh(GnSxQ^_JZf#n?9IZ5jUsuTfG85!L7FpBGjK5!ue*_-50ri+eKwucM}{FMcs zR<_7$YVR~#vwxeoFqvZ>{quAZ^05DxMqViVYS_V)v%;3%$Of&9vKC9jwoMwY4I6*Q zAtGQ9xWSuOWX<1P`djLBDxij`u~#Gyn||OZXug@aEzo(3<`-=JDl@86)W)zBFPzYs zH!gRQkT7mN`ro(p83)z2!tfv23Z|sE_;nK-0yJ%5f@<=|lMcveHqR+Q+BL6e3ubYs z^VntF-(cU7?5ZbP8{W$+sL`DqOUshp>oO90%qMSO&(c_9d`IMm7}hTT_GPCS#R8_y z60(~t*ZLusLSTFqI=l`K)S-_>UJp!48R%nvHMae-qAbKA+~|@<_Qw6ceTRlcu#Q(m zKs}dSEL54J;IB#nQz1add`GvJAEbK6qJ&>G0sCxL2MIVh3jZKX@ypI^RkH`wc{*t~ zZ7-g&T!Tl?q*pdB63k{-r%i>-fMHR@5}|)CkLSM(If3T>i)vHdZ@F+MVd?G!I7)Ug zd3V(PPS7FtC+9x}*#E8qz|P6>zbgR1|6zBUP`>+}_dkU1K0qKlp^ixY}X(o+-FaVZPPu-poW8!~>4UP`3^mwZCdxvp&hXcOO zt9(A1-mmjDz)k(2YCYGIIrLL^ZBXK2Xi{teU+zbLmos*6%I;-~$`fyRV$}YjoisnU zq&ck}Rog0#K1X=a|Mes)@XJG#4iLirC6ErcGtU+!Zyp%defe-nL5~uxip(vLpyh#o zgsCOBVEWN&Pt?5D-TmP;J15p!Lh09suM3xCA4q9cq_#KHSVeki`R_H_+Y;a~p&?yIt9_*Acm@Jj!h z3(T*HmbsiX!>oi{Y2}(l(Vh(cL{t!*>->4!HzH1H1jD_$gtchlYV73MR_P?Gdm-uY zOG$bXNF?OrRNZtCb-N#>Mrhqvfb&2{9ihzHe+84lmsHjOp+^zT@mSuRf3Qh6n|V6y@l zXotNZrO?JG4qL>19kZL_FFQ#xH%yI4qtNM#N6Z unWBU!rL*<8QEd~l4v)Sa*hbW=k$M&T zk(Scinqy>1kz?Vo<@0r7NEY~kw+a<#E==FN;$-0fB*Ywi5_FVdYYkFu{Dqxp8**Il zA}ohSKEFZRih#R?_HEgj0ZR1T{?E8+4TgQTYl(*!x(Cpy=2LasPRJPlyZzWWPs@t_wfG#0VJc zk87aDoff+IZC;sVW^?I0eeNc8Jry7FYSTtWi9Pny>TkSt@#=kvSic`O`eC!Jd^DRC z5Aenkv34qN-@P9A^0}+DY>t8oD~U5ZSJNe#1>+?Pmg7*X5~DP1^e$n9+)GWmsaSv2 z6nUr$R#8(&s{00&R5o!fwQfx_-rwfNJCz#^;0)@Xg2q~>ypym}c!Y$w9#F!$vJZ@Z zMXzF|zbI$2&e6#nUGCkamJEhZ5EN>8g4x=YPPcP#y~>-tJ%zOYb=}SB^aSmZf>5BLbaxnZmnK1lRRp~+(!WA|d(kq5V;SgETti5@33gs^Z(P8V( zQF1O;PSo?71<6TTZ?BPklvovUj#76c+i{R3Nb;v#NL6V>ik0wQl{P1WenugNjcJt| zaB7$_dWBDUUb8Vth?S07s}QC`vI5QKQj7)!8gRarSg&;XQs@H0g&o{|)VOm*QrOeo z0m;IoJgqr{hWNe^;T7o!MoFEZC6zq9Fzke>TOCldF2y%*)g}M*YfyCntS4E`VOv6u z$7vdAS2cIw2d=Q{zW8VkHpi->^P>E`_y#OvAdd~wH4XI{jcu0+qX(YMxRlaS`q1kp z)@N;yZ(GUc$}=})hJ+l1(p4?ty#$`SX)Z`>J1QM*I3n;LmTd~s%@h6{Kd4oKiB3?k zRfC~yIE8N%J8cW!y(SAAiS+y*MlzCE{}(x5?1>pVQ&O~!-2G!?G(EFzp)7y6LhoYp zF7&5TL1$;(!k+0H`okuRFGlSi-;KPT*o;y~{%l+Ng)?qe%y*&`8afkV2{oow0(ku@ zl~IOJJ$41P?6j~hApc+m<*XYuNQHK2aJpD)a4w@64})W_kMvJYs<0R>FzV2e=e7u= z-JHC|T()B=;>SsL9h%<6LF@#{Wx>+Pn*(rvtAtBThMB+~aq5VbTb>27)%^nGeBB30 zF%^=PZlKkO+|$!ZzZU?=32QScmy(%DJ-aA|vYKy5h8Pq4oQu4hWBoDam#~X;^%-_Y z%q=2Br<`Wckbv9He_N5D?2>pZhOC2iW3-glIMa2inbeZf_1K+rV>FC$V|^o+`J97GQAP5_rBF;s z4U%4ZO?wce==j=#r-*1%Vmb$2;8+Xb9CJ>lMZ{e^nM1oY;Dks+!IqyUg8y?r!9fWSl!5P(12glGQPEmuGzx1r+~$c@I@|%^fT4<`xhx zPdlwhFYTJBSXkGzaHUkjBS{7o=XZS7_i4&En9(LASFvfA;y@%4khx(LW~p{BL4>nY zp4;&Y=#M^abcALI`D+LU*Ebsr*G$ho5_va)^HppWi*>cjw_&eq>lFf-226KD_+ZLU zjVjl*i4kq+^Z!|2HvY=DYM8`*9Gw-*VIA$fUuYP(0lLa>>Ru+})F=$f_AY<=G?+YR z=;x7@?f;jlBsLtOa;(7-SyHa-;*A79l~M@hJz!xSZR{8eTgKpB&~m=?+m{T1(=0%Rjb+Z$`acI9TBQI2qY1W+E(- zZQ>e)U*3CFBS>Y4FTw|OCW{1bMsIf1Tp|C#PTue>Pz}Gy#Du({DyhEjAo33A@Alx_ zsN=l?6m0c$8r1zb88D(YOm&{M<|ZR1V+8g)!QAcW{_Wrz)ws7|mG7;*>u&cwoA!AT zfEWi6`cEnLzbh}W{NLq;K`oh>yC#&b|5IMLmLjdW&i#!;*xcYj<9=OL_%~hH;be=U zn@c#Z?tFtB8n@Co40mdnWg7lPwp)gg>4`uZ4uENGYFIq2yAegOag?(0P<=Iz}uzB_6ZU}#`!uSv4cI+d`@rlE6=>YbV$5SV%+qw_%lfLC` z2tHttPwyilR_C5U<16n?98&Kc*iH0~Gv?J^*#5*Egf|Jo{65tD+Kz+6PQAeAwejov z;`QnYKt38ZA7O_bI&Ns0IM)ekpZ2NnbeeABzjn$GxOoNDkL~V6YD};0mZ`7#BlAV4 zscmxD^~EhwX=*I;`U&_yzr>no^M5_Zd46ofAk-_OB6)){;i%7CzaVDm**fuM40bX+ zcTl1w^>HDMqqD!ODi7upHM5n9$8->OSlw4-{XA$EbpP4%Ck8qhDrh4dW0GI}?Oath znO;9xaksFTC#z6v_sRz30AI}}3oSh6zm$=XvT@<36o(kG(Q5>0fOKPdE;70_JM!;WiY#b@FH66ijea3t2=;T#D z6U@Ox(=47oEs!-z#i5Zp-?|Bp$i=QHm9!vOsQ2&wu0DmNlIseec&*VRFz9 z;t^za(P;4O#>}=8xPnrP=99UCLVtK1YZ8QIAjnCEHHjuH2)~eiFK)uyx$H1HrajRE1R_bu}NiwY1@{$?>##+%#ROb!AgxY|oZl=4HI zejt#BCT=LhLK2914g?Z?o}`+ZJ{*ay&)*sJSF|q(0>UmdcmKO6{QNY5n0o!;NsWCy zW)_KHpioN~UIKV{Yi}%@n-v~Hnrk&^feqwY{`|~v^v=l&@{t33-{P;7@eVsqf?dT) zmlZ>K6B+dC0)Gv=5K8lBCOxkj0biHK(G62ID|OUTR8bQntWQLdALk|NFy;(|;W4S| zB(-aEK!f$Z8y{j@(c+$lS~%l0Er^Tb0EM<+wWR9@ULd5uWt`Rh+Q_XVF`bRpuv!xB zLW|76za2UP5{j7$ONgxP^AlhLa_65j z5nNnK>K09-4Y6D!tvaz#r})qm&U{dVa;f9OjN|%gCF&af5^|aalD;jKlSQI&?dwTe zFnCFw(!~;0xkECtp_4fa*72{9PRYHJja$BRl@{DO^jp}-X~pZi^Q4Hu+%{fG$ZL#m zjBR}XLA;CJgY1^6Tw-u};BWCM+cMT%^EuP9HI9uDm}Fa^s_rBZqv&6`nOVylA6 z!T5l^0glNEImz&@CjvY#|OjbQV2b#P^AJK14x&$^t1{UDY|!vsdJcmvk@8J`I^PX0JLJMM>g`lX0tx+ntdhCu)wO} z^EO5J#?h(?X?|A^1}ata#U>c(l_t-*ShR;)qkv;&?R+AHyO^-eM%hffXZ;XZfIB_D z(egIxhXoe~n%D()q*0?)F|f>5*e&tLyc0<`+X)1_`}9oensmEO?jP;&NZA%cwVh8? zg@65NZTm8(+KqM? zgNwu;e)GMld&EvTk@oFhA;XoJv1qq9+(@OKi9MeOfy&%&j+K@aER=#i(K?x~SW4_0WO8nJY&Fw}rf^dG?o~ ztL0^Vn9a4U2t)e_>hiX@#1qGgCkyx@YvEo8gKAp-==+j$3#8u%Q`0$o@%U6z8p7X`U@s8l=}$JuK_ylZ*bO;Jw|W_rI0x@7zx5<4p?37Fa@72cL0a?Jg;A&q5s zJST1LNW5%42+UCzDsg?`R`}kYnn-r0LB3Y4Y%)1zv1l@KR)4 z$ShhY1}RZD(Rng<<=yc?;Sj=P-Ma^=n0RMlJCa&8fL5irV%Q+C!Vy*FsXsJR=HwhpTPkrCLJ?Qc>^s`LxeWz4&J&@@n!c|I~h` zj~@i@!GJHTDghr^fe(xCTlomc{1JCn4=mjWxTLSr{LzK(_hKNA<@eb1)OWq~f5xUi z;cxJ(OmPUNPtGL1VM2%G?VBKEC@_S`03qDa?^F4qYZQqSuKvxXkesb^n4K*I;|WJ& z)0VxB`u9+~Q~UpbJ6ixBKxDcCJvLeFN`h1os@QLn?~N4UpPDfAaNbofuMp<(y8Ks? zjeox~0}<=9KGnVl0|(v&$oDd9>WkjKWWO@Kx2A~ye!TBBUp{JO;siDZ%Xx#*nOs}F z-WKTUwV%jN;164pb!63li#uU5cyqQY%G9>|ZLy*2e01UgrWCjq3Rno_Wj$P$BCBpS z-y7Nwri{c`WG#8FBc=3|>Gf86^IytTq z;QgTVn?;$38Z9vN4{!!JIV+VlMzv!ltW788hpH4ut*$2P5NB!hN2`d-4}A5WwaUX^ zFEHLk?p|x-!gx&NN`jEay7vN?*u2?U46I)CP#VqGiylNnCI_vD?nP4_Z>Nxom=gfT z7Zc5_(4ty$QF_x7zsO)65}DUvj?nSvfXW2(g+966Zjj8LE{$`QZt@rPYW5)|NWAI1 zbs!0i>>U}FnTDs!MrKE)EF8{#P36RSGh+9u;i5Ski*kt;L8(EkQK-&=Kzd`K6;R^5 zYU&<3{}#ssGGvR0M9QBB13Iiuq9COl8Z%yn{4m)h!X4y}-^K{0tj}}$dE(vnu~j}< zdmLMZdlL0>n{X?GZUP7Ztke>PnHaN-S}MaX`xaOMQOsfS?LbwO9oiFweeHMBTl$aD z5`2K7G$bZ?=`rlz0?x2@LoM;MHMHQ+x){!PivaeAKWn=?x-G4TnI6-23f+tc-9E)J z?O1Q;vqDIH)@u_eXfV@0&OC+B)*px%;;3EjgmL%+_ByIS2K>Z|3g!V|!5!wLLc-gE z)vIiZIaaeRXXh8i{wZ)d1~qI*-pwX9V?ZWYew2cfhB1!T#(AZcHxW{z&$@*w7tAeI zdQJC8C_0eGBR=YrJt7f2zg3N_EkUVE`4>6z2>OyZLhmPpUWp^=j8p64PC9|FLG>0p+A6l3zf`I||ds{^)~psWXD^sk(!G|6H{# zw7PLqsthq6sA%ywLAVxYz9(W=zyrQ+{rC2wUZZFXo+;jNN_ z$R^&Ve`+xfS1-EF)7`}~(yHh=O=f@Yq+^tH+MN5CONz1L!Y|WK^Iuo38Ti~s>H=ryp0=5BFHGIPpExq^&`XrheejnpKI#np4>(zIP$#8#=Oei$6OHS5kyEAfXh(6B-5SnyP2AuPkB z1!9QA%jd3}L}ZL_CfD@Ne^^(HZB|?7A4S8do>Q(gT*5=$&Rg9IPZpD5X+Qz1xKiRV zc`0PzQfDj8E<`GR9erq2PeTz?^tS37m3C4HcPV*HFQWWK3VIopQn0tf4VCoc=Zli+ z5laCP>E4!n?obp*J5Q)#Kymhq{*R}GtHbNpYsFu5y0BsSJ4E&1tS)+!9J(ojy;{xyDspk=O_{yLlaP%U{ke_0Z zP!>Ue9X5=M_x#W3j-F-HjEaKr5+R__&IUjJWr;JT>eIy#k%TqwvYIAkipY^YVD_r&xo1`#M*%d|y@G6z!w2(o-FlriC%j zW+UQ+fkjDuY33FddIU@BpyX6LI-RcrVIZ@PbxR~$(0WIH0tQ!qu}KVfSK1Vu`3FzN zsMx1*#!Eo+Xrc)zi4{5-ODSGNl5nlMOAuRhSha7s6Kjxx2@Q*Xk1xBVil%CKy4g+- z8mOvP{$f9oS8C(THvXCL&vy*x?H@qvO*l}L3Sho>i^m*NHQQ4P&h8EuSG7ooW<<_A z4XCZfX=;c})=}K04aV;E6lB3xx02=YpCQgcVSsrZaxUv%Qp*-rrK&{@i>(Pejv>wQ za(c1He{%cENlTq=4Y3@DrMVo>H_`x*0p?GivWO_8?#8}kOr7bjauyB4APa4NzQE!4D13mat6Cey}0ljnsQeK;*{btrG?fMmqfTKjDOj<+Me=-_57hL z4G9KVZ5D90ctU2nFbZBAcg)@LrH-gSD^)6Sp-lneK)MdGk~Ft`JuN{qK_6YFlHv7z z-xB5QQ8YD{@f%=UgOD9>nqYbRO@mmM;tW5APfNSv2*Ks)6$9Utm`uKxuo>d6*DGXRrDu*mRvM*HUYbD zPD4R*=ipVAviWZo=rn_*BO&tF9uLHSr4f>{cD6_P=qwdbt~_TwJ2+)&C^r{O zQ4OOli;Y^lMXc%4PM0-un~t3H*k|V}n(zt)@J7 zsO1-K(F>;1p${r@XK%%xLz!peAZh7ZxgJ&B(pp2vW#}fx6doFI+fZtnioN&@o5LB# z>ngEzomn$>;NSHm`9_^c4UYTGEQ9WT>ANG)8Tc~bAlXOGTYvr8-A_VCeFjJ@i2eIi zG-&z!Z2tO@-2sF6pTh5dcWCEgWc=TU_V2g${~x6E|1kDW?V$wP+GV(6+qP}nwr$(C zZQHh!6>G(|ZL4#>?!GwP`(povda9n9c;^^Lb02`nzj_-ce%GYUUoiI;Emzi*p=r`i z9B#2R&t;>XT%bVFx=JgF0(#13PhZPWN~yxOVaJf&caSv9$mEzyyf$Dz@uW@IfnUusmo%$asBT;U(qT-kFzKK zpCCgk?HeUGEUmCEZ7WTrzCFvTipN`qo-N1&JBVM&@*561h4aKsGZCPZgxo{+BG1P1 zvtT;ntYZr4pKI=92RH!b2BNopE5wbci6WDyqpxSCQZGqGimMNQM5|i1A(5-Z1AH5_d5BOtW*{j#Z35?th zsLh4((Sd3qS}$M)T&=Js_m?-Dh!IR0sR9aKn~hth{R65dIt!BS4?}>j*4f2DZNceQ za!H7~H=+wALV>!43#4pHG-C7T*%4~xk4~q^8!*JN!({*63eVDYas-04(@qx;DpD(S z%;>xbN5LVSH@I<~`95=d`m`g=dzI4C>?LSi_9u1an-!a>UPcy3z~=d;w}3 z^YD#JqEdkUN#W$Ga`V%dhaLL!2RZ5B_tKvcGmL9^q={6#_~ZpRoJR61)tY_>RHhm# zrC5>cRFIjqqvo)-f!#eMlZNWD#GgAp7L3gffg76OFLkj9eIkHxfmToegF7(_&#H(+ z%IYW_-}?BhW(3HG=%2zcW$|w8ZbgEE%oh0&T9O8Ns76M*IScUuZD)n6XGP|>{q<^w zu1yQNCbcG*&sOlOm*8!7-2!5iZsRKY_sFWuRF>w+mC4DWObe?z3yfh6&q!y9U0v+a z!1qUpr{7|i(D^VE4O207T_0R(5=I>!*HPZn5Ge9pK5>^6_z663Ifj>uF|X(8-%?YO zfNg%cSO?NS;q1k|PhvON#nxBQ+l)dJ(Rh^2OAtW_J>B*0=uI~!jo#ag^j&Ls?I1l6DIQ$ka}IWE|K z5$Eihjs-6}*7&~`utS~e)^YvuIuWwsCXnuQV$@~WExB-4F^RrLH*51mQ@1QwTKI?D#>=Gx5I_SOV0kLcB$6puVu@V}JSOP|gvC3=NEte&hX%rl z)CW*1^8|KST9R)yx_~O3+!-DH(mTQ>)J3sN|q5o_ci- zwyIP46za=8{A)%vmw)DdY|*8WkMf!80qJ+_m%pyxNsH{7(a8C{Rxr;Ovo2d*X^Zz=$bf z6pwE5GQ8D!pvX3`ODf&%9*{Ma%&H-cc_J)x7Es(p-jO(!nKjfWtApG_n3Q@N3g8AZ zJ%NcnJX^#&v%s(|Y$|qZ7w6>#sbK@vsX&@vA9Gyz(WD|+i0_AJ+FOg)>QhZ?4>I0} zw!6{z9V-?R?vify)P$Q#*h>c=R~FRi8N+NU445wC2~4PUS;MEKqHW~D7L_7!r^7bt z_rpo5Xz8xU^STu+07b|p^Rn`_ERCz{5;6p0sG+@-iKyt{4X+)(eTTSRy4O-UIf`B8 z`wCphPcTH@czjdDIIN%}bB@$tAOaLx-KS&6M6n~_SRo!>y9f-tih^^BI<3r{iTPe+ zI-4y@D6U{7w{IpS^QoKkZb>7PmaZWrI=G*X8x=rQigWPS?4G7ey}zH8o*vrTIi}5O zP_}Y2ad_Q{K4FN1*!GhkzQCOML! z{4tT?dWmwL>CRbRMS`%M0rf7-W2Jy`+|>nQ@N+nt_CkH1L3++=sLpXQ$Q~ojU-;VT zWqb&k4~~+k-$xMH*o5-QogZwv4GRzFc!r6Sa@>Rr*q8qS?5-_3-j2#-re(fA8)lTH z&_Bal+YdTcUu@sYx=9B5#e#rWG{5eo(Z11T{B#+UV`@(8XS*O~-(QP2e)-}9cseE8CoW_^lfdK3wZWK+!|*ll$li zT-b)^VYhxr-lFtw`z0^clMKm_D@ybqCjxGku+NWn{#MLNjv6io182jQ=h;%nO+0D# z#_h~jj_Rh|r?KnJsU3dbmB&R~-g8RhwNGLfBz{R&Ult%IqdY5BH*U>79YDN zDC!UIv(;)CS@)}{yAbU^j_m+FOXIY)2$?`;6LbZ7i%yvKXL(3 zPUVsYvrk()uP~n)7i+8W`s(9mW%_8re&=&}(9eFD?oEXK0ClcZnD|D~S%KN;BnmvQAkCmAVdp}nEes;mu?+CMl~es(P-|3%k@ z4_0)#94!Vjd?86H88OeFUB-`!x3idS;3P1w&b?a@{g4i?OS9zQCg`6nZrG1$jjZ7Q z|9}r_(9Lpuf4p8lZZBMs4IX~M2g-au2cv%&VngBnXFQ$0dh1;3JK#E3lTPNXOT`f5 z^lJg3lve7pr>T-04$)34ChRf;-P>D(j8YYr3%VnG&g=v< zh~86@GsE11G%I-Li{8$KzG0_;hg3UZrZO-^uSP_yJA*(&8CDN%S*obQh9JRGh($mN zmjeUsKbhW$3*Nx&`ygs6BP(W7lunu+JX_0mJ{Iq^9F7?-VQq1)>)>#wdX0`X?-@P8 zDij(KvRAlKuzsBN)|iaB@J#u9d|+nRwmj+{qc5DAPhhCn$hNH{BNbKQ=1MP*4x-F) z03(UPy{Q|>m{~~vWaEZnHI!>l|094O6+~mbTY>3L)sX~buh6(_D`&3+!Zt8Us80$K zwJRZLnUVigFnmwPUEzRit9;6$T0S>dS%i~Gmnq49tP-shXO3NZa+;p@6BQ(YJPtJj zeVCfVYjqY1nQP%A-3?$xM=Jcl84VF@iZKF_C|nOm=jcmfcOk`F8lB!UDQil~K;gbQ z3SH^7&fot|K4t^xJ5ux~*6~c5FAyX_A0RHc>0s^)#8TLp)fgxVyJdK`4EqWt4yiWI zi6NZI1ICrl=Acc_q0<3^7io6hGJc8LLd3+efL+;FIc&qAx6t+2+Wn3T$A&SH-WtpQ z#R3}Fp|BmC!u#x$`jngOsMPSw*68#5kJoV$e)Qy}$$$cL`Kk9E1DqjL(+l^6nS*}@ zQw)^4?SymRCiE6RV4K9LU3s1SoUIsM3@ljd!z7i>(wa8zx5*40U z>4-8V_?{dOv662C1l`D!q>xl7J_1X(!PuW&$^Hud8LWWHL7fbCP@uFSRm2E=h!fs2 zF>xda*d(m@TkPyXat{y`nnIvg=VlLG2pEfAl2cL;YWGZHUd)sb+SntkY&wT{u!2uY zGN{7B+TY29TnJulgrM1E0Ll9cAy>oP1G-HwRe6==AVql`!(uvVejC#b_{rQ-XBm*2 z!*I-j?Wh{MM759YJq@;wKGPD}Rs)kAS$_O?kcU}^z7B2V2Pt(757-$j0vo7Th8p#; z3n?ezP#9*OHtY+8=zP?CGnA!ME&@rA%QRinUz*!$8Sin=1810Q>m9kmgi*6@khGxV ziQsbV`0M-L>QQMUVi~qiSOZtvdNf1q`ryL3Gi*O&%JK}2qnHaEdSmFp0nCRkHq$er^_dpP7jRB_pb#{}{!% zeFUFHhPr~na6~Pk%uG1qHW#F;6kBdta#n%!*jsmR`z88CfL5wiIhP%k+{7TS4pRWT z=Wsb(+e1dx@eoI61ioV-l>xi7o&;nR5Pwurb7nB+Ku~3XHS{t60B?7BIj|6)P!9=Et-q(D*M|laG40fs@qcgw_vjEk7FO@AY(xO zH}0cw^>0I^3e@1YyGAo1@b$HDmvfCieh`b^CNf0(w7S6!jas>Sc7aBH?M(@^cN!DX zY#~t%b#Jks8-xgI@^l=h$#!XxDP2xCDO}^iwCLPf(#e8ReLz%nPFA|?8wR(D^$bP= zY5$g-%d+}-(uf|Bv(wjOD(1W~lp=mct#=FXr z_uJQim@a~dPg2QeVnoh~o>DL+D?mkooH>N{QgM>to)maJe zR<0#kWvz+xDn0yVc}kGI+f$gi*A%LljW;|Y+khkj&blWXc2@HE$SE{mDD?ueaee4+ zom@6U&5;+7M-ddw1&}f@*rI|;4#$uJYSZ2+Q3MG1gGZCs(<(ps_^sZ)0flBc`8nn5 z_%*?J7*d;fc)d@44B=+ERxsxvmdWL_(L=}{72m53;PO7nB$~TC%ZKXL7f_1mNs{?a z?{1Q*8F1k^r8snY3=mOw514w+fS5S1VR#5ZH}l z^*wS9m@-pCHHSXovj*{N3so1jDywIU)0|3UdRpaAcK`W0RT2wV9V^OqxKHrUh2rjm z?Q|QA)kg}&mhw8H5_7|)UU$~Zc`IyJ+jrbE?aQe-5`uM$H_qai%St7pyNSzcOYQhM zkO5Q*We|_akWQz_T4daDDn!+TU4NyNdsYkqP0r5nSgpx3pwj_Y904hV3KLOW7Uu?| zu70H|VTDp?I;A*Cw5r@CA~4w@Hy**E*2Z6P-u+53pl7y72f&>=G;6O|Bum8&HOztQ z0p8mz5Cc1-6(yf}U7D)3m6qB0R-ovldVm|2cr8#KR6;MRaN3Ve(zc=M?BS??F-!R& z%L`pyE0A_Ph8q|r-(zcTgUpN3(Oy}F#P=-_F2GCk&ubg4gjC-=bCSx7uNUC&JTZM@ zO1bmk-78^Ktil_}6SNtN)Y2)Glt8&oZSk|UJEWJEeOGTTT3*(qG&dn7g+#{wTs?;} z1Z+3d^Kxlm6ZBkN7ozXyuPY-gWsx4ckb|yGLYO@} zf|aB}#cf)nKMfrW4JFA~e6p$cu{)VFJ#zqUh`^W1Unamg>u*g7U4HvUgQ@C=&Pjh5 zu-4PPaqf!NYg#t?3^-&YAt6-ca%Fi)=j;65@jwK1uKq(+$;$ZO0JWHy82=YJe^^^8 z?w}o^_eAX#jycUPfqy6rU=7r9!`M~;_Np~m>bc%)d@Ir6sBd>4E_kC>>#4Oj#;iGkHJJ=wSj*TFr z{{HzFsO2^j(nE#2ozgq`N^9~uHT2<#cGvaVo#nn(68C#sbsNJ)n@Zn5iUqofZg+n- zayzdLj<$1vL%D4**ap}BUM=<7gAy#;H(v9FdyI-jat@)#MtkV`bJEtg-RvAdM`@35 z7gv`tVIMZO5iK-SLsd=8yL|gTbpw|``Zn37Q=9s-V<+ulX8Tj2t%DA?aK1mkm`NhP&{wP}MQ<Mip|ku+tT&NA91R-u4~#TI3%oN~5$=sDRyeMFLmQ zk+-gyz)7oG_3(RODEeBG%Rp3#^T8llbn+@j5+xDhsc2R4qmS^Vc zgd=pqGt(U_$jxS#JQi{ zq#hplJczo0X3Da5&rQ9(%Beonjc~QJI_1{eiPYgDU2Ce-NSx+yb6uSkQ$0$=5|}tNM4{c6(l4#0Vb_?pf2;0EBr43E zui3dYBBV;J$g~&OB8gvwKy#qDG(7Jk%v$*x;T>J>@%r0bw}yXgn6^k0-Y%$3Q>Jyr z%$9^>2#wymO)dI&XHs`7`2m0zKro2}uz15m|H^znJ~%#1nP(7oB4 zCu%InOC@U-7M=;WUbfw4+;V~GGBnbS`i}*Bs8gJ4(1n3+aUpmd<(Fj2x3pn=X0<@* zjdj(|;C_aw-#vDra>Avl@ULM7%h+W2%-yFa)h?8^qt79p*Y+*uLaQ!>=B-M{bKUHT z_NxJPS7v4^mTkFLul5QLqs$WYF52f#)i)xJBZ|+tbQT_fY7F=f2DU(Sx~a#=>%Ila zW7P>!=8k6$NRY=TN|;EI$GZ)cStj;Wrjmlu&uvnqmolx9XV&o`T6Pbhj-#-sQyC4` zO>#Lh)!IxCYFeDO68vS1?85xUKNqL*ywfl^*|VASFN^ zL79Lt!AIIFeWC9xs{LR>Lug_sg=Ka|CPR!tUO6#ZA8T6^iny^f4p1;V-_ zvXC??5th@?w$+YQ!(9AIc&XV3cQ=L%DR=mtKCD~b;-73@BNpKNvaA7L8ci@z%|z9V zovH631pjotcY;zb>mh6^ zWKhyv7(C;!Xe{xGJ)R2@RB`B%Y}7HrdhHm~tj8crK#2%*IvZd={X%dhyutE$<}weO ziaO$(%3yZ6?CdOK=`kIC_+y6NFV7>khc8a*@gwd-7uw}nBa9_nAq}A&9ONb28K&7C z=*7~136o@$$9vcPO27;pU~+{%c>F`y!E>$)!8noGeH68inaF{OXl_be`5YP}qJJ1z zrBH6e?&+tdo}Sh=4WD&u`Ps{Ag`s3OY`Ws`=C~*D1u+|>PD8}RVPIKg*qMYjR(}&t z-p^`sx0*d*qBbAQJgv<0RCo^a7H=x-Fc0qw_F^&YyVnv-f(;vRbr#9Cf)K}g2t6M! z4WCs?$F$}$PL4mm8NrmpWxu=g8baz7BG$U%o2{!~34o-$@ds+p5_ISY7Qdmnm) zv5)^5AGnT)W}*zQ;rZdEAfH75^~}^Pqowhzu6B-wWPwL`*Q^aMdhFkpR+8#qSD4h+ z8o+~U{LjMY*Ko7sn6Hwzw-Q0!{m53eG54prpgGLsPs4U=Ze8x;9k2tb;=Xe|bv^mr zT{IcK!s_0`pPSj%hlfXtnN<8b$=t{bbsu3o7ur;s0bqr9T3nTc%?UIvixw(*SM-GJ z1Ife_qNHo2v&p?)4WF7CijcE)d4@vlTxkO>To$QR13V#1@e_WJCFCUq;dyQ^9dbH2z#VLv%>=@lu!eI}-A{lUMBr)*tFisg85GBU; z7Umw_`^*dGvIOZ{)COHn54uj8WewI0Vg?{iy0t+%)%+~deC87gBoKTE{-p4~d}NbY zqrt3os4?ddae;)tsM^!Ta;NM5WYu<=VOoX|`C%7rD7X-k+Uz12(5LlgepqQ>`g-ba zPq%!B8r%YnfPY4MtINgL-Kh(Kz|0$o1Da6+6;Q{59NzeA3UT;uRp(8(4?K*4guP30%AhCfw16Cvj#;4ciaX< zFR^-SBMs==U1)(aES_kK-mkFx-Q0^i51@OjM`Y5Kmn^SgkX*!*p8cmDv^9IdZu}_? zSQ=dW_1B3Q#CW$NB)O_AQ8Ik|1AFG6PO-eC47X-I=4G-$cnorKPXmZhNRlqS8b!M$ z?6T1SJnNdn7R_ucc4mHnY-SzNDPxB?MPU78d=%EIDM#(IZ{F``jwXCW86Ff_D?so- zUe>MJu9kok5}?W0d{r|>Q_>@*UA`!3>hl>lB=4Tjj(pi^>2k5{-z>y*?LE*emW{Mw z7jD8z!1#hDr*$UWvMI+45~zd7Qa~CmP!qCnohCFRTn?M-s-TR=0l_)RRp73mR-g__ zya1=8ArJKzO0r&vaFB_-(6E3mgc^`Kpi-V3wN4rW61O$5IBtdjnhu;Sw=+L_j&(-7<}k)_VKIN9sC`OPX1>z4$w zLHKH+=$j9eE2wbFm~JUyvF1r5dGN)aS~`F5{1<$&umR70kkq=cM8dyYOfM4)_WH&3--MtiTJmwS`Y-c;W!kr43sJMVo>Lv z2(OnGDy{6~l3rf`^_XR7;OT-UnGqmX(4|{|_pMPkIJ1l58u|x_jBkYa*FxwUafEL` zb0M!BR3cvY#+$pI@U-d3)mxL(-qm?$%iJv6)%GvoxL&Dz!Xv%r!^8(iF{VHE8A=ZE zEcEsn3s-}1&&dgyc$3s21r7^@*m&%PN6U>8f$mG=4MN*Bh5}Mr)J1q21_s^;67oXS6rn z$>#z0ih151h2eT$>QrsBrNP%_c6;9?}ELZMaf%SSybaI$~fn zbJgH0wR~2?w?kXkH_G&L$o6=N?sO)RP=q}`xXeDdM8bj&*AJCIi1!$-{WY^ zjnZ|1c6F2WWuel~5t1JZ-p@w*NN-!mPWdHPj60k^*+3^gep@KI3JitK|I|XU{5LHW zBRl>7-)8^+z$u8D#3Km<2B@J||1>%|x(T525K&~g8`#}{>=i{)^DfrpcEG~_-*}2) zLmpWi$I>0L^xz+`1kD6bT*Ptl`}SsTE+L9LA@0=@V>nR8;CZW&v(L<$G%{c`gb&KbMRGqX2*hp zA9KL}F_6g@4Db7G-Cn1L*_#ph$Ic!qP*o^{QRxas=yCcfepp7Z&5rCjCw<&&AxH2IiUz2t)W{bHBIYN}g3xbu_y z&HJ_f!kG2>wn4Wv%O|))PZxEZ)90T_Q(f)VsRZ|rt~2B6e1nRkE=oo+L2<-_5-ra} zWxP3lG?tRlOcfqWiwVn4WD(PuKA_DQ!QseY&y=Lm6mQDsnW?U{)?iulq2eG%w5^Fr z{tM5`&TfQ3mw0NvZU)LfH^(U{q3IUxS3>r00q?`PS<)rtS3-tLH@44WPGA9Gt3{6w znAJA2kx+Y6DgDvut~qsK8RNtfG8rrUD7{yMze;x5O@>8Z^K;Z%F&^@Sqzh%Hph zIqHe0x&IHht7qaOjr`!IzwYCHaYmBH>#l)rm2-WF-gc-OBPX=NTSy#jUi)@y+bVQy z5wle(7K)fE-hIrZV?Hl6&0*-xT03*01`=zS@&3)BR&rhDQ`tbWKE^!kF+WF~ty4-A z{^NcOE${urpM2=g$8%FG(V+EJ&kKcIInhu4@JskO5D8R9MH}U#7>OWE#YN>J;Eq); zt?OOnam9PWWS8n1Gb7d80ha+`I9_Yj-cSnwAW`x}Dykhi(hmQA(XzR>P3zFHiBg3r zD=Pj>wT!PUsD;&7ITFeWvnuUzWzQTnh!vz1UDGz#2G=GR7wpo{YFt6n{2nM#jNeX3Q64X9ct-;r!J#GYaR$~`{`S7(?m1e0=7h8-UK-2Y z%oQ-3)Lod?eVc-9YxN@b@7R>;{?l>Ic7>YEUb;x#{!d9R7}T5Fm-zPYw^9MOhV_I} zDBJ@L=1^S2nXA@jNW^ls+?vF3%X^tXc!i;hZk|>iHiH_lXddLwMrtA-lI~(Rf7;}1 zS;QHWL9QP^6qwuK6}R>h-io(AAugx8GV6VfnBrfBux=~g+jSI zhBk_>!}i$VLN(W%j$;c{0|tj}C?j~gM?jSsnD_@w&@U1@?X=yu0k)u=Re~C;?Y9-l zq+|nGJrJny8D}VWNB#^%S1`w%+uXv7oU5W}G?q^O0Z34W3>q9baCNVQAXH3eAOYBf z1cwoa+LM-`9Otl?7mTbgVGq%PQj}G`6x@AU#Iz1-C(l9+E-kLsr;&;}5iMXbTzb_F zsNE}ZF(IE1P`Y;bqJf>izyU_>bSMJY}BNSnDG7^o=>}*@~iTYJT6Wj z+X7=g%VZC2`p|#wRQVT8_L61-6V6YLtZ?|O^^dCX{P3?rPijq&A4JjDD#(O2KXloU zf+y<~i@*RfuSU$Gp$%XSrH z_OS(c4`=JH`r-3;NIA)`MVgbcy9DjS>XM_^a9bVY#9}&u6o;QQOQk6(Go-26yB1Jwoa3 zRPFJ+_8&%SFtLzHNEJd2!G3*-7IHIv{J0Uoxp0HVDz#Y8P=kHxP%8Um6q95h2H&l! zA6f-`WKc%k$}v)Mz*gdAPYuKfW1Raa84{6JIzHdy>Q)C9zc?tB7=t z7fThWKQ2Vzmgq--m0*NtsA^@diyEf9A13zU_Qv4TziP}r*NzeJ|LJO9=sctAsoV*|6hPc`yXk~J9Onx zXw;7|uXqc*BL_GS0s8LBMnucf7w?r)APl07i04AbW|#mvo2(@kTxOL}+=BeB=w5%PM)Fz8Ik|F)#SMuBC4k9@48+CE z%~|a_s>LenOU7*Bv%*JrWs{p;-pW1)l)=ln{Cx%a?U|6rFQR@q4n;vM7jPiT&JJ438&HD?C-f z>9@eLK!qjycI;9?nU@zJ@WI2Y(7%8jo7I=C5me`Ax)DkUyE=(vPuwam3gPbHoBB7% zE^sw#b8nz5&bEJ@gA^1hZj6%M2Di49^pCkMv{s_WTRA0>TnGR&X9N0!W35I=pl~!s9yjU?@(qU z{u0fc#d;qQNo(^G@Lnqi+3=d880f%^Tx{pSuunh)hAx*k0CEs7&yF|1!7A1&t6sVK zx+tDFVXx;X%Y%|W0`9_gu)J;OpjmIgvu3m7LcNuRC)m78ZZ4@pK?zu6h0nq098Zwt zwI*zq$}omHhssCfTjCjF!a5 zA1(W)>=XPUy{c2v<$EX)1Kk{s%&=K)XAsyzN>DKwH54R$wC<_c5C{mY!GIS24)WFbyzS}xhSr|QFa7k*3DIUlw^j?_V$m?Ay=xItkSrkb~* ztMsKXFN|5n@5U{3=yt|XP~R^(GF{zHW2D&?+ykY7ad-BEpnmnQumtI^_r4hx+mo-7 zn<0-{5p^q`mx;<;b=MFJk^35efA%t7?xoL2z6VA{OCi?r!u%ELRb<2-YWtvK)2EU79kgX2V*-GChT8hz&+kYsZ z+5W2y1S8A;NAITD5lh^G@brZ82As3+0}#RpA`UgCWx*{V>Y{ecscAGicN1ld4SlST zvz1DJT0uz~6wQSj#PP*&CXwRj8EG0xFiRna*OwNcH?d>aHQV=@{{6|uXTf5Y^7Lqw zv)!Cm6Pd)?1Z(Wit=TXm0d)A_xO=cX5?^zm+5P0^>U$e9Y! zfoMrwE!=^a%2(Db`_!bkD!DgV2Nuig5#`+)MNn{}UL~7obr{yq{ zvp?O{v6`}Y>;Os?W5^t>Nf#rA>c!f%5Ogl4|1GM4TMZ>UCQ0}1G;>*~SI>0@8pKPrZ%6*r8x#*rdgbugki(z*WLs<%&mgE&$Ef z&>ZB5?esWe>A*H<@u!b+NknAs!tT^Lzq?v_rIC}om0UeZi&s9R9P{X=R>2iV9rEb- zZ~7os&T%lUOsgU-P$w&D35JBj4ZT7T%ahQMn{IK|L8GG7pxVxS1%7un?mUlV-TW-A ze%chI3V$npiG?3rMz=izqnZ=Cf{p>qilmlN3Go!$hP1m)j3yyAMofot$6O!aL$0t@ zb;~B~z$1tmLdY7q#gQFpkBvo6OWe@U&+C!?tr=aCYb@(Aun{u6-$@rh0v?3gu6^kcbX8UMQs=TX@X__0>=`eHg|+ ziC|_^_?=y)ul5haBu(wGe3K=hiFc5e?m-O7Y0^KHA0Y|$NF0VK!|;uOjW*zoEM+Tk zkD%2C)@#lAM4QO}iWN@G5uuNgr49ZlPW&n3#X>IbXgx^{RmT3^`q?=a?@n+-%NJT2 za0ep-s|*&$AKr`1#5!0X`~3bmWWg0RpxcI?C@jHjK=;UkXrEx3CPkEU9a@rz1vYUZ zb+C(VEo_By{so`|?I;Wj3|f1O_K|yIx^gQtwe41`lIQf!>XO9mdd1Hm$JmoI4LwPG zXCCX@oH^MDzhm3aVin6?+bTYnPBxb4zf(mM6Cn1xFubn?z;6CoL?plQGel3|%_F4X zH2nt7@z)fG9CA$$WHSKw0{FX@MK?Tu%E5c%}pZmK;hso(3iU4?6zFX>HRHg~(%RKU(m zPJn%s7v;hSNeAH|Y$KO(2{FZ=nrSZ@JJnAo>N|a|wwT=MJYZR^xTZ!YWle@M-Dnha1 zk@B8z6UB7uy+}M^&YFHC?*$mF2Mc;Vh^eg@mZi@v*#k>~!L}!CS+Ceu?Vd`^x^Hrh z3ZXy%*rKBOZL`{XL(K@89fS(0tP=+%7LZd8?X;Yl5bBM|goOnG%)>DTt0sJ2ddVD! zz7I}ipxlU|)Zkg|+S*HmKA8bKAG6;7%rBfhE6kq6t)9ICibDeHZ-t;u)2+Q~Y=aTk z{8#r5tOAF%XjK6xJwn`QX3N)Nd`@D1>B978>ZA7bBqHS_@#KJdDF_t0HzpOGi)m@@ z{hg42Wp2>io&f<*_4yM4-B4-&Z`2s#u_Qcx4y6Nq+tQP#yd@?wGH;&U369w+O#d9M z%MCVBI5mWiq(-@j7N;#fo{Hs^X!kOqcS@r-;X4#NklSITLwbp-fj1XFZIS4+r$v-R ztKNL=Z7(ao|90QFn%9q*t$?m1!eSDos|&rsQBjln6b`7;San*+?S z8XM1c*FV4vY!k1DqPQL%&h%Am6!@-x>+*zv>^jx95?W!(4rtRJOj{`~*Mld*Uf#c; zt^~8yr>u<^;%YY$f%Df9i`GDT1uq^1oERdcxUN40a>;vhgwbXy=^mH0DGN=nYcwva zD%Sa0>#|`ITR=CzTJW3lqwKZg?$5^2*c0EhTG@-(I}B{sk@N@k(q!xb=>4_ZV0E$q z=k@~cfDkceW~Cv`DqxGNw{x}Zp(NXl1UM<>t;s@f>&fq}>4%hR2zqB^`7iDUP@sDR zyj9DmDho~{E*>PUU&y`|h)hOt3LxgapiiB6w}i`xqH9o$9}UAG&7>a5V0YeFFWuK` z3ruQR3Ez7F%uVb0qV0vR6lUfCt0xI2;m-C^b{XD9W~n2sNZP6?g=ix%c0lS_MzOLX3mX<_jWo27kqdCtx>f}YBe zsjWZJZD3RH(cI{Q@zV1~u*ix=2(#6+^8hZjihQ~6LH5Q0_d0JT-ihGl5VK!3<=nW< zRn?7JUvaT#@22mdPCl?=+BqeAP`NO;>@#P0T3!{!Sv+7mASAxpdqS7=i-ep_`>Gy= zeqf^F$;*kG>+g{nF)MYKnBPpmo^bS*V0m0;!~B}?4MQ_(WU`LyFs$oxryycWmZAOZ zy;9q~HzIrXVx_WASBnpruN!Qy13=zz{cHe5owMmVUl`J|vV`|P5ZeEj69iM|Fm6jF z{tQ{^vH@KmT_Rhky4T^qO{oDVyP2$1J($a^yZuX?)`Rn%Z`#Oi>HQ59WF<{&lW7Bj zit5oJ&7f8KU}*KisRS-LF*d3mj9siS>)onL`h-8x40pyBy~J<(d~M*aKi@?6iWHf$ z6oO%Pj{KiA%6Pxq?tiKU|I1M-^Z&{?w`h&WGPV7tQ7GO)g`M>L17HCSfjc-dwBm=R z#B-#)>*;)boGJ*TtX->EnE0X_d|jLDk zGM<+Ye00B*-7YEyA-aJZE2$l^5O$ zs+HU#OmD6B*wg#YiXW}!`xqJuhkWelO~?ehP_j{Jfx|hDE27=Y>x%;Kj)?9dUR{^= z@azs+X&~EVUP@K$-RoDIh}LAZ+U?iRWM7(IoCz`NZw^HvQ&=>C9W_vlfWtO9#_wix z^|fsCiBOO{(L9@uyXWuhBPk=91Fs_w6wA1Xw=yr>$>vIGl)@B7%%`%*dZZYn_wgkS z24jWz z8vklDAYGK!>Xr$QWSl{ZIl^GF4OGuf{SLn@KPYiA$Dz|avm`Ap10w;GkRq=ubB92E zfg_lRu585OGH6u5UdH;%M9HgZPZC@EHjZfsHzx&noTh#TGhlIEs6UB_6s>hSFev(l z%If`j;eFqHlDLpEIyVOGyfeQ^ZPBF%(*x(~pqUswwlO;+wJDTBK{&!JAUa}UV7L}? z48vNnF_P|~(z0R6C6Z@ESq-H=L_v4&mZb$Qb!D&hE$t$3kBW#wKCwk@e&C9SPCEZn z4R?eUlD>4mcB_a=YZqp`T5lS#v96o97zmxSa7mC(6ka;EdrwiswZE57bT8ntztDj} zN`;nF{gEZ`ilqUtn?6weL%+3wzC!k`_>aIb3TkC6pj?SQ!8>^W;=T-2Ev|nNF7iWq=4gKub^2%&qaRK5C(W2tGB+g>VVyKkE$^-Bf(BYA)Bq zCiluaRT4UPq7v=^HVf<M~g!w{Ea___dSF=858*cpyo@@NGQmU^y; zoO3A+-AF8$&m){eq{dWo_+!A+DA-E^L-8r$_Nxdo+9P;liCxMRvQ5EEy_s(Z;>kH<%3yagOh70=^9Hb%`N_I;X3 ztoK~|JI(Q{#ZWxEH7qEfXJ&06rp;3t=2L7Lk3dc49!>P+lkg->r6%jlI6*|*6&;|d zFuyJ_X2}ij0WB`uJ027B7~csm^|8c!I}uY4;y6t3`p9!da^>3KACN$OAf5IcuPbbn zY#xSN!fa!KGX)9~$XBaz*x=Q+IS(bSsu_QMlS*KEt)K5Fsh6iXcvyxc9=*)@J<-Hw)0A3mUktIv1zRJy>#br^G?UzOss`1CbpaJs@)$Se zIJ_kkpVy~3Mk!wpg!IJq?a{dWt-(O#^^eEXoxwH{LFl8Y#2Eq8AgwARt{x`J)fBbg zW}3^P0L}zmQ{Yg#E2e(fq(}^{aoCnU?g4m;r;tK0Z zg6BIs9PwTSL`M4@vW!i38sWFUD66L-IRKbYDVwPrOt-#%z6Di`6Hf?zr}HUc4XWlL z@O(h400Q=rQi*?0JiK^bXI~qt)Ip?=Ikbff6kS%^sp2svOHGzHgq4j~;ieJkjJky5 z^6hWoop8S`lGmfJgq-LU(IPeatmut-(0k=kwO@SE?jr6(*~&i+W%Tz;bAsS2y z3NC#vf{Db2)HT(U^{w&qz(j zBB=7Q0?~`gKPP;WI4^m*)SoG!p`#|dDj|peO%5H|fdb%cTD)qD+t9DdC4ZL$gsscs zM;d4_)kGR&mIcKwq&=p`7SVcwZvK1~o-0XIkBxoSzu8)njaCJEt%hqq^mESRB>wLL}HO37327g7)4L7lmHn|G) zUuu_)V_c8zaBFtH;1rFpdbNS}+I9ucnSoVmff4s?&j_^;M`<8Wo{9Nh`g0hs)0bpw zz@b5^1OE>5yD*6$zm4;3Caw1xH|Ab7p9?3PYz-*m!x zhy}mH!^gC*)Q3<{=~cRx8yh?r_@B@L^C(~=5MA`O@)dioJ-!sY!Y=*1>Q2zf|Cvx> zJgEQh&~CK%2g08=_LvYF4q2qxwA(!`b5MuZwObRz={y7aD5Y)9sX+xjm?m;NJnbrf zZ*?yJ`@V6MQf%>}l--6RFwJrEpOL_-y6M@*TWk!QKQS5{3PRkIHEWFu$RoG4zFE+@ zz=^W~zunSDt{+xYME38cb!-zd3t@J>ydDAL3Vc$gMx->-iJ8&CYCy@gX*W@7V+ z&AdCq64s?x+dq=>M?C9@o9rwdP!DDifb?Jg+JnlWWf( z=OWMco`vt)t?kRoNu8I}UO-2+-+ujRlC5g_5g@l6JwT^hijOI;)8V84nC@-T-cf_d zq+O97PawOZc%WVI8uz=(|7Z;lKG@BOs@67%acx7}z<`mC2 zFE}I)&4F34{2kl?*A=gbNrv`3T#Yl{~hts_0Oeo(fVI5jjCHZ6h=>EeWw3He1vq^m?UaU zS|2|vkyeZni;mTIplZL2m&nws$0{*AJ#3ItfPNn~mRdL%JQ=)wphNhEuJo|~*Thwg zTk;nq^5K6>T#K@s)XB?C&lVpJo@OGE=DVyw>&H;rXkD z${#=V_`le&jsh64IpSg|uG6K`h=9Ki;Sy2bx4H=x&o8zqE_d!v zh1T}TAAH|jSSO|ztiE3}53y&d6vkj8Q$+3sx@OztwtWUBT+k;5}qe4^@62Lzs3VFnl{mEoP3HB%mK5J0f!O3c}a*3{R4p$p6mCy9} z490thpB5f;@^#bZMR9JRsF;~ll@s924tzhkGny^dN(UIr>774{Ft-fIjDS*EoVz+K zP^3Z7Wboceg&30M+}x*4vk?;%HfVXcwyJD#L)#JB0Xs*3-&g~1+Xeg4zHeS12CIXxDQ(5vFm zzc;m@^o|*m^EG)bd1c4XmhTI{Dz+7g7G?|&*%bG)x zQ-za#{VRXfHew0ywmv9$43@W8TCr=QQiDH3RSur@*Sn9VS9R#H0+KL z{Kp|*F4S7Vx0^IPWT@#-0VI|C(3r@vH+jH&w8_{8boQii`&eSiDqZqR~xTj`_k^ z=L6cNBAl~l*7He0HGJL&>GTNT+=@Il&P*Y_j6ft9zM7_Fu8T09(zX~cnu8FUU0uDo zof?>|#2xyfyy+8{@+sp)C#45IXH@n;eMqwxaY>k<(NQHjh>GSm?j9lC?4>CYH2Ngi z*>Lz(KC(D3Rf0x(HGR;f5%-_*yM@24Sh;Y|?Zg_xdM4Iy&P)Ybx z>95nbVANP#?nn>kDTS9lpSYinYm5Ppi9#_3p`0m%SAKDIzR_6vHN~Dlge#rG&?fa7 zptKsN)}3odP>*Z0_KD}lci7wR_Fgl){RS54kc}8vs8qzskO`eWFl?*agoWXMfkfzx zkf_>_+zsAJG1oj84^v>^Kdp8k0ZwVt#oa&iNaH{n|7?l7Hv4ScR13`lLoYw6DkWa} zRxWp}?$f(sUgiJNW+_zB$DqCfs>>q|CZ{dDZEiB_U^0U5ncrp2V%?D+TdkQ90UJIHhMKo%dxOBJEF z?YIVeJN)yf2puA-7Cqdea3WRPjs$*&BRB3KAH}bKZ(yD%WSDSd_RIdX z2J7t_0>z{|-o6+1RSaM24ZAF9owxtT15LqnSTKT8ue-8ZRt&dtssijCwnU3i#MaU*l+ zr?eM31PD;l8c-?=9$He3raP$~Kx5l!E{7lSSTZd!1qX&9x81J32WU&3rL=Vk0bLEp znB)xJ3^|v<`#lg@hBETqK3*j@ceqDb2uz*UEF2oF4{UWA8_h43$)$pOB7uooga@0a z(+PA7&7;P-;h?F}E@@_(lcZ5iHkN{5@bgEM7B<8b+8lDY*Cqr5vsEA0qr$hSZ0EDC zDutfAmKwb76)a&(O^@S8$ep9fzKLeaEdibUUTKD@s(f43SBio4W=u(S@1^Oc)heSl z=LDti^rxgOH3ED&JPx+IP2@nuWO|OM-q6Lt|t@m0+*L6fWuvaeeU&j5&UEl#8aFU5}dcE z_4Se3t!-v&UgJ>J7~X+5kA?lxjyb5Qmd=&Y-}P1ti!cIW^4=302SGA$J3s$@KP>y& zqd8ScM>N%qe~=S6=o#5~3DfPK8X-&Jw$a4J_K?JLwoZRNpit)r@382AOMg@k*cp9j z*>rbgzE#nMs?pdO1Jo_JZ7`KBF5sR8i{VrGYwwk0HpDqUN={sf1q!~_WFIx1F&mmy zw(n%>uyf?a^1X0uy7~@)p}!WJl-&B8&a=j8;wMoh9Z`!@trzux-Ua&K!HE0#wpF=D z-=hafk%WK#)Pk5asHpQC`JLJ#-o)bk9!~W{we@E0YP;@1Yr+}Uq_BFyS=je;$;+H9 zg`Q<2BqAQ$e7clh4B%WVPB zBz${lId}F<81R2yO;z2HSbujP+XNg44$hPnMtl&u-HQ^?8M7qoy-Oi*%A)6^ojAdS`yMYb{GwaFW~I|bwT1nV|0`@M>k zK{H<2Y--Clt3b(p{Pg_GQuU9*qR?zXQNzR%mlY=Hi3-f)qJ=;2pAHk$ z{_qmoF|!R-OQ%EI!hZ1qAHn7czrFdBsCB+G{*$w;^k_i+es!tgR<6Km%&E>QwddZcDP)OQEYI ziNsK2H+x%iU|Rh=&k?BrI&1DbZx5Yam$uCCh_VqhCa}QM*3Dfy0j=51;B4PtbRRHR zi(K@o(+F(brv1RKR+eO~&f|{Btg_t5N#4t2>w2alefL33$nCrJa>n526IyroO_hwY z25+P3U(4xORa=M+$csXX5^(crQ7}_5R*x0ho8@{w+`Ka{Ay=AH{<*GlD}@W7Ir6Ou zy|gD>)vh%};k;lfY(LXWMk8g`+o#*AtdM5Q{8lx@5<8z-g?=XSY{kEFWVByT8(&b7 zly%CjHAZXAsI53_gt{-bYG1%j4vmuDZ0TDqxKL(pvi5<@1+AQy^e^qy@VmA6iEIBb zsM_mwPOrKh|7Bi4!OLOux&3F&$S+QeXMx+N}2R;RaUm}Uo3EKqvhFt(?Z1k{#X!};D_TN}eO3^NjYT~-wf%>B*Gu_-HM zTO4}|d|US@VzxX7pwp%#E24?CwKZrD6-vBEDAq#PQz86=AVRh4n=~QdiMZj~*}Znf zXRP82frj-0PZ`82VreLZTt5KyPjNwQBkO7}*MSHHKV#ZAbT0Q8p}P&+Yz$-a zTj{yvDZ5iEYP|mRGi*fpCG4wT5~`5T$X-$Yz(mdf+Rn)22-Zsmme+nlcBvOt(o!zZ449uk))P=M8LSiz zQaSh)-tVEzs`|4>@Uxh*6%pwl<{6OBVDbP-WVqIV6iJn1J@?u~I^!sX()t~znpK0b z7yd`o-@N<4b&TaADeoH4QR>ow+!38XKGxvk1g3izSHHql)ePx z5qaDyBXI@|$gd<{CP73Y(0YC{+DYEcPAH$`8|oX;TD{{Am_!KoV3P~CQ+m4V3g^_S zYb}2bI)hZZoGKpWmo34ng_lO*0|3@4Q5WZ#b@A+@$Gvo;=e_eRZW0lEFW{vA=}eNRut9 zU%2m$toLyN?{>;_sXxbfV&f(~@Yye!gV0XXI%d0(+<~f4KW?^v%A;YXRoA46a>$ER z1y8^5LUBBoUy#>&>pmTBe&|V)3;al z=EpE{qU(wTXTW=`U6-X&S(*n#i9XsVsSX|dt@3Z_KhY}CoZVC`ZReGmd07(%|68a8 zb3D5NXoPO5dK>;Qp9T$$BX2qLPmibbg2CD0P!UKsh*RpUmyONIrfK|T z8kr|qq(!VuDa#`N1e<5aohTRF@XJImIFpL+TAMFE=JQrIrg0?{zeBiBLp5w4kXQ>_4JBvr5I1ibPvnVmzPTXkf`1FtwXM$3gE{*)on}~X2 z7S^%y_hoQz-r!{qKB$d50Q7wft_bbHBZ#k}~W9Y7K&s`ts z^w@G2nejQ}9mW3RNSsGgZLpz|O#`E<+*f!ljp6xOt$Qz?qi`9`i4M=z1sBe;)WC6V zadPeM;!6#K%9md!1A`GqTm84a#CWYQ-%a=r_-S}vvQh1h$k6NwKI(?B2c&bh2p7Y$Nrw5&kMHBMtahvZ>n~Ggjf91oMc7cCnxD%VFCGT%9b7b!m2P>+;?7MFC`f zl5wCD+p8i=(r?N}ckP@@>kHE2pEMB9W&4i03(poOAvh<6ddibRBZZmEo2c4eOt|)@z1?j*iD>b6vdcNMrk#{0;7lmIsmm{? zPIq`iwhs^rKXz_}wokUF{baOoS00Tb@z|cY;tPiF7Xp34*4Faur29tU$XclN)6Yn&LB*n=l&d| zC@(32qSUh)WcK}cUZyj<#>z}}$M>Gz$GM;H4$t@3+ULW>YQTB6xxL3ezRY zGt)aKWDe@_#ZP39pFv?eN&uwX@DXv5x%NY`bw`qyh*|*C6TlR|A5^Ye$N!oIxfGpl zLU@#T)MsRN{5gnG97!Vihv>qsCA+_6>`gL(flf`(_m-9a3AE5pmA>(QNDFgsJ4Rz$ zvrFf9E)6NqsRm0HmSmi!C6i&N^Lg0l&=hgltOaGp&4YEq^QApXs|N~}z-LN-rsB2* z97WiDRS*4D-PjmV2QvfvFqoBxQrGEtFUQt`T1GS~>mZr^R|p4{ln=492A=MZ;r@Xd z-|(wWyg@1ltLFDz^R#rxr+2JpcJ9)~p4Is=L5Z*AFVi}k!EHPho5hbi7!(b#qKyOoQBaUj?CCwU!%5qzzqM2P4N-2m;U1yvdLj-7 zal)sDD-pbw2wU)EFPR(x@83k#)$`P2lrKqa_E8Cip^HHp^%s^jy485AxI$hlRb#k> z%>A?(=)p-F*ervazo3M4Sk;*A}K29ytDhXzU*lsc8SI zvaqvA4cx(D*rf}&W`Ojwj?3}|+|9*elWa6&NxbWiv07*g>KJXp#5htttJ77`lWS(-JYsNr+A@m`bd#g0u`JZ6MhW+s*RY%l#X3!9yN4P=6 z54kJ|81uJWTp_+$IP)f4cFvsGXK6BbuZU2K36GlR(4!x!Hsp+eX*1ua>NUYB1KUVv zh5)CS0qpZoOastpd~#o4VM-?zRMgQ$D{0#licEyi$Daxz8E?d=trcqtI_W*nAB{hp zE}QT<`vH8hw@)ZWhrV;|V?nhGYuHpR+n3KcqKdSdQBD;ZBxY0KKAMEt38Y#EZ`7mi zU9CTW!*G8qZp$7~VbX$Rv+A)z@A5vB73^E?YojNTNu-IDqup^J-p*3XoIW{D-G{l? zeV>pDgq=TY7fbS3+FOkH%rTi!uxK19v%DBCMtpF(DYhxjTg#r*R<%>--8QO;1-g8RA|>y!hCXD?x3kebJCX2>yK=T zAP8FxwU2g#Ugwm%!*X_w1zkro-&ogQ{$VE)k?d=Z(T;tR%rQI?;jlQWC|!>TGUOBT z`2-0irN>kL?snaL&C;7_U~<}?^PS)e!=W$qHOn=bai+*4zXa>_bY~viK&nA{ z0<}BplwEb8PLGLe<;3g5JQQXA)^u9RYENSIwk}&ALmQ{*r3F5w!oalpqmIl_9?GIu zNv=mw4>0$#o~4_ZyDJKjhu_PyE>AjTuj})0c&YN1-Rv9iG|}RmQFY{vu3;9u*O|~1 zuPn6ueOLpPE#FQ~o{#{Kjh%0@>|Qv2K*dyCiNR5}0NIk$m$N6^+Lco5o1;ThBXxL^ z*(2_^fKuDP+-wDD@Ovz!^(`f!d$WHPK9Y!m`Hdr$ad+NWk4pFB0_b<{16xYaRxewWvoK8O6n&obTReLChfyt;sE;+_za8l41~!s zVxt*&iwXZ2hwV-oXmq-S){V)C_-Ylc*T&`P;PEck9+fG-k4Jx9ur}LahEA z9QbVgyM|WwT__hjB7u~W%5r!2Vy#BV=Nhx4o@wWu8ZcO}CsQ#KBNW1puDm_A50}M& zHtdx7J#fef2xFe4jr>vC(XA72O&q$Hb9#dvEJKul`=&AWqg<#HnNEIHi;& zCa8*L$d1`;hTLc_^N#6OFNaqG(fFa|^{>zG5sbvbmvL7ZMHiV>Efp|s=-h~zVDUWc z928WX80DQ#)Yb5p9U_DqM_SU!`loca2TM_Y4!W14w-sK+a4srE5cW` z$3axvw8yz3WcYags$nNnR8!?&e8ry;wUP-3 zqXQIz;IY>)2I2}%7-}}s4GJ>tcORK%1Eo9{_FE=QvojyyIqr3AzK@p7hffzOsgf1j z+`4!06%XfQsgt$MOMZx)=xJi?z%*@)6z-ltX%nn zcHgCK>_NwO)4Kf%I1)Ke?Te~AO4f~}DEtRrsW1+En4hHR;VeV*bg_Tf&aLyEQaHE^ zxoB)=Q8Ra>`)D2JvA3oo&a&(C;>s>jfv-9;h6ZE-RW6RHIgWAa!P5F|F#hlp>zi-) zjoyiZzw4@+TE{Qb6t6S;i?X79lGyj#g=uFnW>SV`efTy==IEsvhvUWGQ7XEq znNjqEeKx!kIPchmVq$`L%r}zGuEg%hHhlY!D`0DLvTF?VyYA{qA8DoJtZ3y<-8~ul zEjvZbSMTZSaJrMbu+Cs%en|;qS_ojP&P`?X^Y9aSoDv?^yYTsgGvVV>(nPiVTT9L$a&*F8a8 zB&&`RtvR}>rXZi7Es<`uO&fLlUe@HRn-ZgxHrm)B(` z!#5&>2qQySr1_4w)%+zyzOZzALFeO#UbgXdl=GWC#T#jX3HgkXe=e8xTNl+HtPl?w+b0=tEj1`i#kIE| zynBB8b_v&?N;bDTk7*XB3BgTH!nnA!)|que^ORYBzrPkuA80cvHeg)l;T!Ihva;W9 zVRSF?1LK~Cqh#{Zg^-Z>Kljoj|FM@A)L^W@kBd%jP(@~Tx;aKCRf3$-XJaB(;N7Fw zrgp)mpIb+3lOdbcmoH8p&)f@#fk(ql%II{6MT3JBsHAX3XKJ-v)O$6~rSa(((*Q#P z!@VgBq{&d-LCGWTYJ@cfr5BhsWR`T521DtY5Jm~w5F(E_Tv9C<-?)%FMg6a z8QRu24MbMRC0jBaU>Zx%zOen_dN~ejMLg(_F~p$;5xYcLkq1{hjvqFMfhh7T`KzRD z|3f)@N58C96SQqZ=b=>;T-}_rv3E-hd|U8>ftVF(o{4>DI6r$U?l}j zBE5LY%$ zBG^}jJ~o5{Zs|lcfeJA6;iidyLu|r5&(dbfG=m%9(S4OGoR7()Ho!E_ve`ZJ(Opmr zKA67Rg}|MJ;eNiAW%y%3tCxDlG#Dyb>U&0*c<;{#Q_tlnR?0sgFEOV{*w-(X?n;&p zx9U#l?ga873JMlzwaWz@nSP@iw`mbTgZ=sV15d5ZE$fP*lsS7aw$3TUWEhnHm05U2D`CNB6cWCNdF12>6+VOE>MB*yLFYfP+U~z zAly?;@`kgdgLU6s(gda4WY<=jzT`m(_?^)r+_8*kC}hY31m_uO_{%2brro=Lhc4Ci zVJDJ+(4FJ<^p=@$IKIz=pHb;fgZ3oL{%ar~n65$DH)DDnbkGWa>N}g!oRhY^Z<~>7 z9dIF5X|%MR%TTMGEQA}pnVg-i53Z9N@&mOSpC;k%(UzxKdvR)n#u9W^+DWh$v48x+ zVE<(sG!o4Al*GpH1Vk#$izHzgYVmB(A5fP;0j{N)ZCNHa7}|EW`7n{2 z|7_p4Hc~bU@H)URPcVUf)7%fmFjGyjfIW2rbr}~RACk^c^jeGAyLRiJwnuXfWUN{C zi(3uxxV9Kh12OJJc%y_^M-fguA^f*CNlgV*6m1_B@)RF!n0PT1p14rVAfeB!$8+^> zJu_{wrT5xwXV|ukBUNn~0I#Nj{pqm9K z1GG~Sr1a#yTR1rUXyvMt6=x+Vc;zJF1Upd2p*D@JpL_~J-f_cV&#ieEXe}Rc1=j(I zv6OPQ6zO8=G_bwvwCwPXH;F)Wp~iNLu-;%hf_ZPx#0_~djkM6xGJd65D4!umo2v$n zxVgb+)n}mk*U}O`C1^g+@dO*Ap8~PB;gm|mD_4z|m9lddSYT*0MJV^3nKU#i$2w}i z%U3W+1`MJ1dNH)EPT>b<|NO_+-?xQ515k?3$e(TnsUg`9sST8%zf86bNoGk7W8znX zqtZAE->($ATW*Gy?+JfFZS_ow?N(zuXqpIle2R?27#~uhn!gE|SGrbUCXHG(5>StTIbVo@?y#2&F>kupfjLz8}WCa z+Gcke@F|57B(9CT@~&cGIt5!Xpy0_nPkCf%_w5=wjmvu{twLBq&X$g(weGXAZs2`p zlg1qfaN$*+WnPu{;B&JQUjon+!MyTOA;T52@Nd?0-eI-Ss^D>!&s%#x(`mfQ-u%V^ zEDF6(<|r{msZ^88rQVll12LQ&a^mynd*Ua{rp*yc?KW&BB18vxfGDd+T2>skOL(hu zi&v5=S7Ctv@`*VlAB5_O|5|eBNjwH)7p&H2WPpsPG|LP6+B?&Pax80kqrq{w`{`D4 z8{F7^q7EJSFHAdjOO-~a3o`kEc}gw#2{$L|F_7*t@c0F|Cn0*z7`b!P);ZJCwY74v z=vezB&{9w^ zb8<;#i+JL#Dr>$j6L)(NnMlwt){+a@04cX@*9me$EDp646tiY^FscPo1hz-PT;75f zCSx))@dxJ%V~dKV3Eaxho=Tf0@)%=dX0OgiuyU;`J<}HVa=Yk@qM&yXpNfVC^^ekw z^H&lWZAl(#2OpxH*1_b77HOf2Unp3iMdSBqJRpcz7%+HF3DYXzx`wYvpy)T z8>m%ALPJu&pRpFw7Q0%=gtTNAvkQ~&i`C3Pk+SiN{>YAYUM8ooLC1eWab;C|2o-(V zZY`+6(v11nHr_XWCe4p8_aa)-)V*Vx+m|#mB`=4onVoB9mrj?)TJ7mtcri#}iv2|L z?K4Cs5;Lz8MzpFT;0KC-xp|{RKT5}`X3?C07-N$5 zEH5)r+mR5?1M^_zTnyrVw+LR3Er3O)Cv$0g?^ZQbzx{k%ZP#2h(0^~|a)VvTzOny% zS^uRz6;lz_2J5E+>gOHa=gon%<=_HeW}53)^{S&98qDW;hO#-d)-$eJKaba9_dzE5 zv3b0nN`71p;9$=##w$tYjP_AZ#nH$x*sgCl&O9tl$Yc+c7#=1BXI z1)Tsrm^;xIbNb-em6y;6J3wnk%HI|)5e{s@(}(QM_2=1^RnL6eBi92V+f={qPnWs* zAYHWo5Chg|NVy9iS`3%mo@_kcx@K)BHaG9_RPv&ttjnem0m<^Wb zFOoHct+Sz2Mq!rHXF4qMmH(iW6aYQcq|iVj7L@CLnhlZz)2)E9Ek4n@QaPd+&uh1z z=bB+dqeavD@~03%-L1_^kwmrUgh?VJ6cKok#8ruF%qP;XgfhPBtqA5_z@UV2#wmeM zAh*uQt@U^+bYiEQjagwDL1(>HPlE$7dE=>Kw!D#;WQmKjNoP(nh9m9+XYEFjE``A9 z0G>=&my~}?5US0>i4Px%D=iX`=G>j*Xi!^5Yb77;(UvI!sr8&SZ|jj>+{wgdg|-*^ z+@K2P@C0#Ych;=y6R`&akqNY!L7nr?2T%po*Hy+ZF=+1Ak@lEBdXnEg#AV&0iz=b1q1|bG7!Casl z?%Nj#lojIV6pGt4t2)h_p+E=)`~&dbUOk7-0s@hKQ|68ST3rnIShci&PUKJnpX7n2 z;|o(#XTssGc_E9mMDt{M3?Y{gL*IT!)*10dnR+^afsK}RzYrClG{a%Wf$OVIdH%V`(>3Yo zTaIgt{p2A_-TA{6_j>Q2HZG~aT|(++l%1?N+xr)P#amUv}10S6nnYZdJ`6{*($y%>`*eyJ4kiA%touM6dX4%meiG7lVzZgoxi zeakl|@@Y#-QgvWjUw;5-(!$C2|QoR0=2ZhrSJboPUkJ4E$9 zc<1yy8Y)Th?2Uh^`lvej-BrzX%;G5~b&v8C$?YVnjsWdl(_WB!Cd^DCsUwBDJjD$& zAl!6#tU@2s_PGinzmv}9?9S6jU7XH$71^y~(}^7Qi+Rc(WS_BO5&=QckoeU>C9X)8 z3|87Gh#kI+!jO6MEVLQ9*CL_yxE~)Q8;xMIhA@NaG1>|&Zoc$|e7rUmTQ6={rm~6h zLKpgx5wD|yQ&O6sOg;YZ2j83^jnJSt^dbT{dEv6QtyTvLn4nzX&gbcZn9mcVu{#4r zOnqUU#Klu_vO&CAIfdSgPZ(6@Duhh3O75`!ah*$IGG?G~!J^ThO&6*3$z2w^jFW+x*pf4bp9r*{un~dbXd%V? z@Mxp+kfdI{^U}|5`f~gO^D?@PUkBo|bft#1bOm-k(|vZe^MXhhaxV@?e4Q>Wt*woBg;?Y{_>m5?_xj*oW8I%k{?3 z@0tjo8A)+|%g>vIUo##=g_al}`8ELGi_^j)T`cNnh+`qG_dn^tjr}9?A~i&^eOO3< zrhuIH5wUV)b6vFE>zKX&;R^skpM4YztzMvpI-R*P;GT~gD-HTF+ZvHCljL_8Id0Y> ztMg_55dFuHOXgQg;7xMX;feM^o(&19+EoXg<_Z)}x;Fw4+zQwl3%KA-QF~9jjjTck zKsu=1SKXixS#!Dzc)V$2>uTN9Gbb3Rh*)V;)hx5k9ArlEb}7m>7s_QYF7njX!9{<$ zIdT@At6|ipVYs!@3|u%H+1X^CWHiG7eRdFzRtDP7P)h8BD5soLclA1qbhgO-&QcQ} z4nloq<5bsmE}-l46GGrGZ==;>J>V4r?12*@G6V5;zezZO&m&6XM~a(t-NU~?Gi!7FTE zPw}e;U}{Bx?ftTQSP-~4N@PsdI&PZ2ryx2o^i+{GO=*zWKgod5Y8RvB5~ zp_@{<SXB@GE)-Yuj+bjF75+Naw7u0zcpb|7~-HPyrS=}VWT!HX*8*Aiga zX1@5F{-9djq6QOAxorj;p6y*Dw6}6u6Khg!hM-^F7~`_Lw&&g2#hAmBVRKb;#W78> zcFB^LND_X=3XGfi^0Uz=*;3|ok|(piryF^e)O z-}wC9PJafQz8wK>N!DSqjaYdXzKh4?1y&PKrf+TI_LBQw3 zWcW)B>s?PTE9($$UISa{cCOEkG4wyJb~wv;^Z)-`$C7g-si&mSR zno&d%^v6d3AX=D4FlY9wEp#1H3Rm{*p~;dSy+1{yXDg^# z&R>v!&1HX)vKB8qGrSJVy#i~d9_9FD{XQc315_m`I6l>7&2Gof-G3AkrY*$2^LICf z+ShUERdu8}vXXyS0a5o0Pa0FNM z<0q`oRW&67B@P~Kf-4(@0hck4RAy74zVgcY?`+IkeEXzQ$LA<=u%!X71ZveCd`Yg^ zk$6%Sxe)ufFr9RID&a9xKTa(j#`%^MW~t~*wW~H1SS7E7u9Tzq5)D_cLYlGSdDq9H0y|Lh7JwX;mq}uTT5xG{$noB?${K})I`BOwo+?)2jMk99yt5u)fGEtqB4y3Q%LFbg$! z5615NBLT0zVLk-tkuE9`u*s@^M!`=epQ?nygfKf$Z9Nnlc&rw5qr1Q72*?_q46?mC zVFQHi{Uj5UlRVB&52N1+E=O;+OKx8{xdqJ5ylfdcC1|1xWo>TD3SZhAhLd*;c!o*C7`G%~ znntYE$5-d|xRrQE7lRI+(lIT^IIsUIfne#9z@qnGJ`~;Yi026#@oCZ2Rv#I_jH+x$ zvObipI2T^0`YA*tU#yxct7u)BC*GNe5y1M@w$2LrfW*;7^vz@%RROcpI&s=uI?;l* z9GrgqpZrm#ld#~W7F%9|t^|*kTjt2i%k|gr(V39~|H~yF>;NFONxHo(H1QphtZJGy zf6DY5z}GbGey)12$Hcg?XOBnwG{kBQj{?Iv#AC7nhnbzz%Qbwrdjl1^?e8I(xsrLK z4rSo47JOX=fj8DL%`MeYvjXq-uU?z6b^ClK+yN?IZWjEG5)KrSZkoae^c|Lc9QkJ?-UmaKQ!IMLq}w+4C?kz_~CeTI3b$I?09{+ExDg_ zo0Yl%B zt5yY)Q{g~?z>h9X;KeVQ4?Lk%7u7b4H<3=qBbt3y?tPaU<8DvFXh}V6l8(3*YxgYK zLmuUxl(6ne*<5AkJ5<;4sp{opr+O-8EBerYvx#P^cmyE$h8H@JMeeRhp{-;!B-=rNX>wMv_N%E&7F^`RNu-7*9c*v zVJ!JRau0X&2DGVtZ4oLeqRrNryQlT+i4n+dR~p=xoKftiV}IE=;}46)D@FRpsrKiB(1(pyGez zAr_EvJmH+xH}%tQ=J#?+IR=v{;q|sa-eJK_VWMX6U|CpQV~Y`RnlcnGn-Es7dZ`kJ zR^Aeof6c2IV0RD7pGF(97cr`DZdm2pHmH;OWH$ zYK_>Hs^0-Si=Kl@mZ$OSr1>`FPc%GZl1AH?T^Qol1vnxSaJOELdz&n3ti7D9woQ># z*$Am8=aKu`b)@y-Rd;Vg)+LHU$ESyt-*VcF{JB}Up@fM-BIuUbw1qoXu)0ou*wJ*e zKdp4jxC+?d&~x({le)k(DshFn{3V2P4lR#iqBpG%}f$Lb7tG|9-F@20YN{B_`c=-+b*$OOBM9#hrB{MY?_+)Trq~& z*9Qj#>IwQKOjGWNT~~5M&C@lD;y)>ulq6CXIb-H_+XdVfeWKkx6J9^={hx1E(_6;d z&rpREX~yOUTS4&AMy32E^T9|&EQMy9mgXh&d7kC3B7v)fe_x&)VpcaZ;+cUNkq*swdiKSRD|DVy5u&>k&&-*^<;4 z3w7Z!I*O&HQHuosA7kg(BMP)_*|Kfhwr$(CdCELx+qP}nwr$(4J~y3CUMKg%`x85R z&5SvR4Cij$gngz5QyhoXD&mq-1q|KF!H!E_0#lD|gCBrvhZb=?w`7WSweESG#iuoT znlnU`$u)w5Bxb6#JxnE1nY!4`#$;|5vHP`kq9lWiTXVCn&S;~S&x}Zl`7jFs`IT27 zVeMOaUNq1l|DE#Sgc5j@XBF^9K1`V8KnsW~C--$I)vUuz(T8jc+>5c?qUEcRMa(*< zT69|_R$8y<3wBd{&IB08#8mw7(4gW;;L#vPt@o=ZJWt^*u;MMOE;slztB|x#2E1;j zo^D(|U*^IHV?=^z+Y?Qs!_3(Jcreta4gFbI!=RdS45B!4Zl&W53=>{7YD|sj@liV%c(-xowHzh;eJYGux6x<|V|RMa_ANHSB0fDtC8# z7O|Y_Ho>uFI@%EYyYdr06)aC@>Jitg+ChUQg%$ME0jyFt>3YM``$n_eCUv}C-wA#& zSy9&uoQoH0C?6j|fHiW`uN~;tGhnj9Dp&62*pus0S>DhZA0iiuCXMY=v#T7v>sjI2 znek4{9#ql9rfle4x&1DaQ+)7U1XPeWlDCQEU*WswTM&I;PCYViPlhWpp3URIvg>9q zb}Mxm{2u^Gn+5ZhSLoIL^1Z!7r?}T!>=g@Y6LU6_$i6KGWV~J@B6Y|QCa}R z!-H|Vw*b_z!>S-M^DO;(EWKaX31&5Ou6Go^JlPzGSU;wII5E4JwGe3j(-+gpscNVBRx zf~H4TozdKdg!t_FBEgQb_#(tnKz%;r8mB`6MzOFvsB_kVvFTdjVXcItzin5Fz~`iP zj&n4hWIML%s~(7Zdry%=deLoYQ%`06H?RV&E<>#{S)k12d}P%&n_{clu~=7o=X5l7 zq^C_2NwO!b!V-sVIn#8j-I7D&q0g@9dq1SpsuT&ci{cIcaK(XDh7O5E=d4)_$V|GR z=^KP*+6bq-dW69jPO(6vs;4DpWo-B;;>}A@X5?k^+pQQ$m3AWDg5y;eT|ls zLcwNTx9kf8iDg^pg$;&*BE<(pKV@H`iUMvMTIjnM+mWiEP0_k+DKZMhM>A zN4)L}@RY>J<{KYC;J8qVotoc>5SZf=gs*3YBF-bY%W5tbih3qgwqshJ$P zYNi^24r6MZ%tPk(*=PUf?@ZNt1Ez3PmP8O9Ocj*z^|gPa>PQ~ByVt3L8ns2|B83eS zqprnib3__ho=uE$fB}Z0lPt4z)>Wa*5G^C3$B3lel4@B4f<iwC z!?)OU!S2J6vn)foryyG7s40-0l@sqDxvkdkmltiRfKSa{fpoh>Ib&ifKz~%dp7HSw zaiy*#ubd{lPAR!hJu3>0yEOAF*KT7{Em?G3%5zhKGb!6y&}0+Cas>RA1R^|n&$lVc zVS3Vtw90nCa`3A2Z77AP5$kOfzqw5s@9aQtfDv!!6Sv@SD5KZK%p^gsb*O%sR%dz) zf1);b@gzm`Q_}aUzH#av{T*LoVR$?}q9kSF;R63dA6vi43Ue+1nOL0{=@Z)@E%gfm z&`1V!j`?MTdzb-jPBp}B6gNQ>6IuX@brK3L3rfBCB%5UKUr)|G8)rFzB_6Of9J6c_ zBBzw=kT8u2f(4vM(o=Y+xsd|5pKhDZt#o=P);M9Z@Gfb50plo|f~AOpmH5XhsCc?qeE?yH=9Bq``qUx@Q5Pwypsl zWoV$eusIGX-lDn|#87tXlw&ak=xkzlK>*seYc>xOIcyZkn*q~v`vjK?oP)lrj zEMxzdAOJR96H)Fn&L-TB=&wf zBYe6~X^&-oI4dbF@(E|Q*b$4r2+oBa#D-oqu~7e5n4%h%J@jCuBBC9sEcn!%n<>ac zrBAVho7tzbmZ0wHFJ3TMsK4KHSkWLvAj;6f6bge=VBpqyAfK^LR7r$nqmC30(RhGb zmQ>x9>=W2Q8oR=V+{U`{yUt3Y2QWh@Svf|;G}cra6~FR>5PJx$7<_c{j*P_6vjlxC zDG3c?V1}lb3R+t;R0&&b2+~l_$AD3?GOI=MhZN-R(?NY0n_ zi9^nq=*4rEhsh;^DP3Fm7$wwYAbX_^&=?_9{|h*Q+{B7=v<(Akv$TrJ zmhGGfrbMJizp>*3>?oM4zkyTXlo7`m95&{9tM&(COE{X3Y1%thH$RP7&|9C7N~elo0ka;lR`i7d~XBgtLJ$M zKxgiX|3=j7f@~esMvV{V>Haw&q1dgc;iK%dx~fU*{e05A9iy=nL1q{pQJmJ|n+!eT zWAxYw>%4;JKNlW@vC+tf5xyk*YbzEYG6&w&%p}Ff#rODPp1O>opWGtM8rxAN*lD=+ z;*l_PQs@+{h9h=C6+sh9lB$JxmJPt$8*uO26~JIRAnzHu8?^vvmfh%xdSw+`ZZ3x2 zu2*H-GlE*1Q3POVuJJ4Gz&7B;{&b~ixI0SUZ9GO?EzIO_`g7P(w9@}e6(vnEgwv+O zcwfU=Qj88GG9LSj!Ay7rL6Cte&s zV`dF1IfX1!&%-mrKFQ<~vZ0R=Yy~>n^s`I*0d*FB{ih?jff$#KQ=5@7Td^1LEWF^7 zH*&p|>@ar=Kba54m>IQlfa|gW`QQ&#hNC1d5*Lnwoc^F%6jN%h&d5-OnoJr}PMpcA zd}P?@B5pOsXoW-qbF8Z1oVB?bC%5hn{}-^Ze_t1Pf(9I0N#Eqhz^F%z6c{na=b`ah ziYi`9kHlmRbPW8^a#@+cxD<2xE6K_WmBXKhQF`yx1!>wTQs^mAvj4J3Gfk*4I|odh zxKTujeXD()1oVlq_A(eX99r%ZL4d3rdJte<+xsH3H)TaNjTU-o6x-Nk(@hhNTU-zY zcCbnA|KYvfIUZ{jmd7wAA3b_r9=Hn7LN`iQk-g}?g^?)QJ_7GQ!BkXu>F(~&lP)MQ z7B9rmsf>n>v*mOtmppXw_frLWQPqT>sMaLy3Gs2+X2rlMq8S-FT)2S2xXa;(hv6x7 z8#X7M!Sbf;a#OFPd{4*X?C=VQEreYHp0VL*D2o{aDFJZ8ETV;#?(mTHhDa$qt6`(& zU;#bq_ymvn;)NLWxSfmMy*XLzXn=m=vU>D=<$&=J0;ERoMw1%pyo~tvr!D^j6vdu` zCr{);LmR1|V5&yg(CPCmHCJ|LcXU*=|GrVB5a?YUcaDJm1jlgxdf)eCec5Lqa^cfTIt{s&1Zg^4C(FEuJ#024I$T@R80#u|8_03=X)iPYh8 zqR~Dt9j=#%{*iFM4*I$42= z<>}a4R$acnD|q&BO_JleA%j~kHhDu;8B94t2S&g`+aLuN`iZ;ZVoeIyV{MjIurHGD|g*1I&O2d+a6E+j*;MNeQs|!)9 zpB)7?7AFTsQa6=X_ad+QiveHx#l`-!J!6cIcK780n2s0w_~cMSdz~Cy9w=b5o}Fs@ zh8^T2O((bAgMmp0u>(llNdmiGYt5I-8jln@9Z$&Y4~)T+!Xsn=X|o6;1lQb zGr3oHBlAH_=MrIi4SA1-o}I%PY<+@a1taCq!a&}?^##J1vMZ4>?R)!nF}o{1ch0fv z^^)5}e`#w@4FY6QE~MNODxrE|-#W#M4QTUJZSV2s3z{KD7`IOzIj51Q^mJnp4d{0x z5wN?-`xrjyfM7h9cpN+#^z_%Cw-Hsh=vb!{m8eT#UQ4jVflpMB;6F;jak{%$Qhc!m zD;H@tAhiEt7i6;dT5g!{pB?o_8snBUS;J%B;G{X1(pFUj1UHwlKUAKmfhBOeOqHzo5SVQkfVB;IDq^AE(ZI8)h;w(DDTcVeI}@3C zt8wb5Rr_3+J+lDa)c-xmlS)Nxe#=s5_UtdCu&wJa8R3y2`$7J#49W(!eIZoBaS8(~ z58jRV?Oh}=KVr!(54w+WAeL+@5;SB*04h9$C&!jl1dt{u!u)cH&S#jMb*Iw&7@v4_ zH@R-jB@1G7>^zexxyc+m&&u0a(YIYwA@5W@I)RD9&a>}*a{A{eK6g@4fVq3q_YO5g1YAdM z!Npo0%ik$+bNADW;{c<*Pje)4XQHz`EcW>w(FmE1K$7aJ-|l$p3gzVen|>dIzex^L zPlty@|NfvgXGP1hDow?6X!jB%6p1}0;P?qy34^AQaFrkVd0&+TGvQZB<^AkA_CHpa ze-cg3>@2VUc7gw|_%aq|2B!acfj8@n#}Kz8c7IYo0Z$k@kQ1C4^cnZH`hS|eCp{=#Fi+5o}a@1GZ0@TUTa7?KO-(yleQUiF>rB^1PiSxIjeqo7tPGG1rghKqaA~o7zkKX+KkTvRJhhTc zyi;=!LR>@S3iB=lGW|x1NTQjyo{~K3vgga;-RZJ)pr$pXI~fQ;=Ev778y@YP{7nO` zr-;>S0e$N-9e_nzk7m9RvY>s~^(QrsR9eKbK9VIr>n^*b+f@iQaS;A$w1AX@A1fv1 zUC8|KK@!5!0;qMsh5)jT zNJJEQ-tfVZAGw2kK}^WNUZ2r4dC9`~vF;QByofAOPPofnhk2Nv>@q=M@TuGObtHI52mAXC`E4T5QQ1nEE;) zag$LFrg^b~E4l8vlGn0|FL|6)qS}>1GoqbBOFpXd#?~!r8cBNKlc1F-<{Zv3qBYA`A+>pu#Co65j}IGG^`x)6}x2TS|3<72<~2mI=32|UtQ*wyw@_q@5vqDvbdXNxqkFShVkY=cKZ84i}n zAKVj%R#Yojj1Xs`bqeQ9ti)~(KkI^h21BFf4kMOH1yA^_jjy+6@7qJ zUI>7g9w{P761ti{@0$f?U|h3;5)rh!pqXS(MT38h!IXvo27j6gAMgL<%By@L`4oD~ zKvL4j2X(SKF@PEPtP>66AjJeUY61CLv8kpwDGMZc+Em<4sF!xb`P{x{90(da*~ znD1pv#haY}x?&XFH5gCLP(63niflGxvaew9kty*at9&Y3Vxztw|YF4KvU^MSufZFd*)b(%B1Y zKHy89C0UJTyN{WLtBCN-S2O(jW{`83;h4?O9Yf4G_1ut@f)^d|$5Xb0SQbw988VP@ zQc`m`j0#OmB_AgogiB&ti^`-Jv?XWYR+sYv z=QXQXV9bZMA!SbcnS>jjsZD}A2e++GV6MACj{?khmU;K}(!?b1#{&}3&jv~gjDnO_ zx`~65h9#1otE;qbilBx0iH3fCyUpg&8Wxxwm6k=c7J^1YTRHm}wds``Z)S^M7ZY!2 z8j&wbvmce6*8|wac;f^=d4+y7r;c_Rj{2`hC^g)3KcG{kd@XtfXAI=B4(QN)A5kqU0xss~VtwOP(iXmrT1ASQuixt~FSqcsP2u`XF3M&X#I-0w; z5eyxa34YW_$EOWC(`Ol+R$c9q)6{(2OXJEA8IY@PJnXg}~U zDAdF3QWBsYz?f?QbgRh#cxl|j6&#`jtU2kT&F7bV4GS9AuFe#oSrBZWA0pLc^*+X~ z!XMBWiTL0_n*>cuQmr+fT%x7*rc@4~-AAf5Lq90(uq$tC``L1kK%U&Ju{K#aqryKG zROu5Kpy_Sbz`B%o;^PW)0iwy^dSJ+iCk7ol_Y^kGZoeA?6E~avc!>?T%*$;NmN#MJ zJpMAgH*9K&U_ADKQcM-mtS+G$QvMb6ILAh5l`J=yyQa~2?sA;@L_1^YcA!w0)zR}N z`k>s!$y_bnOi!jpO}zin3|ae_V8_PsW{Y#Q6_oNvl~5f1JhI8&k(lGL`dFC9At2iA zKr}mNJ=*FhZgRDK!7JiD+{=BjAV6icX*L9YgP+f`B} zN=?VA2ek{EQu%?37h{~t^}r|J<`ouvPuLep1YCXBcHFsg$x~Ugh;?d7lsvDSK4o*U zWvIEjhJ_1_rs5z->?QZS^Lz*#Kuf~!&1i#++ogkVX&Yu!>EKy>Nh$zyVfV{hkykqOoma!|%- zOQCN237&uRCzhw1@#`}hL`{V0kCX^0F_w3Yim zl+s|y#X(q?)tg(;lSe>HdSh{BX7AexJ~P9$*)~W+^PefC*SgUwTB1$ayBz3xm;4WB zW;HG9Lm~en6ES5aPFBE}wS{f8O&b((V>|PTai>qcds}1i&TuwY?x4KnEfJ%1#G@*d zmIcertTtKAXY5pE(IAP(`D>LGCkDh=ds>X+94){^p8;|;0POx^Q12GNE=+#(z?N?Sz8V2iZZ)%1}VqPT%t9et-&n${0s`ITsbPmkGB4`7&1Ow1B zZ#gktkSAUcN_neKV#U3F41f6hfeRPC`ZGnAdA=$;E75t2ZVXQ+C$N@?sy;+CJ!Y$_ zno-=Q0c0JeH+NAvtk$=uDH;k&)=$A(r_OnsLjuqK{eeXK1OG5f)JYZ>(%8Fm0$^`` zatar1%5}a*F0hKMceb7PPNk9{SBk!_bR6uQL~>DH(8ztZzO(2-P1GQEwkkl&NW-d? zM_%3lB;6d^<}t1F?hnt8B9GU9b(KdbJjAaDFYSt)7qM#f*;%yewAD`lv23) zzNayi|2e*ltf48CWA3^0e4S4I0cTbwC)=W?H`$~mKS39fk-Y8sYi+Y@N|U}1UdpJK zJL+8WFoh#C7Mwj`X16_#foUlgTsbXV3CVSQI< zC761ETdQ}yqn%N-(h~C~ogQ_8+S*$|*!z9*lu2r9U*cT77|E0yl-iNgZM0i2Alo#? z1{PHIGiUI=FY_{R;A}7;3xK~3Uf-?$xHl1}-Q?X0P@1nW*gZ!`{+_7#SpSmMul0(|}I7oAm>*wmLGt^%GxPm}nH9+4nP}{%!SB+A}h{ z`}4pr*ZqO_-$If96&%gN%=rId3Bx*_HUC19>2K5zz~*;ffB+!i7C>`oc{7f=ZY$1v zFzokN*@lWSqDong|U#n;;Nz}}MI-;J)H z^U?FzzxCvlDHH`f-|ks63v^m!3zfYSUwXd! zwm%$6{IgP(PjVoHKAr?8{z%{_f{gGoztM3_N2@$Sr-*Fbo%^M)9U@!Wf*B9lo=vxl zTMzTdE~BmRgv*B?v-p3xF;S89oeuzPdTL`4}<*&O8Cb}r?SsT&@-he6WN9{_Te2JdKFbfMS5o? zNjulzQxvs*d?mb9(`3czOp1qVOP!SCI@EiU-8JX%-0|a@@pU)@Fl@Sc9A(KhoYG75 zqr<4_b1+B;Q9Z$PCu`C3ad1(-YZ!)zG%>xiMoMrcjslB+D(h4!*4I%+FZ+*FbY@i> zpj)aWgWP7?aBUU*kvN9hL`UD!b{0@f?4J_zBzP?3gE1n7!e*+stRpSS9N2ye2N$KR zqKXjOU1@L63JhvkRVA@Rt)O*Q(VY~Vkcw@_4f9UAUT8(M)H=T%m}-2oa?~s-(oTvV z8{r&Ir_=^2m8|Ktsj!M6^P?pu){7O zi+dei(wUlyk}Z+yfS-cFPh)9;n&C`PBrE`GU`*mA9l4M;Rp84jz`Ur4IBsXPCSjfp zptMTcS+8{45^MjmJ&Aqm8Ayj*lCkTS2nOQz34MGSii7Rab@@wXK!(r!S)ig56}1)M zPb+esgocKg%1cd#Zn`B+ox-M7oyJn;3*T_srw`jO)HFFCs)OmG7;p1}(R*NO?JeY~ zHWYoGhdGhuekJQ%|JY{PP#E4vBfqZ52w2j&tZpGalkzPu*F5;%wH;XiQapU0rT+Su8IE1};d)&{oClFu>FB@gA@6ws{>ee;M+bS{6D zMK8t3*Tpuv{rSkESEyjJBaCp)LjLZ;x{eG(nMu>;YA%mjYmBD6Y7N#N& zK9Ug|SIK=NV3?G&&G6K_mQ2G{(f8iwUPunp7C=m-jy;SE1}iEW4UQ0bYQ;+~gbNHBxh}dJQ;u+wk9$PWU6f1O z>~m1YecDKM(saS!{MD*QaAd+iNp^mHN=?#iv{m)MCb_ZR2+|6LUY)cXl=U4T84F%( z{71qgOpWuhGPMtII%KhEnO-pfgYD;h#~Et0iw}lGTQ5y>aBjzOU@g2^mvNaP>!U+= zH{=)~&(cVD(M3P#Y13aYDdA&G3?yu@9kx zi8*t$nQUI0{bKr{TBg#X7lhIhGy3DVZ^&`FvFJ=M`FHqo|F?;z%*j`OaIE&lgL8z* zE*A=OIU&nYewf?PugOf3^7qpa0AC|3lM@HlE2=6Iv=A`>$P_leZh&Ate^O0Q@xD0X z4K-2m*fjtM=Sb54H{B_hhsOSL>o`)>YgWg1-5DgEvOoH5=135PfJeo!WQH%Df_4`w znfaLY1{JW{>p4OJEYBV&lJ<}Xm{vZeE?9H_;JA@W!xmmVuUIBeR3C*vJ-5KLw|Ksak{iKplYPuU5W z_X)M!96YLEl~+lN=5q98fIc>U1}wy=N6QgDiNOl>!mG}qZjXzE$)>t0Tx_!W+DPD^ z!!OP8Hi>)5;d1QsAfT|MSH?wN>PlB{LT^W5%A`2M%lWF5wZ^H91x@|N11+l1^9XK* zw1B{jdKGXq716DV#^V!6SRt<&;gRSSu%~vl707mg@~v`7&0dJ}61vyUE8iPEq2b{r=8=Ab(MI)3cC5|G^wwyMWYC3F z`34+r=YIlm%tiRh?I|O?oe9SuEq2ytrN`_*Nd2bNHqVM}PV`|!KjUn|rRKr4gEK_* zkhHBeuKl%qcQWishAcGHz^SLna0SLfa`-I4Cq(Vm3aRUva1RfD|{)oDoxyIJn2$3Rxj!pK9y0FE#mukWx3IX?_M z3=eb{ncXM}cjD@oWNQ^A7t(VB^Ttt`M2Yge+@bcSyqnOR4<_pAj0!yxt8MRbOio79`z zkbg0!NgI77$gF@d#>+g;)ezrf%%9Y6q24uCi|_j^B@p)>2|yMo||Yb9!>vUL35peAo0!FH(rz z-=C?!#9)juz~qSd_Mx77x#S{FD zMgZJ^qe^f8#c_d;WIyTFF{kwbpryY#3h!^Ey#qTBw~Nn2!=mvpur&mSz^??Xc{g*V z;yHXp{x|(w-2E}ufQ;Sq9 zq96BInY;uxLKutO0@R8bBeEtfe~+j@9AZS&Y$$kAqswf{gRc5Z*!>x8Buv zaSjtMUZ*|<3i4Xp%?~L3ZP`E=z+3JlH1#&r>RNomk=eYKGG_*S?o(-%b{&V;J% z0D5x%-0bXKv{=!Zdxx5`O-qS8(>f1=1*9MovC)vZxnjV5?n=kZ#)j>4Ny&ER9~Rmb zcGdSDvW?Ejk3Pl52+gkv#xSmNwSl-0^&N>`gR;)9d|9{O04@K|l+(s;XZOXSJdfry!fhe}OK=IM z$j6KBtBblk^)3N!9}2M4%NBHG#XBw0S{IgXN0%^9`To2wTb_tf=Kyg5rpv!x%?fE1 z<6ls!s`72agi8h0_?L;Yke}Av%u~GN-=a1-FB^)fQA?RQPLFn_$2fl*)ZpHbX3s6-^&dhSamwe5mm!YLksFM{PKj(;*jP@Mq`(kO+Q%vmaZC5NsBY2mCyaa&(#sn zIB?tiNw;8s$yy^OMX%hQOzb5`_a`IdRo!NebOM^+C+esGWJ|SSO8iEsx#<#n@EV^E zEpH2Vttaw5@OhIs@uBMLkMx!tk!=?t;$hKpNHmu^#BDY<*{Vtg5ab0gsXDZ~3i@=F z!$hlP)06T;GMp5C$OOaEUDSWst_09MRit(57jb`j2)WLp)fGFnnsRanJ15-pyjJkQ znfZ)!35+$cpzSmAz~(n~=rT8FxpcF0J&M}GsTz;4wfBF{JiIJ1HiY_NE5om|>USQw zzjSP*wyW~s(HrsdzkqxMT`a=$Wi@N`gnE6DK- ztmohnt*$AscG+IkB04ajO&vw7+i-869h(*KQ!`7Pq2-EscMS64JlGjUWIbjVuSMji z=7DpSa~|>6U4AQvZj>~O`aT<>!5+8Yn)ZawNBAHsu^gNQSdsezF|hSwX_!kx293&3 z+SQpL^yG9tcb&6cTZ4Aq#Pg%O&))@1W1*a!FwGC=P2d$;Cf;`cO<dx`77NK^c_EB%Cwup(MIYdaNyU3jwGJtN#!Wm3ovP#rdLs% z`NZvVnF};OXhckZ;TO!F=FNEoIhjFYaMKtidBSvmsB&s@t`A>+`Q$nKYhDb5p6Wb? zZ*+0->tD{Dyl{UfX|Kcn=SH%n7a&h4Z$z;vN4K}qu>5!O61l(Iy8oOm<*>CY-Oqt9`}^*9H}@9>2~{^VUAx&G%*0QL3=+Q5fnoBT1hDL9v_S?kP2 zEMcF#9&QcRVFz#YPawYIpH6=K=cK@WO7PNdiPvm>oiOo>_0Cp=x9H>KZ`%`4W?#2_ z-KkBs!l#^9z8Byw!#IA1t{s{U-v?;h?XkiT^-fPwo9kMaw()G6e>FuGZ8vehIgC)p zF1q{5wnhl_;rO<~isc+sBcliktxsfV@_jkjmMMdmT31J5;)H(QKfu#0TX$aIbde{* zI&?9jR$oUDH>l6d?m>8IKJ9Y#iRkua&r|iMA%~De{1#)MoxvI@_T>oB>mL54B(;$U2DMT{ z_QkbKKGK-K^arh-LLacZ>WOrpU%QPeOg~6^ev#}!O9*9#Rwzn?Z}b1yk=rGqVl=X! zj`?LTACWb$f9wc*drR+VkKr}AOKEN;K)c@W_aQzxt&a{msyaX^IUdKv8jwTA`O4bU zzip3AV&9(oPv}47e?RLxD~>;B7YhQ|OMh2XT_VGJe>p7wFFP`Oo?E)RvxeR1MWwSBH`TDAg$L_ItcY^7> zfe8rj-V8RRW`y#f$oBd`4!5Yq3|y&&$=EvU<9^b*iW|J5aFz1q1Pw2LoWHc6(=)O&Z))sQT?%P>b` zgT!5DyO>r%Z>4Fljn(|_yjIA(TOK(Oo58(ZznCghon$ZM0di;VBRGonoDtIwr9XOe zKz4`cP7}{geS;XNgkGzz0?{;kQs^Yx5gpQ8vts*RfrQH-6yI;w2A9Ez{gB zg=}W5Os}sqncT2t4c@kh@~oeB(NOPgr`)I7bSjQA1~p3mTmef(ngjXABU_($S#0%thtcN8`YO zU%_MNPB(c~%#A8`K>}${0q6m&!@2fLX52}b@L*xHz3drYseKdIC1elX{8`#1Wj;YY zR)`h3Akec$=zHvO+k+XDIm4RyXt=wiIx&7l+M`6bsR^;LhSP+_aJJlX3o9ylR{;g{qoQUGx@ ztJcnDC`L2&l?w|S&DIE)sZ2Z{tWz*V?MuDEz11@oz!R{At~?_Olzi;&cCfhYxP4EX zplhrlMiG!>H26C}5?9*YVG+x%;B*cOrru|6FnS5BO-|}#DIJD(e+i`u&)D9Uk*6SU z(gCO?HD4Rvem=^<0u#~RXm#oXi{NQMz#G01w3MIKd{VvgmCjh8$e~Ij%W}?Odotbo z=}qzJwZ_5N@)GrF#~flBC#k!22v3%Kz$XOKB6q;&Hdxt_bQ>Am+zvdeCM}c0k3r_U=Zyh}$$YQj>_=D5sGOPwsnJ zC=-g1!q;$Kt&GQObk(AdGkG1b!Lw9+UM}cgd^?~b7yoc+ib`&c%3Bop8vi!*0sjW418Ac`uSN!}PXVjcSrLtBj27O3{4l zOYV!guNE|^@e2vKA!Jx)Eua>==3;r7dN9=5gbT4vVn))2`?Y#bw)!?sZ2~8J9d@!g z`Kv`>sa2d(H|ib<1{C)YGVl5!7Iixcm874+pI<*u9>0o5LC zy9uu;1lj{E_b2A((RPyj;Xr(R`;u1zIr|*%s+*^l@k+U};W!!o2WuqfBFO7bVwsv! zOXZk4F~o_)(8;=*JO|I4IwFZ3K~iVA+uiBX)OOU#3~Jq=-dL$@(?4XpkEw{~n;U?N z(dtRy(FD^03+!6nzEYH<7+Y}+NhJGvIUn?Zk|JRI${qzW-mz$e28bsvA*^!`VH<XOYhe>Tc1TB_n+~+lO@aukUu0qS zFl4*bvr&!D76MRRg8DakY-PPjT5lvm^}Lfg^YiHx>K^MiVYhBD6**z7!Zw-Gq#`h` zQD&*4B?)wt2hrC!v11PNXGxuWijbZxcwr2INL(Cg0aK#qV$-mDpKyzOJmO`DK}R4Y z8pYEfi9g2VFoU+f72ZZ*wPD>)9Q-kv0y!TAV@_6cer`>g<>i8ja81D#@D>vZoSN^% zmDfDmSI0J0HO;@*bw2yqYmXjgMH4`!!Wk(o1a#@LO{FDCl*%D4Iuertxqpj%rdH~c zW!$!+^Ed~|^?C=ga;MdYSasDzC+42HgBXXT5er+$2R_mjy8=$(276h{V}&tRE|~zC zF1r#m6!fo4fZ<=~H^k#5RYXSr%$m};ePW!mLPN~`%}&TUE>04k0-neVOEr{7Ey+3Bh3Oh;0(Ye9ua{_{Q(@3FWrtaqW(Gk{0U;PIKOse$QdnCVezOWBsVx zjzUsaH?=C2DT}0i)R%H~8dNQuU4J}PDSJZ5{)bA6a>ng;qU%K7t%Cx9_M1a0s12k_ z9`-ShyQ($Ui;vAWMuJpp8_oE@@vP8jwafd3wt9o|+|KQ5Pdg!6>$nGkw#p1*?}y4f zYJ=LC-zDYRh-McW<0wPb_3qhv$RwnlpT zx^>>Y&|QvQii}(*Trk7sh#hnPxfzp+m66d6XPXx?3zKc%KEu8Km|Y&<(A{E3>=+4N z<%^ysY&MYwLvNlfNvZUD9{FU;*Q($yOyHZXv6_nvl6N1kIhGcH0|M04+3=|FCW{UlH!1IxS zvt9D}V4`0%%ihxjG^hJqRWdC6K)a=%3WbLz4$N4OGwM*d$Qi*HdAtNk_ywYZN}w6b zB%`eel`A5)pgaBH*a%a&nxBvCSGg-JWiP)y`{LSd*lRGRapSD2mh)kq>$w*h+vBVE z+~x&RU=;I$AhV|iO>+FuH`DSdN5_o;8vu5D{u@i`BIQW=4jFKl5=J0OM1m*{k*^{| zs!5koF-1i$igiO1OCAAMrn#rtApmExDJxg0ir#<{Q&iz;u3;5~QVJV#h9uIa<)A%6 z)`N*VEd6|6D=!avjQEs{?^Qqd#>;&Er1qF6icAczocSf<#$N z@VHi9Orrt;DTQ<0td{9$kF5C2m)6sl z1=ZQlo;ft@3i`E%nB(?w0W(qb;XZ0x=>oQZWQhai#&pW^Rd6)F5t6cWl!VLY;xNp( zN@uK}X`*f@j3V}|fu24Aveh)@E}T#n?>(K&c9?OpY4y&Bg129$G z0cLq_ZK^4u58ZFwt{6?5LDK}0Ji@1f*u;jff;g9f=Azp8K!o&v7(1seL7-&Yrfu7{ zZQHi9(zb28(zb2ewryLt?%U}x`k}vKue~B-&Zg;=LzOl?1-og4g>e0gpS=}lP(uUc zSxDgy*)&5XGN;k}H42>hbC-7kC;5w!vab~M3v1#e&21WGu_u5wC3p?ZLKIUC!%8I+ z4TkJ7;h31t^+P*mA!DEfa36j@1^Nz{8DAyfjb`r?<007-_A$?c%PpgD1zYJ9wu`(l zMzzK;ayqf4uV^Ao;A>!gv7aaB@Y6loj=|AWu)z>vn4F4k%ExPK5Qa=Ao-5 zTDEg4)9mz4wXdJ&?ZzXPqHE2H8ywZqtop<>Fl=kzA>OAfiTA_&n7<3cAY9Les7L*9 z;7QQYt{Y~f*snS9x7iCa+Kl;)i%E-UXYf0(@b>a@bUC^;2j|q=T(cQ+4&2`J0CG<& zE%W!x`=}9kE(|eapEYi{St^gATNHT{gMh}`Cqk!*yzuSHs95)4N=OC@{d&{g29w{a z>DL5cs;WJVCa<&9zhqekUdzJB%+rzhT(`1oqWIOv*UHjHO=a>TUzE3uIbjy!-nYn( z66bD{7I2&P=IHc%hFG1ce+q~hYEgl-nYZaRe z%Xps!v}PR5d&Q1T55X6bmvBL*PD3=m3+H~$UColtzhT$ud&luaspYw(33ws)2t*VWhW{5Kn0lYBijx$7`5JL67LbT zt$2=H%)pSlj|}=R{#bhKYjLJ9&{AgiqJcI97tbW%o-sRzmc|S=XLLFA0M7LyS4Q9R(fH#V=sV=?AQ(<(b+8J~F z8J9otfXPDkQQmdwyKo;_EipL68E5r(gGFc1-E~xr^MLKtY|0Ul;iy4@yb+i7O}J3K z?$8Sa|8YzPuFb{Lj|Ji#aNsB}6{Fq`Ckzi#Kb>EDWj_9MqZ^~?i)VVliFH>lVb7B{ zI?+Fa=QSGr4ZExW3N4Ru6Rwx}qA*v-e0~&Hid=X;Go1+@5T&`Sc(OI3kVDewJt% zILOy2xt8BIT9s(q>gI2NmWPDVNKon86Q2q1#^rfV*P=aj-bT2n5Jz@)pf?Vz+nHV&BLQ{D9boEoV}To(KrxIPUbi)C0! zq?`SF`uOU}J^V_3`S0ForHTE%n>#C>-fJfdjO)^VYb!6%6MlY9hdEl;^6qc_bbekR zMgzJN93y6Q7t&KPfZ_DodG6Mm98!`4Riz$va+^S(kD2Y1D0fgN8qr;{{roH()?DXt7YOg@`y(a*fZsLO=0f2*@+kdrT%S-iQ9vewnn zJ$N|jTc1x{E*vtj)uNfh;##!x30mhNgJ$=sRZ*|JrnPAl8f9p4DM_jtxID)<@?8}y zSdf+{{G5=EKLNMMW;%iyj1%J}dJ8Qknx9L9KJ@$vu-p&lTj!HQqTQFboK1cydhcJp zl-I`sOi7OGxMtA+H_mqgI<6>axL*2aXvA60Z1M)GqgU}TO*xZEYRJUvu4HbG41+4o}GuJ+(d7_*;kJA`mN^WXwaS z#ZZ~~)INVwIdOltuuwSGtCRwsQ%YWwa2eC9;|508Y(wnUm|#x2dc}sPan&*tz{iX2 z^FsktChak&gvvWr+Ote0gE)Ag-^>sdVHq!ll$=tv0X-h42&`eL)Mrvh#gI78!a**< zC%`4Wf9r}j8KI;jPqs%S2yJAV_3@AXGg0BjK$p^lh-zG3X;)$)Xc=m-2A{LjYygVE zqP|)!W&!sy>;FtaFV+S0eRMbimIP~n*}x#HQ9Lx;HA^ic8vH<`EqbxKlyF3gRyfkV zXn^P)9%|d+bktsyXSOw8@JU|3pI0ICjy44{9$75;3e8!eRX{@SUq3vn=E1<6Lf&k9qPWe>I+9vBd z60EEsV^FxkB$5r^!~z_7LPVEAiI){tHCcSZbWOG?f3t=Yd>W*vItZ<+{ZTFi=%b>u zAC?q!0|*DlMjxfm8DMq+4dB^eh^Q6U&{Z$9)^!nY_?ikUgcw-ii@GS40A=qn8Y&;* z^nlaNX^ifmZe4>`#SqkU zG6HeHZx{xq_zfz}aDBzD%Bcmd)YS$zUb_=1WMtV5zOov8AD&rA>Nt?68#VRGSLk=S z8D5L3g#SwJ#Jm!CF9%2oI*O2_FqW{N^9ks(N_OidzFmvz_Gra*G1mNmW$}d^u(QAd zDU1wI?G#^b6NU1Lt>7Hqb+i|kQVDAt`!_UfB$l183_DJkw_ZmTnwoN;+2AQ(yWk)? zkk3KPidahIT~MMc;~vrk7sN}p=)m2Pa7@d|lek`mJ5)+>MIY<_ZC~2UBMxZLcZ7*b2Hyb~8A+I7z zo&nZ~_*fSjH}t3v<2E20=lC(yttYYb0Cv7SFs?+ljom!rZcyOmD6l}W27)__%sqZf zDfXuTZc92UL>j5r3dE@x>>`g7om%p5jWY0-OfLs))L4E?#H(PE61qbb3RjDD(w)v0 zbZ@6P+$1Pja()0zl|LQX5o17&x^`dA*j0Fycvn~q2 zVd~j9i<&=xFw6-|4#GSf?9r>M^g+HNkB4H3SHSekfqt0iiETbHT;_)yB&&@9yd*6_)oN@2EpvbGagg`X)9q?<~_s4 zPQ(Z&CyfK_EmJ+q_EQvA`2Tl5ND#{_Ia&Lu+!16)jaz_}Ozupf)stAa|7y}u1;|yx z0@{_KHdwuyIg%W2A4eJ}nVr-uxXuOCEde$qsyfg{my1_~FOHl#Hpd8yr4wInkmcfK z%y2Umt71~LTS+#{OU-`bN=rE#T$EPD429NcQGqaaJpIyY3&}^FvAE9Ug%0m<am?dzVyUD%E(IUw&0mn!X@M@FBILN?|ZuW0tWK4*i;WNaEIQdWS zhRq_Ox@h`MfXm{6lAyp@K!l24e|{yDqz+F8#}6*xeL$RE~|So)=YBRZkU0(P-vZ1RZTgo_Cdc}41#A26TF?h6>2kB z$bRU$I4?`l%ybG0A5jo;jI)z#c`>!vPst4t(ah&g{y7`urg!YDW!lSM+KGY8$&u|$ zo~$hEJ~x6r*LlL^g{3%TEVpnq8BM@F@P#Fu|wp?2YA73eBx5|)id;d!icKRBI zL{77UXMH1Q& zj@b0X-1x%139D5ebeL&&XJ}q^4wjc|;=3x9kYTB+$CJ9@C6oclOf4+vV7Ys{K4<4n zntkh{x0Qg3>~e1wk-y^4OC=iMe07UQPtP>+->_yBw^IABH?H&F(y%+K~KF=4#d$`vujy zBy|IsY&4Hz11B)BW0BqR@`yVD+8oAwC1x4zG&HZ4`%e`s!dLr=%|)tV9HVdjj`cXb zI=eqFS|xDwmKSw!=Q7HqT>137q#RGDr!l11SYt4F?T2ER$I$DIRSRMJhK~Uc8rXPz zdoJ?YdnabMZ3Ih`W%+?u8ylTccVVIQlXe@ROerYcA$DMzCc_kUWIftix(LEIq+5e;KnyLM2vx(8|EhG)zLT!r7_utOZYlmPY-wmy6O5pU9Qo$My8ug!*S6ATudT+7&3>` zsbwl&)n+y6e_)PxV8}))!}zLNS`#37v>|4SrY9M8m!|-r8yUlG!g+8@#oe zdeV9oVb1yj4Rl7-D=whM1(%7tACWWgw67ydZ>HL~x+bbl?2p+1G&F?HAu3ZD^ z3&kC~8oU;9P`DVIP^G{iYa$OlX6{(>b$06u0Y&o$Rn8z2t9P*Ye?uxY_me9O=e}}| z=^C3`gBFXoS^_Do%N1klx0fCL;tg4-bW!<>gj|yy!b>i+><)al)-s9I7m*a*cM7a$y>qK_EVBqkMe$pu|Bs$*OX*8U= zf-AG$NJIEmA{r`C*P4cdYvwn_5UiT)$_vR7lW3pV?}VcbT^H4`i_pz)I3USmn@K3Y zx;@QdBb$z6mBWjIl8Q0)YY(b%SiucWd}@}--QICNb%TgXF+$n48Teo7i5i#yuE zp1@tW$^qCnjeAQZB^gM@s4aJe6h`+iwvN8?qo*+Wv%Z=W#o`J<4@|KY&(PwtR(?m| z7hHJ_DenqVLjtc>iTi8p2K%^nCrikC5|>vKs2b9G9hZm}x1*N5HDogQdoq2OWVYL%@N8KZ`?r& zQno0DY0^09Ja#q#twu0E-xdE=ZLa;F5>`;Dwj=u&H$bRDB$%?rfu z3}$ty`s2oPU6Te;$VYe(k*EfoE;TNDNZqE0(a;h7>U~Yc61^GUduUd1Kg&J;TZLv7 z8#Au*I;WTy&XV8zNit!@A00Pw^+8UDoalLHsh6^V1tF2E@CX= z3#q%`RNF6Ere<2>AQ#=K(hR{~H}D_)Z0+BIot5fDgwj8muFvyd=GP;${67zNfMIdA z|D`QqX8T`UT+B>tjQ^LFGOgV{L){5`^N8XLC@&&e2+E)XB0(2_Lskl{wAO3BaD>J# ztH+-xA(d>_HI;j^*JsW~i}LP}^0RnL&QbmZFQ=E=6{Q?rTD!XtrN3~ipLv<d7_8gLy2UM{fV|ba)>ZrL^}?Sx{N8o?WX|>XlOS1NDyCQ{&`|J8`Xv zot>kiu%{f9&JE-;m2GsB?yCkE>^;pZbHi9#irwwAM0wDN*_UePX|ubyR`(*pd*+~; zw|e=HQ~GS;BH_�o=yZOpsFk50v7xxa5+bvDZ?xi>`O80QUYESE_S-d0RR@#E|== z-F`uylHSA?6>J-2SmrRT=#|i2;vFdoSyQi8+7Izxrp|)wZWDqaTEtU(7 zqbY+Q&71T$^)jwi_H+_c!2oomhP8WgVNJoD#7HoX)ig9oew`<)V5^XP?3y(_O?!M7 ziW}MIg~oW*V=YYLgx<+Dl7G?z6d^AI$K1-e;>mqu=;WjShR7WqYN78?A^Zo zyCqK~$@>`Zy6Gj->6N^P&{ZY)!aiuLXT89pNd>)D6%Z9&6d(~@HB%51G3|O}juh6R zi0y9%X69_)Y25_FiAa1haRQ6D;g-6FDd4t^QPkAiT*2&0@{kVtNcTimnsGq}89}^w zJ^1~A`x_4Z_pAtzFX>%;M9*1`8fkXfGYuk#VL@srSOMQtHS91Ji?cg)n~hz|@mM0P z*yB6!q1+dZi5mVuv)Giw8Bh)$a_g5ema)lSBT6;@EoumUzo>}L#Soy6=At>?a4t(z zN_2C~^pb)Q!d#~HssuVBpEx7m=9v|Q>_=dh9h{@^OcXQ_IFnYc^M4{zu4R}c=!YJtcooR)xxb`oGmP1NQhEwd z2a&+A0&{+3qt7jET*h&Ut^v@75TTy;+5+(Z3(XR%?O$UaSzXhw7d(&mgaA~B*8@|j zM;$iAQkH&_yBmmQ{U<*K@rBE?i53IN7ezYKJ^J63BOA0(qO_uzu8`mr>{j%Sk+MAB z(t~<6B+-BdlMW8HJP|M4#S(^GP6Iy5l{!0xpUG_7(~OL2CJoWi2Ba!x)+h%iQHEzc z0D3(x7kyn)vzfD=i;pQyS8tjo{62d|3&0)j*F=t{cd&kBA(D`pU1wgUJK>YwdV=Y# zj*fT3dtZ+KHPVY}Dp8bzP-Mjni7*0Of)B?Cp%ey!gw-xbOq@nzy3%*5!l__VCN)Dll%@62Oih4>g;x&fCduzP&=bU^H^aZu5*`8h{?SHsP$5Mglt8p2%N`3q z<_i=fv1hdFx|+V4+1v8RW%u3hJ=hUesIMqpOXjn<<6lvKvMuVm+xK5O*aa{X*3<|s z6EVeD+pf#}mwg>6!OFSzUYrHwZEYz(GPmxnWB!T-srv{m%M#IWkBGvm2IIo+Sjj5t zW6~5GyT{pY#%5q)zev3aJ~ZU!lz=|)S$3byVmZH77Y9+{xsXhC+7Ko4g_6}`a`u>Ct44lR z<5u%RW2kiULB2nmn0*JBwq~2+cR@}E`BGM+8{ZjrgT+*%0*+GwgEmO8x{vc_0odee zgpY7qv#kZ%LF`8`fR{Q5H7?)#7*P@Tx+-#Du%nm|yagWC-euP*VHZ!*GREj+Tsj290!OZtj)UU@v!L zss7`TZzE7|5AsmxV$MhmPrkEt=T17g=ZDY8@NEQzFeE>AJVBzWuu1`zJm?sr70k#v ztKAQ-iH|5}L5*oDXgZV}Ty!+S;tq3_jG>4RQ;yUdh{kx~BeqI*XHX`Ytu3G&Y$K2; z!PlP@SJno|m`&*{ph^1MMzhN4YQd>3C^ig3lDU( z=E#M*W1qFuj5V#HR_$&=RvzzMs>l9UbGytmp2?=eAQ|WYlqzO)!Jx>5ZJ8dPz9I9|C-x zyhno)Nl&=o3#ZM!6OR1Jz9rtSRbJD>Bn`v)M$!m5Emx2oE)wh2lZmk{xM>;kXo`-4 zWICcRcKB$N+fgZ^j%*%{%?#V<(l1Q9>eQQdVaVeVRE5QQ%b?S=JrcaC1* z?U!&m6uBsQ0E8ZXEGq_nk>?RHqacM&J2!k2uW_VSx$mIM+M3@Zr0nG_mJ4j zoW%J0nKkk8KA`5orPjO$kF&(QUC}^SH(G<0AQ<%4?axxgDS{Z0v_i|mZS0P1fYLK< z$}UgLJnJJxz^^eXc}iKfMK6vG>G(>=4qtV#qHL!vhvP5OweLzoD^l4*)Hn&&4)#>o zG2FQP%a4Gs;B}gUav-KCFE#!8n6-N`GQ(Q#ajnSSfJN6yJxW+-%SXZLf!w-mw5N{p zgw6~WaI3dQVQ2f}bRfIOmtzvCg6IBpw81d;pxxb5*jX&F*2B9`ZKBD7Yj%18+@Iqy zZ{@jw&v-YzVPocpDfUQ6?IWpboKm@YEdCKT8_sS2R3C|69PLvgMD-5UQLARd6{@hh zEFTHH=0Zcjk|R$x(o9$(xNYoR78||B zc&_kpfK+xVqwVB@qJ)p!KC(zLUhy-AOr)5}QEbd;)#z9p4ltn0B=eK%rcN#hp!H8< zggl!4RQWWDjm_-V`Ly^RvL5Gu1dEG0clsZz|4oqIg0vS3VG|*>>G8of}ke`DwA#PtBmW zx#@b#!%}kw>=F^xd$FVA1YS0=xKK(BKT+DirU{6J|Mp}JwP7c~JIHR8#Y&PeS!+f? zHUu0jRnm+yX!tFmZ!vI3dsF-9!~hJG=XTl_)L5}+hFYM=kkqBAzeAT@d($Z{V*#DA z&n!$0op9Lj75%O)ZJ0*J``b9ro1lq64`9kVcg{PKt;T&hP7zm;ezZAb3tsgH-Q_oy zFV|vs`OhrFUPV@eKDX~IpBR1@s?8UBV)?72?_VVj5oKJ$mG3qiyDZFzX}ajupZ?tw zcFzB7?^f7=nwzH_M7nc*qNIXD7hoy-PI4T*%x=x-RZl^)-KM*VP|MCZ7Vq;?czki@@?0*yE_UoM5f0sQ(7ph2ecZ32B0=ECKHe>y+s>g}E z)^zXR5=4~sc&?k<$X8bed-c+!N(Y%l%Y(JRFkHVuhAe{^iIEm<--+P96S;oZJ-<(U zU-$IB0M&_d3|;htkX;R)IDHflX70H^_a&^sjmz(w9gUQ`BS*VjesSg$v-aGdOgNXb zN%ds>=VgXd$Vz}9Kr{m704H&a0QKJJ5ZVOZz8!OCOQ{mCY5?lH8O6P`ZHAh5mIb4t zL7Fqa-oKZ7GE?658Nd=bISy%IQag|(_s zhk6hjARpDt?HvpR_u+;rBqbkcd5+Bue6{90`8elZ9izFxHp~+O7;-xm2I3?jbjl@$ z>qP6o=CMU}fGc^5s)RZDP>olV)KC`yEXO1Xnb6%CAjKWj7>OXvl*F@I6}0giW>u0D ze~%;qr;-e9xts(>%2HZHu>v< zAIDWQ+ZKv~s#hcftZl00$0lPln$*QKGv)g!#1e>|p}Nh`;+KKZe3sR!Zq zu(#-absbr57D%If&Ea;ek(6%w1AA78eJWy6iq#-Ac|XgbjVxKA5R>5{yN7erLsfov zX;F=HiwAqJLl0{~Z1X-)zL9Su1>ZjeB;^<1tu7S&aMmflqL|QEIi7!s$<~ z-B8?Mq{w-nJ*A@$W%&&eH}fnte42*++ntOl$#4B`v-DX7(iVXO#N{#D+OAYiRE2`e zu=8l>ALIo(f+68g#S-Q{d>sl-KzN}+QDc%Dn!ui(a=YTR|CWt!%Gz0i2!;TRnZH2I zG0g564ezboMnR?HDsDUgG3B|Oq{4TK@f#T7ceP&;Jsz1Ixkhc0Xi8w4{yem{ zLtAdBQEs^qP7oqH%MX%L3;EMB>3fzNty5LYLVILM$2wf?WJq`@0Wv6sKKv+?YYPfN zJ%b5e#802NxAbQ}={Nw@nKmhfr<{cMc&$blIlwBp6{MG}BOOeX57q`pj4P6xt4XE` zOIZiJ^85b0J{?vh1v!+K7Js}whYv<<8OyIIQP#*CHBB#Gddm1bsniWp=ka#H&&Q+w z<>kOaIdY8k)`)VbZ)Kl+5POn*B5T4#gE-|(PqpPN zZGYGEpxY#Iv23XmH_BABkMc%-e<{R@7>CNa&ZlQ=>}arS?jcYma{c(l^v>z&1sz<~ z1D9_rl-w;HkR1waY{;ys5+(E4P=_M_bH;N1=?IZm35`F6*2Vg}#iAowIitPPAyjR~ z3Y4d*76Q+uO3C@bo3)9nBw9!{%znjnmTl% zO||P23+#{di6nK+G%~n81JB0r@BE#PLPiGv-~D^cR|Rm>AV8hU&OJHV-DTf{@9S66 z$^iN0H7n}Z#S@%|xG~zON{{(0(kHIV`@1!@p|w3+oj^UcSA`le1$R)fJ4!RMvd4^k zi+UnepDzbNPSOf1H!u24D;jJWX56XRJF!bGUlf+w`YDH^xEB2O%BU09cN$of%e5bc z$%_+}18!Ium=^;Iigb##5R5sFox=(gqv|V}qunAR@1VSEvtU-1uyKbqBzg!RL zVhaS|tN#o2r9u6_PeS#og)xT}$(P;g<1I?Ic~=P7F>;>_4zIGi!H*p|uwXzH6#8X) zDZo=>#mES-!u(5E8ZG8+Lt)u*4iXdGi%`3ixdC!~Cn{U<^XZU`)`x)) zVmdTd&e`hIAEu&c>cM+J!Af+u)j-&o#Tg6Trn=fK$q!pG^dNivZdIh6NJf*zU5<5y zK+gLR&&iZjEv*>R@8gCa3cyj+g<#W|^l!XQ%y+i)>1rA&1NCD#x4KNpDYjcC?J0-0 z)f#hMB~~`38%}IUu9cHrd<#o~c+AEY<5ECOE8&o1r9+-jdEU<2+DDcyd)SEwL}AhA z5Bx_9{h6*@exdK-M_2QaT6n6nG+YnYOUU+qhLV2=+l>nT#7_ zpU9Ov)XHi%eBSm>O&v%ZX_d^4SF4gF>$Z!3|(MW7H4ipbMnhhYLCvk6v4pHWv#%tE>(w_W7{J)>ecK=j#BE> z-OY{P**Vyrh=)NyciO|5xfBVJ)i?>GZo;WCL@xugHKgvL1lVz~A;m_p|3H5q<;GB%65(636i z4g4|}_7-N6oFRME+%huXDW>{Ou@-y{)H{b(&_tY^mZ#Ft9(Uvz;HcQO zkK_EXrSoQ$jt@Y}-&YDZzn+IISk({pI$wa|*q&ePIA7n7_&?xnM1pkxC5N*8Pn(NO zoUH%BEw9#=jJs?@>^W6GgKrv;MS*1ThKPrW-z2$3JK7VSAazP_pW4kOvf3vqzfJ{* z_iZt)*SJ)N{+B|7@KC-M2dzWbM;V9qf1q{VAoYGXyMC`n?^gX}g4B#v6yf<-_J!pO zRUh-F%epard43+tlV8v)_qIEtByUIh%t3D-MN4l#d@~k~nw&rc59rU3AKj`ahoQ4Gn&8Pnw~e9p7Uxe7tFf9UPt-C&4JE_ z1Hlyjb@6F+LWSw)Y8oALavvRim$A3(*%4pgqxov@->ZgAj533_1Gyj3fR`XU{uM&AO$}7~OX0RL6~Zn)ZkDI9yW^M?k%NV}C+b zL26080-w)wShugoS;X=My^RqVni`O??Jim2i3G9rWd1;Ci}F21K3*%5KTevW&^tvq zv+1FY|1`SmbOQfG?oE_%oJC+nCz%fV!xXkB73(&ZC z97<8GY03MsrLof>S>D>4JIIPj|n8?BegjYw|5|WBLVtx{wj$lkTEi zcaznSsOaaN4TG+48vRMQ_QIl38%uvPbdGf6N1pV&@otO6{ZgDNd4qGrXSpSI%7H+t z>|*m)`|yHbePmJ2gN>-S9u(m;jU)o#K)i6;4dZ~)1Zp80f$M;QjAs*1fPyfnGl)+l zz-WlL#`y$OMM~V6+aSCR$~{D;Gw$Z}g&re6F7UpraX@#VtG2vJA(?m{*t4XSM_7-G9Nb-3_e(|Y%NdSd1CRdn2+ttZ9qhq6$ z$bVQ|F+gj438sjv-4in{w<%IFP4m$i0z;#uxUh;moi;?4vvC)FUOQ)~n!*JnU9$l# z3I}F4rA_O8h;*WwC~1l&@7x3cp@jZ6lUWtKn4{Y9axny?YTxu$Ug0>cvzVMraI_dx z?!rSOgEoTTphPdHjtbvts(yit_RU0fsToK27rAb$N@S4GByWk`Qy(!uF-cW4tjBU( z;&l)q%4>#je6{&l?cJ0f(y0P^^GL>QG0H>N$`J2VGIw69J5e~E${&hnF!UQP>yzt% zq0CtS1)t0&JKdRX$n)sl5THK!5k~cus(*)$Y}L%5;BGyA9fU1|4xz^QXoV{^xQU zOb`Ff(;xse*R+DzQv^xAuy`i0Y#?gic7YxB@oAl8Z%_%9b^JMM=|o#7g=)UJCX2Fn zELR6Z^}{GR_9#cSuP1B8386|i(oVTbijUiJ_|IRI{-uQ>F%fqa3_p$XafHFM9<0gs z(uD=ZW7_N9zh1&e)Mn+~In}3Y7o89p;~t76m+ZQ*E>^flk^HCj1CLFsx;*9eW5i5_ z>GhjW+UzP9*wYmk8#ex~T?ubIWp?f7c+B^-dUb?Q}0YX&qB{Lb}OkJpv zW$c*3a7PS0g{rfrApl)?EL1c4nRt4N-Fl*5K~+gXfukG%re_gc8$W-#o}8=0tXS!&*c%2|Qb4MMno6FQ+r>GM>IPQL5rZpjqDThyBx_Y# zxGz8d#r2vQ{(5G8e1efpS=&;gJo3nDSwZDXOBIK3*RF$(z(t;u(n_f>+QW}>yR!V! z0Y$T9!3J}o1(U-3K=-J**3HZMGyZQ6GjqJzF?GvnfXz9wAf}vZs?A37f~_1nJzM*P z0f7fcvK&+{4aJ^j48&g(x)sD)LA?iey1_q~H1TdKDrr#3&bkSVtPIX@%0Q$J&VtoE zaC!OKm7walZY3AnIx?}K76#1+NgGD4g86n+%vlbHDq^*Ev&? z?9e*X0#>!F1m{!%8g19GVtrc{FZthS{QCHgZR0VvCn~3Sql5Ce)9+-7X!PGQofl9d zE!_!$v1(8t6NJn8I}33W!BbJ>Wn34IZeLZ*u9<1^*1CcFd{$0N1LWee?9=y{Q4%EjwP7a|svK^BgO&U5L9A?jb`3( z5187V?zft1=)=s712-wAnBKU#Z@VJ|$E$+)Wp{hv>E4yLL%TZnnA7n>L)PS+0;WEA zIJO~QopX9bb5G~OnStz{W6*%A77u#M^us$=RKWJjZ)dYRsU4c-hyj!?5(y^9GLGnx zU~=F^IR|QTYp)UKn61n(78=Y}?X2=!qAuF{*13)g&kQ>22LgX_Sc;+XIdssCN)J12 zrd;Nqx@sD(hMZ~cfy}VK7DLkx&*vq>ii250lCe2wjgHF=jMh+vcq*FK7(HR)BY-?Y zHNnabT7X13r~tI5B%mc+lGtV+Nml7MCeu`}U&KEvy4lrJzPTjM2I|umdd;*Z)~;Q> z$!F1b26;gD%0;T&RU%rferqS}^w%a$p?z6q@Ir7cQE|>ldAy^3J&46<;R%c@aCC?2 zPfrNL*OYbp8%yp=!cbB7IFcegK*qX&=#Mbw>v1s-y}a5_O&9XR8}FRY|JAU}W)GA! zxI&RW0A>~cddaFwF!uUD%mr3j>k{)`XJZW zKF6Wx7Z`tM)aC^%?W}07Sc3o6x-te^3zKU82x4r1dftt`|D5%E2M)nvQvEM+p5uRF z$uP08{70=ktR)?H)CT)6&cDGo6}$rfSuzZm25PriXe9`%aOF(9GJH+!#aAjYk#cR{ zVrABV@zn8^D0uslu>9~*N(%O~{I?;^7m;2vySvvvlf0*vqV^O#-Csq#R9dDmk z5WqpPFYwl=R35I5V`v{7)Je^oy@_-_5B1NQ=c&0nxMg`B@%P*{L5e=j&+p5pfeT0< z#y-zleg`^*K`6!Mpp@ZBj=KC3_lIxtx#WR_-;d|WvipY*GN~Z*XSEG0IQVmy?6TW_ ze(u|^)K9M0S5Qo>><>ACY!S*N-qHi7QZsI8vc%3Sa6m-HISHDPzqQa3He%7sO=GxZ z5{9j*{mE7{1tgRHaeW_m2u}5bSPh*$xrL-n1c)?q70Dev$v2$l%rkVRx@YBpu+oCC zlms$$b4hv2y##XExUTMwjBgYcq*iJ(Fq*oXoT|}~qx^o7VS3vfx{iVJY#o+_8cwHSAe@3?zEclqrD|D&H*PJJT27usx?} zj|b6=!-7Rk{ri%jx&FT8$TAsJ!XXZvqS_e!B3(^8SW(?99ndV8s%2j^JrwTHIhhj8 z?CQw36?8mx{`kmx`k{A?US$&j6l^Br>oXm?iB|`WZv1z|4z<6ET{YPH7F`Qs6?WzQ zyjGSDf8fn1raEqeJ=riH@(d!`7-MAxy8oh^G#s`tzGYA3Ox%WM2pv1^eN754RN{!j zCiv6wynTsu1a!Ut??&Ujt;|-a`wyui-OHn4zD8bjsQf}SqOew6%=3^d^=w(G)XFFL zu4d?&`qm=B8mdtK5w4$PdRxQk_AqyVrie8`@UYyKSTKD}q)5^sZMWN0ti>S<=Y4Fr zbVdEpvI4YaM))p?Mi*4CR6RkW!~nE{hK8szdW%$zkx*8VLPeRZvbrDP`^(M769Ymm z3Bl_E3b9A!9QQWU7WrTZpqt(p+J}mnRPTTqUXD%rs=eL|#BtL4h}Xzi{EEBo%;=-v z3KgYswb5Lv+SoYZ48}vXZxN>8LGS(fIZD5Mjh_xpv7dE34)CYqANL^@zDe9i%ARB< z8DL5qiTp^rqob|sJ-u9cj{wP=7W-sYd)6^K)4O>=Q+zykKE<0N4bptRo5lbzzb@F4 za9>xG1OM9>^DH~wtQdy1Un2EqxbX_LZ!5M_OKhL`-$R1AKr0|o@yS2S$2Vo=Ux|i= z#0CJW27;h$T9v4!QCP}mP=a zWHNl6DTDL$Qi52*o1-JWX0|4?1BCN4fdTz`dN)WHZw5ex{r6Bqc2!B(0fbddD<{Qv zzg)|5IjFO}8^d>Ka~ZYXyBb6^b&7I1d{z-;OxePXwrDJj^+YliQsjn#8pncC{piLc zX2vR=;r80r&Xlz_y+;)f>x`s~-+dhywLwoL3N58c!4|f~DiMym3o}|STyO6J&P*C% zWVF2lcM=P`@nVSNpsjkADjH3U$?+~=A89QeXJFLBYlX~=+jl*$ImE%tc)mrT8VPgV zhPAUqhm>MPml0rhpuW~|dnL{lxXjzyTSu*%d3h(i43$h=EL{Ovr#6y!7%EizCF@VU z`q#BV_8v4}U!}Zh)hf7evEwZ1evEOOmxMU{_RygX;Gw||3teC9@hK91bWay&jQ95L zS%fSIxe+h|ZyS~k=iwcmTPsf}x+8da3-zutgmn^PnJEooBMgBL;pG<3j~?6wwW~G2 z_3+pgN5GyikKL$RW_F*Bidzs5jeAToqj8QNu3+3dg0FRj3~v`tv>xd@QQc1Bo>oCA zi$NJUzd}A&l{~ZO+r}|wWkf7!HS)z;VgPu=7+gfWM9Pr^ELJz(smp3pThY=|F+r|v zlRXuayH3=z)fxSdbIkJTd&5r)@1|;uJG@43+Oz}raEFu}wfFno44)q6nReZg%kR*i zj$2}IttwQ1E7Q^w>{hv!9FMRG?uDLiqa}3bz{GR}QJA2jCu+ESQVcc;L_!d6;XuOz zM1TKE>dyR+G=e}@i6tU@>9w)f*9Y#_mzv!~6P5*iX(rDG!X)dvl!@gD*l&LSj&$?n zCV(HbI0X7%Uqu*L{qBx5EFEx6k%^i11YIYD(g6~B6Jw<8S3FI(;;S@Ixm8{M-e%Rr z78(d}M0qjJ)q}_RUO!YGj38V{06j8NL+#u)G+JmX0)Lzk7t1QeniK(6mef@$dk2z4 z%XM?D*-nQZk<>vBKcMQ+Y$B(7r0tx{QBMF3N&2c7p-e>~iVy(2oeZPQ9BU@=1gmy& zZm{a9SGff*)gJb{9lcy(zRT*mYCxH5r_X;Pu_Cpq{#G7}IbT@k;?d$pbOz<-X>`WL zJ@XmEl8UpCMNuq@_EEg2{M^QQM(f}2udP8?cxYd3Z$~H`e=TT(JDrTXl)IxMbV7;| zg(a@Ism~k2az*W}|Hs%n1&J0lTe@Z2wr$(CZDW^h+qP}nwzbQ4?Xs)u?~WU{PxN^> zZ}Vxbrx`hBj?8bo0ycOhUQm7|5ieHMbeqV#m^GF)$q-#*r9Vz*Teu>9$2i_Ji;;ZB zAV!^@!TA*VS!u#G7LaVcp-H;O$Kpvgp^d~|2%wP#;8f(-=Ai`v1BXPbqc4650(dR4 zc?K_GDv?xIm}qk6ZE9vP*MZj__o0-IqkM~OV@t_*^)>@m*F2DcJo9yYyV~1>&afNv zhtk?v+{~7e$G$AP7j%`%|J|Ae@4^YR;_@=pe4b|MI@~v?>6&yhzj&chg+P7s5v_5F~ijxs1;?F`UFdBBi zgG+%G(RX-4t;cK+2i(Vj>s>pYkCZk?s~$KfInuNvw2t()I606s}S)4om8P(8~Q z2Qh<}&B17shp1V4LWAAqs-ntIFH3FXSnc5H`9fVLyeXW>u$ zH`-BCot`}d&OeEUyp+h1j;`(yf707@d5 zhVFP_$QlJD_yUlBtlWFQ|B;ZkH>J9-om4OCQhKMlznDw(?K`$sa2|~%EkgNC5DXZH zrGo*%%LEx=g{LI|5N3fp%hb^pEVoc}`o)usIOQZ0Y`;Dp8u!u%>#dg5O{rVO%? z*(|=lUhY2bJaokw03eJNvSMQ6IS`Ev=}Tu>C>cgqM%E8E>X>?fRl$(wlDpv9^H88U z{>kBKvR*HuGo1+h<{6`vkENdnfLd^(7#qGzF`z*NkfOMbOlfqGWiTtsnnB7M1Nw7{ zFIgM!V_AaY25m_bPn<+|zZe5DeiJ#Nm)W|m#g`DEa9%J=4^7|JNCsT_k3Zm3-puRh zrpFmMH>7IKKCd%xH_;`iepTkgHdGm8|KBXwjj`>ytoMY#AFzJ0u%t$*s1dMIADg3_ z%3T#vKFv(C6XZJl&}S0#a5VrVjcoEWD!7xouLaU7(r>7BK0{6cUmB2FUU}M?66=r5T*hWATa%JD3sqwKuz4fE$-*M zEY^R^#!+yoW|WF7ZOJzL$7Uvh7s#~a#HbCkC#YnWWK&g%Fg#~d+ay6y{WyO1K@tEIZGr|UygPQF6JShIwSeB1+0n+$( zt6q`1D%pzDoRI+~<5G7Qz6hCzV&5Ho!58!{cELX}FYt-N;0lttEB6oQV_KmZZDtY@dXnD^)x(r^;x4kV& z3MXAhG3ChYjErFs5KJ1a4jF?L^Q9-y@ywNueR8LIzYcO0dUgW{Y8iY59+1llC$@2tIHCwcJWR)8 zS8SD!F}>)qx^njwj`5U|$`@-X3o<8;^leAAE8>c)$8bTAosOJKydHCm>r{p?&5X=7@wRy0zd$N*ao_#q3NMo7!l~fyacfY{NWA z*>3uS{32M};eo}pCV2{%GDuS7DA_Pi7Us#+B4k08RthUwjmgw`pNLkZCAKRep()RI zGF(pbsH^)Ja%C#<5Owm=R;wku&%Q2{%qX~&Jkv-~PhfQ|zHVsHy zBSLe&q{3vwc1kkaW>#ava18a_B89rOH1OR-3V}tVc!#gj_I#ZJ8P$O-gH86$cz;zXD>UdhvIz0T?!avF*6N@D# z9-H0^oR1-Iladr$Wj7h!O3cQb{x+Zi{T%GnIcqB2LLl<*@ld2+xTrSDi;R59Fd1Nj z7y(CO00sLs%a-d(xFl}+_iUCXtJV|F%ZsBf1+U3vRgzzcpG{9O){Ec04Jt&&e|5-? zH_U|YlRCp)Cwt=;VO4+eCWkdr4{9&=@WZd`8hBLPf0GtCCrCOoNgX*8r%4&9vFzi) zP`&T3Bu=bGtV`6|EBMBIxD6K0Ql03WWm1GxK!AHsytXA@&PY)=PtJ*emHuTOr_r$*6kJlB)7);z@@2>bvUtKk5$n8gD}f5X-H z8%l@mV&E4GH1*sQo!jmjNP4CJ2G{G)L*!X_Q(MlAlnTQc;A^e`KB|Z=UTwFztr^Q1 z;Kv~QdJ^$N2wbEiua7N(%;c6`GLqMaq+jRdU{QwvWv^L}yWrOP-j(^zv@t~Os^xY| z`Br>&H?r0E8EW3-`MsjA4~drlcf#R+6eGpVz|Qc03x^i%soDPzknA8TxeEH4AR6H6 ze^biaRT!mnwc(7$ob?|<^74%1!BO4;!B`(|1kuQr_$23-YhV(@&z{Ng1QtK1U*``N z-X{uQpG~dbo5TCV?g?`E1T=gZ{^dE$Lvb)~Kz9H5QruWyZ!mz9B9Tr?@3?yk( z_xiSK@3(7avfIOXpNIN2$>3KVx$QIyx9H0c=hwsIL+Yf-{V6^_Yg?cACc{h<-LOl0 zgK&;E{crxl}E^{S~88Q-@Gt7B+ot()S$Md>JzK9NP``L2S21b zzw}@p>Ga~DrH!mTE9N@<+`z`N-Lxf788-UBl&WdgiBdkpiA_oF2TE}{*-aaa`*xqK z{(rB*g7pjXkBo4;gf!PYA?aTgX9L~jw?6bA;;seNnbi-wthL}E)0B0tHgvnRnm>7b1G}tz+ zx}@z1gNEeNO1I z@G9(8L~63>JQJDWb9pm$)O@nD-V-6F(*z10iB@rMrljWa9|5qVHPiClqB#jG-Eb3( z-f)0_U$dj)MCRv54X{Tu%noqzqUD@ZQfvslD8mq!lLQ6TV$z}sL3Y6LX&iJkl?!N6 zvdL#)f6?)DlZjUl61>dRr8b|aW!H`rr+)?=f#0*uvv>_~0XK|})oFAP0$@jCfX&5Z z6LM%NsjM_)F{s|r{u0Iw$c|&Dg#v==J1gz$WaP@9wMRx(NDw%|IAVky+tK(7>^6~- z2Z*}rP;n?Wut+LQd=#qr-q=gPtd^8#79Zgbt`sT|UF8fprkCpCE8;fj#K?O$CH2U& z6(-i8ZA9uAR+UTCwq0yI`ig+q6$eYZe4m3N~!3iYss7p~$badR7EyXU@=+DfBi zTk!A1!VdL&)-+zhl%&J zUh_AA($KaX-m9_9OiOmRW$6bBm`d_sqHM+B?i7<7SYd#46AaFGc#juK&<&EjIJNaV6~KWw42&|%f6>)OmRJf? z{orwRZt@68#<6`~!_N>T)=Cg0cx`K1vXCSso6Yg+l!|j>(Ss*NUDHiFpQKoy~AEy9d=r zU4w?%{IZf+Ju|f+Mr^*85w!G_h9)Uc#fh8);?Gr3E~UQ@!t1P9v)xb?!QBiMeJNe~ zE|xG=qs(r#2FDHKV861bZp-Kn5m9JF4-^glN^!V*AB)Aw`I}Vw3C=^cYtOwxH1Kr*kLx__yum1KN)JU_klbj!Vzl)IqEc+{3z(AG zf$H+(_8yHmDqzW6?v`2voAQ+*C_C|;1c$L585kbB&nQIVreg;0od!@KK9YpIBX1R* zQ|2L4UdIrNUF5NYbqZV4{rk1wsy{|)(`qAEoKf)NnqE;m9Am9DE~5L&({fXK@wk9w zBXyE>t!mW)Vv`q={zKB_qzDGPKCri3!so1b5qgl_q%v;md}_o_ZX7li3T0I@F=LGe#Zi1E6 zmeJ6~_`2K(8GI`D*ET#z#BN!5Z~);mTQWI(rr;^xaS0j)krHWnt{{`DJKr?0C&GjZ zl*vw|%)c&3n^C4oR?Vha7M;ItxD%Q^Ha|Bl$fr6jt^g%_VB8n%Fa_jHNHZ7HLlqk3 zBI8$dF{A@_!+=(%rg~FT=*OU-&5Fg|`P`g9yac3p#G@IwQuzjPD_8AP%BYP_D?mNU zqw(U`y#JE!g|Y*Mc$glkD7MTCUGQ}}yB#v>Yv;t2CiBPp5izC8+*G*lVH^cr?~6e% zhL~ok!}f^Kgb9}BshlG@!I$JB6^J%!-CK&jac@b%++xCz2xF}XkH#qN{~lE_GNC&A zEL|(;6n8+IH7#_EDQYzfSMW`97EA~nfwy&A*&!VDBjhl5RMm zh=o7K2Bd~ARSAVwskypjsubF-IQnYMu=@~SAtP+89b>j8>Zh4|Bb^POECasK#8KT| zw}9%dwENofi8L<3rR2)t+@T(zu%*W9=A4z|=tzB-MeGi~c;LFJCsLKTS4;}3K~q5( zo<#|(TMF93a7H6%4NZUFRh4R#2xm`$4;~L_Z$JB#zQ5Dv4HFWFPf_rzW%Iq$3FgkL zl&;X|k{ADD!hZ}};%@OeHBrriGWD~es?T1;?d7HZ5EgR$)O-wAXy={A0m$yASSMKE zm|(Ce%&I`kW{=P--W7m!Bbn?7P~tg~*wU z%Bn@pBj`#%e1+e$vn^_S|ML|wrGD3%p19r&TfmJGRw5hnjFMLen`_HRS-Rs%v;S&F$1Q`@!V1Oz;8_a68)cEJF z!=z9?t6#$_$<=aHX;gKg#ieME3DaQ=@Lt{B<>i!*+$B^&qH z`hT49Xrc@4{wPiq3!ukTS9?+Trb`F98N!ao+ccu5^9J+ooug!f{TA_7(tE<7L9iUZAGi0l$0cL>!Ii^2emH(V zX`kO7T=Fcct1BQa(CcCkY>O$5!PePwklNs(7baQ?;8%ZBZzk%p6EiUD;#bEeg(1i+ z1hz3K77Mlv(=1f2L6mxa#@?2JM6h2~(h=zq=7_LR%NX=9$N?*WnE-~dXTRgrBoPr8 z#<%kAr5M&>p#TNDZoP1c3M!tq;KzB}M>9@S@W?!@g39+E!5IrL9U=y8GhCS{5ON4u z8=56y!coj%Jn?ib5OV(TT-U_Eps|CyZiTGm?`Sa$Nut6tbJj%+G{h?{V$nte7!g3m zcv8Wx7D$O2nn&b%Ac*2Veu!#vs^6`EqJn=CWQtIv!uZ%7#}FALwO#&=K<55n`BH$h z#orum!_ysrhT+2?Fq>4%w5%!S$&SXP7A#dMzfz&Jc{g*DNFw~{j!ELfI3 z=tiVSLbAWF&592DnM>Pj5>??_Dd1etJFQ!hZRdYkaJ;0%Ls}#`A*2>7>`(im{U6 z`k1<_bV9Z_ynZ9NIHfD|`9B)H)6*QUS1B6JQmj}f5Bmaw3oyM!T-7sk7QHD~+J~(v zn>5oB0AtN#^8%T5`V4Ff|B!;21trH$AbL(2IAo1hVJ)^%NdXbLbmijFT6U;alnpve zGs)P!zx|2zB=y;pR1>3Aks2l4_n5QQlzuLLX}H5xE8d9e?JE$}9A^7oU~*>RJuW`2 z6uhs4Q4*!AEgr|D#h;M$mhpIxNNkD^i6*tOOL4QtdED@hL0flejf0ym7`Y{?kQ7>8 zN4<^qcMjIkcN~rOkRlzD$UG|c!3)?+q!DDaO_NG2>o0PzxZO=uHe9=!Tyx`8R@%8H z7u3Fsnwz$q4)$Mi2U0a8S{Fq$vG`?oeEL+%u3@3(v>rY)LlbQO4Bez4OTH$Q0-uJa zXI@hy^52X+?$lDNvp(?n+L5|h_E*hU<2 zpV&w!y>eY(kYD^IU$0n}{u}`8n#Qw+W_M=9qE{e2N}Xia96L9R&xjUtV=9uT7gx;r zsyr-5->fz~Hm24D-^OFb0(Ybhr=kH;uaa1-4>jgHAgG+0LRrmH^`&W{NHWtIX1?K< zT+xoSYO1}2M*BG>EP(&fg@8A@t#pr|Z_oRi9`^bT&M#^h6G_=NY-&cOe&iUJsq1Sd zA&~N?74>fX+MAYPr;D@mZ$B&Xa8Y*?wkGevrSBAyi^g&ET5Y7I0U{)v+@&p&FEmuzVQZbTIKNPpnY%LhrcMoiJk!LX?3E|K5*S+0|Fj z(J0gQ8Qf(!(oL8ZBQCzfDm&DKzbS=ICoIm_4o7TS2-Ldf^iy%{$8gg){9D~RkvCfwB!zXRrc2P1r@1Q%) zxz~#lJ^$GWiW&0g7&o#CDSfwo$w~yG@bYa-jB4IyrHZD5k#5U#9i3~^D*NhIhh|aT zXp&k9<$}zxeGz@(GY>vN4EoJ0_lh!(SATt9T`9e-Ug_f6JD!E+fqV3p&z1K8;Zv>s zTp9O$(o;Wsjjo(nFpq-%)`07!qI>OJ_3Xu%_n;=S1eofvF?PdTkYNo3R_q45l~%-w z2_MalGh(SodM}S_{)(y#wn%+*4#!JWDe{8T}pHKPCgZfMocN~OdLIi^%D9D7q(I61#nH0{2 z^{x2-K{|B-tw{!K1Z<1^vfB(a!AY0pAS#}F;QI?ECLF1aiWqX07Yk5P$k8+ zAmxaCcP5{ZP00BB^jfI&`(XZ$iK_Y^6ZPSLo2c*q+eH1>8b|Opj^S)|NQ@#kjG+-V zzuu;C1HgDrs!1=I`Xaf;gDe+8wVaV^*6_5HlNNfAO)*c!!GDUR z)*HTz&`%Ku4qO_nys)*H5}vdYkwf{f(zXY=tA5xcpg;L!umf2Pm9SDc3L(UY%xOe6 zQs6FvOvXe)RR~|=9+@O@a=T?=egc*98JIr!eJssXL&xYx#+esLQ^S!qc9<=W#(nt2 znsfz6PE7zwBMjFc$7W1 zjCEhJ5kC44e{74tL8x%^pvYu5L(g^@Fv3Ddu0mk-Gf2nwk>U1{`%qHK%!ft>Mx_q% zBGr;cV9H6EA(A;3wU%AGSE6GjLXSE zt|0<>XqSJ>n-T;)Uf$JS0ZoG!(cnW>TY_T0Fj`MmpQOq)C3+EVf*EFa6*Sv}Q}9-2?~8s& zLexU8czpC9(C}Pk(k=BadrRu-D}Lz1}oll-)I7<&fn*A=Ibj9 zE=f?$dM&vqh>0NfcEV5r_jD@B4kx1^U!cp&7(vRa&_mHsQ6-Bk=reE9W}2M zBxP|hd(m)IBjb zZKLq=uUP0JgzBOjBvf;|w+v|5^U7c6)srwl5_(Kw< z-o$TM(`OYRI`kEj0cg~!oPYDjK%pwiP6oGutJ-dbtRxr20Z#jUCbH@3Bu78B)fkeX(e*Onp?@n3__tHOzZSsVop|Rd$aBlL& zW+!vtG5Ym1d)Yi@;M9rn3{h%8;HV1KS zw#~fF!-DU-;MOB!xBK~- zBnY!Uq(FRlp=!d1EjBkJgjwwV4}hUtT7`oZfsW%jx&2ee$d>V`t}o6JtNzw;TgIP9 z8NQ0Zn`v_Ri3vNNm9@~5Q{E?9Jl`vZ7JJdZ;ejhn%g4+jTxn(IFkz0$3xKt~?xp`^ z)C{9;rm3KV_|jA>-CoR4F9YxNY|lWQ^y>}DH=Vq9%{KjeGzfTOAjP)bgJtQ1pX2J$ zGs^t_z(!@QXq0DO4N@2OL{(0NGQrCJVIQdY zo+9vC)PyX?52Uray~wwWV+#`=K9Z*Y`cQ7RUbytpPmH`QIoRmj9WOVP^a<{g@H0sn{zv zxb3;$$P_8!3roNlEf5JHleCN-STjY{)+R}`2{T_m3Z+C+{z~1OUiS9#%hqb}kugHb z%8#ZXxdZ;Q?u%~dLip`Nc$-&DzrLDW{%*IQ&k0uo(Rjelmx?ZbRIPWoWPq~HmwkSF zrNAz$2zlFDD!!D#K2p9f)B|pwS~j+q$5TXtrkxBI&E*P0;IeSh9N zJie%BVF$I8<$VEZJ?~Z?J4$p7^v}?1g4=w|qzwuNf;0rH6}g!82T-T6A)`evl;RRZ zpjubaFPvhwTe^R9TPf`3Y4|dJ$JvN*1q%kWiPee;8g-xA?ID`3Y!;KM>3L`EWwRCd z8ZnlfHr2{n@Zd!U@y7-7L9h@p5JuCrKq^cLjS+EJewMDL#I*j?t65Hzt_wZ~JO%@@ zIcpZb7UCMU<08|EvhY7llEmI=gh{Y8*MEX^sRjDXq z4rBuo$}|pBs;aHB0wgV)a{!3#oJxKu*I!@8tIHnPLiFv@5li(P|^ zQJV*F5719)81>Lf$CL|}0A?zwIl|XqPU&c{dLX8$%_1#Wnl0&WNMf2gL&R7&stf2Q zb}GGZ)D77Ug3lyB?}s9}!ciH)jp9Ph zMn5gi-US8Xv$-^dYL9jyvjJ`F^_Lz0xhDc@u$!i?n1RA87hJ!~S%e-tgh79zqN%tQ zi7Y6f?HPmJvlyADVG7*D%b}5%Dg#j!@hcZ7nvtp05MU5s9P&U1!@<8nA%JazA1YsM z2Y-^t(iy7|QUoq36fv8%GF=s{CB{V^hRXnmlcvHQk~KoQo&@WD3k)b`hzlgMUK;sL zWtt(S{JQx0;FH-AU@iQI)9ke6M1%N{e~iNP1{s`_mm;1bat@amq#_NfQ}Qy=D^3ic zPRqoC23Vjr5H?H%p@M<25`0>pieOVRjPsrjs54U-AkJwChCGll^DEit)IVH7BYnTg zDAC-PDTucSD1v#S7pdt9NnpTz*G2zkkHT}gE+$sGokb@wkE<&vBP9gPMd}%{3~odN z<*^d%aO(gM1`DIU{)gKcZN6?CT>DotDUJJJx>MmQ0=DA2)iprcHiyL_J&1K^-DpDe z>Lhb&?X?J+Y_=wR9BQ2QIJfL>YSv0A-mne%+t4i$6X*LZy3gLpV>ZwkyT8Y(fThGot$R^G+w3BTX`zgiXt; z+C`~ndl@LYkA)^1X^%%eB3PwD&X%;yu_;zbXYft&>)nARq_!644_Jx0TBrtdZ1BfBu~U6z>Y=jKO@g( z>dDMzih`{Dhhr&ZXpQJU?BT}!;W{-kQ4qDOk-%rVWXAvHzfF@Nv6lm;9BP#PJP{cHE4=5BCc6-swpFL;6Cjgtw|R z`fsUQD`^{-wAsK$x?H6M zDSpmViK%F7_)G}Mu|g?diPw?t?*5mjzfqP=uof|Yk^y9{cFqCjr==>+SYp7lmO-q4 z+Vpa4Pi5po~$M6TGoJ#Bs!Wk<{7dVN_fK90?EiHNqi`3P~Nowf0&A6X-a zgz}Z!CSUI@AGUee7hZmz?u}BOfdn=u*UIJ*V&`Ln80K^ea&^pzdf9xVrM z3m)LEZ_cDLOWKv$IkKb9+3}gQ=`@RMO^+8x7GMASe)qyV8)-boly^)R-sqCz2^N9y zomWz#mssGY!QKKO4ts-W-OMSV` z@-RxZ&GfJY5VNaM^FD3Zcaz{D`Dg&ttUpo19{X7@%vl%cHp^B6LA)t=O{T`}YYbon z4}qblF@N{h8xg`GtN8E0nb=(!$sXVqzb{C1kw64crbM| zM385szCC#bAzn(<_fSLefNj;tYS2WF5zo;(?$xHu-3C0bebjYnF!*!>@OsdO{7@CC z2kz!VhQAa6swt$Ff|@);+n}DPq<#UZtQDuMTC0gFpqCOe4M69LjgdkA&nzE%1M++B z-$2>KvH^(C1|*g!{{U-1gbzE;Dp=55c-$qi_;88Cl~`;r<(rW5c+aA0|5+N)Sk|0K z6q!zadqu}LW9TLGfJV=?ywZ}0Cm|{exlY~O;1~?*hhnxlyA$9j7F_6#R!%6Ul zha{Ruc!T!F`ww^~G)h;1b4%fqN?Xty94QD<3zi{i!685=`?LI^=@y?N3~a|D~Heo zY6{8_XaV?EpA57D^sYnEhTQWi8Q%chrM940752h$~io+dM$kko->}pm za2FsFiQkNDJPY8jVZFdZRS+L?98px*a#_{#!V;!n5y~@K0?-vz5>gJpa*1=ucotm= zZ?e;Kq6N&x5@_JqpjMFxDn9?Id<+I4KqOE;7#c$*z_5KfF`=NLJD5L_sS)h{GSXCM z0F*&ggg_FQx%nD{ODGWGeMfZ<>X%;RQ`-F9C%d<`p@s`TgmYV>E6dCaD#APTm6m<)L|Lt} z%Cg`(T~tZtA?;YTr+wmC{Cit@foKa3lL(`VpWO-po_ZLhKmS(Le?rB5*4TjQvyTAx z!alns^fb{p_ofoFG0^7kwrX>7)rREXw(NVSc2)61Kc8GYG<&r4diC`5>a_SVIO!%u zbDmZnORK^@Y!+J3pSmZPH4}7~WjXy)X%xPM5-OsEiqA(q0ZX102dgda1XA^-V&oU! z)s@`wZEviXOVw35AJtV^A63=Wdn|4zeF-;j96!{)TdzL2c`mM;Ex7x+yhgIj%eu3` z?sw6vur^dT^jBs~)n@6nqd!+%`Y=t7Yv%VnW$1yPF=q?{-sS}`3}EqtKlsgUe0kZg zWn0;T9NpZ+72h+UPHMUQ;_C`7z!SgjOLJ8{_>)f`sMt5+R^B!yj2P?6juqNwHqI-* zH@Zx}y2Cdr-CY-4&H2@iKbq9Hzl<#CyBr-{epG}Q0U+v z>;aBFEWA+bqBJZ}4Z2*zGfA^#=HtP5CA6%F!Z2)@3e8nDdhg{DZ}}WfHaM>Rg9M9^ z(j$fButaN}JacuGWyNTJTUTYq@zHBDKcJ%XWfF!;IdBKJpA0?q$N05)u3lg6lh!o?BRfR!n~;_S{v(LH+pg0&{i^aZ(+)Hc`lPUVShxQhWh4Vp6r0 z=pHV>g@WNIx=&LE8*03U;hjPv%r#*G2>)`+(KFA*<>wo-8xE$QqF}MmKxaZ+K_hlZ zcyX0lp`#(hIZ@>&#Z|3aICNOQZtr$>%? z8cvgC`1i%4Aqd&;&nm}J1uu|l)p{oCveXiVl;*7lN4nw6o4Z1%BG~|m;7*Dmw9<*d zm02V_a|ybvwrxO=X|*1$v7%!X-9K3mefOoi)#F#HOr_LHv<3jWhDQ3SZ7W{n_0yEovgXK5roZ~rdy{#lzT$Y*x^ zb?@|y|CGI|G1>v5TVA>nD4do91B^9(gJ#6owGPWAfQC~}As{pX_tq_*HXgKa+$^_zli>Cuci^UcPLDk* zYyZlgfzND8D$DCcu{yhHXk)99x~?h!Y$H?KO#-A$h_an~6zW93zZHS0{1AlVrN-wQ z9+Ym7*zUFUava%|IqTsDemB?q;j4{%slt`WvmH4h@j63-pm6n2L7tp_2sP!Za)?{n z`?%->(=$``%Gp)-iFdSd_ng)_Fb%LLrf{B#({DD*;qh74%VVO!%fYAIKd@<9BSDC{ zOHOD=lDk&!vnD6?l>MR6i&KUkxEaw*oIc&U1nR7C256^XNE2MM7vDPDqi#n_n6_2T zVSuPx1EY4CEw%r3G;vZ8+#tb3Yof__^GD&%qq z9%Kb!u5@uTEhbnF48k?A=RDB>?i^ct<`6UyBWqMWG6G)a+9zuBuq5nwf_-hbp76(v zO;`Wy%uvObllyUf=Ll^Cn!>TTX%EgTX|IXZoS%(`qeXA*@KBl*`r|acxt>a8`pb|s zE7om0{cF;w7PEDbFS40LuId;O6GwDSsG_G~9S7-}5!VQ+%2<9t4wu`o>TvGbUmIXf zrQ&Rye+kW8;xr#7CFcxbi4G5<<&Ga4=$(`_uV(`6RNm@R%qrx`-mowzvi#?|g86A! zP_LO!4G)!A`JwXG4O1A1?5}54_Fk`=U0%erS8!$ANH6*0lxKSH040Gux;}`t zI6cRZkhQd*I0@WN6J^@Ob{t$CHc6od);dF5=$oYRUvq&qQKY3Dk1ojLa; zL7Oo~MGSM|CyTt&@$czurYeoQ2q+Y|H2+`ZH}sqr!VN(~+ioK>8ds+Rq3v$CtMR5q z=82d5-|fW^{kbVWBek~%JF_>xA9u%hwj$hAOhukt61N`7dIa{jB77Z0H9WmoJVrZE zsLSRD9J_io?HiKmWQ3QtQ8xgi>{M7xSh(d#-mc2JNjuM$P36}wX33%i?j*)B#f^=4 z$E}hG<9;65^tr9eE1*GD-n2;E43^nsvlf|=9k0b#<`3Mo4=|_8hY^B@oAcO#l&TRO zQ{;1N&ewGwhT>McF9DGA* zG~K+2av=sfPM=Xb)C7xw$YsjvY6xa7+2~hIH0- zW!DGapLk&7yMAuZ;NLGVyFVU!zgSO$a{iW6etCQ&?afk*AYI#eMum1BlS!rq%O4LA zcpqysUF|ug+s=!^i%K)CWB#Xnx^$M_J(+%){zTfTYH7cf(p;FBqZY2W z8aW0P4H|GM@DreM`gY+e!UHEBcAgmPa00r;6Q(@7Jlv#yV9U^t!qAM)MQjUpRSbz9 z6rL$L=8ocNbaD=;7Y=xD9cVaOz0Oyg8s4YDk>d=tOFx4Z#!omc-L#m!aplv0G}9qz z%LNAX;sNVWLpUvs*PW{4|?8#u})|c=i=ig@i#?md-uofAUk3K1@y{6X5!%LS7 zo6ctHcAC=lp%HGP&b3L__IYz($bhk7G8u??-w%HuLks;6#+ar9%0Nn4uuc~}C6vaK z#f_JCaDP!^^h0wezRu2$jCBi|PI1Z8VEX%pu!!K1pPUTIYw8(u`*jH3q|-jDw?I%4_nJAD)YMcW&H>#x~U3&JRxdQXNY)hcq$WVMm$VwZ}jV@ z$FXd=T<~zgW~ZDm=Z{Whn-~R7;7x_NU7=biLLZ9fq+&j(?6%w~a?J{f5w-!~NBDah zQTnxMY#uQ(*iI;MFDyF4t;TEdj}-as{Zi<$=7GXio&y{)<@K*Qm=2U^%k|L}Q8ARu z&Fs@Mr>3r&udNRe#$5xGAm+KRc5V7{mra_3x7#tF`g@>t55Dl$T@Kd4u!db8HOOQe z;9WXJEfUf~*rTZ+nczE=D?^%eO&Sv%7b3-1f z02Y>Tn0)P(d%`YUl}6VF&6V0)%NO9Xi3|pR7v96C^SqlDjPEQTt7 z-LL2oB+HxUqAsBH8znZH%c1W|jjsFpJicSm8Bpo9qc8P;ge#SI=UqHR?K6oIbx%8r z>P|B&c5&jl>Yo7HbtYi5G&qX+ZeDqi;7QzNgvdVq}d#A?j5Y0LmAj3|BlhaMGu!BZqBM@ z)CW0rJ9P+p#-}XKvgWf>;JQL2+|HbRvvEstt#J2Kax;5Dd{BDc~z|t&w zPg%VGK7LH6GtEWM6u8tQ$Qn4`A7MgY3|joY*f1^9Ihr_CKnMGcj=f2V-U!t26e9t@^)01tW+R?Ef2LW-9ucMbdHg=v7$Je%81< zw;KnovBfmwAPc49zmk#p{1`NFD{u4f`w#H2K83sb>Z^HrVfg;@z~S@I@Pn63I0A7> zYk&?QL4%i1qfrP3u}X8QmBgXcMBC6E8^popZ8)wNZa&@u5l0)S3T?-&jP)J{uy{g(K21*F_H)pDLoBxj9jcz)&OU` zA`lT1+&%!Qz#DLyqN6EH)Mn=(_(1 zY%*@l$aGtQW08Vi2)4us`IvUO4TgC>e#Ru`dD$yLRWLqnWgyM|&5;`)m8Ce5?XZ}M z44f1)LlX@RL4E{+5)C715`A(u8Q>z43{NNVpEEBL>M-yvCx*mP?%1)oIFO_I0N9UkKB{J; z&b&OO8<|zng-%KChiGSc^-bIRwLvzs}47WFkKT~;0KB$h6UyhymzZO8^{NG2nv z+>~YF&_bMf{wMS)nSleEAk?ieO38D93RD@696X=EOq?Gwn!r{gnkQo#sz>g0A^RAS zRwI_!2}Ati!?|mgKYs)Nq$m}?;&jz=##QON z%*o7TSUVVbTpVNhg#O+7ql|%@);h#p#m8|Rc_mCjZlQ&ER6w3Y=fy$r?jwCe2)WN& zKx2gdz)#qC^^pT)WXzMBrN@A`lyiMFzKck4e$RpAxlJ> z7JWwO-?uB3&-Y{VsjKyVQe@F6-2{li@jpZxwG$p^SOjLv=u5XHe40rhITEM4)zQ!zMKU#ow`eQI`8RtAmS69cfVx6HLhlRe{aDBykvU2 z^BiPt1f_GnF0igWUC^`NpRgp+C-h4Va z?H4rd*5R-mf0Mh|clQdhp_0oXmZ&6~U^_JFLp94X5L@L*6DSX-ixT8cJV0L-xo=Lq zUu<(31wP;PG;ThZGOD(yR5Uu7mXOZED{@C2xp>ZSlL94qZ%7%q%6B)dtb+|M?*0Zi zHY>L0dFw$*pDg-(!L`rScFdruP57tK@GNY4kC?G0O@}6RWB%=h=gahIU&lfS7DeRz zy4Gc7M1q7)_9SN&U;53xx}HTZuVa3@5(*l<%t%i|JgAVRCi0WQpBvbSOa^_jsb}U9azbArM;NH#qVp4z7B` z6GE9Rqp1ke3&o2Vk{&FI7d|w^typb-I@pjO!CUH5$9F{$;F3%(&MN&s5)Z=ru=Xpa zjUXen!q2huSc^Og7P@?P&^M$%=Z`3eR( zKKcqR+bN4TyBTb0JO7sI4>rtbF@F~Kx2n2!vSAp$-zo4(JBZK#k>hbZDq%CLntg;$ z9W0#@FG^AXj+lK)%fL1sScLhyQ&}Ap$wD5aAYcN8HRyagx1<=oD+w+2ZP5}@hlt1p zB8`~@)lGNEh=;P7z7?a{=ln!+9lPXQ7ePa`W@NvfC&h3rohfPM6V~QWO^ydHUZ^Mq z?rCz0;QIu8WVNK%k1%l=O=7$5Yh8IBxJ3 zxHY23%@>Pih23K>YHEM^H1HY6P>BDH=wN66U&j0Y-CJj3WMux|OBu~t0fdDdIJFy3pQ$;<+c^rofA0fN=FbAR%LY@uj7S z0C9`j=OIkBEi~wD@E?NI`?dy+UBJMpF}cZVToA;%joFhY>a}|kV^yej3DNovz+Q$J zxEcr2(lbwyb1CiM?a@=Q38_Gsix9W!b$w5@RF{=y#(j|e+3Vn@Vp+b3u4g=HT20qG zZru)+qc@eNr1dj`^zXdP zXMz^9Gmdr1-70FzCL&DO8u7$sg3~sNirC~liZWyWa1klmEGuf0K(SVy#X^ZS?1Bmw zirX5a!k56#*rd*YgoUj_1=v&srL;A76~O{+JjkgcxE0PJ#ePxvnnau=(>9vl#s`l z3p9PcLz0A2tvqp*QtWLA8beGXQIqImVG|ahGdS&j7~KShq3IbY^vwwNL(wJ%1*CQ?1@jlyw*Z>G&cZRRESvrq_m4}8B!G@{5SXzKO zkr13P!KL0wIPv8zatKCdF;J0Tw!V2qf1-Ty>b%W#We{_=)dHPj#}W`=s7w_7b(xat z_wnOHm`2ON79)F)hp1GV#MMxpPOvaZaba8SVmeB{*7-URqQqxXUFhS`X-F@!k}f;xpg=gVh+kC;WRTT;jD$gWPY zT29gASV=B|C4mg(DW3P6MnCXa%3Djh1QWUd)tlr2$xeip!hWy}tg?S?Xg1`K``+ym zk|ZvE=I%0LWCF!?$!@MuBTmiS`q9Te+OO3y%@}eWpTW&p7A|4m6(l6|j&YA7EXS53 zA)Aze_QJ%cctJAmVWA>njh+Ss^L8H3U%<}6ML#&9f);iKCYs`3Xm?Za=&8z&I=iBJ zNS2H@Yf_!*f(2+J91T77De*`!9;MspOn8@|<|#KkPM+Gr2g2CDY_9+4M-UmRd%n~- z_*TdfdsEL6E4%!zAe4QjIq)IRPlipX*y~MjtC$$cSuQQWqkf&^gTK<~wzF zcC0-r8MZ#wts|XXr63zZIU`_e!6|{3FP$2C7xgW_a#rtt=_@;_L}-$8A24#>*+>Sb zUF4aE1=&n9s}x-B6Dvc}JFOO5G3YoGBrR65v0BF)Z=$eeS=K9Cp&bc1;vF#%*aG*W z!icUghUJ!&a?P}^AU)<{^N@mXB#Y`wv{au^+NUzDdIdsx6$0Z8ITaVA#sY#Wtu&zW z1_Qr_9~7%E2#z6{dZ56I;C+6jAFFz#$&$mn$xITfRckzK4ErVKi|o43(z1;^XgFO~ zjCt$O9IZ-Pv3aFFjpz+bd25I8t#Xe;QQ|+ZU!Go0XI|-o+0+)6KoIgAZufM+m*mgi z({Wy%7>`@J%o^H~f$LI%)%pgNYkq|Sla?e(b)-?QP^w;norz$mr8*>L=U`AT#UZDu z8F9RP$6+xX_)h<6x>H73DVB{YD@+-%=A|g0ixrC&FL!A1<`%+2dITZbyMkDprI% z7GjRJdHZNxOGZ9sQ@$9D;Zx}%)XWlmp-kvgqOo?Bnt|rx3fNJ>j5(YWsG}EE zb9v=*nSd*faNduq87??B#qa4x_RSNIw(<(Zp<>J!;Q0nuLqbJa>t6B>=Yr6X-3>0q znGR0sdd(+qG?sN8d^>-X?9A<|b5+P3vB}`Y*t|Ntbme)fkV}t$(YYjSu5i)^jug#{ zTt+$pUyN!NrSdPSKaJn)F4?3Bd(WEvw{Ctvi6Uuu7Z^`k!IB$2sT+Qo&d=NRo~qO7 z_p5#L`HcKt=x5#TKky9Q-Jt(Qhj6m}&vXdef9Q~IE$O&J4!EA#x;y-EvEm&8!Z6Sl z?6u9QC0m9tlGxV<-}LsYUHuD7Nw*RmDYJQrP8w;H_j|&`m#0$@(#=dJ#y9vN~483$%Sra6x8+1_49xDOf*-4LFlUZREF?AjBU zZ#+Bm<1pK|$6%oISZ%maGLBw^1)<)t_mHO~oW74LeZns&QTH?!t~A;$aqd4bvksbh z$hI0X8qo2KG5vdM{!2&38yToZtK!xdkRJ7e?IeSiJyR>?B2;pCk|AbW@ zpJyW=&6l5c11k-)Z~SGHtV^pUUVk$Dvi#PS3_HI3{_SjiA6o(|OL-mSlSUX@AotT? z5XGr68|q+MvaeBfD4>HQ5=<^uf$CbGQK@spHpWC^G?muNa>QH3Imse1Dex|0U~mGW!=$9k1!VG3EhLH{ z>2(QEA|G6X=_fZ)K(v`IR2aenmQj=*33_%}1@c7ty(LF79U608tnH{Ka#EorDmXWA zf45RdI*O4`w|<;}L)587BS%l( zzk#7R!iI@6*%0^DGa)qwO_XcmDvZQl_G(~KPyqkAR|rjRCwGapERedA!o1-v;lGgiT}+bp zgMPOg(^tNkR8)2w_e^=+pq}=xa^4joH}7_Qp%oINCbIEF6LkA)Del^znm2%)+aD~` zb(fm-t_sR1u1}QbFpJ5t*6O-uA6JWzfGW&WGLx%oDr@+KhmuxW6?OJ_7FUHRB?D=p znRir@UEW95f*)}Gwi*eOw(kbJrR#|}5s9po2{PFoPHB^joO(=S3Ap7+2I*{MHA5V* zES9bkz`+kZfHg~msv-z{e*wkbGxreJe$Pl22Y`B_yMBlHc1XcG* zMQcmJJPt4dNML=(n^G^GkM=YxIi5U6mF9BEJ~Ogwe2ql)@9v$XZCVE0p~z;n83*zt zQgP)^S=|Z20~)%rBew87E#|7Le`{$j%&VRtLlPpzzV2jW-ZFKY_hx1=d&m%DYCEX1 zCZ1j)hBjCtNQC#|y2_S|weq{9EetKTkZH|nJFPDEdVKrRi;3uwRRt!EGH`qJ;^-zh z+N9ZJt!40Nno?1n;$-qcGDIcpD%Iw@QXnA8rv5@S?(Vbvkv622$$848$f`yv3uVW4 zmz;*$FxsO)BV#DR+3fDrQTfxbLq|UP#+lFBe)VGUOOt5_7edg22Qh=+ir@GFD4Xmc z+ZhgfOF~q*4d_B-~ zO#vMr4H~3$8IpRgoqPn}!OU_y;;IkY$>Y#T@SlT^Gz=6ekrrwUwyTsj`vXjZUw9@n4QSu*SHdwnter${;a&u z8F0r%i;_-Tut~ZO-tZ7X@Oc+vqlLcr@=fW9K-5qdJ&9>?2#4C zyX1+ECC~9p%6h_@SdA6X;mP4qm6l_Tp2s)?e$AR~6SA(*8aDOP!iU#F`t=C2B9WCK zWym1nQH3e&r0Jmx+OFMtLf*!(#&mp-E6JN->KND30f{gnltlSVFgfo+s1ulhS0Mm( zbk25HR4=S2TbpBBH!4vkOUdvqEc;HL^&l{+?^Z#kM*ZYx4t(t%SVQhmCGlMoAV)kv z`NaqF5zAmK3=NxuZ<2-?!L)}JEH6bp-t(?6Jyt~0$q$HURYWl+Vil`Y4W*t639#5f zkv_rh(*9$fkw4V2N1{d?035^BgM!yyr|=tX{HOp8Fo%fw2?wH~%8NV}9JJ{_qY&|k zIB!`5Ep3@@J%HU^s$_m`;$=0a#^acOv{Jp%NQFDt#46nC2v6BICYzE zlA}q9lzcu9R7OxuUcu+qa;sCP_0F!@JsP^kC%GnAtgmv#qbGC=+G8}pOX?bO$ zd)b`$Y&I4 z@^pGC6bwk_z_Gfb#q=|NNL)h}vm<xq7fP&Uhd*Khy!IeYT4 zioZzTONU&}SqZTi=i1T7gndjt$IQX|ukGKZETzM(*#7dGdrqy^;Vx9&H|_$jPY?aM z7<&w z{OtXISF7@MV5I)6DZ3XUi39x2;2SP**MqEe|MFdU27Vy%|8%5KZU5$+CJQzF&`+q$ zL*4md)I2>Q#pwCDeVRRgb;j)nVbG4+uyF|QQ zet;|OI=-|$x?1C-lh*RyZ|+Xh)Z||&Sjsk!2@?{nn$%W=sBP1=bZm5X(~zj~gmRtU zARnf)>@L{={)2F5sA>DAt*eClE#q~$NCGDAlL(nW2z=lF*#GP%gX_V4$O7ys_P3kZ z*3Kkl`jL)k!oKz^`HTXNjYDlpNX9u|A*1tYA#$4h9P7i)R#u;{yQIVe(yiLHQ-+k; zGE`DzcbdnNwDCNygTo8`>AS+z$&Cj`T>Wn-_NMt%PacU+0K%!MplMLnGm>WJh9nF} zVtBeeSr!iuJx&sn{czjT)x<4+uWKuRQkIZb*Ylz@L*qliy^80;=S777pM}Oik0SyU zB3DPK8cnHHF(K>0qizrAV1_C(p8!wue1Fe9OV*#_`na#@?I@{l^D5Z z3`mSXgbPH%dFUqcr+p3Ulf91d!|+=h2hTb~Q?%s^ z9j7iG=boT-<@!1hx5leTgOyb?Xcm$%z5}(dTyT1A#z)=YB5$iFyW1ef~r0%qNrdm9O}?-}BYYqcl-$e7R4DB+|r}S1nnVRSoMp zQQw*MbKJe7j)MSA9jQy^eWZ?td88uLMqo#s5Tt`=pH9)( z$&b!&o2kQlz`ldC_nch=dinzUTp}n#H#|;6d$_|F{7KGNDJ69aj)n*-hmfW-YX8hl zyA$aImEAB^|0R)jQvTwJbQZy?_W}dVT7(;^D)j<`LeC9m^-p<_0l7vu%0jkY6ZIKZ zD0?tF6Ov3lVsE&;JQ=3#70wg;;arBo$9vjpKuZgnVS{ylAu59Z7zlC7oSaFY# z2s3HW@x$O~=3VKe_wq1JYvXH^VmM|37LNctjto>|*%`3y>h%u1=fnCfe`?rpj|G2* zN*0zik|@p-3LA!VAR6OMf#rpEYd(#KULCDfy#C?xr6mD9$WwA@Hev6Q`aS@aQ@2H1 zjClroeS;pEpeIuHLNZCOOtVS(@{k}-VLs4A*%^3KF3$>QV78O~E$q8yaBb0kbvwo4 z9veHRd6LAu+6+uDC^aFCVyf~dN9GFIQ3!|oojN^u<$`fcLJ)AMyE~hf?`s;w zK9Ggh+R4gIRkC)r8BLCWzKskWNDq($J;k^Dy4|M&YYzJNSwAb^8XTG=%^7wYMF6YyipPegw`yo)JnH+ik&pl%~hr!GMoG_38>>n0G5z_LPI0#tX^tZ zvi~n29B!@C^2o*zL?Q-yn({1qRfHl{3Kb&RbyBgDwE-6i#3ZA%VZsf2r&L&$UX966 z$xJ>Br+zY(EyRlqH)#qjm|oqJri&h z4_*LiY4od76#?usja2An%61noz>X}T=P&kp8Q^$OuzB%=x7s-0e zm|py{8j&Yc=$vXJ?{nAw_HMP4*7-nHs9Lr3*9}iBBq`qyRe3~#m^st^fujqn}%3X6OPM5+1*jbI^8#qn`Q+lOWidJqNyikP8cDu zeRk5EUvoS}T`A@n?`nl1JepZ6R!|Fmoxf4alYgN|gA-CR%L1A>Vg;-HofS3TxjL@MeQe^fYZF<8yr554^h-1nh57uxgJ<2K&e$cq zAY@h)If!%?+jyLZNL?=|&<}|~e9yakH3tu|olFL}M&|wu)Gg)KeeoGV-6s{)K{ndB zOO~AJD}0*qds@j{Y^)V*J+Pe4x50Y_7MTyl!c|#E1Ex;~AGI&3^0BeJU?wxco|NJM z{QER}#0Fm|Z{bEULaX4ES2L}y-c~iV!!vD0$Qiho{DX6a=VmW!#T|Ds%y~1Ua+f2V ztc02MeW!PsVvvhwI5yFqqw$Mj7bF*poAaq24~;qm!q6aG=;wNrmj`V2H)sb<3xXgh z$Yye(0Atxa5Pu4w1I0hF2OJkII?{X^Hj!3kosG~ZT4M$ROQ(WHzR=d(8QQ>#zf~#@ zc;j;1HkBb8DJy6<3#^qKc*T~o39jW+@Inh0-fG=++?}&{TGWDAe8hqpCG4`7r{XYsuF*7j#2X5teLnHRG4RQOwJj#_j(nt_2J&-YwF}wI3P|dbYHMWf5>W5E4 zO?WiQiQkwD9acxGNQ1^LmuSv6$9a;}&yyu%+3+ak(BkXu`H24FZZF#^zkjaZyDOh1 zt0?O8xifFhGmmC-c2hR5L zu|5?=cQLvVUb&+I9?E0i(`oVwq5dO8miW~9D(dZyM?_m|pxbeV=H(+xtDbhD-J7%O zMs=FM-}m*AjD*kM2;h2NS8%FD2-wZ3y3zu79ZCJ$^IPm%{SKLjv{~KSh3B|M6XSIG zAH!O@B&lA1e$Lx6PK~dBw~M>-z1;-F+~<385lxgM0N!(#?()lS*(=IVJ-Fpdufu2X zMlWimh#m#EV@Wsnu=b;q>r~or(LmDdv=Wn4z*0%ig#0?lgO8aUnmw{b_M(gpOLwvF zR7o6!QqI3aGooL~X{XwEp6%h0)&RL2FJqAnSxM!=^ z@ZM1T!;U-(4Q~J`+7kS=ku$m;{aPD!x)R2) zJ6r=&{VW6yXpj=nB4Ut5r~&&X-5WK{^d6u&BDuWJAZGw~O{RaMsyZb~73jFN*4~kz z50^@%rkQU1<-M=2a`mfH?a@Su>aoMvR;<$Gw$FG8B{EsGzmaLGQY!5rnM}+=Wg#P* zse!+Nx+rXHvWybX5&g+1l;VAizMbq~(Td$uJjpJ>xJ1U_xD0Pqk2AcDEZimcyoA=4 zCGRcdJ@OR0hAcuQ81p7<#Qd~?TFiGU0SJg-IH02n7%Ky1h?W#4 zaH>YAeSPKM{__raGY`&4feZZbD=mK-0r4==>wKyC9a#iAzJZbYRp$sipmaGYcR&9@$=2FU!qoGdP%F0x?N;eAS$a(PLOf@-xzQ=N?I-r zxK3DAZSm?VJxN8?jvIMkV+6{sgQN-Z)F%7EiL!R6ReOkC~Apl1+C0~ z<%hXqxRGh1&xfR&nh|dsEmV!V?7i-eqCAhomWav9GeOp`stE7BQaa=MkrxKzgf1}} z@jfgUYbz>-nWr*Dc3KQ&nR0V51ynRsm;9Mua#mbBhkxUgPH#Hz>iMlEymv;WVBRr1EHX-EsVgsRf#5Ym;c7AHrHFvITy%L&qMbh zc+Z+b?we_*v+EQLW1OKa?`5G*V0)BK@JV?Ji7L0O%Pb1{rcPQ5Y|{-n`*#m@c*>@p zi=-( zruB{oqQ*Ipm}dxHyB|CASJ!EhG;KOcnI;$nMEBDk$TE~&`IyoCd1M>~UOsB!xycU? zS!QpK7^laY0z@d4iZVrRei_d6F(Hy}>{fzcgxgodl>kFYn*yP3gty|R-@r5%gwI3< zhA6ZkbpI%1))-;LYLmkX7c}{1LMXhM%&QKHS(mRqyfnx7%^G_GB?noHQ=tANWk)FL z4~x=9MCMdck?JJ4Vn!Vn zxhCNEbRa-Mw_25rL77Ts@b!<(vy* zjnSdDJZp8e0tj@&OA&YANa!>rC1m;)L#*W6CVTU*h&d%=xkCL5(u2y=ief%C+M&?F zGEuisrNowCvT^#N>INrg3v*(4N3QCh#$&fp)Vu@%Q)FrPekrGOqjy|g%=t|eiW%Rf z16)`<#D9j#YC-{M-~P+&?ef<69cRFA17O6SqI*-&R8wOg*8Fv#b&y_20W%Y7A@0%$d#spDX!V48!oUp|s1LZ31I}Gs zg=#x3eO`nB^^in`%re6&e6DqeSW)`2_a%LtvLG>q@#65n_PFJVX_fOu-TOR2U(UT~ z9OA}U#)p8=m$zjE_(hGP#=AMSJ;(t~#8e|c<8+eoFY za8Tm`TQjANOxdF*WbZ|?YAiyx-j)(=iWqVB1sny#MNbZ~zFJq*SE_>T6ioHJMxHji zd=RqUn5kPXcU@%57y7nX9(Nn%f{0Yt;;N}&!DMmqbLkcfQ4hxS={%g>9xUm`Ctusg zSNh#am)`7^*N}up(t2WhMi~iYe73Q?vUwuaq3;;-8X@t80t(V;R zvBn!L=DfDyIMr^qcZ3*! zFbS!C^Bch#_NnSRn@QZHFfh<*SxxjSoTECwPhEafvG=#>mvHEZ;#_71#GQKa`}EoB zPB+d@MELRFhQ5B7Jkx$NsCxMZhlR06nlJQE=ma4Rj;QTlzwiOsmo^VQf)@qz1u-u* zI03c=q27SV(ojLO;@UU}&a#vH<7(`t1ZS6wr?XJ{;Ox6R0J!C`v0dn4 zo_n*!J?mU=H_&>UuDw(=y|f&PUhVf46XpQm%!yWs$`&caM5X!+5Nf#t=OtoV@9#xF zCV1}L<|zd#Wj~?609@MJ?%XRtX81Bx+z)mM&gz@IFZh>}4=lHZ_m-S-r=eqa%)&4B zU%!*M^&G{${W^+CM{B?!QPjr_X!$jdiZ=VkgkQ~Y)hpH)LaNk7!=AYfP$34#J*^&~ z{uHjQ)C|{jiM|WjU~TXP79jACqVgGejKF@<5 z2MpDR*XE~~{U_~?CnMD`@jEBpuGg0+p05ArqCa4Hn?uZh^M~+1LrXI=GX6((Vj6q= z_YdJdx9$#JWAH#Oe?AN#1JEh!Xgd(6!7Q8dzN(hpu@&S5fj%;@h+ z$gk%f5Ebt4;P`N0qv6xGULssttM!w7Scu z^XE_&qW)HDsA}PsNw*|=SG23c{db}F#cshiuUD@m@jmSiNCyXDK_oxIQb_{&P#hW{ zuhueDidp9CS-M zjP20;aw{rAiE`8LPOFMY`|K8~V*C}6EQJ?lMV)?yJ zDpN$#1d8ou&(ciad(0h#TA|*b@LAtaEjh^^*(Jn!`Z4xAioP!H{`Y(f>dd#j@OyWY zj?@N*oN<%~{Jj|2y+~uw>V$|5uRd2 zi2?CJ+y$WDse;KCI(n1IAhL*VADcLrj28$9N_txU$gfq&x%Wh`-U~2Dm|c|uaTQg9 znoLR%OII)-0}dvJV^+@CFPEGMplKx6r|wmA)nXHb7(YnCeBY$9FNXI{78mU-N!1+$ z1E7h!DHDwh9aiU{AOLn@w*-p{MGWz*2xbggXz{VY)euPvK2F*AQ|;}cMWl|x^f@G6 z*ixD8*rwJ@);w9{`Fu;;vWg+|?aseH;GGn?jZp+sM8=&v9{$K+lh_@!l6;ru6I)(UwBDi~sfbpsV*=n)+IZv*83D2#G zkq1LFY@rcTvovIbD5?S~#KJ^72Zua&$;JI2-ZIT%}DOAILH*H3!d6yJsg*Qf}4bxamTyl#qjOgsAwQekTE zWiv>wXr+gBrczu%Vab&vcZB4OLr6lz7vfo!=o{o<-?pRZd~eZsIxPKV6ha)zz}m=o zqZ$z88{BohR!mY%(!{j8;vp0ef0bOp!Y6CG(KFK0I(iQrHpg3sYHuR>g>|{69EI>; z0WNT(Yq~aR_kY+M1vCsjAxiseeA?WQiwFxDAc<@m#D+}!;Htkht8zuW~;GF=w* zjyc4X@;OpT%@_4exeBenLdTrzsMPnp(4fAR#NA537iN6gd&*M1u!#66PGg*DfI4^3 z+m$+LA}HXE!I)TgZ*xuh0_zYmjdMz;*vJVq4imwliYx^r!|SRs6bSw;&1SCY^)hU( zc(9r9h?OwisIz=qM!42FsWnnNp%_byI&NaJMj4(&eU1_ucht4qL6SU8rNPAbEH8Yb zwX{yE{fr=wYc&~zj|jWUkbo^BF5JbHIFV;Qx=mUPvfKj*00w6D;N7!WTKGQgzE zm?&TSxe|%`lsjmfMG69RT}4eQx1<``JrB@8Nb%9wlhjy-N;r}XC+rIG{VQLvlcBPi z5s{eLfO@rY$>>l*ks!prDN>_;eU`yg$xRZpX&#AbH)h&jh+2WhDv=W+jVP(m4k6>$ zw2iQJ*Xll#NM*D?hoDn^&}TnA0}s0Jx9Ud3=X+>1?MvttEdjX&M|$T<88&Zr zO3wvjRIiBeC%)qgu-j^`0S}Od4VgF?(V8a+*QL8|gy=@kAj%#rSFHgQ@i5nk2df-j zXcSSvNyX0+&M!a_Cgbbh7|t&gNsX*F*=ZL&sL@66O&)z|w@zV_YL^GQrxE0bIPkPv zmXU^zg2x622W!BBo>W$?j_HCuM^-wmXJ#C`dGsYde+JU(S-?1E4#{^3E-@Mx(qMl@ zCC5=I_6|q`^<5fao%|7|_EIxgP`(;A}Dds5vVUNL&`I(lG{t+qTQ8GNpc5@wK_ z)ow_J%SpPd5J}HuHqOe$`gO&}`uvzNHIiH}^FNHO` zx2)|!@~P=0#i-JffmCp@gl*0H_Dpc~cCZ&mnvjCs90SQer6H=0KTWoSt5tV%eJJNkz?U18z$6Fic`w?q%`l47Hy>t@>o_KLkg6Kvs?u+PWcfgD4=O_fI?I&Wm6!0$`H-_oOWGuAHSf%wxpU_dvjmEb`9lOpd|u^x`A#* z|5P3v(F0=^4qIH#dG)^J9P|Z8G`ZeoctRBs&JTm7j!L>l|x{JhVS%?Y9zNf)77xdc8 zqHfq6l81sNX?Lqh>KsSuyxw)Yh$H5l<@Pk(kTRX3+zY$OOo~(<(v9p@yh!jy_zNsj zx|ohGUCYjG^!i69t=VvrU;XCQvozUGG=sQ$6CkPa8E>>3mNEDCnI{mFKEVY&Lebnz zo6pHr(Qkpq2<46q0Iz=7+3Xzf0 zaat;2?WKufem;f=)jkyC#?d#^-F}jJL%N1a#(`nsTYWwj7L)KerX;;OV&Nnw__r>r zu67GYKov6t<;NbRTRFO>yL-+KVFHvR5EU;d);@p$Mz&3XRWqXtXR+Cxo`?{>=`(aN z2n*4@_U%v}2oT^aF)8v-VCeOV&tuHhs=5WDDvOfPq}hiOR`^0UII7TA4YlkgjCF>z z2n<^>iNfZj7?l?|_-{%4zEU8_ew$;7rK1LjyTH3{BB5L=2cr;mPQw{b5^ro}6h-;d zz#>ZwA&k))dGo}Z5}(apSRdcz7zg}Tc*$O6%oh$h_*s9nswtHn5FvzVeh6-m>oX#s z2@OkJu2Yn>%%8`5d5>~HN4nW_?&kcB-GUww6mNLEj~ljqzLtK0#p$*s{`ZB0k%58n zf8tkWV*SndU$`ml2^-4}gzTqpO+rDW3*rYhni>7vC{m%YMxQKZ;F(%;l@Ciq@O8wDE{Df;8~_JC&wg%8v{{Y37j@QL`_{^R9!cr2$5`EnPlqkMLEg_&C z=Bv=s;|P{a`BhSZl5Y;OZmvOcL9D$-HtQ}&2s(|J66~cl);JXI!9}5wAql*;a;&dv z{5l1JX~Yw>=&3dzGYb3X_tArQaWi%3*F%X6J2jvsT~;8nR5ob$m!KMU&F}5-W-b3w zmVeQTf@?!xZR+6zy;@cD2mW)~%XRWy+4$$bg3*@Ojt@rrDr7udM-;}me@zJl(?pQJ zp=(2cblFPE&`M}vph^jiiM@^@ET?x}1Vy%$WO*NO7#E_-{b|c4b$n?sg48>KG69uI z=yVq!c&$c3SglVbF^eFy&*)74TRn9!V0mjO$$ZkhL_9UyklN4kLADzO8LhwJP^rx3Ut(3*z!d)h0FyBAFXtHd5{DMoS@n9{V)+qf zrBo_QLkNT`Ij(eYq_RRGd@`-8)|`XOOiBu`bi;iwRtEQNybw00AiMmVOGqlEKHnxK z$^<A?=Ub2Su-y0jL|RsaX{S@(85Q}Tiy4)Q`~?kNf6OC>{of2EkCbn|eN%b@+NBDE zjBuE$yy+fLlHI+>OtII;=V78bA0VWCagKtYvDYZYT}Qi5SWyohfg{Q*m24tlJ)9CK z86GjT-W~ij&7n&v9dN|UB;q}OS|~;uW@(T0I7UO|px};US5%;jRqTtHGw5M*L$Wo1 z*&4Jy^sBeJ@RH>-xhuG=6Bui`a~7n3DFZg#?2a?b!8l)Ow+7ovaDzx046v3F^N%AG zDCYM;&TMHOJfhK99yuZ7f?yjw0oY#i4xiRLuor~QmncaDmX0|Kc+lj_Z8oHEvG2eW z6Owt=!pbs?B0^#6y35Fs92iVmP&FR2E#rKeRF+Nv%8Bx8Ap}eEossVpZD1aBU+q~| z;g4R1ADkL2f%d+ME%c-TwT$O_k3l3QX(MkrZ%f?gm@iyztwc{r(N5VncV6>^AqluF zE?7*xLy{F9k1}F@DOr#2<^;`qOC^E?KD6fKNdkz)8@!iFMv}$Kerk6{R2(c<cB%BbAi2@S^ zGK?VwUB$BQVCuHV{0;{0^xlNz*ax&GI|t5}!MZ8I(~u^^NmG|N*kwW5qf>HznGFjJ zi+Y7X!R06@`J-Pozva7(la+L%4VFQ7o19>|B6f}fejnKJL}}ct(6b(p^UK~_VmQ<< zJ*-<7uh@$&LOO=2A zq}a1*HAu83Dq@0Z5qnCBw4ys?8-Zdj5?-?Kr@YFNq^gTUoPhEnc&Ob?$jGCOcA312 z`*n!E#ExO)TxpgZVJ+q>U)11nI{F;O7;H+~7sJi`oyB(hHp@_6RAL&&E>+@Fn#E3Zc#NBZN_wSr`WJnn0Vc~j=JrQbsf3$|bbEg4kvgn>l zOl^tjt;0UgOKD9T&$`dLBj9XBS0t%f(2*bihO&%>HAhH=vrU9KWu#8%PEyUc)HMeR zFUQ;(YP*DGThzpTC7B_aBx#3KN)9bKMy^9B&e^Xuh?(K&(pNw?JaZY(ka+yxS4EEP zD<1q-VwW^Wdp8!6m1tJca4H^vs0>kemr{4KtqLm|ip+4HmOppaAar70Sr<<6s9{vD z4AnQdWn!N(jHr4&Nl~_}ZP2d_r-20+bd|^Mv*8$10b6Tisv!q?9(t-W3WnGx!f0H* z-BdpoR;}zSy2hNy581C-G+{{xrY}3O4ITBP(Qg=#Sr*b2Ca&5uXNVhc!Y%AoQpLOE zif<_37jMqOhDX z98sE<>d)ND(bs9dt3b_)p)* za`TjMjtK;lIvc2X!_7h|^W|=|zs}*bm3)7b25#sIG|O-@echHqO|G-toc^t^5Q~F; zc;i_rwcjOI@)qS|Hy+`TaihE63Ns`XBGx9Hb=+FvEkZ2|x*Dhvr3x)0>8f3Jg4oe3 z=hPT-AR3Na-ASj8SE%msX6KLqzfD%}p4eSR7wsJQ2P@HW)MkIEiLiskpdr_gM~Htu z6>+kulg7d?0m!n!2&^ zhg~cSev}{e-b#Rm-Z7FUR9o;$(ZV`L!S^&jVr^N!}C1%?w3cjI5N-Cu>V-vXZCx7 zOhv4m35@TW$sd`K-w`b#BeE^Y5%K}Nb|{29JL8Qc6V_{B$e5dL4OF2L<(Sfz7p-H; z0gQNZmUCK#qjtdmCW#}4&b?34cYBaAYD?oxlbX+e4|&!I=}Kq&%_I<{My3OYIEje< z?-Zrg2@eKO-nJnu?MBg)dqkmMsIRukXmid-U20$a0p&F$QU=mnG3%c)jb3)dJ|_WN zD=c1b@(%_piuOH{b}=mquDaFIjkf>7X(dBPUJ4L}AVeFKgp^$w6tABf)z* zV|{W=)Qb*~c{U#=xGOr|hyLM9sR^`$!)o({dE~U6{)>-||7_9%+fMA7dWhR4y4N1o zAY<%+nhLw&DGRO~3Hw@^c0se;0ZYZB1azc8m$f)r{fjJB@1;Q*1pAhT6fSs=H)X)M zD~T-3g{7mr3l~TSC)BcfZZ($0%2A?kJlg&HLpaVhP4h{vcqx)E43;DZ=I_*e5sK); zCeA`NJt_t3F6%bV8%T4_9NXn{+HA*VIh}tXTElzaxKMiHk2p+U;9rwAp>z>Ml5JbO zZMNmS`P#fS{SDL0cO370XtAUWYdXH8=m@2F(O0g(C8UP;slx5_VEO4qU0~IiU4NiJ zog!mu!cJGuS}b(2cvVsn>v=19I<^iu2xsdD9v9>q6oxRK z4HI*Ha3j5-U>2Ci-`^T9oaKe5-e#wTMSRUA2#jO|m+NSuhN}KJ4^q&`PP&>Tq<(0C z#6wHIG_y5eoj92FCx%13lb$YqY(j3YWl6lh3_0}#C5Sr)Jg1{P|=8t1e&{jrmrb@s0`0CzqUvRIsTkKAiS8Gnv$bYyD@tVPmM zG1#-hDj?z9WYxM%zF*AQ+U}nRf|ZHpUaB78oiVT4(ZQNJ<${`Rj;MIfW#@_)?~`YX z>IR{?)cK!u$D^$U1=h=*Jt|aYiF=v)To!vFo|eeG`OE%+VnUNI4?o>9RwWqu!*4hz z^P5#$;$PVcXIco*XN^jSv9vM$um9oJc1s)B_G}>T)Wh^B_5A7yrO*VVy=kSjHWlr@ zY73W7ypH>+5|VeOVbK+;xxawg9=iYmyZoDyWnzG>j791E1Y9!Rwv~a)^`fTM3j(Eb zz;#9(CKqpw|bNAE$!KfPq&v#9oK7wSoEw&ws)j(hEpqM`0&*h@;$d0F; zKmTch*V+1dx}BM@wWR8A%JqF8-}+29`)-1l-&5<|Z_bDV=EB1ZJN16%j>Q5@$kZSN zcTs@Du(M^9l5l}vVSvELR6al|d44BQRt-NWw&XN%Y-IahY~VHrullR@M4TX3<=a-u z4N!Tvv>6=~#7Zj{GsNJaZ@T^jNk!_hUn>UKEmJwXUVE{6KO^=92!r4GXx0)2f>;iB ztr`EiR{v3{{d>u{&^>U*AW$Oqdq-PXORn!fVd!!x7GSRp#It>JP;J@!wP5h_bSpO% zW13R+pGE70)Y3Beo|>mwq)E_)W%bWyWB3f+o#9s`k zHmMDDWPLgP@AjRI&I#6>Ao(nP^|t9MMstz&m&aB&Y0}COl27l|YT|2f)J0bKgR31#uB-UO-Z?d zJgmj0Xo>xn8i7XnN8`imlyTk}26!BC1Z66VYTZ6)r1F1#nw)#~bqxD|?0RRsmHID{ z>*q0_h-(Fb!MiB5nXIiD-aBvqESN=M@##tPH_juT=%Vmk!{^^*Y)M+@_<)+lYPHr0 zq&j^plBaeYRrOO{;r8T$Y%wQ#>!kg}dGCF-lF#IcG;uknX)G{FQD(VNenlFvBXCy# zC|birlmnT?%s`t%#M(zPayd%d?1tl)iG;4ePLxn+!Q!SqJ&J8ztAw1!WcX0&;~@SG z$OJ=aQ%8ZsNqMzFmB*<@o-_l?q`2U@T(=4szxfI+^8`n4FrDpW<^uOK&LwSMj?+p+ z+vsB6;265XXlV|Eey0c(sfs0?vFMo~I3KM?6to_fzK;n5igNrEodqp1{S)?9q0;p; zDK6A$Y~Soxr(%?@LTp61QU>%;;a0>rnjVBL83;7MfC0Sa$?wM>J)s8l`|!N~vaEp@BU#%N#at<=q@1szAtpvjOcy%77vT_4I%M)I9SLqnMA%Wg%I zozoWPAf#Si^6`L3Xz-d-kYBwvs^HKmocg@l7%qmS@B7}LT;dWi<^wUpCHacNq=N4( z2+6&LxFTTHJ_R8WQvSpb$W8*S^*^Q~^b|y3c+&%=iJ&jMmqnkM*R%HENP<#G1(49> ze&tIjxc2l3XFnVXBoOORIaUmH!-gV)N@>80gX)l398ZMKn)ga!I<_V5os8!)C@JBj;FMueq^TLopf_)>G z1vE{)wA-&3d|0*Y)1ss^Yfzi~Ug3IfFx4Oe(KaXqt(PGwt0&k^4`U{=A%ET;Z}YUJ;1 zB1&zxDEDgPfMs+X(NC*z6V*lpL4<7Q{Vp8!+df_Pazxl^cFU64 z>Zt?Ih-w&;S*VjHLG1wFYeVLazG96Vw${NRV83cfp*oQ~FrwZzuT1YcRrO8exWtTE z2Q$DzW`ArAREZsSnYxN8h>c;3d1U>d9bW?s5`#(JmR%^qi45K(sb5#lCW5o6SJVWq zLKX;#e0e7x8A&9BC?Z8xEX#bmMiv3eCE3;BsqBPg0fI$}rffP~N~sNVE~UUaCzy^i ze`T&j@Wbv`ow>OmNmVjWv?BcBMOwqq^_h#X-A2pal6<6eCEbX%fX|ET+8t|YZzSue z7eTvO(L7aV21eZ&p-|;`a*e>vKih}hSqU&xA$Wnh@CYtL#jhi?{=Om{=zMPs^+}k9 z8MZi`$I+Ji-jjtHt%3;^X0~xzrU(RaudZ|nab!-mRk?{Oq7aVshc;L$ruDZa8EV#q zW>6`)2gVLSAE{UZ@$$QMphV4b-$fWzJ6L8dYoP}Q`eb5Ruu0IE;vwfyK4hxW}FD{J+WHJ?-THCEh4(Stkr zV7Q}2&PV`*m`eVF#CmFUlZy(H{zvf<`*!A{lDN{?0ku`V_%bYx^J!%4A3PO@CJs_mi{xw_%e*$@S?k?NUy|yH0jHpyBjN~S z$qWXirUK-}TYV^r9&k@coFr;=5-~ zElzQzRfF~`*~69Ee2Rzu>mBxXY`-%awM6`*$HF-kS^*_^4Nu&hbChjZfPFQ;e12Tg zcp)|Rt9~82#Wh4UglA*@$Gf5_yS`+aoWH$gKZ^sc8s}*hT)O)SX*Mr@zw9Hw#vCU& z{KlF2k%B23T8fuB2O??KXb2h&Xi~{^TxZ5Mt0ZjU0)?S*sDGB2<3JHn&!W$L|9Jey zi5UTE9V$A)J}RjUoC?~+7U%VcnInO9#Pw80$aKay7K>YNn)89E+qoKZlK34{)b$BF z59N%_hjvcUKQ)=$Wy_R|nEoHKv@Z^y{*FXm4yc=zwKBCKvF9=X&hR0VtAEe;Cb#Rh z*c)z!4eUs*BQ+;-br#Sc)q?SYN9`D|(F`;^et$pO&np_lrA}U>Ts2}Kiewh^FpSJ6!-+P~AsOu!>qunA!~m$AR8N^*6bsiUOtj>9V)oe=w}K-!zQH3g+ky266xhs8S( z6*6ds5KU%S^SPW6cDpKR-US$ju&dBp_!-5G8b+6MKVe^08;`^b??!L^M8+vtGVu%& zp4j_~kZl1Va;+)dlt4Gg^7plw8ksS)rR#8DI?>Cf1f%6=?%|EKKx^OdUQ1Y@si-SA zIKJSns2k32XuOiGiy7GG%gb7}K*8A5R>WK~VAY~M;*OmQ;ni4wDZ>xf3ihAUKx3x< zx)f-8S5a_X3o&OrnSL#xQE|(%%acAY-a}?P8sh+NZY4-T+yaOWLgq|@H-NYfL{Kn~ z-8NZbYsm+9oO-L9gDtb2jb+5tN3{J3+;KWK%3=%?;ml716geUq4gD7_)T+cA{zSvKm_4%~!aw2W`kv>E$SD2acfp@mz)6SL(bW@|Z3Q#6b$;?mBj`Z((uAs3kexux zE@lh$%2_iu{Qw`6rei$t(<`}pnt_`+|6a&EEAjpW?0oCq+-TPhGmoarAYThYM{|$V zGqPD@e;;D*S^z5v+0+5Ue3C#&2#0Hgzecke4#(b`Cw4jXr1$9BY18mr^wLLL%*SUBR<;D)ai* z5s*Lo(OVMuLCVaupJ=~jA5FSN8vdai4PpY~`~TC7}C*^kq}Di~LhV1dy$GH*~v^w;cas zHV!|vg(Qu$R7+eGTEN(-Vybv`u&|Ukj>KE_N3C9aq@)F{L;w~u5`Ht$qG7>=Hx{Kb zjv&OumDT4useyJsMX*@0btDcM{vL{p7D<-r*VqI2Tn)hoScudsa>MK2X~VgYP#Z?*IPRnPcc)X4Gwt7qi+uK@^~Iy#B#t;ycofAU8*p#%om>XI|4 zW~9l|&!v}Gcvii|i%SS$XzR3yn@AQf9)a7Avk9847s|$!Q7(^t7@B~=-Jy@+A>)hw zs*FY5sm|fZ9LoJ03lmX^&b4#|ukESM2DfU{zMYTuj4?@U_yg&2Kez=8vZj6hnIe^E z8*7s}2%nK@BWp|e4QZ8e{T)+DNW|0hxlTKLlX1aFZ#JO*OY(mNqhhKvpT9^FQBBqC_kYUeaLlT(o7nMiiZh<4+;Hp?hF>3i^=(O zbjm83@0O{O!MyA=eX1v65gr763x?^8Q7+Emi0Xn-o~e|XH^Jj5YH;RehT|Q*XoT>K zds5q)0YpPb{<#fote6$cY?j~;JYgAI4!D%V9ao;Gj{S})FS~XeT0F`V#75ICNNl*J z^-cV+pauw1tJ%e~aYD)Pq(EYQ&XrN?yZe;o&GGZf&Yj+MXtj{;&JIGim7P=(C+~=Z z8ip^T}(A5PdZv58W)yK53To4Ux0bhAT5Mcje<6rw$eB^ z&n3SkTnP+@qxg3wnWH$JD~P3d@=x{2d^B6sO6p{?^lLdPsR}=EM(`Cj_DO$AJNjM< zm7Qb(R67*g1${&Y)T1E_Lv#iuyBL~D6~{Co&vyXc(JYCFU)D}4LBsB6k;33HBa~aj zeLr3+bPYU})PCQ0eyS+TjX+dUwVN??!jJN2xJi8$RZjl0B9_6>N~yC}Vl)OjY)lYG z^*J8-K|HgVpGS7E%rF|G@a&B8<5`ClLX$;zMUV&5?HLUMvqeA(NOk>5Il90y|4Ac} z4gY({Wu!C(j|k=7_I)j3kXNbPpFbpjF9Ci{Do}6X3d=2paN}5vbEp#XbCQ&h0{Ib1 z53*mudIBqE-ObqHU*KBFuy}hSBLfh|gx~4qHy8$u!EK?0wAth(#$fl#sHjlk^C_vu z-hhPR6>}MCAWbU9f}b^gvxk&~X**j~zNu>zOwy#~vAvFXg1_Pe*@I;J1^FDgLsH=6 z1$@v)hpG7kl8XuwimLXUW-Ju+C&TO7sT|8l6d^FCFbAyCi2lGgP=+yvrpXxV5{Bn_ zGWURd2Ak|gs6K0%8?xh)WT#GD8L(d54fYl>C*vHVcyx}V24casbN5895?a3KOq%5F zG6b519n@kee}(B0DHAM>6}2L zL`MJgT5ZXPUpFVay2FZD?oke+-}{4c-L>mcmvv8y#$nF#0U4FS?t^Ej;2RcMw;7Yb zF4+zu^;y+f40_R3M$gs#v#3TVMRy#~olJhoof-cww-1zOc8ASSgXXnG9S3cuNyI5y z-no5;SYf^W|Mxfzc>H`dEQrLSe!<*Lu-=SRptT^jGkH``3%*q^P>_BWd^4Qw-j zkK12gA7?IjNCQ3e7?t^d!ke*0>rMzTLiZii;X@(dU;5icwC_Fa*BkAhY+Kjp%~?Lt zsRS0($t$z-PUN>>>r0yy`LjF8)(#8Q0QnFN&^3n;w6j9Hot&Cim|gGCl_`o8X^~8- zI+g;!6Y9Kk^5b-$!6X9i$ySwOF@fP^P)=or4Ulct0wm+)R(zB9L8P5I?amew1gVkW) zvUf=+*4zk3JZj1xujo$qVfT_F>RoP1uIF{YKKK0mkG^Mkg7DeZIwrw(AWC_~5Q}^v z#QQxxywiNt`o3aS`^VmT?$-Or)q|Jx&2Iuka~7J{=hl@Ged!N_w#X-m$bnZESis(3 z-u5UV%{~aJ$Vaiv180o=`Ti;ILxIG;bqdhAMbm2JBj&dWvZG9%!MC(Vj{%aOdHpDL zC;V3X>sMzj1XMbU4gV3@JOQL0WoWg&ezr=^!bF`I51Hd zPGQFt%i4~2Z7j>s$p^+$)%JoN%MmBa#h6q2A7ChD%IGE`tAziwtNjr#W9?-Zbh~jR z??5H3ll)Fv{erTn!~R+ZHUj*Zudzt)U$Bco&CpK;DJc2qb&Wjmj!uZ0_Txr+D<%sn z8t6H$=IMrr5boAXMshuJUYgx=m+pi@**=f4)^A#KOI;TE@XI`o2e8(i&zA>C6x6=^ z+1@}Zr?c^X{d9x4`#LvC4i+m%v~RUN z+D9x>uWm8#-rg+z0Gs>V^HGlQ5MO4Ff#1m5G08GH>I!Er`Fpywgk-?&SBN(`IS6>ABoq^h&jj>^{$niVz%WL{7ongO&5qNwk zYDwF=ZUeRu7|PjeF{Wpll3&*R6{P#gI%L06!i-pMJ4e_)!j5;#^T)gK*?E0GcH8H2 z$$YsnbGv)rv}f~r0110n7%+tZM&|MJr5;U;OG__sAA;+^9#M1)phdH{H??agOa1=% zH(T0IXkUfq#D6OkIfIbOFtVTbeiI*LDztT5?paofz6>ujnj{WIt= z_wqRdCTk*&oiT@UhgR5z(7diO@{YJfDjNiPBtLf*eakSB^jxsRXuD23Aj4#nr_-%0 z88bumLHM`K*JvvF8ZYZr?9vL5|PkVbnrB)Yi%&h#i z2d{}1lHo5$Z#XdeBdw&sSj{*-pG^WS?X!}OJ)PiQzOt-y{bHmRH{_aW?tmZorw%KZ zSE1HStOKmtH*|a6Rqxoi+?rUw)CksvNLKeYgFI)bEjlr1JgK@1o@O`qo6mraKe@AT z{A1yg_0p4=oAj`&fHWHxDt48W%}-}eDhYWa){B$=$~oqiD#oNIr<%|7Iq=;}!kH_! z8T&TNGD!#6nI*jzDg^8FKewinySVOFvD56s3{)tPtdc`kwq4gNi|T?3^!_qtfnzjs zzCzm^WntD(wHAh#y?8$e>_!H0aO5lMd0>QNh&`0jJ!IOx8CtAY9(G=1Cu%T2!#B{R zE=#rslj2tel;@R+WL#!i(Y*rBTHuT6` zxLNbG6{35|-cv8dEa}!hXNLQb!nLdMW!g(`u4BqN3Wx*fdZp2W6xz9KGh1}#V??E_uO~WZ~p% zxa(B_nNwaXE*JBId<_JBv<;%<4d#J@+(r}rXPJw$_ftpghxO7d`}t!@)N)NX3Pa@t zN*ilCl;4eadl~>DI0MZRosD8vS?&fVy5c;hQTt&34-{L&wU2zc@?_LRcgRwn${-zk zySI)No1;n_Y}b9bR3Zj_&@L8qFwSgRG9)5(%iws30YCHiL*-pwmCH)1_xgb#P}Xx=Kqu<5As(!!4&fUV?QwVJg#p(6lm2oFSNHzLFcx zkc29gs=6Xby0`;IR?2@rIes~f9c*-ik4)|7o4?u=ct$UA*eHZ8xz~WulXf+#gi_=0 zt+);-qsh*;qW4bfn_Gn`WU!!V`y!pn(7t2mR446F{++uXb_2B3@wsHO55~&yuz~X+ zMO#oBZIxD+$&TlPFJ?3~egy4KkEVUy=_ZRcUkzVUB96Qur-q4;Te(7(X&ekV(<0cV zW^`w#dHhP=*`4xA7zRyoAbt)=$1-bqp?WZ6A^_G~l3N11{9kt%jdB8Z(y7R>U`-@P zOnPMA8Z$|Zrbp2n+txb4>aCYs23Tu4MvzN3Of35n58IE1v!-oI=uY~Ec4tfMd8UT5 z;<0BcXjKR_wu?6zTt0kIM$J^hz3g;;zfB3Tss2#;O}%>Yy)x^@v1#pTG&q=lzp z^^@YNW1nH!VXwFEYl=}i1*SQ+HlhQXG&_+PE{8#r26+`bfc)+Z$}Oj$?N?Wl6{BUZCuH?hm;UuqN?D0bZbXMu5d>qE3j$Qb zT(F$rjh^}tuFST_#{J=Wi#9Se)!???OMypDRUJT8x#~>@SW%VymV}Z5*oTQ8PTC0x z59EV2dN;ZU)LxAI5T%zfH`vux7H>b`V%=X?cflfe`7e_caMZS~ni*s^J;qIDq$Ji) zHmGS1uWNOu*B31mX%9)!#4d-y^ms8>P6PZGGLM#`)?2gP%uV&Ql^(yS5Ue_FL)f*g zk98u7WqTWMRt2aLtgzk|s+tFW`w$PfK$;3B$J!@BwpbsHxR8?9kymc6j3Jol)DcBD z%$kYljI7YdR(k5FEG}MR^N6^DmcEZwrHZ!1de2WGb+{ca=Ir}3v4?mJcY?J#d!$t~ zXorv7*9SK$Mq{yCloX*=wQtV5Wd&vT!DMCzg=buJkj%H`8xa%54Cvqh@fzY{$t242 zmU5*2!A}V6{##PfVOGi@$Y)dJo7&3>E75@dCFEZ5QEs_jnz`6)J#2pmQ|;1kN^OQz z%-jEDkN;0i{houlBb1DHP{*<9Mjplmnmd(V5*npH{Pr-?)!w-${F}JQIXI+q&b2c8 z(Nn?B4g=n)G4Au>I?js#zeSzo9W(X0;(B!zOMfE0FPL(}#0p0a^oeHKG>`!(^0_4L zJxlGDE`;@az4Xtxu`_p6-d4j^s@N&7s6cwmEzzVTgXOCWVDs=YKQTTU&X>51+mO5A zfFiBCV}!P>4WCu8C1$QHU}}eSZPas8Mx9NyMh*b(7<(i{FSS3)ll0DJ_MB5RKu6*U9pS-8$KiSYNDEVxpA zd4-rJaW!=a)?_+6BF|bj>v~vAuFKWw_L$$nZ1(1{MUW4oP)Q?|-VU9cMvK>;gCZ{C zSB~14saS0yURJir*)Nnq$3F!)({9o8T&eKyuJJt3P*o4S)`Pr9G9X`D01;oEqK-&|*QyYhDh zd?Y%5G3AqG!-BUXI-BnJy{r?HviW#&>3Ti(Ix~E%d>5(@S2FVNpOg3#d!#{Ut+t9C zo#U3er-E{`W@@Bf+k3N@kLB2WYUQq?BN0#9pmO!+bsL@NfWXp z^N=nP2q{wYRx__`klsqwF2ot->6ktc1s@zN9l84+*UhHD#dYcT)<}qv~hbiP{8=kepU0_qaMs4O3jgJU;7>$!aE9My! z9A}-mw-}_U-;NQg${0)R`M5PAmZ`?P z78I{qnE83dTX(*KB?!`;o(z}dwVSt0IkbBdqsjgH8&7k+f#1z)BAq4UrOxo|G8Q@T zLj03FQlrA?k_7AFPq&nprQYPS2fsPU(Z=U3alhxM3#)z%sFEX859IPuyhdClc{Oh4 z%DS`di_(VV#~H~SVfqkqDAsF(ahSM20HeinW#t8mlL5T`8jmSPgf9H z6^|>`;EvEe^}O_o%zHs&yhYWYj`Ra69O2&SztU3AE|OOU9KD>Jt;ykChf7w{*T!#m z_L|o(GApe;g+aaE^KT!@vx|RvRpr2HCT;Zpvwb^~++VAJ?79!ujbibhJv?cW8?fKN zTc29|JZ^JXe%hu7y=SO-PPJ4&W=<^jUis#io3|W-xxnBj9bFWc<)kg>L7y zW}Sk%Tr2i_!p?b2xG)|cz>Sf+jz;VNBw{Uc>!5c&16Z|%qzD+5?B z*W?;7Bw*vysblUu_7S}>$>#n0a{YsDByU5X65+C>10P_RYm@P)M1C~$ocDl?+u6Uy z+HtwtUU=G;gE`HXyMdhpASEA*AO)!0pRsxaVlP^y29(=w)DZ#w7VdLFGMDi4cM$m3 zm#v+*_N$|nM{C(;CeKzvPq4xrJX3>m~CrUkLHIqY9wu%>ZT+vAy zV%3s!i%y5`5+l2I?$p!S7D-jsd1JC)uJe+A1wZ3SYhGmw~kz-!M|;h5gg#9lkbt&_DE7Z@Qn) zPwOi_-7#v|3|G`>MVF3UODo>pQOgWN7URFpI)v8odAB#mx zdT%-!AC@1M8W}o5OTO@y+m`|fDn}l@&bd7*=#GR6;L9Hsb>4gEn|M$E`)Qt$k>!7s zKg`6+!0~^QNdGa1{c8L9oj?3-4#VDnL33izL)uwi@n-UhlPqs@L)?$_-R|QV)s`Hx zVqVZ#3+U6Mq5n>MjfK-@|HhEeF)g_rKW|^Sy077QeYAAGZuf7Gdrsi&j@m*eVwVqL zGbC*239+#3UvA!)p^o)z682RpGNILou5Dw~JOi)scx^d5&-ZfGh#+|PV*-bep0B^} zgYbWDcO#$W@p^+TpF`lcXP?h={&+8uzHh_0|a!+3U#1DXcF2$NPzS?Q`vVT6+iY>55j=z6m zl;%p${W|`(g#j(8CKpEdd`@yc*=8Y2nhFMiek0YSM1OR#G4!_hpL|L9y0I|ZVD-Q> zI&pftD3syG(7GvUc|}B1CL-mx)JiLzCik8idY!p2`x<6NxKzDpUUaaL7|p?Sos)RP z+CyM2Pul# z4%8^;*k6^dChrDal=TxfFkh_}zD$w>KW9*`lGz9w;Aq6^ytJ~5Md_*t7TQockI#NN zD(3>^?;|AO)-$|RHkb@`oPH2muksvBl{pAHXE*yK26gM~7IqRh+;hWFEPhUQdVBUI z-HHm<4iO}qGoKhAQOR3I=jf3zpcP_zlu5iW%X_lmU%63&>Mj~qR*%gpn0_g`-m zZ@!#UQMB_79svb~lMXf{`w`Z|$)MCuyy>@~;V0l`C-equ`;X?qlN)4go+E5J`*_DA z?_l+yy;vmt>TKs{a4qvh2c>MW)zMVdd9oXSu8%70%BgIRi=N#f0nP>(jlQN$_X5&Adh(|04NULbwvYYAooJ z#IYPZgDdoTq(=FaR10f7noGJc&*!0M30>>xIrB7L41F_*WX1i3j^Kai1soK|r+7Un zrBL3(A=>_4B=fg%CxGlo2x0+qbC7bf4|ESa&2TMR_4D>YG< zcuwwxNmkzjj2godGAWEyJY`}+h^V0KF5Wqx+yS>Uw~wZu zka6M5e3Cc`h8{6Afte0~9IjLpq5>Op!b4G3kUY*{{aO}pJzesXBG4XvvJnNZwD?%2 zxqS{#KRRnkz?t6=WELFU)PLq&L1kwiklagHP%ng@#oBtiPcT29Rzh~wKC5X2D$o?= z04Y6bQymcQV+m0)6jq<4>3u6iQowyTTttexA(HER*AHRU@2kqSTHLxTXdu8 znL%8``X)|FY4;{7?JEz&p9{rCY*vl*2dW~HcceUio=&E6a3%kZPeTldPIqVMSsL_^ zoWFpC!{)VN!LA|=qA)tLUV2n;SrzA_eGZd;h>9YK$U=Ot`SML353^3JYQngojqet9 z7>p(OaA#Vl7gxSuf;8@$H@B{N=`~h6nnj+f0={XU9@Jto7Pw4ord9;;Uj&@6Lmnu9 zhTo^^uFZmM>JS_f8@l@-*x18tGk0g>(lgSvhw3~tHnj_F^>F{q7=m>;;MmjIdbE4lI!K_f>oLrfgU=_Q}gNN4W7@O$+u2qUPFiaIW z>uubl-x~C;)+j~1bLtmjsLgv6!t>E6dQ##RViukCxbe;TOQHb2GVa;RbntKmuD z0^l<079dG)i2TnKE`apaGt2Cr5AtYs4ugOxms>ZmX<=f8HRDxiXnj6h{v#4Yin ztxUFwCS?84ER`~BILEqjXs(mbz1p7V2Bc4KkecE%i6Z=%5uMQBXm(q*Mv~*(1zD^( zM2J}ELtBGC&+di6RV7SYv>TNe3FJM{AJJ1diN?d=TCY#z2|9vn7uw0?nFTU*G(|o1BQJSr`yDeaF zr)0>50|s*1&n2Cmgo z%L0Av4e_J3SU;n1nuu;PP?LS45rvO3PL4ng;h^ii_fWhRQ%Q6Ga|yyrgn0B$*sZi) zA`uXj$Qjqtb1EBlEL~9eL0Mo+>va0R7(3@6%YtUXw{6?DJ#E{z-92sFwsqS!r)}G| zZO?3f``6ppw=Xv0L`I#gxK)vP>r@X@@}Esw+&f*6Ko z1KyJCW(E4sB6wishc?wo329NV5fQK4=)%AraK+w1Grpvn;eIB*H3<-RS~AE^)g}BN zH-Un-?W<bDL!FDbc`*w}w-7Zu`%FU(Fec4#Y6qyrzSHzIceEkwY#_?2+ z$|pUJ5;ZT`!gHoP=GlL{uvUvY;Xi_V!!nQ$eOd2bn&Y>ea#s6GrkSzjsvIuAw23a@ zn86s8i>}sNIL0dZxrAo@C0YG^Jy`FH)e?O$H^^4HcL@k&Qxu_;6ShM5LqyxV257a~ zljqgVO~a|2_-vj9Ee;|Y57UyBK1AAJTP&+`Bfl*n6pF*EST2`|HNG`Uwr3ZjNc71a zSE_KU4)ar_rGD97XN?$w9NUwEvV47tg|Bd{66!aTzz@o&!KoMg(Z& zY2SUbDaOv%4^xSoeP&(APa5&!ty;UmHz%!@F!`R!A^j55ijSKMSXSgU8mo=fJ2A~d1Y z_%-cf`NNAig}D&#y?aTR4@gtwYK>3D7ppkAgfogG4%U3o%Fn73nIEegP1JMqq`Ofb z_Pk@fgcryyk=6xA=9c#=4vKXW{=!_G_`RhgT_=g_!o9Cm9p&0@tYbH}j;S7W>(Rwb zL}(AQ3Oej$Ji^+CdS(+@3L!SX+uU$(!WD;5KXlur_5^o$!vy2em6$ycS7a*Vn0vEz zGgjh_&2_ak31p^xP+yKp#|wArOX%_hDS2aR3BI;na<7Zt?fUx?0w$2z;3~ILFr$36 zJ3Tev+wq_B%HBDMWbgSk`K9r*d&0*jTN@BUUfufoWxoTN-S*T_X22aR=GpIDn&O+; zuO=BUvW~x=B~@Yu!7yU}AQfHBkEAk#&#MC8gr8c!>HfP1Oz!^@{PjN|f|*$V&+McB zp!qo9dR{f&5JkzKF_^{xf}Mg6cBkr337JFPE{K~l|NN*UmC4?ju`L?LcwUCkhF4z` zU!Lp+pw9^9<>hA}_6MK-rZV^dW_P0x73vn_do!Sgz@WIgXBMGj756AoKx%UI>->9w z3VzWR6fIa_$15+m7ZmZD@QuDUMW*|HcqK_MV0#Ek2teJ7AK@O#5${M6!bk8E9OBdL z7@b`WXw~h<>B$NRBiHplT7u_{G(2L8M@%HF1b}5tM2V9|2+P@tpv^J^7NH) z`@C0)1IEOK_ABJbz6j_3c%nW43ZwI1^4q~d2+ z6Ea9ilykUT$R0S(udAxaafT=d+Xlr&x+B5~nZKbvw4;_0&BR2Un#6KcpIZ&EB+6q6 zW--WufX4z3sra0OO|NRkvoTcDGW-7E+JptDsxKoA$n_74sXmAYQG|!zcHne>qiU9nwnysIw1n*i7h?mnEPEd0V~>)bC*Vb z3lvbn89#+;Ry8MjOxGLBy*Ohh&M+A#3Kf+Z^m=?Z#3`kHVUKQzLRSDGrP%01)UE2o znfu*KzxmC@I5k+1^IUor8$yY7Nk8VPa=#KYMa*CTOQbWuUL|jcYpMc+`m_SYJY4hv z3OhH9d;te}8&P%CiuWTXSj5tb_oo+*83 z(f64y)OO=0%*eNLVfAXK0#3UBoJf(k+^7_imb=_8iT-@AneNi|*q z_G-ZkSOb!-g3!gJ(VC^VpdHG_yhczbT@p>IwT_Zg+ZULMAL5>lnGi)(Q@l$}(~hX( zrAl#52nIA3+46(aS{!cT!1i zON^-{&wi1^)hzxDNAwI~WmI!YX0(tvK@r^K7z#`feKl+oC2(cE*M@H6ml^H^n_UQ7 z@UgbX-B#^DJC8xOEvRX6+Sm}A+ltKzo-(~Y^aNJHnG9>Ky*n6KRL#dkj7Btt_e#y& zo6_Ds$HK=nw?P&Nn*QU*u)Z65+Ib6d)V@^L)u@de1>M3J5A2Znsuo4u3j<(R>D991 zO0c{IG{e$+_5B^1;bjzmYQ#Qm`?-x`b=zBnM(qn1Asz@IiZFye&~HmC;GoDdY{OVk zIJ9RbeL+(0JB&Rd1b&cckdhUmuUl_S4re(t7z<}t$P@Hl@xGJ=BqYtF zQMh@-tjwyixQjQ$FO5Q5f?;Ms9+c{~fID8J4r(%?7^kGTuw_84@<5J@V0MK%RIpB1 zCk{wGiWO-P2Qtk@Lc}8bjFHyzcP%%h6HG#OA;D>&urI|ntj$nYn}p3TvD*Zc`Bq*t z!jHU8Co+1^-w)a&9eG7GsO@zBwYj>JP_awa{33#){%vaEM(QM(!*4_ z)bkH{3n7oibAN@qvp(5iZ}TP=rJ^;!;GPmV)QK;HdZ^Gb;F9EO6O!YXuKRV1wO3*e z5eik+AaeZ;eh%-mUxnW}exj*zK9S9Ie>n06gb~rwz_3a0D6+OT`P@gN(DDnnAQd+P zv=Q@?Pr#Ont+(Ciu(HE%JB%)~QI?dUTN>vHUaA~X)*|r9Sq=ZJW%#o_6exH z7rYySEz#j^Bh-^>;m_uk7WsemVVcx@bRnf_j>JsU;H>;tzmkD2P}JV|YkPzL300}x z5f1R=m<=eNNkFELdIX?)Q8ytZIlLkm2>GVfi-6FX2N_l3glmfRuD71|&=LWB&3)}K|JG})$!isGLHP{|M=7HH#AU4kwGrk~{Xl0U z^t`GM^iffk*KsjLZe|`uQcSg4r_)A_q*rcEOj z|FEge#)Cje^s+yOhninqd#VJ-f(Wu(PXZ*Q!jtp^Mh=Tb=JDlPq}*zF-IgK$Q2RK) z&osQup@LbHE{MFDbCYkD@Dt%sr8IAU&o0D_%DO{+_4b}cCB#Slz48{1l8&O(;bg=~ zmBFoJ@qOFKq^PAnw1JJ|id_vgFQbfi_Ib7TIkkSbUmjQL6@1^RRAcy6y5b=4g_y~j z@ZV-FbN!dB<^N~UI5P{!{}43J!Oi`D+*C~K+Qn~jCH?j59Ux?d)THl84j%?$?et#n z*zVRL>)_pk_!P2h+KjRrPdJkQv@1gjbpM#`v^8o zr^#>vV1yY2&9)_MEd!s<$R-hQ0&60SXu#D!4+T2N+F__m)qF-67~iods)GH~8mx~i zdRGtUZ`b+oryrSZUDz5X?_cmQ8en%bfjn3cIvkyFfRvpH%vdyT04fLZ$jD% z!6pkj+ON=o0{>gyfg~OPV*+a=1!8>{I;CbA8G7VtIUb6(m&x3c5EaO>7y?#cI7L@{ zykDUwiRoc(56Bp@<};v5EQ-fcRu06R!IWlIJaGcRkx}MgOhn$P(z68=q){Y*GK&7- z*!fyuYg7wPF*c4eXxD^wVt<3>j)O85!weR{Pz((~VSgMANMdSR8#RMill3$NHZs8; zqRk<>84S76kR#-km3eVqlW z)RR$M4_L*rLs3{@pP-1$U{5K6{YG#pht9t6RAi!|1` z7%4i$?HK9?y-|h~;5EWnzetyr4~%mZxWM4$C=RnlL51MHkv3^LGB{(QHjH)z4Fzpw zCJTX^2yaaV#t}i1VH-w3f$2Je{Sp#HuJ6-FQp_1JiKBo3Q^CMNbJ-IL4%!D`g4z}s zGW8J?z$g>^22DmaP1X&2qlF>?2?^DQ3jjh>WfB~a3mpW4*1?SUR_-v|L|ZCx^JH?i z#>wcOV(uGACL07Q6G`?OUkWBvtb>Uop^iv;3C;v%B`+|M+D}YYo7|&XQpE!Wqq5A% zNGUM%urv+`J&6>s=2;^<;AC%zM6POvG@>N=SE$e87(+gK%Cm+I9YA4R&xS=5%!uNx zOY4EcuTl&(W6j*xw@fw_F~B{-1Lx>ywV{Erb(ElK^vFtlL~`?BaZbOs!-F9#vAZed>IGp7GPf1`>Cp|}?Ud_U5AE8K(v>3dybNN> zJp2~dcTIJ(=LW3JjQ||6q8JXqy3l62+;mlwGfl2llp~n7xRU3-Y}(>ZVWbXBiL;kr zORdJ{EM<@7=OmdOej;;J{5t2}Wd&b~noa_X)hJH(dSA{Q$6-IYx%ur}%B*&c9G!G(z;HNr9QjacbQ5u3iUz6CLU9Kv-f;}? zVC_|uTX)qAhXwm}_Du-Ev0rBEE>QPJ{B`A8ES>yGW^u|4^9G#cXcP&YGwVqEpKUr$ zKmWCqPF80Ztno3eNPLiZdB_w3b74?X_S{+VLtGD0e8a7(PO`O->6FU-%j2TNzw8D64hi%0v7k@_5 zd_QU5T%KHhyznsalP}cGW4?l(GTUdX(p|GT&q$nSHsMF$?D72TBe}o{zS%~3c4jIq z0mdQVVkWZAb$aEO(kr%d28BIvb5-r@(fPHfk#?IyJyhPp%4*4g=_^SPA%k5@7nd-A?MlM}@wpYzD{tkxmnWvK^^+wkPt42d(w z{xxo&ctyKI`s>oZ(BsBV$RsN+!|u4<;3i-y3VXZ2GU~h3&-y!XMyCjh({Yp?Rw8q~ z<1@Z+>$B~7r?-nfOHHdw!6W7rT*{L|pInN9^~&I=y(9Zx`p7?O`;U)~8#gYlf$8+w zloY>!gIQ;V0Qr16bDq)*03YANu|)bawN$02g!CyUAXTmVFMy`e?UA0 z7mC{AX;t8}tntJ7Tt$R6)9_&k=OEA3-fsnA_;=fvs6}<-54yd@R$%$r$kZiKuEI8K zHT_?;ErNIiDT2G3J?Rs=l9!KF?JaER9`=qN^TyQOi<+deAHNCCSFPsi`{Wv9#*89S z|G6b93=CMPX~oHwsetR{5t3X#hXrN3>5K>tC$Dam$>H)lf`PRzPdlnX)KUaZ()#;{ zkw(v<=+oQ##z1>==B14wOOPG$7_ct?q3iT!p_k95hk@_iXRrf5+V*b&X-;l@P|&s~ z0mNa(=FLif6p9Yj6#53#6ueu!_AJ5)Lh6a`$5~g_4LTA(;eMp&tG8dZSs#nT-6)Hc zU6$Sj1rP9d8<^LXH#`C`oohGfJKxG-k(m8q7E#k4MoqkFb~-7HCIVPkhiLxZy&0KJ zWwSCoXmQsvjd06^!gCg?YDfvX(^z{5@tqGPG~Z=T&n$mrqqgRyXhi@MS6i;b8-$zb z3d2z-du}@Vgq>XY1j2!EC4CqWqja7jxzD-X3ePyN?_*duDVC_&`3)=XdP=U~e_x9R zF;0&#egaD5{Gz0h095#y%nqM2^UeM|o4C0OYJyc3GW-7g0vdkTRX5c#Hv`!S=G4@} zv7q*kN;e0x=3Lp2Z(BE$6TOs_Yq26ariiy7_)#dQ=5>$5DoUw#oKg0&mvEutAe5?T zvRV_VPcg5Kv!gF>cXuAPN$vqOIVvR9Q7p1cKHeCW}}JS2Ou2 zgNnC%?`rq5a?pRR&$7gw?bSi9+v~P7|Mu@oxPR~Go`Ac%z;(35zt6wDgrEQXvKsKF zZ)M25C_BzlLP<=67k)+3Xr?K78Is`-Y{f_|8T{7K`>x=}8zJWkoB1vWoC3lWQ0s8g zhnz=pe%TQ)iaA+|1qrVp84b#ar0~zi;eP+Z8;{&5ynh|`GOb1C6)R)*!8dff;>T#8 zr>iP!q`$o2;TZAK8L=y++RyIZdD+o;#qek+ihrmCxc+f#uBUiH?SAhjmIv)hb zKWpz&>q=$Hse#!P@3)rw2)`RVpO#I(o5}RFnFZ_}sP{jsc9##GR`Qrt6|x-)W)D0& z=<{a1(D+Q%8phJB$Q~Y7*Zj&~34I<_SLHYv%v@8j!yVq{w2=GLp>^$NGJW{oOC_Zp zib>HQobQ{LeSt5x%ID7=#UgxhRz2Vo03(wT4nSI)sb*Sw27gBywRu9IjZW$+ulXiQ z2rpLZ+$?tHo4tVZej#dnOA_Vmcz!gKyLYU?4ENzUgzz{8BU*6JigE=TR#SV z43AEVt*;!rGhKJvWEQm)=z&^eHMZ*8{Pa&y{zK$30gY`MX~LefnK@aI;Sbzl$$^ zlXv%@6|bO+Up#C1dZKBD6+BDwo>L@Jco^mNFGFnOL6(;v5Xl1=nm0;92t>$sk#uPv zZ&B5q)U7M&G0Ay(XC;q~Q~jZZF-vVA6npx~Z5S6yQ*pbHIsNvLA0k0nGIF4Et%u-2ISY*w5G@x3fULZUqG2+FMhQqE z7X+eC0|G8sqsOD-)+P{OeOBaW^XsTv?JNY$2H94WN5K;}+eVuk(6#;be6OHJ2ygV_ zV`cr7`w$ke6FIf92>PPH0Gciz3(j~BwPJ{hTCg5S-E9me~d~I#lS}J$Jo<<3!nC5)3B9i zmciZcd~?FV{TL(u>3tqE6aYAZb^D9M=A|)kyYdt_xHY#&!eO6fLUg@qw#cZGif&Z@ zSk>==k~2$+jrp$Cc=-6cmy~HB#AM*~4}#t_vlFg)u} z`r0h`yRQ_q)_U6Hh{Mgk0DFy^Eo3za{kqM+XW0cbH_%`WRL!J;)#0!pMCQjXAG&NK z@yq-Pi(Lxy4;f1ooo{=8gByZzcUqR4ZV7h>ij=`CYGa>=;np8|(9`no+iWE96|ojw zUlJP+YN-8sRYW-lb_4UYu=BdNgVkdEEj`gw3^z+j0^GK0`!!S_)KEQsPm)cSW04N} zjnhAcC6n>w*mI3ry@pj>BA-#?&9)8}mk;}Zr^(pe>ld(P6K6iMm4XMOxnt=!t41B! z^ua&HefGGP)!|rpd>FR6_u?Nff(?An9FehK)CQpzOTLp6N#!w;&iB8iKE1XJ zT=C@@Es)RoUAuF9v29X2nN3qd<^*$hu{@@s;XBQ6{W|H==!v}6`xo1G0XE%NQDtd9 z;L^O~OawBb-o6V(-Y_0udP*(7O0`EQtBzZ#5%s>;&=Ack?@%ph5V|$71nORCeI4lr z_wH!^w6TbYj1t)O#TKx3c$mKBbn~TIHnuT0$>TC)@RS z{9ut9k#itHJU(o=U$5jMf(S3(eEP|S)J!?qnqcvQ!Nl(WSW~n{eT_!Zp?$w8wdCX+ z>){?gZ_?~dHGhL1)9=biD^$>XrYHQWB|n7Mi9T;iWaWhG?Q|2_S!@N_QRpONY3%8R zZRI{P$Dii;?JW&H6GSnD+~;V!}&g`n9ZA~=80NfEK+ZG z*`F?K2m%^7$}auY47HJBH^hG&yN)%F6ZL{SS^yR|B(Qw|iFoRTB1lD-yBKOVB?C@N zYRkZFzOWi6OhGeexp(WB@*bNcCekV@GH`gL+{|I!yf=}EVdXMN_#-XOBxG?Ifw{Q0 zY>|+YVGxv@#zXQWn0w6P=Y-B$vdV_b{&&ci9uEl0d2D@NTTy4M~$wfhS zRQ`Zy+e)iJAR3fW%h={RS6)8^5F*~`u@;Z|{_&Ac`4GVyI4~pdk7hu%mCi;$gtRM- z{=BFt=h-d$e#Wr59(+|Fh!lrg_3OWgEne1~U-f*LuIEPts?oqR9KE*AC7!Uck!U}v5qH=iW zVn+CL#{?HC^5FJ)-DsR-`Koy1ZXtlb5C-FrG8(z1_vpsI$!kjDyTTHYOCtwO(~r|d zz5V?9yI1tBobMi4XY#{n-EQKdVRgO*Ifw29P!splYweQ&m z#8`vhNLcg%gxQ2BX={7)kM=u?2xzv&!{UNQ@#&cLCMJZnXoqAJ_WI-q@d{ZMq|=a9 zO4Jv>TF_igJB{0&dFKHHzq${k9#b6k>!7BqmKud;s+5sMvMS5yqcbJ*677 z`4`Fyp(PUy7r`v!e+yXK0ytK91OeK?SoIJNSsYESW+MjE5RRDaVt*7#J(X~-?_W|^ zKmi=+NDu3({1Fz%v`a-ZSsY4r6yosNqa$n#Jj#u$KA?)(K_Dr%QP6^oiwW(4Y=oh( zhUX}fhV%@;WEmMUK+qT`6u`vJxHu2i6^0Qa^AfwjuI-}LhPpHIN$QDD?1J?|nUu%~ z6jYBtw>WXC4ABVpYGxrV5G{Yohcpw2w;W079<2mPUPyXRHUdMzkOF6+3F_rD6%GPH z6?WUhaDFI5D12ZN5<%g8+I0QFmWrcf1SH0cwGEhkdF1{2K;CIl;8$8SnDrKmPGUnx zEiEuaBd8sHYzjk3f-#iFQbhg38mXkSZNFLKrDKOdSTJBE8F~pGP?d#8B^_MZ(9osi zAV9G7B=s-Vgk$-Hlz#*?7z+^#Hk7GqQI~pA2#y#G`4W{f6<~x7kfKHi&qttjjE#&$-T`j#sUdMQ_3dM zj>s7j5xZJ;b*dujmAwagVF3qQo3s)vygs)nM|Vj%@q<~b0z;xJLE&So*GTp_i|Fnd z(FgrxyIkzkCpWe-tV3z|Plxe&L`F}mI{c6eNm>{d4?1i_iB&EHinfm$?+4ypNsP7{ zGfMed5#@7r(RQ|tnWbSJsvt-_Gy%lgr4*m+(2lN&LqNCG9aG;9nFp3(eyJ10TK0cB z26c6+fL|!)n|=g3tW)OrVszw+bsaFvT%uH?2I!D22_{4_b`H34n!g(6i>^Gi>k=SR zJGM@*ICp4J{ObBSaSX&ed(SAaTkfvDZ%6*X=x~2jU&IbT`oEPjKNeg4H4p601{)H; z+Gc;jnEOK(-`2N7?i4y3sfn=GDb=7WI;E#m1!~NIJc(>fGrgN5C_#cTZ%A`$upB2- z=)$KhLuqVsru4pg=qoKX!c=E6I3X$J*HO8bg%Q6(X^b3r#Iukk3$6Pk?rul&6jH%v z<${ARB`v5@Zo)$D*iVw>r9szu&{H1v>S;iW+if0PEl~np>U9WCi5Jm0A%5)fK(LuW^ay^^foOVn%zDz~3lI^Y1j9+=OP+0~M@4dwcW3n_o#DN{; z6%-vm-tgB6OGTvCdp@@)KlXFbga0PnLC&JDz8aacyP{I_tuP}hw%=oUTJ$X_uD!5| zqBx`sF|-f!+tI^*@MWLgew~Eik+P~~3Z5pAs2$(HaoO~W*C7Z_A8h-03*Bo8x_*=|r zbGJ;5qqJJlA8)kPM?sza55^^_D9ke>Ao8xPY66R6TGGr4)i=g)^GX_D2X5N%T5sUs z7wiW5i^Vpj8jYAH5pkWR2r=PLe1L!%8?MhC)PjGAzSOg||4pzDJ3H6^N2MobCf5Jq zqa8aZ6YGCXHObYTjwA21+c~A4S>WtjBfkhoGkgO_F-@%57u#HP<8i;?%D{$n%j5s@ zkS>#_=1(KLOJ^4W=a!>J5eMV?UEh{5jcUMDJzQMB%gDnS6({X{?MO6cY zw?bTECM@HPedoNO-{1At=90_DT%x1L1c|y$gX~qYZ4D8T)6!;$Fe4rO3l+1ZMSp&Q zQZ(F>w(1!rPm#?UQn=c(*|fgOGL~kf#l@xrpz+&k`9x7o2YswCfSm(}Rt~0Ec}-0~ zvOw4gWQI;o&lI>f&z^?Vk_IWgQhB^_t9_uSP$VO;n{HzgMl-3n+tlPixjI3P8xY;JNkSD@74EG)(SGW;f5;h+;=CDtsgIqU=G>9Vpd@)j5(zroN3{oJl+Hto8td7Qo zKaGo#Ui^ltl#E92JcaOTAx4py9@X+vbpDnMQdn`)K%hZY zux84F%PHcv+fbg&>nUb?RA2I}P=K9VQwqCKu-0)@#cI3Leh(IyJ5F(kjRb%wQJVy0 zCcr?fiHm`&iW&^$$&w{#grDalctZP?UBatMW=*Fe4^kzM!$u$5qJqZ6P)U`x{=m>d z*0*ep_j0iXk#(6!Ev-=Ft!zb9C>b0VcK^O`{`>nfxfy@k`)~R6Clt}+^K#YyyCn>e z-}>)f!T)XAzw7JaV)V?3Cd=vTG)-HmCU2sEL-F5T=kB)*pT+Ks6n9Qju!8%Rl~N@H zp@dukg+l03)Ji6q%!bs1gF}ArKYh^1J)w|9KAbKNZT@2^*MoJ^Yp6B$czoc_6+U!H zHvU{^7USCal(4W-R#5I25Aztac#E(ppEwJ99U*BLaI3w;ZfX(tmk86d8G=M(<$O|Q z3Q1|pP-8DIS(qoZc&R|21LmLb=rd@4CMk77o54|!H!Q>`QT`VJMt{$5R{>KASKs!O z{fZ*uW7VNZGx!?w0uK>YIte3%P*2eri<~JHkw?{xGH(%8$%SrWnyJNc6{9@A9^Fke z5bbt19JY%c?(FeXW-E%_4rh*?nQa8&qD%~s?=%1So7$MV?4UbjtB^erzlSfC8AU~ji|z#i2ttf z?=Z*L@)QXZ#j~x^6Rb6Ifa=oGG%}4Ou{jM0ZxLo9(;BsXz`TFOX@TCIlv`UvI)f6e1)cK zo}!8Jtry5*JQbmr9c0NGr$4*EuUo4-H@Y8p9VJh%f*EFSc*+%oPLoNVt*kFSC77x# ziX=4@`<4LpNXsd3iTWwjI}&-iS4bBzQ(Yf^UJW@>lODv1Vr;ZycW}MsQ)wx6eoj*L8AaYx(Kb? zI3y{8!-6z3alQt)_jEE2Pxj2>;mbs|t8OTC%|zmv=P@%qAOSIA7< zQ)2QX^VohBIA7h87l(FZ4gVlcDkJ-wfm1=^og5$(C#z z8wD=4+aVUx0JpwmzPx}qzJl@cAH&LQx%p^@vGAU~Z@^U%saW)1mO}%N%s8Xk?_w6dq}D8cuD6Ww9b|g z#egXSl>ht>p;M(@;b2nalMf*xcjiTQgC!mzLIf#~)})W7j&iJ|*FfbSf{Epgb(noZ z6{ivMqvhOu;?rpxAD!VbCaN#b!mS~ztFY@%(|&PhE-_i&Sik6bpWP8L_VYq z%iS-7tkFE=g}mPW{D6-{l4f`nHdK~B9xBu48`@!Qt9O#+>s;S%+km!{^DHvg zZ8CXt%`h~qskEQf_pHZtvQ`?O($%ck-?N@~8WeV#Pb6LRg}z6gTC#L_*E%3rS>dsd z`klt;B63T{Csp|;0Ip6M=0WMc4aYE>tjw94;uIFqi&^~LV|664_KgM{FDXZZ+DzZm z=tRr*{GFu)i=s!Cdid!ngNQKok!M(|r|Wi3*anBnlk1d9^{7jcTCA1Nf6I(KOcol0*z9bKX8-Ju#5bUT?S#L_zn5O5CWkD{) z)H!+}25`)ldS!H)q}}i;`m~EP6&q@+|JH=vA(vUZ6n=kooTR6Ia&rwn_XcaxhTNH_do5nC)~f+Yr?wx!VS>%nzu_x86rXl+Vv*E3nlvMtrQd!i|;ii z|1O{JpX!ODZaXcEeH>3ta@uVD z`~Em5tTWi<@AdnBdUx>u_n4oe{x4=kvf2Zo@$s#Tw9`PS1j3S>ZEV>FJqk% zh)wan6j$h{c8_%yX??>DuM%7Z{9;H6hW>s0$IH$25-3dVSllj2oGD@Uesvt1D12UcpL%EP|p<0=+@u%Fy^ocq4EKUf&3X z4iIj(EwHU^!c^zc0a~uO`SFTlNuTw|b1#Op?P8ZbwI-%pnXt2|&dm$94nNB|dv~Eb! zOfx95z`8~#e0(biAvrVu8GqyI%D3xnXYy|1{xVkoSlMQldp>cc-e>brUNX@O*0JqZ zuO7%PXI;@&knN*2@C^p4PJlN{Cg_%2Bkfw`n2cL}!(y%xB1O;?UV-^K6lA#;$3S|y z*=_Cnm>zxfJ`l&GI9I@QBQk>FBn6wmwW{Y~tsU2?heK8TYb%dHuAFR+6&bP_+l3~w z4|<-jpVaXfY+x*yTN9i#)fv!K5+nE>%F?kU2r6-X_Axig+Vlh7I;6!E06$%+@Wzx^ z8!GMWsc)Bl{v6o;rzPY63Ju>vicAMM5A4<1L0R%J^^{RON<1da&412)@v~Zz;9mVX zJ{@2EB6+<_-ihi)CAZT-w%An`;(*-ELU-%+qxPI2l1ST@5+|7Y^xPS*p&U8AfI2f+ z((9u~_2P7eWmk##U`^$LZ9&!#+BRDU|8Ob_L=E8cl=uS6;zLLS+u{pDw&0x1#l18? zK1ozJ69NXIuPM)7M?P4xzQ4YtZ7_EqosQDB4Yxq^fA)2mIpCUen71yjwkZiuSaF&` zyeY7COGF=e3LSVJ!yo7XKPBU)5<_(2+pq^y@;Jtx_|MwGUo*|`I4U|siBSzhn*tL# z0^$ssev_4gL)%d130b2`-nMDy2!~O zW=_JOH!41kCI!QGh@4x#+j@xE!SLD&@! zu^+_u_2`(_%o zMmr{?JRbI;z*+&F_@b>8o~so9hT|LnDHy+ig%meB;?F z3((Lkx6d>rU)iZ-F=HS*VL%i&bX(+R>CTedXUPP3sxrkV^l|(@4@Oirwz}kIg$k#S zHPTw>Lr|5+E6)J6W4I_iwN;P%48W7x zvf%LpT1LU@cpJ3j%u_}Pq%VI{E^SAI7-w!a<(m{ZO>(!=NH5#pyBzht60x&692_49 zehih+Zu~2_$dB5_;y~!-PjX^wz@;1ikd_!Rxi>|~bimcPyCBaulXh5&mir=mO(U}g zo=qxlsrirzbUJ*tMzpPeCoX0gG$3B!SH}f(3o(27?fsB8)@mICTTkmgI!UBl_~6pXdA2;qzxaW8LmfPmk~S({-J}9mhJr zuzX(`_Bxn`p=FMLI}hiDJ6j`sxOHL1;q7s<>{g(s`^)3|w(ZtI;QL~9lCZbyuh-{* zDIXG{2VPVB-_a^(1A%Uz&-dd`kE-j_HU$R*KR>ncyR~fy69RHk@7axRKCq20vd^=k z<{iCSG)EnqrBo0Nz34?q!jhDD&sFn_WwTAkIgSDDcsbH)OAUnEt_^wkx8o1DbLol# zS*m{6cQ6WqFRM|4@t&VEXH(&d;6^d%`cT4JolZh?z;+0gz@pc8o3bIsy0zsGsd2yU zU`vh;*PwuL%;zps4;eK;0Ar}I`1y5jNaKOxB9|U$0L;uKE z6t%0K$qp0>MX>OYU3mw2w0md4{lF(O1FIG6joG8m@3(_#G?zqkiNClRuu{2hNigyE?ILO?B}OEc<1zcaQ*@ zITadTvq<)=564Uxa)oO2jE};W*JjOU^DPi8^T%8Wo0OWcv6Kotn>7Nc)?5KjBF#1& z5~0#R%k{whf0lnpld6x9wktcYh!cYwW+4eIRL^UFuNycvX87S(%29dh#dGHZ*)M+l z`_k0}(cVVSK?PcF*I=YsWY-|{OYj;C*UxZ}*Wdi-{5qa5cSBtyjD6tsXytFX_dNn* z@k_IQLN(giSaO`8qcj;dRG34rC+u(kHaGlMyTOgiNwXKVds2NCO}pM)o(6q)&!F22wT;>DYp;B+zqk)s#^CqG^i6H6(_!n_9rDsx<4%RsSd`@Bz;$ z0x;FYqdYInM!WA#zdDwY(9z}AO(26*ULvX(E?n#ydZ3^AWV`(eM|u$a9iHNCadq@P zuP|KMJUo`XH{Sp0EaZ~^-|wnfSegDyV(R}p!G!I9q7txiuyOp?chxQ0TF!^DOztXwpGgT%k5p!3QA)S zRBB79WvbP`;i@a!fQ0B<(E?|rCa;kUOxzPxXcV$&CL58bAcIkRnd2d)YC$VVg3Vhq z1qdqLRlbPs@&?6dON~~?=p!3kvHF!11F=@AOLqcAfBEK_fu*oHhO5g!eH&xHCxyV)x^vdU_MP)o?v`UXo`8AMX8IF1HGrJp@*PZo5eN;JWW9K z&wfp)?UhOqQIb2B=x|R~iB5#>0ac`0l(aa}*3sjt)pj-Q0k&!CzuCUQrd7vq`l*2> z>w>~-Byk&^$vxIls8T3NZTQgh{K$h%HTi}iq+n3afIgx)xICnh!M$*Rl4MElAdaC# zlDb8~OG25^1;J6J{4R*#gG+;$*@GP&h!{~UrPKz1u-29f1XpyVtQuBH{F(z2I0T7H z_lo-=py!ytq0afRylwCHur*oYiRM8Hy&q@*fjUSL13>g3qblIWfov4ULvr=g#b%1E zS>R_}eUZ5R1m5_9(+@0XSh4NU+GKNTK**p;F+xPcg-B@9!sRe8p)R zpNh{*gZgFI@JT!py)1@xWkVQ};2`X*VO%@?4GB_;qRMemBZ^--HLgr)(3-C@2{ope6cNaSehS0?S_N%7D_`WnPK z=a?=s-uM-{Lc{5K3gU;v&uS5KE>gxM@p3_;Y;{6)^UJQfN`Eb}T@NXQ_}l zFaV}0EE`p5EYU(*XlxfCPEqz{2Vs#HBunhr{E-QmKWT#md6cB2ol52@@Ve?iPHLEU z6sf;KVNi%JS_HKKPC&DRA`^q+5T3GP_<0f|l>zl-SzwAHav{iS5QRj@%{B+F`T2A_ z$XmtpK8D($?5hH54At$=TK+h8h#jF*;<$a&LiAB*i;zY|hA4IrP}IR&Geo&9;ld0z zYRw4?WA@idaPxaV#cXLm42n?ZAeHX2rSGz0Q+~UNlK(CP86d;x)^i~@Ov0)WNN)Xs z4m(aHcTmvvca5yvIaI{=skQg>`S!YoA3xyRse-Uo9(!rS|9hPGYO#&&fb~<{ zeuTea7P;aS7;Z%F2jHdmTUKEg<0-rLLm=-cebvd$OcXZoq0 zUKid>+^N{n>;j2aA$*3?yRT(r+4FTXH`>#)S%9Ttr?(E_NO#SyPq5&rea-sYti>if zRAMPD$J1v04*Df91^jYlx|H61y7XoP@kDGw?;j7=TSIZe7a|8oWO-6bO7g>huK4}oZy!LRe=2Dii%Z~kJtXOh- zM*1BQ8^3bvq5SmHd#k(Ohu+9IkkF~+CU8GOGcqYqgoHtwGI!Is+hPwXEpFP!$EwA& zEsXHC5Uof7EuzeP)!#NtPxWd;&(AW>&iJNw@stCOw@Xns^Tw*zzB3J*_saEiCQnAp zC#^7oiCp9d~;3;VO_DHOS09$W8-b>dr=gyD2%(y!MsFU`FIa zfcvLjw+Y7G73T*RVkSL`3;iY&loDb{S4z0;l!#a6rNEs1qG>vfcbC%+takCUZrI+8 zR%g_{z_~AOmZ=&eyvuN?nQJzTzgJwZJ3M)>b~oLE?~9Mxd?hJ1%KWu1zQx`(Lmh47 z#3e64uyU!oEqy0;Mc>^wdhsqS%tNN6ZO)ps;Syi$DC^&{VF(op1KWh;WN~FCUOI}3 zh1#lLaG5sdgMps=a7y-KA5~Z=V4H>3XfY;|M`W{`#14((G4^AM9OB!{wPir1t{lSF zYt?!y2I`kXx)p&z5o0{O{FK@cRdY`i28M9(Nb;p3MgYD7xs4B6$~BQN*=|bfML4C||2$ZkR5R723>ry?|<70cb|%H&B1sgBi;6le13 zU&`9AO1A4D+x!KM9UY$I}-+mkHo-~i~rfS-D@iGj-ZU<6i&s<3Na|;>%WnI zoTwarI=QB*_@w^TM!a@4MV=+R)WgN_HW-2Yq%EkO+?&5dhh07eXj?FE zhnzMPwF2h{tD15vAE|b7*^s?!P){*xatVN}(dXd1^A&}W5|Y#=+$U##Cg#$7zIXC4 zkM^t9i!b}N?I<4F&SQTNqqR}2%Zb#0`(N;o$g!({>*3%1Km$#|1{}-1sjH2${@G|E4WlthjmsSLf=%z zfuC~i7@VQYgMnGhvpa}S31EA9g%$Mdc%C=!puK|Sd=Y)%d+K|AZT{<|oj0(@dvJFd zv%}4G0n+|P)YQ7xcEO-<9fmfDfYqyp><`;vX_nNu&W^umy-{coKI9&p;-=gSU<;HA zxA^03URjGu4l?a!rO8y?81VRt zi2KWaPFCz$$Zf11&uJLx{r&gpqU#y;9Bn6B(C2jUL1-epZCPvTTmwlBi-w^4+AHFW zBe=q@)u~^BI)|TVGGf+dE@335YlF&qx<5Jf4t6#{)OC3ct0G|3aBs6NSecTJT$NR< zyE^gB&tz47gDt#EqgB?s-_r3Tf~8jv+`kUSXSBw^rZb8Jd04HaYfhf*VcL3p&Whk! zy)}d8;-c>QXV+Vz;bcQ;?bIZvyZKn?+!M#qkas$XF`$4uuY|JEzUbVh?)JN!o$x4; z1b? zmK=Z(peWp(wj@y+Z=blTzR$lg9X%I2@Xq|ZuF`t}MX!G?P_3;KYU_xE-@~6>Ff`AD z*HxKj*BK%1?`X~zNgl$IVL9#(Gg2wQ7;Y2^ry**UYREnS1deI-yLVxjY|)gI2D%hG zcvF-newmoim5`sVER(ZtUAdcXgq{U`Ia<7EH|$l+5HnYFNXy(Dn->32zZWewD*)oN zCuX30_dgDX+P_T%3eLO}0)O3$xFa0afJPO^L4G!&%^8D`ZL$di1CbbjuaZNWr2ZFK zU}2hiLzUd_A+S|M5WRNW9;hhf`VDzDiGy7FYTx`G`UX6x3{}B32pXBKCN=DFVZXPN zzANw&bVB@%1MEM*{d@R^{GCbZ`v#~bXK(B6(;N9mzC%UO=$L`qTBOz6iLHI{RDLb6 zfM$2Cf0cpR47e2pd%qU^zU@Qd?SKAWG47b2e9y;WWp8Gid@)e#wHB~Jf7*PlY_ObdUP2oDh~8=ZWx6BlBDz5%ORq)ahWkD7@yp`F ziX`KxG2^Y7?lT>4#q5?(fggv@)Y-A)+TDuQ32OFjw|1O zYF``NML2zX5JBh0czj~|<*VnNBUU@VddYKkkKkox`j_%@Wb;w$F`{9?<4##q@~I0& zYyX$D6|47n#|42OvJ5Xp9zg5^dPAoSLCVoPm_Z7oZY47;a!nvr8SfA2N@cGXApm>vS=WgThJx%5Y^N!A7H=$Cx~Ho~f7vXr1QI>9$-(r|jOt14Rm3gN zzlC8uKzhGIZUxh_ynPWf8k4PSr$$!=XiDdp@j;cnAM2OwEbYi^!}?`qHt}gP&v|w2 zhHSdf`mn&(n&+WqkV*njjIFiulZmsnMPf@OOQE#!LCFgxZ?9%~W=q&*jvLlIu#fA? zT*}+9)?fP%EuY4h5H$(DZ#_pHQC!F>9r(*9l@Mcx z{uLd=3`=N|_{bta7`a%_bc?qngZh1PFO36B`Tch)081z7PP_b5AVH82mi*6ma_+_@ z-RJf8Oj$F1Opl!)4!EpanNy;-_7<~XjG6v6w~BO%T*@csd*ekOp4WZBW5sKG7k7zj z0j8I8m@Ab60DcjX0-!IDtinqb)61WlF+m;{%hzEoCkgCndF{(Jfs`3wcOvv-M zttDD{*JoTMR<$>p6YA# z2KcSUWLfebT2XB5od5IMBr`Y1f44Tt!pzP2f48Div}9As|H9|^px1-q_yyW|F1hFJ z2ouhB1?wh=M_Zo5>sFy zGQPkofPqQAYWdQNw^qCknOjE z#RvQ6^MB=JJxJm5iNx88B;vtu1TDpxyEGEe*RT8G*}?e(ig1@4&lVP6$zx+5>c&i{ z=;gU3=2YgOwums+G}YS&W+n(BDW$Jn1pU#^iw~5b*BFpO6qCSc%ZL2(X_iJfZC64G zn}p;}uywh)6MIFJrAH@dXP5@fPZ4Ep0VDLPpB2&A{_t6Nu44Ca1z;mbMEx{>b%lRx zA2b!OlM>Y`>y`Y95eyn>>bEUlTd?vX;aaeI`z={A=!~t0<(C^+6-cFhqdV_>{hY$V zqon6RTii>z!tQ5SLLR zF^S$@YQKnplwAW$bJV1pp;?e*!sJj^+lR|~au;9PfbvQotj+9_n2Nh>X^B6ZGsGOdXc&Ap%+<_o0-MIYu{h2PVQz6HF2Y-v|z(e2&Pfow$bse}4j<-odbuf)D;;05}d}T|`l9@E{FH2=YkuC~4&lf&IvfjyaA!$bAcE zLqZgs+z{xwRPKnjb{1$_HJ58}cD!?nM-Y|1bIl|5!AP_CyT6@S^~i~SshN(;nmTjq zMJzzBh2TFqTw~D6uaH!7soDdx3S=0d6{pcOa(86jh30pP=@ zw1)+%G%N3rG{SK|RO(5_*pdx2OTu2Kk>&Q`>!gXU37&MC9FRK(Pc;_zkIQU(x-&Q*NBZQgzZIc@32VH_YrKTdlCKA%nn zzl7uj&!{?rSUyT$Vi5Rfn1ERd=mKZcFhKx$i_-4J{kWhNpUJplda9Jo2arkeO@6_| zvZjYufUv^Df%j}K3WU+OAimj`m440Wi{jH9wX9DDCz;^cPQlJW&-CYVRIJY@$R7x~ z)>Ei0!Hv&1ma13UkE`gs`w}9z-t+c(RbU~Z&7Z9 zo>A-IIIkylw&c?!$wAi30$AkF%g57^lzq3_a{us4BH%Y7KJ3RkqyyHk$kz9pR|LXN z|8#WBcWyAh*V)1l{gqKp-zDR+kNSR9z0S&;YmhhG!(2j>cbMKR|F(?ooIIV6_kr2< zGw3fbD1TeTEML?;lit(OZ6iCud4l6sy`I$){+o|^6Dz`YK;x&h{>rY0uQzs?f5Wk4 zVUK~UfVFQdrXL_+_am#LC7^QC75qczwe@-B&Oq>THTUx6`eX8|{%v(G;7H}GH9*Je z)OFoo%iqwK_uA$VJKz}z(cR+nh9@`!IIshL_}uRT-#0z)T7k4Tma?C*guoa7o`GIU zff&MrDB4jMu)(Jr*5B!hv!Lh#b03*Mgu!QF!s&yZD0PrnE-43~k?yYIF~P`aY_a!V zV1Gc)O;Lhll{EYKLk)!U-xUSBcM|5S@0UXTz@(p0OAJOLMhTd2WiraIaYeb)#?lP9MC7JsJ>iBN<;~JHN}mz~&7eS5Lo| zjI#*sG7z7EzJ0Td-!L@>&V>4HySL3*i~V3c#V;y{1^+^gTby?BySkTW{5=$PYwo|C z$Iic}uA?@Eabbb5yHmM+`v><3j+Tfwh-#x&eK$WK_@DgwCg)cH9yYV{t9PMShdR86 z9?Ut$-j05SFD2d#rJ}BgHZP;F9fMkWnD;iRPQONfbtf}ADSD_m1W4UfIb2+)t#-gk z@@_kFHL)-StR1MV!)a;%% z3jtqkDLL>H0BJZC){+oK0-67ezIthfoJ@^-q`*=}5%-gUeTiv4?8 zaKH3xucu?>e6#rxJB?9)*pXfkSJ85thBmFhzBlz@`O0@?fpFxR)3j}AmT>caxDlr& z=Co0?+%AS5WAA9!G56`+=xqDQCZ+In4NxdkiPwtryU}15SR1>$WwW04S2DnpJ@R@5 z)lqTnc**(r3y7EdFGIHLaDRTw=`WW7dzC;Zp`I<6KJT|VKyb^&3H(1QpZ|qn^}4S%@5RiRs!s!Yq!dzOa(whZ>uZl52`%g3madstPh zyi?%y$3d(}HY|*s4|pN&w>V6ZBQi*bEQpeZCK)sVuOnw~%tO*xtfhN~2*@52UNeIv+I*OoCv z1Fl5x;YbcRA_IRV_#nSh$mCP|*|5o7^m@_Qb*L8-d~|X3X?cA2IO$_ zAj|+TiA<&i?aYe_Y->MLk<1_xe2~~A*xx|uo&jBNk3SyKnLOWlH;`$;(b^|e2mDheG(pGcs zHww!t-EuIU>tee=%edpFgJW$;2L%pwf+ejTH!8=32R1Si|1;M#BqH0^jzu#y>qFTU zLUuE=24)vcNvn@Fahiv^UNdW=DL-Jzfz^>PABkyi{K1D4au$K{{UOMcLE&gW?TFr) z18-gT$50%j+AvT%Tv`NzPO>sSQbxUx!SoLu%xRtR&TodQaA_QHiV|=&bqI=YBHoij zgYS=*fG^lt75r{y;-3NEx3#@rAEShOk(>U5f=K^&+Do+??fl2r*HYYn?2ql&O65ig!SLlai01wm6j7_{_XFK>MAK7pJ%z! zhskk1z72BE!GX8$3yYM#WFwt#+y%>i*YAk}b3zLZ(uz@N7M_zA`m$M9L9(h*yDb73 zj$Xi{-0~hf+B)>kMVpC^bxwJp69T?#KSI#z%pUz(lavZ)yF(`3&XY-^)XvU}at-Qp z^HzPFeaa)MpUOLZM?933-{VW?=d#Kru9sjSBWwfFRo-6W>+L%W#CM`M;m{m^N&`3F z;M=o3ALMT}#ebiqSqolM4px`Wh9D;z?ed8fp5O~qEV}tVJL8d%Sw^` z_F6|XN3UQL(zpDItG}!xuJ+BH5Oonh`_&@vAZb`&3t2_*aP{_CYkFMZ9oA{DCjQEW z4{C7xYhsezIA}Haqx$?EBNy>rRZ?HGx&NhQ`vvxraY&8C%15xvx$w^86P^G13a4kx z#4|6u5|+a$DVrh^l^bgX#quYr8_m6c*GuLHnEb7dY4wiLQBL@|(ar?N(^BF~N@Hdj zr0FxNm(PjTEaqcX+zTFG>rKQ*&%5Hg)2($-z)jgluIC%MS#1DBS*iOkiS7sgVJVmA zKk5XnNmki#1_P7{RoyS-#Pu&8#=|Kr(z|Gg5*YIy?=r(+%RMgLJ874_J!NAXGi9K+72`0{C44EEcuY%2_o>tGc08}{aNF44{%Pp8d+&$zLk0@ zmnC_l-ka=ieiP^lTXFyCik{(9Sj*q3kVnPtKi}y0r&+!(O`o9RBD;NM((_o(X=C+; z^_mCu7n+|f!#fJMyvO*b-pU3~!}B@nfj6OZ(i=dDWqV5)b+*hrMFb)ul@6%)z<$%N*nI~4^17;|7TMt z+W%+EzVfDDSFk{?*LP3a>C_$sfTR*qOZrdz-01}vwY~q6XbI3La(6rSB&@C3q)8MQ zF4}Zxv1d~mhUGq?^uflh_NmnP&up$$C+Xv?h(`fNHcS#y?2cs`yo8WO)Jbr&md%VX z+t2S6^7AE{bnCT*Fkz{0bKW{}GR}O>RwXWVjI?Vdd07XeINMOQP2Zx4;B%|gb_d8x1)Sa;8Nsh zq>5X>XVH=@+xfDW!nN+a-V7_%gvuK{c%FT#?;nwz!mhx%J=6&8c0>$_!cYfYX8Xkn z!=q3~R*|sugWi~5o$?@TS)k4maUsPb-3fD)k}7E2z64^`(Uk(hjErvei1(269;dBV z+`jMusIp*v6>Pis-_?uGs6jEd6ZAjHp8+~BFW5xlt&~$5p18n-3db@Ow+gmp5U4%{ zs#(jRgbDP08MVK(1%JlM7v*72%j3oa)z6N8Cx`zfjE)s}0+U1q{^*;>cm(;HUvYX} zVhlt~|LrHu97?7wCnIiayiUzHW&VVUxAoKsK$pQIKKG#>)tL^KCdN(at%% z<;0SDn3Ak<1Lw+5S)P3^Bo@O!oH^WJ^%5`)j&i@SXMGF3z&EK}GAt!c z8k#7U@0?N+iO>|qkU$#lr^_%}uwk6NiTeXCJS39jK=)Rj**<}`7>oRHtw~JHZ3>D6 zkv^yysUgf8lX}tUEiH5{Qog=Wzd5$}gLpV=xKi}k$I?fTfirsZR3ig0iWK!>Rf>Up zVU#3j6TS#(nj5`vLoDWS~R%1w&*F(3Sb4e|FOyV#`6Br#Sr^)48V|nx^+Le_I`( z;q+F3vP@L7CTx?}h9g;| zl&q@sr-fV2a$t<=VDrqFcrTNM1wWG0%oLK%5-rXleiY-q3=H(?b#(Xp^|W^{5cHh8 zkcjB}?baaR^W7l;N90M~p?Giw)YgB#-nUHjlBMSj-&|l^WA8FYP#$LQg?#r=#GwE} z^Q&;s3-hxJ^Y!Y|m*}D}Ps?ie@l4}QNa)<)sL5YlvFeO-oAV`I>~GmCH*~ctqQTVW zaZxGy&u*99s2$>7zr_b@feTZB!`Dj9qisiefJ;x`$70X+SL@x?$5`2d!t2up5V!B|m!rR?lUKeC z{in`%>etVktc@T8egz=p4h&E$>-S=1fJB1-!X`$ZXO&+0((tH-{{ZFe5wzD*0OP+I zI0jIEQ^gMO?Jr>7JGzmMBkTUubujp@5R8qh9Obd-K&lr1nU6vk<`5`&}B~IIDlxIY}w-p7H(F`3!Lpu~qc-(~k$*OQ$0`2qPbD(awaFj*=2Rr*${CDHlkR#xCK%AYrLYn`)Yy)cGl zW~aLq@zFd6>Qky${Pug@O3%irLJQn6N|Af%<0rbgRVaGg=v(4!q z)5Uh%Cu!-N`8=3;UKe;;R+l`_-l?$VL3|3vxa+uJqKz*4aSlRL*nHCIL(LWBQ3`GW zW%w=9?CRXHOZ;+evbywWTejeiZbVPTTe5=>5%6_0R!4f^-G$HAPuF@lbJrNeofOy!9_&cypVH|o5!q%%$HO`~#)gh!YKwZdy4AJ zI;U?8U>Nggw*)x1#$-RXv;uNKXd9Pu;8pB!p5SmkCC|Mu-5ZnLltXl&ceuh62&)|9Pw8jkau#MS!o7g z;y$fbChX+tsweiq|Lgv_^VI7lb*R=b=D=yDJR+*&1vRQ*;634vsQR<^l=jzdc2s7- z4w!@fc>KTovH&9??c5^w5qbH?*{hudO@sP3!W=L=!vCalIQ|z~)c+bdoc|5+gO!=} zzYsr~wI^fAxskUY(A&Yu8b07Q7s|O14qbJg^3 zhuR3k%|Tyq0Knx$lD$2`ov~z^3`k;6;+R)FpvbApO_bw-oE2v1V^q%WZ!o1WaqWXz z;py)>?f9L5)h0_(iMl#8?j6G}EYG1`Bb~IE>wI;DCvI3UNVRe{ZbQeRAitv}haIg1 zhB-whQ!bG`Bymwp0j)(S2qEqloe@+b(61nzU-QSESX^P9I@32Kuh4QrT2=1tCntGQ zTs*ZGl|y2lO7T6LRz?;7NJ?4285%mi1#@Y$BSvC#kqVcbjb*6T*V5Yl9V!O*48?}x zaPooV5!8@Q)+_j}W}8sinB7}hKaXSk1PPA!_&y{Ueh^yI6b`! zENWPCh9z9u2~HBybBZfO87gmf4>c7_cC+x`gbWX#63GReqlQr0g+xUUiaPaP#Sw2% zv4n2~OGJFxxNwr(3ByDiK#9i5l;aZ!N;Rf=;26HYgQv_BeFlwT+p2w z#SaEOB!WhY&Dls2;}lzegdpjLU*eggJ{aclrc083#*T+7UhY`S1@p%w2D~$zGq45Q z8pkrL=ozF%n7|NO-5t6`JgeDQMrs8{)_B5VuPJ$7$^->q$v(;)R>OJaAi~KdA_G2r00OI#hZN4LJp>Bch+dUWDRPoK z^wl^q;lzr;0-LRwz$(;j%uZ1iJw#hkj>7tamBJ_=JyZ_l@F+*-xltTT?YsgrHh0`gf+|=+OC2D;8ey+5NY~ecW|_ zm~$2T$VS+5f8zWp=TVenS(xdxg;IFPpchI|z{2iWlRgocEvw?c5=Tluc>U3dJd1?* zYl4@Ev7!s?zK|T`M_(V~Q*fdX!BeoOq_*UYa2lBx)N|<&em+h1v}uFyJ=b7Af)t59 z5?@umV*Q$pV)Y(-tu!`t_?@W}9|T`NRvY$|UHVm>`8^pYpAq9$Kjjrt(r6v&oXjue zJWV#dMCqn!lT_PT=5(4|uUy%{Bi8stlm~qww)nsBT6{<4iH*S#UUUlmfB8~N_s#_y zSgb?nijmTrDKMc*Sd{bi&*Vs@DlH$Zewq|hiJFItU>M$v)+t2^^Bakq=29kILzE{$ zJm8wM{Ky)GyRa6(jF-uv!b8=u%EBbU5Mn1kks&=o6j84PU-Z8VJqFey27HeS?)Pgs z$K(W##|Z|!-qjj>5`~-a-{$1@|Gw<%*D8BUKWUmxin{c&7<$P#io89E% z%VYoSG62|c3g$coV;!AQ5Kj4T#MOG9L78K1?6$3HX9TyWBF3DGbioa`&O>-$+(ew) z_DFk6bW}YkG@nI7cz4&Idc}BooTc5Q2e>m%C>ZG{@loD-zeqgHdr$2};^PBjKbVql z54C#4GLm{y9n{kiZ^LmacRdYQTa7Vwqh5$d@J=E=^X8NbDo=A4K5{=+eACRkDG{@p zRXv+BJnkYwLV-dton8w{26gVSz)ak^e^FxA!*j*%Fc8n1*JqC~fQ3?qbk>l5-yd#6 zHs-CwXeVwef`LHyPmv@%gq^5CFY5lyqZ%r`->utm2(B$qoNJId6I1>~gz%PsY99C; z^3%dDEfI}>a=1?ft$|d-`tlZj!mQg8UA!g3Eb?y3XK(j!z*iR-<#yv0I8>xIid*Wu zohh8UvcZ?qUs$Dz`gx?*!iyZ%TH#|RX|3CQ4i9_XKk?t0W=9%y$JKW10@KJGR zZW-4~Lwl5H5f)=D;?fG#Xo+k8BDZ;}MuX2#G?()(Wj07zbCe$pBPg>xtH^8|p}@F# zI43ygAjiiSpGV?Y>yt0Zudbk~-lu)hSo1_bFCxz?;=OVhAiTN~X|;4yX{3qV&fIE2 zGe;0t?hZyQ;-!~v!*FO~n5qQ6<$8~^;ipmalvYr9yl{$7XRJ%7;dtX~oGovGxGcl# zrF8M%YAvHd7%)k0&U-nD&;RV{j{TSGL4Oocbo8li+dwk`VDT6)CH2peQie%$PW|-25;yz-lVUGFRA^?X0x zUDpbJf4sguKOT=N5(eTAU?1EEXvMj}D zaE=c2=Kr${p}4NTq1t!K?R%Q0;jW|8bS`XO0l&|70$+p5F1p|~d=yIEwlMEM z_zlL!Fg29fX(zlysB(Qam^$DmS`O(IzYpUC{l1)wck*@v1a!ae!W0EX8+WA(il|A^ zmj1*R%n>uALh3WQozSzqpvrxNPps~Z7sOoS6&4y@&73)yQfW1Jdi^*xmsISRB7HmP!c;j0?Smb;JIzbfn@Jd}T8g*O%Vr>=4Tp2ZYzxC`Vj zs4;#;s&UFurYMsuLy7Z1VCx3sEYk=fkO=u|0Ov}tty_;#D{td0u07Yg!DB2sH1YDq zLylrBe|Gu@E`RjwDU!hZn?S?<_&eCIzyE8fe-`(aK7&SdtICD|QSoM1QXNz_X4=`> zaHT}hK$JDhxZ>s~>V@@V7RjAH7fGuF!q+Jz7C)Qlff9vJ!8`Y_3>JF>PCVBttWVT#?V z>hrDE^lguyRFu-*L6F+(HPao9$?7b<{8q;4`h`7jqu}6x{mgLnH*XOV{Olippkdc@ z=JMvZ($-iu=a3r1L4wJpqQurSyDU)u%})_sBSDd7oO1o&LvJprvxTm>8ea$bz}oJ1 z?qTPq{SFuv5i`MlB>4-PPY0oc-K>o zE9-so&qHzH*QYEOMd0OATi-j4&E@1EYp{}9qp`?wD!t$K31Nm@WiS>Y{FL2xte}3i zppMwsUgMe2*6yq^pRN18A1V~~|E159`M;@9IJmj~QFLKkT%FB~>|i`Mmiad$$=aQ7 zzhL+`AbnI?j*t3hnWZmQ;nCM3rXTZ!5aEFUOhBLe z;aT*bVoE9Q1!yw>Xyo_q1S8^vvnORfR{nVAErB{b0IZRD1c_tjewEN7Z3uf0K$H66 z48xe*dkSOK9yEHg2I1!^sq87@%)(ZR1|in|Ao&L>rIYPItWV)ND5&}Yf6j_zC=Z;1 zcI5Cofe1k&RubmQ$x|Q55QE3-6AqF&v=ErCY`%+9+{M{Xi9xcY?P5j-g&zPbp2gVL zE6jW*p`)3p4F1WYyhTTnF2(~+^*a{UB>AWQ@H$-0D2W^1$dLE~w6)2hcg7<%!^{E7 z7LJAmG&I}cpX7y-$=_)_wbMaq$ar1Jp69lBa0T%TW$X=3PicG*2&H6VmX5?F1IrO< zTsp?VO>-*kO;lr|DiHY8Mot{Mn_O5b+SU-~`rvw(NR$$}2^$n+KP(m*gdqW;@kk;R z@e&k;q))~3(2#f%I8tKZ|9(3}F~1x4oy9%zXUq>hJR{n)Y7d8y7)7;R!WskR=rGpt z)ef-28ikMGx`x*K$aCGfaKTX}g``SE`3}fuPNJjZy|Urg*{4H)avz1iT6Mv_p;$by zIQKqrWvxQv#Wi|mmELh>c|g0G(ni=K2M$@731uIW&xEqY#1rq6p->Ls9>B+^BWTD$ zI*`B-1j6+X_luy((JztE)!<+VV}l^enbZiNNGi*lFp$g)7@cB>YuZ-;yx|R1 z@<#&ULKfsd5**Fzt-!OV$9|IKcPNb^I>BJ0Yk9#HLMEL_|K z&078nK4g(#acHOfj$-w;z?7dOV5+&@xVOcpf*gB+T1@d5;)$Z4I#l%wLS?#vd=b%p77hZrsP z!cWiI39KTy^JrqCIqg4V8B*_-Ece|%I~3p$sHCWfB4U)%^219;l?*H!i`SJ*m5d}H zK+A=i=2`R(&_*cqCCwMdc%5{I(BGJlVIZKV6BS5_;L1%7(Z+%{%oE!zTN5Xu2Lkc1 zH4xpP^fTjchS!N$f5PNI5|Ts5kKu4LOotxwWKl(QfVT_KND8g2SkfPMm&-P#S#c!0 zU#lCF9!Xpmy$#6Xt#%I8Ql)H!HEoS;@Q{7lkhld!x*Ryb0inivLbDd`N*;%!_e`BdO2t@)cE>S z&vqSlyM4Tp!omT#-wx9RiMqbOj`MoI9-k%!zn)qJdq)G(7GDf{zn)tIZl`uXUjMz* z^XdO~?c<(^0Vrb(`1rivl`bpp{kpyv+-;=%6Y%+ZXs{j81CLGi(lSP-Qg;8Y+p~J? zqbg8q3Gi9HJ?K8?RzG=gn!k4=vB<#P(MV)4l$!pPfa`B8`NtWQ5*Xi>R%dF*w&!S@K#17|mC{XnSB6S`ZY& zKNT}sY8?8xSO^qqfr)6}L@4tG zUaD;MHZJhqN62g@dY=Pg-VbTWSW2UYwgQxX)_b=gku*Qd44h|5)^}MjWtjvC9a@8~ zr%{Zz3O4svOT0ibq;UO(9a;}gG+DaDU!5YB2Gwuy3f+NUv-qN0NmXvxarCgj+E5~e zY#u><%SU^W5l(p;i5*ROc{x+p*LU|_YhGq%`}aq`W2mu&5HW2G6ENRop$)@Q(7Dc{|cU9xAba2p=Q1-;zCgbg)-M8cc_me?NdNb!(cb1$a>(ZYex+6_r1J74I1c&z?l@1&(&q)wWXY10W1ShNkS zGFc0Xx7k0vv}%O&iUu(|YN(XF7;rLb$uScXlA|h}KoTR(cOd&w65>e-a!$`$b3%iR z8X5M~a$7$PH^-BAIfdzY)B-t8k@cH~Y8-9BM^Tq~2txh%OC4lwx=5ZW)oYdNu}LB) zOUYb#GTPDl-zk$C*{Cr*_?pf>%n#4yOwOi&3#iAa?WP)DvPJkY4gui!0 z)t$>qloU2sDOC5Y8dpm~%71ctI4dV5-s~9AQeanO`do`PJsh;z`?qkRZsi@IrDYu{2aqmb=Dw7%Th}V3ti9 zcM-X1o9u$%?ne+?rHg{X z2da}AX0R4agVzBA(a&f{4p!iinMlFYi}J6*LCs->vx(QE@Hx)jx|V0Jd5~45S-?n# z(pd}kQ?!>~k%=VP{Qmy*Xf8E}hMZ2U&Cpi25mB^pR@CmCoy%-VkTBYE9GG zSZ8*g8GZbzX8l$;bvKER9WXyCz)VM4$V}OH23@$$8}6YN+qP{xS+Tj|yY{(t?|Hwv?>=|eOwIIEJvCKN_qe-%O*mTx zNP9qr^us0^d@N!>9Rpg&{iy*w2R8RY!=Y7qyn?P4Of{84O_eDxF;ZJf#7Gisls2e; z3C0*RT-7@M8C(Ba(L~vA?vB*DA6m(-C>+9pc3g}A4u?L0JndSg<=k+-GBb>P$J5}o zuR!Od6h|#g#ahXZ6T*R$e`0m}XUr?2alcI&=h!MOzR@59X&O0U9X`t?UELjSPI`|C z1XveFd%j$I7#F%zny{2LJ(4lYCuO=_J=?8OiLz_%GubQ%&^6a062pP4Doa>8e$7<9 z6FGL!jAbFOE3pA&ghj5!0vy$Df}xd2Wuiu*pV6ZkxYiaPHWInJDXUWa4&Nz^tyiCS3S-i3l1i&hh#;4h_s>g=6 z0HZiLrw1DdiXP6!iObEa zS5|U?o`UG7I1S9sUf12;u(Ez_WJ$BApo8@Y-suYvq(>e58}Mujn+|#Zt1hrCqhb(3 z|HmKyY#{a6?%mR=jZvf!0J5#a1-LLu-8c-1t*Fp?_W3#%Uuks^jX9u&Ws!X4AB zR2|BS(jN{}pbP#Ofl1X1(?sq}FU*Vkv|e5r9KeS&DDP39yWR)qDz4=YjLmH5)QOlMQ|w4P zbl)`Co`+HXUC0sCZ3%rXaF#pLj2w_nEO4x0u6BLHvhYRUbemZJ-)GrwMdTHJkg@z5 z99u(iOcr9e2U6`cLbxrL^t|LywozEo;43<&7>_cmw9-AjbTS2xGN_o-Pa>Wb>yExk z2)s({M{1J;PnY-;s*lnl>5K)ASpm#qX)mR36sY!{OeLnk#jV-aa2fw>vzkP+kljpZ zu;u=o&A>3N0NgDl+`J5sE(ihB$L?%?`4`8aqatYpDvM}W!m)KRXa->vQE^728v_st zM|tL3ig%wPetwo}A^j8usr=!@EsfungR=3|*O$ypAtB@3V77G8%X{ zYG|U!TIS5Z=EK-RvN2BUDs)r4-^Kf5EMQK#xoVF!&~T5y3@yUe@*M1-iU@$P)^gnB zYm>4|ZmWQg!g!qxa5&Z{aT!f4SJ14VPh2CiJffO%)XI1C9(iYvyucZ{AC=j3dFEr4Lbm3$PHKZ80 z%NdQg&X+w(Pr*co(%9k_A#4|+>>cByVON@l6ru~V zcp8gs-If+#S(fO9nJ(MK4e2XMD1H2O$zyOg8o@rK`$VYpvqR9hqkF;eq?Fg&+7{Lt4u<;dM!okrU8B9u&V`^~@2_&{=z~EZilL1pv z2N4`LlgpbaPdq!x@8OISf3M=h{M7h`bj{RG^F?QNZfEw2YD$FAEJt>AcKCZHT!iUK z&lP~WLEL}Olav=q`B*6&c={VrLgP4 z!s5wW7IUG8>o~2NZ#+#f+31apk}|~Q85t_miz`2idB|fCku0L>G)1ALLh5pa)!Di& zcQWQ;J!E4Dio7Uj3X`#k@-b0NQJ@#c*K{DVM?AuoJr-K4dCjdO-6#MPQE^5EyVeme zXfzf2U}JDP1P6OH$4QSt^5`=K98#GbfifE--{;LIo;Alu;MRQ}ll=<44bNyUIMMPb zjkIL7oXAD)SehcG4&bnTDrv&kWm~@yiei69rY1E*)$wc7B|=FTy}xV-=kbq;sk(qj zU=oc-wfdMSv>($PVDp!pdSY02ObEG`aO0}rdz{0IM9&uT6^3X(3^3|3ibv z;r})_%N%^p=;;wXyS;Ce44Dv-F1O^8Kyx;G$+rpJ{8Yr$q*OXL%+&p8Bp#Yv&^*$Z zt2RJ!=TS(ma@Ex_xu)1z?pmq>&jKIckO8qF(^yZS)#Czx@~o_HEpEGJrAj!f%?%CQ zHl3E*(gdLwQ$g{Nx#xy~^ijr5b{l&c{-)>6UnHQ~oK1Ik<-n zPZi}-n);4jqi0HZ>recO;O8n|TuhemKmJ;4VlH45)Fk{GKvs{Wd9Ft~G7qv5XIFfG zw_tWhxTtintu4iSBOmfKeU~ecWHdZCmF{grhOX;ejG3n+tvUV z>X5K4Q(7h#d!e~0eDmZ@^;^qS34Rqv=B*`OdLe#&Fes)ZRap?h?2Unro7E{p& zlsX9c6-f9?DOW>xXm!{zxaf^%%L*$zm&q<>OA?5xX!ZVQdW&OOxmv2s`YtDdUTe$r z7}Fkw;^pAfRufCYeTOw`bC-vZ{mp=g7D)&1`7wYCNpty-;pk%i>S-0MX7xsW=CKZV zzK>1jEC4$2Ctcy1z(t+509&(aRXAFmsM(yQlj(Wpp}3;=NK<_GjQ}eokS8avNvL7i~W(VE9pkRyIlb~QF za(??`$UBsGqx;T^%~?Ivl$49o$ueO-wN-8X=8k_q7myz^kb&SgWq~gNt4^kkzAUcg zC4^)2cEqy!I4gVc$9Dz(D)X?)B|WR34}M0~ZpKkClQr;#jDeOlRGreBIQrx8c7JgQ zTMFok6@i_MC$)yfNLCB(nr2oP{z_x3Hmb zLcVfy1~61JS21@WyRb4~12`N6h091Fs*9SKY8f~czk=M*jOY9vK5$LqwFH&>iGFrJ zoDqefb$EO=3`R%6z;>Bjo&2Su_WtQA)l$%}y{;?QsK7ToII*2gi|u*i9A?~h7SO8H z<)df+7NpMFtXLI_;pFKCuW49g>*2XOTlM{${>d}#hwN!HoF|qsj{4MZJ8Ih@u8?wC z944LfrEDv&A|v>6zj|TKtH>V}_uC;-njIym_d;7aUh5npd$}*Fi1iP>xd)r_J$P zhSS$v3A3>+EO>Pl(>I|I-Q7;z9bQxA&0H@_9pR3lGE{O=>q#7xF&vaLGWCE$&`&}d zlhzc8+vg$EiW{EZ+_F6`Ff8+v3YHh z=zV_d-7rupwZsf1*%O*TzGP-L547R>FZ(^nT50E$(AVykP|p)uQ^ZJ3nK&{!alK9r zxlTTrJH5b1X$Wy!th`RdYagg+n#kevC-p_Oz3!_H8NJLZkJffP@81@RStJ|x$Ig8n zL;SVw+vzsm6`MO4PswX4Y@NYSo(7GQqbxF>b~eb@3ok-R%lH$)BUSBqPMMp_u4LUT zCTb_0JJBt_vv+T#Co@U{>I4Fc9XsGJa{`5T7Kvq#yu%wyubvM}{db^#mRbgLrQ-YT8F%A9Iay9U?Id)I4AhjZtOVJoH z^?4ghO<*Q|YkfPtK0nR&=F;v8b9B5det)fkpZtlPY^lqqY~SrUgxvL+F|+pV2lkmE zUlZn~A#>1Z7&{>n<{copC&G-6jSTZr7djF`Ayyj**9NC`fNvRNnIle>3ez?qcd#!X zE6yOsppMX{rEpl!9^33BUNsHV=KJZuk}&qfORTmSraejQupKg%Sx;>HE3#{!?%t(i zEOVXMmOe7;14AP{vdfq7zGagxE6v2!Bp}V5=`5Ab_s>;p?QZWdPMLk#tnc4vm?4@` z*6;g^*Uee18m|DlYN?%Rr1WBuW3>2nfup9hF#vcxlO-`Zn8-|3I4)awRt*w|98p6m zr2`?E0~lF@*w2Pds)k;w1~!rgZ;W-(h^ai{$dWM+Sz{WahMcnR$>_NDZn!Vn z$62%fyH=Xs{0~~i1~i6o8t|a0(vv$^EV-0BB{av+b~8z**e2+N^vAdkEq zC-!a#%T+evRvDqXr-6)Dupdo$FV*rp4l`Pk46DyaB)M73$coYa-xBM&)7XSVxFn&o47;U{ z#cpveq}X{KKb`xmc)9TJcHN}Nc()Z4C59mnK)(-rU&|uo=zKio5Ofm}B_nn};)i~U z5*a% z`fSx;yA{>rGwY{r-m#OEr0uG3zY(YjhJ}*6QNYn&`Aj2sjY*)5rM?Q=yu-{%l7XVl zsJ{}uQ&_wcryeW~BOtLn3?rR!@d5G|%$ zN$5vy&yi3JGj`*#9oq4$G6emiL4&6lszdzNZP7Q^!w$tVqzT=hx)#H0$}kRfUL0hYu)DVczjRs&mz8@ z0kH1^3F*-bg&kK%I}1ef{yX!+arX4xh8KZE#H+UV68CXq)A$XM$@zN!HHjs#O%AW= zG;fZvD(Ti4;>sBEgLAd$hg(=u_s?ob9f_|(t`*4h>&K;E=>vvecKO}y8<1jT^|6{r z?m!s4xYsJfpE$iM)#iWJmMIOm!gs5F9js99E8n?M6^rz2mIbNt*m)rZk34OhU+17B zMs~CU**_@LvG_!K=hep?SDV`KO{fYn+LNn96mP?`fQ+4Ke4b8nK4_2dM-^E7Tn zJf!u+3U|9#h=|7+*CCFbewYu%_Hixl!VP_7vC(95MqAnDW-1;z`~kj59WtzzLb2#s zJU4ve#^EZztz}?4^FSf-)hnKWO~Mvb@`r;>O{7_N38ZoeAE}vt+xnM?h505CJ4|iz z8ded@LdHc?ga;#b+?MI8hcb)w*UT` zu25@ikJ;PEN2P6g5Y-`N8)Z$1Wq&ii+U(6?h8=hgkenZRAL<_TEtne!H+T++oPTMb z(%!FIG&h+4YR>wZ^)c;X-NLy+aD(Om|82tGEXw^gQ`%ph-R=4M+T`Q)g*`@c<@>nm z{eJz}ul4=@8;0bs9n=kEez@M($J3;1@7=(Ls6}>R6U>jT|#Mp zdhh`>D5d{JOsG((KSTkN+jm10~MVl@ApeQOTKbl9B-Lvd1G^7}EO`*{Le!7%3OZ4QNr8Q{arrDhbS zAQJwKfsuPEkEAksY>$yQVnr0x7`{DQe<0W-_V-K9#Bk0qyZCm{93dF)M?D~^Fve3f9f+YyI-JU9Dt zcEQaokK0vUZROVqbWn}ZSb++XSf~m@!aBC45%9S(&>1*|QCJ`dt$@5o(O~~m*t6PJ zfEkJ#nZFrIwj=VzUOHHg#9q47?G*2|yJomztH7Lqe677L`7TMEGKfTRV9|5rcu$Y| z6^7Q~_stblj4XG#0b}e*PuK)$j>swz{xFjp4>aGz{lk#yN&NH-Q|4#e`CPK{CfA$W zO5{Tm;KUv!fdDvC6gXdj-y97I8$3u97%w`2SJi1kJ7&V6{$k#sZD>NF#HMDU0Ra$M zGZ6oyM)2_>ts_pxUF_O2_X-tCH#Co&GY?*fHQY7RCaJyFo0UOmeU<1O6>kokICJTS zQRaPXHJ_0|Xxsb(|>QwDwcr2p&h(v^aoMF=k zCQF9EyBk6CDSI_tPREbzdCka@M$usQL*YYa8n+}*e{&Fn3#7Nc!YJBb$ZA5PZgVmL>D+apNof?~O#skQ>AZf6l$JOQ>d_t|QPLb89|UYD^w;UfJQd ze#}3K6zP%j%n^uT9Y=n7?F3rSJ)6!MiEd`jKbvAzFq&O#rGm7V3)((|G@Hn4iTbu{ zNk7~hLX!8;jv!u!EMi3RR0y49!g1;8ti8?*xG83zP-i!*#p}%sb@GXlX9#d&-F#vG zKY1-gmPO~sfQ@W33m1VuJlEkeS+83Ui4b}qC3poccMXR741YU`BpieXa(mA(kuH}5 zmgIClwr^!zC6-ILRE@v?Q8a$*$jgcnJgKn)I-CUaTM3!6Tvp8b1gv)m}}4kDFUrBZzB{Wb*@FMK+zx)#x^Qfdn0xSqq!sAJzC>W!W%rM>Pd)F&@VWv zz%kya?D7|v!gaX8%tsyvSp4Gl@g#Sot!~B;Cqr_^E1-V+%0~F}N91pid-Y?q?YDq} zTGy}u+YPYYCg>gj>a8YlE&4x;em3iXk>b4z2;h8_I4R(Ev^XiO1gUi2cRQtu$IZrK z$oPOMByZ<$6LAR>S&3>odp1dn!J3|>COC~3at5#jnquAx0uK~W9z-RV9|;n%I_F#d z3zbd`?syqqJF{JZ+tNL2mHk@bgSz^E6h|d$AHGVQgQe*{Wkh_H=699t1h>UBFLYNh z+5tK_<~l?(Yo(mFRhnw&%>Qeqt9!pVE(_cd`StL&*pUwN3^wm^o{OD5!pc$UoXvmz ztpG{8oVLb0L<9hMvPurV30tn+%C+=U7c!4@c1F2y-F)3*hPx#W)E=R#9wDk!#7^d1 z)nB#hdGi2yz;#|s->;`l87v3EY^Hs#BHnp~DK&s%p_`5F6}TH-D*Em{}}w$(~gcV+^Vj;_hNc@o?gJqQZqNKJ70 zeA3PtX~25&RI*?dl{#TB;DuT60S?bvlk2Gzzcnxfci2b5jcwNwKgCNgyGwR7YehrO z%ejbuXp3482``(wBVWu?v($=MbT_%74QV@1y*Tes)_AWsNdW3P5b8Zl-Ah5WOKWW_ z`6zoJZH!iZ=JL)vEeWXrr?slA1|VyNyv4*j@}NUH6N1oTH2zd>h+2ax~eZp6;S z{J)*bMFCb$CJuC>Rt8Qce-UDBjZNsJO>E4Z%n6wpnE!eE(Mi;?45UX3x%otIzr-9S zWwpqMT0x|+(n+V1I@y|f*LvJ!RrO~R!9obrCaOF#*${cp~^nDH$3SytSIsT1-=W0q=8y{*TUcl% z<&H^$YAWVcY!S|!pub5H_&j>2p<@Ue{i6XD^&2`tJ+VzxA&x@gaa^fH96uR>G$Kc= zfS4hRGcQAMdz#cME5M9B5sIM~i9->0AxK@O2$#n(Oa91M>GT)JQ!=@@y{yjLb6!IV z+fQ|MkykV#rUF1$ka-4`C=A8Qpd=-nXo69sIK#TJ_+O>T?_Dj7m)4q7i=Ezx=6(rrib3E zGRicK&5Mx%W?EHXE}>P+*wCu8WiQmPWy0u_6M_Y=3E;GE-QJ$%C#7J6vlmO4@)ZcVvKuky4M+BVXa-Icj4f9u!9Gx zMdWx0RT(YOL3v8SfImW9YaynI1W(*^AznEzAx`)S#UCZ`ax6XGzUXKbq67xF&NxkmlkZhsI%M8EuA{ovtucy~ z>s8&-hcewmGQM-QqR$MhjkDK9x;=}Eq`#dpeI7Mj6CJX*Ww($StKLQRLMm2_mb050 zolne4TZTU_akp9IE-cmYVxD#_m^XY_Ejw+nui!-DiSD)YWhg8)D3ao;z&XnLG%1s8 zgB&1!66%$W3B(^6kvx2Jr!;9SLACIP(-aHp686Sb!D8A!D#Nu~25n#(5fc>%hQTJ0 z#f*m@3Q86N$xy5a<|oMzF$*=3`e87S(G*#2=+i_58w#fEe-H{kkre1OMviDw!uxZI+N;0`r%`rJ4Lcz#45%G)plR3=jl z|C)aNV;q+Ey-r;89`w(-BYuizUR0!&E;!@XUj?P7QK^B_bZJ6vMD#_1~}OjI94*ey$TIV>w6< z7jpB3&e;-`5Iesh2!$3JV^xJG1>4QplHktVVxJ}S^@+muNbe69Tcw6#D?C}Cyddys z!csdYK$2XycG2$;gsoLBo)8eXMRTOL!yrWbHa?Z^3^jk};M=*F+UU|@SW$XI&};e- zeRZqv;@Fv!fCpt2aKMQjntSXjosXf~qiEdtOVc=Yt zT&o<&fOsj-5hjuIZZE+eZ|UD{fJ>u9lR%wA9D2ztA}b&6`@NZ0f%7$Zxs?55d?|Zm z-0~WLV@_a>af)P45C*{sM){FqveRYDdU1wMP?cTt9OJ=vyjVO?dM28w@%sTWGschP zUs?JONV)%>rA!O@x3BYD559of@K0mwA1^Pzm0tqg7;SFaH3IG;QQ2kJ>ccqyM%p7Y* z^))`KM)jVsvfn;w_|R(6$0?h7`Tda!HWx99c?YzusS@DO&xk7>)SUzb}_*qpH^ch~hj$lut(4XC# z_lJlHW6@eDaVl8BIHq(|Xz36tk74@v2Gk(AY>=vQwmDrmNypM7L}V?%IhtY5a0Jz> ztRhAb<6iBsjcr=^wKNK{QbMaTmmrsF5EjuDlR^!=D0E>QGI`NTlxga;k?w64hVc^T zQC5K57ejC<5}I9yBwxnc?&Zk?Z_f0xCL1;L5Oau+p-12g2SMn3rMWM##KT(Tze@EV zXgdGBR2iB7b5E4-xA;3zy5Fgs{+@dz5P}7utPt?lS8AxQ48%rN8DmFSV;skJXI+F4 zQPuNGUyOMaR+gew@lVIG<_kh~0cUoMji^v~2$G3iK;=Ptl}W>6H2If(SMjk>k5BJ? zvIMbWhcc5-LpwXZSI@)Rzn>j;PPpRMc27@+iP0>#m#!GyadEbBD5OC6dj}rJJHc6J z7o7ee)yt93|KjO89@q$KYHU`+Rqz}WS1GoCwdOM*l}&+l(nb`YpcV%I%_}S-Kk56a zvix)q+Sx~YuA`5k@s+ejh3`Cnw_TT(4clAVNUCQKUVP`nVQHmY`~n&2?pXP6+++TS zm;QgxJ!ZE5cr@2ZlCuotM;gBIiQs8TD(LL!`~^nD&1^g;S(fMB@@;hiZODy z1rs}yG@`tjVQy6)Z~ELe94}KFtMqO8920!*;UxbpAZ?FnIEuN1Q5PzxT%9aBt4ybm zIQWg(LSBAVel@Myzr!S;BZLXmd2)zje~Pel#0vh+FnumH=_a4<7gZkWk3`nATv6Fc zT{tLoz>!@d+!iu*?A z%KYwV!Oh#5>Yq;#X$%ODe;pxA|C93$!+!uZRDSb4_CW&m`89U`YnT7HtNh;=69z&i zCPw!Elj4Sfk%@)zp9}MqH?)`bvil9k%Z>(frs>}t?lFVijsn4gc1PFLMj9Ga~k4oECxr2D2`cTpJ(A#aN%fm6=mbNnHhl7 zS`1(5~2>bP#%sV^*Z z$2RdAjb^$Rm3#7p&KF3^&$PX2bm#%F9$+~a8Nc|aqsFEj`?*|P1i960`kIdp%_+Br#>E@Z&%5d$ z3>gf%(T;3B8|+O&k|SI;c^?b)?S>RM;qx{;+_v(0of`=51e;cn6v&ft%Q)?wGyx%u zc|6J55;`}*HJcVvNEQ%^*P(HrxW? zWY2r!`1FQekU1pkL-O^%u8s$`{oUFIuvk%u9xj3$A8HqKXM1^jGY;=tURQ(7PED5J z>s9x`cX)-L_ppgb3}bIaJhDDA+rVi;$9@MhtWjW&&WH}EV|`HY90W(F z?u)vm$F7RH>(()K|q3JV$p(gj(h^{O_lVbx+eavO8Sq#m=e$` zCBtdl&H_&D5@w87(i4Y=*^L2I>l`>g5&=Z*cR^V#6hH~6N&vv0A$I{JelolbEV%lO z2UfN#xCx--nFrZ(;micGK_f1u6CUL~P|5lx^>`QZ(KR=K9Ah~V*wHVJ&n-L62yNG% zB+bNau8zgG>w0-jxKhy?0#Jv&$FwYbd{GsUwKG!)mQuz0stEWPNrhsb@iXid-9h?X z9Q?%m=tWeA4Q6iE80_@sbj+o(ypg*;H_Bufel38MgIGpXRPne+2=0KRzIR8QK=1`Q z?fN)Eh`odunNoRqxN?SSkzxkeFL#)GitO@2Txw^-Th2(m2Vo>OeXp zREr)pHs*pk87$H+6IJoyIP&XezKa}(+guAB_ej`@_kdUCk&Np3;QV}eqr*Y}@c5;) z1eoF@CqpMVYv2-$=;VneqLdj4)hzM=3sVyOWLfa*0w>v`;Bg&52WV6g{O{zmthA}N zW&!GO>4_*oPKF#qibI_&Eu~AZm}t^Yu1O({QHIeJ&IFNSL8?AMl!DmF?b2juQ{@^f z6nzMZNnrZ)eUuUvvW_L9Dz&p5S^+u~btLP*DAQ4}PW=`{hHRqH6#2>=S?p}AR8ZSz z<>56GO*|0F8nP#3@0h?qb@CfCIik15C(jOkaoJQNAqXz|M@=Lgw7K}HiwI@ajM*4k zz4lhB8RwG8Mb%u%sL22`tIv@7r$P%8!XOXwTGwGy30;T9H7i|RMj3L>#TXdY-+P+b zjqR7Qc)klupju)3`}GJ}3i)iemrd-lpuQ74`I>*-eZrDiN`EJyR(g|tU$mxPOV)}Hci7fRi*m7EBs$0HkZWmVLL@rg>JYhEAtv6* zW?1ESkUWNpLV8x@Z&(3dEH88+UKce&g3eTaUKhl_bnM?cR*=_)F4*f*7vgoT8~486 zQ$^b55J3xXu2QOc1Mess@V3n5mbcq#2?}(ZTM1NGB&#z9DbSMvmOU&=}mNZgQuYfjviXq zYSj$0i}K9z4JdDZzvS0Z<8<>HX|~~tF6-p8W4$1l(H-DN6?){mpx>14G_cU});DL1 zmdVXwL`Ld=keus@S(MIQ1O{osbaI+7%uxmaX@%38;$|CJRcr1YlJUP=7W39S&}3>9 z&x)TU%^F*63XX5}Y0O0?_7Pm9nW9GLV|kcZANc_o97DKYC(hDML)k{n8!kkvqhZT${^8`ReQSI?f7Rz5#zgMXbNYfcs*`@4KBC{CmLGB780QKZo zGBNOwbtMzlIPObg_)64A4~-nJ|NJVrIehG^5Bc5FidjAyQrBg2G!$EuRnD>t~P%UOOyQ=-9QVf z5cxup1bEem0NIp}nVaC{Xi^DAlwinYRKa-UgS2v9#YgLha8)iur~UR;E7wDGSo$r^ z27Db`thUeE*R%%jJjtW(#FAp$5IGqM&lO^ z7Ydw-i2%yVgbQI6uES3)4T23S%#jqKlV`E*?6=f$frW1}ry4SvZw(hK#757JU~OjP z0*Yy7#Hb$-J?YP^+a;t@53|gcdL%I&nW_y@o ztwzjB1*^x&Bn#?SHWS%sW1>lc%N?U$NnYbIlB1J0q@zi|O^~_|%VZ`yxP9Xe-PT7E z-av$n1VJth=P$1dh63591uhT@TC3uO#uEvZy{Qi45{$9q##Vuoxho+XreYN-AEc)~ zn)d#vH&0hqB}<+>iLlw}$wt^BiNWXnZTL5k~S6F^AC=A_H@STjviK5Sv<}*5pBN^jP>!5yQO1Hgdsjlgg{Df-Z`z znoK3hL1k6Q^R4tDVfdXDSXE7|Pyv}`DNR~Km;J}W{8@h8|YlnR> zFHTx<`c%MltxUMFyLmI-3{jOZ{IZB)ruSiYmYclL)6%jLc=rbC=n7-DllD3nnimHg zwHk7VJ0uq|ULkCRundiECL6SwsM~7tyQL(wA6urK#g$Y~yM>y4m@Or;x3=ITpqY#$#m( z;Yf0&xw3O~;>>d*IgFc)RTVh|rt(-1qaw(Wls^OI$@H(2Dzb3DT)#RW(=C{j!vm0! zqhP?ZEm2^S+qR2Vj6aw;KV4}O*?SK!P|LgkMwPid4X}f53{Y( z)1iyzbl*7i*^dj+T44s-MHr>g;_`PkxL)5b#x-tD6_yQLv>B)F@7w+NReZW_PWChy zM*^e6c>+UjrgGUK`kpWi#%XS9OLV-dfzQoKaWb=-u(GDbeFJWhT-=9k0XPc8Y6?nGNV zk1181Iu+zI3DWdx>f2&3N=b0~)TLM~>TphgNBa6BRwFp5PwwcjjGAyH994#Fqjul| zlI!WyBmX&QX3JKq$rY`8->UWwU(b_=+EBx{Uc_#_K40w3?a`7!;@NF@yKP7XqXTSa zn`}DxueO2(W-@Byl?yNhZZh5S$u_PSB6Mv~v+rYn$S+a$hsNA)2B9m*)W#0d+JF*q zFK9%y+_*b%d>7$m#JNlv9u^-j>z-(@NL?}))78+9BLX`CBlVGQ0nKYPz3xd_}vk+9zw?gU zb7!;jX3F_AZ;Ac@S!o6R8P!1vh>BzuQW0}P2sNHQ5#A3sn|C;lo+M}K;f?GODWX)^ zcRb&R5920&5Z-4^?v}0t%_mk&ss-m7$sRq7W@BaLFhDydmWk-kBP_sxv3cn;>XeDW z{WWT{@wDa%$C0p9=lt+wFEKGM6rcv9Y0}>8_oJ8LLCAgb$Ln40$C16uw}C1?Z*O-I zDe}Z3ES1HCRM(#HBH9U<&%~CHF%hQHHqY%XIj%!ZQR6l&VG`AuHRjv8yl>I|N{X-F zt`m?I_wqd=_3?wdBh|4CZGpB)0dAvUCIROuCC)0Y3;sGt3=o+(?esETHX(P9@N(Sb z3G_C%%gNi5YfQOsVql;I+T@s!=Zm+U`DuT*Cjqwm$<)zNe_&!Flcsj%KJS6y4ipu= zYnG_jxG1QMhnj9p@~b3iky>>|xOD^<&Y7N$YgMUPiRWMkYIqCnzO>VY{I~Iw-eUar zodd0H?k&_2OCr>nbd>@OSa_1W0Lq(l8W56N2mC=Ks{GJ2^#F7ja)4bTy?L`d3gvwV z4YH-Mj=Dw?6x|Q(M5Ay?IDDF=i!)Oh$R$4S+=ln0ij2X{ZXuKFy6N22j_);_l9=t$ zW8L-jo7YQ#%3tUqGI{N?)aPS$39>JvVPaNx0d9pv(3bs16h;JzG&0WY5}Ixb^Tyo^ zmm`qP<6Fb*M;cA?b>eB}650e%zEj?X=8}E?*xZe|-G!YU5CXVZ_?pe*?Dusd7}7x}S z(9n;5wPfU+kJP_KoVwWNQK+k*Qq1hGZMQY2-(3anWX)yz2cZO0uPj_~XU3b8?O=xi z&#PuDOA3uuv+H*8`+5k}<#NA{n9zFC8510|!yK20Yq*L_ku?TvRFRP^a6>wq2i!xo zBT=61aou?26_=M^dADj^`vzTSbe_EJ>|C7Hw}%q66WskF-(x^{Qyn4ErsaCVC`eCM z_qJe0#Rw+6E2r~mn@!23TEDl(!S}*f`YayFj{Xz6VqTAr&o7MCWYTgBc4<+CN*{uK z#3&gTet8QJu(^YZ91)B&0OSaC9gc)j!iiftW|drTa>>--N|-IHZM$B=UbO>FkGPD8 zeL5K(Ub9!HdzRb8!VtYB)!_WXgPQe*^hzgkg!6h`+t_QsI-Rf#jQw-(<-Wx(%W%Ei z1~8NgN^!x4JC4ltu}WUIOrEk)`n>TycZ_vb?_wRlWN2L^+VF`i?I|nUah%**bWFW| z9EF8F{Nl=gATaV`8=3tnDL8U_AgMX~v%QDA<|*W7U}x^@gqWt4Po*)erWV21gym!X zUo`%Bao0cn?bWsA9(4V=xevIIuc)&n3}Bv{Y4-eXac$oHu<_?d9LfSX=1?}`Lf0si zv!7ACEH9KQijNQEN{-#+?$i{yzS%yBU$_$rV|W*f*ZcKBgAvQMb$tb5EtdxABEI?> z*ZP{l^QrTYh>j=?5G90_)K-WIRjJ~X3tbae5_KH4*sLVD&ak!7vi0UD zadf7UNsXeExD8T{d)KaB-5cI#rj4d!LFsqR#CN)xkq?BP8${3E?4?qdRc=DBajt{K zIF;J@i_}fYL+#}nH*_tUu-1ZV z#%Zexo$x`c-!4SoFP+A%S(c5Ob?O}Di)l~hHHj2bf5YKqDa`d+^DK3A_f)Ny^1+Hd zzd*gtbDITA0jgTI92Y~3Dg$3Xb3I5jF4Sb(yy}!4tZms|j7)2L{ktD;4~>bDi#RV8 z!SIMdodUCGnT==uYIqjXw{|<8LntNE-eZbuyUO#)y0Ujrqs0y#J@secnJiZ>FC0RqX&7EP zeSu>Q5I)k8bqQaMi47VEeKa(XF4U~$<20V+5KjLzOg!g}<{NZ>rQyFJ);VFfZ{?tC zDurvq#mU{{&Dezx8Z<$?ZfrJ9!LPf_+UwZbj@vbq?da;?X@CTmqwzTNW0j!Z)ngnDbV| zU3viDxNQ!U`Ax0MEAk7=^DC=6kPj^@Eh%D=CcSjK7xwWMn${|x*ggYWY2cS3QHyTt zBbw7Ck%eAgm1ZIy_6ji$L4g1xo zI^^##1@jaiWsOqqI_TCy#VOtid|O*uh7(Wh51NU0 z@G6hN_YI046B8#hDSx_L6sBIlVfSM3tU&Hq2$SoG22iPUm!JtyS#ph~hND5#y{F1A zX=(jZtbS&OY%C9WF=}zsa2tU;+Rekq#59KNy>-BMo53FG19*w;C)Da~ zH@700m(kHg-*(s1Ns_%>HZ{HlPXqfW?wM zD)TgwWMQ~hW>^avFB0?*ihZc&rL&g$Nv(EWka<8o&(_ApOUUz4Kbre-y6>`|-ahF2 zcH&s;RiAm~&vpDAcx>>Yz2G`8Ssy(&;)3iFK!MbP+F{Q>CA>Ji3^khW1;pd1ejI6? z?;;#G?WJ++-qZV3HAsr}=$=yd+ToM`C;H~-M4>~^Z0wYux-Sbpz8X4GV#r2%1|u)b z$NAcQ=_ruAauhNOB6}>cn14V{9o%wSdeF*3-z3}s ze%%vN&`m+kS}2rhNsX%u-xOiBj&J$Vp`fgxps9`3=qjUK<0|D&?DmEj2Zby?BIwmH z#FJdlQA5<-E1aO=go?-MC*M+`x1sI~6U4r0!jBt&(Gbv`D z;7wnN%H?d;!&;-oxj`kPo}`Vxg2)|NJl(Fgg4DfVF?)H?H+|38x-+sA(h&Xx(MFtG5^JpV!(_*#DV)SnWu6eRLX1ahb;4;^P7J8+g0AUW zMj|RKnSt?RkBC|#sa&hoxtD(x`-jaHbn`DlX70whDcg(@2#tL%@amv%ZZ47AE+wp) z+s6!K%rX}5;Xr&a+`M&hKo;;8Wn(1nbICs_8I^=|990NlAH}u=l;+M`AUAa$?^8N7 zv#*mVQkJK?CyuLeIHtt_Hd#pr6$tBM%9m; zx_x+ibi(PWO5R$|0e7%Pv~P3pGhDb6|1}a8K#t;sCl|ZU0d%hJFqR!HZ7LW1aH$%( zK2(^Q>d~yU9|B?gOUB*@Av@Y3$qMiM+;z+Aqb&e;IO#^)WT*4>74*&VB*v$in_6N~ zG_r%-Dsaa~n$9TWMpY)XNHPyWSPxjD{@KqjuD(j?NFvc=C2qUGy;)O&vxL>e)hy3= zc6o-l?qrTGb_{_g{u34~PLKohE{n(DN8}szd&~S=`wi>=#o1fHR2DpaqBsl;Fu2R$ z&R`dZ!5s#7cXzkJ-MP5CySux)4DNbym&ZT(HgEU6FPqKgoT_xSRJu~hNltbDsuG_O zj@vjrT{&QM=+ASoI~ceVIDCLCVIt{!2-$AL`VMI;*T085W9G)UkdcM+A$LI2t2m?6 zdXuYUHoX>VcP609?^)sGpb86%KB_(zjKM*S3Zp5&@!9tE7)#)uDz{K5!|uYiHiuA6 zrst=a0Y!`i^C3>e^v2_im<63qMB?69n8J>3@CJs>8w<~8HR&Zb@pPz#-1wWt3(OF5 z4KE*s@gZ?$sW`VpGBf3g4ssJ#+eCXV^rx+bMjlVPT_4)meYzu}zHpi;k(%Wcq+E1H zlPA$50NGojdW&%`9)kb9-4^395ZE}@d^l0g4h%?!!+ybcYaMg%zh>vQwW~8^WV(#* zxFh3zn`;g+Tb%7}{d7+3#?oTskzoiw(_>_e@S!{NA5B4s|3=WqS&z$2=*&f@Q?A;W zMYx29rOwy|$ESoIg_+A!z7bR`g@7Q1g>_FbC^!*y>zZN9blHcu`Z}dc^Dt$Lk~Uf# z29bmBI&QQWiquK3F&ADbF?26)hzs@%I;_kDv=)gr4K4xE zWRlBAM0VV(q-4sPi{z|Z%1`co%d4x$;YaZ)D`{wuB`3j`kA=gJkHM=qdQj3~kt^RK zJ;NjXarYkW z2*?!4>55%u*T?HWecqIQB0P<7_hy-#-1ps2zgnGWFW*yjcU`nk(lMD8B7l63y5cbd zI%<@cgeJo&P z8WnKqd;e|5Rxy((B@m)xL!netaoGEfgr9KSl&|gT)nlcAyw|80!ECjAhbCOjKkCoE zwWnJtL?V4RKzxGenFA+5De0*)&|ej!o)fP$L=*eL(T@_+uV0I)9QcIS4|G|ewXQu0 z$mUvK$HS2si;Dg`2)e=WmE3TEt?;oP=XK?7+VGI`GR$1H`(2Dot;4_N4_ZEHpy$xF z)Wzb1&m0;dcLqmLD-o`Q6Aq0qU}F0bM4|{XT?ZUH2dO9)DQkk~=Y*T+BcrRZ#rDhk z4P0=UwV8m8vC0afh#GdHz?b)##C9UI($5=yt4mFjUbMjK<1Pu0h*J}BSM!@oIi(xQ zE5{e2)4j&X`bLK@Q{wTW27tceN|$Ux;vGB0XMZ<6*6(4Sy;ajV*zPUPm{&O>Y{%hx~Atra-g~*v0E=G;$mW zkVRc9lg(PynPJL}Q{n1*W7kn2vN5X1erjiKd%60o4w=N>)OgA1-QlBs{joQEl6xj2 zu#Csgj|4w*fAW|UKwK)fAgEw5)S@$%paoE;RN?xC9IvO&QO2NG4((i=m&toOkZrxY zcX@SH+Sq73DDw=dj5f-~&e{M{JFvX(0KGI)J`R;x=6`&=ytJLIsS^BKraP5oCVJ>0 z+=6B_E?}%(5+f&gjsE&x8EqzqeL>%a=(Tbtk$ z$>TC}mrtla_btio+u+jZ^&0yo;Pc({keJU_Iwh8IJ6knWJ6$>g;dk&RSey=+A zI7g2_^_SdaGEGWn!JmL#Cro>JN1C02fg|H=)72Hfst1W-R5ZIqZXuh&Sm)$V{C`9z zbjLK6*5=XB{m_~2PLKR)LUBcB>D&(*r~T`1J8f%eT$(zZ7aZ<9&0bQf(@MPa&N%ze zlzhHYqb~zojKBe}3Um>xLOn{Qcj4hWCW6(3u;6gI8FMh6RYXJD2V16VT^`|eA@3_e)JK|*H}iGMtSi*(2pmllg#6D>%IO& zGreitIdtTcxR4MmtlhZ&m!530t3xl&ZgxGQPC-)gZ2S}$yCLe&+H$;au*2ba9f_Ju zq$irkBdXA!R+_{H+(~<>tkis13MxaLT8%HC3B(-OX^p^jEX_f5>uaVtEjPal6O*#E{N>*(i}JAsE0pS)-rD#66Z z6++*p<9?lZpFb`$Z`iXng@288J>MRxB-OU#f%;g5G5H{j*?egg&%e8=3Q~5!HPCD{ zcaqXl(#yWMv{bFiT(`c`Ze|mkPFB>CUbr$tbkBl%TM-4Zx5D~F(7ADU- zy%G04i`ac2-Of*%u{fy6(5R+B>aU#+RIizRZC$8}uf8L~D}#`^Rpi2=?fYC#IjNRB zZt3Y6Hm6@k^sVTpa_H$pt*uFE)`r9sU2d|OYFjP|3nM>+SK3o8%UZ%Ob$v(#&B^UK z@D?YOB-MxeKqpNTzgBgbF*RIQ1a1LpwVpq`-qX7-!l` zlNm(-vzBUP>-`>b4IRW<*cEoxe<(EdlKRwIbx%VV7Mbqfh1A7_jDw2BAKG8WP9zeD$G2SXkK#T6Gx1$4 z%|JDHF4UmE18o)&Ib;LsAj>D4KGx|S6~Bl(+<|?A?ZPFueGCfpU`UhBPrxTyZTw0g zg#l*8Ek7o_cv!5|Sdhz{fG*5G*}NQOL3Wgo?Vp2!w5QrDw>9>XU|8`;Od?!?fJFG{ znD?o-*OS+o2g(7NtuUX-0-0a+^-0gu#Ow9nI0poEjXa;9@4sUiN5FqBzoqbvg0_)A z;@?1hw6_~u79YQgM;f<4OKQqwV`)K4T#{1Fa27`7`yEfkiUn2-MHnh-H0 z&Mk@2t~>kStnknjvn)q*yi&d3Oz^1^xDgX8mykUt>%sC)<}E>m0u!{+7ZUXOvx8zO z>~(NDd@F&g&{eAXIJ8RCHQ;i-4RrSY;{3vh1A~Z+O*)h?WV`RRnrKSH3QT`UBV^Z{ zNS{2S8&EK9UB3x$9Pp^WN3LXCqiaH0uWTx|N_LcTDE6s5yYk&}zF~LRcn9brzfI}H zbXYI%b>G}CHb1`%t$TIeBvpZQ+c%@fKfv1Ym6xk5mmAO4?zz1QTnY&I$MD8qg^DLR z_ueXKx14Wn&tF2%+?RDt7#`c2y=2}cm)kdDetgh}TrxQj)y7iC3qctzxyE|Rf3l?q z)qL{c{she()qXxi7(vmzdT0evZwn$~igTLJ>!DmRASR8#QI*$3-^F$>>hZ2hNwKZ` zrn~b&1fcT2hr%3zbrtkdIN-ep!=y_j|H|vdtdny46HvL&wR41PMe4n4f;dG!xJ!y_ zMQOd8%(@~lHpq!MMT$b*AA@$41Jf>E%bMS7V-Uw|=pL%;p%l>hH+yN@OM&4%2$$&0uY z#}ptRa4!sqw5;*tF&mj-LQR;>@8u-hqOz<>UBF3aTcH^n>ipW;{oy>#_xANk-5EXj zr)f4dVu4#)T)KFkTRAp0l77qxm^1NA<8qj@QJ?Ww)|KBDbU0q5<_$@fc1Wf57H|ER zu4_OX~e@X z%Bo*-)_KHoVH8pA7tCsY!xN;lsgXTL<9vBWWfsqZo@VVs{50rW=ow7Oru2|de!Sr^YgQ$`H7*&sx0N=Rwf2_PsK z`dXQyc=^hT?Kt*6jC)Q3yWv~dYZHHTGOvfsxw~4{t21}}?D)0UXB~+EZ=-tll3t(P z8^T$=<0a2z7+8skSL}eOf3}^B=D*&SUdv$mZ99|Muzk{PXZ4<}eR99#TV#u0Z-7q} z#Ne$L=BF!7-Sn?cZ!uPEpR@5RuTa+;83YzCr;z&3*=7JA`ci(t+0^^&eU8 zKg+N3z7|1lEq^JUDe1jh&#CxgdQo4U0pGq9!!-YAQpygZ58j(Uj8JoLWYu;vG~gO? z*Ks#Hlo1uj*L09ELN0tdhiA}YWFWmsw%h#7Cvom-{%KuqYyeqX0}&Wty@HcK>u&gVxX7B<1P-1D(7%}45!dga9<+o`v@g>R3i522D;xBAE^ znRobjp2MT^HFSfQkNjj%(Dk3M`xoedAJ1smaw~pyum`MT-$;B-Sh<%VcZtG@dc=v) zvh`R6PTs=vnZ0$}EXGxHd#mj(YMZ1l=J8)hLKx|0Lo6WekkYUOj&9xB;L>?|OQ!_+ zvsKAsapg7sz|`Y!A(wkW=WBuK4CxrtMt=@gNXrF0h(sA&knr+@XWZiZxf3d-IX=_%KyuNsA|hF9H{U z_W^Yf!<-+7E9+g@g(K(Y^6gNFc3PEhd^#V~tJlUB@yx<8OkZo4@9k{LZ!6yImR2l% zt7LJs_^KJnj-c1;C&3CWK1qTR<(}U;1xpK30;WRL8Ao?nPUm-7j8*Vsu(dJq@4V3o zyggfpW>A%4^3kz)*RJqvygfXjDyiT7`@jMI8FHfXp5N8DM`Tx~vB;R_7^rm@G@yh@e?}vz5|dN_h5 zrh8$fTeY!r4d3-RL$`Z9#c}^%k9s{Dx`_!D6_Le?~p&F31pW6SAII1eR_?RA)foh z`e&OS4ZrY3J&TKo77eU)@DKkH9dwlIw7`DYr<`Tj>kJxijFP_{(9;Qtg(SHR%Ws;( z*0|V9r>=vDS$)1gnorUqIU*t3X`6T%>UWh8+W#HzvudB=Lp&DUd?d~enlEXWNFSfj zRL)w!;l9PJ(7304o-k7h;pUu{$}UdkWgH!Ct%|X`DDhzd#{=#EyV%Ds?P8te+zfki zyu+#t;u%xz`-mLlHwYBqAqdh!(;AP|X)Y=yKO>BZkRCQRq9<~vjB!ERb`_n!62u=@ zd;S$O7FmyDvypGhHXSU6*l(B|-59VQb@C)yRVpFtDp)vrgL>!fxXJ9(JaaaudFq_< z8oahw-XVtS;}odr>APf$+$-mDqii5}TLEmW=b#~2G#O6Be5{HeB&Dc%;+uT8Lw@?5RnShtsFrx zk?LWd8K%3y93=z~HtcTgJ-4urf*%$*{5WA_WRzDp*@zugsZlXWDy2mK*m5eh=LNNc zxg%qtOfnm?CV%NM(>vLp;BrtTUsZ}&QBwiMA81?tuxXB;Fhw=#4M1rqG1NJf&Uy}Z zWv+IqCK&sT6_zWUKwN4T_L1`3t&d)`0?I4dm&tE|T$geiPnwK~5}jtY<7QW5DGZ!{ zm*H*8c5vnCRVbdT7kQyYi&vt8}g z;`)i51r~F<(Ii^)_2GHFk)Zc~er-*}e#5EzhVk$-1Efw~70k;%K-$RDs6wWFZvqad zJxz!kh-4v&x46sZd+mj!LlS!?-q~G)*er?SoD`KOKJVInlP{ewm2))rc(3?h} z^Iur}l>As;44<5jj_%W|SuB(es5xe$`N&aZ_Jf1C*+#mLPLoM9?d*|-Xs$7}N2OJ( z3J+eR;tTL|K==t!^+m;@bvPiZD`+LfT(3LuEb;?MUzER)NQi5#sCrH$5MT3|oXgi# zqs>)?SR2bp(PM7$-WU8{FFEzUg(dtSLGJ#4NQb~Lq{C@s#lU~7@_&My{STxAGb_ul z{~gi+zybJQuu2zN2u}E_?jN9u^D4sf;nT)=7xEa^_=@2wI;kbnB%^8<)p+aGc)C@6 zc4V>g5M$VJl)60*MpSX}fOtDpT&keh;6C&D_?`;sP&5d82&lRK{6uuBVqVIN6A8t! zFG`*hEAV-o(l%dC!iOES;7aiPuTx=Yq9<+tWbn>*0&TG?=KhNFPi$iZng;Qe)Qp04HyPo>9 ze*oW6Z@HuOh;O}?#)S{)-Ksd5U2mL3T2F^=!Si-!4cVm!H($~}Urh7pvq{HZPPESN zI`a8II(Zka{<{2x>FLzxzWbOw{GvwZsk$ktpVy?#zVXLv+5LogrQrd*;((RYK~1zl4}u3G+W)`zs4U&~Vm zA289h_DC~-4MKRKX^&2br+x(iVOuHkfPjNI;O+S&@Rn9{$&B_0Xj{Mht0_his0!sx zbTP0hYJJK!=DOk?x$^r(Zt4fSo~ylav3r_1tb2bpH#(Q*a&;R|3M zDI-PBx0PAYw;fdjc%%s|hLCcXW*aR|cltF)w0NIepV;m@(h#GI!PM+N@p3$%?|rQ| zpk!e>ddNMiJKK;!JZRCwO+NOiWo%H4da)Y8WQ;PZdT#!zmvDwEt9VO}{Y{*oUuAU$FE%G=c zX;2t zQK?nZSgy>V5ECO%B2&lq^%G=zf6UJwv$J?}H3P70%vnnvznSQfjHy%f^{vruDVQ(> zy#z!lmj@+WNYRrOlLxW&2L8~>o_WQJ!j>z81Gu{hN^d}tqN$KHiqct?j;!jnsRyX< zt2@%WD^$sGI8h8sSnxNvMV6V7hI33~sV4e3a$!ECKl9a`wxwdN^+SUZ3z_iw;`S?c zjU*%Z--!Hi8qkAJlTkGj)XkWY!Rk9?NAMDYC9${W!mngM$|sh?s0GLqE>(WC5_ z4%JYEmpu&}LF51eydXscw2Ug6t^-x29#72Y{@$<=`ACokH*VPNRqxg|3G?^H=O|^E zBJ!HyyjyCuQ7QTigJ7CZ7E=Bjr!yry~GRfwf&S6CP zo6co~<=f@;p!M73{ouu$&Q1jPQ|BDk^!B4nmm5Vl`*Wo5o6IW|iS_X$MSD^;X7`B{ zNm2#smMO}+#6X+!uD{5Fx6vV+^)Y3J$Cv}~HT7H<<85AFmF;cM74qZS6Y*{DQR8VC z_wh8w6)QR#nST6@cfo>m!Z7f9NN+V2%3rjRW0o=l$O&sIte5r9*AR>okfZ+>q^ABe7y4#N z-aw6aF`B~PXyuPxQ$&Fv342}=Uhb}{%N(0FRbZAdom1r6sS#ZyVPL5%(8%Q5%U`Au z;0@iS8sbmaq3{L?SdvK(WPp=RC;mdKHZw+1C#GC`!j^UgS(WMqvnCAVbEZU6AnHll zHX{dCTZXtj*n57en0=2^2uVKSdFfZIm2sS4hyG#SFe})>01es7?>14Y@+q}A=zoOW9gW=hdX!P^x%pCIdplqSeg7r{=?df&f zhK0p3fiW>pxx;`X*%2ZkIS?XM?epMw47EP<`nux1k0<)zj~b=e(Z5^rtE*wE>AmH5hpS%OGZdQ{}-w2t70FA)F8sL4F_uDPkw9X;9@x6J%$-*F=g|+-5vc7)-~<#{TG4fc$Ye~7;VLpd|Cp* zAqx*0If1A6SF5Y?sm!j#1c$W%-<}D=S5_NhG3I|30#kPB(474j+Z(ksp!Z#gnk{{S zDW76!&R5u9ip*X!{uw(A2oAyRz3q<5n;`=UdfmhR8Sk!iBdef6>Cr3wuQ8D?di9c8 z-JM)&@JwPAxfm8hThn7*F*2D*v6wtQ88EpRUUo#+1ztQQsZb}}l>7}ZC7lT_W3)Tq z#t$ERAn7j?Jf)+Kqz3&I(O)+IZ52qxK3t@qcUrf)A!A)dqiVf)I2oK@Us*qISDu-k zI*wxO+xbRp*xqbTK(My7%@1wcwTFc1-hFeWIo!0x%l$ej#J%I z)lqr)Q+#7QRy1k<>cp`vqKy)fXF*kzV_?Ql8WL5f-jt>|hu*BXqO85#RheJeSkN+} z(`K$n&0s7iqHb<%Y_1NSETP)_RT}cWBP!Yn%-~zpR^8N8ou>V`#KWyoYgw~9dqBDRl#db6PLt#-_l6SuqzG1{ zfTRpfb0O`goWw>Wg`FV8Y0N-h+)yeb!z}W?`IyI2C7FD9gE>Lq1-(Xi@pU`*b7f!i zR*nIEr7Vq_Q{yD$@b+h1MDHV=zQ_oVG0pyNVY#uQ^YHH)k zU%OoS_fz4F8Gz^Vdbkul^`KSQQnEj|Sqn=oq4w6?3suwj_CTCWnfr8E0zZ@1*f1s;W+KR%!kR!9*N*xq9QqrP;blvC6Xj ztuZfGnWW^JUclcHwc8fZMbUNrrmtM)iF80k_i__yYH8AfmUvoptb$ zg_ci>z-_}FuXu{j{b&D_>Y5~zmKJ@;TH?7*VVDrM4y}E$ESKr+4ciBOHl$mtgvM)7 zW0gMe1by$`Y2M-s$lVr(>_25NGJ7$)-xp{z}md zoF3860NJ}U6C@7boQHN<)1UI3cl=ok(n*9LKg-%^b!=)sx|+%i@pQRdZ+0BMs;M{C zce2VYHr2Os%BAGt_SqhZgWRiU&I-{Bh|p=;J)W3WP*&FWWWl+J19yU8vD8|n%}*Lj z9`nam?}HEJHV9HNRKu_!p(Iyvo7JIDUM>m3n^-r4mkUKB!)mp#&}z!4YxHU%aJC$! z+E`TEVHjbUSVyNZtQJY*u7go(bRNEG7SVQ(i)jB50<(s>qA{jaC@sXLRDtY9rpg8y zWu}g#;UO2nak0=t1X!ZjUZOX~@GMx{s8nFmBmP$TXO<(rfV_sRynOQhk%ZZ~sEKA3 z8vPW~>1>>-JSnsO?))x;NIJDvmgG?FtEdj-rX4n`1`)0*wH4-+%xWrUW-HF0tm9W4 zJ#eWu)!5c9&ww-_KHlgM>6Jua5<5GRH_5Cr_nS5+tm&y;ObpQk`qk@!U-7I&iu7_V zpzaPGl^vVYzOnE7wvr2uhqwHar)ai|^~tB7Ho{8#JKH%?(x>x$)oGbF*SP!HWKyS3 zdGN7gjYuJLD%pAFx#$oc*A~MfewTJr>(J1O<@kY0_ruT4EhWraP-}war;)|Q5eE)N zTgD}Rb0h4U>TBVmZT#5>KgHo8MOAuwdlfDI<>@KNmG61Ql+gE$C59KLWAEeDw)6hu z6|`+%J~+*uvn-?uIXPu@Oe3(5{^1HsM*q8R@yy6xe?chgWo+;mMNLG?e)=M*r2Om;6*p`-PCu^E8k;ywzoZkR^=ND`&1`fKHA4Ov}SQG zjx(KHl$_n(NprWe@&p+z@!rZl^-hCFMJhHDg&8R&;ie6<=-AyV#d7w;a-nYH0X%{>+Jm1{RJdFwo@5)*%E$yG|?Jjhi1kfkbSv3aR#qhO9fWKHw;6*>m6oU3Bw zQ#lR~B?E6nh*?06h)W~ipZ0(tAX8YTliG930H+i1W()Obj__VG?6yS1TYA^)R9-i6 zMI`F9ZU9=TnEad?iZH1qw5%}!6)Qne>X;_i;R2c51(KiAo|?^qKfWb$$SOm=00`%(BWqI3G*mEv z_5NpHJ%E!4l&7|*0GcdFWyn8bW_wy zLd%L6M2TjKpstrJa?;mkMsxBr)COocpuXWO#Ld&#Q#2mp$9}>ex+h&w#iOl*|wVx`&WWeUf#1hq``}!vpL)@Dn0U1PqYC3z;7dT;c zgOQcIBB6?Tf_gL~I7=PoSek$A9EP&K`{j~R)qkY55gOq!;*o61Z{Nadi^97p>`@39 zKRm-CN^^{)cTqK{Qj=C>2*|&Dktn$#8#aC{=^8a~ptRp5Vlc4ujuO_n@5tY4A6%mO zC`Tr`(WaY>?R@r8I8d@aM-nFATs;!MD_}R<>kh+dZpf--N( z{$e18uf?0@|6zgFU!oK$Y15`~#h+#j@>8Kx&U@NZSMgz6e9tA8Q&oH3aWN_viPLlP z(qX&BWxkND&V?MGQ-jr%`-~TKpXqOFx2LX)SbzCS`Jk(8!5pV3fBWk2Lf-L+W-DY5 zPLxZC**HIylU8$iEv|lx)E#Fl%U0Rj9|o}pW>Dt7y8b--cI<(KuKkWJI&H^!x*YUS zUB0EzO>CZ>H1}8``C5_k%vx~eZvQmO>#g!+p#B*D!b~Mc8I_?vA2QoQuDB}qLL`*U z9CSuiC8AX<@l~$AtSV%YUxCQKXu3qsAvLz4p-P1iRF9{iBM8+^oi}VAHhTo+A+XIt zeO==KHvaRLdc+-9PVOhA9DJ$$z>)blWF_RXi&lR*rZ2ksGetuNxGsq<;@PRM{$lYF z@hdg8y`@4%Hq>qJ_06+P2*N7BzZ2DcWA;Ec7Fgl!V;RV*9uwMv~2GI0>x> z^$A}>!RfP> zA;vPlae#9w9QVU{x#u(9=a$wr-IeX^j`GPG+J?LW>oniI&5y!7c>TB7G1-*+nyjYX zCfSsUFk|n$wBm2a9JW|w7Mr~MZGH$=nA2}x@lp8hd2Af8Bl|zjxWR#(RRWBK_K}-# zRn%#-_}aE1NrL|`;-1I-whGmY=Q?bYFhCyL#V|`e~;FqIj)cR_G(!U!5!Y| z3T^@W9?-5rG%JhEc>HS<`fm5GWQ!|vtTFCvo-pzs4H%9%B459fhF~lp_1e1wiq@Q! zRsz$4CZJK?adJ(;)12%GyNGSYf(Chz-%g0L+*B&)A|VF{63A~kM4R;v{bP+Lcibe^ z?6k~yXj;+}oFWYlqYPA$4Yh`o3kN-)?;YZ8V79&!^x%(oH@;wF@nsHZUG8Z>Mej_J zI%p|jJ|2qdcN^RHZP~9yHGe0-$-?Rwjejf>-^TFN&q8ZmNT8EiY)^_&Y>5t!l-YHq zDEu%Kv?aR0dLkpq)BTZ&7CUOl9m7PpfhMR@Kk^m*BTeakgpk_g6P@3+F}6m%me}98 zi9SlNZsXgv#cemox0D^0JVukp!$NUKo&h&?p-^mCy&I2qhMJS^<_F-kMv%S#GP%}NY zs0Gzyx2snf>r^JmEQRyBsKT}*? z2uo7q@q$3XZBkQvFD1oU>5iZrGI;PK{dl=Kv}7aprU<~`vG`419`ClGYHK5`*}67< zGdgXJ-Kmx)<~{q2vfG5PK}O^EdhWfsK&1$tfQu#r?#U4E*C|~m_PR~f?74{6mYlF8 zw-_R>k)?M>pTNcZTB86{y;%9e+OKle^$=5?XULp;K~b=q)(#cB`(6CGwJio04d{la zMv|Yo1YGYe&0*{g{AAWa9hk=;AZGD^TzMZ=Gv$tafC`+CjcGgf+3t(L$8&mXuxO$b3k*^niJ4ay(A5$)wzAxWLNHq z<`DmMfp-^NCH%QmCG5fwL%Zlo6hq*qpIh?UBZAZN3m_tKEwM@ebxp3lC~|eM^QM`6 z9q)e6)fADex{;x`{hnRb_Jq;@4ol!Ag7{q|_JhRDwF@rP?3m8mlMdDNoK!wR{ZlpR z*4_aMa+N55{iteVYfCnDfl4$SlZCH@-bmU+%Y4glD{IGb!7Noh{!adtcZ~kw>|)t0 zUt?y|q+At>ntvr(+gq0Zh*#C4>Pf4&^`GOa-vk($Nq`y*2{Z#2=QYkpwO8LYt_$cR z6sLu~FT1$^+T+6u5KsXQFUEU4>2Jb{|UJ^Pp0|b9h9*#{oiC6lcTi*10!HoKl*P~GXK9S z|Hs)I69*?7^Z%wi3@0-S)BloW%oEm4Yq0TZVx#P${GyZHJfcC_xv_kcyj;Dnj()Vx z3WwcjKHa*9!zt45N6!^85X%QOB=D{y8}})Is3QLd^q%ft=TPt_Y5pD?@9w3|lc0`Kk18&Wh z1l_}N?`6~+gvQ+u7o_{QYhU#EN4HWPUT!GF*_ zLbye(z#pIpO^WIDskfw_u@?Of@3Z}+`+47QLfrF_e@62|`vb2LLqmQzVz9uIwyn_W z1mvwibZYU13?DFkUye?p#Su0$`K+6a@}>$nf96q*f8`R?`gU1Q>V@SVtZRUTYV|8E zisj;SpdPXV4%%oSynp>0j z2~#$zX^|S?brF1H8G556Z^n1*T)5TkYnE3gva}Er17fe4cz#ps_?FkiJ1ci8}aOqS{kb{9w zw;#a!O)T-pSp2vvc$N`QT*QskHKWxEN0|hIgEz`vfj~9>qGBJ?EoiQD}N-* zcbn68lKHijwQ!-;aSOb(^l~@9>!yJe1s73oGb)@P?B}B@CXYrXBl2XQ4D-|fVlr}E ziX6qw74IAvvk#;Q8C{Vt~KEmt@#N@N2|o*vCa!8P zyV>*7j9@o|({s`6?V0HtThiosMPZzvLLt12b!T?}KnABfGEnp4(+U$K?pr*G9~CA* zGx0(>2hR}<*!*)=Hvq-cK6RleDFsIu4&Jlb;-FYRXfl^Fi5s!d;UI2kuUg&ePD?X4 z`46I{Bf?H!m!t>+3Tp^D_hfj~C8cp@V!<6JXhEyjNrDk9bxxM~j83=Y@RXddmJTwkDV+os< z<;p{H`*&eDK{ZTtM84uFYZuE4(bN4jA#KTC=Fh{yW6L-2s~~&(?Ujf~+f)~$HmU&eRe>?fQ$8>F5#d6ZN4sbBpbY_$3E!Y12Z_C%z+Oc*O)~>dpd9U)?*71Q*&+L{w=*_-)hWTmJ8hDVhxuX<-tMiBJ~u~GcLnI0erO0uO}8G;@~IfF_+ux?B_L?vV5L&!QxzC%1mJ7I#xkd8o{zM&?ZO zRyjrhYim;di~M9-fzkd@Y93D!a%A|rhZ{t*KNO}g(lc^O#K{LH2w$?krK8+k(argo>=aGJz)fw!%$2pRT#qyu=c) z!Wv+o!vf$D?EHN>UZ1R@npy9`5{lRnS)lLQWb3A_H;%y}b2XwLwJG{&x71ytv{2gn zl5BV|kPO0k-x$k=@kNdmBLR<>$K(C$8p?v4T+3 zo6Nkf)|PzLA#RBesZ!DT^1`Bn*IAuYBUHhf-HQT7JGr6EqA8GwnOfSL4)2l!k)p7x zS}U|I$;r9`uA>pfI6}a*h;V(|N^1{~Yg6RC{ByZB#D#$5j5g7i=o5zs9IvWS-Y=#s zb;Sn$BhGAW6bmjV=F(IH5fSyc?QsS(65N#7@M_}{-iMe#`W|OZlTP_iPsvK5#AuT_ z%c`lpTC*}X34XEgpfx)%(;;EG4BDNCik({)A!ORCtKP@W9R=CdKx7WxtcZ|E;Vs5ze>g`EIF2CTpVGmI~p&W=d;NZR4 zMW5R?0B3mvO+0cSzT8r~5@`q6*7mn@D&yGFQL58W_APdV09D6#1XQ}ZwqBp#i)%Kt zHOuX2s~%ZSNx2jd8CH=6rOsJW0Dq=gZs;A;Tr+aCk+(Z>TbF(+xFO%wWBTh#(%3}8 z5b3FRbZSLF$!V=Nt)cb`2-++G8mOmB^9k zcFA89jln^pmJZX4JF4922SWYSTLpdb&oA%H?vZdMo&z6h@b1D_xwDubz;>8nu)9ciOhZ1oK$Y*>i#)ky_mQxpLGfCif!{ zE@~_>|yF^;qGyblDT?7tB9>os&*V|ForX!pKZ*4S`&ODXrp6Zfx^~YiKmN@i*9EaPw>95BS~mG~*>4@; zGF`%YYVFX9v$=xy!xggSTvRSe!(JIDA4IuB6Lxzfdvdjc4ZkVD)65((`nN$$XdN5?qQZfjk1`I#+D@OrL1Brb&hduWK%9)k1oP*`i%Z2&xE;i z5_s^U=`S_q4r4i)bc~yyJ&GMgrK8TG>Iy@hA$&rxj!2-_91loaTV8t%7qZnyMb)#h z)yv4#v#l;ISv3`kq^$vdxv4ncs|P@?E94^1pRrqO@OS$4I3Hj{#$A%?*O;oz-~OZD z98il+Iyb8Nfbe{4`XJjF%aC#5z*u*3)^VKETHJa;N*RXdZ^BHOa9OlIyWpg?ez<#9 zh1$0{WXR-wC(kK`Rpxdxiig-wMXK|`QJ-QtYPH1RR6kV}9)T@?| zS!mP9n1okbeQ)K-SfR77mW$HNP_tMDR!;CHZLWcDZk<}9Xs5PM@&5oz9rv5E?{@V; zZoxaY%N%f79F+MBlu-8+_--JSt$V~+s;ps*TCNLk8Te9~7d~BTsY1(LfLaSs+&sX( zAKPF>zTxXi8{%0=f0AXl`LtIr4@p-5!Za+F+L2{g+&!v5r=9<6={tcJgJ9BB6|xg9 zQ?MqWMoHql;0sd740C7piSj7YJ*nl)ps8);-JN{#3r5Y!4O16e>WFTmYdaC>fZ@)l z!#3n4klX8JG9>sM^HvF%E1H8XP-dfvIhf3G19b^sQddh+uu-UeLNNuve!`?u^XvlE zVDTf0lm@W{z-~NSyD%KrY*4S?K9*Eu*P}>eZx=~EX->kOeSz)9c^kSD6m{5`V62Ya zv8_Rdz@P9$2mAw|?PT!`oyf-0J;hSHyO2`Pv2LK3?VZ2%lR&my8s2~|THIOpPVlbQ zA#X}Mk8I3jNLP*dGGF39(5hqWk#3pp#YRo%ZE~h*CAFYta(jYc;y%(|N#NZ(cNNvZ z|3le31!n?vZQ8MIr(@f;)v;~c$&;jG+qP}nPRF)wXL@R?{`tPY-kO>@+ehng)n0pD z`?^nc{H>|_(CY~LDGUl9l41vziTI_7$<6ajyWp@OVn(<%CY)?a?v{Y3O3by-57R>9tD6rR#&&k zZsS+8O*Cj%pOdKQhs;j^9|>&qPJ7m^j`ofxZdrZ|`3!#K2cjG-5=ewI$o#-uetJ&h zWF3>)sVpO@dRoh1kxH>gAf^34B*bTUk2%*~s z40=>OqiIMT{%`)PK&438@ft`NrnZ`*W(gCIO3~HJBPQ!wuEoVx@j|xpX$IT0fBo%D z0b)+qSt>*hNlc_s-AmN9HBoBg)jA5~cr$J3xe;J?yW|vWY1X7MU{#*H`ms-l=tkft;*0XO_lPu%NXyA z|I!uWYA^6*tNvXmp%49wd&0~ow>D#;O|Cl1sF*32Z)KsemVq}vA+b;gk7iW=+4=f1 z1z$(sm*4>{0Wz9IYVbUi#F^v`329|!?##eTA&}I!GXu|x=Y`3k$b$$ZpunPzLRjTY zZ$3(OTaJelnl}dev$S!gR6Fx4VVrJZ<~slRUb+#Y^++%AbReYs!P=~Ng?sv&G_|v# zyHbI6C>itx_O0=6dN^q@6GR&TqM?xMW6`JSN+)dVv|O067g28|E5ZzCf7uIm1XJM# z@8cZ&(^s8}g+__blc{2L!h^!)Zc1I4;lVSm(Yf}tx8L^jGs$^tFR)5$oe3?}3yb@MB$ zq+~|}#S+qpT=@ihr^Sw)W|sgHhJrk+tnF17uE5sTKBgoXrp*Q4^B;~TcM(&QCjM@6 zz*f6;uM66i{=(&4%ELzWuj5=k%u3b{n*hhI=BsfHliMrvSW(&-ZK_ z_|8DgEWEOI!!FV{&}`hD==y757GiIh$P#PLz{@U%JjN%G=b)nxuNW!UPr_;Ewd}7r z$4=bOZwUADX0&grE9zwY9cBLQZ6-ZE{_S~wy=z9-)@Ju~S=}q!E%E^o(i`HNTr7rt z5I&HgyPW+_;?0qCFosiZ&trk+F$#KLSR}eEEctu(U7gmoeJ9OR&49_{NG=-79?lRP z`D_;cbbWqP`gZvfr?Wm00iiC|CWUNmGlJH$r6dCSAcMjH0RAPvt{-h$)t&gjFqCkfm<349@=$PDpxga~Ev}C$ zj^71a3%$4Rdpl4-;#iZi1B1mVZuNQimP{S6%8uZs-jDRbqx;q!+W!+6*7_I6Nd?Q+ zf%&Wo@#I_X4%S>m`C~~AKSRI$R;IZ{wb_Ar{-QFfxn&OxPxa4IJ7UHk4ea$KZ?i!c zcd_efETa{)p~)#4LH)D^^+163se3%9R}W!f?g9WOQVBo}^OU%|YV3kttOPEn^%xKOD|6H!N-N+u9ZRiU&g>L2SMTg4 z@cTk(JgSbHl@t1`a_J0Ok444N6`46rr}W81;NRs&!c4BsR){&YHg`8jc+_pR=XM->9_T#rM0vP*+d7r@oLTHRhqB zP0FA8h3^t9kYczV?ntDNxM076Eu!%`dfEOMugpW+Fvs`kE}iXipIFsUUa)1-z|WKs zU2oII!4Nkq#&YBjal9UcBq-$@>w0?;&u;}|U)I-JUR~N=D0)PsV?T< zUy!$JofKY|FgNyV*&-~a+Xl|2PzF7>+#9g&aSS`-L<{LqJE^N7h-aGf!Uax#d`53w zsotRnEHFnFF6;3pC%=C+)Kn)|a zC+DyD3ETAEdsBAM+bw)#`nLch6p$L__zd4nY&>Rp^b}VQdI9szDSjBozBKgOd1cS< zW%%KLCtC+Si4e{SU3#Tk7VLvj)iSG3N!Fw@4eQZA7hx!f9Djk~M%nm)Ie@_mCCOl%;);9CpfFG-rL6H0`l=O{-mhO`o;t znz*cMI7tzYo5X?PXhW-!rpwzi0=A=Wro2gMaIz!k1X}q?cUwo}mkRI0uc}FqqKD0x zCik}YHX)$;e#7Y$En+X4pnXQkR@JJADCaHa&X+1?f#RH5{~qA+dgN6z;NyxdGO&G% z<;|T=_-1}2#@N3>>86c&w})kC1JCbSMT#!@J8uEX1?rphLohf=SZw|)%*`{Z4BX!! zP8VW@(LSLIB5SIN8+bBEeq__uu7b@jBYn-J%9h#K_Gf7Y@nX6AJAJmRN1nsyYssdE zK9DQ8y-s@UB~Wy;hxH*^dB*e}wJqB-Yp!sRN#kvQeKYs^cna?eZ}MS=myi#rCxcgg zB#Fmb;1G|i!aSEQW74_*&@D|1)_I(TY&)oTs7uHQcd8U&k|M7LH)Cj})MwFFDA9vv z3k8upFB3S8TCM?V42X^}Rx%nTKrw%5Tu!)Nkr-Vv2oT6~UX_p>;lZ1&gwq-#?IDbQ z$xr5EIERr~;i8k%rlNHf*6{?$Pm6U=GH53?gAKM}s?VaLVxk-Z?v@!tb$s(m*BLp$ zLGO?TDpR6XU9d7QmN(qJH+5>ynFSxC_f6NZ%k#X>yhZFM$VARkW_m3XR%yB2R+A90 zN&hMMtGznlvQFte^71}LRFekzJD`(1M5dcNJqCO)hFQEw&EjfbsV7YxbDq?=9>ZOA z(FRuo{Tyl+C0p1UwbFyEtD=n?8@BoFz_D|F{>r(%QI!rSb-+@MEbRjyI#SxK6^x0# zHL)v;Uqx3fUDe9k2i`ZPO^mKlQ<(F2$%{vG#(jrDkyyDxyRK`FPP%ZRb)AF_8FhTy z=08M>4p(#U^BHfe)TS)QXRUFOhVZ00_J_Xib|lxQE}Q|YqoMU>B0s;|*Vj9g9I-~v z*TLz2W~uTk4P`hQ5 zpVj3fg$^>*J|=c$xkf%L85KWa@B3Sbpx3rK{T;y_z&DD(ukxoOz=&;lCZX#T6x=Bz zgfn@tRG+Ahx4!gDgSD9Ex{39vl+4@?&uU&gi>O`I@FvVqnRB?6?E^$E;JBYTmad=z zBMpD1#9$-18#GrlH7fRMD$2C@=wEZs&9&jasaay-curw+v}{-|+%TZXB$nx3$aK*b#8p^WQOBs!-qbof*Ppu)=S5)%~z(%m#DpPU7VG?hM5sW_vD9l8>b5GRGUA4EwGsCniQ+Qiw;1W- zYkwfrsW;!fxaFub9}Yz1AIs788?`j*iRubFeDW#7o}G7AgPlR2so?V$kntr5vS+#t zB|Y{zxZQgn4D|-+el5r>^_tCED(oW~U_KV8xjJTy^alz?{^*`roqI8hFxAG zz=t9nYu-jiY~sO9ZukR75FkQ0fwJuVoau*LyMWgpr*RTM0pvbF@R_m%D~vO}d1d*C z(EG5}j^PIHl*VCvG0ie}j=3Mc5i;hA@gCctnaqeG-xdp*p)Zn`z2rklME~)CTy(y- zXK5ALL4t95CMJAfUX(EKL41tASaJ{>n~fr2d*J2mgdFEWB;jgA3{QKA54a;@;|~$e zV*vF;oGAJY^@uf~JT`tCpNSp#&1}-2@%a@M*#e(Mv%7{wq9Y46;s?!jM}*c- zR|fVD_gdRGu2{z0C$jp@G%xZkTXyi9FpwMe$;Jn5_%=5lw-=U^Ul=%#3_>vwyCyjb zDY(By_%y?Zp`E#yF=R7$H+Br_3-l8?`^$ch{P|WO1U6o0p)~D<_wD_OP%w5>gNIh{ zN85mai%-ME_gk)GkK|=Xj^5NH`v-BO`NV#u|Ew?X`)Y2dB_z!LQ@?qGFgFK~*1Wsp zoi8uajdu<>Jk(KWT!1ysA=0k`niBZ4^G$LdghQ*sr^28ju&9wgdyiOO6Ih05RpwFb zi?As0^J%yET5hPGy-Kk!tum7LDdBLRXF0~oT6NnjxHq*`N%~>bE0pIM>lji%Dhnl_a3HN)6SIE~;aFl+t zes%C(l=WcH0j@n*vXO-41Z(LWWe!iXhn8~ZiRK8Pi9IXq59&0*l-2Ca%-izd}UT)k50FKw|<~SJJf_9 zMq~@}#HPR`1+BNdhFvsZmZy^Dyq)wF|;dL?aaoZEnAJe6&uXhslUazNeW|#^=x&cF?7t$^osZAO5w>2^Q)Ca4Tple_Rq!iYTNwR$d+8MePwqX@coj9|4 zu>eZnTv=XYJu(Zi0AUe+g&)T60%dGV<`_urHKauUTCQb9S9xKEOy@&7!(&`25y&;>p+Ju|*7lJg8b!?*n;YRrs^wHkHx&BW% zs|_T!t+o+9&uNyc3wT1jTSafR3%dLOgEjgFRj_s$ZDdP*os&l7s<0Yj8W-)NUe*qlomyR0*veYwd?&?C9K!}ZCC8I-x=A5KF<1?0vs9ahi*w7 zq7oFv7HsOEzJJa!yI`l)`1YpDME2XOrip?b=TgiRx*uGXqTPNGYu0tw--7)gP&~(; z&i@D*{g*^;Wmh8?PX|*55h+n|dpj4Ee`iLK{{w8q#Pr`oNuyP4WtG*j_+K#WjBkMN z2E+`Db-=O^S0kl9VsHJOc|1wx8lNH;zW%nIg# zxi`gAY?+ZmK*WP&Q5r4}MkT}i+!W{tc}iD=U7Ic?X8C46cyB)VZ!))K0@APq6;ZSJ8k-waAFD)a<-*uZ z0#ki*xYBYU`Zn=&q6u*>oSc?xewD)3^v9-Qr-7?2_=CWOL7MLJ?LycZK*=gPs_-{Q zRur6oAvTSFzewv}>7UZ#SzvEOT6^Rnw##o7_oKj#H0g z00ST3uB7E*KRH%YSH~4YVM>uwZNG>H!IrIS2UCp8HfnE|b|FA6f-&qQ)uf&tK=4jy zD*M$4>*0~VO3M3BhVxoLGqI+0Ru@rhwx-sCrf<=>YO=Clu|gWELZ&Ji*%-{;S*#M3 zglkl|v}4zjnH^7yAy%ueLcBfoVTg2oMI_S9Dj38e;%G2U zM6F$?+92)JXm27e_;OHeB6>!q00Qy~>rsfED|}3Ym;)LDp(f~sg!9CI2BEP4Zlw%J z0IAy$csj}4+Ei)XSMeaH z>~hiKNLeo5tu+&Q^Gk&s&9;% zPJ|lqy_~?0cCumEHU0K)!hYjhrPv*NM-}8|{G;A?u}kNGwdl{i3$E{Py-VH(2>^|y z6r_^?(TVIe5R64MLk(qCX-g194OOdTj246qWmdKLbt{5kTFw~U*NCTus&=l8P_1f6 z9e~LB*agD{Lg;9*C2U$9B66YH79kiQvPOLf?GrD8i}7yd?qqQwOmc;ca73%J3>YFR zgkgbtbfn~{n&-fqfUS(uJqkUNcWRz4Yt&pjHU)vtwH|dry<8=OqTpq`zPl?z<^SnF z7H4plc!}#i2)NDXz(Qbcd#c~ql31NtDau<0MkG|)-=Tzmb{N*sfwQMlW+V|sto}Nnmr+aJ76w!l{ z@L4g;T1W{>cw0C72{1E*vbTXUkLED)-kIgVUgq;yIMio&IQssNjqU#`=AP-lrQBN^ z$K>ZHxF*RSm+uQDK?&UgB0OYF^$YT0(`>Z_k_6j)2swXn8 z$;|G2j(=aYmgF!HckQ_J*v##_1As%+3qo`>8y{3OeozKPbkD>LO!FQ@vHeGQ6`@cm zxJXb-Fl;eoY#K~4BUr&&VgspxNSmF8?ywi44dyNme(&QH50JbmQ{R6M(nOHAm>4Uf z9g03+7>tV7F^>YIYdw78PT%ur%+IumD{aJqe zx0Gt^GH{LBg)V_OE;2|KX;5JO>A>uJO7M!M8FYOX zeiUZ>Hke_I1bOLc1$|`37*6MRIW4FFb&&+TV4AW$D-+BnN~x?FQds!9NR%LUVPhI6 zuoNvyv^X&Vo~wb)13Mrv*YlN z`+L7Gp$(s}ne5R_)d^I0Tsjp%(#wbci_sxi6HOEk)jwVba7@Y7cYuRE2eopafK{^B7z3EZMQsfJpi3t zm)^!7V;F9#YQNrCFK1pL=+4HFSdlaGuJsA~EtmrcaSiQj!Rf&1@9r!FPizaVAM|fL zxpqnzYhC)3v~+PgBO>h%qsXxAhv1Q;NE$ny zax-$f-8W4-PKtzcczcZBO{CACqP<~_ncDrBHO!my@ce%8UtxtQAO&J;BR!|)kxDW? z;Oz85_ZnmT8X~*=9Wj3b^@P0~l`%&ce)kkcq+BS~q+BGx2xjoEgM3b^zp0BB-lq&c zg%1Y_Lgqkl%gWC935VwOx9~^Q#0t=bB?r{XGv9i0PudaTz0-Q8k03)+tTsdA!3}+^ zLBO9pIS#|4cuN%2|CP^KX&Z>QiY_e8&o>t%hy}v8qmHc;qQ~6Q2Ve_fxxC8M+PA-z zll~}uHAiE$-p_(K`nHu59yBJ641Bz8_@DiGz~7Dr4C7o=y|Gv6_sbX?ylH(iwCrso zQwK1p*Qo1y*o#4pCd{wy9nvX)TzUzen8s8YK|w+PNV*yZ}`|ixPDBOI_%L_>D2RFHKNfpw>dm@kzr#^cw0%8KJm7 zt(oJ4>u@H9yTDzaVmS9FZ9pTkH{i&)@bfG3lgD@=N4-8dLDyxk^40HNM2tyLi8OKe zRg)LwF7SPjZx@jpM*s#7m{^pWCZA~mHDcbNVIRxG+R2d_Wv%TWnzM=(E=x~7NN46O z!2)tcVMbarAV`(?n<~njupunGca?D{dYL`AC zW%yxhOm?Rdz^kV;@H*QgMquPgO@2>k2FCP^?M72h3~|g&fD`*IibcnU)hTkv44}B? zb(rE`-A-#6cl|PLp;qotSEPP}yIdc8N=+@`S*FFq@F#lVv`Soqb)Q+peu08s3w+8O|%!c z*;y_$^JvbNdy%)U$@2pw2Gj@q^?*VH0b@5Xk)@6sA8?8JPdEAWAil}|oXaoX5>yzB z*&|GDGG7;wJK|1aSbONXs@>Az?%MhKYb_T6V0-=?YwK48KDvCxy%_0>`jP4+|HZl^ zDFhPU_=-AVp)!5b|I_!HLZU?kb6*rEn`QoQK*7#Zj7cnWG@gvv8b5jG|F+=xncnu5 zP-1`sTt}jHedhM)0PUE+{RsaZL)~HUZ*oH5p|oM^%fURI38kCAP;UbFSN4Vd=mab{ zV{Z2e@Wv1pFeb0TT7@lqrhnrDD$3W#(YF279`(T)BQ4;D<=Yb*aT%k>yf)wUX+qFm z;lDc>)T`9NB)6Vo-x#_azKn(8HIsc4({4A$LUAz!@T@V?Kx{dnXhbdvBq-K#;oH( zoCipQhV-}TkSR)6kRQgz$d*z=`-u}p6(G)CUPa^c8rOA~b4|2x(e$m0O-rKZ1w@ww zc3Up0?Q2<*%-=wmmJr`6Xt)vqPFgq&E(HB2LtZo!9wAjvD#W{t>gynMv6Lw3ud4Bj zvYUyN7w?wgO?&Pn#^gHYSSP)ks|gxd1Z%k!Rj(xx%wBu=roa1wcYu15sxpAX!^Qjv zVj;RWXJEJ|((0)xv7J-f;eBOnZDDni;F?Cc0hi~l$%4sH zC%AIU!f>y6L#Z%}@M?t|#}PhO7u@-DK_;Q0mQG7aX_TC=`)b6TkN^eq*dZ;JZu*_1 zenlI882bG>o~xL+(p4kv%binA_Yc_@3$`T7z~<)8ni$078@lv`D?Im)E`-R)IHxLk z$NCf#+LZfp8F+DH*NzrLVlzZl?gKJ(+v=?Rjg98=O*AEV&aSJ>bU$2;?;q@Y80M%d zjh@q__bx#N>;za5vzT;0x!hV?K7_jyl2w&r#54y+jnfI0J;*evO+trgdyN)zoeG2B zR}-txtZkD~r4=K246pb|yF|VISjLlvm{va0Kq4fLVIUy$8pc?ODJM-Rcpc-|FkIR2 z@cjel^A+z}GZl|bl>*<$5b30!2&FqWF0WKEm!*x|kL)uZ#4^+}TvDoY%u*E5R!y^FjH z8rMuRyq+#lP6VJ_+A9;9ojBjwO+6vpO$ErMISlcDlAG!1#MaVT+BOHcAZ{!4;ECM! z*0B?siQ8JsKfTWDp?K$cP=p^qJ?tm2#6BtIH2Z1&Lus%W9Ur<}zf1cT&)imPK@0hz z02{vbvZ+jvUUt1*(Tu@gc`Cj4q~dh_>0g&IkCIUo%Qk( z(-5rbWlt>F&x^})A-t%#FYDr!OD@#LnGxO<$zIJCvMwgti}3L+Uk>{KZ;U!XE)i~DnZ-!3K}ODi@zfa#@;az8Ah5f@M$+#~5J85*4< zQ}TQ~?Zh0xy)@F?MQLpo;XgPQeVp(RdPc7AxW=^*uz@5?8YB*-5v^nxEEg{nBsu4M z{^XJ|A|+nsJ}yp98dHQA2@u?iW#UtWOiTfXrm^V8sHU`mv`Sj4HqBt#Rji?xRyFeJ zsdOlC%z#34jvgjvt)dYCoeB|a+l@kcWrhmJLu)5wA88=Y3%7cM*c=T2!$JMzj7`6u zcB+w*;q;$Kkc^U2#q!jB?ZUKeMC&98TNj2GjLD*@Vq8bJxD~O z^3Fi-zyQR++QV;in!C!>ipG!L#8;mm4xBo!W>e7bl7IAx#I3q2QfC8{v16?$s5gVE zIjrOSQ2e;WLGHP>)@A2P=uvooc!~4o7-MkB;mQH~H|uxD=83Y2q8hZw$t+8cszH;Q zzx8-`FJt&{vxY7#Bpm9$0ZHFhr>8vLkF0J6&+1kFBtOwn=lbT~Klb)q0CJWtpsYq8 z`s^a$1f4(EXM6|3H+L>w4NSB4~?s8=Lx>w-ZBxVEa)Te%VgIooRu3P& z_V5tZssI5g&pfl4UTgqo_Cf2oToW~d1d%bh6kzN6xo)Ktjo|UfO=N7%u3BNOEw4&a zjr1j;Dw(vKXU#j=eUH0)Hi#uLrlsP2PsmRh#yu2Y9Dn5m0gnA~lT*!RNl#|y$N%f+ z-(RcroACXj@6q#$G7W?3EL<$F2wkY48@@tSZW&wob|p2+&T_i5Cenp@h_Xc0hIQ#! zwG^z{9iEkCf%%Ol^@lg+K%UK*yXo;34`plO7;Rm4^QvwuWeEozedcAH@wqm;nH&;n zC%#ow4R@hMf?-2CI#ROxI*g510i)4vxlFyaclalX+5!E;+MFLseoq=T=o50zpWTPU zU(wnnsvBeAs2QYu+@1aOm~6x!UoC4OV$J>MNmNP2Ry8bJ8rKXgxVOANQ45&59rYJ^ zW(_+gE|5H=Cb}J!5^8y)@GCjLr)6Dj5b9pA>`|b{YSOGC|DNn2PiBzj&x`bAq~$!e z+XisA&JP_FlaQWWF>}2_FwC zllu-@G`Vww@d~RA^gKg6@T_*3$OmVC2EK;tSKex`An16+FHHdAhPm>pku0qJ z8>xIJQBlWHrRnJfOkv(14?X;OEa+*H|hL%3eyk%X=B)Z}Cw8kSd=% z+xeZb`$M?xx$qQpk#B+tV_ZTYs5g%H2YWJ>aol68y=1IR-g^XLPpYJNX!qM^Grs8h z1=W##XG@HM*A7CNWVJ6*)70vimj2Gz$G$bE68K88?A54iA~-P61_xF;X_fW$ zkWQ`N%%$O7s6)l_2*mPbM`O-FoiY6}d(!N7;95Nc7SK>ldHQvZDaLE>UXH$eD6=Id zELn260=qUakca5+Y8A?{%5yy)8c$qT8-I0;VJ_>EKj7Y(73x*rr_3fGe(bO`xPu){ zj#jx3n^s<}r|n8dYuu8+Tape}jgJ&!YscS>)q6V`B`v|$f3PiNb^G7m3aE$DD-~*X zRlY2~IJe~@(Ph$WLN887bG>$y-Sp5&(Af9OGxMy%NNxgptxg#fQ_C7xdN5Z=&9$}7 z6UWzDTGmX`H%y#TliQ=kTT31m7w*evW|SvoO1Vh_2EAYK5x@}WE_p=%;-3fC>L(<& zJELX&JsjYQXjtMfqvQ9B?t*-BfWBbc-1NCE&NKXX=K_FPu~GnC5^* zQ}0FLcMTYy5!j|X)DLs*L-c8}%9tez5Bjc&)qDTyR)C)E_0IZ1|EX$_lt%h$&Il7& zF@A^T`^whC4t`5b7K2mThP)q!e%JPW7P<#gO3;qWo+5#KBj9CmaPRv9dSv*;(-S}P zbcu0KXQ<-@lAMrB!omgrz+(`_{{x+a;Xxqebf$&0 zS_~Z6;3w3kv`N1@2}!vyP6H&i1Iy;#W$8F4??$|k6YN6#mV<=h6>HT+$kQwlJ^)Aa zPTs#A{g`#_0Y&7Qw_J$YXzKn|Q_EWT%0dFz-`K@c^fm3~dt)}S{1p6Nv4$~+YMKkI+PwE_LOT)cNH*DMN3<2;>J zJcC455r+c78lIB|dQ@UIUf!bb` zznr*&dx?Arc`2|0bBWru*(>|K=som&1=cng7xn~}kjCf2m*Jbi4_)lLwI=pUz-{Y| zsAl$Cb0v}R-RoII_vamW<-+f+lC!@?8Bb!!ktDi>!S9Yh62htSStv>c6x$1|K=>X1Kk0y)kvWp# zJx5g!e?pCiv;jtS%Uw?=gzq70BNLCiL)8L12L{lwncSrH~`R1E7PX^A9dm&#tH7e`JH!?dtV!AIS|ik>7ezH-94Nk|Q|jcOSm)#QOXV0tSw z!Yu^6*;{nhfs7nPw5^U<{H|BfB8ryz>%h^!MOG~VZIT#L^kh?|w@z%EIARzSh@IIa z)Pb-Zyk=9$3QY5zwN=g7fnZRVJy+_^QY9@}xDdt)T^XFtK#U8M@3rVpJa-@2jRYf7 ziT>D$X)D1pR};`x2e-oChZA)1s}sb+%2W6j8i8+)Sf6rjNtZDw->#88V!!vZ%z(1f~+KJL+t&o#B}V>(9b$}Jw`y=S6Uo{dswl%I zkyWH#q zD~P5w+tdYXd0Mb&mCmWdiUxaRi}|v6vu45wBS(e(VQPX>{{x!> zS0A+94<5{_8`GMnR8gD2)cUT*>KJI#+rSORBh!?nvWIc_wxz&uS+9iOC*CCmh&*|Z zAFI$w&!`SWmZsAH0QLN$FFFo6X#wdC^S*&_Kd$NDhrdMd)Tg#;56WfQ_fvM%%3N-m zCdw{ojrIie&E&BFpz(Ny@<9~tO?^X7zJ~H?9dt(etW2GrYhhd&wsA(18)!r{JH>(V z7Eg-JV>&1Kz{mcY&l1A&?Qh(0%M{J5ougp&U#9inDXoF|=(-AWYAEP@%t5Ps=w{ucGZ>cY| zA>FO7easAOQjQV-CUlz~!addi@|JJ%GEgZq5+QY+Mzr$E^8<_uPS85T(vsoerQ!Dj z^ZJpq7GadA0U+#X=rAKIEy(SDHe>;Yi;?bF9AdBG?at`6axQTJt?9t}-t`00>_T8m z?7`(cu%Suii@%P%Xnu0Rq4=XFEaC^e4JK#jKknRE{t))hn(inj!x}>E=g@EgtjJ3d)9`_Up|p+WrfgmNzq;8hNc)6=ZcG_b z$@HRd4buVSLjl7>IE-QR-%N33yNDcNAA4}{X&&-t{Jf>b*7F#Cn=hLuzT2@UzV26FTvGeY-3w)Rms z4O}@e;04(aCf=fS0oRX|)muLQd#F5>Z{5FlY3CDKs*Sl+5+*V1T`85On>kj~j%+N} zoB)&5_N~CNa^?&P4ZUK1Sp7&A8fEVsDoOYhNuVt^T)V%s)3;lw z#ZYUywNjiyV=gVe#WiH}IsK+TzIo_W)tCCiE$u{x?lvKGV;w*Y_B9p3K^y8b+#n5g z3ICTZM70+s3G_z<6H^;YQR$w486PO`O$wG3=oFZBK^b%p*1lMgI9bPsiHIDvd|UJ= z*aRnC>Es$;hif$c{YYK*ta7MCA=&wCHuWW)+OHq3Mu(}2QB~G~v>M5s)}lV-<<}gq|egV zA?{12jY4ce1?e+E(&lYq^MbhEoam$5!I;<)txi8;C|!N{i#FjHW);6fv0fTVC962{X(005EDkZ~PgOoBtfz-k0={HpZQtx-` z2Q8okqMNIuKj0-0a5R(66+E|jIgTfDq!+W-f+aD?AAzkAC#I2=BW!Wz1D9OfR-y9X z<+(X?U}d@pJthNr!Z1sjbK{hc&H{ks#i?Q%&+!)eN?G= z5~zr?+y0NehxLE=9&t+>7gHw&aT`MyQ&Cf6dlOTJ|Ahej`tJzA|HKjuK!E7BfCB$x z$^Sw+{J*v{R!(;I|LTj%)`ZqkQQhbznZgGXJz|b<_MOe1YGRIOm6L*%Rs78eKCL4- z7XSB`pp9?>w+;4`^=)9&igyW`Ce8QA>{xOstZ zbePHVo@xBf{c)BM*3d#h2{$?SVqmZhdbT`y%T(!S$^gpdY){D@|A}rE<0bYGAE2SQ zjn%kqq=mI1d*#xGomqA|HJ$pZ`6?8A=lJI!l*8D$Q~BoG&>Zk%ak4RwMD1PW7uS&c zMHmPMoJS;0oWC3Q_%C!5=?iG(;_h@8g zx33z{*}>DquWI>riDE>kc~PFPwI*X@`)Yb#K@liKEyhXOeMKYoJ5r`t2Vx8)1ytDZ z;vm>Ny!t;LIUWHHWSe2hK|J*#8ZsV8IYZn=e0yRxzx0UNQ8J+j2U1sMZHQV>zK7_E z{h>(zK(QeU2cZ~>av}?fqA-cl#tVKDbFmtx2k*k})hB6CdkrT@5`Rl1P-3SsS_AcDmMO zLr%xT!zYHkJ+oYxI~JnWQppnoZ>9x^A3$k1QnYlytAw^U#ZAi{dv|Mz?58oP#N$c0 z8Sqx>v`MUmu1UXCaE=>Nyz|j*?UETKhb+RxG$WoHtFisYo85lG>SW$bTh!W61k?c~ zqoc82iGZ^$*>HXBWoD?t>19V!^fD_56}R^uy#4K$Dc+($I;ybbPv4PnXKmaX2p5=q zvboFw6IG>v_^3~BQr`_&QSfy{BA_t>nb-uE zYZak96(0BtOWfFKY~pXLkQzufp6ZI(`JU$uJ$zgH%n zc3cj;HQsD;_TFQgj6&L`re0N#(Fwgi?5s%AI5A%spSB$i1x*z^4%k5O|BT{TdO2zu zv23Ym@ARz}r@t~M9wI?vf_d&6wtp^Ju+xdmiXY}vH0Tt7TAmE|_9xyBrS`(>`FNMg zz$a?7F_cGMn?}pQF*b0w(D4#c@X8xv1gi^JKOxXvEOfgLv<|{_+`Mt$R1R zeXjc^OebC83L|LR4HP842{UL+TzJ@T_$}@BiNN7C9;x2TzXr^l7hT(k9o3OHKPTOa zbHP(9F!65qZ?SPqZ1ZttY=AfwaC0GMeh-mo;vWbh^bY1BgD^`QLU9Kd1UhP?G0BRE zZ8Sv!MQZr2o)hSsA4 zwL-b<|M`k?ug@EdnUI|y;M!?HoBo1Uf>nW}(EfF3|0VJ4?)GbfCyfnHcxAkUok=)* zSCeb$;-K~MO%=BWe!JW2==?~Tzef^o1`G8y^D-DHeWttrYPU?_^>grENRwm(ufWXs zAdbiG4^|pItVv=}nT4IGyLhh*jHn0qYvQ8e*oN>(BNL=31#~|X?b)0tvu2dpJeaOX zh(n{0M@SKQmzLHx3H6NL=Pfa3+GV*UV7AN;h1vO_ac((n8e409>FE(u3NDK%I{H%R z*NSg!sbQw4^PNcuci0sm3)IPh*Rd16`j4j5rlekN`|Y#p`?O5Q+L2L_P%AV>CaJz- z97CH7Xy%~+{|{e_+K2ft81X8YX2Uu=uzbN9DFjDiz9zOIoLv%G-Fr?*!F~kuV&jj) zpr_YvbaKvY_4;jmh5QD%Yc=iKj!|^?IgN%aDEm`aCe6g zoZvcm5`qPHcXtc!?(VL^-Q5|OU;zeq1|1xN+vR=FIbVI}++%fr+}c%7b*-7I*?Uj- zTHR0gT91_tCW%cbHgmvoTMJ7+GX4O|l50-v9=AhnN+e%T>atr-#@93I&caUWZcnGB z=Eu0~uzDJXL~u0!!Ci%R>QOm*RkRr$Vth&xCU&*_{QfT`%w(>i@mQV2V)e%g9)RCK zO{y)$FBx~%%|CNbrJU4xcNQL8>FNC^qs9phiy6ux8ObTCiR)tw5!bUgDtVp#LQnMf znTO;k?BK8S)ln0JXvUS6Oy$hA5sVg~^1MT>az4UNJgpI)yN8}m-i<+xZ#wisu15=* zcBG4Suy6hAR@R;8SK6w@W4V%U{&42EH#=VQ2_h)Euo(?kYzB1lHL!Q#Y_fc&X5!h# zGyW}kUUu(hz#Zu?5-=W=%E|PJnnO3=PP*z73nN|47uGi&KX<5SO`;dG|)%AyiBM?0k^E~YOFQ46=d<#y{s zKqS0wy7D#&ji%ZBpvBnvv531)>@7FM5LRM*7xk$=>DEVhrf)3G>wN^|ln@GTG%U(*RfVLk_ z<59hM)k}Y>M}vKLoBs)8nME1>xe!xWn4L_m@s3J&a__sIj0|&B(R>sP6{h1!tPgQ0 zptIR8=t`tb(b-wYhksQ?WnuV?+NK_!i35f29gjBvDzA;M)$#D<-r-=~4{i3Yr#FTT zFQ*I1sk%P_5dMaGS!`oC(Atl8I&q+tQkIpWUQA*!aA*n_)M#q=%~B{aidNE0_{a5Y zd7&d&0axd862tm|BsUIX}*?r`P6q95|XY@$vE8g{C$#@pFuQ*A1N*;PR?Sf@-Tl zNy#bB5;SUY?yf3%SLd!7Tuo8Zd~Pqf&c?aD#mIqQ@zLp5CC`@=d){Bz&EU)G3x3;{ zIuwH^Jq7-_%swuXIb>8Mb)6n>@ekcvE^U({v7b-uwpR;JwBF|waP+;a+dvInV?#?K z*}2_&4!Y0hs1du;FFU*)Ek&k!Y1hj?8Ye|=MO<>TPMJ5wrB-&m@ukTQdV>+fnHt{r0&BfR>6r0M>8BKXs)?us%E&iFh4`BsH4L%-p&`JS`A zd#Fh`W6osQghtI2caOamN6PZtP;O}D!^(SRKf&nWX01KoL_Vl1ifumR|j5m0KArvlLiBkH!=XBT3}Z%2&sGQZ`PlOi)UU* z>G(;dCb7BRp-iLZU&^vQ3iGEU?ypt@ql*V3Sab<`=MZY1C)FkQhmDQ!D~=6Hg)@v6 z)7}Kr60Z@2^dIskp#45=>|P$;2tI4@%3K#S`|~l#=d)tqI*F%62cfXO5Ii1uPYs!38ch(^ikJyWl*w;h{+Shz=GL3-UZ5oiS*|F@hsY$wCep>+A;Cg7_j#$& zrsat1Q?a)XH)J5Y+VaUsJA}fakg&d(dMefVS#8A`rI>#7^aSP^{i{B;K%?Vbcp7t7 zjk9M~m1pD>;(>^%3)xu^WGZ1;$k)^^u@Xbk2u<^G$)Qot&(;Fb zxic)tx@T5fJaD_pyR`ILIA6ZxPw;y&2+!q*WOXGgP&x|mGK#tD^z|{|ctNdo;Zc!2 zh4|@}@AKC8ei0`eLJaE@lw64eP5ve>%fjryDjN zbq;$|KJqf|INe&`sbh;L=BKCUk9}W!x;|kXBVg}jbifv59##ODNkIgV_EHn5;bGWSqhex$L)MUZs z%H`%aw@6~$&+bB+j*l%E&aQe!qX#!~@DIVX6_iG4wRAeV_Bpe~T_EeAugWN-v}F-lHHMKP65^0^}4)*Gf4;ns) zrPqB`-DyK79vW~i`kkp4MFHEBjp-(0`$yIT;q1t;WHIP*{8sluc7>qJK#usa7HzLHo6aOTHETk`LaBWm0lm za+z312(ZWW6)0hVh`LEnd7CA#pr5`pdvLASPUbBH5oql}aW&7`n zzjLy2{k!7tOu=Vl-E zg&7{zvyirN^Y<3-Zzn9^(~SrL5ok=Lf2M6q6Nu4ojJ*#dIZRK}`zp9!OY&xCi;d3F zX5rXF`}5qwBS>RV_=yA+1g z2~y|IgD%Ne!a}5wnjB-9p|%PB)=pz-Ck@8H+|J>5NKqI02r&bF>ZIErw?15MqU0K7 z$Nt8dBuzy5noZ6(**!7L8S*8HE=UM8MCy80FzDAF=NG8chP*{gi;MtkTSTT1;a_;< zq?1HIDW)Irsuu}wB=Gz}Gt9Mo{z6}oMx!hdQw?gL8lfK3qmQ`-OY`R}JdQFFA2Tm2 zivSNpe!@@`=a({;C?nUEp(rB(YKDYy2!A`2H#l4Z)efg z99C2`cr{jpIx?8_`ylf;=`CHa2O_dv@vdkvt& z0lAAkLl>7>ER`66^jsZ-;T=wc@dY*kuiF;XuvY$W>i+6k_Thwj+d;`34<5U6w8M_7 zPm0vrAq}G!)~tpO+_mMa@1Qmq)^RA9Y9No~f@P$4G*|7^t9+{-t8lAgt2C>sod&BK zZF^M{Th3-X-9+rtWZBu{HO!gvhQq}#9BtVY;VxIc8dp8lVfPB}jF-gxreDu%^ai|9 zl7wKwW1gb9jDN8`$kS1yo&8zG99=WfRt0y58c1T}AJ!of#Q#kKs;3ipDRt9c`4C~7 zJgK|qvD2U?8f^Cy8R^A z`sTpTQt%u2v2>k&`X^$S7+-mtg@%UX)K45i)gSbtsfvF=!PNwknyE8tEYQO0j;WD8 zt&@<}F%ocIO2l!B)?EgaQMWtjDcIC28v}YI-%O0uteh&V@yU$KzU4L}~h=tYR z%Q}fX+St`?#f)2IvuUNkZ(L&7J*5cvxSItZwUvV+BkUD0nHl=2>2(!5i`*p7r`3H@ z2KiYSbVlX6MLL_T=;BWlL7de17j+vu{Tsj!OmL!+U#1M@8wrwBQMj|GzW1kbtc0j1 ztBR^-ZQ^}bj}R-}SBxYooK{wzi2UWQz{|q0C%V&FnuVWyS>UMqYFvxK=^~~Vn6t;7 z;Ae^8A!cqVeAkiOQB?rj*4V$am5+*G)!e|qUh(nYfz@rBnt-B!2~0&Pd$bDQnosT~ z_u#8i=X6`J3JtEs*6B94omY zpT(#*d}--Za3HuvxFNV^8WkFp5x5DsHMkJze_Tf>i-h$Y#%3cEaoH67A}%3+8+eTE zM%LoGC_F{3Lyk}viR=F|^u+~Iz>A=Tkf87qII?c*|7{Q#i3uS=sOQfI`k^L6~_qO%OVq61-naG3#C-22veRX+P0*QM=b;~Wchgm~; zn#xcmgQ*HzMTCZmb=OdehIRVTo5g>=NJc`&LaYP6EQ#rV=C0YJ0})1DTHagDpEl`jUF>|OvLSgICiHSC7smf9_}6z3Vr?On(ro1EBv;-g_^zIRdhNq%bliyIkOb7xOt^>t0e0?)oCdxDk~lDYDO}7>>G;S$-Sht5 z(_qNgk&VAILr>rq@NkP+^$Rlt`#||!Gv;ytGt!fa?Cr#{`qNsAL&hehlY{Mr2V+Z{ z#`W?YAD;9bS;5441k>K0ivVd=7Ug>Em4~I)@{9e&^)~cJv5WZF=nAW&_C&JN_^zK3 zdF&q#1smaV7YuLfYp}bGpfkBZ2QG_8lgTVPc%qNM!2{s#%_jWp$l1|)GkktZyEjZO z{4(|AF_~ZSm2&3AwkMxZGs4%r=w?Aa0aC_x8g^!-r9V)bFadiE-phTQ(% zK6l|@g}_)7BpA3!hX`c!KG-6AqOV8*GWZ~;h)*b=bGDFRI=N-o(DQKYfB8+Py2n3_ojOW4vyq$9Z>k-hE_~y1IYs4?1fQ?+hzp?E<3Hpq0AX6KDM@ z(hVZ^1addq1l?fb)1DWSogCLO1)e_P?4lqbXpaV>uQX%%rUguHaIhkU&F+<@VZ3?+ z&%Axfl>h>oMmXu94^-~ld_iLsn>9EHux|rU;0I~t--TlME|5F~wAC?B6(;tZ`GNhY z1hs?DZpqdSd{<+g(rZoJFE|DNqLKWzaDksXUTHC>gzg6A&1*xtL<$6 zz+A2sPIsZM`zKz!5Ai!y4{H$}3M>gxG2KI77F|X!la^o_Ui_Hk8fQX_fB9i#r-8EX zuG9klYcUf)WUF_;x0-$!E?m<3mCD0mJ_?-g>9sYswT+8GPgXzKwzDZUvW%x0;Z7GlSz*qYD>2gnk=h zepu@hEYBEX!Mi=gI@bjwVdaTc^|8_?WW|oZF{|H~? znJGRRoLJ$4&V1XBD%70((_@X5k*}!4oQ&44+pD$Q8G6_4l?r2faeL;d8r$u4exG`C z+U=>tKg|k(=Jo)-cDI;nSMso(Kwy1-d$3T?wH8goU%cQ+#T~<5zuSRgypt*Klcu-PyvP z-M;p2LUl8$_npp4G_lOF@4x$OWQ^F})$i$Kbo#5jK<(lE6TF@Wj<#p)_ztH|bJuc7 z^q$~69wM&QJ$eMEiUdJ;w5}{D)iODSNx39~d=EeP4(~xTGXrvp#}1wF_iCJ~=)d1( zjkB1cd))2aqqp{n!~J{cmA9i28o<6JJ8wNl6+s!5uvs#!8m6K{>^mE>#n9~>&lzrfb_HKD4eHu4{nkf zF{uW-bS2<3kG2s$+72e#(6ZD1U0=4BB-ZztY<2%5@?lW-BZoQ5N)yVJeT)Y zCm}>zSd1vWVFP7PWwUJ3;TkG;Bb&pacyO90X!SCu?o>z_O>-4|{IiIM=BL*0-QtR) zs^2E~NCyLR&PY4UR#S)g!U8@w#@W9hqzYr}@?im1NA&BuVch%$T-3iTRKnGh5L{~~ zAYxz1>{j!sk(#KNXvDQvJB%^(W(vUT0m@o6wb+qIKS5kX$;+Rn8hptG+@A~smm-6o zbB!f@TRhgED+cxA@|}OJl!~+>uU4SrW_P~4A^q-ZUDy&i<)T;3pm1^cJ;`=P;#Enu z%7pF#^W8Zq!k>%W8uT^an^#}!!(H-BtXg;2XhGD?(rNJ||BJtlcCX$z)=73T(Jfej z-He{+*OD07-HY)RoU{)#Zuk#m3{+SY?_0NbT(r2=!}Y5O_18+V^O~c-7Iug@0=D$o zGdzqOcG7>sOaQq5sqV?&%!In4i7AWZH!T4Z6JAqOR$fz9BSRx2LoNeO04KX4Cyx;i zJHVLDnAcS3fBuFJi=v&~52U~J^AuSmZB6Yy{H1%R$f9K7Ve)|;z{AR-rp5Mw;{&_S ze^(NPl>_k4=a{&bUFB80eTL5;I#A^?=nKLOzx2i64!z^XKsFQ?9SkTaEe*rP?f8ht zsE$FbI=CiZ_oi!oNIQtP z2^@{D!h3BcHfJg-bAmR5?ej|YolwO z$Mh$^6!QrDY{WNqaRVjg9q<-B z^U4}!uLBx))sDIv-lYJI)fS65Bw0uI3}e`&m>1`m8=KjS&C6uk6M~2uuCipdB>JNk zUwXI?#IS6~%5XAYQvo=4rx`K_6B{>)@i)I3L46Fgu+44Eq(#&+|9lAN-o3QW{6iJa zwyPFtGaWhD;@f>_lDJ0IEqE5X%XAKVe03wo6`aUB=`e0(yS8CsqU{irH4_n{IDGo98w0CjZjmd%*6d z*H|BHS|oDx%2WzIp_;K1d3}l(#TB2nop$#8;+&x- zzLH%p)=F5WJ%?>y6>!!p{^^KYs6tOIV%Z_ofx4x6^vF1U2gvp8nVA${nYR|);edWJ z%K{6fMPCB(4Jtl?p-W_+Qj#cZG{wV5pR@OVzn<$EXtA<*PwrNeh7m_ zH`2sKnIY84jjZB4z#(~dk=j|DnXNhko4ZY-eyX+nd6gzrqA`?(cz&m+=?>TNc(Ov> zO563>SgU3Vx;!bzVdI!xG}gL?(gH%oI$q9n8*S}=OttBfIn;&R&-N@7#eDO8h;i_q zfAl;Ap)0Hpc>=E=Nwdup zOQ>k0I+leOw+TV?5VGH^G?S7)eh{6(b`Pp8gw>p*b`QDUk_m5!KL+L2A@=0i;cQCZ zton9=PM?gz4{)Dt&Zt9d0OH4-Ct1|ouJO4%CjqwH4vAoboBJK^^EmB-Ya-VJl1%tG zJ+_l46>dbTvY%-Ecnes8(H-@3%!K_3^U)8FJ&Q%SAXG^A)F@3pRZE$c5kZJiki+_9 zvy@o9akc|b(ozvBNC)!FI!~iObrbcFddF=cbrIK|?eNmRv^%vO8}*>)WIdg;9q#b* zdx(aOYO<8y5I$;1c7d=%UoC3Dc7YTU{ZLZll1*g6Ne~NZkl~zmGZ5%==bn;){5=0A z*bpv8WEVwyGWnN*)S3J!@`-iI4J&ksnk(W~UjPKLE>IX0hY} z`yRUBT-+dAb53I22zsCJ8N$o|i-wSjPnecy@|ci2_ZykD087h)F}q~g`J-cy3};Wi z6FYW;J%jAP0RYBq%R0+MV7;pGFnz$|hmaXWJ1g{(4IW>gnR!q^J4ni&Z5N^lxf>vQ zU>dzmp@aVA(;Z;{#ivK@_4w9X(HWv1m;Re`=P^XI?H_N2Z84;`9XJMFI$bVy2ik?_ zul)zl4qP^j*IA~RE4FG_aT}Oieq?Q{9!C-g5I-j%8~!ffPaDm1oqJ3qTL-5zRZ@pE zxuKyf=lR;(-{}q#bw)weYPN8dU))h^i0%5FAG&yMb+3qd&hg4aD+l=1V{guw*Tk=! z(a$i2`i5_Dav>a$V?E=Z7XMS3JRg6Sb6oB%E3ZI1g{Mh)uUPVP4xg`A4DDv#Y-<)- zh}ApK4{F{y-abb%hQGs^e-sY8?NKkwxodQ@IKP22#AxnKA&8<_KoY6r3NZkP=~FfL z(Lr<``+SVFy6c3U|JC!?QUVQWkD_!~(K-xyj$+P%TI!ZPpZrgWBvuF9czoC$-!&;q2Z-fr23s5zRgwyBSayJubrXPnI>N|)PNmr7!!acZh%z0Wlj=k()BLd=uw;SsY2iw2$R(RUvivz5@Fsw~Y0*v&WD~hABfp15#F!mqN{vKrZbZ7&{Br%lsR5ATH(nC`KxZy1T!(bPTbC|i?MtBcBuL1YTygkGv$t!BRUzio?Lg-&ed_K#E%%VW8f*^)r?*4yCAYk>ZvcMY*(Aw&Xap(h^#!>jDC|CWI(K3-)KEnquUMG#}4lAiPXP+b|L*xGK z5c3*@S~=`lI#&pmt9z@rNvs*W=}<}a;+L!b!f}BO&aOjt5xHuoE%Vf8dG!bp?c_9D zAG~A_Eh;~z$8gB29TGyVvtp578yZm2R)X1=tU{mQhg!__X%Dgr$u)>LxXH`^9{GVA zyQAQQo(n8kiw<3Li1&Dd)=vfY-o(8H)40iaL)p!5k5o-HRamlN2F+82+ySD_i2I*6=Wjtwa{{4O;zntq;JyVSO8NN< zN+>~;Xfzv{lIy_xIo?#wn-$vIBr0UHf|HWTQm5BhcK%87WZ7k%AJ=5znv@kx(|sJ0 zKm@JDY@KI#y9n2`X0VyU-klW`*$q*OcYsUQO{Bmx^qyqZd#xTFKf%j%nWPl6@C4^n z@`r7!0tAQ-_OGNsPtB_yj|Gn^+}x;a=axp=lP)Wbd2r(0N6Bn^*OFU~T?fCuCDTk- zrJCZaPtKT@U1P#P*@RIy*qVfn+v+C*e}#n@RUT*0 zBR^6Hk}5Ljd0Nct+3}*;*8wfzgP^v>aPh%1T6(VVtb|N~lf_3O&3-mWYK+ z(HvbDs+fVN=0o8`wg0ve8!2tPm33S&hXXlTfir6p(3$p}t#^HgqbhHpuT73NnFNF)m|JwI9sn}hif;Ek}* zO1OeO-mjN>R@^r#Lz~p2UV}pw)C?GBj>C!OY-?pVY@`QPAoyO9G6wwFiZwq~u4_eU zD-s=fGL!L_%baZx9N@VP_WF3`bq)GV;%{V;{f+6$m?zMS{Yn-*(}xHqta#=~{AM%) z+nVOZ&;&$pS8SAKs^XjBysi+pdEuNZKCHmM{zBSuP-Iid2UC z$JzB-+sTb!s(4%9I4v@)mT{G9NOZ^Xks~_@TB5{>d!usgddXIoB)sX?kxTXPA^%np zlMNJY4*(j_-zi!Owxt%Hd}v4BOZ3`IZT}rvWj^Z@*3X$0#8*68=l88}{J1sJ3)Yzz zO86RD3Z1F1>|gI7NBrU2XV)A?l*t(f6N5t(42y@~`tJ(vPV!1eZhL zLC(Rd1*XI(mYpq$d|3Q>VkIVEYzHDJ(aM*KiIi0;MGj4(7xV5N&gHBqqK2}U6)8bP zDfx%*R%_y2$X4e>(34Jb^t|25lR}_u-8K=e6*mnUw*1YyBQza=-V$&1Sj=16<>sfS zAYlbdMxha%ak%`sdXGK2v|=IWuC!sFz!|oDF73DEp@St0oRJlHs_Yxn`XDZ60$-Rm zWe_`9Df!FQ&yv#Fhw%aJiy3fmY02%wZIEiVotcDgZIhG(Y+FtgXG3}Vbdy_>>UjH) zVHEHRm{W67Y4WR}e@gy@;_3mjKB{GqOZHXnmz~s7mZ@^Hbor>FEA}R!Cw(bfpqPgd z8!EDVkCb2=(7&BwKCf9^{2J?FQJ>YPK;_a6ip`yPC_N{5!@V{HU;0#esc{ntXFb@m zeV>%m(c{R-iQk^6Ixc`N7QHSOZ`EzW8S}c7m9`SJbP;v+T^()!U3t}IezTlVk~8BI ziOHWJzuI0B&ai6>XezBstey+KMc_)s@?%nfKxx673wXD~Ki+*$OfUL56`hZK)@rg<@|{80MR^GRi}pbmt2ynVmAsw3*P$Kj`L$ubVCHu@B- z1wzwjVJc#02}^Ud)wY;ArL3?mS1Nc@;BN_X^9SBHK9chfUtkd{^!)f(K0lo^HLDXX zdjVUjVKUxjb+Q!PPHZVqrtuWKO(qa5a+_rOq8ewO(?fk_abY}H$gl9GshU6AlSskJ z3Wg2ANki;rtDEZeUd08ICW|5FSXXN8?anVAVbHr&r9*nHhM6HMiqbZGLC7I}%_ny{ zODf*if0qqvr+c57ab2F1_9Mp}?^BfB)Qkz5l;zqfbJbrY7h{!IZn2#h@ymhllk(M2X#(3U8}cP=~W!+36-zXSA~${NXvXrS6lEP;Y3ZxLg3= zryqL1bv~7X#!!`WPN;Z(!<3n+N4lfEd=nRc!ADSV@)*|5~3MMNKV`8P&qL45}Xmd8{`e zy9@!2LRQ(x;Pw9lA2{$2J}@l;1RxRLkRS=B2O$2<2YOJt{euwXaQKT51TW`l08mRH zC|R)$_S_SF)>)C4tmsbmZ+Ex8YKKSKvoZh8t=RM8Z6K}q1-BxpL5LXpn_AK4jo565 z{*5ltX+@QC;6LfjRu6%<=Q-)?YDK?+Cwb!IJec2!ssRVaaVs3Ivy&zsu=s za6_9k;+osw>I_RgW7qAgP>)1)Bel!(sO5J}(t$ZH(KSBX( zQRdN@r9Ak5)(Y0X{q9Kd&{MPnK#wK5#!Fh@{^0pN59rwuU5j+Vyz2J+dDda4*_4nL zeNyZ?O^Lx)u$w-}=6|h!hH~|su@*A(V0-Dn4E1g#85{BfYgtIye}baczhmtGsvS)% zZx>ND%+!jgX9NrNu2x(L>^OUKGBDtV!Ls21URHn29LoV(f<09{miO7AHuPPGKXC1~ zNIQe0OIzZ|3fF|EAHH}b?&Iz)5P&;)PtTcr`fF~}O|oceJ-eRd4kS=M^E3~Bunxu~ zh%hL9A&(L3f~k11j2XIKcnhh;ey!-RfC_QoydKb9fQL8ui1xXQn4KVz756G+1cAil zT?F)TexlvTCvxB^g|&b2mdA%@{(kjBs{@{$ZT$VM-uWf(^6m`l>U;3Z#^h=7k{69E z>svjw+sm40?s-o_LYj@xiRVY*7sE?;z|{N4w1Y|CPQy!B0O)L*$)5! literal 0 HcmV?d00001 diff --git a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.cdx.json b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.cdx.json new file mode 100644 index 0000000000..1759b3cccb --- /dev/null +++ b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.cdx.json @@ -0,0 +1,3057 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.6", + "serialNumber": "urn:uuid:17e021df-35e4-4aee-a22b-3919fd43ab3f", + "version": 1, + "metadata": { + "timestamp": "2025-10-19T11:10:02+00:00", + "licenses": [ + { + "license": { + "id": "CC-BY-SA-4.0", + "url": "https://creativecommons.org/licenses/by-sa/4.0/legalcode.txt" + } + } + ], + "supplier": { + "name": "OWASP Foundation", + "url": [ + "https://owasp.org" + ] + } + }, + "declarations": { + "standards": [ + { + "bom-ref": "ASVS-5.0.0", + "name": "Application Security Verification Standard (ASVS)", + "version": "5.0.0", + "description": "The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.", + "owner": "Application Security Verification Standard Project", + "requirements": [ + { + "bom-ref": "V1", + "identifier": "V1", + "title": "Encodage et nettoyage" + }, + { + "bom-ref": "V1.1", + "identifier": "V1.1", + "title": "Architecture d'encodage et de nettoyage", + "parent": "V1" + }, + { + "bom-ref": "V1.1.1", + "identifier": "V1.1.1", + "text": "Vérifiez que l'entrée est décodée ou non échappée vers une forme canonique une seule fois, elle n'est décodée que lorsque des données codées sous cette forme sont attendues, et que cela est fait avant de traiter davantage l'entrée, par exemple, elle n'est pas effectuée après la validation ou la désinfection de l'entrée.", + "parent": "V1.1" + }, + { + "bom-ref": "V1.1.2", + "identifier": "V1.1.2", + "text": "Vérifiez que l'application effectue l'encodage et l'échappement de sortie soit comme étape finale avant d'être utilisée par l'interpréteur pour lequel elle est destinée, soit par l'interpréteur lui-même.", + "parent": "V1.1" + }, + { + "bom-ref": "V1.2", + "identifier": "V1.2", + "title": "Prévention des injections", + "parent": "V1" + }, + { + "bom-ref": "V1.2.1", + "identifier": "V1.2.1", + "text": "Vérifiez que l'encodage de sortie d'une réponse HTTP, d'un document HTML ou d'un document XML est pertinent pour le contexte requis, comme l'encodage des caractères pertinents pour les éléments HTML, les attributs HTML, les commentaires HTML, les CSS ou les champs d'en-tête HTTP, pour éviter de modifier la structure du message ou du document.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.2", + "identifier": "V1.2.2", + "text": "Vérifiez que, lors de la création dynamique d'URL, les données non fiables sont encodées en fonction de leur contexte (par exemple, encodage d'URL ou encodage base64url pour les paramètres de requête ou de chemin). Assurez-vous que seuls les schémas d'URL sûrs sont autorisés (par exemple, interdire javascript: ou data:).", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.3", + "identifier": "V1.2.3", + "text": "Vérifiez que l'encodage ou l'échappement de sortie est utilisé lors de la création dynamique de contenu JavaScript (y compris JSON), pour éviter de modifier la structure du message ou du document (pour éviter l'injection JavaScript et JSON).", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.4", + "identifier": "V1.2.4", + "text": "Vérifiez que la sélection de données ou les requêtes de base de données (par exemple, SQL, HQL, NoSQL, Cypher) utilisent des requêtes paramétrées, des ORM, des Framework d'entités ou sont protégées contre les injections SQL et autres attaques par injection de base de données. Ceci est également pertinent lors de l'écriture de procédures stockées.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.5", + "identifier": "V1.2.5", + "text": "Vérifiez que l’application protège contre l’injection de commandes du système d’exploitation et que les appels du système d’exploitation utilisent des requêtes du système d’exploitation paramétrées ou utilisent un encodage de sortie de ligne de commande contextuelle.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.6", + "identifier": "V1.2.6", + "text": "Vérifiez que l’application protège contre les vulnérabilités d’injection LDAP ou que des contrôles de sécurité spécifiques pour empêcher l’injection LDAP ont été mis en œuvre.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.7", + "identifier": "V1.2.7", + "text": "Vérifiez que l’application est protégée contre les attaques par injection XPath en utilisant la paramétrisation des requêtes ou des requêtes précompilées.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.8", + "identifier": "V1.2.8", + "text": "Vérifiez que les processeurs LaTeX sont configurés de manière sécurisée (par exemple, en n'utilisant pas l'indicateur « --shell-escape ») et qu'une liste d’autorisations de commandes est utilisée pour empêcher les attaques par injection LaTeX.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.9", + "identifier": "V1.2.9", + "text": "Vérifiez que l'application échappe les caractères spéciaux dans les expressions régulières (généralement à l'aide d'une barre oblique inverse) pour éviter qu'ils ne soient mal interprétés comme des métacaractères.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.10", + "identifier": "V1.2.10", + "text": "Vérifiez que l'application est protégée contre les injections CSV et injections de formules. L'application doit respecter les règles d'échappement définies dans les sections 2.6 et 2.7 de la RFC 4180 lors de l'export de contenu CSV. De plus, lors de l'export au format CSV ou vers d'autres formats de tableur (tels que XLS, XLSX ou ODF), les caractères spéciaux (notamment « = », « + », « - », « @ », « \\t » (tabulation) et « \\0 » (caractère null)) doivent être protégés par une apostrophe s'ils apparaissent en premier dans une valeur de champ.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.3", + "identifier": "V1.3", + "title": "Nettoyage", + "parent": "V1" + }, + { + "bom-ref": "V1.3.1", + "identifier": "V1.3.1", + "text": "Vérifiez que toutes les entrées HTML non fiables provenant d'éditeurs WYSIWYG ou similaires sont nettoyées à l'aide d'une bibliothèque ou d'une fonctionnalité de Framework de nettoyage HTML bien connue et sécurisée.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.2", + "identifier": "V1.3.2", + "text": "Vérifiez que l'application évite d'utiliser eval() ou d'autres fonctionnalités d'exécution de code dynamique telles que Spring Expression Language (SpEL). En l'absence d'alternative, toute saisie utilisateur incluse doit être nettoyée avant d'être exécutée.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.3", + "identifier": "V1.3.3", + "text": "Vérifiez que les données transmises à un contexte potentiellement dangereux sont préalablement nettoyées pour appliquer des mesures de sécurité, telles qu'autoriser uniquement des caractères sûrs pour ce contexte et raccourcir des entrées trop longues.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.4", + "identifier": "V1.3.4", + "text": "Vérifiez que le contenu Scalable Vector Graphics (SVG) scriptable fourni par l'utilisateur est validé ou nettoyé pour contenir uniquement des balises et des attributs (tels que des graphiques de dessin) qui sont sûrs pour l'application, par exemple, ne contiennent pas de scripts et d'objets étrangers.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.5", + "identifier": "V1.3.5", + "text": "Vérifiez que l'application nettoie ou désactive le contenu du langage de modèle d'expression ou de script fourni par l'utilisateur, tel que les feuilles de style CSS, le Markdown ou XSL, BBCode ou similaire.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.6", + "identifier": "V1.3.6", + "text": "Vérifiez que l'application protège contre les attaques de falsification de requête côté serveur (SSRF), en validant les données non fiables par rapport à une liste d'autorisation de protocoles, de domaines, de chemins et de ports et en nettoyant les caractères potentiellement dangereux avant d'utiliser les données pour appeler un autre service.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.7", + "identifier": "V1.3.7", + "text": "Vérifiez que l'application se protège contre les attaques par injection de modèles en interdisant la création de modèles basés sur des entrées non fiables. En l'absence d'alternative, toute entrée non fiable incluse dynamiquement lors de la création du modèle doit être nettoyée ou rigoureusement validée.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.8", + "identifier": "V1.3.8", + "text": "Vérifiez que l’application nettoie correctement les entrées non fiables avant utilisation dans les requêtes Java Naming and Directory Interface (JNDI) et que JNDI est configuré de manière sécurisée pour empêcher les attaques par injection JNDI.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.9", + "identifier": "V1.3.9", + "text": "Vérifiez que l’application nettoie le contenu avant qu’il ne soit envoyé à memcache pour éviter les attaques par injection.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.10", + "identifier": "V1.3.10", + "text": "Vérifiez que les chaînes de format susceptibles d'être résolues de manière inattendue ou malveillante lors de leur utilisation sont nettoyées avant d'être traitées.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.11", + "identifier": "V1.3.11", + "text": "Vérifiez que l'application nettoie les entrées utilisateur avant de les transmettre aux systèmes de messagerie pour se protéger contre l'injection SMTP ou IMAP.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.12", + "identifier": "V1.3.12", + "text": "Vérifiez que les expressions régulières sont exemptes d'éléments provoquant \"backtracking\" exponentiel et assurez-vous que les entrées non fiables sont nettoyées pour atténuer les attaques ReDoS ou Runaway Regex.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.4", + "identifier": "V1.4", + "title": "Mémoire, chaine de caractères et code à mémoire non-managée", + "parent": "V1" + }, + { + "bom-ref": "V1.4.1", + "identifier": "V1.4.1", + "text": "Vérifiez que l'application utilise des chaînes memory-safe, une copie de mémoire et une arithmétique de pointeur renforcée pour détecter ou empêcher les débordements de pile, de tampon ou de tas.", + "parent": "V1.4" + }, + { + "bom-ref": "V1.4.2", + "identifier": "V1.4.2", + "text": "Vérifiez que les techniques de validation du signe, de la plage et de l’entrée sont utilisées pour éviter les dépassements d’entiers.", + "parent": "V1.4" + }, + { + "bom-ref": "V1.4.3", + "identifier": "V1.4.3", + "text": "Vérifiez que la mémoire et les ressources allouées dynamiquement sont libérées et que les références ou les pointeurs vers la mémoire libérée sont supprimés ou définis à null pour éviter les \"dangling pointer\" et les vulnérabilités d'utilisation après libération.", + "parent": "V1.4" + }, + { + "bom-ref": "V1.5", + "identifier": "V1.5", + "title": "Désérialisation sécurisée", + "parent": "V1" + }, + { + "bom-ref": "V1.5.1", + "identifier": "V1.5.1", + "text": "Vérifiez que l'application configure les \"parser\" XML pour utiliser une configuration restrictive et que les fonctionnalités non sûres telles que la résolution d'entités externes sont désactivées pour empêcher les attaques XML eXternal Entity (XXE).", + "parent": "V1.5" + }, + { + "bom-ref": "V1.5.2", + "identifier": "V1.5.2", + "text": "Vérifiez que la désérialisation des données non fiables garantit une gestion sécurisée des entrées, par exemple en utilisant une liste d'autorisation de types d'objets ou en limitant les types d'objets définis par le client, afin d'empêcher les attaques par désérialisation. Les mécanismes de désérialisation explicitement définis comme non sécurisés ne doivent pas être utilisés avec des entrées non fiables.", + "parent": "V1.5" + }, + { + "bom-ref": "V1.5.3", + "identifier": "V1.5.3", + "text": "Vérifiez que les différents \"parser\" utilisés dans l'application pour le même type de données (par exemple, les \"parser\" JSON, les \"parser\" XML, les \"parser\" d'URL) effectuent l'analyse de manière cohérente et utilisent le même mécanisme d'encodage de caractères pour éviter des problèmes tels que les vulnérabilités d'interopérabilité JSON ou un comportement d'analyse d'URI ou de fichier différent exploité dans les attaques d'inclusion de fichiers à distance (RFI) ou de falsification de requête côté serveur (SSRF).", + "parent": "V1.5" + }, + { + "bom-ref": "V2", + "identifier": "V2", + "title": "Validation et logique métier" + }, + { + "bom-ref": "V2.1", + "identifier": "V2.1", + "title": "Validation et documentation de la logique métier", + "parent": "V2" + }, + { + "bom-ref": "V2.1.1", + "identifier": "V2.1.1", + "text": "Vérifiez que la documentation de l'application définit des règles de validation des entrées pour vérifier la validité des éléments de données par rapport à la structure attendue. Il peut s'agir de formats de données courants tels que des numéros de carte de crédit, des adresses e-mail ou des numéros de téléphone, ou d'un format de données interne.", + "parent": "V2.1" + }, + { + "bom-ref": "V2.1.2", + "identifier": "V2.1.2", + "text": "Vérifiez que la documentation de l'application définit comment valider la cohérence logique et contextuelle des éléments de données combinés, par exemple en vérifiant que la banlieue et le code postal correspondent.", + "parent": "V2.1" + }, + { + "bom-ref": "V2.1.3", + "identifier": "V2.1.3", + "text": "Vérifiez que les attentes en matière de limites et de validations de la logique métier sont documentées, y compris par utilisateur et globalement dans l'application.", + "parent": "V2.1" + }, + { + "bom-ref": "V2.2", + "identifier": "V2.2", + "title": "Validation des entrées", + "parent": "V2" + }, + { + "bom-ref": "V2.2.1", + "identifier": "V2.2.1", + "text": "Vérifier que les entrées sont validées afin de respecter les attentes métier ou fonctionnelles. Cette validation doit être basée sur une liste de valeurs, de modèles et de plages autorisées, ou sur la comparaison des entrées avec une structure attendue et des limites logiques selon des règles prédéfinies. Pour le niveau 1, cette validation peut se concentrer sur les entrées utilisées pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau 2, elle doit s'appliquer à toutes les entrées.", + "parent": "V2.2" + }, + { + "bom-ref": "V2.2.2", + "identifier": "V2.2.2", + "text": "Vérifiez que l'application est conçue pour appliquer la validation des entrées au niveau d'une couche de service de confiance. Bien que la validation côté client améliore l'ergonomie et doit être encouragée, elle ne doit pas être considérée comme un contrôle de sécurité.", + "parent": "V2.2" + }, + { + "bom-ref": "V2.2.3", + "identifier": "V2.2.3", + "text": "Vérifiez que l’application garantit que les combinaisons d’éléments de données associés sont raisonnables selon les règles prédéfinies.", + "parent": "V2.2" + }, + { + "bom-ref": "V2.3", + "identifier": "V2.3", + "title": "Sécurité de la logique métier", + "parent": "V2" + }, + { + "bom-ref": "V2.3.1", + "identifier": "V2.3.1", + "text": "Vérifiez que l’application traitera uniquement les flux de logique métier pour le même utilisateur dans l’ordre séquentiel attendu et sans sauter d’étapes.", + "parent": "V2.3" + }, + { + "bom-ref": "V2.3.2", + "identifier": "V2.3.2", + "text": "Vérifiez que les limites de la logique métier sont implémentées conformément à la documentation de l'application, afin d'éviter que des failles de la logique métier ne soient pas exploitées.", + "parent": "V2.3" + }, + { + "bom-ref": "V2.3.3", + "identifier": "V2.3.3", + "text": "Vérifiez que les transactions sont utilisées au niveau de la logique métier de telle sorte qu'une opération de logique métier réussisse dans son intégralité ou qu'elle soit restaurée à l'état correct précédent.", + "parent": "V2.3" + }, + { + "bom-ref": "V2.3.4", + "identifier": "V2.3.4", + "text": "Vérifiez que les mécanismes de verrouillage au niveau de la logique métier sont utilisés pour garantir que les ressources en quantité limitée (telles que les sièges de théâtre ou les créneaux de livraison) ne peuvent pas être réservées deux fois en manipulant la logique de l'application.", + "parent": "V2.3" + }, + { + "bom-ref": "V2.3.5", + "identifier": "V2.3.5", + "text": "Vérifiez que les flux logiques métier à forte valeur ajoutée nécessitent l'approbation de plusieurs utilisateurs afin d'éviter toute action non autorisée ou accidentelle. Cela peut inclure, sans s'y limiter, les transferts monétaires importants, les approbations de contrats, l'accès à des informations classifiées ou les contournements de sécurité dans le secteur manufacturier.", + "parent": "V2.3" + }, + { + "bom-ref": "V2.4", + "identifier": "V2.4", + "title": "Anti-automatisation", + "parent": "V2" + }, + { + "bom-ref": "V2.4.1", + "identifier": "V2.4.1", + "text": "Vérifiez que des contrôles anti-automatisation sont en place pour protéger contre les appels excessifs aux fonctions d'application qui pourraient conduire à l'exfiltration de données, à la création de données inutiles, à l'épuisement des quotas, aux violations de limites de débit, au déni de service ou à la surutilisation de ressources coûteuses.", + "parent": "V2.4" + }, + { + "bom-ref": "V2.4.2", + "identifier": "V2.4.2", + "text": "Vérifiez que les flux logiques métier nécessitent un timing humain réaliste, évitant ainsi des soumissions de transactions excessivement rapides.", + "parent": "V2.4" + }, + { + "bom-ref": "V3", + "identifier": "V3", + "title": "Sécurité du frontend Web" + }, + { + "bom-ref": "V3.1", + "identifier": "V3.1", + "title": "Documentation sur la sécurité du frontend Web", + "parent": "V3" + }, + { + "bom-ref": "V3.1.1", + "identifier": "V3.1.1", + "text": "Vérifiez que la documentation de l'application indique les fonctionnalités de sécurité attendues que les navigateurs utilisant l'application doivent prendre en charge (telles que HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) et autres mécanismes de sécurité HTTP pertinents). Elle doit également définir le comportement de l'application lorsque certaines de ces fonctionnalités ne sont pas disponibles (par exemple, avertir l'utilisateur ou bloquer l'accès).", + "parent": "V3.1" + }, + { + "bom-ref": "V3.2", + "identifier": "V3.2", + "title": "Interprétation non intentionnelle du contenu", + "parent": "V3" + }, + { + "bom-ref": "V3.2.1", + "identifier": "V3.2.1", + "text": "Vérifiez que des contrôles de sécurité sont en place pour empêcher les navigateurs d'afficher du contenu ou des fonctionnalités dans les réponses HTTP dans un contexte incorrect (par exemple, lorsqu'une API, un fichier téléchargé par l'utilisateur ou une autre ressource est demandée directement). Les contrôles possibles peuvent inclure : ne pas transmettre le contenu sauf si les champs d'en-tête de requête HTTP (tels que Sec-Fetch-\\*) indiquent qu'il s'agit du contexte correct, utiliser la directive sandbox du champ d'en-tête Content-Security-Policy ou utiliser le type de disposition de pièce jointe dans le champ d'en-tête Content-Disposition.", + "parent": "V3.2" + }, + { + "bom-ref": "V3.2.2", + "identifier": "V3.2.2", + "text": "Vérifiez que le contenu destiné à être affiché sous forme de texte, plutôt que rendu sous forme de HTML, est géré à l'aide de fonctions de rendu sécurisées (telles que createTextNode ou textContent) pour empêcher l'exécution involontaire de contenu tel que HTML ou JavaScript.", + "parent": "V3.2" + }, + { + "bom-ref": "V3.2.3", + "identifier": "V3.2.3", + "text": "Vérifiez que l'application évite l'écrasement du DOM lors de l'utilisation de JavaScript côté client en utilisant des déclarations de variables explicites, en effectuant une vérification de type stricte, en évitant de stocker des variables globales sur l'objet document et en implémentant l'isolation de l'espace de nommage.", + "parent": "V3.2" + }, + { + "bom-ref": "V3.3", + "identifier": "V3.3", + "title": "Configuration des cookies", + "parent": "V3" + }, + { + "bom-ref": "V3.3.1", + "identifier": "V3.3.1", + "text": "Vérifiez que les cookies ont l'attribut « Secure » ​​défini et si le préfixe « \\__Host- » n'est pas utilisé pour le nom du cookie, le préfixe « __Secure- » doit être utilisé pour le nom du cookie.", + "parent": "V3.3" + }, + { + "bom-ref": "V3.3.2", + "identifier": "V3.3.2", + "text": "Vérifiez que la valeur de l'attribut « SameSite » de chaque cookie est définie en fonction de l'objectif du cookie, afin de limiter l'exposition aux attaques de réparation de l'interface utilisateur et aux attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).", + "parent": "V3.3" + }, + { + "bom-ref": "V3.3.3", + "identifier": "V3.3.3", + "text": "Vérifiez que les cookies ont le préfixe « __Host- » pour le nom du cookie, sauf s'ils sont explicitement conçus pour être partagés avec d'autres hôtes.", + "parent": "V3.3" + }, + { + "bom-ref": "V3.3.4", + "identifier": "V3.3.4", + "text": "Vérifiez que si la valeur d'un cookie n'est pas censée être accessible aux scripts côté client (comme un jeton de session), le cookie doit avoir l'attribut « HttpOnly » défini et la même valeur (par exemple, un jeton de session) ne doit être transférée au client que via le champ d'en-tête « Set-Cookie ».", + "parent": "V3.3" + }, + { + "bom-ref": "V3.3.5", + "identifier": "V3.3.5", + "text": "Vérifiez que lorsque l'application écrit un cookie, la longueur combinée du nom et de la valeur du cookie ne dépasse pas 4 096 octets. Les cookies trop volumineux ne seront pas stockés par le navigateur et ne seront donc pas envoyés avec les requêtes, empêchant ainsi l'utilisateur d'utiliser les fonctionnalités de l'application qui reposent sur ce cookie.", + "parent": "V3.3" + }, + { + "bom-ref": "V3.4", + "identifier": "V3.4", + "title": "En-têtes du mécanisme de sécurité du navigateur", + "parent": "V3" + }, + { + "bom-ref": "V3.4.1", + "identifier": "V3.4.1", + "text": "Vérifiez qu'un champ d'en-tête Strict-Transport-Security est inclus dans toutes les réponses afin d'appliquer une politique HTTP Strict Transport Security (HSTS). Une durée maximale d'au moins un an doit être définie, et pour les niveaux L2 et supérieurs, la politique doit également s'appliquer à tous les sous-domaines.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.2", + "identifier": "V3.4.2", + "text": "Vérifiez que le champ d'en-tête Access-Control-Allow-Origin du partage de ressources cross-origine (CORS) est une valeur fixe de l'application ou, si la valeur du champ d'en-tête de requête HTTP Origin est utilisée, qu'elle est validée par rapport à une liste d'origines approuvées. Si « Access-Control-Allow-Origin: * » doit être utilisé, vérifiez que la réponse ne contient aucune information sensible.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.3", + "identifier": "V3.4.3", + "text": "Vérifiez que les réponses HTTP incluent un champ d'en-tête de réponse Content-Security-Policy qui définit des directives garantissant que le navigateur charge et exécute uniquement du contenu ou des ressources fiables, afin de limiter l'exécution de JavaScript malveillant. Au minimum, une politique globale doit être utilisée, incluant les directives object-src 'none' et base-uri 'none', et définissant soit une lliste d’autorisations, soit des valeurs nonces ou des hachages. Pour une application L3, une politique par réponse avec des valeurs nonces ou des hachages doit être définie.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.4", + "identifier": "V3.4.4", + "text": "Vérifiez que toutes les réponses HTTP contiennent un champ d'en-tête « X-Content-Type-Options: nosniff ». Cela indique aux navigateurs de ne pas utiliser l'analyse de contenu ni la détection du type MIME pour la réponse donnée, et d'exiger que la valeur du champ d'en-tête « Content-Type » de la réponse corresponde à la ressource de destination. Par exemple, la réponse à une demande de style n'est acceptée que si le type de contenu de la réponse est « text/css ». Cela permet également au navigateur d'utiliser la fonctionnalité de blocage de lecture inter-origines (CORB).", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.5", + "identifier": "V3.4.5", + "text": "Vérifiez que l'application définit une politique de référencement afin d'empêcher la fuite de données techniquement sensibles vers des services tiers via le champ d'en-tête de requête HTTP « Referer ». Cela peut être effectué via le champ d'en-tête de réponse HTTP « Referrer-Policy » ou via les attributs d'élément HTML. Les données sensibles peuvent inclure le chemin d'accès et les données de requête dans l'URL, et pour les applications internes non publiques, le nom d'hôte.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.6", + "identifier": "V3.4.6", + "text": "Vérifiez que l'application Web utilise la directive frame-ancestors du champ d'en-tête Content-Security-Policy pour chaque réponse HTTP afin de garantir qu'elle ne peut pas être intégrée par défaut et que l'intégration de ressources spécifiques n'est autorisée qu'en cas de nécessité. Notez que le champ d'en-tête X-Frame-Options, bien que pris en charge par les navigateurs, est obsolète et n'est pas forcément fiable.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.7", + "identifier": "V3.4.7", + "text": "Vérifiez que le champ d’en-tête Content-Security-Policy spécifie un emplacement pour signaler les violations.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.8", + "identifier": "V3.4.8", + "text": "Vérifiez que toutes les réponses HTTP qui lancent le rendu d'un document (comme les réponses de type text/html) incluent le champ d'en-tête 'Cross-Origin-Opener-Policy' avec la directive 'same-origin' ou s'ame-origin-allow-popups', selon les besoins. Cela empêche les attaques abusant de l'accès partagé aux objets Window, telles que le tabnabbing et le comptage d'images.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.5", + "identifier": "V3.5", + "title": "Séparation de l'origine du navigateur", + "parent": "V3" + }, + { + "bom-ref": "V3.5.1", + "identifier": "V3.5.1", + "text": "Vérifiez que, si l'application ne s'appuie pas sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher les requêtes inter-origines non autorisées d'utiliser des fonctionnalités sensibles, ces requêtes sont validées afin de garantir leur origine. Cela peut se faire en utilisant et en validant des jetons anti-falsification ou en exigeant des champs d'en-tête HTTP supplémentaires qui ne sont pas des champs d'en-tête de requête CORS safelist. Ceci permet de se protéger contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.2", + "identifier": "V3.5.2", + "text": "Vérifiez que, si l'application s'appuie sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher l'utilisation inter-origines non autorisée de fonctionnalités sensibles, il est impossible d'appeler la fonctionnalité avec une requête qui ne déclenche pas de requête de pré-vérification cross-origin CORS. Cela peut nécessiter de vérifier les valeurs des champs d'en-tête de requête 'Origin' et 'Content-Type' ou d'utiliser un champ d'en-tête supplémentaire qui n'est pas un champ d'en-tête de la liste de sécurité CORS.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.3", + "identifier": "V3.5.3", + "text": "Vérifiez que les requêtes HTTP destinées aux fonctionnalités sensibles utilisent des méthodes HTTP appropriées, telles que POST, PUT, PATCH ou DELETE, et non des méthodes définies comme « sûres » par la spécification HTTP, telles que HEAD, OPTIONS ou GET. Une validation stricte des champs d'en-tête de requête Sec-Fetch-* peut également être utilisée pour garantir que la requête ne provient pas d'un appel inter-origines inapproprié, d'une requête de navigation ou d'un chargement de ressources (comme une source d'image) inattendu.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.4", + "identifier": "V3.5.4", + "text": "Vérifiez que des applications distinctes sont hébergées sur des noms d'hôte différents pour tirer parti des restrictions fournies par la politique de même origine, y compris la manière dont les documents ou scripts chargés par une origine peuvent interagir avec les ressources d'une autre origine et les restrictions basées sur le nom d'hôte sur les cookies.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.5", + "identifier": "V3.5.5", + "text": "Vérifiez que les messages reçus par l'interface postMessage sont rejetés si l'origine du message n'est pas digne de confiance ou si la syntaxe du message n'est pas valide.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.6", + "identifier": "V3.5.6", + "text": "Vérifiez que la fonctionnalité JSONP n'est activée nulle part dans l'application pour éviter les attaques Cross-Site Script Inclusion (XSSI).", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.7", + "identifier": "V3.5.7", + "text": "Vérifiez que les données nécessitant une autorisation ne sont pas incluses dans les réponses des ressources de script, comme les fichiers JavaScript, pour empêcher les attaques par inclusion de script intersite (XSSI).", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.8", + "identifier": "V3.5.8", + "text": "Vérifiez que les ressources authentifiées (telles que les images, les vidéos, les scripts et autres documents) peuvent être chargées ou intégrées pour le compte de l'utilisateur uniquement lorsque cela est prévu. Cela peut être réalisé en validant strictement les champs d'en-tête de requête HTTP Sec-Fetch-* afin de garantir que la requête ne provient pas d'un appel cross-origin inapproprié, ou en définissant un champ d'en-tête de réponse HTTP Cross-Origin-Resource-Policy restrictif pour indiquer au navigateur de bloquer le contenu renvoyé.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.6", + "identifier": "V3.6", + "title": "Intégrité des ressources externes", + "parent": "V3" + }, + { + "bom-ref": "V3.6.1", + "identifier": "V3.6.1", + "text": "Vérifiez que les ressources côté client, telles que les bibliothèques JavaScript, les feuilles de style CSS ou les polices web, sont hébergées en externe (par exemple, sur un réseau de diffusion de contenu) uniquement si la ressource est statique et versionnée, et si l'intégrité des sous-ressources (SRI) est utilisée pour valider l'intégrité de la ressource. Si cela n'est pas possible, une décision de sécurité documentée doit justifier cette décision pour chaque ressource.", + "parent": "V3.6" + }, + { + "bom-ref": "V3.7", + "identifier": "V3.7", + "title": "Autres considérations sur la sécurité du navigateur", + "parent": "V3" + }, + { + "bom-ref": "V3.7.1", + "identifier": "V3.7.1", + "text": "Vérifiez que l'application utilise uniquement des technologies côté client toujours prises en charge et considérées comme sécurisées. Parmi les technologies qui ne répondent pas à cette exigence figurent les plugins NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL ou les applets Java côté client.", + "parent": "V3.7" + }, + { + "bom-ref": "V3.7.2", + "identifier": "V3.7.2", + "text": "Vérifiez que l'application redirigera automatiquement l'utilisateur vers un nom d'hôte ou un domaine différent (qui n'est pas contrôlé par l'application) uniquement lorsque la destination apparaît sur une liste d'autorisation.", + "parent": "V3.7" + }, + { + "bom-ref": "V3.7.3", + "identifier": "V3.7.3", + "text": "Vérifiez que le domaine de premier niveau de l'application (par exemple, site.tld) ​​est ajouté à la liste de préchargement publique pour HTTP Strict Transport Security (HSTS). Cela garantit que l'utilisation de TLS pour l'application est intégrée directement dans les principaux navigateurs, plutôt que de dépendre uniquement du champ d'en-tête de réponse Strict-Transport-Security.", + "parent": "V3.7" + }, + { + "bom-ref": "V3.7.4", + "identifier": "V3.7.4", + "text": "Vérifiez que l'application affiche une notification lorsque l'utilisateur est redirigé vers une URL hors du contrôle de l'application, avec une option pour annuler la navigation.", + "parent": "V3.7" + }, + { + "bom-ref": "V3.7.5", + "identifier": "V3.7.5", + "text": "Vérifiez que l'application se comporte comme documenté (par exemple, en avertissant l'utilisateur ou en bloquant l'accès) si le navigateur utilisé pour accéder à l'application ne prend pas en charge les fonctionnalités de sécurité attendues.", + "parent": "V3.7" + }, + { + "bom-ref": "V4", + "identifier": "V4", + "title": "API et service Web" + }, + { + "bom-ref": "V4.1", + "identifier": "V4.1", + "title": "Sécurité du service Web générique", + "parent": "V4" + }, + { + "bom-ref": "V4.1.1", + "identifier": "V4.1.1", + "text": "Vérifiez que chaque réponse HTTP avec un corps de message contient un champ d'en-tête Content-Type qui correspond au contenu réel de la réponse, y compris le paramètre charset pour spécifier un codage de caractères sécurisé (par exemple, UTF-8, ISO-8859-1) conformément aux types de médias IANA, tels que « text/ », « /+xml » et « /xml ».", + "parent": "V4.1" + }, + { + "bom-ref": "V4.1.2", + "identifier": "V4.1.2", + "text": "Vérifiez que seuls les terminaux utilisateurs (destinés à l'accès manuel via un navigateur web) redirigent automatiquement de HTTP vers HTTPS, tandis que les autres services ou terminaux n'implémentent pas de redirections transparentes. Cela permet d'éviter qu'un client envoie par erreur des requêtes HTTP non chiffrées, mais que, comme ces requêtes sont automatiquement redirigées vers HTTPS, la fuite de données sensibles passe inaperçue.", + "parent": "V4.1" + }, + { + "bom-ref": "V4.1.3", + "identifier": "V4.1.3", + "text": "Vérifiez que tout champ d'en-tête HTTP utilisé par l'application et défini par une couche intermédiaire, telle qu'un équilibreur de charge, un proxy web ou un service backend-for-frontend, ne peut pas être remplacé par l'utilisateur final. Les exemples d'en-têtes peuvent inclure X-Real-IP, X-Forwarded-*, ou X-User-ID.", + "parent": "V4.1" + }, + { + "bom-ref": "V4.1.4", + "identifier": "V4.1.4", + "text": "Vérifiez que seules les méthodes HTTP explicitement prises en charge par l'application ou son API (y compris les OPTIONS lors des demandes de contrôle en amont) peuvent être utilisées et que les méthodes inutilisées sont bloquées.", + "parent": "V4.1" + }, + { + "bom-ref": "V4.1.5", + "identifier": "V4.1.5", + "text": "Vérifier que les signatures numériques par message sont utilisées pour fournir une assurance supplémentaire en plus des protections de transport pour les demandes ou les transactions qui sont très sensibles ou qui traversent un certain nombre de systèmes.", + "parent": "V4.1" + }, + { + "bom-ref": "V4.2", + "identifier": "V4.2", + "title": "Validation de la structure des messages HTTP", + "parent": "V4" + }, + { + "bom-ref": "V4.2.1", + "identifier": "V4.2.1", + "text": "Vérifiez que tous les composants de l'application (y compris les équilibreurs de charge, les pares-feux et les serveurs d'applications) déterminent les limites des messages HTTP entrants à l'aide du mécanisme approprié à la version HTTP afin d'empêcher la contrebande de requêtes HTTP. Dans HTTP/1.x, si un champ d'en-tête Transfer-Encoding est présent, l'en-tête Content-Length doit être ignoré conformément à la RFC 2616. Avec HTTP/2 ou HTTP/3, si un champ d'en-tête Content-Length est présent, le récepteur doit s'assurer qu'il est cohérent avec la longueur des trames DATA.", + "parent": "V4.2" + }, + { + "bom-ref": "V4.2.2", + "identifier": "V4.2.2", + "text": "Vérifier que, lors de la génération de messages HTTP, le champ d'en-tête Content-Length n'entre pas en conflit avec la longueur du contenu déterminée par le cadrage du protocole HTTP, afin d'empêcher les attaques de type « request smuggling ».", + "parent": "V4.2" + }, + { + "bom-ref": "V4.2.3", + "identifier": "V4.2.3", + "text": "Vérifiez que l'application n'envoie ni n'accepte de messages HTTP/2 ou HTTP/3 avec des champs d'en-tête spécifiques à la connexion, tels que Transfer-Encoding, afin d'éviter les attaques par fractionnement de la réponse et par injection d'en-tête.", + "parent": "V4.2" + }, + { + "bom-ref": "V4.2.4", + "identifier": "V4.2.4", + "text": "Vérifiez que l'application n'accepte que les requêtes HTTP/2 et HTTP/3 dont les champs et valeurs d'en-tête ne contiennent pas de séquences CR (\\r), LF (\\n) ou CRLF (\\r\\n), afin d'éviter les attaques par injection d'en-tête.", + "parent": "V4.2" + }, + { + "bom-ref": "V4.2.5", + "identifier": "V4.2.5", + "text": "Vérifiez que, si l'application (backend ou frontend) construit et envoie des requêtes, elle utilise des mécanismes de validation, d'assainissement ou autres pour éviter de créer des URI (comme pour les appels API) ou des champs d'en-tête de requête HTTP (comme Authorization ou Cookie) qui sont trop longs pour être acceptés par le composant récepteur. Cela pourrait entraîner un déni de service, par exemple lors de l'envoi d'une requête trop longue (par exemple, un long champ d'en-tête de cookie), ce qui fait que le serveur répond toujours avec un statut d'erreur.", + "parent": "V4.2" + }, + { + "bom-ref": "V4.3", + "identifier": "V4.3", + "title": "GraphQL", + "parent": "V4" + }, + { + "bom-ref": "V4.3.1", + "identifier": "V4.3.1", + "text": "Vérifiez qu'une liste d'autorisation de requête, une limitation de profondeur, une limitation de quantité ou une analyse des coûts de requête est utilisée pour empêcher le déni de service (DoS) de GraphQL ou d'expression de la couche données en raison de requêtes imbriquées coûteuses.", + "parent": "V4.3" + }, + { + "bom-ref": "V4.3.2", + "identifier": "V4.3.2", + "text": "Vérifiez que les requêtes d’introspection GraphQL sont désactivées dans l’environnement de production, sauf si l’API GraphQL est destinée à être utilisée par d’autres parties.", + "parent": "V4.3" + }, + { + "bom-ref": "V4.4", + "identifier": "V4.4", + "title": "WebSocket", + "parent": "V4" + }, + { + "bom-ref": "V4.4.1", + "identifier": "V4.4.1", + "text": "Vérifiez que WebSocket sur TLS (WSS) est utilisé pour toutes les connexions WebSocket.", + "parent": "V4.4" + }, + { + "bom-ref": "V4.4.2", + "identifier": "V4.4.2", + "text": "Vérifiez que, lors de la négociation HTTP WebSocket initiale, le champ d’en-tête 'Origin' est vérifié par rapport à une liste d’origines autorisées pour l’application.", + "parent": "V4.4" + }, + { + "bom-ref": "V4.4.3", + "identifier": "V4.4.3", + "text": "Vérifiez que, si la gestion de session standard de l'application ne peut pas être utilisée, des jetons dédiés sont utilisés à cet effet, qui sont conformes aux exigences de sécurité de gestion de session pertinentes.", + "parent": "V4.4" + }, + { + "bom-ref": "V4.4.4", + "identifier": "V4.4.4", + "text": "Vérifiez que les jetons de gestion de session WebSocket dédiés sont initialement obtenus ou validés via la session HTTPS précédemment authentifiée lors de la transition d'une session HTTPS existante vers un canal WebSocket.", + "parent": "V4.4" + }, + { + "bom-ref": "V5", + "identifier": "V5", + "title": "Gestion des fichiers" + }, + { + "bom-ref": "V5.1", + "identifier": "V5.1", + "title": "Documentation sur la gestion des fichiers", + "parent": "V5" + }, + { + "bom-ref": "V5.1.1", + "identifier": "V5.1.1", + "text": "Vérifiez que la documentation définit les types de fichiers autorisés, les extensions de fichiers attendues et la taille maximale (y compris la taille décompressée) pour chaque fonctionnalité de Téléversement. De plus, assurez-vous que la documentation précise comment les fichiers sont sécurisés pour le téléchargement et le traitement des utilisateurs finaux, par exemple le comportement de l'application lorsqu'un fichier malveillant est détecté.", + "parent": "V5.1" + }, + { + "bom-ref": "V5.2", + "identifier": "V5.2", + "title": "Téléversement de fichiers et contenu", + "parent": "V5" + }, + { + "bom-ref": "V5.2.1", + "identifier": "V5.2.1", + "text": "Vérifiez que l'application n'acceptera que des fichiers d'une taille qu'elle peut traiter sans provoquer de perte de performances ou d'attaque par déni de service.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.2.2", + "identifier": "V5.2.2", + "text": "Vérifiez que lorsque l'application accepte un fichier, seul ou dans une archive telle qu'un fichier zip, elle vérifie si l'extension de fichier correspond à une extension attendue et que le contenu correspond au type représenté par l'extension. Cela inclut, sans s'y limiter, la vérification des « octets magiques » initiaux, la réécriture d'images et l'utilisation de bibliothèques spécialisées pour la validation du contenu des fichiers. Pour le niveau L1, cela peut se concentrer uniquement sur les fichiers utilisés pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau L2, cela doit s'appliquer à tous les fichiers acceptés.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.2.3", + "identifier": "V5.2.3", + "text": "Vérifiez que l'application vérifie les fichiers compressés (par exemple, zip, gz, docx, odt) par rapport à la taille maximale autorisée non compressée et au nombre maximal de fichiers avant de décompresser le fichier.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.2.4", + "identifier": "V5.2.4", + "text": "Vérifiez qu'un quota de taille de fichier et un nombre maximal de fichiers par utilisateur sont appliqués pour garantir qu'un seul utilisateur ne puisse pas remplir le stockage avec trop de fichiers ou des fichiers excessivement volumineux.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.2.5", + "identifier": "V5.2.5", + "text": "Vérifiez que l'application n'autorise pas le téléversement de fichiers compressés contenant des liens symboliques, sauf si cela est spécifiquement requis (auquel cas il sera nécessaire d'appliquer une liste d'autorisation des fichiers vers lesquels il est possible de créer des liens symboliques).", + "parent": "V5.2" + }, + { + "bom-ref": "V5.2.6", + "identifier": "V5.2.6", + "text": "Vérifiez que l'application rejette les images téléversées avec une taille de pixel supérieure au maximum autorisé, afin d'éviter les attaques par inondation de pixels.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.3", + "identifier": "V5.3", + "title": "Stockage de fichiers", + "parent": "V5" + }, + { + "bom-ref": "V5.3.1", + "identifier": "V5.3.1", + "text": "Vérifiez que les fichiers téléversés ou générés par une entrée non fiable et stockés dans un dossier public ne sont pas exécutés en tant que code de programme côté serveur lorsqu'ils sont accessibles directement avec une requête HTTP.", + "parent": "V5.3" + }, + { + "bom-ref": "V5.3.2", + "identifier": "V5.3.2", + "text": "Vérifiez que lorsque l'application crée des chemins d'accès pour les opérations sur les fichiers, elle utilise des données générées en interne ou fiables plutôt que des noms de fichiers soumis par l'utilisateur. Si des noms de fichiers ou des métadonnées de fichiers soumis par l'utilisateur doivent être utilisés, une validation et un nettoyage stricts doivent être appliqués. Ceci permet de se protéger contre les attaques par traversée de chemin, l'inclusion de fichiers locaux ou distants (LFI, RFI) et la falsification de requêtes côté serveur (SSRF).", + "parent": "V5.3" + }, + { + "bom-ref": "V5.3.3", + "identifier": "V5.3.3", + "text": "Vérifiez que le traitement des fichiers côté serveur, comme la décompression des fichiers, ignore les informations de chemin fournies par l'utilisateur pour éviter les vulnérabilités telles que le \"zip slip\".", + "parent": "V5.3" + }, + { + "bom-ref": "V5.4", + "identifier": "V5.4", + "title": "Téléchargement de fichier", + "parent": "V5" + }, + { + "bom-ref": "V5.4.1", + "identifier": "V5.4.1", + "text": "Vérifiez que l’application valide ou ignore les noms de fichiers soumis par l’utilisateur, y compris dans un paramètre JSON, JSONP ou URL et spécifie un nom de fichier dans le champ d’en-tête Content-Disposition de la réponse.", + "parent": "V5.4" + }, + { + "bom-ref": "V5.4.2", + "identifier": "V5.4.2", + "text": "Vérifiez que les noms de fichiers servis (par exemple, dans les champs d'en-tête de réponse HTTP ou les pièces jointes aux e-mails) sont encodés ou nettoyés (par exemple, conformément à la RFC 6266) pour préserver la structure du document et empêcher les attaques par injection.", + "parent": "V5.4" + }, + { + "bom-ref": "V5.4.3", + "identifier": "V5.4.3", + "text": "Vérifiez que les fichiers obtenus à partir de sources non fiables sont analysés par des scanners antivirus pour empêcher la diffusion de contenu malveillant connu.", + "parent": "V5.4" + }, + { + "bom-ref": "V6", + "identifier": "V6", + "title": "Authentification" + }, + { + "bom-ref": "V6.1", + "identifier": "V6.1", + "title": "Documentation d'authentification", + "parent": "V6" + }, + { + "bom-ref": "V6.1.1", + "identifier": "V6.1.1", + "text": "Vérifiez que la documentation de l'application définit comment les contrôles, tels que la limitation de débit, l'anti-automatisation et la réponse adaptative, sont utilisés pour se défendre contre les attaques telles que le « credential stuffing » et la force brute des mots de passe. La documentation doit expliquer clairement comment ces contrôles sont configurés et empêcher le blocage malveillant des comptes.", + "parent": "V6.1" + }, + { + "bom-ref": "V6.1.2", + "identifier": "V6.1.2", + "text": "Vérifiez qu'une liste de mots spécifiques au contexte est documentée afin d'empêcher leur utilisation dans les mots de passe. Cette liste peut inclure des permutations de noms d'organisations, de produits, d'identifiants de systèmes, de noms de codes de projets, de noms de services ou de rôles, etc.", + "parent": "V6.1" + }, + { + "bom-ref": "V6.1.3", + "identifier": "V6.1.3", + "text": "Vérifiez que, si l'application inclut plusieurs voies d'authentification, celles-ci sont toutes documentées avec les contrôles de sécurité et la force d'authentification qui doivent être appliqués de manière cohérente.", + "parent": "V6.1" + }, + { + "bom-ref": "V6.2", + "identifier": "V6.2", + "title": "Sécurité des mots de passe", + "parent": "V6" + }, + { + "bom-ref": "V6.2.1", + "identifier": "V6.2.1", + "text": "Vérifiez que les mots de passe définis par l'utilisateur comportent au moins 8 caractères, bien qu'un minimum de 15 caractères soit fortement recommandé.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.2", + "identifier": "V6.2.2", + "text": "Vérifiez que les utilisateurs peuvent modifier leur mot de passe.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.3", + "identifier": "V6.2.3", + "text": "Vérifiez que la fonctionnalité de changement de mot de passe nécessite le mot de passe actuel et le nouveau mot de passe de l'utilisateur.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.4", + "identifier": "V6.2.4", + "text": "Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou du changement de mot de passe sont vérifiés par rapport à un ensemble disponible d'au moins 3 000 mots de passe principaux qui correspondent à la politique de mot de passe de l'application, par exemple la longueur minimale.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.5", + "identifier": "V6.2.5", + "text": "Vérifiez que les mots de passe peuvent être utilisés, quelle que soit leur composition, sans restriction quant au type de caractères autorisés. Aucun nombre minimal de majuscules ou de minuscules, de chiffres ou de caractères spéciaux ne doit être exigé.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.6", + "identifier": "V6.2.6", + "text": "Vérifiez que les champs de saisie du mot de passe utilisent type=password pour masquer la saisie. Les applications peuvent permettre à l'utilisateur d'afficher temporairement l'intégralité du mot de passe masqué ou le dernier caractère saisi.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.7", + "identifier": "V6.2.7", + "text": "Vérifiez que la fonctionnalité « coller », les assistants de mot de passe du navigateur et les gestionnaires de mots de passe externes sont autorisés.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.8", + "identifier": "V6.2.8", + "text": "Vérifiez que l'application vérifie le mot de passe de l'utilisateur exactement tel qu'il a été reçu de l'utilisateur, sans aucune modification telle qu'une troncature ou une transformation de casse.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.9", + "identifier": "V6.2.9", + "text": "Vérifiez que les mots de passe d’au moins 64 caractères sont autorisés.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.10", + "identifier": "V6.2.10", + "text": "Vérifiez que le mot de passe d'un utilisateur reste valide jusqu'à ce qu'il soit découvert comme compromis ou qu'il soit renouvelé. L'application ne doit pas exiger de renouvellement périodique des identifiants.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.11", + "identifier": "V6.2.11", + "text": "Vérifiez que la liste documentée de mots spécifiques au contexte est utilisée pour éviter la création de mots de passe faciles à deviner.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.12", + "identifier": "V6.2.12", + "text": "Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou des modifications de mot de passe sont vérifiés par rapport à un ensemble de mots de passe fuités.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.3", + "identifier": "V6.3", + "title": "Sécurité générale de l'authentification", + "parent": "V6" + }, + { + "bom-ref": "V6.3.1", + "identifier": "V6.3.1", + "text": "Vérifiez que les contrôles visant à empêcher les attaques telles que le bourrage d'informations d'identification et la force brute des mots de passe sont mis en œuvre conformément à la documentation de sécurité de l'application.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.2", + "identifier": "V6.3.2", + "text": "Vérifiez que les comptes d’utilisateur par défaut (par exemple, « root », « admin » ou « sa ») ne sont pas présents dans l’application ou sont désactivés.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.3", + "identifier": "V6.3.3", + "text": "Vérifiez que l’application exige que les utilisateurs utilisent un mécanisme d’authentification multifacteur ou une combinaison de mécanismes d’authentification à facteur unique.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.4", + "identifier": "V6.3.4", + "text": "Vérifiez que, si l’application inclut plusieurs voies d’authentification, il n’existe aucune voie non documentée et que les contrôles de sécurité et la force d’authentification sont appliqués de manière cohérente.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.5", + "identifier": "V6.3.5", + "text": "Vérifiez que les utilisateurs sont informés des tentatives d'authentification suspectes (réussies ou non). Il peut s'agir de tentatives d'authentification provenant d'un emplacement ou d'un client inhabituel, d'une authentification partiellement réussie (un seul facteur parmi plusieurs), d'une tentative d'authentification après une longue période d'inactivité ou d'une authentification réussie après plusieurs tentatives infructueuses.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.6", + "identifier": "V6.3.6", + "text": "Vérifiez que le courrier électronique n’est pas utilisé comme mécanisme d’authentification à facteur unique ou à facteurs multiples.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.7", + "identifier": "V6.3.7", + "text": "Vérifiez que les utilisateurs sont avertis après les mises à jour des détails d'authentification, telles que les réinitialisations d'informations d'identification ou la modification du nom d'utilisateur ou de l'adresse e-mail.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.8", + "identifier": "V6.3.8", + "text": "Vérifiez que les utilisateurs valides ne peuvent pas être déduits d'échecs d'authentification, par exemple en se basant sur des messages d'erreur, des codes de réponse HTTP ou des temps de réponse différents. Les fonctionnalités d'inscription et de mot de passe oublié doivent également bénéficier de cette protection.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.4", + "identifier": "V6.4", + "title": "Cycle de vie et récupération du facteur d'authentification", + "parent": "V6" + }, + { + "bom-ref": "V6.4.1", + "identifier": "V6.4.1", + "text": "Vérifiez que les mots de passe initiaux ou les codes d'activation générés par le système sont générés de manière aléatoire et sécurisée, qu'ils respectent la politique de mots de passe en vigueur et qu'ils expirent après une courte période ou après leur première utilisation. Ces secrets initiaux ne doivent pas devenir des mots de passe permanents.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.4.2", + "identifier": "V6.4.2", + "text": "Vérifiez que les indices de mot de passe ou l'authentification basée sur les connaissances (appelées « questions secrètes ») ne sont pas présents.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.4.3", + "identifier": "V6.4.3", + "text": "Vérifiez qu'un processus sécurisé de réinitialisation d'un mot de passe oublié est mis en œuvre, qui ne contourne aucun mécanisme d'authentification multifacteur activé.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.4.4", + "identifier": "V6.4.4", + "text": "Vérifiez que si un facteur d'authentification multifacteur est perdu, la preuve de vérification d'identité est effectuée au même niveau que lors de l'inscription.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.4.5", + "identifier": "V6.4.5", + "text": "Vérifiez que les instructions de renouvellement des mécanismes d'authentification qui expirent sont envoyées avec suffisamment de temps pour être exécutées avant l'expiration de l'ancien mécanisme d'authentification, en configurant des rappels automatiques si nécessaire.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.4.6", + "identifier": "V6.4.6", + "text": "Vérifiez que les administrateurs peuvent initier la réinitialisation du mot de passe de l'utilisateur, mais que cela ne leur permet pas de modifier ou de choisir son mot de passe. Cela évite qu'ils ne connaissent le mot de passe de l'utilisateur.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.5", + "identifier": "V6.5", + "title": "Exigences générales en matière d'authentification multifacteur", + "parent": "V6" + }, + { + "bom-ref": "V6.5.1", + "identifier": "V6.5.1", + "text": "Vérifiez que les secrets de recherche, les demandes ou codes d'authentification out-of-band et les mots de passe à usage unique basés sur le temps (TOTP) ne peuvent être utilisés avec succès qu'une seule fois.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.2", + "identifier": "V6.5.2", + "text": "Vérifiez que, lors de leur stockage dans le backend de l'application, les secrets de recherche comportant moins de 112 bits d'entropie (19 caractères alphanumériques aléatoires ou 34 chiffres aléatoires) sont hachés avec un algorithme de hachage de stockage de mots de passe approuvé, intégrant un sel aléatoire de 32 bits. Une fonction de hachage standard peut être utilisée si le secret comporte 112 bits d'entropie ou plus.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.3", + "identifier": "V6.5.3", + "text": "Vérifiez que les secrets de recherche, le code d'authentification out-of-band et les mots de passe à usage unique basés sur le temps sont générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) pour éviter les valeurs prévisibles.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.4", + "identifier": "V6.5.4", + "text": "Vérifiez que les secrets de recherche et les codes d'authentification out-of-band ont un minimum de 20 bits d'entropie (généralement 4 caractères alphanumériques aléatoires ou 6 chiffres aléatoires suffisent).", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.5", + "identifier": "V6.5.5", + "text": "Vérifiez que les requêtes, codes ou jetons d'authentification out-of-band, ainsi que les mots de passe à usage unique (TOTP), ont une durée de vie définie. Les requêtes out-of-band doivent avoir une durée de vie maximale de 10 minutes et les TOTP, de 30 secondes.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.6", + "identifier": "V6.5.6", + "text": "Vérifiez que tout facteur d’authentification (y compris les appareils physiques) peut être révoqué en cas de vol ou autre perte.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.7", + "identifier": "V6.5.7", + "text": "Vérifiez que les mécanismes d’authentification biométrique ne sont utilisés que comme facteurs secondaires, avec quelque chose que vous possédez ou quelque chose que vous savez.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.8", + "identifier": "V6.5.8", + "text": "Vérifiez que les mots de passe à usage unique basés sur le temps (TOTP) sont vérifiés en fonction d'une source temporelle provenant d'un service de confiance et non d'une heure non fiable ou fournie par le client.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.6", + "identifier": "V6.6", + "title": "Mécanismes d'authentification out-of-band", + "parent": "V6" + }, + { + "bom-ref": "V6.6.1", + "identifier": "V6.6.1", + "text": "Vérifier que les mécanismes d'authentification utilisant le réseau téléphonique public commuté (RTPC) pour la transmission de mots de passe à usage unique (OTP) par téléphone ou SMS ne sont proposés que lorsque le numéro de téléphone a été préalablement validé. D'autres méthodes plus robustes (telles que les mots de passe à usage unique à durée déterminée) sont également proposées, et que le service informe les utilisateurs des risques de sécurité qu'elles présentent. Pour les applications de niveau 3, le téléphone et les SMS ne doivent pas être disponibles.", + "parent": "V6.6" + }, + { + "bom-ref": "V6.6.2", + "identifier": "V6.6.2", + "text": "Vérifiez que les demandes d’authentification out-of-band, les codes ou les jetons sont liés à la demande d’authentification d’origine pour laquelle ils ont été générés et ne sont pas utilisables pour une demande précédente ou ultérieure.", + "parent": "V6.6" + }, + { + "bom-ref": "V6.6.3", + "identifier": "V6.6.3", + "text": "Vérifiez qu'un mécanisme d'authentification out-of-band basé sur du code est protégé contre les attaques par force brute grâce au \"rate limiting\". Envisagez également d'utiliser un code avec au moins 64 bits d'entropie.", + "parent": "V6.6" + }, + { + "bom-ref": "V6.6.4", + "identifier": "V6.6.4", + "text": "Vérifiez que, lorsque les notifications push sont utilisées pour l'authentification multifacteur, le \"rate limiting\" est appliqué afin d'empêcher les attaques de type « push bombing ». La concordance des numéros peut également atténuer ce risque.", + "parent": "V6.6" + }, + { + "bom-ref": "V6.7", + "identifier": "V6.7", + "title": "Mécanisme d'authentification cryptographique", + "parent": "V6" + }, + { + "bom-ref": "V6.7.1", + "identifier": "V6.7.1", + "text": "Vérifiez que les certificats utilisés pour vérifier les assertions d’authentification cryptographique sont stockés de manière à les protéger contre toute modification.", + "parent": "V6.7" + }, + { + "bom-ref": "V6.7.2", + "identifier": "V6.7.2", + "text": "Vérifiez que le nonce de défi a une longueur d'au moins 64 bits et qu'il est statistiquement unique ou unique sur toute la durée de vie du périphérique cryptographique.", + "parent": "V6.7" + }, + { + "bom-ref": "V6.8", + "identifier": "V6.8", + "title": "Authentification avec un fournisseur d'identité", + "parent": "V6" + }, + { + "bom-ref": "V6.8.1", + "identifier": "V6.8.1", + "text": "Vérifiez que, si l'application prend en charge plusieurs fournisseurs d'identité (IdP), l'identité de l'utilisateur ne peut pas être usurpée via un autre fournisseur d'identité pris en charge (par exemple, en utilisant le même identifiant utilisateur). La mesure standard consisterait à ce que l'application enregistre et identifie l'utilisateur à l'aide d'une combinaison de l'ID du fournisseur d'identité (servant d'espace de noms) et de l'ID de l'utilisateur dans le fournisseur d'identité.", + "parent": "V6.8" + }, + { + "bom-ref": "V6.8.2", + "identifier": "V6.8.2", + "text": "Vérifiez que la présence et l'intégrité des signatures numériques sur les assertions d'authentification (par exemple sur les assertions JWT ou SAML) sont toujours validées, en rejetant toutes les assertions non signées ou ayant des signatures non valides.", + "parent": "V6.8" + }, + { + "bom-ref": "V6.8.3", + "identifier": "V6.8.3", + "text": "Vérifiez que les assertions SAML sont traitées de manière unique et utilisées une seule fois au cours de la période de validité pour éviter les attaques par rejeu.", + "parent": "V6.8" + }, + { + "bom-ref": "V6.8.4", + "identifier": "V6.8.4", + "text": "Si une application utilise un fournisseur d'identité (IdP) distinct et attend une force, des méthodes ou une date d'authentification spécifiques pour des fonctions spécifiques, vérifiez que l'application les vérifie à l'aide des informations renvoyées par l'IdP. Par exemple, si OIDC est utilisé, cela peut être réalisé en validant les affirmations de jeton d'identification telles que « acr », « amr » et « auth_time » (le cas échéant). Si l'IdP ne fournit pas ces informations, l'application doit disposer d'une approche de secours documentée qui suppose que le mécanisme d'authentification de force minimale a été utilisé (par exemple, une authentification à facteur unique avec nom d'utilisateur et mot de passe).", + "parent": "V6.8" + }, + { + "bom-ref": "V7", + "identifier": "V7", + "title": "Gestion des sessions" + }, + { + "bom-ref": "V7.1", + "identifier": "V7.1", + "title": "Documentation sur la gestion des sessions", + "parent": "V7" + }, + { + "bom-ref": "V7.1.1", + "identifier": "V7.1.1", + "text": "Vérifiez que le délai d'inactivité de la session de l'utilisateur et la durée de vie maximale absolue de la session sont documentés, sont appropriés en combinaison avec d'autres contrôles et que la documentation inclut une justification de tout écart par rapport aux exigences de réauthentification NIST SP 800-63B.", + "parent": "V7.1" + }, + { + "bom-ref": "V7.1.2", + "identifier": "V7.1.2", + "text": "Vérifiez que la documentation définit le nombre de sessions simultanées (parallèles) autorisées pour un compte ainsi que les comportements et actions prévus à entreprendre lorsque le nombre maximal de sessions actives est atteint.", + "parent": "V7.1" + }, + { + "bom-ref": "V7.1.3", + "identifier": "V7.1.3", + "text": "Vérifiez que tous les systèmes qui créent et gèrent des sessions utilisateur dans le cadre d'un écosystème de gestion des identités fédérées (tels que les systèmes SSO) sont documentés avec des contrôles pour coordonner la durée de vie des sessions, la résiliation et toute autre condition nécessitant une réauthentification.", + "parent": "V7.1" + }, + { + "bom-ref": "V7.2", + "identifier": "V7.2", + "title": "Sécurité fondamentale de la gestion des sessions", + "parent": "V7" + }, + { + "bom-ref": "V7.2.1", + "identifier": "V7.2.1", + "text": "Vérifiez que l’application effectue toutes les vérifications des jetons de session à l’aide d’un service backend de confiance.", + "parent": "V7.2" + }, + { + "bom-ref": "V7.2.2", + "identifier": "V7.2.2", + "text": "Vérifiez que l'application utilise des jetons autonomes ou de référence générés dynamiquement pour la gestion des sessions, c'est-à-dire sans utiliser de secrets et de clés d'API statiques.", + "parent": "V7.2" + }, + { + "bom-ref": "V7.2.3", + "identifier": "V7.2.3", + "text": "Vérifiez que si des jetons par référence sont utilisés pour représenter les sessions utilisateur, ils sont uniques et générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et possèdent au moins 128 bits d'entropie.", + "parent": "V7.2" + }, + { + "bom-ref": "V7.2.4", + "identifier": "V7.2.4", + "text": "Vérifiez que l’application génère un nouveau jeton de session lors de l’authentification de l’utilisateur, y compris la réauthentification, et met fin au jeton de session actuel.", + "parent": "V7.2" + }, + { + "bom-ref": "V7.3", + "identifier": "V7.3", + "title": "Délai d'expiration de la session", + "parent": "V7" + }, + { + "bom-ref": "V7.3.1", + "identifier": "V7.3.1", + "text": "Vérifiez qu’il existe un délai d’inactivité tel que la réauthentification soit appliquée conformément à l’analyse des risques et aux décisions de sécurité documentées.", + "parent": "V7.3" + }, + { + "bom-ref": "V7.3.2", + "identifier": "V7.3.2", + "text": "Vérifiez qu'il existe une durée de vie maximale absolue de la session de sorte que la réauthentification soit appliquée conformément à l'analyse des risques et aux décisions de sécurité documentées.", + "parent": "V7.3" + }, + { + "bom-ref": "V7.4", + "identifier": "V7.4", + "title": "Fin de session", + "parent": "V7" + }, + { + "bom-ref": "V7.4.1", + "identifier": "V7.4.1", + "text": "Vérifiez que lorsque la fin de session est déclenchée (par exemple, déconnexion ou expiration), l'application interdit toute utilisation ultérieure de la session. Pour les jetons par référence ou les sessions avec état, cela implique l'invalidation des données de session au niveau du backend de l'application. Les applications utilisant des jetons autonomes nécessiteront une solution, comme la gestion d'une liste des jetons terminés, l'interdiction des jetons produits avant une date et une heure spécifique à chaque utilisateur ou la rotation d'une clé de signature spécifique à chaque utilisateur.", + "parent": "V7.4" + }, + { + "bom-ref": "V7.4.2", + "identifier": "V7.4.2", + "text": "Vérifiez que l'application met fin à toutes les sessions actives lorsqu'un compte utilisateur est désactivé ou supprimé (par exemple, lorsqu'un employé quitte l'entreprise).", + "parent": "V7.4" + }, + { + "bom-ref": "V7.4.3", + "identifier": "V7.4.3", + "text": "Vérifiez que l'application offre la possibilité de mettre fin à toutes les autres sessions actives après une modification ou une suppression réussie de tout facteur d'authentification (y compris la modification du mot de passe via une réinitialisation ou une récupération et, le cas échéant, une mise à jour des paramètres MFA).", + "parent": "V7.4" + }, + { + "bom-ref": "V7.4.4", + "identifier": "V7.4.4", + "text": "Vérifiez que toutes les pages nécessitant une authentification disposent d’un accès facile et visible à la fonctionnalité de déconnexion.", + "parent": "V7.4" + }, + { + "bom-ref": "V7.4.5", + "identifier": "V7.4.5", + "text": "Vérifiez que les administrateurs d’applications sont en mesure de mettre fin aux sessions actives pour un utilisateur individuel ou pour tous les utilisateurs.", + "parent": "V7.4" + }, + { + "bom-ref": "V7.5", + "identifier": "V7.5", + "title": "Défenses contre les abus de session", + "parent": "V7" + }, + { + "bom-ref": "V7.5.1", + "identifier": "V7.5.1", + "text": "Vérifiez que l'application nécessite une réauthentification complète avant d'autoriser les modifications des attributs de compte sensibles qui peuvent affecter l'authentification, tels que l'adresse e-mail, le numéro de téléphone, la configuration MFA ou d'autres informations utilisées dans la récupération de compte.", + "parent": "V7.5" + }, + { + "bom-ref": "V7.5.2", + "identifier": "V7.5.2", + "text": "Vérifiez que les utilisateurs peuvent afficher et (après s'être authentifiés à nouveau avec au moins un facteur) terminer une ou toutes les sessions actuellement actives.", + "parent": "V7.5" + }, + { + "bom-ref": "V7.5.3", + "identifier": "V7.5.3", + "text": "Vérifiez que l’application nécessite une authentification supplémentaire avec au moins un facteur ou une vérification secondaire avant d’effectuer des transactions ou des opérations hautement sensibles.", + "parent": "V7.5" + }, + { + "bom-ref": "V7.6", + "identifier": "V7.6", + "title": "Réauthentification fédérée", + "parent": "V7" + }, + { + "bom-ref": "V7.6.1", + "identifier": "V7.6.1", + "text": "Vérifiez que la durée de vie et la fin de la session entre les parties de confiance (RP) et les fournisseurs d'identité (IdP) se comportent comme documenté, en exigeant une réauthentification si nécessaire, par exemple lorsque le temps maximal entre les événements d'authentification IdP est atteint.", + "parent": "V7.6" + }, + { + "bom-ref": "V7.6.2", + "identifier": "V7.6.2", + "text": "Vérifiez que la création d'une session nécessite soit le consentement de l'utilisateur, soit une action explicite, empêchant ainsi la création de nouvelles sessions d'application sans interaction de l'utilisateur.", + "parent": "V7.6" + }, + { + "bom-ref": "V8", + "identifier": "V8", + "title": "Autorisation" + }, + { + "bom-ref": "V8.1", + "identifier": "V8.1", + "title": "Documentation d'autorisation", + "parent": "V8" + }, + { + "bom-ref": "V8.1.1", + "identifier": "V8.1.1", + "text": "Vérifiez que la documentation d’autorisation définit des règles de restriction de l’accès au niveau de la fonction et aux données en fonction des autorisations du consommateur et des attributs des ressources.", + "parent": "V8.1" + }, + { + "bom-ref": "V8.1.2", + "identifier": "V8.1.2", + "text": "Vérifiez que la documentation d'autorisation définit les règles de restriction d'accès au niveau des champs (lecture et écriture) en fonction des autorisations des consommateurs et des attributs des ressources. Notez que ces règles peuvent dépendre d'autres valeurs d'attributs de l'objet de données concerné, telles que l'état ou le statut.", + "parent": "V8.1" + }, + { + "bom-ref": "V8.1.3", + "identifier": "V8.1.3", + "text": "Vérifiez que la documentation de l'application définit les attributs environnementaux et contextuels (y compris, mais sans s'y limiter, l'heure de la journée, l'emplacement de l'utilisateur, l'adresse IP ou l'appareil) qui sont utilisés dans l'application pour prendre des décisions de sécurité, y compris celles relatives à l'authentification et à l'autorisation.", + "parent": "V8.1" + }, + { + "bom-ref": "V8.1.4", + "identifier": "V8.1.4", + "text": "Vérifier que la documentation d'authentification et d'autorisation définit l'utilisation des facteurs environnementaux et contextuels dans la prise de décision, en plus des autorisations au niveau des fonctions, des données et des champs. Cela doit inclure les attributs évalués, les seuils de risque et les actions entreprises (par exemple, autorisation, contestation, refus, renforcement de l'authentification).", + "parent": "V8.1" + }, + { + "bom-ref": "V8.2", + "identifier": "V8.2", + "title": "Conception d'autorisation générale", + "parent": "V8" + }, + { + "bom-ref": "V8.2.1", + "identifier": "V8.2.1", + "text": "Vérifiez que l’application garantit que l’accès basé sur la fonction est limité aux consommateurs disposant d’autorisations explicites.", + "parent": "V8.2" + }, + { + "bom-ref": "V8.2.2", + "identifier": "V8.2.2", + "text": "Vérifiez que l'application garantit que l'accès spécifique aux données est limité aux consommateurs disposant d'autorisations explicites sur des éléments de données spécifiques afin d'atténuer les références d'objet directes non sécurisées (IDOR) et les autorisations de niveau d'objet rompues (BOLA).", + "parent": "V8.2" + }, + { + "bom-ref": "V8.2.3", + "identifier": "V8.2.3", + "text": "Vérifiez que l'application garantit que l'accès au niveau du champ est limité aux consommateurs disposant d'autorisations explicites sur des champs spécifiques afin d'atténuer les problèmes d'autorisation au niveau de la propriété d'objet (BOPLA).", + "parent": "V8.2" + }, + { + "bom-ref": "V8.2.4", + "identifier": "V8.2.4", + "text": "Vérifiez que les contrôles de sécurité adaptatifs basés sur les attributs environnementaux et contextuels du consommateur (tels que l'heure, la localisation, l'adresse IP ou l'appareil) sont mis en œuvre pour les décisions d'authentification et d'autorisation, comme défini dans la documentation de l'application. Ces contrôles doivent être appliqués lorsque le consommateur tente de démarrer une nouvelle session et également pendant une session existante.", + "parent": "V8.2" + }, + { + "bom-ref": "V8.3", + "identifier": "V8.3", + "title": "Autorisation par opération", + "parent": "V8" + }, + { + "bom-ref": "V8.3.1", + "identifier": "V8.3.1", + "text": "Vérifier que l'application applique les règles d'autorisations au niveau de la couche service de confiance et ne s’appuie pas sur des contrôles qu’un consommateur non approuvé pourrait manipuler, comme JavaScript côté client.", + "parent": "V8.3" + }, + { + "bom-ref": "V8.3.2", + "identifier": "V8.3.2", + "text": "Vérifiez que les modifications apportées aux valeurs sur lesquelles reposent les décisions d'autorisation sont appliquées immédiatement. Lorsque les modifications ne peuvent pas être appliquées immédiatement (par exemple, en s'appuyant sur des données de jetons autonomes), des contrôles d'atténuation doivent être mis en place pour alerter un consommateur lorsqu'il effectue une action alors qu'il n'est plus autorisé à le faire et annuler la modification. Notez que cette solution alternative ne limiterait pas les fuites d'informations.", + "parent": "V8.3" + }, + { + "bom-ref": "V8.3.3", + "identifier": "V8.3.3", + "text": "Vérifiez que l'accès à un objet repose sur les autorisations du sujet d'origine (par exemple, le consommateur), et non sur celles d'un intermédiaire ou d'un service agissant en son nom. Par exemple, si un consommateur appelle un service web à l'aide d'un jeton d'authentification autonome, et que ce service demande ensuite des données à un autre service, ce dernier utilisera le jeton du consommateur, plutôt qu'un jeton inter-machine du premier service, pour prendre les décisions d'autorisation.", + "parent": "V8.3" + }, + { + "bom-ref": "V8.4", + "identifier": "V8.4", + "title": "Autres considérations relatives à l'autorisation", + "parent": "V8" + }, + { + "bom-ref": "V8.4.1", + "identifier": "V8.4.1", + "text": "Vérifiez que les applications multi-tenants utilisent des contrôles inter-tenants pour garantir que les opérations des consommateurs n'affecteront jamais les tenants avec lesquels ils ne sont pas autorisés à interagir.", + "parent": "V8.4" + }, + { + "bom-ref": "V8.4.2", + "identifier": "V8.4.2", + "text": "Vérifiez que l'accès aux interfaces administratives intègre plusieurs couches de sécurité, notamment la vérification continue de l'identité du consommateur, l'évaluation de la posture de sécurité des appareils et l'analyse contextuelle des risques, garantissant que l'emplacement du réseau ou les endpoints approuvés ne sont pas les seuls facteurs d'autorisation, même s'ils peuvent réduire la probabilité d'accès non autorisé.", + "parent": "V8.4" + }, + { + "bom-ref": "V9", + "identifier": "V9", + "title": "Jetons autonomes" + }, + { + "bom-ref": "V9.1", + "identifier": "V9.1", + "title": "Source et intégrité du jeton", + "parent": "V9" + }, + { + "bom-ref": "V9.1.1", + "identifier": "V9.1.1", + "text": "Vérifiez que les jetons autonomes sont validés à l'aide de leur signature numérique ou MAC pour les protéger contre toute falsification avant d'accepter le contenu du jeton.", + "parent": "V9.1" + }, + { + "bom-ref": "V9.1.2", + "identifier": "V9.1.2", + "text": "Vérifiez que seuls les algorithmes d'une liste d’autorisations peuvent être utilisés pour créer et vérifier des jetons autonomes, dans un contexte donné. La liste d'autorisation doit inclure les algorithmes autorisés, idéalement symétriques ou asymétriques, et ne doit pas inclure l'algorithme « Aucun ». Si les algorithmes symétriques et asymétriques doivent être pris en charge, des contrôles supplémentaires seront nécessaires pour éviter toute confusion de clés.", + "parent": "V9.1" + }, + { + "bom-ref": "V9.1.3", + "identifier": "V9.1.3", + "text": "Vérifiez que les clés utilisées pour valider les jetons autonomes proviennent de sources préconfigurées et fiables pour l'émetteur du jeton, empêchant ainsi les attaquants de spécifier des sources et des clés non fiables. Pour les JWT et autres structures JWS, les en-têtes tels que « jku », « x5u » et « jwk » doivent être validés par rapport à une liste d'autorisation de sources fiables.", + "parent": "V9.1" + }, + { + "bom-ref": "V9.2", + "identifier": "V9.2", + "title": "Contenu du jeton", + "parent": "V9" + }, + { + "bom-ref": "V9.2.1", + "identifier": "V9.2.1", + "text": "Vérifiez que, si une période de validité est indiquée dans les données du jeton, celui-ci et son contenu ne sont acceptés que si la date de vérification est comprise dans cette période. Par exemple, pour les JWT, les déclarations « nbf » et « exp » doivent être vérifiées.", + "parent": "V9.2" + }, + { + "bom-ref": "V9.2.2", + "identifier": "V9.2.2", + "text": "Vérifiez que le service recevant un jeton valide le type de jeton et son utilisation avant d'en accepter le contenu. Par exemple, seuls les jetons d'accès peuvent être acceptés pour les décisions d'autorisation, et seuls les jetons d'identification peuvent être utilisés pour prouver l'authentification des utilisateurs.", + "parent": "V9.2" + }, + { + "bom-ref": "V9.2.3", + "identifier": "V9.2.3", + "text": "Vérifiez que le service accepte uniquement les jetons destinés à être utilisés avec ce service (audience). Pour les JWT, cela peut être réalisé en validant la déclaration « aud » par rapport à une liste d'autorisation définie dans le service.", + "parent": "V9.2" + }, + { + "bom-ref": "V9.2.4", + "identifier": "V9.2.4", + "text": "Si un émetteur de jetons utilise la même clé privée pour émettre des jetons destinés à différentes audiences, vérifiez que les jetons émis contiennent une restriction d'audience identifiant de manière unique les audiences visées. Cela empêchera la réutilisation d'un jeton avec une audience non prévue. Si l'identifiant d'audience est provisionné dynamiquement, l'émetteur de jetons doit valider ces audiences afin de garantir qu'elles n'entraînent pas d'usurpation d'identité.", + "parent": "V9.2" + }, + { + "bom-ref": "V10", + "identifier": "V10", + "title": "Oauth et OIDC" + }, + { + "bom-ref": "V10.1", + "identifier": "V10.1", + "title": "Sécurité générique OAuth et OIDC", + "parent": "V10" + }, + { + "bom-ref": "V10.1.1", + "identifier": "V10.1.1", + "text": "Vérifiez que les jetons sont envoyés uniquement aux composants qui en ont absolument besoin. Par exemple, lors de l'utilisation d'un modèle backend-for-frontend pour les applications JavaScript basées sur un navigateur, les jetons d'accès et d'actualisation ne doivent être accessibles qu'au backend.", + "parent": "V10.1" + }, + { + "bom-ref": "V10.1.2", + "identifier": "V10.1.2", + "text": "Vérifiez que le client n'accepte les valeurs du serveur d'autorisation (telles que le code d'autorisation ou le jeton d'identification) que si elles résultent d'un flux d'autorisation initié par la même session d'agent utilisateur et la même transaction. Cela nécessite que les secrets générés par le client, tels que la clé de preuve pour l'échange de codes (PKCE) « code_verifier », « state » ou le nonce OIDC, ne puissent être devinés, soient spécifiques à la transaction et soient liés de manière sécurisée au client et à la session d'agent utilisateur au cours de laquelle la transaction a été initiée.", + "parent": "V10.1" + }, + { + "bom-ref": "V10.2", + "identifier": "V10.2", + "title": "Client OAuth", + "parent": "V10" + }, + { + "bom-ref": "V10.2.1", + "identifier": "V10.2.1", + "text": "Vérifiez que, si le flux de code est utilisé, le client OAuth dispose d'une protection contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF), qui déclenchent des demandes de jetons, soit en utilisant la fonctionnalité de clé de preuve pour l'échange de code (PKCE), soit en vérifiant le paramètre « state » envoyé dans la demande d'autorisation.", + "parent": "V10.2" + }, + { + "bom-ref": "V10.2.2", + "identifier": "V10.2.2", + "text": "Vérifiez que, si le client OAuth peut interagir avec plusieurs serveurs d'autorisation, il dispose d'une protection contre les attaques par confusion. Par exemple, il peut exiger que le serveur d'autorisation renvoie la valeur du paramètre « iss » et la valide dans la réponse d'autorisation et la réponse du jeton.", + "parent": "V10.2" + }, + { + "bom-ref": "V10.2.3", + "identifier": "V10.2.3", + "text": "Vérifiez que le client OAuth demande uniquement les portées requises (ou d’autres paramètres d’autorisation) dans les requêtes adressées au serveur d’autorisation.", + "parent": "V10.2" + }, + { + "bom-ref": "V10.3", + "identifier": "V10.3", + "title": "Serveur de ressources OAuth", + "parent": "V10" + }, + { + "bom-ref": "V10.3.1", + "identifier": "V10.3.1", + "text": "Vérifiez que le serveur de ressources accepte uniquement les jetons d'accès destinés à être utilisés avec ce service (audience). L'audience peut être incluse dans un jeton d'accès structuré (comme la déclaration « aud » dans JWT) ou vérifiée à l'aide du endpoint d'introspection de jeton.", + "parent": "V10.3" + }, + { + "bom-ref": "V10.3.2", + "identifier": "V10.3.2", + "text": "Vérifiez que le serveur de ressources applique les décisions d'autorisation en fonction des déclarations du jeton d'accès définissant l'autorisation déléguée. Si des déclarations telles que « sub », « scope » et « authorization_details » sont présentes, elles doivent être prises en compte dans la décision.", + "parent": "V10.3" + }, + { + "bom-ref": "V10.3.3", + "identifier": "V10.3.3", + "text": "Vérifiez que si une décision de contrôle d'accès nécessite l'identification d'un utilisateur unique à partir d'un jeton d'accès (JWT ou réponse d'introspection de jeton associé), le serveur de ressources identifie l'utilisateur à partir de déclarations non ré attribuables à d'autres utilisateurs. En général, cela implique l'utilisation d'une combinaison de déclarations « iss » et « sub ».", + "parent": "V10.3" + }, + { + "bom-ref": "V10.3.4", + "identifier": "V10.3.4", + "text": "Si le serveur de ressources requiert une force d'authentification, des méthodes ou une date d'expiration spécifiques, vérifiez que le jeton d'accès présenté respecte ces contraintes. Par exemple, s'il est présent, utilisez les déclarations OIDC « acr », « amr » et « auth_time » respectivement.", + "parent": "V10.3" + }, + { + "bom-ref": "V10.3.5", + "identifier": "V10.3.5", + "text": "Vérifiez que le serveur de ressources empêche l'utilisation de jetons d'accès volés ou la relecture de jetons d'accès (de parties non autorisées) en exigeant des jetons d'accès limités par l'expéditeur, soit Mutual TLS pour OAuth 2, soit OAuth 2 Demonstration of Proof of Possession (DPoP).", + "parent": "V10.3" + }, + { + "bom-ref": "V10.4", + "identifier": "V10.4", + "title": "Serveur d'autorisation OAuth", + "parent": "V10" + }, + { + "bom-ref": "V10.4.1", + "identifier": "V10.4.1", + "text": "Vérifiez que le serveur d'autorisation valide les URI de redirection en fonction d'une liste d'autorisation spécifique au client d'URI préenregistrés à l'aide d'une comparaison de chaînes exacte.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.2", + "identifier": "V10.4.2", + "text": "Vérifiez que, si le serveur d'autorisation renvoie le code d'autorisation dans la réponse, celui-ci ne peut être utilisé qu'une seule fois pour une demande de jeton. Pour la deuxième demande valide avec un code d'autorisation déjà utilisé pour émettre un jeton d'accès, le serveur d'autorisation doit rejeter la demande de jeton et révoquer tous les jetons émis liés au code d'autorisation.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.3", + "identifier": "V10.4.3", + "text": "Vérifiez que le code d'autorisation est de courte durée. La durée de vie maximale peut atteindre 10 minutes pour les applications L1 et L2 et 1 minute pour les applications L3.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.4", + "identifier": "V10.4.4", + "text": "Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement l'utilisation des autorisations nécessaires à ce client. Notez que les autorisations « token » (flux implicite) et « password » (flux d'informations d'identification du propriétaire de la ressource) ne doivent plus être utilisées.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.5", + "identifier": "V10.4.5", + "text": "Vérifiez que le serveur d'autorisation atténue les attaques par rejeu de jetons d'actualisation pour les clients publics, de préférence en utilisant des jetons d'actualisation limités par l'expéditeur, par exemple des jetons DPoP (Demonstrating Proof of Possession) ou des jetons d'accès liés à un certificat utilisant le protocole TLS mutuel (mTLS). Pour les applications L1 et L2, la rotation des jetons d'actualisation peut être utilisée. Si cette rotation est utilisée, le serveur d'autorisation doit invalider le jeton d'actualisation après utilisation et révoquer tous les jetons d'actualisation de cette autorisation si un jeton d'actualisation déjà utilisé et invalidé est fourni.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.6", + "identifier": "V10.4.6", + "text": "Vérifiez que, si l'octroi de code est utilisé, le serveur d'autorisation atténue les attaques par interception de code en exigeant une clé de preuve pour l'échange de code (PKCE). Pour les demandes d'autorisation, le serveur d'autorisation doit exiger une valeur « code_challenge » valide et ne doit pas accepter une valeur « plain » pour « code_challenge_method ». Pour une demande de jeton, il doit exiger la validation du paramètre « code_verifier ».", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.7", + "identifier": "V10.4.7", + "text": "Vérifiez que si le serveur d'autorisation prend en charge l'enregistrement dynamique des clients non authentifiés, il réduit le risque d'applications clientes malveillantes. Il doit valider les métadonnées clientes, telles que les URI enregistrés, garantir le consentement de l'utilisateur et l'avertir avant de traiter une demande d'autorisation avec une application cliente non approuvée.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.8", + "identifier": "V10.4.8", + "text": "Vérifiez que les jetons d’actualisation ont une expiration absolue, y compris si l’expiration du jeton d’actualisation glissant est appliquée.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.9", + "identifier": "V10.4.9", + "text": "Vérifiez que les jetons d'actualisation et les jetons d'accès de référence peuvent être révoqués par un utilisateur autorisé à l'aide de l'interface utilisateur du serveur d'autorisation, afin d'atténuer le risque de clients malveillants ou de jetons volés.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.10", + "identifier": "V10.4.10", + "text": "Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.11", + "identifier": "V10.4.11", + "text": "Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.12", + "identifier": "V10.4.12", + "text": "Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement la valeur « response_mode » dont ce client a besoin. Par exemple, en vérifiant cette valeur par rapport aux valeurs attendues ou en utilisant une requête d'autorisation poussée (PAR) ou une requête d'autorisation sécurisée par JWT (JAR).", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.13", + "identifier": "V10.4.13", + "text": "Vérifiez que le type d'Autorisation « code » est toujours utilisé avec les demandes d'autorisation poussées (PAR).", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.14", + "identifier": "V10.4.14", + "text": "Vérifiez que le serveur d'autorisation émet uniquement des jetons d'accès limités à l'expéditeur (preuve de possession), soit avec des jetons d'accès liés au certificat utilisant TLS mutuel (mTLS), soit avec des jetons d'accès liés au DPoP (démonstration de preuve de possession).", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.15", + "identifier": "V10.4.15", + "text": "Vérifiez que, pour un client côté serveur (non exécuté sur l'appareil de l'utilisateur final), le serveur d'autorisation garantit que la valeur du paramètre « authorization_details » provient du backend client et que l'utilisateur ne l'a pas altérée. Par exemple, en exigeant l'utilisation d'une demande d'autorisation poussée (PAR) ou d'une demande d'autorisation sécurisée par JWT (JAR).", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.16", + "identifier": "V10.4.16", + "text": "Vérifiez que le client est confidentiel et que le serveur d'autorisation requiert l'utilisation de méthodes d'authentification client fortes (basées sur la cryptographie à clé publique et résistantes aux attaques par relecture), telles que TLS mutuel ('tls_client_auth', 'self_signed_tls_client_auth') ou JWT à clé privée ('private_key_jwt').", + "parent": "V10.4" + }, + { + "bom-ref": "V10.5", + "identifier": "V10.5", + "title": "Client OIDC", + "parent": "V10" + }, + { + "bom-ref": "V10.5.1", + "identifier": "V10.5.1", + "text": "Vérifiez que le client (en tant que partie utilisatrice) atténue les attaques par rejeu de jeton d'identification. Par exemple, en vous assurant que la valeur « nonce » du jeton d'identification correspond à la valeur « nonce » envoyée dans la demande d'authentification au fournisseur OpenID (appelée demande d'autorisation envoyée au serveur d'autorisation dans OAuth2).", + "parent": "V10.5" + }, + { + "bom-ref": "V10.5.2", + "identifier": "V10.5.2", + "text": "Vérifiez que le client identifie de manière unique l'utilisateur à partir des déclarations de jeton d'identification, généralement la déclaration « sub », qui ne peut pas être réaffectée à d'autres utilisateurs (pour la portée d'un fournisseur d'identité).", + "parent": "V10.5" + }, + { + "bom-ref": "V10.5.3", + "identifier": "V10.5.3", + "text": "Vérifiez que le client rejette les tentatives d'un serveur d'autorisation malveillant d'usurper l'identité d'un autre serveur d'autorisation via ses métadonnées. Le client doit rejeter les métadonnées du serveur d'autorisation si l'URL de l'émetteur figurant dans ces métadonnées ne correspond pas exactement à l'URL d'émetteur préconfigurée attendue par le client.", + "parent": "V10.5" + }, + { + "bom-ref": "V10.5.4", + "identifier": "V10.5.4", + "text": "Vérifiez que le client valide que le jeton d'identification est destiné à être utilisé pour ce client (audience) en vérifiant que la déclaration « aud » du jeton est égale à la valeur « client_id » pour le client.", + "parent": "V10.5" + }, + { + "bom-ref": "V10.5.5", + "identifier": "V10.5.5", + "text": "Vérifiez que, lors de l'utilisation de la déconnexion du back-channel OIDC, la partie utilisatrice atténue les risques de déni de service liés à la déconnexion forcée et à la confusion entre JWT dans le flux de déconnexion. Le client doit vérifier que le jeton de déconnexion est correctement typé avec la valeur « logout+jwt », qu'il contient la déclaration « event » avec le nom de membre correct et qu'il ne contient pas de déclaration « nonce ». Il est également recommandé d'utiliser une expiration courte (par exemple, 2 minutes).", + "parent": "V10.5" + }, + { + "bom-ref": "V10.6", + "identifier": "V10.6", + "title": "Fournisseur OpenID", + "parent": "V10" + }, + { + "bom-ref": "V10.6.1", + "identifier": "V10.6.1", + "text": "Vérifiez que le fournisseur OpenID n'autorise que les valeurs « code », « ciba », « id_token » ou « id_token code » pour le mode de réponse. Notez que « code » est préférable à « id_token code » (flux hybride OIDC) et que « token » (tout flux implicite) ne doit pas être utilisé.", + "parent": "V10.6" + }, + { + "bom-ref": "V10.6.2", + "identifier": "V10.6.2", + "text": "Vérifiez que le fournisseur OpenID atténue les risques de déni de service liés à la déconnexion forcée. Pour ce faire, obtenez une confirmation explicite de l'utilisateur final ou, le cas échéant, validez les paramètres de la requête de déconnexion (initiée par la partie utilisatrice), comme « id_token_hint ».", + "parent": "V10.6" + }, + { + "bom-ref": "V10.7", + "identifier": "V10.7", + "title": "Gestion du consentement", + "parent": "V10" + }, + { + "bom-ref": "V10.7.1", + "identifier": "V10.7.1", + "text": "Vérifiez que le serveur d'autorisation garantit le consentement de l'utilisateur à chaque demande d'autorisation. Si l'identité du client ne peut être garantie, le serveur d'autorisation doit toujours demander explicitement le consentement de l'utilisateur.", + "parent": "V10.7" + }, + { + "bom-ref": "V10.7.2", + "identifier": "V10.7.2", + "text": "Vérifiez que lorsque le serveur d'autorisation demande le consentement de l'utilisateur, il fournit des informations claires et suffisantes sur ce qui est consenti. Le cas échéant, ces informations doivent inclure la nature des autorisations demandées (généralement en fonction de la portée, du serveur de ressources et des détails d'autorisation RAR), l'identité de l'application autorisée et la durée de vie de ces autorisations.", + "parent": "V10.7" + }, + { + "bom-ref": "V10.7.3", + "identifier": "V10.7.3", + "text": "Vérifiez que l’utilisateur peut consulter, modifier et révoquer les consentements qu’il a accordés via le serveur d’autorisation.", + "parent": "V10.7" + }, + { + "bom-ref": "V11", + "identifier": "V11", + "title": "Cryptographie" + }, + { + "bom-ref": "V11.1", + "identifier": "V11.1", + "title": "Inventaire et documentation cryptographiques", + "parent": "V11" + }, + { + "bom-ref": "V11.1.1", + "identifier": "V11.1.1", + "text": "Vérifiez qu’il existe une politique documentée pour la gestion des clés cryptographiques et un cycle de vie des clés cryptographiques qui suit une norme de gestion des clés telle que NIST SP 800-57. Cela devrait inclure la garantie que les clés ne sont pas sur-partagées (par exemple, avec plus de deux entités pour les secrets partagés et plus d’une entité pour les clés privées).", + "parent": "V11.1" + }, + { + "bom-ref": "V11.1.2", + "identifier": "V11.1.2", + "text": "Vérifiez qu'un inventaire cryptographique est réalisé, maintenu et régulièrement mis à jour, et qu'il inclut toutes les clés, algorithmes et certificats cryptographiques utilisés par l'application. Il doit également documenter les emplacements du système où les clés peuvent ou non être utilisées, ainsi que les types de données qui peuvent ou non être protégées par ces clés.", + "parent": "V11.1" + }, + { + "bom-ref": "V11.1.3", + "identifier": "V11.1.3", + "text": "Vérifiez que les mécanismes de découverte cryptographique sont utilisés pour identifier toutes les instances de cryptographie dans le système, y compris les opérations de chiffrement, de hachage et de signature.", + "parent": "V11.1" + }, + { + "bom-ref": "V11.1.4", + "identifier": "V11.1.4", + "text": "Vérifier la tenue d'un inventaire cryptographique. Celui-ci doit inclure un plan documenté décrivant la migration vers de nouvelles normes cryptographiques, telles que la cryptographie post-quantique, afin de réagir aux menaces futures.", + "parent": "V11.1" + }, + { + "bom-ref": "V11.2", + "identifier": "V11.2", + "title": "Mise en œuvre sécurisée de la cryptographie", + "parent": "V11" + }, + { + "bom-ref": "V11.2.1", + "identifier": "V11.2.1", + "text": "Vérifiez que les implémentations validées par l’industrie (y compris les bibliothèques et les implémentations accélérées par le matériel) sont utilisées pour les opérations cryptographiques.", + "parent": "V11.2" + }, + { + "bom-ref": "V11.2.2", + "identifier": "V11.2.2", + "text": "Vérifiez que l'application est conçue avec une agilité cryptographique, de sorte que les nombres aléatoires, le chiffrement authentifié, le MAC ou les algorithmes de hachage, les longueurs de clés, les tours, les chiffrements et les modes puissent être reconfigurés, mis à niveau ou échangés à tout moment, afin de se protéger contre les failles cryptographiques. De même, il doit être possible de remplacer les clés et les mots de passe, ainsi que de rechiffrer les données. Cela permettra des mises à niveau transparentes vers la cryptographie post-quantique (PQC), une fois que des implémentations hautement sécurisées de schémas ou de normes PQC approuvés seront largement disponibles.", + "parent": "V11.2" + }, + { + "bom-ref": "V11.2.3", + "identifier": "V11.2.3", + "text": "Vérifiez que toutes les primitives cryptographiques utilisent un minimum de 128 bits de sécurité en fonction de l'algorithme, de la taille de la clé et de la configuration. Par exemple, une clé ECC de 256 bits offre environ 128 bits de sécurité, tandis que RSA nécessite une clé de 3072 bits pour atteindre 128 bits de sécurité.", + "parent": "V11.2" + }, + { + "bom-ref": "V11.2.4", + "identifier": "V11.2.4", + "text": "Vérifiez que toutes les opérations cryptographiques sont à temps constant, sans opérations de « court-circuit » dans les comparaisons, les calculs ou les retours, pour éviter toute fuite d'informations.", + "parent": "V11.2" + }, + { + "bom-ref": "V11.2.5", + "identifier": "V11.2.5", + "text": "Vérifiez que tous les modules cryptographiques échouent en toute sécurité et que les erreurs sont gérées de manière à ne pas permettre de vulnérabilités, telles que les attaques Padding Oracle.", + "parent": "V11.2" + }, + { + "bom-ref": "V11.3", + "identifier": "V11.3", + "title": "Algorithmes de chiffrement", + "parent": "V11" + }, + { + "bom-ref": "V11.3.1", + "identifier": "V11.3.1", + "text": "Vérifiez que les modes de bloc non sécurisés (par exemple, ECB) et les schémas de remplissage faibles (par exemple, PKCS#1 v1.5) ne sont pas utilisés.", + "parent": "V11.3" + }, + { + "bom-ref": "V11.3.2", + "identifier": "V11.3.2", + "text": "Vérifiez que seuls les chiffrements et modes approuvés tels que AES avec GCM sont utilisés.", + "parent": "V11.3" + }, + { + "bom-ref": "V11.3.3", + "identifier": "V11.3.3", + "text": "Vérifiez que les données chiffrées sont protégées contre toute modification non autorisée, de préférence en utilisant une méthode de chiffrement authentifiée approuvée ou en combinant une méthode de chiffrement approuvée avec un algorithme MAC approuvé.", + "parent": "V11.3" + }, + { + "bom-ref": "V11.3.4", + "identifier": "V11.3.4", + "text": "Vérifiez que les nonces, les vecteurs d'initialisation et autres nombres à usage unique ne sont pas utilisés pour plus d'une paire clé de chiffrement/élément de données. La méthode de génération doit être adaptée à l'algorithme utilisé.", + "parent": "V11.3" + }, + { + "bom-ref": "V11.3.5", + "identifier": "V11.3.5", + "text": "Vérifiez que toute combinaison d'un algorithme de chiffrement et d'un algorithme MAC fonctionne en mode chiffrement puis MAC.", + "parent": "V11.3" + }, + { + "bom-ref": "V11.4", + "identifier": "V11.4", + "title": "Hachage et fonctions basées sur le hachage", + "parent": "V11" + }, + { + "bom-ref": "V11.4.1", + "identifier": "V11.4.1", + "text": "Vérifiez que seules les fonctions de hachage approuvées sont utilisées pour les cas d'utilisation cryptographiques généraux, notamment les signatures numériques, HMAC, KDF et la génération de bits aléatoires. Les fonctions de hachage non autorisées, telles que MD5, ne doivent pas être utilisées à des fins cryptographiques.", + "parent": "V11.4" + }, + { + "bom-ref": "V11.4.2", + "identifier": "V11.4.2", + "text": "Vérifiez que les mots de passe sont stockés à l'aide d'une fonction de dérivation de clés approuvée et gourmande en ressources de calcul (également appelée « fonction de hachage de mots de passe »), dont les paramètres sont configurés conformément aux directives en vigueur. Ces paramètres doivent équilibrer sécurité et performances afin de rendre les attaques par force brute suffisamment difficiles pour le niveau de sécurité requis.", + "parent": "V11.4" + }, + { + "bom-ref": "V11.4.3", + "identifier": "V11.4.3", + "text": "Vérifiez que les fonctions de hachage utilisées dans les signatures numériques, dans le cadre de l'authentification ou de l'intégrité des données, sont résistantes aux collisions et possèdent des longueurs de bits appropriées. Si la résistance aux collisions est requise, la longueur de sortie doit être d'au moins 256 bits. Si seule la résistance aux attaques de seconde pré-image est requise, la longueur de sortie doit être d'au moins 128 bits.", + "parent": "V11.4" + }, + { + "bom-ref": "V11.4.4", + "identifier": "V11.4.4", + "text": "Vérifiez que l'application utilise des fonctions de dérivation de clés approuvées avec des paramètres d'extension de clés lors de la dérivation de clés secrètes à partir de mots de passe. Les paramètres utilisés doivent concilier sécurité et performances afin d'empêcher les attaques par force brute de compromettre la clé cryptographique obtenue.", + "parent": "V11.4" + }, + { + "bom-ref": "V11.5", + "identifier": "V11.5", + "title": "Valeurs aléatoires", + "parent": "V11" + }, + { + "bom-ref": "V11.5.1", + "identifier": "V11.5.1", + "text": "Vérifiez que tous les nombres et chaînes aléatoires destinés à être non devinables doivent être générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et posséder au moins 128 bits d'entropie. Notez que les UUID ne respectent pas cette condition.", + "parent": "V11.5" + }, + { + "bom-ref": "V11.5.2", + "identifier": "V11.5.2", + "text": "Vérifiez que le mécanisme de génération de nombres aléatoires utilisé est conçu pour fonctionner en toute sécurité, même en cas de forte demande.", + "parent": "V11.5" + }, + { + "bom-ref": "V11.6", + "identifier": "V11.6", + "title": "Cryptographie à clé publique", + "parent": "V11" + }, + { + "bom-ref": "V11.6.1", + "identifier": "V11.6.1", + "text": "Vérifier que seuls des algorithmes cryptographiques et des modes opératoires approuvés sont utilisés pour la génération et l'amorçage des clés, ainsi que pour la génération et la vérification des signatures numériques. Les algorithmes de génération de clés ne doivent pas générer de clés non sécurisées et vulnérables aux attaques connues, par exemple les clés RSA vulnérables à la factorisation de Fermat.", + "parent": "V11.6" + }, + { + "bom-ref": "V11.6.2", + "identifier": "V11.6.2", + "text": "Vérifiez que des algorithmes cryptographiques approuvés sont utilisés pour l'échange de clés (tels que Diffie-Hellman), en veillant à ce que les mécanismes d'échange de clés utilisent des paramètres sécurisés. Cela permettra d'éviter les attaques contre le processus d'établissement des clés, susceptibles de conduire à des attaques de type « adversaire du milieu » ou à des failles cryptographiques.", + "parent": "V11.6" + }, + { + "bom-ref": "V11.7", + "identifier": "V11.7", + "title": "Cryptographie des données en cours d'utilisation", + "parent": "V11" + }, + { + "bom-ref": "V11.7.1", + "identifier": "V11.7.1", + "text": "Vérifiez que le chiffrement complet de la mémoire est utilisé pour protéger les données sensibles pendant leur utilisation, empêchant ainsi l'accès par des utilisateurs ou des processus non autorisés.", + "parent": "V11.7" + }, + { + "bom-ref": "V11.7.2", + "identifier": "V11.7.2", + "text": "Vérifiez que la minimisation des données garantit que la quantité minimale de données est exposée pendant le traitement et assurez-vous que les données sont chiffrées immédiatement après utilisation ou dès que possible.", + "parent": "V11.7" + }, + { + "bom-ref": "V12", + "identifier": "V12", + "title": "Communication sécurisée" + }, + { + "bom-ref": "V12.1", + "identifier": "V12.1", + "title": "Conseils généraux de sécurité TLS", + "parent": "V12" + }, + { + "bom-ref": "V12.1.1", + "identifier": "V12.1.1", + "text": "Vérifiez que seules les dernières versions recommandées du protocole TLS sont activées, telles que TLS 1.2 et TLS 1.3. La dernière version du protocole TLS doit être privilégiée.", + "parent": "V12.1" + }, + { + "bom-ref": "V12.1.2", + "identifier": "V12.1.2", + "text": "Vérifiez que seules les suites de chiffrement recommandées sont activées, les suites de chiffrement les plus puissantes étant définies comme préférées. Les applications L3 doivent uniquement prendre en charge les suites de chiffrement assurant la confidentialité persistante (forward secrecy).", + "parent": "V12.1" + }, + { + "bom-ref": "V12.1.3", + "identifier": "V12.1.3", + "text": "Vérifiez que l’application valide que les certificats clients mTLS sont approuvés avant d’utiliser l’identité du certificat pour l’authentification ou l’autorisation.", + "parent": "V12.1" + }, + { + "bom-ref": "V12.1.4", + "identifier": "V12.1.4", + "text": "Vérifiez que la révocation de certification appropriée, telle que l'agrafage du protocole OCSP (Online Certificate Status Protocol), est activée et configurée.", + "parent": "V12.1" + }, + { + "bom-ref": "V12.1.5", + "identifier": "V12.1.5", + "text": "Vérifiez que Encrypted Client Hello (ECH) est activé dans les paramètres TLS de l'application pour empêcher l'exposition de métadonnées sensibles, telles que l'indication du nom du serveur (SNI), pendant les processus de négociation TLS.", + "parent": "V12.1" + }, + { + "bom-ref": "V12.2", + "identifier": "V12.2", + "title": "Communication HTTPS avec des services externes", + "parent": "V12" + }, + { + "bom-ref": "V12.2.1", + "identifier": "V12.2.1", + "text": "Vérifiez que TLS est utilisé pour toute connectivité entre un client et des services externes basés sur HTTP, et ne recourt pas à des communications non sécurisées ou non chiffrées.", + "parent": "V12.2" + }, + { + "bom-ref": "V12.2.2", + "identifier": "V12.2.2", + "text": "Vérifiez que les services externes utilisent des certificats TLS publiquement approuvés.", + "parent": "V12.2" + }, + { + "bom-ref": "V12.3", + "identifier": "V12.3", + "title": "Sécurité des communications entre services généraux", + "parent": "V12" + }, + { + "bom-ref": "V12.3.1", + "identifier": "V12.3.1", + "text": "Vérifiez qu'un protocole chiffré tel que TLS est utilisé pour toutes les connexions entrantes et sortantes vers et depuis l'application, y compris les systèmes de surveillance, les outils de gestion, l'accès à distance et SSH, les intergiciels, les bases de données, les mainframes, les systèmes partenaires ou les API externes. Le serveur ne doit pas recourir à des protocoles non sécurisés ou non chiffrés.", + "parent": "V12.3" + }, + { + "bom-ref": "V12.3.2", + "identifier": "V12.3.2", + "text": "Vérifiez que les clients TLS valident les certificats reçus avant de communiquer avec un serveur TLS.", + "parent": "V12.3" + }, + { + "bom-ref": "V12.3.3", + "identifier": "V12.3.3", + "text": "Vérifiez que TLS ou un autre mécanisme de chiffrement de transport approprié est utilisé pour toute connectivité entre les services internes basés sur HTTP au sein de l'application et ne se replie pas vers des communications non sécurisées ou non chiffrées.", + "parent": "V12.3" + }, + { + "bom-ref": "V12.3.4", + "identifier": "V12.3.4", + "text": "Vérifiez que les connexions TLS entre les services internes utilisent des certificats de confiance. Lorsque des certificats générés en interne ou auto-signés sont utilisés, le service consommateur doit être configuré pour n'approuver que des autorités de certification internes spécifiques et des certificats auto-signés spécifiques.", + "parent": "V12.3" + }, + { + "bom-ref": "V12.3.5", + "identifier": "V12.3.5", + "text": "Vérifiez que les services communiquant en interne au sein d'un système (communications intra-services) utilisent une authentification forte pour garantir la vérification de chaque endpoint. Des méthodes d'authentification forte, telles que l'authentification client TLS, doivent être utilisées pour garantir l'identité, en utilisant une infrastructure à clé publique et des mécanismes résistants aux attaques par rejeu. Pour les architectures de microservices, envisagez d'utiliser un maillage de services pour simplifier la gestion des certificats et renforcer la sécurité.", + "parent": "V12.3" + }, + { + "bom-ref": "V13", + "identifier": "V13", + "title": "Configuration" + }, + { + "bom-ref": "V13.1", + "identifier": "V13.1", + "title": "Documentation de configuration", + "parent": "V13" + }, + { + "bom-ref": "V13.1.1", + "identifier": "V13.1.1", + "text": "Vérifiez que tous les besoins de communication de l'application sont documentés. Cela doit inclure les services externes dont l'application dépend et les cas où un utilisateur final pourrait fournir un emplacement externe auquel l'application se connectera.", + "parent": "V13.1" + }, + { + "bom-ref": "V13.1.2", + "identifier": "V13.1.2", + "text": "Vérifiez que pour chaque service utilisé par l'application, la documentation définit le nombre maximal de connexions simultanées (par exemple, les limites du pool de connexions) et le comportement de l'application lorsque cette limite est atteinte, y compris les mécanismes de secours ou de récupération, pour éviter les conditions de déni de service.", + "parent": "V13.1" + }, + { + "bom-ref": "V13.1.3", + "identifier": "V13.1.3", + "text": "Vérifiez que la documentation de l'application définit des stratégies de gestion des ressources pour chaque système ou service externe utilisé (par exemple, bases de données, descripteurs de fichiers, threads, connexions HTTP). Cela doit inclure les procédures de libération des ressources, les paramètres de délai d'expiration, la gestion des échecs et l'implémentation de la logique de nouvelle tentative, en spécifiant les limites de nouvelle tentative, les délais et les algorithmes de retour arrière. Pour les opérations de requête-réponse HTTP synchrones, la documentation doit imposer des délais d'expiration courts et soit désactiver les nouvelles tentatives, soit les limiter strictement afin d'éviter les retards en cascade et l'épuisement des ressources.", + "parent": "V13.1" + }, + { + "bom-ref": "V13.1.4", + "identifier": "V13.1.4", + "text": "Vérifiez que la documentation de l'application définit les secrets essentiels à la sécurité de l'application et un calendrier de rotation de ceux-ci, en fonction du modèle de menace et des exigences commerciales de l'organisation.", + "parent": "V13.1" + }, + { + "bom-ref": "V13.2", + "identifier": "V13.2", + "title": "Configuration de la communication backend", + "parent": "V13" + }, + { + "bom-ref": "V13.2.1", + "identifier": "V13.2.1", + "text": "Vérifiez que les communications entre les composants de l'application backend qui ne prennent pas en charge le mécanisme de session utilisateur standard de l'application, notamment les API, les intergiciels et les couches de données, sont authentifiées. L'authentification doit utiliser des comptes de service individuels, des jetons à court terme ou une authentification par certificat, et non des identifiants immuables tels que des mots de passe, des clés API ou des comptes partagés avec accès privilégié.", + "parent": "V13.2" + }, + { + "bom-ref": "V13.2.2", + "identifier": "V13.2.2", + "text": "Vérifiez que les communications entre les composants de l'application backend, y compris les services locaux ou du système d'exploitation, les API, les intergiciels et les couches de données, sont effectuées avec des comptes dotés des privilèges les moins nécessaires.", + "parent": "V13.2" + }, + { + "bom-ref": "V13.2.3", + "identifier": "V13.2.3", + "text": "Vérifiez que si des informations d’identification doivent être utilisées pour l’authentification du service, les informations d’identification utilisées par le consommateur ne sont pas des informations d’identification par défaut (par exemple, root/root ou admin/admin).", + "parent": "V13.2" + }, + { + "bom-ref": "V13.2.4", + "identifier": "V13.2.4", + "text": "Vérifiez qu'une liste d’autorisations est utilisée pour définir les ressources ou systèmes externes avec lesquels l'application est autorisée à communiquer (par exemple, pour les requêtes sortantes, les chargements de données ou l'accès aux fichiers). Cette liste d'autorisation peut être implémentée au niveau de la couche applicative, du serveur web, du pare-feu ou d'une combinaison de différentes couches.", + "parent": "V13.2" + }, + { + "bom-ref": "V13.2.5", + "identifier": "V13.2.5", + "text": "Vérifiez que le serveur Web ou d’application est configuré avec une liste autorisée de ressources ou de systèmes vers lesquels le serveur peut envoyer des requêtes ou charger des données ou des fichiers.", + "parent": "V13.2" + }, + { + "bom-ref": "V13.2.6", + "identifier": "V13.2.6", + "text": "Vérifiez que lorsque l'application se connecte à des services distincts, elle suit la configuration documentée pour chaque connexion, comme le nombre maximal de connexions parallèles, le comportement lorsque le nombre maximal de connexions autorisées est atteint, les délais d'expiration de connexion et les stratégies de nouvelle tentative.", + "parent": "V13.2" + }, + { + "bom-ref": "V13.3", + "identifier": "V13.3", + "title": "Gestion des secrets", + "parent": "V13" + }, + { + "bom-ref": "V13.3.1", + "identifier": "V13.3.1", + "text": "Vérifiez qu'une solution de gestion des secrets, telle qu'un coffre-fort de clés, est utilisée pour créer, stocker, contrôler l'accès et détruire en toute sécurité les secrets backend. Ceux-ci peuvent inclure des mots de passe, du matériel de clé, des intégrations avec des bases de données et des systèmes tiers, des clés et des graines pour des jetons temporels, d'autres secrets internes et des clés API. Les secrets ne doivent pas être inclus dans le code source de l'application ni dans les artefacts de build. Pour une application L3, cela doit impliquer une solution matérielle telle qu'un HSM.", + "parent": "V13.3" + }, + { + "bom-ref": "V13.3.2", + "identifier": "V13.3.2", + "text": "Vérifiez que l’accès aux ressources secrètes respecte le principe du moindre privilège.", + "parent": "V13.3" + }, + { + "bom-ref": "V13.3.3", + "identifier": "V13.3.3", + "text": "Vérifiez que toutes les opérations cryptographiques sont effectuées à l'aide d'un module de sécurité isolé (tel qu'un coffre-fort ou un module de sécurité matériel) pour gérer et protéger en toute sécurité le matériel clé contre toute exposition en dehors du module de sécurité.", + "parent": "V13.3" + }, + { + "bom-ref": "V13.3.4", + "identifier": "V13.3.4", + "text": "Vérifiez que les secrets sont configurés pour expirer et être renouvelés en fonction de la documentation de l'application.", + "parent": "V13.3" + }, + { + "bom-ref": "V13.4", + "identifier": "V13.4", + "title": "Fuite d'informations involontaire", + "parent": "V13" + }, + { + "bom-ref": "V13.4.1", + "identifier": "V13.4.1", + "text": "Vérifiez que l'application est déployée soit sans aucune métadonnée de contrôle de source, y compris les dossiers .git ou .svn, soit de manière à ce que ces dossiers soient inaccessibles à la fois en externe et à l'application elle-même.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.2", + "identifier": "V13.4.2", + "text": "Vérifiez que les modes de débogage sont désactivés pour tous les composants dans les environnements de production afin d’éviter l’exposition des fonctionnalités de débogage et la fuite d’informations.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.3", + "identifier": "V13.4.3", + "text": "Vérifiez que les serveurs Web n’exposent pas les listes de répertoires aux clients, sauf si cela est explicitement prévu.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.4", + "identifier": "V13.4.4", + "text": "Vérifiez que l’utilisation de la méthode HTTP TRACE n’est pas prise en charge dans les environnements de production, afin d’éviter toute fuite d’informations potentielle.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.5", + "identifier": "V13.4.5", + "text": "Vérifiez que la documentation (comme pour les API internes) et les endpoints de surveillance ne sont pas exposés, sauf si cela est explicitement prévu.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.6", + "identifier": "V13.4.6", + "text": "Vérifiez que l’application n’expose pas d’informations de version détaillées des composants backend.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.7", + "identifier": "V13.4.7", + "text": "Vérifiez que la couche web est configuré pour servir uniquement les fichiers avec des extensions de fichier spécifiques afin d’éviter toute fuite involontaire d’informations, de configuration et de code source.", + "parent": "V13.4" + }, + { + "bom-ref": "V14", + "identifier": "V14", + "title": "Protection des données" + }, + { + "bom-ref": "V14.1", + "identifier": "V14.1", + "title": "Documentation sur la protection des données", + "parent": "V14" + }, + { + "bom-ref": "V14.1.1", + "identifier": "V14.1.1", + "text": "Vérifiez que toutes les données sensibles créées et traitées par l'application ont été identifiées et classées selon leur niveau de protection. Cela inclut les données uniquement codées et donc facilement déchiffrables, telles que les chaînes Base64 ou la charge utile en texte clair d'un JWT. Les niveaux de protection doivent tenir compte des réglementations et normes de protection des données et de confidentialité auxquelles l'application est tenue de se conformer.", + "parent": "V14.1" + }, + { + "bom-ref": "V14.1.2", + "identifier": "V14.1.2", + "text": "Vérifier que tous les niveaux de protection des données sensibles sont assortis d'un ensemble documenté d'exigences de protection. Cela doit inclure (sans s'y limiter) les exigences relatives au chiffrement général, à la vérification de l'intégrité, à la conservation, à la journalisation des données, aux contrôles d'accès aux données sensibles dans les journaux, au chiffrement au niveau de la base de données, aux technologies de confidentialité et de renforcement de la confidentialité à utiliser, ainsi qu'aux autres exigences de confidentialité.", + "parent": "V14.1" + }, + { + "bom-ref": "V14.2", + "identifier": "V14.2", + "title": "Protection générale des données", + "parent": "V14" + }, + { + "bom-ref": "V14.2.1", + "identifier": "V14.2.1", + "text": "Vérifiez que les données sensibles sont uniquement envoyées au serveur dans les champs de corps ou d’en-tête du message HTTP, et que l’URL et la chaîne de requête ne contiennent pas d’informations sensibles, telles qu’une clé API ou un jeton de session.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.2", + "identifier": "V14.2.2", + "text": "Vérifiez que l’application empêche la mise en cache des données sensibles dans les composants du serveur, tels que les équilibreurs de charge et les caches d’application, ou garantit que les données sont purgées en toute sécurité après utilisation.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.3", + "identifier": "V14.2.3", + "text": "Vérifiez que les données sensibles définies ne sont pas envoyées à des parties non fiables (par exemple, des trackers d'utilisateurs) pour empêcher la collecte indésirable de données en dehors du contrôle de l'application.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.4", + "identifier": "V14.2.4", + "text": "Vérifiez que les contrôles autour des données sensibles liés au chiffrement, à la vérification de l'intégrité, à la conservation, à la manière dont les données doivent être enregistrées, aux contrôles d'accès autour des données sensibles dans les journaux, à la confidentialité et aux technologies d'amélioration de la confidentialité, sont mis en œuvre comme défini dans la documentation pour le niveau de protection des données spécifiques.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.5", + "identifier": "V14.2.5", + "text": "Vérifiez que les mécanismes de mise en cache sont configurés pour ne mettre en cache que les réponses dont le type de contenu est conforme à la ressource et qui ne contiennent pas de contenu sensible et dynamique. Le serveur web doit renvoyer une réponse 404 ou 302 lors de l'accès à un fichier inexistant plutôt qu'un fichier valide différent. Cela devrait empêcher les attaques par empoisonnement de cache web.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.6", + "identifier": "V14.2.6", + "text": "Vérifiez que l'application ne renvoie que les données sensibles minimales requises pour son fonctionnement. Par exemple, ne renvoyez que certains chiffres d'un numéro de carte de crédit, et non le numéro complet. Si les données complètes sont requises, elles doivent être masquées dans l'interface utilisateur, sauf si l'utilisateur les consulte spécifiquement.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.7", + "identifier": "V14.2.7", + "text": "Vérifiez que les informations sensibles sont soumises à une classification de conservation des données, en veillant à ce que les données obsolètes ou inutiles soient supprimées automatiquement, selon un calendrier défini ou selon les besoins de la situation.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.8", + "identifier": "V14.2.8", + "text": "Vérifiez que les informations sensibles sont supprimées des métadonnées des fichiers soumis par l'utilisateur, sauf si le stockage est autorisé par l'utilisateur.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.3", + "identifier": "V14.3", + "title": "Protection des données côté client", + "parent": "V14" + }, + { + "bom-ref": "V14.3.1", + "identifier": "V14.3.1", + "text": "Vérifiez que les données authentifiées sont effacées du stockage client, comme le DOM du navigateur, après la fin du client ou de la session. Le champ d'en-tête de réponse HTTP « Clear-Site-Data » peut être utile, mais le côté client devrait également pouvoir effectuer la correction si la connexion au serveur n'est pas disponible à la fin de la session.", + "parent": "V14.3" + }, + { + "bom-ref": "V14.3.2", + "identifier": "V14.3.2", + "text": "Vérifiez que l'application définit suffisamment de champs d'en-tête de réponse HTTP anti-caching (c'est-à-dire Cache-Control : no-store) afin que les données sensibles ne soient pas mises en cache dans les navigateurs.", + "parent": "V14.3" + }, + { + "bom-ref": "V14.3.3", + "identifier": "V14.3.3", + "text": "Vérifiez que les données stockées dans le stockage du navigateur (telles que localStorage, sessionStorage, IndexedDB ou les cookies) ne contiennent pas de données sensibles, à l'exception des jetons de session.", + "parent": "V14.3" + }, + { + "bom-ref": "V15", + "identifier": "V15", + "title": "Développement et architecture sécurisés" + }, + { + "bom-ref": "V15.1", + "identifier": "V15.1", + "title": "Documentation sur le développement et l'architecture sécurisés", + "parent": "V15" + }, + { + "bom-ref": "V15.1.1", + "identifier": "V15.1.1", + "text": "Vérifiez que la documentation de l'application définit les délais de correction basés sur les risques pour les versions de composants tiers présentant des vulnérabilités et pour la mise à jour des bibliothèques en général, afin de minimiser les risques liés à ces composants.", + "parent": "V15.1" + }, + { + "bom-ref": "V15.1.2", + "identifier": "V15.1.2", + "text": "Vérifiez qu'un catalogue d'inventaire, tel qu'une nomenclature logicielle (SBOM), est conservé pour toutes les bibliothèques tierces utilisées, y compris en vérifiant que les composants proviennent de référentiels prédéfinis, fiables et continuellement maintenus.", + "parent": "V15.1" + }, + { + "bom-ref": "V15.1.3", + "identifier": "V15.1.3", + "text": "Vérifiez que la documentation de l'application identifie les fonctionnalités consommatrices en temps ou gourmandes en ressources. Elle doit notamment indiquer comment prévenir une perte de disponibilité due à une utilisation excessive de ces fonctionnalités et éviter que la génération d'une réponse ne prenne plus de temps que le délai d'expiration du consommateur. Les mesures de protection potentielles peuvent inclure le traitement asynchrone, l'utilisation de files d'attente et la limitation des processus parallèles par utilisateur et par application.", + "parent": "V15.1" + }, + { + "bom-ref": "V15.1.4", + "identifier": "V15.1.4", + "text": "Vérifiez que la documentation de l’application met en évidence les bibliothèques tierces qui sont considérées comme des « composants à risque ».", + "parent": "V15.1" + }, + { + "bom-ref": "V15.1.5", + "identifier": "V15.1.5", + "text": "Vérifiez que la documentation de l’application met en évidence les parties de l’application où des « fonctionnalités dangereuses » sont utilisées.", + "parent": "V15.1" + }, + { + "bom-ref": "V15.2", + "identifier": "V15.2", + "title": "Architecture de sécurité et dépendances", + "parent": "V15" + }, + { + "bom-ref": "V15.2.1", + "identifier": "V15.2.1", + "text": "Vérifiez que l’application contient uniquement des composants qui n’ont pas dépassé les délais de mise à jour et de correction documentés.", + "parent": "V15.2" + }, + { + "bom-ref": "V15.2.2", + "identifier": "V15.2.2", + "text": "Vérifiez que l'application a mis en œuvre des défenses contre la perte de disponibilité due à des fonctionnalités qui prennent du temps ou qui nécessitent des ressources, sur la base des décisions et stratégies de sécurité documentées à cet effet.", + "parent": "V15.2" + }, + { + "bom-ref": "V15.2.3", + "identifier": "V15.2.3", + "text": "Vérifiez que l'environnement de production inclut uniquement les fonctionnalités nécessaires au fonctionnement de l'application et n'expose pas de fonctionnalités superflues telles que du code de test, des exemples d'extraits et des fonctionnalités de développement.", + "parent": "V15.2" + }, + { + "bom-ref": "V15.2.4", + "identifier": "V15.2.4", + "text": "Vérifiez que les composants tiers et toutes leurs dépendances transitives sont inclus à partir du référentiel attendu, qu'il soit détenu en interne ou qu'il s'agisse d'une source externe, et qu'il n'y a aucun risque d'attaque par confusion de dépendances.", + "parent": "V15.2" + }, + { + "bom-ref": "V15.2.5", + "identifier": "V15.2.5", + "text": "Vérifiez que l'application implémente des protections supplémentaires autour des parties documentées comme contenant des « fonctionnalités dangereuses » ou utilisant des bibliothèques tierces considérées comme des « composants à risque ». Cela peut inclure des techniques telles que le sandboxing, l'encapsulation, la conteneurisation ou l'isolation au niveau du réseau pour retarder et dissuader les attaquants qui compromettent une partie de l'application de se propager ailleurs.", + "parent": "V15.2" + }, + { + "bom-ref": "V15.3", + "identifier": "V15.3", + "title": "Développement défensif", + "parent": "V15" + }, + { + "bom-ref": "V15.3.1", + "identifier": "V15.3.1", + "text": "Vérifiez que l'application ne renvoie que le sous-ensemble requis de champs d'un objet de données. Par exemple, elle ne doit pas renvoyer un objet de données entier, car certains champs individuels ne doivent pas être accessibles aux utilisateurs.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.2", + "identifier": "V15.3.2", + "text": "Vérifiez que lorsque le backend de l'application effectue des appels vers des URL externes, il est configuré pour ne pas suivre les redirections, sauf s'il s'agit d'une fonctionnalité prévue.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.3", + "identifier": "V15.3.3", + "text": "Vérifiez que l'application dispose de contre-mesures pour se protéger contre les attaques d'affectation de masse en limitant les champs autorisés par contrôleur et action, par exemple, il n'est pas possible d'insérer ou de mettre à jour une valeur de champ lorsqu'elle n'était pas destinée à faire partie de cette action.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.4", + "identifier": "V15.3.4", + "text": "Vérifiez que tous les composants proxy et middleware transfèrent correctement l'adresse IP d'origine de l'utilisateur à l'aide de champs de données fiables qui ne peuvent pas être manipulés par l'utilisateur final, et que l'application et le serveur Web utilisent cette valeur correcte pour la journalisation et les décisions de sécurité telles que la limitation du débit, en tenant compte du fait que même l'adresse IP d'origine peut ne pas être fiable en raison d'adresses IP dynamiques, de VPN ou de pare-feu d'entreprise.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.5", + "identifier": "V15.3.5", + "text": "Vérifiez que l'application garantit explicitement que les variables sont du type correct et effectue des opérations d'égalité et de comparaison strictes. Cela permet d'éviter les vulnérabilités liées à la confusion de types, causées par des hypothèses du code de l'application sur le type d'une variable.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.6", + "identifier": "V15.3.6", + "text": "Vérifiez que le code JavaScript est écrit de manière à éviter la pollution du prototype, par exemple en utilisant Set() ou Map() au lieu de littéraux d'objet.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.7", + "identifier": "V15.3.7", + "text": "Vérifiez que l'application dispose de défenses contre les attaques de pollution des paramètres HTTP, en particulier si le Framework d'application ne fait aucune distinction quant à la source des paramètres de requête (chaîne de requête, paramètres de corps, cookies ou champs d'en-tête).", + "parent": "V15.3" + }, + { + "bom-ref": "V15.4", + "identifier": "V15.4", + "title": "Concurrence sécurisée", + "parent": "V15" + }, + { + "bom-ref": "V15.4.1", + "identifier": "V15.4.1", + "text": "Vérifiez que les objets partagés dans le code multithread (tels que les caches, les fichiers ou les objets en mémoire accessibles par plusieurs threads) sont accessibles en toute sécurité à l'aide de types thread-safe et de mécanismes de synchronisation tels que des verrous ou des sémaphores pour éviter les conditions de concurrence et la corruption des données.", + "parent": "V15.4" + }, + { + "bom-ref": "V15.4.2", + "identifier": "V15.4.2", + "text": "Vérifiez que les vérifications de l'état d'une ressource, comme son existence ou ses autorisations, et des actions qui en dépendent, sont effectuées en une seule opération atomique afin d'éviter les situations de concurrence entre le moment de la vérification et le moment de l'utilisation (TOCTOU). Par exemple, vérifier l'existence d'un fichier avant de l'ouvrir ou l'accès d'un utilisateur avant de l'accorder.", + "parent": "V15.4" + }, + { + "bom-ref": "V15.4.3", + "identifier": "V15.4.3", + "text": "Vérifiez que les verrous sont utilisés de manière cohérente pour éviter que les threads ne se bloquent, que ce soit en s'attendant les uns les autres ou en réessayant sans fin, et que la logique de verrouillage reste dans le code responsable de la gestion de la ressource pour garantir que les verrous ne peuvent pas être modifiés par inadvertance ou de manière malveillante par des classes ou du code externes.", + "parent": "V15.4" + }, + { + "bom-ref": "V15.4.4", + "identifier": "V15.4.4", + "text": "Vérifiez que les politiques d'allocation des ressources empêchent la saturation de threads en garantissant un accès équitable aux ressources, par exemple en exploitant les pools de threads, permettant aux threads de priorité inférieure de continuer dans un délai raisonnable.", + "parent": "V15.4" + }, + { + "bom-ref": "V16", + "identifier": "V16", + "title": "Journalisation de sécurité et gestion des erreurs" + }, + { + "bom-ref": "V16.1", + "identifier": "V16.1", + "title": "Documentation sur la journalisation de sécurité", + "parent": "V16" + }, + { + "bom-ref": "V16.1.1", + "identifier": "V16.1.1", + "text": "Vérifiez qu'il existe un inventaire documentant la journalisation effectuée à chaque couche de la pile technologique de l'application, les événements enregistrés, les formats de journal, l'endroit où cette journalisation est stockée, la manière dont elle est utilisée, la manière dont l'accès à celle-ci est contrôlé et la durée de conservation des journaux.", + "parent": "V16.1" + }, + { + "bom-ref": "V16.2", + "identifier": "V16.2", + "title": "Journalisation générale", + "parent": "V16" + }, + { + "bom-ref": "V16.2.1", + "identifier": "V16.2.1", + "text": "Vérifiez que chaque entrée de journal inclut les métadonnées nécessaires (telles que quand, où, qui, quoi) qui permettraient une enquête détaillée sur la chronologie lorsqu'un événement se produit.", + "parent": "V16.2" + }, + { + "bom-ref": "V16.2.2", + "identifier": "V16.2.2", + "text": "Vérifiez que les sources de temps de tous les composants de journalisation sont synchronisées et que les horodatages des métadonnées des événements de sécurité utilisent le temps UTC ou incluent un décalage horaire explicite. L'UTC est recommandé pour garantir la cohérence entre les systèmes distribués et éviter toute confusion lors du passage à l'heure d'été.", + "parent": "V16.2" + }, + { + "bom-ref": "V16.2.3", + "identifier": "V16.2.3", + "text": "Vérifiez que l’application stocke ou diffuse uniquement les journaux vers les fichiers et services documentés dans l’inventaire des journaux.", + "parent": "V16.2" + }, + { + "bom-ref": "V16.2.4", + "identifier": "V16.2.4", + "text": "Vérifiez que les journaux peuvent être lus et corrélés par le processeur de journaux utilisé, de préférence en utilisant un format de journalisation commun.", + "parent": "V16.2" + }, + { + "bom-ref": "V16.2.5", + "identifier": "V16.2.5", + "text": "Vérifiez que l'application applique la journalisation en fonction du niveau de protection des données lors de la journalisation de données sensibles. Par exemple, certaines données, comme les identifiants ou les informations de paiement, peuvent être interdites. D'autres données, comme les jetons de session, ne peuvent être enregistrées que par hachage ou masquage, en totalité ou en partie.", + "parent": "V16.2" + }, + { + "bom-ref": "V16.3", + "identifier": "V16.3", + "title": "Événements de sécurité", + "parent": "V16" + }, + { + "bom-ref": "V16.3.1", + "identifier": "V16.3.1", + "text": "Vérifiez que toutes les opérations d'authentification sont enregistrées, y compris les tentatives réussies et infructueuses. Des métadonnées supplémentaires, telles que le type d'authentification ou les facteurs utilisés, doivent également être collectées.", + "parent": "V16.3" + }, + { + "bom-ref": "V16.3.2", + "identifier": "V16.3.2", + "text": "Vérifier que les tentatives d'autorisation infructueuses sont logguées. Pour le niveau 3, cela doit inclure la journalisation de toutes les décisions d'autorisation, y compris lors de l'accès à des données sensibles (sans journalisation des données sensibles elles-mêmes).", + "parent": "V16.3" + }, + { + "bom-ref": "V16.3.3", + "identifier": "V16.3.3", + "text": "Vérifiez que l'application enregistre les événements de sécurité définis dans la documentation et enregistre également les tentatives de contournement des contrôles de sécurité, tels que la validation des entrées, la logique métier et l'anti-automatisation.", + "parent": "V16.3" + }, + { + "bom-ref": "V16.3.4", + "identifier": "V16.3.4", + "text": "Vérifiez que l’application enregistre les erreurs inattendues et les échecs de contrôle de sécurité tels que les échecs TLS du backend.", + "parent": "V16.3" + }, + { + "bom-ref": "V16.4", + "identifier": "V16.4", + "title": "Protection des journaux", + "parent": "V16" + }, + { + "bom-ref": "V16.4.1", + "identifier": "V16.4.1", + "text": "Vérifiez que tous les composants de journalisation codent correctement les données pour empêcher l’injection de journaux.", + "parent": "V16.4" + }, + { + "bom-ref": "V16.4.2", + "identifier": "V16.4.2", + "text": "Vérifiez que les journaux sont protégés contre tout accès non autorisé et ne peuvent pas être modifiés.", + "parent": "V16.4" + }, + { + "bom-ref": "V16.4.3", + "identifier": "V16.4.3", + "text": "Vérifiez que les journaux sont transmis de manière sécurisée à un système logique distinct pour analyse, détection, alerte et remontée des informations. L'objectif est de garantir qu'en cas de violation de l'application, les journaux ne seront pas compromis.", + "parent": "V16.4" + }, + { + "bom-ref": "V16.5", + "identifier": "V16.5", + "title": "Gestion des erreurs", + "parent": "V16" + }, + { + "bom-ref": "V16.5.1", + "identifier": "V16.5.1", + "text": "Vérifiez qu'un message générique est renvoyé au consommateur lorsqu'une erreur inattendue ou sensible à la sécurité se produit, garantissant ainsi l'absence d'exposition de données système internes sensibles telles que les traces de pile, les requêtes, les clés secrètes et les jetons.", + "parent": "V16.5" + }, + { + "bom-ref": "V16.5.2", + "identifier": "V16.5.2", + "text": "Vérifiez que l'application continue de fonctionner en toute sécurité lorsque l'accès aux ressources externes échoue, par exemple, en utilisant des modèles tels que des disjoncteurs ou une dégradation progressive.", + "parent": "V16.5" + }, + { + "bom-ref": "V16.5.3", + "identifier": "V16.5.3", + "text": "Vérifiez que l'application échoue proprement et sécurisée, y compris lorsqu'une exception se produit, en évitant les accès en cas d'erreur telles que le traitement d'une transaction malgré les erreurs résultant de la logique de validation.", + "parent": "V16.5" + }, + { + "bom-ref": "V16.5.4", + "identifier": "V16.5.4", + "text": "Vérifiez qu'un gestionnaire d'erreurs de « dernier recours » est défini pour intercepter toutes les exceptions non gérées. Cela permet d'éviter la perte des informations d'erreur qui doivent être loguées dans les fichiers journaux et de garantir qu'une erreur ne paralyse pas l'ensemble du processus applicatif, entraînant une perte de disponibilité.", + "parent": "V16.5" + }, + { + "bom-ref": "V17", + "identifier": "V17", + "title": "WebRTC" + }, + { + "bom-ref": "V17.1", + "identifier": "V17.1", + "title": "Serveur TURN", + "parent": "V17" + }, + { + "bom-ref": "V17.1.1", + "identifier": "V17.1.1", + "text": "Vérifiez que le service TURN (Traversal Using Relays around NAT) autorise uniquement l'accès aux adresses IP non réservées à des fins spécifiques (par exemple, réseaux internes, diffusion, bouclage). Notez que cela s'applique aux adresses IPv4 et IPv6.", + "parent": "V17.1" + }, + { + "bom-ref": "V17.1.2", + "identifier": "V17.1.2", + "text": "Vérifiez que le service Traversal Using Relays around NAT (TURN) n'est pas susceptible d'épuiser ses ressources lorsque des utilisateurs légitimes tentent d'ouvrir un grand nombre de ports sur le serveur TURN.", + "parent": "V17.1" + }, + { + "bom-ref": "V17.2", + "identifier": "V17.2", + "title": "Média", + "parent": "V17" + }, + { + "bom-ref": "V17.2.1", + "identifier": "V17.2.1", + "text": "Vérifiez que la clé du certificat Datagram Transport Layer Security (DTLS) est gérée et protégée conformément à la politique documentée de gestion des clés cryptographiques.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.2", + "identifier": "V17.2.2", + "text": "Vérifiez que le serveur multimédia est configuré pour utiliser et prendre en charge les suites de chiffrement DTLS (Datagram Transport Layer Security) approuvées et un profil de protection sécurisé pour l'extension DTLS pour l'établissement de clés pour le protocole de transport en temps réel sécurisé (DTLS-SRTP).", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.3", + "identifier": "V17.2.3", + "text": "Vérifiez que l'authentification SRTP (Secure Real-time Transport Protocol) est vérifiée sur le serveur multimédia pour empêcher les attaques par injection RTP (Real-time Transport Protocol) d'entraîner une condition de déni de service ou l'insertion de médias audio ou vidéo dans les flux multimédias.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.4", + "identifier": "V17.2.4", + "text": "Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant lorsqu'il rencontre des paquets SRTP (Secure Real-time Transport Protocol) mal formés.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.5", + "identifier": "V17.2.5", + "text": "Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.6", + "identifier": "V17.2.6", + "text": "Vérifiez que le serveur multimédia n'est pas sensible à la vulnérabilité de condition de concurrence « ClientHello » dans Datagram Transport Layer Security (DTLS) en vérifiant si le serveur multimédia est publiquement connu comme étant vulnérable ou en effectuant le test de condition de concurrence.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.7", + "identifier": "V17.2.7", + "text": "Vérifiez que tous les mécanismes d'enregistrement audio ou vidéo associés au serveur multimédia sont en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.8", + "identifier": "V17.2.8", + "text": "Vérifiez que le certificat Datagram Transport Layer Security (DTLS) est vérifié par rapport à l'attribut d'empreinte cryptographique du protocole de description de session (SDP), en mettant fin au flux multimédia si la vérification échoue, pour garantir l'authenticité du flux multimédia.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.3", + "identifier": "V17.3", + "title": "Signalisation", + "parent": "V17" + }, + { + "bom-ref": "V17.3.1", + "identifier": "V17.3.1", + "text": "Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation entrants légitimes lors d'une attaque par saturation. Cela peut être réalisé en implémentant une limitation de débit au niveau de la signalisation.", + "parent": "V17.3" + }, + { + "bom-ref": "V17.3.2", + "identifier": "V17.3.2", + "text": "Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation légitimes en cas de message mal formé susceptible de provoquer un déni de service. Cela peut inclure la validation des entrées, la gestion sécurisée des dépassements d'entiers, la prévention des dépassements de tampon et l'utilisation d'autres techniques robustes de gestion des erreurs.", + "parent": "V17.3" + } + ], + "levels": [ + { + "bom-ref": "level-1", + "identifier": "Level 1", + "description": "This level contains the minimum requirements to consider when securing an application and represents a critical starting point.", + "requirements": [ + "V1.2.1", + "V1.2.2", + "V1.2.3", + "V1.2.4", + "V1.2.5", + "V1.3.1", + "V1.3.2", + "V1.5.1", + "V2.1.1", + "V2.2.1", + "V2.2.2", + "V2.3.1", + "V3.2.1", + "V3.2.2", + "V3.3.1", + "V3.4.1", + "V3.4.2", + "V3.5.1", + "V3.5.2", + "V3.5.3", + "V4.1.1", + "V4.4.1", + "V5.2.1", + "V5.2.2", + "V5.3.1", + "V5.3.2", + "V6.1.1", + "V6.2.1", + "V6.2.2", + "V6.2.3", + "V6.2.4", + "V6.2.5", + "V6.2.6", + "V6.2.7", + "V6.2.8", + "V6.3.1", + "V6.3.2", + "V6.4.1", + "V6.4.2", + "V7.2.1", + "V7.2.2", + "V7.2.3", + "V7.2.4", + "V7.4.1", + "V7.4.2", + "V8.1.1", + "V8.2.1", + "V8.2.2", + "V8.3.1", + "V9.1.1", + "V9.1.2", + "V9.1.3", + "V9.2.1", + "V10.4.1", + "V10.4.2", + "V10.4.3", + "V10.4.4", + "V10.4.5", + "V11.3.1", + "V11.3.2", + "V11.4.1", + "V12.1.1", + "V12.2.1", + "V12.2.2", + "V13.4.1", + "V14.2.1", + "V14.3.1", + "V15.1.1", + "V15.2.1", + "V15.3.1" + ] + }, + { + "bom-ref": "level-2", + "identifier": "Level 2", + "description": "ASVS Level 2 requirements generally relate to either less common attacks or more complicated protections against common attacks. They may still be a first layer of defense, or they may require certain preconditions for the attack to be successful.", + "requirements": [ + "V1.1.1", + "V1.1.2", + "V1.2.6", + "V1.2.7", + "V1.2.8", + "V1.2.9", + "V1.3.3", + "V1.3.4", + "V1.3.5", + "V1.3.6", + "V1.3.7", + "V1.3.8", + "V1.3.9", + "V1.3.10", + "V1.3.11", + "V1.4.1", + "V1.4.2", + "V1.4.3", + "V1.5.2", + "V2.1.2", + "V2.1.3", + "V2.2.3", + "V2.3.2", + "V2.3.3", + "V2.3.4", + "V2.4.1", + "V3.3.2", + "V3.3.3", + "V3.3.4", + "V3.4.3", + "V3.4.4", + "V3.4.5", + "V3.4.6", + "V3.5.4", + "V3.5.5", + "V3.7.1", + "V3.7.2", + "V4.1.2", + "V4.1.3", + "V4.2.1", + "V4.3.1", + "V4.3.2", + "V4.4.2", + "V4.4.3", + "V4.4.4", + "V5.1.1", + "V5.2.3", + "V5.4.1", + "V5.4.2", + "V5.4.3", + "V6.1.2", + "V6.1.3", + "V6.2.9", + "V6.2.10", + "V6.2.11", + "V6.2.12", + "V6.3.3", + "V6.3.4", + "V6.4.3", + "V6.4.4", + "V6.5.1", + "V6.5.2", + "V6.5.3", + "V6.5.4", + "V6.5.5", + "V6.6.1", + "V6.6.2", + "V6.6.3", + "V6.8.1", + "V6.8.2", + "V6.8.3", + "V6.8.4", + "V7.1.1", + "V7.1.2", + "V7.1.3", + "V7.3.1", + "V7.3.2", + "V7.4.3", + "V7.4.4", + "V7.4.5", + "V7.5.1", + "V7.5.2", + "V7.6.1", + "V7.6.2", + "V8.1.2", + "V8.2.3", + "V8.4.1", + "V9.2.2", + "V9.2.3", + "V9.2.4", + "V10.1.1", + "V10.1.2", + "V10.2.1", + "V10.2.2", + "V10.3.1", + "V10.3.2", + "V10.3.3", + "V10.3.4", + "V10.4.6", + "V10.4.7", + "V10.4.8", + "V10.4.9", + "V10.4.10", + "V10.4.11", + "V10.5.1", + "V10.5.2", + "V10.5.3", + "V10.5.4", + "V10.5.5", + "V10.6.1", + "V10.6.2", + "V10.7.1", + "V10.7.2", + "V10.7.3", + "V11.1.1", + "V11.1.2", + "V11.2.1", + "V11.2.2", + "V11.2.3", + "V11.3.3", + "V11.4.2", + "V11.4.3", + "V11.4.4", + "V11.5.1", + "V11.6.1", + "V12.1.2", + "V12.1.3", + "V12.3.1", + "V12.3.2", + "V12.3.3", + "V12.3.4", + "V13.1.1", + "V13.2.1", + "V13.2.2", + "V13.2.3", + "V13.2.4", + "V13.2.5", + "V13.3.1", + "V13.3.2", + "V13.4.2", + "V13.4.3", + "V13.4.4", + "V13.4.5", + "V14.1.1", + "V14.1.2", + "V14.2.2", + "V14.2.3", + "V14.2.4", + "V14.3.2", + "V14.3.3", + "V15.1.2", + "V15.1.3", + "V15.2.2", + "V15.2.3", + "V15.3.2", + "V15.3.3", + "V15.3.4", + "V15.3.5", + "V15.3.6", + "V15.3.7", + "V16.1.1", + "V16.2.1", + "V16.2.2", + "V16.2.3", + "V16.2.4", + "V16.2.5", + "V16.3.1", + "V16.3.2", + "V16.3.3", + "V16.3.4", + "V16.4.1", + "V16.4.2", + "V16.4.3", + "V16.5.1", + "V16.5.2", + "V16.5.3", + "V17.1.1", + "V17.2.1", + "V17.2.2", + "V17.2.3", + "V17.2.4", + "V17.3.1", + "V17.3.2" + ] + }, + { + "bom-ref": "level-3", + "identifier": "Level 3", + "description": "ASVS Level 3 should be the goal for applications looking to demonstrate the highest levels of security and requirements in this section are generally either defense-in-depth mechanisms or other useful but hard-to-implement controls.", + "requirements": [ + "V1.2.10", + "V1.3.12", + "V1.5.3", + "V2.3.5", + "V2.4.2", + "V3.1.1", + "V3.2.3", + "V3.3.5", + "V3.4.7", + "V3.4.8", + "V3.5.6", + "V3.5.7", + "V3.5.8", + "V3.6.1", + "V3.7.3", + "V3.7.4", + "V3.7.5", + "V4.1.4", + "V4.1.5", + "V4.2.2", + "V4.2.3", + "V4.2.4", + "V4.2.5", + "V5.2.4", + "V5.2.5", + "V5.2.6", + "V5.3.3", + "V6.3.5", + "V6.3.6", + "V6.3.7", + "V6.3.8", + "V6.4.5", + "V6.4.6", + "V6.5.6", + "V6.5.7", + "V6.5.8", + "V6.6.4", + "V6.7.1", + "V6.7.2", + "V7.5.3", + "V8.1.3", + "V8.1.4", + "V8.2.4", + "V8.3.2", + "V8.3.3", + "V8.4.2", + "V10.2.3", + "V10.3.5", + "V10.4.12", + "V10.4.13", + "V10.4.14", + "V10.4.15", + "V10.4.16", + "V11.1.3", + "V11.1.4", + "V11.2.4", + "V11.2.5", + "V11.3.4", + "V11.3.5", + "V11.5.2", + "V11.6.2", + "V11.7.1", + "V11.7.2", + "V12.1.4", + "V12.1.5", + "V12.3.5", + "V13.1.2", + "V13.1.3", + "V13.1.4", + "V13.2.6", + "V13.3.3", + "V13.3.4", + "V13.4.6", + "V13.4.7", + "V14.2.5", + "V14.2.6", + "V14.2.7", + "V14.2.8", + "V15.1.4", + "V15.1.5", + "V15.2.4", + "V15.2.5", + "V15.4.1", + "V15.4.2", + "V15.4.3", + "V15.4.4", + "V16.5.4", + "V17.1.2", + "V17.2.5", + "V17.2.6", + "V17.2.7", + "V17.2.8" + ] + } + ], + "externalReferences": [ + { + "type": "website", + "url": "https://owasp.org/asvs" + }, + { + "type": "vcs", + "url": "https://github.com/OWASP/ASVS" + }, + { + "type": "issue-tracker", + "url": "https://github.com/OWASP/ASVS/issues" + }, + { + "type": "social", + "url": "https://twitter.com/OWASP_ASVS" + } + ] + } + ] + } +} diff --git a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.csv b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.csv new file mode 100644 index 0000000000..cbb00a9a2b --- /dev/null +++ b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.csv @@ -0,0 +1,347 @@ +chapter_id,chapter_name,section_id,section_name,req_id,req_description,L +V1,Encodage et nettoyage,V1.1,Architecture d'encodage et de nettoyage,V1.1.1,"Vérifiez que l'entrée est décodée ou non échappée vers une forme canonique une seule fois, elle n'est décodée que lorsque des données codées sous cette forme sont attendues, et que cela est fait avant de traiter davantage l'entrée, par exemple, elle n'est pas effectuée après la validation ou la désinfection de l'entrée.",2 +V1,Encodage et nettoyage,V1.1,Architecture d'encodage et de nettoyage,V1.1.2,"Vérifiez que l'application effectue l'encodage et l'échappement de sortie soit comme étape finale avant d'être utilisée par l'interpréteur pour lequel elle est destinée, soit par l'interpréteur lui-même.",2 +V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.1,"Vérifiez que l'encodage de sortie d'une réponse HTTP, d'un document HTML ou d'un document XML est pertinent pour le contexte requis, comme l'encodage des caractères pertinents pour les éléments HTML, les attributs HTML, les commentaires HTML, les CSS ou les champs d'en-tête HTTP, pour éviter de modifier la structure du message ou du document.",1 +V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.2,"Vérifiez que, lors de la création dynamique d'URL, les données non fiables sont encodées en fonction de leur contexte (par exemple, encodage d'URL ou encodage base64url pour les paramètres de requête ou de chemin). Assurez-vous que seuls les schémas d'URL sûrs sont autorisés (par exemple, interdire javascript: ou data:).",1 +V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.3,"Vérifiez que l'encodage ou l'échappement de sortie est utilisé lors de la création dynamique de contenu JavaScript (y compris JSON), pour éviter de modifier la structure du message ou du document (pour éviter l'injection JavaScript et JSON).",1 +V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.4,"Vérifiez que la sélection de données ou les requêtes de base de données (par exemple, SQL, HQL, NoSQL, Cypher) utilisent des requêtes paramétrées, des ORM, des Framework d'entités ou sont protégées contre les injections SQL et autres attaques par injection de base de données. Ceci est également pertinent lors de l'écriture de procédures stockées.",1 +V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.5,Vérifiez que l’application protège contre l’injection de commandes du système d’exploitation et que les appels du système d’exploitation utilisent des requêtes du système d’exploitation paramétrées ou utilisent un encodage de sortie de ligne de commande contextuelle.,1 +V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.6,Vérifiez que l’application protège contre les vulnérabilités d’injection LDAP ou que des contrôles de sécurité spécifiques pour empêcher l’injection LDAP ont été mis en œuvre.,2 +V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.7,Vérifiez que l’application est protégée contre les attaques par injection XPath en utilisant la paramétrisation des requêtes ou des requêtes précompilées.,2 +V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.8,"Vérifiez que les processeurs LaTeX sont configurés de manière sécurisée (par exemple, en n'utilisant pas l'indicateur « --shell-escape ») et qu'une liste d’autorisations de commandes est utilisée pour empêcher les attaques par injection LaTeX.",2 +V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.9,Vérifiez que l'application échappe les caractères spéciaux dans les expressions régulières (généralement à l'aide d'une barre oblique inverse) pour éviter qu'ils ne soient mal interprétés comme des métacaractères.,2 +V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.10,"Vérifiez que l'application est protégée contre les injections CSV et injections de formules. L'application doit respecter les règles d'échappement définies dans les sections 2.6 et 2.7 de la RFC 4180 lors de l'export de contenu CSV. De plus, lors de l'export au format CSV ou vers d'autres formats de tableur (tels que XLS, XLSX ou ODF), les caractères spéciaux (notamment « = », « + », « - », « @ », « \t » (tabulation) et « \0 » (caractère null)) doivent être protégés par une apostrophe s'ils apparaissent en premier dans une valeur de champ.",3 +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.1,Vérifiez que toutes les entrées HTML non fiables provenant d'éditeurs WYSIWYG ou similaires sont nettoyées à l'aide d'une bibliothèque ou d'une fonctionnalité de Framework de nettoyage HTML bien connue et sécurisée.,1 +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.2,"Vérifiez que l'application évite d'utiliser eval() ou d'autres fonctionnalités d'exécution de code dynamique telles que Spring Expression Language (SpEL). En l'absence d'alternative, toute saisie utilisateur incluse doit être nettoyée avant d'être exécutée.",1 +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.3,"Vérifiez que les données transmises à un contexte potentiellement dangereux sont préalablement nettoyées pour appliquer des mesures de sécurité, telles qu'autoriser uniquement des caractères sûrs pour ce contexte et raccourcir des entrées trop longues.",2 +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.4,"Vérifiez que le contenu Scalable Vector Graphics (SVG) scriptable fourni par l'utilisateur est validé ou nettoyé pour contenir uniquement des balises et des attributs (tels que des graphiques de dessin) qui sont sûrs pour l'application, par exemple, ne contiennent pas de scripts et d'objets étrangers.",2 +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.5,"Vérifiez que l'application nettoie ou désactive le contenu du langage de modèle d'expression ou de script fourni par l'utilisateur, tel que les feuilles de style CSS, le Markdown ou XSL, BBCode ou similaire.",2 +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.6,"Vérifiez que l'application protège contre les attaques de falsification de requête côté serveur (SSRF), en validant les données non fiables par rapport à une liste d'autorisation de protocoles, de domaines, de chemins et de ports et en nettoyant les caractères potentiellement dangereux avant d'utiliser les données pour appeler un autre service.",2 +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.7,"Vérifiez que l'application se protège contre les attaques par injection de modèles en interdisant la création de modèles basés sur des entrées non fiables. En l'absence d'alternative, toute entrée non fiable incluse dynamiquement lors de la création du modèle doit être nettoyée ou rigoureusement validée.",2 +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.8,Vérifiez que l’application nettoie correctement les entrées non fiables avant utilisation dans les requêtes Java Naming and Directory Interface (JNDI) et que JNDI est configuré de manière sécurisée pour empêcher les attaques par injection JNDI.,2 +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.9,Vérifiez que l’application nettoie le contenu avant qu’il ne soit envoyé à memcache pour éviter les attaques par injection.,2 +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.10,Vérifiez que les chaînes de format susceptibles d'être résolues de manière inattendue ou malveillante lors de leur utilisation sont nettoyées avant d'être traitées.,2 +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.11,Vérifiez que l'application nettoie les entrées utilisateur avant de les transmettre aux systèmes de messagerie pour se protéger contre l'injection SMTP ou IMAP.,2 +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.12,"Vérifiez que les expressions régulières sont exemptes d'éléments provoquant ""backtracking"" exponentiel et assurez-vous que les entrées non fiables sont nettoyées pour atténuer les attaques ReDoS ou Runaway Regex.",3 +V1,Encodage et nettoyage,V1.4,"Mémoire, chaine de caractères et code à mémoire non-managée",V1.4.1,"Vérifiez que l'application utilise des chaînes memory-safe, une copie de mémoire et une arithmétique de pointeur renforcée pour détecter ou empêcher les débordements de pile, de tampon ou de tas.",2 +V1,Encodage et nettoyage,V1.4,"Mémoire, chaine de caractères et code à mémoire non-managée",V1.4.2,"Vérifiez que les techniques de validation du signe, de la plage et de l’entrée sont utilisées pour éviter les dépassements d’entiers.",2 +V1,Encodage et nettoyage,V1.4,"Mémoire, chaine de caractères et code à mémoire non-managée",V1.4.3,"Vérifiez que la mémoire et les ressources allouées dynamiquement sont libérées et que les références ou les pointeurs vers la mémoire libérée sont supprimés ou définis à null pour éviter les ""dangling pointer"" et les vulnérabilités d'utilisation après libération.",2 +V1,Encodage et nettoyage,V1.5,Désérialisation sécurisée,V1.5.1,"Vérifiez que l'application configure les ""parser"" XML pour utiliser une configuration restrictive et que les fonctionnalités non sûres telles que la résolution d'entités externes sont désactivées pour empêcher les attaques XML eXternal Entity (XXE).",1 +V1,Encodage et nettoyage,V1.5,Désérialisation sécurisée,V1.5.2,"Vérifiez que la désérialisation des données non fiables garantit une gestion sécurisée des entrées, par exemple en utilisant une liste d'autorisation de types d'objets ou en limitant les types d'objets définis par le client, afin d'empêcher les attaques par désérialisation. Les mécanismes de désérialisation explicitement définis comme non sécurisés ne doivent pas être utilisés avec des entrées non fiables.",2 +V1,Encodage et nettoyage,V1.5,Désérialisation sécurisée,V1.5.3,"Vérifiez que les différents ""parser"" utilisés dans l'application pour le même type de données (par exemple, les ""parser"" JSON, les ""parser"" XML, les ""parser"" d'URL) effectuent l'analyse de manière cohérente et utilisent le même mécanisme d'encodage de caractères pour éviter des problèmes tels que les vulnérabilités d'interopérabilité JSON ou un comportement d'analyse d'URI ou de fichier différent exploité dans les attaques d'inclusion de fichiers à distance (RFI) ou de falsification de requête côté serveur (SSRF).",3 +V2,Validation et logique métier,V2.1,Validation et documentation de la logique métier,V2.1.1,"Vérifiez que la documentation de l'application définit des règles de validation des entrées pour vérifier la validité des éléments de données par rapport à la structure attendue. Il peut s'agir de formats de données courants tels que des numéros de carte de crédit, des adresses e-mail ou des numéros de téléphone, ou d'un format de données interne.",1 +V2,Validation et logique métier,V2.1,Validation et documentation de la logique métier,V2.1.2,"Vérifiez que la documentation de l'application définit comment valider la cohérence logique et contextuelle des éléments de données combinés, par exemple en vérifiant que la banlieue et le code postal correspondent.",2 +V2,Validation et logique métier,V2.1,Validation et documentation de la logique métier,V2.1.3,"Vérifiez que les attentes en matière de limites et de validations de la logique métier sont documentées, y compris par utilisateur et globalement dans l'application.",2 +V2,Validation et logique métier,V2.2,Validation des entrées,V2.2.1,"Vérifier que les entrées sont validées afin de respecter les attentes métier ou fonctionnelles. Cette validation doit être basée sur une liste de valeurs, de modèles et de plages autorisées, ou sur la comparaison des entrées avec une structure attendue et des limites logiques selon des règles prédéfinies. Pour le niveau 1, cette validation peut se concentrer sur les entrées utilisées pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau 2, elle doit s'appliquer à toutes les entrées.",1 +V2,Validation et logique métier,V2.2,Validation des entrées,V2.2.2,"Vérifiez que l'application est conçue pour appliquer la validation des entrées au niveau d'une couche de service de confiance. Bien que la validation côté client améliore l'ergonomie et doit être encouragée, elle ne doit pas être considérée comme un contrôle de sécurité.",1 +V2,Validation et logique métier,V2.2,Validation des entrées,V2.2.3,Vérifiez que l’application garantit que les combinaisons d’éléments de données associés sont raisonnables selon les règles prédéfinies.,2 +V2,Validation et logique métier,V2.3,Sécurité de la logique métier,V2.3.1,Vérifiez que l’application traitera uniquement les flux de logique métier pour le même utilisateur dans l’ordre séquentiel attendu et sans sauter d’étapes.,1 +V2,Validation et logique métier,V2.3,Sécurité de la logique métier,V2.3.2,"Vérifiez que les limites de la logique métier sont implémentées conformément à la documentation de l'application, afin d'éviter que des failles de la logique métier ne soient pas exploitées.",2 +V2,Validation et logique métier,V2.3,Sécurité de la logique métier,V2.3.3,Vérifiez que les transactions sont utilisées au niveau de la logique métier de telle sorte qu'une opération de logique métier réussisse dans son intégralité ou qu'elle soit restaurée à l'état correct précédent.,2 +V2,Validation et logique métier,V2.3,Sécurité de la logique métier,V2.3.4,Vérifiez que les mécanismes de verrouillage au niveau de la logique métier sont utilisés pour garantir que les ressources en quantité limitée (telles que les sièges de théâtre ou les créneaux de livraison) ne peuvent pas être réservées deux fois en manipulant la logique de l'application.,2 +V2,Validation et logique métier,V2.3,Sécurité de la logique métier,V2.3.5,"Vérifiez que les flux logiques métier à forte valeur ajoutée nécessitent l'approbation de plusieurs utilisateurs afin d'éviter toute action non autorisée ou accidentelle. Cela peut inclure, sans s'y limiter, les transferts monétaires importants, les approbations de contrats, l'accès à des informations classifiées ou les contournements de sécurité dans le secteur manufacturier.",3 +V2,Validation et logique métier,V2.4,Anti-automatisation,V2.4.1,"Vérifiez que des contrôles anti-automatisation sont en place pour protéger contre les appels excessifs aux fonctions d'application qui pourraient conduire à l'exfiltration de données, à la création de données inutiles, à l'épuisement des quotas, aux violations de limites de débit, au déni de service ou à la surutilisation de ressources coûteuses.",2 +V2,Validation et logique métier,V2.4,Anti-automatisation,V2.4.2,"Vérifiez que les flux logiques métier nécessitent un timing humain réaliste, évitant ainsi des soumissions de transactions excessivement rapides.",3 +V3,Sécurité du frontend Web,V3.1,Documentation sur la sécurité du frontend Web,V3.1.1,"Vérifiez que la documentation de l'application indique les fonctionnalités de sécurité attendues que les navigateurs utilisant l'application doivent prendre en charge (telles que HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) et autres mécanismes de sécurité HTTP pertinents). Elle doit également définir le comportement de l'application lorsque certaines de ces fonctionnalités ne sont pas disponibles (par exemple, avertir l'utilisateur ou bloquer l'accès).",3 +V3,Sécurité du frontend Web,V3.2,Interprétation non intentionnelle du contenu,V3.2.1,"Vérifiez que des contrôles de sécurité sont en place pour empêcher les navigateurs d'afficher du contenu ou des fonctionnalités dans les réponses HTTP dans un contexte incorrect (par exemple, lorsqu'une API, un fichier téléchargé par l'utilisateur ou une autre ressource est demandée directement). Les contrôles possibles peuvent inclure : ne pas transmettre le contenu sauf si les champs d'en-tête de requête HTTP (tels que Sec-Fetch-\*) indiquent qu'il s'agit du contexte correct, utiliser la directive sandbox du champ d'en-tête Content-Security-Policy ou utiliser le type de disposition de pièce jointe dans le champ d'en-tête Content-Disposition.",1 +V3,Sécurité du frontend Web,V3.2,Interprétation non intentionnelle du contenu,V3.2.2,"Vérifiez que le contenu destiné à être affiché sous forme de texte, plutôt que rendu sous forme de HTML, est géré à l'aide de fonctions de rendu sécurisées (telles que createTextNode ou textContent) pour empêcher l'exécution involontaire de contenu tel que HTML ou JavaScript.",1 +V3,Sécurité du frontend Web,V3.2,Interprétation non intentionnelle du contenu,V3.2.3,"Vérifiez que l'application évite l'écrasement du DOM lors de l'utilisation de JavaScript côté client en utilisant des déclarations de variables explicites, en effectuant une vérification de type stricte, en évitant de stocker des variables globales sur l'objet document et en implémentant l'isolation de l'espace de nommage.",3 +V3,Sécurité du frontend Web,V3.3,Configuration des cookies,V3.3.1,"Vérifiez que les cookies ont l'attribut « Secure » ​​défini et si le préfixe « \__Host- » n'est pas utilisé pour le nom du cookie, le préfixe « __Secure- » doit être utilisé pour le nom du cookie.",1 +V3,Sécurité du frontend Web,V3.3,Configuration des cookies,V3.3.2,"Vérifiez que la valeur de l'attribut « SameSite » de chaque cookie est définie en fonction de l'objectif du cookie, afin de limiter l'exposition aux attaques de réparation de l'interface utilisateur et aux attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).",2 +V3,Sécurité du frontend Web,V3.3,Configuration des cookies,V3.3.3,"Vérifiez que les cookies ont le préfixe « __Host- » pour le nom du cookie, sauf s'ils sont explicitement conçus pour être partagés avec d'autres hôtes.",2 +V3,Sécurité du frontend Web,V3.3,Configuration des cookies,V3.3.4,"Vérifiez que si la valeur d'un cookie n'est pas censée être accessible aux scripts côté client (comme un jeton de session), le cookie doit avoir l'attribut « HttpOnly » défini et la même valeur (par exemple, un jeton de session) ne doit être transférée au client que via le champ d'en-tête « Set-Cookie ».",2 +V3,Sécurité du frontend Web,V3.3,Configuration des cookies,V3.3.5,"Vérifiez que lorsque l'application écrit un cookie, la longueur combinée du nom et de la valeur du cookie ne dépasse pas 4 096 octets. Les cookies trop volumineux ne seront pas stockés par le navigateur et ne seront donc pas envoyés avec les requêtes, empêchant ainsi l'utilisateur d'utiliser les fonctionnalités de l'application qui reposent sur ce cookie.",3 +V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.1,"Vérifiez qu'un champ d'en-tête Strict-Transport-Security est inclus dans toutes les réponses afin d'appliquer une politique HTTP Strict Transport Security (HSTS). Une durée maximale d'au moins un an doit être définie, et pour les niveaux L2 et supérieurs, la politique doit également s'appliquer à tous les sous-domaines.",1 +V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.2,"Vérifiez que le champ d'en-tête Access-Control-Allow-Origin du partage de ressources cross-origine (CORS) est une valeur fixe de l'application ou, si la valeur du champ d'en-tête de requête HTTP Origin est utilisée, qu'elle est validée par rapport à une liste d'origines approuvées. Si « Access-Control-Allow-Origin: * » doit être utilisé, vérifiez que la réponse ne contient aucune information sensible.",1 +V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.3,"Vérifiez que les réponses HTTP incluent un champ d'en-tête de réponse Content-Security-Policy qui définit des directives garantissant que le navigateur charge et exécute uniquement du contenu ou des ressources fiables, afin de limiter l'exécution de JavaScript malveillant. Au minimum, une politique globale doit être utilisée, incluant les directives object-src 'none' et base-uri 'none', et définissant soit une lliste d’autorisations, soit des valeurs nonces ou des hachages. Pour une application L3, une politique par réponse avec des valeurs nonces ou des hachages doit être définie.",2 +V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.4,"Vérifiez que toutes les réponses HTTP contiennent un champ d'en-tête « X-Content-Type-Options: nosniff ». Cela indique aux navigateurs de ne pas utiliser l'analyse de contenu ni la détection du type MIME pour la réponse donnée, et d'exiger que la valeur du champ d'en-tête « Content-Type » de la réponse corresponde à la ressource de destination. Par exemple, la réponse à une demande de style n'est acceptée que si le type de contenu de la réponse est « text/css ». Cela permet également au navigateur d'utiliser la fonctionnalité de blocage de lecture inter-origines (CORB).",2 +V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.5,"Vérifiez que l'application définit une politique de référencement afin d'empêcher la fuite de données techniquement sensibles vers des services tiers via le champ d'en-tête de requête HTTP « Referer ». Cela peut être effectué via le champ d'en-tête de réponse HTTP « Referrer-Policy » ou via les attributs d'élément HTML. Les données sensibles peuvent inclure le chemin d'accès et les données de requête dans l'URL, et pour les applications internes non publiques, le nom d'hôte.",2 +V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.6,"Vérifiez que l'application Web utilise la directive frame-ancestors du champ d'en-tête Content-Security-Policy pour chaque réponse HTTP afin de garantir qu'elle ne peut pas être intégrée par défaut et que l'intégration de ressources spécifiques n'est autorisée qu'en cas de nécessité. Notez que le champ d'en-tête X-Frame-Options, bien que pris en charge par les navigateurs, est obsolète et n'est pas forcément fiable.",2 +V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.7,Vérifiez que le champ d’en-tête Content-Security-Policy spécifie un emplacement pour signaler les violations.,3 +V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.8,"Vérifiez que toutes les réponses HTTP qui lancent le rendu d'un document (comme les réponses de type text/html) incluent le champ d'en-tête 'Cross-Origin-Opener-Policy' avec la directive 'same-origin' ou s'ame-origin-allow-popups', selon les besoins. Cela empêche les attaques abusant de l'accès partagé aux objets Window, telles que le tabnabbing et le comptage d'images.",3 +V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.1,"Vérifiez que, si l'application ne s'appuie pas sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher les requêtes inter-origines non autorisées d'utiliser des fonctionnalités sensibles, ces requêtes sont validées afin de garantir leur origine. Cela peut se faire en utilisant et en validant des jetons anti-falsification ou en exigeant des champs d'en-tête HTTP supplémentaires qui ne sont pas des champs d'en-tête de requête CORS safelist. Ceci permet de se protéger contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).",1 +V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.2,"Vérifiez que, si l'application s'appuie sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher l'utilisation inter-origines non autorisée de fonctionnalités sensibles, il est impossible d'appeler la fonctionnalité avec une requête qui ne déclenche pas de requête de pré-vérification cross-origin CORS. Cela peut nécessiter de vérifier les valeurs des champs d'en-tête de requête 'Origin' et 'Content-Type' ou d'utiliser un champ d'en-tête supplémentaire qui n'est pas un champ d'en-tête de la liste de sécurité CORS.",1 +V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.3,"Vérifiez que les requêtes HTTP destinées aux fonctionnalités sensibles utilisent des méthodes HTTP appropriées, telles que POST, PUT, PATCH ou DELETE, et non des méthodes définies comme « sûres » par la spécification HTTP, telles que HEAD, OPTIONS ou GET. Une validation stricte des champs d'en-tête de requête Sec-Fetch-* peut également être utilisée pour garantir que la requête ne provient pas d'un appel inter-origines inapproprié, d'une requête de navigation ou d'un chargement de ressources (comme une source d'image) inattendu.",1 +V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.4,"Vérifiez que des applications distinctes sont hébergées sur des noms d'hôte différents pour tirer parti des restrictions fournies par la politique de même origine, y compris la manière dont les documents ou scripts chargés par une origine peuvent interagir avec les ressources d'une autre origine et les restrictions basées sur le nom d'hôte sur les cookies.",2 +V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.5,Vérifiez que les messages reçus par l'interface postMessage sont rejetés si l'origine du message n'est pas digne de confiance ou si la syntaxe du message n'est pas valide.,2 +V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.6,Vérifiez que la fonctionnalité JSONP n'est activée nulle part dans l'application pour éviter les attaques Cross-Site Script Inclusion (XSSI).,3 +V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.7,"Vérifiez que les données nécessitant une autorisation ne sont pas incluses dans les réponses des ressources de script, comme les fichiers JavaScript, pour empêcher les attaques par inclusion de script intersite (XSSI).",3 +V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.8,"Vérifiez que les ressources authentifiées (telles que les images, les vidéos, les scripts et autres documents) peuvent être chargées ou intégrées pour le compte de l'utilisateur uniquement lorsque cela est prévu. Cela peut être réalisé en validant strictement les champs d'en-tête de requête HTTP Sec-Fetch-* afin de garantir que la requête ne provient pas d'un appel cross-origin inapproprié, ou en définissant un champ d'en-tête de réponse HTTP Cross-Origin-Resource-Policy restrictif pour indiquer au navigateur de bloquer le contenu renvoyé.",3 +V3,Sécurité du frontend Web,V3.6,Intégrité des ressources externes,V3.6.1,"Vérifiez que les ressources côté client, telles que les bibliothèques JavaScript, les feuilles de style CSS ou les polices web, sont hébergées en externe (par exemple, sur un réseau de diffusion de contenu) uniquement si la ressource est statique et versionnée, et si l'intégrité des sous-ressources (SRI) est utilisée pour valider l'intégrité de la ressource. Si cela n'est pas possible, une décision de sécurité documentée doit justifier cette décision pour chaque ressource.",3 +V3,Sécurité du frontend Web,V3.7,Autres considérations sur la sécurité du navigateur,V3.7.1,"Vérifiez que l'application utilise uniquement des technologies côté client toujours prises en charge et considérées comme sécurisées. Parmi les technologies qui ne répondent pas à cette exigence figurent les plugins NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL ou les applets Java côté client.",2 +V3,Sécurité du frontend Web,V3.7,Autres considérations sur la sécurité du navigateur,V3.7.2,Vérifiez que l'application redirigera automatiquement l'utilisateur vers un nom d'hôte ou un domaine différent (qui n'est pas contrôlé par l'application) uniquement lorsque la destination apparaît sur une liste d'autorisation.,2 +V3,Sécurité du frontend Web,V3.7,Autres considérations sur la sécurité du navigateur,V3.7.3,"Vérifiez que le domaine de premier niveau de l'application (par exemple, site.tld) ​​est ajouté à la liste de préchargement publique pour HTTP Strict Transport Security (HSTS). Cela garantit que l'utilisation de TLS pour l'application est intégrée directement dans les principaux navigateurs, plutôt que de dépendre uniquement du champ d'en-tête de réponse Strict-Transport-Security.",3 +V3,Sécurité du frontend Web,V3.7,Autres considérations sur la sécurité du navigateur,V3.7.4,"Vérifiez que l'application affiche une notification lorsque l'utilisateur est redirigé vers une URL hors du contrôle de l'application, avec une option pour annuler la navigation.",3 +V3,Sécurité du frontend Web,V3.7,Autres considérations sur la sécurité du navigateur,V3.7.5,"Vérifiez que l'application se comporte comme documenté (par exemple, en avertissant l'utilisateur ou en bloquant l'accès) si le navigateur utilisé pour accéder à l'application ne prend pas en charge les fonctionnalités de sécurité attendues.",3 +V4,API et service Web,V4.1,Sécurité du service Web générique,V4.1.1,"Vérifiez que chaque réponse HTTP avec un corps de message contient un champ d'en-tête Content-Type qui correspond au contenu réel de la réponse, y compris le paramètre charset pour spécifier un codage de caractères sécurisé (par exemple, UTF-8, ISO-8859-1) conformément aux types de médias IANA, tels que « text/ », « /+xml » et « /xml ».",1 +V4,API et service Web,V4.1,Sécurité du service Web générique,V4.1.2,"Vérifiez que seuls les terminaux utilisateurs (destinés à l'accès manuel via un navigateur web) redirigent automatiquement de HTTP vers HTTPS, tandis que les autres services ou terminaux n'implémentent pas de redirections transparentes. Cela permet d'éviter qu'un client envoie par erreur des requêtes HTTP non chiffrées, mais que, comme ces requêtes sont automatiquement redirigées vers HTTPS, la fuite de données sensibles passe inaperçue.",2 +V4,API et service Web,V4.1,Sécurité du service Web générique,V4.1.3,"Vérifiez que tout champ d'en-tête HTTP utilisé par l'application et défini par une couche intermédiaire, telle qu'un équilibreur de charge, un proxy web ou un service backend-for-frontend, ne peut pas être remplacé par l'utilisateur final. Les exemples d'en-têtes peuvent inclure X-Real-IP, X-Forwarded-*, ou X-User-ID.",2 +V4,API et service Web,V4.1,Sécurité du service Web générique,V4.1.4,Vérifiez que seules les méthodes HTTP explicitement prises en charge par l'application ou son API (y compris les OPTIONS lors des demandes de contrôle en amont) peuvent être utilisées et que les méthodes inutilisées sont bloquées.,3 +V4,API et service Web,V4.1,Sécurité du service Web générique,V4.1.5,Vérifier que les signatures numériques par message sont utilisées pour fournir une assurance supplémentaire en plus des protections de transport pour les demandes ou les transactions qui sont très sensibles ou qui traversent un certain nombre de systèmes.,3 +V4,API et service Web,V4.2,Validation de la structure des messages HTTP,V4.2.1,"Vérifiez que tous les composants de l'application (y compris les équilibreurs de charge, les pares-feux et les serveurs d'applications) déterminent les limites des messages HTTP entrants à l'aide du mécanisme approprié à la version HTTP afin d'empêcher la contrebande de requêtes HTTP. Dans HTTP/1.x, si un champ d'en-tête Transfer-Encoding est présent, l'en-tête Content-Length doit être ignoré conformément à la RFC 2616. Avec HTTP/2 ou HTTP/3, si un champ d'en-tête Content-Length est présent, le récepteur doit s'assurer qu'il est cohérent avec la longueur des trames DATA.",2 +V4,API et service Web,V4.2,Validation de la structure des messages HTTP,V4.2.2,"Vérifier que, lors de la génération de messages HTTP, le champ d'en-tête Content-Length n'entre pas en conflit avec la longueur du contenu déterminée par le cadrage du protocole HTTP, afin d'empêcher les attaques de type « request smuggling ».",3 +V4,API et service Web,V4.2,Validation de la structure des messages HTTP,V4.2.3,"Vérifiez que l'application n'envoie ni n'accepte de messages HTTP/2 ou HTTP/3 avec des champs d'en-tête spécifiques à la connexion, tels que Transfer-Encoding, afin d'éviter les attaques par fractionnement de la réponse et par injection d'en-tête.",3 +V4,API et service Web,V4.2,Validation de la structure des messages HTTP,V4.2.4,"Vérifiez que l'application n'accepte que les requêtes HTTP/2 et HTTP/3 dont les champs et valeurs d'en-tête ne contiennent pas de séquences CR (\r), LF (\n) ou CRLF (\r\n), afin d'éviter les attaques par injection d'en-tête.",3 +V4,API et service Web,V4.2,Validation de la structure des messages HTTP,V4.2.5,"Vérifiez que, si l'application (backend ou frontend) construit et envoie des requêtes, elle utilise des mécanismes de validation, d'assainissement ou autres pour éviter de créer des URI (comme pour les appels API) ou des champs d'en-tête de requête HTTP (comme Authorization ou Cookie) qui sont trop longs pour être acceptés par le composant récepteur. Cela pourrait entraîner un déni de service, par exemple lors de l'envoi d'une requête trop longue (par exemple, un long champ d'en-tête de cookie), ce qui fait que le serveur répond toujours avec un statut d'erreur.",3 +V4,API et service Web,V4.3,GraphQL,V4.3.1,"Vérifiez qu'une liste d'autorisation de requête, une limitation de profondeur, une limitation de quantité ou une analyse des coûts de requête est utilisée pour empêcher le déni de service (DoS) de GraphQL ou d'expression de la couche données en raison de requêtes imbriquées coûteuses.",2 +V4,API et service Web,V4.3,GraphQL,V4.3.2,"Vérifiez que les requêtes d’introspection GraphQL sont désactivées dans l’environnement de production, sauf si l’API GraphQL est destinée à être utilisée par d’autres parties.",2 +V4,API et service Web,V4.4,WebSocket,V4.4.1,Vérifiez que WebSocket sur TLS (WSS) est utilisé pour toutes les connexions WebSocket.,1 +V4,API et service Web,V4.4,WebSocket,V4.4.2,"Vérifiez que, lors de la négociation HTTP WebSocket initiale, le champ d’en-tête 'Origin' est vérifié par rapport à une liste d’origines autorisées pour l’application.",2 +V4,API et service Web,V4.4,WebSocket,V4.4.3,"Vérifiez que, si la gestion de session standard de l'application ne peut pas être utilisée, des jetons dédiés sont utilisés à cet effet, qui sont conformes aux exigences de sécurité de gestion de session pertinentes.",2 +V4,API et service Web,V4.4,WebSocket,V4.4.4,Vérifiez que les jetons de gestion de session WebSocket dédiés sont initialement obtenus ou validés via la session HTTPS précédemment authentifiée lors de la transition d'une session HTTPS existante vers un canal WebSocket.,2 +V5,Gestion des fichiers,V5.1,Documentation sur la gestion des fichiers,V5.1.1,"Vérifiez que la documentation définit les types de fichiers autorisés, les extensions de fichiers attendues et la taille maximale (y compris la taille décompressée) pour chaque fonctionnalité de Téléversement. De plus, assurez-vous que la documentation précise comment les fichiers sont sécurisés pour le téléchargement et le traitement des utilisateurs finaux, par exemple le comportement de l'application lorsqu'un fichier malveillant est détecté.",2 +V5,Gestion des fichiers,V5.2,Téléversement de fichiers et contenu,V5.2.1,Vérifiez que l'application n'acceptera que des fichiers d'une taille qu'elle peut traiter sans provoquer de perte de performances ou d'attaque par déni de service.,1 +V5,Gestion des fichiers,V5.2,Téléversement de fichiers et contenu,V5.2.2,"Vérifiez que lorsque l'application accepte un fichier, seul ou dans une archive telle qu'un fichier zip, elle vérifie si l'extension de fichier correspond à une extension attendue et que le contenu correspond au type représenté par l'extension. Cela inclut, sans s'y limiter, la vérification des « octets magiques » initiaux, la réécriture d'images et l'utilisation de bibliothèques spécialisées pour la validation du contenu des fichiers. Pour le niveau L1, cela peut se concentrer uniquement sur les fichiers utilisés pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau L2, cela doit s'appliquer à tous les fichiers acceptés.",1 +V5,Gestion des fichiers,V5.2,Téléversement de fichiers et contenu,V5.2.3,"Vérifiez que l'application vérifie les fichiers compressés (par exemple, zip, gz, docx, odt) par rapport à la taille maximale autorisée non compressée et au nombre maximal de fichiers avant de décompresser le fichier.",2 +V5,Gestion des fichiers,V5.2,Téléversement de fichiers et contenu,V5.2.4,Vérifiez qu'un quota de taille de fichier et un nombre maximal de fichiers par utilisateur sont appliqués pour garantir qu'un seul utilisateur ne puisse pas remplir le stockage avec trop de fichiers ou des fichiers excessivement volumineux.,3 +V5,Gestion des fichiers,V5.2,Téléversement de fichiers et contenu,V5.2.5,"Vérifiez que l'application n'autorise pas le téléversement de fichiers compressés contenant des liens symboliques, sauf si cela est spécifiquement requis (auquel cas il sera nécessaire d'appliquer une liste d'autorisation des fichiers vers lesquels il est possible de créer des liens symboliques).",3 +V5,Gestion des fichiers,V5.2,Téléversement de fichiers et contenu,V5.2.6,"Vérifiez que l'application rejette les images téléversées avec une taille de pixel supérieure au maximum autorisé, afin d'éviter les attaques par inondation de pixels.",3 +V5,Gestion des fichiers,V5.3,Stockage de fichiers,V5.3.1,Vérifiez que les fichiers téléversés ou générés par une entrée non fiable et stockés dans un dossier public ne sont pas exécutés en tant que code de programme côté serveur lorsqu'ils sont accessibles directement avec une requête HTTP.,1 +V5,Gestion des fichiers,V5.3,Stockage de fichiers,V5.3.2,"Vérifiez que lorsque l'application crée des chemins d'accès pour les opérations sur les fichiers, elle utilise des données générées en interne ou fiables plutôt que des noms de fichiers soumis par l'utilisateur. Si des noms de fichiers ou des métadonnées de fichiers soumis par l'utilisateur doivent être utilisés, une validation et un nettoyage stricts doivent être appliqués. Ceci permet de se protéger contre les attaques par traversée de chemin, l'inclusion de fichiers locaux ou distants (LFI, RFI) et la falsification de requêtes côté serveur (SSRF).",1 +V5,Gestion des fichiers,V5.3,Stockage de fichiers,V5.3.3,"Vérifiez que le traitement des fichiers côté serveur, comme la décompression des fichiers, ignore les informations de chemin fournies par l'utilisateur pour éviter les vulnérabilités telles que le ""zip slip"".",3 +V5,Gestion des fichiers,V5.4,Téléchargement de fichier,V5.4.1,"Vérifiez que l’application valide ou ignore les noms de fichiers soumis par l’utilisateur, y compris dans un paramètre JSON, JSONP ou URL et spécifie un nom de fichier dans le champ d’en-tête Content-Disposition de la réponse.",2 +V5,Gestion des fichiers,V5.4,Téléchargement de fichier,V5.4.2,"Vérifiez que les noms de fichiers servis (par exemple, dans les champs d'en-tête de réponse HTTP ou les pièces jointes aux e-mails) sont encodés ou nettoyés (par exemple, conformément à la RFC 6266) pour préserver la structure du document et empêcher les attaques par injection.",2 +V5,Gestion des fichiers,V5.4,Téléchargement de fichier,V5.4.3,Vérifiez que les fichiers obtenus à partir de sources non fiables sont analysés par des scanners antivirus pour empêcher la diffusion de contenu malveillant connu.,2 +V6,Authentification,V6.1,Documentation d'authentification,V6.1.1,"Vérifiez que la documentation de l'application définit comment les contrôles, tels que la limitation de débit, l'anti-automatisation et la réponse adaptative, sont utilisés pour se défendre contre les attaques telles que le « credential stuffing » et la force brute des mots de passe. La documentation doit expliquer clairement comment ces contrôles sont configurés et empêcher le blocage malveillant des comptes.",1 +V6,Authentification,V6.1,Documentation d'authentification,V6.1.2,"Vérifiez qu'une liste de mots spécifiques au contexte est documentée afin d'empêcher leur utilisation dans les mots de passe. Cette liste peut inclure des permutations de noms d'organisations, de produits, d'identifiants de systèmes, de noms de codes de projets, de noms de services ou de rôles, etc.",2 +V6,Authentification,V6.1,Documentation d'authentification,V6.1.3,"Vérifiez que, si l'application inclut plusieurs voies d'authentification, celles-ci sont toutes documentées avec les contrôles de sécurité et la force d'authentification qui doivent être appliqués de manière cohérente.",2 +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.1,"Vérifiez que les mots de passe définis par l'utilisateur comportent au moins 8 caractères, bien qu'un minimum de 15 caractères soit fortement recommandé.",1 +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.2,Vérifiez que les utilisateurs peuvent modifier leur mot de passe.,1 +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.3,Vérifiez que la fonctionnalité de changement de mot de passe nécessite le mot de passe actuel et le nouveau mot de passe de l'utilisateur.,1 +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.4,"Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou du changement de mot de passe sont vérifiés par rapport à un ensemble disponible d'au moins 3 000 mots de passe principaux qui correspondent à la politique de mot de passe de l'application, par exemple la longueur minimale.",1 +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.5,"Vérifiez que les mots de passe peuvent être utilisés, quelle que soit leur composition, sans restriction quant au type de caractères autorisés. Aucun nombre minimal de majuscules ou de minuscules, de chiffres ou de caractères spéciaux ne doit être exigé.",1 +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.6,Vérifiez que les champs de saisie du mot de passe utilisent type=password pour masquer la saisie. Les applications peuvent permettre à l'utilisateur d'afficher temporairement l'intégralité du mot de passe masqué ou le dernier caractère saisi.,1 +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.7,"Vérifiez que la fonctionnalité « coller », les assistants de mot de passe du navigateur et les gestionnaires de mots de passe externes sont autorisés.",1 +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.8,"Vérifiez que l'application vérifie le mot de passe de l'utilisateur exactement tel qu'il a été reçu de l'utilisateur, sans aucune modification telle qu'une troncature ou une transformation de casse.",1 +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.9,Vérifiez que les mots de passe d’au moins 64 caractères sont autorisés.,2 +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.10,Vérifiez que le mot de passe d'un utilisateur reste valide jusqu'à ce qu'il soit découvert comme compromis ou qu'il soit renouvelé. L'application ne doit pas exiger de renouvellement périodique des identifiants.,2 +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.11,Vérifiez que la liste documentée de mots spécifiques au contexte est utilisée pour éviter la création de mots de passe faciles à deviner.,2 +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.12,Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou des modifications de mot de passe sont vérifiés par rapport à un ensemble de mots de passe fuités.,2 +V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.1,Vérifiez que les contrôles visant à empêcher les attaques telles que le bourrage d'informations d'identification et la force brute des mots de passe sont mis en œuvre conformément à la documentation de sécurité de l'application.,1 +V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.2,"Vérifiez que les comptes d’utilisateur par défaut (par exemple, « root », « admin » ou « sa ») ne sont pas présents dans l’application ou sont désactivés.",1 +V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.3,Vérifiez que l’application exige que les utilisateurs utilisent un mécanisme d’authentification multifacteur ou une combinaison de mécanismes d’authentification à facteur unique.,2 +V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.4,"Vérifiez que, si l’application inclut plusieurs voies d’authentification, il n’existe aucune voie non documentée et que les contrôles de sécurité et la force d’authentification sont appliqués de manière cohérente.",2 +V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.5,"Vérifiez que les utilisateurs sont informés des tentatives d'authentification suspectes (réussies ou non). Il peut s'agir de tentatives d'authentification provenant d'un emplacement ou d'un client inhabituel, d'une authentification partiellement réussie (un seul facteur parmi plusieurs), d'une tentative d'authentification après une longue période d'inactivité ou d'une authentification réussie après plusieurs tentatives infructueuses.",3 +V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.6,Vérifiez que le courrier électronique n’est pas utilisé comme mécanisme d’authentification à facteur unique ou à facteurs multiples.,3 +V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.7,"Vérifiez que les utilisateurs sont avertis après les mises à jour des détails d'authentification, telles que les réinitialisations d'informations d'identification ou la modification du nom d'utilisateur ou de l'adresse e-mail.",3 +V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.8,"Vérifiez que les utilisateurs valides ne peuvent pas être déduits d'échecs d'authentification, par exemple en se basant sur des messages d'erreur, des codes de réponse HTTP ou des temps de réponse différents. Les fonctionnalités d'inscription et de mot de passe oublié doivent également bénéficier de cette protection.",3 +V6,Authentification,V6.4,Cycle de vie et récupération du facteur d'authentification,V6.4.1,"Vérifiez que les mots de passe initiaux ou les codes d'activation générés par le système sont générés de manière aléatoire et sécurisée, qu'ils respectent la politique de mots de passe en vigueur et qu'ils expirent après une courte période ou après leur première utilisation. Ces secrets initiaux ne doivent pas devenir des mots de passe permanents.",1 +V6,Authentification,V6.4,Cycle de vie et récupération du facteur d'authentification,V6.4.2,Vérifiez que les indices de mot de passe ou l'authentification basée sur les connaissances (appelées « questions secrètes ») ne sont pas présents.,1 +V6,Authentification,V6.4,Cycle de vie et récupération du facteur d'authentification,V6.4.3,"Vérifiez qu'un processus sécurisé de réinitialisation d'un mot de passe oublié est mis en œuvre, qui ne contourne aucun mécanisme d'authentification multifacteur activé.",2 +V6,Authentification,V6.4,Cycle de vie et récupération du facteur d'authentification,V6.4.4,"Vérifiez que si un facteur d'authentification multifacteur est perdu, la preuve de vérification d'identité est effectuée au même niveau que lors de l'inscription.",2 +V6,Authentification,V6.4,Cycle de vie et récupération du facteur d'authentification,V6.4.5,"Vérifiez que les instructions de renouvellement des mécanismes d'authentification qui expirent sont envoyées avec suffisamment de temps pour être exécutées avant l'expiration de l'ancien mécanisme d'authentification, en configurant des rappels automatiques si nécessaire.",3 +V6,Authentification,V6.4,Cycle de vie et récupération du facteur d'authentification,V6.4.6,"Vérifiez que les administrateurs peuvent initier la réinitialisation du mot de passe de l'utilisateur, mais que cela ne leur permet pas de modifier ou de choisir son mot de passe. Cela évite qu'ils ne connaissent le mot de passe de l'utilisateur.",3 +V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.1,"Vérifiez que les secrets de recherche, les demandes ou codes d'authentification out-of-band et les mots de passe à usage unique basés sur le temps (TOTP) ne peuvent être utilisés avec succès qu'une seule fois.",2 +V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.2,"Vérifiez que, lors de leur stockage dans le backend de l'application, les secrets de recherche comportant moins de 112 bits d'entropie (19 caractères alphanumériques aléatoires ou 34 chiffres aléatoires) sont hachés avec un algorithme de hachage de stockage de mots de passe approuvé, intégrant un sel aléatoire de 32 bits. Une fonction de hachage standard peut être utilisée si le secret comporte 112 bits d'entropie ou plus.",2 +V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.3,"Vérifiez que les secrets de recherche, le code d'authentification out-of-band et les mots de passe à usage unique basés sur le temps sont générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) pour éviter les valeurs prévisibles.",2 +V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.4,Vérifiez que les secrets de recherche et les codes d'authentification out-of-band ont un minimum de 20 bits d'entropie (généralement 4 caractères alphanumériques aléatoires ou 6 chiffres aléatoires suffisent).,2 +V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.5,"Vérifiez que les requêtes, codes ou jetons d'authentification out-of-band, ainsi que les mots de passe à usage unique (TOTP), ont une durée de vie définie. Les requêtes out-of-band doivent avoir une durée de vie maximale de 10 minutes et les TOTP, de 30 secondes.",2 +V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.6,Vérifiez que tout facteur d’authentification (y compris les appareils physiques) peut être révoqué en cas de vol ou autre perte.,3 +V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.7,"Vérifiez que les mécanismes d’authentification biométrique ne sont utilisés que comme facteurs secondaires, avec quelque chose que vous possédez ou quelque chose que vous savez.",3 +V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.8,Vérifiez que les mots de passe à usage unique basés sur le temps (TOTP) sont vérifiés en fonction d'une source temporelle provenant d'un service de confiance et non d'une heure non fiable ou fournie par le client.,3 +V6,Authentification,V6.6,Mécanismes d'authentification out-of-band,V6.6.1,"Vérifier que les mécanismes d'authentification utilisant le réseau téléphonique public commuté (RTPC) pour la transmission de mots de passe à usage unique (OTP) par téléphone ou SMS ne sont proposés que lorsque le numéro de téléphone a été préalablement validé. D'autres méthodes plus robustes (telles que les mots de passe à usage unique à durée déterminée) sont également proposées, et que le service informe les utilisateurs des risques de sécurité qu'elles présentent. Pour les applications de niveau 3, le téléphone et les SMS ne doivent pas être disponibles.",2 +V6,Authentification,V6.6,Mécanismes d'authentification out-of-band,V6.6.2,"Vérifiez que les demandes d’authentification out-of-band, les codes ou les jetons sont liés à la demande d’authentification d’origine pour laquelle ils ont été générés et ne sont pas utilisables pour une demande précédente ou ultérieure.",2 +V6,Authentification,V6.6,Mécanismes d'authentification out-of-band,V6.6.3,"Vérifiez qu'un mécanisme d'authentification out-of-band basé sur du code est protégé contre les attaques par force brute grâce au ""rate limiting"". Envisagez également d'utiliser un code avec au moins 64 bits d'entropie.",2 +V6,Authentification,V6.6,Mécanismes d'authentification out-of-band,V6.6.4,"Vérifiez que, lorsque les notifications push sont utilisées pour l'authentification multifacteur, le ""rate limiting"" est appliqué afin d'empêcher les attaques de type « push bombing ». La concordance des numéros peut également atténuer ce risque.",3 +V6,Authentification,V6.7,Mécanisme d'authentification cryptographique,V6.7.1,Vérifiez que les certificats utilisés pour vérifier les assertions d’authentification cryptographique sont stockés de manière à les protéger contre toute modification.,3 +V6,Authentification,V6.7,Mécanisme d'authentification cryptographique,V6.7.2,Vérifiez que le nonce de défi a une longueur d'au moins 64 bits et qu'il est statistiquement unique ou unique sur toute la durée de vie du périphérique cryptographique.,3 +V6,Authentification,V6.8,Authentification avec un fournisseur d'identité,V6.8.1,"Vérifiez que, si l'application prend en charge plusieurs fournisseurs d'identité (IdP), l'identité de l'utilisateur ne peut pas être usurpée via un autre fournisseur d'identité pris en charge (par exemple, en utilisant le même identifiant utilisateur). La mesure standard consisterait à ce que l'application enregistre et identifie l'utilisateur à l'aide d'une combinaison de l'ID du fournisseur d'identité (servant d'espace de noms) et de l'ID de l'utilisateur dans le fournisseur d'identité.",2 +V6,Authentification,V6.8,Authentification avec un fournisseur d'identité,V6.8.2,"Vérifiez que la présence et l'intégrité des signatures numériques sur les assertions d'authentification (par exemple sur les assertions JWT ou SAML) sont toujours validées, en rejetant toutes les assertions non signées ou ayant des signatures non valides.",2 +V6,Authentification,V6.8,Authentification avec un fournisseur d'identité,V6.8.3,Vérifiez que les assertions SAML sont traitées de manière unique et utilisées une seule fois au cours de la période de validité pour éviter les attaques par rejeu.,2 +V6,Authentification,V6.8,Authentification avec un fournisseur d'identité,V6.8.4,"Si une application utilise un fournisseur d'identité (IdP) distinct et attend une force, des méthodes ou une date d'authentification spécifiques pour des fonctions spécifiques, vérifiez que l'application les vérifie à l'aide des informations renvoyées par l'IdP. Par exemple, si OIDC est utilisé, cela peut être réalisé en validant les affirmations de jeton d'identification telles que « acr », « amr » et « auth_time » (le cas échéant). Si l'IdP ne fournit pas ces informations, l'application doit disposer d'une approche de secours documentée qui suppose que le mécanisme d'authentification de force minimale a été utilisé (par exemple, une authentification à facteur unique avec nom d'utilisateur et mot de passe).",2 +V7,Gestion des sessions,V7.1,Documentation sur la gestion des sessions,V7.1.1,"Vérifiez que le délai d'inactivité de la session de l'utilisateur et la durée de vie maximale absolue de la session sont documentés, sont appropriés en combinaison avec d'autres contrôles et que la documentation inclut une justification de tout écart par rapport aux exigences de réauthentification NIST SP 800-63B.",2 +V7,Gestion des sessions,V7.1,Documentation sur la gestion des sessions,V7.1.2,Vérifiez que la documentation définit le nombre de sessions simultanées (parallèles) autorisées pour un compte ainsi que les comportements et actions prévus à entreprendre lorsque le nombre maximal de sessions actives est atteint.,2 +V7,Gestion des sessions,V7.1,Documentation sur la gestion des sessions,V7.1.3,"Vérifiez que tous les systèmes qui créent et gèrent des sessions utilisateur dans le cadre d'un écosystème de gestion des identités fédérées (tels que les systèmes SSO) sont documentés avec des contrôles pour coordonner la durée de vie des sessions, la résiliation et toute autre condition nécessitant une réauthentification.",2 +V7,Gestion des sessions,V7.2,Sécurité fondamentale de la gestion des sessions,V7.2.1,Vérifiez que l’application effectue toutes les vérifications des jetons de session à l’aide d’un service backend de confiance.,1 +V7,Gestion des sessions,V7.2,Sécurité fondamentale de la gestion des sessions,V7.2.2,"Vérifiez que l'application utilise des jetons autonomes ou de référence générés dynamiquement pour la gestion des sessions, c'est-à-dire sans utiliser de secrets et de clés d'API statiques.",1 +V7,Gestion des sessions,V7.2,Sécurité fondamentale de la gestion des sessions,V7.2.3,"Vérifiez que si des jetons par référence sont utilisés pour représenter les sessions utilisateur, ils sont uniques et générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et possèdent au moins 128 bits d'entropie.",1 +V7,Gestion des sessions,V7.2,Sécurité fondamentale de la gestion des sessions,V7.2.4,"Vérifiez que l’application génère un nouveau jeton de session lors de l’authentification de l’utilisateur, y compris la réauthentification, et met fin au jeton de session actuel.",1 +V7,Gestion des sessions,V7.3,Délai d'expiration de la session,V7.3.1,Vérifiez qu’il existe un délai d’inactivité tel que la réauthentification soit appliquée conformément à l’analyse des risques et aux décisions de sécurité documentées.,2 +V7,Gestion des sessions,V7.3,Délai d'expiration de la session,V7.3.2,Vérifiez qu'il existe une durée de vie maximale absolue de la session de sorte que la réauthentification soit appliquée conformément à l'analyse des risques et aux décisions de sécurité documentées.,2 +V7,Gestion des sessions,V7.4,Fin de session,V7.4.1,"Vérifiez que lorsque la fin de session est déclenchée (par exemple, déconnexion ou expiration), l'application interdit toute utilisation ultérieure de la session. Pour les jetons par référence ou les sessions avec état, cela implique l'invalidation des données de session au niveau du backend de l'application. Les applications utilisant des jetons autonomes nécessiteront une solution, comme la gestion d'une liste des jetons terminés, l'interdiction des jetons produits avant une date et une heure spécifique à chaque utilisateur ou la rotation d'une clé de signature spécifique à chaque utilisateur.",1 +V7,Gestion des sessions,V7.4,Fin de session,V7.4.2,"Vérifiez que l'application met fin à toutes les sessions actives lorsqu'un compte utilisateur est désactivé ou supprimé (par exemple, lorsqu'un employé quitte l'entreprise).",1 +V7,Gestion des sessions,V7.4,Fin de session,V7.4.3,"Vérifiez que l'application offre la possibilité de mettre fin à toutes les autres sessions actives après une modification ou une suppression réussie de tout facteur d'authentification (y compris la modification du mot de passe via une réinitialisation ou une récupération et, le cas échéant, une mise à jour des paramètres MFA).",2 +V7,Gestion des sessions,V7.4,Fin de session,V7.4.4,Vérifiez que toutes les pages nécessitant une authentification disposent d’un accès facile et visible à la fonctionnalité de déconnexion.,2 +V7,Gestion des sessions,V7.4,Fin de session,V7.4.5,Vérifiez que les administrateurs d’applications sont en mesure de mettre fin aux sessions actives pour un utilisateur individuel ou pour tous les utilisateurs.,2 +V7,Gestion des sessions,V7.5,Défenses contre les abus de session,V7.5.1,"Vérifiez que l'application nécessite une réauthentification complète avant d'autoriser les modifications des attributs de compte sensibles qui peuvent affecter l'authentification, tels que l'adresse e-mail, le numéro de téléphone, la configuration MFA ou d'autres informations utilisées dans la récupération de compte.",2 +V7,Gestion des sessions,V7.5,Défenses contre les abus de session,V7.5.2,Vérifiez que les utilisateurs peuvent afficher et (après s'être authentifiés à nouveau avec au moins un facteur) terminer une ou toutes les sessions actuellement actives.,2 +V7,Gestion des sessions,V7.5,Défenses contre les abus de session,V7.5.3,Vérifiez que l’application nécessite une authentification supplémentaire avec au moins un facteur ou une vérification secondaire avant d’effectuer des transactions ou des opérations hautement sensibles.,3 +V7,Gestion des sessions,V7.6,Réauthentification fédérée,V7.6.1,"Vérifiez que la durée de vie et la fin de la session entre les parties de confiance (RP) et les fournisseurs d'identité (IdP) se comportent comme documenté, en exigeant une réauthentification si nécessaire, par exemple lorsque le temps maximal entre les événements d'authentification IdP est atteint.",2 +V7,Gestion des sessions,V7.6,Réauthentification fédérée,V7.6.2,"Vérifiez que la création d'une session nécessite soit le consentement de l'utilisateur, soit une action explicite, empêchant ainsi la création de nouvelles sessions d'application sans interaction de l'utilisateur.",2 +V8,Autorisation,V8.1,Documentation d'autorisation,V8.1.1,Vérifiez que la documentation d’autorisation définit des règles de restriction de l’accès au niveau de la fonction et aux données en fonction des autorisations du consommateur et des attributs des ressources.,1 +V8,Autorisation,V8.1,Documentation d'autorisation,V8.1.2,"Vérifiez que la documentation d'autorisation définit les règles de restriction d'accès au niveau des champs (lecture et écriture) en fonction des autorisations des consommateurs et des attributs des ressources. Notez que ces règles peuvent dépendre d'autres valeurs d'attributs de l'objet de données concerné, telles que l'état ou le statut.",2 +V8,Autorisation,V8.1,Documentation d'autorisation,V8.1.3,"Vérifiez que la documentation de l'application définit les attributs environnementaux et contextuels (y compris, mais sans s'y limiter, l'heure de la journée, l'emplacement de l'utilisateur, l'adresse IP ou l'appareil) qui sont utilisés dans l'application pour prendre des décisions de sécurité, y compris celles relatives à l'authentification et à l'autorisation.",3 +V8,Autorisation,V8.1,Documentation d'autorisation,V8.1.4,"Vérifier que la documentation d'authentification et d'autorisation définit l'utilisation des facteurs environnementaux et contextuels dans la prise de décision, en plus des autorisations au niveau des fonctions, des données et des champs. Cela doit inclure les attributs évalués, les seuils de risque et les actions entreprises (par exemple, autorisation, contestation, refus, renforcement de l'authentification).",3 +V8,Autorisation,V8.2,Conception d'autorisation générale,V8.2.1,Vérifiez que l’application garantit que l’accès basé sur la fonction est limité aux consommateurs disposant d’autorisations explicites.,1 +V8,Autorisation,V8.2,Conception d'autorisation générale,V8.2.2,Vérifiez que l'application garantit que l'accès spécifique aux données est limité aux consommateurs disposant d'autorisations explicites sur des éléments de données spécifiques afin d'atténuer les références d'objet directes non sécurisées (IDOR) et les autorisations de niveau d'objet rompues (BOLA).,1 +V8,Autorisation,V8.2,Conception d'autorisation générale,V8.2.3,Vérifiez que l'application garantit que l'accès au niveau du champ est limité aux consommateurs disposant d'autorisations explicites sur des champs spécifiques afin d'atténuer les problèmes d'autorisation au niveau de la propriété d'objet (BOPLA).,2 +V8,Autorisation,V8.2,Conception d'autorisation générale,V8.2.4,"Vérifiez que les contrôles de sécurité adaptatifs basés sur les attributs environnementaux et contextuels du consommateur (tels que l'heure, la localisation, l'adresse IP ou l'appareil) sont mis en œuvre pour les décisions d'authentification et d'autorisation, comme défini dans la documentation de l'application. Ces contrôles doivent être appliqués lorsque le consommateur tente de démarrer une nouvelle session et également pendant une session existante.",3 +V8,Autorisation,V8.3,Autorisation par opération,V8.3.1,"Vérifier que l'application applique les règles d'autorisations au niveau de la couche service de confiance et ne s’appuie pas sur des contrôles qu’un consommateur non approuvé pourrait manipuler, comme JavaScript côté client.",1 +V8,Autorisation,V8.3,Autorisation par opération,V8.3.2,"Vérifiez que les modifications apportées aux valeurs sur lesquelles reposent les décisions d'autorisation sont appliquées immédiatement. Lorsque les modifications ne peuvent pas être appliquées immédiatement (par exemple, en s'appuyant sur des données de jetons autonomes), des contrôles d'atténuation doivent être mis en place pour alerter un consommateur lorsqu'il effectue une action alors qu'il n'est plus autorisé à le faire et annuler la modification. Notez que cette solution alternative ne limiterait pas les fuites d'informations.",3 +V8,Autorisation,V8.3,Autorisation par opération,V8.3.3,"Vérifiez que l'accès à un objet repose sur les autorisations du sujet d'origine (par exemple, le consommateur), et non sur celles d'un intermédiaire ou d'un service agissant en son nom. Par exemple, si un consommateur appelle un service web à l'aide d'un jeton d'authentification autonome, et que ce service demande ensuite des données à un autre service, ce dernier utilisera le jeton du consommateur, plutôt qu'un jeton inter-machine du premier service, pour prendre les décisions d'autorisation.",3 +V8,Autorisation,V8.4,Autres considérations relatives à l'autorisation,V8.4.1,Vérifiez que les applications multi-tenants utilisent des contrôles inter-tenants pour garantir que les opérations des consommateurs n'affecteront jamais les tenants avec lesquels ils ne sont pas autorisés à interagir.,2 +V8,Autorisation,V8.4,Autres considérations relatives à l'autorisation,V8.4.2,"Vérifiez que l'accès aux interfaces administratives intègre plusieurs couches de sécurité, notamment la vérification continue de l'identité du consommateur, l'évaluation de la posture de sécurité des appareils et l'analyse contextuelle des risques, garantissant que l'emplacement du réseau ou les endpoints approuvés ne sont pas les seuls facteurs d'autorisation, même s'ils peuvent réduire la probabilité d'accès non autorisé.",3 +V9,Jetons autonomes,V9.1,Source et intégrité du jeton,V9.1.1,Vérifiez que les jetons autonomes sont validés à l'aide de leur signature numérique ou MAC pour les protéger contre toute falsification avant d'accepter le contenu du jeton.,1 +V9,Jetons autonomes,V9.1,Source et intégrité du jeton,V9.1.2,"Vérifiez que seuls les algorithmes d'une liste d’autorisations peuvent être utilisés pour créer et vérifier des jetons autonomes, dans un contexte donné. La liste d'autorisation doit inclure les algorithmes autorisés, idéalement symétriques ou asymétriques, et ne doit pas inclure l'algorithme « Aucun ». Si les algorithmes symétriques et asymétriques doivent être pris en charge, des contrôles supplémentaires seront nécessaires pour éviter toute confusion de clés.",1 +V9,Jetons autonomes,V9.1,Source et intégrité du jeton,V9.1.3,"Vérifiez que les clés utilisées pour valider les jetons autonomes proviennent de sources préconfigurées et fiables pour l'émetteur du jeton, empêchant ainsi les attaquants de spécifier des sources et des clés non fiables. Pour les JWT et autres structures JWS, les en-têtes tels que « jku », « x5u » et « jwk » doivent être validés par rapport à une liste d'autorisation de sources fiables.",1 +V9,Jetons autonomes,V9.2,Contenu du jeton,V9.2.1,"Vérifiez que, si une période de validité est indiquée dans les données du jeton, celui-ci et son contenu ne sont acceptés que si la date de vérification est comprise dans cette période. Par exemple, pour les JWT, les déclarations « nbf » et « exp » doivent être vérifiées.",1 +V9,Jetons autonomes,V9.2,Contenu du jeton,V9.2.2,"Vérifiez que le service recevant un jeton valide le type de jeton et son utilisation avant d'en accepter le contenu. Par exemple, seuls les jetons d'accès peuvent être acceptés pour les décisions d'autorisation, et seuls les jetons d'identification peuvent être utilisés pour prouver l'authentification des utilisateurs.",2 +V9,Jetons autonomes,V9.2,Contenu du jeton,V9.2.3,"Vérifiez que le service accepte uniquement les jetons destinés à être utilisés avec ce service (audience). Pour les JWT, cela peut être réalisé en validant la déclaration « aud » par rapport à une liste d'autorisation définie dans le service.",2 +V9,Jetons autonomes,V9.2,Contenu du jeton,V9.2.4,"Si un émetteur de jetons utilise la même clé privée pour émettre des jetons destinés à différentes audiences, vérifiez que les jetons émis contiennent une restriction d'audience identifiant de manière unique les audiences visées. Cela empêchera la réutilisation d'un jeton avec une audience non prévue. Si l'identifiant d'audience est provisionné dynamiquement, l'émetteur de jetons doit valider ces audiences afin de garantir qu'elles n'entraînent pas d'usurpation d'identité.",2 +V10,Oauth et OIDC,V10.1,Sécurité générique OAuth et OIDC,V10.1.1,"Vérifiez que les jetons sont envoyés uniquement aux composants qui en ont absolument besoin. Par exemple, lors de l'utilisation d'un modèle backend-for-frontend pour les applications JavaScript basées sur un navigateur, les jetons d'accès et d'actualisation ne doivent être accessibles qu'au backend.",2 +V10,Oauth et OIDC,V10.1,Sécurité générique OAuth et OIDC,V10.1.2,"Vérifiez que le client n'accepte les valeurs du serveur d'autorisation (telles que le code d'autorisation ou le jeton d'identification) que si elles résultent d'un flux d'autorisation initié par la même session d'agent utilisateur et la même transaction. Cela nécessite que les secrets générés par le client, tels que la clé de preuve pour l'échange de codes (PKCE) « code_verifier », « state » ou le nonce OIDC, ne puissent être devinés, soient spécifiques à la transaction et soient liés de manière sécurisée au client et à la session d'agent utilisateur au cours de laquelle la transaction a été initiée.",2 +V10,Oauth et OIDC,V10.2,Client OAuth,V10.2.1,"Vérifiez que, si le flux de code est utilisé, le client OAuth dispose d'une protection contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF), qui déclenchent des demandes de jetons, soit en utilisant la fonctionnalité de clé de preuve pour l'échange de code (PKCE), soit en vérifiant le paramètre « state » envoyé dans la demande d'autorisation.",2 +V10,Oauth et OIDC,V10.2,Client OAuth,V10.2.2,"Vérifiez que, si le client OAuth peut interagir avec plusieurs serveurs d'autorisation, il dispose d'une protection contre les attaques par confusion. Par exemple, il peut exiger que le serveur d'autorisation renvoie la valeur du paramètre « iss » et la valide dans la réponse d'autorisation et la réponse du jeton.",2 +V10,Oauth et OIDC,V10.2,Client OAuth,V10.2.3,Vérifiez que le client OAuth demande uniquement les portées requises (ou d’autres paramètres d’autorisation) dans les requêtes adressées au serveur d’autorisation.,3 +V10,Oauth et OIDC,V10.3,Serveur de ressources OAuth,V10.3.1,Vérifiez que le serveur de ressources accepte uniquement les jetons d'accès destinés à être utilisés avec ce service (audience). L'audience peut être incluse dans un jeton d'accès structuré (comme la déclaration « aud » dans JWT) ou vérifiée à l'aide du endpoint d'introspection de jeton.,2 +V10,Oauth et OIDC,V10.3,Serveur de ressources OAuth,V10.3.2,"Vérifiez que le serveur de ressources applique les décisions d'autorisation en fonction des déclarations du jeton d'accès définissant l'autorisation déléguée. Si des déclarations telles que « sub », « scope » et « authorization_details » sont présentes, elles doivent être prises en compte dans la décision.",2 +V10,Oauth et OIDC,V10.3,Serveur de ressources OAuth,V10.3.3,"Vérifiez que si une décision de contrôle d'accès nécessite l'identification d'un utilisateur unique à partir d'un jeton d'accès (JWT ou réponse d'introspection de jeton associé), le serveur de ressources identifie l'utilisateur à partir de déclarations non ré attribuables à d'autres utilisateurs. En général, cela implique l'utilisation d'une combinaison de déclarations « iss » et « sub ».",2 +V10,Oauth et OIDC,V10.3,Serveur de ressources OAuth,V10.3.4,"Si le serveur de ressources requiert une force d'authentification, des méthodes ou une date d'expiration spécifiques, vérifiez que le jeton d'accès présenté respecte ces contraintes. Par exemple, s'il est présent, utilisez les déclarations OIDC « acr », « amr » et « auth_time » respectivement.",2 +V10,Oauth et OIDC,V10.3,Serveur de ressources OAuth,V10.3.5,"Vérifiez que le serveur de ressources empêche l'utilisation de jetons d'accès volés ou la relecture de jetons d'accès (de parties non autorisées) en exigeant des jetons d'accès limités par l'expéditeur, soit Mutual TLS pour OAuth 2, soit OAuth 2 Demonstration of Proof of Possession (DPoP).",3 +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.1,Vérifiez que le serveur d'autorisation valide les URI de redirection en fonction d'une liste d'autorisation spécifique au client d'URI préenregistrés à l'aide d'une comparaison de chaînes exacte.,1 +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.2,"Vérifiez que, si le serveur d'autorisation renvoie le code d'autorisation dans la réponse, celui-ci ne peut être utilisé qu'une seule fois pour une demande de jeton. Pour la deuxième demande valide avec un code d'autorisation déjà utilisé pour émettre un jeton d'accès, le serveur d'autorisation doit rejeter la demande de jeton et révoquer tous les jetons émis liés au code d'autorisation.",1 +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.3,Vérifiez que le code d'autorisation est de courte durée. La durée de vie maximale peut atteindre 10 minutes pour les applications L1 et L2 et 1 minute pour les applications L3.,1 +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.4,"Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement l'utilisation des autorisations nécessaires à ce client. Notez que les autorisations « token » (flux implicite) et « password » (flux d'informations d'identification du propriétaire de la ressource) ne doivent plus être utilisées.",1 +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.5,"Vérifiez que le serveur d'autorisation atténue les attaques par rejeu de jetons d'actualisation pour les clients publics, de préférence en utilisant des jetons d'actualisation limités par l'expéditeur, par exemple des jetons DPoP (Demonstrating Proof of Possession) ou des jetons d'accès liés à un certificat utilisant le protocole TLS mutuel (mTLS). Pour les applications L1 et L2, la rotation des jetons d'actualisation peut être utilisée. Si cette rotation est utilisée, le serveur d'autorisation doit invalider le jeton d'actualisation après utilisation et révoquer tous les jetons d'actualisation de cette autorisation si un jeton d'actualisation déjà utilisé et invalidé est fourni.",1 +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.6,"Vérifiez que, si l'octroi de code est utilisé, le serveur d'autorisation atténue les attaques par interception de code en exigeant une clé de preuve pour l'échange de code (PKCE). Pour les demandes d'autorisation, le serveur d'autorisation doit exiger une valeur « code_challenge » valide et ne doit pas accepter une valeur « plain » pour « code_challenge_method ». Pour une demande de jeton, il doit exiger la validation du paramètre « code_verifier ».",2 +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.7,"Vérifiez que si le serveur d'autorisation prend en charge l'enregistrement dynamique des clients non authentifiés, il réduit le risque d'applications clientes malveillantes. Il doit valider les métadonnées clientes, telles que les URI enregistrés, garantir le consentement de l'utilisateur et l'avertir avant de traiter une demande d'autorisation avec une application cliente non approuvée.",2 +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.8,"Vérifiez que les jetons d’actualisation ont une expiration absolue, y compris si l’expiration du jeton d’actualisation glissant est appliquée.",2 +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.9,"Vérifiez que les jetons d'actualisation et les jetons d'accès de référence peuvent être révoqués par un utilisateur autorisé à l'aide de l'interface utilisateur du serveur d'autorisation, afin d'atténuer le risque de clients malveillants ou de jetons volés.",2 +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.10,"Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.",2 +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.11,"Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.",2 +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.12,"Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement la valeur « response_mode » dont ce client a besoin. Par exemple, en vérifiant cette valeur par rapport aux valeurs attendues ou en utilisant une requête d'autorisation poussée (PAR) ou une requête d'autorisation sécurisée par JWT (JAR).",3 +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.13,Vérifiez que le type d'Autorisation « code » est toujours utilisé avec les demandes d'autorisation poussées (PAR).,3 +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.14,"Vérifiez que le serveur d'autorisation émet uniquement des jetons d'accès limités à l'expéditeur (preuve de possession), soit avec des jetons d'accès liés au certificat utilisant TLS mutuel (mTLS), soit avec des jetons d'accès liés au DPoP (démonstration de preuve de possession).",3 +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.15,"Vérifiez que, pour un client côté serveur (non exécuté sur l'appareil de l'utilisateur final), le serveur d'autorisation garantit que la valeur du paramètre « authorization_details » provient du backend client et que l'utilisateur ne l'a pas altérée. Par exemple, en exigeant l'utilisation d'une demande d'autorisation poussée (PAR) ou d'une demande d'autorisation sécurisée par JWT (JAR).",3 +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.16,"Vérifiez que le client est confidentiel et que le serveur d'autorisation requiert l'utilisation de méthodes d'authentification client fortes (basées sur la cryptographie à clé publique et résistantes aux attaques par relecture), telles que TLS mutuel ('tls_client_auth', 'self_signed_tls_client_auth') ou JWT à clé privée ('private_key_jwt').",3 +V10,Oauth et OIDC,V10.5,Client OIDC,V10.5.1,"Vérifiez que le client (en tant que partie utilisatrice) atténue les attaques par rejeu de jeton d'identification. Par exemple, en vous assurant que la valeur « nonce » du jeton d'identification correspond à la valeur « nonce » envoyée dans la demande d'authentification au fournisseur OpenID (appelée demande d'autorisation envoyée au serveur d'autorisation dans OAuth2).",2 +V10,Oauth et OIDC,V10.5,Client OIDC,V10.5.2,"Vérifiez que le client identifie de manière unique l'utilisateur à partir des déclarations de jeton d'identification, généralement la déclaration « sub », qui ne peut pas être réaffectée à d'autres utilisateurs (pour la portée d'un fournisseur d'identité).",2 +V10,Oauth et OIDC,V10.5,Client OIDC,V10.5.3,Vérifiez que le client rejette les tentatives d'un serveur d'autorisation malveillant d'usurper l'identité d'un autre serveur d'autorisation via ses métadonnées. Le client doit rejeter les métadonnées du serveur d'autorisation si l'URL de l'émetteur figurant dans ces métadonnées ne correspond pas exactement à l'URL d'émetteur préconfigurée attendue par le client.,2 +V10,Oauth et OIDC,V10.5,Client OIDC,V10.5.4,Vérifiez que le client valide que le jeton d'identification est destiné à être utilisé pour ce client (audience) en vérifiant que la déclaration « aud » du jeton est égale à la valeur « client_id » pour le client.,2 +V10,Oauth et OIDC,V10.5,Client OIDC,V10.5.5,"Vérifiez que, lors de l'utilisation de la déconnexion du back-channel OIDC, la partie utilisatrice atténue les risques de déni de service liés à la déconnexion forcée et à la confusion entre JWT dans le flux de déconnexion. Le client doit vérifier que le jeton de déconnexion est correctement typé avec la valeur « logout+jwt », qu'il contient la déclaration « event » avec le nom de membre correct et qu'il ne contient pas de déclaration « nonce ». Il est également recommandé d'utiliser une expiration courte (par exemple, 2 minutes).",2 +V10,Oauth et OIDC,V10.6,Fournisseur OpenID,V10.6.1,"Vérifiez que le fournisseur OpenID n'autorise que les valeurs « code », « ciba », « id_token » ou « id_token code » pour le mode de réponse. Notez que « code » est préférable à « id_token code » (flux hybride OIDC) et que « token » (tout flux implicite) ne doit pas être utilisé.",2 +V10,Oauth et OIDC,V10.6,Fournisseur OpenID,V10.6.2,"Vérifiez que le fournisseur OpenID atténue les risques de déni de service liés à la déconnexion forcée. Pour ce faire, obtenez une confirmation explicite de l'utilisateur final ou, le cas échéant, validez les paramètres de la requête de déconnexion (initiée par la partie utilisatrice), comme « id_token_hint ».",2 +V10,Oauth et OIDC,V10.7,Gestion du consentement,V10.7.1,"Vérifiez que le serveur d'autorisation garantit le consentement de l'utilisateur à chaque demande d'autorisation. Si l'identité du client ne peut être garantie, le serveur d'autorisation doit toujours demander explicitement le consentement de l'utilisateur.",2 +V10,Oauth et OIDC,V10.7,Gestion du consentement,V10.7.2,"Vérifiez que lorsque le serveur d'autorisation demande le consentement de l'utilisateur, il fournit des informations claires et suffisantes sur ce qui est consenti. Le cas échéant, ces informations doivent inclure la nature des autorisations demandées (généralement en fonction de la portée, du serveur de ressources et des détails d'autorisation RAR), l'identité de l'application autorisée et la durée de vie de ces autorisations.",2 +V10,Oauth et OIDC,V10.7,Gestion du consentement,V10.7.3,"Vérifiez que l’utilisateur peut consulter, modifier et révoquer les consentements qu’il a accordés via le serveur d’autorisation.",2 +V11,Cryptographie,V11.1,Inventaire et documentation cryptographiques,V11.1.1,"Vérifiez qu’il existe une politique documentée pour la gestion des clés cryptographiques et un cycle de vie des clés cryptographiques qui suit une norme de gestion des clés telle que NIST SP 800-57. Cela devrait inclure la garantie que les clés ne sont pas sur-partagées (par exemple, avec plus de deux entités pour les secrets partagés et plus d’une entité pour les clés privées).",2 +V11,Cryptographie,V11.1,Inventaire et documentation cryptographiques,V11.1.2,"Vérifiez qu'un inventaire cryptographique est réalisé, maintenu et régulièrement mis à jour, et qu'il inclut toutes les clés, algorithmes et certificats cryptographiques utilisés par l'application. Il doit également documenter les emplacements du système où les clés peuvent ou non être utilisées, ainsi que les types de données qui peuvent ou non être protégées par ces clés.",2 +V11,Cryptographie,V11.1,Inventaire et documentation cryptographiques,V11.1.3,"Vérifiez que les mécanismes de découverte cryptographique sont utilisés pour identifier toutes les instances de cryptographie dans le système, y compris les opérations de chiffrement, de hachage et de signature.",3 +V11,Cryptographie,V11.1,Inventaire et documentation cryptographiques,V11.1.4,"Vérifier la tenue d'un inventaire cryptographique. Celui-ci doit inclure un plan documenté décrivant la migration vers de nouvelles normes cryptographiques, telles que la cryptographie post-quantique, afin de réagir aux menaces futures.",3 +V11,Cryptographie,V11.2,Mise en œuvre sécurisée de la cryptographie,V11.2.1,Vérifiez que les implémentations validées par l’industrie (y compris les bibliothèques et les implémentations accélérées par le matériel) sont utilisées pour les opérations cryptographiques.,2 +V11,Cryptographie,V11.2,Mise en œuvre sécurisée de la cryptographie,V11.2.2,"Vérifiez que l'application est conçue avec une agilité cryptographique, de sorte que les nombres aléatoires, le chiffrement authentifié, le MAC ou les algorithmes de hachage, les longueurs de clés, les tours, les chiffrements et les modes puissent être reconfigurés, mis à niveau ou échangés à tout moment, afin de se protéger contre les failles cryptographiques. De même, il doit être possible de remplacer les clés et les mots de passe, ainsi que de rechiffrer les données. Cela permettra des mises à niveau transparentes vers la cryptographie post-quantique (PQC), une fois que des implémentations hautement sécurisées de schémas ou de normes PQC approuvés seront largement disponibles.",2 +V11,Cryptographie,V11.2,Mise en œuvre sécurisée de la cryptographie,V11.2.3,"Vérifiez que toutes les primitives cryptographiques utilisent un minimum de 128 bits de sécurité en fonction de l'algorithme, de la taille de la clé et de la configuration. Par exemple, une clé ECC de 256 bits offre environ 128 bits de sécurité, tandis que RSA nécessite une clé de 3072 bits pour atteindre 128 bits de sécurité.",2 +V11,Cryptographie,V11.2,Mise en œuvre sécurisée de la cryptographie,V11.2.4,"Vérifiez que toutes les opérations cryptographiques sont à temps constant, sans opérations de « court-circuit » dans les comparaisons, les calculs ou les retours, pour éviter toute fuite d'informations.",3 +V11,Cryptographie,V11.2,Mise en œuvre sécurisée de la cryptographie,V11.2.5,"Vérifiez que tous les modules cryptographiques échouent en toute sécurité et que les erreurs sont gérées de manière à ne pas permettre de vulnérabilités, telles que les attaques Padding Oracle.",3 +V11,Cryptographie,V11.3,Algorithmes de chiffrement,V11.3.1,"Vérifiez que les modes de bloc non sécurisés (par exemple, ECB) et les schémas de remplissage faibles (par exemple, PKCS#1 v1.5) ne sont pas utilisés.",1 +V11,Cryptographie,V11.3,Algorithmes de chiffrement,V11.3.2,Vérifiez que seuls les chiffrements et modes approuvés tels que AES avec GCM sont utilisés.,1 +V11,Cryptographie,V11.3,Algorithmes de chiffrement,V11.3.3,"Vérifiez que les données chiffrées sont protégées contre toute modification non autorisée, de préférence en utilisant une méthode de chiffrement authentifiée approuvée ou en combinant une méthode de chiffrement approuvée avec un algorithme MAC approuvé.",2 +V11,Cryptographie,V11.3,Algorithmes de chiffrement,V11.3.4,"Vérifiez que les nonces, les vecteurs d'initialisation et autres nombres à usage unique ne sont pas utilisés pour plus d'une paire clé de chiffrement/élément de données. La méthode de génération doit être adaptée à l'algorithme utilisé.",3 +V11,Cryptographie,V11.3,Algorithmes de chiffrement,V11.3.5,Vérifiez que toute combinaison d'un algorithme de chiffrement et d'un algorithme MAC fonctionne en mode chiffrement puis MAC.,3 +V11,Cryptographie,V11.4,Hachage et fonctions basées sur le hachage,V11.4.1,"Vérifiez que seules les fonctions de hachage approuvées sont utilisées pour les cas d'utilisation cryptographiques généraux, notamment les signatures numériques, HMAC, KDF et la génération de bits aléatoires. Les fonctions de hachage non autorisées, telles que MD5, ne doivent pas être utilisées à des fins cryptographiques.",1 +V11,Cryptographie,V11.4,Hachage et fonctions basées sur le hachage,V11.4.2,"Vérifiez que les mots de passe sont stockés à l'aide d'une fonction de dérivation de clés approuvée et gourmande en ressources de calcul (également appelée « fonction de hachage de mots de passe »), dont les paramètres sont configurés conformément aux directives en vigueur. Ces paramètres doivent équilibrer sécurité et performances afin de rendre les attaques par force brute suffisamment difficiles pour le niveau de sécurité requis.",2 +V11,Cryptographie,V11.4,Hachage et fonctions basées sur le hachage,V11.4.3,"Vérifiez que les fonctions de hachage utilisées dans les signatures numériques, dans le cadre de l'authentification ou de l'intégrité des données, sont résistantes aux collisions et possèdent des longueurs de bits appropriées. Si la résistance aux collisions est requise, la longueur de sortie doit être d'au moins 256 bits. Si seule la résistance aux attaques de seconde pré-image est requise, la longueur de sortie doit être d'au moins 128 bits.",2 +V11,Cryptographie,V11.4,Hachage et fonctions basées sur le hachage,V11.4.4,Vérifiez que l'application utilise des fonctions de dérivation de clés approuvées avec des paramètres d'extension de clés lors de la dérivation de clés secrètes à partir de mots de passe. Les paramètres utilisés doivent concilier sécurité et performances afin d'empêcher les attaques par force brute de compromettre la clé cryptographique obtenue.,2 +V11,Cryptographie,V11.5,Valeurs aléatoires,V11.5.1,Vérifiez que tous les nombres et chaînes aléatoires destinés à être non devinables doivent être générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et posséder au moins 128 bits d'entropie. Notez que les UUID ne respectent pas cette condition.,2 +V11,Cryptographie,V11.5,Valeurs aléatoires,V11.5.2,"Vérifiez que le mécanisme de génération de nombres aléatoires utilisé est conçu pour fonctionner en toute sécurité, même en cas de forte demande.",3 +V11,Cryptographie,V11.6,Cryptographie à clé publique,V11.6.1,"Vérifier que seuls des algorithmes cryptographiques et des modes opératoires approuvés sont utilisés pour la génération et l'amorçage des clés, ainsi que pour la génération et la vérification des signatures numériques. Les algorithmes de génération de clés ne doivent pas générer de clés non sécurisées et vulnérables aux attaques connues, par exemple les clés RSA vulnérables à la factorisation de Fermat.",2 +V11,Cryptographie,V11.6,Cryptographie à clé publique,V11.6.2,"Vérifiez que des algorithmes cryptographiques approuvés sont utilisés pour l'échange de clés (tels que Diffie-Hellman), en veillant à ce que les mécanismes d'échange de clés utilisent des paramètres sécurisés. Cela permettra d'éviter les attaques contre le processus d'établissement des clés, susceptibles de conduire à des attaques de type « adversaire du milieu » ou à des failles cryptographiques.",3 +V11,Cryptographie,V11.7,Cryptographie des données en cours d'utilisation,V11.7.1,"Vérifiez que le chiffrement complet de la mémoire est utilisé pour protéger les données sensibles pendant leur utilisation, empêchant ainsi l'accès par des utilisateurs ou des processus non autorisés.",3 +V11,Cryptographie,V11.7,Cryptographie des données en cours d'utilisation,V11.7.2,Vérifiez que la minimisation des données garantit que la quantité minimale de données est exposée pendant le traitement et assurez-vous que les données sont chiffrées immédiatement après utilisation ou dès que possible.,3 +V12,Communication sécurisée,V12.1,Conseils généraux de sécurité TLS,V12.1.1,"Vérifiez que seules les dernières versions recommandées du protocole TLS sont activées, telles que TLS 1.2 et TLS 1.3. La dernière version du protocole TLS doit être privilégiée.",1 +V12,Communication sécurisée,V12.1,Conseils généraux de sécurité TLS,V12.1.2,"Vérifiez que seules les suites de chiffrement recommandées sont activées, les suites de chiffrement les plus puissantes étant définies comme préférées. Les applications L3 doivent uniquement prendre en charge les suites de chiffrement assurant la confidentialité persistante (forward secrecy).",2 +V12,Communication sécurisée,V12.1,Conseils généraux de sécurité TLS,V12.1.3,Vérifiez que l’application valide que les certificats clients mTLS sont approuvés avant d’utiliser l’identité du certificat pour l’authentification ou l’autorisation.,2 +V12,Communication sécurisée,V12.1,Conseils généraux de sécurité TLS,V12.1.4,"Vérifiez que la révocation de certification appropriée, telle que l'agrafage du protocole OCSP (Online Certificate Status Protocol), est activée et configurée.",3 +V12,Communication sécurisée,V12.1,Conseils généraux de sécurité TLS,V12.1.5,"Vérifiez que Encrypted Client Hello (ECH) est activé dans les paramètres TLS de l'application pour empêcher l'exposition de métadonnées sensibles, telles que l'indication du nom du serveur (SNI), pendant les processus de négociation TLS.",3 +V12,Communication sécurisée,V12.2,Communication HTTPS avec des services externes,V12.2.1,"Vérifiez que TLS est utilisé pour toute connectivité entre un client et des services externes basés sur HTTP, et ne recourt pas à des communications non sécurisées ou non chiffrées.",1 +V12,Communication sécurisée,V12.2,Communication HTTPS avec des services externes,V12.2.2,Vérifiez que les services externes utilisent des certificats TLS publiquement approuvés.,1 +V12,Communication sécurisée,V12.3,Sécurité des communications entre services généraux,V12.3.1,"Vérifiez qu'un protocole chiffré tel que TLS est utilisé pour toutes les connexions entrantes et sortantes vers et depuis l'application, y compris les systèmes de surveillance, les outils de gestion, l'accès à distance et SSH, les intergiciels, les bases de données, les mainframes, les systèmes partenaires ou les API externes. Le serveur ne doit pas recourir à des protocoles non sécurisés ou non chiffrés.",2 +V12,Communication sécurisée,V12.3,Sécurité des communications entre services généraux,V12.3.2,Vérifiez que les clients TLS valident les certificats reçus avant de communiquer avec un serveur TLS.,2 +V12,Communication sécurisée,V12.3,Sécurité des communications entre services généraux,V12.3.3,Vérifiez que TLS ou un autre mécanisme de chiffrement de transport approprié est utilisé pour toute connectivité entre les services internes basés sur HTTP au sein de l'application et ne se replie pas vers des communications non sécurisées ou non chiffrées.,2 +V12,Communication sécurisée,V12.3,Sécurité des communications entre services généraux,V12.3.4,"Vérifiez que les connexions TLS entre les services internes utilisent des certificats de confiance. Lorsque des certificats générés en interne ou auto-signés sont utilisés, le service consommateur doit être configuré pour n'approuver que des autorités de certification internes spécifiques et des certificats auto-signés spécifiques.",2 +V12,Communication sécurisée,V12.3,Sécurité des communications entre services généraux,V12.3.5,"Vérifiez que les services communiquant en interne au sein d'un système (communications intra-services) utilisent une authentification forte pour garantir la vérification de chaque endpoint. Des méthodes d'authentification forte, telles que l'authentification client TLS, doivent être utilisées pour garantir l'identité, en utilisant une infrastructure à clé publique et des mécanismes résistants aux attaques par rejeu. Pour les architectures de microservices, envisagez d'utiliser un maillage de services pour simplifier la gestion des certificats et renforcer la sécurité.",3 +V13,Configuration,V13.1,Documentation de configuration,V13.1.1,Vérifiez que tous les besoins de communication de l'application sont documentés. Cela doit inclure les services externes dont l'application dépend et les cas où un utilisateur final pourrait fournir un emplacement externe auquel l'application se connectera.,2 +V13,Configuration,V13.1,Documentation de configuration,V13.1.2,"Vérifiez que pour chaque service utilisé par l'application, la documentation définit le nombre maximal de connexions simultanées (par exemple, les limites du pool de connexions) et le comportement de l'application lorsque cette limite est atteinte, y compris les mécanismes de secours ou de récupération, pour éviter les conditions de déni de service.",3 +V13,Configuration,V13.1,Documentation de configuration,V13.1.3,"Vérifiez que la documentation de l'application définit des stratégies de gestion des ressources pour chaque système ou service externe utilisé (par exemple, bases de données, descripteurs de fichiers, threads, connexions HTTP). Cela doit inclure les procédures de libération des ressources, les paramètres de délai d'expiration, la gestion des échecs et l'implémentation de la logique de nouvelle tentative, en spécifiant les limites de nouvelle tentative, les délais et les algorithmes de retour arrière. Pour les opérations de requête-réponse HTTP synchrones, la documentation doit imposer des délais d'expiration courts et soit désactiver les nouvelles tentatives, soit les limiter strictement afin d'éviter les retards en cascade et l'épuisement des ressources.",3 +V13,Configuration,V13.1,Documentation de configuration,V13.1.4,"Vérifiez que la documentation de l'application définit les secrets essentiels à la sécurité de l'application et un calendrier de rotation de ceux-ci, en fonction du modèle de menace et des exigences commerciales de l'organisation.",3 +V13,Configuration,V13.2,Configuration de la communication backend,V13.2.1,"Vérifiez que les communications entre les composants de l'application backend qui ne prennent pas en charge le mécanisme de session utilisateur standard de l'application, notamment les API, les intergiciels et les couches de données, sont authentifiées. L'authentification doit utiliser des comptes de service individuels, des jetons à court terme ou une authentification par certificat, et non des identifiants immuables tels que des mots de passe, des clés API ou des comptes partagés avec accès privilégié.",2 +V13,Configuration,V13.2,Configuration de la communication backend,V13.2.2,"Vérifiez que les communications entre les composants de l'application backend, y compris les services locaux ou du système d'exploitation, les API, les intergiciels et les couches de données, sont effectuées avec des comptes dotés des privilèges les moins nécessaires.",2 +V13,Configuration,V13.2,Configuration de la communication backend,V13.2.3,"Vérifiez que si des informations d’identification doivent être utilisées pour l’authentification du service, les informations d’identification utilisées par le consommateur ne sont pas des informations d’identification par défaut (par exemple, root/root ou admin/admin).",2 +V13,Configuration,V13.2,Configuration de la communication backend,V13.2.4,"Vérifiez qu'une liste d’autorisations est utilisée pour définir les ressources ou systèmes externes avec lesquels l'application est autorisée à communiquer (par exemple, pour les requêtes sortantes, les chargements de données ou l'accès aux fichiers). Cette liste d'autorisation peut être implémentée au niveau de la couche applicative, du serveur web, du pare-feu ou d'une combinaison de différentes couches.",2 +V13,Configuration,V13.2,Configuration de la communication backend,V13.2.5,Vérifiez que le serveur Web ou d’application est configuré avec une liste autorisée de ressources ou de systèmes vers lesquels le serveur peut envoyer des requêtes ou charger des données ou des fichiers.,2 +V13,Configuration,V13.2,Configuration de la communication backend,V13.2.6,"Vérifiez que lorsque l'application se connecte à des services distincts, elle suit la configuration documentée pour chaque connexion, comme le nombre maximal de connexions parallèles, le comportement lorsque le nombre maximal de connexions autorisées est atteint, les délais d'expiration de connexion et les stratégies de nouvelle tentative.",3 +V13,Configuration,V13.3,Gestion des secrets,V13.3.1,"Vérifiez qu'une solution de gestion des secrets, telle qu'un coffre-fort de clés, est utilisée pour créer, stocker, contrôler l'accès et détruire en toute sécurité les secrets backend. Ceux-ci peuvent inclure des mots de passe, du matériel de clé, des intégrations avec des bases de données et des systèmes tiers, des clés et des graines pour des jetons temporels, d'autres secrets internes et des clés API. Les secrets ne doivent pas être inclus dans le code source de l'application ni dans les artefacts de build. Pour une application L3, cela doit impliquer une solution matérielle telle qu'un HSM.",2 +V13,Configuration,V13.3,Gestion des secrets,V13.3.2,Vérifiez que l’accès aux ressources secrètes respecte le principe du moindre privilège.,2 +V13,Configuration,V13.3,Gestion des secrets,V13.3.3,Vérifiez que toutes les opérations cryptographiques sont effectuées à l'aide d'un module de sécurité isolé (tel qu'un coffre-fort ou un module de sécurité matériel) pour gérer et protéger en toute sécurité le matériel clé contre toute exposition en dehors du module de sécurité.,3 +V13,Configuration,V13.3,Gestion des secrets,V13.3.4,Vérifiez que les secrets sont configurés pour expirer et être renouvelés en fonction de la documentation de l'application.,3 +V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.1,"Vérifiez que l'application est déployée soit sans aucune métadonnée de contrôle de source, y compris les dossiers .git ou .svn, soit de manière à ce que ces dossiers soient inaccessibles à la fois en externe et à l'application elle-même.",1 +V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.2,Vérifiez que les modes de débogage sont désactivés pour tous les composants dans les environnements de production afin d’éviter l’exposition des fonctionnalités de débogage et la fuite d’informations.,2 +V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.3,"Vérifiez que les serveurs Web n’exposent pas les listes de répertoires aux clients, sauf si cela est explicitement prévu.",2 +V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.4,"Vérifiez que l’utilisation de la méthode HTTP TRACE n’est pas prise en charge dans les environnements de production, afin d’éviter toute fuite d’informations potentielle.",2 +V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.5,"Vérifiez que la documentation (comme pour les API internes) et les endpoints de surveillance ne sont pas exposés, sauf si cela est explicitement prévu.",2 +V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.6,Vérifiez que l’application n’expose pas d’informations de version détaillées des composants backend.,3 +V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.7,"Vérifiez que la couche web est configuré pour servir uniquement les fichiers avec des extensions de fichier spécifiques afin d’éviter toute fuite involontaire d’informations, de configuration et de code source.",3 +V14,Protection des données,V14.1,Documentation sur la protection des données,V14.1.1,"Vérifiez que toutes les données sensibles créées et traitées par l'application ont été identifiées et classées selon leur niveau de protection. Cela inclut les données uniquement codées et donc facilement déchiffrables, telles que les chaînes Base64 ou la charge utile en texte clair d'un JWT. Les niveaux de protection doivent tenir compte des réglementations et normes de protection des données et de confidentialité auxquelles l'application est tenue de se conformer.",2 +V14,Protection des données,V14.1,Documentation sur la protection des données,V14.1.2,"Vérifier que tous les niveaux de protection des données sensibles sont assortis d'un ensemble documenté d'exigences de protection. Cela doit inclure (sans s'y limiter) les exigences relatives au chiffrement général, à la vérification de l'intégrité, à la conservation, à la journalisation des données, aux contrôles d'accès aux données sensibles dans les journaux, au chiffrement au niveau de la base de données, aux technologies de confidentialité et de renforcement de la confidentialité à utiliser, ainsi qu'aux autres exigences de confidentialité.",2 +V14,Protection des données,V14.2,Protection générale des données,V14.2.1,"Vérifiez que les données sensibles sont uniquement envoyées au serveur dans les champs de corps ou d’en-tête du message HTTP, et que l’URL et la chaîne de requête ne contiennent pas d’informations sensibles, telles qu’une clé API ou un jeton de session.",1 +V14,Protection des données,V14.2,Protection générale des données,V14.2.2,"Vérifiez que l’application empêche la mise en cache des données sensibles dans les composants du serveur, tels que les équilibreurs de charge et les caches d’application, ou garantit que les données sont purgées en toute sécurité après utilisation.",2 +V14,Protection des données,V14.2,Protection générale des données,V14.2.3,"Vérifiez que les données sensibles définies ne sont pas envoyées à des parties non fiables (par exemple, des trackers d'utilisateurs) pour empêcher la collecte indésirable de données en dehors du contrôle de l'application.",2 +V14,Protection des données,V14.2,Protection générale des données,V14.2.4,"Vérifiez que les contrôles autour des données sensibles liés au chiffrement, à la vérification de l'intégrité, à la conservation, à la manière dont les données doivent être enregistrées, aux contrôles d'accès autour des données sensibles dans les journaux, à la confidentialité et aux technologies d'amélioration de la confidentialité, sont mis en œuvre comme défini dans la documentation pour le niveau de protection des données spécifiques.",2 +V14,Protection des données,V14.2,Protection générale des données,V14.2.5,Vérifiez que les mécanismes de mise en cache sont configurés pour ne mettre en cache que les réponses dont le type de contenu est conforme à la ressource et qui ne contiennent pas de contenu sensible et dynamique. Le serveur web doit renvoyer une réponse 404 ou 302 lors de l'accès à un fichier inexistant plutôt qu'un fichier valide différent. Cela devrait empêcher les attaques par empoisonnement de cache web.,3 +V14,Protection des données,V14.2,Protection générale des données,V14.2.6,"Vérifiez que l'application ne renvoie que les données sensibles minimales requises pour son fonctionnement. Par exemple, ne renvoyez que certains chiffres d'un numéro de carte de crédit, et non le numéro complet. Si les données complètes sont requises, elles doivent être masquées dans l'interface utilisateur, sauf si l'utilisateur les consulte spécifiquement.",3 +V14,Protection des données,V14.2,Protection générale des données,V14.2.7,"Vérifiez que les informations sensibles sont soumises à une classification de conservation des données, en veillant à ce que les données obsolètes ou inutiles soient supprimées automatiquement, selon un calendrier défini ou selon les besoins de la situation.",3 +V14,Protection des données,V14.2,Protection générale des données,V14.2.8,"Vérifiez que les informations sensibles sont supprimées des métadonnées des fichiers soumis par l'utilisateur, sauf si le stockage est autorisé par l'utilisateur.",3 +V14,Protection des données,V14.3,Protection des données côté client,V14.3.1,"Vérifiez que les données authentifiées sont effacées du stockage client, comme le DOM du navigateur, après la fin du client ou de la session. Le champ d'en-tête de réponse HTTP « Clear-Site-Data » peut être utile, mais le côté client devrait également pouvoir effectuer la correction si la connexion au serveur n'est pas disponible à la fin de la session.",1 +V14,Protection des données,V14.3,Protection des données côté client,V14.3.2,Vérifiez que l'application définit suffisamment de champs d'en-tête de réponse HTTP anti-caching (c'est-à-dire Cache-Control : no-store) afin que les données sensibles ne soient pas mises en cache dans les navigateurs.,2 +V14,Protection des données,V14.3,Protection des données côté client,V14.3.3,"Vérifiez que les données stockées dans le stockage du navigateur (telles que localStorage, sessionStorage, IndexedDB ou les cookies) ne contiennent pas de données sensibles, à l'exception des jetons de session.",2 +V15,Développement et architecture sécurisés,V15.1,Documentation sur le développement et l'architecture sécurisés,V15.1.1,"Vérifiez que la documentation de l'application définit les délais de correction basés sur les risques pour les versions de composants tiers présentant des vulnérabilités et pour la mise à jour des bibliothèques en général, afin de minimiser les risques liés à ces composants.",1 +V15,Développement et architecture sécurisés,V15.1,Documentation sur le développement et l'architecture sécurisés,V15.1.2,"Vérifiez qu'un catalogue d'inventaire, tel qu'une nomenclature logicielle (SBOM), est conservé pour toutes les bibliothèques tierces utilisées, y compris en vérifiant que les composants proviennent de référentiels prédéfinis, fiables et continuellement maintenus.",2 +V15,Développement et architecture sécurisés,V15.1,Documentation sur le développement et l'architecture sécurisés,V15.1.3,"Vérifiez que la documentation de l'application identifie les fonctionnalités consommatrices en temps ou gourmandes en ressources. Elle doit notamment indiquer comment prévenir une perte de disponibilité due à une utilisation excessive de ces fonctionnalités et éviter que la génération d'une réponse ne prenne plus de temps que le délai d'expiration du consommateur. Les mesures de protection potentielles peuvent inclure le traitement asynchrone, l'utilisation de files d'attente et la limitation des processus parallèles par utilisateur et par application.",2 +V15,Développement et architecture sécurisés,V15.1,Documentation sur le développement et l'architecture sécurisés,V15.1.4,Vérifiez que la documentation de l’application met en évidence les bibliothèques tierces qui sont considérées comme des « composants à risque ».,3 +V15,Développement et architecture sécurisés,V15.1,Documentation sur le développement et l'architecture sécurisés,V15.1.5,Vérifiez que la documentation de l’application met en évidence les parties de l’application où des « fonctionnalités dangereuses » sont utilisées.,3 +V15,Développement et architecture sécurisés,V15.2,Architecture de sécurité et dépendances,V15.2.1,Vérifiez que l’application contient uniquement des composants qui n’ont pas dépassé les délais de mise à jour et de correction documentés.,1 +V15,Développement et architecture sécurisés,V15.2,Architecture de sécurité et dépendances,V15.2.2,"Vérifiez que l'application a mis en œuvre des défenses contre la perte de disponibilité due à des fonctionnalités qui prennent du temps ou qui nécessitent des ressources, sur la base des décisions et stratégies de sécurité documentées à cet effet.",2 +V15,Développement et architecture sécurisés,V15.2,Architecture de sécurité et dépendances,V15.2.3,"Vérifiez que l'environnement de production inclut uniquement les fonctionnalités nécessaires au fonctionnement de l'application et n'expose pas de fonctionnalités superflues telles que du code de test, des exemples d'extraits et des fonctionnalités de développement.",2 +V15,Développement et architecture sécurisés,V15.2,Architecture de sécurité et dépendances,V15.2.4,"Vérifiez que les composants tiers et toutes leurs dépendances transitives sont inclus à partir du référentiel attendu, qu'il soit détenu en interne ou qu'il s'agisse d'une source externe, et qu'il n'y a aucun risque d'attaque par confusion de dépendances.",3 +V15,Développement et architecture sécurisés,V15.2,Architecture de sécurité et dépendances,V15.2.5,"Vérifiez que l'application implémente des protections supplémentaires autour des parties documentées comme contenant des « fonctionnalités dangereuses » ou utilisant des bibliothèques tierces considérées comme des « composants à risque ». Cela peut inclure des techniques telles que le sandboxing, l'encapsulation, la conteneurisation ou l'isolation au niveau du réseau pour retarder et dissuader les attaquants qui compromettent une partie de l'application de se propager ailleurs.",3 +V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.1,"Vérifiez que l'application ne renvoie que le sous-ensemble requis de champs d'un objet de données. Par exemple, elle ne doit pas renvoyer un objet de données entier, car certains champs individuels ne doivent pas être accessibles aux utilisateurs.",1 +V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.2,"Vérifiez que lorsque le backend de l'application effectue des appels vers des URL externes, il est configuré pour ne pas suivre les redirections, sauf s'il s'agit d'une fonctionnalité prévue.",2 +V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.3,"Vérifiez que l'application dispose de contre-mesures pour se protéger contre les attaques d'affectation de masse en limitant les champs autorisés par contrôleur et action, par exemple, il n'est pas possible d'insérer ou de mettre à jour une valeur de champ lorsqu'elle n'était pas destinée à faire partie de cette action.",2 +V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.4,"Vérifiez que tous les composants proxy et middleware transfèrent correctement l'adresse IP d'origine de l'utilisateur à l'aide de champs de données fiables qui ne peuvent pas être manipulés par l'utilisateur final, et que l'application et le serveur Web utilisent cette valeur correcte pour la journalisation et les décisions de sécurité telles que la limitation du débit, en tenant compte du fait que même l'adresse IP d'origine peut ne pas être fiable en raison d'adresses IP dynamiques, de VPN ou de pare-feu d'entreprise.",2 +V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.5,"Vérifiez que l'application garantit explicitement que les variables sont du type correct et effectue des opérations d'égalité et de comparaison strictes. Cela permet d'éviter les vulnérabilités liées à la confusion de types, causées par des hypothèses du code de l'application sur le type d'une variable.",2 +V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.6,"Vérifiez que le code JavaScript est écrit de manière à éviter la pollution du prototype, par exemple en utilisant Set() ou Map() au lieu de littéraux d'objet.",2 +V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.7,"Vérifiez que l'application dispose de défenses contre les attaques de pollution des paramètres HTTP, en particulier si le Framework d'application ne fait aucune distinction quant à la source des paramètres de requête (chaîne de requête, paramètres de corps, cookies ou champs d'en-tête).",2 +V15,Développement et architecture sécurisés,V15.4,Concurrence sécurisée,V15.4.1,"Vérifiez que les objets partagés dans le code multithread (tels que les caches, les fichiers ou les objets en mémoire accessibles par plusieurs threads) sont accessibles en toute sécurité à l'aide de types thread-safe et de mécanismes de synchronisation tels que des verrous ou des sémaphores pour éviter les conditions de concurrence et la corruption des données.",3 +V15,Développement et architecture sécurisés,V15.4,Concurrence sécurisée,V15.4.2,"Vérifiez que les vérifications de l'état d'une ressource, comme son existence ou ses autorisations, et des actions qui en dépendent, sont effectuées en une seule opération atomique afin d'éviter les situations de concurrence entre le moment de la vérification et le moment de l'utilisation (TOCTOU). Par exemple, vérifier l'existence d'un fichier avant de l'ouvrir ou l'accès d'un utilisateur avant de l'accorder.",3 +V15,Développement et architecture sécurisés,V15.4,Concurrence sécurisée,V15.4.3,"Vérifiez que les verrous sont utilisés de manière cohérente pour éviter que les threads ne se bloquent, que ce soit en s'attendant les uns les autres ou en réessayant sans fin, et que la logique de verrouillage reste dans le code responsable de la gestion de la ressource pour garantir que les verrous ne peuvent pas être modifiés par inadvertance ou de manière malveillante par des classes ou du code externes.",3 +V15,Développement et architecture sécurisés,V15.4,Concurrence sécurisée,V15.4.4,"Vérifiez que les politiques d'allocation des ressources empêchent la saturation de threads en garantissant un accès équitable aux ressources, par exemple en exploitant les pools de threads, permettant aux threads de priorité inférieure de continuer dans un délai raisonnable.",3 +V16,Journalisation de sécurité et gestion des erreurs,V16.1,Documentation sur la journalisation de sécurité,V16.1.1,"Vérifiez qu'il existe un inventaire documentant la journalisation effectuée à chaque couche de la pile technologique de l'application, les événements enregistrés, les formats de journal, l'endroit où cette journalisation est stockée, la manière dont elle est utilisée, la manière dont l'accès à celle-ci est contrôlé et la durée de conservation des journaux.",2 +V16,Journalisation de sécurité et gestion des erreurs,V16.2,Journalisation générale,V16.2.1,"Vérifiez que chaque entrée de journal inclut les métadonnées nécessaires (telles que quand, où, qui, quoi) qui permettraient une enquête détaillée sur la chronologie lorsqu'un événement se produit.",2 +V16,Journalisation de sécurité et gestion des erreurs,V16.2,Journalisation générale,V16.2.2,Vérifiez que les sources de temps de tous les composants de journalisation sont synchronisées et que les horodatages des métadonnées des événements de sécurité utilisent le temps UTC ou incluent un décalage horaire explicite. L'UTC est recommandé pour garantir la cohérence entre les systèmes distribués et éviter toute confusion lors du passage à l'heure d'été.,2 +V16,Journalisation de sécurité et gestion des erreurs,V16.2,Journalisation générale,V16.2.3,Vérifiez que l’application stocke ou diffuse uniquement les journaux vers les fichiers et services documentés dans l’inventaire des journaux.,2 +V16,Journalisation de sécurité et gestion des erreurs,V16.2,Journalisation générale,V16.2.4,"Vérifiez que les journaux peuvent être lus et corrélés par le processeur de journaux utilisé, de préférence en utilisant un format de journalisation commun.",2 +V16,Journalisation de sécurité et gestion des erreurs,V16.2,Journalisation générale,V16.2.5,"Vérifiez que l'application applique la journalisation en fonction du niveau de protection des données lors de la journalisation de données sensibles. Par exemple, certaines données, comme les identifiants ou les informations de paiement, peuvent être interdites. D'autres données, comme les jetons de session, ne peuvent être enregistrées que par hachage ou masquage, en totalité ou en partie.",2 +V16,Journalisation de sécurité et gestion des erreurs,V16.3,Événements de sécurité,V16.3.1,"Vérifiez que toutes les opérations d'authentification sont enregistrées, y compris les tentatives réussies et infructueuses. Des métadonnées supplémentaires, telles que le type d'authentification ou les facteurs utilisés, doivent également être collectées.",2 +V16,Journalisation de sécurité et gestion des erreurs,V16.3,Événements de sécurité,V16.3.2,"Vérifier que les tentatives d'autorisation infructueuses sont logguées. Pour le niveau 3, cela doit inclure la journalisation de toutes les décisions d'autorisation, y compris lors de l'accès à des données sensibles (sans journalisation des données sensibles elles-mêmes).",2 +V16,Journalisation de sécurité et gestion des erreurs,V16.3,Événements de sécurité,V16.3.3,"Vérifiez que l'application enregistre les événements de sécurité définis dans la documentation et enregistre également les tentatives de contournement des contrôles de sécurité, tels que la validation des entrées, la logique métier et l'anti-automatisation.",2 +V16,Journalisation de sécurité et gestion des erreurs,V16.3,Événements de sécurité,V16.3.4,Vérifiez que l’application enregistre les erreurs inattendues et les échecs de contrôle de sécurité tels que les échecs TLS du backend.,2 +V16,Journalisation de sécurité et gestion des erreurs,V16.4,Protection des journaux,V16.4.1,Vérifiez que tous les composants de journalisation codent correctement les données pour empêcher l’injection de journaux.,2 +V16,Journalisation de sécurité et gestion des erreurs,V16.4,Protection des journaux,V16.4.2,Vérifiez que les journaux sont protégés contre tout accès non autorisé et ne peuvent pas être modifiés.,2 +V16,Journalisation de sécurité et gestion des erreurs,V16.4,Protection des journaux,V16.4.3,"Vérifiez que les journaux sont transmis de manière sécurisée à un système logique distinct pour analyse, détection, alerte et remontée des informations. L'objectif est de garantir qu'en cas de violation de l'application, les journaux ne seront pas compromis.",2 +V16,Journalisation de sécurité et gestion des erreurs,V16.5,Gestion des erreurs,V16.5.1,"Vérifiez qu'un message générique est renvoyé au consommateur lorsqu'une erreur inattendue ou sensible à la sécurité se produit, garantissant ainsi l'absence d'exposition de données système internes sensibles telles que les traces de pile, les requêtes, les clés secrètes et les jetons.",2 +V16,Journalisation de sécurité et gestion des erreurs,V16.5,Gestion des erreurs,V16.5.2,"Vérifiez que l'application continue de fonctionner en toute sécurité lorsque l'accès aux ressources externes échoue, par exemple, en utilisant des modèles tels que des disjoncteurs ou une dégradation progressive.",2 +V16,Journalisation de sécurité et gestion des erreurs,V16.5,Gestion des erreurs,V16.5.3,"Vérifiez que l'application échoue proprement et sécurisée, y compris lorsqu'une exception se produit, en évitant les accès en cas d'erreur telles que le traitement d'une transaction malgré les erreurs résultant de la logique de validation.",2 +V16,Journalisation de sécurité et gestion des erreurs,V16.5,Gestion des erreurs,V16.5.4,"Vérifiez qu'un gestionnaire d'erreurs de « dernier recours » est défini pour intercepter toutes les exceptions non gérées. Cela permet d'éviter la perte des informations d'erreur qui doivent être loguées dans les fichiers journaux et de garantir qu'une erreur ne paralyse pas l'ensemble du processus applicatif, entraînant une perte de disponibilité.",3 +V17,WebRTC,V17.1,Serveur TURN,V17.1.1,"Vérifiez que le service TURN (Traversal Using Relays around NAT) autorise uniquement l'accès aux adresses IP non réservées à des fins spécifiques (par exemple, réseaux internes, diffusion, bouclage). Notez que cela s'applique aux adresses IPv4 et IPv6.",2 +V17,WebRTC,V17.1,Serveur TURN,V17.1.2,Vérifiez que le service Traversal Using Relays around NAT (TURN) n'est pas susceptible d'épuiser ses ressources lorsque des utilisateurs légitimes tentent d'ouvrir un grand nombre de ports sur le serveur TURN.,3 +V17,WebRTC,V17.2,Média,V17.2.1,Vérifiez que la clé du certificat Datagram Transport Layer Security (DTLS) est gérée et protégée conformément à la politique documentée de gestion des clés cryptographiques.,2 +V17,WebRTC,V17.2,Média,V17.2.2,Vérifiez que le serveur multimédia est configuré pour utiliser et prendre en charge les suites de chiffrement DTLS (Datagram Transport Layer Security) approuvées et un profil de protection sécurisé pour l'extension DTLS pour l'établissement de clés pour le protocole de transport en temps réel sécurisé (DTLS-SRTP).,2 +V17,WebRTC,V17.2,Média,V17.2.3,Vérifiez que l'authentification SRTP (Secure Real-time Transport Protocol) est vérifiée sur le serveur multimédia pour empêcher les attaques par injection RTP (Real-time Transport Protocol) d'entraîner une condition de déni de service ou l'insertion de médias audio ou vidéo dans les flux multimédias.,2 +V17,WebRTC,V17.2,Média,V17.2.4,Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant lorsqu'il rencontre des paquets SRTP (Secure Real-time Transport Protocol) mal formés.,2 +V17,WebRTC,V17.2,Média,V17.2.5,Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.,3 +V17,WebRTC,V17.2,Média,V17.2.6,Vérifiez que le serveur multimédia n'est pas sensible à la vulnérabilité de condition de concurrence « ClientHello » dans Datagram Transport Layer Security (DTLS) en vérifiant si le serveur multimédia est publiquement connu comme étant vulnérable ou en effectuant le test de condition de concurrence.,3 +V17,WebRTC,V17.2,Média,V17.2.7,Vérifiez que tous les mécanismes d'enregistrement audio ou vidéo associés au serveur multimédia sont en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.,3 +V17,WebRTC,V17.2,Média,V17.2.8,"Vérifiez que le certificat Datagram Transport Layer Security (DTLS) est vérifié par rapport à l'attribut d'empreinte cryptographique du protocole de description de session (SDP), en mettant fin au flux multimédia si la vérification échoue, pour garantir l'authenticité du flux multimédia.",3 +V17,WebRTC,V17.3,Signalisation,V17.3.1,Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation entrants légitimes lors d'une attaque par saturation. Cela peut être réalisé en implémentant une limitation de débit au niveau de la signalisation.,2 +V17,WebRTC,V17.3,Signalisation,V17.3.2,"Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation légitimes en cas de message mal formé susceptible de provoquer un déni de service. Cela peut inclure la validation des entrées, la gestion sécurisée des dépassements d'entiers, la prévention des dépassements de tampon et l'utilisation d'autres techniques robustes de gestion des erreurs.",2 + diff --git a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.docx b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.docx new file mode 100644 index 0000000000000000000000000000000000000000..785c963570ad84b5dd7bed15234018c183f5c7ef GIT binary patch literal 225553 zcmV)DK*7IIO9KQH00IaI06!!QsN0)1%%O+P@9#)+u4AWgQv@7QikNki;3F?liA znz{GrN-`RZH#&<};DfSe826HH9Dxy5Dl;F(pVODleLNlwrdtOgqEZuv@dD93Fc!oD zG!Kb&U}z+@UUQ^ZKWC1MFFps>?{@E)um-_k2Xl>hG>_EbDTs zVa%P&l;B9itQchn8$D#LMyq?4?^$a}KUY?_puBQmCg%KJj zfwcdieD==fC}iqAQ*xN{Sq7J%cqM(5g8C=ky1>ZoYzD|rk_6cy5C+YH*+>4k2+f2DA7f@(x_W$HnM)p>ObQS6kP96*c4 zVjJsGN!L>>fJ^Y_|8@Q_l)_B`Zm$i{zaBuoTCF5d3O5C4A%W8XTG)h50W?U(nSYi2 zUgFGr4?^ku3Rrxv7b%MCRakKm9eo2(O9KQH00IaI06+Noe~dmdUru;%oQpS5O9KQH00IaI06L^H{K8I|PP4>-+ zlOwleTMI2)QES->5FjX4O?H=DtfK2esn?TVH}+#*PJq1uVZX#$0rHfWjrFF+{v+#` zoN=4Csv^}bHz_LVV8v?Qs%Fj0xPIdsfAe>5W@)fcMVaK;m-mLdgL{F>qC8Hr^DpoH z{>9h*qkDh%w}12ci#U(!naZjFzMqv}y#DguMODqec<`W%F4Qb6ck{W*;InC7%)$y@ z7UvIM=S4g(@<^2>TyB;=*c%KE9?ZfdyC;{KUFS0Sbecr!kqkgzq`J@-DL(chg-XK; zp1ZtA=B2(`{^h;8$i9$E^=C;`W{bDgo_4i&62iLeZPMZEj zc%3JUi}3Z5>76IhM_d7ZRn>)gyw~%OxQ4&}6cZKRi58ZO_7@ z`hN1tdG$@0rmDC!GAW$EBj(fKB+n|4G$lQv`S$O#Ifn~Q)H$jTc!;E^F2B526}6H_O|r5oUZ^+A z2Jrn!@Q-=$S3lQz_1DAxi2n%w@gn%gKLr0+;}FahRt%t2^RUocXz9097VEh&Pxru| z;Rj}+CwczUEG&LHt6){&N=f|Xz0m+4G7D#Lv1tLnNy<5?^arcgMiypxgO&N(UcPfp zx`wys4Dae~A2jJaFZ*%bFI-)B-O=vdV6<1i1bnw3u7hH!X8o`n_&O=d3eG`zUWD_D z8;syo1)fF^VikB=65mL}!0HHiqYPZR8{B_rUj=81zIPdbu(TI}>CWP?h<5^2RzaP? zHIuSZLHy@m{zbh>&cO_#p((>D%gmYXE6@Q(alS$sbzZl-| z=NtrVnq-Rp1SyM~A$kK&-EeR`K7@&jK%kEYd!x|-&o+E(I)zR9n7=#u@*b>UO8+hB zzZLzLzlvIoHcAAa(PWk|91pGGqg61xXoIk-x2m{z(zrj2C z+rNRo(8J+BvIX1|rv+a`-!1G|cON9P@LZJ-WYD{FRID`KQP+6&1^99y-r_Wmeky}3 z2L+U!tA|CAzrKL&Si;=ivu~Gkm`i#KSINK3gVq=)X)^yhNmIN9{v8xwsM$opu!<+~ z-cY6v6sD@83;c5mUw#gEpsPEdJn*lEuS(b;!Q}PRJcefr>ngv87kD!*X812Sn!y`d z*-O2?A?}xzo8^K1{TzEcu6y>L;I5Gac!Ps4yX=Ms z{VVW_(K7ld>Gu8|$dtegEUbvuEA%`*z0ydQ%68P@T?e*pQ$w z%e*dw-{d7;fW241BK`#DBay=~zGtpd$k=>Up?_m+#AhE|u}B3cg@RdIz#pJgQ3*b* zsv?=xY%YN9sUD`uPbwI(a+Qi7PvgI zTBtt+Nfx6EQv^{OCWWGv4C^=W{~%{dF<^?B(x!@@G}{_bum#z z*BSKZ?}0gz9kS(Mm25e*vgN$U>$xK7BI0Wu;^iB@3kn#y%YRu3Gdw=(lrSIt{#Hn& z7x^R!!B)7)z^>k^Q}sMd=NG|4um!;a*shUXhFS2in1L;lZ<#3nCY%%`i*guR_(4hZ z$+q27bq-!<@VhX=IO|qTA(+ZpmITj=8vN5_tA++X9h>suG)zI1Z`I%)$0`f{AuQmZ z6|;676?nKx1s+)y$i{s?$}@HfFpk)tg|G16btuD!>`Zv~3*>(PW!2*6VR)at%2g4Q z>HU+Mfw#L=N9RcyhEZ^;UawMgpIl_aNeoWHB2$-JHF;;Sdy72yCak01D0hxl$(>_2 z0pJQ8RrL#%V)A57V&}w@H>wKk?QR&3`RH`OcNl327Z_DavM7ZYPR0q7FI|!`4&m$R zpMUum(5LE+3LbADdUOW2OHvTZ8RoX?jM7GNQpsRKXUy_Ri8+p5uuyf9rs@xY$_jOk zVJ21J@2e#G38uWPi{P82`nH~MUh3+P@C8^1c;c*?Vv!$*XNEpUNhNci2nNY0athJkKHp5xQ^jMcPV49jJnZu~(u#ypMO*O;G*bOKkYL8n4QZv2! zl{RtXQg|VKQ@9YuKLr|D+N)-i88v@jR zG+LEh9gVGQ#c@u<^*|Y($+b5nHNQ$!woqBEjPzO9v}y~W@Nqx^*#A4L*TRBNpNCd=M1ehV4Az(?pxd`jBN~SAu7o;&@B}sP9Id=g+wjc{mJRvHA z;0<&!Z=Fd*2KbN(Uj9clfgyt6%9gNk_Z-ppO+vVJfVe}g2F(_ z#aaqJy!sWDZ@8dc0Dr;lW-x>Jc4JA>{2aus0ui{0`NOHg$HcWwNmZlF4QWxcd^Ram zUApEItvT5!es-rvZ_X6{f)Gv|1a_jcvQucY$%clfr93L=1K2?%hl+EV!VsLCa5%dtXuneC4wkFhpq(da0#^;D2rs}-&^|(` z0Jnidi1&72cfH`uL9_kf>17zc2l3kl*Byk7k^a^Kg|V{{ied>K67MHxjvS*XG9wJh zL_-K1t9}@0h$dP~nWS)}|Dz)89?D@nl%-(c5;P6Th8De1spx{Ry=72>Z5hEc;0qpb zg&-@IGj{B3Wxv6BpiwJ%1wYGBc%k40qZfw=Hzzmf!xD58+p9pu1BV05SQKwDqZp&4 z6k+PwQ3CeRd(H@Gv5AtZF)OhJh=gW+mR_Dt-7f58SX3iVafLxhU;S%1fsKe?gQ9W&fdp}-yT;yla*FTs$@Fb?OeBWr|ImgI5y z!$mPda$};(JYj1CX0yF(wqc#WOBM>B6zmMGwr~Z})P{-Db_sel_d<_G2CA-e(T=`T^@gh%aZNh=?fJ+CniI)xIoNPHfO!A{(NGhIX6KP<@2V2cp zyNF#A%kh^h7<;N`AhWoj-Y>zk1Y>|UA`F;-fX;pQf_yqH*mhcoU@%51Iq+!a(u(?P zUkZ%4C+4SIZ-kO-4uX<)l|2X6w1Ufk=?juNEJ1w1yW1fK7(Wk6L+SVeA2gK};Ik** zVMk9|&fg*_U>QdH1Ls+B1}I=bcI5C7&*(hCI2Vgg^U|01as*ND(xx%d05H4c)RR3I zqQ4JsV1xwp{d^w6`JW`LxfoXs_a#jMx6pq4`?q9rSMT3ydy;odbAzU6iJ!A?b8TyF zZKOVPx?1qPScS6y61aTfsjOD8m}n90?8z9A3RU2akEi zW&$Xauw*fzW1{{AMLptBVWuh$D;F%R)N~4dM(O+Ha-6sffWCHKCo$h*Cc6Ls{Bym~ z0YyKS(!=rKnbg*xr`vI?oAv`mNwEEjj(wp=5=;}Sh5|X*HP)03eu~&wut}T2<%VUS* z6>{moiD;pItNM}Z!yh1+%Eh(QF*k`K{(a477jDF7RgU%hw|}>>FxRcr7-8tphP7G- zZ!3V+yaEP%bVTa4n(PLTVPBBxRV7u;#t3d1_;I8-0G(i{KNkGnJBK3ElAq4Zx}>Vptr_+gmV+Tyhju^AY-HVVi&K(Cx;jY=zE!pf4@tJD^t z3vZ6?R_cLHsKOb`^PIec*}NGQ?D<&~iVs@rm23=daeREAGIv{<#KU3^Xk48j@{S?uag=WPf)*g?`d>!m(glk| zwS=K7H>64vDJ;MNIeGHno7gz5lsyKI&4rtH8J#qbEQ{ha6;(??eDxdUR1gA#Q z8P#>A!RSUA33K^PNq}Y&NCofz?fqNlIp4p1|0nG*kiA54ByF$pp&?jA(`4^y`~YmM zl*9gLrCt3;JNW1CtOO%i=LH#n+Ofa^lj1?oqOr8@_Gws_;6b9x7-o_zL6lDrQYLDdvSZEZj}F-bCr%}po9Ao=SfI13 zKf;W{&}Bw9f~Fwf1H2kM`Xt0EbW&)oW_gTH1oH#p7w$lEl`?k)Sju(snfxSWui; z*@0lRQw+(0Tr^e_CL86}6a#*4ln;Calys^9uPa-z6=6TSK}jdz4rBGlXCs;v6$!;Q zLzAwUAqWRO40H&+Y4`U!=&RCEJVr!Y35*qcA~rdART>};{to@{p7_3LGD~zImz=Cg zLc``yDRz`ZCeDi(AGi&fyf7J81lL7blgasEQVpv>5Sk@ zyAlb`IShOQGyX`ipy~x>(wZZ*5Y3aP8UW=BTcv#`Q6Rk6IE!6bZ9*9u3QG25iQx=| zkrS12ls={i3Jg=BZP>AJ6rh34&3ECLgcc-91j$8SkmB&HUomu=%Lm&&gmaHkyH1gV zdqw$o)mx;o#5_Zd-Lm`vVTLj%pr&OOK?P9SEO~U7d8C?Vy7xPL*PD<2}71dMQOYXwFohP&S4iahZvuYx#HN)qg=VeF7=EBGqWWQ45K%S zPzV?iK=uv%$T~fu&Ww~`taqJ?^@qOyEM%xoj^P3l;WM-wIWL{ju;0J^JBl!HN{><< zykQoUKjSqfH`SOu8a4>y3QjImSoO~?6g*z={!g63wj$}ePbKVI5e>r1J$#0U((Jc3 z;`eV6!UXTNI9(;pIKfLS)wx&(TI+i}RfVQXm|F*|MnP!Ql#F#5QV+H3|6t`l^UEz7B$? zLwT&Kgc>=OPi}IhB}X4$qv)a+%+oNF zY@}Nl(*`a`h6>LwvzY~qg(u=~ z!5EC29i|%!2|S`a35NGc^K%H^JsUm7^?4Bw_-)8VfmmY;&s9;ej&sV%D$&^9c36&# zT@a>x3d!UxDOH70_+CJ`F|?r*U21~|QA6Q)NR$S#z-TvenYPkdFxwSF9LN*4db9` zQQ5$cc|1SY5naG+6bw!W^MiL}#hwJ|FtoI>syT!9= zs6mgv9%_NjJE+JJlB_y{|8ea(OzpIn>~NTzOHp6WCV`zwmX#yCP=iDX??l)NlzH?5 zEgGc+2gC9LWBdI9!U)eKD`-zRb5hR(@gP^<<0%F;O+2Kr~d$+JG^C;1A z7%w!?Lc@Ukz53tH#d8lvLv%1BvW8}w?599$$iXluG)68d$&;Ped|fE~j-gN<3@}WZH~v8DV*v#5oi>u%V2krlA2A9 z2nrxYTV~uqA?J{x8JW)<0y2h7a7z1QZh=o^D;ePgKU@PF->qN*vpUq(X)Cp%_)TnZ zWs!C2<#8}}>n`hN@R^jhK`LhxAn*h5UXVa#EafClsw&s;@eec+MK6-L#%1DU1C{G& ztJXJ!aG#aA!}q`l6{;Dlxat_I-;^7&Dw%}^YcXKom>tmQs6oJ3^ZU#iwXu?*n8x6) zf4aY>3bLX-OxmQ{k@To2O2=gv^+Lx3v}4MhKRn;LG)+pR08*D7`i=qvj3h|lit6_I z^DN84n_vJB%pk~QsBY*W)|eUOfpL$eELquf@oey&E9>)l;cqC!(J?e)nkQX2VdSWw zOHdI62kb;DI^qt~zmgcCm?VSVRACEAVWZ$+LPprpk8ZpNf`ML5jiCCX>2$D^fn z0(vYfQpJL2X^pg>oAfPOc33SXKkT83oar9yQ3A;>*$|i;;TzdvCa`fHBEL}<|K7@a|E*XRv&P##zVVJ<{roOjWQ}dOk^r)W=9! z7bk$PO~Em45-&L)tzzdGJIIZfqv_%FaBv)}!~KK(z2UJM98JREP(>pZO{aTD(`h)E z#>dwUZQi8r<2xG+x?zRW#-RoV9PU+_e|Y3QEkLCBI;_u0J+u9Yot7|J!SpPGfWdC+)1i9QC(F^c(q`R zQ7MrYQ!)tm;v!yUXQiy?LNC^Y&z8+trKgj19jaSmNRmch*gw^pR>&fwPlvtWbPum{ zI?|S;)BU5e)}`jha6uxQ2Q7!94*-Y#?&g)5vd$5Ia%O_<{ym)MHbv#$EGdNXhhlUwWC?aFdg7rbfP9z}? z0@)BeiY*iifdpId;y_rGddFyPP;TcCC2_=&)}Rl!?#qSOkyN_+Z{}9+PT5>K-kCP? zm{`2JxNmoWPPrqOO}J=PDgPEsDm#L-5S>9ciEuF$+lojg!&#Zb2fsT@N++pq$%jI? zdy4Q5P3RCZMAb?>O}8Rp99;kp(j1Y_T>dVObSvVTI`WCgB*-Z=5de&M=}4a~qa~nx zNa2i0sJX8+pA@HWHe*#TnFxujvoQXdyfyHE$=7n9SD?NwbqNL-IuO04o~WGw>*0J> zY+0LxPibR@v4sqSOIntOM}=}8R94AuPEWfRh_lnlOAfGtHq{PvPxN?9o{v|>ld|gDEpm+u(c1otN^gXy;((PGj`}~`1bwbI+W;l!V9%2 zt$AW*)8NAVodohGnNeCAZA2Y0^Xuw#nMFq(hN?V*2l#%%RWjfc`yCARQ`4Z za2U`rS`1<{+z>S5`&tuX`TJ+}JarrXxGG#$CbYmWQGYX8S0i| zR}x_?Cy&4q*&3%H(4v70ZW|t3gQU*a1h8TkOy;1gqv{l1g&I@5fOF5qn*x5=3<}}Y zK9g6D=UA}@Lr%~uHsp0@X;aNdi8(NLfkz=TY!*BN^Q#OfLD+y>b$*=ys z!l-mo5RP{Tya0pf*2x@WK{jha*uZco{~D?BYpbCqv5}{S#w|6pw?;Lzw=w4}#C=Z+ zp+(rkQ>(=2C08d>g-%>a03&kkdDrE7EQ(}*r6LiJ(efkqG!)x0(>hYz1l0B_H?-n9 zTz$X$X_Il$`<|tTtb)BASAgnLBCf}mFK%2#IR)RXN?b>$u(&juMT4#_qEANx1&%10 zN%aBEqzyl#`q=JRsrum7R-3t*?NvIyTnXL)d#6!42kUG?hko$mNmk!>LbG8ql$5r$RU}c;f*HE$5XUI!J zE_2tlL*Gv8W41`?h9ij6Nuoqd+a@sJ+FN;5CHwfmqt#0#(AYN;dL8@v?=iKflOXy= z8>Q7-!k^}pVA!Sum=Uc^?rBM;qRj=d6diBAwE!dX*%Fp-8wBuwoN@W*R71Tywbtu^ zHcJQn?WZpl%I{!*F3tTsrUD}1@47IAPC>xvn@T?#6Y zB_h+2TKhmMj7!7f)=cwIi4yq*2%#Y4ir6s|?s-KwWL}0C{N*qunrv!Pl2E}iH}jAw zj?#oM_jX?;*;EIY;FaNn=7Ayj*@r#KU11%GfB)LTr^y=Ne6*@^eShS(VI#;@UuV+S zM?R>lUk%X2*nQoysZ*jlHTQx+9qDR5C~ip`(n)$}gh_9zJ^lQXsm3pZ2S~FMqbe3bnB<;& ztI>CEj3GEng6|*J)dfE3k81M##fcXQ&_%R8ig4IRH<4cpBNEPn^DHNRyX%UTRfWsr zWA6lpn5IeS2+r%tI@t=(%+1KGus7SJVdLDkWK=;}bL9Z0)}%!OhE1L_xA^W;Zr-$e zk{3itKjm6z4k%|e7_>!RYG{JQnVB3<-vxGOUP$?l>0;-M!=o`bFciKr?vCu--N@b# zd2Gyou0hX2Mc(oCNFHIqzaV@L{p6N=78spkezm;g={0SV_G}>~!*kPTKtG@~1?&;5 zUQlS2YYfnQ;?cWgk(`wNLi#WlYTHQNYrGu0L@T(+7-8{FY%jP!cLfl2{0jPibzc27 za-Q!Fmb9tc*2(4_hLioslazjziumv~^>kT-MV!pIHzs*%ApT{7C1!b^<`c}^BE$wM zS!7kz$4t2P20cCv2B0KVec~?&ErMB);pes>_6&b$O`K(DOo5c?NlGTJDRHb<&jN^c zD70J>5I-?%*^CvskvmL4IAe9o5qQ}g&9>rq_8C{M-C%ckjkUW)-Qm*D(y`_mq}VrMz_F^Bzj_Wi?W zjwW;qskD0r8j$S~-8hH}F=-Hz7!wEL16!|A83LD>Bhtm}=d>xfu2R@v)#iHNX`As<9Sx6mW}SO15d&``pq2PEt$sQ?qBTw#hT_$CWkx^Cvv%_ zyZ!l>|L+FhehlVYjL}`9=c}sx5?JKhGpc4+ytE*qnl|h42mE0>wC30yo=b_8XvLX&6A?%_0 z0v!)Dq2BqN+Gwu&x;XcyfcfY8>W`>Gzdxf!e8{6!=-_{yQQVD06GfNbRNRb>n>m># zT8MFRN4(iEymf*J(7Hfxco7zfvb4B*SGZ(dI8BY6A)&aryp0&yp40b`!|Xa5izp3_ z(Q~2%C${W)EEa@oAg7$t%3;>pc%SY>E>Nn;yr59)YY(qd#ZrGAw~G`ke2mM!70Ong zc`FQ&mPI_l@FtU~$(C)ml-iD2BmvvMsa#*9O?UOKBstVdx`n|$i9(mg@XlVovzOO0 zQ_3+y-oK?ovK!oInqE*O4km%9jAqQ~x6L}i(XapXkyh~T&P}bYo2Qqat65mUnMWMN z>2Kbqw>6<_+GZL`!C4)H4s+Co=I{~ogOKfpYgejN3C~lPQN58~7iS5JHrHIEB%4mK zNmB+QuoZjQ#P+vkJsSt)Mg|Zi@q9}2)7HZ6)Y33zr=aHPGTRy2(}ws z{i0b!qzKeAi;;CCPiv|drk<@Ff#;T_?`BK{ih;REV_IR4{aojXZfhKC$`C>LP{YpNd*whN39G_&VJ|xzdQT>JA7bv8hTQyq`8r% zLgeMHvZgI@>FSXyES$+4Upw8piotH*p-n=h#7zqXZUnrc>u(-pua;4YR7pW}BKb72 zWk_*8H>Bp=91kg>5er+En(Mu0v&^Tkg9XE{VmT$}@mt6f3o)TG83vcE!j{x+z8-T_ zr-&LM&X9ncEc`^yss+YSA7|Uh2)=Y4Vo7O2fO{WA(qKqput-n;fFB%5TDSo^l^5tf zA<-R*q=6zSZ;B#0mGvX7thomZO+9GJp3IJ9)!+z=CYNB*rV`x4{W)rGF9(&>D3rLa zaB1?#I3KO5>ECzC45F~?$Bvx4alOxts+2m~fPBizAE%#&>7K@w@49V9LtVEE@~Lc} zIcB5?h>8xeTsAR=pNS7kS&_&Vs$W3(cWlqG>k@*~I{MRbv1iGSU!THWNPBAT=23R?D2!%A=qmSS)pcfpP+=z>8oGmC+b zaf=r{FRD!q=wr=X3rhMra%VF<9JuG*8Fngx-ImuZVohnO%Q|l(x9&sC@)+USrPElD zTRG*(Qo+>dDOT9Aau!4_L#$Rj9L2xMY~Y3tuxS|h>C~&60kQG?>&)^#Gy%X;d(`X= z-J#DMD=-W%$PBkg-y^`zZZWe|<4|i;^<4&_UQ~$}PEjBwvXk!syTb-<8j@WmY zBVHb;>G4rCJUos^@xgF~375xJ(FM8Of#4#INj$S9TnlEtp zR*Y;$v)YIyVZVn>-0nV$mQbl0Pu@i=XngN?X*kK5dBdZxPo&JGerS7t7td&9omhT)4g!IH<>Cm z9PJ&94hBbq>39&T;WSjCQfhB7I*5nE!8+ssby>DToH?~%e^h3(I83L~6s@ju6tfuK z+PFlpUEW=8C1jcLDaX(>)I>p^Nl*l1f=Q~8b)zh;J;(`b(o zqeysiJj8rY&#yf)Tyu4)veKJnG&$QPj6}TF>a|1#1g5!&X4eUX!b%$-mRWRCCu!X5 z9%N?8DQMuyYA}#eIi|K{!oW0W;a}_4aQeQrG-t#jw8V4?RJvulXs1%EA;$gi#DD+_ z$u46P)=&g8OyO7Zph|3ELCsJoY{-FdYy7a5;noqvs1{6$x{|M3u*K=4htF{F&d{M3 ztI7~_y*xW}yRHZ|pXMlW27^q8uXAkQLNzx!o=NNLa3MMtA3S}UV~@F7?*r$1%|Q|d z8k7f8MAa$(nqn8yuPLsb!Sq_sfDaa3TO2ouNIY@uHo-U?45R&UxF7Ey>>uxsM*D~R z@n|nTIy%@t9LIYgl!t0KI9!J~ekME6RAF{B=K9q3m{aH@1`0-ib>lauIh|8WCPzpc zJB_ zJ)(Xt@Ks@TM)ry@;f+e?N}~0hMjw?rvYA4xlw4})JkzN=sO5I37DKufQJZ!KT^e!K zQp-VK3U`oe2!XwnAdQgUyH?wB!@>KvwuyL#Ye<|!^f1(Q0R|lgWfzl7fIZ@rU*M&j zui~njLOe7>W8K5S>GfOIuar?BUQ?vfH{w4gfVYxJ$f4tTc{~dD#>2^UZ>;u@#{=-T zjwS~xJlKzqrr~sYbU2Ro2FGh*=JX;kA-W7MxeL}gl&-2Pt%u<3m``JHq4J{QB4Zjew2RIlMSOr&?n%i+d0SRBf^iBm?dV~!m0xdYmv6u$radg}jcX~M``{#ok zpdGusNqOUZw5mk?z$sBT6#5*T?yIb?`yQ?%Q2o#__PYX2-*J=4GuRA7YeXPQ(p+Gr zXhSAh*cxUb^2d}3=WKkR5uC zn>5$G?%_LF-d*irRc`v=xVxo~s`|)eYuwW7p1$En_Vq!&dG~(TPGB7DxwXvkc(kt$ zrw4JkKNw8I@$l$)6om)l(L_bZ69p=Dcrcl)LzFzrt*Ss_^8Jqw&z>3c#(OqeZAMPn z?k&`nXVcj+8YFj}F-=Ik%r5Nt2`DVg%cgZy5V2>bYVvlZ-7Zy6z?m?OOap3vto2RL z32z9otZl6Mg7ewbIRR6u&Vj{tq#>nUJ7)@e0{C<4W`1*`r8NVR5pX0=WraG2vu+Ug zavdhgls5D-F{t)Y%2;koZ+1-Y)cL$l*p@X}LUgP#bYgjm=S9stJZ?K;`$Y3Jj4-}! z`a9zBj}!<0O$%zC41X>Pg>#+oW$~Ks#4wn7{X&_Y6u)<FrFR ziL`VqEPn&|4RUCu%_Hmn5v|9zTfjS!*OsTNdbS)KwYfh{a0o1yzN0()>!t#AqEbFN z$tOv*Ym&tUSQ>0C%=8lBx4F&ww7Vm>v_@~n+We=o)~@*M=M*8t2XQiGgs6U3ag5c zK~NbTWtd}d#w9-Cq+Z|uo0Q5)&*tF$pGf~?iV%R>0j1#SI}ja_Puv6RUDyd|3%X_; zFrdaMIzETL)(G%ebrv%Fy2AfRXCb%?Tqy>dX+CYC7?e^EO#@$#Qbu<*g^d^&sxduo zR-jEPmno+svxFfirtQO|u=5xaV@o_%ddoZcBqU-b*e~KMsvU0jLpW2btY%ypk>N}U zxFA(BSJ2}2D?9Q zj;=lJb{*2idc4X_yd4-B+*!kI6J%Y{Rx|YuOdA62e2b5Em6q*A<4|@@zl$evS>HRT z?QML-G;C2#&Oed{rDD}UgOTQjx+g8+L^X&zarqd&qcpOuaUyESX|bC*1jXe8}&{p9XM9F3{%z9 z@~G9t!9VubR#U6cPzO%h&B9l*ZLec-ZrqROxsI?hZ}8 z(`yT2Ujf;astXH|G#|F^=;(#lGoA3X9B|?s=XGHYE5>Q1FhG&LVHl9LYy(*pF}-gq zzk+shlrV8X3mb{@&p;(sJ>Tgb4&-!Xd`3YDaIJ@>gM_)R5qwqVJkvztfPO?;VeJt% z14S^2?SSlIWh{!Bi4Dm7(jE$9ONHEkM1K)3;M+Yxz07eLOKCnI!Ql7<_M?q+ffa_C zaG;78d`gA|CbgX8B@-sN04eqZ_~cnYI|tM1=~Uu4u!Q-9xlx;O7Va6@Xmaj45_oM2 zYbopKJAj-GwaVzIL@=`;YT1`pY5OEdrjZiG9Qv!v2yIVfg+v3bfF~B;54Wgnsu+xB zKL!B?johUfgWzr#Q${e!syJvi>DTSHle|H|!bSE*gJ>{1K0Z8}9v=;lhT;CPiud;> z(Y`t!438(H!{{(P9vxg)uZ?eH9|eR`qMgeO9(vz4p^={g$d?zTZl~lAt_9q5M%Mt6 zcYQs+gsC^#HVhBwWK$FH|LEb_3qnT0zaXS3s4aZ#EZ|(Hz!8_pT%}3Yfh^`SSgolI z<&hR{CN|>_SR5W}PreGtB85{?5*)(`%al51-4gR0ayd^C^MaMn6_^umctDwn0Ow8+ z*D5a}J}JeagTra<{z-v-QcZL@WYm^Cmtzlx9B4^vBmC)rSAqmw^5h#3Nd{3(VHZJD zm%t?wlpj>l2Z$0y=HIYiPbm@1Mtv2P#SIC;-D$yS=k%z*v;N&mmT z48-E(rT}bgmNe@y87Kj+?Ub)7O*n8$6H?WubB!Gx`m~_bMT_F1RdFNV{G)9cqwT%h zZpvUWJN0zfBIFzI4gx}RQD_ru?q|04)iYGy|C?u32JinA+$W{p>VrY=vTp~*3A^-k zUu2UF8TO4QE)I*B79Pv3QCjHm9pTG#ybcuw2V+s`u(~inOM|oV^1*?^%x)MdX5o{p zFiJNI+^3(4`hp#)>v%R4{S(3BG>_-rbx!M=7U19Mrc~PY)68+;^c{hTFZ()(HzipM zmV!)3J5Cfd>r2^P6BX?=F46O@-h>9oys}=iqw*E2>eGkbl^&n(?PK zxPNguDKMt6BRFtO8Ss{2ONZkmKE7L3U4fU52v4t(#<)h}R>0;Z8r9kkrHOFctF;2S z8XsS_G}yHT{_-xY2Tky_^U-p|>A@<*>5*IXK8^N|j?^$dI-ZWzbP%b*aBnm?IGP?F z?jP?(!|8B5fw$KIfP3ooeL|B+CscTWtsH-IZ8!hWLDS+Qv#7|k{_wg_a1#*96Xy<_ zL?E~gnL(p~J(`4q-sWyo-sH7tM}^6|&{S9&P=z5q-5s8b5yDl?Bpb`LzdP_#m+;G^ zDU>8Z6mpS|+qW)Eg^%NVS3KNrH@93b>e#NsVc1M_isi|aR z$i51PGo^i?U#vLXCsagPPnd{|*?2hEsacjHlyKbSP%F(8gK1JLOuejkgNJoc!OW(; zU^qB-D<4Nk!C&rJ@LyUt-R2l^y%|>kw+V}px^92qU^g6WzSl)@@5ud<)7TFcYMj@T zRDhkMq4UKl$ylZippDs8zRBe{@~-_Y@>6m$WjAco)jEl-*t%tYB|DNf49EG! z3l0-q8RW?qn3RU;<6nuBlO0Xu8d8X1HfifKWUM5wyLnj`(kf97guk_!2dN0wb<^}3 zYaUGo`$zD8dww73Zcl=A%|5<4td=qru(s&`^?0MOn9bIJ`JtR|V>_>2T~Ygv_)}h$c*w6E+&J z@}cYZ0+$%(>R&Z|f>%1LbKFQcM@c5iQc(!Sj~0;cR$~Z8XFYT=TTk~L6pdF30J}2H zz63x@t=54ZttG^NPIB?Ec zEIE$Wp^(m_sGgg+fiojMh#3J7w24zmi&8jTqIx;`LG`t(pbuA-R2({RdISEWV6Gip zUt4oHr0e^$H<6H!%&l8H#ol`3q1{vj++5ciet3*JsVE)22{~0}gl09I3X`FfdXF4Kdv2;mM-n^Y*Xa4-Gb||29Ce`M=`TS% zB8mth8HNNvgA;Y~htgJbXlImK&Vv8*&-Fr*j!p!#A)*Bk8QNM;m+wS)Ru~k7Q;dm` zLR`1?pZ3*Z_9{gmXi= zt+3snSHRq{8YzQM*kHYz=1ISuam1n(OTlzH15uA@!K|l{(*v!6~9!?HM2S|%I zJ~&e2LA*a2A4P+3r1l2;`{U6#9PM435bq|Ajvp&D+0Rs_L{9e`!$G<+DP=LD=GGmC zxP&653z8*Q_pkx-5ZCDxb)$A^Cbf5K?b5z~SXUP~@83UpbQ1jemwygUm|Tw@N{8Zg zaKhASFoU6#ej~+X9_5y#lEh2O)F*=3lVpH03D*k`=$5iG*kmQ)7!#o)nrJXNtnG>KdYMi(K)$#!cOjLTyT_H9yD{q$($=vnMM z(jl2H-h7rNy_`zsSEuYaqykDeZN#oyKEj(@7Oc0wqs|;hs1BwD85nR&HSvV4APC#S zwgJO+$!4*^eYi-@x%N$zF;eYF^^!w_Sq4(hw`gs>_l(eSt>*mMnphjS4&%a!Ak#+hb%uZhz3iJ7 zKwySO%VF2yjEbzv+Y*oqz(V4tve7oz%||tR?^nyTvCYV+?~`jv6tBNdjp8u zg9)9cx^;rkRg)D;FglVq9r1(W>eusBmG&wgq6MS+QrKu0OV-ymsWS&wpw1gAISI2U zQO+?%t@Y5^_(T@@=U@Ii{Lgcj-oG81YGjij*$vKY>vr&|vHVPf3EByp3!xA9$Pb*f zyw`I@dR6$TXN6j@NG7!;9UZ??A4Dp9@HdMrFAAjE)^n-qHnNYa5TS<-iPg*D-gr7x z$J22C;CQe<3is4eI0A1yjKOG!u1~+8)c2UT3Xzygs+!7Gr@G^JgK+4NT^9+XENur+TKuKE8kQ z{P9kYD-Vld~5-k_CNh zj40TmY>Keq!3v@Tv+HOaU%v+I&}DTWsqiq`593%JMF&Tty~F*(gX3YO#)IMh{^8&_ z9*zzNd*kaKl$(UvPe52xNf5TGL-)ogWryn?_7u&C?)}0T4BUc@fY>xe;|+%v+=mT! zG#K;`Mmxd%i>jKJUp#m)$Etu`(BswadA@kSpZ7-(c8L9o>uspd6jlvXppsiX>kN3? z4Oe#shXi^n!Dy+l=uE7dGDIunO|~2X?YWNVhRB`d;9G4G2A5lLY@90`~%i2X0>o7S1^`QApez;Zc};tw`Zncpp);xzEd`J>pw3 z4-cuq$cFQr7@e)5F$_VzhyWi{S8tcZee9ZaB>@`J+;oBWbEdRM1Pe#X*RoY=x|its zs&^GJ`Ju~RJPD(C6o-@1=wR<)98cgs$HRC!Jr4JVhm$A@2Zu_H*FsEw=1fST1F&s! z`e{hi7p3GRsNv9k5WhEVmiwEC(!6`U{^H^i)+9}`pMrv>w0II99^Nw->TIL>t^SR^ z_39p~SO2X!5ntPhI9WLnW^^BVvYT)gFa|-+Q1}MJG>I}uTyL3t?@m)kasv%he;RXa z8Y7@yAucLbj9o|6tO)^DJwyDh&vXYe(6^?sZVkqX*W!4)2s^Kd!VJzH6?}nwVXC8! zZ04JQYkA#}o@Kh>{uW@RqkktQ7W%4qa~5x%DAsEq<>i3+!+v^JLGwa1bu9FcdrqV)!i6~l!8#}1{$oJ#g>Bj;wH&W zC(X5Hp2CTb^VeA~c=qV)UhwGqlb1cetMbdIr@O(kT;iCT%Z!avFcHyMfyWTUft0~g z2qbfpb;Mpm<>Y1S@=kdv#%ctW;Z9K5$PP)c?`AD8kDLk_p4omZL9IT`BSk9KVWfO# ziA&{%fxY1-U712v)chl-+KreUN>io+g^f!Jnf>2)p~WB}qGTao!*FfBk>k+5}=>@5>{kw`N> zwIHUID#)=GBH~JBQ6SQ8+Ic2h_aj`^mEQ6`bOnBo>WIS{YQ`y=D6dH(iMTF_&xe$~ zZad|$dQxGd^#NECI{;U&2Lm>YZ$UMCO|aC6yD#C~4EK(L?p2eF29?v`2YZJ{J?<(o zK6wB3FPjrdVwtcFhl6WgaWvkSEA9>Oir2JGj#gC|962!kG)b8;QTRf+M4ctiI?nAW zA#DvwBYV2`mYX`czt6Dxg>q0xR_wGL&XYGC2sYc)y2BC`5GQvum?M5TrsJa7A&{D1 zLqC?4j_M#9-i(^0Q?rb2EB5d}Ts?aeWcc+UO*9909*JU?`n6`z!ipr6~g5H8>nIT$;8?c+we{`q} zTNp_SLo<;XBqMJMTjDQ}*5$ln4kZ)8*x4#-wEDCn%&^LEi$AYFqhEXlI^Y#4%t$lp za2ZP~t+n7JgA_|BBWhw}4yd|rk@MiR3Ad`jTyCO-F64&KSMP{Azt@ch77xoo8OsT< zS%7=n@>*=TUW1WXod;I%u!!>cHrE9ympHVg!!b@dRb*VZDdDshgSN*q|&J{3z4 ze?RQVJ`SxCwZbD^OBD`QYwG(_XhGkXtZBOMCc{w;ZanS1I&}STa$H^myN*3F6H8{R z)|=S2vzpau zmCzv+b?U`+S8iGoAc9nDVW?4+UT4p)_e8f_ZM51M<7m5Fey7I&?@U@S6v!cZLXgS>bXcgRhIB-H;i(y}b z2Cy8|APUyO1@XfWHhp9uGUi^_cWWJ>y0(^3keNfVj-cH4PF22FVy@*&bTW3wEIt@(E+_sohx*$9%!0gB?1Z5;;bY{;TfVO9TZM-@a$z2WSRIFl$Af5kbhxMDI2uROct1Qo z*c-*_NX2R&cAL63%;P57;fLYwFmN$%68f}iE><7VbZZKL8uXh*(dc|$rMY{S6x7J! zBMIx$ruqVwBk-g_sOcmZ7B}>f+3CK1DFv}f!fKIdMxsu=#yZD|DoURfp=bo9s9U0d zW>Zv}Wc3=@*>uGP|G+J~c-yYAu!$rtt0=2H`pIQ%7p6y!80TopXJX6fpAb=v`5DbR z`ac}$p?x8qyGTxaCWW~fN(PvD z8B$e<+x)=!QpEp#R(wdxxUllqU%ZO+`$U6P+~Ab|MaMEfup{}c<4M)@W)=E|P++~| zy74@5PHOp}9@qt6_XuUPOioHsZP&uKfR5Q6Zq;J{Ak>I|Fg>euwvTYINJy&XT$X39 ztTUyOED^zM${BIO<#|Z#fl*a1{xQ84?G-IIh;A(*BAY)Kk;_4Nz6BXAVrD7k>ohzM zM1>g=I#Y}(t+n0k@qzN+ObfOHa^{``=@E0^oe)n^V_@+j9Jv-f2;z99v!+dwB5Zv@q%%+5mCY= z*())?*W`BW1<&j)h5ka{a+9%jx4pvhjoP!a5iM^pU*9A%!+c$5wtL<@uavMk@+GuW z+-r1Z&?pK&NWfl**RJs!uZLvsCdbRokP%%}u^@~z)!1q{J7Phc>}aTeY}!@1>4#)C z!(zs;a!SJd<3y=r@bl60`8^@9i9TeZaS^8D5v3Ez8_E$hk6o;sNE~s)5Y4DWFDxSk ztdwqB_@M=KsJA!4@)Sxgjv*p%G~Id`Op-~Ot&KHp6~&+^G~IX~v8?3v=+??@amUTA z46~R&3?h|=XJwL8a}@_5Y*;Bu8ic@YD=OLb-lOa5CKLAUle06O?*M&9Rc17Veua4x zd0Zh)3x+u02sk`42R z{sKcLL=>y)ltE)H|EX*kJ1KawttS|>Ifw6g-C$@{9&grAZNk8!QWv6ZBkG!Ku*e7!p2PNgY zTnJFmYzFci+TyF1@u=VJ{Ey%H2cPrK@4`^V-f=j6^za$C|M&nl+;0qlmW^pF-8f-< zNmBwbOUl(q?@zfqKkwA!-tOUNv^y!(W9$cak1nwiUOo$v64dLb8(NX+QsY~3OYW&> z?ND-KHc!%RGz>oX4S2N88;~(>n02AriPP|fdZ{xk*)%z?3n4Z!rEwNr*bbi%O2ckN z>NZA#Pm>T3boI}_{BwB$iny=JD4Z)pSYhhdA3lrwM=e{<)X!HeE}S*v9-PVFBkQ zpD@u1HhV8hwc`g(Oz$NNZN-XXw=TnNdVx|sbjEzQk8e4{H291*@^Wjz2{xRZ{lLAw z%{wt8_G+p>Ic-wqBK`;&tT4G=c%?vbE4FC5vY7K?(D2|D;BCSDk}%`*uTO&U@Mz#g zDd2cXg{}@a!f@Rx>-KlUT3Bf4$-tB$q@z;~Z#Zg@5Ntx>{`-c?>*eWL5C8KLfBF5R zuXlPYq`-Y!%86?0OJ*3sKmQ;5XW#z$|JpyjU9@_QiM{te47E;a2}l*X4%yTsh3)nl@-?yX4c}dK$GZ>G7zfLj$Ljob)E2&LiBdOG=Ow00_ z-Q!XK6XhvZ8o7ab_pAD2++5#3fAsiy@YO%C@s%l4WQgO^%pDp{EOLSnKxH!=>y+EN zKjDoP*|f01OqqE>df=vGf;-XLYA|8fE@NsoclTg~M;?rDbn^n-8=?kB!FL-kMhZz1 zXl8E^&YIX;0(^~)t0k^Yo!W)~Iz4JYfecf1t0&#q8y6&cTiq?)4{LKpW>^-8AL#`F zfhFge<(n-rCz^3BrGuxlqaj>is<^oqrcAp*fU*T0(4%dC*``4z{2CKFRbi4ELJLin z?sf;-L{X&MDA7f~gKQ`EykU7*q;WEv+vC1!+Wt zgY@!!%a@R|Ik093P^Gn-cd);?ElFVd=?3`RmqEzH0d+*W4b{BqN_q$LyYc%EUf;p| zew$f-2lHE_6E@mvn4d$HYHHL8yyqg2Ko2jNkcfSzIAKz-AOGR($&df=jSxy{)^0Kf zS&n-RP`yxsi_5k^L1pX9L*1X#rya2Rfkru@Mj}KjPW{bnEN|QF{m(loHri&4T}MQW zT2_1Zor2rk-_cvm_}1QTE1RVfWLDy~HAo`IYdJ$wh4bLC38@9AU}n^~H}9X#AD?nZ zGaB1O*s$^M6qy03Fr%ky-^r5j91nI)6o)U^eK9AhRih;XzT5P-zUj9bD(B)wnK&vD za@1?pMQL;o`c)|Ana;KZ|&u20wuRnis)07*9x|5`^s!-|Pfz z!O|DFhk~g(b>%AhoK#rN+>?5{%U+~AC9SPH!S=+;v?H;_1U3#Ublfl?%`Ao7DM_}& zY{z)goK4@*SB>)UjGtMv8=;Gg2acYv)V*tv*{7mrGzA^#yHjz?r{Z&hztJ{M*p3D( zCZtwB?%9cvKp;C8T$!+SX=s|ZUKr)i`)tJ-B6)8#&{WlydxswUWJae(uOM198BdUYM3P{^n*5qO1QPcpBaXvtegv&oS`@o*;>K z9USZ|rojzea8FR(zNQfTYrd&=Cs;-YqhD3{w})}%KM zi}wiH7*i>SswHR$Gmvz*tGYWyAAgEICxl(8Rv)Am2wzh*;!c&qD-E;jq;z!ojXjgx zqxZa?qpQh&oD_|5bhU>)^N|1EplYkRy4+%yc~U!Q}OT)}s+U9Xx%>)k>5*RUJ6IW@Ul+&RkI4el8-#?(Z_xs?KfA9X<r1D3N_Ev92mH*44~N1&tTR(|G9=e={?@+ zo8P2Y@SlJAA2;~+B#eH7LlON1X6ub^@;}!!d;~yeLdu8b<4snPrAB&FU2t%us<5eb z)0la#9_2*n^SsW&*Wo3+ajxEM+X=o27`Ou}+U#BIK}C-p#{1FXVKj)xYBW-Nqw&FD zavUB^C!8y|(o2S?+HCa}D15a~F03TGoHARm|+iIg-u0Wwu_z8wu!`6{k_ zAFK=N&(kqYtA_cTi0~bfd+w9VN`)KsxXq7Xz}tju`uz18J2*4*K$2sJjhq(3@H|$YXV6Q7!EXCrPu;#P5^qU~76PYLU=e@uIoreLovCC&pY#1S< zN$Peyx16d{-{HVWY$#WVq!SLlQ4c_gzF}vOLYixp3H>OaYaY&$qs;gtOu@v;*+X37 zKu~mJwD$~|2S`NC-_&*Fc!U1QXfx@&xQw^+4vD(r{Rgk_kf^`S_PRr&uF=vSZ#5Ei znSP7ipu|kg^5U{zhEpmRKs_*LiWH;d6nBmci=?`s_CW&K*TNHvEI>v^Cf17e5nLUJ z^mtz26+WWwX+~q9$nQC-gC%Pf-bE&Ed8cl>OK98D;RaYZ-M(t79N}F;&Dw24C%54R zDO*$TU$*114Qs_{^SiBf%Uf-$L7t%}*f2*P zHM#DiZU;llu(W;QcAx&0p^M`cp^M{zSLM3jM{pY+k5JD~-*K(i6tvh69yRakI`kWh zNRWf5dy%{K%C>7hqSDzM-KmCP-$K(nU+vKcc*RU)9T90 z8o;TE=je;~1zH2IF_wq#p-#16g-cIP-L+KPFKml1Sapg0Zm~EnT*tP$x{EK|`2D;1 z!d-k}i%seM&nmv4p;&5bELBhg<(Al|*r$UjC@epQGE*i39u$0$aIJykVYF&0od~nb z`4VaX32Qr-dK#<2u=}}b9L*&S)=ypnkE8A)F9~*<29NP-m%;s)FCX6#t>5xF-|Fa0 z*kO1rvut!PXO0=3W8cD7!p>%)y+SRYrF3;60h%bKTen4xIN%4fq|$`~t?wB3n#@Bu zeJS#xIE|fGfJ9p}z&uRWbX#Je5_?P}O|b0<*tl%=;?9&|?y@XP+9Y&L%1+4mmYvAY zJBYQv-9aqeZON45PSu^RZG6|B7}MF&tCNxjSxhXY{oN&vA?{3>)_1Yf%H70t+jw{L z(iJe~)>S*Ev2w<}UPG`dFS&z>2~9=$1xq!~JDN@o=Da$=lDN@P&#w&h8V{9DJS#9o z<}0}U;b)8$k@u;;kbwbF5KdIO`ylk7Pb7&sO`;1T&@_@dkiHdItfH%6Y=vf%Kv8~A z*?<@@JX!S91aEtdYI-{%lC(U zmH+2%LFM<<_MfA^*(@#G7JZ9=(9WzA* z!H?0jCV%?m>Eqx9dih`^(dS|ROd%J01>*gOkP0sEpPc=$ z6MUUCy|)if;06pj+hw5CeTA(v)14NtUB3iOLM9dZ17YH8sQH*PsgX4tlM@i zh!ZY&QHBY~n1{i4>UHqA2yxcXwdR>jNS|Ym?q?Kxfw>G`AOXGTFan$4-3M_JzeWeIx=nl zj3W@m*>d*ufD}R*V){eT6BB(Hu_1HkS`3+2x}lzQWeQV?C&)X zCz<20R=BxkI0lmh{wxJ_!tHygdf9>WCbPNx+LhcMNg;ljp5_kpd*k;XyuJhd-hqDC zzLFmYJpvKD-JstNDcqD!B5#G%qf>%n&m^_}c(+r6JN5*2svwj)tZJOy?Q`cZ`A z!d>jT;g0ZMVsJ}sf}92RyDei7xyf$dkt#S(^GRrl-&u)t1EV06?8d7fp>oY*m68$%U% z!8zO{#DWIy2&*)^fC{n%Ulu6b@pt$sH-Y6lHQM$vqOvE^DQ;P9yZG9Mfx-Y@dR^H4 zCc@4m=-$EHX@M}5ROkU$6+|{>K(U0$s6vIFE;hQ}9JiX&h!__fJ7MdcL(SGr7i{X_ zh~}ik-OrKG40m0Ta6vNmZ(&*qH-jtWJJ|194AGi`5|q$qi_-F z37od)U5lWw{ff|^-@bV9Og;rsk#K*F(&9;}^8j(}^`sqBseH3QBBu|ZJu#(Y8(4zh zXZ8qp1#`%bw|;_2d1wY0Q$kJ}2xH;6UBSX37G=a}Ce(xcZ7>`Rc7xw%N}qZEoG-bN zz7&<=dzZsA!xig6iJA5u`U<$2!lk z>RZqG9j_zngYsB&cFb$o0&wn0E=vn>X(}IeMTqUQ@&ZZwh!Q)Rko@4HJWxS@tYnW6 z5oI1ThotUI9uguS-k(b>8ICM=5yG*R)G!Z6v>WLD?8Lt-o8u2l=Re@Gng(gFv>o6k z=eof;=y3eUjelTXGqH4+C7V2ka5YNM2n2O>+o{dlU*s3If3nxpxNXza98&sW4*o@lFx6f!qYX0p-@^t6PH(xuIiw`v+sy>0gB#Um*$?W!zg zkDj=;;WxGY3G7a%SF}w~xCP{Go;3%YmJ*AvB;BQ?{N-bpLKbdwm%_O5`*$gfyA;M2 z$E^0YG=)*LY49oNw2-!DrBDH&t6a_*BXYgS0J`5*?#$grDSA#;t9~yyCm@BrB&9l&|})R5aH*YXxZEDL`x$uC+0sQ2b-A$#9Q}mPti$z|QI-6r5Ql`bi;tY$KIYnyubo$4}i5 z%7iLXB0)ug?10`6F@}>wx8_*t|9zgsWp!i%LQ6ADo32^ z675-{BrNe;C6)mcVmegeeEanM=WSn(w%fn@5Tc&VMHk%8hzbm=^E(3L{16__VQkcK zXN}jKhDn+(9ROz&HNB!CW7@ub`gudvM%(QN=>o1$Qf1A?F^-Ghxr-3dOU^f9QM4+KOe0e{iqv zK$o|^gU4IGgB!%N3+#M|FaX45eP{!F8@|)mQeIaaieH6XRL3G7cjWy>QDm7=O&lGM zi>r56{|lp0(hvs`^O*|8_DB{SGuUxkDA))VLBI+or;Zi;hO)2(F3pm8orb<2c0K3o z?ks%#S=it5v#_)-bxHzy(Wpx`&_}~VImeW>E$~DNMk+^j?BKF(b5K4ZU@byS%r;qr z`#y{!Dn-RpB5+U2l2D;Cf|l53CTIuSO;U5{R2R?k3?+U-Xd~VErR1+Uqb>~}K}etC zGer^hIYR14LMk~mu2C8yAS}@>ZUop$wcoZepObhIu1X5r;7r0ftfwJnmtdZ^?Xdke zR>`4|kSq)79eE+WaUZ2(-xQ0}1g|NIHx3@Q@AYW{cZA7DKy#zIzGE_$C>KJ`g$Am` zNa~AvM*Va-s;qvlx$BY*P{(S97~4j5zD77MbT*gH=Uv0yyCB>rQBQY4xHZ}$+ud;Y z8sd-y6qvGHhaoVC9KAs7zGh)@pxm(xRfD$~L#H7p!k^)U`!Gu(P;fMA5aV4VhEcpm z^=6u+mGw<+>vRsdpn2Z<5QH?^Kl)o__{>ozn>vP{>%77q^f96;4ohTix;k<+gw?ygEot)z?t__?9<4OIC9&tpgtN zQ>i$3aZxBF2&r;f;)mAMS|2~Jvxgn)GWNl1av6m zVUroo{cL5$|7hsMqI_^!-Jcd%#+=3d*J^TI-F+h_S07YX2l|G1UOM$=x544C7If3N z?ybY}_{21>Buqne`tl-C9&FyC<_#cj!Tk`qWc)CA9hh-7hnk5 zy(|XW9E7}NV9=G*Ekw7YkJT)UE1lOsI>+Hk+~?52eZEwaLv=KU z8%^WU{?YzmGMcD^@L+tXj@8lO==k_(dNhg$>)7Q#jCO~?BM(a<OI!v8~a60usd} ziw(T}12R!p_*pE56_KUWQn^Jdr+W=cAs+HHUxdZEkL^I>i?bf{Uz|~Y^56xA&4_ov zIKTJ5J$rGs(+f^WmpC6h%i(^P*kI+^4kq)2JEMVLah`^51g0~1%9xAZ*$p0>nm#8w zV@Q2d)o94rp37927=)ySZy9w>tWH0oEkxYYSweL!epA>GNkbCffkkzc*TE#sxrEH* z;Qy2LT_p2nh4JHL$X_0fC!^zWG#nisA1H8j!s&Q?Jc&nYx_>yHsQt;o;qfF=YchWJ zxS0upBqc^*CZ-Zn?aC~{ zo66K!_5#BxNnJPaJvd+pdyFUf8~OcVlUcHqN63Z2mNOei1Uy5r!h!u36 z*45R2Fes7jIR9(R0eSTLeUQl(g#h7Dvy4mGOg0NgOG(Y`7M>RPF^|vjW99+*RjQkI$n~Lf@{-{uV`ZN zRfer(&$q5w!*6x(S0jXu-K690s82*U=XGJ3#)WfuO-}s?RkyvP%X0kba~C$drYV5T zI2{@9ju|eKiCL$q$EH|^kr0iq!!$&^phzgh=q1hnD~4DZFz}s@A1ECv>*{ERh^nQ} zHQtK5(pmMvda*8yqCo!38ihh$8y?rZAC)l;D~ii-YEL|KmF6Ud0F-8 z`z}L}u9r1b8KC~z?ZtcdIGg=Lu+D@DgbHBjn=39x11hP~Si1 z9uH6OuMp%*WHtvz#e(Mev)5yS=|P1dfu%Qc&LRP)Q0+S1ATGfB-M)H}&wU4OGY_Ac3(oT50qfzZo>Zz=<(J{L*2B-)PZOjZ38 z9`*Y_-5rwKJtSLA&>`5HcEFLsCg#ZWnA0UYuQ>+6eJKf`fl^!Ad)wnyo1;cGrf|?o zPJ)f!za1PO1bI}cs?=#TRuff`&w~X<0Fn%eWil#7)p#EY9Gb|9Ynu>TsQGRT#ugKZ zWsCgMr~)R<5!0lnV(*@J=33O@ zp=O8G#ASE2UEya%oJ2p)iR5YP{N&F&&bjSW9$n||g@%(c(Ooo4?ElZ+ zyDZ0zWm%%X0_zdk?XKYak$1$DLRrdIgjk{?GiG6M;J6bCIN*r~CB>+wJ-(A_vo5o+ zo@A)gtVT6y%URIwkJOjkvmfW2eE_(Vl-wzJBnFuwlJ0n($KGqNz1B!bwZb26*g?uO zWkhFKYxjf_+IZcp-B+W;<&)qlLA+|k^Y~rxUzb%8M%Jg+V#;Ps3CQiWB7+&SjueU) zw)8wq#r00bzJsQX_#Jm9meN@=9n64QM$W{ffp!t5`WUunX|(@Jqyh12AmV*)I0E_& zQP-4|tZy@W#ab{WYR|IDh9$!JBqiDY5M1a@QD5}Do{t*4E%SxCrktMq_{>7q)E75P zb(e8jMBW%!{e~XaJN>T@_;i*(uv@yRy|J##)~^>##>aZp{PrIV#!)6~#$k`t8Qcoo zUch3pMtlfALXU+hJ=)4FnNG4(x|F=rUa=}}r4aH}R-=r=FE`P!Oy+Zn*3h9gUR1EyZltipH3 zgK%f^zJ%SlJv_ENK(}bDSkch+cp&W?IOYUa1(#l1i8u&{i>z`>R91N9rj`ViqXjBh zo8pt}gK%ti?~w2{xPG9Ge-)Lbcm)ep%$1k9g&q*+!_#5AIZ;8cYs4XXs>o~kydqYARU zXLV8i$pn72ye!$u^kAyIR#R1|!ka0zHQ*#-x*q)10eTdnC9!9<|kV;%|RuPcMHGUZ(4+NH3s5(S#fFS0bPGMAes8+Pb!o1 z32AwQ$B?OrbQEEq9fQxnniSTRm6j)J8#?iH$PY`~X}1?Us|Px<4vIpGUyM5K?Z+p< zw|TV^1N(mb9G?$|N~2(6%z_sMd7f~7OeJZr2bP-5@=2Mex4*O*GhpEYRHBWaP64^O?djT9h#rgxG@_N-)nGNZBfwK`2 zN$kJ9cxWYTag-DG;wkCC8>^J|s>UG}TNe4EUcg^Q!pD4~N+_FhE?{yKUwSi~)ZFDN zy_XDC7*P&vH!XudCs~}o8wH+sT2O_PESyY0JepjkLC}h-Ul5zj5&7G?^%nlKl;3q= z2rAwDu6@bx+CMou+dn(oS9>Ru$Yvd z+h!+(DL{S^QrAl(MS{^Tp+d@sjywY}_)8PLF92c6rS5PL=AX^ypBGH#%homyqFxm8s%kcWd%7>}K;+zDdN0YnCzflHOFmOuR8 z=kW*7Rd~o_@1nN3Y#fv6NI4mlR(eh^MZYXNl$;v{HU1X!Iwi9=jJyEM@Ga=->Keq$ z;2B_Q&#rUgmzFu+7!CGA^g?z=cywo3T5^+7Hsi{hH5*+fse=$|hzjpIPZ0@|+3vZ& zsBrgdP>4=Ma09PPCsA3HEU@n%#FLeDd?isG2BcP!5~(#wHFz(^EZeLF_{v0~QF$(v zww=pjEKEuUc&EV{bpQ>uw2XZL1j&I2fB|6%5F{_;?o^)xn#L>iACxD7FX$Jh$j94U z(#C>?hv+@)2yy}PJrB8>hsiuY{ zW?3Z_F}&nkLAxdM(r-wm&`N!Ws~X{kH@Nh(kfBIb&rg4&1JC%uzyIppz%w3r#=S*d zj(f~ARzy~8#L>>Rp-!k!&W+Tc89{W&EjHS$T~XJ!IxhW6ac8J#qvR2)F1sV+s%*HE zWgFDTvOJ$yR^zPKkS8)l8cujPqdA4`jBLf|@1HuX1*IttVo8&yLmLrMuCiWOT__CC zo14nAZ_8JK&$$ez3OGP;Gf`rS@Yrs7hrP$pR{vXJh#vQutlhclh$Uw;%S}U8Zsmg0 zp_J{dFgoH!IAU%TQ%zTeO1qgX2%197XK#b2HwxCN4B$SRv~8}d zFfs2Q3rQ~^-BME_v|9A1` z=|4dz_w4JJU%&Z!WH3?xaE8lVGL8p?tn&8n`i@8(CL~iVu7dMg4%gtF_Mg7Kcs2@N zUA}qo>f0+g=O4a)L+y4q&JdABN$(X93T^EcM%3sypbb-SU5Mssj+9~Wc#{|xH!i^9 zp4Z$=rC8&LKk09596WN6Y;;YKhhhv?+GuZ$;V=nS^lVCPH=pac->hob&-8%8E}cRVfX!uAr^=@jp6VO=6iu{3y;Zd3 zCe5-nAI*#P;$)VYZUU~y!X&^>i}HgG5Z^ETDsF)T#c<6-veyjYb|MXC$d{sBrAnZ~ zIml`#=EKtM80QjQph^tt&lf)CMQkf9n{rY014Tp0NGFJVY8&XVHg@s5~9CRE8g;L#UI;@(d4HTwf#{SUT#M%EX;`=r}mf*RvpIf zM#gTR8MKXvP;z#Z@A(4%CC1-~8P_^}&G`otkUAet8?Wx#V3cx4j#;V8*EK*`t^jci ztx$$krV|bL&N&mvkFePTHKA^IM(JONBx@~8Fq{t4q3)3qlg5q6i#ysp9+3Kac&wlJ zQu)X0(!N{&058v@0KZoBN)46XM)Om8&fMr)G@C1xGYWOhn*|FBZr{QH|5;A;++Ruc zJn$SvPR2Y|A)-J(5jSndz^j8!v<*=`PrxwLoV&Ry)h_Pb&?tnQM~e}R|v`*Rxh04otli=h$FH-a4m1BUzZsAz;0in z>k^@mHj3w!bXSH)gpCxQpJxetXSfX=q(M)5BBUo6he;aS3@YPEO#SNhi(OxEj23%> zS&EK>c-MiNVi>XjV?dn0NsPwS!$~Rzirb0JPz3Xt14^v41MUB9T~<`6j&MtIU-Y_j z?YVn4tv@$-IanFI9Ev`bgT0ee6;IEj^V5^F^Jsc>etdd3IXF2uIX&AuIowxgr{~k@ z-iCsg)8K+K0tgQvXE40}lB7`jB}I%FywZ<3PEfZYwAbEk4y@-+mprz-DNj~xp2w_N zKsbTus#x(X{55HakB0bYh>w0t@zH6&lvsGe|v>y z>Cg3wbv+8MuJh=}cj1kWK`yXA`Fs7lB-L9$n#`_sZ1?TO)0ZZUgJ%Ifvk?2;y)u8v zsj=O4rqe$2QCqX3P;pX#cw2~&|D1wtLKqu3CPo%uqw1B>!ATxET2Y5u5DkKzCil%m zBjDB7?rGia!b!0w){4Es5Z0m6?Y~!?Tu3osS+E!e^m+$$zZr9G@Bw(O=8#(%tKas3 zZzQQnrJhu2yvt^mSZURZe#K7nf|UtSy`XIwPN` zq&0_SIE9)naTc@OHN|^gRi4FVS($wYr2lAJQNeewUk2Ak)XZeA9aDJZS`6}qqdbIJ zR&z^&qg)Q-a=qiS*Q~B)n++9Z^)jV6K6hYTV;j(sy&hAA(N%8_SgLMfiP8L-^gwo5 zH&$RCz8^7s>|;#M9UaYw1lo}KnaM4dd6x;4g;~J;BQ1U|I(WDW9Xu2+WkT(=92-n= ztr*~IafZhN^-zp_fyOq7NLzCWy@8`GrJ%I`?#_$K>N)*GXN0K*uJ~E$KfZ{~FZcKM z_swP6Z!I4p?q;q(EFjm+ehdnHN5zYH|KRAqG#8q}e;MXW|K(oGjPd}J6 z598ov0`E-qhSNt#Xs3eKGyba!MUNL%E2lT6348rv*r ze7K1a=M|sIl;iPKj~43yp%b*zVEP~6PXGBO!Z{GMFA|ao1EPc8 zjk&2PL;T)cVkKJqo6-CN5|0dCJ=2W$@CyA$YZS<>Q#5g8%bdE`fRo~M0<$Ej^hHt$ z+cu;nAnW~ciRM(-8ncq8aOkZuPxi;|ZI0twE;eHxOmL?gVJhgegQBLWzl#+p5NCg^ zdF>Mu!bx7lc1n2D+)cAiQiT%E6L2dE+5|!rbI~8efivP^8yd|)C`x>o={HVbFnDCO z4m8jZ9{l^S-VHQ_frijiR8lX1y`~{_+iehl4MtZB3>mv0x4)RymeSbOSn~o>ILTvnq>A+CqYC!YQc~i581=h1&&Ow@ z;KkLe@!8q&`FMX910kIz8NDpMy~Dam_k8;?PV{d6;^Ny2B&-r$_1C|Vh<)(u-$(Gn zSN}~vW&HyL8t^0i)HmdFn-vgX3iX+@P^vmDnMhO2lMF_YC*-_iBL33i>?GH%dJSsD9$X|K>ThdUeWoPbn7A9lj?fQx9r$%lOQ{Rflr*O^U>CSmlW z%Hpx!m&Vfqx6F9dVRKcGcaOMWSrgQk8m43>$NQh(h}kxj`+oddh3WXk-awNg_Y%p&#{Q?Ga zKj{~R9TaG82F|r*kkxZWo=C!BE|qk|fWfST`f=Ha8$3}^EvG4_s0Sz&$Cd9t0p3@Z zb7u`9>>y|UGkzrGuR!jESE9%MFEV=3ABMl_4@1afGBH)?D?sM!q#%jL4`qc=>GqBA zuimX-U>vSyU>u45tW&jrbQ(@3;dBy(>TrK=a=ss`C_LMb;-k~U=pfpgOrx_6p`Hi9 zpCsap=wVgVWSbmIeJ5B?zYO?^i#TEc5OQagf01g1h6BYmX3CHZWS)pM`G!QkoyIqN zTqF(g6xjwEvJm#f_+i`lAI)c{1x=33$r2i2ml1bJzBT6HUYtW7Tl#7;LgP8if~2eU zBJ{+{7kVSgW=s0z*IM6rs!H2W!CR9pwg~ACJ=x7pOD;18nl^*WzXkKx`aP#rtc{}& z9Mvh-8}L{Oa?i-phqqpS3EaopKD0uia$%BDnx0qszyMx9`1b>NJ%HCej_D414PNVf zzU1QFoQmvaXHSKnZ^)dylu0?kL;76fsjAOOrV&uCzB6 zSUN+lq2u)>G07`BX?-VH#JwG69TpbYu(LTGvgKPQEyuyLkXPof_Mf~*vHx!19y=zc zI>G-si}DzqDOvrgq(WvF%KuVjv+9~;1K4?cmgNQX?Rls=-OTIfPlJP#{gWrb1ymRC zq7ERQ#eW^HxVXmo8drvK0Gc8K!qRpwgvfwA0;2qyd%uivDs1$%K`1Nm<}QP07jG{5 z7Bz1-$Z^n9^u8d#S;Rgo1FO*;KHEGzv852>B*UB6lOavI2A!*j*@eV9YC=gXF0i^) zV>X#bd8+tAy4C{ayT_p0@~?lx6#;ch=Jjlr!p!bpaca9^kAq%A-mR_<9G+OA$*BL; zSjslXyIh@V@Gg_N7ZkXXSNjMOwf9KNvX#@;CL;!Nrywj$gm&5|ipH=-lm2E`>NgDY z^$znsL)Bfw+zjk);|e{z_2}W@Z3W?Zc&o~J^vIE(SqelZil$8Xf+YUw>tM%wOsj8V zcNDyQ{;+Srq3fA{)@u_Up;I*P#}(|Xsq zS>H>DmXC8$SJ!!w{A8fcJQ{Hi@mbCsdiUq`1>Ud^yD$I3x17wo72#=|0|RJ8bKJRI%7y; zpnz8sBZT-K+qYt@t~ng7tT`NeTk>9EImH1EdUnoly`7_m0gJgMy87DYYSFre; zzCHz}9DR!nwi{PH>?y9=Wfe(+5js9C7rddHfrcS9a0QHmQ0aVwbeNkI68q7!B(5XM z8OpGpnuG;dWqzc>EtU{rwA>YSU@Y1zu`<4mV{>)Xdb~1fJ@KN}Bj^Pza~*h98;VajPk(<;nBBnlb) z%$RiGXYl6f<&)q=8iYE3h1EL)#T1`q{Nn33&ruTG6vNTqtrE&!`mDEqtqoy~1$y*yZ;S+i?ZL&!qoYGO^4Z>_kX*W)Eud|02 zqWL9Nj+E?l2ykxnW_m9U@jUvNYY;9?hcL12fDEOdVpm6Zq?Qc`{R%1t$O3jW4cW$! zZ4BAQZzT$NA+>VM%JjinH{Q2t2camT`-Mp@pVao8{RJ!l?E%e#$X2qjEhvgpK zK}RmLJW8Acx)@T4-ldZ;RZCb8-W{$!fAE0M{^!5^>jOSbu51rF{Qun0g~Ob?p$E;e zosL$K@UP{UuPLFgH!R{VVq?20&}O+K z3~}G83K4Q>Pef;E+1+AP{R1_ff_#ZBa4~&Pkv`F~(7ao2M-bSD@w?vf+iU)X7;K&6 z!tE^nU^M#-)qE$whQlr=+d%@UHRN}E9BlF?v2#$aowII(Fj$p495z)YmeW8fx;&5` z+$HuvSo;7<^?Dl{eJ(6?vI-VD5<+jDgzZN3-TuKOZ0)1@Y`Mh4jYx04{`%^T6KZ`V ziOo-YC@V*mGQN5OWcEoN(<1kUF&`EOcD|A|3w$z*;7MN0Ry_Xo#jiTXSoafIv!>_8 zB2Ux&lOM+2Naq)t%tw2hn9LwaXXo-8tcJ{jKh#OAerG2I|GIzEyYn&aKlWoXKiW{> zK1$vlTkcU)t5N=KWk2(=)Nwo>b5w;k*>-8h4A_ZDX7E8dc zHDviN>ZEj}c{I9$izW|UJ)pyxS|t(d(muSt8ANIY=`zuE-&?HoXeEK}ND%10kN5UN z6&@U&=$UbTeio|Zv&qr%!NGLz{NV6RogW{c?M>o)Ya~CYNO}BZKX}Ft9PH3RvY)g2 zPKJ$l>{}mIc%AtqWfvJzx}q!RA{p!9=@hMG^-*ie;oV1*w%Qzptj3jRF=bIOM#2q`krUrtYWwPxhKEwxgMa_kyP=del+t<%Umf>c1r>}O zy``VU-iWARB|+V)X|~&P#G7RW5GrSSxQ^?5 z2{`Vq=eyo8UP3#*+m9(My#;OdPl9K}(jJjgk@{(T1LTsOEVbXFkO3wmc^ zultQbbw?{1Tt|Yz^*zWL?N5%Qqr{J3sJ?mw@q{8JFxL}KDyZ%XbjSrEy>n!~N4;2DBpaR zZ+((X(j>30Z+}6giTKl@r=SX#A_Oso@{L#`o&=YiVX!~?%YA4`M%DScBE#G)LUEl! z8iN~#yIpD=!v#-{m>KJC#+dP7rUnwh@W!x7T;fnt&*VvP`!CcYf`UEf!VdVtoZyu4 z#e%nPb;;T=+ps9DcTwswsjIaZ+4aL48ZOx{8%_JT^2~l3LDsJ4Wgdg}wNEYV02Lgq zkX#lVmH^XN4_=lD<}dhw#SP~x0)(KBLHaC6*mft&7>h1N?NUg>I}NUqfs!5CvtP`uEg&xiRW z$2g#L4XPL@pax%~u?*T{6TRq%^SpF83duKQbXpg`J4}l8PKuK)niPe4i}+@Wef${ryE#F&wIux`cZEgr9$I4S1sodD zQyppGu29ciNOC_JGMxlDT?9C8@1o|wLyZrBTBWRe}KP31pVouoJNa2)=Oiak86D>0W?HjXPh#fb9?1 z{($XoXH3v%C8GvHA$Nbwt5_%7u*MMNBu90z0-|;WtYz>q##;4CsRK|w?H2V!#~ZXp zazT^VZ}>FmD!>{~<}@U2uh(V zVueMj2mXIlHlWDzxz8jj^Ln0?T~3crf~%zaI}CsT%pKZmx!*w>c1{*gCv7r;4%jYjf!RzNQcA1Mc4bxIqMub>ZV}aSZx_bS*cNy`vFB826?ptIw zhX8qF!w{sQ666r`CKfXyV-(J)MbDud%`A+hx@V)OfD8w@sZ%tnm?X$=@{QCsC(iJ{ z9`Na(l0{Ia$>KpL__qgqx^ENmb1?x!&+Enn&OA)uXx!vr3T$9Q(7+MX`~>gQt+`(Y zA?Rk_IeuSKp5C z|1aSj-@Sf`=mFQu6c?Ih^_etcR~m9XOUgxV)IU7mpuU9;+s$I=wcy#3feH-KCf$aI z)N;EJ<2r>>X>8lQNN#_DpyO?xpdT(OCXMHz-rIKxjZ)xt#lRUQ%5A34GQ-4^gOih8 zLt+CipuWMPVJ2PMrXKWS>DEg1Ba>nHuXXtMJCzm5tI=1|1I$nwP1B2CyCN7BHRcV- zi;B5X2$I5jTM%FA@LmDH`6Mca17HJ;FkEN=#zDIJrW_6mc--p=ynNI_~Mr1P}9l^Kt zB9#|GSWFU~TNfYnLX-j`8^&AmnAWUL^Y#0MUMkswY}y5it>Y}6;NLn9yaXv+$DzLo zXGs+N{zKJR+tzyZoiJptpEyXG1%FO{Ocp9m!h1}bjy>#ng;3G)N}-~2vA^A%jGY`K zWsmpWO80&&G-tX6ijFt2F@JG^qUMW1PH2i1IH;J{e%CUR^ePv;@ z?96lWTUvx=H<+;M4Ss@$#>>ws>2&T_N9*0MzI_4Ok(a^Q-ro46l@4u0vC#DFgQben zZzP7A`UpDzW5DI1J|CmWh^lXZjg2NBWyP8oU`Hhi`^5~5NzJ&^=?YkJ0jC8U26Z-H zy6;2c6xFHD`wNO^o#e4FA>~>`IEMiqg(&z9QV2jIghM6J)u(4MG&UG&%Cav$!U+34 z*~uWzK`kBN*X3(JM?x!%nT?Z>XpO9t73;gx&t)zuG$b^S?`Q{|S>fgQ!{ztbllY9R zb#Bl$Dh=shJcZqy)sY%J7r4@KYXg7>Y{k0jAo>syH~A(}(Beq`rtTI*JE5g>=ocDB zs8LnJqQWhYkVA*aCo0*?s0pmybh^oATHZTH_=ve;q#$hZP40ML3 zYT$AI6rfa$$xsW{2S@a)pi6m#p=kAMptntLM@g2a`7A-Ct8pVNeqKy-fR&ReUG|73 zntRiRlvC=*j(l8TuFE51;!4&&48bv0%`+M%W18dzZ4$6WEs>j9^P~7KYfJvnWhw+3 z1wvoaO+W)*L`0(!X)e_9k)(Ey4&!iPXaummFP4pH>P{iblDPTr8{IWYGxL>CLp)Dh^{q56sE8ErU44oV<;5mprx5ymU!a9q*r z+w7IOw|L?4N)?`C>7#b?WPj}GD~;n%jf5Xmnm=g?7k0hR$BHvs6?*Ow@oV({65mqa z>Kc!*7ylX!E`Ynv2xr8*Mx;AQLSfLsSe=hRE9Be{f=IP+{Gf4R4QIItmLYl2^54JN=f zo++=u#Rim%9(v$xGiw;;Vt<(izWcYLp(vGPfN_ZB(D!W6ZH6X<#kMV04zAkiC*a^U zacyIiQ^Z9l#*7F_@vL_PfL>iWx-n59(1uK49wTe6oK*0G&AF#Z$cbtBp{yXar_UNj z1$5_>{N=Z*^8d&>T-=EenB_)QQQxM;HZu@lTJ)HKFfwXca!VrBDoj}uOd@acWJz$1 zLQ8twj3ag@V>3%JdrAkNE!7s6`$cCA51`z#t`!fAiSlc#u2)+~Bm3&z3J$~Z%C7X| zb1&6B7`umyjufycK@9~Lr48k|2f>wZ^X#pJk5)-(o_G{6vPtS{I`=J5UhVedoK>PR zWIt-zNrzNH__NRQ4rvB*)9zbJA5_aH_ASnN7a z%A~;Sgy;o&->$=oU>8|nsVgL`r;LYL4LHCvIV|F~HiN}rStsVUP-=^Tvw;2x_Hkb4 zrNYP#K}H|}g#dp4WWqU;n>G-g4IJr64hLEa4lp3a!f=o7Y|box*w(XXsbqnyRYB9C z45JNn?IgEVxg@I93n$be8mGZ07+dwceS*;_q{hE-t0BmGfPfeQ+z9gWce>T?4o0St z&|z_1FJWG%`X_!3ctXMuN9_>}`2cE-(Ndezs56qs3@tuNWvx}@XuQ-2>Pk@Mv2OLo zl*K@p>#ohM+1>5ezXmA3-;SL(QkRSCbw7_aTdSeHlPM;A@*^35z6bw)0Qv@?ug6(b z&&9S|J1E0?-5tZmSOd**^%p_X;LNx}=`2R?$rCF1)6P5BM*^iTef0ff`8lZcSCBVV zMzanAvJglXeM^6~8{6u+zP4%@x-1k0>hnA{{4G7~^ax$aiyDT|?{v@BP2 zfSkF`YB@Fx{Ukw|LH|$s;y?|PJcTmI2XO@xpWqsY6hRrr+FHk2e`Sfgc0z7DwZ8Az zw^yiHQdV5uLBV+>hXBM;uNs+{w=yl&^gao}ZM|2jtW#3743$JU$d)ADel~$PUDcU z^S5;w)u}B7>A&$WMzm2R(`jM<>V=NcLbo#5Q46IjQ3imSafFVu^T2O zaYDU?lBu3hCIVaqe)%phVxk|+!xGE>&_9h|e-Z%x=d&nz-f$yC;o1nKIvT9SQ)sKz zN7IRs-W)8EfExyGKh6ph2{o<}FGK&H?B0-C3tR*{=;`8yp}pRrecI=t-436T`;zOG zx*$R<(qzig$l0|5ggVH=8}NgM@yVQZE+}L$HqBSW76C+rBD3AzZXF*+-dacAS)WJV za*LX~axOi7LZhr&>4c3Xt%49}<$44c>h`a7$M-nE2q9Kbj34mXJp(S#;M0>LM3oD@ zR?=_uS8Z=O#R>z|u=Wvq-sch920~@-b#l}|FMGYTZ8z`e;K}}8uSZH_2_vXmE@6=6 zC?jsAa}->9s32~ZGfa|D+*1dJ1rtSyu8{-kpjRgEqlH4uD%HtJ@Um$)!zm2OT_-a# zxHRA3$}&1==vC2Z0ZSs@Fn-rOetTW=2@RW65Jm6BEVYIc4dqzLIcbH1(=bX>;)BHM zCdme~x3!P9zE^lY4_3tkxM;4Oq&x&#ZH>-4>7#w-=Ta`uS5YocgiOWvp*oAsPtW$l zx3hOmAg)`o? znq9Z^&GU=ht^*$012PoGZIZ2{g%vt=r64~Dn*whbMx0Y+H%S4i8s|IGZZ#rA$d47a3LwMmTKt`&M@*oyyIia{s~68MuHeJWNsNuG zGD&@WOch?i%lu+@*&&D|?tKqgxJE`me=aYA3;V~HN(W`ZVX$*?@$zt&Qcy`mg@*q` zk6-=W$5UwFNE7Y?wIiHLijg`sL!2y6W(ApE8Y*MR5ar6@H8OsIwvU$LRQ-^Z^k=3> zxvbxU_BDxA8Y_n;VE~)*k-8sL)Q)wd%uCE`J%USTw;1`POb7bwkpm0&EW?pX;XDXs zQ6ra8p|DK-*l=Eb<9a$a1nKGg+~DsxT?hb%*PR%hVy5$NdY_ausNqQr6?$#OD(`Pu8q0 zms!7eU|BYw_(sUC_amq8e1V4%<%`5P+w0l#$xoxx_hijO_x>bo(w+cZhyDh$ZOx;y zpLF99?WJK$K64GzaLw9LOF#|6bR9g9jV9!4CVjFL#578|WD5;3Ga@v^Mlj z*Km((RxH!^*x64!Gyn_@07C=7KV${|;kt-lEQB{bL#GfA4y(vSgcqlo^!IXjJ6%_o!=De<}p|$sS_N+dc|= z-MG*g5158_cf2@ip$`Mz-3ra*6+PM~2{gTP_3bXK`CdKkUvgk>cRlW~&s`3mubPsi zL58S3mXMik1z$j;7gxhdYzad1Q>jw~6==;E!)#;x^DHalw z>^htz(2q8eMdc`g8Nd&E8#i$VNq^d4f;}F~5|!hftS~ z;Ru;<9wQf=r}hpyuG3x_AJ45L;-TsHgU({8|J}Fgdbh=Hzo%=z+bdA?yntQ=D5pli zzC{umZX+dy(}r2}sj@sUK;17(ij#C?KMb`s54B#mJ9O?0V5wXsrCFVjkA(W;dc3^N z+0KFWq?ZLf9_WEe_Q2Fg!qk~N+ynoB#+=Y+rbB-P7?3s+)!Y)?!x#$fioG9)(Y)T# z-0K#K=4d85Fh#3^cYBbjMq!Dpg9`0TzM$OQoFwPpGz$iUKfmJs8a z>bpP|>8By--O~mBvy|0$veGl)wjyP1_m6W|CM>w?Bcz#Z3S&yZzD9 zM6x0bu-SB02pu7@SJaJ`eqLz>^g5mV{&5xb@^w>MPEIycJ8vVqn|U6c2AID&iqAkO zc<}GPdN&XX20}q^^OmFD6AJvAKIO{wds3#bX#`UCtK^0vE$*f;{X4012Jlp&n>Bzi zg~qcyA@3y-GK~zW9W`eV?ait#H6*EAkm=xx)Q+%t!QWT!7fFGvcL$gPrd0{RRNtBf z7?7~8=5&F=X#rXokYb85-u9_b_omI~Vx|9?6dl|M&<+Wg+ChEENwwXjtd zBCE9_bK~xo1M<(b?vq9oJ;Z3*`elNwJe;B=#0m!H?JrOiSxR;o#@%|yU4JPI+yr9{ zoZZUG2#*hdn)+5Jas!#EN9iKhT=EyK^g^0(A^BnS2j;)h%=uxr? zI`W4ImX}l!*VvY{K+k4`Q0Sm7-GXCdfUUqMmZG^IBLH}2K=i}v3pzQhezWjFZ;=RQ<|Ib9jfO}ibT?4-ZIiiOxe z%il14n0QRzx-W~M)$@)ec0`7^>{QBkQDDSCnv782LL#u9i^A-=Z)1PED^o{3FX@-W zkOjqthHf{81*8em5hUCxxIEICT|$M{2->}Ynu7Th$|iDtQ*OSeMfB@+!g;UEo z$&|Qsj^Yk-2_napEmML1+%nSXsxlH3g=`rqI-4Gc(P?yete~89ei$C??VleVA06(i z)BWl3>CyR7yl2W%>n45CdRTeD-{epa}O-l%zfd` zN))*NpDgM=%gs^Cn>3-BCuEM z$x`HY?t)mL4arb)GNjdF=gq~pyCeLLq*!KmzGR)9zYsdXU> zwIO<>pAl)5Sh%!=-O(y<-<5bnQY4J{?)KqZ5uVVr}0Nw6tT^?$6sF|fyt zvms1JDwZ=Yir#k=?v_;^{Rl(doET`bkG1xF;uLgai75e#>klPG(SYC?)&TAbtp7}} z5FS^sC{-QjV}W!x&x{6);5-mw{$PRPNIl|9CWa5(uiKV#qCJoWqdz(DgZf7FuYrif zo7jK;%fE35=$t$Vwl~7u%%g?}bNS+1CPj_lVKr?jC9`5gpuK*C!FN}`XU!eZ21>Ad z@!RK5N0Q@A(?!3^#e$tG;lhI*dLp=~hiO!&9Q;C0Lo&-qQr4f_yR@l;J|0Qjc(G>l zMeg8enI>7-N%dRvkbWkKj|MBAcQ3~#TA{$kbiIW(;3+|}Xh|o=24-S|8zO`|z6>?w zWX+|2riOfmRKmJ%@O&dT_~}fKb>HCWnuT)s20Lm?U+xyyugC(oc-*I3T)!sE@#l%o ztY5O^bThInk3+ip2hmj;NLLU3{a5b>($zq^+W4FNR7n1~_oS;X6oU+2Vg=5slx;@K z(L@>Uv(?KdXS||GrC}9j%37q>YE3zyrB$badD1(Q$#$1fJEF7xjN6ebrDMJg*bb@* zVRi`vEc#LD(b(lvxNOK9kKzzrWD_dQ?(ZK26Vo20pK*aQmOK0BzUN%JxDE-mV*z{z zm%-dQJaU$D;!lk4T!(-v^Y{jMA)Vz#Qe7irfPckXQ{pz81VpQO47!Zu^+iBXsZvRG z)L%HH8+sCamnqv7)Pb#-3ynDm`PPxmk{*E=u!Oa5BD zpAh)AxgDfQ_cgl8No?UiQ%NHlkYa1dvJI7%K~#KLR5?}!;Ead_2{PNx)2qwZ-~M5@ z;b@^s3z-A%f0LA8$2v@bHBW&)bIq3SFFdgC8A#;$f*^&F0Lu-CN}xdJy1(W3`# zOedZD5_5<2;X2iphk^U)1Gn$gv_k!*)>}UK;L-TUE zW-It!53BT=2Ya8nXkh)Ynh?D6fp{tjX@3|)5K)BPl_4_h_Bs0K0uhq#auL`J`cF=uhjwG|8$G#z1ojY^03OOE+44p{UVK5n4MnbTvlK zd&(Vjdh3`n8~#%_t&wdpbu*}e?V;+rVHu*7QkN0g@7Mjx*RO(u%&12qWPm^99Ls~u zT(khFakn#yazHSpK`1;GnRsd~_ChElT)p@P|Au84s&gPm z#m@?O*f;B6d)F+_C6+PMRVlz$eeyJBFm9(N@x!v__itb<-@hBPB{q2dbUL z6h&Z|GC{|H+46{CASw++rGcolow&tGPl-y!{lPR|W~n)syPm{ekFg$k&QhKSvJE@0 z-&{WBGOpgQu?1tElqItw?xzKfxc|cs@t2p!)6Fqwm=(f zSTS)g#EuonET6eJ$hCO_(IP1FNsT>cI}PFK)pwzPHl-7NJXOpSFf?YkM{LaIMijXx zi*y>$98$6F&>wE>CPG;hNnCWLRz6fmAi-tMO(mX}xOFZM4l#z3&y1@&{Me-|7N-`V zoSF@__zkQYJ*J8IB*wc7n65m}igR50#EIa{xfYvUA|0&4?*ZmXI*!H2_U#3+H(zp{&LxhB+ z+KJ3dB1c6IbV1AwGgv4+&qmnTr0wFYxc%P|05hMFfvx)NfBwt=dI$m$g4lF2Pb!_0 zJm@U{_JB`63BJz2+;XO$yVwhz^MWdD$1NhpXmStq(UYS#UuT%1>z$!JCW4JbsMnS8 z`=ws9(s#mFQmzAbsehp9_mJyH=-ybq1>rQIy?BWsZOp}$PILo6VCV?Wix{hu2-+A~ z24a1N zQdSc=h4}ILi)XK>wk6$w5CsOwDiAR)NNO0A3rJAFnMt(H%gkv#_>+tsaA9pieF5C? zx>hOR>aDJ=Vg(fO=Paj5MMOW?GR4&(W6G*qG%t=cKuJb{fOTsd1CIv0?+VKzK;eew z-LVpg^7NpE0yL2hSGY*9mO*KtQY+L{F7#3K{o?vUnZlgw2kc4R_TMmBhdG4Fd~Fj* zi;7-C{s15c7F|%-n%iECN&&8EPsO*?V-j-*B-0T{)rYS_R>FNgYK-bY(@m)^pOluhTijcLrG^S=?o>EZOe~Ods@Tf{;9jl6t-?8E-WfWRbePe6laU?-2v~4H!Yr=2S+6;y zw{JAAgcQ!q&e{zr>EY#nVcS;Lm!c7LDVel)~ZU?9t?EqM;< z=q1xDFtde!iAijpJ!Gw2yFDPJRAgoZbt?OJeH9}?gmdRN$hab!oh#p8`~>X(i)W+Y z)sIy;3NH0)(}%(DeSrD&hdiGFv6|^`?vS8-5St>uJK%Hu;9#JQf;aCHoemWvJ_H=$ z&+6%QSdD1g0n`Agj4%b6I}Pc${#C}F^uRt2(a~vXUFFWfN+5bDHmLc$bn7PxC!1iei4~WT zHyg}g;Oop8Wj*z$!YESkq#I+}F;7r#H|3FUJiTEwE{uJ+fgDOp=qyR|mal3WMhSJW zvJhwtZ?!HPuZWG5#c$p!)TY))12vCC=;es{rVsWOh6MK;;AJ5ln_6los>~B4!IbWe z>T7@j=%53jp6J(z+>cV+y;B>eyR{>>2+9zuk#zpNCVk-uOl=A+yoHEhZHeHx~vKd@amY}O!y?*RL> zNUDYlFTR5r$ivg}!+e|}x*T6??< zEl5sIG68X^h1H&$_^3I5X(W#wAmZwF7BYBH4bCY!e#xy~T+A+3mGv%J7eZwV`!jU- zNPSR0LkStF2#Z;dl`dhraRtL1mS1Fz4t2Pk~2 z93hsw)VO62)4m2%j#_&7zNNC;&4M}WH?R^KZZ9=?i|l|WZRtet4atI?!s`2Be{xQC zed&*XeuJFsi*H^sskzE)9eEa|AysqcQ7DL;>F-daY#awWQuU>pYG(Ms7@f%*&>zC1 z4ou^95A*)gF;#P@z*ysx%| zCJg9$7>4T|hW+9kUL~ytQ0AqsL?{^>i~+9Bq6$W$9yt(+)u;IPo41&Dk<_OTAU7QHDL&;=mhEs@tLPvL)V~-jEwMyIsO388h_N!?}sXx zBRMD70r~|*sUJZNHU#ax;3_e<6J*MI!%=Us{}e{82Z-b^VpS~@8%hij8k%~y~R-TA?xR6vK0%P3ZU>E-&0pBghSSR%MiXs>X&yrbEg{dowAO}bvu>GP00jN(;Xw7aU4Y3aWh)mhe6z%jB zdznmC^dZtG`6kS`pt2>8>u93`>iNY#Z^?65vrx{fKVRsl@Mkp%t`xSVehA(Gvoo8~ zjQXAZQLjUdA+;q>Y|T0|^u#Xp*846m;^3;v(F*VBwF;}?>RPF7nNe$&{h;UaJTGQC zII)js`yR`hxvBJ6o?hp939|@R;qUNYcE0^{O;qY~3m?{+iOo-6TwUP0gH1<`6=sd+ z>102z`3`j@)(UlebWkpX#d~BgORgKT z4*4<>O`=C8>3jIbW*LaV-Xv5_(m%LPxw~mly}S1$vz0V%d$-Cy zR@ej}9p+Avowt4}>it6h6aK0)3$~g{he3c~CAe8uH{Qsa_RJ$gHoECtgP-W7<33PY zdP|t7DG{ObfTS3aYI?0lo>$tR*qt8WV{tR+9Rtir{_nuja>k|nd&2s%weBt@1> zJEq|aq!p=$Qkqk#?U6MsRQjaAfHP0J;nAvzyA5q$2M( zIA@Zg`PACi&(n>pA(4)u68&G;bj=#->GaZY5UOE9L$kHpcJyrvtugOuta%7`nk5DM zTG68afJc3w$NR^|Wi5Z6U75s6#r$)TNqirv^XXX}9Zt@U&yS8Lr$;C1`0Q|hqV|sW z; z&GrpCu#v{AIs`yWarr36R7zlTYHd>lSel$0i;5aUr4IOPIOT?Ac^eVh}fwlb_Vt$j6(4mdJ4EaxyjYsCmNOBN7(HCxm^i%dr@?q>!+^g zIW`XHqzl?vY+l8MY4iT1E;Ve2zf}12WC@xG^7uOE*qK=v9vNtJ8`8duu1Lr%3Kt;{ zIM^e~DH<~PBX-$(1!YDdJzqiW{Ta!h1%?HGFe&TwMYgEs&N#G0qq*E z_gDN4l9BX6$W~I4rcUUcG<>kBwNV}p?Gb7DMX@aEzIt1iK0yiH{$TwsD&j@zQ|Cq1 z*l4MFt+lQr9B0 z)$}#3y1s9!?`@*cjfg}e!D6z;xRskYspnTJiqj?Wbo4GQB<~E0Gph=0e}<8~-jUpA ze!9)6T+1=)=)o$UA^mp-#PlY>-__O=g)r*aRSCRKmgP30AK57lkT|^)VRP4madUI4 zaCIE91yC1#o)tc^ki=`IX*o(n(QC$AI0h*KHEDvJv$E1)KNS+k5BfFCufJJ885N-;Nd!`ScVvR2eqxc=zCjV@P7YZdf5|%IYN+_-g9U~zozK7Pcu&cI+GsV}C z=NgRPY9f^_hb(i*GKVblH~FJ2MHRAE9kY znhE!9k6!VPwqlI+Iz?-YG1L4e29hgxp-@gB`ex(?8h_A%j@526hEU!0fe72;tMTp6 z;~1TPLmMm;x5h{UQ?EQ}A;ZYMxO_n}am(aahH?7o74RJ`VL@4XYd}It>j%oEd_Iw)6Dr z^7XfWKuHLpC1!OJ_Ycnc?}4)IqrPAL$g5Xp9D39MuZLZYtUvChb-O(PTDH*H(Qev6 zq({LA1kFIGg;M?Im(Z?muKx$6#jZ1w;rI3p%+;yA;Tm_R_NS6!{p4^=^?-4Vl)RAn z*5foZjOz{M^@qVTSBP-u_A3aFmB@E+nSoTC3*wQ>zu_yyioniiGR9Dz*CFt~pljRu zT$?WgtV@**Bb>*~Tw>OECv`Mirq(LrQrwI0Fr@qs{{4{h4=I0-H~hmMr~E91O?0w4 zTUKMPRBFm=T?JR75*Z@^f2XVYI5g|MZ3NOODL#E`A;M7$ay5 zO7$@A0*oLi#|{H_&4s7amC@;$7o8rBb>t4==w@Tlqu_ZWW4uQTJHud_GztEODL7+= zb{u3z;mAW((^QSI>1`xF)RtddO;{|G05u*_@STdmavJDCT!tX^94RFGiVGAyJtpQw z4{=a>P9Ab0$m67z8enCHMVqzhd0CNEHn&ZP);vQnrFyYbhN_dt5SVVgOC*3|$II=% zXR26MScb)buAE?U9jS219kG*A&6(fYc>g0_u+Zr5Jse2L`tRsBU{NHa+$qp^^vhEY zQ7S-${t=#%b$D-NTQ(tws=px+hXD;JqJ}{m4GtFrV;TE03^K3;+L1wWtC2M*v;yW& zf@hZ3;H13-Xv{KbDBD`1IF{++L4*vUH?OUYz`NUzH~C*`YP+1I^v}owfJWurimoHD zmVkJqJ_KZVH>4p6TsGXo(6$D}@=c07q;^AUH>7sIrPS`I$Els*8Mbyf?EKM7V5;}& zYut7`!9Vzu-JJAt=$5eEwr(NzUc`x^Xi2YzI>k16RTqsQ{YhZ=lO^>PcFT2aNU^`5 z3Z>I<^r2;IhnUxVqkc)3zShvI^a7&uO>PJIV0QBBk?}D01eZna&quqa*8*+__I4 zG~$4?XCm9$HY~lk>o;y|VWJb4rT=uzG-yE0ubV}(kHMTm}DbTb5`-s+{+F^1EJh%=TLj-Lf_le}Yfmtjoi8v6gFu(l;@BN$S7rmP_+l{gw^}5#Y!3r}O$e6&QUCbwa zYW5icHA}8dKxs~>k(@2xSW7$$?F^K`5ji(qeoqHeKxIGGM+FpPAY{35rQ-&>sVTWC}24 zNosd$tRK%9C=Hv(?T>*&LMJzF&Nw_Kb@>I*{QLOv-BA9gSGBOx3t3hx(oQ3jOT8uv z0K7Fu4XecX&e@UMTjv>%}uQA&qbL6cMOp&hEN zx#!hO2Eh2izaIeO0Wj`yh<4m>z_^h`H;i+;YM@RPD75y2+&RzeN}1Wx4yAX{BAL{c z(RW?oipO@!*yU^r!y#@c?77<}3A?^z_;U<-xZV}V^Ds#<0VZ#{9P{zpkLm5l#dV&k z5f@*D39!z5t=cN#0G?x!*sp0T2%8zVy^-w;Df>NLdJTp)(g`_iljvHZ^vVtcND#|W zTp*(+Z1*s{daQBSRtzu$Bm8JLu>1`4IIovstu-)9$a9|Ky)26)Hk68=1g|@`b$8k?lZ2OILubO}jY{*yLb1PQ#KxM$hw|u9 z!OrW;UG5yc!%h*jAH4(&u*o{*-VeRaXVC27J%ZJDaStizgS|ETK=^W3Pn$37-g?iS z9wSRWYeYE>%uB^c#=NDnLU38dtRL46fLi*v&#X|Y0`|2arj7z>lP*N#&^Ei6C+XY)D9P8XyPVG{UxexbcG$=YJ2m zhd#u}Slz%-C#gjLr@HjOLf-&V;o z9_)+Bdvi8sfE)++eP{23Z1K*ZJZVqSIaj(D86h9pZHITdiPh%I+Tpp11xucIP7v@{ z;y7X86h(QVQ(f+WBdk>?yB-W|m4nM*NB&`Cnwd%=ClRI4N>uJLC7zp7iCw@wPl^bE z35o~n-`ynX?JqMOpI*Ltc?pdCCSRSQIx1KgDT>>ViyV*Oi(I;NUMgy0kE4Mi;*gQ5p1Nl;L|E{)QBQ&?Irk5 z*CM$};O1aY3f!DM*&lmK-sAXFR?P>2p=T|}pXO+KtThQNbbK9i_5L~pk^CEK8Ic!7 zE0YkbCB}}mcr>M|rA_Nb+n>APeKp!Bzs5ii;(8-KGn_-s@k2oaGq@mH(UF8R(kTZzO0J{?MayUs<*~X7YEgm8W zOhXsv5>DU%Rt{k009I}%E_2p*W0#g=MJs|a78bFLbI`XJ>Rl2X;dN9n7nNk;Tlo^x z9jRAM`?vPCqN7e3JCGQGPv0p;u+TR+W}Ex1&bH2HW$CC*SB%>3AzK2`79j2&FpaCp zua8*S`iI@SMr|wPy=&YC&Kouo7i-u&`c4*P+#>j4`VqPg2FYi`xJT!+2%6f7W>r#< zv_>>H`Yf55W4klz4A%oHzvg+=Ytl|@9<_-)-b`|1t(l8*Kn|H|4ZKL#UpN9&*pd)+ zAXa=}SI>ev0Io%U{#$NS;NE~a>IW??0Z7{Ai%T5DbnRiGl5`iToDHF5E081a5c3t| zj_blsYqhqmhw`z@(6}y-i`)1#<=+RwM z(U6AQ5EIsgspiqz$owtQ?0771zT$XyK3k>I8192nZWW}jc(^Q z8)wMN(DqzAec5Qlm)AO?yDcmJsZi6pg#TpNHYC@N=2P!o!|~@){t(1k0dbvq5ZA#N zc<$@6VmpI6mD-Q@fCtH4d76w1kN06suc`~(u03LAW8$G)Z=Jp zyG)#x)iWm{pzI~N<~WF`tSCKTTYG;=B>jg*qnD{dnALAUg4R6RdW{6#bF@hrF&~3m z!+^t493usiTUtsFe)0RdkqAn-jqT(wrTQF28;s)U03(7^Kyk|RecXBR?A2>a5N(1` zHg>m1D)i%r^Y8rr)yw_~?QHuT={3r8&pF~L6k?3J-r2!n?|o*&qR1yH+5EO5?`Cm$K<+(olMfxxf7XT1UIr1o3;rSt$X0sx-<8^=|kcr*h zX&zaPw7X$SgeZ0LDRR$+ktdZ%*}&JgHDSBS z7Ki-@y9m$H15OWQMn7@NyPUttG%f45oJ;H9&yuX^Nz%x5chMp`W1lGI0M!X05=hrx_-; zaJ|RIPysJt7WvB!JxU}WnlFr`{~K{r^kjqw#TVd%B_mi4D!o(NZJ$1dPis66bxwv> zi$KJh!y)ZyJbKn0EB5xy^woI5N(HC=J%<;3zpsu}xHmc53r|%%iT0wSX}llqogSYZ zPgHaiAD*6{?oCV!>AG=)Bft#`rZ6P2Q`zd`$31#K)3c5XYZb?@I3H4Lr1ch` z!_hkpu~*GC_2B(-VWyGz&+D{G#+8EeKqnCDc%XQ(#TU@Kp{pfnfC?V``vEE#pn@KU zQav|tYc_U!i6Yk$*J~^3xXh9*lx*qu=h9W79|0Jue@K`a$gOd+hnU2QV;e8NYT zT8e3gc^Y0nMIE5cZ&(|zLmgi)@&u=rf#3W&#f0rt>K3#DCG?d>>;lbd83CcT>%x@l zC!w{(TGD;pw~6|has2+?$~gXTiMG;4)K31fw3S?t`PoWA`}>crtpp|?dOrNrnJleQ zPHCMFX(Iwu-h=pjB_)_}UoHDvQ)S7Uss|$FzBwNg1Ut46?0x6!gVdDHgFiNq-p(1) zy|f(PrKohai8bcSDk`af`&ukYZXX@i_Fz#U~m86N$?^?pU`BMAr41}CeI?{&TA1fRvbs0T1@L7|kRh5j8mzA4GCBNb`+5b?1;Q8J zQ$Qw^sg2B`Ue|=jG`;on zSPQGKk&lhgwKvXXv_NC1l=RZ#J3(=aVjTW$bDAN>0P z3?0DG-oi=eeHTh{QAi^`!F`gEMpuhf)SC;zVu-j7xq%_oO2>xZTs(D~mR<{CRo9b` z-AK`3$*gszcIynzB8z)4k|zB zX;T%{Eu<$-D1R|xt|1;7f&_bXIJZ4|@ax}x{rRGf>g?B_fBpND;3{dI-a8Gjle}NF zomEjD@;WSLs>Ql$RhCOCVhC>qe%c(Y@^pu|r#9ZSkv>B2cuU(pnS0G!f@$S*(oj@H@;a_T#rJMde zUK-3PjkX2e1AzH_K30~7jB>daEAMrM`b8GnQr-v&Vq{JjBE6 zXU4~8kvu^0C`pK*39>+Pa?{N{2CC=)XbgbH0BHQS0F7Sj^f1X>E!$p7NY!F$R&i~t zuK&bFjFC#~WE>^1-j%klR9or@p%oB{Va|$fTru_XHYhZ3PL|i?Q&IznxxxlXej&oj zktK$^VjBd9*<>nXMfHBs6)QTwlI@H5`aJ>q44;UYs8Er*p;9P^WR!HF-QkCYa)o3b zOIpR1IDch+Cvvx(((N0*$353zRK1_hy3M3h|8K>ai zm>OdioSh-jFy*3;i@ZK0F7gk^{7EXs?sMkyhVi}L@!c=+pet;$6CjvPFAcQ?T2nE( z1W*gD&mb6L=$0u6@sg46(pLnxX_S}N#Hd|W(nm}PM>cpK`t&ya3iwEprsEkV(WK-i zM?NbQ$^Yi($XPe;9B4-ZBb8qq=l}Dfr^ix7DjeD|cSHFV5 z`{wG;?qEw#lA0xt$_IK=HX3EVIV7x6s@&~-Z(Wn2**PozcCeC-e=OMeH~V|z9Kv8= zeC0_TZG_;vzZbj;1!B1J9(_9U;a&9J^G(d|FG}x4aP>e(j?fUV_Y?wK87{D>>Mm|R zdLx?_`suvOiyy(>CX2%&c8GT~2-Jt00p8Kb*k;A;|JH}rn>wCr6f_0HNO?w4xN4=^ zq3h`4@RhESS|!w z`Z80>IJVMdi6K_leXg3x5E?M492o*sc3;01Iu4Bnq!v$G5bMhgcg9d+z&2i zW+cF};jzhTsp`S%CXg@eBJm$z`YZuxiao?N`Fowo!W1xC0k6uwIE*2dklakG&`)wLSh&m3TtbX>WDdmDKxtIpQc*C zqA*|6K^wg2E4)*)&ou9tTFxRc>&EPE2hNJU8`1UcN4>l4!UPhiF1ND~Z$)3!>nkDH zyA5N*iq9L04=6+sn_d-`l z4?7O&EwosPVT$KSs;icrhPAQ(Zv8_ULF8rTvmX3l&<7N>gtntR%JshxTp>l*NEQ0H z8EyNidQZYPY&VFbQ)M%x%NEq)TeI&WtftMb^vA-c%*$R$ZIBJgOepmiOXF0`%0VWP zzPS3+l~wbzNDMV!TigYz%!-A2Tkjr_cRqlQlpo=#-2M*)m58l{(AKKwWTg?|QPE(+ zVtGDeyR30c&D}Bb@}ui4hrcPju_i(#F?%+ZMRi4fP-PRLs&brSWwSLrV>s1`CztvW zC&bcsZAXvrFrUiTY}?zhVO>G*I(9HDU|AY9U{y{vZt941d^m zxr3`xmP{yODIQQ#X_jBQ3QPxURMP_;$c~u+XhzAE1pECU^Yo=xo_CByXBcL8}4%nmX`LNb8 zMm2i)rD(ta{VlY zg3+N5_c%o)ow$H3cEWpy>vC(?Fo*|C;|zxxjBdMubuF3rH2)vky)!ExpEgd3pE6LV zJ3oBXhJj1kI=FZOr0EQ!r{s1sIa+2*81EKK3aT z76ml~ZhFo6@bL!nw+=*Ygu$wCU~q9x4z3GS?Gt@bjE#udLGWf}qTWWbV+mj0^YVHQ zldLLoSmbf)u^LpXeY0CTfB-tZYy(#;tdV}U=1hA1Z{m;cnS@i|U`5xEW)jnj-v@U> z-|-@viyp#c%#SlYb6fK`+657sll(;dPK53U!+;7s1_TlGaJ$xn6w>(=w&5>{tqJ3M zk{@Ly0nQ^=rr73;#s=+cZ&33AA=Ue=^5dNjB4t+*vm11Hxqolfs)MG0q0b6B@)%4YTV)rv zG3RHnt$iA`=|SziaQ5KJEvw?}eoFdSBetnwg?5|%#xMKHr6RL#yY5fB)6Hq1AI}_1yTI{IuQ%SmpZM>nYm|F#A{8P5uG3MjU&A?7in? z=uHcqPBF2Aa{~D*erTe~JjojT$UAnxc^-p;WiSb&A5|8Q^>#d-7T6mXFWCx(xu29> z&fZmc-W`;Zrfohkf`U+)qpO8?@A8%3fhPU5Gm^d%z|iymGEdd{3UL0VrYWhpcA8*IBm z0t+S-4d@2Y8h69g!;2qG6Rfd`_9+R;VdhQQNX3U){e=Xq#{E^7r6Lem0Eyb>^y;Baeq=ZnRli zF_jgW)mz6m^JV)4=(B`gG%Ekim!28(xc9IQRgS|&DJR;%ET`%$E$gbT3r-ol5FL~y zc2E{-2JSex2g!y_)_1#;y*VVZLn1pQvRfLi_g}QgqTU>E%c|Q*1oX_11~x^hEJzHb zCyV}Nl~JN4=oce5Uv?QOvwx{cl(L}#D3eiGU+c`!I(UmKR~-!bvL&{0?L57D4Vx~q zG!4LSR$QiS3jI4~YO72Dj5^G0w6+-;+4}_L9Fw~PvrGXVSv5NuTzJkvg7r}`6w|)@ z@@{!f-D_bbGfBN^h%u}6VI+3Av)fxrctBFc1E=tU+Js0;xdBy~?gI?WtqSMT{Jwzk zonQ_}a6m^}k4{BR(@+{3-6%63!14t+^zB2_$KBt1s^7l#6Q$>xO8#EOt7k)42^d(o znZVwGRIMF0m1lCL>}G2Yv|UFJcUw;wLyrd@GkjPdtxhU%?MV6!tOqw5+DbrHT`veeC&T9P|@=eZTrH^$I^%Zr$Fvi$nis-fA|^yVdf$F;(-)<+$f zc0eoN0kE>|-z13Hb>Go;@Cj7HPnS??c3At&2#8ix0hf+jM-nB3jJ2qe9?KOTwpV+T z;8sX|-zIVj{jm$v!l`SbA$YAiv|9vvm@a$&16K9m-w#;TfK~N5x9No<$(d8-&x%i@tJ0S!b(?azg;CA#}q^lL_q6_U@JuVLP_D6 zP}-IM5G!m|!Vh4$WSa1HycjLBFn#g5qF+PAklk9s)h%CP@}1CEZfnQ9{7IVj&nNE)pn<*F-c*hqjn6k4y*ZPaRe&n8)MJ773PKI4_#J-VaqWr>&5$MDJ@5 z;12U+&GX~9SM%eZ@tqN#Z?C?pBm23@(Ml2+pn!^{*pZ{UKf4nf2YK2joIY;33xO13 zSYftIfsK{4nBPjX5nS1*w2w9MZ))I^2X9_pNsqS!{wx0!JX3Rh=!z$DJ`FC5T>n4( zBQFhkbm!S+e%VQE+ve)ZN^{ABbHBQBUgEo9|(x@XxLXI zQm%}m9PM{h3gwC@v*5iuTz#qc(gQhNuO5hLI_w~CY(yXhN$Bf-CTq4Q0A+`>)4kSi zc7Gj|&S5>E`U9#zp!!=H+#YQWs^8p;Z;WYR8GQHp1qHuxQt-O(ftCz6EHNY#8KCGw zf{(#*VgIu%{ciCPlJC>8i2*XAYjj0|z(YTh-gO;qv(F_C*&gHVhL3qS%W+u;W0TD& zOkXpvzGNGWobr{bQFJt60WZWn3`y7&f7tpD=)?8<VgeYYRqf|9Cr zJog;hIsnbl%IAT!jzZ}#slp>Q3lmVVK+BPwQsuShxXC&-*jb1Tfm=X_-umg+XZ(KY zv_g?RG_wJHni#6CAhRCwKhYpLf!@^j$vjMry--!D1mstP{k>qGWGFncOi%_!>Pr-# z+~?0O`{>~?B-cD7`-NaPb_8CFZDfH$v8z`_D^xFO3oRV4NvdnQe?*2K_ayk%3H7zU z26%D>UUi5i?_j?V)^4JtQo9CmUW8@&E-zy7p{Dg;mjD;BDwoUN?@GA{RGjp8x4|ZS z?UQ9&;Oy34fr0`WuL0;{DaiCu|JOD%T@kBsq-6&Cawy;=yiJmzX3TM&rl zVE~Q}b_8^t&AM>w-G+*xho5sA0!xZ2c&^FrG^sWY82Y>hmE>S&u78l;&z&0>0*CtR zZjo93P}{*MQ98)K!XCtv>byrdm}EEI1aEnACbP;Fab>93J_6F~TSgnm09bm~X7sD< z)xr;D#c1%bX03V6I_dA4MJb;iDS1>Cd9u7!_7fI1Y~lj~qotz6$}6!U`tY#6Q?UTJ zZr4^T;GL6{yZYb)xLwa`%;?iXiDgE`Y0fJ3Orf2gWagQd**d@?4HF7P@IKnd{6S}$ z*ExnEd?#ILF7+~s>uizUn}%Ucah$$Q;VrMCA3Ztk?-afZv}t;qrk-@i+!OEcggdxA z&ILM@P1561Z&Goc;6}|Vu1#|cCrG1{(Hn3+2#HzpBJ~a1Q|7sZlvODA&5>ue$|$Ks zGDptWJ+C_(C3UaY!+xp7vkXuiP$HFZK$>j~$wa2V!YYDhfV$z`h&NhNI-}J&2b>yp5_Fz& z@p{+HMR^#UXinZ|=w{l;Fzz`cU>L^3Fuu<)?lntbT{WRlVkgXIRX@!0n6Q@^wKVOV z3A;7LeF-wcMES6YuIorSFGw`whJ~7;GMdFT^;US0IfU#+{N~Qd!HpTqKQASM;aZ?K zYUhvot9_dB5ayQ?D`#-S_YZg8_q{&9J)|Dwom zD3Y?)BEnCg*@O&7&)7AUs!?f0+THEQ$d=lcbulkRz1y+QonINkokyF7J+3IPvgR|R zc_qb|o1{BBKV46BSKqW};-`ZlPl7oNqT<7%%CQ44K_vsMJR_3^u8HUuWdgprD152& zg$7NB`$~7c;*{LWyqB{2k^Set{Obcg-Dr7x(0Tsn13o=^z-J%QVD_-PUD52fu{*~V z4i+psFpA^`m%okOCY(X9=0E(XKK$_Z-9tReA9!oqxBS9?miG^z^Cfil4cWe8^^*^b|XFGx+{ri3F=T}>MtKTOOf-_*-e+Ew1sRxhI%*5Ygu>h`ta90?<@DtJ$uD=#PLxM&jRQ z!>8T~$iRL9Sx<&chN12B!N33N-OzUWc>&qbcDl*<`?&9Ir$$#;F7+K7!|uIF=^ech z9Vk3-mcvqq+vc1;z>n5^1nk#K533j2f+_(qs~mS8f!##ZGCPsRCQy6pKgnDKJJw!o zX+~>LvqJlxE&+GNgWiQ&TV4n|?sK=Sm}yR>PC7)gXx=K}x|Sg2@(DK*5r!$Bwe(i4 z+9db`nT}h)h%DD9L~U%=UR@%H7wjy!&6W)%ti$NCC~6q^>mK+$FKF?=$KGeQ!38T? zHYMcYvUJH5>@NDO-ZU00*X|;7J_-)d6;cWbnyvaoVrhcuH)*#h$E#d>nVz4){ zre1NvhG(?X;rbu7j*H3)b}xfDNP-GDce&Jp2lkE%-CPKn&8V~2l&XC{-C?$^dA9Yu z#K$9mJbW9%-8U02L7 ziZ?ZidtICZ1KDPcjd6V*WqRdQ@0kSevE9hddkMPb&%&^w$4&k@ z1q5IQfMztbf0I;f(QJlbDT^J?sp#O>pIN733**U^nDwDSyt*;#eIK(v8H+%Boa=No zi8lpZp9Ifasqq&?u)8HG19V6t;_Q5`?k9A42b{fH;j=#gw~j#(SrMYkb`e?{0_;G; zDs=h#4!FA`9Zg4Fy6qVde{d>;CK1`U>D59n6Lsl5Mgi%qBelV%Fj^-4~7IYA4B(DluHd?&NWI!~vz8fj?X)ls0YOJXxKC?61s0 z4*VSCbUXtHDbL1nJ(l_kn@U7ZgFny-k&Yow_*mJ9FSf4})SJR|Dbb8_qHuTVO)yxy z3|D>BG#v{*I0w1D)Nrn?4F=G4$q2(cey~I0(K8sz zPl+lL2>GK#@1jGLKScRMl>eKG@=yC7<=@?gaSu5l;P_sLq&U&d{6HbVMm5r^tNTjU z|37>0(&V<0rj7m;oH?7S2vV;5#b2C-T#{{dOID4lzFHl|`08H6v!)swxslB;L$?FVFiteB=921Df_e zzHMQhBGz`jYv`NjlJwl%d+oaCMR}LmivizlI!N9{p#VWwJ@VTqCE{HjV3zfGjD33C zI}s^FlW;Q!+#;cZhwr9GEje}O#YHLM0-g0NWMQtRUt$F8%V4JgbMX~i9Z<@^E8Y9@ zVU=KOu*s@DZEv2wfwnGxfh*|;OD%BBXbLH+v3PvjF{$TykFs5%D_)_!2EsI*XgC&N zk<_W4hyi4Us0`?lyQZYLXclW}%5NbsOXfukF*o2^mc9G@>I!spO zP+CD&8jZej?(kT_CuUKQLA=RJJ_zP{Qn)qNFYg>wR!`|4NjgtWgu`>C|M()7U+(W6 zoXRlGw-%d-eV8uIufxODYJQ={-;+$WQUH$VSDzmLXtj_3`VUX9E=4f%$sRCmBQJJv zaihX2xVljfo|#ozt6yJ*L?IFP(|{2#@$~BZD=Nf-d>i&!;-{2Bz`+S!QU8Aa13Dkc zoLvv3P&7pPzx=dfvp-widp};e)ZNMH(Rpxvqnx+@)NLORzAp4;_%1JgT<6kQ;S`;$ zVTz9T?l(nW24AVL&ze}hl2>`GwELmY<0}O{ z{MCoxLZ3ar(o3h%hRoOMMJG>B4o_I);P>hSls)v!=>6*Xd*&w}ec@J^)QHcwo!|Z8dKcE# zIKkp?;hvBYXe`kOH)M-CT5(VTv$lV5;`-Hfd86XSvU{VTCcY{A_|b|(516C_z48|M zRtTOff)`~835^#X_;5pJZ1qn2`Qf>1R&SE%X0wfI^-lZw(b2hg;N77l73=`t+wO+U z*Xq6X^V7XO9lexQa8VZsN4PBXV8Bc8H+FH`H)N((?5D>?IIf)8fVugq$lvKd55Eda z*xVg`k`0-o6}#p%M{dBpzoMMN+EbudhGOK}1pvGvfQ6|#NmKP_n{Quvis*c0FY|cC zv4cMu`oEy^x?Vqcg_E)3FyZT`moL0cP@La;Oh-p4;<#CgaQ}9=tW0ro=3?mfhaTnJ zeJd6F55mpu2N&*5I_w{jKaP_u;ZAXY)u|c^<1=tlh#o~G>fA0yTeRjPwfF7^ zL6~G^5{Oz>l0|ijwLpT&P5}{qqeC)6)@E@Cg&w*X+**G=nL*XixhRfBQUAQkpr0-j zNjs=CrZsiPD}V5Wb?^kUt z%U<*=K>X`i`2YMnpg0lG{GqHsFTP_Ei+ogL zV21U=Y*FV^k7nj=i&8TRv!v{t7-u@*Apy><&txXY>|7g&$cPppm3lQ1uk@0HMpr{t z!3F}eG7%&)O47mOFPWQx<*hawn#WzuXcXwPuSy5!+ka!Z{Wtx^nu%F&KThhDm~D{U z_yg2YniE62qv6A$Z8XbkfJVMIod$YFaCPzD!*rs((CP+E3p-#kJ+07m87;sV_h^b< zG`JTk-+02(X@ln0=cXxP`%YK~X|97{fEj*>QWs;?LM5SwmU0vjLpUR7$AiP961Wl@ zDWjW=s4(p4`9)}3)wW^! z)imclp#*{D0=E& z|9t;ET!+i7y?h<3zsLYh2`EiGP8BI@cn!$#at7Topy>R+ z0K8o!D2B@)rBA6qUwo31;RioxV~k-;PlC6gqoLP9ngC@6!no<-Dq6m6S~lT1K^_s2 zzjhuR+@Rjp(c?rk(7TRC&?iB96YB)gkpmrv zHOLBsI5Mu#99=t{^pD^@fu9$A-%3`wN6l<`<_nMaJObV20{ev_5_^=>pv~_R6*csJ z;qs)I2aO1(Zb^iN8lfUDQ%}g- z10;)Y9mB0*(0)|fb4#C5s_?1)VWs7T-lCZb(cG;hQbmNNm34`WbCmKKt+ye?{dUd( zQqbGRX%ie9_#`O_2fVp@%3fMqnLv+kq}N!QLZcHt>GO+=PEMQ^zwmq5soPwLC}sfI zix4e5p*U80FPkRB2gnXlM$VLeYmR32mMrAqzyIRhwvDhco^2c9>PPr1yEe49+T%7t z>a@@?4!D}&_|5V(p30w8MQC`G#(;#!cHgbh}{_{)R@7O;=31D z*TL0gaJIKMJU->nGgk8=OuX(Y=|nVCCv+i~qe<`0LvXyp3H4fe^lRv)lN$nKf=HZN zqe`ntD{-4#gtDLFx**9Lw^Ny~&?s0>WfPg*dcM^9+rmhR)x-v_&4>@2OW>qVDUUjZ zl&s2XZkO^rZJ;I7t`YRl4qV1UPQgIHr%G#YgJwd;3K4d!N$Z{=bAz96!;%OEeon55 zw+i-sVFl@lpl&Wmf=eP7^k=PeDkIsv5 ztc)LmXNcsU+vT?6<<{$dL{)kf9pS{m2(`WZycV0XmAZGi&umgRZM;m ze4vVELSM}xPPFv)oOgkhGN2qtbOUt+q8x-k4ts?AX0{tG83< z*8e|>_x8?@qVt3EXtY0CSK|C2XkY={9AyVox2yOLviE=FOgj34iLKpt?0kus+Ih)0R4Q_h|_d7p() z3-s_5khO{65aj`5{a0d`N;thbOHqLbs(%DO0Ih_q!ZpT=7ijB~NlkjyZa@Qp(;#?p z_4ElcGcHFt>n^X>zNt*KhC`lT(W)+q z+0M9ZICpyE6Z+i>km7hK+Ul4c@HT0-O`2_!W}j2i?4ZX-EFc0*esJ9X50tZvWVc&3c?6>2!aq3uJyQiD5kf-ZCZ%#8SN}fKX2J*|jQZ{f;;5E9K;sza zNy($=*r5QlL2uoOB*;$#F0^S_GP>&zZF|AU1|UTnCl>plS2OgYCtQWY3+rzj?wuac*YRiv z{X6Yb6pJ2syJS|pWcryWY%Q5(?jAXbaL8%HC6G#m6qO~UsvG&}U;c}^RHLyXeohkS!MH}U`v#(`Zw9;JiS2_vi{4pS zq4wD7E)NR5vb<)VQ?eU(H?NEvs)_;~MYQdS1V}FU65JnjrHpe#aD+NVcyxD!>r=0D^U2}Raoe#i(z@a6%2Xc)PyJBAx#weL zrC+uKmPK(+3F%D1`#pVr1;%>u?Nj}K2Ya;VCKVbsbans!F>P8@vaBZGiZ#y9luN7+h!PEpL3Q_JuN%aePoVK{>bzXz>$mj%x^AU zHIO`8+gY*g^f`~@^~RC;P@5cXDGn@<6S@>+5Hmfe$TLssU_d2mOM(ue2{$lj1Y4fo zeyna-@o7hG%~cd!7BEVhrG7C>1j& zq6ul5OR6L^J@yFoK$So#-{|PL#sj&=j_~e7x6z4*-2nte34`w=D|lBaF~8uxCOilRXb)J#(WI#Fr+i<{#VOnaHv{oOZvs{Qf^Gj;~hF^`lju|}JAXH03Z`{iV5Hvp9 z$x66lPEt~DxztbhE-&KXO1sza=&0RN-XY!cu%}t}S)$1)LbrFRCRnh3hf27qOd~hg z*cM&7&Ak2w{?In_x=!!+sMncSZXal!_;Rc{bP}J+R^(H>!lVkyNv1o0ms_Ek|88B99~5OV4-YwM)&s!e# zK0)7k8aVs9iPRPyLega&g>hj?K~1`y6Zr%@b|}{jrK02~2eh`B{ECzoVL9n=U5^Dv z2x}rQ%iEu0A=UI?>LZ`T7S21+N)PQdBh|Vj@I0X9W8`KoC}{h{W7Z?7TfJMrDJKA4 zK%u`NQ@jhh30?Pc=(`}Q&ND7y43jCQS$_Tf1$Me!vMXM)y)HF0dPo?A-Olvfag3Ih z8rnOQfCf)T-^BNBzUMGUc3u~_ck~s=4Mf`0qAQ2hxS5l*9w#9TbUM5J z8?rwxJq=^#vCkQKD9G|=(hTY2>fWIXKT*E=ScIs%bs_eAbm8$(4-)p%p%XT&E7^P; zd`~xXW0XfrD!0QWDag(AW*+D63^Z+}*<=&!TwGng`R+gQKoxYubq)6XEAI1sDd zgtz~l`3jjjrL)fsO8^CTll6`v`bcjxZRg*`&pW&hPjh;xE)kn=G{0^o+T z@0|xvg75OmiRIqDeen!w#8o*12ny%wA}r~_9-d(DT+bHAhQ|xXJ48ECWrslK-e+e4k~6JLf6NxUKYk^4TPzujgNcLxIf=b_C!Va#bbahWHdTlbk? zQv0npA;|(zlnKPIqFe@-mar6xcJo|Q+6KmYn9Fk)XtJziQals`u zzbO-DAW6PU9cMM!UOGB;kYB%W1ybA)3AJRp;UqYi>z7xQA!taIMrvc|qjzrGI zP*Vd2XM8D2VAb(^pOMQyR+G%s%dDu_5Cu5KXVI=&hPa~ggm9_FIT5$*Pkmfog! zYIx#Z>;ZoWWliK0{$YdjVcN@6J|#?snAsf%fz$csPyhi3i1%e8uGFU>;v>x9zE(h; z&^NDk!^5eQUWZe6uEV=lTc@+Pv%tgCt{Wf-fE6?(-jK+$f8FgvT7sTtna61yZL?O9 zoNQ7x>netJ3pJm#D_P5p!377#FQawH`$bEPsF6l?Yop)~k^Eo`tXSCFqCL?ml!Iz? z9)T&0K}L&Mzk0S5KQ+MIUm9Q@IBf%m2jRi_!FU`+rz#E)_x8qnqr?62+3|67aDH-h z5Fd}#`QG8Wg3QxKkm=U-sl86Rp&ZZp5hG8){R^Vq9U6e-k%}AAcNM6XaQ{l_W1v@u zdj6lk{Ko@64OksfKB-eZzz5ywKOgXEAk6b*Nj)kSuStgi93-`tVo%u=T#Xj@VABea z`!2!mpeA#1+UOP~m=(8-BD@6Wpt}8gWf}a!SplMbj!A8!vu$*?jm|!+=%NH=&DI%@LY4fn& z8|XCk++O<}zo0HdmP~CF>sTM>gDd$YQP4t47{9~xSoTCmsEa<0QIyWutLH~)8^u%p z&%-$sXj`lh-Z`&;(^fB47H6Ma&tb$B}Z|WpgUz#8Fbm`B9Ke|ELhvqanJ)M1;w4-%Q znj4%(e!pvQbw|T%pC;#cwUhJpi_5EE|7dU6+OK;0{3ok@eqX)x9&^yOS2w90+`pYI z+s9AOT!6sAFmfxWLnoPi-(7wGAzs1$L9nn?+qt85pG6LJg@`aACn=-~Z~vaE;r{+Q z4yD&3_(VxXy4Pc!P8Uwe8-eA*w9rM6fK_uRQ(MmT5859yg1bK2473pxs>VfXX{2D& zDWbQ9+5iM}fHwLRWvZM&09rG{lqG@TQ4&DNhtZFE__nme=rSh3pihCwVukg7_%?s# z5wH_4Dd`L;WVbsOres=+n5cahrS$8SH45zA?XEm%A3OL}``EJQyJ{uDkk{KT%C>*Z z5JWwXC_AIys?r7kN;m8e4df%3rNfWh{ic57dAQ(qO1ANaOsK~zs!e z8Nu(y@!hEQ&JB{IsTtnXGg%BRTj`1Vm39hD8)1XA$zAArH1Z~CRp54#nC(Qb#uDYy zXgNXIxllE?uyV7VUM-2`inCX@(wVey404}US~A{{eOh9D#kgjDQP`^8pY;XjD$Qpz zlXL=s%3bJQs#>joF3^$c^{IKu;E&mv(bswsyv>wbJyb*xDjKG4v#}?Ue)sgo2?Xm= z#U0krCWdL2syPwT7cIvd<;{|%$**nAYg_Z$*1R^fhM>>WUe~-FMkL4m2G9;}qW(q| z*Oqh<_dVRqLf}Vf@eIMAK^9wYvh>eGgxLy$vjE*aSNMr-wFd8O*{m4 z+2`7pW0xfeT(zRd#u3^u#KqrBB`n|&0C^5R0!4|aqqD!LoG8)&TwMp_<)LvHiR_tJ zZ<*5vfKoT0zPMy881{vZ2MJUtKrf9N+^{}~J0;lB;my0Sh^ak0`mo!#wXo4RRagtX zX7*{&gv>z>*;w*dgiDo2D7)Z=J$_@HzAicCNmAp)J{>Y+O7Sba88k zH;libSRbCm8U|RWz}!5uP?7G*OsZMK`$^=)E+A*`m_ndLYZ|!Yw3*>$H{W!UBeWh z7nKjXgzQx|$DE!Ns|NO=U2lU5w&Mg7>C%q7O<_Iw_uCZKHigw^PvD@}DJ(e4+n{U_ zy2&!+?`73`A5dX9&zc*gBRLCu=>R^7R6MBRO`O?3byb#Ht*gv#VXOXqJIpsci*?ZJ zELQjN>$h??Ye{mB`XY53XgAB9z@_bwr*1ps`SIcC_$(alt9|Vc9*z$V_C|-HisN`R ziuVqW&cbmtIv%gf2|Nt0{3>H($Vd zp&O3Fo<|8!+&|yrHPN5M9TSDUh`pE^keOP>r9n6F3`*p?d!h$%3g$_;rDEB7ja#qr zv-2AJEW%AV7Q5q#e+GG+yPQf^P_{cGoB&ivf@bKvV7~jthS`X-n~+9l6GbgDCW?p@ z6|)$r6dSn8z-<)-XH@G~QaiPy!shye8 z0J2bJL^K9@fBm1QmoLm=f}~+`++@se4+jeQ%Fy2PlXNVKT3=J`yx}AF&ehrQT0*}y z$%(0ls#dV*sJO*xQP(#v)a_quQ^Zo@^5|<6M!;DNv4=_1jW?n`S4hEd^e$2}!C!+V z)u*wbR*RY5rky&~gAxec-4u3N2(witmjx4q0BguC1PyX5q>hoEBmijxPKP+PEwam& zZE3Y-v_v4;!F>=2=tYDb*=F%9PXMs~j5?^Q8)Slv zyRbNT?N-}P|pv^(Gh=g5i(7sb{4Cm*ol|nc$B3tzZ*i^VpC{ zS}`MqJ4scZr}}^Nj+-eESP6d2@^^Z6@;q)&T5I*+Te5z|&Auy~+ZD52ydGYK<4Uhl zTC0~u4jc+F!jDt43WQ&@YCU1yTZH9o+UXkR%g+;n|JzBW$HpXvtpY@>mdn`krglZ9Aa zao=o$pLrzqjk5j$l>Nd{Uc?XzCs~x%+`o)+f8gq~H#|1|Do&liI?V3tUsw`nB7<38 zqQ9^BMjm-D%MISUlm2vRC;ge%Nq_ice;DUc4O2`!JhY%6z6m`HGNA7pJag}BaxF{u zrM36Yck8v_D|QEK>28RM#(TG2+X5!v7c$I9p~&l~Rz6Du(UnVcitv?F0#^T#WMAV% z`=VJgN>c7sQI;Jgj9}r~zd3_>0voa9qui+`*tPdC{VvICfO+QcjCP0HG%t|2%an)G| z0~xqUKoQGc7pC8UOK_>Hkl(3lIRT}PvL!emmPNW zWQ)pFk(-vBas`bumXtz-R!&$TdqS#$@l0m=Z?Z;RuLuoQ{gvQ** z7_?eHX}P3fLh8%!XGvi<7@{S8b~;P?!+VMA6;$0hJ;!lFPT6{ljBn;nBc_^0~zZ_tLk5ng)N|k-(+s$vqn_sW-Fb~=MQk!woM>Evx0T|19 z4v$N&3$g`$V_^#HE(xg>7P*t(QT6*_l;DaNVQrK=%j4UhNo#@hcBL$CGcZUtQ$$I~ z!fJ5qyqJJ*&`WBKPpmngEp7ikbKAee@c4ND^yK{H>>%7bJvfZQlUT(^Cntx8@yYRt z-VP3q^#86ajd$Qz6L`n>qcJ8>ezcUmYLF0Nsx6!(Xw8(0v&z^OE0JkaotnM!>E#QO zu5KOD=ziMH9-F>}gBUFwh!`F82&A^5od+ReM4M!?e?mU%I`LCDOEQFSMObzhc7`TV zuoOdRI0SPC zevKxBQV~V6n<8C$UfCl#l_R;?vSl)`d96dyMl?=c8~{Gh|k3=eT4J*c2cM_m>j5LeP~5C|m^CU6{07*Y&?Q4_2t9d09& zOj76cGV~;uitbOc$IxrWns+j2=tv7EL};haT2ae$s6zYZF>iPxx&IsspSILnt(a0K zN%IJ5!C-&2&4FPia9U8g?rJELIAhr$CWO*&xl0Sgv^BT4cYjSP&_*$?NB)Jd=!Le<5t z=O>8_TI#k~0V56TAj6Quq_E&PvWX<9J2?E5@6-r?)(@nHV^vF12&P^?@hHi{q@;XU z15Syj+;%;#cs=&JtNuLdtaT-gINJ3d+;s7J>qvKjA*8-b=TlL8T zuzYljsc8>5L4Frp1*+9)3S}eerS_mFX8dD|1#{r|wF zXd>NhnKkWbfNnGcnEly_DXbiyU8_V*XA7u40RXiBQUNGv3idHjl5p_m;$G?Fm!DjH zY4yubzx;!XR*?s$r|lwQ@;~WVE@vvLJW!1i%8{h9ScNUPd|MUSRz*I?sz~oS?_dv1 zYdP&Zc62M)!CH?w)N_YGGlBbQiVQCuk#+=RM8!Zm40-e;{KJ&+3pb!uxB=^>nUF|Q ztAOr;bVQ!I1wIfgU{~#+h64cQl2aM+fOAja$Ou5rWLw)H2;qe`!AC_fMO&8OPw0y! znWWR4qKV$?wZ}%K6o)63pUQ2I@+uv4u*t`WO>Zu>Cl2gA*o2;A2$C>l>Pm0}C|F<* zz~eU#`FI-DNg6Y95bHV4mtGzYpv5sXSiqDL9G>x*DMnY&HJER&UiHl--0*;^=LCL! zvdRhJ!H{o%t|;*~!^kRCM*W%4aS4j0+3LpDbXIISeXe3SbgC|Nxgp72wku_xtT}Bv z(>$&TXX%_JiQcaOnNF;(?E{TC13SNJHn?4mTOiF@z?N-cTiwT(bNnD75}t$nuz@2d zq~P4W$%~S4qOCFXZ7pm#kh%ZFesc1oz1y5A`xls~ArmBDpiq>JVRk+XJH8hzdh@Jn zdERCzmDSmypSL+0BE!KjcI%PDB%9}{o_naLuPcdj6nqVLZt+b8?#&-9siRsX7=%k@ zIrc^YnMu(Itk7!L&?cA6>vUoa&iKecSsIBfFES?Uhw||@VF3jI( z6*REyUT26fNgFHay&mNgAm^20T**qkrQzLgx)e5v37o$Ll&B4E%5hfPE@@N0w=_Xg z7N&+*+zyF2%Ep}zdf!ZT!!uJyz0OPt3>@1i0oas@DM>n>+Sp6(qJR#2Ra7}r2SOT@ zB~A3^8rEZg>!P!X+Pd#yLzHqb67SVp+gh=0^*YmILL0ZOSZLmfqv86^(~IY1bfrY2 zIuvpmknXi54%&Mnr6IewIK2T^g4WoYdTz!r#X3dJV>G)~n4aOARB<{Yl%I$zehGqwS4QV!pd5uz{YL(uUVhj-H(M z*_2FM!#nM+H9+U2{Q+=ZfH4?#WiM4|@E{PwW~JC0|J?@}EnT>a&{(c z-#oj8|17S|94@WQ94`_XSqtI%KbgqLkqq;b6%5W+ETKWd1rS;pS&?f%qh*ue8_>-7 zvO&HRYJ+;FARC7B^eW6k>YkFXH7D+V@&;gjUo86D$r8go+}n3cibq2WW=1Ty6u<6k z#19iXI0DIsF6?xt`E)NlN8M+EM0mXplGJ&_EE*j|-{#Jw*YqozqSJ&%f96LNyCq8Z{EE#I#Ehd6N zzeLSnabcV;vy^v=>pQgG1hSo0h^hft7g?7hJq~`SW4+?3i%yyUWIPT#({k4;kZC*RTQx5sda=h%D$0X3ec`w zeNO^D(t^eOqWqL_(R+(!oHeC;{QdvTVcLt&!-MnF^ZotsbZ`H7G>S&?!QPSDA4TJE zbbcJ4?Cl?g;dniun4^|pM!D3$AM3Dqi~Y{bvyAD9Fa<03nwn@ATecLz-mrxZ_H70z zm=8Ee7bQ>^vzI>!UZk-806gI>F-!4BeckVg$tN=s7-)EI6C!-aDl zKH>|=Ny1Q1X!L|$2JL4K+M6U^5b5ovNoi0uel}GP91^o>>K@S2#4nv>+Q{aR+Qk4t zTT`Jhe+$7QY*PRqA@Ul0l=MCe1b6lJj0jlDZC%rMt#1Eb8Lz?EBR_*9(?V?ucO5>? zbAGStL_hnV@uGDqoWA(dKw`7`LV<1vorMm%#4$$G`gN%kCaD%)XO$-4p~V5X)(3U+jL(och>FR{0}xa-)&t$lrN;rQJjt|{bjoErC-;p5ql z4;FX^5LBqLc?Hikt4u1^Ju>utfno#?st!b!zIn}jkN91^-Ov&Md+^vP{iDB#@B(T(9`XCvj-Gv#Ku=e@|pYC}+?%cJqq7@Y9n0d51mZJ@Ue^ggRVum8;Ri~K()yh6f4 zYNWKpo5t(Wd)RcwUPLi7sw^rSR={kCRS`&yO$aWE*7i zaY*f3C@V8+=QI%dPiSaoPIm3UBHc+~+3)-2<7{+W$5G#j*PG$-bawkU0AN9;UBJpA zvBGt(32W|7r-xY$1FH~#eMTSk5uYZbLev8}p zVB}0ZBFl=4TzWr_5M&6QQwgTveC{fjRmAHF>^c9##v5|4drthaFN865v1ngTkvzfA zx2z&X)Goi8oBJRhl@)5Dqsij#?9sC4=tv@&!L_nL?Q9X;W(q_Ic|-rNSyjayU`h?J z9MCdn1?>|&kY6DiAA5va17u~$Az^mf2r@=8mJMVg52W`=VH6CR=coz-L};P%{5YH z`rMh~!ogi%5z4`HKwVF>QFhd)ANQnI4yTD{`1uGZB7bJJ5FsiPsuO0Y;yhiIbJc_# zVuD#TRKeNf19>4vVU)p0m8jN6{$rU`buR<3jkoi&O}2B#(zt2Cu=~(&Ors(#34;#m z-ft~-)t9a6`r76hBK&7@W%_(sW%_*2uS_2 zc8S7cN$v(Kdx>N>DF(F#ZK*8SCB03|uiA(=r!Wi~zmpDgVlQvkM;!_Su7qZ{D{YI| zUdS7v`T0c_tM@8?_7!$dV6rU#F#+za?$mqRfCoar3hmr86JD@DQGX#jp9o7n7k{{$ zvtw@&+00s~F8;~LW{zc;pG-D$zQ05 zA0Y~+PXP6dch1~U*ra!ZG;Y1v4&IqQ%;>>tXVmZ44@bH7GCSs|3`QS4de+`%U`OAmOzCM1AT!|F*BdpdnN?!vn`f7Ac7uElOo{5nNkIufZwU=U0(dSA+vb4+F5*IS6`t2PkUV6Jgo3e!MZN| zKY#g;bzQoVs9WC?{O88aI{A$ovS`j%yJ-G!0|Ce^)L(){1LT;P!3v%!j^XbyFYTZh z!`?3z{cV3)zzig;h9vB0|734;dVU<8sl(Axc(i|XaC)pxN73Q=xf+koN2mMY{^;H$ zVGm=xJPw}Sew?c`pUt>~N(UT81Tz*@;9GOo22hQ6hPB-ZfrC3qFpt)e8Td^}FrTR) zLmj@_?>OdKEO6!ly@kFil3F4PC#e{B8RyfGgyFbv81>mOnQz)=OzDG!+PG}uGY+}} zZUgrQh(~Q)y`kFD(am6P*@9}OZlBpR=o zA(5^jm+mf+MmH2vk9jTT{CWW;SgM+{LY7-h-`t&TcePQ6A@XVAM`|Rn=HgOVmt|ro z#cU(H*N+}|T#|UOA#v)Ee@WZBGcoWMy$4&m;@#bDnM&y4o}&`_$K%o2nc6!!+dDZv zJva{c_fO)3@kw|Zjn4Ex!^3F*?C@|jS`RSfxSJADHQ%tR+OOuWjqnk76hylMl4+DC zEHvLeQpKW?V{Pr!(gcD!Su9ozU-i2ukU5B33&E<0upL!WN?I6t6JXlEJIDqc!}2VY z`D2~#L;|RwY?J_BA6MDa$LGL<>v1>s69sgy6?fV+rfs0#Q^h4Vgzd)O-rN)hZOgC{ z#y@0C&@cbhA*dB*6UCPB%RgZIwF0jC^Umdg?2tHI7m=E-bnf0}_U2|Y4w)s2nUO#oq;Q3b=*-Gt;>Sf; zRz=O5OJ0}5A3`iZJ&tvO4Oz1=){VvkU+pSK9EA>{a)3{Wx|BxI3gOxe4Vfpjew;;$M?Ty+y8Re4&3fAgjWTq1 zqug3|V{LG0GRZs&9Nc4hOp)UG2e?BaCs&FN(+s_>#EKvS7Ka;>+6&F!rK`oh>=qlj z#YV0X6S2ict`7lo+;c+HRy%V$Cb!V8)YwIYKltO|oL4ZD!e~^Z8??m?~;=Vy?HX6ow+*=yZ zKbr<)ZRTN`Pim3*f)+`lE7uOaB~8+yv5w5NOAT%*unR;a9k6rt)$3Qg1L?Si+lW?~ zLl@kzQ*s$?CDPvHKt~$SQ{>1^Dkpo9WHCgo1!WgRJ`|~;YZP_jZfHTDCz7aC(n{K?c_ZpDt$~B0 zJ&XPERLF5bGr?=!pp#(?1uQfM<0*bnT9bSlN=%!`Rcbpy(3ppT_EhQ9Q8j5Xod~!z z5>~ z^K0!+INCZspWpuP`zE=G-P3qvn`e4oyjzT^$FkUxqS=uP5eUQm@zLlYI*-oPINCpr zPEJ*Hbaob=kM>Uvk4O9ahi6JsPAe~(9RyF^`cg}#jjKxGV*>L1B%!0au~-w)Empfj z?x;xNc8BWfK9dEObZsH<5t5bP6XRN8wjiu2!h%Q#MYcFas~4JV0^V@-&w2xJ3mNSK zSF9T6kh~T6`;MV8mB`BQ!MQx}oYq#muBQoQ_)l5Y>Pc?Y4UEM1TKU_`~MW_H=j^a`lRB%H0(PVd~b4bRtZ7F&7P zU~FYyYpk+TO6%$#=WpDVD*{ucEnZg64X#)Ln>5)=^a+IFmit zpZN#@qsmg5@_^7NzsC==ZVP=nLk+)BFSy9U<2WmiidK+U2V&;B6iA@+OntNX4bOJ= zoEE%Ub2Gp^C8ZiJ6XB*Sf0PZ~aORujr|Ug*<9u7_ST7HP5J!*%qD%yTYe7zbaVp<| zPnJG@k{P=ZZzx4B6wk1!q)$#6abt>2895S@&E%1)!UE!ZIFa-MuQAxS?BOP0v6xoH zKx3NoPP7b)$^sBD)bkpIpq<`BUZGD-CQCn6cQX0dW#>G8ayax4_946I$-TSG9-2Zv zZ1$O%JN`Ba<0!}QB(=EeHtf|!fan4IkY|$=*@uYTzeIbV^gEbUoC*s1PC! z77KO`tlU|5I#h?(c}%5Wr&-5OHdB66A7ZKAA>i*$Hy12q^)K|8EkALtjCW5T~p+l7x$0LmKG+<$8zl zGU-aZ0vMXmJ0V7!pv800IpBOs@nKfwXn91vs)WPLK;W9aVUJWHz=k&Wv7FAfE{I)M zLLNFbt5UXN(^x=<+U-X^?ixC!j$|)f7QhN&1nqOSV4(1NKq~;=U^wq zo)Wt@^{uIbAZ`MTzl0_Wj^Gvzs9^OfP?61x(s&tGrCGj2PAB2H!Jhb+|9co9)sRR#(+sULmZK%_Ll=p zaOkZ%g7kvbnZY{($a0>CpsS?E{31E2nH`_tp zbi@%dTz7VdZnMRoV5ohsk$7G^l=Vu>3ZRC9w3j+3Mxk>4!zP2FC1KY zLQqS$E^VnsiKUc;F1fcgXFfj`bzR$gp4&RuLv9Xo%Z2v*I<==L(BS!T60t z?>~UaPLnuJ)w{4zR96{8-UAWan0v7(z%YhNw+dcdQV?Gxz?Ih#Hk#B%LS?~@a8+89 zSd3CKN!Br88iPfF^Ek<%&Cdyx8|BQ@id6y)7kw8W3l{+|DtSiJW!T^zQl|A$s`!4{ z-sgRA8!nK`XM`$#7&3=AqZBjOurg`n)7!rZ&r1h%cK>J+j(+YkmEk~02nui6i zRLp1r76$0Oc-;hyQZX)}2eZYKX<`+cxdS+4vn`>840s--G*nEPB*dU+yIO+1w60f9 z9WHqkH1|aD_$bK){13jo!^D?@Cvg% z7|AeKlPiv+hDI{RToD&ZIGiE&M2=?*e*|@L*mxCNNv*Az~XkA3*8mOwIGaAM;KJw#6r2S z`w=pxdCQpcU?~2xqaDH9|0b7FemQ7VON;6! zeo_4h=uNc?iozsAhlFokHT9$5!rstj{p)z@Ww-y;CH0pCiW#N1KTl0r$qdLe=%Ak> z^1RKD4Z8h_>(>|8uipkc*U3~3^YQQkv_pnfK9pa)E!FOT^{3DqY2h~2Hob;8_^^d^@X2w76c#*RkVl5pSdi{Yq~gfnW3IP) zaS6CoE(XCem&OUC>wMr%1DK4VPzdKwhVA+GCfkbJgMa_UyKTj7TXE~J7j)F`iW@ip zj1|%6VK}kOt?Z*u>r@A?xYat1nwaVW;&tAo4Xq}NvGFy5Xq723y+Rl`>_GaFAo7?u z@?EA>^g$npQEpH^yQwdNXwfBxWjGd=WPRUAM-e5TW{uOqo@mI5rHTR)csZdZ^v$OF z^vq3)+YOiXc^4;Lryp~Iz?oB9H91p(?Ag-VaP;v}ze{~!Q}mn2hyFkz!B*Q$Uz2dN zm)M`I{eLtlW*+r0L<4b4LPjq`eph7<8}z^k??Tpy3)ooaKmv0ogQR_soQQ3S%&n0a zTIlByO)2aU)7Q)1Esb@ZsBgDG|v}N1+($WTySNd_n9D^hxW37|4a%) zn@<2J{(_s*_P(S)2JpdRyD(S0Fne9vbT)gBk)-spPEmeCeJ#r0|K$=AdElA~biAVf z01FTP9w};k(QB?0!l+m(oHdK$G9EX_z8FOLm*EE_BZi|_FGgE<36T$vPAVQdNCi%C z_wew681q91W=Z_;$|uTzpUj3s&&8?fqBS?&1tSk=nPg!+SIpYWrB#`~X_(Fxj1p&% zlf+RPV*MnqO^(>WMz?ElwQI1?rBd|&@-(R&k&6^Ue&aLQcHcms3b%iYZWPHBlt2*K zj{i-Kr7Vf8KHxLp_M<)>D_jkb=yltO8!2O`&Eyt|Fw66_bnY?W;t75LE+zNIMu8+J z&os%P9S(e21C~fI!WXnZQ`%8^ChKF_<5OE#PL^fa_V*WQ3$H~%=$}km_(X>JsiIwn zdn?up6gg9_*94a)eSTReIAoH?6Y*T(EUj1%kY?$XJ|u&uI{uwxXe1jwLn{`4qZzvR z5T$vhp8YZSO1l^!X!=UK_n-w*23Io`nGj?%CTV|f9g_rz9HaSqjgYlT@J*e>>Pz#Z z-kY#q1p%1elfl6?EAt+6*RlQYH!R))ZXb?6z=Vvh4-$-JWNIJB>0_=P-;=+x!iNwUxpM`=T6>z208*-3*_{U*KrvB zrgC~vTq4{Tl-qqdDXDi(YGHe^pM(qmO|amrRDma|Q2pWcsX(f-LQV9Q3eH~WnCp8)k z3782b@Z)4&rxQaXfQ4Sklj|T!+rwi>P+bbI1BwYGsbxcRXs!_Kou=3|4xfWw?>|%8 zM$g;O6f`)INCz&Ft<(E#a96r<$h~D4_m?ut?z_ijymzRg!}Fuj-toB_9qAMEeD8RC zdKkvzv(ee%d3<(q9EJz$I92p<*)7A^vPf@>d#rQEuhAPIW(_7MN)#lMND2;+4UlYh zd;CO_!L4WXp;-c{1z8<)1+ai9!JQVs!bFTSlRg7IGn^KK9QqgzmPoGT?*AT3KI~0N z7A2(UrHCQ}*04SYakb`p5lzEI%V&!n*kT8^*ny2qom4Jz)=u8Q!f+^K!EzT;L2ECJJRc*^rAgzG3Sz&`>4dumr{4zdKu zRv!JRhdB_@PtuFU;wm(Tpvo`axnB?(9lYPugkAFXeI*eEgvmz4jo{jxG{PZc@{N!K<0@^ zsnG!+5YEMS>eK!SHx(}`#7eO1F%JAGRQ3BI_O`(=j9?iSS-DCJQ>85h1_MOCOvUR{$J`|2ae+@W zkPo=ExyE*cg$?N{;wYaG>o&M^RF|-kmT7R}q+9)O#jofE^~B?ITMs-&wg=RqE2Kz| zxEcLXhsu?aW3IBSc|%@eDx9kb(Jk0pSmsG)78_Ugop{~8_Q$bM`+}on7~?ofQJBXW zX-I2~^DGYWxK0J{))oFVRz03~4Nx6eC?B~D|1mkPZE&&;PPW0xXBC|ETRwr~3Qn0j z0f4J7kyVoakf z$wZyGP6g9x#C5W5M_jeN_8l_pWcW!BA?_xYh+E+*`SRv8mLiN?_$JpD6;{wx)jr9Y z5^|wiYl$6F8Q0tE3rgbal|*)rb+Hg(iTY;bOi8;tg$3{(@V5#DRSmtMgs;fND_EPj z;Y_)~7`x8DCo$BOv)=>Q@VMN?9a6`Z>LSf&2+%B&bFRxw$f16YUklP{L zs*Zr_QZ*$XjIWR6TV9I`*PRoJ;EYxd*L^&h>kUuf^xWY3j&e0NBv@*uO|DrmyeN=~ zm-%;;=m#?wmHD>h7zczlwbewQ>j1hVDE4Zf53uFdTSlr?8{j6<(BQwhqoA4W&J6D# z9Ge!h;fQH_nJmuhbeBoH@?BnwPh{xLZ8Cu&FZy?)j*gxVcN4leTB2D>IA`UrEJPK= z2~yrXv$W@3xA{R;LN*26hLF5)njYwKenL(JMs7kKTM)DPG}JD<{x?xjF@w4`aL)Whan49%0*Oj(E3~v8zkuUpLd3zssz@nyiN!oT~+?IId zA@l|&T`JCq2a3X(==(;kGMS4`NVye=fncV|)#XJf>vE?5rq_>y9YYusg}Qj0LFz8C8H^k_Sgoc8wTiD3SWz)UtSLMcs=NVQW4*FYjw@BL=NcTmGk#>XZuy`y;Ss~vez zbp7{Q`@6I|!#)dpEGm>~m${W1Y)YdI8X97T%CR*l_T0_EXBw>sivh$@o`MQXAL%kS zJXGx~GrrSO?{rI$JsHjm-%QEe(|j_iS=k{cT2T&L41t>L$LcCbC+(vBr~8wX{XaR zc%!0b*Ikn<-u95m=dWL0K}5)sE1PF*%hPeo`4&$7bllOx^i(x*!1sY zkmZJtm5B2?{D@y2@)Jd+z%dn)2Dir%@-|VT0AN`y>dXTGC&J&$M#31=W3-D}vK(OX z(rz^5BR-;P5B3qpv=!GtqytwiEQh-RbLxv583)4Uc}cgDe`C9Y*y)Bk((T6>C0e)@ zQ4jfrGhC9PF9@P%Q+-CFo5hE0(;qYAHKGIC0V#mWjF^nEM=9Yxspuw8-rEPT`oF(L zDzGaP+ku@%uGvo0^*Eu)2Slk#BU;0q2Vq(|^lu__VS%!a-lif$Ky8p|g4GBkwuyym zC^xj!V|`q-`)7#k$~;{Nir(g}wt1^<-fBbryMFV@-Vd$@f3a$zK zV0Pmzq-I^V)z36h2c(ANpN&T*r!wSpI*(;I6qmCaZf$ABw$$siOUstT`|{f097+r7 zbuu28W#weG4rcWyI+KA%tU~orDw0ogaQDf>c3~~uy>m`4A4!8ps6ePa);#ri30jS@ zF0YB60TD}QGLU2gt$leQe7ZCcKJx?N;~{f6VHC_shjj(P$H6!EB#ip4kSI%fN4+2r zQYtwDzO@a_sBI9->&_~{q&I~*$b4z~AW8`?@9c=%h9}$bWE-Ar=&^s?Tt0S$P9)&aH%x>S%h-s#j*ynj0hYGUc94Xwp6=X7%oe3D|y{ov6(Dh_FxPKWRrl184pu7P^d6bYqj{(eE`eaKE{@COx zO(xjrB}&ow+p3+oa90A90R5UNaIQF{m~I=TWwPl=bvUjTO0yTl5(_B|pN6rPuDRL? zR>uP)^cZqmz6_ppUbBSNDf_ml9-_an(n9GQH4O{B=lt^1m)ZufK?^`d*#w)$caYHR z>RmF{8{;>*eq{s0%`^jWszVnfdnp(t2*8xsx0vPAQ2}Ljb4}}Dq~$KY;|vIKg`DfZXV8MhlH?nOoqQ zs_OP*b(4$KdWC*J69QQuhP6xOSp^L%62RpG{T(meBDrcrx{HXn;oE>*Z)xf)&@%TNbMmtC(`4>Dzp9zBaIA@Qs$SFI@eald~vNXU%u`BVs zSN&}Ci_&8-lCsj5t)m18(idvB`{ghnRBUmJoP)w3$GC|=LU42Yaip}Xs_#Y82Dd*? z3W3sFh#n2=QCJ{@DfqS|<-oI{y-Cw&1tg&WiO??$rd-d+1l>pN{IAw+Icsd8_Z$B+ z-w8K485m#iH7k(d-!RvcV1cn9CqAEn@Frh-H`}Fd~0RM6I?Dtkz##^w0TXqKEk?|26j3gSFV8BF=#JSB;x}k%!rtP(#5bZCsY8Gj|H6SGHfwZVy6Le z__TR!HV(N4m&QXk_fKkUSaf1B;RWRBqJ%_<%p^)hR`5l;?EwEw%SX{? z#|w-I-}H*lj`LsTelMFe%VZdP*5{rXLWbfk_=eSywf^$c|JtkvHj9|IE2PXQv}**6 z)()Kv)wkUZdgC6oxwF_eDxRuzx-=ZN1nK@<@G?pFD%{tVXY-aL|IwB`)0-#QvcvVF zEUyf!`Ql9hV1QCEBaV8=vbNVhEMz;E>V1^fP+2t)Z8^m0V3!TSaH_Nq0&dWbn#t9{ zg3lYW7S>w8I~P{h+#J?v4Gddi*`t&xLK_+fbvgVYjD+Qf&mZe&3`9{WgC85;b`c`P zFN54T=t*Z(j3AjNUzI%GTOKzqAH4NdCQBCJ4(s?C@UN=rcr{<-yc~U@5o|5z!cj8w_OCcF+JDkF| z4Ln^!Q}R=ZGRoGTA-=2UA?Vhjn%{&~(ILY1nzu`?$N)AT7=no@VVtB@;rEo0YejB? z5H~puaMJUJ34vLyZ){q{E#PB|=6vw)zj(Jrb8gX`Yk!l!5+rfjYXLGu+ej+nz8kqT z1o?c=K7`F|gD)--9D#drF-Oml>0ZWA9d}9k8pL+I!@oCx%>naFV}HgduOpyJ*T;%w z-b2zF*F|fNWqt(vvi|Q$-#`l+jRXQC?=?o#G4i|2Tdx4U4t9eKATlMn_+?!pBmmJe z_WUk@_tr&g3Z65zeiP-pfk7atlBpuv7y-8B^&IkCfKviBVg`6%{y@hj!cHJQ6E4uc z+3iEXHeKHOQu2+1Q{P)Z7?NAKE z&6KM;{zowQ(?4R)&yNkf;ZGo&Oqop4u8=@_oa%{jKWs=eKroNVA8d5fBJAbfS4-Gy zlawWkXWZn|97WGcq8_0b_neu)qdHB1TR2HuvU3p6 z(Nj4p$&ft8fZ=ogf@1nGZLmbkRtgq9EHUihJSu zS;B(azW$sc6hMJRs zvw?Um)DNmcjv!9fIiN5vZ|5#x+u`H9XSv-pOd(l?%r2Qz5n*}V`63oJMY!G&*+ILp zgL;Z_BV*7c?tDPkM&IVuEdcn&hZVm)Vw!V%IczNj>!ai#o3bciecKJOk0g$0Pa@c9 z`P8bD#+fB@U0&tKwV9bx#jwhU@L%3+vv3X^Qn>HvEs{yZsn`iC0w$Ia3*AQreu{n| zrd6VK#RRO-xGze5d65X9JQYPUeCz7x%awu8m^jO*2FSgLp92tIn2E0xo=mVopLvFT1Sh$FtI!ZpOX`<9H7Zo37 zRgP{FO*CWevDRjXb)z>8um?csUpQY;fX^q6T@OAlEM5XD?zj<@Ew#ICm0|_Mj;m74 zEX*<;e+J$?)jFixAASOhCMevLd z3&@l38S*mxpqG&Wrt=X38#i}6f%9Tmgp5uJ`B!{!e8LgYw}i)rC+hmH;AxUwuB!;f zCPg}_QW_8%S|2IP_zh2Gov^R$NVErFzS@ZIvh!WfV<4d!{qs0UCGKE9&8h!U^%VW5 z3b+OIU-53{_f|oiOMh(hTz19F=24zDytqaP=-d$(!7(mQe{u6n#j7y|9jx96rHFdfOe_Ov-JS#)_9lf4jby9w7>eYedqGc{&PkQ7G6h zn0r94DF3@)vM89rga`T%0GKSLnPMl+^nfKe4by;AQd|36v3>ShQ*?dyIn!Q{sMw}C zB}gA`nA!>9gk|g`o*HG$zM1UZWyqeJ?8)YttXCoT*}LX-iqKPLh+uoR2R#7l>VgEA zfBCQAB8BYnw<=BZ;Fo{UNq+xGG!s__Y!(Q?7O${bJxWc6S`Q+t8I%g1x&DkM@S=q9RqDk zWih(#Verpt^=Cb{dZ^F*%6y@TI5Bc8!Wn*^<$!fm3D6EQG#zjj3aWX{bRd%z*(^zH zQ`mtOBG=aa>~eQNi>Sh_9jfDcy)}bFJTO8Tnool^XfVvUQFlb=TKj^Vw;13*ive0o zNudwUe1O*BuuLXaq+ne*t;68Ty-mjxF1zV^8!9?lC|b>+otQ1KUiYbNMK)~wA~gq7?6QWZ+}8`j%O(zbE9vRg1BL3td@?5U|=kCMu|o} zw$wP~bLbG`#QV04{ovn!@ornj-j=cZ>yGwYcZHPN@)9TOiE8Hrk zsLN|nSjcbVKiI>DT74xG$h29Thsvf2J1Ygzj47WU!XQEyilpcAHNF9p8fWxM9ig{Gi1R7;VX_!U+4El^F-Sm(vBnthNi=lIhR?M6F=Ie{# z@c4Ky7y`uQ%iw88q8xd7F_V4`nRJI$be&|gtDLkIv#a8yo$l}JNxQz`Rl2;^5bPj~ zZ9}H(aP`x5e0p-Er|aGs_2&j;SmnXAG;?K?wj`hU9 zo`dVE-hJsTWSJzI(XWd9o&MhNtFTn@CNA>hwM^cLo;+im7kW05SQXrv1JkxqhsViU zrsz~p5qoB4rk;v&f?lB;GC8NKog4#R#&yPJl}iL!-;1QZBc3^I#xw5U&X>hHNBcI` zp*FB#IGm(8^%vha+<6G^_ETy$dm4Nhd?WW+ZG^G^t6u#lWKvw4_WLV8!4F>c+5h>= zzXwl8B`Eeey^)TBib>QtMDI|Kqo((9Ld>PqfrxCSsv<}bmq8pNuqG{@VZy!rNE~>b z*L32?lq%cMJSoyz5SAcxDzWYLh78<+TOfI;Ji>g{bhy8Pp~Oha6I{U`z`+5PhBsjr z=hNiR^pUcG#?yC%CC25&QE(>_$S9|KIR3tnaqeOekd3AI9GqoTyJ#!fS$obI*SqBj-D3K%Qd};&Y*dh>yk5G@V zA>Lp*RIk%qb`anfx&4b!Vqy;+(Lor7e|aGQS%iBb=g@%5|J-e-$E{LGoL)V>y54vb zY&5v6@d)|ega3#k0&eHdf1mV_!z`bDQ`e!bD=A-L(hI>%cww z#4tbg9sarpf@J8lu46ZKSnsj6qvxZJ%NgXND0x}+Wdg1`Q)(ox7O=g zH2VoQY&n0!%lppjh&Ltsp-GbU)3iIFv8km zyytu)15`+r*q`8rfTS_gqV#@s>5|5}Et-wdeUs-C_z3=`2=6@{Ml_Us0ZaDt|K{~| zJyHYt!?QfXXyTh`n53I-k6$He8sy{Pm44HO-a<sMrdFOw30)-0XD zJ_kflDV!P@4NC8gjjQ0aiEGr2^&`AN@U>{hk_HRDR)@CL(@CNRHjvLDBi09pbSRV< zjRGpBE30JV;!S_|7uKcwiu3nxM)Z?+8XelNOFQ0qVY9^ zOwrp=$I`EmsW!L+P`eVBzkjhyw*(|nG2uuhg47{8$K-Dt56YhR=neCQzy^SuQpj$+ zz_G#JruWQ&{0<00GulSMH>nNh0g|$1wL^zyCSv0a3lbM`rz2_*XKV8?o?d{5afR)k z9+z#a#mLFQY6mq;qdIj0|1bqnv+9N}BO)vE6#6y;8(=jXh)5O)n39;0mbyU#ud8VD z-|}*e%yqqCQQm}o@Ksm}1q+nI2JpWZ`ae({(?2}Bgn?gOzy0ouMfBgBWgCvv%A-|? z8h6EnKHPU{g($?%?=Jey#Z{rt;PseBrpI|TU$X`!9D>G|qmDW1yjSQ8bdRf{7~y}A zj+tC^ZXpHW#|PkNa9(m?LYCb%EmK5H z!D5zA^<-lOBv#Ds3;lXfox@}&w4<>Ol-bhtk&T+QbO@n?h8M5_oedc_|Gfz1uQ-nu zJio?Qbq&Q@BL8nxK77Z@4rbsc%z|kW6*-T1fLQ}Lm@(4lgt2zJZvT!|cKO+S%IOX$ zYjViI0atoKb0#~^(U9m~@$JWHSTvNnNJ|$k2d=xyDDnfskM|-qqpAo*2?8LLCL&_{ zbzmXJ9ty1W%XR{EC?5jID@6LfBsUgxWlgdMYhVo-RGc=*`YVhF^u_Z+Dw_C`SwF!! zd2AaI1U3-iV1F`we&bDBTSz&)g1pfcHTPwcbvcfIyt*Q<@%uJyOzQiMR zvhhS@_k&T72&ieX6jK-Lb-B5-dgI^Yhloz?d7@ZDfpO&oiQ%Nl+Hy+IUP?qzh=KSpbvlVIgbPT5 zHtCh#iBMkG%Ou=0zf7h8X$J4w52y=Pb!fmb8u~7DdbpKZ_9Zwb6IM)1H-ZtFIF4~R z<6Lptl7(@iPS8K64cg=3Z|o)WBn;j@yWD*eJR?>K-Uh+|0Ho*pN2e5>Vq4Gtlf#WS zAsq;Z2`B0Rx;I~QnDLC#$U=&gLenl3Ib1;#ta>uN0gj2}&0$rKN~9`_MTx>e8~W)z z2e0GcL7=9}<iGzmhVPRpBx&`W=4owH>HM^7w1L}y zYr#>_v5T!SI`3eT=A$r0SC3&BAnrirBl9ZpJ;n5Z=E)vvWTEyXP&U!ei9#HMUx#h2 z1oo2jPV@WcwzTJ*b!RU=_~WaWYjYX@_?%9n>kl(!nv&t>`lcQRgLN@K#?+FH@ICbG zv~v-KDJK7ulGq3JDNttyMvQcZqG<$h;xsG(>SH^rfrhY7sJub4>kH|bH~rn-{u>p6 zYz}T5BKu5Bm9itPn&C)osI zRk{NfivUF~mtaOf!!eb^+HXQn?ZsK}%W2)VT=ZgPve_^PoAyg;Q@!u#ueT4n=@#|e z6%=nKh1Z@(*|~oH9O_YTGhf-9ng0`JVoLNO3GOQeg>WFW15FV;C#Dg82%>9hOP1*a zEE7mHbveW&qK?s-Y&RSKZcT4w6P3MKDa&)vKUK29$?rT)@yiN91Pwr-OWf(!J9PXp z$)kjRd52Dgh_f^`0O5uvW>H?y0`07uZbo0bikrBT>Lmz3#725@ZP|;fH(%5He9AmS zE|nmO9dP|53#ARA_VL0g98ucIU{J316n@ANk?TQVL}Q!u-^hhP)=UHY>om0_Qu;E6$?VU92c6ebRe6>6&9{}Z3SK-zH}FI7I!lvmZCHk{ zUp#x=?vOz&OxcaEXyhRqa)Qw8gbqUGiRg7*X`pXY@yVfAx(mlemLY;*Vd*{9A;}o= zId0N^=lb#$%LOym*59JvUVTN`_f5A4DQr@5u}J2&LIOwnD0FKWQ(T z-#`2MfOixNW2v(wP6~<>G7uQT1|=Pv2snaeYT*FmoEbbpGxet5HN&6*4`p!UtT4&a zFK7Z@G01uHU36IajM1+}2(R?V!xR8{&{?OaY-ae=pwrGE*7a5ru@~fzd_iL$4*B-4 z7SQLvh8rMyOOpw*YBGBjj0n<%bqZ@qVJfiH4#1D_T$~Feam?Dk7|OjD$wco8n{U~0 zCg_La&L;zRTbJ3sh}o-YXK?s{;=w2j){R>sPOx)vb-8PcH7=nQ=5}-_#xXpcvU2jF zyMw3Xf}J&&2Cz1I`LlY{ODA`2f%nxtU%dyrM2mS6T=8pD-7VGn&CNp-H(AUcDMBoL z=iz7j%D)j@3%~O$pN`-eXL_3Bd}z1fmQo|NbgeyZ))w*RyKgvjp4@-521bH?Yl(JR zz*~luo+>;b(6nq-2iCpoCIK~~D+}D!-nei)OQx;V`w~3R#v6{qmFS5xv!8$aajqxF z@-nU+UAA-e;`u9t{F)r9>EV`v>d}PQ7akkkQo-dm=pU0T!u_S`u3~KfQVKe<0kk0V zOoq07-t0Y%FIr^{Ws|oOk74g*Vq1}YG`pGKKRE@IyqG}5|5d0x)L>iHibQ|d%fW%i6S$geRfgStnH?KDS zMOYR-U6jKLTI8P?VFL7EUr8}Las`POMP$hJU z=J^Ln7^!Sn;md^@CGrUPU7=317B%{l+!{mVplXR_E=0~i)f@b5xD@0MZ^G$}^8$(hh{Q|GMO81DnMukdLLvcWBn!s*0eS|xt98X1yD5+ydC;A4QAv3sn}RP z32N7%+XUM$Hfg45ILe_+J1#LZqwP$4QB}?P7VT#nC_?B%vOH&r)5w3wi!=`Y00#93 zHQMx7{=%v3|r^>cK z&S29=ge$hrAeon5-a}}8CUkWQMAM(y3tKNnDX%~E!oTt%pRNDd(DoogZkm`>5-~i7 zx}%d%6)5y5)NWoDKjDp1dw_U+=!l5|HAdz#f_gw;DHJ85@`HXlEHyN+5d1-D+Rezd ztWDy&>pP#5LGz-oGYUS}cIv!+`{EhxK5sK_<<6V16d8+nij;$MjU^^#C4+9+_%{Kp zCIV5=p3@CTS_l+uZ2|6^uV45DWnnhtGQSRq0IOCP=Gd1}I?}k(1M7PZ15(S;$BXTD zSoVmY=L-Z-U;TbvukYoO*OxAReeM|jSJ`fVz3-c(XN8>F4^Z`EXTNMf06wetOj#d- zOO#2qHizwxS6BR|zYmK9ON~v*sgBVE)XKy#90z^uI{454UqBvmMyNvOlbnX>TqW9j z&&-kPxqt>$s|*nN_U8#9N?ba)&!cVW#a;9v>w57>N`f5=mV6A06p5SYvMeUB08QZw zAw4sNuyP_Yl|KM#7@7mqBuq+HjbfCSA-0&A4yg_iYs!cNR6dy(NUavT%p@=ng0ZWL zuSY$+26tyaOXR*68(;BwVVe1_{&j6YbA9OqiWt|1syJ@;5#sV~P>%2>QFNe1lQbuE zD77`XTqpj50G0$}_VLKcI z2g*+o166_ZS0||LzahfHlFXLl2HfXG~ww#>dUS>qx7uaYa*uo@4;w51hCvW+kA%IdQSr6UV^eISK{8c*3*EC zdK7p8WhvPnVM}})L)rQyBS^QPNv5}dn_|R=S8jr^-F#f8+|7eHO?+ZzJ&Xc8zn__i zhj&8mDDqnnI4sm#9dfF4C02=(HLvBianb69v`OmEW(ll6>HhpZ{EX=f-iW;r!#mrc)t51vgqP{0_ea>-kY9O6k{JD_TPL+fH);3QxV7;O9mC_3JfBJU zRB{fgq`=D|@xwQr$`#yNxcLV9r}j--x$=#FQ$Rdmv}=^x2e^J9!b=~BAYw=cXyoXl z$(pq}XmGV&P^;p`=aycDDWECWG}FTXGb7-o5wWF74tZc7rYeDyu+M-suyyegH#d{x z2k1Pwslv0!v~}o181z{a>#VO$zim+H3 z8c3DP-q7tD({6CM@!*qggR>FZ+6?aPB3pB!Ly>oAg@v}#0of5kdok)%{P$M(k#h^M zK5XU$^3Kqc{UBQ~86C568C3>4>1yLka`b`aS0Njh*-2qRGs+DSG;8AXSfNhXCt zh@_qt33?qVUp|3avXD;{YE`45L8*&;47kXE|%c0Dvy$w8uVK}i8CXx0< zJdDjeDIr$j%A%Akb&yp;fMg`6-HzRodEk*)oNj_8OvsLqh%{z26T;bm3IaMoL^Iz! z+8w3%C&BmHC-~*3FF)Z`W4}+DWIqPQmr4Bp{7dm7K0Mm{m!_E(o>_k@U;3AO8SPC~ z&B`yo_~PBWcTe(nVL5xEXXlINN;D(6>k&474PRdpLlA*!wISc=;A4HsqE}4%)W)As zm<8kc|J!@F-bQw8P4KS})j-3EmTcWE?}KVUmYvRvo$0c?Gk2YbDNqrVL^~AJCL?4! zpX#-r`>BD`jXjMX%+4O5pU%UaIsH_|`6Km9hKpo`LQ+^6c2ZJEsj5PytV@twTwGlD zk3Ig&WF}C?r_;oGmCgGSd%jnjPr74Bi@{NVb$v#bq;s`pOZ7B^ONB9B87)o%(QMD=n|H_(9gdOUVg zPh8O9G&l&_dkPU{<5N$rFZjt0y)N1(jO(dS`_4Z7roW5Ai7 zn1_@YE{(d98dN`J9h+90D$NpheDXWc9_jtW#-93Q$huPMZoC6kNfm;w2=O7!m+eb44FdC=iF`@>Z}q_yt>$nTRehzYRxAZ*c`V`BB$`DCN;O8z+tO z=XT3@mlMsMv=hfCZ6GKn}F_dQYw6bV1Ac8uwqmzm7?IQ?dVROe3h zXVPpbS?FWu?W+O=sDj6T4m56*DaDUlU~2d$)iXeQYFH?WHy9=#70(zLy!)s{nEZ1p zb#l|W>00@M*yI0Fx$bmnUe#HHBY<(^_^?KDz(WWLrUN<5H)b#xxegDZZ=32D8kMN4 zd^pI_i=SfvWFlaPE!Z?klLuc?EG6QxBC)V{((0J(cvXkQ;_?4hm|Lc5BG9e% zOag{hVuk6)7v-6c7oyFk=4*l?!Bm;g6kO59Z?4qkimX?ZGSRt30Yia#BNR)!->*Nm zuRs2*vLI<-Ag>lT&M;=-RLa|2hBA&K{u2i@;RS$yg;K%5q&O+K0^N69!>TBppg>0! zrwwc}huD!sfTMmgK|Nvky6KOK8oLmU0E10sKR{CJ2gPNqGi=9o-w4&n0UAkA-(iE~ z4W$;g4UDLATV3?gC)&oil-k-I;^L&6 zW=dig-17>Qn0y~7@#gOg6xD)NWJH;Z%)^!TX_gy|nH6`RaqgO_~72C7rmP z>z_X)<~OP8MetLT>SboE+uxGtj@R3@JbUDyp7HGwrd$K@(C1*2{r#{1bxG6L@Ip|l zPiEi>qb5Wm-G|X^)Hgn;2a$nc2;zBJd_6RB=#xtSo%KoRL}>_6Y&s=X3{4du2@_C? zWJ)4oTB+bm6e1uariA_s*i;WYFiR4-exfPLDVa_a6NE*catHi4666WDWvzL%>5Tdb zbm>W8F)AEg($*GH8%qs7MyfH@3G?GmW&426-=nGt)m&x9ZV&mXsn&ry77%(%+>4)QAZ-m4 zc4Bma_F^Y&j{|Zfal9=f<Qdfro5^jl!-eIDQd{aN149YWAsNrvd}v+vJ7d2)mP+W?g5a7TCs|~AkKYjN zQomnL+vF!m+EN3dHGxd<*X$I7w#jPcL4P*Z6Xx(ZE%bgUxr zst#NUJt*iDp-^f~+!KF-3TwJ-Cu}EifL%5UqJX}Rh^Q2i*+Q$?-J05wT4S;!W|GAb z2c*f79I)t;qNhrsvTjV}8HBksM45~?bvxS?9+j61kEiOR)Lve*5h|CWnn7f}#;vlP z8n;P(+uhw=ainKo4A`hBMaH6v@nlsnQb3bU|c zpchu`!@@RlpX5nV@Ovc6mlXE*r?$%d8AS^!I%Yu|xi1~o3ly|!3nGOIUf}{1cLTCY zJOufO7q9H^R(+MbCGc>#nfs#?kKvw$&cI8$aLSd&N_RsosyNV#%CawMI%i{%&RIK} zXgI%+MziVmu;bJY%Wi|Xl~NCv-MT}Ls)vcm&U&1k9 z7&>$b4HcTpIs1~saUcdn5}0s^vrmM3=q`j)QL!7y{q zo^Q^ki2r(Zq4=-Qi+@v)5ENY^in_pQHJ+}hZ*;PwzSNSlT79 zQbRsw3)U+JYF#ho$ofK#Je=o9D5@!%JkR3N*-)48n5@zzFkXFWCb0a2dqgbF{H@kk zZ2m?Idd4l6#&CxVqb{{X)CHiwGKX27!(1)(WSiFNqR~!>MiMHRATuQPf(Ljyv|=fu zV)t}3te+04F#r&SKxZ@S?X&efV@PlYY%T)U8@59C0 z>#I{Fe>YSZIr!EGQFSVxPfV?g<()aS?7N8#_B*maq|lA*8yygHxCxi-w-XgQ(wc?b zmC$#nXa8&*Ew2gX$f1#@ETV;M=#HG=0MBm=+B<=KlyP;xvR_75&<$L7r4Y(En(DkD zgeoS!1cYdfE^m7)8%yjb`s7wdjf2F2B-39cIsP)P7AwW_{>bfZ-ZsZUqfqZH=k$L~XyceeI73JEd z9aJwf&Kk8D<1G2vB2PiB)|^Y1bBZyG6=&;wmzX@)hUB@4GBrE$s;s_qXkCRzpqVN- zgLYyb8pvRbrCC>WiTC(h6l$fqd8j51uix()isq`_*G#4*)y0a3?xT|lQgzCC^& zMAf<^PFd4Q%}HvghVb$U#8+6!eFGw?EXxS`*_7DN_771xfKX~pRk5V*A2*a=RJ~JB zTiK(U4NL>36s(y9ezmJW(mXE)2$rN%K)I$0sGwVU#26v!VanbW2}}yz|D7uXJHk_1 zyay|Yn@-Up#s!s+jM^jVlvvKXla%IUur~?kI?KyXrBA+C{vKMFzvt74wBI3clTwvN z$SDz}5gccSwz6sA2o zhTiP6joTw6-5C&Q1>!~Z;-bDMYCZt|L0yIULK3(gfGgNTd5F1D? zkX}=&SR!tvT5HzIHFp_-thYW~KhWVr0nbK_y>%axH5oqoP({e@Pip@OZC-UKS&~GH z`is&jN=f!zOf2-NT;9*n4%kXsr3fYfdCJhzJ#Uqop!#~V&}blzx;$qmTZr(Ub$6u% zaH0-5YFtFq;Ts?{b*hg1REcmn2BD|m-n4BcWwPm!T0oj^j8pRnDHpI8%0Kqer9pBq zhD;SOYk{!p@_=4@ju-M24Q0~pRm5!t)Uy-qDx+dsmN9vb*^DhXi=G>yOT)8b0@!d0h>apI&yYXYES|jRZKeI8!7@3lp>^A{`Wwmj5z?S zLp;5B-6~cj3zg-vf>2)d)~}7D7s=LCf0yM91Z|&R$o&OuLVr?EIJ24cl>f#?KbO;irYPG9yPno!*Z=z zYSdlQXjHmor&no~aHCOgF5}{qlyQ`n^D87_c-n{MY6vYnlxLKuxLa1|Iuu5z-p_#$ zdsy2~GhU)eck8*EOanNpL*oarLF>qC1)3SjbF?RKEG4ns?`g-7%Gs6!&L7@NS>3rr z%~GjYKSTyiuDpOz7q6j!M*D~5*)p+cXM?V1{xOs4dQ+3X2KpK1l%IW;?+0>ZmAJ%! z&F?1CLwPymvp{IMMqa={-j?QzBye{H3tT!DMDDo?k10j}6f1O34!s;IijWiL3R^w$1nm zux5OkuX(+e&tN>Mn?f^4X~O4fmTjq0cBSRwd4Nzj+c#%wb_bKwwU(*=doTEhKS~Lm zEBaNgPflC8n$bD>BPy3FwI!Lo&-v~Lm`WpG8+MyUo^?;ErwLW8RI2Mee`&hbq2-LQ za=G$N17LkyQO)Inu9RxcoE+#%&d$zl8hO?|sh%cOu~M(+@IYHm{VP}Ih@Yba-8$_Q zQ)amKBV8>WR+e;3pM9k3ja-rEHjO;%o>Wg0s#tC2@s75f*;ziy^Bt{@^!yChexwf@ zGuFxaj&!w|zgv2aJnNoRPZO$GFVA`Ua&V+Ar~IY}`J5f;yj?@elCD=9c{$VddBbV# zXL_DK>z-9lQ|do_^F+fx+7WLx?tYq#xF!?sY=>Lxu`}LUD$7(Fv-15;oU4%he$r_b z(CgPHZwlz*PoFk!HN7d9EVyGKH9@t+?WEcK`Cg5qT(=_OyH$I1+E%-C>gs>mSvSj4 zi1CUHF_&|JsW?*!J0cv7n1HU$3b5G;eZ;s+eT{;m;5bz;ZeKMzht#>h{q_$?P-qJl z5HI;{@9`@RR2Q~ogquI*U?EzRo%_jUAy!(L-m#efqdq$r$cOE2~v*&DvA6T&L z(C@S7B*kwK&NbOwqVe|h3{!11xvNlpHEa)X{G-KY+JQ^P2V5TT+;QkR^}~Bq+iy;* z*3T2+sg|zg-p6~)3HDK?RBpUlVDT=VH>CXav8g_Ya-4L66aCmJpqB4SEyGpGrAnPq zd0mraDUAz0@)$LFz?UC8Z+`(uW0g!HFDpgPeRK@(z#F!SYB_`Q>UI0DUOif+3*p%u zs)2bFo=4A0h&!{ZmnxdSa?FdcA{$z@E%6G zk^4Yigka%gFDi!`K`Jd*NKEp~I00DXiA5r5CaN~@b8WA8C&k`L0q=VI`l@(xb$qr4 zI;Y+T%gNw|1n#5K+~(y!%rTFJ0Gf!ZI=(q?R9s6`df-+O3|mB;mr_$yQ}OdAh{T5Nllzm@g#5(-`Y`SSWN zS0B#)(mFr;c=h)B&Bcq!v{RLqcmce*Xtj6J-@q0pksq3|z8Kq6~zDK(bs_a+l zbEzXs^0e6|i)EaMA$C4?P`R|9l1!5;dn)OeU`_zw4$0_m1njLUlqtCCOg9QL3aL=t z5tTP%#+hLpHU-q@kN@2vQEL}4Y)m&r=u9Y;^&$4iKDvZ-0@J9lfE4=lWixF-okT!LWQIGjf)PrMyodMv$f%quiV6~38Qxwr1&0?h% zdO*d>19G7yneLu}qxO8JhmuZ6NwoXOocPgPh-Pw>fLBa3NdY_^XF#Dd6>!`#@;{Qb zy3o&JGFs}&ewZ{6{3Kme1D@&%8t|Mio<_`@rjdf*(P%ac4gvK)}Udfi6N+G>** zw}&;>Rc*b~RyTq(*3epG#~IqelwZzRQd_iW@O4vuE;g1Q$^+riUiIX(b0Gh(wS*Yu zZWF#awYNL&Uk~B0+DmAAvZMPqr*`bIyB-yT9r4$phV8h1J%pE+?2k-$_(umH(}Uu* zNl+XTBWAQ*fp`Ma9zCx+Gm-LA(RQ83U|ax#S{QTn1`tJ|~EXZaMarSSX?@>V#M=@6u+td_=b&!gPfKw+eD4QRZOI|U#BHG80 zu6#bJArs3zos)n#)#jpH@OAINsvIrr=KS`K^V2!sa`nSB=eKv9zkbd?p4)}B(*47t z3v!j5Z@CU;n)6p$LvJtgwOyRwz9{AkxnL<$Kb7`tSlj}a*H*FBY5O==Otln&x?`#p z%c|EqrrI%;?dxX8R6C}!E~&1sc1*RUOa=cep*lJ0YHuIJp&ZS^8c@JB3w5~5MA4#X zqzZ*ig~*ZtG_jB552vf6p$H!0R!Cal$bbCm$Oo#5b_m-E!5lgPw+;P7u`9Z0wUbrc zs`z@WdhJ7bZZxxfbn2u2<5wR-n_dCRvy%^*F68#;uc2-!=wSr)kOP?6-~OM!{npko zL5@^CKa5HE-+ueszoNY%mTz32cTjo1VircA@qh66&%xYdpn_aK!UP%BLtgEp4wW;L z-}VUvZKEmmF*IhQ1+|`tNFPqo$;Y?X=(5$B2}ACqbBqKDJ(3JVBKG(%@PK4kQ$VdVfTHaJE|z~3>6`6)KHfO zVj4tzAGL`?HGYQB(R)b}sKHm=D?E*>(T7+VYV23`kL1%RQg2D-l3PM01k3T9EXeooetr}SqHyd zcM9m2(_i4-^Q+G~^)3bjXlkA^c@=(0vk}A~iFC*heJ|9KT z|0bi_%JNaoVjMgYp{KWFPthDnK1*!fD|0y#UCHkxKzt(ZoMIi7{lNm$O=Ie}8uSMG zpg^+7%-D`T^u@>DiqPX`{wuGh`q;pL4)&=SlG#kDnMNH2gnQIiaz_d!H4&JV&Z zYT|;0155)*;feS`FBQ%*EXJfX!Jj}+IjT-Hy9xX7p$~mnDEwR$pf!$O`j|aTJwgy) z?TkhvfcF*30S@nz4}jmxyFn1@&jFfEQ*bdUp3}pnO-96*E0j{#P=pRgj05kh6f!Dr zd@07|4}3_N0?iBni9mM02ha(AFTrC4CCsJ5DJ5nk5HTQ`>DJV*3@FeXL*ua-MkuQF zu_8Q>8xEq}3+M5x3xmxu)WP)0FF?a$sJu#*?TO&!|0YVx4-_-A?mtUbD_TDsWqt9R3eDb>Oxnw?opJA zn=vJ2&H{^6jeR5n=G=nHrY^$~haA0_`BrfDR6j0Aq;o)O=nXM_ zH&^u7vs4^zimioYXj>?_XJ>iwkM>QKrB0}GUK-zCgtqU~g%ei2+vj#ma znV&f$*o}grlVPxl$7rECW5w$lcjB<|tty$3@)lKVR;cBj?PqB(JvV>;MXgDdk6(r$2u>{ct^3 zLm`yc&cViPOE|4!w^9KqcPqeeN(DqJD*AKf57m!znG?d@qHIJ}lmRNbKQ>0*oONtG zGDd~Z?wDvSbWAiSj)|#iq=Ykk8BU7!6O}8ga#%e6)oc}bh>UA>$}1HbuapMWjRA?G z-~pM99vHh+e@QE(fr=nV?Q`O!0$VcnT*rP$OilFeP6yKW4JJXRmeosxarW z%Jy4bP!;1VsknuDDIeN8d9{lApJ~Hc+aEJJb`+lA$z{O=C*H(;bP8>SwG&~2PADyg zuC!eFB6>uRfTKPishNDNXr-(@@TK!mn}G8{7Wpd(j;w-qGf^6t?_7{ZISC~5-7p3H zJ7G6v)hU}>iYAQ@tt>3L4_&G;s$xvHDXTknwh2S^WSqiCF9X{4@hUvfT1nt?nn(La(KIiJ~HLsbdot zo%+h$2m2!Kd5`v_K3!gf+P-6@Z?IBc`Z4ZUX&YE+359k$Uiz_k$q=*%L@r*mmQczY z&11I-PfiVxveX6;y&K!R3Eyst3;#^FElb7@nlrJ3^IEiHYl=Uwfb*pf{;(`Of_^L%ou<>r7E*8r3KmF~+fu*TUE+v9Tzm&_R zQuPSqDrr<34N^TkJginL-G*Cpo7F=i->)B4Ylq7SCZ%nBlxr+f!*o&XB)nf0gPaqj zau^|fQ0Ev;B~4H7Okx?6>}j!hNi*R>kyv8^1;i6NYZdl8%2E@^4~LNRy_8y>_~=?p zYtKL=2Jr=7Clbq(7pUZPq2d<~B&Xjahk24}I6ix1R^Np3OxRXD)rjm zep6K^Bb9{g2ho--;AFYsVXvn$8p$^sSH`j=k+PbQ1yP!`(Qkl;#$<86G98E`l8JS$^2ea%f*;7&S}9Ie35_ zqpe4vRhvsdYS;<19iL4LwA`@SPM~cyqgC^gxv&#xTg_*np&jIg)pkN{yP0jrXgfw* z1*5$`%?+pRZqIGyv*UB%vjvX6RkE4o^mM(ppOB!?kAxSH7-CPo=s{u^7U<$+F6ny5 zgKOf!?v4j{Jh)yStmcCSE#r3Rr6C3x4xtXy8SW!v!XNGigwF-Vb{x1K)1tC-%&m>l zR-eqiXf_{6l!&FXF(8v9Jx^_t3{-$rpr==n2M$-BnjM$#xO|(ryqX_D{^MEhI|g5Y z7%%68yKDAqm8<2$MdEugX`WM(K!Rs{dG^7n)Uezk4XDv5AMGx)ANZ`dui9u&x9#$n z-w#R1=jt4nWRI<3wLc2N(Zxwlw38+DnkZK*r5sDFABV+q(axk+vRoT(SZq%J`Egkc z{&}iiRux1ZBtM(3iLEBeB`cM~O1W2WmJh2va@43bj;cpT?orRF5T|$8JuJyjdX1Hr zOHMk~yQ*`#hQ5*4yI5H%ttuJ{{di`k^iG(T`BQT$=n|pSN~_1OE=_6FIjQggh>hv; zxWvyrRh1S5k6(R&ywME}quMy=4c}wjA*jnkU2g?%xw?+PSM6H~bo%V8N?%{0Ex5GT zqfY1rY9YwMp8P}g9p&<=sU+VO8CiS(;BM23jHJ4pD}6t&MMWTEG-#DToctQn)ra>N z`VVs6%@OlH^DETNhyHS8Uw=6&m*(<{a-_cm=#QxU6B?qw|EK>8)eg(08rrKh&;>ny zRX`*7@EML1cvvNRSox?{Z=k*M(Tg7jPpQU_t5ljz`MAoHk6Sk>bKG)9EUD4V3(i>C zvXfl3JUlAr*>N_~XY7OGn3E5PgplcC(LrBwS``X;8ZQPTs+c9c$d;VxMSQ!9cMs>c}{3?*yF$Io1{GF zsoL@K6DsYoRQ@YPaGMwNRFYe^oGzF|r72ezg;^KVtMCkwn<=*RBc@6~TNQ4)yr|2l zTq=}GyEFU3Gn8t^~xoPvFO^>iG6SnAqBB7G{(qnr??BAv&B|tx_Si=3$Mvy%NFo!?H^%PPO7z zYloG}QLRxXWj9jzS8azS4xF^Z7pI;62sYU+1#)MrWt`V81@gP*w@ZQCr9kddAeTM0 zT?*tn8Dp0Mx&0?>mo~O$<8>F%-ldK0(#CdYcGJ%6E^Ta=Hnuyln{;9~KW!|{mHjl_ zxJs3J+Ra_5Pu$$Y$FC0dsTdLgc~s5-`+X88Q7t2X>S8jYLOYEHjeXlGWLY$YWuuTg za<^B7LXM|UfC+f{fh1@Yc0GkP3*h99XMm1Z5?wT6aM$83xnD-uq7$RXzCZnCRlE4J z24{8@|4e|V;jePJf)p|^3(?361v>fo_Sz&j_T^B1Kus%;fQ1^pRvw37z}%-;v!HR| zY4-Kpx`mCNSZ%Hz9Ad|Mb`oHv7AQuH2b0ViXCRr6tFjk7CJwsl zw2GJS+ns+`M&t7S5;7p8nXY@AJ}^I5Z1bE{FRNu$A0PikDe+0&-RSD_1@i;+(>JXf zKOE{8)Ej%Ta%@Nh6E~Yn(z&o2gt&v#Td+PVULki`F^vbn%^8a3UX2t@E_q{`Oid+1=Nw z@w3muF#*!kiIYURQ$Cz(oA|QTF@=PLD+^uQJMxD-<|Gc$8BZe_L@ciMSan>Y{qoP{Is5o^tSpf&SlcoEO^NHaFTs>B+URGYQV z-1%{#w1_X287ClIKWSdWnWgL_7{sSz0&;KKYpF&8KRgG&rFIx%EgR8{@IiZnAQ*|C z4h|f_oqc(a1^azAK9CorI1r-)`L%<3;{YG<>VdrGu=lE+)EQnxiV9qeOLh1 z2b`nj0+M_ zsQ^)?k$k~-`LEgOR&N-()f+pyWv5%UY4}aP*wHOJ-RhOHrki}Rqg&Rgy)Ra(RYkWz zzPR1dEj!(s5#5?Qx;=w#wbGHMn|!gOTXwqD54C&?Vd% z%TBkXeB042JKd7|Ct2a3H@gh zY$x=eNw5tR`tZ+_RfCYzaq!e<^+nkr)kG9I#0b}R`*rSB2EDq`ik6-&bX#^5E5~Di0{!P9U`q8la=w~0vk&&FT+;HN{ z{{@ibj3(cK=Y+n_Spi21fBapeHLITQzeBc>{PgjwO3{bX$v6)Y_2|7^nTL_2B2>r0 z8g-frjHwpuVcsW@%oOJ=#RYMY?Zg7+uqdOE4Tqs0(QblhE%y|FqscuPjyzI8*XNys zPUrlU&c`toeLRI0hCoT0O|go}*nts%EF{YQ4JdgcIrK+JVA)mY{l``ecMgo4t9u}? z-4(x;kh2a_5h-Og+Wdl6kLy-9a@W+RvV>;rm2&Cj?UUD=E^N8!xNf9z)ST~!lA}f% z3zW^5&L$c-pJ%VyT)la;JA1pcw>x|JX~4KUd%LsugPgth^6Zr>t9R0;GFo$q9od?5 zb=x~`TMM`4#<_N@p`gNXmitTlH5>rLs60kFBwWGOSIGds8R+rc+pxRti zBfmR*t2=yWc{zMl%S{-j*=??M&W_zyzRpYLJ(R1ZdQtLSK3L9j!;9+yLCHl%@zi1* zeANM5h>P#|aqaw=vj*%tFWV3AWn0hyefv({4m^2ne72yG;4=6O{&_P0uDY<}QuQd& zuATOMtTMxjemI2WFGvboMn+vH9tkBzN+H^!alb2d&UA%S*wOZ(>g z2X`Bsu9iGVE5COZ-WMC1x3+F2;?zCqw9wwEtBOwx=+v#%n)z^MS8MiFie_mch|;>b zCC6n8zZg!LR4NxxROOu$eyQ8#7ro*gx4cNKv=y_Mc59}4m}-WV6JD|GCNTJAja=iG z<(OZf8~#-XTH<$d;?-P&J=-jm7d7zRvByI8=qwvBVaFxk>GfDQm#8bphl;ErU~drg zYp9yYPulo{X`hn|$a134MqEJ8f!;`SaxH|PtQ}6AT)OMO!kbjEE2=`UIAS6w{u)9# z->+fhf3WKE`k=;DoHiL3O^=&GgQYpZpp&?mX(c`jS}{F4sk8m5{R+8^j$!KZX(QqU zP#p?xyk&qX)GTL6z)2`pN-xhBv5l2mTLM-tbUu3V0@oUns#y*f8)_^{jr@iS6FvS_ z)$tApc!#B!Q@2I|Q4hgoLhh*u0C7{GF2SM0!jY1HFoPbl<0sk-y)pus# zOVoGy#8ZV_Dn`twT~!zi)y7VI%J$JEyrBR_<*(ewuW*ft0va>QZSRTYv_XRhz+j0` zTJ0Gm0Oe@sj6!8L8B!?zj+VPvW+K(~ABwf10w1%-e+^KjRH@C~<=^SJep(E_0PpD> z$GES$eBW^xcOx|f%FNN=q06Z|Cxb_v$#>*pZSS*XkJ`|?CBwr;^FFn6-E!oS2mpjh z17tV@sQx!B224eLhmI8N4<6G#4&;fJ97jBXW-nd~#I)>gk{3Pcv3oQI$Wi8_?}2+? zuY|YkTWJqC87xN6-eX++ z8p2%wPlYc{1p4H8UHKCs0uehE;X4D-}fDfMf zY!=mhN_DO$RA-IjQgn-)K*J2|yZY+NsxFtG<8g>EV}3$c)1xh1^R(KZh;36ph{1}A zm1QXSZxbV|Op%vdW;AzzZ-R())cploqnKk+-!GYWH1y7-wTqMd`V^G8Vn)w=L0+t_ z&Zo{RrT73Z%g-ddKZBCr4zgWtL;(%$(ovgR33-e>&wm3 zsP0la1=NRi0dWNoLTY=45}FFoKSxr5Nl_v1Eve!?)gs2Kit<4+2@5@J=p*Op%DE`m zdWR%;7#i3peNE$rIdVamN@79_9;xHVg*tc?ggkD)P+;wS^j34A zJc@kwET(WFu(DLxjZEl)Uu~#81Mynb!BF~_{5jW}85@oQGC6P<-q*dONK)t|+AuxA zCP|V#3oo-45z!i6=Fh$qRxZpO4)rv`nri&Sw7MYaDI)qt=esA3IiG4H4^!7TRJ8VC z^wh`SB5A`_`z#hr9;VDdAb#$N)Q0w7Utj_9<{3a=F+miO9`=KKd8s&3un46f;ZUQl zIwpULV@C=}WjY(Sf!j_>8sI~;emEFy?7tPVBWb%Wq_xQU>hlzP0_gizW8mUot($&s% zYm?&o@t>6t_mn`GW?e<*UqjH5;ifYV32*9QaxXRVV0_3O7CHk>AvrpAh#_!~Vs#HX z7`z?oI)^QYd>q=@C@Ab(;&dRaHU|!ox>QvLo}BwXdvlXlM=X%9AhQp+L~gHA5@uK? z_uF+k96kO|Ny9IC<~=x12B&wV`pXI83++21$%7@}wG=Uu0+A9Hcf^xIMaddhT~-6a zVUOVW!3fliWORIXC8tZF1}C==ojT$d1IZY~__CzABahQB#VhsA;x+C^&M)ACE_iK- z@`GUX=KA71dSc#*f38eBr5;6MT5iM{T+V+wFC=h@VSBK&1pCS;G;JCg2fm#-7~1!) zk45x-APmr1o~l4{vC^<3&DVU@jH##^0>uUM#_C8&d8Y;hD9u3QAoszu822iiOhbTg zaRBE)USaaPJ*>TtQZ1DSZe{4si7Y)~8|}RQA|6O{VAL%~Boy+latEuVVPkEFHtY-RX`Nt(mrOWQD>RPs3g~9B1*vQ3FwUO*I`i3(M&xwJ z2u|v&LgYxn(OoNru+dH6o!Bj*^_YY}p3zg>&?r*MsPdJ+UpY*q+6%WkcCr}#Yo_yw zxt*l>3*j<(C5@QYI|`F~63%W~>?IC13wuCKT~DEasx_^ZdnNjvcA6&dN^?W2 z2FBWqSa>wxTtUr)x-7rQZDqM9_*)lfV;nDF7smdF8H(x<)8p@OeQ0H5N{x>(-L(xW zzxfr+Pz4swd|#24sEEIiUvNzOUHU1_-8Fy-UW7NuUbV!0{fgXl*+ zvAb#dO=Y2e(@5$!3=E`j4f>54I1l>GW$e8lJu$6`M^}WS5x6$LYUNe=#g)@r={xd~ zfl_pgZ(G`Qk^$hcH&Tjx{M_nXqE74LLUCJC41rY$(KV#Sj8Tlmh?=lQ%$+lWJh~#4 z)FX)nM7oMMt-HaUqGa6A#3AHDbU<&SxxsJ{O>jUSSyyrntqYY;Q_cFLGp&xfw%eTt zM_;aEN)qBy6V+2LmND_zXhfm|9g*pAaiT4P3>|s$;!DQe1Ss~wVVJyWR#N93E=l4&=?p%SV<3`7`zNcXbi5AS$P=Wk>E^|TcDh3 z-pwl?+owKK-fI>0Osu_tZXyLRx^;;kEA2#Ok?9&|V0cZ}A&5iHdeqxT z?}&;Ksa!3rSYQ1DOxzH(GT`(0haNG%gU3PAwVsV1xx@H#X!ZBM{@2Z6MTiialn?49 z08*qRQCWktHjh-+z=b=J%mtH67>B)QYqMLqGH4rph~15N6N-r@yz5qfqz@wZt{mJ z;G;cdW9>|n(pAONV%uMd4tUH|YKl4_*w<{V9qRWpg4)xr0i^?yv3(P9**BWvutaWw z3gD}N8z{Z%bWZ|g=7@7iiO8{{U6fkoh{8RyscceP@YsWCZ}DKX2bUAYB5_^~?rZ-@ zx{e7EgdWE+!W5#zVThIg#~e>i^gvYaD42xc^cGr!jQlTggh(XiA&G?B6lVv9AN60b zYNf3L*I^E0c*?C1;K1Z>D@L3m%2eXrhOq`5Re92=5EHc>&+NGpW4)dvRA~GQ@m(;2 zlr5#&>C;J9;$f+oNRgIWweQmVA}JP&O1%dcE-2PZ zNs>0Bp;J^u?c`{y651c&B7t-&c?GcuT2bC4pjgB)(#SvJDT5=X3jClDzo}etCY>rU z?@E;z`w_$?xep+zMP2oykg73Jde~eGN&(@<#%L z!M&dTTBT+6*DB==CUVsk(C^p)`>6Ba3Ib~U-i%))Rg7A$6c=Xj1rl`e8dhIGzi2id zNC}l<=w~CR<&Jt@PY=E&Ebw^-018%-_u{nAs| z5_(=hoeJ^L8RmT&dR|6-$Fi9->_@|I30bf3NRjm<^dS(IiKe!pxG>Z{F2!yESk*;9#a>c5F8Ao2G=Lq2y594iHfsaJYLGxyl#>AjtzX&#+)-RqtLT#&O9)M zB`}};yrEqCjtml{JvI84kn;iu0b%G8(qA&s)3Tv+QG@X>w}hG< z(!~ODUQwS);|*scsbxE-bIGV5)L!1$EXU%s6Ob{K>>9tvF~%9ifMvsH>~`hQTf(*P z2q(h_bjJz&`!yoZ)epBpt1M-IP1luaW{)3)WpG3^({fcXzO*3+-3<6!PG z)S;aA!%QsHv~0_8>IgOZHcG#1HpJo!`pj9EWYZ>_mhGV6u7bBklWcj!$LJ*N5;3^V z=09s%wtnO`VwlC2Q1lA-luwcqlI>b<+D4yJ6Hw#7ynkse?+E8IC+<9wq!J&$tcm31ruN-bbHtMpr@8vf*%hcPEG5pmVcOsb$=SEUS>wSozMG}Xbknke?-CEP;>c)Q;ze)$K0{YH%<7ju zvTPVoIew9=@wZXoJ)!&-eTHhejO4X!O}P9{4ZbDZdcmYbLjOpapUu8MvTQvJVf-Q< zQOdVP09;}y7rsR&cMn;4)Upi$MWTEpr@^+xFw=plwukv`HmCHFWi!Hs2{>x}BHm6< z0=~rqXgvS1k3}{&^^s+RBrsE8FoP}O+!nvZE~V(t_?C?c6tHI@tYvFQvMqJX_3gQ| z0``DKh&s3%@{AXkWy@%2=1>%B4jV+-RO(o^b38)%qFBhvC12{IEt@h@F)RW?0}aB3 zNrh|L(;`q81W!?pAR!>3iXm@(}BzJg&KZKxb+>8OY+fY zfFd4>Y(a>6$+GnT71%d&8XH8@RI*ss_p#6Xhan3^aUr(cx>@Kw9&+#-W7-Qn4-c}j zkYyF#C9ip@-(M8$-&moiQg~1Yx;6GmknvKntj`OWgNUZEK?ijqVMh;~WxPl%TL3=e z!N46cZ(GW1-avD&H_&>5XY!8JOP0-xft+6r%XlmI2;j}-HmK<}pQKG)E=%rq^Y?Fww+b#Oe z%Tw9%#kx@og-_VQoOoU~L$6}lq-oJ!Eg0azmJs!t`E*D*dQSxw%y%=zYwH!;k(gUO z{FV?^3VhZnk}*UdR6Wb6Vg2Ws68@Li?^y?VuZ zd}O?pnqJ)1i3$Pj>od{Tc5K99-a`;>Pe?dGE%2j>j9DQS%chA`?gDYM5Px8k=y`&r z_57IvtbI1~xnjG9L{8vNkG~}(eaC$N0d<^#PlKSJQMapFwnNk;CUe+E>Dr;*m}2zl z@qc*P%#x~QvqY!~$X{-F25G%&yR$ELZu>YO;;_1A%_nuWmd%5*yo&nWGGC;^tXn2s z(_zR_G21b*Y$60OHv4iLE~OTA-BRcba}o^D8}dN1U7%IVX2w7swlU!W+oTGCRKnN} zUW`W6Ti7UVZ7a2{NQ1<(ohDe*1`IBT|8)v^ZP z3Op>{NGT+R&<2U1MYFk+f&;zA9O4L>Xj-$ZzQY81di*URX-iI7D(hG(%{OG6EjUxN ztguU6-3-4aM7_kJhc28p_Om%dYL*p!Duz^$5#CPKu9LBgZoOvNqUhk88|+@PkZ-h@8 z;$&kU%O*&20vpaib<38-HSJb8T^Rq%l^{B%flq|^EcMDvtW>vbBXsrncXIp<;-rNl z1P>|kyDSqhUA=DEM2JV<5^72%gt+K}WJA5G*Dad{H$yq{_x2#n7e%9VI6}N(RztRK zJB>-0(YH~zJLbfP=9wS={@4G~X1>p|nI*Qd=tCiH*w!H6Dab~Ou4#}B@V8#K9o~Qm z1i`kz{X&Uu@lyAOe0@W_jJK6#D+C8#cu#|+RO+u%iL?z22)*+l(6}jDg zP(yEzZKr$xUJ&TNl8K&{Z4P$`LpQgjg+$9E_qvOOG@5BP)y6iKdB6tFU{TMO&9##; z=@4HKnk}8!HlTSI%U5dnE#cNr)OUyGY=pH9$RYn9rm?9)FO^1?Etd;?>*LPp$2FhN)TP=k|Hl0G3*oF%sw^_p)_r!) zDIR7!E|v`g82E&B0bNucn=O$`xT5P;ygmj2L!Hpe z=pnF;`_1I=0!H5;R!yUeb=YsrJrCbCn$3ES#hmW0fZnkI_R$;W4N32Y@oeE(+wk9b zAjhZM(iq?h^hrs{*PKGT(rgs9toHLBr_0f1*QI#b2Js#e5eEIx?=LKr!YNsJzd*Jm_x_J=2I{8*IGiv0~R-M3r1gxwDW;>nW7_ z&dKA~o(BbvnRv-Ih(U~OZKM}uz(pSC>e++g$`+MQ>iXTv&{IUC}D z)wU(cw?kc@JfJJuC6s5RsO`?S{6-jkXG@5BhP#{+s0ri0hS~J-hHdQgv+hH^v5nI7 zgp)g!;_H3MMp(;+j?0A_e1mv3l`OVF35iSj0I$0vXzEgJx4crV(gK!aqvMMCJ|*b2 zhl8xm_8Yc=$T=JNY$+(j>lQ(m1M1Pyh(NKy)q|7C&D^k!Lq0N-a0!1{SSy`3X|!lI z7uX9jc?BD`VaSKrt1cyAw@N{0*>p~xJfI9dVK!!2}N*dO2w9VifbbuDk=9tI}Whk$;H;?}#?0Om7Of+l*X-Cs|gEvXj zOr?xv9X#}JeRk&;L-}{H$620Bcv~JtS9l0rZP0b=-~QXl>G|o0Z2V+f&-Q45h3jo) zhtEsma)wTYgXMY6C-y@ow!|eeR^@xy2{2>mhF@4A^hiR z(>cm^(Y92hID1%FY_o20)L{eE!2!$WEU=FI%?1Jn-*m>YY$|ZlXB^94;zb#uxspQ) zUb2`iE!j4Hw;sDoAuZ9}s6LqsB|FDM^oETE89m@^c7kmXZ!D)Uh-R=sWKE@wWkvrT zrbBYZhUCi`<_^W3T&5}8#>@VMJ(r%*pp+TSbKQc8-eJHJ&U%6@Yui)|*xlBk7=NNZ zb5YC33XLrjJuNHgY6fNkTSCQ;S8$`}jx>#1;M>zC~chvJJ z9t!3c#T{E%c(8Jzmr4Z7`ZJGhh5sO5=)G=qoP3bz}!VXoygSZR~$ zw-(LjjAK7QAN_vTG9TM;*qq!2+tQq-9dc5yW+J0)=xj#~y$m|8OTgI%%Wiq}s&Y>K zFwfz*mMhQ+zLU35HZHPV^^5)f87IWQCPVqdYaE2zl8W$I-|y&(JY>TZZrFyyK9)03 zqi+dC`?#Ae_rNv)cHiObZmUF{?J@!^9MxiT&5|y4t(KK{FQh_Xn%R50hJ(_Pce9T! zupi!Lb?@26iXPt=w+E>4lCprKGmrk;|L0S3N1be)9BczkkNO_{VkWSu(rD4tuCYr( z@dbT`WFUZ;%|>O*_CcU$aTiTuOL+JL7L+4=i_r(1v1HvgMm2zQZkA9;rHbu#LL>;J zNsQs&MVUS8W}tH{4fZ!UD{xA~Ht;lz|7I)29+9`TL(r+4(M@X`qMFEoHyq}?VH<1u z9Tr3Cla9Ou7Pd}W_o;00&_^9Q#x52aRXy7<(gDF^>{GExEVO7ge-1_1LuZfwlr7)M zHiYy84BzXA8{0;Ap{(QV0ou%o0roNho;GX)Nki7u&`e-U81@>g#?P1h!OtiGEE^`l z2!`GgYJQ;3EqcG7jgXdY4_}T=dvw!PWZO8<9JA1?HZ~?Nr1gc6A$sdQ;A|l-+n~6dZwD!lW0FND7dp&;~RUJuRCx zdIDye+ZacZ@^c=Ow+($exx>7)LH6l(&+=oOJP0 z@`KhbOW$G0^0;D|Gp}qzU*Et4iqs!dLD{yLi^oJt)vV48+o0K9;&->mk?{_SZ7$^% z@z7=&yHwi-)mHUB-a~n#T8=K7&F29PRP&B=+|73EZKG=6!3>~xhbL#Sje@o1k$ZH8 zAN-7YUbaEGu^fL(xb-#kh(}|EFiZT5@i5!)-94CuoP(#PutAhfC5~mg=!S&6zmO_x zTd8G>Me6tLf_Rx>GuAGKOjG&yArG=8DA~rk#t+3?{IEd>X3=b}*$`dJmyGdjrN_2` zuH^)x@wbGe%yZE&W0cx9%C$?zgyU^;=P*E(@*n>gTgc;p)wlS;&M-D#T7WBAd%)6Ll(BrUF<+5sVmhFtLP{VJd6ulz;<5zS=!mQa2 zw$ZFx@>OTkOCAnwV^TZv+Q!c9hGe=4}onvEHw?A zKqF;2rX-f2?$savP%51sH7ZBtKSXa`a(J`Rt{xqiqBo^VAHciiTDfHsB?kmc(S1dF zrkXQmk0ba|Ab0PNe;{Mxn_-{)dbvFLzDs&I^dg4tF&3o%q?S6w)8DT?HN?}iDouXU zqg;G@PL=c@jQX7~@`J%2|4?o;YwD?Y@^$%0+8EI{9IP=o_)~)Nl1hQ0vrI8TK(&{K&dUYgBIHDcwC#yX-Sm8ufRgxP*wP^ zzuvauyDig(EBXD4crq`je~U>|YhCmbIyer*&MetSYt zoDd8b4wvJvKNZSKWzTqXay}Kui(eZ>rCN9C1Y&vuaevK^;rRX8>H7_%HPgq5`|}_k zhJ6%3JpL3x`tL>%e~KXacOyt1vd&kSgTt_oBS=3*@Tbo~2toEKfE}niKgPv3Os!_^-HMf8VxA=8qJyw`}o&{mVVh#Sicurh#J3 zwr<@b<>}e;7wkavVjy~6Y2G0m9Kw! zzj!57d58pHf1b1SiwG^LVfEsF=5zFPe!&A}?lKjqHEZ^K`hMVoEq?8UqBTz1rq92Ugk{V=bL?hpa1gn;&)aqZq$a!1wdK+oo*>g zI%n~-$$aU!~3u30raMdZRXO}>CqwOTp7h?B18uf%)0ep3}KdqFi$BRw5Ie=WWT zDZ02ahOeZ%Axip^^!fJbFV2HbP?8l-i)WMdQTbuExRd<(d>JJ0Wq14rX(#}YD?-Ie zfj`}}D55^;`1uyjwN_SH7}A9XMF0OmeZ=YW$^GzVeshY3V5BY?Ki{RAGvjv37w@SA zK1M5Kv;6ra-Za_~H3-qAhN$a!`4d~NwFTm?zPx3qFWI%SWx zD@HoMfXx4S|88*)dhrH?szo1?OlLm%s@jeLdiT3grAPa2WL2b9FY7d-Y{ktsjz?X+ z#6Uro`V8@V&@HW^PKkY-j&lOz<>NG&VS%1{qZRkijqI08!6MVK3J+pm?C4X(w}uKs zVY=gZoQyLp;1l1-0sE}FtRkvMCG0s8fBw#gaUryv+IqnMv@ylTB&W+ z^`$s&TAHY4mU02?6HUisl21rSwIwm!XG`*E$p->3kmcL*`jjjKfZ^wHHYO<^?Ah2C z+;|N8bWF0S@9G#40jbZGdX#_y2tb7WDeK`3J0hk}y*~P5*k=POtc}3I!a!EyE8=*REcY;u zw7JiTa#aqb)IcKBWXR4WwChmpawonV#m}T{n~<2C{Go3f?s@Km(m+nN)GKmZH5C3M zryb*ON|0~U45#f`Y3uU*>t3j%!CA0#hx9H-G)-Q+i&_L;|* zTJl;^AvgtDjcD)AW1_6M9f69JObp|8eF?X1Blux|8yzmV??hJVEfuvnTp78KT&6Sp z`75u#pT<*Gj3;G20iysG%WRrtHLZ)3&Wb8wv?!Cfq)Qax!rT`w1bUjj9CT7_lw6gu zMv;b<`?4a=z+UlXW*gdIz*_hO&^cDYKP2xQ`=CJUYtC_w76c;LRT!Y=zEIgYR4b_Y zX)twB!~im1G2$8CzrDNq$D5Q`MnArGr70%TbQb{*z#Nr=Zdi(?;3F$M2JJaTRBmd9 z0cjBs7=L4OO6}UwuzigUAHX)CtJ%D2 zl(@qHIP>Kno)ul}ZcCM83mv-9+_J@j`au{eB+{4(O785i$q zUE`3onXg3W4DAQ%GC`2&Fwb7n1E{qcQ95ob~XN9k^`x)N(n^%^j za3r&U#+_d)E^UTl7bo|n&YWYV>ou*fRj;Yw7yzff9xe|6OG~BOwmfdCYi1Z|w&vIn z{k=jV($YX+^>H$)fs9hM1Td_SsOkVQ)p%T@5PEq)=*=r-?N3a!IOf&YN$ni1TG}1e zY|gQGos+;0$Xvl#oNh2+Ez--OlbavO4XYZCf)xs1{pLB?hF#tMFAn{e&n}B-!1|i@ z(u}=zSY5le@Qu5>Lvfel?(XjHE=7u4f#UA&?!~=0EQ-536nCfZYWF_(>~p_+zxVxP zJ#);gk<4T!BhO5JBMF>^5>CIik@s%NaW;9*?i7Ki-!fDCwt0nTtceA@Ve};T!ou4P zD5RQU;5N6~{04KEI^3|vr)}9Kf#4T>O!i;#t1NJ<{7j6B=Z<1&T{R+V|}Zf;6QWXuzp46CCq(9}puuxyZ^hDAn00 z>n-U2*kzG&uLs|j3>ZsQ%d0cHd2Q(1S2<2^(#6mkPL&6vO3te=M`QA7I{)9E>nxIY3tq|x58NKz>TFGdF zX*i|~^Npd!8$%0x6w6f>5!<$TFdlE`#Ow)#;W7XPHe&CV6t?a(WwF8#mOxGyqCps> z`a3EklMmwcWc>MP=#G|N;MdR6eQZgg&IC68)HQ=y);r(wmHOUL4ekd zo0kV5^nNfbO`WJt7;VT06Mt#uQz}q#p-X4sbx^`#7AG(QFK$D1l~rnu@FdVO+VXM6 zh%wo&bmf<{2_>?|$y4yjKA6nYz%bKj0zHHeiJJib4zdL&>@nyXQGhEe&~+NZ+bYvI zAE6p9vT4!%UU?Xh4(h1P&Q(-hD?J0OZ50B$Ovr>Ay6pF05vwWj5tl0@hx=6mbGq8DK*1D@}X83 zc9W$#fhC3#v#qx81iVwXdDlsiATvgrWV_Pcn0ac{s~_f!h2+ODXsD6k(Unbzh?H4( zAvUoQCW2Evk|cvk-nSwPhFYNiMJ^voSM@Sh$R0xwL7jODCwTN-s z1;p5=I)=g-Ipwl1q;Um0wynmog+JMllZqBs&bDzdKr;azL37|$ycY3l$9sXa*?8wI zh0jQmll!D`xnnjsaF9xdf@7cZ7^B_Y!h#`p#!1Hq6OR&9%bk|A18d|@Q`BukMA0z1 z1?DZaQZZ+{P$JY`Dww!q*xH4RM-t#S?8`BdqzO?jchWmg)QQ+lL8f_FxfdH^r0;FQX$9S5t-_fS)zx1J9S(Cfc_Zw9I8+6&;!ZdccE10KqQr?-I$R%wgW>AtpKLgXg>bv6&IyOGA|q;epex4^I}#L(>qku4{#z{QMyx;q#Dc>ir5Mt?A{epbf%lkJ zA8!P$8=(zh-m@k%Eb$mIqA5s*Y7Uz)32eRlJ{_Y4zhJUkOllOHW6F(LEXV~DAMMs= zwIVK3g1|Z#S-0YEgY|?&N5}|TZKQ+fumh1{I>=fUA%-202b=EF z%M-uZU`B;_0($~3LHJkc-GmkAI!BW8D&RKtI(Z{6qu?P$84lc^t-vJbD4h_38RH>< zO}m9@LIchs1ujBF7$b0Zk9}2}z+7u~T%g^+hMb2JzNi{Zp`YC_zswN;P7CV9fgmSI zz=vYBkcWvr^j%&_tS=(qtXQ2YUaRTK{DaX^Xh#_|RF!8QZdHCman|cA641at4<$+A z*&K|TlZ~s%oHE4Ri->O_ATdK!X?PR7%Mnoz@)8`;XtIl9wkufUTw(>H zM1!vH|4?xAcLqUX_-3)h!l_@&OE5ji=fqsHZ8DxM94QiqX>H`EZd#_!#Zwps&RV&6 z@VSHzs?{?OGn6GNJVgcrb%-y{$&r5E+|YjJ3P*g@f#|C@?szl6RY9FZTAv=wo-b;j zK=KlZVvo_&0orhTmpWXR{xOg}~W#8_uGwjZJ!KbjfCtCYkN z8+!eMmls1njDpjFwLPS?Llt}Q>ac%S$pH5}OL4Fgb*t6Dkn~O^je9nx8v|es4oRVo zRMbZ`58G+wbz6q_{rHeW#&`=7z3yJ zp|$b-4JYDT1nE{2_=1BJc22?4^!V&}bDLYAgj0ABSGRib z&SeVew@wU%+K(9g1vhb|s&5I7F#8##)>&vHxGmWmyH2x_y)3beajPo!by-=dknSJO z82hG~{m^Dwy!%{Lww(yT(3(^6%iR-hL#-R;Dh5G#kduyXhpI4R9wo7uZTbqT(@UsV zKrI4?xVJJ@3BnQ&0#*H6IvZp*3yc;>yXh@jI(KK37(G*Vn32H_0~{S;6MS;%ry_iZ z>C4la*Y3H-b|VAeR@v8(yp@7dq|}zp4V*l`Q)_*gWL*7*bd+F&0~N-A&ZS^hi(n{C zE~$DDxO?(|hjDHf^xcpe%wVaT^UbC0r!tOVJ*T1aY|T?D4iuruC)BerMnR8$EmXLz zZgh<7H4`0acR7R8q-M&9MpyTguUGQQFDCBM^(DcEv^vP(g&;r28+DKear&b}1LcQl zH4QkT*lg?~Me2&X3x%LLh?+WQ#_TJQU;DBYK~1z5Y&c)#6TiCi(b9EY*pa91UH*Ku z94vB|=TlB|EoU0PEf)(qQyW!>_=QfZQCDL>i*}BL6jU0%ciTT_S^7;4X*cztPGyS} zp-jDnI3MM$ytWM_AcsJVCiSh_Tb8HYWT;DKQd(-7J|B>JOV(0wBFpOXLR^@&RDQRLzlV?aocgL2oDvO;v0Z>rqie~tD z1;HW=Hq%(QzSK#i)ZQoq*|})JJcfWY)#hlSn1?KtYUC3CGGH=e-Lw}JZ^l9?ixf9~ zG%#@J^ctAa4_&09(lGYja6+mRr!fEfVwmVz*)bAXyQZ0ZOA_-j9*+%1RML}*qGFjx z2cewn>OC44b^FhD@4nVnYqmo7?K*h!(vg8~g?nV{K=wL!0Qkod`{0I*r9dRnDpFnz zG%r%rVHrhVe$F>B#O&U$);Nt)buTe;-ViU{Xfh4YSkRZ36|K-eior+dm1Vamv|y!5 z1Rku}nINlavvnTJsOVX-jz}trUNy)E9&h_qzY2r>8g)5_*{p~eFvZwP92IYJM>0Sa zP35AWoYR~;mqhfpHh)Ut9{+Ab5l3%icp)hW8QRPM2XMYNGr+~7Cd;e0vD7vd%6)DR z6%5@Vgkef!DNCuSC7n_11!eEt*VQ=-Kd=bi`|zls;hhCF?qru<)ZKXUT9=(1uC++n z4c;!8iDqg|qm>lDsoloqfqyW3!Q_Cn89M~)S-h7}>*f0hm3+6ue)467cPjEhZ3YwH zfXF|{IK{+}_(v_bENL^EW2G#CX2-i|0?2WW8pc6m@7{7>ez^YwKX~O%+ zeUEc6plSVpSxO!=O4kQU$Z{zv*FgE>y(?lw5FHg~;eiia6rkQ@4D1R0Ph|^VGHw#% zDonn6II^}DIBET@v&3ENm7Qn-xkNH0;j$$3#5cd?ik zNem%Q@F;NO0q02)%JIZ6F~dHzZ;+QZrBM`eHkZO{`qHE3(SsG&ZeZS|_S$IZIJNr= zXH7Z$rp4hQyxT?wo63QT6wGhGgz{=VuF+uuyYwF%Sl}d5<}eLV&3PNl@f1aD`8)-} z4xDr1nz2*JC@-E~(>oxSP7&*hK9A&ZN!_&FC{i+f$k3612;28i!q(A_q$C_%(I$1ZZCvqW*fFj4TjemeK^RY8P2pt#VpP=|#$r;TEJJ`VAA3rdw>0D#0X0 zJ-R^L=5)2^7CnC3sm=$Qnh)x6w@MOu(COA?R1-oRR(;2o5Urr}`!4fyGvnK(f9o?9 z8q)QE198~vwP6uKA=eJ+eKw~X?&m15&j-9D#{!=r>o9TJiQ-Jd-xA$V>oh$n2i(bI;9xNk>8G~d#eSALeThWay(PEY5hrdq@zpJ= z44uP~(E^S`dbmwnXY6kbwQlovaYO*PnPEfYBS(?+x^GMl>$Qkd3^KKm~D z1s3+Z@6fHn&4xqxX7GKlmTQ-Pj&-lr&HhmlU9|F1*v5RM89TvR$7S2y{utOf1`mU0 zsIJ0^xl9}@N0CV*-p{8P7Tifm_h*UBe8c92A zAXdlTboOI$mFhyWMe8*lusAdszi(UM{Oj_^o|u_U;Lej-w@g%E94k7~$fFz5m{4PJ zd-M()ZuEL@6dq;rEH)SQ6~qz&1<+5une~f3w8E#_SfWeUvUn=VAOujJZF?_jvICDQ zfm6fx%F>zpYC0!38W)8gd|7jOcBECtEAuh#XUzTNLVvNBqq2rx6ZQo{$qTOtf~GWH z@}iw=)ko}FA{WCivX$$P%A8n4Ck)nev$dF{8%b8T|(#m6D zg{Y05ktCd$dFvKpW?$pMuk!BCI1R=0iHA9-?bP#&Q6ap=9c<@}=nk*-d}neVP+&Ek{-l6JXr-qCL2pob%iN4UjOqgwK`{71 zBfVDj(0q-n;H*1h3cfY*b5wz>1IPW~8PRa|5IRBY?quc#-)IS!lb}gDf2g-k9@jWI zzCY19*cS@8weG!h_*SY$9O(05pM6Ou#bK6+VC|2aee~GQrCjZdKLlbGOSB_Q^h$mW~Koo-TfY z|0k_R`SQapn-BzqN*xpgc=;!-ws3TGb#Qbw|MU-BZSS$l(eO^kKbq<-D1>21aklIb zn^`2?F1;JQ=05pW0G<#B0}G)Al0^UOnK$oL%fYx$d1b=RFveV#G#8ox!2*gkxX0gP zJ;JeB4!>rvWpZcwahX$2qvF8j?yNDl){kV?a`SEXf;c@7OTZX!Bi(U}ZpP=Os=oO} z7bCsGn1P*ao(1;e53V-6qy1^sluw66vFnU_ylczn{dvN%=AO`d40GOPlqa1Im5tC3rnonjL*CER4)_$$=#lSQfvnv@fqtkXmB zZFOAw&T{O$KV10j0@n2Z(A`Sg$8SYD%be5xaY`BTzocLsKo{+B8bhr?cvN_8+P8@u z%_nM@4tfBR(e{vVP~nI1Sw>E`8m`l;P!0o?+enev=hcI2U7S)Qmw@DP;n^` zNOt*a*)FQkZT4IfNngOa|4DXjuqnp5(z7S7_ro3{u|<+8d|-avWEC5VeJcu`kMy5B zJo5YlcI|1EYO9u?UjKmI^WR|CVfJPbv*jxg>=yk7yJHvdcHMtIX0TCy;MF=&UOicC z#sYh020!!t9U1#HJ&>fqSXWu)>#RY`S)YgN9hZM`-LcG%JAT1lYSH0pDRCBbc3u$>>o!{Z>bx@Ru1WiK>p{T^ zTsQ~{eUFhkQmu`B$GKmIK)wca ze0rh2rs*R;>!!~cuA|z8K)pU~1oo>JHUzDLqQXJtK-YxHG9L_&7^oHx|D)JeWC>x6 z(lj$Z&lMflFy9F2TN7*L7R#{QX$m}OpQzoGLT#$smNsqXtSn~Dq#f&e&Kh*lw_h7>M zRoWo0FV{S0Dp%Bwy_!QVmaB0b98q1osYF(mgID29;tUXqPKRKuzRo-ofoMzSRL49e z<0DQGJL7`9o09p$t6Vb{n1o0DQ9krkPNV~AkkMmjT=`YbV)e_w-Ujh=`*zMJ;v^`Z zd6n7`w|S+<*tH8Be|3>=`PA7jw+&$IM5aQ5FQ=uTTaBN2{2Y+*Qz1gs%)0?M%&~T% zVqf@dWl($t+L&k`+uKZuN*TU(r>&hd)kbch`}u)A`$U0v4Id#D<_=L031nxn-Y4>j z2MS0}PID*vgo<2Ib)VHRKkxXp`{);r><&UsD@MMw{?rt|fWHWxRvh9+x;;E12zzfU zVjv3*r*K}LGBVSY)9rSBx!qE{#e(GD6qryw0zzHEVZ7{Ucmi}X-eHuCL0GinTke`W zs#{pBQSRZW%wkq@Q~wwmmhm{8{AF%hHxArFW)WZoaGUB<>K(?SCO2tx67d9EHJfFO zMu^+C7st0vTt|nx8s4J{ROk>S`5^D*s4T*Apj0?A@#>xBAa_oIr^~p#xHzUiM^@TvQ6_cDjv4t3VMH@Sh{?< zJCm0+q_x;sN!Y%;gx_rLN8KT&aa^{YZ^&F!)6Du&E(W@~xO53>2X4!rsTqyNi34KU z{n~HZ8*x1U&~B;n5yRF!C#N~gPfg|A*oUIUJp|lkdsT)j=v5I4?lCv(L;Th(*j0?p z4HWp)8g`-p)R^_l4Eq#Dk~IdU&cXNvm&mI?V@kO!g3^toh-_}&OmxwWCNZ!&MEZYX z!8}R05yH`o?9Rd=Y#EfYM5r~J_^gQdD>^QP?W-3)tD8DMVmw(72(mD4%(f5Z+p-#l z|3F=doih(2(eCH-mPXE7u!-s~NYCNu6PTeeH*uO%GRwj29y*u&d{}Fs74tnF07iHI zs^V=6Nb$93F38JM#yWYHiR?=<}+Bdea#v$fkt5o)l z4Mod0OM-ohT3r^TA8u5IkVG|lm;$ai6*_67Q)QvsxL}Z_rdz>g*lK>}yv*WL%-~5D zguBoIT+QGy6!-!uKOs+>mwb)Zyc0%&(&JCg*glTao#$UpRsK(>-y)!@n5>zqji5qU zvLKr|Yce*hcerDc$tD$F#5FtR*e{f$?6xbfxQABS{RIjFe$p}Xg;uQ4m9)rgFWE5q zz^+O<`R5lL)V2{8)~(;{+-|*pH;2Ub<{k!VzT7tzgsA)p54(UHqva*Q-^Dg15uQ>w z1?_2+pe(G*>Lk8 ziosyEemw4C)kn2$>xI2|Qq6g~HmzEX3^8*khE(IwR>DwUq?E`@v89E~S~@k}WVTRN zNaGN}tT1DoJhyG*{G(hIIWUIz;KT-G;Y#w^qIPjK4PSDgt?;WckQ$AAR&p7%C)|Pu zNMSzfGs;4`f*`%|@Y_2i%cUS=#EA$I|qLcpxFt)p`M7&(+&Er4%qF5 z06&Z@bi#l)EIwgTVZD{=2XWguVe^M*D#&ZBK;$x{PO>9Xf&$TmX{Reu#hB2#KDK6B z>r>CD)&TlMoY)_n^mrkp;a*~?2aB#gXOI&H+fxsIXx1j-?m?@`NIk}l;OhV^lD*?F z7|jwk;e~A{LnAP0N_J{!@nr;zR5YJ};s8Ess9;ch*OuD18PgnKlPS1#jOgvIJ~2xu zyd3m}UU>txy1njy88^70i0GRDXSZax=T6&&3)w2^p7kIONX~)CGSLgA} zlPL{-IV3cpboMG-yva0cjV*?oR3g7uu0!cjmJZ7^|$ctt*xH0mWukz<7JswdwP^}o$cytV zA4s?TH_}!3Uy*L?e<9rvAkr278|mi!KOG}nz6KuS4fBor4rjg+U1$8vkR=$` z%1d(YrMqWI$hs3sA6y~aSGIQ=;H3Pp%`St+*s|tC;C3#ar+ks&@Wf7!{t6XxbPx!U z!Cu)`P9GECvPB-iuG<_{+rkwQ+8B5Aabm@Ho*E-OLY$=0Wy0$-@*u)E7%#wfgK^u0 zYfhNRDy0e7QrHc=7CVQ_?Hy+g=}crFc3W)_>U!!*ocFHzS?N`A|OcuA!!qK{O4dpe76l>G;zKhzz)IfLr(Zam<)6G4xaP_4<9@YZOz)LYdGy z?M-wg){!PL`-uSrmlgRUvl$v(a+g98Hseh)g2UAX`YJnN&(+ljfZCysh&gjhn+=C-eRE5Pu_(oe$l52}x^}1Qb0qgr-=mHi zlFlPpJ>$HtX=Wsi5V^tHoh_LFbsDxQdEf$rPYh_Ax{~R$MNo?5BI(Mwpz-P0ysg73 zm5Sj&%F2a&FLIVX;~L;Z@mNs1BV|z9d)o^XQIT&U;A0CUvq9$y6;723DiF_GO|_td zB$I^{uNV3U)SdkUb!{E6q;w&(LT$T6lsD6$Qy_YmnVAWlM}+dUgEi!E;5mg+A?d)H zQ#G>1Oy-A5lLPYc&kKlvZWVzRb)jP^F4wcX7)IdRxT>VqW$9F<(e$b`^(|a0@R)(D zT)ilDI%m$0te$xo7fyMldh-b4BV_P)5o_6kKY5Ccdvzg1*q{~|J=`l^!oi)a3fTK& z+K#=}x4$wT1O~GpV(XqG=wL)tNrCTH;)zy&pT;#Oz|rpFXt8WJ2>`YPW1Rjpt8y_^ zV*ohp!;p&p{X8XMta8%nL11fYz1_InVG101d8Bw=bXa}X?pKb(K+&tH`6x|998)Q~ z&^V-%79Y{_W&+upe4$OJ*^6@PYnGVMAPr0&RF|y_L(jmR+Dq&(KSb_Mw);bp zZA6i?42k8MyH{+#JQLV3U%QZlY*U|$iviYB$hQs%$^J)atFCqUl0>+$U6iT1t~IHq z#3D|)#9|Ews434pu~JTpYNr9gh5%)FEc*#I@o6Mxc(xy)n^`+tS!~Ez&mH^8>d$x~ zby!!{>>c}rsi7{TjTm8`C|uA!-tuvKFJ^%nr@R)@gWvX>hn0y8AyVq}`_Jm2DXhZH zXm}am85MCtsP~qwGZ#ShRS;AAjK?8j(3k1@HPJ?=lRUQ`pSwaKJvfB7nJ_?^>^3v~ z+Vt+IqiUBjYs;(`UnxT)k?PyN-ixN@W^U{JjdeGEW8KWoB^rBq49nwFYSi7zg8RW! zJX3k-O|@@Cj8R}^Op`YJ7^VoEc#L*D8g17N+cJei&D0pWKY8I?QFfKb>8jUCo=J!S zPZ)VA=GE@~lWgHu!-WkqFFzz)q>*YJ{HxODYQm}D5*hEz(*=^rmlTrq#4iQ&O(1Vp zI2g9iw@5x`NGS-)`MS%b*Jx&aogTvr)BKP9=^X({LOX8w-tjm^3EG~G}z^U4)F>n%9>2hbvM*s zhnFXieHbsE(vC`7ZYrl=U0jVcOpLK!C?}o(5lKa#%REaKQk6t+rc?}%51s%PyYPgj z+bNG3@N|~)G31TZ^w|U0ew|@yB%sIXOXn+pW8K%938N%jg1k?gBOAd2B>F+4;^%0Q z(xvkW@Dd4wY4qGe5{;CU0%5zzc1Zpt$q5PSSbjDVJA*ig@P@=lO@$@AdedE`z(MsF z>BTAKLX;vvs+U)+SIcUjP>Vg2a8N;HO^0e!WTgbF4K`ATkV}Nz>518|ICwx{6FSk9 zumgV5`~VUkLVd)kmh=(7H~}mF-QC)4A|6j5>MXNGywL+;`aR6OFGZ5s9Xrz2wze~L zmMnCfc0me>EHio>g73NRd?$jAdb|1dERS(|eQ$7;*QIWJ+*LKQ;)h^}_r$vy2A@hE zv{>Z;MM|pFCezCZob~}@&ywx}cR`y+X}a+ifHsx}U7#7*i={G8n$eb^L6;3-ml=1=;m%BrxL zw5jGc0u4G#6Ka+&ukYz_BxvsMwqNNaX~?jEsgbf3)+caXSgA5! zH++eP>-d-5-am!fKO0#YSf2r1z3So5#fS~{JAHn^^|z9DFX;I1w*rWw#%qCGm+4PxnCijHh7)WFU?*GW z>ZeCxkcp6w@b-uGJwLi92V3G0I_wvjHDYkP_Kq%ZHn5}0CNI3#LvrYKvZR%`?oS2f z^;SlPs|}@}WWs-jWrw2Cv#K;Qfb{l_V^h2%7?iKZ^SU^Ot3uI%`ICm3QJJ`}fgRx8 zMjGiCl9MGYXU|a6UYl-Sr77+k22{C^X?-t(A|6;zPSRV@s-iWds-tolPe|*%({Wfg zIGJYE$k1vI`#(_HoVxQLi@vYKmK>F%WWuf!=)&-3O|lI%WEj`i4!!l z3p5@Bc@Q0%J(u^FnGNjp+(%L_xt@NP{NyI98D*a?vK#<|n|NEl%B1>um92eLP*SbW zWq6U!0+C!jLrk+weQm~3xE|XHM0KbY9USd%tgFH@ULi3}%6@-l_$+P4ML@p^3Kt9d z&h~R!l%0Uz@ETKCStR*UC+y3k+GhfZ&4ps(cVz5eBBa7OOJ}=rxxXaFSR%+6O*TDM zO9O|g11!726V8J)L39K2b>W)uXgd>}6U2A5#rhW4;$v1qd*4Pa3_sSP7sLDH$G;CO zvfsum+2>3M!GSLUQl~wj7YuaS1~asOrsswIJloD_ssQwx$fN5wwsT-Wz7CWcMxin; zBBo?3S30z!U`#lb3Sc@s|4_$|)pOwJsO;2Bo<4IQ(66BC%-gj|n2|P+kc!C!dIE#E z`}7k>z3Ouj7_@c*_o7>p_u?GxB~jo{*>`9OF3ta<(*g03b_+vl>o7B z2_~m2vn@gkK#W~?#$ahASuMScml4<1xkwZjYMY^~>O&sg%K|Q9K(&iH*q7irrsH5Q z^n}<_%oJxSpEIX*uDW(svIX0DLp<Hj7f3R){F1s9Ui@}!B4s0Dak1#V5R>U@!p07`%K5^ATV8hX1G(;~q{Yar6r;h9!$^A>w4joFsRO!Qrzo~14K>Y) z2px`FQ?6_G0`gePI`xp?nR zlMM2r`%kW*o<5P79h6GIV)+f51HrVrq4*K(nlzupGzBOA%Z_{OuEH)X(%RKwv`3Da zDnTo8J%Fg6pFt_hJRw>T*#mS84bs8T>sY%`4`tUguWr4R7|g* zW^uTQ{RRD>T-VTcKbi{(1Z4g@CE%}Ljdvqj>jkJAh8Iwd=O0l=Tq(bJ@-@PEr7 zW>^(J{Z)jkqF%!|-}5qzHu(NCGdA*RR6e10*8Kh;smonKF~P36Q>yX7QQ_A+qu+kE z-_0HHFz1GoLC*wiNkzC|J6{g@M&ivZ1AC6j#%U}54jHW3yAyGq@zj(3{ewHZHXH^f zrdjQe?IWeca2==~X}q*m3UtWu&eO}mL<}j|qk4L31{TD;FL8y-^K6^s#18^mmQ*%- zv7PN?8~v!CB(mo9!-#I-Iy5+)BzSWk8SilJ6PV{G6y@oHp4jl z@A^OXXzh<{HyB_O_nH`(GfbSXF_#Vo$O?K#rd(4;k4>&Ezn>WFRTb0HLU$hI730uC z8?5)yTXQ4&9hh89`mON_9(N_RpA=={tG8+U>#V_3pBxN1_W%GD^4jZg z?G>eA>Kx12Yu=}tOi*EN`5xEU3XPe^UKi(G*&Tw1<0tbQx;BSrt8Xs9jGLNo?)v9l z)d4Dz%gZgm0}llFbFt@@M;?llwnm!|6x=cOy0cEjoK^e`N-28eCKoe(cvgKpx~LI< zT$^>#Se#wZR>3lIN(=l*v=(NE1m|adyf5HuF3xj1em}L~VTu{yLNl&XRFv2+AH4HP z?3Q;(c8vyO-L1&irCCdY8{aMa@BM*sTie9hngee!+4&|-eu(?uJ%s(W%g zm5ol)n|)%#(OIc=HDK(ai+g@;x!cqA;r#WU!oVWaExqrKp5fNIVQEnF0c_ObtFZ4!c&^Yz!u#K{fhW2N^Wz}WuDetEGa`C{&*agqDqKoV zZ5@H$5Cx}eXQyKx+WF|BVF3srSJb_BPF4T7R;2d%0xsaUzUmao-;yqKV;SqG5k3Z2yKw+5j_mo1Jb*r29_vqPxBxlL z;J+mV3%?H*DeM*p3K-lv?F)d@qmkK+!pVO>9SjeGHTX|H;4L)VEG$eFp+0^yKakEN zRCHeZhaTKN^xRJXfDn`#-QvbypI8Z~u3LA{{@3zUodD=tjqicBxJcG?1*&Zld? ztb`N1Y=R8=m6;IcO-2c@J_C|~iV*)+jH6~%oh9M6C@JnUW?^MVM9NBk<6(VSF}34s zHa}2O_+A%B^!NMwU1A6}nBVR#K#9XUV~!IHV?TuwU7$Y1BEJbCgE&k0Oqa%HO729q z+*p{kiK+Oj2rD~mLa>Dn9sw2`@Hxs>B_+ZxQ*yGw{XrHscmzCbiymMYGwEFUn(N_f z_!;_~a8%u~9jsHoKYm`;RS_Xt9)dAL&uR#0rfs{dPB75e1MB(&`r;cV^?JR&20xAk0LIKbk+G{G~h zZBhQjAr3frwg~v{F@8w5x|x&ThHcFW#s;1NI`Kz4Jpk%&X&EZxqytpOvZ@tZ>jG+o z5VLj6`JNl<->SG%a=O8PB0YhyEw+FsMOfqVE=*N%d+-yP@(TUeqyICLfq2R|1d=B4d6eP5~R-;u;!aP+?=Oga3vGf~se zGuFA<1JSlq{aANWw>OTJztw=b=tj7pZ1MaqPW|fMJMX4-4h(kf(g>Jy(|R_KRFW>m zTyiB$d1w$n`nVCnl@WFa0iwJ~C?77=x>DI~a=z|nTC-OZNi3d!5?X`b?r_wee#xorKC(+SH2G6gge(XcrGPakDK7fPV+=<)x=Ug+cy~15DcbAMGv-Y2t2uI*CB`!}ody zHrXFV_iQ=jAb)2xzyfIJe^)%dRn0|A$t%mQvyrcNXapuUs2|LK6~hAUzv+<@@vhz2 z=W}N~3bS2JS^vBBKq7+u)#Mrxffge9DIMW6j{4JS53de&!IJfgN*cGGO)6xUz|=f) zrs7RU+D6IA#KWx5vp{Z5&3kNJ#)2YwXvqAWAE_`#W%-+2IDy7*3#!WiT964l(1QAH zep{r5>g?83eS5dRPG2iJ;ot&t@y%WuJSr!@VepDL7rRx78=?U4y}BbR{6CnXe+IrB zDI?W9dYZTBrz>vh+`-S?P=A{rcm|EtU*-j#VV~F5ZJEc5G-TuRfDSw-n;^C;oD&x0 zFZ=r4+9~sd|2B^101M?!RwY*d(=QHp=sg=#1QlQzO&4dMejE3{ZL;|?8^dLbk<^phxB{){+_fmLK$5)E! z=nk}#gY|cc5lqLyF#RwJ!)6%B)aurnle(CXvky!n+b!TVHT^EY;Np`eu%ep&87AE? zGCbA2B`0;AsSF~iR~iG;d{tB+U!UKtd0 zz>&s~IubB8Uk?wEBxh|7(mSXn8KZ7vRq6FC}fh z5sK~Pk3`=##_v;~*nM?hivrI+*MBm5JtkYN*E$>-U==&?^d(JHBwmi;&70Q{e!D4T3{5+(h-7~}$YTaC;>dcxPTcmY5j3!da?@qa%yRI_}T6nslOechn5 zpJeNQ7+YnXxazvTmuvK??c|^3+oW@xWSjjHdpPL2-bCF5GRP0(gHC={DdH`?Xqw@Z_r- z@VY>H^0i9%w)}uJ=d?97;h}>4lD1(jm^HR1 z97_fV>JJvpY{_v~qT3~CA1z0eMAoQ3{tnE#ZO#7@MHkMT95+1$jHL`G3d!=RE)?!# zN(b|Vu!N}STN=Cm`A^@^+LxJ8h|AS0DPhrwunrs?d#%e$afcSBqBWV(h%WXV9MsLr zOC&26rs%wExS5an%S$ES<#49$>{N{@Gpsn8%bC$t+3;7@(!%L8qU~t`5I7S<9GDj0 zqby7_;aK}58tdgl(t*R1-_f@IiuV3jw9vnzN&Jo`x1^R>@-J*z>aOUeTJke}@lOp@C3c+MPr z)Lhm(pv@fDGoKw*<;dpy=LNHbM{Vic?LjD__P>uabI0|Cd2vBN6q!IlkpDH#{N(Cs z_m|u7nZCBiDi_dWn9nc6b406SParY9@Q%{5LH^V|hX$@;xkO4oAtLep4m>E5#NXBBgkB61sKfh&8DDx&RzDGc>G64ruJV)dRhY>LD46hU0siF7IzjdR~P6qeh5iuUJG0;IQO-}(fL@zG#P#U3)Z-kq zz7ezDbkcS;Ic`wO+CE|=f}Uj5;YQd1lhq&d$WrN#ixx`?<>z{FUPy2@4ROW-!}-GO zB!w}JdftiQXxZThI!g#6#JdO^OuaPpD=&D|Yaq|+&LQm0@sJQSlsO;=ggFRQP7EaM zwJgk8+V-0394eHR)@cnf47lnBz#JCtcb1^=0r~8`6(JJGN&zez%?Tn<0kJ;f(u+{M$%Z9)$wN zr&!DLP<{$`3`MfVgG%~FOX(+H75yNOQMF^m=OK?(Z|`Y*jM#(t%c;gU-e)KIRUdET zFvprwpIJwyufGl+P9i(;-q_!==Q{yI9@<2A-H*v#8U?88v=t_c#*RRRU6UrW>bJUi^M0qGD#nXWz zZGHZsWLOEsfv>GB<3h*5Ge#Yh40pLz#eIoQY(5Ps5{e5mkE1#neA=>_)h&C^_}Bd^ zB>jP2T0*|`d7xNRDDYNaAlZh%GK@g=*`XuAB`IRE@*cJmazN+?8oBF4^fJNe23mkZ z)^DK$D6IV!dVm69256~6+FcH97BS~yi#^JK9|}4hr69_dU2af)D+(-gI-K-ZRt1Et zxhZpW*H2u-7CnJCKK?MN!{j!NLDfxe7f2t%Gd!{%H^U|Sy~j7~s7WYIq;^D)$lyGr zn#sw#MU^NBQ0G7SnmmQA_pluQe6a?rGep_5&5+w*okvg~pSkoW5 z=vRt^A|yJ10q($nvyWU5E92+g5$vGLP^)U#EC49qlvp$M-E zs2K7%Z*6=K7g!8)v&-xCLRjT3QeX<&S!M|;B2+it4@J!p8F6M2ds5xG?(V;ajC~V3 zT0un+?jMtYYYE1slo0Id^%VLDxbQodmNIP(J5Z|Zy$O}3U%~_svkx?N zP7N}-$SmW=A3a(lqr$d?v$j5bMvf|V9g~8t^AUNf}-Er#!m z^i{y@ixLYsLMO=@5uX_8!Pn1f0Mx4yoX=s|#Q8`Wpe8ZtpasadsxCMr5;8z~V0h$k z$@P6|YN>B(>ND_%(>LYR7Enj`RaA5dZy^7}DYDFTUDp5M>>a}^YqquF*tTukwr#s( z+qP|^V_O~DUUAZ~txo#Ov(Gv2KKs4CU+<5qS*zAP##&d+F-v32yFd}(<#!zML2JrL z|0!YNWcM($v3Z$VTHdc3YMFJH#j_mr3>g2IG^<+zt&Kv`1e2nf6?==!smq5EY9yoY>VNpC)W-L30Gqz7&#sDs; z4#HZO_1n9Mhh;#`jR05Qf(IF{sS^)6M9V%Fw4WCH-yn=`3(vCOTueQS&fiF@e~`=n zAX)xFV*eLXp7P>bZTdeFQ%**nWyjy}e<_~e`i7hR1DE*+PX7=5U$B{P82RCUz*7Iu z@Baf^d74Eqg?&K!enA#E-0jWNnOGBKmSMkn{YZP_t?>=U>i+RFyq}!5+)r`VWKK|1 zhK5qVv1w}Xo>M!c`Dyi05{q23vdqDaCuG8tPut?=YDspf_%TN1J-IhdT8ekUbj`Om zrKC%$%PQP``$^h4L;LRVg1EDDCSH&XGxG>^nyC3=y(4CU=MDEw-oiGK4?bG?2kn@C zij&J)U?Xv@oy_fAUn-ry^Y4-xqNJ!EA_rf8hY0OE<=Oj;x+-XX!k4j<5$YmBsEq&_ z9;d9o#VBIMm-rv?(;_B<(^wlz5t6IFr%%x@T7(z9sXL?edQ-xYigmPs-Rcbf z&~Y_H5>goJ5nSn8={d?PsAiEk{Ff# zxFoGwalE}&q)Cfdl{>6yKkt-_yQ&9F_<&_6fk>!9&7`qgh^b4&f6QO4B&SZVaD5YS zs4NLmRys8Y93v;|2TLs=k%)_$QR4_WP~+sLptaJlM+cI0R}^zS6ZMyoq)|q&thpyQ zJ51e|cI}D~Lv?cc!^Nrv1E2E7fKMSS=klqEiM}a!(pdGfT$9_`U6nP7{C(KjMZ0qF zXOa*kaG)(`oQ^v2Ygt+g={?p@ur-x-YEOaubMY8!&n_~)h-n=;wS=ILK?;oYrJ7jK zl-!nV0Fi!qg?^TgKfajzyXlKNB2pzpeC|jfKiqBwwlR1CA%^#Zuj7qvaqBa(4c1|6F!A3Na8 z15`EB*YEzua+$gCs1oIJSiM{nuDm~n!WyYDM;Q}fdz<$Mhf`rwGRDFzP?;$(>*P8e zpYA(uZ75I9%_I@CFHeiedGB9`*fyM+WZs;U@!i&ts=YQN?%NVZHw6;gDW}5b!rI|A z9<(&L1^IL`!j2PiG8&J_iuBE&*w{{7mYRvS5)-fJWmM-BBp}k2WM+saVhtZDb&)58 zQg~ZqY`xMm>ohy1bk?f#D_SmA+$*_k$GgLy9Bfwm`OJd_whg4zNJ!+cx@w-6 zWlrbN=2uhgS^;Lwp@7(c8=%Kjn??FVY0!ECQOLS@z14s-&66VVi{LS~rHqfWWmQi5 zQ`hDv+jl9RiL+&E(e8rYcnJwjIObsXPbHf()7^${n0LGFBXj5P5 zh7L?yIjiQ$kMXq(}z5GsN1tX(wCP-9{WQ`_(X*@d$IYx zYj78W@*Vq@7nj&Zu5n>n6Sd?CC@~4FJtB$w#*%O-Mjo!~?Iy=BHwL-Zc*gXpGi$Py zI|i+>f}o{GKDATnVZ7}H?Abbt=(pl(R9rO43Ugv__6$bR_^QuIO`FG56z`oy6>LsE zO=GWBi4(oDGHD}Ey$`1Qp^mh8LnN%W4Q;L9+|4Pwd?L-u3x9v;`#1G_%*3)Y%miZS z`_*h}-J(?-nyk|A`)M+suG?kTTXvF5RDh7uuavB21&U#<{o3d#+Y}GJS==9RSCGD8cucO(dz1SaSZ#>X@A$ z0mDBxe9Y+PYJmE?-Z}I@vrnhw1r;l+|w>^S_IjFT!H2M(amp3CRto950LN6&_?JnLG8V z$VtS<1+S~GTC9YQ3aXzK*<{0S3Mp8LTG9%&u{FU&94Se5&lFM;DzE*CvA3Xg=}C`Q z$1F_;ULg#ml$2+h(Vutbdx1Dn67`%~@|tfJZ`_W!t4D<c7@Ahzl<}!#-7L|-!RJ#MhHnqq9|F0va~|(e`Hx% zCb9&F!8l`hkV{&PXKvV(Mpuy4t&aZrJciLm!GJeq@8R=V#0)h6n>Ci~tx9;_5lg#Y zqkk3{_xY{E;zIoGgJ-}mTPKW*9ttUSXTJN@dqd`)S7OKOrD13mcBd{&uQ+p@>@z4s z=~#n6|h2G5%T)8r)ShFl%76y3<(VfTO$ z7nVFYC=q{g6)YDDCHG@@A{{D2!&GkvPTF+hJf9%En&|F^Nk?`n!x*)N;CsQ#NO#u+ zGk-~EKo5j0SBdro?ob<@NS`ULQSJ*#0$BIdf@5-l!>cRp#?La zo9)k3GW%M5WA*-j^;Bov4%&S7iV=yWGPn&&Q-cX%y2);I>p$M3RCIMQa1)>0rVdp7 zL^j_i)nf8$8{3?F+NW*Z!t`^)-I0!k&e$gW%2Rx5zIZTG)gK(8j`oq_B8GlU4H=HG zVz3F>?->_GJ|pDoWT0wd+udeb3>;Uy1unJ+Y+J^6#u;Uhne`>pLr2{pq4GER2}atv zo4R?{KrT}(*8qBW2^eJ}z(^^GSV*?#iMB#V@cc|Pz*9qis4Zms?%F)qtjL{ZCMmJHfrA|krqbn=@G65AVJdbDjUdhSU55HiYU{iA(33Hq(Eie zqcG363al);u~4`GPgPl&$eewwi1AQlMZ2w=tfoLyOmQ|BF`G*ReBhUq9^n(U`9hH*8V6tJ(F zxy6$qHSvrMEHlvZMY?g1OS_{3UaVF`4-Z+~}LEH;a&zzi6$_{2egOkMkn6)0X51;zrFv zsREl48HF4SKbAXK3s(W`({k-`ju${`lLE!=xABha_jv<>Y+d32Y@yk^-_cT_zx4-T z{M)R*+!bZQU|gi*;QAZ^Gb6g59YNV)3qPtx@%O?z&ZVuOzFwlhtR`k@n05_$YUu%7 z-<>|{BH*J}a%cYZ9KH;!9b7Rbk6{HUyjf;-kV8j3JiIARLtaF5M521%ace3jpMfox zu43sCRV40oQgCs{_Q0^aTIXERnp^i3vPfwY~usXQ(r zg2v$iip|?^_1-O|u6Fc2C5x9wk?DREMGARl%^dwZilA1a3dP5VeIucpKH&wWJ*@tPC601AsmFKhG~)>Ad?MwA(e zil?9tt?bF!B*s%y2?JnDS7|fGH(eNf8LPx%vQ6SXYu_}>k{pr%=>*)m8vYp=oO=~H zuZ59C!bD^|k%;qSiQLLXl9)7g#@Som>7Q!#SL@qOx+_iS36ea;4lTNGIRoxKO%%lh z^UN$Oh^Knd#XyH@N)?P_>>!-4vJrWO(!V9VE_}%h;VG>R*PP>=ajSRPNr~1Q9AImA{Lht2)%_#44S@l_1g22W?}5QO@uq?M32U~(TYy|KGt9k$xF?D zQxaI}P~wR$2Aar`d|X86D?uUct5F`4?49WFE`#C9*(k~}BP@Hs(p)V)+^)X%yxil> za>DXlhV@r_&GNnL3=b%HA!|7lVz|=NCXJg}{OCwp9(X!*S3_&6LTR-*Gf(qCf_BnqvzJto8qbe zSLT{(QxLEp;(I`yA=v5I^U{7f4ITD7J$la9|F1bG2>9WuQQ<`mhtGToYd$8_3oIC6SRpoA#Xx0y5C+b& ziI|~*QfD(xP~o9o2<=?zR5MliU$hk5^u7*yjRr+oT{P<%Gy1C6G4GHSM5N?s$v*^) z;gDGUiv5C^BTtHxCKCk%%OW8^F2>$a>M5wy;HXqK+FGeBEr;2Akt2{%uArg(UiHs&;qrTj&EoyzQhklc>JOpqZ-u;0zW!E){=tKX| zC#AW7cc0zWar*qM>>qh^m763Ad`ha`y3sDvfMbRrC(juOKE{W*aH*99!GB1zXCZbA zn%6p>9-!*aJ|+_8WyFA3Wm@PirWJo?nXJb}nUQd@+a7;8$w5iy+(7b&&C=Sx$7>WoVbIZT^mW~9WAbQzCW5uZB+;bp z5i@iss^PuWq3c$Ntc`|BZUN5CZn?3Q`PI1girhyM2|`|Rakp!2rKV<|43CbUK^B{mfQPOE={|2&jVJtrJy-CMtVVn^@)xA_49 z5d&F9d1L^8H@OHH5D?P0`Td_}H+FRVr`2=SrtCMFka{pr1(ABjQgbC?Lo5<`sGKdW zK{YN}MQd$~(WDb&kzX#llT9@2y`vRayO%vXcv<@W?BKbDA^{uR^pxP_MrqZp+cRgX zPoD?0W%~=i%8Hi>s%EdsefV{e?HGoa($oDt#Bwpi@Mlg zT4&V~>{DT&(-0*ea}YjY1EMSHx8F>JkM<+tQF#GSIcvD3CYj(JtU2#ZiW*t4onxWW zz3iM`-Qz5sEz?d^o}o1tTmKuOn2H-0XtzsA(&;U%8Tf9*0HP8_K}l}PW>zA1*UO`1R9HZ}5tlWVQA^d0jL;@abe?{~-Jlh`$n~&CQZ;Tsw*0t?#R%uzX8Mxz; zZHZ1PG(T)3vi0PnJ=(e7-p3|NTCl?Fk`@MA4RrKSr=VUQX$9UUw>_YJbVt0L(DG{) zK3X$iGH=@DRAv#m&?5z!)f`vBh=ZkvLYN{iu^8&i^4uzqn&Eri^e~&`AO<+oar} z$={Y-NDf#6(w{B( z&vp1i2;NmBCAq(=_j-kazB-iUDNtaL97bpMP1nay_|}%*;+Cw#r2@>Z#p$TMsS#hC zXo%MJ;^0ZX8-d%*X`~|x4%)T&)flrkuHSrCm7`?~SLi#?z`Vj`a;M9@`F?$A?jZo_ ze<&yJ`=&(_>2WUc4x2oW?rMaCs zf?H;pg!P9mkT^nF)M6ErfLpb+wzVIQFz?MIysel3! zk93$>j$h$jc>t6O!8UBQ>~xKXAWIMF2)u-Zl3g6nD!J9!^sx__u^%6)930r9_=a%F z)rho|=bQ!EgncjT8m+RySxy%uqM@yZfX$cgkE&9qP7~)0;&dK}MzMG`bB6^9g=fK# zw>|h4I37^B_f4U=E_{rGjRAwJP_=hij)Thi8LN|dCGu{!r>HhT*z!m_el)|2g1FS8x#NJ zePyt#Ys9W((DHiC`SDa0wDxC>^H!hn1IrV9GUgh>pX*VRd0EJ7q4_)J;6Wd>UdXGl zF~~uq%dg#P51opFE6=u&)}Z7XvsqtcG*z#8a5JCRb`|3my{e|RZc6}tb5#fAMwKHK zC{2&b5oXvodXy=Vix7p+1nY92Djn7VMs?EMrAz}`DkHxk%Ph4>+z9`&*A{o;r7M$#2^j+7j=*1^^vikhCpD!6c?n{W5 zE8Rj*T-PHp3B9Aqh0fH%9tu4j=ch8koe1HEjSX}mX2mBK86XnN-L$oD>J)zIO2za6 zyiD*hC&}$a!FNJZuO#{L+?i&|)#f_kT&yR&iZLid*()293(w#uub2}Ub+K=IFtaTB zJ@539rmge|HRWSB+d+%Xd~#8mMy5X8XXjIL@vCmFnQi;DH!*}guCyy&b@>p3_f9pq zN!Cuia%^>Zex!!I9@uyg&MxXo*<->!_PX|GT>tHLb=aIcVO*z;)5v%|sH)o{)4jPe zl^YMrL~R*M>vG}lb)>>o7ssY2L@jTmV+dz;L=LHf!$L1GLM9w`q=~4kLMG{R#CKvU z)5}M!+BoOEAZj)%2=}sS)#1yM0j1Koy7#3999fawuS&Q)LAANoTPJy|F+iEM{S6Q0 z$doR&Ctje#nIkH)aA%+cU|`fve`;Wy+a#fP{so%$U%uVSP118nEM%HewKp_-*<$Ub z&pd9iNk404tvgAv3JGo7l0yNo#2QDg=FD-gU8&2!duvm1Sh4BekgR1z)>wf`&){&S z`_x@aa{}kO=Qj3WPnxi#eR-DWB#K#$K@XG6{}tCRkBt%d?S!DJ|Mmx!4ha;D(z*7+ zis&p_w{>;;*i(3-l@^oH`CL|!1t&q7sI8@@s)^CVu9mJ&h1L%qAd@_A%MtoStA5{nPn8i zx>_Rzz-<84vY#&NvWe}qQ!(&fHG>d&U{Gm|TTgL%+NbyC=cS*AJbYIQ=RopE z4_eKph=CGh`kQ_ak;Y){$tK^hs-;JGqP9CtW$I#8R)4Nq6Vjk{@n(f!vM`dX()(>) z^o>vSIEIt4%J1+>Rz*7WJQOlR}!8Qcgv3o;JSpzrX4Q|8{wOV{~n zP`&(&+pE&Q&-pRbchd?Oia_8}F>2R+*&Z!aw^sA(|II;z{i)Ht>}u0mw|UtHVgIsE zvg&+1;(=^1V)H`yJ!bsp4C0?rh1HcT81OyeY=r-hRinMDnz4!Pzb5*>)8!R6nXtxg zQl9aPw}=@_>x+q~TyxmC;L7v#$LwlG+|9b_dk6ha@Y@oYt{SAfZ|!KDj%Y6%Q$&<; zS1-e?N;Gg!8b9X_4f6vQueMp!c}z*r(R&Uda{4Zi;>G3O8V>seuI$+KC9Q@{Q(+W% zu2ZQzJWkG1uB3g4Iy4Y!PO4@c$K+dP0r?e9qrb9l1mGzI%F)%kF8VOmMKI=v(PfBzc)_cI9Y^S$cCxXMWTXsLTAvhwW+lTUfaeNb%S)+gB+y`<0rJ)<1C8y2PVbwaWt1I zcTeX%g-=eBwULxcv&HQ4BeGeVNy9f8!}X+=6@{U%lRz`^X>I+9bzK_tGy7DRt68mF zhK&X$QlG@F53vtKl7PZTsjfQw;dSLSaVLFr{CmSSm^OvtF6Fk^xFNuGWf3#+0Ho}hDL4-87=3fk{# zjxab@cZk?!F)DzJmQphBHZ-}ILasp>@*)bgN^6KH4RmoVc7kCdNy=H|BQE50aG59O z&=YAxL;tS6KL>if0Ul5Lrj3_&F*UZ*VEc$# z1BM|Q;u=1Vu$uiAA_0U{SP&1-5jLZ?dpG=QE-ze+XG{xa1T3>&Yy{pEt|E8*1lf53 zd3gaj`g+r|f*ITs%Sx~YQk^N2nV*OX-U^G%3uq-{r{%>Z?tTBibLl)XW`gMNZ`z^% z*UI0;+|~8_ZODJE{983PRW_xN{C4Xd&%DCSP1or$Da45oiZ0>RNj6TBmYaB|#aCFH zR((I8rEp-Q;bqB#Fxe{R9(#R!pRWnYC3%TrBp8b)lu_b@PRfOPwZ#mt)9(rvx*wV? z><73it)#oJMNd>HW#ytsqyUOJv;m&5pQF zGSehg(sMrWjf1(d>}4@7CCA%GUxppRg4XFmFk{33dJPWC=6m*Yo&^|IlomwcLIfFi zM({>emfP&Lb!#|u^enuZBQx5!Ej?CggCzEP%6oIrG~uM{TF_QDz{Wxcefg$r2RcrA z?G?EUB%Ady?*O)RvKfY3&mvYuT!=2uU%TOe1R@L5#>j)H3V+GW$EM~xRCPJJX~WU& zr16_I3&>tg@Tl;TFDWfO+(F1^&G8l#?vR1b!zD8B(Jz?aOaW0bZOJBrmc2L(0ei>0 zgeC#r#8h8`UFf_BaPCku^v87+r;hnmgW+(lkPKG9I_JotuFyAN zN^RFv5#7*3RF)UFqv+hqVZh%_aZ-DaMY0#3_1oS_y1_x z8NV5mKbN~Fh+DOzYDZwetQTO6z>#--0?_uhYoQC|zl<#sUS<000UHUyf+;Dd~zJgnJ^GoULx-G@D^Bs0=-)z?Kg0to04N3~wl*H{Kr_tAKktat#|Y zmPcvKEmnsg@KY#}^h7Uv+1)S`Y<5-k!f1aq`qGTAoBOl)N-j8%$Vy)xy0PK~|ZEkOu{dtC{pEN+<%W{dZUQWu#d zmqa0xX1x7)f|p)K5`z3}Quqz{J0aXICjkPtD9gH8&{eT`&=n-W?k2j1OoV(P zG1YU)&`_rd)hA`BD@KcNn!K3$0iHb}e5gp^&-3<4SN1lhoo4v4N!_fG0BtrO-PG~1 z$=6y1;cmxU%|)|CmUbXMo4sr-#GZ$;H9>T=C5zXScSRRo4Sgf9CG<=ecj= z>HTK$Y*%vwO?JlvPm9~?Si;pz@hl+VTEpR9slKVNho-tIK#K@yuASv-?Puu41q-7< z=$|@5zc?M0p@tC@pF;&eHgS@nvl313x&~p|CQOvrJ zW>2O~0(h0i&fp?7O+^sbTp$6|y`ER!-0)3nI+H2CJZG<51i|yvDgL~_Ygzn3bzBO; z?w_Xw=QGGFZ*Oy)@|MljG&JH8&6dX-L_Ke~KHVE|BdA4SQIz z&O_JL4Zg2TmtAvJr$`SYVT)UWOQLWgW%XvPCqW^YjG6Te$CEiW zu)qNV;WVuFjL=>9h>-BC_J}UvsIY4k;!UaC1h>*x?h~V&XFY+2*o2TD`l~o&H}NAf ze1}1(8;r~=$)bp-aE2g+Wx=FDC8t4!skLdO!60pH(5)G{RDSLEyg-=pQ2kRv*7lh? z!2i}AGD$^R#0QVJ>TTj+-XH@K5xqoHLMKh97#0EXs1OxEHb`o5G$~k@0+le~WqHWP zONv>%xEExE*YqIcSvoK@JPnEzIyT`2SB8nXiQTd?IlyHZ^`>a+f0ZgK>#iq&_E50? zXEc#S0;k?C@}K&Oag|sYQ!%86g4I7_k*nJDlz(Y;0yt4|+6@hUd_Dt)jOylfWjCMn ziM`J)MGDbN(v1YNM6Vtq7e-L6ICtJDxD+no#lCk`2l(L~lnBz+;-&1Xvj_28m;XwOM;tHcObnG`@CbLD*y>*P3C)WBc5u=9?<=~LE z<0^I(q17!B`jY!C)x)-!=W8Y+&KQe9*+2+=VQ^+BR05f&77=PikAXpaDg%Pe(%$~gE~N>YK{xxN zkPU???%wZo-|V=|@t*{w`xq{2r`c_`>6n|BsjK0!`L&jol67m;DeujNf!x~4%Erj& zvrUA<<63x;N@y*rD)PIzFCEKkcr?wvKVR8=zQ44$wQ)S1T^7jp*R?+2fDfLEwLlXMVtE|@P+o-dvn;bT$r{tLaNO`1&9_`aWkq#;ZAM!crB6kJEoc{gFxHYZs zqtxymO+OYWxG&Gs?5Yi7lAe%uKOHx=v9)d@m5kS#oMP;^eX#G{kch{zBE6S<^@_5! z6(jk)65_-+gSE3>gTErZaFA>6PX%!Sx=GHHPJYjoh4qHE0_0|`+;DjNYv`nqzHd#1 zI!Y*;7jI}`eG=Gb&TCsZ}uZzEUm>YwI-{4(T7zT;1-S^arJaae|(BM=&=fwR(S zwZKY3@^nT{Yiqm8Gs@Pyc)jyO-~`%as0JlB+C>&lIOf0+Er3RI>O@6a3hcP^*${75rDylX0*RZMu zRlMf7JGu^%2>6ZX*37M$rG0${FYtH^7JiS6&N%ZiGlIT2Si$2L@I?-hOGC;O^F>4N{(x*8oZ8M-ZG5kS#v*;0T{PM26x+}DCsb2) zz@6zBoE?wlyb!Z~bQksluyA7JV8_cstaB0Z%)EEk3Jtr!X1jg6C?uk`oqTPc6&LB* zHrB$H1CB6qC?;xALCbU_;4nQS;|F#YHp9$*H99kge3(gw=5T=@*p|LZ zOk)Be?=?+LSC!0gWg|{yvnft#ulbRC%l%JwHa1skFCqvmLBslijS%{JqTQ9Pz3+Zk zchN^|07@2FIEi3d;cix4-ADlo9D03u-pps}1yB?%+IGLK-gds7#xUahi(5Htu84^$ zm5J*Sv3=!KD=V{lfC5d?)pN1lu#26u@+Jeir;}AAazag2`>^Wcc3`N@MY6KipcSAX zQw>Hn?xl|okm2=6yS~4xs;zCjLmkx}_z5C?PbYn+Cy(>K@?i>Y#~9OC2?PgiCNx8k zO4#G-Q(3KV@oC)46|M$#V~oU$8nc^#Ct#v3S?!xlgxpkm9)1LmI&`ub8ih*FL2-Ou zA0QDhmS-7WT_glKmK6*a0p9t1y=`NoS?4qX2{uqT@e;)|4*`#7W)-Y2gir|i8J={0 zevao%R2fB01gEf^*AN1U2>7#U-{^EW7PTO$JDZ4CK(_F^?{xzo03aDx>b!}p)$Sd2 zPrq(y$}@LA7>3T6Z=vTE+zkJH3;^;Q6*v$##zR&RN~JO05RE|8Z4F&(TFcldcf++a znGl=GAT#{ag7tE1WDKthuM3g!L;-l{)VmE{YkVC#@iV+l3V)@fn$38} z#-TOfVd?F9oxC#%F;O!vGu|w39*FUkyeCAR(bhh{GUKvar(*HXCH`IpUGUVO7`(Cx zm0r-;JGJHg2xrm!;wajza=3hU9uADKBJxXJzu7-Uhm&+ zyID6@uR^5lm(X$e1U$JPtV0WT9dcNmo8c1Sg1zfUm#s=Vp0vbjjoJ=%J+-;7=&Y4u zwf`yvX=N;jW-E7$jU(h#2qvG);^`{rOf1fm>&de|S-sjUEvjDrD%sglk^ZbY$0;Df z%IXw#{`79a2DG(Lk~6z6cR&>^RQmZmOOs!iW-`#x$wsB)q#RR63x`Rj z(H9HdPXd}9|1oQ6q{!0-mXnWmmz|wms|>0{Dsn}?Nt+PI76O-TAuT~BWnocHA!+t1 zVR!!7&*Y}78*{bkBb0K}fMp(MhpG^U3;~B_bU2LnVBa-S*KHqP>K=qX3PZ1}1pAVY zd+t5vC_qAJn+G;10?dpt>_?MFiYYP}&NeaFx_nY`kpfV6u5m?9n}qfGb`^1dT; z*iuphR3ZB!&1RdO3nH8xzr{3G4xd*tI%bBJv{R#e7K`@i1r;a8;SI1UC@ZJ^mZev4 z{KxZEGdwPb_htfK<+54LlhMR{PtoG(nLyIrtEJAc=2A&P3WY+h=d&rI|JEp4oD+LQ z_stNqo|zXxTB`P+EtAbw(+qXIpN?m^WXv~O6Jd>+r9yo(`K)6y6lq#*WOn7H=;^Mz zeO3aQKU>ewX=rI_QxKhFaCLmx8qm?v8AfI!&#;Av;HO#C?901vy2mVLv#dVJkq36P z4tn*Ctb5p*CIkMQjv$VFF6|HHQ-+Vt)3;@{of4XCe>8~toJ4oFeIrQ5l@IPnT0eUv9gOtxn zQQw08I`^Z;F{036A00x@kVSV@pC|iQ70M(uY6 zt<+9Nv*}3q_?d!75u3d1wO2ye>T}&aCqd;-=!gRrA3?IQu_3@zYj^m~L+3(`FPsSR zF;gF4Uf=r_UaQj!Ack2hYC}vVY%o0E83R);pUJflKa9S#Ef~-2B%9P56mJ1yHBfM|3u{5a|PKI zF)dvEJ&|&SyZfgce+7(+p56@;PvA&1qt9CIITjfEnxq$Lv|QhEG$a3Sik)`<2qme? z`+%a~WY$~y+XKDqiadu<#U4XaM+qneZPG*yMZF# zUFhB!vF_I_jKkmBDv$MBcH%M|>?qa(bfiuRhoG z$6kSAzmcDrZCtZx|H|2#i^55q+krIs2?G05-$2Tc#8OyC-}Xm`{b($4hWt;#~Em=?lkAhpbAh_{A9DCb^AoLc*c34Yz8z_(zAi4h_J&8g=OushRXp^ z$TS${$DLUWBrv;|!tMRM#ye=u05Frbn~Q$!C25OFTBuPHA1_qs4pzzU zt*xy9ntZ*3KB+BB<=02O`*};aUWl;ZzqiXbc86W?*OS4CQpBZj7>|En#{ydB{yZ7# zI!Q;F8e7~Sp^@k<^IJb!enhI_*D*yJh$;kLZ&OJS(IWfi7fBIblYfU_FT02no4-{l z(#W*iO=;-1nv|v8P-nQxXOw4~2)+&=US4DM5EL{K5- z>r)&(AoTx`d|_a=03Yl}^xKDBWN7D#iytSiy{CxzM1`lxWwKD;R&#yyEtF&OksbAHz@?l1f=R5xT}kZ2@f z!o9f&ObtIh_=r5Q64`#T`i|6kOR8`zb8-z~VvM@hi7cu3MRj;&Txs-U_0Y(dyVDY|{fk;lhm{@#E@9)4-`RE)~IzWUG+-Fy5Wp^|X-Ur%_T1wL9AMj9-Wl4I`rm zXx79u8D3!zN+z#-V}hAgyAq>cPwpbRX#r$3)23V0&MXyNEO`HZFTB7*X0Iy{CP9Pg zKrnb+K9NAk4r-V;@eW?4a3&agL^TZ<9KvvO8Gn{dO7fEqg=Gkjole#rM{3b6YYXX>KF#$RKv z14vBhpjd*1K}J#Dh;F3Z6qZJP?<@5@$3xa*FLBmnY;p!~>rSTp)RYG2#N1 z-D-XC&*RsmZAyJo6@eOiz4sMbGcLzV($ps*E8Q#Q9HFE@@n8Vx zF~*}1XJaOrj(v;?aJ&8sX%ppN#1MN{BpT7V;4X3o`-_-JTNAZY-fQ177GgmnE+eLX zJcI?Tl}gNM>UX;C{XOk-wc(daO2bY-#4MT7z;7vso^|8kfpt%Q$2VhC#~T@|gcAeL z0b*M8`2r{##6`1My-c}V)odXs;wDZvjEZNeGYu0LP96}B!KaX_ioLF&O8ZRSc3Dx# zn(!nr<~gVsNE4>pY3BybL^K2AEkX~kGaky)Yj`ItU$$>vg*)&SUT@dwmEQ{3sx8QH zQC*uAd~sH+#eh+`BXDw3eMm=#7=p3}?&Kr@vc@bd3QYJrrSp(m0U>3=Tsxii zrR_iTVR#k-Mmv-x_!bE!<~~I}e?#3BGu4Sj&P7X-eYr9g*!a^e1az5Q{&Z1RV20DD zXO{>@429c)_RY$J1&bU!?2?Fe*GmbWRU(48reS#^q632tyGVq?A}0gA!#=*7D2z%Z zr{j`P!8sGc1-Uc+>9i+~Ejp!H<2V6qdXo`eq!1~2_A7TkJmYSbC>b?QH_C@74a*FG z16b+w_D8Ir9b-7+1sN=g?vgYSl!I+{W!Uq$@5crORE>6NMm0jA2__c(oCv zggHUzx=e?qyyL$|ID%F=Dj=!Et~psTYd{w*%va?q@_OBITSovUV`IY0T~bh=du2xz z6y)70h_6y@*^4FFFh)sa#D}2`*~z8MpvIDO+s)LB)Nj`7Lfr;HP_j?aWFw)F4>`#< z%1h0XBR6&_L9}hLH0muskDl>2@xOADf*_QGu(8zI$8~?TzPbhpqA{I`d6E2obiHGE zWlh^H8m!ppSRFenPCB-Yj-8He+crB+r(@f;ZQFLT^Ss|V`#NX8&%Ul&Ki2#)XU)5+ z#;BTA_ZZ^Yo;R4CS3#LTHmmM($mD!P)~?CUH@*_FPu2n6>n1sK$&yA2?;a;7!XtFk z`T6Us)sWw4sSw>=Jo@Hg^M4i2*CSgz779s5r#J|TKg7E@W{)*sr9<>UWVh{}AAMfg z7rmF5J`dx>@?hpRI93MU)6jt~dTNLcW$L1&{s`isA;Av%o&z91_2=kumN%vz+&y;6 zr3ME0`}!L_ex_L^w?c-=ki^vmdK>n*j`8A*U5=@iZ446nNLLQ>v_^z=UFzpx1>PHM z^fPoE4J@Q|Jc+bQ`9;#D12|qkFY{wsxFS#WQu+Igy5U1_+pbnO-`9O=Aq=k4m`$2r zVf?pV$5U{TAvaepK7{ZqG&)AC+uSNpTkUyBqJN+%u+(+@AO&JP&0xk2+}D@BPJLda z65<5+d>x4WcI1yqs#DsWg!L0@QHdhWH=r-)8VD1*^u61O;9dat1+>Phn5Vj%gAxI1)TowqfP_`N?;+)wu&&vs3`f_pcwF*rSgz!^fk3LZ8Iao)7WuGVC_$Y5YwtktSI8O*{{kRp^RD z9qZ?#tO-QhQJ_Mn6b`b6kQ}U4PKOsxMmF{C)j0d6V_Z62I;!XE$zsO>iVWhrP-vX$ zm@xleP9>9Hlrfr8OMPpehgv$W^RCmB_L4Ju$2EF z{?K>_2%nX3{sVsYDMrJCK zL-vM>1blXDjM=MHIBk9CsR|mz>fbNMKyipfb_#f)F(6E*=Dn&QE|g#yK90eb;XdC9 zKXMI;fltCa9aJk*m+G~@vJKT-R0!Qx04A|(Wk+98CLQI8u(*8hDF~~BvkKZSAuFDa z?Fbb@V?-y15};dArCJ3XM^%|8H13b;zQjuiJ{RkcaR%cKZ4kR5@#0g$8)MddLbcw!>mb%K}#tGDn zlLa0ju#eT_CPhRZ`on-~JuUjYZ%%|_`C$1m4CTrRA^-sc^wc;e4u=~@qU6op;B#(@ zY<71JNRdNBu489S>`rKzSbysSpEk_Ugux%#*s`bfB79+XPAOy58iFG?wx4?~yDmU0 z8uVG}kin(-j-_&N@w#22r){`#rf55^eis@%dF1N8)n{T(9J&--h<0;;ady!I#(m5D z=z%-i5Ypg=6jJ83CxquPGO3}aSg8qpta_k5pi7K8&XPVbxe5L>K%X?!qO3$4F4($A zdBT~xAEp^%1e+?vn2y08Tdt^G2c|m)w^Oop62}viA(J8 zTLB6BYdI)H94Jg3v&ptL6-fQpO%sOv{`-@Rwgrb_Vk?}P-f5Q##-!@{M2!4(5aj$M zpoO6)zZ?I4YJWTGDQyL_nuh(_p|Sh!KS_u_4(qK;J`fn&g~8RS8{{ux`JR;Y+c*Fc z>884mvhPoKJ?y&Ot(`8swBEsxKiKDcYR_BbxQD+>lhyIhPH(dYyI%6ug^TMQQEBJ} zd)cHx8ZL?v(><4!FObg$@i@Yfo_r=8GTZhCq{v3%qXeZ*S{B${7Y0yqA%GlqyP}g~ zz{~7Nr-Dc$Vu1`G1Pl`Sp~dn4RR#ka^GwAIMnr@CwcYPhfzTP^Y-ina5tc6W5-7M= zecQafRM%-3j2{9k}09 z_xU#YxtD918l9Qe!x&T}1=$Qms(3m5yS;qn1!QsvOC+4JKs|2aeRG zjekW;YuaIVc4JC56Bh-NY6#x&Hf2g}f@0@D(=n{d70|;-ip87`mVh6dzDkS-oh%fj zfC>LX@mzInpA#(}($@-hNA!;N77`A41?BU1H0cILc*YTbLBSU9m4XIm6l|e91Nis| zy2&pIW#{iV^IWi5M-ka6O?*998cA6dbi<<2^zs$%wW$|YrCd%kIFD!bMLw^ZA&^Mi zww)e=dZ|xf=sAHfVtdMr;oVHirjVy69wm3LEi8 zF5xfT{CDHEeWb+?(p&tD6gW0~Rr1XU9Hau4VOb!>qme-GxCVZ24WmvZlsvPk5ddx~ zma#>^ZJi%;fZ0^)L7+S7wN&?WrS`?wVq@XdVTe^p^-kN zc>#W__0-GAH`p|0KWKve1Io?Z-_>Sl0SFFI16Lj;*2(66LTK7eNOj#?h6afEY;!-S zK`z!wv0e1v0nC7{|2 z?$NJW-)IIpl;{>)!xnyR@&RQvF+WNmitUyMnpJ(NG5sCJubDs*Y5X+z5edkKFD~Mu^-{krUrxq}VYd}bbiyJ!hQevrDB zl9F-u`}`U&5ga7ufAejwiv&%twwo_ zu}^6Baddo;)ac3&97|qY#5u|7rMN~*M64R6s|@``p!15H*5?rabzDh~6a414d-%XN zH*@;cu4)-=b(ux8`6q=Jq^c)opSS#0FuU!Ug`Icl_(J;Wm&ez76jqY;_;N=()~FO4Zru_Faf^!>Wst%1_(0$8W=w!F8S92W zsU2HD@)2qdfOk3LaMMU^Ue~#IrP;8EbP>h`OEm=<)Yv}2L|-e}*z0w5GnzbiMRHgk z|EZF(CGO>~0~R<{Ifbn24d3W(4SJjZLgS`W>+Zovx|$W;iRRYEtz(VM>(TFdqcrk> z>OUo_kJR<`s8|KewtQyEj-zeX_|DEy(`ClN+6D@o1=3P|6^IGH{99NX|LrJ%<3hhP~wt_)sStg;!sf&s(A z?C5@S8>;nb%5VcEI&C0lY862QO+Wlt_~lo6|K#ykdGNYdE)Kf7wot3OFeK4qXK2Ae zMvCNN;j^wtpbh*H62`^`D9hO%`jvNU&~gg?Msef*JH|i9M3YDb53qPvg9^#*iRh_E zugLc%C3IpBlfdSmjpuy^9^Q%zjpBp^qF2f8G~-8`vA2|{P8mU!aJ`iRX(_If$a>H}$g}wfgbXD_$({(G{PfPUu_4Obe{G9B@?6GOYigt?$*m4H zGN%#;8-V`m|A77ZdbSApAo$+Pp9@4;+TF4FCThaZ2r0pBBY%e)1h*?UA5Y%1i61X1 z40)3C!dr+Rw$uP}KYA}C87r4?4MAeK1po8Ox2NkW4>1zg)*vkv$_lKvwV(da#4M@g zY|Ge@XJ_5uM~*%)mYJ-45c(4%LO;3vI{5*2E&op2YK_utfChcdc#3{cI9pM6R6-^c z#D)XOeTMMrt{l#$_PQUfPQ<3;)hEt7MMI5xV1zPo!Jo@og^Q^@s!RM~*U+Hm&o#cj zhiM2T@g^W3Wq2424$R^^{xW;?qFq*>uPA+%mSuHMDueJgZ&%mGFLTpbGQ(27otz

jQ1gRQCu6u2~DoXj@>RjeXVox6AYxa-#MM;<^l7`V;Nm&50Y1VN0-68afsfxY*% z+4JlwZyR)-*9C3KrBxt<%OH{-nqVbvb zb5wHFG9Z2i+2HI30-S`~e=zJ}mUjT)Dx4L*YiCB&fFKG^^f&gbNo$wF{K&$l{R%uJ2rxBXuf$jwl^lgg+-(r3~ta)!HBP<1qa+kNu z_jDQh*3<*1sHC#U^bq93xii4%WP`!0Jy5&nE)$4L=p@jh`cc85gh7iut=6JxklWg< zZdEr$qq=aaQ2&b8U^}CzXE1i>)57qA0WDczS2j98ubXe+|FWpmV9yq+1;>pu|j^5A!*aG%bamP!(ZG>0$Wf3*y)kt`s6wj#ds+@ zk#rs=356kd1H4xzyXbpd(gtA64>~dAdNxmg83HlBs^nR$;av#8u}4V9&8W9{&!9I3 zvMf+7-Rv`XO%u57d8{DnrMGTl6=Y==`>E@nT>5;zKETmIfu9E8UUwq?bmjaya}tcP zkw&9V{3EoPEXdGMG=le;-YMFjC*fk-V6w60l#9dgwh5sC&aGRfSZ2l(C7{No_F+sR z4@q6q>j(egez_oR-Rej<;?0B$|?}%t>GA&+%!(Pj7Ot0`_-#Q2i*4zeQd&4-O)u&yJ`tHd%a1`LBKIIazaZ&5_()vOwUkw%i*5jM zOTQ$}mlrx#K%uO_tgjf%5WKlZWalB>V;<$XtEvjE~i z>gAebz0m@R1g_#$xQvD0*s*xXf*moYG`@%Ed4q#8uY%t}%~tNroM+$MX3!;HD!GoI zseRlp)$pBC`AT%)IBUcdctGAV`?tr_oWlR(PAvYH{u& z$9HZ8ugYzy!Q>YIDpxd~xe<4zOW%lNO-+QFu`<r_=!`D0( z!;0L05}vY02c|N51WSn!Gy}EAgzeGg)37H}@BZ~J%uqJXzy0}jCIg4DTdZPOS_XvQ@MU&|lr+4BF6hJ{&*X+F5 zLM};sO$YBIv}})3VA6!PkL$&6Go>qjfUfh?M4JB14K^KmdHq>hN8qbNC6Ine?JZh* zt5Lp3E$Ff>#90^S$6#Z?4MAx9Ks9Ld@%cWM6N@ho*AMeNGJ8|sw z-vYP|BB3D#TwkONuv9%wb*nHH+O6V3V!MFBfrAT}`>YJ00W zRx5v}9w4o-Dy$5;>oYqAi(}g;;b$oKbuiH*@7hqdU;sfJSROzY`QW6BT)$kax}fzd z{UZr~!UCa*RG!gwuE3|bgI3bQl#aH(rPz4oX<_WjTm;OUi7q9`5*yOMIC$X-cU|MT z-*NSbbTF3Z^fb3+oNS?)Im&BMBVc7yfMCR_0F&OTPH13kx%;CeKYv1&9zmoR#&!G$ z@K4p$;IXt}z`$i7YGz)d>Wc7YYGN&^w7vb^8a50$(+l*>^hK8GYS2_$tHXpJ@oza; z=EUeYuB)+GpSxJ97`}kf+5emi0il5oJx?n=Crr1}&uKl(}yX5dQKEPAZhU zmsM=kA@=F(*~RG7cNPepHMsmmql6H zQ2B9{QLBlA(_V*Mn+g-P4H}`$slDy=_u6~T=?O`$hreA`wB4&Y5%0J?pJK%XhD-X& zU-;&ExfLT3VsbuS7CSD`kQOf{eZIT`f_7lIi-PT1(^FsDBJt%oAmPp01fE-gh%{09 zKa{OXYK|cPz+crV#uxd5?YpbsaU5+MR`jp-cm%E!4`ZAl0bo8Z`AMq5JXFdV7KCv z(9@+PI`38@S!xUM#g(v*WPHrdy{uLndt?Hoj|(2-rP{M#Za_Jcl!jwyOolT!<5!06 z6p0P68WN?1@-G_Bi^mez+2cT_{XUMa%l751>xlHnsF`O`EOMRmQ2xZdj$~+h)~gkm#KAmGF)p6sDP?@Eoc&F&;&Kxh*bTw zcxol{vX#^zkV?B`tzr=Z{#Bqpwc?~=Xvv$<)h1H@2_+GOaH&qLNf8E?so{u~8r37& z_O^rT5oJarq!JgDPV)|VBEDha^0LZ07kM6-%ikreZkm_FQ|C!N$rsb-SF9C}kyckw zK?H*m<`3jj6sLm91erEsr|=b};sfXqT?e*HD{1cw)xJSdS5TXEgMf2E!^QTD8iDg( z8`yUi%x~8Zny(|eT{N3`sXQIt&#^`h2?`)v0+N%;RZ#iJrg6l_uXlErbNDkls-Hl_ z1#y>n&kyCe_2u3V7AqJzkbYi@)%RPf0s@L>THzFY8*C^mE2K3dk940 zuZ)09OSBOHuM=YUjz^Q!s?>=WH=Ycv(h8xc)U9Ylt(jo>xjo{bhS91m&F2?-0Md!a z2TOf47)j3zVcE&)2XR6@w?O6-M6>;`7EBH5A-&iw+Nd#$@UR4G>AeUec^};tcGTMX ze(*gF%V`Yv8R!Q3X$)%C379otwP7vUw7*BUm%m{)1b}zgPVC0;9B7inp2=;ZY5S}8 z_P?wadDCE;HIL7}t7kOxt7Xu!M4RojSI`lDyo>SKA2FIdSh53C%$^Cr!aeODh%+nt zNyZ}iECvt(!Eve8W7Y)}-(3l6dVie;Zu@=bM|~T&D%Y?ranNL5{YiQ1kRp-*Sq2$^ z3To`nUp=eg=ODS%p(wi8(f*1jwfnp^Tqn*)zA~={eZGUZUTad>P6sKnf13`}_vZ`u z2&f@Z{|oO>+ZHZTHx-3&>qbmZKs@K6*CYIZlCHpz0FC8enw06RQ-|_MOTUh5(>Cn= z`O5dS0p#Y5Nz}to0_VFHy{65ij^gy_e`0EUa7SBSkSagTBXw?q3EYMV*ggCO;tMWD zjp#udTW@`)AD4m0(+hwMQt1ArV73_af?6zcGOO+$SGvQ6BXM$zCuFaNNF`zMzT%_+ z6i0)$fu9NPhN+xtDBb_9g{x>{7gpWhJ@f{~4(m4X<_`h)c8pMl#$60EYR{zz5xeAh zaID=leHC~Y7y>2GTf+k1$yl9gb2*xfT{$vz@AXvYhiIX+ypF+6^hB7S0ybNFC|-({ zG5P%b{L#lkE}`~q4lUu@V35^zMMN7D=R!0vw6CGJO^*YbMZPuo7vh*Q&^QM*(VlxZ zS_N~f$@@KjemkvE9JOqrM^Kdocu|25K0 z2}y~@&}fVpt>Zk1mXf0kP4Qsi3jLI&7xGue{%AxLT^~Lgbq{p6f7x3)_?w!-k)uR} zf&)lZ{YdmO*W!VX?qW*X|{cclZ(r#=j)lm9r-D}n{H6Fi?FMI9- zIi-UECONT!fwR}PS6otAYCix<31s3EmVqH8#pelu7X8p$vTQc`vD09I$8H87(x`7u z)AiSMO)b2$G?oCpZ(}_U6mF2Dn#x@q`>@Y^uWt_S3lq`N?+AW$v{%Nnc=kEhe*xRm zXzc;Pk(lzP8Ep(CbG#T4p6|GuSJj5=#J0OKZsKZmyQSk~ak^6j8Qi14MLN9-ys&rW zMuI702TvL_ZIm>w)1&Q9!kl%bf2WKuZU2G~WNy4-D^&QT6#q`j@47@Gm7gbIVRAOa zzGIF%7OgM>*k)e*IwI}fbYPw`bBEa%<0tJ7q8`JK+903=|n<5D#769 zRBXkt{{2W{i$wrjWmE@*FQgp7lxn87q-8|OzI*BG2(}X;yL@?3ol*`}RdixVe!4RE zq*wCWDbO@PF@}cqI?L-oooB<{lI6I-ZsG6w*Aje}xnT)hj^-3~T)2SKvdPU@jA*Bo z)bF!aJei26!ZH5?^#W;^Xj*TqOIX0S3msH7sKcHB%+Eo;!MDBlI?G$kHxSb*r#u(` zjes1ByQf-yXLbDYCpc1^oNz2nkW8yWfcV0bXvl!BM<)v`fP`HOAB(#!WYaC=!tVj^ z@+9-=)?>%P6IbvZXl;sl>DS$RJ+bJ>OE7U-?g9YI!f6nZ{q8wZaywC5-H3CW;+}00 zx&BH5hm`Ot_aPM@8B&X7`BxlrS5iD;gQB~h>w`=YWPqHJ0V87h6Wphn&l;$6zWt7O7yl7!t} zXK&l~tulnrvN{Jw1RjvgHdo68?4^oIbYQ1#>K^>|GlLGhfi7gBAh{I}d^Uc&m1}$@ zif#hkXoh}(j~P>w#86A_VjPZb8b%!}&arR{F#9!q|D(HaMTtPY;(TevAk%;tAk8ZB zj0jWPw=Kk_(Kk(y`E9D!HnNE{1g-ZOSYU!sE`YYD1L_a0T@-fWjWyqxSOPiJ3JWN~ zDcEo-_=K+T!5_AYe>)XlCpWXjFIJFMukE5D;cU}V%K8q|=xJyi+G(W@)dfFnlvEJL z4K{o66Dx7g<|idsWqPbrJ`$QIO+Jc5tAa=_iNok^&fVqQhormwQ%cH6Kx0^^ZJI*c zxH!Gj9tH)~p8o-{tXg|-t%cbYQw34$qyLhz8LRbVX7cL3*twZ%!41HYq;t$C8DnIV z;)ip@H-*rZ{HVZDP8u?71c>V2JM3u~f{e{0A z{UwyL_L60@H8Jm+W7zz$G2h*j5bee$hz&9(lg@dHG@bLvvh#T|)2DQP19-crM?XEK z!Y9Mj2SNpGMr^ODhN;9#(a{AMaphxzbwKZtMoZ{dNTGyS!5rWzFd^mIe7{E%f3Q_a zp=Il(K4J(v;*T#WcEA7-3Cvh{S||}a;w!E}hYkh;`Z-VnFGD%Ac;pTk1}e92Z?;zx zt{<~~utyZkUCuEHvA3x_Y2gX}mUj^ni&2H6eW&82>%8*JcZa*au35|LUrl+LoQh%?eX`UpbO$j<;C*4dPl*NwSvSF*(L8OpJ z)A!gr^{^&?YzUf&;8_UoA6pg9Ig*2g0h6pL3txoipY8mJSIyDwfC#R%*S<#Z5~X@)X=uv_3>q290`h0<~v{0^}<58+3o%} zbsnK0Pm8WqgRVu)zx|J+kS_jPy3)LcHJ0anc|ru(Un4fxQWpJNQW+JTL)n8dD38UohcmOm+V?7EY1Srb|?TPKm##s9v;lHUo%`rGK$zGRo<-U@@ zB3fh>(+mL-f6Ncs&k)1RKj1Fuw7ZYCz^*p z*TeAf?3A%hUPeSIu;8snpYSTPi>lTQhQ@q;Y3Tj8HqL9W@`m`AHcsf5BFO&%Xw3hJ zt$hJnbO!KCRDk9lKlT#MVW^nWhykO1Tzh_<*LRVlTf;L}M)2kV9}U{f>}TK}7+S{j z+obESz57`S^o=;|(Ijbk;C(NTVG{#JLFMhh6X8Dx07!B^^H{!JB zws$O%$=Hg1)!-Ar@i408Vncw7(7_X&&b`1kG_oreq?fWIySd-*5&~1UF935dc;=Yl z%hZe{3G(`~ZJ|0zP~8=8cSL;${7jcnTcaWohw&LFfHT-YatG6sk^C5d)5-EXX3&7& zzVQkqu4+LQPF$B!GstC96;_v0fcb%i&Hj*3+MYn5dzO(~4-|UqOf3i}03;ZnbF!8B zs!^IbR8)SWADGc&wD~?5lgSaD_g*p6-DUr*>mkXId*&;&$9|33FY-Lt*F|VcjA&Pn zMZ7)9qe%urcn335pEE=pK`sMV_ynx|3pW zwe$w!_MTI|rV(xW=!lMrxc`=1j>ZeW`BnJm6L^26m<1P$LMRcJa~WwgM%1RhdjQA2 zAlD>j<^5keH2=t1oU(Nr{v-c6hWKB-j_E(WF2%|wp96VtGuv?!^qLm}6&k>*UGH|J zQX)I;{OGigMUmrgwY(=$^nStKz&MQGs-50piZwPi=@T;u-u`Z1CTSuUNQ?Emr90~K zN1#FSH%Bg~P9IG~)WtZ~JZx%gGNni1g4g|vNj_^Nvn&{>ykco2Jh}C@3bzwC)WZV7 zn?KZ5dhu2#xMS2YR%{UD8-8J9xG#Q{bo5x{iapBA!e0(@2#AEQ(@cJd$Ys8{Ar7SG z_T0?=NJ7LmJ7n5ZSFp%swpfk|`AGQ#S&H+ZK|lTYRYK6U#a@PY1{ULjwG}<_&F09+ z7UO>GD?7nu+6iuN2ZzDV+tM`X1of>(BY})5XqQFQ{FUpv8^j2JeQ^#V4mF3Fr+fu| zf1pl|vrklq&1m5gm?ig~8lX8Y4zrMaVsQ27Dg7c) zU}NmNN5s<4!h5c(oI|^36_4}`_M>HfTD>LENXFykD>@Q0ECSwa`F<*Q0)$b<);x}W&T4^4-UlB>Ob`j);LtKe zw-S2QzQ$~tRk3d8H)$GPF^?bYxdAVzPavgKpQ9vHd=v*{VtDRKL9<14#$e@A@__y` zex4uhP;(5Hr7fljc=+?sYg|wE+d$MmcrbT>Z)hsU^u!X%7+hJ092f;S8<%GR^lb@a&J&Vw+*8Fy``FPc0z2B~ick{^J(OkFJE2EH zZQENlEAOZHST!;PnD5X)-`mcnB>#2~d!qMA;Zu(pC6)sWapjiD@-%58r@9|gM1StC zurLGNG^T2D`i5cEeZZ?q%R?62t?3H;=hfv<`Z>{lRNj(mjbYf``WgkvKANThx-Ban zLyD@Prf%@>zheQmDe-#Pw$NNfx;Y4_%|^^>zc=Y%EhTDH)K-JqOS~G}dVS6V$@Obvqbg}4+{Ng0d zSd&7$(f1>ty`219R%eiRP$n^<1LiuF*7VaLkH=AeZ?5G^!mq=-hP>1JFN@z9&!-fZB( z&)Pb2nZL#!dz9Fn=sxM*UFd#I%Kw|?Cf+CD{)^@Q(G54Y|2LKs8uAnQPUDoX++5nS z3U!5pR@M)-JaK%^h5R3uv-RtK@cc00CUAT9L=AG$8?YxsLyz>@W0X)C*{2ui++fRx zc3VJ6ix-qg&S9=Sa=X7Dy}>e>aMh!;@|_&t!&*6R|CWXN1ZwHfUkdC&yRBZf3a=)Hn#I&c3K%luZ z0ouy0?B>x@D)>{5$k578;g@p#i$J zz5b~&?F67|XoH(>-Rsz?A8p;p^n8$%V5Kwyfye8C5E#_PBB^ZXNjdFtc2;~XD=9O( z5nk&o7=L0uF%#C)nC+ZI%{lig}lZY2ZLLy2nL?CRrBxV(E+` z2}R|mf4w89w9DUVFSq_BJc`zOmuw^It_8wB4{?mn?U(}OG z#Gg%)^B1xXogGiUWhwhwzG~;c&aDXIPq5J-KtRO4)Jy*N-0FXN-G5lFE=B4e!6x5- z1e*Zb7?fK_`t6owwXwR(Ah>05O|2mfP@;L3Z1I$_j%Rg8K9}+ZMidj|;j;(GVZGaf z*b_o`gL19J>=%r?fypGZoV7CGDKIh;%{XbD^oQ+3EKU5z;r1FkanHWZ&&O|v*}T>v zX?l=l^v|}MWF!uB!mM?)S!H&9PwE1wqMYM>>Vj|)zpy2$>I-S>wN|T78^fmo4v3mE z@@_Fr#dgDAX5z-Ca1mrvwehS5V3!Z@hvUebIBL_3Lp-1Wf|d!!lFwhtdJ?74{2LNP zRVSf)*`n?P&08$-9@4OKB=<2A(`E(vj?~d;nW{~J!;v*$FjzH7Dn!nW#qJ;#u|$oe z6g!})&Qp5GRF|?<(5m%;dD$Il$Qlqbb{lfIu=r`Xs)+Y5I;}eCyvnEd`Rd&*PnF5i zW;Il{ROXX(!44d78aJ%PE3gc*h248Ceruh3eO__w?yDomYV>^Oa!O8#9(tI!_s^Kk zHE+gwhAyF@!gVw)saLL(1My%rww>1!Vh*-VvV)K_AZsN2v0Kpyo%+J*`ed)LNq95W zEI85O;d`;~-9PYOmy`?PEfLRz@5z#b$Z`ge| z>S9P^G16$&1nRe!3#OL@Jv#%7mU;M7ym(g9Ld;{`F(lDCnmP9m{-DpVk7QVZ2uzU3 zvIPd@G7<;tTZY69zYU%du|Mbi^>EnwT3SjHalLrQ)86)iw=&;tyv99A{;Ej6xWPYm zIN!-cWws-nZ)*eNM;5^vIyT9gwyMpIiDM2Y2&dXhdL0 z!;mBMX|WkDZbKWc4*}-?+}?fIqpqRXz&2@hyh>wCKqY zaDbTm#{GfSHf-ak=FRO1-Dp&6k&9INIX z%3torH|AlYt1_U}k4V1HxP=n`og3@j!*A{YN}U3RnKB#q>;gQN%ey8$8DIaqdHd$N z5Ya<<5w&Y~gqZ1f+CRb9;z&e&Lb-YyoT8pauf~HE07D0{q-sHN(kWXmoKlGSa-pC; zf<6;IpI>)Xq=41BaVDW548EBCcPo1v7!XW&%a&tE$2<4}WZ2Zd~{d$H zbO+sOKxaQq)2!LJi;bWp{Ss;(iN{E+&}Uq=ajKzn%(#OgitZSE@6$WxuDP=pV}?(A zM|eswppNE~M9O=Mevm0&cs(HIA+A+=P=NaZ$%TsQjy=5{l}!CxfLQB83K6I~lV{|cZRh?KWvUjTaY-vIib zuWfy)nl`I!=)Rj!XME7^RKTw3{$w&-C)nW>7XAPni3MIu4?WTq48gAtZiBKR?~nN5 ziAIZNI~=Wh-KfL8F^2;})R%mga0Wbj^!6IjmX~AobXtE{Mo0IDKJJ|t!Yrl4m4Ag! zp~jqv(Vih4@_pWUGi!-kcb_T3v(w@)(@-r>*$KDwK%kn4WZ6?631$`6*&Z3h6)i2x zXK{9%HqYbkvh)jfDH>pB4Z3PQ@KH$3rSo6o)ud%pq+%Vha-hHv&hR zJDeix_w=6b1Tq#oc4;3!DyG-+juUWm^8tv`Qx&3YSuTaiRhoiNuvS$%8q&G7H$8Ak zf0n$@&9Wi5hxd+rcOMD-a|)JHQ?s_6>dRnCrOIjH>}p4i0Qr-3Z<~{Z09J9-D%EAr z`B}j&-SlTem*E`y2Sez>n_J!?0m|2k;TK+h&qsPaImADFE>W>;SK(p=S`7LDnv=al z0_Qy*3g0WSieJL<9H*IoaP*f_cH_qaS5356v+|*~PNL zeVcsk1`*SIYp_baw7bpq_#LZ}wKC*@73G57QDX_t7Lptk(prdTQxz2XPGr^lzdF|o zia}kxUl7_xa=>_auwPoQ;6ZJx-2^HyNditJRd|l&$4I^hYi2hR={Ps?OS8ZjMn|0I z%&i-3*F{-UgByJ7+5R5Bn^XQU+B5HtV2=P9d)bI$p1FsMbPl z0s&HgiSVyVX$9xc-wIRN@XAGtxJ-T1WJjpd6zu}+@JS2KNGfs6;g~c;DASc=uQD&3zVPs2Q{F{a3vl34Y!}=wj3UncMr-4@AV%sxEP-Rm z60zQ=`<2)n7Xw&q@acn|V|^}x=xeP08{)Nyr5eSFPylnAB`GFAWFo;9teG~V^X{xE za)QXP&CMKdqeIFNwAZ+$rBZxi%M=Z9fV9NhcyQf6S5vm>Q(f_A5p#C=@U--4LDBcu z0bju|(%3gOvcNt$jWX3V(sz#OFl%wL-wu+PDpgsU3Rxc3Nj{$y5KUtm`zqF{1(mjG zEJz7JhDv|&==APYt@sgEb z+tC~Cp56X;O=41(7bimnI=<($)veRJJ_Qn(7+Hs(pU zqK0h@UP4upRZzNMST-BAPB$O^O7_GNSyN?JG5?{$zW#k9qt9hRmq7)l=pW2{C(iBy z+~>mj=q~XbFzlDLx9a`{uh{%;%*CHZ0lR7uj996q5_~k6!94L_*erd}Zfe8Yw|Abxm@yq&Q;1Qbi{_cM^zMQfnFB0=<++xIXSW&a$3sJWiWr z%&32U9(&)lgqA&ElMG**j>+jvd;cr{l#nBKw0#BX`~NLi|Cz@BCs>h_)#1HBc*w2y zoJ+krcG(|^yP*k%ct&*R;Lw_O(uT`R9lJLVtd3^6y;1Q`orL$h*}DAm3k~e}4blgX4d69L=osO^p99LXHru zU($`~{}FQBh%9RV`h#vJBqT2(Bt-OOs`Sgu(ijAUGR{y>Pf?tfa!4OlPj6_Ph6>i+ zMKLrqQcRRA&pS&a2Sg1Ch55BY6fnZkbygnkDRw2TIT2Yf0*LMHP;GbZRj21ERS zhksK-F)$B?hX;FshkrdFO~FVKh|)J=`lUzI2L)09BY{LRy5;>9>VMO=0L%;e6@d{+dUL5Og4>7BW5 z|LoRw*54f%`<>?TdFXb~T>CiDcIoEB%w@NMHl0O<0t*uh@_#K$f&9`LM-r?O{On+l zmz$Whj~DB+$*(83+xcQQl&)@1@~^MMyMs5%%WwLRJ}-M=++Hurv)|qCj)i9u0`{-qF-@#p`EA#k<9 zWrL6TNw1sia5y>I>~OfpoeYOrclo86LA+vrU!tWXRb@8=4+(T6mr9n7CzGQejwhdA z00#pjRXLf9r&ghsDCezydVS5vC3q$Mm*;#vToXBT;L1T0kAk`wy35w>U<{kneJ?bV z!%a~(izC-7OYyWwE_;ESt{pTEeyP@dt)20b|eHN>Qszi=={=Y}jmjNwD zVKybEBWTcD-A$WdsZ$pb06DTP6tZ`<-D@w5&5Xi!aSAp$VYys0d|KH_zdRSuY$EGM z;^9o!x4yV+`$ozS_TQyLz*kgelVc*8V1HjK#ptj?yT)XaV7U@L?e*~-4U3g38Z8us zB-m&;Uc`QXgzPJ7$!%`8lCt##T+Wt*xZBD9eanBY=%InJn6K>dyG5kSDR<*z(KlMH zQ**go%q7>FOuCO=(Xt|<)A(ajz-Ow#exs+QQubKGMqb7HA%CF?~B%Ew->Mym6FjBd!HKp|$!hgqze-r#@&1!{o zwn#2zzvOB%Uo580?Jr(N7(lU5lC0i*Ft5V_gF@ZIlLMG z@xSQ$>W8elU~9z(q#LBWyGueEq`OP$?(P&MmG178?huqlN{~iCLb{u8^WOW@C-)EF z;hcT;o>^AX(HgYmSEr~Pp>4S&WcvWcI&TO~5;sPAx_lY}6=`dMYvAokRz zTKNnypE?cr>I-5~3ctsfVZ|#pyXBUR7vz6XD`ZK`Ds?BSjYLZ{YjQ8IuC%n&b|jwq z6+Ip_D7uQa=>> zllIccwE4m^Z}ct2I= zR}80tPn2wq>r!z1_FYukDst%V!X&1{$;!=du`I@OLySk$uli7Q$)AkU0ZCwKuh3Cj z@8I75`7Qp@c(&TeF}Tlf*Y&d4jt7z}8N-x7r}inaLR&hKL96Fipuv;p{*n*uVH;1F zuHR_w8kO+@ zFJSsRAMUM0_e$8{cqE@?rcIY>B!LYimC9j}KA)oV`Kid`{&+`PzJ2&+)6beueYY>#Xe)1MpZ*V zgK8Wkl5*wXfO#a1J4vEc+cTZVA#yLW;>oAb`~==3k)L5K;W20-67g&L-kfO&Bg+9m z(1ie1qFnIloRCinOO2KAiktSyc+epVjxYkz-!K&7!C*KHc@l8vRXtgI3ch=Yu7^XkwxL+tGy}h<9=qb(S|- z#%s64_2~auWBV(bVEkLv+ zQ&3$kEV@)3dSMdT;r1XHH4&$Lb_*tfoc*0ia^0JM1V;i@&%B<*D=d-V%Z27dHLZGG z><_GD`F=WD`(9h>(VOgi1x?xyvU2=XiHgke`T(WY7voPH7Ru6vKR;8*Gr*x!z-s+2 zbHQP|yS>%j0duv@91U=}g8~EBe^%%?p8S#9J4w85^W00-ZFUr|)a_s>w)9)=f#&tQ zZ)@0BHd`1lg0h&%kJE4WlpatnAXo~+|Mb)b*GvNsNF*o-rl-Y@X7CMw3@@-yd*S+$ z+~m)23Z)N#PfCoqY^L$2+mlwIvN)`(HD+o7NdQ)ujb$c)IjQ|6pQ$$>*lINJeYr$} z-sWo4HbojBLv4gr>QPF6qG*`RfPZpR2LsG#s!0@j=d$(WY9lJ#JE?;S)=nt9^%s ztk*JVX8U6@DT~2lGZf>p>W$cJ6N;td_n9P=Ic-K0e(@N>{`JM9*7Vf7Gy+$NjLM(o z^!^2mR0^93+0uv3C*S11Pyj=i_<~Nh$t4X;RqjU%@~n2NJ?v%3j!ZsGrq?e|##WbS zmc5Gx^N<@&=6_avaoy7fSvo3R)q{_A6{A?CvC{kD?n1lo=CE<4@yTeRP7Y4$s3Zid z+V5)P6>c$q7m8Rd4U^_5?`qEl~2PBGWXv?oMLV z3l=4I@GC77%e72qf8=~pDd5k3`c)ni6(13~YK`s9UgH;sH3>qUdOMY3KK){QBift$ zn^aPaQ1XZ?2vKnzEUZdcfYYyu0>}GXkCTKi{xF9`w!neTVKE_QzyEYLD}O{S8PQ0Q zq8X~J*f!*gy(Rn}9O?-ftQR1Yd`e^d<#oYd`qo3-r2qCX zFNVToF#en-mGrA(XxjN}bOeGWl>iFwR zlr}Sa!Nb(P1lu>>8ZI< z4Sg2xIswf;C(geQl;^8HTRPlL|(OXL$Soo(G7fAtw?`zwxv!33W$&Wkd!2Av@(&t*63^KCv|Y~ZR{H{h@!6fbg3FhN1gqq2|<&uAiP}j^>)mx?|KhIRvjas zI9!I(V72+|fwA}(nOqtN+B){BDI6?p>@^aeRK}R#X9ygI=ZPXO*9+L)#a4}P(S-Ce zNepq+3Yj=Rf?QG=v`XV6aacuG+NDXK$gt>#{Ew*LP|zSG)lCsAmRQgmr!VpRj@Rpa zcR~}_hF-0d!q?aLoDi0?5fZ>|HVWG_;rFn|T{YU8LT)B+lTNFgUk!1i6MkYVc8K{) zj7UYFA7=R_3J1Z6e+g;#8%$(O^S&G5)?SiTXKlQwsmnc|sWO;}_?umgeLU`&moJ;5 zOhxm;HkyF9&B2`jr@%o5>)B&0Jkv#2`CH zpFa(SAw|GY67x`T9J$GLRp%hs-jTb5@eOE!f+A5>fIAnSj>${^OKrPeft_+Sq15Sf z(@j6WjR6*1G=Sf2Kb@o4zyO($4|7N7riyISz-l8!D^CJwr1Xh* zFMH8uQ=d87BI9$(nvSJX7H96uO~}f9AbH6=$?HC;w4wPgTq&0V>-`Y@*3d9}>gG3s zaB+F#2ZP;N?dkJBjM`EFbhMjj5`-n8^4PEVpKgtda@ozTQ<8fMM#j*q$7lIohhxC% zyQuQw{0rsE(6W_O2;=lxT`gcnbQ*27_AZ;s$0Uh;C^Gomu!GZ8q`C$niHv%5?Ve}o z?)IJ^5=k8hp4!&5P=a<-3vC{?9G0_+fq{VxE{3{lR2r4K$D%Wp z%EgML8fh!O6e|u;D5}qMj@G^n0MTQ8f3cP5VEF?w7!OR>S0B6AX8d7k1}e;#S9UW;=az{lDfZMj4gE7;H775$1Ps0m)X z4p+FASF^Vj70G7M0a#NL$Tt=6&x86y+5-I*@HjUgj>76}=G6gweD^mfSXL#| z$P!El$Dr!Z77kipYWI?GH8GzDP(CrG)^xnug2seP{-3C^f&lUUR?Mq|MP#vDnPC%S zF`Uf00i?4;(~&e85XY=vBh$%4?W6KIUDwsAJbdqOw$KRpPKB6;DBk!NEr03Xjiyer zf*~zK zPNxmWp#GVFg#Q#@H6UF%lNgyUQTqh4vztY- zQZF$=INvw~lr$z5&sn($EPARS-)m`rQ;fK$OPJx3MGUXLm`s$YP&YfQh0@-&P6ECz zZW2fri1}Kcz%6yPTDH(cLc(a~>mEVOgwgt90Mn1mj{l*l%!1t%STg zGXE^GAh!jM=-{wen0192v79a&0@{%IkGfS} z$%G1->}$UV4GU{7B^J*qnkzXqv8O4An0yyKKWCPJ7gdFJLww)ISCWF-2zL<+9w6){ z0Np@aioO&?1Mz1eL34GsjE@7?N4nniejr^_Th0DNDKjTwM)&rgmwp44NwtC{G2-iU zGq^RLConR)asP=*j_&>U=mhVplhy?oH^4*fBfEeqRshZ~n?!+o^+%wn4>4egWRXiE zw-(C^Je4Q&Al7zMw`Vg31w(Gj9+;`GGfYO)wW#D%DF7pME5h9eA7F*zxh}o$iihV@a5_%E@`pyeOZ5BnTMQ^&oVoa!wR0kKtQTP50kz|0=-5e ztxC~E_SNr&H9R=?^f!R*8W*ym&-LA~9(FyqC^?3n-{9LkdNGLn?|XYE`ZGqQa@#G% z7s{p1ew&Av2qzT{i^$5#8p|{%;DOT&c_Y7Z_o3Rhb-hft*0UawfTfG>viRi_dq*?S ze=jnX=6YOPja|^`PbB3ti9$#z4yeQ!%r#iO`ek|>1(E9d3W=>kCrYDy8-Hj&R_PKZ zVm_3}aNjq@=W)Y0mw{Y?6X zwkXL+vHnqTBnBp7=X)mm3(bkd;*Sij13trSm1KyR4*b9WKWrGXJfC;B%;a$p>A3rY zALP)q%pZyLxk$D~PP6QW+!TQVHL**3Lwd17hnx2uMwLi@I1Z0_>{N*k_wE~p%UArI z^XwTR&@qT=|Ej!)9M5%dI1iTE=?%DS=o;;o&pC*Tu4R&0a%3OQG-y?eV^wY(-lHE< zL8%nUf!o{~rL#JG*6;6b8gM|+8qWvf#Do|YNo@;*S~DjQ@!z{}mJmPj)o|XDgdP{~ zn3|*Taoq1UE)NPl+~$eOeB+E`&|!f;#Oc0x$P2zFA zTk@!x!)Oa>94$V;zqDDZ8<^m;TWC@O%!6ioqM)`eQ#JaDTpmeg=%FwIve95}2tpKI zC(|C4LZ+@M$WV4|N1;r6HE8J7>;ZH2mNIYN_;Uq&octL81C^~g(}BRH&F8vfY>|;A z=tK7yQ~+7k)>fdC{O7~Gfs#P0u2VVz32>rOfjIA5rA+H%{u3DmkiT5U%Q_gcD^KFO zJ3FCT@XP)g&QEYy9`1wnO=j`>8nH_6o0Jrj$dE&v0f5WVpW8oVb?R>YQIjxBW1HE&V+r6KV?*^ zm3mbo2x+bSG4iSjs}ez5-Hew6V+^WkzW zM!DW{`hzdm-Hl`nk@R0K8*3GdC1*p`f54km7d@=zXtBrHj+(`CN4v=?_(2tkC_GB> zkJ$C)(W;SD&9{Q~J zh53osU`g=bh)gAn7d{zGpf3~&FF(nGK}iI~D9HvmKd_jWG0#e~0nk*x`3tf};-~`d zFX12~*Z)nx{aoy4jTS0Jg9d(gCZ))`=}&B1e(^44iIEbO!v0dVGJa0iqMPlh=33Qq z&GGHKrWbIRYyp;PWg+W7b*t?IY?OeIDy*cY_RW{{yAPwl9vsDaIoPQNs z@#PT$$|k4P&son)kj$nK)9&x@6A50zSKJ+aC;q>FTL1B)j>A#<-&miD+ z8U#gR(TI$#IUWEqiAfK^y;0Ht-PDa&E>|y|=Z%(BB0P%9TjPula6TbsG5d?q`e~R? zEXtueRAFbFL6g1k<9(CT9f$p?#UgSQJ8>q`=Bg2p9@1xP21oDu>J8-6c}SC(^x)0t zy?oTZsM2m9t;Hm&USFU6Jtl7-V)U>s#{4Jb`3pj1xh?MxJ0AvsT7QZg69?;BZVc`3RNdTzgO~t> z{J%>~_!Q3#sO@*AN>Cx7r~%QL%c5PFd4GiP zxd(?+*cZp=V|`SL70&UZ3Hdj9^>N71@SOwet1LZGrLry9!?_$*H+ zb`J{J>MBv!PhcMZAqcL2j9zXlaQ#n@v$)l30j3R3h7Tc)6nyj&$FniO@^>- zZUNs-sKZ8_{<*fITBWbIGgVP0snXJLbkO-Qm>-VeV)HrbsgsiOzrR0DE;&r#)a2uK zFfO{}`M1K}Z!L*pMH*@o+yQCqMzoFap3n2N_@_p<2s9x2AGO`beAI|D1e_nKdN2FB-$fsXd%9?`*XBOQ|rC8MPn2|NjN^Aw*y;P zi)%)|Um~vOo%}2^6ciicK-pr*s;b=-4jmSsnAN$x&(5A6zP2whJ_e zU!29M?vk_cWJNT!fxDo416XVbZUqeX;If)0iZZu3dK;lNyqPToDcH@9y$=zyVsAq z`CWIDx#DV^e4?5|@mk)i*hYPMht>#;|>^c625$vP7gEZ^PEDRxzFapYuhE6Q}%L}5i^-peQ zkqb%xMfWZOs8A|T(LQ5(52!wc*f%W~TSmwh=R0SRN`p?O&(sQuZXY}8fw1Oa+2-EV z3d-CKF`b>ADmOdztVA41RhpF^8h~l^RG7N$&0#4=Qh}gw4DRY`ozCRmMLakJ7~!n~ z0+w7FmrE&!<&@Nlv`h{4^EO!h7H4Ul$`Y%7H8pF*3%&B?78e=YV=L9pWi0v zp>G+w|BklFk_lOZ@Bft{`9t_C=A{$y0=Mw0pBTkAjFmy*)1Oosr9V+6`1?PzG1__M zm1#8v93@@ca0@LSDonaNZwBSKwn_*=?C3JYJZ}TFJIINJYWR}Y|^puy;sBmn*Zu;A)iLQ8Oa$z@X5)! z-zH^dfPLnY8b(9+m>}t9k>`U)E|qIm=_al0%DcN1ZIbbL6%oYxE?&}>w>n`iVw3IO z(Z3fNFBf{LN2kSjgdSc?Vo<)#uV3|&3?Zj_K8DINTpW%t&}86yG)zOVyU}{kF{xin zu#lb>=dS`e^oRbsLVWTN8;XR-SAPI#he(40s*rGhOOZNoNRa@MK@FvB45@7Y{I%IW z!JZM+o@%M;z^T2b+xNVg`!jrwSZD<7{!9U{Q_G18SNjfRLN>AMk{)5qzvx}T-$6*( z2-c1+gA4m?$y;`utIy-7&u;2D@ey4=O><>nJ7T5p*|(8+fco%EWXEDz^Nf{0o~O`$ zUMYzGA7jM|FO)m>o4Q!nETxNA3s&-3f{dF}0x%c2vTa^(4U+@M;Xamq(!~8_A0u6n zc#6wrevurxb06p>ms)4x!{^wqR;WIUvPqiGRGkhgJELWr*(Y>r*rQ6`@7QKOkBN@5 z1k?~=w9~3~PpMkM2?|XXC@|w5A?A;&$ik=qgrZAsn5^U!KR6Tm>vfsbDw+5rVNzEL z^K>T-SQ%WRPppb3{8YZVek39F87Zj^7To)(eXjc)K|$#Bb{5nxqDe7I}Z|EvHKRD~ePr)JK%j z&^@C^5*k=Y>&-4~e^pRvIK;rIB22)ndi>CVM009FP5YdhgoA3BvELffK!Et7nSD(6 zvb%nPX3(<biP@kbG?2;s`Fnw-sA_`QPN4;C!_#3-q zl}!J9+3SSbCPF&~_gIx?a~mc2Z6ELq@vl2dU*KOtY+V#In-B#aGtw6L&mxB`$Wn14 z$|d2X3?H^?uRYBBu?Svel+cxr)BP@D0s|wUT?u62;c&#CJ)FkA7IuSV#vHU?WPa7l z5V+_mPN6X(3%hVK6XoYPy{ri{edAD+(SP12%Eq66^eGUZUA!*L90yHOn<9%cQdS5B zp9!vi zo62Zds~Yl)??E;4@1z8U!IBOmUAoSIm8zen`kQ`QS5tOkzNGQetZns_S&# zR^BUI$nkkOkjhy`-BM>wT$Av;O<}o1d5Dab^{|H>^!08Ofm_LkhDRg1-vg0gnoTlf zcx5sr7tWQaQK{u?f3y41JDctoScvJctbId8YNnAqM0p{^J6(Cxn~iB6F)sx`oabC5NkFpythT9xpc2 znrFc9r{I^28lGt;W_t|V{KpS(elmd;(Eq*vBS6p44$AVlOR)+>2gDraJ8n&J zUp6n6{gP5a@sCm_J~k^M2&yA5)*lzL(i`yC1W1q@dK>nN1&$^ud?pbjNDcRYz*eym276D__REiXOBvnsuWxwWmULB4;z)=GLDkGS zqNV?;#aR*MJD8OR-5qozrM43FTkttWQ&?O@Z|lJzFyG_6+ZR+0({8G$%zFey6Lb{q z4tWwrj)lBa&$$27N%2wNRL*Fzn+<|6%Z!A_@q=pIXeA#<=Gpdpzzj%sHJ1s`;Q zzu=v97?&*}v|_8TdIwsv=5JS3r=q5By3LHd0nE zHWy6ndnpW0yBQ6Lu0@|h6kc_ugj}1fCZz}c@wv;+!Y>+I>m*1IW$fMAF6lBcucsJ- zILZ}SV8X{FrqHWCsXQvg2-utIz~OXG6(9kTcBKEMB_a6_`G89O}@{>hZfXMl&l#ZY*$8%MZ(&N8=2lp4x^OyW*@FTImM-!ce zlKyf;><>pe;Bg<=Uv3;re9t1XJ(R>GtzpvZUZqMqLXQz@7-0stqKERCXe0ip9f-Q{ zkr|liET6johBY4D{WW)^1Pa^6fc>bBkpsb$OlX-<_U5N-yGY95RE1-XP z#hjThpTU2QH;^`xlUzbKGs^zg{?(%^_x72c}3s;PJe54r8&3k>PHn6K0q6iit z=nb%9h_oy=8NKiK6r)d?DmSeLu5DewR?%*Y_Ol)v2-@Y`@Pj22nDHkRXV+Vq^cMPx z=kGi3uFJAf5&Br6UQdZVk4z~}j`-yeaR$56?ORG`s3{>ZTcuq;=n1b({zwKt_&=*O z0EX;D6t(dXxrbYfZuQ$aS*YaX?*cH}&j{oMObRh%_b2CTSRLI~+_uB^F+!ecscH$?{M6nuGI5QmeA*SlAFJAMTND=67q0MD zRiI#!Z6AvTLCGI>!#j)Xk{SMyBU%7tSx2D$6uYfp7h*I4oBE@f;l8Mi%fg@Q&R+2` z=F-5fq^cFk6K>BmG7Bu{8k&S;f!k@yL-NSO@~iT*gwaSaUkEcfMAX9prCY*sx}5d} z4B}zR$>f}5@EkP$f{;3z+RcLOTFyr$r(a)80)xBMW1&jf2z#EKD!D?q!^mbwPKCu5d=x3C3= zlUg=gZ^Uxs-MZ^v?2z6(s5Dxslybkg^l312r)m<5y03FoZTXjvy; z+^kzqCmyI(s=;qu=0UBpfkA!Cv<%Wg$ zMi`hk=x=;iOS8O1n00Q5L@ec@^ktrr<^sa?yiDPn=ic)lMuwn(JwpcUOvi|0KeK$! zQy7wk3|=Z*_aH(^eO8piQbEjs8bK78rG|rG__r5GUhE%_%owz;YpyjYVHC`{wQT8O z@x!(Y4wYK^KO#K+ks3l`%2-+zsy$)ISA$yDC?H*ZFR3PWpWhh1>d|om83;JFGhi)p zJAbh4ZW=M&v4`1`x4GbORxr5*?)R^d29Yz?K?PB?ebuSArL^g=B}c$!ipA%)4Ms%D zY&d8;iH?8BZd)HpQ}})L9pMUT;7l?akM?Y5<}(}yb?`4{V{!})Mc&sSc~Ds%=Kh6S z``&pOWQ7+1jOvy!a&Dp&A13i2E6vDXpMSK~Tys}M04IE$pIu4mwYy`Y?5@lTI5~6d zFX#fjK9X#D5}N#Q=KM0K!{h#yXNBH3c0;I9(=hW2z!F1 z%zIlJQGZzq*b=oav+yugv_@zH^NtVcS4qUAweK-uB!O<$i+nC>QhmTk>k;96Rr#^b z`j;~3bIYmOT`X%fT?hWZne*-;C^{%E%LS=#QN(5`Jv_yM`nBp6u?{KCP%%bSn0^kB zSgSgtAeg`;%!murCikOU?;J$fQ}x5l_k(e<{(5kagbbK!-VK>%~@wN}>Gtw=5oqcTq#> z%}$UU{+y2wBoDO7Jv8ZzIt{RAqI3a`OP(@1c-*!O#SOqYIGq04PkyC60ypOoEuL9U zga1btXt{0*A6e7?{Q3t}X8mVX+s`5)@G0S6(S68YD&cR4BLuZB_5#+2P9;kdj!rot zxJLKYm%n}mW0TJ}rUKhrLgj%TxFTb>2ImQgHZT3WO21Y52zuno?eZ(Cam3kS5ly;H zufK_9JO7P=(tDWvt!VMMCR2?ljYV@TgdC}?VOiHC$funL?wr!3qpstL7TO$ zJ6EqS1)X$4_?HzglG1hrF|$rq-F*Hb~@C3J}tKYh`;V=yy6 zR~)tPT%AQ?IJT3Ro$cBp1a%ueW(3$NtS&wkOZ-h#I=R4Quk$-B=3~8fTOipgu;4IR zwi0sLnVM)(vl>YbA1CMj;~($>uz2LTubReUhQ+;K3EEmo<{RuL=|)yfaWmuTHRM6g z!aByV%`7hG*Tffu$NFAEx{N<@wLa2`<_#e`!_n_{sm_&> z=PP(G#w6F#TY8+v>2M`xx4$fq1I^#a|X@NX@!lmf=5Z;pBk>K>7pWn>+9Ks zKCPc~D6LWDK>FCeIYuxhnD#zqUN`K5U)dI9mRKqtTEP3>k24DWFGzL=o(SiHxpk z=>44?4ROa4ev}hu&d5G&l@O!N{T_T=b5yYvi_Ky_p^9td2CeorWIPTjKG)r1YA~i4 z$`)<5-l^!1Dx1Xg*oU2mpC);KFgEIsTG?PVh3QIm{Np?BabI&LZnVEIW9 zUNKFFzDVC#A*UZ*0jAD(Z?oKK zn2Y(%PSyv=Fa5eWVI<_r;HVU;yIu(J3)fJpots}-Cj!h;eJ-^l>V=QR)U<6AO z^LcBoY}aatYg#Lf{r)Z@E*jDpL*0R&O*I0vFIv#)av|o{au!hcy4~w+qC&t8UxX1V zy~wU~Gke#rEk|y*@NL52qN&~z@u*t&m;lSQB$Yj8*ZO{E#I|61mL+fbs2V-aswDkp z>L<##QfO*PT}k=Q+Y_m*3-jM2oe*7N+`Fxajw}T(7hg%ZmlgJR1*2AG5WaSaI7Mx? zp3-gitfwqJ?&cYnP?OG$^;d%6aa!kxyji0p_~PB?Xj6#7>qz#waoO`VP)zn>)7Z)K zsCq~ufPvNOXF1&D`T@J|Ob4(^`XnFd-Mv78YVw$qhJQuJ035j`q$mN0>EgmU;JGZP z_v6ekLis7)NESG+Z^J;B;r81D?(N&@zECM{pdE2n(E@WH<{xiucwUN|Cr^clngp6lC{qSrw)l$k*h^pY6) zVr*;8{9?G=8XN~o8^YJoo};kX`FjBv!!R2>L6};H99%MdZu{j}@6QTU`Rk`Sp=RC~ zyb@z1BgCKzM!vhLQWrH$a^&w47_=7dB}nJ9C;T9#d)_JG-HMfOS#NplcxFz&B~A!h z9ZW0ZWH3m%x&sMf`n_;d+N`@4S~i+zOvP^6bXj2MSD%~r{~$GTl$NOLBwy~#G3D5! zYQ5M^RLYYau;S*weEkpP17)o%q_8VD-i_UQ;Lc z9*bYeVeP`-+Od88ye7$W^$_o1bMj~87$9q_Rm;bQGYuRL^53vkqoGLnr5vb}#$|&> z3$lLReO7TGN!HHze+A41-Fs#$3mEg(y@77oaL9D zM1hm6?@tY0(@k3Sw5eLf13{mov?;r}G($M)Sl z%5&bEQ@cLhC&y(s<|wZ!#*@&jQKQQlQzhN%pmHA&)7MZKd`-7**20#5Un0V2xNx|e?wD8P{}+c-|KB^9n2}wC;GHU40Eicq;zx%01OX6I`+J2vb zAk*~QTs0mq1RHIGgn3RAIR5^dxzPa8UVMgD;5r2{6G`_eL?XI>M-82f{r9Cv0D^oD6@T4Lrfxh zYe=HkcCj@C44YWQ{yCJucyX*Tw@mXcFYJcf(UMH)lO8mTJcTxB?`X;qrP0h@IjN=; z^$Krsz-cH)%?-9^q+jQcOilLH>5`dLfwr-?Nhypx?<`gH3l>z-NA=%4Wd;U(;*(9U zT~c@>*M3Iv|C&k2;a2$8!Y^p^V=ShcYD_6CN*sIG+rNFxi-3}Pp?diMuZB|-e5`&J zOwy~uYz9q!7Sc^9Zp%;VF4Qe{e2hh(pBm8z zhtVmy*)@tPE;HU&a)m06%-dqA4X#c{yd<_uth1OL3>!={9QO+;9mb}ZzgAe6>92?R>8aD{h;o_;qks$ zr#Joz0YIZ7*zAdB>QZSl^%8;5;&?o5UugxT(a^gtLx?EyKKr6-UGz9F_xG}a7T}=J zNyJ=I`c6v?r62{AuKb{5Sutp*x0jGu8Pq;2Ntz;L9#@@bm${e7My1x(*aFJ3ol?I>b zld8;@cr_)(i_^Gm2S;?c>m$aSx=AU}5F%5$C8XP(?HdURbX6g}&@}s24)qH>O~NFS zB3laO-#-#7(7R#?>3i?70}HEmF^8Z}4ao=g-M>Cc3ZunZKjr8+paM^xhYofNAt7Vf zMlajHxCX|IK-9b+fw`i39S3C1j(;Xh`2$4}P#qDOg)y-_wG>J1u8ud9^*8EZvDcIN zU2l_DR&oBK>C+tZZVHe{gBp7+qdr<-O*$0R!cU z(Ia-;Ye7$8uX7&N4(AOSxrlb*#e@f*j4hnaN7sOEQHK{Fc<9P(k>hbE;9N55~(+`8iP4LU*! zaq@OhNBXwrYBOJ=)rai3JIjj1K3WnQg=ZOh{(Hytvyg%BNE)`pJ9mxW!~%8SO%H2+ z`5AVaE(~Y9Zd5OZAxbwHNm}4Jh7(o2%Pq>;Y`UQ=)Ml%Ik|KP&k zMPM@J9#01!bP#I2R=-9f8t?MdP%$m&3PtW zT>*(wM(@{oqRjCx{`|63E{le*d%+CL4k6FvmEEqe1*|K@{NxdF
<`2 zy@#LTbojjQyn3a6YiT#6mb26!8yhFo=mR{Lz3a}DG`o~UJgV<4q`5)ZTtSzdlxbJEQ{zj$pkR|uB&KJW8{3*MA z+pXVsIgbyWIb${bP^}dBmo(ye&K!523lvQ*Bzk)4Be>VYCz?>8)Z-Vqh0uR0;3?TN zW&s{`9LhuQJmE=!7Ab+iTnDvM)i_{=X`a!9crmLi$rbZIIO3Q<(!6%9g1JPw^B~B? z{p8VbZzHTA6NNI=on>U1S;Z%lG_Bt})xz(9r!SB{0u$Xn_}RqPh^i7S5CK_s+k%Oj z!fa=&g+c8SJ2z1!Gqp^u=EHoWUD&SmPxuHkNZ15l>5Edz41N>e*|xmvIg{5oLyFV* zGGb6)sUy>#4`kuHSUX`?KI8QOa4UU9Bqe)c_FF96 zWMW+!t;LkQ{VOnyAeuQ+Z^`5M>|K8k`S^WUKPHnS~0~ws4=+%_)@+jVa zi`15?!iqq|iq>Z%dfA9!XyJ$6 z-x%K%ew5-cX*Q88^!{eX=Rp(nRT=RXr|3VhTo)(F_1(J`a9s3kRl<09kvx2*-+Z1% zt1+S}*1nQNKG&O4Ptc z>xtcpc7-BGh@ehpOqjL~pogonYBq%B^eXR|5Nd;oArK&Q?@t3tbN1kcn_kCf7$khD z`km?ZvP1*vs-<>t?C)N!0dJ_2HT94-g> zT+FhhED6x4(H^$MJ6Gny>R?QVyb)w=aR*k2)%wO@yCXf*syexHEwb!tfk8w$`^|Gv z9+H^dq0Gxr=Uxe5)AJ5|Ms@903dJfRb%w`DVYk#K!Lc`K!=;At38+Kd!2wvx2<`mU zBM(?2K386D4-!-Q^R9afHla72V$Yz(jl|eQxXNHf;NhA?p3$E9DvtX|!10H_DuL}W zbeJs;M`g%ksOTQ#Io6V)>~j&1=ulA=yxt<$aNQ83LVts^1)T2Cp)i;wBK=UuD!%u9 zo62jGc*pf@=%>U#41CpWN0YV0Rx^R#o|emsC@(dPJT~%YB+ZIfTu!MsjIU3$5VXfA zMB;pN3jUSKIHZIz3d`|G`IP$EL4Guhhh?t+ifs@g>h)*C zkARA*Q`;Lp_=+wSz55m^UF8^rESSlzQ*UV^^%s<$B3URCNC_pzX)+Ja_ZRW|)GO~6 zlv(Sn23cn$c2n99JC{dE-XCdUS%kkE1OX)E4WZhPS}^gAETPL$XA$hvT^Fh7x9`gpne}Z9nLb&_ts)L7tDW0Iy1;uta93tr-a2#*`YlWxJ%cE3zodbWH}MH zy{hPDO@g!SwXqUDe|$&q+}-k>u>8Ar=*_;@;vaVw8Rmia{!kd|CP8Tume!!7?Y!Jd zY~ETW{|jCJghI%rJ{aAhK_Ha_*^G*$dsT|HewZT~x^5;LPZKwFd#XZ@I8N_Eqf?nq zLW!5|b&8EyD;Gx=vNZBVfSB}$h937&aXd!#{1)T9>b-$jS5L=UtP;j6U3wfSt5#f* z=-(oHa}AUHt@p|fmzW2X{_FFauDc6prm_8IaPQ4pPPZw1T251QFusifA93(6`4}Pl zj&_4TKD2lG7QZgXBt~#ddPgKs^!8?9CKOdmbo-)9Tg%yd2Ep_)ric5Rsv(=L8gkQb zZR5ojQ$v4>c7%!8w=v(tO{rVFiDa?tsg3xLe|e(9A|g)ZrD)8(+2ZZvfdZ=H1Y+8n znh|#UMm8UH`MW88(7(L&b#kt(G$ORuv@U|wdYpz#UC}9D;b5ud0+Q4-YG5?o7N}I`yqAzu72tlofNJFBNl_Y-v;CLLz-qb)_)FZ{e|-`7 zi1EgD_U`4mm5jNXQaO!J=;|4Kog~Nl^Jgk|-iunf1Z*qA=mZC8O zX)_Kdwl_99S%~ig8ci>37i9(7{7MHa+NYx+Gb(oI?lL%}#55>)5l4_E4U|O|B64G0 z1=gLmA1abS6{Ijkfhv;En9x(o7otBYU-={uq8 z%l83E8AMP)QlP?7Uv0c@E;eBsVTbXihHO~AgI_eqDXAelY>SC z8tLxt?(P!*>)hYH_w&ww=FI2}ejoenz1Ldr`@ByKX9%|x)7uLpAhphOtLDo)JlxnL zT-#Yyvp;96=g(*TQAGeVqxwe89gr{Ui)+;bGsUwbg8hHl0ylczEK`&R6rT3>cC%_4K=T$rI)W*|kR=6t>b&H*ZZ{aL;i26Ft+wDqU9x zbWCSqgcDD|gkv&p)K@`~{f*79auN#EIzZ$Pax5GOX!O#70=N%3P7z zDN#bp##qD>*E+*kpMEYz=;-}@GEmr{tcv>#pok3+ivpaNl6ah-iFmU&VWP$gkZe;y zSzFJK_T#F%1P=KL9y$JGN!JLuxbaQMY68m=0jp$fA+sNlV40)mu>=5R8EdY6z@HUu zVDNE%t`uK^Z*UN!zU}k-ayrlP+YtSlW#3wmIztc`$O^GE`RI(rHNl3j%nHr2W(GS2P79P;l9) zQy*d?}WA3W0EipvY%M-ewypq)<%_~% zZlma{!nO~Rh@@MQnFRJJbtr5Cxt>TdZRE?Vlu(!@7KH z?0wdVdTe~N1__6m1iK)%JgHJV85cMLaH9orjb>Gu&l!WUC9hd^JVnc|BnnG;9f&EM$= ziC8OjJtcn|f@km3)*9q$8D@$|wy6dDuAGktLL9|isb@1cky=OLjwL<%S=EUcRC2cX zp5Y*##U+}U{bb2i`<+{a^2hz>h_Mg{ep#%qDH2rJ!dASH8}}9oM@^k)_0%$-%=r^8 zNynwWKDef*opkB6(Q{9ZBvVP#Y1>IaxivtgA7Jq0H9hq9ezKR`aOGZGuuBNTe!i5dd7q8@O+N^ST9)3Z8ehsSE>s=>LTtOTUlJpNiD-r{w z*D}@2DM)8FP}?B^DKa1kQQ5BMOWz+c5nLrdZATa8P`3>D(YiiE*nya%PQOLUwmHGl z7TXna-j2g_5C@(q2dpF>JS@sd9~)}40w320vDpyEcCA#&9sK~m!CCv;xvM1)pSwBx zi>cFQ0}%s$iB?Io39pkCKP%<<;Xxd#=ArC1@FyM`#ul%~gqb^t)gDj_^p5o%#&82( zN_nc?iuv0ws`yTT7YK(==jF#g*7ax}baux_I)ceaz=%SL9`LBOwp@8o#uUt<&S@w$m^bzuqp0| z!VY1uP~<|Ef*0#ua$IZR5GeGTy*{{voO?WTyWsbw?^7TtEXwc*Z$VbgaZC5bT!`cm z7ElTj1OkY!GAorso%}2bKOY}W(0Xa_xhNhUPIIL4t2x$$wn@3mcGu51pGN$o(OiAF z_`beVy6(N`3tRMg;*uR)-1762=0bf3Gh;Ve)tI)|MiV{CDy0^j9x;IkAPj*SluY?9CE-n$0sTt*?1-l0Z zcAlP;D7_jy!i(_j@Qk8l-$e`SC^#%^=4yH;{JyDA%7HEMLlGLLbJRmJVEIL3wo6Gv z-RR~bmScUVv1h7`!{dOU6aEi}COg!0N6%q%V6);EX?zycOhu=`WfIx(^iS_C5H)%p z^R~ned4Bb788PIM6sW*I)i3PUY-);hgU5>{9WU5D{D#^s1sjCT(uV!&mE$9!&w}nz zE24NBCVXe&Wz?Q6<&csP!t2*Mf0iRz>ff(EOl07^=kWIheE^mG*EiQ?hC$O5XC4Rh z4cv_x0#|9cx)V7Bj40(NjPn%+{t<-2iWtL6^Kw0+^&{?y|Fx>#rrzX$i`yMR! z$+)Rvf9N{xM&Bd@mJ_Y?rz3co0X)`D;q(>=6?$|;5}PcL5bnnBZXv1W+8OxS7lO&Y@Rm2jaK9I( zo6WZl6aKYn64;B*czb4ZRvxb^QQY9G+HQA+@N4yPVd+frTw#Xnjsy5z4lt@oSAZtW z9QR0hPq{>s_2rvP-+?slx4=%qy2zef*0>G^X-8iFxVb4=ncb=SXI7hjXy6A%zZv^A zFmvp%0*(h=E;us#DGIOXUxZqq{khoKRSo{(?9`4|G(yyQ4gr+AEYELXo2qB%g$LUd zqXJlch{x>d!W*L~KYs{wk}Vfi8%2a@uHNn*DBFF!-+>o^(^`FS%0PKvfecgXJG0te zUxa-`IBgOuK5T#?DqWNYNmqd~X(|o7WRu2>4|4gOsbPK~5}^p}Og%2ldcy)HheHb{ z_d6b-2imIKm&DesE5<}m&_$Bn7R5K1h%+5_n))&b)d>3DL)YI1kzf+)f_%Vl>B?Ov7Nz4!%-|0-{ zdJnkB=(no2?$i$tp$;FHn>>Fk{pOiWPZJxaB+vxs zS)N{tPnG#O4b*}a&ggnu|?Rl@fu>mo&~g#-p%P3w;mUGqu(ibT_jgfQ)2G1w@5fpGnb>+C^6HxPB?fmx%(e0O?@1gCDRBBLi+|I64sQ&kE^O9 z{Sr6aK;uY}dYJ$~;y)w;binChx`FiDT(x)%nG}Lrt{vt}&CE=wr3Rb#ol~91VNp(l z1AjPn2&r(hNkKp*+l+o;=^xXI4v)2tP-+t#q)vmKnsayi{V68gq+9u$XwxI4XSRbt zmHaio0~iu2?57a_|3-??!?trum(?Qq_lIO)pxp~(72iJx#LoS?YzEGdu;>#|Ne-YQ zZYYir)4pHbN~ee>6aBQ^)z{HSmqb-brJNxXm!)$5Fzk!upQk&ydA2c_gWn{`Db#fD zCwdMHn%0hw%c0;C5-jz^Wv6`37TDf5SKEU>NJ#r(16rVKGyB4TqLp;&Tl5=flKy->5{jFa4s z>tDL@H$wEoebW36t5R;~ZL!lsZIH1o(k76}Zn0ElLL3fM_edxyP(>ptJm>#K3ApvUoJ>o#C{nYu&MsQ*5*4-A#3KNGt49WHa3; zK%|u9IF8{;LR_HyN_hw&>EdajBRF{~!we9A%E@HjEWJRW9PRl7g;Z8uY}h)sa~97Uv94kyLS-u zfYbt_e#Un-(gz3MO(*>5qg#B{O4O9kwt5*xbELS72vz4wZ|q+m{!GE;I~dB0rB>*o z5IuS_VZYpFp<=ccfW%k3qpfN}pq4fs_dhnf5bTgb3y~crS8JlceC}tpK=-dt&RQ;Bj+eFgQ;Iqi{4bmKD>8kFiOKK#(}%2X z7Bb*BTf!PFEDoR%4}gBA)L<{q3wW&M0hJV+&x70TRf;VzonrLhv@Uk3G8v@zhe!JY z7NuvP=sD0G8-B+KJk7&XPcX&?rV0@ofu;zI10>WA!RpB{b)H)I+qxHSMgPGixzI zeOkdxCwOtB|1k{gBop`9P!`xwg25Kc0n{<@igbn<5anaBX_b0_{!@&8kuuoCA@^NR zoR-7p5Ov@)+=M5_5ubjTY|6$P4=wQ4@?`^Ib8UR{QW;}e4rn(yt-qe!d^{iIR@l$@ zpACmcYK3!CE$0W3u#fgJ&3~`9qu^FeomPA&Q|l8^sBP0_g4W{u=H(Sxlfh;y8o-H( znY7gK%#%_B2U4zbj^rl_S(jKr&#NA&NNK;eG-gX8@W&Q#y{|F;9dyZNGJxlo$mUQ4 zOt9Z`SuK#guwtu5f^#}r0Or`c+MRU)jg2Nqf}DdC!+*Wft(>rS6(jF$mKqD2j$7^h z|8Me-iO6b^&gfVwq+zRPLd>_^}z77)^p@Aa*Kda4&DjMv|#P2;vCtNPelIvCSUg+5YFCbrt z6Ai|P3660&Y(wDMkvJrN{FF26Br!L{~cK9tK@i~&Z|2E znbwztKMv;!gLgz^%$85PN{;_rH$ls5!2P0PDN`OG_uVhll2nMeDX8z-7)%^a{Z;+; zpG}<%<{J_jYQmD_AQ)Kn|H~*~Sjh1m>CwM7nkWo#3rXH)^_$3|#fsAm5;c6g>q5bI zAPpM&7$UoPvI9hK1GDT7R|8tSu8*l21(M|_&T99P(pCVv%LCq)UjTVm303Qd51?k! z0E#nup?=x>cHNngjE|2mPfV=c7<=dw!;(u5s?r3~!$Of5sK@+N)|z;7 z=7=1$Sl`?<5caxx^GdIdak@-5)^fVMcaV^K^D1o~TC^W6w$R@E?p>!nyO>q=L&(=- z6n1Aivcv)t{y`821#GQjX(G3n!h8%H5RlB{xsE$n)VR-1DsT> zg*ZmHXWP>a=FqciWgWtilRvA=$zgGKqh(gPn)7D3Lk8Oz)H~0|jy;##RP)ns-Hi6-<-4MCX^OpBoq7kr}YW?SF<_*$!gfa-?xk3fJ)5a z_{b4`wOfhgS(xFklXNP3EO*fCbC$2H{PzCM4#tfHgl?)Sb2WuPoh1j9!Uw1YJn-N>4#yaYNH+1DG#X5vq~IwCD#!LEFI8F= za#(4Fk;|T`HvNpUBP;@jf8X3ik_$JcnBISHlR0S%klG5{WY`#46~`=s48Pr&wE|eu zhCBb~R6$pb{zZ@7HR?KG{-a&z@w)gfYQz~Yff#pVyAaqbdc9j$m2y43JA52oa&Mir z^R|D`pWbV_Uh@3>oEjqPL=o~lhU}fwmmQr8EaflJ0d(X6WPun>2wF|=jWLVMu3AhV z-BWaG8-WNa?b@f?^uW{BhWDBuu=7$qk9diW{7_T6KTCNF7>V(OZ*H@lW?N%Cf%*3* zT5N?g=0r6}IW~T?LYHaTBYbN(L+Po6iX0-M?-RtYqOIUWZg%R8s9mt3EOxsI^7XZV z1)yXO;1A-Hd@6DdE&9k+Z!=rf8S=K5+QAny-*z*4c;awAqK-ul}yt zi+8e6Cm4%b*63nz*;x18SeXw0o#TB*jeWc14?)@4H@%_xZtF%GTGd8*C9_p3cTT&J z9cl^aQzpbF{mJTuU2i*%Wfk3483f^Xh#(?Q{{7J=Z!PwAdpZHk?R5&bRJ71?Cbx4w zn*mUt!|g=B4`|ipE|u}1|F{hsdg*?w9a#Yx8KfUpdG%MyHzB}7K=N6OwlsrANkyZr zE5Fyx3Ay#1F*c`LHO%e(y(;)0g|5Fpn*Z_H=l1f&T%Dt74eP6%{lu2fn|%p68!x|% ze-?hk(@{1Aed4v*COSi*bMX{rUzKjThR@^-u%|_7-|tc&q@C+6qMlTZ3Gma8ak zK9F}zoD)nNGi7I2cyZs)$jThaYK>~^~9>?k8XPl&$q$ZQCs^f8f znVA19fhREih!u{a&oJ*DMyK`Uj$?`C6GAsc8&4hOe{(PA&b4V#Iwy0C-Af{X_iss* zj0;`7vq~L7sM$y0QMVk)N;=sdtR>M zg+y7+rm8mrPd3HLb!w`EQvBEoQxgEY6^Qu3#z`&|v}WRCvkqUKS9!-fXssG0_1Wjx z{&R^H{C+lz^_bn2KUBahST4isfi<4#eZpSzDSRXW?-w87OJDDDm>h4B$qfFZ6wHvp zYRVxGhhDt*@SW&OY+V6dmo#=VR9$z{9rnETYXM7PU70#7r>%Ih7>g*)_=ZU*Pl37< z_bMUrJO2mcAaA_RXSzisSXfw{x?UxpM1n4M)tv~ZXl+E=->f`^?hF6-nF)KsPiB|u zg?sjJ>&WM@fjF4PpUCI3BVybim&KMRH_m_DC{7ueg3DNZIr^-ea1;^|`JZnD8VsR97b@lT1 zT~_EsPv5P4Sl}MwK$Wa>UDgGJwYYg1Ck{L@2(HZ^Z0|-nU0I*&rA0*N4<3$t7a!A; zwQGULgrtdclrVv=?#pXr>*Y$p2dNs1OL|HJ%Mt{ zR%2MAD2s;xBnm2Z@wLe`zA%FW9Qa|NG-3bb0ZJLq-jQBOrDpCRaQ_P^PcC*<$N8@t zHYF%9#ywG|_1{5Y(4^p)jWK5$joB5FIYN!RLXCEbR2#BBi{&t_MX~N*6pmxgZEQew zHSRC@8$W7)w77I(cvs`5tm&@!h6B_hMY>J(nlvg2pp?g~MQ5JCkOuy-m0nV>kGVTg zX&`@JY%>Hf{bhgOU4I*GW9?9ED^>;`X4Y1#ms?_u?9mlF;3agM%Xh%pbY9bgz`(b+j13(Jo`0 zS}}LLgH1KojsNNRSU86J`_q43S#aYd6nzaXNnVgQ@=U}n24*;-5%K6-t#-G`#5imW znB(y{p0izjj7-z2Hl`F7ZaH~nI0!T9wLTn{XM-pd3&3+VeXa4J#70kif!{tq{PxlpKt1 zDC=BsRM`9~M;T%}5b>r>5LVCo5|`<>PoZbL^_%d-=TfvsjKbSjiW#A16C1+>+!pdc zksgkrWD5RJdyGGu&|{Rr=k&lK=5wNJ^C{cLXjY!7Gz_jh9g70lT&jR?8fxh1;PN_z z2)3xa9C(G2qphI9{HM|YB}WA_OnPp5i$2VE+vRkZFi#IXsF(i;I9Vc@9=;lOhP?*4 zFG%M*M&jRM3Z&iK&ahlT6(X_$xw##&I&CN(DdytN{3xCs23(rZWsT5*2>vBv;^Lnymen6dtFbaF7|yKkvR1 zS?l$~vjBth#VBHP&^+@M7{q=zr|aXN0-u?KV5*v( z{qh`!z3O`a3&=NG&sI^x!l5;ElcY%wD0b@^9LPtiTVnF8M!I4Ho7A9PIJLdP-XMHL z#ILV?*;AC#*^+$j54o$8Cu-Ax2{zEm53Z!JCWMweAtZG#>dzUx!zwjblK`nNd(MRX%O)c@&?UTr1c0gv)jA>!J^1#rS@J1=Jy})UsEnkO~PVgAchhl zo?fd@(`9H=SNqdY1}}p^6h&Y-UP=xcAt!JCHc+318an7A)r$#44byy-gu6p$@tGku zKIJw6E4&h&R3Jo4Chotz1ayT{!(6dwH-C6K2vQn=u<*;Nm43gUS-}OsC_;XKiU@zM z6Sp^67Ln57=_;8@j)_7ag8&~nnLaJ7U-##fvRB)?$`%vybe~YgMOv|8flqoqAc~Fv za8b~_OT)QXtx(JgBSP_LxkV{mUegZ#!eUL&XiR&c&w)`P*bCrvl2xQp*z1KSY|oaU z9jv)(0W%`in^frpKVm(1r(&jiv0DC6Ring4f!&PH6;Nsyf2;HoI1q0f`2=2s12{Je z3wsg~r2k$RMzjK1B+Dz12k?mtdAJP-S~0tq0(vN08TLU~#%th<4Bw>HBIHdQ(R(lh z3j^~n?e&P$2g=+NesT(cmY;sr=Z-Y6)HFIEu-=1lV&=|G8fnA;}`ZMa3*z zGpzY=SU7N9ocTizoWv_XU^*N6M(1~-RT3MA%>vJwDLW$Kj>HOZzN2a{ND|WF>jdPv zgpoZbjLdK$$V?`$SI0@>r` zgvnr%OL~Q`TR@AEdBO);*S*ie9DhASTnIqA6`;g7X}0=EXx|EWJ~UAu5n`lPK;^(; zxg}qunFSk3%pSxu&jA5>x)pK(&o(xOOyo!~-*eSQ1f{9t%r>M_2Rfj^W@Tjsi8=yW zdDLgGEoM`J;gs$=-;s0zPJDW1^AJTglO8iXu4lOPI2u4~Z_44_<#Y#(GTVjPpM8g@ z>6&JQQR)8A3${$%+CNgPQ7nlqLDVBi(SQBod`lS|q%XhOeevxf2R{VxvH}PJ$jg&U z7y*LBO{V}2(N-B)XtG5twGKmqu%3{?1db%4`q~THsG_pba#SQdxuMso&-FOW?rv|D z=UuGRge-n>`=`AkR2Pkk$B#X++7DT!EP%ct;t_UK5BiVc5mC+O|9rSex;4 zr$AvvWgt%PRoXmrj7Oh8`Xny6k95MzXY;@_2jHH|G|LgnKQlkfM%$c z2i}-aIVKE9+F77M2F~_vTd+)9K?}~zM%IitkbRxXC>>w$;H}JQa`EincU%J#kISh* zT_=kaqar{Aq^;5cokCZaRugfXA~vuFBjd6=b9v`RoPKl7ybbHyA@7^f>v4G?!(VIr zVs$~1PJxD?x|VKL0rH$#m(iF9un@WCE>-IUSfbj3tzW8*7T^H?cf~y6*H;31@vn61 z-w3>jZTf03u|bHyC0oaK`=&}lCYh>=I0{2JPCLUG*vtkc9%lOa>(8j!VKq2B3}`5A z9*55wihBMRX90h)Ks=%H1{3AT$i(vCMDQ9AlJukb(=u0YO&|24xF@xOV`UdOZE|d% z55EKfGt4hqY02~{{C-os02XBL<*iOz@&OEQ+ISkyWFoE>YM4}1^f+4n2zl;P7Y)TL ze&fdHuI_W{(Q@I`)0^ONy7vnISpj(qvw27ENe{W9v1Y&_onn4fBj=Upti#O{JT4tE zb6JD-Y3$4;oKOKupFN7xiYhBew{Mlw?{%bTO=U$JMPRjig52*&>vfCK&9kz)5 z?G14NX)OnsL;ci_{n$#HgyXmcpzT+LoLZ}(dQ$!K_}d&*jU7SeTqTtTvF(T#$J5Ky z$4ZGXnPL!F`toY}k9rg$t%Uz<^G{$hC|Y$xfO|J9DBMl`X$ZN9;gy0-w*l+D7gLPE z%iY%78zhTaEH?{!17!16Ir4=D4PIg$1nNFHD8~+>)YNLsl*J8%<9j`#CE6BZyHeiG z*E!O9ztUdwR_D1zBmA?Vh1IHcG=PORp##JjKT<3w3NSYZQ>Ix=;1LkUT`=2?rw+6x zzRSJ+F)#6Y8nK{psOZ7lJ`zjT|F3=tkav8B`jWuj-1OMy>mHxn-h;oj__9#|&@fNM zWRBfD0g3&t;yrh=peb5mMEfx@2W!{~#Adl!0a&Oa|A{FqFAinFiE^A$GS-%hCy~g< zdTp4G#pAez5}CoW)Z=4n(avR20$4h6at|~0lwe0&EPQTGd^K^Q2CdP?zbSk(AOD75 zsSM5oTO-->x8>>I6mpueA!;=H%D4Ax5CWXPyNoA(EU-XnPqsv_UW9Xn-}0043ns4s zKXI4hV?Qqd0~^weL1;1u$Q&YIvCB*ghFRpKXk8A4`7pVKig~P&0OrlYCFXhk!=%AM zK`%eOAZvxp^xMsx7+jpJif24kskPGbsD4bb`TS=};aq@okj3Im1dCQt9u5H|7X+A& zFEDS7HQt^VfL*0a!G9j^_3Lkl0zMBjg$``UotW&a|8q=WfP4eMCsRQ>J!pIHwi>N> z5WUXgmVU?WLd$H-%|N7i^Jvtxh5Mykqfl(~Poy$kF=@>{A*3skSni;QN^T5n)vMZ< z=ODyw@@>SS(1}62dW4-<#glGsd_fZqdw705+^C${YAL19LAH`#$bw z7*?)RetvAe+bdS9cQSwX=iH;-eV-;GnPk+d>kYTAJ<%veGGH2hXWE2tn0Ycalh6* zJ^6rdsGr_pYhX7N$(KdXM#MRhc%vC0O+boy!WJXm1EkYA!z?NRb6DLuIas4ckxXYBOJ zsP8z0U_B12KlfrKa~Ya2WC-M6bRK0Krit+f3sR8&Cng%oK4$` zUu!y)itkO%ynOG{|DzBvT=FB%u1e?gYu3#+9sX1WK)- z5uzF{*D8ASNDKD=@d7x-RZMQmMG^X|paZ+(Ad($c94Im{O{p`uKQ_l`Ps+yE=_$HF zVElFv!8Z(qMj;z&^(;P;aP>Noq_w39A<4;aUUZ`qCX_?-}1G-eO6pFl;YU`wOV)2>oQW7 zD-_-VH<*{Gzn$ok1Pkr%NgdbC*%Z^gSJwlLM7enD+6vu)GizH@^&@pe@)Wz&=f7W| zB`LBjO&Cs>1s;0ks@%$h#C5&CFCf?#I#ekDnTS>OA`JxCZVxxC#Jmmxj|;VtwV~F- zOHDXMBfW(lmwTWTYo`mnrB>M~bico{ZrA^?H8xKt6-GRVvBKQ@^K{*7>i%==H?O}4LH;7)ou2jfPs|KI<0(2ZJ3IZ zLb{HAy9r=s=cr@xH-)!Ohd1YgpLSh(F`gH$5&uPc4&k;9ky6+Z6lx{bqq>4 zyT%SZLQF(7G>sxA0nYd}sqMe74bX}Wt*f%Wnc}d*58{ErZAv6{7YME6%;9C4zbSCF zMFw1X6>j$UwfMwF?Nsr;(`E49Ce1e1)UJgYvKwv<;2j3~$l!Qbob7+PhoqPE@-YM&gQk%3(WYO^#%mRrAB>?TcLdpn%yO%PgNkU)nC*Yh zASi5dGIj#R#Xz9!fc4GtlpE3=*f9&hic^`J&Qhi-n_8ulC~b!r{A30i^@*pCi|dI3 zufy=3^)j}iFIF{98SO>Z>d>BmBQp77ma3o4sIDw)f#BHHCxbq$wVo|dFvGYfFr3Ar zZ-u@=A)P~o`eldhGqLc3?9V>`cer@@f$8AyLa*DiW)?N;E*`@!lsU35X<{NG2(aGw zS9!v9_ut|nT8a#Cbksn`tvhk% zW+Gy)+5yJJ7qJ_lU_Tk#1@E*n!20s+c&H+hF)%8UpP2I5F6Kv$FLr4h7P`+$MQSUO zk~6>TsTQ!DDm(o$`jabyMj`plxyhhT@rKDR(DeP(V!yK>`ZM(wb!;?t)U&*A-*Qi_ z@FEEA@P9X;Er@QZN}z1wD<)%{U^L<{W3LFF`t=}Iz)hOQ(yBJN98$~^Z<#odGvlG;(lME~V6-eH^mxI@=@OlNmxrktd1jrv zi#{^lPv7#{t~8vyz!ZKCaPe?;%qOLwCl1K$OrVuTLPCn^T3vhUW+Cg(kY$jrrT&us z<6E^TLhpY{S>Hv(6XcAMkvFQ`XnId8gM3?Bgw;#msmq#HOiTX?lYHt2FikAl#(SGy zEO77B=H(+wNb!MG?V?cChI>t>^V#;WrwXw%Crztx1iQ)5h^9Dik^S>NfOV)I%ygyt zr7C8dscT$09v!Vw<8kJ+mTh(ym6tv=0GQ^V!ha;A)pglh3UKB))JMTIL*@9h5ZiYJ zj^~_y^c1yQVCiPRTG=9Tv#3Wxo6M$ub36Ig9K=IF2|{N5yw&G_BnMIOQ(rRVp?D@N zHoC{Ekj19rG}9Aql1k}4V}4UBueCS-jkz-vyW8Ocg!@n=^$)9iK5C&&Y!Rmmx+?A> zjxjvwDD&Alq5baxgH5NK9S}!y9QuHVfx!|k0*D&BIYQnA@4j1@aLNQJt6sKm^PZld z=H#1qtAz&*rSr@6zh#^jdr=%mr(T6~`Qm6i^}AdkkW7hM`~YbqIpD#_gicea+ml*9 zG=9i2fyd+Yz8Gk)_`8-Yp@{}&kASO%v{+|ovo;fqPWny|=VCh$5{C0q?AZB89@Jf2 zf)W{(LK>HBqFfeY!11WtC<#!SZ&irm!3bm=cnOEBCl!1Fn5OhG!BX-VX3Eqr0MRH| z_D=@!2q9NxG{~ZE{{2fuTD@Tb$Ihk20f&=R$PJ^D#0v#>6nn+At^RTkpOyV>sjdPT zkg+ai_7dQ|G6pk=P+h`aPxa38I042CYoEn>=LD8n?gm-}Q9guRa8Zo)w_r&p5$B{B}Pl|H>^BRD%=fnecm%5{78^aVphzU?c zAf!5}Mfu08$#T66P*H4IssHH5mmDmifowayhf_Yi3B^uVlhTPqgn;g?jroN|Zj81% zbOr~QpIIP}p^lh$l+QFdkqNlWCoDdlh*-oM7#faE4eZ$}6X#+QdcVI~J5V?O zlp-rdz|YOuI|aiK<-@jZGJOnb#x@eQk~e<3xV=S1>ZP)UeuE}8&*`A_crZSSqkolnVy$<37F_p8F`AmH{@WPWe%BY=90PsH}>tWk~>IHrmH#2SCgU! zzYzoK-fs@YN)@_DMG+~_3G=yTv;r$=^U<}}N8I|c$$*-jL+*bmjl3apwb6?W=rwig zrPLoQA&Xc8Hm+^D;~z=+w_LoH7-%r6y}=CZq6UBB@7wb4#=y@E>A`dY_^Hf&s&a*X zFRl;fhmN)9K$9=h+O?L#W5ggP>F;zkO-07|g{a@jR8-G^%+9qzph<0=|$ba%8^Ec)(3 z04O$z&AJ!gH$8r-jyr6;a=uAiL&{zVqwUfDL|u2Hx+;TOnf}C+K|GcAiLP?>ms8>` z+~?6fNIfgW?n*Z}VA6~X%SIDaGBQ8pEfCLwZ)!?1vdE1X;BL|NLR1WZKDkyCMA#=2 zy|I0FQr$^rYQG&ORI)rhZe-NN1brF=OAuoU#0j!llWrU+(y1&f|rj=~ttg z2VdDbgeotb9So59fnhSSVR8Em$F8)tH}9Ik2ansGM|XK)izy{kkh4h{E6hs2JqRra z92w@kjbK9_QQG%W$$tMP`g{LkJjz&CT2XTp!0DG0E*>N#MXH~Y*qLBEmkHvh+p!Iy zZ%blVsu9JMj#>Q@H=U3$c0=p?_ccXW(wKS#f<2={UZl(Qb(h5J0m{=uEHBh<=UTs@OKeOo36*1wP>3hk}ScR;KS;EU4i0 zCR1m(x0;YxU|>>01^pK$vFcZ*ZLa1^=s+`xObEgu?J7TIEX*7{j5;J2XcuhS&)RP#KDm}ec%t|J$`miB z$&6Q4{T>|imef2J;fKW}eLdhY_LdgemZ|ls0DC2>yezyA*(c*l!lOVJNUX|gen0z+ zo`*;C-M!h2H>}j-T{wxb&w&pd$&`F74JuGA^|fnEs3oq3x+--v1!^jZz`N?$>=@&{ zJ$84`7FHT+ZMZ&iR}mbmzox3eH<#jiIC=C($hTxNZ0mEP9wkFG6A|e;PW?gqWpbsW zDYp#{sb!b#NKjXWh}72?0YXt?sB&n~9z+m@`ISlr3q2^Hs0s;0Ag3hww5YjoC;V8> zc7J98=EC-j3ObvTC#Y*y=S5(tGt_eG7Mjpj{{aR^{Z>LtFE6rs?~$A+@OHl##6TbC1y;$I$t#NgT$#7CCN4}%}X zfRBw^@2FOq5fLh@Eu~JXenE=uhd7l2Mxm;pH#01vv=(MIUjz_+&DCfHFXTCst^_*O zKz>S2+I}gO?AMSW6cVx0ci+e6GJ7dg1U+k?ACyCM?1?!nq-iSvbz;|BV%o1XG8rp@ zZYl7aiPN|68gI6r`wrsF?LUzz-%otYj&R&9la4?NP4&ge$qyKzh_U>vB-*+JF?twU z3^uLbqzyzl*2KRiN$?j9)>R<;q#P^tF4s&s4{oW>FnH{7)cpbiEtG&zA*4Av@@lI$ zEjV8>P1d+SVN!R0(bHudO`(}o^ldbw^bhPH!;&L)ftPA(<2*G(M8y&mykBP>+MkI# zeI1mR^aQ+jmZsT&P^_e-e123KP=2Rbj86S>C*UN(H*hhk!M{X2_)e?Y=K8kl`=YK| z784?m6x5kz2-hiV0uYGS#msRy{acBV2G+a7O@l1V;2^n}ZoLIsz$n=~jd%P6l%lCG zgV@3l?HtI|kt_yC&QdOyb3uEG*$p$H!$Y|P@b2%**!Uygd2tNFi1?Uh7 zpr~*#Lw#rmb+27kJ=aLMl`Nlzp5U3tsVKCq_3$Ve7=_zpZCND5s1X+z+CK?(xgBqJpTc|Of`(OuRB z@Ye3A=3}#2V9MFcBmPbOCE88g?TOG2kEzS1^TqjBu?D zs%PoiYd|=(A~sd;vW-$)*23KmC=%k`DxalTf3TC1!bg8@rN5381Kimga=yHsjybjK zX)SxUt^=T@rsOn!|5yY4#M3l;Q>y|v*m~^fQ=J%R)XB6w+22NZUySh@)!D?Bm!wvV zl@vPr5oVvA0J`Og(3ma@1u@oyTUe#UDHezKoYQ-J4&M2jD&u|u;`+i%V?0!O^$`TZ zdr-B+N7cK9V#(fL*Er&HTM3AE_a2i?Vez;=HtrI8R4d0C=l~xACleRj6F`Tg+W(>0 z#cScZRMHZ0{wDFbjGKrw;#UJw55S>w@jbtZmyoyK${3YkeX+OE6o)k3Ap0doBtPgU zQkp8}tuHsaSA+NRwjWY!yR4X+wp50Nfgu7gNg-51E_rh{M%No_ToO07#up2toyx(n zv^|Ithi0T7btqfA#hnEdCUqanFg@#PN)VQFq@o%Z@P%R|eFayHIzr@=8Iw5Dbj*2d z7JlL=iCKY^KE6p?7#qNf2E&3y1YQT;~48l9}}$`PQY8=iQDEXT{9c{BfV2 zB9BD?-;zi^+ZhKGVcQ!mxh7*q+YyIMt~Yzb*7Lc7Ui|zIY{q>&@74Mp%*XTdK%(7m znG0z>w0W4yC||}UFeIq3!C<|J1H&>r*`Lk#kcebvQT|t>Cv??^iSQp{(T(t@K=73< zHtZX0$OM)?0tS8;13!OffgnZM_0Z|1aR~95QV$;YTn)OPbjAt@(fQ^CIf#cpex4Uh zCbr%3aP~~6(T%mu)WvQ6_*jW}&NUNg#9||YMHui-&eXNgchmO(MEVUfSX}P0>rN4a z&jn3k_;BJM5 zhF@3AU9GL1M{nA_4H?S!B7(thajrtK9*XSwAxjLN(!-sR z`jxi9=_Z_X{08F@V@}(C7v6!G**20XHi47DDeOZ(-&YVLJkB37jR|{g3NHkWDiZ7! zciNtLxPjXmnG8xpswK5Bi($%m!|B3f&=9HsZh4won8u4J?kmL2CBEX>aNC3*LMmS$GyK%^hwU8=EiFx_uZW%0WnvgvS74zuN>BcgutHG*YJ zPvaR{FN~$7wv5_xcLuzHdwB%%^;8xe8IGNE2nDAFTRd3m^nulYzJrW}q+H}*?)td$ z3+~Qm_PX}h8=%>vbb)$uH?>(t{K^n^)qVe1Pt82`JkF@o=g%Q`uVBZ57jI|F3s%b= z?NC5A=Y2cUsUjTOOCI6{yYF)+BTHK~^vpGWkfOKet{9OM?pD}OkIL<#xyNO^E0Wn~ zqx$&zU{+iJ#;A6Oi`?MqW`qRstAa?^#;g6GNG;4Jq(zBy>)SBtWNh!N%y4|V4=S?+ zkI6Cel&if0k!7WN`!k)~G~XhN+HV6%Nj5*04cj2ebA<0llhrRG0X1dJQ%mHgc)Bb( zvcKl4;$eX!j)arSu&$H=*P^!-=VU=kEjB^MM383i6d9V*UY} zDVM`EKIgC*$2YYgyfehDt$jMM{Bu>~Y&Z_n-o6{F4~AXn6I$;GT!sWW=hT;8DvZL* z6dxkQH=v$SxnPVTYfcm^u2PY$9E&7jJ^?NDHbJKP#*wyV6p%jJqka(d15_73C?(dr zTk+~Exi>rks~6<*U^aF}b(}CTHrx*JiOwdlPnY)1zFB#oN|-NFq{?fDeANmj2N(tr zM!u>}4j&nM;kb=Om_@#Y4K?w@l$w1=2!(}(l}@Of*YUpftFEB39Ry(t^~DL(6Dh3T z^~Q!t=eOG(Nci4bU|7iT@;U`{T5;UAx_Xk~mHr@)7o;3W-%`16d0)+%_8n{KfQ=Iw zXfnQJn*$6dgjR(d6mx!bk;x@)uRE8Lvpzicr2K%U<%4$m!!o1_-)JE!~U=O0u!O;z3 z%LO{=4x}9?Y^|l7j}NB^w+^s`L$b{dd4Mf8!+%xG+%j=^Q6*2R>mw}pg*;7g$m!we z9sCPoKi?FH5%oubijTrfi8vN*gION0IUg67PR@r_x+wOwqq7+aF3n+qLn#9Tm&I9( zRyg%eLPn;SczI5+ekU?+WF7$UIcd}Vu3akquY-pA*PDJntVC?HRT0&!$Tp@h;Bf~0gR0s_+A-Jo;`N_QiO5>iS_iXb5%A=2F)3iu7@+&t5TW=6RlRZDN02P1bo5t#~WMGJc>35-F09z*PC(TVaxJ zpL2c#uLMv$9gb#5_QrLmq*62twMlR4)9r0cqyvf)6VD;d)zCfdO?W#PPRtMdk8~`)t4gIL*@ZRw%81!VCJmbK=pWeI}&J~6N449#O~m}ht<@66Y?P1`sARY0zpnA z?g;1GjfLnX)M4sv9gt(hf#O5aF;Vy&yMu4#u~hfpeczBxB`7={wcw}qwWh+6q|(eb z_PuWUqOx~~*tt0nQx9V%-~sZrdqq@F6!RXp0AB#O2>-wbvg$9dp1j49qIM^LWOG4E z7vYhMdq3Nc*u#lkuD7+pgWG%{3KCheF7ep6GSVgH4T8U;oDnVH>_DTyK_kn@S6@_` zqX~IY)8Y& zl3adVk|oAY-Ppj+!T2hYTtJe1v?~7F_ci(;nh$y~t5o$u}j-4$j! z_{5@Iiz1)QFVE7tERzy49N!8hRlZL_1|dnTd^?D8z>%y--N5Zx!p8$iX7;#@1<=1; z?j26J2{1%+)>=$(l;2?UP8BfQg9)k0bJ7*NuikW8RwJPjU30aN>p!7UzC*i}!SX$+-Rmqq zHpZxwD?=y)RL<|1e9F;c?`yZ(NXw57CQ_LqXyhJ()WBI@YI;_LBY>QEd8nAZ>|!}4 zavolAUw$HwmF6`4{i^|wtJuGvdc2CD^3()GhcKb71ka9pTb9t{e^-9LF zYi0Lh@Z3VT5=Ye~(&oe44=P+8Qc_{9?5k-?FbJ>&4vY@|H5xeKJi4r^jPRkml&}*( ztVM`RYZD7I_OBtHDl4TZjdw(S@pAp8JUBncLt}$QGvw75FrG zkG8%(Uax^L7;s{MCsZ}ba4T}YD^cuY5>GDavs3~;L;tEGn$0A9}{dgpCi!fvru)m^EDn0UbiiUt|uFSI>>5t}EYrejY$Tvv1H6D*v zSjei=-H=2tY7c$ z@}Iam?|*6ylWA|IrZH?wRpWo-BVeLP*}ZNZU`saBk?v*Oa>r1S^`+dQuoI7T*X$!>?WCluE~@saf~N{gdY@{1JwZj<2KaD;DI+8UgT)edl4xUnhT1d)si z@-{$_FGcV>nRYGqRVv246>IVIP<1`ty#Mk};6SCez;p;RM3sF_P{xV$XkI3b&8*l# z2qc2e>ALl)%h=(qV8*(ev_kFG^KVvP2VjnZ3m)?oa}*Ux6`jv$;AO6#@>v1(7G6o5 z9dz5QfI;CRo`xw?O+$9^eg7lRNa!$hM+UKBvaJ?A-5) zffI3Z{fm(JA7w7I!d>?Hq1V)l5(-`qR35(j4$~)>h{l*=Vg(ZX;^sb2+EjC8B*4XY zscqGTLHQXE`#0rm1}qo&Ns*m&*cI-=aQMq~haC;FB#j?|bJlfpKAP z!ZZ5N#bn_L`8`MC�uF;CYx>f-ZLk2H`cl_9}e?dl0#A{@~VmF|FLNEu|!YQva|z zONNi&gGZ`B;qv$^Z-6)e9%$4s1Qqq#`*sT`rY>1&T~9PXgdd#}A|z6FxhAsZ+;*k# zkDPSxZy}#UA{cFr(07{-Bu3E9UZdHr zP}>_v*me?e!tzYL#KcBPDN1Y2Ri&Wty8ke>Veox9C&Cw1mcf&9uK76L2nUwHU7Cn0`4O&s2Kv zu25deQf6*q^A6TKhZ2PA`<}7H^T=NRalE-(-96U9tM@+%v+I#@8eba3L)TDqlY32V zJQIl7*7n#~F^5JXR0#xd3Pj#LI`czmu}aBnzmCj2;-qwV*$CjTPfr_8Il`&H)9LH9K@zX&_CE-^Ze|c2 z9EjaIz3fax+^tA3806b8`H^4WIKhBFpMad87e z5&bZemi>x}!5rb#tJXlddcOvy)8&-GqsMI8`6<`&MwGvy8;nX$yrKE`PxEn!Bq628|(r5FUaCMQ2$b0wQFoBwFH&Zbjs=otwnuqugs ziFr3Yf+&z!Sok@mg<3&~_w7b!6xW-4x?hM`?q{gE)ZZ%IisTL2^w(4<%^KL!Y96YG zV+S51|NIK&#Ep>=OcRnKBklE#c#e) z9zNxCZ((i$C~w&ftuJ57OeKJzny~M@A0ck&^NZC(I5H zf1$42^q*`H{v@)!fp`p?l-|vN7Qda@(1vw<_`SYK0aM)J!SY~drP#yl z!F=WH{Afw^Cwvbs*wnN<<2UiIvn8Ww_pIN_E8BE2TPN17&^Db4VjliL8H}h_;RVrd1Pc~`pI(TXw*Yv$m&(y4}Gqp zkS1uxVmGBh8*GBY=badCJ&@@usLQ+XGX1slMGN-k{Zr zjWCV}t`-;2d#)?!8>s6&4w$(xR%8&B$;&>I&h6oxa9duI@?JTFIRt{kb9ekRKR(e% z70Y{kjTGg%T&m1@3<6tEf_+}Vq3*WUx((cMt$qKd9b@HvGqLkD`Bx=S6_l~G^@EHQ z5Obo_1w)#LxcB+X!%C>1slQ1`CF^FJagkKSTB#BdG}tt!Ktmgj^_3kF0yUZEt$a5* zNm@9Ok8Nu#k2rcr+%lbuQr<2`M+#?3<1@a?I6@|MnHZ%$WeQJPr_f$l+1mb^F2P_q zs3L7RwKtg1X4#v{{LE?C$?f&BgVfNe8=iIMn?w__7+$n?N5f*(U_s>7EkV6$ad&yT z;$Rsl!!d1BzcsRAr1qfeG$lTvn*co~3q$vzvyUk@if1B1K$GQoTb9->lHFl5uXLxb z2awCmz)KkCVhL|WMSo*BFngJhOi{j~$Th!^o}CJQTjE zPXIdYz@pgdrZJuo@JOXu4J&JTaIIYyuRVfN5wqn(ZUP-pNXt#P^l9I!%NdnUI3b5f zge&os*gjA_bH2Dy4ijw(4!@Q^?hoJ=U;T2iU1NTNNnsro38@C(wj;meu@z_!5E%qk z<(UM%yTmS!b*HDTi#hta67c7QRM9GE>7#V$j(fG&{m1&WCA3!BB@OER)K~?RwNwp} z4xFawNNZ6FwZHGzKWX|rQ><0R=2c}Ff@{(F`CN#&+bLkAF-WbbVSDf=C|l^t1f&<= zS0;AFAKoJzw93!=W0kH;B9qbDl=8LT{45MpsZkSob+Af*PG-876~_bbJq_L=t8RS? zpC>8`O0A!7r=+|$&ZJ!I3!_17;me7a@2=>zpWe*ahJf+cdqN-aFgF(44Tu zBe8IG+eO}mod)X(=2NMMAX{MZl>TY)$!Y-_HSPX%JEf0YI{JpAjYj3_wf5Nf0w~oN z3^KOsgA1IbUc)6CAgiQ%vs|UUqcf%9`?|pNo7^IqGj><*8xsi{QuPiAoiz1`(jX_; zvT50U6#+bxga7b(n2~-{UOhHLWDJ(NJu2Yq^6nO@tFo0QA&`;BMH`K>8H5`L3sj|! z4sR9?$Lo6KKEM{ZTB1LPQ8mE!Apd&ACDU{+<45!RH3|32lsq=p>BSt2MrQiWJIpG=Br!+j#W_iRGsV@>i zdT@)V@Z#|GIg8G_H)RhP)4gRJT3(w8w!Cq+{sz(=5I0`Zn#we53q`ly=+6{0tH1Lh zN``LCmrv2xAklea{3{<3_&ARBG%`S8zr)y@uS`4o#w?mhLGcr+ML!mw-=zCf+j6fU ztd@>-pcz}CjB%L9v8q4e2t&O&*iX>vBxNZh3DG{F5DJbk#o0qa z7QZCE|KWJ;V4?sH^peAfJpmH_3JlL91j}4)3Gm*mKhl!i3--M?I%s%yk<6^eOJ3&REN5Dw# zW6~bBIuCLzQT&O?;JO=h%yT@=M@n3#6~4SmE}%bq$KdVFXF3wyXz7o9tx@=%>?~9I z^TdIt0UA^1xsQ>hw-&Q<|Q85TGtfxcRj^7mdriRu>Yniq4hQAl18A9Nqi z{Nc1R1fwsK<}SB#llZ_(GtMMon_Et6pJG>|oCH4kxlRS8WIl<(oNkV=z=tKNt> z9LKuM7gZT79a1&n{l!sHBV_{|=56#^HZsHEHyzS-hZUfTd#vD9i+cKXnoa~{&T;^c zrUI;n3UBY-t>%EKWVyz*YnOy)x0}}^X&zRYPmwz8lSvql=SQ}Hc7kcd8#{01!}%@w zr*DglBa$W$Xn<%9yvRC@^fyx(Bds1R;V#_?)(LZbrBbpDAGp zTE25BbWqxdrTH=tqZUj9Ha~n@dY-6~7!l3qAWP)mv6@{;l#OB?*ce~9WV#^=6zM~XyAJ7Vf?cepT5%`e>rEezu zRi6bGB5)EI6W2scBiVioe?tYl;WaspZn62a`@-OD7nD6}#7U2{@8ZJK7B+Jkl=UjttwN}jJ}PCUhN9E1aY0ff%^Lc19tbv_#YgEuRy6?3AjfV>MC8oyAt5lEcw^(suvxG8gtWf^mCK2Opr+ zK|1b6gKBc+`*8;{#mKrhWE7P5W2qM&=G}SvXtc`4#uA_joN>i=4?eBYgd?}lR+g1e zM`Knw1rSfJ(3m}2PnSbzxPc@kZYo#d-iEy-YCu0incL-H`b}2Ef=y zj>;dc!-TNLnJm%Va9%dF^pu|&ME)YqvJDs+)yWB;=J!X)0B4)Wi@pVi?K}*cu$uyO zOQ)p!O*orGu;rfFV{{ACRv0(vPQ@7p2Tm~}Fd9@}g*u<;*1A3oC1REVQa+WAHC8F5 zA4pf2zTyf`nkP#GRm}bYv;Ho#uI77qVTRXgW6smWi}<2_Y4qE3GnjgLK;}M~e?QGh zZftA^^Oho+PQ9l_5e-RscW2%<2CdYs8yX*cE)p<39DARf>ZSQO)4UjY;+n0X*f?L? z2Ix^peD^@b_H4x1UtHb$I0VsMxA@i^FMOQ`qZUd5^#3)Xvr9gv0Kh15y2JnlCRC;*&CF`Qu2x z4Gdl3XgNjE4?)deNW1j7PR_N>H=ebC$Qy0qs`dV}U^+}3oJ|JgTCQx39b;t%cNL+} z5VThYAttp#z3->Q0C5NE+h={U)D{+gMhoA?+rB;)Jt6d3K*Y#(&^Mr6h|QqFsJ0I% z3XW(lDcO=%pCWbQu`QY6NFDz4TvqCgcc|n2fp>HDt>2s4YKpq}z3C`gcpJQz)}Je; za&*hEw$7nq2qiq|SqCL4JL^;0)9sr_A}NnoBX**Aw~~4qOs2;iQhelsdsxR^-`YR0 zdqR)1a5-I(x#h_4m{4|(6C<0Clyl@h)=?zFr>7?j^%V9brR%!b{!jbuv?qIsEUB*Z zOwD!pBzjqHojjqfpEwp;h-esERqjaMIw8^#JtlXy>`JL~J91^T`FdmmM8fjk{9J^utUsenIf=(ma$~ z7w0JLjBai7FG`4Vk~`cKXIFf48!{R2-((QjX|Jq$OEQUQ4Vst1cdF<;FXQW*h=MW8 z{?OPVuQDJZDQ&8jNzlChaQb2o$&FHH#;L7e#C;G*HVloDGCJEIGv)X!(LHi@uHq}C zwHLe1p>ND^TsL*!N%SopN%Uowl)tc<7Tk~*W=WutRb}-hFO0wU9Eu!uBT}|oppulI za(`KN(+z2{)@KjNXJgfMGC^i_IRnG-SEArQNP0ge^aNw-4(8W#pFL0Zm;_$Cw*vz< z{7~-RLD;E?2$3HOjgBlFuMN33lxxU{F{df~VCU+sc3K%LWXb&eozjyk^DYyZ$l1!`x|oY~;b3pegJ1>rwS5^Q73CB6o3mBSoIlxEo(yaOJ`oLbnx-)6++m zBxY7Bp@L$7(!@>~sJ{T+AxZ!rap^|2Y~!uz){uC%Wg5tj({xv(BO%#PE4{g+#~QTF zq!yXmuh|qLSpW&B-qLKTY-YW+BEUr4|3dA4?kBYPf6c&)o?t#;NM3!gIF)yGUcJU? zg-AYyukSdpj|Pp2MyW*PHto6eto7_wo?To)?reYj)+Zpy+K=*d>j7~`ssQgGhzkGz z?p3zYG20lXeu3p%`#xv$xo)WMoV368)xs!#@gm>`C%Zg=EfD{?z6KK%9h~fG1F@ec z^V(GFD62$Z*SI`~+?2FA`NyACxBj()ukTwFIbQSE?m{iirEF)iamy18!qoHWY*Hxh zt}+=9G`tuv$qd|br01=JZdLy{bA8~H{D73(Aw=8;NEv;SluY1W{G@6R`Iqx1(@ z7^lr&x973hPq&~a-E_!fTNc5_*$ftGl_9Ly$#2f_+X>oz_ZXGSwh^&#?Y`1BR42(9 zF3mkAyPqLc{a?HOA4OwR0{K&#zVLFt)U`BDldg>DrZ@1$YVhyGau5=-YQm1un7?#9 zHHl(;M*XXQH2dr<9ta!~>Gks;|BrU`KfVP#d(IVZII2nj1ch5&3tQ6z*pVPd7wLMF z9|dJqAp?9|P0T6K!_r*JF600*Oy1GXyjiYJdc9Z0&ha1yPR!3tqJQtW_n9wOHbdk+ zUYn0Vlfz}idITYUbYL;00Veas$Lndg++IYmRbOoi)J?nZw!fOlb2W}d;~A)9ja5%U0!H_k$YP@t>-}D~i&$~nbpgs!5D;1^JE-r{xS~SlCZE7G}3fuh~L7LGh z83EHYksqW5&%kA4FD#ttUCkvGcN_iAaT#sTE?(5AjThqTjA1sgD_+F6-=0{&&5@a|<=cr$6c#*e5?Cy0uyLB;r^3`MC z8&5yg)!f5pw!8$m@eDDEzj(s zWjU;Lac}B~Y)|hp=%S?xxUelFW9-)szNVk+ij}?HvxxWC+kF_K%o%dWbUSlX?UVE{ zTEF(9cAs5s!2RQ(3nvzP|1Dpf;Rj5>vSmvr!&sc$*0_>8)~~|ph^^hLl#;s zRrTjQpn8abBpaUe(hSZ&Ou);?W3swOODx`$p(uRR@^T*Z5SgfZ;S@=K61buEJbZj= zPvwZ8i7EKP?nbdnz@6{wG=d8^9g+SvELPV|%lTGd@7H#8 z0wyKjvqG^kO(0|wyI-ue(3P#;leP;8I@4SdMHbL|)47(Kap^DX;v2EEUauW27Z$5T zByoT3Q#B`7NU+;q)hO`Fu)~Rx&TuQ6=SYq$wSoa5&IQEo(RweB7Hn?Uc6?dEcR*AB zzX|)_7gmE`0-8c4ftRj`+MPo#pC+Zf*NaG<5lNTUPXKZPrMS%7 zZTDW>&D>ud409Dl|Jyn^ zE-DhD99&a=kPnP z=BMf?q5Wl;3Q}jZ%kBBUvme%zU?wQEqw}rZW(gD0G7vrPH^pBI0i8r zOIg^RFHgv|Msn#?yk4Get`yg25nj7@|EpE_$(G#}US}2{B{H_XX8PBxav?eI5D02r zY4O`?zZ%+^CSw4v4^%kL_)X5W)(;x2TTU)vVh$?sGNB;fz%~7@@FgMiVMEA27#%oF zbCyc%B)K1abt!n5DLT&`9QW^<@XL1*d}Nu3B)EaRDOyR>M>JU^pvInE@AXam7-vJI z@xqyqwk#y^%hXhL_Xa@8kIV@#uo>hD?|=A`*bN%sqC)Qbj(JQU{77O7TzpB_s5V!AZy|(!TLjzjzum5>VSP1;bMs(64QSm8_z#J&5kzw z2;s4G25RKc_F^@jfnd=k?2mBfzuz_-`y`3SLK2iZTyil!{B1XWg=VTZAeYL|jY%PR zU(5EK#Jw4at(p~55}X6Rak=$i(liKNkFfO%hv9#5!Rr(BIZgQ%+)DteVmztYS1|Kr zVnZ)rk{C*=0-xX)d;ha4m(yniC`T`qm?-Zp4_2VGZf(P~Nd&pyqFiq!3=|sL#qdvXt@oWmTTG|w2qDT`TmJLB2$Niq3uqrv_x0<~gLc0p<*w{Ur5fxQlUko>sT zTL=>`lgTj_nDTuhECNG&n<8f#yuW>-(M=)eURtM_i%~&%CBP{b0vzto&-FjO|*?KCfi%&`BI!Ciz-w zfO@7e4yEm9F3Y_5^0mrF_bSwN;y>TZ`ImM2zMP0`wy{X9Yv9n+?m)b5&tskE3cHJa zv|-p+s?Q+}{j&;y;?s(|1fxaEUKK-Ub@Xz=JxhrB43vtYzG_$?ysDOgMJ|xUW6Xu} zhusm#&Quw>%F*v&utt7EkCacH0~SSwwRR1ji4=&$uA`h``Cj9FLqS1VyyY3cC*Z!z zRN=KiUJWAholdV_L_t}^BtA1dkWT4*!PbZUmq#$YEuxjp&~G+WM1HsEfyPB8W#&?l zkcD6?v5?0;%L|%AGL&+vs9Rp{=0KJt(4I!$Ft>T8%BZM9`jlW5B66D87F`K9VgSAM z%E{mU_q_oYF{;PDpC#q@Z-E4YNlV-1)VcP-!UAApZVnF|QQhW!ED|=)$^?gmyneLc z1);R0luIvLwQQ7aZA+F?x-3glgIB)0ztS}3390;ZE{Qbqpp^5NbF{`VtA6UzD7&+8 znDmm7ln3BaUat%`O4D#A7#b;JH=I3(9MQIBT6yc_2{C~skf6zBqrh9FtKL`F?-j?a z8h8PVY|+t;0Oj{F3PaY0Hlt2C+Rx!xv|nUZHSAc$YwtshWMY`~ zu0BRV$4eMZ3vJs6ggI+K&^)j{?>cTcrb9)*%q33aJ7JN_17K7}?oGhwI< zWBHHCba#N_%cX6^TWi+OuuL_r3Umr3XLX7y;n|tU0&w#vsvckX+e=tSu{0WhqLvvN zWhQ4Nw2B4q#a?P!o(bS3ln)VNd}Htf+^!0M=H#!`YDXj$s=vzW-l&rTHe#M_)X1G| z$%y=jP2`}zY$FIXoRJUt9jGi&y@1PUlq-~6%V+Rrn0@mF%te@_d_y840>}Wq-qowZ zmhZb}H{Fs~ZeT=P*1~ZHd+CSO;??TsSM}S(Od_;W5%z^_zjM9MuIbB**E_*+8GR36 z!YXjCpdHDckOIDV9zz5ve*5ZUUr1PNFZ3vamACG*3S8k%7jzQ^X{!u7gLZd8>uV%; z;#jT#Ks<=g;diB@e-@)Ny(3Gr0mDI{TFA*;MezkY&E?!a+wC^u+2*QnaC$>UzPOC4 zKt(6PPs}i4Cc56w4^Kyth3yng>G(EIbW#{89zxM|Iccs;*FJ( z^2U5JEbWHH@&afcL3@Pbx%iB7C6B9n`-0GH=eJ=6eJiAobzTou@nc2?)l;$pW~-6f zk+o7yZM#Qrbb$3Ux@_G?`L~5au@R;*oN|(wr>D=BRF7V)^T6g;5E3U77NBFWTMTa) zSIjUBdA95Rap)@v6MN(n!1ZgvGUT|ssBFGDpX>-AiNfmLH|e*$zA4px+Y_=z#r)sR z|KAVrHcBd#qp{IEg3mPR0EBIoJX0oP_`thR;$pS?-U} z#IM}fn0lV>os}n_G`#%%GmwwJWylg=yOH^qod>6c5a|mkccL?R!=|T?&JzfGdwyx0 zsIs9Pe5Dodyf$h?nwpvKfGDg39fM6n9yE+(=b z3I+j_$SVC}XpVGhTkLdP3?>#<9whJjKyAoc+Q-=G8PE$LC&*xDiupI!*;ix$rM4}< zL+qta9lzK1(sSj=d(A?t@;siy*O%F*EpI_GKnyeUSuw6Dl&mCVx!=2__gp^y^U~{k z1W;icG3YgeIa=yfL-;lEvlJjzFGV^C&}nm6^_u?82_B=HybD9E7o^sfM=J`G`3CN4 zu})j^SoZpMrwJ7*pzmHnek20N)_j}v`WPth^4t|rSMLh!?-6{PPqqoaw2-nirqJ}V z;duEPZA@V5ZeY=0wvLQY-=QnqR}4W7B+Gg2OQHUw01`3%hc0j-vEpFo-ijs)ToR{TwnflQ#bl zXP(rT{4jxowXd?E#heGu{hRx$UR!|0>l4IP1%1q{NS|n9SfUE3e1DeLT|#@Snsa9xEA$ zu|$o;##BP~P}V`5CL5T2cg!dw{^r&4;%@@9(L^*II3f_q=#OiU!sNCrfl^HvrAVmA z$XC%E-K+4y2e|pE=;ACp&eFnb;n@vI&Qoi&?D;a29zz!s_wQs?j-$Iv%J$rKVqAaQ z%5)?f3nP*|UmhPHn^s3epa$}enxtR3kP^nTE4lM}BTNx1h!GXU@Z@2?cQZQ%4u;PX z=LqE{hl7rFeNUcF*XjsAV6a}8^>+}Bv=guWEnvinqAx@|EqA*n-VJJg)X{QeZ;Vy| z$V)omI`tl5hZewT=G2ghzhDuBT1fk{6UsK|%B1L}M64C4KF?#H_trC%trDFoR4@J% zMJ;AJ6Nq`w5jY4p4BAzoI81IuWZ+*WaU(I>VK^*F42i?ISvmE10xGuCMCc`ybtYKu#`IiEnG7IOB3MX=`Y>?xNg}JjJsQz5Ch@;zpSsW zl8w*9lfpxVcqUc`LLd!0edT6r#mULZ65tLOA7kI5Qs4v492+{@Z@XqBy$ua(j5Mz3 zKMv9H0oo=x?wW9&;V-*?Ns4dJ74Ae^Q&T3Vwb8--&iigGtFLZC5j7AfqiYE8^;O4l z-JV7Nm?)H-r;sd}8A&nXE=M*L->$6Hf^;S?@aHE%tdTJyDf~$U1B8?E1`F>cimB*b zOL5Hsfu%OrXLRx}l<*xfk<;*pYh2ht6fF4k^t(+Dsp^>Mm@lH4Pb=5_ZfjD8$6xMt zlMVS6Oo`^h)e%k-n7UqYeATg2i>8+~zRUwShfl9(S#^-G9``euXrF=V<;CUlg2-v(N7=2#k-O+Ca73#TgK-0|3Ub zH_K(;1N=$8swP;b+_>trO)tlcUmP>*#ElX`W~S?95{|&5`Wra@NIW#9{=93 zegp}(Y47B_7;cMu0h)kf2u=d1qrKcPV8q3>-y3^Caj4snEaWC+y5DP@B&PirE0ka( zUFL2kheA)^LIb_O6_m0FjkQ;LcW8WqShbCzv{bFU7NtzFiZ>i1xPWx@P1nPPa_p|t zg57a6>K#$MXHmX5F*%phENJ~Or<*Rke=nL@(aAxDJooN=z^m%7rA1*Jdv^CQ?%LKo z8b%s5Qnsr$b&Xm^WU1jbT@FRLE)s}9LP8g%p}z1w%|VM;_VMh}f$heImr3{7#D>d; z(1NEfc#-y3SUr=s#~NR*ZW z1xEyd^wYOT3cfkULSnB?dMM<1I~u^n8*&)@Dm?Phf8A#iNj{N7;>L{|>sW!~HIf-Q zIpXX|hVyV<*Y00va|BPMPjjZWn=EPfS(dMs84pzf)eIY7~7#M^HsY zI;kM;{7s zf4<*;Zhx7Osz8IiGu`{;%a;R|(Ivx`R$r>d=GJAQa76FRkuq)|=v0{Xw|#xr`#l4f z&vnwbEc*zwqy_h$jM^YeiHk2Lnxqdx@w56P&UD;g4T2-mh>c9gZR6{?^obtaP$`=t z9k0g%U%hTpQ{RqeQ2ZQ2`Q!eYd{*>1zdW>An~5SwteXS3N#1RYyQihCZMi|mTjS=< zn?*~UGobl2`F^?S)736xte*zOzulvy zAf!J^j>gBwTf~hB9Rq35Y&LqmPKcJa+0ABB7~+39IdlgXM0>QvAA%g0`$@%6Onm%v zsEF}eV%brQ9y{qr?_qrUsoK=kl=UK;m-z42=m%>gU$5on=1vlDDO#8)b7PIrPC7lH zm0V2oSnq?-{K(poCKa}iu+MtRxchf2#>BTa6SuIXz71uzR#_Di>v}4`ef!qO>#6SV z1`(m6I_vyhJ;^d;ypD3~HO<)ASg#owQ?KK9*gp9HLSbfLU?@js)coD@ z52!>`%FbU{0@=}T>N`bs*tZTd&YL^f5S}TG0AHW`10CN+^$J^SdwUIU0?x|OyK|^1 z;`5r(T`WS5Of6YII&If1h)%t_$>dY{_t@DtG5?rBk0fE*U&NHq)=rIM*DZ4E5vF|B z*;i~-9ztEC3MY(gF2hBo3hoX1Su{4JhGIk*dcU%ce!fBg|1zb6_b0`AE#62QP$CWm!iSz zwLq-TZl9Fki|0w3y+{j;6Lg?SW93d@FdCBKv zYnc0Z*YJZ<{Qzup7oS+>wJ+Bg8QZ08N9UH&YlHet9-Bw6@Pr(l#<4=xvghU&7G9s@ zw60b9L|&ZlaWN*U;lA)K;`cY4j~+F!I~8oh-H{_j;U*4cAKzkY*|`kDFs@#!{KECH z5n+_P&3p2_Y($AOa5u`0()jjmKj(yJ>FLFQDdWlJ*$_@jPA+t7I1G3e9bHGsf=lz; zYCcH~^Ys>mTun%Cw($2v9-HyinYdbIulx5CKq)8_(D3|o&JNx0-#>ioF4SxhAMNwn zqbf8s^t2&Lq!{%@T6$Ji)@}>FqUopEj=cwSjK7Z{95iRRfHz6zpiOP&LYjvHFy#(Z z!^X`R*w_^6K6>zd-(AWc&l}!(RW*LK=8AGY86hFz>kSLm@iM8_)>Z{(R@Om)---rg zv`%+*cYpRt7!q@YDsZjKIW&JFHFKqjX1RsT}-lwtKY5{o0$AEJIJbC%~YYv=)^%^;b7vl zJgf}+fs(yUsEVAljLf!$eqml-o3z~M+*IXosj%JgnDu3+CO}d0TPz-E>J}H-cLiYD*b|~tblgF+`s%)aCmr21X zt1tVpXpjtzs@EPF4l(_JFfFP?M`u-M=BEDbQG7*|(7=R`^h!8Sh+x5nV#isPNl;DAUu^ zyHI%CV!7NbG(6l<>iH7=pNoSuw2mJ3{N4*&-`=jOVnKQNKozF405S#cWlrPp9g?7Z zV@{?&H>Aya*pR5mXGTXgUvVX))xpLEV39DYHTtijR3*qzp>_!0Vc{w#Cua$HrqiF} zv=GK=gFSD3>5lQj>W|~W;@xDZij1EM7Ng3|&ArLVDOFN<(+BI1)g}iT#$WmlrHIQP zzC(WXvC~01a)|+%l|3pY<)zPQhvJ#aRs|HVo+HhW{NuW|0nl9iQvaX=9HiA@;TZzS z|Dx0Pj3|O^4|$Q!pvl09z17;*<}Rq&B=*}biSQ$Z^{Do#Qj`ubou5aKu`n^AeWLip ziju^RLr(q*a`_gYS4U)IWX!z-27Z6d2;?*zs)D6$y{?IR?Ta6cMb94{u|@i?)7svh zTrr&Q`o5tqBlBVKqNnKZmqkJehue-kzA}6zIgE&Hz&Uz$R;2M2GPr}?U2@4?H}kW7NG5pK{$TK9UT6{#>2=WtX!Bh2LfUrBBigG2m;)r{;G2>2v;f<9XoO z0|(UIiH4I`5cSCo4aFdq5*@0ei;9iST{33e!KIaCqM>P$&BVR<$2}b0hDk*k^*A#G z{ItE#Uu-OnUK@Se?N@x9DZ5ME0y!nxy%X3V0n}z>Y#exh*Z+4P0fEfQ3_CbIx318VXK*WYRAkJpQ#@&<`c{NaI8-2q?!LWc-S7AXj@ z_d)((FG(ZG8~kk%M?W5+t2jhNc`4LlTz1pqXQE25F;PUsl>F%f;eZcxE|bF0>hs`W z0hO?>P5n_G6nDr7GcMpqMV80Cqo_CpJpaAOJcuTiGT+_2^oKR5Y{g*F+xv z)pc~zw!1Effm?)Kx`=-81w~Uz!fd!Vv-&zu1m4MU&AZ2`8i}AT9iN){w^4xt>!dN&fcChtnOQ-ZL$$o^`bb&( zTwm{r4ZdlAUWC29J=Z4|cFMTq!r|dzo0?RMKcB)^7oOrMSYNqR7*4#`JEyNZFcd=GC;zR%`V z(5Nv+=fF8ZDoo2;{QR0D=PsCTX59V&zB^ztEGDDJ0)O*R;8&D0|Lx(JSk@p^WLXl6 z9y?yd_E7>iWVKC<%#S!YJbb`v;(HqBMTaP9!+ih%MR+3%v+Vvk$w{bTq~hKm8x=%K z9w_hlNS;TqK34EaEGS8xT9NloV|PneSC^WzbLEAExmgVjjnI$~v)-~X|G(T)HmuGM z$zpMq`i~qI)XFX5!C@)yOmX?K70D0f8G^+(lCL*6HSMMrX%8Oke;I^y;Pc(Z5mj7V z+*!8`&wiDS&H00l!+4cVI?O8P6I9W|&{V&~r%y8h=u_C^ z(ohJY@O(HSy%vc3^ZblJ)**tGaISCfj^*IsAU_ai%eH#Kb9Q{sq6M|KOP-M3%t}fk zi4=D`xejjIAU&)6gtVf1;7H4JU}Se2-*S%M-rU?=5q?kj#}Y5nm<>}+h`%Hg=N`D! zx4y4(g0sIA%-pV+(u>a7-`~Aoo-WKe*A#H^w!B_^*q0n55DXt+=Du4npJLvfD&NHM zN|rb`QQY{!g9l3OA`5?;0pRoOR`IPJ-OZSvmbja6;F$I*zxRr2{q^)7^?NWmW$w;D zI9lj&=E+apbL$(k>8Tv}{COF0GzxE_6mfbt!&4GHW2sRWwZP=xrZT!Q zwu@C0Gx`Rp{)P`cYaO2Oc69jrqtI7aJkMznui)(H5_d4J%+>utXL{)mM?jEj)5lR^ zC-qWup#lQFq$L!@i$otjQj$eNMj!}akf0$%G*q=}i6T?VkPwJU30UFllPMet!E5Q9xf2)v&< zLLe^f{--NzCo6p;doyd3zdclXr}k}uD+q)lI}!r>m-ddx$p1c+gQJ_}zjyGvL2D8C zW<+3f*>i~BEXw(7nFi zfy)Q|(fld}G6LR$lD&Vv!N-9f^5~hAKQ-60 zwf%4FpNH`nN*Q(yT>RUG--mH8^-rx0oE#i&tp3}<&zFCpLO($Zjl)O~2*O`3UrYO+ zhj%nJvNB@-=lhMnb;0RK_h=NJpcM0W`{P~xpZ%>J)%5f&|7U@ppCOg*21O{myDIeG z?N7$~pY{$$j*c*N{%8N6pFrne7-0v-6E-^Q^yja^>;Gx)Vx+J7TMz%<02F3{wO~lE z=xrGf0&({D*B)HC|I>q&k)fF$yS=m_#|<`HYm>7v@bf)fp}C%s4fo&!gZI~$sBQV5 z9!!n&42|snYQXQ!YU6jnfWcsZUt6=mnEYo&__sCZ-^{ z($PPU@>@q|m#0R&pJ2YdHH|=={rz<=iNNCU&wKoL9GO|^nHc?NAf1QFhd_|PpLqDm K&>SWL;{O4g+IEZp literal 0 HcmV?d00001 diff --git a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.flat.json b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.flat.json new file mode 100644 index 0000000000..4cf21ad9ef --- /dev/null +++ b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.flat.json @@ -0,0 +1,3109 @@ +{ + "requirements": [ + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.1", + "section_name": "Architecture d'encodage et de nettoyage", + "req_id": "V1.1.1", + "req_description": "Vérifiez que l'entrée est décodée ou non échappée vers une forme canonique une seule fois, elle n'est décodée que lorsque des données codées sous cette forme sont attendues, et que cela est fait avant de traiter davantage l'entrée, par exemple, elle n'est pas effectuée après la validation ou la désinfection de l'entrée.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.1", + "section_name": "Architecture d'encodage et de nettoyage", + "req_id": "V1.1.2", + "req_description": "Vérifiez que l'application effectue l'encodage et l'échappement de sortie soit comme étape finale avant d'être utilisée par l'interpréteur pour lequel elle est destinée, soit par l'interpréteur lui-même.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.1", + "req_description": "Vérifiez que l'encodage de sortie d'une réponse HTTP, d'un document HTML ou d'un document XML est pertinent pour le contexte requis, comme l'encodage des caractères pertinents pour les éléments HTML, les attributs HTML, les commentaires HTML, les CSS ou les champs d'en-tête HTTP, pour éviter de modifier la structure du message ou du document.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.2", + "req_description": "Vérifiez que, lors de la création dynamique d'URL, les données non fiables sont encodées en fonction de leur contexte (par exemple, encodage d'URL ou encodage base64url pour les paramètres de requête ou de chemin). Assurez-vous que seuls les schémas d'URL sûrs sont autorisés (par exemple, interdire javascript: ou data:).", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.3", + "req_description": "Vérifiez que l'encodage ou l'échappement de sortie est utilisé lors de la création dynamique de contenu JavaScript (y compris JSON), pour éviter de modifier la structure du message ou du document (pour éviter l'injection JavaScript et JSON).", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.4", + "req_description": "Vérifiez que la sélection de données ou les requêtes de base de données (par exemple, SQL, HQL, NoSQL, Cypher) utilisent des requêtes paramétrées, des ORM, des Framework d'entités ou sont protégées contre les injections SQL et autres attaques par injection de base de données. Ceci est également pertinent lors de l'écriture de procédures stockées.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.5", + "req_description": "Vérifiez que l’application protège contre l’injection de commandes du système d’exploitation et que les appels du système d’exploitation utilisent des requêtes du système d’exploitation paramétrées ou utilisent un encodage de sortie de ligne de commande contextuelle.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.6", + "req_description": "Vérifiez que l’application protège contre les vulnérabilités d’injection LDAP ou que des contrôles de sécurité spécifiques pour empêcher l’injection LDAP ont été mis en œuvre.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.7", + "req_description": "Vérifiez que l’application est protégée contre les attaques par injection XPath en utilisant la paramétrisation des requêtes ou des requêtes précompilées.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.8", + "req_description": "Vérifiez que les processeurs LaTeX sont configurés de manière sécurisée (par exemple, en n'utilisant pas l'indicateur « --shell-escape ») et qu'une liste d’autorisations de commandes est utilisée pour empêcher les attaques par injection LaTeX.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.9", + "req_description": "Vérifiez que l'application échappe les caractères spéciaux dans les expressions régulières (généralement à l'aide d'une barre oblique inverse) pour éviter qu'ils ne soient mal interprétés comme des métacaractères.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.10", + "req_description": "Vérifiez que l'application est protégée contre les injections CSV et injections de formules. L'application doit respecter les règles d'échappement définies dans les sections 2.6 et 2.7 de la RFC 4180 lors de l'export de contenu CSV. De plus, lors de l'export au format CSV ou vers d'autres formats de tableur (tels que XLS, XLSX ou ODF), les caractères spéciaux (notamment « = », « + », « - », « @ », « \\t » (tabulation) et « \\0 » (caractère null)) doivent être protégés par une apostrophe s'ils apparaissent en premier dans une valeur de champ.", + "L": "3" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.1", + "req_description": "Vérifiez que toutes les entrées HTML non fiables provenant d'éditeurs WYSIWYG ou similaires sont nettoyées à l'aide d'une bibliothèque ou d'une fonctionnalité de Framework de nettoyage HTML bien connue et sécurisée.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.2", + "req_description": "Vérifiez que l'application évite d'utiliser eval() ou d'autres fonctionnalités d'exécution de code dynamique telles que Spring Expression Language (SpEL). En l'absence d'alternative, toute saisie utilisateur incluse doit être nettoyée avant d'être exécutée.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.3", + "req_description": "Vérifiez que les données transmises à un contexte potentiellement dangereux sont préalablement nettoyées pour appliquer des mesures de sécurité, telles qu'autoriser uniquement des caractères sûrs pour ce contexte et raccourcir des entrées trop longues.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.4", + "req_description": "Vérifiez que le contenu Scalable Vector Graphics (SVG) scriptable fourni par l'utilisateur est validé ou nettoyé pour contenir uniquement des balises et des attributs (tels que des graphiques de dessin) qui sont sûrs pour l'application, par exemple, ne contiennent pas de scripts et d'objets étrangers.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.5", + "req_description": "Vérifiez que l'application nettoie ou désactive le contenu du langage de modèle d'expression ou de script fourni par l'utilisateur, tel que les feuilles de style CSS, le Markdown ou XSL, BBCode ou similaire.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.6", + "req_description": "Vérifiez que l'application protège contre les attaques de falsification de requête côté serveur (SSRF), en validant les données non fiables par rapport à une liste d'autorisation de protocoles, de domaines, de chemins et de ports et en nettoyant les caractères potentiellement dangereux avant d'utiliser les données pour appeler un autre service.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.7", + "req_description": "Vérifiez que l'application se protège contre les attaques par injection de modèles en interdisant la création de modèles basés sur des entrées non fiables. En l'absence d'alternative, toute entrée non fiable incluse dynamiquement lors de la création du modèle doit être nettoyée ou rigoureusement validée.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.8", + "req_description": "Vérifiez que l’application nettoie correctement les entrées non fiables avant utilisation dans les requêtes Java Naming and Directory Interface (JNDI) et que JNDI est configuré de manière sécurisée pour empêcher les attaques par injection JNDI.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.9", + "req_description": "Vérifiez que l’application nettoie le contenu avant qu’il ne soit envoyé à memcache pour éviter les attaques par injection.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.10", + "req_description": "Vérifiez que les chaînes de format susceptibles d'être résolues de manière inattendue ou malveillante lors de leur utilisation sont nettoyées avant d'être traitées.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.11", + "req_description": "Vérifiez que l'application nettoie les entrées utilisateur avant de les transmettre aux systèmes de messagerie pour se protéger contre l'injection SMTP ou IMAP.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.12", + "req_description": "Vérifiez que les expressions régulières sont exemptes d'éléments provoquant \"backtracking\" exponentiel et assurez-vous que les entrées non fiables sont nettoyées pour atténuer les attaques ReDoS ou Runaway Regex.", + "L": "3" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.4", + "section_name": "Mémoire, chaine de caractères et code à mémoire non-managée", + "req_id": "V1.4.1", + "req_description": "Vérifiez que l'application utilise des chaînes memory-safe, une copie de mémoire et une arithmétique de pointeur renforcée pour détecter ou empêcher les débordements de pile, de tampon ou de tas.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.4", + "section_name": "Mémoire, chaine de caractères et code à mémoire non-managée", + "req_id": "V1.4.2", + "req_description": "Vérifiez que les techniques de validation du signe, de la plage et de l’entrée sont utilisées pour éviter les dépassements d’entiers.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.4", + "section_name": "Mémoire, chaine de caractères et code à mémoire non-managée", + "req_id": "V1.4.3", + "req_description": "Vérifiez que la mémoire et les ressources allouées dynamiquement sont libérées et que les références ou les pointeurs vers la mémoire libérée sont supprimés ou définis à null pour éviter les \"dangling pointer\" et les vulnérabilités d'utilisation après libération.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.5", + "section_name": "Désérialisation sécurisée", + "req_id": "V1.5.1", + "req_description": "Vérifiez que l'application configure les \"parser\" XML pour utiliser une configuration restrictive et que les fonctionnalités non sûres telles que la résolution d'entités externes sont désactivées pour empêcher les attaques XML eXternal Entity (XXE).", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.5", + "section_name": "Désérialisation sécurisée", + "req_id": "V1.5.2", + "req_description": "Vérifiez que la désérialisation des données non fiables garantit une gestion sécurisée des entrées, par exemple en utilisant une liste d'autorisation de types d'objets ou en limitant les types d'objets définis par le client, afin d'empêcher les attaques par désérialisation. Les mécanismes de désérialisation explicitement définis comme non sécurisés ne doivent pas être utilisés avec des entrées non fiables.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.5", + "section_name": "Désérialisation sécurisée", + "req_id": "V1.5.3", + "req_description": "Vérifiez que les différents \"parser\" utilisés dans l'application pour le même type de données (par exemple, les \"parser\" JSON, les \"parser\" XML, les \"parser\" d'URL) effectuent l'analyse de manière cohérente et utilisent le même mécanisme d'encodage de caractères pour éviter des problèmes tels que les vulnérabilités d'interopérabilité JSON ou un comportement d'analyse d'URI ou de fichier différent exploité dans les attaques d'inclusion de fichiers à distance (RFI) ou de falsification de requête côté serveur (SSRF).", + "L": "3" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.1", + "section_name": "Validation et documentation de la logique métier", + "req_id": "V2.1.1", + "req_description": "Vérifiez que la documentation de l'application définit des règles de validation des entrées pour vérifier la validité des éléments de données par rapport à la structure attendue. Il peut s'agir de formats de données courants tels que des numéros de carte de crédit, des adresses e-mail ou des numéros de téléphone, ou d'un format de données interne.", + "L": "1" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.1", + "section_name": "Validation et documentation de la logique métier", + "req_id": "V2.1.2", + "req_description": "Vérifiez que la documentation de l'application définit comment valider la cohérence logique et contextuelle des éléments de données combinés, par exemple en vérifiant que la banlieue et le code postal correspondent.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.1", + "section_name": "Validation et documentation de la logique métier", + "req_id": "V2.1.3", + "req_description": "Vérifiez que les attentes en matière de limites et de validations de la logique métier sont documentées, y compris par utilisateur et globalement dans l'application.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.2", + "section_name": "Validation des entrées", + "req_id": "V2.2.1", + "req_description": "Vérifier que les entrées sont validées afin de respecter les attentes métier ou fonctionnelles. Cette validation doit être basée sur une liste de valeurs, de modèles et de plages autorisées, ou sur la comparaison des entrées avec une structure attendue et des limites logiques selon des règles prédéfinies. Pour le niveau 1, cette validation peut se concentrer sur les entrées utilisées pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau 2, elle doit s'appliquer à toutes les entrées.", + "L": "1" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.2", + "section_name": "Validation des entrées", + "req_id": "V2.2.2", + "req_description": "Vérifiez que l'application est conçue pour appliquer la validation des entrées au niveau d'une couche de service de confiance. Bien que la validation côté client améliore l'ergonomie et doit être encouragée, elle ne doit pas être considérée comme un contrôle de sécurité.", + "L": "1" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.2", + "section_name": "Validation des entrées", + "req_id": "V2.2.3", + "req_description": "Vérifiez que l’application garantit que les combinaisons d’éléments de données associés sont raisonnables selon les règles prédéfinies.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.3", + "section_name": "Sécurité de la logique métier", + "req_id": "V2.3.1", + "req_description": "Vérifiez que l’application traitera uniquement les flux de logique métier pour le même utilisateur dans l’ordre séquentiel attendu et sans sauter d’étapes.", + "L": "1" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.3", + "section_name": "Sécurité de la logique métier", + "req_id": "V2.3.2", + "req_description": "Vérifiez que les limites de la logique métier sont implémentées conformément à la documentation de l'application, afin d'éviter que des failles de la logique métier ne soient pas exploitées.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.3", + "section_name": "Sécurité de la logique métier", + "req_id": "V2.3.3", + "req_description": "Vérifiez que les transactions sont utilisées au niveau de la logique métier de telle sorte qu'une opération de logique métier réussisse dans son intégralité ou qu'elle soit restaurée à l'état correct précédent.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.3", + "section_name": "Sécurité de la logique métier", + "req_id": "V2.3.4", + "req_description": "Vérifiez que les mécanismes de verrouillage au niveau de la logique métier sont utilisés pour garantir que les ressources en quantité limitée (telles que les sièges de théâtre ou les créneaux de livraison) ne peuvent pas être réservées deux fois en manipulant la logique de l'application.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.3", + "section_name": "Sécurité de la logique métier", + "req_id": "V2.3.5", + "req_description": "Vérifiez que les flux logiques métier à forte valeur ajoutée nécessitent l'approbation de plusieurs utilisateurs afin d'éviter toute action non autorisée ou accidentelle. Cela peut inclure, sans s'y limiter, les transferts monétaires importants, les approbations de contrats, l'accès à des informations classifiées ou les contournements de sécurité dans le secteur manufacturier.", + "L": "3" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.4", + "section_name": "Anti-automatisation", + "req_id": "V2.4.1", + "req_description": "Vérifiez que des contrôles anti-automatisation sont en place pour protéger contre les appels excessifs aux fonctions d'application qui pourraient conduire à l'exfiltration de données, à la création de données inutiles, à l'épuisement des quotas, aux violations de limites de débit, au déni de service ou à la surutilisation de ressources coûteuses.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.4", + "section_name": "Anti-automatisation", + "req_id": "V2.4.2", + "req_description": "Vérifiez que les flux logiques métier nécessitent un timing humain réaliste, évitant ainsi des soumissions de transactions excessivement rapides.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.1", + "section_name": "Documentation sur la sécurité du frontend Web", + "req_id": "V3.1.1", + "req_description": "Vérifiez que la documentation de l'application indique les fonctionnalités de sécurité attendues que les navigateurs utilisant l'application doivent prendre en charge (telles que HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) et autres mécanismes de sécurité HTTP pertinents). Elle doit également définir le comportement de l'application lorsque certaines de ces fonctionnalités ne sont pas disponibles (par exemple, avertir l'utilisateur ou bloquer l'accès).", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.2", + "section_name": "Interprétation non intentionnelle du contenu", + "req_id": "V3.2.1", + "req_description": "Vérifiez que des contrôles de sécurité sont en place pour empêcher les navigateurs d'afficher du contenu ou des fonctionnalités dans les réponses HTTP dans un contexte incorrect (par exemple, lorsqu'une API, un fichier téléchargé par l'utilisateur ou une autre ressource est demandée directement). Les contrôles possibles peuvent inclure : ne pas transmettre le contenu sauf si les champs d'en-tête de requête HTTP (tels que Sec-Fetch-\\*) indiquent qu'il s'agit du contexte correct, utiliser la directive sandbox du champ d'en-tête Content-Security-Policy ou utiliser le type de disposition de pièce jointe dans le champ d'en-tête Content-Disposition.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.2", + "section_name": "Interprétation non intentionnelle du contenu", + "req_id": "V3.2.2", + "req_description": "Vérifiez que le contenu destiné à être affiché sous forme de texte, plutôt que rendu sous forme de HTML, est géré à l'aide de fonctions de rendu sécurisées (telles que createTextNode ou textContent) pour empêcher l'exécution involontaire de contenu tel que HTML ou JavaScript.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.2", + "section_name": "Interprétation non intentionnelle du contenu", + "req_id": "V3.2.3", + "req_description": "Vérifiez que l'application évite l'écrasement du DOM lors de l'utilisation de JavaScript côté client en utilisant des déclarations de variables explicites, en effectuant une vérification de type stricte, en évitant de stocker des variables globales sur l'objet document et en implémentant l'isolation de l'espace de nommage.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.3", + "section_name": "Configuration des cookies", + "req_id": "V3.3.1", + "req_description": "Vérifiez que les cookies ont l'attribut « Secure » ​​défini et si le préfixe « \\__Host- » n'est pas utilisé pour le nom du cookie, le préfixe « __Secure- » doit être utilisé pour le nom du cookie.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.3", + "section_name": "Configuration des cookies", + "req_id": "V3.3.2", + "req_description": "Vérifiez que la valeur de l'attribut « SameSite » de chaque cookie est définie en fonction de l'objectif du cookie, afin de limiter l'exposition aux attaques de réparation de l'interface utilisateur et aux attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.3", + "section_name": "Configuration des cookies", + "req_id": "V3.3.3", + "req_description": "Vérifiez que les cookies ont le préfixe « __Host- » pour le nom du cookie, sauf s'ils sont explicitement conçus pour être partagés avec d'autres hôtes.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.3", + "section_name": "Configuration des cookies", + "req_id": "V3.3.4", + "req_description": "Vérifiez que si la valeur d'un cookie n'est pas censée être accessible aux scripts côté client (comme un jeton de session), le cookie doit avoir l'attribut « HttpOnly » défini et la même valeur (par exemple, un jeton de session) ne doit être transférée au client que via le champ d'en-tête « Set-Cookie ».", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.3", + "section_name": "Configuration des cookies", + "req_id": "V3.3.5", + "req_description": "Vérifiez que lorsque l'application écrit un cookie, la longueur combinée du nom et de la valeur du cookie ne dépasse pas 4 096 octets. Les cookies trop volumineux ne seront pas stockés par le navigateur et ne seront donc pas envoyés avec les requêtes, empêchant ainsi l'utilisateur d'utiliser les fonctionnalités de l'application qui reposent sur ce cookie.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.4", + "section_name": "En-têtes du mécanisme de sécurité du navigateur", + "req_id": "V3.4.1", + "req_description": "Vérifiez qu'un champ d'en-tête Strict-Transport-Security est inclus dans toutes les réponses afin d'appliquer une politique HTTP Strict Transport Security (HSTS). Une durée maximale d'au moins un an doit être définie, et pour les niveaux L2 et supérieurs, la politique doit également s'appliquer à tous les sous-domaines.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.4", + "section_name": "En-têtes du mécanisme de sécurité du navigateur", + "req_id": "V3.4.2", + "req_description": "Vérifiez que le champ d'en-tête Access-Control-Allow-Origin du partage de ressources cross-origine (CORS) est une valeur fixe de l'application ou, si la valeur du champ d'en-tête de requête HTTP Origin est utilisée, qu'elle est validée par rapport à une liste d'origines approuvées. Si « Access-Control-Allow-Origin: * » doit être utilisé, vérifiez que la réponse ne contient aucune information sensible.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.4", + "section_name": "En-têtes du mécanisme de sécurité du navigateur", + "req_id": "V3.4.3", + "req_description": "Vérifiez que les réponses HTTP incluent un champ d'en-tête de réponse Content-Security-Policy qui définit des directives garantissant que le navigateur charge et exécute uniquement du contenu ou des ressources fiables, afin de limiter l'exécution de JavaScript malveillant. Au minimum, une politique globale doit être utilisée, incluant les directives object-src 'none' et base-uri 'none', et définissant soit une lliste d’autorisations, soit des valeurs nonces ou des hachages. Pour une application L3, une politique par réponse avec des valeurs nonces ou des hachages doit être définie.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.4", + "section_name": "En-têtes du mécanisme de sécurité du navigateur", + "req_id": "V3.4.4", + "req_description": "Vérifiez que toutes les réponses HTTP contiennent un champ d'en-tête « X-Content-Type-Options: nosniff ». Cela indique aux navigateurs de ne pas utiliser l'analyse de contenu ni la détection du type MIME pour la réponse donnée, et d'exiger que la valeur du champ d'en-tête « Content-Type » de la réponse corresponde à la ressource de destination. Par exemple, la réponse à une demande de style n'est acceptée que si le type de contenu de la réponse est « text/css ». Cela permet également au navigateur d'utiliser la fonctionnalité de blocage de lecture inter-origines (CORB).", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.4", + "section_name": "En-têtes du mécanisme de sécurité du navigateur", + "req_id": "V3.4.5", + "req_description": "Vérifiez que l'application définit une politique de référencement afin d'empêcher la fuite de données techniquement sensibles vers des services tiers via le champ d'en-tête de requête HTTP « Referer ». Cela peut être effectué via le champ d'en-tête de réponse HTTP « Referrer-Policy » ou via les attributs d'élément HTML. Les données sensibles peuvent inclure le chemin d'accès et les données de requête dans l'URL, et pour les applications internes non publiques, le nom d'hôte.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.4", + "section_name": "En-têtes du mécanisme de sécurité du navigateur", + "req_id": "V3.4.6", + "req_description": "Vérifiez que l'application Web utilise la directive frame-ancestors du champ d'en-tête Content-Security-Policy pour chaque réponse HTTP afin de garantir qu'elle ne peut pas être intégrée par défaut et que l'intégration de ressources spécifiques n'est autorisée qu'en cas de nécessité. Notez que le champ d'en-tête X-Frame-Options, bien que pris en charge par les navigateurs, est obsolète et n'est pas forcément fiable.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.4", + "section_name": "En-têtes du mécanisme de sécurité du navigateur", + "req_id": "V3.4.7", + "req_description": "Vérifiez que le champ d’en-tête Content-Security-Policy spécifie un emplacement pour signaler les violations.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.4", + "section_name": "En-têtes du mécanisme de sécurité du navigateur", + "req_id": "V3.4.8", + "req_description": "Vérifiez que toutes les réponses HTTP qui lancent le rendu d'un document (comme les réponses de type text/html) incluent le champ d'en-tête 'Cross-Origin-Opener-Policy' avec la directive 'same-origin' ou s'ame-origin-allow-popups', selon les besoins. Cela empêche les attaques abusant de l'accès partagé aux objets Window, telles que le tabnabbing et le comptage d'images.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.5", + "section_name": "Séparation de l'origine du navigateur", + "req_id": "V3.5.1", + "req_description": "Vérifiez que, si l'application ne s'appuie pas sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher les requêtes inter-origines non autorisées d'utiliser des fonctionnalités sensibles, ces requêtes sont validées afin de garantir leur origine. Cela peut se faire en utilisant et en validant des jetons anti-falsification ou en exigeant des champs d'en-tête HTTP supplémentaires qui ne sont pas des champs d'en-tête de requête CORS safelist. Ceci permet de se protéger contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.5", + "section_name": "Séparation de l'origine du navigateur", + "req_id": "V3.5.2", + "req_description": "Vérifiez que, si l'application s'appuie sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher l'utilisation inter-origines non autorisée de fonctionnalités sensibles, il est impossible d'appeler la fonctionnalité avec une requête qui ne déclenche pas de requête de pré-vérification cross-origin CORS. Cela peut nécessiter de vérifier les valeurs des champs d'en-tête de requête 'Origin' et 'Content-Type' ou d'utiliser un champ d'en-tête supplémentaire qui n'est pas un champ d'en-tête de la liste de sécurité CORS.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.5", + "section_name": "Séparation de l'origine du navigateur", + "req_id": "V3.5.3", + "req_description": "Vérifiez que les requêtes HTTP destinées aux fonctionnalités sensibles utilisent des méthodes HTTP appropriées, telles que POST, PUT, PATCH ou DELETE, et non des méthodes définies comme « sûres » par la spécification HTTP, telles que HEAD, OPTIONS ou GET. Une validation stricte des champs d'en-tête de requête Sec-Fetch-* peut également être utilisée pour garantir que la requête ne provient pas d'un appel inter-origines inapproprié, d'une requête de navigation ou d'un chargement de ressources (comme une source d'image) inattendu.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.5", + "section_name": "Séparation de l'origine du navigateur", + "req_id": "V3.5.4", + "req_description": "Vérifiez que des applications distinctes sont hébergées sur des noms d'hôte différents pour tirer parti des restrictions fournies par la politique de même origine, y compris la manière dont les documents ou scripts chargés par une origine peuvent interagir avec les ressources d'une autre origine et les restrictions basées sur le nom d'hôte sur les cookies.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.5", + "section_name": "Séparation de l'origine du navigateur", + "req_id": "V3.5.5", + "req_description": "Vérifiez que les messages reçus par l'interface postMessage sont rejetés si l'origine du message n'est pas digne de confiance ou si la syntaxe du message n'est pas valide.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.5", + "section_name": "Séparation de l'origine du navigateur", + "req_id": "V3.5.6", + "req_description": "Vérifiez que la fonctionnalité JSONP n'est activée nulle part dans l'application pour éviter les attaques Cross-Site Script Inclusion (XSSI).", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.5", + "section_name": "Séparation de l'origine du navigateur", + "req_id": "V3.5.7", + "req_description": "Vérifiez que les données nécessitant une autorisation ne sont pas incluses dans les réponses des ressources de script, comme les fichiers JavaScript, pour empêcher les attaques par inclusion de script intersite (XSSI).", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.5", + "section_name": "Séparation de l'origine du navigateur", + "req_id": "V3.5.8", + "req_description": "Vérifiez que les ressources authentifiées (telles que les images, les vidéos, les scripts et autres documents) peuvent être chargées ou intégrées pour le compte de l'utilisateur uniquement lorsque cela est prévu. Cela peut être réalisé en validant strictement les champs d'en-tête de requête HTTP Sec-Fetch-* afin de garantir que la requête ne provient pas d'un appel cross-origin inapproprié, ou en définissant un champ d'en-tête de réponse HTTP Cross-Origin-Resource-Policy restrictif pour indiquer au navigateur de bloquer le contenu renvoyé.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.6", + "section_name": "Intégrité des ressources externes", + "req_id": "V3.6.1", + "req_description": "Vérifiez que les ressources côté client, telles que les bibliothèques JavaScript, les feuilles de style CSS ou les polices web, sont hébergées en externe (par exemple, sur un réseau de diffusion de contenu) uniquement si la ressource est statique et versionnée, et si l'intégrité des sous-ressources (SRI) est utilisée pour valider l'intégrité de la ressource. Si cela n'est pas possible, une décision de sécurité documentée doit justifier cette décision pour chaque ressource.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.7", + "section_name": "Autres considérations sur la sécurité du navigateur", + "req_id": "V3.7.1", + "req_description": "Vérifiez que l'application utilise uniquement des technologies côté client toujours prises en charge et considérées comme sécurisées. Parmi les technologies qui ne répondent pas à cette exigence figurent les plugins NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL ou les applets Java côté client.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.7", + "section_name": "Autres considérations sur la sécurité du navigateur", + "req_id": "V3.7.2", + "req_description": "Vérifiez que l'application redirigera automatiquement l'utilisateur vers un nom d'hôte ou un domaine différent (qui n'est pas contrôlé par l'application) uniquement lorsque la destination apparaît sur une liste d'autorisation.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.7", + "section_name": "Autres considérations sur la sécurité du navigateur", + "req_id": "V3.7.3", + "req_description": "Vérifiez que le domaine de premier niveau de l'application (par exemple, site.tld) ​​est ajouté à la liste de préchargement publique pour HTTP Strict Transport Security (HSTS). Cela garantit que l'utilisation de TLS pour l'application est intégrée directement dans les principaux navigateurs, plutôt que de dépendre uniquement du champ d'en-tête de réponse Strict-Transport-Security.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.7", + "section_name": "Autres considérations sur la sécurité du navigateur", + "req_id": "V3.7.4", + "req_description": "Vérifiez que l'application affiche une notification lorsque l'utilisateur est redirigé vers une URL hors du contrôle de l'application, avec une option pour annuler la navigation.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.7", + "section_name": "Autres considérations sur la sécurité du navigateur", + "req_id": "V3.7.5", + "req_description": "Vérifiez que l'application se comporte comme documenté (par exemple, en avertissant l'utilisateur ou en bloquant l'accès) si le navigateur utilisé pour accéder à l'application ne prend pas en charge les fonctionnalités de sécurité attendues.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.1", + "section_name": "Sécurité du service Web générique", + "req_id": "V4.1.1", + "req_description": "Vérifiez que chaque réponse HTTP avec un corps de message contient un champ d'en-tête Content-Type qui correspond au contenu réel de la réponse, y compris le paramètre charset pour spécifier un codage de caractères sécurisé (par exemple, UTF-8, ISO-8859-1) conformément aux types de médias IANA, tels que « text/ », « /+xml » et « /xml ».", + "L": "1" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.1", + "section_name": "Sécurité du service Web générique", + "req_id": "V4.1.2", + "req_description": "Vérifiez que seuls les terminaux utilisateurs (destinés à l'accès manuel via un navigateur web) redirigent automatiquement de HTTP vers HTTPS, tandis que les autres services ou terminaux n'implémentent pas de redirections transparentes. Cela permet d'éviter qu'un client envoie par erreur des requêtes HTTP non chiffrées, mais que, comme ces requêtes sont automatiquement redirigées vers HTTPS, la fuite de données sensibles passe inaperçue.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.1", + "section_name": "Sécurité du service Web générique", + "req_id": "V4.1.3", + "req_description": "Vérifiez que tout champ d'en-tête HTTP utilisé par l'application et défini par une couche intermédiaire, telle qu'un équilibreur de charge, un proxy web ou un service backend-for-frontend, ne peut pas être remplacé par l'utilisateur final. Les exemples d'en-têtes peuvent inclure X-Real-IP, X-Forwarded-*, ou X-User-ID.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.1", + "section_name": "Sécurité du service Web générique", + "req_id": "V4.1.4", + "req_description": "Vérifiez que seules les méthodes HTTP explicitement prises en charge par l'application ou son API (y compris les OPTIONS lors des demandes de contrôle en amont) peuvent être utilisées et que les méthodes inutilisées sont bloquées.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.1", + "section_name": "Sécurité du service Web générique", + "req_id": "V4.1.5", + "req_description": "Vérifier que les signatures numériques par message sont utilisées pour fournir une assurance supplémentaire en plus des protections de transport pour les demandes ou les transactions qui sont très sensibles ou qui traversent un certain nombre de systèmes.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.2", + "section_name": "Validation de la structure des messages HTTP", + "req_id": "V4.2.1", + "req_description": "Vérifiez que tous les composants de l'application (y compris les équilibreurs de charge, les pares-feux et les serveurs d'applications) déterminent les limites des messages HTTP entrants à l'aide du mécanisme approprié à la version HTTP afin d'empêcher la contrebande de requêtes HTTP. Dans HTTP/1.x, si un champ d'en-tête Transfer-Encoding est présent, l'en-tête Content-Length doit être ignoré conformément à la RFC 2616. Avec HTTP/2 ou HTTP/3, si un champ d'en-tête Content-Length est présent, le récepteur doit s'assurer qu'il est cohérent avec la longueur des trames DATA.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.2", + "section_name": "Validation de la structure des messages HTTP", + "req_id": "V4.2.2", + "req_description": "Vérifier que, lors de la génération de messages HTTP, le champ d'en-tête Content-Length n'entre pas en conflit avec la longueur du contenu déterminée par le cadrage du protocole HTTP, afin d'empêcher les attaques de type « request smuggling ».", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.2", + "section_name": "Validation de la structure des messages HTTP", + "req_id": "V4.2.3", + "req_description": "Vérifiez que l'application n'envoie ni n'accepte de messages HTTP/2 ou HTTP/3 avec des champs d'en-tête spécifiques à la connexion, tels que Transfer-Encoding, afin d'éviter les attaques par fractionnement de la réponse et par injection d'en-tête.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.2", + "section_name": "Validation de la structure des messages HTTP", + "req_id": "V4.2.4", + "req_description": "Vérifiez que l'application n'accepte que les requêtes HTTP/2 et HTTP/3 dont les champs et valeurs d'en-tête ne contiennent pas de séquences CR (\\r), LF (\\n) ou CRLF (\\r\\n), afin d'éviter les attaques par injection d'en-tête.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.2", + "section_name": "Validation de la structure des messages HTTP", + "req_id": "V4.2.5", + "req_description": "Vérifiez que, si l'application (backend ou frontend) construit et envoie des requêtes, elle utilise des mécanismes de validation, d'assainissement ou autres pour éviter de créer des URI (comme pour les appels API) ou des champs d'en-tête de requête HTTP (comme Authorization ou Cookie) qui sont trop longs pour être acceptés par le composant récepteur. Cela pourrait entraîner un déni de service, par exemple lors de l'envoi d'une requête trop longue (par exemple, un long champ d'en-tête de cookie), ce qui fait que le serveur répond toujours avec un statut d'erreur.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.3", + "section_name": "GraphQL", + "req_id": "V4.3.1", + "req_description": "Vérifiez qu'une liste d'autorisation de requête, une limitation de profondeur, une limitation de quantité ou une analyse des coûts de requête est utilisée pour empêcher le déni de service (DoS) de GraphQL ou d'expression de la couche données en raison de requêtes imbriquées coûteuses.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.3", + "section_name": "GraphQL", + "req_id": "V4.3.2", + "req_description": "Vérifiez que les requêtes d’introspection GraphQL sont désactivées dans l’environnement de production, sauf si l’API GraphQL est destinée à être utilisée par d’autres parties.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.1", + "req_description": "Vérifiez que WebSocket sur TLS (WSS) est utilisé pour toutes les connexions WebSocket.", + "L": "1" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.2", + "req_description": "Vérifiez que, lors de la négociation HTTP WebSocket initiale, le champ d’en-tête 'Origin' est vérifié par rapport à une liste d’origines autorisées pour l’application.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.3", + "req_description": "Vérifiez que, si la gestion de session standard de l'application ne peut pas être utilisée, des jetons dédiés sont utilisés à cet effet, qui sont conformes aux exigences de sécurité de gestion de session pertinentes.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.4", + "req_description": "Vérifiez que les jetons de gestion de session WebSocket dédiés sont initialement obtenus ou validés via la session HTTPS précédemment authentifiée lors de la transition d'une session HTTPS existante vers un canal WebSocket.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.1", + "section_name": "Documentation sur la gestion des fichiers", + "req_id": "V5.1.1", + "req_description": "Vérifiez que la documentation définit les types de fichiers autorisés, les extensions de fichiers attendues et la taille maximale (y compris la taille décompressée) pour chaque fonctionnalité de Téléversement. De plus, assurez-vous que la documentation précise comment les fichiers sont sécurisés pour le téléchargement et le traitement des utilisateurs finaux, par exemple le comportement de l'application lorsqu'un fichier malveillant est détecté.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.2", + "section_name": "Téléversement de fichiers et contenu", + "req_id": "V5.2.1", + "req_description": "Vérifiez que l'application n'acceptera que des fichiers d'une taille qu'elle peut traiter sans provoquer de perte de performances ou d'attaque par déni de service.", + "L": "1" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.2", + "section_name": "Téléversement de fichiers et contenu", + "req_id": "V5.2.2", + "req_description": "Vérifiez que lorsque l'application accepte un fichier, seul ou dans une archive telle qu'un fichier zip, elle vérifie si l'extension de fichier correspond à une extension attendue et que le contenu correspond au type représenté par l'extension. Cela inclut, sans s'y limiter, la vérification des « octets magiques » initiaux, la réécriture d'images et l'utilisation de bibliothèques spécialisées pour la validation du contenu des fichiers. Pour le niveau L1, cela peut se concentrer uniquement sur les fichiers utilisés pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau L2, cela doit s'appliquer à tous les fichiers acceptés.", + "L": "1" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.2", + "section_name": "Téléversement de fichiers et contenu", + "req_id": "V5.2.3", + "req_description": "Vérifiez que l'application vérifie les fichiers compressés (par exemple, zip, gz, docx, odt) par rapport à la taille maximale autorisée non compressée et au nombre maximal de fichiers avant de décompresser le fichier.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.2", + "section_name": "Téléversement de fichiers et contenu", + "req_id": "V5.2.4", + "req_description": "Vérifiez qu'un quota de taille de fichier et un nombre maximal de fichiers par utilisateur sont appliqués pour garantir qu'un seul utilisateur ne puisse pas remplir le stockage avec trop de fichiers ou des fichiers excessivement volumineux.", + "L": "3" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.2", + "section_name": "Téléversement de fichiers et contenu", + "req_id": "V5.2.5", + "req_description": "Vérifiez que l'application n'autorise pas le téléversement de fichiers compressés contenant des liens symboliques, sauf si cela est spécifiquement requis (auquel cas il sera nécessaire d'appliquer une liste d'autorisation des fichiers vers lesquels il est possible de créer des liens symboliques).", + "L": "3" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.2", + "section_name": "Téléversement de fichiers et contenu", + "req_id": "V5.2.6", + "req_description": "Vérifiez que l'application rejette les images téléversées avec une taille de pixel supérieure au maximum autorisé, afin d'éviter les attaques par inondation de pixels.", + "L": "3" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.3", + "section_name": "Stockage de fichiers", + "req_id": "V5.3.1", + "req_description": "Vérifiez que les fichiers téléversés ou générés par une entrée non fiable et stockés dans un dossier public ne sont pas exécutés en tant que code de programme côté serveur lorsqu'ils sont accessibles directement avec une requête HTTP.", + "L": "1" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.3", + "section_name": "Stockage de fichiers", + "req_id": "V5.3.2", + "req_description": "Vérifiez que lorsque l'application crée des chemins d'accès pour les opérations sur les fichiers, elle utilise des données générées en interne ou fiables plutôt que des noms de fichiers soumis par l'utilisateur. Si des noms de fichiers ou des métadonnées de fichiers soumis par l'utilisateur doivent être utilisés, une validation et un nettoyage stricts doivent être appliqués. Ceci permet de se protéger contre les attaques par traversée de chemin, l'inclusion de fichiers locaux ou distants (LFI, RFI) et la falsification de requêtes côté serveur (SSRF).", + "L": "1" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.3", + "section_name": "Stockage de fichiers", + "req_id": "V5.3.3", + "req_description": "Vérifiez que le traitement des fichiers côté serveur, comme la décompression des fichiers, ignore les informations de chemin fournies par l'utilisateur pour éviter les vulnérabilités telles que le \"zip slip\".", + "L": "3" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.4", + "section_name": "Téléchargement de fichier", + "req_id": "V5.4.1", + "req_description": "Vérifiez que l’application valide ou ignore les noms de fichiers soumis par l’utilisateur, y compris dans un paramètre JSON, JSONP ou URL et spécifie un nom de fichier dans le champ d’en-tête Content-Disposition de la réponse.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.4", + "section_name": "Téléchargement de fichier", + "req_id": "V5.4.2", + "req_description": "Vérifiez que les noms de fichiers servis (par exemple, dans les champs d'en-tête de réponse HTTP ou les pièces jointes aux e-mails) sont encodés ou nettoyés (par exemple, conformément à la RFC 6266) pour préserver la structure du document et empêcher les attaques par injection.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.4", + "section_name": "Téléchargement de fichier", + "req_id": "V5.4.3", + "req_description": "Vérifiez que les fichiers obtenus à partir de sources non fiables sont analysés par des scanners antivirus pour empêcher la diffusion de contenu malveillant connu.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.1", + "section_name": "Documentation d'authentification", + "req_id": "V6.1.1", + "req_description": "Vérifiez que la documentation de l'application définit comment les contrôles, tels que la limitation de débit, l'anti-automatisation et la réponse adaptative, sont utilisés pour se défendre contre les attaques telles que le « credential stuffing » et la force brute des mots de passe. La documentation doit expliquer clairement comment ces contrôles sont configurés et empêcher le blocage malveillant des comptes.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.1", + "section_name": "Documentation d'authentification", + "req_id": "V6.1.2", + "req_description": "Vérifiez qu'une liste de mots spécifiques au contexte est documentée afin d'empêcher leur utilisation dans les mots de passe. Cette liste peut inclure des permutations de noms d'organisations, de produits, d'identifiants de systèmes, de noms de codes de projets, de noms de services ou de rôles, etc.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.1", + "section_name": "Documentation d'authentification", + "req_id": "V6.1.3", + "req_description": "Vérifiez que, si l'application inclut plusieurs voies d'authentification, celles-ci sont toutes documentées avec les contrôles de sécurité et la force d'authentification qui doivent être appliqués de manière cohérente.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.1", + "req_description": "Vérifiez que les mots de passe définis par l'utilisateur comportent au moins 8 caractères, bien qu'un minimum de 15 caractères soit fortement recommandé.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.2", + "req_description": "Vérifiez que les utilisateurs peuvent modifier leur mot de passe.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.3", + "req_description": "Vérifiez que la fonctionnalité de changement de mot de passe nécessite le mot de passe actuel et le nouveau mot de passe de l'utilisateur.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.4", + "req_description": "Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou du changement de mot de passe sont vérifiés par rapport à un ensemble disponible d'au moins 3 000 mots de passe principaux qui correspondent à la politique de mot de passe de l'application, par exemple la longueur minimale.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.5", + "req_description": "Vérifiez que les mots de passe peuvent être utilisés, quelle que soit leur composition, sans restriction quant au type de caractères autorisés. Aucun nombre minimal de majuscules ou de minuscules, de chiffres ou de caractères spéciaux ne doit être exigé.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.6", + "req_description": "Vérifiez que les champs de saisie du mot de passe utilisent type=password pour masquer la saisie. Les applications peuvent permettre à l'utilisateur d'afficher temporairement l'intégralité du mot de passe masqué ou le dernier caractère saisi.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.7", + "req_description": "Vérifiez que la fonctionnalité « coller », les assistants de mot de passe du navigateur et les gestionnaires de mots de passe externes sont autorisés.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.8", + "req_description": "Vérifiez que l'application vérifie le mot de passe de l'utilisateur exactement tel qu'il a été reçu de l'utilisateur, sans aucune modification telle qu'une troncature ou une transformation de casse.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.9", + "req_description": "Vérifiez que les mots de passe d’au moins 64 caractères sont autorisés.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.10", + "req_description": "Vérifiez que le mot de passe d'un utilisateur reste valide jusqu'à ce qu'il soit découvert comme compromis ou qu'il soit renouvelé. L'application ne doit pas exiger de renouvellement périodique des identifiants.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.11", + "req_description": "Vérifiez que la liste documentée de mots spécifiques au contexte est utilisée pour éviter la création de mots de passe faciles à deviner.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.12", + "req_description": "Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou des modifications de mot de passe sont vérifiés par rapport à un ensemble de mots de passe fuités.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.3", + "section_name": "Sécurité générale de l'authentification", + "req_id": "V6.3.1", + "req_description": "Vérifiez que les contrôles visant à empêcher les attaques telles que le bourrage d'informations d'identification et la force brute des mots de passe sont mis en œuvre conformément à la documentation de sécurité de l'application.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.3", + "section_name": "Sécurité générale de l'authentification", + "req_id": "V6.3.2", + "req_description": "Vérifiez que les comptes d’utilisateur par défaut (par exemple, « root », « admin » ou « sa ») ne sont pas présents dans l’application ou sont désactivés.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.3", + "section_name": "Sécurité générale de l'authentification", + "req_id": "V6.3.3", + "req_description": "Vérifiez que l’application exige que les utilisateurs utilisent un mécanisme d’authentification multifacteur ou une combinaison de mécanismes d’authentification à facteur unique.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.3", + "section_name": "Sécurité générale de l'authentification", + "req_id": "V6.3.4", + "req_description": "Vérifiez que, si l’application inclut plusieurs voies d’authentification, il n’existe aucune voie non documentée et que les contrôles de sécurité et la force d’authentification sont appliqués de manière cohérente.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.3", + "section_name": "Sécurité générale de l'authentification", + "req_id": "V6.3.5", + "req_description": "Vérifiez que les utilisateurs sont informés des tentatives d'authentification suspectes (réussies ou non). Il peut s'agir de tentatives d'authentification provenant d'un emplacement ou d'un client inhabituel, d'une authentification partiellement réussie (un seul facteur parmi plusieurs), d'une tentative d'authentification après une longue période d'inactivité ou d'une authentification réussie après plusieurs tentatives infructueuses.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.3", + "section_name": "Sécurité générale de l'authentification", + "req_id": "V6.3.6", + "req_description": "Vérifiez que le courrier électronique n’est pas utilisé comme mécanisme d’authentification à facteur unique ou à facteurs multiples.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.3", + "section_name": "Sécurité générale de l'authentification", + "req_id": "V6.3.7", + "req_description": "Vérifiez que les utilisateurs sont avertis après les mises à jour des détails d'authentification, telles que les réinitialisations d'informations d'identification ou la modification du nom d'utilisateur ou de l'adresse e-mail.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.3", + "section_name": "Sécurité générale de l'authentification", + "req_id": "V6.3.8", + "req_description": "Vérifiez que les utilisateurs valides ne peuvent pas être déduits d'échecs d'authentification, par exemple en se basant sur des messages d'erreur, des codes de réponse HTTP ou des temps de réponse différents. Les fonctionnalités d'inscription et de mot de passe oublié doivent également bénéficier de cette protection.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.4", + "section_name": "Cycle de vie et récupération du facteur d'authentification", + "req_id": "V6.4.1", + "req_description": "Vérifiez que les mots de passe initiaux ou les codes d'activation générés par le système sont générés de manière aléatoire et sécurisée, qu'ils respectent la politique de mots de passe en vigueur et qu'ils expirent après une courte période ou après leur première utilisation. Ces secrets initiaux ne doivent pas devenir des mots de passe permanents.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.4", + "section_name": "Cycle de vie et récupération du facteur d'authentification", + "req_id": "V6.4.2", + "req_description": "Vérifiez que les indices de mot de passe ou l'authentification basée sur les connaissances (appelées « questions secrètes ») ne sont pas présents.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.4", + "section_name": "Cycle de vie et récupération du facteur d'authentification", + "req_id": "V6.4.3", + "req_description": "Vérifiez qu'un processus sécurisé de réinitialisation d'un mot de passe oublié est mis en œuvre, qui ne contourne aucun mécanisme d'authentification multifacteur activé.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.4", + "section_name": "Cycle de vie et récupération du facteur d'authentification", + "req_id": "V6.4.4", + "req_description": "Vérifiez que si un facteur d'authentification multifacteur est perdu, la preuve de vérification d'identité est effectuée au même niveau que lors de l'inscription.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.4", + "section_name": "Cycle de vie et récupération du facteur d'authentification", + "req_id": "V6.4.5", + "req_description": "Vérifiez que les instructions de renouvellement des mécanismes d'authentification qui expirent sont envoyées avec suffisamment de temps pour être exécutées avant l'expiration de l'ancien mécanisme d'authentification, en configurant des rappels automatiques si nécessaire.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.4", + "section_name": "Cycle de vie et récupération du facteur d'authentification", + "req_id": "V6.4.6", + "req_description": "Vérifiez que les administrateurs peuvent initier la réinitialisation du mot de passe de l'utilisateur, mais que cela ne leur permet pas de modifier ou de choisir son mot de passe. Cela évite qu'ils ne connaissent le mot de passe de l'utilisateur.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.5", + "section_name": "Exigences générales en matière d'authentification multifacteur", + "req_id": "V6.5.1", + "req_description": "Vérifiez que les secrets de recherche, les demandes ou codes d'authentification out-of-band et les mots de passe à usage unique basés sur le temps (TOTP) ne peuvent être utilisés avec succès qu'une seule fois.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.5", + "section_name": "Exigences générales en matière d'authentification multifacteur", + "req_id": "V6.5.2", + "req_description": "Vérifiez que, lors de leur stockage dans le backend de l'application, les secrets de recherche comportant moins de 112 bits d'entropie (19 caractères alphanumériques aléatoires ou 34 chiffres aléatoires) sont hachés avec un algorithme de hachage de stockage de mots de passe approuvé, intégrant un sel aléatoire de 32 bits. Une fonction de hachage standard peut être utilisée si le secret comporte 112 bits d'entropie ou plus.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.5", + "section_name": "Exigences générales en matière d'authentification multifacteur", + "req_id": "V6.5.3", + "req_description": "Vérifiez que les secrets de recherche, le code d'authentification out-of-band et les mots de passe à usage unique basés sur le temps sont générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) pour éviter les valeurs prévisibles.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.5", + "section_name": "Exigences générales en matière d'authentification multifacteur", + "req_id": "V6.5.4", + "req_description": "Vérifiez que les secrets de recherche et les codes d'authentification out-of-band ont un minimum de 20 bits d'entropie (généralement 4 caractères alphanumériques aléatoires ou 6 chiffres aléatoires suffisent).", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.5", + "section_name": "Exigences générales en matière d'authentification multifacteur", + "req_id": "V6.5.5", + "req_description": "Vérifiez que les requêtes, codes ou jetons d'authentification out-of-band, ainsi que les mots de passe à usage unique (TOTP), ont une durée de vie définie. Les requêtes out-of-band doivent avoir une durée de vie maximale de 10 minutes et les TOTP, de 30 secondes.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.5", + "section_name": "Exigences générales en matière d'authentification multifacteur", + "req_id": "V6.5.6", + "req_description": "Vérifiez que tout facteur d’authentification (y compris les appareils physiques) peut être révoqué en cas de vol ou autre perte.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.5", + "section_name": "Exigences générales en matière d'authentification multifacteur", + "req_id": "V6.5.7", + "req_description": "Vérifiez que les mécanismes d’authentification biométrique ne sont utilisés que comme facteurs secondaires, avec quelque chose que vous possédez ou quelque chose que vous savez.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.5", + "section_name": "Exigences générales en matière d'authentification multifacteur", + "req_id": "V6.5.8", + "req_description": "Vérifiez que les mots de passe à usage unique basés sur le temps (TOTP) sont vérifiés en fonction d'une source temporelle provenant d'un service de confiance et non d'une heure non fiable ou fournie par le client.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.6", + "section_name": "Mécanismes d'authentification out-of-band", + "req_id": "V6.6.1", + "req_description": "Vérifier que les mécanismes d'authentification utilisant le réseau téléphonique public commuté (RTPC) pour la transmission de mots de passe à usage unique (OTP) par téléphone ou SMS ne sont proposés que lorsque le numéro de téléphone a été préalablement validé. D'autres méthodes plus robustes (telles que les mots de passe à usage unique à durée déterminée) sont également proposées, et que le service informe les utilisateurs des risques de sécurité qu'elles présentent. Pour les applications de niveau 3, le téléphone et les SMS ne doivent pas être disponibles.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.6", + "section_name": "Mécanismes d'authentification out-of-band", + "req_id": "V6.6.2", + "req_description": "Vérifiez que les demandes d’authentification out-of-band, les codes ou les jetons sont liés à la demande d’authentification d’origine pour laquelle ils ont été générés et ne sont pas utilisables pour une demande précédente ou ultérieure.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.6", + "section_name": "Mécanismes d'authentification out-of-band", + "req_id": "V6.6.3", + "req_description": "Vérifiez qu'un mécanisme d'authentification out-of-band basé sur du code est protégé contre les attaques par force brute grâce au \"rate limiting\". Envisagez également d'utiliser un code avec au moins 64 bits d'entropie.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.6", + "section_name": "Mécanismes d'authentification out-of-band", + "req_id": "V6.6.4", + "req_description": "Vérifiez que, lorsque les notifications push sont utilisées pour l'authentification multifacteur, le \"rate limiting\" est appliqué afin d'empêcher les attaques de type « push bombing ». La concordance des numéros peut également atténuer ce risque.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.7", + "section_name": "Mécanisme d'authentification cryptographique", + "req_id": "V6.7.1", + "req_description": "Vérifiez que les certificats utilisés pour vérifier les assertions d’authentification cryptographique sont stockés de manière à les protéger contre toute modification.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.7", + "section_name": "Mécanisme d'authentification cryptographique", + "req_id": "V6.7.2", + "req_description": "Vérifiez que le nonce de défi a une longueur d'au moins 64 bits et qu'il est statistiquement unique ou unique sur toute la durée de vie du périphérique cryptographique.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.8", + "section_name": "Authentification avec un fournisseur d'identité", + "req_id": "V6.8.1", + "req_description": "Vérifiez que, si l'application prend en charge plusieurs fournisseurs d'identité (IdP), l'identité de l'utilisateur ne peut pas être usurpée via un autre fournisseur d'identité pris en charge (par exemple, en utilisant le même identifiant utilisateur). La mesure standard consisterait à ce que l'application enregistre et identifie l'utilisateur à l'aide d'une combinaison de l'ID du fournisseur d'identité (servant d'espace de noms) et de l'ID de l'utilisateur dans le fournisseur d'identité.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.8", + "section_name": "Authentification avec un fournisseur d'identité", + "req_id": "V6.8.2", + "req_description": "Vérifiez que la présence et l'intégrité des signatures numériques sur les assertions d'authentification (par exemple sur les assertions JWT ou SAML) sont toujours validées, en rejetant toutes les assertions non signées ou ayant des signatures non valides.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.8", + "section_name": "Authentification avec un fournisseur d'identité", + "req_id": "V6.8.3", + "req_description": "Vérifiez que les assertions SAML sont traitées de manière unique et utilisées une seule fois au cours de la période de validité pour éviter les attaques par rejeu.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.8", + "section_name": "Authentification avec un fournisseur d'identité", + "req_id": "V6.8.4", + "req_description": "Si une application utilise un fournisseur d'identité (IdP) distinct et attend une force, des méthodes ou une date d'authentification spécifiques pour des fonctions spécifiques, vérifiez que l'application les vérifie à l'aide des informations renvoyées par l'IdP. Par exemple, si OIDC est utilisé, cela peut être réalisé en validant les affirmations de jeton d'identification telles que « acr », « amr » et « auth_time » (le cas échéant). Si l'IdP ne fournit pas ces informations, l'application doit disposer d'une approche de secours documentée qui suppose que le mécanisme d'authentification de force minimale a été utilisé (par exemple, une authentification à facteur unique avec nom d'utilisateur et mot de passe).", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.1", + "section_name": "Documentation sur la gestion des sessions", + "req_id": "V7.1.1", + "req_description": "Vérifiez que le délai d'inactivité de la session de l'utilisateur et la durée de vie maximale absolue de la session sont documentés, sont appropriés en combinaison avec d'autres contrôles et que la documentation inclut une justification de tout écart par rapport aux exigences de réauthentification NIST SP 800-63B.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.1", + "section_name": "Documentation sur la gestion des sessions", + "req_id": "V7.1.2", + "req_description": "Vérifiez que la documentation définit le nombre de sessions simultanées (parallèles) autorisées pour un compte ainsi que les comportements et actions prévus à entreprendre lorsque le nombre maximal de sessions actives est atteint.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.1", + "section_name": "Documentation sur la gestion des sessions", + "req_id": "V7.1.3", + "req_description": "Vérifiez que tous les systèmes qui créent et gèrent des sessions utilisateur dans le cadre d'un écosystème de gestion des identités fédérées (tels que les systèmes SSO) sont documentés avec des contrôles pour coordonner la durée de vie des sessions, la résiliation et toute autre condition nécessitant une réauthentification.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.2", + "section_name": "Sécurité fondamentale de la gestion des sessions", + "req_id": "V7.2.1", + "req_description": "Vérifiez que l’application effectue toutes les vérifications des jetons de session à l’aide d’un service backend de confiance.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.2", + "section_name": "Sécurité fondamentale de la gestion des sessions", + "req_id": "V7.2.2", + "req_description": "Vérifiez que l'application utilise des jetons autonomes ou de référence générés dynamiquement pour la gestion des sessions, c'est-à-dire sans utiliser de secrets et de clés d'API statiques.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.2", + "section_name": "Sécurité fondamentale de la gestion des sessions", + "req_id": "V7.2.3", + "req_description": "Vérifiez que si des jetons par référence sont utilisés pour représenter les sessions utilisateur, ils sont uniques et générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et possèdent au moins 128 bits d'entropie.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.2", + "section_name": "Sécurité fondamentale de la gestion des sessions", + "req_id": "V7.2.4", + "req_description": "Vérifiez que l’application génère un nouveau jeton de session lors de l’authentification de l’utilisateur, y compris la réauthentification, et met fin au jeton de session actuel.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.3", + "section_name": "Délai d'expiration de la session", + "req_id": "V7.3.1", + "req_description": "Vérifiez qu’il existe un délai d’inactivité tel que la réauthentification soit appliquée conformément à l’analyse des risques et aux décisions de sécurité documentées.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.3", + "section_name": "Délai d'expiration de la session", + "req_id": "V7.3.2", + "req_description": "Vérifiez qu'il existe une durée de vie maximale absolue de la session de sorte que la réauthentification soit appliquée conformément à l'analyse des risques et aux décisions de sécurité documentées.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.4", + "section_name": "Fin de session", + "req_id": "V7.4.1", + "req_description": "Vérifiez que lorsque la fin de session est déclenchée (par exemple, déconnexion ou expiration), l'application interdit toute utilisation ultérieure de la session. Pour les jetons par référence ou les sessions avec état, cela implique l'invalidation des données de session au niveau du backend de l'application. Les applications utilisant des jetons autonomes nécessiteront une solution, comme la gestion d'une liste des jetons terminés, l'interdiction des jetons produits avant une date et une heure spécifique à chaque utilisateur ou la rotation d'une clé de signature spécifique à chaque utilisateur.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.4", + "section_name": "Fin de session", + "req_id": "V7.4.2", + "req_description": "Vérifiez que l'application met fin à toutes les sessions actives lorsqu'un compte utilisateur est désactivé ou supprimé (par exemple, lorsqu'un employé quitte l'entreprise).", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.4", + "section_name": "Fin de session", + "req_id": "V7.4.3", + "req_description": "Vérifiez que l'application offre la possibilité de mettre fin à toutes les autres sessions actives après une modification ou une suppression réussie de tout facteur d'authentification (y compris la modification du mot de passe via une réinitialisation ou une récupération et, le cas échéant, une mise à jour des paramètres MFA).", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.4", + "section_name": "Fin de session", + "req_id": "V7.4.4", + "req_description": "Vérifiez que toutes les pages nécessitant une authentification disposent d’un accès facile et visible à la fonctionnalité de déconnexion.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.4", + "section_name": "Fin de session", + "req_id": "V7.4.5", + "req_description": "Vérifiez que les administrateurs d’applications sont en mesure de mettre fin aux sessions actives pour un utilisateur individuel ou pour tous les utilisateurs.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.5", + "section_name": "Défenses contre les abus de session", + "req_id": "V7.5.1", + "req_description": "Vérifiez que l'application nécessite une réauthentification complète avant d'autoriser les modifications des attributs de compte sensibles qui peuvent affecter l'authentification, tels que l'adresse e-mail, le numéro de téléphone, la configuration MFA ou d'autres informations utilisées dans la récupération de compte.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.5", + "section_name": "Défenses contre les abus de session", + "req_id": "V7.5.2", + "req_description": "Vérifiez que les utilisateurs peuvent afficher et (après s'être authentifiés à nouveau avec au moins un facteur) terminer une ou toutes les sessions actuellement actives.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.5", + "section_name": "Défenses contre les abus de session", + "req_id": "V7.5.3", + "req_description": "Vérifiez que l’application nécessite une authentification supplémentaire avec au moins un facteur ou une vérification secondaire avant d’effectuer des transactions ou des opérations hautement sensibles.", + "L": "3" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.6", + "section_name": "Réauthentification fédérée", + "req_id": "V7.6.1", + "req_description": "Vérifiez que la durée de vie et la fin de la session entre les parties de confiance (RP) et les fournisseurs d'identité (IdP) se comportent comme documenté, en exigeant une réauthentification si nécessaire, par exemple lorsque le temps maximal entre les événements d'authentification IdP est atteint.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.6", + "section_name": "Réauthentification fédérée", + "req_id": "V7.6.2", + "req_description": "Vérifiez que la création d'une session nécessite soit le consentement de l'utilisateur, soit une action explicite, empêchant ainsi la création de nouvelles sessions d'application sans interaction de l'utilisateur.", + "L": "2" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.1", + "section_name": "Documentation d'autorisation", + "req_id": "V8.1.1", + "req_description": "Vérifiez que la documentation d’autorisation définit des règles de restriction de l’accès au niveau de la fonction et aux données en fonction des autorisations du consommateur et des attributs des ressources.", + "L": "1" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.1", + "section_name": "Documentation d'autorisation", + "req_id": "V8.1.2", + "req_description": "Vérifiez que la documentation d'autorisation définit les règles de restriction d'accès au niveau des champs (lecture et écriture) en fonction des autorisations des consommateurs et des attributs des ressources. Notez que ces règles peuvent dépendre d'autres valeurs d'attributs de l'objet de données concerné, telles que l'état ou le statut.", + "L": "2" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.1", + "section_name": "Documentation d'autorisation", + "req_id": "V8.1.3", + "req_description": "Vérifiez que la documentation de l'application définit les attributs environnementaux et contextuels (y compris, mais sans s'y limiter, l'heure de la journée, l'emplacement de l'utilisateur, l'adresse IP ou l'appareil) qui sont utilisés dans l'application pour prendre des décisions de sécurité, y compris celles relatives à l'authentification et à l'autorisation.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.1", + "section_name": "Documentation d'autorisation", + "req_id": "V8.1.4", + "req_description": "Vérifier que la documentation d'authentification et d'autorisation définit l'utilisation des facteurs environnementaux et contextuels dans la prise de décision, en plus des autorisations au niveau des fonctions, des données et des champs. Cela doit inclure les attributs évalués, les seuils de risque et les actions entreprises (par exemple, autorisation, contestation, refus, renforcement de l'authentification).", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.2", + "section_name": "Conception d'autorisation générale", + "req_id": "V8.2.1", + "req_description": "Vérifiez que l’application garantit que l’accès basé sur la fonction est limité aux consommateurs disposant d’autorisations explicites.", + "L": "1" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.2", + "section_name": "Conception d'autorisation générale", + "req_id": "V8.2.2", + "req_description": "Vérifiez que l'application garantit que l'accès spécifique aux données est limité aux consommateurs disposant d'autorisations explicites sur des éléments de données spécifiques afin d'atténuer les références d'objet directes non sécurisées (IDOR) et les autorisations de niveau d'objet rompues (BOLA).", + "L": "1" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.2", + "section_name": "Conception d'autorisation générale", + "req_id": "V8.2.3", + "req_description": "Vérifiez que l'application garantit que l'accès au niveau du champ est limité aux consommateurs disposant d'autorisations explicites sur des champs spécifiques afin d'atténuer les problèmes d'autorisation au niveau de la propriété d'objet (BOPLA).", + "L": "2" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.2", + "section_name": "Conception d'autorisation générale", + "req_id": "V8.2.4", + "req_description": "Vérifiez que les contrôles de sécurité adaptatifs basés sur les attributs environnementaux et contextuels du consommateur (tels que l'heure, la localisation, l'adresse IP ou l'appareil) sont mis en œuvre pour les décisions d'authentification et d'autorisation, comme défini dans la documentation de l'application. Ces contrôles doivent être appliqués lorsque le consommateur tente de démarrer une nouvelle session et également pendant une session existante.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.3", + "section_name": "Autorisation par opération", + "req_id": "V8.3.1", + "req_description": "Vérifier que l'application applique les règles d'autorisations au niveau de la couche service de confiance et ne s’appuie pas sur des contrôles qu’un consommateur non approuvé pourrait manipuler, comme JavaScript côté client.", + "L": "1" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.3", + "section_name": "Autorisation par opération", + "req_id": "V8.3.2", + "req_description": "Vérifiez que les modifications apportées aux valeurs sur lesquelles reposent les décisions d'autorisation sont appliquées immédiatement. Lorsque les modifications ne peuvent pas être appliquées immédiatement (par exemple, en s'appuyant sur des données de jetons autonomes), des contrôles d'atténuation doivent être mis en place pour alerter un consommateur lorsqu'il effectue une action alors qu'il n'est plus autorisé à le faire et annuler la modification. Notez que cette solution alternative ne limiterait pas les fuites d'informations.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.3", + "section_name": "Autorisation par opération", + "req_id": "V8.3.3", + "req_description": "Vérifiez que l'accès à un objet repose sur les autorisations du sujet d'origine (par exemple, le consommateur), et non sur celles d'un intermédiaire ou d'un service agissant en son nom. Par exemple, si un consommateur appelle un service web à l'aide d'un jeton d'authentification autonome, et que ce service demande ensuite des données à un autre service, ce dernier utilisera le jeton du consommateur, plutôt qu'un jeton inter-machine du premier service, pour prendre les décisions d'autorisation.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.4", + "section_name": "Autres considérations relatives à l'autorisation", + "req_id": "V8.4.1", + "req_description": "Vérifiez que les applications multi-tenants utilisent des contrôles inter-tenants pour garantir que les opérations des consommateurs n'affecteront jamais les tenants avec lesquels ils ne sont pas autorisés à interagir.", + "L": "2" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.4", + "section_name": "Autres considérations relatives à l'autorisation", + "req_id": "V8.4.2", + "req_description": "Vérifiez que l'accès aux interfaces administratives intègre plusieurs couches de sécurité, notamment la vérification continue de l'identité du consommateur, l'évaluation de la posture de sécurité des appareils et l'analyse contextuelle des risques, garantissant que l'emplacement du réseau ou les endpoints approuvés ne sont pas les seuls facteurs d'autorisation, même s'ils peuvent réduire la probabilité d'accès non autorisé.", + "L": "3" + }, + { + "chapter_id": "V9", + "chapter_name": "Jetons autonomes", + "section_id": "V9.1", + "section_name": "Source et intégrité du jeton", + "req_id": "V9.1.1", + "req_description": "Vérifiez que les jetons autonomes sont validés à l'aide de leur signature numérique ou MAC pour les protéger contre toute falsification avant d'accepter le contenu du jeton.", + "L": "1" + }, + { + "chapter_id": "V9", + "chapter_name": "Jetons autonomes", + "section_id": "V9.1", + "section_name": "Source et intégrité du jeton", + "req_id": "V9.1.2", + "req_description": "Vérifiez que seuls les algorithmes d'une liste d’autorisations peuvent être utilisés pour créer et vérifier des jetons autonomes, dans un contexte donné. La liste d'autorisation doit inclure les algorithmes autorisés, idéalement symétriques ou asymétriques, et ne doit pas inclure l'algorithme « Aucun ». Si les algorithmes symétriques et asymétriques doivent être pris en charge, des contrôles supplémentaires seront nécessaires pour éviter toute confusion de clés.", + "L": "1" + }, + { + "chapter_id": "V9", + "chapter_name": "Jetons autonomes", + "section_id": "V9.1", + "section_name": "Source et intégrité du jeton", + "req_id": "V9.1.3", + "req_description": "Vérifiez que les clés utilisées pour valider les jetons autonomes proviennent de sources préconfigurées et fiables pour l'émetteur du jeton, empêchant ainsi les attaquants de spécifier des sources et des clés non fiables. Pour les JWT et autres structures JWS, les en-têtes tels que « jku », « x5u » et « jwk » doivent être validés par rapport à une liste d'autorisation de sources fiables.", + "L": "1" + }, + { + "chapter_id": "V9", + "chapter_name": "Jetons autonomes", + "section_id": "V9.2", + "section_name": "Contenu du jeton", + "req_id": "V9.2.1", + "req_description": "Vérifiez que, si une période de validité est indiquée dans les données du jeton, celui-ci et son contenu ne sont acceptés que si la date de vérification est comprise dans cette période. Par exemple, pour les JWT, les déclarations « nbf » et « exp » doivent être vérifiées.", + "L": "1" + }, + { + "chapter_id": "V9", + "chapter_name": "Jetons autonomes", + "section_id": "V9.2", + "section_name": "Contenu du jeton", + "req_id": "V9.2.2", + "req_description": "Vérifiez que le service recevant un jeton valide le type de jeton et son utilisation avant d'en accepter le contenu. Par exemple, seuls les jetons d'accès peuvent être acceptés pour les décisions d'autorisation, et seuls les jetons d'identification peuvent être utilisés pour prouver l'authentification des utilisateurs.", + "L": "2" + }, + { + "chapter_id": "V9", + "chapter_name": "Jetons autonomes", + "section_id": "V9.2", + "section_name": "Contenu du jeton", + "req_id": "V9.2.3", + "req_description": "Vérifiez que le service accepte uniquement les jetons destinés à être utilisés avec ce service (audience). Pour les JWT, cela peut être réalisé en validant la déclaration « aud » par rapport à une liste d'autorisation définie dans le service.", + "L": "2" + }, + { + "chapter_id": "V9", + "chapter_name": "Jetons autonomes", + "section_id": "V9.2", + "section_name": "Contenu du jeton", + "req_id": "V9.2.4", + "req_description": "Si un émetteur de jetons utilise la même clé privée pour émettre des jetons destinés à différentes audiences, vérifiez que les jetons émis contiennent une restriction d'audience identifiant de manière unique les audiences visées. Cela empêchera la réutilisation d'un jeton avec une audience non prévue. Si l'identifiant d'audience est provisionné dynamiquement, l'émetteur de jetons doit valider ces audiences afin de garantir qu'elles n'entraînent pas d'usurpation d'identité.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.1", + "section_name": "Sécurité générique OAuth et OIDC", + "req_id": "V10.1.1", + "req_description": "Vérifiez que les jetons sont envoyés uniquement aux composants qui en ont absolument besoin. Par exemple, lors de l'utilisation d'un modèle backend-for-frontend pour les applications JavaScript basées sur un navigateur, les jetons d'accès et d'actualisation ne doivent être accessibles qu'au backend.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.1", + "section_name": "Sécurité générique OAuth et OIDC", + "req_id": "V10.1.2", + "req_description": "Vérifiez que le client n'accepte les valeurs du serveur d'autorisation (telles que le code d'autorisation ou le jeton d'identification) que si elles résultent d'un flux d'autorisation initié par la même session d'agent utilisateur et la même transaction. Cela nécessite que les secrets générés par le client, tels que la clé de preuve pour l'échange de codes (PKCE) « code_verifier », « state » ou le nonce OIDC, ne puissent être devinés, soient spécifiques à la transaction et soient liés de manière sécurisée au client et à la session d'agent utilisateur au cours de laquelle la transaction a été initiée.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.2", + "section_name": "Client OAuth", + "req_id": "V10.2.1", + "req_description": "Vérifiez que, si le flux de code est utilisé, le client OAuth dispose d'une protection contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF), qui déclenchent des demandes de jetons, soit en utilisant la fonctionnalité de clé de preuve pour l'échange de code (PKCE), soit en vérifiant le paramètre « state » envoyé dans la demande d'autorisation.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.2", + "section_name": "Client OAuth", + "req_id": "V10.2.2", + "req_description": "Vérifiez que, si le client OAuth peut interagir avec plusieurs serveurs d'autorisation, il dispose d'une protection contre les attaques par confusion. Par exemple, il peut exiger que le serveur d'autorisation renvoie la valeur du paramètre « iss » et la valide dans la réponse d'autorisation et la réponse du jeton.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.2", + "section_name": "Client OAuth", + "req_id": "V10.2.3", + "req_description": "Vérifiez que le client OAuth demande uniquement les portées requises (ou d’autres paramètres d’autorisation) dans les requêtes adressées au serveur d’autorisation.", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.3", + "section_name": "Serveur de ressources OAuth", + "req_id": "V10.3.1", + "req_description": "Vérifiez que le serveur de ressources accepte uniquement les jetons d'accès destinés à être utilisés avec ce service (audience). L'audience peut être incluse dans un jeton d'accès structuré (comme la déclaration « aud » dans JWT) ou vérifiée à l'aide du endpoint d'introspection de jeton.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.3", + "section_name": "Serveur de ressources OAuth", + "req_id": "V10.3.2", + "req_description": "Vérifiez que le serveur de ressources applique les décisions d'autorisation en fonction des déclarations du jeton d'accès définissant l'autorisation déléguée. Si des déclarations telles que « sub », « scope » et « authorization_details » sont présentes, elles doivent être prises en compte dans la décision.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.3", + "section_name": "Serveur de ressources OAuth", + "req_id": "V10.3.3", + "req_description": "Vérifiez que si une décision de contrôle d'accès nécessite l'identification d'un utilisateur unique à partir d'un jeton d'accès (JWT ou réponse d'introspection de jeton associé), le serveur de ressources identifie l'utilisateur à partir de déclarations non ré attribuables à d'autres utilisateurs. En général, cela implique l'utilisation d'une combinaison de déclarations « iss » et « sub ».", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.3", + "section_name": "Serveur de ressources OAuth", + "req_id": "V10.3.4", + "req_description": "Si le serveur de ressources requiert une force d'authentification, des méthodes ou une date d'expiration spécifiques, vérifiez que le jeton d'accès présenté respecte ces contraintes. Par exemple, s'il est présent, utilisez les déclarations OIDC « acr », « amr » et « auth_time » respectivement.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.3", + "section_name": "Serveur de ressources OAuth", + "req_id": "V10.3.5", + "req_description": "Vérifiez que le serveur de ressources empêche l'utilisation de jetons d'accès volés ou la relecture de jetons d'accès (de parties non autorisées) en exigeant des jetons d'accès limités par l'expéditeur, soit Mutual TLS pour OAuth 2, soit OAuth 2 Demonstration of Proof of Possession (DPoP).", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.1", + "req_description": "Vérifiez que le serveur d'autorisation valide les URI de redirection en fonction d'une liste d'autorisation spécifique au client d'URI préenregistrés à l'aide d'une comparaison de chaînes exacte.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.2", + "req_description": "Vérifiez que, si le serveur d'autorisation renvoie le code d'autorisation dans la réponse, celui-ci ne peut être utilisé qu'une seule fois pour une demande de jeton. Pour la deuxième demande valide avec un code d'autorisation déjà utilisé pour émettre un jeton d'accès, le serveur d'autorisation doit rejeter la demande de jeton et révoquer tous les jetons émis liés au code d'autorisation.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.3", + "req_description": "Vérifiez que le code d'autorisation est de courte durée. La durée de vie maximale peut atteindre 10 minutes pour les applications L1 et L2 et 1 minute pour les applications L3.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.4", + "req_description": "Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement l'utilisation des autorisations nécessaires à ce client. Notez que les autorisations « token » (flux implicite) et « password » (flux d'informations d'identification du propriétaire de la ressource) ne doivent plus être utilisées.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.5", + "req_description": "Vérifiez que le serveur d'autorisation atténue les attaques par rejeu de jetons d'actualisation pour les clients publics, de préférence en utilisant des jetons d'actualisation limités par l'expéditeur, par exemple des jetons DPoP (Demonstrating Proof of Possession) ou des jetons d'accès liés à un certificat utilisant le protocole TLS mutuel (mTLS). Pour les applications L1 et L2, la rotation des jetons d'actualisation peut être utilisée. Si cette rotation est utilisée, le serveur d'autorisation doit invalider le jeton d'actualisation après utilisation et révoquer tous les jetons d'actualisation de cette autorisation si un jeton d'actualisation déjà utilisé et invalidé est fourni.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.6", + "req_description": "Vérifiez que, si l'octroi de code est utilisé, le serveur d'autorisation atténue les attaques par interception de code en exigeant une clé de preuve pour l'échange de code (PKCE). Pour les demandes d'autorisation, le serveur d'autorisation doit exiger une valeur « code_challenge » valide et ne doit pas accepter une valeur « plain » pour « code_challenge_method ». Pour une demande de jeton, il doit exiger la validation du paramètre « code_verifier ».", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.7", + "req_description": "Vérifiez que si le serveur d'autorisation prend en charge l'enregistrement dynamique des clients non authentifiés, il réduit le risque d'applications clientes malveillantes. Il doit valider les métadonnées clientes, telles que les URI enregistrés, garantir le consentement de l'utilisateur et l'avertir avant de traiter une demande d'autorisation avec une application cliente non approuvée.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.8", + "req_description": "Vérifiez que les jetons d’actualisation ont une expiration absolue, y compris si l’expiration du jeton d’actualisation glissant est appliquée.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.9", + "req_description": "Vérifiez que les jetons d'actualisation et les jetons d'accès de référence peuvent être révoqués par un utilisateur autorisé à l'aide de l'interface utilisateur du serveur d'autorisation, afin d'atténuer le risque de clients malveillants ou de jetons volés.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.10", + "req_description": "Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.11", + "req_description": "Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.12", + "req_description": "Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement la valeur « response_mode » dont ce client a besoin. Par exemple, en vérifiant cette valeur par rapport aux valeurs attendues ou en utilisant une requête d'autorisation poussée (PAR) ou une requête d'autorisation sécurisée par JWT (JAR).", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.13", + "req_description": "Vérifiez que le type d'Autorisation « code » est toujours utilisé avec les demandes d'autorisation poussées (PAR).", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.14", + "req_description": "Vérifiez que le serveur d'autorisation émet uniquement des jetons d'accès limités à l'expéditeur (preuve de possession), soit avec des jetons d'accès liés au certificat utilisant TLS mutuel (mTLS), soit avec des jetons d'accès liés au DPoP (démonstration de preuve de possession).", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.15", + "req_description": "Vérifiez que, pour un client côté serveur (non exécuté sur l'appareil de l'utilisateur final), le serveur d'autorisation garantit que la valeur du paramètre « authorization_details » provient du backend client et que l'utilisateur ne l'a pas altérée. Par exemple, en exigeant l'utilisation d'une demande d'autorisation poussée (PAR) ou d'une demande d'autorisation sécurisée par JWT (JAR).", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.16", + "req_description": "Vérifiez que le client est confidentiel et que le serveur d'autorisation requiert l'utilisation de méthodes d'authentification client fortes (basées sur la cryptographie à clé publique et résistantes aux attaques par relecture), telles que TLS mutuel ('tls_client_auth', 'self_signed_tls_client_auth') ou JWT à clé privée ('private_key_jwt').", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.5", + "section_name": "Client OIDC", + "req_id": "V10.5.1", + "req_description": "Vérifiez que le client (en tant que partie utilisatrice) atténue les attaques par rejeu de jeton d'identification. Par exemple, en vous assurant que la valeur « nonce » du jeton d'identification correspond à la valeur « nonce » envoyée dans la demande d'authentification au fournisseur OpenID (appelée demande d'autorisation envoyée au serveur d'autorisation dans OAuth2).", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.5", + "section_name": "Client OIDC", + "req_id": "V10.5.2", + "req_description": "Vérifiez que le client identifie de manière unique l'utilisateur à partir des déclarations de jeton d'identification, généralement la déclaration « sub », qui ne peut pas être réaffectée à d'autres utilisateurs (pour la portée d'un fournisseur d'identité).", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.5", + "section_name": "Client OIDC", + "req_id": "V10.5.3", + "req_description": "Vérifiez que le client rejette les tentatives d'un serveur d'autorisation malveillant d'usurper l'identité d'un autre serveur d'autorisation via ses métadonnées. Le client doit rejeter les métadonnées du serveur d'autorisation si l'URL de l'émetteur figurant dans ces métadonnées ne correspond pas exactement à l'URL d'émetteur préconfigurée attendue par le client.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.5", + "section_name": "Client OIDC", + "req_id": "V10.5.4", + "req_description": "Vérifiez que le client valide que le jeton d'identification est destiné à être utilisé pour ce client (audience) en vérifiant que la déclaration « aud » du jeton est égale à la valeur « client_id » pour le client.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.5", + "section_name": "Client OIDC", + "req_id": "V10.5.5", + "req_description": "Vérifiez que, lors de l'utilisation de la déconnexion du back-channel OIDC, la partie utilisatrice atténue les risques de déni de service liés à la déconnexion forcée et à la confusion entre JWT dans le flux de déconnexion. Le client doit vérifier que le jeton de déconnexion est correctement typé avec la valeur « logout+jwt », qu'il contient la déclaration « event » avec le nom de membre correct et qu'il ne contient pas de déclaration « nonce ». Il est également recommandé d'utiliser une expiration courte (par exemple, 2 minutes).", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.6", + "section_name": "Fournisseur OpenID", + "req_id": "V10.6.1", + "req_description": "Vérifiez que le fournisseur OpenID n'autorise que les valeurs « code », « ciba », « id_token » ou « id_token code » pour le mode de réponse. Notez que « code » est préférable à « id_token code » (flux hybride OIDC) et que « token » (tout flux implicite) ne doit pas être utilisé.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.6", + "section_name": "Fournisseur OpenID", + "req_id": "V10.6.2", + "req_description": "Vérifiez que le fournisseur OpenID atténue les risques de déni de service liés à la déconnexion forcée. Pour ce faire, obtenez une confirmation explicite de l'utilisateur final ou, le cas échéant, validez les paramètres de la requête de déconnexion (initiée par la partie utilisatrice), comme « id_token_hint ».", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.7", + "section_name": "Gestion du consentement", + "req_id": "V10.7.1", + "req_description": "Vérifiez que le serveur d'autorisation garantit le consentement de l'utilisateur à chaque demande d'autorisation. Si l'identité du client ne peut être garantie, le serveur d'autorisation doit toujours demander explicitement le consentement de l'utilisateur.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.7", + "section_name": "Gestion du consentement", + "req_id": "V10.7.2", + "req_description": "Vérifiez que lorsque le serveur d'autorisation demande le consentement de l'utilisateur, il fournit des informations claires et suffisantes sur ce qui est consenti. Le cas échéant, ces informations doivent inclure la nature des autorisations demandées (généralement en fonction de la portée, du serveur de ressources et des détails d'autorisation RAR), l'identité de l'application autorisée et la durée de vie de ces autorisations.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.7", + "section_name": "Gestion du consentement", + "req_id": "V10.7.3", + "req_description": "Vérifiez que l’utilisateur peut consulter, modifier et révoquer les consentements qu’il a accordés via le serveur d’autorisation.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.1", + "section_name": "Inventaire et documentation cryptographiques", + "req_id": "V11.1.1", + "req_description": "Vérifiez qu’il existe une politique documentée pour la gestion des clés cryptographiques et un cycle de vie des clés cryptographiques qui suit une norme de gestion des clés telle que NIST SP 800-57. Cela devrait inclure la garantie que les clés ne sont pas sur-partagées (par exemple, avec plus de deux entités pour les secrets partagés et plus d’une entité pour les clés privées).", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.1", + "section_name": "Inventaire et documentation cryptographiques", + "req_id": "V11.1.2", + "req_description": "Vérifiez qu'un inventaire cryptographique est réalisé, maintenu et régulièrement mis à jour, et qu'il inclut toutes les clés, algorithmes et certificats cryptographiques utilisés par l'application. Il doit également documenter les emplacements du système où les clés peuvent ou non être utilisées, ainsi que les types de données qui peuvent ou non être protégées par ces clés.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.1", + "section_name": "Inventaire et documentation cryptographiques", + "req_id": "V11.1.3", + "req_description": "Vérifiez que les mécanismes de découverte cryptographique sont utilisés pour identifier toutes les instances de cryptographie dans le système, y compris les opérations de chiffrement, de hachage et de signature.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.1", + "section_name": "Inventaire et documentation cryptographiques", + "req_id": "V11.1.4", + "req_description": "Vérifier la tenue d'un inventaire cryptographique. Celui-ci doit inclure un plan documenté décrivant la migration vers de nouvelles normes cryptographiques, telles que la cryptographie post-quantique, afin de réagir aux menaces futures.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.2", + "section_name": "Mise en œuvre sécurisée de la cryptographie", + "req_id": "V11.2.1", + "req_description": "Vérifiez que les implémentations validées par l’industrie (y compris les bibliothèques et les implémentations accélérées par le matériel) sont utilisées pour les opérations cryptographiques.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.2", + "section_name": "Mise en œuvre sécurisée de la cryptographie", + "req_id": "V11.2.2", + "req_description": "Vérifiez que l'application est conçue avec une agilité cryptographique, de sorte que les nombres aléatoires, le chiffrement authentifié, le MAC ou les algorithmes de hachage, les longueurs de clés, les tours, les chiffrements et les modes puissent être reconfigurés, mis à niveau ou échangés à tout moment, afin de se protéger contre les failles cryptographiques. De même, il doit être possible de remplacer les clés et les mots de passe, ainsi que de rechiffrer les données. Cela permettra des mises à niveau transparentes vers la cryptographie post-quantique (PQC), une fois que des implémentations hautement sécurisées de schémas ou de normes PQC approuvés seront largement disponibles.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.2", + "section_name": "Mise en œuvre sécurisée de la cryptographie", + "req_id": "V11.2.3", + "req_description": "Vérifiez que toutes les primitives cryptographiques utilisent un minimum de 128 bits de sécurité en fonction de l'algorithme, de la taille de la clé et de la configuration. Par exemple, une clé ECC de 256 bits offre environ 128 bits de sécurité, tandis que RSA nécessite une clé de 3072 bits pour atteindre 128 bits de sécurité.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.2", + "section_name": "Mise en œuvre sécurisée de la cryptographie", + "req_id": "V11.2.4", + "req_description": "Vérifiez que toutes les opérations cryptographiques sont à temps constant, sans opérations de « court-circuit » dans les comparaisons, les calculs ou les retours, pour éviter toute fuite d'informations.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.2", + "section_name": "Mise en œuvre sécurisée de la cryptographie", + "req_id": "V11.2.5", + "req_description": "Vérifiez que tous les modules cryptographiques échouent en toute sécurité et que les erreurs sont gérées de manière à ne pas permettre de vulnérabilités, telles que les attaques Padding Oracle.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.3", + "section_name": "Algorithmes de chiffrement", + "req_id": "V11.3.1", + "req_description": "Vérifiez que les modes de bloc non sécurisés (par exemple, ECB) et les schémas de remplissage faibles (par exemple, PKCS#1 v1.5) ne sont pas utilisés.", + "L": "1" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.3", + "section_name": "Algorithmes de chiffrement", + "req_id": "V11.3.2", + "req_description": "Vérifiez que seuls les chiffrements et modes approuvés tels que AES avec GCM sont utilisés.", + "L": "1" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.3", + "section_name": "Algorithmes de chiffrement", + "req_id": "V11.3.3", + "req_description": "Vérifiez que les données chiffrées sont protégées contre toute modification non autorisée, de préférence en utilisant une méthode de chiffrement authentifiée approuvée ou en combinant une méthode de chiffrement approuvée avec un algorithme MAC approuvé.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.3", + "section_name": "Algorithmes de chiffrement", + "req_id": "V11.3.4", + "req_description": "Vérifiez que les nonces, les vecteurs d'initialisation et autres nombres à usage unique ne sont pas utilisés pour plus d'une paire clé de chiffrement/élément de données. La méthode de génération doit être adaptée à l'algorithme utilisé.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.3", + "section_name": "Algorithmes de chiffrement", + "req_id": "V11.3.5", + "req_description": "Vérifiez que toute combinaison d'un algorithme de chiffrement et d'un algorithme MAC fonctionne en mode chiffrement puis MAC.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.4", + "section_name": "Hachage et fonctions basées sur le hachage", + "req_id": "V11.4.1", + "req_description": "Vérifiez que seules les fonctions de hachage approuvées sont utilisées pour les cas d'utilisation cryptographiques généraux, notamment les signatures numériques, HMAC, KDF et la génération de bits aléatoires. Les fonctions de hachage non autorisées, telles que MD5, ne doivent pas être utilisées à des fins cryptographiques.", + "L": "1" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.4", + "section_name": "Hachage et fonctions basées sur le hachage", + "req_id": "V11.4.2", + "req_description": "Vérifiez que les mots de passe sont stockés à l'aide d'une fonction de dérivation de clés approuvée et gourmande en ressources de calcul (également appelée « fonction de hachage de mots de passe »), dont les paramètres sont configurés conformément aux directives en vigueur. Ces paramètres doivent équilibrer sécurité et performances afin de rendre les attaques par force brute suffisamment difficiles pour le niveau de sécurité requis.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.4", + "section_name": "Hachage et fonctions basées sur le hachage", + "req_id": "V11.4.3", + "req_description": "Vérifiez que les fonctions de hachage utilisées dans les signatures numériques, dans le cadre de l'authentification ou de l'intégrité des données, sont résistantes aux collisions et possèdent des longueurs de bits appropriées. Si la résistance aux collisions est requise, la longueur de sortie doit être d'au moins 256 bits. Si seule la résistance aux attaques de seconde pré-image est requise, la longueur de sortie doit être d'au moins 128 bits.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.4", + "section_name": "Hachage et fonctions basées sur le hachage", + "req_id": "V11.4.4", + "req_description": "Vérifiez que l'application utilise des fonctions de dérivation de clés approuvées avec des paramètres d'extension de clés lors de la dérivation de clés secrètes à partir de mots de passe. Les paramètres utilisés doivent concilier sécurité et performances afin d'empêcher les attaques par force brute de compromettre la clé cryptographique obtenue.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.5", + "section_name": "Valeurs aléatoires", + "req_id": "V11.5.1", + "req_description": "Vérifiez que tous les nombres et chaînes aléatoires destinés à être non devinables doivent être générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et posséder au moins 128 bits d'entropie. Notez que les UUID ne respectent pas cette condition.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.5", + "section_name": "Valeurs aléatoires", + "req_id": "V11.5.2", + "req_description": "Vérifiez que le mécanisme de génération de nombres aléatoires utilisé est conçu pour fonctionner en toute sécurité, même en cas de forte demande.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.6", + "section_name": "Cryptographie à clé publique", + "req_id": "V11.6.1", + "req_description": "Vérifier que seuls des algorithmes cryptographiques et des modes opératoires approuvés sont utilisés pour la génération et l'amorçage des clés, ainsi que pour la génération et la vérification des signatures numériques. Les algorithmes de génération de clés ne doivent pas générer de clés non sécurisées et vulnérables aux attaques connues, par exemple les clés RSA vulnérables à la factorisation de Fermat.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.6", + "section_name": "Cryptographie à clé publique", + "req_id": "V11.6.2", + "req_description": "Vérifiez que des algorithmes cryptographiques approuvés sont utilisés pour l'échange de clés (tels que Diffie-Hellman), en veillant à ce que les mécanismes d'échange de clés utilisent des paramètres sécurisés. Cela permettra d'éviter les attaques contre le processus d'établissement des clés, susceptibles de conduire à des attaques de type « adversaire du milieu » ou à des failles cryptographiques.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.7", + "section_name": "Cryptographie des données en cours d'utilisation", + "req_id": "V11.7.1", + "req_description": "Vérifiez que le chiffrement complet de la mémoire est utilisé pour protéger les données sensibles pendant leur utilisation, empêchant ainsi l'accès par des utilisateurs ou des processus non autorisés.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.7", + "section_name": "Cryptographie des données en cours d'utilisation", + "req_id": "V11.7.2", + "req_description": "Vérifiez que la minimisation des données garantit que la quantité minimale de données est exposée pendant le traitement et assurez-vous que les données sont chiffrées immédiatement après utilisation ou dès que possible.", + "L": "3" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.1", + "section_name": "Conseils généraux de sécurité TLS", + "req_id": "V12.1.1", + "req_description": "Vérifiez que seules les dernières versions recommandées du protocole TLS sont activées, telles que TLS 1.2 et TLS 1.3. La dernière version du protocole TLS doit être privilégiée.", + "L": "1" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.1", + "section_name": "Conseils généraux de sécurité TLS", + "req_id": "V12.1.2", + "req_description": "Vérifiez que seules les suites de chiffrement recommandées sont activées, les suites de chiffrement les plus puissantes étant définies comme préférées. Les applications L3 doivent uniquement prendre en charge les suites de chiffrement assurant la confidentialité persistante (forward secrecy).", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.1", + "section_name": "Conseils généraux de sécurité TLS", + "req_id": "V12.1.3", + "req_description": "Vérifiez que l’application valide que les certificats clients mTLS sont approuvés avant d’utiliser l’identité du certificat pour l’authentification ou l’autorisation.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.1", + "section_name": "Conseils généraux de sécurité TLS", + "req_id": "V12.1.4", + "req_description": "Vérifiez que la révocation de certification appropriée, telle que l'agrafage du protocole OCSP (Online Certificate Status Protocol), est activée et configurée.", + "L": "3" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.1", + "section_name": "Conseils généraux de sécurité TLS", + "req_id": "V12.1.5", + "req_description": "Vérifiez que Encrypted Client Hello (ECH) est activé dans les paramètres TLS de l'application pour empêcher l'exposition de métadonnées sensibles, telles que l'indication du nom du serveur (SNI), pendant les processus de négociation TLS.", + "L": "3" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.2", + "section_name": "Communication HTTPS avec des services externes", + "req_id": "V12.2.1", + "req_description": "Vérifiez que TLS est utilisé pour toute connectivité entre un client et des services externes basés sur HTTP, et ne recourt pas à des communications non sécurisées ou non chiffrées.", + "L": "1" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.2", + "section_name": "Communication HTTPS avec des services externes", + "req_id": "V12.2.2", + "req_description": "Vérifiez que les services externes utilisent des certificats TLS publiquement approuvés.", + "L": "1" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.3", + "section_name": "Sécurité des communications entre services généraux", + "req_id": "V12.3.1", + "req_description": "Vérifiez qu'un protocole chiffré tel que TLS est utilisé pour toutes les connexions entrantes et sortantes vers et depuis l'application, y compris les systèmes de surveillance, les outils de gestion, l'accès à distance et SSH, les intergiciels, les bases de données, les mainframes, les systèmes partenaires ou les API externes. Le serveur ne doit pas recourir à des protocoles non sécurisés ou non chiffrés.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.3", + "section_name": "Sécurité des communications entre services généraux", + "req_id": "V12.3.2", + "req_description": "Vérifiez que les clients TLS valident les certificats reçus avant de communiquer avec un serveur TLS.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.3", + "section_name": "Sécurité des communications entre services généraux", + "req_id": "V12.3.3", + "req_description": "Vérifiez que TLS ou un autre mécanisme de chiffrement de transport approprié est utilisé pour toute connectivité entre les services internes basés sur HTTP au sein de l'application et ne se replie pas vers des communications non sécurisées ou non chiffrées.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.3", + "section_name": "Sécurité des communications entre services généraux", + "req_id": "V12.3.4", + "req_description": "Vérifiez que les connexions TLS entre les services internes utilisent des certificats de confiance. Lorsque des certificats générés en interne ou auto-signés sont utilisés, le service consommateur doit être configuré pour n'approuver que des autorités de certification internes spécifiques et des certificats auto-signés spécifiques.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.3", + "section_name": "Sécurité des communications entre services généraux", + "req_id": "V12.3.5", + "req_description": "Vérifiez que les services communiquant en interne au sein d'un système (communications intra-services) utilisent une authentification forte pour garantir la vérification de chaque endpoint. Des méthodes d'authentification forte, telles que l'authentification client TLS, doivent être utilisées pour garantir l'identité, en utilisant une infrastructure à clé publique et des mécanismes résistants aux attaques par rejeu. Pour les architectures de microservices, envisagez d'utiliser un maillage de services pour simplifier la gestion des certificats et renforcer la sécurité.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.1", + "section_name": "Documentation de configuration", + "req_id": "V13.1.1", + "req_description": "Vérifiez que tous les besoins de communication de l'application sont documentés. Cela doit inclure les services externes dont l'application dépend et les cas où un utilisateur final pourrait fournir un emplacement externe auquel l'application se connectera.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.1", + "section_name": "Documentation de configuration", + "req_id": "V13.1.2", + "req_description": "Vérifiez que pour chaque service utilisé par l'application, la documentation définit le nombre maximal de connexions simultanées (par exemple, les limites du pool de connexions) et le comportement de l'application lorsque cette limite est atteinte, y compris les mécanismes de secours ou de récupération, pour éviter les conditions de déni de service.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.1", + "section_name": "Documentation de configuration", + "req_id": "V13.1.3", + "req_description": "Vérifiez que la documentation de l'application définit des stratégies de gestion des ressources pour chaque système ou service externe utilisé (par exemple, bases de données, descripteurs de fichiers, threads, connexions HTTP). Cela doit inclure les procédures de libération des ressources, les paramètres de délai d'expiration, la gestion des échecs et l'implémentation de la logique de nouvelle tentative, en spécifiant les limites de nouvelle tentative, les délais et les algorithmes de retour arrière. Pour les opérations de requête-réponse HTTP synchrones, la documentation doit imposer des délais d'expiration courts et soit désactiver les nouvelles tentatives, soit les limiter strictement afin d'éviter les retards en cascade et l'épuisement des ressources.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.1", + "section_name": "Documentation de configuration", + "req_id": "V13.1.4", + "req_description": "Vérifiez que la documentation de l'application définit les secrets essentiels à la sécurité de l'application et un calendrier de rotation de ceux-ci, en fonction du modèle de menace et des exigences commerciales de l'organisation.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Configuration de la communication backend", + "req_id": "V13.2.1", + "req_description": "Vérifiez que les communications entre les composants de l'application backend qui ne prennent pas en charge le mécanisme de session utilisateur standard de l'application, notamment les API, les intergiciels et les couches de données, sont authentifiées. L'authentification doit utiliser des comptes de service individuels, des jetons à court terme ou une authentification par certificat, et non des identifiants immuables tels que des mots de passe, des clés API ou des comptes partagés avec accès privilégié.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Configuration de la communication backend", + "req_id": "V13.2.2", + "req_description": "Vérifiez que les communications entre les composants de l'application backend, y compris les services locaux ou du système d'exploitation, les API, les intergiciels et les couches de données, sont effectuées avec des comptes dotés des privilèges les moins nécessaires.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Configuration de la communication backend", + "req_id": "V13.2.3", + "req_description": "Vérifiez que si des informations d’identification doivent être utilisées pour l’authentification du service, les informations d’identification utilisées par le consommateur ne sont pas des informations d’identification par défaut (par exemple, root/root ou admin/admin).", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Configuration de la communication backend", + "req_id": "V13.2.4", + "req_description": "Vérifiez qu'une liste d’autorisations est utilisée pour définir les ressources ou systèmes externes avec lesquels l'application est autorisée à communiquer (par exemple, pour les requêtes sortantes, les chargements de données ou l'accès aux fichiers). Cette liste d'autorisation peut être implémentée au niveau de la couche applicative, du serveur web, du pare-feu ou d'une combinaison de différentes couches.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Configuration de la communication backend", + "req_id": "V13.2.5", + "req_description": "Vérifiez que le serveur Web ou d’application est configuré avec une liste autorisée de ressources ou de systèmes vers lesquels le serveur peut envoyer des requêtes ou charger des données ou des fichiers.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Configuration de la communication backend", + "req_id": "V13.2.6", + "req_description": "Vérifiez que lorsque l'application se connecte à des services distincts, elle suit la configuration documentée pour chaque connexion, comme le nombre maximal de connexions parallèles, le comportement lorsque le nombre maximal de connexions autorisées est atteint, les délais d'expiration de connexion et les stratégies de nouvelle tentative.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.3", + "section_name": "Gestion des secrets", + "req_id": "V13.3.1", + "req_description": "Vérifiez qu'une solution de gestion des secrets, telle qu'un coffre-fort de clés, est utilisée pour créer, stocker, contrôler l'accès et détruire en toute sécurité les secrets backend. Ceux-ci peuvent inclure des mots de passe, du matériel de clé, des intégrations avec des bases de données et des systèmes tiers, des clés et des graines pour des jetons temporels, d'autres secrets internes et des clés API. Les secrets ne doivent pas être inclus dans le code source de l'application ni dans les artefacts de build. Pour une application L3, cela doit impliquer une solution matérielle telle qu'un HSM.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.3", + "section_name": "Gestion des secrets", + "req_id": "V13.3.2", + "req_description": "Vérifiez que l’accès aux ressources secrètes respecte le principe du moindre privilège.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.3", + "section_name": "Gestion des secrets", + "req_id": "V13.3.3", + "req_description": "Vérifiez que toutes les opérations cryptographiques sont effectuées à l'aide d'un module de sécurité isolé (tel qu'un coffre-fort ou un module de sécurité matériel) pour gérer et protéger en toute sécurité le matériel clé contre toute exposition en dehors du module de sécurité.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.3", + "section_name": "Gestion des secrets", + "req_id": "V13.3.4", + "req_description": "Vérifiez que les secrets sont configurés pour expirer et être renouvelés en fonction de la documentation de l'application.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Fuite d'informations involontaire", + "req_id": "V13.4.1", + "req_description": "Vérifiez que l'application est déployée soit sans aucune métadonnée de contrôle de source, y compris les dossiers .git ou .svn, soit de manière à ce que ces dossiers soient inaccessibles à la fois en externe et à l'application elle-même.", + "L": "1" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Fuite d'informations involontaire", + "req_id": "V13.4.2", + "req_description": "Vérifiez que les modes de débogage sont désactivés pour tous les composants dans les environnements de production afin d’éviter l’exposition des fonctionnalités de débogage et la fuite d’informations.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Fuite d'informations involontaire", + "req_id": "V13.4.3", + "req_description": "Vérifiez que les serveurs Web n’exposent pas les listes de répertoires aux clients, sauf si cela est explicitement prévu.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Fuite d'informations involontaire", + "req_id": "V13.4.4", + "req_description": "Vérifiez que l’utilisation de la méthode HTTP TRACE n’est pas prise en charge dans les environnements de production, afin d’éviter toute fuite d’informations potentielle.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Fuite d'informations involontaire", + "req_id": "V13.4.5", + "req_description": "Vérifiez que la documentation (comme pour les API internes) et les endpoints de surveillance ne sont pas exposés, sauf si cela est explicitement prévu.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Fuite d'informations involontaire", + "req_id": "V13.4.6", + "req_description": "Vérifiez que l’application n’expose pas d’informations de version détaillées des composants backend.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Fuite d'informations involontaire", + "req_id": "V13.4.7", + "req_description": "Vérifiez que la couche web est configuré pour servir uniquement les fichiers avec des extensions de fichier spécifiques afin d’éviter toute fuite involontaire d’informations, de configuration et de code source.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.1", + "section_name": "Documentation sur la protection des données", + "req_id": "V14.1.1", + "req_description": "Vérifiez que toutes les données sensibles créées et traitées par l'application ont été identifiées et classées selon leur niveau de protection. Cela inclut les données uniquement codées et donc facilement déchiffrables, telles que les chaînes Base64 ou la charge utile en texte clair d'un JWT. Les niveaux de protection doivent tenir compte des réglementations et normes de protection des données et de confidentialité auxquelles l'application est tenue de se conformer.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.1", + "section_name": "Documentation sur la protection des données", + "req_id": "V14.1.2", + "req_description": "Vérifier que tous les niveaux de protection des données sensibles sont assortis d'un ensemble documenté d'exigences de protection. Cela doit inclure (sans s'y limiter) les exigences relatives au chiffrement général, à la vérification de l'intégrité, à la conservation, à la journalisation des données, aux contrôles d'accès aux données sensibles dans les journaux, au chiffrement au niveau de la base de données, aux technologies de confidentialité et de renforcement de la confidentialité à utiliser, ainsi qu'aux autres exigences de confidentialité.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.2", + "section_name": "Protection générale des données", + "req_id": "V14.2.1", + "req_description": "Vérifiez que les données sensibles sont uniquement envoyées au serveur dans les champs de corps ou d’en-tête du message HTTP, et que l’URL et la chaîne de requête ne contiennent pas d’informations sensibles, telles qu’une clé API ou un jeton de session.", + "L": "1" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.2", + "section_name": "Protection générale des données", + "req_id": "V14.2.2", + "req_description": "Vérifiez que l’application empêche la mise en cache des données sensibles dans les composants du serveur, tels que les équilibreurs de charge et les caches d’application, ou garantit que les données sont purgées en toute sécurité après utilisation.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.2", + "section_name": "Protection générale des données", + "req_id": "V14.2.3", + "req_description": "Vérifiez que les données sensibles définies ne sont pas envoyées à des parties non fiables (par exemple, des trackers d'utilisateurs) pour empêcher la collecte indésirable de données en dehors du contrôle de l'application.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.2", + "section_name": "Protection générale des données", + "req_id": "V14.2.4", + "req_description": "Vérifiez que les contrôles autour des données sensibles liés au chiffrement, à la vérification de l'intégrité, à la conservation, à la manière dont les données doivent être enregistrées, aux contrôles d'accès autour des données sensibles dans les journaux, à la confidentialité et aux technologies d'amélioration de la confidentialité, sont mis en œuvre comme défini dans la documentation pour le niveau de protection des données spécifiques.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.2", + "section_name": "Protection générale des données", + "req_id": "V14.2.5", + "req_description": "Vérifiez que les mécanismes de mise en cache sont configurés pour ne mettre en cache que les réponses dont le type de contenu est conforme à la ressource et qui ne contiennent pas de contenu sensible et dynamique. Le serveur web doit renvoyer une réponse 404 ou 302 lors de l'accès à un fichier inexistant plutôt qu'un fichier valide différent. Cela devrait empêcher les attaques par empoisonnement de cache web.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.2", + "section_name": "Protection générale des données", + "req_id": "V14.2.6", + "req_description": "Vérifiez que l'application ne renvoie que les données sensibles minimales requises pour son fonctionnement. Par exemple, ne renvoyez que certains chiffres d'un numéro de carte de crédit, et non le numéro complet. Si les données complètes sont requises, elles doivent être masquées dans l'interface utilisateur, sauf si l'utilisateur les consulte spécifiquement.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.2", + "section_name": "Protection générale des données", + "req_id": "V14.2.7", + "req_description": "Vérifiez que les informations sensibles sont soumises à une classification de conservation des données, en veillant à ce que les données obsolètes ou inutiles soient supprimées automatiquement, selon un calendrier défini ou selon les besoins de la situation.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.2", + "section_name": "Protection générale des données", + "req_id": "V14.2.8", + "req_description": "Vérifiez que les informations sensibles sont supprimées des métadonnées des fichiers soumis par l'utilisateur, sauf si le stockage est autorisé par l'utilisateur.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.3", + "section_name": "Protection des données côté client", + "req_id": "V14.3.1", + "req_description": "Vérifiez que les données authentifiées sont effacées du stockage client, comme le DOM du navigateur, après la fin du client ou de la session. Le champ d'en-tête de réponse HTTP « Clear-Site-Data » peut être utile, mais le côté client devrait également pouvoir effectuer la correction si la connexion au serveur n'est pas disponible à la fin de la session.", + "L": "1" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.3", + "section_name": "Protection des données côté client", + "req_id": "V14.3.2", + "req_description": "Vérifiez que l'application définit suffisamment de champs d'en-tête de réponse HTTP anti-caching (c'est-à-dire Cache-Control : no-store) afin que les données sensibles ne soient pas mises en cache dans les navigateurs.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.3", + "section_name": "Protection des données côté client", + "req_id": "V14.3.3", + "req_description": "Vérifiez que les données stockées dans le stockage du navigateur (telles que localStorage, sessionStorage, IndexedDB ou les cookies) ne contiennent pas de données sensibles, à l'exception des jetons de session.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.1", + "section_name": "Documentation sur le développement et l'architecture sécurisés", + "req_id": "V15.1.1", + "req_description": "Vérifiez que la documentation de l'application définit les délais de correction basés sur les risques pour les versions de composants tiers présentant des vulnérabilités et pour la mise à jour des bibliothèques en général, afin de minimiser les risques liés à ces composants.", + "L": "1" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.1", + "section_name": "Documentation sur le développement et l'architecture sécurisés", + "req_id": "V15.1.2", + "req_description": "Vérifiez qu'un catalogue d'inventaire, tel qu'une nomenclature logicielle (SBOM), est conservé pour toutes les bibliothèques tierces utilisées, y compris en vérifiant que les composants proviennent de référentiels prédéfinis, fiables et continuellement maintenus.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.1", + "section_name": "Documentation sur le développement et l'architecture sécurisés", + "req_id": "V15.1.3", + "req_description": "Vérifiez que la documentation de l'application identifie les fonctionnalités consommatrices en temps ou gourmandes en ressources. Elle doit notamment indiquer comment prévenir une perte de disponibilité due à une utilisation excessive de ces fonctionnalités et éviter que la génération d'une réponse ne prenne plus de temps que le délai d'expiration du consommateur. Les mesures de protection potentielles peuvent inclure le traitement asynchrone, l'utilisation de files d'attente et la limitation des processus parallèles par utilisateur et par application.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.1", + "section_name": "Documentation sur le développement et l'architecture sécurisés", + "req_id": "V15.1.4", + "req_description": "Vérifiez que la documentation de l’application met en évidence les bibliothèques tierces qui sont considérées comme des « composants à risque ».", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.1", + "section_name": "Documentation sur le développement et l'architecture sécurisés", + "req_id": "V15.1.5", + "req_description": "Vérifiez que la documentation de l’application met en évidence les parties de l’application où des « fonctionnalités dangereuses » sont utilisées.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.2", + "section_name": "Architecture de sécurité et dépendances", + "req_id": "V15.2.1", + "req_description": "Vérifiez que l’application contient uniquement des composants qui n’ont pas dépassé les délais de mise à jour et de correction documentés.", + "L": "1" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.2", + "section_name": "Architecture de sécurité et dépendances", + "req_id": "V15.2.2", + "req_description": "Vérifiez que l'application a mis en œuvre des défenses contre la perte de disponibilité due à des fonctionnalités qui prennent du temps ou qui nécessitent des ressources, sur la base des décisions et stratégies de sécurité documentées à cet effet.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.2", + "section_name": "Architecture de sécurité et dépendances", + "req_id": "V15.2.3", + "req_description": "Vérifiez que l'environnement de production inclut uniquement les fonctionnalités nécessaires au fonctionnement de l'application et n'expose pas de fonctionnalités superflues telles que du code de test, des exemples d'extraits et des fonctionnalités de développement.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.2", + "section_name": "Architecture de sécurité et dépendances", + "req_id": "V15.2.4", + "req_description": "Vérifiez que les composants tiers et toutes leurs dépendances transitives sont inclus à partir du référentiel attendu, qu'il soit détenu en interne ou qu'il s'agisse d'une source externe, et qu'il n'y a aucun risque d'attaque par confusion de dépendances.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.2", + "section_name": "Architecture de sécurité et dépendances", + "req_id": "V15.2.5", + "req_description": "Vérifiez que l'application implémente des protections supplémentaires autour des parties documentées comme contenant des « fonctionnalités dangereuses » ou utilisant des bibliothèques tierces considérées comme des « composants à risque ». Cela peut inclure des techniques telles que le sandboxing, l'encapsulation, la conteneurisation ou l'isolation au niveau du réseau pour retarder et dissuader les attaquants qui compromettent une partie de l'application de se propager ailleurs.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.3", + "section_name": "Développement défensif", + "req_id": "V15.3.1", + "req_description": "Vérifiez que l'application ne renvoie que le sous-ensemble requis de champs d'un objet de données. Par exemple, elle ne doit pas renvoyer un objet de données entier, car certains champs individuels ne doivent pas être accessibles aux utilisateurs.", + "L": "1" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.3", + "section_name": "Développement défensif", + "req_id": "V15.3.2", + "req_description": "Vérifiez que lorsque le backend de l'application effectue des appels vers des URL externes, il est configuré pour ne pas suivre les redirections, sauf s'il s'agit d'une fonctionnalité prévue.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.3", + "section_name": "Développement défensif", + "req_id": "V15.3.3", + "req_description": "Vérifiez que l'application dispose de contre-mesures pour se protéger contre les attaques d'affectation de masse en limitant les champs autorisés par contrôleur et action, par exemple, il n'est pas possible d'insérer ou de mettre à jour une valeur de champ lorsqu'elle n'était pas destinée à faire partie de cette action.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.3", + "section_name": "Développement défensif", + "req_id": "V15.3.4", + "req_description": "Vérifiez que tous les composants proxy et middleware transfèrent correctement l'adresse IP d'origine de l'utilisateur à l'aide de champs de données fiables qui ne peuvent pas être manipulés par l'utilisateur final, et que l'application et le serveur Web utilisent cette valeur correcte pour la journalisation et les décisions de sécurité telles que la limitation du débit, en tenant compte du fait que même l'adresse IP d'origine peut ne pas être fiable en raison d'adresses IP dynamiques, de VPN ou de pare-feu d'entreprise.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.3", + "section_name": "Développement défensif", + "req_id": "V15.3.5", + "req_description": "Vérifiez que l'application garantit explicitement que les variables sont du type correct et effectue des opérations d'égalité et de comparaison strictes. Cela permet d'éviter les vulnérabilités liées à la confusion de types, causées par des hypothèses du code de l'application sur le type d'une variable.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.3", + "section_name": "Développement défensif", + "req_id": "V15.3.6", + "req_description": "Vérifiez que le code JavaScript est écrit de manière à éviter la pollution du prototype, par exemple en utilisant Set() ou Map() au lieu de littéraux d'objet.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.3", + "section_name": "Développement défensif", + "req_id": "V15.3.7", + "req_description": "Vérifiez que l'application dispose de défenses contre les attaques de pollution des paramètres HTTP, en particulier si le Framework d'application ne fait aucune distinction quant à la source des paramètres de requête (chaîne de requête, paramètres de corps, cookies ou champs d'en-tête).", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.4", + "section_name": "Concurrence sécurisée", + "req_id": "V15.4.1", + "req_description": "Vérifiez que les objets partagés dans le code multithread (tels que les caches, les fichiers ou les objets en mémoire accessibles par plusieurs threads) sont accessibles en toute sécurité à l'aide de types thread-safe et de mécanismes de synchronisation tels que des verrous ou des sémaphores pour éviter les conditions de concurrence et la corruption des données.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.4", + "section_name": "Concurrence sécurisée", + "req_id": "V15.4.2", + "req_description": "Vérifiez que les vérifications de l'état d'une ressource, comme son existence ou ses autorisations, et des actions qui en dépendent, sont effectuées en une seule opération atomique afin d'éviter les situations de concurrence entre le moment de la vérification et le moment de l'utilisation (TOCTOU). Par exemple, vérifier l'existence d'un fichier avant de l'ouvrir ou l'accès d'un utilisateur avant de l'accorder.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.4", + "section_name": "Concurrence sécurisée", + "req_id": "V15.4.3", + "req_description": "Vérifiez que les verrous sont utilisés de manière cohérente pour éviter que les threads ne se bloquent, que ce soit en s'attendant les uns les autres ou en réessayant sans fin, et que la logique de verrouillage reste dans le code responsable de la gestion de la ressource pour garantir que les verrous ne peuvent pas être modifiés par inadvertance ou de manière malveillante par des classes ou du code externes.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.4", + "section_name": "Concurrence sécurisée", + "req_id": "V15.4.4", + "req_description": "Vérifiez que les politiques d'allocation des ressources empêchent la saturation de threads en garantissant un accès équitable aux ressources, par exemple en exploitant les pools de threads, permettant aux threads de priorité inférieure de continuer dans un délai raisonnable.", + "L": "3" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.1", + "section_name": "Documentation sur la journalisation de sécurité", + "req_id": "V16.1.1", + "req_description": "Vérifiez qu'il existe un inventaire documentant la journalisation effectuée à chaque couche de la pile technologique de l'application, les événements enregistrés, les formats de journal, l'endroit où cette journalisation est stockée, la manière dont elle est utilisée, la manière dont l'accès à celle-ci est contrôlé et la durée de conservation des journaux.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.2", + "section_name": "Journalisation générale", + "req_id": "V16.2.1", + "req_description": "Vérifiez que chaque entrée de journal inclut les métadonnées nécessaires (telles que quand, où, qui, quoi) qui permettraient une enquête détaillée sur la chronologie lorsqu'un événement se produit.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.2", + "section_name": "Journalisation générale", + "req_id": "V16.2.2", + "req_description": "Vérifiez que les sources de temps de tous les composants de journalisation sont synchronisées et que les horodatages des métadonnées des événements de sécurité utilisent le temps UTC ou incluent un décalage horaire explicite. L'UTC est recommandé pour garantir la cohérence entre les systèmes distribués et éviter toute confusion lors du passage à l'heure d'été.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.2", + "section_name": "Journalisation générale", + "req_id": "V16.2.3", + "req_description": "Vérifiez que l’application stocke ou diffuse uniquement les journaux vers les fichiers et services documentés dans l’inventaire des journaux.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.2", + "section_name": "Journalisation générale", + "req_id": "V16.2.4", + "req_description": "Vérifiez que les journaux peuvent être lus et corrélés par le processeur de journaux utilisé, de préférence en utilisant un format de journalisation commun.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.2", + "section_name": "Journalisation générale", + "req_id": "V16.2.5", + "req_description": "Vérifiez que l'application applique la journalisation en fonction du niveau de protection des données lors de la journalisation de données sensibles. Par exemple, certaines données, comme les identifiants ou les informations de paiement, peuvent être interdites. D'autres données, comme les jetons de session, ne peuvent être enregistrées que par hachage ou masquage, en totalité ou en partie.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.3", + "section_name": "Événements de sécurité", + "req_id": "V16.3.1", + "req_description": "Vérifiez que toutes les opérations d'authentification sont enregistrées, y compris les tentatives réussies et infructueuses. Des métadonnées supplémentaires, telles que le type d'authentification ou les facteurs utilisés, doivent également être collectées.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.3", + "section_name": "Événements de sécurité", + "req_id": "V16.3.2", + "req_description": "Vérifier que les tentatives d'autorisation infructueuses sont logguées. Pour le niveau 3, cela doit inclure la journalisation de toutes les décisions d'autorisation, y compris lors de l'accès à des données sensibles (sans journalisation des données sensibles elles-mêmes).", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.3", + "section_name": "Événements de sécurité", + "req_id": "V16.3.3", + "req_description": "Vérifiez que l'application enregistre les événements de sécurité définis dans la documentation et enregistre également les tentatives de contournement des contrôles de sécurité, tels que la validation des entrées, la logique métier et l'anti-automatisation.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.3", + "section_name": "Événements de sécurité", + "req_id": "V16.3.4", + "req_description": "Vérifiez que l’application enregistre les erreurs inattendues et les échecs de contrôle de sécurité tels que les échecs TLS du backend.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.4", + "section_name": "Protection des journaux", + "req_id": "V16.4.1", + "req_description": "Vérifiez que tous les composants de journalisation codent correctement les données pour empêcher l’injection de journaux.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.4", + "section_name": "Protection des journaux", + "req_id": "V16.4.2", + "req_description": "Vérifiez que les journaux sont protégés contre tout accès non autorisé et ne peuvent pas être modifiés.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.4", + "section_name": "Protection des journaux", + "req_id": "V16.4.3", + "req_description": "Vérifiez que les journaux sont transmis de manière sécurisée à un système logique distinct pour analyse, détection, alerte et remontée des informations. L'objectif est de garantir qu'en cas de violation de l'application, les journaux ne seront pas compromis.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.5", + "section_name": "Gestion des erreurs", + "req_id": "V16.5.1", + "req_description": "Vérifiez qu'un message générique est renvoyé au consommateur lorsqu'une erreur inattendue ou sensible à la sécurité se produit, garantissant ainsi l'absence d'exposition de données système internes sensibles telles que les traces de pile, les requêtes, les clés secrètes et les jetons.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.5", + "section_name": "Gestion des erreurs", + "req_id": "V16.5.2", + "req_description": "Vérifiez que l'application continue de fonctionner en toute sécurité lorsque l'accès aux ressources externes échoue, par exemple, en utilisant des modèles tels que des disjoncteurs ou une dégradation progressive.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.5", + "section_name": "Gestion des erreurs", + "req_id": "V16.5.3", + "req_description": "Vérifiez que l'application échoue proprement et sécurisée, y compris lorsqu'une exception se produit, en évitant les accès en cas d'erreur telles que le traitement d'une transaction malgré les erreurs résultant de la logique de validation.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.5", + "section_name": "Gestion des erreurs", + "req_id": "V16.5.4", + "req_description": "Vérifiez qu'un gestionnaire d'erreurs de « dernier recours » est défini pour intercepter toutes les exceptions non gérées. Cela permet d'éviter la perte des informations d'erreur qui doivent être loguées dans les fichiers journaux et de garantir qu'une erreur ne paralyse pas l'ensemble du processus applicatif, entraînant une perte de disponibilité.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.1", + "section_name": "Serveur TURN", + "req_id": "V17.1.1", + "req_description": "Vérifiez que le service TURN (Traversal Using Relays around NAT) autorise uniquement l'accès aux adresses IP non réservées à des fins spécifiques (par exemple, réseaux internes, diffusion, bouclage). Notez que cela s'applique aux adresses IPv4 et IPv6.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.1", + "section_name": "Serveur TURN", + "req_id": "V17.1.2", + "req_description": "Vérifiez que le service Traversal Using Relays around NAT (TURN) n'est pas susceptible d'épuiser ses ressources lorsque des utilisateurs légitimes tentent d'ouvrir un grand nombre de ports sur le serveur TURN.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Média", + "req_id": "V17.2.1", + "req_description": "Vérifiez que la clé du certificat Datagram Transport Layer Security (DTLS) est gérée et protégée conformément à la politique documentée de gestion des clés cryptographiques.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Média", + "req_id": "V17.2.2", + "req_description": "Vérifiez que le serveur multimédia est configuré pour utiliser et prendre en charge les suites de chiffrement DTLS (Datagram Transport Layer Security) approuvées et un profil de protection sécurisé pour l'extension DTLS pour l'établissement de clés pour le protocole de transport en temps réel sécurisé (DTLS-SRTP).", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Média", + "req_id": "V17.2.3", + "req_description": "Vérifiez que l'authentification SRTP (Secure Real-time Transport Protocol) est vérifiée sur le serveur multimédia pour empêcher les attaques par injection RTP (Real-time Transport Protocol) d'entraîner une condition de déni de service ou l'insertion de médias audio ou vidéo dans les flux multimédias.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Média", + "req_id": "V17.2.4", + "req_description": "Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant lorsqu'il rencontre des paquets SRTP (Secure Real-time Transport Protocol) mal formés.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Média", + "req_id": "V17.2.5", + "req_description": "Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Média", + "req_id": "V17.2.6", + "req_description": "Vérifiez que le serveur multimédia n'est pas sensible à la vulnérabilité de condition de concurrence « ClientHello » dans Datagram Transport Layer Security (DTLS) en vérifiant si le serveur multimédia est publiquement connu comme étant vulnérable ou en effectuant le test de condition de concurrence.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Média", + "req_id": "V17.2.7", + "req_description": "Vérifiez que tous les mécanismes d'enregistrement audio ou vidéo associés au serveur multimédia sont en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Média", + "req_id": "V17.2.8", + "req_description": "Vérifiez que le certificat Datagram Transport Layer Security (DTLS) est vérifié par rapport à l'attribut d'empreinte cryptographique du protocole de description de session (SDP), en mettant fin au flux multimédia si la vérification échoue, pour garantir l'authenticité du flux multimédia.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.3", + "section_name": "Signalisation", + "req_id": "V17.3.1", + "req_description": "Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation entrants légitimes lors d'une attaque par saturation. Cela peut être réalisé en implémentant une limitation de débit au niveau de la signalisation.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.3", + "section_name": "Signalisation", + "req_id": "V17.3.2", + "req_description": "Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation légitimes en cas de message mal formé susceptible de provoquer un déni de service. Cela peut inclure la validation des entrées, la gestion sécurisée des dépassements d'entiers, la prévention des dépassements de tampon et l'utilisation d'autres techniques robustes de gestion des erreurs.", + "L": "2" + } + ] +} diff --git a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.flat.legacy.json b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.flat.legacy.json new file mode 100644 index 0000000000..da3d145c8e --- /dev/null +++ b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.flat.legacy.json @@ -0,0 +1,4489 @@ +{ + "requirements": [ + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.1", + "section_name": "Architecture d'encodage et de nettoyage", + "req_id": "V1.1.1", + "req_description": "Vérifiez que l'entrée est décodée ou non échappée vers une forme canonique une seule fois, elle n'est décodée que lorsque des données codées sous cette forme sont attendues, et que cela est fait avant de traiter davantage l'entrée, par exemple, elle n'est pas effectuée après la validation ou la désinfection de l'entrée.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.1", + "section_name": "Architecture d'encodage et de nettoyage", + "req_id": "V1.1.2", + "req_description": "Vérifiez que l'application effectue l'encodage et l'échappement de sortie soit comme étape finale avant d'être utilisée par l'interpréteur pour lequel elle est destinée, soit par l'interpréteur lui-même.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.1", + "req_description": "Vérifiez que l'encodage de sortie d'une réponse HTTP, d'un document HTML ou d'un document XML est pertinent pour le contexte requis, comme l'encodage des caractères pertinents pour les éléments HTML, les attributs HTML, les commentaires HTML, les CSS ou les champs d'en-tête HTTP, pour éviter de modifier la structure du message ou du document.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.2", + "req_description": "Vérifiez que, lors de la création dynamique d'URL, les données non fiables sont encodées en fonction de leur contexte (par exemple, encodage d'URL ou encodage base64url pour les paramètres de requête ou de chemin). Assurez-vous que seuls les schémas d'URL sûrs sont autorisés (par exemple, interdire javascript: ou data:).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.3", + "req_description": "Vérifiez que l'encodage ou l'échappement de sortie est utilisé lors de la création dynamique de contenu JavaScript (y compris JSON), pour éviter de modifier la structure du message ou du document (pour éviter l'injection JavaScript et JSON).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.4", + "req_description": "Vérifiez que la sélection de données ou les requêtes de base de données (par exemple, SQL, HQL, NoSQL, Cypher) utilisent des requêtes paramétrées, des ORM, des Framework d'entités ou sont protégées contre les injections SQL et autres attaques par injection de base de données. Ceci est également pertinent lors de l'écriture de procédures stockées.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.5", + "req_description": "Vérifiez que l’application protège contre l’injection de commandes du système d’exploitation et que les appels du système d’exploitation utilisent des requêtes du système d’exploitation paramétrées ou utilisent un encodage de sortie de ligne de commande contextuelle.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.6", + "req_description": "Vérifiez que l’application protège contre les vulnérabilités d’injection LDAP ou que des contrôles de sécurité spécifiques pour empêcher l’injection LDAP ont été mis en œuvre.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.7", + "req_description": "Vérifiez que l’application est protégée contre les attaques par injection XPath en utilisant la paramétrisation des requêtes ou des requêtes précompilées.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.8", + "req_description": "Vérifiez que les processeurs LaTeX sont configurés de manière sécurisée (par exemple, en n'utilisant pas l'indicateur « --shell-escape ») et qu'une liste d’autorisations de commandes est utilisée pour empêcher les attaques par injection LaTeX.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.9", + "req_description": "Vérifiez que l'application échappe les caractères spéciaux dans les expressions régulières (généralement à l'aide d'une barre oblique inverse) pour éviter qu'ils ne soient mal interprétés comme des métacaractères.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.2", + "section_name": "Prévention des injections", + "req_id": "V1.2.10", + "req_description": "Vérifiez que l'application est protégée contre les injections CSV et injections de formules. L'application doit respecter les règles d'échappement définies dans les sections 2.6 et 2.7 de la RFC 4180 lors de l'export de contenu CSV. De plus, lors de l'export au format CSV ou vers d'autres formats de tableur (tels que XLS, XLSX ou ODF), les caractères spéciaux (notamment « = », « + », « - », « @ », « \\t » (tabulation) et « \\0 » (caractère null)) doivent être protégés par une apostrophe s'ils apparaissent en premier dans une valeur de champ.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.1", + "req_description": "Vérifiez que toutes les entrées HTML non fiables provenant d'éditeurs WYSIWYG ou similaires sont nettoyées à l'aide d'une bibliothèque ou d'une fonctionnalité de Framework de nettoyage HTML bien connue et sécurisée.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.2", + "req_description": "Vérifiez que l'application évite d'utiliser eval() ou d'autres fonctionnalités d'exécution de code dynamique telles que Spring Expression Language (SpEL). En l'absence d'alternative, toute saisie utilisateur incluse doit être nettoyée avant d'être exécutée.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.3", + "req_description": "Vérifiez que les données transmises à un contexte potentiellement dangereux sont préalablement nettoyées pour appliquer des mesures de sécurité, telles qu'autoriser uniquement des caractères sûrs pour ce contexte et raccourcir des entrées trop longues.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.4", + "req_description": "Vérifiez que le contenu Scalable Vector Graphics (SVG) scriptable fourni par l'utilisateur est validé ou nettoyé pour contenir uniquement des balises et des attributs (tels que des graphiques de dessin) qui sont sûrs pour l'application, par exemple, ne contiennent pas de scripts et d'objets étrangers.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.5", + "req_description": "Vérifiez que l'application nettoie ou désactive le contenu du langage de modèle d'expression ou de script fourni par l'utilisateur, tel que les feuilles de style CSS, le Markdown ou XSL, BBCode ou similaire.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.6", + "req_description": "Vérifiez que l'application protège contre les attaques de falsification de requête côté serveur (SSRF), en validant les données non fiables par rapport à une liste d'autorisation de protocoles, de domaines, de chemins et de ports et en nettoyant les caractères potentiellement dangereux avant d'utiliser les données pour appeler un autre service.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.7", + "req_description": "Vérifiez que l'application se protège contre les attaques par injection de modèles en interdisant la création de modèles basés sur des entrées non fiables. En l'absence d'alternative, toute entrée non fiable incluse dynamiquement lors de la création du modèle doit être nettoyée ou rigoureusement validée.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.8", + "req_description": "Vérifiez que l’application nettoie correctement les entrées non fiables avant utilisation dans les requêtes Java Naming and Directory Interface (JNDI) et que JNDI est configuré de manière sécurisée pour empêcher les attaques par injection JNDI.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.9", + "req_description": "Vérifiez que l’application nettoie le contenu avant qu’il ne soit envoyé à memcache pour éviter les attaques par injection.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.10", + "req_description": "Vérifiez que les chaînes de format susceptibles d'être résolues de manière inattendue ou malveillante lors de leur utilisation sont nettoyées avant d'être traitées.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.11", + "req_description": "Vérifiez que l'application nettoie les entrées utilisateur avant de les transmettre aux systèmes de messagerie pour se protéger contre l'injection SMTP ou IMAP.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.3", + "section_name": "Nettoyage", + "req_id": "V1.3.12", + "req_description": "Vérifiez que les expressions régulières sont exemptes d'éléments provoquant \"backtracking\" exponentiel et assurez-vous que les entrées non fiables sont nettoyées pour atténuer les attaques ReDoS ou Runaway Regex.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.4", + "section_name": "Mémoire, chaine de caractères et code à mémoire non-managée", + "req_id": "V1.4.1", + "req_description": "Vérifiez que l'application utilise des chaînes memory-safe, une copie de mémoire et une arithmétique de pointeur renforcée pour détecter ou empêcher les débordements de pile, de tampon ou de tas.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.4", + "section_name": "Mémoire, chaine de caractères et code à mémoire non-managée", + "req_id": "V1.4.2", + "req_description": "Vérifiez que les techniques de validation du signe, de la plage et de l’entrée sont utilisées pour éviter les dépassements d’entiers.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.4", + "section_name": "Mémoire, chaine de caractères et code à mémoire non-managée", + "req_id": "V1.4.3", + "req_description": "Vérifiez que la mémoire et les ressources allouées dynamiquement sont libérées et que les références ou les pointeurs vers la mémoire libérée sont supprimés ou définis à null pour éviter les \"dangling pointer\" et les vulnérabilités d'utilisation après libération.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.5", + "section_name": "Désérialisation sécurisée", + "req_id": "V1.5.1", + "req_description": "Vérifiez que l'application configure les \"parser\" XML pour utiliser une configuration restrictive et que les fonctionnalités non sûres telles que la résolution d'entités externes sont désactivées pour empêcher les attaques XML eXternal Entity (XXE).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.5", + "section_name": "Désérialisation sécurisée", + "req_id": "V1.5.2", + "req_description": "Vérifiez que la désérialisation des données non fiables garantit une gestion sécurisée des entrées, par exemple en utilisant une liste d'autorisation de types d'objets ou en limitant les types d'objets définis par le client, afin d'empêcher les attaques par désérialisation. Les mécanismes de désérialisation explicitement définis comme non sécurisés ne doivent pas être utilisés avec des entrées non fiables.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encodage et nettoyage", + "section_id": "V1.5", + "section_name": "Désérialisation sécurisée", + "req_id": "V1.5.3", + "req_description": "Vérifiez que les différents \"parser\" utilisés dans l'application pour le même type de données (par exemple, les \"parser\" JSON, les \"parser\" XML, les \"parser\" d'URL) effectuent l'analyse de manière cohérente et utilisent le même mécanisme d'encodage de caractères pour éviter des problèmes tels que les vulnérabilités d'interopérabilité JSON ou un comportement d'analyse d'URI ou de fichier différent exploité dans les attaques d'inclusion de fichiers à distance (RFI) ou de falsification de requête côté serveur (SSRF).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.1", + "section_name": "Validation et documentation de la logique métier", + "req_id": "V2.1.1", + "req_description": "Vérifiez que la documentation de l'application définit des règles de validation des entrées pour vérifier la validité des éléments de données par rapport à la structure attendue. Il peut s'agir de formats de données courants tels que des numéros de carte de crédit, des adresses e-mail ou des numéros de téléphone, ou d'un format de données interne.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.1", + "section_name": "Validation et documentation de la logique métier", + "req_id": "V2.1.2", + "req_description": "Vérifiez que la documentation de l'application définit comment valider la cohérence logique et contextuelle des éléments de données combinés, par exemple en vérifiant que la banlieue et le code postal correspondent.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.1", + "section_name": "Validation et documentation de la logique métier", + "req_id": "V2.1.3", + "req_description": "Vérifiez que les attentes en matière de limites et de validations de la logique métier sont documentées, y compris par utilisateur et globalement dans l'application.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.2", + "section_name": "Validation des entrées", + "req_id": "V2.2.1", + "req_description": "Vérifier que les entrées sont validées afin de respecter les attentes métier ou fonctionnelles. Cette validation doit être basée sur une liste de valeurs, de modèles et de plages autorisées, ou sur la comparaison des entrées avec une structure attendue et des limites logiques selon des règles prédéfinies. Pour le niveau 1, cette validation peut se concentrer sur les entrées utilisées pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau 2, elle doit s'appliquer à toutes les entrées.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.2", + "section_name": "Validation des entrées", + "req_id": "V2.2.2", + "req_description": "Vérifiez que l'application est conçue pour appliquer la validation des entrées au niveau d'une couche de service de confiance. Bien que la validation côté client améliore l'ergonomie et doit être encouragée, elle ne doit pas être considérée comme un contrôle de sécurité.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.2", + "section_name": "Validation des entrées", + "req_id": "V2.2.3", + "req_description": "Vérifiez que l’application garantit que les combinaisons d’éléments de données associés sont raisonnables selon les règles prédéfinies.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.3", + "section_name": "Sécurité de la logique métier", + "req_id": "V2.3.1", + "req_description": "Vérifiez que l’application traitera uniquement les flux de logique métier pour le même utilisateur dans l’ordre séquentiel attendu et sans sauter d’étapes.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.3", + "section_name": "Sécurité de la logique métier", + "req_id": "V2.3.2", + "req_description": "Vérifiez que les limites de la logique métier sont implémentées conformément à la documentation de l'application, afin d'éviter que des failles de la logique métier ne soient pas exploitées.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.3", + "section_name": "Sécurité de la logique métier", + "req_id": "V2.3.3", + "req_description": "Vérifiez que les transactions sont utilisées au niveau de la logique métier de telle sorte qu'une opération de logique métier réussisse dans son intégralité ou qu'elle soit restaurée à l'état correct précédent.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.3", + "section_name": "Sécurité de la logique métier", + "req_id": "V2.3.4", + "req_description": "Vérifiez que les mécanismes de verrouillage au niveau de la logique métier sont utilisés pour garantir que les ressources en quantité limitée (telles que les sièges de théâtre ou les créneaux de livraison) ne peuvent pas être réservées deux fois en manipulant la logique de l'application.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.3", + "section_name": "Sécurité de la logique métier", + "req_id": "V2.3.5", + "req_description": "Vérifiez que les flux logiques métier à forte valeur ajoutée nécessitent l'approbation de plusieurs utilisateurs afin d'éviter toute action non autorisée ou accidentelle. Cela peut inclure, sans s'y limiter, les transferts monétaires importants, les approbations de contrats, l'accès à des informations classifiées ou les contournements de sécurité dans le secteur manufacturier.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.4", + "section_name": "Anti-automatisation", + "req_id": "V2.4.1", + "req_description": "Vérifiez que des contrôles anti-automatisation sont en place pour protéger contre les appels excessifs aux fonctions d'application qui pourraient conduire à l'exfiltration de données, à la création de données inutiles, à l'épuisement des quotas, aux violations de limites de débit, au déni de service ou à la surutilisation de ressources coûteuses.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation et logique métier", + "section_id": "V2.4", + "section_name": "Anti-automatisation", + "req_id": "V2.4.2", + "req_description": "Vérifiez que les flux logiques métier nécessitent un timing humain réaliste, évitant ainsi des soumissions de transactions excessivement rapides.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.1", + "section_name": "Documentation sur la sécurité du frontend Web", + "req_id": "V3.1.1", + "req_description": "Vérifiez que la documentation de l'application indique les fonctionnalités de sécurité attendues que les navigateurs utilisant l'application doivent prendre en charge (telles que HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) et autres mécanismes de sécurité HTTP pertinents). Elle doit également définir le comportement de l'application lorsque certaines de ces fonctionnalités ne sont pas disponibles (par exemple, avertir l'utilisateur ou bloquer l'accès).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.2", + "section_name": "Interprétation non intentionnelle du contenu", + "req_id": "V3.2.1", + "req_description": "Vérifiez que des contrôles de sécurité sont en place pour empêcher les navigateurs d'afficher du contenu ou des fonctionnalités dans les réponses HTTP dans un contexte incorrect (par exemple, lorsqu'une API, un fichier téléchargé par l'utilisateur ou une autre ressource est demandée directement). Les contrôles possibles peuvent inclure : ne pas transmettre le contenu sauf si les champs d'en-tête de requête HTTP (tels que Sec-Fetch-\\*) indiquent qu'il s'agit du contexte correct, utiliser la directive sandbox du champ d'en-tête Content-Security-Policy ou utiliser le type de disposition de pièce jointe dans le champ d'en-tête Content-Disposition.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.2", + "section_name": "Interprétation non intentionnelle du contenu", + "req_id": "V3.2.2", + "req_description": "Vérifiez que le contenu destiné à être affiché sous forme de texte, plutôt que rendu sous forme de HTML, est géré à l'aide de fonctions de rendu sécurisées (telles que createTextNode ou textContent) pour empêcher l'exécution involontaire de contenu tel que HTML ou JavaScript.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.2", + "section_name": "Interprétation non intentionnelle du contenu", + "req_id": "V3.2.3", + "req_description": "Vérifiez que l'application évite l'écrasement du DOM lors de l'utilisation de JavaScript côté client en utilisant des déclarations de variables explicites, en effectuant une vérification de type stricte, en évitant de stocker des variables globales sur l'objet document et en implémentant l'isolation de l'espace de nommage.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.3", + "section_name": "Configuration des cookies", + "req_id": "V3.3.1", + "req_description": "Vérifiez que les cookies ont l'attribut « Secure » ​​défini et si le préfixe « \\__Host- » n'est pas utilisé pour le nom du cookie, le préfixe « __Secure- » doit être utilisé pour le nom du cookie.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.3", + "section_name": "Configuration des cookies", + "req_id": "V3.3.2", + "req_description": "Vérifiez que la valeur de l'attribut « SameSite » de chaque cookie est définie en fonction de l'objectif du cookie, afin de limiter l'exposition aux attaques de réparation de l'interface utilisateur et aux attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.3", + "section_name": "Configuration des cookies", + "req_id": "V3.3.3", + "req_description": "Vérifiez que les cookies ont le préfixe « __Host- » pour le nom du cookie, sauf s'ils sont explicitement conçus pour être partagés avec d'autres hôtes.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.3", + "section_name": "Configuration des cookies", + "req_id": "V3.3.4", + "req_description": "Vérifiez que si la valeur d'un cookie n'est pas censée être accessible aux scripts côté client (comme un jeton de session), le cookie doit avoir l'attribut « HttpOnly » défini et la même valeur (par exemple, un jeton de session) ne doit être transférée au client que via le champ d'en-tête « Set-Cookie ».", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.3", + "section_name": "Configuration des cookies", + "req_id": "V3.3.5", + "req_description": "Vérifiez que lorsque l'application écrit un cookie, la longueur combinée du nom et de la valeur du cookie ne dépasse pas 4 096 octets. Les cookies trop volumineux ne seront pas stockés par le navigateur et ne seront donc pas envoyés avec les requêtes, empêchant ainsi l'utilisateur d'utiliser les fonctionnalités de l'application qui reposent sur ce cookie.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.4", + "section_name": "En-têtes du mécanisme de sécurité du navigateur", + "req_id": "V3.4.1", + "req_description": "Vérifiez qu'un champ d'en-tête Strict-Transport-Security est inclus dans toutes les réponses afin d'appliquer une politique HTTP Strict Transport Security (HSTS). Une durée maximale d'au moins un an doit être définie, et pour les niveaux L2 et supérieurs, la politique doit également s'appliquer à tous les sous-domaines.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.4", + "section_name": "En-têtes du mécanisme de sécurité du navigateur", + "req_id": "V3.4.2", + "req_description": "Vérifiez que le champ d'en-tête Access-Control-Allow-Origin du partage de ressources cross-origine (CORS) est une valeur fixe de l'application ou, si la valeur du champ d'en-tête de requête HTTP Origin est utilisée, qu'elle est validée par rapport à une liste d'origines approuvées. Si « Access-Control-Allow-Origin: * » doit être utilisé, vérifiez que la réponse ne contient aucune information sensible.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.4", + "section_name": "En-têtes du mécanisme de sécurité du navigateur", + "req_id": "V3.4.3", + "req_description": "Vérifiez que les réponses HTTP incluent un champ d'en-tête de réponse Content-Security-Policy qui définit des directives garantissant que le navigateur charge et exécute uniquement du contenu ou des ressources fiables, afin de limiter l'exécution de JavaScript malveillant. Au minimum, une politique globale doit être utilisée, incluant les directives object-src 'none' et base-uri 'none', et définissant soit une lliste d’autorisations, soit des valeurs nonces ou des hachages. Pour une application L3, une politique par réponse avec des valeurs nonces ou des hachages doit être définie.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.4", + "section_name": "En-têtes du mécanisme de sécurité du navigateur", + "req_id": "V3.4.4", + "req_description": "Vérifiez que toutes les réponses HTTP contiennent un champ d'en-tête « X-Content-Type-Options: nosniff ». Cela indique aux navigateurs de ne pas utiliser l'analyse de contenu ni la détection du type MIME pour la réponse donnée, et d'exiger que la valeur du champ d'en-tête « Content-Type » de la réponse corresponde à la ressource de destination. Par exemple, la réponse à une demande de style n'est acceptée que si le type de contenu de la réponse est « text/css ». Cela permet également au navigateur d'utiliser la fonctionnalité de blocage de lecture inter-origines (CORB).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.4", + "section_name": "En-têtes du mécanisme de sécurité du navigateur", + "req_id": "V3.4.5", + "req_description": "Vérifiez que l'application définit une politique de référencement afin d'empêcher la fuite de données techniquement sensibles vers des services tiers via le champ d'en-tête de requête HTTP « Referer ». Cela peut être effectué via le champ d'en-tête de réponse HTTP « Referrer-Policy » ou via les attributs d'élément HTML. Les données sensibles peuvent inclure le chemin d'accès et les données de requête dans l'URL, et pour les applications internes non publiques, le nom d'hôte.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.4", + "section_name": "En-têtes du mécanisme de sécurité du navigateur", + "req_id": "V3.4.6", + "req_description": "Vérifiez que l'application Web utilise la directive frame-ancestors du champ d'en-tête Content-Security-Policy pour chaque réponse HTTP afin de garantir qu'elle ne peut pas être intégrée par défaut et que l'intégration de ressources spécifiques n'est autorisée qu'en cas de nécessité. Notez que le champ d'en-tête X-Frame-Options, bien que pris en charge par les navigateurs, est obsolète et n'est pas forcément fiable.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.4", + "section_name": "En-têtes du mécanisme de sécurité du navigateur", + "req_id": "V3.4.7", + "req_description": "Vérifiez que le champ d’en-tête Content-Security-Policy spécifie un emplacement pour signaler les violations.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.4", + "section_name": "En-têtes du mécanisme de sécurité du navigateur", + "req_id": "V3.4.8", + "req_description": "Vérifiez que toutes les réponses HTTP qui lancent le rendu d'un document (comme les réponses de type text/html) incluent le champ d'en-tête 'Cross-Origin-Opener-Policy' avec la directive 'same-origin' ou s'ame-origin-allow-popups', selon les besoins. Cela empêche les attaques abusant de l'accès partagé aux objets Window, telles que le tabnabbing et le comptage d'images.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.5", + "section_name": "Séparation de l'origine du navigateur", + "req_id": "V3.5.1", + "req_description": "Vérifiez que, si l'application ne s'appuie pas sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher les requêtes inter-origines non autorisées d'utiliser des fonctionnalités sensibles, ces requêtes sont validées afin de garantir leur origine. Cela peut se faire en utilisant et en validant des jetons anti-falsification ou en exigeant des champs d'en-tête HTTP supplémentaires qui ne sont pas des champs d'en-tête de requête CORS safelist. Ceci permet de se protéger contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.5", + "section_name": "Séparation de l'origine du navigateur", + "req_id": "V3.5.2", + "req_description": "Vérifiez que, si l'application s'appuie sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher l'utilisation inter-origines non autorisée de fonctionnalités sensibles, il est impossible d'appeler la fonctionnalité avec une requête qui ne déclenche pas de requête de pré-vérification cross-origin CORS. Cela peut nécessiter de vérifier les valeurs des champs d'en-tête de requête 'Origin' et 'Content-Type' ou d'utiliser un champ d'en-tête supplémentaire qui n'est pas un champ d'en-tête de la liste de sécurité CORS.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.5", + "section_name": "Séparation de l'origine du navigateur", + "req_id": "V3.5.3", + "req_description": "Vérifiez que les requêtes HTTP destinées aux fonctionnalités sensibles utilisent des méthodes HTTP appropriées, telles que POST, PUT, PATCH ou DELETE, et non des méthodes définies comme « sûres » par la spécification HTTP, telles que HEAD, OPTIONS ou GET. Une validation stricte des champs d'en-tête de requête Sec-Fetch-* peut également être utilisée pour garantir que la requête ne provient pas d'un appel inter-origines inapproprié, d'une requête de navigation ou d'un chargement de ressources (comme une source d'image) inattendu.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.5", + "section_name": "Séparation de l'origine du navigateur", + "req_id": "V3.5.4", + "req_description": "Vérifiez que des applications distinctes sont hébergées sur des noms d'hôte différents pour tirer parti des restrictions fournies par la politique de même origine, y compris la manière dont les documents ou scripts chargés par une origine peuvent interagir avec les ressources d'une autre origine et les restrictions basées sur le nom d'hôte sur les cookies.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.5", + "section_name": "Séparation de l'origine du navigateur", + "req_id": "V3.5.5", + "req_description": "Vérifiez que les messages reçus par l'interface postMessage sont rejetés si l'origine du message n'est pas digne de confiance ou si la syntaxe du message n'est pas valide.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.5", + "section_name": "Séparation de l'origine du navigateur", + "req_id": "V3.5.6", + "req_description": "Vérifiez que la fonctionnalité JSONP n'est activée nulle part dans l'application pour éviter les attaques Cross-Site Script Inclusion (XSSI).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.5", + "section_name": "Séparation de l'origine du navigateur", + "req_id": "V3.5.7", + "req_description": "Vérifiez que les données nécessitant une autorisation ne sont pas incluses dans les réponses des ressources de script, comme les fichiers JavaScript, pour empêcher les attaques par inclusion de script intersite (XSSI).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.5", + "section_name": "Séparation de l'origine du navigateur", + "req_id": "V3.5.8", + "req_description": "Vérifiez que les ressources authentifiées (telles que les images, les vidéos, les scripts et autres documents) peuvent être chargées ou intégrées pour le compte de l'utilisateur uniquement lorsque cela est prévu. Cela peut être réalisé en validant strictement les champs d'en-tête de requête HTTP Sec-Fetch-* afin de garantir que la requête ne provient pas d'un appel cross-origin inapproprié, ou en définissant un champ d'en-tête de réponse HTTP Cross-Origin-Resource-Policy restrictif pour indiquer au navigateur de bloquer le contenu renvoyé.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.6", + "section_name": "Intégrité des ressources externes", + "req_id": "V3.6.1", + "req_description": "Vérifiez que les ressources côté client, telles que les bibliothèques JavaScript, les feuilles de style CSS ou les polices web, sont hébergées en externe (par exemple, sur un réseau de diffusion de contenu) uniquement si la ressource est statique et versionnée, et si l'intégrité des sous-ressources (SRI) est utilisée pour valider l'intégrité de la ressource. Si cela n'est pas possible, une décision de sécurité documentée doit justifier cette décision pour chaque ressource.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.7", + "section_name": "Autres considérations sur la sécurité du navigateur", + "req_id": "V3.7.1", + "req_description": "Vérifiez que l'application utilise uniquement des technologies côté client toujours prises en charge et considérées comme sécurisées. Parmi les technologies qui ne répondent pas à cette exigence figurent les plugins NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL ou les applets Java côté client.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.7", + "section_name": "Autres considérations sur la sécurité du navigateur", + "req_id": "V3.7.2", + "req_description": "Vérifiez que l'application redirigera automatiquement l'utilisateur vers un nom d'hôte ou un domaine différent (qui n'est pas contrôlé par l'application) uniquement lorsque la destination apparaît sur une liste d'autorisation.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.7", + "section_name": "Autres considérations sur la sécurité du navigateur", + "req_id": "V3.7.3", + "req_description": "Vérifiez que le domaine de premier niveau de l'application (par exemple, site.tld) ​​est ajouté à la liste de préchargement publique pour HTTP Strict Transport Security (HSTS). Cela garantit que l'utilisation de TLS pour l'application est intégrée directement dans les principaux navigateurs, plutôt que de dépendre uniquement du champ d'en-tête de réponse Strict-Transport-Security.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.7", + "section_name": "Autres considérations sur la sécurité du navigateur", + "req_id": "V3.7.4", + "req_description": "Vérifiez que l'application affiche une notification lorsque l'utilisateur est redirigé vers une URL hors du contrôle de l'application, avec une option pour annuler la navigation.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Sécurité du frontend Web", + "section_id": "V3.7", + "section_name": "Autres considérations sur la sécurité du navigateur", + "req_id": "V3.7.5", + "req_description": "Vérifiez que l'application se comporte comme documenté (par exemple, en avertissant l'utilisateur ou en bloquant l'accès) si le navigateur utilisé pour accéder à l'application ne prend pas en charge les fonctionnalités de sécurité attendues.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.1", + "section_name": "Sécurité du service Web générique", + "req_id": "V4.1.1", + "req_description": "Vérifiez que chaque réponse HTTP avec un corps de message contient un champ d'en-tête Content-Type qui correspond au contenu réel de la réponse, y compris le paramètre charset pour spécifier un codage de caractères sécurisé (par exemple, UTF-8, ISO-8859-1) conformément aux types de médias IANA, tels que « text/ », « /+xml » et « /xml ».", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.1", + "section_name": "Sécurité du service Web générique", + "req_id": "V4.1.2", + "req_description": "Vérifiez que seuls les terminaux utilisateurs (destinés à l'accès manuel via un navigateur web) redirigent automatiquement de HTTP vers HTTPS, tandis que les autres services ou terminaux n'implémentent pas de redirections transparentes. Cela permet d'éviter qu'un client envoie par erreur des requêtes HTTP non chiffrées, mais que, comme ces requêtes sont automatiquement redirigées vers HTTPS, la fuite de données sensibles passe inaperçue.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.1", + "section_name": "Sécurité du service Web générique", + "req_id": "V4.1.3", + "req_description": "Vérifiez que tout champ d'en-tête HTTP utilisé par l'application et défini par une couche intermédiaire, telle qu'un équilibreur de charge, un proxy web ou un service backend-for-frontend, ne peut pas être remplacé par l'utilisateur final. Les exemples d'en-têtes peuvent inclure X-Real-IP, X-Forwarded-*, ou X-User-ID.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.1", + "section_name": "Sécurité du service Web générique", + "req_id": "V4.1.4", + "req_description": "Vérifiez que seules les méthodes HTTP explicitement prises en charge par l'application ou son API (y compris les OPTIONS lors des demandes de contrôle en amont) peuvent être utilisées et que les méthodes inutilisées sont bloquées.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.1", + "section_name": "Sécurité du service Web générique", + "req_id": "V4.1.5", + "req_description": "Vérifier que les signatures numériques par message sont utilisées pour fournir une assurance supplémentaire en plus des protections de transport pour les demandes ou les transactions qui sont très sensibles ou qui traversent un certain nombre de systèmes.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.2", + "section_name": "Validation de la structure des messages HTTP", + "req_id": "V4.2.1", + "req_description": "Vérifiez que tous les composants de l'application (y compris les équilibreurs de charge, les pares-feux et les serveurs d'applications) déterminent les limites des messages HTTP entrants à l'aide du mécanisme approprié à la version HTTP afin d'empêcher la contrebande de requêtes HTTP. Dans HTTP/1.x, si un champ d'en-tête Transfer-Encoding est présent, l'en-tête Content-Length doit être ignoré conformément à la RFC 2616. Avec HTTP/2 ou HTTP/3, si un champ d'en-tête Content-Length est présent, le récepteur doit s'assurer qu'il est cohérent avec la longueur des trames DATA.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.2", + "section_name": "Validation de la structure des messages HTTP", + "req_id": "V4.2.2", + "req_description": "Vérifier que, lors de la génération de messages HTTP, le champ d'en-tête Content-Length n'entre pas en conflit avec la longueur du contenu déterminée par le cadrage du protocole HTTP, afin d'empêcher les attaques de type « request smuggling ».", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.2", + "section_name": "Validation de la structure des messages HTTP", + "req_id": "V4.2.3", + "req_description": "Vérifiez que l'application n'envoie ni n'accepte de messages HTTP/2 ou HTTP/3 avec des champs d'en-tête spécifiques à la connexion, tels que Transfer-Encoding, afin d'éviter les attaques par fractionnement de la réponse et par injection d'en-tête.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.2", + "section_name": "Validation de la structure des messages HTTP", + "req_id": "V4.2.4", + "req_description": "Vérifiez que l'application n'accepte que les requêtes HTTP/2 et HTTP/3 dont les champs et valeurs d'en-tête ne contiennent pas de séquences CR (\\r), LF (\\n) ou CRLF (\\r\\n), afin d'éviter les attaques par injection d'en-tête.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.2", + "section_name": "Validation de la structure des messages HTTP", + "req_id": "V4.2.5", + "req_description": "Vérifiez que, si l'application (backend ou frontend) construit et envoie des requêtes, elle utilise des mécanismes de validation, d'assainissement ou autres pour éviter de créer des URI (comme pour les appels API) ou des champs d'en-tête de requête HTTP (comme Authorization ou Cookie) qui sont trop longs pour être acceptés par le composant récepteur. Cela pourrait entraîner un déni de service, par exemple lors de l'envoi d'une requête trop longue (par exemple, un long champ d'en-tête de cookie), ce qui fait que le serveur répond toujours avec un statut d'erreur.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.3", + "section_name": "GraphQL", + "req_id": "V4.3.1", + "req_description": "Vérifiez qu'une liste d'autorisation de requête, une limitation de profondeur, une limitation de quantité ou une analyse des coûts de requête est utilisée pour empêcher le déni de service (DoS) de GraphQL ou d'expression de la couche données en raison de requêtes imbriquées coûteuses.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.3", + "section_name": "GraphQL", + "req_id": "V4.3.2", + "req_description": "Vérifiez que les requêtes d’introspection GraphQL sont désactivées dans l’environnement de production, sauf si l’API GraphQL est destinée à être utilisée par d’autres parties.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.1", + "req_description": "Vérifiez que WebSocket sur TLS (WSS) est utilisé pour toutes les connexions WebSocket.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.2", + "req_description": "Vérifiez que, lors de la négociation HTTP WebSocket initiale, le champ d’en-tête 'Origin' est vérifié par rapport à une liste d’origines autorisées pour l’application.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.3", + "req_description": "Vérifiez que, si la gestion de session standard de l'application ne peut pas être utilisée, des jetons dédiés sont utilisés à cet effet, qui sont conformes aux exigences de sécurité de gestion de session pertinentes.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API et service Web", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.4", + "req_description": "Vérifiez que les jetons de gestion de session WebSocket dédiés sont initialement obtenus ou validés via la session HTTPS précédemment authentifiée lors de la transition d'une session HTTPS existante vers un canal WebSocket.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.1", + "section_name": "Documentation sur la gestion des fichiers", + "req_id": "V5.1.1", + "req_description": "Vérifiez que la documentation définit les types de fichiers autorisés, les extensions de fichiers attendues et la taille maximale (y compris la taille décompressée) pour chaque fonctionnalité de Téléversement. De plus, assurez-vous que la documentation précise comment les fichiers sont sécurisés pour le téléchargement et le traitement des utilisateurs finaux, par exemple le comportement de l'application lorsqu'un fichier malveillant est détecté.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.2", + "section_name": "Téléversement de fichiers et contenu", + "req_id": "V5.2.1", + "req_description": "Vérifiez que l'application n'acceptera que des fichiers d'une taille qu'elle peut traiter sans provoquer de perte de performances ou d'attaque par déni de service.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.2", + "section_name": "Téléversement de fichiers et contenu", + "req_id": "V5.2.2", + "req_description": "Vérifiez que lorsque l'application accepte un fichier, seul ou dans une archive telle qu'un fichier zip, elle vérifie si l'extension de fichier correspond à une extension attendue et que le contenu correspond au type représenté par l'extension. Cela inclut, sans s'y limiter, la vérification des « octets magiques » initiaux, la réécriture d'images et l'utilisation de bibliothèques spécialisées pour la validation du contenu des fichiers. Pour le niveau L1, cela peut se concentrer uniquement sur les fichiers utilisés pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau L2, cela doit s'appliquer à tous les fichiers acceptés.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.2", + "section_name": "Téléversement de fichiers et contenu", + "req_id": "V5.2.3", + "req_description": "Vérifiez que l'application vérifie les fichiers compressés (par exemple, zip, gz, docx, odt) par rapport à la taille maximale autorisée non compressée et au nombre maximal de fichiers avant de décompresser le fichier.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.2", + "section_name": "Téléversement de fichiers et contenu", + "req_id": "V5.2.4", + "req_description": "Vérifiez qu'un quota de taille de fichier et un nombre maximal de fichiers par utilisateur sont appliqués pour garantir qu'un seul utilisateur ne puisse pas remplir le stockage avec trop de fichiers ou des fichiers excessivement volumineux.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.2", + "section_name": "Téléversement de fichiers et contenu", + "req_id": "V5.2.5", + "req_description": "Vérifiez que l'application n'autorise pas le téléversement de fichiers compressés contenant des liens symboliques, sauf si cela est spécifiquement requis (auquel cas il sera nécessaire d'appliquer une liste d'autorisation des fichiers vers lesquels il est possible de créer des liens symboliques).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.2", + "section_name": "Téléversement de fichiers et contenu", + "req_id": "V5.2.6", + "req_description": "Vérifiez que l'application rejette les images téléversées avec une taille de pixel supérieure au maximum autorisé, afin d'éviter les attaques par inondation de pixels.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.3", + "section_name": "Stockage de fichiers", + "req_id": "V5.3.1", + "req_description": "Vérifiez que les fichiers téléversés ou générés par une entrée non fiable et stockés dans un dossier public ne sont pas exécutés en tant que code de programme côté serveur lorsqu'ils sont accessibles directement avec une requête HTTP.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.3", + "section_name": "Stockage de fichiers", + "req_id": "V5.3.2", + "req_description": "Vérifiez que lorsque l'application crée des chemins d'accès pour les opérations sur les fichiers, elle utilise des données générées en interne ou fiables plutôt que des noms de fichiers soumis par l'utilisateur. Si des noms de fichiers ou des métadonnées de fichiers soumis par l'utilisateur doivent être utilisés, une validation et un nettoyage stricts doivent être appliqués. Ceci permet de se protéger contre les attaques par traversée de chemin, l'inclusion de fichiers locaux ou distants (LFI, RFI) et la falsification de requêtes côté serveur (SSRF).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.3", + "section_name": "Stockage de fichiers", + "req_id": "V5.3.3", + "req_description": "Vérifiez que le traitement des fichiers côté serveur, comme la décompression des fichiers, ignore les informations de chemin fournies par l'utilisateur pour éviter les vulnérabilités telles que le \"zip slip\".", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.4", + "section_name": "Téléchargement de fichier", + "req_id": "V5.4.1", + "req_description": "Vérifiez que l’application valide ou ignore les noms de fichiers soumis par l’utilisateur, y compris dans un paramètre JSON, JSONP ou URL et spécifie un nom de fichier dans le champ d’en-tête Content-Disposition de la réponse.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.4", + "section_name": "Téléchargement de fichier", + "req_id": "V5.4.2", + "req_description": "Vérifiez que les noms de fichiers servis (par exemple, dans les champs d'en-tête de réponse HTTP ou les pièces jointes aux e-mails) sont encodés ou nettoyés (par exemple, conformément à la RFC 6266) pour préserver la structure du document et empêcher les attaques par injection.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Gestion des fichiers", + "section_id": "V5.4", + "section_name": "Téléchargement de fichier", + "req_id": "V5.4.3", + "req_description": "Vérifiez que les fichiers obtenus à partir de sources non fiables sont analysés par des scanners antivirus pour empêcher la diffusion de contenu malveillant connu.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.1", + "section_name": "Documentation d'authentification", + "req_id": "V6.1.1", + "req_description": "Vérifiez que la documentation de l'application définit comment les contrôles, tels que la limitation de débit, l'anti-automatisation et la réponse adaptative, sont utilisés pour se défendre contre les attaques telles que le « credential stuffing » et la force brute des mots de passe. La documentation doit expliquer clairement comment ces contrôles sont configurés et empêcher le blocage malveillant des comptes.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.1", + "section_name": "Documentation d'authentification", + "req_id": "V6.1.2", + "req_description": "Vérifiez qu'une liste de mots spécifiques au contexte est documentée afin d'empêcher leur utilisation dans les mots de passe. Cette liste peut inclure des permutations de noms d'organisations, de produits, d'identifiants de systèmes, de noms de codes de projets, de noms de services ou de rôles, etc.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.1", + "section_name": "Documentation d'authentification", + "req_id": "V6.1.3", + "req_description": "Vérifiez que, si l'application inclut plusieurs voies d'authentification, celles-ci sont toutes documentées avec les contrôles de sécurité et la force d'authentification qui doivent être appliqués de manière cohérente.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.1", + "req_description": "Vérifiez que les mots de passe définis par l'utilisateur comportent au moins 8 caractères, bien qu'un minimum de 15 caractères soit fortement recommandé.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.2", + "req_description": "Vérifiez que les utilisateurs peuvent modifier leur mot de passe.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.3", + "req_description": "Vérifiez que la fonctionnalité de changement de mot de passe nécessite le mot de passe actuel et le nouveau mot de passe de l'utilisateur.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.4", + "req_description": "Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou du changement de mot de passe sont vérifiés par rapport à un ensemble disponible d'au moins 3 000 mots de passe principaux qui correspondent à la politique de mot de passe de l'application, par exemple la longueur minimale.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.5", + "req_description": "Vérifiez que les mots de passe peuvent être utilisés, quelle que soit leur composition, sans restriction quant au type de caractères autorisés. Aucun nombre minimal de majuscules ou de minuscules, de chiffres ou de caractères spéciaux ne doit être exigé.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.6", + "req_description": "Vérifiez que les champs de saisie du mot de passe utilisent type=password pour masquer la saisie. Les applications peuvent permettre à l'utilisateur d'afficher temporairement l'intégralité du mot de passe masqué ou le dernier caractère saisi.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.7", + "req_description": "Vérifiez que la fonctionnalité « coller », les assistants de mot de passe du navigateur et les gestionnaires de mots de passe externes sont autorisés.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.8", + "req_description": "Vérifiez que l'application vérifie le mot de passe de l'utilisateur exactement tel qu'il a été reçu de l'utilisateur, sans aucune modification telle qu'une troncature ou une transformation de casse.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.9", + "req_description": "Vérifiez que les mots de passe d’au moins 64 caractères sont autorisés.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.10", + "req_description": "Vérifiez que le mot de passe d'un utilisateur reste valide jusqu'à ce qu'il soit découvert comme compromis ou qu'il soit renouvelé. L'application ne doit pas exiger de renouvellement périodique des identifiants.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.11", + "req_description": "Vérifiez que la liste documentée de mots spécifiques au contexte est utilisée pour éviter la création de mots de passe faciles à deviner.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.2", + "section_name": "Sécurité des mots de passe", + "req_id": "V6.2.12", + "req_description": "Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou des modifications de mot de passe sont vérifiés par rapport à un ensemble de mots de passe fuités.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.3", + "section_name": "Sécurité générale de l'authentification", + "req_id": "V6.3.1", + "req_description": "Vérifiez que les contrôles visant à empêcher les attaques telles que le bourrage d'informations d'identification et la force brute des mots de passe sont mis en œuvre conformément à la documentation de sécurité de l'application.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.3", + "section_name": "Sécurité générale de l'authentification", + "req_id": "V6.3.2", + "req_description": "Vérifiez que les comptes d’utilisateur par défaut (par exemple, « root », « admin » ou « sa ») ne sont pas présents dans l’application ou sont désactivés.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.3", + "section_name": "Sécurité générale de l'authentification", + "req_id": "V6.3.3", + "req_description": "Vérifiez que l’application exige que les utilisateurs utilisent un mécanisme d’authentification multifacteur ou une combinaison de mécanismes d’authentification à facteur unique.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.3", + "section_name": "Sécurité générale de l'authentification", + "req_id": "V6.3.4", + "req_description": "Vérifiez que, si l’application inclut plusieurs voies d’authentification, il n’existe aucune voie non documentée et que les contrôles de sécurité et la force d’authentification sont appliqués de manière cohérente.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.3", + "section_name": "Sécurité générale de l'authentification", + "req_id": "V6.3.5", + "req_description": "Vérifiez que les utilisateurs sont informés des tentatives d'authentification suspectes (réussies ou non). Il peut s'agir de tentatives d'authentification provenant d'un emplacement ou d'un client inhabituel, d'une authentification partiellement réussie (un seul facteur parmi plusieurs), d'une tentative d'authentification après une longue période d'inactivité ou d'une authentification réussie après plusieurs tentatives infructueuses.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.3", + "section_name": "Sécurité générale de l'authentification", + "req_id": "V6.3.6", + "req_description": "Vérifiez que le courrier électronique n’est pas utilisé comme mécanisme d’authentification à facteur unique ou à facteurs multiples.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.3", + "section_name": "Sécurité générale de l'authentification", + "req_id": "V6.3.7", + "req_description": "Vérifiez que les utilisateurs sont avertis après les mises à jour des détails d'authentification, telles que les réinitialisations d'informations d'identification ou la modification du nom d'utilisateur ou de l'adresse e-mail.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.3", + "section_name": "Sécurité générale de l'authentification", + "req_id": "V6.3.8", + "req_description": "Vérifiez que les utilisateurs valides ne peuvent pas être déduits d'échecs d'authentification, par exemple en se basant sur des messages d'erreur, des codes de réponse HTTP ou des temps de réponse différents. Les fonctionnalités d'inscription et de mot de passe oublié doivent également bénéficier de cette protection.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.4", + "section_name": "Cycle de vie et récupération du facteur d'authentification", + "req_id": "V6.4.1", + "req_description": "Vérifiez que les mots de passe initiaux ou les codes d'activation générés par le système sont générés de manière aléatoire et sécurisée, qu'ils respectent la politique de mots de passe en vigueur et qu'ils expirent après une courte période ou après leur première utilisation. Ces secrets initiaux ne doivent pas devenir des mots de passe permanents.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.4", + "section_name": "Cycle de vie et récupération du facteur d'authentification", + "req_id": "V6.4.2", + "req_description": "Vérifiez que les indices de mot de passe ou l'authentification basée sur les connaissances (appelées « questions secrètes ») ne sont pas présents.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.4", + "section_name": "Cycle de vie et récupération du facteur d'authentification", + "req_id": "V6.4.3", + "req_description": "Vérifiez qu'un processus sécurisé de réinitialisation d'un mot de passe oublié est mis en œuvre, qui ne contourne aucun mécanisme d'authentification multifacteur activé.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.4", + "section_name": "Cycle de vie et récupération du facteur d'authentification", + "req_id": "V6.4.4", + "req_description": "Vérifiez que si un facteur d'authentification multifacteur est perdu, la preuve de vérification d'identité est effectuée au même niveau que lors de l'inscription.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.4", + "section_name": "Cycle de vie et récupération du facteur d'authentification", + "req_id": "V6.4.5", + "req_description": "Vérifiez que les instructions de renouvellement des mécanismes d'authentification qui expirent sont envoyées avec suffisamment de temps pour être exécutées avant l'expiration de l'ancien mécanisme d'authentification, en configurant des rappels automatiques si nécessaire.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.4", + "section_name": "Cycle de vie et récupération du facteur d'authentification", + "req_id": "V6.4.6", + "req_description": "Vérifiez que les administrateurs peuvent initier la réinitialisation du mot de passe de l'utilisateur, mais que cela ne leur permet pas de modifier ou de choisir son mot de passe. Cela évite qu'ils ne connaissent le mot de passe de l'utilisateur.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.5", + "section_name": "Exigences générales en matière d'authentification multifacteur", + "req_id": "V6.5.1", + "req_description": "Vérifiez que les secrets de recherche, les demandes ou codes d'authentification out-of-band et les mots de passe à usage unique basés sur le temps (TOTP) ne peuvent être utilisés avec succès qu'une seule fois.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.5", + "section_name": "Exigences générales en matière d'authentification multifacteur", + "req_id": "V6.5.2", + "req_description": "Vérifiez que, lors de leur stockage dans le backend de l'application, les secrets de recherche comportant moins de 112 bits d'entropie (19 caractères alphanumériques aléatoires ou 34 chiffres aléatoires) sont hachés avec un algorithme de hachage de stockage de mots de passe approuvé, intégrant un sel aléatoire de 32 bits. Une fonction de hachage standard peut être utilisée si le secret comporte 112 bits d'entropie ou plus.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.5", + "section_name": "Exigences générales en matière d'authentification multifacteur", + "req_id": "V6.5.3", + "req_description": "Vérifiez que les secrets de recherche, le code d'authentification out-of-band et les mots de passe à usage unique basés sur le temps sont générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) pour éviter les valeurs prévisibles.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.5", + "section_name": "Exigences générales en matière d'authentification multifacteur", + "req_id": "V6.5.4", + "req_description": "Vérifiez que les secrets de recherche et les codes d'authentification out-of-band ont un minimum de 20 bits d'entropie (généralement 4 caractères alphanumériques aléatoires ou 6 chiffres aléatoires suffisent).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.5", + "section_name": "Exigences générales en matière d'authentification multifacteur", + "req_id": "V6.5.5", + "req_description": "Vérifiez que les requêtes, codes ou jetons d'authentification out-of-band, ainsi que les mots de passe à usage unique (TOTP), ont une durée de vie définie. Les requêtes out-of-band doivent avoir une durée de vie maximale de 10 minutes et les TOTP, de 30 secondes.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.5", + "section_name": "Exigences générales en matière d'authentification multifacteur", + "req_id": "V6.5.6", + "req_description": "Vérifiez que tout facteur d’authentification (y compris les appareils physiques) peut être révoqué en cas de vol ou autre perte.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.5", + "section_name": "Exigences générales en matière d'authentification multifacteur", + "req_id": "V6.5.7", + "req_description": "Vérifiez que les mécanismes d’authentification biométrique ne sont utilisés que comme facteurs secondaires, avec quelque chose que vous possédez ou quelque chose que vous savez.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.5", + "section_name": "Exigences générales en matière d'authentification multifacteur", + "req_id": "V6.5.8", + "req_description": "Vérifiez que les mots de passe à usage unique basés sur le temps (TOTP) sont vérifiés en fonction d'une source temporelle provenant d'un service de confiance et non d'une heure non fiable ou fournie par le client.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.6", + "section_name": "Mécanismes d'authentification out-of-band", + "req_id": "V6.6.1", + "req_description": "Vérifier que les mécanismes d'authentification utilisant le réseau téléphonique public commuté (RTPC) pour la transmission de mots de passe à usage unique (OTP) par téléphone ou SMS ne sont proposés que lorsque le numéro de téléphone a été préalablement validé. D'autres méthodes plus robustes (telles que les mots de passe à usage unique à durée déterminée) sont également proposées, et que le service informe les utilisateurs des risques de sécurité qu'elles présentent. Pour les applications de niveau 3, le téléphone et les SMS ne doivent pas être disponibles.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.6", + "section_name": "Mécanismes d'authentification out-of-band", + "req_id": "V6.6.2", + "req_description": "Vérifiez que les demandes d’authentification out-of-band, les codes ou les jetons sont liés à la demande d’authentification d’origine pour laquelle ils ont été générés et ne sont pas utilisables pour une demande précédente ou ultérieure.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.6", + "section_name": "Mécanismes d'authentification out-of-band", + "req_id": "V6.6.3", + "req_description": "Vérifiez qu'un mécanisme d'authentification out-of-band basé sur du code est protégé contre les attaques par force brute grâce au \"rate limiting\". Envisagez également d'utiliser un code avec au moins 64 bits d'entropie.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.6", + "section_name": "Mécanismes d'authentification out-of-band", + "req_id": "V6.6.4", + "req_description": "Vérifiez que, lorsque les notifications push sont utilisées pour l'authentification multifacteur, le \"rate limiting\" est appliqué afin d'empêcher les attaques de type « push bombing ». La concordance des numéros peut également atténuer ce risque.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.7", + "section_name": "Mécanisme d'authentification cryptographique", + "req_id": "V6.7.1", + "req_description": "Vérifiez que les certificats utilisés pour vérifier les assertions d’authentification cryptographique sont stockés de manière à les protéger contre toute modification.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.7", + "section_name": "Mécanisme d'authentification cryptographique", + "req_id": "V6.7.2", + "req_description": "Vérifiez que le nonce de défi a une longueur d'au moins 64 bits et qu'il est statistiquement unique ou unique sur toute la durée de vie du périphérique cryptographique.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.8", + "section_name": "Authentification avec un fournisseur d'identité", + "req_id": "V6.8.1", + "req_description": "Vérifiez que, si l'application prend en charge plusieurs fournisseurs d'identité (IdP), l'identité de l'utilisateur ne peut pas être usurpée via un autre fournisseur d'identité pris en charge (par exemple, en utilisant le même identifiant utilisateur). La mesure standard consisterait à ce que l'application enregistre et identifie l'utilisateur à l'aide d'une combinaison de l'ID du fournisseur d'identité (servant d'espace de noms) et de l'ID de l'utilisateur dans le fournisseur d'identité.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.8", + "section_name": "Authentification avec un fournisseur d'identité", + "req_id": "V6.8.2", + "req_description": "Vérifiez que la présence et l'intégrité des signatures numériques sur les assertions d'authentification (par exemple sur les assertions JWT ou SAML) sont toujours validées, en rejetant toutes les assertions non signées ou ayant des signatures non valides.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.8", + "section_name": "Authentification avec un fournisseur d'identité", + "req_id": "V6.8.3", + "req_description": "Vérifiez que les assertions SAML sont traitées de manière unique et utilisées une seule fois au cours de la période de validité pour éviter les attaques par rejeu.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentification", + "section_id": "V6.8", + "section_name": "Authentification avec un fournisseur d'identité", + "req_id": "V6.8.4", + "req_description": "Si une application utilise un fournisseur d'identité (IdP) distinct et attend une force, des méthodes ou une date d'authentification spécifiques pour des fonctions spécifiques, vérifiez que l'application les vérifie à l'aide des informations renvoyées par l'IdP. Par exemple, si OIDC est utilisé, cela peut être réalisé en validant les affirmations de jeton d'identification telles que « acr », « amr » et « auth_time » (le cas échéant). Si l'IdP ne fournit pas ces informations, l'application doit disposer d'une approche de secours documentée qui suppose que le mécanisme d'authentification de force minimale a été utilisé (par exemple, une authentification à facteur unique avec nom d'utilisateur et mot de passe).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.1", + "section_name": "Documentation sur la gestion des sessions", + "req_id": "V7.1.1", + "req_description": "Vérifiez que le délai d'inactivité de la session de l'utilisateur et la durée de vie maximale absolue de la session sont documentés, sont appropriés en combinaison avec d'autres contrôles et que la documentation inclut une justification de tout écart par rapport aux exigences de réauthentification NIST SP 800-63B.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.1", + "section_name": "Documentation sur la gestion des sessions", + "req_id": "V7.1.2", + "req_description": "Vérifiez que la documentation définit le nombre de sessions simultanées (parallèles) autorisées pour un compte ainsi que les comportements et actions prévus à entreprendre lorsque le nombre maximal de sessions actives est atteint.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.1", + "section_name": "Documentation sur la gestion des sessions", + "req_id": "V7.1.3", + "req_description": "Vérifiez que tous les systèmes qui créent et gèrent des sessions utilisateur dans le cadre d'un écosystème de gestion des identités fédérées (tels que les systèmes SSO) sont documentés avec des contrôles pour coordonner la durée de vie des sessions, la résiliation et toute autre condition nécessitant une réauthentification.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.2", + "section_name": "Sécurité fondamentale de la gestion des sessions", + "req_id": "V7.2.1", + "req_description": "Vérifiez que l’application effectue toutes les vérifications des jetons de session à l’aide d’un service backend de confiance.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.2", + "section_name": "Sécurité fondamentale de la gestion des sessions", + "req_id": "V7.2.2", + "req_description": "Vérifiez que l'application utilise des jetons autonomes ou de référence générés dynamiquement pour la gestion des sessions, c'est-à-dire sans utiliser de secrets et de clés d'API statiques.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.2", + "section_name": "Sécurité fondamentale de la gestion des sessions", + "req_id": "V7.2.3", + "req_description": "Vérifiez que si des jetons par référence sont utilisés pour représenter les sessions utilisateur, ils sont uniques et générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et possèdent au moins 128 bits d'entropie.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.2", + "section_name": "Sécurité fondamentale de la gestion des sessions", + "req_id": "V7.2.4", + "req_description": "Vérifiez que l’application génère un nouveau jeton de session lors de l’authentification de l’utilisateur, y compris la réauthentification, et met fin au jeton de session actuel.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.3", + "section_name": "Délai d'expiration de la session", + "req_id": "V7.3.1", + "req_description": "Vérifiez qu’il existe un délai d’inactivité tel que la réauthentification soit appliquée conformément à l’analyse des risques et aux décisions de sécurité documentées.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.3", + "section_name": "Délai d'expiration de la session", + "req_id": "V7.3.2", + "req_description": "Vérifiez qu'il existe une durée de vie maximale absolue de la session de sorte que la réauthentification soit appliquée conformément à l'analyse des risques et aux décisions de sécurité documentées.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.4", + "section_name": "Fin de session", + "req_id": "V7.4.1", + "req_description": "Vérifiez que lorsque la fin de session est déclenchée (par exemple, déconnexion ou expiration), l'application interdit toute utilisation ultérieure de la session. Pour les jetons par référence ou les sessions avec état, cela implique l'invalidation des données de session au niveau du backend de l'application. Les applications utilisant des jetons autonomes nécessiteront une solution, comme la gestion d'une liste des jetons terminés, l'interdiction des jetons produits avant une date et une heure spécifique à chaque utilisateur ou la rotation d'une clé de signature spécifique à chaque utilisateur.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.4", + "section_name": "Fin de session", + "req_id": "V7.4.2", + "req_description": "Vérifiez que l'application met fin à toutes les sessions actives lorsqu'un compte utilisateur est désactivé ou supprimé (par exemple, lorsqu'un employé quitte l'entreprise).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.4", + "section_name": "Fin de session", + "req_id": "V7.4.3", + "req_description": "Vérifiez que l'application offre la possibilité de mettre fin à toutes les autres sessions actives après une modification ou une suppression réussie de tout facteur d'authentification (y compris la modification du mot de passe via une réinitialisation ou une récupération et, le cas échéant, une mise à jour des paramètres MFA).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.4", + "section_name": "Fin de session", + "req_id": "V7.4.4", + "req_description": "Vérifiez que toutes les pages nécessitant une authentification disposent d’un accès facile et visible à la fonctionnalité de déconnexion.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.4", + "section_name": "Fin de session", + "req_id": "V7.4.5", + "req_description": "Vérifiez que les administrateurs d’applications sont en mesure de mettre fin aux sessions actives pour un utilisateur individuel ou pour tous les utilisateurs.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.5", + "section_name": "Défenses contre les abus de session", + "req_id": "V7.5.1", + "req_description": "Vérifiez que l'application nécessite une réauthentification complète avant d'autoriser les modifications des attributs de compte sensibles qui peuvent affecter l'authentification, tels que l'adresse e-mail, le numéro de téléphone, la configuration MFA ou d'autres informations utilisées dans la récupération de compte.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.5", + "section_name": "Défenses contre les abus de session", + "req_id": "V7.5.2", + "req_description": "Vérifiez que les utilisateurs peuvent afficher et (après s'être authentifiés à nouveau avec au moins un facteur) terminer une ou toutes les sessions actuellement actives.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.5", + "section_name": "Défenses contre les abus de session", + "req_id": "V7.5.3", + "req_description": "Vérifiez que l’application nécessite une authentification supplémentaire avec au moins un facteur ou une vérification secondaire avant d’effectuer des transactions ou des opérations hautement sensibles.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.6", + "section_name": "Réauthentification fédérée", + "req_id": "V7.6.1", + "req_description": "Vérifiez que la durée de vie et la fin de la session entre les parties de confiance (RP) et les fournisseurs d'identité (IdP) se comportent comme documenté, en exigeant une réauthentification si nécessaire, par exemple lorsque le temps maximal entre les événements d'authentification IdP est atteint.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Gestion des sessions", + "section_id": "V7.6", + "section_name": "Réauthentification fédérée", + "req_id": "V7.6.2", + "req_description": "Vérifiez que la création d'une session nécessite soit le consentement de l'utilisateur, soit une action explicite, empêchant ainsi la création de nouvelles sessions d'application sans interaction de l'utilisateur.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.1", + "section_name": "Documentation d'autorisation", + "req_id": "V8.1.1", + "req_description": "Vérifiez que la documentation d’autorisation définit des règles de restriction de l’accès au niveau de la fonction et aux données en fonction des autorisations du consommateur et des attributs des ressources.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.1", + "section_name": "Documentation d'autorisation", + "req_id": "V8.1.2", + "req_description": "Vérifiez que la documentation d'autorisation définit les règles de restriction d'accès au niveau des champs (lecture et écriture) en fonction des autorisations des consommateurs et des attributs des ressources. Notez que ces règles peuvent dépendre d'autres valeurs d'attributs de l'objet de données concerné, telles que l'état ou le statut.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.1", + "section_name": "Documentation d'autorisation", + "req_id": "V8.1.3", + "req_description": "Vérifiez que la documentation de l'application définit les attributs environnementaux et contextuels (y compris, mais sans s'y limiter, l'heure de la journée, l'emplacement de l'utilisateur, l'adresse IP ou l'appareil) qui sont utilisés dans l'application pour prendre des décisions de sécurité, y compris celles relatives à l'authentification et à l'autorisation.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.1", + "section_name": "Documentation d'autorisation", + "req_id": "V8.1.4", + "req_description": "Vérifier que la documentation d'authentification et d'autorisation définit l'utilisation des facteurs environnementaux et contextuels dans la prise de décision, en plus des autorisations au niveau des fonctions, des données et des champs. Cela doit inclure les attributs évalués, les seuils de risque et les actions entreprises (par exemple, autorisation, contestation, refus, renforcement de l'authentification).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.2", + "section_name": "Conception d'autorisation générale", + "req_id": "V8.2.1", + "req_description": "Vérifiez que l’application garantit que l’accès basé sur la fonction est limité aux consommateurs disposant d’autorisations explicites.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.2", + "section_name": "Conception d'autorisation générale", + "req_id": "V8.2.2", + "req_description": "Vérifiez que l'application garantit que l'accès spécifique aux données est limité aux consommateurs disposant d'autorisations explicites sur des éléments de données spécifiques afin d'atténuer les références d'objet directes non sécurisées (IDOR) et les autorisations de niveau d'objet rompues (BOLA).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.2", + "section_name": "Conception d'autorisation générale", + "req_id": "V8.2.3", + "req_description": "Vérifiez que l'application garantit que l'accès au niveau du champ est limité aux consommateurs disposant d'autorisations explicites sur des champs spécifiques afin d'atténuer les problèmes d'autorisation au niveau de la propriété d'objet (BOPLA).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.2", + "section_name": "Conception d'autorisation générale", + "req_id": "V8.2.4", + "req_description": "Vérifiez que les contrôles de sécurité adaptatifs basés sur les attributs environnementaux et contextuels du consommateur (tels que l'heure, la localisation, l'adresse IP ou l'appareil) sont mis en œuvre pour les décisions d'authentification et d'autorisation, comme défini dans la documentation de l'application. Ces contrôles doivent être appliqués lorsque le consommateur tente de démarrer une nouvelle session et également pendant une session existante.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.3", + "section_name": "Autorisation par opération", + "req_id": "V8.3.1", + "req_description": "Vérifier que l'application applique les règles d'autorisations au niveau de la couche service de confiance et ne s’appuie pas sur des contrôles qu’un consommateur non approuvé pourrait manipuler, comme JavaScript côté client.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.3", + "section_name": "Autorisation par opération", + "req_id": "V8.3.2", + "req_description": "Vérifiez que les modifications apportées aux valeurs sur lesquelles reposent les décisions d'autorisation sont appliquées immédiatement. Lorsque les modifications ne peuvent pas être appliquées immédiatement (par exemple, en s'appuyant sur des données de jetons autonomes), des contrôles d'atténuation doivent être mis en place pour alerter un consommateur lorsqu'il effectue une action alors qu'il n'est plus autorisé à le faire et annuler la modification. Notez que cette solution alternative ne limiterait pas les fuites d'informations.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.3", + "section_name": "Autorisation par opération", + "req_id": "V8.3.3", + "req_description": "Vérifiez que l'accès à un objet repose sur les autorisations du sujet d'origine (par exemple, le consommateur), et non sur celles d'un intermédiaire ou d'un service agissant en son nom. Par exemple, si un consommateur appelle un service web à l'aide d'un jeton d'authentification autonome, et que ce service demande ensuite des données à un autre service, ce dernier utilisera le jeton du consommateur, plutôt qu'un jeton inter-machine du premier service, pour prendre les décisions d'autorisation.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.4", + "section_name": "Autres considérations relatives à l'autorisation", + "req_id": "V8.4.1", + "req_description": "Vérifiez que les applications multi-tenants utilisent des contrôles inter-tenants pour garantir que les opérations des consommateurs n'affecteront jamais les tenants avec lesquels ils ne sont pas autorisés à interagir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Autorisation", + "section_id": "V8.4", + "section_name": "Autres considérations relatives à l'autorisation", + "req_id": "V8.4.2", + "req_description": "Vérifiez que l'accès aux interfaces administratives intègre plusieurs couches de sécurité, notamment la vérification continue de l'identité du consommateur, l'évaluation de la posture de sécurité des appareils et l'analyse contextuelle des risques, garantissant que l'emplacement du réseau ou les endpoints approuvés ne sont pas les seuls facteurs d'autorisation, même s'ils peuvent réduire la probabilité d'accès non autorisé.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Jetons autonomes", + "section_id": "V9.1", + "section_name": "Source et intégrité du jeton", + "req_id": "V9.1.1", + "req_description": "Vérifiez que les jetons autonomes sont validés à l'aide de leur signature numérique ou MAC pour les protéger contre toute falsification avant d'accepter le contenu du jeton.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Jetons autonomes", + "section_id": "V9.1", + "section_name": "Source et intégrité du jeton", + "req_id": "V9.1.2", + "req_description": "Vérifiez que seuls les algorithmes d'une liste d’autorisations peuvent être utilisés pour créer et vérifier des jetons autonomes, dans un contexte donné. La liste d'autorisation doit inclure les algorithmes autorisés, idéalement symétriques ou asymétriques, et ne doit pas inclure l'algorithme « Aucun ». Si les algorithmes symétriques et asymétriques doivent être pris en charge, des contrôles supplémentaires seront nécessaires pour éviter toute confusion de clés.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Jetons autonomes", + "section_id": "V9.1", + "section_name": "Source et intégrité du jeton", + "req_id": "V9.1.3", + "req_description": "Vérifiez que les clés utilisées pour valider les jetons autonomes proviennent de sources préconfigurées et fiables pour l'émetteur du jeton, empêchant ainsi les attaquants de spécifier des sources et des clés non fiables. Pour les JWT et autres structures JWS, les en-têtes tels que « jku », « x5u » et « jwk » doivent être validés par rapport à une liste d'autorisation de sources fiables.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Jetons autonomes", + "section_id": "V9.2", + "section_name": "Contenu du jeton", + "req_id": "V9.2.1", + "req_description": "Vérifiez que, si une période de validité est indiquée dans les données du jeton, celui-ci et son contenu ne sont acceptés que si la date de vérification est comprise dans cette période. Par exemple, pour les JWT, les déclarations « nbf » et « exp » doivent être vérifiées.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Jetons autonomes", + "section_id": "V9.2", + "section_name": "Contenu du jeton", + "req_id": "V9.2.2", + "req_description": "Vérifiez que le service recevant un jeton valide le type de jeton et son utilisation avant d'en accepter le contenu. Par exemple, seuls les jetons d'accès peuvent être acceptés pour les décisions d'autorisation, et seuls les jetons d'identification peuvent être utilisés pour prouver l'authentification des utilisateurs.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Jetons autonomes", + "section_id": "V9.2", + "section_name": "Contenu du jeton", + "req_id": "V9.2.3", + "req_description": "Vérifiez que le service accepte uniquement les jetons destinés à être utilisés avec ce service (audience). Pour les JWT, cela peut être réalisé en validant la déclaration « aud » par rapport à une liste d'autorisation définie dans le service.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Jetons autonomes", + "section_id": "V9.2", + "section_name": "Contenu du jeton", + "req_id": "V9.2.4", + "req_description": "Si un émetteur de jetons utilise la même clé privée pour émettre des jetons destinés à différentes audiences, vérifiez que les jetons émis contiennent une restriction d'audience identifiant de manière unique les audiences visées. Cela empêchera la réutilisation d'un jeton avec une audience non prévue. Si l'identifiant d'audience est provisionné dynamiquement, l'émetteur de jetons doit valider ces audiences afin de garantir qu'elles n'entraînent pas d'usurpation d'identité.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.1", + "section_name": "Sécurité générique OAuth et OIDC", + "req_id": "V10.1.1", + "req_description": "Vérifiez que les jetons sont envoyés uniquement aux composants qui en ont absolument besoin. Par exemple, lors de l'utilisation d'un modèle backend-for-frontend pour les applications JavaScript basées sur un navigateur, les jetons d'accès et d'actualisation ne doivent être accessibles qu'au backend.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.1", + "section_name": "Sécurité générique OAuth et OIDC", + "req_id": "V10.1.2", + "req_description": "Vérifiez que le client n'accepte les valeurs du serveur d'autorisation (telles que le code d'autorisation ou le jeton d'identification) que si elles résultent d'un flux d'autorisation initié par la même session d'agent utilisateur et la même transaction. Cela nécessite que les secrets générés par le client, tels que la clé de preuve pour l'échange de codes (PKCE) « code_verifier », « state » ou le nonce OIDC, ne puissent être devinés, soient spécifiques à la transaction et soient liés de manière sécurisée au client et à la session d'agent utilisateur au cours de laquelle la transaction a été initiée.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.2", + "section_name": "Client OAuth", + "req_id": "V10.2.1", + "req_description": "Vérifiez que, si le flux de code est utilisé, le client OAuth dispose d'une protection contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF), qui déclenchent des demandes de jetons, soit en utilisant la fonctionnalité de clé de preuve pour l'échange de code (PKCE), soit en vérifiant le paramètre « state » envoyé dans la demande d'autorisation.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.2", + "section_name": "Client OAuth", + "req_id": "V10.2.2", + "req_description": "Vérifiez que, si le client OAuth peut interagir avec plusieurs serveurs d'autorisation, il dispose d'une protection contre les attaques par confusion. Par exemple, il peut exiger que le serveur d'autorisation renvoie la valeur du paramètre « iss » et la valide dans la réponse d'autorisation et la réponse du jeton.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.2", + "section_name": "Client OAuth", + "req_id": "V10.2.3", + "req_description": "Vérifiez que le client OAuth demande uniquement les portées requises (ou d’autres paramètres d’autorisation) dans les requêtes adressées au serveur d’autorisation.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.3", + "section_name": "Serveur de ressources OAuth", + "req_id": "V10.3.1", + "req_description": "Vérifiez que le serveur de ressources accepte uniquement les jetons d'accès destinés à être utilisés avec ce service (audience). L'audience peut être incluse dans un jeton d'accès structuré (comme la déclaration « aud » dans JWT) ou vérifiée à l'aide du endpoint d'introspection de jeton.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.3", + "section_name": "Serveur de ressources OAuth", + "req_id": "V10.3.2", + "req_description": "Vérifiez que le serveur de ressources applique les décisions d'autorisation en fonction des déclarations du jeton d'accès définissant l'autorisation déléguée. Si des déclarations telles que « sub », « scope » et « authorization_details » sont présentes, elles doivent être prises en compte dans la décision.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.3", + "section_name": "Serveur de ressources OAuth", + "req_id": "V10.3.3", + "req_description": "Vérifiez que si une décision de contrôle d'accès nécessite l'identification d'un utilisateur unique à partir d'un jeton d'accès (JWT ou réponse d'introspection de jeton associé), le serveur de ressources identifie l'utilisateur à partir de déclarations non ré attribuables à d'autres utilisateurs. En général, cela implique l'utilisation d'une combinaison de déclarations « iss » et « sub ».", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.3", + "section_name": "Serveur de ressources OAuth", + "req_id": "V10.3.4", + "req_description": "Si le serveur de ressources requiert une force d'authentification, des méthodes ou une date d'expiration spécifiques, vérifiez que le jeton d'accès présenté respecte ces contraintes. Par exemple, s'il est présent, utilisez les déclarations OIDC « acr », « amr » et « auth_time » respectivement.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.3", + "section_name": "Serveur de ressources OAuth", + "req_id": "V10.3.5", + "req_description": "Vérifiez que le serveur de ressources empêche l'utilisation de jetons d'accès volés ou la relecture de jetons d'accès (de parties non autorisées) en exigeant des jetons d'accès limités par l'expéditeur, soit Mutual TLS pour OAuth 2, soit OAuth 2 Demonstration of Proof of Possession (DPoP).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.1", + "req_description": "Vérifiez que le serveur d'autorisation valide les URI de redirection en fonction d'une liste d'autorisation spécifique au client d'URI préenregistrés à l'aide d'une comparaison de chaînes exacte.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.2", + "req_description": "Vérifiez que, si le serveur d'autorisation renvoie le code d'autorisation dans la réponse, celui-ci ne peut être utilisé qu'une seule fois pour une demande de jeton. Pour la deuxième demande valide avec un code d'autorisation déjà utilisé pour émettre un jeton d'accès, le serveur d'autorisation doit rejeter la demande de jeton et révoquer tous les jetons émis liés au code d'autorisation.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.3", + "req_description": "Vérifiez que le code d'autorisation est de courte durée. La durée de vie maximale peut atteindre 10 minutes pour les applications L1 et L2 et 1 minute pour les applications L3.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.4", + "req_description": "Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement l'utilisation des autorisations nécessaires à ce client. Notez que les autorisations « token » (flux implicite) et « password » (flux d'informations d'identification du propriétaire de la ressource) ne doivent plus être utilisées.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.5", + "req_description": "Vérifiez que le serveur d'autorisation atténue les attaques par rejeu de jetons d'actualisation pour les clients publics, de préférence en utilisant des jetons d'actualisation limités par l'expéditeur, par exemple des jetons DPoP (Demonstrating Proof of Possession) ou des jetons d'accès liés à un certificat utilisant le protocole TLS mutuel (mTLS). Pour les applications L1 et L2, la rotation des jetons d'actualisation peut être utilisée. Si cette rotation est utilisée, le serveur d'autorisation doit invalider le jeton d'actualisation après utilisation et révoquer tous les jetons d'actualisation de cette autorisation si un jeton d'actualisation déjà utilisé et invalidé est fourni.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.6", + "req_description": "Vérifiez que, si l'octroi de code est utilisé, le serveur d'autorisation atténue les attaques par interception de code en exigeant une clé de preuve pour l'échange de code (PKCE). Pour les demandes d'autorisation, le serveur d'autorisation doit exiger une valeur « code_challenge » valide et ne doit pas accepter une valeur « plain » pour « code_challenge_method ». Pour une demande de jeton, il doit exiger la validation du paramètre « code_verifier ».", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.7", + "req_description": "Vérifiez que si le serveur d'autorisation prend en charge l'enregistrement dynamique des clients non authentifiés, il réduit le risque d'applications clientes malveillantes. Il doit valider les métadonnées clientes, telles que les URI enregistrés, garantir le consentement de l'utilisateur et l'avertir avant de traiter une demande d'autorisation avec une application cliente non approuvée.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.8", + "req_description": "Vérifiez que les jetons d’actualisation ont une expiration absolue, y compris si l’expiration du jeton d’actualisation glissant est appliquée.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.9", + "req_description": "Vérifiez que les jetons d'actualisation et les jetons d'accès de référence peuvent être révoqués par un utilisateur autorisé à l'aide de l'interface utilisateur du serveur d'autorisation, afin d'atténuer le risque de clients malveillants ou de jetons volés.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.10", + "req_description": "Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.11", + "req_description": "Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.12", + "req_description": "Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement la valeur « response_mode » dont ce client a besoin. Par exemple, en vérifiant cette valeur par rapport aux valeurs attendues ou en utilisant une requête d'autorisation poussée (PAR) ou une requête d'autorisation sécurisée par JWT (JAR).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.13", + "req_description": "Vérifiez que le type d'Autorisation « code » est toujours utilisé avec les demandes d'autorisation poussées (PAR).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.14", + "req_description": "Vérifiez que le serveur d'autorisation émet uniquement des jetons d'accès limités à l'expéditeur (preuve de possession), soit avec des jetons d'accès liés au certificat utilisant TLS mutuel (mTLS), soit avec des jetons d'accès liés au DPoP (démonstration de preuve de possession).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.15", + "req_description": "Vérifiez que, pour un client côté serveur (non exécuté sur l'appareil de l'utilisateur final), le serveur d'autorisation garantit que la valeur du paramètre « authorization_details » provient du backend client et que l'utilisateur ne l'a pas altérée. Par exemple, en exigeant l'utilisation d'une demande d'autorisation poussée (PAR) ou d'une demande d'autorisation sécurisée par JWT (JAR).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.4", + "section_name": "Serveur d'autorisation OAuth", + "req_id": "V10.4.16", + "req_description": "Vérifiez que le client est confidentiel et que le serveur d'autorisation requiert l'utilisation de méthodes d'authentification client fortes (basées sur la cryptographie à clé publique et résistantes aux attaques par relecture), telles que TLS mutuel ('tls_client_auth', 'self_signed_tls_client_auth') ou JWT à clé privée ('private_key_jwt').", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.5", + "section_name": "Client OIDC", + "req_id": "V10.5.1", + "req_description": "Vérifiez que le client (en tant que partie utilisatrice) atténue les attaques par rejeu de jeton d'identification. Par exemple, en vous assurant que la valeur « nonce » du jeton d'identification correspond à la valeur « nonce » envoyée dans la demande d'authentification au fournisseur OpenID (appelée demande d'autorisation envoyée au serveur d'autorisation dans OAuth2).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.5", + "section_name": "Client OIDC", + "req_id": "V10.5.2", + "req_description": "Vérifiez que le client identifie de manière unique l'utilisateur à partir des déclarations de jeton d'identification, généralement la déclaration « sub », qui ne peut pas être réaffectée à d'autres utilisateurs (pour la portée d'un fournisseur d'identité).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.5", + "section_name": "Client OIDC", + "req_id": "V10.5.3", + "req_description": "Vérifiez que le client rejette les tentatives d'un serveur d'autorisation malveillant d'usurper l'identité d'un autre serveur d'autorisation via ses métadonnées. Le client doit rejeter les métadonnées du serveur d'autorisation si l'URL de l'émetteur figurant dans ces métadonnées ne correspond pas exactement à l'URL d'émetteur préconfigurée attendue par le client.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.5", + "section_name": "Client OIDC", + "req_id": "V10.5.4", + "req_description": "Vérifiez que le client valide que le jeton d'identification est destiné à être utilisé pour ce client (audience) en vérifiant que la déclaration « aud » du jeton est égale à la valeur « client_id » pour le client.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.5", + "section_name": "Client OIDC", + "req_id": "V10.5.5", + "req_description": "Vérifiez que, lors de l'utilisation de la déconnexion du back-channel OIDC, la partie utilisatrice atténue les risques de déni de service liés à la déconnexion forcée et à la confusion entre JWT dans le flux de déconnexion. Le client doit vérifier que le jeton de déconnexion est correctement typé avec la valeur « logout+jwt », qu'il contient la déclaration « event » avec le nom de membre correct et qu'il ne contient pas de déclaration « nonce ». Il est également recommandé d'utiliser une expiration courte (par exemple, 2 minutes).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.6", + "section_name": "Fournisseur OpenID", + "req_id": "V10.6.1", + "req_description": "Vérifiez que le fournisseur OpenID n'autorise que les valeurs « code », « ciba », « id_token » ou « id_token code » pour le mode de réponse. Notez que « code » est préférable à « id_token code » (flux hybride OIDC) et que « token » (tout flux implicite) ne doit pas être utilisé.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.6", + "section_name": "Fournisseur OpenID", + "req_id": "V10.6.2", + "req_description": "Vérifiez que le fournisseur OpenID atténue les risques de déni de service liés à la déconnexion forcée. Pour ce faire, obtenez une confirmation explicite de l'utilisateur final ou, le cas échéant, validez les paramètres de la requête de déconnexion (initiée par la partie utilisatrice), comme « id_token_hint ».", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.7", + "section_name": "Gestion du consentement", + "req_id": "V10.7.1", + "req_description": "Vérifiez que le serveur d'autorisation garantit le consentement de l'utilisateur à chaque demande d'autorisation. Si l'identité du client ne peut être garantie, le serveur d'autorisation doit toujours demander explicitement le consentement de l'utilisateur.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.7", + "section_name": "Gestion du consentement", + "req_id": "V10.7.2", + "req_description": "Vérifiez que lorsque le serveur d'autorisation demande le consentement de l'utilisateur, il fournit des informations claires et suffisantes sur ce qui est consenti. Le cas échéant, ces informations doivent inclure la nature des autorisations demandées (généralement en fonction de la portée, du serveur de ressources et des détails d'autorisation RAR), l'identité de l'application autorisée et la durée de vie de ces autorisations.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "Oauth et OIDC", + "section_id": "V10.7", + "section_name": "Gestion du consentement", + "req_id": "V10.7.3", + "req_description": "Vérifiez que l’utilisateur peut consulter, modifier et révoquer les consentements qu’il a accordés via le serveur d’autorisation.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.1", + "section_name": "Inventaire et documentation cryptographiques", + "req_id": "V11.1.1", + "req_description": "Vérifiez qu’il existe une politique documentée pour la gestion des clés cryptographiques et un cycle de vie des clés cryptographiques qui suit une norme de gestion des clés telle que NIST SP 800-57. Cela devrait inclure la garantie que les clés ne sont pas sur-partagées (par exemple, avec plus de deux entités pour les secrets partagés et plus d’une entité pour les clés privées).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.1", + "section_name": "Inventaire et documentation cryptographiques", + "req_id": "V11.1.2", + "req_description": "Vérifiez qu'un inventaire cryptographique est réalisé, maintenu et régulièrement mis à jour, et qu'il inclut toutes les clés, algorithmes et certificats cryptographiques utilisés par l'application. Il doit également documenter les emplacements du système où les clés peuvent ou non être utilisées, ainsi que les types de données qui peuvent ou non être protégées par ces clés.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.1", + "section_name": "Inventaire et documentation cryptographiques", + "req_id": "V11.1.3", + "req_description": "Vérifiez que les mécanismes de découverte cryptographique sont utilisés pour identifier toutes les instances de cryptographie dans le système, y compris les opérations de chiffrement, de hachage et de signature.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.1", + "section_name": "Inventaire et documentation cryptographiques", + "req_id": "V11.1.4", + "req_description": "Vérifier la tenue d'un inventaire cryptographique. Celui-ci doit inclure un plan documenté décrivant la migration vers de nouvelles normes cryptographiques, telles que la cryptographie post-quantique, afin de réagir aux menaces futures.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.2", + "section_name": "Mise en œuvre sécurisée de la cryptographie", + "req_id": "V11.2.1", + "req_description": "Vérifiez que les implémentations validées par l’industrie (y compris les bibliothèques et les implémentations accélérées par le matériel) sont utilisées pour les opérations cryptographiques.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.2", + "section_name": "Mise en œuvre sécurisée de la cryptographie", + "req_id": "V11.2.2", + "req_description": "Vérifiez que l'application est conçue avec une agilité cryptographique, de sorte que les nombres aléatoires, le chiffrement authentifié, le MAC ou les algorithmes de hachage, les longueurs de clés, les tours, les chiffrements et les modes puissent être reconfigurés, mis à niveau ou échangés à tout moment, afin de se protéger contre les failles cryptographiques. De même, il doit être possible de remplacer les clés et les mots de passe, ainsi que de rechiffrer les données. Cela permettra des mises à niveau transparentes vers la cryptographie post-quantique (PQC), une fois que des implémentations hautement sécurisées de schémas ou de normes PQC approuvés seront largement disponibles.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.2", + "section_name": "Mise en œuvre sécurisée de la cryptographie", + "req_id": "V11.2.3", + "req_description": "Vérifiez que toutes les primitives cryptographiques utilisent un minimum de 128 bits de sécurité en fonction de l'algorithme, de la taille de la clé et de la configuration. Par exemple, une clé ECC de 256 bits offre environ 128 bits de sécurité, tandis que RSA nécessite une clé de 3072 bits pour atteindre 128 bits de sécurité.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.2", + "section_name": "Mise en œuvre sécurisée de la cryptographie", + "req_id": "V11.2.4", + "req_description": "Vérifiez que toutes les opérations cryptographiques sont à temps constant, sans opérations de « court-circuit » dans les comparaisons, les calculs ou les retours, pour éviter toute fuite d'informations.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.2", + "section_name": "Mise en œuvre sécurisée de la cryptographie", + "req_id": "V11.2.5", + "req_description": "Vérifiez que tous les modules cryptographiques échouent en toute sécurité et que les erreurs sont gérées de manière à ne pas permettre de vulnérabilités, telles que les attaques Padding Oracle.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.3", + "section_name": "Algorithmes de chiffrement", + "req_id": "V11.3.1", + "req_description": "Vérifiez que les modes de bloc non sécurisés (par exemple, ECB) et les schémas de remplissage faibles (par exemple, PKCS#1 v1.5) ne sont pas utilisés.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.3", + "section_name": "Algorithmes de chiffrement", + "req_id": "V11.3.2", + "req_description": "Vérifiez que seuls les chiffrements et modes approuvés tels que AES avec GCM sont utilisés.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.3", + "section_name": "Algorithmes de chiffrement", + "req_id": "V11.3.3", + "req_description": "Vérifiez que les données chiffrées sont protégées contre toute modification non autorisée, de préférence en utilisant une méthode de chiffrement authentifiée approuvée ou en combinant une méthode de chiffrement approuvée avec un algorithme MAC approuvé.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.3", + "section_name": "Algorithmes de chiffrement", + "req_id": "V11.3.4", + "req_description": "Vérifiez que les nonces, les vecteurs d'initialisation et autres nombres à usage unique ne sont pas utilisés pour plus d'une paire clé de chiffrement/élément de données. La méthode de génération doit être adaptée à l'algorithme utilisé.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.3", + "section_name": "Algorithmes de chiffrement", + "req_id": "V11.3.5", + "req_description": "Vérifiez que toute combinaison d'un algorithme de chiffrement et d'un algorithme MAC fonctionne en mode chiffrement puis MAC.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.4", + "section_name": "Hachage et fonctions basées sur le hachage", + "req_id": "V11.4.1", + "req_description": "Vérifiez que seules les fonctions de hachage approuvées sont utilisées pour les cas d'utilisation cryptographiques généraux, notamment les signatures numériques, HMAC, KDF et la génération de bits aléatoires. Les fonctions de hachage non autorisées, telles que MD5, ne doivent pas être utilisées à des fins cryptographiques.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.4", + "section_name": "Hachage et fonctions basées sur le hachage", + "req_id": "V11.4.2", + "req_description": "Vérifiez que les mots de passe sont stockés à l'aide d'une fonction de dérivation de clés approuvée et gourmande en ressources de calcul (également appelée « fonction de hachage de mots de passe »), dont les paramètres sont configurés conformément aux directives en vigueur. Ces paramètres doivent équilibrer sécurité et performances afin de rendre les attaques par force brute suffisamment difficiles pour le niveau de sécurité requis.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.4", + "section_name": "Hachage et fonctions basées sur le hachage", + "req_id": "V11.4.3", + "req_description": "Vérifiez que les fonctions de hachage utilisées dans les signatures numériques, dans le cadre de l'authentification ou de l'intégrité des données, sont résistantes aux collisions et possèdent des longueurs de bits appropriées. Si la résistance aux collisions est requise, la longueur de sortie doit être d'au moins 256 bits. Si seule la résistance aux attaques de seconde pré-image est requise, la longueur de sortie doit être d'au moins 128 bits.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.4", + "section_name": "Hachage et fonctions basées sur le hachage", + "req_id": "V11.4.4", + "req_description": "Vérifiez que l'application utilise des fonctions de dérivation de clés approuvées avec des paramètres d'extension de clés lors de la dérivation de clés secrètes à partir de mots de passe. Les paramètres utilisés doivent concilier sécurité et performances afin d'empêcher les attaques par force brute de compromettre la clé cryptographique obtenue.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.5", + "section_name": "Valeurs aléatoires", + "req_id": "V11.5.1", + "req_description": "Vérifiez que tous les nombres et chaînes aléatoires destinés à être non devinables doivent être générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et posséder au moins 128 bits d'entropie. Notez que les UUID ne respectent pas cette condition.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.5", + "section_name": "Valeurs aléatoires", + "req_id": "V11.5.2", + "req_description": "Vérifiez que le mécanisme de génération de nombres aléatoires utilisé est conçu pour fonctionner en toute sécurité, même en cas de forte demande.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.6", + "section_name": "Cryptographie à clé publique", + "req_id": "V11.6.1", + "req_description": "Vérifier que seuls des algorithmes cryptographiques et des modes opératoires approuvés sont utilisés pour la génération et l'amorçage des clés, ainsi que pour la génération et la vérification des signatures numériques. Les algorithmes de génération de clés ne doivent pas générer de clés non sécurisées et vulnérables aux attaques connues, par exemple les clés RSA vulnérables à la factorisation de Fermat.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.6", + "section_name": "Cryptographie à clé publique", + "req_id": "V11.6.2", + "req_description": "Vérifiez que des algorithmes cryptographiques approuvés sont utilisés pour l'échange de clés (tels que Diffie-Hellman), en veillant à ce que les mécanismes d'échange de clés utilisent des paramètres sécurisés. Cela permettra d'éviter les attaques contre le processus d'établissement des clés, susceptibles de conduire à des attaques de type « adversaire du milieu » ou à des failles cryptographiques.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.7", + "section_name": "Cryptographie des données en cours d'utilisation", + "req_id": "V11.7.1", + "req_description": "Vérifiez que le chiffrement complet de la mémoire est utilisé pour protéger les données sensibles pendant leur utilisation, empêchant ainsi l'accès par des utilisateurs ou des processus non autorisés.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptographie", + "section_id": "V11.7", + "section_name": "Cryptographie des données en cours d'utilisation", + "req_id": "V11.7.2", + "req_description": "Vérifiez que la minimisation des données garantit que la quantité minimale de données est exposée pendant le traitement et assurez-vous que les données sont chiffrées immédiatement après utilisation ou dès que possible.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.1", + "section_name": "Conseils généraux de sécurité TLS", + "req_id": "V12.1.1", + "req_description": "Vérifiez que seules les dernières versions recommandées du protocole TLS sont activées, telles que TLS 1.2 et TLS 1.3. La dernière version du protocole TLS doit être privilégiée.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.1", + "section_name": "Conseils généraux de sécurité TLS", + "req_id": "V12.1.2", + "req_description": "Vérifiez que seules les suites de chiffrement recommandées sont activées, les suites de chiffrement les plus puissantes étant définies comme préférées. Les applications L3 doivent uniquement prendre en charge les suites de chiffrement assurant la confidentialité persistante (forward secrecy).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.1", + "section_name": "Conseils généraux de sécurité TLS", + "req_id": "V12.1.3", + "req_description": "Vérifiez que l’application valide que les certificats clients mTLS sont approuvés avant d’utiliser l’identité du certificat pour l’authentification ou l’autorisation.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.1", + "section_name": "Conseils généraux de sécurité TLS", + "req_id": "V12.1.4", + "req_description": "Vérifiez que la révocation de certification appropriée, telle que l'agrafage du protocole OCSP (Online Certificate Status Protocol), est activée et configurée.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.1", + "section_name": "Conseils généraux de sécurité TLS", + "req_id": "V12.1.5", + "req_description": "Vérifiez que Encrypted Client Hello (ECH) est activé dans les paramètres TLS de l'application pour empêcher l'exposition de métadonnées sensibles, telles que l'indication du nom du serveur (SNI), pendant les processus de négociation TLS.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.2", + "section_name": "Communication HTTPS avec des services externes", + "req_id": "V12.2.1", + "req_description": "Vérifiez que TLS est utilisé pour toute connectivité entre un client et des services externes basés sur HTTP, et ne recourt pas à des communications non sécurisées ou non chiffrées.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.2", + "section_name": "Communication HTTPS avec des services externes", + "req_id": "V12.2.2", + "req_description": "Vérifiez que les services externes utilisent des certificats TLS publiquement approuvés.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.3", + "section_name": "Sécurité des communications entre services généraux", + "req_id": "V12.3.1", + "req_description": "Vérifiez qu'un protocole chiffré tel que TLS est utilisé pour toutes les connexions entrantes et sortantes vers et depuis l'application, y compris les systèmes de surveillance, les outils de gestion, l'accès à distance et SSH, les intergiciels, les bases de données, les mainframes, les systèmes partenaires ou les API externes. Le serveur ne doit pas recourir à des protocoles non sécurisés ou non chiffrés.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.3", + "section_name": "Sécurité des communications entre services généraux", + "req_id": "V12.3.2", + "req_description": "Vérifiez que les clients TLS valident les certificats reçus avant de communiquer avec un serveur TLS.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.3", + "section_name": "Sécurité des communications entre services généraux", + "req_id": "V12.3.3", + "req_description": "Vérifiez que TLS ou un autre mécanisme de chiffrement de transport approprié est utilisé pour toute connectivité entre les services internes basés sur HTTP au sein de l'application et ne se replie pas vers des communications non sécurisées ou non chiffrées.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.3", + "section_name": "Sécurité des communications entre services généraux", + "req_id": "V12.3.4", + "req_description": "Vérifiez que les connexions TLS entre les services internes utilisent des certificats de confiance. Lorsque des certificats générés en interne ou auto-signés sont utilisés, le service consommateur doit être configuré pour n'approuver que des autorités de certification internes spécifiques et des certificats auto-signés spécifiques.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Communication sécurisée", + "section_id": "V12.3", + "section_name": "Sécurité des communications entre services généraux", + "req_id": "V12.3.5", + "req_description": "Vérifiez que les services communiquant en interne au sein d'un système (communications intra-services) utilisent une authentification forte pour garantir la vérification de chaque endpoint. Des méthodes d'authentification forte, telles que l'authentification client TLS, doivent être utilisées pour garantir l'identité, en utilisant une infrastructure à clé publique et des mécanismes résistants aux attaques par rejeu. Pour les architectures de microservices, envisagez d'utiliser un maillage de services pour simplifier la gestion des certificats et renforcer la sécurité.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.1", + "section_name": "Documentation de configuration", + "req_id": "V13.1.1", + "req_description": "Vérifiez que tous les besoins de communication de l'application sont documentés. Cela doit inclure les services externes dont l'application dépend et les cas où un utilisateur final pourrait fournir un emplacement externe auquel l'application se connectera.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.1", + "section_name": "Documentation de configuration", + "req_id": "V13.1.2", + "req_description": "Vérifiez que pour chaque service utilisé par l'application, la documentation définit le nombre maximal de connexions simultanées (par exemple, les limites du pool de connexions) et le comportement de l'application lorsque cette limite est atteinte, y compris les mécanismes de secours ou de récupération, pour éviter les conditions de déni de service.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.1", + "section_name": "Documentation de configuration", + "req_id": "V13.1.3", + "req_description": "Vérifiez que la documentation de l'application définit des stratégies de gestion des ressources pour chaque système ou service externe utilisé (par exemple, bases de données, descripteurs de fichiers, threads, connexions HTTP). Cela doit inclure les procédures de libération des ressources, les paramètres de délai d'expiration, la gestion des échecs et l'implémentation de la logique de nouvelle tentative, en spécifiant les limites de nouvelle tentative, les délais et les algorithmes de retour arrière. Pour les opérations de requête-réponse HTTP synchrones, la documentation doit imposer des délais d'expiration courts et soit désactiver les nouvelles tentatives, soit les limiter strictement afin d'éviter les retards en cascade et l'épuisement des ressources.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.1", + "section_name": "Documentation de configuration", + "req_id": "V13.1.4", + "req_description": "Vérifiez que la documentation de l'application définit les secrets essentiels à la sécurité de l'application et un calendrier de rotation de ceux-ci, en fonction du modèle de menace et des exigences commerciales de l'organisation.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Configuration de la communication backend", + "req_id": "V13.2.1", + "req_description": "Vérifiez que les communications entre les composants de l'application backend qui ne prennent pas en charge le mécanisme de session utilisateur standard de l'application, notamment les API, les intergiciels et les couches de données, sont authentifiées. L'authentification doit utiliser des comptes de service individuels, des jetons à court terme ou une authentification par certificat, et non des identifiants immuables tels que des mots de passe, des clés API ou des comptes partagés avec accès privilégié.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Configuration de la communication backend", + "req_id": "V13.2.2", + "req_description": "Vérifiez que les communications entre les composants de l'application backend, y compris les services locaux ou du système d'exploitation, les API, les intergiciels et les couches de données, sont effectuées avec des comptes dotés des privilèges les moins nécessaires.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Configuration de la communication backend", + "req_id": "V13.2.3", + "req_description": "Vérifiez que si des informations d’identification doivent être utilisées pour l’authentification du service, les informations d’identification utilisées par le consommateur ne sont pas des informations d’identification par défaut (par exemple, root/root ou admin/admin).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Configuration de la communication backend", + "req_id": "V13.2.4", + "req_description": "Vérifiez qu'une liste d’autorisations est utilisée pour définir les ressources ou systèmes externes avec lesquels l'application est autorisée à communiquer (par exemple, pour les requêtes sortantes, les chargements de données ou l'accès aux fichiers). Cette liste d'autorisation peut être implémentée au niveau de la couche applicative, du serveur web, du pare-feu ou d'une combinaison de différentes couches.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Configuration de la communication backend", + "req_id": "V13.2.5", + "req_description": "Vérifiez que le serveur Web ou d’application est configuré avec une liste autorisée de ressources ou de systèmes vers lesquels le serveur peut envoyer des requêtes ou charger des données ou des fichiers.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Configuration de la communication backend", + "req_id": "V13.2.6", + "req_description": "Vérifiez que lorsque l'application se connecte à des services distincts, elle suit la configuration documentée pour chaque connexion, comme le nombre maximal de connexions parallèles, le comportement lorsque le nombre maximal de connexions autorisées est atteint, les délais d'expiration de connexion et les stratégies de nouvelle tentative.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.3", + "section_name": "Gestion des secrets", + "req_id": "V13.3.1", + "req_description": "Vérifiez qu'une solution de gestion des secrets, telle qu'un coffre-fort de clés, est utilisée pour créer, stocker, contrôler l'accès et détruire en toute sécurité les secrets backend. Ceux-ci peuvent inclure des mots de passe, du matériel de clé, des intégrations avec des bases de données et des systèmes tiers, des clés et des graines pour des jetons temporels, d'autres secrets internes et des clés API. Les secrets ne doivent pas être inclus dans le code source de l'application ni dans les artefacts de build. Pour une application L3, cela doit impliquer une solution matérielle telle qu'un HSM.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.3", + "section_name": "Gestion des secrets", + "req_id": "V13.3.2", + "req_description": "Vérifiez que l’accès aux ressources secrètes respecte le principe du moindre privilège.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.3", + "section_name": "Gestion des secrets", + "req_id": "V13.3.3", + "req_description": "Vérifiez que toutes les opérations cryptographiques sont effectuées à l'aide d'un module de sécurité isolé (tel qu'un coffre-fort ou un module de sécurité matériel) pour gérer et protéger en toute sécurité le matériel clé contre toute exposition en dehors du module de sécurité.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.3", + "section_name": "Gestion des secrets", + "req_id": "V13.3.4", + "req_description": "Vérifiez que les secrets sont configurés pour expirer et être renouvelés en fonction de la documentation de l'application.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Fuite d'informations involontaire", + "req_id": "V13.4.1", + "req_description": "Vérifiez que l'application est déployée soit sans aucune métadonnée de contrôle de source, y compris les dossiers .git ou .svn, soit de manière à ce que ces dossiers soient inaccessibles à la fois en externe et à l'application elle-même.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Fuite d'informations involontaire", + "req_id": "V13.4.2", + "req_description": "Vérifiez que les modes de débogage sont désactivés pour tous les composants dans les environnements de production afin d’éviter l’exposition des fonctionnalités de débogage et la fuite d’informations.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Fuite d'informations involontaire", + "req_id": "V13.4.3", + "req_description": "Vérifiez que les serveurs Web n’exposent pas les listes de répertoires aux clients, sauf si cela est explicitement prévu.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Fuite d'informations involontaire", + "req_id": "V13.4.4", + "req_description": "Vérifiez que l’utilisation de la méthode HTTP TRACE n’est pas prise en charge dans les environnements de production, afin d’éviter toute fuite d’informations potentielle.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Fuite d'informations involontaire", + "req_id": "V13.4.5", + "req_description": "Vérifiez que la documentation (comme pour les API internes) et les endpoints de surveillance ne sont pas exposés, sauf si cela est explicitement prévu.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Fuite d'informations involontaire", + "req_id": "V13.4.6", + "req_description": "Vérifiez que l’application n’expose pas d’informations de version détaillées des composants backend.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Fuite d'informations involontaire", + "req_id": "V13.4.7", + "req_description": "Vérifiez que la couche web est configuré pour servir uniquement les fichiers avec des extensions de fichier spécifiques afin d’éviter toute fuite involontaire d’informations, de configuration et de code source.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.1", + "section_name": "Documentation sur la protection des données", + "req_id": "V14.1.1", + "req_description": "Vérifiez que toutes les données sensibles créées et traitées par l'application ont été identifiées et classées selon leur niveau de protection. Cela inclut les données uniquement codées et donc facilement déchiffrables, telles que les chaînes Base64 ou la charge utile en texte clair d'un JWT. Les niveaux de protection doivent tenir compte des réglementations et normes de protection des données et de confidentialité auxquelles l'application est tenue de se conformer.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.1", + "section_name": "Documentation sur la protection des données", + "req_id": "V14.1.2", + "req_description": "Vérifier que tous les niveaux de protection des données sensibles sont assortis d'un ensemble documenté d'exigences de protection. Cela doit inclure (sans s'y limiter) les exigences relatives au chiffrement général, à la vérification de l'intégrité, à la conservation, à la journalisation des données, aux contrôles d'accès aux données sensibles dans les journaux, au chiffrement au niveau de la base de données, aux technologies de confidentialité et de renforcement de la confidentialité à utiliser, ainsi qu'aux autres exigences de confidentialité.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.2", + "section_name": "Protection générale des données", + "req_id": "V14.2.1", + "req_description": "Vérifiez que les données sensibles sont uniquement envoyées au serveur dans les champs de corps ou d’en-tête du message HTTP, et que l’URL et la chaîne de requête ne contiennent pas d’informations sensibles, telles qu’une clé API ou un jeton de session.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.2", + "section_name": "Protection générale des données", + "req_id": "V14.2.2", + "req_description": "Vérifiez que l’application empêche la mise en cache des données sensibles dans les composants du serveur, tels que les équilibreurs de charge et les caches d’application, ou garantit que les données sont purgées en toute sécurité après utilisation.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.2", + "section_name": "Protection générale des données", + "req_id": "V14.2.3", + "req_description": "Vérifiez que les données sensibles définies ne sont pas envoyées à des parties non fiables (par exemple, des trackers d'utilisateurs) pour empêcher la collecte indésirable de données en dehors du contrôle de l'application.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.2", + "section_name": "Protection générale des données", + "req_id": "V14.2.4", + "req_description": "Vérifiez que les contrôles autour des données sensibles liés au chiffrement, à la vérification de l'intégrité, à la conservation, à la manière dont les données doivent être enregistrées, aux contrôles d'accès autour des données sensibles dans les journaux, à la confidentialité et aux technologies d'amélioration de la confidentialité, sont mis en œuvre comme défini dans la documentation pour le niveau de protection des données spécifiques.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.2", + "section_name": "Protection générale des données", + "req_id": "V14.2.5", + "req_description": "Vérifiez que les mécanismes de mise en cache sont configurés pour ne mettre en cache que les réponses dont le type de contenu est conforme à la ressource et qui ne contiennent pas de contenu sensible et dynamique. Le serveur web doit renvoyer une réponse 404 ou 302 lors de l'accès à un fichier inexistant plutôt qu'un fichier valide différent. Cela devrait empêcher les attaques par empoisonnement de cache web.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.2", + "section_name": "Protection générale des données", + "req_id": "V14.2.6", + "req_description": "Vérifiez que l'application ne renvoie que les données sensibles minimales requises pour son fonctionnement. Par exemple, ne renvoyez que certains chiffres d'un numéro de carte de crédit, et non le numéro complet. Si les données complètes sont requises, elles doivent être masquées dans l'interface utilisateur, sauf si l'utilisateur les consulte spécifiquement.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.2", + "section_name": "Protection générale des données", + "req_id": "V14.2.7", + "req_description": "Vérifiez que les informations sensibles sont soumises à une classification de conservation des données, en veillant à ce que les données obsolètes ou inutiles soient supprimées automatiquement, selon un calendrier défini ou selon les besoins de la situation.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.2", + "section_name": "Protection générale des données", + "req_id": "V14.2.8", + "req_description": "Vérifiez que les informations sensibles sont supprimées des métadonnées des fichiers soumis par l'utilisateur, sauf si le stockage est autorisé par l'utilisateur.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.3", + "section_name": "Protection des données côté client", + "req_id": "V14.3.1", + "req_description": "Vérifiez que les données authentifiées sont effacées du stockage client, comme le DOM du navigateur, après la fin du client ou de la session. Le champ d'en-tête de réponse HTTP « Clear-Site-Data » peut être utile, mais le côté client devrait également pouvoir effectuer la correction si la connexion au serveur n'est pas disponible à la fin de la session.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.3", + "section_name": "Protection des données côté client", + "req_id": "V14.3.2", + "req_description": "Vérifiez que l'application définit suffisamment de champs d'en-tête de réponse HTTP anti-caching (c'est-à-dire Cache-Control : no-store) afin que les données sensibles ne soient pas mises en cache dans les navigateurs.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Protection des données", + "section_id": "V14.3", + "section_name": "Protection des données côté client", + "req_id": "V14.3.3", + "req_description": "Vérifiez que les données stockées dans le stockage du navigateur (telles que localStorage, sessionStorage, IndexedDB ou les cookies) ne contiennent pas de données sensibles, à l'exception des jetons de session.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.1", + "section_name": "Documentation sur le développement et l'architecture sécurisés", + "req_id": "V15.1.1", + "req_description": "Vérifiez que la documentation de l'application définit les délais de correction basés sur les risques pour les versions de composants tiers présentant des vulnérabilités et pour la mise à jour des bibliothèques en général, afin de minimiser les risques liés à ces composants.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.1", + "section_name": "Documentation sur le développement et l'architecture sécurisés", + "req_id": "V15.1.2", + "req_description": "Vérifiez qu'un catalogue d'inventaire, tel qu'une nomenclature logicielle (SBOM), est conservé pour toutes les bibliothèques tierces utilisées, y compris en vérifiant que les composants proviennent de référentiels prédéfinis, fiables et continuellement maintenus.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.1", + "section_name": "Documentation sur le développement et l'architecture sécurisés", + "req_id": "V15.1.3", + "req_description": "Vérifiez que la documentation de l'application identifie les fonctionnalités consommatrices en temps ou gourmandes en ressources. Elle doit notamment indiquer comment prévenir une perte de disponibilité due à une utilisation excessive de ces fonctionnalités et éviter que la génération d'une réponse ne prenne plus de temps que le délai d'expiration du consommateur. Les mesures de protection potentielles peuvent inclure le traitement asynchrone, l'utilisation de files d'attente et la limitation des processus parallèles par utilisateur et par application.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.1", + "section_name": "Documentation sur le développement et l'architecture sécurisés", + "req_id": "V15.1.4", + "req_description": "Vérifiez que la documentation de l’application met en évidence les bibliothèques tierces qui sont considérées comme des « composants à risque ».", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.1", + "section_name": "Documentation sur le développement et l'architecture sécurisés", + "req_id": "V15.1.5", + "req_description": "Vérifiez que la documentation de l’application met en évidence les parties de l’application où des « fonctionnalités dangereuses » sont utilisées.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.2", + "section_name": "Architecture de sécurité et dépendances", + "req_id": "V15.2.1", + "req_description": "Vérifiez que l’application contient uniquement des composants qui n’ont pas dépassé les délais de mise à jour et de correction documentés.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.2", + "section_name": "Architecture de sécurité et dépendances", + "req_id": "V15.2.2", + "req_description": "Vérifiez que l'application a mis en œuvre des défenses contre la perte de disponibilité due à des fonctionnalités qui prennent du temps ou qui nécessitent des ressources, sur la base des décisions et stratégies de sécurité documentées à cet effet.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.2", + "section_name": "Architecture de sécurité et dépendances", + "req_id": "V15.2.3", + "req_description": "Vérifiez que l'environnement de production inclut uniquement les fonctionnalités nécessaires au fonctionnement de l'application et n'expose pas de fonctionnalités superflues telles que du code de test, des exemples d'extraits et des fonctionnalités de développement.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.2", + "section_name": "Architecture de sécurité et dépendances", + "req_id": "V15.2.4", + "req_description": "Vérifiez que les composants tiers et toutes leurs dépendances transitives sont inclus à partir du référentiel attendu, qu'il soit détenu en interne ou qu'il s'agisse d'une source externe, et qu'il n'y a aucun risque d'attaque par confusion de dépendances.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.2", + "section_name": "Architecture de sécurité et dépendances", + "req_id": "V15.2.5", + "req_description": "Vérifiez que l'application implémente des protections supplémentaires autour des parties documentées comme contenant des « fonctionnalités dangereuses » ou utilisant des bibliothèques tierces considérées comme des « composants à risque ». Cela peut inclure des techniques telles que le sandboxing, l'encapsulation, la conteneurisation ou l'isolation au niveau du réseau pour retarder et dissuader les attaquants qui compromettent une partie de l'application de se propager ailleurs.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.3", + "section_name": "Développement défensif", + "req_id": "V15.3.1", + "req_description": "Vérifiez que l'application ne renvoie que le sous-ensemble requis de champs d'un objet de données. Par exemple, elle ne doit pas renvoyer un objet de données entier, car certains champs individuels ne doivent pas être accessibles aux utilisateurs.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.3", + "section_name": "Développement défensif", + "req_id": "V15.3.2", + "req_description": "Vérifiez que lorsque le backend de l'application effectue des appels vers des URL externes, il est configuré pour ne pas suivre les redirections, sauf s'il s'agit d'une fonctionnalité prévue.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.3", + "section_name": "Développement défensif", + "req_id": "V15.3.3", + "req_description": "Vérifiez que l'application dispose de contre-mesures pour se protéger contre les attaques d'affectation de masse en limitant les champs autorisés par contrôleur et action, par exemple, il n'est pas possible d'insérer ou de mettre à jour une valeur de champ lorsqu'elle n'était pas destinée à faire partie de cette action.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.3", + "section_name": "Développement défensif", + "req_id": "V15.3.4", + "req_description": "Vérifiez que tous les composants proxy et middleware transfèrent correctement l'adresse IP d'origine de l'utilisateur à l'aide de champs de données fiables qui ne peuvent pas être manipulés par l'utilisateur final, et que l'application et le serveur Web utilisent cette valeur correcte pour la journalisation et les décisions de sécurité telles que la limitation du débit, en tenant compte du fait que même l'adresse IP d'origine peut ne pas être fiable en raison d'adresses IP dynamiques, de VPN ou de pare-feu d'entreprise.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.3", + "section_name": "Développement défensif", + "req_id": "V15.3.5", + "req_description": "Vérifiez que l'application garantit explicitement que les variables sont du type correct et effectue des opérations d'égalité et de comparaison strictes. Cela permet d'éviter les vulnérabilités liées à la confusion de types, causées par des hypothèses du code de l'application sur le type d'une variable.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.3", + "section_name": "Développement défensif", + "req_id": "V15.3.6", + "req_description": "Vérifiez que le code JavaScript est écrit de manière à éviter la pollution du prototype, par exemple en utilisant Set() ou Map() au lieu de littéraux d'objet.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.3", + "section_name": "Développement défensif", + "req_id": "V15.3.7", + "req_description": "Vérifiez que l'application dispose de défenses contre les attaques de pollution des paramètres HTTP, en particulier si le Framework d'application ne fait aucune distinction quant à la source des paramètres de requête (chaîne de requête, paramètres de corps, cookies ou champs d'en-tête).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.4", + "section_name": "Concurrence sécurisée", + "req_id": "V15.4.1", + "req_description": "Vérifiez que les objets partagés dans le code multithread (tels que les caches, les fichiers ou les objets en mémoire accessibles par plusieurs threads) sont accessibles en toute sécurité à l'aide de types thread-safe et de mécanismes de synchronisation tels que des verrous ou des sémaphores pour éviter les conditions de concurrence et la corruption des données.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.4", + "section_name": "Concurrence sécurisée", + "req_id": "V15.4.2", + "req_description": "Vérifiez que les vérifications de l'état d'une ressource, comme son existence ou ses autorisations, et des actions qui en dépendent, sont effectuées en une seule opération atomique afin d'éviter les situations de concurrence entre le moment de la vérification et le moment de l'utilisation (TOCTOU). Par exemple, vérifier l'existence d'un fichier avant de l'ouvrir ou l'accès d'un utilisateur avant de l'accorder.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.4", + "section_name": "Concurrence sécurisée", + "req_id": "V15.4.3", + "req_description": "Vérifiez que les verrous sont utilisés de manière cohérente pour éviter que les threads ne se bloquent, que ce soit en s'attendant les uns les autres ou en réessayant sans fin, et que la logique de verrouillage reste dans le code responsable de la gestion de la ressource pour garantir que les verrous ne peuvent pas être modifiés par inadvertance ou de manière malveillante par des classes ou du code externes.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Développement et architecture sécurisés", + "section_id": "V15.4", + "section_name": "Concurrence sécurisée", + "req_id": "V15.4.4", + "req_description": "Vérifiez que les politiques d'allocation des ressources empêchent la saturation de threads en garantissant un accès équitable aux ressources, par exemple en exploitant les pools de threads, permettant aux threads de priorité inférieure de continuer dans un délai raisonnable.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.1", + "section_name": "Documentation sur la journalisation de sécurité", + "req_id": "V16.1.1", + "req_description": "Vérifiez qu'il existe un inventaire documentant la journalisation effectuée à chaque couche de la pile technologique de l'application, les événements enregistrés, les formats de journal, l'endroit où cette journalisation est stockée, la manière dont elle est utilisée, la manière dont l'accès à celle-ci est contrôlé et la durée de conservation des journaux.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.2", + "section_name": "Journalisation générale", + "req_id": "V16.2.1", + "req_description": "Vérifiez que chaque entrée de journal inclut les métadonnées nécessaires (telles que quand, où, qui, quoi) qui permettraient une enquête détaillée sur la chronologie lorsqu'un événement se produit.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.2", + "section_name": "Journalisation générale", + "req_id": "V16.2.2", + "req_description": "Vérifiez que les sources de temps de tous les composants de journalisation sont synchronisées et que les horodatages des métadonnées des événements de sécurité utilisent le temps UTC ou incluent un décalage horaire explicite. L'UTC est recommandé pour garantir la cohérence entre les systèmes distribués et éviter toute confusion lors du passage à l'heure d'été.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.2", + "section_name": "Journalisation générale", + "req_id": "V16.2.3", + "req_description": "Vérifiez que l’application stocke ou diffuse uniquement les journaux vers les fichiers et services documentés dans l’inventaire des journaux.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.2", + "section_name": "Journalisation générale", + "req_id": "V16.2.4", + "req_description": "Vérifiez que les journaux peuvent être lus et corrélés par le processeur de journaux utilisé, de préférence en utilisant un format de journalisation commun.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.2", + "section_name": "Journalisation générale", + "req_id": "V16.2.5", + "req_description": "Vérifiez que l'application applique la journalisation en fonction du niveau de protection des données lors de la journalisation de données sensibles. Par exemple, certaines données, comme les identifiants ou les informations de paiement, peuvent être interdites. D'autres données, comme les jetons de session, ne peuvent être enregistrées que par hachage ou masquage, en totalité ou en partie.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.3", + "section_name": "Événements de sécurité", + "req_id": "V16.3.1", + "req_description": "Vérifiez que toutes les opérations d'authentification sont enregistrées, y compris les tentatives réussies et infructueuses. Des métadonnées supplémentaires, telles que le type d'authentification ou les facteurs utilisés, doivent également être collectées.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.3", + "section_name": "Événements de sécurité", + "req_id": "V16.3.2", + "req_description": "Vérifier que les tentatives d'autorisation infructueuses sont logguées. Pour le niveau 3, cela doit inclure la journalisation de toutes les décisions d'autorisation, y compris lors de l'accès à des données sensibles (sans journalisation des données sensibles elles-mêmes).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.3", + "section_name": "Événements de sécurité", + "req_id": "V16.3.3", + "req_description": "Vérifiez que l'application enregistre les événements de sécurité définis dans la documentation et enregistre également les tentatives de contournement des contrôles de sécurité, tels que la validation des entrées, la logique métier et l'anti-automatisation.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.3", + "section_name": "Événements de sécurité", + "req_id": "V16.3.4", + "req_description": "Vérifiez que l’application enregistre les erreurs inattendues et les échecs de contrôle de sécurité tels que les échecs TLS du backend.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.4", + "section_name": "Protection des journaux", + "req_id": "V16.4.1", + "req_description": "Vérifiez que tous les composants de journalisation codent correctement les données pour empêcher l’injection de journaux.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.4", + "section_name": "Protection des journaux", + "req_id": "V16.4.2", + "req_description": "Vérifiez que les journaux sont protégés contre tout accès non autorisé et ne peuvent pas être modifiés.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.4", + "section_name": "Protection des journaux", + "req_id": "V16.4.3", + "req_description": "Vérifiez que les journaux sont transmis de manière sécurisée à un système logique distinct pour analyse, détection, alerte et remontée des informations. L'objectif est de garantir qu'en cas de violation de l'application, les journaux ne seront pas compromis.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.5", + "section_name": "Gestion des erreurs", + "req_id": "V16.5.1", + "req_description": "Vérifiez qu'un message générique est renvoyé au consommateur lorsqu'une erreur inattendue ou sensible à la sécurité se produit, garantissant ainsi l'absence d'exposition de données système internes sensibles telles que les traces de pile, les requêtes, les clés secrètes et les jetons.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.5", + "section_name": "Gestion des erreurs", + "req_id": "V16.5.2", + "req_description": "Vérifiez que l'application continue de fonctionner en toute sécurité lorsque l'accès aux ressources externes échoue, par exemple, en utilisant des modèles tels que des disjoncteurs ou une dégradation progressive.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.5", + "section_name": "Gestion des erreurs", + "req_id": "V16.5.3", + "req_description": "Vérifiez que l'application échoue proprement et sécurisée, y compris lorsqu'une exception se produit, en évitant les accès en cas d'erreur telles que le traitement d'une transaction malgré les erreurs résultant de la logique de validation.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Journalisation de sécurité et gestion des erreurs", + "section_id": "V16.5", + "section_name": "Gestion des erreurs", + "req_id": "V16.5.4", + "req_description": "Vérifiez qu'un gestionnaire d'erreurs de « dernier recours » est défini pour intercepter toutes les exceptions non gérées. Cela permet d'éviter la perte des informations d'erreur qui doivent être loguées dans les fichiers journaux et de garantir qu'une erreur ne paralyse pas l'ensemble du processus applicatif, entraînant une perte de disponibilité.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.1", + "section_name": "Serveur TURN", + "req_id": "V17.1.1", + "req_description": "Vérifiez que le service TURN (Traversal Using Relays around NAT) autorise uniquement l'accès aux adresses IP non réservées à des fins spécifiques (par exemple, réseaux internes, diffusion, bouclage). Notez que cela s'applique aux adresses IPv4 et IPv6.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.1", + "section_name": "Serveur TURN", + "req_id": "V17.1.2", + "req_description": "Vérifiez que le service Traversal Using Relays around NAT (TURN) n'est pas susceptible d'épuiser ses ressources lorsque des utilisateurs légitimes tentent d'ouvrir un grand nombre de ports sur le serveur TURN.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Média", + "req_id": "V17.2.1", + "req_description": "Vérifiez que la clé du certificat Datagram Transport Layer Security (DTLS) est gérée et protégée conformément à la politique documentée de gestion des clés cryptographiques.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Média", + "req_id": "V17.2.2", + "req_description": "Vérifiez que le serveur multimédia est configuré pour utiliser et prendre en charge les suites de chiffrement DTLS (Datagram Transport Layer Security) approuvées et un profil de protection sécurisé pour l'extension DTLS pour l'établissement de clés pour le protocole de transport en temps réel sécurisé (DTLS-SRTP).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Média", + "req_id": "V17.2.3", + "req_description": "Vérifiez que l'authentification SRTP (Secure Real-time Transport Protocol) est vérifiée sur le serveur multimédia pour empêcher les attaques par injection RTP (Real-time Transport Protocol) d'entraîner une condition de déni de service ou l'insertion de médias audio ou vidéo dans les flux multimédias.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Média", + "req_id": "V17.2.4", + "req_description": "Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant lorsqu'il rencontre des paquets SRTP (Secure Real-time Transport Protocol) mal formés.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Média", + "req_id": "V17.2.5", + "req_description": "Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Média", + "req_id": "V17.2.6", + "req_description": "Vérifiez que le serveur multimédia n'est pas sensible à la vulnérabilité de condition de concurrence « ClientHello » dans Datagram Transport Layer Security (DTLS) en vérifiant si le serveur multimédia est publiquement connu comme étant vulnérable ou en effectuant le test de condition de concurrence.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Média", + "req_id": "V17.2.7", + "req_description": "Vérifiez que tous les mécanismes d'enregistrement audio ou vidéo associés au serveur multimédia sont en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Média", + "req_id": "V17.2.8", + "req_description": "Vérifiez que le certificat Datagram Transport Layer Security (DTLS) est vérifié par rapport à l'attribut d'empreinte cryptographique du protocole de description de session (SDP), en mettant fin au flux multimédia si la vérification échoue, pour garantir l'authenticité du flux multimédia.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.3", + "section_name": "Signalisation", + "req_id": "V17.3.1", + "req_description": "Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation entrants légitimes lors d'une attaque par saturation. Cela peut être réalisé en implémentant une limitation de débit au niveau de la signalisation.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.3", + "section_name": "Signalisation", + "req_id": "V17.3.2", + "req_description": "Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation légitimes en cas de message mal formé susceptible de provoquer un déni de service. Cela peut inclure la validation des entrées, la gestion sécurisée des dépassements d'entiers, la prévention des dépassements de tampon et l'utilisation d'autres techniques robustes de gestion des erreurs.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + } + ] +} diff --git a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.json b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.json new file mode 100644 index 0000000000..dc558e6b1a --- /dev/null +++ b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.json @@ -0,0 +1,2774 @@ +{ + "Name": "Application Security Verification Standard Project", + "ShortName": "ASVS", + "Version": "5.0.0", + "Description": "The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.", + "Requirements": [ + { + "Shortcode": "V1", + "Ordinal": 1, + "ShortName": "Encoding", + "Name": "Encodage et nettoyage", + "Items": [ + { + "Shortcode": "V1.1", + "Ordinal": 1, + "Name": "Architecture d'encodage et de nettoyage", + "Items": [ + { + "Shortcode": "V1.1.1", + "Ordinal": 1, + "Description": "Vérifiez que l'entrée est décodée ou non échappée vers une forme canonique une seule fois, elle n'est décodée que lorsque des données codées sous cette forme sont attendues, et que cela est fait avant de traiter davantage l'entrée, par exemple, elle n'est pas effectuée après la validation ou la désinfection de l'entrée.", + "L": "2" + }, + { + "Shortcode": "V1.1.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application effectue l'encodage et l'échappement de sortie soit comme étape finale avant d'être utilisée par l'interpréteur pour lequel elle est destinée, soit par l'interpréteur lui-même.", + "L": "2" + } + ] + }, + { + "Shortcode": "V1.2", + "Ordinal": 2, + "Name": "Prévention des injections", + "Items": [ + { + "Shortcode": "V1.2.1", + "Ordinal": 1, + "Description": "Vérifiez que l'encodage de sortie d'une réponse HTTP, d'un document HTML ou d'un document XML est pertinent pour le contexte requis, comme l'encodage des caractères pertinents pour les éléments HTML, les attributs HTML, les commentaires HTML, les CSS ou les champs d'en-tête HTTP, pour éviter de modifier la structure du message ou du document.", + "L": "1" + }, + { + "Shortcode": "V1.2.2", + "Ordinal": 2, + "Description": "Vérifiez que, lors de la création dynamique d'URL, les données non fiables sont encodées en fonction de leur contexte (par exemple, encodage d'URL ou encodage base64url pour les paramètres de requête ou de chemin). Assurez-vous que seuls les schémas d'URL sûrs sont autorisés (par exemple, interdire javascript: ou data:).", + "L": "1" + }, + { + "Shortcode": "V1.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l'encodage ou l'échappement de sortie est utilisé lors de la création dynamique de contenu JavaScript (y compris JSON), pour éviter de modifier la structure du message ou du document (pour éviter l'injection JavaScript et JSON).", + "L": "1" + }, + { + "Shortcode": "V1.2.4", + "Ordinal": 4, + "Description": "Vérifiez que la sélection de données ou les requêtes de base de données (par exemple, SQL, HQL, NoSQL, Cypher) utilisent des requêtes paramétrées, des ORM, des Framework d'entités ou sont protégées contre les injections SQL et autres attaques par injection de base de données. Ceci est également pertinent lors de l'écriture de procédures stockées.", + "L": "1" + }, + { + "Shortcode": "V1.2.5", + "Ordinal": 5, + "Description": "Vérifiez que l’application protège contre l’injection de commandes du système d’exploitation et que les appels du système d’exploitation utilisent des requêtes du système d’exploitation paramétrées ou utilisent un encodage de sortie de ligne de commande contextuelle.", + "L": "1" + }, + { + "Shortcode": "V1.2.6", + "Ordinal": 6, + "Description": "Vérifiez que l’application protège contre les vulnérabilités d’injection LDAP ou que des contrôles de sécurité spécifiques pour empêcher l’injection LDAP ont été mis en œuvre.", + "L": "2" + }, + { + "Shortcode": "V1.2.7", + "Ordinal": 7, + "Description": "Vérifiez que l’application est protégée contre les attaques par injection XPath en utilisant la paramétrisation des requêtes ou des requêtes précompilées.", + "L": "2" + }, + { + "Shortcode": "V1.2.8", + "Ordinal": 8, + "Description": "Vérifiez que les processeurs LaTeX sont configurés de manière sécurisée (par exemple, en n'utilisant pas l'indicateur « --shell-escape ») et qu'une liste d’autorisations de commandes est utilisée pour empêcher les attaques par injection LaTeX.", + "L": "2" + }, + { + "Shortcode": "V1.2.9", + "Ordinal": 9, + "Description": "Vérifiez que l'application échappe les caractères spéciaux dans les expressions régulières (généralement à l'aide d'une barre oblique inverse) pour éviter qu'ils ne soient mal interprétés comme des métacaractères.", + "L": "2" + }, + { + "Shortcode": "V1.2.10", + "Ordinal": 10, + "Description": "Vérifiez que l'application est protégée contre les injections CSV et injections de formules. L'application doit respecter les règles d'échappement définies dans les sections 2.6 et 2.7 de la RFC 4180 lors de l'export de contenu CSV. De plus, lors de l'export au format CSV ou vers d'autres formats de tableur (tels que XLS, XLSX ou ODF), les caractères spéciaux (notamment « = », « + », « - », « @ », « \\t » (tabulation) et « \\0 » (caractère null)) doivent être protégés par une apostrophe s'ils apparaissent en premier dans une valeur de champ.", + "L": "3" + } + ] + }, + { + "Shortcode": "V1.3", + "Ordinal": 3, + "Name": "Nettoyage", + "Items": [ + { + "Shortcode": "V1.3.1", + "Ordinal": 1, + "Description": "Vérifiez que toutes les entrées HTML non fiables provenant d'éditeurs WYSIWYG ou similaires sont nettoyées à l'aide d'une bibliothèque ou d'une fonctionnalité de Framework de nettoyage HTML bien connue et sécurisée.", + "L": "1" + }, + { + "Shortcode": "V1.3.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application évite d'utiliser eval() ou d'autres fonctionnalités d'exécution de code dynamique telles que Spring Expression Language (SpEL). En l'absence d'alternative, toute saisie utilisateur incluse doit être nettoyée avant d'être exécutée.", + "L": "1" + }, + { + "Shortcode": "V1.3.3", + "Ordinal": 3, + "Description": "Vérifiez que les données transmises à un contexte potentiellement dangereux sont préalablement nettoyées pour appliquer des mesures de sécurité, telles qu'autoriser uniquement des caractères sûrs pour ce contexte et raccourcir des entrées trop longues.", + "L": "2" + }, + { + "Shortcode": "V1.3.4", + "Ordinal": 4, + "Description": "Vérifiez que le contenu Scalable Vector Graphics (SVG) scriptable fourni par l'utilisateur est validé ou nettoyé pour contenir uniquement des balises et des attributs (tels que des graphiques de dessin) qui sont sûrs pour l'application, par exemple, ne contiennent pas de scripts et d'objets étrangers.", + "L": "2" + }, + { + "Shortcode": "V1.3.5", + "Ordinal": 5, + "Description": "Vérifiez que l'application nettoie ou désactive le contenu du langage de modèle d'expression ou de script fourni par l'utilisateur, tel que les feuilles de style CSS, le Markdown ou XSL, BBCode ou similaire.", + "L": "2" + }, + { + "Shortcode": "V1.3.6", + "Ordinal": 6, + "Description": "Vérifiez que l'application protège contre les attaques de falsification de requête côté serveur (SSRF), en validant les données non fiables par rapport à une liste d'autorisation de protocoles, de domaines, de chemins et de ports et en nettoyant les caractères potentiellement dangereux avant d'utiliser les données pour appeler un autre service.", + "L": "2" + }, + { + "Shortcode": "V1.3.7", + "Ordinal": 7, + "Description": "Vérifiez que l'application se protège contre les attaques par injection de modèles en interdisant la création de modèles basés sur des entrées non fiables. En l'absence d'alternative, toute entrée non fiable incluse dynamiquement lors de la création du modèle doit être nettoyée ou rigoureusement validée.", + "L": "2" + }, + { + "Shortcode": "V1.3.8", + "Ordinal": 8, + "Description": "Vérifiez que l’application nettoie correctement les entrées non fiables avant utilisation dans les requêtes Java Naming and Directory Interface (JNDI) et que JNDI est configuré de manière sécurisée pour empêcher les attaques par injection JNDI.", + "L": "2" + }, + { + "Shortcode": "V1.3.9", + "Ordinal": 9, + "Description": "Vérifiez que l’application nettoie le contenu avant qu’il ne soit envoyé à memcache pour éviter les attaques par injection.", + "L": "2" + }, + { + "Shortcode": "V1.3.10", + "Ordinal": 10, + "Description": "Vérifiez que les chaînes de format susceptibles d'être résolues de manière inattendue ou malveillante lors de leur utilisation sont nettoyées avant d'être traitées.", + "L": "2" + }, + { + "Shortcode": "V1.3.11", + "Ordinal": 11, + "Description": "Vérifiez que l'application nettoie les entrées utilisateur avant de les transmettre aux systèmes de messagerie pour se protéger contre l'injection SMTP ou IMAP.", + "L": "2" + }, + { + "Shortcode": "V1.3.12", + "Ordinal": 12, + "Description": "Vérifiez que les expressions régulières sont exemptes d'éléments provoquant \"backtracking\" exponentiel et assurez-vous que les entrées non fiables sont nettoyées pour atténuer les attaques ReDoS ou Runaway Regex.", + "L": "3" + } + ] + }, + { + "Shortcode": "V1.4", + "Ordinal": 4, + "Name": "Mémoire, chaine de caractères et code à mémoire non-managée", + "Items": [ + { + "Shortcode": "V1.4.1", + "Ordinal": 1, + "Description": "Vérifiez que l'application utilise des chaînes memory-safe, une copie de mémoire et une arithmétique de pointeur renforcée pour détecter ou empêcher les débordements de pile, de tampon ou de tas.", + "L": "2" + }, + { + "Shortcode": "V1.4.2", + "Ordinal": 2, + "Description": "Vérifiez que les techniques de validation du signe, de la plage et de l’entrée sont utilisées pour éviter les dépassements d’entiers.", + "L": "2" + }, + { + "Shortcode": "V1.4.3", + "Ordinal": 3, + "Description": "Vérifiez que la mémoire et les ressources allouées dynamiquement sont libérées et que les références ou les pointeurs vers la mémoire libérée sont supprimés ou définis à null pour éviter les \"dangling pointer\" et les vulnérabilités d'utilisation après libération.", + "L": "2" + } + ] + }, + { + "Shortcode": "V1.5", + "Ordinal": 5, + "Name": "Désérialisation sécurisée", + "Items": [ + { + "Shortcode": "V1.5.1", + "Ordinal": 1, + "Description": "Vérifiez que l'application configure les \"parser\" XML pour utiliser une configuration restrictive et que les fonctionnalités non sûres telles que la résolution d'entités externes sont désactivées pour empêcher les attaques XML eXternal Entity (XXE).", + "L": "1" + }, + { + "Shortcode": "V1.5.2", + "Ordinal": 2, + "Description": "Vérifiez que la désérialisation des données non fiables garantit une gestion sécurisée des entrées, par exemple en utilisant une liste d'autorisation de types d'objets ou en limitant les types d'objets définis par le client, afin d'empêcher les attaques par désérialisation. Les mécanismes de désérialisation explicitement définis comme non sécurisés ne doivent pas être utilisés avec des entrées non fiables.", + "L": "2" + }, + { + "Shortcode": "V1.5.3", + "Ordinal": 3, + "Description": "Vérifiez que les différents \"parser\" utilisés dans l'application pour le même type de données (par exemple, les \"parser\" JSON, les \"parser\" XML, les \"parser\" d'URL) effectuent l'analyse de manière cohérente et utilisent le même mécanisme d'encodage de caractères pour éviter des problèmes tels que les vulnérabilités d'interopérabilité JSON ou un comportement d'analyse d'URI ou de fichier différent exploité dans les attaques d'inclusion de fichiers à distance (RFI) ou de falsification de requête côté serveur (SSRF).", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V2", + "Ordinal": 2, + "ShortName": "Validation", + "Name": "Validation et logique métier", + "Items": [ + { + "Shortcode": "V2.1", + "Ordinal": 1, + "Name": "Validation et documentation de la logique métier", + "Items": [ + { + "Shortcode": "V2.1.1", + "Ordinal": 1, + "Description": "Vérifiez que la documentation de l'application définit des règles de validation des entrées pour vérifier la validité des éléments de données par rapport à la structure attendue. Il peut s'agir de formats de données courants tels que des numéros de carte de crédit, des adresses e-mail ou des numéros de téléphone, ou d'un format de données interne.", + "L": "1" + }, + { + "Shortcode": "V2.1.2", + "Ordinal": 2, + "Description": "Vérifiez que la documentation de l'application définit comment valider la cohérence logique et contextuelle des éléments de données combinés, par exemple en vérifiant que la banlieue et le code postal correspondent.", + "L": "2" + }, + { + "Shortcode": "V2.1.3", + "Ordinal": 3, + "Description": "Vérifiez que les attentes en matière de limites et de validations de la logique métier sont documentées, y compris par utilisateur et globalement dans l'application.", + "L": "2" + } + ] + }, + { + "Shortcode": "V2.2", + "Ordinal": 2, + "Name": "Validation des entrées", + "Items": [ + { + "Shortcode": "V2.2.1", + "Ordinal": 1, + "Description": "Vérifier que les entrées sont validées afin de respecter les attentes métier ou fonctionnelles. Cette validation doit être basée sur une liste de valeurs, de modèles et de plages autorisées, ou sur la comparaison des entrées avec une structure attendue et des limites logiques selon des règles prédéfinies. Pour le niveau 1, cette validation peut se concentrer sur les entrées utilisées pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau 2, elle doit s'appliquer à toutes les entrées.", + "L": "1" + }, + { + "Shortcode": "V2.2.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application est conçue pour appliquer la validation des entrées au niveau d'une couche de service de confiance. Bien que la validation côté client améliore l'ergonomie et doit être encouragée, elle ne doit pas être considérée comme un contrôle de sécurité.", + "L": "1" + }, + { + "Shortcode": "V2.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l’application garantit que les combinaisons d’éléments de données associés sont raisonnables selon les règles prédéfinies.", + "L": "2" + } + ] + }, + { + "Shortcode": "V2.3", + "Ordinal": 3, + "Name": "Sécurité de la logique métier", + "Items": [ + { + "Shortcode": "V2.3.1", + "Ordinal": 1, + "Description": "Vérifiez que l’application traitera uniquement les flux de logique métier pour le même utilisateur dans l’ordre séquentiel attendu et sans sauter d’étapes.", + "L": "1" + }, + { + "Shortcode": "V2.3.2", + "Ordinal": 2, + "Description": "Vérifiez que les limites de la logique métier sont implémentées conformément à la documentation de l'application, afin d'éviter que des failles de la logique métier ne soient pas exploitées.", + "L": "2" + }, + { + "Shortcode": "V2.3.3", + "Ordinal": 3, + "Description": "Vérifiez que les transactions sont utilisées au niveau de la logique métier de telle sorte qu'une opération de logique métier réussisse dans son intégralité ou qu'elle soit restaurée à l'état correct précédent.", + "L": "2" + }, + { + "Shortcode": "V2.3.4", + "Ordinal": 4, + "Description": "Vérifiez que les mécanismes de verrouillage au niveau de la logique métier sont utilisés pour garantir que les ressources en quantité limitée (telles que les sièges de théâtre ou les créneaux de livraison) ne peuvent pas être réservées deux fois en manipulant la logique de l'application.", + "L": "2" + }, + { + "Shortcode": "V2.3.5", + "Ordinal": 5, + "Description": "Vérifiez que les flux logiques métier à forte valeur ajoutée nécessitent l'approbation de plusieurs utilisateurs afin d'éviter toute action non autorisée ou accidentelle. Cela peut inclure, sans s'y limiter, les transferts monétaires importants, les approbations de contrats, l'accès à des informations classifiées ou les contournements de sécurité dans le secteur manufacturier.", + "L": "3" + } + ] + }, + { + "Shortcode": "V2.4", + "Ordinal": 4, + "Name": "Anti-automatisation", + "Items": [ + { + "Shortcode": "V2.4.1", + "Ordinal": 1, + "Description": "Vérifiez que des contrôles anti-automatisation sont en place pour protéger contre les appels excessifs aux fonctions d'application qui pourraient conduire à l'exfiltration de données, à la création de données inutiles, à l'épuisement des quotas, aux violations de limites de débit, au déni de service ou à la surutilisation de ressources coûteuses.", + "L": "2" + }, + { + "Shortcode": "V2.4.2", + "Ordinal": 2, + "Description": "Vérifiez que les flux logiques métier nécessitent un timing humain réaliste, évitant ainsi des soumissions de transactions excessivement rapides.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V3", + "Ordinal": 3, + "ShortName": "Web", + "Name": "Sécurité du frontend Web", + "Items": [ + { + "Shortcode": "V3.1", + "Ordinal": 1, + "Name": "Documentation sur la sécurité du frontend Web", + "Items": [ + { + "Shortcode": "V3.1.1", + "Ordinal": 1, + "Description": "Vérifiez que la documentation de l'application indique les fonctionnalités de sécurité attendues que les navigateurs utilisant l'application doivent prendre en charge (telles que HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) et autres mécanismes de sécurité HTTP pertinents). Elle doit également définir le comportement de l'application lorsque certaines de ces fonctionnalités ne sont pas disponibles (par exemple, avertir l'utilisateur ou bloquer l'accès).", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.2", + "Ordinal": 2, + "Name": "Interprétation non intentionnelle du contenu", + "Items": [ + { + "Shortcode": "V3.2.1", + "Ordinal": 1, + "Description": "Vérifiez que des contrôles de sécurité sont en place pour empêcher les navigateurs d'afficher du contenu ou des fonctionnalités dans les réponses HTTP dans un contexte incorrect (par exemple, lorsqu'une API, un fichier téléchargé par l'utilisateur ou une autre ressource est demandée directement). Les contrôles possibles peuvent inclure : ne pas transmettre le contenu sauf si les champs d'en-tête de requête HTTP (tels que Sec-Fetch-\\*) indiquent qu'il s'agit du contexte correct, utiliser la directive sandbox du champ d'en-tête Content-Security-Policy ou utiliser le type de disposition de pièce jointe dans le champ d'en-tête Content-Disposition.", + "L": "1" + }, + { + "Shortcode": "V3.2.2", + "Ordinal": 2, + "Description": "Vérifiez que le contenu destiné à être affiché sous forme de texte, plutôt que rendu sous forme de HTML, est géré à l'aide de fonctions de rendu sécurisées (telles que createTextNode ou textContent) pour empêcher l'exécution involontaire de contenu tel que HTML ou JavaScript.", + "L": "1" + }, + { + "Shortcode": "V3.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l'application évite l'écrasement du DOM lors de l'utilisation de JavaScript côté client en utilisant des déclarations de variables explicites, en effectuant une vérification de type stricte, en évitant de stocker des variables globales sur l'objet document et en implémentant l'isolation de l'espace de nommage.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.3", + "Ordinal": 3, + "Name": "Configuration des cookies", + "Items": [ + { + "Shortcode": "V3.3.1", + "Ordinal": 1, + "Description": "Vérifiez que les cookies ont l'attribut « Secure » ​​défini et si le préfixe « \\__Host- » n'est pas utilisé pour le nom du cookie, le préfixe « __Secure- » doit être utilisé pour le nom du cookie.", + "L": "1" + }, + { + "Shortcode": "V3.3.2", + "Ordinal": 2, + "Description": "Vérifiez que la valeur de l'attribut « SameSite » de chaque cookie est définie en fonction de l'objectif du cookie, afin de limiter l'exposition aux attaques de réparation de l'interface utilisateur et aux attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).", + "L": "2" + }, + { + "Shortcode": "V3.3.3", + "Ordinal": 3, + "Description": "Vérifiez que les cookies ont le préfixe « __Host- » pour le nom du cookie, sauf s'ils sont explicitement conçus pour être partagés avec d'autres hôtes.", + "L": "2" + }, + { + "Shortcode": "V3.3.4", + "Ordinal": 4, + "Description": "Vérifiez que si la valeur d'un cookie n'est pas censée être accessible aux scripts côté client (comme un jeton de session), le cookie doit avoir l'attribut « HttpOnly » défini et la même valeur (par exemple, un jeton de session) ne doit être transférée au client que via le champ d'en-tête « Set-Cookie ».", + "L": "2" + }, + { + "Shortcode": "V3.3.5", + "Ordinal": 5, + "Description": "Vérifiez que lorsque l'application écrit un cookie, la longueur combinée du nom et de la valeur du cookie ne dépasse pas 4 096 octets. Les cookies trop volumineux ne seront pas stockés par le navigateur et ne seront donc pas envoyés avec les requêtes, empêchant ainsi l'utilisateur d'utiliser les fonctionnalités de l'application qui reposent sur ce cookie.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.4", + "Ordinal": 4, + "Name": "En-têtes du mécanisme de sécurité du navigateur", + "Items": [ + { + "Shortcode": "V3.4.1", + "Ordinal": 1, + "Description": "Vérifiez qu'un champ d'en-tête Strict-Transport-Security est inclus dans toutes les réponses afin d'appliquer une politique HTTP Strict Transport Security (HSTS). Une durée maximale d'au moins un an doit être définie, et pour les niveaux L2 et supérieurs, la politique doit également s'appliquer à tous les sous-domaines.", + "L": "1" + }, + { + "Shortcode": "V3.4.2", + "Ordinal": 2, + "Description": "Vérifiez que le champ d'en-tête Access-Control-Allow-Origin du partage de ressources cross-origine (CORS) est une valeur fixe de l'application ou, si la valeur du champ d'en-tête de requête HTTP Origin est utilisée, qu'elle est validée par rapport à une liste d'origines approuvées. Si « Access-Control-Allow-Origin: * » doit être utilisé, vérifiez que la réponse ne contient aucune information sensible.", + "L": "1" + }, + { + "Shortcode": "V3.4.3", + "Ordinal": 3, + "Description": "Vérifiez que les réponses HTTP incluent un champ d'en-tête de réponse Content-Security-Policy qui définit des directives garantissant que le navigateur charge et exécute uniquement du contenu ou des ressources fiables, afin de limiter l'exécution de JavaScript malveillant. Au minimum, une politique globale doit être utilisée, incluant les directives object-src 'none' et base-uri 'none', et définissant soit une lliste d’autorisations, soit des valeurs nonces ou des hachages. Pour une application L3, une politique par réponse avec des valeurs nonces ou des hachages doit être définie.", + "L": "2" + }, + { + "Shortcode": "V3.4.4", + "Ordinal": 4, + "Description": "Vérifiez que toutes les réponses HTTP contiennent un champ d'en-tête « X-Content-Type-Options: nosniff ». Cela indique aux navigateurs de ne pas utiliser l'analyse de contenu ni la détection du type MIME pour la réponse donnée, et d'exiger que la valeur du champ d'en-tête « Content-Type » de la réponse corresponde à la ressource de destination. Par exemple, la réponse à une demande de style n'est acceptée que si le type de contenu de la réponse est « text/css ». Cela permet également au navigateur d'utiliser la fonctionnalité de blocage de lecture inter-origines (CORB).", + "L": "2" + }, + { + "Shortcode": "V3.4.5", + "Ordinal": 5, + "Description": "Vérifiez que l'application définit une politique de référencement afin d'empêcher la fuite de données techniquement sensibles vers des services tiers via le champ d'en-tête de requête HTTP « Referer ». Cela peut être effectué via le champ d'en-tête de réponse HTTP « Referrer-Policy » ou via les attributs d'élément HTML. Les données sensibles peuvent inclure le chemin d'accès et les données de requête dans l'URL, et pour les applications internes non publiques, le nom d'hôte.", + "L": "2" + }, + { + "Shortcode": "V3.4.6", + "Ordinal": 6, + "Description": "Vérifiez que l'application Web utilise la directive frame-ancestors du champ d'en-tête Content-Security-Policy pour chaque réponse HTTP afin de garantir qu'elle ne peut pas être intégrée par défaut et que l'intégration de ressources spécifiques n'est autorisée qu'en cas de nécessité. Notez que le champ d'en-tête X-Frame-Options, bien que pris en charge par les navigateurs, est obsolète et n'est pas forcément fiable.", + "L": "2" + }, + { + "Shortcode": "V3.4.7", + "Ordinal": 7, + "Description": "Vérifiez que le champ d’en-tête Content-Security-Policy spécifie un emplacement pour signaler les violations.", + "L": "3" + }, + { + "Shortcode": "V3.4.8", + "Ordinal": 8, + "Description": "Vérifiez que toutes les réponses HTTP qui lancent le rendu d'un document (comme les réponses de type text/html) incluent le champ d'en-tête 'Cross-Origin-Opener-Policy' avec la directive 'same-origin' ou s'ame-origin-allow-popups', selon les besoins. Cela empêche les attaques abusant de l'accès partagé aux objets Window, telles que le tabnabbing et le comptage d'images.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.5", + "Ordinal": 5, + "Name": "Séparation de l'origine du navigateur", + "Items": [ + { + "Shortcode": "V3.5.1", + "Ordinal": 1, + "Description": "Vérifiez que, si l'application ne s'appuie pas sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher les requêtes inter-origines non autorisées d'utiliser des fonctionnalités sensibles, ces requêtes sont validées afin de garantir leur origine. Cela peut se faire en utilisant et en validant des jetons anti-falsification ou en exigeant des champs d'en-tête HTTP supplémentaires qui ne sont pas des champs d'en-tête de requête CORS safelist. Ceci permet de se protéger contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).", + "L": "1" + }, + { + "Shortcode": "V3.5.2", + "Ordinal": 2, + "Description": "Vérifiez que, si l'application s'appuie sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher l'utilisation inter-origines non autorisée de fonctionnalités sensibles, il est impossible d'appeler la fonctionnalité avec une requête qui ne déclenche pas de requête de pré-vérification cross-origin CORS. Cela peut nécessiter de vérifier les valeurs des champs d'en-tête de requête 'Origin' et 'Content-Type' ou d'utiliser un champ d'en-tête supplémentaire qui n'est pas un champ d'en-tête de la liste de sécurité CORS.", + "L": "1" + }, + { + "Shortcode": "V3.5.3", + "Ordinal": 3, + "Description": "Vérifiez que les requêtes HTTP destinées aux fonctionnalités sensibles utilisent des méthodes HTTP appropriées, telles que POST, PUT, PATCH ou DELETE, et non des méthodes définies comme « sûres » par la spécification HTTP, telles que HEAD, OPTIONS ou GET. Une validation stricte des champs d'en-tête de requête Sec-Fetch-* peut également être utilisée pour garantir que la requête ne provient pas d'un appel inter-origines inapproprié, d'une requête de navigation ou d'un chargement de ressources (comme une source d'image) inattendu.", + "L": "1" + }, + { + "Shortcode": "V3.5.4", + "Ordinal": 4, + "Description": "Vérifiez que des applications distinctes sont hébergées sur des noms d'hôte différents pour tirer parti des restrictions fournies par la politique de même origine, y compris la manière dont les documents ou scripts chargés par une origine peuvent interagir avec les ressources d'une autre origine et les restrictions basées sur le nom d'hôte sur les cookies.", + "L": "2" + }, + { + "Shortcode": "V3.5.5", + "Ordinal": 5, + "Description": "Vérifiez que les messages reçus par l'interface postMessage sont rejetés si l'origine du message n'est pas digne de confiance ou si la syntaxe du message n'est pas valide.", + "L": "2" + }, + { + "Shortcode": "V3.5.6", + "Ordinal": 6, + "Description": "Vérifiez que la fonctionnalité JSONP n'est activée nulle part dans l'application pour éviter les attaques Cross-Site Script Inclusion (XSSI).", + "L": "3" + }, + { + "Shortcode": "V3.5.7", + "Ordinal": 7, + "Description": "Vérifiez que les données nécessitant une autorisation ne sont pas incluses dans les réponses des ressources de script, comme les fichiers JavaScript, pour empêcher les attaques par inclusion de script intersite (XSSI).", + "L": "3" + }, + { + "Shortcode": "V3.5.8", + "Ordinal": 8, + "Description": "Vérifiez que les ressources authentifiées (telles que les images, les vidéos, les scripts et autres documents) peuvent être chargées ou intégrées pour le compte de l'utilisateur uniquement lorsque cela est prévu. Cela peut être réalisé en validant strictement les champs d'en-tête de requête HTTP Sec-Fetch-* afin de garantir que la requête ne provient pas d'un appel cross-origin inapproprié, ou en définissant un champ d'en-tête de réponse HTTP Cross-Origin-Resource-Policy restrictif pour indiquer au navigateur de bloquer le contenu renvoyé.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.6", + "Ordinal": 6, + "Name": "Intégrité des ressources externes", + "Items": [ + { + "Shortcode": "V3.6.1", + "Ordinal": 1, + "Description": "Vérifiez que les ressources côté client, telles que les bibliothèques JavaScript, les feuilles de style CSS ou les polices web, sont hébergées en externe (par exemple, sur un réseau de diffusion de contenu) uniquement si la ressource est statique et versionnée, et si l'intégrité des sous-ressources (SRI) est utilisée pour valider l'intégrité de la ressource. Si cela n'est pas possible, une décision de sécurité documentée doit justifier cette décision pour chaque ressource.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.7", + "Ordinal": 7, + "Name": "Autres considérations sur la sécurité du navigateur", + "Items": [ + { + "Shortcode": "V3.7.1", + "Ordinal": 1, + "Description": "Vérifiez que l'application utilise uniquement des technologies côté client toujours prises en charge et considérées comme sécurisées. Parmi les technologies qui ne répondent pas à cette exigence figurent les plugins NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL ou les applets Java côté client.", + "L": "2" + }, + { + "Shortcode": "V3.7.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application redirigera automatiquement l'utilisateur vers un nom d'hôte ou un domaine différent (qui n'est pas contrôlé par l'application) uniquement lorsque la destination apparaît sur une liste d'autorisation.", + "L": "2" + }, + { + "Shortcode": "V3.7.3", + "Ordinal": 3, + "Description": "Vérifiez que le domaine de premier niveau de l'application (par exemple, site.tld) ​​est ajouté à la liste de préchargement publique pour HTTP Strict Transport Security (HSTS). Cela garantit que l'utilisation de TLS pour l'application est intégrée directement dans les principaux navigateurs, plutôt que de dépendre uniquement du champ d'en-tête de réponse Strict-Transport-Security.", + "L": "3" + }, + { + "Shortcode": "V3.7.4", + "Ordinal": 4, + "Description": "Vérifiez que l'application affiche une notification lorsque l'utilisateur est redirigé vers une URL hors du contrôle de l'application, avec une option pour annuler la navigation.", + "L": "3" + }, + { + "Shortcode": "V3.7.5", + "Ordinal": 5, + "Description": "Vérifiez que l'application se comporte comme documenté (par exemple, en avertissant l'utilisateur ou en bloquant l'accès) si le navigateur utilisé pour accéder à l'application ne prend pas en charge les fonctionnalités de sécurité attendues.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V4", + "Ordinal": 4, + "ShortName": "API", + "Name": "API et service Web", + "Items": [ + { + "Shortcode": "V4.1", + "Ordinal": 1, + "Name": "Sécurité du service Web générique", + "Items": [ + { + "Shortcode": "V4.1.1", + "Ordinal": 1, + "Description": "Vérifiez que chaque réponse HTTP avec un corps de message contient un champ d'en-tête Content-Type qui correspond au contenu réel de la réponse, y compris le paramètre charset pour spécifier un codage de caractères sécurisé (par exemple, UTF-8, ISO-8859-1) conformément aux types de médias IANA, tels que « text/ », « /+xml » et « /xml ».", + "L": "1" + }, + { + "Shortcode": "V4.1.2", + "Ordinal": 2, + "Description": "Vérifiez que seuls les terminaux utilisateurs (destinés à l'accès manuel via un navigateur web) redirigent automatiquement de HTTP vers HTTPS, tandis que les autres services ou terminaux n'implémentent pas de redirections transparentes. Cela permet d'éviter qu'un client envoie par erreur des requêtes HTTP non chiffrées, mais que, comme ces requêtes sont automatiquement redirigées vers HTTPS, la fuite de données sensibles passe inaperçue.", + "L": "2" + }, + { + "Shortcode": "V4.1.3", + "Ordinal": 3, + "Description": "Vérifiez que tout champ d'en-tête HTTP utilisé par l'application et défini par une couche intermédiaire, telle qu'un équilibreur de charge, un proxy web ou un service backend-for-frontend, ne peut pas être remplacé par l'utilisateur final. Les exemples d'en-têtes peuvent inclure X-Real-IP, X-Forwarded-*, ou X-User-ID.", + "L": "2" + }, + { + "Shortcode": "V4.1.4", + "Ordinal": 4, + "Description": "Vérifiez que seules les méthodes HTTP explicitement prises en charge par l'application ou son API (y compris les OPTIONS lors des demandes de contrôle en amont) peuvent être utilisées et que les méthodes inutilisées sont bloquées.", + "L": "3" + }, + { + "Shortcode": "V4.1.5", + "Ordinal": 5, + "Description": "Vérifier que les signatures numériques par message sont utilisées pour fournir une assurance supplémentaire en plus des protections de transport pour les demandes ou les transactions qui sont très sensibles ou qui traversent un certain nombre de systèmes.", + "L": "3" + } + ] + }, + { + "Shortcode": "V4.2", + "Ordinal": 2, + "Name": "Validation de la structure des messages HTTP", + "Items": [ + { + "Shortcode": "V4.2.1", + "Ordinal": 1, + "Description": "Vérifiez que tous les composants de l'application (y compris les équilibreurs de charge, les pares-feux et les serveurs d'applications) déterminent les limites des messages HTTP entrants à l'aide du mécanisme approprié à la version HTTP afin d'empêcher la contrebande de requêtes HTTP. Dans HTTP/1.x, si un champ d'en-tête Transfer-Encoding est présent, l'en-tête Content-Length doit être ignoré conformément à la RFC 2616. Avec HTTP/2 ou HTTP/3, si un champ d'en-tête Content-Length est présent, le récepteur doit s'assurer qu'il est cohérent avec la longueur des trames DATA.", + "L": "2" + }, + { + "Shortcode": "V4.2.2", + "Ordinal": 2, + "Description": "Vérifier que, lors de la génération de messages HTTP, le champ d'en-tête Content-Length n'entre pas en conflit avec la longueur du contenu déterminée par le cadrage du protocole HTTP, afin d'empêcher les attaques de type « request smuggling ».", + "L": "3" + }, + { + "Shortcode": "V4.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l'application n'envoie ni n'accepte de messages HTTP/2 ou HTTP/3 avec des champs d'en-tête spécifiques à la connexion, tels que Transfer-Encoding, afin d'éviter les attaques par fractionnement de la réponse et par injection d'en-tête.", + "L": "3" + }, + { + "Shortcode": "V4.2.4", + "Ordinal": 4, + "Description": "Vérifiez que l'application n'accepte que les requêtes HTTP/2 et HTTP/3 dont les champs et valeurs d'en-tête ne contiennent pas de séquences CR (\\r), LF (\\n) ou CRLF (\\r\\n), afin d'éviter les attaques par injection d'en-tête.", + "L": "3" + }, + { + "Shortcode": "V4.2.5", + "Ordinal": 5, + "Description": "Vérifiez que, si l'application (backend ou frontend) construit et envoie des requêtes, elle utilise des mécanismes de validation, d'assainissement ou autres pour éviter de créer des URI (comme pour les appels API) ou des champs d'en-tête de requête HTTP (comme Authorization ou Cookie) qui sont trop longs pour être acceptés par le composant récepteur. Cela pourrait entraîner un déni de service, par exemple lors de l'envoi d'une requête trop longue (par exemple, un long champ d'en-tête de cookie), ce qui fait que le serveur répond toujours avec un statut d'erreur.", + "L": "3" + } + ] + }, + { + "Shortcode": "V4.3", + "Ordinal": 3, + "Name": "GraphQL", + "Items": [ + { + "Shortcode": "V4.3.1", + "Ordinal": 1, + "Description": "Vérifiez qu'une liste d'autorisation de requête, une limitation de profondeur, une limitation de quantité ou une analyse des coûts de requête est utilisée pour empêcher le déni de service (DoS) de GraphQL ou d'expression de la couche données en raison de requêtes imbriquées coûteuses.", + "L": "2" + }, + { + "Shortcode": "V4.3.2", + "Ordinal": 2, + "Description": "Vérifiez que les requêtes d’introspection GraphQL sont désactivées dans l’environnement de production, sauf si l’API GraphQL est destinée à être utilisée par d’autres parties.", + "L": "2" + } + ] + }, + { + "Shortcode": "V4.4", + "Ordinal": 4, + "Name": "WebSocket", + "Items": [ + { + "Shortcode": "V4.4.1", + "Ordinal": 1, + "Description": "Vérifiez que WebSocket sur TLS (WSS) est utilisé pour toutes les connexions WebSocket.", + "L": "1" + }, + { + "Shortcode": "V4.4.2", + "Ordinal": 2, + "Description": "Vérifiez que, lors de la négociation HTTP WebSocket initiale, le champ d’en-tête 'Origin' est vérifié par rapport à une liste d’origines autorisées pour l’application.", + "L": "2" + }, + { + "Shortcode": "V4.4.3", + "Ordinal": 3, + "Description": "Vérifiez que, si la gestion de session standard de l'application ne peut pas être utilisée, des jetons dédiés sont utilisés à cet effet, qui sont conformes aux exigences de sécurité de gestion de session pertinentes.", + "L": "2" + }, + { + "Shortcode": "V4.4.4", + "Ordinal": 4, + "Description": "Vérifiez que les jetons de gestion de session WebSocket dédiés sont initialement obtenus ou validés via la session HTTPS précédemment authentifiée lors de la transition d'une session HTTPS existante vers un canal WebSocket.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V5", + "Ordinal": 5, + "ShortName": "File", + "Name": "Gestion des fichiers", + "Items": [ + { + "Shortcode": "V5.1", + "Ordinal": 1, + "Name": "Documentation sur la gestion des fichiers", + "Items": [ + { + "Shortcode": "V5.1.1", + "Ordinal": 1, + "Description": "Vérifiez que la documentation définit les types de fichiers autorisés, les extensions de fichiers attendues et la taille maximale (y compris la taille décompressée) pour chaque fonctionnalité de Téléversement. De plus, assurez-vous que la documentation précise comment les fichiers sont sécurisés pour le téléchargement et le traitement des utilisateurs finaux, par exemple le comportement de l'application lorsqu'un fichier malveillant est détecté.", + "L": "2" + } + ] + }, + { + "Shortcode": "V5.2", + "Ordinal": 2, + "Name": "Téléversement de fichiers et contenu", + "Items": [ + { + "Shortcode": "V5.2.1", + "Ordinal": 1, + "Description": "Vérifiez que l'application n'acceptera que des fichiers d'une taille qu'elle peut traiter sans provoquer de perte de performances ou d'attaque par déni de service.", + "L": "1" + }, + { + "Shortcode": "V5.2.2", + "Ordinal": 2, + "Description": "Vérifiez que lorsque l'application accepte un fichier, seul ou dans une archive telle qu'un fichier zip, elle vérifie si l'extension de fichier correspond à une extension attendue et que le contenu correspond au type représenté par l'extension. Cela inclut, sans s'y limiter, la vérification des « octets magiques » initiaux, la réécriture d'images et l'utilisation de bibliothèques spécialisées pour la validation du contenu des fichiers. Pour le niveau L1, cela peut se concentrer uniquement sur les fichiers utilisés pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau L2, cela doit s'appliquer à tous les fichiers acceptés.", + "L": "1" + }, + { + "Shortcode": "V5.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l'application vérifie les fichiers compressés (par exemple, zip, gz, docx, odt) par rapport à la taille maximale autorisée non compressée et au nombre maximal de fichiers avant de décompresser le fichier.", + "L": "2" + }, + { + "Shortcode": "V5.2.4", + "Ordinal": 4, + "Description": "Vérifiez qu'un quota de taille de fichier et un nombre maximal de fichiers par utilisateur sont appliqués pour garantir qu'un seul utilisateur ne puisse pas remplir le stockage avec trop de fichiers ou des fichiers excessivement volumineux.", + "L": "3" + }, + { + "Shortcode": "V5.2.5", + "Ordinal": 5, + "Description": "Vérifiez que l'application n'autorise pas le téléversement de fichiers compressés contenant des liens symboliques, sauf si cela est spécifiquement requis (auquel cas il sera nécessaire d'appliquer une liste d'autorisation des fichiers vers lesquels il est possible de créer des liens symboliques).", + "L": "3" + }, + { + "Shortcode": "V5.2.6", + "Ordinal": 6, + "Description": "Vérifiez que l'application rejette les images téléversées avec une taille de pixel supérieure au maximum autorisé, afin d'éviter les attaques par inondation de pixels.", + "L": "3" + } + ] + }, + { + "Shortcode": "V5.3", + "Ordinal": 3, + "Name": "Stockage de fichiers", + "Items": [ + { + "Shortcode": "V5.3.1", + "Ordinal": 1, + "Description": "Vérifiez que les fichiers téléversés ou générés par une entrée non fiable et stockés dans un dossier public ne sont pas exécutés en tant que code de programme côté serveur lorsqu'ils sont accessibles directement avec une requête HTTP.", + "L": "1" + }, + { + "Shortcode": "V5.3.2", + "Ordinal": 2, + "Description": "Vérifiez que lorsque l'application crée des chemins d'accès pour les opérations sur les fichiers, elle utilise des données générées en interne ou fiables plutôt que des noms de fichiers soumis par l'utilisateur. Si des noms de fichiers ou des métadonnées de fichiers soumis par l'utilisateur doivent être utilisés, une validation et un nettoyage stricts doivent être appliqués. Ceci permet de se protéger contre les attaques par traversée de chemin, l'inclusion de fichiers locaux ou distants (LFI, RFI) et la falsification de requêtes côté serveur (SSRF).", + "L": "1" + }, + { + "Shortcode": "V5.3.3", + "Ordinal": 3, + "Description": "Vérifiez que le traitement des fichiers côté serveur, comme la décompression des fichiers, ignore les informations de chemin fournies par l'utilisateur pour éviter les vulnérabilités telles que le \"zip slip\".", + "L": "3" + } + ] + }, + { + "Shortcode": "V5.4", + "Ordinal": 4, + "Name": "Téléchargement de fichier", + "Items": [ + { + "Shortcode": "V5.4.1", + "Ordinal": 1, + "Description": "Vérifiez que l’application valide ou ignore les noms de fichiers soumis par l’utilisateur, y compris dans un paramètre JSON, JSONP ou URL et spécifie un nom de fichier dans le champ d’en-tête Content-Disposition de la réponse.", + "L": "2" + }, + { + "Shortcode": "V5.4.2", + "Ordinal": 2, + "Description": "Vérifiez que les noms de fichiers servis (par exemple, dans les champs d'en-tête de réponse HTTP ou les pièces jointes aux e-mails) sont encodés ou nettoyés (par exemple, conformément à la RFC 6266) pour préserver la structure du document et empêcher les attaques par injection.", + "L": "2" + }, + { + "Shortcode": "V5.4.3", + "Ordinal": 3, + "Description": "Vérifiez que les fichiers obtenus à partir de sources non fiables sont analysés par des scanners antivirus pour empêcher la diffusion de contenu malveillant connu.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V6", + "Ordinal": 6, + "ShortName": "Authentication", + "Name": "Authentification", + "Items": [ + { + "Shortcode": "V6.1", + "Ordinal": 1, + "Name": "Documentation d'authentification", + "Items": [ + { + "Shortcode": "V6.1.1", + "Ordinal": 1, + "Description": "Vérifiez que la documentation de l'application définit comment les contrôles, tels que la limitation de débit, l'anti-automatisation et la réponse adaptative, sont utilisés pour se défendre contre les attaques telles que le « credential stuffing » et la force brute des mots de passe. La documentation doit expliquer clairement comment ces contrôles sont configurés et empêcher le blocage malveillant des comptes.", + "L": "1" + }, + { + "Shortcode": "V6.1.2", + "Ordinal": 2, + "Description": "Vérifiez qu'une liste de mots spécifiques au contexte est documentée afin d'empêcher leur utilisation dans les mots de passe. Cette liste peut inclure des permutations de noms d'organisations, de produits, d'identifiants de systèmes, de noms de codes de projets, de noms de services ou de rôles, etc.", + "L": "2" + }, + { + "Shortcode": "V6.1.3", + "Ordinal": 3, + "Description": "Vérifiez que, si l'application inclut plusieurs voies d'authentification, celles-ci sont toutes documentées avec les contrôles de sécurité et la force d'authentification qui doivent être appliqués de manière cohérente.", + "L": "2" + } + ] + }, + { + "Shortcode": "V6.2", + "Ordinal": 2, + "Name": "Sécurité des mots de passe", + "Items": [ + { + "Shortcode": "V6.2.1", + "Ordinal": 1, + "Description": "Vérifiez que les mots de passe définis par l'utilisateur comportent au moins 8 caractères, bien qu'un minimum de 15 caractères soit fortement recommandé.", + "L": "1" + }, + { + "Shortcode": "V6.2.2", + "Ordinal": 2, + "Description": "Vérifiez que les utilisateurs peuvent modifier leur mot de passe.", + "L": "1" + }, + { + "Shortcode": "V6.2.3", + "Ordinal": 3, + "Description": "Vérifiez que la fonctionnalité de changement de mot de passe nécessite le mot de passe actuel et le nouveau mot de passe de l'utilisateur.", + "L": "1" + }, + { + "Shortcode": "V6.2.4", + "Ordinal": 4, + "Description": "Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou du changement de mot de passe sont vérifiés par rapport à un ensemble disponible d'au moins 3 000 mots de passe principaux qui correspondent à la politique de mot de passe de l'application, par exemple la longueur minimale.", + "L": "1" + }, + { + "Shortcode": "V6.2.5", + "Ordinal": 5, + "Description": "Vérifiez que les mots de passe peuvent être utilisés, quelle que soit leur composition, sans restriction quant au type de caractères autorisés. Aucun nombre minimal de majuscules ou de minuscules, de chiffres ou de caractères spéciaux ne doit être exigé.", + "L": "1" + }, + { + "Shortcode": "V6.2.6", + "Ordinal": 6, + "Description": "Vérifiez que les champs de saisie du mot de passe utilisent type=password pour masquer la saisie. Les applications peuvent permettre à l'utilisateur d'afficher temporairement l'intégralité du mot de passe masqué ou le dernier caractère saisi.", + "L": "1" + }, + { + "Shortcode": "V6.2.7", + "Ordinal": 7, + "Description": "Vérifiez que la fonctionnalité « coller », les assistants de mot de passe du navigateur et les gestionnaires de mots de passe externes sont autorisés.", + "L": "1" + }, + { + "Shortcode": "V6.2.8", + "Ordinal": 8, + "Description": "Vérifiez que l'application vérifie le mot de passe de l'utilisateur exactement tel qu'il a été reçu de l'utilisateur, sans aucune modification telle qu'une troncature ou une transformation de casse.", + "L": "1" + }, + { + "Shortcode": "V6.2.9", + "Ordinal": 9, + "Description": "Vérifiez que les mots de passe d’au moins 64 caractères sont autorisés.", + "L": "2" + }, + { + "Shortcode": "V6.2.10", + "Ordinal": 10, + "Description": "Vérifiez que le mot de passe d'un utilisateur reste valide jusqu'à ce qu'il soit découvert comme compromis ou qu'il soit renouvelé. L'application ne doit pas exiger de renouvellement périodique des identifiants.", + "L": "2" + }, + { + "Shortcode": "V6.2.11", + "Ordinal": 11, + "Description": "Vérifiez que la liste documentée de mots spécifiques au contexte est utilisée pour éviter la création de mots de passe faciles à deviner.", + "L": "2" + }, + { + "Shortcode": "V6.2.12", + "Ordinal": 12, + "Description": "Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou des modifications de mot de passe sont vérifiés par rapport à un ensemble de mots de passe fuités.", + "L": "2" + } + ] + }, + { + "Shortcode": "V6.3", + "Ordinal": 3, + "Name": "Sécurité générale de l'authentification", + "Items": [ + { + "Shortcode": "V6.3.1", + "Ordinal": 1, + "Description": "Vérifiez que les contrôles visant à empêcher les attaques telles que le bourrage d'informations d'identification et la force brute des mots de passe sont mis en œuvre conformément à la documentation de sécurité de l'application.", + "L": "1" + }, + { + "Shortcode": "V6.3.2", + "Ordinal": 2, + "Description": "Vérifiez que les comptes d’utilisateur par défaut (par exemple, « root », « admin » ou « sa ») ne sont pas présents dans l’application ou sont désactivés.", + "L": "1" + }, + { + "Shortcode": "V6.3.3", + "Ordinal": 3, + "Description": "Vérifiez que l’application exige que les utilisateurs utilisent un mécanisme d’authentification multifacteur ou une combinaison de mécanismes d’authentification à facteur unique.", + "L": "2" + }, + { + "Shortcode": "V6.3.4", + "Ordinal": 4, + "Description": "Vérifiez que, si l’application inclut plusieurs voies d’authentification, il n’existe aucune voie non documentée et que les contrôles de sécurité et la force d’authentification sont appliqués de manière cohérente.", + "L": "2" + }, + { + "Shortcode": "V6.3.5", + "Ordinal": 5, + "Description": "Vérifiez que les utilisateurs sont informés des tentatives d'authentification suspectes (réussies ou non). Il peut s'agir de tentatives d'authentification provenant d'un emplacement ou d'un client inhabituel, d'une authentification partiellement réussie (un seul facteur parmi plusieurs), d'une tentative d'authentification après une longue période d'inactivité ou d'une authentification réussie après plusieurs tentatives infructueuses.", + "L": "3" + }, + { + "Shortcode": "V6.3.6", + "Ordinal": 6, + "Description": "Vérifiez que le courrier électronique n’est pas utilisé comme mécanisme d’authentification à facteur unique ou à facteurs multiples.", + "L": "3" + }, + { + "Shortcode": "V6.3.7", + "Ordinal": 7, + "Description": "Vérifiez que les utilisateurs sont avertis après les mises à jour des détails d'authentification, telles que les réinitialisations d'informations d'identification ou la modification du nom d'utilisateur ou de l'adresse e-mail.", + "L": "3" + }, + { + "Shortcode": "V6.3.8", + "Ordinal": 8, + "Description": "Vérifiez que les utilisateurs valides ne peuvent pas être déduits d'échecs d'authentification, par exemple en se basant sur des messages d'erreur, des codes de réponse HTTP ou des temps de réponse différents. Les fonctionnalités d'inscription et de mot de passe oublié doivent également bénéficier de cette protection.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.4", + "Ordinal": 4, + "Name": "Cycle de vie et récupération du facteur d'authentification", + "Items": [ + { + "Shortcode": "V6.4.1", + "Ordinal": 1, + "Description": "Vérifiez que les mots de passe initiaux ou les codes d'activation générés par le système sont générés de manière aléatoire et sécurisée, qu'ils respectent la politique de mots de passe en vigueur et qu'ils expirent après une courte période ou après leur première utilisation. Ces secrets initiaux ne doivent pas devenir des mots de passe permanents.", + "L": "1" + }, + { + "Shortcode": "V6.4.2", + "Ordinal": 2, + "Description": "Vérifiez que les indices de mot de passe ou l'authentification basée sur les connaissances (appelées « questions secrètes ») ne sont pas présents.", + "L": "1" + }, + { + "Shortcode": "V6.4.3", + "Ordinal": 3, + "Description": "Vérifiez qu'un processus sécurisé de réinitialisation d'un mot de passe oublié est mis en œuvre, qui ne contourne aucun mécanisme d'authentification multifacteur activé.", + "L": "2" + }, + { + "Shortcode": "V6.4.4", + "Ordinal": 4, + "Description": "Vérifiez que si un facteur d'authentification multifacteur est perdu, la preuve de vérification d'identité est effectuée au même niveau que lors de l'inscription.", + "L": "2" + }, + { + "Shortcode": "V6.4.5", + "Ordinal": 5, + "Description": "Vérifiez que les instructions de renouvellement des mécanismes d'authentification qui expirent sont envoyées avec suffisamment de temps pour être exécutées avant l'expiration de l'ancien mécanisme d'authentification, en configurant des rappels automatiques si nécessaire.", + "L": "3" + }, + { + "Shortcode": "V6.4.6", + "Ordinal": 6, + "Description": "Vérifiez que les administrateurs peuvent initier la réinitialisation du mot de passe de l'utilisateur, mais que cela ne leur permet pas de modifier ou de choisir son mot de passe. Cela évite qu'ils ne connaissent le mot de passe de l'utilisateur.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.5", + "Ordinal": 5, + "Name": "Exigences générales en matière d'authentification multifacteur", + "Items": [ + { + "Shortcode": "V6.5.1", + "Ordinal": 1, + "Description": "Vérifiez que les secrets de recherche, les demandes ou codes d'authentification out-of-band et les mots de passe à usage unique basés sur le temps (TOTP) ne peuvent être utilisés avec succès qu'une seule fois.", + "L": "2" + }, + { + "Shortcode": "V6.5.2", + "Ordinal": 2, + "Description": "Vérifiez que, lors de leur stockage dans le backend de l'application, les secrets de recherche comportant moins de 112 bits d'entropie (19 caractères alphanumériques aléatoires ou 34 chiffres aléatoires) sont hachés avec un algorithme de hachage de stockage de mots de passe approuvé, intégrant un sel aléatoire de 32 bits. Une fonction de hachage standard peut être utilisée si le secret comporte 112 bits d'entropie ou plus.", + "L": "2" + }, + { + "Shortcode": "V6.5.3", + "Ordinal": 3, + "Description": "Vérifiez que les secrets de recherche, le code d'authentification out-of-band et les mots de passe à usage unique basés sur le temps sont générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) pour éviter les valeurs prévisibles.", + "L": "2" + }, + { + "Shortcode": "V6.5.4", + "Ordinal": 4, + "Description": "Vérifiez que les secrets de recherche et les codes d'authentification out-of-band ont un minimum de 20 bits d'entropie (généralement 4 caractères alphanumériques aléatoires ou 6 chiffres aléatoires suffisent).", + "L": "2" + }, + { + "Shortcode": "V6.5.5", + "Ordinal": 5, + "Description": "Vérifiez que les requêtes, codes ou jetons d'authentification out-of-band, ainsi que les mots de passe à usage unique (TOTP), ont une durée de vie définie. Les requêtes out-of-band doivent avoir une durée de vie maximale de 10 minutes et les TOTP, de 30 secondes.", + "L": "2" + }, + { + "Shortcode": "V6.5.6", + "Ordinal": 6, + "Description": "Vérifiez que tout facteur d’authentification (y compris les appareils physiques) peut être révoqué en cas de vol ou autre perte.", + "L": "3" + }, + { + "Shortcode": "V6.5.7", + "Ordinal": 7, + "Description": "Vérifiez que les mécanismes d’authentification biométrique ne sont utilisés que comme facteurs secondaires, avec quelque chose que vous possédez ou quelque chose que vous savez.", + "L": "3" + }, + { + "Shortcode": "V6.5.8", + "Ordinal": 8, + "Description": "Vérifiez que les mots de passe à usage unique basés sur le temps (TOTP) sont vérifiés en fonction d'une source temporelle provenant d'un service de confiance et non d'une heure non fiable ou fournie par le client.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.6", + "Ordinal": 6, + "Name": "Mécanismes d'authentification out-of-band", + "Items": [ + { + "Shortcode": "V6.6.1", + "Ordinal": 1, + "Description": "Vérifier que les mécanismes d'authentification utilisant le réseau téléphonique public commuté (RTPC) pour la transmission de mots de passe à usage unique (OTP) par téléphone ou SMS ne sont proposés que lorsque le numéro de téléphone a été préalablement validé. D'autres méthodes plus robustes (telles que les mots de passe à usage unique à durée déterminée) sont également proposées, et que le service informe les utilisateurs des risques de sécurité qu'elles présentent. Pour les applications de niveau 3, le téléphone et les SMS ne doivent pas être disponibles.", + "L": "2" + }, + { + "Shortcode": "V6.6.2", + "Ordinal": 2, + "Description": "Vérifiez que les demandes d’authentification out-of-band, les codes ou les jetons sont liés à la demande d’authentification d’origine pour laquelle ils ont été générés et ne sont pas utilisables pour une demande précédente ou ultérieure.", + "L": "2" + }, + { + "Shortcode": "V6.6.3", + "Ordinal": 3, + "Description": "Vérifiez qu'un mécanisme d'authentification out-of-band basé sur du code est protégé contre les attaques par force brute grâce au \"rate limiting\". Envisagez également d'utiliser un code avec au moins 64 bits d'entropie.", + "L": "2" + }, + { + "Shortcode": "V6.6.4", + "Ordinal": 4, + "Description": "Vérifiez que, lorsque les notifications push sont utilisées pour l'authentification multifacteur, le \"rate limiting\" est appliqué afin d'empêcher les attaques de type « push bombing ». La concordance des numéros peut également atténuer ce risque.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.7", + "Ordinal": 7, + "Name": "Mécanisme d'authentification cryptographique", + "Items": [ + { + "Shortcode": "V6.7.1", + "Ordinal": 1, + "Description": "Vérifiez que les certificats utilisés pour vérifier les assertions d’authentification cryptographique sont stockés de manière à les protéger contre toute modification.", + "L": "3" + }, + { + "Shortcode": "V6.7.2", + "Ordinal": 2, + "Description": "Vérifiez que le nonce de défi a une longueur d'au moins 64 bits et qu'il est statistiquement unique ou unique sur toute la durée de vie du périphérique cryptographique.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.8", + "Ordinal": 8, + "Name": "Authentification avec un fournisseur d'identité", + "Items": [ + { + "Shortcode": "V6.8.1", + "Ordinal": 1, + "Description": "Vérifiez que, si l'application prend en charge plusieurs fournisseurs d'identité (IdP), l'identité de l'utilisateur ne peut pas être usurpée via un autre fournisseur d'identité pris en charge (par exemple, en utilisant le même identifiant utilisateur). La mesure standard consisterait à ce que l'application enregistre et identifie l'utilisateur à l'aide d'une combinaison de l'ID du fournisseur d'identité (servant d'espace de noms) et de l'ID de l'utilisateur dans le fournisseur d'identité.", + "L": "2" + }, + { + "Shortcode": "V6.8.2", + "Ordinal": 2, + "Description": "Vérifiez que la présence et l'intégrité des signatures numériques sur les assertions d'authentification (par exemple sur les assertions JWT ou SAML) sont toujours validées, en rejetant toutes les assertions non signées ou ayant des signatures non valides.", + "L": "2" + }, + { + "Shortcode": "V6.8.3", + "Ordinal": 3, + "Description": "Vérifiez que les assertions SAML sont traitées de manière unique et utilisées une seule fois au cours de la période de validité pour éviter les attaques par rejeu.", + "L": "2" + }, + { + "Shortcode": "V6.8.4", + "Ordinal": 4, + "Description": "Si une application utilise un fournisseur d'identité (IdP) distinct et attend une force, des méthodes ou une date d'authentification spécifiques pour des fonctions spécifiques, vérifiez que l'application les vérifie à l'aide des informations renvoyées par l'IdP. Par exemple, si OIDC est utilisé, cela peut être réalisé en validant les affirmations de jeton d'identification telles que « acr », « amr » et « auth_time » (le cas échéant). Si l'IdP ne fournit pas ces informations, l'application doit disposer d'une approche de secours documentée qui suppose que le mécanisme d'authentification de force minimale a été utilisé (par exemple, une authentification à facteur unique avec nom d'utilisateur et mot de passe).", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V7", + "Ordinal": 7, + "ShortName": "Session", + "Name": "Gestion des sessions", + "Items": [ + { + "Shortcode": "V7.1", + "Ordinal": 1, + "Name": "Documentation sur la gestion des sessions", + "Items": [ + { + "Shortcode": "V7.1.1", + "Ordinal": 1, + "Description": "Vérifiez que le délai d'inactivité de la session de l'utilisateur et la durée de vie maximale absolue de la session sont documentés, sont appropriés en combinaison avec d'autres contrôles et que la documentation inclut une justification de tout écart par rapport aux exigences de réauthentification NIST SP 800-63B.", + "L": "2" + }, + { + "Shortcode": "V7.1.2", + "Ordinal": 2, + "Description": "Vérifiez que la documentation définit le nombre de sessions simultanées (parallèles) autorisées pour un compte ainsi que les comportements et actions prévus à entreprendre lorsque le nombre maximal de sessions actives est atteint.", + "L": "2" + }, + { + "Shortcode": "V7.1.3", + "Ordinal": 3, + "Description": "Vérifiez que tous les systèmes qui créent et gèrent des sessions utilisateur dans le cadre d'un écosystème de gestion des identités fédérées (tels que les systèmes SSO) sont documentés avec des contrôles pour coordonner la durée de vie des sessions, la résiliation et toute autre condition nécessitant une réauthentification.", + "L": "2" + } + ] + }, + { + "Shortcode": "V7.2", + "Ordinal": 2, + "Name": "Sécurité fondamentale de la gestion des sessions", + "Items": [ + { + "Shortcode": "V7.2.1", + "Ordinal": 1, + "Description": "Vérifiez que l’application effectue toutes les vérifications des jetons de session à l’aide d’un service backend de confiance.", + "L": "1" + }, + { + "Shortcode": "V7.2.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application utilise des jetons autonomes ou de référence générés dynamiquement pour la gestion des sessions, c'est-à-dire sans utiliser de secrets et de clés d'API statiques.", + "L": "1" + }, + { + "Shortcode": "V7.2.3", + "Ordinal": 3, + "Description": "Vérifiez que si des jetons par référence sont utilisés pour représenter les sessions utilisateur, ils sont uniques et générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et possèdent au moins 128 bits d'entropie.", + "L": "1" + }, + { + "Shortcode": "V7.2.4", + "Ordinal": 4, + "Description": "Vérifiez que l’application génère un nouveau jeton de session lors de l’authentification de l’utilisateur, y compris la réauthentification, et met fin au jeton de session actuel.", + "L": "1" + } + ] + }, + { + "Shortcode": "V7.3", + "Ordinal": 3, + "Name": "Délai d'expiration de la session", + "Items": [ + { + "Shortcode": "V7.3.1", + "Ordinal": 1, + "Description": "Vérifiez qu’il existe un délai d’inactivité tel que la réauthentification soit appliquée conformément à l’analyse des risques et aux décisions de sécurité documentées.", + "L": "2" + }, + { + "Shortcode": "V7.3.2", + "Ordinal": 2, + "Description": "Vérifiez qu'il existe une durée de vie maximale absolue de la session de sorte que la réauthentification soit appliquée conformément à l'analyse des risques et aux décisions de sécurité documentées.", + "L": "2" + } + ] + }, + { + "Shortcode": "V7.4", + "Ordinal": 4, + "Name": "Fin de session", + "Items": [ + { + "Shortcode": "V7.4.1", + "Ordinal": 1, + "Description": "Vérifiez que lorsque la fin de session est déclenchée (par exemple, déconnexion ou expiration), l'application interdit toute utilisation ultérieure de la session. Pour les jetons par référence ou les sessions avec état, cela implique l'invalidation des données de session au niveau du backend de l'application. Les applications utilisant des jetons autonomes nécessiteront une solution, comme la gestion d'une liste des jetons terminés, l'interdiction des jetons produits avant une date et une heure spécifique à chaque utilisateur ou la rotation d'une clé de signature spécifique à chaque utilisateur.", + "L": "1" + }, + { + "Shortcode": "V7.4.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application met fin à toutes les sessions actives lorsqu'un compte utilisateur est désactivé ou supprimé (par exemple, lorsqu'un employé quitte l'entreprise).", + "L": "1" + }, + { + "Shortcode": "V7.4.3", + "Ordinal": 3, + "Description": "Vérifiez que l'application offre la possibilité de mettre fin à toutes les autres sessions actives après une modification ou une suppression réussie de tout facteur d'authentification (y compris la modification du mot de passe via une réinitialisation ou une récupération et, le cas échéant, une mise à jour des paramètres MFA).", + "L": "2" + }, + { + "Shortcode": "V7.4.4", + "Ordinal": 4, + "Description": "Vérifiez que toutes les pages nécessitant une authentification disposent d’un accès facile et visible à la fonctionnalité de déconnexion.", + "L": "2" + }, + { + "Shortcode": "V7.4.5", + "Ordinal": 5, + "Description": "Vérifiez que les administrateurs d’applications sont en mesure de mettre fin aux sessions actives pour un utilisateur individuel ou pour tous les utilisateurs.", + "L": "2" + } + ] + }, + { + "Shortcode": "V7.5", + "Ordinal": 5, + "Name": "Défenses contre les abus de session", + "Items": [ + { + "Shortcode": "V7.5.1", + "Ordinal": 1, + "Description": "Vérifiez que l'application nécessite une réauthentification complète avant d'autoriser les modifications des attributs de compte sensibles qui peuvent affecter l'authentification, tels que l'adresse e-mail, le numéro de téléphone, la configuration MFA ou d'autres informations utilisées dans la récupération de compte.", + "L": "2" + }, + { + "Shortcode": "V7.5.2", + "Ordinal": 2, + "Description": "Vérifiez que les utilisateurs peuvent afficher et (après s'être authentifiés à nouveau avec au moins un facteur) terminer une ou toutes les sessions actuellement actives.", + "L": "2" + }, + { + "Shortcode": "V7.5.3", + "Ordinal": 3, + "Description": "Vérifiez que l’application nécessite une authentification supplémentaire avec au moins un facteur ou une vérification secondaire avant d’effectuer des transactions ou des opérations hautement sensibles.", + "L": "3" + } + ] + }, + { + "Shortcode": "V7.6", + "Ordinal": 6, + "Name": "Réauthentification fédérée", + "Items": [ + { + "Shortcode": "V7.6.1", + "Ordinal": 1, + "Description": "Vérifiez que la durée de vie et la fin de la session entre les parties de confiance (RP) et les fournisseurs d'identité (IdP) se comportent comme documenté, en exigeant une réauthentification si nécessaire, par exemple lorsque le temps maximal entre les événements d'authentification IdP est atteint.", + "L": "2" + }, + { + "Shortcode": "V7.6.2", + "Ordinal": 2, + "Description": "Vérifiez que la création d'une session nécessite soit le consentement de l'utilisateur, soit une action explicite, empêchant ainsi la création de nouvelles sessions d'application sans interaction de l'utilisateur.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V8", + "Ordinal": 8, + "ShortName": "Authorization", + "Name": "Autorisation", + "Items": [ + { + "Shortcode": "V8.1", + "Ordinal": 1, + "Name": "Documentation d'autorisation", + "Items": [ + { + "Shortcode": "V8.1.1", + "Ordinal": 1, + "Description": "Vérifiez que la documentation d’autorisation définit des règles de restriction de l’accès au niveau de la fonction et aux données en fonction des autorisations du consommateur et des attributs des ressources.", + "L": "1" + }, + { + "Shortcode": "V8.1.2", + "Ordinal": 2, + "Description": "Vérifiez que la documentation d'autorisation définit les règles de restriction d'accès au niveau des champs (lecture et écriture) en fonction des autorisations des consommateurs et des attributs des ressources. Notez que ces règles peuvent dépendre d'autres valeurs d'attributs de l'objet de données concerné, telles que l'état ou le statut.", + "L": "2" + }, + { + "Shortcode": "V8.1.3", + "Ordinal": 3, + "Description": "Vérifiez que la documentation de l'application définit les attributs environnementaux et contextuels (y compris, mais sans s'y limiter, l'heure de la journée, l'emplacement de l'utilisateur, l'adresse IP ou l'appareil) qui sont utilisés dans l'application pour prendre des décisions de sécurité, y compris celles relatives à l'authentification et à l'autorisation.", + "L": "3" + }, + { + "Shortcode": "V8.1.4", + "Ordinal": 4, + "Description": "Vérifier que la documentation d'authentification et d'autorisation définit l'utilisation des facteurs environnementaux et contextuels dans la prise de décision, en plus des autorisations au niveau des fonctions, des données et des champs. Cela doit inclure les attributs évalués, les seuils de risque et les actions entreprises (par exemple, autorisation, contestation, refus, renforcement de l'authentification).", + "L": "3" + } + ] + }, + { + "Shortcode": "V8.2", + "Ordinal": 2, + "Name": "Conception d'autorisation générale", + "Items": [ + { + "Shortcode": "V8.2.1", + "Ordinal": 1, + "Description": "Vérifiez que l’application garantit que l’accès basé sur la fonction est limité aux consommateurs disposant d’autorisations explicites.", + "L": "1" + }, + { + "Shortcode": "V8.2.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application garantit que l'accès spécifique aux données est limité aux consommateurs disposant d'autorisations explicites sur des éléments de données spécifiques afin d'atténuer les références d'objet directes non sécurisées (IDOR) et les autorisations de niveau d'objet rompues (BOLA).", + "L": "1" + }, + { + "Shortcode": "V8.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l'application garantit que l'accès au niveau du champ est limité aux consommateurs disposant d'autorisations explicites sur des champs spécifiques afin d'atténuer les problèmes d'autorisation au niveau de la propriété d'objet (BOPLA).", + "L": "2" + }, + { + "Shortcode": "V8.2.4", + "Ordinal": 4, + "Description": "Vérifiez que les contrôles de sécurité adaptatifs basés sur les attributs environnementaux et contextuels du consommateur (tels que l'heure, la localisation, l'adresse IP ou l'appareil) sont mis en œuvre pour les décisions d'authentification et d'autorisation, comme défini dans la documentation de l'application. Ces contrôles doivent être appliqués lorsque le consommateur tente de démarrer une nouvelle session et également pendant une session existante.", + "L": "3" + } + ] + }, + { + "Shortcode": "V8.3", + "Ordinal": 3, + "Name": "Autorisation par opération", + "Items": [ + { + "Shortcode": "V8.3.1", + "Ordinal": 1, + "Description": "Vérifier que l'application applique les règles d'autorisations au niveau de la couche service de confiance et ne s’appuie pas sur des contrôles qu’un consommateur non approuvé pourrait manipuler, comme JavaScript côté client.", + "L": "1" + }, + { + "Shortcode": "V8.3.2", + "Ordinal": 2, + "Description": "Vérifiez que les modifications apportées aux valeurs sur lesquelles reposent les décisions d'autorisation sont appliquées immédiatement. Lorsque les modifications ne peuvent pas être appliquées immédiatement (par exemple, en s'appuyant sur des données de jetons autonomes), des contrôles d'atténuation doivent être mis en place pour alerter un consommateur lorsqu'il effectue une action alors qu'il n'est plus autorisé à le faire et annuler la modification. Notez que cette solution alternative ne limiterait pas les fuites d'informations.", + "L": "3" + }, + { + "Shortcode": "V8.3.3", + "Ordinal": 3, + "Description": "Vérifiez que l'accès à un objet repose sur les autorisations du sujet d'origine (par exemple, le consommateur), et non sur celles d'un intermédiaire ou d'un service agissant en son nom. Par exemple, si un consommateur appelle un service web à l'aide d'un jeton d'authentification autonome, et que ce service demande ensuite des données à un autre service, ce dernier utilisera le jeton du consommateur, plutôt qu'un jeton inter-machine du premier service, pour prendre les décisions d'autorisation.", + "L": "3" + } + ] + }, + { + "Shortcode": "V8.4", + "Ordinal": 4, + "Name": "Autres considérations relatives à l'autorisation", + "Items": [ + { + "Shortcode": "V8.4.1", + "Ordinal": 1, + "Description": "Vérifiez que les applications multi-tenants utilisent des contrôles inter-tenants pour garantir que les opérations des consommateurs n'affecteront jamais les tenants avec lesquels ils ne sont pas autorisés à interagir.", + "L": "2" + }, + { + "Shortcode": "V8.4.2", + "Ordinal": 2, + "Description": "Vérifiez que l'accès aux interfaces administratives intègre plusieurs couches de sécurité, notamment la vérification continue de l'identité du consommateur, l'évaluation de la posture de sécurité des appareils et l'analyse contextuelle des risques, garantissant que l'emplacement du réseau ou les endpoints approuvés ne sont pas les seuls facteurs d'autorisation, même s'ils peuvent réduire la probabilité d'accès non autorisé.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V9", + "Ordinal": 9, + "ShortName": "Self", + "Name": "Jetons autonomes", + "Items": [ + { + "Shortcode": "V9.1", + "Ordinal": 1, + "Name": "Source et intégrité du jeton", + "Items": [ + { + "Shortcode": "V9.1.1", + "Ordinal": 1, + "Description": "Vérifiez que les jetons autonomes sont validés à l'aide de leur signature numérique ou MAC pour les protéger contre toute falsification avant d'accepter le contenu du jeton.", + "L": "1" + }, + { + "Shortcode": "V9.1.2", + "Ordinal": 2, + "Description": "Vérifiez que seuls les algorithmes d'une liste d’autorisations peuvent être utilisés pour créer et vérifier des jetons autonomes, dans un contexte donné. La liste d'autorisation doit inclure les algorithmes autorisés, idéalement symétriques ou asymétriques, et ne doit pas inclure l'algorithme « Aucun ». Si les algorithmes symétriques et asymétriques doivent être pris en charge, des contrôles supplémentaires seront nécessaires pour éviter toute confusion de clés.", + "L": "1" + }, + { + "Shortcode": "V9.1.3", + "Ordinal": 3, + "Description": "Vérifiez que les clés utilisées pour valider les jetons autonomes proviennent de sources préconfigurées et fiables pour l'émetteur du jeton, empêchant ainsi les attaquants de spécifier des sources et des clés non fiables. Pour les JWT et autres structures JWS, les en-têtes tels que « jku », « x5u » et « jwk » doivent être validés par rapport à une liste d'autorisation de sources fiables.", + "L": "1" + } + ] + }, + { + "Shortcode": "V9.2", + "Ordinal": 2, + "Name": "Contenu du jeton", + "Items": [ + { + "Shortcode": "V9.2.1", + "Ordinal": 1, + "Description": "Vérifiez que, si une période de validité est indiquée dans les données du jeton, celui-ci et son contenu ne sont acceptés que si la date de vérification est comprise dans cette période. Par exemple, pour les JWT, les déclarations « nbf » et « exp » doivent être vérifiées.", + "L": "1" + }, + { + "Shortcode": "V9.2.2", + "Ordinal": 2, + "Description": "Vérifiez que le service recevant un jeton valide le type de jeton et son utilisation avant d'en accepter le contenu. Par exemple, seuls les jetons d'accès peuvent être acceptés pour les décisions d'autorisation, et seuls les jetons d'identification peuvent être utilisés pour prouver l'authentification des utilisateurs.", + "L": "2" + }, + { + "Shortcode": "V9.2.3", + "Ordinal": 3, + "Description": "Vérifiez que le service accepte uniquement les jetons destinés à être utilisés avec ce service (audience). Pour les JWT, cela peut être réalisé en validant la déclaration « aud » par rapport à une liste d'autorisation définie dans le service.", + "L": "2" + }, + { + "Shortcode": "V9.2.4", + "Ordinal": 4, + "Description": "Si un émetteur de jetons utilise la même clé privée pour émettre des jetons destinés à différentes audiences, vérifiez que les jetons émis contiennent une restriction d'audience identifiant de manière unique les audiences visées. Cela empêchera la réutilisation d'un jeton avec une audience non prévue. Si l'identifiant d'audience est provisionné dynamiquement, l'émetteur de jetons doit valider ces audiences afin de garantir qu'elles n'entraînent pas d'usurpation d'identité.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V10", + "Ordinal": 10, + "ShortName": "OAuth", + "Name": "Oauth et OIDC", + "Items": [ + { + "Shortcode": "V10.1", + "Ordinal": 1, + "Name": "Sécurité générique OAuth et OIDC", + "Items": [ + { + "Shortcode": "V10.1.1", + "Ordinal": 1, + "Description": "Vérifiez que les jetons sont envoyés uniquement aux composants qui en ont absolument besoin. Par exemple, lors de l'utilisation d'un modèle backend-for-frontend pour les applications JavaScript basées sur un navigateur, les jetons d'accès et d'actualisation ne doivent être accessibles qu'au backend.", + "L": "2" + }, + { + "Shortcode": "V10.1.2", + "Ordinal": 2, + "Description": "Vérifiez que le client n'accepte les valeurs du serveur d'autorisation (telles que le code d'autorisation ou le jeton d'identification) que si elles résultent d'un flux d'autorisation initié par la même session d'agent utilisateur et la même transaction. Cela nécessite que les secrets générés par le client, tels que la clé de preuve pour l'échange de codes (PKCE) « code_verifier », « state » ou le nonce OIDC, ne puissent être devinés, soient spécifiques à la transaction et soient liés de manière sécurisée au client et à la session d'agent utilisateur au cours de laquelle la transaction a été initiée.", + "L": "2" + } + ] + }, + { + "Shortcode": "V10.2", + "Ordinal": 2, + "Name": "Client OAuth", + "Items": [ + { + "Shortcode": "V10.2.1", + "Ordinal": 1, + "Description": "Vérifiez que, si le flux de code est utilisé, le client OAuth dispose d'une protection contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF), qui déclenchent des demandes de jetons, soit en utilisant la fonctionnalité de clé de preuve pour l'échange de code (PKCE), soit en vérifiant le paramètre « state » envoyé dans la demande d'autorisation.", + "L": "2" + }, + { + "Shortcode": "V10.2.2", + "Ordinal": 2, + "Description": "Vérifiez que, si le client OAuth peut interagir avec plusieurs serveurs d'autorisation, il dispose d'une protection contre les attaques par confusion. Par exemple, il peut exiger que le serveur d'autorisation renvoie la valeur du paramètre « iss » et la valide dans la réponse d'autorisation et la réponse du jeton.", + "L": "2" + }, + { + "Shortcode": "V10.2.3", + "Ordinal": 3, + "Description": "Vérifiez que le client OAuth demande uniquement les portées requises (ou d’autres paramètres d’autorisation) dans les requêtes adressées au serveur d’autorisation.", + "L": "3" + } + ] + }, + { + "Shortcode": "V10.3", + "Ordinal": 3, + "Name": "Serveur de ressources OAuth", + "Items": [ + { + "Shortcode": "V10.3.1", + "Ordinal": 1, + "Description": "Vérifiez que le serveur de ressources accepte uniquement les jetons d'accès destinés à être utilisés avec ce service (audience). L'audience peut être incluse dans un jeton d'accès structuré (comme la déclaration « aud » dans JWT) ou vérifiée à l'aide du endpoint d'introspection de jeton.", + "L": "2" + }, + { + "Shortcode": "V10.3.2", + "Ordinal": 2, + "Description": "Vérifiez que le serveur de ressources applique les décisions d'autorisation en fonction des déclarations du jeton d'accès définissant l'autorisation déléguée. Si des déclarations telles que « sub », « scope » et « authorization_details » sont présentes, elles doivent être prises en compte dans la décision.", + "L": "2" + }, + { + "Shortcode": "V10.3.3", + "Ordinal": 3, + "Description": "Vérifiez que si une décision de contrôle d'accès nécessite l'identification d'un utilisateur unique à partir d'un jeton d'accès (JWT ou réponse d'introspection de jeton associé), le serveur de ressources identifie l'utilisateur à partir de déclarations non ré attribuables à d'autres utilisateurs. En général, cela implique l'utilisation d'une combinaison de déclarations « iss » et « sub ».", + "L": "2" + }, + { + "Shortcode": "V10.3.4", + "Ordinal": 4, + "Description": "Si le serveur de ressources requiert une force d'authentification, des méthodes ou une date d'expiration spécifiques, vérifiez que le jeton d'accès présenté respecte ces contraintes. Par exemple, s'il est présent, utilisez les déclarations OIDC « acr », « amr » et « auth_time » respectivement.", + "L": "2" + }, + { + "Shortcode": "V10.3.5", + "Ordinal": 5, + "Description": "Vérifiez que le serveur de ressources empêche l'utilisation de jetons d'accès volés ou la relecture de jetons d'accès (de parties non autorisées) en exigeant des jetons d'accès limités par l'expéditeur, soit Mutual TLS pour OAuth 2, soit OAuth 2 Demonstration of Proof of Possession (DPoP).", + "L": "3" + } + ] + }, + { + "Shortcode": "V10.4", + "Ordinal": 4, + "Name": "Serveur d'autorisation OAuth", + "Items": [ + { + "Shortcode": "V10.4.1", + "Ordinal": 1, + "Description": "Vérifiez que le serveur d'autorisation valide les URI de redirection en fonction d'une liste d'autorisation spécifique au client d'URI préenregistrés à l'aide d'une comparaison de chaînes exacte.", + "L": "1" + }, + { + "Shortcode": "V10.4.2", + "Ordinal": 2, + "Description": "Vérifiez que, si le serveur d'autorisation renvoie le code d'autorisation dans la réponse, celui-ci ne peut être utilisé qu'une seule fois pour une demande de jeton. Pour la deuxième demande valide avec un code d'autorisation déjà utilisé pour émettre un jeton d'accès, le serveur d'autorisation doit rejeter la demande de jeton et révoquer tous les jetons émis liés au code d'autorisation.", + "L": "1" + }, + { + "Shortcode": "V10.4.3", + "Ordinal": 3, + "Description": "Vérifiez que le code d'autorisation est de courte durée. La durée de vie maximale peut atteindre 10 minutes pour les applications L1 et L2 et 1 minute pour les applications L3.", + "L": "1" + }, + { + "Shortcode": "V10.4.4", + "Ordinal": 4, + "Description": "Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement l'utilisation des autorisations nécessaires à ce client. Notez que les autorisations « token » (flux implicite) et « password » (flux d'informations d'identification du propriétaire de la ressource) ne doivent plus être utilisées.", + "L": "1" + }, + { + "Shortcode": "V10.4.5", + "Ordinal": 5, + "Description": "Vérifiez que le serveur d'autorisation atténue les attaques par rejeu de jetons d'actualisation pour les clients publics, de préférence en utilisant des jetons d'actualisation limités par l'expéditeur, par exemple des jetons DPoP (Demonstrating Proof of Possession) ou des jetons d'accès liés à un certificat utilisant le protocole TLS mutuel (mTLS). Pour les applications L1 et L2, la rotation des jetons d'actualisation peut être utilisée. Si cette rotation est utilisée, le serveur d'autorisation doit invalider le jeton d'actualisation après utilisation et révoquer tous les jetons d'actualisation de cette autorisation si un jeton d'actualisation déjà utilisé et invalidé est fourni.", + "L": "1" + }, + { + "Shortcode": "V10.4.6", + "Ordinal": 6, + "Description": "Vérifiez que, si l'octroi de code est utilisé, le serveur d'autorisation atténue les attaques par interception de code en exigeant une clé de preuve pour l'échange de code (PKCE). Pour les demandes d'autorisation, le serveur d'autorisation doit exiger une valeur « code_challenge » valide et ne doit pas accepter une valeur « plain » pour « code_challenge_method ». Pour une demande de jeton, il doit exiger la validation du paramètre « code_verifier ».", + "L": "2" + }, + { + "Shortcode": "V10.4.7", + "Ordinal": 7, + "Description": "Vérifiez que si le serveur d'autorisation prend en charge l'enregistrement dynamique des clients non authentifiés, il réduit le risque d'applications clientes malveillantes. Il doit valider les métadonnées clientes, telles que les URI enregistrés, garantir le consentement de l'utilisateur et l'avertir avant de traiter une demande d'autorisation avec une application cliente non approuvée.", + "L": "2" + }, + { + "Shortcode": "V10.4.8", + "Ordinal": 8, + "Description": "Vérifiez que les jetons d’actualisation ont une expiration absolue, y compris si l’expiration du jeton d’actualisation glissant est appliquée.", + "L": "2" + }, + { + "Shortcode": "V10.4.9", + "Ordinal": 9, + "Description": "Vérifiez que les jetons d'actualisation et les jetons d'accès de référence peuvent être révoqués par un utilisateur autorisé à l'aide de l'interface utilisateur du serveur d'autorisation, afin d'atténuer le risque de clients malveillants ou de jetons volés.", + "L": "2" + }, + { + "Shortcode": "V10.4.10", + "Ordinal": 10, + "Description": "Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.", + "L": "2" + }, + { + "Shortcode": "V10.4.11", + "Ordinal": 11, + "Description": "Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.", + "L": "2" + }, + { + "Shortcode": "V10.4.12", + "Ordinal": 12, + "Description": "Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement la valeur « response_mode » dont ce client a besoin. Par exemple, en vérifiant cette valeur par rapport aux valeurs attendues ou en utilisant une requête d'autorisation poussée (PAR) ou une requête d'autorisation sécurisée par JWT (JAR).", + "L": "3" + }, + { + "Shortcode": "V10.4.13", + "Ordinal": 13, + "Description": "Vérifiez que le type d'Autorisation « code » est toujours utilisé avec les demandes d'autorisation poussées (PAR).", + "L": "3" + }, + { + "Shortcode": "V10.4.14", + "Ordinal": 14, + "Description": "Vérifiez que le serveur d'autorisation émet uniquement des jetons d'accès limités à l'expéditeur (preuve de possession), soit avec des jetons d'accès liés au certificat utilisant TLS mutuel (mTLS), soit avec des jetons d'accès liés au DPoP (démonstration de preuve de possession).", + "L": "3" + }, + { + "Shortcode": "V10.4.15", + "Ordinal": 15, + "Description": "Vérifiez que, pour un client côté serveur (non exécuté sur l'appareil de l'utilisateur final), le serveur d'autorisation garantit que la valeur du paramètre « authorization_details » provient du backend client et que l'utilisateur ne l'a pas altérée. Par exemple, en exigeant l'utilisation d'une demande d'autorisation poussée (PAR) ou d'une demande d'autorisation sécurisée par JWT (JAR).", + "L": "3" + }, + { + "Shortcode": "V10.4.16", + "Ordinal": 16, + "Description": "Vérifiez que le client est confidentiel et que le serveur d'autorisation requiert l'utilisation de méthodes d'authentification client fortes (basées sur la cryptographie à clé publique et résistantes aux attaques par relecture), telles que TLS mutuel ('tls_client_auth', 'self_signed_tls_client_auth') ou JWT à clé privée ('private_key_jwt').", + "L": "3" + } + ] + }, + { + "Shortcode": "V10.5", + "Ordinal": 5, + "Name": "Client OIDC", + "Items": [ + { + "Shortcode": "V10.5.1", + "Ordinal": 1, + "Description": "Vérifiez que le client (en tant que partie utilisatrice) atténue les attaques par rejeu de jeton d'identification. Par exemple, en vous assurant que la valeur « nonce » du jeton d'identification correspond à la valeur « nonce » envoyée dans la demande d'authentification au fournisseur OpenID (appelée demande d'autorisation envoyée au serveur d'autorisation dans OAuth2).", + "L": "2" + }, + { + "Shortcode": "V10.5.2", + "Ordinal": 2, + "Description": "Vérifiez que le client identifie de manière unique l'utilisateur à partir des déclarations de jeton d'identification, généralement la déclaration « sub », qui ne peut pas être réaffectée à d'autres utilisateurs (pour la portée d'un fournisseur d'identité).", + "L": "2" + }, + { + "Shortcode": "V10.5.3", + "Ordinal": 3, + "Description": "Vérifiez que le client rejette les tentatives d'un serveur d'autorisation malveillant d'usurper l'identité d'un autre serveur d'autorisation via ses métadonnées. Le client doit rejeter les métadonnées du serveur d'autorisation si l'URL de l'émetteur figurant dans ces métadonnées ne correspond pas exactement à l'URL d'émetteur préconfigurée attendue par le client.", + "L": "2" + }, + { + "Shortcode": "V10.5.4", + "Ordinal": 4, + "Description": "Vérifiez que le client valide que le jeton d'identification est destiné à être utilisé pour ce client (audience) en vérifiant que la déclaration « aud » du jeton est égale à la valeur « client_id » pour le client.", + "L": "2" + }, + { + "Shortcode": "V10.5.5", + "Ordinal": 5, + "Description": "Vérifiez que, lors de l'utilisation de la déconnexion du back-channel OIDC, la partie utilisatrice atténue les risques de déni de service liés à la déconnexion forcée et à la confusion entre JWT dans le flux de déconnexion. Le client doit vérifier que le jeton de déconnexion est correctement typé avec la valeur « logout+jwt », qu'il contient la déclaration « event » avec le nom de membre correct et qu'il ne contient pas de déclaration « nonce ». Il est également recommandé d'utiliser une expiration courte (par exemple, 2 minutes).", + "L": "2" + } + ] + }, + { + "Shortcode": "V10.6", + "Ordinal": 6, + "Name": "Fournisseur OpenID", + "Items": [ + { + "Shortcode": "V10.6.1", + "Ordinal": 1, + "Description": "Vérifiez que le fournisseur OpenID n'autorise que les valeurs « code », « ciba », « id_token » ou « id_token code » pour le mode de réponse. Notez que « code » est préférable à « id_token code » (flux hybride OIDC) et que « token » (tout flux implicite) ne doit pas être utilisé.", + "L": "2" + }, + { + "Shortcode": "V10.6.2", + "Ordinal": 2, + "Description": "Vérifiez que le fournisseur OpenID atténue les risques de déni de service liés à la déconnexion forcée. Pour ce faire, obtenez une confirmation explicite de l'utilisateur final ou, le cas échéant, validez les paramètres de la requête de déconnexion (initiée par la partie utilisatrice), comme « id_token_hint ».", + "L": "2" + } + ] + }, + { + "Shortcode": "V10.7", + "Ordinal": 7, + "Name": "Gestion du consentement", + "Items": [ + { + "Shortcode": "V10.7.1", + "Ordinal": 1, + "Description": "Vérifiez que le serveur d'autorisation garantit le consentement de l'utilisateur à chaque demande d'autorisation. Si l'identité du client ne peut être garantie, le serveur d'autorisation doit toujours demander explicitement le consentement de l'utilisateur.", + "L": "2" + }, + { + "Shortcode": "V10.7.2", + "Ordinal": 2, + "Description": "Vérifiez que lorsque le serveur d'autorisation demande le consentement de l'utilisateur, il fournit des informations claires et suffisantes sur ce qui est consenti. Le cas échéant, ces informations doivent inclure la nature des autorisations demandées (généralement en fonction de la portée, du serveur de ressources et des détails d'autorisation RAR), l'identité de l'application autorisée et la durée de vie de ces autorisations.", + "L": "2" + }, + { + "Shortcode": "V10.7.3", + "Ordinal": 3, + "Description": "Vérifiez que l’utilisateur peut consulter, modifier et révoquer les consentements qu’il a accordés via le serveur d’autorisation.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V11", + "Ordinal": 11, + "ShortName": "Cryptography", + "Name": "Cryptographie", + "Items": [ + { + "Shortcode": "V11.1", + "Ordinal": 1, + "Name": "Inventaire et documentation cryptographiques", + "Items": [ + { + "Shortcode": "V11.1.1", + "Ordinal": 1, + "Description": "Vérifiez qu’il existe une politique documentée pour la gestion des clés cryptographiques et un cycle de vie des clés cryptographiques qui suit une norme de gestion des clés telle que NIST SP 800-57. Cela devrait inclure la garantie que les clés ne sont pas sur-partagées (par exemple, avec plus de deux entités pour les secrets partagés et plus d’une entité pour les clés privées).", + "L": "2" + }, + { + "Shortcode": "V11.1.2", + "Ordinal": 2, + "Description": "Vérifiez qu'un inventaire cryptographique est réalisé, maintenu et régulièrement mis à jour, et qu'il inclut toutes les clés, algorithmes et certificats cryptographiques utilisés par l'application. Il doit également documenter les emplacements du système où les clés peuvent ou non être utilisées, ainsi que les types de données qui peuvent ou non être protégées par ces clés.", + "L": "2" + }, + { + "Shortcode": "V11.1.3", + "Ordinal": 3, + "Description": "Vérifiez que les mécanismes de découverte cryptographique sont utilisés pour identifier toutes les instances de cryptographie dans le système, y compris les opérations de chiffrement, de hachage et de signature.", + "L": "3" + }, + { + "Shortcode": "V11.1.4", + "Ordinal": 4, + "Description": "Vérifier la tenue d'un inventaire cryptographique. Celui-ci doit inclure un plan documenté décrivant la migration vers de nouvelles normes cryptographiques, telles que la cryptographie post-quantique, afin de réagir aux menaces futures.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.2", + "Ordinal": 2, + "Name": "Mise en œuvre sécurisée de la cryptographie", + "Items": [ + { + "Shortcode": "V11.2.1", + "Ordinal": 1, + "Description": "Vérifiez que les implémentations validées par l’industrie (y compris les bibliothèques et les implémentations accélérées par le matériel) sont utilisées pour les opérations cryptographiques.", + "L": "2" + }, + { + "Shortcode": "V11.2.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application est conçue avec une agilité cryptographique, de sorte que les nombres aléatoires, le chiffrement authentifié, le MAC ou les algorithmes de hachage, les longueurs de clés, les tours, les chiffrements et les modes puissent être reconfigurés, mis à niveau ou échangés à tout moment, afin de se protéger contre les failles cryptographiques. De même, il doit être possible de remplacer les clés et les mots de passe, ainsi que de rechiffrer les données. Cela permettra des mises à niveau transparentes vers la cryptographie post-quantique (PQC), une fois que des implémentations hautement sécurisées de schémas ou de normes PQC approuvés seront largement disponibles.", + "L": "2" + }, + { + "Shortcode": "V11.2.3", + "Ordinal": 3, + "Description": "Vérifiez que toutes les primitives cryptographiques utilisent un minimum de 128 bits de sécurité en fonction de l'algorithme, de la taille de la clé et de la configuration. Par exemple, une clé ECC de 256 bits offre environ 128 bits de sécurité, tandis que RSA nécessite une clé de 3072 bits pour atteindre 128 bits de sécurité.", + "L": "2" + }, + { + "Shortcode": "V11.2.4", + "Ordinal": 4, + "Description": "Vérifiez que toutes les opérations cryptographiques sont à temps constant, sans opérations de « court-circuit » dans les comparaisons, les calculs ou les retours, pour éviter toute fuite d'informations.", + "L": "3" + }, + { + "Shortcode": "V11.2.5", + "Ordinal": 5, + "Description": "Vérifiez que tous les modules cryptographiques échouent en toute sécurité et que les erreurs sont gérées de manière à ne pas permettre de vulnérabilités, telles que les attaques Padding Oracle.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.3", + "Ordinal": 3, + "Name": "Algorithmes de chiffrement", + "Items": [ + { + "Shortcode": "V11.3.1", + "Ordinal": 1, + "Description": "Vérifiez que les modes de bloc non sécurisés (par exemple, ECB) et les schémas de remplissage faibles (par exemple, PKCS#1 v1.5) ne sont pas utilisés.", + "L": "1" + }, + { + "Shortcode": "V11.3.2", + "Ordinal": 2, + "Description": "Vérifiez que seuls les chiffrements et modes approuvés tels que AES avec GCM sont utilisés.", + "L": "1" + }, + { + "Shortcode": "V11.3.3", + "Ordinal": 3, + "Description": "Vérifiez que les données chiffrées sont protégées contre toute modification non autorisée, de préférence en utilisant une méthode de chiffrement authentifiée approuvée ou en combinant une méthode de chiffrement approuvée avec un algorithme MAC approuvé.", + "L": "2" + }, + { + "Shortcode": "V11.3.4", + "Ordinal": 4, + "Description": "Vérifiez que les nonces, les vecteurs d'initialisation et autres nombres à usage unique ne sont pas utilisés pour plus d'une paire clé de chiffrement/élément de données. La méthode de génération doit être adaptée à l'algorithme utilisé.", + "L": "3" + }, + { + "Shortcode": "V11.3.5", + "Ordinal": 5, + "Description": "Vérifiez que toute combinaison d'un algorithme de chiffrement et d'un algorithme MAC fonctionne en mode chiffrement puis MAC.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.4", + "Ordinal": 4, + "Name": "Hachage et fonctions basées sur le hachage", + "Items": [ + { + "Shortcode": "V11.4.1", + "Ordinal": 1, + "Description": "Vérifiez que seules les fonctions de hachage approuvées sont utilisées pour les cas d'utilisation cryptographiques généraux, notamment les signatures numériques, HMAC, KDF et la génération de bits aléatoires. Les fonctions de hachage non autorisées, telles que MD5, ne doivent pas être utilisées à des fins cryptographiques.", + "L": "1" + }, + { + "Shortcode": "V11.4.2", + "Ordinal": 2, + "Description": "Vérifiez que les mots de passe sont stockés à l'aide d'une fonction de dérivation de clés approuvée et gourmande en ressources de calcul (également appelée « fonction de hachage de mots de passe »), dont les paramètres sont configurés conformément aux directives en vigueur. Ces paramètres doivent équilibrer sécurité et performances afin de rendre les attaques par force brute suffisamment difficiles pour le niveau de sécurité requis.", + "L": "2" + }, + { + "Shortcode": "V11.4.3", + "Ordinal": 3, + "Description": "Vérifiez que les fonctions de hachage utilisées dans les signatures numériques, dans le cadre de l'authentification ou de l'intégrité des données, sont résistantes aux collisions et possèdent des longueurs de bits appropriées. Si la résistance aux collisions est requise, la longueur de sortie doit être d'au moins 256 bits. Si seule la résistance aux attaques de seconde pré-image est requise, la longueur de sortie doit être d'au moins 128 bits.", + "L": "2" + }, + { + "Shortcode": "V11.4.4", + "Ordinal": 4, + "Description": "Vérifiez que l'application utilise des fonctions de dérivation de clés approuvées avec des paramètres d'extension de clés lors de la dérivation de clés secrètes à partir de mots de passe. Les paramètres utilisés doivent concilier sécurité et performances afin d'empêcher les attaques par force brute de compromettre la clé cryptographique obtenue.", + "L": "2" + } + ] + }, + { + "Shortcode": "V11.5", + "Ordinal": 5, + "Name": "Valeurs aléatoires", + "Items": [ + { + "Shortcode": "V11.5.1", + "Ordinal": 1, + "Description": "Vérifiez que tous les nombres et chaînes aléatoires destinés à être non devinables doivent être générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et posséder au moins 128 bits d'entropie. Notez que les UUID ne respectent pas cette condition.", + "L": "2" + }, + { + "Shortcode": "V11.5.2", + "Ordinal": 2, + "Description": "Vérifiez que le mécanisme de génération de nombres aléatoires utilisé est conçu pour fonctionner en toute sécurité, même en cas de forte demande.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.6", + "Ordinal": 6, + "Name": "Cryptographie à clé publique", + "Items": [ + { + "Shortcode": "V11.6.1", + "Ordinal": 1, + "Description": "Vérifier que seuls des algorithmes cryptographiques et des modes opératoires approuvés sont utilisés pour la génération et l'amorçage des clés, ainsi que pour la génération et la vérification des signatures numériques. Les algorithmes de génération de clés ne doivent pas générer de clés non sécurisées et vulnérables aux attaques connues, par exemple les clés RSA vulnérables à la factorisation de Fermat.", + "L": "2" + }, + { + "Shortcode": "V11.6.2", + "Ordinal": 2, + "Description": "Vérifiez que des algorithmes cryptographiques approuvés sont utilisés pour l'échange de clés (tels que Diffie-Hellman), en veillant à ce que les mécanismes d'échange de clés utilisent des paramètres sécurisés. Cela permettra d'éviter les attaques contre le processus d'établissement des clés, susceptibles de conduire à des attaques de type « adversaire du milieu » ou à des failles cryptographiques.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.7", + "Ordinal": 7, + "Name": "Cryptographie des données en cours d'utilisation", + "Items": [ + { + "Shortcode": "V11.7.1", + "Ordinal": 1, + "Description": "Vérifiez que le chiffrement complet de la mémoire est utilisé pour protéger les données sensibles pendant leur utilisation, empêchant ainsi l'accès par des utilisateurs ou des processus non autorisés.", + "L": "3" + }, + { + "Shortcode": "V11.7.2", + "Ordinal": 2, + "Description": "Vérifiez que la minimisation des données garantit que la quantité minimale de données est exposée pendant le traitement et assurez-vous que les données sont chiffrées immédiatement après utilisation ou dès que possible.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V12", + "Ordinal": 12, + "ShortName": "Secure", + "Name": "Communication sécurisée", + "Items": [ + { + "Shortcode": "V12.1", + "Ordinal": 1, + "Name": "Conseils généraux de sécurité TLS", + "Items": [ + { + "Shortcode": "V12.1.1", + "Ordinal": 1, + "Description": "Vérifiez que seules les dernières versions recommandées du protocole TLS sont activées, telles que TLS 1.2 et TLS 1.3. La dernière version du protocole TLS doit être privilégiée.", + "L": "1" + }, + { + "Shortcode": "V12.1.2", + "Ordinal": 2, + "Description": "Vérifiez que seules les suites de chiffrement recommandées sont activées, les suites de chiffrement les plus puissantes étant définies comme préférées. Les applications L3 doivent uniquement prendre en charge les suites de chiffrement assurant la confidentialité persistante (forward secrecy).", + "L": "2" + }, + { + "Shortcode": "V12.1.3", + "Ordinal": 3, + "Description": "Vérifiez que l’application valide que les certificats clients mTLS sont approuvés avant d’utiliser l’identité du certificat pour l’authentification ou l’autorisation.", + "L": "2" + }, + { + "Shortcode": "V12.1.4", + "Ordinal": 4, + "Description": "Vérifiez que la révocation de certification appropriée, telle que l'agrafage du protocole OCSP (Online Certificate Status Protocol), est activée et configurée.", + "L": "3" + }, + { + "Shortcode": "V12.1.5", + "Ordinal": 5, + "Description": "Vérifiez que Encrypted Client Hello (ECH) est activé dans les paramètres TLS de l'application pour empêcher l'exposition de métadonnées sensibles, telles que l'indication du nom du serveur (SNI), pendant les processus de négociation TLS.", + "L": "3" + } + ] + }, + { + "Shortcode": "V12.2", + "Ordinal": 2, + "Name": "Communication HTTPS avec des services externes", + "Items": [ + { + "Shortcode": "V12.2.1", + "Ordinal": 1, + "Description": "Vérifiez que TLS est utilisé pour toute connectivité entre un client et des services externes basés sur HTTP, et ne recourt pas à des communications non sécurisées ou non chiffrées.", + "L": "1" + }, + { + "Shortcode": "V12.2.2", + "Ordinal": 2, + "Description": "Vérifiez que les services externes utilisent des certificats TLS publiquement approuvés.", + "L": "1" + } + ] + }, + { + "Shortcode": "V12.3", + "Ordinal": 3, + "Name": "Sécurité des communications entre services généraux", + "Items": [ + { + "Shortcode": "V12.3.1", + "Ordinal": 1, + "Description": "Vérifiez qu'un protocole chiffré tel que TLS est utilisé pour toutes les connexions entrantes et sortantes vers et depuis l'application, y compris les systèmes de surveillance, les outils de gestion, l'accès à distance et SSH, les intergiciels, les bases de données, les mainframes, les systèmes partenaires ou les API externes. Le serveur ne doit pas recourir à des protocoles non sécurisés ou non chiffrés.", + "L": "2" + }, + { + "Shortcode": "V12.3.2", + "Ordinal": 2, + "Description": "Vérifiez que les clients TLS valident les certificats reçus avant de communiquer avec un serveur TLS.", + "L": "2" + }, + { + "Shortcode": "V12.3.3", + "Ordinal": 3, + "Description": "Vérifiez que TLS ou un autre mécanisme de chiffrement de transport approprié est utilisé pour toute connectivité entre les services internes basés sur HTTP au sein de l'application et ne se replie pas vers des communications non sécurisées ou non chiffrées.", + "L": "2" + }, + { + "Shortcode": "V12.3.4", + "Ordinal": 4, + "Description": "Vérifiez que les connexions TLS entre les services internes utilisent des certificats de confiance. Lorsque des certificats générés en interne ou auto-signés sont utilisés, le service consommateur doit être configuré pour n'approuver que des autorités de certification internes spécifiques et des certificats auto-signés spécifiques.", + "L": "2" + }, + { + "Shortcode": "V12.3.5", + "Ordinal": 5, + "Description": "Vérifiez que les services communiquant en interne au sein d'un système (communications intra-services) utilisent une authentification forte pour garantir la vérification de chaque endpoint. Des méthodes d'authentification forte, telles que l'authentification client TLS, doivent être utilisées pour garantir l'identité, en utilisant une infrastructure à clé publique et des mécanismes résistants aux attaques par rejeu. Pour les architectures de microservices, envisagez d'utiliser un maillage de services pour simplifier la gestion des certificats et renforcer la sécurité.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V13", + "Ordinal": 13, + "ShortName": "Configuration", + "Name": "Configuration", + "Items": [ + { + "Shortcode": "V13.1", + "Ordinal": 1, + "Name": "Documentation de configuration", + "Items": [ + { + "Shortcode": "V13.1.1", + "Ordinal": 1, + "Description": "Vérifiez que tous les besoins de communication de l'application sont documentés. Cela doit inclure les services externes dont l'application dépend et les cas où un utilisateur final pourrait fournir un emplacement externe auquel l'application se connectera.", + "L": "2" + }, + { + "Shortcode": "V13.1.2", + "Ordinal": 2, + "Description": "Vérifiez que pour chaque service utilisé par l'application, la documentation définit le nombre maximal de connexions simultanées (par exemple, les limites du pool de connexions) et le comportement de l'application lorsque cette limite est atteinte, y compris les mécanismes de secours ou de récupération, pour éviter les conditions de déni de service.", + "L": "3" + }, + { + "Shortcode": "V13.1.3", + "Ordinal": 3, + "Description": "Vérifiez que la documentation de l'application définit des stratégies de gestion des ressources pour chaque système ou service externe utilisé (par exemple, bases de données, descripteurs de fichiers, threads, connexions HTTP). Cela doit inclure les procédures de libération des ressources, les paramètres de délai d'expiration, la gestion des échecs et l'implémentation de la logique de nouvelle tentative, en spécifiant les limites de nouvelle tentative, les délais et les algorithmes de retour arrière. Pour les opérations de requête-réponse HTTP synchrones, la documentation doit imposer des délais d'expiration courts et soit désactiver les nouvelles tentatives, soit les limiter strictement afin d'éviter les retards en cascade et l'épuisement des ressources.", + "L": "3" + }, + { + "Shortcode": "V13.1.4", + "Ordinal": 4, + "Description": "Vérifiez que la documentation de l'application définit les secrets essentiels à la sécurité de l'application et un calendrier de rotation de ceux-ci, en fonction du modèle de menace et des exigences commerciales de l'organisation.", + "L": "3" + } + ] + }, + { + "Shortcode": "V13.2", + "Ordinal": 2, + "Name": "Configuration de la communication backend", + "Items": [ + { + "Shortcode": "V13.2.1", + "Ordinal": 1, + "Description": "Vérifiez que les communications entre les composants de l'application backend qui ne prennent pas en charge le mécanisme de session utilisateur standard de l'application, notamment les API, les intergiciels et les couches de données, sont authentifiées. L'authentification doit utiliser des comptes de service individuels, des jetons à court terme ou une authentification par certificat, et non des identifiants immuables tels que des mots de passe, des clés API ou des comptes partagés avec accès privilégié.", + "L": "2" + }, + { + "Shortcode": "V13.2.2", + "Ordinal": 2, + "Description": "Vérifiez que les communications entre les composants de l'application backend, y compris les services locaux ou du système d'exploitation, les API, les intergiciels et les couches de données, sont effectuées avec des comptes dotés des privilèges les moins nécessaires.", + "L": "2" + }, + { + "Shortcode": "V13.2.3", + "Ordinal": 3, + "Description": "Vérifiez que si des informations d’identification doivent être utilisées pour l’authentification du service, les informations d’identification utilisées par le consommateur ne sont pas des informations d’identification par défaut (par exemple, root/root ou admin/admin).", + "L": "2" + }, + { + "Shortcode": "V13.2.4", + "Ordinal": 4, + "Description": "Vérifiez qu'une liste d’autorisations est utilisée pour définir les ressources ou systèmes externes avec lesquels l'application est autorisée à communiquer (par exemple, pour les requêtes sortantes, les chargements de données ou l'accès aux fichiers). Cette liste d'autorisation peut être implémentée au niveau de la couche applicative, du serveur web, du pare-feu ou d'une combinaison de différentes couches.", + "L": "2" + }, + { + "Shortcode": "V13.2.5", + "Ordinal": 5, + "Description": "Vérifiez que le serveur Web ou d’application est configuré avec une liste autorisée de ressources ou de systèmes vers lesquels le serveur peut envoyer des requêtes ou charger des données ou des fichiers.", + "L": "2" + }, + { + "Shortcode": "V13.2.6", + "Ordinal": 6, + "Description": "Vérifiez que lorsque l'application se connecte à des services distincts, elle suit la configuration documentée pour chaque connexion, comme le nombre maximal de connexions parallèles, le comportement lorsque le nombre maximal de connexions autorisées est atteint, les délais d'expiration de connexion et les stratégies de nouvelle tentative.", + "L": "3" + } + ] + }, + { + "Shortcode": "V13.3", + "Ordinal": 3, + "Name": "Gestion des secrets", + "Items": [ + { + "Shortcode": "V13.3.1", + "Ordinal": 1, + "Description": "Vérifiez qu'une solution de gestion des secrets, telle qu'un coffre-fort de clés, est utilisée pour créer, stocker, contrôler l'accès et détruire en toute sécurité les secrets backend. Ceux-ci peuvent inclure des mots de passe, du matériel de clé, des intégrations avec des bases de données et des systèmes tiers, des clés et des graines pour des jetons temporels, d'autres secrets internes et des clés API. Les secrets ne doivent pas être inclus dans le code source de l'application ni dans les artefacts de build. Pour une application L3, cela doit impliquer une solution matérielle telle qu'un HSM.", + "L": "2" + }, + { + "Shortcode": "V13.3.2", + "Ordinal": 2, + "Description": "Vérifiez que l’accès aux ressources secrètes respecte le principe du moindre privilège.", + "L": "2" + }, + { + "Shortcode": "V13.3.3", + "Ordinal": 3, + "Description": "Vérifiez que toutes les opérations cryptographiques sont effectuées à l'aide d'un module de sécurité isolé (tel qu'un coffre-fort ou un module de sécurité matériel) pour gérer et protéger en toute sécurité le matériel clé contre toute exposition en dehors du module de sécurité.", + "L": "3" + }, + { + "Shortcode": "V13.3.4", + "Ordinal": 4, + "Description": "Vérifiez que les secrets sont configurés pour expirer et être renouvelés en fonction de la documentation de l'application.", + "L": "3" + } + ] + }, + { + "Shortcode": "V13.4", + "Ordinal": 4, + "Name": "Fuite d'informations involontaire", + "Items": [ + { + "Shortcode": "V13.4.1", + "Ordinal": 1, + "Description": "Vérifiez que l'application est déployée soit sans aucune métadonnée de contrôle de source, y compris les dossiers .git ou .svn, soit de manière à ce que ces dossiers soient inaccessibles à la fois en externe et à l'application elle-même.", + "L": "1" + }, + { + "Shortcode": "V13.4.2", + "Ordinal": 2, + "Description": "Vérifiez que les modes de débogage sont désactivés pour tous les composants dans les environnements de production afin d’éviter l’exposition des fonctionnalités de débogage et la fuite d’informations.", + "L": "2" + }, + { + "Shortcode": "V13.4.3", + "Ordinal": 3, + "Description": "Vérifiez que les serveurs Web n’exposent pas les listes de répertoires aux clients, sauf si cela est explicitement prévu.", + "L": "2" + }, + { + "Shortcode": "V13.4.4", + "Ordinal": 4, + "Description": "Vérifiez que l’utilisation de la méthode HTTP TRACE n’est pas prise en charge dans les environnements de production, afin d’éviter toute fuite d’informations potentielle.", + "L": "2" + }, + { + "Shortcode": "V13.4.5", + "Ordinal": 5, + "Description": "Vérifiez que la documentation (comme pour les API internes) et les endpoints de surveillance ne sont pas exposés, sauf si cela est explicitement prévu.", + "L": "2" + }, + { + "Shortcode": "V13.4.6", + "Ordinal": 6, + "Description": "Vérifiez que l’application n’expose pas d’informations de version détaillées des composants backend.", + "L": "3" + }, + { + "Shortcode": "V13.4.7", + "Ordinal": 7, + "Description": "Vérifiez que la couche web est configuré pour servir uniquement les fichiers avec des extensions de fichier spécifiques afin d’éviter toute fuite involontaire d’informations, de configuration et de code source.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V14", + "Ordinal": 14, + "ShortName": "Data", + "Name": "Protection des données", + "Items": [ + { + "Shortcode": "V14.1", + "Ordinal": 1, + "Name": "Documentation sur la protection des données", + "Items": [ + { + "Shortcode": "V14.1.1", + "Ordinal": 1, + "Description": "Vérifiez que toutes les données sensibles créées et traitées par l'application ont été identifiées et classées selon leur niveau de protection. Cela inclut les données uniquement codées et donc facilement déchiffrables, telles que les chaînes Base64 ou la charge utile en texte clair d'un JWT. Les niveaux de protection doivent tenir compte des réglementations et normes de protection des données et de confidentialité auxquelles l'application est tenue de se conformer.", + "L": "2" + }, + { + "Shortcode": "V14.1.2", + "Ordinal": 2, + "Description": "Vérifier que tous les niveaux de protection des données sensibles sont assortis d'un ensemble documenté d'exigences de protection. Cela doit inclure (sans s'y limiter) les exigences relatives au chiffrement général, à la vérification de l'intégrité, à la conservation, à la journalisation des données, aux contrôles d'accès aux données sensibles dans les journaux, au chiffrement au niveau de la base de données, aux technologies de confidentialité et de renforcement de la confidentialité à utiliser, ainsi qu'aux autres exigences de confidentialité.", + "L": "2" + } + ] + }, + { + "Shortcode": "V14.2", + "Ordinal": 2, + "Name": "Protection générale des données", + "Items": [ + { + "Shortcode": "V14.2.1", + "Ordinal": 1, + "Description": "Vérifiez que les données sensibles sont uniquement envoyées au serveur dans les champs de corps ou d’en-tête du message HTTP, et que l’URL et la chaîne de requête ne contiennent pas d’informations sensibles, telles qu’une clé API ou un jeton de session.", + "L": "1" + }, + { + "Shortcode": "V14.2.2", + "Ordinal": 2, + "Description": "Vérifiez que l’application empêche la mise en cache des données sensibles dans les composants du serveur, tels que les équilibreurs de charge et les caches d’application, ou garantit que les données sont purgées en toute sécurité après utilisation.", + "L": "2" + }, + { + "Shortcode": "V14.2.3", + "Ordinal": 3, + "Description": "Vérifiez que les données sensibles définies ne sont pas envoyées à des parties non fiables (par exemple, des trackers d'utilisateurs) pour empêcher la collecte indésirable de données en dehors du contrôle de l'application.", + "L": "2" + }, + { + "Shortcode": "V14.2.4", + "Ordinal": 4, + "Description": "Vérifiez que les contrôles autour des données sensibles liés au chiffrement, à la vérification de l'intégrité, à la conservation, à la manière dont les données doivent être enregistrées, aux contrôles d'accès autour des données sensibles dans les journaux, à la confidentialité et aux technologies d'amélioration de la confidentialité, sont mis en œuvre comme défini dans la documentation pour le niveau de protection des données spécifiques.", + "L": "2" + }, + { + "Shortcode": "V14.2.5", + "Ordinal": 5, + "Description": "Vérifiez que les mécanismes de mise en cache sont configurés pour ne mettre en cache que les réponses dont le type de contenu est conforme à la ressource et qui ne contiennent pas de contenu sensible et dynamique. Le serveur web doit renvoyer une réponse 404 ou 302 lors de l'accès à un fichier inexistant plutôt qu'un fichier valide différent. Cela devrait empêcher les attaques par empoisonnement de cache web.", + "L": "3" + }, + { + "Shortcode": "V14.2.6", + "Ordinal": 6, + "Description": "Vérifiez que l'application ne renvoie que les données sensibles minimales requises pour son fonctionnement. Par exemple, ne renvoyez que certains chiffres d'un numéro de carte de crédit, et non le numéro complet. Si les données complètes sont requises, elles doivent être masquées dans l'interface utilisateur, sauf si l'utilisateur les consulte spécifiquement.", + "L": "3" + }, + { + "Shortcode": "V14.2.7", + "Ordinal": 7, + "Description": "Vérifiez que les informations sensibles sont soumises à une classification de conservation des données, en veillant à ce que les données obsolètes ou inutiles soient supprimées automatiquement, selon un calendrier défini ou selon les besoins de la situation.", + "L": "3" + }, + { + "Shortcode": "V14.2.8", + "Ordinal": 8, + "Description": "Vérifiez que les informations sensibles sont supprimées des métadonnées des fichiers soumis par l'utilisateur, sauf si le stockage est autorisé par l'utilisateur.", + "L": "3" + } + ] + }, + { + "Shortcode": "V14.3", + "Ordinal": 3, + "Name": "Protection des données côté client", + "Items": [ + { + "Shortcode": "V14.3.1", + "Ordinal": 1, + "Description": "Vérifiez que les données authentifiées sont effacées du stockage client, comme le DOM du navigateur, après la fin du client ou de la session. Le champ d'en-tête de réponse HTTP « Clear-Site-Data » peut être utile, mais le côté client devrait également pouvoir effectuer la correction si la connexion au serveur n'est pas disponible à la fin de la session.", + "L": "1" + }, + { + "Shortcode": "V14.3.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application définit suffisamment de champs d'en-tête de réponse HTTP anti-caching (c'est-à-dire Cache-Control : no-store) afin que les données sensibles ne soient pas mises en cache dans les navigateurs.", + "L": "2" + }, + { + "Shortcode": "V14.3.3", + "Ordinal": 3, + "Description": "Vérifiez que les données stockées dans le stockage du navigateur (telles que localStorage, sessionStorage, IndexedDB ou les cookies) ne contiennent pas de données sensibles, à l'exception des jetons de session.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V15", + "Ordinal": 15, + "ShortName": "Secure", + "Name": "Développement et architecture sécurisés", + "Items": [ + { + "Shortcode": "V15.1", + "Ordinal": 1, + "Name": "Documentation sur le développement et l'architecture sécurisés", + "Items": [ + { + "Shortcode": "V15.1.1", + "Ordinal": 1, + "Description": "Vérifiez que la documentation de l'application définit les délais de correction basés sur les risques pour les versions de composants tiers présentant des vulnérabilités et pour la mise à jour des bibliothèques en général, afin de minimiser les risques liés à ces composants.", + "L": "1" + }, + { + "Shortcode": "V15.1.2", + "Ordinal": 2, + "Description": "Vérifiez qu'un catalogue d'inventaire, tel qu'une nomenclature logicielle (SBOM), est conservé pour toutes les bibliothèques tierces utilisées, y compris en vérifiant que les composants proviennent de référentiels prédéfinis, fiables et continuellement maintenus.", + "L": "2" + }, + { + "Shortcode": "V15.1.3", + "Ordinal": 3, + "Description": "Vérifiez que la documentation de l'application identifie les fonctionnalités consommatrices en temps ou gourmandes en ressources. Elle doit notamment indiquer comment prévenir une perte de disponibilité due à une utilisation excessive de ces fonctionnalités et éviter que la génération d'une réponse ne prenne plus de temps que le délai d'expiration du consommateur. Les mesures de protection potentielles peuvent inclure le traitement asynchrone, l'utilisation de files d'attente et la limitation des processus parallèles par utilisateur et par application.", + "L": "2" + }, + { + "Shortcode": "V15.1.4", + "Ordinal": 4, + "Description": "Vérifiez que la documentation de l’application met en évidence les bibliothèques tierces qui sont considérées comme des « composants à risque ».", + "L": "3" + }, + { + "Shortcode": "V15.1.5", + "Ordinal": 5, + "Description": "Vérifiez que la documentation de l’application met en évidence les parties de l’application où des « fonctionnalités dangereuses » sont utilisées.", + "L": "3" + } + ] + }, + { + "Shortcode": "V15.2", + "Ordinal": 2, + "Name": "Architecture de sécurité et dépendances", + "Items": [ + { + "Shortcode": "V15.2.1", + "Ordinal": 1, + "Description": "Vérifiez que l’application contient uniquement des composants qui n’ont pas dépassé les délais de mise à jour et de correction documentés.", + "L": "1" + }, + { + "Shortcode": "V15.2.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application a mis en œuvre des défenses contre la perte de disponibilité due à des fonctionnalités qui prennent du temps ou qui nécessitent des ressources, sur la base des décisions et stratégies de sécurité documentées à cet effet.", + "L": "2" + }, + { + "Shortcode": "V15.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l'environnement de production inclut uniquement les fonctionnalités nécessaires au fonctionnement de l'application et n'expose pas de fonctionnalités superflues telles que du code de test, des exemples d'extraits et des fonctionnalités de développement.", + "L": "2" + }, + { + "Shortcode": "V15.2.4", + "Ordinal": 4, + "Description": "Vérifiez que les composants tiers et toutes leurs dépendances transitives sont inclus à partir du référentiel attendu, qu'il soit détenu en interne ou qu'il s'agisse d'une source externe, et qu'il n'y a aucun risque d'attaque par confusion de dépendances.", + "L": "3" + }, + { + "Shortcode": "V15.2.5", + "Ordinal": 5, + "Description": "Vérifiez que l'application implémente des protections supplémentaires autour des parties documentées comme contenant des « fonctionnalités dangereuses » ou utilisant des bibliothèques tierces considérées comme des « composants à risque ». Cela peut inclure des techniques telles que le sandboxing, l'encapsulation, la conteneurisation ou l'isolation au niveau du réseau pour retarder et dissuader les attaquants qui compromettent une partie de l'application de se propager ailleurs.", + "L": "3" + } + ] + }, + { + "Shortcode": "V15.3", + "Ordinal": 3, + "Name": "Développement défensif", + "Items": [ + { + "Shortcode": "V15.3.1", + "Ordinal": 1, + "Description": "Vérifiez que l'application ne renvoie que le sous-ensemble requis de champs d'un objet de données. Par exemple, elle ne doit pas renvoyer un objet de données entier, car certains champs individuels ne doivent pas être accessibles aux utilisateurs.", + "L": "1" + }, + { + "Shortcode": "V15.3.2", + "Ordinal": 2, + "Description": "Vérifiez que lorsque le backend de l'application effectue des appels vers des URL externes, il est configuré pour ne pas suivre les redirections, sauf s'il s'agit d'une fonctionnalité prévue.", + "L": "2" + }, + { + "Shortcode": "V15.3.3", + "Ordinal": 3, + "Description": "Vérifiez que l'application dispose de contre-mesures pour se protéger contre les attaques d'affectation de masse en limitant les champs autorisés par contrôleur et action, par exemple, il n'est pas possible d'insérer ou de mettre à jour une valeur de champ lorsqu'elle n'était pas destinée à faire partie de cette action.", + "L": "2" + }, + { + "Shortcode": "V15.3.4", + "Ordinal": 4, + "Description": "Vérifiez que tous les composants proxy et middleware transfèrent correctement l'adresse IP d'origine de l'utilisateur à l'aide de champs de données fiables qui ne peuvent pas être manipulés par l'utilisateur final, et que l'application et le serveur Web utilisent cette valeur correcte pour la journalisation et les décisions de sécurité telles que la limitation du débit, en tenant compte du fait que même l'adresse IP d'origine peut ne pas être fiable en raison d'adresses IP dynamiques, de VPN ou de pare-feu d'entreprise.", + "L": "2" + }, + { + "Shortcode": "V15.3.5", + "Ordinal": 5, + "Description": "Vérifiez que l'application garantit explicitement que les variables sont du type correct et effectue des opérations d'égalité et de comparaison strictes. Cela permet d'éviter les vulnérabilités liées à la confusion de types, causées par des hypothèses du code de l'application sur le type d'une variable.", + "L": "2" + }, + { + "Shortcode": "V15.3.6", + "Ordinal": 6, + "Description": "Vérifiez que le code JavaScript est écrit de manière à éviter la pollution du prototype, par exemple en utilisant Set() ou Map() au lieu de littéraux d'objet.", + "L": "2" + }, + { + "Shortcode": "V15.3.7", + "Ordinal": 7, + "Description": "Vérifiez que l'application dispose de défenses contre les attaques de pollution des paramètres HTTP, en particulier si le Framework d'application ne fait aucune distinction quant à la source des paramètres de requête (chaîne de requête, paramètres de corps, cookies ou champs d'en-tête).", + "L": "2" + } + ] + }, + { + "Shortcode": "V15.4", + "Ordinal": 4, + "Name": "Concurrence sécurisée", + "Items": [ + { + "Shortcode": "V15.4.1", + "Ordinal": 1, + "Description": "Vérifiez que les objets partagés dans le code multithread (tels que les caches, les fichiers ou les objets en mémoire accessibles par plusieurs threads) sont accessibles en toute sécurité à l'aide de types thread-safe et de mécanismes de synchronisation tels que des verrous ou des sémaphores pour éviter les conditions de concurrence et la corruption des données.", + "L": "3" + }, + { + "Shortcode": "V15.4.2", + "Ordinal": 2, + "Description": "Vérifiez que les vérifications de l'état d'une ressource, comme son existence ou ses autorisations, et des actions qui en dépendent, sont effectuées en une seule opération atomique afin d'éviter les situations de concurrence entre le moment de la vérification et le moment de l'utilisation (TOCTOU). Par exemple, vérifier l'existence d'un fichier avant de l'ouvrir ou l'accès d'un utilisateur avant de l'accorder.", + "L": "3" + }, + { + "Shortcode": "V15.4.3", + "Ordinal": 3, + "Description": "Vérifiez que les verrous sont utilisés de manière cohérente pour éviter que les threads ne se bloquent, que ce soit en s'attendant les uns les autres ou en réessayant sans fin, et que la logique de verrouillage reste dans le code responsable de la gestion de la ressource pour garantir que les verrous ne peuvent pas être modifiés par inadvertance ou de manière malveillante par des classes ou du code externes.", + "L": "3" + }, + { + "Shortcode": "V15.4.4", + "Ordinal": 4, + "Description": "Vérifiez que les politiques d'allocation des ressources empêchent la saturation de threads en garantissant un accès équitable aux ressources, par exemple en exploitant les pools de threads, permettant aux threads de priorité inférieure de continuer dans un délai raisonnable.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V16", + "Ordinal": 16, + "ShortName": "Security", + "Name": "Journalisation de sécurité et gestion des erreurs", + "Items": [ + { + "Shortcode": "V16.1", + "Ordinal": 1, + "Name": "Documentation sur la journalisation de sécurité", + "Items": [ + { + "Shortcode": "V16.1.1", + "Ordinal": 1, + "Description": "Vérifiez qu'il existe un inventaire documentant la journalisation effectuée à chaque couche de la pile technologique de l'application, les événements enregistrés, les formats de journal, l'endroit où cette journalisation est stockée, la manière dont elle est utilisée, la manière dont l'accès à celle-ci est contrôlé et la durée de conservation des journaux.", + "L": "2" + } + ] + }, + { + "Shortcode": "V16.2", + "Ordinal": 2, + "Name": "Journalisation générale", + "Items": [ + { + "Shortcode": "V16.2.1", + "Ordinal": 1, + "Description": "Vérifiez que chaque entrée de journal inclut les métadonnées nécessaires (telles que quand, où, qui, quoi) qui permettraient une enquête détaillée sur la chronologie lorsqu'un événement se produit.", + "L": "2" + }, + { + "Shortcode": "V16.2.2", + "Ordinal": 2, + "Description": "Vérifiez que les sources de temps de tous les composants de journalisation sont synchronisées et que les horodatages des métadonnées des événements de sécurité utilisent le temps UTC ou incluent un décalage horaire explicite. L'UTC est recommandé pour garantir la cohérence entre les systèmes distribués et éviter toute confusion lors du passage à l'heure d'été.", + "L": "2" + }, + { + "Shortcode": "V16.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l’application stocke ou diffuse uniquement les journaux vers les fichiers et services documentés dans l’inventaire des journaux.", + "L": "2" + }, + { + "Shortcode": "V16.2.4", + "Ordinal": 4, + "Description": "Vérifiez que les journaux peuvent être lus et corrélés par le processeur de journaux utilisé, de préférence en utilisant un format de journalisation commun.", + "L": "2" + }, + { + "Shortcode": "V16.2.5", + "Ordinal": 5, + "Description": "Vérifiez que l'application applique la journalisation en fonction du niveau de protection des données lors de la journalisation de données sensibles. Par exemple, certaines données, comme les identifiants ou les informations de paiement, peuvent être interdites. D'autres données, comme les jetons de session, ne peuvent être enregistrées que par hachage ou masquage, en totalité ou en partie.", + "L": "2" + } + ] + }, + { + "Shortcode": "V16.3", + "Ordinal": 3, + "Name": "Événements de sécurité", + "Items": [ + { + "Shortcode": "V16.3.1", + "Ordinal": 1, + "Description": "Vérifiez que toutes les opérations d'authentification sont enregistrées, y compris les tentatives réussies et infructueuses. Des métadonnées supplémentaires, telles que le type d'authentification ou les facteurs utilisés, doivent également être collectées.", + "L": "2" + }, + { + "Shortcode": "V16.3.2", + "Ordinal": 2, + "Description": "Vérifier que les tentatives d'autorisation infructueuses sont logguées. Pour le niveau 3, cela doit inclure la journalisation de toutes les décisions d'autorisation, y compris lors de l'accès à des données sensibles (sans journalisation des données sensibles elles-mêmes).", + "L": "2" + }, + { + "Shortcode": "V16.3.3", + "Ordinal": 3, + "Description": "Vérifiez que l'application enregistre les événements de sécurité définis dans la documentation et enregistre également les tentatives de contournement des contrôles de sécurité, tels que la validation des entrées, la logique métier et l'anti-automatisation.", + "L": "2" + }, + { + "Shortcode": "V16.3.4", + "Ordinal": 4, + "Description": "Vérifiez que l’application enregistre les erreurs inattendues et les échecs de contrôle de sécurité tels que les échecs TLS du backend.", + "L": "2" + } + ] + }, + { + "Shortcode": "V16.4", + "Ordinal": 4, + "Name": "Protection des journaux", + "Items": [ + { + "Shortcode": "V16.4.1", + "Ordinal": 1, + "Description": "Vérifiez que tous les composants de journalisation codent correctement les données pour empêcher l’injection de journaux.", + "L": "2" + }, + { + "Shortcode": "V16.4.2", + "Ordinal": 2, + "Description": "Vérifiez que les journaux sont protégés contre tout accès non autorisé et ne peuvent pas être modifiés.", + "L": "2" + }, + { + "Shortcode": "V16.4.3", + "Ordinal": 3, + "Description": "Vérifiez que les journaux sont transmis de manière sécurisée à un système logique distinct pour analyse, détection, alerte et remontée des informations. L'objectif est de garantir qu'en cas de violation de l'application, les journaux ne seront pas compromis.", + "L": "2" + } + ] + }, + { + "Shortcode": "V16.5", + "Ordinal": 5, + "Name": "Gestion des erreurs", + "Items": [ + { + "Shortcode": "V16.5.1", + "Ordinal": 1, + "Description": "Vérifiez qu'un message générique est renvoyé au consommateur lorsqu'une erreur inattendue ou sensible à la sécurité se produit, garantissant ainsi l'absence d'exposition de données système internes sensibles telles que les traces de pile, les requêtes, les clés secrètes et les jetons.", + "L": "2" + }, + { + "Shortcode": "V16.5.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application continue de fonctionner en toute sécurité lorsque l'accès aux ressources externes échoue, par exemple, en utilisant des modèles tels que des disjoncteurs ou une dégradation progressive.", + "L": "2" + }, + { + "Shortcode": "V16.5.3", + "Ordinal": 3, + "Description": "Vérifiez que l'application échoue proprement et sécurisée, y compris lorsqu'une exception se produit, en évitant les accès en cas d'erreur telles que le traitement d'une transaction malgré les erreurs résultant de la logique de validation.", + "L": "2" + }, + { + "Shortcode": "V16.5.4", + "Ordinal": 4, + "Description": "Vérifiez qu'un gestionnaire d'erreurs de « dernier recours » est défini pour intercepter toutes les exceptions non gérées. Cela permet d'éviter la perte des informations d'erreur qui doivent être loguées dans les fichiers journaux et de garantir qu'une erreur ne paralyse pas l'ensemble du processus applicatif, entraînant une perte de disponibilité.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V17", + "Ordinal": 17, + "ShortName": "WebRTC", + "Name": "WebRTC", + "Items": [ + { + "Shortcode": "V17.1", + "Ordinal": 1, + "Name": "Serveur TURN", + "Items": [ + { + "Shortcode": "V17.1.1", + "Ordinal": 1, + "Description": "Vérifiez que le service TURN (Traversal Using Relays around NAT) autorise uniquement l'accès aux adresses IP non réservées à des fins spécifiques (par exemple, réseaux internes, diffusion, bouclage). Notez que cela s'applique aux adresses IPv4 et IPv6.", + "L": "2" + }, + { + "Shortcode": "V17.1.2", + "Ordinal": 2, + "Description": "Vérifiez que le service Traversal Using Relays around NAT (TURN) n'est pas susceptible d'épuiser ses ressources lorsque des utilisateurs légitimes tentent d'ouvrir un grand nombre de ports sur le serveur TURN.", + "L": "3" + } + ] + }, + { + "Shortcode": "V17.2", + "Ordinal": 2, + "Name": "Média", + "Items": [ + { + "Shortcode": "V17.2.1", + "Ordinal": 1, + "Description": "Vérifiez que la clé du certificat Datagram Transport Layer Security (DTLS) est gérée et protégée conformément à la politique documentée de gestion des clés cryptographiques.", + "L": "2" + }, + { + "Shortcode": "V17.2.2", + "Ordinal": 2, + "Description": "Vérifiez que le serveur multimédia est configuré pour utiliser et prendre en charge les suites de chiffrement DTLS (Datagram Transport Layer Security) approuvées et un profil de protection sécurisé pour l'extension DTLS pour l'établissement de clés pour le protocole de transport en temps réel sécurisé (DTLS-SRTP).", + "L": "2" + }, + { + "Shortcode": "V17.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l'authentification SRTP (Secure Real-time Transport Protocol) est vérifiée sur le serveur multimédia pour empêcher les attaques par injection RTP (Real-time Transport Protocol) d'entraîner une condition de déni de service ou l'insertion de médias audio ou vidéo dans les flux multimédias.", + "L": "2" + }, + { + "Shortcode": "V17.2.4", + "Ordinal": 4, + "Description": "Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant lorsqu'il rencontre des paquets SRTP (Secure Real-time Transport Protocol) mal formés.", + "L": "2" + }, + { + "Shortcode": "V17.2.5", + "Ordinal": 5, + "Description": "Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.", + "L": "3" + }, + { + "Shortcode": "V17.2.6", + "Ordinal": 6, + "Description": "Vérifiez que le serveur multimédia n'est pas sensible à la vulnérabilité de condition de concurrence « ClientHello » dans Datagram Transport Layer Security (DTLS) en vérifiant si le serveur multimédia est publiquement connu comme étant vulnérable ou en effectuant le test de condition de concurrence.", + "L": "3" + }, + { + "Shortcode": "V17.2.7", + "Ordinal": 7, + "Description": "Vérifiez que tous les mécanismes d'enregistrement audio ou vidéo associés au serveur multimédia sont en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.", + "L": "3" + }, + { + "Shortcode": "V17.2.8", + "Ordinal": 8, + "Description": "Vérifiez que le certificat Datagram Transport Layer Security (DTLS) est vérifié par rapport à l'attribut d'empreinte cryptographique du protocole de description de session (SDP), en mettant fin au flux multimédia si la vérification échoue, pour garantir l'authenticité du flux multimédia.", + "L": "3" + } + ] + }, + { + "Shortcode": "V17.3", + "Ordinal": 3, + "Name": "Signalisation", + "Items": [ + { + "Shortcode": "V17.3.1", + "Ordinal": 1, + "Description": "Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation entrants légitimes lors d'une attaque par saturation. Cela peut être réalisé en implémentant une limitation de débit au niveau de la signalisation.", + "L": "2" + }, + { + "Shortcode": "V17.3.2", + "Ordinal": 2, + "Description": "Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation légitimes en cas de message mal formé susceptible de provoquer un déni de service. Cela peut inclure la validation des entrées, la gestion sécurisée des dépassements d'entiers, la prévention des dépassements de tampon et l'utilisation d'autres techniques robustes de gestion des erreurs.", + "L": "2" + } + ] + } + ] + } + ] +} diff --git a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.csv b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.csv new file mode 100644 index 0000000000..15b13d7673 --- /dev/null +++ b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.csv @@ -0,0 +1,347 @@ +chapter_id,chapter_name,section_id,section_name,req_id,req_description,level1,level2,level3,cwe,nist +V1,Encodage et nettoyage,V1.1,Architecture d'encodage et de nettoyage,V1.1.1,"Vérifiez que l'entrée est décodée ou non échappée vers une forme canonique une seule fois, elle n'est décodée que lorsque des données codées sous cette forme sont attendues, et que cela est fait avant de traiter davantage l'entrée, par exemple, elle n'est pas effectuée après la validation ou la désinfection de l'entrée.",,✓,✓,, +V1,Encodage et nettoyage,V1.1,Architecture d'encodage et de nettoyage,V1.1.2,"Vérifiez que l'application effectue l'encodage et l'échappement de sortie soit comme étape finale avant d'être utilisée par l'interpréteur pour lequel elle est destinée, soit par l'interpréteur lui-même.",,✓,✓,, +V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.1,"Vérifiez que l'encodage de sortie d'une réponse HTTP, d'un document HTML ou d'un document XML est pertinent pour le contexte requis, comme l'encodage des caractères pertinents pour les éléments HTML, les attributs HTML, les commentaires HTML, les CSS ou les champs d'en-tête HTTP, pour éviter de modifier la structure du message ou du document.",✓,✓,✓,, +V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.2,"Vérifiez que, lors de la création dynamique d'URL, les données non fiables sont encodées en fonction de leur contexte (par exemple, encodage d'URL ou encodage base64url pour les paramètres de requête ou de chemin). Assurez-vous que seuls les schémas d'URL sûrs sont autorisés (par exemple, interdire javascript: ou data:).",✓,✓,✓,, +V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.3,"Vérifiez que l'encodage ou l'échappement de sortie est utilisé lors de la création dynamique de contenu JavaScript (y compris JSON), pour éviter de modifier la structure du message ou du document (pour éviter l'injection JavaScript et JSON).",✓,✓,✓,, +V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.4,"Vérifiez que la sélection de données ou les requêtes de base de données (par exemple, SQL, HQL, NoSQL, Cypher) utilisent des requêtes paramétrées, des ORM, des Framework d'entités ou sont protégées contre les injections SQL et autres attaques par injection de base de données. Ceci est également pertinent lors de l'écriture de procédures stockées.",✓,✓,✓,, +V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.5,Vérifiez que l’application protège contre l’injection de commandes du système d’exploitation et que les appels du système d’exploitation utilisent des requêtes du système d’exploitation paramétrées ou utilisent un encodage de sortie de ligne de commande contextuelle.,✓,✓,✓,, +V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.6,Vérifiez que l’application protège contre les vulnérabilités d’injection LDAP ou que des contrôles de sécurité spécifiques pour empêcher l’injection LDAP ont été mis en œuvre.,,✓,✓,, +V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.7,Vérifiez que l’application est protégée contre les attaques par injection XPath en utilisant la paramétrisation des requêtes ou des requêtes précompilées.,,✓,✓,, +V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.8,"Vérifiez que les processeurs LaTeX sont configurés de manière sécurisée (par exemple, en n'utilisant pas l'indicateur « --shell-escape ») et qu'une liste d’autorisations de commandes est utilisée pour empêcher les attaques par injection LaTeX.",,✓,✓,, +V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.9,Vérifiez que l'application échappe les caractères spéciaux dans les expressions régulières (généralement à l'aide d'une barre oblique inverse) pour éviter qu'ils ne soient mal interprétés comme des métacaractères.,,✓,✓,, +V1,Encodage et nettoyage,V1.2,Prévention des injections,V1.2.10,"Vérifiez que l'application est protégée contre les injections CSV et injections de formules. L'application doit respecter les règles d'échappement définies dans les sections 2.6 et 2.7 de la RFC 4180 lors de l'export de contenu CSV. De plus, lors de l'export au format CSV ou vers d'autres formats de tableur (tels que XLS, XLSX ou ODF), les caractères spéciaux (notamment « = », « + », « - », « @ », « \t » (tabulation) et « \0 » (caractère null)) doivent être protégés par une apostrophe s'ils apparaissent en premier dans une valeur de champ.",,,✓,, +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.1,Vérifiez que toutes les entrées HTML non fiables provenant d'éditeurs WYSIWYG ou similaires sont nettoyées à l'aide d'une bibliothèque ou d'une fonctionnalité de Framework de nettoyage HTML bien connue et sécurisée.,✓,✓,✓,, +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.2,"Vérifiez que l'application évite d'utiliser eval() ou d'autres fonctionnalités d'exécution de code dynamique telles que Spring Expression Language (SpEL). En l'absence d'alternative, toute saisie utilisateur incluse doit être nettoyée avant d'être exécutée.",✓,✓,✓,, +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.3,"Vérifiez que les données transmises à un contexte potentiellement dangereux sont préalablement nettoyées pour appliquer des mesures de sécurité, telles qu'autoriser uniquement des caractères sûrs pour ce contexte et raccourcir des entrées trop longues.",,✓,✓,, +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.4,"Vérifiez que le contenu Scalable Vector Graphics (SVG) scriptable fourni par l'utilisateur est validé ou nettoyé pour contenir uniquement des balises et des attributs (tels que des graphiques de dessin) qui sont sûrs pour l'application, par exemple, ne contiennent pas de scripts et d'objets étrangers.",,✓,✓,, +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.5,"Vérifiez que l'application nettoie ou désactive le contenu du langage de modèle d'expression ou de script fourni par l'utilisateur, tel que les feuilles de style CSS, le Markdown ou XSL, BBCode ou similaire.",,✓,✓,, +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.6,"Vérifiez que l'application protège contre les attaques de falsification de requête côté serveur (SSRF), en validant les données non fiables par rapport à une liste d'autorisation de protocoles, de domaines, de chemins et de ports et en nettoyant les caractères potentiellement dangereux avant d'utiliser les données pour appeler un autre service.",,✓,✓,, +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.7,"Vérifiez que l'application se protège contre les attaques par injection de modèles en interdisant la création de modèles basés sur des entrées non fiables. En l'absence d'alternative, toute entrée non fiable incluse dynamiquement lors de la création du modèle doit être nettoyée ou rigoureusement validée.",,✓,✓,, +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.8,Vérifiez que l’application nettoie correctement les entrées non fiables avant utilisation dans les requêtes Java Naming and Directory Interface (JNDI) et que JNDI est configuré de manière sécurisée pour empêcher les attaques par injection JNDI.,,✓,✓,, +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.9,Vérifiez que l’application nettoie le contenu avant qu’il ne soit envoyé à memcache pour éviter les attaques par injection.,,✓,✓,, +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.10,Vérifiez que les chaînes de format susceptibles d'être résolues de manière inattendue ou malveillante lors de leur utilisation sont nettoyées avant d'être traitées.,,✓,✓,, +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.11,Vérifiez que l'application nettoie les entrées utilisateur avant de les transmettre aux systèmes de messagerie pour se protéger contre l'injection SMTP ou IMAP.,,✓,✓,, +V1,Encodage et nettoyage,V1.3,Nettoyage,V1.3.12,"Vérifiez que les expressions régulières sont exemptes d'éléments provoquant ""backtracking"" exponentiel et assurez-vous que les entrées non fiables sont nettoyées pour atténuer les attaques ReDoS ou Runaway Regex.",,,✓,, +V1,Encodage et nettoyage,V1.4,"Mémoire, chaine de caractères et code à mémoire non-managée",V1.4.1,"Vérifiez que l'application utilise des chaînes memory-safe, une copie de mémoire et une arithmétique de pointeur renforcée pour détecter ou empêcher les débordements de pile, de tampon ou de tas.",,✓,✓,, +V1,Encodage et nettoyage,V1.4,"Mémoire, chaine de caractères et code à mémoire non-managée",V1.4.2,"Vérifiez que les techniques de validation du signe, de la plage et de l’entrée sont utilisées pour éviter les dépassements d’entiers.",,✓,✓,, +V1,Encodage et nettoyage,V1.4,"Mémoire, chaine de caractères et code à mémoire non-managée",V1.4.3,"Vérifiez que la mémoire et les ressources allouées dynamiquement sont libérées et que les références ou les pointeurs vers la mémoire libérée sont supprimés ou définis à null pour éviter les ""dangling pointer"" et les vulnérabilités d'utilisation après libération.",,✓,✓,, +V1,Encodage et nettoyage,V1.5,Désérialisation sécurisée,V1.5.1,"Vérifiez que l'application configure les ""parser"" XML pour utiliser une configuration restrictive et que les fonctionnalités non sûres telles que la résolution d'entités externes sont désactivées pour empêcher les attaques XML eXternal Entity (XXE).",✓,✓,✓,, +V1,Encodage et nettoyage,V1.5,Désérialisation sécurisée,V1.5.2,"Vérifiez que la désérialisation des données non fiables garantit une gestion sécurisée des entrées, par exemple en utilisant une liste d'autorisation de types d'objets ou en limitant les types d'objets définis par le client, afin d'empêcher les attaques par désérialisation. Les mécanismes de désérialisation explicitement définis comme non sécurisés ne doivent pas être utilisés avec des entrées non fiables.",,✓,✓,, +V1,Encodage et nettoyage,V1.5,Désérialisation sécurisée,V1.5.3,"Vérifiez que les différents ""parser"" utilisés dans l'application pour le même type de données (par exemple, les ""parser"" JSON, les ""parser"" XML, les ""parser"" d'URL) effectuent l'analyse de manière cohérente et utilisent le même mécanisme d'encodage de caractères pour éviter des problèmes tels que les vulnérabilités d'interopérabilité JSON ou un comportement d'analyse d'URI ou de fichier différent exploité dans les attaques d'inclusion de fichiers à distance (RFI) ou de falsification de requête côté serveur (SSRF).",,,✓,, +V2,Validation et logique métier,V2.1,Validation et documentation de la logique métier,V2.1.1,"Vérifiez que la documentation de l'application définit des règles de validation des entrées pour vérifier la validité des éléments de données par rapport à la structure attendue. Il peut s'agir de formats de données courants tels que des numéros de carte de crédit, des adresses e-mail ou des numéros de téléphone, ou d'un format de données interne.",✓,✓,✓,, +V2,Validation et logique métier,V2.1,Validation et documentation de la logique métier,V2.1.2,"Vérifiez que la documentation de l'application définit comment valider la cohérence logique et contextuelle des éléments de données combinés, par exemple en vérifiant que la banlieue et le code postal correspondent.",,✓,✓,, +V2,Validation et logique métier,V2.1,Validation et documentation de la logique métier,V2.1.3,"Vérifiez que les attentes en matière de limites et de validations de la logique métier sont documentées, y compris par utilisateur et globalement dans l'application.",,✓,✓,, +V2,Validation et logique métier,V2.2,Validation des entrées,V2.2.1,"Vérifier que les entrées sont validées afin de respecter les attentes métier ou fonctionnelles. Cette validation doit être basée sur une liste de valeurs, de modèles et de plages autorisées, ou sur la comparaison des entrées avec une structure attendue et des limites logiques selon des règles prédéfinies. Pour le niveau 1, cette validation peut se concentrer sur les entrées utilisées pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau 2, elle doit s'appliquer à toutes les entrées.",✓,✓,✓,, +V2,Validation et logique métier,V2.2,Validation des entrées,V2.2.2,"Vérifiez que l'application est conçue pour appliquer la validation des entrées au niveau d'une couche de service de confiance. Bien que la validation côté client améliore l'ergonomie et doit être encouragée, elle ne doit pas être considérée comme un contrôle de sécurité.",✓,✓,✓,, +V2,Validation et logique métier,V2.2,Validation des entrées,V2.2.3,Vérifiez que l’application garantit que les combinaisons d’éléments de données associés sont raisonnables selon les règles prédéfinies.,,✓,✓,, +V2,Validation et logique métier,V2.3,Sécurité de la logique métier,V2.3.1,Vérifiez que l’application traitera uniquement les flux de logique métier pour le même utilisateur dans l’ordre séquentiel attendu et sans sauter d’étapes.,✓,✓,✓,, +V2,Validation et logique métier,V2.3,Sécurité de la logique métier,V2.3.2,"Vérifiez que les limites de la logique métier sont implémentées conformément à la documentation de l'application, afin d'éviter que des failles de la logique métier ne soient pas exploitées.",,✓,✓,, +V2,Validation et logique métier,V2.3,Sécurité de la logique métier,V2.3.3,Vérifiez que les transactions sont utilisées au niveau de la logique métier de telle sorte qu'une opération de logique métier réussisse dans son intégralité ou qu'elle soit restaurée à l'état correct précédent.,,✓,✓,, +V2,Validation et logique métier,V2.3,Sécurité de la logique métier,V2.3.4,Vérifiez que les mécanismes de verrouillage au niveau de la logique métier sont utilisés pour garantir que les ressources en quantité limitée (telles que les sièges de théâtre ou les créneaux de livraison) ne peuvent pas être réservées deux fois en manipulant la logique de l'application.,,✓,✓,, +V2,Validation et logique métier,V2.3,Sécurité de la logique métier,V2.3.5,"Vérifiez que les flux logiques métier à forte valeur ajoutée nécessitent l'approbation de plusieurs utilisateurs afin d'éviter toute action non autorisée ou accidentelle. Cela peut inclure, sans s'y limiter, les transferts monétaires importants, les approbations de contrats, l'accès à des informations classifiées ou les contournements de sécurité dans le secteur manufacturier.",,,✓,, +V2,Validation et logique métier,V2.4,Anti-automatisation,V2.4.1,"Vérifiez que des contrôles anti-automatisation sont en place pour protéger contre les appels excessifs aux fonctions d'application qui pourraient conduire à l'exfiltration de données, à la création de données inutiles, à l'épuisement des quotas, aux violations de limites de débit, au déni de service ou à la surutilisation de ressources coûteuses.",,✓,✓,, +V2,Validation et logique métier,V2.4,Anti-automatisation,V2.4.2,"Vérifiez que les flux logiques métier nécessitent un timing humain réaliste, évitant ainsi des soumissions de transactions excessivement rapides.",,,✓,, +V3,Sécurité du frontend Web,V3.1,Documentation sur la sécurité du frontend Web,V3.1.1,"Vérifiez que la documentation de l'application indique les fonctionnalités de sécurité attendues que les navigateurs utilisant l'application doivent prendre en charge (telles que HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) et autres mécanismes de sécurité HTTP pertinents). Elle doit également définir le comportement de l'application lorsque certaines de ces fonctionnalités ne sont pas disponibles (par exemple, avertir l'utilisateur ou bloquer l'accès).",,,✓,, +V3,Sécurité du frontend Web,V3.2,Interprétation non intentionnelle du contenu,V3.2.1,"Vérifiez que des contrôles de sécurité sont en place pour empêcher les navigateurs d'afficher du contenu ou des fonctionnalités dans les réponses HTTP dans un contexte incorrect (par exemple, lorsqu'une API, un fichier téléchargé par l'utilisateur ou une autre ressource est demandée directement). Les contrôles possibles peuvent inclure : ne pas transmettre le contenu sauf si les champs d'en-tête de requête HTTP (tels que Sec-Fetch-\*) indiquent qu'il s'agit du contexte correct, utiliser la directive sandbox du champ d'en-tête Content-Security-Policy ou utiliser le type de disposition de pièce jointe dans le champ d'en-tête Content-Disposition.",✓,✓,✓,, +V3,Sécurité du frontend Web,V3.2,Interprétation non intentionnelle du contenu,V3.2.2,"Vérifiez que le contenu destiné à être affiché sous forme de texte, plutôt que rendu sous forme de HTML, est géré à l'aide de fonctions de rendu sécurisées (telles que createTextNode ou textContent) pour empêcher l'exécution involontaire de contenu tel que HTML ou JavaScript.",✓,✓,✓,, +V3,Sécurité du frontend Web,V3.2,Interprétation non intentionnelle du contenu,V3.2.3,"Vérifiez que l'application évite l'écrasement du DOM lors de l'utilisation de JavaScript côté client en utilisant des déclarations de variables explicites, en effectuant une vérification de type stricte, en évitant de stocker des variables globales sur l'objet document et en implémentant l'isolation de l'espace de nommage.",,,✓,, +V3,Sécurité du frontend Web,V3.3,Configuration des cookies,V3.3.1,"Vérifiez que les cookies ont l'attribut « Secure » ​​défini et si le préfixe « \__Host- » n'est pas utilisé pour le nom du cookie, le préfixe « __Secure- » doit être utilisé pour le nom du cookie.",✓,✓,✓,, +V3,Sécurité du frontend Web,V3.3,Configuration des cookies,V3.3.2,"Vérifiez que la valeur de l'attribut « SameSite » de chaque cookie est définie en fonction de l'objectif du cookie, afin de limiter l'exposition aux attaques de réparation de l'interface utilisateur et aux attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).",,✓,✓,, +V3,Sécurité du frontend Web,V3.3,Configuration des cookies,V3.3.3,"Vérifiez que les cookies ont le préfixe « __Host- » pour le nom du cookie, sauf s'ils sont explicitement conçus pour être partagés avec d'autres hôtes.",,✓,✓,, +V3,Sécurité du frontend Web,V3.3,Configuration des cookies,V3.3.4,"Vérifiez que si la valeur d'un cookie n'est pas censée être accessible aux scripts côté client (comme un jeton de session), le cookie doit avoir l'attribut « HttpOnly » défini et la même valeur (par exemple, un jeton de session) ne doit être transférée au client que via le champ d'en-tête « Set-Cookie ».",,✓,✓,, +V3,Sécurité du frontend Web,V3.3,Configuration des cookies,V3.3.5,"Vérifiez que lorsque l'application écrit un cookie, la longueur combinée du nom et de la valeur du cookie ne dépasse pas 4 096 octets. Les cookies trop volumineux ne seront pas stockés par le navigateur et ne seront donc pas envoyés avec les requêtes, empêchant ainsi l'utilisateur d'utiliser les fonctionnalités de l'application qui reposent sur ce cookie.",,,✓,, +V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.1,"Vérifiez qu'un champ d'en-tête Strict-Transport-Security est inclus dans toutes les réponses afin d'appliquer une politique HTTP Strict Transport Security (HSTS). Une durée maximale d'au moins un an doit être définie, et pour les niveaux L2 et supérieurs, la politique doit également s'appliquer à tous les sous-domaines.",✓,✓,✓,, +V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.2,"Vérifiez que le champ d'en-tête Access-Control-Allow-Origin du partage de ressources cross-origine (CORS) est une valeur fixe de l'application ou, si la valeur du champ d'en-tête de requête HTTP Origin est utilisée, qu'elle est validée par rapport à une liste d'origines approuvées. Si « Access-Control-Allow-Origin: * » doit être utilisé, vérifiez que la réponse ne contient aucune information sensible.",✓,✓,✓,, +V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.3,"Vérifiez que les réponses HTTP incluent un champ d'en-tête de réponse Content-Security-Policy qui définit des directives garantissant que le navigateur charge et exécute uniquement du contenu ou des ressources fiables, afin de limiter l'exécution de JavaScript malveillant. Au minimum, une politique globale doit être utilisée, incluant les directives object-src 'none' et base-uri 'none', et définissant soit une lliste d’autorisations, soit des valeurs nonces ou des hachages. Pour une application L3, une politique par réponse avec des valeurs nonces ou des hachages doit être définie.",,✓,✓,, +V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.4,"Vérifiez que toutes les réponses HTTP contiennent un champ d'en-tête « X-Content-Type-Options: nosniff ». Cela indique aux navigateurs de ne pas utiliser l'analyse de contenu ni la détection du type MIME pour la réponse donnée, et d'exiger que la valeur du champ d'en-tête « Content-Type » de la réponse corresponde à la ressource de destination. Par exemple, la réponse à une demande de style n'est acceptée que si le type de contenu de la réponse est « text/css ». Cela permet également au navigateur d'utiliser la fonctionnalité de blocage de lecture inter-origines (CORB).",,✓,✓,, +V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.5,"Vérifiez que l'application définit une politique de référencement afin d'empêcher la fuite de données techniquement sensibles vers des services tiers via le champ d'en-tête de requête HTTP « Referer ». Cela peut être effectué via le champ d'en-tête de réponse HTTP « Referrer-Policy » ou via les attributs d'élément HTML. Les données sensibles peuvent inclure le chemin d'accès et les données de requête dans l'URL, et pour les applications internes non publiques, le nom d'hôte.",,✓,✓,, +V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.6,"Vérifiez que l'application Web utilise la directive frame-ancestors du champ d'en-tête Content-Security-Policy pour chaque réponse HTTP afin de garantir qu'elle ne peut pas être intégrée par défaut et que l'intégration de ressources spécifiques n'est autorisée qu'en cas de nécessité. Notez que le champ d'en-tête X-Frame-Options, bien que pris en charge par les navigateurs, est obsolète et n'est pas forcément fiable.",,✓,✓,, +V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.7,Vérifiez que le champ d’en-tête Content-Security-Policy spécifie un emplacement pour signaler les violations.,,,✓,, +V3,Sécurité du frontend Web,V3.4,En-têtes du mécanisme de sécurité du navigateur,V3.4.8,"Vérifiez que toutes les réponses HTTP qui lancent le rendu d'un document (comme les réponses de type text/html) incluent le champ d'en-tête 'Cross-Origin-Opener-Policy' avec la directive 'same-origin' ou s'ame-origin-allow-popups', selon les besoins. Cela empêche les attaques abusant de l'accès partagé aux objets Window, telles que le tabnabbing et le comptage d'images.",,,✓,, +V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.1,"Vérifiez que, si l'application ne s'appuie pas sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher les requêtes inter-origines non autorisées d'utiliser des fonctionnalités sensibles, ces requêtes sont validées afin de garantir leur origine. Cela peut se faire en utilisant et en validant des jetons anti-falsification ou en exigeant des champs d'en-tête HTTP supplémentaires qui ne sont pas des champs d'en-tête de requête CORS safelist. Ceci permet de se protéger contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).",✓,✓,✓,, +V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.2,"Vérifiez que, si l'application s'appuie sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher l'utilisation inter-origines non autorisée de fonctionnalités sensibles, il est impossible d'appeler la fonctionnalité avec une requête qui ne déclenche pas de requête de pré-vérification cross-origin CORS. Cela peut nécessiter de vérifier les valeurs des champs d'en-tête de requête 'Origin' et 'Content-Type' ou d'utiliser un champ d'en-tête supplémentaire qui n'est pas un champ d'en-tête de la liste de sécurité CORS.",✓,✓,✓,, +V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.3,"Vérifiez que les requêtes HTTP destinées aux fonctionnalités sensibles utilisent des méthodes HTTP appropriées, telles que POST, PUT, PATCH ou DELETE, et non des méthodes définies comme « sûres » par la spécification HTTP, telles que HEAD, OPTIONS ou GET. Une validation stricte des champs d'en-tête de requête Sec-Fetch-* peut également être utilisée pour garantir que la requête ne provient pas d'un appel inter-origines inapproprié, d'une requête de navigation ou d'un chargement de ressources (comme une source d'image) inattendu.",✓,✓,✓,, +V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.4,"Vérifiez que des applications distinctes sont hébergées sur des noms d'hôte différents pour tirer parti des restrictions fournies par la politique de même origine, y compris la manière dont les documents ou scripts chargés par une origine peuvent interagir avec les ressources d'une autre origine et les restrictions basées sur le nom d'hôte sur les cookies.",,✓,✓,, +V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.5,Vérifiez que les messages reçus par l'interface postMessage sont rejetés si l'origine du message n'est pas digne de confiance ou si la syntaxe du message n'est pas valide.,,✓,✓,, +V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.6,Vérifiez que la fonctionnalité JSONP n'est activée nulle part dans l'application pour éviter les attaques Cross-Site Script Inclusion (XSSI).,,,✓,, +V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.7,"Vérifiez que les données nécessitant une autorisation ne sont pas incluses dans les réponses des ressources de script, comme les fichiers JavaScript, pour empêcher les attaques par inclusion de script intersite (XSSI).",,,✓,, +V3,Sécurité du frontend Web,V3.5,Séparation de l'origine du navigateur,V3.5.8,"Vérifiez que les ressources authentifiées (telles que les images, les vidéos, les scripts et autres documents) peuvent être chargées ou intégrées pour le compte de l'utilisateur uniquement lorsque cela est prévu. Cela peut être réalisé en validant strictement les champs d'en-tête de requête HTTP Sec-Fetch-* afin de garantir que la requête ne provient pas d'un appel cross-origin inapproprié, ou en définissant un champ d'en-tête de réponse HTTP Cross-Origin-Resource-Policy restrictif pour indiquer au navigateur de bloquer le contenu renvoyé.",,,✓,, +V3,Sécurité du frontend Web,V3.6,Intégrité des ressources externes,V3.6.1,"Vérifiez que les ressources côté client, telles que les bibliothèques JavaScript, les feuilles de style CSS ou les polices web, sont hébergées en externe (par exemple, sur un réseau de diffusion de contenu) uniquement si la ressource est statique et versionnée, et si l'intégrité des sous-ressources (SRI) est utilisée pour valider l'intégrité de la ressource. Si cela n'est pas possible, une décision de sécurité documentée doit justifier cette décision pour chaque ressource.",,,✓,, +V3,Sécurité du frontend Web,V3.7,Autres considérations sur la sécurité du navigateur,V3.7.1,"Vérifiez que l'application utilise uniquement des technologies côté client toujours prises en charge et considérées comme sécurisées. Parmi les technologies qui ne répondent pas à cette exigence figurent les plugins NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL ou les applets Java côté client.",,✓,✓,, +V3,Sécurité du frontend Web,V3.7,Autres considérations sur la sécurité du navigateur,V3.7.2,Vérifiez que l'application redirigera automatiquement l'utilisateur vers un nom d'hôte ou un domaine différent (qui n'est pas contrôlé par l'application) uniquement lorsque la destination apparaît sur une liste d'autorisation.,,✓,✓,, +V3,Sécurité du frontend Web,V3.7,Autres considérations sur la sécurité du navigateur,V3.7.3,"Vérifiez que le domaine de premier niveau de l'application (par exemple, site.tld) ​​est ajouté à la liste de préchargement publique pour HTTP Strict Transport Security (HSTS). Cela garantit que l'utilisation de TLS pour l'application est intégrée directement dans les principaux navigateurs, plutôt que de dépendre uniquement du champ d'en-tête de réponse Strict-Transport-Security.",,,✓,, +V3,Sécurité du frontend Web,V3.7,Autres considérations sur la sécurité du navigateur,V3.7.4,"Vérifiez que l'application affiche une notification lorsque l'utilisateur est redirigé vers une URL hors du contrôle de l'application, avec une option pour annuler la navigation.",,,✓,, +V3,Sécurité du frontend Web,V3.7,Autres considérations sur la sécurité du navigateur,V3.7.5,"Vérifiez que l'application se comporte comme documenté (par exemple, en avertissant l'utilisateur ou en bloquant l'accès) si le navigateur utilisé pour accéder à l'application ne prend pas en charge les fonctionnalités de sécurité attendues.",,,✓,, +V4,API et service Web,V4.1,Sécurité du service Web générique,V4.1.1,"Vérifiez que chaque réponse HTTP avec un corps de message contient un champ d'en-tête Content-Type qui correspond au contenu réel de la réponse, y compris le paramètre charset pour spécifier un codage de caractères sécurisé (par exemple, UTF-8, ISO-8859-1) conformément aux types de médias IANA, tels que « text/ », « /+xml » et « /xml ».",✓,✓,✓,, +V4,API et service Web,V4.1,Sécurité du service Web générique,V4.1.2,"Vérifiez que seuls les terminaux utilisateurs (destinés à l'accès manuel via un navigateur web) redirigent automatiquement de HTTP vers HTTPS, tandis que les autres services ou terminaux n'implémentent pas de redirections transparentes. Cela permet d'éviter qu'un client envoie par erreur des requêtes HTTP non chiffrées, mais que, comme ces requêtes sont automatiquement redirigées vers HTTPS, la fuite de données sensibles passe inaperçue.",,✓,✓,, +V4,API et service Web,V4.1,Sécurité du service Web générique,V4.1.3,"Vérifiez que tout champ d'en-tête HTTP utilisé par l'application et défini par une couche intermédiaire, telle qu'un équilibreur de charge, un proxy web ou un service backend-for-frontend, ne peut pas être remplacé par l'utilisateur final. Les exemples d'en-têtes peuvent inclure X-Real-IP, X-Forwarded-*, ou X-User-ID.",,✓,✓,, +V4,API et service Web,V4.1,Sécurité du service Web générique,V4.1.4,Vérifiez que seules les méthodes HTTP explicitement prises en charge par l'application ou son API (y compris les OPTIONS lors des demandes de contrôle en amont) peuvent être utilisées et que les méthodes inutilisées sont bloquées.,,,✓,, +V4,API et service Web,V4.1,Sécurité du service Web générique,V4.1.5,Vérifier que les signatures numériques par message sont utilisées pour fournir une assurance supplémentaire en plus des protections de transport pour les demandes ou les transactions qui sont très sensibles ou qui traversent un certain nombre de systèmes.,,,✓,, +V4,API et service Web,V4.2,Validation de la structure des messages HTTP,V4.2.1,"Vérifiez que tous les composants de l'application (y compris les équilibreurs de charge, les pares-feux et les serveurs d'applications) déterminent les limites des messages HTTP entrants à l'aide du mécanisme approprié à la version HTTP afin d'empêcher la contrebande de requêtes HTTP. Dans HTTP/1.x, si un champ d'en-tête Transfer-Encoding est présent, l'en-tête Content-Length doit être ignoré conformément à la RFC 2616. Avec HTTP/2 ou HTTP/3, si un champ d'en-tête Content-Length est présent, le récepteur doit s'assurer qu'il est cohérent avec la longueur des trames DATA.",,✓,✓,, +V4,API et service Web,V4.2,Validation de la structure des messages HTTP,V4.2.2,"Vérifier que, lors de la génération de messages HTTP, le champ d'en-tête Content-Length n'entre pas en conflit avec la longueur du contenu déterminée par le cadrage du protocole HTTP, afin d'empêcher les attaques de type « request smuggling ».",,,✓,, +V4,API et service Web,V4.2,Validation de la structure des messages HTTP,V4.2.3,"Vérifiez que l'application n'envoie ni n'accepte de messages HTTP/2 ou HTTP/3 avec des champs d'en-tête spécifiques à la connexion, tels que Transfer-Encoding, afin d'éviter les attaques par fractionnement de la réponse et par injection d'en-tête.",,,✓,, +V4,API et service Web,V4.2,Validation de la structure des messages HTTP,V4.2.4,"Vérifiez que l'application n'accepte que les requêtes HTTP/2 et HTTP/3 dont les champs et valeurs d'en-tête ne contiennent pas de séquences CR (\r), LF (\n) ou CRLF (\r\n), afin d'éviter les attaques par injection d'en-tête.",,,✓,, +V4,API et service Web,V4.2,Validation de la structure des messages HTTP,V4.2.5,"Vérifiez que, si l'application (backend ou frontend) construit et envoie des requêtes, elle utilise des mécanismes de validation, d'assainissement ou autres pour éviter de créer des URI (comme pour les appels API) ou des champs d'en-tête de requête HTTP (comme Authorization ou Cookie) qui sont trop longs pour être acceptés par le composant récepteur. Cela pourrait entraîner un déni de service, par exemple lors de l'envoi d'une requête trop longue (par exemple, un long champ d'en-tête de cookie), ce qui fait que le serveur répond toujours avec un statut d'erreur.",,,✓,, +V4,API et service Web,V4.3,GraphQL,V4.3.1,"Vérifiez qu'une liste d'autorisation de requête, une limitation de profondeur, une limitation de quantité ou une analyse des coûts de requête est utilisée pour empêcher le déni de service (DoS) de GraphQL ou d'expression de la couche données en raison de requêtes imbriquées coûteuses.",,✓,✓,, +V4,API et service Web,V4.3,GraphQL,V4.3.2,"Vérifiez que les requêtes d’introspection GraphQL sont désactivées dans l’environnement de production, sauf si l’API GraphQL est destinée à être utilisée par d’autres parties.",,✓,✓,, +V4,API et service Web,V4.4,WebSocket,V4.4.1,Vérifiez que WebSocket sur TLS (WSS) est utilisé pour toutes les connexions WebSocket.,✓,✓,✓,, +V4,API et service Web,V4.4,WebSocket,V4.4.2,"Vérifiez que, lors de la négociation HTTP WebSocket initiale, le champ d’en-tête 'Origin' est vérifié par rapport à une liste d’origines autorisées pour l’application.",,✓,✓,, +V4,API et service Web,V4.4,WebSocket,V4.4.3,"Vérifiez que, si la gestion de session standard de l'application ne peut pas être utilisée, des jetons dédiés sont utilisés à cet effet, qui sont conformes aux exigences de sécurité de gestion de session pertinentes.",,✓,✓,, +V4,API et service Web,V4.4,WebSocket,V4.4.4,Vérifiez que les jetons de gestion de session WebSocket dédiés sont initialement obtenus ou validés via la session HTTPS précédemment authentifiée lors de la transition d'une session HTTPS existante vers un canal WebSocket.,,✓,✓,, +V5,Gestion des fichiers,V5.1,Documentation sur la gestion des fichiers,V5.1.1,"Vérifiez que la documentation définit les types de fichiers autorisés, les extensions de fichiers attendues et la taille maximale (y compris la taille décompressée) pour chaque fonctionnalité de Téléversement. De plus, assurez-vous que la documentation précise comment les fichiers sont sécurisés pour le téléchargement et le traitement des utilisateurs finaux, par exemple le comportement de l'application lorsqu'un fichier malveillant est détecté.",,✓,✓,, +V5,Gestion des fichiers,V5.2,Téléversement de fichiers et contenu,V5.2.1,Vérifiez que l'application n'acceptera que des fichiers d'une taille qu'elle peut traiter sans provoquer de perte de performances ou d'attaque par déni de service.,✓,✓,✓,, +V5,Gestion des fichiers,V5.2,Téléversement de fichiers et contenu,V5.2.2,"Vérifiez que lorsque l'application accepte un fichier, seul ou dans une archive telle qu'un fichier zip, elle vérifie si l'extension de fichier correspond à une extension attendue et que le contenu correspond au type représenté par l'extension. Cela inclut, sans s'y limiter, la vérification des « octets magiques » initiaux, la réécriture d'images et l'utilisation de bibliothèques spécialisées pour la validation du contenu des fichiers. Pour le niveau L1, cela peut se concentrer uniquement sur les fichiers utilisés pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau L2, cela doit s'appliquer à tous les fichiers acceptés.",✓,✓,✓,, +V5,Gestion des fichiers,V5.2,Téléversement de fichiers et contenu,V5.2.3,"Vérifiez que l'application vérifie les fichiers compressés (par exemple, zip, gz, docx, odt) par rapport à la taille maximale autorisée non compressée et au nombre maximal de fichiers avant de décompresser le fichier.",,✓,✓,, +V5,Gestion des fichiers,V5.2,Téléversement de fichiers et contenu,V5.2.4,Vérifiez qu'un quota de taille de fichier et un nombre maximal de fichiers par utilisateur sont appliqués pour garantir qu'un seul utilisateur ne puisse pas remplir le stockage avec trop de fichiers ou des fichiers excessivement volumineux.,,,✓,, +V5,Gestion des fichiers,V5.2,Téléversement de fichiers et contenu,V5.2.5,"Vérifiez que l'application n'autorise pas le téléversement de fichiers compressés contenant des liens symboliques, sauf si cela est spécifiquement requis (auquel cas il sera nécessaire d'appliquer une liste d'autorisation des fichiers vers lesquels il est possible de créer des liens symboliques).",,,✓,, +V5,Gestion des fichiers,V5.2,Téléversement de fichiers et contenu,V5.2.6,"Vérifiez que l'application rejette les images téléversées avec une taille de pixel supérieure au maximum autorisé, afin d'éviter les attaques par inondation de pixels.",,,✓,, +V5,Gestion des fichiers,V5.3,Stockage de fichiers,V5.3.1,Vérifiez que les fichiers téléversés ou générés par une entrée non fiable et stockés dans un dossier public ne sont pas exécutés en tant que code de programme côté serveur lorsqu'ils sont accessibles directement avec une requête HTTP.,✓,✓,✓,, +V5,Gestion des fichiers,V5.3,Stockage de fichiers,V5.3.2,"Vérifiez que lorsque l'application crée des chemins d'accès pour les opérations sur les fichiers, elle utilise des données générées en interne ou fiables plutôt que des noms de fichiers soumis par l'utilisateur. Si des noms de fichiers ou des métadonnées de fichiers soumis par l'utilisateur doivent être utilisés, une validation et un nettoyage stricts doivent être appliqués. Ceci permet de se protéger contre les attaques par traversée de chemin, l'inclusion de fichiers locaux ou distants (LFI, RFI) et la falsification de requêtes côté serveur (SSRF).",✓,✓,✓,, +V5,Gestion des fichiers,V5.3,Stockage de fichiers,V5.3.3,"Vérifiez que le traitement des fichiers côté serveur, comme la décompression des fichiers, ignore les informations de chemin fournies par l'utilisateur pour éviter les vulnérabilités telles que le ""zip slip"".",,,✓,, +V5,Gestion des fichiers,V5.4,Téléchargement de fichier,V5.4.1,"Vérifiez que l’application valide ou ignore les noms de fichiers soumis par l’utilisateur, y compris dans un paramètre JSON, JSONP ou URL et spécifie un nom de fichier dans le champ d’en-tête Content-Disposition de la réponse.",,✓,✓,, +V5,Gestion des fichiers,V5.4,Téléchargement de fichier,V5.4.2,"Vérifiez que les noms de fichiers servis (par exemple, dans les champs d'en-tête de réponse HTTP ou les pièces jointes aux e-mails) sont encodés ou nettoyés (par exemple, conformément à la RFC 6266) pour préserver la structure du document et empêcher les attaques par injection.",,✓,✓,, +V5,Gestion des fichiers,V5.4,Téléchargement de fichier,V5.4.3,Vérifiez que les fichiers obtenus à partir de sources non fiables sont analysés par des scanners antivirus pour empêcher la diffusion de contenu malveillant connu.,,✓,✓,, +V6,Authentification,V6.1,Documentation d'authentification,V6.1.1,"Vérifiez que la documentation de l'application définit comment les contrôles, tels que la limitation de débit, l'anti-automatisation et la réponse adaptative, sont utilisés pour se défendre contre les attaques telles que le « credential stuffing » et la force brute des mots de passe. La documentation doit expliquer clairement comment ces contrôles sont configurés et empêcher le blocage malveillant des comptes.",✓,✓,✓,, +V6,Authentification,V6.1,Documentation d'authentification,V6.1.2,"Vérifiez qu'une liste de mots spécifiques au contexte est documentée afin d'empêcher leur utilisation dans les mots de passe. Cette liste peut inclure des permutations de noms d'organisations, de produits, d'identifiants de systèmes, de noms de codes de projets, de noms de services ou de rôles, etc.",,✓,✓,, +V6,Authentification,V6.1,Documentation d'authentification,V6.1.3,"Vérifiez que, si l'application inclut plusieurs voies d'authentification, celles-ci sont toutes documentées avec les contrôles de sécurité et la force d'authentification qui doivent être appliqués de manière cohérente.",,✓,✓,, +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.1,"Vérifiez que les mots de passe définis par l'utilisateur comportent au moins 8 caractères, bien qu'un minimum de 15 caractères soit fortement recommandé.",✓,✓,✓,, +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.2,Vérifiez que les utilisateurs peuvent modifier leur mot de passe.,✓,✓,✓,, +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.3,Vérifiez que la fonctionnalité de changement de mot de passe nécessite le mot de passe actuel et le nouveau mot de passe de l'utilisateur.,✓,✓,✓,, +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.4,"Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou du changement de mot de passe sont vérifiés par rapport à un ensemble disponible d'au moins 3 000 mots de passe principaux qui correspondent à la politique de mot de passe de l'application, par exemple la longueur minimale.",✓,✓,✓,, +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.5,"Vérifiez que les mots de passe peuvent être utilisés, quelle que soit leur composition, sans restriction quant au type de caractères autorisés. Aucun nombre minimal de majuscules ou de minuscules, de chiffres ou de caractères spéciaux ne doit être exigé.",✓,✓,✓,, +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.6,Vérifiez que les champs de saisie du mot de passe utilisent type=password pour masquer la saisie. Les applications peuvent permettre à l'utilisateur d'afficher temporairement l'intégralité du mot de passe masqué ou le dernier caractère saisi.,✓,✓,✓,, +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.7,"Vérifiez que la fonctionnalité « coller », les assistants de mot de passe du navigateur et les gestionnaires de mots de passe externes sont autorisés.",✓,✓,✓,, +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.8,"Vérifiez que l'application vérifie le mot de passe de l'utilisateur exactement tel qu'il a été reçu de l'utilisateur, sans aucune modification telle qu'une troncature ou une transformation de casse.",✓,✓,✓,, +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.9,Vérifiez que les mots de passe d’au moins 64 caractères sont autorisés.,,✓,✓,, +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.10,Vérifiez que le mot de passe d'un utilisateur reste valide jusqu'à ce qu'il soit découvert comme compromis ou qu'il soit renouvelé. L'application ne doit pas exiger de renouvellement périodique des identifiants.,,✓,✓,, +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.11,Vérifiez que la liste documentée de mots spécifiques au contexte est utilisée pour éviter la création de mots de passe faciles à deviner.,,✓,✓,, +V6,Authentification,V6.2,Sécurité des mots de passe,V6.2.12,Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou des modifications de mot de passe sont vérifiés par rapport à un ensemble de mots de passe fuités.,,✓,✓,, +V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.1,Vérifiez que les contrôles visant à empêcher les attaques telles que le bourrage d'informations d'identification et la force brute des mots de passe sont mis en œuvre conformément à la documentation de sécurité de l'application.,✓,✓,✓,, +V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.2,"Vérifiez que les comptes d’utilisateur par défaut (par exemple, « root », « admin » ou « sa ») ne sont pas présents dans l’application ou sont désactivés.",✓,✓,✓,, +V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.3,Vérifiez que l’application exige que les utilisateurs utilisent un mécanisme d’authentification multifacteur ou une combinaison de mécanismes d’authentification à facteur unique.,,✓,✓,, +V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.4,"Vérifiez que, si l’application inclut plusieurs voies d’authentification, il n’existe aucune voie non documentée et que les contrôles de sécurité et la force d’authentification sont appliqués de manière cohérente.",,✓,✓,, +V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.5,"Vérifiez que les utilisateurs sont informés des tentatives d'authentification suspectes (réussies ou non). Il peut s'agir de tentatives d'authentification provenant d'un emplacement ou d'un client inhabituel, d'une authentification partiellement réussie (un seul facteur parmi plusieurs), d'une tentative d'authentification après une longue période d'inactivité ou d'une authentification réussie après plusieurs tentatives infructueuses.",,,✓,, +V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.6,Vérifiez que le courrier électronique n’est pas utilisé comme mécanisme d’authentification à facteur unique ou à facteurs multiples.,,,✓,, +V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.7,"Vérifiez que les utilisateurs sont avertis après les mises à jour des détails d'authentification, telles que les réinitialisations d'informations d'identification ou la modification du nom d'utilisateur ou de l'adresse e-mail.",,,✓,, +V6,Authentification,V6.3,Sécurité générale de l'authentification,V6.3.8,"Vérifiez que les utilisateurs valides ne peuvent pas être déduits d'échecs d'authentification, par exemple en se basant sur des messages d'erreur, des codes de réponse HTTP ou des temps de réponse différents. Les fonctionnalités d'inscription et de mot de passe oublié doivent également bénéficier de cette protection.",,,✓,, +V6,Authentification,V6.4,Cycle de vie et récupération du facteur d'authentification,V6.4.1,"Vérifiez que les mots de passe initiaux ou les codes d'activation générés par le système sont générés de manière aléatoire et sécurisée, qu'ils respectent la politique de mots de passe en vigueur et qu'ils expirent après une courte période ou après leur première utilisation. Ces secrets initiaux ne doivent pas devenir des mots de passe permanents.",✓,✓,✓,, +V6,Authentification,V6.4,Cycle de vie et récupération du facteur d'authentification,V6.4.2,Vérifiez que les indices de mot de passe ou l'authentification basée sur les connaissances (appelées « questions secrètes ») ne sont pas présents.,✓,✓,✓,, +V6,Authentification,V6.4,Cycle de vie et récupération du facteur d'authentification,V6.4.3,"Vérifiez qu'un processus sécurisé de réinitialisation d'un mot de passe oublié est mis en œuvre, qui ne contourne aucun mécanisme d'authentification multifacteur activé.",,✓,✓,, +V6,Authentification,V6.4,Cycle de vie et récupération du facteur d'authentification,V6.4.4,"Vérifiez que si un facteur d'authentification multifacteur est perdu, la preuve de vérification d'identité est effectuée au même niveau que lors de l'inscription.",,✓,✓,, +V6,Authentification,V6.4,Cycle de vie et récupération du facteur d'authentification,V6.4.5,"Vérifiez que les instructions de renouvellement des mécanismes d'authentification qui expirent sont envoyées avec suffisamment de temps pour être exécutées avant l'expiration de l'ancien mécanisme d'authentification, en configurant des rappels automatiques si nécessaire.",,,✓,, +V6,Authentification,V6.4,Cycle de vie et récupération du facteur d'authentification,V6.4.6,"Vérifiez que les administrateurs peuvent initier la réinitialisation du mot de passe de l'utilisateur, mais que cela ne leur permet pas de modifier ou de choisir son mot de passe. Cela évite qu'ils ne connaissent le mot de passe de l'utilisateur.",,,✓,, +V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.1,"Vérifiez que les secrets de recherche, les demandes ou codes d'authentification out-of-band et les mots de passe à usage unique basés sur le temps (TOTP) ne peuvent être utilisés avec succès qu'une seule fois.",,✓,✓,, +V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.2,"Vérifiez que, lors de leur stockage dans le backend de l'application, les secrets de recherche comportant moins de 112 bits d'entropie (19 caractères alphanumériques aléatoires ou 34 chiffres aléatoires) sont hachés avec un algorithme de hachage de stockage de mots de passe approuvé, intégrant un sel aléatoire de 32 bits. Une fonction de hachage standard peut être utilisée si le secret comporte 112 bits d'entropie ou plus.",,✓,✓,, +V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.3,"Vérifiez que les secrets de recherche, le code d'authentification out-of-band et les mots de passe à usage unique basés sur le temps sont générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) pour éviter les valeurs prévisibles.",,✓,✓,, +V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.4,Vérifiez que les secrets de recherche et les codes d'authentification out-of-band ont un minimum de 20 bits d'entropie (généralement 4 caractères alphanumériques aléatoires ou 6 chiffres aléatoires suffisent).,,✓,✓,, +V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.5,"Vérifiez que les requêtes, codes ou jetons d'authentification out-of-band, ainsi que les mots de passe à usage unique (TOTP), ont une durée de vie définie. Les requêtes out-of-band doivent avoir une durée de vie maximale de 10 minutes et les TOTP, de 30 secondes.",,✓,✓,, +V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.6,Vérifiez que tout facteur d’authentification (y compris les appareils physiques) peut être révoqué en cas de vol ou autre perte.,,,✓,, +V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.7,"Vérifiez que les mécanismes d’authentification biométrique ne sont utilisés que comme facteurs secondaires, avec quelque chose que vous possédez ou quelque chose que vous savez.",,,✓,, +V6,Authentification,V6.5,Exigences générales en matière d'authentification multifacteur,V6.5.8,Vérifiez que les mots de passe à usage unique basés sur le temps (TOTP) sont vérifiés en fonction d'une source temporelle provenant d'un service de confiance et non d'une heure non fiable ou fournie par le client.,,,✓,, +V6,Authentification,V6.6,Mécanismes d'authentification out-of-band,V6.6.1,"Vérifier que les mécanismes d'authentification utilisant le réseau téléphonique public commuté (RTPC) pour la transmission de mots de passe à usage unique (OTP) par téléphone ou SMS ne sont proposés que lorsque le numéro de téléphone a été préalablement validé. D'autres méthodes plus robustes (telles que les mots de passe à usage unique à durée déterminée) sont également proposées, et que le service informe les utilisateurs des risques de sécurité qu'elles présentent. Pour les applications de niveau 3, le téléphone et les SMS ne doivent pas être disponibles.",,✓,✓,, +V6,Authentification,V6.6,Mécanismes d'authentification out-of-band,V6.6.2,"Vérifiez que les demandes d’authentification out-of-band, les codes ou les jetons sont liés à la demande d’authentification d’origine pour laquelle ils ont été générés et ne sont pas utilisables pour une demande précédente ou ultérieure.",,✓,✓,, +V6,Authentification,V6.6,Mécanismes d'authentification out-of-band,V6.6.3,"Vérifiez qu'un mécanisme d'authentification out-of-band basé sur du code est protégé contre les attaques par force brute grâce au ""rate limiting"". Envisagez également d'utiliser un code avec au moins 64 bits d'entropie.",,✓,✓,, +V6,Authentification,V6.6,Mécanismes d'authentification out-of-band,V6.6.4,"Vérifiez que, lorsque les notifications push sont utilisées pour l'authentification multifacteur, le ""rate limiting"" est appliqué afin d'empêcher les attaques de type « push bombing ». La concordance des numéros peut également atténuer ce risque.",,,✓,, +V6,Authentification,V6.7,Mécanisme d'authentification cryptographique,V6.7.1,Vérifiez que les certificats utilisés pour vérifier les assertions d’authentification cryptographique sont stockés de manière à les protéger contre toute modification.,,,✓,, +V6,Authentification,V6.7,Mécanisme d'authentification cryptographique,V6.7.2,Vérifiez que le nonce de défi a une longueur d'au moins 64 bits et qu'il est statistiquement unique ou unique sur toute la durée de vie du périphérique cryptographique.,,,✓,, +V6,Authentification,V6.8,Authentification avec un fournisseur d'identité,V6.8.1,"Vérifiez que, si l'application prend en charge plusieurs fournisseurs d'identité (IdP), l'identité de l'utilisateur ne peut pas être usurpée via un autre fournisseur d'identité pris en charge (par exemple, en utilisant le même identifiant utilisateur). La mesure standard consisterait à ce que l'application enregistre et identifie l'utilisateur à l'aide d'une combinaison de l'ID du fournisseur d'identité (servant d'espace de noms) et de l'ID de l'utilisateur dans le fournisseur d'identité.",,✓,✓,, +V6,Authentification,V6.8,Authentification avec un fournisseur d'identité,V6.8.2,"Vérifiez que la présence et l'intégrité des signatures numériques sur les assertions d'authentification (par exemple sur les assertions JWT ou SAML) sont toujours validées, en rejetant toutes les assertions non signées ou ayant des signatures non valides.",,✓,✓,, +V6,Authentification,V6.8,Authentification avec un fournisseur d'identité,V6.8.3,Vérifiez que les assertions SAML sont traitées de manière unique et utilisées une seule fois au cours de la période de validité pour éviter les attaques par rejeu.,,✓,✓,, +V6,Authentification,V6.8,Authentification avec un fournisseur d'identité,V6.8.4,"Si une application utilise un fournisseur d'identité (IdP) distinct et attend une force, des méthodes ou une date d'authentification spécifiques pour des fonctions spécifiques, vérifiez que l'application les vérifie à l'aide des informations renvoyées par l'IdP. Par exemple, si OIDC est utilisé, cela peut être réalisé en validant les affirmations de jeton d'identification telles que « acr », « amr » et « auth_time » (le cas échéant). Si l'IdP ne fournit pas ces informations, l'application doit disposer d'une approche de secours documentée qui suppose que le mécanisme d'authentification de force minimale a été utilisé (par exemple, une authentification à facteur unique avec nom d'utilisateur et mot de passe).",,✓,✓,, +V7,Gestion des sessions,V7.1,Documentation sur la gestion des sessions,V7.1.1,"Vérifiez que le délai d'inactivité de la session de l'utilisateur et la durée de vie maximale absolue de la session sont documentés, sont appropriés en combinaison avec d'autres contrôles et que la documentation inclut une justification de tout écart par rapport aux exigences de réauthentification NIST SP 800-63B.",,✓,✓,, +V7,Gestion des sessions,V7.1,Documentation sur la gestion des sessions,V7.1.2,Vérifiez que la documentation définit le nombre de sessions simultanées (parallèles) autorisées pour un compte ainsi que les comportements et actions prévus à entreprendre lorsque le nombre maximal de sessions actives est atteint.,,✓,✓,, +V7,Gestion des sessions,V7.1,Documentation sur la gestion des sessions,V7.1.3,"Vérifiez que tous les systèmes qui créent et gèrent des sessions utilisateur dans le cadre d'un écosystème de gestion des identités fédérées (tels que les systèmes SSO) sont documentés avec des contrôles pour coordonner la durée de vie des sessions, la résiliation et toute autre condition nécessitant une réauthentification.",,✓,✓,, +V7,Gestion des sessions,V7.2,Sécurité fondamentale de la gestion des sessions,V7.2.1,Vérifiez que l’application effectue toutes les vérifications des jetons de session à l’aide d’un service backend de confiance.,✓,✓,✓,, +V7,Gestion des sessions,V7.2,Sécurité fondamentale de la gestion des sessions,V7.2.2,"Vérifiez que l'application utilise des jetons autonomes ou de référence générés dynamiquement pour la gestion des sessions, c'est-à-dire sans utiliser de secrets et de clés d'API statiques.",✓,✓,✓,, +V7,Gestion des sessions,V7.2,Sécurité fondamentale de la gestion des sessions,V7.2.3,"Vérifiez que si des jetons par référence sont utilisés pour représenter les sessions utilisateur, ils sont uniques et générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et possèdent au moins 128 bits d'entropie.",✓,✓,✓,, +V7,Gestion des sessions,V7.2,Sécurité fondamentale de la gestion des sessions,V7.2.4,"Vérifiez que l’application génère un nouveau jeton de session lors de l’authentification de l’utilisateur, y compris la réauthentification, et met fin au jeton de session actuel.",✓,✓,✓,, +V7,Gestion des sessions,V7.3,Délai d'expiration de la session,V7.3.1,Vérifiez qu’il existe un délai d’inactivité tel que la réauthentification soit appliquée conformément à l’analyse des risques et aux décisions de sécurité documentées.,,✓,✓,, +V7,Gestion des sessions,V7.3,Délai d'expiration de la session,V7.3.2,Vérifiez qu'il existe une durée de vie maximale absolue de la session de sorte que la réauthentification soit appliquée conformément à l'analyse des risques et aux décisions de sécurité documentées.,,✓,✓,, +V7,Gestion des sessions,V7.4,Fin de session,V7.4.1,"Vérifiez que lorsque la fin de session est déclenchée (par exemple, déconnexion ou expiration), l'application interdit toute utilisation ultérieure de la session. Pour les jetons par référence ou les sessions avec état, cela implique l'invalidation des données de session au niveau du backend de l'application. Les applications utilisant des jetons autonomes nécessiteront une solution, comme la gestion d'une liste des jetons terminés, l'interdiction des jetons produits avant une date et une heure spécifique à chaque utilisateur ou la rotation d'une clé de signature spécifique à chaque utilisateur.",✓,✓,✓,, +V7,Gestion des sessions,V7.4,Fin de session,V7.4.2,"Vérifiez que l'application met fin à toutes les sessions actives lorsqu'un compte utilisateur est désactivé ou supprimé (par exemple, lorsqu'un employé quitte l'entreprise).",✓,✓,✓,, +V7,Gestion des sessions,V7.4,Fin de session,V7.4.3,"Vérifiez que l'application offre la possibilité de mettre fin à toutes les autres sessions actives après une modification ou une suppression réussie de tout facteur d'authentification (y compris la modification du mot de passe via une réinitialisation ou une récupération et, le cas échéant, une mise à jour des paramètres MFA).",,✓,✓,, +V7,Gestion des sessions,V7.4,Fin de session,V7.4.4,Vérifiez que toutes les pages nécessitant une authentification disposent d’un accès facile et visible à la fonctionnalité de déconnexion.,,✓,✓,, +V7,Gestion des sessions,V7.4,Fin de session,V7.4.5,Vérifiez que les administrateurs d’applications sont en mesure de mettre fin aux sessions actives pour un utilisateur individuel ou pour tous les utilisateurs.,,✓,✓,, +V7,Gestion des sessions,V7.5,Défenses contre les abus de session,V7.5.1,"Vérifiez que l'application nécessite une réauthentification complète avant d'autoriser les modifications des attributs de compte sensibles qui peuvent affecter l'authentification, tels que l'adresse e-mail, le numéro de téléphone, la configuration MFA ou d'autres informations utilisées dans la récupération de compte.",,✓,✓,, +V7,Gestion des sessions,V7.5,Défenses contre les abus de session,V7.5.2,Vérifiez que les utilisateurs peuvent afficher et (après s'être authentifiés à nouveau avec au moins un facteur) terminer une ou toutes les sessions actuellement actives.,,✓,✓,, +V7,Gestion des sessions,V7.5,Défenses contre les abus de session,V7.5.3,Vérifiez que l’application nécessite une authentification supplémentaire avec au moins un facteur ou une vérification secondaire avant d’effectuer des transactions ou des opérations hautement sensibles.,,,✓,, +V7,Gestion des sessions,V7.6,Réauthentification fédérée,V7.6.1,"Vérifiez que la durée de vie et la fin de la session entre les parties de confiance (RP) et les fournisseurs d'identité (IdP) se comportent comme documenté, en exigeant une réauthentification si nécessaire, par exemple lorsque le temps maximal entre les événements d'authentification IdP est atteint.",,✓,✓,, +V7,Gestion des sessions,V7.6,Réauthentification fédérée,V7.6.2,"Vérifiez que la création d'une session nécessite soit le consentement de l'utilisateur, soit une action explicite, empêchant ainsi la création de nouvelles sessions d'application sans interaction de l'utilisateur.",,✓,✓,, +V8,Autorisation,V8.1,Documentation d'autorisation,V8.1.1,Vérifiez que la documentation d’autorisation définit des règles de restriction de l’accès au niveau de la fonction et aux données en fonction des autorisations du consommateur et des attributs des ressources.,✓,✓,✓,, +V8,Autorisation,V8.1,Documentation d'autorisation,V8.1.2,"Vérifiez que la documentation d'autorisation définit les règles de restriction d'accès au niveau des champs (lecture et écriture) en fonction des autorisations des consommateurs et des attributs des ressources. Notez que ces règles peuvent dépendre d'autres valeurs d'attributs de l'objet de données concerné, telles que l'état ou le statut.",,✓,✓,, +V8,Autorisation,V8.1,Documentation d'autorisation,V8.1.3,"Vérifiez que la documentation de l'application définit les attributs environnementaux et contextuels (y compris, mais sans s'y limiter, l'heure de la journée, l'emplacement de l'utilisateur, l'adresse IP ou l'appareil) qui sont utilisés dans l'application pour prendre des décisions de sécurité, y compris celles relatives à l'authentification et à l'autorisation.",,,✓,, +V8,Autorisation,V8.1,Documentation d'autorisation,V8.1.4,"Vérifier que la documentation d'authentification et d'autorisation définit l'utilisation des facteurs environnementaux et contextuels dans la prise de décision, en plus des autorisations au niveau des fonctions, des données et des champs. Cela doit inclure les attributs évalués, les seuils de risque et les actions entreprises (par exemple, autorisation, contestation, refus, renforcement de l'authentification).",,,✓,, +V8,Autorisation,V8.2,Conception d'autorisation générale,V8.2.1,Vérifiez que l’application garantit que l’accès basé sur la fonction est limité aux consommateurs disposant d’autorisations explicites.,✓,✓,✓,, +V8,Autorisation,V8.2,Conception d'autorisation générale,V8.2.2,Vérifiez que l'application garantit que l'accès spécifique aux données est limité aux consommateurs disposant d'autorisations explicites sur des éléments de données spécifiques afin d'atténuer les références d'objet directes non sécurisées (IDOR) et les autorisations de niveau d'objet rompues (BOLA).,✓,✓,✓,, +V8,Autorisation,V8.2,Conception d'autorisation générale,V8.2.3,Vérifiez que l'application garantit que l'accès au niveau du champ est limité aux consommateurs disposant d'autorisations explicites sur des champs spécifiques afin d'atténuer les problèmes d'autorisation au niveau de la propriété d'objet (BOPLA).,,✓,✓,, +V8,Autorisation,V8.2,Conception d'autorisation générale,V8.2.4,"Vérifiez que les contrôles de sécurité adaptatifs basés sur les attributs environnementaux et contextuels du consommateur (tels que l'heure, la localisation, l'adresse IP ou l'appareil) sont mis en œuvre pour les décisions d'authentification et d'autorisation, comme défini dans la documentation de l'application. Ces contrôles doivent être appliqués lorsque le consommateur tente de démarrer une nouvelle session et également pendant une session existante.",,,✓,, +V8,Autorisation,V8.3,Autorisation par opération,V8.3.1,"Vérifier que l'application applique les règles d'autorisations au niveau de la couche service de confiance et ne s’appuie pas sur des contrôles qu’un consommateur non approuvé pourrait manipuler, comme JavaScript côté client.",✓,✓,✓,, +V8,Autorisation,V8.3,Autorisation par opération,V8.3.2,"Vérifiez que les modifications apportées aux valeurs sur lesquelles reposent les décisions d'autorisation sont appliquées immédiatement. Lorsque les modifications ne peuvent pas être appliquées immédiatement (par exemple, en s'appuyant sur des données de jetons autonomes), des contrôles d'atténuation doivent être mis en place pour alerter un consommateur lorsqu'il effectue une action alors qu'il n'est plus autorisé à le faire et annuler la modification. Notez que cette solution alternative ne limiterait pas les fuites d'informations.",,,✓,, +V8,Autorisation,V8.3,Autorisation par opération,V8.3.3,"Vérifiez que l'accès à un objet repose sur les autorisations du sujet d'origine (par exemple, le consommateur), et non sur celles d'un intermédiaire ou d'un service agissant en son nom. Par exemple, si un consommateur appelle un service web à l'aide d'un jeton d'authentification autonome, et que ce service demande ensuite des données à un autre service, ce dernier utilisera le jeton du consommateur, plutôt qu'un jeton inter-machine du premier service, pour prendre les décisions d'autorisation.",,,✓,, +V8,Autorisation,V8.4,Autres considérations relatives à l'autorisation,V8.4.1,Vérifiez que les applications multi-tenants utilisent des contrôles inter-tenants pour garantir que les opérations des consommateurs n'affecteront jamais les tenants avec lesquels ils ne sont pas autorisés à interagir.,,✓,✓,, +V8,Autorisation,V8.4,Autres considérations relatives à l'autorisation,V8.4.2,"Vérifiez que l'accès aux interfaces administratives intègre plusieurs couches de sécurité, notamment la vérification continue de l'identité du consommateur, l'évaluation de la posture de sécurité des appareils et l'analyse contextuelle des risques, garantissant que l'emplacement du réseau ou les endpoints approuvés ne sont pas les seuls facteurs d'autorisation, même s'ils peuvent réduire la probabilité d'accès non autorisé.",,,✓,, +V9,Jetons autonomes,V9.1,Source et intégrité du jeton,V9.1.1,Vérifiez que les jetons autonomes sont validés à l'aide de leur signature numérique ou MAC pour les protéger contre toute falsification avant d'accepter le contenu du jeton.,✓,✓,✓,, +V9,Jetons autonomes,V9.1,Source et intégrité du jeton,V9.1.2,"Vérifiez que seuls les algorithmes d'une liste d’autorisations peuvent être utilisés pour créer et vérifier des jetons autonomes, dans un contexte donné. La liste d'autorisation doit inclure les algorithmes autorisés, idéalement symétriques ou asymétriques, et ne doit pas inclure l'algorithme « Aucun ». Si les algorithmes symétriques et asymétriques doivent être pris en charge, des contrôles supplémentaires seront nécessaires pour éviter toute confusion de clés.",✓,✓,✓,, +V9,Jetons autonomes,V9.1,Source et intégrité du jeton,V9.1.3,"Vérifiez que les clés utilisées pour valider les jetons autonomes proviennent de sources préconfigurées et fiables pour l'émetteur du jeton, empêchant ainsi les attaquants de spécifier des sources et des clés non fiables. Pour les JWT et autres structures JWS, les en-têtes tels que « jku », « x5u » et « jwk » doivent être validés par rapport à une liste d'autorisation de sources fiables.",✓,✓,✓,, +V9,Jetons autonomes,V9.2,Contenu du jeton,V9.2.1,"Vérifiez que, si une période de validité est indiquée dans les données du jeton, celui-ci et son contenu ne sont acceptés que si la date de vérification est comprise dans cette période. Par exemple, pour les JWT, les déclarations « nbf » et « exp » doivent être vérifiées.",✓,✓,✓,, +V9,Jetons autonomes,V9.2,Contenu du jeton,V9.2.2,"Vérifiez que le service recevant un jeton valide le type de jeton et son utilisation avant d'en accepter le contenu. Par exemple, seuls les jetons d'accès peuvent être acceptés pour les décisions d'autorisation, et seuls les jetons d'identification peuvent être utilisés pour prouver l'authentification des utilisateurs.",,✓,✓,, +V9,Jetons autonomes,V9.2,Contenu du jeton,V9.2.3,"Vérifiez que le service accepte uniquement les jetons destinés à être utilisés avec ce service (audience). Pour les JWT, cela peut être réalisé en validant la déclaration « aud » par rapport à une liste d'autorisation définie dans le service.",,✓,✓,, +V9,Jetons autonomes,V9.2,Contenu du jeton,V9.2.4,"Si un émetteur de jetons utilise la même clé privée pour émettre des jetons destinés à différentes audiences, vérifiez que les jetons émis contiennent une restriction d'audience identifiant de manière unique les audiences visées. Cela empêchera la réutilisation d'un jeton avec une audience non prévue. Si l'identifiant d'audience est provisionné dynamiquement, l'émetteur de jetons doit valider ces audiences afin de garantir qu'elles n'entraînent pas d'usurpation d'identité.",,✓,✓,, +V10,Oauth et OIDC,V10.1,Sécurité générique OAuth et OIDC,V10.1.1,"Vérifiez que les jetons sont envoyés uniquement aux composants qui en ont absolument besoin. Par exemple, lors de l'utilisation d'un modèle backend-for-frontend pour les applications JavaScript basées sur un navigateur, les jetons d'accès et d'actualisation ne doivent être accessibles qu'au backend.",,✓,✓,, +V10,Oauth et OIDC,V10.1,Sécurité générique OAuth et OIDC,V10.1.2,"Vérifiez que le client n'accepte les valeurs du serveur d'autorisation (telles que le code d'autorisation ou le jeton d'identification) que si elles résultent d'un flux d'autorisation initié par la même session d'agent utilisateur et la même transaction. Cela nécessite que les secrets générés par le client, tels que la clé de preuve pour l'échange de codes (PKCE) « code_verifier », « state » ou le nonce OIDC, ne puissent être devinés, soient spécifiques à la transaction et soient liés de manière sécurisée au client et à la session d'agent utilisateur au cours de laquelle la transaction a été initiée.",,✓,✓,, +V10,Oauth et OIDC,V10.2,Client OAuth,V10.2.1,"Vérifiez que, si le flux de code est utilisé, le client OAuth dispose d'une protection contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF), qui déclenchent des demandes de jetons, soit en utilisant la fonctionnalité de clé de preuve pour l'échange de code (PKCE), soit en vérifiant le paramètre « state » envoyé dans la demande d'autorisation.",,✓,✓,, +V10,Oauth et OIDC,V10.2,Client OAuth,V10.2.2,"Vérifiez que, si le client OAuth peut interagir avec plusieurs serveurs d'autorisation, il dispose d'une protection contre les attaques par confusion. Par exemple, il peut exiger que le serveur d'autorisation renvoie la valeur du paramètre « iss » et la valide dans la réponse d'autorisation et la réponse du jeton.",,✓,✓,, +V10,Oauth et OIDC,V10.2,Client OAuth,V10.2.3,Vérifiez que le client OAuth demande uniquement les portées requises (ou d’autres paramètres d’autorisation) dans les requêtes adressées au serveur d’autorisation.,,,✓,, +V10,Oauth et OIDC,V10.3,Serveur de ressources OAuth,V10.3.1,Vérifiez que le serveur de ressources accepte uniquement les jetons d'accès destinés à être utilisés avec ce service (audience). L'audience peut être incluse dans un jeton d'accès structuré (comme la déclaration « aud » dans JWT) ou vérifiée à l'aide du endpoint d'introspection de jeton.,,✓,✓,, +V10,Oauth et OIDC,V10.3,Serveur de ressources OAuth,V10.3.2,"Vérifiez que le serveur de ressources applique les décisions d'autorisation en fonction des déclarations du jeton d'accès définissant l'autorisation déléguée. Si des déclarations telles que « sub », « scope » et « authorization_details » sont présentes, elles doivent être prises en compte dans la décision.",,✓,✓,, +V10,Oauth et OIDC,V10.3,Serveur de ressources OAuth,V10.3.3,"Vérifiez que si une décision de contrôle d'accès nécessite l'identification d'un utilisateur unique à partir d'un jeton d'accès (JWT ou réponse d'introspection de jeton associé), le serveur de ressources identifie l'utilisateur à partir de déclarations non ré attribuables à d'autres utilisateurs. En général, cela implique l'utilisation d'une combinaison de déclarations « iss » et « sub ».",,✓,✓,, +V10,Oauth et OIDC,V10.3,Serveur de ressources OAuth,V10.3.4,"Si le serveur de ressources requiert une force d'authentification, des méthodes ou une date d'expiration spécifiques, vérifiez que le jeton d'accès présenté respecte ces contraintes. Par exemple, s'il est présent, utilisez les déclarations OIDC « acr », « amr » et « auth_time » respectivement.",,✓,✓,, +V10,Oauth et OIDC,V10.3,Serveur de ressources OAuth,V10.3.5,"Vérifiez que le serveur de ressources empêche l'utilisation de jetons d'accès volés ou la relecture de jetons d'accès (de parties non autorisées) en exigeant des jetons d'accès limités par l'expéditeur, soit Mutual TLS pour OAuth 2, soit OAuth 2 Demonstration of Proof of Possession (DPoP).",,,✓,, +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.1,Vérifiez que le serveur d'autorisation valide les URI de redirection en fonction d'une liste d'autorisation spécifique au client d'URI préenregistrés à l'aide d'une comparaison de chaînes exacte.,✓,✓,✓,, +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.2,"Vérifiez que, si le serveur d'autorisation renvoie le code d'autorisation dans la réponse, celui-ci ne peut être utilisé qu'une seule fois pour une demande de jeton. Pour la deuxième demande valide avec un code d'autorisation déjà utilisé pour émettre un jeton d'accès, le serveur d'autorisation doit rejeter la demande de jeton et révoquer tous les jetons émis liés au code d'autorisation.",✓,✓,✓,, +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.3,Vérifiez que le code d'autorisation est de courte durée. La durée de vie maximale peut atteindre 10 minutes pour les applications L1 et L2 et 1 minute pour les applications L3.,✓,✓,✓,, +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.4,"Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement l'utilisation des autorisations nécessaires à ce client. Notez que les autorisations « token » (flux implicite) et « password » (flux d'informations d'identification du propriétaire de la ressource) ne doivent plus être utilisées.",✓,✓,✓,, +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.5,"Vérifiez que le serveur d'autorisation atténue les attaques par rejeu de jetons d'actualisation pour les clients publics, de préférence en utilisant des jetons d'actualisation limités par l'expéditeur, par exemple des jetons DPoP (Demonstrating Proof of Possession) ou des jetons d'accès liés à un certificat utilisant le protocole TLS mutuel (mTLS). Pour les applications L1 et L2, la rotation des jetons d'actualisation peut être utilisée. Si cette rotation est utilisée, le serveur d'autorisation doit invalider le jeton d'actualisation après utilisation et révoquer tous les jetons d'actualisation de cette autorisation si un jeton d'actualisation déjà utilisé et invalidé est fourni.",✓,✓,✓,, +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.6,"Vérifiez que, si l'octroi de code est utilisé, le serveur d'autorisation atténue les attaques par interception de code en exigeant une clé de preuve pour l'échange de code (PKCE). Pour les demandes d'autorisation, le serveur d'autorisation doit exiger une valeur « code_challenge » valide et ne doit pas accepter une valeur « plain » pour « code_challenge_method ». Pour une demande de jeton, il doit exiger la validation du paramètre « code_verifier ».",,✓,✓,, +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.7,"Vérifiez que si le serveur d'autorisation prend en charge l'enregistrement dynamique des clients non authentifiés, il réduit le risque d'applications clientes malveillantes. Il doit valider les métadonnées clientes, telles que les URI enregistrés, garantir le consentement de l'utilisateur et l'avertir avant de traiter une demande d'autorisation avec une application cliente non approuvée.",,✓,✓,, +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.8,"Vérifiez que les jetons d’actualisation ont une expiration absolue, y compris si l’expiration du jeton d’actualisation glissant est appliquée.",,✓,✓,, +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.9,"Vérifiez que les jetons d'actualisation et les jetons d'accès de référence peuvent être révoqués par un utilisateur autorisé à l'aide de l'interface utilisateur du serveur d'autorisation, afin d'atténuer le risque de clients malveillants ou de jetons volés.",,✓,✓,, +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.10,"Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.",,✓,✓,, +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.11,"Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.",,✓,✓,, +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.12,"Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement la valeur « response_mode » dont ce client a besoin. Par exemple, en vérifiant cette valeur par rapport aux valeurs attendues ou en utilisant une requête d'autorisation poussée (PAR) ou une requête d'autorisation sécurisée par JWT (JAR).",,,✓,, +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.13,Vérifiez que le type d'Autorisation « code » est toujours utilisé avec les demandes d'autorisation poussées (PAR).,,,✓,, +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.14,"Vérifiez que le serveur d'autorisation émet uniquement des jetons d'accès limités à l'expéditeur (preuve de possession), soit avec des jetons d'accès liés au certificat utilisant TLS mutuel (mTLS), soit avec des jetons d'accès liés au DPoP (démonstration de preuve de possession).",,,✓,, +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.15,"Vérifiez que, pour un client côté serveur (non exécuté sur l'appareil de l'utilisateur final), le serveur d'autorisation garantit que la valeur du paramètre « authorization_details » provient du backend client et que l'utilisateur ne l'a pas altérée. Par exemple, en exigeant l'utilisation d'une demande d'autorisation poussée (PAR) ou d'une demande d'autorisation sécurisée par JWT (JAR).",,,✓,, +V10,Oauth et OIDC,V10.4,Serveur d'autorisation OAuth,V10.4.16,"Vérifiez que le client est confidentiel et que le serveur d'autorisation requiert l'utilisation de méthodes d'authentification client fortes (basées sur la cryptographie à clé publique et résistantes aux attaques par relecture), telles que TLS mutuel ('tls_client_auth', 'self_signed_tls_client_auth') ou JWT à clé privée ('private_key_jwt').",,,✓,, +V10,Oauth et OIDC,V10.5,Client OIDC,V10.5.1,"Vérifiez que le client (en tant que partie utilisatrice) atténue les attaques par rejeu de jeton d'identification. Par exemple, en vous assurant que la valeur « nonce » du jeton d'identification correspond à la valeur « nonce » envoyée dans la demande d'authentification au fournisseur OpenID (appelée demande d'autorisation envoyée au serveur d'autorisation dans OAuth2).",,✓,✓,, +V10,Oauth et OIDC,V10.5,Client OIDC,V10.5.2,"Vérifiez que le client identifie de manière unique l'utilisateur à partir des déclarations de jeton d'identification, généralement la déclaration « sub », qui ne peut pas être réaffectée à d'autres utilisateurs (pour la portée d'un fournisseur d'identité).",,✓,✓,, +V10,Oauth et OIDC,V10.5,Client OIDC,V10.5.3,Vérifiez que le client rejette les tentatives d'un serveur d'autorisation malveillant d'usurper l'identité d'un autre serveur d'autorisation via ses métadonnées. Le client doit rejeter les métadonnées du serveur d'autorisation si l'URL de l'émetteur figurant dans ces métadonnées ne correspond pas exactement à l'URL d'émetteur préconfigurée attendue par le client.,,✓,✓,, +V10,Oauth et OIDC,V10.5,Client OIDC,V10.5.4,Vérifiez que le client valide que le jeton d'identification est destiné à être utilisé pour ce client (audience) en vérifiant que la déclaration « aud » du jeton est égale à la valeur « client_id » pour le client.,,✓,✓,, +V10,Oauth et OIDC,V10.5,Client OIDC,V10.5.5,"Vérifiez que, lors de l'utilisation de la déconnexion du back-channel OIDC, la partie utilisatrice atténue les risques de déni de service liés à la déconnexion forcée et à la confusion entre JWT dans le flux de déconnexion. Le client doit vérifier que le jeton de déconnexion est correctement typé avec la valeur « logout+jwt », qu'il contient la déclaration « event » avec le nom de membre correct et qu'il ne contient pas de déclaration « nonce ». Il est également recommandé d'utiliser une expiration courte (par exemple, 2 minutes).",,✓,✓,, +V10,Oauth et OIDC,V10.6,Fournisseur OpenID,V10.6.1,"Vérifiez que le fournisseur OpenID n'autorise que les valeurs « code », « ciba », « id_token » ou « id_token code » pour le mode de réponse. Notez que « code » est préférable à « id_token code » (flux hybride OIDC) et que « token » (tout flux implicite) ne doit pas être utilisé.",,✓,✓,, +V10,Oauth et OIDC,V10.6,Fournisseur OpenID,V10.6.2,"Vérifiez que le fournisseur OpenID atténue les risques de déni de service liés à la déconnexion forcée. Pour ce faire, obtenez une confirmation explicite de l'utilisateur final ou, le cas échéant, validez les paramètres de la requête de déconnexion (initiée par la partie utilisatrice), comme « id_token_hint ».",,✓,✓,, +V10,Oauth et OIDC,V10.7,Gestion du consentement,V10.7.1,"Vérifiez que le serveur d'autorisation garantit le consentement de l'utilisateur à chaque demande d'autorisation. Si l'identité du client ne peut être garantie, le serveur d'autorisation doit toujours demander explicitement le consentement de l'utilisateur.",,✓,✓,, +V10,Oauth et OIDC,V10.7,Gestion du consentement,V10.7.2,"Vérifiez que lorsque le serveur d'autorisation demande le consentement de l'utilisateur, il fournit des informations claires et suffisantes sur ce qui est consenti. Le cas échéant, ces informations doivent inclure la nature des autorisations demandées (généralement en fonction de la portée, du serveur de ressources et des détails d'autorisation RAR), l'identité de l'application autorisée et la durée de vie de ces autorisations.",,✓,✓,, +V10,Oauth et OIDC,V10.7,Gestion du consentement,V10.7.3,"Vérifiez que l’utilisateur peut consulter, modifier et révoquer les consentements qu’il a accordés via le serveur d’autorisation.",,✓,✓,, +V11,Cryptographie,V11.1,Inventaire et documentation cryptographiques,V11.1.1,"Vérifiez qu’il existe une politique documentée pour la gestion des clés cryptographiques et un cycle de vie des clés cryptographiques qui suit une norme de gestion des clés telle que NIST SP 800-57. Cela devrait inclure la garantie que les clés ne sont pas sur-partagées (par exemple, avec plus de deux entités pour les secrets partagés et plus d’une entité pour les clés privées).",,✓,✓,, +V11,Cryptographie,V11.1,Inventaire et documentation cryptographiques,V11.1.2,"Vérifiez qu'un inventaire cryptographique est réalisé, maintenu et régulièrement mis à jour, et qu'il inclut toutes les clés, algorithmes et certificats cryptographiques utilisés par l'application. Il doit également documenter les emplacements du système où les clés peuvent ou non être utilisées, ainsi que les types de données qui peuvent ou non être protégées par ces clés.",,✓,✓,, +V11,Cryptographie,V11.1,Inventaire et documentation cryptographiques,V11.1.3,"Vérifiez que les mécanismes de découverte cryptographique sont utilisés pour identifier toutes les instances de cryptographie dans le système, y compris les opérations de chiffrement, de hachage et de signature.",,,✓,, +V11,Cryptographie,V11.1,Inventaire et documentation cryptographiques,V11.1.4,"Vérifier la tenue d'un inventaire cryptographique. Celui-ci doit inclure un plan documenté décrivant la migration vers de nouvelles normes cryptographiques, telles que la cryptographie post-quantique, afin de réagir aux menaces futures.",,,✓,, +V11,Cryptographie,V11.2,Mise en œuvre sécurisée de la cryptographie,V11.2.1,Vérifiez que les implémentations validées par l’industrie (y compris les bibliothèques et les implémentations accélérées par le matériel) sont utilisées pour les opérations cryptographiques.,,✓,✓,, +V11,Cryptographie,V11.2,Mise en œuvre sécurisée de la cryptographie,V11.2.2,"Vérifiez que l'application est conçue avec une agilité cryptographique, de sorte que les nombres aléatoires, le chiffrement authentifié, le MAC ou les algorithmes de hachage, les longueurs de clés, les tours, les chiffrements et les modes puissent être reconfigurés, mis à niveau ou échangés à tout moment, afin de se protéger contre les failles cryptographiques. De même, il doit être possible de remplacer les clés et les mots de passe, ainsi que de rechiffrer les données. Cela permettra des mises à niveau transparentes vers la cryptographie post-quantique (PQC), une fois que des implémentations hautement sécurisées de schémas ou de normes PQC approuvés seront largement disponibles.",,✓,✓,, +V11,Cryptographie,V11.2,Mise en œuvre sécurisée de la cryptographie,V11.2.3,"Vérifiez que toutes les primitives cryptographiques utilisent un minimum de 128 bits de sécurité en fonction de l'algorithme, de la taille de la clé et de la configuration. Par exemple, une clé ECC de 256 bits offre environ 128 bits de sécurité, tandis que RSA nécessite une clé de 3072 bits pour atteindre 128 bits de sécurité.",,✓,✓,, +V11,Cryptographie,V11.2,Mise en œuvre sécurisée de la cryptographie,V11.2.4,"Vérifiez que toutes les opérations cryptographiques sont à temps constant, sans opérations de « court-circuit » dans les comparaisons, les calculs ou les retours, pour éviter toute fuite d'informations.",,,✓,, +V11,Cryptographie,V11.2,Mise en œuvre sécurisée de la cryptographie,V11.2.5,"Vérifiez que tous les modules cryptographiques échouent en toute sécurité et que les erreurs sont gérées de manière à ne pas permettre de vulnérabilités, telles que les attaques Padding Oracle.",,,✓,, +V11,Cryptographie,V11.3,Algorithmes de chiffrement,V11.3.1,"Vérifiez que les modes de bloc non sécurisés (par exemple, ECB) et les schémas de remplissage faibles (par exemple, PKCS#1 v1.5) ne sont pas utilisés.",✓,✓,✓,, +V11,Cryptographie,V11.3,Algorithmes de chiffrement,V11.3.2,Vérifiez que seuls les chiffrements et modes approuvés tels que AES avec GCM sont utilisés.,✓,✓,✓,, +V11,Cryptographie,V11.3,Algorithmes de chiffrement,V11.3.3,"Vérifiez que les données chiffrées sont protégées contre toute modification non autorisée, de préférence en utilisant une méthode de chiffrement authentifiée approuvée ou en combinant une méthode de chiffrement approuvée avec un algorithme MAC approuvé.",,✓,✓,, +V11,Cryptographie,V11.3,Algorithmes de chiffrement,V11.3.4,"Vérifiez que les nonces, les vecteurs d'initialisation et autres nombres à usage unique ne sont pas utilisés pour plus d'une paire clé de chiffrement/élément de données. La méthode de génération doit être adaptée à l'algorithme utilisé.",,,✓,, +V11,Cryptographie,V11.3,Algorithmes de chiffrement,V11.3.5,Vérifiez que toute combinaison d'un algorithme de chiffrement et d'un algorithme MAC fonctionne en mode chiffrement puis MAC.,,,✓,, +V11,Cryptographie,V11.4,Hachage et fonctions basées sur le hachage,V11.4.1,"Vérifiez que seules les fonctions de hachage approuvées sont utilisées pour les cas d'utilisation cryptographiques généraux, notamment les signatures numériques, HMAC, KDF et la génération de bits aléatoires. Les fonctions de hachage non autorisées, telles que MD5, ne doivent pas être utilisées à des fins cryptographiques.",✓,✓,✓,, +V11,Cryptographie,V11.4,Hachage et fonctions basées sur le hachage,V11.4.2,"Vérifiez que les mots de passe sont stockés à l'aide d'une fonction de dérivation de clés approuvée et gourmande en ressources de calcul (également appelée « fonction de hachage de mots de passe »), dont les paramètres sont configurés conformément aux directives en vigueur. Ces paramètres doivent équilibrer sécurité et performances afin de rendre les attaques par force brute suffisamment difficiles pour le niveau de sécurité requis.",,✓,✓,, +V11,Cryptographie,V11.4,Hachage et fonctions basées sur le hachage,V11.4.3,"Vérifiez que les fonctions de hachage utilisées dans les signatures numériques, dans le cadre de l'authentification ou de l'intégrité des données, sont résistantes aux collisions et possèdent des longueurs de bits appropriées. Si la résistance aux collisions est requise, la longueur de sortie doit être d'au moins 256 bits. Si seule la résistance aux attaques de seconde pré-image est requise, la longueur de sortie doit être d'au moins 128 bits.",,✓,✓,, +V11,Cryptographie,V11.4,Hachage et fonctions basées sur le hachage,V11.4.4,Vérifiez que l'application utilise des fonctions de dérivation de clés approuvées avec des paramètres d'extension de clés lors de la dérivation de clés secrètes à partir de mots de passe. Les paramètres utilisés doivent concilier sécurité et performances afin d'empêcher les attaques par force brute de compromettre la clé cryptographique obtenue.,,✓,✓,, +V11,Cryptographie,V11.5,Valeurs aléatoires,V11.5.1,Vérifiez que tous les nombres et chaînes aléatoires destinés à être non devinables doivent être générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et posséder au moins 128 bits d'entropie. Notez que les UUID ne respectent pas cette condition.,,✓,✓,, +V11,Cryptographie,V11.5,Valeurs aléatoires,V11.5.2,"Vérifiez que le mécanisme de génération de nombres aléatoires utilisé est conçu pour fonctionner en toute sécurité, même en cas de forte demande.",,,✓,, +V11,Cryptographie,V11.6,Cryptographie à clé publique,V11.6.1,"Vérifier que seuls des algorithmes cryptographiques et des modes opératoires approuvés sont utilisés pour la génération et l'amorçage des clés, ainsi que pour la génération et la vérification des signatures numériques. Les algorithmes de génération de clés ne doivent pas générer de clés non sécurisées et vulnérables aux attaques connues, par exemple les clés RSA vulnérables à la factorisation de Fermat.",,✓,✓,, +V11,Cryptographie,V11.6,Cryptographie à clé publique,V11.6.2,"Vérifiez que des algorithmes cryptographiques approuvés sont utilisés pour l'échange de clés (tels que Diffie-Hellman), en veillant à ce que les mécanismes d'échange de clés utilisent des paramètres sécurisés. Cela permettra d'éviter les attaques contre le processus d'établissement des clés, susceptibles de conduire à des attaques de type « adversaire du milieu » ou à des failles cryptographiques.",,,✓,, +V11,Cryptographie,V11.7,Cryptographie des données en cours d'utilisation,V11.7.1,"Vérifiez que le chiffrement complet de la mémoire est utilisé pour protéger les données sensibles pendant leur utilisation, empêchant ainsi l'accès par des utilisateurs ou des processus non autorisés.",,,✓,, +V11,Cryptographie,V11.7,Cryptographie des données en cours d'utilisation,V11.7.2,Vérifiez que la minimisation des données garantit que la quantité minimale de données est exposée pendant le traitement et assurez-vous que les données sont chiffrées immédiatement après utilisation ou dès que possible.,,,✓,, +V12,Communication sécurisée,V12.1,Conseils généraux de sécurité TLS,V12.1.1,"Vérifiez que seules les dernières versions recommandées du protocole TLS sont activées, telles que TLS 1.2 et TLS 1.3. La dernière version du protocole TLS doit être privilégiée.",✓,✓,✓,, +V12,Communication sécurisée,V12.1,Conseils généraux de sécurité TLS,V12.1.2,"Vérifiez que seules les suites de chiffrement recommandées sont activées, les suites de chiffrement les plus puissantes étant définies comme préférées. Les applications L3 doivent uniquement prendre en charge les suites de chiffrement assurant la confidentialité persistante (forward secrecy).",,✓,✓,, +V12,Communication sécurisée,V12.1,Conseils généraux de sécurité TLS,V12.1.3,Vérifiez que l’application valide que les certificats clients mTLS sont approuvés avant d’utiliser l’identité du certificat pour l’authentification ou l’autorisation.,,✓,✓,, +V12,Communication sécurisée,V12.1,Conseils généraux de sécurité TLS,V12.1.4,"Vérifiez que la révocation de certification appropriée, telle que l'agrafage du protocole OCSP (Online Certificate Status Protocol), est activée et configurée.",,,✓,, +V12,Communication sécurisée,V12.1,Conseils généraux de sécurité TLS,V12.1.5,"Vérifiez que Encrypted Client Hello (ECH) est activé dans les paramètres TLS de l'application pour empêcher l'exposition de métadonnées sensibles, telles que l'indication du nom du serveur (SNI), pendant les processus de négociation TLS.",,,✓,, +V12,Communication sécurisée,V12.2,Communication HTTPS avec des services externes,V12.2.1,"Vérifiez que TLS est utilisé pour toute connectivité entre un client et des services externes basés sur HTTP, et ne recourt pas à des communications non sécurisées ou non chiffrées.",✓,✓,✓,, +V12,Communication sécurisée,V12.2,Communication HTTPS avec des services externes,V12.2.2,Vérifiez que les services externes utilisent des certificats TLS publiquement approuvés.,✓,✓,✓,, +V12,Communication sécurisée,V12.3,Sécurité des communications entre services généraux,V12.3.1,"Vérifiez qu'un protocole chiffré tel que TLS est utilisé pour toutes les connexions entrantes et sortantes vers et depuis l'application, y compris les systèmes de surveillance, les outils de gestion, l'accès à distance et SSH, les intergiciels, les bases de données, les mainframes, les systèmes partenaires ou les API externes. Le serveur ne doit pas recourir à des protocoles non sécurisés ou non chiffrés.",,✓,✓,, +V12,Communication sécurisée,V12.3,Sécurité des communications entre services généraux,V12.3.2,Vérifiez que les clients TLS valident les certificats reçus avant de communiquer avec un serveur TLS.,,✓,✓,, +V12,Communication sécurisée,V12.3,Sécurité des communications entre services généraux,V12.3.3,Vérifiez que TLS ou un autre mécanisme de chiffrement de transport approprié est utilisé pour toute connectivité entre les services internes basés sur HTTP au sein de l'application et ne se replie pas vers des communications non sécurisées ou non chiffrées.,,✓,✓,, +V12,Communication sécurisée,V12.3,Sécurité des communications entre services généraux,V12.3.4,"Vérifiez que les connexions TLS entre les services internes utilisent des certificats de confiance. Lorsque des certificats générés en interne ou auto-signés sont utilisés, le service consommateur doit être configuré pour n'approuver que des autorités de certification internes spécifiques et des certificats auto-signés spécifiques.",,✓,✓,, +V12,Communication sécurisée,V12.3,Sécurité des communications entre services généraux,V12.3.5,"Vérifiez que les services communiquant en interne au sein d'un système (communications intra-services) utilisent une authentification forte pour garantir la vérification de chaque endpoint. Des méthodes d'authentification forte, telles que l'authentification client TLS, doivent être utilisées pour garantir l'identité, en utilisant une infrastructure à clé publique et des mécanismes résistants aux attaques par rejeu. Pour les architectures de microservices, envisagez d'utiliser un maillage de services pour simplifier la gestion des certificats et renforcer la sécurité.",,,✓,, +V13,Configuration,V13.1,Documentation de configuration,V13.1.1,Vérifiez que tous les besoins de communication de l'application sont documentés. Cela doit inclure les services externes dont l'application dépend et les cas où un utilisateur final pourrait fournir un emplacement externe auquel l'application se connectera.,,✓,✓,, +V13,Configuration,V13.1,Documentation de configuration,V13.1.2,"Vérifiez que pour chaque service utilisé par l'application, la documentation définit le nombre maximal de connexions simultanées (par exemple, les limites du pool de connexions) et le comportement de l'application lorsque cette limite est atteinte, y compris les mécanismes de secours ou de récupération, pour éviter les conditions de déni de service.",,,✓,, +V13,Configuration,V13.1,Documentation de configuration,V13.1.3,"Vérifiez que la documentation de l'application définit des stratégies de gestion des ressources pour chaque système ou service externe utilisé (par exemple, bases de données, descripteurs de fichiers, threads, connexions HTTP). Cela doit inclure les procédures de libération des ressources, les paramètres de délai d'expiration, la gestion des échecs et l'implémentation de la logique de nouvelle tentative, en spécifiant les limites de nouvelle tentative, les délais et les algorithmes de retour arrière. Pour les opérations de requête-réponse HTTP synchrones, la documentation doit imposer des délais d'expiration courts et soit désactiver les nouvelles tentatives, soit les limiter strictement afin d'éviter les retards en cascade et l'épuisement des ressources.",,,✓,, +V13,Configuration,V13.1,Documentation de configuration,V13.1.4,"Vérifiez que la documentation de l'application définit les secrets essentiels à la sécurité de l'application et un calendrier de rotation de ceux-ci, en fonction du modèle de menace et des exigences commerciales de l'organisation.",,,✓,, +V13,Configuration,V13.2,Configuration de la communication backend,V13.2.1,"Vérifiez que les communications entre les composants de l'application backend qui ne prennent pas en charge le mécanisme de session utilisateur standard de l'application, notamment les API, les intergiciels et les couches de données, sont authentifiées. L'authentification doit utiliser des comptes de service individuels, des jetons à court terme ou une authentification par certificat, et non des identifiants immuables tels que des mots de passe, des clés API ou des comptes partagés avec accès privilégié.",,✓,✓,, +V13,Configuration,V13.2,Configuration de la communication backend,V13.2.2,"Vérifiez que les communications entre les composants de l'application backend, y compris les services locaux ou du système d'exploitation, les API, les intergiciels et les couches de données, sont effectuées avec des comptes dotés des privilèges les moins nécessaires.",,✓,✓,, +V13,Configuration,V13.2,Configuration de la communication backend,V13.2.3,"Vérifiez que si des informations d’identification doivent être utilisées pour l’authentification du service, les informations d’identification utilisées par le consommateur ne sont pas des informations d’identification par défaut (par exemple, root/root ou admin/admin).",,✓,✓,, +V13,Configuration,V13.2,Configuration de la communication backend,V13.2.4,"Vérifiez qu'une liste d’autorisations est utilisée pour définir les ressources ou systèmes externes avec lesquels l'application est autorisée à communiquer (par exemple, pour les requêtes sortantes, les chargements de données ou l'accès aux fichiers). Cette liste d'autorisation peut être implémentée au niveau de la couche applicative, du serveur web, du pare-feu ou d'une combinaison de différentes couches.",,✓,✓,, +V13,Configuration,V13.2,Configuration de la communication backend,V13.2.5,Vérifiez que le serveur Web ou d’application est configuré avec une liste autorisée de ressources ou de systèmes vers lesquels le serveur peut envoyer des requêtes ou charger des données ou des fichiers.,,✓,✓,, +V13,Configuration,V13.2,Configuration de la communication backend,V13.2.6,"Vérifiez que lorsque l'application se connecte à des services distincts, elle suit la configuration documentée pour chaque connexion, comme le nombre maximal de connexions parallèles, le comportement lorsque le nombre maximal de connexions autorisées est atteint, les délais d'expiration de connexion et les stratégies de nouvelle tentative.",,,✓,, +V13,Configuration,V13.3,Gestion des secrets,V13.3.1,"Vérifiez qu'une solution de gestion des secrets, telle qu'un coffre-fort de clés, est utilisée pour créer, stocker, contrôler l'accès et détruire en toute sécurité les secrets backend. Ceux-ci peuvent inclure des mots de passe, du matériel de clé, des intégrations avec des bases de données et des systèmes tiers, des clés et des graines pour des jetons temporels, d'autres secrets internes et des clés API. Les secrets ne doivent pas être inclus dans le code source de l'application ni dans les artefacts de build. Pour une application L3, cela doit impliquer une solution matérielle telle qu'un HSM.",,✓,✓,, +V13,Configuration,V13.3,Gestion des secrets,V13.3.2,Vérifiez que l’accès aux ressources secrètes respecte le principe du moindre privilège.,,✓,✓,, +V13,Configuration,V13.3,Gestion des secrets,V13.3.3,Vérifiez que toutes les opérations cryptographiques sont effectuées à l'aide d'un module de sécurité isolé (tel qu'un coffre-fort ou un module de sécurité matériel) pour gérer et protéger en toute sécurité le matériel clé contre toute exposition en dehors du module de sécurité.,,,✓,, +V13,Configuration,V13.3,Gestion des secrets,V13.3.4,Vérifiez que les secrets sont configurés pour expirer et être renouvelés en fonction de la documentation de l'application.,,,✓,, +V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.1,"Vérifiez que l'application est déployée soit sans aucune métadonnée de contrôle de source, y compris les dossiers .git ou .svn, soit de manière à ce que ces dossiers soient inaccessibles à la fois en externe et à l'application elle-même.",✓,✓,✓,, +V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.2,Vérifiez que les modes de débogage sont désactivés pour tous les composants dans les environnements de production afin d’éviter l’exposition des fonctionnalités de débogage et la fuite d’informations.,,✓,✓,, +V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.3,"Vérifiez que les serveurs Web n’exposent pas les listes de répertoires aux clients, sauf si cela est explicitement prévu.",,✓,✓,, +V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.4,"Vérifiez que l’utilisation de la méthode HTTP TRACE n’est pas prise en charge dans les environnements de production, afin d’éviter toute fuite d’informations potentielle.",,✓,✓,, +V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.5,"Vérifiez que la documentation (comme pour les API internes) et les endpoints de surveillance ne sont pas exposés, sauf si cela est explicitement prévu.",,✓,✓,, +V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.6,Vérifiez que l’application n’expose pas d’informations de version détaillées des composants backend.,,,✓,, +V13,Configuration,V13.4,Fuite d'informations involontaire,V13.4.7,"Vérifiez que la couche web est configuré pour servir uniquement les fichiers avec des extensions de fichier spécifiques afin d’éviter toute fuite involontaire d’informations, de configuration et de code source.",,,✓,, +V14,Protection des données,V14.1,Documentation sur la protection des données,V14.1.1,"Vérifiez que toutes les données sensibles créées et traitées par l'application ont été identifiées et classées selon leur niveau de protection. Cela inclut les données uniquement codées et donc facilement déchiffrables, telles que les chaînes Base64 ou la charge utile en texte clair d'un JWT. Les niveaux de protection doivent tenir compte des réglementations et normes de protection des données et de confidentialité auxquelles l'application est tenue de se conformer.",,✓,✓,, +V14,Protection des données,V14.1,Documentation sur la protection des données,V14.1.2,"Vérifier que tous les niveaux de protection des données sensibles sont assortis d'un ensemble documenté d'exigences de protection. Cela doit inclure (sans s'y limiter) les exigences relatives au chiffrement général, à la vérification de l'intégrité, à la conservation, à la journalisation des données, aux contrôles d'accès aux données sensibles dans les journaux, au chiffrement au niveau de la base de données, aux technologies de confidentialité et de renforcement de la confidentialité à utiliser, ainsi qu'aux autres exigences de confidentialité.",,✓,✓,, +V14,Protection des données,V14.2,Protection générale des données,V14.2.1,"Vérifiez que les données sensibles sont uniquement envoyées au serveur dans les champs de corps ou d’en-tête du message HTTP, et que l’URL et la chaîne de requête ne contiennent pas d’informations sensibles, telles qu’une clé API ou un jeton de session.",✓,✓,✓,, +V14,Protection des données,V14.2,Protection générale des données,V14.2.2,"Vérifiez que l’application empêche la mise en cache des données sensibles dans les composants du serveur, tels que les équilibreurs de charge et les caches d’application, ou garantit que les données sont purgées en toute sécurité après utilisation.",,✓,✓,, +V14,Protection des données,V14.2,Protection générale des données,V14.2.3,"Vérifiez que les données sensibles définies ne sont pas envoyées à des parties non fiables (par exemple, des trackers d'utilisateurs) pour empêcher la collecte indésirable de données en dehors du contrôle de l'application.",,✓,✓,, +V14,Protection des données,V14.2,Protection générale des données,V14.2.4,"Vérifiez que les contrôles autour des données sensibles liés au chiffrement, à la vérification de l'intégrité, à la conservation, à la manière dont les données doivent être enregistrées, aux contrôles d'accès autour des données sensibles dans les journaux, à la confidentialité et aux technologies d'amélioration de la confidentialité, sont mis en œuvre comme défini dans la documentation pour le niveau de protection des données spécifiques.",,✓,✓,, +V14,Protection des données,V14.2,Protection générale des données,V14.2.5,Vérifiez que les mécanismes de mise en cache sont configurés pour ne mettre en cache que les réponses dont le type de contenu est conforme à la ressource et qui ne contiennent pas de contenu sensible et dynamique. Le serveur web doit renvoyer une réponse 404 ou 302 lors de l'accès à un fichier inexistant plutôt qu'un fichier valide différent. Cela devrait empêcher les attaques par empoisonnement de cache web.,,,✓,, +V14,Protection des données,V14.2,Protection générale des données,V14.2.6,"Vérifiez que l'application ne renvoie que les données sensibles minimales requises pour son fonctionnement. Par exemple, ne renvoyez que certains chiffres d'un numéro de carte de crédit, et non le numéro complet. Si les données complètes sont requises, elles doivent être masquées dans l'interface utilisateur, sauf si l'utilisateur les consulte spécifiquement.",,,✓,, +V14,Protection des données,V14.2,Protection générale des données,V14.2.7,"Vérifiez que les informations sensibles sont soumises à une classification de conservation des données, en veillant à ce que les données obsolètes ou inutiles soient supprimées automatiquement, selon un calendrier défini ou selon les besoins de la situation.",,,✓,, +V14,Protection des données,V14.2,Protection générale des données,V14.2.8,"Vérifiez que les informations sensibles sont supprimées des métadonnées des fichiers soumis par l'utilisateur, sauf si le stockage est autorisé par l'utilisateur.",,,✓,, +V14,Protection des données,V14.3,Protection des données côté client,V14.3.1,"Vérifiez que les données authentifiées sont effacées du stockage client, comme le DOM du navigateur, après la fin du client ou de la session. Le champ d'en-tête de réponse HTTP « Clear-Site-Data » peut être utile, mais le côté client devrait également pouvoir effectuer la correction si la connexion au serveur n'est pas disponible à la fin de la session.",✓,✓,✓,, +V14,Protection des données,V14.3,Protection des données côté client,V14.3.2,Vérifiez que l'application définit suffisamment de champs d'en-tête de réponse HTTP anti-caching (c'est-à-dire Cache-Control : no-store) afin que les données sensibles ne soient pas mises en cache dans les navigateurs.,,✓,✓,, +V14,Protection des données,V14.3,Protection des données côté client,V14.3.3,"Vérifiez que les données stockées dans le stockage du navigateur (telles que localStorage, sessionStorage, IndexedDB ou les cookies) ne contiennent pas de données sensibles, à l'exception des jetons de session.",,✓,✓,, +V15,Développement et architecture sécurisés,V15.1,Documentation sur le développement et l'architecture sécurisés,V15.1.1,"Vérifiez que la documentation de l'application définit les délais de correction basés sur les risques pour les versions de composants tiers présentant des vulnérabilités et pour la mise à jour des bibliothèques en général, afin de minimiser les risques liés à ces composants.",✓,✓,✓,, +V15,Développement et architecture sécurisés,V15.1,Documentation sur le développement et l'architecture sécurisés,V15.1.2,"Vérifiez qu'un catalogue d'inventaire, tel qu'une nomenclature logicielle (SBOM), est conservé pour toutes les bibliothèques tierces utilisées, y compris en vérifiant que les composants proviennent de référentiels prédéfinis, fiables et continuellement maintenus.",,✓,✓,, +V15,Développement et architecture sécurisés,V15.1,Documentation sur le développement et l'architecture sécurisés,V15.1.3,"Vérifiez que la documentation de l'application identifie les fonctionnalités consommatrices en temps ou gourmandes en ressources. Elle doit notamment indiquer comment prévenir une perte de disponibilité due à une utilisation excessive de ces fonctionnalités et éviter que la génération d'une réponse ne prenne plus de temps que le délai d'expiration du consommateur. Les mesures de protection potentielles peuvent inclure le traitement asynchrone, l'utilisation de files d'attente et la limitation des processus parallèles par utilisateur et par application.",,✓,✓,, +V15,Développement et architecture sécurisés,V15.1,Documentation sur le développement et l'architecture sécurisés,V15.1.4,Vérifiez que la documentation de l’application met en évidence les bibliothèques tierces qui sont considérées comme des « composants à risque ».,,,✓,, +V15,Développement et architecture sécurisés,V15.1,Documentation sur le développement et l'architecture sécurisés,V15.1.5,Vérifiez que la documentation de l’application met en évidence les parties de l’application où des « fonctionnalités dangereuses » sont utilisées.,,,✓,, +V15,Développement et architecture sécurisés,V15.2,Architecture de sécurité et dépendances,V15.2.1,Vérifiez que l’application contient uniquement des composants qui n’ont pas dépassé les délais de mise à jour et de correction documentés.,✓,✓,✓,, +V15,Développement et architecture sécurisés,V15.2,Architecture de sécurité et dépendances,V15.2.2,"Vérifiez que l'application a mis en œuvre des défenses contre la perte de disponibilité due à des fonctionnalités qui prennent du temps ou qui nécessitent des ressources, sur la base des décisions et stratégies de sécurité documentées à cet effet.",,✓,✓,, +V15,Développement et architecture sécurisés,V15.2,Architecture de sécurité et dépendances,V15.2.3,"Vérifiez que l'environnement de production inclut uniquement les fonctionnalités nécessaires au fonctionnement de l'application et n'expose pas de fonctionnalités superflues telles que du code de test, des exemples d'extraits et des fonctionnalités de développement.",,✓,✓,, +V15,Développement et architecture sécurisés,V15.2,Architecture de sécurité et dépendances,V15.2.4,"Vérifiez que les composants tiers et toutes leurs dépendances transitives sont inclus à partir du référentiel attendu, qu'il soit détenu en interne ou qu'il s'agisse d'une source externe, et qu'il n'y a aucun risque d'attaque par confusion de dépendances.",,,✓,, +V15,Développement et architecture sécurisés,V15.2,Architecture de sécurité et dépendances,V15.2.5,"Vérifiez que l'application implémente des protections supplémentaires autour des parties documentées comme contenant des « fonctionnalités dangereuses » ou utilisant des bibliothèques tierces considérées comme des « composants à risque ». Cela peut inclure des techniques telles que le sandboxing, l'encapsulation, la conteneurisation ou l'isolation au niveau du réseau pour retarder et dissuader les attaquants qui compromettent une partie de l'application de se propager ailleurs.",,,✓,, +V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.1,"Vérifiez que l'application ne renvoie que le sous-ensemble requis de champs d'un objet de données. Par exemple, elle ne doit pas renvoyer un objet de données entier, car certains champs individuels ne doivent pas être accessibles aux utilisateurs.",✓,✓,✓,, +V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.2,"Vérifiez que lorsque le backend de l'application effectue des appels vers des URL externes, il est configuré pour ne pas suivre les redirections, sauf s'il s'agit d'une fonctionnalité prévue.",,✓,✓,, +V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.3,"Vérifiez que l'application dispose de contre-mesures pour se protéger contre les attaques d'affectation de masse en limitant les champs autorisés par contrôleur et action, par exemple, il n'est pas possible d'insérer ou de mettre à jour une valeur de champ lorsqu'elle n'était pas destinée à faire partie de cette action.",,✓,✓,, +V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.4,"Vérifiez que tous les composants proxy et middleware transfèrent correctement l'adresse IP d'origine de l'utilisateur à l'aide de champs de données fiables qui ne peuvent pas être manipulés par l'utilisateur final, et que l'application et le serveur Web utilisent cette valeur correcte pour la journalisation et les décisions de sécurité telles que la limitation du débit, en tenant compte du fait que même l'adresse IP d'origine peut ne pas être fiable en raison d'adresses IP dynamiques, de VPN ou de pare-feu d'entreprise.",,✓,✓,, +V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.5,"Vérifiez que l'application garantit explicitement que les variables sont du type correct et effectue des opérations d'égalité et de comparaison strictes. Cela permet d'éviter les vulnérabilités liées à la confusion de types, causées par des hypothèses du code de l'application sur le type d'une variable.",,✓,✓,, +V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.6,"Vérifiez que le code JavaScript est écrit de manière à éviter la pollution du prototype, par exemple en utilisant Set() ou Map() au lieu de littéraux d'objet.",,✓,✓,, +V15,Développement et architecture sécurisés,V15.3,Développement défensif,V15.3.7,"Vérifiez que l'application dispose de défenses contre les attaques de pollution des paramètres HTTP, en particulier si le Framework d'application ne fait aucune distinction quant à la source des paramètres de requête (chaîne de requête, paramètres de corps, cookies ou champs d'en-tête).",,✓,✓,, +V15,Développement et architecture sécurisés,V15.4,Concurrence sécurisée,V15.4.1,"Vérifiez que les objets partagés dans le code multithread (tels que les caches, les fichiers ou les objets en mémoire accessibles par plusieurs threads) sont accessibles en toute sécurité à l'aide de types thread-safe et de mécanismes de synchronisation tels que des verrous ou des sémaphores pour éviter les conditions de concurrence et la corruption des données.",,,✓,, +V15,Développement et architecture sécurisés,V15.4,Concurrence sécurisée,V15.4.2,"Vérifiez que les vérifications de l'état d'une ressource, comme son existence ou ses autorisations, et des actions qui en dépendent, sont effectuées en une seule opération atomique afin d'éviter les situations de concurrence entre le moment de la vérification et le moment de l'utilisation (TOCTOU). Par exemple, vérifier l'existence d'un fichier avant de l'ouvrir ou l'accès d'un utilisateur avant de l'accorder.",,,✓,, +V15,Développement et architecture sécurisés,V15.4,Concurrence sécurisée,V15.4.3,"Vérifiez que les verrous sont utilisés de manière cohérente pour éviter que les threads ne se bloquent, que ce soit en s'attendant les uns les autres ou en réessayant sans fin, et que la logique de verrouillage reste dans le code responsable de la gestion de la ressource pour garantir que les verrous ne peuvent pas être modifiés par inadvertance ou de manière malveillante par des classes ou du code externes.",,,✓,, +V15,Développement et architecture sécurisés,V15.4,Concurrence sécurisée,V15.4.4,"Vérifiez que les politiques d'allocation des ressources empêchent la saturation de threads en garantissant un accès équitable aux ressources, par exemple en exploitant les pools de threads, permettant aux threads de priorité inférieure de continuer dans un délai raisonnable.",,,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.1,Documentation sur la journalisation de sécurité,V16.1.1,"Vérifiez qu'il existe un inventaire documentant la journalisation effectuée à chaque couche de la pile technologique de l'application, les événements enregistrés, les formats de journal, l'endroit où cette journalisation est stockée, la manière dont elle est utilisée, la manière dont l'accès à celle-ci est contrôlé et la durée de conservation des journaux.",,✓,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.2,Journalisation générale,V16.2.1,"Vérifiez que chaque entrée de journal inclut les métadonnées nécessaires (telles que quand, où, qui, quoi) qui permettraient une enquête détaillée sur la chronologie lorsqu'un événement se produit.",,✓,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.2,Journalisation générale,V16.2.2,Vérifiez que les sources de temps de tous les composants de journalisation sont synchronisées et que les horodatages des métadonnées des événements de sécurité utilisent le temps UTC ou incluent un décalage horaire explicite. L'UTC est recommandé pour garantir la cohérence entre les systèmes distribués et éviter toute confusion lors du passage à l'heure d'été.,,✓,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.2,Journalisation générale,V16.2.3,Vérifiez que l’application stocke ou diffuse uniquement les journaux vers les fichiers et services documentés dans l’inventaire des journaux.,,✓,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.2,Journalisation générale,V16.2.4,"Vérifiez que les journaux peuvent être lus et corrélés par le processeur de journaux utilisé, de préférence en utilisant un format de journalisation commun.",,✓,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.2,Journalisation générale,V16.2.5,"Vérifiez que l'application applique la journalisation en fonction du niveau de protection des données lors de la journalisation de données sensibles. Par exemple, certaines données, comme les identifiants ou les informations de paiement, peuvent être interdites. D'autres données, comme les jetons de session, ne peuvent être enregistrées que par hachage ou masquage, en totalité ou en partie.",,✓,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.3,Événements de sécurité,V16.3.1,"Vérifiez que toutes les opérations d'authentification sont enregistrées, y compris les tentatives réussies et infructueuses. Des métadonnées supplémentaires, telles que le type d'authentification ou les facteurs utilisés, doivent également être collectées.",,✓,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.3,Événements de sécurité,V16.3.2,"Vérifier que les tentatives d'autorisation infructueuses sont logguées. Pour le niveau 3, cela doit inclure la journalisation de toutes les décisions d'autorisation, y compris lors de l'accès à des données sensibles (sans journalisation des données sensibles elles-mêmes).",,✓,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.3,Événements de sécurité,V16.3.3,"Vérifiez que l'application enregistre les événements de sécurité définis dans la documentation et enregistre également les tentatives de contournement des contrôles de sécurité, tels que la validation des entrées, la logique métier et l'anti-automatisation.",,✓,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.3,Événements de sécurité,V16.3.4,Vérifiez que l’application enregistre les erreurs inattendues et les échecs de contrôle de sécurité tels que les échecs TLS du backend.,,✓,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.4,Protection des journaux,V16.4.1,Vérifiez que tous les composants de journalisation codent correctement les données pour empêcher l’injection de journaux.,,✓,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.4,Protection des journaux,V16.4.2,Vérifiez que les journaux sont protégés contre tout accès non autorisé et ne peuvent pas être modifiés.,,✓,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.4,Protection des journaux,V16.4.3,"Vérifiez que les journaux sont transmis de manière sécurisée à un système logique distinct pour analyse, détection, alerte et remontée des informations. L'objectif est de garantir qu'en cas de violation de l'application, les journaux ne seront pas compromis.",,✓,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.5,Gestion des erreurs,V16.5.1,"Vérifiez qu'un message générique est renvoyé au consommateur lorsqu'une erreur inattendue ou sensible à la sécurité se produit, garantissant ainsi l'absence d'exposition de données système internes sensibles telles que les traces de pile, les requêtes, les clés secrètes et les jetons.",,✓,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.5,Gestion des erreurs,V16.5.2,"Vérifiez que l'application continue de fonctionner en toute sécurité lorsque l'accès aux ressources externes échoue, par exemple, en utilisant des modèles tels que des disjoncteurs ou une dégradation progressive.",,✓,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.5,Gestion des erreurs,V16.5.3,"Vérifiez que l'application échoue proprement et sécurisée, y compris lorsqu'une exception se produit, en évitant les accès en cas d'erreur telles que le traitement d'une transaction malgré les erreurs résultant de la logique de validation.",,✓,✓,, +V16,Journalisation de sécurité et gestion des erreurs,V16.5,Gestion des erreurs,V16.5.4,"Vérifiez qu'un gestionnaire d'erreurs de « dernier recours » est défini pour intercepter toutes les exceptions non gérées. Cela permet d'éviter la perte des informations d'erreur qui doivent être loguées dans les fichiers journaux et de garantir qu'une erreur ne paralyse pas l'ensemble du processus applicatif, entraînant une perte de disponibilité.",,,✓,, +V17,WebRTC,V17.1,Serveur TURN,V17.1.1,"Vérifiez que le service TURN (Traversal Using Relays around NAT) autorise uniquement l'accès aux adresses IP non réservées à des fins spécifiques (par exemple, réseaux internes, diffusion, bouclage). Notez que cela s'applique aux adresses IPv4 et IPv6.",,✓,✓,, +V17,WebRTC,V17.1,Serveur TURN,V17.1.2,Vérifiez que le service Traversal Using Relays around NAT (TURN) n'est pas susceptible d'épuiser ses ressources lorsque des utilisateurs légitimes tentent d'ouvrir un grand nombre de ports sur le serveur TURN.,,,✓,, +V17,WebRTC,V17.2,Média,V17.2.1,Vérifiez que la clé du certificat Datagram Transport Layer Security (DTLS) est gérée et protégée conformément à la politique documentée de gestion des clés cryptographiques.,,✓,✓,, +V17,WebRTC,V17.2,Média,V17.2.2,Vérifiez que le serveur multimédia est configuré pour utiliser et prendre en charge les suites de chiffrement DTLS (Datagram Transport Layer Security) approuvées et un profil de protection sécurisé pour l'extension DTLS pour l'établissement de clés pour le protocole de transport en temps réel sécurisé (DTLS-SRTP).,,✓,✓,, +V17,WebRTC,V17.2,Média,V17.2.3,Vérifiez que l'authentification SRTP (Secure Real-time Transport Protocol) est vérifiée sur le serveur multimédia pour empêcher les attaques par injection RTP (Real-time Transport Protocol) d'entraîner une condition de déni de service ou l'insertion de médias audio ou vidéo dans les flux multimédias.,,✓,✓,, +V17,WebRTC,V17.2,Média,V17.2.4,Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant lorsqu'il rencontre des paquets SRTP (Secure Real-time Transport Protocol) mal formés.,,✓,✓,, +V17,WebRTC,V17.2,Média,V17.2.5,Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.,,,✓,, +V17,WebRTC,V17.2,Média,V17.2.6,Vérifiez que le serveur multimédia n'est pas sensible à la vulnérabilité de condition de concurrence « ClientHello » dans Datagram Transport Layer Security (DTLS) en vérifiant si le serveur multimédia est publiquement connu comme étant vulnérable ou en effectuant le test de condition de concurrence.,,,✓,, +V17,WebRTC,V17.2,Média,V17.2.7,Vérifiez que tous les mécanismes d'enregistrement audio ou vidéo associés au serveur multimédia sont en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.,,,✓,, +V17,WebRTC,V17.2,Média,V17.2.8,"Vérifiez que le certificat Datagram Transport Layer Security (DTLS) est vérifié par rapport à l'attribut d'empreinte cryptographique du protocole de description de session (SDP), en mettant fin au flux multimédia si la vérification échoue, pour garantir l'authenticité du flux multimédia.",,,✓,, +V17,WebRTC,V17.3,Signalisation,V17.3.1,Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation entrants légitimes lors d'une attaque par saturation. Cela peut être réalisé en implémentant une limitation de débit au niveau de la signalisation.,,✓,✓,, +V17,WebRTC,V17.3,Signalisation,V17.3.2,"Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation légitimes en cas de message mal formé susceptible de provoquer un déni de service. Cela peut inclure la validation des entrées, la gestion sécurisée des dépassements d'entiers, la prévention des dépassements de tampon et l'utilisation d'autres techniques robustes de gestion des erreurs.",,✓,✓,, + diff --git a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.json b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.json new file mode 100644 index 0000000000..a1fdbe08df --- /dev/null +++ b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.json @@ -0,0 +1,7259 @@ +{ + "Name": "Application Security Verification Standard Project", + "ShortName": "ASVS", + "Version": "5.0.0", + "Description": "The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.", + "Requirements": [ + { + "Shortcode": "V1", + "Ordinal": 1, + "ShortName": "Encoding", + "Name": "Encodage et nettoyage", + "Items": [ + { + "Shortcode": "V1.1", + "Ordinal": 1, + "Name": "Architecture d'encodage et de nettoyage", + "Items": [ + { + "Shortcode": "V1.1.1", + "Ordinal": 1, + "Description": "Vérifiez que l'entrée est décodée ou non échappée vers une forme canonique une seule fois, elle n'est décodée que lorsque des données codées sous cette forme sont attendues, et que cela est fait avant de traiter davantage l'entrée, par exemple, elle n'est pas effectuée après la validation ou la désinfection de l'entrée.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.1.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application effectue l'encodage et l'échappement de sortie soit comme étape finale avant d'être utilisée par l'interpréteur pour lequel elle est destinée, soit par l'interpréteur lui-même.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V1.2", + "Ordinal": 2, + "Name": "Prévention des injections", + "Items": [ + { + "Shortcode": "V1.2.1", + "Ordinal": 1, + "Description": "Vérifiez que l'encodage de sortie d'une réponse HTTP, d'un document HTML ou d'un document XML est pertinent pour le contexte requis, comme l'encodage des caractères pertinents pour les éléments HTML, les attributs HTML, les commentaires HTML, les CSS ou les champs d'en-tête HTTP, pour éviter de modifier la structure du message ou du document.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.2", + "Ordinal": 2, + "Description": "Vérifiez que, lors de la création dynamique d'URL, les données non fiables sont encodées en fonction de leur contexte (par exemple, encodage d'URL ou encodage base64url pour les paramètres de requête ou de chemin). Assurez-vous que seuls les schémas d'URL sûrs sont autorisés (par exemple, interdire javascript: ou data:).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l'encodage ou l'échappement de sortie est utilisé lors de la création dynamique de contenu JavaScript (y compris JSON), pour éviter de modifier la structure du message ou du document (pour éviter l'injection JavaScript et JSON).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.4", + "Ordinal": 4, + "Description": "Vérifiez que la sélection de données ou les requêtes de base de données (par exemple, SQL, HQL, NoSQL, Cypher) utilisent des requêtes paramétrées, des ORM, des Framework d'entités ou sont protégées contre les injections SQL et autres attaques par injection de base de données. Ceci est également pertinent lors de l'écriture de procédures stockées.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.5", + "Ordinal": 5, + "Description": "Vérifiez que l’application protège contre l’injection de commandes du système d’exploitation et que les appels du système d’exploitation utilisent des requêtes du système d’exploitation paramétrées ou utilisent un encodage de sortie de ligne de commande contextuelle.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.6", + "Ordinal": 6, + "Description": "Vérifiez que l’application protège contre les vulnérabilités d’injection LDAP ou que des contrôles de sécurité spécifiques pour empêcher l’injection LDAP ont été mis en œuvre.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.7", + "Ordinal": 7, + "Description": "Vérifiez que l’application est protégée contre les attaques par injection XPath en utilisant la paramétrisation des requêtes ou des requêtes précompilées.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.8", + "Ordinal": 8, + "Description": "Vérifiez que les processeurs LaTeX sont configurés de manière sécurisée (par exemple, en n'utilisant pas l'indicateur « --shell-escape ») et qu'une liste d’autorisations de commandes est utilisée pour empêcher les attaques par injection LaTeX.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.9", + "Ordinal": 9, + "Description": "Vérifiez que l'application échappe les caractères spéciaux dans les expressions régulières (généralement à l'aide d'une barre oblique inverse) pour éviter qu'ils ne soient mal interprétés comme des métacaractères.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.10", + "Ordinal": 10, + "Description": "Vérifiez que l'application est protégée contre les injections CSV et injections de formules. L'application doit respecter les règles d'échappement définies dans les sections 2.6 et 2.7 de la RFC 4180 lors de l'export de contenu CSV. De plus, lors de l'export au format CSV ou vers d'autres formats de tableur (tels que XLS, XLSX ou ODF), les caractères spéciaux (notamment « = », « + », « - », « @ », « \\t » (tabulation) et « \\0 » (caractère null)) doivent être protégés par une apostrophe s'ils apparaissent en premier dans une valeur de champ.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V1.3", + "Ordinal": 3, + "Name": "Nettoyage", + "Items": [ + { + "Shortcode": "V1.3.1", + "Ordinal": 1, + "Description": "Vérifiez que toutes les entrées HTML non fiables provenant d'éditeurs WYSIWYG ou similaires sont nettoyées à l'aide d'une bibliothèque ou d'une fonctionnalité de Framework de nettoyage HTML bien connue et sécurisée.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application évite d'utiliser eval() ou d'autres fonctionnalités d'exécution de code dynamique telles que Spring Expression Language (SpEL). En l'absence d'alternative, toute saisie utilisateur incluse doit être nettoyée avant d'être exécutée.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.3", + "Ordinal": 3, + "Description": "Vérifiez que les données transmises à un contexte potentiellement dangereux sont préalablement nettoyées pour appliquer des mesures de sécurité, telles qu'autoriser uniquement des caractères sûrs pour ce contexte et raccourcir des entrées trop longues.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.4", + "Ordinal": 4, + "Description": "Vérifiez que le contenu Scalable Vector Graphics (SVG) scriptable fourni par l'utilisateur est validé ou nettoyé pour contenir uniquement des balises et des attributs (tels que des graphiques de dessin) qui sont sûrs pour l'application, par exemple, ne contiennent pas de scripts et d'objets étrangers.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.5", + "Ordinal": 5, + "Description": "Vérifiez que l'application nettoie ou désactive le contenu du langage de modèle d'expression ou de script fourni par l'utilisateur, tel que les feuilles de style CSS, le Markdown ou XSL, BBCode ou similaire.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.6", + "Ordinal": 6, + "Description": "Vérifiez que l'application protège contre les attaques de falsification de requête côté serveur (SSRF), en validant les données non fiables par rapport à une liste d'autorisation de protocoles, de domaines, de chemins et de ports et en nettoyant les caractères potentiellement dangereux avant d'utiliser les données pour appeler un autre service.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.7", + "Ordinal": 7, + "Description": "Vérifiez que l'application se protège contre les attaques par injection de modèles en interdisant la création de modèles basés sur des entrées non fiables. En l'absence d'alternative, toute entrée non fiable incluse dynamiquement lors de la création du modèle doit être nettoyée ou rigoureusement validée.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.8", + "Ordinal": 8, + "Description": "Vérifiez que l’application nettoie correctement les entrées non fiables avant utilisation dans les requêtes Java Naming and Directory Interface (JNDI) et que JNDI est configuré de manière sécurisée pour empêcher les attaques par injection JNDI.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.9", + "Ordinal": 9, + "Description": "Vérifiez que l’application nettoie le contenu avant qu’il ne soit envoyé à memcache pour éviter les attaques par injection.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.10", + "Ordinal": 10, + "Description": "Vérifiez que les chaînes de format susceptibles d'être résolues de manière inattendue ou malveillante lors de leur utilisation sont nettoyées avant d'être traitées.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.11", + "Ordinal": 11, + "Description": "Vérifiez que l'application nettoie les entrées utilisateur avant de les transmettre aux systèmes de messagerie pour se protéger contre l'injection SMTP ou IMAP.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.12", + "Ordinal": 12, + "Description": "Vérifiez que les expressions régulières sont exemptes d'éléments provoquant \"backtracking\" exponentiel et assurez-vous que les entrées non fiables sont nettoyées pour atténuer les attaques ReDoS ou Runaway Regex.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V1.4", + "Ordinal": 4, + "Name": "Mémoire, chaine de caractères et code à mémoire non-managée", + "Items": [ + { + "Shortcode": "V1.4.1", + "Ordinal": 1, + "Description": "Vérifiez que l'application utilise des chaînes memory-safe, une copie de mémoire et une arithmétique de pointeur renforcée pour détecter ou empêcher les débordements de pile, de tampon ou de tas.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.4.2", + "Ordinal": 2, + "Description": "Vérifiez que les techniques de validation du signe, de la plage et de l’entrée sont utilisées pour éviter les dépassements d’entiers.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.4.3", + "Ordinal": 3, + "Description": "Vérifiez que la mémoire et les ressources allouées dynamiquement sont libérées et que les références ou les pointeurs vers la mémoire libérée sont supprimés ou définis à null pour éviter les \"dangling pointer\" et les vulnérabilités d'utilisation après libération.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V1.5", + "Ordinal": 5, + "Name": "Désérialisation sécurisée", + "Items": [ + { + "Shortcode": "V1.5.1", + "Ordinal": 1, + "Description": "Vérifiez que l'application configure les \"parser\" XML pour utiliser une configuration restrictive et que les fonctionnalités non sûres telles que la résolution d'entités externes sont désactivées pour empêcher les attaques XML eXternal Entity (XXE).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.5.2", + "Ordinal": 2, + "Description": "Vérifiez que la désérialisation des données non fiables garantit une gestion sécurisée des entrées, par exemple en utilisant une liste d'autorisation de types d'objets ou en limitant les types d'objets définis par le client, afin d'empêcher les attaques par désérialisation. Les mécanismes de désérialisation explicitement définis comme non sécurisés ne doivent pas être utilisés avec des entrées non fiables.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.5.3", + "Ordinal": 3, + "Description": "Vérifiez que les différents \"parser\" utilisés dans l'application pour le même type de données (par exemple, les \"parser\" JSON, les \"parser\" XML, les \"parser\" d'URL) effectuent l'analyse de manière cohérente et utilisent le même mécanisme d'encodage de caractères pour éviter des problèmes tels que les vulnérabilités d'interopérabilité JSON ou un comportement d'analyse d'URI ou de fichier différent exploité dans les attaques d'inclusion de fichiers à distance (RFI) ou de falsification de requête côté serveur (SSRF).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V2", + "Ordinal": 2, + "ShortName": "Validation", + "Name": "Validation et logique métier", + "Items": [ + { + "Shortcode": "V2.1", + "Ordinal": 1, + "Name": "Validation et documentation de la logique métier", + "Items": [ + { + "Shortcode": "V2.1.1", + "Ordinal": 1, + "Description": "Vérifiez que la documentation de l'application définit des règles de validation des entrées pour vérifier la validité des éléments de données par rapport à la structure attendue. Il peut s'agir de formats de données courants tels que des numéros de carte de crédit, des adresses e-mail ou des numéros de téléphone, ou d'un format de données interne.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.1.2", + "Ordinal": 2, + "Description": "Vérifiez que la documentation de l'application définit comment valider la cohérence logique et contextuelle des éléments de données combinés, par exemple en vérifiant que la banlieue et le code postal correspondent.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.1.3", + "Ordinal": 3, + "Description": "Vérifiez que les attentes en matière de limites et de validations de la logique métier sont documentées, y compris par utilisateur et globalement dans l'application.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V2.2", + "Ordinal": 2, + "Name": "Validation des entrées", + "Items": [ + { + "Shortcode": "V2.2.1", + "Ordinal": 1, + "Description": "Vérifier que les entrées sont validées afin de respecter les attentes métier ou fonctionnelles. Cette validation doit être basée sur une liste de valeurs, de modèles et de plages autorisées, ou sur la comparaison des entrées avec une structure attendue et des limites logiques selon des règles prédéfinies. Pour le niveau 1, cette validation peut se concentrer sur les entrées utilisées pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau 2, elle doit s'appliquer à toutes les entrées.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.2.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application est conçue pour appliquer la validation des entrées au niveau d'une couche de service de confiance. Bien que la validation côté client améliore l'ergonomie et doit être encouragée, elle ne doit pas être considérée comme un contrôle de sécurité.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l’application garantit que les combinaisons d’éléments de données associés sont raisonnables selon les règles prédéfinies.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V2.3", + "Ordinal": 3, + "Name": "Sécurité de la logique métier", + "Items": [ + { + "Shortcode": "V2.3.1", + "Ordinal": 1, + "Description": "Vérifiez que l’application traitera uniquement les flux de logique métier pour le même utilisateur dans l’ordre séquentiel attendu et sans sauter d’étapes.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.3.2", + "Ordinal": 2, + "Description": "Vérifiez que les limites de la logique métier sont implémentées conformément à la documentation de l'application, afin d'éviter que des failles de la logique métier ne soient pas exploitées.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.3.3", + "Ordinal": 3, + "Description": "Vérifiez que les transactions sont utilisées au niveau de la logique métier de telle sorte qu'une opération de logique métier réussisse dans son intégralité ou qu'elle soit restaurée à l'état correct précédent.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.3.4", + "Ordinal": 4, + "Description": "Vérifiez que les mécanismes de verrouillage au niveau de la logique métier sont utilisés pour garantir que les ressources en quantité limitée (telles que les sièges de théâtre ou les créneaux de livraison) ne peuvent pas être réservées deux fois en manipulant la logique de l'application.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.3.5", + "Ordinal": 5, + "Description": "Vérifiez que les flux logiques métier à forte valeur ajoutée nécessitent l'approbation de plusieurs utilisateurs afin d'éviter toute action non autorisée ou accidentelle. Cela peut inclure, sans s'y limiter, les transferts monétaires importants, les approbations de contrats, l'accès à des informations classifiées ou les contournements de sécurité dans le secteur manufacturier.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V2.4", + "Ordinal": 4, + "Name": "Anti-automatisation", + "Items": [ + { + "Shortcode": "V2.4.1", + "Ordinal": 1, + "Description": "Vérifiez que des contrôles anti-automatisation sont en place pour protéger contre les appels excessifs aux fonctions d'application qui pourraient conduire à l'exfiltration de données, à la création de données inutiles, à l'épuisement des quotas, aux violations de limites de débit, au déni de service ou à la surutilisation de ressources coûteuses.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.4.2", + "Ordinal": 2, + "Description": "Vérifiez que les flux logiques métier nécessitent un timing humain réaliste, évitant ainsi des soumissions de transactions excessivement rapides.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V3", + "Ordinal": 3, + "ShortName": "Web", + "Name": "Sécurité du frontend Web", + "Items": [ + { + "Shortcode": "V3.1", + "Ordinal": 1, + "Name": "Documentation sur la sécurité du frontend Web", + "Items": [ + { + "Shortcode": "V3.1.1", + "Ordinal": 1, + "Description": "Vérifiez que la documentation de l'application indique les fonctionnalités de sécurité attendues que les navigateurs utilisant l'application doivent prendre en charge (telles que HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) et autres mécanismes de sécurité HTTP pertinents). Elle doit également définir le comportement de l'application lorsque certaines de ces fonctionnalités ne sont pas disponibles (par exemple, avertir l'utilisateur ou bloquer l'accès).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.2", + "Ordinal": 2, + "Name": "Interprétation non intentionnelle du contenu", + "Items": [ + { + "Shortcode": "V3.2.1", + "Ordinal": 1, + "Description": "Vérifiez que des contrôles de sécurité sont en place pour empêcher les navigateurs d'afficher du contenu ou des fonctionnalités dans les réponses HTTP dans un contexte incorrect (par exemple, lorsqu'une API, un fichier téléchargé par l'utilisateur ou une autre ressource est demandée directement). Les contrôles possibles peuvent inclure : ne pas transmettre le contenu sauf si les champs d'en-tête de requête HTTP (tels que Sec-Fetch-\\*) indiquent qu'il s'agit du contexte correct, utiliser la directive sandbox du champ d'en-tête Content-Security-Policy ou utiliser le type de disposition de pièce jointe dans le champ d'en-tête Content-Disposition.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.2.2", + "Ordinal": 2, + "Description": "Vérifiez que le contenu destiné à être affiché sous forme de texte, plutôt que rendu sous forme de HTML, est géré à l'aide de fonctions de rendu sécurisées (telles que createTextNode ou textContent) pour empêcher l'exécution involontaire de contenu tel que HTML ou JavaScript.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l'application évite l'écrasement du DOM lors de l'utilisation de JavaScript côté client en utilisant des déclarations de variables explicites, en effectuant une vérification de type stricte, en évitant de stocker des variables globales sur l'objet document et en implémentant l'isolation de l'espace de nommage.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.3", + "Ordinal": 3, + "Name": "Configuration des cookies", + "Items": [ + { + "Shortcode": "V3.3.1", + "Ordinal": 1, + "Description": "Vérifiez que les cookies ont l'attribut « Secure » ​​défini et si le préfixe « \\__Host- » n'est pas utilisé pour le nom du cookie, le préfixe « __Secure- » doit être utilisé pour le nom du cookie.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.3.2", + "Ordinal": 2, + "Description": "Vérifiez que la valeur de l'attribut « SameSite » de chaque cookie est définie en fonction de l'objectif du cookie, afin de limiter l'exposition aux attaques de réparation de l'interface utilisateur et aux attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.3.3", + "Ordinal": 3, + "Description": "Vérifiez que les cookies ont le préfixe « __Host- » pour le nom du cookie, sauf s'ils sont explicitement conçus pour être partagés avec d'autres hôtes.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.3.4", + "Ordinal": 4, + "Description": "Vérifiez que si la valeur d'un cookie n'est pas censée être accessible aux scripts côté client (comme un jeton de session), le cookie doit avoir l'attribut « HttpOnly » défini et la même valeur (par exemple, un jeton de session) ne doit être transférée au client que via le champ d'en-tête « Set-Cookie ».", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.3.5", + "Ordinal": 5, + "Description": "Vérifiez que lorsque l'application écrit un cookie, la longueur combinée du nom et de la valeur du cookie ne dépasse pas 4 096 octets. Les cookies trop volumineux ne seront pas stockés par le navigateur et ne seront donc pas envoyés avec les requêtes, empêchant ainsi l'utilisateur d'utiliser les fonctionnalités de l'application qui reposent sur ce cookie.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.4", + "Ordinal": 4, + "Name": "En-têtes du mécanisme de sécurité du navigateur", + "Items": [ + { + "Shortcode": "V3.4.1", + "Ordinal": 1, + "Description": "Vérifiez qu'un champ d'en-tête Strict-Transport-Security est inclus dans toutes les réponses afin d'appliquer une politique HTTP Strict Transport Security (HSTS). Une durée maximale d'au moins un an doit être définie, et pour les niveaux L2 et supérieurs, la politique doit également s'appliquer à tous les sous-domaines.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.2", + "Ordinal": 2, + "Description": "Vérifiez que le champ d'en-tête Access-Control-Allow-Origin du partage de ressources cross-origine (CORS) est une valeur fixe de l'application ou, si la valeur du champ d'en-tête de requête HTTP Origin est utilisée, qu'elle est validée par rapport à une liste d'origines approuvées. Si « Access-Control-Allow-Origin: * » doit être utilisé, vérifiez que la réponse ne contient aucune information sensible.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.3", + "Ordinal": 3, + "Description": "Vérifiez que les réponses HTTP incluent un champ d'en-tête de réponse Content-Security-Policy qui définit des directives garantissant que le navigateur charge et exécute uniquement du contenu ou des ressources fiables, afin de limiter l'exécution de JavaScript malveillant. Au minimum, une politique globale doit être utilisée, incluant les directives object-src 'none' et base-uri 'none', et définissant soit une lliste d’autorisations, soit des valeurs nonces ou des hachages. Pour une application L3, une politique par réponse avec des valeurs nonces ou des hachages doit être définie.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.4", + "Ordinal": 4, + "Description": "Vérifiez que toutes les réponses HTTP contiennent un champ d'en-tête « X-Content-Type-Options: nosniff ». Cela indique aux navigateurs de ne pas utiliser l'analyse de contenu ni la détection du type MIME pour la réponse donnée, et d'exiger que la valeur du champ d'en-tête « Content-Type » de la réponse corresponde à la ressource de destination. Par exemple, la réponse à une demande de style n'est acceptée que si le type de contenu de la réponse est « text/css ». Cela permet également au navigateur d'utiliser la fonctionnalité de blocage de lecture inter-origines (CORB).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.5", + "Ordinal": 5, + "Description": "Vérifiez que l'application définit une politique de référencement afin d'empêcher la fuite de données techniquement sensibles vers des services tiers via le champ d'en-tête de requête HTTP « Referer ». Cela peut être effectué via le champ d'en-tête de réponse HTTP « Referrer-Policy » ou via les attributs d'élément HTML. Les données sensibles peuvent inclure le chemin d'accès et les données de requête dans l'URL, et pour les applications internes non publiques, le nom d'hôte.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.6", + "Ordinal": 6, + "Description": "Vérifiez que l'application Web utilise la directive frame-ancestors du champ d'en-tête Content-Security-Policy pour chaque réponse HTTP afin de garantir qu'elle ne peut pas être intégrée par défaut et que l'intégration de ressources spécifiques n'est autorisée qu'en cas de nécessité. Notez que le champ d'en-tête X-Frame-Options, bien que pris en charge par les navigateurs, est obsolète et n'est pas forcément fiable.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.7", + "Ordinal": 7, + "Description": "Vérifiez que le champ d’en-tête Content-Security-Policy spécifie un emplacement pour signaler les violations.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.8", + "Ordinal": 8, + "Description": "Vérifiez que toutes les réponses HTTP qui lancent le rendu d'un document (comme les réponses de type text/html) incluent le champ d'en-tête 'Cross-Origin-Opener-Policy' avec la directive 'same-origin' ou s'ame-origin-allow-popups', selon les besoins. Cela empêche les attaques abusant de l'accès partagé aux objets Window, telles que le tabnabbing et le comptage d'images.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.5", + "Ordinal": 5, + "Name": "Séparation de l'origine du navigateur", + "Items": [ + { + "Shortcode": "V3.5.1", + "Ordinal": 1, + "Description": "Vérifiez que, si l'application ne s'appuie pas sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher les requêtes inter-origines non autorisées d'utiliser des fonctionnalités sensibles, ces requêtes sont validées afin de garantir leur origine. Cela peut se faire en utilisant et en validant des jetons anti-falsification ou en exigeant des champs d'en-tête HTTP supplémentaires qui ne sont pas des champs d'en-tête de requête CORS safelist. Ceci permet de se protéger contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.2", + "Ordinal": 2, + "Description": "Vérifiez que, si l'application s'appuie sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher l'utilisation inter-origines non autorisée de fonctionnalités sensibles, il est impossible d'appeler la fonctionnalité avec une requête qui ne déclenche pas de requête de pré-vérification cross-origin CORS. Cela peut nécessiter de vérifier les valeurs des champs d'en-tête de requête 'Origin' et 'Content-Type' ou d'utiliser un champ d'en-tête supplémentaire qui n'est pas un champ d'en-tête de la liste de sécurité CORS.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.3", + "Ordinal": 3, + "Description": "Vérifiez que les requêtes HTTP destinées aux fonctionnalités sensibles utilisent des méthodes HTTP appropriées, telles que POST, PUT, PATCH ou DELETE, et non des méthodes définies comme « sûres » par la spécification HTTP, telles que HEAD, OPTIONS ou GET. Une validation stricte des champs d'en-tête de requête Sec-Fetch-* peut également être utilisée pour garantir que la requête ne provient pas d'un appel inter-origines inapproprié, d'une requête de navigation ou d'un chargement de ressources (comme une source d'image) inattendu.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.4", + "Ordinal": 4, + "Description": "Vérifiez que des applications distinctes sont hébergées sur des noms d'hôte différents pour tirer parti des restrictions fournies par la politique de même origine, y compris la manière dont les documents ou scripts chargés par une origine peuvent interagir avec les ressources d'une autre origine et les restrictions basées sur le nom d'hôte sur les cookies.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.5", + "Ordinal": 5, + "Description": "Vérifiez que les messages reçus par l'interface postMessage sont rejetés si l'origine du message n'est pas digne de confiance ou si la syntaxe du message n'est pas valide.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.6", + "Ordinal": 6, + "Description": "Vérifiez que la fonctionnalité JSONP n'est activée nulle part dans l'application pour éviter les attaques Cross-Site Script Inclusion (XSSI).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.7", + "Ordinal": 7, + "Description": "Vérifiez que les données nécessitant une autorisation ne sont pas incluses dans les réponses des ressources de script, comme les fichiers JavaScript, pour empêcher les attaques par inclusion de script intersite (XSSI).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.8", + "Ordinal": 8, + "Description": "Vérifiez que les ressources authentifiées (telles que les images, les vidéos, les scripts et autres documents) peuvent être chargées ou intégrées pour le compte de l'utilisateur uniquement lorsque cela est prévu. Cela peut être réalisé en validant strictement les champs d'en-tête de requête HTTP Sec-Fetch-* afin de garantir que la requête ne provient pas d'un appel cross-origin inapproprié, ou en définissant un champ d'en-tête de réponse HTTP Cross-Origin-Resource-Policy restrictif pour indiquer au navigateur de bloquer le contenu renvoyé.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.6", + "Ordinal": 6, + "Name": "Intégrité des ressources externes", + "Items": [ + { + "Shortcode": "V3.6.1", + "Ordinal": 1, + "Description": "Vérifiez que les ressources côté client, telles que les bibliothèques JavaScript, les feuilles de style CSS ou les polices web, sont hébergées en externe (par exemple, sur un réseau de diffusion de contenu) uniquement si la ressource est statique et versionnée, et si l'intégrité des sous-ressources (SRI) est utilisée pour valider l'intégrité de la ressource. Si cela n'est pas possible, une décision de sécurité documentée doit justifier cette décision pour chaque ressource.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.7", + "Ordinal": 7, + "Name": "Autres considérations sur la sécurité du navigateur", + "Items": [ + { + "Shortcode": "V3.7.1", + "Ordinal": 1, + "Description": "Vérifiez que l'application utilise uniquement des technologies côté client toujours prises en charge et considérées comme sécurisées. Parmi les technologies qui ne répondent pas à cette exigence figurent les plugins NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL ou les applets Java côté client.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.7.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application redirigera automatiquement l'utilisateur vers un nom d'hôte ou un domaine différent (qui n'est pas contrôlé par l'application) uniquement lorsque la destination apparaît sur une liste d'autorisation.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.7.3", + "Ordinal": 3, + "Description": "Vérifiez que le domaine de premier niveau de l'application (par exemple, site.tld) ​​est ajouté à la liste de préchargement publique pour HTTP Strict Transport Security (HSTS). Cela garantit que l'utilisation de TLS pour l'application est intégrée directement dans les principaux navigateurs, plutôt que de dépendre uniquement du champ d'en-tête de réponse Strict-Transport-Security.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.7.4", + "Ordinal": 4, + "Description": "Vérifiez que l'application affiche une notification lorsque l'utilisateur est redirigé vers une URL hors du contrôle de l'application, avec une option pour annuler la navigation.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.7.5", + "Ordinal": 5, + "Description": "Vérifiez que l'application se comporte comme documenté (par exemple, en avertissant l'utilisateur ou en bloquant l'accès) si le navigateur utilisé pour accéder à l'application ne prend pas en charge les fonctionnalités de sécurité attendues.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V4", + "Ordinal": 4, + "ShortName": "API", + "Name": "API et service Web", + "Items": [ + { + "Shortcode": "V4.1", + "Ordinal": 1, + "Name": "Sécurité du service Web générique", + "Items": [ + { + "Shortcode": "V4.1.1", + "Ordinal": 1, + "Description": "Vérifiez que chaque réponse HTTP avec un corps de message contient un champ d'en-tête Content-Type qui correspond au contenu réel de la réponse, y compris le paramètre charset pour spécifier un codage de caractères sécurisé (par exemple, UTF-8, ISO-8859-1) conformément aux types de médias IANA, tels que « text/ », « /+xml » et « /xml ».", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.1.2", + "Ordinal": 2, + "Description": "Vérifiez que seuls les terminaux utilisateurs (destinés à l'accès manuel via un navigateur web) redirigent automatiquement de HTTP vers HTTPS, tandis que les autres services ou terminaux n'implémentent pas de redirections transparentes. Cela permet d'éviter qu'un client envoie par erreur des requêtes HTTP non chiffrées, mais que, comme ces requêtes sont automatiquement redirigées vers HTTPS, la fuite de données sensibles passe inaperçue.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.1.3", + "Ordinal": 3, + "Description": "Vérifiez que tout champ d'en-tête HTTP utilisé par l'application et défini par une couche intermédiaire, telle qu'un équilibreur de charge, un proxy web ou un service backend-for-frontend, ne peut pas être remplacé par l'utilisateur final. Les exemples d'en-têtes peuvent inclure X-Real-IP, X-Forwarded-*, ou X-User-ID.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.1.4", + "Ordinal": 4, + "Description": "Vérifiez que seules les méthodes HTTP explicitement prises en charge par l'application ou son API (y compris les OPTIONS lors des demandes de contrôle en amont) peuvent être utilisées et que les méthodes inutilisées sont bloquées.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.1.5", + "Ordinal": 5, + "Description": "Vérifier que les signatures numériques par message sont utilisées pour fournir une assurance supplémentaire en plus des protections de transport pour les demandes ou les transactions qui sont très sensibles ou qui traversent un certain nombre de systèmes.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V4.2", + "Ordinal": 2, + "Name": "Validation de la structure des messages HTTP", + "Items": [ + { + "Shortcode": "V4.2.1", + "Ordinal": 1, + "Description": "Vérifiez que tous les composants de l'application (y compris les équilibreurs de charge, les pares-feux et les serveurs d'applications) déterminent les limites des messages HTTP entrants à l'aide du mécanisme approprié à la version HTTP afin d'empêcher la contrebande de requêtes HTTP. Dans HTTP/1.x, si un champ d'en-tête Transfer-Encoding est présent, l'en-tête Content-Length doit être ignoré conformément à la RFC 2616. Avec HTTP/2 ou HTTP/3, si un champ d'en-tête Content-Length est présent, le récepteur doit s'assurer qu'il est cohérent avec la longueur des trames DATA.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.2.2", + "Ordinal": 2, + "Description": "Vérifier que, lors de la génération de messages HTTP, le champ d'en-tête Content-Length n'entre pas en conflit avec la longueur du contenu déterminée par le cadrage du protocole HTTP, afin d'empêcher les attaques de type « request smuggling ».", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l'application n'envoie ni n'accepte de messages HTTP/2 ou HTTP/3 avec des champs d'en-tête spécifiques à la connexion, tels que Transfer-Encoding, afin d'éviter les attaques par fractionnement de la réponse et par injection d'en-tête.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.2.4", + "Ordinal": 4, + "Description": "Vérifiez que l'application n'accepte que les requêtes HTTP/2 et HTTP/3 dont les champs et valeurs d'en-tête ne contiennent pas de séquences CR (\\r), LF (\\n) ou CRLF (\\r\\n), afin d'éviter les attaques par injection d'en-tête.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.2.5", + "Ordinal": 5, + "Description": "Vérifiez que, si l'application (backend ou frontend) construit et envoie des requêtes, elle utilise des mécanismes de validation, d'assainissement ou autres pour éviter de créer des URI (comme pour les appels API) ou des champs d'en-tête de requête HTTP (comme Authorization ou Cookie) qui sont trop longs pour être acceptés par le composant récepteur. Cela pourrait entraîner un déni de service, par exemple lors de l'envoi d'une requête trop longue (par exemple, un long champ d'en-tête de cookie), ce qui fait que le serveur répond toujours avec un statut d'erreur.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V4.3", + "Ordinal": 3, + "Name": "GraphQL", + "Items": [ + { + "Shortcode": "V4.3.1", + "Ordinal": 1, + "Description": "Vérifiez qu'une liste d'autorisation de requête, une limitation de profondeur, une limitation de quantité ou une analyse des coûts de requête est utilisée pour empêcher le déni de service (DoS) de GraphQL ou d'expression de la couche données en raison de requêtes imbriquées coûteuses.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.3.2", + "Ordinal": 2, + "Description": "Vérifiez que les requêtes d’introspection GraphQL sont désactivées dans l’environnement de production, sauf si l’API GraphQL est destinée à être utilisée par d’autres parties.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V4.4", + "Ordinal": 4, + "Name": "WebSocket", + "Items": [ + { + "Shortcode": "V4.4.1", + "Ordinal": 1, + "Description": "Vérifiez que WebSocket sur TLS (WSS) est utilisé pour toutes les connexions WebSocket.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.4.2", + "Ordinal": 2, + "Description": "Vérifiez que, lors de la négociation HTTP WebSocket initiale, le champ d’en-tête 'Origin' est vérifié par rapport à une liste d’origines autorisées pour l’application.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.4.3", + "Ordinal": 3, + "Description": "Vérifiez que, si la gestion de session standard de l'application ne peut pas être utilisée, des jetons dédiés sont utilisés à cet effet, qui sont conformes aux exigences de sécurité de gestion de session pertinentes.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.4.4", + "Ordinal": 4, + "Description": "Vérifiez que les jetons de gestion de session WebSocket dédiés sont initialement obtenus ou validés via la session HTTPS précédemment authentifiée lors de la transition d'une session HTTPS existante vers un canal WebSocket.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V5", + "Ordinal": 5, + "ShortName": "File", + "Name": "Gestion des fichiers", + "Items": [ + { + "Shortcode": "V5.1", + "Ordinal": 1, + "Name": "Documentation sur la gestion des fichiers", + "Items": [ + { + "Shortcode": "V5.1.1", + "Ordinal": 1, + "Description": "Vérifiez que la documentation définit les types de fichiers autorisés, les extensions de fichiers attendues et la taille maximale (y compris la taille décompressée) pour chaque fonctionnalité de Téléversement. De plus, assurez-vous que la documentation précise comment les fichiers sont sécurisés pour le téléchargement et le traitement des utilisateurs finaux, par exemple le comportement de l'application lorsqu'un fichier malveillant est détecté.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V5.2", + "Ordinal": 2, + "Name": "Téléversement de fichiers et contenu", + "Items": [ + { + "Shortcode": "V5.2.1", + "Ordinal": 1, + "Description": "Vérifiez que l'application n'acceptera que des fichiers d'une taille qu'elle peut traiter sans provoquer de perte de performances ou d'attaque par déni de service.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.2", + "Ordinal": 2, + "Description": "Vérifiez que lorsque l'application accepte un fichier, seul ou dans une archive telle qu'un fichier zip, elle vérifie si l'extension de fichier correspond à une extension attendue et que le contenu correspond au type représenté par l'extension. Cela inclut, sans s'y limiter, la vérification des « octets magiques » initiaux, la réécriture d'images et l'utilisation de bibliothèques spécialisées pour la validation du contenu des fichiers. Pour le niveau L1, cela peut se concentrer uniquement sur les fichiers utilisés pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau L2, cela doit s'appliquer à tous les fichiers acceptés.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l'application vérifie les fichiers compressés (par exemple, zip, gz, docx, odt) par rapport à la taille maximale autorisée non compressée et au nombre maximal de fichiers avant de décompresser le fichier.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.4", + "Ordinal": 4, + "Description": "Vérifiez qu'un quota de taille de fichier et un nombre maximal de fichiers par utilisateur sont appliqués pour garantir qu'un seul utilisateur ne puisse pas remplir le stockage avec trop de fichiers ou des fichiers excessivement volumineux.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.5", + "Ordinal": 5, + "Description": "Vérifiez que l'application n'autorise pas le téléversement de fichiers compressés contenant des liens symboliques, sauf si cela est spécifiquement requis (auquel cas il sera nécessaire d'appliquer une liste d'autorisation des fichiers vers lesquels il est possible de créer des liens symboliques).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.6", + "Ordinal": 6, + "Description": "Vérifiez que l'application rejette les images téléversées avec une taille de pixel supérieure au maximum autorisé, afin d'éviter les attaques par inondation de pixels.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V5.3", + "Ordinal": 3, + "Name": "Stockage de fichiers", + "Items": [ + { + "Shortcode": "V5.3.1", + "Ordinal": 1, + "Description": "Vérifiez que les fichiers téléversés ou générés par une entrée non fiable et stockés dans un dossier public ne sont pas exécutés en tant que code de programme côté serveur lorsqu'ils sont accessibles directement avec une requête HTTP.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.3.2", + "Ordinal": 2, + "Description": "Vérifiez que lorsque l'application crée des chemins d'accès pour les opérations sur les fichiers, elle utilise des données générées en interne ou fiables plutôt que des noms de fichiers soumis par l'utilisateur. Si des noms de fichiers ou des métadonnées de fichiers soumis par l'utilisateur doivent être utilisés, une validation et un nettoyage stricts doivent être appliqués. Ceci permet de se protéger contre les attaques par traversée de chemin, l'inclusion de fichiers locaux ou distants (LFI, RFI) et la falsification de requêtes côté serveur (SSRF).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.3.3", + "Ordinal": 3, + "Description": "Vérifiez que le traitement des fichiers côté serveur, comme la décompression des fichiers, ignore les informations de chemin fournies par l'utilisateur pour éviter les vulnérabilités telles que le \"zip slip\".", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V5.4", + "Ordinal": 4, + "Name": "Téléchargement de fichier", + "Items": [ + { + "Shortcode": "V5.4.1", + "Ordinal": 1, + "Description": "Vérifiez que l’application valide ou ignore les noms de fichiers soumis par l’utilisateur, y compris dans un paramètre JSON, JSONP ou URL et spécifie un nom de fichier dans le champ d’en-tête Content-Disposition de la réponse.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.4.2", + "Ordinal": 2, + "Description": "Vérifiez que les noms de fichiers servis (par exemple, dans les champs d'en-tête de réponse HTTP ou les pièces jointes aux e-mails) sont encodés ou nettoyés (par exemple, conformément à la RFC 6266) pour préserver la structure du document et empêcher les attaques par injection.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.4.3", + "Ordinal": 3, + "Description": "Vérifiez que les fichiers obtenus à partir de sources non fiables sont analysés par des scanners antivirus pour empêcher la diffusion de contenu malveillant connu.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V6", + "Ordinal": 6, + "ShortName": "Authentication", + "Name": "Authentification", + "Items": [ + { + "Shortcode": "V6.1", + "Ordinal": 1, + "Name": "Documentation d'authentification", + "Items": [ + { + "Shortcode": "V6.1.1", + "Ordinal": 1, + "Description": "Vérifiez que la documentation de l'application définit comment les contrôles, tels que la limitation de débit, l'anti-automatisation et la réponse adaptative, sont utilisés pour se défendre contre les attaques telles que le « credential stuffing » et la force brute des mots de passe. La documentation doit expliquer clairement comment ces contrôles sont configurés et empêcher le blocage malveillant des comptes.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.1.2", + "Ordinal": 2, + "Description": "Vérifiez qu'une liste de mots spécifiques au contexte est documentée afin d'empêcher leur utilisation dans les mots de passe. Cette liste peut inclure des permutations de noms d'organisations, de produits, d'identifiants de systèmes, de noms de codes de projets, de noms de services ou de rôles, etc.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.1.3", + "Ordinal": 3, + "Description": "Vérifiez que, si l'application inclut plusieurs voies d'authentification, celles-ci sont toutes documentées avec les contrôles de sécurité et la force d'authentification qui doivent être appliqués de manière cohérente.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.2", + "Ordinal": 2, + "Name": "Sécurité des mots de passe", + "Items": [ + { + "Shortcode": "V6.2.1", + "Ordinal": 1, + "Description": "Vérifiez que les mots de passe définis par l'utilisateur comportent au moins 8 caractères, bien qu'un minimum de 15 caractères soit fortement recommandé.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.2", + "Ordinal": 2, + "Description": "Vérifiez que les utilisateurs peuvent modifier leur mot de passe.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.3", + "Ordinal": 3, + "Description": "Vérifiez que la fonctionnalité de changement de mot de passe nécessite le mot de passe actuel et le nouveau mot de passe de l'utilisateur.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.4", + "Ordinal": 4, + "Description": "Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou du changement de mot de passe sont vérifiés par rapport à un ensemble disponible d'au moins 3 000 mots de passe principaux qui correspondent à la politique de mot de passe de l'application, par exemple la longueur minimale.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.5", + "Ordinal": 5, + "Description": "Vérifiez que les mots de passe peuvent être utilisés, quelle que soit leur composition, sans restriction quant au type de caractères autorisés. Aucun nombre minimal de majuscules ou de minuscules, de chiffres ou de caractères spéciaux ne doit être exigé.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.6", + "Ordinal": 6, + "Description": "Vérifiez que les champs de saisie du mot de passe utilisent type=password pour masquer la saisie. Les applications peuvent permettre à l'utilisateur d'afficher temporairement l'intégralité du mot de passe masqué ou le dernier caractère saisi.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.7", + "Ordinal": 7, + "Description": "Vérifiez que la fonctionnalité « coller », les assistants de mot de passe du navigateur et les gestionnaires de mots de passe externes sont autorisés.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.8", + "Ordinal": 8, + "Description": "Vérifiez que l'application vérifie le mot de passe de l'utilisateur exactement tel qu'il a été reçu de l'utilisateur, sans aucune modification telle qu'une troncature ou une transformation de casse.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.9", + "Ordinal": 9, + "Description": "Vérifiez que les mots de passe d’au moins 64 caractères sont autorisés.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.10", + "Ordinal": 10, + "Description": "Vérifiez que le mot de passe d'un utilisateur reste valide jusqu'à ce qu'il soit découvert comme compromis ou qu'il soit renouvelé. L'application ne doit pas exiger de renouvellement périodique des identifiants.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.11", + "Ordinal": 11, + "Description": "Vérifiez que la liste documentée de mots spécifiques au contexte est utilisée pour éviter la création de mots de passe faciles à deviner.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.12", + "Ordinal": 12, + "Description": "Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou des modifications de mot de passe sont vérifiés par rapport à un ensemble de mots de passe fuités.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.3", + "Ordinal": 3, + "Name": "Sécurité générale de l'authentification", + "Items": [ + { + "Shortcode": "V6.3.1", + "Ordinal": 1, + "Description": "Vérifiez que les contrôles visant à empêcher les attaques telles que le bourrage d'informations d'identification et la force brute des mots de passe sont mis en œuvre conformément à la documentation de sécurité de l'application.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.2", + "Ordinal": 2, + "Description": "Vérifiez que les comptes d’utilisateur par défaut (par exemple, « root », « admin » ou « sa ») ne sont pas présents dans l’application ou sont désactivés.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.3", + "Ordinal": 3, + "Description": "Vérifiez que l’application exige que les utilisateurs utilisent un mécanisme d’authentification multifacteur ou une combinaison de mécanismes d’authentification à facteur unique.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.4", + "Ordinal": 4, + "Description": "Vérifiez que, si l’application inclut plusieurs voies d’authentification, il n’existe aucune voie non documentée et que les contrôles de sécurité et la force d’authentification sont appliqués de manière cohérente.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.5", + "Ordinal": 5, + "Description": "Vérifiez que les utilisateurs sont informés des tentatives d'authentification suspectes (réussies ou non). Il peut s'agir de tentatives d'authentification provenant d'un emplacement ou d'un client inhabituel, d'une authentification partiellement réussie (un seul facteur parmi plusieurs), d'une tentative d'authentification après une longue période d'inactivité ou d'une authentification réussie après plusieurs tentatives infructueuses.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.6", + "Ordinal": 6, + "Description": "Vérifiez que le courrier électronique n’est pas utilisé comme mécanisme d’authentification à facteur unique ou à facteurs multiples.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.7", + "Ordinal": 7, + "Description": "Vérifiez que les utilisateurs sont avertis après les mises à jour des détails d'authentification, telles que les réinitialisations d'informations d'identification ou la modification du nom d'utilisateur ou de l'adresse e-mail.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.8", + "Ordinal": 8, + "Description": "Vérifiez que les utilisateurs valides ne peuvent pas être déduits d'échecs d'authentification, par exemple en se basant sur des messages d'erreur, des codes de réponse HTTP ou des temps de réponse différents. Les fonctionnalités d'inscription et de mot de passe oublié doivent également bénéficier de cette protection.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.4", + "Ordinal": 4, + "Name": "Cycle de vie et récupération du facteur d'authentification", + "Items": [ + { + "Shortcode": "V6.4.1", + "Ordinal": 1, + "Description": "Vérifiez que les mots de passe initiaux ou les codes d'activation générés par le système sont générés de manière aléatoire et sécurisée, qu'ils respectent la politique de mots de passe en vigueur et qu'ils expirent après une courte période ou après leur première utilisation. Ces secrets initiaux ne doivent pas devenir des mots de passe permanents.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.2", + "Ordinal": 2, + "Description": "Vérifiez que les indices de mot de passe ou l'authentification basée sur les connaissances (appelées « questions secrètes ») ne sont pas présents.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.3", + "Ordinal": 3, + "Description": "Vérifiez qu'un processus sécurisé de réinitialisation d'un mot de passe oublié est mis en œuvre, qui ne contourne aucun mécanisme d'authentification multifacteur activé.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.4", + "Ordinal": 4, + "Description": "Vérifiez que si un facteur d'authentification multifacteur est perdu, la preuve de vérification d'identité est effectuée au même niveau que lors de l'inscription.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.5", + "Ordinal": 5, + "Description": "Vérifiez que les instructions de renouvellement des mécanismes d'authentification qui expirent sont envoyées avec suffisamment de temps pour être exécutées avant l'expiration de l'ancien mécanisme d'authentification, en configurant des rappels automatiques si nécessaire.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.6", + "Ordinal": 6, + "Description": "Vérifiez que les administrateurs peuvent initier la réinitialisation du mot de passe de l'utilisateur, mais que cela ne leur permet pas de modifier ou de choisir son mot de passe. Cela évite qu'ils ne connaissent le mot de passe de l'utilisateur.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.5", + "Ordinal": 5, + "Name": "Exigences générales en matière d'authentification multifacteur", + "Items": [ + { + "Shortcode": "V6.5.1", + "Ordinal": 1, + "Description": "Vérifiez que les secrets de recherche, les demandes ou codes d'authentification out-of-band et les mots de passe à usage unique basés sur le temps (TOTP) ne peuvent être utilisés avec succès qu'une seule fois.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.2", + "Ordinal": 2, + "Description": "Vérifiez que, lors de leur stockage dans le backend de l'application, les secrets de recherche comportant moins de 112 bits d'entropie (19 caractères alphanumériques aléatoires ou 34 chiffres aléatoires) sont hachés avec un algorithme de hachage de stockage de mots de passe approuvé, intégrant un sel aléatoire de 32 bits. Une fonction de hachage standard peut être utilisée si le secret comporte 112 bits d'entropie ou plus.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.3", + "Ordinal": 3, + "Description": "Vérifiez que les secrets de recherche, le code d'authentification out-of-band et les mots de passe à usage unique basés sur le temps sont générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) pour éviter les valeurs prévisibles.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.4", + "Ordinal": 4, + "Description": "Vérifiez que les secrets de recherche et les codes d'authentification out-of-band ont un minimum de 20 bits d'entropie (généralement 4 caractères alphanumériques aléatoires ou 6 chiffres aléatoires suffisent).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.5", + "Ordinal": 5, + "Description": "Vérifiez que les requêtes, codes ou jetons d'authentification out-of-band, ainsi que les mots de passe à usage unique (TOTP), ont une durée de vie définie. Les requêtes out-of-band doivent avoir une durée de vie maximale de 10 minutes et les TOTP, de 30 secondes.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.6", + "Ordinal": 6, + "Description": "Vérifiez que tout facteur d’authentification (y compris les appareils physiques) peut être révoqué en cas de vol ou autre perte.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.7", + "Ordinal": 7, + "Description": "Vérifiez que les mécanismes d’authentification biométrique ne sont utilisés que comme facteurs secondaires, avec quelque chose que vous possédez ou quelque chose que vous savez.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.8", + "Ordinal": 8, + "Description": "Vérifiez que les mots de passe à usage unique basés sur le temps (TOTP) sont vérifiés en fonction d'une source temporelle provenant d'un service de confiance et non d'une heure non fiable ou fournie par le client.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.6", + "Ordinal": 6, + "Name": "Mécanismes d'authentification out-of-band", + "Items": [ + { + "Shortcode": "V6.6.1", + "Ordinal": 1, + "Description": "Vérifier que les mécanismes d'authentification utilisant le réseau téléphonique public commuté (RTPC) pour la transmission de mots de passe à usage unique (OTP) par téléphone ou SMS ne sont proposés que lorsque le numéro de téléphone a été préalablement validé. D'autres méthodes plus robustes (telles que les mots de passe à usage unique à durée déterminée) sont également proposées, et que le service informe les utilisateurs des risques de sécurité qu'elles présentent. Pour les applications de niveau 3, le téléphone et les SMS ne doivent pas être disponibles.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.6.2", + "Ordinal": 2, + "Description": "Vérifiez que les demandes d’authentification out-of-band, les codes ou les jetons sont liés à la demande d’authentification d’origine pour laquelle ils ont été générés et ne sont pas utilisables pour une demande précédente ou ultérieure.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.6.3", + "Ordinal": 3, + "Description": "Vérifiez qu'un mécanisme d'authentification out-of-band basé sur du code est protégé contre les attaques par force brute grâce au \"rate limiting\". Envisagez également d'utiliser un code avec au moins 64 bits d'entropie.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.6.4", + "Ordinal": 4, + "Description": "Vérifiez que, lorsque les notifications push sont utilisées pour l'authentification multifacteur, le \"rate limiting\" est appliqué afin d'empêcher les attaques de type « push bombing ». La concordance des numéros peut également atténuer ce risque.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.7", + "Ordinal": 7, + "Name": "Mécanisme d'authentification cryptographique", + "Items": [ + { + "Shortcode": "V6.7.1", + "Ordinal": 1, + "Description": "Vérifiez que les certificats utilisés pour vérifier les assertions d’authentification cryptographique sont stockés de manière à les protéger contre toute modification.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.7.2", + "Ordinal": 2, + "Description": "Vérifiez que le nonce de défi a une longueur d'au moins 64 bits et qu'il est statistiquement unique ou unique sur toute la durée de vie du périphérique cryptographique.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.8", + "Ordinal": 8, + "Name": "Authentification avec un fournisseur d'identité", + "Items": [ + { + "Shortcode": "V6.8.1", + "Ordinal": 1, + "Description": "Vérifiez que, si l'application prend en charge plusieurs fournisseurs d'identité (IdP), l'identité de l'utilisateur ne peut pas être usurpée via un autre fournisseur d'identité pris en charge (par exemple, en utilisant le même identifiant utilisateur). La mesure standard consisterait à ce que l'application enregistre et identifie l'utilisateur à l'aide d'une combinaison de l'ID du fournisseur d'identité (servant d'espace de noms) et de l'ID de l'utilisateur dans le fournisseur d'identité.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.8.2", + "Ordinal": 2, + "Description": "Vérifiez que la présence et l'intégrité des signatures numériques sur les assertions d'authentification (par exemple sur les assertions JWT ou SAML) sont toujours validées, en rejetant toutes les assertions non signées ou ayant des signatures non valides.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.8.3", + "Ordinal": 3, + "Description": "Vérifiez que les assertions SAML sont traitées de manière unique et utilisées une seule fois au cours de la période de validité pour éviter les attaques par rejeu.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.8.4", + "Ordinal": 4, + "Description": "Si une application utilise un fournisseur d'identité (IdP) distinct et attend une force, des méthodes ou une date d'authentification spécifiques pour des fonctions spécifiques, vérifiez que l'application les vérifie à l'aide des informations renvoyées par l'IdP. Par exemple, si OIDC est utilisé, cela peut être réalisé en validant les affirmations de jeton d'identification telles que « acr », « amr » et « auth_time » (le cas échéant). Si l'IdP ne fournit pas ces informations, l'application doit disposer d'une approche de secours documentée qui suppose que le mécanisme d'authentification de force minimale a été utilisé (par exemple, une authentification à facteur unique avec nom d'utilisateur et mot de passe).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V7", + "Ordinal": 7, + "ShortName": "Session", + "Name": "Gestion des sessions", + "Items": [ + { + "Shortcode": "V7.1", + "Ordinal": 1, + "Name": "Documentation sur la gestion des sessions", + "Items": [ + { + "Shortcode": "V7.1.1", + "Ordinal": 1, + "Description": "Vérifiez que le délai d'inactivité de la session de l'utilisateur et la durée de vie maximale absolue de la session sont documentés, sont appropriés en combinaison avec d'autres contrôles et que la documentation inclut une justification de tout écart par rapport aux exigences de réauthentification NIST SP 800-63B.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.1.2", + "Ordinal": 2, + "Description": "Vérifiez que la documentation définit le nombre de sessions simultanées (parallèles) autorisées pour un compte ainsi que les comportements et actions prévus à entreprendre lorsque le nombre maximal de sessions actives est atteint.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.1.3", + "Ordinal": 3, + "Description": "Vérifiez que tous les systèmes qui créent et gèrent des sessions utilisateur dans le cadre d'un écosystème de gestion des identités fédérées (tels que les systèmes SSO) sont documentés avec des contrôles pour coordonner la durée de vie des sessions, la résiliation et toute autre condition nécessitant une réauthentification.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.2", + "Ordinal": 2, + "Name": "Sécurité fondamentale de la gestion des sessions", + "Items": [ + { + "Shortcode": "V7.2.1", + "Ordinal": 1, + "Description": "Vérifiez que l’application effectue toutes les vérifications des jetons de session à l’aide d’un service backend de confiance.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.2.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application utilise des jetons autonomes ou de référence générés dynamiquement pour la gestion des sessions, c'est-à-dire sans utiliser de secrets et de clés d'API statiques.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.2.3", + "Ordinal": 3, + "Description": "Vérifiez que si des jetons par référence sont utilisés pour représenter les sessions utilisateur, ils sont uniques et générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et possèdent au moins 128 bits d'entropie.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.2.4", + "Ordinal": 4, + "Description": "Vérifiez que l’application génère un nouveau jeton de session lors de l’authentification de l’utilisateur, y compris la réauthentification, et met fin au jeton de session actuel.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.3", + "Ordinal": 3, + "Name": "Délai d'expiration de la session", + "Items": [ + { + "Shortcode": "V7.3.1", + "Ordinal": 1, + "Description": "Vérifiez qu’il existe un délai d’inactivité tel que la réauthentification soit appliquée conformément à l’analyse des risques et aux décisions de sécurité documentées.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.3.2", + "Ordinal": 2, + "Description": "Vérifiez qu'il existe une durée de vie maximale absolue de la session de sorte que la réauthentification soit appliquée conformément à l'analyse des risques et aux décisions de sécurité documentées.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.4", + "Ordinal": 4, + "Name": "Fin de session", + "Items": [ + { + "Shortcode": "V7.4.1", + "Ordinal": 1, + "Description": "Vérifiez que lorsque la fin de session est déclenchée (par exemple, déconnexion ou expiration), l'application interdit toute utilisation ultérieure de la session. Pour les jetons par référence ou les sessions avec état, cela implique l'invalidation des données de session au niveau du backend de l'application. Les applications utilisant des jetons autonomes nécessiteront une solution, comme la gestion d'une liste des jetons terminés, l'interdiction des jetons produits avant une date et une heure spécifique à chaque utilisateur ou la rotation d'une clé de signature spécifique à chaque utilisateur.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.4.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application met fin à toutes les sessions actives lorsqu'un compte utilisateur est désactivé ou supprimé (par exemple, lorsqu'un employé quitte l'entreprise).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.4.3", + "Ordinal": 3, + "Description": "Vérifiez que l'application offre la possibilité de mettre fin à toutes les autres sessions actives après une modification ou une suppression réussie de tout facteur d'authentification (y compris la modification du mot de passe via une réinitialisation ou une récupération et, le cas échéant, une mise à jour des paramètres MFA).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.4.4", + "Ordinal": 4, + "Description": "Vérifiez que toutes les pages nécessitant une authentification disposent d’un accès facile et visible à la fonctionnalité de déconnexion.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.4.5", + "Ordinal": 5, + "Description": "Vérifiez que les administrateurs d’applications sont en mesure de mettre fin aux sessions actives pour un utilisateur individuel ou pour tous les utilisateurs.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.5", + "Ordinal": 5, + "Name": "Défenses contre les abus de session", + "Items": [ + { + "Shortcode": "V7.5.1", + "Ordinal": 1, + "Description": "Vérifiez que l'application nécessite une réauthentification complète avant d'autoriser les modifications des attributs de compte sensibles qui peuvent affecter l'authentification, tels que l'adresse e-mail, le numéro de téléphone, la configuration MFA ou d'autres informations utilisées dans la récupération de compte.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.5.2", + "Ordinal": 2, + "Description": "Vérifiez que les utilisateurs peuvent afficher et (après s'être authentifiés à nouveau avec au moins un facteur) terminer une ou toutes les sessions actuellement actives.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.5.3", + "Ordinal": 3, + "Description": "Vérifiez que l’application nécessite une authentification supplémentaire avec au moins un facteur ou une vérification secondaire avant d’effectuer des transactions ou des opérations hautement sensibles.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.6", + "Ordinal": 6, + "Name": "Réauthentification fédérée", + "Items": [ + { + "Shortcode": "V7.6.1", + "Ordinal": 1, + "Description": "Vérifiez que la durée de vie et la fin de la session entre les parties de confiance (RP) et les fournisseurs d'identité (IdP) se comportent comme documenté, en exigeant une réauthentification si nécessaire, par exemple lorsque le temps maximal entre les événements d'authentification IdP est atteint.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.6.2", + "Ordinal": 2, + "Description": "Vérifiez que la création d'une session nécessite soit le consentement de l'utilisateur, soit une action explicite, empêchant ainsi la création de nouvelles sessions d'application sans interaction de l'utilisateur.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V8", + "Ordinal": 8, + "ShortName": "Authorization", + "Name": "Autorisation", + "Items": [ + { + "Shortcode": "V8.1", + "Ordinal": 1, + "Name": "Documentation d'autorisation", + "Items": [ + { + "Shortcode": "V8.1.1", + "Ordinal": 1, + "Description": "Vérifiez que la documentation d’autorisation définit des règles de restriction de l’accès au niveau de la fonction et aux données en fonction des autorisations du consommateur et des attributs des ressources.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.1.2", + "Ordinal": 2, + "Description": "Vérifiez que la documentation d'autorisation définit les règles de restriction d'accès au niveau des champs (lecture et écriture) en fonction des autorisations des consommateurs et des attributs des ressources. Notez que ces règles peuvent dépendre d'autres valeurs d'attributs de l'objet de données concerné, telles que l'état ou le statut.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.1.3", + "Ordinal": 3, + "Description": "Vérifiez que la documentation de l'application définit les attributs environnementaux et contextuels (y compris, mais sans s'y limiter, l'heure de la journée, l'emplacement de l'utilisateur, l'adresse IP ou l'appareil) qui sont utilisés dans l'application pour prendre des décisions de sécurité, y compris celles relatives à l'authentification et à l'autorisation.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.1.4", + "Ordinal": 4, + "Description": "Vérifier que la documentation d'authentification et d'autorisation définit l'utilisation des facteurs environnementaux et contextuels dans la prise de décision, en plus des autorisations au niveau des fonctions, des données et des champs. Cela doit inclure les attributs évalués, les seuils de risque et les actions entreprises (par exemple, autorisation, contestation, refus, renforcement de l'authentification).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V8.2", + "Ordinal": 2, + "Name": "Conception d'autorisation générale", + "Items": [ + { + "Shortcode": "V8.2.1", + "Ordinal": 1, + "Description": "Vérifiez que l’application garantit que l’accès basé sur la fonction est limité aux consommateurs disposant d’autorisations explicites.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.2.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application garantit que l'accès spécifique aux données est limité aux consommateurs disposant d'autorisations explicites sur des éléments de données spécifiques afin d'atténuer les références d'objet directes non sécurisées (IDOR) et les autorisations de niveau d'objet rompues (BOLA).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l'application garantit que l'accès au niveau du champ est limité aux consommateurs disposant d'autorisations explicites sur des champs spécifiques afin d'atténuer les problèmes d'autorisation au niveau de la propriété d'objet (BOPLA).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.2.4", + "Ordinal": 4, + "Description": "Vérifiez que les contrôles de sécurité adaptatifs basés sur les attributs environnementaux et contextuels du consommateur (tels que l'heure, la localisation, l'adresse IP ou l'appareil) sont mis en œuvre pour les décisions d'authentification et d'autorisation, comme défini dans la documentation de l'application. Ces contrôles doivent être appliqués lorsque le consommateur tente de démarrer une nouvelle session et également pendant une session existante.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V8.3", + "Ordinal": 3, + "Name": "Autorisation par opération", + "Items": [ + { + "Shortcode": "V8.3.1", + "Ordinal": 1, + "Description": "Vérifier que l'application applique les règles d'autorisations au niveau de la couche service de confiance et ne s’appuie pas sur des contrôles qu’un consommateur non approuvé pourrait manipuler, comme JavaScript côté client.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.3.2", + "Ordinal": 2, + "Description": "Vérifiez que les modifications apportées aux valeurs sur lesquelles reposent les décisions d'autorisation sont appliquées immédiatement. Lorsque les modifications ne peuvent pas être appliquées immédiatement (par exemple, en s'appuyant sur des données de jetons autonomes), des contrôles d'atténuation doivent être mis en place pour alerter un consommateur lorsqu'il effectue une action alors qu'il n'est plus autorisé à le faire et annuler la modification. Notez que cette solution alternative ne limiterait pas les fuites d'informations.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.3.3", + "Ordinal": 3, + "Description": "Vérifiez que l'accès à un objet repose sur les autorisations du sujet d'origine (par exemple, le consommateur), et non sur celles d'un intermédiaire ou d'un service agissant en son nom. Par exemple, si un consommateur appelle un service web à l'aide d'un jeton d'authentification autonome, et que ce service demande ensuite des données à un autre service, ce dernier utilisera le jeton du consommateur, plutôt qu'un jeton inter-machine du premier service, pour prendre les décisions d'autorisation.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V8.4", + "Ordinal": 4, + "Name": "Autres considérations relatives à l'autorisation", + "Items": [ + { + "Shortcode": "V8.4.1", + "Ordinal": 1, + "Description": "Vérifiez que les applications multi-tenants utilisent des contrôles inter-tenants pour garantir que les opérations des consommateurs n'affecteront jamais les tenants avec lesquels ils ne sont pas autorisés à interagir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.4.2", + "Ordinal": 2, + "Description": "Vérifiez que l'accès aux interfaces administratives intègre plusieurs couches de sécurité, notamment la vérification continue de l'identité du consommateur, l'évaluation de la posture de sécurité des appareils et l'analyse contextuelle des risques, garantissant que l'emplacement du réseau ou les endpoints approuvés ne sont pas les seuls facteurs d'autorisation, même s'ils peuvent réduire la probabilité d'accès non autorisé.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V9", + "Ordinal": 9, + "ShortName": "Self", + "Name": "Jetons autonomes", + "Items": [ + { + "Shortcode": "V9.1", + "Ordinal": 1, + "Name": "Source et intégrité du jeton", + "Items": [ + { + "Shortcode": "V9.1.1", + "Ordinal": 1, + "Description": "Vérifiez que les jetons autonomes sont validés à l'aide de leur signature numérique ou MAC pour les protéger contre toute falsification avant d'accepter le contenu du jeton.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.1.2", + "Ordinal": 2, + "Description": "Vérifiez que seuls les algorithmes d'une liste d’autorisations peuvent être utilisés pour créer et vérifier des jetons autonomes, dans un contexte donné. La liste d'autorisation doit inclure les algorithmes autorisés, idéalement symétriques ou asymétriques, et ne doit pas inclure l'algorithme « Aucun ». Si les algorithmes symétriques et asymétriques doivent être pris en charge, des contrôles supplémentaires seront nécessaires pour éviter toute confusion de clés.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.1.3", + "Ordinal": 3, + "Description": "Vérifiez que les clés utilisées pour valider les jetons autonomes proviennent de sources préconfigurées et fiables pour l'émetteur du jeton, empêchant ainsi les attaquants de spécifier des sources et des clés non fiables. Pour les JWT et autres structures JWS, les en-têtes tels que « jku », « x5u » et « jwk » doivent être validés par rapport à une liste d'autorisation de sources fiables.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V9.2", + "Ordinal": 2, + "Name": "Contenu du jeton", + "Items": [ + { + "Shortcode": "V9.2.1", + "Ordinal": 1, + "Description": "Vérifiez que, si une période de validité est indiquée dans les données du jeton, celui-ci et son contenu ne sont acceptés que si la date de vérification est comprise dans cette période. Par exemple, pour les JWT, les déclarations « nbf » et « exp » doivent être vérifiées.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.2.2", + "Ordinal": 2, + "Description": "Vérifiez que le service recevant un jeton valide le type de jeton et son utilisation avant d'en accepter le contenu. Par exemple, seuls les jetons d'accès peuvent être acceptés pour les décisions d'autorisation, et seuls les jetons d'identification peuvent être utilisés pour prouver l'authentification des utilisateurs.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.2.3", + "Ordinal": 3, + "Description": "Vérifiez que le service accepte uniquement les jetons destinés à être utilisés avec ce service (audience). Pour les JWT, cela peut être réalisé en validant la déclaration « aud » par rapport à une liste d'autorisation définie dans le service.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.2.4", + "Ordinal": 4, + "Description": "Si un émetteur de jetons utilise la même clé privée pour émettre des jetons destinés à différentes audiences, vérifiez que les jetons émis contiennent une restriction d'audience identifiant de manière unique les audiences visées. Cela empêchera la réutilisation d'un jeton avec une audience non prévue. Si l'identifiant d'audience est provisionné dynamiquement, l'émetteur de jetons doit valider ces audiences afin de garantir qu'elles n'entraînent pas d'usurpation d'identité.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V10", + "Ordinal": 10, + "ShortName": "OAuth", + "Name": "Oauth et OIDC", + "Items": [ + { + "Shortcode": "V10.1", + "Ordinal": 1, + "Name": "Sécurité générique OAuth et OIDC", + "Items": [ + { + "Shortcode": "V10.1.1", + "Ordinal": 1, + "Description": "Vérifiez que les jetons sont envoyés uniquement aux composants qui en ont absolument besoin. Par exemple, lors de l'utilisation d'un modèle backend-for-frontend pour les applications JavaScript basées sur un navigateur, les jetons d'accès et d'actualisation ne doivent être accessibles qu'au backend.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.1.2", + "Ordinal": 2, + "Description": "Vérifiez que le client n'accepte les valeurs du serveur d'autorisation (telles que le code d'autorisation ou le jeton d'identification) que si elles résultent d'un flux d'autorisation initié par la même session d'agent utilisateur et la même transaction. Cela nécessite que les secrets générés par le client, tels que la clé de preuve pour l'échange de codes (PKCE) « code_verifier », « state » ou le nonce OIDC, ne puissent être devinés, soient spécifiques à la transaction et soient liés de manière sécurisée au client et à la session d'agent utilisateur au cours de laquelle la transaction a été initiée.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.2", + "Ordinal": 2, + "Name": "Client OAuth", + "Items": [ + { + "Shortcode": "V10.2.1", + "Ordinal": 1, + "Description": "Vérifiez que, si le flux de code est utilisé, le client OAuth dispose d'une protection contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF), qui déclenchent des demandes de jetons, soit en utilisant la fonctionnalité de clé de preuve pour l'échange de code (PKCE), soit en vérifiant le paramètre « state » envoyé dans la demande d'autorisation.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.2.2", + "Ordinal": 2, + "Description": "Vérifiez que, si le client OAuth peut interagir avec plusieurs serveurs d'autorisation, il dispose d'une protection contre les attaques par confusion. Par exemple, il peut exiger que le serveur d'autorisation renvoie la valeur du paramètre « iss » et la valide dans la réponse d'autorisation et la réponse du jeton.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.2.3", + "Ordinal": 3, + "Description": "Vérifiez que le client OAuth demande uniquement les portées requises (ou d’autres paramètres d’autorisation) dans les requêtes adressées au serveur d’autorisation.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.3", + "Ordinal": 3, + "Name": "Serveur de ressources OAuth", + "Items": [ + { + "Shortcode": "V10.3.1", + "Ordinal": 1, + "Description": "Vérifiez que le serveur de ressources accepte uniquement les jetons d'accès destinés à être utilisés avec ce service (audience). L'audience peut être incluse dans un jeton d'accès structuré (comme la déclaration « aud » dans JWT) ou vérifiée à l'aide du endpoint d'introspection de jeton.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.3.2", + "Ordinal": 2, + "Description": "Vérifiez que le serveur de ressources applique les décisions d'autorisation en fonction des déclarations du jeton d'accès définissant l'autorisation déléguée. Si des déclarations telles que « sub », « scope » et « authorization_details » sont présentes, elles doivent être prises en compte dans la décision.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.3.3", + "Ordinal": 3, + "Description": "Vérifiez que si une décision de contrôle d'accès nécessite l'identification d'un utilisateur unique à partir d'un jeton d'accès (JWT ou réponse d'introspection de jeton associé), le serveur de ressources identifie l'utilisateur à partir de déclarations non ré attribuables à d'autres utilisateurs. En général, cela implique l'utilisation d'une combinaison de déclarations « iss » et « sub ».", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.3.4", + "Ordinal": 4, + "Description": "Si le serveur de ressources requiert une force d'authentification, des méthodes ou une date d'expiration spécifiques, vérifiez que le jeton d'accès présenté respecte ces contraintes. Par exemple, s'il est présent, utilisez les déclarations OIDC « acr », « amr » et « auth_time » respectivement.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.3.5", + "Ordinal": 5, + "Description": "Vérifiez que le serveur de ressources empêche l'utilisation de jetons d'accès volés ou la relecture de jetons d'accès (de parties non autorisées) en exigeant des jetons d'accès limités par l'expéditeur, soit Mutual TLS pour OAuth 2, soit OAuth 2 Demonstration of Proof of Possession (DPoP).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.4", + "Ordinal": 4, + "Name": "Serveur d'autorisation OAuth", + "Items": [ + { + "Shortcode": "V10.4.1", + "Ordinal": 1, + "Description": "Vérifiez que le serveur d'autorisation valide les URI de redirection en fonction d'une liste d'autorisation spécifique au client d'URI préenregistrés à l'aide d'une comparaison de chaînes exacte.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.2", + "Ordinal": 2, + "Description": "Vérifiez que, si le serveur d'autorisation renvoie le code d'autorisation dans la réponse, celui-ci ne peut être utilisé qu'une seule fois pour une demande de jeton. Pour la deuxième demande valide avec un code d'autorisation déjà utilisé pour émettre un jeton d'accès, le serveur d'autorisation doit rejeter la demande de jeton et révoquer tous les jetons émis liés au code d'autorisation.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.3", + "Ordinal": 3, + "Description": "Vérifiez que le code d'autorisation est de courte durée. La durée de vie maximale peut atteindre 10 minutes pour les applications L1 et L2 et 1 minute pour les applications L3.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.4", + "Ordinal": 4, + "Description": "Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement l'utilisation des autorisations nécessaires à ce client. Notez que les autorisations « token » (flux implicite) et « password » (flux d'informations d'identification du propriétaire de la ressource) ne doivent plus être utilisées.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.5", + "Ordinal": 5, + "Description": "Vérifiez que le serveur d'autorisation atténue les attaques par rejeu de jetons d'actualisation pour les clients publics, de préférence en utilisant des jetons d'actualisation limités par l'expéditeur, par exemple des jetons DPoP (Demonstrating Proof of Possession) ou des jetons d'accès liés à un certificat utilisant le protocole TLS mutuel (mTLS). Pour les applications L1 et L2, la rotation des jetons d'actualisation peut être utilisée. Si cette rotation est utilisée, le serveur d'autorisation doit invalider le jeton d'actualisation après utilisation et révoquer tous les jetons d'actualisation de cette autorisation si un jeton d'actualisation déjà utilisé et invalidé est fourni.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.6", + "Ordinal": 6, + "Description": "Vérifiez que, si l'octroi de code est utilisé, le serveur d'autorisation atténue les attaques par interception de code en exigeant une clé de preuve pour l'échange de code (PKCE). Pour les demandes d'autorisation, le serveur d'autorisation doit exiger une valeur « code_challenge » valide et ne doit pas accepter une valeur « plain » pour « code_challenge_method ». Pour une demande de jeton, il doit exiger la validation du paramètre « code_verifier ».", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.7", + "Ordinal": 7, + "Description": "Vérifiez que si le serveur d'autorisation prend en charge l'enregistrement dynamique des clients non authentifiés, il réduit le risque d'applications clientes malveillantes. Il doit valider les métadonnées clientes, telles que les URI enregistrés, garantir le consentement de l'utilisateur et l'avertir avant de traiter une demande d'autorisation avec une application cliente non approuvée.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.8", + "Ordinal": 8, + "Description": "Vérifiez que les jetons d’actualisation ont une expiration absolue, y compris si l’expiration du jeton d’actualisation glissant est appliquée.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.9", + "Ordinal": 9, + "Description": "Vérifiez que les jetons d'actualisation et les jetons d'accès de référence peuvent être révoqués par un utilisateur autorisé à l'aide de l'interface utilisateur du serveur d'autorisation, afin d'atténuer le risque de clients malveillants ou de jetons volés.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.10", + "Ordinal": 10, + "Description": "Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.11", + "Ordinal": 11, + "Description": "Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.12", + "Ordinal": 12, + "Description": "Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement la valeur « response_mode » dont ce client a besoin. Par exemple, en vérifiant cette valeur par rapport aux valeurs attendues ou en utilisant une requête d'autorisation poussée (PAR) ou une requête d'autorisation sécurisée par JWT (JAR).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.13", + "Ordinal": 13, + "Description": "Vérifiez que le type d'Autorisation « code » est toujours utilisé avec les demandes d'autorisation poussées (PAR).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.14", + "Ordinal": 14, + "Description": "Vérifiez que le serveur d'autorisation émet uniquement des jetons d'accès limités à l'expéditeur (preuve de possession), soit avec des jetons d'accès liés au certificat utilisant TLS mutuel (mTLS), soit avec des jetons d'accès liés au DPoP (démonstration de preuve de possession).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.15", + "Ordinal": 15, + "Description": "Vérifiez que, pour un client côté serveur (non exécuté sur l'appareil de l'utilisateur final), le serveur d'autorisation garantit que la valeur du paramètre « authorization_details » provient du backend client et que l'utilisateur ne l'a pas altérée. Par exemple, en exigeant l'utilisation d'une demande d'autorisation poussée (PAR) ou d'une demande d'autorisation sécurisée par JWT (JAR).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.16", + "Ordinal": 16, + "Description": "Vérifiez que le client est confidentiel et que le serveur d'autorisation requiert l'utilisation de méthodes d'authentification client fortes (basées sur la cryptographie à clé publique et résistantes aux attaques par relecture), telles que TLS mutuel ('tls_client_auth', 'self_signed_tls_client_auth') ou JWT à clé privée ('private_key_jwt').", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.5", + "Ordinal": 5, + "Name": "Client OIDC", + "Items": [ + { + "Shortcode": "V10.5.1", + "Ordinal": 1, + "Description": "Vérifiez que le client (en tant que partie utilisatrice) atténue les attaques par rejeu de jeton d'identification. Par exemple, en vous assurant que la valeur « nonce » du jeton d'identification correspond à la valeur « nonce » envoyée dans la demande d'authentification au fournisseur OpenID (appelée demande d'autorisation envoyée au serveur d'autorisation dans OAuth2).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.5.2", + "Ordinal": 2, + "Description": "Vérifiez que le client identifie de manière unique l'utilisateur à partir des déclarations de jeton d'identification, généralement la déclaration « sub », qui ne peut pas être réaffectée à d'autres utilisateurs (pour la portée d'un fournisseur d'identité).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.5.3", + "Ordinal": 3, + "Description": "Vérifiez que le client rejette les tentatives d'un serveur d'autorisation malveillant d'usurper l'identité d'un autre serveur d'autorisation via ses métadonnées. Le client doit rejeter les métadonnées du serveur d'autorisation si l'URL de l'émetteur figurant dans ces métadonnées ne correspond pas exactement à l'URL d'émetteur préconfigurée attendue par le client.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.5.4", + "Ordinal": 4, + "Description": "Vérifiez que le client valide que le jeton d'identification est destiné à être utilisé pour ce client (audience) en vérifiant que la déclaration « aud » du jeton est égale à la valeur « client_id » pour le client.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.5.5", + "Ordinal": 5, + "Description": "Vérifiez que, lors de l'utilisation de la déconnexion du back-channel OIDC, la partie utilisatrice atténue les risques de déni de service liés à la déconnexion forcée et à la confusion entre JWT dans le flux de déconnexion. Le client doit vérifier que le jeton de déconnexion est correctement typé avec la valeur « logout+jwt », qu'il contient la déclaration « event » avec le nom de membre correct et qu'il ne contient pas de déclaration « nonce ». Il est également recommandé d'utiliser une expiration courte (par exemple, 2 minutes).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.6", + "Ordinal": 6, + "Name": "Fournisseur OpenID", + "Items": [ + { + "Shortcode": "V10.6.1", + "Ordinal": 1, + "Description": "Vérifiez que le fournisseur OpenID n'autorise que les valeurs « code », « ciba », « id_token » ou « id_token code » pour le mode de réponse. Notez que « code » est préférable à « id_token code » (flux hybride OIDC) et que « token » (tout flux implicite) ne doit pas être utilisé.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.6.2", + "Ordinal": 2, + "Description": "Vérifiez que le fournisseur OpenID atténue les risques de déni de service liés à la déconnexion forcée. Pour ce faire, obtenez une confirmation explicite de l'utilisateur final ou, le cas échéant, validez les paramètres de la requête de déconnexion (initiée par la partie utilisatrice), comme « id_token_hint ».", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.7", + "Ordinal": 7, + "Name": "Gestion du consentement", + "Items": [ + { + "Shortcode": "V10.7.1", + "Ordinal": 1, + "Description": "Vérifiez que le serveur d'autorisation garantit le consentement de l'utilisateur à chaque demande d'autorisation. Si l'identité du client ne peut être garantie, le serveur d'autorisation doit toujours demander explicitement le consentement de l'utilisateur.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.7.2", + "Ordinal": 2, + "Description": "Vérifiez que lorsque le serveur d'autorisation demande le consentement de l'utilisateur, il fournit des informations claires et suffisantes sur ce qui est consenti. Le cas échéant, ces informations doivent inclure la nature des autorisations demandées (généralement en fonction de la portée, du serveur de ressources et des détails d'autorisation RAR), l'identité de l'application autorisée et la durée de vie de ces autorisations.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.7.3", + "Ordinal": 3, + "Description": "Vérifiez que l’utilisateur peut consulter, modifier et révoquer les consentements qu’il a accordés via le serveur d’autorisation.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V11", + "Ordinal": 11, + "ShortName": "Cryptography", + "Name": "Cryptographie", + "Items": [ + { + "Shortcode": "V11.1", + "Ordinal": 1, + "Name": "Inventaire et documentation cryptographiques", + "Items": [ + { + "Shortcode": "V11.1.1", + "Ordinal": 1, + "Description": "Vérifiez qu’il existe une politique documentée pour la gestion des clés cryptographiques et un cycle de vie des clés cryptographiques qui suit une norme de gestion des clés telle que NIST SP 800-57. Cela devrait inclure la garantie que les clés ne sont pas sur-partagées (par exemple, avec plus de deux entités pour les secrets partagés et plus d’une entité pour les clés privées).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.1.2", + "Ordinal": 2, + "Description": "Vérifiez qu'un inventaire cryptographique est réalisé, maintenu et régulièrement mis à jour, et qu'il inclut toutes les clés, algorithmes et certificats cryptographiques utilisés par l'application. Il doit également documenter les emplacements du système où les clés peuvent ou non être utilisées, ainsi que les types de données qui peuvent ou non être protégées par ces clés.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.1.3", + "Ordinal": 3, + "Description": "Vérifiez que les mécanismes de découverte cryptographique sont utilisés pour identifier toutes les instances de cryptographie dans le système, y compris les opérations de chiffrement, de hachage et de signature.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.1.4", + "Ordinal": 4, + "Description": "Vérifier la tenue d'un inventaire cryptographique. Celui-ci doit inclure un plan documenté décrivant la migration vers de nouvelles normes cryptographiques, telles que la cryptographie post-quantique, afin de réagir aux menaces futures.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.2", + "Ordinal": 2, + "Name": "Mise en œuvre sécurisée de la cryptographie", + "Items": [ + { + "Shortcode": "V11.2.1", + "Ordinal": 1, + "Description": "Vérifiez que les implémentations validées par l’industrie (y compris les bibliothèques et les implémentations accélérées par le matériel) sont utilisées pour les opérations cryptographiques.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.2.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application est conçue avec une agilité cryptographique, de sorte que les nombres aléatoires, le chiffrement authentifié, le MAC ou les algorithmes de hachage, les longueurs de clés, les tours, les chiffrements et les modes puissent être reconfigurés, mis à niveau ou échangés à tout moment, afin de se protéger contre les failles cryptographiques. De même, il doit être possible de remplacer les clés et les mots de passe, ainsi que de rechiffrer les données. Cela permettra des mises à niveau transparentes vers la cryptographie post-quantique (PQC), une fois que des implémentations hautement sécurisées de schémas ou de normes PQC approuvés seront largement disponibles.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.2.3", + "Ordinal": 3, + "Description": "Vérifiez que toutes les primitives cryptographiques utilisent un minimum de 128 bits de sécurité en fonction de l'algorithme, de la taille de la clé et de la configuration. Par exemple, une clé ECC de 256 bits offre environ 128 bits de sécurité, tandis que RSA nécessite une clé de 3072 bits pour atteindre 128 bits de sécurité.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.2.4", + "Ordinal": 4, + "Description": "Vérifiez que toutes les opérations cryptographiques sont à temps constant, sans opérations de « court-circuit » dans les comparaisons, les calculs ou les retours, pour éviter toute fuite d'informations.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.2.5", + "Ordinal": 5, + "Description": "Vérifiez que tous les modules cryptographiques échouent en toute sécurité et que les erreurs sont gérées de manière à ne pas permettre de vulnérabilités, telles que les attaques Padding Oracle.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.3", + "Ordinal": 3, + "Name": "Algorithmes de chiffrement", + "Items": [ + { + "Shortcode": "V11.3.1", + "Ordinal": 1, + "Description": "Vérifiez que les modes de bloc non sécurisés (par exemple, ECB) et les schémas de remplissage faibles (par exemple, PKCS#1 v1.5) ne sont pas utilisés.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.3.2", + "Ordinal": 2, + "Description": "Vérifiez que seuls les chiffrements et modes approuvés tels que AES avec GCM sont utilisés.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.3.3", + "Ordinal": 3, + "Description": "Vérifiez que les données chiffrées sont protégées contre toute modification non autorisée, de préférence en utilisant une méthode de chiffrement authentifiée approuvée ou en combinant une méthode de chiffrement approuvée avec un algorithme MAC approuvé.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.3.4", + "Ordinal": 4, + "Description": "Vérifiez que les nonces, les vecteurs d'initialisation et autres nombres à usage unique ne sont pas utilisés pour plus d'une paire clé de chiffrement/élément de données. La méthode de génération doit être adaptée à l'algorithme utilisé.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.3.5", + "Ordinal": 5, + "Description": "Vérifiez que toute combinaison d'un algorithme de chiffrement et d'un algorithme MAC fonctionne en mode chiffrement puis MAC.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.4", + "Ordinal": 4, + "Name": "Hachage et fonctions basées sur le hachage", + "Items": [ + { + "Shortcode": "V11.4.1", + "Ordinal": 1, + "Description": "Vérifiez que seules les fonctions de hachage approuvées sont utilisées pour les cas d'utilisation cryptographiques généraux, notamment les signatures numériques, HMAC, KDF et la génération de bits aléatoires. Les fonctions de hachage non autorisées, telles que MD5, ne doivent pas être utilisées à des fins cryptographiques.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.4.2", + "Ordinal": 2, + "Description": "Vérifiez que les mots de passe sont stockés à l'aide d'une fonction de dérivation de clés approuvée et gourmande en ressources de calcul (également appelée « fonction de hachage de mots de passe »), dont les paramètres sont configurés conformément aux directives en vigueur. Ces paramètres doivent équilibrer sécurité et performances afin de rendre les attaques par force brute suffisamment difficiles pour le niveau de sécurité requis.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.4.3", + "Ordinal": 3, + "Description": "Vérifiez que les fonctions de hachage utilisées dans les signatures numériques, dans le cadre de l'authentification ou de l'intégrité des données, sont résistantes aux collisions et possèdent des longueurs de bits appropriées. Si la résistance aux collisions est requise, la longueur de sortie doit être d'au moins 256 bits. Si seule la résistance aux attaques de seconde pré-image est requise, la longueur de sortie doit être d'au moins 128 bits.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.4.4", + "Ordinal": 4, + "Description": "Vérifiez que l'application utilise des fonctions de dérivation de clés approuvées avec des paramètres d'extension de clés lors de la dérivation de clés secrètes à partir de mots de passe. Les paramètres utilisés doivent concilier sécurité et performances afin d'empêcher les attaques par force brute de compromettre la clé cryptographique obtenue.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.5", + "Ordinal": 5, + "Name": "Valeurs aléatoires", + "Items": [ + { + "Shortcode": "V11.5.1", + "Ordinal": 1, + "Description": "Vérifiez que tous les nombres et chaînes aléatoires destinés à être non devinables doivent être générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et posséder au moins 128 bits d'entropie. Notez que les UUID ne respectent pas cette condition.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.5.2", + "Ordinal": 2, + "Description": "Vérifiez que le mécanisme de génération de nombres aléatoires utilisé est conçu pour fonctionner en toute sécurité, même en cas de forte demande.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.6", + "Ordinal": 6, + "Name": "Cryptographie à clé publique", + "Items": [ + { + "Shortcode": "V11.6.1", + "Ordinal": 1, + "Description": "Vérifier que seuls des algorithmes cryptographiques et des modes opératoires approuvés sont utilisés pour la génération et l'amorçage des clés, ainsi que pour la génération et la vérification des signatures numériques. Les algorithmes de génération de clés ne doivent pas générer de clés non sécurisées et vulnérables aux attaques connues, par exemple les clés RSA vulnérables à la factorisation de Fermat.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.6.2", + "Ordinal": 2, + "Description": "Vérifiez que des algorithmes cryptographiques approuvés sont utilisés pour l'échange de clés (tels que Diffie-Hellman), en veillant à ce que les mécanismes d'échange de clés utilisent des paramètres sécurisés. Cela permettra d'éviter les attaques contre le processus d'établissement des clés, susceptibles de conduire à des attaques de type « adversaire du milieu » ou à des failles cryptographiques.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.7", + "Ordinal": 7, + "Name": "Cryptographie des données en cours d'utilisation", + "Items": [ + { + "Shortcode": "V11.7.1", + "Ordinal": 1, + "Description": "Vérifiez que le chiffrement complet de la mémoire est utilisé pour protéger les données sensibles pendant leur utilisation, empêchant ainsi l'accès par des utilisateurs ou des processus non autorisés.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.7.2", + "Ordinal": 2, + "Description": "Vérifiez que la minimisation des données garantit que la quantité minimale de données est exposée pendant le traitement et assurez-vous que les données sont chiffrées immédiatement après utilisation ou dès que possible.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V12", + "Ordinal": 12, + "ShortName": "Secure", + "Name": "Communication sécurisée", + "Items": [ + { + "Shortcode": "V12.1", + "Ordinal": 1, + "Name": "Conseils généraux de sécurité TLS", + "Items": [ + { + "Shortcode": "V12.1.1", + "Ordinal": 1, + "Description": "Vérifiez que seules les dernières versions recommandées du protocole TLS sont activées, telles que TLS 1.2 et TLS 1.3. La dernière version du protocole TLS doit être privilégiée.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.1.2", + "Ordinal": 2, + "Description": "Vérifiez que seules les suites de chiffrement recommandées sont activées, les suites de chiffrement les plus puissantes étant définies comme préférées. Les applications L3 doivent uniquement prendre en charge les suites de chiffrement assurant la confidentialité persistante (forward secrecy).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.1.3", + "Ordinal": 3, + "Description": "Vérifiez que l’application valide que les certificats clients mTLS sont approuvés avant d’utiliser l’identité du certificat pour l’authentification ou l’autorisation.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.1.4", + "Ordinal": 4, + "Description": "Vérifiez que la révocation de certification appropriée, telle que l'agrafage du protocole OCSP (Online Certificate Status Protocol), est activée et configurée.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.1.5", + "Ordinal": 5, + "Description": "Vérifiez que Encrypted Client Hello (ECH) est activé dans les paramètres TLS de l'application pour empêcher l'exposition de métadonnées sensibles, telles que l'indication du nom du serveur (SNI), pendant les processus de négociation TLS.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V12.2", + "Ordinal": 2, + "Name": "Communication HTTPS avec des services externes", + "Items": [ + { + "Shortcode": "V12.2.1", + "Ordinal": 1, + "Description": "Vérifiez que TLS est utilisé pour toute connectivité entre un client et des services externes basés sur HTTP, et ne recourt pas à des communications non sécurisées ou non chiffrées.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.2.2", + "Ordinal": 2, + "Description": "Vérifiez que les services externes utilisent des certificats TLS publiquement approuvés.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V12.3", + "Ordinal": 3, + "Name": "Sécurité des communications entre services généraux", + "Items": [ + { + "Shortcode": "V12.3.1", + "Ordinal": 1, + "Description": "Vérifiez qu'un protocole chiffré tel que TLS est utilisé pour toutes les connexions entrantes et sortantes vers et depuis l'application, y compris les systèmes de surveillance, les outils de gestion, l'accès à distance et SSH, les intergiciels, les bases de données, les mainframes, les systèmes partenaires ou les API externes. Le serveur ne doit pas recourir à des protocoles non sécurisés ou non chiffrés.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.3.2", + "Ordinal": 2, + "Description": "Vérifiez que les clients TLS valident les certificats reçus avant de communiquer avec un serveur TLS.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.3.3", + "Ordinal": 3, + "Description": "Vérifiez que TLS ou un autre mécanisme de chiffrement de transport approprié est utilisé pour toute connectivité entre les services internes basés sur HTTP au sein de l'application et ne se replie pas vers des communications non sécurisées ou non chiffrées.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.3.4", + "Ordinal": 4, + "Description": "Vérifiez que les connexions TLS entre les services internes utilisent des certificats de confiance. Lorsque des certificats générés en interne ou auto-signés sont utilisés, le service consommateur doit être configuré pour n'approuver que des autorités de certification internes spécifiques et des certificats auto-signés spécifiques.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.3.5", + "Ordinal": 5, + "Description": "Vérifiez que les services communiquant en interne au sein d'un système (communications intra-services) utilisent une authentification forte pour garantir la vérification de chaque endpoint. Des méthodes d'authentification forte, telles que l'authentification client TLS, doivent être utilisées pour garantir l'identité, en utilisant une infrastructure à clé publique et des mécanismes résistants aux attaques par rejeu. Pour les architectures de microservices, envisagez d'utiliser un maillage de services pour simplifier la gestion des certificats et renforcer la sécurité.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V13", + "Ordinal": 13, + "ShortName": "Configuration", + "Name": "Configuration", + "Items": [ + { + "Shortcode": "V13.1", + "Ordinal": 1, + "Name": "Documentation de configuration", + "Items": [ + { + "Shortcode": "V13.1.1", + "Ordinal": 1, + "Description": "Vérifiez que tous les besoins de communication de l'application sont documentés. Cela doit inclure les services externes dont l'application dépend et les cas où un utilisateur final pourrait fournir un emplacement externe auquel l'application se connectera.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.1.2", + "Ordinal": 2, + "Description": "Vérifiez que pour chaque service utilisé par l'application, la documentation définit le nombre maximal de connexions simultanées (par exemple, les limites du pool de connexions) et le comportement de l'application lorsque cette limite est atteinte, y compris les mécanismes de secours ou de récupération, pour éviter les conditions de déni de service.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.1.3", + "Ordinal": 3, + "Description": "Vérifiez que la documentation de l'application définit des stratégies de gestion des ressources pour chaque système ou service externe utilisé (par exemple, bases de données, descripteurs de fichiers, threads, connexions HTTP). Cela doit inclure les procédures de libération des ressources, les paramètres de délai d'expiration, la gestion des échecs et l'implémentation de la logique de nouvelle tentative, en spécifiant les limites de nouvelle tentative, les délais et les algorithmes de retour arrière. Pour les opérations de requête-réponse HTTP synchrones, la documentation doit imposer des délais d'expiration courts et soit désactiver les nouvelles tentatives, soit les limiter strictement afin d'éviter les retards en cascade et l'épuisement des ressources.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.1.4", + "Ordinal": 4, + "Description": "Vérifiez que la documentation de l'application définit les secrets essentiels à la sécurité de l'application et un calendrier de rotation de ceux-ci, en fonction du modèle de menace et des exigences commerciales de l'organisation.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V13.2", + "Ordinal": 2, + "Name": "Configuration de la communication backend", + "Items": [ + { + "Shortcode": "V13.2.1", + "Ordinal": 1, + "Description": "Vérifiez que les communications entre les composants de l'application backend qui ne prennent pas en charge le mécanisme de session utilisateur standard de l'application, notamment les API, les intergiciels et les couches de données, sont authentifiées. L'authentification doit utiliser des comptes de service individuels, des jetons à court terme ou une authentification par certificat, et non des identifiants immuables tels que des mots de passe, des clés API ou des comptes partagés avec accès privilégié.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.2", + "Ordinal": 2, + "Description": "Vérifiez que les communications entre les composants de l'application backend, y compris les services locaux ou du système d'exploitation, les API, les intergiciels et les couches de données, sont effectuées avec des comptes dotés des privilèges les moins nécessaires.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.3", + "Ordinal": 3, + "Description": "Vérifiez que si des informations d’identification doivent être utilisées pour l’authentification du service, les informations d’identification utilisées par le consommateur ne sont pas des informations d’identification par défaut (par exemple, root/root ou admin/admin).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.4", + "Ordinal": 4, + "Description": "Vérifiez qu'une liste d’autorisations est utilisée pour définir les ressources ou systèmes externes avec lesquels l'application est autorisée à communiquer (par exemple, pour les requêtes sortantes, les chargements de données ou l'accès aux fichiers). Cette liste d'autorisation peut être implémentée au niveau de la couche applicative, du serveur web, du pare-feu ou d'une combinaison de différentes couches.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.5", + "Ordinal": 5, + "Description": "Vérifiez que le serveur Web ou d’application est configuré avec une liste autorisée de ressources ou de systèmes vers lesquels le serveur peut envoyer des requêtes ou charger des données ou des fichiers.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.6", + "Ordinal": 6, + "Description": "Vérifiez que lorsque l'application se connecte à des services distincts, elle suit la configuration documentée pour chaque connexion, comme le nombre maximal de connexions parallèles, le comportement lorsque le nombre maximal de connexions autorisées est atteint, les délais d'expiration de connexion et les stratégies de nouvelle tentative.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V13.3", + "Ordinal": 3, + "Name": "Gestion des secrets", + "Items": [ + { + "Shortcode": "V13.3.1", + "Ordinal": 1, + "Description": "Vérifiez qu'une solution de gestion des secrets, telle qu'un coffre-fort de clés, est utilisée pour créer, stocker, contrôler l'accès et détruire en toute sécurité les secrets backend. Ceux-ci peuvent inclure des mots de passe, du matériel de clé, des intégrations avec des bases de données et des systèmes tiers, des clés et des graines pour des jetons temporels, d'autres secrets internes et des clés API. Les secrets ne doivent pas être inclus dans le code source de l'application ni dans les artefacts de build. Pour une application L3, cela doit impliquer une solution matérielle telle qu'un HSM.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.3.2", + "Ordinal": 2, + "Description": "Vérifiez que l’accès aux ressources secrètes respecte le principe du moindre privilège.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.3.3", + "Ordinal": 3, + "Description": "Vérifiez que toutes les opérations cryptographiques sont effectuées à l'aide d'un module de sécurité isolé (tel qu'un coffre-fort ou un module de sécurité matériel) pour gérer et protéger en toute sécurité le matériel clé contre toute exposition en dehors du module de sécurité.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.3.4", + "Ordinal": 4, + "Description": "Vérifiez que les secrets sont configurés pour expirer et être renouvelés en fonction de la documentation de l'application.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V13.4", + "Ordinal": 4, + "Name": "Fuite d'informations involontaire", + "Items": [ + { + "Shortcode": "V13.4.1", + "Ordinal": 1, + "Description": "Vérifiez que l'application est déployée soit sans aucune métadonnée de contrôle de source, y compris les dossiers .git ou .svn, soit de manière à ce que ces dossiers soient inaccessibles à la fois en externe et à l'application elle-même.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.2", + "Ordinal": 2, + "Description": "Vérifiez que les modes de débogage sont désactivés pour tous les composants dans les environnements de production afin d’éviter l’exposition des fonctionnalités de débogage et la fuite d’informations.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.3", + "Ordinal": 3, + "Description": "Vérifiez que les serveurs Web n’exposent pas les listes de répertoires aux clients, sauf si cela est explicitement prévu.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.4", + "Ordinal": 4, + "Description": "Vérifiez que l’utilisation de la méthode HTTP TRACE n’est pas prise en charge dans les environnements de production, afin d’éviter toute fuite d’informations potentielle.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.5", + "Ordinal": 5, + "Description": "Vérifiez que la documentation (comme pour les API internes) et les endpoints de surveillance ne sont pas exposés, sauf si cela est explicitement prévu.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.6", + "Ordinal": 6, + "Description": "Vérifiez que l’application n’expose pas d’informations de version détaillées des composants backend.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.7", + "Ordinal": 7, + "Description": "Vérifiez que la couche web est configuré pour servir uniquement les fichiers avec des extensions de fichier spécifiques afin d’éviter toute fuite involontaire d’informations, de configuration et de code source.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V14", + "Ordinal": 14, + "ShortName": "Data", + "Name": "Protection des données", + "Items": [ + { + "Shortcode": "V14.1", + "Ordinal": 1, + "Name": "Documentation sur la protection des données", + "Items": [ + { + "Shortcode": "V14.1.1", + "Ordinal": 1, + "Description": "Vérifiez que toutes les données sensibles créées et traitées par l'application ont été identifiées et classées selon leur niveau de protection. Cela inclut les données uniquement codées et donc facilement déchiffrables, telles que les chaînes Base64 ou la charge utile en texte clair d'un JWT. Les niveaux de protection doivent tenir compte des réglementations et normes de protection des données et de confidentialité auxquelles l'application est tenue de se conformer.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.1.2", + "Ordinal": 2, + "Description": "Vérifier que tous les niveaux de protection des données sensibles sont assortis d'un ensemble documenté d'exigences de protection. Cela doit inclure (sans s'y limiter) les exigences relatives au chiffrement général, à la vérification de l'intégrité, à la conservation, à la journalisation des données, aux contrôles d'accès aux données sensibles dans les journaux, au chiffrement au niveau de la base de données, aux technologies de confidentialité et de renforcement de la confidentialité à utiliser, ainsi qu'aux autres exigences de confidentialité.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V14.2", + "Ordinal": 2, + "Name": "Protection générale des données", + "Items": [ + { + "Shortcode": "V14.2.1", + "Ordinal": 1, + "Description": "Vérifiez que les données sensibles sont uniquement envoyées au serveur dans les champs de corps ou d’en-tête du message HTTP, et que l’URL et la chaîne de requête ne contiennent pas d’informations sensibles, telles qu’une clé API ou un jeton de session.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.2", + "Ordinal": 2, + "Description": "Vérifiez que l’application empêche la mise en cache des données sensibles dans les composants du serveur, tels que les équilibreurs de charge et les caches d’application, ou garantit que les données sont purgées en toute sécurité après utilisation.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.3", + "Ordinal": 3, + "Description": "Vérifiez que les données sensibles définies ne sont pas envoyées à des parties non fiables (par exemple, des trackers d'utilisateurs) pour empêcher la collecte indésirable de données en dehors du contrôle de l'application.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.4", + "Ordinal": 4, + "Description": "Vérifiez que les contrôles autour des données sensibles liés au chiffrement, à la vérification de l'intégrité, à la conservation, à la manière dont les données doivent être enregistrées, aux contrôles d'accès autour des données sensibles dans les journaux, à la confidentialité et aux technologies d'amélioration de la confidentialité, sont mis en œuvre comme défini dans la documentation pour le niveau de protection des données spécifiques.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.5", + "Ordinal": 5, + "Description": "Vérifiez que les mécanismes de mise en cache sont configurés pour ne mettre en cache que les réponses dont le type de contenu est conforme à la ressource et qui ne contiennent pas de contenu sensible et dynamique. Le serveur web doit renvoyer une réponse 404 ou 302 lors de l'accès à un fichier inexistant plutôt qu'un fichier valide différent. Cela devrait empêcher les attaques par empoisonnement de cache web.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.6", + "Ordinal": 6, + "Description": "Vérifiez que l'application ne renvoie que les données sensibles minimales requises pour son fonctionnement. Par exemple, ne renvoyez que certains chiffres d'un numéro de carte de crédit, et non le numéro complet. Si les données complètes sont requises, elles doivent être masquées dans l'interface utilisateur, sauf si l'utilisateur les consulte spécifiquement.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.7", + "Ordinal": 7, + "Description": "Vérifiez que les informations sensibles sont soumises à une classification de conservation des données, en veillant à ce que les données obsolètes ou inutiles soient supprimées automatiquement, selon un calendrier défini ou selon les besoins de la situation.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.8", + "Ordinal": 8, + "Description": "Vérifiez que les informations sensibles sont supprimées des métadonnées des fichiers soumis par l'utilisateur, sauf si le stockage est autorisé par l'utilisateur.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V14.3", + "Ordinal": 3, + "Name": "Protection des données côté client", + "Items": [ + { + "Shortcode": "V14.3.1", + "Ordinal": 1, + "Description": "Vérifiez que les données authentifiées sont effacées du stockage client, comme le DOM du navigateur, après la fin du client ou de la session. Le champ d'en-tête de réponse HTTP « Clear-Site-Data » peut être utile, mais le côté client devrait également pouvoir effectuer la correction si la connexion au serveur n'est pas disponible à la fin de la session.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.3.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application définit suffisamment de champs d'en-tête de réponse HTTP anti-caching (c'est-à-dire Cache-Control : no-store) afin que les données sensibles ne soient pas mises en cache dans les navigateurs.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.3.3", + "Ordinal": 3, + "Description": "Vérifiez que les données stockées dans le stockage du navigateur (telles que localStorage, sessionStorage, IndexedDB ou les cookies) ne contiennent pas de données sensibles, à l'exception des jetons de session.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V15", + "Ordinal": 15, + "ShortName": "Secure", + "Name": "Développement et architecture sécurisés", + "Items": [ + { + "Shortcode": "V15.1", + "Ordinal": 1, + "Name": "Documentation sur le développement et l'architecture sécurisés", + "Items": [ + { + "Shortcode": "V15.1.1", + "Ordinal": 1, + "Description": "Vérifiez que la documentation de l'application définit les délais de correction basés sur les risques pour les versions de composants tiers présentant des vulnérabilités et pour la mise à jour des bibliothèques en général, afin de minimiser les risques liés à ces composants.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.1.2", + "Ordinal": 2, + "Description": "Vérifiez qu'un catalogue d'inventaire, tel qu'une nomenclature logicielle (SBOM), est conservé pour toutes les bibliothèques tierces utilisées, y compris en vérifiant que les composants proviennent de référentiels prédéfinis, fiables et continuellement maintenus.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.1.3", + "Ordinal": 3, + "Description": "Vérifiez que la documentation de l'application identifie les fonctionnalités consommatrices en temps ou gourmandes en ressources. Elle doit notamment indiquer comment prévenir une perte de disponibilité due à une utilisation excessive de ces fonctionnalités et éviter que la génération d'une réponse ne prenne plus de temps que le délai d'expiration du consommateur. Les mesures de protection potentielles peuvent inclure le traitement asynchrone, l'utilisation de files d'attente et la limitation des processus parallèles par utilisateur et par application.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.1.4", + "Ordinal": 4, + "Description": "Vérifiez que la documentation de l’application met en évidence les bibliothèques tierces qui sont considérées comme des « composants à risque ».", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.1.5", + "Ordinal": 5, + "Description": "Vérifiez que la documentation de l’application met en évidence les parties de l’application où des « fonctionnalités dangereuses » sont utilisées.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V15.2", + "Ordinal": 2, + "Name": "Architecture de sécurité et dépendances", + "Items": [ + { + "Shortcode": "V15.2.1", + "Ordinal": 1, + "Description": "Vérifiez que l’application contient uniquement des composants qui n’ont pas dépassé les délais de mise à jour et de correction documentés.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.2.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application a mis en œuvre des défenses contre la perte de disponibilité due à des fonctionnalités qui prennent du temps ou qui nécessitent des ressources, sur la base des décisions et stratégies de sécurité documentées à cet effet.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l'environnement de production inclut uniquement les fonctionnalités nécessaires au fonctionnement de l'application et n'expose pas de fonctionnalités superflues telles que du code de test, des exemples d'extraits et des fonctionnalités de développement.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.2.4", + "Ordinal": 4, + "Description": "Vérifiez que les composants tiers et toutes leurs dépendances transitives sont inclus à partir du référentiel attendu, qu'il soit détenu en interne ou qu'il s'agisse d'une source externe, et qu'il n'y a aucun risque d'attaque par confusion de dépendances.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.2.5", + "Ordinal": 5, + "Description": "Vérifiez que l'application implémente des protections supplémentaires autour des parties documentées comme contenant des « fonctionnalités dangereuses » ou utilisant des bibliothèques tierces considérées comme des « composants à risque ». Cela peut inclure des techniques telles que le sandboxing, l'encapsulation, la conteneurisation ou l'isolation au niveau du réseau pour retarder et dissuader les attaquants qui compromettent une partie de l'application de se propager ailleurs.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V15.3", + "Ordinal": 3, + "Name": "Développement défensif", + "Items": [ + { + "Shortcode": "V15.3.1", + "Ordinal": 1, + "Description": "Vérifiez que l'application ne renvoie que le sous-ensemble requis de champs d'un objet de données. Par exemple, elle ne doit pas renvoyer un objet de données entier, car certains champs individuels ne doivent pas être accessibles aux utilisateurs.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.2", + "Ordinal": 2, + "Description": "Vérifiez que lorsque le backend de l'application effectue des appels vers des URL externes, il est configuré pour ne pas suivre les redirections, sauf s'il s'agit d'une fonctionnalité prévue.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.3", + "Ordinal": 3, + "Description": "Vérifiez que l'application dispose de contre-mesures pour se protéger contre les attaques d'affectation de masse en limitant les champs autorisés par contrôleur et action, par exemple, il n'est pas possible d'insérer ou de mettre à jour une valeur de champ lorsqu'elle n'était pas destinée à faire partie de cette action.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.4", + "Ordinal": 4, + "Description": "Vérifiez que tous les composants proxy et middleware transfèrent correctement l'adresse IP d'origine de l'utilisateur à l'aide de champs de données fiables qui ne peuvent pas être manipulés par l'utilisateur final, et que l'application et le serveur Web utilisent cette valeur correcte pour la journalisation et les décisions de sécurité telles que la limitation du débit, en tenant compte du fait que même l'adresse IP d'origine peut ne pas être fiable en raison d'adresses IP dynamiques, de VPN ou de pare-feu d'entreprise.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.5", + "Ordinal": 5, + "Description": "Vérifiez que l'application garantit explicitement que les variables sont du type correct et effectue des opérations d'égalité et de comparaison strictes. Cela permet d'éviter les vulnérabilités liées à la confusion de types, causées par des hypothèses du code de l'application sur le type d'une variable.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.6", + "Ordinal": 6, + "Description": "Vérifiez que le code JavaScript est écrit de manière à éviter la pollution du prototype, par exemple en utilisant Set() ou Map() au lieu de littéraux d'objet.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.7", + "Ordinal": 7, + "Description": "Vérifiez que l'application dispose de défenses contre les attaques de pollution des paramètres HTTP, en particulier si le Framework d'application ne fait aucune distinction quant à la source des paramètres de requête (chaîne de requête, paramètres de corps, cookies ou champs d'en-tête).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V15.4", + "Ordinal": 4, + "Name": "Concurrence sécurisée", + "Items": [ + { + "Shortcode": "V15.4.1", + "Ordinal": 1, + "Description": "Vérifiez que les objets partagés dans le code multithread (tels que les caches, les fichiers ou les objets en mémoire accessibles par plusieurs threads) sont accessibles en toute sécurité à l'aide de types thread-safe et de mécanismes de synchronisation tels que des verrous ou des sémaphores pour éviter les conditions de concurrence et la corruption des données.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.4.2", + "Ordinal": 2, + "Description": "Vérifiez que les vérifications de l'état d'une ressource, comme son existence ou ses autorisations, et des actions qui en dépendent, sont effectuées en une seule opération atomique afin d'éviter les situations de concurrence entre le moment de la vérification et le moment de l'utilisation (TOCTOU). Par exemple, vérifier l'existence d'un fichier avant de l'ouvrir ou l'accès d'un utilisateur avant de l'accorder.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.4.3", + "Ordinal": 3, + "Description": "Vérifiez que les verrous sont utilisés de manière cohérente pour éviter que les threads ne se bloquent, que ce soit en s'attendant les uns les autres ou en réessayant sans fin, et que la logique de verrouillage reste dans le code responsable de la gestion de la ressource pour garantir que les verrous ne peuvent pas être modifiés par inadvertance ou de manière malveillante par des classes ou du code externes.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.4.4", + "Ordinal": 4, + "Description": "Vérifiez que les politiques d'allocation des ressources empêchent la saturation de threads en garantissant un accès équitable aux ressources, par exemple en exploitant les pools de threads, permettant aux threads de priorité inférieure de continuer dans un délai raisonnable.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V16", + "Ordinal": 16, + "ShortName": "Security", + "Name": "Journalisation de sécurité et gestion des erreurs", + "Items": [ + { + "Shortcode": "V16.1", + "Ordinal": 1, + "Name": "Documentation sur la journalisation de sécurité", + "Items": [ + { + "Shortcode": "V16.1.1", + "Ordinal": 1, + "Description": "Vérifiez qu'il existe un inventaire documentant la journalisation effectuée à chaque couche de la pile technologique de l'application, les événements enregistrés, les formats de journal, l'endroit où cette journalisation est stockée, la manière dont elle est utilisée, la manière dont l'accès à celle-ci est contrôlé et la durée de conservation des journaux.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V16.2", + "Ordinal": 2, + "Name": "Journalisation générale", + "Items": [ + { + "Shortcode": "V16.2.1", + "Ordinal": 1, + "Description": "Vérifiez que chaque entrée de journal inclut les métadonnées nécessaires (telles que quand, où, qui, quoi) qui permettraient une enquête détaillée sur la chronologie lorsqu'un événement se produit.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.2.2", + "Ordinal": 2, + "Description": "Vérifiez que les sources de temps de tous les composants de journalisation sont synchronisées et que les horodatages des métadonnées des événements de sécurité utilisent le temps UTC ou incluent un décalage horaire explicite. L'UTC est recommandé pour garantir la cohérence entre les systèmes distribués et éviter toute confusion lors du passage à l'heure d'été.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l’application stocke ou diffuse uniquement les journaux vers les fichiers et services documentés dans l’inventaire des journaux.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.2.4", + "Ordinal": 4, + "Description": "Vérifiez que les journaux peuvent être lus et corrélés par le processeur de journaux utilisé, de préférence en utilisant un format de journalisation commun.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.2.5", + "Ordinal": 5, + "Description": "Vérifiez que l'application applique la journalisation en fonction du niveau de protection des données lors de la journalisation de données sensibles. Par exemple, certaines données, comme les identifiants ou les informations de paiement, peuvent être interdites. D'autres données, comme les jetons de session, ne peuvent être enregistrées que par hachage ou masquage, en totalité ou en partie.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V16.3", + "Ordinal": 3, + "Name": "Événements de sécurité", + "Items": [ + { + "Shortcode": "V16.3.1", + "Ordinal": 1, + "Description": "Vérifiez que toutes les opérations d'authentification sont enregistrées, y compris les tentatives réussies et infructueuses. Des métadonnées supplémentaires, telles que le type d'authentification ou les facteurs utilisés, doivent également être collectées.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.3.2", + "Ordinal": 2, + "Description": "Vérifier que les tentatives d'autorisation infructueuses sont logguées. Pour le niveau 3, cela doit inclure la journalisation de toutes les décisions d'autorisation, y compris lors de l'accès à des données sensibles (sans journalisation des données sensibles elles-mêmes).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.3.3", + "Ordinal": 3, + "Description": "Vérifiez que l'application enregistre les événements de sécurité définis dans la documentation et enregistre également les tentatives de contournement des contrôles de sécurité, tels que la validation des entrées, la logique métier et l'anti-automatisation.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.3.4", + "Ordinal": 4, + "Description": "Vérifiez que l’application enregistre les erreurs inattendues et les échecs de contrôle de sécurité tels que les échecs TLS du backend.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V16.4", + "Ordinal": 4, + "Name": "Protection des journaux", + "Items": [ + { + "Shortcode": "V16.4.1", + "Ordinal": 1, + "Description": "Vérifiez que tous les composants de journalisation codent correctement les données pour empêcher l’injection de journaux.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.4.2", + "Ordinal": 2, + "Description": "Vérifiez que les journaux sont protégés contre tout accès non autorisé et ne peuvent pas être modifiés.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.4.3", + "Ordinal": 3, + "Description": "Vérifiez que les journaux sont transmis de manière sécurisée à un système logique distinct pour analyse, détection, alerte et remontée des informations. L'objectif est de garantir qu'en cas de violation de l'application, les journaux ne seront pas compromis.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V16.5", + "Ordinal": 5, + "Name": "Gestion des erreurs", + "Items": [ + { + "Shortcode": "V16.5.1", + "Ordinal": 1, + "Description": "Vérifiez qu'un message générique est renvoyé au consommateur lorsqu'une erreur inattendue ou sensible à la sécurité se produit, garantissant ainsi l'absence d'exposition de données système internes sensibles telles que les traces de pile, les requêtes, les clés secrètes et les jetons.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.5.2", + "Ordinal": 2, + "Description": "Vérifiez que l'application continue de fonctionner en toute sécurité lorsque l'accès aux ressources externes échoue, par exemple, en utilisant des modèles tels que des disjoncteurs ou une dégradation progressive.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.5.3", + "Ordinal": 3, + "Description": "Vérifiez que l'application échoue proprement et sécurisée, y compris lorsqu'une exception se produit, en évitant les accès en cas d'erreur telles que le traitement d'une transaction malgré les erreurs résultant de la logique de validation.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.5.4", + "Ordinal": 4, + "Description": "Vérifiez qu'un gestionnaire d'erreurs de « dernier recours » est défini pour intercepter toutes les exceptions non gérées. Cela permet d'éviter la perte des informations d'erreur qui doivent être loguées dans les fichiers journaux et de garantir qu'une erreur ne paralyse pas l'ensemble du processus applicatif, entraînant une perte de disponibilité.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V17", + "Ordinal": 17, + "ShortName": "WebRTC", + "Name": "WebRTC", + "Items": [ + { + "Shortcode": "V17.1", + "Ordinal": 1, + "Name": "Serveur TURN", + "Items": [ + { + "Shortcode": "V17.1.1", + "Ordinal": 1, + "Description": "Vérifiez que le service TURN (Traversal Using Relays around NAT) autorise uniquement l'accès aux adresses IP non réservées à des fins spécifiques (par exemple, réseaux internes, diffusion, bouclage). Notez que cela s'applique aux adresses IPv4 et IPv6.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.1.2", + "Ordinal": 2, + "Description": "Vérifiez que le service Traversal Using Relays around NAT (TURN) n'est pas susceptible d'épuiser ses ressources lorsque des utilisateurs légitimes tentent d'ouvrir un grand nombre de ports sur le serveur TURN.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V17.2", + "Ordinal": 2, + "Name": "Média", + "Items": [ + { + "Shortcode": "V17.2.1", + "Ordinal": 1, + "Description": "Vérifiez que la clé du certificat Datagram Transport Layer Security (DTLS) est gérée et protégée conformément à la politique documentée de gestion des clés cryptographiques.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.2", + "Ordinal": 2, + "Description": "Vérifiez que le serveur multimédia est configuré pour utiliser et prendre en charge les suites de chiffrement DTLS (Datagram Transport Layer Security) approuvées et un profil de protection sécurisé pour l'extension DTLS pour l'établissement de clés pour le protocole de transport en temps réel sécurisé (DTLS-SRTP).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.3", + "Ordinal": 3, + "Description": "Vérifiez que l'authentification SRTP (Secure Real-time Transport Protocol) est vérifiée sur le serveur multimédia pour empêcher les attaques par injection RTP (Real-time Transport Protocol) d'entraîner une condition de déni de service ou l'insertion de médias audio ou vidéo dans les flux multimédias.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.4", + "Ordinal": 4, + "Description": "Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant lorsqu'il rencontre des paquets SRTP (Secure Real-time Transport Protocol) mal formés.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.5", + "Ordinal": 5, + "Description": "Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.6", + "Ordinal": 6, + "Description": "Vérifiez que le serveur multimédia n'est pas sensible à la vulnérabilité de condition de concurrence « ClientHello » dans Datagram Transport Layer Security (DTLS) en vérifiant si le serveur multimédia est publiquement connu comme étant vulnérable ou en effectuant le test de condition de concurrence.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.7", + "Ordinal": 7, + "Description": "Vérifiez que tous les mécanismes d'enregistrement audio ou vidéo associés au serveur multimédia sont en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.8", + "Ordinal": 8, + "Description": "Vérifiez que le certificat Datagram Transport Layer Security (DTLS) est vérifié par rapport à l'attribut d'empreinte cryptographique du protocole de description de session (SDP), en mettant fin au flux multimédia si la vérification échoue, pour garantir l'authenticité du flux multimédia.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V17.3", + "Ordinal": 3, + "Name": "Signalisation", + "Items": [ + { + "Shortcode": "V17.3.1", + "Ordinal": 1, + "Description": "Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation entrants légitimes lors d'une attaque par saturation. Cela peut être réalisé en implémentant une limitation de débit au niveau de la signalisation.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.3.2", + "Ordinal": 2, + "Description": "Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation légitimes en cas de message mal formé susceptible de provoquer un déni de service. Cela peut inclure la validation des entrées, la gestion sécurisée des dépassements d'entiers, la prévention des dépassements de tampon et l'utilisation d'autres techniques robustes de gestion des erreurs.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + } + ] +} diff --git a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.xml b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.xml new file mode 100644 index 0000000000..4225c650e7 --- /dev/null +++ b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.legacy.xml @@ -0,0 +1 @@ +Application Security Verification Standard ProjectASVS5.0.0The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.V11EncodingEncodage et nettoyageV1.11Architecture d'encodage et de nettoyageV1.1.11Vérifiez que l'entrée est décodée ou non échappée vers une forme canonique une seule fois, elle n'est décodée que lorsque des données codées sous cette forme sont attendues, et que cela est fait avant de traiter davantage l'entrée, par exemple, elle n'est pas effectuée après la validation ou la désinfection de l'entrée.FalseTrue✓True✓V1.1.22Vérifiez que l'application effectue l'encodage et l'échappement de sortie soit comme étape finale avant d'être utilisée par l'interpréteur pour lequel elle est destinée, soit par l'interpréteur lui-même.FalseTrue✓True✓V1.22Prévention des injectionsV1.2.11Vérifiez que l'encodage de sortie d'une réponse HTTP, d'un document HTML ou d'un document XML est pertinent pour le contexte requis, comme l'encodage des caractères pertinents pour les éléments HTML, les attributs HTML, les commentaires HTML, les CSS ou les champs d'en-tête HTTP, pour éviter de modifier la structure du message ou du document.True✓True✓True✓V1.2.22Vérifiez que, lors de la création dynamique d'URL, les données non fiables sont encodées en fonction de leur contexte (par exemple, encodage d'URL ou encodage base64url pour les paramètres de requête ou de chemin). Assurez-vous que seuls les schémas d'URL sûrs sont autorisés (par exemple, interdire javascript: ou data:).True✓True✓True✓V1.2.33Vérifiez que l'encodage ou l'échappement de sortie est utilisé lors de la création dynamique de contenu JavaScript (y compris JSON), pour éviter de modifier la structure du message ou du document (pour éviter l'injection JavaScript et JSON).True✓True✓True✓V1.2.44Vérifiez que la sélection de données ou les requêtes de base de données (par exemple, SQL, HQL, NoSQL, Cypher) utilisent des requêtes paramétrées, des ORM, des Framework d'entités ou sont protégées contre les injections SQL et autres attaques par injection de base de données. Ceci est également pertinent lors de l'écriture de procédures stockées.True✓True✓True✓V1.2.55Vérifiez que l’application protège contre l’injection de commandes du système d’exploitation et que les appels du système d’exploitation utilisent des requêtes du système d’exploitation paramétrées ou utilisent un encodage de sortie de ligne de commande contextuelle.True✓True✓True✓V1.2.66Vérifiez que l’application protège contre les vulnérabilités d’injection LDAP ou que des contrôles de sécurité spécifiques pour empêcher l’injection LDAP ont été mis en œuvre.FalseTrue✓True✓V1.2.77Vérifiez que l’application est protégée contre les attaques par injection XPath en utilisant la paramétrisation des requêtes ou des requêtes précompilées.FalseTrue✓True✓V1.2.88Vérifiez que les processeurs LaTeX sont configurés de manière sécurisée (par exemple, en n'utilisant pas l'indicateur « --shell-escape ») et qu'une liste d’autorisations de commandes est utilisée pour empêcher les attaques par injection LaTeX.FalseTrue✓True✓V1.2.99Vérifiez que l'application échappe les caractères spéciaux dans les expressions régulières (généralement à l'aide d'une barre oblique inverse) pour éviter qu'ils ne soient mal interprétés comme des métacaractères.FalseTrue✓True✓V1.2.1010Vérifiez que l'application est protégée contre les injections CSV et injections de formules. L'application doit respecter les règles d'échappement définies dans les sections 2.6 et 2.7 de la RFC 4180 lors de l'export de contenu CSV. De plus, lors de l'export au format CSV ou vers d'autres formats de tableur (tels que XLS, XLSX ou ODF), les caractères spéciaux (notamment « = », « + », « - », « @ », « \t » (tabulation) et « \0 » (caractère null)) doivent être protégés par une apostrophe s'ils apparaissent en premier dans une valeur de champ.FalseFalseTrue✓V1.33NettoyageV1.3.11Vérifiez que toutes les entrées HTML non fiables provenant d'éditeurs WYSIWYG ou similaires sont nettoyées à l'aide d'une bibliothèque ou d'une fonctionnalité de Framework de nettoyage HTML bien connue et sécurisée.True✓True✓True✓V1.3.22Vérifiez que l'application évite d'utiliser eval() ou d'autres fonctionnalités d'exécution de code dynamique telles que Spring Expression Language (SpEL). En l'absence d'alternative, toute saisie utilisateur incluse doit être nettoyée avant d'être exécutée.True✓True✓True✓V1.3.33Vérifiez que les données transmises à un contexte potentiellement dangereux sont préalablement nettoyées pour appliquer des mesures de sécurité, telles qu'autoriser uniquement des caractères sûrs pour ce contexte et raccourcir des entrées trop longues.FalseTrue✓True✓V1.3.44Vérifiez que le contenu Scalable Vector Graphics (SVG) scriptable fourni par l'utilisateur est validé ou nettoyé pour contenir uniquement des balises et des attributs (tels que des graphiques de dessin) qui sont sûrs pour l'application, par exemple, ne contiennent pas de scripts et d'objets étrangers.FalseTrue✓True✓V1.3.55Vérifiez que l'application nettoie ou désactive le contenu du langage de modèle d'expression ou de script fourni par l'utilisateur, tel que les feuilles de style CSS, le Markdown ou XSL, BBCode ou similaire.FalseTrue✓True✓V1.3.66Vérifiez que l'application protège contre les attaques de falsification de requête côté serveur (SSRF), en validant les données non fiables par rapport à une liste d'autorisation de protocoles, de domaines, de chemins et de ports et en nettoyant les caractères potentiellement dangereux avant d'utiliser les données pour appeler un autre service.FalseTrue✓True✓V1.3.77Vérifiez que l'application se protège contre les attaques par injection de modèles en interdisant la création de modèles basés sur des entrées non fiables. En l'absence d'alternative, toute entrée non fiable incluse dynamiquement lors de la création du modèle doit être nettoyée ou rigoureusement validée.FalseTrue✓True✓V1.3.88Vérifiez que l’application nettoie correctement les entrées non fiables avant utilisation dans les requêtes Java Naming and Directory Interface (JNDI) et que JNDI est configuré de manière sécurisée pour empêcher les attaques par injection JNDI.FalseTrue✓True✓V1.3.99Vérifiez que l’application nettoie le contenu avant qu’il ne soit envoyé à memcache pour éviter les attaques par injection.FalseTrue✓True✓V1.3.1010Vérifiez que les chaînes de format susceptibles d'être résolues de manière inattendue ou malveillante lors de leur utilisation sont nettoyées avant d'être traitées.FalseTrue✓True✓V1.3.1111Vérifiez que l'application nettoie les entrées utilisateur avant de les transmettre aux systèmes de messagerie pour se protéger contre l'injection SMTP ou IMAP.FalseTrue✓True✓V1.3.1212Vérifiez que les expressions régulières sont exemptes d'éléments provoquant "backtracking" exponentiel et assurez-vous que les entrées non fiables sont nettoyées pour atténuer les attaques ReDoS ou Runaway Regex.FalseFalseTrue✓V1.44Mémoire, chaine de caractères et code à mémoire non-managéeV1.4.11Vérifiez que l'application utilise des chaînes memory-safe, une copie de mémoire et une arithmétique de pointeur renforcée pour détecter ou empêcher les débordements de pile, de tampon ou de tas.FalseTrue✓True✓V1.4.22Vérifiez que les techniques de validation du signe, de la plage et de l’entrée sont utilisées pour éviter les dépassements d’entiers.FalseTrue✓True✓V1.4.33Vérifiez que la mémoire et les ressources allouées dynamiquement sont libérées et que les références ou les pointeurs vers la mémoire libérée sont supprimés ou définis à null pour éviter les "dangling pointer" et les vulnérabilités d'utilisation après libération.FalseTrue✓True✓V1.55Désérialisation sécuriséeV1.5.11Vérifiez que l'application configure les "parser" XML pour utiliser une configuration restrictive et que les fonctionnalités non sûres telles que la résolution d'entités externes sont désactivées pour empêcher les attaques XML eXternal Entity (XXE).True✓True✓True✓V1.5.22Vérifiez que la désérialisation des données non fiables garantit une gestion sécurisée des entrées, par exemple en utilisant une liste d'autorisation de types d'objets ou en limitant les types d'objets définis par le client, afin d'empêcher les attaques par désérialisation. Les mécanismes de désérialisation explicitement définis comme non sécurisés ne doivent pas être utilisés avec des entrées non fiables.FalseTrue✓True✓V1.5.33Vérifiez que les différents "parser" utilisés dans l'application pour le même type de données (par exemple, les "parser" JSON, les "parser" XML, les "parser" d'URL) effectuent l'analyse de manière cohérente et utilisent le même mécanisme d'encodage de caractères pour éviter des problèmes tels que les vulnérabilités d'interopérabilité JSON ou un comportement d'analyse d'URI ou de fichier différent exploité dans les attaques d'inclusion de fichiers à distance (RFI) ou de falsification de requête côté serveur (SSRF).FalseFalseTrue✓V22ValidationValidation et logique métierV2.11Validation et documentation de la logique métierV2.1.11Vérifiez que la documentation de l'application définit des règles de validation des entrées pour vérifier la validité des éléments de données par rapport à la structure attendue. Il peut s'agir de formats de données courants tels que des numéros de carte de crédit, des adresses e-mail ou des numéros de téléphone, ou d'un format de données interne.True✓True✓True✓V2.1.22Vérifiez que la documentation de l'application définit comment valider la cohérence logique et contextuelle des éléments de données combinés, par exemple en vérifiant que la banlieue et le code postal correspondent.FalseTrue✓True✓V2.1.33Vérifiez que les attentes en matière de limites et de validations de la logique métier sont documentées, y compris par utilisateur et globalement dans l'application.FalseTrue✓True✓V2.22Validation des entréesV2.2.11Vérifier que les entrées sont validées afin de respecter les attentes métier ou fonctionnelles. Cette validation doit être basée sur une liste de valeurs, de modèles et de plages autorisées, ou sur la comparaison des entrées avec une structure attendue et des limites logiques selon des règles prédéfinies. Pour le niveau 1, cette validation peut se concentrer sur les entrées utilisées pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau 2, elle doit s'appliquer à toutes les entrées.True✓True✓True✓V2.2.22Vérifiez que l'application est conçue pour appliquer la validation des entrées au niveau d'une couche de service de confiance. Bien que la validation côté client améliore l'ergonomie et doit être encouragée, elle ne doit pas être considérée comme un contrôle de sécurité.True✓True✓True✓V2.2.33Vérifiez que l’application garantit que les combinaisons d’éléments de données associés sont raisonnables selon les règles prédéfinies.FalseTrue✓True✓V2.33Sécurité de la logique métierV2.3.11Vérifiez que l’application traitera uniquement les flux de logique métier pour le même utilisateur dans l’ordre séquentiel attendu et sans sauter d’étapes.True✓True✓True✓V2.3.22Vérifiez que les limites de la logique métier sont implémentées conformément à la documentation de l'application, afin d'éviter que des failles de la logique métier ne soient pas exploitées.FalseTrue✓True✓V2.3.33Vérifiez que les transactions sont utilisées au niveau de la logique métier de telle sorte qu'une opération de logique métier réussisse dans son intégralité ou qu'elle soit restaurée à l'état correct précédent.FalseTrue✓True✓V2.3.44Vérifiez que les mécanismes de verrouillage au niveau de la logique métier sont utilisés pour garantir que les ressources en quantité limitée (telles que les sièges de théâtre ou les créneaux de livraison) ne peuvent pas être réservées deux fois en manipulant la logique de l'application.FalseTrue✓True✓V2.3.55Vérifiez que les flux logiques métier à forte valeur ajoutée nécessitent l'approbation de plusieurs utilisateurs afin d'éviter toute action non autorisée ou accidentelle. Cela peut inclure, sans s'y limiter, les transferts monétaires importants, les approbations de contrats, l'accès à des informations classifiées ou les contournements de sécurité dans le secteur manufacturier.FalseFalseTrue✓V2.44Anti-automatisationV2.4.11Vérifiez que des contrôles anti-automatisation sont en place pour protéger contre les appels excessifs aux fonctions d'application qui pourraient conduire à l'exfiltration de données, à la création de données inutiles, à l'épuisement des quotas, aux violations de limites de débit, au déni de service ou à la surutilisation de ressources coûteuses.FalseTrue✓True✓V2.4.22Vérifiez que les flux logiques métier nécessitent un timing humain réaliste, évitant ainsi des soumissions de transactions excessivement rapides.FalseFalseTrue✓V33WebSécurité du frontend WebV3.11Documentation sur la sécurité du frontend WebV3.1.11Vérifiez que la documentation de l'application indique les fonctionnalités de sécurité attendues que les navigateurs utilisant l'application doivent prendre en charge (telles que HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) et autres mécanismes de sécurité HTTP pertinents). Elle doit également définir le comportement de l'application lorsque certaines de ces fonctionnalités ne sont pas disponibles (par exemple, avertir l'utilisateur ou bloquer l'accès).FalseFalseTrue✓V3.22Interprétation non intentionnelle du contenuV3.2.11Vérifiez que des contrôles de sécurité sont en place pour empêcher les navigateurs d'afficher du contenu ou des fonctionnalités dans les réponses HTTP dans un contexte incorrect (par exemple, lorsqu'une API, un fichier téléchargé par l'utilisateur ou une autre ressource est demandée directement). Les contrôles possibles peuvent inclure : ne pas transmettre le contenu sauf si les champs d'en-tête de requête HTTP (tels que Sec-Fetch-\*) indiquent qu'il s'agit du contexte correct, utiliser la directive sandbox du champ d'en-tête Content-Security-Policy ou utiliser le type de disposition de pièce jointe dans le champ d'en-tête Content-Disposition.True✓True✓True✓V3.2.22Vérifiez que le contenu destiné à être affiché sous forme de texte, plutôt que rendu sous forme de HTML, est géré à l'aide de fonctions de rendu sécurisées (telles que createTextNode ou textContent) pour empêcher l'exécution involontaire de contenu tel que HTML ou JavaScript.True✓True✓True✓V3.2.33Vérifiez que l'application évite l'écrasement du DOM lors de l'utilisation de JavaScript côté client en utilisant des déclarations de variables explicites, en effectuant une vérification de type stricte, en évitant de stocker des variables globales sur l'objet document et en implémentant l'isolation de l'espace de nommage.FalseFalseTrue✓V3.33Configuration des cookiesV3.3.11Vérifiez que les cookies ont l'attribut « Secure » ​​défini et si le préfixe « \__Host- » n'est pas utilisé pour le nom du cookie, le préfixe « __Secure- » doit être utilisé pour le nom du cookie.True✓True✓True✓V3.3.22Vérifiez que la valeur de l'attribut « SameSite » de chaque cookie est définie en fonction de l'objectif du cookie, afin de limiter l'exposition aux attaques de réparation de l'interface utilisateur et aux attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).FalseTrue✓True✓V3.3.33Vérifiez que les cookies ont le préfixe « __Host- » pour le nom du cookie, sauf s'ils sont explicitement conçus pour être partagés avec d'autres hôtes.FalseTrue✓True✓V3.3.44Vérifiez que si la valeur d'un cookie n'est pas censée être accessible aux scripts côté client (comme un jeton de session), le cookie doit avoir l'attribut « HttpOnly » défini et la même valeur (par exemple, un jeton de session) ne doit être transférée au client que via le champ d'en-tête « Set-Cookie ».FalseTrue✓True✓V3.3.55Vérifiez que lorsque l'application écrit un cookie, la longueur combinée du nom et de la valeur du cookie ne dépasse pas 4 096 octets. Les cookies trop volumineux ne seront pas stockés par le navigateur et ne seront donc pas envoyés avec les requêtes, empêchant ainsi l'utilisateur d'utiliser les fonctionnalités de l'application qui reposent sur ce cookie.FalseFalseTrue✓V3.44En-têtes du mécanisme de sécurité du navigateurV3.4.11Vérifiez qu'un champ d'en-tête Strict-Transport-Security est inclus dans toutes les réponses afin d'appliquer une politique HTTP Strict Transport Security (HSTS). Une durée maximale d'au moins un an doit être définie, et pour les niveaux L2 et supérieurs, la politique doit également s'appliquer à tous les sous-domaines.True✓True✓True✓V3.4.22Vérifiez que le champ d'en-tête Access-Control-Allow-Origin du partage de ressources cross-origine (CORS) est une valeur fixe de l'application ou, si la valeur du champ d'en-tête de requête HTTP Origin est utilisée, qu'elle est validée par rapport à une liste d'origines approuvées. Si « Access-Control-Allow-Origin: * » doit être utilisé, vérifiez que la réponse ne contient aucune information sensible.True✓True✓True✓V3.4.33Vérifiez que les réponses HTTP incluent un champ d'en-tête de réponse Content-Security-Policy qui définit des directives garantissant que le navigateur charge et exécute uniquement du contenu ou des ressources fiables, afin de limiter l'exécution de JavaScript malveillant. Au minimum, une politique globale doit être utilisée, incluant les directives object-src 'none' et base-uri 'none', et définissant soit une lliste d’autorisations, soit des valeurs nonces ou des hachages. Pour une application L3, une politique par réponse avec des valeurs nonces ou des hachages doit être définie.FalseTrue✓True✓V3.4.44Vérifiez que toutes les réponses HTTP contiennent un champ d'en-tête « X-Content-Type-Options: nosniff ». Cela indique aux navigateurs de ne pas utiliser l'analyse de contenu ni la détection du type MIME pour la réponse donnée, et d'exiger que la valeur du champ d'en-tête « Content-Type » de la réponse corresponde à la ressource de destination. Par exemple, la réponse à une demande de style n'est acceptée que si le type de contenu de la réponse est « text/css ». Cela permet également au navigateur d'utiliser la fonctionnalité de blocage de lecture inter-origines (CORB).FalseTrue✓True✓V3.4.55Vérifiez que l'application définit une politique de référencement afin d'empêcher la fuite de données techniquement sensibles vers des services tiers via le champ d'en-tête de requête HTTP « Referer ». Cela peut être effectué via le champ d'en-tête de réponse HTTP « Referrer-Policy » ou via les attributs d'élément HTML. Les données sensibles peuvent inclure le chemin d'accès et les données de requête dans l'URL, et pour les applications internes non publiques, le nom d'hôte.FalseTrue✓True✓V3.4.66Vérifiez que l'application Web utilise la directive frame-ancestors du champ d'en-tête Content-Security-Policy pour chaque réponse HTTP afin de garantir qu'elle ne peut pas être intégrée par défaut et que l'intégration de ressources spécifiques n'est autorisée qu'en cas de nécessité. Notez que le champ d'en-tête X-Frame-Options, bien que pris en charge par les navigateurs, est obsolète et n'est pas forcément fiable.FalseTrue✓True✓V3.4.77Vérifiez que le champ d’en-tête Content-Security-Policy spécifie un emplacement pour signaler les violations.FalseFalseTrue✓V3.4.88Vérifiez que toutes les réponses HTTP qui lancent le rendu d'un document (comme les réponses de type text/html) incluent le champ d'en-tête 'Cross-Origin-Opener-Policy' avec la directive 'same-origin' ou s'ame-origin-allow-popups', selon les besoins. Cela empêche les attaques abusant de l'accès partagé aux objets Window, telles que le tabnabbing et le comptage d'images.FalseFalseTrue✓V3.55Séparation de l'origine du navigateurV3.5.11Vérifiez que, si l'application ne s'appuie pas sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher les requêtes inter-origines non autorisées d'utiliser des fonctionnalités sensibles, ces requêtes sont validées afin de garantir leur origine. Cela peut se faire en utilisant et en validant des jetons anti-falsification ou en exigeant des champs d'en-tête HTTP supplémentaires qui ne sont pas des champs d'en-tête de requête CORS safelist. Ceci permet de se protéger contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).True✓True✓True✓V3.5.22Vérifiez que, si l'application s'appuie sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher l'utilisation inter-origines non autorisée de fonctionnalités sensibles, il est impossible d'appeler la fonctionnalité avec une requête qui ne déclenche pas de requête de pré-vérification cross-origin CORS. Cela peut nécessiter de vérifier les valeurs des champs d'en-tête de requête 'Origin' et 'Content-Type' ou d'utiliser un champ d'en-tête supplémentaire qui n'est pas un champ d'en-tête de la liste de sécurité CORS.True✓True✓True✓V3.5.33Vérifiez que les requêtes HTTP destinées aux fonctionnalités sensibles utilisent des méthodes HTTP appropriées, telles que POST, PUT, PATCH ou DELETE, et non des méthodes définies comme « sûres » par la spécification HTTP, telles que HEAD, OPTIONS ou GET. Une validation stricte des champs d'en-tête de requête Sec-Fetch-* peut également être utilisée pour garantir que la requête ne provient pas d'un appel inter-origines inapproprié, d'une requête de navigation ou d'un chargement de ressources (comme une source d'image) inattendu.True✓True✓True✓V3.5.44Vérifiez que des applications distinctes sont hébergées sur des noms d'hôte différents pour tirer parti des restrictions fournies par la politique de même origine, y compris la manière dont les documents ou scripts chargés par une origine peuvent interagir avec les ressources d'une autre origine et les restrictions basées sur le nom d'hôte sur les cookies.FalseTrue✓True✓V3.5.55Vérifiez que les messages reçus par l'interface postMessage sont rejetés si l'origine du message n'est pas digne de confiance ou si la syntaxe du message n'est pas valide.FalseTrue✓True✓V3.5.66Vérifiez que la fonctionnalité JSONP n'est activée nulle part dans l'application pour éviter les attaques Cross-Site Script Inclusion (XSSI).FalseFalseTrue✓V3.5.77Vérifiez que les données nécessitant une autorisation ne sont pas incluses dans les réponses des ressources de script, comme les fichiers JavaScript, pour empêcher les attaques par inclusion de script intersite (XSSI).FalseFalseTrue✓V3.5.88Vérifiez que les ressources authentifiées (telles que les images, les vidéos, les scripts et autres documents) peuvent être chargées ou intégrées pour le compte de l'utilisateur uniquement lorsque cela est prévu. Cela peut être réalisé en validant strictement les champs d'en-tête de requête HTTP Sec-Fetch-* afin de garantir que la requête ne provient pas d'un appel cross-origin inapproprié, ou en définissant un champ d'en-tête de réponse HTTP Cross-Origin-Resource-Policy restrictif pour indiquer au navigateur de bloquer le contenu renvoyé.FalseFalseTrue✓V3.66Intégrité des ressources externesV3.6.11Vérifiez que les ressources côté client, telles que les bibliothèques JavaScript, les feuilles de style CSS ou les polices web, sont hébergées en externe (par exemple, sur un réseau de diffusion de contenu) uniquement si la ressource est statique et versionnée, et si l'intégrité des sous-ressources (SRI) est utilisée pour valider l'intégrité de la ressource. Si cela n'est pas possible, une décision de sécurité documentée doit justifier cette décision pour chaque ressource.FalseFalseTrue✓V3.77Autres considérations sur la sécurité du navigateurV3.7.11Vérifiez que l'application utilise uniquement des technologies côté client toujours prises en charge et considérées comme sécurisées. Parmi les technologies qui ne répondent pas à cette exigence figurent les plugins NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL ou les applets Java côté client.FalseTrue✓True✓V3.7.22Vérifiez que l'application redirigera automatiquement l'utilisateur vers un nom d'hôte ou un domaine différent (qui n'est pas contrôlé par l'application) uniquement lorsque la destination apparaît sur une liste d'autorisation.FalseTrue✓True✓V3.7.33Vérifiez que le domaine de premier niveau de l'application (par exemple, site.tld) ​​est ajouté à la liste de préchargement publique pour HTTP Strict Transport Security (HSTS). Cela garantit que l'utilisation de TLS pour l'application est intégrée directement dans les principaux navigateurs, plutôt que de dépendre uniquement du champ d'en-tête de réponse Strict-Transport-Security.FalseFalseTrue✓V3.7.44Vérifiez que l'application affiche une notification lorsque l'utilisateur est redirigé vers une URL hors du contrôle de l'application, avec une option pour annuler la navigation.FalseFalseTrue✓V3.7.55Vérifiez que l'application se comporte comme documenté (par exemple, en avertissant l'utilisateur ou en bloquant l'accès) si le navigateur utilisé pour accéder à l'application ne prend pas en charge les fonctionnalités de sécurité attendues.FalseFalseTrue✓V44APIAPI et service WebV4.11Sécurité du service Web génériqueV4.1.11Vérifiez que chaque réponse HTTP avec un corps de message contient un champ d'en-tête Content-Type qui correspond au contenu réel de la réponse, y compris le paramètre charset pour spécifier un codage de caractères sécurisé (par exemple, UTF-8, ISO-8859-1) conformément aux types de médias IANA, tels que « text/ », « /+xml » et « /xml ».True✓True✓True✓V4.1.22Vérifiez que seuls les terminaux utilisateurs (destinés à l'accès manuel via un navigateur web) redirigent automatiquement de HTTP vers HTTPS, tandis que les autres services ou terminaux n'implémentent pas de redirections transparentes. Cela permet d'éviter qu'un client envoie par erreur des requêtes HTTP non chiffrées, mais que, comme ces requêtes sont automatiquement redirigées vers HTTPS, la fuite de données sensibles passe inaperçue.FalseTrue✓True✓V4.1.33Vérifiez que tout champ d'en-tête HTTP utilisé par l'application et défini par une couche intermédiaire, telle qu'un équilibreur de charge, un proxy web ou un service backend-for-frontend, ne peut pas être remplacé par l'utilisateur final. Les exemples d'en-têtes peuvent inclure X-Real-IP, X-Forwarded-*, ou X-User-ID.FalseTrue✓True✓V4.1.44Vérifiez que seules les méthodes HTTP explicitement prises en charge par l'application ou son API (y compris les OPTIONS lors des demandes de contrôle en amont) peuvent être utilisées et que les méthodes inutilisées sont bloquées.FalseFalseTrue✓V4.1.55Vérifier que les signatures numériques par message sont utilisées pour fournir une assurance supplémentaire en plus des protections de transport pour les demandes ou les transactions qui sont très sensibles ou qui traversent un certain nombre de systèmes.FalseFalseTrue✓V4.22Validation de la structure des messages HTTPV4.2.11Vérifiez que tous les composants de l'application (y compris les équilibreurs de charge, les pares-feux et les serveurs d'applications) déterminent les limites des messages HTTP entrants à l'aide du mécanisme approprié à la version HTTP afin d'empêcher la contrebande de requêtes HTTP. Dans HTTP/1.x, si un champ d'en-tête Transfer-Encoding est présent, l'en-tête Content-Length doit être ignoré conformément à la RFC 2616. Avec HTTP/2 ou HTTP/3, si un champ d'en-tête Content-Length est présent, le récepteur doit s'assurer qu'il est cohérent avec la longueur des trames DATA.FalseTrue✓True✓V4.2.22Vérifier que, lors de la génération de messages HTTP, le champ d'en-tête Content-Length n'entre pas en conflit avec la longueur du contenu déterminée par le cadrage du protocole HTTP, afin d'empêcher les attaques de type « request smuggling ».FalseFalseTrue✓V4.2.33Vérifiez que l'application n'envoie ni n'accepte de messages HTTP/2 ou HTTP/3 avec des champs d'en-tête spécifiques à la connexion, tels que Transfer-Encoding, afin d'éviter les attaques par fractionnement de la réponse et par injection d'en-tête.FalseFalseTrue✓V4.2.44Vérifiez que l'application n'accepte que les requêtes HTTP/2 et HTTP/3 dont les champs et valeurs d'en-tête ne contiennent pas de séquences CR (\r), LF (\n) ou CRLF (\r\n), afin d'éviter les attaques par injection d'en-tête.FalseFalseTrue✓V4.2.55Vérifiez que, si l'application (backend ou frontend) construit et envoie des requêtes, elle utilise des mécanismes de validation, d'assainissement ou autres pour éviter de créer des URI (comme pour les appels API) ou des champs d'en-tête de requête HTTP (comme Authorization ou Cookie) qui sont trop longs pour être acceptés par le composant récepteur. Cela pourrait entraîner un déni de service, par exemple lors de l'envoi d'une requête trop longue (par exemple, un long champ d'en-tête de cookie), ce qui fait que le serveur répond toujours avec un statut d'erreur.FalseFalseTrue✓V4.33GraphQLV4.3.11Vérifiez qu'une liste d'autorisation de requête, une limitation de profondeur, une limitation de quantité ou une analyse des coûts de requête est utilisée pour empêcher le déni de service (DoS) de GraphQL ou d'expression de la couche données en raison de requêtes imbriquées coûteuses.FalseTrue✓True✓V4.3.22Vérifiez que les requêtes d’introspection GraphQL sont désactivées dans l’environnement de production, sauf si l’API GraphQL est destinée à être utilisée par d’autres parties.FalseTrue✓True✓V4.44WebSocketV4.4.11Vérifiez que WebSocket sur TLS (WSS) est utilisé pour toutes les connexions WebSocket.True✓True✓True✓V4.4.22Vérifiez que, lors de la négociation HTTP WebSocket initiale, le champ d’en-tête 'Origin' est vérifié par rapport à une liste d’origines autorisées pour l’application.FalseTrue✓True✓V4.4.33Vérifiez que, si la gestion de session standard de l'application ne peut pas être utilisée, des jetons dédiés sont utilisés à cet effet, qui sont conformes aux exigences de sécurité de gestion de session pertinentes.FalseTrue✓True✓V4.4.44Vérifiez que les jetons de gestion de session WebSocket dédiés sont initialement obtenus ou validés via la session HTTPS précédemment authentifiée lors de la transition d'une session HTTPS existante vers un canal WebSocket.FalseTrue✓True✓V55FileGestion des fichiersV5.11Documentation sur la gestion des fichiersV5.1.11Vérifiez que la documentation définit les types de fichiers autorisés, les extensions de fichiers attendues et la taille maximale (y compris la taille décompressée) pour chaque fonctionnalité de Téléversement. De plus, assurez-vous que la documentation précise comment les fichiers sont sécurisés pour le téléchargement et le traitement des utilisateurs finaux, par exemple le comportement de l'application lorsqu'un fichier malveillant est détecté.FalseTrue✓True✓V5.22Téléversement de fichiers et contenuV5.2.11Vérifiez que l'application n'acceptera que des fichiers d'une taille qu'elle peut traiter sans provoquer de perte de performances ou d'attaque par déni de service.True✓True✓True✓V5.2.22Vérifiez que lorsque l'application accepte un fichier, seul ou dans une archive telle qu'un fichier zip, elle vérifie si l'extension de fichier correspond à une extension attendue et que le contenu correspond au type représenté par l'extension. Cela inclut, sans s'y limiter, la vérification des « octets magiques » initiaux, la réécriture d'images et l'utilisation de bibliothèques spécialisées pour la validation du contenu des fichiers. Pour le niveau L1, cela peut se concentrer uniquement sur les fichiers utilisés pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau L2, cela doit s'appliquer à tous les fichiers acceptés.True✓True✓True✓V5.2.33Vérifiez que l'application vérifie les fichiers compressés (par exemple, zip, gz, docx, odt) par rapport à la taille maximale autorisée non compressée et au nombre maximal de fichiers avant de décompresser le fichier.FalseTrue✓True✓V5.2.44Vérifiez qu'un quota de taille de fichier et un nombre maximal de fichiers par utilisateur sont appliqués pour garantir qu'un seul utilisateur ne puisse pas remplir le stockage avec trop de fichiers ou des fichiers excessivement volumineux.FalseFalseTrue✓V5.2.55Vérifiez que l'application n'autorise pas le téléversement de fichiers compressés contenant des liens symboliques, sauf si cela est spécifiquement requis (auquel cas il sera nécessaire d'appliquer une liste d'autorisation des fichiers vers lesquels il est possible de créer des liens symboliques).FalseFalseTrue✓V5.2.66Vérifiez que l'application rejette les images téléversées avec une taille de pixel supérieure au maximum autorisé, afin d'éviter les attaques par inondation de pixels.FalseFalseTrue✓V5.33Stockage de fichiersV5.3.11Vérifiez que les fichiers téléversés ou générés par une entrée non fiable et stockés dans un dossier public ne sont pas exécutés en tant que code de programme côté serveur lorsqu'ils sont accessibles directement avec une requête HTTP.True✓True✓True✓V5.3.22Vérifiez que lorsque l'application crée des chemins d'accès pour les opérations sur les fichiers, elle utilise des données générées en interne ou fiables plutôt que des noms de fichiers soumis par l'utilisateur. Si des noms de fichiers ou des métadonnées de fichiers soumis par l'utilisateur doivent être utilisés, une validation et un nettoyage stricts doivent être appliqués. Ceci permet de se protéger contre les attaques par traversée de chemin, l'inclusion de fichiers locaux ou distants (LFI, RFI) et la falsification de requêtes côté serveur (SSRF).True✓True✓True✓V5.3.33Vérifiez que le traitement des fichiers côté serveur, comme la décompression des fichiers, ignore les informations de chemin fournies par l'utilisateur pour éviter les vulnérabilités telles que le "zip slip".FalseFalseTrue✓V5.44Téléchargement de fichierV5.4.11Vérifiez que l’application valide ou ignore les noms de fichiers soumis par l’utilisateur, y compris dans un paramètre JSON, JSONP ou URL et spécifie un nom de fichier dans le champ d’en-tête Content-Disposition de la réponse.FalseTrue✓True✓V5.4.22Vérifiez que les noms de fichiers servis (par exemple, dans les champs d'en-tête de réponse HTTP ou les pièces jointes aux e-mails) sont encodés ou nettoyés (par exemple, conformément à la RFC 6266) pour préserver la structure du document et empêcher les attaques par injection.FalseTrue✓True✓V5.4.33Vérifiez que les fichiers obtenus à partir de sources non fiables sont analysés par des scanners antivirus pour empêcher la diffusion de contenu malveillant connu.FalseTrue✓True✓V66AuthenticationAuthentificationV6.11Documentation d'authentificationV6.1.11Vérifiez que la documentation de l'application définit comment les contrôles, tels que la limitation de débit, l'anti-automatisation et la réponse adaptative, sont utilisés pour se défendre contre les attaques telles que le « credential stuffing » et la force brute des mots de passe. La documentation doit expliquer clairement comment ces contrôles sont configurés et empêcher le blocage malveillant des comptes.True✓True✓True✓V6.1.22Vérifiez qu'une liste de mots spécifiques au contexte est documentée afin d'empêcher leur utilisation dans les mots de passe. Cette liste peut inclure des permutations de noms d'organisations, de produits, d'identifiants de systèmes, de noms de codes de projets, de noms de services ou de rôles, etc.FalseTrue✓True✓V6.1.33Vérifiez que, si l'application inclut plusieurs voies d'authentification, celles-ci sont toutes documentées avec les contrôles de sécurité et la force d'authentification qui doivent être appliqués de manière cohérente.FalseTrue✓True✓V6.22Sécurité des mots de passeV6.2.11Vérifiez que les mots de passe définis par l'utilisateur comportent au moins 8 caractères, bien qu'un minimum de 15 caractères soit fortement recommandé.True✓True✓True✓V6.2.22Vérifiez que les utilisateurs peuvent modifier leur mot de passe.True✓True✓True✓V6.2.33Vérifiez que la fonctionnalité de changement de mot de passe nécessite le mot de passe actuel et le nouveau mot de passe de l'utilisateur.True✓True✓True✓V6.2.44Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou du changement de mot de passe sont vérifiés par rapport à un ensemble disponible d'au moins 3 000 mots de passe principaux qui correspondent à la politique de mot de passe de l'application, par exemple la longueur minimale.True✓True✓True✓V6.2.55Vérifiez que les mots de passe peuvent être utilisés, quelle que soit leur composition, sans restriction quant au type de caractères autorisés. Aucun nombre minimal de majuscules ou de minuscules, de chiffres ou de caractères spéciaux ne doit être exigé.True✓True✓True✓V6.2.66Vérifiez que les champs de saisie du mot de passe utilisent type=password pour masquer la saisie. Les applications peuvent permettre à l'utilisateur d'afficher temporairement l'intégralité du mot de passe masqué ou le dernier caractère saisi.True✓True✓True✓V6.2.77Vérifiez que la fonctionnalité « coller », les assistants de mot de passe du navigateur et les gestionnaires de mots de passe externes sont autorisés.True✓True✓True✓V6.2.88Vérifiez que l'application vérifie le mot de passe de l'utilisateur exactement tel qu'il a été reçu de l'utilisateur, sans aucune modification telle qu'une troncature ou une transformation de casse.True✓True✓True✓V6.2.99Vérifiez que les mots de passe d’au moins 64 caractères sont autorisés.FalseTrue✓True✓V6.2.1010Vérifiez que le mot de passe d'un utilisateur reste valide jusqu'à ce qu'il soit découvert comme compromis ou qu'il soit renouvelé. L'application ne doit pas exiger de renouvellement périodique des identifiants.FalseTrue✓True✓V6.2.1111Vérifiez que la liste documentée de mots spécifiques au contexte est utilisée pour éviter la création de mots de passe faciles à deviner.FalseTrue✓True✓V6.2.1212Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou des modifications de mot de passe sont vérifiés par rapport à un ensemble de mots de passe fuités.FalseTrue✓True✓V6.33Sécurité générale de l'authentificationV6.3.11Vérifiez que les contrôles visant à empêcher les attaques telles que le bourrage d'informations d'identification et la force brute des mots de passe sont mis en œuvre conformément à la documentation de sécurité de l'application.True✓True✓True✓V6.3.22Vérifiez que les comptes d’utilisateur par défaut (par exemple, « root », « admin » ou « sa ») ne sont pas présents dans l’application ou sont désactivés.True✓True✓True✓V6.3.33Vérifiez que l’application exige que les utilisateurs utilisent un mécanisme d’authentification multifacteur ou une combinaison de mécanismes d’authentification à facteur unique.FalseTrue✓True✓V6.3.44Vérifiez que, si l’application inclut plusieurs voies d’authentification, il n’existe aucune voie non documentée et que les contrôles de sécurité et la force d’authentification sont appliqués de manière cohérente.FalseTrue✓True✓V6.3.55Vérifiez que les utilisateurs sont informés des tentatives d'authentification suspectes (réussies ou non). Il peut s'agir de tentatives d'authentification provenant d'un emplacement ou d'un client inhabituel, d'une authentification partiellement réussie (un seul facteur parmi plusieurs), d'une tentative d'authentification après une longue période d'inactivité ou d'une authentification réussie après plusieurs tentatives infructueuses.FalseFalseTrue✓V6.3.66Vérifiez que le courrier électronique n’est pas utilisé comme mécanisme d’authentification à facteur unique ou à facteurs multiples.FalseFalseTrue✓V6.3.77Vérifiez que les utilisateurs sont avertis après les mises à jour des détails d'authentification, telles que les réinitialisations d'informations d'identification ou la modification du nom d'utilisateur ou de l'adresse e-mail.FalseFalseTrue✓V6.3.88Vérifiez que les utilisateurs valides ne peuvent pas être déduits d'échecs d'authentification, par exemple en se basant sur des messages d'erreur, des codes de réponse HTTP ou des temps de réponse différents. Les fonctionnalités d'inscription et de mot de passe oublié doivent également bénéficier de cette protection.FalseFalseTrue✓V6.44Cycle de vie et récupération du facteur d'authentificationV6.4.11Vérifiez que les mots de passe initiaux ou les codes d'activation générés par le système sont générés de manière aléatoire et sécurisée, qu'ils respectent la politique de mots de passe en vigueur et qu'ils expirent après une courte période ou après leur première utilisation. Ces secrets initiaux ne doivent pas devenir des mots de passe permanents.True✓True✓True✓V6.4.22Vérifiez que les indices de mot de passe ou l'authentification basée sur les connaissances (appelées « questions secrètes ») ne sont pas présents.True✓True✓True✓V6.4.33Vérifiez qu'un processus sécurisé de réinitialisation d'un mot de passe oublié est mis en œuvre, qui ne contourne aucun mécanisme d'authentification multifacteur activé.FalseTrue✓True✓V6.4.44Vérifiez que si un facteur d'authentification multifacteur est perdu, la preuve de vérification d'identité est effectuée au même niveau que lors de l'inscription.FalseTrue✓True✓V6.4.55Vérifiez que les instructions de renouvellement des mécanismes d'authentification qui expirent sont envoyées avec suffisamment de temps pour être exécutées avant l'expiration de l'ancien mécanisme d'authentification, en configurant des rappels automatiques si nécessaire.FalseFalseTrue✓V6.4.66Vérifiez que les administrateurs peuvent initier la réinitialisation du mot de passe de l'utilisateur, mais que cela ne leur permet pas de modifier ou de choisir son mot de passe. Cela évite qu'ils ne connaissent le mot de passe de l'utilisateur.FalseFalseTrue✓V6.55Exigences générales en matière d'authentification multifacteurV6.5.11Vérifiez que les secrets de recherche, les demandes ou codes d'authentification out-of-band et les mots de passe à usage unique basés sur le temps (TOTP) ne peuvent être utilisés avec succès qu'une seule fois.FalseTrue✓True✓V6.5.22Vérifiez que, lors de leur stockage dans le backend de l'application, les secrets de recherche comportant moins de 112 bits d'entropie (19 caractères alphanumériques aléatoires ou 34 chiffres aléatoires) sont hachés avec un algorithme de hachage de stockage de mots de passe approuvé, intégrant un sel aléatoire de 32 bits. Une fonction de hachage standard peut être utilisée si le secret comporte 112 bits d'entropie ou plus.FalseTrue✓True✓V6.5.33Vérifiez que les secrets de recherche, le code d'authentification out-of-band et les mots de passe à usage unique basés sur le temps sont générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) pour éviter les valeurs prévisibles.FalseTrue✓True✓V6.5.44Vérifiez que les secrets de recherche et les codes d'authentification out-of-band ont un minimum de 20 bits d'entropie (généralement 4 caractères alphanumériques aléatoires ou 6 chiffres aléatoires suffisent).FalseTrue✓True✓V6.5.55Vérifiez que les requêtes, codes ou jetons d'authentification out-of-band, ainsi que les mots de passe à usage unique (TOTP), ont une durée de vie définie. Les requêtes out-of-band doivent avoir une durée de vie maximale de 10 minutes et les TOTP, de 30 secondes.FalseTrue✓True✓V6.5.66Vérifiez que tout facteur d’authentification (y compris les appareils physiques) peut être révoqué en cas de vol ou autre perte.FalseFalseTrue✓V6.5.77Vérifiez que les mécanismes d’authentification biométrique ne sont utilisés que comme facteurs secondaires, avec quelque chose que vous possédez ou quelque chose que vous savez.FalseFalseTrue✓V6.5.88Vérifiez que les mots de passe à usage unique basés sur le temps (TOTP) sont vérifiés en fonction d'une source temporelle provenant d'un service de confiance et non d'une heure non fiable ou fournie par le client.FalseFalseTrue✓V6.66Mécanismes d'authentification out-of-bandV6.6.11Vérifier que les mécanismes d'authentification utilisant le réseau téléphonique public commuté (RTPC) pour la transmission de mots de passe à usage unique (OTP) par téléphone ou SMS ne sont proposés que lorsque le numéro de téléphone a été préalablement validé. D'autres méthodes plus robustes (telles que les mots de passe à usage unique à durée déterminée) sont également proposées, et que le service informe les utilisateurs des risques de sécurité qu'elles présentent. Pour les applications de niveau 3, le téléphone et les SMS ne doivent pas être disponibles.FalseTrue✓True✓V6.6.22Vérifiez que les demandes d’authentification out-of-band, les codes ou les jetons sont liés à la demande d’authentification d’origine pour laquelle ils ont été générés et ne sont pas utilisables pour une demande précédente ou ultérieure.FalseTrue✓True✓V6.6.33Vérifiez qu'un mécanisme d'authentification out-of-band basé sur du code est protégé contre les attaques par force brute grâce au "rate limiting". Envisagez également d'utiliser un code avec au moins 64 bits d'entropie.FalseTrue✓True✓V6.6.44Vérifiez que, lorsque les notifications push sont utilisées pour l'authentification multifacteur, le "rate limiting" est appliqué afin d'empêcher les attaques de type « push bombing ». La concordance des numéros peut également atténuer ce risque.FalseFalseTrue✓V6.77Mécanisme d'authentification cryptographiqueV6.7.11Vérifiez que les certificats utilisés pour vérifier les assertions d’authentification cryptographique sont stockés de manière à les protéger contre toute modification.FalseFalseTrue✓V6.7.22Vérifiez que le nonce de défi a une longueur d'au moins 64 bits et qu'il est statistiquement unique ou unique sur toute la durée de vie du périphérique cryptographique.FalseFalseTrue✓V6.88Authentification avec un fournisseur d'identitéV6.8.11Vérifiez que, si l'application prend en charge plusieurs fournisseurs d'identité (IdP), l'identité de l'utilisateur ne peut pas être usurpée via un autre fournisseur d'identité pris en charge (par exemple, en utilisant le même identifiant utilisateur). La mesure standard consisterait à ce que l'application enregistre et identifie l'utilisateur à l'aide d'une combinaison de l'ID du fournisseur d'identité (servant d'espace de noms) et de l'ID de l'utilisateur dans le fournisseur d'identité.FalseTrue✓True✓V6.8.22Vérifiez que la présence et l'intégrité des signatures numériques sur les assertions d'authentification (par exemple sur les assertions JWT ou SAML) sont toujours validées, en rejetant toutes les assertions non signées ou ayant des signatures non valides.FalseTrue✓True✓V6.8.33Vérifiez que les assertions SAML sont traitées de manière unique et utilisées une seule fois au cours de la période de validité pour éviter les attaques par rejeu.FalseTrue✓True✓V6.8.44Si une application utilise un fournisseur d'identité (IdP) distinct et attend une force, des méthodes ou une date d'authentification spécifiques pour des fonctions spécifiques, vérifiez que l'application les vérifie à l'aide des informations renvoyées par l'IdP. Par exemple, si OIDC est utilisé, cela peut être réalisé en validant les affirmations de jeton d'identification telles que « acr », « amr » et « auth_time » (le cas échéant). Si l'IdP ne fournit pas ces informations, l'application doit disposer d'une approche de secours documentée qui suppose que le mécanisme d'authentification de force minimale a été utilisé (par exemple, une authentification à facteur unique avec nom d'utilisateur et mot de passe).FalseTrue✓True✓V77SessionGestion des sessionsV7.11Documentation sur la gestion des sessionsV7.1.11Vérifiez que le délai d'inactivité de la session de l'utilisateur et la durée de vie maximale absolue de la session sont documentés, sont appropriés en combinaison avec d'autres contrôles et que la documentation inclut une justification de tout écart par rapport aux exigences de réauthentification NIST SP 800-63B.FalseTrue✓True✓V7.1.22Vérifiez que la documentation définit le nombre de sessions simultanées (parallèles) autorisées pour un compte ainsi que les comportements et actions prévus à entreprendre lorsque le nombre maximal de sessions actives est atteint.FalseTrue✓True✓V7.1.33Vérifiez que tous les systèmes qui créent et gèrent des sessions utilisateur dans le cadre d'un écosystème de gestion des identités fédérées (tels que les systèmes SSO) sont documentés avec des contrôles pour coordonner la durée de vie des sessions, la résiliation et toute autre condition nécessitant une réauthentification.FalseTrue✓True✓V7.22Sécurité fondamentale de la gestion des sessionsV7.2.11Vérifiez que l’application effectue toutes les vérifications des jetons de session à l’aide d’un service backend de confiance.True✓True✓True✓V7.2.22Vérifiez que l'application utilise des jetons autonomes ou de référence générés dynamiquement pour la gestion des sessions, c'est-à-dire sans utiliser de secrets et de clés d'API statiques.True✓True✓True✓V7.2.33Vérifiez que si des jetons par référence sont utilisés pour représenter les sessions utilisateur, ils sont uniques et générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et possèdent au moins 128 bits d'entropie.True✓True✓True✓V7.2.44Vérifiez que l’application génère un nouveau jeton de session lors de l’authentification de l’utilisateur, y compris la réauthentification, et met fin au jeton de session actuel.True✓True✓True✓V7.33Délai d'expiration de la sessionV7.3.11Vérifiez qu’il existe un délai d’inactivité tel que la réauthentification soit appliquée conformément à l’analyse des risques et aux décisions de sécurité documentées.FalseTrue✓True✓V7.3.22Vérifiez qu'il existe une durée de vie maximale absolue de la session de sorte que la réauthentification soit appliquée conformément à l'analyse des risques et aux décisions de sécurité documentées.FalseTrue✓True✓V7.44Fin de sessionV7.4.11Vérifiez que lorsque la fin de session est déclenchée (par exemple, déconnexion ou expiration), l'application interdit toute utilisation ultérieure de la session. Pour les jetons par référence ou les sessions avec état, cela implique l'invalidation des données de session au niveau du backend de l'application. Les applications utilisant des jetons autonomes nécessiteront une solution, comme la gestion d'une liste des jetons terminés, l'interdiction des jetons produits avant une date et une heure spécifique à chaque utilisateur ou la rotation d'une clé de signature spécifique à chaque utilisateur.True✓True✓True✓V7.4.22Vérifiez que l'application met fin à toutes les sessions actives lorsqu'un compte utilisateur est désactivé ou supprimé (par exemple, lorsqu'un employé quitte l'entreprise).True✓True✓True✓V7.4.33Vérifiez que l'application offre la possibilité de mettre fin à toutes les autres sessions actives après une modification ou une suppression réussie de tout facteur d'authentification (y compris la modification du mot de passe via une réinitialisation ou une récupération et, le cas échéant, une mise à jour des paramètres MFA).FalseTrue✓True✓V7.4.44Vérifiez que toutes les pages nécessitant une authentification disposent d’un accès facile et visible à la fonctionnalité de déconnexion.FalseTrue✓True✓V7.4.55Vérifiez que les administrateurs d’applications sont en mesure de mettre fin aux sessions actives pour un utilisateur individuel ou pour tous les utilisateurs.FalseTrue✓True✓V7.55Défenses contre les abus de sessionV7.5.11Vérifiez que l'application nécessite une réauthentification complète avant d'autoriser les modifications des attributs de compte sensibles qui peuvent affecter l'authentification, tels que l'adresse e-mail, le numéro de téléphone, la configuration MFA ou d'autres informations utilisées dans la récupération de compte.FalseTrue✓True✓V7.5.22Vérifiez que les utilisateurs peuvent afficher et (après s'être authentifiés à nouveau avec au moins un facteur) terminer une ou toutes les sessions actuellement actives.FalseTrue✓True✓V7.5.33Vérifiez que l’application nécessite une authentification supplémentaire avec au moins un facteur ou une vérification secondaire avant d’effectuer des transactions ou des opérations hautement sensibles.FalseFalseTrue✓V7.66Réauthentification fédéréeV7.6.11Vérifiez que la durée de vie et la fin de la session entre les parties de confiance (RP) et les fournisseurs d'identité (IdP) se comportent comme documenté, en exigeant une réauthentification si nécessaire, par exemple lorsque le temps maximal entre les événements d'authentification IdP est atteint.FalseTrue✓True✓V7.6.22Vérifiez que la création d'une session nécessite soit le consentement de l'utilisateur, soit une action explicite, empêchant ainsi la création de nouvelles sessions d'application sans interaction de l'utilisateur.FalseTrue✓True✓V88AuthorizationAutorisationV8.11Documentation d'autorisationV8.1.11Vérifiez que la documentation d’autorisation définit des règles de restriction de l’accès au niveau de la fonction et aux données en fonction des autorisations du consommateur et des attributs des ressources.True✓True✓True✓V8.1.22Vérifiez que la documentation d'autorisation définit les règles de restriction d'accès au niveau des champs (lecture et écriture) en fonction des autorisations des consommateurs et des attributs des ressources. Notez que ces règles peuvent dépendre d'autres valeurs d'attributs de l'objet de données concerné, telles que l'état ou le statut.FalseTrue✓True✓V8.1.33Vérifiez que la documentation de l'application définit les attributs environnementaux et contextuels (y compris, mais sans s'y limiter, l'heure de la journée, l'emplacement de l'utilisateur, l'adresse IP ou l'appareil) qui sont utilisés dans l'application pour prendre des décisions de sécurité, y compris celles relatives à l'authentification et à l'autorisation.FalseFalseTrue✓V8.1.44Vérifier que la documentation d'authentification et d'autorisation définit l'utilisation des facteurs environnementaux et contextuels dans la prise de décision, en plus des autorisations au niveau des fonctions, des données et des champs. Cela doit inclure les attributs évalués, les seuils de risque et les actions entreprises (par exemple, autorisation, contestation, refus, renforcement de l'authentification).FalseFalseTrue✓V8.22Conception d'autorisation généraleV8.2.11Vérifiez que l’application garantit que l’accès basé sur la fonction est limité aux consommateurs disposant d’autorisations explicites.True✓True✓True✓V8.2.22Vérifiez que l'application garantit que l'accès spécifique aux données est limité aux consommateurs disposant d'autorisations explicites sur des éléments de données spécifiques afin d'atténuer les références d'objet directes non sécurisées (IDOR) et les autorisations de niveau d'objet rompues (BOLA).True✓True✓True✓V8.2.33Vérifiez que l'application garantit que l'accès au niveau du champ est limité aux consommateurs disposant d'autorisations explicites sur des champs spécifiques afin d'atténuer les problèmes d'autorisation au niveau de la propriété d'objet (BOPLA).FalseTrue✓True✓V8.2.44Vérifiez que les contrôles de sécurité adaptatifs basés sur les attributs environnementaux et contextuels du consommateur (tels que l'heure, la localisation, l'adresse IP ou l'appareil) sont mis en œuvre pour les décisions d'authentification et d'autorisation, comme défini dans la documentation de l'application. Ces contrôles doivent être appliqués lorsque le consommateur tente de démarrer une nouvelle session et également pendant une session existante.FalseFalseTrue✓V8.33Autorisation par opérationV8.3.11Vérifier que l'application applique les règles d'autorisations au niveau de la couche service de confiance et ne s’appuie pas sur des contrôles qu’un consommateur non approuvé pourrait manipuler, comme JavaScript côté client.True✓True✓True✓V8.3.22Vérifiez que les modifications apportées aux valeurs sur lesquelles reposent les décisions d'autorisation sont appliquées immédiatement. Lorsque les modifications ne peuvent pas être appliquées immédiatement (par exemple, en s'appuyant sur des données de jetons autonomes), des contrôles d'atténuation doivent être mis en place pour alerter un consommateur lorsqu'il effectue une action alors qu'il n'est plus autorisé à le faire et annuler la modification. Notez que cette solution alternative ne limiterait pas les fuites d'informations.FalseFalseTrue✓V8.3.33Vérifiez que l'accès à un objet repose sur les autorisations du sujet d'origine (par exemple, le consommateur), et non sur celles d'un intermédiaire ou d'un service agissant en son nom. Par exemple, si un consommateur appelle un service web à l'aide d'un jeton d'authentification autonome, et que ce service demande ensuite des données à un autre service, ce dernier utilisera le jeton du consommateur, plutôt qu'un jeton inter-machine du premier service, pour prendre les décisions d'autorisation.FalseFalseTrue✓V8.44Autres considérations relatives à l'autorisationV8.4.11Vérifiez que les applications multi-tenants utilisent des contrôles inter-tenants pour garantir que les opérations des consommateurs n'affecteront jamais les tenants avec lesquels ils ne sont pas autorisés à interagir.FalseTrue✓True✓V8.4.22Vérifiez que l'accès aux interfaces administratives intègre plusieurs couches de sécurité, notamment la vérification continue de l'identité du consommateur, l'évaluation de la posture de sécurité des appareils et l'analyse contextuelle des risques, garantissant que l'emplacement du réseau ou les endpoints approuvés ne sont pas les seuls facteurs d'autorisation, même s'ils peuvent réduire la probabilité d'accès non autorisé.FalseFalseTrue✓V99SelfJetons autonomesV9.11Source et intégrité du jetonV9.1.11Vérifiez que les jetons autonomes sont validés à l'aide de leur signature numérique ou MAC pour les protéger contre toute falsification avant d'accepter le contenu du jeton.True✓True✓True✓V9.1.22Vérifiez que seuls les algorithmes d'une liste d’autorisations peuvent être utilisés pour créer et vérifier des jetons autonomes, dans un contexte donné. La liste d'autorisation doit inclure les algorithmes autorisés, idéalement symétriques ou asymétriques, et ne doit pas inclure l'algorithme « Aucun ». Si les algorithmes symétriques et asymétriques doivent être pris en charge, des contrôles supplémentaires seront nécessaires pour éviter toute confusion de clés.True✓True✓True✓V9.1.33Vérifiez que les clés utilisées pour valider les jetons autonomes proviennent de sources préconfigurées et fiables pour l'émetteur du jeton, empêchant ainsi les attaquants de spécifier des sources et des clés non fiables. Pour les JWT et autres structures JWS, les en-têtes tels que « jku », « x5u » et « jwk » doivent être validés par rapport à une liste d'autorisation de sources fiables.True✓True✓True✓V9.22Contenu du jetonV9.2.11Vérifiez que, si une période de validité est indiquée dans les données du jeton, celui-ci et son contenu ne sont acceptés que si la date de vérification est comprise dans cette période. Par exemple, pour les JWT, les déclarations « nbf » et « exp » doivent être vérifiées.True✓True✓True✓V9.2.22Vérifiez que le service recevant un jeton valide le type de jeton et son utilisation avant d'en accepter le contenu. Par exemple, seuls les jetons d'accès peuvent être acceptés pour les décisions d'autorisation, et seuls les jetons d'identification peuvent être utilisés pour prouver l'authentification des utilisateurs.FalseTrue✓True✓V9.2.33Vérifiez que le service accepte uniquement les jetons destinés à être utilisés avec ce service (audience). Pour les JWT, cela peut être réalisé en validant la déclaration « aud » par rapport à une liste d'autorisation définie dans le service.FalseTrue✓True✓V9.2.44Si un émetteur de jetons utilise la même clé privée pour émettre des jetons destinés à différentes audiences, vérifiez que les jetons émis contiennent une restriction d'audience identifiant de manière unique les audiences visées. Cela empêchera la réutilisation d'un jeton avec une audience non prévue. Si l'identifiant d'audience est provisionné dynamiquement, l'émetteur de jetons doit valider ces audiences afin de garantir qu'elles n'entraînent pas d'usurpation d'identité.FalseTrue✓True✓V1010OAuthOauth et OIDCV10.11Sécurité générique OAuth et OIDCV10.1.11Vérifiez que les jetons sont envoyés uniquement aux composants qui en ont absolument besoin. Par exemple, lors de l'utilisation d'un modèle backend-for-frontend pour les applications JavaScript basées sur un navigateur, les jetons d'accès et d'actualisation ne doivent être accessibles qu'au backend.FalseTrue✓True✓V10.1.22Vérifiez que le client n'accepte les valeurs du serveur d'autorisation (telles que le code d'autorisation ou le jeton d'identification) que si elles résultent d'un flux d'autorisation initié par la même session d'agent utilisateur et la même transaction. Cela nécessite que les secrets générés par le client, tels que la clé de preuve pour l'échange de codes (PKCE) « code_verifier », « state » ou le nonce OIDC, ne puissent être devinés, soient spécifiques à la transaction et soient liés de manière sécurisée au client et à la session d'agent utilisateur au cours de laquelle la transaction a été initiée.FalseTrue✓True✓V10.22Client OAuthV10.2.11Vérifiez que, si le flux de code est utilisé, le client OAuth dispose d'une protection contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF), qui déclenchent des demandes de jetons, soit en utilisant la fonctionnalité de clé de preuve pour l'échange de code (PKCE), soit en vérifiant le paramètre « state » envoyé dans la demande d'autorisation.FalseTrue✓True✓V10.2.22Vérifiez que, si le client OAuth peut interagir avec plusieurs serveurs d'autorisation, il dispose d'une protection contre les attaques par confusion. Par exemple, il peut exiger que le serveur d'autorisation renvoie la valeur du paramètre « iss » et la valide dans la réponse d'autorisation et la réponse du jeton.FalseTrue✓True✓V10.2.33Vérifiez que le client OAuth demande uniquement les portées requises (ou d’autres paramètres d’autorisation) dans les requêtes adressées au serveur d’autorisation.FalseFalseTrue✓V10.33Serveur de ressources OAuthV10.3.11Vérifiez que le serveur de ressources accepte uniquement les jetons d'accès destinés à être utilisés avec ce service (audience). L'audience peut être incluse dans un jeton d'accès structuré (comme la déclaration « aud » dans JWT) ou vérifiée à l'aide du endpoint d'introspection de jeton.FalseTrue✓True✓V10.3.22Vérifiez que le serveur de ressources applique les décisions d'autorisation en fonction des déclarations du jeton d'accès définissant l'autorisation déléguée. Si des déclarations telles que « sub », « scope » et « authorization_details » sont présentes, elles doivent être prises en compte dans la décision.FalseTrue✓True✓V10.3.33Vérifiez que si une décision de contrôle d'accès nécessite l'identification d'un utilisateur unique à partir d'un jeton d'accès (JWT ou réponse d'introspection de jeton associé), le serveur de ressources identifie l'utilisateur à partir de déclarations non ré attribuables à d'autres utilisateurs. En général, cela implique l'utilisation d'une combinaison de déclarations « iss » et « sub ».FalseTrue✓True✓V10.3.44Si le serveur de ressources requiert une force d'authentification, des méthodes ou une date d'expiration spécifiques, vérifiez que le jeton d'accès présenté respecte ces contraintes. Par exemple, s'il est présent, utilisez les déclarations OIDC « acr », « amr » et « auth_time » respectivement.FalseTrue✓True✓V10.3.55Vérifiez que le serveur de ressources empêche l'utilisation de jetons d'accès volés ou la relecture de jetons d'accès (de parties non autorisées) en exigeant des jetons d'accès limités par l'expéditeur, soit Mutual TLS pour OAuth 2, soit OAuth 2 Demonstration of Proof of Possession (DPoP).FalseFalseTrue✓V10.44Serveur d'autorisation OAuthV10.4.11Vérifiez que le serveur d'autorisation valide les URI de redirection en fonction d'une liste d'autorisation spécifique au client d'URI préenregistrés à l'aide d'une comparaison de chaînes exacte.True✓True✓True✓V10.4.22Vérifiez que, si le serveur d'autorisation renvoie le code d'autorisation dans la réponse, celui-ci ne peut être utilisé qu'une seule fois pour une demande de jeton. Pour la deuxième demande valide avec un code d'autorisation déjà utilisé pour émettre un jeton d'accès, le serveur d'autorisation doit rejeter la demande de jeton et révoquer tous les jetons émis liés au code d'autorisation.True✓True✓True✓V10.4.33Vérifiez que le code d'autorisation est de courte durée. La durée de vie maximale peut atteindre 10 minutes pour les applications L1 et L2 et 1 minute pour les applications L3.True✓True✓True✓V10.4.44Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement l'utilisation des autorisations nécessaires à ce client. Notez que les autorisations « token » (flux implicite) et « password » (flux d'informations d'identification du propriétaire de la ressource) ne doivent plus être utilisées.True✓True✓True✓V10.4.55Vérifiez que le serveur d'autorisation atténue les attaques par rejeu de jetons d'actualisation pour les clients publics, de préférence en utilisant des jetons d'actualisation limités par l'expéditeur, par exemple des jetons DPoP (Demonstrating Proof of Possession) ou des jetons d'accès liés à un certificat utilisant le protocole TLS mutuel (mTLS). Pour les applications L1 et L2, la rotation des jetons d'actualisation peut être utilisée. Si cette rotation est utilisée, le serveur d'autorisation doit invalider le jeton d'actualisation après utilisation et révoquer tous les jetons d'actualisation de cette autorisation si un jeton d'actualisation déjà utilisé et invalidé est fourni.True✓True✓True✓V10.4.66Vérifiez que, si l'octroi de code est utilisé, le serveur d'autorisation atténue les attaques par interception de code en exigeant une clé de preuve pour l'échange de code (PKCE). Pour les demandes d'autorisation, le serveur d'autorisation doit exiger une valeur « code_challenge » valide et ne doit pas accepter une valeur « plain » pour « code_challenge_method ». Pour une demande de jeton, il doit exiger la validation du paramètre « code_verifier ».FalseTrue✓True✓V10.4.77Vérifiez que si le serveur d'autorisation prend en charge l'enregistrement dynamique des clients non authentifiés, il réduit le risque d'applications clientes malveillantes. Il doit valider les métadonnées clientes, telles que les URI enregistrés, garantir le consentement de l'utilisateur et l'avertir avant de traiter une demande d'autorisation avec une application cliente non approuvée.FalseTrue✓True✓V10.4.88Vérifiez que les jetons d’actualisation ont une expiration absolue, y compris si l’expiration du jeton d’actualisation glissant est appliquée.FalseTrue✓True✓V10.4.99Vérifiez que les jetons d'actualisation et les jetons d'accès de référence peuvent être révoqués par un utilisateur autorisé à l'aide de l'interface utilisateur du serveur d'autorisation, afin d'atténuer le risque de clients malveillants ou de jetons volés.FalseTrue✓True✓V10.4.1010Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.FalseTrue✓True✓V10.4.1111Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.FalseTrue✓True✓V10.4.1212Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement la valeur « response_mode » dont ce client a besoin. Par exemple, en vérifiant cette valeur par rapport aux valeurs attendues ou en utilisant une requête d'autorisation poussée (PAR) ou une requête d'autorisation sécurisée par JWT (JAR).FalseFalseTrue✓V10.4.1313Vérifiez que le type d'Autorisation « code » est toujours utilisé avec les demandes d'autorisation poussées (PAR).FalseFalseTrue✓V10.4.1414Vérifiez que le serveur d'autorisation émet uniquement des jetons d'accès limités à l'expéditeur (preuve de possession), soit avec des jetons d'accès liés au certificat utilisant TLS mutuel (mTLS), soit avec des jetons d'accès liés au DPoP (démonstration de preuve de possession).FalseFalseTrue✓V10.4.1515Vérifiez que, pour un client côté serveur (non exécuté sur l'appareil de l'utilisateur final), le serveur d'autorisation garantit que la valeur du paramètre « authorization_details » provient du backend client et que l'utilisateur ne l'a pas altérée. Par exemple, en exigeant l'utilisation d'une demande d'autorisation poussée (PAR) ou d'une demande d'autorisation sécurisée par JWT (JAR).FalseFalseTrue✓V10.4.1616Vérifiez que le client est confidentiel et que le serveur d'autorisation requiert l'utilisation de méthodes d'authentification client fortes (basées sur la cryptographie à clé publique et résistantes aux attaques par relecture), telles que TLS mutuel ('tls_client_auth', 'self_signed_tls_client_auth') ou JWT à clé privée ('private_key_jwt').FalseFalseTrue✓V10.55Client OIDCV10.5.11Vérifiez que le client (en tant que partie utilisatrice) atténue les attaques par rejeu de jeton d'identification. Par exemple, en vous assurant que la valeur « nonce » du jeton d'identification correspond à la valeur « nonce » envoyée dans la demande d'authentification au fournisseur OpenID (appelée demande d'autorisation envoyée au serveur d'autorisation dans OAuth2).FalseTrue✓True✓V10.5.22Vérifiez que le client identifie de manière unique l'utilisateur à partir des déclarations de jeton d'identification, généralement la déclaration « sub », qui ne peut pas être réaffectée à d'autres utilisateurs (pour la portée d'un fournisseur d'identité).FalseTrue✓True✓V10.5.33Vérifiez que le client rejette les tentatives d'un serveur d'autorisation malveillant d'usurper l'identité d'un autre serveur d'autorisation via ses métadonnées. Le client doit rejeter les métadonnées du serveur d'autorisation si l'URL de l'émetteur figurant dans ces métadonnées ne correspond pas exactement à l'URL d'émetteur préconfigurée attendue par le client.FalseTrue✓True✓V10.5.44Vérifiez que le client valide que le jeton d'identification est destiné à être utilisé pour ce client (audience) en vérifiant que la déclaration « aud » du jeton est égale à la valeur « client_id » pour le client.FalseTrue✓True✓V10.5.55Vérifiez que, lors de l'utilisation de la déconnexion du back-channel OIDC, la partie utilisatrice atténue les risques de déni de service liés à la déconnexion forcée et à la confusion entre JWT dans le flux de déconnexion. Le client doit vérifier que le jeton de déconnexion est correctement typé avec la valeur « logout+jwt », qu'il contient la déclaration « event » avec le nom de membre correct et qu'il ne contient pas de déclaration « nonce ». Il est également recommandé d'utiliser une expiration courte (par exemple, 2 minutes).FalseTrue✓True✓V10.66Fournisseur OpenIDV10.6.11Vérifiez que le fournisseur OpenID n'autorise que les valeurs « code », « ciba », « id_token » ou « id_token code » pour le mode de réponse. Notez que « code » est préférable à « id_token code » (flux hybride OIDC) et que « token » (tout flux implicite) ne doit pas être utilisé.FalseTrue✓True✓V10.6.22Vérifiez que le fournisseur OpenID atténue les risques de déni de service liés à la déconnexion forcée. Pour ce faire, obtenez une confirmation explicite de l'utilisateur final ou, le cas échéant, validez les paramètres de la requête de déconnexion (initiée par la partie utilisatrice), comme « id_token_hint ».FalseTrue✓True✓V10.77Gestion du consentementV10.7.11Vérifiez que le serveur d'autorisation garantit le consentement de l'utilisateur à chaque demande d'autorisation. Si l'identité du client ne peut être garantie, le serveur d'autorisation doit toujours demander explicitement le consentement de l'utilisateur.FalseTrue✓True✓V10.7.22Vérifiez que lorsque le serveur d'autorisation demande le consentement de l'utilisateur, il fournit des informations claires et suffisantes sur ce qui est consenti. Le cas échéant, ces informations doivent inclure la nature des autorisations demandées (généralement en fonction de la portée, du serveur de ressources et des détails d'autorisation RAR), l'identité de l'application autorisée et la durée de vie de ces autorisations.FalseTrue✓True✓V10.7.33Vérifiez que l’utilisateur peut consulter, modifier et révoquer les consentements qu’il a accordés via le serveur d’autorisation.FalseTrue✓True✓V1111CryptographyCryptographieV11.11Inventaire et documentation cryptographiquesV11.1.11Vérifiez qu’il existe une politique documentée pour la gestion des clés cryptographiques et un cycle de vie des clés cryptographiques qui suit une norme de gestion des clés telle que NIST SP 800-57. Cela devrait inclure la garantie que les clés ne sont pas sur-partagées (par exemple, avec plus de deux entités pour les secrets partagés et plus d’une entité pour les clés privées).FalseTrue✓True✓V11.1.22Vérifiez qu'un inventaire cryptographique est réalisé, maintenu et régulièrement mis à jour, et qu'il inclut toutes les clés, algorithmes et certificats cryptographiques utilisés par l'application. Il doit également documenter les emplacements du système où les clés peuvent ou non être utilisées, ainsi que les types de données qui peuvent ou non être protégées par ces clés.FalseTrue✓True✓V11.1.33Vérifiez que les mécanismes de découverte cryptographique sont utilisés pour identifier toutes les instances de cryptographie dans le système, y compris les opérations de chiffrement, de hachage et de signature.FalseFalseTrue✓V11.1.44Vérifier la tenue d'un inventaire cryptographique. Celui-ci doit inclure un plan documenté décrivant la migration vers de nouvelles normes cryptographiques, telles que la cryptographie post-quantique, afin de réagir aux menaces futures.FalseFalseTrue✓V11.22Mise en œuvre sécurisée de la cryptographieV11.2.11Vérifiez que les implémentations validées par l’industrie (y compris les bibliothèques et les implémentations accélérées par le matériel) sont utilisées pour les opérations cryptographiques.FalseTrue✓True✓V11.2.22Vérifiez que l'application est conçue avec une agilité cryptographique, de sorte que les nombres aléatoires, le chiffrement authentifié, le MAC ou les algorithmes de hachage, les longueurs de clés, les tours, les chiffrements et les modes puissent être reconfigurés, mis à niveau ou échangés à tout moment, afin de se protéger contre les failles cryptographiques. De même, il doit être possible de remplacer les clés et les mots de passe, ainsi que de rechiffrer les données. Cela permettra des mises à niveau transparentes vers la cryptographie post-quantique (PQC), une fois que des implémentations hautement sécurisées de schémas ou de normes PQC approuvés seront largement disponibles.FalseTrue✓True✓V11.2.33Vérifiez que toutes les primitives cryptographiques utilisent un minimum de 128 bits de sécurité en fonction de l'algorithme, de la taille de la clé et de la configuration. Par exemple, une clé ECC de 256 bits offre environ 128 bits de sécurité, tandis que RSA nécessite une clé de 3072 bits pour atteindre 128 bits de sécurité.FalseTrue✓True✓V11.2.44Vérifiez que toutes les opérations cryptographiques sont à temps constant, sans opérations de « court-circuit » dans les comparaisons, les calculs ou les retours, pour éviter toute fuite d'informations.FalseFalseTrue✓V11.2.55Vérifiez que tous les modules cryptographiques échouent en toute sécurité et que les erreurs sont gérées de manière à ne pas permettre de vulnérabilités, telles que les attaques Padding Oracle.FalseFalseTrue✓V11.33Algorithmes de chiffrementV11.3.11Vérifiez que les modes de bloc non sécurisés (par exemple, ECB) et les schémas de remplissage faibles (par exemple, PKCS#1 v1.5) ne sont pas utilisés.True✓True✓True✓V11.3.22Vérifiez que seuls les chiffrements et modes approuvés tels que AES avec GCM sont utilisés.True✓True✓True✓V11.3.33Vérifiez que les données chiffrées sont protégées contre toute modification non autorisée, de préférence en utilisant une méthode de chiffrement authentifiée approuvée ou en combinant une méthode de chiffrement approuvée avec un algorithme MAC approuvé.FalseTrue✓True✓V11.3.44Vérifiez que les nonces, les vecteurs d'initialisation et autres nombres à usage unique ne sont pas utilisés pour plus d'une paire clé de chiffrement/élément de données. La méthode de génération doit être adaptée à l'algorithme utilisé.FalseFalseTrue✓V11.3.55Vérifiez que toute combinaison d'un algorithme de chiffrement et d'un algorithme MAC fonctionne en mode chiffrement puis MAC.FalseFalseTrue✓V11.44Hachage et fonctions basées sur le hachageV11.4.11Vérifiez que seules les fonctions de hachage approuvées sont utilisées pour les cas d'utilisation cryptographiques généraux, notamment les signatures numériques, HMAC, KDF et la génération de bits aléatoires. Les fonctions de hachage non autorisées, telles que MD5, ne doivent pas être utilisées à des fins cryptographiques.True✓True✓True✓V11.4.22Vérifiez que les mots de passe sont stockés à l'aide d'une fonction de dérivation de clés approuvée et gourmande en ressources de calcul (également appelée « fonction de hachage de mots de passe »), dont les paramètres sont configurés conformément aux directives en vigueur. Ces paramètres doivent équilibrer sécurité et performances afin de rendre les attaques par force brute suffisamment difficiles pour le niveau de sécurité requis.FalseTrue✓True✓V11.4.33Vérifiez que les fonctions de hachage utilisées dans les signatures numériques, dans le cadre de l'authentification ou de l'intégrité des données, sont résistantes aux collisions et possèdent des longueurs de bits appropriées. Si la résistance aux collisions est requise, la longueur de sortie doit être d'au moins 256 bits. Si seule la résistance aux attaques de seconde pré-image est requise, la longueur de sortie doit être d'au moins 128 bits.FalseTrue✓True✓V11.4.44Vérifiez que l'application utilise des fonctions de dérivation de clés approuvées avec des paramètres d'extension de clés lors de la dérivation de clés secrètes à partir de mots de passe. Les paramètres utilisés doivent concilier sécurité et performances afin d'empêcher les attaques par force brute de compromettre la clé cryptographique obtenue.FalseTrue✓True✓V11.55Valeurs aléatoiresV11.5.11Vérifiez que tous les nombres et chaînes aléatoires destinés à être non devinables doivent être générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et posséder au moins 128 bits d'entropie. Notez que les UUID ne respectent pas cette condition.FalseTrue✓True✓V11.5.22Vérifiez que le mécanisme de génération de nombres aléatoires utilisé est conçu pour fonctionner en toute sécurité, même en cas de forte demande.FalseFalseTrue✓V11.66Cryptographie à clé publiqueV11.6.11Vérifier que seuls des algorithmes cryptographiques et des modes opératoires approuvés sont utilisés pour la génération et l'amorçage des clés, ainsi que pour la génération et la vérification des signatures numériques. Les algorithmes de génération de clés ne doivent pas générer de clés non sécurisées et vulnérables aux attaques connues, par exemple les clés RSA vulnérables à la factorisation de Fermat.FalseTrue✓True✓V11.6.22Vérifiez que des algorithmes cryptographiques approuvés sont utilisés pour l'échange de clés (tels que Diffie-Hellman), en veillant à ce que les mécanismes d'échange de clés utilisent des paramètres sécurisés. Cela permettra d'éviter les attaques contre le processus d'établissement des clés, susceptibles de conduire à des attaques de type « adversaire du milieu » ou à des failles cryptographiques.FalseFalseTrue✓V11.77Cryptographie des données en cours d'utilisationV11.7.11Vérifiez que le chiffrement complet de la mémoire est utilisé pour protéger les données sensibles pendant leur utilisation, empêchant ainsi l'accès par des utilisateurs ou des processus non autorisés.FalseFalseTrue✓V11.7.22Vérifiez que la minimisation des données garantit que la quantité minimale de données est exposée pendant le traitement et assurez-vous que les données sont chiffrées immédiatement après utilisation ou dès que possible.FalseFalseTrue✓V1212SecureCommunication sécuriséeV12.11Conseils généraux de sécurité TLSV12.1.11Vérifiez que seules les dernières versions recommandées du protocole TLS sont activées, telles que TLS 1.2 et TLS 1.3. La dernière version du protocole TLS doit être privilégiée.True✓True✓True✓V12.1.22Vérifiez que seules les suites de chiffrement recommandées sont activées, les suites de chiffrement les plus puissantes étant définies comme préférées. Les applications L3 doivent uniquement prendre en charge les suites de chiffrement assurant la confidentialité persistante (forward secrecy).FalseTrue✓True✓V12.1.33Vérifiez que l’application valide que les certificats clients mTLS sont approuvés avant d’utiliser l’identité du certificat pour l’authentification ou l’autorisation.FalseTrue✓True✓V12.1.44Vérifiez que la révocation de certification appropriée, telle que l'agrafage du protocole OCSP (Online Certificate Status Protocol), est activée et configurée.FalseFalseTrue✓V12.1.55Vérifiez que Encrypted Client Hello (ECH) est activé dans les paramètres TLS de l'application pour empêcher l'exposition de métadonnées sensibles, telles que l'indication du nom du serveur (SNI), pendant les processus de négociation TLS.FalseFalseTrue✓V12.22Communication HTTPS avec des services externesV12.2.11Vérifiez que TLS est utilisé pour toute connectivité entre un client et des services externes basés sur HTTP, et ne recourt pas à des communications non sécurisées ou non chiffrées.True✓True✓True✓V12.2.22Vérifiez que les services externes utilisent des certificats TLS publiquement approuvés.True✓True✓True✓V12.33Sécurité des communications entre services générauxV12.3.11Vérifiez qu'un protocole chiffré tel que TLS est utilisé pour toutes les connexions entrantes et sortantes vers et depuis l'application, y compris les systèmes de surveillance, les outils de gestion, l'accès à distance et SSH, les intergiciels, les bases de données, les mainframes, les systèmes partenaires ou les API externes. Le serveur ne doit pas recourir à des protocoles non sécurisés ou non chiffrés.FalseTrue✓True✓V12.3.22Vérifiez que les clients TLS valident les certificats reçus avant de communiquer avec un serveur TLS.FalseTrue✓True✓V12.3.33Vérifiez que TLS ou un autre mécanisme de chiffrement de transport approprié est utilisé pour toute connectivité entre les services internes basés sur HTTP au sein de l'application et ne se replie pas vers des communications non sécurisées ou non chiffrées.FalseTrue✓True✓V12.3.44Vérifiez que les connexions TLS entre les services internes utilisent des certificats de confiance. Lorsque des certificats générés en interne ou auto-signés sont utilisés, le service consommateur doit être configuré pour n'approuver que des autorités de certification internes spécifiques et des certificats auto-signés spécifiques.FalseTrue✓True✓V12.3.55Vérifiez que les services communiquant en interne au sein d'un système (communications intra-services) utilisent une authentification forte pour garantir la vérification de chaque endpoint. Des méthodes d'authentification forte, telles que l'authentification client TLS, doivent être utilisées pour garantir l'identité, en utilisant une infrastructure à clé publique et des mécanismes résistants aux attaques par rejeu. Pour les architectures de microservices, envisagez d'utiliser un maillage de services pour simplifier la gestion des certificats et renforcer la sécurité.FalseFalseTrue✓V1313ConfigurationConfigurationV13.11Documentation de configurationV13.1.11Vérifiez que tous les besoins de communication de l'application sont documentés. Cela doit inclure les services externes dont l'application dépend et les cas où un utilisateur final pourrait fournir un emplacement externe auquel l'application se connectera.FalseTrue✓True✓V13.1.22Vérifiez que pour chaque service utilisé par l'application, la documentation définit le nombre maximal de connexions simultanées (par exemple, les limites du pool de connexions) et le comportement de l'application lorsque cette limite est atteinte, y compris les mécanismes de secours ou de récupération, pour éviter les conditions de déni de service.FalseFalseTrue✓V13.1.33Vérifiez que la documentation de l'application définit des stratégies de gestion des ressources pour chaque système ou service externe utilisé (par exemple, bases de données, descripteurs de fichiers, threads, connexions HTTP). Cela doit inclure les procédures de libération des ressources, les paramètres de délai d'expiration, la gestion des échecs et l'implémentation de la logique de nouvelle tentative, en spécifiant les limites de nouvelle tentative, les délais et les algorithmes de retour arrière. Pour les opérations de requête-réponse HTTP synchrones, la documentation doit imposer des délais d'expiration courts et soit désactiver les nouvelles tentatives, soit les limiter strictement afin d'éviter les retards en cascade et l'épuisement des ressources.FalseFalseTrue✓V13.1.44Vérifiez que la documentation de l'application définit les secrets essentiels à la sécurité de l'application et un calendrier de rotation de ceux-ci, en fonction du modèle de menace et des exigences commerciales de l'organisation.FalseFalseTrue✓V13.22Configuration de la communication backendV13.2.11Vérifiez que les communications entre les composants de l'application backend qui ne prennent pas en charge le mécanisme de session utilisateur standard de l'application, notamment les API, les intergiciels et les couches de données, sont authentifiées. L'authentification doit utiliser des comptes de service individuels, des jetons à court terme ou une authentification par certificat, et non des identifiants immuables tels que des mots de passe, des clés API ou des comptes partagés avec accès privilégié.FalseTrue✓True✓V13.2.22Vérifiez que les communications entre les composants de l'application backend, y compris les services locaux ou du système d'exploitation, les API, les intergiciels et les couches de données, sont effectuées avec des comptes dotés des privilèges les moins nécessaires.FalseTrue✓True✓V13.2.33Vérifiez que si des informations d’identification doivent être utilisées pour l’authentification du service, les informations d’identification utilisées par le consommateur ne sont pas des informations d’identification par défaut (par exemple, root/root ou admin/admin).FalseTrue✓True✓V13.2.44Vérifiez qu'une liste d’autorisations est utilisée pour définir les ressources ou systèmes externes avec lesquels l'application est autorisée à communiquer (par exemple, pour les requêtes sortantes, les chargements de données ou l'accès aux fichiers). Cette liste d'autorisation peut être implémentée au niveau de la couche applicative, du serveur web, du pare-feu ou d'une combinaison de différentes couches.FalseTrue✓True✓V13.2.55Vérifiez que le serveur Web ou d’application est configuré avec une liste autorisée de ressources ou de systèmes vers lesquels le serveur peut envoyer des requêtes ou charger des données ou des fichiers.FalseTrue✓True✓V13.2.66Vérifiez que lorsque l'application se connecte à des services distincts, elle suit la configuration documentée pour chaque connexion, comme le nombre maximal de connexions parallèles, le comportement lorsque le nombre maximal de connexions autorisées est atteint, les délais d'expiration de connexion et les stratégies de nouvelle tentative.FalseFalseTrue✓V13.33Gestion des secretsV13.3.11Vérifiez qu'une solution de gestion des secrets, telle qu'un coffre-fort de clés, est utilisée pour créer, stocker, contrôler l'accès et détruire en toute sécurité les secrets backend. Ceux-ci peuvent inclure des mots de passe, du matériel de clé, des intégrations avec des bases de données et des systèmes tiers, des clés et des graines pour des jetons temporels, d'autres secrets internes et des clés API. Les secrets ne doivent pas être inclus dans le code source de l'application ni dans les artefacts de build. Pour une application L3, cela doit impliquer une solution matérielle telle qu'un HSM.FalseTrue✓True✓V13.3.22Vérifiez que l’accès aux ressources secrètes respecte le principe du moindre privilège.FalseTrue✓True✓V13.3.33Vérifiez que toutes les opérations cryptographiques sont effectuées à l'aide d'un module de sécurité isolé (tel qu'un coffre-fort ou un module de sécurité matériel) pour gérer et protéger en toute sécurité le matériel clé contre toute exposition en dehors du module de sécurité.FalseFalseTrue✓V13.3.44Vérifiez que les secrets sont configurés pour expirer et être renouvelés en fonction de la documentation de l'application.FalseFalseTrue✓V13.44Fuite d'informations involontaireV13.4.11Vérifiez que l'application est déployée soit sans aucune métadonnée de contrôle de source, y compris les dossiers .git ou .svn, soit de manière à ce que ces dossiers soient inaccessibles à la fois en externe et à l'application elle-même.True✓True✓True✓V13.4.22Vérifiez que les modes de débogage sont désactivés pour tous les composants dans les environnements de production afin d’éviter l’exposition des fonctionnalités de débogage et la fuite d’informations.FalseTrue✓True✓V13.4.33Vérifiez que les serveurs Web n’exposent pas les listes de répertoires aux clients, sauf si cela est explicitement prévu.FalseTrue✓True✓V13.4.44Vérifiez que l’utilisation de la méthode HTTP TRACE n’est pas prise en charge dans les environnements de production, afin d’éviter toute fuite d’informations potentielle.FalseTrue✓True✓V13.4.55Vérifiez que la documentation (comme pour les API internes) et les endpoints de surveillance ne sont pas exposés, sauf si cela est explicitement prévu.FalseTrue✓True✓V13.4.66Vérifiez que l’application n’expose pas d’informations de version détaillées des composants backend.FalseFalseTrue✓V13.4.77Vérifiez que la couche web est configuré pour servir uniquement les fichiers avec des extensions de fichier spécifiques afin d’éviter toute fuite involontaire d’informations, de configuration et de code source.FalseFalseTrue✓V1414DataProtection des donnéesV14.11Documentation sur la protection des donnéesV14.1.11Vérifiez que toutes les données sensibles créées et traitées par l'application ont été identifiées et classées selon leur niveau de protection. Cela inclut les données uniquement codées et donc facilement déchiffrables, telles que les chaînes Base64 ou la charge utile en texte clair d'un JWT. Les niveaux de protection doivent tenir compte des réglementations et normes de protection des données et de confidentialité auxquelles l'application est tenue de se conformer.FalseTrue✓True✓V14.1.22Vérifier que tous les niveaux de protection des données sensibles sont assortis d'un ensemble documenté d'exigences de protection. Cela doit inclure (sans s'y limiter) les exigences relatives au chiffrement général, à la vérification de l'intégrité, à la conservation, à la journalisation des données, aux contrôles d'accès aux données sensibles dans les journaux, au chiffrement au niveau de la base de données, aux technologies de confidentialité et de renforcement de la confidentialité à utiliser, ainsi qu'aux autres exigences de confidentialité.FalseTrue✓True✓V14.22Protection générale des donnéesV14.2.11Vérifiez que les données sensibles sont uniquement envoyées au serveur dans les champs de corps ou d’en-tête du message HTTP, et que l’URL et la chaîne de requête ne contiennent pas d’informations sensibles, telles qu’une clé API ou un jeton de session.True✓True✓True✓V14.2.22Vérifiez que l’application empêche la mise en cache des données sensibles dans les composants du serveur, tels que les équilibreurs de charge et les caches d’application, ou garantit que les données sont purgées en toute sécurité après utilisation.FalseTrue✓True✓V14.2.33Vérifiez que les données sensibles définies ne sont pas envoyées à des parties non fiables (par exemple, des trackers d'utilisateurs) pour empêcher la collecte indésirable de données en dehors du contrôle de l'application.FalseTrue✓True✓V14.2.44Vérifiez que les contrôles autour des données sensibles liés au chiffrement, à la vérification de l'intégrité, à la conservation, à la manière dont les données doivent être enregistrées, aux contrôles d'accès autour des données sensibles dans les journaux, à la confidentialité et aux technologies d'amélioration de la confidentialité, sont mis en œuvre comme défini dans la documentation pour le niveau de protection des données spécifiques.FalseTrue✓True✓V14.2.55Vérifiez que les mécanismes de mise en cache sont configurés pour ne mettre en cache que les réponses dont le type de contenu est conforme à la ressource et qui ne contiennent pas de contenu sensible et dynamique. Le serveur web doit renvoyer une réponse 404 ou 302 lors de l'accès à un fichier inexistant plutôt qu'un fichier valide différent. Cela devrait empêcher les attaques par empoisonnement de cache web.FalseFalseTrue✓V14.2.66Vérifiez que l'application ne renvoie que les données sensibles minimales requises pour son fonctionnement. Par exemple, ne renvoyez que certains chiffres d'un numéro de carte de crédit, et non le numéro complet. Si les données complètes sont requises, elles doivent être masquées dans l'interface utilisateur, sauf si l'utilisateur les consulte spécifiquement.FalseFalseTrue✓V14.2.77Vérifiez que les informations sensibles sont soumises à une classification de conservation des données, en veillant à ce que les données obsolètes ou inutiles soient supprimées automatiquement, selon un calendrier défini ou selon les besoins de la situation.FalseFalseTrue✓V14.2.88Vérifiez que les informations sensibles sont supprimées des métadonnées des fichiers soumis par l'utilisateur, sauf si le stockage est autorisé par l'utilisateur.FalseFalseTrue✓V14.33Protection des données côté clientV14.3.11Vérifiez que les données authentifiées sont effacées du stockage client, comme le DOM du navigateur, après la fin du client ou de la session. Le champ d'en-tête de réponse HTTP « Clear-Site-Data » peut être utile, mais le côté client devrait également pouvoir effectuer la correction si la connexion au serveur n'est pas disponible à la fin de la session.True✓True✓True✓V14.3.22Vérifiez que l'application définit suffisamment de champs d'en-tête de réponse HTTP anti-caching (c'est-à-dire Cache-Control : no-store) afin que les données sensibles ne soient pas mises en cache dans les navigateurs.FalseTrue✓True✓V14.3.33Vérifiez que les données stockées dans le stockage du navigateur (telles que localStorage, sessionStorage, IndexedDB ou les cookies) ne contiennent pas de données sensibles, à l'exception des jetons de session.FalseTrue✓True✓V1515SecureDéveloppement et architecture sécurisésV15.11Documentation sur le développement et l'architecture sécurisésV15.1.11Vérifiez que la documentation de l'application définit les délais de correction basés sur les risques pour les versions de composants tiers présentant des vulnérabilités et pour la mise à jour des bibliothèques en général, afin de minimiser les risques liés à ces composants.True✓True✓True✓V15.1.22Vérifiez qu'un catalogue d'inventaire, tel qu'une nomenclature logicielle (SBOM), est conservé pour toutes les bibliothèques tierces utilisées, y compris en vérifiant que les composants proviennent de référentiels prédéfinis, fiables et continuellement maintenus.FalseTrue✓True✓V15.1.33Vérifiez que la documentation de l'application identifie les fonctionnalités consommatrices en temps ou gourmandes en ressources. Elle doit notamment indiquer comment prévenir une perte de disponibilité due à une utilisation excessive de ces fonctionnalités et éviter que la génération d'une réponse ne prenne plus de temps que le délai d'expiration du consommateur. Les mesures de protection potentielles peuvent inclure le traitement asynchrone, l'utilisation de files d'attente et la limitation des processus parallèles par utilisateur et par application.FalseTrue✓True✓V15.1.44Vérifiez que la documentation de l’application met en évidence les bibliothèques tierces qui sont considérées comme des « composants à risque ».FalseFalseTrue✓V15.1.55Vérifiez que la documentation de l’application met en évidence les parties de l’application où des « fonctionnalités dangereuses » sont utilisées.FalseFalseTrue✓V15.22Architecture de sécurité et dépendancesV15.2.11Vérifiez que l’application contient uniquement des composants qui n’ont pas dépassé les délais de mise à jour et de correction documentés.True✓True✓True✓V15.2.22Vérifiez que l'application a mis en œuvre des défenses contre la perte de disponibilité due à des fonctionnalités qui prennent du temps ou qui nécessitent des ressources, sur la base des décisions et stratégies de sécurité documentées à cet effet.FalseTrue✓True✓V15.2.33Vérifiez que l'environnement de production inclut uniquement les fonctionnalités nécessaires au fonctionnement de l'application et n'expose pas de fonctionnalités superflues telles que du code de test, des exemples d'extraits et des fonctionnalités de développement.FalseTrue✓True✓V15.2.44Vérifiez que les composants tiers et toutes leurs dépendances transitives sont inclus à partir du référentiel attendu, qu'il soit détenu en interne ou qu'il s'agisse d'une source externe, et qu'il n'y a aucun risque d'attaque par confusion de dépendances.FalseFalseTrue✓V15.2.55Vérifiez que l'application implémente des protections supplémentaires autour des parties documentées comme contenant des « fonctionnalités dangereuses » ou utilisant des bibliothèques tierces considérées comme des « composants à risque ». Cela peut inclure des techniques telles que le sandboxing, l'encapsulation, la conteneurisation ou l'isolation au niveau du réseau pour retarder et dissuader les attaquants qui compromettent une partie de l'application de se propager ailleurs.FalseFalseTrue✓V15.33Développement défensifV15.3.11Vérifiez que l'application ne renvoie que le sous-ensemble requis de champs d'un objet de données. Par exemple, elle ne doit pas renvoyer un objet de données entier, car certains champs individuels ne doivent pas être accessibles aux utilisateurs.True✓True✓True✓V15.3.22Vérifiez que lorsque le backend de l'application effectue des appels vers des URL externes, il est configuré pour ne pas suivre les redirections, sauf s'il s'agit d'une fonctionnalité prévue.FalseTrue✓True✓V15.3.33Vérifiez que l'application dispose de contre-mesures pour se protéger contre les attaques d'affectation de masse en limitant les champs autorisés par contrôleur et action, par exemple, il n'est pas possible d'insérer ou de mettre à jour une valeur de champ lorsqu'elle n'était pas destinée à faire partie de cette action.FalseTrue✓True✓V15.3.44Vérifiez que tous les composants proxy et middleware transfèrent correctement l'adresse IP d'origine de l'utilisateur à l'aide de champs de données fiables qui ne peuvent pas être manipulés par l'utilisateur final, et que l'application et le serveur Web utilisent cette valeur correcte pour la journalisation et les décisions de sécurité telles que la limitation du débit, en tenant compte du fait que même l'adresse IP d'origine peut ne pas être fiable en raison d'adresses IP dynamiques, de VPN ou de pare-feu d'entreprise.FalseTrue✓True✓V15.3.55Vérifiez que l'application garantit explicitement que les variables sont du type correct et effectue des opérations d'égalité et de comparaison strictes. Cela permet d'éviter les vulnérabilités liées à la confusion de types, causées par des hypothèses du code de l'application sur le type d'une variable.FalseTrue✓True✓V15.3.66Vérifiez que le code JavaScript est écrit de manière à éviter la pollution du prototype, par exemple en utilisant Set() ou Map() au lieu de littéraux d'objet.FalseTrue✓True✓V15.3.77Vérifiez que l'application dispose de défenses contre les attaques de pollution des paramètres HTTP, en particulier si le Framework d'application ne fait aucune distinction quant à la source des paramètres de requête (chaîne de requête, paramètres de corps, cookies ou champs d'en-tête).FalseTrue✓True✓V15.44Concurrence sécuriséeV15.4.11Vérifiez que les objets partagés dans le code multithread (tels que les caches, les fichiers ou les objets en mémoire accessibles par plusieurs threads) sont accessibles en toute sécurité à l'aide de types thread-safe et de mécanismes de synchronisation tels que des verrous ou des sémaphores pour éviter les conditions de concurrence et la corruption des données.FalseFalseTrue✓V15.4.22Vérifiez que les vérifications de l'état d'une ressource, comme son existence ou ses autorisations, et des actions qui en dépendent, sont effectuées en une seule opération atomique afin d'éviter les situations de concurrence entre le moment de la vérification et le moment de l'utilisation (TOCTOU). Par exemple, vérifier l'existence d'un fichier avant de l'ouvrir ou l'accès d'un utilisateur avant de l'accorder.FalseFalseTrue✓V15.4.33Vérifiez que les verrous sont utilisés de manière cohérente pour éviter que les threads ne se bloquent, que ce soit en s'attendant les uns les autres ou en réessayant sans fin, et que la logique de verrouillage reste dans le code responsable de la gestion de la ressource pour garantir que les verrous ne peuvent pas être modifiés par inadvertance ou de manière malveillante par des classes ou du code externes.FalseFalseTrue✓V15.4.44Vérifiez que les politiques d'allocation des ressources empêchent la saturation de threads en garantissant un accès équitable aux ressources, par exemple en exploitant les pools de threads, permettant aux threads de priorité inférieure de continuer dans un délai raisonnable.FalseFalseTrue✓V1616SecurityJournalisation de sécurité et gestion des erreursV16.11Documentation sur la journalisation de sécuritéV16.1.11Vérifiez qu'il existe un inventaire documentant la journalisation effectuée à chaque couche de la pile technologique de l'application, les événements enregistrés, les formats de journal, l'endroit où cette journalisation est stockée, la manière dont elle est utilisée, la manière dont l'accès à celle-ci est contrôlé et la durée de conservation des journaux.FalseTrue✓True✓V16.22Journalisation généraleV16.2.11Vérifiez que chaque entrée de journal inclut les métadonnées nécessaires (telles que quand, où, qui, quoi) qui permettraient une enquête détaillée sur la chronologie lorsqu'un événement se produit.FalseTrue✓True✓V16.2.22Vérifiez que les sources de temps de tous les composants de journalisation sont synchronisées et que les horodatages des métadonnées des événements de sécurité utilisent le temps UTC ou incluent un décalage horaire explicite. L'UTC est recommandé pour garantir la cohérence entre les systèmes distribués et éviter toute confusion lors du passage à l'heure d'été.FalseTrue✓True✓V16.2.33Vérifiez que l’application stocke ou diffuse uniquement les journaux vers les fichiers et services documentés dans l’inventaire des journaux.FalseTrue✓True✓V16.2.44Vérifiez que les journaux peuvent être lus et corrélés par le processeur de journaux utilisé, de préférence en utilisant un format de journalisation commun.FalseTrue✓True✓V16.2.55Vérifiez que l'application applique la journalisation en fonction du niveau de protection des données lors de la journalisation de données sensibles. Par exemple, certaines données, comme les identifiants ou les informations de paiement, peuvent être interdites. D'autres données, comme les jetons de session, ne peuvent être enregistrées que par hachage ou masquage, en totalité ou en partie.FalseTrue✓True✓V16.33Événements de sécuritéV16.3.11Vérifiez que toutes les opérations d'authentification sont enregistrées, y compris les tentatives réussies et infructueuses. Des métadonnées supplémentaires, telles que le type d'authentification ou les facteurs utilisés, doivent également être collectées.FalseTrue✓True✓V16.3.22Vérifier que les tentatives d'autorisation infructueuses sont logguées. Pour le niveau 3, cela doit inclure la journalisation de toutes les décisions d'autorisation, y compris lors de l'accès à des données sensibles (sans journalisation des données sensibles elles-mêmes).FalseTrue✓True✓V16.3.33Vérifiez que l'application enregistre les événements de sécurité définis dans la documentation et enregistre également les tentatives de contournement des contrôles de sécurité, tels que la validation des entrées, la logique métier et l'anti-automatisation.FalseTrue✓True✓V16.3.44Vérifiez que l’application enregistre les erreurs inattendues et les échecs de contrôle de sécurité tels que les échecs TLS du backend.FalseTrue✓True✓V16.44Protection des journauxV16.4.11Vérifiez que tous les composants de journalisation codent correctement les données pour empêcher l’injection de journaux.FalseTrue✓True✓V16.4.22Vérifiez que les journaux sont protégés contre tout accès non autorisé et ne peuvent pas être modifiés.FalseTrue✓True✓V16.4.33Vérifiez que les journaux sont transmis de manière sécurisée à un système logique distinct pour analyse, détection, alerte et remontée des informations. L'objectif est de garantir qu'en cas de violation de l'application, les journaux ne seront pas compromis.FalseTrue✓True✓V16.55Gestion des erreursV16.5.11Vérifiez qu'un message générique est renvoyé au consommateur lorsqu'une erreur inattendue ou sensible à la sécurité se produit, garantissant ainsi l'absence d'exposition de données système internes sensibles telles que les traces de pile, les requêtes, les clés secrètes et les jetons.FalseTrue✓True✓V16.5.22Vérifiez que l'application continue de fonctionner en toute sécurité lorsque l'accès aux ressources externes échoue, par exemple, en utilisant des modèles tels que des disjoncteurs ou une dégradation progressive.FalseTrue✓True✓V16.5.33Vérifiez que l'application échoue proprement et sécurisée, y compris lorsqu'une exception se produit, en évitant les accès en cas d'erreur telles que le traitement d'une transaction malgré les erreurs résultant de la logique de validation.FalseTrue✓True✓V16.5.44Vérifiez qu'un gestionnaire d'erreurs de « dernier recours » est défini pour intercepter toutes les exceptions non gérées. Cela permet d'éviter la perte des informations d'erreur qui doivent être loguées dans les fichiers journaux et de garantir qu'une erreur ne paralyse pas l'ensemble du processus applicatif, entraînant une perte de disponibilité.FalseFalseTrue✓V1717WebRTCWebRTCV17.11Serveur TURNV17.1.11Vérifiez que le service TURN (Traversal Using Relays around NAT) autorise uniquement l'accès aux adresses IP non réservées à des fins spécifiques (par exemple, réseaux internes, diffusion, bouclage). Notez que cela s'applique aux adresses IPv4 et IPv6.FalseTrue✓True✓V17.1.22Vérifiez que le service Traversal Using Relays around NAT (TURN) n'est pas susceptible d'épuiser ses ressources lorsque des utilisateurs légitimes tentent d'ouvrir un grand nombre de ports sur le serveur TURN.FalseFalseTrue✓V17.22MédiaV17.2.11Vérifiez que la clé du certificat Datagram Transport Layer Security (DTLS) est gérée et protégée conformément à la politique documentée de gestion des clés cryptographiques.FalseTrue✓True✓V17.2.22Vérifiez que le serveur multimédia est configuré pour utiliser et prendre en charge les suites de chiffrement DTLS (Datagram Transport Layer Security) approuvées et un profil de protection sécurisé pour l'extension DTLS pour l'établissement de clés pour le protocole de transport en temps réel sécurisé (DTLS-SRTP).FalseTrue✓True✓V17.2.33Vérifiez que l'authentification SRTP (Secure Real-time Transport Protocol) est vérifiée sur le serveur multimédia pour empêcher les attaques par injection RTP (Real-time Transport Protocol) d'entraîner une condition de déni de service ou l'insertion de médias audio ou vidéo dans les flux multimédias.FalseTrue✓True✓V17.2.44Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant lorsqu'il rencontre des paquets SRTP (Secure Real-time Transport Protocol) mal formés.FalseTrue✓True✓V17.2.55Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.FalseFalseTrue✓V17.2.66Vérifiez que le serveur multimédia n'est pas sensible à la vulnérabilité de condition de concurrence « ClientHello » dans Datagram Transport Layer Security (DTLS) en vérifiant si le serveur multimédia est publiquement connu comme étant vulnérable ou en effectuant le test de condition de concurrence.FalseFalseTrue✓V17.2.77Vérifiez que tous les mécanismes d'enregistrement audio ou vidéo associés au serveur multimédia sont en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.FalseFalseTrue✓V17.2.88Vérifiez que le certificat Datagram Transport Layer Security (DTLS) est vérifié par rapport à l'attribut d'empreinte cryptographique du protocole de description de session (SDP), en mettant fin au flux multimédia si la vérification échoue, pour garantir l'authenticité du flux multimédia.FalseFalseTrue✓V17.33SignalisationV17.3.11Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation entrants légitimes lors d'une attaque par saturation. Cela peut être réalisé en implémentant une limitation de débit au niveau de la signalisation.FalseTrue✓True✓V17.3.22Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation légitimes en cas de message mal formé susceptible de provoquer un déni de service. Cela peut inclure la validation des entrées, la gestion sécurisée des dépassements d'entiers, la prévention des dépassements de tampon et l'utilisation d'autres techniques robustes de gestion des erreurs.FalseTrue✓True✓ diff --git a/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.xml b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.xml new file mode 100644 index 0000000000..1dfb448a78 --- /dev/null +++ b/5.0/docs_fr/OWASP_Application_Security_Verification_Standard_5.0.0_fr.xml @@ -0,0 +1 @@ +Application Security Verification Standard ProjectASVS5.0.0The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.V11EncodingEncodage et nettoyageV1.11Architecture d'encodage et de nettoyageV1.1.11Vérifiez que l'entrée est décodée ou non échappée vers une forme canonique une seule fois, elle n'est décodée que lorsque des données codées sous cette forme sont attendues, et que cela est fait avant de traiter davantage l'entrée, par exemple, elle n'est pas effectuée après la validation ou la désinfection de l'entrée.2V1.1.22Vérifiez que l'application effectue l'encodage et l'échappement de sortie soit comme étape finale avant d'être utilisée par l'interpréteur pour lequel elle est destinée, soit par l'interpréteur lui-même.2V1.22Prévention des injectionsV1.2.11Vérifiez que l'encodage de sortie d'une réponse HTTP, d'un document HTML ou d'un document XML est pertinent pour le contexte requis, comme l'encodage des caractères pertinents pour les éléments HTML, les attributs HTML, les commentaires HTML, les CSS ou les champs d'en-tête HTTP, pour éviter de modifier la structure du message ou du document.1V1.2.22Vérifiez que, lors de la création dynamique d'URL, les données non fiables sont encodées en fonction de leur contexte (par exemple, encodage d'URL ou encodage base64url pour les paramètres de requête ou de chemin). Assurez-vous que seuls les schémas d'URL sûrs sont autorisés (par exemple, interdire javascript: ou data:).1V1.2.33Vérifiez que l'encodage ou l'échappement de sortie est utilisé lors de la création dynamique de contenu JavaScript (y compris JSON), pour éviter de modifier la structure du message ou du document (pour éviter l'injection JavaScript et JSON).1V1.2.44Vérifiez que la sélection de données ou les requêtes de base de données (par exemple, SQL, HQL, NoSQL, Cypher) utilisent des requêtes paramétrées, des ORM, des Framework d'entités ou sont protégées contre les injections SQL et autres attaques par injection de base de données. Ceci est également pertinent lors de l'écriture de procédures stockées.1V1.2.55Vérifiez que l’application protège contre l’injection de commandes du système d’exploitation et que les appels du système d’exploitation utilisent des requêtes du système d’exploitation paramétrées ou utilisent un encodage de sortie de ligne de commande contextuelle.1V1.2.66Vérifiez que l’application protège contre les vulnérabilités d’injection LDAP ou que des contrôles de sécurité spécifiques pour empêcher l’injection LDAP ont été mis en œuvre.2V1.2.77Vérifiez que l’application est protégée contre les attaques par injection XPath en utilisant la paramétrisation des requêtes ou des requêtes précompilées.2V1.2.88Vérifiez que les processeurs LaTeX sont configurés de manière sécurisée (par exemple, en n'utilisant pas l'indicateur « --shell-escape ») et qu'une liste d’autorisations de commandes est utilisée pour empêcher les attaques par injection LaTeX.2V1.2.99Vérifiez que l'application échappe les caractères spéciaux dans les expressions régulières (généralement à l'aide d'une barre oblique inverse) pour éviter qu'ils ne soient mal interprétés comme des métacaractères.2V1.2.1010Vérifiez que l'application est protégée contre les injections CSV et injections de formules. L'application doit respecter les règles d'échappement définies dans les sections 2.6 et 2.7 de la RFC 4180 lors de l'export de contenu CSV. De plus, lors de l'export au format CSV ou vers d'autres formats de tableur (tels que XLS, XLSX ou ODF), les caractères spéciaux (notamment « = », « + », « - », « @ », « \t » (tabulation) et « \0 » (caractère null)) doivent être protégés par une apostrophe s'ils apparaissent en premier dans une valeur de champ.3V1.33NettoyageV1.3.11Vérifiez que toutes les entrées HTML non fiables provenant d'éditeurs WYSIWYG ou similaires sont nettoyées à l'aide d'une bibliothèque ou d'une fonctionnalité de Framework de nettoyage HTML bien connue et sécurisée.1V1.3.22Vérifiez que l'application évite d'utiliser eval() ou d'autres fonctionnalités d'exécution de code dynamique telles que Spring Expression Language (SpEL). En l'absence d'alternative, toute saisie utilisateur incluse doit être nettoyée avant d'être exécutée.1V1.3.33Vérifiez que les données transmises à un contexte potentiellement dangereux sont préalablement nettoyées pour appliquer des mesures de sécurité, telles qu'autoriser uniquement des caractères sûrs pour ce contexte et raccourcir des entrées trop longues.2V1.3.44Vérifiez que le contenu Scalable Vector Graphics (SVG) scriptable fourni par l'utilisateur est validé ou nettoyé pour contenir uniquement des balises et des attributs (tels que des graphiques de dessin) qui sont sûrs pour l'application, par exemple, ne contiennent pas de scripts et d'objets étrangers.2V1.3.55Vérifiez que l'application nettoie ou désactive le contenu du langage de modèle d'expression ou de script fourni par l'utilisateur, tel que les feuilles de style CSS, le Markdown ou XSL, BBCode ou similaire.2V1.3.66Vérifiez que l'application protège contre les attaques de falsification de requête côté serveur (SSRF), en validant les données non fiables par rapport à une liste d'autorisation de protocoles, de domaines, de chemins et de ports et en nettoyant les caractères potentiellement dangereux avant d'utiliser les données pour appeler un autre service.2V1.3.77Vérifiez que l'application se protège contre les attaques par injection de modèles en interdisant la création de modèles basés sur des entrées non fiables. En l'absence d'alternative, toute entrée non fiable incluse dynamiquement lors de la création du modèle doit être nettoyée ou rigoureusement validée.2V1.3.88Vérifiez que l’application nettoie correctement les entrées non fiables avant utilisation dans les requêtes Java Naming and Directory Interface (JNDI) et que JNDI est configuré de manière sécurisée pour empêcher les attaques par injection JNDI.2V1.3.99Vérifiez que l’application nettoie le contenu avant qu’il ne soit envoyé à memcache pour éviter les attaques par injection.2V1.3.1010Vérifiez que les chaînes de format susceptibles d'être résolues de manière inattendue ou malveillante lors de leur utilisation sont nettoyées avant d'être traitées.2V1.3.1111Vérifiez que l'application nettoie les entrées utilisateur avant de les transmettre aux systèmes de messagerie pour se protéger contre l'injection SMTP ou IMAP.2V1.3.1212Vérifiez que les expressions régulières sont exemptes d'éléments provoquant "backtracking" exponentiel et assurez-vous que les entrées non fiables sont nettoyées pour atténuer les attaques ReDoS ou Runaway Regex.3V1.44Mémoire, chaine de caractères et code à mémoire non-managéeV1.4.11Vérifiez que l'application utilise des chaînes memory-safe, une copie de mémoire et une arithmétique de pointeur renforcée pour détecter ou empêcher les débordements de pile, de tampon ou de tas.2V1.4.22Vérifiez que les techniques de validation du signe, de la plage et de l’entrée sont utilisées pour éviter les dépassements d’entiers.2V1.4.33Vérifiez que la mémoire et les ressources allouées dynamiquement sont libérées et que les références ou les pointeurs vers la mémoire libérée sont supprimés ou définis à null pour éviter les "dangling pointer" et les vulnérabilités d'utilisation après libération.2V1.55Désérialisation sécuriséeV1.5.11Vérifiez que l'application configure les "parser" XML pour utiliser une configuration restrictive et que les fonctionnalités non sûres telles que la résolution d'entités externes sont désactivées pour empêcher les attaques XML eXternal Entity (XXE).1V1.5.22Vérifiez que la désérialisation des données non fiables garantit une gestion sécurisée des entrées, par exemple en utilisant une liste d'autorisation de types d'objets ou en limitant les types d'objets définis par le client, afin d'empêcher les attaques par désérialisation. Les mécanismes de désérialisation explicitement définis comme non sécurisés ne doivent pas être utilisés avec des entrées non fiables.2V1.5.33Vérifiez que les différents "parser" utilisés dans l'application pour le même type de données (par exemple, les "parser" JSON, les "parser" XML, les "parser" d'URL) effectuent l'analyse de manière cohérente et utilisent le même mécanisme d'encodage de caractères pour éviter des problèmes tels que les vulnérabilités d'interopérabilité JSON ou un comportement d'analyse d'URI ou de fichier différent exploité dans les attaques d'inclusion de fichiers à distance (RFI) ou de falsification de requête côté serveur (SSRF).3V22ValidationValidation et logique métierV2.11Validation et documentation de la logique métierV2.1.11Vérifiez que la documentation de l'application définit des règles de validation des entrées pour vérifier la validité des éléments de données par rapport à la structure attendue. Il peut s'agir de formats de données courants tels que des numéros de carte de crédit, des adresses e-mail ou des numéros de téléphone, ou d'un format de données interne.1V2.1.22Vérifiez que la documentation de l'application définit comment valider la cohérence logique et contextuelle des éléments de données combinés, par exemple en vérifiant que la banlieue et le code postal correspondent.2V2.1.33Vérifiez que les attentes en matière de limites et de validations de la logique métier sont documentées, y compris par utilisateur et globalement dans l'application.2V2.22Validation des entréesV2.2.11Vérifier que les entrées sont validées afin de respecter les attentes métier ou fonctionnelles. Cette validation doit être basée sur une liste de valeurs, de modèles et de plages autorisées, ou sur la comparaison des entrées avec une structure attendue et des limites logiques selon des règles prédéfinies. Pour le niveau 1, cette validation peut se concentrer sur les entrées utilisées pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau 2, elle doit s'appliquer à toutes les entrées.1V2.2.22Vérifiez que l'application est conçue pour appliquer la validation des entrées au niveau d'une couche de service de confiance. Bien que la validation côté client améliore l'ergonomie et doit être encouragée, elle ne doit pas être considérée comme un contrôle de sécurité.1V2.2.33Vérifiez que l’application garantit que les combinaisons d’éléments de données associés sont raisonnables selon les règles prédéfinies.2V2.33Sécurité de la logique métierV2.3.11Vérifiez que l’application traitera uniquement les flux de logique métier pour le même utilisateur dans l’ordre séquentiel attendu et sans sauter d’étapes.1V2.3.22Vérifiez que les limites de la logique métier sont implémentées conformément à la documentation de l'application, afin d'éviter que des failles de la logique métier ne soient pas exploitées.2V2.3.33Vérifiez que les transactions sont utilisées au niveau de la logique métier de telle sorte qu'une opération de logique métier réussisse dans son intégralité ou qu'elle soit restaurée à l'état correct précédent.2V2.3.44Vérifiez que les mécanismes de verrouillage au niveau de la logique métier sont utilisés pour garantir que les ressources en quantité limitée (telles que les sièges de théâtre ou les créneaux de livraison) ne peuvent pas être réservées deux fois en manipulant la logique de l'application.2V2.3.55Vérifiez que les flux logiques métier à forte valeur ajoutée nécessitent l'approbation de plusieurs utilisateurs afin d'éviter toute action non autorisée ou accidentelle. Cela peut inclure, sans s'y limiter, les transferts monétaires importants, les approbations de contrats, l'accès à des informations classifiées ou les contournements de sécurité dans le secteur manufacturier.3V2.44Anti-automatisationV2.4.11Vérifiez que des contrôles anti-automatisation sont en place pour protéger contre les appels excessifs aux fonctions d'application qui pourraient conduire à l'exfiltration de données, à la création de données inutiles, à l'épuisement des quotas, aux violations de limites de débit, au déni de service ou à la surutilisation de ressources coûteuses.2V2.4.22Vérifiez que les flux logiques métier nécessitent un timing humain réaliste, évitant ainsi des soumissions de transactions excessivement rapides.3V33WebSécurité du frontend WebV3.11Documentation sur la sécurité du frontend WebV3.1.11Vérifiez que la documentation de l'application indique les fonctionnalités de sécurité attendues que les navigateurs utilisant l'application doivent prendre en charge (telles que HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) et autres mécanismes de sécurité HTTP pertinents). Elle doit également définir le comportement de l'application lorsque certaines de ces fonctionnalités ne sont pas disponibles (par exemple, avertir l'utilisateur ou bloquer l'accès).3V3.22Interprétation non intentionnelle du contenuV3.2.11Vérifiez que des contrôles de sécurité sont en place pour empêcher les navigateurs d'afficher du contenu ou des fonctionnalités dans les réponses HTTP dans un contexte incorrect (par exemple, lorsqu'une API, un fichier téléchargé par l'utilisateur ou une autre ressource est demandée directement). Les contrôles possibles peuvent inclure : ne pas transmettre le contenu sauf si les champs d'en-tête de requête HTTP (tels que Sec-Fetch-\*) indiquent qu'il s'agit du contexte correct, utiliser la directive sandbox du champ d'en-tête Content-Security-Policy ou utiliser le type de disposition de pièce jointe dans le champ d'en-tête Content-Disposition.1V3.2.22Vérifiez que le contenu destiné à être affiché sous forme de texte, plutôt que rendu sous forme de HTML, est géré à l'aide de fonctions de rendu sécurisées (telles que createTextNode ou textContent) pour empêcher l'exécution involontaire de contenu tel que HTML ou JavaScript.1V3.2.33Vérifiez que l'application évite l'écrasement du DOM lors de l'utilisation de JavaScript côté client en utilisant des déclarations de variables explicites, en effectuant une vérification de type stricte, en évitant de stocker des variables globales sur l'objet document et en implémentant l'isolation de l'espace de nommage.3V3.33Configuration des cookiesV3.3.11Vérifiez que les cookies ont l'attribut « Secure » ​​défini et si le préfixe « \__Host- » n'est pas utilisé pour le nom du cookie, le préfixe « __Secure- » doit être utilisé pour le nom du cookie.1V3.3.22Vérifiez que la valeur de l'attribut « SameSite » de chaque cookie est définie en fonction de l'objectif du cookie, afin de limiter l'exposition aux attaques de réparation de l'interface utilisateur et aux attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).2V3.3.33Vérifiez que les cookies ont le préfixe « __Host- » pour le nom du cookie, sauf s'ils sont explicitement conçus pour être partagés avec d'autres hôtes.2V3.3.44Vérifiez que si la valeur d'un cookie n'est pas censée être accessible aux scripts côté client (comme un jeton de session), le cookie doit avoir l'attribut « HttpOnly » défini et la même valeur (par exemple, un jeton de session) ne doit être transférée au client que via le champ d'en-tête « Set-Cookie ».2V3.3.55Vérifiez que lorsque l'application écrit un cookie, la longueur combinée du nom et de la valeur du cookie ne dépasse pas 4 096 octets. Les cookies trop volumineux ne seront pas stockés par le navigateur et ne seront donc pas envoyés avec les requêtes, empêchant ainsi l'utilisateur d'utiliser les fonctionnalités de l'application qui reposent sur ce cookie.3V3.44En-têtes du mécanisme de sécurité du navigateurV3.4.11Vérifiez qu'un champ d'en-tête Strict-Transport-Security est inclus dans toutes les réponses afin d'appliquer une politique HTTP Strict Transport Security (HSTS). Une durée maximale d'au moins un an doit être définie, et pour les niveaux L2 et supérieurs, la politique doit également s'appliquer à tous les sous-domaines.1V3.4.22Vérifiez que le champ d'en-tête Access-Control-Allow-Origin du partage de ressources cross-origine (CORS) est une valeur fixe de l'application ou, si la valeur du champ d'en-tête de requête HTTP Origin est utilisée, qu'elle est validée par rapport à une liste d'origines approuvées. Si « Access-Control-Allow-Origin: * » doit être utilisé, vérifiez que la réponse ne contient aucune information sensible.1V3.4.33Vérifiez que les réponses HTTP incluent un champ d'en-tête de réponse Content-Security-Policy qui définit des directives garantissant que le navigateur charge et exécute uniquement du contenu ou des ressources fiables, afin de limiter l'exécution de JavaScript malveillant. Au minimum, une politique globale doit être utilisée, incluant les directives object-src 'none' et base-uri 'none', et définissant soit une lliste d’autorisations, soit des valeurs nonces ou des hachages. Pour une application L3, une politique par réponse avec des valeurs nonces ou des hachages doit être définie.2V3.4.44Vérifiez que toutes les réponses HTTP contiennent un champ d'en-tête « X-Content-Type-Options: nosniff ». Cela indique aux navigateurs de ne pas utiliser l'analyse de contenu ni la détection du type MIME pour la réponse donnée, et d'exiger que la valeur du champ d'en-tête « Content-Type » de la réponse corresponde à la ressource de destination. Par exemple, la réponse à une demande de style n'est acceptée que si le type de contenu de la réponse est « text/css ». Cela permet également au navigateur d'utiliser la fonctionnalité de blocage de lecture inter-origines (CORB).2V3.4.55Vérifiez que l'application définit une politique de référencement afin d'empêcher la fuite de données techniquement sensibles vers des services tiers via le champ d'en-tête de requête HTTP « Referer ». Cela peut être effectué via le champ d'en-tête de réponse HTTP « Referrer-Policy » ou via les attributs d'élément HTML. Les données sensibles peuvent inclure le chemin d'accès et les données de requête dans l'URL, et pour les applications internes non publiques, le nom d'hôte.2V3.4.66Vérifiez que l'application Web utilise la directive frame-ancestors du champ d'en-tête Content-Security-Policy pour chaque réponse HTTP afin de garantir qu'elle ne peut pas être intégrée par défaut et que l'intégration de ressources spécifiques n'est autorisée qu'en cas de nécessité. Notez que le champ d'en-tête X-Frame-Options, bien que pris en charge par les navigateurs, est obsolète et n'est pas forcément fiable.2V3.4.77Vérifiez que le champ d’en-tête Content-Security-Policy spécifie un emplacement pour signaler les violations.3V3.4.88Vérifiez que toutes les réponses HTTP qui lancent le rendu d'un document (comme les réponses de type text/html) incluent le champ d'en-tête 'Cross-Origin-Opener-Policy' avec la directive 'same-origin' ou s'ame-origin-allow-popups', selon les besoins. Cela empêche les attaques abusant de l'accès partagé aux objets Window, telles que le tabnabbing et le comptage d'images.3V3.55Séparation de l'origine du navigateurV3.5.11Vérifiez que, si l'application ne s'appuie pas sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher les requêtes inter-origines non autorisées d'utiliser des fonctionnalités sensibles, ces requêtes sont validées afin de garantir leur origine. Cela peut se faire en utilisant et en validant des jetons anti-falsification ou en exigeant des champs d'en-tête HTTP supplémentaires qui ne sont pas des champs d'en-tête de requête CORS safelist. Ceci permet de se protéger contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF).1V3.5.22Vérifiez que, si l'application s'appuie sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher l'utilisation inter-origines non autorisée de fonctionnalités sensibles, il est impossible d'appeler la fonctionnalité avec une requête qui ne déclenche pas de requête de pré-vérification cross-origin CORS. Cela peut nécessiter de vérifier les valeurs des champs d'en-tête de requête 'Origin' et 'Content-Type' ou d'utiliser un champ d'en-tête supplémentaire qui n'est pas un champ d'en-tête de la liste de sécurité CORS.1V3.5.33Vérifiez que les requêtes HTTP destinées aux fonctionnalités sensibles utilisent des méthodes HTTP appropriées, telles que POST, PUT, PATCH ou DELETE, et non des méthodes définies comme « sûres » par la spécification HTTP, telles que HEAD, OPTIONS ou GET. Une validation stricte des champs d'en-tête de requête Sec-Fetch-* peut également être utilisée pour garantir que la requête ne provient pas d'un appel inter-origines inapproprié, d'une requête de navigation ou d'un chargement de ressources (comme une source d'image) inattendu.1V3.5.44Vérifiez que des applications distinctes sont hébergées sur des noms d'hôte différents pour tirer parti des restrictions fournies par la politique de même origine, y compris la manière dont les documents ou scripts chargés par une origine peuvent interagir avec les ressources d'une autre origine et les restrictions basées sur le nom d'hôte sur les cookies.2V3.5.55Vérifiez que les messages reçus par l'interface postMessage sont rejetés si l'origine du message n'est pas digne de confiance ou si la syntaxe du message n'est pas valide.2V3.5.66Vérifiez que la fonctionnalité JSONP n'est activée nulle part dans l'application pour éviter les attaques Cross-Site Script Inclusion (XSSI).3V3.5.77Vérifiez que les données nécessitant une autorisation ne sont pas incluses dans les réponses des ressources de script, comme les fichiers JavaScript, pour empêcher les attaques par inclusion de script intersite (XSSI).3V3.5.88Vérifiez que les ressources authentifiées (telles que les images, les vidéos, les scripts et autres documents) peuvent être chargées ou intégrées pour le compte de l'utilisateur uniquement lorsque cela est prévu. Cela peut être réalisé en validant strictement les champs d'en-tête de requête HTTP Sec-Fetch-* afin de garantir que la requête ne provient pas d'un appel cross-origin inapproprié, ou en définissant un champ d'en-tête de réponse HTTP Cross-Origin-Resource-Policy restrictif pour indiquer au navigateur de bloquer le contenu renvoyé.3V3.66Intégrité des ressources externesV3.6.11Vérifiez que les ressources côté client, telles que les bibliothèques JavaScript, les feuilles de style CSS ou les polices web, sont hébergées en externe (par exemple, sur un réseau de diffusion de contenu) uniquement si la ressource est statique et versionnée, et si l'intégrité des sous-ressources (SRI) est utilisée pour valider l'intégrité de la ressource. Si cela n'est pas possible, une décision de sécurité documentée doit justifier cette décision pour chaque ressource.3V3.77Autres considérations sur la sécurité du navigateurV3.7.11Vérifiez que l'application utilise uniquement des technologies côté client toujours prises en charge et considérées comme sécurisées. Parmi les technologies qui ne répondent pas à cette exigence figurent les plugins NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL ou les applets Java côté client.2V3.7.22Vérifiez que l'application redirigera automatiquement l'utilisateur vers un nom d'hôte ou un domaine différent (qui n'est pas contrôlé par l'application) uniquement lorsque la destination apparaît sur une liste d'autorisation.2V3.7.33Vérifiez que le domaine de premier niveau de l'application (par exemple, site.tld) ​​est ajouté à la liste de préchargement publique pour HTTP Strict Transport Security (HSTS). Cela garantit que l'utilisation de TLS pour l'application est intégrée directement dans les principaux navigateurs, plutôt que de dépendre uniquement du champ d'en-tête de réponse Strict-Transport-Security.3V3.7.44Vérifiez que l'application affiche une notification lorsque l'utilisateur est redirigé vers une URL hors du contrôle de l'application, avec une option pour annuler la navigation.3V3.7.55Vérifiez que l'application se comporte comme documenté (par exemple, en avertissant l'utilisateur ou en bloquant l'accès) si le navigateur utilisé pour accéder à l'application ne prend pas en charge les fonctionnalités de sécurité attendues.3V44APIAPI et service WebV4.11Sécurité du service Web génériqueV4.1.11Vérifiez que chaque réponse HTTP avec un corps de message contient un champ d'en-tête Content-Type qui correspond au contenu réel de la réponse, y compris le paramètre charset pour spécifier un codage de caractères sécurisé (par exemple, UTF-8, ISO-8859-1) conformément aux types de médias IANA, tels que « text/ », « /+xml » et « /xml ».1V4.1.22Vérifiez que seuls les terminaux utilisateurs (destinés à l'accès manuel via un navigateur web) redirigent automatiquement de HTTP vers HTTPS, tandis que les autres services ou terminaux n'implémentent pas de redirections transparentes. Cela permet d'éviter qu'un client envoie par erreur des requêtes HTTP non chiffrées, mais que, comme ces requêtes sont automatiquement redirigées vers HTTPS, la fuite de données sensibles passe inaperçue.2V4.1.33Vérifiez que tout champ d'en-tête HTTP utilisé par l'application et défini par une couche intermédiaire, telle qu'un équilibreur de charge, un proxy web ou un service backend-for-frontend, ne peut pas être remplacé par l'utilisateur final. Les exemples d'en-têtes peuvent inclure X-Real-IP, X-Forwarded-*, ou X-User-ID.2V4.1.44Vérifiez que seules les méthodes HTTP explicitement prises en charge par l'application ou son API (y compris les OPTIONS lors des demandes de contrôle en amont) peuvent être utilisées et que les méthodes inutilisées sont bloquées.3V4.1.55Vérifier que les signatures numériques par message sont utilisées pour fournir une assurance supplémentaire en plus des protections de transport pour les demandes ou les transactions qui sont très sensibles ou qui traversent un certain nombre de systèmes.3V4.22Validation de la structure des messages HTTPV4.2.11Vérifiez que tous les composants de l'application (y compris les équilibreurs de charge, les pares-feux et les serveurs d'applications) déterminent les limites des messages HTTP entrants à l'aide du mécanisme approprié à la version HTTP afin d'empêcher la contrebande de requêtes HTTP. Dans HTTP/1.x, si un champ d'en-tête Transfer-Encoding est présent, l'en-tête Content-Length doit être ignoré conformément à la RFC 2616. Avec HTTP/2 ou HTTP/3, si un champ d'en-tête Content-Length est présent, le récepteur doit s'assurer qu'il est cohérent avec la longueur des trames DATA.2V4.2.22Vérifier que, lors de la génération de messages HTTP, le champ d'en-tête Content-Length n'entre pas en conflit avec la longueur du contenu déterminée par le cadrage du protocole HTTP, afin d'empêcher les attaques de type « request smuggling ».3V4.2.33Vérifiez que l'application n'envoie ni n'accepte de messages HTTP/2 ou HTTP/3 avec des champs d'en-tête spécifiques à la connexion, tels que Transfer-Encoding, afin d'éviter les attaques par fractionnement de la réponse et par injection d'en-tête.3V4.2.44Vérifiez que l'application n'accepte que les requêtes HTTP/2 et HTTP/3 dont les champs et valeurs d'en-tête ne contiennent pas de séquences CR (\r), LF (\n) ou CRLF (\r\n), afin d'éviter les attaques par injection d'en-tête.3V4.2.55Vérifiez que, si l'application (backend ou frontend) construit et envoie des requêtes, elle utilise des mécanismes de validation, d'assainissement ou autres pour éviter de créer des URI (comme pour les appels API) ou des champs d'en-tête de requête HTTP (comme Authorization ou Cookie) qui sont trop longs pour être acceptés par le composant récepteur. Cela pourrait entraîner un déni de service, par exemple lors de l'envoi d'une requête trop longue (par exemple, un long champ d'en-tête de cookie), ce qui fait que le serveur répond toujours avec un statut d'erreur.3V4.33GraphQLV4.3.11Vérifiez qu'une liste d'autorisation de requête, une limitation de profondeur, une limitation de quantité ou une analyse des coûts de requête est utilisée pour empêcher le déni de service (DoS) de GraphQL ou d'expression de la couche données en raison de requêtes imbriquées coûteuses.2V4.3.22Vérifiez que les requêtes d’introspection GraphQL sont désactivées dans l’environnement de production, sauf si l’API GraphQL est destinée à être utilisée par d’autres parties.2V4.44WebSocketV4.4.11Vérifiez que WebSocket sur TLS (WSS) est utilisé pour toutes les connexions WebSocket.1V4.4.22Vérifiez que, lors de la négociation HTTP WebSocket initiale, le champ d’en-tête 'Origin' est vérifié par rapport à une liste d’origines autorisées pour l’application.2V4.4.33Vérifiez que, si la gestion de session standard de l'application ne peut pas être utilisée, des jetons dédiés sont utilisés à cet effet, qui sont conformes aux exigences de sécurité de gestion de session pertinentes.2V4.4.44Vérifiez que les jetons de gestion de session WebSocket dédiés sont initialement obtenus ou validés via la session HTTPS précédemment authentifiée lors de la transition d'une session HTTPS existante vers un canal WebSocket.2V55FileGestion des fichiersV5.11Documentation sur la gestion des fichiersV5.1.11Vérifiez que la documentation définit les types de fichiers autorisés, les extensions de fichiers attendues et la taille maximale (y compris la taille décompressée) pour chaque fonctionnalité de Téléversement. De plus, assurez-vous que la documentation précise comment les fichiers sont sécurisés pour le téléchargement et le traitement des utilisateurs finaux, par exemple le comportement de l'application lorsqu'un fichier malveillant est détecté.2V5.22Téléversement de fichiers et contenuV5.2.11Vérifiez que l'application n'acceptera que des fichiers d'une taille qu'elle peut traiter sans provoquer de perte de performances ou d'attaque par déni de service.1V5.2.22Vérifiez que lorsque l'application accepte un fichier, seul ou dans une archive telle qu'un fichier zip, elle vérifie si l'extension de fichier correspond à une extension attendue et que le contenu correspond au type représenté par l'extension. Cela inclut, sans s'y limiter, la vérification des « octets magiques » initiaux, la réécriture d'images et l'utilisation de bibliothèques spécialisées pour la validation du contenu des fichiers. Pour le niveau L1, cela peut se concentrer uniquement sur les fichiers utilisés pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau L2, cela doit s'appliquer à tous les fichiers acceptés.1V5.2.33Vérifiez que l'application vérifie les fichiers compressés (par exemple, zip, gz, docx, odt) par rapport à la taille maximale autorisée non compressée et au nombre maximal de fichiers avant de décompresser le fichier.2V5.2.44Vérifiez qu'un quota de taille de fichier et un nombre maximal de fichiers par utilisateur sont appliqués pour garantir qu'un seul utilisateur ne puisse pas remplir le stockage avec trop de fichiers ou des fichiers excessivement volumineux.3V5.2.55Vérifiez que l'application n'autorise pas le téléversement de fichiers compressés contenant des liens symboliques, sauf si cela est spécifiquement requis (auquel cas il sera nécessaire d'appliquer une liste d'autorisation des fichiers vers lesquels il est possible de créer des liens symboliques).3V5.2.66Vérifiez que l'application rejette les images téléversées avec une taille de pixel supérieure au maximum autorisé, afin d'éviter les attaques par inondation de pixels.3V5.33Stockage de fichiersV5.3.11Vérifiez que les fichiers téléversés ou générés par une entrée non fiable et stockés dans un dossier public ne sont pas exécutés en tant que code de programme côté serveur lorsqu'ils sont accessibles directement avec une requête HTTP.1V5.3.22Vérifiez que lorsque l'application crée des chemins d'accès pour les opérations sur les fichiers, elle utilise des données générées en interne ou fiables plutôt que des noms de fichiers soumis par l'utilisateur. Si des noms de fichiers ou des métadonnées de fichiers soumis par l'utilisateur doivent être utilisés, une validation et un nettoyage stricts doivent être appliqués. Ceci permet de se protéger contre les attaques par traversée de chemin, l'inclusion de fichiers locaux ou distants (LFI, RFI) et la falsification de requêtes côté serveur (SSRF).1V5.3.33Vérifiez que le traitement des fichiers côté serveur, comme la décompression des fichiers, ignore les informations de chemin fournies par l'utilisateur pour éviter les vulnérabilités telles que le "zip slip".3V5.44Téléchargement de fichierV5.4.11Vérifiez que l’application valide ou ignore les noms de fichiers soumis par l’utilisateur, y compris dans un paramètre JSON, JSONP ou URL et spécifie un nom de fichier dans le champ d’en-tête Content-Disposition de la réponse.2V5.4.22Vérifiez que les noms de fichiers servis (par exemple, dans les champs d'en-tête de réponse HTTP ou les pièces jointes aux e-mails) sont encodés ou nettoyés (par exemple, conformément à la RFC 6266) pour préserver la structure du document et empêcher les attaques par injection.2V5.4.33Vérifiez que les fichiers obtenus à partir de sources non fiables sont analysés par des scanners antivirus pour empêcher la diffusion de contenu malveillant connu.2V66AuthenticationAuthentificationV6.11Documentation d'authentificationV6.1.11Vérifiez que la documentation de l'application définit comment les contrôles, tels que la limitation de débit, l'anti-automatisation et la réponse adaptative, sont utilisés pour se défendre contre les attaques telles que le « credential stuffing » et la force brute des mots de passe. La documentation doit expliquer clairement comment ces contrôles sont configurés et empêcher le blocage malveillant des comptes.1V6.1.22Vérifiez qu'une liste de mots spécifiques au contexte est documentée afin d'empêcher leur utilisation dans les mots de passe. Cette liste peut inclure des permutations de noms d'organisations, de produits, d'identifiants de systèmes, de noms de codes de projets, de noms de services ou de rôles, etc.2V6.1.33Vérifiez que, si l'application inclut plusieurs voies d'authentification, celles-ci sont toutes documentées avec les contrôles de sécurité et la force d'authentification qui doivent être appliqués de manière cohérente.2V6.22Sécurité des mots de passeV6.2.11Vérifiez que les mots de passe définis par l'utilisateur comportent au moins 8 caractères, bien qu'un minimum de 15 caractères soit fortement recommandé.1V6.2.22Vérifiez que les utilisateurs peuvent modifier leur mot de passe.1V6.2.33Vérifiez que la fonctionnalité de changement de mot de passe nécessite le mot de passe actuel et le nouveau mot de passe de l'utilisateur.1V6.2.44Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou du changement de mot de passe sont vérifiés par rapport à un ensemble disponible d'au moins 3 000 mots de passe principaux qui correspondent à la politique de mot de passe de l'application, par exemple la longueur minimale.1V6.2.55Vérifiez que les mots de passe peuvent être utilisés, quelle que soit leur composition, sans restriction quant au type de caractères autorisés. Aucun nombre minimal de majuscules ou de minuscules, de chiffres ou de caractères spéciaux ne doit être exigé.1V6.2.66Vérifiez que les champs de saisie du mot de passe utilisent type=password pour masquer la saisie. Les applications peuvent permettre à l'utilisateur d'afficher temporairement l'intégralité du mot de passe masqué ou le dernier caractère saisi.1V6.2.77Vérifiez que la fonctionnalité « coller », les assistants de mot de passe du navigateur et les gestionnaires de mots de passe externes sont autorisés.1V6.2.88Vérifiez que l'application vérifie le mot de passe de l'utilisateur exactement tel qu'il a été reçu de l'utilisateur, sans aucune modification telle qu'une troncature ou une transformation de casse.1V6.2.99Vérifiez que les mots de passe d’au moins 64 caractères sont autorisés.2V6.2.1010Vérifiez que le mot de passe d'un utilisateur reste valide jusqu'à ce qu'il soit découvert comme compromis ou qu'il soit renouvelé. L'application ne doit pas exiger de renouvellement périodique des identifiants.2V6.2.1111Vérifiez que la liste documentée de mots spécifiques au contexte est utilisée pour éviter la création de mots de passe faciles à deviner.2V6.2.1212Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou des modifications de mot de passe sont vérifiés par rapport à un ensemble de mots de passe fuités.2V6.33Sécurité générale de l'authentificationV6.3.11Vérifiez que les contrôles visant à empêcher les attaques telles que le bourrage d'informations d'identification et la force brute des mots de passe sont mis en œuvre conformément à la documentation de sécurité de l'application.1V6.3.22Vérifiez que les comptes d’utilisateur par défaut (par exemple, « root », « admin » ou « sa ») ne sont pas présents dans l’application ou sont désactivés.1V6.3.33Vérifiez que l’application exige que les utilisateurs utilisent un mécanisme d’authentification multifacteur ou une combinaison de mécanismes d’authentification à facteur unique.2V6.3.44Vérifiez que, si l’application inclut plusieurs voies d’authentification, il n’existe aucune voie non documentée et que les contrôles de sécurité et la force d’authentification sont appliqués de manière cohérente.2V6.3.55Vérifiez que les utilisateurs sont informés des tentatives d'authentification suspectes (réussies ou non). Il peut s'agir de tentatives d'authentification provenant d'un emplacement ou d'un client inhabituel, d'une authentification partiellement réussie (un seul facteur parmi plusieurs), d'une tentative d'authentification après une longue période d'inactivité ou d'une authentification réussie après plusieurs tentatives infructueuses.3V6.3.66Vérifiez que le courrier électronique n’est pas utilisé comme mécanisme d’authentification à facteur unique ou à facteurs multiples.3V6.3.77Vérifiez que les utilisateurs sont avertis après les mises à jour des détails d'authentification, telles que les réinitialisations d'informations d'identification ou la modification du nom d'utilisateur ou de l'adresse e-mail.3V6.3.88Vérifiez que les utilisateurs valides ne peuvent pas être déduits d'échecs d'authentification, par exemple en se basant sur des messages d'erreur, des codes de réponse HTTP ou des temps de réponse différents. Les fonctionnalités d'inscription et de mot de passe oublié doivent également bénéficier de cette protection.3V6.44Cycle de vie et récupération du facteur d'authentificationV6.4.11Vérifiez que les mots de passe initiaux ou les codes d'activation générés par le système sont générés de manière aléatoire et sécurisée, qu'ils respectent la politique de mots de passe en vigueur et qu'ils expirent après une courte période ou après leur première utilisation. Ces secrets initiaux ne doivent pas devenir des mots de passe permanents.1V6.4.22Vérifiez que les indices de mot de passe ou l'authentification basée sur les connaissances (appelées « questions secrètes ») ne sont pas présents.1V6.4.33Vérifiez qu'un processus sécurisé de réinitialisation d'un mot de passe oublié est mis en œuvre, qui ne contourne aucun mécanisme d'authentification multifacteur activé.2V6.4.44Vérifiez que si un facteur d'authentification multifacteur est perdu, la preuve de vérification d'identité est effectuée au même niveau que lors de l'inscription.2V6.4.55Vérifiez que les instructions de renouvellement des mécanismes d'authentification qui expirent sont envoyées avec suffisamment de temps pour être exécutées avant l'expiration de l'ancien mécanisme d'authentification, en configurant des rappels automatiques si nécessaire.3V6.4.66Vérifiez que les administrateurs peuvent initier la réinitialisation du mot de passe de l'utilisateur, mais que cela ne leur permet pas de modifier ou de choisir son mot de passe. Cela évite qu'ils ne connaissent le mot de passe de l'utilisateur.3V6.55Exigences générales en matière d'authentification multifacteurV6.5.11Vérifiez que les secrets de recherche, les demandes ou codes d'authentification out-of-band et les mots de passe à usage unique basés sur le temps (TOTP) ne peuvent être utilisés avec succès qu'une seule fois.2V6.5.22Vérifiez que, lors de leur stockage dans le backend de l'application, les secrets de recherche comportant moins de 112 bits d'entropie (19 caractères alphanumériques aléatoires ou 34 chiffres aléatoires) sont hachés avec un algorithme de hachage de stockage de mots de passe approuvé, intégrant un sel aléatoire de 32 bits. Une fonction de hachage standard peut être utilisée si le secret comporte 112 bits d'entropie ou plus.2V6.5.33Vérifiez que les secrets de recherche, le code d'authentification out-of-band et les mots de passe à usage unique basés sur le temps sont générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) pour éviter les valeurs prévisibles.2V6.5.44Vérifiez que les secrets de recherche et les codes d'authentification out-of-band ont un minimum de 20 bits d'entropie (généralement 4 caractères alphanumériques aléatoires ou 6 chiffres aléatoires suffisent).2V6.5.55Vérifiez que les requêtes, codes ou jetons d'authentification out-of-band, ainsi que les mots de passe à usage unique (TOTP), ont une durée de vie définie. Les requêtes out-of-band doivent avoir une durée de vie maximale de 10 minutes et les TOTP, de 30 secondes.2V6.5.66Vérifiez que tout facteur d’authentification (y compris les appareils physiques) peut être révoqué en cas de vol ou autre perte.3V6.5.77Vérifiez que les mécanismes d’authentification biométrique ne sont utilisés que comme facteurs secondaires, avec quelque chose que vous possédez ou quelque chose que vous savez.3V6.5.88Vérifiez que les mots de passe à usage unique basés sur le temps (TOTP) sont vérifiés en fonction d'une source temporelle provenant d'un service de confiance et non d'une heure non fiable ou fournie par le client.3V6.66Mécanismes d'authentification out-of-bandV6.6.11Vérifier que les mécanismes d'authentification utilisant le réseau téléphonique public commuté (RTPC) pour la transmission de mots de passe à usage unique (OTP) par téléphone ou SMS ne sont proposés que lorsque le numéro de téléphone a été préalablement validé. D'autres méthodes plus robustes (telles que les mots de passe à usage unique à durée déterminée) sont également proposées, et que le service informe les utilisateurs des risques de sécurité qu'elles présentent. Pour les applications de niveau 3, le téléphone et les SMS ne doivent pas être disponibles.2V6.6.22Vérifiez que les demandes d’authentification out-of-band, les codes ou les jetons sont liés à la demande d’authentification d’origine pour laquelle ils ont été générés et ne sont pas utilisables pour une demande précédente ou ultérieure.2V6.6.33Vérifiez qu'un mécanisme d'authentification out-of-band basé sur du code est protégé contre les attaques par force brute grâce au "rate limiting". Envisagez également d'utiliser un code avec au moins 64 bits d'entropie.2V6.6.44Vérifiez que, lorsque les notifications push sont utilisées pour l'authentification multifacteur, le "rate limiting" est appliqué afin d'empêcher les attaques de type « push bombing ». La concordance des numéros peut également atténuer ce risque.3V6.77Mécanisme d'authentification cryptographiqueV6.7.11Vérifiez que les certificats utilisés pour vérifier les assertions d’authentification cryptographique sont stockés de manière à les protéger contre toute modification.3V6.7.22Vérifiez que le nonce de défi a une longueur d'au moins 64 bits et qu'il est statistiquement unique ou unique sur toute la durée de vie du périphérique cryptographique.3V6.88Authentification avec un fournisseur d'identitéV6.8.11Vérifiez que, si l'application prend en charge plusieurs fournisseurs d'identité (IdP), l'identité de l'utilisateur ne peut pas être usurpée via un autre fournisseur d'identité pris en charge (par exemple, en utilisant le même identifiant utilisateur). La mesure standard consisterait à ce que l'application enregistre et identifie l'utilisateur à l'aide d'une combinaison de l'ID du fournisseur d'identité (servant d'espace de noms) et de l'ID de l'utilisateur dans le fournisseur d'identité.2V6.8.22Vérifiez que la présence et l'intégrité des signatures numériques sur les assertions d'authentification (par exemple sur les assertions JWT ou SAML) sont toujours validées, en rejetant toutes les assertions non signées ou ayant des signatures non valides.2V6.8.33Vérifiez que les assertions SAML sont traitées de manière unique et utilisées une seule fois au cours de la période de validité pour éviter les attaques par rejeu.2V6.8.44Si une application utilise un fournisseur d'identité (IdP) distinct et attend une force, des méthodes ou une date d'authentification spécifiques pour des fonctions spécifiques, vérifiez que l'application les vérifie à l'aide des informations renvoyées par l'IdP. Par exemple, si OIDC est utilisé, cela peut être réalisé en validant les affirmations de jeton d'identification telles que « acr », « amr » et « auth_time » (le cas échéant). Si l'IdP ne fournit pas ces informations, l'application doit disposer d'une approche de secours documentée qui suppose que le mécanisme d'authentification de force minimale a été utilisé (par exemple, une authentification à facteur unique avec nom d'utilisateur et mot de passe).2V77SessionGestion des sessionsV7.11Documentation sur la gestion des sessionsV7.1.11Vérifiez que le délai d'inactivité de la session de l'utilisateur et la durée de vie maximale absolue de la session sont documentés, sont appropriés en combinaison avec d'autres contrôles et que la documentation inclut une justification de tout écart par rapport aux exigences de réauthentification NIST SP 800-63B.2V7.1.22Vérifiez que la documentation définit le nombre de sessions simultanées (parallèles) autorisées pour un compte ainsi que les comportements et actions prévus à entreprendre lorsque le nombre maximal de sessions actives est atteint.2V7.1.33Vérifiez que tous les systèmes qui créent et gèrent des sessions utilisateur dans le cadre d'un écosystème de gestion des identités fédérées (tels que les systèmes SSO) sont documentés avec des contrôles pour coordonner la durée de vie des sessions, la résiliation et toute autre condition nécessitant une réauthentification.2V7.22Sécurité fondamentale de la gestion des sessionsV7.2.11Vérifiez que l’application effectue toutes les vérifications des jetons de session à l’aide d’un service backend de confiance.1V7.2.22Vérifiez que l'application utilise des jetons autonomes ou de référence générés dynamiquement pour la gestion des sessions, c'est-à-dire sans utiliser de secrets et de clés d'API statiques.1V7.2.33Vérifiez que si des jetons par référence sont utilisés pour représenter les sessions utilisateur, ils sont uniques et générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et possèdent au moins 128 bits d'entropie.1V7.2.44Vérifiez que l’application génère un nouveau jeton de session lors de l’authentification de l’utilisateur, y compris la réauthentification, et met fin au jeton de session actuel.1V7.33Délai d'expiration de la sessionV7.3.11Vérifiez qu’il existe un délai d’inactivité tel que la réauthentification soit appliquée conformément à l’analyse des risques et aux décisions de sécurité documentées.2V7.3.22Vérifiez qu'il existe une durée de vie maximale absolue de la session de sorte que la réauthentification soit appliquée conformément à l'analyse des risques et aux décisions de sécurité documentées.2V7.44Fin de sessionV7.4.11Vérifiez que lorsque la fin de session est déclenchée (par exemple, déconnexion ou expiration), l'application interdit toute utilisation ultérieure de la session. Pour les jetons par référence ou les sessions avec état, cela implique l'invalidation des données de session au niveau du backend de l'application. Les applications utilisant des jetons autonomes nécessiteront une solution, comme la gestion d'une liste des jetons terminés, l'interdiction des jetons produits avant une date et une heure spécifique à chaque utilisateur ou la rotation d'une clé de signature spécifique à chaque utilisateur.1V7.4.22Vérifiez que l'application met fin à toutes les sessions actives lorsqu'un compte utilisateur est désactivé ou supprimé (par exemple, lorsqu'un employé quitte l'entreprise).1V7.4.33Vérifiez que l'application offre la possibilité de mettre fin à toutes les autres sessions actives après une modification ou une suppression réussie de tout facteur d'authentification (y compris la modification du mot de passe via une réinitialisation ou une récupération et, le cas échéant, une mise à jour des paramètres MFA).2V7.4.44Vérifiez que toutes les pages nécessitant une authentification disposent d’un accès facile et visible à la fonctionnalité de déconnexion.2V7.4.55Vérifiez que les administrateurs d’applications sont en mesure de mettre fin aux sessions actives pour un utilisateur individuel ou pour tous les utilisateurs.2V7.55Défenses contre les abus de sessionV7.5.11Vérifiez que l'application nécessite une réauthentification complète avant d'autoriser les modifications des attributs de compte sensibles qui peuvent affecter l'authentification, tels que l'adresse e-mail, le numéro de téléphone, la configuration MFA ou d'autres informations utilisées dans la récupération de compte.2V7.5.22Vérifiez que les utilisateurs peuvent afficher et (après s'être authentifiés à nouveau avec au moins un facteur) terminer une ou toutes les sessions actuellement actives.2V7.5.33Vérifiez que l’application nécessite une authentification supplémentaire avec au moins un facteur ou une vérification secondaire avant d’effectuer des transactions ou des opérations hautement sensibles.3V7.66Réauthentification fédéréeV7.6.11Vérifiez que la durée de vie et la fin de la session entre les parties de confiance (RP) et les fournisseurs d'identité (IdP) se comportent comme documenté, en exigeant une réauthentification si nécessaire, par exemple lorsque le temps maximal entre les événements d'authentification IdP est atteint.2V7.6.22Vérifiez que la création d'une session nécessite soit le consentement de l'utilisateur, soit une action explicite, empêchant ainsi la création de nouvelles sessions d'application sans interaction de l'utilisateur.2V88AuthorizationAutorisationV8.11Documentation d'autorisationV8.1.11Vérifiez que la documentation d’autorisation définit des règles de restriction de l’accès au niveau de la fonction et aux données en fonction des autorisations du consommateur et des attributs des ressources.1V8.1.22Vérifiez que la documentation d'autorisation définit les règles de restriction d'accès au niveau des champs (lecture et écriture) en fonction des autorisations des consommateurs et des attributs des ressources. Notez que ces règles peuvent dépendre d'autres valeurs d'attributs de l'objet de données concerné, telles que l'état ou le statut.2V8.1.33Vérifiez que la documentation de l'application définit les attributs environnementaux et contextuels (y compris, mais sans s'y limiter, l'heure de la journée, l'emplacement de l'utilisateur, l'adresse IP ou l'appareil) qui sont utilisés dans l'application pour prendre des décisions de sécurité, y compris celles relatives à l'authentification et à l'autorisation.3V8.1.44Vérifier que la documentation d'authentification et d'autorisation définit l'utilisation des facteurs environnementaux et contextuels dans la prise de décision, en plus des autorisations au niveau des fonctions, des données et des champs. Cela doit inclure les attributs évalués, les seuils de risque et les actions entreprises (par exemple, autorisation, contestation, refus, renforcement de l'authentification).3V8.22Conception d'autorisation généraleV8.2.11Vérifiez que l’application garantit que l’accès basé sur la fonction est limité aux consommateurs disposant d’autorisations explicites.1V8.2.22Vérifiez que l'application garantit que l'accès spécifique aux données est limité aux consommateurs disposant d'autorisations explicites sur des éléments de données spécifiques afin d'atténuer les références d'objet directes non sécurisées (IDOR) et les autorisations de niveau d'objet rompues (BOLA).1V8.2.33Vérifiez que l'application garantit que l'accès au niveau du champ est limité aux consommateurs disposant d'autorisations explicites sur des champs spécifiques afin d'atténuer les problèmes d'autorisation au niveau de la propriété d'objet (BOPLA).2V8.2.44Vérifiez que les contrôles de sécurité adaptatifs basés sur les attributs environnementaux et contextuels du consommateur (tels que l'heure, la localisation, l'adresse IP ou l'appareil) sont mis en œuvre pour les décisions d'authentification et d'autorisation, comme défini dans la documentation de l'application. Ces contrôles doivent être appliqués lorsque le consommateur tente de démarrer une nouvelle session et également pendant une session existante.3V8.33Autorisation par opérationV8.3.11Vérifier que l'application applique les règles d'autorisations au niveau de la couche service de confiance et ne s’appuie pas sur des contrôles qu’un consommateur non approuvé pourrait manipuler, comme JavaScript côté client.1V8.3.22Vérifiez que les modifications apportées aux valeurs sur lesquelles reposent les décisions d'autorisation sont appliquées immédiatement. Lorsque les modifications ne peuvent pas être appliquées immédiatement (par exemple, en s'appuyant sur des données de jetons autonomes), des contrôles d'atténuation doivent être mis en place pour alerter un consommateur lorsqu'il effectue une action alors qu'il n'est plus autorisé à le faire et annuler la modification. Notez que cette solution alternative ne limiterait pas les fuites d'informations.3V8.3.33Vérifiez que l'accès à un objet repose sur les autorisations du sujet d'origine (par exemple, le consommateur), et non sur celles d'un intermédiaire ou d'un service agissant en son nom. Par exemple, si un consommateur appelle un service web à l'aide d'un jeton d'authentification autonome, et que ce service demande ensuite des données à un autre service, ce dernier utilisera le jeton du consommateur, plutôt qu'un jeton inter-machine du premier service, pour prendre les décisions d'autorisation.3V8.44Autres considérations relatives à l'autorisationV8.4.11Vérifiez que les applications multi-tenants utilisent des contrôles inter-tenants pour garantir que les opérations des consommateurs n'affecteront jamais les tenants avec lesquels ils ne sont pas autorisés à interagir.2V8.4.22Vérifiez que l'accès aux interfaces administratives intègre plusieurs couches de sécurité, notamment la vérification continue de l'identité du consommateur, l'évaluation de la posture de sécurité des appareils et l'analyse contextuelle des risques, garantissant que l'emplacement du réseau ou les endpoints approuvés ne sont pas les seuls facteurs d'autorisation, même s'ils peuvent réduire la probabilité d'accès non autorisé.3V99SelfJetons autonomesV9.11Source et intégrité du jetonV9.1.11Vérifiez que les jetons autonomes sont validés à l'aide de leur signature numérique ou MAC pour les protéger contre toute falsification avant d'accepter le contenu du jeton.1V9.1.22Vérifiez que seuls les algorithmes d'une liste d’autorisations peuvent être utilisés pour créer et vérifier des jetons autonomes, dans un contexte donné. La liste d'autorisation doit inclure les algorithmes autorisés, idéalement symétriques ou asymétriques, et ne doit pas inclure l'algorithme « Aucun ». Si les algorithmes symétriques et asymétriques doivent être pris en charge, des contrôles supplémentaires seront nécessaires pour éviter toute confusion de clés.1V9.1.33Vérifiez que les clés utilisées pour valider les jetons autonomes proviennent de sources préconfigurées et fiables pour l'émetteur du jeton, empêchant ainsi les attaquants de spécifier des sources et des clés non fiables. Pour les JWT et autres structures JWS, les en-têtes tels que « jku », « x5u » et « jwk » doivent être validés par rapport à une liste d'autorisation de sources fiables.1V9.22Contenu du jetonV9.2.11Vérifiez que, si une période de validité est indiquée dans les données du jeton, celui-ci et son contenu ne sont acceptés que si la date de vérification est comprise dans cette période. Par exemple, pour les JWT, les déclarations « nbf » et « exp » doivent être vérifiées.1V9.2.22Vérifiez que le service recevant un jeton valide le type de jeton et son utilisation avant d'en accepter le contenu. Par exemple, seuls les jetons d'accès peuvent être acceptés pour les décisions d'autorisation, et seuls les jetons d'identification peuvent être utilisés pour prouver l'authentification des utilisateurs.2V9.2.33Vérifiez que le service accepte uniquement les jetons destinés à être utilisés avec ce service (audience). Pour les JWT, cela peut être réalisé en validant la déclaration « aud » par rapport à une liste d'autorisation définie dans le service.2V9.2.44Si un émetteur de jetons utilise la même clé privée pour émettre des jetons destinés à différentes audiences, vérifiez que les jetons émis contiennent une restriction d'audience identifiant de manière unique les audiences visées. Cela empêchera la réutilisation d'un jeton avec une audience non prévue. Si l'identifiant d'audience est provisionné dynamiquement, l'émetteur de jetons doit valider ces audiences afin de garantir qu'elles n'entraînent pas d'usurpation d'identité.2V1010OAuthOauth et OIDCV10.11Sécurité générique OAuth et OIDCV10.1.11Vérifiez que les jetons sont envoyés uniquement aux composants qui en ont absolument besoin. Par exemple, lors de l'utilisation d'un modèle backend-for-frontend pour les applications JavaScript basées sur un navigateur, les jetons d'accès et d'actualisation ne doivent être accessibles qu'au backend.2V10.1.22Vérifiez que le client n'accepte les valeurs du serveur d'autorisation (telles que le code d'autorisation ou le jeton d'identification) que si elles résultent d'un flux d'autorisation initié par la même session d'agent utilisateur et la même transaction. Cela nécessite que les secrets générés par le client, tels que la clé de preuve pour l'échange de codes (PKCE) « code_verifier », « state » ou le nonce OIDC, ne puissent être devinés, soient spécifiques à la transaction et soient liés de manière sécurisée au client et à la session d'agent utilisateur au cours de laquelle la transaction a été initiée.2V10.22Client OAuthV10.2.11Vérifiez que, si le flux de code est utilisé, le client OAuth dispose d'une protection contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF), qui déclenchent des demandes de jetons, soit en utilisant la fonctionnalité de clé de preuve pour l'échange de code (PKCE), soit en vérifiant le paramètre « state » envoyé dans la demande d'autorisation.2V10.2.22Vérifiez que, si le client OAuth peut interagir avec plusieurs serveurs d'autorisation, il dispose d'une protection contre les attaques par confusion. Par exemple, il peut exiger que le serveur d'autorisation renvoie la valeur du paramètre « iss » et la valide dans la réponse d'autorisation et la réponse du jeton.2V10.2.33Vérifiez que le client OAuth demande uniquement les portées requises (ou d’autres paramètres d’autorisation) dans les requêtes adressées au serveur d’autorisation.3V10.33Serveur de ressources OAuthV10.3.11Vérifiez que le serveur de ressources accepte uniquement les jetons d'accès destinés à être utilisés avec ce service (audience). L'audience peut être incluse dans un jeton d'accès structuré (comme la déclaration « aud » dans JWT) ou vérifiée à l'aide du endpoint d'introspection de jeton.2V10.3.22Vérifiez que le serveur de ressources applique les décisions d'autorisation en fonction des déclarations du jeton d'accès définissant l'autorisation déléguée. Si des déclarations telles que « sub », « scope » et « authorization_details » sont présentes, elles doivent être prises en compte dans la décision.2V10.3.33Vérifiez que si une décision de contrôle d'accès nécessite l'identification d'un utilisateur unique à partir d'un jeton d'accès (JWT ou réponse d'introspection de jeton associé), le serveur de ressources identifie l'utilisateur à partir de déclarations non ré attribuables à d'autres utilisateurs. En général, cela implique l'utilisation d'une combinaison de déclarations « iss » et « sub ».2V10.3.44Si le serveur de ressources requiert une force d'authentification, des méthodes ou une date d'expiration spécifiques, vérifiez que le jeton d'accès présenté respecte ces contraintes. Par exemple, s'il est présent, utilisez les déclarations OIDC « acr », « amr » et « auth_time » respectivement.2V10.3.55Vérifiez que le serveur de ressources empêche l'utilisation de jetons d'accès volés ou la relecture de jetons d'accès (de parties non autorisées) en exigeant des jetons d'accès limités par l'expéditeur, soit Mutual TLS pour OAuth 2, soit OAuth 2 Demonstration of Proof of Possession (DPoP).3V10.44Serveur d'autorisation OAuthV10.4.11Vérifiez que le serveur d'autorisation valide les URI de redirection en fonction d'une liste d'autorisation spécifique au client d'URI préenregistrés à l'aide d'une comparaison de chaînes exacte.1V10.4.22Vérifiez que, si le serveur d'autorisation renvoie le code d'autorisation dans la réponse, celui-ci ne peut être utilisé qu'une seule fois pour une demande de jeton. Pour la deuxième demande valide avec un code d'autorisation déjà utilisé pour émettre un jeton d'accès, le serveur d'autorisation doit rejeter la demande de jeton et révoquer tous les jetons émis liés au code d'autorisation.1V10.4.33Vérifiez que le code d'autorisation est de courte durée. La durée de vie maximale peut atteindre 10 minutes pour les applications L1 et L2 et 1 minute pour les applications L3.1V10.4.44Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement l'utilisation des autorisations nécessaires à ce client. Notez que les autorisations « token » (flux implicite) et « password » (flux d'informations d'identification du propriétaire de la ressource) ne doivent plus être utilisées.1V10.4.55Vérifiez que le serveur d'autorisation atténue les attaques par rejeu de jetons d'actualisation pour les clients publics, de préférence en utilisant des jetons d'actualisation limités par l'expéditeur, par exemple des jetons DPoP (Demonstrating Proof of Possession) ou des jetons d'accès liés à un certificat utilisant le protocole TLS mutuel (mTLS). Pour les applications L1 et L2, la rotation des jetons d'actualisation peut être utilisée. Si cette rotation est utilisée, le serveur d'autorisation doit invalider le jeton d'actualisation après utilisation et révoquer tous les jetons d'actualisation de cette autorisation si un jeton d'actualisation déjà utilisé et invalidé est fourni.1V10.4.66Vérifiez que, si l'octroi de code est utilisé, le serveur d'autorisation atténue les attaques par interception de code en exigeant une clé de preuve pour l'échange de code (PKCE). Pour les demandes d'autorisation, le serveur d'autorisation doit exiger une valeur « code_challenge » valide et ne doit pas accepter une valeur « plain » pour « code_challenge_method ». Pour une demande de jeton, il doit exiger la validation du paramètre « code_verifier ».2V10.4.77Vérifiez que si le serveur d'autorisation prend en charge l'enregistrement dynamique des clients non authentifiés, il réduit le risque d'applications clientes malveillantes. Il doit valider les métadonnées clientes, telles que les URI enregistrés, garantir le consentement de l'utilisateur et l'avertir avant de traiter une demande d'autorisation avec une application cliente non approuvée.2V10.4.88Vérifiez que les jetons d’actualisation ont une expiration absolue, y compris si l’expiration du jeton d’actualisation glissant est appliquée.2V10.4.99Vérifiez que les jetons d'actualisation et les jetons d'accès de référence peuvent être révoqués par un utilisateur autorisé à l'aide de l'interface utilisateur du serveur d'autorisation, afin d'atténuer le risque de clients malveillants ou de jetons volés.2V10.4.1010Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.2V10.4.1111Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton.2V10.4.1212Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement la valeur « response_mode » dont ce client a besoin. Par exemple, en vérifiant cette valeur par rapport aux valeurs attendues ou en utilisant une requête d'autorisation poussée (PAR) ou une requête d'autorisation sécurisée par JWT (JAR).3V10.4.1313Vérifiez que le type d'Autorisation « code » est toujours utilisé avec les demandes d'autorisation poussées (PAR).3V10.4.1414Vérifiez que le serveur d'autorisation émet uniquement des jetons d'accès limités à l'expéditeur (preuve de possession), soit avec des jetons d'accès liés au certificat utilisant TLS mutuel (mTLS), soit avec des jetons d'accès liés au DPoP (démonstration de preuve de possession).3V10.4.1515Vérifiez que, pour un client côté serveur (non exécuté sur l'appareil de l'utilisateur final), le serveur d'autorisation garantit que la valeur du paramètre « authorization_details » provient du backend client et que l'utilisateur ne l'a pas altérée. Par exemple, en exigeant l'utilisation d'une demande d'autorisation poussée (PAR) ou d'une demande d'autorisation sécurisée par JWT (JAR).3V10.4.1616Vérifiez que le client est confidentiel et que le serveur d'autorisation requiert l'utilisation de méthodes d'authentification client fortes (basées sur la cryptographie à clé publique et résistantes aux attaques par relecture), telles que TLS mutuel ('tls_client_auth', 'self_signed_tls_client_auth') ou JWT à clé privée ('private_key_jwt').3V10.55Client OIDCV10.5.11Vérifiez que le client (en tant que partie utilisatrice) atténue les attaques par rejeu de jeton d'identification. Par exemple, en vous assurant que la valeur « nonce » du jeton d'identification correspond à la valeur « nonce » envoyée dans la demande d'authentification au fournisseur OpenID (appelée demande d'autorisation envoyée au serveur d'autorisation dans OAuth2).2V10.5.22Vérifiez que le client identifie de manière unique l'utilisateur à partir des déclarations de jeton d'identification, généralement la déclaration « sub », qui ne peut pas être réaffectée à d'autres utilisateurs (pour la portée d'un fournisseur d'identité).2V10.5.33Vérifiez que le client rejette les tentatives d'un serveur d'autorisation malveillant d'usurper l'identité d'un autre serveur d'autorisation via ses métadonnées. Le client doit rejeter les métadonnées du serveur d'autorisation si l'URL de l'émetteur figurant dans ces métadonnées ne correspond pas exactement à l'URL d'émetteur préconfigurée attendue par le client.2V10.5.44Vérifiez que le client valide que le jeton d'identification est destiné à être utilisé pour ce client (audience) en vérifiant que la déclaration « aud » du jeton est égale à la valeur « client_id » pour le client.2V10.5.55Vérifiez que, lors de l'utilisation de la déconnexion du back-channel OIDC, la partie utilisatrice atténue les risques de déni de service liés à la déconnexion forcée et à la confusion entre JWT dans le flux de déconnexion. Le client doit vérifier que le jeton de déconnexion est correctement typé avec la valeur « logout+jwt », qu'il contient la déclaration « event » avec le nom de membre correct et qu'il ne contient pas de déclaration « nonce ». Il est également recommandé d'utiliser une expiration courte (par exemple, 2 minutes).2V10.66Fournisseur OpenIDV10.6.11Vérifiez que le fournisseur OpenID n'autorise que les valeurs « code », « ciba », « id_token » ou « id_token code » pour le mode de réponse. Notez que « code » est préférable à « id_token code » (flux hybride OIDC) et que « token » (tout flux implicite) ne doit pas être utilisé.2V10.6.22Vérifiez que le fournisseur OpenID atténue les risques de déni de service liés à la déconnexion forcée. Pour ce faire, obtenez une confirmation explicite de l'utilisateur final ou, le cas échéant, validez les paramètres de la requête de déconnexion (initiée par la partie utilisatrice), comme « id_token_hint ».2V10.77Gestion du consentementV10.7.11Vérifiez que le serveur d'autorisation garantit le consentement de l'utilisateur à chaque demande d'autorisation. Si l'identité du client ne peut être garantie, le serveur d'autorisation doit toujours demander explicitement le consentement de l'utilisateur.2V10.7.22Vérifiez que lorsque le serveur d'autorisation demande le consentement de l'utilisateur, il fournit des informations claires et suffisantes sur ce qui est consenti. Le cas échéant, ces informations doivent inclure la nature des autorisations demandées (généralement en fonction de la portée, du serveur de ressources et des détails d'autorisation RAR), l'identité de l'application autorisée et la durée de vie de ces autorisations.2V10.7.33Vérifiez que l’utilisateur peut consulter, modifier et révoquer les consentements qu’il a accordés via le serveur d’autorisation.2V1111CryptographyCryptographieV11.11Inventaire et documentation cryptographiquesV11.1.11Vérifiez qu’il existe une politique documentée pour la gestion des clés cryptographiques et un cycle de vie des clés cryptographiques qui suit une norme de gestion des clés telle que NIST SP 800-57. Cela devrait inclure la garantie que les clés ne sont pas sur-partagées (par exemple, avec plus de deux entités pour les secrets partagés et plus d’une entité pour les clés privées).2V11.1.22Vérifiez qu'un inventaire cryptographique est réalisé, maintenu et régulièrement mis à jour, et qu'il inclut toutes les clés, algorithmes et certificats cryptographiques utilisés par l'application. Il doit également documenter les emplacements du système où les clés peuvent ou non être utilisées, ainsi que les types de données qui peuvent ou non être protégées par ces clés.2V11.1.33Vérifiez que les mécanismes de découverte cryptographique sont utilisés pour identifier toutes les instances de cryptographie dans le système, y compris les opérations de chiffrement, de hachage et de signature.3V11.1.44Vérifier la tenue d'un inventaire cryptographique. Celui-ci doit inclure un plan documenté décrivant la migration vers de nouvelles normes cryptographiques, telles que la cryptographie post-quantique, afin de réagir aux menaces futures.3V11.22Mise en œuvre sécurisée de la cryptographieV11.2.11Vérifiez que les implémentations validées par l’industrie (y compris les bibliothèques et les implémentations accélérées par le matériel) sont utilisées pour les opérations cryptographiques.2V11.2.22Vérifiez que l'application est conçue avec une agilité cryptographique, de sorte que les nombres aléatoires, le chiffrement authentifié, le MAC ou les algorithmes de hachage, les longueurs de clés, les tours, les chiffrements et les modes puissent être reconfigurés, mis à niveau ou échangés à tout moment, afin de se protéger contre les failles cryptographiques. De même, il doit être possible de remplacer les clés et les mots de passe, ainsi que de rechiffrer les données. Cela permettra des mises à niveau transparentes vers la cryptographie post-quantique (PQC), une fois que des implémentations hautement sécurisées de schémas ou de normes PQC approuvés seront largement disponibles.2V11.2.33Vérifiez que toutes les primitives cryptographiques utilisent un minimum de 128 bits de sécurité en fonction de l'algorithme, de la taille de la clé et de la configuration. Par exemple, une clé ECC de 256 bits offre environ 128 bits de sécurité, tandis que RSA nécessite une clé de 3072 bits pour atteindre 128 bits de sécurité.2V11.2.44Vérifiez que toutes les opérations cryptographiques sont à temps constant, sans opérations de « court-circuit » dans les comparaisons, les calculs ou les retours, pour éviter toute fuite d'informations.3V11.2.55Vérifiez que tous les modules cryptographiques échouent en toute sécurité et que les erreurs sont gérées de manière à ne pas permettre de vulnérabilités, telles que les attaques Padding Oracle.3V11.33Algorithmes de chiffrementV11.3.11Vérifiez que les modes de bloc non sécurisés (par exemple, ECB) et les schémas de remplissage faibles (par exemple, PKCS#1 v1.5) ne sont pas utilisés.1V11.3.22Vérifiez que seuls les chiffrements et modes approuvés tels que AES avec GCM sont utilisés.1V11.3.33Vérifiez que les données chiffrées sont protégées contre toute modification non autorisée, de préférence en utilisant une méthode de chiffrement authentifiée approuvée ou en combinant une méthode de chiffrement approuvée avec un algorithme MAC approuvé.2V11.3.44Vérifiez que les nonces, les vecteurs d'initialisation et autres nombres à usage unique ne sont pas utilisés pour plus d'une paire clé de chiffrement/élément de données. La méthode de génération doit être adaptée à l'algorithme utilisé.3V11.3.55Vérifiez que toute combinaison d'un algorithme de chiffrement et d'un algorithme MAC fonctionne en mode chiffrement puis MAC.3V11.44Hachage et fonctions basées sur le hachageV11.4.11Vérifiez que seules les fonctions de hachage approuvées sont utilisées pour les cas d'utilisation cryptographiques généraux, notamment les signatures numériques, HMAC, KDF et la génération de bits aléatoires. Les fonctions de hachage non autorisées, telles que MD5, ne doivent pas être utilisées à des fins cryptographiques.1V11.4.22Vérifiez que les mots de passe sont stockés à l'aide d'une fonction de dérivation de clés approuvée et gourmande en ressources de calcul (également appelée « fonction de hachage de mots de passe »), dont les paramètres sont configurés conformément aux directives en vigueur. Ces paramètres doivent équilibrer sécurité et performances afin de rendre les attaques par force brute suffisamment difficiles pour le niveau de sécurité requis.2V11.4.33Vérifiez que les fonctions de hachage utilisées dans les signatures numériques, dans le cadre de l'authentification ou de l'intégrité des données, sont résistantes aux collisions et possèdent des longueurs de bits appropriées. Si la résistance aux collisions est requise, la longueur de sortie doit être d'au moins 256 bits. Si seule la résistance aux attaques de seconde pré-image est requise, la longueur de sortie doit être d'au moins 128 bits.2V11.4.44Vérifiez que l'application utilise des fonctions de dérivation de clés approuvées avec des paramètres d'extension de clés lors de la dérivation de clés secrètes à partir de mots de passe. Les paramètres utilisés doivent concilier sécurité et performances afin d'empêcher les attaques par force brute de compromettre la clé cryptographique obtenue.2V11.55Valeurs aléatoiresV11.5.11Vérifiez que tous les nombres et chaînes aléatoires destinés à être non devinables doivent être générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et posséder au moins 128 bits d'entropie. Notez que les UUID ne respectent pas cette condition.2V11.5.22Vérifiez que le mécanisme de génération de nombres aléatoires utilisé est conçu pour fonctionner en toute sécurité, même en cas de forte demande.3V11.66Cryptographie à clé publiqueV11.6.11Vérifier que seuls des algorithmes cryptographiques et des modes opératoires approuvés sont utilisés pour la génération et l'amorçage des clés, ainsi que pour la génération et la vérification des signatures numériques. Les algorithmes de génération de clés ne doivent pas générer de clés non sécurisées et vulnérables aux attaques connues, par exemple les clés RSA vulnérables à la factorisation de Fermat.2V11.6.22Vérifiez que des algorithmes cryptographiques approuvés sont utilisés pour l'échange de clés (tels que Diffie-Hellman), en veillant à ce que les mécanismes d'échange de clés utilisent des paramètres sécurisés. Cela permettra d'éviter les attaques contre le processus d'établissement des clés, susceptibles de conduire à des attaques de type « adversaire du milieu » ou à des failles cryptographiques.3V11.77Cryptographie des données en cours d'utilisationV11.7.11Vérifiez que le chiffrement complet de la mémoire est utilisé pour protéger les données sensibles pendant leur utilisation, empêchant ainsi l'accès par des utilisateurs ou des processus non autorisés.3V11.7.22Vérifiez que la minimisation des données garantit que la quantité minimale de données est exposée pendant le traitement et assurez-vous que les données sont chiffrées immédiatement après utilisation ou dès que possible.3V1212SecureCommunication sécuriséeV12.11Conseils généraux de sécurité TLSV12.1.11Vérifiez que seules les dernières versions recommandées du protocole TLS sont activées, telles que TLS 1.2 et TLS 1.3. La dernière version du protocole TLS doit être privilégiée.1V12.1.22Vérifiez que seules les suites de chiffrement recommandées sont activées, les suites de chiffrement les plus puissantes étant définies comme préférées. Les applications L3 doivent uniquement prendre en charge les suites de chiffrement assurant la confidentialité persistante (forward secrecy).2V12.1.33Vérifiez que l’application valide que les certificats clients mTLS sont approuvés avant d’utiliser l’identité du certificat pour l’authentification ou l’autorisation.2V12.1.44Vérifiez que la révocation de certification appropriée, telle que l'agrafage du protocole OCSP (Online Certificate Status Protocol), est activée et configurée.3V12.1.55Vérifiez que Encrypted Client Hello (ECH) est activé dans les paramètres TLS de l'application pour empêcher l'exposition de métadonnées sensibles, telles que l'indication du nom du serveur (SNI), pendant les processus de négociation TLS.3V12.22Communication HTTPS avec des services externesV12.2.11Vérifiez que TLS est utilisé pour toute connectivité entre un client et des services externes basés sur HTTP, et ne recourt pas à des communications non sécurisées ou non chiffrées.1V12.2.22Vérifiez que les services externes utilisent des certificats TLS publiquement approuvés.1V12.33Sécurité des communications entre services générauxV12.3.11Vérifiez qu'un protocole chiffré tel que TLS est utilisé pour toutes les connexions entrantes et sortantes vers et depuis l'application, y compris les systèmes de surveillance, les outils de gestion, l'accès à distance et SSH, les intergiciels, les bases de données, les mainframes, les systèmes partenaires ou les API externes. Le serveur ne doit pas recourir à des protocoles non sécurisés ou non chiffrés.2V12.3.22Vérifiez que les clients TLS valident les certificats reçus avant de communiquer avec un serveur TLS.2V12.3.33Vérifiez que TLS ou un autre mécanisme de chiffrement de transport approprié est utilisé pour toute connectivité entre les services internes basés sur HTTP au sein de l'application et ne se replie pas vers des communications non sécurisées ou non chiffrées.2V12.3.44Vérifiez que les connexions TLS entre les services internes utilisent des certificats de confiance. Lorsque des certificats générés en interne ou auto-signés sont utilisés, le service consommateur doit être configuré pour n'approuver que des autorités de certification internes spécifiques et des certificats auto-signés spécifiques.2V12.3.55Vérifiez que les services communiquant en interne au sein d'un système (communications intra-services) utilisent une authentification forte pour garantir la vérification de chaque endpoint. Des méthodes d'authentification forte, telles que l'authentification client TLS, doivent être utilisées pour garantir l'identité, en utilisant une infrastructure à clé publique et des mécanismes résistants aux attaques par rejeu. Pour les architectures de microservices, envisagez d'utiliser un maillage de services pour simplifier la gestion des certificats et renforcer la sécurité.3V1313ConfigurationConfigurationV13.11Documentation de configurationV13.1.11Vérifiez que tous les besoins de communication de l'application sont documentés. Cela doit inclure les services externes dont l'application dépend et les cas où un utilisateur final pourrait fournir un emplacement externe auquel l'application se connectera.2V13.1.22Vérifiez que pour chaque service utilisé par l'application, la documentation définit le nombre maximal de connexions simultanées (par exemple, les limites du pool de connexions) et le comportement de l'application lorsque cette limite est atteinte, y compris les mécanismes de secours ou de récupération, pour éviter les conditions de déni de service.3V13.1.33Vérifiez que la documentation de l'application définit des stratégies de gestion des ressources pour chaque système ou service externe utilisé (par exemple, bases de données, descripteurs de fichiers, threads, connexions HTTP). Cela doit inclure les procédures de libération des ressources, les paramètres de délai d'expiration, la gestion des échecs et l'implémentation de la logique de nouvelle tentative, en spécifiant les limites de nouvelle tentative, les délais et les algorithmes de retour arrière. Pour les opérations de requête-réponse HTTP synchrones, la documentation doit imposer des délais d'expiration courts et soit désactiver les nouvelles tentatives, soit les limiter strictement afin d'éviter les retards en cascade et l'épuisement des ressources.3V13.1.44Vérifiez que la documentation de l'application définit les secrets essentiels à la sécurité de l'application et un calendrier de rotation de ceux-ci, en fonction du modèle de menace et des exigences commerciales de l'organisation.3V13.22Configuration de la communication backendV13.2.11Vérifiez que les communications entre les composants de l'application backend qui ne prennent pas en charge le mécanisme de session utilisateur standard de l'application, notamment les API, les intergiciels et les couches de données, sont authentifiées. L'authentification doit utiliser des comptes de service individuels, des jetons à court terme ou une authentification par certificat, et non des identifiants immuables tels que des mots de passe, des clés API ou des comptes partagés avec accès privilégié.2V13.2.22Vérifiez que les communications entre les composants de l'application backend, y compris les services locaux ou du système d'exploitation, les API, les intergiciels et les couches de données, sont effectuées avec des comptes dotés des privilèges les moins nécessaires.2V13.2.33Vérifiez que si des informations d’identification doivent être utilisées pour l’authentification du service, les informations d’identification utilisées par le consommateur ne sont pas des informations d’identification par défaut (par exemple, root/root ou admin/admin).2V13.2.44Vérifiez qu'une liste d’autorisations est utilisée pour définir les ressources ou systèmes externes avec lesquels l'application est autorisée à communiquer (par exemple, pour les requêtes sortantes, les chargements de données ou l'accès aux fichiers). Cette liste d'autorisation peut être implémentée au niveau de la couche applicative, du serveur web, du pare-feu ou d'une combinaison de différentes couches.2V13.2.55Vérifiez que le serveur Web ou d’application est configuré avec une liste autorisée de ressources ou de systèmes vers lesquels le serveur peut envoyer des requêtes ou charger des données ou des fichiers.2V13.2.66Vérifiez que lorsque l'application se connecte à des services distincts, elle suit la configuration documentée pour chaque connexion, comme le nombre maximal de connexions parallèles, le comportement lorsque le nombre maximal de connexions autorisées est atteint, les délais d'expiration de connexion et les stratégies de nouvelle tentative.3V13.33Gestion des secretsV13.3.11Vérifiez qu'une solution de gestion des secrets, telle qu'un coffre-fort de clés, est utilisée pour créer, stocker, contrôler l'accès et détruire en toute sécurité les secrets backend. Ceux-ci peuvent inclure des mots de passe, du matériel de clé, des intégrations avec des bases de données et des systèmes tiers, des clés et des graines pour des jetons temporels, d'autres secrets internes et des clés API. Les secrets ne doivent pas être inclus dans le code source de l'application ni dans les artefacts de build. Pour une application L3, cela doit impliquer une solution matérielle telle qu'un HSM.2V13.3.22Vérifiez que l’accès aux ressources secrètes respecte le principe du moindre privilège.2V13.3.33Vérifiez que toutes les opérations cryptographiques sont effectuées à l'aide d'un module de sécurité isolé (tel qu'un coffre-fort ou un module de sécurité matériel) pour gérer et protéger en toute sécurité le matériel clé contre toute exposition en dehors du module de sécurité.3V13.3.44Vérifiez que les secrets sont configurés pour expirer et être renouvelés en fonction de la documentation de l'application.3V13.44Fuite d'informations involontaireV13.4.11Vérifiez que l'application est déployée soit sans aucune métadonnée de contrôle de source, y compris les dossiers .git ou .svn, soit de manière à ce que ces dossiers soient inaccessibles à la fois en externe et à l'application elle-même.1V13.4.22Vérifiez que les modes de débogage sont désactivés pour tous les composants dans les environnements de production afin d’éviter l’exposition des fonctionnalités de débogage et la fuite d’informations.2V13.4.33Vérifiez que les serveurs Web n’exposent pas les listes de répertoires aux clients, sauf si cela est explicitement prévu.2V13.4.44Vérifiez que l’utilisation de la méthode HTTP TRACE n’est pas prise en charge dans les environnements de production, afin d’éviter toute fuite d’informations potentielle.2V13.4.55Vérifiez que la documentation (comme pour les API internes) et les endpoints de surveillance ne sont pas exposés, sauf si cela est explicitement prévu.2V13.4.66Vérifiez que l’application n’expose pas d’informations de version détaillées des composants backend.3V13.4.77Vérifiez que la couche web est configuré pour servir uniquement les fichiers avec des extensions de fichier spécifiques afin d’éviter toute fuite involontaire d’informations, de configuration et de code source.3V1414DataProtection des donnéesV14.11Documentation sur la protection des donnéesV14.1.11Vérifiez que toutes les données sensibles créées et traitées par l'application ont été identifiées et classées selon leur niveau de protection. Cela inclut les données uniquement codées et donc facilement déchiffrables, telles que les chaînes Base64 ou la charge utile en texte clair d'un JWT. Les niveaux de protection doivent tenir compte des réglementations et normes de protection des données et de confidentialité auxquelles l'application est tenue de se conformer.2V14.1.22Vérifier que tous les niveaux de protection des données sensibles sont assortis d'un ensemble documenté d'exigences de protection. Cela doit inclure (sans s'y limiter) les exigences relatives au chiffrement général, à la vérification de l'intégrité, à la conservation, à la journalisation des données, aux contrôles d'accès aux données sensibles dans les journaux, au chiffrement au niveau de la base de données, aux technologies de confidentialité et de renforcement de la confidentialité à utiliser, ainsi qu'aux autres exigences de confidentialité.2V14.22Protection générale des donnéesV14.2.11Vérifiez que les données sensibles sont uniquement envoyées au serveur dans les champs de corps ou d’en-tête du message HTTP, et que l’URL et la chaîne de requête ne contiennent pas d’informations sensibles, telles qu’une clé API ou un jeton de session.1V14.2.22Vérifiez que l’application empêche la mise en cache des données sensibles dans les composants du serveur, tels que les équilibreurs de charge et les caches d’application, ou garantit que les données sont purgées en toute sécurité après utilisation.2V14.2.33Vérifiez que les données sensibles définies ne sont pas envoyées à des parties non fiables (par exemple, des trackers d'utilisateurs) pour empêcher la collecte indésirable de données en dehors du contrôle de l'application.2V14.2.44Vérifiez que les contrôles autour des données sensibles liés au chiffrement, à la vérification de l'intégrité, à la conservation, à la manière dont les données doivent être enregistrées, aux contrôles d'accès autour des données sensibles dans les journaux, à la confidentialité et aux technologies d'amélioration de la confidentialité, sont mis en œuvre comme défini dans la documentation pour le niveau de protection des données spécifiques.2V14.2.55Vérifiez que les mécanismes de mise en cache sont configurés pour ne mettre en cache que les réponses dont le type de contenu est conforme à la ressource et qui ne contiennent pas de contenu sensible et dynamique. Le serveur web doit renvoyer une réponse 404 ou 302 lors de l'accès à un fichier inexistant plutôt qu'un fichier valide différent. Cela devrait empêcher les attaques par empoisonnement de cache web.3V14.2.66Vérifiez que l'application ne renvoie que les données sensibles minimales requises pour son fonctionnement. Par exemple, ne renvoyez que certains chiffres d'un numéro de carte de crédit, et non le numéro complet. Si les données complètes sont requises, elles doivent être masquées dans l'interface utilisateur, sauf si l'utilisateur les consulte spécifiquement.3V14.2.77Vérifiez que les informations sensibles sont soumises à une classification de conservation des données, en veillant à ce que les données obsolètes ou inutiles soient supprimées automatiquement, selon un calendrier défini ou selon les besoins de la situation.3V14.2.88Vérifiez que les informations sensibles sont supprimées des métadonnées des fichiers soumis par l'utilisateur, sauf si le stockage est autorisé par l'utilisateur.3V14.33Protection des données côté clientV14.3.11Vérifiez que les données authentifiées sont effacées du stockage client, comme le DOM du navigateur, après la fin du client ou de la session. Le champ d'en-tête de réponse HTTP « Clear-Site-Data » peut être utile, mais le côté client devrait également pouvoir effectuer la correction si la connexion au serveur n'est pas disponible à la fin de la session.1V14.3.22Vérifiez que l'application définit suffisamment de champs d'en-tête de réponse HTTP anti-caching (c'est-à-dire Cache-Control : no-store) afin que les données sensibles ne soient pas mises en cache dans les navigateurs.2V14.3.33Vérifiez que les données stockées dans le stockage du navigateur (telles que localStorage, sessionStorage, IndexedDB ou les cookies) ne contiennent pas de données sensibles, à l'exception des jetons de session.2V1515SecureDéveloppement et architecture sécurisésV15.11Documentation sur le développement et l'architecture sécurisésV15.1.11Vérifiez que la documentation de l'application définit les délais de correction basés sur les risques pour les versions de composants tiers présentant des vulnérabilités et pour la mise à jour des bibliothèques en général, afin de minimiser les risques liés à ces composants.1V15.1.22Vérifiez qu'un catalogue d'inventaire, tel qu'une nomenclature logicielle (SBOM), est conservé pour toutes les bibliothèques tierces utilisées, y compris en vérifiant que les composants proviennent de référentiels prédéfinis, fiables et continuellement maintenus.2V15.1.33Vérifiez que la documentation de l'application identifie les fonctionnalités consommatrices en temps ou gourmandes en ressources. Elle doit notamment indiquer comment prévenir une perte de disponibilité due à une utilisation excessive de ces fonctionnalités et éviter que la génération d'une réponse ne prenne plus de temps que le délai d'expiration du consommateur. Les mesures de protection potentielles peuvent inclure le traitement asynchrone, l'utilisation de files d'attente et la limitation des processus parallèles par utilisateur et par application.2V15.1.44Vérifiez que la documentation de l’application met en évidence les bibliothèques tierces qui sont considérées comme des « composants à risque ».3V15.1.55Vérifiez que la documentation de l’application met en évidence les parties de l’application où des « fonctionnalités dangereuses » sont utilisées.3V15.22Architecture de sécurité et dépendancesV15.2.11Vérifiez que l’application contient uniquement des composants qui n’ont pas dépassé les délais de mise à jour et de correction documentés.1V15.2.22Vérifiez que l'application a mis en œuvre des défenses contre la perte de disponibilité due à des fonctionnalités qui prennent du temps ou qui nécessitent des ressources, sur la base des décisions et stratégies de sécurité documentées à cet effet.2V15.2.33Vérifiez que l'environnement de production inclut uniquement les fonctionnalités nécessaires au fonctionnement de l'application et n'expose pas de fonctionnalités superflues telles que du code de test, des exemples d'extraits et des fonctionnalités de développement.2V15.2.44Vérifiez que les composants tiers et toutes leurs dépendances transitives sont inclus à partir du référentiel attendu, qu'il soit détenu en interne ou qu'il s'agisse d'une source externe, et qu'il n'y a aucun risque d'attaque par confusion de dépendances.3V15.2.55Vérifiez que l'application implémente des protections supplémentaires autour des parties documentées comme contenant des « fonctionnalités dangereuses » ou utilisant des bibliothèques tierces considérées comme des « composants à risque ». Cela peut inclure des techniques telles que le sandboxing, l'encapsulation, la conteneurisation ou l'isolation au niveau du réseau pour retarder et dissuader les attaquants qui compromettent une partie de l'application de se propager ailleurs.3V15.33Développement défensifV15.3.11Vérifiez que l'application ne renvoie que le sous-ensemble requis de champs d'un objet de données. Par exemple, elle ne doit pas renvoyer un objet de données entier, car certains champs individuels ne doivent pas être accessibles aux utilisateurs.1V15.3.22Vérifiez que lorsque le backend de l'application effectue des appels vers des URL externes, il est configuré pour ne pas suivre les redirections, sauf s'il s'agit d'une fonctionnalité prévue.2V15.3.33Vérifiez que l'application dispose de contre-mesures pour se protéger contre les attaques d'affectation de masse en limitant les champs autorisés par contrôleur et action, par exemple, il n'est pas possible d'insérer ou de mettre à jour une valeur de champ lorsqu'elle n'était pas destinée à faire partie de cette action.2V15.3.44Vérifiez que tous les composants proxy et middleware transfèrent correctement l'adresse IP d'origine de l'utilisateur à l'aide de champs de données fiables qui ne peuvent pas être manipulés par l'utilisateur final, et que l'application et le serveur Web utilisent cette valeur correcte pour la journalisation et les décisions de sécurité telles que la limitation du débit, en tenant compte du fait que même l'adresse IP d'origine peut ne pas être fiable en raison d'adresses IP dynamiques, de VPN ou de pare-feu d'entreprise.2V15.3.55Vérifiez que l'application garantit explicitement que les variables sont du type correct et effectue des opérations d'égalité et de comparaison strictes. Cela permet d'éviter les vulnérabilités liées à la confusion de types, causées par des hypothèses du code de l'application sur le type d'une variable.2V15.3.66Vérifiez que le code JavaScript est écrit de manière à éviter la pollution du prototype, par exemple en utilisant Set() ou Map() au lieu de littéraux d'objet.2V15.3.77Vérifiez que l'application dispose de défenses contre les attaques de pollution des paramètres HTTP, en particulier si le Framework d'application ne fait aucune distinction quant à la source des paramètres de requête (chaîne de requête, paramètres de corps, cookies ou champs d'en-tête).2V15.44Concurrence sécuriséeV15.4.11Vérifiez que les objets partagés dans le code multithread (tels que les caches, les fichiers ou les objets en mémoire accessibles par plusieurs threads) sont accessibles en toute sécurité à l'aide de types thread-safe et de mécanismes de synchronisation tels que des verrous ou des sémaphores pour éviter les conditions de concurrence et la corruption des données.3V15.4.22Vérifiez que les vérifications de l'état d'une ressource, comme son existence ou ses autorisations, et des actions qui en dépendent, sont effectuées en une seule opération atomique afin d'éviter les situations de concurrence entre le moment de la vérification et le moment de l'utilisation (TOCTOU). Par exemple, vérifier l'existence d'un fichier avant de l'ouvrir ou l'accès d'un utilisateur avant de l'accorder.3V15.4.33Vérifiez que les verrous sont utilisés de manière cohérente pour éviter que les threads ne se bloquent, que ce soit en s'attendant les uns les autres ou en réessayant sans fin, et que la logique de verrouillage reste dans le code responsable de la gestion de la ressource pour garantir que les verrous ne peuvent pas être modifiés par inadvertance ou de manière malveillante par des classes ou du code externes.3V15.4.44Vérifiez que les politiques d'allocation des ressources empêchent la saturation de threads en garantissant un accès équitable aux ressources, par exemple en exploitant les pools de threads, permettant aux threads de priorité inférieure de continuer dans un délai raisonnable.3V1616SecurityJournalisation de sécurité et gestion des erreursV16.11Documentation sur la journalisation de sécuritéV16.1.11Vérifiez qu'il existe un inventaire documentant la journalisation effectuée à chaque couche de la pile technologique de l'application, les événements enregistrés, les formats de journal, l'endroit où cette journalisation est stockée, la manière dont elle est utilisée, la manière dont l'accès à celle-ci est contrôlé et la durée de conservation des journaux.2V16.22Journalisation généraleV16.2.11Vérifiez que chaque entrée de journal inclut les métadonnées nécessaires (telles que quand, où, qui, quoi) qui permettraient une enquête détaillée sur la chronologie lorsqu'un événement se produit.2V16.2.22Vérifiez que les sources de temps de tous les composants de journalisation sont synchronisées et que les horodatages des métadonnées des événements de sécurité utilisent le temps UTC ou incluent un décalage horaire explicite. L'UTC est recommandé pour garantir la cohérence entre les systèmes distribués et éviter toute confusion lors du passage à l'heure d'été.2V16.2.33Vérifiez que l’application stocke ou diffuse uniquement les journaux vers les fichiers et services documentés dans l’inventaire des journaux.2V16.2.44Vérifiez que les journaux peuvent être lus et corrélés par le processeur de journaux utilisé, de préférence en utilisant un format de journalisation commun.2V16.2.55Vérifiez que l'application applique la journalisation en fonction du niveau de protection des données lors de la journalisation de données sensibles. Par exemple, certaines données, comme les identifiants ou les informations de paiement, peuvent être interdites. D'autres données, comme les jetons de session, ne peuvent être enregistrées que par hachage ou masquage, en totalité ou en partie.2V16.33Événements de sécuritéV16.3.11Vérifiez que toutes les opérations d'authentification sont enregistrées, y compris les tentatives réussies et infructueuses. Des métadonnées supplémentaires, telles que le type d'authentification ou les facteurs utilisés, doivent également être collectées.2V16.3.22Vérifier que les tentatives d'autorisation infructueuses sont logguées. Pour le niveau 3, cela doit inclure la journalisation de toutes les décisions d'autorisation, y compris lors de l'accès à des données sensibles (sans journalisation des données sensibles elles-mêmes).2V16.3.33Vérifiez que l'application enregistre les événements de sécurité définis dans la documentation et enregistre également les tentatives de contournement des contrôles de sécurité, tels que la validation des entrées, la logique métier et l'anti-automatisation.2V16.3.44Vérifiez que l’application enregistre les erreurs inattendues et les échecs de contrôle de sécurité tels que les échecs TLS du backend.2V16.44Protection des journauxV16.4.11Vérifiez que tous les composants de journalisation codent correctement les données pour empêcher l’injection de journaux.2V16.4.22Vérifiez que les journaux sont protégés contre tout accès non autorisé et ne peuvent pas être modifiés.2V16.4.33Vérifiez que les journaux sont transmis de manière sécurisée à un système logique distinct pour analyse, détection, alerte et remontée des informations. L'objectif est de garantir qu'en cas de violation de l'application, les journaux ne seront pas compromis.2V16.55Gestion des erreursV16.5.11Vérifiez qu'un message générique est renvoyé au consommateur lorsqu'une erreur inattendue ou sensible à la sécurité se produit, garantissant ainsi l'absence d'exposition de données système internes sensibles telles que les traces de pile, les requêtes, les clés secrètes et les jetons.2V16.5.22Vérifiez que l'application continue de fonctionner en toute sécurité lorsque l'accès aux ressources externes échoue, par exemple, en utilisant des modèles tels que des disjoncteurs ou une dégradation progressive.2V16.5.33Vérifiez que l'application échoue proprement et sécurisée, y compris lorsqu'une exception se produit, en évitant les accès en cas d'erreur telles que le traitement d'une transaction malgré les erreurs résultant de la logique de validation.2V16.5.44Vérifiez qu'un gestionnaire d'erreurs de « dernier recours » est défini pour intercepter toutes les exceptions non gérées. Cela permet d'éviter la perte des informations d'erreur qui doivent être loguées dans les fichiers journaux et de garantir qu'une erreur ne paralyse pas l'ensemble du processus applicatif, entraînant une perte de disponibilité.3V1717WebRTCWebRTCV17.11Serveur TURNV17.1.11Vérifiez que le service TURN (Traversal Using Relays around NAT) autorise uniquement l'accès aux adresses IP non réservées à des fins spécifiques (par exemple, réseaux internes, diffusion, bouclage). Notez que cela s'applique aux adresses IPv4 et IPv6.2V17.1.22Vérifiez que le service Traversal Using Relays around NAT (TURN) n'est pas susceptible d'épuiser ses ressources lorsque des utilisateurs légitimes tentent d'ouvrir un grand nombre de ports sur le serveur TURN.3V17.22MédiaV17.2.11Vérifiez que la clé du certificat Datagram Transport Layer Security (DTLS) est gérée et protégée conformément à la politique documentée de gestion des clés cryptographiques.2V17.2.22Vérifiez que le serveur multimédia est configuré pour utiliser et prendre en charge les suites de chiffrement DTLS (Datagram Transport Layer Security) approuvées et un profil de protection sécurisé pour l'extension DTLS pour l'établissement de clés pour le protocole de transport en temps réel sécurisé (DTLS-SRTP).2V17.2.33Vérifiez que l'authentification SRTP (Secure Real-time Transport Protocol) est vérifiée sur le serveur multimédia pour empêcher les attaques par injection RTP (Real-time Transport Protocol) d'entraîner une condition de déni de service ou l'insertion de médias audio ou vidéo dans les flux multimédias.2V17.2.44Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant lorsqu'il rencontre des paquets SRTP (Secure Real-time Transport Protocol) mal formés.2V17.2.55Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.3V17.2.66Vérifiez que le serveur multimédia n'est pas sensible à la vulnérabilité de condition de concurrence « ClientHello » dans Datagram Transport Layer Security (DTLS) en vérifiant si le serveur multimédia est publiquement connu comme étant vulnérable ou en effectuant le test de condition de concurrence.3V17.2.77Vérifiez que tous les mécanismes d'enregistrement audio ou vidéo associés au serveur multimédia sont en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes.3V17.2.88Vérifiez que le certificat Datagram Transport Layer Security (DTLS) est vérifié par rapport à l'attribut d'empreinte cryptographique du protocole de description de session (SDP), en mettant fin au flux multimédia si la vérification échoue, pour garantir l'authenticité du flux multimédia.3V17.33SignalisationV17.3.11Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation entrants légitimes lors d'une attaque par saturation. Cela peut être réalisé en implémentant une limitation de débit au niveau de la signalisation.2V17.3.22Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation légitimes en cas de message mal formé susceptible de provoquer un déni de service. Cela peut inclure la validation des entrées, la gestion sécurisée des dépassements d'entiers, la prévention des dépassements de tampon et l'utilisation d'autres techniques robustes de gestion des erreurs.2 diff --git a/5.0/docs_fr/fr b/5.0/docs_fr/fr new file mode 100644 index 0000000000..e69de29bb2 diff --git a/5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.cdx.json b/5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.cdx.json new file mode 100644 index 0000000000..603dda2b42 --- /dev/null +++ b/5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.cdx.json @@ -0,0 +1,3057 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.6", + "serialNumber": "urn:uuid:e008700f-ece0-4f72-9ba7-0d15833c741b", + "version": 1, + "metadata": { + "timestamp": "2025-11-10T08:19:53+00:00", + "licenses": [ + { + "license": { + "id": "CC-BY-SA-4.0", + "url": "https://creativecommons.org/licenses/by-sa/4.0/legalcode.txt" + } + } + ], + "supplier": { + "name": "OWASP Foundation", + "url": [ + "https://owasp.org" + ] + } + }, + "declarations": { + "standards": [ + { + "bom-ref": "ASVS-5.0.0", + "name": "Application Security Verification Standard (ASVS)", + "version": "5.0.0", + "description": "The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.", + "owner": "Application Security Verification Standard Project", + "requirements": [ + { + "bom-ref": "V1", + "identifier": "V1", + "title": "인코딩과 데이터 정제" + }, + { + "bom-ref": "V1.1", + "identifier": "V1.1", + "title": "인코딩 및 데이터 정제 아키텍처", + "parent": "V1" + }, + { + "bom-ref": "V1.1.1", + "identifier": "V1.1.1", + "text": "입력값 검증은 오직 한 번만 표준 형태로 디코딩 되거나 언이스케이프 되어야 하며, 인코딩된 데이터가 예상될 때만 디코딩 되어야 한다. 이 과정은 입력이 추가로 처리되기 전에 완료되어야 한다. 예를 들어서 입력값 검증이나 데이터 정제 이후에는 수행되면 안 된다.", + "parent": "V1.1" + }, + { + "bom-ref": "V1.1.2", + "identifier": "V1.1.2", + "text": "애플리케이션이 출력값 인코딩 또는 이스케이핑을 인터프리터가 사용하기 전의 최종 단계로 수행하거나 인터프리터 자체에서 처리하는지 검증해야 한다.", + "parent": "V1.1" + }, + { + "bom-ref": "V1.2", + "identifier": "V1.2", + "title": "인젝션(Injection) 방지", + "parent": "V1" + }, + { + "bom-ref": "V1.2.1", + "identifier": "V1.2.1", + "text": "HTTP 응답, HTML 문서 또는 XML 문서에 대한 출력값 인코딩이 해당 컨텍스트에 적절한지 검증해야 한다. 예를 들어, 메시지나 문서 구조가 변경되지 않도록 HTML 요소, HTML 속성, HTML 주석, CSS, HTTP 헤더 필드 등에 맞는 문맥별 문자 인코딩이 수행되어야 한다.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.2", + "identifier": "V1.2.2", + "text": "통합 자원 식별자(Uniform Resource Locator; URL)들을 동적으로 생성할 때 신뢰할 수 없는 데이터가 해당 컨텍스트에 맞게 인코딩되었는지 검증해야 한다(예: 쿼리나 경로 파라미터에 대한 URL 인코딩 또는 base64url 인코딩). 또한, 오직 안전한 URL 프로토콜만이 허용되는지 검증해야 한다(예: javascript: 또는 data:를 허용하지 않음).", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.3", + "identifier": "V1.2.3", + "text": "동적으로 자바스크립트 콘텐츠(JSON 포함)를 생성할 때 메시지나 문서 구조를 바꾸는 것을 방지하기 위해 출력값 인코딩이나 이스케이핑이 사용되고 있는지 검증해야 한다(자바스크립트 또는 JSON 인젝션을 피하기 위함).", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.4", + "identifier": "V1.2.4", + "text": "데이터 선택 혹은 데이터베이스 쿼리(예: SQL, HQL, NoSQL, Cypher)들 파라미터화된 쿼리, 객체 관계 매핑(Object Relational Mapping; ORM), 엔티티 프레임워크, 또는 다른 구조화된 쿼리 언어(Structured Query Language; SQL) 인젝션 및 기타 데이터베이스 인젝션 공격으로부터 보호해 주는 것들을 사용하는지 검증해야 한다. 이는 저장 프로시저를 쓸 때도 마찬가지이다.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.5", + "identifier": "V1.2.5", + "text": "애플리케이션이 운영체제(Operating System; OS) 명령 인젝션으로부터 보호되며 운영체제 호출 시 파라미터화된 OS 쿼리나 상황에 맞는 명령줄 출력값 인코딩을 사용하는지 검증해야 한다.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.6", + "identifier": "V1.2.6", + "text": "애플리케이션이 경량 디렉터리 접근 프로토콜(Lightweight Directory Access Protocol; LDAP) 인젝션 취약점에 대해 보호되어 있는지, 또는 LDAP 인젝션을 방지하기 위한 특정 보안 통제가 구현되어 있는지 검증해야 한다.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.7", + "identifier": "V1.2.7", + "text": "애플리케이션이 XPath 인젝션 공격을 쿼리 파라미터나 미리 컴파일된 쿼리들을 사용해 보호되고 있는지 검증해야 한다.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.8", + "identifier": "V1.2.8", + "text": "LaTeX 프로세서가 안전하게 구성되어 있으며(\"--shell-escape\" 플래그 비사용 등) LaTeX 인젝션 공격을 방지하기 위해 허용된 명령어 목록이 사용되고 있는지 검증해야 한다.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.9", + "identifier": "V1.2.9", + "text": "애플리케이션이 정규 표현식에서 특수 문자들을 메타 문자로 잘못 해석하는 것을 방지하기 위해 해당 문자들 이스케이프(보통 백슬래시를 사용)하고 있는지 검증해야 한다.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.10", + "identifier": "V1.2.10", + "text": "애플리케이션이 쉼표 구분 데이터(Comma Separated Values; CSV) 및 수식 인젝션에 대해 보호되어 있는지 검증해야 한다. 그리고 애플리케이션은 CSV 콘텐츠를 내보낼 때 RFC 4180 2.6과 2.7 부분에 명시된 이스케이핑 규칙을 반드시 따라야 한다. 또한 CSV나 다른 스프레드시트 포맷(XLS, XLSX, ODF 등)으로 내보낼 때 필드 값의 첫 번째가 특수 문자('=', '+', '-', '@', '\\t' (탭), '\\0' (null 문자) 포함)라면 반드시 작은따옴표로 이스케이프되어야 한다.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.3", + "identifier": "V1.3", + "title": "데이터 정제", + "parent": "V1" + }, + { + "bom-ref": "V1.3.1", + "identifier": "V1.3.1", + "text": "위지윅(WYSIWYG) 에디터나 이와 유사한 것으로부터 오는 모든 신뢰할 수 없는 HTML 입력들은 잘 알려지고 안전한 HTML 데이터 정제 라이브러리나 프레임워크 기능을 사용해 정제되는지 검증해야 한다.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.2", + "identifier": "V1.3.2", + "text": "애플리케이션이 eval() 또는 스프링 표현 언어(Spring Expression Language; SpEL) 등과 같은 동적 코드 실행 기능 사용을 피하고 있는지 검증해야 한다. 대안이 없는 경우, 실행 전에 포함되는 모든 사용자 입력이 반드시 정제되어야 한다.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.3", + "identifier": "V1.3.3", + "text": "잠재적으로 위험한 컨텍스트에 전달되는 데이터가 사전에 정제되어 안전 조치가 적용되는지 검증해야 한다. 예를 들어 해당 컨텍스트에서 안전한 문자만 허용하고 너무 긴 입력값은 잘라내는 등의 조치가 포함된다.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.4", + "identifier": "V1.3.4", + "text": "사용자로부터 제공된 확장 가능한 벡터 그래픽(Scalable Vector Graphics; SVG)의 스크립트 실행 가능 콘텐츠가 애플리케이션에 안전한 태그 및 속성(예: 그래픽 그리기)만 포함하도록 검증 또는 정제되는지 검증해야 한다. 예를 들어 스크립트나 foreignObject는 포함되면 안 된다.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.5", + "identifier": "V1.3.5", + "text": "애플리케이션이 사용자로부터 제공된 스크립트 실행 가능하거나 표현식 템플릿 언어(예: 마크다운, CSS, XSL 스타일시트, BBCode ) 콘텐츠를 정제하거나 비활성화하는지 검증해야 한다.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.6", + "identifier": "V1.3.6", + "text": "애플리케이션이 서버측 요청 위조(Server-side Request Forgery; SSRF) 공격으로부터 보호하기 위해 신뢰할 수 없는 데이터를 프로토콜, 도메인, 경로, 포트의 허용 목록과 대조해 검증하고 다른 서비스를 호출하기 전에 잠재적으로 위험한 문자를 정제(sanitization)하는지 검증해야 한다.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.7", + "identifier": "V1.3.7", + "text": "애플리케이션이 템플릿 인젝션 공격으로부터 보호하기 위해 신뢰할 수 없는 입력값을 기반으로 템플릿을 생성하지 않도록 하는지 검증해야 한다. 대안이 없는 경우에는 템플릿 생성 과정에서 동적으로 포함되는 모든 신뢰할 수 없는 입력값은 정제되거나 엄격히 검증되어야 한다.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.8", + "identifier": "V1.3.8", + "text": "애플리케이션이 자바 명명 및 디렉터리 인터페이스(Java Naming and Directory Interface; JNDI) 쿼리에서 신뢰할 수 없는 입력값을 사용하기 전에 적절히 정제하고 JNDI가 JNDI 인젝션 공격을 방지할 수 있도록 안전하게 구성되어 있는지 검증해야 한다.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.9", + "identifier": "V1.3.9", + "text": "인젝션을 방지하기 위해 애플리케이션이 메모리 캐시(memcache)에 콘텐츠를 전달하기 전에 해당 데이터를 정제하는지 검증해야 한다. ", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.10", + "identifier": "V1.3.10", + "text": "사용 시 예상치 못하거나 악의적인 방식으로 작동할 수 있는 포맷 스트링(format string)들은 처리되기 전에 정제되는지 검증해야 한다.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.11", + "identifier": "V1.3.11", + "text": "간이 전자 우편 전송 프로토콜(Simple Mail Transfer Protocol; SMTP)이나 인터넷 메시지 액세스 프로토콜(Internet Message Access Protocol; IMAP) 인젝션으로부터 보호하기 위해 애플리케이션이 사용자 입력을 메일 시스템으로 보내기 전에 정제를 하는지 검증해야 한다.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.12", + "identifier": "V1.3.12", + "text": "정규 표현식에 지수형 백트래킹을 유발하는 요소가 없는지, 또한 신뢰할 수 없는 입력값을 정제하여 정규식 기반 서비스 거부 공격(Regular Expression Denial of Service; ReDoS) 또는 런어웨이(Runaway) 정규식 공격을 방지하는지 검증해야 한다.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.4", + "identifier": "V1.4", + "title": "메모리, 스트링, 비관리 코드", + "parent": "V1" + }, + { + "bom-ref": "V1.4.1", + "identifier": "V1.4.1", + "text": "애플리케이션이 스택, 버퍼, 또는 힙 오버플로를 탐지하거나 방지하기 위해 메모리 안전 문자열, 안전한 메모리 복사 및 포인터 산술을 사용하는지 검증해야 한다.", + "parent": "V1.4" + }, + { + "bom-ref": "V1.4.2", + "identifier": "V1.4.2", + "text": "정수 오버플로를 방지하기 위해 부호 확인, 범위 검사, 입력값 검증 등의 기법이 사용되고 있는지 검증해야 한다.", + "parent": "V1.4" + }, + { + "bom-ref": "V1.4.3", + "identifier": "V1.4.3", + "text": "댕글링 포인터(dangling pointer)나 해체 후 사용(Use After Free; UAF) 취약점을 방지하기 위해 동적으로 할당된 메모리와 자원이 적절히 해제되었는지 그리고 해제된 메모리를 참조하는 포인터나 참조가 제거되었거나 null로 설정되었는지를 검증해야 한다.", + "parent": "V1.4" + }, + { + "bom-ref": "V1.5", + "identifier": "V1.5", + "title": "안전한 역직렬화", + "parent": "V1" + }, + { + "bom-ref": "V1.5.1", + "identifier": "V1.5.1", + "text": "애플리케이션이 확장 가능한 마크업 언어(eXtensible Markup Language; XML) 파서(parser)를 제한적인 설정으로 구성하고 외부 엔티티 해석과 같은 안전하지 않은 기능을 비활성화하여 XML 외부 엔티티(XML eXternal Entity; XXE) 공격을 방지하는지 검증해야 한다.", + "parent": "V1.5" + }, + { + "bom-ref": "V1.5.2", + "identifier": "V1.5.2", + "text": "역직렬화 공격을 방지하기 위해 신뢰할 수 없는 데이터의 역직렬화 시 객체 타입 허용 목록 사용 또는 클라이언트 정의 객체 타입 제한과 같은 안전한 입력 처리 방식이 적용되는지 검증해야 한다. 또한 명확히 안전하지 않은 것으로 지정된 역직렬화 메커니즘은 신뢰할 수 없는 입력에 대해 반드시 사용해서는 안 된다.", + "parent": "V1.5" + }, + { + "bom-ref": "V1.5.3", + "identifier": "V1.5.3", + "text": "애플리케이션에서 동일한 데이터 타입(예: JSON 파서, XML 파서, URL 파서)에 대해 사용되는 서로 다른 파서들이 일관된 방식으로 파싱(parsing)을 수행하고 동일한 문자 인코딩 방식을 사용하는지 검증해야 한다. 이를 통해 JSON 상호운용 취약점이나 원격 파일 포함(Remote File Inclusion; RFI) 및 SSRF 공격에서 악용될 수 있는 서로 다른 URI 또는 파일 파싱 동작 문제를 방지할 수 있다.", + "parent": "V1.5" + }, + { + "bom-ref": "V2", + "identifier": "V2", + "title": "유효성 검증 및 비즈니스 로직" + }, + { + "bom-ref": "V2.1", + "identifier": "V2.1", + "title": "유효성 검증 및 비즈니스 로직 문서화", + "parent": "V2" + }, + { + "bom-ref": "V2.1.1", + "identifier": "V2.1.1", + "text": "애플리케이션 문서에 데이터 항목이 예상되는 구조에 부합하는지 확인하는 입력값 유효성 검증 규칙이 정의되어 있는지 확인한다. 이는 신용카드 번호, 이메일 주소, 전화번호와 같은 일반적인 데이터 형식일 수도 있고, 내부적으로 사용하는 데이터 형식일 수도 있다.", + "parent": "V2.1" + }, + { + "bom-ref": "V2.1.2", + "identifier": "V2.1.2", + "text": "애플리케이션 문서에 연관된 데이터 항목들 간의 논리적, 문맥적 일관성을 검증하는 방법이 정의되어 있는지 검증한다. 예를 들어서 세부 주소와 우편번호가 서로 일치하는지 확인하는 경우가 이에 해당한다.", + "parent": "V2.1" + }, + { + "bom-ref": "V2.1.3", + "identifier": "V2.1.3", + "text": "비즈니스 로직의 제한사항 및 유효성 검증에 대한 요구사항이 사용자별 기준과 애플리케이션 전체에 적용되는 전역적 기준을 모두 포함하여 문서화되어 있는지 검증한다.", + "parent": "V2.1" + }, + { + "bom-ref": "V2.2", + "identifier": "V2.2", + "title": "입력값 검증", + "parent": "V2" + }, + { + "bom-ref": "V2.2.1", + "identifier": "V2.2.1", + "text": "입력값에 대한 비즈니스 또는 기능적인 기대치를 충족하기 위해서 입력값의 유효성을 검증해야 한다. 이는 허용 값, 패턴 및 범위 목록에 대한 긍정적 검증을 사용하거나, 미리 정의된 규칙에 따라 입력값을 예상 구조 및 논리적 한계와 비교하여 검증해야 한다. L1의 경우, 특정 비즈니스 또는 보안 결정을 내리는 데 초점을 맞출 수 있다. L2 이상의 경우에는 모든 입력값에 적용해야 한다.", + "parent": "V2.2" + }, + { + "bom-ref": "V2.2.2", + "identifier": "V2.2.2", + "text": "애플리케이션이 신뢰할 수 있는 서비스 계층에서 입력값 유효성 검사를 시행하도록 설계되었는지 확인해야 한다. 클라이언트 측 유효성 검사는 사용성을 향상시키므로 권장해야 하지만, 보안 제어 수단으로 의존해서는 안된다.", + "parent": "V2.2" + }, + { + "bom-ref": "V2.2.3", + "identifier": "V2.2.3", + "text": "사전 정의된 규칙에 따라 관련 데이터 항목의 조합이 합리적인지 애플리케이션에서 확인해야 한다.", + "parent": "V2.2" + }, + { + "bom-ref": "V2.3", + "identifier": "V2.3", + "title": "비즈니스 로직 보안", + "parent": "V2" + }, + { + "bom-ref": "V2.3.1", + "identifier": "V2.3.1", + "text": "애플리케이션이 예상되는 순차적 단계 순서에 따라 동일한 사용자에 대한 비즈니스 로직 흐름만 처리하고 단계를 건너뛰지 않는지 확인한다.", + "parent": "V2.3" + }, + { + "bom-ref": "V2.3.2", + "identifier": "V2.3.2", + "text": "비즈니스 로직 결함이 악용되는 것을 방지하기 위해서 애플리케이션 문서에 따라 비즈니스 로직 제한이 구현되었는지 확인한다.", + "parent": "V2.3" + }, + { + "bom-ref": "V2.3.3", + "identifier": "V2.3.3", + "text": "비즈니스 로직 수준에서 트랜잭션이 사용되고 있는지 확인하여 비즈니스 로직 작업이 완전히 성공하거나 이전의 올바른 상태로 롤백되는지 확인한다.", + "parent": "V2.3" + }, + { + "bom-ref": "V2.3.4", + "identifier": "V2.3.4", + "text": "제한된 양의 리소스(ex. 극장 좌석이나 배송 시간대)가 애플리케이션의 로직을 조작하여 이중으로 예약되는 것을 방지하기 위해서 비즈니스 로직 수준 잠금 메커니즘이 사용되는지 확인한다.", + "parent": "V2.3" + }, + { + "bom-ref": "V2.3.5", + "identifier": "V2.3.5", + "text": "핵심적인 비즈니스 로직 흐름에 무단 또는 우발적인 행위를 방지하기 위해서 다중 사용자 승인이 필요한지 확인해야 한다. 이는 거액 자금 이체, 계약 승인, 기밀 정보 접근, 제조 과정의 안전 무시 등이 포함될 수 있지만, 이에 국한되지는 않는다.", + "parent": "V2.3" + }, + { + "bom-ref": "V2.4", + "identifier": "V2.4", + "title": "자동화 방지", + "parent": "V2" + }, + { + "bom-ref": "V2.4.1", + "identifier": "V2.4.1", + "text": "데이터 유출, 더미 데이터 생성, 할당량 소진, 속도 제한 위반, 서비스 거부(DoS), 핵심적인 리소스의 과다 사용으로 이어질 수 있는 애플리케이션 기능에 대한 과도한 호출을 방어하기 위해, 자동화 방지 제어 기능이 구현되어 있는지 검증한다.", + "parent": "V2.4" + }, + { + "bom-ref": "V2.4.2", + "identifier": "V2.4.2", + "text": "비즈니스 로직의 각 단계가 실제 사람이 수행하는 데 필요한 현실적인 시간을 요구하여, 비정상적으로 빠른 속도의 트랜잭션 제출을 방지하는지 검증한다.", + "parent": "V2.4" + }, + { + "bom-ref": "V3", + "identifier": "V3", + "title": "웹 프론트엔드 보안" + }, + { + "bom-ref": "V3.1", + "identifier": "V3.1", + "title": "웹 프론트엔드 보안 문서", + "parent": "V3" + }, + { + "bom-ref": "V3.1.1", + "identifier": "V3.1.1", + "text": "애플리케이션 공식 문서에서 애플리케이션이 반드시 지원해야 하는, 예상되는 보안 특징들을 서술하고 있는지 확인한다. (예: HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP), 그리고 다른 관련된 HTTP 보안 메커니즘들). 또한 문서에서 앞선 특징들(유저에게나 경고하거나 접속을 막는 등의)이 유효하지 않을 때 애플리케이션이 어떻게 행동하는지 반드시 정의해야 한다.", + "parent": "V3.1" + }, + { + "bom-ref": "V3.2", + "identifier": "V3.2", + "title": "의도하지 않은 콘텐츠 접근", + "parent": "V3" + }, + { + "bom-ref": "V3.2.1", + "identifier": "V3.2.1", + "text": "브라우저가 HTTP 응답에 대해 콘텐츠나 기능을 불러올 때, 의도하지 않은 상황이 보안적으로 통제되고 있는지 확인한다(예: API, 유저가 올린 파일, 혹은 다른 리소스에 직접 접근 시). Content-Security-Policy 헤더 필드의 샌드박스 지시어를 사용하거나, Content-Disposition 헤더 필드 내의 attachment disposition 타입을 사용하는 등으로, 불필요한 HTTP 요청 헤더 필드 (Sec-Fetch-* 와 같은)를 제공하지 않을 수 있다.", + "parent": "V3.2" + }, + { + "bom-ref": "V3.2.2", + "identifier": "V3.2.2", + "text": "콘텐츠가 HTML로 렌더링되지 않고 텍스트로 표시되도록 하여, HTML이나 JavaScript 등의 의도하지 않은 실행을 방지하는 안전한 렌더링 함수(예: createTextNode, textContent)를 사용하는지 확인한다.", + "parent": "V3.2" + }, + { + "bom-ref": "V3.2.3", + "identifier": "V3.2.3", + "text": "애플리케이션이 클라이언트 사이드 JavaScript를 사용할 때, 명시적 변수 사용, 엄격한 타입 검사, 문서에서의 전역 변수 저장 지양, 그리고 네임스페이스 격리 구현 등으로 DOM 클로버링을 막고 있음을 확인한다.", + "parent": "V3.2" + }, + { + "bom-ref": "V3.3", + "identifier": "V3.3", + "title": "쿠키 설정", + "parent": "V3" + }, + { + "bom-ref": "V3.3.1", + "identifier": "V3.3.1", + "text": "쿠키가 'Secure' 속성을 가지며, 쿠키 이름에 '\\__Host-' 접두사가 사용되지 않았고, '__Secure-' 접두사를 사용했는지 확인한다.", + "parent": "V3.3" + }, + { + "bom-ref": "V3.3.2", + "identifier": "V3.3.2", + "text": "UI redress 공격, 그리고 CSRF라 알려진 브라우저 기반 요청 위조 공격들에 대한 노출을 제한하기 위해 각 쿠키의 'SameSite' 속성 값이 쿠키의 목적에 맞게 설정되어 있는지 확인한다.", + "parent": "V3.3" + }, + { + "bom-ref": "V3.3.3", + "identifier": "V3.3.3", + "text": "다른 호스트들과 명시적으로 공유되는 쿠키에 대해서, '__Host-' 접두사를 가지고 있는지 확인한다.", + "parent": "V3.3" + }, + { + "bom-ref": "V3.3.4", + "identifier": "V3.3.4", + "text": "클라이언트 측 스크립트에서 쿠키의 값에 접근이 가능한 걸 의도하지 않았다면(세션 토큰 등), 쿠키는 반드시 'HttpOnly' 속성을 가져야 하고, 반드시 'Set-Cookie' 헤더 필드를 통해 클라이언트에게 전달돼야 한다.", + "parent": "V3.3" + }, + { + "bom-ref": "V3.3.5", + "identifier": "V3.3.5", + "text": "애플리케이션이 쿠키를 만들 때, 쿠키 이름과 값의 길이 합이 4096바이트를 넘지 않는지 확인한다. 너무 큰 쿠키는 브라우저에 저장되지 않으며, 요청 전달도 안되고, 해당 쿠키에 의존하는 애플리케이션 기능을 사용하지 못하게 된다.", + "parent": "V3.3" + }, + { + "bom-ref": "V3.4", + "identifier": "V3.4", + "title": "브라우저 보안 메커니즘 헤더", + "parent": "V3" + }, + { + "bom-ref": "V3.4.1", + "identifier": "V3.4.1", + "text": "이 섹션에서는 애플리케이션의 응답을 처리할 때 브라우저의 보안 기능과, 제한 사항을 활성화하기 위해 HTTP 응답에 설정해야 하는 보안 헤더를 설명한다.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.2", + "identifier": "V3.4.2", + "text": "교차 출처 리소스 공유(CORS)의 Access-Control-Allow-Origin 헤더 필드가 애플리케이션의 고정 값인지 확인한다. 만약 출처 Origin HTTP 요청 헤더 필드 값을 사용하고 있다면, 신뢰할 수 있는 출처 목록으로 검증한다. 'Access-Control-Allow-Origin: *' 사용이 필요할 때엔, 응답이 민감한 정보를 포함하지 않는지 확인한다.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.3", + "identifier": "V3.4.3", + "text": "HTTP 응답이 Content-Security-Policy 응답 헤더 필드를 가지고 있는지 확인한다. 이는 브라우저가 신뢰하는 콘텐츠나 리소스만 불러오고 실행하도록 하고, 위험한 JavaScript의 실행을 제한한다. 최소한, object-src 'none' 과 base-uri 'none'이라는 지침, 그리고 허용 목록을 정의하거나 논스, 해쉬의 사용을 포함한다는 전역 정책은 반드시 사용돼야 한다. 3계층 애플리케이션의 경우에는, 논스나 해쉬가 적용된 응답별 정책이 반드시 정의돼야 한다.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.4", + "identifier": "V3.4.4", + "text": "모든 HTTP 응답이 'X-Content-Type-Options: nosniff' 헤더 필드를 포함하는지 확인해야 한다. 이는 브라우저들이 주어진 응답에 대해 콘텐츠 스니핑과 MIME 타입 추측을 하지 않도록, 응답의 Content-Type 헤더 필드 값을 목적지 리소스와 일치하도록 지시한다. 예를 들어서, 응답의 Content-Type이 'text/css'인 스타일만 허용된다고 치자. 이는 기능적으로 브라우저의 Cross-Origin Read Blocking (CORB) 사용 또한 활성화시킨다.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.5", + "identifier": "V3.4.5", + "text": "'Referer' HTTP 요청 헤더 필드를 통해 제 3자 서비스들에 기술적으로 민감한 정보 누출을 막기 위해, 애플리케이션에서 리퍼러 정책을 설정했는지 확인해야 한다. 이는 Referrer-Policy HTTP 응답 헤더 필드나 HTML 속성 항목을 통해 설정할 수 있다. 민감한 데이터는 URL에 있는 경로나 쿼리 데이터, 그리고 내부 비공개 애플리케이션의 경우 hostname도 포함된다.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.6", + "identifier": "V3.4.6", + "text": "웹 애플리케이션이 Content-Security-Policy 헤더 필드의 frame-ancestors를 사용해 모든 HTTP 응답들에 대해 기본적으로 내부 삽입을 할 수 없고, 필요할 때만 특정 리소스에 대해 내부 삽입을 허용하도록 확인한다. X-Frame-Options 헤더 필드가 브라우저에서 지원되더라도, 오래돼서 신뢰할 수 없음을 알아야 한다.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.7", + "identifier": "V3.4.7", + "text": "Content-Security-Policy 헤더 필드에 위반 사항을 보고할 영역이 특정되어 있는지 확인해야 한다.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.8", + "identifier": "V3.4.8", + "text": "문서 렌더링을 시작하는 모든 HTTP 요청(Content-Type text/html과 같은 응답)에 same-origin 지시어나 same-origin-allow-popups이 있는 Cross‑Origin‑Opener‑Policy 헤더 필드를 포함하는지 확인해야 한다. 이는 탭내빙(tabnabbing) 및 프레임 카운팅과 같은 Window 객체에 대한 공유 액세스를 악용하는 공격을 방지할 수 있다.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.5", + "identifier": "V3.5", + "title": "브라우저 출처 구분", + "parent": "V3" + }, + { + "bom-ref": "V3.5.1", + "identifier": "V3.5.1", + "text": "애플리케이션이 허용되지 않은 교차 출처 요청을 통한 민감한 기능의 사용을 막기 위해 CORS preflight 메커니즘에 의존하지 않는지 확인하고, 이런 요청이 애플리케이션 자체에서 시작된건지 증명해야 한다. 이는 anti-forgery 토큰의 사용과 증명이나 CORS-safelisted 요청 헤더 필드가 아닌 확장 HTTP 헤더 필드를 요구하는 것으로 가능하다. 사이트 간 요청 위조 공격(CSRF)으로 알려진 브라우저 기반의 요청 위조 공격에 대한 방어다.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.2", + "identifier": "V3.5.2", + "text": "애플리케이션이 민감한 기능의 허용되지 않은 교차 출처 사용을 막기 위해 CORS preflight 메커니즘에 의존하고 있다면, CORS preflight 요청을 작동하지 않는 요청을 호출할 수 있는지 확인해야 한다. 이는 'Origin'과 'Content-Type' 요청 헤더 필드 값을 확인하거나 CORS-safelisted 헤더 필드가 아닌 확장 필드 사용에 대한 확인이 필요하다.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.3", + "identifier": "V3.5.3", + "text": "민감한 기능이 HTTP 요청으로 POST, PUT, PATCH, DELETE와 같은 적절한 HTTP 방식을 사용하는지, HEAD, OPTIONS, 또는 GET처럼 HTTP 사양이 \"안전\"으로 정의되지 않는 방식을 사용하는지 확인한다. 또는 Sec-Fetch-* 요청 헤더 필드의 엄격한 검증을 사용하여 요청이 부적절한 교차 출처 호출, 탐색 요청 또는 이미지 소스와 같은 리소스 로드에서 발생하지 않았는지 확인할 수 있다.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.4", + "identifier": "V3.5.4", + "text": "서로 다른 호스트 이름에 별도의 애플리케이션이 호스팅되어 있는지 확인하여 동일한 출처 정책에서 제공하는 제한 사항을 활용한다. 여기에는 한 출처에서 불러온 문서나 스크립트가 다른 출처의 리소스와 상호 작용할 수 있는 방법과 쿠키에서의 호스트 이름 기반 제한 사항이 포함된다.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.5", + "identifier": "V3.5.5", + "text": "postMessage 인터페이스를 통해 수신한 메시지의 출처를 신뢰할 수 없거나, 구문이 유효하지 않은 경우, 수신한 메시지가 폐기되는지 확인한다.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.6", + "identifier": "V3.5.6", + "text": "Cross-Site Script Inclusion (XSSI) 공격을 피하기 위해, 애플리케이션 아무 곳에서나 JSONP 기능이 활성화되지 않는지 확인한다.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.7", + "identifier": "V3.5.7", + "text": "Cross-Site Script Inclusion (XSSI) 공격을 방지하기 위해 JavaScript 파일과 같은 스크립트 리소스 응답에 승인이 필요한 데이터가 포함되지 않았는지 확인한다.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.8", + "identifier": "V3.5.8", + "text": "인증된 리소스(예: 이미지, 비디오, 스크립트 및 기타 문서)가 의도된 경우에만 사용자를 대신하여 불러와지거나 내장될 수 있는지 확인한다. 이는 Sec-Fetch-* HTTP 요청 헤더 필드를 엄격하게 검증하여 요청이 부적절한 교차 출처 호출에서 발생하지 않았는지 확인하거나 브라우저에 반환된 콘텐츠를 차단하도록 지시하는 제한적인 교차 출처 리소스 정책 HTTP 응답 헤더 필드를 설정하여 달성할 수 있다.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.6", + "identifier": "V3.6", + "title": "외부 리소스 무결성", + "parent": "V3" + }, + { + "bom-ref": "V3.6.1", + "identifier": "V3.6.1", + "text": "클라이언트 측 자산(예: JavaScript 라이브러리, CSS 또는 웹 폰트)이 정적이고 버전이 지정된 경우에만 외부(예: 콘텐츠 전송 네트워크)로만 호스팅되는지 확인하고, 하위 리소스 무결성(SRI)을 사용하여 자산의 무결성을 검증한다. 이것이 불가능하다면 각 리소스에 대해 이를 정당화하기 위해 문서화된 보안 결정이 필요하다.", + "parent": "V3.6" + }, + { + "bom-ref": "V3.7", + "identifier": "V3.7", + "title": "다른 브라우저 보안 고려사항", + "parent": "V3" + }, + { + "bom-ref": "V3.7.1", + "identifier": "V3.7.1", + "text": "애플리케이션이 여전히 지원되고 안전하다고 간주되는 클라이언트 측 기술만 사용하는지 확인한다. 이 요구 사항을 충족하지 않는 기술의 예로는 NSAPI 플러그인, Flash, Shockwave, ActiveX, Silverlight, NACL 또는 클라이언트 측 Java applets가 있다.", + "parent": "V3.7" + }, + { + "bom-ref": "V3.7.2", + "identifier": "V3.7.2", + "text": "애플리케이션이 사용자를 통제하지 못하는 다른 호스트 이름이나 도메인으로 자동으로 리다이렉션할 때, 허용된 목적지로만 리다이렉션 하는지 확인한다.", + "parent": "V3.7" + }, + { + "bom-ref": "V3.7.3", + "identifier": "V3.7.3", + "text": "사용자가 애플리케이션의 통제 범위를 벗어난 URL로 리다이렉션 될 때 이를 취소할 수 있는 옵션이 있는 알림이 애플리케이션에 표시되는지 확인한다.", + "parent": "V3.7" + }, + { + "bom-ref": "V3.7.4", + "identifier": "V3.7.4", + "text": "애플리케이션의 최상위 도메인(예: site.tld)가 공공 HSTS preload 목록에 추가되었는지 확인한다. 이렇게 하면 애플리케이션에 TLS를 사용하는 것이 Strict-Transport-Security 응답 헤더 필드에만 의존하지 않고 메인 브라우저에 직접 내장된다.", + "parent": "V3.7" + }, + { + "bom-ref": "V3.7.5", + "identifier": "V3.7.5", + "text": "애플리케이션에 접근하는 브라우저가 예상한 보안 특징을 가지고 있지 않은 경우, 애플리케이션이 문서에 명시된 대로 동작하는지 확인한다 (유저에게 경고하거나 접근을 차단하는 등).", + "parent": "V3.7" + }, + { + "bom-ref": "V4", + "identifier": "V4", + "title": "API 와 WEB 서비스" + }, + { + "bom-ref": "V4.1", + "identifier": "V4.1", + "title": "일반적인 웹 서비스 보안", + "parent": "V4" + }, + { + "bom-ref": "V4.1.1", + "identifier": "V4.1.1", + "text": "메세지 본문이 포함된 모든 HTTP 응답에는 실제 내용과 일치하는 Content-Type 헤더 필드가 포함되어 있는지 검증한다. 이때 IANA 미디어 타입(text, /+xml, /xml 등)에 따라 안전한 문자 인코딩 (ex. UTF-8, ISO-8859-1)을 지정하는 charset 파라미터도 포함되어야 한다.", + "parent": "V4.1" + }, + { + "bom-ref": "V4.1.2", + "identifier": "V4.1.2", + "text": "사용자가 대면하는 엔드포인트(사람이 직접 웹 브라우저에 접속하는 경우)만 HTTP에서 HTTPS로 자동 리디렉션하고, 그 외에 서비스나 API 엔드포인트는 명백한 리디렉션을 구현하지 않았는지 검증한다. 이는 클라이언트가 실수로 암호화되지 않은 HTTP 요청을 보내고 있음에도, 요청이 자동으로 HTTPS로 리디렉션되어 민감한 데이터의 유출 사실을 발견하지 못하게 되는 상황을 방지하기 위함이다.", + "parent": "V4.1" + }, + { + "bom-ref": "V4.1.3", + "identifier": "V4.1.3", + "text": "로드 밸런서, 웹 프록시, 백엔드-프론트엔드 서비스 등 중간 계층에서 설정되며, 애플리케이션에서 사용하는 모든 HTTP 헤더 필드를 사용자가 재정의할 수 없는지 확인한다. 예를 들어 X-Real-IP, X-Frowarded-*, X-User-ID 등의 헤더가 포함될 수 있다.", + "parent": "V4.1" + }, + { + "bom-ref": "V4.1.4", + "identifier": "V4.1.4", + "text": "애플리케이션이나 API에서 명시적으로 지원하는 HTTP 메서드(프리플라이트 요청 시에 OPTIONS 포함)만 사용할 수 있으며, 사용되지 않는 메서드는 차단되어 있는지 확인한다.", + "parent": "V4.1" + }, + { + "bom-ref": "V4.1.5", + "identifier": "V4.1.5", + "text": "매우 민감하거나 여러 시스템을 거치는 요청이나 거래에 대한 전송 계층 보호에 더하여 메세지별 디지털 서명들을 사용함으로써 추가적인 보증을 제공하는지 확인한다.", + "parent": "V4.1" + }, + { + "bom-ref": "V4.2", + "identifier": "V4.2", + "title": "HTTP 메세지 구조 검증", + "parent": "V4" + }, + { + "bom-ref": "V4.2.1", + "identifier": "V4.2.1", + "text": "모든 애플리케이션 구성 요소(로드 밸런서, 방화벽, 애플리케이션 서버 포함)가 HTTP 요청 smuggling을 예방하는 HTTP 버전의 적합한 메커니즘을 사용하는지에 대해, 수신되는 HTTP 메세지의 끝을 결정하는지 확인한다. HTTP/1.x에서 Transfer-encoding 헤더 필드가 있는 경우에 RFC 2616에 따라서 Content-Length 헤더는 무시해야 한다. HTTP/2 또는 HTTP/3를 사용할 때 Content-Length 헤더 필드가 있는 경우에 수신기는 DATA 프레임의 길이와 일치하는지 확인해야 한다.", + "parent": "V4.2" + }, + { + "bom-ref": "V4.2.2", + "identifier": "V4.2.2", + "text": "HTTP 메세지를 생성할 때, 요청 smuggling 공격을 예방하기 위해서 HTTP 프로토콜의 프레이밍 방식에 의해 결정된 Content의 길이와 Content-Length 헤더 필드가 충돌하지 않는지 확인한다. ", + "parent": "V4.2" + }, + { + "bom-ref": "V4.2.3", + "identifier": "V4.2.3", + "text": "응답 분할 및 헤더 인젝션 공격을 예방하기 위해서 애플리케이션이 Transfer-encoding과 같은 connection-specific 헤더 필드를 가진 HTTP/2또는 HTTP/3 메세지를 전송하거나 수락하지 않는지 확인한다.", + "parent": "V4.2" + }, + { + "bom-ref": "V4.2.4", + "identifier": "V4.2.4", + "text": "헤더 인젝션 공격을 예방하기 위해서, 애플리케이션이 헤더 이름과 값에 CR(\\r), LF(\\n), CRLF(\\r\\n)과 같은 줄바꿈 문자가 포함되어 있지 않은 HTTP/2 및 HTTP/3 요청만 허용하는지 확인한다.", + "parent": "V4.2" + }, + { + "bom-ref": "V4.2.5", + "identifier": "V4.2.5", + "text": "애플리케이션(백엔드 또는 프론트엔드)이 요청을 빌드하고 전송하는 경우, 수신 구성 요소가 수학하기에는 너무 긴 URI(ex. API 호출) 또는 HTTP 요청 헤더 필드(ex. Authorization 또는 Cookie)를 생성하지 않도록 검증, 검열 또는 기타 메커니즘을 사용하는지 확인한다. 이로 인해서 지나치게 긴 요청(ex. 긴 쿠키 헤더 필드)을 보낼 때와 같이 서비스 거부가 발생하여 서버가 항상 오류 상태로 응답할 수 있다.", + "parent": "V4.2" + }, + { + "bom-ref": "V4.3", + "identifier": "V4.3", + "title": "GraphQL", + "parent": "V4" + }, + { + "bom-ref": "V4.3.1", + "identifier": "V4.3.1", + "text": "쿼리 허용 목록, 깊이 제한, 양 제한 또는 쿼리 비용 분석을 사용하여 값비싼 중첩 쿼리로 인해 GraphQL 또는 데이터 계층 표현식 거부(DOS)를 방지하는지 확인한다.", + "parent": "V4.3" + }, + { + "bom-ref": "V4.3.2", + "identifier": "V4.3.2", + "text": "GraphQL API가 다른 사용자에 의해 사용되지 않는 한, 운영 환경에서 GraphQL 점검 쿼리들이 비비활성화되어 있는지 확인한다.", + "parent": "V4.3" + }, + { + "bom-ref": "V4.4", + "identifier": "V4.4", + "title": "WebSocket", + "parent": "V4" + }, + { + "bom-ref": "V4.4.1", + "identifier": "V4.4.1", + "text": "모든 WebSocket 연결에 WebSocket over TLS(WSS)이 사용되는지 확인한다.", + "parent": "V4.4" + }, + { + "bom-ref": "V4.4.2", + "identifier": "V4.4.2", + "text": "초기 HTTP WebSocket Handshake 중에 기존 헤더 필드가 애플리케이션에 허용된 기존 목록과 대조되는지 확인한다.", + "parent": "V4.4" + }, + { + "bom-ref": "V4.4.3", + "identifier": "V4.4.3", + "text": "애플리케이션의 표준 세션 관리를 사용할 수 없는 경우, 관련 세션 관리 보안 요구 사항을 준수하는 전용 토큰이 사용되고 있는지 확인한다.", + "parent": "V4.4" + }, + { + "bom-ref": "V4.4.4", + "identifier": "V4.4.4", + "text": "기존 HTTPS 세션을 WebSocket 채널로 전환할 때 이전에 인증된 HTTPS 세션을 통해 전용 WebSocket 세션 관리 토큰을 처음 얻거나 검증하는지 확인한다.", + "parent": "V4.4" + }, + { + "bom-ref": "V5", + "identifier": "V5", + "title": "파일 처리" + }, + { + "bom-ref": "V5.1", + "identifier": "V5.1", + "title": "파일 처리 문서화", + "parent": "V5" + }, + { + "bom-ref": "V5.1.1", + "identifier": "V5.1.1", + "text": "업로드 기능별로 허용되는 파일 형식, 예상되는 파일 확장자, 그리고 최대 크기(압축 해제된 크기 포함)가 문서에 정의되어 있는지 검증해야 한다. 또한, 악성 파일이 탐지될 때 애플리케이션이 어떻게 동작하는지와 같이, 최종 사용자가 파일을 안전하게 다운로드하고 처리할 수 있도록 하는 방법이 문서에 명시되어 있는지 확인해야 한다.", + "parent": "V5.1" + }, + { + "bom-ref": "V5.2", + "identifier": "V5.2", + "title": "파일 업로드 및 콘텐츠", + "parent": "V5" + }, + { + "bom-ref": "V5.2.1", + "identifier": "V5.2.1", + "text": "애플리케이션이 성능 저하나 서비스 거부 공격(Denial of Service; DoS)을 유발하지 않고 처리할 수 있는 크기의 파일만 허용하는지 검증해야 한다.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.2.2", + "identifier": "V5.2.2", + "text": "애플리케이션이 파일 자체 또는 zip 파일과 같은 아카이브 내에서 파일을 허용할 때, 파일 확장자가 예상 파일 확장자와 일치하는지 확인하고 내용이 확장자로 표현된 유형과 일치하는지 확인하는지 검증해야 한다. 여기에는 초기 '매직 바이트(magic bytes)' 확인, 이미지 재작성 수행, 파일 내용 유효성 검사를 위한 전문 라이브러리 사용이 포함되지만 이에 국한되지 않는다. L1의 경우, 특정 비즈니스 또는 보안 결정을 내리는 데 사용되는 파일에만 집중할 수 있다. L2 이상에서는 허용되는 모든 파일에 적용되어야 한다", + "parent": "V5.2" + }, + { + "bom-ref": "V5.2.3", + "identifier": "V5.2.3", + "text": "애플리케이션이 압축 파일(예: zip, gz, docx, odt)을 압축 해제하기 전에 허용되는 최대 압축 해제 크기와 최대 파일 수를 확인하는지 검증해야 한다.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.2.4", + "identifier": "V5.2.4", + "text": "단일 사용자가 너무 많은 파일이나 과도하게 큰 파일로 저장 공간을 채우지 않도록 사용자별 파일 크기 할당량(quota) 및 최대 파일 수가 적용되는지 검증해야 한다.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.2.5", + "identifier": "V5.2.5", + "text": "애플리케이션이 심볼릭 링크(symlink)를 포함하는 압축 파일 업로드를 허용하지 않는지 검증해야 한다. 단, 이러한 기능이 특별히 요구되는 경우에는 심볼릭 링크할 수 있는 파일의 허용 목록(allowlist)을 강제하는 것이 필요하다.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.2.6", + "identifier": "V5.2.6", + "text": "픽셀 플러드 공격(Pixel Flood Attack)을 방지하기 위해, 애플리케이션이 업로드된 이미지의 픽셀 크기가 허용된 최대값보다 큰 경우 해당 이미지를 거부하는지 검증해야 한다.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.3", + "identifier": "V5.3", + "title": "파일 저장", + "parent": "V5" + }, + { + "bom-ref": "V5.3.1", + "identifier": "V5.3.1", + "text": "신뢰할 수 없는 입력으로 업로드되거나 생성되어 공개 폴더에 저장된 파일이 HTTP 요청으로 직접 접근될 때 서버 측 프로그램 코드로 실행되지 않는지 검증해야 한다.", + "parent": "V5.3" + }, + { + "bom-ref": "V5.3.2", + "identifier": "V5.3.2", + "text": "애플리케이션이 파일 작업을 위한 파일 경로를 생성할 때, 사용자 제출 파일명 대신 내부적으로 생성되거나 신뢰할 수 있는 데이터를 사용하는지 검증해야 한다. 만약 사용자 제출 파일명 또는 파일 메타데이터를 반드시 사용해야 한다면, 경로 탐색(path traversal), 로컬 또는 원격 파일 포함(Local File Inclusion; LFI, Remote File Inclusion; RFI), 그리고 서버 측 요청 위조(Server-side Request Forgery; SSRF) 공격으로부터 보호하기 위해 엄격한 유효성 검사 및 정제(Sanitization)가 적용되는지 확인해야 한다.", + "parent": "V5.3" + }, + { + "bom-ref": "V5.3.3", + "identifier": "V5.3.3", + "text": "파일 압축 해제와 같은 서버 측 파일 처리가 zip slip과 같은 취약점을 방지하기 위해 사용자 제공 경로 정보를 무시하는지 검증해야 한다.", + "parent": "V5.3" + }, + { + "bom-ref": "V5.4", + "identifier": "V5.4", + "title": "파일 다운로드", + "parent": "V5" + }, + { + "bom-ref": "V5.4.1", + "identifier": "V5.4.1", + "text": "애플리케이션이 JSON, JSONP 또는 URL 파라미터를 포함한 사용자 제출 파일명을 검증하거나 무시하는지 검증해야 하고, 응답의 Content-Disposition 헤더 필드에 파일명을 명시하는지 검증해야 한다.", + "parent": "V5.4" + }, + { + "bom-ref": "V5.4.2", + "identifier": "V5.4.2", + "text": "제공되는 파일 이름(예: HTTP 응답 헤더 필드 또는 이메일 첨부 파일)이 문서 구조를 보존하고 삽입 공격(Injection Attack)을 방지하기 위해 인코딩되거나 정제되는지 검증해야 한다. (예: RFC 6266 준수)", + "parent": "V5.4" + }, + { + "bom-ref": "V5.4.3", + "identifier": "V5.4.3", + "text": "신뢰할 수 없는 소스에서 얻은 파일이 알려진 악성 콘텐츠 제공을 방지하기 위해 안티바이러스 스캐너에 의해 검사되는지 검증해야 한다.", + "parent": "V5.4" + }, + { + "bom-ref": "V6", + "identifier": "V6", + "title": "인증" + }, + { + "bom-ref": "V6.1", + "identifier": "V6.1", + "title": "Authentication Documentation", + "parent": "V6" + }, + { + "bom-ref": "V6.1.1", + "identifier": "V6.1.1", + "text": "인증 문서가 크리덴셜 스터핑, 비밀번호 무차별 대입 공격 등을 방어하기 위해 속도 제한, 자동화 방지, 적응형 응답(adaptive response)과 같은 제어가 어떻게 사용되는지를 정의한다. 또한, 이러한 제어가 어떻게 구성되는지와 악의적으로 계정을 잠그는 것을 방지하는 방법을 명확히 하는지 검증한다.", + "parent": "V6.1" + }, + { + "bom-ref": "V6.1.2", + "identifier": "V6.1.2", + "text": "조직명, 제품명, 시스템 식별자, 프로젝트 코드명, 부서명 또는 역할명 등 문맥적으로 특정된 단어의 변형을 포함하여, 비밀번호에 사용되지 않도록 문서화된 단어 목록이 있는지 검증한다.", + "parent": "V6.1" + }, + { + "bom-ref": "V6.1.3", + "identifier": "V6.1.3", + "text": "애플리케이션이 여러 인증 경로를 포함하는 경우, 이들 모두가 문서화되어 있으며 각 경로에 대해 일관되게 적용되는 보안 제어와 인증 강도가 정의되어 있는지 검증한다.", + "parent": "V6.1" + }, + { + "bom-ref": "V6.2", + "identifier": "V6.2", + "title": "비밀번호 보안", + "parent": "V6" + }, + { + "bom-ref": "V6.2.1", + "identifier": "V6.2.1", + "text": "사용자가 설정하는 비밀번호가 최소 8자 이상이어야 하며, 최소 15자 이상을 강력히 권장하는지 검증한다.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.2", + "identifier": "V6.2.2", + "text": "사용자가 비밀번호를 변경할 수 있는지 검증한다.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.3", + "identifier": "V6.2.3", + "text": "비밀번호 변경 기능이 사용자의 현재 비밀번호와 새 비밀번호를 요구하는지 검증한다.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.4", + "identifier": "V6.2.4", + "text": "계정 등록 또는 비밀번호 변경 시 제출된 비밀번호가 최소 3000개의 상위 비밀번호 목록과 비교 및 검사되는지, 이때 애플리케이션 비밀번호 정책(예: 최소 길이)을 만족하는지 검증한다.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.5", + "identifier": "V6.2.5", + "text": "비밀번호는 어떤 구성도 허용되며, 허용되는 문자 유형에 대한 제한이 없는지 검증한다. 대/소문자, 숫자, 특수문자에 대한 최소 개수 요구사항이 없어야 한다.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.6", + "identifier": "V6.2.6", + "text": "비밀번호 입력 필드가 type=password를 사용하여 입력을 마스킹하는지 검증한다. 애플리케이션은 사용자가 전체 비밀번호나 마지막 입력 문자를 일시적으로 볼 수 있도록 허용할 수 있다.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.7", + "identifier": "V6.2.7", + "text": "붙여넣기 기능, 브라우저 비밀번호 도우미, 외부 비밀번호 관리자의 사용이 허용되는지 검증한다.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.8", + "identifier": "V6.2.8", + "text": "애플리케이션이 비밀번호를 사용자로부터 수신한 그대로 검증하며, 대소문자 변경이나 잘림(truncation)과 같은 수정 없이 처리하는지 검증한다.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.9", + "identifier": "V6.2.9", + "text": "비밀번호가 최소 64자까지 허용되는지 검증한다.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.10", + "identifier": "V6.2.10", + "text": "사용자의 비밀번호는 손상되었음이 발견되거나 사용자가 교체할 때까지 유효하며, 애플리케이션이 주기적인 자격 증명 교체를 요구하지 않는지 검증한다.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.11", + "identifier": "V6.2.11", + "text": "문서화된 문맥별 단어 목록을 사용하여 추측하기 쉬운 비밀번호가 생성되지 않도록 하는지 검증한다.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.12", + "identifier": "V6.2.12", + "text": "계정 등록 또는 비밀번호 변경 시 제출된 비밀번호가 유출된 비밀번호 집합과 비교 및 검사되는지 검증한다.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.3", + "identifier": "V6.3", + "title": "일반 인증 보안", + "parent": "V6" + }, + { + "bom-ref": "V6.3.1", + "identifier": "V6.3.1", + "text": "애플리케이션의 보안 문서에 따라 크리덴셜 스터핑 및 비밀번호 무차별 대입 공격을 방지하기 위한 제어가 구현되어 있는지 검증한다.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.2", + "identifier": "V6.3.2", + "text": "“root”, “admin”, “sa”와 같은 기본 사용자 계정이 애플리케이션에 존재하지 않거나 비활성화되어 있는지 검증한다.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.3", + "identifier": "V6.3.3", + "text": "애플리케이션 접근 시 반드시 MFA 또는 단일 요소 인증 메커니즘의 조합을 사용하는지 검증한다. L3의 경우, 인증을 수행하려는 사용자의 의도를 검증하기 위해 사용자가 직접 수행하는 동작(예: FIDO 하드웨어 키 또는 모바일 기기에서 버튼을 누르는 행위)을 요구함으로써, 피싱 공격에 대한 침해 및 위장 저항성을 제공하는 하드웨어 기반 인증 메커니즘이 반드시 하나의 요소로 포함되어야 한다. 이 요구사항에서 고려 사항을 완화하려는 경우, 완전히 문서화된 근거와 포괄적인 보완 통제가 반드시 수반되어야 한다.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.4", + "identifier": "V6.3.4", + "text": "여러 인증 경로가 존재하는 경우, 문서화되지 않은 경로가 없어야 하며 보안 제어와 인증 강도가 일관되게 적용되는지 검증한다.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.5", + "identifier": "V6.3.5", + "text": "사용자가 의심스러운 인증 시도에 대해 성공 여부와 관계 없이 알림을 제공받는지 검증한다. 여기에는 비정상적인 위치나 클라이언트에서의 인증 시도, 부분적으로만 성공한 인증(여러 요소 중 하나만 성공한 경우), 장기간 비활성 상태 이후의 인증 시도, 또는 여러 번의 인증 실패 후 성공한 인증이 포함될 수 있다.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.6", + "identifier": "V6.3.6", + "text": "이메일이 단일 또는 다중 요소 인증 메커니즘으로 사용되지 않는지 검증한다.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.7", + "identifier": "V6.3.7", + "text": "자격 증명 재설정, 사용자명/이메일 수정 등 인증 관련 정보 변경 이후 사용자에게 통지되는지 검증한다.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.8", + "identifier": "V6.3.8", + "text": "오류 메시지, HTTP 응답 코드, 응답 시간 차이 등을 통해 유효한 사용자를 유추할 수 없으며, 비밀번호 등록/찾기 기능에도 동일한 보호가 적용되는지 검증한다.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.4", + "identifier": "V6.4", + "title": "인증 요소 수명 주기 및 복구", + "parent": "V6" + }, + { + "bom-ref": "V6.4.1", + "identifier": "V6.4.1", + "text": "시스템이 생성하는 초기 비밀번호나 활성화 코드가 안전하게 난수로 생성되며, 기존 비밀번호 정책을 따르고, 짧은 기간 내 또는 최초 사용 시 만료되는지 검증한다. 초기 비밀번호는 장기 비밀번호로 허용되지 않아야 한다.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.4.2", + "identifier": "V6.4.2", + "text": "비밀번호 힌트나 지식 기반 인증(“비밀 질문”)이 존재하지 않는지 검증한다.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.4.3", + "identifier": "V6.4.3", + "text": "분실된 비밀번호에 대한 재설정 절차가 안전하게 구현되며, MFA를 우회하지 않는지 검증한다.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.4.4", + "identifier": "V6.4.4", + "text": "MFA 요소 분실 시, 등록 시와 동일 수준의 신원 증명이 수행되는지 검증한다.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.4.5", + "identifier": "V6.4.5", + "text": "만료 예정인 인증 메커니즘에 대한 갱신 안내가 충분한 시간 전에 발송되며, 필요한 경우 자동 알림이 구성되는지 검증한다", + "parent": "V6.4" + }, + { + "bom-ref": "V6.4.6", + "identifier": "V6.4.6", + "text": "관리자가 사용자 비밀번호 재설정 절차를 시작할 수 있으나, 사용자의 비밀번호를 직접 변경하거나 지정할 수 없는지 검증한다. 이는 관리자가 사용자의 비밀번호를 알지 못하도록 한다.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.5", + "identifier": "V6.5", + "title": "General Multi-factor authentication requirements", + "parent": "V6" + }, + { + "bom-ref": "V6.5.1", + "identifier": "V6.5.1", + "text": "조회 secret, 대역 외 인증 요청 및 코드, 시간 기반 일회용 비밀번호가 단 한 번만 성공적으로 사용 가능한지 검증한다.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.2", + "identifier": "V6.5.2", + "text": "애플리케이션 백엔드에 저장될 때, 엔트로피가 112비트 미만인 룩업 시크릿(예: 무작위 영숫자 19자 또는 무작위 숫자 34자)은 32비트 무작위 솔트(salt)를 포함하는 사전 승인된 비밀번호 저장용 해시 알고리즘으로 해시되는지 검증한다. 룩업 시크릿이 112비트 이상의 엔트로피를 가진 경우에는 표준 해시 함수를 사용할 수 있다.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.3", + "identifier": "V6.5.3", + "text": "룩업 시크릿, 대역 외 인증 코드, 그리고 시간 기반 일회용 비밀번호의 시드가 예측 가능한 값을 피하기 위해 암호학적으로 안전한 의사난수 생성기(CSPRNG)를 사용하여 생성되는지 검증한다. ", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.4", + "identifier": "V6.5.4", + "text": "룩업 시크릿과 대역 외 인증 코드가 최소 20비트의 엔트로피를 가지는지 검증한다. 일반적으로 무작위 영숫자 4자 또는 무작위 숫자 6자가 충분하다.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.5", + "identifier": "V6.5.5", + "text": "대역 외 인증 요청, 코드 또는 토큰과 시간 기반 일회용 비밀번호가 정의된 수명을 가지는지 검증한다. 대역 외 요청의 최대 수명은 10분이어야 하며, TOTP의 최대 수명은 30초이어야 한다.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.6", + "identifier": "V6.5.6", + "text": "도난이나 기타 손실의 경우 모든 인증 요소(물리적 장치 포함)를 해지할 수 있는지 검증한다.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.7", + "identifier": "V6.5.7", + "text": "생체 인식 인증 메커니즘은 반드시 보조 요소로만 사용되어야 하며, “소유하고 있는 것” 또는 “알고 있는 것” 중 하나와 함께 사용되는지 검증한다.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.8", + "identifier": "V6.5.8", + "text": "시간 기반 일회용 비밀번호는 신뢰할 수 있는 서비스의 시간 소스를 기준으로 검증되어야 하며, 신뢰할 수 없거나 클라이언트에서 제공한 시간을 기반으로 해서는 안 된다.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.6", + "identifier": "V6.6", + "title": "대역 외(Out-of-Band) 인증 메커니즘", + "parent": "V6" + }, + { + "bom-ref": "V6.6.1", + "identifier": "V6.6.1", + "text": "공중 교환 전화망(PSTN)을 사용하여 전화나 SMS를 통해 일회용 비밀번호(OTPs)를 전달하는 인증 메커니즘은, 해당 전화번호가 사전에 검증되었을 때만 제공되어야 하며, 더 강력한 대체 방법(예: 시간 기반 일회용 비밀번호)도 제공되어야 하고, 서비스는 사용자에게 이러한 보안 위험에 대한 정보를 제공해야 한다. L3 애플리케이션의 경우, 전화와 SMS는 옵션으로 제공되어서는 안 된다.", + "parent": "V6.6" + }, + { + "bom-ref": "V6.6.2", + "identifier": "V6.6.2", + "text": "대역 외 인증 요청, 코드 또는 토큰은 생성된 원래 인증 요청에만 바인딩되어야 하며, 이전이나 이후의 요청에는 사용할 수 없어야 한다.", + "parent": "V6.6" + }, + { + "bom-ref": "V6.6.3", + "identifier": "V6.6.3", + "text": "코드 기반 대역 외 인증 메커니즘이 속도 제한 등을 통해 무차별 대입 공격으로부터 보호되는지 검증한다. 또한 최소 64비트 이상의 엔트로피를 가진 코드를 사용하는 것도 고려해야한다.", + "parent": "V6.6" + }, + { + "bom-ref": "V6.6.4", + "identifier": "V6.6.4", + "text": "다중요소 인증에 푸시 알림이 사용되는 경우, 푸시 폭탄(push bombing) 공격을 방지하기 위해 속도 제한을 적용해야 한다. 또한 숫자 일치 기법 역시 이 위험을 완화할 수 있다.", + "parent": "V6.6" + }, + { + "bom-ref": "V6.7", + "identifier": "V6.7", + "title": "암호학적 인증 메커니즘", + "parent": "V6" + }, + { + "bom-ref": "V6.7.1", + "identifier": "V6.7.1", + "text": "암호학적 인증 단언(assertion)을 검증하는 데 사용되는 인증서는 수정으로부터 보호되는 방식으로 저장되는지 검증한다.", + "parent": "V6.7" + }, + { + "bom-ref": "V6.7.2", + "identifier": "V6.7.2", + "text": "챌린지 논스(nonce)는 최소 64비트 길이여야 하며, 통계적으로 고유하거나 해당 암호 장치의 수명 동안 고유해야 한다.", + "parent": "V6.7" + }, + { + "bom-ref": "V6.8", + "identifier": "V6.8", + "title": "ID 제공자(IdP)를 통한 인증", + "parent": "V6" + }, + { + "bom-ref": "V6.8.1", + "identifier": "V6.8.1", + "text": "애플리케이션이 다중 ID 제공자(IdP)를 지원하는 경우, 사용자의 신원이 다른 지원 IdP를 통해 위조될 수 없는지 검증한다. (예: 동일한 사용자 식별자를 사용하는 방식). 표준적인 대응책은 애플리케이션이 IdP ID(네임스페이스 역할)와 IdP 내 사용자 ID의 조합을 사용하여 사용자를 등록하고 식별하는 것이다.", + "parent": "V6.8" + }, + { + "bom-ref": "V6.8.2", + "identifier": "V6.8.2", + "text": "인증 단언(예: JWT 또는 SAML 단언)의 디지털 서명이 존재하고 무결성이 항상 유지되는지를 검증한다. 서명이 없거나 유효하지 않은 단언은 거부해야 한다.", + "parent": "V6.8" + }, + { + "bom-ref": "V6.8.3", + "identifier": "V6.8.3", + "text": "SAML 단언이 재생 공격의 방지를 위해 고유하게 처리되는지, 유효 기간 내에 단 한 번만 사용되는지 검증한다.", + "parent": "V6.8" + }, + { + "bom-ref": "V6.8.4", + "identifier": "V6.8.4", + "text": "애플리케이션이 별도의 ID 제공자(IdP)를 사용하고 특정 기능에 대해 특정 인증 강도, 방식, 또는 최근성을 요구하는 경우, 애플리케이션은 IdP가 반환한 정보를 사용하여 이를 검증해야 한다. 예를 들어, OIDC가 사용되는 경우, 이는 ‘acr’, ‘amr’, ‘auth_time’(존재하는 경우)과 같은 ID 토큰 클레임을 검증함으로써 달성할 수 있다. IdP가 이 정보를 제공하지 않는 경우, 애플리케이션은 최소 강도의 인증 메커니즘(예: 사용자 이름과 비밀번호를 사용하는 단일요소 인증)이 사용되었다고 가정하는 문서화된 대체 접근법을 가져야 한다.", + "parent": "V6.8" + }, + { + "bom-ref": "V7", + "identifier": "V7", + "title": "세션 관리" + }, + { + "bom-ref": "V7.1", + "identifier": "V7.1", + "title": "세션 관리 문서화", + "parent": "V7" + }, + { + "bom-ref": "V7.1.1", + "identifier": "V7.1.1", + "text": "사용자의 세션 비활성 시간 초과 및 절대 최대 세션 수명에 대한 문서가 존재하고, 다른 제어와의 조합에서 적절하며, NIST SP 800-63B 재인증 요구사항에서 벗어날 시 그 근거가 문서에 포함되어 있는지 검증한다.", + "parent": "V7.1" + }, + { + "bom-ref": "V7.1.2", + "identifier": "V7.1.2", + "text": "문서가 하나의 계정에서 허용되는 동시(병렬) 세션 수와 활성 세션 수의 최대값에 도달했을 때의 의도된 동작과 수행할 조치를 정의하는지 검증한다.", + "parent": "V7.1" + }, + { + "bom-ref": "V7.1.3", + "identifier": "V7.1.3", + "text": "통합 신원 관리 생태계(예: SSO 시스템)의 일부로 사용자 세션을 생성하고 관리하는 모든 시스템이 문서화되어 있으며, 세션 수명, 종료, 재인증이 필요한 기타 조건을 조율하기 위한 제어가 포함되어 있는지 검증한다.", + "parent": "V7.1" + }, + { + "bom-ref": "V7.2", + "identifier": "V7.2", + "title": "기본 세션 관리 보안", + "parent": "V7" + }, + { + "bom-ref": "V7.2.1", + "identifier": "V7.2.1", + "text": "애플리케이션이 모든 세션 토큰 검증을 신뢰할 수 있는 백엔드 서비스에서 수행하는지 검증한다.", + "parent": "V7.2" + }, + { + "bom-ref": "V7.2.2", + "identifier": "V7.2.2", + "text": "애플리케이션이 세션 관리를 위해 정적 API 시크릿이나 키가 아닌, 자체 포함 토큰 또는 참조 토큰을 동적으로 생성하여 사용하는지 검증한다.", + "parent": "V7.2" + }, + { + "bom-ref": "V7.2.3", + "identifier": "V7.2.3", + "text": "참조 토큰이 사용자 세션을 나타내는 데 사용되는 경우, 그 토큰이 고유하고, 암호학적으로 안전한 의사난수 생성기(CSPRNG)를 사용해 생성되며 최소 128비트의 엔트로피를 갖는지 검증한다.", + "parent": "V7.2" + }, + { + "bom-ref": "V7.2.4", + "identifier": "V7.2.4", + "text": "애플리케이션이 사용자 인증(재인증 포함) 시 새로운 세션 토큰을 생성하고 기존 세션 토큰을 종료하는지 검증한다.", + "parent": "V7.2" + }, + { + "bom-ref": "V7.3", + "identifier": "V7.3", + "title": "세션 타임아웃", + "parent": "V7" + }, + { + "bom-ref": "V7.3.1", + "identifier": "V7.3.1", + "text": "위험 분석 및 문서화된 보안 결정에 따라 재인증을 강제하는 비활성 시간 초과가 존재하는지 검증한다.", + "parent": "V7.3" + }, + { + "bom-ref": "V7.3.2", + "identifier": "V7.3.2", + "text": "위험 분석 및 문서화된 보안 결정에 따라 재인증을 강제하는 절대 최대 세션 수명이 존재하는지 검증한다.", + "parent": "V7.3" + }, + { + "bom-ref": "V7.4", + "identifier": "V7.4", + "title": "세션 종료", + "parent": "V7" + }, + { + "bom-ref": "V7.4.1", + "identifier": "V7.4.1", + "text": "로그아웃이나 만료와 같이 세션 종료가 트리거될 때, 애플리케이션이 해당 세션의 추가 사용을 허용하지 않는지 검증한다. 참조 토큰 또는 상태 유지형 세션의 경우, 이는 애플리케이션 백엔드에서 세션 데이터를 무효화하는 것을 의미한다. 자체 포함 토큰을 사용하는 애플리케이션은 종료된 토큰 목록 유지, 사용자별 날짜·시간 이전에 발급된 토큰 거부, 사용자별 서명 키 회전과 같은 방법을 사용해야 한다.", + "parent": "V7.4" + }, + { + "bom-ref": "V7.4.2", + "identifier": "V7.4.2", + "text": "사용자 계정이 비활성화되거나 삭제될 때(예: 직원 퇴사), 애플리케이션이 모든 활성 세션을 종료하는지 검증한다.", + "parent": "V7.4" + }, + { + "bom-ref": "V7.4.3", + "identifier": "V7.4.3", + "text": "비밀번호 재설정·복구를 통한 변경, MFA 설정 변경 등 어떤 인증 요소라도 성공적으로 변경 또는 제거한 후, 모든 다른 활성 세션을 종료할 수 있는 옵션을 제공하는지 검증한다.", + "parent": "V7.4" + }, + { + "bom-ref": "V7.4.4", + "identifier": "V7.4.4", + "text": "인증이 필요한 모든 페이지의 로그아웃 기능에 접근하는 것이 쉽고 잘 보이는지 검증한다.", + "parent": "V7.4" + }, + { + "bom-ref": "V7.4.5", + "identifier": "V7.4.5", + "text": "애플리케이션 관리자가 개별 사용자 또는 모든 사용자의 활성 세션을 종료할 수 있는지 검증한다.", + "parent": "V7.4" + }, + { + "bom-ref": "V7.5", + "identifier": "V7.5", + "title": "세션 악용 방어", + "parent": "V7" + }, + { + "bom-ref": "V7.5.1", + "identifier": "V7.5.1", + "text": "이메일 주소, 전화번호, MFA 구성, 계정 복구에 사용되는 기타 정보 등 인증에 영향을 줄 수 있는 민감한 계정 속성을 변경하기 전에 전체 재인증을 요구하는지 검증한다.", + "parent": "V7.5" + }, + { + "bom-ref": "V7.5.2", + "identifier": "V7.5.2", + "text": "사용자가 현재 활성 세션을 전체 또는 일부 확인하고(최소 요소 한 개에 대한 인증을 다시 수행한 후) 종료할 수 있는지 검증한다.", + "parent": "V7.5" + }, + { + "bom-ref": "V7.5.3", + "identifier": "V7.5.3", + "text": "매우 민감한 거래나 작업을 수행하기 전에 최소 한 요소 인증 또는 2차 검증을 요구하는지 검증한다.", + "parent": "V7.5" + }, + { + "bom-ref": "V7.6", + "identifier": "V7.6", + "title": "페더레이션 재인증", + "parent": "V7" + }, + { + "bom-ref": "V7.6.1", + "identifier": "V7.6.1", + "text": "RP와 IdP 간 세션 수명과 종료가 문서대로 동작하며, IdP 인증 이벤트 간의 최대 시간이 도달하는 경우 등 필요한 시점에 재인증을 요구하는지 검증한다.", + "parent": "V7.6" + }, + { + "bom-ref": "V7.6.2", + "identifier": "V7.6.2", + "text": "세션 생성 시 사용자 동의 또는 명시적 동작을 요구하여, 사용자 상호작용 없이 새로운 애플리케이션 세션이 생성되지 않도록 하는지 검증한다.", + "parent": "V7.6" + }, + { + "bom-ref": "V8", + "identifier": "V8", + "title": "권한 부여" + }, + { + "bom-ref": "V8.1", + "identifier": "V8.1", + "title": "권한 부여 문서화", + "parent": "V8" + }, + { + "bom-ref": "V8.1.1", + "identifier": "V8.1.1", + "text": "권한 부여 문서가 소비자 권한과 자원 속성에 따라 기능 수준 및 데이터별 접근을 제한하는 규칙을 정의하는지 검증한다.", + "parent": "V8.1" + }, + { + "bom-ref": "V8.1.2", + "identifier": "V8.1.2", + "text": "권한 부여 문서가 소비자 권한과 자원 속성에 따라 필드 수준 접근 제한(읽기 및 쓰기 모두)을 정의하는지 검증한다. 이러한 규칙은 관련 데이터 객체의 상태(state)나 상태값(status)과 같은 다른 속성 값에 의존할 수 있다.", + "parent": "V8.1" + }, + { + "bom-ref": "V8.1.3", + "identifier": "V8.1.3", + "text": "애플리케이션 문서가 인증 및 권한 부여와 관련된 보안 결정을 내리는 데 사용되는 환경적, 맥락적 속성(예: 시간대, 사용자 위치, IP 주소, 디바이스 등)을 정의하는지 검증한다.", + "parent": "V8.1" + }, + { + "bom-ref": "V8.1.4", + "identifier": "V8.1.4", + "text": "인증 및 권한 부여 문서가 기능 수준, 데이터별, 필드 수준 권한 부여에 더해 환경적, 맥락적 요소가 의사 결정에 어떻게 사용되는지 정의하는지 검증한다. 여기에는 평가되는 속성, 위험 임계값, 수행되는 조치(예: 허용, 추가 인증 요청, 거부, 단계적 인증)을 포함하는 것을 권장한다.", + "parent": "V8.1" + }, + { + "bom-ref": "V8.2", + "identifier": "V8.2", + "title": "일반 권한 부여 설계", + "parent": "V8" + }, + { + "bom-ref": "V8.2.1", + "identifier": "V8.2.1", + "text": "애플리케이션이 기능 수준의 접근을 명시적 권한이 있는 소비자에게만 허용하는지 검증한다.", + "parent": "V8.2" + }, + { + "bom-ref": "V8.2.2", + "identifier": "V8.2.2", + "text": "애플리케이션이 특정 데이터 항목에 대한 명시적 권한이 있는 소비자에게만 데이터별 접근을 허용하여, 안전하지 않은 직접 객체 참조(IDOR) 및 객체 수준 권한 부여 취약점(BOLA)을 방지하는지 검증한다.", + "parent": "V8.2" + }, + { + "bom-ref": "V8.2.3", + "identifier": "V8.2.3", + "text": "애플리케이션이 특정 필드에 대한 명시적 권한이 있는 소비자에게만 필드 수준 접근을 허용하여, 객체 속성 수준 권한 부여 취약점(BOPLA)을 방지하는지 검증한다.", + "parent": "V8.2" + }, + { + "bom-ref": "V8.2.4", + "identifier": "V8.2.4", + "text": "애플리케이션 문서에서 정의한 바에 따라, 소비자의 환경적, 맥락적 속성(예: 시간대, 위치, IP 주소 또는 장치)에 기반한 적응형 보안 제어가 인증 및 권한 부여 결정에 구현되는지 검증한다. 이러한 제어는 소비자가 새 세션을 시작할 때뿐만 아니라 기존 세션 중에도 반드시 적용되어야 한다.", + "parent": "V8.2" + }, + { + "bom-ref": "V8.3", + "identifier": "V8.3", + "title": "운영 수준 권한 부여", + "parent": "V8" + }, + { + "bom-ref": "V8.3.1", + "identifier": "V8.3.1", + "text": "애플리케이션이 권한 부여 규칙을 신뢰할 수 있는 서비스 계층에서 적용하고, 클라이언트 측 JavaScript처럼 신뢰할 수 없는 소비자가 조작할 수 있는 제어에 의존하지 않는지 검증한다.", + "parent": "V8.3" + }, + { + "bom-ref": "V8.3.2", + "identifier": "V8.3.2", + "text": "권한 부여 결정에 영향을 미치는 값의 변경 사항이 즉시 적용되는지 검증한다. 자체 포함 토큰(self-contained token)과 같이 즉시 적용이 불가능한 경우, 소비자가 더 이상 권한이 없는 작업을 수행할 때 이를 알리고 변경을 되돌리는 완화 제어를 반드시 두어야 한다. 단, 이 방법은 정보 유출을 방지하지는 못한다.", + "parent": "V8.3" + }, + { + "bom-ref": "V8.3.3", + "identifier": "V8.3.3", + "text": "객체에 대한 접근이, 대리인이나 이를 대신 수행하는 서비스의 권한이 아닌, 원래 주체(예: 소비자)의 권한에 기반하는지 검증한다. 예를 들어, 소비자가 인증을 위해 자체 포함 토큰을 사용하여 웹 서비스를 호출하고, 해당 서비스가 다른 서비스에 데이터를 요청하는 경우, 두 번째 서비스는 첫 번째 서비스의 머신-투-머신 토큰이 아니라 소비자의 토큰을 사용하여 권한 결정을 내려야 한다.", + "parent": "V8.3" + }, + { + "bom-ref": "V8.4", + "identifier": "V8.4", + "title": "기타 권한 부여 고려사항", + "parent": "V8" + }, + { + "bom-ref": "V8.4.1", + "identifier": "V8.4.1", + "text": "다중 테넌트 애플리케이션이 교차 테넌트 제어를 사용하여, 소비자의 작업이 권한이 없는 다른 테넌트에 영향을 미치지 않도록 하는지 검증한다.", + "parent": "V8.4" + }, + { + "bom-ref": "V8.4.2", + "identifier": "V8.4.2", + "text": "관리 인터페이스 접근이 연속적인 소비자 신원 검증, 장치 보안 상태 평가, 맥락 기반 위험 분석 등 복수의 보안 계층을 포함하는지 검증한다. 네트워크 위치나 신뢰된 엔드포인트가 무단 접근 가능성을 줄일 수는 있더라도, 단독으로 권한 부여 판단의 유일한 요소가 되어서는 안 된다.", + "parent": "V8.4" + }, + { + "bom-ref": "V9", + "identifier": "V9", + "title": "자체 포함 토큰(self-contained token)" + }, + { + "bom-ref": "V9.1", + "identifier": "V9.1", + "title": "토큰 출처 및 무결성", + "parent": "V9" + }, + { + "bom-ref": "V9.1.1", + "identifier": "V9.1.1", + "text": "자체 포함 토큰 내용을 허용하기 전에 변조를 방지하기 위해 디지털 서명 또는 메시지 인증 코드(MAC)를 사용하여 토큰의 무결성을 검증해야 한다.", + "parent": "V9.1" + }, + { + "bom-ref": "V9.1.2", + "identifier": "V9.1.2", + "text": "주어진 컨텍스트에 대해 자체 포함 토큰을 생성하고 검증할 때, 허용 목록에 있는 알고리즘만 사용될 수 있는지 검증해야 한다. 허용 목록에는 사용 가능한 알고리즘을 모두 포함해야 하며, 이상적으로는 대칭 또는 비대칭 알고리즘 중 하나만을 포함해야 한다. 또한 'None' 알고리즘은 반드시 제외해야 한다. 대칭 및 비대칭 알고리즘 모두를 지원해야 하는 경우, 키 혼동을 방지하기 위해 추가 제어가 필요하다.", + "parent": "V9.1" + }, + { + "bom-ref": "V9.1.3", + "identifier": "V9.1.3", + "text": "자체 포함 토큰을 검증하는 데 사용되는 키 자료가 토큰 발행자를 위한 신뢰할 수 있는 사전 구성된 출처에서 비롯되었는지 검증하여, 공격자가 신뢰할 수 없는 출처 및 키를 지정하는 것을 방지해야 한다. JWT 및 기타 JWS 구조의 경우, 'jku', 'x5u', 'jwk'와 같은 헤더는 신뢰할 수 있는 출처의 허용 목록에 대해 검증되어야 한다.", + "parent": "V9.1" + }, + { + "bom-ref": "V9.2", + "identifier": "V9.2", + "title": "토큰 내용", + "parent": "V9" + }, + { + "bom-ref": "V9.2.1", + "identifier": "V9.2.1", + "text": "토큰 데이터에 유효 기간이 존재하는 경우, 검증 시간이 이 유효 기간 내에 있을 때만 토큰 및 해당 내용이 허용되는지 검증해야 한다. 예를 들어, JWT의 경우 'nbf' 및 'exp' 클레임이 검증되어야 한다.", + "parent": "V9.2" + }, + { + "bom-ref": "V9.2.2", + "identifier": "V9.2.2", + "text": "토큰을 수신하는 서비스가 토큰 내용을 수락하기 전에 올바른 유형이며 의도된 목적을 위한 것인지 토큰을 검증하는지 확인해야 한다. 예를 들어, 인가 결정에는 액세스 토큰만 허용될 수 있으며, 사용자 인증을 증명하는 데는 ID 토큰만 사용될 수 있다.", + "parent": "V9.2" + }, + { + "bom-ref": "V9.2.3", + "identifier": "V9.2.3", + "text": "서비스가 대상 서비스(audience)와 함께 사용하기 위한 토큰만 허용하는지 검증해야 한다. JWT의 경우, 서비스에 정의된 허용 목록에 대해 'aud' 클레임을 검증함으로써 이를 달성할 수 있다.", + "parent": "V9.2" + }, + { + "bom-ref": "V9.2.4", + "identifier": "V9.2.4", + "text": "토큰 발행자가 다른 대상(audience)에게 토큰을 발행하기 위해 동일한 개인 키를 사용하는 경우, 발행된 토큰이 의도된 대상을 고유하게 식별하는 대상 제한을 포함하는지 검증해야 한다. 이는 토큰이 의도하지 않은 대상에서 재사용되는 것을 방지한다. 대상 식별자가 동적으로 프로비저닝되는 경우, 토큰 발행자는 대상 위장(audience impersonation)을 초래하지 않도록 대상들을 검증해야 한다.", + "parent": "V9.2" + }, + { + "bom-ref": "V10", + "identifier": "V10", + "title": "OAuth와 OIDC" + }, + { + "bom-ref": "V10.1", + "identifier": "V10.1", + "title": "일반적인 OAuth 및 OIDC 보안", + "parent": "V10" + }, + { + "bom-ref": "V10.1.1", + "identifier": "V10.1.1", + "text": "엄격하게 필요한 구성 요소에만 토큰이 전송되는지 검증해야 한다. 예를 들어, 브라우저 기반 JavaScript 애플리케이션에 프론트엔드 전용 백엔드(Backend For Frontend; BFF) 패턴을 사용하는 경우, 액세스 토큰 및 리프레시 토큰은 백엔드에서만 접근 가능해야 한다.", + "parent": "V10.1" + }, + { + "bom-ref": "V10.1.2", + "identifier": "V10.1.2", + "text": "클라이언트는 인가 서버에서 제공하는 값(예: 인가 코드 또는 ID 토큰)이 동일한 사용자 에이전트 세션 및 트랜잭션에서 시작된 인가 플로우의 결과인 경우에만 허용하는지 검증해야 한다. 이를 위해 클라이언트가 생성하는 비밀 값(PKCE(Proof Key for Code Exchange)의 'code_verifier', 'state', OIDC의 'nonce' 등)은 추측이 불가능해야 하며, 해당 트랜잭션에 고유해야 하고, 트랜잭션이 시작된 클라이언트와 사용자 에이전트 세션 양쪽에 안전하게 결합(Binding)되어 있어야 한다.", + "parent": "V10.1" + }, + { + "bom-ref": "V10.2", + "identifier": "V10.2", + "title": "OAuth 클라이언트", + "parent": "V10" + }, + { + "bom-ref": "V10.2.1", + "identifier": "V10.2.1", + "text": "코드 플로우를 사용하는 경우, OAuth 클라이언트는 토큰 요청을 유도하는 사이트 간 요청 위조 공격(Cross-Site Request Forgery; CSRF)에 대한 보호 기능을 갖추고 있는지 검증한다. 이를 위해 인가 요청 시 전송된 'state' 파라미터를 검증하거나, PKCE 기능을 사용해야 한다.", + "parent": "V10.2" + }, + { + "bom-ref": "V10.2.2", + "identifier": "V10.2.2", + "text": "OAuth 클라이언트가 둘 이상의 인가 서버와 상호 작용할 수 있는 경우, 믹스업 공격에 대한 방어 대책을 갖는지 검증해야 한다. 예를 들어, 인가 서버가 'iss' 파라미터 값을 반환하도록 요구하고 인가 응답 및 토큰 응답에서 이를 검증할 수 있다.", + "parent": "V10.2" + }, + { + "bom-ref": "V10.2.3", + "identifier": "V10.2.3", + "text": "OAuth 클라이언트가 인가 서버에 대한 요청에서 필요한 범위(또는 기타 인가 파라미터)만 요청하는지 검증해야 한다.", + "parent": "V10.2" + }, + { + "bom-ref": "V10.3", + "identifier": "V10.3", + "title": "OAuth 리소스 서버", + "parent": "V10" + }, + { + "bom-ref": "V10.3.1", + "identifier": "V10.3.1", + "text": "리소스 서버가 해당 서비스(audience)에 사용하도록 의도된 액세스 토큰만 수락하는지 검증해야 한다. 대상은 구조화된 액세스 토큰(예: JWT의 'aud' 클레임)에 포함될 수 있거나, 토큰 조회 엔드포인트를 사용하여 확인할 수 있다.", + "parent": "V10.3" + }, + { + "bom-ref": "V10.3.2", + "identifier": "V10.3.2", + "text": "리소스 서버가 위임된 인가를 정의하는 액세스 토큰의 클레임을 기반으로 인가 결정을 시행하는지 검증해야 한다. 'sub', 'scope', 'authorization_details'와 같은 클레임이 존재하는 경우, 이는 결정에 반영되어야 한다.", + "parent": "V10.3" + }, + { + "bom-ref": "V10.3.3", + "identifier": "V10.3.3", + "text": "액세스 토큰(JWT 또는 관련 토큰 조회 응답)에서 고유한 사용자를 식별해야 하는 접근 제어 결정이 필요한 경우, 리소스 서버가 다른 사용자에게 재할당될 수 없는 클레임에서 사용자를 식별하는지 검증해야 한다. 일반적으로 이는 'iss' 및 'sub' 클레임의 조합을 사용하는 것을 의미한다.", + "parent": "V10.3" + }, + { + "bom-ref": "V10.3.4", + "identifier": "V10.3.4", + "text": "리소스 서버가 특정 인증 강도, 방법 또는 최신성을 요구하는 경우, 제시된 액세스 토큰이 이러한 제약 조건을 충족하는지 검증해야 한다. 예를 들어, 토큰을 제시한 경우 OIDC의 'acr', 'amr' 및 'auth_time' 클레임을 각각 사용해야 한다.", + "parent": "V10.3" + }, + { + "bom-ref": "V10.3.5", + "identifier": "V10.3.5", + "text": "리소스 서버가 발신자 제약 액세스 토큰, 즉 OAuth 2용 상호 TLS(Mutual TLS; mTLS) 또는 OAuth 2 소유 증명(Demonstration of Proof of Possession; DPoP)를 요구하여 도난된 액세스 토큰 사용 또는 액세스 토큰 재사용(권한 없는 당사자로부터)을 방지하는지 검증해야 한다.", + "parent": "V10.3" + }, + { + "bom-ref": "V10.4", + "identifier": "V10.4", + "title": "OAuth 인가 서버", + "parent": "V10" + }, + { + "bom-ref": "V10.4.1", + "identifier": "V10.4.1", + "text": "인가 서버는 클라이언트 별로 사전 등록된 URI의 허용 목록을 기반으로 리디렉션 URI를 정확한 문자열 비교 방식으로 검증해야 한다.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.2", + "identifier": "V10.4.2", + "text": "인가 서버가 인가 응답에서 인가 코드를 반환하는 경우, 해당 코드는 토큰 요청에 한번만 사용될 수 있어야 한다. 이미 액세스 토큰을 발급하는 데 사용된 인가 코드를 사용하여 두 번째 요청이 발생하면, 인가 서버는 토큰 요청을 거부하고 해당 인가 코드와 관련된 모든 발급된 토큰을 취소해야 한다.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.3", + "identifier": "V10.4.3", + "text": "인가 코드가 단기간만 유효한지 검증해야 한다. 최대 수명은 L1 및 L2 애플리케이션의 경우 최대 10분, L3 애플리케이션의 경우 최대 1분 이내여야 한다.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.4", + "identifier": "V10.4.4", + "text": "인가 서버는 특정 클라이언트에 대해, 해당 클라이언트가 사용할 필요가 있는 인가 방식(grant)만 사용하도록 허용해야 한다. token(암시적 플로우) 및 password(리소스 소유자 비밀번호 자격 증명 플로우) 방식은 더 이상 사용되어서는 안 된다.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.5", + "identifier": "V10.4.5", + "text": "인가 서버가 공개 클라이언트에 대한 리프레시 토큰 재사용 공격을 완화하는지 검증해야 한다. 가급적이면 발신자 제약 리프레시 토큰, 즉 소유 증명이나 mTLS를 사용한 인증서 바인딩 액세스 토큰을 사용해야 한다. L1 및 L2 애플리케이션의 경우, 리프레시 토큰 회전(rotation)이 사용될 수 있다. 리프레시 토큰 회전이 사용되는 경우, 인가 서버는 리프레시 토큰을 사용 후 무효화해야 하며, 이미 사용되고 무효화된 리프레시 토큰이 제공되면 해당 인가에 대한 모든 리프레시 토큰을 철회(revoke)해야 한다.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.6", + "identifier": "V10.4.6", + "text": "코드 인가 방식(code grant)이 사용되는 경우, 인가 서버가 PKCE를 요구하여 인가 코드 탈취 공격을 완화하는지 검증해야 한다. 인가 요청의 경우, 인가 서버는 유효한 'code_challenge' 값을 요구해야 하며, 'code_challenge_method'값으로 'plain'를 허용해서는 안 된다. 토큰 요청의 경우, 'code_verifier' 파라미터의 검증을 요구해야 한다.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.7", + "identifier": "V10.4.7", + "text": "인가 서버가 인증되지 않은 동적 클라이언트 등록을 지원하는 경우, 악의적인 클라이언트 애플리케이션의 위험을 완화하는지 검증해야 한다. 등록된 URI와 같은 클라이언트 메타데이터를 검증하고, 사용자의 동의를 확인해야 하며, 신뢰할 수 없는 클라이언트 애플리케이션으로 인가 요청을 처리하기 전에 사용자에게 경고해야 한다.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.8", + "identifier": "V10.4.8", + "text": "슬라이딩 리프레시 토큰 만료(expiration)가 적용되더라도, 리프레시 토큰에 절대 만료 시점(absolute expiration)이 포함되어 있는지 확인한다.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.9", + "identifier": "V10.4.9", + "text": "악의적인 클라이언트 또는 도난된 토큰의 위험을 완화하기 위해 인가 서버 사용자 인터페이스를 통해 권한 있는 사용자가 리프레시 토큰 및 참조 액세스 토큰을 철회할 수 있는지 검증해야 한다.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.10", + "identifier": "V10.4.10", + "text": "토큰 요청, 푸시된 인가 요청(Pushed Authorization Request; PAR), 토큰 철회 요청과 같은 클라이언트에서 인가 서버로의 백채널 요청(backchannel request)에 대해 기밀 클라이언트가 인증되는지 검증해야 한다.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.11", + "identifier": "V10.4.11", + "text": "인가 서버 구성이 OAuth 클라이언트에 필요한 범위만 할당하는지 검증해야 한다.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.12", + "identifier": "V10.4.12", + "text": "주어진 클라이언트에 대해 인가 서버가 해당 클라이언트가 사용해야 하는 'response_mode' 값만 허용하는지 검증해야 한다. 예를 들어, 인가 서버가 이 값을 예상 값과 비교하여 검증하거나, PAR 또는 JWT 기반 인가 요청(JWT-secured Authorization Request; JAR)을 사용하여 검증해야 한다.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.13", + "identifier": "V10.4.13", + "text": "인가 유형 'code'가 항상 PAR과 함께 사용되는지 검증해야 한다.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.14", + "identifier": "V10.4.14", + "text": "인가 서버가 mTLS를 사용하는 인증서 바인딩 액세스 토큰 또는 소유 증명 바인딩 액세스 토큰을 사용하여 발신자 제약(Proof-of-Possession) 액세스 토큰만 발급하는지 검증해야 한다.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.15", + "identifier": "V10.4.15", + "text": "최종 사용자 장치에서 실행되지 않는 서버에서 동작하는 클라이언트의 경우, 인가 서버가 'authorization_details' 파라미터 값이 클라이언트 백엔드로부터 생성되었는지와 사용자가 해당 값을 변조되지 않았는지를 검증해야 한다. 예를 들어, PAR 또는 JAR의 사용을 요구하여 확인해야 한다.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.16", + "identifier": "V10.4.16", + "text": "클라이언트가 기밀 클라이언트인지 검증하고, 인가 서버는 재사용 공격에 강하고 공개키 암호화에 기반한 강력한 클라이언트 인증 방식을 사용하도록 요구해야 한다. 예를 들어, mTLS(tls_client_auth, self_signed_tls_client_auth) 또는 비공개 키 기반 JWT 인증(private_key_jwt) 등이 이에 해당한다.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.5", + "identifier": "V10.5", + "title": "OIDC 클라이언트", + "parent": "V10" + }, + { + "bom-ref": "V10.5.1", + "identifier": "V10.5.1", + "text": "신뢰 당사자로서 클라이언트가 ID 토큰 재사용 공격을 완화하는지 검증해야 한다. 예를 들어, ID 토큰의 'nonce' 클레임이 OpenID 공급자에 전송된 인증 요청(OAuth2에서는 인가 서버에 전송된 인가 요청)에서 전송된 'nonce' 값과 일치하는지 확인해야 한다.", + "parent": "V10.5" + }, + { + "bom-ref": "V10.5.2", + "identifier": "V10.5.2", + "text": "클라이언트가 ID 토큰 클레임, 일반적으로 'sub' 클레임에서 사용자를 고유하게 식별하며, 해당 클레임이 ID 공급자 범위 내에서 다른 사용자에게 재할당될 수 없는지 검증해야 한다.", + "parent": "V10.5" + }, + { + "bom-ref": "V10.5.3", + "identifier": "V10.5.3", + "text": "클라이언트는 악의적인 인가 서버가 인가 서버 메타데이터를 통해 다른 인가 서버를 가장하려는 시도를 거부하는지 검증해야 한다. 클라이언트는 인가 서버 메타데이터에 포함된 발급자(issuer) URL이 클라이언트가 예상하는 사전 구성된 발급자 URL과 정확히 일치하지 않는 경우, 해당 메타데이터를 거부해야 한다.", + "parent": "V10.5" + }, + { + "bom-ref": "V10.5.4", + "identifier": "V10.5.4", + "text": "클라이언트는 토큰의 aud 클레임 값이 클라이언트의 client_id 값과 동일한지 확인하여 ID 토큰이 해당 클라이언트(audience)를 대상으로 발급되었음을 검증해야 한다.", + "parent": "V10.5" + }, + { + "bom-ref": "V10.5.5", + "identifier": "V10.5.5", + "text": "OIDC 백채널 로그아웃을 사용하는 경우, 신뢰 당사자는 강제 로그아웃을 통한 서비스 거부 공격(Denial of Service) 및 로그아웃 플로우에서의 JWT 혼동(cross-JWT confusion)을 완화하는지 검증해야 한다. 클라이언트는 로그아웃 토큰이 'logout+jwt' 값으로 올바르게 지정되어 있는지, 올바른 멤버 이름을 가진 'event' 클레임을 포함하는지, 그리고 'nonce' 클레임을 포함하지 않는지 검증해야 한다. 또한, 짧은 만료 시간(예: 2분)을 갖는 것이 권장된다.", + "parent": "V10.5" + }, + { + "bom-ref": "V10.6", + "identifier": "V10.6", + "title": "OpenID 공급자", + "parent": "V10" + }, + { + "bom-ref": "V10.6.1", + "identifier": "V10.6.1", + "text": "OpenID 공급자는 response_mode 파라미터 값으로'code', 'ciba', 'id_token' 또는 'id_token code' 만 허용하는지 검증해야 한다. 이 중 'id_token code'(OIDC 하이브리드 플로우)보다는 'code'가 선호되며, 'token'(모든 암시적 플로우)은 사용되어서는 안 된다.", + "parent": "V10.6" + }, + { + "bom-ref": "V10.6.2", + "identifier": "V10.6.2", + "text": "OpenID 공급자가 강제 로그아웃을 통한 서비스 거부 공격을 완화하는지 검증해야 한다. 신뢰 당사자로 부터 시작된 로그아웃 요청에 id_token_hint 등의 파라미터가 포함되어 있는 경우, 이를 검증하거나 최종 사용자로부터 명시적인 확인을 받아야 한다.", + "parent": "V10.6" + }, + { + "bom-ref": "V10.7", + "identifier": "V10.7", + "title": "동의 관리", + "parent": "V10" + }, + { + "bom-ref": "V10.7.1", + "identifier": "V10.7.1", + "text": "인가 서버가 사용자로부터 각 인가 요청에 대한 명시적인 동의(consent)를 확인하는지 검증해야 한다. 클라이언트의 신원을 보장할 수 없는 경우, 인가 서버는 항상 사용자에게 명시적으로 동의를 요청해야 한다.", + "parent": "V10.7" + }, + { + "bom-ref": "V10.7.2", + "identifier": "V10.7.2", + "text": "인가 서버가 사용자 동의를 요청할 때, 동의하는 내용에 대한 충분하고 명확한 정보를 제공하는지 검증해야 한다. 이에 해당하는 경우, 요청된 인가의 성격(일반적으로 범위, 리소스 서버, RAR(Rich Authorization Requests) 인가 세부 정보 기반), 인가된 애플리케이션의 신원, 인가의 유효 기간이 포함되어야 한다.", + "parent": "V10.7" + }, + { + "bom-ref": "V10.7.3", + "identifier": "V10.7.3", + "text": "사용자가 인가 서버를 통해 부여한 동의를 검토, 수정 및 철회할 수 있는지 검증해야 한다.", + "parent": "V10.7" + }, + { + "bom-ref": "V11", + "identifier": "V11", + "title": "암호화" + }, + { + "bom-ref": "V11.1", + "identifier": "V11.1", + "title": "암호화 인벤토리 및 문서화", + "parent": "V11" + }, + { + "bom-ref": "V11.1.1", + "identifier": "V11.1.1", + "text": "'NIST SP 800-57'과 같은 암호화 키 관리 및 키 관리 표준을 따르는 암호화 키 수명 주기에 대한 문서화 된 정책이 있는지 검증해야 한다. 여기에는 키가 과도하게 공유되지 않도록 하는 것이 포함된다(예: 공유 비밀의 경우 두 개를 초과하는 엔터티와 공유 및 개인 키의 경우 한 개를 초과하는 엔터티에 공유).", + "parent": "V11.1" + }, + { + "bom-ref": "V11.1.2", + "identifier": "V11.1.2", + "text": "애플리케이션에서 사용되는 모든 암호화 키, 알고리즘, 인증서를 포함한 암호화 자산 목록(cryptographic inventory)이 작성되고, 유지되며, 정기적으로 업데이트되고 있는지 검증해야 한다. 또한, 각 키가 시스템 내에서 사용 가능한 위치와 사용이 제한되는 위치, 해당 키로 보호할 수 있는 데이터 유형과 보호할 수 없는 데이터 유형이 문서화되어 있어야 한다.", + "parent": "V11.1" + }, + { + "bom-ref": "V11.1.3", + "identifier": "V11.1.3", + "text": "암호화, 해싱, 서명 작업을 포함하는 시스템 내의 모든 암호화 사용 사례를 식별하기 위해, 암호화 사용 탐지 메커니즘이 적용되는지 검증해야 한다.", + "parent": "V11.1" + }, + { + "bom-ref": "V11.1.4", + "identifier": "V11.1.4", + "text": "암호화 자산 목록이 유지 관리되는지 검증해야 한다. 여기에는 미래의 위협에 대응하기 위해 양자 내성 암호(Post-Quantum Cryptography; PQC)와 같은 새로운 암호화 표준으로의 마이그레이션 계획을 설명하는 문서화된 계획이 포함되어야 한다.", + "parent": "V11.1" + }, + { + "bom-ref": "V11.2", + "identifier": "V11.2", + "title": "안전한 암호화 구현", + "parent": "V11" + }, + { + "bom-ref": "V11.2.1", + "identifier": "V11.2.1", + "text": "암호화 작업에 업계에서 검증된 구현(라이브러리 및 하드웨어 가속 구현 포함)이 사용되는지 검증해야 한다.", + "parent": "V11.2" + }, + { + "bom-ref": "V11.2.2", + "identifier": "V11.2.2", + "text": "난수, 인증 암호화, MAC, 해싱 알고리즘, 키 길이, 라운드, 암호 및 모드를 언제든지 재구성, 업그레이드 또는 교체하여 암호화 해독으로부터 보호할 수 있도록 애플리케이션이 암호화 유연성(crypto agility)을 갖추고 설계되었는지 검증해야 한다. 또한, 키와 비밀번호를 교체하고 데이터를 다시 암호화하는 것도 가능해야 한다. 이를 통해 승인된 PQC 체계(또는 표준)의 고신뢰 구현이 널리 사용 가능해지면 PQC로 원활하게 업그레이드할 수 있다.", + "parent": "V11.2" + }, + { + "bom-ref": "V11.2.3", + "identifier": "V11.2.3", + "text": "모든 암호화 기본 구성요소(primitive)가 알고리즘, 키 크기 및 구성에 따라 최소 128비트의 보안강도를 제공하는지 검증해야 한다. 예를 들어, 256비트 ECC 키는 대략 128비트의 보안을 제공하며, RSA는 128비트의 보안을 달성하기 위해 3072비트 키를 필요로 한다.", + "parent": "V11.2" + }, + { + "bom-ref": "V11.2.4", + "identifier": "V11.2.4", + "text": "민감한 정보가 누출되는 것을 방지하기 위해 모든 암호화 연산은 상수 시간(constant-time)으로 수행되어야 하며, 비교, 계산, 반환 과정에서 단락(short-circuit) 연산이 없는지 검증해야 한다.", + "parent": "V11.2" + }, + { + "bom-ref": "V11.2.5", + "identifier": "V11.2.5", + "text": "모든 암호화 모듈이 안전하게 실패하고, 패딩 오라클 공격(Padding Oracle attacks)과 같은 취약점을 허용하지 않는 방식으로 오류가 처리되는지 검증해야 한다.", + "parent": "V11.2" + }, + { + "bom-ref": "V11.3", + "identifier": "V11.3", + "title": "암호화 알고리즘", + "parent": "V11" + }, + { + "bom-ref": "V11.3.1", + "identifier": "V11.3.1", + "text": "안전하지 않은 블록 모드(예: ECB) 및 약한 패딩 방식(예: PKCS#1 v1.5)가 사용되지 않는지 검증해야 한다.", + "parent": "V11.3" + }, + { + "bom-ref": "V11.3.2", + "identifier": "V11.3.2", + "text": "GCM을 사용하는 AES와 같이 승인된 암호 및 모드만 사용되는지 검증해야 한다.", + "parent": "V11.3" + }, + { + "bom-ref": "V11.3.3", + "identifier": "V11.3.3", + "text": "암호화 된 데이터가 승인된 인증된 암호화 방식을 사용하거나, 승인된 암호화 방식과 승인된 MAC 알고리즘을 조합을 통한 무단 수정으로부터 보호되는지 검증해야 한다.", + "parent": "V11.3" + }, + { + "bom-ref": "V11.3.4", + "identifier": "V11.3.4", + "text": "논스(nonces), 초기화 벡터 및 기타 단일 사용 번호가 둘 이상의 암호화 키 및 데이터 요소 쌍에 사용되지 않는지 검증해야 한다. 생성 방법은 사용되는 알고리즘에 적합해야 한다.", + "parent": "V11.3" + }, + { + "bom-ref": "V11.3.5", + "identifier": "V11.3.5", + "text": "암호화 알고리즘과 MAC 알고리즘의 모든 조합이 암호화 후 MAC(Encrypt-then-MAC) 방식으로 동작하는지 검증해야 한다.", + "parent": "V11.3" + }, + { + "bom-ref": "V11.4", + "identifier": "V11.4", + "title": "해싱 및 해시 기반 함수", + "parent": "V11" + }, + { + "bom-ref": "V11.4.1", + "identifier": "V11.4.1", + "text": "디지털 서명, HMAC, KDF 및 무작위 비트 생성을 포함한 일반적인 암호화 사용 사례에 승인된 해시 함수만 사용되는지 검증해야 한다. MD5와 같이 허용되지 않는 해시 함수는 어떤 암호화 목적으로도 사용해서는 안 된다.", + "parent": "V11.4" + }, + { + "bom-ref": "V11.4.2", + "identifier": "V11.4.2", + "text": "비밀번호가 승인된 '계산 집약적인 키 유도 함수(\"비밀번호 해싱 함수\"라고도 함)'를 사용하여 저장되고, 파라미터 설정이 현재 지침에 따라 구성되었는지 검증해야 한다. 설정은 필요한 보안 수준에 대한 무차별 대입 공격을 충분히 어렵게 만들기 위해 보안과 성능의 균형을 이루어야 한다.", + "parent": "V11.4" + }, + { + "bom-ref": "V11.4.3", + "identifier": "V11.4.3", + "text": "데이터 인증 또는 데이터 무결성의 일부로 디지털 서명에 사용되는 해시 함수가 충돌 저항성을 가지며 적절한 비트 길이를 갖는지 검증해야 한다. 충돌 저항성이 필요한 경우, 출력 길이는 최소 256비트여야 한다. 제2 역상(pre-image) 공격 저항성만 필요한 경우, 출력 길이는 최소 128비트여야 한다.", + "parent": "V11.4" + }, + { + "bom-ref": "V11.4.4", + "identifier": "V11.4.4", + "text": "비밀번호로부터 비밀 키를 유도할 때 애플리케이션이 키 스트레칭(key stretching) 파라미터를 사용하여 승인된 키 유도 함수(key derivation function)를 사용하는지 검증해야 한다. 사용 중인 파라미터는 결과적인 암호화 키를 손상시키는 무차별 대입 공격을 방지하기 위해 보안과 성능의 균형을 이루어야 한다.", + "parent": "V11.4" + }, + { + "bom-ref": "V11.5", + "identifier": "V11.5", + "title": "무작위 값", + "parent": "V11" + }, + { + "bom-ref": "V11.5.1", + "identifier": "V11.5.1", + "text": "예측 불가능해야 하는 모든 난수 및 문자열이 암호학적으로 안전한 의사 난수 생성기(CSPRNG)를 사용하여 생성되고 최소 128비트의 엔트로피를 갖는지 검증해야 한다. UUID는 이 조건을 충족하지 않는다.", + "parent": "V11.5" + }, + { + "bom-ref": "V11.5.2", + "identifier": "V11.5.2", + "text": "사용 중인 난수 생성 메커니즘이 높은 부하(heavy demand)에서도 안전하게 작동하도록 설계되었는지 검증해야 한다.", + "parent": "V11.5" + }, + { + "bom-ref": "V11.6", + "identifier": "V11.6", + "title": "공개 키 암호화", + "parent": "V11" + }, + { + "bom-ref": "V11.6.1", + "identifier": "V11.6.1", + "text": "키 생성 및 시딩, 디지털 서명 생성 및 검증에 승인된 암호화 알고리즘 및 작동 모드만 사용되는지 검증해야 한다. 키 생성 알고리즘은 알려진 공격에 취약한 안전하지 않은 키(예: 페르마 인수분해(Fermat factorization)에 취약한 RSA 키)를 생성해서는 안 된다.", + "parent": "V11.6" + }, + { + "bom-ref": "V11.6.2", + "identifier": "V11.6.2", + "text": "키 교환에는 디피-헬만과 같은 승인된 암호화 알고리즘이 사용되어야 하며, 안전한 파라미터를 사용하는지 여부를 중점적으로 검증해야 한다.이는 중간자 공격(adversary-in-the-middle attacks) 또는 암호화 해독으로 이어질 수 있는 키 설정 프로세스에 대한 공격을 방지할 것이다.", + "parent": "V11.6" + }, + { + "bom-ref": "V11.7", + "identifier": "V11.7", + "title": "사용 중 데이터 암호화", + "parent": "V11" + }, + { + "bom-ref": "V11.7.1", + "identifier": "V11.7.1", + "text": "사용 중인 민감한 데이터를 보호하고 무단 사용자 또는 프로세스의 접근을 방지하기 위해 전체 메모리 암호화가 사용되는지 검증해야 한다.", + "parent": "V11.7" + }, + { + "bom-ref": "V11.7.2", + "identifier": "V11.7.2", + "text": "데이터 최소화가 처리 중에 노출되는 데이터의 양을 최소화하고, 사용 직후 또는 가능한 한 빨리 데이터가 암호화되도록 보장하는지 검증해야 한다.", + "parent": "V11.7" + }, + { + "bom-ref": "V12", + "identifier": "V12", + "title": "보안 통신" + }, + { + "bom-ref": "V12.1", + "identifier": "V12.1", + "title": "일반 TLS 보안 가이드", + "parent": "V12" + }, + { + "bom-ref": "V12.1.1", + "identifier": "V12.1.1", + "text": "TLS 1.2 및 TLS 1.3과 같은 최신 권장 버전의 TLS 프로토콜만 활성화되어 있으며, 그중 최신 버전이 우선되어야 한다.", + "parent": "V12.1" + }, + { + "bom-ref": "V12.1.2", + "identifier": "V12.1.2", + "text": "오직 권장되는 암호화 스위트(cipher suites)들이 활성화되어 있으며 그 중 가장 강력한 암호화 스위트로 우선 설정되어 있는지 확인한다. 레벨3 애플리케이션은 순방향 비밀성(forward secrecy)을 제공하는 암호화 스위트만 지원해야 한다.", + "parent": "V12.1" + }, + { + "bom-ref": "V12.1.3", + "identifier": "V12.1.3", + "text": "인증이나 권한 부여를 위해 인증서 ID를 사용하기 전에 애플리케이션이 mTLS 클라이언트 인증서가 신뢰할 수 있는지 검증해야 한다.", + "parent": "V12.1" + }, + { + "bom-ref": "V12.1.4", + "identifier": "V12.1.4", + "text": "Online Certificate Status Protocol (OCSP) 스테이플링(Stapling)과 같은 적절한 인증서 폐지 프로토콜이 활성화되고 설정되어 있는지 확인해야 한다.", + "parent": "V12.1" + }, + { + "bom-ref": "V12.1.5", + "identifier": "V12.1.5", + "text": "TLS 핸드셰이크 프로세스 중 Server Name Indication (SNI)과 같은 민감한 메타 데이터의 노출을 방지하기 위해 애플리케이션 TLS 설정에서 Encrypted Client Hello (ECH)가 활성화되어 있는지 확인해야 한다.", + "parent": "V12.1" + }, + { + "bom-ref": "V12.2", + "identifier": "V12.2", + "title": "외부 서비스와의 HTTPS 통신", + "parent": "V12" + }, + { + "bom-ref": "V12.2.1", + "identifier": "V12.2.1", + "text": "TLS는 클라이언트와 외부 HTTP 기반 서비스 간의 모든 연결에 사용되며, 안전하지 않거나 암호화 되어 있지 않은 통신에 대체 동작(fall back)이 발생하지 않는지 확인해야한다. ", + "parent": "V12.2" + }, + { + "bom-ref": "V12.2.2", + "identifier": "V12.2.2", + "text": "외부 서비스가 공적으로 신뢰된 TLS 인증서를 사용하는지 확인해야 한다.", + "parent": "V12.2" + }, + { + "bom-ref": "V12.3", + "identifier": "V12.3", + "title": "일반 서비스 간의 통신 보안", + "parent": "V12" + }, + { + "bom-ref": "V12.3.1", + "identifier": "V12.3.1", + "text": "애플리케이션간의 모니터링 시스템, 관리 도구, 원격 엑세스 및 SSH, 미들웨어, 데이터베이스, 메인프레임, 파트너 시스템이나 외부 API를 포함한 모든 인바운드와 아웃바운드 통신은 TLS같은 암호화 프로토콜이 사용되는지 확인해야 한다. 이 서버는 안전하지 않거나 암호화 되어있지 않은 프로토콜에 대체 동작(fall back)이 발생하지 않아야 한다.", + "parent": "V12.3" + }, + { + "bom-ref": "V12.3.2", + "identifier": "V12.3.2", + "text": "TLS 클라이언트가 통신하기 전에 TLS서버로 부터 받은 인증서를 검증하는지 확인해야 한다.", + "parent": "V12.3" + }, + { + "bom-ref": "V12.3.3", + "identifier": "V12.3.3", + "text": "그리고 TLS 또는 애플리케이션 내의 내부 HTTP 기반 서비스간에 사용된 다른 적절한 전송 암호화 매커니즘이 안전하지 않거나 암호화 되어있지 않은 통신에 대체 동작(fall back)이 발생하지 않는지 확인해야 한다.", + "parent": "V12.3" + }, + { + "bom-ref": "V12.3.4", + "identifier": "V12.3.4", + "text": "내부 서버간에 TLS 통신이 신뢰된 인증서를 사용하는지 확인해야 한다. 내부 인증서나 자체 서명(self-signed)인증서를 사용할 경우, 이를 사용하는 서비스는 오직 특정 내부 인증기관(CA)과 자체 서명 인증만을 신뢰하게 설정해야 한다.", + "parent": "V12.3" + }, + { + "bom-ref": "V12.3.5", + "identifier": "V12.3.5", + "text": "시스템 내부에서 통신하는 서비스(intra-service communication)는 각 엔드포인트를 검증하기 위해 강력한 인증을 사용해야 한다. 공용키(public-key) 기반 구조와 재전송 공격(replay attacks)에 저항하는 매커니즘을 사용하여 신원보장을 위해 TLS 클라이언트 인증과 같은 강력한 인증 방식을 사용해야 한다. 마이크로서비스 아키텍쳐의 경우 인증서 관리를 간소화 하고 보안을 강화하기 위해 서비스 매시(service mesh)를 사용하는 것을 고려해야 한다.", + "parent": "V12.3" + }, + { + "bom-ref": "V13", + "identifier": "V13", + "title": "설정" + }, + { + "bom-ref": "V13.1", + "identifier": "V13.1", + "title": "설정 문서", + "parent": "V13" + }, + { + "bom-ref": "V13.1.1", + "identifier": "V13.1.1", + "text": "애플리케이션의 모든 통신 요구사항이 문서화 되어 있는지를 검증한다. 이는 애플리케이션이 의존하는 외부 서비스나, 사용자가 애플리케이션이 연결할 외부 위치를 제공하는 경우들을 포함한다.", + "parent": "V13.1" + }, + { + "bom-ref": "V13.1.2", + "identifier": "V13.1.2", + "text": "애플리케이션이 사용하는 각각의 서비스들에 대해, 문서가 최대 동시 연결 수(연결 풀 제한)를 정의하고 있는지, 그리고 그 한계에 다다랐을 때 폴백(fallback)이나 복구 메커니즘 등을 포함하여, DoS 공격을 방지하기 위해 애플리케이션이 어떻게 동작하는지를 검증한다.", + "parent": "V13.1" + }, + { + "bom-ref": "V13.1.3", + "identifier": "V13.1.3", + "text": "애플리케이션 문서가 모든 외부 시스템이나 애플리케이션이 사용하는 서비스(예시: 데이터베이스, 파일 핸들, 스레드, HTTP 연결)들에 대한 자원-관리 전략을 정의하고 있는지 검증한다.이는 자원-해제 프로시저, 시간초과 설정, 오류 핸들링을 포함하며, 재시도 로직이 구현된 경우 재시도 제한과 지연, 백-오프 알고리즘을 명시해야 한다. 동기 HTTP 요청-응답 명령에 대해서는 짧은 타임아웃에 더해 재시도의 비활성화 혹은 연쇄적인 지연과 자원 고갈을 방지하기 위한 재시도의 엄격한 제한을 의무화해야 한다.", + "parent": "V13.1" + }, + { + "bom-ref": "V13.1.4", + "identifier": "V13.1.4", + "text": "애플리케이션 문서가 조직의 위협 모델과 사업적 요구사항에 기반하여, 애플리케이션의 보안과 비밀 정보들의 주기적 갱신 일정에 치명적인 비밀 정보들을 정의하고 있는지 검증한다.", + "parent": "V13.1" + }, + { + "bom-ref": "V13.2", + "identifier": "V13.2", + "title": "백엔드 통신 설정", + "parent": "V13" + }, + { + "bom-ref": "V13.2.1", + "identifier": "V13.2.1", + "text": "API나 미들웨어와 같은 애플리케이션의 표준 사용자 세션 메커니즘을 지원하지 않는 백엔드 애플리케이션 컴포넌트와 데이터 계층 사이의 통신이 인증되어 있는지를 검증한다. 인증은 반드시 개별적인 서비스 계정과 단기간 토큰, 또는 인증서 기반 인증을 사용하고 비밀번호, API 키, 또는 접근 권한이 부여된 공유 계정 등의 자격 증명을 변경하지 않아선 안 된다. ", + "parent": "V13.2" + }, + { + "bom-ref": "V13.2.2", + "identifier": "V13.2.2", + "text": "로컬 또는 운영체제 서비스, API, 미들웨어, 그리고 데이터 계층을 포함한 백엔드 애플리케이션 컴포넌트 간의 통신이 최소 필요 권한이 할당된 계정들로 수행되는지 검증한다.", + "parent": "V13.2" + }, + { + "bom-ref": "V13.2.3", + "identifier": "V13.2.3", + "text": "만약 자격 증명이 서비스 인증을 위해 필요하다면, 소비자로부터 사용되는 그 자격 증명이 기본 자격 증명이 아님을 검증한다. (예시: root/root 또는 admin/admin)", + "parent": "V13.2" + }, + { + "bom-ref": "V13.2.4", + "identifier": "V13.2.4", + "text": "얼로우리스트가 애플리케이션의 통신이 허가된 외부 리소스나 시스템을 정의하기 위해 사용되는지 검증한다. (예시: 아웃바운드 요청, 데이터 로드, 파일 접근). 이 얼로우리스트는 애플리케이션 계층, 웹 서버, 방화벽 또는 다른 여러 계층의 조합으로 구현할 수 있다. ", + "parent": "V13.2" + }, + { + "bom-ref": "V13.2.5", + "identifier": "V13.2.5", + "text": "웹이나 애플리케이션 서버에 요청을 보내거나 데이터나 파일을 로드 할 수 있는 리소스 또는 시스템의 얼로우리스트가 설정되어 있는지를 검증한다.", + "parent": "V13.2" + }, + { + "bom-ref": "V13.2.6", + "identifier": "V13.2.6", + "text": "애플리케이션이 별도의 서비스와 연결할 때, 각 연결이 최대 병렬연결, 최대 연결 도달 시의 동작, 연결 타임아웃, 재시도 전략 등 문서화된 설정에 따르는지 검증한다.", + "parent": "V13.2" + }, + { + "bom-ref": "V13.3", + "identifier": "V13.3", + "title": "비밀 정보 관리", + "parent": "V13" + }, + { + "bom-ref": "V13.3.1", + "identifier": "V13.3.1", + "text": "키 볼트와 같은 비밀 정보 관리 솔루션이 백엔드 비밀 정보들을 만들고 저장하고, 접근을 제어하고, 파기하기 위해 사용되고 있는지 검증한다. 이는 비밀번호, 키 재료, 데이터베이스와 서드 파티 시스템의 통합, 시간-기반 토큰을 위한 키와 시드, 그리고 API 키들을 포함할 수 있다. 비밀 정보들은 애플리케이션 소스 코드 내부나, 빌드 아티팩트에 포함되어서는 안 된다. L3 애플리케이션에 대해서는, 반드시 HSM과 같은 하드웨어 기반 솔루션을 사용해야 한다.", + "parent": "V13.3" + }, + { + "bom-ref": "V13.3.2", + "identifier": "V13.3.2", + "text": "비밀 정보 자원들에 대한 접근이 최소 권한의 원칙을 고수하는지 검증한다.", + "parent": "V13.3" + }, + { + "bom-ref": "V13.3.3", + "identifier": "V13.3.3", + "text": "보안 모듈에 대한 외부의 노출로부터 안전하게 키 재료를 관리하고 보호하기 위해 모든 암호 연산이 고립된 보안 모듈(볼트나, 하드웨어 보안 모듈 등)을 사용하여 수행되는지 검증한다.", + "parent": "V13.3" + }, + { + "bom-ref": "V13.3.4", + "identifier": "V13.3.4", + "text": "애플리케이션의 문서를 기반으로 비밀 정보들이 만료되고 갱신되도록 설정되었는지 검증한다.", + "parent": "V13.3" + }, + { + "bom-ref": "V13.4", + "identifier": "V13.4", + "title": "의도하지 않은 정보 노출", + "parent": "V13" + }, + { + "bom-ref": "V13.4.1", + "identifier": "V13.4.1", + "text": "애플리케이션이 .git 이나 .svn 폴더 같은 소스 코드 관리 메타데이터 없이 배포되었는지, 또는 이 폴더들이 외부적으로든 애플리케이션 자체에서든 접근할 수 없도록 배포되었는지 검증한다. ", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.2", + "identifier": "V13.4.2", + "text": "실제 운영환경에서 디버깅 기능 노출이나 정보 누출을 방지하기 위해, 모든 컴포넌트에서 디버그 모드가 비활성화되어 있는지 검증한다.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.3", + "identifier": "V13.4.3", + "text": "분명히 의도된 것이 아닌 이상 웹 서버가 폴더 목록을 클라이언트에게 노출하지 않는지 검증한다.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.4", + "identifier": "V13.4.4", + "text": "잠재적인 정보 누출을 방지하기 위해 실제 운영환경에서 HTTP TRACE 메소드 사용이 지원되지 않는지 검증한다. ", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.5", + "identifier": "V13.4.5", + "text": "분명히 의도된 것이 아닌 이상 문서(내부 API 같은)와 모니터링 엔드포인트가 노출되지 않는지 검증한다.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.6", + "identifier": "V13.4.6", + "text": "애플리케이션이 백엔드 컴포넌트의 자세한 버전 정보를 노출하지 않는지 검증한다.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.7", + "identifier": "V13.4.7", + "text": "웹 계층이 의도적이지 않은 정보, 설정, 소스코드 누출을 방지하기 위해 특정 파일 확장자만 서비스하도록 설정되었는지 검증한다.", + "parent": "V13.4" + }, + { + "bom-ref": "V14", + "identifier": "V14", + "title": "데이터 보호" + }, + { + "bom-ref": "V14.1", + "identifier": "V14.1", + "title": "데이터 보호 문서화", + "parent": "V14" + }, + { + "bom-ref": "V14.1.1", + "identifier": "V14.1.1", + "text": "애플리케이션이 생성하고 처리하는 모든 민감한 데이터가 식별되고 보호 수준으로 분류되었는지 확인한다. 여기에는 단순히 인코딩되어 있고 쉽게 디코딩할 수 있는 데이터, 예를 들어 Base64 문자열이나 JWT 내부 평문 페이로드가 포함된다. 보호 수준은 애플리케이션이 준수해야 하는 모든 데이터 보호 및 개인정보 보호 관련 규정과 표준을 반드시 고려해야 한다.", + "parent": "V14.1" + }, + { + "bom-ref": "V14.1.2", + "identifier": "V14.1.2", + "text": "모든 민감한 데이터의 보호 수준에 대해 문서화된 요구사항이 있는지 확인한다. 반드시 여기에는(이에 한정되지 않지만) 일반적인 암호화, 무결성 검증, 보존 기간, 데이터 로그 기록 방식, 로그 내 민감한 데이터에 대한 접근 제어, 데이터베이스 암호화 수준, 사용할 개인정보 보호 및 개인정보 보호 강화 기술, 그리고 기타 기밀성 요구사항들 관련하여 포함되어야 한다.", + "parent": "V14.1" + }, + { + "bom-ref": "V14.2", + "identifier": "V14.2", + "title": "일반 데이터 보호", + "parent": "V14" + }, + { + "bom-ref": "V14.2.1", + "identifier": "V14.2.1", + "text": "민감한 데이터는 HTTP 메시지 본문이나 헤더 필드로만 서버에 전송되고, URL과 쿼리 문자열에는 API키나 세션토큰처럼 민감한 정보가 포함되지 않도록 검증한다.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.2", + "identifier": "V14.2.2", + "text": "서버 구성 요소에서 로드밸런서나 애플리케이션 캐시와 같은 민감한 데이터가 캐시되지 않게 하거나, 사용 후 해당 데이터를 안전하게 삭제하도록 검증한다.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.3", + "identifier": "V14.2.3", + "text": "정의된 민감한 데이터가 애플리케이션의 통제를 벗어난 곳에서 원치 않는 수집을 예방하기 위해 신뢰할 수 없는 대상(예: 사용자 추적기)에게 전송되지 않도록 검증한다.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.4", + "identifier": "V14.2.4", + "text": "암호화, 무결성 검증, 보존, 데이터 로그 기록 방식, 로그 내 민감한 데이터 접근 제어, 개인정보 보호 및 개인정보 보호 강화 기술과 관련된 민감한 데이터 통제가, 해당 데이터 보호 수준에 대한 문서에 정의된 대로 구현되었는지 검증한다.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.5", + "identifier": "V14.2.5", + "text": "캐시 메커니즘이 해당 리소스에 대해 예상되는 콘텐츠 유형을 가진 응답만 캐시하고, 민감하거나 동적인 콘텐츠는 캐시하지 않도록 구성되어 있는지 검증한다. 존재하지 않는 파일에 접근했을 때 다른 유효한 파일을 반환하는 대신 웹 서버는 404 또는 302 응답을 반환해야 한다. 이는 Web Cache Deception 공격을 예방한다.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.6", + "identifier": "V14.2.6", + "text": "애플리케이션 기능에 필요한 최소한의 민감한 데이터만 반환을 검증한다. 예를 들어, 전체 신용카드 번호가 아닌 일부 숫자만 반환해야 한다. 만약 전체 데이터가 필요한 경우, 사용자가 구체적으로 조회하지 않는 한 사용자 인터페이스에서는 마스킹하는 것이 권장된다.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.7", + "identifier": "V14.2.7", + "text": "민감한 정보는 데이터 보존 분류 기준에 따라 관리되어야 하고, 오래되었거나 불필요한 데이터는 사전에 정의된 작업 또는 상황에 따라 자동으로 삭제되도록 검증한다.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.8", + "identifier": "V14.2.8", + "text": "사용자가 제출한 파일의 메타데이터에서 사용자가 저장에 동의하지 않는 한 민감한 정보는 제거를 검증한다.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.3", + "identifier": "V14.3", + "title": "클라이언트 측 데이터 보호", + "parent": "V14" + }, + { + "bom-ref": "V14.3.1", + "identifier": "V14.3.1", + "text": "클라이언트나 세션이 종료된 후에 브라우저 DOM과 같은 클라이언트 스토리지에서 인증된 데이터를 삭제되는지 검증한다. 이를 위해 ‘Clear-Site-Data’ HTTP 응답 헤더 필드를 사용할 수 있으나, 세션 종료 시 서버 연결이 불가능한 경우에도 클라이언트 측에서 해당 데이터를 삭제하는 것이 권장된다.", + "parent": "V14.3" + }, + { + "bom-ref": "V14.3.2", + "identifier": "V14.3.2", + "text": "애플리케이션이 브라우저에서 민감한 데이터가 캐시되지 않도록, (Cache-Control: no-store)충분한 캐시 방지 HTTP 응답 헤더 필드를 설정을 검증한다.", + "parent": "V14.3" + }, + { + "bom-ref": "V14.3.3", + "identifier": "V14.3.3", + "text": "브라우저 저장소(localStorage, sessionStorage, IndexedDB, 쿠키)에 저장되는 데이터에는 세션 토큰을 제외한 민감 데이터가 포함되지 않도록 검증한다.", + "parent": "V14.3" + }, + { + "bom-ref": "V15", + "identifier": "V15", + "title": "보안 코딩 및 아키텍처" + }, + { + "bom-ref": "V15.1", + "identifier": "V15.1", + "title": "보안 코딩 및 아키텍처 문서화", + "parent": "V15" + }, + { + "bom-ref": "V15.1.1", + "identifier": "V15.1.1", + "text": "애플리케이션 문서에 취약점이 존재하는 서드파티 구성요소 버전 및 일반적인 라이브러리 업데이트에 대해, 해당 구성요소로부터 발생할 수 있는 위험을 최소화하기 위한 위험 기반 대응 기한이 정의되어 있는지 확인해야 한다.", + "parent": "V15.1" + }, + { + "bom-ref": "V15.1.2", + "identifier": "V15.1.2", + "text": "사용 중인 모든 서드파티 라이브러리에 대해 소프트웨어 자재 명세서(SBOM)와 같은 인벤토리가 유지되고 있으며, 해당 구성요소가 사전에 정의된 신뢰할 수 있고 지속적으로 관리되는 저장소에서 제공되는지 확인해야 한다.", + "parent": "V15.1" + }, + { + "bom-ref": "V15.1.3", + "identifier": "V15.1.3", + "text": "애플리케이션 문서에 시간 소모가 크거나 리소스 소비가 많은 기능이 식별되어 있으며, 해당 기능의 과도한 사용으로 인해 가용성이 손실되지 않도록 하는 방법과, 응답 생성이 소비자의 타임아웃보다 오래 걸리는 상황을 방지하는 방법이 포함되어 있는지 확인해야 한다. 가능한 방어 전략에는 비동기 처리, 큐(queue) 사용, 사용자 및 애플리케이션 단위의 병렬 처리 제한 등이 있다.", + "parent": "V15.1" + }, + { + "bom-ref": "V15.1.4", + "identifier": "V15.1.4", + "text": "애플리케이션 문서에 위험한 구성요소로 간주되는 서드파티 라이브러리가 강조되어 있는지 확인해야 한다.", + "parent": "V15.1" + }, + { + "bom-ref": "V15.1.5", + "identifier": "V15.1.5", + "text": "애플리케이션 문서에 위험한 기능을 사용하는 애플리케이션의 부분이 강조되어 있는지 확인해야 한다.", + "parent": "V15.1" + }, + { + "bom-ref": "V15.2", + "identifier": "V15.2", + "title": "보안 아키텍처 및 종속성", + "parent": "V15" + }, + { + "bom-ref": "V15.2.1", + "identifier": "V15.2.1", + "text": "애플리케이션이 문서화된 업데이트 및 대응 기한을 위반하지 않은 구성요소만 포함하고 있는지 확인해야 한다.", + "parent": "V15.2" + }, + { + "bom-ref": "V15.2.2", + "identifier": "V15.2.2", + "text": "애플리케이션이 시간 소모가 크거나 리소스 소비가 많은 기능의 과도한 사용으로 인한 가용성 손실을 방지하기 위해, 해당 기능에 대한 문서화된 보안 결정 및 전략을 기반으로 방어 조치를 구현하고 있는지 확인해야 한다.", + "parent": "V15.2" + }, + { + "bom-ref": "V15.2.3", + "identifier": "V15.2.3", + "text": "운영 환경에 애플리케이션 기능 수행에 필요한 기능만 포함되어 있으며, 테스트 코드, 샘플 코드, 개발용 기능 등 불필요한 기능이 노출되지 않도록 구성되어 있는지 확인해야 한다.", + "parent": "V15.2" + }, + { + "bom-ref": "V15.2.4", + "identifier": "V15.2.4", + "text": "서드파티 구성요소 및 그 모든 전이 종속성(transitive dependencies)이 내부 또는 외부의 예상된 저장소에서 가져며, 의존성 혼동(dependency confusion) 공격의 위험이 없는지 확인해야 한다.", + "parent": "V15.2" + }, + { + "bom-ref": "V15.2.5", + "identifier": "V15.2.5", + "text": "애플리케이션이 위험한 기능을 포함하거나 위험한 구성요소를 사용하는 부분에 대해 샌드박싱, 캡슐화, 컨테이너화, 네트워크 수준 격리와 같은 추가적인 보호 기법을 구현하여, 애플리케이션의 한 부분이 침해되더라도 공격자가 다른 영역으로 확산하지 못하도록 지연 및 차단하고 있는지 확인해야 한다.", + "parent": "V15.2" + }, + { + "bom-ref": "V15.3", + "identifier": "V15.3", + "title": "방어적(Defensive) 코딩", + "parent": "V15" + }, + { + "bom-ref": "V15.3.1", + "identifier": "V15.3.1", + "text": "애플리케이션이 데이터 객체에서 필요한 필드만 선택적으로 반환하고 있는지 확인해야 한다. 예를 들어, 일부 필드는 사용자에게 노출되어서는 안 되므로 전체 데이터 객체를 반환해서는 안 된다.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.2", + "identifier": "V15.3.2", + "text": "애플리케이션 백엔드에서 외부 URL로 요청을 보낼 때, 의도된 기능이 아닌 경우 리디렉션을 따르지 않도록 구성되어 있는지 확인해야 한다.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.3", + "identifier": "V15.3.3", + "text": "애플리케이션이 각 컨트롤러 및 액션 단위로 허용된 필드를 제한함으로써, 대량 할당(mass assignment) 공격에 대한 방어가 구현되어 있는지 확인해야 한다. 예를 들어, 특정 동작에 포함되지 않은 필드 값을 삽입하거나 수정할 수 없어야 한다.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.4", + "identifier": "V15.3.4", + "text": "모든 프록시 및 미들웨어 구성요소가 사용자의 원래 IP 주소를 신뢰 가능한 데이터 필드를 통해 정확하게 전달하고 있으며, 애플리케이션과 웹 서버가 이 값을 로그 기록이나 속도 제한(rate limiting)과 같은 보안 결정에 사용하는지 확인해야 한다. 단, 동적 IP, VPN, 방화벽 등으로 인해 원래 IP조차 완전히 신뢰할 수 없는 점도 고려해야 한다.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.5", + "identifier": "V15.3.5", + "text": "애플리케이션이 변수의 타입이 올바른지 명시적으로 확인하고, 엄격한 동등성 비교 및 연산자를 사용하여 타입 혼용(type juggling) 또는 타입 혼동(type confusion)으로 인한 취약점을 방지하고 있는지 확인해야 한다.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.6", + "identifier": "V15.3.6", + "text": "JavaScript 코드가 프로토타입 오염(prototype pollution)을 방지할 수 있도록 작성되어 있는지 확인해야 한다. 예를 들어, 객체 리터럴 대신 `Set()` 또는 `Map()`을 사용하는 방식이 권장된다.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.7", + "identifier": "V15.3.7", + "text": "애플리케이션이 HTTP 파라미터 오염(HTTP parameter pollution) 공격에 대한 방어를 구현하고 있는지 확인해야 한다. 특히, 애플리케이션 프레임워크가 요청 파라미터의 출처(쿼리 스트링, 본문, 쿠키, 헤더)를 구분하지 않는 경우 이를 고려해야 한다.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.4", + "identifier": "V15.4", + "title": "안전한 동시성", + "parent": "V15" + }, + { + "bom-ref": "V15.4.1", + "identifier": "V15.4.1", + "text": "다중 스레드 코드에서 캐시, 파일, 다수 스레드가 접근하는 메모리 내 객체 등 공유 객체에 접근할 때, 스레드 세이프(thread-safe) 타입과 락·세마포어 같은 동기화 메커니즘을 사용하여 경쟁 상태와 데이터 손상을 피하고 안전하게 접근하는지 확인해야 한다.", + "parent": "V15.4" + }, + { + "bom-ref": "V15.4.2", + "identifier": "V15.4.2", + "text": "리소스의 존재 여부나 권한과 같은 상태 검사와, 그 검사 결과에 의존하는 동작이 단일(atomic) 연산으로 수행되어 TOCTOU 경쟁 상태를 방지하는지 확인해야 한다. (예: 파일을 열기 전에 존재 여부를 확인하는 작업과 파일 열기 동작을 분리하지 않기, 접근 권한 검증과 권한 부여를 동일 트랜잭션/원자적 구간에서 수행하기)", + "parent": "V15.4" + }, + { + "bom-ref": "V15.4.3", + "identifier": "V15.4.3", + "text": "스레드가 서로를 기다리거나 무한 재시도에 빠지지 않도록 일관된 락 사용을 보장하고, 락 관리 로직을 리소스 관리 책임 코드 내부에 유지하여 외부 클래스 및 코드가 우발적·악의적으로 락을 변경하지 못하도록 하는지 확인해야 한다.", + "parent": "V15.4" + }, + { + "bom-ref": "V15.4.4", + "identifier": "V15.4.4", + "text": "**스레드 풀** 활용 등 **리소스 할당 정책**을 통해 공정한 리소스 접근을 보장하고, 우선순위가 낮은 스레드도 합리적 시간 내 진행될 수 있게 하여 **스레드 기아**를 방지하는지 확인해야 한다.", + "parent": "V15.4" + }, + { + "bom-ref": "V16", + "identifier": "V16", + "title": "보안 로깅과 오류 처리" + }, + { + "bom-ref": "V16.1", + "identifier": "V16.1", + "title": "보안 로깅 문서화", + "parent": "V16" + }, + { + "bom-ref": "V16.1.1", + "identifier": "V16.1.1", + "text": "애플리케이션의 기술 스택의 각 계층에서 수행된 로깅에 대해, 어떤 이벤트들이 로그로 남았는지, 로그의 형식이 무엇인지, 로그가 어디에 저장되었는지, 어떻게 사용되는지, 로그에 대한 접근이 어떻게 제어되는지, 그리고 로그가 얼마나 보관되는지에 대해 문서화한 목록이 존재하는지 검증한다.", + "parent": "V16.1" + }, + { + "bom-ref": "V16.2", + "identifier": "V16.2", + "title": "일반 로깅", + "parent": "V16" + }, + { + "bom-ref": "V16.2.1", + "identifier": "V16.2.1", + "text": "이벤트가 발생했을 때 그 타임라인을 자세히 조사할 수 있도록 각 로그의 항목이 필수적인 메타데이터(언제, 어디서, 누가, 무엇을 등)을 포함하는지 검증한다. ", + "parent": "V16.2" + }, + { + "bom-ref": "V16.2.2", + "identifier": "V16.2.2", + "text": "모든 로깅 컴포넌트의 시간 소스가 동기화되어 있는지, 그리고 보안 이벤트 메타데이터에서 타임스탬프가 UTC를 사용하거나 혹은 명시적인 시간대 오프셋을 포함하는지 검증한다. UTC는 분산 시스템 전체에 걸친 일관성을 보장하고, 일광 절약 시간제 전환 시의 혼란을 방지하기 위해 추천된다.", + "parent": "V16.2" + }, + { + "bom-ref": "V16.2.3", + "identifier": "V16.2.3", + "text": "애플리케이션이 로그를 저장만 하는지, 혹은 로그 목록에서 문서화 된 파일이나 서비스로 브로드캐스트하는지 검증한다.", + "parent": "V16.2" + }, + { + "bom-ref": "V16.2.4", + "identifier": "V16.2.4", + "text": "사용 중인 로그 처리기가 로그를 읽고, 또 상호 연관 지을 수 있는지 검증한다. 가능하다면 공통 로깅 형식을 사용하는 것이 좋다.", + "parent": "V16.2" + }, + { + "bom-ref": "V16.2.5", + "identifier": "V16.2.5", + "text": "민감한 데이터를 로깅할때, 애플리케이션이 데이터의 보호 수준을 기반으로 로깅을 수행하는지 검증한다. 예를 들어, 자격 증명이나, 지불 상세 정보 등의 특정 데이터는 로깅 해서는 안 된다. 또한 세션 토큰 등의 데이터는 전체 혹은 일부분이 해싱된, 마스킹 된 상태로 로깅 되어야 한다.", + "parent": "V16.2" + }, + { + "bom-ref": "V16.3", + "identifier": "V16.3", + "title": "보안 이벤트", + "parent": "V16" + }, + { + "bom-ref": "V16.3.1", + "identifier": "V16.3.1", + "text": "성공한 시도와 실패한 시도를 포함하여 모든 인증 명령을 로깅 하는지 검증한다. 인증의 종류나, 사용한 인증 요소 등의 추가적인 메타데이터 또한 수집해야 한다.", + "parent": "V16.3" + }, + { + "bom-ref": "V16.3.2", + "identifier": "V16.3.2", + "text": "실패한 인가 시도들도 로깅 하는지 검증한다. L3에 대해서는 반드시 민감한 데이터가 접근되었을 때를 포함하여(민감한 데이터 자체는 제외하고) 모든 인가 결정들의 로그를 포함해야 한다.", + "parent": "V16.3" + }, + { + "bom-ref": "V16.3.3", + "identifier": "V16.3.3", + "text": "애플리케이션이 이 문서에서 정의한 보안 이벤트들을 로깅하고, 또한 입력값 확인, 비즈니스 로직, 그리고 자동화 방지 등의 보안 제어를 우회하려는 시도들도 로깅 하는지 검증한다.", + "parent": "V16.3" + }, + { + "bom-ref": "V16.3.4", + "identifier": "V16.3.4", + "text": "애플리케이션이 백엔드 TLS 오류와 같은 예상치 못한 오류나 보안 제어 오류들을 로깅 하는지 검증한다.", + "parent": "V16.3" + }, + { + "bom-ref": "V16.4", + "identifier": "V16.4", + "title": "로그 보호", + "parent": "V16" + }, + { + "bom-ref": "V16.4.1", + "identifier": "V16.4.1", + "text": "로그 삽입을 방지하기 위해 모든 로깅 컴포넌트가 적절히 데이터를 인코딩하는지 검증한다.", + "parent": "V16.4" + }, + { + "bom-ref": "V16.4.2", + "identifier": "V16.4.2", + "text": "로그가 비인가된 접근으로부터 보호되고 수정할 수 없는지 검증한다.", + "parent": "V16.4" + }, + { + "bom-ref": "V16.4.3", + "identifier": "V16.4.3", + "text": "분석, 탐지, 경보, 그리고 에스컬레이션(escalation)을 위해 로그가 논리적으로 분리된 시스템으로 안전하게 전송되는지 검증한다. 애플리케이션이 침해되더라도 로그는 훼손하지 못하도록 보장하는 것이 목적이다.", + "parent": "V16.4" + }, + { + "bom-ref": "V16.5", + "identifier": "V16.5", + "title": "오류 처리", + "parent": "V16" + }, + { + "bom-ref": "V16.5.1", + "identifier": "V16.5.1", + "text": "예상치 못한 혹은 보안 측면에서 민감한 오류가 발생했을 때 스택 흔적, 쿼리, 비밀키, 그리고 토큰 등의 민감한 내부 시스템 데이터의 노출 방지를 보장하기 위해 유저에게 구체화하지 않은 메시지를 반환하는지 검증한다.", + "parent": "V16.5" + }, + { + "bom-ref": "V16.5.2", + "identifier": "V16.5.2", + "text": "외부 리소스 접근 오류가 발생하더라도 애플리케이션이 계속해서 안전하게 작동하는지 검증한다. 예를 들어 서킷 브레이커(circuit breaker)나 우아한 성능 저하와 같은 패턴을 사용할 수 있다.", + "parent": "V16.5" + }, + { + "bom-ref": "V16.5.3", + "identifier": "V16.5.3", + "text": "예외가 발생할 때, 검증 로직의 오류에도 불구하고 거래를 처리하는 등의 페일-오픈(fail-open) 상태 방지를 포함하여 애플리케이션이 우아하고 안전하게 실패하는지 검증한다. ", + "parent": "V16.5" + }, + { + "bom-ref": "V16.5.4", + "identifier": "V16.5.4", + "text": "처리되지 못한 모든 예외를 처리할 “최후의 수단” 오류 핸들러가 정의되어 있는지 검증한다. 이는 로그 파일에 기록되어야 하는 오류 상세 정보들의 손실을 피하기 위함과 동시에, 오류로 인해 전체 애플리케이션 프로세스가 종료되어 가용성 손실로 이어지지 않도록 보장하기 위함이다. ", + "parent": "V16.5" + }, + { + "bom-ref": "V17", + "identifier": "V17", + "title": "WebRTC" + }, + { + "bom-ref": "V17.1", + "identifier": "V17.1", + "title": "TURN 서버", + "parent": "V17" + }, + { + "bom-ref": "V17.1.1", + "identifier": "V17.1.1", + "text": "Traversal Using Relays around NAT(TURN) 서비스가 특정 목적을 위해 보존된 주소(예: 내부 네트워크, 브로드캐스트, 루프백)를 제외한 주소에 대해서만 접근을 허용하도록 한다.", + "parent": "V17.1" + }, + { + "bom-ref": "V17.1.2", + "identifier": "V17.1.2", + "text": "Traversal Using Relays around NAT(TURN) 서비스가 정당한 사용자의 TURN 서버 포트의 대량 개방 시 자원고갈에 취약하지 않도록 한다.", + "parent": "V17.1" + }, + { + "bom-ref": "V17.2", + "identifier": "V17.2", + "title": "미디어", + "parent": "V17" + }, + { + "bom-ref": "V17.2.1", + "identifier": "V17.2.1", + "text": "데이터그램 전송 계층 보안(DTLS) 인증서의 키가 암호화 키 관리에 대한 문서화된 정책에 따라 관리되고 보호되는지 확인해야 한다.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.2", + "identifier": "V17.2.2", + "text": "미디어 서버가 승인된 데이터그램 전송 계층 보안(DTLS) 암호 모음을 사용하고 지원하도록 구성되었는지, 그리고 보안 실시간 전송 프로토콜(DTLS-SRTP)을 위한 키 생성에 사용되는 DTLS 확장을 위한 안전한 보호 프로파일을 구성했는지 확인해야 한다.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.3", + "identifier": "V17.2.3", + "text": "미디어 서버에서 보안 실시간 전송 프로토콜(SRTP) 인증이 선택되어 있는지 확인한다. 이를 통해 실시간 전송 프로토콜(RTP) 삽입 공격으로 인한 서비스 거부 상태 발생 또는 오디오/비디오 미디어가 미디어 스트림에 삽입되는 것을 방지할 수 있다.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.4", + "identifier": "V17.2.4", + "text": "미디어 서버가 잘못된 형식의 보안 실시간 전송 프로토콜(SRTP) 패킷을 접했을 때도 수신 미디어 트래픽 처리를 계속할 수 있는지 확인해야 한다.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.5", + "identifier": "V17.2.5", + "text": "미디어 서버가 정상 사용자로부터의 보안 실시간 전송 프로토콜(SRTP) 패킷이 대량으로 유입되는 상황에서도 수신 미디어 트래픽 처리를 계속할 수 있는지 확인해야 한다.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.6", + "identifier": "V17.2.6", + "text": "미디어 서버가 Datagram Transport Layer Security(DTLS)의 “ClientHello” 경합 조건 취약점에 노출되지 않았는지 확인해야 한다. 이를 위해 해당 미디어 서버가 공개적으로 취약한 것으로 알려져 있는지 확인하거나 경합 조건 테스트를 수행해야 한다.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.7", + "identifier": "V17.2.7", + "text": "미디어 서버와 연결된 모든 오디오 또는 비디오 녹화 장치가 합법적인 사용자로부터의 보안 실시간 전송 프로토콜(SRTP) 패킷이 대량으로 유입되는 상황에서도 수신 미디어 트래픽 처리를 계속할 수 있는지 확인해야 한다.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.8", + "identifier": "V17.2.8", + "text": "데이터그램 전송 계층 보안(DTLS) 인증서가 세션 설명 프로토콜(SDP) 지문 속성과 대조되어 검증되었는지 확인하고, 검증이 실패할 경우 미디어 스트림을 종료하여 미디어 스트림의 진위성을 보장해야 한다.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.3", + "identifier": "V17.3", + "title": "신호 처리", + "parent": "V17" + }, + { + "bom-ref": "V17.3.1", + "identifier": "V17.3.1", + "text": "신호 서버가 플러드 공격 중에도 합법적인 수신 신호 메시지 처리를 계속할 수 있는지 확인해야 한다. 이는 신호 수준에서 속도 제한을 구현함으로써 달성되어야 한다.", + "parent": "V17.3" + }, + { + "bom-ref": "V17.3.2", + "identifier": "V17.3.2", + "text": "서비스 거부 상태를 유발할 수 있는 잘못된 형식의 신호 메시지를 접했을 때 신호 서버가 정상적인 신호 메시지 처리를 계속할 수 있는지 확인해야 한다. 여기에는 입력 검증 구현, 정수 오버플로우 안전 처리, 버퍼 오버플로우 방지 및 기타 강력한 오류 처리 기법 적용이 포함될 수 있다.", + "parent": "V17.3" + } + ], + "levels": [ + { + "bom-ref": "level-1", + "identifier": "Level 1", + "description": "This level contains the minimum requirements to consider when securing an application and represents a critical starting point.", + "requirements": [ + "V1.2.1", + "V1.2.2", + "V1.2.3", + "V1.2.4", + "V1.2.5", + "V1.3.1", + "V1.3.2", + "V1.5.1", + "V2.1.1", + "V2.2.1", + "V2.2.2", + "V2.3.1", + "V3.2.1", + "V3.2.2", + "V3.3.1", + "V3.4.1", + "V3.4.2", + "V3.5.1", + "V3.5.2", + "V3.5.3", + "V4.1.1", + "V4.4.1", + "V5.2.1", + "V5.2.2", + "V5.3.1", + "V5.3.2", + "V6.1.1", + "V6.2.1", + "V6.2.2", + "V6.2.3", + "V6.2.4", + "V6.2.5", + "V6.2.6", + "V6.2.7", + "V6.2.8", + "V6.3.1", + "V6.3.2", + "V6.4.1", + "V6.4.2", + "V7.2.1", + "V7.2.2", + "V7.2.3", + "V7.2.4", + "V7.4.1", + "V7.4.2", + "V8.1.1", + "V8.2.1", + "V8.2.2", + "V8.3.1", + "V9.1.1", + "V9.1.2", + "V9.1.3", + "V9.2.1", + "V10.4.1", + "V10.4.2", + "V10.4.3", + "V10.4.4", + "V10.4.5", + "V11.3.1", + "V11.3.2", + "V11.4.1", + "V12.1.1", + "V12.2.1", + "V12.2.2", + "V13.4.1", + "V14.2.1", + "V14.3.1", + "V15.1.1", + "V15.2.1", + "V15.3.1" + ] + }, + { + "bom-ref": "level-2", + "identifier": "Level 2", + "description": "ASVS Level 2 requirements generally relate to either less common attacks or more complicated protections against common attacks. They may still be a first layer of defense, or they may require certain preconditions for the attack to be successful.", + "requirements": [ + "V1.1.1", + "V1.1.2", + "V1.2.6", + "V1.2.7", + "V1.2.8", + "V1.2.9", + "V1.3.3", + "V1.3.4", + "V1.3.5", + "V1.3.6", + "V1.3.7", + "V1.3.8", + "V1.3.9", + "V1.3.10", + "V1.3.11", + "V1.4.1", + "V1.4.2", + "V1.4.3", + "V1.5.2", + "V2.1.2", + "V2.1.3", + "V2.2.3", + "V2.3.2", + "V2.3.3", + "V2.3.4", + "V2.4.1", + "V3.3.2", + "V3.3.3", + "V3.3.4", + "V3.4.3", + "V3.4.4", + "V3.4.5", + "V3.4.6", + "V3.5.4", + "V3.5.5", + "V3.7.1", + "V3.7.2", + "V4.1.2", + "V4.1.3", + "V4.2.1", + "V4.3.1", + "V4.3.2", + "V4.4.2", + "V4.4.3", + "V4.4.4", + "V5.1.1", + "V5.2.3", + "V5.4.1", + "V5.4.2", + "V5.4.3", + "V6.1.2", + "V6.1.3", + "V6.2.9", + "V6.2.10", + "V6.2.11", + "V6.2.12", + "V6.3.3", + "V6.3.4", + "V6.4.3", + "V6.4.4", + "V6.5.1", + "V6.5.2", + "V6.5.3", + "V6.5.4", + "V6.5.5", + "V6.6.1", + "V6.6.2", + "V6.6.3", + "V6.8.1", + "V6.8.2", + "V6.8.3", + "V6.8.4", + "V7.1.1", + "V7.1.2", + "V7.1.3", + "V7.3.1", + "V7.3.2", + "V7.4.3", + "V7.4.4", + "V7.4.5", + "V7.5.1", + "V7.5.2", + "V7.6.1", + "V7.6.2", + "V8.1.2", + "V8.2.3", + "V8.4.1", + "V9.2.2", + "V9.2.3", + "V9.2.4", + "V10.1.1", + "V10.1.2", + "V10.2.1", + "V10.2.2", + "V10.3.1", + "V10.3.2", + "V10.3.3", + "V10.3.4", + "V10.4.6", + "V10.4.7", + "V10.4.8", + "V10.4.9", + "V10.4.10", + "V10.4.11", + "V10.5.1", + "V10.5.2", + "V10.5.3", + "V10.5.4", + "V10.5.5", + "V10.6.1", + "V10.6.2", + "V10.7.1", + "V10.7.2", + "V10.7.3", + "V11.1.1", + "V11.1.2", + "V11.2.1", + "V11.2.2", + "V11.2.3", + "V11.3.3", + "V11.4.2", + "V11.4.3", + "V11.4.4", + "V11.5.1", + "V11.6.1", + "V12.1.2", + "V12.1.3", + "V12.3.1", + "V12.3.2", + "V12.3.3", + "V12.3.4", + "V13.1.1", + "V13.2.1", + "V13.2.2", + "V13.2.3", + "V13.2.4", + "V13.2.5", + "V13.3.1", + "V13.3.2", + "V13.4.2", + "V13.4.3", + "V13.4.4", + "V13.4.5", + "V14.1.1", + "V14.1.2", + "V14.2.2", + "V14.2.3", + "V14.2.4", + "V14.3.2", + "V14.3.3", + "V15.1.2", + "V15.1.3", + "V15.2.2", + "V15.2.3", + "V15.3.2", + "V15.3.3", + "V15.3.4", + "V15.3.5", + "V15.3.6", + "V15.3.7", + "V16.1.1", + "V16.2.1", + "V16.2.2", + "V16.2.3", + "V16.2.4", + "V16.2.5", + "V16.3.1", + "V16.3.2", + "V16.3.3", + "V16.3.4", + "V16.4.1", + "V16.4.2", + "V16.4.3", + "V16.5.1", + "V16.5.2", + "V16.5.3", + "V17.1.1", + "V17.2.1", + "V17.2.2", + "V17.2.3", + "V17.2.4", + "V17.3.1", + "V17.3.2" + ] + }, + { + "bom-ref": "level-3", + "identifier": "Level 3", + "description": "ASVS Level 3 should be the goal for applications looking to demonstrate the highest levels of security and requirements in this section are generally either defense-in-depth mechanisms or other useful but hard-to-implement controls.", + "requirements": [ + "V1.2.10", + "V1.3.12", + "V1.5.3", + "V2.3.5", + "V2.4.2", + "V3.1.1", + "V3.2.3", + "V3.3.5", + "V3.4.7", + "V3.4.8", + "V3.5.6", + "V3.5.7", + "V3.5.8", + "V3.6.1", + "V3.7.3", + "V3.7.4", + "V3.7.5", + "V4.1.4", + "V4.1.5", + "V4.2.2", + "V4.2.3", + "V4.2.4", + "V4.2.5", + "V5.2.4", + "V5.2.5", + "V5.2.6", + "V5.3.3", + "V6.3.5", + "V6.3.6", + "V6.3.7", + "V6.3.8", + "V6.4.5", + "V6.4.6", + "V6.5.6", + "V6.5.7", + "V6.5.8", + "V6.6.4", + "V6.7.1", + "V6.7.2", + "V7.5.3", + "V8.1.3", + "V8.1.4", + "V8.2.4", + "V8.3.2", + "V8.3.3", + "V8.4.2", + "V10.2.3", + "V10.3.5", + "V10.4.12", + "V10.4.13", + "V10.4.14", + "V10.4.15", + "V10.4.16", + "V11.1.3", + "V11.1.4", + "V11.2.4", + "V11.2.5", + "V11.3.4", + "V11.3.5", + "V11.5.2", + "V11.6.2", + "V11.7.1", + "V11.7.2", + "V12.1.4", + "V12.1.5", + "V12.3.5", + "V13.1.2", + "V13.1.3", + "V13.1.4", + "V13.2.6", + "V13.3.3", + "V13.3.4", + "V13.4.6", + "V13.4.7", + "V14.2.5", + "V14.2.6", + "V14.2.7", + "V14.2.8", + "V15.1.4", + "V15.1.5", + "V15.2.4", + "V15.2.5", + "V15.4.1", + "V15.4.2", + "V15.4.3", + "V15.4.4", + "V16.5.4", + "V17.1.2", + "V17.2.5", + "V17.2.6", + "V17.2.7", + "V17.2.8" + ] + } + ], + "externalReferences": [ + { + "type": "website", + "url": "https://owasp.org/asvs" + }, + { + "type": "vcs", + "url": "https://github.com/OWASP/ASVS" + }, + { + "type": "issue-tracker", + "url": "https://github.com/OWASP/ASVS/issues" + }, + { + "type": "social", + "url": "https://twitter.com/OWASP_ASVS" + } + ] + } + ] + } +} diff --git a/5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.csv b/5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.csv new file mode 100644 index 0000000000..58fd2bdac5 --- /dev/null +++ b/5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.csv @@ -0,0 +1,347 @@ +chapter_id,chapter_name,section_id,section_name,req_id,req_description,L +V1,인코딩과 데이터 정제,V1.1,인코딩 및 데이터 정제 아키텍처,V1.1.1,"입력값 검증은 오직 한 번만 표준 형태로 디코딩 되거나 언이스케이프 되어야 하며, 인코딩된 데이터가 예상될 때만 디코딩 되어야 한다. 이 과정은 입력이 추가로 처리되기 전에 완료되어야 한다. 예를 들어서 입력값 검증이나 데이터 정제 이후에는 수행되면 안 된다.",2 +V1,인코딩과 데이터 정제,V1.1,인코딩 및 데이터 정제 아키텍처,V1.1.2,애플리케이션이 출력값 인코딩 또는 이스케이핑을 인터프리터가 사용하기 전의 최종 단계로 수행하거나 인터프리터 자체에서 처리하는지 검증해야 한다.,2 +V1,인코딩과 데이터 정제,V1.2,인젝션(Injection) 방지,V1.2.1,"HTTP 응답, HTML 문서 또는 XML 문서에 대한 출력값 인코딩이 해당 컨텍스트에 적절한지 검증해야 한다. 예를 들어, 메시지나 문서 구조가 변경되지 않도록 HTML 요소, HTML 속성, HTML 주석, CSS, HTTP 헤더 필드 등에 맞는 문맥별 문자 인코딩이 수행되어야 한다.",1 +V1,인코딩과 데이터 정제,V1.2,인젝션(Injection) 방지,V1.2.2,"통합 자원 식별자(Uniform Resource Locator; URL)들을 동적으로 생성할 때 신뢰할 수 없는 데이터가 해당 컨텍스트에 맞게 인코딩되었는지 검증해야 한다(예: 쿼리나 경로 파라미터에 대한 URL 인코딩 또는 base64url 인코딩). 또한, 오직 안전한 URL 프로토콜만이 허용되는지 검증해야 한다(예: javascript: 또는 data:를 허용하지 않음).",1 +V1,인코딩과 데이터 정제,V1.2,인젝션(Injection) 방지,V1.2.3,동적으로 자바스크립트 콘텐츠(JSON 포함)를 생성할 때 메시지나 문서 구조를 바꾸는 것을 방지하기 위해 출력값 인코딩이나 이스케이핑이 사용되고 있는지 검증해야 한다(자바스크립트 또는 JSON 인젝션을 피하기 위함).,1 +V1,인코딩과 데이터 정제,V1.2,인젝션(Injection) 방지,V1.2.4,"데이터 선택 혹은 데이터베이스 쿼리(예: SQL, HQL, NoSQL, Cypher)들 파라미터화된 쿼리, 객체 관계 매핑(Object Relational Mapping; ORM), 엔티티 프레임워크, 또는 다른 구조화된 쿼리 언어(Structured Query Language; SQL) 인젝션 및 기타 데이터베이스 인젝션 공격으로부터 보호해 주는 것들을 사용하는지 검증해야 한다. 이는 저장 프로시저를 쓸 때도 마찬가지이다.",1 +V1,인코딩과 데이터 정제,V1.2,인젝션(Injection) 방지,V1.2.5,애플리케이션이 운영체제(Operating System; OS) 명령 인젝션으로부터 보호되며 운영체제 호출 시 파라미터화된 OS 쿼리나 상황에 맞는 명령줄 출력값 인코딩을 사용하는지 검증해야 한다.,1 +V1,인코딩과 데이터 정제,V1.2,인젝션(Injection) 방지,V1.2.6,"애플리케이션이 경량 디렉터리 접근 프로토콜(Lightweight Directory Access Protocol; LDAP) 인젝션 취약점에 대해 보호되어 있는지, 또는 LDAP 인젝션을 방지하기 위한 특정 보안 통제가 구현되어 있는지 검증해야 한다.",2 +V1,인코딩과 데이터 정제,V1.2,인젝션(Injection) 방지,V1.2.7,애플리케이션이 XPath 인젝션 공격을 쿼리 파라미터나 미리 컴파일된 쿼리들을 사용해 보호되고 있는지 검증해야 한다.,2 +V1,인코딩과 데이터 정제,V1.2,인젝션(Injection) 방지,V1.2.8,"LaTeX 프로세서가 안전하게 구성되어 있으며(""--shell-escape"" 플래그 비사용 등) LaTeX 인젝션 공격을 방지하기 위해 허용된 명령어 목록이 사용되고 있는지 검증해야 한다.",2 +V1,인코딩과 데이터 정제,V1.2,인젝션(Injection) 방지,V1.2.9,애플리케이션이 정규 표현식에서 특수 문자들을 메타 문자로 잘못 해석하는 것을 방지하기 위해 해당 문자들 이스케이프(보통 백슬래시를 사용)하고 있는지 검증해야 한다.,2 +V1,인코딩과 데이터 정제,V1.2,인젝션(Injection) 방지,V1.2.10,"애플리케이션이 쉼표 구분 데이터(Comma Separated Values; CSV) 및 수식 인젝션에 대해 보호되어 있는지 검증해야 한다. 그리고 애플리케이션은 CSV 콘텐츠를 내보낼 때 RFC 4180 2.6과 2.7 부분에 명시된 이스케이핑 규칙을 반드시 따라야 한다. 또한 CSV나 다른 스프레드시트 포맷(XLS, XLSX, ODF 등)으로 내보낼 때 필드 값의 첫 번째가 특수 문자('=', '+', '-', '@', '\t' (탭), '\0' (null 문자) 포함)라면 반드시 작은따옴표로 이스케이프되어야 한다.",3 +V1,인코딩과 데이터 정제,V1.3,데이터 정제,V1.3.1,위지윅(WYSIWYG) 에디터나 이와 유사한 것으로부터 오는 모든 신뢰할 수 없는 HTML 입력들은 잘 알려지고 안전한 HTML 데이터 정제 라이브러리나 프레임워크 기능을 사용해 정제되는지 검증해야 한다.,1 +V1,인코딩과 데이터 정제,V1.3,데이터 정제,V1.3.2,"애플리케이션이 eval() 또는 스프링 표현 언어(Spring Expression Language; SpEL) 등과 같은 동적 코드 실행 기능 사용을 피하고 있는지 검증해야 한다. 대안이 없는 경우, 실행 전에 포함되는 모든 사용자 입력이 반드시 정제되어야 한다.",1 +V1,인코딩과 데이터 정제,V1.3,데이터 정제,V1.3.3,잠재적으로 위험한 컨텍스트에 전달되는 데이터가 사전에 정제되어 안전 조치가 적용되는지 검증해야 한다. 예를 들어 해당 컨텍스트에서 안전한 문자만 허용하고 너무 긴 입력값은 잘라내는 등의 조치가 포함된다.,2 +V1,인코딩과 데이터 정제,V1.3,데이터 정제,V1.3.4,사용자로부터 제공된 확장 가능한 벡터 그래픽(Scalable Vector Graphics; SVG)의 스크립트 실행 가능 콘텐츠가 애플리케이션에 안전한 태그 및 속성(예: 그래픽 그리기)만 포함하도록 검증 또는 정제되는지 검증해야 한다. 예를 들어 스크립트나 foreignObject는 포함되면 안 된다.,2 +V1,인코딩과 데이터 정제,V1.3,데이터 정제,V1.3.5,"애플리케이션이 사용자로부터 제공된 스크립트 실행 가능하거나 표현식 템플릿 언어(예: 마크다운, CSS, XSL 스타일시트, BBCode ) 콘텐츠를 정제하거나 비활성화하는지 검증해야 한다.",2 +V1,인코딩과 데이터 정제,V1.3,데이터 정제,V1.3.6,"애플리케이션이 서버측 요청 위조(Server-side Request Forgery; SSRF) 공격으로부터 보호하기 위해 신뢰할 수 없는 데이터를 프로토콜, 도메인, 경로, 포트의 허용 목록과 대조해 검증하고 다른 서비스를 호출하기 전에 잠재적으로 위험한 문자를 정제(sanitization)하는지 검증해야 한다.",2 +V1,인코딩과 데이터 정제,V1.3,데이터 정제,V1.3.7,애플리케이션이 템플릿 인젝션 공격으로부터 보호하기 위해 신뢰할 수 없는 입력값을 기반으로 템플릿을 생성하지 않도록 하는지 검증해야 한다. 대안이 없는 경우에는 템플릿 생성 과정에서 동적으로 포함되는 모든 신뢰할 수 없는 입력값은 정제되거나 엄격히 검증되어야 한다.,2 +V1,인코딩과 데이터 정제,V1.3,데이터 정제,V1.3.8,애플리케이션이 자바 명명 및 디렉터리 인터페이스(Java Naming and Directory Interface; JNDI) 쿼리에서 신뢰할 수 없는 입력값을 사용하기 전에 적절히 정제하고 JNDI가 JNDI 인젝션 공격을 방지할 수 있도록 안전하게 구성되어 있는지 검증해야 한다.,2 +V1,인코딩과 데이터 정제,V1.3,데이터 정제,V1.3.9,인젝션을 방지하기 위해 애플리케이션이 메모리 캐시(memcache)에 콘텐츠를 전달하기 전에 해당 데이터를 정제하는지 검증해야 한다. ,2 +V1,인코딩과 데이터 정제,V1.3,데이터 정제,V1.3.10,사용 시 예상치 못하거나 악의적인 방식으로 작동할 수 있는 포맷 스트링(format string)들은 처리되기 전에 정제되는지 검증해야 한다.,2 +V1,인코딩과 데이터 정제,V1.3,데이터 정제,V1.3.11,간이 전자 우편 전송 프로토콜(Simple Mail Transfer Protocol; SMTP)이나 인터넷 메시지 액세스 프로토콜(Internet Message Access Protocol; IMAP) 인젝션으로부터 보호하기 위해 애플리케이션이 사용자 입력을 메일 시스템으로 보내기 전에 정제를 하는지 검증해야 한다.,2 +V1,인코딩과 데이터 정제,V1.3,데이터 정제,V1.3.12,"정규 표현식에 지수형 백트래킹을 유발하는 요소가 없는지, 또한 신뢰할 수 없는 입력값을 정제하여 정규식 기반 서비스 거부 공격(Regular Expression Denial of Service; ReDoS) 또는 런어웨이(Runaway) 정규식 공격을 방지하는지 검증해야 한다.",3 +V1,인코딩과 데이터 정제,V1.4,"메모리, 스트링, 비관리 코드",V1.4.1,"애플리케이션이 스택, 버퍼, 또는 힙 오버플로를 탐지하거나 방지하기 위해 메모리 안전 문자열, 안전한 메모리 복사 및 포인터 산술을 사용하는지 검증해야 한다.",2 +V1,인코딩과 데이터 정제,V1.4,"메모리, 스트링, 비관리 코드",V1.4.2,"정수 오버플로를 방지하기 위해 부호 확인, 범위 검사, 입력값 검증 등의 기법이 사용되고 있는지 검증해야 한다.",2 +V1,인코딩과 데이터 정제,V1.4,"메모리, 스트링, 비관리 코드",V1.4.3,댕글링 포인터(dangling pointer)나 해체 후 사용(Use After Free; UAF) 취약점을 방지하기 위해 동적으로 할당된 메모리와 자원이 적절히 해제되었는지 그리고 해제된 메모리를 참조하는 포인터나 참조가 제거되었거나 null로 설정되었는지를 검증해야 한다.,2 +V1,인코딩과 데이터 정제,V1.5,안전한 역직렬화,V1.5.1,애플리케이션이 확장 가능한 마크업 언어(eXtensible Markup Language; XML) 파서(parser)를 제한적인 설정으로 구성하고 외부 엔티티 해석과 같은 안전하지 않은 기능을 비활성화하여 XML 외부 엔티티(XML eXternal Entity; XXE) 공격을 방지하는지 검증해야 한다.,1 +V1,인코딩과 데이터 정제,V1.5,안전한 역직렬화,V1.5.2,역직렬화 공격을 방지하기 위해 신뢰할 수 없는 데이터의 역직렬화 시 객체 타입 허용 목록 사용 또는 클라이언트 정의 객체 타입 제한과 같은 안전한 입력 처리 방식이 적용되는지 검증해야 한다. 또한 명확히 안전하지 않은 것으로 지정된 역직렬화 메커니즘은 신뢰할 수 없는 입력에 대해 반드시 사용해서는 안 된다.,2 +V1,인코딩과 데이터 정제,V1.5,안전한 역직렬화,V1.5.3,"애플리케이션에서 동일한 데이터 타입(예: JSON 파서, XML 파서, URL 파서)에 대해 사용되는 서로 다른 파서들이 일관된 방식으로 파싱(parsing)을 수행하고 동일한 문자 인코딩 방식을 사용하는지 검증해야 한다. 이를 통해 JSON 상호운용 취약점이나 원격 파일 포함(Remote File Inclusion; RFI) 및 SSRF 공격에서 악용될 수 있는 서로 다른 URI 또는 파일 파싱 동작 문제를 방지할 수 있다.",3 +V2,유효성 검증 및 비즈니스 로직,V2.1,유효성 검증 및 비즈니스 로직 문서화,V2.1.1,"애플리케이션 문서에 데이터 항목이 예상되는 구조에 부합하는지 확인하는 입력값 유효성 검증 규칙이 정의되어 있는지 확인한다. 이는 신용카드 번호, 이메일 주소, 전화번호와 같은 일반적인 데이터 형식일 수도 있고, 내부적으로 사용하는 데이터 형식일 수도 있다.",1 +V2,유효성 검증 및 비즈니스 로직,V2.1,유효성 검증 및 비즈니스 로직 문서화,V2.1.2,"애플리케이션 문서에 연관된 데이터 항목들 간의 논리적, 문맥적 일관성을 검증하는 방법이 정의되어 있는지 검증한다. 예를 들어서 세부 주소와 우편번호가 서로 일치하는지 확인하는 경우가 이에 해당한다.",2 +V2,유효성 검증 및 비즈니스 로직,V2.1,유효성 검증 및 비즈니스 로직 문서화,V2.1.3,비즈니스 로직의 제한사항 및 유효성 검증에 대한 요구사항이 사용자별 기준과 애플리케이션 전체에 적용되는 전역적 기준을 모두 포함하여 문서화되어 있는지 검증한다.,2 +V2,유효성 검증 및 비즈니스 로직,V2.2,입력값 검증,V2.2.1,"입력값에 대한 비즈니스 또는 기능적인 기대치를 충족하기 위해서 입력값의 유효성을 검증해야 한다. 이는 허용 값, 패턴 및 범위 목록에 대한 긍정적 검증을 사용하거나, 미리 정의된 규칙에 따라 입력값을 예상 구조 및 논리적 한계와 비교하여 검증해야 한다. L1의 경우, 특정 비즈니스 또는 보안 결정을 내리는 데 초점을 맞출 수 있다. L2 이상의 경우에는 모든 입력값에 적용해야 한다.",1 +V2,유효성 검증 및 비즈니스 로직,V2.2,입력값 검증,V2.2.2,"애플리케이션이 신뢰할 수 있는 서비스 계층에서 입력값 유효성 검사를 시행하도록 설계되었는지 확인해야 한다. 클라이언트 측 유효성 검사는 사용성을 향상시키므로 권장해야 하지만, 보안 제어 수단으로 의존해서는 안된다.",1 +V2,유효성 검증 및 비즈니스 로직,V2.2,입력값 검증,V2.2.3,사전 정의된 규칙에 따라 관련 데이터 항목의 조합이 합리적인지 애플리케이션에서 확인해야 한다.,2 +V2,유효성 검증 및 비즈니스 로직,V2.3,비즈니스 로직 보안,V2.3.1,애플리케이션이 예상되는 순차적 단계 순서에 따라 동일한 사용자에 대한 비즈니스 로직 흐름만 처리하고 단계를 건너뛰지 않는지 확인한다.,1 +V2,유효성 검증 및 비즈니스 로직,V2.3,비즈니스 로직 보안,V2.3.2,비즈니스 로직 결함이 악용되는 것을 방지하기 위해서 애플리케이션 문서에 따라 비즈니스 로직 제한이 구현되었는지 확인한다.,2 +V2,유효성 검증 및 비즈니스 로직,V2.3,비즈니스 로직 보안,V2.3.3,비즈니스 로직 수준에서 트랜잭션이 사용되고 있는지 확인하여 비즈니스 로직 작업이 완전히 성공하거나 이전의 올바른 상태로 롤백되는지 확인한다.,2 +V2,유효성 검증 및 비즈니스 로직,V2.3,비즈니스 로직 보안,V2.3.4,제한된 양의 리소스(ex. 극장 좌석이나 배송 시간대)가 애플리케이션의 로직을 조작하여 이중으로 예약되는 것을 방지하기 위해서 비즈니스 로직 수준 잠금 메커니즘이 사용되는지 확인한다.,2 +V2,유효성 검증 및 비즈니스 로직,V2.3,비즈니스 로직 보안,V2.3.5,"핵심적인 비즈니스 로직 흐름에 무단 또는 우발적인 행위를 방지하기 위해서 다중 사용자 승인이 필요한지 확인해야 한다. 이는 거액 자금 이체, 계약 승인, 기밀 정보 접근, 제조 과정의 안전 무시 등이 포함될 수 있지만, 이에 국한되지는 않는다.",3 +V2,유효성 검증 및 비즈니스 로직,V2.4,자동화 방지,V2.4.1,"데이터 유출, 더미 데이터 생성, 할당량 소진, 속도 제한 위반, 서비스 거부(DoS), 핵심적인 리소스의 과다 사용으로 이어질 수 있는 애플리케이션 기능에 대한 과도한 호출을 방어하기 위해, 자동화 방지 제어 기능이 구현되어 있는지 검증한다.",2 +V2,유효성 검증 및 비즈니스 로직,V2.4,자동화 방지,V2.4.2,"비즈니스 로직의 각 단계가 실제 사람이 수행하는 데 필요한 현실적인 시간을 요구하여, 비정상적으로 빠른 속도의 트랜잭션 제출을 방지하는지 검증한다.",3 +V3,웹 프론트엔드 보안,V3.1,웹 프론트엔드 보안 문서,V3.1.1,"애플리케이션 공식 문서에서 애플리케이션이 반드시 지원해야 하는, 예상되는 보안 특징들을 서술하고 있는지 확인한다. (예: HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP), 그리고 다른 관련된 HTTP 보안 메커니즘들). 또한 문서에서 앞선 특징들(유저에게나 경고하거나 접속을 막는 등의)이 유효하지 않을 때 애플리케이션이 어떻게 행동하는지 반드시 정의해야 한다.",3 +V3,웹 프론트엔드 보안,V3.2,의도하지 않은 콘텐츠 접근,V3.2.1,"브라우저가 HTTP 응답에 대해 콘텐츠나 기능을 불러올 때, 의도하지 않은 상황이 보안적으로 통제되고 있는지 확인한다(예: API, 유저가 올린 파일, 혹은 다른 리소스에 직접 접근 시). Content-Security-Policy 헤더 필드의 샌드박스 지시어를 사용하거나, Content-Disposition 헤더 필드 내의 attachment disposition 타입을 사용하는 등으로, 불필요한 HTTP 요청 헤더 필드 (Sec-Fetch-* 와 같은)를 제공하지 않을 수 있다.",1 +V3,웹 프론트엔드 보안,V3.2,의도하지 않은 콘텐츠 접근,V3.2.2,"콘텐츠가 HTML로 렌더링되지 않고 텍스트로 표시되도록 하여, HTML이나 JavaScript 등의 의도하지 않은 실행을 방지하는 안전한 렌더링 함수(예: createTextNode, textContent)를 사용하는지 확인한다.",1 +V3,웹 프론트엔드 보안,V3.2,의도하지 않은 콘텐츠 접근,V3.2.3,"애플리케이션이 클라이언트 사이드 JavaScript를 사용할 때, 명시적 변수 사용, 엄격한 타입 검사, 문서에서의 전역 변수 저장 지양, 그리고 네임스페이스 격리 구현 등으로 DOM 클로버링을 막고 있음을 확인한다.",3 +V3,웹 프론트엔드 보안,V3.3,쿠키 설정,V3.3.1,"쿠키가 'Secure' 속성을 가지며, 쿠키 이름에 '\__Host-' 접두사가 사용되지 않았고, '__Secure-' 접두사를 사용했는지 확인한다.",1 +V3,웹 프론트엔드 보안,V3.3,쿠키 설정,V3.3.2,"UI redress 공격, 그리고 CSRF라 알려진 브라우저 기반 요청 위조 공격들에 대한 노출을 제한하기 위해 각 쿠키의 'SameSite' 속성 값이 쿠키의 목적에 맞게 설정되어 있는지 확인한다.",2 +V3,웹 프론트엔드 보안,V3.3,쿠키 설정,V3.3.3,"다른 호스트들과 명시적으로 공유되는 쿠키에 대해서, '__Host-' 접두사를 가지고 있는지 확인한다.",2 +V3,웹 프론트엔드 보안,V3.3,쿠키 설정,V3.3.4,"클라이언트 측 스크립트에서 쿠키의 값에 접근이 가능한 걸 의도하지 않았다면(세션 토큰 등), 쿠키는 반드시 'HttpOnly' 속성을 가져야 하고, 반드시 'Set-Cookie' 헤더 필드를 통해 클라이언트에게 전달돼야 한다.",2 +V3,웹 프론트엔드 보안,V3.3,쿠키 설정,V3.3.5,"애플리케이션이 쿠키를 만들 때, 쿠키 이름과 값의 길이 합이 4096바이트를 넘지 않는지 확인한다. 너무 큰 쿠키는 브라우저에 저장되지 않으며, 요청 전달도 안되고, 해당 쿠키에 의존하는 애플리케이션 기능을 사용하지 못하게 된다.",3 +V3,웹 프론트엔드 보안,V3.4,브라우저 보안 메커니즘 헤더,V3.4.1,"이 섹션에서는 애플리케이션의 응답을 처리할 때 브라우저의 보안 기능과, 제한 사항을 활성화하기 위해 HTTP 응답에 설정해야 하는 보안 헤더를 설명한다.",1 +V3,웹 프론트엔드 보안,V3.4,브라우저 보안 메커니즘 헤더,V3.4.2,"교차 출처 리소스 공유(CORS)의 Access-Control-Allow-Origin 헤더 필드가 애플리케이션의 고정 값인지 확인한다. 만약 출처 Origin HTTP 요청 헤더 필드 값을 사용하고 있다면, 신뢰할 수 있는 출처 목록으로 검증한다. 'Access-Control-Allow-Origin: *' 사용이 필요할 때엔, 응답이 민감한 정보를 포함하지 않는지 확인한다.",1 +V3,웹 프론트엔드 보안,V3.4,브라우저 보안 메커니즘 헤더,V3.4.3,"HTTP 응답이 Content-Security-Policy 응답 헤더 필드를 가지고 있는지 확인한다. 이는 브라우저가 신뢰하는 콘텐츠나 리소스만 불러오고 실행하도록 하고, 위험한 JavaScript의 실행을 제한한다. 최소한, object-src 'none' 과 base-uri 'none'이라는 지침, 그리고 허용 목록을 정의하거나 논스, 해쉬의 사용을 포함한다는 전역 정책은 반드시 사용돼야 한다. 3계층 애플리케이션의 경우에는, 논스나 해쉬가 적용된 응답별 정책이 반드시 정의돼야 한다.",2 +V3,웹 프론트엔드 보안,V3.4,브라우저 보안 메커니즘 헤더,V3.4.4,"모든 HTTP 응답이 'X-Content-Type-Options: nosniff' 헤더 필드를 포함하는지 확인해야 한다. 이는 브라우저들이 주어진 응답에 대해 콘텐츠 스니핑과 MIME 타입 추측을 하지 않도록, 응답의 Content-Type 헤더 필드 값을 목적지 리소스와 일치하도록 지시한다. 예를 들어서, 응답의 Content-Type이 'text/css'인 스타일만 허용된다고 치자. 이는 기능적으로 브라우저의 Cross-Origin Read Blocking (CORB) 사용 또한 활성화시킨다.",2 +V3,웹 프론트엔드 보안,V3.4,브라우저 보안 메커니즘 헤더,V3.4.5,"'Referer' HTTP 요청 헤더 필드를 통해 제 3자 서비스들에 기술적으로 민감한 정보 누출을 막기 위해, 애플리케이션에서 리퍼러 정책을 설정했는지 확인해야 한다. 이는 Referrer-Policy HTTP 응답 헤더 필드나 HTML 속성 항목을 통해 설정할 수 있다. 민감한 데이터는 URL에 있는 경로나 쿼리 데이터, 그리고 내부 비공개 애플리케이션의 경우 hostname도 포함된다.",2 +V3,웹 프론트엔드 보안,V3.4,브라우저 보안 메커니즘 헤더,V3.4.6,"웹 애플리케이션이 Content-Security-Policy 헤더 필드의 frame-ancestors를 사용해 모든 HTTP 응답들에 대해 기본적으로 내부 삽입을 할 수 없고, 필요할 때만 특정 리소스에 대해 내부 삽입을 허용하도록 확인한다. X-Frame-Options 헤더 필드가 브라우저에서 지원되더라도, 오래돼서 신뢰할 수 없음을 알아야 한다.",2 +V3,웹 프론트엔드 보안,V3.4,브라우저 보안 메커니즘 헤더,V3.4.7,Content-Security-Policy 헤더 필드에 위반 사항을 보고할 영역이 특정되어 있는지 확인해야 한다.,3 +V3,웹 프론트엔드 보안,V3.4,브라우저 보안 메커니즘 헤더,V3.4.8,문서 렌더링을 시작하는 모든 HTTP 요청(Content-Type text/html과 같은 응답)에 same-origin 지시어나 same-origin-allow-popups이 있는 Cross‑Origin‑Opener‑Policy 헤더 필드를 포함하는지 확인해야 한다. 이는 탭내빙(tabnabbing) 및 프레임 카운팅과 같은 Window 객체에 대한 공유 액세스를 악용하는 공격을 방지할 수 있다.,3 +V3,웹 프론트엔드 보안,V3.5,브라우저 출처 구분,V3.5.1,"애플리케이션이 허용되지 않은 교차 출처 요청을 통한 민감한 기능의 사용을 막기 위해 CORS preflight 메커니즘에 의존하지 않는지 확인하고, 이런 요청이 애플리케이션 자체에서 시작된건지 증명해야 한다. 이는 anti-forgery 토큰의 사용과 증명이나 CORS-safelisted 요청 헤더 필드가 아닌 확장 HTTP 헤더 필드를 요구하는 것으로 가능하다. 사이트 간 요청 위조 공격(CSRF)으로 알려진 브라우저 기반의 요청 위조 공격에 대한 방어다.",1 +V3,웹 프론트엔드 보안,V3.5,브라우저 출처 구분,V3.5.2,"애플리케이션이 민감한 기능의 허용되지 않은 교차 출처 사용을 막기 위해 CORS preflight 메커니즘에 의존하고 있다면, CORS preflight 요청을 작동하지 않는 요청을 호출할 수 있는지 확인해야 한다. 이는 'Origin'과 'Content-Type' 요청 헤더 필드 값을 확인하거나 CORS-safelisted 헤더 필드가 아닌 확장 필드 사용에 대한 확인이 필요하다.",1 +V3,웹 프론트엔드 보안,V3.5,브라우저 출처 구분,V3.5.3,"민감한 기능이 HTTP 요청으로 POST, PUT, PATCH, DELETE와 같은 적절한 HTTP 방식을 사용하는지, HEAD, OPTIONS, 또는 GET처럼 HTTP 사양이 ""안전""으로 정의되지 않는 방식을 사용하는지 확인한다. 또는 Sec-Fetch-* 요청 헤더 필드의 엄격한 검증을 사용하여 요청이 부적절한 교차 출처 호출, 탐색 요청 또는 이미지 소스와 같은 리소스 로드에서 발생하지 않았는지 확인할 수 있다.",1 +V3,웹 프론트엔드 보안,V3.5,브라우저 출처 구분,V3.5.4,서로 다른 호스트 이름에 별도의 애플리케이션이 호스팅되어 있는지 확인하여 동일한 출처 정책에서 제공하는 제한 사항을 활용한다. 여기에는 한 출처에서 불러온 문서나 스크립트가 다른 출처의 리소스와 상호 작용할 수 있는 방법과 쿠키에서의 호스트 이름 기반 제한 사항이 포함된다.,2 +V3,웹 프론트엔드 보안,V3.5,브라우저 출처 구분,V3.5.5,"postMessage 인터페이스를 통해 수신한 메시지의 출처를 신뢰할 수 없거나, 구문이 유효하지 않은 경우, 수신한 메시지가 폐기되는지 확인한다.",2 +V3,웹 프론트엔드 보안,V3.5,브라우저 출처 구분,V3.5.6,"Cross-Site Script Inclusion (XSSI) 공격을 피하기 위해, 애플리케이션 아무 곳에서나 JSONP 기능이 활성화되지 않는지 확인한다.",3 +V3,웹 프론트엔드 보안,V3.5,브라우저 출처 구분,V3.5.7,Cross-Site Script Inclusion (XSSI) 공격을 방지하기 위해 JavaScript 파일과 같은 스크립트 리소스 응답에 승인이 필요한 데이터가 포함되지 않았는지 확인한다.,3 +V3,웹 프론트엔드 보안,V3.5,브라우저 출처 구분,V3.5.8,"인증된 리소스(예: 이미지, 비디오, 스크립트 및 기타 문서)가 의도된 경우에만 사용자를 대신하여 불러와지거나 내장될 수 있는지 확인한다. 이는 Sec-Fetch-* HTTP 요청 헤더 필드를 엄격하게 검증하여 요청이 부적절한 교차 출처 호출에서 발생하지 않았는지 확인하거나 브라우저에 반환된 콘텐츠를 차단하도록 지시하는 제한적인 교차 출처 리소스 정책 HTTP 응답 헤더 필드를 설정하여 달성할 수 있다.",3 +V3,웹 프론트엔드 보안,V3.6,외부 리소스 무결성,V3.6.1,"클라이언트 측 자산(예: JavaScript 라이브러리, CSS 또는 웹 폰트)이 정적이고 버전이 지정된 경우에만 외부(예: 콘텐츠 전송 네트워크)로만 호스팅되는지 확인하고, 하위 리소스 무결성(SRI)을 사용하여 자산의 무결성을 검증한다. 이것이 불가능하다면 각 리소스에 대해 이를 정당화하기 위해 문서화된 보안 결정이 필요하다.",3 +V3,웹 프론트엔드 보안,V3.7,다른 브라우저 보안 고려사항,V3.7.1,"애플리케이션이 여전히 지원되고 안전하다고 간주되는 클라이언트 측 기술만 사용하는지 확인한다. 이 요구 사항을 충족하지 않는 기술의 예로는 NSAPI 플러그인, Flash, Shockwave, ActiveX, Silverlight, NACL 또는 클라이언트 측 Java applets가 있다.",2 +V3,웹 프론트엔드 보안,V3.7,다른 브라우저 보안 고려사항,V3.7.2,"애플리케이션이 사용자를 통제하지 못하는 다른 호스트 이름이나 도메인으로 자동으로 리다이렉션할 때, 허용된 목적지로만 리다이렉션 하는지 확인한다.",2 +V3,웹 프론트엔드 보안,V3.7,다른 브라우저 보안 고려사항,V3.7.3,사용자가 애플리케이션의 통제 범위를 벗어난 URL로 리다이렉션 될 때 이를 취소할 수 있는 옵션이 있는 알림이 애플리케이션에 표시되는지 확인한다.,3 +V3,웹 프론트엔드 보안,V3.7,다른 브라우저 보안 고려사항,V3.7.4,애플리케이션의 최상위 도메인(예: site.tld)가 공공 HSTS preload 목록에 추가되었는지 확인한다. 이렇게 하면 애플리케이션에 TLS를 사용하는 것이 Strict-Transport-Security 응답 헤더 필드에만 의존하지 않고 메인 브라우저에 직접 내장된다.,3 +V3,웹 프론트엔드 보안,V3.7,다른 브라우저 보안 고려사항,V3.7.5,"애플리케이션에 접근하는 브라우저가 예상한 보안 특징을 가지고 있지 않은 경우, 애플리케이션이 문서에 명시된 대로 동작하는지 확인한다 (유저에게 경고하거나 접근을 차단하는 등).",3 +V4,API 와 WEB 서비스,V4.1,일반적인 웹 서비스 보안,V4.1.1,"메세지 본문이 포함된 모든 HTTP 응답에는 실제 내용과 일치하는 Content-Type 헤더 필드가 포함되어 있는지 검증한다. 이때 IANA 미디어 타입(text, /+xml, /xml 등)에 따라 안전한 문자 인코딩 (ex. UTF-8, ISO-8859-1)을 지정하는 charset 파라미터도 포함되어야 한다.",1 +V4,API 와 WEB 서비스,V4.1,일반적인 웹 서비스 보안,V4.1.2,"사용자가 대면하는 엔드포인트(사람이 직접 웹 브라우저에 접속하는 경우)만 HTTP에서 HTTPS로 자동 리디렉션하고, 그 외에 서비스나 API 엔드포인트는 명백한 리디렉션을 구현하지 않았는지 검증한다. 이는 클라이언트가 실수로 암호화되지 않은 HTTP 요청을 보내고 있음에도, 요청이 자동으로 HTTPS로 리디렉션되어 민감한 데이터의 유출 사실을 발견하지 못하게 되는 상황을 방지하기 위함이다.",2 +V4,API 와 WEB 서비스,V4.1,일반적인 웹 서비스 보안,V4.1.3,"로드 밸런서, 웹 프록시, 백엔드-프론트엔드 서비스 등 중간 계층에서 설정되며, 애플리케이션에서 사용하는 모든 HTTP 헤더 필드를 사용자가 재정의할 수 없는지 확인한다. 예를 들어 X-Real-IP, X-Frowarded-*, X-User-ID 등의 헤더가 포함될 수 있다.",2 +V4,API 와 WEB 서비스,V4.1,일반적인 웹 서비스 보안,V4.1.4,"애플리케이션이나 API에서 명시적으로 지원하는 HTTP 메서드(프리플라이트 요청 시에 OPTIONS 포함)만 사용할 수 있으며, 사용되지 않는 메서드는 차단되어 있는지 확인한다.",3 +V4,API 와 WEB 서비스,V4.1,일반적인 웹 서비스 보안,V4.1.5,매우 민감하거나 여러 시스템을 거치는 요청이나 거래에 대한 전송 계층 보호에 더하여 메세지별 디지털 서명들을 사용함으로써 추가적인 보증을 제공하는지 확인한다.,3 +V4,API 와 WEB 서비스,V4.2,HTTP 메세지 구조 검증,V4.2.1,"모든 애플리케이션 구성 요소(로드 밸런서, 방화벽, 애플리케이션 서버 포함)가 HTTP 요청 smuggling을 예방하는 HTTP 버전의 적합한 메커니즘을 사용하는지에 대해, 수신되는 HTTP 메세지의 끝을 결정하는지 확인한다. HTTP/1.x에서 Transfer-encoding 헤더 필드가 있는 경우에 RFC 2616에 따라서 Content-Length 헤더는 무시해야 한다. HTTP/2 또는 HTTP/3를 사용할 때 Content-Length 헤더 필드가 있는 경우에 수신기는 DATA 프레임의 길이와 일치하는지 확인해야 한다.",2 +V4,API 와 WEB 서비스,V4.2,HTTP 메세지 구조 검증,V4.2.2,"HTTP 메세지를 생성할 때, 요청 smuggling 공격을 예방하기 위해서 HTTP 프로토콜의 프레이밍 방식에 의해 결정된 Content의 길이와 Content-Length 헤더 필드가 충돌하지 않는지 확인한다. ",3 +V4,API 와 WEB 서비스,V4.2,HTTP 메세지 구조 검증,V4.2.3,응답 분할 및 헤더 인젝션 공격을 예방하기 위해서 애플리케이션이 Transfer-encoding과 같은 connection-specific 헤더 필드를 가진 HTTP/2또는 HTTP/3 메세지를 전송하거나 수락하지 않는지 확인한다.,3 +V4,API 와 WEB 서비스,V4.2,HTTP 메세지 구조 검증,V4.2.4,"헤더 인젝션 공격을 예방하기 위해서, 애플리케이션이 헤더 이름과 값에 CR(\r), LF(\n), CRLF(\r\n)과 같은 줄바꿈 문자가 포함되어 있지 않은 HTTP/2 및 HTTP/3 요청만 허용하는지 확인한다.",3 +V4,API 와 WEB 서비스,V4.2,HTTP 메세지 구조 검증,V4.2.5,"애플리케이션(백엔드 또는 프론트엔드)이 요청을 빌드하고 전송하는 경우, 수신 구성 요소가 수학하기에는 너무 긴 URI(ex. API 호출) 또는 HTTP 요청 헤더 필드(ex. Authorization 또는 Cookie)를 생성하지 않도록 검증, 검열 또는 기타 메커니즘을 사용하는지 확인한다. 이로 인해서 지나치게 긴 요청(ex. 긴 쿠키 헤더 필드)을 보낼 때와 같이 서비스 거부가 발생하여 서버가 항상 오류 상태로 응답할 수 있다.",3 +V4,API 와 WEB 서비스,V4.3,GraphQL,V4.3.1,"쿼리 허용 목록, 깊이 제한, 양 제한 또는 쿼리 비용 분석을 사용하여 값비싼 중첩 쿼리로 인해 GraphQL 또는 데이터 계층 표현식 거부(DOS)를 방지하는지 확인한다.",2 +V4,API 와 WEB 서비스,V4.3,GraphQL,V4.3.2,"GraphQL API가 다른 사용자에 의해 사용되지 않는 한, 운영 환경에서 GraphQL 점검 쿼리들이 비비활성화되어 있는지 확인한다.",2 +V4,API 와 WEB 서비스,V4.4,WebSocket,V4.4.1,모든 WebSocket 연결에 WebSocket over TLS(WSS)이 사용되는지 확인한다.,1 +V4,API 와 WEB 서비스,V4.4,WebSocket,V4.4.2,초기 HTTP WebSocket Handshake 중에 기존 헤더 필드가 애플리케이션에 허용된 기존 목록과 대조되는지 확인한다.,2 +V4,API 와 WEB 서비스,V4.4,WebSocket,V4.4.3,"애플리케이션의 표준 세션 관리를 사용할 수 없는 경우, 관련 세션 관리 보안 요구 사항을 준수하는 전용 토큰이 사용되고 있는지 확인한다.",2 +V4,API 와 WEB 서비스,V4.4,WebSocket,V4.4.4,기존 HTTPS 세션을 WebSocket 채널로 전환할 때 이전에 인증된 HTTPS 세션을 통해 전용 WebSocket 세션 관리 토큰을 처음 얻거나 검증하는지 확인한다.,2 +V5,파일 처리,V5.1,파일 처리 문서화,V5.1.1,"업로드 기능별로 허용되는 파일 형식, 예상되는 파일 확장자, 그리고 최대 크기(압축 해제된 크기 포함)가 문서에 정의되어 있는지 검증해야 한다. 또한, 악성 파일이 탐지될 때 애플리케이션이 어떻게 동작하는지와 같이, 최종 사용자가 파일을 안전하게 다운로드하고 처리할 수 있도록 하는 방법이 문서에 명시되어 있는지 확인해야 한다.",2 +V5,파일 처리,V5.2,파일 업로드 및 콘텐츠,V5.2.1,애플리케이션이 성능 저하나 서비스 거부 공격(Denial of Service; DoS)을 유발하지 않고 처리할 수 있는 크기의 파일만 허용하는지 검증해야 한다.,1 +V5,파일 처리,V5.2,파일 업로드 및 콘텐츠,V5.2.2,"애플리케이션이 파일 자체 또는 zip 파일과 같은 아카이브 내에서 파일을 허용할 때, 파일 확장자가 예상 파일 확장자와 일치하는지 확인하고 내용이 확장자로 표현된 유형과 일치하는지 확인하는지 검증해야 한다. 여기에는 초기 '매직 바이트(magic bytes)' 확인, 이미지 재작성 수행, 파일 내용 유효성 검사를 위한 전문 라이브러리 사용이 포함되지만 이에 국한되지 않는다. L1의 경우, 특정 비즈니스 또는 보안 결정을 내리는 데 사용되는 파일에만 집중할 수 있다. L2 이상에서는 허용되는 모든 파일에 적용되어야 한다",1 +V5,파일 처리,V5.2,파일 업로드 및 콘텐츠,V5.2.3,"애플리케이션이 압축 파일(예: zip, gz, docx, odt)을 압축 해제하기 전에 허용되는 최대 압축 해제 크기와 최대 파일 수를 확인하는지 검증해야 한다.",2 +V5,파일 처리,V5.2,파일 업로드 및 콘텐츠,V5.2.4,단일 사용자가 너무 많은 파일이나 과도하게 큰 파일로 저장 공간을 채우지 않도록 사용자별 파일 크기 할당량(quota) 및 최대 파일 수가 적용되는지 검증해야 한다.,3 +V5,파일 처리,V5.2,파일 업로드 및 콘텐츠,V5.2.5,"애플리케이션이 심볼릭 링크(symlink)를 포함하는 압축 파일 업로드를 허용하지 않는지 검증해야 한다. 단, 이러한 기능이 특별히 요구되는 경우에는 심볼릭 링크할 수 있는 파일의 허용 목록(allowlist)을 강제하는 것이 필요하다.",3 +V5,파일 처리,V5.2,파일 업로드 및 콘텐츠,V5.2.6,"픽셀 플러드 공격(Pixel Flood Attack)을 방지하기 위해, 애플리케이션이 업로드된 이미지의 픽셀 크기가 허용된 최대값보다 큰 경우 해당 이미지를 거부하는지 검증해야 한다.",3 +V5,파일 처리,V5.3,파일 저장,V5.3.1,신뢰할 수 없는 입력으로 업로드되거나 생성되어 공개 폴더에 저장된 파일이 HTTP 요청으로 직접 접근될 때 서버 측 프로그램 코드로 실행되지 않는지 검증해야 한다.,1 +V5,파일 처리,V5.3,파일 저장,V5.3.2,"애플리케이션이 파일 작업을 위한 파일 경로를 생성할 때, 사용자 제출 파일명 대신 내부적으로 생성되거나 신뢰할 수 있는 데이터를 사용하는지 검증해야 한다. 만약 사용자 제출 파일명 또는 파일 메타데이터를 반드시 사용해야 한다면, 경로 탐색(path traversal), 로컬 또는 원격 파일 포함(Local File Inclusion; LFI, Remote File Inclusion; RFI), 그리고 서버 측 요청 위조(Server-side Request Forgery; SSRF) 공격으로부터 보호하기 위해 엄격한 유효성 검사 및 정제(Sanitization)가 적용되는지 확인해야 한다.",1 +V5,파일 처리,V5.3,파일 저장,V5.3.3,파일 압축 해제와 같은 서버 측 파일 처리가 zip slip과 같은 취약점을 방지하기 위해 사용자 제공 경로 정보를 무시하는지 검증해야 한다.,3 +V5,파일 처리,V5.4,파일 다운로드,V5.4.1,"애플리케이션이 JSON, JSONP 또는 URL 파라미터를 포함한 사용자 제출 파일명을 검증하거나 무시하는지 검증해야 하고, 응답의 Content-Disposition 헤더 필드에 파일명을 명시하는지 검증해야 한다.",2 +V5,파일 처리,V5.4,파일 다운로드,V5.4.2,제공되는 파일 이름(예: HTTP 응답 헤더 필드 또는 이메일 첨부 파일)이 문서 구조를 보존하고 삽입 공격(Injection Attack)을 방지하기 위해 인코딩되거나 정제되는지 검증해야 한다. (예: RFC 6266 준수),2 +V5,파일 처리,V5.4,파일 다운로드,V5.4.3,신뢰할 수 없는 소스에서 얻은 파일이 알려진 악성 콘텐츠 제공을 방지하기 위해 안티바이러스 스캐너에 의해 검사되는지 검증해야 한다.,2 +V6,인증,V6.1,Authentication Documentation,V6.1.1,"인증 문서가 크리덴셜 스터핑, 비밀번호 무차별 대입 공격 등을 방어하기 위해 속도 제한, 자동화 방지, 적응형 응답(adaptive response)과 같은 제어가 어떻게 사용되는지를 정의한다. 또한, 이러한 제어가 어떻게 구성되는지와 악의적으로 계정을 잠그는 것을 방지하는 방법을 명확히 하는지 검증한다.",1 +V6,인증,V6.1,Authentication Documentation,V6.1.2,"조직명, 제품명, 시스템 식별자, 프로젝트 코드명, 부서명 또는 역할명 등 문맥적으로 특정된 단어의 변형을 포함하여, 비밀번호에 사용되지 않도록 문서화된 단어 목록이 있는지 검증한다.",2 +V6,인증,V6.1,Authentication Documentation,V6.1.3,"애플리케이션이 여러 인증 경로를 포함하는 경우, 이들 모두가 문서화되어 있으며 각 경로에 대해 일관되게 적용되는 보안 제어와 인증 강도가 정의되어 있는지 검증한다.",2 +V6,인증,V6.2,비밀번호 보안,V6.2.1,"사용자가 설정하는 비밀번호가 최소 8자 이상이어야 하며, 최소 15자 이상을 강력히 권장하는지 검증한다.",1 +V6,인증,V6.2,비밀번호 보안,V6.2.2,사용자가 비밀번호를 변경할 수 있는지 검증한다.,1 +V6,인증,V6.2,비밀번호 보안,V6.2.3,비밀번호 변경 기능이 사용자의 현재 비밀번호와 새 비밀번호를 요구하는지 검증한다.,1 +V6,인증,V6.2,비밀번호 보안,V6.2.4,"계정 등록 또는 비밀번호 변경 시 제출된 비밀번호가 최소 3000개의 상위 비밀번호 목록과 비교 및 검사되는지, 이때 애플리케이션 비밀번호 정책(예: 최소 길이)을 만족하는지 검증한다.",1 +V6,인증,V6.2,비밀번호 보안,V6.2.5,"비밀번호는 어떤 구성도 허용되며, 허용되는 문자 유형에 대한 제한이 없는지 검증한다. 대/소문자, 숫자, 특수문자에 대한 최소 개수 요구사항이 없어야 한다.",1 +V6,인증,V6.2,비밀번호 보안,V6.2.6,비밀번호 입력 필드가 type=password를 사용하여 입력을 마스킹하는지 검증한다. 애플리케이션은 사용자가 전체 비밀번호나 마지막 입력 문자를 일시적으로 볼 수 있도록 허용할 수 있다.,1 +V6,인증,V6.2,비밀번호 보안,V6.2.7,"붙여넣기 기능, 브라우저 비밀번호 도우미, 외부 비밀번호 관리자의 사용이 허용되는지 검증한다.",1 +V6,인증,V6.2,비밀번호 보안,V6.2.8,"애플리케이션이 비밀번호를 사용자로부터 수신한 그대로 검증하며, 대소문자 변경이나 잘림(truncation)과 같은 수정 없이 처리하는지 검증한다.",1 +V6,인증,V6.2,비밀번호 보안,V6.2.9,비밀번호가 최소 64자까지 허용되는지 검증한다.,2 +V6,인증,V6.2,비밀번호 보안,V6.2.10,"사용자의 비밀번호는 손상되었음이 발견되거나 사용자가 교체할 때까지 유효하며, 애플리케이션이 주기적인 자격 증명 교체를 요구하지 않는지 검증한다.",2 +V6,인증,V6.2,비밀번호 보안,V6.2.11,문서화된 문맥별 단어 목록을 사용하여 추측하기 쉬운 비밀번호가 생성되지 않도록 하는지 검증한다.,2 +V6,인증,V6.2,비밀번호 보안,V6.2.12,계정 등록 또는 비밀번호 변경 시 제출된 비밀번호가 유출된 비밀번호 집합과 비교 및 검사되는지 검증한다.,2 +V6,인증,V6.3,일반 인증 보안,V6.3.1,애플리케이션의 보안 문서에 따라 크리덴셜 스터핑 및 비밀번호 무차별 대입 공격을 방지하기 위한 제어가 구현되어 있는지 검증한다.,1 +V6,인증,V6.3,일반 인증 보안,V6.3.2,"“root”, “admin”, “sa”와 같은 기본 사용자 계정이 애플리케이션에 존재하지 않거나 비활성화되어 있는지 검증한다.",1 +V6,인증,V6.3,일반 인증 보안,V6.3.3,"애플리케이션 접근 시 반드시 MFA 또는 단일 요소 인증 메커니즘의 조합을 사용하는지 검증한다. L3의 경우, 인증을 수행하려는 사용자의 의도를 검증하기 위해 사용자가 직접 수행하는 동작(예: FIDO 하드웨어 키 또는 모바일 기기에서 버튼을 누르는 행위)을 요구함으로써, 피싱 공격에 대한 침해 및 위장 저항성을 제공하는 하드웨어 기반 인증 메커니즘이 반드시 하나의 요소로 포함되어야 한다. 이 요구사항에서 고려 사항을 완화하려는 경우, 완전히 문서화된 근거와 포괄적인 보완 통제가 반드시 수반되어야 한다.",2 +V6,인증,V6.3,일반 인증 보안,V6.3.4,"여러 인증 경로가 존재하는 경우, 문서화되지 않은 경로가 없어야 하며 보안 제어와 인증 강도가 일관되게 적용되는지 검증한다.",2 +V6,인증,V6.3,일반 인증 보안,V6.3.5,"사용자가 의심스러운 인증 시도에 대해 성공 여부와 관계 없이 알림을 제공받는지 검증한다. 여기에는 비정상적인 위치나 클라이언트에서의 인증 시도, 부분적으로만 성공한 인증(여러 요소 중 하나만 성공한 경우), 장기간 비활성 상태 이후의 인증 시도, 또는 여러 번의 인증 실패 후 성공한 인증이 포함될 수 있다.",3 +V6,인증,V6.3,일반 인증 보안,V6.3.6,이메일이 단일 또는 다중 요소 인증 메커니즘으로 사용되지 않는지 검증한다.,3 +V6,인증,V6.3,일반 인증 보안,V6.3.7,"자격 증명 재설정, 사용자명/이메일 수정 등 인증 관련 정보 변경 이후 사용자에게 통지되는지 검증한다.",3 +V6,인증,V6.3,일반 인증 보안,V6.3.8,"오류 메시지, HTTP 응답 코드, 응답 시간 차이 등을 통해 유효한 사용자를 유추할 수 없으며, 비밀번호 등록/찾기 기능에도 동일한 보호가 적용되는지 검증한다.",3 +V6,인증,V6.4,인증 요소 수명 주기 및 복구,V6.4.1,"시스템이 생성하는 초기 비밀번호나 활성화 코드가 안전하게 난수로 생성되며, 기존 비밀번호 정책을 따르고, 짧은 기간 내 또는 최초 사용 시 만료되는지 검증한다. 초기 비밀번호는 장기 비밀번호로 허용되지 않아야 한다.",1 +V6,인증,V6.4,인증 요소 수명 주기 및 복구,V6.4.2,비밀번호 힌트나 지식 기반 인증(“비밀 질문”)이 존재하지 않는지 검증한다.,1 +V6,인증,V6.4,인증 요소 수명 주기 및 복구,V6.4.3,"분실된 비밀번호에 대한 재설정 절차가 안전하게 구현되며, MFA를 우회하지 않는지 검증한다.",2 +V6,인증,V6.4,인증 요소 수명 주기 및 복구,V6.4.4,"MFA 요소 분실 시, 등록 시와 동일 수준의 신원 증명이 수행되는지 검증한다.",2 +V6,인증,V6.4,인증 요소 수명 주기 및 복구,V6.4.5,"만료 예정인 인증 메커니즘에 대한 갱신 안내가 충분한 시간 전에 발송되며, 필요한 경우 자동 알림이 구성되는지 검증한다",3 +V6,인증,V6.4,인증 요소 수명 주기 및 복구,V6.4.6,"관리자가 사용자 비밀번호 재설정 절차를 시작할 수 있으나, 사용자의 비밀번호를 직접 변경하거나 지정할 수 없는지 검증한다. 이는 관리자가 사용자의 비밀번호를 알지 못하도록 한다.",3 +V6,인증,V6.5,General Multi-factor authentication requirements,V6.5.1,"조회 secret, 대역 외 인증 요청 및 코드, 시간 기반 일회용 비밀번호가 단 한 번만 성공적으로 사용 가능한지 검증한다.",2 +V6,인증,V6.5,General Multi-factor authentication requirements,V6.5.2,"애플리케이션 백엔드에 저장될 때, 엔트로피가 112비트 미만인 룩업 시크릿(예: 무작위 영숫자 19자 또는 무작위 숫자 34자)은 32비트 무작위 솔트(salt)를 포함하는 사전 승인된 비밀번호 저장용 해시 알고리즘으로 해시되는지 검증한다. 룩업 시크릿이 112비트 이상의 엔트로피를 가진 경우에는 표준 해시 함수를 사용할 수 있다.",2 +V6,인증,V6.5,General Multi-factor authentication requirements,V6.5.3,"룩업 시크릿, 대역 외 인증 코드, 그리고 시간 기반 일회용 비밀번호의 시드가 예측 가능한 값을 피하기 위해 암호학적으로 안전한 의사난수 생성기(CSPRNG)를 사용하여 생성되는지 검증한다. ",2 +V6,인증,V6.5,General Multi-factor authentication requirements,V6.5.4,룩업 시크릿과 대역 외 인증 코드가 최소 20비트의 엔트로피를 가지는지 검증한다. 일반적으로 무작위 영숫자 4자 또는 무작위 숫자 6자가 충분하다.,2 +V6,인증,V6.5,General Multi-factor authentication requirements,V6.5.5,"대역 외 인증 요청, 코드 또는 토큰과 시간 기반 일회용 비밀번호가 정의된 수명을 가지는지 검증한다. 대역 외 요청의 최대 수명은 10분이어야 하며, TOTP의 최대 수명은 30초이어야 한다.",2 +V6,인증,V6.5,General Multi-factor authentication requirements,V6.5.6,도난이나 기타 손실의 경우 모든 인증 요소(물리적 장치 포함)를 해지할 수 있는지 검증한다.,3 +V6,인증,V6.5,General Multi-factor authentication requirements,V6.5.7,"생체 인식 인증 메커니즘은 반드시 보조 요소로만 사용되어야 하며, “소유하고 있는 것” 또는 “알고 있는 것” 중 하나와 함께 사용되는지 검증한다.",3 +V6,인증,V6.5,General Multi-factor authentication requirements,V6.5.8,"시간 기반 일회용 비밀번호는 신뢰할 수 있는 서비스의 시간 소스를 기준으로 검증되어야 하며, 신뢰할 수 없거나 클라이언트에서 제공한 시간을 기반으로 해서는 안 된다.",3 +V6,인증,V6.6,대역 외(Out-of-Band) 인증 메커니즘,V6.6.1,"공중 교환 전화망(PSTN)을 사용하여 전화나 SMS를 통해 일회용 비밀번호(OTPs)를 전달하는 인증 메커니즘은, 해당 전화번호가 사전에 검증되었을 때만 제공되어야 하며, 더 강력한 대체 방법(예: 시간 기반 일회용 비밀번호)도 제공되어야 하고, 서비스는 사용자에게 이러한 보안 위험에 대한 정보를 제공해야 한다. L3 애플리케이션의 경우, 전화와 SMS는 옵션으로 제공되어서는 안 된다.",2 +V6,인증,V6.6,대역 외(Out-of-Band) 인증 메커니즘,V6.6.2,"대역 외 인증 요청, 코드 또는 토큰은 생성된 원래 인증 요청에만 바인딩되어야 하며, 이전이나 이후의 요청에는 사용할 수 없어야 한다.",2 +V6,인증,V6.6,대역 외(Out-of-Band) 인증 메커니즘,V6.6.3,코드 기반 대역 외 인증 메커니즘이 속도 제한 등을 통해 무차별 대입 공격으로부터 보호되는지 검증한다. 또한 최소 64비트 이상의 엔트로피를 가진 코드를 사용하는 것도 고려해야한다.,2 +V6,인증,V6.6,대역 외(Out-of-Band) 인증 메커니즘,V6.6.4,"다중요소 인증에 푸시 알림이 사용되는 경우, 푸시 폭탄(push bombing) 공격을 방지하기 위해 속도 제한을 적용해야 한다. 또한 숫자 일치 기법 역시 이 위험을 완화할 수 있다.",3 +V6,인증,V6.7,암호학적 인증 메커니즘,V6.7.1,암호학적 인증 단언(assertion)을 검증하는 데 사용되는 인증서는 수정으로부터 보호되는 방식으로 저장되는지 검증한다.,3 +V6,인증,V6.7,암호학적 인증 메커니즘,V6.7.2,"챌린지 논스(nonce)는 최소 64비트 길이여야 하며, 통계적으로 고유하거나 해당 암호 장치의 수명 동안 고유해야 한다.",3 +V6,인증,V6.8,ID 제공자(IdP)를 통한 인증,V6.8.1,"애플리케이션이 다중 ID 제공자(IdP)를 지원하는 경우, 사용자의 신원이 다른 지원 IdP를 통해 위조될 수 없는지 검증한다. (예: 동일한 사용자 식별자를 사용하는 방식). 표준적인 대응책은 애플리케이션이 IdP ID(네임스페이스 역할)와 IdP 내 사용자 ID의 조합을 사용하여 사용자를 등록하고 식별하는 것이다.",2 +V6,인증,V6.8,ID 제공자(IdP)를 통한 인증,V6.8.2,인증 단언(예: JWT 또는 SAML 단언)의 디지털 서명이 존재하고 무결성이 항상 유지되는지를 검증한다. 서명이 없거나 유효하지 않은 단언은 거부해야 한다.,2 +V6,인증,V6.8,ID 제공자(IdP)를 통한 인증,V6.8.3,"SAML 단언이 재생 공격의 방지를 위해 고유하게 처리되는지, 유효 기간 내에 단 한 번만 사용되는지 검증한다.",2 +V6,인증,V6.8,ID 제공자(IdP)를 통한 인증,V6.8.4,"애플리케이션이 별도의 ID 제공자(IdP)를 사용하고 특정 기능에 대해 특정 인증 강도, 방식, 또는 최근성을 요구하는 경우, 애플리케이션은 IdP가 반환한 정보를 사용하여 이를 검증해야 한다. 예를 들어, OIDC가 사용되는 경우, 이는 ‘acr’, ‘amr’, ‘auth_time’(존재하는 경우)과 같은 ID 토큰 클레임을 검증함으로써 달성할 수 있다. IdP가 이 정보를 제공하지 않는 경우, 애플리케이션은 최소 강도의 인증 메커니즘(예: 사용자 이름과 비밀번호를 사용하는 단일요소 인증)이 사용되었다고 가정하는 문서화된 대체 접근법을 가져야 한다.",2 +V7,세션 관리,V7.1,세션 관리 문서화,V7.1.1,"사용자의 세션 비활성 시간 초과 및 절대 최대 세션 수명에 대한 문서가 존재하고, 다른 제어와의 조합에서 적절하며, NIST SP 800-63B 재인증 요구사항에서 벗어날 시 그 근거가 문서에 포함되어 있는지 검증한다.",2 +V7,세션 관리,V7.1,세션 관리 문서화,V7.1.2,문서가 하나의 계정에서 허용되는 동시(병렬) 세션 수와 활성 세션 수의 최대값에 도달했을 때의 의도된 동작과 수행할 조치를 정의하는지 검증한다.,2 +V7,세션 관리,V7.1,세션 관리 문서화,V7.1.3,"통합 신원 관리 생태계(예: SSO 시스템)의 일부로 사용자 세션을 생성하고 관리하는 모든 시스템이 문서화되어 있으며, 세션 수명, 종료, 재인증이 필요한 기타 조건을 조율하기 위한 제어가 포함되어 있는지 검증한다.",2 +V7,세션 관리,V7.2,기본 세션 관리 보안,V7.2.1,애플리케이션이 모든 세션 토큰 검증을 신뢰할 수 있는 백엔드 서비스에서 수행하는지 검증한다.,1 +V7,세션 관리,V7.2,기본 세션 관리 보안,V7.2.2,"애플리케이션이 세션 관리를 위해 정적 API 시크릿이나 키가 아닌, 자체 포함 토큰 또는 참조 토큰을 동적으로 생성하여 사용하는지 검증한다.",1 +V7,세션 관리,V7.2,기본 세션 관리 보안,V7.2.3,"참조 토큰이 사용자 세션을 나타내는 데 사용되는 경우, 그 토큰이 고유하고, 암호학적으로 안전한 의사난수 생성기(CSPRNG)를 사용해 생성되며 최소 128비트의 엔트로피를 갖는지 검증한다.",1 +V7,세션 관리,V7.2,기본 세션 관리 보안,V7.2.4,애플리케이션이 사용자 인증(재인증 포함) 시 새로운 세션 토큰을 생성하고 기존 세션 토큰을 종료하는지 검증한다.,1 +V7,세션 관리,V7.3,세션 타임아웃,V7.3.1,위험 분석 및 문서화된 보안 결정에 따라 재인증을 강제하는 비활성 시간 초과가 존재하는지 검증한다.,2 +V7,세션 관리,V7.3,세션 타임아웃,V7.3.2,위험 분석 및 문서화된 보안 결정에 따라 재인증을 강제하는 절대 최대 세션 수명이 존재하는지 검증한다.,2 +V7,세션 관리,V7.4,세션 종료,V7.4.1,"로그아웃이나 만료와 같이 세션 종료가 트리거될 때, 애플리케이션이 해당 세션의 추가 사용을 허용하지 않는지 검증한다. 참조 토큰 또는 상태 유지형 세션의 경우, 이는 애플리케이션 백엔드에서 세션 데이터를 무효화하는 것을 의미한다. 자체 포함 토큰을 사용하는 애플리케이션은 종료된 토큰 목록 유지, 사용자별 날짜·시간 이전에 발급된 토큰 거부, 사용자별 서명 키 회전과 같은 방법을 사용해야 한다.",1 +V7,세션 관리,V7.4,세션 종료,V7.4.2,"사용자 계정이 비활성화되거나 삭제될 때(예: 직원 퇴사), 애플리케이션이 모든 활성 세션을 종료하는지 검증한다.",1 +V7,세션 관리,V7.4,세션 종료,V7.4.3,"비밀번호 재설정·복구를 통한 변경, MFA 설정 변경 등 어떤 인증 요소라도 성공적으로 변경 또는 제거한 후, 모든 다른 활성 세션을 종료할 수 있는 옵션을 제공하는지 검증한다.",2 +V7,세션 관리,V7.4,세션 종료,V7.4.4,인증이 필요한 모든 페이지의 로그아웃 기능에 접근하는 것이 쉽고 잘 보이는지 검증한다.,2 +V7,세션 관리,V7.4,세션 종료,V7.4.5,애플리케이션 관리자가 개별 사용자 또는 모든 사용자의 활성 세션을 종료할 수 있는지 검증한다.,2 +V7,세션 관리,V7.5,세션 악용 방어,V7.5.1,"이메일 주소, 전화번호, MFA 구성, 계정 복구에 사용되는 기타 정보 등 인증에 영향을 줄 수 있는 민감한 계정 속성을 변경하기 전에 전체 재인증을 요구하는지 검증한다.",2 +V7,세션 관리,V7.5,세션 악용 방어,V7.5.2,사용자가 현재 활성 세션을 전체 또는 일부 확인하고(최소 요소 한 개에 대한 인증을 다시 수행한 후) 종료할 수 있는지 검증한다.,2 +V7,세션 관리,V7.5,세션 악용 방어,V7.5.3,매우 민감한 거래나 작업을 수행하기 전에 최소 한 요소 인증 또는 2차 검증을 요구하는지 검증한다.,3 +V7,세션 관리,V7.6,페더레이션 재인증,V7.6.1,"RP와 IdP 간 세션 수명과 종료가 문서대로 동작하며, IdP 인증 이벤트 간의 최대 시간이 도달하는 경우 등 필요한 시점에 재인증을 요구하는지 검증한다.",2 +V7,세션 관리,V7.6,페더레이션 재인증,V7.6.2,"세션 생성 시 사용자 동의 또는 명시적 동작을 요구하여, 사용자 상호작용 없이 새로운 애플리케이션 세션이 생성되지 않도록 하는지 검증한다.",2 +V8,권한 부여,V8.1,권한 부여 문서화,V8.1.1,권한 부여 문서가 소비자 권한과 자원 속성에 따라 기능 수준 및 데이터별 접근을 제한하는 규칙을 정의하는지 검증한다.,1 +V8,권한 부여,V8.1,권한 부여 문서화,V8.1.2,권한 부여 문서가 소비자 권한과 자원 속성에 따라 필드 수준 접근 제한(읽기 및 쓰기 모두)을 정의하는지 검증한다. 이러한 규칙은 관련 데이터 객체의 상태(state)나 상태값(status)과 같은 다른 속성 값에 의존할 수 있다.,2 +V8,권한 부여,V8.1,권한 부여 문서화,V8.1.3,"애플리케이션 문서가 인증 및 권한 부여와 관련된 보안 결정을 내리는 데 사용되는 환경적, 맥락적 속성(예: 시간대, 사용자 위치, IP 주소, 디바이스 등)을 정의하는지 검증한다.",3 +V8,권한 부여,V8.1,권한 부여 문서화,V8.1.4,"인증 및 권한 부여 문서가 기능 수준, 데이터별, 필드 수준 권한 부여에 더해 환경적, 맥락적 요소가 의사 결정에 어떻게 사용되는지 정의하는지 검증한다. 여기에는 평가되는 속성, 위험 임계값, 수행되는 조치(예: 허용, 추가 인증 요청, 거부, 단계적 인증)을 포함하는 것을 권장한다.",3 +V8,권한 부여,V8.2,일반 권한 부여 설계,V8.2.1,애플리케이션이 기능 수준의 접근을 명시적 권한이 있는 소비자에게만 허용하는지 검증한다.,1 +V8,권한 부여,V8.2,일반 권한 부여 설계,V8.2.2,"애플리케이션이 특정 데이터 항목에 대한 명시적 권한이 있는 소비자에게만 데이터별 접근을 허용하여, 안전하지 않은 직접 객체 참조(IDOR) 및 객체 수준 권한 부여 취약점(BOLA)을 방지하는지 검증한다.",1 +V8,권한 부여,V8.2,일반 권한 부여 설계,V8.2.3,"애플리케이션이 특정 필드에 대한 명시적 권한이 있는 소비자에게만 필드 수준 접근을 허용하여, 객체 속성 수준 권한 부여 취약점(BOPLA)을 방지하는지 검증한다.",2 +V8,권한 부여,V8.2,일반 권한 부여 설계,V8.2.4,"애플리케이션 문서에서 정의한 바에 따라, 소비자의 환경적, 맥락적 속성(예: 시간대, 위치, IP 주소 또는 장치)에 기반한 적응형 보안 제어가 인증 및 권한 부여 결정에 구현되는지 검증한다. 이러한 제어는 소비자가 새 세션을 시작할 때뿐만 아니라 기존 세션 중에도 반드시 적용되어야 한다.",3 +V8,권한 부여,V8.3,운영 수준 권한 부여,V8.3.1,"애플리케이션이 권한 부여 규칙을 신뢰할 수 있는 서비스 계층에서 적용하고, 클라이언트 측 JavaScript처럼 신뢰할 수 없는 소비자가 조작할 수 있는 제어에 의존하지 않는지 검증한다.",1 +V8,권한 부여,V8.3,운영 수준 권한 부여,V8.3.2,"권한 부여 결정에 영향을 미치는 값의 변경 사항이 즉시 적용되는지 검증한다. 자체 포함 토큰(self-contained token)과 같이 즉시 적용이 불가능한 경우, 소비자가 더 이상 권한이 없는 작업을 수행할 때 이를 알리고 변경을 되돌리는 완화 제어를 반드시 두어야 한다. 단, 이 방법은 정보 유출을 방지하지는 못한다.",3 +V8,권한 부여,V8.3,운영 수준 권한 부여,V8.3.3,"객체에 대한 접근이, 대리인이나 이를 대신 수행하는 서비스의 권한이 아닌, 원래 주체(예: 소비자)의 권한에 기반하는지 검증한다. 예를 들어, 소비자가 인증을 위해 자체 포함 토큰을 사용하여 웹 서비스를 호출하고, 해당 서비스가 다른 서비스에 데이터를 요청하는 경우, 두 번째 서비스는 첫 번째 서비스의 머신-투-머신 토큰이 아니라 소비자의 토큰을 사용하여 권한 결정을 내려야 한다.",3 +V8,권한 부여,V8.4,기타 권한 부여 고려사항,V8.4.1,"다중 테넌트 애플리케이션이 교차 테넌트 제어를 사용하여, 소비자의 작업이 권한이 없는 다른 테넌트에 영향을 미치지 않도록 하는지 검증한다.",2 +V8,권한 부여,V8.4,기타 권한 부여 고려사항,V8.4.2,"관리 인터페이스 접근이 연속적인 소비자 신원 검증, 장치 보안 상태 평가, 맥락 기반 위험 분석 등 복수의 보안 계층을 포함하는지 검증한다. 네트워크 위치나 신뢰된 엔드포인트가 무단 접근 가능성을 줄일 수는 있더라도, 단독으로 권한 부여 판단의 유일한 요소가 되어서는 안 된다.",3 +V9,자체 포함 토큰(self-contained token),V9.1,토큰 출처 및 무결성,V9.1.1,자체 포함 토큰 내용을 허용하기 전에 변조를 방지하기 위해 디지털 서명 또는 메시지 인증 코드(MAC)를 사용하여 토큰의 무결성을 검증해야 한다.,1 +V9,자체 포함 토큰(self-contained token),V9.1,토큰 출처 및 무결성,V9.1.2,"주어진 컨텍스트에 대해 자체 포함 토큰을 생성하고 검증할 때, 허용 목록에 있는 알고리즘만 사용될 수 있는지 검증해야 한다. 허용 목록에는 사용 가능한 알고리즘을 모두 포함해야 하며, 이상적으로는 대칭 또는 비대칭 알고리즘 중 하나만을 포함해야 한다. 또한 'None' 알고리즘은 반드시 제외해야 한다. 대칭 및 비대칭 알고리즘 모두를 지원해야 하는 경우, 키 혼동을 방지하기 위해 추가 제어가 필요하다.",1 +V9,자체 포함 토큰(self-contained token),V9.1,토큰 출처 및 무결성,V9.1.3,"자체 포함 토큰을 검증하는 데 사용되는 키 자료가 토큰 발행자를 위한 신뢰할 수 있는 사전 구성된 출처에서 비롯되었는지 검증하여, 공격자가 신뢰할 수 없는 출처 및 키를 지정하는 것을 방지해야 한다. JWT 및 기타 JWS 구조의 경우, 'jku', 'x5u', 'jwk'와 같은 헤더는 신뢰할 수 있는 출처의 허용 목록에 대해 검증되어야 한다.",1 +V9,자체 포함 토큰(self-contained token),V9.2,토큰 내용,V9.2.1,"토큰 데이터에 유효 기간이 존재하는 경우, 검증 시간이 이 유효 기간 내에 있을 때만 토큰 및 해당 내용이 허용되는지 검증해야 한다. 예를 들어, JWT의 경우 'nbf' 및 'exp' 클레임이 검증되어야 한다.",1 +V9,자체 포함 토큰(self-contained token),V9.2,토큰 내용,V9.2.2,"토큰을 수신하는 서비스가 토큰 내용을 수락하기 전에 올바른 유형이며 의도된 목적을 위한 것인지 토큰을 검증하는지 확인해야 한다. 예를 들어, 인가 결정에는 액세스 토큰만 허용될 수 있으며, 사용자 인증을 증명하는 데는 ID 토큰만 사용될 수 있다.",2 +V9,자체 포함 토큰(self-contained token),V9.2,토큰 내용,V9.2.3,"서비스가 대상 서비스(audience)와 함께 사용하기 위한 토큰만 허용하는지 검증해야 한다. JWT의 경우, 서비스에 정의된 허용 목록에 대해 'aud' 클레임을 검증함으로써 이를 달성할 수 있다.",2 +V9,자체 포함 토큰(self-contained token),V9.2,토큰 내용,V9.2.4,"토큰 발행자가 다른 대상(audience)에게 토큰을 발행하기 위해 동일한 개인 키를 사용하는 경우, 발행된 토큰이 의도된 대상을 고유하게 식별하는 대상 제한을 포함하는지 검증해야 한다. 이는 토큰이 의도하지 않은 대상에서 재사용되는 것을 방지한다. 대상 식별자가 동적으로 프로비저닝되는 경우, 토큰 발행자는 대상 위장(audience impersonation)을 초래하지 않도록 대상들을 검증해야 한다.",2 +V10,OAuth와 OIDC,V10.1,일반적인 OAuth 및 OIDC 보안,V10.1.1,"엄격하게 필요한 구성 요소에만 토큰이 전송되는지 검증해야 한다. 예를 들어, 브라우저 기반 JavaScript 애플리케이션에 프론트엔드 전용 백엔드(Backend For Frontend; BFF) 패턴을 사용하는 경우, 액세스 토큰 및 리프레시 토큰은 백엔드에서만 접근 가능해야 한다.",2 +V10,OAuth와 OIDC,V10.1,일반적인 OAuth 및 OIDC 보안,V10.1.2,"클라이언트는 인가 서버에서 제공하는 값(예: 인가 코드 또는 ID 토큰)이 동일한 사용자 에이전트 세션 및 트랜잭션에서 시작된 인가 플로우의 결과인 경우에만 허용하는지 검증해야 한다. 이를 위해 클라이언트가 생성하는 비밀 값(PKCE(Proof Key for Code Exchange)의 'code_verifier', 'state', OIDC의 'nonce' 등)은 추측이 불가능해야 하며, 해당 트랜잭션에 고유해야 하고, 트랜잭션이 시작된 클라이언트와 사용자 에이전트 세션 양쪽에 안전하게 결합(Binding)되어 있어야 한다.",2 +V10,OAuth와 OIDC,V10.2,OAuth 클라이언트,V10.2.1,"코드 플로우를 사용하는 경우, OAuth 클라이언트는 토큰 요청을 유도하는 사이트 간 요청 위조 공격(Cross-Site Request Forgery; CSRF)에 대한 보호 기능을 갖추고 있는지 검증한다. 이를 위해 인가 요청 시 전송된 'state' 파라미터를 검증하거나, PKCE 기능을 사용해야 한다.",2 +V10,OAuth와 OIDC,V10.2,OAuth 클라이언트,V10.2.2,"OAuth 클라이언트가 둘 이상의 인가 서버와 상호 작용할 수 있는 경우, 믹스업 공격에 대한 방어 대책을 갖는지 검증해야 한다. 예를 들어, 인가 서버가 'iss' 파라미터 값을 반환하도록 요구하고 인가 응답 및 토큰 응답에서 이를 검증할 수 있다.",2 +V10,OAuth와 OIDC,V10.2,OAuth 클라이언트,V10.2.3,OAuth 클라이언트가 인가 서버에 대한 요청에서 필요한 범위(또는 기타 인가 파라미터)만 요청하는지 검증해야 한다.,3 +V10,OAuth와 OIDC,V10.3,OAuth 리소스 서버,V10.3.1,"리소스 서버가 해당 서비스(audience)에 사용하도록 의도된 액세스 토큰만 수락하는지 검증해야 한다. 대상은 구조화된 액세스 토큰(예: JWT의 'aud' 클레임)에 포함될 수 있거나, 토큰 조회 엔드포인트를 사용하여 확인할 수 있다.",2 +V10,OAuth와 OIDC,V10.3,OAuth 리소스 서버,V10.3.2,"리소스 서버가 위임된 인가를 정의하는 액세스 토큰의 클레임을 기반으로 인가 결정을 시행하는지 검증해야 한다. 'sub', 'scope', 'authorization_details'와 같은 클레임이 존재하는 경우, 이는 결정에 반영되어야 한다.",2 +V10,OAuth와 OIDC,V10.3,OAuth 리소스 서버,V10.3.3,"액세스 토큰(JWT 또는 관련 토큰 조회 응답)에서 고유한 사용자를 식별해야 하는 접근 제어 결정이 필요한 경우, 리소스 서버가 다른 사용자에게 재할당될 수 없는 클레임에서 사용자를 식별하는지 검증해야 한다. 일반적으로 이는 'iss' 및 'sub' 클레임의 조합을 사용하는 것을 의미한다.",2 +V10,OAuth와 OIDC,V10.3,OAuth 리소스 서버,V10.3.4,"리소스 서버가 특정 인증 강도, 방법 또는 최신성을 요구하는 경우, 제시된 액세스 토큰이 이러한 제약 조건을 충족하는지 검증해야 한다. 예를 들어, 토큰을 제시한 경우 OIDC의 'acr', 'amr' 및 'auth_time' 클레임을 각각 사용해야 한다.",2 +V10,OAuth와 OIDC,V10.3,OAuth 리소스 서버,V10.3.5,"리소스 서버가 발신자 제약 액세스 토큰, 즉 OAuth 2용 상호 TLS(Mutual TLS; mTLS) 또는 OAuth 2 소유 증명(Demonstration of Proof of Possession; DPoP)를 요구하여 도난된 액세스 토큰 사용 또는 액세스 토큰 재사용(권한 없는 당사자로부터)을 방지하는지 검증해야 한다.",3 +V10,OAuth와 OIDC,V10.4,OAuth 인가 서버,V10.4.1,인가 서버는 클라이언트 별로 사전 등록된 URI의 허용 목록을 기반으로 리디렉션 URI를 정확한 문자열 비교 방식으로 검증해야 한다.,1 +V10,OAuth와 OIDC,V10.4,OAuth 인가 서버,V10.4.2,"인가 서버가 인가 응답에서 인가 코드를 반환하는 경우, 해당 코드는 토큰 요청에 한번만 사용될 수 있어야 한다. 이미 액세스 토큰을 발급하는 데 사용된 인가 코드를 사용하여 두 번째 요청이 발생하면, 인가 서버는 토큰 요청을 거부하고 해당 인가 코드와 관련된 모든 발급된 토큰을 취소해야 한다.",1 +V10,OAuth와 OIDC,V10.4,OAuth 인가 서버,V10.4.3,"인가 코드가 단기간만 유효한지 검증해야 한다. 최대 수명은 L1 및 L2 애플리케이션의 경우 최대 10분, L3 애플리케이션의 경우 최대 1분 이내여야 한다.",1 +V10,OAuth와 OIDC,V10.4,OAuth 인가 서버,V10.4.4,"인가 서버는 특정 클라이언트에 대해, 해당 클라이언트가 사용할 필요가 있는 인가 방식(grant)만 사용하도록 허용해야 한다. token(암시적 플로우) 및 password(리소스 소유자 비밀번호 자격 증명 플로우) 방식은 더 이상 사용되어서는 안 된다.",1 +V10,OAuth와 OIDC,V10.4,OAuth 인가 서버,V10.4.5,"인가 서버가 공개 클라이언트에 대한 리프레시 토큰 재사용 공격을 완화하는지 검증해야 한다. 가급적이면 발신자 제약 리프레시 토큰, 즉 소유 증명이나 mTLS를 사용한 인증서 바인딩 액세스 토큰을 사용해야 한다. L1 및 L2 애플리케이션의 경우, 리프레시 토큰 회전(rotation)이 사용될 수 있다. 리프레시 토큰 회전이 사용되는 경우, 인가 서버는 리프레시 토큰을 사용 후 무효화해야 하며, 이미 사용되고 무효화된 리프레시 토큰이 제공되면 해당 인가에 대한 모든 리프레시 토큰을 철회(revoke)해야 한다.",1 +V10,OAuth와 OIDC,V10.4,OAuth 인가 서버,V10.4.6,"코드 인가 방식(code grant)이 사용되는 경우, 인가 서버가 PKCE를 요구하여 인가 코드 탈취 공격을 완화하는지 검증해야 한다. 인가 요청의 경우, 인가 서버는 유효한 'code_challenge' 값을 요구해야 하며, 'code_challenge_method'값으로 'plain'를 허용해서는 안 된다. 토큰 요청의 경우, 'code_verifier' 파라미터의 검증을 요구해야 한다.",2 +V10,OAuth와 OIDC,V10.4,OAuth 인가 서버,V10.4.7,"인가 서버가 인증되지 않은 동적 클라이언트 등록을 지원하는 경우, 악의적인 클라이언트 애플리케이션의 위험을 완화하는지 검증해야 한다. 등록된 URI와 같은 클라이언트 메타데이터를 검증하고, 사용자의 동의를 확인해야 하며, 신뢰할 수 없는 클라이언트 애플리케이션으로 인가 요청을 처리하기 전에 사용자에게 경고해야 한다.",2 +V10,OAuth와 OIDC,V10.4,OAuth 인가 서버,V10.4.8,"슬라이딩 리프레시 토큰 만료(expiration)가 적용되더라도, 리프레시 토큰에 절대 만료 시점(absolute expiration)이 포함되어 있는지 확인한다.",2 +V10,OAuth와 OIDC,V10.4,OAuth 인가 서버,V10.4.9,악의적인 클라이언트 또는 도난된 토큰의 위험을 완화하기 위해 인가 서버 사용자 인터페이스를 통해 권한 있는 사용자가 리프레시 토큰 및 참조 액세스 토큰을 철회할 수 있는지 검증해야 한다.,2 +V10,OAuth와 OIDC,V10.4,OAuth 인가 서버,V10.4.10,"토큰 요청, 푸시된 인가 요청(Pushed Authorization Request; PAR), 토큰 철회 요청과 같은 클라이언트에서 인가 서버로의 백채널 요청(backchannel request)에 대해 기밀 클라이언트가 인증되는지 검증해야 한다.",2 +V10,OAuth와 OIDC,V10.4,OAuth 인가 서버,V10.4.11,인가 서버 구성이 OAuth 클라이언트에 필요한 범위만 할당하는지 검증해야 한다.,2 +V10,OAuth와 OIDC,V10.4,OAuth 인가 서버,V10.4.12,"주어진 클라이언트에 대해 인가 서버가 해당 클라이언트가 사용해야 하는 'response_mode' 값만 허용하는지 검증해야 한다. 예를 들어, 인가 서버가 이 값을 예상 값과 비교하여 검증하거나, PAR 또는 JWT 기반 인가 요청(JWT-secured Authorization Request; JAR)을 사용하여 검증해야 한다.",3 +V10,OAuth와 OIDC,V10.4,OAuth 인가 서버,V10.4.13,인가 유형 'code'가 항상 PAR과 함께 사용되는지 검증해야 한다.,3 +V10,OAuth와 OIDC,V10.4,OAuth 인가 서버,V10.4.14,인가 서버가 mTLS를 사용하는 인증서 바인딩 액세스 토큰 또는 소유 증명 바인딩 액세스 토큰을 사용하여 발신자 제약(Proof-of-Possession) 액세스 토큰만 발급하는지 검증해야 한다.,3 +V10,OAuth와 OIDC,V10.4,OAuth 인가 서버,V10.4.15,"최종 사용자 장치에서 실행되지 않는 서버에서 동작하는 클라이언트의 경우, 인가 서버가 'authorization_details' 파라미터 값이 클라이언트 백엔드로부터 생성되었는지와 사용자가 해당 값을 변조되지 않았는지를 검증해야 한다. 예를 들어, PAR 또는 JAR의 사용을 요구하여 확인해야 한다.",3 +V10,OAuth와 OIDC,V10.4,OAuth 인가 서버,V10.4.16,"클라이언트가 기밀 클라이언트인지 검증하고, 인가 서버는 재사용 공격에 강하고 공개키 암호화에 기반한 강력한 클라이언트 인증 방식을 사용하도록 요구해야 한다. 예를 들어, mTLS(tls_client_auth, self_signed_tls_client_auth) 또는 비공개 키 기반 JWT 인증(private_key_jwt) 등이 이에 해당한다.",3 +V10,OAuth와 OIDC,V10.5,OIDC 클라이언트,V10.5.1,"신뢰 당사자로서 클라이언트가 ID 토큰 재사용 공격을 완화하는지 검증해야 한다. 예를 들어, ID 토큰의 'nonce' 클레임이 OpenID 공급자에 전송된 인증 요청(OAuth2에서는 인가 서버에 전송된 인가 요청)에서 전송된 'nonce' 값과 일치하는지 확인해야 한다.",2 +V10,OAuth와 OIDC,V10.5,OIDC 클라이언트,V10.5.2,"클라이언트가 ID 토큰 클레임, 일반적으로 'sub' 클레임에서 사용자를 고유하게 식별하며, 해당 클레임이 ID 공급자 범위 내에서 다른 사용자에게 재할당될 수 없는지 검증해야 한다.",2 +V10,OAuth와 OIDC,V10.5,OIDC 클라이언트,V10.5.3,"클라이언트는 악의적인 인가 서버가 인가 서버 메타데이터를 통해 다른 인가 서버를 가장하려는 시도를 거부하는지 검증해야 한다. 클라이언트는 인가 서버 메타데이터에 포함된 발급자(issuer) URL이 클라이언트가 예상하는 사전 구성된 발급자 URL과 정확히 일치하지 않는 경우, 해당 메타데이터를 거부해야 한다.",2 +V10,OAuth와 OIDC,V10.5,OIDC 클라이언트,V10.5.4,클라이언트는 토큰의 aud 클레임 값이 클라이언트의 client_id 값과 동일한지 확인하여 ID 토큰이 해당 클라이언트(audience)를 대상으로 발급되었음을 검증해야 한다.,2 +V10,OAuth와 OIDC,V10.5,OIDC 클라이언트,V10.5.5,"OIDC 백채널 로그아웃을 사용하는 경우, 신뢰 당사자는 강제 로그아웃을 통한 서비스 거부 공격(Denial of Service) 및 로그아웃 플로우에서의 JWT 혼동(cross-JWT confusion)을 완화하는지 검증해야 한다. 클라이언트는 로그아웃 토큰이 'logout+jwt' 값으로 올바르게 지정되어 있는지, 올바른 멤버 이름을 가진 'event' 클레임을 포함하는지, 그리고 'nonce' 클레임을 포함하지 않는지 검증해야 한다. 또한, 짧은 만료 시간(예: 2분)을 갖는 것이 권장된다.",2 +V10,OAuth와 OIDC,V10.6,OpenID 공급자,V10.6.1,"OpenID 공급자는 response_mode 파라미터 값으로'code', 'ciba', 'id_token' 또는 'id_token code' 만 허용하는지 검증해야 한다. 이 중 'id_token code'(OIDC 하이브리드 플로우)보다는 'code'가 선호되며, 'token'(모든 암시적 플로우)은 사용되어서는 안 된다.",2 +V10,OAuth와 OIDC,V10.6,OpenID 공급자,V10.6.2,"OpenID 공급자가 강제 로그아웃을 통한 서비스 거부 공격을 완화하는지 검증해야 한다. 신뢰 당사자로 부터 시작된 로그아웃 요청에 id_token_hint 등의 파라미터가 포함되어 있는 경우, 이를 검증하거나 최종 사용자로부터 명시적인 확인을 받아야 한다.",2 +V10,OAuth와 OIDC,V10.7,동의 관리,V10.7.1,"인가 서버가 사용자로부터 각 인가 요청에 대한 명시적인 동의(consent)를 확인하는지 검증해야 한다. 클라이언트의 신원을 보장할 수 없는 경우, 인가 서버는 항상 사용자에게 명시적으로 동의를 요청해야 한다.",2 +V10,OAuth와 OIDC,V10.7,동의 관리,V10.7.2,"인가 서버가 사용자 동의를 요청할 때, 동의하는 내용에 대한 충분하고 명확한 정보를 제공하는지 검증해야 한다. 이에 해당하는 경우, 요청된 인가의 성격(일반적으로 범위, 리소스 서버, RAR(Rich Authorization Requests) 인가 세부 정보 기반), 인가된 애플리케이션의 신원, 인가의 유효 기간이 포함되어야 한다.",2 +V10,OAuth와 OIDC,V10.7,동의 관리,V10.7.3,"사용자가 인가 서버를 통해 부여한 동의를 검토, 수정 및 철회할 수 있는지 검증해야 한다.",2 +V11,암호화,V11.1,암호화 인벤토리 및 문서화,V11.1.1,'NIST SP 800-57'과 같은 암호화 키 관리 및 키 관리 표준을 따르는 암호화 키 수명 주기에 대한 문서화 된 정책이 있는지 검증해야 한다. 여기에는 키가 과도하게 공유되지 않도록 하는 것이 포함된다(예: 공유 비밀의 경우 두 개를 초과하는 엔터티와 공유 및 개인 키의 경우 한 개를 초과하는 엔터티에 공유).,2 +V11,암호화,V11.1,암호화 인벤토리 및 문서화,V11.1.2,"애플리케이션에서 사용되는 모든 암호화 키, 알고리즘, 인증서를 포함한 암호화 자산 목록(cryptographic inventory)이 작성되고, 유지되며, 정기적으로 업데이트되고 있는지 검증해야 한다. 또한, 각 키가 시스템 내에서 사용 가능한 위치와 사용이 제한되는 위치, 해당 키로 보호할 수 있는 데이터 유형과 보호할 수 없는 데이터 유형이 문서화되어 있어야 한다.",2 +V11,암호화,V11.1,암호화 인벤토리 및 문서화,V11.1.3,"암호화, 해싱, 서명 작업을 포함하는 시스템 내의 모든 암호화 사용 사례를 식별하기 위해, 암호화 사용 탐지 메커니즘이 적용되는지 검증해야 한다.",3 +V11,암호화,V11.1,암호화 인벤토리 및 문서화,V11.1.4,암호화 자산 목록이 유지 관리되는지 검증해야 한다. 여기에는 미래의 위협에 대응하기 위해 양자 내성 암호(Post-Quantum Cryptography; PQC)와 같은 새로운 암호화 표준으로의 마이그레이션 계획을 설명하는 문서화된 계획이 포함되어야 한다.,3 +V11,암호화,V11.2,안전한 암호화 구현,V11.2.1,암호화 작업에 업계에서 검증된 구현(라이브러리 및 하드웨어 가속 구현 포함)이 사용되는지 검증해야 한다.,2 +V11,암호화,V11.2,안전한 암호화 구현,V11.2.2,"난수, 인증 암호화, MAC, 해싱 알고리즘, 키 길이, 라운드, 암호 및 모드를 언제든지 재구성, 업그레이드 또는 교체하여 암호화 해독으로부터 보호할 수 있도록 애플리케이션이 암호화 유연성(crypto agility)을 갖추고 설계되었는지 검증해야 한다. 또한, 키와 비밀번호를 교체하고 데이터를 다시 암호화하는 것도 가능해야 한다. 이를 통해 승인된 PQC 체계(또는 표준)의 고신뢰 구현이 널리 사용 가능해지면 PQC로 원활하게 업그레이드할 수 있다.",2 +V11,암호화,V11.2,안전한 암호화 구현,V11.2.3,"모든 암호화 기본 구성요소(primitive)가 알고리즘, 키 크기 및 구성에 따라 최소 128비트의 보안강도를 제공하는지 검증해야 한다. 예를 들어, 256비트 ECC 키는 대략 128비트의 보안을 제공하며, RSA는 128비트의 보안을 달성하기 위해 3072비트 키를 필요로 한다.",2 +V11,암호화,V11.2,안전한 암호화 구현,V11.2.4,"민감한 정보가 누출되는 것을 방지하기 위해 모든 암호화 연산은 상수 시간(constant-time)으로 수행되어야 하며, 비교, 계산, 반환 과정에서 단락(short-circuit) 연산이 없는지 검증해야 한다.",3 +V11,암호화,V11.2,안전한 암호화 구현,V11.2.5,"모든 암호화 모듈이 안전하게 실패하고, 패딩 오라클 공격(Padding Oracle attacks)과 같은 취약점을 허용하지 않는 방식으로 오류가 처리되는지 검증해야 한다.",3 +V11,암호화,V11.3,암호화 알고리즘,V11.3.1,안전하지 않은 블록 모드(예: ECB) 및 약한 패딩 방식(예: PKCS#1 v1.5)가 사용되지 않는지 검증해야 한다.,1 +V11,암호화,V11.3,암호화 알고리즘,V11.3.2,GCM을 사용하는 AES와 같이 승인된 암호 및 모드만 사용되는지 검증해야 한다.,1 +V11,암호화,V11.3,암호화 알고리즘,V11.3.3,"암호화 된 데이터가 승인된 인증된 암호화 방식을 사용하거나, 승인된 암호화 방식과 승인된 MAC 알고리즘을 조합을 통한 무단 수정으로부터 보호되는지 검증해야 한다.",2 +V11,암호화,V11.3,암호화 알고리즘,V11.3.4,"논스(nonces), 초기화 벡터 및 기타 단일 사용 번호가 둘 이상의 암호화 키 및 데이터 요소 쌍에 사용되지 않는지 검증해야 한다. 생성 방법은 사용되는 알고리즘에 적합해야 한다.",3 +V11,암호화,V11.3,암호화 알고리즘,V11.3.5,암호화 알고리즘과 MAC 알고리즘의 모든 조합이 암호화 후 MAC(Encrypt-then-MAC) 방식으로 동작하는지 검증해야 한다.,3 +V11,암호화,V11.4,해싱 및 해시 기반 함수,V11.4.1,"디지털 서명, HMAC, KDF 및 무작위 비트 생성을 포함한 일반적인 암호화 사용 사례에 승인된 해시 함수만 사용되는지 검증해야 한다. MD5와 같이 허용되지 않는 해시 함수는 어떤 암호화 목적으로도 사용해서는 안 된다.",1 +V11,암호화,V11.4,해싱 및 해시 기반 함수,V11.4.2,"비밀번호가 승인된 '계산 집약적인 키 유도 함수(""비밀번호 해싱 함수""라고도 함)'를 사용하여 저장되고, 파라미터 설정이 현재 지침에 따라 구성되었는지 검증해야 한다. 설정은 필요한 보안 수준에 대한 무차별 대입 공격을 충분히 어렵게 만들기 위해 보안과 성능의 균형을 이루어야 한다.",2 +V11,암호화,V11.4,해싱 및 해시 기반 함수,V11.4.3,"데이터 인증 또는 데이터 무결성의 일부로 디지털 서명에 사용되는 해시 함수가 충돌 저항성을 가지며 적절한 비트 길이를 갖는지 검증해야 한다. 충돌 저항성이 필요한 경우, 출력 길이는 최소 256비트여야 한다. 제2 역상(pre-image) 공격 저항성만 필요한 경우, 출력 길이는 최소 128비트여야 한다.",2 +V11,암호화,V11.4,해싱 및 해시 기반 함수,V11.4.4,비밀번호로부터 비밀 키를 유도할 때 애플리케이션이 키 스트레칭(key stretching) 파라미터를 사용하여 승인된 키 유도 함수(key derivation function)를 사용하는지 검증해야 한다. 사용 중인 파라미터는 결과적인 암호화 키를 손상시키는 무차별 대입 공격을 방지하기 위해 보안과 성능의 균형을 이루어야 한다.,2 +V11,암호화,V11.5,무작위 값,V11.5.1,예측 불가능해야 하는 모든 난수 및 문자열이 암호학적으로 안전한 의사 난수 생성기(CSPRNG)를 사용하여 생성되고 최소 128비트의 엔트로피를 갖는지 검증해야 한다. UUID는 이 조건을 충족하지 않는다.,2 +V11,암호화,V11.5,무작위 값,V11.5.2,사용 중인 난수 생성 메커니즘이 높은 부하(heavy demand)에서도 안전하게 작동하도록 설계되었는지 검증해야 한다.,3 +V11,암호화,V11.6,공개 키 암호화,V11.6.1,"키 생성 및 시딩, 디지털 서명 생성 및 검증에 승인된 암호화 알고리즘 및 작동 모드만 사용되는지 검증해야 한다. 키 생성 알고리즘은 알려진 공격에 취약한 안전하지 않은 키(예: 페르마 인수분해(Fermat factorization)에 취약한 RSA 키)를 생성해서는 안 된다.",2 +V11,암호화,V11.6,공개 키 암호화,V11.6.2,"키 교환에는 디피-헬만과 같은 승인된 암호화 알고리즘이 사용되어야 하며, 안전한 파라미터를 사용하는지 여부를 중점적으로 검증해야 한다.이는 중간자 공격(adversary-in-the-middle attacks) 또는 암호화 해독으로 이어질 수 있는 키 설정 프로세스에 대한 공격을 방지할 것이다.",3 +V11,암호화,V11.7,사용 중 데이터 암호화,V11.7.1,사용 중인 민감한 데이터를 보호하고 무단 사용자 또는 프로세스의 접근을 방지하기 위해 전체 메모리 암호화가 사용되는지 검증해야 한다.,3 +V11,암호화,V11.7,사용 중 데이터 암호화,V11.7.2,"데이터 최소화가 처리 중에 노출되는 데이터의 양을 최소화하고, 사용 직후 또는 가능한 한 빨리 데이터가 암호화되도록 보장하는지 검증해야 한다.",3 +V12,보안 통신,V12.1,일반 TLS 보안 가이드,V12.1.1,"TLS 1.2 및 TLS 1.3과 같은 최신 권장 버전의 TLS 프로토콜만 활성화되어 있으며, 그중 최신 버전이 우선되어야 한다.",1 +V12,보안 통신,V12.1,일반 TLS 보안 가이드,V12.1.2,오직 권장되는 암호화 스위트(cipher suites)들이 활성화되어 있으며 그 중 가장 강력한 암호화 스위트로 우선 설정되어 있는지 확인한다. 레벨3 애플리케이션은 순방향 비밀성(forward secrecy)을 제공하는 암호화 스위트만 지원해야 한다.,2 +V12,보안 통신,V12.1,일반 TLS 보안 가이드,V12.1.3,인증이나 권한 부여를 위해 인증서 ID를 사용하기 전에 애플리케이션이 mTLS 클라이언트 인증서가 신뢰할 수 있는지 검증해야 한다.,2 +V12,보안 통신,V12.1,일반 TLS 보안 가이드,V12.1.4,Online Certificate Status Protocol (OCSP) 스테이플링(Stapling)과 같은 적절한 인증서 폐지 프로토콜이 활성화되고 설정되어 있는지 확인해야 한다.,3 +V12,보안 통신,V12.1,일반 TLS 보안 가이드,V12.1.5,TLS 핸드셰이크 프로세스 중 Server Name Indication (SNI)과 같은 민감한 메타 데이터의 노출을 방지하기 위해 애플리케이션 TLS 설정에서 Encrypted Client Hello (ECH)가 활성화되어 있는지 확인해야 한다.,3 +V12,보안 통신,V12.2,외부 서비스와의 HTTPS 통신,V12.2.1,"TLS는 클라이언트와 외부 HTTP 기반 서비스 간의 모든 연결에 사용되며, 안전하지 않거나 암호화 되어 있지 않은 통신에 대체 동작(fall back)이 발생하지 않는지 확인해야한다. ",1 +V12,보안 통신,V12.2,외부 서비스와의 HTTPS 통신,V12.2.2,외부 서비스가 공적으로 신뢰된 TLS 인증서를 사용하는지 확인해야 한다.,1 +V12,보안 통신,V12.3,일반 서비스 간의 통신 보안,V12.3.1,"애플리케이션간의 모니터링 시스템, 관리 도구, 원격 엑세스 및 SSH, 미들웨어, 데이터베이스, 메인프레임, 파트너 시스템이나 외부 API를 포함한 모든 인바운드와 아웃바운드 통신은 TLS같은 암호화 프로토콜이 사용되는지 확인해야 한다. 이 서버는 안전하지 않거나 암호화 되어있지 않은 프로토콜에 대체 동작(fall back)이 발생하지 않아야 한다.",2 +V12,보안 통신,V12.3,일반 서비스 간의 통신 보안,V12.3.2,TLS 클라이언트가 통신하기 전에 TLS서버로 부터 받은 인증서를 검증하는지 확인해야 한다.,2 +V12,보안 통신,V12.3,일반 서비스 간의 통신 보안,V12.3.3,그리고 TLS 또는 애플리케이션 내의 내부 HTTP 기반 서비스간에 사용된 다른 적절한 전송 암호화 매커니즘이 안전하지 않거나 암호화 되어있지 않은 통신에 대체 동작(fall back)이 발생하지 않는지 확인해야 한다.,2 +V12,보안 통신,V12.3,일반 서비스 간의 통신 보안,V12.3.4,"내부 서버간에 TLS 통신이 신뢰된 인증서를 사용하는지 확인해야 한다. 내부 인증서나 자체 서명(self-signed)인증서를 사용할 경우, 이를 사용하는 서비스는 오직 특정 내부 인증기관(CA)과 자체 서명 인증만을 신뢰하게 설정해야 한다.",2 +V12,보안 통신,V12.3,일반 서비스 간의 통신 보안,V12.3.5,시스템 내부에서 통신하는 서비스(intra-service communication)는 각 엔드포인트를 검증하기 위해 강력한 인증을 사용해야 한다. 공용키(public-key) 기반 구조와 재전송 공격(replay attacks)에 저항하는 매커니즘을 사용하여 신원보장을 위해 TLS 클라이언트 인증과 같은 강력한 인증 방식을 사용해야 한다. 마이크로서비스 아키텍쳐의 경우 인증서 관리를 간소화 하고 보안을 강화하기 위해 서비스 매시(service mesh)를 사용하는 것을 고려해야 한다.,3 +V13,설정,V13.1,설정 문서,V13.1.1,"애플리케이션의 모든 통신 요구사항이 문서화 되어 있는지를 검증한다. 이는 애플리케이션이 의존하는 외부 서비스나, 사용자가 애플리케이션이 연결할 외부 위치를 제공하는 경우들을 포함한다.",2 +V13,설정,V13.1,설정 문서,V13.1.2,"애플리케이션이 사용하는 각각의 서비스들에 대해, 문서가 최대 동시 연결 수(연결 풀 제한)를 정의하고 있는지, 그리고 그 한계에 다다랐을 때 폴백(fallback)이나 복구 메커니즘 등을 포함하여, DoS 공격을 방지하기 위해 애플리케이션이 어떻게 동작하는지를 검증한다.",3 +V13,설정,V13.1,설정 문서,V13.1.3,"애플리케이션 문서가 모든 외부 시스템이나 애플리케이션이 사용하는 서비스(예시: 데이터베이스, 파일 핸들, 스레드, HTTP 연결)들에 대한 자원-관리 전략을 정의하고 있는지 검증한다.이는 자원-해제 프로시저, 시간초과 설정, 오류 핸들링을 포함하며, 재시도 로직이 구현된 경우 재시도 제한과 지연, 백-오프 알고리즘을 명시해야 한다. 동기 HTTP 요청-응답 명령에 대해서는 짧은 타임아웃에 더해 재시도의 비활성화 혹은 연쇄적인 지연과 자원 고갈을 방지하기 위한 재시도의 엄격한 제한을 의무화해야 한다.",3 +V13,설정,V13.1,설정 문서,V13.1.4,"애플리케이션 문서가 조직의 위협 모델과 사업적 요구사항에 기반하여, 애플리케이션의 보안과 비밀 정보들의 주기적 갱신 일정에 치명적인 비밀 정보들을 정의하고 있는지 검증한다.",3 +V13,설정,V13.2,백엔드 통신 설정,V13.2.1,"API나 미들웨어와 같은 애플리케이션의 표준 사용자 세션 메커니즘을 지원하지 않는 백엔드 애플리케이션 컴포넌트와 데이터 계층 사이의 통신이 인증되어 있는지를 검증한다. 인증은 반드시 개별적인 서비스 계정과 단기간 토큰, 또는 인증서 기반 인증을 사용하고 비밀번호, API 키, 또는 접근 권한이 부여된 공유 계정 등의 자격 증명을 변경하지 않아선 안 된다. ",2 +V13,설정,V13.2,백엔드 통신 설정,V13.2.2,"로컬 또는 운영체제 서비스, API, 미들웨어, 그리고 데이터 계층을 포함한 백엔드 애플리케이션 컴포넌트 간의 통신이 최소 필요 권한이 할당된 계정들로 수행되는지 검증한다.",2 +V13,설정,V13.2,백엔드 통신 설정,V13.2.3,"만약 자격 증명이 서비스 인증을 위해 필요하다면, 소비자로부터 사용되는 그 자격 증명이 기본 자격 증명이 아님을 검증한다. (예시: root/root 또는 admin/admin)",2 +V13,설정,V13.2,백엔드 통신 설정,V13.2.4,"얼로우리스트가 애플리케이션의 통신이 허가된 외부 리소스나 시스템을 정의하기 위해 사용되는지 검증한다. (예시: 아웃바운드 요청, 데이터 로드, 파일 접근). 이 얼로우리스트는 애플리케이션 계층, 웹 서버, 방화벽 또는 다른 여러 계층의 조합으로 구현할 수 있다. ",2 +V13,설정,V13.2,백엔드 통신 설정,V13.2.5,웹이나 애플리케이션 서버에 요청을 보내거나 데이터나 파일을 로드 할 수 있는 리소스 또는 시스템의 얼로우리스트가 설정되어 있는지를 검증한다.,2 +V13,설정,V13.2,백엔드 통신 설정,V13.2.6,"애플리케이션이 별도의 서비스와 연결할 때, 각 연결이 최대 병렬연결, 최대 연결 도달 시의 동작, 연결 타임아웃, 재시도 전략 등 문서화된 설정에 따르는지 검증한다.",3 +V13,설정,V13.3,비밀 정보 관리,V13.3.1,"키 볼트와 같은 비밀 정보 관리 솔루션이 백엔드 비밀 정보들을 만들고 저장하고, 접근을 제어하고, 파기하기 위해 사용되고 있는지 검증한다. 이는 비밀번호, 키 재료, 데이터베이스와 서드 파티 시스템의 통합, 시간-기반 토큰을 위한 키와 시드, 그리고 API 키들을 포함할 수 있다. 비밀 정보들은 애플리케이션 소스 코드 내부나, 빌드 아티팩트에 포함되어서는 안 된다. L3 애플리케이션에 대해서는, 반드시 HSM과 같은 하드웨어 기반 솔루션을 사용해야 한다.",2 +V13,설정,V13.3,비밀 정보 관리,V13.3.2,비밀 정보 자원들에 대한 접근이 최소 권한의 원칙을 고수하는지 검증한다.,2 +V13,설정,V13.3,비밀 정보 관리,V13.3.3,"보안 모듈에 대한 외부의 노출로부터 안전하게 키 재료를 관리하고 보호하기 위해 모든 암호 연산이 고립된 보안 모듈(볼트나, 하드웨어 보안 모듈 등)을 사용하여 수행되는지 검증한다.",3 +V13,설정,V13.3,비밀 정보 관리,V13.3.4,애플리케이션의 문서를 기반으로 비밀 정보들이 만료되고 갱신되도록 설정되었는지 검증한다.,3 +V13,설정,V13.4,의도하지 않은 정보 노출,V13.4.1,"애플리케이션이 .git 이나 .svn 폴더 같은 소스 코드 관리 메타데이터 없이 배포되었는지, 또는 이 폴더들이 외부적으로든 애플리케이션 자체에서든 접근할 수 없도록 배포되었는지 검증한다. ",1 +V13,설정,V13.4,의도하지 않은 정보 노출,V13.4.2,"실제 운영환경에서 디버깅 기능 노출이나 정보 누출을 방지하기 위해, 모든 컴포넌트에서 디버그 모드가 비활성화되어 있는지 검증한다.",2 +V13,설정,V13.4,의도하지 않은 정보 노출,V13.4.3,분명히 의도된 것이 아닌 이상 웹 서버가 폴더 목록을 클라이언트에게 노출하지 않는지 검증한다.,2 +V13,설정,V13.4,의도하지 않은 정보 노출,V13.4.4,잠재적인 정보 누출을 방지하기 위해 실제 운영환경에서 HTTP TRACE 메소드 사용이 지원되지 않는지 검증한다. ,2 +V13,설정,V13.4,의도하지 않은 정보 노출,V13.4.5,분명히 의도된 것이 아닌 이상 문서(내부 API 같은)와 모니터링 엔드포인트가 노출되지 않는지 검증한다.,2 +V13,설정,V13.4,의도하지 않은 정보 노출,V13.4.6,애플리케이션이 백엔드 컴포넌트의 자세한 버전 정보를 노출하지 않는지 검증한다.,3 +V13,설정,V13.4,의도하지 않은 정보 노출,V13.4.7,"웹 계층이 의도적이지 않은 정보, 설정, 소스코드 누출을 방지하기 위해 특정 파일 확장자만 서비스하도록 설정되었는지 검증한다.",3 +V14,데이터 보호,V14.1,데이터 보호 문서화,V14.1.1,"애플리케이션이 생성하고 처리하는 모든 민감한 데이터가 식별되고 보호 수준으로 분류되었는지 확인한다. 여기에는 단순히 인코딩되어 있고 쉽게 디코딩할 수 있는 데이터, 예를 들어 Base64 문자열이나 JWT 내부 평문 페이로드가 포함된다. 보호 수준은 애플리케이션이 준수해야 하는 모든 데이터 보호 및 개인정보 보호 관련 규정과 표준을 반드시 고려해야 한다.",2 +V14,데이터 보호,V14.1,데이터 보호 문서화,V14.1.2,"모든 민감한 데이터의 보호 수준에 대해 문서화된 요구사항이 있는지 확인한다. 반드시 여기에는(이에 한정되지 않지만) 일반적인 암호화, 무결성 검증, 보존 기간, 데이터 로그 기록 방식, 로그 내 민감한 데이터에 대한 접근 제어, 데이터베이스 암호화 수준, 사용할 개인정보 보호 및 개인정보 보호 강화 기술, 그리고 기타 기밀성 요구사항들 관련하여 포함되어야 한다.",2 +V14,데이터 보호,V14.2,일반 데이터 보호,V14.2.1,"민감한 데이터는 HTTP 메시지 본문이나 헤더 필드로만 서버에 전송되고, URL과 쿼리 문자열에는 API키나 세션토큰처럼 민감한 정보가 포함되지 않도록 검증한다.",1 +V14,데이터 보호,V14.2,일반 데이터 보호,V14.2.2,"서버 구성 요소에서 로드밸런서나 애플리케이션 캐시와 같은 민감한 데이터가 캐시되지 않게 하거나, 사용 후 해당 데이터를 안전하게 삭제하도록 검증한다.",2 +V14,데이터 보호,V14.2,일반 데이터 보호,V14.2.3,정의된 민감한 데이터가 애플리케이션의 통제를 벗어난 곳에서 원치 않는 수집을 예방하기 위해 신뢰할 수 없는 대상(예: 사용자 추적기)에게 전송되지 않도록 검증한다.,2 +V14,데이터 보호,V14.2,일반 데이터 보호,V14.2.4,"암호화, 무결성 검증, 보존, 데이터 로그 기록 방식, 로그 내 민감한 데이터 접근 제어, 개인정보 보호 및 개인정보 보호 강화 기술과 관련된 민감한 데이터 통제가, 해당 데이터 보호 수준에 대한 문서에 정의된 대로 구현되었는지 검증한다.",2 +V14,데이터 보호,V14.2,일반 데이터 보호,V14.2.5,"캐시 메커니즘이 해당 리소스에 대해 예상되는 콘텐츠 유형을 가진 응답만 캐시하고, 민감하거나 동적인 콘텐츠는 캐시하지 않도록 구성되어 있는지 검증한다. 존재하지 않는 파일에 접근했을 때 다른 유효한 파일을 반환하는 대신 웹 서버는 404 또는 302 응답을 반환해야 한다. 이는 Web Cache Deception 공격을 예방한다.",3 +V14,데이터 보호,V14.2,일반 데이터 보호,V14.2.6,"애플리케이션 기능에 필요한 최소한의 민감한 데이터만 반환을 검증한다. 예를 들어, 전체 신용카드 번호가 아닌 일부 숫자만 반환해야 한다. 만약 전체 데이터가 필요한 경우, 사용자가 구체적으로 조회하지 않는 한 사용자 인터페이스에서는 마스킹하는 것이 권장된다.",3 +V14,데이터 보호,V14.2,일반 데이터 보호,V14.2.7,"민감한 정보는 데이터 보존 분류 기준에 따라 관리되어야 하고, 오래되었거나 불필요한 데이터는 사전에 정의된 작업 또는 상황에 따라 자동으로 삭제되도록 검증한다.",3 +V14,데이터 보호,V14.2,일반 데이터 보호,V14.2.8,사용자가 제출한 파일의 메타데이터에서 사용자가 저장에 동의하지 않는 한 민감한 정보는 제거를 검증한다.,3 +V14,데이터 보호,V14.3,클라이언트 측 데이터 보호,V14.3.1,"클라이언트나 세션이 종료된 후에 브라우저 DOM과 같은 클라이언트 스토리지에서 인증된 데이터를 삭제되는지 검증한다. 이를 위해 ‘Clear-Site-Data’ HTTP 응답 헤더 필드를 사용할 수 있으나, 세션 종료 시 서버 연결이 불가능한 경우에도 클라이언트 측에서 해당 데이터를 삭제하는 것이 권장된다.",1 +V14,데이터 보호,V14.3,클라이언트 측 데이터 보호,V14.3.2,"애플리케이션이 브라우저에서 민감한 데이터가 캐시되지 않도록, (Cache-Control: no-store)충분한 캐시 방지 HTTP 응답 헤더 필드를 설정을 검증한다.",2 +V14,데이터 보호,V14.3,클라이언트 측 데이터 보호,V14.3.3,"브라우저 저장소(localStorage, sessionStorage, IndexedDB, 쿠키)에 저장되는 데이터에는 세션 토큰을 제외한 민감 데이터가 포함되지 않도록 검증한다.",2 +V15,보안 코딩 및 아키텍처,V15.1,보안 코딩 및 아키텍처 문서화,V15.1.1,"애플리케이션 문서에 취약점이 존재하는 서드파티 구성요소 버전 및 일반적인 라이브러리 업데이트에 대해, 해당 구성요소로부터 발생할 수 있는 위험을 최소화하기 위한 위험 기반 대응 기한이 정의되어 있는지 확인해야 한다.",1 +V15,보안 코딩 및 아키텍처,V15.1,보안 코딩 및 아키텍처 문서화,V15.1.2,"사용 중인 모든 서드파티 라이브러리에 대해 소프트웨어 자재 명세서(SBOM)와 같은 인벤토리가 유지되고 있으며, 해당 구성요소가 사전에 정의된 신뢰할 수 있고 지속적으로 관리되는 저장소에서 제공되는지 확인해야 한다.",2 +V15,보안 코딩 및 아키텍처,V15.1,보안 코딩 및 아키텍처 문서화,V15.1.3,"애플리케이션 문서에 시간 소모가 크거나 리소스 소비가 많은 기능이 식별되어 있으며, 해당 기능의 과도한 사용으로 인해 가용성이 손실되지 않도록 하는 방법과, 응답 생성이 소비자의 타임아웃보다 오래 걸리는 상황을 방지하는 방법이 포함되어 있는지 확인해야 한다. 가능한 방어 전략에는 비동기 처리, 큐(queue) 사용, 사용자 및 애플리케이션 단위의 병렬 처리 제한 등이 있다.",2 +V15,보안 코딩 및 아키텍처,V15.1,보안 코딩 및 아키텍처 문서화,V15.1.4,애플리케이션 문서에 위험한 구성요소로 간주되는 서드파티 라이브러리가 강조되어 있는지 확인해야 한다.,3 +V15,보안 코딩 및 아키텍처,V15.1,보안 코딩 및 아키텍처 문서화,V15.1.5,애플리케이션 문서에 위험한 기능을 사용하는 애플리케이션의 부분이 강조되어 있는지 확인해야 한다.,3 +V15,보안 코딩 및 아키텍처,V15.2,보안 아키텍처 및 종속성,V15.2.1,애플리케이션이 문서화된 업데이트 및 대응 기한을 위반하지 않은 구성요소만 포함하고 있는지 확인해야 한다.,1 +V15,보안 코딩 및 아키텍처,V15.2,보안 아키텍처 및 종속성,V15.2.2,"애플리케이션이 시간 소모가 크거나 리소스 소비가 많은 기능의 과도한 사용으로 인한 가용성 손실을 방지하기 위해, 해당 기능에 대한 문서화된 보안 결정 및 전략을 기반으로 방어 조치를 구현하고 있는지 확인해야 한다.",2 +V15,보안 코딩 및 아키텍처,V15.2,보안 아키텍처 및 종속성,V15.2.3,"운영 환경에 애플리케이션 기능 수행에 필요한 기능만 포함되어 있으며, 테스트 코드, 샘플 코드, 개발용 기능 등 불필요한 기능이 노출되지 않도록 구성되어 있는지 확인해야 한다.",2 +V15,보안 코딩 및 아키텍처,V15.2,보안 아키텍처 및 종속성,V15.2.4,"서드파티 구성요소 및 그 모든 전이 종속성(transitive dependencies)이 내부 또는 외부의 예상된 저장소에서 가져며, 의존성 혼동(dependency confusion) 공격의 위험이 없는지 확인해야 한다.",3 +V15,보안 코딩 및 아키텍처,V15.2,보안 아키텍처 및 종속성,V15.2.5,"애플리케이션이 위험한 기능을 포함하거나 위험한 구성요소를 사용하는 부분에 대해 샌드박싱, 캡슐화, 컨테이너화, 네트워크 수준 격리와 같은 추가적인 보호 기법을 구현하여, 애플리케이션의 한 부분이 침해되더라도 공격자가 다른 영역으로 확산하지 못하도록 지연 및 차단하고 있는지 확인해야 한다.",3 +V15,보안 코딩 및 아키텍처,V15.3,방어적(Defensive) 코딩,V15.3.1,"애플리케이션이 데이터 객체에서 필요한 필드만 선택적으로 반환하고 있는지 확인해야 한다. 예를 들어, 일부 필드는 사용자에게 노출되어서는 안 되므로 전체 데이터 객체를 반환해서는 안 된다.",1 +V15,보안 코딩 및 아키텍처,V15.3,방어적(Defensive) 코딩,V15.3.2,"애플리케이션 백엔드에서 외부 URL로 요청을 보낼 때, 의도된 기능이 아닌 경우 리디렉션을 따르지 않도록 구성되어 있는지 확인해야 한다.",2 +V15,보안 코딩 및 아키텍처,V15.3,방어적(Defensive) 코딩,V15.3.3,"애플리케이션이 각 컨트롤러 및 액션 단위로 허용된 필드를 제한함으로써, 대량 할당(mass assignment) 공격에 대한 방어가 구현되어 있는지 확인해야 한다. 예를 들어, 특정 동작에 포함되지 않은 필드 값을 삽입하거나 수정할 수 없어야 한다.",2 +V15,보안 코딩 및 아키텍처,V15.3,방어적(Defensive) 코딩,V15.3.4,"모든 프록시 및 미들웨어 구성요소가 사용자의 원래 IP 주소를 신뢰 가능한 데이터 필드를 통해 정확하게 전달하고 있으며, 애플리케이션과 웹 서버가 이 값을 로그 기록이나 속도 제한(rate limiting)과 같은 보안 결정에 사용하는지 확인해야 한다. 단, 동적 IP, VPN, 방화벽 등으로 인해 원래 IP조차 완전히 신뢰할 수 없는 점도 고려해야 한다.",2 +V15,보안 코딩 및 아키텍처,V15.3,방어적(Defensive) 코딩,V15.3.5,"애플리케이션이 변수의 타입이 올바른지 명시적으로 확인하고, 엄격한 동등성 비교 및 연산자를 사용하여 타입 혼용(type juggling) 또는 타입 혼동(type confusion)으로 인한 취약점을 방지하고 있는지 확인해야 한다.",2 +V15,보안 코딩 및 아키텍처,V15.3,방어적(Defensive) 코딩,V15.3.6,"JavaScript 코드가 프로토타입 오염(prototype pollution)을 방지할 수 있도록 작성되어 있는지 확인해야 한다. 예를 들어, 객체 리터럴 대신 `Set()` 또는 `Map()`을 사용하는 방식이 권장된다.",2 +V15,보안 코딩 및 아키텍처,V15.3,방어적(Defensive) 코딩,V15.3.7,"애플리케이션이 HTTP 파라미터 오염(HTTP parameter pollution) 공격에 대한 방어를 구현하고 있는지 확인해야 한다. 특히, 애플리케이션 프레임워크가 요청 파라미터의 출처(쿼리 스트링, 본문, 쿠키, 헤더)를 구분하지 않는 경우 이를 고려해야 한다.",2 +V15,보안 코딩 및 아키텍처,V15.4,안전한 동시성,V15.4.1,"다중 스레드 코드에서 캐시, 파일, 다수 스레드가 접근하는 메모리 내 객체 등 공유 객체에 접근할 때, 스레드 세이프(thread-safe) 타입과 락·세마포어 같은 동기화 메커니즘을 사용하여 경쟁 상태와 데이터 손상을 피하고 안전하게 접근하는지 확인해야 한다.",3 +V15,보안 코딩 및 아키텍처,V15.4,안전한 동시성,V15.4.2,"리소스의 존재 여부나 권한과 같은 상태 검사와, 그 검사 결과에 의존하는 동작이 단일(atomic) 연산으로 수행되어 TOCTOU 경쟁 상태를 방지하는지 확인해야 한다. (예: 파일을 열기 전에 존재 여부를 확인하는 작업과 파일 열기 동작을 분리하지 않기, 접근 권한 검증과 권한 부여를 동일 트랜잭션/원자적 구간에서 수행하기)",3 +V15,보안 코딩 및 아키텍처,V15.4,안전한 동시성,V15.4.3,"스레드가 서로를 기다리거나 무한 재시도에 빠지지 않도록 일관된 락 사용을 보장하고, 락 관리 로직을 리소스 관리 책임 코드 내부에 유지하여 외부 클래스 및 코드가 우발적·악의적으로 락을 변경하지 못하도록 하는지 확인해야 한다.",3 +V15,보안 코딩 및 아키텍처,V15.4,안전한 동시성,V15.4.4,"**스레드 풀** 활용 등 **리소스 할당 정책**을 통해 공정한 리소스 접근을 보장하고, 우선순위가 낮은 스레드도 합리적 시간 내 진행될 수 있게 하여 **스레드 기아**를 방지하는지 확인해야 한다.",3 +V16,보안 로깅과 오류 처리,V16.1,보안 로깅 문서화,V16.1.1,"애플리케이션의 기술 스택의 각 계층에서 수행된 로깅에 대해, 어떤 이벤트들이 로그로 남았는지, 로그의 형식이 무엇인지, 로그가 어디에 저장되었는지, 어떻게 사용되는지, 로그에 대한 접근이 어떻게 제어되는지, 그리고 로그가 얼마나 보관되는지에 대해 문서화한 목록이 존재하는지 검증한다.",2 +V16,보안 로깅과 오류 처리,V16.2,일반 로깅,V16.2.1,"이벤트가 발생했을 때 그 타임라인을 자세히 조사할 수 있도록 각 로그의 항목이 필수적인 메타데이터(언제, 어디서, 누가, 무엇을 등)을 포함하는지 검증한다. ",2 +V16,보안 로깅과 오류 처리,V16.2,일반 로깅,V16.2.2,"모든 로깅 컴포넌트의 시간 소스가 동기화되어 있는지, 그리고 보안 이벤트 메타데이터에서 타임스탬프가 UTC를 사용하거나 혹은 명시적인 시간대 오프셋을 포함하는지 검증한다. UTC는 분산 시스템 전체에 걸친 일관성을 보장하고, 일광 절약 시간제 전환 시의 혼란을 방지하기 위해 추천된다.",2 +V16,보안 로깅과 오류 처리,V16.2,일반 로깅,V16.2.3,"애플리케이션이 로그를 저장만 하는지, 혹은 로그 목록에서 문서화 된 파일이나 서비스로 브로드캐스트하는지 검증한다.",2 +V16,보안 로깅과 오류 처리,V16.2,일반 로깅,V16.2.4,"사용 중인 로그 처리기가 로그를 읽고, 또 상호 연관 지을 수 있는지 검증한다. 가능하다면 공통 로깅 형식을 사용하는 것이 좋다.",2 +V16,보안 로깅과 오류 처리,V16.2,일반 로깅,V16.2.5,"민감한 데이터를 로깅할때, 애플리케이션이 데이터의 보호 수준을 기반으로 로깅을 수행하는지 검증한다. 예를 들어, 자격 증명이나, 지불 상세 정보 등의 특정 데이터는 로깅 해서는 안 된다. 또한 세션 토큰 등의 데이터는 전체 혹은 일부분이 해싱된, 마스킹 된 상태로 로깅 되어야 한다.",2 +V16,보안 로깅과 오류 처리,V16.3,보안 이벤트,V16.3.1,"성공한 시도와 실패한 시도를 포함하여 모든 인증 명령을 로깅 하는지 검증한다. 인증의 종류나, 사용한 인증 요소 등의 추가적인 메타데이터 또한 수집해야 한다.",2 +V16,보안 로깅과 오류 처리,V16.3,보안 이벤트,V16.3.2,실패한 인가 시도들도 로깅 하는지 검증한다. L3에 대해서는 반드시 민감한 데이터가 접근되었을 때를 포함하여(민감한 데이터 자체는 제외하고) 모든 인가 결정들의 로그를 포함해야 한다.,2 +V16,보안 로깅과 오류 처리,V16.3,보안 이벤트,V16.3.3,"애플리케이션이 이 문서에서 정의한 보안 이벤트들을 로깅하고, 또한 입력값 확인, 비즈니스 로직, 그리고 자동화 방지 등의 보안 제어를 우회하려는 시도들도 로깅 하는지 검증한다.",2 +V16,보안 로깅과 오류 처리,V16.3,보안 이벤트,V16.3.4,애플리케이션이 백엔드 TLS 오류와 같은 예상치 못한 오류나 보안 제어 오류들을 로깅 하는지 검증한다.,2 +V16,보안 로깅과 오류 처리,V16.4,로그 보호,V16.4.1,로그 삽입을 방지하기 위해 모든 로깅 컴포넌트가 적절히 데이터를 인코딩하는지 검증한다.,2 +V16,보안 로깅과 오류 처리,V16.4,로그 보호,V16.4.2,로그가 비인가된 접근으로부터 보호되고 수정할 수 없는지 검증한다.,2 +V16,보안 로깅과 오류 처리,V16.4,로그 보호,V16.4.3,"분석, 탐지, 경보, 그리고 에스컬레이션(escalation)을 위해 로그가 논리적으로 분리된 시스템으로 안전하게 전송되는지 검증한다. 애플리케이션이 침해되더라도 로그는 훼손하지 못하도록 보장하는 것이 목적이다.",2 +V16,보안 로깅과 오류 처리,V16.5,오류 처리,V16.5.1,"예상치 못한 혹은 보안 측면에서 민감한 오류가 발생했을 때 스택 흔적, 쿼리, 비밀키, 그리고 토큰 등의 민감한 내부 시스템 데이터의 노출 방지를 보장하기 위해 유저에게 구체화하지 않은 메시지를 반환하는지 검증한다.",2 +V16,보안 로깅과 오류 처리,V16.5,오류 처리,V16.5.2,외부 리소스 접근 오류가 발생하더라도 애플리케이션이 계속해서 안전하게 작동하는지 검증한다. 예를 들어 서킷 브레이커(circuit breaker)나 우아한 성능 저하와 같은 패턴을 사용할 수 있다.,2 +V16,보안 로깅과 오류 처리,V16.5,오류 처리,V16.5.3,"예외가 발생할 때, 검증 로직의 오류에도 불구하고 거래를 처리하는 등의 페일-오픈(fail-open) 상태 방지를 포함하여 애플리케이션이 우아하고 안전하게 실패하는지 검증한다. ",2 +V16,보안 로깅과 오류 처리,V16.5,오류 처리,V16.5.4,"처리되지 못한 모든 예외를 처리할 “최후의 수단” 오류 핸들러가 정의되어 있는지 검증한다. 이는 로그 파일에 기록되어야 하는 오류 상세 정보들의 손실을 피하기 위함과 동시에, 오류로 인해 전체 애플리케이션 프로세스가 종료되어 가용성 손실로 이어지지 않도록 보장하기 위함이다. ",3 +V17,WebRTC,V17.1,TURN 서버,V17.1.1,"Traversal Using Relays around NAT(TURN) 서비스가 특정 목적을 위해 보존된 주소(예: 내부 네트워크, 브로드캐스트, 루프백)를 제외한 주소에 대해서만 접근을 허용하도록 한다.",2 +V17,WebRTC,V17.1,TURN 서버,V17.1.2,Traversal Using Relays around NAT(TURN) 서비스가 정당한 사용자의 TURN 서버 포트의 대량 개방 시 자원고갈에 취약하지 않도록 한다.,3 +V17,WebRTC,V17.2,미디어,V17.2.1,데이터그램 전송 계층 보안(DTLS) 인증서의 키가 암호화 키 관리에 대한 문서화된 정책에 따라 관리되고 보호되는지 확인해야 한다.,2 +V17,WebRTC,V17.2,미디어,V17.2.2,"미디어 서버가 승인된 데이터그램 전송 계층 보안(DTLS) 암호 모음을 사용하고 지원하도록 구성되었는지, 그리고 보안 실시간 전송 프로토콜(DTLS-SRTP)을 위한 키 생성에 사용되는 DTLS 확장을 위한 안전한 보호 프로파일을 구성했는지 확인해야 한다.",2 +V17,WebRTC,V17.2,미디어,V17.2.3,미디어 서버에서 보안 실시간 전송 프로토콜(SRTP) 인증이 선택되어 있는지 확인한다. 이를 통해 실시간 전송 프로토콜(RTP) 삽입 공격으로 인한 서비스 거부 상태 발생 또는 오디오/비디오 미디어가 미디어 스트림에 삽입되는 것을 방지할 수 있다.,2 +V17,WebRTC,V17.2,미디어,V17.2.4,미디어 서버가 잘못된 형식의 보안 실시간 전송 프로토콜(SRTP) 패킷을 접했을 때도 수신 미디어 트래픽 처리를 계속할 수 있는지 확인해야 한다.,2 +V17,WebRTC,V17.2,미디어,V17.2.5,미디어 서버가 정상 사용자로부터의 보안 실시간 전송 프로토콜(SRTP) 패킷이 대량으로 유입되는 상황에서도 수신 미디어 트래픽 처리를 계속할 수 있는지 확인해야 한다.,3 +V17,WebRTC,V17.2,미디어,V17.2.6,미디어 서버가 Datagram Transport Layer Security(DTLS)의 “ClientHello” 경합 조건 취약점에 노출되지 않았는지 확인해야 한다. 이를 위해 해당 미디어 서버가 공개적으로 취약한 것으로 알려져 있는지 확인하거나 경합 조건 테스트를 수행해야 한다.,3 +V17,WebRTC,V17.2,미디어,V17.2.7,미디어 서버와 연결된 모든 오디오 또는 비디오 녹화 장치가 합법적인 사용자로부터의 보안 실시간 전송 프로토콜(SRTP) 패킷이 대량으로 유입되는 상황에서도 수신 미디어 트래픽 처리를 계속할 수 있는지 확인해야 한다.,3 +V17,WebRTC,V17.2,미디어,V17.2.8,"데이터그램 전송 계층 보안(DTLS) 인증서가 세션 설명 프로토콜(SDP) 지문 속성과 대조되어 검증되었는지 확인하고, 검증이 실패할 경우 미디어 스트림을 종료하여 미디어 스트림의 진위성을 보장해야 한다.",3 +V17,WebRTC,V17.3,신호 처리,V17.3.1,신호 서버가 플러드 공격 중에도 합법적인 수신 신호 메시지 처리를 계속할 수 있는지 확인해야 한다. 이는 신호 수준에서 속도 제한을 구현함으로써 달성되어야 한다.,2 +V17,WebRTC,V17.3,신호 처리,V17.3.2,"서비스 거부 상태를 유발할 수 있는 잘못된 형식의 신호 메시지를 접했을 때 신호 서버가 정상적인 신호 메시지 처리를 계속할 수 있는지 확인해야 한다. 여기에는 입력 검증 구현, 정수 오버플로우 안전 처리, 버퍼 오버플로우 방지 및 기타 강력한 오류 처리 기법 적용이 포함될 수 있다.",2 + diff --git a/5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.docx b/5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.docx new file mode 100644 index 0000000000000000000000000000000000000000..fed4a9e6123fb49cc95e9cbebe265e9e2444cecb GIT binary patch literal 224281 zcmV)RK(oJ4O9KQH00IaI0D3}dTf7#JoU;J{0JaJM022TJ09!+EZggdCbYE0?aAk8{ zE_iKh#g^G>!!QsN0)1%%O+P@9#)+u4AWgQv@7QikNki;3F?liA znz{GrN-`RZH#&<};DfSe826HH9Dxy5Dl;F(pVODleLNlwrdtOgqEZuv@dD93Fc!oD zG!Kb&U}z+@UUQ^ZKWC1MFFps>?{@E)um-_k2Xl>hG>_EbDTs zVa%P&l;B9itQchn8$D#LMyq?4?^$a}KUY?_puBQmCg%KJj zfwcdieD==fC}iqAQ*xN{Sq7J%cqM(5g8C=ky1>ZoYzD|rk_6cy5C+YH*+>4k2+f2DA7f@(x_W$HnM)p>ObQS6kP96*c4 zVjJsGN!L>>fJ^Y_|8@Q_l)_B`Zm$i{zaBuoTCF5d3O5C4A%W8XTG)h50W?U(nSYi2 zUgFGr4?^ku3Rrxv7b%MCRakKm9eo2(O9KQH00IaI0D3}dTeo+l@8+Noe~dmdUru;%oQpS5O9KQH00IaI0D3}dTZP2j z09>yD09^_V01*HH0C#V4WG`fIV|8t1ZgehqZEWnlZF5ssnlAiTc4ewh+2@e}+dv4J zo_T0U(sV(G!E}pP~<4lARL_RU6tDc|I zAHBE!!*jo_wb$C(k}a@=+{ayMZ0lw3wbowie!cGN{>Oj*=Gw4xJ)X`aQpsO`(0Aa_ z2TnXWl)98iUitM0f4J~z^wzGV8$SlbPc;e*MAKYYABw`z~!zDAM8JL=;*;~u|)C%xy-el zTqbq-a$+ccN(P`VlD(=fl78EZq~pV}EX+G|H8GM=S4;i+gVA*IxLhiFEisf%Wm1>3 z(V^6}<9rqQp}ujw**C6V8&;pY(RXME*TzLt--zvGW|z{j8x59sBr)_BSAcJ2N7H(G zH%8v#8up_<#czIq8|h-|(oOt1LjRmg(~rUI&EdFnLU`n2vba5c21^} zS&(NLnxg*nACifGAC1eb&FdXB?gPKbx3@WtpP&3~JcbIPg>|eOVB^O|m$^KA>EzW| z+R?vVxH$qBycoZN(hMe%NM~>U`h#qGG%iz3Bs1Cch4?p(2Jrbw=igG!|M>UORQBV( z=m7uX{M%LM-~Pk-w^1B|zCx1$Wa1;SwAw-qKNU}2Qfs4UchFwpgZe>VOr^fQ7E6CU zn1!bTS4v#^^#=ooaFWT`HMp3UFS=`0xnbkSBG06+6+uZ?4t)|~gX%X1#R4Si-I>}d z7k4_g{uai@H*oj{EuQgD6X{GA_IT_{IyQ3koivBTGTvcn?C_|1PK=BUCx*yYa0cT; zqv=HUrUSAraaq5bjU_L|(w9DVP7HoA*y}CAROa%vTg$cad$qgOhy$~7%SCT#I^xvE zr@Xt%wR|}uck@blcrIJzT*S$yQp3*H%U4^~Z@u|(Z@m)1C2=?M@J;xD!=J9r6`lIA zdy9F;E6sU}1-RX-HShJDzSrHV;6~|986q`U5RH7%AgO7pyH$P z4up+YU4Sna!&{t54Sk()k||IS$t&>_>2&JGRoIjnSlbW$mop=&AF- zI5F~RVt5#DfxkQHJrQ?HkwU+fEW1Ya{3zn1i!@jhMw$A^?YNvUz%=~gZ}qN;7EKHPhE5H7Z@&# ziLM{JekP+vr#^$PCsQ~wzRhsb0Z;RzBOn@rZ{dofV4**H)69(M#iS>H z(ArVv-*`^^198weCp$fRr*YTF0c_#m%Pwp2p#KJ(D70K!xY5bf$jx-(%GIp%|2+rU za_CqT1&njyYTWt!%M*j=oKI7upu%wY;nI9pN8`Q(jkH!pi{$R?J6POT!Tw6aL;D)e zLqZP2;Scmx(lQcTL8$L&o9$fFg-gd_Rj$Xul)ZK>mCQINve|Uv;wY|EbP#O7_=(}f z*Kz0YfkVz|u=dhPTEy6}b0+-R>M`%8d*RJbJML^5bQkEba_#<_J6&w3n0NJ2dP{3; zM>uX_8Vv}(zvE37(ZH#KT`>c;jJpO}wO}b%$9q!VdQm~U#ry!)i+l@`G^ih{A@K4_0wYuv`++l0;}dvREP$X>iS zY&&7-Pssq`y)WVQEV&*euHmm6TKD4nXJGc|q@X!+KE?0dI6fRR|DrcfriMqaC5`v3 z7m}&p{s!z?{nr=9Uo@;k@ISR0=GZ?=CobWySKudHk;gai(NQ(T@YfGo-_7#HhWKC5 zP}@8mIG(WjS-Ha>ht%uC@yo4j=TC;gzdHjOI^;PW^vBcTQT;BJx$2yBK1-)EnQO6R zzf&-z_^@+wG<)@8Je}Qk{SN9Q86snjHj^z6Q=ts>=lUXR(WEl0YdKTC98J_u2Rra8I4z#fC6o+Eq&k zwsta^aL%Pi!I4dL)zHBCOFHNa#4g8%L5g?P;6Aw&Pdfh^OT&*QtF{xx_hB=|cg#?H z-*0-4W}{oxvNylxElsyY_t8BZeUJZZ)!*JQs|Wv>il;A;Vf}Ud8aTjRbwo~QVzD9T zO#DVOh4$V>Gn_c*WGtPG-|VWz8-(4PPC1{&Mu*-}z8q^NUq15X3mp2|?VK-PI7tBB z_0MJRVWl0?hVST08%`9cJGK~PdFw1e{U{^{lXKkHIrz=_1mi%p`)jqiRd>1oL!+!t zN8&(74t(Rd>v^w~$2d=IY|SlAxU(y2j2NGq$h(Vg-07mTwf@F?RE{{GC9=OAy+~u8 zEPI;|C=~SI1$-WpRL?6;?cvkfhf946|FK3?IDn zU>O&a{XAS8_#95UxamGAs?eBIE9AYUHM$oq^Q~2HF0ayg?#iEVAeaz*QuY>ddW>^F z!jqvf!tssYaIS+1b19y72D7Q5uOrS`jA{NR1>SPz>qNx)UHtN8=gY+Ka3Xds6LC(( zuE*iep{wvVJ~4PYYwmYz{?_EF6>4*^178)r$^=a!{{naAJUu68>*eOwi!y$YzlC#l ze^_-NlwddKVd`7I6r8Q{G)5OOa#;L@Gn{!fZ(RFQ-oB?hm7}$TUASH`&c{}H%-Ee0 zdVab|%l)L>VvzBpfSmH*8fcc_960QYFn6_z;$vmUwoxmIetq#y38oz<(lI%XNlx`F zaF-O8y~z@M@HRf)+5#Twojea~W%~@{vuzlK&VmzAVz}dZJ|7_5i!O%7e_3|_d)b|w z0C@@Le#R|5rB%E0icZ>k!CRcd$U7W1l(V?rl+%YJ2y5&;-UvzW!#Q;DG;HL(yUTPY z^2=K<^9r*-s!rnwFhpN1J6@4M2%u@UD)1o3yv1rLO2Ee?G<&4GDxFcX!n(2O1yM`W zgNcF==s(oohf69V6+s$?Qt7!4pFS|qOK-m};wrLy1~m%n6EXMgB0*JZvw2iTk5^IA z3YG)E%&U!f5Bz9e^b{>vArBIYKD0aoDO6T%IXO@YU2WEs*smoH_n~gYD zaFO&!{)P8=Izq2JTibeBlEfjVYhZ#nCu4UaT4k#;i7MGyz#BI7=st4&Rl zoj3^=#T1?i*lF~_5B~|j=E(Hm&+|a(`PL4NV%k9{?Rc-@DFS=LD@`BAqa~`xJh*idPyw+bN?no2 z6CO3C=PKO!zje1_+Jk-sEy^X+j_Pf_p!YW;sjL+Cw&c zYIir_fzUReDB;OM0}hvavEZ&%Y74WB&_Y{=Kmf>ftKvO+&L%ZYbfHLR{JV1Sa&Y}86)-h|p=|HKZtxe2 z)sC2Yu&Bo!Q{>5B4}3iDf817d_3L^cZ0>QrplHNzYBl_N7E~ghD);VFl$wj=$auHG zRUx4Vztt9=)45t%@?ICrJ+P94^9MHv35fY|Z)J?W&RfPB1}Qce-aJeaT&?w0xgbhf zrHkQ4x7p5pf-^Lse!Mfg=+Uv9qJvD+Ij+r@0e5m0&JTG9_o}o^#S*L(F4IcRU73og z6+k&l&mF%;U&rHl4>t9;Z%6~Z$k%Q!)-Qv|NO_!mF{e*?aI}E(O>0+FCh#vF9eQMZ z&XwoA{$C(o{FmFMrc4}OB*A}kN?=jn--*VuC6M@$ArP`?lsifpe6iz zPFV6)$@+x(MeW|99IM^`(ak@gI|Phv@AVvr1&XebMPzD;*R%8q+1~|lLy92G=!j3` z-Dedg4e6D?PUA4WxjbAO@njN%JjtPOS0+nq zfz!i*qeP0HhSd&5PZk{Zat6yPhq!JpSaH}W}1r38#K}2Vwmn?dB={&PSNj{ z^={VC)eUT?XL{hBbWW)t{Z1SNf6KK}_pcmy6eJ)G9#Xs<15IeN zp`-BJ+&%?$I?6>#IiSo7*rITi+Mg$sm1!nxbO1(Oz}(lyVc7baq9 zYd)%Go+`vPsEAD|vJE39lZz@M2KH(Ff#&F_j2@+2V~OjFRuuhswN4esG%~K9gHUzX z-}HPLzv!4|8=Qvtjo9$;$Ih20KJ5i%^rYxMKsz1dv4nZxA{&xaiab?Ua z&7gV&>FaL;>vKkYl$DSH+rYi|Q;r}F9Op!20*1K!fJ(@YDabg-5wLP0$6CQTdQsvoZJdL zqMk(ZB397#vgHiE=i}S{o2k*Pyz9-Ex7N#Y8_L5}a^O7ENKBoilte{T?ap+a;bOxl_+s2!$}3%t=W~4?rU_pSHE`g0gFmcoEVhO; z9HcNoS9q`tSBN;Lem_X|OR1=~wE0yqyCh&x1H(rh4Bq0trH4~`*11wTE2i`W-J?)J z=`D>*-k-SvB$evDE~=MrFOnoQC8=R_(3SYz!nw7>EvYgU7n_5y8w~5Ns+}zj5kk>+eRC8qdp3 zZlt*!XoW~R)~TnRhCrItD-Ia-iY$xUVZep38nw}AQ$Bpa{MJENaEX>ZI0l^Hz$EHJ z+S2Y%7`IoN9bM_IpQ}#o5gO0*7?#E{5W+b(yL2>gvx>$c62dTCE-BR~xe+vyC<-wx zVUD0TL>f&ni|V_Sn&Xgm5l*C^57f#<&kj*;ph`iTZx%Z$;zi<>#>6*)slAy+g99C( z+c5J@Jy zgtCr{g#7}$UCxEP$IzK>@sB3Kk6vw?Pt+2N8|~+=SQW5`;Tg5hQ=DIGy@GzAS&`3x zQRKs6v34A>w_>Y%*D!*a?|>g1jy5o9;(HP$7!oTpm}Y5|xZ#LlP%SC@rOss) zzt%(^SRWFnowO&p6>PAw*;_!($w6^P)en%Nj^9Gyk^z*k(dCq2*WO%2lFkNpT6y#2 z(FC%8?N?pkDk9X1Fo*`w-NZ85u~cz1QAVm~E^5pC4k>IxM3HN=JmX?|U0bLW`pnlJ z-Sdsf+H50RRU3+3BXBI_nX;P~3TUBoNreS8GCVIZ(;xnV2^VGR7^eW1xNR~_f$vr( zaNm(nVTBFI8sqbH@@hPmbq24-wHNK)9~ZY!K$R4<0PoO@ipd$2j76THdH6t0b)&EgMLDZvp<^I)k==!d z2i0) zlkG*gkjjUl4}xG2+MN8E%+=KB@Fl_;=uhpy``g{f8pEL7m1$U+h&@1ZP&rVDM$KG> ztQiaEDaCE#ZovzMSCr>lo}neag<(0Bp$+=a>G@ZnV0QY_Kd1GP$9k02X*AJW%!%s-eM7ubX? zc!Nf?%5n#7X%Vst&i~w9pHma^vDV8o9-J19J>%??nwE%FGN4-&tHJs}3vpqv>gx15 z9K9&dKgv+_wgmc&yV=0^PKn$GB~zmH<@uAh#7PuQPwPIPMYJ0z+Ghn(nGB;5V_YI{ z-a?*AOpB5gtc&Z@eeO{<0G%K~UWP*Nc$bI=$2DLp`3?yy-qWF`ctO`r>r)CV_sUy( zqOt&?@l3WSxIkbTgYoD+;Z6u9%v7A5g0B;pB70I~c*_)wDI&QCgk9Ahtzs+_kJzoX z2o;(O?A+ zOQ~S4p_v{#^P;o6fh}aZMP6xU>*q~XZ1`$T=f%V*GV6Vms-fBF+|_NnAiz*RrT?T- z8%wNev){(oTp9dv zdyL_u1+z{FHwi}Zig|g|U`(rw+0s)hf1)?1@D|o!fFZ199fx9*q6m3k1G85^+urv{F^LMn&gmZGYij)UbyDkjG zXyPq_9;z}*2LV3houEu5^NFO#{k->>lDl>3NT(i&;m=IOOvRM^1rg+hIb zDhSDoTzmMfG2sr0E!ehoTe7Jk8j##@&V!D0sLXDx+)4g{!>NiDRjH(@jum-AA!G{% z;3CWsLw>I298rbN`6}KQ{q&_gBewLuttdm;--&P~rTjs9Ju<6k5Fa)-MTd&wDXL|M zpvD@341}6T))9Q7*)`s~3whBTYB+fjCZrIgELE+MQGRpXdDn*g<%zxOtcXhSq(L6{WWu9wg}0P zM0@!r5iP*fxKy2raGH~;hAR(}PgP)>JKHVKVsXpL7;o+lEu=Nl+Y=b+dsH#taO(Mk z4gYY4`C=%iiDrD=@vNstQPpk*m1GsdnAbV?bzU9ZI+1H;&+s&2StLS_D>;AD@iPgy z4%k4acITDj{Zc_9{QMM-WFe<2b(av{R|Su%_9u+np>C{;FX*tp|76rY2_7DK;68#$ zCr*tOaqr~ZrF*KpX?)XN;$oipHB3$terX~M1ZQX#kWZaN2B~RHu31n*mg1yLePQ66 zGyy(^T;O~P*_M?-r&H;GIfEsNPl~2i4b+p0a#x(b94B^ zW42C>NTwr>uLMszttar*R%z8+UOu3pt6KsU7@m(XTWF%RpK0VMDHCwXy?e z0^P9uTfExRQ-k$MAvl^O9&8E;y0b6{GQ$^LhWLCUN+mJ&yuKhQXl_cU5U@3bA3`pV zXJ;i(mS-VgSgEP!M?9L0eX# zhrlHXf#?$$#@fPMOHvmC5wAfL*RX%d`i^ty;X~2>-F$v)oeO_;7a2OTjf3=|veM)P zquWF|kk*zA3>WqC4LT+FjB{JRp-svKzgHlrGlDMT>$A1nb9%3i)n_h^+GRts=(=s9 zF|zArC9O;pU1TjXhml~QgHlBekZ2tg6AA}DY1{b5f%b^x29IXNf5lk!(l|!Y-1Rqn zg#TOBj<4kEBwYtip*iC)C}5cCycIx}>pTmFyEieWf|2;;JSRp`b?KA_bO22r{1wj+QP~JIU9X{E@5?!+#foyo70rpoZ&W44DY$WvtkqZYiSSY_ zKkC=vqT*^97Lba&So?tj73N$+#FaQVX6q7gIYH-;QF%X) zg*p`P)S^y8yqXrQ@6e%Np+v0BJ@-KY5*9KsKd{n%!M9|@b?RG>M;jsN_rQ*-^4_yS8REeQuWIBEP24zM9$_N+i_lf*Uf7Kqes-3=$rTKB2YpoNW2IAx|1*zwz^ugDWYot)UGu0&6PO)E~LY3^{ z02f+SoeER`pa|1rTIy<&AOSzNLV4)$0OCo5qfXaohAm~9E(P7n8m1d@|su`>3Z5L)=8#$(i zPh6868Wz3|tCMR}=N*#sDY$vWzHvDR!cAm@;T^HqSAUM$;iUDZtpnf+zo?wmH`0X%%9?wk&^@th94C;RzTk$i3+ zRjJwWxaggoa!hNf=yiCunao$pMOamgY)Ny)qZR(VRd83U?0dd(1`hoy%=5E&j5~6a zVC!ut@{nzglNEZfa(o6b7z-j5iC{rdw5r@W?e2$&P{e#_5UJYAK5oYIaM!B|DOj8n3z%KU{H12%C!y!_+xfLF;XEg_ z)euIyYzC=87Mid*$_fUcN{V4Bh-Q^2O!&PNRvM#23!$_tI(aQUp)@u$2ws*bkLI7q zV>cx)zo=q&JDF2$YTBJ#^=bZ9n!U69LqRBys%@6FGN93HVp7#LKWHXq=OP@+NHGnJ z@U>eN)=!G2D}<%n;M&OJGY|%T083e_i$u+imo2O^#hK&27_Z$5WBjt|oVLn~0=7`9 z1^G>=;{V8iO%NL8eHdjZK)Xmn69U1{8W5Ke1}e_vAxP-D2u(FU3|r;gMwL%ORV^WCl-MPivC+^#xtfkZKYsN zl&vB%sA6Nbj^!$so(c=`21)nVc@o}cATIo%sla(rSL|C@eCx6b7RRj}6mMM~h04lU z%|g#%P3A<=Z_m;gbclA-BuG(kgZbBI_gpMHbhSHTOH-@0JmvBQBS~^=;=cq1sGuAANn(YADj&?jNiu41%w~{8bYg%N ztxUAOnh|9+N;2r?rjx_p-z8J^nYB*evHi;4jk(3`b7=daJa6)xIeY}un5EPx9NKGRXU{d z!rztplucEm&Aj{)Gup}8ny{Tip)_N|d(qH$I+%cJjRbfPV&MiHq zQ%OyLe63MMaDAXY98_=Lfj%LFhld*|f03ehqf$#NrlNp`xV+|}s@A4vi@N<<9iq>w z73)lh8hOH1IFR8YVE)wRfDNQ1T z&*0G5@jq%Uxr}9^x`m-UJewSs28PetsFBlq;bp~p{ajk>1c8d$9+)(bPoS_uUkSGE zohhZgxHfZX!r+3@`;e--qy|}c|I$@P(me<3PyRAVCj)%qJ5AgE)C=Mx&APN7=?g}@ zj5$ZSgr&vsSF2(1*ky}&VAn0;R@P^${O5XPTm?HVaKkQUG$5b80fVOKgT4d* zaNr+0v>*SLYo&J!VxQj3y0gz&{obD7eteiJBsJahNpdKKGQf#}_!*2P6WPRnP^*vD zz&s0Wnyowpek8jeTiE^mCwt0|Q5rFzI-++$f);#DyUmU}?(ew%J-Xw%W?L<`GL-hN zS7}kY?tonGIi37te2ALuoJ+^A$CF)j81)w2JLmCj^g$r81LxOwX6if@X^|J+48-VD zS};2BV*6D}``|n5;NgKjqOhwPn8THF*84^ z9(}Fqt~_#pA{ogX|#XQ+-l7)Vp# z(TMI-K_Lig^@z|ZzpWNH7P$K~4>9Z%M_GB{v;YCZhT{&1hwCkziRj)nm0_l;p=rLA z)KmLp{q=Y{17`*Xri(pfZ`5uVw|=gMn%?-x3fD<$L`h1(*J&?U;-uivRrhu8yXfBT zSRY@@a+psv&k>b$tLr+(rD}mLRUYwrqnI&r?LC6AXqN<_8-qVN7tDXz226V*TjeSU z%j1sk^{QYI*R*(ZOSGs3;$T5BCBxOR~EIS1O}5HvBe4q>QGJHnewGZG|n5(U3%2DpU| zn&>nHL|dNQej-P(;qEFQ=4(o9O(~4Q#qs1w#X@8zGKFy zpP(@qV>pTBlfyIlzKt;pL-@W;?j|H#W94ZuA;4SfMIHuVITMsv<`xtWe=(}dgN1`q zAYD+`59R?nn9(7qoRwzkfcn^D86E#A8N@eEU!6y+NQC$n;UIg)kQ;OWQnIFm%7D6- zkOu9zX}KXjf+h0CTg|HUj(il7FlTTwlT5b@oJJ5a zCjrUxK$vNw?WUW^+73q1CLY&(RS}(ebNSk>Wdw(;!w%t;qUvVSmS#3|cU_HQ+}#P> zy<=)>XNDR*uX}-NL)lc!Y*LzfdN8hjGwiipnH`O$cC<$_duk^WBUZrR7f~fWzNdwmR z<~}7XPD4^y^`xjD8SW0-g4~ACB1FtLEAl*I6nS!YE`6>k5~DKmdV{s=RMWln1LG)= zSlH&h-@h^t_lAyav*9v~Q2K`(EcsTkL?g{%({I{*ujb)neix%;b$-*GA?7alAv@Q- zKc{%NRXv^zg1EWs0g>A3M(oJKoVbNxed1x8E{5|Q`B)M)X%oXFCZ+bDf)<}z$a&(b znw+4DQXeD}IK$inRNc^CQM!AOf1m7aW`r%H8qSw+03`9u`38t*_zrmZ=)o$QQtQ!# z;o3Y{5>&E23#C;Xi-+Gv@mPB$WZ7D>_nMW$9x+N`ahu*>P~DLxL2c%vFt#YQ9eo}( z2_~YvccW-Tz_1?_+b9Q&Q8_#+X3wKh1!yniMA@V2w1f~27lYnUH6k~7#l`iiZ&gd| zGKzE~=eHv?=>ZhaSN0(VCVoD6Oh+jvfMq;rVy4&cu$@1skrnfTJb9wYX{sZ<@uQEJni}Z{p z6WLy4qx2+_**H8=O7YpdMu|>kC*E6S9Fe;*#jP3?>vU-I8_>yxHB3r9tq_oZX$H5e z&e^ej%@SW(8g(Qpbts%CoIHVN`^zeh^2svXoFW2xQ(*~95p_UMHlE2knNctSdriWB zDohBR4+_j_!^PydAmS&BvAg0v%SVWt0;Typ_S@@;4GpD6lUXO89K9Bo#Uw^UG<-0h zIhDh_>c#YEHtt+brHAmrM4U6HPMo7>G59ZMRPNPJxJI0>1_uMI=jI@+{3>lne76+7h8RK^PYSKx>HXw})1SzGenBIaH^V67=M9UQ(Msjp`*tvKUo`p;_V%=A& z7ih|O20g3S(ZjcK=YxgDmUuUqsTB=1X{#vGc^035Kw?o|X-fg1_&jVL={pKjZO6s3 zm<_h=q>vD*_XU$oD^H$0u~74!dr7n{yU`MPm1%RfbeDEj6;e|Yp?IVk-X(1k*QS^m zbMDPn8GWlIl5)jmG^jy~VCUXj8;)E659#X(32_=^I+n#n5*3Wy68pVGH)aVt<%hwk zMtP2HNkcl(1mm&X^&{d0HnE5ki&Z$-{RjCN^ zdqNm}bYbDP*4I=7qI%E&lGO(SyG!cQ21Qq#=O}F155d+M*vgL)Vt_^wyC4Uq>o-vR zUiHx7$Qx~#@lD>6q#fzPx}a;@+LRC}-IVj;Se=v(NU12!YjRDC>tYnMOQi|yqw{zQ zqkwI*zr)3*qX(qfsKN%+9Wq`9tNlkE)>n>uzKHFEuuz?66>L^T(bmV{!T%UCQx(O6 zO@b|qILXNus%MI_2ZrLy%o%*enOPiESi`uw#8iG+nz3MkG;+w${e|j8A$GUBrP1M< z-SuaSQX-<;GkWVkzGbR1$VXtj)vP%0=%HXu2==do%}=ED?PEcqy9hOYr}nNPhu|a? zW;pIJM#MRSp1Z$*_PMHb$eW&`cdIO9JGj$|CBOb&<*va$qX5mVGBIzP`Ae!ZF6z3X zU=zp=QivKMCbNg0Z<$#!9b>AT!!S~eqJ0WdfnYY8kacR`(Dh+8w8ijvCm6 z)QwnX1XGB7yy-&lWTM<0Itrc~iq`q*D0^v9q~2S4+K!X|`IjdK&!HQ@B0!Bq+EhDw zBz__TN75@)hD`e0D$zg8F@7Rns>L0QSJ4}`4hlpvKJZ*D;YVgL&Q$ufFK;PytX;R)s#U5?Ocz^U* zP><46jbaY?HMW3=nvGxEPBJEXM%~=*I@{TLOJy-yQCf}~`-mV4`~?S%Qh#Aiwq9`f zChr{R6rB_asjLljK=pI{?hpS7|8W<2*jr|?Jt!Cg^OYndt2)`WlDI!=FwCi*WTYqC z;XSA}UUY+wrQb_=%uUJ42k5c=8U#Dor!YFpm~^Iu&yNTQT$z#<2i|;zpLAC^`Cehd zTTpWmW`(x7{F=yZ#&4+?z@#WndcC+Rm|6l~BxiI?#y^QQSz54!_vK~Cb;RLmQk17$ z^e_u=rxGHP;g@D^M&_phuC!5mEVCO{u=fjPU>RSAk?z}LwcAA`lk3T3W7+s{Jd?q{ zdRbmjPLccEVmjm5TCds5*ysjeER-3U5;D`b2m~K(2HrY)xc<=7Gim3cryIOK%nkc6 z=uBID2cbmZA-mD+>1%eIHt@coxG~$VLM4t#I(W#w`^#v|Q z2x8nhW{NVE>UzZdn~Ip9Et;Po3=~pI>$bt*$u>!ctMHuP;NHJ+2#q$#74Dn9iKJ(S z=vgdau<|}~7O!soLK&N#9m!oMv8RdVY_TeYwUZ?=l2xV{yIVhX7vFFJ4OYsixKIPm zPH+(JPE)Ahex4Z>(4gn14Ytpk)j}$d_KT5QqyPg2Y{^#+=>T1+LrZmR;Ybl-y0wzy zcHg{&Y@ZQ}`?ObFHFSOu;HC2Giv3W&84%j&iIx3*fk>86APdO$m#=gxyr9MS_@YtE2i+Kt09x4H zfiBHE7V7Hv26}jjy$zA`+w)kr4^x(F960&&JUrww$zhM6qWO z!ya*U8Uv~YA$g{sf}Upv0xd0BMk;^Kpr;BN0yIZ3bLYqX>A*zC*4$@h@Al9BUvFUY z5!0z4#0F>d{Z?c}hq1|YdblGJ+NB6csc4K0wKp_p{rWjkFBhpr@{4kK(|5lPU!pgD zqE!K=q_~>C4{nXwV;J2Uf5LLZpp_FsNn}{60f-M#DjL9y_gu^seuRp3i{sZ8aO2XP zcjunb?H)7;C%N46V_GW86xK(~{L30!0>M|*SBl$889)<@XBvEc1;%e+leI*y7AjVc zgrNKstXB^!s+T0njT?30k1YUD$ zQ%Kc@8B1!I!1clgTupm8?sGILs9yt9x(mrFc1=}z$dYnp>Uyaw(vToUuqGtra4ky- zCdoHgA}Nhx3LjtKb7)OFA}UeI(2E~_@q6uV!qmBGEV@XT+@X^3Dw(U8)(doir^p$N zn#&6o@&qxp_~*;d#f(O_*bY{|Nw7d3Cbl1`gz$rKe@NVB#h#4Gb7hMcODe7x-0wD3 zH)q(MM!!c6B(WCJwncy#kDh*g;1;npM!MWm(zgl}@MFCr_ zNA&j9Sa5rxw3N+JRV)_HXw8LMV=AYD@ut}n2X^s6YiYp^D6@CBLk}CFtrv{nmOFQMFZj$R`{__B?uOXsCi!_Om5(FXJT0d zo-1c2X9Qh{^aS?sqgC=288FD%Q#iF$({3b@F@(SM^M(=D!8YPEp*Sk73ox+vutRMr z)nP9xXucmsWBq2DHASo;wAb2~KAgnII!F#8yeNFivJ0I;M6gQ2;(;=mGH%pI(=ER+iRAQG2&lWVB8Q%Y+}s37*vG5<=6cC1 z*_iys&1|dX+9Rr|bMHLxHrPg60h_nfA%WK{$LOPA8&(Tq5OP5sHrfLVd4e!=I|$hj z)|91GN44&giXH2W@_RkFlen7f8Q71--q0SwL9mjF=`*r@o2V3~7tl=ija7YKQQw2X zeS3`5+eE=H^xdhnZrnQUXb?tgyww54MxO_b-}4j2{Q z%;B2}!;bj>J9g_oG*FVT4`5?O`*u3gR=^v4?M~?=S{B7#0z2%LH?d%q1<_fc-W3sX z4H@eA^QPIm9)#6`*>S>;%8@iZa^R4<3u;}n8HHo*cNTjl!Ah8`(;@FctLp;;IPCso zN2#@(O%gxjcRn&wU}A3d^xmdJKg1Tk)TcI*FCP2d==Ru-MULm$D_dj^jEsyD2i8dD%(;>4f;)a(O!m7l8bwud(U(pqSG zmX?7!^{JXb369?S5knRcsLv<|JJx7IA!$fG$Abdsd{s%r%IMGZ-Sk(pqxy zID2L*)0O4g+>8;G540*{T36#E6ewqmh8~GGUj{SOIA^j|*wi!AZ}a0qZgIEjHz`8P zY$5-4X|xZUwN&`fUdvx5} z`bNS6;`K1#I z_v@InX*dGZJ7C#LjrRC7+4n)C9(lZ<{74a-2TU`|H6fCndMS3RPnTy!De*2Z#s#rU zRv3q(5W{(|>aL7wWTmw+3dETxf&9W;?Y2(iQ@A{Dus?)=HEW<+5%C1m%~ObzN;ff1vU>au6A9ywwbi z_Ms6PVjl{g5(b6{JyE`o#cCiUqirfo)3>SnpGO(TGYZI zb&>pLlh)*P>OwudoI*Hsia{tmTazZbTHwRfUfY=)_x`y1?2XEnvX3P1zzURtIFoMQ zO<%?@p1&ZwXtAPEo8VrvZyL0-|WKD+G8ZB5jmcC(fOgFo8u&D28agxNI<-aCM}1gNPkg zOgk4R?|bzpi?y+7l9WbwB$K<*Kc%|ur#_Ans|I0;z3eTvJJB!|Z`R>F;!7(56fB(6^>uFqpt+O2x&7!v5_(zeA)?Qvf01WBwZ z=U*Rg$%d&#(Gl|C)1>^LM9dkyul9<<@>zMfCRwr&H?tW4?U0diM&;FC5^(BN*_gC=R0UT z4D$|xLbs_KYxFE@Pes0?B`Pt>c#o&0_k^4xT1O<$k8YKx!AxvNWEN-d=wUcK z496UXqle+}FgkUZaA?-OT4S!bdUGV69!?~`cG9%?>C=}!Jogw;nhs#||Be9v!G_xu*xUz4Ml%HhD|`g&Bpp3C&i4u%Xve9FNVhgSnj?T z)<=Vs(88>l{Ic?H%F<`2k50s*0%1_n`O$N{2k}1S;CN`v-<(@otIMx-(zR7AHPj?V z#q*@%tZ1(Y9%2PrU%{5&g2D9W^IPlBRou9=Mu$E>O|BvMYbM7ACvTq9bP3xP5nz9P z1t*q1te6g3R$!3&*$=7Xl=UXjrA z#TG$`bwSE(0S!+hJy_ z2TymDe3ql{_&xz6XZm_tFcDfLta?=p3WVLHsKO=#{p}k)TjXsW{XqLh50YW4`fdA0 zuN-Zr%`<8A$xC;C+5~k#qC_?LB5Af>;Gi2TV6kkf+NJgA^HuT!}pP5_l{{A-4C_Wf>3EAbs|X<+0kti zin`4<$|UM@rfR#f@jZ58J97FzJhml$ z{Q9Ua1anPi`Y57z_~@^=oBAq>h=)3i3~OQmWB5t~hmWW$eMm(pc!~Z)zhYz+7Pz+N zF&=A%l0Igjq;Ug0XNLum4HWcNu!<;fQi>D=Un)ozrLShc{NPr*uSNmTIAWLC25yRm7yCPl^>MRZseIoNm$ULIp(m2{0wtuY4t! z(9MxMX3#Whyl3^|zO`v`5ZoR^qeYie6O>$6QzP-FFl7~%@$?c$;skYM+l1@YZmsfy z2gPq-9K5V_9WIe2A*;I^D$F{FJ#vn9O|1|>gfu-9xVL_a7>T2zW6dh98r#kxsc3|F zrk0*M-nVZ8bX_)oL=c?dlYa5{5eK5SEtQ(<-V`}K3HqRdy;9>^qNNNb_o_rkW|gCN zz;4$}A)(+#wskoufmk}#WrBlR#*`7@kS`g0VG1k)Pcxz>Z-Hsuapbr&Y)Btp(o*Q- zSTk_?F$0{=Lyt;N3#yWcf=mH3nDXZtIARc1#t;Cf6NC<0S*RY?bj>Hn(=1)UCLQgti6WJ2 z@s6adg&eG0_};YGAo#N&1_<$v7AQJcK3J3~9QlcGX&*x`enigmm3h#*p zMC>dWx=dOeVUK9)vZUCKpU)z#h;Y?P>7|r|D3yk7k|tM`2dwQrTHo<-=I;0Y1I7&O13J}_1+|%gO&iCB8>uXZ&P^L|)_Synx z;6ANa9*K8g>e&|{#*1{-zt;7UGcc}JOUo1IPRj%I9+XW2Sg@aNk7=9kFO&RapM4vVXw_Ev z&;G%UG#pXzI5VN6LD*k#_*D6_ZWw7X$bzD%zLH=^&!za~crp`@CX&%h@saG+ zUc0rsAo(b+E9^RO2ASzCI8vX5M9_*k`4Cl|S!a+s3@}EmVIwoMsN1Dp)Fu~#CT`g^nuYpCMDn%s(v79e3#Di!- z#m;4`No1R?tAeRWhY8ij!sk1;31et9RQ#nesHLjU&x!3;nHw{Y@lGS(Pi1)Iaw-BO zV>>GP21~$rr5qW)+$dK+SU*N#sS=o-uBqiVIlsMt858xjUb-Z8`#_c#^+c$MgQHx0 zH&xuD!Wn*inC`bcV{S3O5L`V3O+_o>v(og$WiJlP4}pYS9Jcn{h1kX6xSSPu?@M?+ zdvgSKS8Oz!!qa!d2mHhPXW*2=iCw3Umio{T|9dXIowPBFA8s7~v)Fams>JK zD9_v8A+@|j92IXosDu8qZubafpIkhd5iPePfEK8k1AX1~oI?%HWhAaQL>czK_PsDF>2pC;pf zALl2;jjV*Zuf9cPIkCcaV;Wg>7*u;3wR_RvcvbZNGEP+7FY|&|VtQ$9)L7SXxcpTC zU<@A^qcn;MbsPHl?%t^fwH*}VfHVUsA3J6_ApPWklosLfC6a%P4L%m z-?8Vkx@E5zgB^1(mP+1|QN1pqc<+~0baR-$ekcV`?VD^bbD35J?yr+%TN_hIm7$Gx z!CLvO&ml)aMJ|FT;q8Jl!4^niccg@K$nBKj9-u#D0GOt%SJz|2i6UnTMi6E0&%ULE zo9TzSr78E`th+K6V8apwn%{{Kb&zDB@vkaz%QLuIpLMsyS%5iKGs^knM!E&}hhL<6 z)bw>szqW1}Dp-+@ZMHB9*l9jkW_Z&SXtaVsoH;grAuj0e)^KMinj>x#L9t5p;LR|f zAAUqfY@#5pYF#BJ)qpsdi&|Q$Q!)~I@{Dd}je~;w-r2r)w(p(oIqR~& z%e=GSUbt`$MBR)#`6|LeDdEr;WAZEgiq(HFOyg>8RxjdMp*1oJgPa07M@=4)Q2JAC zAR(v%%-s?aSZF>947xl{qg;#mtRC6^&q|ildjD#V-g7@Em2`Sc){v_N%{z2 zuUPDS1-D58KJ>vcuA3pY4fr(p_GdbX`J+2kUMXCwR{vl8MWy^fl*vJd+wt z55=7`si9almHycI!}&A4DyvNG^OOy7dr`U~QRH~rbaI1J1v`}@@J8erk(CWyFAh6% z29|k?-wGcAS!QbP=<4_Ehiw0o>gKIM7uG&^|+8l$U4CPP4wB(t{N# zVukmT1#ca=#>&O-=wNp^3?#5ZV=s*yPTvR98Kow>zJ6A+?`cZfou_2^?4~)W)&1SS z%e((@ckO;ZE=;Z1!JXV-7>vS5t(SQ7iHK(rI`}VVz}mroexIV>Pu?848c(BMYKG6* zDlcM*2KR@MqU4^>FJcS{6x}eDddG&Hv$2tpMDohV&gbXP_JRVKpRG-n;lChk$A{4{ zK%S4Abx#WIKdkf&f-^Rh9ZknCIsY;mPv3OT#FAG=V^`uI<6L_EGr$l}CbJ4#1pPVe zLBB550s+iQg=%x8-Lt@lR8+J{4Abu%z#ucGsKGc2;YYj&Rmv|QigabdE3Yx?+iTe1 zY5$bI{V6@tRj0H;sQys}31Zig*RkjG5u!>+UU3F*X0q{XaCioLv8c-}Z5R^1e!EiE zr)*seD>y+H5&k~pG=Dy5n0tsNSa@!_ICM*IIUlahc6Jo@ck{09=A(OHH>2P1-M5%J zbxYr(%q2n%qI@xp{hl+4D_65O;`py~Dv<`&kpgjkVrU2{L(ZjB+0;;K_+#hHsT1c+ zvF@XX{2~K=03@Qy8&Yc(yo7BWg`tjA^9-|mfRKU&{SRJzFYNZcoo4Mn@ZlcV?O&aX zWv|v-6DS_pZZYL9c@#fY=|ucep}z8)zKIjCFpO=zt!J>m^LBUV9qX!{cP4fr{*^K# z^XQN=8qmn^>4clgDN!1+eRL>)%RR_kjSmk;dXV&D=5F zeej~!;q?nUqhZdw(WZngATEG$pDecKt?!@7-93{Zb=8?{V9A%}kmR{GQ^ahpW?ezk zVxl0a0u}OoK1;4CzeXV|N}Y45k69?vV4F&hZ*|Qep123K#~m!Pc;Ve$L%{H4(Pw(; zH4x1EJGfJcy+eCp3xB%_+ZPpz`#SGOPKeYm<_yM1V&I;}FF9YthDYO>kCEf2mr)%P zu*DV)J9|6(JUn({60?L6S;776dIRi3_p;*NB9Z~;{HG_K!+pmNIp8cIdauofq%Y= zIG>;Tl$4PwUbY4;DMrHgAQRMoA?VdxAwCF8cC@C@3oU&5*DYOnp@mOJ+NADVo8SNQ zcRs)9-}(Ih-@o(uwKnEf#?e!|{bO%;O!D6jb;pV%M~8<+qW0=UAh_bsO`aBPSg@D_ z9pDuz*iiIIF=%3SJHVq!epc)y{J}86-7O&|mh0nvF@h+-;c!~_U= z50`3(@VXr!79Ip>&Vqs`pzSYf?suE;NBcbB&(ELwvlC_CKtpM5jNV$ z`Y8XDyHOY|=&X8DX|>!8sHB(~w=GktyLrV#u1l|w(3z;I(g^?`U}d#7`JyKizZOeo z6GNC`C}3z7uL~Z?6c=!5GE=7A2$?{A#j||Jg0U-700oa+f~Bnbg~eQVu;e=`e${&? zI~W-38Gfa-)wEutdc(wvCEB*^&td5WQu|@E@H@2Ywh=!2Nc$$Q zAH1=Tw13Aq%|6n;EdjZKE<@U50ozK>D~|Vk`LBbgzx>zFKq<{nyR);BITQ)a{avhP zS%L#W!dQa`K1|~?)SW4DgcD;48I-56iN#8e!)^+n%V_^#!EvA%3P%=za|yYQoy-(L z-wf5;ZT{2VMvDw|89+Wf+#H8X_4I0!k3*?g`A;bnjrto&BO>aPZ}4&%>@R1){zg7I z(~GfHvtIyVfvL0SgCe;a55HBEPvWik5ZP_hAht!orYG7Y5p`v$?bn5U<|z#LMm86$ zJ``OYN7(DV&Y@bsw%S}rfV)7-l{6&oDv#b6b!cfEds@29Ti&LdWWwe~gL^(XiV^xBpRwb?g4gF~@l^rW0G2rKA(h9Qu|PzF@M7oYXg zrn2fiMC#K816Atb9V7g5?b}6ykziJnY6KZ9uZN)=e_C^s?%QokvLtRlzRs8OX+AP0s9LZPRBD@=hIaBN<4iNg#Y0APkWnH@mQ64 z+ww@881;yQ68-tCw+Q>2>tQ1#d%-3Gb;HJwfCGut8~lVPWxS8t&}8K9-S2Itlk?3pMODPjmzO4FwB7EU@AdQ4 zT~PZ5dWq_;2@n3mI8!rQ)lE#p^``=7EPH+zyB>3XAG?Mjt61`qQQdSJ*Y7gi^JC|C zzdv=lS7qhJ!QS@l)p7Fq>?zo0T-#cpbnyD<>)_9(*mpls$;Y*6UBSMd>D0OCGPry5 z>bXiNShs>8cND~UM*jCSI0`-2;@5^^Ls#R>GomqP3CxpC}{g;0X3-2u*9n!#RicCR)@YdZqySQ+ax$z(C>&})&$ z2iSb~UQ%n%Z^rIQ+G2BBD*VY)j^`1W0ag0z&J(-bc`$Kp1nzz|mKb&}q+`j<<#^gC za~?c<;asmKiJ@ZA{LelY4Q%NrSo(K&*}f_n6v=qjIUCPpVprnz_0y-%TJ_W0I{?k2 zOgfE46-?Oc5eEn-XS}GuUs%^rsXru7H@EQw_7BSL9+WOi|JIkrVUItg$}3<$z85Ha zmkPC88`4JHEf*D!Dv|b4;GS$^Rol<4gtoPrmBD~5NO%+&>{Ja0RZzx3-GOj3GLU=D z$FGbI$I@oX`BXfahz&cb%MQk)5@^JqkDp2n>g=`qT^U`)$E$E+dd`m~V>e3n$N8u@9OC@}bvifa8=pOcM)`)KrL>zs4 z0TqO-Mzg`ZeOqSiaXS^-%q9foYS`N(un7|3H=+`5Z8}b7Kf6^TjtO#Dhbsal?IlMb zF@0-oOmx4H7)l&&zgD^t>u;#Dy2dye`3$4oj?%4RIA8^JxxI+Q*H~x*PiA2@VuGzWS)=az;DyB; zO_&uO9fp_LWQdrXSFBnN9eeYY2uVULB@}6;-T71(C_7ROS`a%ZPbW%ylqGF%dp?J|4fo1gH@Fo;w;s6V zg{pLUzzsdiEz5JTiR#;(DkvRVB3NLxPfqjxwp@2XOx>xut!j>7)Jh`tT#6;H3}Z%W zB$dGV_Y(F8_QX2am5-I2>iI(^?wq&`?>nESzhGDOQ&0$CI!bSu#^jGNIrjC;jmGrq2fdaU^- zw}$Li^Oktgzl$T%%mM#M*`T2gc%S8fABk!`7xm_U^j5~)(i-?DZF0Gf7;4qLU8h`Z zzXg-tEF8eK`U7&IXIO72aMiFbhB=Wr0-CEW6jYTe;T3w!iS?5E4lmp?z&?IUcU83z zLU~DD)u*KekRTHlX6xD!G6Z~b4Y5Ywy)lb=xI|Sqax!|6`_1hCGVVStNH=;FxTQ)7 z_&Bw@?rcBu+T9Hh6%kbqYA&Q%TTD@LM(Dcbdq#93Se&Grm6(`z6+}_be_NQC-Cb*C ziWscL%hYmNEp<@s$R ztoGgReYbnx?cRgtkwx=gOK;0k5$N*Ji`bd=$>{f9(<)a1HribIqQM%&AC?xca8JyLP8V(T8GdH+1?f8k zmI=3vG|W9R&*raC3mA$p~)}J z7*1zBK)L&l@w=fSFz(VYDARXnz>mssXsaCo7`}4HVl5%eR}68Wt`&p`&Ve`df|nf~tMPcYH@G-@pk1|81MOHUlzbq< z?_%I2Z`8IS)MTA%@lOReMgQ zhDNV}>~o}t+u78m`0&Thsn5^$Dxe&!-wR#uaA1y(isXN{f4DU5@SUx`6CCH=0gdzUf3mcMUU{ zg;J93jrICych~FurzffJL6kZquxU;1|I1g{21Gg%aAgad?`V+!@SJ$EtbzkH$tkwi zb9Qt%n;02QkEAkj$1gR&5{6H{q1aw3nfcf`d;07rz2a82xc0kcR$4&>-@8D!g8YeX z$XDBJf_}JLn+C4c7U^RJojRq;c5zkuc6U{p_{#_(+j`Yj5wnZyvfCa@I+nZ=cP?aN z3FmLQ2M&VcOH-h(dM>2nN%TB>8zf>;68Rw&PN0rc7^6sG1PXoLo*=X}fz08s?qH4U zU25{04>o%5a5I0q@2G)-=#P5EQti>ImwyrE2ul=XCRQPM&n7THd3QOAqg@%>sZ-w9 z3M!)C(YM!VFBI9v?H#^-sH6&yCmb>22_O<5R-z#PYcs`Y-%jVyQec5@;qWaw7GD4} zV0{8){8NrdF~Wg)92%B1%;m8?mO*}fdkk@R$VR=KBOnCLfp+cd=iZYSe(;TZ8A46z*N6rv1!?{RZ&VpcOsQ%KFe1~vP<87!fTrXO;kgcO7t z58x&!GFn8sLD384RijLX3N^U-azrrJ}xU{$)j@Z(Uh6d*rTf? zRV*txWXO|z?VTxa?g{*OvQ?dsz%n!WP0*&=D8fd;Qa>ckLnaOH^(^{^#>oRW=>CGV z3h`5EK5QF<C@D}3in&i{4Xvto zSv)39jojp2f^9}X@sHdSbaNs zC>>LgI~^Gp4$1&In;NDoxIebeKN00Issc=b>uj)<2B*Ya*rqP1gUpwR)UP79>5G_M z0_WGTqR&Y0&HV@(*rCFF!Z5lkPua=EoE%)s7@6Q9DN(+Ur`yNV?c?eG{_u1ljk_LC z=Yx{#1Q~fKM02CeaWJ-@lub)J)EV)sg&GJ^=~s*`bAt3<>Owx2053RM!f4qB2J+FQ z0~H^k_k;%I`%SR_&{V)uW`5ta>~wWGS~UI~3v&c(*fgq$L8?cnLF((AVP>11pPGNa z3t<9#8E}W^r^^6$&CZWEUslkYz)3=gzOo9&iFU7q#17#Gf+lb^TbMOGFzVAGWZnde z$uq8$jtH6R#1q7agzA;@(qD2Dqpyvk3s{j)pXO#_%#PNb2-Cd`Z^I4WUGTQ1#xmQ= z?E3~Jy_xkeqcj$6_)DU6^_FwgIJ5p}VJ*~pMKMkK=r<&H`Vr3!f19o9Rd;6E=ffvL z4dvf7KQw!8{~m0D>*|vZj7=yEfsRXM45s^U)fX)GI`@$Ugq7@E6Sm%Y)ff5ixId2^W*!^XnQL-+46oRHS z^va(nyp;*s`FH-zW0YtJ@?2rlNX#fM=fytJEHI3U#weKBR#s`5q6`0}f=S!_R7mel z6-<0xL?ra1=L%msLk;MKbO#$MVx1n+B(7mUM7*d17=YqiS>7raF~T!ZVDcHWUj^}- z(*=~rJe316VBCBD4m>naX=V{2Jgmvi^{Z66n-<5qWAm@J*5JC8E9yh-S5Q)~&Yk87-hIEA zMp+~@;KgU3umc>%H+bYKPT!$JNNqT|ES3h-DxOiPBAC~f4FZ1NXVGG;>-%AJ~La3#yiSJiyvuymrh+e*O zYLC7{pNWgEVBSgq&i@Ekrl|WI=QL#gILliFY}&LAvSnq1mv*4BESI4LAX}mR)Q!9WbDJGDBD6*J2J_ zIdO@bEpUc!9C^@u=M=W`T1BNTOj*ccK0*k5$%uS)_Do$XV>+93wzRUU-OdGx#g!J2 zIvs77iHQf=Vylu@N;YT;nzaUU773WQ^whDmv+wJehquGeq27F@9IfLM;GsEMECs{1 zyNuiUXx9@vj4TPvllB70^2I_|C^4{LP_4M-GVCa1Rf3(?Mtz3faK$T(f&46>k87Gb zy1KMPDJW!~lbZcGZWOJ~mp7kx%Q?(6xGU4JCAwlEy#-u4T?~iiZf#q~R%Rj6mohp# zHrU?t!Lf-G!jDm~GwuC+giK;|PEl9kwq{3^+NQBlk5S3Om~vLZft{Q{17&4Q(#>K7 zV{zg9xEL^Zt2;;*bUIw`0In?eJP2)HCDoNv*jMwfjp)-kQDmWwCL5) z8J+2)`h<0ErLEl5kfoJ^qOJ9^uv=kr5cIovG2lWfYPyvr?{(4giqG^@y5#nle=mWq zsSaW0^W_NlK6ghOPj|Pc5}D-OqMh)|*d>wyJG}bJ^2Y1)?6;V#aIz>aw`R@O;JZMQ z&pI1n6;E~7$3bx#hvi1?;Zxk`a7!?Yf65VS&g&`g@b$$D%3qQrCDCq-15K{_!3^(7 z#WDoDlR{&!pM>tpF>*`!W=cTe0qX!N)Xlv%M^F{`!Ky%Fl?|CW!nS>vZLoJu0)E&u z33$v(0uF@ZROy(uDIGWvjz^_iwixVtmwFAydohQJJYBERAQu=iRwBNp(Gw6fMd~tza@fb7=SI#)ggc0lVvQOoDPD6_c!V8Z_>kEwMki4Q2{%l1RNB1caSuxC;rU= zaMU*t#o_&B%F8bb$iyv|u>-9)S==h;K~whEWfKf>v`E9+7vWMD3Gm z`bJT+kF2QK;izT|i1Nd4Q>^T;PfZ}ZtfLXK{00eYLIi?9r%H`ti2_PRMN|X^#v{T> zaJY$mu80ZI)H7g^aJUdJ*3Hz$#7o~;RpYTA!rBjEy&t1!KZMm58=>2JewutF%s%4Y zn{|IOi-^73i{MH{RO7ktz9lA_l|1OqJNKw4SXd>%N+=g1;h6M@V_PH2#AXh~O~U=N z0in{Q6|C+=(72H!u8&3tF2sOjXn~AU`*l%?VM5^hhD&4{Ic$e6{*DUky8Cc+eHe{f zeyC_JxqaN94iN)OQ)EsA>j3;pG1yM@ajqdC@6j?Tz%%698L(t;j~U(THcAw&pz}tx zL`K|%Hm<+X!njiwXXo6d!J2Knio&qfoM;>VrS$&t~l^Mx)kQtt;>Xcsv~cXPdVnR|8n_4>_d zCXtM1GR~RQmBdi@u2!>Io=9dBQFL^!@gpCKC7p|LCpL675x*Y4E#X%_xx3-5%t@)TY9B{2tNozqe$aG3X!>^) zG#%Ir43pu)ESz;ow^Lood5@?4>Jbo?5gR>NC+yJ8hwD$26x_N2sU)}GMBa-*p{5zk zrV~S1=R!J`%#5T!hiU(>=eL6wFhF}U1OL|AOCzoB4;2Je(+kO`ft(7vUm!MtvP z_(HgH$ApaMiJ_?hJo912efSHptbo08f5DHI8BbT2xDnIJIDb&WNy=p1SsrWY8HvNuybJgou-&}A2oeRMg+#h}+u#g%7ZCAhd`RfU= zSiQnBv&1qiEk_n_VMaxM^;fBeZCP5>@=mudu(e*sgoeT7vv1t&8#nvL&EJu6(`^;` zrpJZ(EmH2@;*2}_%Jj9GOTRT#z>#pteS567K*fw~G5A?7^y5p#hTvb6d~Da8ICq+w z7sv<^&ikya`Sogr4M~hpshZ9-V}N004Ah0F3{1d*c_L;{RGB?dF?*QHPw4-+fz}j; zJj!#J4Mf{*lKAXUHU~@o)iqBgz}CtnDC}rmj}ka=%~&=Y8@fupVK14VB^sGJ9y7Fg zXsIH&(0*Ex9}%IB0=MabSw%mMXNRsv|EJ^gh4%_C9pj@7v#EPqf$!x4k%8_j%vZ;k zPx#q0lw~eWA^2lu%nz3lMbr2_ZXoM(prU)i756G>jn@!x^zUNVW85WLjP!6ZKxR)c zX)WMQ@)y)-94uRzDDcrA!W>5&neTp|x)hH%S@=y(Td#E#_W;^?uW#w@sx=As_Uf1( zsL45sMt_@{`=-Q-OH)uf%uK z2cpcu8wIl!y!kfyrUSzC>+oIPXN=wbX>+SgffgPTZE6~o-qd02^Gnmra!Nq{l__be z@MMa>&AyYZ@Fo>(BTDJ0TLn-Zn&OCiiIgVj{u2d?pH!ScMT;4@L6{-adgshekZchy z=6&O&NxEo1?7#0BcZKHJ_l(1_1jb?8-?G{2X|+tL70;VuWA&PgCNy4^c9|{ z{UyU>d$m-=owX;GgXJpUyssLiRRcTi(+h9B! zJqiAQqC51gmF+RmxPd*-xEhQ}x|3_}{mt%$wd{4#*If)C4G>T|K*$k4i4L0n8meI7 zPT#5ul?R3Y4j=mHs9T=pHXU?{yaBDQ2cjVl-5T!4vMC7-gPbKTM#l~J4|G1ckYc3E zw#_qHGK&S(h)bISidebOyi(ZAsS@bxhhL;meRt9@zhlt6Uj_fdgXVo!(EM=Jd@>rj zZXo)iEO6QsPCp!gd)FfhCA}T8CY=kkhYZo??(jRam>y#QM`1cX8tg7`Pnshe!eLQ+ zBgsUUll!6(^8KnAFE<+4?jz;*L+0J2nD#^FZ81Q)jb3Eu)j%Q{Q9TQ(Ew|aVYz3Vn z6p70MQs_rC|92|_*h1e21Tbe%n+nSJxn1{mOu5^*KDJ&>d*xMWwCke=CGga9^7He9 zy}18Q3=PFInJ8k8(y8I-iQ(bYjp*m;#Faz<;@6lG5_@fz=GeZjhM3GNQ^b15Baurt zhWM$rK^lW7VJ-?uL>e?(ky&y-BZ;t?Tp<`uYckX0&i|w!8#DG8M1OQwU148S7{eZE1j6M{ICWu;Z6mt6^?Lx#td0YFi6)3yA9*BJ z*F_j~3ss@vV;&hE1A1j1OEL^B8L2W2ZB&^f8PcmF+yVZIIH`+&j1Og_nenN|NVpj}m!}t%EB7+5 zZ(gY@NZXIxwNXBHSJFb-=h?gV#@atKx`h>)dZ}5;R@y(=y zW3Fnri6_Z(3|i`2DrS8^#B)@~fN+*{ojdAlz1x+_`Hnix7CzZ_4;(_JBM8aihtKTfIW3=liIqDPgG zEF2qeqGTMKfV(E3Soz}!-bb}8%{fJueQqJqzlRtbFQW`SfS86VfT^xxv=amkwbzXuwzW~cN8P( z+>{4X*>_pmbj&{Ns$;gZ!-N8!h{BD4J!m;1dx8B^7z6*CB8s%-8v;Z3G&4(g@2X>6 zwX3+U(ys<4xiVSgPD)0jdBXIbXC zcq1C4*!M_kWOO7${vewusH^V*+{xT9z#?$ai*w$~=53Sw)5rzB4LQgh!F&Vpf z5j>?{$1UF{qQBCFw*)J(QThMbd$+DOu5?}auhiIA(zhkY9Bp^L8`_S$-P?)1jJvb$ zG6=}FRxolS$f2)Xx53Aegc&AIf$^Lz6=o_FXI6;v-7BtV8on9_`KP_XnSV_fV0*HQW(JQDA zfcKgjz3bc)u@AqS2z^6_tPE5}DMV;k7r_!US4lxIT^m8r;NNk?4`;;IE4L0DW<-mI zz|QqbyuK0ytZ)NUgzL2Cb#V)V>#R}=Ck|R@4LEwo7EhrKh067ieMBGk{e#6~O`g!n##4j`d z6Fg2lJ#Z^AoJ@l*MNnd#z)@LudIq0kKiMv^=tj8)=>tQ?IJIennD3)tX; zI(s9~6daW&OTETme6D~in2o`xCKkeosI?JFJs|@G)?jZASl36`9!|LOeV9Jq*No6h ztY~C3)?078TUv}x^&b#R$_no>1l`=mc6(*b|@=q7;lf7s{Si*G%h zYbHMFIK98bAbG6IFCXXf>_iYC&(xKvJ&%5XH_f6&%^I+Spev&21__>Rw=XVk84jPt z!Db&nwDHHB%7a<&!M7^y!(#7ZqkoAobPXwzNezX9hf4hSlDr?Z;U6s94e<7JhBU&bSaEg#3hLX0A#lxU|a$jXxw6sQWMcI+KaX5{wudD8_9Og8~42}Mj; zY-pS$FyTXINY+j$CT*326;v_|nTiEnAJ#zS$t+mtY%35gx4Kz|3r#ZeN^)g>->lJs20*iS6wNI`aj;=xjTRvCVEw8n) zAU$D27#+v*6s^3GZ!xIpNiD*}gcygs;rSX3!;kiSA-92Fr7e+8=GuO7+e900qTzxo z=@Pv%ArdZ7VO9*l%I^HUms^YZjIQ_uHoVG%4Evr@%m*Re7+g`eldaF_0za1IXEJz3 zlc!7`>=JfJatqx35)$mx%KTZ`elsqui)@#{DVAtu`|xq2(j&)|s-4eA9weOP%2Li& zaG|gLf`^?tFzSHc4Tg1^_~|V;qCy@0o)k4DC60qpQ(YEnsyFT} zm4yMs)ttt~F@LaA6tmPM)KsrSw=`21@|FQlUT*-6APs_Jg~p?5R5D<-Y?Vb%a3QI9 z*hhYkjjtv(ej5zY21C4?Gp-GWXo@e>8!|9NAaUx-taraiE{!Slgr9?>`3K?6Y{i_5 z{rxJz4ASIJisA~S)+&xw#F%0G)=m~$?%~H`e*?U~-_618lU*o7^E2x`Tm|tQ*ioO) z2p=j6DeCnZE1ejKlz_uJpA9-7BKn|y;nt7L@po(yh_R)ZcoxGVXpd})W_(m>tl3VKE}B?C1V4b3&r~e zqz9%>o8)kuQ#yk|w1CF_-;MVXw1fjjibhXnM~EA#KRvzXJ)Ofqmzl9pq7ky(m0VVs zao}THa@8ioM%!Cydn;{kvF^U+lnDa^B#jDce3VHx=)|`QR z_l6T=X-q4HGCk4Sm6~%c0b#T&cSrZvSZu z+y?Q%8}10#gcdTcmVFIysg&Gd4VgRUD{GzIyHavHvC_w}(>$Lz1!(N{hSmkTftlR|85j zh5yF%u-F_oYuV<_tNnfvY=`p_{bQra!Lj(w(Seclz0|0tX$Y)s$n1-+^#oHk_=wdS z4(k(MVNO+=+N+`Qt07$Iq+kmq(In|b_{mpuQvi-L(g~O;(87^Y%Q^ss6x@v=MYmZm z484n)44wtTA(0#r{`KTUpt}_9mP(gzkbXo~7^U!2)+i#9aB;NtOuBxmt-D^Tt;zlNsK=-Q{1AVcA4XkpJtK59;MF=r7D=BT~@Bjb1JFCr8hR+%B5B=O5D zL-L0mXFEFNDAl)WTZMj>JKx-cAaCRgXB1z{=#`<4&Yu6_-%m#Ew;;dtKaRA!XjLnR zHT1B(DEYNBlo%UG4yXMSp#~MMY3Xh3v|RhNum8Fv33Jqe$>c5L_#^g^VXHDv5KpEpqg z7y7A|g+wfpk`7VTXZW$0YRs}sQrB=TUA>5Av!MhaAh%=Ae|~&5=KKMM{vTKQ4pHv8 zaew}A_V*zGa9?41o@%A43Atc&yeN`<6$7tm3 zTwk*qtR;sgD5q_m4k?lB9g@Rm*)~n@Bw`(sk%fl>D22B&=@wob6u)E40b-W%fic_> zAy6TY#nueGGMM8hS=BB@^f^3%Irk;RMlq^VY%f%@gliBnJ9Vc6u3|^b$NCF*`HdVO zXW2j(H!oh6e$kc58Ojcm!H|7Sv5q3aEQxk2Um)hK!&tR~Hln&xF#%110f;->oKDC%EAPx^d1}kwh94d_EDNN7rlr_wYkdPcg7%gy`R&7&P`k$8 zuJN~P{4JJq6x&+JYW$FU&SI~+*rK?1QT4+H@Ni4s#OXDx9N{^Keu0wA0KUDN!W(u| zkJX!81^Hb6~`YIFxa0*CMoUBf4}W`YjePvM=EwQ9Uzs- z-Ob>_n=fnNCt%=*&XJFyjEWr;fH9H_?VIT46GFEEC%61*^Y@13%pENU=dh6 zKW)Jk@d!a69Fs#%W7(ORvDnh0CO%Xd9oz?35|bEPlu`0lxUFNgxh4%x7(KUEhE#y{ zh6_>w>B(nBLP!r~Tcc?pwyv{so!DKPOXrVCeI2&U-7H&%3NGcP-(Sf-S?#_`vW z=VjNjjHy6-6e1VlPh`t@P6!{2nmD9QZ_t|Y9&a#YNpqM>ax#O6sr8NbgRkmZWM}-&*x0?enrsk{06+!#tWC;Fb{hK`M$L3nc9c&sA&Cilos(RLnuIW41mBcP zzELV}BSjXUzB_*V_ON(*+(+VuO z+Z`aL6P1NcNvfx1T&k#Jb(Kvr@o^5Q`owZ4mZ>qlsPe+qQ8j$+gN`#_b1;N(@LM8$ zPK*quz{3dOqgHaP)RphtxO~y+?Ct2)8Em+c%%WdSjNBf(!}{ ztKq-8OyoKp8iCiWH#C|dB#oPQF7@5)(^6@8rk9~&U~6W#jI3a5Cki@4mL#wCSI7a< zvSq#%Z8(r>VcU2aN`67QEnj(9@ZJ!uE7_lL&x(&FL9|vPqqPdPD>il8N)NUF-A(t& zOig8wFj{eICk#46mItfIg2G64uzFzIrcceL!LNkh7pb&K-{|D0klKoADOSE>X@N-TX|U373E6_Qc{Z?BeiYMw5RVK=3<%g?g5vru(MO4Wj*|3|$QWTrA1& zNtV_6u~$G3F4T*b%kt#(=P_A+8itGiM2dg=S)vM1un&HwN>G-J!YrJGyVx+PSy6$A z3`0-c4;Fs$9!!YsaLs*@W8qdB8n^@RH32E4)$1hPd#$8ENl*yrEI_qDgMrIiIVgys0tKA ze0O1%Gt8Bxc}KGAkmWgkVPn(|l8=zH0muejP8&=~X}|}j_p#u$v&rAm?t|)# zk^<{WIGro?mAQN+C$6x}-azEiwSM$-RQ0k2och*IS$2giWhqTYxXz{sl?2xrX~iI< z5t;L|l9!thHj@J{o=O0!N3Sp|oMdUKfcq$+Qo&xt?Ou>vmDKC z=zUG62ERy*HObZNc0Nsf-j8=UEoW2Rklf7;;pRCvFJ5O~QfXb6u-A~_aALcJ1kKYI zNY*8yLvK6lW@r7tAo*K6S&pz}r}Jz_hdYUwf-4{0ylhxC)SY^}dwQ_-a4zqyW!NMa z6~vBG@K3e?sMp=yg=vxVXC?4YF~YDSM0QPVwtNAJ>PG%%RGbD!7BTKi8O4ZK3t3%n z{@)JGQRO!SFnl@>VBPAeU6|BJT>dTl)`;vd+etApP|c(DKr!N|`f*=Gw5sc`iq*2M zL(ulr+n)OS=c#vx%u{D9hdPhs2_%jN{j=1UVzu17+8_C}zdx#JPFsVgv9%lEx$?W1lrp+F-+lEX7<>$IyQjDLYJ7XI#^=TxpG22PLw_rJw%B z2oI$c_+Hp${UpMr(^=?!LUr%ZPtlDi&IhL=P|L~- zYOPdVm+DKxH$K=Y`V#3Fzv=Mpa80}*Q?84A>Nb&2J!d*>V~#5^$)=R2#Qki;*5Z|? z=5<=Ehc+K51RVFb2$Y_8ixSnS;t=CafvhIHYZ2TO#CuyU9&DE+Pecun@sv?}VGGW& z(gErlkX)#m5E--|+a%h>ly)(tT})}Q+)z*GC=|WLN$z>YHpv(6t1K4OIlXP{V@@Tv z;7tP`F>YqQ-z_b`A-FPYGA?+p^PmY^nb;E7j(7_T-tGb%h(J(0o9CaKy|Y@sg*c&V z(kxodqi$}N&@2m+06mwxE)Xux0w!Ckeg&)FDe?xNLX3uD$57MhACoq5mEoR9@kqRi za2%eMXi6nq9?wA2Zy>;dNj4SY>Yx24w2kagFE*>s zbiteC+;l4EMy(z6Hsx(k*FkptD;Pb|>4N)@qOY`IxFdw*U9hwLPJ>C)9GDP}nF! zYWN4)ZLz09Dgln``?;#b1B2!wml7k%fng_g%jp-_OAaPJbS|a(iJCcIpfJ;rO{{hb zken7gBCHwXrW@3?8RPKMoj^e*1@9{6p4&sHZw^xGm zygY-4HNjuC|0*p^3N!mWdacx0^{aZ+Dd_rY-#~qb;kuPv7GeOgG(=e8=U}(4Q_uDH z7PoX;DdBvqch|Ur&Hv5hj`3+=Zd{)bZs9!9ghuWT+)fTUpMNu!NJo!#*QF*s4^1yh zzql`n{B31R#6Q@)JC&(gXG>8m+2xMc~8YfSzk4pyuwq4Gx@G&rzLz>JZ z?3p1m&Q?Zx^@NTrh1+s$$p>OvV2xXq9Yg4q2;`s0%vEKgDBVs3f*G|lwA<}0u&P<{ zySfi>1xx3Evw8~!cY4qL;oHbx$5UeiQA&~cjTU_irAF2=M%&8lBt0#_PJ%n?^cLiq ze)>gN?u0O^Ncx+*Q2WQOS5?6!kvU`U)#)(&oD809_Nd@A^7KZ`NPEd-TFDS4q}&v5 z(28b|+Oh1>`U5+aL$mseBLl<3sjr5UX*wDXiVJims5*BEE0FaVa@)(`?UzAssFp!x z{*5;&Hph8%pTC#gc#-SLuM@-0<>6Fn$mts!8yNf|T7$N_7W0)}5)g4oho9&O>7KY} zV^u@7HPBuSo$Ie4Ka9r%nLK86r}y-gu#}F;kd|^iPDnk|T_4PQ-YQjesZs@=t4*p* zbg4}c?-KBQO({h9DhH|_QF)#jhfWo-pF zbu8A z(UBOmgrw%Mg4hAE?{*q%4(w{M`N}0AmxR5JC_qyVgV~r_xAfqy&v*-O>W+trH93pEIbV5@ zvF_s*b7HM{(^@>wxP!Y{it#j{$MfLZ$i0EFJI>hXz?X^9^uTa5=79FnZ(E9r>iMjQ z7gQbw{gTMl)Zl=K9+Kj%csLkV%Mzm6x;W6tH&=oSGY5{mut8Xpg%Eik~#LST!8c*gKWx~e*SXWYUXXhU)TmU2ls%BpFW3saTpB0((OAGQD$2)FtFX5H+RrKyHs#a4osoV17P zLcNfzr8D&&jsU1`?5DqT!lwH(~d>h)5}DNfk#O2aa)tAr>7~W?z>>> zp*g`!XE6`|AapVG`|KeDs_^cF)5ZvO_op{H-Zl~I07u3)4%Ls0-lK_ShQ?)V7$(eR z!FxVyNAV0B0-#Uj>9^up)reCZVJW>KY|ou`(*UnC!k>_kRP5$IeLGw#k5NYbG) z)oZ|g0%BVHcs1{BX8|7SlV6b_ro$0IwckMvb%20P|6Ffl_xw+;03G3V=lt2T@!qPa z;>f&j0w#;i0 zBoMv54JXdqB-J{ma!?HyOBaGS;)6Zbhystp8lNT{HCYms|EZkeuFn8(L0M9DK^6M% zWwgOE29&uuY(iX_72{+D4cUl8kD{xCV9cc{Stndy@pf}&am9Fv+%C58i`b8OXE-Qj zH8cU0?KWU|2xC|MZ{AWC8AbAr{nj~$LYj|+3(reXt^p=^J_~suBkVaO)@`)C@6LnT zvwX^!?;&U%Y(mEzNvS|`bT^}(1B6xfB{oAUxtOo+=SesDuOr!*~$qXrGn0`%Je5eT8evf*ojUMo>icq;_}(FQa(nXG?V_Gcl)twsfe zu{zbt5LQ@aA%g>8jzZW#3>Uz6Q}oyAJS;F+XVc4KF(I)g^;vj@WstMvJ`4CT__o=+ zfjIXTe}VRU_`&zvuz=n57urIJP6YxGU<(i~2qw5P!0zb-BKi_x5cdXm$SG$@UzIzY zDfi*0?+l|^w=xg_%sOO1fEta+TVi*WzOnA{u-f@0?GJ3l->+d3Wo}lp!&ImYPkCRskiWg*!ZPSkZur3&NnOv!E{hY-`%@2Vd0z4fNC{UhTPH zMV6g$b7P3pd^Rbd?DY8;c&}57BaK^w<@hpL7)6F7%~39TPhaEqi$jiloVW`DJc%LD z+ZauZ9glVFIJpl@WbRIZYv`|?03pG=_!Io5!c^qmKstTz&gg*f*J94~E1$&BM=A@) zXJ(_4Eh(ligOlvpy!Q~A4GWbA%hHGRhuv1PFBEUXTbR*Wd*J>>(y6( zd@+*xs(CL&dZNXw_v1cndH7nG8HguTrsp?>e<8D^ocrb@{^2yPxQ+RB7Bz9>Kzl~hebz!NK-?;ot127CErQF(auUXC9n(~OSc6F%C2EClcGAm@9;Vg=i+&6{UKIY z@n2nX!DE#^)6rvo2#MI-!V5^r9qi61z){#Ez}8O8g^qUH;?OkxE^MpG9PGTYtLSa> zXs&sLE5YSUN`N^Sl#$AK5YCp%dMjIYE)@Z5Q&o0F9&>xUISqRX7jrMwjUdH=33aA7 z4=^%Bcwr~2&h}ItdR=GFo<%G!FhEU+pxAdQ%*{j1O#JxZ^(^5i?M5jTb5^Hv?TbOK zbbFGT{rL6=Wr%*Mp>Tc1TitG3^l4ahxM+R-xe6?!uE`qeldM5^4z8F@w7*qGj||lz zEX+34h^dtDFvz0dgC7VJqzecep8DTZJA1STI8^+pc|EpQu~eq~`3k&;#p~a;*T&jw zxcGPNO$~YVxbqq|R?I~}0{g4f=#WJch9bg5!-xAF=u=eg@737y0#TnCUzbB6i=r;( z0s?LVacMv@e=A2v=8S_`-iMO01{S~C_lpfGk(c@j!L~iWy*-}`mp$(;LA^EmBf{>{ zHH|qS&LV8(S1 z1vE+_LJO+Cm2BXmTGdQO9pUWus+O{x`_q18Y;=5Nka++N;Fq{C zR1d|e4Tm=ithFt(`IdPhRF+vIChF~m<8^NanIcYLUqdc4? zX=_gy2vA3qpkL=;XUm|zF+DXAI}1;ZnfchZh{9B5n1g{(*bFDz&sLDPRTv;Z_UMvU zGANipxoxXWu+?xCJ8WDf;y4jmZ6hqRzF1^;-Yc(4JjA!+H>K({k)j0;V0vsDS(A+{ zT!oHCWghc|fZu@7Vr5~oeyXv>tquODjjOCn#?)(f>~+Nn&BhcK%>`C=F?3D=kWLj@ z=~tT%z(D1ANM^o{M_dEm#o+^1-Ni;p?C%rU{!7iQBCycfFF?bXR}ihhv`hd{EAsK> zKBmg6!`?2g*;VVB>U(7N*b0oiX)KxGRF-mLy+v-0j;F^GL(WHECkDr{m-3^LFO#FG z5oo83IX6H0C@T9HQLt5V3NGOFpW_)pt?-Uy=*R|-)t1pE+71B0{bLe(b5I^)1G8Fd zk)Z@=TgN|7jSCxxeApL>Z_?42leluJubPE)7N*ki)1!;H&xxi zyn!ZB#3y`!oka{F@FDOd)A1=|=ooBB+a>ma6B#6OHSUIQ@+21OJ!z)S(-kSNX{_hAz-CT6iHo(+22 zK^7BQaj~)e^w|^WnIN4z3+oqNQw<`8j3xuc*{t40Bi4X}A%(pS=AAPI$NlqlWKd!B z#BlDwM{O{lT!6l0fd2E59~yTiW*8Cf)N=0Bjn6ohtMI!GeivZ}?wV8^g(Mq6uxY5o4S?sNwM`i?v+u|_{&R}&sEK)37NJz#ee(Aoh=xuZXzGcYpL=!fiS z_(KNv=^ptZkJH$LJw>Iqszn>W-o~%LkNEY_sW=9besM=K<$Db-uVBgz%%L5Hbt9NM z-Q>0)x}lb8bZ+fpY1q^mkJs2bno5lwhgRX_Zj}fty#6xm2^0sEj%$-*pbu0vG^`$P*;q)Ew0Tf|6K3 zW0_@jIe364OWw*HVe2nnxpd7=?pN-wsVDt;1C>zrkr^5D5y&vPldU`=CBZ2%3hH7< zUTjK|Gs0kll5O7O4PY7C_ola{17V~`_coAU6&QVqVA~?lCao48cI^^GRgzu5H)>wz zyc6KRfUAhZvYd^>c65V0XQ#LsA2YU2?fkTQdql9iGG$X231bp_4s2nXsdt$;N0zcq z<>701%3`J}^;|W;kZnY*T`}(pS*uPEixDnhd3>3cW|0=rv8E+K@mofd0aPxI!cJ6+ z*(mG>VyoL>xEgHi(_=XY%&?EvKnm+wNtOAq5@)hvWw$}O7;Jbq!^{mx)X%8d1#!ae z>kZv4J`e6z)@JtYX1>60v-?_`15SgFeHB--U;~k&Cje=W;Pu0 z#j2qlr&#KQI(Osl@?kJ*8K`bmJ&`r;vKM!5NXr;w-od;J~hDTEkUnbvp}LvrcZ! zeUZa0XgZJ0-KNYeammKiKd19>YL%z%n8-UWYWNgU5PlKwicwJO z-zd1O-1L2DyhHRv8j2KZGyVM=GW|6i9@F4ADv=}And>7zqJ>m#gF)J0kayy)wZR}w zam%~I1_qHb514wxo;=yHP?|z-%0~gB>Y(hiS8*h}_kqcV8eh1@5B)~%L;h?~%H zm=}IaiNsUa*SU6!sk8efl@xoO7lUHApGt1)GwzQwHT?6yC!p?b^39Qi^v zyycYEuIqM(41r?VWMySWxa!zvy`BM2+^Qb>yBX?T_LxehI0$jmDR--Uth*djowQVi za%h3*w$%+jTtEh>bcjgJ*C}h3+GQRP8V|hUM%6B_P<(F7n!5ubCqpI%r*upEvUUuMs; zz>pbWYnLgyLsn8%By(s@3ODLwX0#7SJo?1mwlZfVXrcUYKNoXqll{QA2yiF4ycNNZ za6Ao#>>50yhT3oShy(Aofb2l-&%Z&4C;3*wxT&7BmT|sbE#q8|u4Vk^z|hcz&cwOS zp+x8Bw>lGDi3>yLItIH3Z(TT>_4 z&C}{Dw%|hIDVAqy(k;M{es}1QM#k^bUy{RL4y*hoTZ;JQl_B}Vj+YcbuO`HZd&PDlC9RGHsQ_$qEGW2gUCQ4zQ*hFdTr0ugpfE z4iH7CYQBI)z?`2qBnbSSVRXD9o{TDn5+nb#vev%pe*mRTwP}KYvbbj3r0STI?Tg@>)g3qH zPpxf1aTdMKd;gfMWhdfmQFNJQMZ|2GQ2?atS3c3mB@4X)dqY9|^w0gj7e4tL=!a!< z_~i0Mr}B4b)^OJ+L@1iu!(s>Tq$HvZU26BSheo%udAsx2Eem^Kmg(0|o15jB=NK-T zEE0KZTn4*d>{~K<7y-RcYp3{k1daq^A1*Wn-f;pM$A%+V&NY}=iXZXq!5xjpubgWz zofJP{K!xtzJ!0cIh~N=>!t{uZXCdl28O;(h!E9`(Rrg9i7m_ z`lyWQy7d{%_xaL?#1Wy>bzW|QwC|jb3s^(*=kxftU7(5*h0v=@-9&%pAq*sv9vB|O zfL!xzGtWgK%lXG@-gkT?uz84+fhl2O2Iv{Y9H{n3`b{kWVReGEWXyyVYtC7-g+v=7 zFk8=ZahXdFkR)2m$e{q?#Z=A|aSLy<{8~jP=UfsZdIXiLXX3_Fup8$seNCGK32A+lKBm+pNQd z{qmbN3U1UeY(o>P^DJ$rHTTg>4e*03Ds%ci;MnP|ck1*?!~`RTa%}@`xPgWYTUNu_ zj;Z1%nF^I@zH@;$Itvg=;4QI41)!o4 z`1!80UTMnwe0$4nyhVo#tOgja`*{|o6joY!kU{;p={3z0rvx#~9_5IxQgWX$`PJlN zFO-n3)dcZ`{U~p35M)o-I6>@A^kC$KW}t({@ztW{%){)1;+3(sFY7UnmrSnr*@hIf zk9EJ}6t9m(2A?~jibDgZ3B%>EO^{~YLXyOVjf3BE+S=M%RnxbskkQHJW%BvJ$dFPeG|r?ZL9}}f zcijZKM1#)7fSIW`qLZMrF{pi2syuwHTsvVnJIKz-OfGwxx}H4yqHANKq_o>V2_=dsp( z%;~@KF+;#(j;tSw&F;yPd}W+oF^Ptm#~x29r6-CEXhot~6Q;5|gPj7L__HX~;QE+u z$)f9M!cf^9ex4*;IVBQtYi0DZ`*Q!FI12_;LpT`s>0kk1c187BD-QDFCWsJ7W#V5q ztR8;F88^LkP@JIS86Fp$UnWmc>*UbvV}nm8@pfQ9utJz3=HS=;Mz4+r)1X;yk!;yC zjK!RK>X&=_Riqp3o+=;9>FfVXKlZL_D-1BdgJ1L5g{qEqvb|8aUOa`BC%;r4WFz;+ z(|4TDQ+GcX?tSxm5RUUSq+Mak45OZ~$-!7M_!Zlz!#3*hT_jK1sKcft$$CSEIs_cx z+8p>gm8G2Yr`DGv5Nbs&*&&2*nEn=eC``OuvsEfhIFLftot8AS!9ib4NuSd_bOjZW zToBpmM4N~Y!JiVRB-9hQMaZ9jb05ze>h$D5gH!G9ED#>;C_Z}>_@4vrKy-96NoXr8 z5udsCqNHXD?f3?h64Ij6{7~}Ga_xg%G*jgXX9}WicpET;+-vv<<8;hHhdpuF+Qr}A zkRdvc2WLQ6Pc?Om*a+JV&F=wDQ7kkJjmqwPb?puTkA*D97KVa}`np;mCJlQVj?g@d z3>UDG?XFgYUPZUzJ$%d?FK(a~%YQ97SrX^j%~Y~Q=IO5q-lfQpVP?JEM@8+@Q&_-8 z_Ss>ur0+(Xc-y9%VbdW)HCFT81XMOkRs~v}-F2eWy7I`rr9nab1lpqIJV+BKL?h(q z_lT}wXMqU>NTyInp)5uiX0Z85%ZnH4l^4%U6mJ$ychdkGX z|GPc~mFzw2I2RrOse#^K1OHvAWRjy`%fcy{(xt5X<4h3toNJG`>Hb!#e7_;KcP#TP z77uocnix$HC-@eERRP7}N`4NcH+)g+nsgc111uWLR!KaZ_9i+@b z4z{dV5^*3!FEzhG{P^7XxS!?B@$; zX!j)tpj@Vbrxbw+Lh+J`b~AD@HF7I?dwdjWqr&rwPgHhm+$8ZUCEmvfvAsDT4~z`l zMvB0Y%$MYM@yQ$SJixvXt+i#v1XYn&V{VV5*SELi>RO+8AyxIpf7_?KBuV&UHQ0Zdu8m%aV{UlR%<4` zZ1j*iE!!aYrkh^4N&!{TF2}g6nPjFv56Wf8fG%#CiT%pM*ARJX64X}(2DWn8&0((@ zFKg9F^yU_()VD&M?>}K~39?6Za!Z|7Zs~kHITWXO+gq7U4&4)Re;l*hc}_GnDYtaq zxpK)-H;!BxA}UL|HSaH{m0hYHNk9=5N4Ci_AXU`hhRiQ~_aBo;+qt;q{;=hUE1F$E z^uvQ?k;nzB7*m!^Yy>+2h`AY{)Q|Q+yMV{e)jU86tRly z6EF&}0KbF`0s_Pps(N@xfljMB(6_{t!zIWHDGR4-JUYc_+Y6NScS)qKltEK~dCyBe zSH>A+x5Zk-RO7dAP#bT3MqEI?98{rOn1KKp;$#KsG&K2gju^NwA6T`J5A{=K>zO7v zy$Qn4GWCZT1(MrO6cHf1X*X-^h$$A|7K6RNg|B8Q55`1n{eVj-a8tSBK^C80TA=r0 zCUSoS&fV$}!X;Mzcjd{xZ<;r>J}7naOL1HvBM_F*{d$@$uo zaR;9)^Wjm zwGY?VOk$2Ym3}sTfo1mAB_M@S)N1n+Dvc<1`JR%?39MVx!6R{TorX7;vSmiILz4Al9W_M8#rs%SHg8tGE8 zuBp`lxpxXv;By<*whc-GdXG26QL%-hPFCVcEs(NaJm50}(|HR>iStG@Q6|DS10NHZZK~JbxHZ4kg3|6ID992IeSCGt^)) z9Usw%n4&&giWn5$t|o6K2EQ2;H_@QO7MZS|rW(}czW->Ed1x@v(X~(e#4LQ8_#Cu{ z$46l$-Ats%poEGm>UZj&w^E}%lWLI}YcM*KW=skhJN;uRvBf8xi+2(OV^05_M50wz zRD-EeXkIR-MsKIa^z^jev@}>*k*4M1om46fs|a@CKjYujdi#%YSYfG=bn8vlg$4tM zFJ9^I!+mF9WH90Qc9;gx4G$;56pt_?0l~`!fAC`duB%R9(|NYnz@wdu1L|Nh7pJz7qXsw~$AO-m zbLbx2ni3dR1czWfMhI5OdrwPo_vg*ZTt430lt>J3;m|EkD5*(6sqLte z3mH|yzlfKCh1INT!)GWNO`9aK$odH;B$`j_6uH{4Y6k&IPH*9jSC~ZEQQnbd>uVDJ7mqwNC@Ebh&(7Na(TF_PK_yZ8(M<@1F(exJFR{ z--$&XJ7&L+PrJ;j&-qAl=vcvv+pYcHP6^qCnRd*c*&x6E^gH&S?~&6|Kmi2eq{87I z>z2)L+HXm#gUw>6#KapW$yW^*WGV;cBQ`kRXxQ%9cL};+tC?KDGqkL+1qFO{wKFbQ z0pFPpJLHS2GGJ5sj>P@^XM?=oY55;g=`4uyT46q!mSw^hM5ywrQ<>SQWJ|b|WWm{| zP(UFQ(tXe!mC!F-xU#TGIHY-iq+)kcUc^h>SX23X+1U6|H_(J^iZgL{N-DPIjF>{A zpaA-TXRO4kOoCjE*kEM?0J3NjSKm^G{ST@C0Zn>4MZ9ZPzaE3o8x#k#ek%2;T;=Jv zRfIbwrVgtis^nAmrc*)k{u|^?`$M-Zyg#6olUzAC9Ux z&=;nw4^gDf(_u0Gqjw0*K(mq)-pdv$53s%J@w~7j3fB2&c@VsIf83C$CAKeoi@_Uj zR>gtJm}QN3Ws=&sj4mDdf=&50Zz*fEz=#+7BTyNMDIiFw!VdUV2_*X%MasaECfwQn z{%etbv3H0U(Vx6M5>Jgpt@+?CATy_6((37z;N#8@eEaRDl{!EF;H!4i$_bH#?WUC` zAV!6w5VocjtJ{S4aGi27b1M|5i&rp{Q3||#K9dlyc9?1B#8i!ev5%>s7gGh|j5eA* zq)6O^xPwfD`5_qqo>sKI<{^sy$j&01HTO|29@>t@|Mw5JQDlq8gOoUutPeX#TSDKp zl_An#@ZoA3(Wc2tnvl79g~B!*q)2Tp^oy~#JmS8Za|>Hh!`{)kCQYynts%N`%f=4PjOQnJB{-fnT5D@|J4o1-drFI&Nttn+qS!n(p0 z?bHB5nMb+NdJG{)VZ!OVeg)jY%EXrY(?6LcOOj{<6&AXC)x{>2D8^I;R(f~DFZaD|U zU-$F4iK1N!UpI2G|N4zj{$RC6m$YLkf*{%F*wJ~Om?eW1b)L43y6HyU3hno1uPa2z z5uL`Q{WFRgOYgxH^yoe-1>iod;GLQLsy>8~`1`V#)(@J`)eV}@TS0S|jF!b#0)5dU z*n9qc z_Yu(w<}1zGs@-~RmEa*Y3M@FAM?mnl&lO?!B+0T)eFJ9oU)@wHx2Hw;slM%{~>;o(}k$5xiZD!an%=rBWJom^+ib)hI^VnXXH+k zxR4Qx+uy2lbFfZT)2Xh!NJJd=^u=Ul6IdOqMunwA6aOcI{Fhh-t@g{-{9Z$96srMtE>JC{v#fJ)}f4D|OTOGDu04-t3_Kt9OdW0v< zHgc8I*&diOm7+_$FXz-gN2$~R$&WzBbF0YU>tpbr8s_d@^GL06azJfDe4vsoqGJ?v zhGY@<_p+>p7I=VUZPLRUGy>!wh;Twa7|Pr56Bz{ZAb;%M7eCDZ>sJ}0imPCkjChj# zLHS$bD#T3f`#KR^L-h}3QVLmvbkZ$uGKZonlZ2N>v9${w-C+xJRY`-Pv*75+dVQk;OGDosR;H zYY{yf3SsW6jM&Lz&c~PgxG=##0?`O;NPD{G=tct28pBpJ2l-fD>)=Lyiw_PFOm2ff zy;FIfjY$KQY%aCz)Pm@Ex!3a7N{l}IX588-!tSsYi34ELaVm~Qx^wE><~>a&e9SJeBW-1^Z(jA2 z%@^t){*wUW&}D%p&6^EmKgJuNjU=iK8f($mdOE%mH{_$G#c_}9thizx%DLUiT0 zUV$OvuCS;)nwKOPLxbE|5oFnnL7Jv+~wZ>R+>ooF@dRvRRd*$GTlJSx?{;$IKJ%y~wpis+AKwERQg7pJjxkn!G{Ms7wtAY7GJ?%=tv$(?}@Xh8VIWqsCwAIylLq~|UF`BLuYj;|) zc5l4$cO(yk7^Q?kw>%-56ma)CzB}qO=^aGf)cGm4r#;vbS7swO62sqs8iu&;*f$^E zxUTrxu3SRW@A9{#^~fqu*8qk?GhmYfUG%?$mG@$CRX zs*MOS|zFw_;|Az#v6Mi3@OfbVqCez@5WBqcvMX!A!QF*0;_2zH>c!*Uq!1wh+m? zHb+$G-$dT^yd338wYNIYHdx;Ea23k_L^=&BrdqdDexi;C9i|y;urvzISir0tPeU+h zP5O!I&EM6dd+Y2l*6Ww&<5VJzgPO= z*3@9tc@gR9XMw1E20CLzV69HD7-D62vN4$*2PO99eK@V2mW2xzC8;NOeTE@C7K+)x z30uVPN>ZJx<>K6XKI`o*MXq1H#`CB^p!n?jUAM-te6!v7Ic4Xg$wLhJ1Aw)LtmNFvLD2ZDK?1WEE>5| z+dyj9)goZCVJ{FD*`73MIyTI$NvSyzbEerBN1YQj)EWSVR?OpOsnBULDdUkXN^AUi zva+(ayHbA5_FQ* zEzb63psHYHqz8FYm5O3Xoh4tt!=H_(qh|XdYl+~aI4rn8%ms%l%!NDU7jEkh7a$|3 zNmnlchFAc@ow-U5lZU%s0+N#;(oq!!#$*^M0z$Gu?ry}|iaV3BvfKHrx0j1KSFS7U zojX787UyBakJg~%a`%|lYEf*v8f!itcO8$m1m$3-2&QgEhU)%zkQc9>)o_vdGGiqtar4o~(i{481;8j*^ z-Z2JE$&VqS39TqfL&OvZfNtE}`6Z^>)4w?q->|%{N}sFH@S| z!X1fecMI$Dvh*oCiB*P;Sg7ELVQQkljGCUAqw_kDPxV;9Mh1--7U?XCuGAcC{}``r(^EE!8&j zQ!w+eCnF3qCnxi*jXNksS8d(WR4FTVsKs7yL6dFm{8{)lOEesU6qzZ|hvtZRoiR4z z9pVf*Mq13D3{xF@D=)+^keU}9j?y^fX=6 zT6uVf2UBK$p;)Ydvql00_n!oY070xNF5notEZ*82q(7cy4XlkS!9(yETBf{{<{;`a zr*xdPau8i{?^(&qO~h%VdOO71F>?@I4&5_wb3CmaL=d2PAzQh>R+)V4?GU92OQBQ0 zbon)}M_+c37|INs)=%GRQ!^7^V&RE%sIoF8<=B?Xa@DeaIzcFa>Li~F98&Lz*8K{Y>DD3S`RD)Ch1YI$n9z`P0Cc1O0=e z$$MjI`>A5}A^xG&4X0mdV{ z_#HM<*~fdyKHh7(wE^7Hk#u7CR(vouGB%JLNenq-sV@>E8cyN6GPVZpPD#{dUNd7` zMUKbwNGScl3SfCs!WKg_t;-nOVpTOZFqDbPeXWL{2 z98)ygkV09`nZ_>Vke|=GD>)2jcS;=a%9Ro|zG6hSHI}ZAi_kh>bn`9CH6O+ykJ+B* zdwTT9tC%Z`C85qf$+XX(z;(^YDpUT&Vz{T;yVW%ugJtQsJ5%1e@lBk%o&R0+bKKiD z%3_-1m8q>b{nZo$R#CN`We9#m-dJt?PGRl64Y51w5~g%?SRr>6vNA)9rY=9Z$EMFBCe-9{(m+Bfx$=3tVKz z$CMLp9=pB@fOPmv)v%y9fP*I|zRyQ|58|(8~ zHk23_kyNpW#GVL(Dr-~hgF8O4*6+80?-Z&6%j)}_HS$48tNnI23p6|4^O?%T78kfM zqQImPcF>|~l(+~y-=i{d_?SJ5w%9tfE$$=p5603{z(0o?B?xqNpG-2Y&~~jVGqd8i z#D`uG7tmybct0vUu^OUyxY{m9D?7&>b)DnxDn^v%5ElGDAwxiG(*=5amsJRY3Geo@NcIv zH%QPz1ABBj&z!}y+E!WCY@U`$u+StLfYTasbyoT+u$`;K>1Wv=s6mH} zK7lGwVai*{Mh1rml6TY94J1bT$<}hLGZsr2ay9S$wk02DwODyJW26FX<;Uq|_Z4z= z0P@Qm1RU^FQnc~l)jp=+UT=v{R{=|Es}vVA!c8(&jmwaE^rq1@_*4J2PcUuBCXfGy zjr1lM`-je-KD~*BgZ{pcuR7>atcl1Wg8v*y3nPGS1g5Wain1j&o>U5kX4t9#D|GG3 zrHhWYR7R%>TQC5nL)eCc(i}BtFx3RGhu<%1@>c{;Oy{YdSF)9+mDh;sIBE#O%>z>; z$4+{U$ZetXos1Cle%k>2$D=hFB(X+x9vn_ZWR6zw=!IK&VU`t@DLSany}->^(k&oH z4BhEPdefUEc8X537RnBc3T1L!X0SBfkT9pG-foc$ui#hTmWeVT0@*1^V}srr<*dBe zS8{mA;*II3Po{OwJWS4X@BtEsdeBZTE-WFgUQJUnpyHlVTb1rfUH$T&r?wrV5bqwm zM()ScY4*U9ITkV4w6M&e_!Sq~XrO2(_AgDj=z$g#`kI<M{`_N^oQ{Tq}nVm>!Hl)hOHqDao#M(`#`oauU zCxuh@Qx0+K+|OT2$;OH!{1?Rw;sqQH5i;*Ut${!iqYit%U{3m+KsPDdqj3q%WW2p! z)PmZ}@(;|*I#|9~fYhpZ2GfF}eA#!`&tJeoRQim)U60Ac#F;clc3JX4xUtS5;qWjaQH>sJ4U^9REv>(U0 zN;w-^QK8t?{_BhJrfq8Bc*3uHn)rl{`22r;^@aE^@=y_-S!HnzihP*+3$j}>QvkvF zPk8ngBYk&3N*D@o(<%OXkdJ}v? zu<7*`i*>4cKeiLyOgjv2#y<6`=1KVsyvyATrup$lxaEuCuI8&?uBf>qTT!i#$Sj_i zmfV8U(h1-ZVCam@I=?mGuc5hdJM&#LC2LE&IZ#k|LJzv~!udb|SASkwVybiR1|@tEsv;#)lN1TB{{*Wy=?U(s5xZp4C3zR;F;r zULdv&8CN`!EfO+sSW>zOekhoIB-x!D!nfC6d?;Mpkb8meZlBflu(; zV>QUzpQbYsa(0^}u_eLUs*$D%#Zf0FCTvHY-e(L|ABj1d-okoUdtEngU5AU5%%9aa zx{_&?8*7_Hqx5-2U-H%MRbuF%m`CO#PR*N`OV!AX7r-^FGh+J8#QUSczAC`E%9>ON z*p!D8??kAdQLlLm!_=*dRMdE^A}i*=gW)hy-=^hN#4De7)_@}5JygW2Bj%?C1-G+Ft0U!ADo5Oz&)H$ zq_?9kEqmwLs+N@IV8Q=QT2d6s|K!~k7n;#+VZ*7-b_?fLY7~iwj@X0IxPv$X{bH~Y z<|RQt6fO5Qc;l+y;9yvKr=OX?{9WC~tRAB=>&uR_@zlWh*d5`w#Z$?l!KO5L$c#2P zhmg>&`;7LA?XK0taiJ*-_gyq`;M8rX-AH9ed}o6ELAgf1*+Prpb;bF!@sgPt9q5QJbKM_q_3tq zVYrsocl}C)#C{#P-b0YDjFR{7*Ks(-0uL1gH8jf?JTuw`l{PHkHok>x_Yxx_mcE!8 z8A%L|MPNNd{clXYew-_KTzwyOE{twjLiO-`sdoyg11)U~H$jI7?Sq9jjBDbtA>ym) z?SnGCT=6uyjYxn0wP;N8ta8_|`~5b?WXM#H17J{+eXHt`Nb7{lKb-@ke3`+@9~-{7 zC_l5WKE^dL=pB)4T&G#jvx7}<@fTrrtcoU%SmyO={NdX9R)_21#_LQpLuMo|*yPZgdnuTTRV=HnA!1Y;p=Oa&a^4Lh-Dm6N95Z-~XK@>1Jktdg3L}a`2*#8hMWCLQDeH$qOK@0yqmJ z|0cE*G(&H>H=Xvmt4>$minNdC-*F*>EkA5_Z03x!TAZRM+L=%L>8)M3?xP1e5aeFi zGf>MRq0Zc(t5hDo2FJX%&+$6%{bRCDG{T6rzzfKrpz1rm*N(u!AVPR;iWM0x-YYgA^Tb43Nu#_t! z`xiKScJaoS8Gr|ZM0~DZ>u)o184P=T2k}yO!|jUD;bPo-@Xl6dBR3Mm-vFzPn3=I} zFdxIgJb0gF*%QIrjQ@3;83L2k^(YCKl3BF~wmaAnc&arK^wHk^JD%pMIjpf2Yrh?k z%)WO6Mu%(@f!reU1hoR4fP+cSbkLB@e@CtiU5_$t7-A`S+w~TUV*6B`sndCApA&B~ zw-&i2;;_+yvBZ#*9!!i3j3!g*sFCaQ-4NEhbwmGzXqIAGQhW6(>SGkHaY*i;AZ2#4 zB&W>(;u~fjXCw!SjNM6&4#n@`x(Xb0Kw524Ls)Wa?xUQ0zaW`7?w8=A2v4qaQN>8Y zXR9pmQ6dXa^FM46S+x>BvQlA2O9|c4dgB&AA5K(i8pR5r@JYNk$lC}scq^+MXQFg8 z);OUu$laS9P!c`F6zurVN}4loA50rwdok}lSbjJ8Q1i9ICjWGfP9g$A1$rtfrD+0^ zco7--z`p*!^yAUz%LpRVcGXqkXaT<%F1|MB6=rcx=Vo!gcxN*LV+Fygse(-A!lUdi zpa(L!4=Ghn<}%M)oBPv3u#?eeeO6&(4e_#y;r$ z;8ZGzC(EA%PECWk?$p$XQ!P1!b2F6qGBKP2(834ldx^pH=}eW}gNy%%y&|(W_30c3 zL*8zYoPo}u)*TQXU)jPX_w$CkgWq*mGlZ6s9XUX$MsCEmH?>3^)kqn@i#exQMKMnN zQJlexlZ>$!!6zR%I-_VTbU&q!T$U{IA^d`A@mJxy6tb{*#hM0=-|0NyZX{5pWGji` z7_w#T-eOp5hNV~~f04m2bV>^!N12-tPAt)T8RsIAy({7c*$$SMOk*6DBiY!)dH2T+ z%Vm&UTi|Uh%m8aV@IaUaQ`!s7fZME!;>Ib$EAc)Uup>`j>})pQNzRz@BTKk7W&5<9 z4~jpt*3yG$MF3y_xVDe&wD+P`oduOu9 zw<)zH4Y!MQoMyS{gjlgo_4x61@PQ?g$R*^rhkYD64N7hu>+;LT**}*d$h3{e zKo%L)j13Ovdm10iS0w~9K^Y?Wi)p{A8HD|Dq>_vzN5)1|aE>AT&ItNd6A8{4?WhW6 zc(7fBa6)Pn1G$1`<+D^)tg8feA0ID>d&hGx=9vKw(|Ke1tMj}0s%l-$_tAvZM&lnG zw@%eKfu}4zA4Dz?$&tnniQPV(av$dc@`)#$f<~bXUs++pu0JSK9Pgy{itpEc6l_xo zta?);3{idr6mgB9h*7;-92pSn@Zt3-D}8=YTyP5nI`OC1bQaEpJu!fiNJoS_wJP(!Ed1#tr^XO=GK_%c>U$0m1i$TKNq_IMB!cYse2*x%cfZ|8|%E z2VcFrF0Xc%f8)D;V4DkBo4>c16$hQ9-ew-SJcqQbWWuqW(Ir#JdJk8R*NyL%0kI*@ zIj@kBYA{;yx5nOyS@Ht9KS1t@H--+s;x_#t^810oFB0OoyPO(zE{~?f>lzvQ(E0u4 z%TcE?vr);G>;v9tvhl|OM7$U5psM>BUYIE%)8d^pAzv^dYZX5nSx9o%23F^w_#G>h z@+Xn1R=N}_EIRc?wl#&k^2#1*?<%B(?o%My2dhOV`lfz}-ls79}?hJ|q%Eq+^6HtNzso-DpNZK0UJ_e#RS!EjYP>h9&#`LER z9zw!9#*{FT&+kNuKVjy7XKZD_Q$>Ot-0F`-PlmgBt9qI}CHnCLCbdS!%FMjcmgAeC zpi3Q^#H+&BR3YV1SWlAIvwv%jwPHMiNB5~(qoWcxt$pO=0oRV|BcI00~O=GDghW>cLAd^*}R0> z1qt`sfuszHc_7nym0b#loJ4a2rMK;Qf(g{Zc34l2IS^=@{n%_ZE$yL)eD4TXZYpp~ zKveKtP71*IAx;4uB^EkfQ8c~W!w#8ADac^#0mV&Z%b3Z4TTgqyF*3u}aKzt2vFwxS zbm$g6WYY*Gk*h4_46b(!#AHJR&*t)+JN=rngnS<0Poy(Vd$3kAYSX+mZI1{Se`C!( zqN+chS2z0+WH-7(M4GJ;4wzX#Mdq9hqm5#<#AtM?wJn6q?CQL=BPEaO3Z-_Qvy(?% z5^EuWXmNTC&B`8iIl;ZirhbR!9)>dG!r!0at4%*#)@mQrQNO=$z z%S527q6D`CvO%-0SDt69-Yxn-)vpnE58ewbc5e|lV+!&J(93o{u$>QV=L1{MU+)T8 zKG1(gkX|Pihl6O>RYPsH6j(JU8@lFF#h_lqE*Y3Jtd1xfetg$c{zX_S|Dj`D#}`B` z97a(|Ch#l|%%Ren_%L+e`C#KHYR!Fl?clwMn?bk|d_kK5F}-NS7ll3x*fW<4QUO6l zOG^fzt|JRAq))#+M(qC1GWFx1H*K+p1hh4ny4Ot5miRoRAyT8szagRgXG4jxf#h)7 zC!1=jB?T&gF+q*eqJfO1mzxN?rc%pqR^iGtR(S^~w#@lL&QaJ09%iVcvU!T3Zh0U3 z534?y(&tv{M{Qjt6VEQI7y%oo+ zans#dP*TfC79u$-WcAQG!IeOCwfBgEp6(A@lyuK~3va+8fm0G$=r_I9?ZY-eI}K_O zgyU@uMSw8D$Oi`B_oje>yUlyTR^0u;8UAc6c{e2ZA1h`nPKf`tF+QiT=l6tu&j-@K z=>jQu(0=UOw8e)0)3;na>4XkSM*Q5o+8_CNd~AGR822xBU7C-*bxpX~s9r;ky>4F@{PqOa)z*B_{SshSSzm~FV z5y@{$&bZ?J1Ua?c4B!n+IktZzyurD8c!RF9Hr}9{@dlLaX)@TLJBVR5;AxvuUJPth z2_oxdxxjod9c*yN3Kd~ajgzVtg^3bI4aK3EP7L4rES zH=(E9{XT!Pm^+X^@qAoS{JFDL2hfo@5>Mtj2R>qh1^S3)#R)*t9{nLX4`aqL zP_P$AVPIIId!LmUcDszI9kMchm5xVMN8+n2=7NPcTgY;MB6!Mw zzHtQ$c9yoezi20d0(XAiEqn`msrUxh04qxi2-V#xV_LfetPBUQXVE>LUY0!5;rET} zyvo+F#c)-T{S6m(&w%O>FsMo}Tc^4XOsQ%{qR^+Rn$O^f6&AHKWfB)^Li49p1S2oY zhwJ`mr8|S>M32+LNVs#t+IObB^|I=RD=ChAApG;Sp9J>L0X$+WV_&eg7?eOi1Nm*M@ASUhbTZJLdStBh2=12QvlfF2#H zV`+MtfHorDehXZE$Dc9TKHZ1BkI3!OfswJOJ{UA$QPNRa3tJh0mUql0Xa zj^cW_H;_($l^Pui!pk!ml{g2e%h8bdv@e5R5%9e|p67N+n{Af~$NfBq zseRKulIpbBZB?8X|8VCw>#8%BRAv5O=Etr!c$_o8+AxQh6J2|I}x>#ishwC2l-J(SwrhFPf&pUSf^W z?G%7tel+o=*!H4rhq0NPPH(t29peA6&q`n>bm+i5n&HFWfDWRn1ZOi)Rvt`=kmR@< zlSSEKF7|4%Qt98GAPZgZvv0xgICy7ZcsMa~I~+BA?&z1V$lQKHIAx#RO^n@14Tjri{AaBsdX^8yVvqh&kIw-v@sxy3;j-Dl2) zYf}!$n2|CIi|S$2a46N>dd7P`Tg5{yJT$2Ya76M%6xcZOc5Ua9Z5+Qf(9QYEgA9w2 z`6-5g^v_T%&atd8E_v=lvVAAiWmU~d8ajQ*<5^8828GoQsA>ATaeaVoF{5Ib?Pb}_ zWqCea%kt3{*%O2=L9v3nKI8s46G?o1FG+wU>XBE998!!gFixSq`6)<@(RGkmw=f$S z_&l8&9v@3M#&xmXfcyGnA386}!}Rmo26+O5ybvyfthbpnwoQZJ3^s!59o--;u}&Xb zNL=jGOiKG`&6FQwken8|RASMA%LEjSS@tm~0f51%%?s8dsJfQ7?~b#fGH}a@T#_sT{n$h(diu{oH%e~Y{I`P@v)KF+LYDbr}sZT@- z1pvvpDLxA2K=Cg)qX zLcEn6-pLU5tt6Zfl6;|(TadX@%)!Er@e7!xusASF5q%!~mb1zOEpq&{zRiRf(gA<- zmw#D}^zaI>YRNKd%15ji69ms!wk9dCxcHxL7>fo{Q<t-!2J)br>}Ppt0-X4>d(ChvjCrPkhBnz*%u3utjnReFCdtP1Mjhk1co zUvYs^38M%F+IX0LOpC*Nqu->a=RA zE^r8S81^PcFNJ$WSVQBA+#5}PIWU&^?2E)VpZ(WYV^JtKGDirdM@pCqY0VV{f7EQb z?vl-M!7bMvcFT27Je3?8JS};^9%N2=SL%RxZ>j+64t-cI!J0)-@I?k|u<4heyVgAL z%W;rMN7Y$8?4HX_dK&7T#Z%4ba2LCRs&JlCWBM_twU_sfa7-eq4}`mg~~2Gis%-Zu%DQR5Lm1RDFY!cprBjUNqHWlxlGGf zSzpwZ7fCN0E|tmfyb!K%iPPNM%V{%jfdom5m#}+6#u89>XH?5J=4Uew#c~QCZEpZq zv?RFBA=|Vfj@~REo1V|5X9o-*f!|zZCv+DbJbmX;$8E=Xl zX-6(4Mv?==Kr7rYhLaRlN;;gzRWx@8`9QElpfFX*?TdvG85~We({cF0U~1&nc$&I& zju^lPtXKQia&d*i-5pNdPK}TK&;R;rEEHa^ZVvWxTW)dQeNjSRbUg#Ao4)p_nEDWO zAg*DD%W}#6iCNAw-g-6^bDa26EcsAOuf+o|d5d#$HieD4KW&NFA{4V0p1elztZBEc zcKd8@R{T|%>H0c$`KngHgJPBh4?Er6Y?RFPsS;wrCM@CohLb7i@Us&Bs9pN*s9XB( zv`gQ;@zg!Boe#xT{MxLtcW+e+G2l6yQ}Xt6iYo$rf6G#MYu$$vwI6oJ_rB6?WWc2J z5s_Rf@&`C~3t4x1CR*E33Q*P2UN@uNP{z6zAHBQ&ci4{n& zoWZd4HXgmP5j=slxqqW+j1b;+0k|;SGH?o6K3UX#Re~x-NKDJ<;PbMDO0JA#k;H`7 z+_e~C-pL>$UGyhgiSM?>GrqkctN8oRY;1{mo9yk;aZ=TwEJrpA3F{Pr@~nMtLs&rW zE1%s-j*L;)LC$h2u%D=!lF3pjw>ZwQecSQ3oaz20Ak)P)gX}(7ZXt1k=PVCcipbbn0lzeP~Prvo@Szf4O5mx5Pm4!Lguq#IRYz9_jWnoFJ*^-Sx zfwJFpL2?TqYZQL;*<<(nWs~u#oiAwT3)=aD_a|R)E@b(FYV1+<`HOF#E^rNr30B9P8+|t-HhXBbeH^1Y3=pawDlG)_^U-UQH52NP}bdyaE0+iQEO1FlFCEq z`Jc*xEE2M%zR#4X^~1rgdf{M?5e^cgZ2UqqVnDj~X@z~D2PNyRw3njv{2F5;#bA(l z9NzZt4jt3T_+9!-a`?+(6_4;FiCm_Vr)q+I;7kvkq`7uja)z;k^;((q0akJErpiqzi}4PlHUh zum3Oo+!{iIlwI1s?1i-AoD{dh-K{hQNne1(Kgc^bE?=}7(Hn2&=NtE$dmFC6-g~b5 zg7KpH;9w5zm8|!CrZQ2LfNJC-XyELeYr^dGoIP}QekYv4f^fCmAGTC$Em~8HOxyX! zPuuwp%c%0%N^TA{!5)_h=q#d5u>{4r;uh8%TCXiKTNfHWTjzSadgV42D8YyO6OiTS zrLq;!vo7V7%H#dD)|kBRvyGp;o(mm@snu1fv5v78nX!(B&)E6i&hzGs&Cesv+*-@?(8`|L+At3>eIn~WiF2;yeb54NGGYQ;gfXXY_DlXfkde^Yk%s$ z_KD*?-{ao^IdoJm#Tnt8?YGDrHaNt9Iqc}{HNEUwdJ}y&qAfB<4UR)#jylc7=x>o# zy{pt=-XgQqcsKq+*9FUxmKLZv!?vUrnV!b`@fW(SDCc_WdgM~#ZfYbw1_Dz@ksE3?&V?(dxvfj!T`tv(jiFa2sEizdR_TB-DC;ZH3MX!)i zN(cdIdo^{&Muu64)|j@Q2K()D7CLG~)NeOAjqP>1m>L;L433%grHP2izQguP`UBBk8%h z?Y)q#EaeP_ZsBPb)>J7Sx`U~;m>*q{*y+uZnuqIk>b>p$&~^5$_J_K5Bb=W?Rxw$v zRc1ES^sj3eFsC_*oKH;NoTR&QUzXh!Nhd4o3}$K7phq{}=X4%GkCTX41P1h6w&mta zSd+IndGIQ0n=u+GFa#;37WLHb=DhdYnmaw^{e*5)Wht-9GU0!4jdrDFBX^wQ6Y+{? z#lxeI_~-?9(|fz%Ez)F}uO6xB5&3Id0kpZUXIf=49!z25MahtVtvvZwczaSb;8#+M zn=c9%T0H#>R0G5gMlW9YQouuHE5+&=TFL=t2R>I=5TDSv9C?e@n4@5X&r}Yw`reQG z@a&M$h87jo*dq4_;f>y>G@B&XLtNCW5`3V>yfNRaahj}WyoZksSW_`C4g>jy&<2mt zR^22ly1P|Y^rz+-`Fz&fTcSEr)#-?cT74Ed-cp%%UhF;+yAGUK7oE6iOmlf}Eu-7- zxgI4xZl1%~VI}5z%PYU;fq>yn6#@Wgj5J%^f=?_GULAn$I&j&WfoC=X?=Wl5N0m$@%2qWa2$`;xSHU zKXvNVl!E0%PcZTkB7U+z30Qc`79K+^K-dC{2@a4=o(L@4Vh8VCH9uuOvX=hC>HDR7 zbuTRmun}2eRFxUqAg!0~ySwj~>%OjX34OD<>fUyx$>MF)H`DD1gHhpddB!Yh3#A9f z<_c7qo|D$nTi2tFb1iXE=Z$FNlooHqz>c<8>-S-zVq%tJw5ksgiX5(cruS5@zTs(i zCmWG>Keml5V2>A5B?%MNJ}xHgwe7qp>SrRga5Zk}rC^V7&K90Sed>|BT|__KUKOra z0}NCiB?f1sx{B_`i^rV!1v=owb8H~3hwW?%3!OwqR{MrQ4@qC#o`X89yEVm}L~b=F zoM2zijb_}&CeLw(_CEYFs{04X{A`3Qu4egnQTZ8gm_+FPQw3-MZzVth$Qr$yPL5=h z?2mbA@p%Z+tM&2CNIX6CO)`@h%8aEG;#$X3M}qV^hJQ6e9;-BR2`W+H_yfc^{C+k{+VSV1ZE7k1AIE z*}7Z6U{B)wU{WE0g|sa0O0~pl9(6Gd+d@apz~TiuGHy{$#yAJ%#(hlP&ZZYe}6ZV!X5GZ|J%C$r-2?^T>f{FU4vEY#^5EIzR9fc;;g-wE3Pfg zAoB6>aPn>@Ib;oti81kA{NsUv9?;X1r>8xG;gO~V+YmyCy$be7vF7;5ldOHfhU?6% zYdbB-oaeNyhk!{3LC_zu9T37A3U^{OF9Nmz0If{t+vnzu)t-Uo$!3i$h)VzPn@WsZR z`9;;t4x+-Oo*mHxbm`bz2zwA`pzuAHs{3@Wm_fR@KC(i*+!Y?K^rl|Ea!X}Rg_n}v zrt6`2*~K-9HIu$(QAp^C@mkI-2xnrn2aes#T^YKWSxf;DVJ;z*Y-r2kx;S(mz|LX9Pt59pJZYcQ=%Mx8xElmpNJ z3*~yk`yJ8_Dl;JVcCYT}ukhf3L+rvi@hZS2U(V5?X+c8n=_3rA^%9b{RhQIfI;F$@ zJr%$qtKTB$f5FW8_r+8xTg(1aF0x&j{=UHSIo`+ompCI%4w3m&Tmk`F)VebG`ROYk5A-w^ zQSmlw%kJxnsxfFd4(VD6SFt?T0NyatRlw%yR4QVnz$Ot8G|>*RQgPSDVdRkhMxR4m z{dg&CNqW2p!URNC5V@O3q+{vCcge)P9+sSPcS_I?2Y&+(FTaY!evHJMf~Fnrq$8NF z^geOy^(X9R%evXJZno?MX3P3QmMznLEOh&!Orr0yUM+x5h6uH^LeIhTO_e(nTk4aN z`)nNoNgxEe|41GrNvpDGN5iEPFbixA(S#zR{ZPaa5D3Kj{;v7(63P-iG>3togfjrnB}~# zvz-HWYj7&$`yd8SM^*snIj^~=TJ8R^t+G>oiZYF}Nnx?DBq;78o;M=FMd;b}5Wz{A z`G#rvH&jWrd#z=GZB<+jU7%+(^~I8eH=EP7KSyeJi+GPMB3yZ?hO83%^R$%76_4Ca zC+{RP$?p<9Bn0H&FY4o)h+2ix1$|G$GrcN79lN*hBA^+Ffs%1?BGe%1+=FrW6?3?> zo~(*fFKUTMl`aS<0ZiLMGheoOj$K=GQ1k7Qz*+xHV(X&2J$A`qD#xt4t(6^&KIvn85x;yvQEhGJ~(tXjOq-N8ZxWS7e zo;lmaeKXG;XQ{0du@_nY zXPw9Wq00~Qp{uk`g@;)yK<zI@c;F){hC0KFGrN62 zX1Sw`x5JY-{b5VuOzpZ4S0f{-k)gyWXm4Pv9h%$r3YrL{F~v_Nf$3@8U6LKR7G?f1 z=`&kIO_9lQgfq;=4_1Wso3w1e=Wr*B_aN`E{>vhouk&LRC|W5o>Cdgq4bcEKVJSs?8f5c24qCZwz$%ww!z0n{Z(vu zS$Fw`mRf|G>-?;bR7d0f_O(cq%wBX~UoF>xe48%U#(0eBxiL+Il`JfJ zI6*~-6#xOj=Te|Xw-85r2&Dc#dcAoEeHe_kWW~Z_^gPAZV z@D$dYluAB+uHd#L3{6z*Zk}uhOeI;@E}zqqQ&coGLMY#Lk&UA2%&!_{%?;Iks53HF z)uEhgL4?vxUA>3phb#N3AM<9u3j5XpMIjF6Su9eIa}&1DQ9Xn^b2tJv!v$fVKEQ+D z@0N#QWOJ5wAxxx~>jAPn-QPr}(HOy_;tJs86^%0VI;4eah?GLn+ zSIRP?iplp-u?^{-jGq6hTUmErB14Y5JjLJx^rJ{Db~%R|K=~EY8?8+{PgZpxjv{4) zM|=2!>b%sZ%XQxMPJ_i1artoO5@6iF}**-WtuM6PclJfbGmUo*GXw&kt=l)8RrQ zI!t~?y4|OrNVPU;X|JR1)$fiDGVk!UZBr zPyT_{GEIA4rUio2w7q7U_FPN_H?h6S5A90Ip3`C|ahqdK!Okt}ER?ESdZ`F>2O(PwJQVJUu{Jrfie4c;88&& zvg)qo_GxtKX56|Nw{FI*6J4NlA%TU8Fl-IXl^+uxC%N63vlT*)=l2{tUU zfp5yW{{u7E3L}YplZbx@9{3$`j`eV@6#2&W9+c%-=kcN@L3FS#-jJExdtwsK_qKF) z`%Gu|e2m1!W5NSEyd2nJectm*%6vl0y&sqB8+32t$J}(Di~TXb1LnCrgL)E>PBg+# zBF;1kKDEtSvbKYNygco$jhhf{a$5BS(7vVIBQ45t+jp!kUVd#layfbX zb}|wBG%-9ZR#;B}9k=;;A1k-{b>QW`{Hf8^WklAjQ}18!GDp;$&%CNyadfUQ(!3bU2`QcCoN0-9?vR9|4A{mgjCGQXO8t&E{=OS)i9c)c2C7Yywm7$WNx+*rx zkBF;bG_^>sgRl07j3xo=(r8FvZHM~ehNhX?1wwSgvTj&*;=;1?Aq&fJSMm^s09q_; zL>o#w`e(?;G=U9GNdEAW=(QfQea6zB%ipdl{_T`k-8EaLh2crCt(vfpjSXbtV$>5> z|7#KG)gkS*R0F8QYe*nRK1rnS#52}yF`lV(^4~B8-eX=CG(5y*D4N9Q>ICdWhlh9P zLl)k7&Yfg;)t$ybf3R8CwZ=~7W3`zb4{i5pb4gG$ogSB_+#{tFz$$ zFV9HMg7~fP66w)+`ukXN1fcJ+JIPzOH1YyZJt~N=Dj<{mkR=Nc(!dC0*RBaCSJ&xn zsOanyFm!Ur+Sf8EEc)g&N@bvzj;|^oZZaR(jLWzPJL}OAW zPM2W|)O8{tfuvh5+wOK1LNqv+e$wKxDE{vLO0!{zf`qI1hCz9zhEBxA&uqQ$f?x(& z$??;nQF{qWUO~wcl?o{Y@e86=Sv6xe$yUN1?4r%$tKU0G!_^vHHTaBZOWEo?< zXWHSu(#4O@K~;*fEP@WEmKQtRGz(A)yQ1m-aNlPd8M{M&Ne+KEtXv`F_()Yh`wC`_mu6RBaA)T6$lnYBT@q6^=ecwB6PA%VWu?90vD-7RYbJtlZ zD}NVqWx$fpmO-DBdg%c!??ET#_kL~R^ykZ-E8=zN5%YxVl3iQXAR9Kf@5xAkQg97y zGxT*mL4PRq^xu1Eu)gQm$F1HDJXg zKcEt*H_b_-MPabX-^7X&;e%_#GL%YZnD>>jgr)}2e53-7^9wDTKrR?fAbqELV>BMI z%7DY zdnBJf3+!oI7Csqvk?BGNSylBh2!sOF3T3zTpAD z9Cm%-j^?8Qiwjp($1Se9YvT&u;1kz{q(lk&vLZvtyWfaidUPzANsRV@=Kv8&Ga~~V zLj(u-X~I^es&6Ui+6ZGp+hgaWji*t0`4H+<5u}9SN~Wa>8xdsL#LP1`Fsh zzMV?ni>Gf{qluw(Vu;lEbj`28rvj+t8nh^cx`Ncv5JOlF;UZ&U7f`sZ6Gd1Q=ue7J zabZ(OFDXCq%4Ng7#nf9FBhFv~i95Jeo5@0-7mad?x&&g!6f-;C6vIVY^7+VcawK65 zB+{AW?c`8AlduLe@yyt$bv>QRq=tl_9r=7<@OqCIw}Hj2jYq`C?hXSViS9e7@W`{? z`r{egU3HRL->%MTrL8vQ5L;wNBS63+!^QZGo7Y?oauripc^Ka`Fh+Rd55i~D)@SiM z3G2$pEihbQw22IUc15>G4cD|$K&pEkEJ84nrbwlRy;aZbP?Cbl#1pryf#IZ>8Vi~S zQ&!~TflpD6Cct$$Np^kuUJKaBg_b?M7y8UxWnYY{7BRg}B_=8MO(t`9^pGXV!{#je zEH0V&Zf<>g^XB!zR;9{zTryZ< z{2OREJ%A3+g7t+h3+6kv!9xr@mVNcPptisc@E`ZLp4R?j%Z9oO{igreFKgXubYrye z*>&Xlce^~uep&Ty*moql25)~{J|rP~w5<^yYunZ!LAY0Xs0S%4L)0UROp_>kq4xQr z=5d$+$tN;s;Z_R1r2^8!9_^>%Qet%bX8gOpV%Jyf`ih-+)P_%C*dIh|ZeTtKXx6oH zZ%2zVhJ*1uQ2@Xo{rAEwC!L^HIym@g)N+2UL0#(EI)Yj}aO^gq=fo$Y2znJqbHN7s z=4Bh@1RxZ*a|R6*x|g&&U%Gw;c1=%oL^`WWHK$T=pCXzOHuE{#eKx6nq;2P7-<2uY zU|BGoi=c%I!9+-KSTO0uLA+w0Q*6qS9m+L^Hw>*q)8VCuut_urRH-m$ibieLxd1jr zM!ABOG7>O-M&K{aOP2Mk4)T&a-l)P=TJ`!K5PvFJO&U`9Oy129_`u8oGbk!4Mdb&3 zMJ{fXXaX&-zT^IRR7r)d#ka@e!&Sl6`g^u*wpktPT-DMFhfXP|?jiL>FkgcCQd2=> zG%E+q)4E0-H_+9OU#b`R--HZpJt>wCr{ND=lmYRzSA z1BJ3!t?Mp_b}ol-m5&X51_ae$rB-tf)yUnkuZELDv2PRK_sG)+nvqs2=nBD9J zowXd*?XhOB`U~f5@y_+BNAAlRPc~NricknfTE%k57;oG&Km zCxbCQe)S_o%gVAx+OXAg)fNNRdet6r2kj9K?hz9{d>$K&-_Gz_l=enkyB;k#tyc!U zm6s024ia<#v|xs~(2^PA;sw3D)*mB3`k<%7;V2>c*-H;Jf#9cW&IQremJ{sv;etR) zSo;mA=5f=p0Re9YQ)HS+=VeV(oRyh~V{SWz=o2~lH9iXp0-e08hJ*iJna~0B6KW-kTz5HU! z_VSBHdwD;!m*W7(K*h;!Q$u+_G?Wv`Fx}?(mY=5xk<~*C@dq&++FObpxhAda=?0RS z-=A^ws|K(b0}sXhDl0t@nnjy*aZvag4T7d>eeC)IGKp1iRTO#DM9icKjR>Q1mS3TQ zv|SR9#8H-Pe`Y2S!?v)ySp;Z6^im4CC~Fy^(XDG&3!JZRnZH}+@0R&HE!o!}x=!XM zEDuyYXXKShHdXcZF3aDPp=b6~HM|*_L={ism1+}6zB5sbdemLSB^r1U1W{op9$%qk zyE{eQJK>}iWXsso*^e))o6dd@3lCS3youEq`AkJR;#uDluO|dhDroX(gs(~|x6gBq%*NM(92QAp*(|a$80ZE+x;=kn?^nK>0g{4-V z$`+O`W#tkD=3c%6fi0aLPI|4TYjim^xQ{M)lL4BqI`h9l1&E5Ls>;={#zVGzI=Y## zKYX3m0hNEX7$nMyH(ozBYyXw!)saB>HedQM5D!+Lo_3dZsi$!j`H#RAfcTa`xVZ9q z^d(!u`sTBl7^Bie=qLPj;u8p3kfue;LyIl}u6em6lS$$o%MerKOAuIAb688o@G1($ zSLa2MpVL_zH&!DxNi1)Ib`-ez;#%;DDl4c%P#_CB>O-`V;4Rj&;x!?l--?Obh==hh z<%lc(JcX2OW+mzIA}n6yX`KzukGqhH5ZB(TY@v(1#0fT_q=tn^3!w442it%;&Z1AZs-j+O*~fgb&rFK- z#T2)$>^wPK?){gV`AZWorW@-kUgS zb-iF?l!(h#3^68`C*Wivwj{+%X%b+v)_A}`+6qIZ3sr&4agK;qk4yX+>(*w;zV$cS zr+*xB?PG!sQQ1KD@Jn8ycPWB&v$fr9Z8uxndA@Mi8u+2j36eir2NjX#F7AJdD-i_f z$AYt1KggM88A$XrIJ~ZM(0G{Z=P61esB$divTCoS9)fD&rIarMjSrAFCIl!bEfk@7 z3y$AP$$6<_ORr5Bel~}$dVU>1&J}3WE!W2@QPsZSK_t0Fp#fk@C`t6!o$Z|1^P}K* zfkdl!6>@}#ZVnUS#5gyDI<3M@;75^4m5{cE7C7;~A|gPKAuHSxvsVk)6uZL6?OML! zN<~A?=eJE|PDtnNZew;ynRArgeWOV-NK2I#nNiF*_v3VC;2XN7pxvQtygpZU z@;hYXHbF(OVxKG4=N~lc40f%!4OSekj4*VG%)RyRZaRou+g+)|Kvtzl;G>o>HTdlE zjIbr{M%0^YDbn)aKti$_ZVXKNBt&AIAu6YwPNg!Z;s4~)i{HAF9662u-_teLqczr$ zWe?{8U<8FK!Un{&+i(3zB+59+v!w_L*81FrRNlZ! zg-&|g-RzHi{e-L;?AcD!YM#XYLskw=m$PEdM3vigy`-i12N^Mb2F=A!RSvV8DjuHJ-CoFHy!2nM51A;DsackS*N^7KaR>D zGQI;6z4=YFO(+u~HX-c6u$dM|@t!@HTrq*ib6iWpVOwP220 z!%lGbcmozXYmCM3S37{mJ=EpfTQQLHQTZ>3M4+rhhZ^aodnkC-z!6kZ_9U>}H|u+~ z2e@(7Rz$Rf=W8|RmI)I!Tj-VnKZoK@t2p7ch)g-WPft`_%b2FC@uO$32 z=f~+FCKjTvn>Gw1;2z5}+tiwUfVWXI90y4&25Sl5Tot$QGbOoyDJqe2@ z&xb(AU`UKQR9Vo4e+D>lOH!tbXU!DS*%)*UJZ1{X7%@c3d=hOW?aC*ewe(v{a!ScG zfVV!bGNK#wlv~XVMWNEhKxy7ui0C1Zbo$sq&*li$eQ|d-01#+|3)Q{LRG zjN{&p=zX^T`r`*!eS@!)!}^e9($SsxaaR?q-mJTGZ{6~YMDs$gi7j1Q2m_vP;){u8 zRxa^Eq9U@!$HRDH^{gO_8rT%4v0z|7o$$V~(@CsB$hqDB0ZVi(3uCS3_FWLYx<0%l zozAbD$SfG~Z30o#h60Gy-1=Uv$_Q%m^VLD9qojdSdwSj7DMGYDmV#B6h5M{+ph?J^ za`wd;>|6vYv7a|!j}mu=p?|S!v<+!EZX(8`7|>Mfq*@Y@{_$14v)`*K0StGma@Z&3 zXi>IE76WFr)=ju|6K=nY*U(M4wZ}a?8?uC3a0T9s9RRpjo%IE6azCl!(u<-6R;aSbqssv5dGi{X$@ zMsZ;V*)pWetf?x{wXZhXSIBZb%VlI9C#1yzHZrUEE{VJiH*Z`T_!#?j?o*A2T6w@; zv1f-O<*uicpR#&#wq^C?e50gAdkDe*NhB@K%BOs99{r0)EaE^E`F~D) zWep~V#?r~m_twqCXhzJV^@p+Kt;C1cKx*W6^6RlQiuqV^VMCV_cZXBo-w`HjU5k&z zzfRy^`D^}xI~c=0SlsDmzq`=FR{PHw#6f3cD(MxYI{!h<_HbPLXZ7|hyicIP1g|b# zFveuv?{CW@`(0S~13U$fDG);!C@R(Ms$}URS^|JZJeJrW)D=>xL`X#bnsrv76V4~K z1pWTC3f66Y-QBCq7==u&WCxr6615CrqLO)A#IHPRamYeZiyIaSUr&o;qj_I`tHFC$ zYI|`^c_48Ht8iu2MEOU9e_h#dw#88?`}FkR0g@kD&54)Hpbe!wFjjZ@8)Xbhb44z! zdbH(!DqsmOJf=bNFFl#TU3ZVyfw|Jy0ic&jzo^Yjiw5 zC%@sV&8Xh85dWQ}5OvO(LC z4aiHoOs+yYq4VN;L9Ytk%$wj#6A^tD9I**%U7Q?8GK?-0Viz%WG|$sTOobtZe6}NW zYs7{=xx|uqfG9;rT874ye+bxlF(;5;g41?J>k^R%HAC|8oHugBawFyAWC1s6KJD}C zZmvW{xf*1w3mY0iGCbOYw}=%e6zI2pCKNBsHzB?s#YYq8&!TH3g4Bg7qh+EF2YPN@Sve~^+I z=_utn$;6J~7n1Jia^l(0iSjgGj!eF<*{7$vXL6_bQc)h3%UqeBndxgZ0%i{Vv2!IZ z{^%}Rk0#p-APz|ajoBOEicy-gn1~aerA5S}KJqRAph04BMJm2WhBQ&FQlHFHb5a&%8BInIUftZ@X0#f2@IpS_vV7K3 z^!I}^W+>hlBRhKM+Qebw@IE%&gB2;-k^NU;m8sCm`C6rc$u=XSI3nOj7!)?;phPVt zQ3F*us|~sXwAQDy&=3FG#zQTj3&}4TtM{@~(U^0GFLu4q4P!Ql%e`;IbNsx)%xB`! zBnwZ&#zj#T|D5AK01`2P1UHmax?hK`C$*RKFY z3Sj?{pPt!OL=5*_Ps)<#qK7mJMn-6!Fhh4by1C?R=;+kR(6F*iz9~S&xWrRdXC-sNAM#$@ea74v-d$_GdZRMS_+jhM9hODh+|0Kx!WZ$M#F^;W_U&z?Ce zOY8k-`uMH&ulnd^5Wfx3<$?InHwo)FxcoZ0o#bo>@V_&fmlFIE z9Ybt`%rqDj>xxxI_SPsRW0c_ttFny_75Ga#sNO+LqvXeNrjd~6mQZy+pI{Eg|pd~__V`0~udC!)?4`hWUxaQew);#-Tz8;;JTU$A{0%(6jhmg2? z2&$oc(E1-v?rh!>Ej}uKTekVprKtwi9xCDh2JeO`4@Gw9W14Fg=aRc|3c2Wjb;8fAA zGh*8guM>w&lA=jxlD3`5s`0_fzZ76btq5ixV*{y?Ogc6Ep*508mM34J=Lxjrc zSaD_;eJ-o@Lg9u=JJg{>hgS|lr*)y9X&i#ypNNV+DfNOq7t9#))l@*&@w73YJ#qh-YroB3!G0<^JFV8Y3K zlkn(qD0CaO?j^n&6%Lq{Nm*k5ANp1-Q2qpPL0@Z zf}AjnX#dfU=;hSV7|;YUi_ll8u}shyjapxQZ(U3MTXJ|f-Vp=U+jpTIgiL5{31w?{ z)2aWN7|L|Si1dAMwjCpKJ)Qh6KJ>kHBRTr*sQ6bW4M5tO5PQh?CrH;-d>)%ZHY^drbgn!R&wNa zDt!m{rw$pnBi?yF9!sb0Cd8kbapC$ei9#>H6=_u|LnA19n3pe2^Iud_$|9s!kyg?xEQK(0q{Kk%0H2r7J z9POg{^EVKH+>MJb!J-L(!X02-8pB`=bWbU;Q;*#3;z48Q!*O$-lPa8aSHueIcMS|;g9HBlrc9k@5Blt(XX<1|Tx8Po(;2cH z8=|dIp4S3RAg@zKR-1Xei{tJB@)1eYwQ7z5#P`k=UWoaaiI=1CT1{bmI+|N=_dVn| zy&EZ~vz;?}IfJsvNQbxg(q`rnP)@9rpymO{SRcDZW3R6qL|+jeYy!Z$emO(`R6#A| zr;1_d$i+lV+4UcC?pn_IZ(_ej={sj>HySkB^c+giTxS+D*hBR@@r%<^qdNj<3t9uJ z+4}qguGhG$vy!H2wr~jQJ6wn@@^XgQ=Q*IhYq{;Tn+We55aG4lf_?{DJepOcS4VoA z$_A>nd(HLQR|Sf6iAfQTf|Hcc<;+Xkqq0%^*yAA;XLKuObsUrBHZLef_Rc8a7J(^8d_&yNEzbhRTWqf&FHRyG0FPx7N$~}pM#^_) zC`v>A4i`KtC3kX3o=H+pw;3apxXt|;p!gG~(gcdO$_}qe5wYb3TP!(G;sZaoX%Jh1 zoNAWM8ZTJQIm;~x1KVX(J{uyNvEUU}N>D9(h`s1uAA#%v(|0;nm{ri`EX*72O|l`Z zWSSm<7NF|)d=ntku-z^donL{F5sk08Eqf#;#8T1)S2}_NFs4!+lUug&CUPb%fsqcCmviSiG7z z$B>%|cHx>lr`WEh#WI^k#-%yZHKCIZIONK6CUgayDcGZd?2|yqGqgL-K?_Kie6x$& z?BX_05N`8a2as>-z0vyisG3My?y6EF48sK@GB%G(aoA3=>x6on+)b-mxQ&BRDa1=B z$Dr8MTo7st1TA_45|1B{-i>d2uBsj-Ukk0I9t<%7UPprq&xMZ3lF47-OkS!fnVS|q zpWX#7?5+Tv9`3VsvZEQXTHxph57aJ220!}zT91|~6Sr`-8QP3q6FPUyTdRdI0qX%j z9@JuIMmx+;D}0mtk2Eh-Hu#ad!7w!$#|uaJ)>39KNH#NC`1+mj9NR)(0GW5N5M+u?!U^4dpD|GGI zU}Yr-_Q?Dal;GI)p{ksUm(gvJcfo?UFUd=6)Gd0pjV$nSrB0!ayzGq?#}(oi#sjpz zQu|clyj=szE6cNoy3ye@4uK6fWbdq7P#fR87~pP~G|4V^6*gd$JS{>7Yj1nQgpHUm1lBU4jLkMnU6s58f*fw_9W}I2 zyc(JOVpd~pLp53oE114jJ9Ahv)|s1zg9^g>piGkrJRop}Z$fcEvUAGPBB3NeFYXy? z!?jXW?Pl@2S^RDmzw;dKu+hCYX^S>AcC>susVVx)lwwZ@TD!TX_35=~4b?(f%Fgk< zJ3Ln&I>Po~nX&gu5Vp?ymGt8mlYYSzNL7D6(a-wJ3xY!w0;ExJLK!%46tGkz1>-nB zw^9MUQcdxt^AL*)oY4z3e+7xf+=Of*FLn*4%z;4q1x0c}*W>hrN<$*=9Hy z$&R;J156x5noOHrYA8a&Heaq0esie^umiE< z*Nft0Sk#j>L#dJ5V?d_Sqo|^b3JXwWuxE!@a);-iLr3Bs?3@H7o)3o7*2%9Z&ZlIw zR{nptLT^Yd?>&<(;JE95d&)}4Gu#slx0i$B*g7k}Q&#rMa^i4-$> zD{(s^Hp}l4+}P5t9DKi}ZW*~O@7cq>EP=_WZKxT$O;C8d01s7!r;-Mn)=RI_n(5}MO-xk$u;YLj(z?0uo&^4 zC_g7qEz!r^;;Or_8@ZcKWm5RryQ$&fG3*tP)pX^`@c{q+pf8LP z2JjtdE%Ok8W~YJ#Vh3n+=_v?g2_zkwIqa7pMk>7nLT7E>+nzL)U}&dqNCF?yvfrax zvR7Ghx2wj{fHJ5$TVZ{+q(zG8`+z#0UR+{`xi|>&WlaP`*V#~XiLLODw5L;hqDqH* zY6Ag>L{{f2UY-I_KbR%de5&|BB&IB^Rd!3}EI%h1liuMO@-i##)(~Dmn7#Z$Ynj}r zMDD~#M=kNcVQcpgq!SmmBUtw0dG4E@>(W2xIY!F!;X6@+N4n@^vxQfUU5; z_Ohj2ScPiHqf(zl>zfr*>~76*_mI2=9pfx{L=7cIQ4iJ9=hpXrEAkv2L|VC99_W?_ zy5)gRjEBNT&fKItpms_+$`tFaOdavgi#o98&Z~~6{oVeCCN`4N;cM%J`7BT9rKuWD zo?ofg&8M%Uoy49jkN(9lh94bXjtD<5u&{+KcLB1b63;^J*B3Xgq7jL}ewzdmURIrn zUD@!5G470>Hf0GY@(7@e;S>r^`2n}lg7fgA+Rdnj#41Bp9|+uc_bTI<7J687R#u(o zn~dIG@etdXep$$2cv#XMV0L)dX&ZJQtw&L{^7#Ytp|X?TY4EINnn$aFVOD@e$5`lc zf3&)96PH{O2*tvphL2?!$xO&O-mCmTar;{lWN4W-3^26T{C)l5?!tJFg%Pe&11Cc; zy|P5C>W?kw*BaOt^-l%$JE_>seKrG~8CR}b?vJ}NKa0&zdRs+61Sx}VVR(vq1ggII zP0yE6iI0ZGi<0+B?2=pErF|PBxdbA#-20D^F$b4zBpuHrtl{LHWCoH;n&gF1iN+XQ z%QZJ$l47e+ToYHWN3Acfe-?$+4dw0ax0sGHx@Od%K_R=cF3v+})WojzAeIcbJfo)+ zx@)t2YqJxIC(g?(?AWqXY6?B0;-*t6I4^2cA(#>i*$WY*&9Z#pf-R0AhVO!D+FOw4 z-FwBoOA8fuq5>L#{&ZTa{H)4_s?R`)5I^G;2YpypucKMVj&xe_qT@|IT&lDG68|nf zIFwG_%`mV6p-TtP{p-f$rDnNUh7@Y=8Tcfh6xl2(41NPiX2 zB<~D-6IXNHdL9Q8nMlw3K1=f)yBMdCyy&&~-9x=-Lqikm_=Q}lsN?sPaH;SHAEOO5 zI=QXjFYdfp!q*EViwvkGQhLO!CW7Pry5w#bBkq6iVjD3+ z)10+&;dj2QIh!>pViRRaq#k}qR8TUjd6-P$;@64rG2xHqXo2%B(E=Atw7}Vzs(;78 z!53~-`+D`xT3)eT-7Mg3TiyDd@d025&&RQ`ei8ztA@tmCC7FE>O2QMHG0DpT?&S=i z8$k+qrx>~U`M}N3zktuZnsF-|e3__hO`t83d)P6VPm*#p_Ykk`QM z=j%|^sQ%Pf7wraG8v+DjP^y5-2GMNbEOu*(-I`*zrr3G@&DoIE6hT~UbynL}DRPp< z78Fa2GI1(`nsCpPpCA_a!ml8= z_Sk6rcA|%~1GphCz5V+e@hN95SAV=o%*m91^LF};g8SR5lh3(76%9WgauLR91>h<# z#mH=`fG92ON{5WkRn9VcFWVtWh7JcMpAA`wQtL!6GIS20hye1NkZ>d|DNI(zE|4&` zC^7WnKOt2tKFV+{aV@!ss2&69y8OCWcaeA|btgI0BlByV3PX4uXC%mnGEJK*=^n#T z)0iS69H0+*jpJ%rpyqHUCNtgHI3t7%}{Evx@%r@+PPSKPIIAPT3<@mdU-PT|lHlH{sG-S)(FM z0fHVW`3=7#vJt2f0sS|8MD;`RuiULE5rRwFa3+sNzML|xM1&p^hyipWmW%LZPppB$ z_6k5m%j4plo122Y!Gr89y`?7ulx7gBzk4n>ap+k#Ga2;{~_C^lrJ%SfXjD8 zY2QP>qqiOjN`d@0TT_R481(+Azzj|+fE!AB+cV>k{ksD|yX~@@D~Yfkanuw48_$0^ z<_K}0!v-Nx6`&4laFX3M8_#i%?o;@gv`_p#L+DSj9O5Ys>T-14Hq<&Tc%fBVus1-d zx;=_j;Zmwr%=bsERDE7P^o7B#qKF zK)78}2)B+Nq242w5~L9t_ zmNJihhT__JNf${fe#AmV%ukiIL4fdX0w6E-`CCL!TorbnKKy zjWL{k8w>@EI9~!#!Bj~Tu&h7Zb??sv_VhGsYsE!Dv6RMmVC3UvC#`HtrS~<6b6&mz zb{&wx0%YNGR!4d5+q!wQGybUHKHaiB&zUtDAs@A~j<1Yvv)BZ7nE!zeOEEXxYt73` zcdrjD+}YbwxU<(hMm*t8n(21ybe{KgI;B4Cam#W_X;~ipAjLhz%1kbC?;7q$TQzs5 zBvIH@F_My)CG{#ILR$Dm&lz}3rvQ9?x(;OkLwXk0Y(5986mU79xCs}=)_r52|E&s- zi0cnp{2#7LZmJw9_B7wjx(I?Uf}o2a=(MEs`3{gCW6ozcSLXc^e^410XR+Y+X z1wtTX5ycBSn(|6`5Hm=_nxmId^UJ;&JDDAXsjUNrDz)nroRHag1ZdbN&VxdZ;TjJY^Qz@VCl z)@*m8;>88xP3(zu28X=#%OKYoqOwj0$=&ZU8L_(hzZ_3z>}oiD!=M%R0&GLWAU11g?nfqVrrT zeQ0{W&e|#h-!<9a+{X?ZUD+lq~_(dTLUjZ@Nnk?<*m+neUQI{Wr2kZ_Zv)Vp*(p`>8wqAFxaRvcrJfY zE`6-%XatoV==#Q@g4b;<;kE3;Q$GX zN>(>TnYR$3CiG(zYaIDwxsT|PwPtT~Yn6SdMT+zx%C6skB@Y&vr_nD6N@09gysC_i9%Cb3BS~9Z&lnR&- zz^sv0*pNC6Ea+fkN0ukvEM89Leaox*cmt1Yj!)_FX3(YO89=G6O?zTS7HiN@<%1;0 z&_32)a8DP2u-5G38PrRIUk>6f>sw)_#X8#s@$eoos3JltQu$%~t@wTddjB}RU_>p3y_?MLCbPTA?9TJpLr30kZ&7JnLsPr?RZv7y zKhuG{q(Z}o6M?^lp*ZCo$x@5XaT9+WKaXe6-=+vy9#yeoNnTE>0+QQoYL%HeM&)m_ z|IyLDaLBDTTp4Z6LYD|C3le-YkRa6gun=Fl+ZkL%GG$_`L12J%dR^ik?g6hON^on%o-eJj>sBd zB?KQan{T2)eK%&e&W!VT5!29E-w15R!K5Pgq;`sR z^Xee?)9CV~sNL)C6p2Bkq_v^>+Q8`Ny2+myGi#k1Yf1Rod%;YNosH3v5~HkYyYgaZ zRVfQ^b6iO=ty_^3KqWXho$|DsUxKtqJzuF$Z(tIk>TFc>vmPJRFMPnrM-RgK;4MO^ zrDUO07@7D*m?33;p%$V&2WDAtqui{*(M}a+cX^WXThuhei7zl}?6bpSb7fub@P5$* z>?)h_n%uZWkL0g|vF?hm3vc2%Cq95JWYtgH ziuGauJgSi2F$2fYNpY~TV~CDh6tZ1n#G|tBZlxr~4MPaFfue_nXH>tBV9$2%uTbYA z)y~v!0fLGO%b29saycH7-zQeNFIrhkyLOX5-Q-U<`Ex>&KcQn;WvBp(XEnnyHAj!p z{)&Xw%Q;_{`%;axwNHva7IM1^S9->Cp435%ha+{SVG-Xre)(K&5N+#PPWvqwp85kq+1y5yQ@WXDvVq2A2Hf3$%ybvc`1RboQ3V|~ zem!>pZlL4np=^>f@!~g*`E6}1hW47lRQ3_B&&e>iJQu?U z+-%r+JsK$kvx-SH4xum!)v&2nk#4)3#!yRZUz=dTZ;%1%$$k3o}s(H_$Zisf(wH<|z=B*0`k_@Qy!D^D6sqDid6)B`xIarUC8xtCWH+zZ6i zKAWir^#-tBEgW-TsrWEZa0lJ4N(s(Ls=hA;nOb9|8XpZ|yscxXz{Vh3J5QULU{$$q z+(L&V6ZH%ITJ8?CFiYreWdm>yn#Z><$!$>L@M5dPVV_RY&5{=FVdp+pNeke?Vsqq; z3pPGo(?VEuTQn^$$ftaNErPbFH5`U!}$}Rsx6YPGWR4{&ixsLx!xk9Yc0C_4U_aNXMlAafHLs z*A@%%lquBEe3=@Ge>FB7Pk(>NQ3}}N`}}m^`tMqDZ}xwn*NrZK)=QPz-xNQIerIUTYIhL7x?hwo9J?ikP4L_ipaV&M@9CDqLZ7}vU*4Cn_Tqm zlLuZE^&fJcU;Uw)EBpoaK;JJw`|VUwD&8;8%B0iFS9`Swa<1-ALo%QIbjma_hn6M$ zY0y-lK+Tef(yS!(1laHLwDjm3@}GbJsLbtcRedR^l6+L+u=Z@K0X6`b+ygSs9>i4k(GDbyWdyg$vj7ZtfRX3@+Cpm zp)L@+pQ{sbn@}>`R z2nNnDvVO1Xn}TsLC`)F`4g0$WZl|*9PK-sKK-A>!ce_EZ`88WR68d5#1*HnLEuRq ziE@xW}@}fx{H97(J|r|GX}q+HzlSxGP&aqI3U4Iw-Df zNp;m{P+eU()f>xmMFxemTRJ&qah)N=Obd0MU9vBg> z%!d-Csc+QL0H$Q|vme*NyRB^Xa7d5*Eb?L|N6gx^($x|X-$IT(A0yEiGV|?d#1B|* zxX_sIWVukU&F`R5p|{M556!zk1R4_@PG_Cx56G3?U_B!^#`zS7=={yPJNH%t5ro

-ZA>al5*7_wAp14Ff5OQ{fJG@DQrL>>g1nU zk-<;C7>!zkiD4+{ewVO5Nu}?_)9}jH7bD5cXipSF($!fkXfTxufA`t|eD~Vea3*;- zl^n@f1F4ZrT6jG2n}n}Y#!I<95$-|hf|8c#!{cuugXTH$97}6%GP&0f2NwY-RiB<} z@Y^Yr#NBsXSL*g(1Oi0wXOyk@Y1hEBAag^df{4!|v0DIUWtSjXULMcZI3cudD1IeX z5DH?Q^;WrGei}2?ocsPE=dR`CF;<-Q<^G{swGHZLFSAHk;bjyc-|#vs89ADCYd23% zHAE?Llw=bw4E(DSrTQ#X{ylIR;k`>s;)t&==fvCIe}pJ@jJKkG`4GkcMz!p#_#cvb zi?QAzJTQlOo`?yyc>=(TW`}@$+cu2P3cRjjx2imr?d)@;Tq54S@(6o22rVqHEx!DS zH0H$sYp8Z{#pj#AYs7Qpr6VMv`SJ^XOqu>Q(jL;$(X6}1WG(=?ns|eTXXl(v@yAZt zc~QmUps<(<)(2!HS;az@{7P1F)ikK3>%?FZeoapn#fUgpY#1yGJb76~BQkaHG z*dsOxrewBR;)X)NFwBNk^`KpklBK$U8j656^2#$^aNwBvpheIx?9sn7k;ZIE3^6pc z<8wXRL3dPGtXOL0ENwot57l#<@~_^7cw<_a!F_P4D16?={6<#e=WZ|~hWZ7iK2(|y z@Qh8hYL0rWf~w_aGDVRuzNtCO>)eaYO1=Cdk;^x)4)$PPj<#K*$98_)g>}w6$78Wn+xma!n(Pz z6Os!Hn~vnc&p64PZIkTW1mzYEeZFa^H~P5bvy&t|+-W1X!Y=P{`%E!h$t}OviuR?B z?ZX%<8YPrRWp{$AmP3U}Ho-{M(^sJ8!s6jgB_>s@$M>b?s`~x1`?iF)jSb$odA&!g z@xg)sW)pi0vu5}RWZo8h9u0i?g)V-hs%adk@jY01&*mqs&*!>J= z4q~KepGy9q%GtYy4o7KJUWcQ^h*bBv0bL(y{ABKdQ8`OBnY}WSNU9MU8n6`rPXy-T z6^pBa2GdNwC|t5eD|;Zh1`74hu(ZI$1_k-ykp%=$45r*rqUVfYW({| zTD8Qg1ZgOemIK2{F;AZ+hKEz3NL%i0zpc-0K!?EIR+UTZ5<`kqULJ1Moof{uOHWNU z$In%r{7yq50Cj$lqEW+4b3MO=UX!FCoklQgEnvM%$g%n8^{Hug$KWAY5x2WFv~O#; z5bCV~doC6#d)pO^-6bi_s&wed*VjD!sU1inQE3w4R&yI9NrBMm?%~*70SznQVz^eo zJ0w!k|0A7lO1S%M_c8?3YguQr2ABldlspZX3`ygI<#IiFrR~!o^gXT;O4*`Q@Ynlh4{rK4>f{%8&ZYe^N|chQ7_^~c1%Q7_ioN);_`W6^Dn zpDJ4CiKcc*)s#&Sq%c*aHXHz`QWaM$Y+L>o2<6n^1(CMA0h{1KrJ%nODEo`f24a=u zf1{8)^e7aoQk16PA!3kbxg+9qm8C?wwMnJlQ z&^0(%ib)Wf<_%ohYk+ZaR?a&I6;l|cs>_&B+m|<~Tc7UMr@Qs(&U33mCk?G1DHs^| z@QnzuBXU+VW+3;Szpv=5-_duMRFCp;#Kl*$61S$qMY&Fgu*!7`Gu%h(mXnu7#`zGt zNgbZ<4V^%AaKVexG-YIvFuah!gWG4n)Fm{llgj&72xXMzGB_&xU)Y2ObEbzp7OZY% zPTZs!R+q8($asPD$@?omhI?hT4nSH`PWE4Hq?~LIo!7BaPC{&9*I4ra=Q?XLPGVQ{ z(KAkZPTG-?JKX#xA!8)OerRcE>vC$)N{(7zB}OyWt<=!i9k8uiR@|hnJ6y^+kcsbz z*)KmH0T*87`Tvn!6fZHH`r5ji5^oYu-ocjuMn|H?yqiwlPK*KyHa^^n%kk)v>%zCU zGGgT8qob*zWL%8u5f5qq5z}Md`zD!5Sa;*%OWpvo-P}riml#fo-?Wnl^Bqk;aBPm4 z2lK`!16KdJb7!oWb>rss53NgD#p!xFl}QbWFbjBAZzSTwv72J_be70Y8MGs2%fvyu z(Az5p4YnX$s|gyR42)2~5K_jxLx!vW=!fgvh4W{{aP3>yv^bgj@&C#sMiASdNm(C{ zX2hnL9R0@nW8(W!G{?-L#=TPp{_N2Y{KboX=fuE&{+;+yGI8%iZ6V7+q7nTlow_H! z7yBqaDt5>YT;%84GI;03;3?xA5TlX2l}OXL;IIXA#fEf<&bMWVE{GxG<5Z2*rSuS- zxSGSqSvi^tsg zYQ0oEXhd@u5@qh{y7Zw%_c+=>qW7KV{5_H&ZaL>nBf~NN!Ih9)(Vr_lIv+cRt#Di| zczBpz!1jTB;0TEi4_k0{q{a>tM;#9613AH^-MyD(O#jW-_G%Bf5{nrVRN2FvPqF4M z&x#0^n>r!!LT$Jd&T>I`Z)X}4G~8|tk{T=Ze8s6v%W4hvfX|poBc5v_qn5;@H1og& z`QtQGib1UnC}r9}%6t5VPV6_p#skYYB4#^vPxxJ#p0=4e-O=bok<1e?xeHTF&j$@q zSSoK2uG5odn78t-xLK3(D*6RFe2xGiu%a@1q-WW-=>g;3hE8%6TbfXO%OK1I+!G|I zLk~eDcD9q3y=V9#x&ZtNC2J%qXrbUdDFMI9QVsAAs@vaPEN~{u)6J%aq5vr-qgz8^ zHV^`}QE-1-b@Dm)r((xXc;kx`?xlURZmck5K+R$^2=9#uKd{{Gs#{jdLmDhiW9Pze zt2Q73_I{2@uXcobyziT+X5Mu>fp8usKny1}UaAIa{Q%h%mhg zDH-e&+~D_Of|^dBG2m{$|4K7@irU&VYmtFJf81k<9Zq=F{~H`@5kgDHTZwweNAeB3 z>?rU(=_&X;6rks;*foHR@Zi5A+%)(av<#)3B`^E!MW9I&#sJzBUb7FvJeHi7fT38l zL9TLZDvG{sWkV+opQ<5-lRT8wEQn#8h+tk(19aAQ^IV`|n6Oo*e zHee;aX4cAoftJh5U4zZmcdVa`iS<~HoF{F}uqlEscWxTCTrmef6?K#|WKd6g|6n~L zdbs)oDb*nj63-|6@uWoFQiJ=XQ7@h5)}8uar|EYmW5Vili<-H5Z9Za0o7fZ)M+prV z2TW{UZ9GYDeD()iqcl^@fXk~&@nymGSsq7m(5BBARfJo=L9iYe9>5@(ZmyknNep;^LINy_#v0!E%vGkqo2$W5Folml zzS)ofGm2xDMCYla|72N!y$ba3ZO%xxs0Cn>OH09@v@!@MPn(YbQ94lP^qaE5zD)ngN!NRd$Kr6S|FvedwXhZW-D0z`t~i z3&*LY&y$j;l<-^=m+JVb{dDkJyQcBec>318c-reO;@Lvimx-cFh%Cx4sZa`|s|i%o zMxQk+XQ!O?%9(ofX(WIf=%GbX^=$+qQ^YI1%;vjcXRm6Vz#M_!Ael0y0_s;wj!2h zFJY+2P^z`*1~oz;+0K{b3=;7>$C&hlG4+HowZ`40SttKWTx->N1S{3%JT9>hlRicX z5=mIRKLI{J%vjs30f73zIzzT_JCRmxG-wL1ZFizVz2>t}RwPUf#P?!#KHAlYpHLJf zP{ugGmk!D*xX&OXZ@G&oW(9wHwqr&9oJtShvi_XBg{`qYI;@tNeGsn+bXO-LUpqK> z^|V+te=qCF605~DwR4}K^n4IS8M1X6N9tmM$-r=f2~em*KlnsI6$tFq{zB%JTbL+8 z6`^!OOnPEuC^4#)xb~~CVks0puXP@jS{FePbxO`C7e2MbASjh(PrxD*<0Q@q5lczc zzB$`{Hrc)aQDNrjuAV9?LV&zZj=;_hZrK2LwFYza&(geMbV9UmZt`X4Zxt1kE!@|t z`H~K;2&dcL8&If03B|@I>b%kYm%-0J!xOfx9T$;*`7`FS*oEAyP`q7a$5GP7%~zfI z-yj;Mp%t@1El$ARB_lF&_lQ$4ie=(*PApv!y+wwGNeTkR>Ya z)Fn)!UI!0$c>F4iXr<~dOZ=wsnmUXf@1SH*s=)rWmfKg{uXEX#P z{jvd+ z_qHp{Y%McQTV_`!tReLsZEqzQgE(fPeb3(P_{qz!;95K$YQS zq^3p4y(zbg9<0+xncDFod)clbzQYime`FUCH2x1~7SWk&Hs^)>(7Iti?sBP!OFt=@P2|k1|-gXX!=9OwDmleeMFCK{x zc|3El5U4#|#}9dNwO+_IK|QN7HD=k}@=_Zy+}Jb?^MQY9(xUEz@9I9ZILX&+U#t7t zvirJ-!EveVto(wIeQ@kIBwMZCv?bGFPb+XsLPR(}Phk&#vyl;ZY14Qdj)DeA^Yb9G zbf`NVihPC(t!vYgUqp<~@-(+1!8yK7NT8rtM@>@6t}hg|vR}PuV`iqr@}PJ~X$--% z3}u82Dw~Z7$-|9#5X05kBj(loCX=~4`r+x*_wL<0mAV%ny?ZK^{`$0kqc|`JDZzJ6 z!pTiObc`Ur1k@}sQhObyysurG%k_``c=?k)-0dIkI4=ptnqLQTj`Qc8$`4k3>Jbs=p!n450?Kv}Q@~~w+ICCA8Mt2nCro^tuFLh7y~>;xQuwwm=jpSnA8oL9!he^_IwlpsS5rh!F1*|51?Q58%P zU3x_rOz=>;nSL&VYB6b$e9&78ohMtUB#y}`J(5Ln)tb4C! z!1IPqmc@dz*0$jF`rysa(D@f$pk3zs!Hm{RRpdaU2QZ^n@w5A{qcMJne2lJvX+7zl>wMs7&lgmp9ZZDOQ-Yyn#7 z2M>BoAd`{@@B(ZU>XTU`smW|{Hg!TGvjb^Y;(?%}$Ab!kr!Xx&UVsD=AQ%*F9p;Rx za82OoA(4r~zZLonUIeGt0oiKfdFR3$u&7;@w~ zDXLP0gf2BQF+i`%GmtmVuVQA6fg8o(oWrSBS7d4ykevN@RcP0EA8|zrYxFAZNBjJOD_laqX)9@wFWCY)+jJD1U<= zYUF0y>xW{et%!U=;(;sJ#IZTzgPteOC2!mSBw#se$<{AbVCK}cOu>jRJey%V6@v*; zBwP{?3wnOsRw8$a2fv41>-EyLtLOvx0QQ`ZGh9{+cNXQO(UV4muLcHzX9|{h ziPI8kyn|>es1CceSIZLjQO$CT>zd0cJEF1t#O;|U1758)^xIp9T9<*VEqIN=CRiM= z&y%LKn46|_$|5c!EIvQci5g@Ys25%m#IdJ7eFv~r5CD0W8V{we1)el;wRG)Pu;>P$jv z0{0^^pxdihCPI*5+xEmO9}|}4w@s(~K&%!jNo+dLH!UCMomW?nak|FL(-bu_Y^*bs zfD6K1!^+2%o56J$uL%wI!s0B>@me;DZPA5kg<2BdiK?w(ViSw@I53L6r*wi4F9BJu zHfI(IbXU}Kirm9R0WM`7!6LK-n4ULd#S0I`=iYw=$QW*a|IZco;S6^1mH36Qyv2XV zPi0jOOz&;bE>lz`tu1QzR$jG+)Py=|o5t#J=nJU#;$R-?4(+O2anh4#gV(p}rWJF# zw^egr&S+$CR8T`EN=7Ib30=lo%z@1%xW6N-v79L_`tfM>=uBVb?VSakO?FcxPiUB2 zub82A(x8_XwVD8rErJLmn}*^9R2(!qa|V{q6|=($@DF%ti-VSxWh|1zY1?5kc;gd1 zOej@OZBQnGsvPmRXax&XJn0W>K6gS)`owx;x{do`mQ91fGeBIDX&;3<^txoUOQ7dX z52g6&+~rwnmV}ReapS5%QOB2ZUS{jXxswrdaV3H*|9J8vmxJq++>t7Mag!a&Tg6g; zo(huS0b)uupfG7LcJR{e!CcANbLY>W%yOi^u+*kWB>vOiDaA*xc;#~YLYvAKX=?=) zR=HtXvsaamL5F8zRoZ4y?T-k(?NU?)J^}S(57zBN=!>7?VM|~2{ZcPAk$~6<+Mn9& z?M8zA7Tciv>9LgarW)Zj7Dx_uBY`Df|CNGl$-J7mc^M^nybs_6$xD$LA~u=Fn|oDT zt9y!%lcbch*73aXpIy2Mh<|AmlQZt*18nQgg9|CnleQgNH@`r9*WE-S9m}L*@TbN% zLdZGO6&26QPl$fY<2jr{?SSRH{n?8rwZU3%*zypH?F(5wl_(^O(9O=$kHYwgo1j0}GCIb~%1a$Et04VznU zWaK+9ew=e^1w<3w`D!@PBjz4VMi?F_K{4hN)EdeL@nn=G9HM?Q#3&wQ$c4g0@6MAg zUp!xwyv+b`Mivv#HG#$lsU>_eiZ0FU0(0MOGl~IhnIHwiXMQc9bwMt|$fL&1Z)rlOA90IVdCS0J%H^>R>PE z@Ch6I(^Wj<%S&PjwQXkpbTx@Hvrs^I|E8scz|mEhn}Y2J9tC#z%^JG5l4V8=eN<tD3hF%5s{;7_1 zBctL`?aItJClIONhw^2d48vL=ICNrxmr#cgH6~TH4kM3OCHHSrd}j!PC}BmNW+!7i zZkYpWUrMrd=1FtAIeVz`mNLS?xOm|{9@K$ZMVU2}tpBa^Vc2-;{alLNF{K^FAmAE2 z-=t2HRnQ<hWIn z80y`#Krsqd%Qr5b0Hb7`<)al4`FlAs$g&`TUSqzbsRWBdps*2T|ISqV@X1aDBC*J; zi> z?T-rLkQZBHH1MMkeCa=KJqoPRiubJ)oNPf)B3mq?!I#+EhTcnb9XG2W)PN-IXtd

|*iY0ga3blzrbyHwZ?CDBlXtl zGN=yfni&}Ck((FbwpmZVjDCepWAcN>J2)iY%KcSih8BR}05y2!QEHuR?k9xyvl*$r zXWKv@5tnuT#|#L@1AZ|w?a#e&L2E|599Pl-((a5|LK%@AOlO$O>m$3!&fIrsZoePu z=)X0&8mCYiMJwvec}`r~>km)lLpjsuJY4-Az!D8fVp_GWB?m(@ofXl8VKu(Ps{wp5 zpe9Dy_f`XH%-|mVYV-_ep+gC7u{3Pq*QXv())Moh1fp1Pd7xR;mz&bxVfe(WlIGTVp~up)$*#gz&%$8NXTQvXmxgTp?}SVuMH;613%{+K`9bj@et z0l15nBIF0DYbhxiWxuZr>2HJKx7(w*ZGCt>ycYQsMY$}R(`-^Bq1I5mn;%fp>2wNW zU(Zvn@GR)pq#C%I`tJwSq_Nkdh(e0i07|M}a%0q#VQ5;TAk~8FBTH}?`q$mqO86Qo zCuB=-tJ-Uo#~J#C<{rl;hKLQX{J=5g#YLQxoL)+5wM4{fP`b;%ya;q%ky85{;l55N z$#H<+{BjQ;{OV>-yVhMJgY|s8aUa*H$Xy~a?z$nfWVZ06u%#5ca9N((1J~PJm$%8% zaN(EJs*U>GCz-?NZ3>J`QK^=Nz{?aa&LYXb@k(MEiQqa90BiVe3;DV?~*MT|1Y(0P2I zZ%+#bz=(up)1TOmH6ZyIH3z`El5ww3dCc3bEuY1@r|E)H#4dQyp@xWiDNS3 zpywxpd4tv`ktM9RFY0(MAn^^%5*jW)^!$B3K@61mToF#89Q14R+qnTAi=Ys{rZ{r+Ho_vn&IF?dS6MDn24D46> zFU(fi3|_&25n;A3esY_t4Qa}7gQeQ-AZKcoL3quae$4#xt9`%o_^Um5-K&;{TwPl! zRbA+kXt6T1;2)gZdNimx1b?BpaTkyC&ofdbQosW& zp4Fg2a(g3s8@^QLdlTb3v4u%sv0t$%dY6Vy1a3RDkCIA?hEvOjjQIA93F|hIUzj}z zVB~Jm`}yc1R}(9S&4bQ=&`Ma7;+g^YkzW|~`+0Sudac#A&EGCe?#)$ws1~5K3=7t+ zH(Ev78j{Q(43^%e0V|z5~3te_)mViXW3W~ONFum z>uVdJ{XIEHEIHRYe(c#*KlG8KM<2^XQZWSmi5{Vs+;N@!fW4l7_tR>f+-#8Q%ev7t z?Y?lfqU@N2OelyAJCge>{?%OtoK4;J09w6>P3NmmoOgW4@GQQoMVQ8TWU26U9>IW3KG~sWVZvcu|MS6AazMVhaw|<;?0MTIj9d5oHK2IbF zLR99^&nOG5{im(oXIFXKpzFMDXiF}w0vT*Nk@O&Ux&z$b!gDB=l*oopWv`d_UbM;W z?fr|D+NU2@mmZq+`a$AWViMaiT!XD;$2LZ0aS>bzjW>k#`qTmF@v1iR% zd%)6t7B(F~cwEnvrJvJfW#uC_2N(nxz?2Z?T6dhYUP8lTPpxmdI%RF`N&OgKd1epf z(t$|`bht|K*BSYhlhYVNE@f@Gqt@d`&N7R1w~AjMX8C0Xp;?~Zz2JeieQEG(%#Vk4 z@2zBnyHiVpeSZUf)i2Ks3VsVov*1o?383@{qmVDK6b)Smgv1j14p3ACsIRB$L^ z&>~N(^=K;O_I9gV)h*Ge?r+to#p1PC&M4{`3_bbOFuY*&mdvnn0H24DsQcIR<21P= zJ{d6sB+7XrT7 zBcx+zG+4Z6&>GP*FH$Vu9ME~q;JNL4tRm{Bx9wmSWM!84sq39w`h31Vz|lZ~p9WxG zcOm|8i!=RMu0zE7cy!!kP*zL{>PFq3OB zhUJuXp&ajX0hGTf6e_rd=MFC1h69MuoeCqDU%KtjrH#u99lLW8t@X*Vqk1ZO_6n4P zd!#$5nUx*?bt~CUM=h%eOsV^)tVvD($b@QPtzx$^{msA-Xl91 zq~x*H|GHwd>N{AYsei3d$i}42KY;BcHH}j)=h3Lxj#h1xN*6P&T^iZ26LJEDTkR6_ zd7fN)u)!Ul*_?Hjeaz;Hem>}U6q6C^4kB%As^9yFln|Ta%sFI8;2z}X7bJZL zABpX`p0Xx%(E}iC9gzIis7`_HqcNq4PjpJdDNFQ_m?M|nx$b0mLw-&NN>E4;vSi>5|#>H%h zDGh68Ys`2|O05&IK0w|G9 z1yCSr8~yp(0^9sG!~crEll$A#^`$gPVg?!E56*$4TTgq;2s zH?Pyn7eh+IK;@y+%CLuvx!vXdCM0Bv%!DZ37r~OqCF$Zi+3zfJndYo~dXm z{o?daypfDv(A70NFSd|N5?9l~`xq_Tql`Xj@~4mM#V<3ZD}I2E^V4LS-pvgb&6kRX zv$W2@SBENk+GVx3XzA@H`Chf4%k~gw9T?7`rhutw8fZon%Wq;(y)l{nCfd{i= zFrZ9(tp*N#;u@zY9&OI%Gra=Y#K?&GiJ5xwMZcvpESZca?!<{KsNE1TP)8x7X+}d_+ zw-SkEHN?DtTtuQOC^m`gIy97&O+sWZ)$q%$KzC_-&qin+fg4i)V z=$Yk%lP+@oa;@rvHm>xJCH(OVgeFsY#x}SDpW+VNhznCX+xwSe0>M0 zA0_$u6S8#iBE8VB<3H$sS5FW9kv0ezybMIm%u7^V72ZlstRt4Tx4&D*f+1ymfu5bY z$TD3Enr?4%nDit3B?rrt7#+uTH9qHa7fTVtH#v8LfNBhRTB2gvK<_rHtf_O8MWfTG zh18NV|J4D)U!KlMg?#U_nw2sHT0rBPiw-jSb}yzU6P}i;mrP1K>HK&PqQx`Vkd+1cs!a(>LJwusD( z{?_}2OH$@16c65IQPxkW{J5&9wZx$ruOqH4g~_@`jZmi4z7E>^pZm_~2}!O;zg$*- zy4P?Z-f??A#fk}xl=fG=@GbCiD@G#33cyr@ppF z;>xi@!ke`VJh#y!Qbp-;DqEG-9z*_yzp7V^FY*ODa96=$Ki)B@99Zl12;3kXK|etP zzPd?pt6}Rf_FxR}Zi2g@wix&b%xbxPL$4;I4uwu2o!?r!T+c34;;)p+ zXj-O67V&u@!dE3MHsC53tyf$AFzAkCr%YAz^^=M>7Y!_!a`0;(3 zdYYWU%kM)$5G@^o&5BP#SBIS7yhn*>xjn=eTf#b$;W0b+vPNzEkr9+OE_j@mV&8(P z5#>x$8jh|h8BYIc9#dR*cY%-5bnfBbRzkyuZ12{uXsFs3-DG47UI98xU4kZPHhWqSsF zbSH`nSw;inWX$`i58wQ#ET~hH8qUaV9nvh@azoVrQ$|CtPY|Ji0QF1o3Z)KDhHI@p z1-)usE1JX^G+ylvBEJF2oj9==TJjcjjfs?hLTSVh zT&fdGQiQ%`YB*w*M$Krpz3tFOM7iN8vBU+r(}F{uh;LZ9ysWbJMV<%7%6AE?o0gUE z)CFQs(xvo;RcpmRNNcO8Ac8>&3x{$kiqk>mf{dH7)3}OK@c}f5u7f*eRn+%|YG0u! zD=E!-K)|`6;bMEo48eJ?_3gU~7Iqqj%r_9-E?P{yRGyCR=UF0$1qF~T0m(@fDyV!U zGvCA~u6OrVa`-bkYo0*F1+kZT&yVD|_2k|Umns?9k$zl?H4JEl6SGJth#%{Pf0s_B z*WN6j(>Q7-DZQh7_7I4~T^$9Pk!Z)GzfOqZ`!klLR;^CBwE3iOl~xEnt!_mnYRw44 z&+QQhHG)=SX}+-73y@CybGY13g`V_G7nYrzei$dzdrQxBf@pRC9KqC}UgC?rqRm>f z2oFnoE!`JkB=6(f!p=Hd-w(d05jl;Ketn%lKaC;HdI7UW%y!IWn~wMBj*2&o#sKh6 z+sVBco-qDAdj!-HsTadL)U}6;)K5nt+`19c;t|e!==KUfprk9%B|u~P zmnCI7YuBSZQqyi=+q92(f4=fPZPIh|#w6;ZD}nP}i(XS_Qbuuj3_LM5J-DN-EJ{_J z<`FwL!vyX?1neCdgZP4rQ6hQ}$2M4>>BVK>@bm#7gA{s<70i}`UQkO!PUh6zj>cUAGiJ}F2obyNdHCmN^UPJ?U0?{5Kwm90d>2Das?FtCGFH{-@V(bly&s~5 z(#i%p8^IHPehS!J-H~`1X2#U>^YcePGpU5y*Lk#rYyBY>+f|XD7~d{L14H{8``UHc zp_%2|f{hW!mFbOgP!sLB_o7uWwwt}*^A{GP`5c$%=i)$yNYY@guAq4%Cr|QOJ|;g# zvoi9A(3!{+v*c&A?fij}Zi-J#FpfrL$Y34kL9m=0WnhW}3s>l;EWMb&I{sTDqUieQ z(XeN*rvq5;(!t-<6pj=nA`~1ztm;Rko4FoO|LAU(?2_D-&#Kz;Tf6>P_R;S)H74!G zrb-QEfZDxw14H8xxP003fSyA-7+{hUD;PL;ZF|Kfm8HfBP)Z;XpR^1NAu2gf2(%c0 z-j-#x(Tkk{3;g4z4p2oKb6pJBnL+Ca2#&;%H_d3LBbw($kMMlQ-nyzW*dVmslW`MQquDE) zAc@nN9?ak#`z6xlRp5oSCpQ{Q9y@f>sA;35ah)D*cM|5TBmFC7VtL0HK9H&DinUPT zlU)2eF~93FnN)tBfQ8A~Fx##<_IR|yC}4+a3AjYsz4_2QW%drEKgLhm9Yj5bAGJ|H z3Cgq98iToq-0;TZ(~(#1W7qSFHkcz;y6DkWAoVPc3ngXO)a(mkZ2i~Ju*ZlZh&l;W zIRa7_ld>y5kI?EJ@`Nu!n8U*90JL0;bk81U2|p}1lDuxu%RN*2I#x=I07Ac>SPZ4% zs-U=h30sCA+A9ubbgvS0ZcZgubQ|A~6}FiLz*WYyLHI%{5KJj%>q=WkmF#<#flIKR z@Y&=mit3eeD5|3qL-Ny=xu?96-%jaG0~BMZSgy0Y4%K-!-7T5_6xb~mp95dP_m~=& z!R4q>%@}@cq$$9KTt1__6TNl$Ge3Ee7nDZss?r1bz@ijxzLr3#X1QwR`Wd=d>A)bZ$I zh6NC@Y2jjWw}))GgsU3z_PwI zipYNV94)<_tgC7IcAMg!Z4tTgN(6_L@GAEq6(1Q=hiO?X4!I{O9uYG<1+;|2eAtEbWDX8oJ|KEp;MM$5M58Q|A11$UWSG&x`#@>+5 z)JV_J$o@atLroyI@38zUEc6*(@W81$*7edYA92gOJNHo_{BNMQnDk{;5mA0jG_{+}> zI_w6zkeQ6=Ry^?8=6IY58FaG+`T;&>Tul;PExDUvB(`}3b-X0U!Y#nec;=q7 zr+-xmPrdSdc~w7CpAaC;BJzv~Q`f&E#HGy4+&+}I{NA?%&r(K3ECe0myOI=tfw-Q z*AB$a%~T6+0G32u<37pgqg!O0&JkY~LRa&n0>?P0NU)T5%y!EZ9g?+*jKE7ktih*; z3XJ-yFazTCcIFUOG7AnCi`fTC$z|;&%jari-ZjUu_+w+fyC)&qjZYHlXG|rX^Au@1 z=aFRR^JJz^YySf9c2kahdP;>)g{cpQ3fPR=UR94!h?RZ$BEWzx9}}z%dXF?#O1nx7 zCBy>e08fSiDcA1%JsK}Z-*d^~vVCWKUM}~K)cyP~_}{razPHo7zHBOjYw7fxkI|as-4@LowbDP$7~<0Q3Z3Ca}0c}9STosc)a3@ZhS&9ig2{=6nwqc zvJpE;ZxBn20-i3~?Gz$fqvgegv-Yt#a$R2U-*`Kyqqcg*s{7zr7Sl47bWK$lz3+|{ zS8W%a-r&qQe%eYdCD$q?+EB(3UwZ0j!&1M}rBaLAPYXmsqh5pQDrvej+^cDtC&~OI z2OYJOZlMgyV#8|Pv{mdRP{^a|f9#unSeO4}0Gf#4SqSgs?1WQw+VXR*JNDLk>d$Ls z{BOvLCBRrUX8K8s@_lMB>=Lso(cEpjHV1p2YY#$0Y;`!tXbvViOtPjdd=ZX+w(}!S z4SSCRBDnH4`En+YTfvizvRDXJr^Y}NVbL6BybP(opJ$<%$;r~OOIl1;w~kXH!W6WW!J zv-Cg0e^q&!r*mYKy)NU*eI=>4}g z&TF6YrZ`X=Clsg%@_zst(_gVQAfQEO05vf$sqS%OFVP%^OUMoB&>JRxE^P4nF0uD$ zc*e>I-aO!#WtrSdU z#EA3ar_*JYPhN-K=uUbgPHk>`#~hiArRY}!K1n|jMzK<20B{jHe1g-y7ubPDcEyDB zQg&oB_xn|fXUYl$F!zFI_F2A6%}AmkFJK)PijxG@J@F1l)OWy-bP2U}3LQV|YoS0Z_4+&)*33xhZ z8MzJgLT_EE1>tyr1fz2f)^cApax;g@s;{(zv$_m6--lu{*~9bRD`$JU?Voi#BN6= z&nf5ap1NmEIZ~ADa5f=WF_(uv&>g_5&v^UW7xbof2Z=g-sI9uNoThQ3_(a#7Ws2?D z{J7L)Ubd18yrjpaWSQ?s1@_LhDTOv+qNu$H%99 zVurvw-tEgJP2>WpF@Lr8L|t+Q>L-77JK$|E2-43W=B=jzd01|(4Wrr39nh~*!J_gq&wM|RID9_bm%S$Y$xC_whTu=5p^r*jaVD124(PGH1 zxx>*b@q&KqlqvXp5snynhZa?O;vDVljm4MIzp@TFGz@Sys>lN9+2Y5XCnSAyPZb;M zXG5zD>};PeLQO36P?p{3f*uXE?P$}ix}WA_(Z~>BxZ6bRb`-gjWUCy2*@`IgHF2!8`(74#=;mtcRm{&-d%F+>s=+qV znocwe%RAwL$8&(Hn^}9*n1eWDT?+9=&yRHOa_VzMolf3CnaG5!bz}RH+?o-Rxms~^ z6zp`4xi#cn-a?fvHr%+$vrY5Nm)M79CAkCgDT&cZ)`q=Zu)`q~NO8`tr?uN-dDK9P zI}c4%wgB@i9^nUa+*GYKbwajJ@CZ+4#!jCu`g5JY@lZt1J8>jbO;@N8pR~U^{cCPs zZmf&q0u<#@dv(Ub@RWGN(F$KXycvP7qj=3PmsT(&q8HF*>^;=hqPl68WQ|4&P73dMU-QV&!9V(83=G z7MnFvM5EGlGOmhvXw7eLHgVwRY#q7GUt|Axl-ix>Jn7tB=m3-Q|7N+#_er?_V!6LU z;zsuWVmYBIvgSj(Euy5w3rZyCFx4Hq-QSPhV46(2>e5(w&NB#pjoS4dQclj=ZrBS2qZcRvx6Lg4VXgUQrS zN84L2F#?jD@e_>L&uK#tXzonFPi0p&^Jpm*+-XN-Xk{nyI=uoPb~b#`bVrE@y@G0~ z@ZdPkKg6vtmCOnBsT4$^0XlVk{;4q?c%W)%LtAb=8(66y?LEk}e30Z|WmE!ze>MUk z&?${XQdz$w<#fc^S@E^5rp)d|cx^DF|Bm^@NNC9O=qV`U9t!@73`b%$d4C@mk;{xZ zjy=4?M247WdWh>ZecSw2#a%&{YY9Y{rT>uJQGfSk4H3z%`HWa^wgsysz)-L4Drb5f zz;>+8|E;?KJXLA2ZksK#*jRTpYdXHq11~DrVI?WPZ><}W=X7~X-x?%&BP5lD^Gto+ zwZJ8&@Z2T;p|$XO$aJj{8h0$C8@HVE-6rNQ%UQ@W&;MmPSs=^7{V$eVKuok*UaT$Q zT^XT*1J&r65D}VUUhI#hF^t3)m76hsM^NdIzx%n;R*Zifwd0)l5g7I{MyNHuv{cD5 zHr#2;M)dVPq$K@^3oXB>CxM7Rt0adpvNnw!PrhXt+j_og*FSSBy!aC=Gzbt7F`#;)zh&2iMpfTzI7NVI%Q>!LmC7-nwf zHww4c*o}MkZF&Clc9hL)9g?OCSx)18_jpl#zFfX)duF0ah0`GKGsEnXZdx(FePHfIpf*-uk9C!!XPP z3czcfWGMYKR@Rj$i{{^yAgDeG-Om3k(epIjnJhhoUTXm3Y&y8Tf_VZJi3vG2YqZ?a|^BqYlzH2HqgQYZw?d!;uy^3P6wL>*@{EDw9^9l6uC$j2u zvCj2mY*aUQNJd2S#Jxe!-I$93mBnb2RWqpHelD1967<|GEL!H#5Al*YNeeNL4abl~ z>u9Fj-?&3Q#vjSB0udM>k>!hY$mK*1*0*$tn|_--qhi0$2O8k8^t7~;B;xvT{>*sW z3*O3nxAB_rBq~;sd~t(+>~y}9iOTFiIN$k6A3wVEmD?}ZGUlzi3df!Jq1{%_6unml z_3eGTL zanCOFf8_G6iBBdrinngxTo)sH$uFYz?2ZvL{Z0oa`C1(bC{M`OZi7?Q(`eOrkOE+6 zAeL1v$WFRsD}+-DFScV&>TwX;@MJ@pVYCkE`yqP6@N2gm;2e)=GH(DrmTQQvl9`hW?#Cw2wZS z3K0wqelQOA?)4I8+~A&*ey@Zt=8O#@c%sL~Z5}gSZyZKLP{CgZ;w7OrEqO!+l@`%> zkeDQVj-qzzWu9SOJxg{wC2XdX<}{#dfU0@UY{JDxP?B~THIK++G*;*{uEr?Uz&U2Z z!2m^P9KP@A9b?bj*^42=r=v4GB^Xdo^+_bx#+l zO`m@P=q4ihEeQ}nPyQP~|MRu2KULFajrEJ~7StIZv^xcT_sl>t3APjLND4E5z&D9S zUP}*M;#G7(;0L!M*^u`~-0(!hC9_@jw*4N|k-nItK_SXZK1(=#9$i{{jcCiu@dg^L z-^^oU2g4ut&WmA|QsTz#=o>SV;Akbv zK_RY#cs5l*k?%rQy)V|jUQ`U~<^@7%JJBJ-(cwW^gMtU8?ayXVfhi(z0;$4tOg{$F zeONQQ(MZSnQDe;lBN%OQo-?-|v^^JPNeyoB?PvRY_#O`VqiD~(JG^~7WULiyx=Lxa zeXU`OQu0!XShI!z1Ifjp*87D$CovMm*%+Ah*Yrhk2bC!tp0gZ8DOI!?KsnMq&dYx9RYDV7|6| z%crLD_Y%h3%F$`r)1soU@gZNq2-5ghHIl%7IgN7FG~##mnJ{Z{l3xyz7%J6SnhIGS z)=55}l@QJ28V4%YsRdQGY0O9o^mJAJ;?e0nYg+N6EXXnC7k9nWw@`8T$A0h*@0!J=EH6~l2nU=MN9~{{DT7H^0A+BMw(U$)Zbgkd=)Cxjc89Y_Mu zauahjN!}e7&Vnu?fYVW7pJEGVa=W&Nle_Pwf5<)xvilc$T+A1w2RAKQ-{ndVAHu=F-@;_t=;(8%YY`s1#$a;1Kij zk(nNpkd<=g@%Ae8OcB#{E}pJH+2CL?#WG0EzxD5&)C{r}`wsYyGzSD+?EiNHL&x68 z(&7I*jY0eOLV28w6gUGi|E2%u_wkJhVD-ycONwPdq`YR8DTcI(U~AIvBa*L|G78gz zNOm@dqZpGw+gJT#79QvNTj?VP1ZE^=J z$pD0~udpPbLX$gLw*`=nj4HeYNs^cO2`zy$R|E^P-}dWTI}fhuz*o^o*Gxg}@=dxM zLwrB=UOSs$@!QjJ6nX3XHGeo`fJHQNZ8|QeJ>&gP{wXCz>}&@b>HGi9 zSpP}m|6{DkshaRUdU(j~_nb@JdNx_k#J$jjLL5Vyb8u))J86TJ<<7mE2Np-O+`g#z zr!M^ay=zxjf!oD=Ov%OzQ3g{f;24aC_Q3Z%!f2p^0(252zBM4 zI{(7NClaGYIJa?`(EfYIko}r@26Zfjt?78~`g4WfCg8ysO46bN>C#ZUwIVMuxQ8od zoDlDOVPhGve>~4C2}q?x{K)pMYR=M!(f6mvQig)L{*QNM;3@Fi-0&8K!1XQ&$lu@p zuEFs?I*w*mdL~By7a>Oo7NB%v`hSERHzSKWfG1zfgoNZJgoFryRhEp+ER8@w$m0xj zbrr>_$%pk&b#;d)s3>6VT@*t@BNcVKrn=z+1^LM{Qnj?UF_E|Xe9=7H2D_p2=uZ8| zdn*vBwk0KKWFcpLeA&5La*6}}{20K8RcYxcKx#aEE#nF-={-P0e*zo{Vml!EWkagv zd>8naUAoN${WJZ}koZ}3P*W!WwGniWHi<#=!XI+fRR8V z8r${;n)+Ybmi!?9qiuQi3nKNa5ylWw1A)}gECONfECB%lw7;Y{G_)iULGJ7>*>_yj z+1cFL+3$*Avj`E6E`77t9iKfvo%Qwx$A6`Hd>*+Sw$wdNwqLsWFmc&!qRnJcpuob! zg8W~Pc@+Xx#ZWA+ns!|8**2-C;8Xck-ecC<&`(RN1vDd zFmA6G<+<UA{9e7w+X2X2H`s8YOC(l_gG}II96^lUW2Mq>&j>MBLEP{i95v!cc$5X0MN>uRHJiWeVV^vdD=1| zZOCG=P?gB>&i}U+ed*A06y{Q5I)jG1)!lyLEqCc40w70sghKYOcKYmvv6xU;FHXUx zCM{QLM^3A{XjkUrnM`Eeh&-HW`ZtzVY~P6a!T$T`6z~<5*;f8X-&6ZGIKp^VD-AC$U5kIWZyOZYK6jAXDkr1^fZ%i^-*N|8($f2jIHE50|e>t?t zux`770rfspJfCkQ{xBL9L~6)~h6?^;D1a?hB?k8NYfLzTW2^gpX}MaB;D<(wBCF+c zcj-PWyYXacs%X&f6pEi3qsdf7L8U{HSaU0+%{>2(I!r;}&W3k%l4)Os$GN;%Vn)AZPeob8zcT& z9trPmTBy_hAbdQXMap<0lVT_aAL$)!Nurws3|fp%r8IHATt!NZ8xN<5bMQf3Es|+8RZrMV34-7-7OV6c zh5zML+X(>E`8&TpZy*+>al6%y%Re*PY_%SM6CEN~NE4V;YRy*b36-eTAy2rq zVJ!HcvD}^ww2roGB+!Sb@hB$BDsdsqB*{u%dAoIoG8 za)<0rZ86;u#Co`$DmS#AGZ1eeB15LpU@j?+%&5?8`fbN#ul$zuk0JJq2AYDEd!On@ zWuhNAtJ~WIPN&n+A39zn5(%UWMGB4o#2j5IpiNh|t8qCz)!ZL1Xv%(6 zHTpFw#{nWqwl6Q~CNkJkL`yZ?GuiDT&m$}T*$TCIU_X+%si%_uf)+d;x0?6s{SN^| z8DK)t4F^`DSQ!6+%PIafjMz9dfbg>z^_7S#Dn{kxm<>t?5e7=jf$@Kt$XKFWD zwkP2)E|=teP*7fJKOwSz_{A0h5CKG@Z%dSl_J{Cz07(;n+ggdj-zlRkQMHxh*B}0M ztU3QX{bQy(=hm)d`pYw`hj?At5RE1Cs=eX>$z!TY>ni5TeRKx~bSg@7;v zq9vi6^3Ly~C*?74qsUH|Pu{56IK}%npc2Ua=~9aG`P$#)h^Gp~Pp@EQyrfnz7GRgIdQ&3N$O^Qghaj8FrL{=QR4Sv01FE3C%Eq3x3=LnGDdDiP5 zouP<~4#(3-ynyMG0u2_UapK*dIg4OvOop8r6BWM{U|L}^m6Zh4NgXapAUgn{tB}JE zNjOu>W-GKw!>jtcDl-?zA_E@Mop2XgrN)t(v#J zL(f&AGma=^e>6#|wk$JjrP^@putAhEurc3v{(mK7sF;}KKqc{|$m~t;@~Ce*`Uk&W zyYRh{l_iV*ncFR={Ou*XbFnGnrF0;^5)P4XwH+p%!ZC?l7Wb+<=|NPOXG$k6v<+X* zO*J9e>Eti2hJ&*-rq1YrlIs-rOP)VlU0uoX-6gm!4F7aa5+L50ZR_!Si@2J|X0uLo zYq#f{?blJO<@kP~RTPFrr!K}~_&H(q2Uj=~d%!5E%;6{+x7KY8eWli|&iKx=G#pET zkkps{?gJcBJdM$aa5J>)pFQ~x6hPu8gHuX3J7oY>m4{IR+^b#cuKKBSB2%wYskF;e z(N$&Xq~D`~ddN*iYl{`N&gU9HmX69)cH^YjK`T~js`UJPf7BRwy=vNS`X^eb5&EF?UiNc=&c*XV5&`KeG4lA>T_8)I6QlRMp7y1 z?v(CEB&7stq>=9Cy!?A#9o<*lExvkZ=82h+BJp7)@w&{SL_?@N5cweD=!Scs)X4jS zMThd^3zh`gMCPlGLJAV{mQWu80WFnWX^gAjf94nI4o(o;o5JqFp&pmTc?vSgrxd1N zo)-eeuiYh0`fm?&qA5)V;?9X9qAk&$ZfeAbIF5A%eRcZ9-k2SZc2%4i`eU>^#L5Em zL;RC(^8Y9cG^oLgAe7qtdTeP0lCJe!-EgGFZnIUB({`@uaPng^mMJ+lQE3T*p)atT zt&w@Gsbu3`9CtrMYcaD&je-P~%(`xo4kvRt+N0V2v+`J`d%Ov0g5V+C;gmrWk`q($ z#ZEM#OA*VT#Z6nLKm@g&#ltfYsp4{^qP7;>a0pK?E)x9)-d49)yCbypESVY+ZYiEh?1W9RIxfpNA3Nl@c|PrAbi|& zwRS9QZ+Z@cR^CVa<8T?tfTzuG4~)gX$mLTwG1hQTO%V|gVy;mLq|-))K0^?(JWiDO zxSt~IE;MWQMZIK@O=OIvQB24C5#XH6s9hWvfyXAc+$ux%j|_`>DDYVI8wnW(CA%u& z#E=Mm!0SyozvJ^f-yPS&w_#8(ru6pqK7Wb8RS)swFdISW8uxkFF{z74NAkQl=9(jm`7((PJ^xfqN*nQe7eGL zI{Z&&CGPQD0^cRz=|tlU~Y zRIr;2P}Bv(V5G^(8;{j_yqb z`KF=O`WNjSDBwsL67HV$V9X@LythRq?{a zDh;0ZL)2>{qs+;h-_J!0OY1`ocV~2_&NrBJq(RZqYNACHl8DZ0zwCRuH73q&H@ikf z;UN?e&7cvN;e8#3g<#;U#)tQJDOZA#sjT`kR=?TB0)AMx-d20>vY~WTio}aDjo%eF zFjZB$V*rxCq)*@Kafaz;@9{B?SziZQERa&Q+H;gZ=0NnX&zcTa$Zm4J#l4!-az@GD z-=ERhNKc(wvs~|3e7anvP>D=4W!al@*#Q^<34dy@+lanA$sL9ROV7z$TF4Py&;_s_Sz_s~s6jEa| zrvb{xH-7?>guFbqC+aImhvLOx7ojl3lZBszT!!%6K`C1nlE|dX{e|1B2?Bx4co3<9 z4(Y!>V{oOL5y|a$=P6EC`>)*3cfY7d`Av9`wzN2`_8kw`FTEzhC3i?Bajkse*U=%e zJz13lMqYn22yf4|2}Z_$2TsgukedvygM9v31oFyu6htIXs3Cy8G#A2V_}Z2?sq}HR zKJDJ07+h^-wZgY4QA-d+Of7k?9r3?zTm&|OW_b!a z?89vv2O@jFxVq#o+fTI0nqdWXE%d%xfVM7a;|<5Flo%J9y9XcI1JPQ-q$jqPBG@0Dq=xQ5;MB` zYBFA=O4I1D8ccWBJOS{!q=`ShKlUpHBG=@Vw!a@M<+3WIWxTM_XGy3?zqxL{&1+8M z8HY}d`FNd;uEo)mroS`5n!c+LX1xYdCY_oX0EBtlK1NnLy5OYA^^oE;YL>9vT zE5fJvPUCY$lL#|U6>G%*nXb@Hxs{zIoByy?X{?eh5tit^k^!zL3e)ZKFzYdr<(I_R zHp}$Bj(=B3kI;vR()^NdNA|BrYy|(Lg5A=f*+stC`#3CBzGi0NoL(~|2pIhu8XV!igs#(34+Z!ey%5d7mxV?-Jt*&#P&DD5BYAKExA z=4V{shb^Z{1_3u@{-b7vPb$7lHuKu&LDRyTTbb2klJ-hoUE<%6Lqeg0L4Yem(384M zr!KDd;|nPvo#%Jq^X?$*#sl6!N1CA+L<32fpn%yLTc*c>>%$#ydP2!o)mJhD0?O&|z<{n}Myd9Kqp{_4`lM^7L=NMa6%(I%%GVcLg}qKB5D#VtL^F zvP1LSDn9~7eUK4HEQ3M{wYgAE@Lzc{2V!kEd3!c(m^bLUdJZf>1_ z^XTaS>fiVMA;Fg^GMUG2F)m*|d8Tg;2^vNw9ul6BkujQXPQ;6-6(pjteivG4+q_ny zSM5=YOvKtje_8nKAK#9azwcf|GVS%4jyi{s<3yrdu>MI`vX2e(N@=I_XX$(rn2h6Gop*Qk=r zX=}}iRX-PvMH8ig-p_1cWQ&%B65|_*NNQ*ja=vG>Ki`-@BKe5m+K|%BR!9d)=)wQ{ z|HFn6>ytS*%XD4`v9`Mn!T^VcC4mT(&joT-@>(S~6sFH9(Gxm!)@2sTbb0vRU{#3a zhT-v=$4nOK^6ZK*UcM0En&U_df{R90|C{AKWy50 z#DD9|RYdZSw}$tcH2Ao1$J88+pYwjNerZ7X;WkHHwvQ{8QJekhtbU2ob$`Ckxhp}Y z10GVY-%kAul_(}Nlhplsx9E{Ghu0C-JX&}_dSBF!Ybh%t;>#WAezNf$ z3{S)+Uc65x2fB1ukPxoq=e z{u3JkC4Z@`r*$A?SAo=JcV=8I@1t)f!f1oTsx{9epp+prnXmb(2ZHJ>JYJr90^vO80O1oF!Q}%`;o&}CkksIP6{e*OgC1g z$HcKYlJOaY($|1yx8Z6dmkjUM#}R9P`wew)$Lspkq72jH{`QKggaYSZS(*Yt>!)gU z^zjb?r>z)_w?FfS!PG~25TSaAlAC_Kqga&ARPKiQ!wSU6?D+IX9qT7DCsc$B8Fj$$ zRr<8QJW?_H$C-lZLC!-7M+aL{wm(2I~WkOMhe}} zcGNAF+FDIkzz?cIBMGP^KjPMwMyW+WO2sl=_GTaD9Qm{*?}uS}OTN5kE%G-EcKt{= z^t`nhG(18;<2>D&8vLyPmE|9|!5Z(o9+CVqPV{6To*`c>tn?%U9xVZgQBrk?KHyf;{nG~b$rvBrz6_D&ufesg` z=Jyw?mk4mV6x?i2Hdd>ZYK?8*H9SSUWcRaFF9}-vsaI+5XQK>=Tv=!Yk;QhGQ4)63 zhpVqP_^J;7xNiG6Uz3RB!{1-uU#^)s@AM}cdT-Ne+JZ0oki<`|NJS<~EU2cv&SoxO zU80^L)$Qo_cd+)1N-`Wffv5|>vRv^H)P%{%*Z)uteA6L}#*-gFt?aZvDMKvambp3O zWK}Zhc_0Jeos(5GN~~`MM&aerbF@t^tDiF-mmrx^Du4b+ zDsPQ3IUsrknMLm}z!{`q|Kp(?YQW~V#~L=+i$3m~lxaKcPc9UbFWZSVkug^bhjfv_ ztQsD@>8&+XNaZCjzv zKWu;a4%qrr{K%-Xju?yed3S!)c==dgDTKA}DKxnm9UUDp&aWyatL)4512ZdX-3!~( zMp1VDuJDZ*pQuJA%O)_!g2*{BgV8i|-Qo9?Nq>E&*VusvlQmLgL+*?CwUFz+UVqbq zCco1zEl7TqYpj65A_v89ZLTf2r@tZ3Jeg6l^2yKPl<`_CO;;x#>!ru&bcKY2Y?XoX z*_Q<~6o)~hzcNF>3-hb(1y0~kw3pm+Y*7LZkDANgD4WI= zxnxcma8gbFuU{7Lz|PqaCgd3y`ogg=HW%ZiTA;urTs_`MX8ns6ad)nr1=98BmjRmg zMMAt@qvLaGt5WLGbivOG^b+?#z}8TWy#7bc<2wiuu$}Drc=q6Z*=Z6KIXgBwstBc1 zETNS7gf|5@NA)Cwy3%A2*X9=B-S`?@y74+FVjSk5+| zBmZ?$zWnd+k5Nbs5ji$^xgLy(FM9kbv-ep|q+FJP-2^)z-?baa#COvr`O? z3S?R0?db>wZ>7)N?kDRUIe(;Yi1LrU4ceUO#%(Ss{_)^vf_$YSlijlVKGsgO}e?6oU$eX679EO{fAOe=38lQk%AqxyJWx1HnN5-(Ae){~#b{&)I45wfOdAsb- z(j`u=^;8#(QUWI7_A!Z&A{fc`W6{gHdsOe0&&+B=tWe!9)ZDu^|@77K2t5 zt)_^W2!td&wyC=d^*nlBtZYi{240}9QEF&Em}wMeHfSllJ2%+Ap!9Hx<_`@i`ApNs zXb7myQf*ZrPpyRQ6Yb}C*4wiCboxu9jG^-Mq5NIlN_SAg5?3>y?pU>XKBgDezF@Vt?1Q^0l*%QdXWJ~c6 znIHO_SV|vZ@w=gK&3yf+T|-r$(nmXt0V%x z8e?-3>r_Z8nf=y}teD|4bdNT(17dt$^GpGcQ(B3NevOSgHbrU$Bwb^|;MwKk&8y=L ztU!~SPXLT-p1?=rPrOw)LS1?JqrF`~X|dy9@w1ZQNq1y28i`O`o7c5gxFWDkm>e#5 z`X4$XJr?x#&h}ea3>u88Q;$-j#w3Hl=wLtg;}W*rnJS8RpCv!Ou(%RElI(qrBi?qA zhqLzbZX?Bxk!#IybHpOOHbEu)pYI+Eg3M#7kisqhT+vyKrkm$6e^A*pIR#&Iqe^$+ z!-5rx)7(-cGHO4#Rk>~FX%D|TNm9$F=kDQRV^acZbNc6Fuz)*$VV}oWF;nn`9uHf2 zM7bJ16lt$>8+B;h@9rPejc*AAnai@PknPQ-y{0qAyY^$?Gg+rsN47|byyo@;;&?GE zWBDe%fctSS{0}5Jf1r1-9d`=2>?U!?RyqArX>>hE|EUl^p#GtW6$N=J03PM5+z|~C z_TII?o4~Ww{2xTHkM0K2tP6`M zge2S;FhiQUF-XrYh)dQ!xtc}HC;k`RJBVO|sXfGd-!Ztu_A17RG+k^NqgtHroI%PB z+nGPpC?>dmY-a$(nuBGFTSGIDx$C0a+uK!dc52y(ITI_i%H1^q(&#EPb={lAQHh`i zLE#we>S~@!=h;O*I0QAqYsKd{@+sWT#hjLt(#tZkRWwgp5Dc1}WOU1mtoqf}t&uPE zOP89QWo?%lDO@Y(+seFtn_vdNX6*bk(jrGLYz^LjH)B$0*bA1$6UjW+u!^5pg*Qy) z0bx_0)R<&GQOEoG!q^z^yzor7ngouL4j#n$CU;e4y%t){3Oz)}=uStLeU@3TjdoAD z7>{(6wr>z0A+-xaDLB4$!?tfdVOUbPQ(kZvxO)ZxHxW9YC>2TSD)Rb6XRmh<)T=z1`$wN#q3ITuZ0e~H1b&BZ1qWw(; z8o(h%3P=WZw31PjlKt~nX8S~Y#;|*8#cJPA?LAz-;U+6wB=f(Yxv0|AI)(uyrCdMU0`QpXAl|qIP)8?cg`~|*T zi|1>jB>yqQk0qb9@ITo{%akRY;C`$W)hrQ(geUS8S@4gLb4OI=;8j6|qDNtr zr0f_sFdh8sRf+Tpx#S~Y(ohcZa3k|u9#~{ZsEBED-r+atf8}{@jSw3ch8bK+*b2Ma zgMj0IyE!22yhlIt2iriOMB`Fvx^8bCPhj%;{0~h$y~ZT6xCY)JpltKD6AfR3L{yp? zHTuUltFk`!MbOj59S}PJB^Im= zr)aX9jocoa3f){}OMc81zd3J;Y6l*G@hVjs{khYGK8;c>GQ)a{oIm!KQ^i!mPJ6{x zDU0JXvs_lWjRT@(1!`p)!zvh<9#O;bb*yByW*4@<%BVFRq7l`ekHfFH|Imd*acRL$ zd7YYs0X6KM&nn7yKgk6%`{>RkH-kK_0GM%%+na-SP@$Y5pH}DqJ%lom#jq~epV|D$ zTfxQ1N}`!|;dxx6(;*-owPcM*rGCEbaYSzsqZ>thRHfNnM~Hsg`@tapaYO6%|ML=8 z4-La6NRii!tO@C}*dZ&bbgY<4Q5YFx=vMW$yLmqj(TlVq`qDA_-v!KIU<8~CksJ~t zo+Qk}Y0N88S4evFLF+|&w|<)7MOWb$T4VB%3r90?0nXFQst{8Vhk~^J^Imawf!w1{ z{)8NoH6iAB7*aZv8B`H+!f1rlAb+o~9I-wTSo@v#eERuXRS+8%%bPYvw`Hj;cE(PB zY+U!rk7g@fL3sd~d}7dK&Oll9$SyDHYzz;$YPh))ako(JqVb(X_Bin_+;5FLL=@om zuaC}HLU{QA=-YR#O{3OJb@Cjz+EXb^x7A`xb}M`Jj^9vi5N+{ScI?{k>aZELl){TV z<=Q@6rM{O#unoxocA4T-`5mH#{1HWgXL~>+lr>(~u{vLPZhQig*w2LJNA$(;&Y#D} z5B7NE)d2#vkC*zgdijOmFHLQJ4%?X@Dg`nWhb|#l$cx*K#byq8D`jtXIeQAjST$U` z;DOz`zb?sSG`9=&QFVJFfZeH!MJ#>z!Kts%-5^K-^8C2mO$`2yvtKE|^bk*Js#W|O zs!Em^oW*2iEbDZv^dF6~ciW$+bP6?DX*h&mFzeBlO*wxecIYF4Yf&oGZ`Md)(WUlz zxU0`QRv;AinD!8fVsx`N-mVZxGhPdHI0--#iczsVMyMYApXBbh35g=+BOja;GzGR2 zohCv>=#5I4l}+z~D)9b+UQ!OJ-5J@`xr4u>*0n^mTj)+(UIIY>wwX z&r%%hjsRmW5t@+`PYHMEK2$#Nd)8&3I^^L}KAF2VoPV-=5V6AzHHX?1|EPW0+`Hii zRKCHBkm+M0BdVh^dy{ZYyVJJHUjBTR*R$`*TqQJ3HP$3m@lRS5m)cYY$?4b*yEs5! z?|K2)NQN zt|;r}J6RMRu7m*1oAo?SV!AoUkZ~jLm#jL0X*zamH2d7gP?4XEqmj-@V_NmL`VuLv z$AZXNoxiQuPnYkA?j+o-4y`kCZnkO{_~IuC4N^*`OMjNg%+&=b&06k|{i0|0x&JWe z7Nrvu*6gwT;h;n%16zYd0!ZUyEgTjw}vb^eBjWS$iAB@48w$Ojh&Z zw!uL~0e>+@k@$dw(|pIZA@=L$#gb2AG7$f$WaDBo;sapYa$32;#+4CHBR`wf9arX<~=3i)d4x#G7~sEozY)v*2SW6ok) z=iI9sKG#J()st9Kk^!Kay$f&ZziM()Li+}0<-v6Z+(@f0NB$OiLfH@!Th`NjFaXT= zcyIQFR6=wb%F1&di=uIQ%2tOQsPX%JzDXFK|9DbDbdmCDZ4R>m5N26W2snRGj~OrL z;>p5nzXiyEjHIw~iACr^5BLk-Sch=izJyb1cKt(rP{?|pKG3-ZND6M^NI^BQCa2~$ zcd;V87=0N8X?y=};*jBzT8Y^}67Negdw-$HQwCV)qnK$8?@7;myktcR_>`y=Cc9feWz6?mtPsQ{^C0QOTQdI8$ z^*gvdeUiKAJ53mY`z?z2EST)qd*uEwlmlM3@B2&jqX}5SR7QJ`=CU9kl{d7bzkQ8SH`H zYmAxWR%O=jL1Oqwb*-;7j!}WB)+?o?)<&sFSlPg2DhUr?R4MFc$Ea7?Q7~$@*^l4O zB{sp}eOq-47#MfT+ulozs%HQ`8B*FyxHnCe>+9-xpT$4Q%`Y&t-VcQi6c=_Cd)*NS zY)a*3GUP>k3GETH#0zhPEOW90O2xfh4u21S>a}F*Fje>BFlD6zj_h47Fz6OrE_UEc zu#62CBD#K9+o|^ND1<11hY%nFtQcZV3k}9^`#mHW5+_SdD}ifU51>_y+k*X!#|DB{ zc~``u-xfgOmCzG z6`ZNisU7e@QlWSRgQ31K<%YnJoq(o379{_0i`A)dJ1Ym9l=MvyejA2JUeF}J&Eq1{ zJTzJzgKBN8`qOIQ;%beRryF-Kho!c&H@k_yesuQ5_T6SU&g>0Vsu(ftCc3NSi=6z8 zg&cZfZAo;Os7E-*D+^PtWmtPVQ1;Q=JZB@TJEVqwD|Xvq`}lc|X|Y-n`P}5*5-LfR zsY1%t^9`%&Fk3WMwWlsfRuw=n$+VBbfuQ9Mxe}bkcE}F>$P&*3wCsDp{uH_{mh1X0hWgFC+-lZGWyfD%P5c8pG-6BL z-M6Th%taxq*uV=3L=g2xr<=I$U`w>#vWs(?-`oct`}cKSX+EUF{fYJ^;NFlrW(3 z1YYDq*rKAM$LooP12LTeUi>uHJ%OcngPiNiCtr|Od!Ew!-@&?vmDbwV`#T#bvU8B#=E z(PhBh=ty4!+>A(AZUlnnOIQ>_PVBY1R4&g1jXc8i{t;=w z3Q~ICUXnFi&(_er6KnzUo*^C=55UWSH$k)GsBahlWKe>AjAX}pSh@>LnX19TIrK93 zTJhbRCoDpV=Pzfi)alqJp5|adcy{%hUB9o$WAUdDO- z%nYtEJ3^4wN!&diX1vrWpU@Z!`vz0Qd!;zzgBXkM4Y8P|0<3{73|Te+Tu(|A`#koZ z{4h2G0`@dHurnPakN(W?I{(6$By9Lh#kva_R{FD&JdP@I8tgE#;0z5S1k1NIPwHa- zczD{dc};7zP8ln2*0pI%A4dS8RcNr-()Y2#GZ?OVNkSDvr%Jsi3h6eic8LVk)wiNb z61Tbap{p)kN05PlQ#%d8BD?(u`|hSO^BqTsEk%nn9#=;9@{`6>!4$>cSKpprp?p7+iXxyp+nN51h(#0l zi{%{!mZlQlE08>>Ef2H*Ag+FEzYMS<@B>D5OL%!#amvsM0?2YBYWI_mwpy!hO3%Rw z9~0nER(|F7K0$6*b{U+US&pal{+=I6H$7gO{BYv>I-twz*3G;8^4oVTJKj%=T*1Pi zMo}WWJKvjAKpC>h$&YX0Y`@v6^>!}E5* zoG55LfItemy*nOwwl0Klf}_HBTO3|{Sq#t;jUJ2W5OtJha2?Bz7g@Iya^mW@=nztW zSL+3SXLadbV5D^qce*P7SY!Q51@yUPRqZa6)SIpW|KId^=O8RSEVt#nbYCQi*_STf zLVts5jj|YrFO9I##?;t84v-kD8sh+X|3vKY3-kuJqwEh^$Oxwzhv{zzVq<*u5g!2= zFx9;IZjRZ^&ZTQ7m&~O!in?f&3+;Dbg+|Vgc$uBE89%Tf0BeHE;L}0aES4nu;SaF1 z;UV9#%v2~F)-eOW6i|J9ks|y)?@2Li@Oe~qpo&^o9b}nlI!pZ7Fcv!59P8`zKTC@I zt~@;eLRsJ}>}RWX#sU91-#6rH^NE zU%8i%d$#b9Ot3wFdshvM_XhqnQn)y+FsuP%igb%O+!lr9oec7(9BPe0?}8-KdAiuZY6N?&Xh zKfhgWZ#h?IldC{bUSrWGH-9P8!37i*eR?oJ{3a$Bq*O; z;B(aY92WAkUAxYcZsl2Unk-ofJMT=6H>q0)52@yJK={gzt6hp4H$Z~{1tMyxh&{hfikHkRecLhGB| z5>{#>9BD;faxfnKZk29dE_$*|@N`sa4YL_IEK`NNbVdr{h@ZH*^$j*pL0Hmge@-c` zpXEJL`o1)X9Ss*{;oRM4prfO9&uG3!mO}u( z`?Cs_tVPyTmSAdB1}`&c=1kDx52omzF`gpa8PqdEKxI1gF1wadr_-v;oa0#F6*`Fb zP<-8@D|WAURlxlU{}z3`z>eg5B1;A^yozz42L0?*{WGjv^8>lu^aW>EDJOMBHvf`f zZ*PQmjIiU64nI?;yVn_Rv@C@JW+!XkDK33FxZt7kC5Y6Dl^st71w^Z;)Xw4N7JyrH zTBap4nF$CfaViI`1@azAWzTOwqtD?>Sb$YW$=mba@lCAF-TM}L14lN1lCkEUrO%%mO$+!r0_bh(gl zZ94O-dDZH9HeM#^N+`wzn_6I3yqURc*ODc_oBuj~V8K*>kz_=@b5xM^T8i2pyJKy? zJ$zdzHN%pxbVQv2Z$*k>Gx-zMYiSJi#E!&Vr|t1%w)wel5st_%@NS(}#7CBbmkTeT zZYBBs9f9cOX)j+nho7Q1T2Jb=del-CA9wPOLDgllV|Srn9#M%Le_jDVuN_r(7=-)j>gKco1l|gzz z&j=j3MPz7xhpCdHS>U=Xr}ksbu!03BMWpha*0$sl7{7dTFgC?^zgPOTVBNW<{@mnU zWdGod^onoN%A*fA zS3;l*R>u8EKT&2A999kbsC9@>p3cGVV@)qUe54{4Xum9rI1=jnk$QH!XUs2y-h> z%=>?k8NZi-*0fVBwP%@f?ol^i>?SDZNPV|!f1o}*WEVR`f9TybG=~m>UTaJJj%M7c znc+_?DO`^HEsF^HqiL^bl6sCMujFxdk#6nSyFaf=@m@W|IoOBCzlcPzYA3!uGW7< zNC@IE#I)(>F{1S8VDr#`TztFdT`V_zeqDUaI$vbCRsT?4Ws$a^62R`Aj$IG*Tw3l@5fwYOe8JxXqzXLu_G4IXcs} z3-8j{TUhk#Ky_kg`?_WZ*nn#KJ42n;FBWBCrXNZN++m$9V}3g19?vfnrXp(;xpt%v zsNMt|ufuIi4}Ch{oBa-a7Ua8&R5{d)bykMQv>z*<1^AffW6r5acbLOAG-hXWAFIF* z0@F0-X!dfu;eBA$%N2x9|1Qqh;WlF^U&|q4pckW7C20eGz0i^e$L*nOJpq@SS)dVx z+EXk#K&8b3Y)1H#LIBr$_bA6{Z&v;Kbe{sB;~i&dMIixHt4f_dYgCPFtBu<2yM%$J z;=n8VHM1u6-1{OiCZpw(DZTuL#h*pGnz+n5xzy1c?jPV^em{;)iTqDAfMSZ&Iw}%0 z7=bwU0xt{@?gg^^BotS8Q`{{-Vhp{G_qC#glf7@=9pn zJ~us8xBcd$7A1vu6=VBt8iGpOZ*x_DJRfMh4HD)#t^e5DK6B&m#CvgR+6geb_#k&< zxXIe82St0H?K8QnCvz)4M^0Xtkc3Wg_`&qn6-^0f($*lf$9ADP2n?H8!2LNG&vbFDIlDyrCMV>E=e;Gl@F#sZ zcm+xw(B9FIB~GiAxqMPdCGHv4!tBp+H>bUk$sU%Z;{}Y^XA&v?zMt#nIaL zF(({W`l;IG1ClykRp7D4Ss-bTDvKE$#aU42OG#S+GB@E)iQ{7&hTP=vt_YiKsU(`d zKhh+j*b>I70uK?IQJlP*f@Jk}3z%zHc`+S>5X{1`s!_EDA%O<7LV;8JzQbHbH3fr| zxC?VPOpX?ooNLWP__x$7@Ge?zd}I2_(okWmSd# zBeUXihXKeDxU9aCABp9&rBwesctN8v^xyPGtu6Fg}N=r=l<=nwa!*jMc>H{lN;m=6y5^5|a20{i> zjK+L|iiZdojtNIpd049}8q*1c?<-cqY-*MzPf9ANzNl3J@~K8)=GV%ruGwgA3ybbi8F0QAUFAI*cIV zsQVlXYBf<~d_3PuzBd5}g>C}&qVhL78dybXz;xvX9Lq_-IljJx#K@xeT1n9spz^xl zrMZ46_V{U;KW;SEKy-h!T%WyOAH)G45z*i4A(qDscAQ)uN$o9Oy^nlSu#{a#Td#`e zJcK)+`n&`d$pbM$db-^3Gecs9`68c|lw@HFkL|#)E>CUvSVJcnCC2lJFP%`CRww)V zmqdDMkRCYNeJh9BdEN$5QYo=5#nNvdNfa4eu!Idh>~R1Kt4<-OkXIFHD97#}FJ;A% zLhYaO^qjE%Cr^S0I)zbCv23H3?4Mo(V}?I^&JX`=as9Rf^2YZYWip28ld9O}zA?1P#S$^B%-A!bhRHmSr)r3zCG zvOf1p)d~7w*@!)35vIldp>}7u%x@hhpazy(HQs%qvyBiNa*^pMKpfJzP?O8Vr|X~K zk#KL%!lMGzSrX%D4)quTm*u;y8)h)vG_bpPWr|iWU{Vo^G$Nat!8raK&xDtSY}&Z$ zcW+)JJ1+sgd|;hsq3cL^JUw4NQT?$ttYln0^>GKPiUkF$_S+gSY}#2%OzZ>|*25b{q*1Q?w#Bs0zhB&ekPI3U zm;~U+=)*AY>(jTc_`L&;P=XvkIB1~st-9FE6>0aPzTcf;L*W=H3XUYO3_kz8WBOUx z(0e!q7y8Cc^EZiL%{SA-s$V`v?WXfXX|L)v3gL-UO$OsprVGQo`V{e4Kp%6=BMk$9 zf9(l(Ls`F&@zzMXVDkn((p@+FDrFkT!n1#v5r)c(L)zQl%scshabcIKatPgUfQ{iiLa_ zq0JoYAeI(6^ny6t5%SoryZ#$URdrdPn?tp-lqVYBu9oQLTGG1&VJA5@N zjSED=jdW!!_-c~@cFQ`j(r_c*PazWjLgv zap>MlZC=T-*u>I>T_`N&hxA@K(TiRlQXdYrR8-%Q-^0^l7W9he~DtKV;!gvSxXDondLSAyHG4AHiM^ zuc()T#qPf-EQJ4K0Z++cSOj@B@Td+y% z;XR%SB*k;rDv(>8CkKK`(oYeE_&VGQGM+C>(_TWJo>6!*LEGHtp&oVzJbnHG;nPriS)^3{6RSNu@phPA7g> zA??+7;8yBJCL@1p_FE#%WPD8qqsf$_wHug5kj>uHY$@P*?OlHh`uKwL;9ct5MMi0S z-xe*_uSs-;(7U^b`^~9zlBBrD?i8}5qu>6o6M$|M@PZ|+-%F?JjbyiJkY-^v9H-@u zW6R9rKn6!x26bhE9Ll$S5jxTpIN`_yTu{Z@kKe1=-hO*Mr6@GEL$$TQ5}|C*TRHoV zO>A@_?DAvy1natqWPqt!T=xA-1q0e#E%9|z$>(8M=>6=Rs-pL&uG;mYm%hd-h0=A z?-x9pm9ZY4CJkK~G@hr>X-+=91iBX&+B=Rj)~^T7R?`GO1;oB+FX$PzAYk2!;y7=W zwyZ>=r=pdqlhORA-E2u3-Cdt~aN*>?6kxdJbYpci56=3%Na7~?O%TQ+Hv-+QTYI>$ z5!lZtf{SaxkRUI2Mfpk9Q!-!2%@n)#`1`x-?TKaCvQqU?5l+iCNRSUyhE%uCI=S=i zWK{UYS|N{^#@$(Bf+j9TSIkzF3oOO+aGE5h_$g~Y2E+=hMk53+&(gMW;THI4B0+Mu z{uID8XAWGr>bHG{M^&yiDO@i{4GqnD)QNC8KU@vtS?zC0UJ18+L`;kleG{`X}P_1;m0&Ipf` zigxa7iwwJJU=UHs6nP@fOB%g9n0^`T)B^=Jy$}8{)Yq=XuxwE2GXgG3yTukL=iY=3 zw>s7*zz*>Q`r)WNZxyHgiNDUDdVCEpr{6oz0rfW_+r7Ez6hC$_W`Iv=^VPXmL}4FfbN)=D` z5;{hkesI3OK-jBMemAeeR%125HVxhV(t6mwG(!6JNE^o@?9BiOAVDH8)qhlj0ZZk( zJ3oX9{fQY-Hz#Yv{4xQ-|2@U74ZpN`A_EA?Q(Ybp8s+!cH(0*Y6aoTOEsRMha*5n& zx$-F*<3;ZVE(4zoVM%^GJUkf-A(6R48yMW-D&cx-Es=G>@@Kd`jbhmMKylI8o?0qHqac6;X4tVbm zMPYB^l_wDB4BJ}HORXg4tW|Tr()W)m23;C}(H)vZ(piwr$O!ru#W-t+S>nNKW^!?~ zv6Hu_stm|u49>K=<*B4p1gV~w}_J(79tU>mR;51|KTqWbOdDN$(%2m zvm#r3y}Yo1RUAi7Syea2ZC%ggrzw3iDFFJH7rQ5BONzsTdrWJ>$*jj{$u*Q5a}^I3 zn=UX4M-bI&^J9D&AW9T@=>vJMbZ}lz>7x5b(Qg5zI_oV|UQLka)jYbfrw3(mP}cSz zZbPf72H-DoZT&i8ui(>9Wa99{Kf*?lw>h?c{|Z9_t$8@p z31xG2mVNR$#FpaG-&3X?PHb;%bTg3O`qi6W*e=Kkw)hkel(kMpLZ(&iFx_PF$Vh0> z2*Qsbi<)Q)ti%-W^c2~4T7IZX0alRG2o1JCA#Ge=IaiooB{y_`?`vlzWZC9jpz=wa zsD)jZ<-v?04GORDm?Pi1j5J#U3?8BJq=4~{>Z&TvnWlJzOr@QgBGqoD!rk)p6t!@% zkjUh$)v1NOnW;PB>&v%(iD|^J0n$L>sI7drW-c*q8*YasQbj(b&?X=rW*-)T&u-Z_ zf{f2${^xMliHpae6BZ8c`SH|H5}&vWn`X)c4RHi6=*hvLBt4hBk_ckE0CH1Is$SG_ zi}zg_o*sF+?N-H#v^RG;8&UPcA@`4tiFZIv{7P@8wT*?hS zQJ@*M)5GW#4hc9}3nU1L1$#psyVUO@eo(b}_>5)G15r z-nyCtm%Zs#K3n})f+sVoN^0)FeA!e|ryi6ko*fYq&}j#ny_*=8tplKHEG*jDxf_ww z&5Cw>pv}IT-ocZE)E*3t`2|*M@6O(3t58M!w$DRtbALCGB%>?UhH<+QO3K5SAWrW( zJfzKG@>w(<{^eLN^IQi5I<%&Ve%n5I(qcEeZr_94P8x3g%FG4l7-uliGYy>5Rdry; zbQXR#W7GoyvPT}sfY1-QE5?2Sp^Yamfc{&E2<9eE##}_c87P!tONSBr!Io9-io`*I z99BNgDwg=WH=GSFy5w2U_q)TPqGn}PoacZ=Y=&4CV$(tKxT1;pve%zPjTa)?rGm1y z=@n}I`M1)iNHBP0_*12QKgh&QE<;xmSQiP{pmjwoexL=*0xgd<5OkKY5ztHJ{DR60 zOuGJAT(IgFZtz)(L5gl%ptarPvKQn<&vDC8S<$4`kp7PX&_vX0uoO>j9vK@dHv7%p9IkWZrbm5ZhM;JQuYpu_DN zFCnOH@v_-W& zS*k5~tr8mY6nn*drZVft@az!9!Gf0|a7*7SPc?xazI+^%PVh!Ws@)ZYVCf0b&|jjJ;)?;ziKGAas@D+` z@w?3Rh)gpS&%wK^BiPj{+zf$qT^r21ay}Rebrg4{`jxqk*fI9>0O~QwrcT75lC#18 z92?;{F45Gyfi+j{F1Hx@!M)*!i4Z4#`Db4<#K*=K_LBMBI88)sHFe&VBddH;XMY^x zo--pOa7}Q%wCOZ4voQP6RFZU>Zembw4N)2e8pBA^KR#Z62k4qB&+mErgm4W04qv|u z%kWJEJO_E!-}8q=80YVBU_*_>tGHU%zrM%)cuIeA0jk%FZ6{A0L2M7=^f#baBo?$@ z%T%+ZARgO3jvW$^A_Wa0Dx1~(>3@Eh3a*eHb)yM$s#^utcdX73_8{b_({GTluTQde zeeMfA>Bi>WjRWtL6BddG4~u*_z>X3l&(Hlv>{qB`w{|LY%P7!q_?N@g?D?XH_w}s9 z>CdA!V-e$55*<+U$q$Fie%8wIqr=#gZ6n!T;4dC3`UaoJq`5m-t39L^O4I060C6V`n@EG!`2f$-mh%IY+D zw0wwlg#M8RJ!_@x0vTi72phEAmUZ(eNaOlJlro=p7O4p%Qbj&d%8)O01Q`Y(^YZ8^ z1vI-o@!PFvFTbHx>ZcdW*#J0y9kk&#x$ejX6vn*6ktt>#&~N)gzU1@JO4bNd%C4{@ z3Oj<%N}l`w$odMXsF$>9?k@ki z?|1J#-tmvI#yE_@Ifu2^UUSa(ecmS^3xV@>&Y3Qi2uPHAO`ac|gHGL_x}FL6F!U;t z=H;ikhcrJ?%XCfk!I}%>6%kYp5CQ^-Z?a2egB=2_aX%j(OwfDiZn-J%?v691b1FDj zgg41}inmu!xE_c8q}5u!JF8mVDq8iL_kqv z_cW%$9v6jdVIHL#RHV~)*X7&4sID>?seX#EwQSvs8y16Aa0L%XRZJy?Kkd1!^^-%2 z>Kl>4k+XBCRB~F$NbdHYfvtxJ6>5(rugE-N8zPe!d6igREhQ(^dbYA>-1mpZggn?1 zKjfohIfdUP0+wF{R-3d8%#Cg~bTQgz3TL|9I3xxLIuZYHYH`3!cl7Mn``1f2WMjG8`#;dS zq~QZ_SX*&kzI1pX@}AQ@XhD`p!9whaKM&urp&C>cMtb#1=g(poYu&r$yYV#KcbuPn zKp#M@@a^?wv0=az<%#>=?|PnwG{K7$Jl*k3LMGIbBc|V_2A@NTM3gXxlqul!D1ow$ z9?)4c$gx}j(Wf%oy=n)Z=V;7SsV{hyZmoBM5!;bY=F6vG=W_X zNC>xMw>MDKvTO}}?eN_q2C&!kiZzQ8wdZ$7OR!QC%f`c!R@~s(3_C^})d;zqqK8J-72(f^#SZL0;=I61cA=MNKi zoI(KQF5Tk?*rw_jdl11k#iR&UAMznbs>s?1>dzVxF7n0v3Zu{x?OJr&!Jw_AvU z2-?ecj%ldxN}s?L`Ajdj)#c+H5KWmxOAHxcipk`sKvGph8<1wZ~j+0RXFpZ$k zEyOj=E-k%+dHD4vFB=tVOZeqM(mTRq)U(hb(Iz)`0#0a_{rJ09E-0mPY68sQhmDfV zkFL{?VSCZ@Gz^tMP_mDCD_D323ASj*x7AFXhnn!fGh)jSj9N*Y2n7G~KOaGwXG!XTnt=5pUFN+-UCZg6%&p zHhR=7-1APPric$w5o&?+EL*SHyWISg7G}W;Xa@Wlir0-%?@r3Sm#jbp9*etu@Xy+8;~5Sd7mNv>ZR`?P*u(I3;&cK4O`U>Xx#ln#Tf%2PMH z-AQJ=glmPX2-5?Ur#1sXmHaKI9T*ZS?k17^|3-?i!?t5mmkpYD{~-|=X!ihFMb%fo z=-FTAO~4rv9%CFP$pKWvHKkz^x_8SPsgx1qVxKlUd)s?oBv6-8tE9=sq^sWE4f&va z&eok+KUo{dBxn@k5^lWp6*~n6O)H0oB{1*_1)gU7yh9;#18nc>%WZ)lBxQVY@PE?( ze@aiE$0+#A$i{q`CO{d%9HdJYy99j)oUpEs+Axe4$WD!b$lv~OLCA~Hlra)pRD8BQ z7+bzo5{2uq2WFO>c9hkA`AawUN|<4&S4O~oS=#lqHF|2W6*9U()(A4$p$p|EBq2a` zkAj*6Q#6txa{aF-IT=+1%SZ3+yLp$oaQs;1825RB?7x2X+tLZkRKpkfbl__V7XA#}$pUD1$Z z9J9skbq#Y!3;g3JX1d{kNGZj67|ET0JV*77Y9B({$>*>!jv5kaZMO8ae*FHklp+FL zg*j~E`+rv{iZ7jV+N`A7p$g6+ycXbm%0pW5xv<3D@21(*y1w>qHc_&QkAwXjMqhQ< z9Ej}*c|P`YyX9A)%X)psB3?fsVBE-qS7xLQLJyH+sIZJ{b}+taT@Rj8w@z%|LhjAoRnkSz~ZMNvj z?$!R!Bs~7T!SB&Dik*~V2am?>7F(gJW-ERu{MB3U)l3N0Q^sQc$7UCT6O;!P-C}mJ zBKFVWd0Gv0|N6wftWt^SP#KSWAyYfa_=qdg(cVQf&N>|9*8(2VVR zuVRQA*t@%Pnb$h20_`Nwl}CVC^;@NyTwJ+mZbkK^BNq%T)>}gNt0RMf-^ACS|FfR| zWz&8^t}i)0QMEg@&*lo11%KHB-e7LNADyHh^fN^UJK3JVV=Wt~q}aXhT(2*ZY=G$$ zlRKAHfpfXZ0K;cQ^eC_>J^aN^LI3mV0|S<9%FvE$gN%w~9q;Kq@VGkY-eh3`Rt zr&c694ejUc!XV){T0)-T{AewzVffepqPY_RUZ90M=Nrda?{J{pHk zxf|#|#Tn+Q0!{3*-gd`m+piDO_&>#qdt@B?sm5eoF4lN(j<1?O0|=X|W1AL=nTj(( zyUAts?da;`=>U)7ZrcBBIK0wJTxXtJaQoS4W73r&w~X?1WQWvOIJeWH|eju!H`=!S`ucB_jbHzfUQHh}AW zrSW~hIlDy>Wd zg10RlerLVVkk@$FV)yy~CjVH-Y|vCbhtBcd-^gWB(_A$6@T`;?g<2}_Ug|Y50d`+B zm_F@OIY}lOHfC>l7*J_!9 zxFX9A@)19;)R!0gXI z9K&7J80LVVj^c;UHGoc#rNVJ$Fk(t_EnnIIz|11Cxz`b;*MNy`e>Sbc2XxOs`q`W5 z9~dD}1uXPcGu_dCYd8U!R#e;{`_s6A8)9-6i^rXXhkq^`VdXX8eo?a)tMpU&?B;1p zDTZF<)^)B8#1AF^s(ACyrcMs`1BDzdZb51Q46OS8WfU+Z?C_TC;9na}I3{?6q;Jyu zOytm`C1?kT>wnyIq7vAX1q^-+lAAx;0;0G684ml4er-ONhh)uMsgffn^;;VHK;BhG)2{Ib)J$4HamL8gFMijiJ3XBC@qzxx#0nV0;?lowe=2QuPqF;b698B_ z^j~gK!V+_qO}oIe`S-QN={wh(OW%CIaptYE4|6YLp8uAj8up5d_5m1s=##)xNDZjb z`ZK`8kQkW9{ABuyMB?{hd04T&zHT7mdG-3GUMa8Zo`G@``pFUl85z!g!g%L|O^*wv7R2LCy}S^^-z;@cu<5_sc- zLbpq>2xr z(hKnF;uV1f-wxor3c}a@SeUly?NZ=^>3eecsQ5`bi}={@U$m zK>zLiDzxpJ*6#V+b|Rt*pqdwLez;&Pt62|eU5EpQ8Xu1h;}xp_g@@^k{RY2=K~1{RHV-;NgR2;4Z_rd8UtN!19+&Ajdj&T(Be z($uan$}XHKSG{rE4r^DB!7zP(ig|D)j5cL%>~zItDuKcB62Fs)>J znYkO^{B^xIE_01OYV51X1HO)mA?On?&DJp(^PCDMv3kpOOEkSFrhz>zYTIt7A`ule zbqI+7ceX-8)M%EHg!yO=n~DEew!A4mGlx;PC=A&ird{|cC0d1aXM9`_pP6IPg_nlxyD6 zr|YLLfaOIyiixY601H*PtY(R>)fPAzR%AlT)5|pqG{?)0l5mrmxM&L$-m;L0)z*g@EwTTLA&u0tim1!7cq5?t z$OZNrF*Nee9=hq5@q@xGXOcA%=@>DLkT1#`_|n%o z?5+Zv8UlXTXiZLgOe z!}f*$yQaT95+Jut_QX56yLRBWUqc>95s2q^-V!zLi%DnCmLC&1Y>=SxPj>(k_)2Ab z(ZjpbuTRd0>5zSVOdxmDhG8tk`I6_KYx31po%a0e&Zed^_sJ!WEc z{06_I2EaE+UD2m?++6xF$0c|2x~FFWgR*3#UXgse{j4S`4pI9xH3EfFoLeCkf46wR}{kFu&8;>T{ zO~xDSBruSN;s4nvL|csEiNm3HekhdG8WJlLDg0jy_HYr0fYOBHlRGG7JbH$Eq?DU@ z0>Janr8+v>RvQzztY4R;#2oWLo6>&^fkT%@U@^v;ZZPIhOymqU@(ecGCRVFY|0$GT9<3K5oRgJ+i zjwu8DW6M0HUmfzaqtQbCzS$-SVEW75-(3C}X=Q6yYAsL!9%fdS%jX+@xqCASYWTd@ zEJXa*EOaazSAQ_Ui&+Z+$q7d8NZvKL%!-bo)Umb%fj&M8@SyI=)~+z^*%O!jos9W{ z-_B{9uLjSND+rwPrbePJmGh-y5-Z;lEGr$mK^{=$k1bi+-@+#w>&E_cc*q;YyZ`i`R~9@tNhKdc3)1Hl4ZPzq^ZscL z=)}DGmdjnOvXS;{{pR?*4yWuFAH!0#D~zc`M4FFY9TS3$3jsd7y`7ZvSXHC>BQDak z#`W+$Hk#*>6R-w<2iu&toK{!h%AOlLt`w_m1LlW1uuw0}0ZI@h;HO8;jV|C9pLuHk z0A$vxM`8N2H6POq-%RTrq^%wub@Ds`B|Z;ovaw|8A)w6##I`+kgQzPJ&NqKtL_XJd z+E8%g9AW?GMZTi-jciprUFis^bl6lXfwU|DGa6E^>LUcB&nDak)2N3NJ$3>PMng)( z&7|<~4no#Qdzd*^w?TD=a5e`?44f)5yR(~lmM?#3iKs(xc^idpyViJflJLwZPtgYvRO=Z{^H@T2lMhD z1}94x^W8VYjxVo3?hDH4mXXAd$Xpp$*Ar|PP=$!DL9VWcEsyI9hI4yTO|+t*7Zk5N zz%2a-U)oSQc)YG$p?exPKW_`f81wy%go>~UEHB!613v!p?F6If50(J@$`-6WeckZ|FANQF@F+|0V~U*J zhBQ8xkVt?T+&}NWBYDf^-BUk<)A?``bI?5V=VmD&c`v|>@5}r@3V-lt50dN-@a1^l zujD<{6GBeDv|_HY%GfLEWdHc@hcoqEN0V!pf{fb5@A(W@FNwb=g(Y`hOc~VK zF2jGkiy{`WOLk3a)^A$=rClYbk^jDy9RNXF+2vON708djUQ{7oXya*_w7DUMdEmM3NXP2TKR#cB(}KV!be18Zh0Lc zVr6`c`u-<)W&rCjm>`xPZWBhn{A5Z6q8N-U@7THyjWGr?yTV6-`QA1_$ytmuMV$BW zk1ww0hQijjouE^|0`rN#1s;nI#rGRRMngAW##L$Uf6mEAa1JQ8<)Z+QRWq>rDhyJQ z4A~i_8_GooyqX2$P(C8h&l(vDSa(~Qa&uJ0Qjh- zV(R`5YuQ%&k(ImGg(9dPyn|$|u`1QPfvt})J#A-be*3gScjF>M+2U9-rx9SIUAYnU zGefn@K(!_b9q*5%LW*V3?$vT0T-Sa7X)ukCQ81j+KLkH16P<{QFJ}{|&w>r@by4cX z1;dAEKT09oV6b{mlNcZKn1B^thCwD6q%9ls-(CW?!fD_xSl>5&csu}78i24c>ey1h z&(|#X3}6&NHJ~CQnC-ypNt8pTvVXixu9|70*vlx$PeHCv2k+bUHL3XJ=C%rST;ath zGzrlb9C+Z9o&$)Y!vI_qGVj!MDp1c8x5NxpI#_I0PF2vdMLdJ9=oyW^@9(u|QVjG2 zIGt2ESvbyW-VyuL1y~1bu9nM!O#M39D>7^Wb^`tPI;6n_iIVO$YIN=uVhD-+P7KT- zO@JyU_A*>+pj+IZgOEjM(+VKV0SLXjRZx}2I;T7ztzxj9&7&ko=#Q^`t1Kg<_uN_& zZNtR0jekVMDIG?-u7;>+qVeX=wu3s{c#bVL1o~%&!!&c&nEI6deXi}a_XSXD7yKym z6x@?&82$uaggpdTDAbNr6y?7+h8dwq9>)3-sPhKGaum-c$tapI~D=QobcOJ%MvNSQf5kiDvf!7YUniveEE1wG>4 zuW!s2)%aa|c`7h?W#nQcT_O;9rpIQ!?$tfg8C`f8%1Gd&p=1G^L-n{$3|yte9zvYi z$NxMp%%DV3;G$xdq4lL{e@MiCRf6S1CW7QkUtl^L{95Ne&oY6X(|V3~#gqdXc}sE$ zINwpXrhJwVI>(8|NVdTy|o3JxW8)%pyl5^@nRu$Tuav72<8;d4L5W5Cq}VtZ3g zuTIAsV3gS=-1f8zqONP2_Jvyae_pUfnwGxd0?h&`97*DCA{VH@Ss zO#yxh;AKS+0+5|8A2$pHiR+Gjnqn=o@UUcyXc`^HI1xQzgK=CbWQ~>Qbm95MBPD1k z`0|6VlAq~un%!JqtNeDhN)d+s;`yBNl1M`=JeDB($Z|JmnJO3d&U|_KV8S+#%0VRZ z9V<82E%SuG;NFE0j|2;co3x;nUOHirLNpl`(B~ zVZDRkqbou_DE0pDLl4qK&m*FS8J}s6QEj$1wK0NB+TAw9sRJ_SAHd{b^zQL#a3h!Y zRjbpV1+SfjMuCoBF7x^sDA;K6{&ac51IvHtA33AnPao}%_c zT8_Dif(o}A%1WgvL_QM>xyOVfArc1sj9wuYp%Px*Tg1FX-oqm;Pp0u&%T*Z%;ggqy zV$7Jf(JeO34}?}`0z64DSWyLt(|eTHPaI+~ejj|25ZXmK;^Viz$o(0Y$xJe_xp!VF zTqb8v|NX=@vGBPab2W6*$uLX(L_yl>3!qcz?9^@~X;s1j)?nn^wkOVST}e`}E?G9= zecBa#(t6y__hbdCZJsaBNxe{{C9J4^v8)Jr#-ht)%nMkE+_UFuwSuhSt$|kb>LaXw18t}8#rxpZk`U&gMb;9=Ph*P`jo!+l+S?$**gWxhkv~fyZ(%0;z%Ah}D>&K=IHXhl zUe?Tf=`mw}^$4F^N8DV_Aa+VSwwWcTMS|+@yM2qZ#I)NG>#-h->~3F99GD*cr@Sn> z#^D3KfXL=mx#fIa?AxaEXUtkZBckY(5BgrPI`=?mL%!9Puf?9MhvmFNM{(+LU+SRR zJ#v?>7b(7u1fOAp*f29`3t11fHR!g5jecrDzM$Kim8xxHQTZ-5}uJ%?1j0)6cX- z+$4y~fu@^)_1=Re&gki8W(CXtB zo7mP(urW{HAP8uf$KtYwt{#BIepC96CsD{0JukHFkc5-%%MrwSu}KkFs6P1}sXr7mn{XiNw7V+Tw<{1r+`qewN4~7^Kxt3D zz@U+jdqL3rlPU^}Pf&oQQ|Y0P4}gL7DaIf)nG<9V5whBTPYHyZ=b~&`42JtKv4Mtl zs2K<5%_4>7*?mJ~fdK*ZpPrMqK&Ja_r;iNIj+Q0T9;;ScYP(lFBw2s`GpTqg$Th$U zJrTvGQ&K=cLd^mJrekv~8>0=^r@3HP=~Vpu8{yTfAIO5`ywdIF|qCn7{=2 z27phdigLWy`p$JZLT@i(mDM%%hR2zX#h8bYSnKM+sBr@?szftSeEmaymPWz zeV)R>xuAGnug7x&6Hu1|0gV!W8T)lD_d&e7tB_nd&lw_RJcpE9V~i$XkF`^np+3)B zI~egx;sqGDke)m2R=cGp?(q-yG1zbPZ$~OEGdd&>OQ8|@|3NOH!G7(Q5=J*@{x6vN zzlhWoHXQd)@ZdY9^EC^e8EnB$3O$U<+yeL=}Z=L&U@&LmnC-mf^=yy)#s@d9||7m#ql?4ZU zzJw<@h{|TtKh^!cQwqzF1N+m?lXFm8k40t6o8N|$NR5&X4qI2*eo|2)1jxB5N-0*8 zbJ5#4e9qPOU$>0k^FQd|> z{Di?o!)i6l2}@eY_SzZO27|*qP;0ewIGUiCM)0T&rhQf!Q%KdU&YsOpAU6#M`e$vUUSBojD*qK#Kqj94%+gF;(CzQ@*>vT!;BCEO7Y<$Jh5 zX6eb?inKiM zC1*|L7><9f*6q{Uw4}vS#kar>h92$S@kN4Ap6xA}!>T#EQmWVTs=tvKH(zaQo*Qsx zZEdW0pb1T!&KM~*9m6PLhk#O#vUgq?qBflr%BRZt``>w#x z8<=Jb4Sd;3DTxa>c06vesZ29J4G=;T%a<6eFRIFlsXF>?CV-ipsevuf7}7Eo(v$;!?=kf~nK%rLX3$7EzX2n% zeIvA~FY|R))`E)ChoFSBZD`jc!a_zz*UV=YOF@gjI{6J{DJt5?1lau{y( z%i_92Pqx6>iKV;5DYds8a;yHVjxhq-|A{{(iPMVIwinypK61>;#MYc$_WjerBWK=dml8>&{cnmyRSfaQ-z^niZUg*c{iF~^2 zHc!cF;1!}TsEtPf;^1jm$`V@cv^%K|L`cttx&9Ot&d>^56MKA)AClOU5M4j#iVZqP z_;2wLAx#cAI_e^AQLxZ=R|r~679U5A{NxU$RZM(+YBHcxux7FiG<`p{Ic}iD zeC22Rm1CAhO@2b|3ImtErH0eAP2b<amHW(?Zjh?2LC^5YD8$eET- z$^7~v_1G6+n%Hy=x7Iz_;Mu4ARtPO5BLGshvph9xo)y`Sr<+3_sw7Tav@If`943Rq zS`vKucF%eN)}gjH-I?s0tdwD{W`K&$xUUD62QX(#?3ev_a|$twTYd$e?+BJ@LjI#6!RcLS}t@ z6{mls22cr-=^3+8J>upY+@e*L%%r1hS%yslQz-ueB5r6U-p%l-_6`%otI z4QY5hXrqsBkfaK^C~YH;GT!N^@Y_0~|L*~V^FlYnFNX9m_zoWvlQl#X5H+?lg}rj$ zRzXd;WCK*x&f7Nmj*rkXbIiNcLjnd<1?2nQFinX+FNk@eQI325{9r7(O5Ptxro^B% zAZ;WQd@-`YQ;A)}F*BV-{Ob23+y%oYe z+w_Ng!KD{JbUIJ~br-jgWLlZ9<~h30L;$bwlk&8BIkfe^|EOq-7d+tDIXBzma*+wUVs?;vqQZ~h zESa{}o$nB^al9$gRRjYvw)yWpg!nIw!Av4pm#D`>qvJG2kSWc|d%n);4A50>`>#Uq zn58}=p=m;gjix^WnianTH}n~Ux{SNX7ErzeQqDyK7SFrx7`}=aGA5o0F|L1J15oxH zxx;VMv{!CongR$h4u%K>RU|a4)V!Q1(Mtmr#fGIuO&@{OKp`z;)A1dG%JEe&PO7@J zP8c!-bZ@OJ&!Jh7?=@gEIKcc&2YC#&Bzz20qw{DW_W6ChKlByTJ_SMDf$G=e|Y+f=xCO#RW?gZ6&>857A)r+20F#Q)cA4|ye7hc zO(U>HAf@PxwNA5@9~!bLxmN?0?h4l><}Eg_=M^iMO>{IN*ovLDuE-aLh(%8T-rb_k z@WOq@(YRw;N-UR#P9KTk8X5opb_hN`P7p^eA+ve2k!S_@2Fv6&0$Z&z;+YDy3u3+( zAfh*hMNe1`Wb5@8>sbG0h1xTFBWs+K_oEnts`ORz0?7wucu!Q*p#&@Cb)E4~*};LB1ow&sC2t)bcKl5#dMr zYezT|f@g)+Irrd-XZoXx{jWwZ@y2#?>77;ml{tn*Yn*yeYFbE3qfwh@nWbu8i zH6nr1SPmBL$z6?ZY8FVq1&GSBz~FDLk6O>9y`Oub#5TlRv4Tz58p2egr9`!bA$E zd-=%jr^n%dPOnvZ3WdF*~`msZ`ek7NQH&R)ulw3roMU*;;u4H*I)!c~ zmT-r;!7KGdTts_ta01w(gO&oMTwAE{7gU(lcgbXu8c$f_*OCYXQ40j06kn3O_;3lN z!#(F;xbsIE+#I0u`Blz@fMOHhqMqW0 zFee2IaW$%7f3ehW3qa2VM}|3H1K5yhgPQOjQvrsI;vuIRo0zNb(NT2ps_uxGR@h<3WX z>XdxdPj$SH&F(#BxXQotn=TejitJaecB#HtHUk;2t*H5*tvNRsqF-sdEWXJ&oof_u zMgX|?!62fKjk#)r6%Cx;9I%#_hof?{&sIhS_cxKs1|jX!EelXZ!_6YXX+W}ocEP&s zr0rVrlS^T!2S(qo?-C`n-(ywOssbb5keNp#)j%g0>Hv?irzqd1SiMIT*eg+Ir{jOf zI2uzH83DRL5;ZpS+nJ{fyu4a(Z_TE?;H4jKLP$lt_q-8ECl#V;(ST~Hw@q_gJ$^aZ zMY+AvUrSjO(M894%NYO7p_^NVi1J`d{pEq1s?ccNC3Pi%xit6P(Zgq?91CW{)?P=N z5prZRQPIxBb^l+0AV=RH)>gIi~zs< zaug7OoD}EXtnSPcSF@Pm_7n={!gfrGI_pwLXe*Yd`CzFtR&(j*nb1}I0R~5XmcpIY z8h--XbM-kN8wpvK@UW}CTL7p+|N@7s==OksO>=seWeG3XeB^57vTQxfSy@x7E$fNq%UI|3Uj)W5` zLstr@6Wd;rQ@%xEiP&*37W{vhIQ|H!^kVGkrrQ-#ab31Mt6hrfu?oqbpEJ^S_GG*ai7Hkbrs1!sYFY^%`#KTMp&pd3>JBglFk>iKzoYS1vjq4OSJ{??kW`=g5fGY zT!Syf0`4*5xE_zT6W=qUs&cZxd}s%BFP)b?R!Di2EglCS;hV^-Dz>h4^C}w{h1^)y zx}QVG1?K14C_H)dh}MkZfr!B4S^`5vOokByE~9P;Q-*R`Sfi3*bR9mBY6s^1hghNXbQ;klWaHU0UyiLD+VZM!$8Oqf=TWM(mjAxem zt0djQ-v2Axt@zYfu04+5prU-nFHqehhPO&q!%te5&!-+W7iF87nNXeGF zH^PrH#&6JI7hhbEUNTlz?C3+9d3prsmPf*)x~!BW*yFBW$|R4mIlX2b-w|-~{k|$U z?h_=b%R4v5M^n%kMk2ZeRZDDmoog_*-0fwh0|AevpjcPWA^9XWuggQjHi>(MO0o_`_lzVzSU*^(fr{ht4AK_#sh9(Q++oREQmA zXRRdxX}o&k8y}i@ryoycs+7ID*x*(H-plJgNVUzPQgX^dF*YWqD8M9z(TKPe%-NY- zuB`A#UD+F+&y94b1V+%YfeJIBAsI4qSTFjIVZJ4?t@K;Vwu zxR>{xdY`@dSWY%bw7Zu*lhH%}4ObTK!?XZ~1f|xPY-cfGScWh6v*{KRn#dw1@N(qn zMa6zR;)iGqBZ5f~d}V_J{~8A}j;)V`NzlnCAkdL3L|J?}czkXgL~^3sjn6Y%iQy}g zwgf_SemFw*Vi6CYWe1XrZ#LhZJk@D%WotEcc3nL@R3@2q`3^K<(V>B&jQB?<8rm4! zsXG87{Q(&$C~@C*ql_fr2m1L9G#N2@Z*T7y-A~Iq0PA=nwOX&!yON@vc@;?9JZZ@X z|8*rkf>hY^DtoB^W{H(nKv&#Ny|s;3Z_2Ip35@SW3`fxHRE}yj7}i}QM*`5HGq@je zDQ|n9V2$Cu`Yfynh!;8Nq&!-mio4th2npo?eQr{M;CW?tv;c-;3VSRex8;kD+up|- zf(-7U-CntR!T%&Q@rD?0VyaIyTV5@h*X|5%C5IO9pzSJ5#wWOKX2gk;Fg~F90)|Jz zf(mp1b{=s7HlShy1HuWJZ&53PZroA(Js6J|bJ_Gc^Yus0w31G;3my$j;_UnSyo4Cx zbJfT;#O<^yJ{K}7jk8nQYJKYN3La}%A}9^17u3H%hp1u=r}7R#L#PV44$k{GRc2owJHM6ii4V&kEH7%4{6N8iVNTivv2<_OfS6vk$!-8sm{j9e7i=SF5t4y zuER4i#GZqJjP}XL2%bGPg?Df@FPe_VB7DQm3GfDP6_6-alUa3SIk!$Blw45uSg_O? z{3`%`=LrgmO8(~(mxrZa2shp{m({;s1I-?lGt85_vDG55!&to6Dh@CAW+VjRjHtv64^>^6a#Mvdy_@5VA?2brtSw@EVkbDz`s&M1)mOjEf!H=CBT1(? zTNTkpCDW6t*=&T8zOjd&Wlp2|b-MV0W?1zCa7wL2bHOfJ!FC3#P+hzLE9rf+x6nLR zDi>x3I3{I(f&GEI(p%o^27aA>dapTw(^g)r$!pCPinI<7<_$VAsL)d zO_0DRCq%iw+r?!;c~4B%OV=VlqWMs&>Mc!r@w)M?Q=*UsH=u_Pw8fnj7CZDa<8w`< zal9$fr3v@{p{fh|uN5QI1#$o%#<7Qj24f8H8nY|Ir2Z)D4}29F1)xFJ(u<6Q5#gkx z7fMXDr~PsAloU&YBm(``lg|4o{7zq{9bQ+1@XjFD*0w4ClCR|rGamHlt%FSUwS)H- z;XwLmhxS3p7f@Y%VU$>}E~Sfa6kdpgY@U$wy_x7~wJ{?9=nz}vM>^}kK3&Eq<7(-S zI_`JA5_NVP3WOEM^U5*4LaT(yhVIY;_H(HF{1e>So%?fIUX0p#$xd~(ZefhGJO^;ZB>nx>!sj9 z_GmtPPpH7%gKH~Gc^z@zeYCQ0ux0%C5E!ILfdQuK?QoS{YD5HHz0QV<42{N)hs=vj@x=F+uoHbW8*e``JXTBD&heuiHcU6x@P`SqpwDA8T?&b(-hC~)G=)3KCmTd*y+7l zSDGQgLebL9!cJH8l|(>_WVR;$=60VZkh0gH)XR^~sm5lJ)R;io1(#7b8L(+K%{g*0 z;NviZCUbiT)eCgzv0r8E8V$@=jqG;{MNooFeu z5|cgFgQQ+YNGhu$ zG2|T^Q_{Zai({sjyff*EF^L*NP8NL$R!6)$9I58mD^=7K}eLSJP9NlcO));W9Sz3ZQxRho+a-4Ch))A8J_;e z2WW^;<_0ttojU3&78~V)Lt`>qxWWA~IQGE~RknQjxiykPj)9Np_| zIXpQa<-A4XRf(49ZaD5Fs=U5jOnDJTsh|(624Hikl{Hazf0E}rQza}FPb<;jbFhO( zauc|%-mcJSG5CM3VYz+qh-Gl~S_H+CM%_3QkkxaZjitB4WdXm;o%4nig6})7)q`6> z>zjkG*=taV+OEXjSGhVQr+~e3q`vi=p}!^2!06&IQi2ZW6TX_tqmR_6-%kCXzr(|# zvI%=7pRov7mU5JFr8`V0IJBIa9NpuQht04tx=@|VkB^c$P#Y{#`I1zjypPS^vmNDk z2lW631DY716RKIF75=)>pCB=i$em3Tm4eG_l?yoqAO8;7(tS#W0EfLE*zayI&ug6V-@7_r zjCO>`b#+is8g-_q^Z)!PV5&?ucwp^sOT5~X=4H|@W2DSnsBk6X#4TuNa@rfqFk;KL zOv5OD64Ldpq!EOV9E6ZrTtARJCFOTp0<{f$=%J;pAwsNA0fT%y zjNi$ue`};#Ij&Zs-P1$O_3lWkP$po!T1Q|dm>!_YKBka`X9kpoiF2#Fb^rniqjqAo zesGz)5)Ptkh4+qcHrRRSBrtmi6Y>O-pN!YTUZg3)!Qlv)`NtB8YLb9KLQILSx z$sfv?(R^;Z*$K1{a-~sd_=g;nVI|EQ+xKTwYF~lk|s};uQz3DGM`0xX!PZj~S3HkUk zT=0uo_(Zg*WJ!yIi|<4k}+r^WuNki zVg3^0i7MMVuEHPpciW?rNG$>?RP$6+!UuIZa0wmM(Xpzg!W-(;;K=e~yvYb>e7-$` zpY)38vCg5Qf0Cas+=9X&oVl|Zo^O#!KhF5@1>&2{%!+e&<8u3l1)pNZMKspyW_^{I zfOBD~#&9LW^n2O%Ou75sGR37AN=ywb-a-23Py#Reeq<>2JhV4>9B1KHbDw$OntHDg zt3D}*$)y2YbPZKE**8=s(*c+*EssqUUQ&yPD1rb^p74i9Cw?dmRtZ`4x8dnW925?( z>jC`L`?T(uJ&cl%xq^b<`Sl+87HcXX5$3q6`)aRXr{2d%OY)SPVzv=R#1cr<^fpwL zLylop#pEPVsVGw>n?Bws^6ARcp)Oqm_n7%`%$_mAb9u&CN5pr@*Von24mg}t*t^E>viUJH;vY==!*MboMZP$%6~>`&=4pXMtOoJ zxjfPKN{QOB=_|8V;$ZGY=7$|}$JW!~>khnKl6k#Zc|q?`uhEuUQ3n)$BfWm0>8<4d zbm}Hep!gfwy-xzJ8|ei5`=YmxiJS=tI~DK;0)6`=KJyuv#2fPE;&ay*XqP-136+h- zaX_=e!ES$JDBe)6O?xVCE2Fz|rCU-#PmWkfUnG8MRZO6Dm0A^7LF^;` zac2oq98X{|DxQM9(d9ORL-#0o+V7mMq0{x_J|?NcO`*m#;=VUUBJ()lZiW|3(kEV+uFVcw{er1pP zL6_|D#fOmy5939aqwaH06&~bl2uz_$4QyqrKU=lz6*B^j8keG{55!taO7~gPNZ3*+ zJPo_rhldY7kdSZ>#m@{4eWfbj@SmtlHkp1ulo~va9ue7EM>vX2Lg!{kgV)MrWXn7@ z^wGdHkMa4z{?b5ux#)w;fn24`+-M2(2wv?AwpC5f_)Pt4>`2L5J!?0!OE+B1*9i5h zIrDhn=7Gk;4U(y6Ep6{_HlrRd;G=bY-6X46-jBy*G4_wU2|z|+EWhJ(7rG(3K~01| zyECJiFOcC3Ne~P}U(+i%65&-fyi3rw3T~RQ5qY>OPr2q7CPn^`V&>PnS5zIN<>!!Scp_=~VC({>33k{<(cvz>?xICQW@5o6| z+%JPL2Y*ml*0z7f=LiE-(d@_9Nl4#h;M;lP@9_W*b*H)7t^clT^~ZOu7|S0U z37x0NzA1vLptO~pAKXX*F(*1rAh>amYmcuiw3zCd+PnA^(oU9X7YPNd8O{C*)iQYb?TkKsf5Au@@}_z2Z8 zV_4!Exz7CZ=GM0~aeAu(WhtY{-GTTPtL_x0XHG*-Zf}+xBnOY(aBVW)C76oF@SwFi z8WpJo2_Ua*3g}OXxy#WO1xZ61jw##P&EaKZRqc-B6LPS4m?C$vowmw}^Tma7kYJm4@U84|-xDsem9H0DHRi?{<=0S= zkgD+P+H%_-TZ8rhfnh*JwrSvpORREOce`3Tn4)tOfj=jxg7%h%E=rg7s9R^vf3!zO zTx+>i!m!p)m02K3OT`Fj-)WMTq#7k(=f_@cM8lWqBCQG*uL`5!%a-k5&IOCP9Ro%h zgT$H&wg-Rw()o@IKzi|hV`NqMNSy91}Y3@ zrKh@?aXfH8QsW*l>(wUndZMDBRQvh1OUQZSOvuK*G9JJdB1#~-x2)fKd@Fqm0>XkWBekw`24jk7daPJYODy%r;-mqw!rc!-P59)DsW;A~7pfn~Q;|G8xRpN?r{|TWjm>|p*kBf;qMt=O_hvZJ?ML+T@prRi@~}lG zzEE1JGdW~;Xj%fIsJhWmd%kIlkL+dMM+6qAf5fF1YE@uG^ItA8`@sS+@s@B;$#8c6 zcK_x(zYcHb!LftAYV&*fFwx<3A{RMxk4)^fSbZaJkbbRBjq5Uo^PZ95rNrH^EhlV(lIykw6V#q zoM3%Q!V+wkhV77gA`v9}w+Zqu4&9u!Y`=F)W}hL=TiT)Njk!S6J7=5kAl(6R<3+8> z4D*%{ber|Q3{msiyPu+@X-9o|6?_d7oY%*`@e+WK<5){A4HWjf4Bfd(G$ZfKqY2~{ zdQmO=uz39@+@IQ&c?DuMwXFfo*cxS&-Qqd3S_FG2>aBr>lDX$W@#;A9=&v>3hVX8? z$u{srB`>-z#pLbexl&HOQ^esyd1KmMm~F`5@gyfZI$irl%eab;0qQdQ(^+Z}nb2*y zpGDNcI{V~;LE&aNyC}$Fm&Eoy9j)$<=fQzqVhFLTnb+exJqgK5{FVlaiX@Pdb~R;b zVer!34it&^Vtrg9W2dP1;;(s1;0;63WXgcY^;12n(R04 z?FPrie3NIKl3X93fy~FWHFRYT8w)8u`xFPZHBDaf$Y zChV$Lv#?P}To4;@AIkXUv^)r-FOvEmmr{dR|7&xOL?PSTPOH7KD^X7Ty?(Bffyo&W zaX3rYZdxSz7@bJPM2q7Rllj{QJixbKy-O>X*niW;=Et@IcwES!d-Lh-1;r6&2g>h_Jz(WUyG(NR$KJAJQiW9pJ+*i7z4mSCkYaLD z0{!n{S7S(|NWxUu!VkuU zdsU+zf19Ee2AQ*$fJajXR>NCw@14!YCzDCC^{dw}3C(OZu0>KmsIZtMao8gjHyO)~ zYy#~Bv+#Ehy_F8;HszkaFEj~HoY< z2n^MY2}{80gG;`H;vOu`L_mz1H+!=2>HA_%+QLiv)-NOxvasTX4V({e z`ph3DQb?v$8#o<4ZRNv6{)js`-po^QpKel7`h;KbyutPPO??qM(RtJ!o-xPFYK?w`o=^ z*>Mbn1EqwHHXgGfRq7?jja^$|YnsO%Z>-hK3gJ%mwHke`k`qw^5sk1~f`sM4pqsQ* z)Q(XV7;tqj9UXaZm0bQ&5Jkz7lPXXmJLK{O@i*-KTGx0ZVQNG)vY=%U&vN z+MX|ZlgqT`H*}Ezukx92riRw#jgPr)*i~@u%K{b7*~h6g1}+yr2XzaQUtDd^l+ds|{G?5PEEvsHI^wkjtLLRv?qZ;YX5I z|FKdR)>Zs5drt=+pwz*299x}AQu)U*2U3N|ns=n+6zZ{5^AED`K7BM&VQXsz&;*X> zMGv)mSE<90TW88ki>ab9E1aGXPApTKKU+(fI3&03U+9r2cf5UJMYx`=XO(>I2?L#U z5Z(S2@zI(=i~e+gu@4`XJz9eaVS_VKthw&IWMt(jH$8y-RqVzVU}RJ##(f$;9wGyr zZ4Nj3HXOFIF{ndt@zX9Ilk7F%Y!JYfdt#4~O-wtX%Yk>_o?vj`6eA3yL8TzX`KMmB z>(dYdCTSq$Q|j7al~DMBbcI;~XISDKX)35<_Vt_hb(nWF-p36!x?UY~o;pt07wv1k z->#eC_laEfR43Wd(QVAz3Z%NVo*ISJ#ATiB*;^PilDFA3KKWe4XM8aFF)77M z^Kphn5%TzTI|0!#-j;RHqY(e$zdwhh?+U>RUv50s9>1Bu`j9E4VuLK{fIBJ!TU!f` zVdfNp#kn9RQ&K`Gq~KosG#V3el<33ZNFZNrBrA=!Zjl<#NX4y}8WY4EhG(MJWw7Xp z?3!m&;vXHf*s4^v7~0Tzx2R?>v1Ie$(Ctx?b@e8@)1Ib~*Y~n6e~HQMYf143on8AP z2G=!T6J5b0VR+$>BlSKYWSPC`7{wqMHFrMs(&HLg*B0M6<~#y#wDD^;d(VPsF>!D< z=#i^AGc~qNl<3`+1;0ShUI~PlRP*(J91{Y>9jI?#3`kR&ZtyW!`Yzn@^|9;{gc9=@W$feO)0fW5+`oE;z{Rh;2;XffyuLT`q=Xxs4s;5CM6I z^f8d?d-O{-Hy^P2MCh1i6;E;jQa?t+Gq5xyysoP{B$S6Xp>*pms6B1SBYPH17Ymv; zJI{@KP}Y9gtiiTbqWdrqdqIx_u9x8qw&}#-QEnA;&+3RL@PMqbCaO>p%Y9L{-Y}CM z+vdf`H9k;eW^QR~Kjd9z0&gh1zW&a+USt~~IH*Rx3OTR=3Z_~i z2T3~bwpB~m)!1d^^T{;z+tJkqehfrzRdn3C?4;DsolBlB7OMAl`rOJR6hioqlV8Lx zo^PQ16wP2oMuz9NoP|JqXBo5wWtlpl|H>#P3rl~WA4xDh=+Tul; zx~E?ES`AHvZB+YXO#MVT&}?ZREP_yicGnsxNjR5-72%oO5P}F1ClN4|2 zVf#Prd#E$fO<+ZNlY4Tu%_qUjYV&6VP3`!R;Cy)9;EGaP(&kSBU6CU)XRD6n8n?p_ zr0tZy3?tQGet*H6NWL7=rZcU{Q0V5lTE%?3ZhO5Za+*A-C~|V$XOt^wYyH`@ZqP4! z*{J$=s0OIlTYoCD*Z#U(ckd{v*+(U0*@TZRqkUiO9mShtfjg07a`pHSn5(w;Bqe+P zVFPnR;^~Lz8X@rRfcgyxw{fril;@(~bN3}x#ffGp*YJphyahfdvo-#_Ap5$l?V3qP zvbjO18O9$7-W}=(vTI`OCGFA8E&he^QBJZ48)B>q@9w}&2K+Z^1a@kHb$4+F0gYkf z68KJUyU$De`X-=Y%&X=VePlxXv_2V^s`YPuO9v$~Xy;rJ&}@E;_-A0v9a2~``@ z8`&?OKX)1V-?+B|12*hH_Wpk8v9K_K9}2au3>>eGxYm`bNC`2g$o*jF>aKKJ9?idz z@#P1FCuPPxPV_&B5YVIWnZv#LIk(NiX>D{^dsV=U`R2{2+MjbI*qXxkaJnOfpHjP< z5Y4-C;tZnOi9FXgK$ak6QY@x~WPnnHPU)zB0No)<03R`_deuym&8g<#IF==9xF4tP ztVBmbvZYddcUPY|aEnnjGOJIsAy^_0E}*(gG9@#a^j8Z36QTZ<%KhALXz~AsF`r|c6fFNrh z%F|74!nPECo&gXQ{{MScnR>@e6PWsWR`2b5oGoTMA-{9t-s(3?Gr*fEfq(?WrgC48G zyBo`X=^aAi${|aC?+S=zuHGL&rafjz#)-ZJOBCr(T@I)ZvpTA@+ub`RmA~< z!lkB#t?2>mNRXq8biKugg0do?4nD3X<|OE0X)b2wvjZ6>`*3^CJWDsN*6Z!|(EtWc z%VD;q3e@adqU{Fa*la*OUc)>;l_TzRpeb=eC*VL1!T&%VCI$Z(2&sdl~Y zRrWTayVudo=Eby$g2%pWPkU>s?&C38T>{*Ax~TZk?~*tF8xdbGN7?inQGcs+K2ZuW zKW{qHpI4^WH01B=n}W`1HKcfPck+;QSDy%U(Ng$bSeB46_NoWo(9L$l%G~K%z&-PE z9|S9L1m88=%Ggltl^R0p(^+ubU(-qHf5bvLf$IkvGb(w?S=z5?GH<>~lazNl;T-+! z&3d}7x?>KiMBzB3A(fI9f6oKT2N*~)VTrHJ;rzo0yo_u{>-#i>Vh!mELWfPS=RgmU zk*XU`k#s);)>U)D#wK@_5BV4wgD&i>7b!ov`(uq-VE&dP(pke|MYf(jlb+$?cXiQo zQ=s@^4l-EIw*$JrwW8xQD*B!zij8RiA)DB}BCYw3Otr4m9YD~TWf3df0KGTe>nZ7% z&R7@UiJsJYeSayxNI5)_>sybC1(|&O!@U)aJg@YJI8jpRZl!bVNs%SiFd)P@f!IA# z>*dje&E?vPCnN9yXzKrO!v3$rs_=?IQ>ZxL(p8a%=a9>$2<+#voV?cs-63hvefK+8 zPuNzV(8&myb~*`oYDfjReu-AX&As`SY1+?yKl&n9kzj`BC$~SRKNFZJH+U>eI+GK| z)<-q?o&Eg$`t=$QTt@sJiHzX7R?U9>zHmw3_`6f+bf+jt|EvhE z7m?b-6ECg(1jq@b;<9M9+kJJ9)92W8b?1=?<-{dFAh)Ri2`_~ygdG=6!1Ew#43B)g zvbkp_V{c_3)KvuitaWfqL^xO}x+VaevrM{1B^pW4u&pZV$CUOHmPJu@w`_TtRIyG$ zYp_ku@2*;k!aZa%!q<9q{1 zi3}}o82>e^Z1Bqu2n3a$l-M2BKMn0no!*bz11cOR{3hpW8|^xqrk|HEF$d&%7*UYf zE}Q+3{~90ipf30yj1C;8IZDL06W#Z}x#T^_5Sil&dj9X4@W*#yJY?zcM0kMgNg4^W zN7OHfL5)4L*6X|25ze}B{e=@DZ5g=4FI831+wBJ>KT;>$fJTrfRR8ofp%XN~MFidV z9J3ie{kM_*->MEj_^zTc0^qX%v_TaC1XzYrAx(>w$gBV8dF34@oS+C{$fLvvY70GA z*qqW>iMeb+8U^xEX2F)3_^J1Gi$v(VX7CI+@^6)$`)kM{kTowW!ums;hD9a~>VQ2M zVWJ5j64SRY6UR3;#fmoc2;s4K0%~N}@nSZahG5Yp?9XuKS8o}LjY#CSlmMj;mn@7= zXYIxXXlDBTvMGFAnB)TLT6X8e?@vQ))jXd9{~Yj*%WMV`r$Fd>n59oB6z{7GZjXS^ zaq{<|ZhTM`<4(!EikU4P8*%}Y*hoSJ_ym90`=3?0j4u6&QuJc6snYJ!z+05&%`KQV z2_W}dnB}dAfkI7F-%Abz z@6W!^QOejX*vY(!6zHnConinmM&muUYdPqsip}RI{1PRR)5aj!uf3~_wfDGYweiHQ z>bS~LMs^=mxR^2d)0xp2FZ^ZgiCvU3b_;;gJfjbzC}Q4ek7LCn!Q{Pz2K%!xqvZHEmK}_5XM#orS%J&H0;2+%G5I)i1J@tu3H-kI(k{Zn{jJH>= zK5>eL0Ec^y9Em}f99$0h)q}jTd@}Fd?1Mv(ik!K*ai1K}`|Sb60b>KlDr+AfpG0=2 zYj0Aj6^y@n| z46RyBJ_XWuX~hqTh`*H>qMm4sLu&hJBI#FOzg5`kU4y(%eCNA4&RD0_WrbxjO@ymm z0|uXV2H08Gj5c1IvPQ>JGrMSp<78u=YPQZ8i{SQP0tI#sx)k{}YhhH`@C zdxQHO1qEf{wrAWfzxxj3Td#StN)VB6cPe-l1!)lzdChS_I;H&;OAq!LuV8jZSSyph z&wQ|u>|UX^#zjRXrV@~lg2Nb4$q<$0nwy$0}U^7;G#Z!>E7lF$y|v{77m@%N`)inV$sC0qgUgk4XGs(m79rq0&v{J}1%M1&S}HjxkTQc^~}}<&+B0DHNU6$SZ_qrX%yf%_FaP zeBrE4SVOTg?uVq7=^CY`CnU7D^WF>HR5aY^yIQRio|vyz z@S=0QMiSVF*>+LGcQYlzbHg`~1JBq-5NJ5VpK{w!Z$S0}PNxyh5Hc;Ffm@;WjTbN% zV3P6<3Jdci1NeGJzXDsX=la8`rtC69W17+?_7m7kAFLJyD_;s~w+I=9X(Yq#^I1-F zy-(Wo<-zS9XD3461(>ihoGWOCGsh)?FP=>wPJ-9E^4J$HEVkym6u`=x>dgFCxzYsO zL_pdq{h?v2yMWDg;=9jpTm^u5Ag{w|rK5iqqZ7R&EAxJ%0iasQ%2`M8206{XymPYK zt;eyJKCE}KEh z$}2b2yBGCy9HJu~lw4)RRnYqmJ*M-T9 zO4N<%37}+MCBFfW_+(xU2&Dm@k%M{Vtr< z91XIrW&e!fO=Y9og}>&KxcNwb<$*w#eWPNjo{<#n@7Iubm%d~|U`}G#3lNx0;4Ley z#l3$#-2?ESghXy@X^62z4adfm!|kDrgBW!tF#GPBQ-q)8)$-tN0JPCmBn>zs5XtC! z-Wr9;WmOERnlMU`P?3?Zp*gx&;DHZttGDpt3@gs!{2QT}bqS7R8??;1QqwLY7gP5i zq!o@MJBv#8Ts5McXKiJ=67~7viJq^Ij*iSK!^2Snct%Xqu3ktE<=&ClezP8`fECDq z3SxM2u;06x9{~r$XOUx=VuRg5*QT~BTeo9nm=7>mugv?}2!>k;SI-ICn9 zsfu%hoF6qb?3wE$Zvo^b6@Qaz_ez@W!ijHJc8=yzdAc1UAD~Wk?Q_^)@o#j7eNih;|SLOAfQgWpkBe)tsQ!7) zswwF5PI-I`g!j)_UtJ~YbHWnCLIk(8sfBswq+~LAw?Aw&`yr7w5 zOKbOi$DFvku5Oiq+7_8Q5!Ace}At za0`;Cfj}8;-4kD5H5}Ki8T8Kyf=Su(NfH^6q`(=YH@u=EB8tf&k++j6>q4@g%w1>f{u@W*mjYqjEao< zA{u$MvMla3C#HLx@w6K($hToiG#;!Ba}dMS^@8K8?nBjRIvEopZooP8zL{axMZ$XA z{iq&XV)NHQSC%pHFfVb!5rorrOyJu7r|X&sD=zQ`kToZVXAu52`Gl3M1VTl%MJlXTukSqi3cQyx&xPm zTvr&?yG;^BbGfj z;TXXQq@(Y89xfE4_nhV*9z~H-cyg^XnQu<EVqm$|o@ zkf+sscd+ihvhuS*5gKw79AN~~Z{Hrt`@S?06n$gbMJ~tFRtGNLpu@m7q2bT|Yd#Z5 zatZ9>Y;0_6SOH^I66r5rim@gd&B1wHr*FQ+5j>F|&5d@wYoAt}JN-^QE&{ohkTTDW z%&-b?yDU$|IGRmYKv`M&MC=eQ5tNjAdUP*6jejJZURI_GS7iN=Mem-P8X=0H#UYEp zgJUwm?+ck27cW{Ke#*Q2`}6+u_)AwP^E6o7)4X55e%)^sT|887{k39rc1;EnM|8g) zF69D(&Rg@omTw=rf23dLb)E1n%{&AxX@T8{5nE(QF|maN)3gCdepY+Pk#_k{gWw3) zV-Cubo7XKWsyos23SVLNmyI@KJ6;GE>lVOm zl5-p7>S}6fS*p|Z*0^=+R^cKCnfM>3hMHxdW)j}S6FM}ooCNuoS1bd7Ah5hf@$=)b zYAy&`>HX@s>bHzB)buN0cX=0LmY-@Pzbv;hSB$<;lbtFDCaErV?7^u{#6i$gGiZ}n)&2&vB!BXMzYmd}R;kAO62J`=rGBS=Hj=w>@11o6L@FKPEL zh;(U*Jpef__n&VEW8&g+AS1>b@g+x5I_$(>-3M`L$EuT)lQs)1USg-M(FfK@x>?P| z#g)kKQaC?e>c$+dlX$#OBe9U`vDO2j`Qg<=O-gJZA)mG6G4~(V3<>XT$8Tdxejm(e zuCUH0)bmt&|Ngy?*HgXI1`(#DJgNLcEy$q=?#@Jm2yIcKQYb%#oQzB#9Cf&ySJb&7 zYKz02JNV?u6M1Tf8aLByxw*g*z(Qd&15YG=zbAUpb9ZM(1r`}RTlc?$>IDC6sr<1aiXBYbbC0u1Oz`@3 z8By71eb04kJWAWT?~&Jez2T4b+3AsV|MheKt<&=TSWs-LDF4vAz6sN%ZtJ^XYJ=b}gT?@R{Sa<#pbBzF^o zw2$wxwH~?*z%Z^{E&s~-pdMkIw8iuDN9nL4N5D>$8->Z8JATgb&(hM008_@D$-OR= zn3R<7R(J5^S#)#_#f{6RkdWiLDB&X1SE*?)UcA_8!c#EoooUaf^g8B zp#g8=i~-x~jQLa#d0@)ztAvi3)3dP1*L?Qi{jsx{IhH-NT~IN0t?H^$F6oskSKh2! zGLMx?Ha9oRGchv{0Q^?uNqX~CM`!03pZGyhN5}%#y!4X#ueLUdpfiNr;UKE1aC|g> zqMb;gwQHi{yq!^2#_7aSbhsh>I1;{RUjXh;UUjuLTtVK~&`4NW zo1x1dDoxpJ?-B4jIB@-$G>o<|=CN)(XS>blMto}g`uV~nyi|`<4bjC!%jdOQwW8w_ zUuOoGbt)O(sxUaQ)4g>tby^xyg8e|zUOGfsR!UlW%hDh}JG(_nc4T(4e5gd|;nBN@ zU+;&EvQNb9_AsS`2HgiYCf(-}Odb2=c%HmNnWQ=0YnWhEB;wXjpQM3=rtquO-q_b2 zXXNt;W(Y1G-axsvmg&BeM|oR!d_0kO(p2(i4??X3y0y!5V|E-I{he5tJnKi*R?j{4 z*xDqMe5;K@<>=_lYD`>Ir(VTZSP>0O z_(;E)<0kHc0Eq@Z;4kmrwX*!p&NR21^c z%K9rXmH3g#FB5T?gl!WC?wN2f{=Fe>)WU{DNj5z)qFKP1gjNF^7l1`VDOc&fiBJ|J zLx$QxJcs#f92^|QWEoC>kJEe@r*-x`wI$mo^DDoO28wo)AS*In3RsLXD=X_32Zv;F z{w*J@zgC-0 ztkdZ~3ZKi`YoA0m zQQ&LFrDV1J?Q{NbTyOe_-VUezS>$IzA^s3)2Hw_LuQAn3GS3=c7MVK37|G(6O#b- z9skol0s@(t33hNgE*<5;2r~XM`&nsg&v~-v*;Pgzqobeu`&H%QZ+_4)7^@XUMv||sV`XK9e&B=X z>B&RsD{KgF!!2>WX^okcRZUknb*tloD7Zz~B@5{LUr{tA#m$GhGb(?qRdMy-V2xxS zzxCIfAdq}cHs!do_ODD#Og$&Aam29pNAEc_LGVtFsy;kU(MSMw>9~}Pvql99tdk~` z{W@bN=H_{&4wZ6tYs00jvpwBEZSlVjzemwPh9A-Nln$$5&Zp?PL|kW;%I->GC>E% z)Fu9mXjL|Jmh0lF%Jtcp3>-1RXzxEKK#6H}n~zU(_}m4vjr2R8z;_2shUG-`Xuv5C z1%5?2@!uYdioO_tj4X?y(W6HT*glHjhOD%RlKK$_g@yH7kN-&JxabfiWwZwXpm1+w zp&L7YPjX@^7^#=lM@IyZlKRWqK9gnRuZ`yQiUuaCQ7Q1;t?z8==;%;&b}qjVKRctL zp%D@sY~Ecu>VL)~Wy0$GfHW3ovG34fUbW0J4jh)U_GFh|n~{8wo*_tVJ?Um+L&Hu= zq0Yem-q!)R4$RqE7*@G_`Esp!l;&Tv00Ba>uty>I>afdM`s&X#U= zgXiq{@rD-U+AfYDz4an7kvLM!?dMH!+Xm>E<;JBH)B=W^a)6QDX>!{+Zfj#>V_E3q zmA{sF;rdLNYJz;l894XBrM~@Rg#(=Z#UQ3uh2(B@j=sLmy|OeRj@gDM7w^dF$Ax}< zX$*ql{Y+f<^5&8)I#c8t*b8I`vl7Hiw6(PrTZQM(ngQVR>{Rfs9^Olzn-aelzwek@ zklTG#rS@i8m)d=poYME^v=8UIoVjyTcHMeLZM(|*zkFE&9F6>YNJX61N&l2s-$Zi6 zMKvI4Yj-|3m(dh;ld+U`l;vW@__TpxiocPzXSG8FPg|S6KMLJj%bb@@VsAOxI>a1I z%Cq!-(VAWQ%MlQu-0*Rf-%h#Im@kijFDY?(u|kmtj}&E)kP!%c7$j&2cM%J%YJ$k* zQX~YT90P&CJNX~~_|g)!wQ)4Ianw_Fvom(kVR5y#I$c49%ggn7DAWtpUi_o*3{0U5P!341wrZMMA(ozkM3gG0=d7!2PWv1mfKKe^uEySsNJJo7Y zue^h!o7KNhaN3~N2t0EFu(`}R#Hq&n2$27^$RBTTx;%x=IlN(L^dXr4&kngt^j~>H zTkDhl_{RXJi>u-?;c7thHh&eTx{8c|UQo2RwR2!Kw6!<>->WnKHxK~}gfI(si8~pZ zA}9z1&L6LyNBmoHeLK7VmHvGgJ7Mh$R6*n4FPt96L!`fzHgs}uw6*?U1;01{N||n) z1`3A~BM?{qXugU3zn6D3GqyHn{pUN|Syga2(moo2Hz>h8ZGU3A|Fgf1qpH4v)&E)G z_jgF4Wg`!PzNNatbl SArQpyCk}qHGKPtO`2PSufGR%# literal 0 HcmV?d00001 diff --git a/5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.flat.json b/5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.flat.json new file mode 100644 index 0000000000..a17e83d3f0 --- /dev/null +++ b/5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.flat.json @@ -0,0 +1,3109 @@ +{ + "requirements": [ + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.1", + "section_name": "인코딩 및 데이터 정제 아키텍처", + "req_id": "V1.1.1", + "req_description": "입력값 검증은 오직 한 번만 표준 형태로 디코딩 되거나 언이스케이프 되어야 하며, 인코딩된 데이터가 예상될 때만 디코딩 되어야 한다. 이 과정은 입력이 추가로 처리되기 전에 완료되어야 한다. 예를 들어서 입력값 검증이나 데이터 정제 이후에는 수행되면 안 된다.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.1", + "section_name": "인코딩 및 데이터 정제 아키텍처", + "req_id": "V1.1.2", + "req_description": "애플리케이션이 출력값 인코딩 또는 이스케이핑을 인터프리터가 사용하기 전의 최종 단계로 수행하거나 인터프리터 자체에서 처리하는지 검증해야 한다.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.2", + "section_name": "인젝션(Injection) 방지", + "req_id": "V1.2.1", + "req_description": "HTTP 응답, HTML 문서 또는 XML 문서에 대한 출력값 인코딩이 해당 컨텍스트에 적절한지 검증해야 한다. 예를 들어, 메시지나 문서 구조가 변경되지 않도록 HTML 요소, HTML 속성, HTML 주석, CSS, HTTP 헤더 필드 등에 맞는 문맥별 문자 인코딩이 수행되어야 한다.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.2", + "section_name": "인젝션(Injection) 방지", + "req_id": "V1.2.2", + "req_description": "통합 자원 식별자(Uniform Resource Locator; URL)들을 동적으로 생성할 때 신뢰할 수 없는 데이터가 해당 컨텍스트에 맞게 인코딩되었는지 검증해야 한다(예: 쿼리나 경로 파라미터에 대한 URL 인코딩 또는 base64url 인코딩). 또한, 오직 안전한 URL 프로토콜만이 허용되는지 검증해야 한다(예: javascript: 또는 data:를 허용하지 않음).", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.2", + "section_name": "인젝션(Injection) 방지", + "req_id": "V1.2.3", + "req_description": "동적으로 자바스크립트 콘텐츠(JSON 포함)를 생성할 때 메시지나 문서 구조를 바꾸는 것을 방지하기 위해 출력값 인코딩이나 이스케이핑이 사용되고 있는지 검증해야 한다(자바스크립트 또는 JSON 인젝션을 피하기 위함).", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.2", + "section_name": "인젝션(Injection) 방지", + "req_id": "V1.2.4", + "req_description": "데이터 선택 혹은 데이터베이스 쿼리(예: SQL, HQL, NoSQL, Cypher)들 파라미터화된 쿼리, 객체 관계 매핑(Object Relational Mapping; ORM), 엔티티 프레임워크, 또는 다른 구조화된 쿼리 언어(Structured Query Language; SQL) 인젝션 및 기타 데이터베이스 인젝션 공격으로부터 보호해 주는 것들을 사용하는지 검증해야 한다. 이는 저장 프로시저를 쓸 때도 마찬가지이다.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.2", + "section_name": "인젝션(Injection) 방지", + "req_id": "V1.2.5", + "req_description": "애플리케이션이 운영체제(Operating System; OS) 명령 인젝션으로부터 보호되며 운영체제 호출 시 파라미터화된 OS 쿼리나 상황에 맞는 명령줄 출력값 인코딩을 사용하는지 검증해야 한다.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.2", + "section_name": "인젝션(Injection) 방지", + "req_id": "V1.2.6", + "req_description": "애플리케이션이 경량 디렉터리 접근 프로토콜(Lightweight Directory Access Protocol; LDAP) 인젝션 취약점에 대해 보호되어 있는지, 또는 LDAP 인젝션을 방지하기 위한 특정 보안 통제가 구현되어 있는지 검증해야 한다.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.2", + "section_name": "인젝션(Injection) 방지", + "req_id": "V1.2.7", + "req_description": "애플리케이션이 XPath 인젝션 공격을 쿼리 파라미터나 미리 컴파일된 쿼리들을 사용해 보호되고 있는지 검증해야 한다.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.2", + "section_name": "인젝션(Injection) 방지", + "req_id": "V1.2.8", + "req_description": "LaTeX 프로세서가 안전하게 구성되어 있으며(\"--shell-escape\" 플래그 비사용 등) LaTeX 인젝션 공격을 방지하기 위해 허용된 명령어 목록이 사용되고 있는지 검증해야 한다.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.2", + "section_name": "인젝션(Injection) 방지", + "req_id": "V1.2.9", + "req_description": "애플리케이션이 정규 표현식에서 특수 문자들을 메타 문자로 잘못 해석하는 것을 방지하기 위해 해당 문자들 이스케이프(보통 백슬래시를 사용)하고 있는지 검증해야 한다.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.2", + "section_name": "인젝션(Injection) 방지", + "req_id": "V1.2.10", + "req_description": "애플리케이션이 쉼표 구분 데이터(Comma Separated Values; CSV) 및 수식 인젝션에 대해 보호되어 있는지 검증해야 한다. 그리고 애플리케이션은 CSV 콘텐츠를 내보낼 때 RFC 4180 2.6과 2.7 부분에 명시된 이스케이핑 규칙을 반드시 따라야 한다. 또한 CSV나 다른 스프레드시트 포맷(XLS, XLSX, ODF 등)으로 내보낼 때 필드 값의 첫 번째가 특수 문자('=', '+', '-', '@', '\\t' (탭), '\\0' (null 문자) 포함)라면 반드시 작은따옴표로 이스케이프되어야 한다.", + "L": "3" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.3", + "section_name": "데이터 정제", + "req_id": "V1.3.1", + "req_description": "위지윅(WYSIWYG) 에디터나 이와 유사한 것으로부터 오는 모든 신뢰할 수 없는 HTML 입력들은 잘 알려지고 안전한 HTML 데이터 정제 라이브러리나 프레임워크 기능을 사용해 정제되는지 검증해야 한다.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.3", + "section_name": "데이터 정제", + "req_id": "V1.3.2", + "req_description": "애플리케이션이 eval() 또는 스프링 표현 언어(Spring Expression Language; SpEL) 등과 같은 동적 코드 실행 기능 사용을 피하고 있는지 검증해야 한다. 대안이 없는 경우, 실행 전에 포함되는 모든 사용자 입력이 반드시 정제되어야 한다.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.3", + "section_name": "데이터 정제", + "req_id": "V1.3.3", + "req_description": "잠재적으로 위험한 컨텍스트에 전달되는 데이터가 사전에 정제되어 안전 조치가 적용되는지 검증해야 한다. 예를 들어 해당 컨텍스트에서 안전한 문자만 허용하고 너무 긴 입력값은 잘라내는 등의 조치가 포함된다.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.3", + "section_name": "데이터 정제", + "req_id": "V1.3.4", + "req_description": "사용자로부터 제공된 확장 가능한 벡터 그래픽(Scalable Vector Graphics; SVG)의 스크립트 실행 가능 콘텐츠가 애플리케이션에 안전한 태그 및 속성(예: 그래픽 그리기)만 포함하도록 검증 또는 정제되는지 검증해야 한다. 예를 들어 스크립트나 foreignObject는 포함되면 안 된다.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.3", + "section_name": "데이터 정제", + "req_id": "V1.3.5", + "req_description": "애플리케이션이 사용자로부터 제공된 스크립트 실행 가능하거나 표현식 템플릿 언어(예: 마크다운, CSS, XSL 스타일시트, BBCode ) 콘텐츠를 정제하거나 비활성화하는지 검증해야 한다.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.3", + "section_name": "데이터 정제", + "req_id": "V1.3.6", + "req_description": "애플리케이션이 서버측 요청 위조(Server-side Request Forgery; SSRF) 공격으로부터 보호하기 위해 신뢰할 수 없는 데이터를 프로토콜, 도메인, 경로, 포트의 허용 목록과 대조해 검증하고 다른 서비스를 호출하기 전에 잠재적으로 위험한 문자를 정제(sanitization)하는지 검증해야 한다.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.3", + "section_name": "데이터 정제", + "req_id": "V1.3.7", + "req_description": "애플리케이션이 템플릿 인젝션 공격으로부터 보호하기 위해 신뢰할 수 없는 입력값을 기반으로 템플릿을 생성하지 않도록 하는지 검증해야 한다. 대안이 없는 경우에는 템플릿 생성 과정에서 동적으로 포함되는 모든 신뢰할 수 없는 입력값은 정제되거나 엄격히 검증되어야 한다.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.3", + "section_name": "데이터 정제", + "req_id": "V1.3.8", + "req_description": "애플리케이션이 자바 명명 및 디렉터리 인터페이스(Java Naming and Directory Interface; JNDI) 쿼리에서 신뢰할 수 없는 입력값을 사용하기 전에 적절히 정제하고 JNDI가 JNDI 인젝션 공격을 방지할 수 있도록 안전하게 구성되어 있는지 검증해야 한다.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.3", + "section_name": "데이터 정제", + "req_id": "V1.3.9", + "req_description": "인젝션을 방지하기 위해 애플리케이션이 메모리 캐시(memcache)에 콘텐츠를 전달하기 전에 해당 데이터를 정제하는지 검증해야 한다. ", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.3", + "section_name": "데이터 정제", + "req_id": "V1.3.10", + "req_description": "사용 시 예상치 못하거나 악의적인 방식으로 작동할 수 있는 포맷 스트링(format string)들은 처리되기 전에 정제되는지 검증해야 한다.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.3", + "section_name": "데이터 정제", + "req_id": "V1.3.11", + "req_description": "간이 전자 우편 전송 프로토콜(Simple Mail Transfer Protocol; SMTP)이나 인터넷 메시지 액세스 프로토콜(Internet Message Access Protocol; IMAP) 인젝션으로부터 보호하기 위해 애플리케이션이 사용자 입력을 메일 시스템으로 보내기 전에 정제를 하는지 검증해야 한다.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.3", + "section_name": "데이터 정제", + "req_id": "V1.3.12", + "req_description": "정규 표현식에 지수형 백트래킹을 유발하는 요소가 없는지, 또한 신뢰할 수 없는 입력값을 정제하여 정규식 기반 서비스 거부 공격(Regular Expression Denial of Service; ReDoS) 또는 런어웨이(Runaway) 정규식 공격을 방지하는지 검증해야 한다.", + "L": "3" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.4", + "section_name": "메모리, 스트링, 비관리 코드", + "req_id": "V1.4.1", + "req_description": "애플리케이션이 스택, 버퍼, 또는 힙 오버플로를 탐지하거나 방지하기 위해 메모리 안전 문자열, 안전한 메모리 복사 및 포인터 산술을 사용하는지 검증해야 한다.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.4", + "section_name": "메모리, 스트링, 비관리 코드", + "req_id": "V1.4.2", + "req_description": "정수 오버플로를 방지하기 위해 부호 확인, 범위 검사, 입력값 검증 등의 기법이 사용되고 있는지 검증해야 한다.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.4", + "section_name": "메모리, 스트링, 비관리 코드", + "req_id": "V1.4.3", + "req_description": "댕글링 포인터(dangling pointer)나 해체 후 사용(Use After Free; UAF) 취약점을 방지하기 위해 동적으로 할당된 메모리와 자원이 적절히 해제되었는지 그리고 해제된 메모리를 참조하는 포인터나 참조가 제거되었거나 null로 설정되었는지를 검증해야 한다.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.5", + "section_name": "안전한 역직렬화", + "req_id": "V1.5.1", + "req_description": "애플리케이션이 확장 가능한 마크업 언어(eXtensible Markup Language; XML) 파서(parser)를 제한적인 설정으로 구성하고 외부 엔티티 해석과 같은 안전하지 않은 기능을 비활성화하여 XML 외부 엔티티(XML eXternal Entity; XXE) 공격을 방지하는지 검증해야 한다.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.5", + "section_name": "안전한 역직렬화", + "req_id": "V1.5.2", + "req_description": "역직렬화 공격을 방지하기 위해 신뢰할 수 없는 데이터의 역직렬화 시 객체 타입 허용 목록 사용 또는 클라이언트 정의 객체 타입 제한과 같은 안전한 입력 처리 방식이 적용되는지 검증해야 한다. 또한 명확히 안전하지 않은 것으로 지정된 역직렬화 메커니즘은 신뢰할 수 없는 입력에 대해 반드시 사용해서는 안 된다.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.5", + "section_name": "안전한 역직렬화", + "req_id": "V1.5.3", + "req_description": "애플리케이션에서 동일한 데이터 타입(예: JSON 파서, XML 파서, URL 파서)에 대해 사용되는 서로 다른 파서들이 일관된 방식으로 파싱(parsing)을 수행하고 동일한 문자 인코딩 방식을 사용하는지 검증해야 한다. 이를 통해 JSON 상호운용 취약점이나 원격 파일 포함(Remote File Inclusion; RFI) 및 SSRF 공격에서 악용될 수 있는 서로 다른 URI 또는 파일 파싱 동작 문제를 방지할 수 있다.", + "L": "3" + }, + { + "chapter_id": "V2", + "chapter_name": "유효성 검증 및 비즈니스 로직", + "section_id": "V2.1", + "section_name": "유효성 검증 및 비즈니스 로직 문서화", + "req_id": "V2.1.1", + "req_description": "애플리케이션 문서에 데이터 항목이 예상되는 구조에 부합하는지 확인하는 입력값 유효성 검증 규칙이 정의되어 있는지 확인한다. 이는 신용카드 번호, 이메일 주소, 전화번호와 같은 일반적인 데이터 형식일 수도 있고, 내부적으로 사용하는 데이터 형식일 수도 있다.", + "L": "1" + }, + { + "chapter_id": "V2", + "chapter_name": "유효성 검증 및 비즈니스 로직", + "section_id": "V2.1", + "section_name": "유효성 검증 및 비즈니스 로직 문서화", + "req_id": "V2.1.2", + "req_description": "애플리케이션 문서에 연관된 데이터 항목들 간의 논리적, 문맥적 일관성을 검증하는 방법이 정의되어 있는지 검증한다. 예를 들어서 세부 주소와 우편번호가 서로 일치하는지 확인하는 경우가 이에 해당한다.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "유효성 검증 및 비즈니스 로직", + "section_id": "V2.1", + "section_name": "유효성 검증 및 비즈니스 로직 문서화", + "req_id": "V2.1.3", + "req_description": "비즈니스 로직의 제한사항 및 유효성 검증에 대한 요구사항이 사용자별 기준과 애플리케이션 전체에 적용되는 전역적 기준을 모두 포함하여 문서화되어 있는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "유효성 검증 및 비즈니스 로직", + "section_id": "V2.2", + "section_name": "입력값 검증", + "req_id": "V2.2.1", + "req_description": "입력값에 대한 비즈니스 또는 기능적인 기대치를 충족하기 위해서 입력값의 유효성을 검증해야 한다. 이는 허용 값, 패턴 및 범위 목록에 대한 긍정적 검증을 사용하거나, 미리 정의된 규칙에 따라 입력값을 예상 구조 및 논리적 한계와 비교하여 검증해야 한다. L1의 경우, 특정 비즈니스 또는 보안 결정을 내리는 데 초점을 맞출 수 있다. L2 이상의 경우에는 모든 입력값에 적용해야 한다.", + "L": "1" + }, + { + "chapter_id": "V2", + "chapter_name": "유효성 검증 및 비즈니스 로직", + "section_id": "V2.2", + "section_name": "입력값 검증", + "req_id": "V2.2.2", + "req_description": "애플리케이션이 신뢰할 수 있는 서비스 계층에서 입력값 유효성 검사를 시행하도록 설계되었는지 확인해야 한다. 클라이언트 측 유효성 검사는 사용성을 향상시키므로 권장해야 하지만, 보안 제어 수단으로 의존해서는 안된다.", + "L": "1" + }, + { + "chapter_id": "V2", + "chapter_name": "유효성 검증 및 비즈니스 로직", + "section_id": "V2.2", + "section_name": "입력값 검증", + "req_id": "V2.2.3", + "req_description": "사전 정의된 규칙에 따라 관련 데이터 항목의 조합이 합리적인지 애플리케이션에서 확인해야 한다.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "유효성 검증 및 비즈니스 로직", + "section_id": "V2.3", + "section_name": "비즈니스 로직 보안", + "req_id": "V2.3.1", + "req_description": "애플리케이션이 예상되는 순차적 단계 순서에 따라 동일한 사용자에 대한 비즈니스 로직 흐름만 처리하고 단계를 건너뛰지 않는지 확인한다.", + "L": "1" + }, + { + "chapter_id": "V2", + "chapter_name": "유효성 검증 및 비즈니스 로직", + "section_id": "V2.3", + "section_name": "비즈니스 로직 보안", + "req_id": "V2.3.2", + "req_description": "비즈니스 로직 결함이 악용되는 것을 방지하기 위해서 애플리케이션 문서에 따라 비즈니스 로직 제한이 구현되었는지 확인한다.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "유효성 검증 및 비즈니스 로직", + "section_id": "V2.3", + "section_name": "비즈니스 로직 보안", + "req_id": "V2.3.3", + "req_description": "비즈니스 로직 수준에서 트랜잭션이 사용되고 있는지 확인하여 비즈니스 로직 작업이 완전히 성공하거나 이전의 올바른 상태로 롤백되는지 확인한다.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "유효성 검증 및 비즈니스 로직", + "section_id": "V2.3", + "section_name": "비즈니스 로직 보안", + "req_id": "V2.3.4", + "req_description": "제한된 양의 리소스(ex. 극장 좌석이나 배송 시간대)가 애플리케이션의 로직을 조작하여 이중으로 예약되는 것을 방지하기 위해서 비즈니스 로직 수준 잠금 메커니즘이 사용되는지 확인한다.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "유효성 검증 및 비즈니스 로직", + "section_id": "V2.3", + "section_name": "비즈니스 로직 보안", + "req_id": "V2.3.5", + "req_description": "핵심적인 비즈니스 로직 흐름에 무단 또는 우발적인 행위를 방지하기 위해서 다중 사용자 승인이 필요한지 확인해야 한다. 이는 거액 자금 이체, 계약 승인, 기밀 정보 접근, 제조 과정의 안전 무시 등이 포함될 수 있지만, 이에 국한되지는 않는다.", + "L": "3" + }, + { + "chapter_id": "V2", + "chapter_name": "유효성 검증 및 비즈니스 로직", + "section_id": "V2.4", + "section_name": "자동화 방지", + "req_id": "V2.4.1", + "req_description": "데이터 유출, 더미 데이터 생성, 할당량 소진, 속도 제한 위반, 서비스 거부(DoS), 핵심적인 리소스의 과다 사용으로 이어질 수 있는 애플리케이션 기능에 대한 과도한 호출을 방어하기 위해, 자동화 방지 제어 기능이 구현되어 있는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "유효성 검증 및 비즈니스 로직", + "section_id": "V2.4", + "section_name": "자동화 방지", + "req_id": "V2.4.2", + "req_description": "비즈니스 로직의 각 단계가 실제 사람이 수행하는 데 필요한 현실적인 시간을 요구하여, 비정상적으로 빠른 속도의 트랜잭션 제출을 방지하는지 검증한다.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.1", + "section_name": "웹 프론트엔드 보안 문서", + "req_id": "V3.1.1", + "req_description": "애플리케이션 공식 문서에서 애플리케이션이 반드시 지원해야 하는, 예상되는 보안 특징들을 서술하고 있는지 확인한다. (예: HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP), 그리고 다른 관련된 HTTP 보안 메커니즘들). 또한 문서에서 앞선 특징들(유저에게나 경고하거나 접속을 막는 등의)이 유효하지 않을 때 애플리케이션이 어떻게 행동하는지 반드시 정의해야 한다.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.2", + "section_name": "의도하지 않은 콘텐츠 접근", + "req_id": "V3.2.1", + "req_description": "브라우저가 HTTP 응답에 대해 콘텐츠나 기능을 불러올 때, 의도하지 않은 상황이 보안적으로 통제되고 있는지 확인한다(예: API, 유저가 올린 파일, 혹은 다른 리소스에 직접 접근 시). Content-Security-Policy 헤더 필드의 샌드박스 지시어를 사용하거나, Content-Disposition 헤더 필드 내의 attachment disposition 타입을 사용하는 등으로, 불필요한 HTTP 요청 헤더 필드 (Sec-Fetch-* 와 같은)를 제공하지 않을 수 있다.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.2", + "section_name": "의도하지 않은 콘텐츠 접근", + "req_id": "V3.2.2", + "req_description": "콘텐츠가 HTML로 렌더링되지 않고 텍스트로 표시되도록 하여, HTML이나 JavaScript 등의 의도하지 않은 실행을 방지하는 안전한 렌더링 함수(예: createTextNode, textContent)를 사용하는지 확인한다.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.2", + "section_name": "의도하지 않은 콘텐츠 접근", + "req_id": "V3.2.3", + "req_description": "애플리케이션이 클라이언트 사이드 JavaScript를 사용할 때, 명시적 변수 사용, 엄격한 타입 검사, 문서에서의 전역 변수 저장 지양, 그리고 네임스페이스 격리 구현 등으로 DOM 클로버링을 막고 있음을 확인한다.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.3", + "section_name": "쿠키 설정", + "req_id": "V3.3.1", + "req_description": "쿠키가 'Secure' 속성을 가지며, 쿠키 이름에 '\\__Host-' 접두사가 사용되지 않았고, '__Secure-' 접두사를 사용했는지 확인한다.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.3", + "section_name": "쿠키 설정", + "req_id": "V3.3.2", + "req_description": "UI redress 공격, 그리고 CSRF라 알려진 브라우저 기반 요청 위조 공격들에 대한 노출을 제한하기 위해 각 쿠키의 'SameSite' 속성 값이 쿠키의 목적에 맞게 설정되어 있는지 확인한다.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.3", + "section_name": "쿠키 설정", + "req_id": "V3.3.3", + "req_description": "다른 호스트들과 명시적으로 공유되는 쿠키에 대해서, '__Host-' 접두사를 가지고 있는지 확인한다.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.3", + "section_name": "쿠키 설정", + "req_id": "V3.3.4", + "req_description": "클라이언트 측 스크립트에서 쿠키의 값에 접근이 가능한 걸 의도하지 않았다면(세션 토큰 등), 쿠키는 반드시 'HttpOnly' 속성을 가져야 하고, 반드시 'Set-Cookie' 헤더 필드를 통해 클라이언트에게 전달돼야 한다.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.3", + "section_name": "쿠키 설정", + "req_id": "V3.3.5", + "req_description": "애플리케이션이 쿠키를 만들 때, 쿠키 이름과 값의 길이 합이 4096바이트를 넘지 않는지 확인한다. 너무 큰 쿠키는 브라우저에 저장되지 않으며, 요청 전달도 안되고, 해당 쿠키에 의존하는 애플리케이션 기능을 사용하지 못하게 된다.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.4", + "section_name": "브라우저 보안 메커니즘 헤더", + "req_id": "V3.4.1", + "req_description": "이 섹션에서는 애플리케이션의 응답을 처리할 때 브라우저의 보안 기능과, 제한 사항을 활성화하기 위해 HTTP 응답에 설정해야 하는 보안 헤더를 설명한다.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.4", + "section_name": "브라우저 보안 메커니즘 헤더", + "req_id": "V3.4.2", + "req_description": "교차 출처 리소스 공유(CORS)의 Access-Control-Allow-Origin 헤더 필드가 애플리케이션의 고정 값인지 확인한다. 만약 출처 Origin HTTP 요청 헤더 필드 값을 사용하고 있다면, 신뢰할 수 있는 출처 목록으로 검증한다. 'Access-Control-Allow-Origin: *' 사용이 필요할 때엔, 응답이 민감한 정보를 포함하지 않는지 확인한다.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.4", + "section_name": "브라우저 보안 메커니즘 헤더", + "req_id": "V3.4.3", + "req_description": "HTTP 응답이 Content-Security-Policy 응답 헤더 필드를 가지고 있는지 확인한다. 이는 브라우저가 신뢰하는 콘텐츠나 리소스만 불러오고 실행하도록 하고, 위험한 JavaScript의 실행을 제한한다. 최소한, object-src 'none' 과 base-uri 'none'이라는 지침, 그리고 허용 목록을 정의하거나 논스, 해쉬의 사용을 포함한다는 전역 정책은 반드시 사용돼야 한다. 3계층 애플리케이션의 경우에는, 논스나 해쉬가 적용된 응답별 정책이 반드시 정의돼야 한다.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.4", + "section_name": "브라우저 보안 메커니즘 헤더", + "req_id": "V3.4.4", + "req_description": "모든 HTTP 응답이 'X-Content-Type-Options: nosniff' 헤더 필드를 포함하는지 확인해야 한다. 이는 브라우저들이 주어진 응답에 대해 콘텐츠 스니핑과 MIME 타입 추측을 하지 않도록, 응답의 Content-Type 헤더 필드 값을 목적지 리소스와 일치하도록 지시한다. 예를 들어서, 응답의 Content-Type이 'text/css'인 스타일만 허용된다고 치자. 이는 기능적으로 브라우저의 Cross-Origin Read Blocking (CORB) 사용 또한 활성화시킨다.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.4", + "section_name": "브라우저 보안 메커니즘 헤더", + "req_id": "V3.4.5", + "req_description": "'Referer' HTTP 요청 헤더 필드를 통해 제 3자 서비스들에 기술적으로 민감한 정보 누출을 막기 위해, 애플리케이션에서 리퍼러 정책을 설정했는지 확인해야 한다. 이는 Referrer-Policy HTTP 응답 헤더 필드나 HTML 속성 항목을 통해 설정할 수 있다. 민감한 데이터는 URL에 있는 경로나 쿼리 데이터, 그리고 내부 비공개 애플리케이션의 경우 hostname도 포함된다.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.4", + "section_name": "브라우저 보안 메커니즘 헤더", + "req_id": "V3.4.6", + "req_description": "웹 애플리케이션이 Content-Security-Policy 헤더 필드의 frame-ancestors를 사용해 모든 HTTP 응답들에 대해 기본적으로 내부 삽입을 할 수 없고, 필요할 때만 특정 리소스에 대해 내부 삽입을 허용하도록 확인한다. X-Frame-Options 헤더 필드가 브라우저에서 지원되더라도, 오래돼서 신뢰할 수 없음을 알아야 한다.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.4", + "section_name": "브라우저 보안 메커니즘 헤더", + "req_id": "V3.4.7", + "req_description": "Content-Security-Policy 헤더 필드에 위반 사항을 보고할 영역이 특정되어 있는지 확인해야 한다.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.4", + "section_name": "브라우저 보안 메커니즘 헤더", + "req_id": "V3.4.8", + "req_description": "문서 렌더링을 시작하는 모든 HTTP 요청(Content-Type text/html과 같은 응답)에 same-origin 지시어나 same-origin-allow-popups이 있는 Cross‑Origin‑Opener‑Policy 헤더 필드를 포함하는지 확인해야 한다. 이는 탭내빙(tabnabbing) 및 프레임 카운팅과 같은 Window 객체에 대한 공유 액세스를 악용하는 공격을 방지할 수 있다.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.5", + "section_name": "브라우저 출처 구분", + "req_id": "V3.5.1", + "req_description": "애플리케이션이 허용되지 않은 교차 출처 요청을 통한 민감한 기능의 사용을 막기 위해 CORS preflight 메커니즘에 의존하지 않는지 확인하고, 이런 요청이 애플리케이션 자체에서 시작된건지 증명해야 한다. 이는 anti-forgery 토큰의 사용과 증명이나 CORS-safelisted 요청 헤더 필드가 아닌 확장 HTTP 헤더 필드를 요구하는 것으로 가능하다. 사이트 간 요청 위조 공격(CSRF)으로 알려진 브라우저 기반의 요청 위조 공격에 대한 방어다.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.5", + "section_name": "브라우저 출처 구분", + "req_id": "V3.5.2", + "req_description": "애플리케이션이 민감한 기능의 허용되지 않은 교차 출처 사용을 막기 위해 CORS preflight 메커니즘에 의존하고 있다면, CORS preflight 요청을 작동하지 않는 요청을 호출할 수 있는지 확인해야 한다. 이는 'Origin'과 'Content-Type' 요청 헤더 필드 값을 확인하거나 CORS-safelisted 헤더 필드가 아닌 확장 필드 사용에 대한 확인이 필요하다.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.5", + "section_name": "브라우저 출처 구분", + "req_id": "V3.5.3", + "req_description": "민감한 기능이 HTTP 요청으로 POST, PUT, PATCH, DELETE와 같은 적절한 HTTP 방식을 사용하는지, HEAD, OPTIONS, 또는 GET처럼 HTTP 사양이 \"안전\"으로 정의되지 않는 방식을 사용하는지 확인한다. 또는 Sec-Fetch-* 요청 헤더 필드의 엄격한 검증을 사용하여 요청이 부적절한 교차 출처 호출, 탐색 요청 또는 이미지 소스와 같은 리소스 로드에서 발생하지 않았는지 확인할 수 있다.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.5", + "section_name": "브라우저 출처 구분", + "req_id": "V3.5.4", + "req_description": "서로 다른 호스트 이름에 별도의 애플리케이션이 호스팅되어 있는지 확인하여 동일한 출처 정책에서 제공하는 제한 사항을 활용한다. 여기에는 한 출처에서 불러온 문서나 스크립트가 다른 출처의 리소스와 상호 작용할 수 있는 방법과 쿠키에서의 호스트 이름 기반 제한 사항이 포함된다.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.5", + "section_name": "브라우저 출처 구분", + "req_id": "V3.5.5", + "req_description": "postMessage 인터페이스를 통해 수신한 메시지의 출처를 신뢰할 수 없거나, 구문이 유효하지 않은 경우, 수신한 메시지가 폐기되는지 확인한다.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.5", + "section_name": "브라우저 출처 구분", + "req_id": "V3.5.6", + "req_description": "Cross-Site Script Inclusion (XSSI) 공격을 피하기 위해, 애플리케이션 아무 곳에서나 JSONP 기능이 활성화되지 않는지 확인한다.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.5", + "section_name": "브라우저 출처 구분", + "req_id": "V3.5.7", + "req_description": "Cross-Site Script Inclusion (XSSI) 공격을 방지하기 위해 JavaScript 파일과 같은 스크립트 리소스 응답에 승인이 필요한 데이터가 포함되지 않았는지 확인한다.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.5", + "section_name": "브라우저 출처 구분", + "req_id": "V3.5.8", + "req_description": "인증된 리소스(예: 이미지, 비디오, 스크립트 및 기타 문서)가 의도된 경우에만 사용자를 대신하여 불러와지거나 내장될 수 있는지 확인한다. 이는 Sec-Fetch-* HTTP 요청 헤더 필드를 엄격하게 검증하여 요청이 부적절한 교차 출처 호출에서 발생하지 않았는지 확인하거나 브라우저에 반환된 콘텐츠를 차단하도록 지시하는 제한적인 교차 출처 리소스 정책 HTTP 응답 헤더 필드를 설정하여 달성할 수 있다.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.6", + "section_name": "외부 리소스 무결성", + "req_id": "V3.6.1", + "req_description": "클라이언트 측 자산(예: JavaScript 라이브러리, CSS 또는 웹 폰트)이 정적이고 버전이 지정된 경우에만 외부(예: 콘텐츠 전송 네트워크)로만 호스팅되는지 확인하고, 하위 리소스 무결성(SRI)을 사용하여 자산의 무결성을 검증한다. 이것이 불가능하다면 각 리소스에 대해 이를 정당화하기 위해 문서화된 보안 결정이 필요하다.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.7", + "section_name": "다른 브라우저 보안 고려사항", + "req_id": "V3.7.1", + "req_description": "애플리케이션이 여전히 지원되고 안전하다고 간주되는 클라이언트 측 기술만 사용하는지 확인한다. 이 요구 사항을 충족하지 않는 기술의 예로는 NSAPI 플러그인, Flash, Shockwave, ActiveX, Silverlight, NACL 또는 클라이언트 측 Java applets가 있다.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.7", + "section_name": "다른 브라우저 보안 고려사항", + "req_id": "V3.7.2", + "req_description": "애플리케이션이 사용자를 통제하지 못하는 다른 호스트 이름이나 도메인으로 자동으로 리다이렉션할 때, 허용된 목적지로만 리다이렉션 하는지 확인한다.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.7", + "section_name": "다른 브라우저 보안 고려사항", + "req_id": "V3.7.3", + "req_description": "사용자가 애플리케이션의 통제 범위를 벗어난 URL로 리다이렉션 될 때 이를 취소할 수 있는 옵션이 있는 알림이 애플리케이션에 표시되는지 확인한다.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.7", + "section_name": "다른 브라우저 보안 고려사항", + "req_id": "V3.7.4", + "req_description": "애플리케이션의 최상위 도메인(예: site.tld)가 공공 HSTS preload 목록에 추가되었는지 확인한다. 이렇게 하면 애플리케이션에 TLS를 사용하는 것이 Strict-Transport-Security 응답 헤더 필드에만 의존하지 않고 메인 브라우저에 직접 내장된다.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.7", + "section_name": "다른 브라우저 보안 고려사항", + "req_id": "V3.7.5", + "req_description": "애플리케이션에 접근하는 브라우저가 예상한 보안 특징을 가지고 있지 않은 경우, 애플리케이션이 문서에 명시된 대로 동작하는지 확인한다 (유저에게 경고하거나 접근을 차단하는 등).", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API 와 WEB 서비스", + "section_id": "V4.1", + "section_name": "일반적인 웹 서비스 보안", + "req_id": "V4.1.1", + "req_description": "메세지 본문이 포함된 모든 HTTP 응답에는 실제 내용과 일치하는 Content-Type 헤더 필드가 포함되어 있는지 검증한다. 이때 IANA 미디어 타입(text, /+xml, /xml 등)에 따라 안전한 문자 인코딩 (ex. UTF-8, ISO-8859-1)을 지정하는 charset 파라미터도 포함되어야 한다.", + "L": "1" + }, + { + "chapter_id": "V4", + "chapter_name": "API 와 WEB 서비스", + "section_id": "V4.1", + "section_name": "일반적인 웹 서비스 보안", + "req_id": "V4.1.2", + "req_description": "사용자가 대면하는 엔드포인트(사람이 직접 웹 브라우저에 접속하는 경우)만 HTTP에서 HTTPS로 자동 리디렉션하고, 그 외에 서비스나 API 엔드포인트는 명백한 리디렉션을 구현하지 않았는지 검증한다. 이는 클라이언트가 실수로 암호화되지 않은 HTTP 요청을 보내고 있음에도, 요청이 자동으로 HTTPS로 리디렉션되어 민감한 데이터의 유출 사실을 발견하지 못하게 되는 상황을 방지하기 위함이다.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API 와 WEB 서비스", + "section_id": "V4.1", + "section_name": "일반적인 웹 서비스 보안", + "req_id": "V4.1.3", + "req_description": "로드 밸런서, 웹 프록시, 백엔드-프론트엔드 서비스 등 중간 계층에서 설정되며, 애플리케이션에서 사용하는 모든 HTTP 헤더 필드를 사용자가 재정의할 수 없는지 확인한다. 예를 들어 X-Real-IP, X-Frowarded-*, X-User-ID 등의 헤더가 포함될 수 있다.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API 와 WEB 서비스", + "section_id": "V4.1", + "section_name": "일반적인 웹 서비스 보안", + "req_id": "V4.1.4", + "req_description": "애플리케이션이나 API에서 명시적으로 지원하는 HTTP 메서드(프리플라이트 요청 시에 OPTIONS 포함)만 사용할 수 있으며, 사용되지 않는 메서드는 차단되어 있는지 확인한다.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API 와 WEB 서비스", + "section_id": "V4.1", + "section_name": "일반적인 웹 서비스 보안", + "req_id": "V4.1.5", + "req_description": "매우 민감하거나 여러 시스템을 거치는 요청이나 거래에 대한 전송 계층 보호에 더하여 메세지별 디지털 서명들을 사용함으로써 추가적인 보증을 제공하는지 확인한다.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API 와 WEB 서비스", + "section_id": "V4.2", + "section_name": "HTTP 메세지 구조 검증", + "req_id": "V4.2.1", + "req_description": "모든 애플리케이션 구성 요소(로드 밸런서, 방화벽, 애플리케이션 서버 포함)가 HTTP 요청 smuggling을 예방하는 HTTP 버전의 적합한 메커니즘을 사용하는지에 대해, 수신되는 HTTP 메세지의 끝을 결정하는지 확인한다. HTTP/1.x에서 Transfer-encoding 헤더 필드가 있는 경우에 RFC 2616에 따라서 Content-Length 헤더는 무시해야 한다. HTTP/2 또는 HTTP/3를 사용할 때 Content-Length 헤더 필드가 있는 경우에 수신기는 DATA 프레임의 길이와 일치하는지 확인해야 한다.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API 와 WEB 서비스", + "section_id": "V4.2", + "section_name": "HTTP 메세지 구조 검증", + "req_id": "V4.2.2", + "req_description": "HTTP 메세지를 생성할 때, 요청 smuggling 공격을 예방하기 위해서 HTTP 프로토콜의 프레이밍 방식에 의해 결정된 Content의 길이와 Content-Length 헤더 필드가 충돌하지 않는지 확인한다. ", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API 와 WEB 서비스", + "section_id": "V4.2", + "section_name": "HTTP 메세지 구조 검증", + "req_id": "V4.2.3", + "req_description": "응답 분할 및 헤더 인젝션 공격을 예방하기 위해서 애플리케이션이 Transfer-encoding과 같은 connection-specific 헤더 필드를 가진 HTTP/2또는 HTTP/3 메세지를 전송하거나 수락하지 않는지 확인한다.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API 와 WEB 서비스", + "section_id": "V4.2", + "section_name": "HTTP 메세지 구조 검증", + "req_id": "V4.2.4", + "req_description": "헤더 인젝션 공격을 예방하기 위해서, 애플리케이션이 헤더 이름과 값에 CR(\\r), LF(\\n), CRLF(\\r\\n)과 같은 줄바꿈 문자가 포함되어 있지 않은 HTTP/2 및 HTTP/3 요청만 허용하는지 확인한다.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API 와 WEB 서비스", + "section_id": "V4.2", + "section_name": "HTTP 메세지 구조 검증", + "req_id": "V4.2.5", + "req_description": "애플리케이션(백엔드 또는 프론트엔드)이 요청을 빌드하고 전송하는 경우, 수신 구성 요소가 수학하기에는 너무 긴 URI(ex. API 호출) 또는 HTTP 요청 헤더 필드(ex. Authorization 또는 Cookie)를 생성하지 않도록 검증, 검열 또는 기타 메커니즘을 사용하는지 확인한다. 이로 인해서 지나치게 긴 요청(ex. 긴 쿠키 헤더 필드)을 보낼 때와 같이 서비스 거부가 발생하여 서버가 항상 오류 상태로 응답할 수 있다.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API 와 WEB 서비스", + "section_id": "V4.3", + "section_name": "GraphQL", + "req_id": "V4.3.1", + "req_description": "쿼리 허용 목록, 깊이 제한, 양 제한 또는 쿼리 비용 분석을 사용하여 값비싼 중첩 쿼리로 인해 GraphQL 또는 데이터 계층 표현식 거부(DOS)를 방지하는지 확인한다.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API 와 WEB 서비스", + "section_id": "V4.3", + "section_name": "GraphQL", + "req_id": "V4.3.2", + "req_description": "GraphQL API가 다른 사용자에 의해 사용되지 않는 한, 운영 환경에서 GraphQL 점검 쿼리들이 비비활성화되어 있는지 확인한다.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API 와 WEB 서비스", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.1", + "req_description": "모든 WebSocket 연결에 WebSocket over TLS(WSS)이 사용되는지 확인한다.", + "L": "1" + }, + { + "chapter_id": "V4", + "chapter_name": "API 와 WEB 서비스", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.2", + "req_description": "초기 HTTP WebSocket Handshake 중에 기존 헤더 필드가 애플리케이션에 허용된 기존 목록과 대조되는지 확인한다.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API 와 WEB 서비스", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.3", + "req_description": "애플리케이션의 표준 세션 관리를 사용할 수 없는 경우, 관련 세션 관리 보안 요구 사항을 준수하는 전용 토큰이 사용되고 있는지 확인한다.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API 와 WEB 서비스", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.4", + "req_description": "기존 HTTPS 세션을 WebSocket 채널로 전환할 때 이전에 인증된 HTTPS 세션을 통해 전용 WebSocket 세션 관리 토큰을 처음 얻거나 검증하는지 확인한다.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "파일 처리", + "section_id": "V5.1", + "section_name": "파일 처리 문서화", + "req_id": "V5.1.1", + "req_description": "업로드 기능별로 허용되는 파일 형식, 예상되는 파일 확장자, 그리고 최대 크기(압축 해제된 크기 포함)가 문서에 정의되어 있는지 검증해야 한다. 또한, 악성 파일이 탐지될 때 애플리케이션이 어떻게 동작하는지와 같이, 최종 사용자가 파일을 안전하게 다운로드하고 처리할 수 있도록 하는 방법이 문서에 명시되어 있는지 확인해야 한다.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "파일 처리", + "section_id": "V5.2", + "section_name": "파일 업로드 및 콘텐츠", + "req_id": "V5.2.1", + "req_description": "애플리케이션이 성능 저하나 서비스 거부 공격(Denial of Service; DoS)을 유발하지 않고 처리할 수 있는 크기의 파일만 허용하는지 검증해야 한다.", + "L": "1" + }, + { + "chapter_id": "V5", + "chapter_name": "파일 처리", + "section_id": "V5.2", + "section_name": "파일 업로드 및 콘텐츠", + "req_id": "V5.2.2", + "req_description": "애플리케이션이 파일 자체 또는 zip 파일과 같은 아카이브 내에서 파일을 허용할 때, 파일 확장자가 예상 파일 확장자와 일치하는지 확인하고 내용이 확장자로 표현된 유형과 일치하는지 확인하는지 검증해야 한다. 여기에는 초기 '매직 바이트(magic bytes)' 확인, 이미지 재작성 수행, 파일 내용 유효성 검사를 위한 전문 라이브러리 사용이 포함되지만 이에 국한되지 않는다. L1의 경우, 특정 비즈니스 또는 보안 결정을 내리는 데 사용되는 파일에만 집중할 수 있다. L2 이상에서는 허용되는 모든 파일에 적용되어야 한다", + "L": "1" + }, + { + "chapter_id": "V5", + "chapter_name": "파일 처리", + "section_id": "V5.2", + "section_name": "파일 업로드 및 콘텐츠", + "req_id": "V5.2.3", + "req_description": "애플리케이션이 압축 파일(예: zip, gz, docx, odt)을 압축 해제하기 전에 허용되는 최대 압축 해제 크기와 최대 파일 수를 확인하는지 검증해야 한다.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "파일 처리", + "section_id": "V5.2", + "section_name": "파일 업로드 및 콘텐츠", + "req_id": "V5.2.4", + "req_description": "단일 사용자가 너무 많은 파일이나 과도하게 큰 파일로 저장 공간을 채우지 않도록 사용자별 파일 크기 할당량(quota) 및 최대 파일 수가 적용되는지 검증해야 한다.", + "L": "3" + }, + { + "chapter_id": "V5", + "chapter_name": "파일 처리", + "section_id": "V5.2", + "section_name": "파일 업로드 및 콘텐츠", + "req_id": "V5.2.5", + "req_description": "애플리케이션이 심볼릭 링크(symlink)를 포함하는 압축 파일 업로드를 허용하지 않는지 검증해야 한다. 단, 이러한 기능이 특별히 요구되는 경우에는 심볼릭 링크할 수 있는 파일의 허용 목록(allowlist)을 강제하는 것이 필요하다.", + "L": "3" + }, + { + "chapter_id": "V5", + "chapter_name": "파일 처리", + "section_id": "V5.2", + "section_name": "파일 업로드 및 콘텐츠", + "req_id": "V5.2.6", + "req_description": "픽셀 플러드 공격(Pixel Flood Attack)을 방지하기 위해, 애플리케이션이 업로드된 이미지의 픽셀 크기가 허용된 최대값보다 큰 경우 해당 이미지를 거부하는지 검증해야 한다.", + "L": "3" + }, + { + "chapter_id": "V5", + "chapter_name": "파일 처리", + "section_id": "V5.3", + "section_name": "파일 저장", + "req_id": "V5.3.1", + "req_description": "신뢰할 수 없는 입력으로 업로드되거나 생성되어 공개 폴더에 저장된 파일이 HTTP 요청으로 직접 접근될 때 서버 측 프로그램 코드로 실행되지 않는지 검증해야 한다.", + "L": "1" + }, + { + "chapter_id": "V5", + "chapter_name": "파일 처리", + "section_id": "V5.3", + "section_name": "파일 저장", + "req_id": "V5.3.2", + "req_description": "애플리케이션이 파일 작업을 위한 파일 경로를 생성할 때, 사용자 제출 파일명 대신 내부적으로 생성되거나 신뢰할 수 있는 데이터를 사용하는지 검증해야 한다. 만약 사용자 제출 파일명 또는 파일 메타데이터를 반드시 사용해야 한다면, 경로 탐색(path traversal), 로컬 또는 원격 파일 포함(Local File Inclusion; LFI, Remote File Inclusion; RFI), 그리고 서버 측 요청 위조(Server-side Request Forgery; SSRF) 공격으로부터 보호하기 위해 엄격한 유효성 검사 및 정제(Sanitization)가 적용되는지 확인해야 한다.", + "L": "1" + }, + { + "chapter_id": "V5", + "chapter_name": "파일 처리", + "section_id": "V5.3", + "section_name": "파일 저장", + "req_id": "V5.3.3", + "req_description": "파일 압축 해제와 같은 서버 측 파일 처리가 zip slip과 같은 취약점을 방지하기 위해 사용자 제공 경로 정보를 무시하는지 검증해야 한다.", + "L": "3" + }, + { + "chapter_id": "V5", + "chapter_name": "파일 처리", + "section_id": "V5.4", + "section_name": "파일 다운로드", + "req_id": "V5.4.1", + "req_description": "애플리케이션이 JSON, JSONP 또는 URL 파라미터를 포함한 사용자 제출 파일명을 검증하거나 무시하는지 검증해야 하고, 응답의 Content-Disposition 헤더 필드에 파일명을 명시하는지 검증해야 한다.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "파일 처리", + "section_id": "V5.4", + "section_name": "파일 다운로드", + "req_id": "V5.4.2", + "req_description": "제공되는 파일 이름(예: HTTP 응답 헤더 필드 또는 이메일 첨부 파일)이 문서 구조를 보존하고 삽입 공격(Injection Attack)을 방지하기 위해 인코딩되거나 정제되는지 검증해야 한다. (예: RFC 6266 준수)", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "파일 처리", + "section_id": "V5.4", + "section_name": "파일 다운로드", + "req_id": "V5.4.3", + "req_description": "신뢰할 수 없는 소스에서 얻은 파일이 알려진 악성 콘텐츠 제공을 방지하기 위해 안티바이러스 스캐너에 의해 검사되는지 검증해야 한다.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.1", + "section_name": "Authentication Documentation", + "req_id": "V6.1.1", + "req_description": "인증 문서가 크리덴셜 스터핑, 비밀번호 무차별 대입 공격 등을 방어하기 위해 속도 제한, 자동화 방지, 적응형 응답(adaptive response)과 같은 제어가 어떻게 사용되는지를 정의한다. 또한, 이러한 제어가 어떻게 구성되는지와 악의적으로 계정을 잠그는 것을 방지하는 방법을 명확히 하는지 검증한다.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.1", + "section_name": "Authentication Documentation", + "req_id": "V6.1.2", + "req_description": "조직명, 제품명, 시스템 식별자, 프로젝트 코드명, 부서명 또는 역할명 등 문맥적으로 특정된 단어의 변형을 포함하여, 비밀번호에 사용되지 않도록 문서화된 단어 목록이 있는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.1", + "section_name": "Authentication Documentation", + "req_id": "V6.1.3", + "req_description": "애플리케이션이 여러 인증 경로를 포함하는 경우, 이들 모두가 문서화되어 있으며 각 경로에 대해 일관되게 적용되는 보안 제어와 인증 강도가 정의되어 있는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.2", + "section_name": "비밀번호 보안", + "req_id": "V6.2.1", + "req_description": "사용자가 설정하는 비밀번호가 최소 8자 이상이어야 하며, 최소 15자 이상을 강력히 권장하는지 검증한다.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.2", + "section_name": "비밀번호 보안", + "req_id": "V6.2.2", + "req_description": "사용자가 비밀번호를 변경할 수 있는지 검증한다.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.2", + "section_name": "비밀번호 보안", + "req_id": "V6.2.3", + "req_description": "비밀번호 변경 기능이 사용자의 현재 비밀번호와 새 비밀번호를 요구하는지 검증한다.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.2", + "section_name": "비밀번호 보안", + "req_id": "V6.2.4", + "req_description": "계정 등록 또는 비밀번호 변경 시 제출된 비밀번호가 최소 3000개의 상위 비밀번호 목록과 비교 및 검사되는지, 이때 애플리케이션 비밀번호 정책(예: 최소 길이)을 만족하는지 검증한다.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.2", + "section_name": "비밀번호 보안", + "req_id": "V6.2.5", + "req_description": "비밀번호는 어떤 구성도 허용되며, 허용되는 문자 유형에 대한 제한이 없는지 검증한다. 대/소문자, 숫자, 특수문자에 대한 최소 개수 요구사항이 없어야 한다.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.2", + "section_name": "비밀번호 보안", + "req_id": "V6.2.6", + "req_description": "비밀번호 입력 필드가 type=password를 사용하여 입력을 마스킹하는지 검증한다. 애플리케이션은 사용자가 전체 비밀번호나 마지막 입력 문자를 일시적으로 볼 수 있도록 허용할 수 있다.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.2", + "section_name": "비밀번호 보안", + "req_id": "V6.2.7", + "req_description": "붙여넣기 기능, 브라우저 비밀번호 도우미, 외부 비밀번호 관리자의 사용이 허용되는지 검증한다.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.2", + "section_name": "비밀번호 보안", + "req_id": "V6.2.8", + "req_description": "애플리케이션이 비밀번호를 사용자로부터 수신한 그대로 검증하며, 대소문자 변경이나 잘림(truncation)과 같은 수정 없이 처리하는지 검증한다.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.2", + "section_name": "비밀번호 보안", + "req_id": "V6.2.9", + "req_description": "비밀번호가 최소 64자까지 허용되는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.2", + "section_name": "비밀번호 보안", + "req_id": "V6.2.10", + "req_description": "사용자의 비밀번호는 손상되었음이 발견되거나 사용자가 교체할 때까지 유효하며, 애플리케이션이 주기적인 자격 증명 교체를 요구하지 않는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.2", + "section_name": "비밀번호 보안", + "req_id": "V6.2.11", + "req_description": "문서화된 문맥별 단어 목록을 사용하여 추측하기 쉬운 비밀번호가 생성되지 않도록 하는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.2", + "section_name": "비밀번호 보안", + "req_id": "V6.2.12", + "req_description": "계정 등록 또는 비밀번호 변경 시 제출된 비밀번호가 유출된 비밀번호 집합과 비교 및 검사되는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.3", + "section_name": "일반 인증 보안", + "req_id": "V6.3.1", + "req_description": "애플리케이션의 보안 문서에 따라 크리덴셜 스터핑 및 비밀번호 무차별 대입 공격을 방지하기 위한 제어가 구현되어 있는지 검증한다.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.3", + "section_name": "일반 인증 보안", + "req_id": "V6.3.2", + "req_description": "“root”, “admin”, “sa”와 같은 기본 사용자 계정이 애플리케이션에 존재하지 않거나 비활성화되어 있는지 검증한다.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.3", + "section_name": "일반 인증 보안", + "req_id": "V6.3.3", + "req_description": "애플리케이션 접근 시 반드시 MFA 또는 단일 요소 인증 메커니즘의 조합을 사용하는지 검증한다. L3의 경우, 인증을 수행하려는 사용자의 의도를 검증하기 위해 사용자가 직접 수행하는 동작(예: FIDO 하드웨어 키 또는 모바일 기기에서 버튼을 누르는 행위)을 요구함으로써, 피싱 공격에 대한 침해 및 위장 저항성을 제공하는 하드웨어 기반 인증 메커니즘이 반드시 하나의 요소로 포함되어야 한다. 이 요구사항에서 고려 사항을 완화하려는 경우, 완전히 문서화된 근거와 포괄적인 보완 통제가 반드시 수반되어야 한다.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.3", + "section_name": "일반 인증 보안", + "req_id": "V6.3.4", + "req_description": "여러 인증 경로가 존재하는 경우, 문서화되지 않은 경로가 없어야 하며 보안 제어와 인증 강도가 일관되게 적용되는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.3", + "section_name": "일반 인증 보안", + "req_id": "V6.3.5", + "req_description": "사용자가 의심스러운 인증 시도에 대해 성공 여부와 관계 없이 알림을 제공받는지 검증한다. 여기에는 비정상적인 위치나 클라이언트에서의 인증 시도, 부분적으로만 성공한 인증(여러 요소 중 하나만 성공한 경우), 장기간 비활성 상태 이후의 인증 시도, 또는 여러 번의 인증 실패 후 성공한 인증이 포함될 수 있다.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.3", + "section_name": "일반 인증 보안", + "req_id": "V6.3.6", + "req_description": "이메일이 단일 또는 다중 요소 인증 메커니즘으로 사용되지 않는지 검증한다.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.3", + "section_name": "일반 인증 보안", + "req_id": "V6.3.7", + "req_description": "자격 증명 재설정, 사용자명/이메일 수정 등 인증 관련 정보 변경 이후 사용자에게 통지되는지 검증한다.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.3", + "section_name": "일반 인증 보안", + "req_id": "V6.3.8", + "req_description": "오류 메시지, HTTP 응답 코드, 응답 시간 차이 등을 통해 유효한 사용자를 유추할 수 없으며, 비밀번호 등록/찾기 기능에도 동일한 보호가 적용되는지 검증한다.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.4", + "section_name": "인증 요소 수명 주기 및 복구", + "req_id": "V6.4.1", + "req_description": "시스템이 생성하는 초기 비밀번호나 활성화 코드가 안전하게 난수로 생성되며, 기존 비밀번호 정책을 따르고, 짧은 기간 내 또는 최초 사용 시 만료되는지 검증한다. 초기 비밀번호는 장기 비밀번호로 허용되지 않아야 한다.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.4", + "section_name": "인증 요소 수명 주기 및 복구", + "req_id": "V6.4.2", + "req_description": "비밀번호 힌트나 지식 기반 인증(“비밀 질문”)이 존재하지 않는지 검증한다.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.4", + "section_name": "인증 요소 수명 주기 및 복구", + "req_id": "V6.4.3", + "req_description": "분실된 비밀번호에 대한 재설정 절차가 안전하게 구현되며, MFA를 우회하지 않는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.4", + "section_name": "인증 요소 수명 주기 및 복구", + "req_id": "V6.4.4", + "req_description": "MFA 요소 분실 시, 등록 시와 동일 수준의 신원 증명이 수행되는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.4", + "section_name": "인증 요소 수명 주기 및 복구", + "req_id": "V6.4.5", + "req_description": "만료 예정인 인증 메커니즘에 대한 갱신 안내가 충분한 시간 전에 발송되며, 필요한 경우 자동 알림이 구성되는지 검증한다", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.4", + "section_name": "인증 요소 수명 주기 및 복구", + "req_id": "V6.4.6", + "req_description": "관리자가 사용자 비밀번호 재설정 절차를 시작할 수 있으나, 사용자의 비밀번호를 직접 변경하거나 지정할 수 없는지 검증한다. 이는 관리자가 사용자의 비밀번호를 알지 못하도록 한다.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.5", + "section_name": "General Multi-factor authentication requirements", + "req_id": "V6.5.1", + "req_description": "조회 secret, 대역 외 인증 요청 및 코드, 시간 기반 일회용 비밀번호가 단 한 번만 성공적으로 사용 가능한지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.5", + "section_name": "General Multi-factor authentication requirements", + "req_id": "V6.5.2", + "req_description": "애플리케이션 백엔드에 저장될 때, 엔트로피가 112비트 미만인 룩업 시크릿(예: 무작위 영숫자 19자 또는 무작위 숫자 34자)은 32비트 무작위 솔트(salt)를 포함하는 사전 승인된 비밀번호 저장용 해시 알고리즘으로 해시되는지 검증한다. 룩업 시크릿이 112비트 이상의 엔트로피를 가진 경우에는 표준 해시 함수를 사용할 수 있다.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.5", + "section_name": "General Multi-factor authentication requirements", + "req_id": "V6.5.3", + "req_description": "룩업 시크릿, 대역 외 인증 코드, 그리고 시간 기반 일회용 비밀번호의 시드가 예측 가능한 값을 피하기 위해 암호학적으로 안전한 의사난수 생성기(CSPRNG)를 사용하여 생성되는지 검증한다. ", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.5", + "section_name": "General Multi-factor authentication requirements", + "req_id": "V6.5.4", + "req_description": "룩업 시크릿과 대역 외 인증 코드가 최소 20비트의 엔트로피를 가지는지 검증한다. 일반적으로 무작위 영숫자 4자 또는 무작위 숫자 6자가 충분하다.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.5", + "section_name": "General Multi-factor authentication requirements", + "req_id": "V6.5.5", + "req_description": "대역 외 인증 요청, 코드 또는 토큰과 시간 기반 일회용 비밀번호가 정의된 수명을 가지는지 검증한다. 대역 외 요청의 최대 수명은 10분이어야 하며, TOTP의 최대 수명은 30초이어야 한다.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.5", + "section_name": "General Multi-factor authentication requirements", + "req_id": "V6.5.6", + "req_description": "도난이나 기타 손실의 경우 모든 인증 요소(물리적 장치 포함)를 해지할 수 있는지 검증한다.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.5", + "section_name": "General Multi-factor authentication requirements", + "req_id": "V6.5.7", + "req_description": "생체 인식 인증 메커니즘은 반드시 보조 요소로만 사용되어야 하며, “소유하고 있는 것” 또는 “알고 있는 것” 중 하나와 함께 사용되는지 검증한다.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.5", + "section_name": "General Multi-factor authentication requirements", + "req_id": "V6.5.8", + "req_description": "시간 기반 일회용 비밀번호는 신뢰할 수 있는 서비스의 시간 소스를 기준으로 검증되어야 하며, 신뢰할 수 없거나 클라이언트에서 제공한 시간을 기반으로 해서는 안 된다.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.6", + "section_name": "대역 외(Out-of-Band) 인증 메커니즘", + "req_id": "V6.6.1", + "req_description": "공중 교환 전화망(PSTN)을 사용하여 전화나 SMS를 통해 일회용 비밀번호(OTPs)를 전달하는 인증 메커니즘은, 해당 전화번호가 사전에 검증되었을 때만 제공되어야 하며, 더 강력한 대체 방법(예: 시간 기반 일회용 비밀번호)도 제공되어야 하고, 서비스는 사용자에게 이러한 보안 위험에 대한 정보를 제공해야 한다. L3 애플리케이션의 경우, 전화와 SMS는 옵션으로 제공되어서는 안 된다.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.6", + "section_name": "대역 외(Out-of-Band) 인증 메커니즘", + "req_id": "V6.6.2", + "req_description": "대역 외 인증 요청, 코드 또는 토큰은 생성된 원래 인증 요청에만 바인딩되어야 하며, 이전이나 이후의 요청에는 사용할 수 없어야 한다.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.6", + "section_name": "대역 외(Out-of-Band) 인증 메커니즘", + "req_id": "V6.6.3", + "req_description": "코드 기반 대역 외 인증 메커니즘이 속도 제한 등을 통해 무차별 대입 공격으로부터 보호되는지 검증한다. 또한 최소 64비트 이상의 엔트로피를 가진 코드를 사용하는 것도 고려해야한다.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.6", + "section_name": "대역 외(Out-of-Band) 인증 메커니즘", + "req_id": "V6.6.4", + "req_description": "다중요소 인증에 푸시 알림이 사용되는 경우, 푸시 폭탄(push bombing) 공격을 방지하기 위해 속도 제한을 적용해야 한다. 또한 숫자 일치 기법 역시 이 위험을 완화할 수 있다.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.7", + "section_name": "암호학적 인증 메커니즘", + "req_id": "V6.7.1", + "req_description": "암호학적 인증 단언(assertion)을 검증하는 데 사용되는 인증서는 수정으로부터 보호되는 방식으로 저장되는지 검증한다.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.7", + "section_name": "암호학적 인증 메커니즘", + "req_id": "V6.7.2", + "req_description": "챌린지 논스(nonce)는 최소 64비트 길이여야 하며, 통계적으로 고유하거나 해당 암호 장치의 수명 동안 고유해야 한다.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.8", + "section_name": "ID 제공자(IdP)를 통한 인증", + "req_id": "V6.8.1", + "req_description": "애플리케이션이 다중 ID 제공자(IdP)를 지원하는 경우, 사용자의 신원이 다른 지원 IdP를 통해 위조될 수 없는지 검증한다. (예: 동일한 사용자 식별자를 사용하는 방식). 표준적인 대응책은 애플리케이션이 IdP ID(네임스페이스 역할)와 IdP 내 사용자 ID의 조합을 사용하여 사용자를 등록하고 식별하는 것이다.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.8", + "section_name": "ID 제공자(IdP)를 통한 인증", + "req_id": "V6.8.2", + "req_description": "인증 단언(예: JWT 또는 SAML 단언)의 디지털 서명이 존재하고 무결성이 항상 유지되는지를 검증한다. 서명이 없거나 유효하지 않은 단언은 거부해야 한다.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.8", + "section_name": "ID 제공자(IdP)를 통한 인증", + "req_id": "V6.8.3", + "req_description": "SAML 단언이 재생 공격의 방지를 위해 고유하게 처리되는지, 유효 기간 내에 단 한 번만 사용되는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.8", + "section_name": "ID 제공자(IdP)를 통한 인증", + "req_id": "V6.8.4", + "req_description": "애플리케이션이 별도의 ID 제공자(IdP)를 사용하고 특정 기능에 대해 특정 인증 강도, 방식, 또는 최근성을 요구하는 경우, 애플리케이션은 IdP가 반환한 정보를 사용하여 이를 검증해야 한다. 예를 들어, OIDC가 사용되는 경우, 이는 ‘acr’, ‘amr’, ‘auth_time’(존재하는 경우)과 같은 ID 토큰 클레임을 검증함으로써 달성할 수 있다. IdP가 이 정보를 제공하지 않는 경우, 애플리케이션은 최소 강도의 인증 메커니즘(예: 사용자 이름과 비밀번호를 사용하는 단일요소 인증)이 사용되었다고 가정하는 문서화된 대체 접근법을 가져야 한다.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.1", + "section_name": "세션 관리 문서화", + "req_id": "V7.1.1", + "req_description": "사용자의 세션 비활성 시간 초과 및 절대 최대 세션 수명에 대한 문서가 존재하고, 다른 제어와의 조합에서 적절하며, NIST SP 800-63B 재인증 요구사항에서 벗어날 시 그 근거가 문서에 포함되어 있는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.1", + "section_name": "세션 관리 문서화", + "req_id": "V7.1.2", + "req_description": "문서가 하나의 계정에서 허용되는 동시(병렬) 세션 수와 활성 세션 수의 최대값에 도달했을 때의 의도된 동작과 수행할 조치를 정의하는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.1", + "section_name": "세션 관리 문서화", + "req_id": "V7.1.3", + "req_description": "통합 신원 관리 생태계(예: SSO 시스템)의 일부로 사용자 세션을 생성하고 관리하는 모든 시스템이 문서화되어 있으며, 세션 수명, 종료, 재인증이 필요한 기타 조건을 조율하기 위한 제어가 포함되어 있는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.2", + "section_name": "기본 세션 관리 보안", + "req_id": "V7.2.1", + "req_description": "애플리케이션이 모든 세션 토큰 검증을 신뢰할 수 있는 백엔드 서비스에서 수행하는지 검증한다.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.2", + "section_name": "기본 세션 관리 보안", + "req_id": "V7.2.2", + "req_description": "애플리케이션이 세션 관리를 위해 정적 API 시크릿이나 키가 아닌, 자체 포함 토큰 또는 참조 토큰을 동적으로 생성하여 사용하는지 검증한다.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.2", + "section_name": "기본 세션 관리 보안", + "req_id": "V7.2.3", + "req_description": "참조 토큰이 사용자 세션을 나타내는 데 사용되는 경우, 그 토큰이 고유하고, 암호학적으로 안전한 의사난수 생성기(CSPRNG)를 사용해 생성되며 최소 128비트의 엔트로피를 갖는지 검증한다.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.2", + "section_name": "기본 세션 관리 보안", + "req_id": "V7.2.4", + "req_description": "애플리케이션이 사용자 인증(재인증 포함) 시 새로운 세션 토큰을 생성하고 기존 세션 토큰을 종료하는지 검증한다.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.3", + "section_name": "세션 타임아웃", + "req_id": "V7.3.1", + "req_description": "위험 분석 및 문서화된 보안 결정에 따라 재인증을 강제하는 비활성 시간 초과가 존재하는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.3", + "section_name": "세션 타임아웃", + "req_id": "V7.3.2", + "req_description": "위험 분석 및 문서화된 보안 결정에 따라 재인증을 강제하는 절대 최대 세션 수명이 존재하는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.4", + "section_name": "세션 종료", + "req_id": "V7.4.1", + "req_description": "로그아웃이나 만료와 같이 세션 종료가 트리거될 때, 애플리케이션이 해당 세션의 추가 사용을 허용하지 않는지 검증한다. 참조 토큰 또는 상태 유지형 세션의 경우, 이는 애플리케이션 백엔드에서 세션 데이터를 무효화하는 것을 의미한다. 자체 포함 토큰을 사용하는 애플리케이션은 종료된 토큰 목록 유지, 사용자별 날짜·시간 이전에 발급된 토큰 거부, 사용자별 서명 키 회전과 같은 방법을 사용해야 한다.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.4", + "section_name": "세션 종료", + "req_id": "V7.4.2", + "req_description": "사용자 계정이 비활성화되거나 삭제될 때(예: 직원 퇴사), 애플리케이션이 모든 활성 세션을 종료하는지 검증한다.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.4", + "section_name": "세션 종료", + "req_id": "V7.4.3", + "req_description": "비밀번호 재설정·복구를 통한 변경, MFA 설정 변경 등 어떤 인증 요소라도 성공적으로 변경 또는 제거한 후, 모든 다른 활성 세션을 종료할 수 있는 옵션을 제공하는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.4", + "section_name": "세션 종료", + "req_id": "V7.4.4", + "req_description": "인증이 필요한 모든 페이지의 로그아웃 기능에 접근하는 것이 쉽고 잘 보이는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.4", + "section_name": "세션 종료", + "req_id": "V7.4.5", + "req_description": "애플리케이션 관리자가 개별 사용자 또는 모든 사용자의 활성 세션을 종료할 수 있는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.5", + "section_name": "세션 악용 방어", + "req_id": "V7.5.1", + "req_description": "이메일 주소, 전화번호, MFA 구성, 계정 복구에 사용되는 기타 정보 등 인증에 영향을 줄 수 있는 민감한 계정 속성을 변경하기 전에 전체 재인증을 요구하는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.5", + "section_name": "세션 악용 방어", + "req_id": "V7.5.2", + "req_description": "사용자가 현재 활성 세션을 전체 또는 일부 확인하고(최소 요소 한 개에 대한 인증을 다시 수행한 후) 종료할 수 있는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.5", + "section_name": "세션 악용 방어", + "req_id": "V7.5.3", + "req_description": "매우 민감한 거래나 작업을 수행하기 전에 최소 한 요소 인증 또는 2차 검증을 요구하는지 검증한다.", + "L": "3" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.6", + "section_name": "페더레이션 재인증", + "req_id": "V7.6.1", + "req_description": "RP와 IdP 간 세션 수명과 종료가 문서대로 동작하며, IdP 인증 이벤트 간의 최대 시간이 도달하는 경우 등 필요한 시점에 재인증을 요구하는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.6", + "section_name": "페더레이션 재인증", + "req_id": "V7.6.2", + "req_description": "세션 생성 시 사용자 동의 또는 명시적 동작을 요구하여, 사용자 상호작용 없이 새로운 애플리케이션 세션이 생성되지 않도록 하는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V8", + "chapter_name": "권한 부여", + "section_id": "V8.1", + "section_name": "권한 부여 문서화", + "req_id": "V8.1.1", + "req_description": "권한 부여 문서가 소비자 권한과 자원 속성에 따라 기능 수준 및 데이터별 접근을 제한하는 규칙을 정의하는지 검증한다.", + "L": "1" + }, + { + "chapter_id": "V8", + "chapter_name": "권한 부여", + "section_id": "V8.1", + "section_name": "권한 부여 문서화", + "req_id": "V8.1.2", + "req_description": "권한 부여 문서가 소비자 권한과 자원 속성에 따라 필드 수준 접근 제한(읽기 및 쓰기 모두)을 정의하는지 검증한다. 이러한 규칙은 관련 데이터 객체의 상태(state)나 상태값(status)과 같은 다른 속성 값에 의존할 수 있다.", + "L": "2" + }, + { + "chapter_id": "V8", + "chapter_name": "권한 부여", + "section_id": "V8.1", + "section_name": "권한 부여 문서화", + "req_id": "V8.1.3", + "req_description": "애플리케이션 문서가 인증 및 권한 부여와 관련된 보안 결정을 내리는 데 사용되는 환경적, 맥락적 속성(예: 시간대, 사용자 위치, IP 주소, 디바이스 등)을 정의하는지 검증한다.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "권한 부여", + "section_id": "V8.1", + "section_name": "권한 부여 문서화", + "req_id": "V8.1.4", + "req_description": "인증 및 권한 부여 문서가 기능 수준, 데이터별, 필드 수준 권한 부여에 더해 환경적, 맥락적 요소가 의사 결정에 어떻게 사용되는지 정의하는지 검증한다. 여기에는 평가되는 속성, 위험 임계값, 수행되는 조치(예: 허용, 추가 인증 요청, 거부, 단계적 인증)을 포함하는 것을 권장한다.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "권한 부여", + "section_id": "V8.2", + "section_name": "일반 권한 부여 설계", + "req_id": "V8.2.1", + "req_description": "애플리케이션이 기능 수준의 접근을 명시적 권한이 있는 소비자에게만 허용하는지 검증한다.", + "L": "1" + }, + { + "chapter_id": "V8", + "chapter_name": "권한 부여", + "section_id": "V8.2", + "section_name": "일반 권한 부여 설계", + "req_id": "V8.2.2", + "req_description": "애플리케이션이 특정 데이터 항목에 대한 명시적 권한이 있는 소비자에게만 데이터별 접근을 허용하여, 안전하지 않은 직접 객체 참조(IDOR) 및 객체 수준 권한 부여 취약점(BOLA)을 방지하는지 검증한다.", + "L": "1" + }, + { + "chapter_id": "V8", + "chapter_name": "권한 부여", + "section_id": "V8.2", + "section_name": "일반 권한 부여 설계", + "req_id": "V8.2.3", + "req_description": "애플리케이션이 특정 필드에 대한 명시적 권한이 있는 소비자에게만 필드 수준 접근을 허용하여, 객체 속성 수준 권한 부여 취약점(BOPLA)을 방지하는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V8", + "chapter_name": "권한 부여", + "section_id": "V8.2", + "section_name": "일반 권한 부여 설계", + "req_id": "V8.2.4", + "req_description": "애플리케이션 문서에서 정의한 바에 따라, 소비자의 환경적, 맥락적 속성(예: 시간대, 위치, IP 주소 또는 장치)에 기반한 적응형 보안 제어가 인증 및 권한 부여 결정에 구현되는지 검증한다. 이러한 제어는 소비자가 새 세션을 시작할 때뿐만 아니라 기존 세션 중에도 반드시 적용되어야 한다.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "권한 부여", + "section_id": "V8.3", + "section_name": "운영 수준 권한 부여", + "req_id": "V8.3.1", + "req_description": "애플리케이션이 권한 부여 규칙을 신뢰할 수 있는 서비스 계층에서 적용하고, 클라이언트 측 JavaScript처럼 신뢰할 수 없는 소비자가 조작할 수 있는 제어에 의존하지 않는지 검증한다.", + "L": "1" + }, + { + "chapter_id": "V8", + "chapter_name": "권한 부여", + "section_id": "V8.3", + "section_name": "운영 수준 권한 부여", + "req_id": "V8.3.2", + "req_description": "권한 부여 결정에 영향을 미치는 값의 변경 사항이 즉시 적용되는지 검증한다. 자체 포함 토큰(self-contained token)과 같이 즉시 적용이 불가능한 경우, 소비자가 더 이상 권한이 없는 작업을 수행할 때 이를 알리고 변경을 되돌리는 완화 제어를 반드시 두어야 한다. 단, 이 방법은 정보 유출을 방지하지는 못한다.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "권한 부여", + "section_id": "V8.3", + "section_name": "운영 수준 권한 부여", + "req_id": "V8.3.3", + "req_description": "객체에 대한 접근이, 대리인이나 이를 대신 수행하는 서비스의 권한이 아닌, 원래 주체(예: 소비자)의 권한에 기반하는지 검증한다. 예를 들어, 소비자가 인증을 위해 자체 포함 토큰을 사용하여 웹 서비스를 호출하고, 해당 서비스가 다른 서비스에 데이터를 요청하는 경우, 두 번째 서비스는 첫 번째 서비스의 머신-투-머신 토큰이 아니라 소비자의 토큰을 사용하여 권한 결정을 내려야 한다.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "권한 부여", + "section_id": "V8.4", + "section_name": "기타 권한 부여 고려사항", + "req_id": "V8.4.1", + "req_description": "다중 테넌트 애플리케이션이 교차 테넌트 제어를 사용하여, 소비자의 작업이 권한이 없는 다른 테넌트에 영향을 미치지 않도록 하는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V8", + "chapter_name": "권한 부여", + "section_id": "V8.4", + "section_name": "기타 권한 부여 고려사항", + "req_id": "V8.4.2", + "req_description": "관리 인터페이스 접근이 연속적인 소비자 신원 검증, 장치 보안 상태 평가, 맥락 기반 위험 분석 등 복수의 보안 계층을 포함하는지 검증한다. 네트워크 위치나 신뢰된 엔드포인트가 무단 접근 가능성을 줄일 수는 있더라도, 단독으로 권한 부여 판단의 유일한 요소가 되어서는 안 된다.", + "L": "3" + }, + { + "chapter_id": "V9", + "chapter_name": "자체 포함 토큰(self-contained token)", + "section_id": "V9.1", + "section_name": "토큰 출처 및 무결성", + "req_id": "V9.1.1", + "req_description": "자체 포함 토큰 내용을 허용하기 전에 변조를 방지하기 위해 디지털 서명 또는 메시지 인증 코드(MAC)를 사용하여 토큰의 무결성을 검증해야 한다.", + "L": "1" + }, + { + "chapter_id": "V9", + "chapter_name": "자체 포함 토큰(self-contained token)", + "section_id": "V9.1", + "section_name": "토큰 출처 및 무결성", + "req_id": "V9.1.2", + "req_description": "주어진 컨텍스트에 대해 자체 포함 토큰을 생성하고 검증할 때, 허용 목록에 있는 알고리즘만 사용될 수 있는지 검증해야 한다. 허용 목록에는 사용 가능한 알고리즘을 모두 포함해야 하며, 이상적으로는 대칭 또는 비대칭 알고리즘 중 하나만을 포함해야 한다. 또한 'None' 알고리즘은 반드시 제외해야 한다. 대칭 및 비대칭 알고리즘 모두를 지원해야 하는 경우, 키 혼동을 방지하기 위해 추가 제어가 필요하다.", + "L": "1" + }, + { + "chapter_id": "V9", + "chapter_name": "자체 포함 토큰(self-contained token)", + "section_id": "V9.1", + "section_name": "토큰 출처 및 무결성", + "req_id": "V9.1.3", + "req_description": "자체 포함 토큰을 검증하는 데 사용되는 키 자료가 토큰 발행자를 위한 신뢰할 수 있는 사전 구성된 출처에서 비롯되었는지 검증하여, 공격자가 신뢰할 수 없는 출처 및 키를 지정하는 것을 방지해야 한다. JWT 및 기타 JWS 구조의 경우, 'jku', 'x5u', 'jwk'와 같은 헤더는 신뢰할 수 있는 출처의 허용 목록에 대해 검증되어야 한다.", + "L": "1" + }, + { + "chapter_id": "V9", + "chapter_name": "자체 포함 토큰(self-contained token)", + "section_id": "V9.2", + "section_name": "토큰 내용", + "req_id": "V9.2.1", + "req_description": "토큰 데이터에 유효 기간이 존재하는 경우, 검증 시간이 이 유효 기간 내에 있을 때만 토큰 및 해당 내용이 허용되는지 검증해야 한다. 예를 들어, JWT의 경우 'nbf' 및 'exp' 클레임이 검증되어야 한다.", + "L": "1" + }, + { + "chapter_id": "V9", + "chapter_name": "자체 포함 토큰(self-contained token)", + "section_id": "V9.2", + "section_name": "토큰 내용", + "req_id": "V9.2.2", + "req_description": "토큰을 수신하는 서비스가 토큰 내용을 수락하기 전에 올바른 유형이며 의도된 목적을 위한 것인지 토큰을 검증하는지 확인해야 한다. 예를 들어, 인가 결정에는 액세스 토큰만 허용될 수 있으며, 사용자 인증을 증명하는 데는 ID 토큰만 사용될 수 있다.", + "L": "2" + }, + { + "chapter_id": "V9", + "chapter_name": "자체 포함 토큰(self-contained token)", + "section_id": "V9.2", + "section_name": "토큰 내용", + "req_id": "V9.2.3", + "req_description": "서비스가 대상 서비스(audience)와 함께 사용하기 위한 토큰만 허용하는지 검증해야 한다. JWT의 경우, 서비스에 정의된 허용 목록에 대해 'aud' 클레임을 검증함으로써 이를 달성할 수 있다.", + "L": "2" + }, + { + "chapter_id": "V9", + "chapter_name": "자체 포함 토큰(self-contained token)", + "section_id": "V9.2", + "section_name": "토큰 내용", + "req_id": "V9.2.4", + "req_description": "토큰 발행자가 다른 대상(audience)에게 토큰을 발행하기 위해 동일한 개인 키를 사용하는 경우, 발행된 토큰이 의도된 대상을 고유하게 식별하는 대상 제한을 포함하는지 검증해야 한다. 이는 토큰이 의도하지 않은 대상에서 재사용되는 것을 방지한다. 대상 식별자가 동적으로 프로비저닝되는 경우, 토큰 발행자는 대상 위장(audience impersonation)을 초래하지 않도록 대상들을 검증해야 한다.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.1", + "section_name": "일반적인 OAuth 및 OIDC 보안", + "req_id": "V10.1.1", + "req_description": "엄격하게 필요한 구성 요소에만 토큰이 전송되는지 검증해야 한다. 예를 들어, 브라우저 기반 JavaScript 애플리케이션에 프론트엔드 전용 백엔드(Backend For Frontend; BFF) 패턴을 사용하는 경우, 액세스 토큰 및 리프레시 토큰은 백엔드에서만 접근 가능해야 한다.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.1", + "section_name": "일반적인 OAuth 및 OIDC 보안", + "req_id": "V10.1.2", + "req_description": "클라이언트는 인가 서버에서 제공하는 값(예: 인가 코드 또는 ID 토큰)이 동일한 사용자 에이전트 세션 및 트랜잭션에서 시작된 인가 플로우의 결과인 경우에만 허용하는지 검증해야 한다. 이를 위해 클라이언트가 생성하는 비밀 값(PKCE(Proof Key for Code Exchange)의 'code_verifier', 'state', OIDC의 'nonce' 등)은 추측이 불가능해야 하며, 해당 트랜잭션에 고유해야 하고, 트랜잭션이 시작된 클라이언트와 사용자 에이전트 세션 양쪽에 안전하게 결합(Binding)되어 있어야 한다.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.2", + "section_name": "OAuth 클라이언트", + "req_id": "V10.2.1", + "req_description": "코드 플로우를 사용하는 경우, OAuth 클라이언트는 토큰 요청을 유도하는 사이트 간 요청 위조 공격(Cross-Site Request Forgery; CSRF)에 대한 보호 기능을 갖추고 있는지 검증한다. 이를 위해 인가 요청 시 전송된 'state' 파라미터를 검증하거나, PKCE 기능을 사용해야 한다.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.2", + "section_name": "OAuth 클라이언트", + "req_id": "V10.2.2", + "req_description": "OAuth 클라이언트가 둘 이상의 인가 서버와 상호 작용할 수 있는 경우, 믹스업 공격에 대한 방어 대책을 갖는지 검증해야 한다. 예를 들어, 인가 서버가 'iss' 파라미터 값을 반환하도록 요구하고 인가 응답 및 토큰 응답에서 이를 검증할 수 있다.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.2", + "section_name": "OAuth 클라이언트", + "req_id": "V10.2.3", + "req_description": "OAuth 클라이언트가 인가 서버에 대한 요청에서 필요한 범위(또는 기타 인가 파라미터)만 요청하는지 검증해야 한다.", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.3", + "section_name": "OAuth 리소스 서버", + "req_id": "V10.3.1", + "req_description": "리소스 서버가 해당 서비스(audience)에 사용하도록 의도된 액세스 토큰만 수락하는지 검증해야 한다. 대상은 구조화된 액세스 토큰(예: JWT의 'aud' 클레임)에 포함될 수 있거나, 토큰 조회 엔드포인트를 사용하여 확인할 수 있다.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.3", + "section_name": "OAuth 리소스 서버", + "req_id": "V10.3.2", + "req_description": "리소스 서버가 위임된 인가를 정의하는 액세스 토큰의 클레임을 기반으로 인가 결정을 시행하는지 검증해야 한다. 'sub', 'scope', 'authorization_details'와 같은 클레임이 존재하는 경우, 이는 결정에 반영되어야 한다.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.3", + "section_name": "OAuth 리소스 서버", + "req_id": "V10.3.3", + "req_description": "액세스 토큰(JWT 또는 관련 토큰 조회 응답)에서 고유한 사용자를 식별해야 하는 접근 제어 결정이 필요한 경우, 리소스 서버가 다른 사용자에게 재할당될 수 없는 클레임에서 사용자를 식별하는지 검증해야 한다. 일반적으로 이는 'iss' 및 'sub' 클레임의 조합을 사용하는 것을 의미한다.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.3", + "section_name": "OAuth 리소스 서버", + "req_id": "V10.3.4", + "req_description": "리소스 서버가 특정 인증 강도, 방법 또는 최신성을 요구하는 경우, 제시된 액세스 토큰이 이러한 제약 조건을 충족하는지 검증해야 한다. 예를 들어, 토큰을 제시한 경우 OIDC의 'acr', 'amr' 및 'auth_time' 클레임을 각각 사용해야 한다.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.3", + "section_name": "OAuth 리소스 서버", + "req_id": "V10.3.5", + "req_description": "리소스 서버가 발신자 제약 액세스 토큰, 즉 OAuth 2용 상호 TLS(Mutual TLS; mTLS) 또는 OAuth 2 소유 증명(Demonstration of Proof of Possession; DPoP)를 요구하여 도난된 액세스 토큰 사용 또는 액세스 토큰 재사용(권한 없는 당사자로부터)을 방지하는지 검증해야 한다.", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.4", + "section_name": "OAuth 인가 서버", + "req_id": "V10.4.1", + "req_description": "인가 서버는 클라이언트 별로 사전 등록된 URI의 허용 목록을 기반으로 리디렉션 URI를 정확한 문자열 비교 방식으로 검증해야 한다.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.4", + "section_name": "OAuth 인가 서버", + "req_id": "V10.4.2", + "req_description": "인가 서버가 인가 응답에서 인가 코드를 반환하는 경우, 해당 코드는 토큰 요청에 한번만 사용될 수 있어야 한다. 이미 액세스 토큰을 발급하는 데 사용된 인가 코드를 사용하여 두 번째 요청이 발생하면, 인가 서버는 토큰 요청을 거부하고 해당 인가 코드와 관련된 모든 발급된 토큰을 취소해야 한다.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.4", + "section_name": "OAuth 인가 서버", + "req_id": "V10.4.3", + "req_description": "인가 코드가 단기간만 유효한지 검증해야 한다. 최대 수명은 L1 및 L2 애플리케이션의 경우 최대 10분, L3 애플리케이션의 경우 최대 1분 이내여야 한다.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.4", + "section_name": "OAuth 인가 서버", + "req_id": "V10.4.4", + "req_description": "인가 서버는 특정 클라이언트에 대해, 해당 클라이언트가 사용할 필요가 있는 인가 방식(grant)만 사용하도록 허용해야 한다. token(암시적 플로우) 및 password(리소스 소유자 비밀번호 자격 증명 플로우) 방식은 더 이상 사용되어서는 안 된다.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.4", + "section_name": "OAuth 인가 서버", + "req_id": "V10.4.5", + "req_description": "인가 서버가 공개 클라이언트에 대한 리프레시 토큰 재사용 공격을 완화하는지 검증해야 한다. 가급적이면 발신자 제약 리프레시 토큰, 즉 소유 증명이나 mTLS를 사용한 인증서 바인딩 액세스 토큰을 사용해야 한다. L1 및 L2 애플리케이션의 경우, 리프레시 토큰 회전(rotation)이 사용될 수 있다. 리프레시 토큰 회전이 사용되는 경우, 인가 서버는 리프레시 토큰을 사용 후 무효화해야 하며, 이미 사용되고 무효화된 리프레시 토큰이 제공되면 해당 인가에 대한 모든 리프레시 토큰을 철회(revoke)해야 한다.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.4", + "section_name": "OAuth 인가 서버", + "req_id": "V10.4.6", + "req_description": "코드 인가 방식(code grant)이 사용되는 경우, 인가 서버가 PKCE를 요구하여 인가 코드 탈취 공격을 완화하는지 검증해야 한다. 인가 요청의 경우, 인가 서버는 유효한 'code_challenge' 값을 요구해야 하며, 'code_challenge_method'값으로 'plain'를 허용해서는 안 된다. 토큰 요청의 경우, 'code_verifier' 파라미터의 검증을 요구해야 한다.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.4", + "section_name": "OAuth 인가 서버", + "req_id": "V10.4.7", + "req_description": "인가 서버가 인증되지 않은 동적 클라이언트 등록을 지원하는 경우, 악의적인 클라이언트 애플리케이션의 위험을 완화하는지 검증해야 한다. 등록된 URI와 같은 클라이언트 메타데이터를 검증하고, 사용자의 동의를 확인해야 하며, 신뢰할 수 없는 클라이언트 애플리케이션으로 인가 요청을 처리하기 전에 사용자에게 경고해야 한다.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.4", + "section_name": "OAuth 인가 서버", + "req_id": "V10.4.8", + "req_description": "슬라이딩 리프레시 토큰 만료(expiration)가 적용되더라도, 리프레시 토큰에 절대 만료 시점(absolute expiration)이 포함되어 있는지 확인한다.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.4", + "section_name": "OAuth 인가 서버", + "req_id": "V10.4.9", + "req_description": "악의적인 클라이언트 또는 도난된 토큰의 위험을 완화하기 위해 인가 서버 사용자 인터페이스를 통해 권한 있는 사용자가 리프레시 토큰 및 참조 액세스 토큰을 철회할 수 있는지 검증해야 한다.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.4", + "section_name": "OAuth 인가 서버", + "req_id": "V10.4.10", + "req_description": "토큰 요청, 푸시된 인가 요청(Pushed Authorization Request; PAR), 토큰 철회 요청과 같은 클라이언트에서 인가 서버로의 백채널 요청(backchannel request)에 대해 기밀 클라이언트가 인증되는지 검증해야 한다.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.4", + "section_name": "OAuth 인가 서버", + "req_id": "V10.4.11", + "req_description": "인가 서버 구성이 OAuth 클라이언트에 필요한 범위만 할당하는지 검증해야 한다.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.4", + "section_name": "OAuth 인가 서버", + "req_id": "V10.4.12", + "req_description": "주어진 클라이언트에 대해 인가 서버가 해당 클라이언트가 사용해야 하는 'response_mode' 값만 허용하는지 검증해야 한다. 예를 들어, 인가 서버가 이 값을 예상 값과 비교하여 검증하거나, PAR 또는 JWT 기반 인가 요청(JWT-secured Authorization Request; JAR)을 사용하여 검증해야 한다.", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.4", + "section_name": "OAuth 인가 서버", + "req_id": "V10.4.13", + "req_description": "인가 유형 'code'가 항상 PAR과 함께 사용되는지 검증해야 한다.", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.4", + "section_name": "OAuth 인가 서버", + "req_id": "V10.4.14", + "req_description": "인가 서버가 mTLS를 사용하는 인증서 바인딩 액세스 토큰 또는 소유 증명 바인딩 액세스 토큰을 사용하여 발신자 제약(Proof-of-Possession) 액세스 토큰만 발급하는지 검증해야 한다.", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.4", + "section_name": "OAuth 인가 서버", + "req_id": "V10.4.15", + "req_description": "최종 사용자 장치에서 실행되지 않는 서버에서 동작하는 클라이언트의 경우, 인가 서버가 'authorization_details' 파라미터 값이 클라이언트 백엔드로부터 생성되었는지와 사용자가 해당 값을 변조되지 않았는지를 검증해야 한다. 예를 들어, PAR 또는 JAR의 사용을 요구하여 확인해야 한다.", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.4", + "section_name": "OAuth 인가 서버", + "req_id": "V10.4.16", + "req_description": "클라이언트가 기밀 클라이언트인지 검증하고, 인가 서버는 재사용 공격에 강하고 공개키 암호화에 기반한 강력한 클라이언트 인증 방식을 사용하도록 요구해야 한다. 예를 들어, mTLS(tls_client_auth, self_signed_tls_client_auth) 또는 비공개 키 기반 JWT 인증(private_key_jwt) 등이 이에 해당한다.", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.5", + "section_name": "OIDC 클라이언트", + "req_id": "V10.5.1", + "req_description": "신뢰 당사자로서 클라이언트가 ID 토큰 재사용 공격을 완화하는지 검증해야 한다. 예를 들어, ID 토큰의 'nonce' 클레임이 OpenID 공급자에 전송된 인증 요청(OAuth2에서는 인가 서버에 전송된 인가 요청)에서 전송된 'nonce' 값과 일치하는지 확인해야 한다.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.5", + "section_name": "OIDC 클라이언트", + "req_id": "V10.5.2", + "req_description": "클라이언트가 ID 토큰 클레임, 일반적으로 'sub' 클레임에서 사용자를 고유하게 식별하며, 해당 클레임이 ID 공급자 범위 내에서 다른 사용자에게 재할당될 수 없는지 검증해야 한다.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.5", + "section_name": "OIDC 클라이언트", + "req_id": "V10.5.3", + "req_description": "클라이언트는 악의적인 인가 서버가 인가 서버 메타데이터를 통해 다른 인가 서버를 가장하려는 시도를 거부하는지 검증해야 한다. 클라이언트는 인가 서버 메타데이터에 포함된 발급자(issuer) URL이 클라이언트가 예상하는 사전 구성된 발급자 URL과 정확히 일치하지 않는 경우, 해당 메타데이터를 거부해야 한다.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.5", + "section_name": "OIDC 클라이언트", + "req_id": "V10.5.4", + "req_description": "클라이언트는 토큰의 aud 클레임 값이 클라이언트의 client_id 값과 동일한지 확인하여 ID 토큰이 해당 클라이언트(audience)를 대상으로 발급되었음을 검증해야 한다.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.5", + "section_name": "OIDC 클라이언트", + "req_id": "V10.5.5", + "req_description": "OIDC 백채널 로그아웃을 사용하는 경우, 신뢰 당사자는 강제 로그아웃을 통한 서비스 거부 공격(Denial of Service) 및 로그아웃 플로우에서의 JWT 혼동(cross-JWT confusion)을 완화하는지 검증해야 한다. 클라이언트는 로그아웃 토큰이 'logout+jwt' 값으로 올바르게 지정되어 있는지, 올바른 멤버 이름을 가진 'event' 클레임을 포함하는지, 그리고 'nonce' 클레임을 포함하지 않는지 검증해야 한다. 또한, 짧은 만료 시간(예: 2분)을 갖는 것이 권장된다.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.6", + "section_name": "OpenID 공급자", + "req_id": "V10.6.1", + "req_description": "OpenID 공급자는 response_mode 파라미터 값으로'code', 'ciba', 'id_token' 또는 'id_token code' 만 허용하는지 검증해야 한다. 이 중 'id_token code'(OIDC 하이브리드 플로우)보다는 'code'가 선호되며, 'token'(모든 암시적 플로우)은 사용되어서는 안 된다.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.6", + "section_name": "OpenID 공급자", + "req_id": "V10.6.2", + "req_description": "OpenID 공급자가 강제 로그아웃을 통한 서비스 거부 공격을 완화하는지 검증해야 한다. 신뢰 당사자로 부터 시작된 로그아웃 요청에 id_token_hint 등의 파라미터가 포함되어 있는 경우, 이를 검증하거나 최종 사용자로부터 명시적인 확인을 받아야 한다.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.7", + "section_name": "동의 관리", + "req_id": "V10.7.1", + "req_description": "인가 서버가 사용자로부터 각 인가 요청에 대한 명시적인 동의(consent)를 확인하는지 검증해야 한다. 클라이언트의 신원을 보장할 수 없는 경우, 인가 서버는 항상 사용자에게 명시적으로 동의를 요청해야 한다.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.7", + "section_name": "동의 관리", + "req_id": "V10.7.2", + "req_description": "인가 서버가 사용자 동의를 요청할 때, 동의하는 내용에 대한 충분하고 명확한 정보를 제공하는지 검증해야 한다. 이에 해당하는 경우, 요청된 인가의 성격(일반적으로 범위, 리소스 서버, RAR(Rich Authorization Requests) 인가 세부 정보 기반), 인가된 애플리케이션의 신원, 인가의 유효 기간이 포함되어야 한다.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.7", + "section_name": "동의 관리", + "req_id": "V10.7.3", + "req_description": "사용자가 인가 서버를 통해 부여한 동의를 검토, 수정 및 철회할 수 있는지 검증해야 한다.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.1", + "section_name": "암호화 인벤토리 및 문서화", + "req_id": "V11.1.1", + "req_description": "'NIST SP 800-57'과 같은 암호화 키 관리 및 키 관리 표준을 따르는 암호화 키 수명 주기에 대한 문서화 된 정책이 있는지 검증해야 한다. 여기에는 키가 과도하게 공유되지 않도록 하는 것이 포함된다(예: 공유 비밀의 경우 두 개를 초과하는 엔터티와 공유 및 개인 키의 경우 한 개를 초과하는 엔터티에 공유).", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.1", + "section_name": "암호화 인벤토리 및 문서화", + "req_id": "V11.1.2", + "req_description": "애플리케이션에서 사용되는 모든 암호화 키, 알고리즘, 인증서를 포함한 암호화 자산 목록(cryptographic inventory)이 작성되고, 유지되며, 정기적으로 업데이트되고 있는지 검증해야 한다. 또한, 각 키가 시스템 내에서 사용 가능한 위치와 사용이 제한되는 위치, 해당 키로 보호할 수 있는 데이터 유형과 보호할 수 없는 데이터 유형이 문서화되어 있어야 한다.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.1", + "section_name": "암호화 인벤토리 및 문서화", + "req_id": "V11.1.3", + "req_description": "암호화, 해싱, 서명 작업을 포함하는 시스템 내의 모든 암호화 사용 사례를 식별하기 위해, 암호화 사용 탐지 메커니즘이 적용되는지 검증해야 한다.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.1", + "section_name": "암호화 인벤토리 및 문서화", + "req_id": "V11.1.4", + "req_description": "암호화 자산 목록이 유지 관리되는지 검증해야 한다. 여기에는 미래의 위협에 대응하기 위해 양자 내성 암호(Post-Quantum Cryptography; PQC)와 같은 새로운 암호화 표준으로의 마이그레이션 계획을 설명하는 문서화된 계획이 포함되어야 한다.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.2", + "section_name": "안전한 암호화 구현", + "req_id": "V11.2.1", + "req_description": "암호화 작업에 업계에서 검증된 구현(라이브러리 및 하드웨어 가속 구현 포함)이 사용되는지 검증해야 한다.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.2", + "section_name": "안전한 암호화 구현", + "req_id": "V11.2.2", + "req_description": "난수, 인증 암호화, MAC, 해싱 알고리즘, 키 길이, 라운드, 암호 및 모드를 언제든지 재구성, 업그레이드 또는 교체하여 암호화 해독으로부터 보호할 수 있도록 애플리케이션이 암호화 유연성(crypto agility)을 갖추고 설계되었는지 검증해야 한다. 또한, 키와 비밀번호를 교체하고 데이터를 다시 암호화하는 것도 가능해야 한다. 이를 통해 승인된 PQC 체계(또는 표준)의 고신뢰 구현이 널리 사용 가능해지면 PQC로 원활하게 업그레이드할 수 있다.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.2", + "section_name": "안전한 암호화 구현", + "req_id": "V11.2.3", + "req_description": "모든 암호화 기본 구성요소(primitive)가 알고리즘, 키 크기 및 구성에 따라 최소 128비트의 보안강도를 제공하는지 검증해야 한다. 예를 들어, 256비트 ECC 키는 대략 128비트의 보안을 제공하며, RSA는 128비트의 보안을 달성하기 위해 3072비트 키를 필요로 한다.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.2", + "section_name": "안전한 암호화 구현", + "req_id": "V11.2.4", + "req_description": "민감한 정보가 누출되는 것을 방지하기 위해 모든 암호화 연산은 상수 시간(constant-time)으로 수행되어야 하며, 비교, 계산, 반환 과정에서 단락(short-circuit) 연산이 없는지 검증해야 한다.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.2", + "section_name": "안전한 암호화 구현", + "req_id": "V11.2.5", + "req_description": "모든 암호화 모듈이 안전하게 실패하고, 패딩 오라클 공격(Padding Oracle attacks)과 같은 취약점을 허용하지 않는 방식으로 오류가 처리되는지 검증해야 한다.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.3", + "section_name": "암호화 알고리즘", + "req_id": "V11.3.1", + "req_description": "안전하지 않은 블록 모드(예: ECB) 및 약한 패딩 방식(예: PKCS#1 v1.5)가 사용되지 않는지 검증해야 한다.", + "L": "1" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.3", + "section_name": "암호화 알고리즘", + "req_id": "V11.3.2", + "req_description": "GCM을 사용하는 AES와 같이 승인된 암호 및 모드만 사용되는지 검증해야 한다.", + "L": "1" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.3", + "section_name": "암호화 알고리즘", + "req_id": "V11.3.3", + "req_description": "암호화 된 데이터가 승인된 인증된 암호화 방식을 사용하거나, 승인된 암호화 방식과 승인된 MAC 알고리즘을 조합을 통한 무단 수정으로부터 보호되는지 검증해야 한다.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.3", + "section_name": "암호화 알고리즘", + "req_id": "V11.3.4", + "req_description": "논스(nonces), 초기화 벡터 및 기타 단일 사용 번호가 둘 이상의 암호화 키 및 데이터 요소 쌍에 사용되지 않는지 검증해야 한다. 생성 방법은 사용되는 알고리즘에 적합해야 한다.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.3", + "section_name": "암호화 알고리즘", + "req_id": "V11.3.5", + "req_description": "암호화 알고리즘과 MAC 알고리즘의 모든 조합이 암호화 후 MAC(Encrypt-then-MAC) 방식으로 동작하는지 검증해야 한다.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.4", + "section_name": "해싱 및 해시 기반 함수", + "req_id": "V11.4.1", + "req_description": "디지털 서명, HMAC, KDF 및 무작위 비트 생성을 포함한 일반적인 암호화 사용 사례에 승인된 해시 함수만 사용되는지 검증해야 한다. MD5와 같이 허용되지 않는 해시 함수는 어떤 암호화 목적으로도 사용해서는 안 된다.", + "L": "1" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.4", + "section_name": "해싱 및 해시 기반 함수", + "req_id": "V11.4.2", + "req_description": "비밀번호가 승인된 '계산 집약적인 키 유도 함수(\"비밀번호 해싱 함수\"라고도 함)'를 사용하여 저장되고, 파라미터 설정이 현재 지침에 따라 구성되었는지 검증해야 한다. 설정은 필요한 보안 수준에 대한 무차별 대입 공격을 충분히 어렵게 만들기 위해 보안과 성능의 균형을 이루어야 한다.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.4", + "section_name": "해싱 및 해시 기반 함수", + "req_id": "V11.4.3", + "req_description": "데이터 인증 또는 데이터 무결성의 일부로 디지털 서명에 사용되는 해시 함수가 충돌 저항성을 가지며 적절한 비트 길이를 갖는지 검증해야 한다. 충돌 저항성이 필요한 경우, 출력 길이는 최소 256비트여야 한다. 제2 역상(pre-image) 공격 저항성만 필요한 경우, 출력 길이는 최소 128비트여야 한다.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.4", + "section_name": "해싱 및 해시 기반 함수", + "req_id": "V11.4.4", + "req_description": "비밀번호로부터 비밀 키를 유도할 때 애플리케이션이 키 스트레칭(key stretching) 파라미터를 사용하여 승인된 키 유도 함수(key derivation function)를 사용하는지 검증해야 한다. 사용 중인 파라미터는 결과적인 암호화 키를 손상시키는 무차별 대입 공격을 방지하기 위해 보안과 성능의 균형을 이루어야 한다.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.5", + "section_name": "무작위 값", + "req_id": "V11.5.1", + "req_description": "예측 불가능해야 하는 모든 난수 및 문자열이 암호학적으로 안전한 의사 난수 생성기(CSPRNG)를 사용하여 생성되고 최소 128비트의 엔트로피를 갖는지 검증해야 한다. UUID는 이 조건을 충족하지 않는다.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.5", + "section_name": "무작위 값", + "req_id": "V11.5.2", + "req_description": "사용 중인 난수 생성 메커니즘이 높은 부하(heavy demand)에서도 안전하게 작동하도록 설계되었는지 검증해야 한다.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.6", + "section_name": "공개 키 암호화", + "req_id": "V11.6.1", + "req_description": "키 생성 및 시딩, 디지털 서명 생성 및 검증에 승인된 암호화 알고리즘 및 작동 모드만 사용되는지 검증해야 한다. 키 생성 알고리즘은 알려진 공격에 취약한 안전하지 않은 키(예: 페르마 인수분해(Fermat factorization)에 취약한 RSA 키)를 생성해서는 안 된다.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.6", + "section_name": "공개 키 암호화", + "req_id": "V11.6.2", + "req_description": "키 교환에는 디피-헬만과 같은 승인된 암호화 알고리즘이 사용되어야 하며, 안전한 파라미터를 사용하는지 여부를 중점적으로 검증해야 한다.이는 중간자 공격(adversary-in-the-middle attacks) 또는 암호화 해독으로 이어질 수 있는 키 설정 프로세스에 대한 공격을 방지할 것이다.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.7", + "section_name": "사용 중 데이터 암호화", + "req_id": "V11.7.1", + "req_description": "사용 중인 민감한 데이터를 보호하고 무단 사용자 또는 프로세스의 접근을 방지하기 위해 전체 메모리 암호화가 사용되는지 검증해야 한다.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.7", + "section_name": "사용 중 데이터 암호화", + "req_id": "V11.7.2", + "req_description": "데이터 최소화가 처리 중에 노출되는 데이터의 양을 최소화하고, 사용 직후 또는 가능한 한 빨리 데이터가 암호화되도록 보장하는지 검증해야 한다.", + "L": "3" + }, + { + "chapter_id": "V12", + "chapter_name": "보안 통신", + "section_id": "V12.1", + "section_name": "일반 TLS 보안 가이드", + "req_id": "V12.1.1", + "req_description": "TLS 1.2 및 TLS 1.3과 같은 최신 권장 버전의 TLS 프로토콜만 활성화되어 있으며, 그중 최신 버전이 우선되어야 한다.", + "L": "1" + }, + { + "chapter_id": "V12", + "chapter_name": "보안 통신", + "section_id": "V12.1", + "section_name": "일반 TLS 보안 가이드", + "req_id": "V12.1.2", + "req_description": "오직 권장되는 암호화 스위트(cipher suites)들이 활성화되어 있으며 그 중 가장 강력한 암호화 스위트로 우선 설정되어 있는지 확인한다. 레벨3 애플리케이션은 순방향 비밀성(forward secrecy)을 제공하는 암호화 스위트만 지원해야 한다.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "보안 통신", + "section_id": "V12.1", + "section_name": "일반 TLS 보안 가이드", + "req_id": "V12.1.3", + "req_description": "인증이나 권한 부여를 위해 인증서 ID를 사용하기 전에 애플리케이션이 mTLS 클라이언트 인증서가 신뢰할 수 있는지 검증해야 한다.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "보안 통신", + "section_id": "V12.1", + "section_name": "일반 TLS 보안 가이드", + "req_id": "V12.1.4", + "req_description": "Online Certificate Status Protocol (OCSP) 스테이플링(Stapling)과 같은 적절한 인증서 폐지 프로토콜이 활성화되고 설정되어 있는지 확인해야 한다.", + "L": "3" + }, + { + "chapter_id": "V12", + "chapter_name": "보안 통신", + "section_id": "V12.1", + "section_name": "일반 TLS 보안 가이드", + "req_id": "V12.1.5", + "req_description": "TLS 핸드셰이크 프로세스 중 Server Name Indication (SNI)과 같은 민감한 메타 데이터의 노출을 방지하기 위해 애플리케이션 TLS 설정에서 Encrypted Client Hello (ECH)가 활성화되어 있는지 확인해야 한다.", + "L": "3" + }, + { + "chapter_id": "V12", + "chapter_name": "보안 통신", + "section_id": "V12.2", + "section_name": "외부 서비스와의 HTTPS 통신", + "req_id": "V12.2.1", + "req_description": "TLS는 클라이언트와 외부 HTTP 기반 서비스 간의 모든 연결에 사용되며, 안전하지 않거나 암호화 되어 있지 않은 통신에 대체 동작(fall back)이 발생하지 않는지 확인해야한다. ", + "L": "1" + }, + { + "chapter_id": "V12", + "chapter_name": "보안 통신", + "section_id": "V12.2", + "section_name": "외부 서비스와의 HTTPS 통신", + "req_id": "V12.2.2", + "req_description": "외부 서비스가 공적으로 신뢰된 TLS 인증서를 사용하는지 확인해야 한다.", + "L": "1" + }, + { + "chapter_id": "V12", + "chapter_name": "보안 통신", + "section_id": "V12.3", + "section_name": "일반 서비스 간의 통신 보안", + "req_id": "V12.3.1", + "req_description": "애플리케이션간의 모니터링 시스템, 관리 도구, 원격 엑세스 및 SSH, 미들웨어, 데이터베이스, 메인프레임, 파트너 시스템이나 외부 API를 포함한 모든 인바운드와 아웃바운드 통신은 TLS같은 암호화 프로토콜이 사용되는지 확인해야 한다. 이 서버는 안전하지 않거나 암호화 되어있지 않은 프로토콜에 대체 동작(fall back)이 발생하지 않아야 한다.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "보안 통신", + "section_id": "V12.3", + "section_name": "일반 서비스 간의 통신 보안", + "req_id": "V12.3.2", + "req_description": "TLS 클라이언트가 통신하기 전에 TLS서버로 부터 받은 인증서를 검증하는지 확인해야 한다.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "보안 통신", + "section_id": "V12.3", + "section_name": "일반 서비스 간의 통신 보안", + "req_id": "V12.3.3", + "req_description": "그리고 TLS 또는 애플리케이션 내의 내부 HTTP 기반 서비스간에 사용된 다른 적절한 전송 암호화 매커니즘이 안전하지 않거나 암호화 되어있지 않은 통신에 대체 동작(fall back)이 발생하지 않는지 확인해야 한다.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "보안 통신", + "section_id": "V12.3", + "section_name": "일반 서비스 간의 통신 보안", + "req_id": "V12.3.4", + "req_description": "내부 서버간에 TLS 통신이 신뢰된 인증서를 사용하는지 확인해야 한다. 내부 인증서나 자체 서명(self-signed)인증서를 사용할 경우, 이를 사용하는 서비스는 오직 특정 내부 인증기관(CA)과 자체 서명 인증만을 신뢰하게 설정해야 한다.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "보안 통신", + "section_id": "V12.3", + "section_name": "일반 서비스 간의 통신 보안", + "req_id": "V12.3.5", + "req_description": "시스템 내부에서 통신하는 서비스(intra-service communication)는 각 엔드포인트를 검증하기 위해 강력한 인증을 사용해야 한다. 공용키(public-key) 기반 구조와 재전송 공격(replay attacks)에 저항하는 매커니즘을 사용하여 신원보장을 위해 TLS 클라이언트 인증과 같은 강력한 인증 방식을 사용해야 한다. 마이크로서비스 아키텍쳐의 경우 인증서 관리를 간소화 하고 보안을 강화하기 위해 서비스 매시(service mesh)를 사용하는 것을 고려해야 한다.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.1", + "section_name": "설정 문서", + "req_id": "V13.1.1", + "req_description": "애플리케이션의 모든 통신 요구사항이 문서화 되어 있는지를 검증한다. 이는 애플리케이션이 의존하는 외부 서비스나, 사용자가 애플리케이션이 연결할 외부 위치를 제공하는 경우들을 포함한다.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.1", + "section_name": "설정 문서", + "req_id": "V13.1.2", + "req_description": "애플리케이션이 사용하는 각각의 서비스들에 대해, 문서가 최대 동시 연결 수(연결 풀 제한)를 정의하고 있는지, 그리고 그 한계에 다다랐을 때 폴백(fallback)이나 복구 메커니즘 등을 포함하여, DoS 공격을 방지하기 위해 애플리케이션이 어떻게 동작하는지를 검증한다.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.1", + "section_name": "설정 문서", + "req_id": "V13.1.3", + "req_description": "애플리케이션 문서가 모든 외부 시스템이나 애플리케이션이 사용하는 서비스(예시: 데이터베이스, 파일 핸들, 스레드, HTTP 연결)들에 대한 자원-관리 전략을 정의하고 있는지 검증한다.이는 자원-해제 프로시저, 시간초과 설정, 오류 핸들링을 포함하며, 재시도 로직이 구현된 경우 재시도 제한과 지연, 백-오프 알고리즘을 명시해야 한다. 동기 HTTP 요청-응답 명령에 대해서는 짧은 타임아웃에 더해 재시도의 비활성화 혹은 연쇄적인 지연과 자원 고갈을 방지하기 위한 재시도의 엄격한 제한을 의무화해야 한다.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.1", + "section_name": "설정 문서", + "req_id": "V13.1.4", + "req_description": "애플리케이션 문서가 조직의 위협 모델과 사업적 요구사항에 기반하여, 애플리케이션의 보안과 비밀 정보들의 주기적 갱신 일정에 치명적인 비밀 정보들을 정의하고 있는지 검증한다.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.2", + "section_name": "백엔드 통신 설정", + "req_id": "V13.2.1", + "req_description": "API나 미들웨어와 같은 애플리케이션의 표준 사용자 세션 메커니즘을 지원하지 않는 백엔드 애플리케이션 컴포넌트와 데이터 계층 사이의 통신이 인증되어 있는지를 검증한다. 인증은 반드시 개별적인 서비스 계정과 단기간 토큰, 또는 인증서 기반 인증을 사용하고 비밀번호, API 키, 또는 접근 권한이 부여된 공유 계정 등의 자격 증명을 변경하지 않아선 안 된다. ", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.2", + "section_name": "백엔드 통신 설정", + "req_id": "V13.2.2", + "req_description": "로컬 또는 운영체제 서비스, API, 미들웨어, 그리고 데이터 계층을 포함한 백엔드 애플리케이션 컴포넌트 간의 통신이 최소 필요 권한이 할당된 계정들로 수행되는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.2", + "section_name": "백엔드 통신 설정", + "req_id": "V13.2.3", + "req_description": "만약 자격 증명이 서비스 인증을 위해 필요하다면, 소비자로부터 사용되는 그 자격 증명이 기본 자격 증명이 아님을 검증한다. (예시: root/root 또는 admin/admin)", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.2", + "section_name": "백엔드 통신 설정", + "req_id": "V13.2.4", + "req_description": "얼로우리스트가 애플리케이션의 통신이 허가된 외부 리소스나 시스템을 정의하기 위해 사용되는지 검증한다. (예시: 아웃바운드 요청, 데이터 로드, 파일 접근). 이 얼로우리스트는 애플리케이션 계층, 웹 서버, 방화벽 또는 다른 여러 계층의 조합으로 구현할 수 있다. ", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.2", + "section_name": "백엔드 통신 설정", + "req_id": "V13.2.5", + "req_description": "웹이나 애플리케이션 서버에 요청을 보내거나 데이터나 파일을 로드 할 수 있는 리소스 또는 시스템의 얼로우리스트가 설정되어 있는지를 검증한다.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.2", + "section_name": "백엔드 통신 설정", + "req_id": "V13.2.6", + "req_description": "애플리케이션이 별도의 서비스와 연결할 때, 각 연결이 최대 병렬연결, 최대 연결 도달 시의 동작, 연결 타임아웃, 재시도 전략 등 문서화된 설정에 따르는지 검증한다.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.3", + "section_name": "비밀 정보 관리", + "req_id": "V13.3.1", + "req_description": "키 볼트와 같은 비밀 정보 관리 솔루션이 백엔드 비밀 정보들을 만들고 저장하고, 접근을 제어하고, 파기하기 위해 사용되고 있는지 검증한다. 이는 비밀번호, 키 재료, 데이터베이스와 서드 파티 시스템의 통합, 시간-기반 토큰을 위한 키와 시드, 그리고 API 키들을 포함할 수 있다. 비밀 정보들은 애플리케이션 소스 코드 내부나, 빌드 아티팩트에 포함되어서는 안 된다. L3 애플리케이션에 대해서는, 반드시 HSM과 같은 하드웨어 기반 솔루션을 사용해야 한다.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.3", + "section_name": "비밀 정보 관리", + "req_id": "V13.3.2", + "req_description": "비밀 정보 자원들에 대한 접근이 최소 권한의 원칙을 고수하는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.3", + "section_name": "비밀 정보 관리", + "req_id": "V13.3.3", + "req_description": "보안 모듈에 대한 외부의 노출로부터 안전하게 키 재료를 관리하고 보호하기 위해 모든 암호 연산이 고립된 보안 모듈(볼트나, 하드웨어 보안 모듈 등)을 사용하여 수행되는지 검증한다.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.3", + "section_name": "비밀 정보 관리", + "req_id": "V13.3.4", + "req_description": "애플리케이션의 문서를 기반으로 비밀 정보들이 만료되고 갱신되도록 설정되었는지 검증한다.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.4", + "section_name": "의도하지 않은 정보 노출", + "req_id": "V13.4.1", + "req_description": "애플리케이션이 .git 이나 .svn 폴더 같은 소스 코드 관리 메타데이터 없이 배포되었는지, 또는 이 폴더들이 외부적으로든 애플리케이션 자체에서든 접근할 수 없도록 배포되었는지 검증한다. ", + "L": "1" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.4", + "section_name": "의도하지 않은 정보 노출", + "req_id": "V13.4.2", + "req_description": "실제 운영환경에서 디버깅 기능 노출이나 정보 누출을 방지하기 위해, 모든 컴포넌트에서 디버그 모드가 비활성화되어 있는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.4", + "section_name": "의도하지 않은 정보 노출", + "req_id": "V13.4.3", + "req_description": "분명히 의도된 것이 아닌 이상 웹 서버가 폴더 목록을 클라이언트에게 노출하지 않는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.4", + "section_name": "의도하지 않은 정보 노출", + "req_id": "V13.4.4", + "req_description": "잠재적인 정보 누출을 방지하기 위해 실제 운영환경에서 HTTP TRACE 메소드 사용이 지원되지 않는지 검증한다. ", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.4", + "section_name": "의도하지 않은 정보 노출", + "req_id": "V13.4.5", + "req_description": "분명히 의도된 것이 아닌 이상 문서(내부 API 같은)와 모니터링 엔드포인트가 노출되지 않는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.4", + "section_name": "의도하지 않은 정보 노출", + "req_id": "V13.4.6", + "req_description": "애플리케이션이 백엔드 컴포넌트의 자세한 버전 정보를 노출하지 않는지 검증한다.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.4", + "section_name": "의도하지 않은 정보 노출", + "req_id": "V13.4.7", + "req_description": "웹 계층이 의도적이지 않은 정보, 설정, 소스코드 누출을 방지하기 위해 특정 파일 확장자만 서비스하도록 설정되었는지 검증한다.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "데이터 보호", + "section_id": "V14.1", + "section_name": "데이터 보호 문서화", + "req_id": "V14.1.1", + "req_description": "애플리케이션이 생성하고 처리하는 모든 민감한 데이터가 식별되고 보호 수준으로 분류되었는지 확인한다. 여기에는 단순히 인코딩되어 있고 쉽게 디코딩할 수 있는 데이터, 예를 들어 Base64 문자열이나 JWT 내부 평문 페이로드가 포함된다. 보호 수준은 애플리케이션이 준수해야 하는 모든 데이터 보호 및 개인정보 보호 관련 규정과 표준을 반드시 고려해야 한다.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "데이터 보호", + "section_id": "V14.1", + "section_name": "데이터 보호 문서화", + "req_id": "V14.1.2", + "req_description": "모든 민감한 데이터의 보호 수준에 대해 문서화된 요구사항이 있는지 확인한다. 반드시 여기에는(이에 한정되지 않지만) 일반적인 암호화, 무결성 검증, 보존 기간, 데이터 로그 기록 방식, 로그 내 민감한 데이터에 대한 접근 제어, 데이터베이스 암호화 수준, 사용할 개인정보 보호 및 개인정보 보호 강화 기술, 그리고 기타 기밀성 요구사항들 관련하여 포함되어야 한다.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "데이터 보호", + "section_id": "V14.2", + "section_name": "일반 데이터 보호", + "req_id": "V14.2.1", + "req_description": "민감한 데이터는 HTTP 메시지 본문이나 헤더 필드로만 서버에 전송되고, URL과 쿼리 문자열에는 API키나 세션토큰처럼 민감한 정보가 포함되지 않도록 검증한다.", + "L": "1" + }, + { + "chapter_id": "V14", + "chapter_name": "데이터 보호", + "section_id": "V14.2", + "section_name": "일반 데이터 보호", + "req_id": "V14.2.2", + "req_description": "서버 구성 요소에서 로드밸런서나 애플리케이션 캐시와 같은 민감한 데이터가 캐시되지 않게 하거나, 사용 후 해당 데이터를 안전하게 삭제하도록 검증한다.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "데이터 보호", + "section_id": "V14.2", + "section_name": "일반 데이터 보호", + "req_id": "V14.2.3", + "req_description": "정의된 민감한 데이터가 애플리케이션의 통제를 벗어난 곳에서 원치 않는 수집을 예방하기 위해 신뢰할 수 없는 대상(예: 사용자 추적기)에게 전송되지 않도록 검증한다.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "데이터 보호", + "section_id": "V14.2", + "section_name": "일반 데이터 보호", + "req_id": "V14.2.4", + "req_description": "암호화, 무결성 검증, 보존, 데이터 로그 기록 방식, 로그 내 민감한 데이터 접근 제어, 개인정보 보호 및 개인정보 보호 강화 기술과 관련된 민감한 데이터 통제가, 해당 데이터 보호 수준에 대한 문서에 정의된 대로 구현되었는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "데이터 보호", + "section_id": "V14.2", + "section_name": "일반 데이터 보호", + "req_id": "V14.2.5", + "req_description": "캐시 메커니즘이 해당 리소스에 대해 예상되는 콘텐츠 유형을 가진 응답만 캐시하고, 민감하거나 동적인 콘텐츠는 캐시하지 않도록 구성되어 있는지 검증한다. 존재하지 않는 파일에 접근했을 때 다른 유효한 파일을 반환하는 대신 웹 서버는 404 또는 302 응답을 반환해야 한다. 이는 Web Cache Deception 공격을 예방한다.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "데이터 보호", + "section_id": "V14.2", + "section_name": "일반 데이터 보호", + "req_id": "V14.2.6", + "req_description": "애플리케이션 기능에 필요한 최소한의 민감한 데이터만 반환을 검증한다. 예를 들어, 전체 신용카드 번호가 아닌 일부 숫자만 반환해야 한다. 만약 전체 데이터가 필요한 경우, 사용자가 구체적으로 조회하지 않는 한 사용자 인터페이스에서는 마스킹하는 것이 권장된다.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "데이터 보호", + "section_id": "V14.2", + "section_name": "일반 데이터 보호", + "req_id": "V14.2.7", + "req_description": "민감한 정보는 데이터 보존 분류 기준에 따라 관리되어야 하고, 오래되었거나 불필요한 데이터는 사전에 정의된 작업 또는 상황에 따라 자동으로 삭제되도록 검증한다.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "데이터 보호", + "section_id": "V14.2", + "section_name": "일반 데이터 보호", + "req_id": "V14.2.8", + "req_description": "사용자가 제출한 파일의 메타데이터에서 사용자가 저장에 동의하지 않는 한 민감한 정보는 제거를 검증한다.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "데이터 보호", + "section_id": "V14.3", + "section_name": "클라이언트 측 데이터 보호", + "req_id": "V14.3.1", + "req_description": "클라이언트나 세션이 종료된 후에 브라우저 DOM과 같은 클라이언트 스토리지에서 인증된 데이터를 삭제되는지 검증한다. 이를 위해 ‘Clear-Site-Data’ HTTP 응답 헤더 필드를 사용할 수 있으나, 세션 종료 시 서버 연결이 불가능한 경우에도 클라이언트 측에서 해당 데이터를 삭제하는 것이 권장된다.", + "L": "1" + }, + { + "chapter_id": "V14", + "chapter_name": "데이터 보호", + "section_id": "V14.3", + "section_name": "클라이언트 측 데이터 보호", + "req_id": "V14.3.2", + "req_description": "애플리케이션이 브라우저에서 민감한 데이터가 캐시되지 않도록, (Cache-Control: no-store)충분한 캐시 방지 HTTP 응답 헤더 필드를 설정을 검증한다.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "데이터 보호", + "section_id": "V14.3", + "section_name": "클라이언트 측 데이터 보호", + "req_id": "V14.3.3", + "req_description": "브라우저 저장소(localStorage, sessionStorage, IndexedDB, 쿠키)에 저장되는 데이터에는 세션 토큰을 제외한 민감 데이터가 포함되지 않도록 검증한다.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.1", + "section_name": "보안 코딩 및 아키텍처 문서화", + "req_id": "V15.1.1", + "req_description": "애플리케이션 문서에 취약점이 존재하는 서드파티 구성요소 버전 및 일반적인 라이브러리 업데이트에 대해, 해당 구성요소로부터 발생할 수 있는 위험을 최소화하기 위한 위험 기반 대응 기한이 정의되어 있는지 확인해야 한다.", + "L": "1" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.1", + "section_name": "보안 코딩 및 아키텍처 문서화", + "req_id": "V15.1.2", + "req_description": "사용 중인 모든 서드파티 라이브러리에 대해 소프트웨어 자재 명세서(SBOM)와 같은 인벤토리가 유지되고 있으며, 해당 구성요소가 사전에 정의된 신뢰할 수 있고 지속적으로 관리되는 저장소에서 제공되는지 확인해야 한다.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.1", + "section_name": "보안 코딩 및 아키텍처 문서화", + "req_id": "V15.1.3", + "req_description": "애플리케이션 문서에 시간 소모가 크거나 리소스 소비가 많은 기능이 식별되어 있으며, 해당 기능의 과도한 사용으로 인해 가용성이 손실되지 않도록 하는 방법과, 응답 생성이 소비자의 타임아웃보다 오래 걸리는 상황을 방지하는 방법이 포함되어 있는지 확인해야 한다. 가능한 방어 전략에는 비동기 처리, 큐(queue) 사용, 사용자 및 애플리케이션 단위의 병렬 처리 제한 등이 있다.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.1", + "section_name": "보안 코딩 및 아키텍처 문서화", + "req_id": "V15.1.4", + "req_description": "애플리케이션 문서에 위험한 구성요소로 간주되는 서드파티 라이브러리가 강조되어 있는지 확인해야 한다.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.1", + "section_name": "보안 코딩 및 아키텍처 문서화", + "req_id": "V15.1.5", + "req_description": "애플리케이션 문서에 위험한 기능을 사용하는 애플리케이션의 부분이 강조되어 있는지 확인해야 한다.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.2", + "section_name": "보안 아키텍처 및 종속성", + "req_id": "V15.2.1", + "req_description": "애플리케이션이 문서화된 업데이트 및 대응 기한을 위반하지 않은 구성요소만 포함하고 있는지 확인해야 한다.", + "L": "1" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.2", + "section_name": "보안 아키텍처 및 종속성", + "req_id": "V15.2.2", + "req_description": "애플리케이션이 시간 소모가 크거나 리소스 소비가 많은 기능의 과도한 사용으로 인한 가용성 손실을 방지하기 위해, 해당 기능에 대한 문서화된 보안 결정 및 전략을 기반으로 방어 조치를 구현하고 있는지 확인해야 한다.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.2", + "section_name": "보안 아키텍처 및 종속성", + "req_id": "V15.2.3", + "req_description": "운영 환경에 애플리케이션 기능 수행에 필요한 기능만 포함되어 있으며, 테스트 코드, 샘플 코드, 개발용 기능 등 불필요한 기능이 노출되지 않도록 구성되어 있는지 확인해야 한다.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.2", + "section_name": "보안 아키텍처 및 종속성", + "req_id": "V15.2.4", + "req_description": "서드파티 구성요소 및 그 모든 전이 종속성(transitive dependencies)이 내부 또는 외부의 예상된 저장소에서 가져며, 의존성 혼동(dependency confusion) 공격의 위험이 없는지 확인해야 한다.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.2", + "section_name": "보안 아키텍처 및 종속성", + "req_id": "V15.2.5", + "req_description": "애플리케이션이 위험한 기능을 포함하거나 위험한 구성요소를 사용하는 부분에 대해 샌드박싱, 캡슐화, 컨테이너화, 네트워크 수준 격리와 같은 추가적인 보호 기법을 구현하여, 애플리케이션의 한 부분이 침해되더라도 공격자가 다른 영역으로 확산하지 못하도록 지연 및 차단하고 있는지 확인해야 한다.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.3", + "section_name": "방어적(Defensive) 코딩", + "req_id": "V15.3.1", + "req_description": "애플리케이션이 데이터 객체에서 필요한 필드만 선택적으로 반환하고 있는지 확인해야 한다. 예를 들어, 일부 필드는 사용자에게 노출되어서는 안 되므로 전체 데이터 객체를 반환해서는 안 된다.", + "L": "1" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.3", + "section_name": "방어적(Defensive) 코딩", + "req_id": "V15.3.2", + "req_description": "애플리케이션 백엔드에서 외부 URL로 요청을 보낼 때, 의도된 기능이 아닌 경우 리디렉션을 따르지 않도록 구성되어 있는지 확인해야 한다.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.3", + "section_name": "방어적(Defensive) 코딩", + "req_id": "V15.3.3", + "req_description": "애플리케이션이 각 컨트롤러 및 액션 단위로 허용된 필드를 제한함으로써, 대량 할당(mass assignment) 공격에 대한 방어가 구현되어 있는지 확인해야 한다. 예를 들어, 특정 동작에 포함되지 않은 필드 값을 삽입하거나 수정할 수 없어야 한다.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.3", + "section_name": "방어적(Defensive) 코딩", + "req_id": "V15.3.4", + "req_description": "모든 프록시 및 미들웨어 구성요소가 사용자의 원래 IP 주소를 신뢰 가능한 데이터 필드를 통해 정확하게 전달하고 있으며, 애플리케이션과 웹 서버가 이 값을 로그 기록이나 속도 제한(rate limiting)과 같은 보안 결정에 사용하는지 확인해야 한다. 단, 동적 IP, VPN, 방화벽 등으로 인해 원래 IP조차 완전히 신뢰할 수 없는 점도 고려해야 한다.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.3", + "section_name": "방어적(Defensive) 코딩", + "req_id": "V15.3.5", + "req_description": "애플리케이션이 변수의 타입이 올바른지 명시적으로 확인하고, 엄격한 동등성 비교 및 연산자를 사용하여 타입 혼용(type juggling) 또는 타입 혼동(type confusion)으로 인한 취약점을 방지하고 있는지 확인해야 한다.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.3", + "section_name": "방어적(Defensive) 코딩", + "req_id": "V15.3.6", + "req_description": "JavaScript 코드가 프로토타입 오염(prototype pollution)을 방지할 수 있도록 작성되어 있는지 확인해야 한다. 예를 들어, 객체 리터럴 대신 `Set()` 또는 `Map()`을 사용하는 방식이 권장된다.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.3", + "section_name": "방어적(Defensive) 코딩", + "req_id": "V15.3.7", + "req_description": "애플리케이션이 HTTP 파라미터 오염(HTTP parameter pollution) 공격에 대한 방어를 구현하고 있는지 확인해야 한다. 특히, 애플리케이션 프레임워크가 요청 파라미터의 출처(쿼리 스트링, 본문, 쿠키, 헤더)를 구분하지 않는 경우 이를 고려해야 한다.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.4", + "section_name": "안전한 동시성", + "req_id": "V15.4.1", + "req_description": "다중 스레드 코드에서 캐시, 파일, 다수 스레드가 접근하는 메모리 내 객체 등 공유 객체에 접근할 때, 스레드 세이프(thread-safe) 타입과 락·세마포어 같은 동기화 메커니즘을 사용하여 경쟁 상태와 데이터 손상을 피하고 안전하게 접근하는지 확인해야 한다.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.4", + "section_name": "안전한 동시성", + "req_id": "V15.4.2", + "req_description": "리소스의 존재 여부나 권한과 같은 상태 검사와, 그 검사 결과에 의존하는 동작이 단일(atomic) 연산으로 수행되어 TOCTOU 경쟁 상태를 방지하는지 확인해야 한다. (예: 파일을 열기 전에 존재 여부를 확인하는 작업과 파일 열기 동작을 분리하지 않기, 접근 권한 검증과 권한 부여를 동일 트랜잭션/원자적 구간에서 수행하기)", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.4", + "section_name": "안전한 동시성", + "req_id": "V15.4.3", + "req_description": "스레드가 서로를 기다리거나 무한 재시도에 빠지지 않도록 일관된 락 사용을 보장하고, 락 관리 로직을 리소스 관리 책임 코드 내부에 유지하여 외부 클래스 및 코드가 우발적·악의적으로 락을 변경하지 못하도록 하는지 확인해야 한다.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.4", + "section_name": "안전한 동시성", + "req_id": "V15.4.4", + "req_description": "**스레드 풀** 활용 등 **리소스 할당 정책**을 통해 공정한 리소스 접근을 보장하고, 우선순위가 낮은 스레드도 합리적 시간 내 진행될 수 있게 하여 **스레드 기아**를 방지하는지 확인해야 한다.", + "L": "3" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.1", + "section_name": "보안 로깅 문서화", + "req_id": "V16.1.1", + "req_description": "애플리케이션의 기술 스택의 각 계층에서 수행된 로깅에 대해, 어떤 이벤트들이 로그로 남았는지, 로그의 형식이 무엇인지, 로그가 어디에 저장되었는지, 어떻게 사용되는지, 로그에 대한 접근이 어떻게 제어되는지, 그리고 로그가 얼마나 보관되는지에 대해 문서화한 목록이 존재하는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.2", + "section_name": "일반 로깅", + "req_id": "V16.2.1", + "req_description": "이벤트가 발생했을 때 그 타임라인을 자세히 조사할 수 있도록 각 로그의 항목이 필수적인 메타데이터(언제, 어디서, 누가, 무엇을 등)을 포함하는지 검증한다. ", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.2", + "section_name": "일반 로깅", + "req_id": "V16.2.2", + "req_description": "모든 로깅 컴포넌트의 시간 소스가 동기화되어 있는지, 그리고 보안 이벤트 메타데이터에서 타임스탬프가 UTC를 사용하거나 혹은 명시적인 시간대 오프셋을 포함하는지 검증한다. UTC는 분산 시스템 전체에 걸친 일관성을 보장하고, 일광 절약 시간제 전환 시의 혼란을 방지하기 위해 추천된다.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.2", + "section_name": "일반 로깅", + "req_id": "V16.2.3", + "req_description": "애플리케이션이 로그를 저장만 하는지, 혹은 로그 목록에서 문서화 된 파일이나 서비스로 브로드캐스트하는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.2", + "section_name": "일반 로깅", + "req_id": "V16.2.4", + "req_description": "사용 중인 로그 처리기가 로그를 읽고, 또 상호 연관 지을 수 있는지 검증한다. 가능하다면 공통 로깅 형식을 사용하는 것이 좋다.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.2", + "section_name": "일반 로깅", + "req_id": "V16.2.5", + "req_description": "민감한 데이터를 로깅할때, 애플리케이션이 데이터의 보호 수준을 기반으로 로깅을 수행하는지 검증한다. 예를 들어, 자격 증명이나, 지불 상세 정보 등의 특정 데이터는 로깅 해서는 안 된다. 또한 세션 토큰 등의 데이터는 전체 혹은 일부분이 해싱된, 마스킹 된 상태로 로깅 되어야 한다.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.3", + "section_name": "보안 이벤트", + "req_id": "V16.3.1", + "req_description": "성공한 시도와 실패한 시도를 포함하여 모든 인증 명령을 로깅 하는지 검증한다. 인증의 종류나, 사용한 인증 요소 등의 추가적인 메타데이터 또한 수집해야 한다.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.3", + "section_name": "보안 이벤트", + "req_id": "V16.3.2", + "req_description": "실패한 인가 시도들도 로깅 하는지 검증한다. L3에 대해서는 반드시 민감한 데이터가 접근되었을 때를 포함하여(민감한 데이터 자체는 제외하고) 모든 인가 결정들의 로그를 포함해야 한다.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.3", + "section_name": "보안 이벤트", + "req_id": "V16.3.3", + "req_description": "애플리케이션이 이 문서에서 정의한 보안 이벤트들을 로깅하고, 또한 입력값 확인, 비즈니스 로직, 그리고 자동화 방지 등의 보안 제어를 우회하려는 시도들도 로깅 하는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.3", + "section_name": "보안 이벤트", + "req_id": "V16.3.4", + "req_description": "애플리케이션이 백엔드 TLS 오류와 같은 예상치 못한 오류나 보안 제어 오류들을 로깅 하는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.4", + "section_name": "로그 보호", + "req_id": "V16.4.1", + "req_description": "로그 삽입을 방지하기 위해 모든 로깅 컴포넌트가 적절히 데이터를 인코딩하는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.4", + "section_name": "로그 보호", + "req_id": "V16.4.2", + "req_description": "로그가 비인가된 접근으로부터 보호되고 수정할 수 없는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.4", + "section_name": "로그 보호", + "req_id": "V16.4.3", + "req_description": "분석, 탐지, 경보, 그리고 에스컬레이션(escalation)을 위해 로그가 논리적으로 분리된 시스템으로 안전하게 전송되는지 검증한다. 애플리케이션이 침해되더라도 로그는 훼손하지 못하도록 보장하는 것이 목적이다.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.5", + "section_name": "오류 처리", + "req_id": "V16.5.1", + "req_description": "예상치 못한 혹은 보안 측면에서 민감한 오류가 발생했을 때 스택 흔적, 쿼리, 비밀키, 그리고 토큰 등의 민감한 내부 시스템 데이터의 노출 방지를 보장하기 위해 유저에게 구체화하지 않은 메시지를 반환하는지 검증한다.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.5", + "section_name": "오류 처리", + "req_id": "V16.5.2", + "req_description": "외부 리소스 접근 오류가 발생하더라도 애플리케이션이 계속해서 안전하게 작동하는지 검증한다. 예를 들어 서킷 브레이커(circuit breaker)나 우아한 성능 저하와 같은 패턴을 사용할 수 있다.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.5", + "section_name": "오류 처리", + "req_id": "V16.5.3", + "req_description": "예외가 발생할 때, 검증 로직의 오류에도 불구하고 거래를 처리하는 등의 페일-오픈(fail-open) 상태 방지를 포함하여 애플리케이션이 우아하고 안전하게 실패하는지 검증한다. ", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.5", + "section_name": "오류 처리", + "req_id": "V16.5.4", + "req_description": "처리되지 못한 모든 예외를 처리할 “최후의 수단” 오류 핸들러가 정의되어 있는지 검증한다. 이는 로그 파일에 기록되어야 하는 오류 상세 정보들의 손실을 피하기 위함과 동시에, 오류로 인해 전체 애플리케이션 프로세스가 종료되어 가용성 손실로 이어지지 않도록 보장하기 위함이다. ", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.1", + "section_name": "TURN 서버", + "req_id": "V17.1.1", + "req_description": "Traversal Using Relays around NAT(TURN) 서비스가 특정 목적을 위해 보존된 주소(예: 내부 네트워크, 브로드캐스트, 루프백)를 제외한 주소에 대해서만 접근을 허용하도록 한다.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.1", + "section_name": "TURN 서버", + "req_id": "V17.1.2", + "req_description": "Traversal Using Relays around NAT(TURN) 서비스가 정당한 사용자의 TURN 서버 포트의 대량 개방 시 자원고갈에 취약하지 않도록 한다.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "미디어", + "req_id": "V17.2.1", + "req_description": "데이터그램 전송 계층 보안(DTLS) 인증서의 키가 암호화 키 관리에 대한 문서화된 정책에 따라 관리되고 보호되는지 확인해야 한다.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "미디어", + "req_id": "V17.2.2", + "req_description": "미디어 서버가 승인된 데이터그램 전송 계층 보안(DTLS) 암호 모음을 사용하고 지원하도록 구성되었는지, 그리고 보안 실시간 전송 프로토콜(DTLS-SRTP)을 위한 키 생성에 사용되는 DTLS 확장을 위한 안전한 보호 프로파일을 구성했는지 확인해야 한다.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "미디어", + "req_id": "V17.2.3", + "req_description": "미디어 서버에서 보안 실시간 전송 프로토콜(SRTP) 인증이 선택되어 있는지 확인한다. 이를 통해 실시간 전송 프로토콜(RTP) 삽입 공격으로 인한 서비스 거부 상태 발생 또는 오디오/비디오 미디어가 미디어 스트림에 삽입되는 것을 방지할 수 있다.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "미디어", + "req_id": "V17.2.4", + "req_description": "미디어 서버가 잘못된 형식의 보안 실시간 전송 프로토콜(SRTP) 패킷을 접했을 때도 수신 미디어 트래픽 처리를 계속할 수 있는지 확인해야 한다.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "미디어", + "req_id": "V17.2.5", + "req_description": "미디어 서버가 정상 사용자로부터의 보안 실시간 전송 프로토콜(SRTP) 패킷이 대량으로 유입되는 상황에서도 수신 미디어 트래픽 처리를 계속할 수 있는지 확인해야 한다.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "미디어", + "req_id": "V17.2.6", + "req_description": "미디어 서버가 Datagram Transport Layer Security(DTLS)의 “ClientHello” 경합 조건 취약점에 노출되지 않았는지 확인해야 한다. 이를 위해 해당 미디어 서버가 공개적으로 취약한 것으로 알려져 있는지 확인하거나 경합 조건 테스트를 수행해야 한다.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "미디어", + "req_id": "V17.2.7", + "req_description": "미디어 서버와 연결된 모든 오디오 또는 비디오 녹화 장치가 합법적인 사용자로부터의 보안 실시간 전송 프로토콜(SRTP) 패킷이 대량으로 유입되는 상황에서도 수신 미디어 트래픽 처리를 계속할 수 있는지 확인해야 한다.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "미디어", + "req_id": "V17.2.8", + "req_description": "데이터그램 전송 계층 보안(DTLS) 인증서가 세션 설명 프로토콜(SDP) 지문 속성과 대조되어 검증되었는지 확인하고, 검증이 실패할 경우 미디어 스트림을 종료하여 미디어 스트림의 진위성을 보장해야 한다.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.3", + "section_name": "신호 처리", + "req_id": "V17.3.1", + "req_description": "신호 서버가 플러드 공격 중에도 합법적인 수신 신호 메시지 처리를 계속할 수 있는지 확인해야 한다. 이는 신호 수준에서 속도 제한을 구현함으로써 달성되어야 한다.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.3", + "section_name": "신호 처리", + "req_id": "V17.3.2", + "req_description": "서비스 거부 상태를 유발할 수 있는 잘못된 형식의 신호 메시지를 접했을 때 신호 서버가 정상적인 신호 메시지 처리를 계속할 수 있는지 확인해야 한다. 여기에는 입력 검증 구현, 정수 오버플로우 안전 처리, 버퍼 오버플로우 방지 및 기타 강력한 오류 처리 기법 적용이 포함될 수 있다.", + "L": "2" + } + ] +} diff --git a/5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.flat.legacy.json b/5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.flat.legacy.json new file mode 100644 index 0000000000..05fa136368 --- /dev/null +++ b/5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.flat.legacy.json @@ -0,0 +1,4489 @@ +{ + "requirements": [ + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.1", + "section_name": "인코딩 및 데이터 정제 아키텍처", + "req_id": "V1.1.1", + "req_description": "입력값 검증은 오직 한 번만 표준 형태로 디코딩 되거나 언이스케이프 되어야 하며, 인코딩된 데이터가 예상될 때만 디코딩 되어야 한다. 이 과정은 입력이 추가로 처리되기 전에 완료되어야 한다. 예를 들어서 입력값 검증이나 데이터 정제 이후에는 수행되면 안 된다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.1", + "section_name": "인코딩 및 데이터 정제 아키텍처", + "req_id": "V1.1.2", + "req_description": "애플리케이션이 출력값 인코딩 또는 이스케이핑을 인터프리터가 사용하기 전의 최종 단계로 수행하거나 인터프리터 자체에서 처리하는지 검증해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.2", + "section_name": "인젝션(Injection) 방지", + "req_id": "V1.2.1", + "req_description": "HTTP 응답, HTML 문서 또는 XML 문서에 대한 출력값 인코딩이 해당 컨텍스트에 적절한지 검증해야 한다. 예를 들어, 메시지나 문서 구조가 변경되지 않도록 HTML 요소, HTML 속성, HTML 주석, CSS, HTTP 헤더 필드 등에 맞는 문맥별 문자 인코딩이 수행되어야 한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.2", + "section_name": "인젝션(Injection) 방지", + "req_id": "V1.2.2", + "req_description": "통합 자원 식별자(Uniform Resource Locator; URL)들을 동적으로 생성할 때 신뢰할 수 없는 데이터가 해당 컨텍스트에 맞게 인코딩되었는지 검증해야 한다(예: 쿼리나 경로 파라미터에 대한 URL 인코딩 또는 base64url 인코딩). 또한, 오직 안전한 URL 프로토콜만이 허용되는지 검증해야 한다(예: javascript: 또는 data:를 허용하지 않음).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.2", + "section_name": "인젝션(Injection) 방지", + "req_id": "V1.2.3", + "req_description": "동적으로 자바스크립트 콘텐츠(JSON 포함)를 생성할 때 메시지나 문서 구조를 바꾸는 것을 방지하기 위해 출력값 인코딩이나 이스케이핑이 사용되고 있는지 검증해야 한다(자바스크립트 또는 JSON 인젝션을 피하기 위함).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.2", + "section_name": "인젝션(Injection) 방지", + "req_id": "V1.2.4", + "req_description": "데이터 선택 혹은 데이터베이스 쿼리(예: SQL, HQL, NoSQL, Cypher)들 파라미터화된 쿼리, 객체 관계 매핑(Object Relational Mapping; ORM), 엔티티 프레임워크, 또는 다른 구조화된 쿼리 언어(Structured Query Language; SQL) 인젝션 및 기타 데이터베이스 인젝션 공격으로부터 보호해 주는 것들을 사용하는지 검증해야 한다. 이는 저장 프로시저를 쓸 때도 마찬가지이다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.2", + "section_name": "인젝션(Injection) 방지", + "req_id": "V1.2.5", + "req_description": "애플리케이션이 운영체제(Operating System; OS) 명령 인젝션으로부터 보호되며 운영체제 호출 시 파라미터화된 OS 쿼리나 상황에 맞는 명령줄 출력값 인코딩을 사용하는지 검증해야 한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.2", + "section_name": "인젝션(Injection) 방지", + "req_id": "V1.2.6", + "req_description": "애플리케이션이 경량 디렉터리 접근 프로토콜(Lightweight Directory Access Protocol; LDAP) 인젝션 취약점에 대해 보호되어 있는지, 또는 LDAP 인젝션을 방지하기 위한 특정 보안 통제가 구현되어 있는지 검증해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.2", + "section_name": "인젝션(Injection) 방지", + "req_id": "V1.2.7", + "req_description": "애플리케이션이 XPath 인젝션 공격을 쿼리 파라미터나 미리 컴파일된 쿼리들을 사용해 보호되고 있는지 검증해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.2", + "section_name": "인젝션(Injection) 방지", + "req_id": "V1.2.8", + "req_description": "LaTeX 프로세서가 안전하게 구성되어 있으며(\"--shell-escape\" 플래그 비사용 등) LaTeX 인젝션 공격을 방지하기 위해 허용된 명령어 목록이 사용되고 있는지 검증해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.2", + "section_name": "인젝션(Injection) 방지", + "req_id": "V1.2.9", + "req_description": "애플리케이션이 정규 표현식에서 특수 문자들을 메타 문자로 잘못 해석하는 것을 방지하기 위해 해당 문자들 이스케이프(보통 백슬래시를 사용)하고 있는지 검증해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.2", + "section_name": "인젝션(Injection) 방지", + "req_id": "V1.2.10", + "req_description": "애플리케이션이 쉼표 구분 데이터(Comma Separated Values; CSV) 및 수식 인젝션에 대해 보호되어 있는지 검증해야 한다. 그리고 애플리케이션은 CSV 콘텐츠를 내보낼 때 RFC 4180 2.6과 2.7 부분에 명시된 이스케이핑 규칙을 반드시 따라야 한다. 또한 CSV나 다른 스프레드시트 포맷(XLS, XLSX, ODF 등)으로 내보낼 때 필드 값의 첫 번째가 특수 문자('=', '+', '-', '@', '\\t' (탭), '\\0' (null 문자) 포함)라면 반드시 작은따옴표로 이스케이프되어야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.3", + "section_name": "데이터 정제", + "req_id": "V1.3.1", + "req_description": "위지윅(WYSIWYG) 에디터나 이와 유사한 것으로부터 오는 모든 신뢰할 수 없는 HTML 입력들은 잘 알려지고 안전한 HTML 데이터 정제 라이브러리나 프레임워크 기능을 사용해 정제되는지 검증해야 한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.3", + "section_name": "데이터 정제", + "req_id": "V1.3.2", + "req_description": "애플리케이션이 eval() 또는 스프링 표현 언어(Spring Expression Language; SpEL) 등과 같은 동적 코드 실행 기능 사용을 피하고 있는지 검증해야 한다. 대안이 없는 경우, 실행 전에 포함되는 모든 사용자 입력이 반드시 정제되어야 한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.3", + "section_name": "데이터 정제", + "req_id": "V1.3.3", + "req_description": "잠재적으로 위험한 컨텍스트에 전달되는 데이터가 사전에 정제되어 안전 조치가 적용되는지 검증해야 한다. 예를 들어 해당 컨텍스트에서 안전한 문자만 허용하고 너무 긴 입력값은 잘라내는 등의 조치가 포함된다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.3", + "section_name": "데이터 정제", + "req_id": "V1.3.4", + "req_description": "사용자로부터 제공된 확장 가능한 벡터 그래픽(Scalable Vector Graphics; SVG)의 스크립트 실행 가능 콘텐츠가 애플리케이션에 안전한 태그 및 속성(예: 그래픽 그리기)만 포함하도록 검증 또는 정제되는지 검증해야 한다. 예를 들어 스크립트나 foreignObject는 포함되면 안 된다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.3", + "section_name": "데이터 정제", + "req_id": "V1.3.5", + "req_description": "애플리케이션이 사용자로부터 제공된 스크립트 실행 가능하거나 표현식 템플릿 언어(예: 마크다운, CSS, XSL 스타일시트, BBCode ) 콘텐츠를 정제하거나 비활성화하는지 검증해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.3", + "section_name": "데이터 정제", + "req_id": "V1.3.6", + "req_description": "애플리케이션이 서버측 요청 위조(Server-side Request Forgery; SSRF) 공격으로부터 보호하기 위해 신뢰할 수 없는 데이터를 프로토콜, 도메인, 경로, 포트의 허용 목록과 대조해 검증하고 다른 서비스를 호출하기 전에 잠재적으로 위험한 문자를 정제(sanitization)하는지 검증해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.3", + "section_name": "데이터 정제", + "req_id": "V1.3.7", + "req_description": "애플리케이션이 템플릿 인젝션 공격으로부터 보호하기 위해 신뢰할 수 없는 입력값을 기반으로 템플릿을 생성하지 않도록 하는지 검증해야 한다. 대안이 없는 경우에는 템플릿 생성 과정에서 동적으로 포함되는 모든 신뢰할 수 없는 입력값은 정제되거나 엄격히 검증되어야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.3", + "section_name": "데이터 정제", + "req_id": "V1.3.8", + "req_description": "애플리케이션이 자바 명명 및 디렉터리 인터페이스(Java Naming and Directory Interface; JNDI) 쿼리에서 신뢰할 수 없는 입력값을 사용하기 전에 적절히 정제하고 JNDI가 JNDI 인젝션 공격을 방지할 수 있도록 안전하게 구성되어 있는지 검증해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.3", + "section_name": "데이터 정제", + "req_id": "V1.3.9", + "req_description": "인젝션을 방지하기 위해 애플리케이션이 메모리 캐시(memcache)에 콘텐츠를 전달하기 전에 해당 데이터를 정제하는지 검증해야 한다. ", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.3", + "section_name": "데이터 정제", + "req_id": "V1.3.10", + "req_description": "사용 시 예상치 못하거나 악의적인 방식으로 작동할 수 있는 포맷 스트링(format string)들은 처리되기 전에 정제되는지 검증해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.3", + "section_name": "데이터 정제", + "req_id": "V1.3.11", + "req_description": "간이 전자 우편 전송 프로토콜(Simple Mail Transfer Protocol; SMTP)이나 인터넷 메시지 액세스 프로토콜(Internet Message Access Protocol; IMAP) 인젝션으로부터 보호하기 위해 애플리케이션이 사용자 입력을 메일 시스템으로 보내기 전에 정제를 하는지 검증해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.3", + "section_name": "데이터 정제", + "req_id": "V1.3.12", + "req_description": "정규 표현식에 지수형 백트래킹을 유발하는 요소가 없는지, 또한 신뢰할 수 없는 입력값을 정제하여 정규식 기반 서비스 거부 공격(Regular Expression Denial of Service; ReDoS) 또는 런어웨이(Runaway) 정규식 공격을 방지하는지 검증해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.4", + "section_name": "메모리, 스트링, 비관리 코드", + "req_id": "V1.4.1", + "req_description": "애플리케이션이 스택, 버퍼, 또는 힙 오버플로를 탐지하거나 방지하기 위해 메모리 안전 문자열, 안전한 메모리 복사 및 포인터 산술을 사용하는지 검증해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.4", + "section_name": "메모리, 스트링, 비관리 코드", + "req_id": "V1.4.2", + "req_description": "정수 오버플로를 방지하기 위해 부호 확인, 범위 검사, 입력값 검증 등의 기법이 사용되고 있는지 검증해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.4", + "section_name": "메모리, 스트링, 비관리 코드", + "req_id": "V1.4.3", + "req_description": "댕글링 포인터(dangling pointer)나 해체 후 사용(Use After Free; UAF) 취약점을 방지하기 위해 동적으로 할당된 메모리와 자원이 적절히 해제되었는지 그리고 해제된 메모리를 참조하는 포인터나 참조가 제거되었거나 null로 설정되었는지를 검증해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.5", + "section_name": "안전한 역직렬화", + "req_id": "V1.5.1", + "req_description": "애플리케이션이 확장 가능한 마크업 언어(eXtensible Markup Language; XML) 파서(parser)를 제한적인 설정으로 구성하고 외부 엔티티 해석과 같은 안전하지 않은 기능을 비활성화하여 XML 외부 엔티티(XML eXternal Entity; XXE) 공격을 방지하는지 검증해야 한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.5", + "section_name": "안전한 역직렬화", + "req_id": "V1.5.2", + "req_description": "역직렬화 공격을 방지하기 위해 신뢰할 수 없는 데이터의 역직렬화 시 객체 타입 허용 목록 사용 또는 클라이언트 정의 객체 타입 제한과 같은 안전한 입력 처리 방식이 적용되는지 검증해야 한다. 또한 명확히 안전하지 않은 것으로 지정된 역직렬화 메커니즘은 신뢰할 수 없는 입력에 대해 반드시 사용해서는 안 된다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "인코딩과 데이터 정제", + "section_id": "V1.5", + "section_name": "안전한 역직렬화", + "req_id": "V1.5.3", + "req_description": "애플리케이션에서 동일한 데이터 타입(예: JSON 파서, XML 파서, URL 파서)에 대해 사용되는 서로 다른 파서들이 일관된 방식으로 파싱(parsing)을 수행하고 동일한 문자 인코딩 방식을 사용하는지 검증해야 한다. 이를 통해 JSON 상호운용 취약점이나 원격 파일 포함(Remote File Inclusion; RFI) 및 SSRF 공격에서 악용될 수 있는 서로 다른 URI 또는 파일 파싱 동작 문제를 방지할 수 있다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "유효성 검증 및 비즈니스 로직", + "section_id": "V2.1", + "section_name": "유효성 검증 및 비즈니스 로직 문서화", + "req_id": "V2.1.1", + "req_description": "애플리케이션 문서에 데이터 항목이 예상되는 구조에 부합하는지 확인하는 입력값 유효성 검증 규칙이 정의되어 있는지 확인한다. 이는 신용카드 번호, 이메일 주소, 전화번호와 같은 일반적인 데이터 형식일 수도 있고, 내부적으로 사용하는 데이터 형식일 수도 있다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "유효성 검증 및 비즈니스 로직", + "section_id": "V2.1", + "section_name": "유효성 검증 및 비즈니스 로직 문서화", + "req_id": "V2.1.2", + "req_description": "애플리케이션 문서에 연관된 데이터 항목들 간의 논리적, 문맥적 일관성을 검증하는 방법이 정의되어 있는지 검증한다. 예를 들어서 세부 주소와 우편번호가 서로 일치하는지 확인하는 경우가 이에 해당한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "유효성 검증 및 비즈니스 로직", + "section_id": "V2.1", + "section_name": "유효성 검증 및 비즈니스 로직 문서화", + "req_id": "V2.1.3", + "req_description": "비즈니스 로직의 제한사항 및 유효성 검증에 대한 요구사항이 사용자별 기준과 애플리케이션 전체에 적용되는 전역적 기준을 모두 포함하여 문서화되어 있는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "유효성 검증 및 비즈니스 로직", + "section_id": "V2.2", + "section_name": "입력값 검증", + "req_id": "V2.2.1", + "req_description": "입력값에 대한 비즈니스 또는 기능적인 기대치를 충족하기 위해서 입력값의 유효성을 검증해야 한다. 이는 허용 값, 패턴 및 범위 목록에 대한 긍정적 검증을 사용하거나, 미리 정의된 규칙에 따라 입력값을 예상 구조 및 논리적 한계와 비교하여 검증해야 한다. L1의 경우, 특정 비즈니스 또는 보안 결정을 내리는 데 초점을 맞출 수 있다. L2 이상의 경우에는 모든 입력값에 적용해야 한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "유효성 검증 및 비즈니스 로직", + "section_id": "V2.2", + "section_name": "입력값 검증", + "req_id": "V2.2.2", + "req_description": "애플리케이션이 신뢰할 수 있는 서비스 계층에서 입력값 유효성 검사를 시행하도록 설계되었는지 확인해야 한다. 클라이언트 측 유효성 검사는 사용성을 향상시키므로 권장해야 하지만, 보안 제어 수단으로 의존해서는 안된다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "유효성 검증 및 비즈니스 로직", + "section_id": "V2.2", + "section_name": "입력값 검증", + "req_id": "V2.2.3", + "req_description": "사전 정의된 규칙에 따라 관련 데이터 항목의 조합이 합리적인지 애플리케이션에서 확인해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "유효성 검증 및 비즈니스 로직", + "section_id": "V2.3", + "section_name": "비즈니스 로직 보안", + "req_id": "V2.3.1", + "req_description": "애플리케이션이 예상되는 순차적 단계 순서에 따라 동일한 사용자에 대한 비즈니스 로직 흐름만 처리하고 단계를 건너뛰지 않는지 확인한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "유효성 검증 및 비즈니스 로직", + "section_id": "V2.3", + "section_name": "비즈니스 로직 보안", + "req_id": "V2.3.2", + "req_description": "비즈니스 로직 결함이 악용되는 것을 방지하기 위해서 애플리케이션 문서에 따라 비즈니스 로직 제한이 구현되었는지 확인한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "유효성 검증 및 비즈니스 로직", + "section_id": "V2.3", + "section_name": "비즈니스 로직 보안", + "req_id": "V2.3.3", + "req_description": "비즈니스 로직 수준에서 트랜잭션이 사용되고 있는지 확인하여 비즈니스 로직 작업이 완전히 성공하거나 이전의 올바른 상태로 롤백되는지 확인한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "유효성 검증 및 비즈니스 로직", + "section_id": "V2.3", + "section_name": "비즈니스 로직 보안", + "req_id": "V2.3.4", + "req_description": "제한된 양의 리소스(ex. 극장 좌석이나 배송 시간대)가 애플리케이션의 로직을 조작하여 이중으로 예약되는 것을 방지하기 위해서 비즈니스 로직 수준 잠금 메커니즘이 사용되는지 확인한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "유효성 검증 및 비즈니스 로직", + "section_id": "V2.3", + "section_name": "비즈니스 로직 보안", + "req_id": "V2.3.5", + "req_description": "핵심적인 비즈니스 로직 흐름에 무단 또는 우발적인 행위를 방지하기 위해서 다중 사용자 승인이 필요한지 확인해야 한다. 이는 거액 자금 이체, 계약 승인, 기밀 정보 접근, 제조 과정의 안전 무시 등이 포함될 수 있지만, 이에 국한되지는 않는다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "유효성 검증 및 비즈니스 로직", + "section_id": "V2.4", + "section_name": "자동화 방지", + "req_id": "V2.4.1", + "req_description": "데이터 유출, 더미 데이터 생성, 할당량 소진, 속도 제한 위반, 서비스 거부(DoS), 핵심적인 리소스의 과다 사용으로 이어질 수 있는 애플리케이션 기능에 대한 과도한 호출을 방어하기 위해, 자동화 방지 제어 기능이 구현되어 있는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "유효성 검증 및 비즈니스 로직", + "section_id": "V2.4", + "section_name": "자동화 방지", + "req_id": "V2.4.2", + "req_description": "비즈니스 로직의 각 단계가 실제 사람이 수행하는 데 필요한 현실적인 시간을 요구하여, 비정상적으로 빠른 속도의 트랜잭션 제출을 방지하는지 검증한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.1", + "section_name": "웹 프론트엔드 보안 문서", + "req_id": "V3.1.1", + "req_description": "애플리케이션 공식 문서에서 애플리케이션이 반드시 지원해야 하는, 예상되는 보안 특징들을 서술하고 있는지 확인한다. (예: HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP), 그리고 다른 관련된 HTTP 보안 메커니즘들). 또한 문서에서 앞선 특징들(유저에게나 경고하거나 접속을 막는 등의)이 유효하지 않을 때 애플리케이션이 어떻게 행동하는지 반드시 정의해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.2", + "section_name": "의도하지 않은 콘텐츠 접근", + "req_id": "V3.2.1", + "req_description": "브라우저가 HTTP 응답에 대해 콘텐츠나 기능을 불러올 때, 의도하지 않은 상황이 보안적으로 통제되고 있는지 확인한다(예: API, 유저가 올린 파일, 혹은 다른 리소스에 직접 접근 시). Content-Security-Policy 헤더 필드의 샌드박스 지시어를 사용하거나, Content-Disposition 헤더 필드 내의 attachment disposition 타입을 사용하는 등으로, 불필요한 HTTP 요청 헤더 필드 (Sec-Fetch-* 와 같은)를 제공하지 않을 수 있다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.2", + "section_name": "의도하지 않은 콘텐츠 접근", + "req_id": "V3.2.2", + "req_description": "콘텐츠가 HTML로 렌더링되지 않고 텍스트로 표시되도록 하여, HTML이나 JavaScript 등의 의도하지 않은 실행을 방지하는 안전한 렌더링 함수(예: createTextNode, textContent)를 사용하는지 확인한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.2", + "section_name": "의도하지 않은 콘텐츠 접근", + "req_id": "V3.2.3", + "req_description": "애플리케이션이 클라이언트 사이드 JavaScript를 사용할 때, 명시적 변수 사용, 엄격한 타입 검사, 문서에서의 전역 변수 저장 지양, 그리고 네임스페이스 격리 구현 등으로 DOM 클로버링을 막고 있음을 확인한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.3", + "section_name": "쿠키 설정", + "req_id": "V3.3.1", + "req_description": "쿠키가 'Secure' 속성을 가지며, 쿠키 이름에 '\\__Host-' 접두사가 사용되지 않았고, '__Secure-' 접두사를 사용했는지 확인한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.3", + "section_name": "쿠키 설정", + "req_id": "V3.3.2", + "req_description": "UI redress 공격, 그리고 CSRF라 알려진 브라우저 기반 요청 위조 공격들에 대한 노출을 제한하기 위해 각 쿠키의 'SameSite' 속성 값이 쿠키의 목적에 맞게 설정되어 있는지 확인한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.3", + "section_name": "쿠키 설정", + "req_id": "V3.3.3", + "req_description": "다른 호스트들과 명시적으로 공유되는 쿠키에 대해서, '__Host-' 접두사를 가지고 있는지 확인한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.3", + "section_name": "쿠키 설정", + "req_id": "V3.3.4", + "req_description": "클라이언트 측 스크립트에서 쿠키의 값에 접근이 가능한 걸 의도하지 않았다면(세션 토큰 등), 쿠키는 반드시 'HttpOnly' 속성을 가져야 하고, 반드시 'Set-Cookie' 헤더 필드를 통해 클라이언트에게 전달돼야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.3", + "section_name": "쿠키 설정", + "req_id": "V3.3.5", + "req_description": "애플리케이션이 쿠키를 만들 때, 쿠키 이름과 값의 길이 합이 4096바이트를 넘지 않는지 확인한다. 너무 큰 쿠키는 브라우저에 저장되지 않으며, 요청 전달도 안되고, 해당 쿠키에 의존하는 애플리케이션 기능을 사용하지 못하게 된다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.4", + "section_name": "브라우저 보안 메커니즘 헤더", + "req_id": "V3.4.1", + "req_description": "이 섹션에서는 애플리케이션의 응답을 처리할 때 브라우저의 보안 기능과, 제한 사항을 활성화하기 위해 HTTP 응답에 설정해야 하는 보안 헤더를 설명한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.4", + "section_name": "브라우저 보안 메커니즘 헤더", + "req_id": "V3.4.2", + "req_description": "교차 출처 리소스 공유(CORS)의 Access-Control-Allow-Origin 헤더 필드가 애플리케이션의 고정 값인지 확인한다. 만약 출처 Origin HTTP 요청 헤더 필드 값을 사용하고 있다면, 신뢰할 수 있는 출처 목록으로 검증한다. 'Access-Control-Allow-Origin: *' 사용이 필요할 때엔, 응답이 민감한 정보를 포함하지 않는지 확인한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.4", + "section_name": "브라우저 보안 메커니즘 헤더", + "req_id": "V3.4.3", + "req_description": "HTTP 응답이 Content-Security-Policy 응답 헤더 필드를 가지고 있는지 확인한다. 이는 브라우저가 신뢰하는 콘텐츠나 리소스만 불러오고 실행하도록 하고, 위험한 JavaScript의 실행을 제한한다. 최소한, object-src 'none' 과 base-uri 'none'이라는 지침, 그리고 허용 목록을 정의하거나 논스, 해쉬의 사용을 포함한다는 전역 정책은 반드시 사용돼야 한다. 3계층 애플리케이션의 경우에는, 논스나 해쉬가 적용된 응답별 정책이 반드시 정의돼야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.4", + "section_name": "브라우저 보안 메커니즘 헤더", + "req_id": "V3.4.4", + "req_description": "모든 HTTP 응답이 'X-Content-Type-Options: nosniff' 헤더 필드를 포함하는지 확인해야 한다. 이는 브라우저들이 주어진 응답에 대해 콘텐츠 스니핑과 MIME 타입 추측을 하지 않도록, 응답의 Content-Type 헤더 필드 값을 목적지 리소스와 일치하도록 지시한다. 예를 들어서, 응답의 Content-Type이 'text/css'인 스타일만 허용된다고 치자. 이는 기능적으로 브라우저의 Cross-Origin Read Blocking (CORB) 사용 또한 활성화시킨다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.4", + "section_name": "브라우저 보안 메커니즘 헤더", + "req_id": "V3.4.5", + "req_description": "'Referer' HTTP 요청 헤더 필드를 통해 제 3자 서비스들에 기술적으로 민감한 정보 누출을 막기 위해, 애플리케이션에서 리퍼러 정책을 설정했는지 확인해야 한다. 이는 Referrer-Policy HTTP 응답 헤더 필드나 HTML 속성 항목을 통해 설정할 수 있다. 민감한 데이터는 URL에 있는 경로나 쿼리 데이터, 그리고 내부 비공개 애플리케이션의 경우 hostname도 포함된다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.4", + "section_name": "브라우저 보안 메커니즘 헤더", + "req_id": "V3.4.6", + "req_description": "웹 애플리케이션이 Content-Security-Policy 헤더 필드의 frame-ancestors를 사용해 모든 HTTP 응답들에 대해 기본적으로 내부 삽입을 할 수 없고, 필요할 때만 특정 리소스에 대해 내부 삽입을 허용하도록 확인한다. X-Frame-Options 헤더 필드가 브라우저에서 지원되더라도, 오래돼서 신뢰할 수 없음을 알아야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.4", + "section_name": "브라우저 보안 메커니즘 헤더", + "req_id": "V3.4.7", + "req_description": "Content-Security-Policy 헤더 필드에 위반 사항을 보고할 영역이 특정되어 있는지 확인해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.4", + "section_name": "브라우저 보안 메커니즘 헤더", + "req_id": "V3.4.8", + "req_description": "문서 렌더링을 시작하는 모든 HTTP 요청(Content-Type text/html과 같은 응답)에 same-origin 지시어나 same-origin-allow-popups이 있는 Cross‑Origin‑Opener‑Policy 헤더 필드를 포함하는지 확인해야 한다. 이는 탭내빙(tabnabbing) 및 프레임 카운팅과 같은 Window 객체에 대한 공유 액세스를 악용하는 공격을 방지할 수 있다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.5", + "section_name": "브라우저 출처 구분", + "req_id": "V3.5.1", + "req_description": "애플리케이션이 허용되지 않은 교차 출처 요청을 통한 민감한 기능의 사용을 막기 위해 CORS preflight 메커니즘에 의존하지 않는지 확인하고, 이런 요청이 애플리케이션 자체에서 시작된건지 증명해야 한다. 이는 anti-forgery 토큰의 사용과 증명이나 CORS-safelisted 요청 헤더 필드가 아닌 확장 HTTP 헤더 필드를 요구하는 것으로 가능하다. 사이트 간 요청 위조 공격(CSRF)으로 알려진 브라우저 기반의 요청 위조 공격에 대한 방어다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.5", + "section_name": "브라우저 출처 구분", + "req_id": "V3.5.2", + "req_description": "애플리케이션이 민감한 기능의 허용되지 않은 교차 출처 사용을 막기 위해 CORS preflight 메커니즘에 의존하고 있다면, CORS preflight 요청을 작동하지 않는 요청을 호출할 수 있는지 확인해야 한다. 이는 'Origin'과 'Content-Type' 요청 헤더 필드 값을 확인하거나 CORS-safelisted 헤더 필드가 아닌 확장 필드 사용에 대한 확인이 필요하다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.5", + "section_name": "브라우저 출처 구분", + "req_id": "V3.5.3", + "req_description": "민감한 기능이 HTTP 요청으로 POST, PUT, PATCH, DELETE와 같은 적절한 HTTP 방식을 사용하는지, HEAD, OPTIONS, 또는 GET처럼 HTTP 사양이 \"안전\"으로 정의되지 않는 방식을 사용하는지 확인한다. 또는 Sec-Fetch-* 요청 헤더 필드의 엄격한 검증을 사용하여 요청이 부적절한 교차 출처 호출, 탐색 요청 또는 이미지 소스와 같은 리소스 로드에서 발생하지 않았는지 확인할 수 있다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.5", + "section_name": "브라우저 출처 구분", + "req_id": "V3.5.4", + "req_description": "서로 다른 호스트 이름에 별도의 애플리케이션이 호스팅되어 있는지 확인하여 동일한 출처 정책에서 제공하는 제한 사항을 활용한다. 여기에는 한 출처에서 불러온 문서나 스크립트가 다른 출처의 리소스와 상호 작용할 수 있는 방법과 쿠키에서의 호스트 이름 기반 제한 사항이 포함된다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.5", + "section_name": "브라우저 출처 구분", + "req_id": "V3.5.5", + "req_description": "postMessage 인터페이스를 통해 수신한 메시지의 출처를 신뢰할 수 없거나, 구문이 유효하지 않은 경우, 수신한 메시지가 폐기되는지 확인한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.5", + "section_name": "브라우저 출처 구분", + "req_id": "V3.5.6", + "req_description": "Cross-Site Script Inclusion (XSSI) 공격을 피하기 위해, 애플리케이션 아무 곳에서나 JSONP 기능이 활성화되지 않는지 확인한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.5", + "section_name": "브라우저 출처 구분", + "req_id": "V3.5.7", + "req_description": "Cross-Site Script Inclusion (XSSI) 공격을 방지하기 위해 JavaScript 파일과 같은 스크립트 리소스 응답에 승인이 필요한 데이터가 포함되지 않았는지 확인한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.5", + "section_name": "브라우저 출처 구분", + "req_id": "V3.5.8", + "req_description": "인증된 리소스(예: 이미지, 비디오, 스크립트 및 기타 문서)가 의도된 경우에만 사용자를 대신하여 불러와지거나 내장될 수 있는지 확인한다. 이는 Sec-Fetch-* HTTP 요청 헤더 필드를 엄격하게 검증하여 요청이 부적절한 교차 출처 호출에서 발생하지 않았는지 확인하거나 브라우저에 반환된 콘텐츠를 차단하도록 지시하는 제한적인 교차 출처 리소스 정책 HTTP 응답 헤더 필드를 설정하여 달성할 수 있다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.6", + "section_name": "외부 리소스 무결성", + "req_id": "V3.6.1", + "req_description": "클라이언트 측 자산(예: JavaScript 라이브러리, CSS 또는 웹 폰트)이 정적이고 버전이 지정된 경우에만 외부(예: 콘텐츠 전송 네트워크)로만 호스팅되는지 확인하고, 하위 리소스 무결성(SRI)을 사용하여 자산의 무결성을 검증한다. 이것이 불가능하다면 각 리소스에 대해 이를 정당화하기 위해 문서화된 보안 결정이 필요하다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.7", + "section_name": "다른 브라우저 보안 고려사항", + "req_id": "V3.7.1", + "req_description": "애플리케이션이 여전히 지원되고 안전하다고 간주되는 클라이언트 측 기술만 사용하는지 확인한다. 이 요구 사항을 충족하지 않는 기술의 예로는 NSAPI 플러그인, Flash, Shockwave, ActiveX, Silverlight, NACL 또는 클라이언트 측 Java applets가 있다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.7", + "section_name": "다른 브라우저 보안 고려사항", + "req_id": "V3.7.2", + "req_description": "애플리케이션이 사용자를 통제하지 못하는 다른 호스트 이름이나 도메인으로 자동으로 리다이렉션할 때, 허용된 목적지로만 리다이렉션 하는지 확인한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.7", + "section_name": "다른 브라우저 보안 고려사항", + "req_id": "V3.7.3", + "req_description": "사용자가 애플리케이션의 통제 범위를 벗어난 URL로 리다이렉션 될 때 이를 취소할 수 있는 옵션이 있는 알림이 애플리케이션에 표시되는지 확인한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.7", + "section_name": "다른 브라우저 보안 고려사항", + "req_id": "V3.7.4", + "req_description": "애플리케이션의 최상위 도메인(예: site.tld)가 공공 HSTS preload 목록에 추가되었는지 확인한다. 이렇게 하면 애플리케이션에 TLS를 사용하는 것이 Strict-Transport-Security 응답 헤더 필드에만 의존하지 않고 메인 브라우저에 직접 내장된다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "웹 프론트엔드 보안", + "section_id": "V3.7", + "section_name": "다른 브라우저 보안 고려사항", + "req_id": "V3.7.5", + "req_description": "애플리케이션에 접근하는 브라우저가 예상한 보안 특징을 가지고 있지 않은 경우, 애플리케이션이 문서에 명시된 대로 동작하는지 확인한다 (유저에게 경고하거나 접근을 차단하는 등).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API 와 WEB 서비스", + "section_id": "V4.1", + "section_name": "일반적인 웹 서비스 보안", + "req_id": "V4.1.1", + "req_description": "메세지 본문이 포함된 모든 HTTP 응답에는 실제 내용과 일치하는 Content-Type 헤더 필드가 포함되어 있는지 검증한다. 이때 IANA 미디어 타입(text, /+xml, /xml 등)에 따라 안전한 문자 인코딩 (ex. UTF-8, ISO-8859-1)을 지정하는 charset 파라미터도 포함되어야 한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API 와 WEB 서비스", + "section_id": "V4.1", + "section_name": "일반적인 웹 서비스 보안", + "req_id": "V4.1.2", + "req_description": "사용자가 대면하는 엔드포인트(사람이 직접 웹 브라우저에 접속하는 경우)만 HTTP에서 HTTPS로 자동 리디렉션하고, 그 외에 서비스나 API 엔드포인트는 명백한 리디렉션을 구현하지 않았는지 검증한다. 이는 클라이언트가 실수로 암호화되지 않은 HTTP 요청을 보내고 있음에도, 요청이 자동으로 HTTPS로 리디렉션되어 민감한 데이터의 유출 사실을 발견하지 못하게 되는 상황을 방지하기 위함이다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API 와 WEB 서비스", + "section_id": "V4.1", + "section_name": "일반적인 웹 서비스 보안", + "req_id": "V4.1.3", + "req_description": "로드 밸런서, 웹 프록시, 백엔드-프론트엔드 서비스 등 중간 계층에서 설정되며, 애플리케이션에서 사용하는 모든 HTTP 헤더 필드를 사용자가 재정의할 수 없는지 확인한다. 예를 들어 X-Real-IP, X-Frowarded-*, X-User-ID 등의 헤더가 포함될 수 있다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API 와 WEB 서비스", + "section_id": "V4.1", + "section_name": "일반적인 웹 서비스 보안", + "req_id": "V4.1.4", + "req_description": "애플리케이션이나 API에서 명시적으로 지원하는 HTTP 메서드(프리플라이트 요청 시에 OPTIONS 포함)만 사용할 수 있으며, 사용되지 않는 메서드는 차단되어 있는지 확인한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API 와 WEB 서비스", + "section_id": "V4.1", + "section_name": "일반적인 웹 서비스 보안", + "req_id": "V4.1.5", + "req_description": "매우 민감하거나 여러 시스템을 거치는 요청이나 거래에 대한 전송 계층 보호에 더하여 메세지별 디지털 서명들을 사용함으로써 추가적인 보증을 제공하는지 확인한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API 와 WEB 서비스", + "section_id": "V4.2", + "section_name": "HTTP 메세지 구조 검증", + "req_id": "V4.2.1", + "req_description": "모든 애플리케이션 구성 요소(로드 밸런서, 방화벽, 애플리케이션 서버 포함)가 HTTP 요청 smuggling을 예방하는 HTTP 버전의 적합한 메커니즘을 사용하는지에 대해, 수신되는 HTTP 메세지의 끝을 결정하는지 확인한다. HTTP/1.x에서 Transfer-encoding 헤더 필드가 있는 경우에 RFC 2616에 따라서 Content-Length 헤더는 무시해야 한다. HTTP/2 또는 HTTP/3를 사용할 때 Content-Length 헤더 필드가 있는 경우에 수신기는 DATA 프레임의 길이와 일치하는지 확인해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API 와 WEB 서비스", + "section_id": "V4.2", + "section_name": "HTTP 메세지 구조 검증", + "req_id": "V4.2.2", + "req_description": "HTTP 메세지를 생성할 때, 요청 smuggling 공격을 예방하기 위해서 HTTP 프로토콜의 프레이밍 방식에 의해 결정된 Content의 길이와 Content-Length 헤더 필드가 충돌하지 않는지 확인한다. ", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API 와 WEB 서비스", + "section_id": "V4.2", + "section_name": "HTTP 메세지 구조 검증", + "req_id": "V4.2.3", + "req_description": "응답 분할 및 헤더 인젝션 공격을 예방하기 위해서 애플리케이션이 Transfer-encoding과 같은 connection-specific 헤더 필드를 가진 HTTP/2또는 HTTP/3 메세지를 전송하거나 수락하지 않는지 확인한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API 와 WEB 서비스", + "section_id": "V4.2", + "section_name": "HTTP 메세지 구조 검증", + "req_id": "V4.2.4", + "req_description": "헤더 인젝션 공격을 예방하기 위해서, 애플리케이션이 헤더 이름과 값에 CR(\\r), LF(\\n), CRLF(\\r\\n)과 같은 줄바꿈 문자가 포함되어 있지 않은 HTTP/2 및 HTTP/3 요청만 허용하는지 확인한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API 와 WEB 서비스", + "section_id": "V4.2", + "section_name": "HTTP 메세지 구조 검증", + "req_id": "V4.2.5", + "req_description": "애플리케이션(백엔드 또는 프론트엔드)이 요청을 빌드하고 전송하는 경우, 수신 구성 요소가 수학하기에는 너무 긴 URI(ex. API 호출) 또는 HTTP 요청 헤더 필드(ex. Authorization 또는 Cookie)를 생성하지 않도록 검증, 검열 또는 기타 메커니즘을 사용하는지 확인한다. 이로 인해서 지나치게 긴 요청(ex. 긴 쿠키 헤더 필드)을 보낼 때와 같이 서비스 거부가 발생하여 서버가 항상 오류 상태로 응답할 수 있다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API 와 WEB 서비스", + "section_id": "V4.3", + "section_name": "GraphQL", + "req_id": "V4.3.1", + "req_description": "쿼리 허용 목록, 깊이 제한, 양 제한 또는 쿼리 비용 분석을 사용하여 값비싼 중첩 쿼리로 인해 GraphQL 또는 데이터 계층 표현식 거부(DOS)를 방지하는지 확인한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API 와 WEB 서비스", + "section_id": "V4.3", + "section_name": "GraphQL", + "req_id": "V4.3.2", + "req_description": "GraphQL API가 다른 사용자에 의해 사용되지 않는 한, 운영 환경에서 GraphQL 점검 쿼리들이 비비활성화되어 있는지 확인한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API 와 WEB 서비스", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.1", + "req_description": "모든 WebSocket 연결에 WebSocket over TLS(WSS)이 사용되는지 확인한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API 와 WEB 서비스", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.2", + "req_description": "초기 HTTP WebSocket Handshake 중에 기존 헤더 필드가 애플리케이션에 허용된 기존 목록과 대조되는지 확인한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API 와 WEB 서비스", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.3", + "req_description": "애플리케이션의 표준 세션 관리를 사용할 수 없는 경우, 관련 세션 관리 보안 요구 사항을 준수하는 전용 토큰이 사용되고 있는지 확인한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API 와 WEB 서비스", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.4", + "req_description": "기존 HTTPS 세션을 WebSocket 채널로 전환할 때 이전에 인증된 HTTPS 세션을 통해 전용 WebSocket 세션 관리 토큰을 처음 얻거나 검증하는지 확인한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "파일 처리", + "section_id": "V5.1", + "section_name": "파일 처리 문서화", + "req_id": "V5.1.1", + "req_description": "업로드 기능별로 허용되는 파일 형식, 예상되는 파일 확장자, 그리고 최대 크기(압축 해제된 크기 포함)가 문서에 정의되어 있는지 검증해야 한다. 또한, 악성 파일이 탐지될 때 애플리케이션이 어떻게 동작하는지와 같이, 최종 사용자가 파일을 안전하게 다운로드하고 처리할 수 있도록 하는 방법이 문서에 명시되어 있는지 확인해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "파일 처리", + "section_id": "V5.2", + "section_name": "파일 업로드 및 콘텐츠", + "req_id": "V5.2.1", + "req_description": "애플리케이션이 성능 저하나 서비스 거부 공격(Denial of Service; DoS)을 유발하지 않고 처리할 수 있는 크기의 파일만 허용하는지 검증해야 한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "파일 처리", + "section_id": "V5.2", + "section_name": "파일 업로드 및 콘텐츠", + "req_id": "V5.2.2", + "req_description": "애플리케이션이 파일 자체 또는 zip 파일과 같은 아카이브 내에서 파일을 허용할 때, 파일 확장자가 예상 파일 확장자와 일치하는지 확인하고 내용이 확장자로 표현된 유형과 일치하는지 확인하는지 검증해야 한다. 여기에는 초기 '매직 바이트(magic bytes)' 확인, 이미지 재작성 수행, 파일 내용 유효성 검사를 위한 전문 라이브러리 사용이 포함되지만 이에 국한되지 않는다. L1의 경우, 특정 비즈니스 또는 보안 결정을 내리는 데 사용되는 파일에만 집중할 수 있다. L2 이상에서는 허용되는 모든 파일에 적용되어야 한다", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "파일 처리", + "section_id": "V5.2", + "section_name": "파일 업로드 및 콘텐츠", + "req_id": "V5.2.3", + "req_description": "애플리케이션이 압축 파일(예: zip, gz, docx, odt)을 압축 해제하기 전에 허용되는 최대 압축 해제 크기와 최대 파일 수를 확인하는지 검증해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "파일 처리", + "section_id": "V5.2", + "section_name": "파일 업로드 및 콘텐츠", + "req_id": "V5.2.4", + "req_description": "단일 사용자가 너무 많은 파일이나 과도하게 큰 파일로 저장 공간을 채우지 않도록 사용자별 파일 크기 할당량(quota) 및 최대 파일 수가 적용되는지 검증해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "파일 처리", + "section_id": "V5.2", + "section_name": "파일 업로드 및 콘텐츠", + "req_id": "V5.2.5", + "req_description": "애플리케이션이 심볼릭 링크(symlink)를 포함하는 압축 파일 업로드를 허용하지 않는지 검증해야 한다. 단, 이러한 기능이 특별히 요구되는 경우에는 심볼릭 링크할 수 있는 파일의 허용 목록(allowlist)을 강제하는 것이 필요하다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "파일 처리", + "section_id": "V5.2", + "section_name": "파일 업로드 및 콘텐츠", + "req_id": "V5.2.6", + "req_description": "픽셀 플러드 공격(Pixel Flood Attack)을 방지하기 위해, 애플리케이션이 업로드된 이미지의 픽셀 크기가 허용된 최대값보다 큰 경우 해당 이미지를 거부하는지 검증해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "파일 처리", + "section_id": "V5.3", + "section_name": "파일 저장", + "req_id": "V5.3.1", + "req_description": "신뢰할 수 없는 입력으로 업로드되거나 생성되어 공개 폴더에 저장된 파일이 HTTP 요청으로 직접 접근될 때 서버 측 프로그램 코드로 실행되지 않는지 검증해야 한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "파일 처리", + "section_id": "V5.3", + "section_name": "파일 저장", + "req_id": "V5.3.2", + "req_description": "애플리케이션이 파일 작업을 위한 파일 경로를 생성할 때, 사용자 제출 파일명 대신 내부적으로 생성되거나 신뢰할 수 있는 데이터를 사용하는지 검증해야 한다. 만약 사용자 제출 파일명 또는 파일 메타데이터를 반드시 사용해야 한다면, 경로 탐색(path traversal), 로컬 또는 원격 파일 포함(Local File Inclusion; LFI, Remote File Inclusion; RFI), 그리고 서버 측 요청 위조(Server-side Request Forgery; SSRF) 공격으로부터 보호하기 위해 엄격한 유효성 검사 및 정제(Sanitization)가 적용되는지 확인해야 한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "파일 처리", + "section_id": "V5.3", + "section_name": "파일 저장", + "req_id": "V5.3.3", + "req_description": "파일 압축 해제와 같은 서버 측 파일 처리가 zip slip과 같은 취약점을 방지하기 위해 사용자 제공 경로 정보를 무시하는지 검증해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "파일 처리", + "section_id": "V5.4", + "section_name": "파일 다운로드", + "req_id": "V5.4.1", + "req_description": "애플리케이션이 JSON, JSONP 또는 URL 파라미터를 포함한 사용자 제출 파일명을 검증하거나 무시하는지 검증해야 하고, 응답의 Content-Disposition 헤더 필드에 파일명을 명시하는지 검증해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "파일 처리", + "section_id": "V5.4", + "section_name": "파일 다운로드", + "req_id": "V5.4.2", + "req_description": "제공되는 파일 이름(예: HTTP 응답 헤더 필드 또는 이메일 첨부 파일)이 문서 구조를 보존하고 삽입 공격(Injection Attack)을 방지하기 위해 인코딩되거나 정제되는지 검증해야 한다. (예: RFC 6266 준수)", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "파일 처리", + "section_id": "V5.4", + "section_name": "파일 다운로드", + "req_id": "V5.4.3", + "req_description": "신뢰할 수 없는 소스에서 얻은 파일이 알려진 악성 콘텐츠 제공을 방지하기 위해 안티바이러스 스캐너에 의해 검사되는지 검증해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.1", + "section_name": "Authentication Documentation", + "req_id": "V6.1.1", + "req_description": "인증 문서가 크리덴셜 스터핑, 비밀번호 무차별 대입 공격 등을 방어하기 위해 속도 제한, 자동화 방지, 적응형 응답(adaptive response)과 같은 제어가 어떻게 사용되는지를 정의한다. 또한, 이러한 제어가 어떻게 구성되는지와 악의적으로 계정을 잠그는 것을 방지하는 방법을 명확히 하는지 검증한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.1", + "section_name": "Authentication Documentation", + "req_id": "V6.1.2", + "req_description": "조직명, 제품명, 시스템 식별자, 프로젝트 코드명, 부서명 또는 역할명 등 문맥적으로 특정된 단어의 변형을 포함하여, 비밀번호에 사용되지 않도록 문서화된 단어 목록이 있는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.1", + "section_name": "Authentication Documentation", + "req_id": "V6.1.3", + "req_description": "애플리케이션이 여러 인증 경로를 포함하는 경우, 이들 모두가 문서화되어 있으며 각 경로에 대해 일관되게 적용되는 보안 제어와 인증 강도가 정의되어 있는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.2", + "section_name": "비밀번호 보안", + "req_id": "V6.2.1", + "req_description": "사용자가 설정하는 비밀번호가 최소 8자 이상이어야 하며, 최소 15자 이상을 강력히 권장하는지 검증한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.2", + "section_name": "비밀번호 보안", + "req_id": "V6.2.2", + "req_description": "사용자가 비밀번호를 변경할 수 있는지 검증한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.2", + "section_name": "비밀번호 보안", + "req_id": "V6.2.3", + "req_description": "비밀번호 변경 기능이 사용자의 현재 비밀번호와 새 비밀번호를 요구하는지 검증한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.2", + "section_name": "비밀번호 보안", + "req_id": "V6.2.4", + "req_description": "계정 등록 또는 비밀번호 변경 시 제출된 비밀번호가 최소 3000개의 상위 비밀번호 목록과 비교 및 검사되는지, 이때 애플리케이션 비밀번호 정책(예: 최소 길이)을 만족하는지 검증한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.2", + "section_name": "비밀번호 보안", + "req_id": "V6.2.5", + "req_description": "비밀번호는 어떤 구성도 허용되며, 허용되는 문자 유형에 대한 제한이 없는지 검증한다. 대/소문자, 숫자, 특수문자에 대한 최소 개수 요구사항이 없어야 한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.2", + "section_name": "비밀번호 보안", + "req_id": "V6.2.6", + "req_description": "비밀번호 입력 필드가 type=password를 사용하여 입력을 마스킹하는지 검증한다. 애플리케이션은 사용자가 전체 비밀번호나 마지막 입력 문자를 일시적으로 볼 수 있도록 허용할 수 있다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.2", + "section_name": "비밀번호 보안", + "req_id": "V6.2.7", + "req_description": "붙여넣기 기능, 브라우저 비밀번호 도우미, 외부 비밀번호 관리자의 사용이 허용되는지 검증한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.2", + "section_name": "비밀번호 보안", + "req_id": "V6.2.8", + "req_description": "애플리케이션이 비밀번호를 사용자로부터 수신한 그대로 검증하며, 대소문자 변경이나 잘림(truncation)과 같은 수정 없이 처리하는지 검증한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.2", + "section_name": "비밀번호 보안", + "req_id": "V6.2.9", + "req_description": "비밀번호가 최소 64자까지 허용되는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.2", + "section_name": "비밀번호 보안", + "req_id": "V6.2.10", + "req_description": "사용자의 비밀번호는 손상되었음이 발견되거나 사용자가 교체할 때까지 유효하며, 애플리케이션이 주기적인 자격 증명 교체를 요구하지 않는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.2", + "section_name": "비밀번호 보안", + "req_id": "V6.2.11", + "req_description": "문서화된 문맥별 단어 목록을 사용하여 추측하기 쉬운 비밀번호가 생성되지 않도록 하는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.2", + "section_name": "비밀번호 보안", + "req_id": "V6.2.12", + "req_description": "계정 등록 또는 비밀번호 변경 시 제출된 비밀번호가 유출된 비밀번호 집합과 비교 및 검사되는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.3", + "section_name": "일반 인증 보안", + "req_id": "V6.3.1", + "req_description": "애플리케이션의 보안 문서에 따라 크리덴셜 스터핑 및 비밀번호 무차별 대입 공격을 방지하기 위한 제어가 구현되어 있는지 검증한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.3", + "section_name": "일반 인증 보안", + "req_id": "V6.3.2", + "req_description": "“root”, “admin”, “sa”와 같은 기본 사용자 계정이 애플리케이션에 존재하지 않거나 비활성화되어 있는지 검증한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.3", + "section_name": "일반 인증 보안", + "req_id": "V6.3.3", + "req_description": "애플리케이션 접근 시 반드시 MFA 또는 단일 요소 인증 메커니즘의 조합을 사용하는지 검증한다. L3의 경우, 인증을 수행하려는 사용자의 의도를 검증하기 위해 사용자가 직접 수행하는 동작(예: FIDO 하드웨어 키 또는 모바일 기기에서 버튼을 누르는 행위)을 요구함으로써, 피싱 공격에 대한 침해 및 위장 저항성을 제공하는 하드웨어 기반 인증 메커니즘이 반드시 하나의 요소로 포함되어야 한다. 이 요구사항에서 고려 사항을 완화하려는 경우, 완전히 문서화된 근거와 포괄적인 보완 통제가 반드시 수반되어야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.3", + "section_name": "일반 인증 보안", + "req_id": "V6.3.4", + "req_description": "여러 인증 경로가 존재하는 경우, 문서화되지 않은 경로가 없어야 하며 보안 제어와 인증 강도가 일관되게 적용되는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.3", + "section_name": "일반 인증 보안", + "req_id": "V6.3.5", + "req_description": "사용자가 의심스러운 인증 시도에 대해 성공 여부와 관계 없이 알림을 제공받는지 검증한다. 여기에는 비정상적인 위치나 클라이언트에서의 인증 시도, 부분적으로만 성공한 인증(여러 요소 중 하나만 성공한 경우), 장기간 비활성 상태 이후의 인증 시도, 또는 여러 번의 인증 실패 후 성공한 인증이 포함될 수 있다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.3", + "section_name": "일반 인증 보안", + "req_id": "V6.3.6", + "req_description": "이메일이 단일 또는 다중 요소 인증 메커니즘으로 사용되지 않는지 검증한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.3", + "section_name": "일반 인증 보안", + "req_id": "V6.3.7", + "req_description": "자격 증명 재설정, 사용자명/이메일 수정 등 인증 관련 정보 변경 이후 사용자에게 통지되는지 검증한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.3", + "section_name": "일반 인증 보안", + "req_id": "V6.3.8", + "req_description": "오류 메시지, HTTP 응답 코드, 응답 시간 차이 등을 통해 유효한 사용자를 유추할 수 없으며, 비밀번호 등록/찾기 기능에도 동일한 보호가 적용되는지 검증한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.4", + "section_name": "인증 요소 수명 주기 및 복구", + "req_id": "V6.4.1", + "req_description": "시스템이 생성하는 초기 비밀번호나 활성화 코드가 안전하게 난수로 생성되며, 기존 비밀번호 정책을 따르고, 짧은 기간 내 또는 최초 사용 시 만료되는지 검증한다. 초기 비밀번호는 장기 비밀번호로 허용되지 않아야 한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.4", + "section_name": "인증 요소 수명 주기 및 복구", + "req_id": "V6.4.2", + "req_description": "비밀번호 힌트나 지식 기반 인증(“비밀 질문”)이 존재하지 않는지 검증한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.4", + "section_name": "인증 요소 수명 주기 및 복구", + "req_id": "V6.4.3", + "req_description": "분실된 비밀번호에 대한 재설정 절차가 안전하게 구현되며, MFA를 우회하지 않는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.4", + "section_name": "인증 요소 수명 주기 및 복구", + "req_id": "V6.4.4", + "req_description": "MFA 요소 분실 시, 등록 시와 동일 수준의 신원 증명이 수행되는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.4", + "section_name": "인증 요소 수명 주기 및 복구", + "req_id": "V6.4.5", + "req_description": "만료 예정인 인증 메커니즘에 대한 갱신 안내가 충분한 시간 전에 발송되며, 필요한 경우 자동 알림이 구성되는지 검증한다", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.4", + "section_name": "인증 요소 수명 주기 및 복구", + "req_id": "V6.4.6", + "req_description": "관리자가 사용자 비밀번호 재설정 절차를 시작할 수 있으나, 사용자의 비밀번호를 직접 변경하거나 지정할 수 없는지 검증한다. 이는 관리자가 사용자의 비밀번호를 알지 못하도록 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.5", + "section_name": "General Multi-factor authentication requirements", + "req_id": "V6.5.1", + "req_description": "조회 secret, 대역 외 인증 요청 및 코드, 시간 기반 일회용 비밀번호가 단 한 번만 성공적으로 사용 가능한지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.5", + "section_name": "General Multi-factor authentication requirements", + "req_id": "V6.5.2", + "req_description": "애플리케이션 백엔드에 저장될 때, 엔트로피가 112비트 미만인 룩업 시크릿(예: 무작위 영숫자 19자 또는 무작위 숫자 34자)은 32비트 무작위 솔트(salt)를 포함하는 사전 승인된 비밀번호 저장용 해시 알고리즘으로 해시되는지 검증한다. 룩업 시크릿이 112비트 이상의 엔트로피를 가진 경우에는 표준 해시 함수를 사용할 수 있다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.5", + "section_name": "General Multi-factor authentication requirements", + "req_id": "V6.5.3", + "req_description": "룩업 시크릿, 대역 외 인증 코드, 그리고 시간 기반 일회용 비밀번호의 시드가 예측 가능한 값을 피하기 위해 암호학적으로 안전한 의사난수 생성기(CSPRNG)를 사용하여 생성되는지 검증한다. ", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.5", + "section_name": "General Multi-factor authentication requirements", + "req_id": "V6.5.4", + "req_description": "룩업 시크릿과 대역 외 인증 코드가 최소 20비트의 엔트로피를 가지는지 검증한다. 일반적으로 무작위 영숫자 4자 또는 무작위 숫자 6자가 충분하다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.5", + "section_name": "General Multi-factor authentication requirements", + "req_id": "V6.5.5", + "req_description": "대역 외 인증 요청, 코드 또는 토큰과 시간 기반 일회용 비밀번호가 정의된 수명을 가지는지 검증한다. 대역 외 요청의 최대 수명은 10분이어야 하며, TOTP의 최대 수명은 30초이어야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.5", + "section_name": "General Multi-factor authentication requirements", + "req_id": "V6.5.6", + "req_description": "도난이나 기타 손실의 경우 모든 인증 요소(물리적 장치 포함)를 해지할 수 있는지 검증한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.5", + "section_name": "General Multi-factor authentication requirements", + "req_id": "V6.5.7", + "req_description": "생체 인식 인증 메커니즘은 반드시 보조 요소로만 사용되어야 하며, “소유하고 있는 것” 또는 “알고 있는 것” 중 하나와 함께 사용되는지 검증한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.5", + "section_name": "General Multi-factor authentication requirements", + "req_id": "V6.5.8", + "req_description": "시간 기반 일회용 비밀번호는 신뢰할 수 있는 서비스의 시간 소스를 기준으로 검증되어야 하며, 신뢰할 수 없거나 클라이언트에서 제공한 시간을 기반으로 해서는 안 된다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.6", + "section_name": "대역 외(Out-of-Band) 인증 메커니즘", + "req_id": "V6.6.1", + "req_description": "공중 교환 전화망(PSTN)을 사용하여 전화나 SMS를 통해 일회용 비밀번호(OTPs)를 전달하는 인증 메커니즘은, 해당 전화번호가 사전에 검증되었을 때만 제공되어야 하며, 더 강력한 대체 방법(예: 시간 기반 일회용 비밀번호)도 제공되어야 하고, 서비스는 사용자에게 이러한 보안 위험에 대한 정보를 제공해야 한다. L3 애플리케이션의 경우, 전화와 SMS는 옵션으로 제공되어서는 안 된다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.6", + "section_name": "대역 외(Out-of-Band) 인증 메커니즘", + "req_id": "V6.6.2", + "req_description": "대역 외 인증 요청, 코드 또는 토큰은 생성된 원래 인증 요청에만 바인딩되어야 하며, 이전이나 이후의 요청에는 사용할 수 없어야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.6", + "section_name": "대역 외(Out-of-Band) 인증 메커니즘", + "req_id": "V6.6.3", + "req_description": "코드 기반 대역 외 인증 메커니즘이 속도 제한 등을 통해 무차별 대입 공격으로부터 보호되는지 검증한다. 또한 최소 64비트 이상의 엔트로피를 가진 코드를 사용하는 것도 고려해야한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.6", + "section_name": "대역 외(Out-of-Band) 인증 메커니즘", + "req_id": "V6.6.4", + "req_description": "다중요소 인증에 푸시 알림이 사용되는 경우, 푸시 폭탄(push bombing) 공격을 방지하기 위해 속도 제한을 적용해야 한다. 또한 숫자 일치 기법 역시 이 위험을 완화할 수 있다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.7", + "section_name": "암호학적 인증 메커니즘", + "req_id": "V6.7.1", + "req_description": "암호학적 인증 단언(assertion)을 검증하는 데 사용되는 인증서는 수정으로부터 보호되는 방식으로 저장되는지 검증한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.7", + "section_name": "암호학적 인증 메커니즘", + "req_id": "V6.7.2", + "req_description": "챌린지 논스(nonce)는 최소 64비트 길이여야 하며, 통계적으로 고유하거나 해당 암호 장치의 수명 동안 고유해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.8", + "section_name": "ID 제공자(IdP)를 통한 인증", + "req_id": "V6.8.1", + "req_description": "애플리케이션이 다중 ID 제공자(IdP)를 지원하는 경우, 사용자의 신원이 다른 지원 IdP를 통해 위조될 수 없는지 검증한다. (예: 동일한 사용자 식별자를 사용하는 방식). 표준적인 대응책은 애플리케이션이 IdP ID(네임스페이스 역할)와 IdP 내 사용자 ID의 조합을 사용하여 사용자를 등록하고 식별하는 것이다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.8", + "section_name": "ID 제공자(IdP)를 통한 인증", + "req_id": "V6.8.2", + "req_description": "인증 단언(예: JWT 또는 SAML 단언)의 디지털 서명이 존재하고 무결성이 항상 유지되는지를 검증한다. 서명이 없거나 유효하지 않은 단언은 거부해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.8", + "section_name": "ID 제공자(IdP)를 통한 인증", + "req_id": "V6.8.3", + "req_description": "SAML 단언이 재생 공격의 방지를 위해 고유하게 처리되는지, 유효 기간 내에 단 한 번만 사용되는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "인증", + "section_id": "V6.8", + "section_name": "ID 제공자(IdP)를 통한 인증", + "req_id": "V6.8.4", + "req_description": "애플리케이션이 별도의 ID 제공자(IdP)를 사용하고 특정 기능에 대해 특정 인증 강도, 방식, 또는 최근성을 요구하는 경우, 애플리케이션은 IdP가 반환한 정보를 사용하여 이를 검증해야 한다. 예를 들어, OIDC가 사용되는 경우, 이는 ‘acr’, ‘amr’, ‘auth_time’(존재하는 경우)과 같은 ID 토큰 클레임을 검증함으로써 달성할 수 있다. IdP가 이 정보를 제공하지 않는 경우, 애플리케이션은 최소 강도의 인증 메커니즘(예: 사용자 이름과 비밀번호를 사용하는 단일요소 인증)이 사용되었다고 가정하는 문서화된 대체 접근법을 가져야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.1", + "section_name": "세션 관리 문서화", + "req_id": "V7.1.1", + "req_description": "사용자의 세션 비활성 시간 초과 및 절대 최대 세션 수명에 대한 문서가 존재하고, 다른 제어와의 조합에서 적절하며, NIST SP 800-63B 재인증 요구사항에서 벗어날 시 그 근거가 문서에 포함되어 있는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.1", + "section_name": "세션 관리 문서화", + "req_id": "V7.1.2", + "req_description": "문서가 하나의 계정에서 허용되는 동시(병렬) 세션 수와 활성 세션 수의 최대값에 도달했을 때의 의도된 동작과 수행할 조치를 정의하는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.1", + "section_name": "세션 관리 문서화", + "req_id": "V7.1.3", + "req_description": "통합 신원 관리 생태계(예: SSO 시스템)의 일부로 사용자 세션을 생성하고 관리하는 모든 시스템이 문서화되어 있으며, 세션 수명, 종료, 재인증이 필요한 기타 조건을 조율하기 위한 제어가 포함되어 있는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.2", + "section_name": "기본 세션 관리 보안", + "req_id": "V7.2.1", + "req_description": "애플리케이션이 모든 세션 토큰 검증을 신뢰할 수 있는 백엔드 서비스에서 수행하는지 검증한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.2", + "section_name": "기본 세션 관리 보안", + "req_id": "V7.2.2", + "req_description": "애플리케이션이 세션 관리를 위해 정적 API 시크릿이나 키가 아닌, 자체 포함 토큰 또는 참조 토큰을 동적으로 생성하여 사용하는지 검증한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.2", + "section_name": "기본 세션 관리 보안", + "req_id": "V7.2.3", + "req_description": "참조 토큰이 사용자 세션을 나타내는 데 사용되는 경우, 그 토큰이 고유하고, 암호학적으로 안전한 의사난수 생성기(CSPRNG)를 사용해 생성되며 최소 128비트의 엔트로피를 갖는지 검증한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.2", + "section_name": "기본 세션 관리 보안", + "req_id": "V7.2.4", + "req_description": "애플리케이션이 사용자 인증(재인증 포함) 시 새로운 세션 토큰을 생성하고 기존 세션 토큰을 종료하는지 검증한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.3", + "section_name": "세션 타임아웃", + "req_id": "V7.3.1", + "req_description": "위험 분석 및 문서화된 보안 결정에 따라 재인증을 강제하는 비활성 시간 초과가 존재하는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.3", + "section_name": "세션 타임아웃", + "req_id": "V7.3.2", + "req_description": "위험 분석 및 문서화된 보안 결정에 따라 재인증을 강제하는 절대 최대 세션 수명이 존재하는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.4", + "section_name": "세션 종료", + "req_id": "V7.4.1", + "req_description": "로그아웃이나 만료와 같이 세션 종료가 트리거될 때, 애플리케이션이 해당 세션의 추가 사용을 허용하지 않는지 검증한다. 참조 토큰 또는 상태 유지형 세션의 경우, 이는 애플리케이션 백엔드에서 세션 데이터를 무효화하는 것을 의미한다. 자체 포함 토큰을 사용하는 애플리케이션은 종료된 토큰 목록 유지, 사용자별 날짜·시간 이전에 발급된 토큰 거부, 사용자별 서명 키 회전과 같은 방법을 사용해야 한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.4", + "section_name": "세션 종료", + "req_id": "V7.4.2", + "req_description": "사용자 계정이 비활성화되거나 삭제될 때(예: 직원 퇴사), 애플리케이션이 모든 활성 세션을 종료하는지 검증한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.4", + "section_name": "세션 종료", + "req_id": "V7.4.3", + "req_description": "비밀번호 재설정·복구를 통한 변경, MFA 설정 변경 등 어떤 인증 요소라도 성공적으로 변경 또는 제거한 후, 모든 다른 활성 세션을 종료할 수 있는 옵션을 제공하는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.4", + "section_name": "세션 종료", + "req_id": "V7.4.4", + "req_description": "인증이 필요한 모든 페이지의 로그아웃 기능에 접근하는 것이 쉽고 잘 보이는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.4", + "section_name": "세션 종료", + "req_id": "V7.4.5", + "req_description": "애플리케이션 관리자가 개별 사용자 또는 모든 사용자의 활성 세션을 종료할 수 있는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.5", + "section_name": "세션 악용 방어", + "req_id": "V7.5.1", + "req_description": "이메일 주소, 전화번호, MFA 구성, 계정 복구에 사용되는 기타 정보 등 인증에 영향을 줄 수 있는 민감한 계정 속성을 변경하기 전에 전체 재인증을 요구하는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.5", + "section_name": "세션 악용 방어", + "req_id": "V7.5.2", + "req_description": "사용자가 현재 활성 세션을 전체 또는 일부 확인하고(최소 요소 한 개에 대한 인증을 다시 수행한 후) 종료할 수 있는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.5", + "section_name": "세션 악용 방어", + "req_id": "V7.5.3", + "req_description": "매우 민감한 거래나 작업을 수행하기 전에 최소 한 요소 인증 또는 2차 검증을 요구하는지 검증한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.6", + "section_name": "페더레이션 재인증", + "req_id": "V7.6.1", + "req_description": "RP와 IdP 간 세션 수명과 종료가 문서대로 동작하며, IdP 인증 이벤트 간의 최대 시간이 도달하는 경우 등 필요한 시점에 재인증을 요구하는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "세션 관리", + "section_id": "V7.6", + "section_name": "페더레이션 재인증", + "req_id": "V7.6.2", + "req_description": "세션 생성 시 사용자 동의 또는 명시적 동작을 요구하여, 사용자 상호작용 없이 새로운 애플리케이션 세션이 생성되지 않도록 하는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "권한 부여", + "section_id": "V8.1", + "section_name": "권한 부여 문서화", + "req_id": "V8.1.1", + "req_description": "권한 부여 문서가 소비자 권한과 자원 속성에 따라 기능 수준 및 데이터별 접근을 제한하는 규칙을 정의하는지 검증한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "권한 부여", + "section_id": "V8.1", + "section_name": "권한 부여 문서화", + "req_id": "V8.1.2", + "req_description": "권한 부여 문서가 소비자 권한과 자원 속성에 따라 필드 수준 접근 제한(읽기 및 쓰기 모두)을 정의하는지 검증한다. 이러한 규칙은 관련 데이터 객체의 상태(state)나 상태값(status)과 같은 다른 속성 값에 의존할 수 있다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "권한 부여", + "section_id": "V8.1", + "section_name": "권한 부여 문서화", + "req_id": "V8.1.3", + "req_description": "애플리케이션 문서가 인증 및 권한 부여와 관련된 보안 결정을 내리는 데 사용되는 환경적, 맥락적 속성(예: 시간대, 사용자 위치, IP 주소, 디바이스 등)을 정의하는지 검증한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "권한 부여", + "section_id": "V8.1", + "section_name": "권한 부여 문서화", + "req_id": "V8.1.4", + "req_description": "인증 및 권한 부여 문서가 기능 수준, 데이터별, 필드 수준 권한 부여에 더해 환경적, 맥락적 요소가 의사 결정에 어떻게 사용되는지 정의하는지 검증한다. 여기에는 평가되는 속성, 위험 임계값, 수행되는 조치(예: 허용, 추가 인증 요청, 거부, 단계적 인증)을 포함하는 것을 권장한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "권한 부여", + "section_id": "V8.2", + "section_name": "일반 권한 부여 설계", + "req_id": "V8.2.1", + "req_description": "애플리케이션이 기능 수준의 접근을 명시적 권한이 있는 소비자에게만 허용하는지 검증한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "권한 부여", + "section_id": "V8.2", + "section_name": "일반 권한 부여 설계", + "req_id": "V8.2.2", + "req_description": "애플리케이션이 특정 데이터 항목에 대한 명시적 권한이 있는 소비자에게만 데이터별 접근을 허용하여, 안전하지 않은 직접 객체 참조(IDOR) 및 객체 수준 권한 부여 취약점(BOLA)을 방지하는지 검증한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "권한 부여", + "section_id": "V8.2", + "section_name": "일반 권한 부여 설계", + "req_id": "V8.2.3", + "req_description": "애플리케이션이 특정 필드에 대한 명시적 권한이 있는 소비자에게만 필드 수준 접근을 허용하여, 객체 속성 수준 권한 부여 취약점(BOPLA)을 방지하는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "권한 부여", + "section_id": "V8.2", + "section_name": "일반 권한 부여 설계", + "req_id": "V8.2.4", + "req_description": "애플리케이션 문서에서 정의한 바에 따라, 소비자의 환경적, 맥락적 속성(예: 시간대, 위치, IP 주소 또는 장치)에 기반한 적응형 보안 제어가 인증 및 권한 부여 결정에 구현되는지 검증한다. 이러한 제어는 소비자가 새 세션을 시작할 때뿐만 아니라 기존 세션 중에도 반드시 적용되어야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "권한 부여", + "section_id": "V8.3", + "section_name": "운영 수준 권한 부여", + "req_id": "V8.3.1", + "req_description": "애플리케이션이 권한 부여 규칙을 신뢰할 수 있는 서비스 계층에서 적용하고, 클라이언트 측 JavaScript처럼 신뢰할 수 없는 소비자가 조작할 수 있는 제어에 의존하지 않는지 검증한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "권한 부여", + "section_id": "V8.3", + "section_name": "운영 수준 권한 부여", + "req_id": "V8.3.2", + "req_description": "권한 부여 결정에 영향을 미치는 값의 변경 사항이 즉시 적용되는지 검증한다. 자체 포함 토큰(self-contained token)과 같이 즉시 적용이 불가능한 경우, 소비자가 더 이상 권한이 없는 작업을 수행할 때 이를 알리고 변경을 되돌리는 완화 제어를 반드시 두어야 한다. 단, 이 방법은 정보 유출을 방지하지는 못한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "권한 부여", + "section_id": "V8.3", + "section_name": "운영 수준 권한 부여", + "req_id": "V8.3.3", + "req_description": "객체에 대한 접근이, 대리인이나 이를 대신 수행하는 서비스의 권한이 아닌, 원래 주체(예: 소비자)의 권한에 기반하는지 검증한다. 예를 들어, 소비자가 인증을 위해 자체 포함 토큰을 사용하여 웹 서비스를 호출하고, 해당 서비스가 다른 서비스에 데이터를 요청하는 경우, 두 번째 서비스는 첫 번째 서비스의 머신-투-머신 토큰이 아니라 소비자의 토큰을 사용하여 권한 결정을 내려야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "권한 부여", + "section_id": "V8.4", + "section_name": "기타 권한 부여 고려사항", + "req_id": "V8.4.1", + "req_description": "다중 테넌트 애플리케이션이 교차 테넌트 제어를 사용하여, 소비자의 작업이 권한이 없는 다른 테넌트에 영향을 미치지 않도록 하는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "권한 부여", + "section_id": "V8.4", + "section_name": "기타 권한 부여 고려사항", + "req_id": "V8.4.2", + "req_description": "관리 인터페이스 접근이 연속적인 소비자 신원 검증, 장치 보안 상태 평가, 맥락 기반 위험 분석 등 복수의 보안 계층을 포함하는지 검증한다. 네트워크 위치나 신뢰된 엔드포인트가 무단 접근 가능성을 줄일 수는 있더라도, 단독으로 권한 부여 판단의 유일한 요소가 되어서는 안 된다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "자체 포함 토큰(self-contained token)", + "section_id": "V9.1", + "section_name": "토큰 출처 및 무결성", + "req_id": "V9.1.1", + "req_description": "자체 포함 토큰 내용을 허용하기 전에 변조를 방지하기 위해 디지털 서명 또는 메시지 인증 코드(MAC)를 사용하여 토큰의 무결성을 검증해야 한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "자체 포함 토큰(self-contained token)", + "section_id": "V9.1", + "section_name": "토큰 출처 및 무결성", + "req_id": "V9.1.2", + "req_description": "주어진 컨텍스트에 대해 자체 포함 토큰을 생성하고 검증할 때, 허용 목록에 있는 알고리즘만 사용될 수 있는지 검증해야 한다. 허용 목록에는 사용 가능한 알고리즘을 모두 포함해야 하며, 이상적으로는 대칭 또는 비대칭 알고리즘 중 하나만을 포함해야 한다. 또한 'None' 알고리즘은 반드시 제외해야 한다. 대칭 및 비대칭 알고리즘 모두를 지원해야 하는 경우, 키 혼동을 방지하기 위해 추가 제어가 필요하다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "자체 포함 토큰(self-contained token)", + "section_id": "V9.1", + "section_name": "토큰 출처 및 무결성", + "req_id": "V9.1.3", + "req_description": "자체 포함 토큰을 검증하는 데 사용되는 키 자료가 토큰 발행자를 위한 신뢰할 수 있는 사전 구성된 출처에서 비롯되었는지 검증하여, 공격자가 신뢰할 수 없는 출처 및 키를 지정하는 것을 방지해야 한다. JWT 및 기타 JWS 구조의 경우, 'jku', 'x5u', 'jwk'와 같은 헤더는 신뢰할 수 있는 출처의 허용 목록에 대해 검증되어야 한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "자체 포함 토큰(self-contained token)", + "section_id": "V9.2", + "section_name": "토큰 내용", + "req_id": "V9.2.1", + "req_description": "토큰 데이터에 유효 기간이 존재하는 경우, 검증 시간이 이 유효 기간 내에 있을 때만 토큰 및 해당 내용이 허용되는지 검증해야 한다. 예를 들어, JWT의 경우 'nbf' 및 'exp' 클레임이 검증되어야 한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "자체 포함 토큰(self-contained token)", + "section_id": "V9.2", + "section_name": "토큰 내용", + "req_id": "V9.2.2", + "req_description": "토큰을 수신하는 서비스가 토큰 내용을 수락하기 전에 올바른 유형이며 의도된 목적을 위한 것인지 토큰을 검증하는지 확인해야 한다. 예를 들어, 인가 결정에는 액세스 토큰만 허용될 수 있으며, 사용자 인증을 증명하는 데는 ID 토큰만 사용될 수 있다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "자체 포함 토큰(self-contained token)", + "section_id": "V9.2", + "section_name": "토큰 내용", + "req_id": "V9.2.3", + "req_description": "서비스가 대상 서비스(audience)와 함께 사용하기 위한 토큰만 허용하는지 검증해야 한다. JWT의 경우, 서비스에 정의된 허용 목록에 대해 'aud' 클레임을 검증함으로써 이를 달성할 수 있다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "자체 포함 토큰(self-contained token)", + "section_id": "V9.2", + "section_name": "토큰 내용", + "req_id": "V9.2.4", + "req_description": "토큰 발행자가 다른 대상(audience)에게 토큰을 발행하기 위해 동일한 개인 키를 사용하는 경우, 발행된 토큰이 의도된 대상을 고유하게 식별하는 대상 제한을 포함하는지 검증해야 한다. 이는 토큰이 의도하지 않은 대상에서 재사용되는 것을 방지한다. 대상 식별자가 동적으로 프로비저닝되는 경우, 토큰 발행자는 대상 위장(audience impersonation)을 초래하지 않도록 대상들을 검증해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.1", + "section_name": "일반적인 OAuth 및 OIDC 보안", + "req_id": "V10.1.1", + "req_description": "엄격하게 필요한 구성 요소에만 토큰이 전송되는지 검증해야 한다. 예를 들어, 브라우저 기반 JavaScript 애플리케이션에 프론트엔드 전용 백엔드(Backend For Frontend; BFF) 패턴을 사용하는 경우, 액세스 토큰 및 리프레시 토큰은 백엔드에서만 접근 가능해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.1", + "section_name": "일반적인 OAuth 및 OIDC 보안", + "req_id": "V10.1.2", + "req_description": "클라이언트는 인가 서버에서 제공하는 값(예: 인가 코드 또는 ID 토큰)이 동일한 사용자 에이전트 세션 및 트랜잭션에서 시작된 인가 플로우의 결과인 경우에만 허용하는지 검증해야 한다. 이를 위해 클라이언트가 생성하는 비밀 값(PKCE(Proof Key for Code Exchange)의 'code_verifier', 'state', OIDC의 'nonce' 등)은 추측이 불가능해야 하며, 해당 트랜잭션에 고유해야 하고, 트랜잭션이 시작된 클라이언트와 사용자 에이전트 세션 양쪽에 안전하게 결합(Binding)되어 있어야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.2", + "section_name": "OAuth 클라이언트", + "req_id": "V10.2.1", + "req_description": "코드 플로우를 사용하는 경우, OAuth 클라이언트는 토큰 요청을 유도하는 사이트 간 요청 위조 공격(Cross-Site Request Forgery; CSRF)에 대한 보호 기능을 갖추고 있는지 검증한다. 이를 위해 인가 요청 시 전송된 'state' 파라미터를 검증하거나, PKCE 기능을 사용해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.2", + "section_name": "OAuth 클라이언트", + "req_id": "V10.2.2", + "req_description": "OAuth 클라이언트가 둘 이상의 인가 서버와 상호 작용할 수 있는 경우, 믹스업 공격에 대한 방어 대책을 갖는지 검증해야 한다. 예를 들어, 인가 서버가 'iss' 파라미터 값을 반환하도록 요구하고 인가 응답 및 토큰 응답에서 이를 검증할 수 있다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.2", + "section_name": "OAuth 클라이언트", + "req_id": "V10.2.3", + "req_description": "OAuth 클라이언트가 인가 서버에 대한 요청에서 필요한 범위(또는 기타 인가 파라미터)만 요청하는지 검증해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.3", + "section_name": "OAuth 리소스 서버", + "req_id": "V10.3.1", + "req_description": "리소스 서버가 해당 서비스(audience)에 사용하도록 의도된 액세스 토큰만 수락하는지 검증해야 한다. 대상은 구조화된 액세스 토큰(예: JWT의 'aud' 클레임)에 포함될 수 있거나, 토큰 조회 엔드포인트를 사용하여 확인할 수 있다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.3", + "section_name": "OAuth 리소스 서버", + "req_id": "V10.3.2", + "req_description": "리소스 서버가 위임된 인가를 정의하는 액세스 토큰의 클레임을 기반으로 인가 결정을 시행하는지 검증해야 한다. 'sub', 'scope', 'authorization_details'와 같은 클레임이 존재하는 경우, 이는 결정에 반영되어야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.3", + "section_name": "OAuth 리소스 서버", + "req_id": "V10.3.3", + "req_description": "액세스 토큰(JWT 또는 관련 토큰 조회 응답)에서 고유한 사용자를 식별해야 하는 접근 제어 결정이 필요한 경우, 리소스 서버가 다른 사용자에게 재할당될 수 없는 클레임에서 사용자를 식별하는지 검증해야 한다. 일반적으로 이는 'iss' 및 'sub' 클레임의 조합을 사용하는 것을 의미한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.3", + "section_name": "OAuth 리소스 서버", + "req_id": "V10.3.4", + "req_description": "리소스 서버가 특정 인증 강도, 방법 또는 최신성을 요구하는 경우, 제시된 액세스 토큰이 이러한 제약 조건을 충족하는지 검증해야 한다. 예를 들어, 토큰을 제시한 경우 OIDC의 'acr', 'amr' 및 'auth_time' 클레임을 각각 사용해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.3", + "section_name": "OAuth 리소스 서버", + "req_id": "V10.3.5", + "req_description": "리소스 서버가 발신자 제약 액세스 토큰, 즉 OAuth 2용 상호 TLS(Mutual TLS; mTLS) 또는 OAuth 2 소유 증명(Demonstration of Proof of Possession; DPoP)를 요구하여 도난된 액세스 토큰 사용 또는 액세스 토큰 재사용(권한 없는 당사자로부터)을 방지하는지 검증해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.4", + "section_name": "OAuth 인가 서버", + "req_id": "V10.4.1", + "req_description": "인가 서버는 클라이언트 별로 사전 등록된 URI의 허용 목록을 기반으로 리디렉션 URI를 정확한 문자열 비교 방식으로 검증해야 한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.4", + "section_name": "OAuth 인가 서버", + "req_id": "V10.4.2", + "req_description": "인가 서버가 인가 응답에서 인가 코드를 반환하는 경우, 해당 코드는 토큰 요청에 한번만 사용될 수 있어야 한다. 이미 액세스 토큰을 발급하는 데 사용된 인가 코드를 사용하여 두 번째 요청이 발생하면, 인가 서버는 토큰 요청을 거부하고 해당 인가 코드와 관련된 모든 발급된 토큰을 취소해야 한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.4", + "section_name": "OAuth 인가 서버", + "req_id": "V10.4.3", + "req_description": "인가 코드가 단기간만 유효한지 검증해야 한다. 최대 수명은 L1 및 L2 애플리케이션의 경우 최대 10분, L3 애플리케이션의 경우 최대 1분 이내여야 한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.4", + "section_name": "OAuth 인가 서버", + "req_id": "V10.4.4", + "req_description": "인가 서버는 특정 클라이언트에 대해, 해당 클라이언트가 사용할 필요가 있는 인가 방식(grant)만 사용하도록 허용해야 한다. token(암시적 플로우) 및 password(리소스 소유자 비밀번호 자격 증명 플로우) 방식은 더 이상 사용되어서는 안 된다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.4", + "section_name": "OAuth 인가 서버", + "req_id": "V10.4.5", + "req_description": "인가 서버가 공개 클라이언트에 대한 리프레시 토큰 재사용 공격을 완화하는지 검증해야 한다. 가급적이면 발신자 제약 리프레시 토큰, 즉 소유 증명이나 mTLS를 사용한 인증서 바인딩 액세스 토큰을 사용해야 한다. L1 및 L2 애플리케이션의 경우, 리프레시 토큰 회전(rotation)이 사용될 수 있다. 리프레시 토큰 회전이 사용되는 경우, 인가 서버는 리프레시 토큰을 사용 후 무효화해야 하며, 이미 사용되고 무효화된 리프레시 토큰이 제공되면 해당 인가에 대한 모든 리프레시 토큰을 철회(revoke)해야 한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.4", + "section_name": "OAuth 인가 서버", + "req_id": "V10.4.6", + "req_description": "코드 인가 방식(code grant)이 사용되는 경우, 인가 서버가 PKCE를 요구하여 인가 코드 탈취 공격을 완화하는지 검증해야 한다. 인가 요청의 경우, 인가 서버는 유효한 'code_challenge' 값을 요구해야 하며, 'code_challenge_method'값으로 'plain'를 허용해서는 안 된다. 토큰 요청의 경우, 'code_verifier' 파라미터의 검증을 요구해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.4", + "section_name": "OAuth 인가 서버", + "req_id": "V10.4.7", + "req_description": "인가 서버가 인증되지 않은 동적 클라이언트 등록을 지원하는 경우, 악의적인 클라이언트 애플리케이션의 위험을 완화하는지 검증해야 한다. 등록된 URI와 같은 클라이언트 메타데이터를 검증하고, 사용자의 동의를 확인해야 하며, 신뢰할 수 없는 클라이언트 애플리케이션으로 인가 요청을 처리하기 전에 사용자에게 경고해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.4", + "section_name": "OAuth 인가 서버", + "req_id": "V10.4.8", + "req_description": "슬라이딩 리프레시 토큰 만료(expiration)가 적용되더라도, 리프레시 토큰에 절대 만료 시점(absolute expiration)이 포함되어 있는지 확인한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.4", + "section_name": "OAuth 인가 서버", + "req_id": "V10.4.9", + "req_description": "악의적인 클라이언트 또는 도난된 토큰의 위험을 완화하기 위해 인가 서버 사용자 인터페이스를 통해 권한 있는 사용자가 리프레시 토큰 및 참조 액세스 토큰을 철회할 수 있는지 검증해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.4", + "section_name": "OAuth 인가 서버", + "req_id": "V10.4.10", + "req_description": "토큰 요청, 푸시된 인가 요청(Pushed Authorization Request; PAR), 토큰 철회 요청과 같은 클라이언트에서 인가 서버로의 백채널 요청(backchannel request)에 대해 기밀 클라이언트가 인증되는지 검증해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.4", + "section_name": "OAuth 인가 서버", + "req_id": "V10.4.11", + "req_description": "인가 서버 구성이 OAuth 클라이언트에 필요한 범위만 할당하는지 검증해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.4", + "section_name": "OAuth 인가 서버", + "req_id": "V10.4.12", + "req_description": "주어진 클라이언트에 대해 인가 서버가 해당 클라이언트가 사용해야 하는 'response_mode' 값만 허용하는지 검증해야 한다. 예를 들어, 인가 서버가 이 값을 예상 값과 비교하여 검증하거나, PAR 또는 JWT 기반 인가 요청(JWT-secured Authorization Request; JAR)을 사용하여 검증해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.4", + "section_name": "OAuth 인가 서버", + "req_id": "V10.4.13", + "req_description": "인가 유형 'code'가 항상 PAR과 함께 사용되는지 검증해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.4", + "section_name": "OAuth 인가 서버", + "req_id": "V10.4.14", + "req_description": "인가 서버가 mTLS를 사용하는 인증서 바인딩 액세스 토큰 또는 소유 증명 바인딩 액세스 토큰을 사용하여 발신자 제약(Proof-of-Possession) 액세스 토큰만 발급하는지 검증해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.4", + "section_name": "OAuth 인가 서버", + "req_id": "V10.4.15", + "req_description": "최종 사용자 장치에서 실행되지 않는 서버에서 동작하는 클라이언트의 경우, 인가 서버가 'authorization_details' 파라미터 값이 클라이언트 백엔드로부터 생성되었는지와 사용자가 해당 값을 변조되지 않았는지를 검증해야 한다. 예를 들어, PAR 또는 JAR의 사용을 요구하여 확인해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.4", + "section_name": "OAuth 인가 서버", + "req_id": "V10.4.16", + "req_description": "클라이언트가 기밀 클라이언트인지 검증하고, 인가 서버는 재사용 공격에 강하고 공개키 암호화에 기반한 강력한 클라이언트 인증 방식을 사용하도록 요구해야 한다. 예를 들어, mTLS(tls_client_auth, self_signed_tls_client_auth) 또는 비공개 키 기반 JWT 인증(private_key_jwt) 등이 이에 해당한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.5", + "section_name": "OIDC 클라이언트", + "req_id": "V10.5.1", + "req_description": "신뢰 당사자로서 클라이언트가 ID 토큰 재사용 공격을 완화하는지 검증해야 한다. 예를 들어, ID 토큰의 'nonce' 클레임이 OpenID 공급자에 전송된 인증 요청(OAuth2에서는 인가 서버에 전송된 인가 요청)에서 전송된 'nonce' 값과 일치하는지 확인해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.5", + "section_name": "OIDC 클라이언트", + "req_id": "V10.5.2", + "req_description": "클라이언트가 ID 토큰 클레임, 일반적으로 'sub' 클레임에서 사용자를 고유하게 식별하며, 해당 클레임이 ID 공급자 범위 내에서 다른 사용자에게 재할당될 수 없는지 검증해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.5", + "section_name": "OIDC 클라이언트", + "req_id": "V10.5.3", + "req_description": "클라이언트는 악의적인 인가 서버가 인가 서버 메타데이터를 통해 다른 인가 서버를 가장하려는 시도를 거부하는지 검증해야 한다. 클라이언트는 인가 서버 메타데이터에 포함된 발급자(issuer) URL이 클라이언트가 예상하는 사전 구성된 발급자 URL과 정확히 일치하지 않는 경우, 해당 메타데이터를 거부해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.5", + "section_name": "OIDC 클라이언트", + "req_id": "V10.5.4", + "req_description": "클라이언트는 토큰의 aud 클레임 값이 클라이언트의 client_id 값과 동일한지 확인하여 ID 토큰이 해당 클라이언트(audience)를 대상으로 발급되었음을 검증해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.5", + "section_name": "OIDC 클라이언트", + "req_id": "V10.5.5", + "req_description": "OIDC 백채널 로그아웃을 사용하는 경우, 신뢰 당사자는 강제 로그아웃을 통한 서비스 거부 공격(Denial of Service) 및 로그아웃 플로우에서의 JWT 혼동(cross-JWT confusion)을 완화하는지 검증해야 한다. 클라이언트는 로그아웃 토큰이 'logout+jwt' 값으로 올바르게 지정되어 있는지, 올바른 멤버 이름을 가진 'event' 클레임을 포함하는지, 그리고 'nonce' 클레임을 포함하지 않는지 검증해야 한다. 또한, 짧은 만료 시간(예: 2분)을 갖는 것이 권장된다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.6", + "section_name": "OpenID 공급자", + "req_id": "V10.6.1", + "req_description": "OpenID 공급자는 response_mode 파라미터 값으로'code', 'ciba', 'id_token' 또는 'id_token code' 만 허용하는지 검증해야 한다. 이 중 'id_token code'(OIDC 하이브리드 플로우)보다는 'code'가 선호되며, 'token'(모든 암시적 플로우)은 사용되어서는 안 된다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.6", + "section_name": "OpenID 공급자", + "req_id": "V10.6.2", + "req_description": "OpenID 공급자가 강제 로그아웃을 통한 서비스 거부 공격을 완화하는지 검증해야 한다. 신뢰 당사자로 부터 시작된 로그아웃 요청에 id_token_hint 등의 파라미터가 포함되어 있는 경우, 이를 검증하거나 최종 사용자로부터 명시적인 확인을 받아야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.7", + "section_name": "동의 관리", + "req_id": "V10.7.1", + "req_description": "인가 서버가 사용자로부터 각 인가 요청에 대한 명시적인 동의(consent)를 확인하는지 검증해야 한다. 클라이언트의 신원을 보장할 수 없는 경우, 인가 서버는 항상 사용자에게 명시적으로 동의를 요청해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.7", + "section_name": "동의 관리", + "req_id": "V10.7.2", + "req_description": "인가 서버가 사용자 동의를 요청할 때, 동의하는 내용에 대한 충분하고 명확한 정보를 제공하는지 검증해야 한다. 이에 해당하는 경우, 요청된 인가의 성격(일반적으로 범위, 리소스 서버, RAR(Rich Authorization Requests) 인가 세부 정보 기반), 인가된 애플리케이션의 신원, 인가의 유효 기간이 포함되어야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth와 OIDC", + "section_id": "V10.7", + "section_name": "동의 관리", + "req_id": "V10.7.3", + "req_description": "사용자가 인가 서버를 통해 부여한 동의를 검토, 수정 및 철회할 수 있는지 검증해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.1", + "section_name": "암호화 인벤토리 및 문서화", + "req_id": "V11.1.1", + "req_description": "'NIST SP 800-57'과 같은 암호화 키 관리 및 키 관리 표준을 따르는 암호화 키 수명 주기에 대한 문서화 된 정책이 있는지 검증해야 한다. 여기에는 키가 과도하게 공유되지 않도록 하는 것이 포함된다(예: 공유 비밀의 경우 두 개를 초과하는 엔터티와 공유 및 개인 키의 경우 한 개를 초과하는 엔터티에 공유).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.1", + "section_name": "암호화 인벤토리 및 문서화", + "req_id": "V11.1.2", + "req_description": "애플리케이션에서 사용되는 모든 암호화 키, 알고리즘, 인증서를 포함한 암호화 자산 목록(cryptographic inventory)이 작성되고, 유지되며, 정기적으로 업데이트되고 있는지 검증해야 한다. 또한, 각 키가 시스템 내에서 사용 가능한 위치와 사용이 제한되는 위치, 해당 키로 보호할 수 있는 데이터 유형과 보호할 수 없는 데이터 유형이 문서화되어 있어야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.1", + "section_name": "암호화 인벤토리 및 문서화", + "req_id": "V11.1.3", + "req_description": "암호화, 해싱, 서명 작업을 포함하는 시스템 내의 모든 암호화 사용 사례를 식별하기 위해, 암호화 사용 탐지 메커니즘이 적용되는지 검증해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.1", + "section_name": "암호화 인벤토리 및 문서화", + "req_id": "V11.1.4", + "req_description": "암호화 자산 목록이 유지 관리되는지 검증해야 한다. 여기에는 미래의 위협에 대응하기 위해 양자 내성 암호(Post-Quantum Cryptography; PQC)와 같은 새로운 암호화 표준으로의 마이그레이션 계획을 설명하는 문서화된 계획이 포함되어야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.2", + "section_name": "안전한 암호화 구현", + "req_id": "V11.2.1", + "req_description": "암호화 작업에 업계에서 검증된 구현(라이브러리 및 하드웨어 가속 구현 포함)이 사용되는지 검증해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.2", + "section_name": "안전한 암호화 구현", + "req_id": "V11.2.2", + "req_description": "난수, 인증 암호화, MAC, 해싱 알고리즘, 키 길이, 라운드, 암호 및 모드를 언제든지 재구성, 업그레이드 또는 교체하여 암호화 해독으로부터 보호할 수 있도록 애플리케이션이 암호화 유연성(crypto agility)을 갖추고 설계되었는지 검증해야 한다. 또한, 키와 비밀번호를 교체하고 데이터를 다시 암호화하는 것도 가능해야 한다. 이를 통해 승인된 PQC 체계(또는 표준)의 고신뢰 구현이 널리 사용 가능해지면 PQC로 원활하게 업그레이드할 수 있다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.2", + "section_name": "안전한 암호화 구현", + "req_id": "V11.2.3", + "req_description": "모든 암호화 기본 구성요소(primitive)가 알고리즘, 키 크기 및 구성에 따라 최소 128비트의 보안강도를 제공하는지 검증해야 한다. 예를 들어, 256비트 ECC 키는 대략 128비트의 보안을 제공하며, RSA는 128비트의 보안을 달성하기 위해 3072비트 키를 필요로 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.2", + "section_name": "안전한 암호화 구현", + "req_id": "V11.2.4", + "req_description": "민감한 정보가 누출되는 것을 방지하기 위해 모든 암호화 연산은 상수 시간(constant-time)으로 수행되어야 하며, 비교, 계산, 반환 과정에서 단락(short-circuit) 연산이 없는지 검증해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.2", + "section_name": "안전한 암호화 구현", + "req_id": "V11.2.5", + "req_description": "모든 암호화 모듈이 안전하게 실패하고, 패딩 오라클 공격(Padding Oracle attacks)과 같은 취약점을 허용하지 않는 방식으로 오류가 처리되는지 검증해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.3", + "section_name": "암호화 알고리즘", + "req_id": "V11.3.1", + "req_description": "안전하지 않은 블록 모드(예: ECB) 및 약한 패딩 방식(예: PKCS#1 v1.5)가 사용되지 않는지 검증해야 한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.3", + "section_name": "암호화 알고리즘", + "req_id": "V11.3.2", + "req_description": "GCM을 사용하는 AES와 같이 승인된 암호 및 모드만 사용되는지 검증해야 한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.3", + "section_name": "암호화 알고리즘", + "req_id": "V11.3.3", + "req_description": "암호화 된 데이터가 승인된 인증된 암호화 방식을 사용하거나, 승인된 암호화 방식과 승인된 MAC 알고리즘을 조합을 통한 무단 수정으로부터 보호되는지 검증해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.3", + "section_name": "암호화 알고리즘", + "req_id": "V11.3.4", + "req_description": "논스(nonces), 초기화 벡터 및 기타 단일 사용 번호가 둘 이상의 암호화 키 및 데이터 요소 쌍에 사용되지 않는지 검증해야 한다. 생성 방법은 사용되는 알고리즘에 적합해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.3", + "section_name": "암호화 알고리즘", + "req_id": "V11.3.5", + "req_description": "암호화 알고리즘과 MAC 알고리즘의 모든 조합이 암호화 후 MAC(Encrypt-then-MAC) 방식으로 동작하는지 검증해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.4", + "section_name": "해싱 및 해시 기반 함수", + "req_id": "V11.4.1", + "req_description": "디지털 서명, HMAC, KDF 및 무작위 비트 생성을 포함한 일반적인 암호화 사용 사례에 승인된 해시 함수만 사용되는지 검증해야 한다. MD5와 같이 허용되지 않는 해시 함수는 어떤 암호화 목적으로도 사용해서는 안 된다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.4", + "section_name": "해싱 및 해시 기반 함수", + "req_id": "V11.4.2", + "req_description": "비밀번호가 승인된 '계산 집약적인 키 유도 함수(\"비밀번호 해싱 함수\"라고도 함)'를 사용하여 저장되고, 파라미터 설정이 현재 지침에 따라 구성되었는지 검증해야 한다. 설정은 필요한 보안 수준에 대한 무차별 대입 공격을 충분히 어렵게 만들기 위해 보안과 성능의 균형을 이루어야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.4", + "section_name": "해싱 및 해시 기반 함수", + "req_id": "V11.4.3", + "req_description": "데이터 인증 또는 데이터 무결성의 일부로 디지털 서명에 사용되는 해시 함수가 충돌 저항성을 가지며 적절한 비트 길이를 갖는지 검증해야 한다. 충돌 저항성이 필요한 경우, 출력 길이는 최소 256비트여야 한다. 제2 역상(pre-image) 공격 저항성만 필요한 경우, 출력 길이는 최소 128비트여야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.4", + "section_name": "해싱 및 해시 기반 함수", + "req_id": "V11.4.4", + "req_description": "비밀번호로부터 비밀 키를 유도할 때 애플리케이션이 키 스트레칭(key stretching) 파라미터를 사용하여 승인된 키 유도 함수(key derivation function)를 사용하는지 검증해야 한다. 사용 중인 파라미터는 결과적인 암호화 키를 손상시키는 무차별 대입 공격을 방지하기 위해 보안과 성능의 균형을 이루어야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.5", + "section_name": "무작위 값", + "req_id": "V11.5.1", + "req_description": "예측 불가능해야 하는 모든 난수 및 문자열이 암호학적으로 안전한 의사 난수 생성기(CSPRNG)를 사용하여 생성되고 최소 128비트의 엔트로피를 갖는지 검증해야 한다. UUID는 이 조건을 충족하지 않는다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.5", + "section_name": "무작위 값", + "req_id": "V11.5.2", + "req_description": "사용 중인 난수 생성 메커니즘이 높은 부하(heavy demand)에서도 안전하게 작동하도록 설계되었는지 검증해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.6", + "section_name": "공개 키 암호화", + "req_id": "V11.6.1", + "req_description": "키 생성 및 시딩, 디지털 서명 생성 및 검증에 승인된 암호화 알고리즘 및 작동 모드만 사용되는지 검증해야 한다. 키 생성 알고리즘은 알려진 공격에 취약한 안전하지 않은 키(예: 페르마 인수분해(Fermat factorization)에 취약한 RSA 키)를 생성해서는 안 된다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.6", + "section_name": "공개 키 암호화", + "req_id": "V11.6.2", + "req_description": "키 교환에는 디피-헬만과 같은 승인된 암호화 알고리즘이 사용되어야 하며, 안전한 파라미터를 사용하는지 여부를 중점적으로 검증해야 한다.이는 중간자 공격(adversary-in-the-middle attacks) 또는 암호화 해독으로 이어질 수 있는 키 설정 프로세스에 대한 공격을 방지할 것이다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.7", + "section_name": "사용 중 데이터 암호화", + "req_id": "V11.7.1", + "req_description": "사용 중인 민감한 데이터를 보호하고 무단 사용자 또는 프로세스의 접근을 방지하기 위해 전체 메모리 암호화가 사용되는지 검증해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "암호화", + "section_id": "V11.7", + "section_name": "사용 중 데이터 암호화", + "req_id": "V11.7.2", + "req_description": "데이터 최소화가 처리 중에 노출되는 데이터의 양을 최소화하고, 사용 직후 또는 가능한 한 빨리 데이터가 암호화되도록 보장하는지 검증해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "보안 통신", + "section_id": "V12.1", + "section_name": "일반 TLS 보안 가이드", + "req_id": "V12.1.1", + "req_description": "TLS 1.2 및 TLS 1.3과 같은 최신 권장 버전의 TLS 프로토콜만 활성화되어 있으며, 그중 최신 버전이 우선되어야 한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "보안 통신", + "section_id": "V12.1", + "section_name": "일반 TLS 보안 가이드", + "req_id": "V12.1.2", + "req_description": "오직 권장되는 암호화 스위트(cipher suites)들이 활성화되어 있으며 그 중 가장 강력한 암호화 스위트로 우선 설정되어 있는지 확인한다. 레벨3 애플리케이션은 순방향 비밀성(forward secrecy)을 제공하는 암호화 스위트만 지원해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "보안 통신", + "section_id": "V12.1", + "section_name": "일반 TLS 보안 가이드", + "req_id": "V12.1.3", + "req_description": "인증이나 권한 부여를 위해 인증서 ID를 사용하기 전에 애플리케이션이 mTLS 클라이언트 인증서가 신뢰할 수 있는지 검증해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "보안 통신", + "section_id": "V12.1", + "section_name": "일반 TLS 보안 가이드", + "req_id": "V12.1.4", + "req_description": "Online Certificate Status Protocol (OCSP) 스테이플링(Stapling)과 같은 적절한 인증서 폐지 프로토콜이 활성화되고 설정되어 있는지 확인해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "보안 통신", + "section_id": "V12.1", + "section_name": "일반 TLS 보안 가이드", + "req_id": "V12.1.5", + "req_description": "TLS 핸드셰이크 프로세스 중 Server Name Indication (SNI)과 같은 민감한 메타 데이터의 노출을 방지하기 위해 애플리케이션 TLS 설정에서 Encrypted Client Hello (ECH)가 활성화되어 있는지 확인해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "보안 통신", + "section_id": "V12.2", + "section_name": "외부 서비스와의 HTTPS 통신", + "req_id": "V12.2.1", + "req_description": "TLS는 클라이언트와 외부 HTTP 기반 서비스 간의 모든 연결에 사용되며, 안전하지 않거나 암호화 되어 있지 않은 통신에 대체 동작(fall back)이 발생하지 않는지 확인해야한다. ", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "보안 통신", + "section_id": "V12.2", + "section_name": "외부 서비스와의 HTTPS 통신", + "req_id": "V12.2.2", + "req_description": "외부 서비스가 공적으로 신뢰된 TLS 인증서를 사용하는지 확인해야 한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "보안 통신", + "section_id": "V12.3", + "section_name": "일반 서비스 간의 통신 보안", + "req_id": "V12.3.1", + "req_description": "애플리케이션간의 모니터링 시스템, 관리 도구, 원격 엑세스 및 SSH, 미들웨어, 데이터베이스, 메인프레임, 파트너 시스템이나 외부 API를 포함한 모든 인바운드와 아웃바운드 통신은 TLS같은 암호화 프로토콜이 사용되는지 확인해야 한다. 이 서버는 안전하지 않거나 암호화 되어있지 않은 프로토콜에 대체 동작(fall back)이 발생하지 않아야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "보안 통신", + "section_id": "V12.3", + "section_name": "일반 서비스 간의 통신 보안", + "req_id": "V12.3.2", + "req_description": "TLS 클라이언트가 통신하기 전에 TLS서버로 부터 받은 인증서를 검증하는지 확인해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "보안 통신", + "section_id": "V12.3", + "section_name": "일반 서비스 간의 통신 보안", + "req_id": "V12.3.3", + "req_description": "그리고 TLS 또는 애플리케이션 내의 내부 HTTP 기반 서비스간에 사용된 다른 적절한 전송 암호화 매커니즘이 안전하지 않거나 암호화 되어있지 않은 통신에 대체 동작(fall back)이 발생하지 않는지 확인해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "보안 통신", + "section_id": "V12.3", + "section_name": "일반 서비스 간의 통신 보안", + "req_id": "V12.3.4", + "req_description": "내부 서버간에 TLS 통신이 신뢰된 인증서를 사용하는지 확인해야 한다. 내부 인증서나 자체 서명(self-signed)인증서를 사용할 경우, 이를 사용하는 서비스는 오직 특정 내부 인증기관(CA)과 자체 서명 인증만을 신뢰하게 설정해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "보안 통신", + "section_id": "V12.3", + "section_name": "일반 서비스 간의 통신 보안", + "req_id": "V12.3.5", + "req_description": "시스템 내부에서 통신하는 서비스(intra-service communication)는 각 엔드포인트를 검증하기 위해 강력한 인증을 사용해야 한다. 공용키(public-key) 기반 구조와 재전송 공격(replay attacks)에 저항하는 매커니즘을 사용하여 신원보장을 위해 TLS 클라이언트 인증과 같은 강력한 인증 방식을 사용해야 한다. 마이크로서비스 아키텍쳐의 경우 인증서 관리를 간소화 하고 보안을 강화하기 위해 서비스 매시(service mesh)를 사용하는 것을 고려해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.1", + "section_name": "설정 문서", + "req_id": "V13.1.1", + "req_description": "애플리케이션의 모든 통신 요구사항이 문서화 되어 있는지를 검증한다. 이는 애플리케이션이 의존하는 외부 서비스나, 사용자가 애플리케이션이 연결할 외부 위치를 제공하는 경우들을 포함한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.1", + "section_name": "설정 문서", + "req_id": "V13.1.2", + "req_description": "애플리케이션이 사용하는 각각의 서비스들에 대해, 문서가 최대 동시 연결 수(연결 풀 제한)를 정의하고 있는지, 그리고 그 한계에 다다랐을 때 폴백(fallback)이나 복구 메커니즘 등을 포함하여, DoS 공격을 방지하기 위해 애플리케이션이 어떻게 동작하는지를 검증한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.1", + "section_name": "설정 문서", + "req_id": "V13.1.3", + "req_description": "애플리케이션 문서가 모든 외부 시스템이나 애플리케이션이 사용하는 서비스(예시: 데이터베이스, 파일 핸들, 스레드, HTTP 연결)들에 대한 자원-관리 전략을 정의하고 있는지 검증한다.이는 자원-해제 프로시저, 시간초과 설정, 오류 핸들링을 포함하며, 재시도 로직이 구현된 경우 재시도 제한과 지연, 백-오프 알고리즘을 명시해야 한다. 동기 HTTP 요청-응답 명령에 대해서는 짧은 타임아웃에 더해 재시도의 비활성화 혹은 연쇄적인 지연과 자원 고갈을 방지하기 위한 재시도의 엄격한 제한을 의무화해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.1", + "section_name": "설정 문서", + "req_id": "V13.1.4", + "req_description": "애플리케이션 문서가 조직의 위협 모델과 사업적 요구사항에 기반하여, 애플리케이션의 보안과 비밀 정보들의 주기적 갱신 일정에 치명적인 비밀 정보들을 정의하고 있는지 검증한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.2", + "section_name": "백엔드 통신 설정", + "req_id": "V13.2.1", + "req_description": "API나 미들웨어와 같은 애플리케이션의 표준 사용자 세션 메커니즘을 지원하지 않는 백엔드 애플리케이션 컴포넌트와 데이터 계층 사이의 통신이 인증되어 있는지를 검증한다. 인증은 반드시 개별적인 서비스 계정과 단기간 토큰, 또는 인증서 기반 인증을 사용하고 비밀번호, API 키, 또는 접근 권한이 부여된 공유 계정 등의 자격 증명을 변경하지 않아선 안 된다. ", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.2", + "section_name": "백엔드 통신 설정", + "req_id": "V13.2.2", + "req_description": "로컬 또는 운영체제 서비스, API, 미들웨어, 그리고 데이터 계층을 포함한 백엔드 애플리케이션 컴포넌트 간의 통신이 최소 필요 권한이 할당된 계정들로 수행되는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.2", + "section_name": "백엔드 통신 설정", + "req_id": "V13.2.3", + "req_description": "만약 자격 증명이 서비스 인증을 위해 필요하다면, 소비자로부터 사용되는 그 자격 증명이 기본 자격 증명이 아님을 검증한다. (예시: root/root 또는 admin/admin)", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.2", + "section_name": "백엔드 통신 설정", + "req_id": "V13.2.4", + "req_description": "얼로우리스트가 애플리케이션의 통신이 허가된 외부 리소스나 시스템을 정의하기 위해 사용되는지 검증한다. (예시: 아웃바운드 요청, 데이터 로드, 파일 접근). 이 얼로우리스트는 애플리케이션 계층, 웹 서버, 방화벽 또는 다른 여러 계층의 조합으로 구현할 수 있다. ", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.2", + "section_name": "백엔드 통신 설정", + "req_id": "V13.2.5", + "req_description": "웹이나 애플리케이션 서버에 요청을 보내거나 데이터나 파일을 로드 할 수 있는 리소스 또는 시스템의 얼로우리스트가 설정되어 있는지를 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.2", + "section_name": "백엔드 통신 설정", + "req_id": "V13.2.6", + "req_description": "애플리케이션이 별도의 서비스와 연결할 때, 각 연결이 최대 병렬연결, 최대 연결 도달 시의 동작, 연결 타임아웃, 재시도 전략 등 문서화된 설정에 따르는지 검증한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.3", + "section_name": "비밀 정보 관리", + "req_id": "V13.3.1", + "req_description": "키 볼트와 같은 비밀 정보 관리 솔루션이 백엔드 비밀 정보들을 만들고 저장하고, 접근을 제어하고, 파기하기 위해 사용되고 있는지 검증한다. 이는 비밀번호, 키 재료, 데이터베이스와 서드 파티 시스템의 통합, 시간-기반 토큰을 위한 키와 시드, 그리고 API 키들을 포함할 수 있다. 비밀 정보들은 애플리케이션 소스 코드 내부나, 빌드 아티팩트에 포함되어서는 안 된다. L3 애플리케이션에 대해서는, 반드시 HSM과 같은 하드웨어 기반 솔루션을 사용해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.3", + "section_name": "비밀 정보 관리", + "req_id": "V13.3.2", + "req_description": "비밀 정보 자원들에 대한 접근이 최소 권한의 원칙을 고수하는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.3", + "section_name": "비밀 정보 관리", + "req_id": "V13.3.3", + "req_description": "보안 모듈에 대한 외부의 노출로부터 안전하게 키 재료를 관리하고 보호하기 위해 모든 암호 연산이 고립된 보안 모듈(볼트나, 하드웨어 보안 모듈 등)을 사용하여 수행되는지 검증한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.3", + "section_name": "비밀 정보 관리", + "req_id": "V13.3.4", + "req_description": "애플리케이션의 문서를 기반으로 비밀 정보들이 만료되고 갱신되도록 설정되었는지 검증한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.4", + "section_name": "의도하지 않은 정보 노출", + "req_id": "V13.4.1", + "req_description": "애플리케이션이 .git 이나 .svn 폴더 같은 소스 코드 관리 메타데이터 없이 배포되었는지, 또는 이 폴더들이 외부적으로든 애플리케이션 자체에서든 접근할 수 없도록 배포되었는지 검증한다. ", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.4", + "section_name": "의도하지 않은 정보 노출", + "req_id": "V13.4.2", + "req_description": "실제 운영환경에서 디버깅 기능 노출이나 정보 누출을 방지하기 위해, 모든 컴포넌트에서 디버그 모드가 비활성화되어 있는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.4", + "section_name": "의도하지 않은 정보 노출", + "req_id": "V13.4.3", + "req_description": "분명히 의도된 것이 아닌 이상 웹 서버가 폴더 목록을 클라이언트에게 노출하지 않는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.4", + "section_name": "의도하지 않은 정보 노출", + "req_id": "V13.4.4", + "req_description": "잠재적인 정보 누출을 방지하기 위해 실제 운영환경에서 HTTP TRACE 메소드 사용이 지원되지 않는지 검증한다. ", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.4", + "section_name": "의도하지 않은 정보 노출", + "req_id": "V13.4.5", + "req_description": "분명히 의도된 것이 아닌 이상 문서(내부 API 같은)와 모니터링 엔드포인트가 노출되지 않는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.4", + "section_name": "의도하지 않은 정보 노출", + "req_id": "V13.4.6", + "req_description": "애플리케이션이 백엔드 컴포넌트의 자세한 버전 정보를 노출하지 않는지 검증한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "설정", + "section_id": "V13.4", + "section_name": "의도하지 않은 정보 노출", + "req_id": "V13.4.7", + "req_description": "웹 계층이 의도적이지 않은 정보, 설정, 소스코드 누출을 방지하기 위해 특정 파일 확장자만 서비스하도록 설정되었는지 검증한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "데이터 보호", + "section_id": "V14.1", + "section_name": "데이터 보호 문서화", + "req_id": "V14.1.1", + "req_description": "애플리케이션이 생성하고 처리하는 모든 민감한 데이터가 식별되고 보호 수준으로 분류되었는지 확인한다. 여기에는 단순히 인코딩되어 있고 쉽게 디코딩할 수 있는 데이터, 예를 들어 Base64 문자열이나 JWT 내부 평문 페이로드가 포함된다. 보호 수준은 애플리케이션이 준수해야 하는 모든 데이터 보호 및 개인정보 보호 관련 규정과 표준을 반드시 고려해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "데이터 보호", + "section_id": "V14.1", + "section_name": "데이터 보호 문서화", + "req_id": "V14.1.2", + "req_description": "모든 민감한 데이터의 보호 수준에 대해 문서화된 요구사항이 있는지 확인한다. 반드시 여기에는(이에 한정되지 않지만) 일반적인 암호화, 무결성 검증, 보존 기간, 데이터 로그 기록 방식, 로그 내 민감한 데이터에 대한 접근 제어, 데이터베이스 암호화 수준, 사용할 개인정보 보호 및 개인정보 보호 강화 기술, 그리고 기타 기밀성 요구사항들 관련하여 포함되어야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "데이터 보호", + "section_id": "V14.2", + "section_name": "일반 데이터 보호", + "req_id": "V14.2.1", + "req_description": "민감한 데이터는 HTTP 메시지 본문이나 헤더 필드로만 서버에 전송되고, URL과 쿼리 문자열에는 API키나 세션토큰처럼 민감한 정보가 포함되지 않도록 검증한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "데이터 보호", + "section_id": "V14.2", + "section_name": "일반 데이터 보호", + "req_id": "V14.2.2", + "req_description": "서버 구성 요소에서 로드밸런서나 애플리케이션 캐시와 같은 민감한 데이터가 캐시되지 않게 하거나, 사용 후 해당 데이터를 안전하게 삭제하도록 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "데이터 보호", + "section_id": "V14.2", + "section_name": "일반 데이터 보호", + "req_id": "V14.2.3", + "req_description": "정의된 민감한 데이터가 애플리케이션의 통제를 벗어난 곳에서 원치 않는 수집을 예방하기 위해 신뢰할 수 없는 대상(예: 사용자 추적기)에게 전송되지 않도록 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "데이터 보호", + "section_id": "V14.2", + "section_name": "일반 데이터 보호", + "req_id": "V14.2.4", + "req_description": "암호화, 무결성 검증, 보존, 데이터 로그 기록 방식, 로그 내 민감한 데이터 접근 제어, 개인정보 보호 및 개인정보 보호 강화 기술과 관련된 민감한 데이터 통제가, 해당 데이터 보호 수준에 대한 문서에 정의된 대로 구현되었는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "데이터 보호", + "section_id": "V14.2", + "section_name": "일반 데이터 보호", + "req_id": "V14.2.5", + "req_description": "캐시 메커니즘이 해당 리소스에 대해 예상되는 콘텐츠 유형을 가진 응답만 캐시하고, 민감하거나 동적인 콘텐츠는 캐시하지 않도록 구성되어 있는지 검증한다. 존재하지 않는 파일에 접근했을 때 다른 유효한 파일을 반환하는 대신 웹 서버는 404 또는 302 응답을 반환해야 한다. 이는 Web Cache Deception 공격을 예방한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "데이터 보호", + "section_id": "V14.2", + "section_name": "일반 데이터 보호", + "req_id": "V14.2.6", + "req_description": "애플리케이션 기능에 필요한 최소한의 민감한 데이터만 반환을 검증한다. 예를 들어, 전체 신용카드 번호가 아닌 일부 숫자만 반환해야 한다. 만약 전체 데이터가 필요한 경우, 사용자가 구체적으로 조회하지 않는 한 사용자 인터페이스에서는 마스킹하는 것이 권장된다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "데이터 보호", + "section_id": "V14.2", + "section_name": "일반 데이터 보호", + "req_id": "V14.2.7", + "req_description": "민감한 정보는 데이터 보존 분류 기준에 따라 관리되어야 하고, 오래되었거나 불필요한 데이터는 사전에 정의된 작업 또는 상황에 따라 자동으로 삭제되도록 검증한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "데이터 보호", + "section_id": "V14.2", + "section_name": "일반 데이터 보호", + "req_id": "V14.2.8", + "req_description": "사용자가 제출한 파일의 메타데이터에서 사용자가 저장에 동의하지 않는 한 민감한 정보는 제거를 검증한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "데이터 보호", + "section_id": "V14.3", + "section_name": "클라이언트 측 데이터 보호", + "req_id": "V14.3.1", + "req_description": "클라이언트나 세션이 종료된 후에 브라우저 DOM과 같은 클라이언트 스토리지에서 인증된 데이터를 삭제되는지 검증한다. 이를 위해 ‘Clear-Site-Data’ HTTP 응답 헤더 필드를 사용할 수 있으나, 세션 종료 시 서버 연결이 불가능한 경우에도 클라이언트 측에서 해당 데이터를 삭제하는 것이 권장된다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "데이터 보호", + "section_id": "V14.3", + "section_name": "클라이언트 측 데이터 보호", + "req_id": "V14.3.2", + "req_description": "애플리케이션이 브라우저에서 민감한 데이터가 캐시되지 않도록, (Cache-Control: no-store)충분한 캐시 방지 HTTP 응답 헤더 필드를 설정을 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "데이터 보호", + "section_id": "V14.3", + "section_name": "클라이언트 측 데이터 보호", + "req_id": "V14.3.3", + "req_description": "브라우저 저장소(localStorage, sessionStorage, IndexedDB, 쿠키)에 저장되는 데이터에는 세션 토큰을 제외한 민감 데이터가 포함되지 않도록 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.1", + "section_name": "보안 코딩 및 아키텍처 문서화", + "req_id": "V15.1.1", + "req_description": "애플리케이션 문서에 취약점이 존재하는 서드파티 구성요소 버전 및 일반적인 라이브러리 업데이트에 대해, 해당 구성요소로부터 발생할 수 있는 위험을 최소화하기 위한 위험 기반 대응 기한이 정의되어 있는지 확인해야 한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.1", + "section_name": "보안 코딩 및 아키텍처 문서화", + "req_id": "V15.1.2", + "req_description": "사용 중인 모든 서드파티 라이브러리에 대해 소프트웨어 자재 명세서(SBOM)와 같은 인벤토리가 유지되고 있으며, 해당 구성요소가 사전에 정의된 신뢰할 수 있고 지속적으로 관리되는 저장소에서 제공되는지 확인해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.1", + "section_name": "보안 코딩 및 아키텍처 문서화", + "req_id": "V15.1.3", + "req_description": "애플리케이션 문서에 시간 소모가 크거나 리소스 소비가 많은 기능이 식별되어 있으며, 해당 기능의 과도한 사용으로 인해 가용성이 손실되지 않도록 하는 방법과, 응답 생성이 소비자의 타임아웃보다 오래 걸리는 상황을 방지하는 방법이 포함되어 있는지 확인해야 한다. 가능한 방어 전략에는 비동기 처리, 큐(queue) 사용, 사용자 및 애플리케이션 단위의 병렬 처리 제한 등이 있다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.1", + "section_name": "보안 코딩 및 아키텍처 문서화", + "req_id": "V15.1.4", + "req_description": "애플리케이션 문서에 위험한 구성요소로 간주되는 서드파티 라이브러리가 강조되어 있는지 확인해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.1", + "section_name": "보안 코딩 및 아키텍처 문서화", + "req_id": "V15.1.5", + "req_description": "애플리케이션 문서에 위험한 기능을 사용하는 애플리케이션의 부분이 강조되어 있는지 확인해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.2", + "section_name": "보안 아키텍처 및 종속성", + "req_id": "V15.2.1", + "req_description": "애플리케이션이 문서화된 업데이트 및 대응 기한을 위반하지 않은 구성요소만 포함하고 있는지 확인해야 한다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.2", + "section_name": "보안 아키텍처 및 종속성", + "req_id": "V15.2.2", + "req_description": "애플리케이션이 시간 소모가 크거나 리소스 소비가 많은 기능의 과도한 사용으로 인한 가용성 손실을 방지하기 위해, 해당 기능에 대한 문서화된 보안 결정 및 전략을 기반으로 방어 조치를 구현하고 있는지 확인해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.2", + "section_name": "보안 아키텍처 및 종속성", + "req_id": "V15.2.3", + "req_description": "운영 환경에 애플리케이션 기능 수행에 필요한 기능만 포함되어 있으며, 테스트 코드, 샘플 코드, 개발용 기능 등 불필요한 기능이 노출되지 않도록 구성되어 있는지 확인해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.2", + "section_name": "보안 아키텍처 및 종속성", + "req_id": "V15.2.4", + "req_description": "서드파티 구성요소 및 그 모든 전이 종속성(transitive dependencies)이 내부 또는 외부의 예상된 저장소에서 가져며, 의존성 혼동(dependency confusion) 공격의 위험이 없는지 확인해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.2", + "section_name": "보안 아키텍처 및 종속성", + "req_id": "V15.2.5", + "req_description": "애플리케이션이 위험한 기능을 포함하거나 위험한 구성요소를 사용하는 부분에 대해 샌드박싱, 캡슐화, 컨테이너화, 네트워크 수준 격리와 같은 추가적인 보호 기법을 구현하여, 애플리케이션의 한 부분이 침해되더라도 공격자가 다른 영역으로 확산하지 못하도록 지연 및 차단하고 있는지 확인해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.3", + "section_name": "방어적(Defensive) 코딩", + "req_id": "V15.3.1", + "req_description": "애플리케이션이 데이터 객체에서 필요한 필드만 선택적으로 반환하고 있는지 확인해야 한다. 예를 들어, 일부 필드는 사용자에게 노출되어서는 안 되므로 전체 데이터 객체를 반환해서는 안 된다.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.3", + "section_name": "방어적(Defensive) 코딩", + "req_id": "V15.3.2", + "req_description": "애플리케이션 백엔드에서 외부 URL로 요청을 보낼 때, 의도된 기능이 아닌 경우 리디렉션을 따르지 않도록 구성되어 있는지 확인해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.3", + "section_name": "방어적(Defensive) 코딩", + "req_id": "V15.3.3", + "req_description": "애플리케이션이 각 컨트롤러 및 액션 단위로 허용된 필드를 제한함으로써, 대량 할당(mass assignment) 공격에 대한 방어가 구현되어 있는지 확인해야 한다. 예를 들어, 특정 동작에 포함되지 않은 필드 값을 삽입하거나 수정할 수 없어야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.3", + "section_name": "방어적(Defensive) 코딩", + "req_id": "V15.3.4", + "req_description": "모든 프록시 및 미들웨어 구성요소가 사용자의 원래 IP 주소를 신뢰 가능한 데이터 필드를 통해 정확하게 전달하고 있으며, 애플리케이션과 웹 서버가 이 값을 로그 기록이나 속도 제한(rate limiting)과 같은 보안 결정에 사용하는지 확인해야 한다. 단, 동적 IP, VPN, 방화벽 등으로 인해 원래 IP조차 완전히 신뢰할 수 없는 점도 고려해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.3", + "section_name": "방어적(Defensive) 코딩", + "req_id": "V15.3.5", + "req_description": "애플리케이션이 변수의 타입이 올바른지 명시적으로 확인하고, 엄격한 동등성 비교 및 연산자를 사용하여 타입 혼용(type juggling) 또는 타입 혼동(type confusion)으로 인한 취약점을 방지하고 있는지 확인해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.3", + "section_name": "방어적(Defensive) 코딩", + "req_id": "V15.3.6", + "req_description": "JavaScript 코드가 프로토타입 오염(prototype pollution)을 방지할 수 있도록 작성되어 있는지 확인해야 한다. 예를 들어, 객체 리터럴 대신 `Set()` 또는 `Map()`을 사용하는 방식이 권장된다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.3", + "section_name": "방어적(Defensive) 코딩", + "req_id": "V15.3.7", + "req_description": "애플리케이션이 HTTP 파라미터 오염(HTTP parameter pollution) 공격에 대한 방어를 구현하고 있는지 확인해야 한다. 특히, 애플리케이션 프레임워크가 요청 파라미터의 출처(쿼리 스트링, 본문, 쿠키, 헤더)를 구분하지 않는 경우 이를 고려해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.4", + "section_name": "안전한 동시성", + "req_id": "V15.4.1", + "req_description": "다중 스레드 코드에서 캐시, 파일, 다수 스레드가 접근하는 메모리 내 객체 등 공유 객체에 접근할 때, 스레드 세이프(thread-safe) 타입과 락·세마포어 같은 동기화 메커니즘을 사용하여 경쟁 상태와 데이터 손상을 피하고 안전하게 접근하는지 확인해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.4", + "section_name": "안전한 동시성", + "req_id": "V15.4.2", + "req_description": "리소스의 존재 여부나 권한과 같은 상태 검사와, 그 검사 결과에 의존하는 동작이 단일(atomic) 연산으로 수행되어 TOCTOU 경쟁 상태를 방지하는지 확인해야 한다. (예: 파일을 열기 전에 존재 여부를 확인하는 작업과 파일 열기 동작을 분리하지 않기, 접근 권한 검증과 권한 부여를 동일 트랜잭션/원자적 구간에서 수행하기)", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.4", + "section_name": "안전한 동시성", + "req_id": "V15.4.3", + "req_description": "스레드가 서로를 기다리거나 무한 재시도에 빠지지 않도록 일관된 락 사용을 보장하고, 락 관리 로직을 리소스 관리 책임 코드 내부에 유지하여 외부 클래스 및 코드가 우발적·악의적으로 락을 변경하지 못하도록 하는지 확인해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "보안 코딩 및 아키텍처", + "section_id": "V15.4", + "section_name": "안전한 동시성", + "req_id": "V15.4.4", + "req_description": "**스레드 풀** 활용 등 **리소스 할당 정책**을 통해 공정한 리소스 접근을 보장하고, 우선순위가 낮은 스레드도 합리적 시간 내 진행될 수 있게 하여 **스레드 기아**를 방지하는지 확인해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.1", + "section_name": "보안 로깅 문서화", + "req_id": "V16.1.1", + "req_description": "애플리케이션의 기술 스택의 각 계층에서 수행된 로깅에 대해, 어떤 이벤트들이 로그로 남았는지, 로그의 형식이 무엇인지, 로그가 어디에 저장되었는지, 어떻게 사용되는지, 로그에 대한 접근이 어떻게 제어되는지, 그리고 로그가 얼마나 보관되는지에 대해 문서화한 목록이 존재하는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.2", + "section_name": "일반 로깅", + "req_id": "V16.2.1", + "req_description": "이벤트가 발생했을 때 그 타임라인을 자세히 조사할 수 있도록 각 로그의 항목이 필수적인 메타데이터(언제, 어디서, 누가, 무엇을 등)을 포함하는지 검증한다. ", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.2", + "section_name": "일반 로깅", + "req_id": "V16.2.2", + "req_description": "모든 로깅 컴포넌트의 시간 소스가 동기화되어 있는지, 그리고 보안 이벤트 메타데이터에서 타임스탬프가 UTC를 사용하거나 혹은 명시적인 시간대 오프셋을 포함하는지 검증한다. UTC는 분산 시스템 전체에 걸친 일관성을 보장하고, 일광 절약 시간제 전환 시의 혼란을 방지하기 위해 추천된다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.2", + "section_name": "일반 로깅", + "req_id": "V16.2.3", + "req_description": "애플리케이션이 로그를 저장만 하는지, 혹은 로그 목록에서 문서화 된 파일이나 서비스로 브로드캐스트하는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.2", + "section_name": "일반 로깅", + "req_id": "V16.2.4", + "req_description": "사용 중인 로그 처리기가 로그를 읽고, 또 상호 연관 지을 수 있는지 검증한다. 가능하다면 공통 로깅 형식을 사용하는 것이 좋다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.2", + "section_name": "일반 로깅", + "req_id": "V16.2.5", + "req_description": "민감한 데이터를 로깅할때, 애플리케이션이 데이터의 보호 수준을 기반으로 로깅을 수행하는지 검증한다. 예를 들어, 자격 증명이나, 지불 상세 정보 등의 특정 데이터는 로깅 해서는 안 된다. 또한 세션 토큰 등의 데이터는 전체 혹은 일부분이 해싱된, 마스킹 된 상태로 로깅 되어야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.3", + "section_name": "보안 이벤트", + "req_id": "V16.3.1", + "req_description": "성공한 시도와 실패한 시도를 포함하여 모든 인증 명령을 로깅 하는지 검증한다. 인증의 종류나, 사용한 인증 요소 등의 추가적인 메타데이터 또한 수집해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.3", + "section_name": "보안 이벤트", + "req_id": "V16.3.2", + "req_description": "실패한 인가 시도들도 로깅 하는지 검증한다. L3에 대해서는 반드시 민감한 데이터가 접근되었을 때를 포함하여(민감한 데이터 자체는 제외하고) 모든 인가 결정들의 로그를 포함해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.3", + "section_name": "보안 이벤트", + "req_id": "V16.3.3", + "req_description": "애플리케이션이 이 문서에서 정의한 보안 이벤트들을 로깅하고, 또한 입력값 확인, 비즈니스 로직, 그리고 자동화 방지 등의 보안 제어를 우회하려는 시도들도 로깅 하는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.3", + "section_name": "보안 이벤트", + "req_id": "V16.3.4", + "req_description": "애플리케이션이 백엔드 TLS 오류와 같은 예상치 못한 오류나 보안 제어 오류들을 로깅 하는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.4", + "section_name": "로그 보호", + "req_id": "V16.4.1", + "req_description": "로그 삽입을 방지하기 위해 모든 로깅 컴포넌트가 적절히 데이터를 인코딩하는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.4", + "section_name": "로그 보호", + "req_id": "V16.4.2", + "req_description": "로그가 비인가된 접근으로부터 보호되고 수정할 수 없는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.4", + "section_name": "로그 보호", + "req_id": "V16.4.3", + "req_description": "분석, 탐지, 경보, 그리고 에스컬레이션(escalation)을 위해 로그가 논리적으로 분리된 시스템으로 안전하게 전송되는지 검증한다. 애플리케이션이 침해되더라도 로그는 훼손하지 못하도록 보장하는 것이 목적이다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.5", + "section_name": "오류 처리", + "req_id": "V16.5.1", + "req_description": "예상치 못한 혹은 보안 측면에서 민감한 오류가 발생했을 때 스택 흔적, 쿼리, 비밀키, 그리고 토큰 등의 민감한 내부 시스템 데이터의 노출 방지를 보장하기 위해 유저에게 구체화하지 않은 메시지를 반환하는지 검증한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.5", + "section_name": "오류 처리", + "req_id": "V16.5.2", + "req_description": "외부 리소스 접근 오류가 발생하더라도 애플리케이션이 계속해서 안전하게 작동하는지 검증한다. 예를 들어 서킷 브레이커(circuit breaker)나 우아한 성능 저하와 같은 패턴을 사용할 수 있다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.5", + "section_name": "오류 처리", + "req_id": "V16.5.3", + "req_description": "예외가 발생할 때, 검증 로직의 오류에도 불구하고 거래를 처리하는 등의 페일-오픈(fail-open) 상태 방지를 포함하여 애플리케이션이 우아하고 안전하게 실패하는지 검증한다. ", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "보안 로깅과 오류 처리", + "section_id": "V16.5", + "section_name": "오류 처리", + "req_id": "V16.5.4", + "req_description": "처리되지 못한 모든 예외를 처리할 “최후의 수단” 오류 핸들러가 정의되어 있는지 검증한다. 이는 로그 파일에 기록되어야 하는 오류 상세 정보들의 손실을 피하기 위함과 동시에, 오류로 인해 전체 애플리케이션 프로세스가 종료되어 가용성 손실로 이어지지 않도록 보장하기 위함이다. ", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.1", + "section_name": "TURN 서버", + "req_id": "V17.1.1", + "req_description": "Traversal Using Relays around NAT(TURN) 서비스가 특정 목적을 위해 보존된 주소(예: 내부 네트워크, 브로드캐스트, 루프백)를 제외한 주소에 대해서만 접근을 허용하도록 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.1", + "section_name": "TURN 서버", + "req_id": "V17.1.2", + "req_description": "Traversal Using Relays around NAT(TURN) 서비스가 정당한 사용자의 TURN 서버 포트의 대량 개방 시 자원고갈에 취약하지 않도록 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "미디어", + "req_id": "V17.2.1", + "req_description": "데이터그램 전송 계층 보안(DTLS) 인증서의 키가 암호화 키 관리에 대한 문서화된 정책에 따라 관리되고 보호되는지 확인해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "미디어", + "req_id": "V17.2.2", + "req_description": "미디어 서버가 승인된 데이터그램 전송 계층 보안(DTLS) 암호 모음을 사용하고 지원하도록 구성되었는지, 그리고 보안 실시간 전송 프로토콜(DTLS-SRTP)을 위한 키 생성에 사용되는 DTLS 확장을 위한 안전한 보호 프로파일을 구성했는지 확인해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "미디어", + "req_id": "V17.2.3", + "req_description": "미디어 서버에서 보안 실시간 전송 프로토콜(SRTP) 인증이 선택되어 있는지 확인한다. 이를 통해 실시간 전송 프로토콜(RTP) 삽입 공격으로 인한 서비스 거부 상태 발생 또는 오디오/비디오 미디어가 미디어 스트림에 삽입되는 것을 방지할 수 있다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "미디어", + "req_id": "V17.2.4", + "req_description": "미디어 서버가 잘못된 형식의 보안 실시간 전송 프로토콜(SRTP) 패킷을 접했을 때도 수신 미디어 트래픽 처리를 계속할 수 있는지 확인해야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "미디어", + "req_id": "V17.2.5", + "req_description": "미디어 서버가 정상 사용자로부터의 보안 실시간 전송 프로토콜(SRTP) 패킷이 대량으로 유입되는 상황에서도 수신 미디어 트래픽 처리를 계속할 수 있는지 확인해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "미디어", + "req_id": "V17.2.6", + "req_description": "미디어 서버가 Datagram Transport Layer Security(DTLS)의 “ClientHello” 경합 조건 취약점에 노출되지 않았는지 확인해야 한다. 이를 위해 해당 미디어 서버가 공개적으로 취약한 것으로 알려져 있는지 확인하거나 경합 조건 테스트를 수행해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "미디어", + "req_id": "V17.2.7", + "req_description": "미디어 서버와 연결된 모든 오디오 또는 비디오 녹화 장치가 합법적인 사용자로부터의 보안 실시간 전송 프로토콜(SRTP) 패킷이 대량으로 유입되는 상황에서도 수신 미디어 트래픽 처리를 계속할 수 있는지 확인해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "미디어", + "req_id": "V17.2.8", + "req_description": "데이터그램 전송 계층 보안(DTLS) 인증서가 세션 설명 프로토콜(SDP) 지문 속성과 대조되어 검증되었는지 확인하고, 검증이 실패할 경우 미디어 스트림을 종료하여 미디어 스트림의 진위성을 보장해야 한다.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.3", + "section_name": "신호 처리", + "req_id": "V17.3.1", + "req_description": "신호 서버가 플러드 공격 중에도 합법적인 수신 신호 메시지 처리를 계속할 수 있는지 확인해야 한다. 이는 신호 수준에서 속도 제한을 구현함으로써 달성되어야 한다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.3", + "section_name": "신호 처리", + "req_id": "V17.3.2", + "req_description": "서비스 거부 상태를 유발할 수 있는 잘못된 형식의 신호 메시지를 접했을 때 신호 서버가 정상적인 신호 메시지 처리를 계속할 수 있는지 확인해야 한다. 여기에는 입력 검증 구현, 정수 오버플로우 안전 처리, 버퍼 오버플로우 방지 및 기타 강력한 오류 처리 기법 적용이 포함될 수 있다.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + } + ] +} diff --git a/5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.json b/5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.json new file mode 100644 index 0000000000..813ea6d218 --- /dev/null +++ b/5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.json @@ -0,0 +1,2774 @@ +{ + "Name": "Application Security Verification Standard Project", + "ShortName": "ASVS", + "Version": "5.0.0", + "Description": "The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.", + "Requirements": [ + { + "Shortcode": "V1", + "Ordinal": 1, + "ShortName": "Encoding", + "Name": "인코딩과 데이터 정제", + "Items": [ + { + "Shortcode": "V1.1", + "Ordinal": 1, + "Name": "인코딩 및 데이터 정제 아키텍처", + "Items": [ + { + "Shortcode": "V1.1.1", + "Ordinal": 1, + "Description": "입력값 검증은 오직 한 번만 표준 형태로 디코딩 되거나 언이스케이프 되어야 하며, 인코딩된 데이터가 예상될 때만 디코딩 되어야 한다. 이 과정은 입력이 추가로 처리되기 전에 완료되어야 한다. 예를 들어서 입력값 검증이나 데이터 정제 이후에는 수행되면 안 된다.", + "L": "2" + }, + { + "Shortcode": "V1.1.2", + "Ordinal": 2, + "Description": "애플리케이션이 출력값 인코딩 또는 이스케이핑을 인터프리터가 사용하기 전의 최종 단계로 수행하거나 인터프리터 자체에서 처리하는지 검증해야 한다.", + "L": "2" + } + ] + }, + { + "Shortcode": "V1.2", + "Ordinal": 2, + "Name": "인젝션(Injection) 방지", + "Items": [ + { + "Shortcode": "V1.2.1", + "Ordinal": 1, + "Description": "HTTP 응답, HTML 문서 또는 XML 문서에 대한 출력값 인코딩이 해당 컨텍스트에 적절한지 검증해야 한다. 예를 들어, 메시지나 문서 구조가 변경되지 않도록 HTML 요소, HTML 속성, HTML 주석, CSS, HTTP 헤더 필드 등에 맞는 문맥별 문자 인코딩이 수행되어야 한다.", + "L": "1" + }, + { + "Shortcode": "V1.2.2", + "Ordinal": 2, + "Description": "통합 자원 식별자(Uniform Resource Locator; URL)들을 동적으로 생성할 때 신뢰할 수 없는 데이터가 해당 컨텍스트에 맞게 인코딩되었는지 검증해야 한다(예: 쿼리나 경로 파라미터에 대한 URL 인코딩 또는 base64url 인코딩). 또한, 오직 안전한 URL 프로토콜만이 허용되는지 검증해야 한다(예: javascript: 또는 data:를 허용하지 않음).", + "L": "1" + }, + { + "Shortcode": "V1.2.3", + "Ordinal": 3, + "Description": "동적으로 자바스크립트 콘텐츠(JSON 포함)를 생성할 때 메시지나 문서 구조를 바꾸는 것을 방지하기 위해 출력값 인코딩이나 이스케이핑이 사용되고 있는지 검증해야 한다(자바스크립트 또는 JSON 인젝션을 피하기 위함).", + "L": "1" + }, + { + "Shortcode": "V1.2.4", + "Ordinal": 4, + "Description": "데이터 선택 혹은 데이터베이스 쿼리(예: SQL, HQL, NoSQL, Cypher)들 파라미터화된 쿼리, 객체 관계 매핑(Object Relational Mapping; ORM), 엔티티 프레임워크, 또는 다른 구조화된 쿼리 언어(Structured Query Language; SQL) 인젝션 및 기타 데이터베이스 인젝션 공격으로부터 보호해 주는 것들을 사용하는지 검증해야 한다. 이는 저장 프로시저를 쓸 때도 마찬가지이다.", + "L": "1" + }, + { + "Shortcode": "V1.2.5", + "Ordinal": 5, + "Description": "애플리케이션이 운영체제(Operating System; OS) 명령 인젝션으로부터 보호되며 운영체제 호출 시 파라미터화된 OS 쿼리나 상황에 맞는 명령줄 출력값 인코딩을 사용하는지 검증해야 한다.", + "L": "1" + }, + { + "Shortcode": "V1.2.6", + "Ordinal": 6, + "Description": "애플리케이션이 경량 디렉터리 접근 프로토콜(Lightweight Directory Access Protocol; LDAP) 인젝션 취약점에 대해 보호되어 있는지, 또는 LDAP 인젝션을 방지하기 위한 특정 보안 통제가 구현되어 있는지 검증해야 한다.", + "L": "2" + }, + { + "Shortcode": "V1.2.7", + "Ordinal": 7, + "Description": "애플리케이션이 XPath 인젝션 공격을 쿼리 파라미터나 미리 컴파일된 쿼리들을 사용해 보호되고 있는지 검증해야 한다.", + "L": "2" + }, + { + "Shortcode": "V1.2.8", + "Ordinal": 8, + "Description": "LaTeX 프로세서가 안전하게 구성되어 있으며(\"--shell-escape\" 플래그 비사용 등) LaTeX 인젝션 공격을 방지하기 위해 허용된 명령어 목록이 사용되고 있는지 검증해야 한다.", + "L": "2" + }, + { + "Shortcode": "V1.2.9", + "Ordinal": 9, + "Description": "애플리케이션이 정규 표현식에서 특수 문자들을 메타 문자로 잘못 해석하는 것을 방지하기 위해 해당 문자들 이스케이프(보통 백슬래시를 사용)하고 있는지 검증해야 한다.", + "L": "2" + }, + { + "Shortcode": "V1.2.10", + "Ordinal": 10, + "Description": "애플리케이션이 쉼표 구분 데이터(Comma Separated Values; CSV) 및 수식 인젝션에 대해 보호되어 있는지 검증해야 한다. 그리고 애플리케이션은 CSV 콘텐츠를 내보낼 때 RFC 4180 2.6과 2.7 부분에 명시된 이스케이핑 규칙을 반드시 따라야 한다. 또한 CSV나 다른 스프레드시트 포맷(XLS, XLSX, ODF 등)으로 내보낼 때 필드 값의 첫 번째가 특수 문자('=', '+', '-', '@', '\\t' (탭), '\\0' (null 문자) 포함)라면 반드시 작은따옴표로 이스케이프되어야 한다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V1.3", + "Ordinal": 3, + "Name": "데이터 정제", + "Items": [ + { + "Shortcode": "V1.3.1", + "Ordinal": 1, + "Description": "위지윅(WYSIWYG) 에디터나 이와 유사한 것으로부터 오는 모든 신뢰할 수 없는 HTML 입력들은 잘 알려지고 안전한 HTML 데이터 정제 라이브러리나 프레임워크 기능을 사용해 정제되는지 검증해야 한다.", + "L": "1" + }, + { + "Shortcode": "V1.3.2", + "Ordinal": 2, + "Description": "애플리케이션이 eval() 또는 스프링 표현 언어(Spring Expression Language; SpEL) 등과 같은 동적 코드 실행 기능 사용을 피하고 있는지 검증해야 한다. 대안이 없는 경우, 실행 전에 포함되는 모든 사용자 입력이 반드시 정제되어야 한다.", + "L": "1" + }, + { + "Shortcode": "V1.3.3", + "Ordinal": 3, + "Description": "잠재적으로 위험한 컨텍스트에 전달되는 데이터가 사전에 정제되어 안전 조치가 적용되는지 검증해야 한다. 예를 들어 해당 컨텍스트에서 안전한 문자만 허용하고 너무 긴 입력값은 잘라내는 등의 조치가 포함된다.", + "L": "2" + }, + { + "Shortcode": "V1.3.4", + "Ordinal": 4, + "Description": "사용자로부터 제공된 확장 가능한 벡터 그래픽(Scalable Vector Graphics; SVG)의 스크립트 실행 가능 콘텐츠가 애플리케이션에 안전한 태그 및 속성(예: 그래픽 그리기)만 포함하도록 검증 또는 정제되는지 검증해야 한다. 예를 들어 스크립트나 foreignObject는 포함되면 안 된다.", + "L": "2" + }, + { + "Shortcode": "V1.3.5", + "Ordinal": 5, + "Description": "애플리케이션이 사용자로부터 제공된 스크립트 실행 가능하거나 표현식 템플릿 언어(예: 마크다운, CSS, XSL 스타일시트, BBCode ) 콘텐츠를 정제하거나 비활성화하는지 검증해야 한다.", + "L": "2" + }, + { + "Shortcode": "V1.3.6", + "Ordinal": 6, + "Description": "애플리케이션이 서버측 요청 위조(Server-side Request Forgery; SSRF) 공격으로부터 보호하기 위해 신뢰할 수 없는 데이터를 프로토콜, 도메인, 경로, 포트의 허용 목록과 대조해 검증하고 다른 서비스를 호출하기 전에 잠재적으로 위험한 문자를 정제(sanitization)하는지 검증해야 한다.", + "L": "2" + }, + { + "Shortcode": "V1.3.7", + "Ordinal": 7, + "Description": "애플리케이션이 템플릿 인젝션 공격으로부터 보호하기 위해 신뢰할 수 없는 입력값을 기반으로 템플릿을 생성하지 않도록 하는지 검증해야 한다. 대안이 없는 경우에는 템플릿 생성 과정에서 동적으로 포함되는 모든 신뢰할 수 없는 입력값은 정제되거나 엄격히 검증되어야 한다.", + "L": "2" + }, + { + "Shortcode": "V1.3.8", + "Ordinal": 8, + "Description": "애플리케이션이 자바 명명 및 디렉터리 인터페이스(Java Naming and Directory Interface; JNDI) 쿼리에서 신뢰할 수 없는 입력값을 사용하기 전에 적절히 정제하고 JNDI가 JNDI 인젝션 공격을 방지할 수 있도록 안전하게 구성되어 있는지 검증해야 한다.", + "L": "2" + }, + { + "Shortcode": "V1.3.9", + "Ordinal": 9, + "Description": "인젝션을 방지하기 위해 애플리케이션이 메모리 캐시(memcache)에 콘텐츠를 전달하기 전에 해당 데이터를 정제하는지 검증해야 한다. ", + "L": "2" + }, + { + "Shortcode": "V1.3.10", + "Ordinal": 10, + "Description": "사용 시 예상치 못하거나 악의적인 방식으로 작동할 수 있는 포맷 스트링(format string)들은 처리되기 전에 정제되는지 검증해야 한다.", + "L": "2" + }, + { + "Shortcode": "V1.3.11", + "Ordinal": 11, + "Description": "간이 전자 우편 전송 프로토콜(Simple Mail Transfer Protocol; SMTP)이나 인터넷 메시지 액세스 프로토콜(Internet Message Access Protocol; IMAP) 인젝션으로부터 보호하기 위해 애플리케이션이 사용자 입력을 메일 시스템으로 보내기 전에 정제를 하는지 검증해야 한다.", + "L": "2" + }, + { + "Shortcode": "V1.3.12", + "Ordinal": 12, + "Description": "정규 표현식에 지수형 백트래킹을 유발하는 요소가 없는지, 또한 신뢰할 수 없는 입력값을 정제하여 정규식 기반 서비스 거부 공격(Regular Expression Denial of Service; ReDoS) 또는 런어웨이(Runaway) 정규식 공격을 방지하는지 검증해야 한다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V1.4", + "Ordinal": 4, + "Name": "메모리, 스트링, 비관리 코드", + "Items": [ + { + "Shortcode": "V1.4.1", + "Ordinal": 1, + "Description": "애플리케이션이 스택, 버퍼, 또는 힙 오버플로를 탐지하거나 방지하기 위해 메모리 안전 문자열, 안전한 메모리 복사 및 포인터 산술을 사용하는지 검증해야 한다.", + "L": "2" + }, + { + "Shortcode": "V1.4.2", + "Ordinal": 2, + "Description": "정수 오버플로를 방지하기 위해 부호 확인, 범위 검사, 입력값 검증 등의 기법이 사용되고 있는지 검증해야 한다.", + "L": "2" + }, + { + "Shortcode": "V1.4.3", + "Ordinal": 3, + "Description": "댕글링 포인터(dangling pointer)나 해체 후 사용(Use After Free; UAF) 취약점을 방지하기 위해 동적으로 할당된 메모리와 자원이 적절히 해제되었는지 그리고 해제된 메모리를 참조하는 포인터나 참조가 제거되었거나 null로 설정되었는지를 검증해야 한다.", + "L": "2" + } + ] + }, + { + "Shortcode": "V1.5", + "Ordinal": 5, + "Name": "안전한 역직렬화", + "Items": [ + { + "Shortcode": "V1.5.1", + "Ordinal": 1, + "Description": "애플리케이션이 확장 가능한 마크업 언어(eXtensible Markup Language; XML) 파서(parser)를 제한적인 설정으로 구성하고 외부 엔티티 해석과 같은 안전하지 않은 기능을 비활성화하여 XML 외부 엔티티(XML eXternal Entity; XXE) 공격을 방지하는지 검증해야 한다.", + "L": "1" + }, + { + "Shortcode": "V1.5.2", + "Ordinal": 2, + "Description": "역직렬화 공격을 방지하기 위해 신뢰할 수 없는 데이터의 역직렬화 시 객체 타입 허용 목록 사용 또는 클라이언트 정의 객체 타입 제한과 같은 안전한 입력 처리 방식이 적용되는지 검증해야 한다. 또한 명확히 안전하지 않은 것으로 지정된 역직렬화 메커니즘은 신뢰할 수 없는 입력에 대해 반드시 사용해서는 안 된다.", + "L": "2" + }, + { + "Shortcode": "V1.5.3", + "Ordinal": 3, + "Description": "애플리케이션에서 동일한 데이터 타입(예: JSON 파서, XML 파서, URL 파서)에 대해 사용되는 서로 다른 파서들이 일관된 방식으로 파싱(parsing)을 수행하고 동일한 문자 인코딩 방식을 사용하는지 검증해야 한다. 이를 통해 JSON 상호운용 취약점이나 원격 파일 포함(Remote File Inclusion; RFI) 및 SSRF 공격에서 악용될 수 있는 서로 다른 URI 또는 파일 파싱 동작 문제를 방지할 수 있다.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V2", + "Ordinal": 2, + "ShortName": "Validation", + "Name": "유효성 검증 및 비즈니스 로직", + "Items": [ + { + "Shortcode": "V2.1", + "Ordinal": 1, + "Name": "유효성 검증 및 비즈니스 로직 문서화", + "Items": [ + { + "Shortcode": "V2.1.1", + "Ordinal": 1, + "Description": "애플리케이션 문서에 데이터 항목이 예상되는 구조에 부합하는지 확인하는 입력값 유효성 검증 규칙이 정의되어 있는지 확인한다. 이는 신용카드 번호, 이메일 주소, 전화번호와 같은 일반적인 데이터 형식일 수도 있고, 내부적으로 사용하는 데이터 형식일 수도 있다.", + "L": "1" + }, + { + "Shortcode": "V2.1.2", + "Ordinal": 2, + "Description": "애플리케이션 문서에 연관된 데이터 항목들 간의 논리적, 문맥적 일관성을 검증하는 방법이 정의되어 있는지 검증한다. 예를 들어서 세부 주소와 우편번호가 서로 일치하는지 확인하는 경우가 이에 해당한다.", + "L": "2" + }, + { + "Shortcode": "V2.1.3", + "Ordinal": 3, + "Description": "비즈니스 로직의 제한사항 및 유효성 검증에 대한 요구사항이 사용자별 기준과 애플리케이션 전체에 적용되는 전역적 기준을 모두 포함하여 문서화되어 있는지 검증한다.", + "L": "2" + } + ] + }, + { + "Shortcode": "V2.2", + "Ordinal": 2, + "Name": "입력값 검증", + "Items": [ + { + "Shortcode": "V2.2.1", + "Ordinal": 1, + "Description": "입력값에 대한 비즈니스 또는 기능적인 기대치를 충족하기 위해서 입력값의 유효성을 검증해야 한다. 이는 허용 값, 패턴 및 범위 목록에 대한 긍정적 검증을 사용하거나, 미리 정의된 규칙에 따라 입력값을 예상 구조 및 논리적 한계와 비교하여 검증해야 한다. L1의 경우, 특정 비즈니스 또는 보안 결정을 내리는 데 초점을 맞출 수 있다. L2 이상의 경우에는 모든 입력값에 적용해야 한다.", + "L": "1" + }, + { + "Shortcode": "V2.2.2", + "Ordinal": 2, + "Description": "애플리케이션이 신뢰할 수 있는 서비스 계층에서 입력값 유효성 검사를 시행하도록 설계되었는지 확인해야 한다. 클라이언트 측 유효성 검사는 사용성을 향상시키므로 권장해야 하지만, 보안 제어 수단으로 의존해서는 안된다.", + "L": "1" + }, + { + "Shortcode": "V2.2.3", + "Ordinal": 3, + "Description": "사전 정의된 규칙에 따라 관련 데이터 항목의 조합이 합리적인지 애플리케이션에서 확인해야 한다.", + "L": "2" + } + ] + }, + { + "Shortcode": "V2.3", + "Ordinal": 3, + "Name": "비즈니스 로직 보안", + "Items": [ + { + "Shortcode": "V2.3.1", + "Ordinal": 1, + "Description": "애플리케이션이 예상되는 순차적 단계 순서에 따라 동일한 사용자에 대한 비즈니스 로직 흐름만 처리하고 단계를 건너뛰지 않는지 확인한다.", + "L": "1" + }, + { + "Shortcode": "V2.3.2", + "Ordinal": 2, + "Description": "비즈니스 로직 결함이 악용되는 것을 방지하기 위해서 애플리케이션 문서에 따라 비즈니스 로직 제한이 구현되었는지 확인한다.", + "L": "2" + }, + { + "Shortcode": "V2.3.3", + "Ordinal": 3, + "Description": "비즈니스 로직 수준에서 트랜잭션이 사용되고 있는지 확인하여 비즈니스 로직 작업이 완전히 성공하거나 이전의 올바른 상태로 롤백되는지 확인한다.", + "L": "2" + }, + { + "Shortcode": "V2.3.4", + "Ordinal": 4, + "Description": "제한된 양의 리소스(ex. 극장 좌석이나 배송 시간대)가 애플리케이션의 로직을 조작하여 이중으로 예약되는 것을 방지하기 위해서 비즈니스 로직 수준 잠금 메커니즘이 사용되는지 확인한다.", + "L": "2" + }, + { + "Shortcode": "V2.3.5", + "Ordinal": 5, + "Description": "핵심적인 비즈니스 로직 흐름에 무단 또는 우발적인 행위를 방지하기 위해서 다중 사용자 승인이 필요한지 확인해야 한다. 이는 거액 자금 이체, 계약 승인, 기밀 정보 접근, 제조 과정의 안전 무시 등이 포함될 수 있지만, 이에 국한되지는 않는다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V2.4", + "Ordinal": 4, + "Name": "자동화 방지", + "Items": [ + { + "Shortcode": "V2.4.1", + "Ordinal": 1, + "Description": "데이터 유출, 더미 데이터 생성, 할당량 소진, 속도 제한 위반, 서비스 거부(DoS), 핵심적인 리소스의 과다 사용으로 이어질 수 있는 애플리케이션 기능에 대한 과도한 호출을 방어하기 위해, 자동화 방지 제어 기능이 구현되어 있는지 검증한다.", + "L": "2" + }, + { + "Shortcode": "V2.4.2", + "Ordinal": 2, + "Description": "비즈니스 로직의 각 단계가 실제 사람이 수행하는 데 필요한 현실적인 시간을 요구하여, 비정상적으로 빠른 속도의 트랜잭션 제출을 방지하는지 검증한다.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V3", + "Ordinal": 3, + "ShortName": "Web", + "Name": "웹 프론트엔드 보안", + "Items": [ + { + "Shortcode": "V3.1", + "Ordinal": 1, + "Name": "웹 프론트엔드 보안 문서", + "Items": [ + { + "Shortcode": "V3.1.1", + "Ordinal": 1, + "Description": "애플리케이션 공식 문서에서 애플리케이션이 반드시 지원해야 하는, 예상되는 보안 특징들을 서술하고 있는지 확인한다. (예: HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP), 그리고 다른 관련된 HTTP 보안 메커니즘들). 또한 문서에서 앞선 특징들(유저에게나 경고하거나 접속을 막는 등의)이 유효하지 않을 때 애플리케이션이 어떻게 행동하는지 반드시 정의해야 한다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.2", + "Ordinal": 2, + "Name": "의도하지 않은 콘텐츠 접근", + "Items": [ + { + "Shortcode": "V3.2.1", + "Ordinal": 1, + "Description": "브라우저가 HTTP 응답에 대해 콘텐츠나 기능을 불러올 때, 의도하지 않은 상황이 보안적으로 통제되고 있는지 확인한다(예: API, 유저가 올린 파일, 혹은 다른 리소스에 직접 접근 시). Content-Security-Policy 헤더 필드의 샌드박스 지시어를 사용하거나, Content-Disposition 헤더 필드 내의 attachment disposition 타입을 사용하는 등으로, 불필요한 HTTP 요청 헤더 필드 (Sec-Fetch-* 와 같은)를 제공하지 않을 수 있다.", + "L": "1" + }, + { + "Shortcode": "V3.2.2", + "Ordinal": 2, + "Description": "콘텐츠가 HTML로 렌더링되지 않고 텍스트로 표시되도록 하여, HTML이나 JavaScript 등의 의도하지 않은 실행을 방지하는 안전한 렌더링 함수(예: createTextNode, textContent)를 사용하는지 확인한다.", + "L": "1" + }, + { + "Shortcode": "V3.2.3", + "Ordinal": 3, + "Description": "애플리케이션이 클라이언트 사이드 JavaScript를 사용할 때, 명시적 변수 사용, 엄격한 타입 검사, 문서에서의 전역 변수 저장 지양, 그리고 네임스페이스 격리 구현 등으로 DOM 클로버링을 막고 있음을 확인한다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.3", + "Ordinal": 3, + "Name": "쿠키 설정", + "Items": [ + { + "Shortcode": "V3.3.1", + "Ordinal": 1, + "Description": "쿠키가 'Secure' 속성을 가지며, 쿠키 이름에 '\\__Host-' 접두사가 사용되지 않았고, '__Secure-' 접두사를 사용했는지 확인한다.", + "L": "1" + }, + { + "Shortcode": "V3.3.2", + "Ordinal": 2, + "Description": "UI redress 공격, 그리고 CSRF라 알려진 브라우저 기반 요청 위조 공격들에 대한 노출을 제한하기 위해 각 쿠키의 'SameSite' 속성 값이 쿠키의 목적에 맞게 설정되어 있는지 확인한다.", + "L": "2" + }, + { + "Shortcode": "V3.3.3", + "Ordinal": 3, + "Description": "다른 호스트들과 명시적으로 공유되는 쿠키에 대해서, '__Host-' 접두사를 가지고 있는지 확인한다.", + "L": "2" + }, + { + "Shortcode": "V3.3.4", + "Ordinal": 4, + "Description": "클라이언트 측 스크립트에서 쿠키의 값에 접근이 가능한 걸 의도하지 않았다면(세션 토큰 등), 쿠키는 반드시 'HttpOnly' 속성을 가져야 하고, 반드시 'Set-Cookie' 헤더 필드를 통해 클라이언트에게 전달돼야 한다.", + "L": "2" + }, + { + "Shortcode": "V3.3.5", + "Ordinal": 5, + "Description": "애플리케이션이 쿠키를 만들 때, 쿠키 이름과 값의 길이 합이 4096바이트를 넘지 않는지 확인한다. 너무 큰 쿠키는 브라우저에 저장되지 않으며, 요청 전달도 안되고, 해당 쿠키에 의존하는 애플리케이션 기능을 사용하지 못하게 된다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.4", + "Ordinal": 4, + "Name": "브라우저 보안 메커니즘 헤더", + "Items": [ + { + "Shortcode": "V3.4.1", + "Ordinal": 1, + "Description": "이 섹션에서는 애플리케이션의 응답을 처리할 때 브라우저의 보안 기능과, 제한 사항을 활성화하기 위해 HTTP 응답에 설정해야 하는 보안 헤더를 설명한다.", + "L": "1" + }, + { + "Shortcode": "V3.4.2", + "Ordinal": 2, + "Description": "교차 출처 리소스 공유(CORS)의 Access-Control-Allow-Origin 헤더 필드가 애플리케이션의 고정 값인지 확인한다. 만약 출처 Origin HTTP 요청 헤더 필드 값을 사용하고 있다면, 신뢰할 수 있는 출처 목록으로 검증한다. 'Access-Control-Allow-Origin: *' 사용이 필요할 때엔, 응답이 민감한 정보를 포함하지 않는지 확인한다.", + "L": "1" + }, + { + "Shortcode": "V3.4.3", + "Ordinal": 3, + "Description": "HTTP 응답이 Content-Security-Policy 응답 헤더 필드를 가지고 있는지 확인한다. 이는 브라우저가 신뢰하는 콘텐츠나 리소스만 불러오고 실행하도록 하고, 위험한 JavaScript의 실행을 제한한다. 최소한, object-src 'none' 과 base-uri 'none'이라는 지침, 그리고 허용 목록을 정의하거나 논스, 해쉬의 사용을 포함한다는 전역 정책은 반드시 사용돼야 한다. 3계층 애플리케이션의 경우에는, 논스나 해쉬가 적용된 응답별 정책이 반드시 정의돼야 한다.", + "L": "2" + }, + { + "Shortcode": "V3.4.4", + "Ordinal": 4, + "Description": "모든 HTTP 응답이 'X-Content-Type-Options: nosniff' 헤더 필드를 포함하는지 확인해야 한다. 이는 브라우저들이 주어진 응답에 대해 콘텐츠 스니핑과 MIME 타입 추측을 하지 않도록, 응답의 Content-Type 헤더 필드 값을 목적지 리소스와 일치하도록 지시한다. 예를 들어서, 응답의 Content-Type이 'text/css'인 스타일만 허용된다고 치자. 이는 기능적으로 브라우저의 Cross-Origin Read Blocking (CORB) 사용 또한 활성화시킨다.", + "L": "2" + }, + { + "Shortcode": "V3.4.5", + "Ordinal": 5, + "Description": "'Referer' HTTP 요청 헤더 필드를 통해 제 3자 서비스들에 기술적으로 민감한 정보 누출을 막기 위해, 애플리케이션에서 리퍼러 정책을 설정했는지 확인해야 한다. 이는 Referrer-Policy HTTP 응답 헤더 필드나 HTML 속성 항목을 통해 설정할 수 있다. 민감한 데이터는 URL에 있는 경로나 쿼리 데이터, 그리고 내부 비공개 애플리케이션의 경우 hostname도 포함된다.", + "L": "2" + }, + { + "Shortcode": "V3.4.6", + "Ordinal": 6, + "Description": "웹 애플리케이션이 Content-Security-Policy 헤더 필드의 frame-ancestors를 사용해 모든 HTTP 응답들에 대해 기본적으로 내부 삽입을 할 수 없고, 필요할 때만 특정 리소스에 대해 내부 삽입을 허용하도록 확인한다. X-Frame-Options 헤더 필드가 브라우저에서 지원되더라도, 오래돼서 신뢰할 수 없음을 알아야 한다.", + "L": "2" + }, + { + "Shortcode": "V3.4.7", + "Ordinal": 7, + "Description": "Content-Security-Policy 헤더 필드에 위반 사항을 보고할 영역이 특정되어 있는지 확인해야 한다.", + "L": "3" + }, + { + "Shortcode": "V3.4.8", + "Ordinal": 8, + "Description": "문서 렌더링을 시작하는 모든 HTTP 요청(Content-Type text/html과 같은 응답)에 same-origin 지시어나 same-origin-allow-popups이 있는 Cross‑Origin‑Opener‑Policy 헤더 필드를 포함하는지 확인해야 한다. 이는 탭내빙(tabnabbing) 및 프레임 카운팅과 같은 Window 객체에 대한 공유 액세스를 악용하는 공격을 방지할 수 있다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.5", + "Ordinal": 5, + "Name": "브라우저 출처 구분", + "Items": [ + { + "Shortcode": "V3.5.1", + "Ordinal": 1, + "Description": "애플리케이션이 허용되지 않은 교차 출처 요청을 통한 민감한 기능의 사용을 막기 위해 CORS preflight 메커니즘에 의존하지 않는지 확인하고, 이런 요청이 애플리케이션 자체에서 시작된건지 증명해야 한다. 이는 anti-forgery 토큰의 사용과 증명이나 CORS-safelisted 요청 헤더 필드가 아닌 확장 HTTP 헤더 필드를 요구하는 것으로 가능하다. 사이트 간 요청 위조 공격(CSRF)으로 알려진 브라우저 기반의 요청 위조 공격에 대한 방어다.", + "L": "1" + }, + { + "Shortcode": "V3.5.2", + "Ordinal": 2, + "Description": "애플리케이션이 민감한 기능의 허용되지 않은 교차 출처 사용을 막기 위해 CORS preflight 메커니즘에 의존하고 있다면, CORS preflight 요청을 작동하지 않는 요청을 호출할 수 있는지 확인해야 한다. 이는 'Origin'과 'Content-Type' 요청 헤더 필드 값을 확인하거나 CORS-safelisted 헤더 필드가 아닌 확장 필드 사용에 대한 확인이 필요하다.", + "L": "1" + }, + { + "Shortcode": "V3.5.3", + "Ordinal": 3, + "Description": "민감한 기능이 HTTP 요청으로 POST, PUT, PATCH, DELETE와 같은 적절한 HTTP 방식을 사용하는지, HEAD, OPTIONS, 또는 GET처럼 HTTP 사양이 \"안전\"으로 정의되지 않는 방식을 사용하는지 확인한다. 또는 Sec-Fetch-* 요청 헤더 필드의 엄격한 검증을 사용하여 요청이 부적절한 교차 출처 호출, 탐색 요청 또는 이미지 소스와 같은 리소스 로드에서 발생하지 않았는지 확인할 수 있다.", + "L": "1" + }, + { + "Shortcode": "V3.5.4", + "Ordinal": 4, + "Description": "서로 다른 호스트 이름에 별도의 애플리케이션이 호스팅되어 있는지 확인하여 동일한 출처 정책에서 제공하는 제한 사항을 활용한다. 여기에는 한 출처에서 불러온 문서나 스크립트가 다른 출처의 리소스와 상호 작용할 수 있는 방법과 쿠키에서의 호스트 이름 기반 제한 사항이 포함된다.", + "L": "2" + }, + { + "Shortcode": "V3.5.5", + "Ordinal": 5, + "Description": "postMessage 인터페이스를 통해 수신한 메시지의 출처를 신뢰할 수 없거나, 구문이 유효하지 않은 경우, 수신한 메시지가 폐기되는지 확인한다.", + "L": "2" + }, + { + "Shortcode": "V3.5.6", + "Ordinal": 6, + "Description": "Cross-Site Script Inclusion (XSSI) 공격을 피하기 위해, 애플리케이션 아무 곳에서나 JSONP 기능이 활성화되지 않는지 확인한다.", + "L": "3" + }, + { + "Shortcode": "V3.5.7", + "Ordinal": 7, + "Description": "Cross-Site Script Inclusion (XSSI) 공격을 방지하기 위해 JavaScript 파일과 같은 스크립트 리소스 응답에 승인이 필요한 데이터가 포함되지 않았는지 확인한다.", + "L": "3" + }, + { + "Shortcode": "V3.5.8", + "Ordinal": 8, + "Description": "인증된 리소스(예: 이미지, 비디오, 스크립트 및 기타 문서)가 의도된 경우에만 사용자를 대신하여 불러와지거나 내장될 수 있는지 확인한다. 이는 Sec-Fetch-* HTTP 요청 헤더 필드를 엄격하게 검증하여 요청이 부적절한 교차 출처 호출에서 발생하지 않았는지 확인하거나 브라우저에 반환된 콘텐츠를 차단하도록 지시하는 제한적인 교차 출처 리소스 정책 HTTP 응답 헤더 필드를 설정하여 달성할 수 있다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.6", + "Ordinal": 6, + "Name": "외부 리소스 무결성", + "Items": [ + { + "Shortcode": "V3.6.1", + "Ordinal": 1, + "Description": "클라이언트 측 자산(예: JavaScript 라이브러리, CSS 또는 웹 폰트)이 정적이고 버전이 지정된 경우에만 외부(예: 콘텐츠 전송 네트워크)로만 호스팅되는지 확인하고, 하위 리소스 무결성(SRI)을 사용하여 자산의 무결성을 검증한다. 이것이 불가능하다면 각 리소스에 대해 이를 정당화하기 위해 문서화된 보안 결정이 필요하다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.7", + "Ordinal": 7, + "Name": "다른 브라우저 보안 고려사항", + "Items": [ + { + "Shortcode": "V3.7.1", + "Ordinal": 1, + "Description": "애플리케이션이 여전히 지원되고 안전하다고 간주되는 클라이언트 측 기술만 사용하는지 확인한다. 이 요구 사항을 충족하지 않는 기술의 예로는 NSAPI 플러그인, Flash, Shockwave, ActiveX, Silverlight, NACL 또는 클라이언트 측 Java applets가 있다.", + "L": "2" + }, + { + "Shortcode": "V3.7.2", + "Ordinal": 2, + "Description": "애플리케이션이 사용자를 통제하지 못하는 다른 호스트 이름이나 도메인으로 자동으로 리다이렉션할 때, 허용된 목적지로만 리다이렉션 하는지 확인한다.", + "L": "2" + }, + { + "Shortcode": "V3.7.3", + "Ordinal": 3, + "Description": "사용자가 애플리케이션의 통제 범위를 벗어난 URL로 리다이렉션 될 때 이를 취소할 수 있는 옵션이 있는 알림이 애플리케이션에 표시되는지 확인한다.", + "L": "3" + }, + { + "Shortcode": "V3.7.4", + "Ordinal": 4, + "Description": "애플리케이션의 최상위 도메인(예: site.tld)가 공공 HSTS preload 목록에 추가되었는지 확인한다. 이렇게 하면 애플리케이션에 TLS를 사용하는 것이 Strict-Transport-Security 응답 헤더 필드에만 의존하지 않고 메인 브라우저에 직접 내장된다.", + "L": "3" + }, + { + "Shortcode": "V3.7.5", + "Ordinal": 5, + "Description": "애플리케이션에 접근하는 브라우저가 예상한 보안 특징을 가지고 있지 않은 경우, 애플리케이션이 문서에 명시된 대로 동작하는지 확인한다 (유저에게 경고하거나 접근을 차단하는 등).", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V4", + "Ordinal": 4, + "ShortName": "API", + "Name": "API 와 WEB 서비스", + "Items": [ + { + "Shortcode": "V4.1", + "Ordinal": 1, + "Name": "일반적인 웹 서비스 보안", + "Items": [ + { + "Shortcode": "V4.1.1", + "Ordinal": 1, + "Description": "메세지 본문이 포함된 모든 HTTP 응답에는 실제 내용과 일치하는 Content-Type 헤더 필드가 포함되어 있는지 검증한다. 이때 IANA 미디어 타입(text, /+xml, /xml 등)에 따라 안전한 문자 인코딩 (ex. UTF-8, ISO-8859-1)을 지정하는 charset 파라미터도 포함되어야 한다.", + "L": "1" + }, + { + "Shortcode": "V4.1.2", + "Ordinal": 2, + "Description": "사용자가 대면하는 엔드포인트(사람이 직접 웹 브라우저에 접속하는 경우)만 HTTP에서 HTTPS로 자동 리디렉션하고, 그 외에 서비스나 API 엔드포인트는 명백한 리디렉션을 구현하지 않았는지 검증한다. 이는 클라이언트가 실수로 암호화되지 않은 HTTP 요청을 보내고 있음에도, 요청이 자동으로 HTTPS로 리디렉션되어 민감한 데이터의 유출 사실을 발견하지 못하게 되는 상황을 방지하기 위함이다.", + "L": "2" + }, + { + "Shortcode": "V4.1.3", + "Ordinal": 3, + "Description": "로드 밸런서, 웹 프록시, 백엔드-프론트엔드 서비스 등 중간 계층에서 설정되며, 애플리케이션에서 사용하는 모든 HTTP 헤더 필드를 사용자가 재정의할 수 없는지 확인한다. 예를 들어 X-Real-IP, X-Frowarded-*, X-User-ID 등의 헤더가 포함될 수 있다.", + "L": "2" + }, + { + "Shortcode": "V4.1.4", + "Ordinal": 4, + "Description": "애플리케이션이나 API에서 명시적으로 지원하는 HTTP 메서드(프리플라이트 요청 시에 OPTIONS 포함)만 사용할 수 있으며, 사용되지 않는 메서드는 차단되어 있는지 확인한다.", + "L": "3" + }, + { + "Shortcode": "V4.1.5", + "Ordinal": 5, + "Description": "매우 민감하거나 여러 시스템을 거치는 요청이나 거래에 대한 전송 계층 보호에 더하여 메세지별 디지털 서명들을 사용함으로써 추가적인 보증을 제공하는지 확인한다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V4.2", + "Ordinal": 2, + "Name": "HTTP 메세지 구조 검증", + "Items": [ + { + "Shortcode": "V4.2.1", + "Ordinal": 1, + "Description": "모든 애플리케이션 구성 요소(로드 밸런서, 방화벽, 애플리케이션 서버 포함)가 HTTP 요청 smuggling을 예방하는 HTTP 버전의 적합한 메커니즘을 사용하는지에 대해, 수신되는 HTTP 메세지의 끝을 결정하는지 확인한다. HTTP/1.x에서 Transfer-encoding 헤더 필드가 있는 경우에 RFC 2616에 따라서 Content-Length 헤더는 무시해야 한다. HTTP/2 또는 HTTP/3를 사용할 때 Content-Length 헤더 필드가 있는 경우에 수신기는 DATA 프레임의 길이와 일치하는지 확인해야 한다.", + "L": "2" + }, + { + "Shortcode": "V4.2.2", + "Ordinal": 2, + "Description": "HTTP 메세지를 생성할 때, 요청 smuggling 공격을 예방하기 위해서 HTTP 프로토콜의 프레이밍 방식에 의해 결정된 Content의 길이와 Content-Length 헤더 필드가 충돌하지 않는지 확인한다. ", + "L": "3" + }, + { + "Shortcode": "V4.2.3", + "Ordinal": 3, + "Description": "응답 분할 및 헤더 인젝션 공격을 예방하기 위해서 애플리케이션이 Transfer-encoding과 같은 connection-specific 헤더 필드를 가진 HTTP/2또는 HTTP/3 메세지를 전송하거나 수락하지 않는지 확인한다.", + "L": "3" + }, + { + "Shortcode": "V4.2.4", + "Ordinal": 4, + "Description": "헤더 인젝션 공격을 예방하기 위해서, 애플리케이션이 헤더 이름과 값에 CR(\\r), LF(\\n), CRLF(\\r\\n)과 같은 줄바꿈 문자가 포함되어 있지 않은 HTTP/2 및 HTTP/3 요청만 허용하는지 확인한다.", + "L": "3" + }, + { + "Shortcode": "V4.2.5", + "Ordinal": 5, + "Description": "애플리케이션(백엔드 또는 프론트엔드)이 요청을 빌드하고 전송하는 경우, 수신 구성 요소가 수학하기에는 너무 긴 URI(ex. API 호출) 또는 HTTP 요청 헤더 필드(ex. Authorization 또는 Cookie)를 생성하지 않도록 검증, 검열 또는 기타 메커니즘을 사용하는지 확인한다. 이로 인해서 지나치게 긴 요청(ex. 긴 쿠키 헤더 필드)을 보낼 때와 같이 서비스 거부가 발생하여 서버가 항상 오류 상태로 응답할 수 있다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V4.3", + "Ordinal": 3, + "Name": "GraphQL", + "Items": [ + { + "Shortcode": "V4.3.1", + "Ordinal": 1, + "Description": "쿼리 허용 목록, 깊이 제한, 양 제한 또는 쿼리 비용 분석을 사용하여 값비싼 중첩 쿼리로 인해 GraphQL 또는 데이터 계층 표현식 거부(DOS)를 방지하는지 확인한다.", + "L": "2" + }, + { + "Shortcode": "V4.3.2", + "Ordinal": 2, + "Description": "GraphQL API가 다른 사용자에 의해 사용되지 않는 한, 운영 환경에서 GraphQL 점검 쿼리들이 비비활성화되어 있는지 확인한다.", + "L": "2" + } + ] + }, + { + "Shortcode": "V4.4", + "Ordinal": 4, + "Name": "WebSocket", + "Items": [ + { + "Shortcode": "V4.4.1", + "Ordinal": 1, + "Description": "모든 WebSocket 연결에 WebSocket over TLS(WSS)이 사용되는지 확인한다.", + "L": "1" + }, + { + "Shortcode": "V4.4.2", + "Ordinal": 2, + "Description": "초기 HTTP WebSocket Handshake 중에 기존 헤더 필드가 애플리케이션에 허용된 기존 목록과 대조되는지 확인한다.", + "L": "2" + }, + { + "Shortcode": "V4.4.3", + "Ordinal": 3, + "Description": "애플리케이션의 표준 세션 관리를 사용할 수 없는 경우, 관련 세션 관리 보안 요구 사항을 준수하는 전용 토큰이 사용되고 있는지 확인한다.", + "L": "2" + }, + { + "Shortcode": "V4.4.4", + "Ordinal": 4, + "Description": "기존 HTTPS 세션을 WebSocket 채널로 전환할 때 이전에 인증된 HTTPS 세션을 통해 전용 WebSocket 세션 관리 토큰을 처음 얻거나 검증하는지 확인한다.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V5", + "Ordinal": 5, + "ShortName": "File", + "Name": "파일 처리", + "Items": [ + { + "Shortcode": "V5.1", + "Ordinal": 1, + "Name": "파일 처리 문서화", + "Items": [ + { + "Shortcode": "V5.1.1", + "Ordinal": 1, + "Description": "업로드 기능별로 허용되는 파일 형식, 예상되는 파일 확장자, 그리고 최대 크기(압축 해제된 크기 포함)가 문서에 정의되어 있는지 검증해야 한다. 또한, 악성 파일이 탐지될 때 애플리케이션이 어떻게 동작하는지와 같이, 최종 사용자가 파일을 안전하게 다운로드하고 처리할 수 있도록 하는 방법이 문서에 명시되어 있는지 확인해야 한다.", + "L": "2" + } + ] + }, + { + "Shortcode": "V5.2", + "Ordinal": 2, + "Name": "파일 업로드 및 콘텐츠", + "Items": [ + { + "Shortcode": "V5.2.1", + "Ordinal": 1, + "Description": "애플리케이션이 성능 저하나 서비스 거부 공격(Denial of Service; DoS)을 유발하지 않고 처리할 수 있는 크기의 파일만 허용하는지 검증해야 한다.", + "L": "1" + }, + { + "Shortcode": "V5.2.2", + "Ordinal": 2, + "Description": "애플리케이션이 파일 자체 또는 zip 파일과 같은 아카이브 내에서 파일을 허용할 때, 파일 확장자가 예상 파일 확장자와 일치하는지 확인하고 내용이 확장자로 표현된 유형과 일치하는지 확인하는지 검증해야 한다. 여기에는 초기 '매직 바이트(magic bytes)' 확인, 이미지 재작성 수행, 파일 내용 유효성 검사를 위한 전문 라이브러리 사용이 포함되지만 이에 국한되지 않는다. L1의 경우, 특정 비즈니스 또는 보안 결정을 내리는 데 사용되는 파일에만 집중할 수 있다. L2 이상에서는 허용되는 모든 파일에 적용되어야 한다", + "L": "1" + }, + { + "Shortcode": "V5.2.3", + "Ordinal": 3, + "Description": "애플리케이션이 압축 파일(예: zip, gz, docx, odt)을 압축 해제하기 전에 허용되는 최대 압축 해제 크기와 최대 파일 수를 확인하는지 검증해야 한다.", + "L": "2" + }, + { + "Shortcode": "V5.2.4", + "Ordinal": 4, + "Description": "단일 사용자가 너무 많은 파일이나 과도하게 큰 파일로 저장 공간을 채우지 않도록 사용자별 파일 크기 할당량(quota) 및 최대 파일 수가 적용되는지 검증해야 한다.", + "L": "3" + }, + { + "Shortcode": "V5.2.5", + "Ordinal": 5, + "Description": "애플리케이션이 심볼릭 링크(symlink)를 포함하는 압축 파일 업로드를 허용하지 않는지 검증해야 한다. 단, 이러한 기능이 특별히 요구되는 경우에는 심볼릭 링크할 수 있는 파일의 허용 목록(allowlist)을 강제하는 것이 필요하다.", + "L": "3" + }, + { + "Shortcode": "V5.2.6", + "Ordinal": 6, + "Description": "픽셀 플러드 공격(Pixel Flood Attack)을 방지하기 위해, 애플리케이션이 업로드된 이미지의 픽셀 크기가 허용된 최대값보다 큰 경우 해당 이미지를 거부하는지 검증해야 한다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V5.3", + "Ordinal": 3, + "Name": "파일 저장", + "Items": [ + { + "Shortcode": "V5.3.1", + "Ordinal": 1, + "Description": "신뢰할 수 없는 입력으로 업로드되거나 생성되어 공개 폴더에 저장된 파일이 HTTP 요청으로 직접 접근될 때 서버 측 프로그램 코드로 실행되지 않는지 검증해야 한다.", + "L": "1" + }, + { + "Shortcode": "V5.3.2", + "Ordinal": 2, + "Description": "애플리케이션이 파일 작업을 위한 파일 경로를 생성할 때, 사용자 제출 파일명 대신 내부적으로 생성되거나 신뢰할 수 있는 데이터를 사용하는지 검증해야 한다. 만약 사용자 제출 파일명 또는 파일 메타데이터를 반드시 사용해야 한다면, 경로 탐색(path traversal), 로컬 또는 원격 파일 포함(Local File Inclusion; LFI, Remote File Inclusion; RFI), 그리고 서버 측 요청 위조(Server-side Request Forgery; SSRF) 공격으로부터 보호하기 위해 엄격한 유효성 검사 및 정제(Sanitization)가 적용되는지 확인해야 한다.", + "L": "1" + }, + { + "Shortcode": "V5.3.3", + "Ordinal": 3, + "Description": "파일 압축 해제와 같은 서버 측 파일 처리가 zip slip과 같은 취약점을 방지하기 위해 사용자 제공 경로 정보를 무시하는지 검증해야 한다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V5.4", + "Ordinal": 4, + "Name": "파일 다운로드", + "Items": [ + { + "Shortcode": "V5.4.1", + "Ordinal": 1, + "Description": "애플리케이션이 JSON, JSONP 또는 URL 파라미터를 포함한 사용자 제출 파일명을 검증하거나 무시하는지 검증해야 하고, 응답의 Content-Disposition 헤더 필드에 파일명을 명시하는지 검증해야 한다.", + "L": "2" + }, + { + "Shortcode": "V5.4.2", + "Ordinal": 2, + "Description": "제공되는 파일 이름(예: HTTP 응답 헤더 필드 또는 이메일 첨부 파일)이 문서 구조를 보존하고 삽입 공격(Injection Attack)을 방지하기 위해 인코딩되거나 정제되는지 검증해야 한다. (예: RFC 6266 준수)", + "L": "2" + }, + { + "Shortcode": "V5.4.3", + "Ordinal": 3, + "Description": "신뢰할 수 없는 소스에서 얻은 파일이 알려진 악성 콘텐츠 제공을 방지하기 위해 안티바이러스 스캐너에 의해 검사되는지 검증해야 한다.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V6", + "Ordinal": 6, + "ShortName": "Authentication", + "Name": "인증", + "Items": [ + { + "Shortcode": "V6.1", + "Ordinal": 1, + "Name": "Authentication Documentation", + "Items": [ + { + "Shortcode": "V6.1.1", + "Ordinal": 1, + "Description": "인증 문서가 크리덴셜 스터핑, 비밀번호 무차별 대입 공격 등을 방어하기 위해 속도 제한, 자동화 방지, 적응형 응답(adaptive response)과 같은 제어가 어떻게 사용되는지를 정의한다. 또한, 이러한 제어가 어떻게 구성되는지와 악의적으로 계정을 잠그는 것을 방지하는 방법을 명확히 하는지 검증한다.", + "L": "1" + }, + { + "Shortcode": "V6.1.2", + "Ordinal": 2, + "Description": "조직명, 제품명, 시스템 식별자, 프로젝트 코드명, 부서명 또는 역할명 등 문맥적으로 특정된 단어의 변형을 포함하여, 비밀번호에 사용되지 않도록 문서화된 단어 목록이 있는지 검증한다.", + "L": "2" + }, + { + "Shortcode": "V6.1.3", + "Ordinal": 3, + "Description": "애플리케이션이 여러 인증 경로를 포함하는 경우, 이들 모두가 문서화되어 있으며 각 경로에 대해 일관되게 적용되는 보안 제어와 인증 강도가 정의되어 있는지 검증한다.", + "L": "2" + } + ] + }, + { + "Shortcode": "V6.2", + "Ordinal": 2, + "Name": "비밀번호 보안", + "Items": [ + { + "Shortcode": "V6.2.1", + "Ordinal": 1, + "Description": "사용자가 설정하는 비밀번호가 최소 8자 이상이어야 하며, 최소 15자 이상을 강력히 권장하는지 검증한다.", + "L": "1" + }, + { + "Shortcode": "V6.2.2", + "Ordinal": 2, + "Description": "사용자가 비밀번호를 변경할 수 있는지 검증한다.", + "L": "1" + }, + { + "Shortcode": "V6.2.3", + "Ordinal": 3, + "Description": "비밀번호 변경 기능이 사용자의 현재 비밀번호와 새 비밀번호를 요구하는지 검증한다.", + "L": "1" + }, + { + "Shortcode": "V6.2.4", + "Ordinal": 4, + "Description": "계정 등록 또는 비밀번호 변경 시 제출된 비밀번호가 최소 3000개의 상위 비밀번호 목록과 비교 및 검사되는지, 이때 애플리케이션 비밀번호 정책(예: 최소 길이)을 만족하는지 검증한다.", + "L": "1" + }, + { + "Shortcode": "V6.2.5", + "Ordinal": 5, + "Description": "비밀번호는 어떤 구성도 허용되며, 허용되는 문자 유형에 대한 제한이 없는지 검증한다. 대/소문자, 숫자, 특수문자에 대한 최소 개수 요구사항이 없어야 한다.", + "L": "1" + }, + { + "Shortcode": "V6.2.6", + "Ordinal": 6, + "Description": "비밀번호 입력 필드가 type=password를 사용하여 입력을 마스킹하는지 검증한다. 애플리케이션은 사용자가 전체 비밀번호나 마지막 입력 문자를 일시적으로 볼 수 있도록 허용할 수 있다.", + "L": "1" + }, + { + "Shortcode": "V6.2.7", + "Ordinal": 7, + "Description": "붙여넣기 기능, 브라우저 비밀번호 도우미, 외부 비밀번호 관리자의 사용이 허용되는지 검증한다.", + "L": "1" + }, + { + "Shortcode": "V6.2.8", + "Ordinal": 8, + "Description": "애플리케이션이 비밀번호를 사용자로부터 수신한 그대로 검증하며, 대소문자 변경이나 잘림(truncation)과 같은 수정 없이 처리하는지 검증한다.", + "L": "1" + }, + { + "Shortcode": "V6.2.9", + "Ordinal": 9, + "Description": "비밀번호가 최소 64자까지 허용되는지 검증한다.", + "L": "2" + }, + { + "Shortcode": "V6.2.10", + "Ordinal": 10, + "Description": "사용자의 비밀번호는 손상되었음이 발견되거나 사용자가 교체할 때까지 유효하며, 애플리케이션이 주기적인 자격 증명 교체를 요구하지 않는지 검증한다.", + "L": "2" + }, + { + "Shortcode": "V6.2.11", + "Ordinal": 11, + "Description": "문서화된 문맥별 단어 목록을 사용하여 추측하기 쉬운 비밀번호가 생성되지 않도록 하는지 검증한다.", + "L": "2" + }, + { + "Shortcode": "V6.2.12", + "Ordinal": 12, + "Description": "계정 등록 또는 비밀번호 변경 시 제출된 비밀번호가 유출된 비밀번호 집합과 비교 및 검사되는지 검증한다.", + "L": "2" + } + ] + }, + { + "Shortcode": "V6.3", + "Ordinal": 3, + "Name": "일반 인증 보안", + "Items": [ + { + "Shortcode": "V6.3.1", + "Ordinal": 1, + "Description": "애플리케이션의 보안 문서에 따라 크리덴셜 스터핑 및 비밀번호 무차별 대입 공격을 방지하기 위한 제어가 구현되어 있는지 검증한다.", + "L": "1" + }, + { + "Shortcode": "V6.3.2", + "Ordinal": 2, + "Description": "“root”, “admin”, “sa”와 같은 기본 사용자 계정이 애플리케이션에 존재하지 않거나 비활성화되어 있는지 검증한다.", + "L": "1" + }, + { + "Shortcode": "V6.3.3", + "Ordinal": 3, + "Description": "애플리케이션 접근 시 반드시 MFA 또는 단일 요소 인증 메커니즘의 조합을 사용하는지 검증한다. L3의 경우, 인증을 수행하려는 사용자의 의도를 검증하기 위해 사용자가 직접 수행하는 동작(예: FIDO 하드웨어 키 또는 모바일 기기에서 버튼을 누르는 행위)을 요구함으로써, 피싱 공격에 대한 침해 및 위장 저항성을 제공하는 하드웨어 기반 인증 메커니즘이 반드시 하나의 요소로 포함되어야 한다. 이 요구사항에서 고려 사항을 완화하려는 경우, 완전히 문서화된 근거와 포괄적인 보완 통제가 반드시 수반되어야 한다.", + "L": "2" + }, + { + "Shortcode": "V6.3.4", + "Ordinal": 4, + "Description": "여러 인증 경로가 존재하는 경우, 문서화되지 않은 경로가 없어야 하며 보안 제어와 인증 강도가 일관되게 적용되는지 검증한다.", + "L": "2" + }, + { + "Shortcode": "V6.3.5", + "Ordinal": 5, + "Description": "사용자가 의심스러운 인증 시도에 대해 성공 여부와 관계 없이 알림을 제공받는지 검증한다. 여기에는 비정상적인 위치나 클라이언트에서의 인증 시도, 부분적으로만 성공한 인증(여러 요소 중 하나만 성공한 경우), 장기간 비활성 상태 이후의 인증 시도, 또는 여러 번의 인증 실패 후 성공한 인증이 포함될 수 있다.", + "L": "3" + }, + { + "Shortcode": "V6.3.6", + "Ordinal": 6, + "Description": "이메일이 단일 또는 다중 요소 인증 메커니즘으로 사용되지 않는지 검증한다.", + "L": "3" + }, + { + "Shortcode": "V6.3.7", + "Ordinal": 7, + "Description": "자격 증명 재설정, 사용자명/이메일 수정 등 인증 관련 정보 변경 이후 사용자에게 통지되는지 검증한다.", + "L": "3" + }, + { + "Shortcode": "V6.3.8", + "Ordinal": 8, + "Description": "오류 메시지, HTTP 응답 코드, 응답 시간 차이 등을 통해 유효한 사용자를 유추할 수 없으며, 비밀번호 등록/찾기 기능에도 동일한 보호가 적용되는지 검증한다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.4", + "Ordinal": 4, + "Name": "인증 요소 수명 주기 및 복구", + "Items": [ + { + "Shortcode": "V6.4.1", + "Ordinal": 1, + "Description": "시스템이 생성하는 초기 비밀번호나 활성화 코드가 안전하게 난수로 생성되며, 기존 비밀번호 정책을 따르고, 짧은 기간 내 또는 최초 사용 시 만료되는지 검증한다. 초기 비밀번호는 장기 비밀번호로 허용되지 않아야 한다.", + "L": "1" + }, + { + "Shortcode": "V6.4.2", + "Ordinal": 2, + "Description": "비밀번호 힌트나 지식 기반 인증(“비밀 질문”)이 존재하지 않는지 검증한다.", + "L": "1" + }, + { + "Shortcode": "V6.4.3", + "Ordinal": 3, + "Description": "분실된 비밀번호에 대한 재설정 절차가 안전하게 구현되며, MFA를 우회하지 않는지 검증한다.", + "L": "2" + }, + { + "Shortcode": "V6.4.4", + "Ordinal": 4, + "Description": "MFA 요소 분실 시, 등록 시와 동일 수준의 신원 증명이 수행되는지 검증한다.", + "L": "2" + }, + { + "Shortcode": "V6.4.5", + "Ordinal": 5, + "Description": "만료 예정인 인증 메커니즘에 대한 갱신 안내가 충분한 시간 전에 발송되며, 필요한 경우 자동 알림이 구성되는지 검증한다", + "L": "3" + }, + { + "Shortcode": "V6.4.6", + "Ordinal": 6, + "Description": "관리자가 사용자 비밀번호 재설정 절차를 시작할 수 있으나, 사용자의 비밀번호를 직접 변경하거나 지정할 수 없는지 검증한다. 이는 관리자가 사용자의 비밀번호를 알지 못하도록 한다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.5", + "Ordinal": 5, + "Name": "General Multi-factor authentication requirements", + "Items": [ + { + "Shortcode": "V6.5.1", + "Ordinal": 1, + "Description": "조회 secret, 대역 외 인증 요청 및 코드, 시간 기반 일회용 비밀번호가 단 한 번만 성공적으로 사용 가능한지 검증한다.", + "L": "2" + }, + { + "Shortcode": "V6.5.2", + "Ordinal": 2, + "Description": "애플리케이션 백엔드에 저장될 때, 엔트로피가 112비트 미만인 룩업 시크릿(예: 무작위 영숫자 19자 또는 무작위 숫자 34자)은 32비트 무작위 솔트(salt)를 포함하는 사전 승인된 비밀번호 저장용 해시 알고리즘으로 해시되는지 검증한다. 룩업 시크릿이 112비트 이상의 엔트로피를 가진 경우에는 표준 해시 함수를 사용할 수 있다.", + "L": "2" + }, + { + "Shortcode": "V6.5.3", + "Ordinal": 3, + "Description": "룩업 시크릿, 대역 외 인증 코드, 그리고 시간 기반 일회용 비밀번호의 시드가 예측 가능한 값을 피하기 위해 암호학적으로 안전한 의사난수 생성기(CSPRNG)를 사용하여 생성되는지 검증한다. ", + "L": "2" + }, + { + "Shortcode": "V6.5.4", + "Ordinal": 4, + "Description": "룩업 시크릿과 대역 외 인증 코드가 최소 20비트의 엔트로피를 가지는지 검증한다. 일반적으로 무작위 영숫자 4자 또는 무작위 숫자 6자가 충분하다.", + "L": "2" + }, + { + "Shortcode": "V6.5.5", + "Ordinal": 5, + "Description": "대역 외 인증 요청, 코드 또는 토큰과 시간 기반 일회용 비밀번호가 정의된 수명을 가지는지 검증한다. 대역 외 요청의 최대 수명은 10분이어야 하며, TOTP의 최대 수명은 30초이어야 한다.", + "L": "2" + }, + { + "Shortcode": "V6.5.6", + "Ordinal": 6, + "Description": "도난이나 기타 손실의 경우 모든 인증 요소(물리적 장치 포함)를 해지할 수 있는지 검증한다.", + "L": "3" + }, + { + "Shortcode": "V6.5.7", + "Ordinal": 7, + "Description": "생체 인식 인증 메커니즘은 반드시 보조 요소로만 사용되어야 하며, “소유하고 있는 것” 또는 “알고 있는 것” 중 하나와 함께 사용되는지 검증한다.", + "L": "3" + }, + { + "Shortcode": "V6.5.8", + "Ordinal": 8, + "Description": "시간 기반 일회용 비밀번호는 신뢰할 수 있는 서비스의 시간 소스를 기준으로 검증되어야 하며, 신뢰할 수 없거나 클라이언트에서 제공한 시간을 기반으로 해서는 안 된다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.6", + "Ordinal": 6, + "Name": "대역 외(Out-of-Band) 인증 메커니즘", + "Items": [ + { + "Shortcode": "V6.6.1", + "Ordinal": 1, + "Description": "공중 교환 전화망(PSTN)을 사용하여 전화나 SMS를 통해 일회용 비밀번호(OTPs)를 전달하는 인증 메커니즘은, 해당 전화번호가 사전에 검증되었을 때만 제공되어야 하며, 더 강력한 대체 방법(예: 시간 기반 일회용 비밀번호)도 제공되어야 하고, 서비스는 사용자에게 이러한 보안 위험에 대한 정보를 제공해야 한다. L3 애플리케이션의 경우, 전화와 SMS는 옵션으로 제공되어서는 안 된다.", + "L": "2" + }, + { + "Shortcode": "V6.6.2", + "Ordinal": 2, + "Description": "대역 외 인증 요청, 코드 또는 토큰은 생성된 원래 인증 요청에만 바인딩되어야 하며, 이전이나 이후의 요청에는 사용할 수 없어야 한다.", + "L": "2" + }, + { + "Shortcode": "V6.6.3", + "Ordinal": 3, + "Description": "코드 기반 대역 외 인증 메커니즘이 속도 제한 등을 통해 무차별 대입 공격으로부터 보호되는지 검증한다. 또한 최소 64비트 이상의 엔트로피를 가진 코드를 사용하는 것도 고려해야한다.", + "L": "2" + }, + { + "Shortcode": "V6.6.4", + "Ordinal": 4, + "Description": "다중요소 인증에 푸시 알림이 사용되는 경우, 푸시 폭탄(push bombing) 공격을 방지하기 위해 속도 제한을 적용해야 한다. 또한 숫자 일치 기법 역시 이 위험을 완화할 수 있다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.7", + "Ordinal": 7, + "Name": "암호학적 인증 메커니즘", + "Items": [ + { + "Shortcode": "V6.7.1", + "Ordinal": 1, + "Description": "암호학적 인증 단언(assertion)을 검증하는 데 사용되는 인증서는 수정으로부터 보호되는 방식으로 저장되는지 검증한다.", + "L": "3" + }, + { + "Shortcode": "V6.7.2", + "Ordinal": 2, + "Description": "챌린지 논스(nonce)는 최소 64비트 길이여야 하며, 통계적으로 고유하거나 해당 암호 장치의 수명 동안 고유해야 한다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.8", + "Ordinal": 8, + "Name": "ID 제공자(IdP)를 통한 인증", + "Items": [ + { + "Shortcode": "V6.8.1", + "Ordinal": 1, + "Description": "애플리케이션이 다중 ID 제공자(IdP)를 지원하는 경우, 사용자의 신원이 다른 지원 IdP를 통해 위조될 수 없는지 검증한다. (예: 동일한 사용자 식별자를 사용하는 방식). 표준적인 대응책은 애플리케이션이 IdP ID(네임스페이스 역할)와 IdP 내 사용자 ID의 조합을 사용하여 사용자를 등록하고 식별하는 것이다.", + "L": "2" + }, + { + "Shortcode": "V6.8.2", + "Ordinal": 2, + "Description": "인증 단언(예: JWT 또는 SAML 단언)의 디지털 서명이 존재하고 무결성이 항상 유지되는지를 검증한다. 서명이 없거나 유효하지 않은 단언은 거부해야 한다.", + "L": "2" + }, + { + "Shortcode": "V6.8.3", + "Ordinal": 3, + "Description": "SAML 단언이 재생 공격의 방지를 위해 고유하게 처리되는지, 유효 기간 내에 단 한 번만 사용되는지 검증한다.", + "L": "2" + }, + { + "Shortcode": "V6.8.4", + "Ordinal": 4, + "Description": "애플리케이션이 별도의 ID 제공자(IdP)를 사용하고 특정 기능에 대해 특정 인증 강도, 방식, 또는 최근성을 요구하는 경우, 애플리케이션은 IdP가 반환한 정보를 사용하여 이를 검증해야 한다. 예를 들어, OIDC가 사용되는 경우, 이는 ‘acr’, ‘amr’, ‘auth_time’(존재하는 경우)과 같은 ID 토큰 클레임을 검증함으로써 달성할 수 있다. IdP가 이 정보를 제공하지 않는 경우, 애플리케이션은 최소 강도의 인증 메커니즘(예: 사용자 이름과 비밀번호를 사용하는 단일요소 인증)이 사용되었다고 가정하는 문서화된 대체 접근법을 가져야 한다.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V7", + "Ordinal": 7, + "ShortName": "Session", + "Name": "세션 관리", + "Items": [ + { + "Shortcode": "V7.1", + "Ordinal": 1, + "Name": "세션 관리 문서화", + "Items": [ + { + "Shortcode": "V7.1.1", + "Ordinal": 1, + "Description": "사용자의 세션 비활성 시간 초과 및 절대 최대 세션 수명에 대한 문서가 존재하고, 다른 제어와의 조합에서 적절하며, NIST SP 800-63B 재인증 요구사항에서 벗어날 시 그 근거가 문서에 포함되어 있는지 검증한다.", + "L": "2" + }, + { + "Shortcode": "V7.1.2", + "Ordinal": 2, + "Description": "문서가 하나의 계정에서 허용되는 동시(병렬) 세션 수와 활성 세션 수의 최대값에 도달했을 때의 의도된 동작과 수행할 조치를 정의하는지 검증한다.", + "L": "2" + }, + { + "Shortcode": "V7.1.3", + "Ordinal": 3, + "Description": "통합 신원 관리 생태계(예: SSO 시스템)의 일부로 사용자 세션을 생성하고 관리하는 모든 시스템이 문서화되어 있으며, 세션 수명, 종료, 재인증이 필요한 기타 조건을 조율하기 위한 제어가 포함되어 있는지 검증한다.", + "L": "2" + } + ] + }, + { + "Shortcode": "V7.2", + "Ordinal": 2, + "Name": "기본 세션 관리 보안", + "Items": [ + { + "Shortcode": "V7.2.1", + "Ordinal": 1, + "Description": "애플리케이션이 모든 세션 토큰 검증을 신뢰할 수 있는 백엔드 서비스에서 수행하는지 검증한다.", + "L": "1" + }, + { + "Shortcode": "V7.2.2", + "Ordinal": 2, + "Description": "애플리케이션이 세션 관리를 위해 정적 API 시크릿이나 키가 아닌, 자체 포함 토큰 또는 참조 토큰을 동적으로 생성하여 사용하는지 검증한다.", + "L": "1" + }, + { + "Shortcode": "V7.2.3", + "Ordinal": 3, + "Description": "참조 토큰이 사용자 세션을 나타내는 데 사용되는 경우, 그 토큰이 고유하고, 암호학적으로 안전한 의사난수 생성기(CSPRNG)를 사용해 생성되며 최소 128비트의 엔트로피를 갖는지 검증한다.", + "L": "1" + }, + { + "Shortcode": "V7.2.4", + "Ordinal": 4, + "Description": "애플리케이션이 사용자 인증(재인증 포함) 시 새로운 세션 토큰을 생성하고 기존 세션 토큰을 종료하는지 검증한다.", + "L": "1" + } + ] + }, + { + "Shortcode": "V7.3", + "Ordinal": 3, + "Name": "세션 타임아웃", + "Items": [ + { + "Shortcode": "V7.3.1", + "Ordinal": 1, + "Description": "위험 분석 및 문서화된 보안 결정에 따라 재인증을 강제하는 비활성 시간 초과가 존재하는지 검증한다.", + "L": "2" + }, + { + "Shortcode": "V7.3.2", + "Ordinal": 2, + "Description": "위험 분석 및 문서화된 보안 결정에 따라 재인증을 강제하는 절대 최대 세션 수명이 존재하는지 검증한다.", + "L": "2" + } + ] + }, + { + "Shortcode": "V7.4", + "Ordinal": 4, + "Name": "세션 종료", + "Items": [ + { + "Shortcode": "V7.4.1", + "Ordinal": 1, + "Description": "로그아웃이나 만료와 같이 세션 종료가 트리거될 때, 애플리케이션이 해당 세션의 추가 사용을 허용하지 않는지 검증한다. 참조 토큰 또는 상태 유지형 세션의 경우, 이는 애플리케이션 백엔드에서 세션 데이터를 무효화하는 것을 의미한다. 자체 포함 토큰을 사용하는 애플리케이션은 종료된 토큰 목록 유지, 사용자별 날짜·시간 이전에 발급된 토큰 거부, 사용자별 서명 키 회전과 같은 방법을 사용해야 한다.", + "L": "1" + }, + { + "Shortcode": "V7.4.2", + "Ordinal": 2, + "Description": "사용자 계정이 비활성화되거나 삭제될 때(예: 직원 퇴사), 애플리케이션이 모든 활성 세션을 종료하는지 검증한다.", + "L": "1" + }, + { + "Shortcode": "V7.4.3", + "Ordinal": 3, + "Description": "비밀번호 재설정·복구를 통한 변경, MFA 설정 변경 등 어떤 인증 요소라도 성공적으로 변경 또는 제거한 후, 모든 다른 활성 세션을 종료할 수 있는 옵션을 제공하는지 검증한다.", + "L": "2" + }, + { + "Shortcode": "V7.4.4", + "Ordinal": 4, + "Description": "인증이 필요한 모든 페이지의 로그아웃 기능에 접근하는 것이 쉽고 잘 보이는지 검증한다.", + "L": "2" + }, + { + "Shortcode": "V7.4.5", + "Ordinal": 5, + "Description": "애플리케이션 관리자가 개별 사용자 또는 모든 사용자의 활성 세션을 종료할 수 있는지 검증한다.", + "L": "2" + } + ] + }, + { + "Shortcode": "V7.5", + "Ordinal": 5, + "Name": "세션 악용 방어", + "Items": [ + { + "Shortcode": "V7.5.1", + "Ordinal": 1, + "Description": "이메일 주소, 전화번호, MFA 구성, 계정 복구에 사용되는 기타 정보 등 인증에 영향을 줄 수 있는 민감한 계정 속성을 변경하기 전에 전체 재인증을 요구하는지 검증한다.", + "L": "2" + }, + { + "Shortcode": "V7.5.2", + "Ordinal": 2, + "Description": "사용자가 현재 활성 세션을 전체 또는 일부 확인하고(최소 요소 한 개에 대한 인증을 다시 수행한 후) 종료할 수 있는지 검증한다.", + "L": "2" + }, + { + "Shortcode": "V7.5.3", + "Ordinal": 3, + "Description": "매우 민감한 거래나 작업을 수행하기 전에 최소 한 요소 인증 또는 2차 검증을 요구하는지 검증한다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V7.6", + "Ordinal": 6, + "Name": "페더레이션 재인증", + "Items": [ + { + "Shortcode": "V7.6.1", + "Ordinal": 1, + "Description": "RP와 IdP 간 세션 수명과 종료가 문서대로 동작하며, IdP 인증 이벤트 간의 최대 시간이 도달하는 경우 등 필요한 시점에 재인증을 요구하는지 검증한다.", + "L": "2" + }, + { + "Shortcode": "V7.6.2", + "Ordinal": 2, + "Description": "세션 생성 시 사용자 동의 또는 명시적 동작을 요구하여, 사용자 상호작용 없이 새로운 애플리케이션 세션이 생성되지 않도록 하는지 검증한다.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V8", + "Ordinal": 8, + "ShortName": "Authorization", + "Name": "권한 부여", + "Items": [ + { + "Shortcode": "V8.1", + "Ordinal": 1, + "Name": "권한 부여 문서화", + "Items": [ + { + "Shortcode": "V8.1.1", + "Ordinal": 1, + "Description": "권한 부여 문서가 소비자 권한과 자원 속성에 따라 기능 수준 및 데이터별 접근을 제한하는 규칙을 정의하는지 검증한다.", + "L": "1" + }, + { + "Shortcode": "V8.1.2", + "Ordinal": 2, + "Description": "권한 부여 문서가 소비자 권한과 자원 속성에 따라 필드 수준 접근 제한(읽기 및 쓰기 모두)을 정의하는지 검증한다. 이러한 규칙은 관련 데이터 객체의 상태(state)나 상태값(status)과 같은 다른 속성 값에 의존할 수 있다.", + "L": "2" + }, + { + "Shortcode": "V8.1.3", + "Ordinal": 3, + "Description": "애플리케이션 문서가 인증 및 권한 부여와 관련된 보안 결정을 내리는 데 사용되는 환경적, 맥락적 속성(예: 시간대, 사용자 위치, IP 주소, 디바이스 등)을 정의하는지 검증한다.", + "L": "3" + }, + { + "Shortcode": "V8.1.4", + "Ordinal": 4, + "Description": "인증 및 권한 부여 문서가 기능 수준, 데이터별, 필드 수준 권한 부여에 더해 환경적, 맥락적 요소가 의사 결정에 어떻게 사용되는지 정의하는지 검증한다. 여기에는 평가되는 속성, 위험 임계값, 수행되는 조치(예: 허용, 추가 인증 요청, 거부, 단계적 인증)을 포함하는 것을 권장한다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V8.2", + "Ordinal": 2, + "Name": "일반 권한 부여 설계", + "Items": [ + { + "Shortcode": "V8.2.1", + "Ordinal": 1, + "Description": "애플리케이션이 기능 수준의 접근을 명시적 권한이 있는 소비자에게만 허용하는지 검증한다.", + "L": "1" + }, + { + "Shortcode": "V8.2.2", + "Ordinal": 2, + "Description": "애플리케이션이 특정 데이터 항목에 대한 명시적 권한이 있는 소비자에게만 데이터별 접근을 허용하여, 안전하지 않은 직접 객체 참조(IDOR) 및 객체 수준 권한 부여 취약점(BOLA)을 방지하는지 검증한다.", + "L": "1" + }, + { + "Shortcode": "V8.2.3", + "Ordinal": 3, + "Description": "애플리케이션이 특정 필드에 대한 명시적 권한이 있는 소비자에게만 필드 수준 접근을 허용하여, 객체 속성 수준 권한 부여 취약점(BOPLA)을 방지하는지 검증한다.", + "L": "2" + }, + { + "Shortcode": "V8.2.4", + "Ordinal": 4, + "Description": "애플리케이션 문서에서 정의한 바에 따라, 소비자의 환경적, 맥락적 속성(예: 시간대, 위치, IP 주소 또는 장치)에 기반한 적응형 보안 제어가 인증 및 권한 부여 결정에 구현되는지 검증한다. 이러한 제어는 소비자가 새 세션을 시작할 때뿐만 아니라 기존 세션 중에도 반드시 적용되어야 한다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V8.3", + "Ordinal": 3, + "Name": "운영 수준 권한 부여", + "Items": [ + { + "Shortcode": "V8.3.1", + "Ordinal": 1, + "Description": "애플리케이션이 권한 부여 규칙을 신뢰할 수 있는 서비스 계층에서 적용하고, 클라이언트 측 JavaScript처럼 신뢰할 수 없는 소비자가 조작할 수 있는 제어에 의존하지 않는지 검증한다.", + "L": "1" + }, + { + "Shortcode": "V8.3.2", + "Ordinal": 2, + "Description": "권한 부여 결정에 영향을 미치는 값의 변경 사항이 즉시 적용되는지 검증한다. 자체 포함 토큰(self-contained token)과 같이 즉시 적용이 불가능한 경우, 소비자가 더 이상 권한이 없는 작업을 수행할 때 이를 알리고 변경을 되돌리는 완화 제어를 반드시 두어야 한다. 단, 이 방법은 정보 유출을 방지하지는 못한다.", + "L": "3" + }, + { + "Shortcode": "V8.3.3", + "Ordinal": 3, + "Description": "객체에 대한 접근이, 대리인이나 이를 대신 수행하는 서비스의 권한이 아닌, 원래 주체(예: 소비자)의 권한에 기반하는지 검증한다. 예를 들어, 소비자가 인증을 위해 자체 포함 토큰을 사용하여 웹 서비스를 호출하고, 해당 서비스가 다른 서비스에 데이터를 요청하는 경우, 두 번째 서비스는 첫 번째 서비스의 머신-투-머신 토큰이 아니라 소비자의 토큰을 사용하여 권한 결정을 내려야 한다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V8.4", + "Ordinal": 4, + "Name": "기타 권한 부여 고려사항", + "Items": [ + { + "Shortcode": "V8.4.1", + "Ordinal": 1, + "Description": "다중 테넌트 애플리케이션이 교차 테넌트 제어를 사용하여, 소비자의 작업이 권한이 없는 다른 테넌트에 영향을 미치지 않도록 하는지 검증한다.", + "L": "2" + }, + { + "Shortcode": "V8.4.2", + "Ordinal": 2, + "Description": "관리 인터페이스 접근이 연속적인 소비자 신원 검증, 장치 보안 상태 평가, 맥락 기반 위험 분석 등 복수의 보안 계층을 포함하는지 검증한다. 네트워크 위치나 신뢰된 엔드포인트가 무단 접근 가능성을 줄일 수는 있더라도, 단독으로 권한 부여 판단의 유일한 요소가 되어서는 안 된다.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V9", + "Ordinal": 9, + "ShortName": "Self", + "Name": "자체 포함 토큰(self-contained token)", + "Items": [ + { + "Shortcode": "V9.1", + "Ordinal": 1, + "Name": "토큰 출처 및 무결성", + "Items": [ + { + "Shortcode": "V9.1.1", + "Ordinal": 1, + "Description": "자체 포함 토큰 내용을 허용하기 전에 변조를 방지하기 위해 디지털 서명 또는 메시지 인증 코드(MAC)를 사용하여 토큰의 무결성을 검증해야 한다.", + "L": "1" + }, + { + "Shortcode": "V9.1.2", + "Ordinal": 2, + "Description": "주어진 컨텍스트에 대해 자체 포함 토큰을 생성하고 검증할 때, 허용 목록에 있는 알고리즘만 사용될 수 있는지 검증해야 한다. 허용 목록에는 사용 가능한 알고리즘을 모두 포함해야 하며, 이상적으로는 대칭 또는 비대칭 알고리즘 중 하나만을 포함해야 한다. 또한 'None' 알고리즘은 반드시 제외해야 한다. 대칭 및 비대칭 알고리즘 모두를 지원해야 하는 경우, 키 혼동을 방지하기 위해 추가 제어가 필요하다.", + "L": "1" + }, + { + "Shortcode": "V9.1.3", + "Ordinal": 3, + "Description": "자체 포함 토큰을 검증하는 데 사용되는 키 자료가 토큰 발행자를 위한 신뢰할 수 있는 사전 구성된 출처에서 비롯되었는지 검증하여, 공격자가 신뢰할 수 없는 출처 및 키를 지정하는 것을 방지해야 한다. JWT 및 기타 JWS 구조의 경우, 'jku', 'x5u', 'jwk'와 같은 헤더는 신뢰할 수 있는 출처의 허용 목록에 대해 검증되어야 한다.", + "L": "1" + } + ] + }, + { + "Shortcode": "V9.2", + "Ordinal": 2, + "Name": "토큰 내용", + "Items": [ + { + "Shortcode": "V9.2.1", + "Ordinal": 1, + "Description": "토큰 데이터에 유효 기간이 존재하는 경우, 검증 시간이 이 유효 기간 내에 있을 때만 토큰 및 해당 내용이 허용되는지 검증해야 한다. 예를 들어, JWT의 경우 'nbf' 및 'exp' 클레임이 검증되어야 한다.", + "L": "1" + }, + { + "Shortcode": "V9.2.2", + "Ordinal": 2, + "Description": "토큰을 수신하는 서비스가 토큰 내용을 수락하기 전에 올바른 유형이며 의도된 목적을 위한 것인지 토큰을 검증하는지 확인해야 한다. 예를 들어, 인가 결정에는 액세스 토큰만 허용될 수 있으며, 사용자 인증을 증명하는 데는 ID 토큰만 사용될 수 있다.", + "L": "2" + }, + { + "Shortcode": "V9.2.3", + "Ordinal": 3, + "Description": "서비스가 대상 서비스(audience)와 함께 사용하기 위한 토큰만 허용하는지 검증해야 한다. JWT의 경우, 서비스에 정의된 허용 목록에 대해 'aud' 클레임을 검증함으로써 이를 달성할 수 있다.", + "L": "2" + }, + { + "Shortcode": "V9.2.4", + "Ordinal": 4, + "Description": "토큰 발행자가 다른 대상(audience)에게 토큰을 발행하기 위해 동일한 개인 키를 사용하는 경우, 발행된 토큰이 의도된 대상을 고유하게 식별하는 대상 제한을 포함하는지 검증해야 한다. 이는 토큰이 의도하지 않은 대상에서 재사용되는 것을 방지한다. 대상 식별자가 동적으로 프로비저닝되는 경우, 토큰 발행자는 대상 위장(audience impersonation)을 초래하지 않도록 대상들을 검증해야 한다.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V10", + "Ordinal": 10, + "ShortName": "OAuth", + "Name": "OAuth와 OIDC", + "Items": [ + { + "Shortcode": "V10.1", + "Ordinal": 1, + "Name": "일반적인 OAuth 및 OIDC 보안", + "Items": [ + { + "Shortcode": "V10.1.1", + "Ordinal": 1, + "Description": "엄격하게 필요한 구성 요소에만 토큰이 전송되는지 검증해야 한다. 예를 들어, 브라우저 기반 JavaScript 애플리케이션에 프론트엔드 전용 백엔드(Backend For Frontend; BFF) 패턴을 사용하는 경우, 액세스 토큰 및 리프레시 토큰은 백엔드에서만 접근 가능해야 한다.", + "L": "2" + }, + { + "Shortcode": "V10.1.2", + "Ordinal": 2, + "Description": "클라이언트는 인가 서버에서 제공하는 값(예: 인가 코드 또는 ID 토큰)이 동일한 사용자 에이전트 세션 및 트랜잭션에서 시작된 인가 플로우의 결과인 경우에만 허용하는지 검증해야 한다. 이를 위해 클라이언트가 생성하는 비밀 값(PKCE(Proof Key for Code Exchange)의 'code_verifier', 'state', OIDC의 'nonce' 등)은 추측이 불가능해야 하며, 해당 트랜잭션에 고유해야 하고, 트랜잭션이 시작된 클라이언트와 사용자 에이전트 세션 양쪽에 안전하게 결합(Binding)되어 있어야 한다.", + "L": "2" + } + ] + }, + { + "Shortcode": "V10.2", + "Ordinal": 2, + "Name": "OAuth 클라이언트", + "Items": [ + { + "Shortcode": "V10.2.1", + "Ordinal": 1, + "Description": "코드 플로우를 사용하는 경우, OAuth 클라이언트는 토큰 요청을 유도하는 사이트 간 요청 위조 공격(Cross-Site Request Forgery; CSRF)에 대한 보호 기능을 갖추고 있는지 검증한다. 이를 위해 인가 요청 시 전송된 'state' 파라미터를 검증하거나, PKCE 기능을 사용해야 한다.", + "L": "2" + }, + { + "Shortcode": "V10.2.2", + "Ordinal": 2, + "Description": "OAuth 클라이언트가 둘 이상의 인가 서버와 상호 작용할 수 있는 경우, 믹스업 공격에 대한 방어 대책을 갖는지 검증해야 한다. 예를 들어, 인가 서버가 'iss' 파라미터 값을 반환하도록 요구하고 인가 응답 및 토큰 응답에서 이를 검증할 수 있다.", + "L": "2" + }, + { + "Shortcode": "V10.2.3", + "Ordinal": 3, + "Description": "OAuth 클라이언트가 인가 서버에 대한 요청에서 필요한 범위(또는 기타 인가 파라미터)만 요청하는지 검증해야 한다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V10.3", + "Ordinal": 3, + "Name": "OAuth 리소스 서버", + "Items": [ + { + "Shortcode": "V10.3.1", + "Ordinal": 1, + "Description": "리소스 서버가 해당 서비스(audience)에 사용하도록 의도된 액세스 토큰만 수락하는지 검증해야 한다. 대상은 구조화된 액세스 토큰(예: JWT의 'aud' 클레임)에 포함될 수 있거나, 토큰 조회 엔드포인트를 사용하여 확인할 수 있다.", + "L": "2" + }, + { + "Shortcode": "V10.3.2", + "Ordinal": 2, + "Description": "리소스 서버가 위임된 인가를 정의하는 액세스 토큰의 클레임을 기반으로 인가 결정을 시행하는지 검증해야 한다. 'sub', 'scope', 'authorization_details'와 같은 클레임이 존재하는 경우, 이는 결정에 반영되어야 한다.", + "L": "2" + }, + { + "Shortcode": "V10.3.3", + "Ordinal": 3, + "Description": "액세스 토큰(JWT 또는 관련 토큰 조회 응답)에서 고유한 사용자를 식별해야 하는 접근 제어 결정이 필요한 경우, 리소스 서버가 다른 사용자에게 재할당될 수 없는 클레임에서 사용자를 식별하는지 검증해야 한다. 일반적으로 이는 'iss' 및 'sub' 클레임의 조합을 사용하는 것을 의미한다.", + "L": "2" + }, + { + "Shortcode": "V10.3.4", + "Ordinal": 4, + "Description": "리소스 서버가 특정 인증 강도, 방법 또는 최신성을 요구하는 경우, 제시된 액세스 토큰이 이러한 제약 조건을 충족하는지 검증해야 한다. 예를 들어, 토큰을 제시한 경우 OIDC의 'acr', 'amr' 및 'auth_time' 클레임을 각각 사용해야 한다.", + "L": "2" + }, + { + "Shortcode": "V10.3.5", + "Ordinal": 5, + "Description": "리소스 서버가 발신자 제약 액세스 토큰, 즉 OAuth 2용 상호 TLS(Mutual TLS; mTLS) 또는 OAuth 2 소유 증명(Demonstration of Proof of Possession; DPoP)를 요구하여 도난된 액세스 토큰 사용 또는 액세스 토큰 재사용(권한 없는 당사자로부터)을 방지하는지 검증해야 한다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V10.4", + "Ordinal": 4, + "Name": "OAuth 인가 서버", + "Items": [ + { + "Shortcode": "V10.4.1", + "Ordinal": 1, + "Description": "인가 서버는 클라이언트 별로 사전 등록된 URI의 허용 목록을 기반으로 리디렉션 URI를 정확한 문자열 비교 방식으로 검증해야 한다.", + "L": "1" + }, + { + "Shortcode": "V10.4.2", + "Ordinal": 2, + "Description": "인가 서버가 인가 응답에서 인가 코드를 반환하는 경우, 해당 코드는 토큰 요청에 한번만 사용될 수 있어야 한다. 이미 액세스 토큰을 발급하는 데 사용된 인가 코드를 사용하여 두 번째 요청이 발생하면, 인가 서버는 토큰 요청을 거부하고 해당 인가 코드와 관련된 모든 발급된 토큰을 취소해야 한다.", + "L": "1" + }, + { + "Shortcode": "V10.4.3", + "Ordinal": 3, + "Description": "인가 코드가 단기간만 유효한지 검증해야 한다. 최대 수명은 L1 및 L2 애플리케이션의 경우 최대 10분, L3 애플리케이션의 경우 최대 1분 이내여야 한다.", + "L": "1" + }, + { + "Shortcode": "V10.4.4", + "Ordinal": 4, + "Description": "인가 서버는 특정 클라이언트에 대해, 해당 클라이언트가 사용할 필요가 있는 인가 방식(grant)만 사용하도록 허용해야 한다. token(암시적 플로우) 및 password(리소스 소유자 비밀번호 자격 증명 플로우) 방식은 더 이상 사용되어서는 안 된다.", + "L": "1" + }, + { + "Shortcode": "V10.4.5", + "Ordinal": 5, + "Description": "인가 서버가 공개 클라이언트에 대한 리프레시 토큰 재사용 공격을 완화하는지 검증해야 한다. 가급적이면 발신자 제약 리프레시 토큰, 즉 소유 증명이나 mTLS를 사용한 인증서 바인딩 액세스 토큰을 사용해야 한다. L1 및 L2 애플리케이션의 경우, 리프레시 토큰 회전(rotation)이 사용될 수 있다. 리프레시 토큰 회전이 사용되는 경우, 인가 서버는 리프레시 토큰을 사용 후 무효화해야 하며, 이미 사용되고 무효화된 리프레시 토큰이 제공되면 해당 인가에 대한 모든 리프레시 토큰을 철회(revoke)해야 한다.", + "L": "1" + }, + { + "Shortcode": "V10.4.6", + "Ordinal": 6, + "Description": "코드 인가 방식(code grant)이 사용되는 경우, 인가 서버가 PKCE를 요구하여 인가 코드 탈취 공격을 완화하는지 검증해야 한다. 인가 요청의 경우, 인가 서버는 유효한 'code_challenge' 값을 요구해야 하며, 'code_challenge_method'값으로 'plain'를 허용해서는 안 된다. 토큰 요청의 경우, 'code_verifier' 파라미터의 검증을 요구해야 한다.", + "L": "2" + }, + { + "Shortcode": "V10.4.7", + "Ordinal": 7, + "Description": "인가 서버가 인증되지 않은 동적 클라이언트 등록을 지원하는 경우, 악의적인 클라이언트 애플리케이션의 위험을 완화하는지 검증해야 한다. 등록된 URI와 같은 클라이언트 메타데이터를 검증하고, 사용자의 동의를 확인해야 하며, 신뢰할 수 없는 클라이언트 애플리케이션으로 인가 요청을 처리하기 전에 사용자에게 경고해야 한다.", + "L": "2" + }, + { + "Shortcode": "V10.4.8", + "Ordinal": 8, + "Description": "슬라이딩 리프레시 토큰 만료(expiration)가 적용되더라도, 리프레시 토큰에 절대 만료 시점(absolute expiration)이 포함되어 있는지 확인한다.", + "L": "2" + }, + { + "Shortcode": "V10.4.9", + "Ordinal": 9, + "Description": "악의적인 클라이언트 또는 도난된 토큰의 위험을 완화하기 위해 인가 서버 사용자 인터페이스를 통해 권한 있는 사용자가 리프레시 토큰 및 참조 액세스 토큰을 철회할 수 있는지 검증해야 한다.", + "L": "2" + }, + { + "Shortcode": "V10.4.10", + "Ordinal": 10, + "Description": "토큰 요청, 푸시된 인가 요청(Pushed Authorization Request; PAR), 토큰 철회 요청과 같은 클라이언트에서 인가 서버로의 백채널 요청(backchannel request)에 대해 기밀 클라이언트가 인증되는지 검증해야 한다.", + "L": "2" + }, + { + "Shortcode": "V10.4.11", + "Ordinal": 11, + "Description": "인가 서버 구성이 OAuth 클라이언트에 필요한 범위만 할당하는지 검증해야 한다.", + "L": "2" + }, + { + "Shortcode": "V10.4.12", + "Ordinal": 12, + "Description": "주어진 클라이언트에 대해 인가 서버가 해당 클라이언트가 사용해야 하는 'response_mode' 값만 허용하는지 검증해야 한다. 예를 들어, 인가 서버가 이 값을 예상 값과 비교하여 검증하거나, PAR 또는 JWT 기반 인가 요청(JWT-secured Authorization Request; JAR)을 사용하여 검증해야 한다.", + "L": "3" + }, + { + "Shortcode": "V10.4.13", + "Ordinal": 13, + "Description": "인가 유형 'code'가 항상 PAR과 함께 사용되는지 검증해야 한다.", + "L": "3" + }, + { + "Shortcode": "V10.4.14", + "Ordinal": 14, + "Description": "인가 서버가 mTLS를 사용하는 인증서 바인딩 액세스 토큰 또는 소유 증명 바인딩 액세스 토큰을 사용하여 발신자 제약(Proof-of-Possession) 액세스 토큰만 발급하는지 검증해야 한다.", + "L": "3" + }, + { + "Shortcode": "V10.4.15", + "Ordinal": 15, + "Description": "최종 사용자 장치에서 실행되지 않는 서버에서 동작하는 클라이언트의 경우, 인가 서버가 'authorization_details' 파라미터 값이 클라이언트 백엔드로부터 생성되었는지와 사용자가 해당 값을 변조되지 않았는지를 검증해야 한다. 예를 들어, PAR 또는 JAR의 사용을 요구하여 확인해야 한다.", + "L": "3" + }, + { + "Shortcode": "V10.4.16", + "Ordinal": 16, + "Description": "클라이언트가 기밀 클라이언트인지 검증하고, 인가 서버는 재사용 공격에 강하고 공개키 암호화에 기반한 강력한 클라이언트 인증 방식을 사용하도록 요구해야 한다. 예를 들어, mTLS(tls_client_auth, self_signed_tls_client_auth) 또는 비공개 키 기반 JWT 인증(private_key_jwt) 등이 이에 해당한다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V10.5", + "Ordinal": 5, + "Name": "OIDC 클라이언트", + "Items": [ + { + "Shortcode": "V10.5.1", + "Ordinal": 1, + "Description": "신뢰 당사자로서 클라이언트가 ID 토큰 재사용 공격을 완화하는지 검증해야 한다. 예를 들어, ID 토큰의 'nonce' 클레임이 OpenID 공급자에 전송된 인증 요청(OAuth2에서는 인가 서버에 전송된 인가 요청)에서 전송된 'nonce' 값과 일치하는지 확인해야 한다.", + "L": "2" + }, + { + "Shortcode": "V10.5.2", + "Ordinal": 2, + "Description": "클라이언트가 ID 토큰 클레임, 일반적으로 'sub' 클레임에서 사용자를 고유하게 식별하며, 해당 클레임이 ID 공급자 범위 내에서 다른 사용자에게 재할당될 수 없는지 검증해야 한다.", + "L": "2" + }, + { + "Shortcode": "V10.5.3", + "Ordinal": 3, + "Description": "클라이언트는 악의적인 인가 서버가 인가 서버 메타데이터를 통해 다른 인가 서버를 가장하려는 시도를 거부하는지 검증해야 한다. 클라이언트는 인가 서버 메타데이터에 포함된 발급자(issuer) URL이 클라이언트가 예상하는 사전 구성된 발급자 URL과 정확히 일치하지 않는 경우, 해당 메타데이터를 거부해야 한다.", + "L": "2" + }, + { + "Shortcode": "V10.5.4", + "Ordinal": 4, + "Description": "클라이언트는 토큰의 aud 클레임 값이 클라이언트의 client_id 값과 동일한지 확인하여 ID 토큰이 해당 클라이언트(audience)를 대상으로 발급되었음을 검증해야 한다.", + "L": "2" + }, + { + "Shortcode": "V10.5.5", + "Ordinal": 5, + "Description": "OIDC 백채널 로그아웃을 사용하는 경우, 신뢰 당사자는 강제 로그아웃을 통한 서비스 거부 공격(Denial of Service) 및 로그아웃 플로우에서의 JWT 혼동(cross-JWT confusion)을 완화하는지 검증해야 한다. 클라이언트는 로그아웃 토큰이 'logout+jwt' 값으로 올바르게 지정되어 있는지, 올바른 멤버 이름을 가진 'event' 클레임을 포함하는지, 그리고 'nonce' 클레임을 포함하지 않는지 검증해야 한다. 또한, 짧은 만료 시간(예: 2분)을 갖는 것이 권장된다.", + "L": "2" + } + ] + }, + { + "Shortcode": "V10.6", + "Ordinal": 6, + "Name": "OpenID 공급자", + "Items": [ + { + "Shortcode": "V10.6.1", + "Ordinal": 1, + "Description": "OpenID 공급자는 response_mode 파라미터 값으로'code', 'ciba', 'id_token' 또는 'id_token code' 만 허용하는지 검증해야 한다. 이 중 'id_token code'(OIDC 하이브리드 플로우)보다는 'code'가 선호되며, 'token'(모든 암시적 플로우)은 사용되어서는 안 된다.", + "L": "2" + }, + { + "Shortcode": "V10.6.2", + "Ordinal": 2, + "Description": "OpenID 공급자가 강제 로그아웃을 통한 서비스 거부 공격을 완화하는지 검증해야 한다. 신뢰 당사자로 부터 시작된 로그아웃 요청에 id_token_hint 등의 파라미터가 포함되어 있는 경우, 이를 검증하거나 최종 사용자로부터 명시적인 확인을 받아야 한다.", + "L": "2" + } + ] + }, + { + "Shortcode": "V10.7", + "Ordinal": 7, + "Name": "동의 관리", + "Items": [ + { + "Shortcode": "V10.7.1", + "Ordinal": 1, + "Description": "인가 서버가 사용자로부터 각 인가 요청에 대한 명시적인 동의(consent)를 확인하는지 검증해야 한다. 클라이언트의 신원을 보장할 수 없는 경우, 인가 서버는 항상 사용자에게 명시적으로 동의를 요청해야 한다.", + "L": "2" + }, + { + "Shortcode": "V10.7.2", + "Ordinal": 2, + "Description": "인가 서버가 사용자 동의를 요청할 때, 동의하는 내용에 대한 충분하고 명확한 정보를 제공하는지 검증해야 한다. 이에 해당하는 경우, 요청된 인가의 성격(일반적으로 범위, 리소스 서버, RAR(Rich Authorization Requests) 인가 세부 정보 기반), 인가된 애플리케이션의 신원, 인가의 유효 기간이 포함되어야 한다.", + "L": "2" + }, + { + "Shortcode": "V10.7.3", + "Ordinal": 3, + "Description": "사용자가 인가 서버를 통해 부여한 동의를 검토, 수정 및 철회할 수 있는지 검증해야 한다.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V11", + "Ordinal": 11, + "ShortName": "Cryptography", + "Name": "암호화", + "Items": [ + { + "Shortcode": "V11.1", + "Ordinal": 1, + "Name": "암호화 인벤토리 및 문서화", + "Items": [ + { + "Shortcode": "V11.1.1", + "Ordinal": 1, + "Description": "'NIST SP 800-57'과 같은 암호화 키 관리 및 키 관리 표준을 따르는 암호화 키 수명 주기에 대한 문서화 된 정책이 있는지 검증해야 한다. 여기에는 키가 과도하게 공유되지 않도록 하는 것이 포함된다(예: 공유 비밀의 경우 두 개를 초과하는 엔터티와 공유 및 개인 키의 경우 한 개를 초과하는 엔터티에 공유).", + "L": "2" + }, + { + "Shortcode": "V11.1.2", + "Ordinal": 2, + "Description": "애플리케이션에서 사용되는 모든 암호화 키, 알고리즘, 인증서를 포함한 암호화 자산 목록(cryptographic inventory)이 작성되고, 유지되며, 정기적으로 업데이트되고 있는지 검증해야 한다. 또한, 각 키가 시스템 내에서 사용 가능한 위치와 사용이 제한되는 위치, 해당 키로 보호할 수 있는 데이터 유형과 보호할 수 없는 데이터 유형이 문서화되어 있어야 한다.", + "L": "2" + }, + { + "Shortcode": "V11.1.3", + "Ordinal": 3, + "Description": "암호화, 해싱, 서명 작업을 포함하는 시스템 내의 모든 암호화 사용 사례를 식별하기 위해, 암호화 사용 탐지 메커니즘이 적용되는지 검증해야 한다.", + "L": "3" + }, + { + "Shortcode": "V11.1.4", + "Ordinal": 4, + "Description": "암호화 자산 목록이 유지 관리되는지 검증해야 한다. 여기에는 미래의 위협에 대응하기 위해 양자 내성 암호(Post-Quantum Cryptography; PQC)와 같은 새로운 암호화 표준으로의 마이그레이션 계획을 설명하는 문서화된 계획이 포함되어야 한다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.2", + "Ordinal": 2, + "Name": "안전한 암호화 구현", + "Items": [ + { + "Shortcode": "V11.2.1", + "Ordinal": 1, + "Description": "암호화 작업에 업계에서 검증된 구현(라이브러리 및 하드웨어 가속 구현 포함)이 사용되는지 검증해야 한다.", + "L": "2" + }, + { + "Shortcode": "V11.2.2", + "Ordinal": 2, + "Description": "난수, 인증 암호화, MAC, 해싱 알고리즘, 키 길이, 라운드, 암호 및 모드를 언제든지 재구성, 업그레이드 또는 교체하여 암호화 해독으로부터 보호할 수 있도록 애플리케이션이 암호화 유연성(crypto agility)을 갖추고 설계되었는지 검증해야 한다. 또한, 키와 비밀번호를 교체하고 데이터를 다시 암호화하는 것도 가능해야 한다. 이를 통해 승인된 PQC 체계(또는 표준)의 고신뢰 구현이 널리 사용 가능해지면 PQC로 원활하게 업그레이드할 수 있다.", + "L": "2" + }, + { + "Shortcode": "V11.2.3", + "Ordinal": 3, + "Description": "모든 암호화 기본 구성요소(primitive)가 알고리즘, 키 크기 및 구성에 따라 최소 128비트의 보안강도를 제공하는지 검증해야 한다. 예를 들어, 256비트 ECC 키는 대략 128비트의 보안을 제공하며, RSA는 128비트의 보안을 달성하기 위해 3072비트 키를 필요로 한다.", + "L": "2" + }, + { + "Shortcode": "V11.2.4", + "Ordinal": 4, + "Description": "민감한 정보가 누출되는 것을 방지하기 위해 모든 암호화 연산은 상수 시간(constant-time)으로 수행되어야 하며, 비교, 계산, 반환 과정에서 단락(short-circuit) 연산이 없는지 검증해야 한다.", + "L": "3" + }, + { + "Shortcode": "V11.2.5", + "Ordinal": 5, + "Description": "모든 암호화 모듈이 안전하게 실패하고, 패딩 오라클 공격(Padding Oracle attacks)과 같은 취약점을 허용하지 않는 방식으로 오류가 처리되는지 검증해야 한다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.3", + "Ordinal": 3, + "Name": "암호화 알고리즘", + "Items": [ + { + "Shortcode": "V11.3.1", + "Ordinal": 1, + "Description": "안전하지 않은 블록 모드(예: ECB) 및 약한 패딩 방식(예: PKCS#1 v1.5)가 사용되지 않는지 검증해야 한다.", + "L": "1" + }, + { + "Shortcode": "V11.3.2", + "Ordinal": 2, + "Description": "GCM을 사용하는 AES와 같이 승인된 암호 및 모드만 사용되는지 검증해야 한다.", + "L": "1" + }, + { + "Shortcode": "V11.3.3", + "Ordinal": 3, + "Description": "암호화 된 데이터가 승인된 인증된 암호화 방식을 사용하거나, 승인된 암호화 방식과 승인된 MAC 알고리즘을 조합을 통한 무단 수정으로부터 보호되는지 검증해야 한다.", + "L": "2" + }, + { + "Shortcode": "V11.3.4", + "Ordinal": 4, + "Description": "논스(nonces), 초기화 벡터 및 기타 단일 사용 번호가 둘 이상의 암호화 키 및 데이터 요소 쌍에 사용되지 않는지 검증해야 한다. 생성 방법은 사용되는 알고리즘에 적합해야 한다.", + "L": "3" + }, + { + "Shortcode": "V11.3.5", + "Ordinal": 5, + "Description": "암호화 알고리즘과 MAC 알고리즘의 모든 조합이 암호화 후 MAC(Encrypt-then-MAC) 방식으로 동작하는지 검증해야 한다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.4", + "Ordinal": 4, + "Name": "해싱 및 해시 기반 함수", + "Items": [ + { + "Shortcode": "V11.4.1", + "Ordinal": 1, + "Description": "디지털 서명, HMAC, KDF 및 무작위 비트 생성을 포함한 일반적인 암호화 사용 사례에 승인된 해시 함수만 사용되는지 검증해야 한다. MD5와 같이 허용되지 않는 해시 함수는 어떤 암호화 목적으로도 사용해서는 안 된다.", + "L": "1" + }, + { + "Shortcode": "V11.4.2", + "Ordinal": 2, + "Description": "비밀번호가 승인된 '계산 집약적인 키 유도 함수(\"비밀번호 해싱 함수\"라고도 함)'를 사용하여 저장되고, 파라미터 설정이 현재 지침에 따라 구성되었는지 검증해야 한다. 설정은 필요한 보안 수준에 대한 무차별 대입 공격을 충분히 어렵게 만들기 위해 보안과 성능의 균형을 이루어야 한다.", + "L": "2" + }, + { + "Shortcode": "V11.4.3", + "Ordinal": 3, + "Description": "데이터 인증 또는 데이터 무결성의 일부로 디지털 서명에 사용되는 해시 함수가 충돌 저항성을 가지며 적절한 비트 길이를 갖는지 검증해야 한다. 충돌 저항성이 필요한 경우, 출력 길이는 최소 256비트여야 한다. 제2 역상(pre-image) 공격 저항성만 필요한 경우, 출력 길이는 최소 128비트여야 한다.", + "L": "2" + }, + { + "Shortcode": "V11.4.4", + "Ordinal": 4, + "Description": "비밀번호로부터 비밀 키를 유도할 때 애플리케이션이 키 스트레칭(key stretching) 파라미터를 사용하여 승인된 키 유도 함수(key derivation function)를 사용하는지 검증해야 한다. 사용 중인 파라미터는 결과적인 암호화 키를 손상시키는 무차별 대입 공격을 방지하기 위해 보안과 성능의 균형을 이루어야 한다.", + "L": "2" + } + ] + }, + { + "Shortcode": "V11.5", + "Ordinal": 5, + "Name": "무작위 값", + "Items": [ + { + "Shortcode": "V11.5.1", + "Ordinal": 1, + "Description": "예측 불가능해야 하는 모든 난수 및 문자열이 암호학적으로 안전한 의사 난수 생성기(CSPRNG)를 사용하여 생성되고 최소 128비트의 엔트로피를 갖는지 검증해야 한다. UUID는 이 조건을 충족하지 않는다.", + "L": "2" + }, + { + "Shortcode": "V11.5.2", + "Ordinal": 2, + "Description": "사용 중인 난수 생성 메커니즘이 높은 부하(heavy demand)에서도 안전하게 작동하도록 설계되었는지 검증해야 한다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.6", + "Ordinal": 6, + "Name": "공개 키 암호화", + "Items": [ + { + "Shortcode": "V11.6.1", + "Ordinal": 1, + "Description": "키 생성 및 시딩, 디지털 서명 생성 및 검증에 승인된 암호화 알고리즘 및 작동 모드만 사용되는지 검증해야 한다. 키 생성 알고리즘은 알려진 공격에 취약한 안전하지 않은 키(예: 페르마 인수분해(Fermat factorization)에 취약한 RSA 키)를 생성해서는 안 된다.", + "L": "2" + }, + { + "Shortcode": "V11.6.2", + "Ordinal": 2, + "Description": "키 교환에는 디피-헬만과 같은 승인된 암호화 알고리즘이 사용되어야 하며, 안전한 파라미터를 사용하는지 여부를 중점적으로 검증해야 한다.이는 중간자 공격(adversary-in-the-middle attacks) 또는 암호화 해독으로 이어질 수 있는 키 설정 프로세스에 대한 공격을 방지할 것이다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.7", + "Ordinal": 7, + "Name": "사용 중 데이터 암호화", + "Items": [ + { + "Shortcode": "V11.7.1", + "Ordinal": 1, + "Description": "사용 중인 민감한 데이터를 보호하고 무단 사용자 또는 프로세스의 접근을 방지하기 위해 전체 메모리 암호화가 사용되는지 검증해야 한다.", + "L": "3" + }, + { + "Shortcode": "V11.7.2", + "Ordinal": 2, + "Description": "데이터 최소화가 처리 중에 노출되는 데이터의 양을 최소화하고, 사용 직후 또는 가능한 한 빨리 데이터가 암호화되도록 보장하는지 검증해야 한다.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V12", + "Ordinal": 12, + "ShortName": "Secure", + "Name": "보안 통신", + "Items": [ + { + "Shortcode": "V12.1", + "Ordinal": 1, + "Name": "일반 TLS 보안 가이드", + "Items": [ + { + "Shortcode": "V12.1.1", + "Ordinal": 1, + "Description": "TLS 1.2 및 TLS 1.3과 같은 최신 권장 버전의 TLS 프로토콜만 활성화되어 있으며, 그중 최신 버전이 우선되어야 한다.", + "L": "1" + }, + { + "Shortcode": "V12.1.2", + "Ordinal": 2, + "Description": "오직 권장되는 암호화 스위트(cipher suites)들이 활성화되어 있으며 그 중 가장 강력한 암호화 스위트로 우선 설정되어 있는지 확인한다. 레벨3 애플리케이션은 순방향 비밀성(forward secrecy)을 제공하는 암호화 스위트만 지원해야 한다.", + "L": "2" + }, + { + "Shortcode": "V12.1.3", + "Ordinal": 3, + "Description": "인증이나 권한 부여를 위해 인증서 ID를 사용하기 전에 애플리케이션이 mTLS 클라이언트 인증서가 신뢰할 수 있는지 검증해야 한다.", + "L": "2" + }, + { + "Shortcode": "V12.1.4", + "Ordinal": 4, + "Description": "Online Certificate Status Protocol (OCSP) 스테이플링(Stapling)과 같은 적절한 인증서 폐지 프로토콜이 활성화되고 설정되어 있는지 확인해야 한다.", + "L": "3" + }, + { + "Shortcode": "V12.1.5", + "Ordinal": 5, + "Description": "TLS 핸드셰이크 프로세스 중 Server Name Indication (SNI)과 같은 민감한 메타 데이터의 노출을 방지하기 위해 애플리케이션 TLS 설정에서 Encrypted Client Hello (ECH)가 활성화되어 있는지 확인해야 한다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V12.2", + "Ordinal": 2, + "Name": "외부 서비스와의 HTTPS 통신", + "Items": [ + { + "Shortcode": "V12.2.1", + "Ordinal": 1, + "Description": "TLS는 클라이언트와 외부 HTTP 기반 서비스 간의 모든 연결에 사용되며, 안전하지 않거나 암호화 되어 있지 않은 통신에 대체 동작(fall back)이 발생하지 않는지 확인해야한다. ", + "L": "1" + }, + { + "Shortcode": "V12.2.2", + "Ordinal": 2, + "Description": "외부 서비스가 공적으로 신뢰된 TLS 인증서를 사용하는지 확인해야 한다.", + "L": "1" + } + ] + }, + { + "Shortcode": "V12.3", + "Ordinal": 3, + "Name": "일반 서비스 간의 통신 보안", + "Items": [ + { + "Shortcode": "V12.3.1", + "Ordinal": 1, + "Description": "애플리케이션간의 모니터링 시스템, 관리 도구, 원격 엑세스 및 SSH, 미들웨어, 데이터베이스, 메인프레임, 파트너 시스템이나 외부 API를 포함한 모든 인바운드와 아웃바운드 통신은 TLS같은 암호화 프로토콜이 사용되는지 확인해야 한다. 이 서버는 안전하지 않거나 암호화 되어있지 않은 프로토콜에 대체 동작(fall back)이 발생하지 않아야 한다.", + "L": "2" + }, + { + "Shortcode": "V12.3.2", + "Ordinal": 2, + "Description": "TLS 클라이언트가 통신하기 전에 TLS서버로 부터 받은 인증서를 검증하는지 확인해야 한다.", + "L": "2" + }, + { + "Shortcode": "V12.3.3", + "Ordinal": 3, + "Description": "그리고 TLS 또는 애플리케이션 내의 내부 HTTP 기반 서비스간에 사용된 다른 적절한 전송 암호화 매커니즘이 안전하지 않거나 암호화 되어있지 않은 통신에 대체 동작(fall back)이 발생하지 않는지 확인해야 한다.", + "L": "2" + }, + { + "Shortcode": "V12.3.4", + "Ordinal": 4, + "Description": "내부 서버간에 TLS 통신이 신뢰된 인증서를 사용하는지 확인해야 한다. 내부 인증서나 자체 서명(self-signed)인증서를 사용할 경우, 이를 사용하는 서비스는 오직 특정 내부 인증기관(CA)과 자체 서명 인증만을 신뢰하게 설정해야 한다.", + "L": "2" + }, + { + "Shortcode": "V12.3.5", + "Ordinal": 5, + "Description": "시스템 내부에서 통신하는 서비스(intra-service communication)는 각 엔드포인트를 검증하기 위해 강력한 인증을 사용해야 한다. 공용키(public-key) 기반 구조와 재전송 공격(replay attacks)에 저항하는 매커니즘을 사용하여 신원보장을 위해 TLS 클라이언트 인증과 같은 강력한 인증 방식을 사용해야 한다. 마이크로서비스 아키텍쳐의 경우 인증서 관리를 간소화 하고 보안을 강화하기 위해 서비스 매시(service mesh)를 사용하는 것을 고려해야 한다.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V13", + "Ordinal": 13, + "ShortName": "Configuration", + "Name": "설정", + "Items": [ + { + "Shortcode": "V13.1", + "Ordinal": 1, + "Name": "설정 문서", + "Items": [ + { + "Shortcode": "V13.1.1", + "Ordinal": 1, + "Description": "애플리케이션의 모든 통신 요구사항이 문서화 되어 있는지를 검증한다. 이는 애플리케이션이 의존하는 외부 서비스나, 사용자가 애플리케이션이 연결할 외부 위치를 제공하는 경우들을 포함한다.", + "L": "2" + }, + { + "Shortcode": "V13.1.2", + "Ordinal": 2, + "Description": "애플리케이션이 사용하는 각각의 서비스들에 대해, 문서가 최대 동시 연결 수(연결 풀 제한)를 정의하고 있는지, 그리고 그 한계에 다다랐을 때 폴백(fallback)이나 복구 메커니즘 등을 포함하여, DoS 공격을 방지하기 위해 애플리케이션이 어떻게 동작하는지를 검증한다.", + "L": "3" + }, + { + "Shortcode": "V13.1.3", + "Ordinal": 3, + "Description": "애플리케이션 문서가 모든 외부 시스템이나 애플리케이션이 사용하는 서비스(예시: 데이터베이스, 파일 핸들, 스레드, HTTP 연결)들에 대한 자원-관리 전략을 정의하고 있는지 검증한다.이는 자원-해제 프로시저, 시간초과 설정, 오류 핸들링을 포함하며, 재시도 로직이 구현된 경우 재시도 제한과 지연, 백-오프 알고리즘을 명시해야 한다. 동기 HTTP 요청-응답 명령에 대해서는 짧은 타임아웃에 더해 재시도의 비활성화 혹은 연쇄적인 지연과 자원 고갈을 방지하기 위한 재시도의 엄격한 제한을 의무화해야 한다.", + "L": "3" + }, + { + "Shortcode": "V13.1.4", + "Ordinal": 4, + "Description": "애플리케이션 문서가 조직의 위협 모델과 사업적 요구사항에 기반하여, 애플리케이션의 보안과 비밀 정보들의 주기적 갱신 일정에 치명적인 비밀 정보들을 정의하고 있는지 검증한다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V13.2", + "Ordinal": 2, + "Name": "백엔드 통신 설정", + "Items": [ + { + "Shortcode": "V13.2.1", + "Ordinal": 1, + "Description": "API나 미들웨어와 같은 애플리케이션의 표준 사용자 세션 메커니즘을 지원하지 않는 백엔드 애플리케이션 컴포넌트와 데이터 계층 사이의 통신이 인증되어 있는지를 검증한다. 인증은 반드시 개별적인 서비스 계정과 단기간 토큰, 또는 인증서 기반 인증을 사용하고 비밀번호, API 키, 또는 접근 권한이 부여된 공유 계정 등의 자격 증명을 변경하지 않아선 안 된다. ", + "L": "2" + }, + { + "Shortcode": "V13.2.2", + "Ordinal": 2, + "Description": "로컬 또는 운영체제 서비스, API, 미들웨어, 그리고 데이터 계층을 포함한 백엔드 애플리케이션 컴포넌트 간의 통신이 최소 필요 권한이 할당된 계정들로 수행되는지 검증한다.", + "L": "2" + }, + { + "Shortcode": "V13.2.3", + "Ordinal": 3, + "Description": "만약 자격 증명이 서비스 인증을 위해 필요하다면, 소비자로부터 사용되는 그 자격 증명이 기본 자격 증명이 아님을 검증한다. (예시: root/root 또는 admin/admin)", + "L": "2" + }, + { + "Shortcode": "V13.2.4", + "Ordinal": 4, + "Description": "얼로우리스트가 애플리케이션의 통신이 허가된 외부 리소스나 시스템을 정의하기 위해 사용되는지 검증한다. (예시: 아웃바운드 요청, 데이터 로드, 파일 접근). 이 얼로우리스트는 애플리케이션 계층, 웹 서버, 방화벽 또는 다른 여러 계층의 조합으로 구현할 수 있다. ", + "L": "2" + }, + { + "Shortcode": "V13.2.5", + "Ordinal": 5, + "Description": "웹이나 애플리케이션 서버에 요청을 보내거나 데이터나 파일을 로드 할 수 있는 리소스 또는 시스템의 얼로우리스트가 설정되어 있는지를 검증한다.", + "L": "2" + }, + { + "Shortcode": "V13.2.6", + "Ordinal": 6, + "Description": "애플리케이션이 별도의 서비스와 연결할 때, 각 연결이 최대 병렬연결, 최대 연결 도달 시의 동작, 연결 타임아웃, 재시도 전략 등 문서화된 설정에 따르는지 검증한다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V13.3", + "Ordinal": 3, + "Name": "비밀 정보 관리", + "Items": [ + { + "Shortcode": "V13.3.1", + "Ordinal": 1, + "Description": "키 볼트와 같은 비밀 정보 관리 솔루션이 백엔드 비밀 정보들을 만들고 저장하고, 접근을 제어하고, 파기하기 위해 사용되고 있는지 검증한다. 이는 비밀번호, 키 재료, 데이터베이스와 서드 파티 시스템의 통합, 시간-기반 토큰을 위한 키와 시드, 그리고 API 키들을 포함할 수 있다. 비밀 정보들은 애플리케이션 소스 코드 내부나, 빌드 아티팩트에 포함되어서는 안 된다. L3 애플리케이션에 대해서는, 반드시 HSM과 같은 하드웨어 기반 솔루션을 사용해야 한다.", + "L": "2" + }, + { + "Shortcode": "V13.3.2", + "Ordinal": 2, + "Description": "비밀 정보 자원들에 대한 접근이 최소 권한의 원칙을 고수하는지 검증한다.", + "L": "2" + }, + { + "Shortcode": "V13.3.3", + "Ordinal": 3, + "Description": "보안 모듈에 대한 외부의 노출로부터 안전하게 키 재료를 관리하고 보호하기 위해 모든 암호 연산이 고립된 보안 모듈(볼트나, 하드웨어 보안 모듈 등)을 사용하여 수행되는지 검증한다.", + "L": "3" + }, + { + "Shortcode": "V13.3.4", + "Ordinal": 4, + "Description": "애플리케이션의 문서를 기반으로 비밀 정보들이 만료되고 갱신되도록 설정되었는지 검증한다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V13.4", + "Ordinal": 4, + "Name": "의도하지 않은 정보 노출", + "Items": [ + { + "Shortcode": "V13.4.1", + "Ordinal": 1, + "Description": "애플리케이션이 .git 이나 .svn 폴더 같은 소스 코드 관리 메타데이터 없이 배포되었는지, 또는 이 폴더들이 외부적으로든 애플리케이션 자체에서든 접근할 수 없도록 배포되었는지 검증한다. ", + "L": "1" + }, + { + "Shortcode": "V13.4.2", + "Ordinal": 2, + "Description": "실제 운영환경에서 디버깅 기능 노출이나 정보 누출을 방지하기 위해, 모든 컴포넌트에서 디버그 모드가 비활성화되어 있는지 검증한다.", + "L": "2" + }, + { + "Shortcode": "V13.4.3", + "Ordinal": 3, + "Description": "분명히 의도된 것이 아닌 이상 웹 서버가 폴더 목록을 클라이언트에게 노출하지 않는지 검증한다.", + "L": "2" + }, + { + "Shortcode": "V13.4.4", + "Ordinal": 4, + "Description": "잠재적인 정보 누출을 방지하기 위해 실제 운영환경에서 HTTP TRACE 메소드 사용이 지원되지 않는지 검증한다. ", + "L": "2" + }, + { + "Shortcode": "V13.4.5", + "Ordinal": 5, + "Description": "분명히 의도된 것이 아닌 이상 문서(내부 API 같은)와 모니터링 엔드포인트가 노출되지 않는지 검증한다.", + "L": "2" + }, + { + "Shortcode": "V13.4.6", + "Ordinal": 6, + "Description": "애플리케이션이 백엔드 컴포넌트의 자세한 버전 정보를 노출하지 않는지 검증한다.", + "L": "3" + }, + { + "Shortcode": "V13.4.7", + "Ordinal": 7, + "Description": "웹 계층이 의도적이지 않은 정보, 설정, 소스코드 누출을 방지하기 위해 특정 파일 확장자만 서비스하도록 설정되었는지 검증한다.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V14", + "Ordinal": 14, + "ShortName": "Data", + "Name": "데이터 보호", + "Items": [ + { + "Shortcode": "V14.1", + "Ordinal": 1, + "Name": "데이터 보호 문서화", + "Items": [ + { + "Shortcode": "V14.1.1", + "Ordinal": 1, + "Description": "애플리케이션이 생성하고 처리하는 모든 민감한 데이터가 식별되고 보호 수준으로 분류되었는지 확인한다. 여기에는 단순히 인코딩되어 있고 쉽게 디코딩할 수 있는 데이터, 예를 들어 Base64 문자열이나 JWT 내부 평문 페이로드가 포함된다. 보호 수준은 애플리케이션이 준수해야 하는 모든 데이터 보호 및 개인정보 보호 관련 규정과 표준을 반드시 고려해야 한다.", + "L": "2" + }, + { + "Shortcode": "V14.1.2", + "Ordinal": 2, + "Description": "모든 민감한 데이터의 보호 수준에 대해 문서화된 요구사항이 있는지 확인한다. 반드시 여기에는(이에 한정되지 않지만) 일반적인 암호화, 무결성 검증, 보존 기간, 데이터 로그 기록 방식, 로그 내 민감한 데이터에 대한 접근 제어, 데이터베이스 암호화 수준, 사용할 개인정보 보호 및 개인정보 보호 강화 기술, 그리고 기타 기밀성 요구사항들 관련하여 포함되어야 한다.", + "L": "2" + } + ] + }, + { + "Shortcode": "V14.2", + "Ordinal": 2, + "Name": "일반 데이터 보호", + "Items": [ + { + "Shortcode": "V14.2.1", + "Ordinal": 1, + "Description": "민감한 데이터는 HTTP 메시지 본문이나 헤더 필드로만 서버에 전송되고, URL과 쿼리 문자열에는 API키나 세션토큰처럼 민감한 정보가 포함되지 않도록 검증한다.", + "L": "1" + }, + { + "Shortcode": "V14.2.2", + "Ordinal": 2, + "Description": "서버 구성 요소에서 로드밸런서나 애플리케이션 캐시와 같은 민감한 데이터가 캐시되지 않게 하거나, 사용 후 해당 데이터를 안전하게 삭제하도록 검증한다.", + "L": "2" + }, + { + "Shortcode": "V14.2.3", + "Ordinal": 3, + "Description": "정의된 민감한 데이터가 애플리케이션의 통제를 벗어난 곳에서 원치 않는 수집을 예방하기 위해 신뢰할 수 없는 대상(예: 사용자 추적기)에게 전송되지 않도록 검증한다.", + "L": "2" + }, + { + "Shortcode": "V14.2.4", + "Ordinal": 4, + "Description": "암호화, 무결성 검증, 보존, 데이터 로그 기록 방식, 로그 내 민감한 데이터 접근 제어, 개인정보 보호 및 개인정보 보호 강화 기술과 관련된 민감한 데이터 통제가, 해당 데이터 보호 수준에 대한 문서에 정의된 대로 구현되었는지 검증한다.", + "L": "2" + }, + { + "Shortcode": "V14.2.5", + "Ordinal": 5, + "Description": "캐시 메커니즘이 해당 리소스에 대해 예상되는 콘텐츠 유형을 가진 응답만 캐시하고, 민감하거나 동적인 콘텐츠는 캐시하지 않도록 구성되어 있는지 검증한다. 존재하지 않는 파일에 접근했을 때 다른 유효한 파일을 반환하는 대신 웹 서버는 404 또는 302 응답을 반환해야 한다. 이는 Web Cache Deception 공격을 예방한다.", + "L": "3" + }, + { + "Shortcode": "V14.2.6", + "Ordinal": 6, + "Description": "애플리케이션 기능에 필요한 최소한의 민감한 데이터만 반환을 검증한다. 예를 들어, 전체 신용카드 번호가 아닌 일부 숫자만 반환해야 한다. 만약 전체 데이터가 필요한 경우, 사용자가 구체적으로 조회하지 않는 한 사용자 인터페이스에서는 마스킹하는 것이 권장된다.", + "L": "3" + }, + { + "Shortcode": "V14.2.7", + "Ordinal": 7, + "Description": "민감한 정보는 데이터 보존 분류 기준에 따라 관리되어야 하고, 오래되었거나 불필요한 데이터는 사전에 정의된 작업 또는 상황에 따라 자동으로 삭제되도록 검증한다.", + "L": "3" + }, + { + "Shortcode": "V14.2.8", + "Ordinal": 8, + "Description": "사용자가 제출한 파일의 메타데이터에서 사용자가 저장에 동의하지 않는 한 민감한 정보는 제거를 검증한다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V14.3", + "Ordinal": 3, + "Name": "클라이언트 측 데이터 보호", + "Items": [ + { + "Shortcode": "V14.3.1", + "Ordinal": 1, + "Description": "클라이언트나 세션이 종료된 후에 브라우저 DOM과 같은 클라이언트 스토리지에서 인증된 데이터를 삭제되는지 검증한다. 이를 위해 ‘Clear-Site-Data’ HTTP 응답 헤더 필드를 사용할 수 있으나, 세션 종료 시 서버 연결이 불가능한 경우에도 클라이언트 측에서 해당 데이터를 삭제하는 것이 권장된다.", + "L": "1" + }, + { + "Shortcode": "V14.3.2", + "Ordinal": 2, + "Description": "애플리케이션이 브라우저에서 민감한 데이터가 캐시되지 않도록, (Cache-Control: no-store)충분한 캐시 방지 HTTP 응답 헤더 필드를 설정을 검증한다.", + "L": "2" + }, + { + "Shortcode": "V14.3.3", + "Ordinal": 3, + "Description": "브라우저 저장소(localStorage, sessionStorage, IndexedDB, 쿠키)에 저장되는 데이터에는 세션 토큰을 제외한 민감 데이터가 포함되지 않도록 검증한다.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V15", + "Ordinal": 15, + "ShortName": "Secure", + "Name": "보안 코딩 및 아키텍처", + "Items": [ + { + "Shortcode": "V15.1", + "Ordinal": 1, + "Name": "보안 코딩 및 아키텍처 문서화", + "Items": [ + { + "Shortcode": "V15.1.1", + "Ordinal": 1, + "Description": "애플리케이션 문서에 취약점이 존재하는 서드파티 구성요소 버전 및 일반적인 라이브러리 업데이트에 대해, 해당 구성요소로부터 발생할 수 있는 위험을 최소화하기 위한 위험 기반 대응 기한이 정의되어 있는지 확인해야 한다.", + "L": "1" + }, + { + "Shortcode": "V15.1.2", + "Ordinal": 2, + "Description": "사용 중인 모든 서드파티 라이브러리에 대해 소프트웨어 자재 명세서(SBOM)와 같은 인벤토리가 유지되고 있으며, 해당 구성요소가 사전에 정의된 신뢰할 수 있고 지속적으로 관리되는 저장소에서 제공되는지 확인해야 한다.", + "L": "2" + }, + { + "Shortcode": "V15.1.3", + "Ordinal": 3, + "Description": "애플리케이션 문서에 시간 소모가 크거나 리소스 소비가 많은 기능이 식별되어 있으며, 해당 기능의 과도한 사용으로 인해 가용성이 손실되지 않도록 하는 방법과, 응답 생성이 소비자의 타임아웃보다 오래 걸리는 상황을 방지하는 방법이 포함되어 있는지 확인해야 한다. 가능한 방어 전략에는 비동기 처리, 큐(queue) 사용, 사용자 및 애플리케이션 단위의 병렬 처리 제한 등이 있다.", + "L": "2" + }, + { + "Shortcode": "V15.1.4", + "Ordinal": 4, + "Description": "애플리케이션 문서에 위험한 구성요소로 간주되는 서드파티 라이브러리가 강조되어 있는지 확인해야 한다.", + "L": "3" + }, + { + "Shortcode": "V15.1.5", + "Ordinal": 5, + "Description": "애플리케이션 문서에 위험한 기능을 사용하는 애플리케이션의 부분이 강조되어 있는지 확인해야 한다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V15.2", + "Ordinal": 2, + "Name": "보안 아키텍처 및 종속성", + "Items": [ + { + "Shortcode": "V15.2.1", + "Ordinal": 1, + "Description": "애플리케이션이 문서화된 업데이트 및 대응 기한을 위반하지 않은 구성요소만 포함하고 있는지 확인해야 한다.", + "L": "1" + }, + { + "Shortcode": "V15.2.2", + "Ordinal": 2, + "Description": "애플리케이션이 시간 소모가 크거나 리소스 소비가 많은 기능의 과도한 사용으로 인한 가용성 손실을 방지하기 위해, 해당 기능에 대한 문서화된 보안 결정 및 전략을 기반으로 방어 조치를 구현하고 있는지 확인해야 한다.", + "L": "2" + }, + { + "Shortcode": "V15.2.3", + "Ordinal": 3, + "Description": "운영 환경에 애플리케이션 기능 수행에 필요한 기능만 포함되어 있으며, 테스트 코드, 샘플 코드, 개발용 기능 등 불필요한 기능이 노출되지 않도록 구성되어 있는지 확인해야 한다.", + "L": "2" + }, + { + "Shortcode": "V15.2.4", + "Ordinal": 4, + "Description": "서드파티 구성요소 및 그 모든 전이 종속성(transitive dependencies)이 내부 또는 외부의 예상된 저장소에서 가져며, 의존성 혼동(dependency confusion) 공격의 위험이 없는지 확인해야 한다.", + "L": "3" + }, + { + "Shortcode": "V15.2.5", + "Ordinal": 5, + "Description": "애플리케이션이 위험한 기능을 포함하거나 위험한 구성요소를 사용하는 부분에 대해 샌드박싱, 캡슐화, 컨테이너화, 네트워크 수준 격리와 같은 추가적인 보호 기법을 구현하여, 애플리케이션의 한 부분이 침해되더라도 공격자가 다른 영역으로 확산하지 못하도록 지연 및 차단하고 있는지 확인해야 한다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V15.3", + "Ordinal": 3, + "Name": "방어적(Defensive) 코딩", + "Items": [ + { + "Shortcode": "V15.3.1", + "Ordinal": 1, + "Description": "애플리케이션이 데이터 객체에서 필요한 필드만 선택적으로 반환하고 있는지 확인해야 한다. 예를 들어, 일부 필드는 사용자에게 노출되어서는 안 되므로 전체 데이터 객체를 반환해서는 안 된다.", + "L": "1" + }, + { + "Shortcode": "V15.3.2", + "Ordinal": 2, + "Description": "애플리케이션 백엔드에서 외부 URL로 요청을 보낼 때, 의도된 기능이 아닌 경우 리디렉션을 따르지 않도록 구성되어 있는지 확인해야 한다.", + "L": "2" + }, + { + "Shortcode": "V15.3.3", + "Ordinal": 3, + "Description": "애플리케이션이 각 컨트롤러 및 액션 단위로 허용된 필드를 제한함으로써, 대량 할당(mass assignment) 공격에 대한 방어가 구현되어 있는지 확인해야 한다. 예를 들어, 특정 동작에 포함되지 않은 필드 값을 삽입하거나 수정할 수 없어야 한다.", + "L": "2" + }, + { + "Shortcode": "V15.3.4", + "Ordinal": 4, + "Description": "모든 프록시 및 미들웨어 구성요소가 사용자의 원래 IP 주소를 신뢰 가능한 데이터 필드를 통해 정확하게 전달하고 있으며, 애플리케이션과 웹 서버가 이 값을 로그 기록이나 속도 제한(rate limiting)과 같은 보안 결정에 사용하는지 확인해야 한다. 단, 동적 IP, VPN, 방화벽 등으로 인해 원래 IP조차 완전히 신뢰할 수 없는 점도 고려해야 한다.", + "L": "2" + }, + { + "Shortcode": "V15.3.5", + "Ordinal": 5, + "Description": "애플리케이션이 변수의 타입이 올바른지 명시적으로 확인하고, 엄격한 동등성 비교 및 연산자를 사용하여 타입 혼용(type juggling) 또는 타입 혼동(type confusion)으로 인한 취약점을 방지하고 있는지 확인해야 한다.", + "L": "2" + }, + { + "Shortcode": "V15.3.6", + "Ordinal": 6, + "Description": "JavaScript 코드가 프로토타입 오염(prototype pollution)을 방지할 수 있도록 작성되어 있는지 확인해야 한다. 예를 들어, 객체 리터럴 대신 `Set()` 또는 `Map()`을 사용하는 방식이 권장된다.", + "L": "2" + }, + { + "Shortcode": "V15.3.7", + "Ordinal": 7, + "Description": "애플리케이션이 HTTP 파라미터 오염(HTTP parameter pollution) 공격에 대한 방어를 구현하고 있는지 확인해야 한다. 특히, 애플리케이션 프레임워크가 요청 파라미터의 출처(쿼리 스트링, 본문, 쿠키, 헤더)를 구분하지 않는 경우 이를 고려해야 한다.", + "L": "2" + } + ] + }, + { + "Shortcode": "V15.4", + "Ordinal": 4, + "Name": "안전한 동시성", + "Items": [ + { + "Shortcode": "V15.4.1", + "Ordinal": 1, + "Description": "다중 스레드 코드에서 캐시, 파일, 다수 스레드가 접근하는 메모리 내 객체 등 공유 객체에 접근할 때, 스레드 세이프(thread-safe) 타입과 락·세마포어 같은 동기화 메커니즘을 사용하여 경쟁 상태와 데이터 손상을 피하고 안전하게 접근하는지 확인해야 한다.", + "L": "3" + }, + { + "Shortcode": "V15.4.2", + "Ordinal": 2, + "Description": "리소스의 존재 여부나 권한과 같은 상태 검사와, 그 검사 결과에 의존하는 동작이 단일(atomic) 연산으로 수행되어 TOCTOU 경쟁 상태를 방지하는지 확인해야 한다. (예: 파일을 열기 전에 존재 여부를 확인하는 작업과 파일 열기 동작을 분리하지 않기, 접근 권한 검증과 권한 부여를 동일 트랜잭션/원자적 구간에서 수행하기)", + "L": "3" + }, + { + "Shortcode": "V15.4.3", + "Ordinal": 3, + "Description": "스레드가 서로를 기다리거나 무한 재시도에 빠지지 않도록 일관된 락 사용을 보장하고, 락 관리 로직을 리소스 관리 책임 코드 내부에 유지하여 외부 클래스 및 코드가 우발적·악의적으로 락을 변경하지 못하도록 하는지 확인해야 한다.", + "L": "3" + }, + { + "Shortcode": "V15.4.4", + "Ordinal": 4, + "Description": "**스레드 풀** 활용 등 **리소스 할당 정책**을 통해 공정한 리소스 접근을 보장하고, 우선순위가 낮은 스레드도 합리적 시간 내 진행될 수 있게 하여 **스레드 기아**를 방지하는지 확인해야 한다.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V16", + "Ordinal": 16, + "ShortName": "Security", + "Name": "보안 로깅과 오류 처리", + "Items": [ + { + "Shortcode": "V16.1", + "Ordinal": 1, + "Name": "보안 로깅 문서화", + "Items": [ + { + "Shortcode": "V16.1.1", + "Ordinal": 1, + "Description": "애플리케이션의 기술 스택의 각 계층에서 수행된 로깅에 대해, 어떤 이벤트들이 로그로 남았는지, 로그의 형식이 무엇인지, 로그가 어디에 저장되었는지, 어떻게 사용되는지, 로그에 대한 접근이 어떻게 제어되는지, 그리고 로그가 얼마나 보관되는지에 대해 문서화한 목록이 존재하는지 검증한다.", + "L": "2" + } + ] + }, + { + "Shortcode": "V16.2", + "Ordinal": 2, + "Name": "일반 로깅", + "Items": [ + { + "Shortcode": "V16.2.1", + "Ordinal": 1, + "Description": "이벤트가 발생했을 때 그 타임라인을 자세히 조사할 수 있도록 각 로그의 항목이 필수적인 메타데이터(언제, 어디서, 누가, 무엇을 등)을 포함하는지 검증한다. ", + "L": "2" + }, + { + "Shortcode": "V16.2.2", + "Ordinal": 2, + "Description": "모든 로깅 컴포넌트의 시간 소스가 동기화되어 있는지, 그리고 보안 이벤트 메타데이터에서 타임스탬프가 UTC를 사용하거나 혹은 명시적인 시간대 오프셋을 포함하는지 검증한다. UTC는 분산 시스템 전체에 걸친 일관성을 보장하고, 일광 절약 시간제 전환 시의 혼란을 방지하기 위해 추천된다.", + "L": "2" + }, + { + "Shortcode": "V16.2.3", + "Ordinal": 3, + "Description": "애플리케이션이 로그를 저장만 하는지, 혹은 로그 목록에서 문서화 된 파일이나 서비스로 브로드캐스트하는지 검증한다.", + "L": "2" + }, + { + "Shortcode": "V16.2.4", + "Ordinal": 4, + "Description": "사용 중인 로그 처리기가 로그를 읽고, 또 상호 연관 지을 수 있는지 검증한다. 가능하다면 공통 로깅 형식을 사용하는 것이 좋다.", + "L": "2" + }, + { + "Shortcode": "V16.2.5", + "Ordinal": 5, + "Description": "민감한 데이터를 로깅할때, 애플리케이션이 데이터의 보호 수준을 기반으로 로깅을 수행하는지 검증한다. 예를 들어, 자격 증명이나, 지불 상세 정보 등의 특정 데이터는 로깅 해서는 안 된다. 또한 세션 토큰 등의 데이터는 전체 혹은 일부분이 해싱된, 마스킹 된 상태로 로깅 되어야 한다.", + "L": "2" + } + ] + }, + { + "Shortcode": "V16.3", + "Ordinal": 3, + "Name": "보안 이벤트", + "Items": [ + { + "Shortcode": "V16.3.1", + "Ordinal": 1, + "Description": "성공한 시도와 실패한 시도를 포함하여 모든 인증 명령을 로깅 하는지 검증한다. 인증의 종류나, 사용한 인증 요소 등의 추가적인 메타데이터 또한 수집해야 한다.", + "L": "2" + }, + { + "Shortcode": "V16.3.2", + "Ordinal": 2, + "Description": "실패한 인가 시도들도 로깅 하는지 검증한다. L3에 대해서는 반드시 민감한 데이터가 접근되었을 때를 포함하여(민감한 데이터 자체는 제외하고) 모든 인가 결정들의 로그를 포함해야 한다.", + "L": "2" + }, + { + "Shortcode": "V16.3.3", + "Ordinal": 3, + "Description": "애플리케이션이 이 문서에서 정의한 보안 이벤트들을 로깅하고, 또한 입력값 확인, 비즈니스 로직, 그리고 자동화 방지 등의 보안 제어를 우회하려는 시도들도 로깅 하는지 검증한다.", + "L": "2" + }, + { + "Shortcode": "V16.3.4", + "Ordinal": 4, + "Description": "애플리케이션이 백엔드 TLS 오류와 같은 예상치 못한 오류나 보안 제어 오류들을 로깅 하는지 검증한다.", + "L": "2" + } + ] + }, + { + "Shortcode": "V16.4", + "Ordinal": 4, + "Name": "로그 보호", + "Items": [ + { + "Shortcode": "V16.4.1", + "Ordinal": 1, + "Description": "로그 삽입을 방지하기 위해 모든 로깅 컴포넌트가 적절히 데이터를 인코딩하는지 검증한다.", + "L": "2" + }, + { + "Shortcode": "V16.4.2", + "Ordinal": 2, + "Description": "로그가 비인가된 접근으로부터 보호되고 수정할 수 없는지 검증한다.", + "L": "2" + }, + { + "Shortcode": "V16.4.3", + "Ordinal": 3, + "Description": "분석, 탐지, 경보, 그리고 에스컬레이션(escalation)을 위해 로그가 논리적으로 분리된 시스템으로 안전하게 전송되는지 검증한다. 애플리케이션이 침해되더라도 로그는 훼손하지 못하도록 보장하는 것이 목적이다.", + "L": "2" + } + ] + }, + { + "Shortcode": "V16.5", + "Ordinal": 5, + "Name": "오류 처리", + "Items": [ + { + "Shortcode": "V16.5.1", + "Ordinal": 1, + "Description": "예상치 못한 혹은 보안 측면에서 민감한 오류가 발생했을 때 스택 흔적, 쿼리, 비밀키, 그리고 토큰 등의 민감한 내부 시스템 데이터의 노출 방지를 보장하기 위해 유저에게 구체화하지 않은 메시지를 반환하는지 검증한다.", + "L": "2" + }, + { + "Shortcode": "V16.5.2", + "Ordinal": 2, + "Description": "외부 리소스 접근 오류가 발생하더라도 애플리케이션이 계속해서 안전하게 작동하는지 검증한다. 예를 들어 서킷 브레이커(circuit breaker)나 우아한 성능 저하와 같은 패턴을 사용할 수 있다.", + "L": "2" + }, + { + "Shortcode": "V16.5.3", + "Ordinal": 3, + "Description": "예외가 발생할 때, 검증 로직의 오류에도 불구하고 거래를 처리하는 등의 페일-오픈(fail-open) 상태 방지를 포함하여 애플리케이션이 우아하고 안전하게 실패하는지 검증한다. ", + "L": "2" + }, + { + "Shortcode": "V16.5.4", + "Ordinal": 4, + "Description": "처리되지 못한 모든 예외를 처리할 “최후의 수단” 오류 핸들러가 정의되어 있는지 검증한다. 이는 로그 파일에 기록되어야 하는 오류 상세 정보들의 손실을 피하기 위함과 동시에, 오류로 인해 전체 애플리케이션 프로세스가 종료되어 가용성 손실로 이어지지 않도록 보장하기 위함이다. ", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V17", + "Ordinal": 17, + "ShortName": "WebRTC", + "Name": "WebRTC", + "Items": [ + { + "Shortcode": "V17.1", + "Ordinal": 1, + "Name": "TURN 서버", + "Items": [ + { + "Shortcode": "V17.1.1", + "Ordinal": 1, + "Description": "Traversal Using Relays around NAT(TURN) 서비스가 특정 목적을 위해 보존된 주소(예: 내부 네트워크, 브로드캐스트, 루프백)를 제외한 주소에 대해서만 접근을 허용하도록 한다.", + "L": "2" + }, + { + "Shortcode": "V17.1.2", + "Ordinal": 2, + "Description": "Traversal Using Relays around NAT(TURN) 서비스가 정당한 사용자의 TURN 서버 포트의 대량 개방 시 자원고갈에 취약하지 않도록 한다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V17.2", + "Ordinal": 2, + "Name": "미디어", + "Items": [ + { + "Shortcode": "V17.2.1", + "Ordinal": 1, + "Description": "데이터그램 전송 계층 보안(DTLS) 인증서의 키가 암호화 키 관리에 대한 문서화된 정책에 따라 관리되고 보호되는지 확인해야 한다.", + "L": "2" + }, + { + "Shortcode": "V17.2.2", + "Ordinal": 2, + "Description": "미디어 서버가 승인된 데이터그램 전송 계층 보안(DTLS) 암호 모음을 사용하고 지원하도록 구성되었는지, 그리고 보안 실시간 전송 프로토콜(DTLS-SRTP)을 위한 키 생성에 사용되는 DTLS 확장을 위한 안전한 보호 프로파일을 구성했는지 확인해야 한다.", + "L": "2" + }, + { + "Shortcode": "V17.2.3", + "Ordinal": 3, + "Description": "미디어 서버에서 보안 실시간 전송 프로토콜(SRTP) 인증이 선택되어 있는지 확인한다. 이를 통해 실시간 전송 프로토콜(RTP) 삽입 공격으로 인한 서비스 거부 상태 발생 또는 오디오/비디오 미디어가 미디어 스트림에 삽입되는 것을 방지할 수 있다.", + "L": "2" + }, + { + "Shortcode": "V17.2.4", + "Ordinal": 4, + "Description": "미디어 서버가 잘못된 형식의 보안 실시간 전송 프로토콜(SRTP) 패킷을 접했을 때도 수신 미디어 트래픽 처리를 계속할 수 있는지 확인해야 한다.", + "L": "2" + }, + { + "Shortcode": "V17.2.5", + "Ordinal": 5, + "Description": "미디어 서버가 정상 사용자로부터의 보안 실시간 전송 프로토콜(SRTP) 패킷이 대량으로 유입되는 상황에서도 수신 미디어 트래픽 처리를 계속할 수 있는지 확인해야 한다.", + "L": "3" + }, + { + "Shortcode": "V17.2.6", + "Ordinal": 6, + "Description": "미디어 서버가 Datagram Transport Layer Security(DTLS)의 “ClientHello” 경합 조건 취약점에 노출되지 않았는지 확인해야 한다. 이를 위해 해당 미디어 서버가 공개적으로 취약한 것으로 알려져 있는지 확인하거나 경합 조건 테스트를 수행해야 한다.", + "L": "3" + }, + { + "Shortcode": "V17.2.7", + "Ordinal": 7, + "Description": "미디어 서버와 연결된 모든 오디오 또는 비디오 녹화 장치가 합법적인 사용자로부터의 보안 실시간 전송 프로토콜(SRTP) 패킷이 대량으로 유입되는 상황에서도 수신 미디어 트래픽 처리를 계속할 수 있는지 확인해야 한다.", + "L": "3" + }, + { + "Shortcode": "V17.2.8", + "Ordinal": 8, + "Description": "데이터그램 전송 계층 보안(DTLS) 인증서가 세션 설명 프로토콜(SDP) 지문 속성과 대조되어 검증되었는지 확인하고, 검증이 실패할 경우 미디어 스트림을 종료하여 미디어 스트림의 진위성을 보장해야 한다.", + "L": "3" + } + ] + }, + { + "Shortcode": "V17.3", + "Ordinal": 3, + "Name": "신호 처리", + "Items": [ + { + "Shortcode": "V17.3.1", + "Ordinal": 1, + "Description": "신호 서버가 플러드 공격 중에도 합법적인 수신 신호 메시지 처리를 계속할 수 있는지 확인해야 한다. 이는 신호 수준에서 속도 제한을 구현함으로써 달성되어야 한다.", + "L": "2" + }, + { + "Shortcode": "V17.3.2", + "Ordinal": 2, + "Description": "서비스 거부 상태를 유발할 수 있는 잘못된 형식의 신호 메시지를 접했을 때 신호 서버가 정상적인 신호 메시지 처리를 계속할 수 있는지 확인해야 한다. 여기에는 입력 검증 구현, 정수 오버플로우 안전 처리, 버퍼 오버플로우 방지 및 기타 강력한 오류 처리 기법 적용이 포함될 수 있다.", + "L": "2" + } + ] + } + ] + } + ] +} diff --git a/5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.legacy.csv b/5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.legacy.csv new file mode 100644 index 0000000000..c450549841 --- /dev/null +++ b/5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.legacy.csv @@ -0,0 +1,347 @@ +chapter_id,chapter_name,section_id,section_name,req_id,req_description,level1,level2,level3,cwe,nist +V1,인코딩과 데이터 정제,V1.1,인코딩 및 데이터 정제 아키텍처,V1.1.1,"입력값 검증은 오직 한 번만 표준 형태로 디코딩 되거나 언이스케이프 되어야 하며, 인코딩된 데이터가 예상될 때만 디코딩 되어야 한다. 이 과정은 입력이 추가로 처리되기 전에 완료되어야 한다. 예를 들어서 입력값 검증이나 데이터 정제 이후에는 수행되면 안 된다.",,✓,✓,, +V1,인코딩과 데이터 정제,V1.1,인코딩 및 데이터 정제 아키텍처,V1.1.2,애플리케이션이 출력값 인코딩 또는 이스케이핑을 인터프리터가 사용하기 전의 최종 단계로 수행하거나 인터프리터 자체에서 처리하는지 검증해야 한다.,,✓,✓,, +V1,인코딩과 데이터 정제,V1.2,인젝션(Injection) 방지,V1.2.1,"HTTP 응답, HTML 문서 또는 XML 문서에 대한 출력값 인코딩이 해당 컨텍스트에 적절한지 검증해야 한다. 예를 들어, 메시지나 문서 구조가 변경되지 않도록 HTML 요소, HTML 속성, HTML 주석, CSS, HTTP 헤더 필드 등에 맞는 문맥별 문자 인코딩이 수행되어야 한다.",✓,✓,✓,, +V1,인코딩과 데이터 정제,V1.2,인젝션(Injection) 방지,V1.2.2,"통합 자원 식별자(Uniform Resource Locator; URL)들을 동적으로 생성할 때 신뢰할 수 없는 데이터가 해당 컨텍스트에 맞게 인코딩되었는지 검증해야 한다(예: 쿼리나 경로 파라미터에 대한 URL 인코딩 또는 base64url 인코딩). 또한, 오직 안전한 URL 프로토콜만이 허용되는지 검증해야 한다(예: javascript: 또는 data:를 허용하지 않음).",✓,✓,✓,, +V1,인코딩과 데이터 정제,V1.2,인젝션(Injection) 방지,V1.2.3,동적으로 자바스크립트 콘텐츠(JSON 포함)를 생성할 때 메시지나 문서 구조를 바꾸는 것을 방지하기 위해 출력값 인코딩이나 이스케이핑이 사용되고 있는지 검증해야 한다(자바스크립트 또는 JSON 인젝션을 피하기 위함).,✓,✓,✓,, +V1,인코딩과 데이터 정제,V1.2,인젝션(Injection) 방지,V1.2.4,"데이터 선택 혹은 데이터베이스 쿼리(예: SQL, HQL, NoSQL, Cypher)들 파라미터화된 쿼리, 객체 관계 매핑(Object Relational Mapping; ORM), 엔티티 프레임워크, 또는 다른 구조화된 쿼리 언어(Structured Query Language; SQL) 인젝션 및 기타 데이터베이스 인젝션 공격으로부터 보호해 주는 것들을 사용하는지 검증해야 한다. 이는 저장 프로시저를 쓸 때도 마찬가지이다.",✓,✓,✓,, +V1,인코딩과 데이터 정제,V1.2,인젝션(Injection) 방지,V1.2.5,애플리케이션이 운영체제(Operating System; OS) 명령 인젝션으로부터 보호되며 운영체제 호출 시 파라미터화된 OS 쿼리나 상황에 맞는 명령줄 출력값 인코딩을 사용하는지 검증해야 한다.,✓,✓,✓,, +V1,인코딩과 데이터 정제,V1.2,인젝션(Injection) 방지,V1.2.6,"애플리케이션이 경량 디렉터리 접근 프로토콜(Lightweight Directory Access Protocol; LDAP) 인젝션 취약점에 대해 보호되어 있는지, 또는 LDAP 인젝션을 방지하기 위한 특정 보안 통제가 구현되어 있는지 검증해야 한다.",,✓,✓,, +V1,인코딩과 데이터 정제,V1.2,인젝션(Injection) 방지,V1.2.7,애플리케이션이 XPath 인젝션 공격을 쿼리 파라미터나 미리 컴파일된 쿼리들을 사용해 보호되고 있는지 검증해야 한다.,,✓,✓,, +V1,인코딩과 데이터 정제,V1.2,인젝션(Injection) 방지,V1.2.8,"LaTeX 프로세서가 안전하게 구성되어 있으며(""--shell-escape"" 플래그 비사용 등) LaTeX 인젝션 공격을 방지하기 위해 허용된 명령어 목록이 사용되고 있는지 검증해야 한다.",,✓,✓,, +V1,인코딩과 데이터 정제,V1.2,인젝션(Injection) 방지,V1.2.9,애플리케이션이 정규 표현식에서 특수 문자들을 메타 문자로 잘못 해석하는 것을 방지하기 위해 해당 문자들 이스케이프(보통 백슬래시를 사용)하고 있는지 검증해야 한다.,,✓,✓,, +V1,인코딩과 데이터 정제,V1.2,인젝션(Injection) 방지,V1.2.10,"애플리케이션이 쉼표 구분 데이터(Comma Separated Values; CSV) 및 수식 인젝션에 대해 보호되어 있는지 검증해야 한다. 그리고 애플리케이션은 CSV 콘텐츠를 내보낼 때 RFC 4180 2.6과 2.7 부분에 명시된 이스케이핑 규칙을 반드시 따라야 한다. 또한 CSV나 다른 스프레드시트 포맷(XLS, XLSX, ODF 등)으로 내보낼 때 필드 값의 첫 번째가 특수 문자('=', '+', '-', '@', '\t' (탭), '\0' (null 문자) 포함)라면 반드시 작은따옴표로 이스케이프되어야 한다.",,,✓,, +V1,인코딩과 데이터 정제,V1.3,데이터 정제,V1.3.1,위지윅(WYSIWYG) 에디터나 이와 유사한 것으로부터 오는 모든 신뢰할 수 없는 HTML 입력들은 잘 알려지고 안전한 HTML 데이터 정제 라이브러리나 프레임워크 기능을 사용해 정제되는지 검증해야 한다.,✓,✓,✓,, +V1,인코딩과 데이터 정제,V1.3,데이터 정제,V1.3.2,"애플리케이션이 eval() 또는 스프링 표현 언어(Spring Expression Language; SpEL) 등과 같은 동적 코드 실행 기능 사용을 피하고 있는지 검증해야 한다. 대안이 없는 경우, 실행 전에 포함되는 모든 사용자 입력이 반드시 정제되어야 한다.",✓,✓,✓,, +V1,인코딩과 데이터 정제,V1.3,데이터 정제,V1.3.3,잠재적으로 위험한 컨텍스트에 전달되는 데이터가 사전에 정제되어 안전 조치가 적용되는지 검증해야 한다. 예를 들어 해당 컨텍스트에서 안전한 문자만 허용하고 너무 긴 입력값은 잘라내는 등의 조치가 포함된다.,,✓,✓,, +V1,인코딩과 데이터 정제,V1.3,데이터 정제,V1.3.4,사용자로부터 제공된 확장 가능한 벡터 그래픽(Scalable Vector Graphics; SVG)의 스크립트 실행 가능 콘텐츠가 애플리케이션에 안전한 태그 및 속성(예: 그래픽 그리기)만 포함하도록 검증 또는 정제되는지 검증해야 한다. 예를 들어 스크립트나 foreignObject는 포함되면 안 된다.,,✓,✓,, +V1,인코딩과 데이터 정제,V1.3,데이터 정제,V1.3.5,"애플리케이션이 사용자로부터 제공된 스크립트 실행 가능하거나 표현식 템플릿 언어(예: 마크다운, CSS, XSL 스타일시트, BBCode ) 콘텐츠를 정제하거나 비활성화하는지 검증해야 한다.",,✓,✓,, +V1,인코딩과 데이터 정제,V1.3,데이터 정제,V1.3.6,"애플리케이션이 서버측 요청 위조(Server-side Request Forgery; SSRF) 공격으로부터 보호하기 위해 신뢰할 수 없는 데이터를 프로토콜, 도메인, 경로, 포트의 허용 목록과 대조해 검증하고 다른 서비스를 호출하기 전에 잠재적으로 위험한 문자를 정제(sanitization)하는지 검증해야 한다.",,✓,✓,, +V1,인코딩과 데이터 정제,V1.3,데이터 정제,V1.3.7,애플리케이션이 템플릿 인젝션 공격으로부터 보호하기 위해 신뢰할 수 없는 입력값을 기반으로 템플릿을 생성하지 않도록 하는지 검증해야 한다. 대안이 없는 경우에는 템플릿 생성 과정에서 동적으로 포함되는 모든 신뢰할 수 없는 입력값은 정제되거나 엄격히 검증되어야 한다.,,✓,✓,, +V1,인코딩과 데이터 정제,V1.3,데이터 정제,V1.3.8,애플리케이션이 자바 명명 및 디렉터리 인터페이스(Java Naming and Directory Interface; JNDI) 쿼리에서 신뢰할 수 없는 입력값을 사용하기 전에 적절히 정제하고 JNDI가 JNDI 인젝션 공격을 방지할 수 있도록 안전하게 구성되어 있는지 검증해야 한다.,,✓,✓,, +V1,인코딩과 데이터 정제,V1.3,데이터 정제,V1.3.9,인젝션을 방지하기 위해 애플리케이션이 메모리 캐시(memcache)에 콘텐츠를 전달하기 전에 해당 데이터를 정제하는지 검증해야 한다. ,,✓,✓,, +V1,인코딩과 데이터 정제,V1.3,데이터 정제,V1.3.10,사용 시 예상치 못하거나 악의적인 방식으로 작동할 수 있는 포맷 스트링(format string)들은 처리되기 전에 정제되는지 검증해야 한다.,,✓,✓,, +V1,인코딩과 데이터 정제,V1.3,데이터 정제,V1.3.11,간이 전자 우편 전송 프로토콜(Simple Mail Transfer Protocol; SMTP)이나 인터넷 메시지 액세스 프로토콜(Internet Message Access Protocol; IMAP) 인젝션으로부터 보호하기 위해 애플리케이션이 사용자 입력을 메일 시스템으로 보내기 전에 정제를 하는지 검증해야 한다.,,✓,✓,, +V1,인코딩과 데이터 정제,V1.3,데이터 정제,V1.3.12,"정규 표현식에 지수형 백트래킹을 유발하는 요소가 없는지, 또한 신뢰할 수 없는 입력값을 정제하여 정규식 기반 서비스 거부 공격(Regular Expression Denial of Service; ReDoS) 또는 런어웨이(Runaway) 정규식 공격을 방지하는지 검증해야 한다.",,,✓,, +V1,인코딩과 데이터 정제,V1.4,"메모리, 스트링, 비관리 코드",V1.4.1,"애플리케이션이 스택, 버퍼, 또는 힙 오버플로를 탐지하거나 방지하기 위해 메모리 안전 문자열, 안전한 메모리 복사 및 포인터 산술을 사용하는지 검증해야 한다.",,✓,✓,, +V1,인코딩과 데이터 정제,V1.4,"메모리, 스트링, 비관리 코드",V1.4.2,"정수 오버플로를 방지하기 위해 부호 확인, 범위 검사, 입력값 검증 등의 기법이 사용되고 있는지 검증해야 한다.",,✓,✓,, +V1,인코딩과 데이터 정제,V1.4,"메모리, 스트링, 비관리 코드",V1.4.3,댕글링 포인터(dangling pointer)나 해체 후 사용(Use After Free; UAF) 취약점을 방지하기 위해 동적으로 할당된 메모리와 자원이 적절히 해제되었는지 그리고 해제된 메모리를 참조하는 포인터나 참조가 제거되었거나 null로 설정되었는지를 검증해야 한다.,,✓,✓,, +V1,인코딩과 데이터 정제,V1.5,안전한 역직렬화,V1.5.1,애플리케이션이 확장 가능한 마크업 언어(eXtensible Markup Language; XML) 파서(parser)를 제한적인 설정으로 구성하고 외부 엔티티 해석과 같은 안전하지 않은 기능을 비활성화하여 XML 외부 엔티티(XML eXternal Entity; XXE) 공격을 방지하는지 검증해야 한다.,✓,✓,✓,, +V1,인코딩과 데이터 정제,V1.5,안전한 역직렬화,V1.5.2,역직렬화 공격을 방지하기 위해 신뢰할 수 없는 데이터의 역직렬화 시 객체 타입 허용 목록 사용 또는 클라이언트 정의 객체 타입 제한과 같은 안전한 입력 처리 방식이 적용되는지 검증해야 한다. 또한 명확히 안전하지 않은 것으로 지정된 역직렬화 메커니즘은 신뢰할 수 없는 입력에 대해 반드시 사용해서는 안 된다.,,✓,✓,, +V1,인코딩과 데이터 정제,V1.5,안전한 역직렬화,V1.5.3,"애플리케이션에서 동일한 데이터 타입(예: JSON 파서, XML 파서, URL 파서)에 대해 사용되는 서로 다른 파서들이 일관된 방식으로 파싱(parsing)을 수행하고 동일한 문자 인코딩 방식을 사용하는지 검증해야 한다. 이를 통해 JSON 상호운용 취약점이나 원격 파일 포함(Remote File Inclusion; RFI) 및 SSRF 공격에서 악용될 수 있는 서로 다른 URI 또는 파일 파싱 동작 문제를 방지할 수 있다.",,,✓,, +V2,유효성 검증 및 비즈니스 로직,V2.1,유효성 검증 및 비즈니스 로직 문서화,V2.1.1,"애플리케이션 문서에 데이터 항목이 예상되는 구조에 부합하는지 확인하는 입력값 유효성 검증 규칙이 정의되어 있는지 확인한다. 이는 신용카드 번호, 이메일 주소, 전화번호와 같은 일반적인 데이터 형식일 수도 있고, 내부적으로 사용하는 데이터 형식일 수도 있다.",✓,✓,✓,, +V2,유효성 검증 및 비즈니스 로직,V2.1,유효성 검증 및 비즈니스 로직 문서화,V2.1.2,"애플리케이션 문서에 연관된 데이터 항목들 간의 논리적, 문맥적 일관성을 검증하는 방법이 정의되어 있는지 검증한다. 예를 들어서 세부 주소와 우편번호가 서로 일치하는지 확인하는 경우가 이에 해당한다.",,✓,✓,, +V2,유효성 검증 및 비즈니스 로직,V2.1,유효성 검증 및 비즈니스 로직 문서화,V2.1.3,비즈니스 로직의 제한사항 및 유효성 검증에 대한 요구사항이 사용자별 기준과 애플리케이션 전체에 적용되는 전역적 기준을 모두 포함하여 문서화되어 있는지 검증한다.,,✓,✓,, +V2,유효성 검증 및 비즈니스 로직,V2.2,입력값 검증,V2.2.1,"입력값에 대한 비즈니스 또는 기능적인 기대치를 충족하기 위해서 입력값의 유효성을 검증해야 한다. 이는 허용 값, 패턴 및 범위 목록에 대한 긍정적 검증을 사용하거나, 미리 정의된 규칙에 따라 입력값을 예상 구조 및 논리적 한계와 비교하여 검증해야 한다. L1의 경우, 특정 비즈니스 또는 보안 결정을 내리는 데 초점을 맞출 수 있다. L2 이상의 경우에는 모든 입력값에 적용해야 한다.",✓,✓,✓,, +V2,유효성 검증 및 비즈니스 로직,V2.2,입력값 검증,V2.2.2,"애플리케이션이 신뢰할 수 있는 서비스 계층에서 입력값 유효성 검사를 시행하도록 설계되었는지 확인해야 한다. 클라이언트 측 유효성 검사는 사용성을 향상시키므로 권장해야 하지만, 보안 제어 수단으로 의존해서는 안된다.",✓,✓,✓,, +V2,유효성 검증 및 비즈니스 로직,V2.2,입력값 검증,V2.2.3,사전 정의된 규칙에 따라 관련 데이터 항목의 조합이 합리적인지 애플리케이션에서 확인해야 한다.,,✓,✓,, +V2,유효성 검증 및 비즈니스 로직,V2.3,비즈니스 로직 보안,V2.3.1,애플리케이션이 예상되는 순차적 단계 순서에 따라 동일한 사용자에 대한 비즈니스 로직 흐름만 처리하고 단계를 건너뛰지 않는지 확인한다.,✓,✓,✓,, +V2,유효성 검증 및 비즈니스 로직,V2.3,비즈니스 로직 보안,V2.3.2,비즈니스 로직 결함이 악용되는 것을 방지하기 위해서 애플리케이션 문서에 따라 비즈니스 로직 제한이 구현되었는지 확인한다.,,✓,✓,, +V2,유효성 검증 및 비즈니스 로직,V2.3,비즈니스 로직 보안,V2.3.3,비즈니스 로직 수준에서 트랜잭션이 사용되고 있는지 확인하여 비즈니스 로직 작업이 완전히 성공하거나 이전의 올바른 상태로 롤백되는지 확인한다.,,✓,✓,, +V2,유효성 검증 및 비즈니스 로직,V2.3,비즈니스 로직 보안,V2.3.4,제한된 양의 리소스(ex. 극장 좌석이나 배송 시간대)가 애플리케이션의 로직을 조작하여 이중으로 예약되는 것을 방지하기 위해서 비즈니스 로직 수준 잠금 메커니즘이 사용되는지 확인한다.,,✓,✓,, +V2,유효성 검증 및 비즈니스 로직,V2.3,비즈니스 로직 보안,V2.3.5,"핵심적인 비즈니스 로직 흐름에 무단 또는 우발적인 행위를 방지하기 위해서 다중 사용자 승인이 필요한지 확인해야 한다. 이는 거액 자금 이체, 계약 승인, 기밀 정보 접근, 제조 과정의 안전 무시 등이 포함될 수 있지만, 이에 국한되지는 않는다.",,,✓,, +V2,유효성 검증 및 비즈니스 로직,V2.4,자동화 방지,V2.4.1,"데이터 유출, 더미 데이터 생성, 할당량 소진, 속도 제한 위반, 서비스 거부(DoS), 핵심적인 리소스의 과다 사용으로 이어질 수 있는 애플리케이션 기능에 대한 과도한 호출을 방어하기 위해, 자동화 방지 제어 기능이 구현되어 있는지 검증한다.",,✓,✓,, +V2,유효성 검증 및 비즈니스 로직,V2.4,자동화 방지,V2.4.2,"비즈니스 로직의 각 단계가 실제 사람이 수행하는 데 필요한 현실적인 시간을 요구하여, 비정상적으로 빠른 속도의 트랜잭션 제출을 방지하는지 검증한다.",,,✓,, +V3,웹 프론트엔드 보안,V3.1,웹 프론트엔드 보안 문서,V3.1.1,"애플리케이션 공식 문서에서 애플리케이션이 반드시 지원해야 하는, 예상되는 보안 특징들을 서술하고 있는지 확인한다. (예: HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP), 그리고 다른 관련된 HTTP 보안 메커니즘들). 또한 문서에서 앞선 특징들(유저에게나 경고하거나 접속을 막는 등의)이 유효하지 않을 때 애플리케이션이 어떻게 행동하는지 반드시 정의해야 한다.",,,✓,, +V3,웹 프론트엔드 보안,V3.2,의도하지 않은 콘텐츠 접근,V3.2.1,"브라우저가 HTTP 응답에 대해 콘텐츠나 기능을 불러올 때, 의도하지 않은 상황이 보안적으로 통제되고 있는지 확인한다(예: API, 유저가 올린 파일, 혹은 다른 리소스에 직접 접근 시). Content-Security-Policy 헤더 필드의 샌드박스 지시어를 사용하거나, Content-Disposition 헤더 필드 내의 attachment disposition 타입을 사용하는 등으로, 불필요한 HTTP 요청 헤더 필드 (Sec-Fetch-* 와 같은)를 제공하지 않을 수 있다.",✓,✓,✓,, +V3,웹 프론트엔드 보안,V3.2,의도하지 않은 콘텐츠 접근,V3.2.2,"콘텐츠가 HTML로 렌더링되지 않고 텍스트로 표시되도록 하여, HTML이나 JavaScript 등의 의도하지 않은 실행을 방지하는 안전한 렌더링 함수(예: createTextNode, textContent)를 사용하는지 확인한다.",✓,✓,✓,, +V3,웹 프론트엔드 보안,V3.2,의도하지 않은 콘텐츠 접근,V3.2.3,"애플리케이션이 클라이언트 사이드 JavaScript를 사용할 때, 명시적 변수 사용, 엄격한 타입 검사, 문서에서의 전역 변수 저장 지양, 그리고 네임스페이스 격리 구현 등으로 DOM 클로버링을 막고 있음을 확인한다.",,,✓,, +V3,웹 프론트엔드 보안,V3.3,쿠키 설정,V3.3.1,"쿠키가 'Secure' 속성을 가지며, 쿠키 이름에 '\__Host-' 접두사가 사용되지 않았고, '__Secure-' 접두사를 사용했는지 확인한다.",✓,✓,✓,, +V3,웹 프론트엔드 보안,V3.3,쿠키 설정,V3.3.2,"UI redress 공격, 그리고 CSRF라 알려진 브라우저 기반 요청 위조 공격들에 대한 노출을 제한하기 위해 각 쿠키의 'SameSite' 속성 값이 쿠키의 목적에 맞게 설정되어 있는지 확인한다.",,✓,✓,, +V3,웹 프론트엔드 보안,V3.3,쿠키 설정,V3.3.3,"다른 호스트들과 명시적으로 공유되는 쿠키에 대해서, '__Host-' 접두사를 가지고 있는지 확인한다.",,✓,✓,, +V3,웹 프론트엔드 보안,V3.3,쿠키 설정,V3.3.4,"클라이언트 측 스크립트에서 쿠키의 값에 접근이 가능한 걸 의도하지 않았다면(세션 토큰 등), 쿠키는 반드시 'HttpOnly' 속성을 가져야 하고, 반드시 'Set-Cookie' 헤더 필드를 통해 클라이언트에게 전달돼야 한다.",,✓,✓,, +V3,웹 프론트엔드 보안,V3.3,쿠키 설정,V3.3.5,"애플리케이션이 쿠키를 만들 때, 쿠키 이름과 값의 길이 합이 4096바이트를 넘지 않는지 확인한다. 너무 큰 쿠키는 브라우저에 저장되지 않으며, 요청 전달도 안되고, 해당 쿠키에 의존하는 애플리케이션 기능을 사용하지 못하게 된다.",,,✓,, +V3,웹 프론트엔드 보안,V3.4,브라우저 보안 메커니즘 헤더,V3.4.1,"이 섹션에서는 애플리케이션의 응답을 처리할 때 브라우저의 보안 기능과, 제한 사항을 활성화하기 위해 HTTP 응답에 설정해야 하는 보안 헤더를 설명한다.",✓,✓,✓,, +V3,웹 프론트엔드 보안,V3.4,브라우저 보안 메커니즘 헤더,V3.4.2,"교차 출처 리소스 공유(CORS)의 Access-Control-Allow-Origin 헤더 필드가 애플리케이션의 고정 값인지 확인한다. 만약 출처 Origin HTTP 요청 헤더 필드 값을 사용하고 있다면, 신뢰할 수 있는 출처 목록으로 검증한다. 'Access-Control-Allow-Origin: *' 사용이 필요할 때엔, 응답이 민감한 정보를 포함하지 않는지 확인한다.",✓,✓,✓,, +V3,웹 프론트엔드 보안,V3.4,브라우저 보안 메커니즘 헤더,V3.4.3,"HTTP 응답이 Content-Security-Policy 응답 헤더 필드를 가지고 있는지 확인한다. 이는 브라우저가 신뢰하는 콘텐츠나 리소스만 불러오고 실행하도록 하고, 위험한 JavaScript의 실행을 제한한다. 최소한, object-src 'none' 과 base-uri 'none'이라는 지침, 그리고 허용 목록을 정의하거나 논스, 해쉬의 사용을 포함한다는 전역 정책은 반드시 사용돼야 한다. 3계층 애플리케이션의 경우에는, 논스나 해쉬가 적용된 응답별 정책이 반드시 정의돼야 한다.",,✓,✓,, +V3,웹 프론트엔드 보안,V3.4,브라우저 보안 메커니즘 헤더,V3.4.4,"모든 HTTP 응답이 'X-Content-Type-Options: nosniff' 헤더 필드를 포함하는지 확인해야 한다. 이는 브라우저들이 주어진 응답에 대해 콘텐츠 스니핑과 MIME 타입 추측을 하지 않도록, 응답의 Content-Type 헤더 필드 값을 목적지 리소스와 일치하도록 지시한다. 예를 들어서, 응답의 Content-Type이 'text/css'인 스타일만 허용된다고 치자. 이는 기능적으로 브라우저의 Cross-Origin Read Blocking (CORB) 사용 또한 활성화시킨다.",,✓,✓,, +V3,웹 프론트엔드 보안,V3.4,브라우저 보안 메커니즘 헤더,V3.4.5,"'Referer' HTTP 요청 헤더 필드를 통해 제 3자 서비스들에 기술적으로 민감한 정보 누출을 막기 위해, 애플리케이션에서 리퍼러 정책을 설정했는지 확인해야 한다. 이는 Referrer-Policy HTTP 응답 헤더 필드나 HTML 속성 항목을 통해 설정할 수 있다. 민감한 데이터는 URL에 있는 경로나 쿼리 데이터, 그리고 내부 비공개 애플리케이션의 경우 hostname도 포함된다.",,✓,✓,, +V3,웹 프론트엔드 보안,V3.4,브라우저 보안 메커니즘 헤더,V3.4.6,"웹 애플리케이션이 Content-Security-Policy 헤더 필드의 frame-ancestors를 사용해 모든 HTTP 응답들에 대해 기본적으로 내부 삽입을 할 수 없고, 필요할 때만 특정 리소스에 대해 내부 삽입을 허용하도록 확인한다. X-Frame-Options 헤더 필드가 브라우저에서 지원되더라도, 오래돼서 신뢰할 수 없음을 알아야 한다.",,✓,✓,, +V3,웹 프론트엔드 보안,V3.4,브라우저 보안 메커니즘 헤더,V3.4.7,Content-Security-Policy 헤더 필드에 위반 사항을 보고할 영역이 특정되어 있는지 확인해야 한다.,,,✓,, +V3,웹 프론트엔드 보안,V3.4,브라우저 보안 메커니즘 헤더,V3.4.8,문서 렌더링을 시작하는 모든 HTTP 요청(Content-Type text/html과 같은 응답)에 same-origin 지시어나 same-origin-allow-popups이 있는 Cross‑Origin‑Opener‑Policy 헤더 필드를 포함하는지 확인해야 한다. 이는 탭내빙(tabnabbing) 및 프레임 카운팅과 같은 Window 객체에 대한 공유 액세스를 악용하는 공격을 방지할 수 있다.,,,✓,, +V3,웹 프론트엔드 보안,V3.5,브라우저 출처 구분,V3.5.1,"애플리케이션이 허용되지 않은 교차 출처 요청을 통한 민감한 기능의 사용을 막기 위해 CORS preflight 메커니즘에 의존하지 않는지 확인하고, 이런 요청이 애플리케이션 자체에서 시작된건지 증명해야 한다. 이는 anti-forgery 토큰의 사용과 증명이나 CORS-safelisted 요청 헤더 필드가 아닌 확장 HTTP 헤더 필드를 요구하는 것으로 가능하다. 사이트 간 요청 위조 공격(CSRF)으로 알려진 브라우저 기반의 요청 위조 공격에 대한 방어다.",✓,✓,✓,, +V3,웹 프론트엔드 보안,V3.5,브라우저 출처 구분,V3.5.2,"애플리케이션이 민감한 기능의 허용되지 않은 교차 출처 사용을 막기 위해 CORS preflight 메커니즘에 의존하고 있다면, CORS preflight 요청을 작동하지 않는 요청을 호출할 수 있는지 확인해야 한다. 이는 'Origin'과 'Content-Type' 요청 헤더 필드 값을 확인하거나 CORS-safelisted 헤더 필드가 아닌 확장 필드 사용에 대한 확인이 필요하다.",✓,✓,✓,, +V3,웹 프론트엔드 보안,V3.5,브라우저 출처 구분,V3.5.3,"민감한 기능이 HTTP 요청으로 POST, PUT, PATCH, DELETE와 같은 적절한 HTTP 방식을 사용하는지, HEAD, OPTIONS, 또는 GET처럼 HTTP 사양이 ""안전""으로 정의되지 않는 방식을 사용하는지 확인한다. 또는 Sec-Fetch-* 요청 헤더 필드의 엄격한 검증을 사용하여 요청이 부적절한 교차 출처 호출, 탐색 요청 또는 이미지 소스와 같은 리소스 로드에서 발생하지 않았는지 확인할 수 있다.",✓,✓,✓,, +V3,웹 프론트엔드 보안,V3.5,브라우저 출처 구분,V3.5.4,서로 다른 호스트 이름에 별도의 애플리케이션이 호스팅되어 있는지 확인하여 동일한 출처 정책에서 제공하는 제한 사항을 활용한다. 여기에는 한 출처에서 불러온 문서나 스크립트가 다른 출처의 리소스와 상호 작용할 수 있는 방법과 쿠키에서의 호스트 이름 기반 제한 사항이 포함된다.,,✓,✓,, +V3,웹 프론트엔드 보안,V3.5,브라우저 출처 구분,V3.5.5,"postMessage 인터페이스를 통해 수신한 메시지의 출처를 신뢰할 수 없거나, 구문이 유효하지 않은 경우, 수신한 메시지가 폐기되는지 확인한다.",,✓,✓,, +V3,웹 프론트엔드 보안,V3.5,브라우저 출처 구분,V3.5.6,"Cross-Site Script Inclusion (XSSI) 공격을 피하기 위해, 애플리케이션 아무 곳에서나 JSONP 기능이 활성화되지 않는지 확인한다.",,,✓,, +V3,웹 프론트엔드 보안,V3.5,브라우저 출처 구분,V3.5.7,Cross-Site Script Inclusion (XSSI) 공격을 방지하기 위해 JavaScript 파일과 같은 스크립트 리소스 응답에 승인이 필요한 데이터가 포함되지 않았는지 확인한다.,,,✓,, +V3,웹 프론트엔드 보안,V3.5,브라우저 출처 구분,V3.5.8,"인증된 리소스(예: 이미지, 비디오, 스크립트 및 기타 문서)가 의도된 경우에만 사용자를 대신하여 불러와지거나 내장될 수 있는지 확인한다. 이는 Sec-Fetch-* HTTP 요청 헤더 필드를 엄격하게 검증하여 요청이 부적절한 교차 출처 호출에서 발생하지 않았는지 확인하거나 브라우저에 반환된 콘텐츠를 차단하도록 지시하는 제한적인 교차 출처 리소스 정책 HTTP 응답 헤더 필드를 설정하여 달성할 수 있다.",,,✓,, +V3,웹 프론트엔드 보안,V3.6,외부 리소스 무결성,V3.6.1,"클라이언트 측 자산(예: JavaScript 라이브러리, CSS 또는 웹 폰트)이 정적이고 버전이 지정된 경우에만 외부(예: 콘텐츠 전송 네트워크)로만 호스팅되는지 확인하고, 하위 리소스 무결성(SRI)을 사용하여 자산의 무결성을 검증한다. 이것이 불가능하다면 각 리소스에 대해 이를 정당화하기 위해 문서화된 보안 결정이 필요하다.",,,✓,, +V3,웹 프론트엔드 보안,V3.7,다른 브라우저 보안 고려사항,V3.7.1,"애플리케이션이 여전히 지원되고 안전하다고 간주되는 클라이언트 측 기술만 사용하는지 확인한다. 이 요구 사항을 충족하지 않는 기술의 예로는 NSAPI 플러그인, Flash, Shockwave, ActiveX, Silverlight, NACL 또는 클라이언트 측 Java applets가 있다.",,✓,✓,, +V3,웹 프론트엔드 보안,V3.7,다른 브라우저 보안 고려사항,V3.7.2,"애플리케이션이 사용자를 통제하지 못하는 다른 호스트 이름이나 도메인으로 자동으로 리다이렉션할 때, 허용된 목적지로만 리다이렉션 하는지 확인한다.",,✓,✓,, +V3,웹 프론트엔드 보안,V3.7,다른 브라우저 보안 고려사항,V3.7.3,사용자가 애플리케이션의 통제 범위를 벗어난 URL로 리다이렉션 될 때 이를 취소할 수 있는 옵션이 있는 알림이 애플리케이션에 표시되는지 확인한다.,,,✓,, +V3,웹 프론트엔드 보안,V3.7,다른 브라우저 보안 고려사항,V3.7.4,애플리케이션의 최상위 도메인(예: site.tld)가 공공 HSTS preload 목록에 추가되었는지 확인한다. 이렇게 하면 애플리케이션에 TLS를 사용하는 것이 Strict-Transport-Security 응답 헤더 필드에만 의존하지 않고 메인 브라우저에 직접 내장된다.,,,✓,, +V3,웹 프론트엔드 보안,V3.7,다른 브라우저 보안 고려사항,V3.7.5,"애플리케이션에 접근하는 브라우저가 예상한 보안 특징을 가지고 있지 않은 경우, 애플리케이션이 문서에 명시된 대로 동작하는지 확인한다 (유저에게 경고하거나 접근을 차단하는 등).",,,✓,, +V4,API 와 WEB 서비스,V4.1,일반적인 웹 서비스 보안,V4.1.1,"메세지 본문이 포함된 모든 HTTP 응답에는 실제 내용과 일치하는 Content-Type 헤더 필드가 포함되어 있는지 검증한다. 이때 IANA 미디어 타입(text, /+xml, /xml 등)에 따라 안전한 문자 인코딩 (ex. UTF-8, ISO-8859-1)을 지정하는 charset 파라미터도 포함되어야 한다.",✓,✓,✓,, +V4,API 와 WEB 서비스,V4.1,일반적인 웹 서비스 보안,V4.1.2,"사용자가 대면하는 엔드포인트(사람이 직접 웹 브라우저에 접속하는 경우)만 HTTP에서 HTTPS로 자동 리디렉션하고, 그 외에 서비스나 API 엔드포인트는 명백한 리디렉션을 구현하지 않았는지 검증한다. 이는 클라이언트가 실수로 암호화되지 않은 HTTP 요청을 보내고 있음에도, 요청이 자동으로 HTTPS로 리디렉션되어 민감한 데이터의 유출 사실을 발견하지 못하게 되는 상황을 방지하기 위함이다.",,✓,✓,, +V4,API 와 WEB 서비스,V4.1,일반적인 웹 서비스 보안,V4.1.3,"로드 밸런서, 웹 프록시, 백엔드-프론트엔드 서비스 등 중간 계층에서 설정되며, 애플리케이션에서 사용하는 모든 HTTP 헤더 필드를 사용자가 재정의할 수 없는지 확인한다. 예를 들어 X-Real-IP, X-Frowarded-*, X-User-ID 등의 헤더가 포함될 수 있다.",,✓,✓,, +V4,API 와 WEB 서비스,V4.1,일반적인 웹 서비스 보안,V4.1.4,"애플리케이션이나 API에서 명시적으로 지원하는 HTTP 메서드(프리플라이트 요청 시에 OPTIONS 포함)만 사용할 수 있으며, 사용되지 않는 메서드는 차단되어 있는지 확인한다.",,,✓,, +V4,API 와 WEB 서비스,V4.1,일반적인 웹 서비스 보안,V4.1.5,매우 민감하거나 여러 시스템을 거치는 요청이나 거래에 대한 전송 계층 보호에 더하여 메세지별 디지털 서명들을 사용함으로써 추가적인 보증을 제공하는지 확인한다.,,,✓,, +V4,API 와 WEB 서비스,V4.2,HTTP 메세지 구조 검증,V4.2.1,"모든 애플리케이션 구성 요소(로드 밸런서, 방화벽, 애플리케이션 서버 포함)가 HTTP 요청 smuggling을 예방하는 HTTP 버전의 적합한 메커니즘을 사용하는지에 대해, 수신되는 HTTP 메세지의 끝을 결정하는지 확인한다. HTTP/1.x에서 Transfer-encoding 헤더 필드가 있는 경우에 RFC 2616에 따라서 Content-Length 헤더는 무시해야 한다. HTTP/2 또는 HTTP/3를 사용할 때 Content-Length 헤더 필드가 있는 경우에 수신기는 DATA 프레임의 길이와 일치하는지 확인해야 한다.",,✓,✓,, +V4,API 와 WEB 서비스,V4.2,HTTP 메세지 구조 검증,V4.2.2,"HTTP 메세지를 생성할 때, 요청 smuggling 공격을 예방하기 위해서 HTTP 프로토콜의 프레이밍 방식에 의해 결정된 Content의 길이와 Content-Length 헤더 필드가 충돌하지 않는지 확인한다. ",,,✓,, +V4,API 와 WEB 서비스,V4.2,HTTP 메세지 구조 검증,V4.2.3,응답 분할 및 헤더 인젝션 공격을 예방하기 위해서 애플리케이션이 Transfer-encoding과 같은 connection-specific 헤더 필드를 가진 HTTP/2또는 HTTP/3 메세지를 전송하거나 수락하지 않는지 확인한다.,,,✓,, +V4,API 와 WEB 서비스,V4.2,HTTP 메세지 구조 검증,V4.2.4,"헤더 인젝션 공격을 예방하기 위해서, 애플리케이션이 헤더 이름과 값에 CR(\r), LF(\n), CRLF(\r\n)과 같은 줄바꿈 문자가 포함되어 있지 않은 HTTP/2 및 HTTP/3 요청만 허용하는지 확인한다.",,,✓,, +V4,API 와 WEB 서비스,V4.2,HTTP 메세지 구조 검증,V4.2.5,"애플리케이션(백엔드 또는 프론트엔드)이 요청을 빌드하고 전송하는 경우, 수신 구성 요소가 수학하기에는 너무 긴 URI(ex. API 호출) 또는 HTTP 요청 헤더 필드(ex. Authorization 또는 Cookie)를 생성하지 않도록 검증, 검열 또는 기타 메커니즘을 사용하는지 확인한다. 이로 인해서 지나치게 긴 요청(ex. 긴 쿠키 헤더 필드)을 보낼 때와 같이 서비스 거부가 발생하여 서버가 항상 오류 상태로 응답할 수 있다.",,,✓,, +V4,API 와 WEB 서비스,V4.3,GraphQL,V4.3.1,"쿼리 허용 목록, 깊이 제한, 양 제한 또는 쿼리 비용 분석을 사용하여 값비싼 중첩 쿼리로 인해 GraphQL 또는 데이터 계층 표현식 거부(DOS)를 방지하는지 확인한다.",,✓,✓,, +V4,API 와 WEB 서비스,V4.3,GraphQL,V4.3.2,"GraphQL API가 다른 사용자에 의해 사용되지 않는 한, 운영 환경에서 GraphQL 점검 쿼리들이 비비활성화되어 있는지 확인한다.",,✓,✓,, +V4,API 와 WEB 서비스,V4.4,WebSocket,V4.4.1,모든 WebSocket 연결에 WebSocket over TLS(WSS)이 사용되는지 확인한다.,✓,✓,✓,, +V4,API 와 WEB 서비스,V4.4,WebSocket,V4.4.2,초기 HTTP WebSocket Handshake 중에 기존 헤더 필드가 애플리케이션에 허용된 기존 목록과 대조되는지 확인한다.,,✓,✓,, +V4,API 와 WEB 서비스,V4.4,WebSocket,V4.4.3,"애플리케이션의 표준 세션 관리를 사용할 수 없는 경우, 관련 세션 관리 보안 요구 사항을 준수하는 전용 토큰이 사용되고 있는지 확인한다.",,✓,✓,, +V4,API 와 WEB 서비스,V4.4,WebSocket,V4.4.4,기존 HTTPS 세션을 WebSocket 채널로 전환할 때 이전에 인증된 HTTPS 세션을 통해 전용 WebSocket 세션 관리 토큰을 처음 얻거나 검증하는지 확인한다.,,✓,✓,, +V5,파일 처리,V5.1,파일 처리 문서화,V5.1.1,"업로드 기능별로 허용되는 파일 형식, 예상되는 파일 확장자, 그리고 최대 크기(압축 해제된 크기 포함)가 문서에 정의되어 있는지 검증해야 한다. 또한, 악성 파일이 탐지될 때 애플리케이션이 어떻게 동작하는지와 같이, 최종 사용자가 파일을 안전하게 다운로드하고 처리할 수 있도록 하는 방법이 문서에 명시되어 있는지 확인해야 한다.",,✓,✓,, +V5,파일 처리,V5.2,파일 업로드 및 콘텐츠,V5.2.1,애플리케이션이 성능 저하나 서비스 거부 공격(Denial of Service; DoS)을 유발하지 않고 처리할 수 있는 크기의 파일만 허용하는지 검증해야 한다.,✓,✓,✓,, +V5,파일 처리,V5.2,파일 업로드 및 콘텐츠,V5.2.2,"애플리케이션이 파일 자체 또는 zip 파일과 같은 아카이브 내에서 파일을 허용할 때, 파일 확장자가 예상 파일 확장자와 일치하는지 확인하고 내용이 확장자로 표현된 유형과 일치하는지 확인하는지 검증해야 한다. 여기에는 초기 '매직 바이트(magic bytes)' 확인, 이미지 재작성 수행, 파일 내용 유효성 검사를 위한 전문 라이브러리 사용이 포함되지만 이에 국한되지 않는다. L1의 경우, 특정 비즈니스 또는 보안 결정을 내리는 데 사용되는 파일에만 집중할 수 있다. L2 이상에서는 허용되는 모든 파일에 적용되어야 한다",✓,✓,✓,, +V5,파일 처리,V5.2,파일 업로드 및 콘텐츠,V5.2.3,"애플리케이션이 압축 파일(예: zip, gz, docx, odt)을 압축 해제하기 전에 허용되는 최대 압축 해제 크기와 최대 파일 수를 확인하는지 검증해야 한다.",,✓,✓,, +V5,파일 처리,V5.2,파일 업로드 및 콘텐츠,V5.2.4,단일 사용자가 너무 많은 파일이나 과도하게 큰 파일로 저장 공간을 채우지 않도록 사용자별 파일 크기 할당량(quota) 및 최대 파일 수가 적용되는지 검증해야 한다.,,,✓,, +V5,파일 처리,V5.2,파일 업로드 및 콘텐츠,V5.2.5,"애플리케이션이 심볼릭 링크(symlink)를 포함하는 압축 파일 업로드를 허용하지 않는지 검증해야 한다. 단, 이러한 기능이 특별히 요구되는 경우에는 심볼릭 링크할 수 있는 파일의 허용 목록(allowlist)을 강제하는 것이 필요하다.",,,✓,, +V5,파일 처리,V5.2,파일 업로드 및 콘텐츠,V5.2.6,"픽셀 플러드 공격(Pixel Flood Attack)을 방지하기 위해, 애플리케이션이 업로드된 이미지의 픽셀 크기가 허용된 최대값보다 큰 경우 해당 이미지를 거부하는지 검증해야 한다.",,,✓,, +V5,파일 처리,V5.3,파일 저장,V5.3.1,신뢰할 수 없는 입력으로 업로드되거나 생성되어 공개 폴더에 저장된 파일이 HTTP 요청으로 직접 접근될 때 서버 측 프로그램 코드로 실행되지 않는지 검증해야 한다.,✓,✓,✓,, +V5,파일 처리,V5.3,파일 저장,V5.3.2,"애플리케이션이 파일 작업을 위한 파일 경로를 생성할 때, 사용자 제출 파일명 대신 내부적으로 생성되거나 신뢰할 수 있는 데이터를 사용하는지 검증해야 한다. 만약 사용자 제출 파일명 또는 파일 메타데이터를 반드시 사용해야 한다면, 경로 탐색(path traversal), 로컬 또는 원격 파일 포함(Local File Inclusion; LFI, Remote File Inclusion; RFI), 그리고 서버 측 요청 위조(Server-side Request Forgery; SSRF) 공격으로부터 보호하기 위해 엄격한 유효성 검사 및 정제(Sanitization)가 적용되는지 확인해야 한다.",✓,✓,✓,, +V5,파일 처리,V5.3,파일 저장,V5.3.3,파일 압축 해제와 같은 서버 측 파일 처리가 zip slip과 같은 취약점을 방지하기 위해 사용자 제공 경로 정보를 무시하는지 검증해야 한다.,,,✓,, +V5,파일 처리,V5.4,파일 다운로드,V5.4.1,"애플리케이션이 JSON, JSONP 또는 URL 파라미터를 포함한 사용자 제출 파일명을 검증하거나 무시하는지 검증해야 하고, 응답의 Content-Disposition 헤더 필드에 파일명을 명시하는지 검증해야 한다.",,✓,✓,, +V5,파일 처리,V5.4,파일 다운로드,V5.4.2,제공되는 파일 이름(예: HTTP 응답 헤더 필드 또는 이메일 첨부 파일)이 문서 구조를 보존하고 삽입 공격(Injection Attack)을 방지하기 위해 인코딩되거나 정제되는지 검증해야 한다. (예: RFC 6266 준수),,✓,✓,, +V5,파일 처리,V5.4,파일 다운로드,V5.4.3,신뢰할 수 없는 소스에서 얻은 파일이 알려진 악성 콘텐츠 제공을 방지하기 위해 안티바이러스 스캐너에 의해 검사되는지 검증해야 한다.,,✓,✓,, +V6,인증,V6.1,Authentication Documentation,V6.1.1,"인증 문서가 크리덴셜 스터핑, 비밀번호 무차별 대입 공격 등을 방어하기 위해 속도 제한, 자동화 방지, 적응형 응답(adaptive response)과 같은 제어가 어떻게 사용되는지를 정의한다. 또한, 이러한 제어가 어떻게 구성되는지와 악의적으로 계정을 잠그는 것을 방지하는 방법을 명확히 하는지 검증한다.",✓,✓,✓,, +V6,인증,V6.1,Authentication Documentation,V6.1.2,"조직명, 제품명, 시스템 식별자, 프로젝트 코드명, 부서명 또는 역할명 등 문맥적으로 특정된 단어의 변형을 포함하여, 비밀번호에 사용되지 않도록 문서화된 단어 목록이 있는지 검증한다.",,✓,✓,, +V6,인증,V6.1,Authentication Documentation,V6.1.3,"애플리케이션이 여러 인증 경로를 포함하는 경우, 이들 모두가 문서화되어 있으며 각 경로에 대해 일관되게 적용되는 보안 제어와 인증 강도가 정의되어 있는지 검증한다.",,✓,✓,, +V6,인증,V6.2,비밀번호 보안,V6.2.1,"사용자가 설정하는 비밀번호가 최소 8자 이상이어야 하며, 최소 15자 이상을 강력히 권장하는지 검증한다.",✓,✓,✓,, +V6,인증,V6.2,비밀번호 보안,V6.2.2,사용자가 비밀번호를 변경할 수 있는지 검증한다.,✓,✓,✓,, +V6,인증,V6.2,비밀번호 보안,V6.2.3,비밀번호 변경 기능이 사용자의 현재 비밀번호와 새 비밀번호를 요구하는지 검증한다.,✓,✓,✓,, +V6,인증,V6.2,비밀번호 보안,V6.2.4,"계정 등록 또는 비밀번호 변경 시 제출된 비밀번호가 최소 3000개의 상위 비밀번호 목록과 비교 및 검사되는지, 이때 애플리케이션 비밀번호 정책(예: 최소 길이)을 만족하는지 검증한다.",✓,✓,✓,, +V6,인증,V6.2,비밀번호 보안,V6.2.5,"비밀번호는 어떤 구성도 허용되며, 허용되는 문자 유형에 대한 제한이 없는지 검증한다. 대/소문자, 숫자, 특수문자에 대한 최소 개수 요구사항이 없어야 한다.",✓,✓,✓,, +V6,인증,V6.2,비밀번호 보안,V6.2.6,비밀번호 입력 필드가 type=password를 사용하여 입력을 마스킹하는지 검증한다. 애플리케이션은 사용자가 전체 비밀번호나 마지막 입력 문자를 일시적으로 볼 수 있도록 허용할 수 있다.,✓,✓,✓,, +V6,인증,V6.2,비밀번호 보안,V6.2.7,"붙여넣기 기능, 브라우저 비밀번호 도우미, 외부 비밀번호 관리자의 사용이 허용되는지 검증한다.",✓,✓,✓,, +V6,인증,V6.2,비밀번호 보안,V6.2.8,"애플리케이션이 비밀번호를 사용자로부터 수신한 그대로 검증하며, 대소문자 변경이나 잘림(truncation)과 같은 수정 없이 처리하는지 검증한다.",✓,✓,✓,, +V6,인증,V6.2,비밀번호 보안,V6.2.9,비밀번호가 최소 64자까지 허용되는지 검증한다.,,✓,✓,, +V6,인증,V6.2,비밀번호 보안,V6.2.10,"사용자의 비밀번호는 손상되었음이 발견되거나 사용자가 교체할 때까지 유효하며, 애플리케이션이 주기적인 자격 증명 교체를 요구하지 않는지 검증한다.",,✓,✓,, +V6,인증,V6.2,비밀번호 보안,V6.2.11,문서화된 문맥별 단어 목록을 사용하여 추측하기 쉬운 비밀번호가 생성되지 않도록 하는지 검증한다.,,✓,✓,, +V6,인증,V6.2,비밀번호 보안,V6.2.12,계정 등록 또는 비밀번호 변경 시 제출된 비밀번호가 유출된 비밀번호 집합과 비교 및 검사되는지 검증한다.,,✓,✓,, +V6,인증,V6.3,일반 인증 보안,V6.3.1,애플리케이션의 보안 문서에 따라 크리덴셜 스터핑 및 비밀번호 무차별 대입 공격을 방지하기 위한 제어가 구현되어 있는지 검증한다.,✓,✓,✓,, +V6,인증,V6.3,일반 인증 보안,V6.3.2,"“root”, “admin”, “sa”와 같은 기본 사용자 계정이 애플리케이션에 존재하지 않거나 비활성화되어 있는지 검증한다.",✓,✓,✓,, +V6,인증,V6.3,일반 인증 보안,V6.3.3,"애플리케이션 접근 시 반드시 MFA 또는 단일 요소 인증 메커니즘의 조합을 사용하는지 검증한다. L3의 경우, 인증을 수행하려는 사용자의 의도를 검증하기 위해 사용자가 직접 수행하는 동작(예: FIDO 하드웨어 키 또는 모바일 기기에서 버튼을 누르는 행위)을 요구함으로써, 피싱 공격에 대한 침해 및 위장 저항성을 제공하는 하드웨어 기반 인증 메커니즘이 반드시 하나의 요소로 포함되어야 한다. 이 요구사항에서 고려 사항을 완화하려는 경우, 완전히 문서화된 근거와 포괄적인 보완 통제가 반드시 수반되어야 한다.",,✓,✓,, +V6,인증,V6.3,일반 인증 보안,V6.3.4,"여러 인증 경로가 존재하는 경우, 문서화되지 않은 경로가 없어야 하며 보안 제어와 인증 강도가 일관되게 적용되는지 검증한다.",,✓,✓,, +V6,인증,V6.3,일반 인증 보안,V6.3.5,"사용자가 의심스러운 인증 시도에 대해 성공 여부와 관계 없이 알림을 제공받는지 검증한다. 여기에는 비정상적인 위치나 클라이언트에서의 인증 시도, 부분적으로만 성공한 인증(여러 요소 중 하나만 성공한 경우), 장기간 비활성 상태 이후의 인증 시도, 또는 여러 번의 인증 실패 후 성공한 인증이 포함될 수 있다.",,,✓,, +V6,인증,V6.3,일반 인증 보안,V6.3.6,이메일이 단일 또는 다중 요소 인증 메커니즘으로 사용되지 않는지 검증한다.,,,✓,, +V6,인증,V6.3,일반 인증 보안,V6.3.7,"자격 증명 재설정, 사용자명/이메일 수정 등 인증 관련 정보 변경 이후 사용자에게 통지되는지 검증한다.",,,✓,, +V6,인증,V6.3,일반 인증 보안,V6.3.8,"오류 메시지, HTTP 응답 코드, 응답 시간 차이 등을 통해 유효한 사용자를 유추할 수 없으며, 비밀번호 등록/찾기 기능에도 동일한 보호가 적용되는지 검증한다.",,,✓,, +V6,인증,V6.4,인증 요소 수명 주기 및 복구,V6.4.1,"시스템이 생성하는 초기 비밀번호나 활성화 코드가 안전하게 난수로 생성되며, 기존 비밀번호 정책을 따르고, 짧은 기간 내 또는 최초 사용 시 만료되는지 검증한다. 초기 비밀번호는 장기 비밀번호로 허용되지 않아야 한다.",✓,✓,✓,, +V6,인증,V6.4,인증 요소 수명 주기 및 복구,V6.4.2,비밀번호 힌트나 지식 기반 인증(“비밀 질문”)이 존재하지 않는지 검증한다.,✓,✓,✓,, +V6,인증,V6.4,인증 요소 수명 주기 및 복구,V6.4.3,"분실된 비밀번호에 대한 재설정 절차가 안전하게 구현되며, MFA를 우회하지 않는지 검증한다.",,✓,✓,, +V6,인증,V6.4,인증 요소 수명 주기 및 복구,V6.4.4,"MFA 요소 분실 시, 등록 시와 동일 수준의 신원 증명이 수행되는지 검증한다.",,✓,✓,, +V6,인증,V6.4,인증 요소 수명 주기 및 복구,V6.4.5,"만료 예정인 인증 메커니즘에 대한 갱신 안내가 충분한 시간 전에 발송되며, 필요한 경우 자동 알림이 구성되는지 검증한다",,,✓,, +V6,인증,V6.4,인증 요소 수명 주기 및 복구,V6.4.6,"관리자가 사용자 비밀번호 재설정 절차를 시작할 수 있으나, 사용자의 비밀번호를 직접 변경하거나 지정할 수 없는지 검증한다. 이는 관리자가 사용자의 비밀번호를 알지 못하도록 한다.",,,✓,, +V6,인증,V6.5,General Multi-factor authentication requirements,V6.5.1,"조회 secret, 대역 외 인증 요청 및 코드, 시간 기반 일회용 비밀번호가 단 한 번만 성공적으로 사용 가능한지 검증한다.",,✓,✓,, +V6,인증,V6.5,General Multi-factor authentication requirements,V6.5.2,"애플리케이션 백엔드에 저장될 때, 엔트로피가 112비트 미만인 룩업 시크릿(예: 무작위 영숫자 19자 또는 무작위 숫자 34자)은 32비트 무작위 솔트(salt)를 포함하는 사전 승인된 비밀번호 저장용 해시 알고리즘으로 해시되는지 검증한다. 룩업 시크릿이 112비트 이상의 엔트로피를 가진 경우에는 표준 해시 함수를 사용할 수 있다.",,✓,✓,, +V6,인증,V6.5,General Multi-factor authentication requirements,V6.5.3,"룩업 시크릿, 대역 외 인증 코드, 그리고 시간 기반 일회용 비밀번호의 시드가 예측 가능한 값을 피하기 위해 암호학적으로 안전한 의사난수 생성기(CSPRNG)를 사용하여 생성되는지 검증한다. ",,✓,✓,, +V6,인증,V6.5,General Multi-factor authentication requirements,V6.5.4,룩업 시크릿과 대역 외 인증 코드가 최소 20비트의 엔트로피를 가지는지 검증한다. 일반적으로 무작위 영숫자 4자 또는 무작위 숫자 6자가 충분하다.,,✓,✓,, +V6,인증,V6.5,General Multi-factor authentication requirements,V6.5.5,"대역 외 인증 요청, 코드 또는 토큰과 시간 기반 일회용 비밀번호가 정의된 수명을 가지는지 검증한다. 대역 외 요청의 최대 수명은 10분이어야 하며, TOTP의 최대 수명은 30초이어야 한다.",,✓,✓,, +V6,인증,V6.5,General Multi-factor authentication requirements,V6.5.6,도난이나 기타 손실의 경우 모든 인증 요소(물리적 장치 포함)를 해지할 수 있는지 검증한다.,,,✓,, +V6,인증,V6.5,General Multi-factor authentication requirements,V6.5.7,"생체 인식 인증 메커니즘은 반드시 보조 요소로만 사용되어야 하며, “소유하고 있는 것” 또는 “알고 있는 것” 중 하나와 함께 사용되는지 검증한다.",,,✓,, +V6,인증,V6.5,General Multi-factor authentication requirements,V6.5.8,"시간 기반 일회용 비밀번호는 신뢰할 수 있는 서비스의 시간 소스를 기준으로 검증되어야 하며, 신뢰할 수 없거나 클라이언트에서 제공한 시간을 기반으로 해서는 안 된다.",,,✓,, +V6,인증,V6.6,대역 외(Out-of-Band) 인증 메커니즘,V6.6.1,"공중 교환 전화망(PSTN)을 사용하여 전화나 SMS를 통해 일회용 비밀번호(OTPs)를 전달하는 인증 메커니즘은, 해당 전화번호가 사전에 검증되었을 때만 제공되어야 하며, 더 강력한 대체 방법(예: 시간 기반 일회용 비밀번호)도 제공되어야 하고, 서비스는 사용자에게 이러한 보안 위험에 대한 정보를 제공해야 한다. L3 애플리케이션의 경우, 전화와 SMS는 옵션으로 제공되어서는 안 된다.",,✓,✓,, +V6,인증,V6.6,대역 외(Out-of-Band) 인증 메커니즘,V6.6.2,"대역 외 인증 요청, 코드 또는 토큰은 생성된 원래 인증 요청에만 바인딩되어야 하며, 이전이나 이후의 요청에는 사용할 수 없어야 한다.",,✓,✓,, +V6,인증,V6.6,대역 외(Out-of-Band) 인증 메커니즘,V6.6.3,코드 기반 대역 외 인증 메커니즘이 속도 제한 등을 통해 무차별 대입 공격으로부터 보호되는지 검증한다. 또한 최소 64비트 이상의 엔트로피를 가진 코드를 사용하는 것도 고려해야한다.,,✓,✓,, +V6,인증,V6.6,대역 외(Out-of-Band) 인증 메커니즘,V6.6.4,"다중요소 인증에 푸시 알림이 사용되는 경우, 푸시 폭탄(push bombing) 공격을 방지하기 위해 속도 제한을 적용해야 한다. 또한 숫자 일치 기법 역시 이 위험을 완화할 수 있다.",,,✓,, +V6,인증,V6.7,암호학적 인증 메커니즘,V6.7.1,암호학적 인증 단언(assertion)을 검증하는 데 사용되는 인증서는 수정으로부터 보호되는 방식으로 저장되는지 검증한다.,,,✓,, +V6,인증,V6.7,암호학적 인증 메커니즘,V6.7.2,"챌린지 논스(nonce)는 최소 64비트 길이여야 하며, 통계적으로 고유하거나 해당 암호 장치의 수명 동안 고유해야 한다.",,,✓,, +V6,인증,V6.8,ID 제공자(IdP)를 통한 인증,V6.8.1,"애플리케이션이 다중 ID 제공자(IdP)를 지원하는 경우, 사용자의 신원이 다른 지원 IdP를 통해 위조될 수 없는지 검증한다. (예: 동일한 사용자 식별자를 사용하는 방식). 표준적인 대응책은 애플리케이션이 IdP ID(네임스페이스 역할)와 IdP 내 사용자 ID의 조합을 사용하여 사용자를 등록하고 식별하는 것이다.",,✓,✓,, +V6,인증,V6.8,ID 제공자(IdP)를 통한 인증,V6.8.2,인증 단언(예: JWT 또는 SAML 단언)의 디지털 서명이 존재하고 무결성이 항상 유지되는지를 검증한다. 서명이 없거나 유효하지 않은 단언은 거부해야 한다.,,✓,✓,, +V6,인증,V6.8,ID 제공자(IdP)를 통한 인증,V6.8.3,"SAML 단언이 재생 공격의 방지를 위해 고유하게 처리되는지, 유효 기간 내에 단 한 번만 사용되는지 검증한다.",,✓,✓,, +V6,인증,V6.8,ID 제공자(IdP)를 통한 인증,V6.8.4,"애플리케이션이 별도의 ID 제공자(IdP)를 사용하고 특정 기능에 대해 특정 인증 강도, 방식, 또는 최근성을 요구하는 경우, 애플리케이션은 IdP가 반환한 정보를 사용하여 이를 검증해야 한다. 예를 들어, OIDC가 사용되는 경우, 이는 ‘acr’, ‘amr’, ‘auth_time’(존재하는 경우)과 같은 ID 토큰 클레임을 검증함으로써 달성할 수 있다. IdP가 이 정보를 제공하지 않는 경우, 애플리케이션은 최소 강도의 인증 메커니즘(예: 사용자 이름과 비밀번호를 사용하는 단일요소 인증)이 사용되었다고 가정하는 문서화된 대체 접근법을 가져야 한다.",,✓,✓,, +V7,세션 관리,V7.1,세션 관리 문서화,V7.1.1,"사용자의 세션 비활성 시간 초과 및 절대 최대 세션 수명에 대한 문서가 존재하고, 다른 제어와의 조합에서 적절하며, NIST SP 800-63B 재인증 요구사항에서 벗어날 시 그 근거가 문서에 포함되어 있는지 검증한다.",,✓,✓,, +V7,세션 관리,V7.1,세션 관리 문서화,V7.1.2,문서가 하나의 계정에서 허용되는 동시(병렬) 세션 수와 활성 세션 수의 최대값에 도달했을 때의 의도된 동작과 수행할 조치를 정의하는지 검증한다.,,✓,✓,, +V7,세션 관리,V7.1,세션 관리 문서화,V7.1.3,"통합 신원 관리 생태계(예: SSO 시스템)의 일부로 사용자 세션을 생성하고 관리하는 모든 시스템이 문서화되어 있으며, 세션 수명, 종료, 재인증이 필요한 기타 조건을 조율하기 위한 제어가 포함되어 있는지 검증한다.",,✓,✓,, +V7,세션 관리,V7.2,기본 세션 관리 보안,V7.2.1,애플리케이션이 모든 세션 토큰 검증을 신뢰할 수 있는 백엔드 서비스에서 수행하는지 검증한다.,✓,✓,✓,, +V7,세션 관리,V7.2,기본 세션 관리 보안,V7.2.2,"애플리케이션이 세션 관리를 위해 정적 API 시크릿이나 키가 아닌, 자체 포함 토큰 또는 참조 토큰을 동적으로 생성하여 사용하는지 검증한다.",✓,✓,✓,, +V7,세션 관리,V7.2,기본 세션 관리 보안,V7.2.3,"참조 토큰이 사용자 세션을 나타내는 데 사용되는 경우, 그 토큰이 고유하고, 암호학적으로 안전한 의사난수 생성기(CSPRNG)를 사용해 생성되며 최소 128비트의 엔트로피를 갖는지 검증한다.",✓,✓,✓,, +V7,세션 관리,V7.2,기본 세션 관리 보안,V7.2.4,애플리케이션이 사용자 인증(재인증 포함) 시 새로운 세션 토큰을 생성하고 기존 세션 토큰을 종료하는지 검증한다.,✓,✓,✓,, +V7,세션 관리,V7.3,세션 타임아웃,V7.3.1,위험 분석 및 문서화된 보안 결정에 따라 재인증을 강제하는 비활성 시간 초과가 존재하는지 검증한다.,,✓,✓,, +V7,세션 관리,V7.3,세션 타임아웃,V7.3.2,위험 분석 및 문서화된 보안 결정에 따라 재인증을 강제하는 절대 최대 세션 수명이 존재하는지 검증한다.,,✓,✓,, +V7,세션 관리,V7.4,세션 종료,V7.4.1,"로그아웃이나 만료와 같이 세션 종료가 트리거될 때, 애플리케이션이 해당 세션의 추가 사용을 허용하지 않는지 검증한다. 참조 토큰 또는 상태 유지형 세션의 경우, 이는 애플리케이션 백엔드에서 세션 데이터를 무효화하는 것을 의미한다. 자체 포함 토큰을 사용하는 애플리케이션은 종료된 토큰 목록 유지, 사용자별 날짜·시간 이전에 발급된 토큰 거부, 사용자별 서명 키 회전과 같은 방법을 사용해야 한다.",✓,✓,✓,, +V7,세션 관리,V7.4,세션 종료,V7.4.2,"사용자 계정이 비활성화되거나 삭제될 때(예: 직원 퇴사), 애플리케이션이 모든 활성 세션을 종료하는지 검증한다.",✓,✓,✓,, +V7,세션 관리,V7.4,세션 종료,V7.4.3,"비밀번호 재설정·복구를 통한 변경, MFA 설정 변경 등 어떤 인증 요소라도 성공적으로 변경 또는 제거한 후, 모든 다른 활성 세션을 종료할 수 있는 옵션을 제공하는지 검증한다.",,✓,✓,, +V7,세션 관리,V7.4,세션 종료,V7.4.4,인증이 필요한 모든 페이지의 로그아웃 기능에 접근하는 것이 쉽고 잘 보이는지 검증한다.,,✓,✓,, +V7,세션 관리,V7.4,세션 종료,V7.4.5,애플리케이션 관리자가 개별 사용자 또는 모든 사용자의 활성 세션을 종료할 수 있는지 검증한다.,,✓,✓,, +V7,세션 관리,V7.5,세션 악용 방어,V7.5.1,"이메일 주소, 전화번호, MFA 구성, 계정 복구에 사용되는 기타 정보 등 인증에 영향을 줄 수 있는 민감한 계정 속성을 변경하기 전에 전체 재인증을 요구하는지 검증한다.",,✓,✓,, +V7,세션 관리,V7.5,세션 악용 방어,V7.5.2,사용자가 현재 활성 세션을 전체 또는 일부 확인하고(최소 요소 한 개에 대한 인증을 다시 수행한 후) 종료할 수 있는지 검증한다.,,✓,✓,, +V7,세션 관리,V7.5,세션 악용 방어,V7.5.3,매우 민감한 거래나 작업을 수행하기 전에 최소 한 요소 인증 또는 2차 검증을 요구하는지 검증한다.,,,✓,, +V7,세션 관리,V7.6,페더레이션 재인증,V7.6.1,"RP와 IdP 간 세션 수명과 종료가 문서대로 동작하며, IdP 인증 이벤트 간의 최대 시간이 도달하는 경우 등 필요한 시점에 재인증을 요구하는지 검증한다.",,✓,✓,, +V7,세션 관리,V7.6,페더레이션 재인증,V7.6.2,"세션 생성 시 사용자 동의 또는 명시적 동작을 요구하여, 사용자 상호작용 없이 새로운 애플리케이션 세션이 생성되지 않도록 하는지 검증한다.",,✓,✓,, +V8,권한 부여,V8.1,권한 부여 문서화,V8.1.1,권한 부여 문서가 소비자 권한과 자원 속성에 따라 기능 수준 및 데이터별 접근을 제한하는 규칙을 정의하는지 검증한다.,✓,✓,✓,, +V8,권한 부여,V8.1,권한 부여 문서화,V8.1.2,권한 부여 문서가 소비자 권한과 자원 속성에 따라 필드 수준 접근 제한(읽기 및 쓰기 모두)을 정의하는지 검증한다. 이러한 규칙은 관련 데이터 객체의 상태(state)나 상태값(status)과 같은 다른 속성 값에 의존할 수 있다.,,✓,✓,, +V8,권한 부여,V8.1,권한 부여 문서화,V8.1.3,"애플리케이션 문서가 인증 및 권한 부여와 관련된 보안 결정을 내리는 데 사용되는 환경적, 맥락적 속성(예: 시간대, 사용자 위치, IP 주소, 디바이스 등)을 정의하는지 검증한다.",,,✓,, +V8,권한 부여,V8.1,권한 부여 문서화,V8.1.4,"인증 및 권한 부여 문서가 기능 수준, 데이터별, 필드 수준 권한 부여에 더해 환경적, 맥락적 요소가 의사 결정에 어떻게 사용되는지 정의하는지 검증한다. 여기에는 평가되는 속성, 위험 임계값, 수행되는 조치(예: 허용, 추가 인증 요청, 거부, 단계적 인증)을 포함하는 것을 권장한다.",,,✓,, +V8,권한 부여,V8.2,일반 권한 부여 설계,V8.2.1,애플리케이션이 기능 수준의 접근을 명시적 권한이 있는 소비자에게만 허용하는지 검증한다.,✓,✓,✓,, +V8,권한 부여,V8.2,일반 권한 부여 설계,V8.2.2,"애플리케이션이 특정 데이터 항목에 대한 명시적 권한이 있는 소비자에게만 데이터별 접근을 허용하여, 안전하지 않은 직접 객체 참조(IDOR) 및 객체 수준 권한 부여 취약점(BOLA)을 방지하는지 검증한다.",✓,✓,✓,, +V8,권한 부여,V8.2,일반 권한 부여 설계,V8.2.3,"애플리케이션이 특정 필드에 대한 명시적 권한이 있는 소비자에게만 필드 수준 접근을 허용하여, 객체 속성 수준 권한 부여 취약점(BOPLA)을 방지하는지 검증한다.",,✓,✓,, +V8,권한 부여,V8.2,일반 권한 부여 설계,V8.2.4,"애플리케이션 문서에서 정의한 바에 따라, 소비자의 환경적, 맥락적 속성(예: 시간대, 위치, IP 주소 또는 장치)에 기반한 적응형 보안 제어가 인증 및 권한 부여 결정에 구현되는지 검증한다. 이러한 제어는 소비자가 새 세션을 시작할 때뿐만 아니라 기존 세션 중에도 반드시 적용되어야 한다.",,,✓,, +V8,권한 부여,V8.3,운영 수준 권한 부여,V8.3.1,"애플리케이션이 권한 부여 규칙을 신뢰할 수 있는 서비스 계층에서 적용하고, 클라이언트 측 JavaScript처럼 신뢰할 수 없는 소비자가 조작할 수 있는 제어에 의존하지 않는지 검증한다.",✓,✓,✓,, +V8,권한 부여,V8.3,운영 수준 권한 부여,V8.3.2,"권한 부여 결정에 영향을 미치는 값의 변경 사항이 즉시 적용되는지 검증한다. 자체 포함 토큰(self-contained token)과 같이 즉시 적용이 불가능한 경우, 소비자가 더 이상 권한이 없는 작업을 수행할 때 이를 알리고 변경을 되돌리는 완화 제어를 반드시 두어야 한다. 단, 이 방법은 정보 유출을 방지하지는 못한다.",,,✓,, +V8,권한 부여,V8.3,운영 수준 권한 부여,V8.3.3,"객체에 대한 접근이, 대리인이나 이를 대신 수행하는 서비스의 권한이 아닌, 원래 주체(예: 소비자)의 권한에 기반하는지 검증한다. 예를 들어, 소비자가 인증을 위해 자체 포함 토큰을 사용하여 웹 서비스를 호출하고, 해당 서비스가 다른 서비스에 데이터를 요청하는 경우, 두 번째 서비스는 첫 번째 서비스의 머신-투-머신 토큰이 아니라 소비자의 토큰을 사용하여 권한 결정을 내려야 한다.",,,✓,, +V8,권한 부여,V8.4,기타 권한 부여 고려사항,V8.4.1,"다중 테넌트 애플리케이션이 교차 테넌트 제어를 사용하여, 소비자의 작업이 권한이 없는 다른 테넌트에 영향을 미치지 않도록 하는지 검증한다.",,✓,✓,, +V8,권한 부여,V8.4,기타 권한 부여 고려사항,V8.4.2,"관리 인터페이스 접근이 연속적인 소비자 신원 검증, 장치 보안 상태 평가, 맥락 기반 위험 분석 등 복수의 보안 계층을 포함하는지 검증한다. 네트워크 위치나 신뢰된 엔드포인트가 무단 접근 가능성을 줄일 수는 있더라도, 단독으로 권한 부여 판단의 유일한 요소가 되어서는 안 된다.",,,✓,, +V9,자체 포함 토큰(self-contained token),V9.1,토큰 출처 및 무결성,V9.1.1,자체 포함 토큰 내용을 허용하기 전에 변조를 방지하기 위해 디지털 서명 또는 메시지 인증 코드(MAC)를 사용하여 토큰의 무결성을 검증해야 한다.,✓,✓,✓,, +V9,자체 포함 토큰(self-contained token),V9.1,토큰 출처 및 무결성,V9.1.2,"주어진 컨텍스트에 대해 자체 포함 토큰을 생성하고 검증할 때, 허용 목록에 있는 알고리즘만 사용될 수 있는지 검증해야 한다. 허용 목록에는 사용 가능한 알고리즘을 모두 포함해야 하며, 이상적으로는 대칭 또는 비대칭 알고리즘 중 하나만을 포함해야 한다. 또한 'None' 알고리즘은 반드시 제외해야 한다. 대칭 및 비대칭 알고리즘 모두를 지원해야 하는 경우, 키 혼동을 방지하기 위해 추가 제어가 필요하다.",✓,✓,✓,, +V9,자체 포함 토큰(self-contained token),V9.1,토큰 출처 및 무결성,V9.1.3,"자체 포함 토큰을 검증하는 데 사용되는 키 자료가 토큰 발행자를 위한 신뢰할 수 있는 사전 구성된 출처에서 비롯되었는지 검증하여, 공격자가 신뢰할 수 없는 출처 및 키를 지정하는 것을 방지해야 한다. JWT 및 기타 JWS 구조의 경우, 'jku', 'x5u', 'jwk'와 같은 헤더는 신뢰할 수 있는 출처의 허용 목록에 대해 검증되어야 한다.",✓,✓,✓,, +V9,자체 포함 토큰(self-contained token),V9.2,토큰 내용,V9.2.1,"토큰 데이터에 유효 기간이 존재하는 경우, 검증 시간이 이 유효 기간 내에 있을 때만 토큰 및 해당 내용이 허용되는지 검증해야 한다. 예를 들어, JWT의 경우 'nbf' 및 'exp' 클레임이 검증되어야 한다.",✓,✓,✓,, +V9,자체 포함 토큰(self-contained token),V9.2,토큰 내용,V9.2.2,"토큰을 수신하는 서비스가 토큰 내용을 수락하기 전에 올바른 유형이며 의도된 목적을 위한 것인지 토큰을 검증하는지 확인해야 한다. 예를 들어, 인가 결정에는 액세스 토큰만 허용될 수 있으며, 사용자 인증을 증명하는 데는 ID 토큰만 사용될 수 있다.",,✓,✓,, +V9,자체 포함 토큰(self-contained token),V9.2,토큰 내용,V9.2.3,"서비스가 대상 서비스(audience)와 함께 사용하기 위한 토큰만 허용하는지 검증해야 한다. JWT의 경우, 서비스에 정의된 허용 목록에 대해 'aud' 클레임을 검증함으로써 이를 달성할 수 있다.",,✓,✓,, +V9,자체 포함 토큰(self-contained token),V9.2,토큰 내용,V9.2.4,"토큰 발행자가 다른 대상(audience)에게 토큰을 발행하기 위해 동일한 개인 키를 사용하는 경우, 발행된 토큰이 의도된 대상을 고유하게 식별하는 대상 제한을 포함하는지 검증해야 한다. 이는 토큰이 의도하지 않은 대상에서 재사용되는 것을 방지한다. 대상 식별자가 동적으로 프로비저닝되는 경우, 토큰 발행자는 대상 위장(audience impersonation)을 초래하지 않도록 대상들을 검증해야 한다.",,✓,✓,, +V10,OAuth와 OIDC,V10.1,일반적인 OAuth 및 OIDC 보안,V10.1.1,"엄격하게 필요한 구성 요소에만 토큰이 전송되는지 검증해야 한다. 예를 들어, 브라우저 기반 JavaScript 애플리케이션에 프론트엔드 전용 백엔드(Backend For Frontend; BFF) 패턴을 사용하는 경우, 액세스 토큰 및 리프레시 토큰은 백엔드에서만 접근 가능해야 한다.",,✓,✓,, +V10,OAuth와 OIDC,V10.1,일반적인 OAuth 및 OIDC 보안,V10.1.2,"클라이언트는 인가 서버에서 제공하는 값(예: 인가 코드 또는 ID 토큰)이 동일한 사용자 에이전트 세션 및 트랜잭션에서 시작된 인가 플로우의 결과인 경우에만 허용하는지 검증해야 한다. 이를 위해 클라이언트가 생성하는 비밀 값(PKCE(Proof Key for Code Exchange)의 'code_verifier', 'state', OIDC의 'nonce' 등)은 추측이 불가능해야 하며, 해당 트랜잭션에 고유해야 하고, 트랜잭션이 시작된 클라이언트와 사용자 에이전트 세션 양쪽에 안전하게 결합(Binding)되어 있어야 한다.",,✓,✓,, +V10,OAuth와 OIDC,V10.2,OAuth 클라이언트,V10.2.1,"코드 플로우를 사용하는 경우, OAuth 클라이언트는 토큰 요청을 유도하는 사이트 간 요청 위조 공격(Cross-Site Request Forgery; CSRF)에 대한 보호 기능을 갖추고 있는지 검증한다. 이를 위해 인가 요청 시 전송된 'state' 파라미터를 검증하거나, PKCE 기능을 사용해야 한다.",,✓,✓,, +V10,OAuth와 OIDC,V10.2,OAuth 클라이언트,V10.2.2,"OAuth 클라이언트가 둘 이상의 인가 서버와 상호 작용할 수 있는 경우, 믹스업 공격에 대한 방어 대책을 갖는지 검증해야 한다. 예를 들어, 인가 서버가 'iss' 파라미터 값을 반환하도록 요구하고 인가 응답 및 토큰 응답에서 이를 검증할 수 있다.",,✓,✓,, +V10,OAuth와 OIDC,V10.2,OAuth 클라이언트,V10.2.3,OAuth 클라이언트가 인가 서버에 대한 요청에서 필요한 범위(또는 기타 인가 파라미터)만 요청하는지 검증해야 한다.,,,✓,, +V10,OAuth와 OIDC,V10.3,OAuth 리소스 서버,V10.3.1,"리소스 서버가 해당 서비스(audience)에 사용하도록 의도된 액세스 토큰만 수락하는지 검증해야 한다. 대상은 구조화된 액세스 토큰(예: JWT의 'aud' 클레임)에 포함될 수 있거나, 토큰 조회 엔드포인트를 사용하여 확인할 수 있다.",,✓,✓,, +V10,OAuth와 OIDC,V10.3,OAuth 리소스 서버,V10.3.2,"리소스 서버가 위임된 인가를 정의하는 액세스 토큰의 클레임을 기반으로 인가 결정을 시행하는지 검증해야 한다. 'sub', 'scope', 'authorization_details'와 같은 클레임이 존재하는 경우, 이는 결정에 반영되어야 한다.",,✓,✓,, +V10,OAuth와 OIDC,V10.3,OAuth 리소스 서버,V10.3.3,"액세스 토큰(JWT 또는 관련 토큰 조회 응답)에서 고유한 사용자를 식별해야 하는 접근 제어 결정이 필요한 경우, 리소스 서버가 다른 사용자에게 재할당될 수 없는 클레임에서 사용자를 식별하는지 검증해야 한다. 일반적으로 이는 'iss' 및 'sub' 클레임의 조합을 사용하는 것을 의미한다.",,✓,✓,, +V10,OAuth와 OIDC,V10.3,OAuth 리소스 서버,V10.3.4,"리소스 서버가 특정 인증 강도, 방법 또는 최신성을 요구하는 경우, 제시된 액세스 토큰이 이러한 제약 조건을 충족하는지 검증해야 한다. 예를 들어, 토큰을 제시한 경우 OIDC의 'acr', 'amr' 및 'auth_time' 클레임을 각각 사용해야 한다.",,✓,✓,, +V10,OAuth와 OIDC,V10.3,OAuth 리소스 서버,V10.3.5,"리소스 서버가 발신자 제약 액세스 토큰, 즉 OAuth 2용 상호 TLS(Mutual TLS; mTLS) 또는 OAuth 2 소유 증명(Demonstration of Proof of Possession; DPoP)를 요구하여 도난된 액세스 토큰 사용 또는 액세스 토큰 재사용(권한 없는 당사자로부터)을 방지하는지 검증해야 한다.",,,✓,, +V10,OAuth와 OIDC,V10.4,OAuth 인가 서버,V10.4.1,인가 서버는 클라이언트 별로 사전 등록된 URI의 허용 목록을 기반으로 리디렉션 URI를 정확한 문자열 비교 방식으로 검증해야 한다.,✓,✓,✓,, +V10,OAuth와 OIDC,V10.4,OAuth 인가 서버,V10.4.2,"인가 서버가 인가 응답에서 인가 코드를 반환하는 경우, 해당 코드는 토큰 요청에 한번만 사용될 수 있어야 한다. 이미 액세스 토큰을 발급하는 데 사용된 인가 코드를 사용하여 두 번째 요청이 발생하면, 인가 서버는 토큰 요청을 거부하고 해당 인가 코드와 관련된 모든 발급된 토큰을 취소해야 한다.",✓,✓,✓,, +V10,OAuth와 OIDC,V10.4,OAuth 인가 서버,V10.4.3,"인가 코드가 단기간만 유효한지 검증해야 한다. 최대 수명은 L1 및 L2 애플리케이션의 경우 최대 10분, L3 애플리케이션의 경우 최대 1분 이내여야 한다.",✓,✓,✓,, +V10,OAuth와 OIDC,V10.4,OAuth 인가 서버,V10.4.4,"인가 서버는 특정 클라이언트에 대해, 해당 클라이언트가 사용할 필요가 있는 인가 방식(grant)만 사용하도록 허용해야 한다. token(암시적 플로우) 및 password(리소스 소유자 비밀번호 자격 증명 플로우) 방식은 더 이상 사용되어서는 안 된다.",✓,✓,✓,, +V10,OAuth와 OIDC,V10.4,OAuth 인가 서버,V10.4.5,"인가 서버가 공개 클라이언트에 대한 리프레시 토큰 재사용 공격을 완화하는지 검증해야 한다. 가급적이면 발신자 제약 리프레시 토큰, 즉 소유 증명이나 mTLS를 사용한 인증서 바인딩 액세스 토큰을 사용해야 한다. L1 및 L2 애플리케이션의 경우, 리프레시 토큰 회전(rotation)이 사용될 수 있다. 리프레시 토큰 회전이 사용되는 경우, 인가 서버는 리프레시 토큰을 사용 후 무효화해야 하며, 이미 사용되고 무효화된 리프레시 토큰이 제공되면 해당 인가에 대한 모든 리프레시 토큰을 철회(revoke)해야 한다.",✓,✓,✓,, +V10,OAuth와 OIDC,V10.4,OAuth 인가 서버,V10.4.6,"코드 인가 방식(code grant)이 사용되는 경우, 인가 서버가 PKCE를 요구하여 인가 코드 탈취 공격을 완화하는지 검증해야 한다. 인가 요청의 경우, 인가 서버는 유효한 'code_challenge' 값을 요구해야 하며, 'code_challenge_method'값으로 'plain'를 허용해서는 안 된다. 토큰 요청의 경우, 'code_verifier' 파라미터의 검증을 요구해야 한다.",,✓,✓,, +V10,OAuth와 OIDC,V10.4,OAuth 인가 서버,V10.4.7,"인가 서버가 인증되지 않은 동적 클라이언트 등록을 지원하는 경우, 악의적인 클라이언트 애플리케이션의 위험을 완화하는지 검증해야 한다. 등록된 URI와 같은 클라이언트 메타데이터를 검증하고, 사용자의 동의를 확인해야 하며, 신뢰할 수 없는 클라이언트 애플리케이션으로 인가 요청을 처리하기 전에 사용자에게 경고해야 한다.",,✓,✓,, +V10,OAuth와 OIDC,V10.4,OAuth 인가 서버,V10.4.8,"슬라이딩 리프레시 토큰 만료(expiration)가 적용되더라도, 리프레시 토큰에 절대 만료 시점(absolute expiration)이 포함되어 있는지 확인한다.",,✓,✓,, +V10,OAuth와 OIDC,V10.4,OAuth 인가 서버,V10.4.9,악의적인 클라이언트 또는 도난된 토큰의 위험을 완화하기 위해 인가 서버 사용자 인터페이스를 통해 권한 있는 사용자가 리프레시 토큰 및 참조 액세스 토큰을 철회할 수 있는지 검증해야 한다.,,✓,✓,, +V10,OAuth와 OIDC,V10.4,OAuth 인가 서버,V10.4.10,"토큰 요청, 푸시된 인가 요청(Pushed Authorization Request; PAR), 토큰 철회 요청과 같은 클라이언트에서 인가 서버로의 백채널 요청(backchannel request)에 대해 기밀 클라이언트가 인증되는지 검증해야 한다.",,✓,✓,, +V10,OAuth와 OIDC,V10.4,OAuth 인가 서버,V10.4.11,인가 서버 구성이 OAuth 클라이언트에 필요한 범위만 할당하는지 검증해야 한다.,,✓,✓,, +V10,OAuth와 OIDC,V10.4,OAuth 인가 서버,V10.4.12,"주어진 클라이언트에 대해 인가 서버가 해당 클라이언트가 사용해야 하는 'response_mode' 값만 허용하는지 검증해야 한다. 예를 들어, 인가 서버가 이 값을 예상 값과 비교하여 검증하거나, PAR 또는 JWT 기반 인가 요청(JWT-secured Authorization Request; JAR)을 사용하여 검증해야 한다.",,,✓,, +V10,OAuth와 OIDC,V10.4,OAuth 인가 서버,V10.4.13,인가 유형 'code'가 항상 PAR과 함께 사용되는지 검증해야 한다.,,,✓,, +V10,OAuth와 OIDC,V10.4,OAuth 인가 서버,V10.4.14,인가 서버가 mTLS를 사용하는 인증서 바인딩 액세스 토큰 또는 소유 증명 바인딩 액세스 토큰을 사용하여 발신자 제약(Proof-of-Possession) 액세스 토큰만 발급하는지 검증해야 한다.,,,✓,, +V10,OAuth와 OIDC,V10.4,OAuth 인가 서버,V10.4.15,"최종 사용자 장치에서 실행되지 않는 서버에서 동작하는 클라이언트의 경우, 인가 서버가 'authorization_details' 파라미터 값이 클라이언트 백엔드로부터 생성되었는지와 사용자가 해당 값을 변조되지 않았는지를 검증해야 한다. 예를 들어, PAR 또는 JAR의 사용을 요구하여 확인해야 한다.",,,✓,, +V10,OAuth와 OIDC,V10.4,OAuth 인가 서버,V10.4.16,"클라이언트가 기밀 클라이언트인지 검증하고, 인가 서버는 재사용 공격에 강하고 공개키 암호화에 기반한 강력한 클라이언트 인증 방식을 사용하도록 요구해야 한다. 예를 들어, mTLS(tls_client_auth, self_signed_tls_client_auth) 또는 비공개 키 기반 JWT 인증(private_key_jwt) 등이 이에 해당한다.",,,✓,, +V10,OAuth와 OIDC,V10.5,OIDC 클라이언트,V10.5.1,"신뢰 당사자로서 클라이언트가 ID 토큰 재사용 공격을 완화하는지 검증해야 한다. 예를 들어, ID 토큰의 'nonce' 클레임이 OpenID 공급자에 전송된 인증 요청(OAuth2에서는 인가 서버에 전송된 인가 요청)에서 전송된 'nonce' 값과 일치하는지 확인해야 한다.",,✓,✓,, +V10,OAuth와 OIDC,V10.5,OIDC 클라이언트,V10.5.2,"클라이언트가 ID 토큰 클레임, 일반적으로 'sub' 클레임에서 사용자를 고유하게 식별하며, 해당 클레임이 ID 공급자 범위 내에서 다른 사용자에게 재할당될 수 없는지 검증해야 한다.",,✓,✓,, +V10,OAuth와 OIDC,V10.5,OIDC 클라이언트,V10.5.3,"클라이언트는 악의적인 인가 서버가 인가 서버 메타데이터를 통해 다른 인가 서버를 가장하려는 시도를 거부하는지 검증해야 한다. 클라이언트는 인가 서버 메타데이터에 포함된 발급자(issuer) URL이 클라이언트가 예상하는 사전 구성된 발급자 URL과 정확히 일치하지 않는 경우, 해당 메타데이터를 거부해야 한다.",,✓,✓,, +V10,OAuth와 OIDC,V10.5,OIDC 클라이언트,V10.5.4,클라이언트는 토큰의 aud 클레임 값이 클라이언트의 client_id 값과 동일한지 확인하여 ID 토큰이 해당 클라이언트(audience)를 대상으로 발급되었음을 검증해야 한다.,,✓,✓,, +V10,OAuth와 OIDC,V10.5,OIDC 클라이언트,V10.5.5,"OIDC 백채널 로그아웃을 사용하는 경우, 신뢰 당사자는 강제 로그아웃을 통한 서비스 거부 공격(Denial of Service) 및 로그아웃 플로우에서의 JWT 혼동(cross-JWT confusion)을 완화하는지 검증해야 한다. 클라이언트는 로그아웃 토큰이 'logout+jwt' 값으로 올바르게 지정되어 있는지, 올바른 멤버 이름을 가진 'event' 클레임을 포함하는지, 그리고 'nonce' 클레임을 포함하지 않는지 검증해야 한다. 또한, 짧은 만료 시간(예: 2분)을 갖는 것이 권장된다.",,✓,✓,, +V10,OAuth와 OIDC,V10.6,OpenID 공급자,V10.6.1,"OpenID 공급자는 response_mode 파라미터 값으로'code', 'ciba', 'id_token' 또는 'id_token code' 만 허용하는지 검증해야 한다. 이 중 'id_token code'(OIDC 하이브리드 플로우)보다는 'code'가 선호되며, 'token'(모든 암시적 플로우)은 사용되어서는 안 된다.",,✓,✓,, +V10,OAuth와 OIDC,V10.6,OpenID 공급자,V10.6.2,"OpenID 공급자가 강제 로그아웃을 통한 서비스 거부 공격을 완화하는지 검증해야 한다. 신뢰 당사자로 부터 시작된 로그아웃 요청에 id_token_hint 등의 파라미터가 포함되어 있는 경우, 이를 검증하거나 최종 사용자로부터 명시적인 확인을 받아야 한다.",,✓,✓,, +V10,OAuth와 OIDC,V10.7,동의 관리,V10.7.1,"인가 서버가 사용자로부터 각 인가 요청에 대한 명시적인 동의(consent)를 확인하는지 검증해야 한다. 클라이언트의 신원을 보장할 수 없는 경우, 인가 서버는 항상 사용자에게 명시적으로 동의를 요청해야 한다.",,✓,✓,, +V10,OAuth와 OIDC,V10.7,동의 관리,V10.7.2,"인가 서버가 사용자 동의를 요청할 때, 동의하는 내용에 대한 충분하고 명확한 정보를 제공하는지 검증해야 한다. 이에 해당하는 경우, 요청된 인가의 성격(일반적으로 범위, 리소스 서버, RAR(Rich Authorization Requests) 인가 세부 정보 기반), 인가된 애플리케이션의 신원, 인가의 유효 기간이 포함되어야 한다.",,✓,✓,, +V10,OAuth와 OIDC,V10.7,동의 관리,V10.7.3,"사용자가 인가 서버를 통해 부여한 동의를 검토, 수정 및 철회할 수 있는지 검증해야 한다.",,✓,✓,, +V11,암호화,V11.1,암호화 인벤토리 및 문서화,V11.1.1,'NIST SP 800-57'과 같은 암호화 키 관리 및 키 관리 표준을 따르는 암호화 키 수명 주기에 대한 문서화 된 정책이 있는지 검증해야 한다. 여기에는 키가 과도하게 공유되지 않도록 하는 것이 포함된다(예: 공유 비밀의 경우 두 개를 초과하는 엔터티와 공유 및 개인 키의 경우 한 개를 초과하는 엔터티에 공유).,,✓,✓,, +V11,암호화,V11.1,암호화 인벤토리 및 문서화,V11.1.2,"애플리케이션에서 사용되는 모든 암호화 키, 알고리즘, 인증서를 포함한 암호화 자산 목록(cryptographic inventory)이 작성되고, 유지되며, 정기적으로 업데이트되고 있는지 검증해야 한다. 또한, 각 키가 시스템 내에서 사용 가능한 위치와 사용이 제한되는 위치, 해당 키로 보호할 수 있는 데이터 유형과 보호할 수 없는 데이터 유형이 문서화되어 있어야 한다.",,✓,✓,, +V11,암호화,V11.1,암호화 인벤토리 및 문서화,V11.1.3,"암호화, 해싱, 서명 작업을 포함하는 시스템 내의 모든 암호화 사용 사례를 식별하기 위해, 암호화 사용 탐지 메커니즘이 적용되는지 검증해야 한다.",,,✓,, +V11,암호화,V11.1,암호화 인벤토리 및 문서화,V11.1.4,암호화 자산 목록이 유지 관리되는지 검증해야 한다. 여기에는 미래의 위협에 대응하기 위해 양자 내성 암호(Post-Quantum Cryptography; PQC)와 같은 새로운 암호화 표준으로의 마이그레이션 계획을 설명하는 문서화된 계획이 포함되어야 한다.,,,✓,, +V11,암호화,V11.2,안전한 암호화 구현,V11.2.1,암호화 작업에 업계에서 검증된 구현(라이브러리 및 하드웨어 가속 구현 포함)이 사용되는지 검증해야 한다.,,✓,✓,, +V11,암호화,V11.2,안전한 암호화 구현,V11.2.2,"난수, 인증 암호화, MAC, 해싱 알고리즘, 키 길이, 라운드, 암호 및 모드를 언제든지 재구성, 업그레이드 또는 교체하여 암호화 해독으로부터 보호할 수 있도록 애플리케이션이 암호화 유연성(crypto agility)을 갖추고 설계되었는지 검증해야 한다. 또한, 키와 비밀번호를 교체하고 데이터를 다시 암호화하는 것도 가능해야 한다. 이를 통해 승인된 PQC 체계(또는 표준)의 고신뢰 구현이 널리 사용 가능해지면 PQC로 원활하게 업그레이드할 수 있다.",,✓,✓,, +V11,암호화,V11.2,안전한 암호화 구현,V11.2.3,"모든 암호화 기본 구성요소(primitive)가 알고리즘, 키 크기 및 구성에 따라 최소 128비트의 보안강도를 제공하는지 검증해야 한다. 예를 들어, 256비트 ECC 키는 대략 128비트의 보안을 제공하며, RSA는 128비트의 보안을 달성하기 위해 3072비트 키를 필요로 한다.",,✓,✓,, +V11,암호화,V11.2,안전한 암호화 구현,V11.2.4,"민감한 정보가 누출되는 것을 방지하기 위해 모든 암호화 연산은 상수 시간(constant-time)으로 수행되어야 하며, 비교, 계산, 반환 과정에서 단락(short-circuit) 연산이 없는지 검증해야 한다.",,,✓,, +V11,암호화,V11.2,안전한 암호화 구현,V11.2.5,"모든 암호화 모듈이 안전하게 실패하고, 패딩 오라클 공격(Padding Oracle attacks)과 같은 취약점을 허용하지 않는 방식으로 오류가 처리되는지 검증해야 한다.",,,✓,, +V11,암호화,V11.3,암호화 알고리즘,V11.3.1,안전하지 않은 블록 모드(예: ECB) 및 약한 패딩 방식(예: PKCS#1 v1.5)가 사용되지 않는지 검증해야 한다.,✓,✓,✓,, +V11,암호화,V11.3,암호화 알고리즘,V11.3.2,GCM을 사용하는 AES와 같이 승인된 암호 및 모드만 사용되는지 검증해야 한다.,✓,✓,✓,, +V11,암호화,V11.3,암호화 알고리즘,V11.3.3,"암호화 된 데이터가 승인된 인증된 암호화 방식을 사용하거나, 승인된 암호화 방식과 승인된 MAC 알고리즘을 조합을 통한 무단 수정으로부터 보호되는지 검증해야 한다.",,✓,✓,, +V11,암호화,V11.3,암호화 알고리즘,V11.3.4,"논스(nonces), 초기화 벡터 및 기타 단일 사용 번호가 둘 이상의 암호화 키 및 데이터 요소 쌍에 사용되지 않는지 검증해야 한다. 생성 방법은 사용되는 알고리즘에 적합해야 한다.",,,✓,, +V11,암호화,V11.3,암호화 알고리즘,V11.3.5,암호화 알고리즘과 MAC 알고리즘의 모든 조합이 암호화 후 MAC(Encrypt-then-MAC) 방식으로 동작하는지 검증해야 한다.,,,✓,, +V11,암호화,V11.4,해싱 및 해시 기반 함수,V11.4.1,"디지털 서명, HMAC, KDF 및 무작위 비트 생성을 포함한 일반적인 암호화 사용 사례에 승인된 해시 함수만 사용되는지 검증해야 한다. MD5와 같이 허용되지 않는 해시 함수는 어떤 암호화 목적으로도 사용해서는 안 된다.",✓,✓,✓,, +V11,암호화,V11.4,해싱 및 해시 기반 함수,V11.4.2,"비밀번호가 승인된 '계산 집약적인 키 유도 함수(""비밀번호 해싱 함수""라고도 함)'를 사용하여 저장되고, 파라미터 설정이 현재 지침에 따라 구성되었는지 검증해야 한다. 설정은 필요한 보안 수준에 대한 무차별 대입 공격을 충분히 어렵게 만들기 위해 보안과 성능의 균형을 이루어야 한다.",,✓,✓,, +V11,암호화,V11.4,해싱 및 해시 기반 함수,V11.4.3,"데이터 인증 또는 데이터 무결성의 일부로 디지털 서명에 사용되는 해시 함수가 충돌 저항성을 가지며 적절한 비트 길이를 갖는지 검증해야 한다. 충돌 저항성이 필요한 경우, 출력 길이는 최소 256비트여야 한다. 제2 역상(pre-image) 공격 저항성만 필요한 경우, 출력 길이는 최소 128비트여야 한다.",,✓,✓,, +V11,암호화,V11.4,해싱 및 해시 기반 함수,V11.4.4,비밀번호로부터 비밀 키를 유도할 때 애플리케이션이 키 스트레칭(key stretching) 파라미터를 사용하여 승인된 키 유도 함수(key derivation function)를 사용하는지 검증해야 한다. 사용 중인 파라미터는 결과적인 암호화 키를 손상시키는 무차별 대입 공격을 방지하기 위해 보안과 성능의 균형을 이루어야 한다.,,✓,✓,, +V11,암호화,V11.5,무작위 값,V11.5.1,예측 불가능해야 하는 모든 난수 및 문자열이 암호학적으로 안전한 의사 난수 생성기(CSPRNG)를 사용하여 생성되고 최소 128비트의 엔트로피를 갖는지 검증해야 한다. UUID는 이 조건을 충족하지 않는다.,,✓,✓,, +V11,암호화,V11.5,무작위 값,V11.5.2,사용 중인 난수 생성 메커니즘이 높은 부하(heavy demand)에서도 안전하게 작동하도록 설계되었는지 검증해야 한다.,,,✓,, +V11,암호화,V11.6,공개 키 암호화,V11.6.1,"키 생성 및 시딩, 디지털 서명 생성 및 검증에 승인된 암호화 알고리즘 및 작동 모드만 사용되는지 검증해야 한다. 키 생성 알고리즘은 알려진 공격에 취약한 안전하지 않은 키(예: 페르마 인수분해(Fermat factorization)에 취약한 RSA 키)를 생성해서는 안 된다.",,✓,✓,, +V11,암호화,V11.6,공개 키 암호화,V11.6.2,"키 교환에는 디피-헬만과 같은 승인된 암호화 알고리즘이 사용되어야 하며, 안전한 파라미터를 사용하는지 여부를 중점적으로 검증해야 한다.이는 중간자 공격(adversary-in-the-middle attacks) 또는 암호화 해독으로 이어질 수 있는 키 설정 프로세스에 대한 공격을 방지할 것이다.",,,✓,, +V11,암호화,V11.7,사용 중 데이터 암호화,V11.7.1,사용 중인 민감한 데이터를 보호하고 무단 사용자 또는 프로세스의 접근을 방지하기 위해 전체 메모리 암호화가 사용되는지 검증해야 한다.,,,✓,, +V11,암호화,V11.7,사용 중 데이터 암호화,V11.7.2,"데이터 최소화가 처리 중에 노출되는 데이터의 양을 최소화하고, 사용 직후 또는 가능한 한 빨리 데이터가 암호화되도록 보장하는지 검증해야 한다.",,,✓,, +V12,보안 통신,V12.1,일반 TLS 보안 가이드,V12.1.1,"TLS 1.2 및 TLS 1.3과 같은 최신 권장 버전의 TLS 프로토콜만 활성화되어 있으며, 그중 최신 버전이 우선되어야 한다.",✓,✓,✓,, +V12,보안 통신,V12.1,일반 TLS 보안 가이드,V12.1.2,오직 권장되는 암호화 스위트(cipher suites)들이 활성화되어 있으며 그 중 가장 강력한 암호화 스위트로 우선 설정되어 있는지 확인한다. 레벨3 애플리케이션은 순방향 비밀성(forward secrecy)을 제공하는 암호화 스위트만 지원해야 한다.,,✓,✓,, +V12,보안 통신,V12.1,일반 TLS 보안 가이드,V12.1.3,인증이나 권한 부여를 위해 인증서 ID를 사용하기 전에 애플리케이션이 mTLS 클라이언트 인증서가 신뢰할 수 있는지 검증해야 한다.,,✓,✓,, +V12,보안 통신,V12.1,일반 TLS 보안 가이드,V12.1.4,Online Certificate Status Protocol (OCSP) 스테이플링(Stapling)과 같은 적절한 인증서 폐지 프로토콜이 활성화되고 설정되어 있는지 확인해야 한다.,,,✓,, +V12,보안 통신,V12.1,일반 TLS 보안 가이드,V12.1.5,TLS 핸드셰이크 프로세스 중 Server Name Indication (SNI)과 같은 민감한 메타 데이터의 노출을 방지하기 위해 애플리케이션 TLS 설정에서 Encrypted Client Hello (ECH)가 활성화되어 있는지 확인해야 한다.,,,✓,, +V12,보안 통신,V12.2,외부 서비스와의 HTTPS 통신,V12.2.1,"TLS는 클라이언트와 외부 HTTP 기반 서비스 간의 모든 연결에 사용되며, 안전하지 않거나 암호화 되어 있지 않은 통신에 대체 동작(fall back)이 발생하지 않는지 확인해야한다. ",✓,✓,✓,, +V12,보안 통신,V12.2,외부 서비스와의 HTTPS 통신,V12.2.2,외부 서비스가 공적으로 신뢰된 TLS 인증서를 사용하는지 확인해야 한다.,✓,✓,✓,, +V12,보안 통신,V12.3,일반 서비스 간의 통신 보안,V12.3.1,"애플리케이션간의 모니터링 시스템, 관리 도구, 원격 엑세스 및 SSH, 미들웨어, 데이터베이스, 메인프레임, 파트너 시스템이나 외부 API를 포함한 모든 인바운드와 아웃바운드 통신은 TLS같은 암호화 프로토콜이 사용되는지 확인해야 한다. 이 서버는 안전하지 않거나 암호화 되어있지 않은 프로토콜에 대체 동작(fall back)이 발생하지 않아야 한다.",,✓,✓,, +V12,보안 통신,V12.3,일반 서비스 간의 통신 보안,V12.3.2,TLS 클라이언트가 통신하기 전에 TLS서버로 부터 받은 인증서를 검증하는지 확인해야 한다.,,✓,✓,, +V12,보안 통신,V12.3,일반 서비스 간의 통신 보안,V12.3.3,그리고 TLS 또는 애플리케이션 내의 내부 HTTP 기반 서비스간에 사용된 다른 적절한 전송 암호화 매커니즘이 안전하지 않거나 암호화 되어있지 않은 통신에 대체 동작(fall back)이 발생하지 않는지 확인해야 한다.,,✓,✓,, +V12,보안 통신,V12.3,일반 서비스 간의 통신 보안,V12.3.4,"내부 서버간에 TLS 통신이 신뢰된 인증서를 사용하는지 확인해야 한다. 내부 인증서나 자체 서명(self-signed)인증서를 사용할 경우, 이를 사용하는 서비스는 오직 특정 내부 인증기관(CA)과 자체 서명 인증만을 신뢰하게 설정해야 한다.",,✓,✓,, +V12,보안 통신,V12.3,일반 서비스 간의 통신 보안,V12.3.5,시스템 내부에서 통신하는 서비스(intra-service communication)는 각 엔드포인트를 검증하기 위해 강력한 인증을 사용해야 한다. 공용키(public-key) 기반 구조와 재전송 공격(replay attacks)에 저항하는 매커니즘을 사용하여 신원보장을 위해 TLS 클라이언트 인증과 같은 강력한 인증 방식을 사용해야 한다. 마이크로서비스 아키텍쳐의 경우 인증서 관리를 간소화 하고 보안을 강화하기 위해 서비스 매시(service mesh)를 사용하는 것을 고려해야 한다.,,,✓,, +V13,설정,V13.1,설정 문서,V13.1.1,"애플리케이션의 모든 통신 요구사항이 문서화 되어 있는지를 검증한다. 이는 애플리케이션이 의존하는 외부 서비스나, 사용자가 애플리케이션이 연결할 외부 위치를 제공하는 경우들을 포함한다.",,✓,✓,, +V13,설정,V13.1,설정 문서,V13.1.2,"애플리케이션이 사용하는 각각의 서비스들에 대해, 문서가 최대 동시 연결 수(연결 풀 제한)를 정의하고 있는지, 그리고 그 한계에 다다랐을 때 폴백(fallback)이나 복구 메커니즘 등을 포함하여, DoS 공격을 방지하기 위해 애플리케이션이 어떻게 동작하는지를 검증한다.",,,✓,, +V13,설정,V13.1,설정 문서,V13.1.3,"애플리케이션 문서가 모든 외부 시스템이나 애플리케이션이 사용하는 서비스(예시: 데이터베이스, 파일 핸들, 스레드, HTTP 연결)들에 대한 자원-관리 전략을 정의하고 있는지 검증한다.이는 자원-해제 프로시저, 시간초과 설정, 오류 핸들링을 포함하며, 재시도 로직이 구현된 경우 재시도 제한과 지연, 백-오프 알고리즘을 명시해야 한다. 동기 HTTP 요청-응답 명령에 대해서는 짧은 타임아웃에 더해 재시도의 비활성화 혹은 연쇄적인 지연과 자원 고갈을 방지하기 위한 재시도의 엄격한 제한을 의무화해야 한다.",,,✓,, +V13,설정,V13.1,설정 문서,V13.1.4,"애플리케이션 문서가 조직의 위협 모델과 사업적 요구사항에 기반하여, 애플리케이션의 보안과 비밀 정보들의 주기적 갱신 일정에 치명적인 비밀 정보들을 정의하고 있는지 검증한다.",,,✓,, +V13,설정,V13.2,백엔드 통신 설정,V13.2.1,"API나 미들웨어와 같은 애플리케이션의 표준 사용자 세션 메커니즘을 지원하지 않는 백엔드 애플리케이션 컴포넌트와 데이터 계층 사이의 통신이 인증되어 있는지를 검증한다. 인증은 반드시 개별적인 서비스 계정과 단기간 토큰, 또는 인증서 기반 인증을 사용하고 비밀번호, API 키, 또는 접근 권한이 부여된 공유 계정 등의 자격 증명을 변경하지 않아선 안 된다. ",,✓,✓,, +V13,설정,V13.2,백엔드 통신 설정,V13.2.2,"로컬 또는 운영체제 서비스, API, 미들웨어, 그리고 데이터 계층을 포함한 백엔드 애플리케이션 컴포넌트 간의 통신이 최소 필요 권한이 할당된 계정들로 수행되는지 검증한다.",,✓,✓,, +V13,설정,V13.2,백엔드 통신 설정,V13.2.3,"만약 자격 증명이 서비스 인증을 위해 필요하다면, 소비자로부터 사용되는 그 자격 증명이 기본 자격 증명이 아님을 검증한다. (예시: root/root 또는 admin/admin)",,✓,✓,, +V13,설정,V13.2,백엔드 통신 설정,V13.2.4,"얼로우리스트가 애플리케이션의 통신이 허가된 외부 리소스나 시스템을 정의하기 위해 사용되는지 검증한다. (예시: 아웃바운드 요청, 데이터 로드, 파일 접근). 이 얼로우리스트는 애플리케이션 계층, 웹 서버, 방화벽 또는 다른 여러 계층의 조합으로 구현할 수 있다. ",,✓,✓,, +V13,설정,V13.2,백엔드 통신 설정,V13.2.5,웹이나 애플리케이션 서버에 요청을 보내거나 데이터나 파일을 로드 할 수 있는 리소스 또는 시스템의 얼로우리스트가 설정되어 있는지를 검증한다.,,✓,✓,, +V13,설정,V13.2,백엔드 통신 설정,V13.2.6,"애플리케이션이 별도의 서비스와 연결할 때, 각 연결이 최대 병렬연결, 최대 연결 도달 시의 동작, 연결 타임아웃, 재시도 전략 등 문서화된 설정에 따르는지 검증한다.",,,✓,, +V13,설정,V13.3,비밀 정보 관리,V13.3.1,"키 볼트와 같은 비밀 정보 관리 솔루션이 백엔드 비밀 정보들을 만들고 저장하고, 접근을 제어하고, 파기하기 위해 사용되고 있는지 검증한다. 이는 비밀번호, 키 재료, 데이터베이스와 서드 파티 시스템의 통합, 시간-기반 토큰을 위한 키와 시드, 그리고 API 키들을 포함할 수 있다. 비밀 정보들은 애플리케이션 소스 코드 내부나, 빌드 아티팩트에 포함되어서는 안 된다. L3 애플리케이션에 대해서는, 반드시 HSM과 같은 하드웨어 기반 솔루션을 사용해야 한다.",,✓,✓,, +V13,설정,V13.3,비밀 정보 관리,V13.3.2,비밀 정보 자원들에 대한 접근이 최소 권한의 원칙을 고수하는지 검증한다.,,✓,✓,, +V13,설정,V13.3,비밀 정보 관리,V13.3.3,"보안 모듈에 대한 외부의 노출로부터 안전하게 키 재료를 관리하고 보호하기 위해 모든 암호 연산이 고립된 보안 모듈(볼트나, 하드웨어 보안 모듈 등)을 사용하여 수행되는지 검증한다.",,,✓,, +V13,설정,V13.3,비밀 정보 관리,V13.3.4,애플리케이션의 문서를 기반으로 비밀 정보들이 만료되고 갱신되도록 설정되었는지 검증한다.,,,✓,, +V13,설정,V13.4,의도하지 않은 정보 노출,V13.4.1,"애플리케이션이 .git 이나 .svn 폴더 같은 소스 코드 관리 메타데이터 없이 배포되었는지, 또는 이 폴더들이 외부적으로든 애플리케이션 자체에서든 접근할 수 없도록 배포되었는지 검증한다. ",✓,✓,✓,, +V13,설정,V13.4,의도하지 않은 정보 노출,V13.4.2,"실제 운영환경에서 디버깅 기능 노출이나 정보 누출을 방지하기 위해, 모든 컴포넌트에서 디버그 모드가 비활성화되어 있는지 검증한다.",,✓,✓,, +V13,설정,V13.4,의도하지 않은 정보 노출,V13.4.3,분명히 의도된 것이 아닌 이상 웹 서버가 폴더 목록을 클라이언트에게 노출하지 않는지 검증한다.,,✓,✓,, +V13,설정,V13.4,의도하지 않은 정보 노출,V13.4.4,잠재적인 정보 누출을 방지하기 위해 실제 운영환경에서 HTTP TRACE 메소드 사용이 지원되지 않는지 검증한다. ,,✓,✓,, +V13,설정,V13.4,의도하지 않은 정보 노출,V13.4.5,분명히 의도된 것이 아닌 이상 문서(내부 API 같은)와 모니터링 엔드포인트가 노출되지 않는지 검증한다.,,✓,✓,, +V13,설정,V13.4,의도하지 않은 정보 노출,V13.4.6,애플리케이션이 백엔드 컴포넌트의 자세한 버전 정보를 노출하지 않는지 검증한다.,,,✓,, +V13,설정,V13.4,의도하지 않은 정보 노출,V13.4.7,"웹 계층이 의도적이지 않은 정보, 설정, 소스코드 누출을 방지하기 위해 특정 파일 확장자만 서비스하도록 설정되었는지 검증한다.",,,✓,, +V14,데이터 보호,V14.1,데이터 보호 문서화,V14.1.1,"애플리케이션이 생성하고 처리하는 모든 민감한 데이터가 식별되고 보호 수준으로 분류되었는지 확인한다. 여기에는 단순히 인코딩되어 있고 쉽게 디코딩할 수 있는 데이터, 예를 들어 Base64 문자열이나 JWT 내부 평문 페이로드가 포함된다. 보호 수준은 애플리케이션이 준수해야 하는 모든 데이터 보호 및 개인정보 보호 관련 규정과 표준을 반드시 고려해야 한다.",,✓,✓,, +V14,데이터 보호,V14.1,데이터 보호 문서화,V14.1.2,"모든 민감한 데이터의 보호 수준에 대해 문서화된 요구사항이 있는지 확인한다. 반드시 여기에는(이에 한정되지 않지만) 일반적인 암호화, 무결성 검증, 보존 기간, 데이터 로그 기록 방식, 로그 내 민감한 데이터에 대한 접근 제어, 데이터베이스 암호화 수준, 사용할 개인정보 보호 및 개인정보 보호 강화 기술, 그리고 기타 기밀성 요구사항들 관련하여 포함되어야 한다.",,✓,✓,, +V14,데이터 보호,V14.2,일반 데이터 보호,V14.2.1,"민감한 데이터는 HTTP 메시지 본문이나 헤더 필드로만 서버에 전송되고, URL과 쿼리 문자열에는 API키나 세션토큰처럼 민감한 정보가 포함되지 않도록 검증한다.",✓,✓,✓,, +V14,데이터 보호,V14.2,일반 데이터 보호,V14.2.2,"서버 구성 요소에서 로드밸런서나 애플리케이션 캐시와 같은 민감한 데이터가 캐시되지 않게 하거나, 사용 후 해당 데이터를 안전하게 삭제하도록 검증한다.",,✓,✓,, +V14,데이터 보호,V14.2,일반 데이터 보호,V14.2.3,정의된 민감한 데이터가 애플리케이션의 통제를 벗어난 곳에서 원치 않는 수집을 예방하기 위해 신뢰할 수 없는 대상(예: 사용자 추적기)에게 전송되지 않도록 검증한다.,,✓,✓,, +V14,데이터 보호,V14.2,일반 데이터 보호,V14.2.4,"암호화, 무결성 검증, 보존, 데이터 로그 기록 방식, 로그 내 민감한 데이터 접근 제어, 개인정보 보호 및 개인정보 보호 강화 기술과 관련된 민감한 데이터 통제가, 해당 데이터 보호 수준에 대한 문서에 정의된 대로 구현되었는지 검증한다.",,✓,✓,, +V14,데이터 보호,V14.2,일반 데이터 보호,V14.2.5,"캐시 메커니즘이 해당 리소스에 대해 예상되는 콘텐츠 유형을 가진 응답만 캐시하고, 민감하거나 동적인 콘텐츠는 캐시하지 않도록 구성되어 있는지 검증한다. 존재하지 않는 파일에 접근했을 때 다른 유효한 파일을 반환하는 대신 웹 서버는 404 또는 302 응답을 반환해야 한다. 이는 Web Cache Deception 공격을 예방한다.",,,✓,, +V14,데이터 보호,V14.2,일반 데이터 보호,V14.2.6,"애플리케이션 기능에 필요한 최소한의 민감한 데이터만 반환을 검증한다. 예를 들어, 전체 신용카드 번호가 아닌 일부 숫자만 반환해야 한다. 만약 전체 데이터가 필요한 경우, 사용자가 구체적으로 조회하지 않는 한 사용자 인터페이스에서는 마스킹하는 것이 권장된다.",,,✓,, +V14,데이터 보호,V14.2,일반 데이터 보호,V14.2.7,"민감한 정보는 데이터 보존 분류 기준에 따라 관리되어야 하고, 오래되었거나 불필요한 데이터는 사전에 정의된 작업 또는 상황에 따라 자동으로 삭제되도록 검증한다.",,,✓,, +V14,데이터 보호,V14.2,일반 데이터 보호,V14.2.8,사용자가 제출한 파일의 메타데이터에서 사용자가 저장에 동의하지 않는 한 민감한 정보는 제거를 검증한다.,,,✓,, +V14,데이터 보호,V14.3,클라이언트 측 데이터 보호,V14.3.1,"클라이언트나 세션이 종료된 후에 브라우저 DOM과 같은 클라이언트 스토리지에서 인증된 데이터를 삭제되는지 검증한다. 이를 위해 ‘Clear-Site-Data’ HTTP 응답 헤더 필드를 사용할 수 있으나, 세션 종료 시 서버 연결이 불가능한 경우에도 클라이언트 측에서 해당 데이터를 삭제하는 것이 권장된다.",✓,✓,✓,, +V14,데이터 보호,V14.3,클라이언트 측 데이터 보호,V14.3.2,"애플리케이션이 브라우저에서 민감한 데이터가 캐시되지 않도록, (Cache-Control: no-store)충분한 캐시 방지 HTTP 응답 헤더 필드를 설정을 검증한다.",,✓,✓,, +V14,데이터 보호,V14.3,클라이언트 측 데이터 보호,V14.3.3,"브라우저 저장소(localStorage, sessionStorage, IndexedDB, 쿠키)에 저장되는 데이터에는 세션 토큰을 제외한 민감 데이터가 포함되지 않도록 검증한다.",,✓,✓,, +V15,보안 코딩 및 아키텍처,V15.1,보안 코딩 및 아키텍처 문서화,V15.1.1,"애플리케이션 문서에 취약점이 존재하는 서드파티 구성요소 버전 및 일반적인 라이브러리 업데이트에 대해, 해당 구성요소로부터 발생할 수 있는 위험을 최소화하기 위한 위험 기반 대응 기한이 정의되어 있는지 확인해야 한다.",✓,✓,✓,, +V15,보안 코딩 및 아키텍처,V15.1,보안 코딩 및 아키텍처 문서화,V15.1.2,"사용 중인 모든 서드파티 라이브러리에 대해 소프트웨어 자재 명세서(SBOM)와 같은 인벤토리가 유지되고 있으며, 해당 구성요소가 사전에 정의된 신뢰할 수 있고 지속적으로 관리되는 저장소에서 제공되는지 확인해야 한다.",,✓,✓,, +V15,보안 코딩 및 아키텍처,V15.1,보안 코딩 및 아키텍처 문서화,V15.1.3,"애플리케이션 문서에 시간 소모가 크거나 리소스 소비가 많은 기능이 식별되어 있으며, 해당 기능의 과도한 사용으로 인해 가용성이 손실되지 않도록 하는 방법과, 응답 생성이 소비자의 타임아웃보다 오래 걸리는 상황을 방지하는 방법이 포함되어 있는지 확인해야 한다. 가능한 방어 전략에는 비동기 처리, 큐(queue) 사용, 사용자 및 애플리케이션 단위의 병렬 처리 제한 등이 있다.",,✓,✓,, +V15,보안 코딩 및 아키텍처,V15.1,보안 코딩 및 아키텍처 문서화,V15.1.4,애플리케이션 문서에 위험한 구성요소로 간주되는 서드파티 라이브러리가 강조되어 있는지 확인해야 한다.,,,✓,, +V15,보안 코딩 및 아키텍처,V15.1,보안 코딩 및 아키텍처 문서화,V15.1.5,애플리케이션 문서에 위험한 기능을 사용하는 애플리케이션의 부분이 강조되어 있는지 확인해야 한다.,,,✓,, +V15,보안 코딩 및 아키텍처,V15.2,보안 아키텍처 및 종속성,V15.2.1,애플리케이션이 문서화된 업데이트 및 대응 기한을 위반하지 않은 구성요소만 포함하고 있는지 확인해야 한다.,✓,✓,✓,, +V15,보안 코딩 및 아키텍처,V15.2,보안 아키텍처 및 종속성,V15.2.2,"애플리케이션이 시간 소모가 크거나 리소스 소비가 많은 기능의 과도한 사용으로 인한 가용성 손실을 방지하기 위해, 해당 기능에 대한 문서화된 보안 결정 및 전략을 기반으로 방어 조치를 구현하고 있는지 확인해야 한다.",,✓,✓,, +V15,보안 코딩 및 아키텍처,V15.2,보안 아키텍처 및 종속성,V15.2.3,"운영 환경에 애플리케이션 기능 수행에 필요한 기능만 포함되어 있으며, 테스트 코드, 샘플 코드, 개발용 기능 등 불필요한 기능이 노출되지 않도록 구성되어 있는지 확인해야 한다.",,✓,✓,, +V15,보안 코딩 및 아키텍처,V15.2,보안 아키텍처 및 종속성,V15.2.4,"서드파티 구성요소 및 그 모든 전이 종속성(transitive dependencies)이 내부 또는 외부의 예상된 저장소에서 가져며, 의존성 혼동(dependency confusion) 공격의 위험이 없는지 확인해야 한다.",,,✓,, +V15,보안 코딩 및 아키텍처,V15.2,보안 아키텍처 및 종속성,V15.2.5,"애플리케이션이 위험한 기능을 포함하거나 위험한 구성요소를 사용하는 부분에 대해 샌드박싱, 캡슐화, 컨테이너화, 네트워크 수준 격리와 같은 추가적인 보호 기법을 구현하여, 애플리케이션의 한 부분이 침해되더라도 공격자가 다른 영역으로 확산하지 못하도록 지연 및 차단하고 있는지 확인해야 한다.",,,✓,, +V15,보안 코딩 및 아키텍처,V15.3,방어적(Defensive) 코딩,V15.3.1,"애플리케이션이 데이터 객체에서 필요한 필드만 선택적으로 반환하고 있는지 확인해야 한다. 예를 들어, 일부 필드는 사용자에게 노출되어서는 안 되므로 전체 데이터 객체를 반환해서는 안 된다.",✓,✓,✓,, +V15,보안 코딩 및 아키텍처,V15.3,방어적(Defensive) 코딩,V15.3.2,"애플리케이션 백엔드에서 외부 URL로 요청을 보낼 때, 의도된 기능이 아닌 경우 리디렉션을 따르지 않도록 구성되어 있는지 확인해야 한다.",,✓,✓,, +V15,보안 코딩 및 아키텍처,V15.3,방어적(Defensive) 코딩,V15.3.3,"애플리케이션이 각 컨트롤러 및 액션 단위로 허용된 필드를 제한함으로써, 대량 할당(mass assignment) 공격에 대한 방어가 구현되어 있는지 확인해야 한다. 예를 들어, 특정 동작에 포함되지 않은 필드 값을 삽입하거나 수정할 수 없어야 한다.",,✓,✓,, +V15,보안 코딩 및 아키텍처,V15.3,방어적(Defensive) 코딩,V15.3.4,"모든 프록시 및 미들웨어 구성요소가 사용자의 원래 IP 주소를 신뢰 가능한 데이터 필드를 통해 정확하게 전달하고 있으며, 애플리케이션과 웹 서버가 이 값을 로그 기록이나 속도 제한(rate limiting)과 같은 보안 결정에 사용하는지 확인해야 한다. 단, 동적 IP, VPN, 방화벽 등으로 인해 원래 IP조차 완전히 신뢰할 수 없는 점도 고려해야 한다.",,✓,✓,, +V15,보안 코딩 및 아키텍처,V15.3,방어적(Defensive) 코딩,V15.3.5,"애플리케이션이 변수의 타입이 올바른지 명시적으로 확인하고, 엄격한 동등성 비교 및 연산자를 사용하여 타입 혼용(type juggling) 또는 타입 혼동(type confusion)으로 인한 취약점을 방지하고 있는지 확인해야 한다.",,✓,✓,, +V15,보안 코딩 및 아키텍처,V15.3,방어적(Defensive) 코딩,V15.3.6,"JavaScript 코드가 프로토타입 오염(prototype pollution)을 방지할 수 있도록 작성되어 있는지 확인해야 한다. 예를 들어, 객체 리터럴 대신 `Set()` 또는 `Map()`을 사용하는 방식이 권장된다.",,✓,✓,, +V15,보안 코딩 및 아키텍처,V15.3,방어적(Defensive) 코딩,V15.3.7,"애플리케이션이 HTTP 파라미터 오염(HTTP parameter pollution) 공격에 대한 방어를 구현하고 있는지 확인해야 한다. 특히, 애플리케이션 프레임워크가 요청 파라미터의 출처(쿼리 스트링, 본문, 쿠키, 헤더)를 구분하지 않는 경우 이를 고려해야 한다.",,✓,✓,, +V15,보안 코딩 및 아키텍처,V15.4,안전한 동시성,V15.4.1,"다중 스레드 코드에서 캐시, 파일, 다수 스레드가 접근하는 메모리 내 객체 등 공유 객체에 접근할 때, 스레드 세이프(thread-safe) 타입과 락·세마포어 같은 동기화 메커니즘을 사용하여 경쟁 상태와 데이터 손상을 피하고 안전하게 접근하는지 확인해야 한다.",,,✓,, +V15,보안 코딩 및 아키텍처,V15.4,안전한 동시성,V15.4.2,"리소스의 존재 여부나 권한과 같은 상태 검사와, 그 검사 결과에 의존하는 동작이 단일(atomic) 연산으로 수행되어 TOCTOU 경쟁 상태를 방지하는지 확인해야 한다. (예: 파일을 열기 전에 존재 여부를 확인하는 작업과 파일 열기 동작을 분리하지 않기, 접근 권한 검증과 권한 부여를 동일 트랜잭션/원자적 구간에서 수행하기)",,,✓,, +V15,보안 코딩 및 아키텍처,V15.4,안전한 동시성,V15.4.3,"스레드가 서로를 기다리거나 무한 재시도에 빠지지 않도록 일관된 락 사용을 보장하고, 락 관리 로직을 리소스 관리 책임 코드 내부에 유지하여 외부 클래스 및 코드가 우발적·악의적으로 락을 변경하지 못하도록 하는지 확인해야 한다.",,,✓,, +V15,보안 코딩 및 아키텍처,V15.4,안전한 동시성,V15.4.4,"**스레드 풀** 활용 등 **리소스 할당 정책**을 통해 공정한 리소스 접근을 보장하고, 우선순위가 낮은 스레드도 합리적 시간 내 진행될 수 있게 하여 **스레드 기아**를 방지하는지 확인해야 한다.",,,✓,, +V16,보안 로깅과 오류 처리,V16.1,보안 로깅 문서화,V16.1.1,"애플리케이션의 기술 스택의 각 계층에서 수행된 로깅에 대해, 어떤 이벤트들이 로그로 남았는지, 로그의 형식이 무엇인지, 로그가 어디에 저장되었는지, 어떻게 사용되는지, 로그에 대한 접근이 어떻게 제어되는지, 그리고 로그가 얼마나 보관되는지에 대해 문서화한 목록이 존재하는지 검증한다.",,✓,✓,, +V16,보안 로깅과 오류 처리,V16.2,일반 로깅,V16.2.1,"이벤트가 발생했을 때 그 타임라인을 자세히 조사할 수 있도록 각 로그의 항목이 필수적인 메타데이터(언제, 어디서, 누가, 무엇을 등)을 포함하는지 검증한다. ",,✓,✓,, +V16,보안 로깅과 오류 처리,V16.2,일반 로깅,V16.2.2,"모든 로깅 컴포넌트의 시간 소스가 동기화되어 있는지, 그리고 보안 이벤트 메타데이터에서 타임스탬프가 UTC를 사용하거나 혹은 명시적인 시간대 오프셋을 포함하는지 검증한다. UTC는 분산 시스템 전체에 걸친 일관성을 보장하고, 일광 절약 시간제 전환 시의 혼란을 방지하기 위해 추천된다.",,✓,✓,, +V16,보안 로깅과 오류 처리,V16.2,일반 로깅,V16.2.3,"애플리케이션이 로그를 저장만 하는지, 혹은 로그 목록에서 문서화 된 파일이나 서비스로 브로드캐스트하는지 검증한다.",,✓,✓,, +V16,보안 로깅과 오류 처리,V16.2,일반 로깅,V16.2.4,"사용 중인 로그 처리기가 로그를 읽고, 또 상호 연관 지을 수 있는지 검증한다. 가능하다면 공통 로깅 형식을 사용하는 것이 좋다.",,✓,✓,, +V16,보안 로깅과 오류 처리,V16.2,일반 로깅,V16.2.5,"민감한 데이터를 로깅할때, 애플리케이션이 데이터의 보호 수준을 기반으로 로깅을 수행하는지 검증한다. 예를 들어, 자격 증명이나, 지불 상세 정보 등의 특정 데이터는 로깅 해서는 안 된다. 또한 세션 토큰 등의 데이터는 전체 혹은 일부분이 해싱된, 마스킹 된 상태로 로깅 되어야 한다.",,✓,✓,, +V16,보안 로깅과 오류 처리,V16.3,보안 이벤트,V16.3.1,"성공한 시도와 실패한 시도를 포함하여 모든 인증 명령을 로깅 하는지 검증한다. 인증의 종류나, 사용한 인증 요소 등의 추가적인 메타데이터 또한 수집해야 한다.",,✓,✓,, +V16,보안 로깅과 오류 처리,V16.3,보안 이벤트,V16.3.2,실패한 인가 시도들도 로깅 하는지 검증한다. L3에 대해서는 반드시 민감한 데이터가 접근되었을 때를 포함하여(민감한 데이터 자체는 제외하고) 모든 인가 결정들의 로그를 포함해야 한다.,,✓,✓,, +V16,보안 로깅과 오류 처리,V16.3,보안 이벤트,V16.3.3,"애플리케이션이 이 문서에서 정의한 보안 이벤트들을 로깅하고, 또한 입력값 확인, 비즈니스 로직, 그리고 자동화 방지 등의 보안 제어를 우회하려는 시도들도 로깅 하는지 검증한다.",,✓,✓,, +V16,보안 로깅과 오류 처리,V16.3,보안 이벤트,V16.3.4,애플리케이션이 백엔드 TLS 오류와 같은 예상치 못한 오류나 보안 제어 오류들을 로깅 하는지 검증한다.,,✓,✓,, +V16,보안 로깅과 오류 처리,V16.4,로그 보호,V16.4.1,로그 삽입을 방지하기 위해 모든 로깅 컴포넌트가 적절히 데이터를 인코딩하는지 검증한다.,,✓,✓,, +V16,보안 로깅과 오류 처리,V16.4,로그 보호,V16.4.2,로그가 비인가된 접근으로부터 보호되고 수정할 수 없는지 검증한다.,,✓,✓,, +V16,보안 로깅과 오류 처리,V16.4,로그 보호,V16.4.3,"분석, 탐지, 경보, 그리고 에스컬레이션(escalation)을 위해 로그가 논리적으로 분리된 시스템으로 안전하게 전송되는지 검증한다. 애플리케이션이 침해되더라도 로그는 훼손하지 못하도록 보장하는 것이 목적이다.",,✓,✓,, +V16,보안 로깅과 오류 처리,V16.5,오류 처리,V16.5.1,"예상치 못한 혹은 보안 측면에서 민감한 오류가 발생했을 때 스택 흔적, 쿼리, 비밀키, 그리고 토큰 등의 민감한 내부 시스템 데이터의 노출 방지를 보장하기 위해 유저에게 구체화하지 않은 메시지를 반환하는지 검증한다.",,✓,✓,, +V16,보안 로깅과 오류 처리,V16.5,오류 처리,V16.5.2,외부 리소스 접근 오류가 발생하더라도 애플리케이션이 계속해서 안전하게 작동하는지 검증한다. 예를 들어 서킷 브레이커(circuit breaker)나 우아한 성능 저하와 같은 패턴을 사용할 수 있다.,,✓,✓,, +V16,보안 로깅과 오류 처리,V16.5,오류 처리,V16.5.3,"예외가 발생할 때, 검증 로직의 오류에도 불구하고 거래를 처리하는 등의 페일-오픈(fail-open) 상태 방지를 포함하여 애플리케이션이 우아하고 안전하게 실패하는지 검증한다. ",,✓,✓,, +V16,보안 로깅과 오류 처리,V16.5,오류 처리,V16.5.4,"처리되지 못한 모든 예외를 처리할 “최후의 수단” 오류 핸들러가 정의되어 있는지 검증한다. 이는 로그 파일에 기록되어야 하는 오류 상세 정보들의 손실을 피하기 위함과 동시에, 오류로 인해 전체 애플리케이션 프로세스가 종료되어 가용성 손실로 이어지지 않도록 보장하기 위함이다. ",,,✓,, +V17,WebRTC,V17.1,TURN 서버,V17.1.1,"Traversal Using Relays around NAT(TURN) 서비스가 특정 목적을 위해 보존된 주소(예: 내부 네트워크, 브로드캐스트, 루프백)를 제외한 주소에 대해서만 접근을 허용하도록 한다.",,✓,✓,, +V17,WebRTC,V17.1,TURN 서버,V17.1.2,Traversal Using Relays around NAT(TURN) 서비스가 정당한 사용자의 TURN 서버 포트의 대량 개방 시 자원고갈에 취약하지 않도록 한다.,,,✓,, +V17,WebRTC,V17.2,미디어,V17.2.1,데이터그램 전송 계층 보안(DTLS) 인증서의 키가 암호화 키 관리에 대한 문서화된 정책에 따라 관리되고 보호되는지 확인해야 한다.,,✓,✓,, +V17,WebRTC,V17.2,미디어,V17.2.2,"미디어 서버가 승인된 데이터그램 전송 계층 보안(DTLS) 암호 모음을 사용하고 지원하도록 구성되었는지, 그리고 보안 실시간 전송 프로토콜(DTLS-SRTP)을 위한 키 생성에 사용되는 DTLS 확장을 위한 안전한 보호 프로파일을 구성했는지 확인해야 한다.",,✓,✓,, +V17,WebRTC,V17.2,미디어,V17.2.3,미디어 서버에서 보안 실시간 전송 프로토콜(SRTP) 인증이 선택되어 있는지 확인한다. 이를 통해 실시간 전송 프로토콜(RTP) 삽입 공격으로 인한 서비스 거부 상태 발생 또는 오디오/비디오 미디어가 미디어 스트림에 삽입되는 것을 방지할 수 있다.,,✓,✓,, +V17,WebRTC,V17.2,미디어,V17.2.4,미디어 서버가 잘못된 형식의 보안 실시간 전송 프로토콜(SRTP) 패킷을 접했을 때도 수신 미디어 트래픽 처리를 계속할 수 있는지 확인해야 한다.,,✓,✓,, +V17,WebRTC,V17.2,미디어,V17.2.5,미디어 서버가 정상 사용자로부터의 보안 실시간 전송 프로토콜(SRTP) 패킷이 대량으로 유입되는 상황에서도 수신 미디어 트래픽 처리를 계속할 수 있는지 확인해야 한다.,,,✓,, +V17,WebRTC,V17.2,미디어,V17.2.6,미디어 서버가 Datagram Transport Layer Security(DTLS)의 “ClientHello” 경합 조건 취약점에 노출되지 않았는지 확인해야 한다. 이를 위해 해당 미디어 서버가 공개적으로 취약한 것으로 알려져 있는지 확인하거나 경합 조건 테스트를 수행해야 한다.,,,✓,, +V17,WebRTC,V17.2,미디어,V17.2.7,미디어 서버와 연결된 모든 오디오 또는 비디오 녹화 장치가 합법적인 사용자로부터의 보안 실시간 전송 프로토콜(SRTP) 패킷이 대량으로 유입되는 상황에서도 수신 미디어 트래픽 처리를 계속할 수 있는지 확인해야 한다.,,,✓,, +V17,WebRTC,V17.2,미디어,V17.2.8,"데이터그램 전송 계층 보안(DTLS) 인증서가 세션 설명 프로토콜(SDP) 지문 속성과 대조되어 검증되었는지 확인하고, 검증이 실패할 경우 미디어 스트림을 종료하여 미디어 스트림의 진위성을 보장해야 한다.",,,✓,, +V17,WebRTC,V17.3,신호 처리,V17.3.1,신호 서버가 플러드 공격 중에도 합법적인 수신 신호 메시지 처리를 계속할 수 있는지 확인해야 한다. 이는 신호 수준에서 속도 제한을 구현함으로써 달성되어야 한다.,,✓,✓,, +V17,WebRTC,V17.3,신호 처리,V17.3.2,"서비스 거부 상태를 유발할 수 있는 잘못된 형식의 신호 메시지를 접했을 때 신호 서버가 정상적인 신호 메시지 처리를 계속할 수 있는지 확인해야 한다. 여기에는 입력 검증 구현, 정수 오버플로우 안전 처리, 버퍼 오버플로우 방지 및 기타 강력한 오류 처리 기법 적용이 포함될 수 있다.",,✓,✓,, + diff --git a/5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.legacy.json b/5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.legacy.json new file mode 100644 index 0000000000..2f85ce09bf --- /dev/null +++ b/5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.legacy.json @@ -0,0 +1,7259 @@ +{ + "Name": "Application Security Verification Standard Project", + "ShortName": "ASVS", + "Version": "5.0.0", + "Description": "The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.", + "Requirements": [ + { + "Shortcode": "V1", + "Ordinal": 1, + "ShortName": "Encoding", + "Name": "인코딩과 데이터 정제", + "Items": [ + { + "Shortcode": "V1.1", + "Ordinal": 1, + "Name": "인코딩 및 데이터 정제 아키텍처", + "Items": [ + { + "Shortcode": "V1.1.1", + "Ordinal": 1, + "Description": "입력값 검증은 오직 한 번만 표준 형태로 디코딩 되거나 언이스케이프 되어야 하며, 인코딩된 데이터가 예상될 때만 디코딩 되어야 한다. 이 과정은 입력이 추가로 처리되기 전에 완료되어야 한다. 예를 들어서 입력값 검증이나 데이터 정제 이후에는 수행되면 안 된다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.1.2", + "Ordinal": 2, + "Description": "애플리케이션이 출력값 인코딩 또는 이스케이핑을 인터프리터가 사용하기 전의 최종 단계로 수행하거나 인터프리터 자체에서 처리하는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V1.2", + "Ordinal": 2, + "Name": "인젝션(Injection) 방지", + "Items": [ + { + "Shortcode": "V1.2.1", + "Ordinal": 1, + "Description": "HTTP 응답, HTML 문서 또는 XML 문서에 대한 출력값 인코딩이 해당 컨텍스트에 적절한지 검증해야 한다. 예를 들어, 메시지나 문서 구조가 변경되지 않도록 HTML 요소, HTML 속성, HTML 주석, CSS, HTTP 헤더 필드 등에 맞는 문맥별 문자 인코딩이 수행되어야 한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.2", + "Ordinal": 2, + "Description": "통합 자원 식별자(Uniform Resource Locator; URL)들을 동적으로 생성할 때 신뢰할 수 없는 데이터가 해당 컨텍스트에 맞게 인코딩되었는지 검증해야 한다(예: 쿼리나 경로 파라미터에 대한 URL 인코딩 또는 base64url 인코딩). 또한, 오직 안전한 URL 프로토콜만이 허용되는지 검증해야 한다(예: javascript: 또는 data:를 허용하지 않음).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.3", + "Ordinal": 3, + "Description": "동적으로 자바스크립트 콘텐츠(JSON 포함)를 생성할 때 메시지나 문서 구조를 바꾸는 것을 방지하기 위해 출력값 인코딩이나 이스케이핑이 사용되고 있는지 검증해야 한다(자바스크립트 또는 JSON 인젝션을 피하기 위함).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.4", + "Ordinal": 4, + "Description": "데이터 선택 혹은 데이터베이스 쿼리(예: SQL, HQL, NoSQL, Cypher)들 파라미터화된 쿼리, 객체 관계 매핑(Object Relational Mapping; ORM), 엔티티 프레임워크, 또는 다른 구조화된 쿼리 언어(Structured Query Language; SQL) 인젝션 및 기타 데이터베이스 인젝션 공격으로부터 보호해 주는 것들을 사용하는지 검증해야 한다. 이는 저장 프로시저를 쓸 때도 마찬가지이다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.5", + "Ordinal": 5, + "Description": "애플리케이션이 운영체제(Operating System; OS) 명령 인젝션으로부터 보호되며 운영체제 호출 시 파라미터화된 OS 쿼리나 상황에 맞는 명령줄 출력값 인코딩을 사용하는지 검증해야 한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.6", + "Ordinal": 6, + "Description": "애플리케이션이 경량 디렉터리 접근 프로토콜(Lightweight Directory Access Protocol; LDAP) 인젝션 취약점에 대해 보호되어 있는지, 또는 LDAP 인젝션을 방지하기 위한 특정 보안 통제가 구현되어 있는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.7", + "Ordinal": 7, + "Description": "애플리케이션이 XPath 인젝션 공격을 쿼리 파라미터나 미리 컴파일된 쿼리들을 사용해 보호되고 있는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.8", + "Ordinal": 8, + "Description": "LaTeX 프로세서가 안전하게 구성되어 있으며(\"--shell-escape\" 플래그 비사용 등) LaTeX 인젝션 공격을 방지하기 위해 허용된 명령어 목록이 사용되고 있는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.9", + "Ordinal": 9, + "Description": "애플리케이션이 정규 표현식에서 특수 문자들을 메타 문자로 잘못 해석하는 것을 방지하기 위해 해당 문자들 이스케이프(보통 백슬래시를 사용)하고 있는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.10", + "Ordinal": 10, + "Description": "애플리케이션이 쉼표 구분 데이터(Comma Separated Values; CSV) 및 수식 인젝션에 대해 보호되어 있는지 검증해야 한다. 그리고 애플리케이션은 CSV 콘텐츠를 내보낼 때 RFC 4180 2.6과 2.7 부분에 명시된 이스케이핑 규칙을 반드시 따라야 한다. 또한 CSV나 다른 스프레드시트 포맷(XLS, XLSX, ODF 등)으로 내보낼 때 필드 값의 첫 번째가 특수 문자('=', '+', '-', '@', '\\t' (탭), '\\0' (null 문자) 포함)라면 반드시 작은따옴표로 이스케이프되어야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V1.3", + "Ordinal": 3, + "Name": "데이터 정제", + "Items": [ + { + "Shortcode": "V1.3.1", + "Ordinal": 1, + "Description": "위지윅(WYSIWYG) 에디터나 이와 유사한 것으로부터 오는 모든 신뢰할 수 없는 HTML 입력들은 잘 알려지고 안전한 HTML 데이터 정제 라이브러리나 프레임워크 기능을 사용해 정제되는지 검증해야 한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.2", + "Ordinal": 2, + "Description": "애플리케이션이 eval() 또는 스프링 표현 언어(Spring Expression Language; SpEL) 등과 같은 동적 코드 실행 기능 사용을 피하고 있는지 검증해야 한다. 대안이 없는 경우, 실행 전에 포함되는 모든 사용자 입력이 반드시 정제되어야 한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.3", + "Ordinal": 3, + "Description": "잠재적으로 위험한 컨텍스트에 전달되는 데이터가 사전에 정제되어 안전 조치가 적용되는지 검증해야 한다. 예를 들어 해당 컨텍스트에서 안전한 문자만 허용하고 너무 긴 입력값은 잘라내는 등의 조치가 포함된다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.4", + "Ordinal": 4, + "Description": "사용자로부터 제공된 확장 가능한 벡터 그래픽(Scalable Vector Graphics; SVG)의 스크립트 실행 가능 콘텐츠가 애플리케이션에 안전한 태그 및 속성(예: 그래픽 그리기)만 포함하도록 검증 또는 정제되는지 검증해야 한다. 예를 들어 스크립트나 foreignObject는 포함되면 안 된다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.5", + "Ordinal": 5, + "Description": "애플리케이션이 사용자로부터 제공된 스크립트 실행 가능하거나 표현식 템플릿 언어(예: 마크다운, CSS, XSL 스타일시트, BBCode ) 콘텐츠를 정제하거나 비활성화하는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.6", + "Ordinal": 6, + "Description": "애플리케이션이 서버측 요청 위조(Server-side Request Forgery; SSRF) 공격으로부터 보호하기 위해 신뢰할 수 없는 데이터를 프로토콜, 도메인, 경로, 포트의 허용 목록과 대조해 검증하고 다른 서비스를 호출하기 전에 잠재적으로 위험한 문자를 정제(sanitization)하는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.7", + "Ordinal": 7, + "Description": "애플리케이션이 템플릿 인젝션 공격으로부터 보호하기 위해 신뢰할 수 없는 입력값을 기반으로 템플릿을 생성하지 않도록 하는지 검증해야 한다. 대안이 없는 경우에는 템플릿 생성 과정에서 동적으로 포함되는 모든 신뢰할 수 없는 입력값은 정제되거나 엄격히 검증되어야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.8", + "Ordinal": 8, + "Description": "애플리케이션이 자바 명명 및 디렉터리 인터페이스(Java Naming and Directory Interface; JNDI) 쿼리에서 신뢰할 수 없는 입력값을 사용하기 전에 적절히 정제하고 JNDI가 JNDI 인젝션 공격을 방지할 수 있도록 안전하게 구성되어 있는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.9", + "Ordinal": 9, + "Description": "인젝션을 방지하기 위해 애플리케이션이 메모리 캐시(memcache)에 콘텐츠를 전달하기 전에 해당 데이터를 정제하는지 검증해야 한다. ", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.10", + "Ordinal": 10, + "Description": "사용 시 예상치 못하거나 악의적인 방식으로 작동할 수 있는 포맷 스트링(format string)들은 처리되기 전에 정제되는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.11", + "Ordinal": 11, + "Description": "간이 전자 우편 전송 프로토콜(Simple Mail Transfer Protocol; SMTP)이나 인터넷 메시지 액세스 프로토콜(Internet Message Access Protocol; IMAP) 인젝션으로부터 보호하기 위해 애플리케이션이 사용자 입력을 메일 시스템으로 보내기 전에 정제를 하는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.12", + "Ordinal": 12, + "Description": "정규 표현식에 지수형 백트래킹을 유발하는 요소가 없는지, 또한 신뢰할 수 없는 입력값을 정제하여 정규식 기반 서비스 거부 공격(Regular Expression Denial of Service; ReDoS) 또는 런어웨이(Runaway) 정규식 공격을 방지하는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V1.4", + "Ordinal": 4, + "Name": "메모리, 스트링, 비관리 코드", + "Items": [ + { + "Shortcode": "V1.4.1", + "Ordinal": 1, + "Description": "애플리케이션이 스택, 버퍼, 또는 힙 오버플로를 탐지하거나 방지하기 위해 메모리 안전 문자열, 안전한 메모리 복사 및 포인터 산술을 사용하는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.4.2", + "Ordinal": 2, + "Description": "정수 오버플로를 방지하기 위해 부호 확인, 범위 검사, 입력값 검증 등의 기법이 사용되고 있는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.4.3", + "Ordinal": 3, + "Description": "댕글링 포인터(dangling pointer)나 해체 후 사용(Use After Free; UAF) 취약점을 방지하기 위해 동적으로 할당된 메모리와 자원이 적절히 해제되었는지 그리고 해제된 메모리를 참조하는 포인터나 참조가 제거되었거나 null로 설정되었는지를 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V1.5", + "Ordinal": 5, + "Name": "안전한 역직렬화", + "Items": [ + { + "Shortcode": "V1.5.1", + "Ordinal": 1, + "Description": "애플리케이션이 확장 가능한 마크업 언어(eXtensible Markup Language; XML) 파서(parser)를 제한적인 설정으로 구성하고 외부 엔티티 해석과 같은 안전하지 않은 기능을 비활성화하여 XML 외부 엔티티(XML eXternal Entity; XXE) 공격을 방지하는지 검증해야 한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.5.2", + "Ordinal": 2, + "Description": "역직렬화 공격을 방지하기 위해 신뢰할 수 없는 데이터의 역직렬화 시 객체 타입 허용 목록 사용 또는 클라이언트 정의 객체 타입 제한과 같은 안전한 입력 처리 방식이 적용되는지 검증해야 한다. 또한 명확히 안전하지 않은 것으로 지정된 역직렬화 메커니즘은 신뢰할 수 없는 입력에 대해 반드시 사용해서는 안 된다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.5.3", + "Ordinal": 3, + "Description": "애플리케이션에서 동일한 데이터 타입(예: JSON 파서, XML 파서, URL 파서)에 대해 사용되는 서로 다른 파서들이 일관된 방식으로 파싱(parsing)을 수행하고 동일한 문자 인코딩 방식을 사용하는지 검증해야 한다. 이를 통해 JSON 상호운용 취약점이나 원격 파일 포함(Remote File Inclusion; RFI) 및 SSRF 공격에서 악용될 수 있는 서로 다른 URI 또는 파일 파싱 동작 문제를 방지할 수 있다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V2", + "Ordinal": 2, + "ShortName": "Validation", + "Name": "유효성 검증 및 비즈니스 로직", + "Items": [ + { + "Shortcode": "V2.1", + "Ordinal": 1, + "Name": "유효성 검증 및 비즈니스 로직 문서화", + "Items": [ + { + "Shortcode": "V2.1.1", + "Ordinal": 1, + "Description": "애플리케이션 문서에 데이터 항목이 예상되는 구조에 부합하는지 확인하는 입력값 유효성 검증 규칙이 정의되어 있는지 확인한다. 이는 신용카드 번호, 이메일 주소, 전화번호와 같은 일반적인 데이터 형식일 수도 있고, 내부적으로 사용하는 데이터 형식일 수도 있다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.1.2", + "Ordinal": 2, + "Description": "애플리케이션 문서에 연관된 데이터 항목들 간의 논리적, 문맥적 일관성을 검증하는 방법이 정의되어 있는지 검증한다. 예를 들어서 세부 주소와 우편번호가 서로 일치하는지 확인하는 경우가 이에 해당한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.1.3", + "Ordinal": 3, + "Description": "비즈니스 로직의 제한사항 및 유효성 검증에 대한 요구사항이 사용자별 기준과 애플리케이션 전체에 적용되는 전역적 기준을 모두 포함하여 문서화되어 있는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V2.2", + "Ordinal": 2, + "Name": "입력값 검증", + "Items": [ + { + "Shortcode": "V2.2.1", + "Ordinal": 1, + "Description": "입력값에 대한 비즈니스 또는 기능적인 기대치를 충족하기 위해서 입력값의 유효성을 검증해야 한다. 이는 허용 값, 패턴 및 범위 목록에 대한 긍정적 검증을 사용하거나, 미리 정의된 규칙에 따라 입력값을 예상 구조 및 논리적 한계와 비교하여 검증해야 한다. L1의 경우, 특정 비즈니스 또는 보안 결정을 내리는 데 초점을 맞출 수 있다. L2 이상의 경우에는 모든 입력값에 적용해야 한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.2.2", + "Ordinal": 2, + "Description": "애플리케이션이 신뢰할 수 있는 서비스 계층에서 입력값 유효성 검사를 시행하도록 설계되었는지 확인해야 한다. 클라이언트 측 유효성 검사는 사용성을 향상시키므로 권장해야 하지만, 보안 제어 수단으로 의존해서는 안된다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.2.3", + "Ordinal": 3, + "Description": "사전 정의된 규칙에 따라 관련 데이터 항목의 조합이 합리적인지 애플리케이션에서 확인해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V2.3", + "Ordinal": 3, + "Name": "비즈니스 로직 보안", + "Items": [ + { + "Shortcode": "V2.3.1", + "Ordinal": 1, + "Description": "애플리케이션이 예상되는 순차적 단계 순서에 따라 동일한 사용자에 대한 비즈니스 로직 흐름만 처리하고 단계를 건너뛰지 않는지 확인한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.3.2", + "Ordinal": 2, + "Description": "비즈니스 로직 결함이 악용되는 것을 방지하기 위해서 애플리케이션 문서에 따라 비즈니스 로직 제한이 구현되었는지 확인한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.3.3", + "Ordinal": 3, + "Description": "비즈니스 로직 수준에서 트랜잭션이 사용되고 있는지 확인하여 비즈니스 로직 작업이 완전히 성공하거나 이전의 올바른 상태로 롤백되는지 확인한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.3.4", + "Ordinal": 4, + "Description": "제한된 양의 리소스(ex. 극장 좌석이나 배송 시간대)가 애플리케이션의 로직을 조작하여 이중으로 예약되는 것을 방지하기 위해서 비즈니스 로직 수준 잠금 메커니즘이 사용되는지 확인한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.3.5", + "Ordinal": 5, + "Description": "핵심적인 비즈니스 로직 흐름에 무단 또는 우발적인 행위를 방지하기 위해서 다중 사용자 승인이 필요한지 확인해야 한다. 이는 거액 자금 이체, 계약 승인, 기밀 정보 접근, 제조 과정의 안전 무시 등이 포함될 수 있지만, 이에 국한되지는 않는다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V2.4", + "Ordinal": 4, + "Name": "자동화 방지", + "Items": [ + { + "Shortcode": "V2.4.1", + "Ordinal": 1, + "Description": "데이터 유출, 더미 데이터 생성, 할당량 소진, 속도 제한 위반, 서비스 거부(DoS), 핵심적인 리소스의 과다 사용으로 이어질 수 있는 애플리케이션 기능에 대한 과도한 호출을 방어하기 위해, 자동화 방지 제어 기능이 구현되어 있는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.4.2", + "Ordinal": 2, + "Description": "비즈니스 로직의 각 단계가 실제 사람이 수행하는 데 필요한 현실적인 시간을 요구하여, 비정상적으로 빠른 속도의 트랜잭션 제출을 방지하는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V3", + "Ordinal": 3, + "ShortName": "Web", + "Name": "웹 프론트엔드 보안", + "Items": [ + { + "Shortcode": "V3.1", + "Ordinal": 1, + "Name": "웹 프론트엔드 보안 문서", + "Items": [ + { + "Shortcode": "V3.1.1", + "Ordinal": 1, + "Description": "애플리케이션 공식 문서에서 애플리케이션이 반드시 지원해야 하는, 예상되는 보안 특징들을 서술하고 있는지 확인한다. (예: HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP), 그리고 다른 관련된 HTTP 보안 메커니즘들). 또한 문서에서 앞선 특징들(유저에게나 경고하거나 접속을 막는 등의)이 유효하지 않을 때 애플리케이션이 어떻게 행동하는지 반드시 정의해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.2", + "Ordinal": 2, + "Name": "의도하지 않은 콘텐츠 접근", + "Items": [ + { + "Shortcode": "V3.2.1", + "Ordinal": 1, + "Description": "브라우저가 HTTP 응답에 대해 콘텐츠나 기능을 불러올 때, 의도하지 않은 상황이 보안적으로 통제되고 있는지 확인한다(예: API, 유저가 올린 파일, 혹은 다른 리소스에 직접 접근 시). Content-Security-Policy 헤더 필드의 샌드박스 지시어를 사용하거나, Content-Disposition 헤더 필드 내의 attachment disposition 타입을 사용하는 등으로, 불필요한 HTTP 요청 헤더 필드 (Sec-Fetch-* 와 같은)를 제공하지 않을 수 있다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.2.2", + "Ordinal": 2, + "Description": "콘텐츠가 HTML로 렌더링되지 않고 텍스트로 표시되도록 하여, HTML이나 JavaScript 등의 의도하지 않은 실행을 방지하는 안전한 렌더링 함수(예: createTextNode, textContent)를 사용하는지 확인한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.2.3", + "Ordinal": 3, + "Description": "애플리케이션이 클라이언트 사이드 JavaScript를 사용할 때, 명시적 변수 사용, 엄격한 타입 검사, 문서에서의 전역 변수 저장 지양, 그리고 네임스페이스 격리 구현 등으로 DOM 클로버링을 막고 있음을 확인한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.3", + "Ordinal": 3, + "Name": "쿠키 설정", + "Items": [ + { + "Shortcode": "V3.3.1", + "Ordinal": 1, + "Description": "쿠키가 'Secure' 속성을 가지며, 쿠키 이름에 '\\__Host-' 접두사가 사용되지 않았고, '__Secure-' 접두사를 사용했는지 확인한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.3.2", + "Ordinal": 2, + "Description": "UI redress 공격, 그리고 CSRF라 알려진 브라우저 기반 요청 위조 공격들에 대한 노출을 제한하기 위해 각 쿠키의 'SameSite' 속성 값이 쿠키의 목적에 맞게 설정되어 있는지 확인한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.3.3", + "Ordinal": 3, + "Description": "다른 호스트들과 명시적으로 공유되는 쿠키에 대해서, '__Host-' 접두사를 가지고 있는지 확인한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.3.4", + "Ordinal": 4, + "Description": "클라이언트 측 스크립트에서 쿠키의 값에 접근이 가능한 걸 의도하지 않았다면(세션 토큰 등), 쿠키는 반드시 'HttpOnly' 속성을 가져야 하고, 반드시 'Set-Cookie' 헤더 필드를 통해 클라이언트에게 전달돼야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.3.5", + "Ordinal": 5, + "Description": "애플리케이션이 쿠키를 만들 때, 쿠키 이름과 값의 길이 합이 4096바이트를 넘지 않는지 확인한다. 너무 큰 쿠키는 브라우저에 저장되지 않으며, 요청 전달도 안되고, 해당 쿠키에 의존하는 애플리케이션 기능을 사용하지 못하게 된다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.4", + "Ordinal": 4, + "Name": "브라우저 보안 메커니즘 헤더", + "Items": [ + { + "Shortcode": "V3.4.1", + "Ordinal": 1, + "Description": "이 섹션에서는 애플리케이션의 응답을 처리할 때 브라우저의 보안 기능과, 제한 사항을 활성화하기 위해 HTTP 응답에 설정해야 하는 보안 헤더를 설명한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.2", + "Ordinal": 2, + "Description": "교차 출처 리소스 공유(CORS)의 Access-Control-Allow-Origin 헤더 필드가 애플리케이션의 고정 값인지 확인한다. 만약 출처 Origin HTTP 요청 헤더 필드 값을 사용하고 있다면, 신뢰할 수 있는 출처 목록으로 검증한다. 'Access-Control-Allow-Origin: *' 사용이 필요할 때엔, 응답이 민감한 정보를 포함하지 않는지 확인한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.3", + "Ordinal": 3, + "Description": "HTTP 응답이 Content-Security-Policy 응답 헤더 필드를 가지고 있는지 확인한다. 이는 브라우저가 신뢰하는 콘텐츠나 리소스만 불러오고 실행하도록 하고, 위험한 JavaScript의 실행을 제한한다. 최소한, object-src 'none' 과 base-uri 'none'이라는 지침, 그리고 허용 목록을 정의하거나 논스, 해쉬의 사용을 포함한다는 전역 정책은 반드시 사용돼야 한다. 3계층 애플리케이션의 경우에는, 논스나 해쉬가 적용된 응답별 정책이 반드시 정의돼야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.4", + "Ordinal": 4, + "Description": "모든 HTTP 응답이 'X-Content-Type-Options: nosniff' 헤더 필드를 포함하는지 확인해야 한다. 이는 브라우저들이 주어진 응답에 대해 콘텐츠 스니핑과 MIME 타입 추측을 하지 않도록, 응답의 Content-Type 헤더 필드 값을 목적지 리소스와 일치하도록 지시한다. 예를 들어서, 응답의 Content-Type이 'text/css'인 스타일만 허용된다고 치자. 이는 기능적으로 브라우저의 Cross-Origin Read Blocking (CORB) 사용 또한 활성화시킨다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.5", + "Ordinal": 5, + "Description": "'Referer' HTTP 요청 헤더 필드를 통해 제 3자 서비스들에 기술적으로 민감한 정보 누출을 막기 위해, 애플리케이션에서 리퍼러 정책을 설정했는지 확인해야 한다. 이는 Referrer-Policy HTTP 응답 헤더 필드나 HTML 속성 항목을 통해 설정할 수 있다. 민감한 데이터는 URL에 있는 경로나 쿼리 데이터, 그리고 내부 비공개 애플리케이션의 경우 hostname도 포함된다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.6", + "Ordinal": 6, + "Description": "웹 애플리케이션이 Content-Security-Policy 헤더 필드의 frame-ancestors를 사용해 모든 HTTP 응답들에 대해 기본적으로 내부 삽입을 할 수 없고, 필요할 때만 특정 리소스에 대해 내부 삽입을 허용하도록 확인한다. X-Frame-Options 헤더 필드가 브라우저에서 지원되더라도, 오래돼서 신뢰할 수 없음을 알아야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.7", + "Ordinal": 7, + "Description": "Content-Security-Policy 헤더 필드에 위반 사항을 보고할 영역이 특정되어 있는지 확인해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.8", + "Ordinal": 8, + "Description": "문서 렌더링을 시작하는 모든 HTTP 요청(Content-Type text/html과 같은 응답)에 same-origin 지시어나 same-origin-allow-popups이 있는 Cross‑Origin‑Opener‑Policy 헤더 필드를 포함하는지 확인해야 한다. 이는 탭내빙(tabnabbing) 및 프레임 카운팅과 같은 Window 객체에 대한 공유 액세스를 악용하는 공격을 방지할 수 있다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.5", + "Ordinal": 5, + "Name": "브라우저 출처 구분", + "Items": [ + { + "Shortcode": "V3.5.1", + "Ordinal": 1, + "Description": "애플리케이션이 허용되지 않은 교차 출처 요청을 통한 민감한 기능의 사용을 막기 위해 CORS preflight 메커니즘에 의존하지 않는지 확인하고, 이런 요청이 애플리케이션 자체에서 시작된건지 증명해야 한다. 이는 anti-forgery 토큰의 사용과 증명이나 CORS-safelisted 요청 헤더 필드가 아닌 확장 HTTP 헤더 필드를 요구하는 것으로 가능하다. 사이트 간 요청 위조 공격(CSRF)으로 알려진 브라우저 기반의 요청 위조 공격에 대한 방어다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.2", + "Ordinal": 2, + "Description": "애플리케이션이 민감한 기능의 허용되지 않은 교차 출처 사용을 막기 위해 CORS preflight 메커니즘에 의존하고 있다면, CORS preflight 요청을 작동하지 않는 요청을 호출할 수 있는지 확인해야 한다. 이는 'Origin'과 'Content-Type' 요청 헤더 필드 값을 확인하거나 CORS-safelisted 헤더 필드가 아닌 확장 필드 사용에 대한 확인이 필요하다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.3", + "Ordinal": 3, + "Description": "민감한 기능이 HTTP 요청으로 POST, PUT, PATCH, DELETE와 같은 적절한 HTTP 방식을 사용하는지, HEAD, OPTIONS, 또는 GET처럼 HTTP 사양이 \"안전\"으로 정의되지 않는 방식을 사용하는지 확인한다. 또는 Sec-Fetch-* 요청 헤더 필드의 엄격한 검증을 사용하여 요청이 부적절한 교차 출처 호출, 탐색 요청 또는 이미지 소스와 같은 리소스 로드에서 발생하지 않았는지 확인할 수 있다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.4", + "Ordinal": 4, + "Description": "서로 다른 호스트 이름에 별도의 애플리케이션이 호스팅되어 있는지 확인하여 동일한 출처 정책에서 제공하는 제한 사항을 활용한다. 여기에는 한 출처에서 불러온 문서나 스크립트가 다른 출처의 리소스와 상호 작용할 수 있는 방법과 쿠키에서의 호스트 이름 기반 제한 사항이 포함된다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.5", + "Ordinal": 5, + "Description": "postMessage 인터페이스를 통해 수신한 메시지의 출처를 신뢰할 수 없거나, 구문이 유효하지 않은 경우, 수신한 메시지가 폐기되는지 확인한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.6", + "Ordinal": 6, + "Description": "Cross-Site Script Inclusion (XSSI) 공격을 피하기 위해, 애플리케이션 아무 곳에서나 JSONP 기능이 활성화되지 않는지 확인한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.7", + "Ordinal": 7, + "Description": "Cross-Site Script Inclusion (XSSI) 공격을 방지하기 위해 JavaScript 파일과 같은 스크립트 리소스 응답에 승인이 필요한 데이터가 포함되지 않았는지 확인한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.8", + "Ordinal": 8, + "Description": "인증된 리소스(예: 이미지, 비디오, 스크립트 및 기타 문서)가 의도된 경우에만 사용자를 대신하여 불러와지거나 내장될 수 있는지 확인한다. 이는 Sec-Fetch-* HTTP 요청 헤더 필드를 엄격하게 검증하여 요청이 부적절한 교차 출처 호출에서 발생하지 않았는지 확인하거나 브라우저에 반환된 콘텐츠를 차단하도록 지시하는 제한적인 교차 출처 리소스 정책 HTTP 응답 헤더 필드를 설정하여 달성할 수 있다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.6", + "Ordinal": 6, + "Name": "외부 리소스 무결성", + "Items": [ + { + "Shortcode": "V3.6.1", + "Ordinal": 1, + "Description": "클라이언트 측 자산(예: JavaScript 라이브러리, CSS 또는 웹 폰트)이 정적이고 버전이 지정된 경우에만 외부(예: 콘텐츠 전송 네트워크)로만 호스팅되는지 확인하고, 하위 리소스 무결성(SRI)을 사용하여 자산의 무결성을 검증한다. 이것이 불가능하다면 각 리소스에 대해 이를 정당화하기 위해 문서화된 보안 결정이 필요하다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.7", + "Ordinal": 7, + "Name": "다른 브라우저 보안 고려사항", + "Items": [ + { + "Shortcode": "V3.7.1", + "Ordinal": 1, + "Description": "애플리케이션이 여전히 지원되고 안전하다고 간주되는 클라이언트 측 기술만 사용하는지 확인한다. 이 요구 사항을 충족하지 않는 기술의 예로는 NSAPI 플러그인, Flash, Shockwave, ActiveX, Silverlight, NACL 또는 클라이언트 측 Java applets가 있다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.7.2", + "Ordinal": 2, + "Description": "애플리케이션이 사용자를 통제하지 못하는 다른 호스트 이름이나 도메인으로 자동으로 리다이렉션할 때, 허용된 목적지로만 리다이렉션 하는지 확인한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.7.3", + "Ordinal": 3, + "Description": "사용자가 애플리케이션의 통제 범위를 벗어난 URL로 리다이렉션 될 때 이를 취소할 수 있는 옵션이 있는 알림이 애플리케이션에 표시되는지 확인한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.7.4", + "Ordinal": 4, + "Description": "애플리케이션의 최상위 도메인(예: site.tld)가 공공 HSTS preload 목록에 추가되었는지 확인한다. 이렇게 하면 애플리케이션에 TLS를 사용하는 것이 Strict-Transport-Security 응답 헤더 필드에만 의존하지 않고 메인 브라우저에 직접 내장된다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.7.5", + "Ordinal": 5, + "Description": "애플리케이션에 접근하는 브라우저가 예상한 보안 특징을 가지고 있지 않은 경우, 애플리케이션이 문서에 명시된 대로 동작하는지 확인한다 (유저에게 경고하거나 접근을 차단하는 등).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V4", + "Ordinal": 4, + "ShortName": "API", + "Name": "API 와 WEB 서비스", + "Items": [ + { + "Shortcode": "V4.1", + "Ordinal": 1, + "Name": "일반적인 웹 서비스 보안", + "Items": [ + { + "Shortcode": "V4.1.1", + "Ordinal": 1, + "Description": "메세지 본문이 포함된 모든 HTTP 응답에는 실제 내용과 일치하는 Content-Type 헤더 필드가 포함되어 있는지 검증한다. 이때 IANA 미디어 타입(text, /+xml, /xml 등)에 따라 안전한 문자 인코딩 (ex. UTF-8, ISO-8859-1)을 지정하는 charset 파라미터도 포함되어야 한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.1.2", + "Ordinal": 2, + "Description": "사용자가 대면하는 엔드포인트(사람이 직접 웹 브라우저에 접속하는 경우)만 HTTP에서 HTTPS로 자동 리디렉션하고, 그 외에 서비스나 API 엔드포인트는 명백한 리디렉션을 구현하지 않았는지 검증한다. 이는 클라이언트가 실수로 암호화되지 않은 HTTP 요청을 보내고 있음에도, 요청이 자동으로 HTTPS로 리디렉션되어 민감한 데이터의 유출 사실을 발견하지 못하게 되는 상황을 방지하기 위함이다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.1.3", + "Ordinal": 3, + "Description": "로드 밸런서, 웹 프록시, 백엔드-프론트엔드 서비스 등 중간 계층에서 설정되며, 애플리케이션에서 사용하는 모든 HTTP 헤더 필드를 사용자가 재정의할 수 없는지 확인한다. 예를 들어 X-Real-IP, X-Frowarded-*, X-User-ID 등의 헤더가 포함될 수 있다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.1.4", + "Ordinal": 4, + "Description": "애플리케이션이나 API에서 명시적으로 지원하는 HTTP 메서드(프리플라이트 요청 시에 OPTIONS 포함)만 사용할 수 있으며, 사용되지 않는 메서드는 차단되어 있는지 확인한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.1.5", + "Ordinal": 5, + "Description": "매우 민감하거나 여러 시스템을 거치는 요청이나 거래에 대한 전송 계층 보호에 더하여 메세지별 디지털 서명들을 사용함으로써 추가적인 보증을 제공하는지 확인한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V4.2", + "Ordinal": 2, + "Name": "HTTP 메세지 구조 검증", + "Items": [ + { + "Shortcode": "V4.2.1", + "Ordinal": 1, + "Description": "모든 애플리케이션 구성 요소(로드 밸런서, 방화벽, 애플리케이션 서버 포함)가 HTTP 요청 smuggling을 예방하는 HTTP 버전의 적합한 메커니즘을 사용하는지에 대해, 수신되는 HTTP 메세지의 끝을 결정하는지 확인한다. HTTP/1.x에서 Transfer-encoding 헤더 필드가 있는 경우에 RFC 2616에 따라서 Content-Length 헤더는 무시해야 한다. HTTP/2 또는 HTTP/3를 사용할 때 Content-Length 헤더 필드가 있는 경우에 수신기는 DATA 프레임의 길이와 일치하는지 확인해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.2.2", + "Ordinal": 2, + "Description": "HTTP 메세지를 생성할 때, 요청 smuggling 공격을 예방하기 위해서 HTTP 프로토콜의 프레이밍 방식에 의해 결정된 Content의 길이와 Content-Length 헤더 필드가 충돌하지 않는지 확인한다. ", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.2.3", + "Ordinal": 3, + "Description": "응답 분할 및 헤더 인젝션 공격을 예방하기 위해서 애플리케이션이 Transfer-encoding과 같은 connection-specific 헤더 필드를 가진 HTTP/2또는 HTTP/3 메세지를 전송하거나 수락하지 않는지 확인한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.2.4", + "Ordinal": 4, + "Description": "헤더 인젝션 공격을 예방하기 위해서, 애플리케이션이 헤더 이름과 값에 CR(\\r), LF(\\n), CRLF(\\r\\n)과 같은 줄바꿈 문자가 포함되어 있지 않은 HTTP/2 및 HTTP/3 요청만 허용하는지 확인한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.2.5", + "Ordinal": 5, + "Description": "애플리케이션(백엔드 또는 프론트엔드)이 요청을 빌드하고 전송하는 경우, 수신 구성 요소가 수학하기에는 너무 긴 URI(ex. API 호출) 또는 HTTP 요청 헤더 필드(ex. Authorization 또는 Cookie)를 생성하지 않도록 검증, 검열 또는 기타 메커니즘을 사용하는지 확인한다. 이로 인해서 지나치게 긴 요청(ex. 긴 쿠키 헤더 필드)을 보낼 때와 같이 서비스 거부가 발생하여 서버가 항상 오류 상태로 응답할 수 있다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V4.3", + "Ordinal": 3, + "Name": "GraphQL", + "Items": [ + { + "Shortcode": "V4.3.1", + "Ordinal": 1, + "Description": "쿼리 허용 목록, 깊이 제한, 양 제한 또는 쿼리 비용 분석을 사용하여 값비싼 중첩 쿼리로 인해 GraphQL 또는 데이터 계층 표현식 거부(DOS)를 방지하는지 확인한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.3.2", + "Ordinal": 2, + "Description": "GraphQL API가 다른 사용자에 의해 사용되지 않는 한, 운영 환경에서 GraphQL 점검 쿼리들이 비비활성화되어 있는지 확인한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V4.4", + "Ordinal": 4, + "Name": "WebSocket", + "Items": [ + { + "Shortcode": "V4.4.1", + "Ordinal": 1, + "Description": "모든 WebSocket 연결에 WebSocket over TLS(WSS)이 사용되는지 확인한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.4.2", + "Ordinal": 2, + "Description": "초기 HTTP WebSocket Handshake 중에 기존 헤더 필드가 애플리케이션에 허용된 기존 목록과 대조되는지 확인한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.4.3", + "Ordinal": 3, + "Description": "애플리케이션의 표준 세션 관리를 사용할 수 없는 경우, 관련 세션 관리 보안 요구 사항을 준수하는 전용 토큰이 사용되고 있는지 확인한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.4.4", + "Ordinal": 4, + "Description": "기존 HTTPS 세션을 WebSocket 채널로 전환할 때 이전에 인증된 HTTPS 세션을 통해 전용 WebSocket 세션 관리 토큰을 처음 얻거나 검증하는지 확인한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V5", + "Ordinal": 5, + "ShortName": "File", + "Name": "파일 처리", + "Items": [ + { + "Shortcode": "V5.1", + "Ordinal": 1, + "Name": "파일 처리 문서화", + "Items": [ + { + "Shortcode": "V5.1.1", + "Ordinal": 1, + "Description": "업로드 기능별로 허용되는 파일 형식, 예상되는 파일 확장자, 그리고 최대 크기(압축 해제된 크기 포함)가 문서에 정의되어 있는지 검증해야 한다. 또한, 악성 파일이 탐지될 때 애플리케이션이 어떻게 동작하는지와 같이, 최종 사용자가 파일을 안전하게 다운로드하고 처리할 수 있도록 하는 방법이 문서에 명시되어 있는지 확인해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V5.2", + "Ordinal": 2, + "Name": "파일 업로드 및 콘텐츠", + "Items": [ + { + "Shortcode": "V5.2.1", + "Ordinal": 1, + "Description": "애플리케이션이 성능 저하나 서비스 거부 공격(Denial of Service; DoS)을 유발하지 않고 처리할 수 있는 크기의 파일만 허용하는지 검증해야 한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.2", + "Ordinal": 2, + "Description": "애플리케이션이 파일 자체 또는 zip 파일과 같은 아카이브 내에서 파일을 허용할 때, 파일 확장자가 예상 파일 확장자와 일치하는지 확인하고 내용이 확장자로 표현된 유형과 일치하는지 확인하는지 검증해야 한다. 여기에는 초기 '매직 바이트(magic bytes)' 확인, 이미지 재작성 수행, 파일 내용 유효성 검사를 위한 전문 라이브러리 사용이 포함되지만 이에 국한되지 않는다. L1의 경우, 특정 비즈니스 또는 보안 결정을 내리는 데 사용되는 파일에만 집중할 수 있다. L2 이상에서는 허용되는 모든 파일에 적용되어야 한다", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.3", + "Ordinal": 3, + "Description": "애플리케이션이 압축 파일(예: zip, gz, docx, odt)을 압축 해제하기 전에 허용되는 최대 압축 해제 크기와 최대 파일 수를 확인하는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.4", + "Ordinal": 4, + "Description": "단일 사용자가 너무 많은 파일이나 과도하게 큰 파일로 저장 공간을 채우지 않도록 사용자별 파일 크기 할당량(quota) 및 최대 파일 수가 적용되는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.5", + "Ordinal": 5, + "Description": "애플리케이션이 심볼릭 링크(symlink)를 포함하는 압축 파일 업로드를 허용하지 않는지 검증해야 한다. 단, 이러한 기능이 특별히 요구되는 경우에는 심볼릭 링크할 수 있는 파일의 허용 목록(allowlist)을 강제하는 것이 필요하다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.6", + "Ordinal": 6, + "Description": "픽셀 플러드 공격(Pixel Flood Attack)을 방지하기 위해, 애플리케이션이 업로드된 이미지의 픽셀 크기가 허용된 최대값보다 큰 경우 해당 이미지를 거부하는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V5.3", + "Ordinal": 3, + "Name": "파일 저장", + "Items": [ + { + "Shortcode": "V5.3.1", + "Ordinal": 1, + "Description": "신뢰할 수 없는 입력으로 업로드되거나 생성되어 공개 폴더에 저장된 파일이 HTTP 요청으로 직접 접근될 때 서버 측 프로그램 코드로 실행되지 않는지 검증해야 한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.3.2", + "Ordinal": 2, + "Description": "애플리케이션이 파일 작업을 위한 파일 경로를 생성할 때, 사용자 제출 파일명 대신 내부적으로 생성되거나 신뢰할 수 있는 데이터를 사용하는지 검증해야 한다. 만약 사용자 제출 파일명 또는 파일 메타데이터를 반드시 사용해야 한다면, 경로 탐색(path traversal), 로컬 또는 원격 파일 포함(Local File Inclusion; LFI, Remote File Inclusion; RFI), 그리고 서버 측 요청 위조(Server-side Request Forgery; SSRF) 공격으로부터 보호하기 위해 엄격한 유효성 검사 및 정제(Sanitization)가 적용되는지 확인해야 한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.3.3", + "Ordinal": 3, + "Description": "파일 압축 해제와 같은 서버 측 파일 처리가 zip slip과 같은 취약점을 방지하기 위해 사용자 제공 경로 정보를 무시하는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V5.4", + "Ordinal": 4, + "Name": "파일 다운로드", + "Items": [ + { + "Shortcode": "V5.4.1", + "Ordinal": 1, + "Description": "애플리케이션이 JSON, JSONP 또는 URL 파라미터를 포함한 사용자 제출 파일명을 검증하거나 무시하는지 검증해야 하고, 응답의 Content-Disposition 헤더 필드에 파일명을 명시하는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.4.2", + "Ordinal": 2, + "Description": "제공되는 파일 이름(예: HTTP 응답 헤더 필드 또는 이메일 첨부 파일)이 문서 구조를 보존하고 삽입 공격(Injection Attack)을 방지하기 위해 인코딩되거나 정제되는지 검증해야 한다. (예: RFC 6266 준수)", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.4.3", + "Ordinal": 3, + "Description": "신뢰할 수 없는 소스에서 얻은 파일이 알려진 악성 콘텐츠 제공을 방지하기 위해 안티바이러스 스캐너에 의해 검사되는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V6", + "Ordinal": 6, + "ShortName": "Authentication", + "Name": "인증", + "Items": [ + { + "Shortcode": "V6.1", + "Ordinal": 1, + "Name": "Authentication Documentation", + "Items": [ + { + "Shortcode": "V6.1.1", + "Ordinal": 1, + "Description": "인증 문서가 크리덴셜 스터핑, 비밀번호 무차별 대입 공격 등을 방어하기 위해 속도 제한, 자동화 방지, 적응형 응답(adaptive response)과 같은 제어가 어떻게 사용되는지를 정의한다. 또한, 이러한 제어가 어떻게 구성되는지와 악의적으로 계정을 잠그는 것을 방지하는 방법을 명확히 하는지 검증한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.1.2", + "Ordinal": 2, + "Description": "조직명, 제품명, 시스템 식별자, 프로젝트 코드명, 부서명 또는 역할명 등 문맥적으로 특정된 단어의 변형을 포함하여, 비밀번호에 사용되지 않도록 문서화된 단어 목록이 있는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.1.3", + "Ordinal": 3, + "Description": "애플리케이션이 여러 인증 경로를 포함하는 경우, 이들 모두가 문서화되어 있으며 각 경로에 대해 일관되게 적용되는 보안 제어와 인증 강도가 정의되어 있는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.2", + "Ordinal": 2, + "Name": "비밀번호 보안", + "Items": [ + { + "Shortcode": "V6.2.1", + "Ordinal": 1, + "Description": "사용자가 설정하는 비밀번호가 최소 8자 이상이어야 하며, 최소 15자 이상을 강력히 권장하는지 검증한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.2", + "Ordinal": 2, + "Description": "사용자가 비밀번호를 변경할 수 있는지 검증한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.3", + "Ordinal": 3, + "Description": "비밀번호 변경 기능이 사용자의 현재 비밀번호와 새 비밀번호를 요구하는지 검증한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.4", + "Ordinal": 4, + "Description": "계정 등록 또는 비밀번호 변경 시 제출된 비밀번호가 최소 3000개의 상위 비밀번호 목록과 비교 및 검사되는지, 이때 애플리케이션 비밀번호 정책(예: 최소 길이)을 만족하는지 검증한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.5", + "Ordinal": 5, + "Description": "비밀번호는 어떤 구성도 허용되며, 허용되는 문자 유형에 대한 제한이 없는지 검증한다. 대/소문자, 숫자, 특수문자에 대한 최소 개수 요구사항이 없어야 한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.6", + "Ordinal": 6, + "Description": "비밀번호 입력 필드가 type=password를 사용하여 입력을 마스킹하는지 검증한다. 애플리케이션은 사용자가 전체 비밀번호나 마지막 입력 문자를 일시적으로 볼 수 있도록 허용할 수 있다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.7", + "Ordinal": 7, + "Description": "붙여넣기 기능, 브라우저 비밀번호 도우미, 외부 비밀번호 관리자의 사용이 허용되는지 검증한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.8", + "Ordinal": 8, + "Description": "애플리케이션이 비밀번호를 사용자로부터 수신한 그대로 검증하며, 대소문자 변경이나 잘림(truncation)과 같은 수정 없이 처리하는지 검증한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.9", + "Ordinal": 9, + "Description": "비밀번호가 최소 64자까지 허용되는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.10", + "Ordinal": 10, + "Description": "사용자의 비밀번호는 손상되었음이 발견되거나 사용자가 교체할 때까지 유효하며, 애플리케이션이 주기적인 자격 증명 교체를 요구하지 않는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.11", + "Ordinal": 11, + "Description": "문서화된 문맥별 단어 목록을 사용하여 추측하기 쉬운 비밀번호가 생성되지 않도록 하는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.12", + "Ordinal": 12, + "Description": "계정 등록 또는 비밀번호 변경 시 제출된 비밀번호가 유출된 비밀번호 집합과 비교 및 검사되는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.3", + "Ordinal": 3, + "Name": "일반 인증 보안", + "Items": [ + { + "Shortcode": "V6.3.1", + "Ordinal": 1, + "Description": "애플리케이션의 보안 문서에 따라 크리덴셜 스터핑 및 비밀번호 무차별 대입 공격을 방지하기 위한 제어가 구현되어 있는지 검증한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.2", + "Ordinal": 2, + "Description": "“root”, “admin”, “sa”와 같은 기본 사용자 계정이 애플리케이션에 존재하지 않거나 비활성화되어 있는지 검증한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.3", + "Ordinal": 3, + "Description": "애플리케이션 접근 시 반드시 MFA 또는 단일 요소 인증 메커니즘의 조합을 사용하는지 검증한다. L3의 경우, 인증을 수행하려는 사용자의 의도를 검증하기 위해 사용자가 직접 수행하는 동작(예: FIDO 하드웨어 키 또는 모바일 기기에서 버튼을 누르는 행위)을 요구함으로써, 피싱 공격에 대한 침해 및 위장 저항성을 제공하는 하드웨어 기반 인증 메커니즘이 반드시 하나의 요소로 포함되어야 한다. 이 요구사항에서 고려 사항을 완화하려는 경우, 완전히 문서화된 근거와 포괄적인 보완 통제가 반드시 수반되어야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.4", + "Ordinal": 4, + "Description": "여러 인증 경로가 존재하는 경우, 문서화되지 않은 경로가 없어야 하며 보안 제어와 인증 강도가 일관되게 적용되는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.5", + "Ordinal": 5, + "Description": "사용자가 의심스러운 인증 시도에 대해 성공 여부와 관계 없이 알림을 제공받는지 검증한다. 여기에는 비정상적인 위치나 클라이언트에서의 인증 시도, 부분적으로만 성공한 인증(여러 요소 중 하나만 성공한 경우), 장기간 비활성 상태 이후의 인증 시도, 또는 여러 번의 인증 실패 후 성공한 인증이 포함될 수 있다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.6", + "Ordinal": 6, + "Description": "이메일이 단일 또는 다중 요소 인증 메커니즘으로 사용되지 않는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.7", + "Ordinal": 7, + "Description": "자격 증명 재설정, 사용자명/이메일 수정 등 인증 관련 정보 변경 이후 사용자에게 통지되는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.8", + "Ordinal": 8, + "Description": "오류 메시지, HTTP 응답 코드, 응답 시간 차이 등을 통해 유효한 사용자를 유추할 수 없으며, 비밀번호 등록/찾기 기능에도 동일한 보호가 적용되는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.4", + "Ordinal": 4, + "Name": "인증 요소 수명 주기 및 복구", + "Items": [ + { + "Shortcode": "V6.4.1", + "Ordinal": 1, + "Description": "시스템이 생성하는 초기 비밀번호나 활성화 코드가 안전하게 난수로 생성되며, 기존 비밀번호 정책을 따르고, 짧은 기간 내 또는 최초 사용 시 만료되는지 검증한다. 초기 비밀번호는 장기 비밀번호로 허용되지 않아야 한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.2", + "Ordinal": 2, + "Description": "비밀번호 힌트나 지식 기반 인증(“비밀 질문”)이 존재하지 않는지 검증한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.3", + "Ordinal": 3, + "Description": "분실된 비밀번호에 대한 재설정 절차가 안전하게 구현되며, MFA를 우회하지 않는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.4", + "Ordinal": 4, + "Description": "MFA 요소 분실 시, 등록 시와 동일 수준의 신원 증명이 수행되는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.5", + "Ordinal": 5, + "Description": "만료 예정인 인증 메커니즘에 대한 갱신 안내가 충분한 시간 전에 발송되며, 필요한 경우 자동 알림이 구성되는지 검증한다", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.6", + "Ordinal": 6, + "Description": "관리자가 사용자 비밀번호 재설정 절차를 시작할 수 있으나, 사용자의 비밀번호를 직접 변경하거나 지정할 수 없는지 검증한다. 이는 관리자가 사용자의 비밀번호를 알지 못하도록 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.5", + "Ordinal": 5, + "Name": "General Multi-factor authentication requirements", + "Items": [ + { + "Shortcode": "V6.5.1", + "Ordinal": 1, + "Description": "조회 secret, 대역 외 인증 요청 및 코드, 시간 기반 일회용 비밀번호가 단 한 번만 성공적으로 사용 가능한지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.2", + "Ordinal": 2, + "Description": "애플리케이션 백엔드에 저장될 때, 엔트로피가 112비트 미만인 룩업 시크릿(예: 무작위 영숫자 19자 또는 무작위 숫자 34자)은 32비트 무작위 솔트(salt)를 포함하는 사전 승인된 비밀번호 저장용 해시 알고리즘으로 해시되는지 검증한다. 룩업 시크릿이 112비트 이상의 엔트로피를 가진 경우에는 표준 해시 함수를 사용할 수 있다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.3", + "Ordinal": 3, + "Description": "룩업 시크릿, 대역 외 인증 코드, 그리고 시간 기반 일회용 비밀번호의 시드가 예측 가능한 값을 피하기 위해 암호학적으로 안전한 의사난수 생성기(CSPRNG)를 사용하여 생성되는지 검증한다. ", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.4", + "Ordinal": 4, + "Description": "룩업 시크릿과 대역 외 인증 코드가 최소 20비트의 엔트로피를 가지는지 검증한다. 일반적으로 무작위 영숫자 4자 또는 무작위 숫자 6자가 충분하다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.5", + "Ordinal": 5, + "Description": "대역 외 인증 요청, 코드 또는 토큰과 시간 기반 일회용 비밀번호가 정의된 수명을 가지는지 검증한다. 대역 외 요청의 최대 수명은 10분이어야 하며, TOTP의 최대 수명은 30초이어야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.6", + "Ordinal": 6, + "Description": "도난이나 기타 손실의 경우 모든 인증 요소(물리적 장치 포함)를 해지할 수 있는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.7", + "Ordinal": 7, + "Description": "생체 인식 인증 메커니즘은 반드시 보조 요소로만 사용되어야 하며, “소유하고 있는 것” 또는 “알고 있는 것” 중 하나와 함께 사용되는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.8", + "Ordinal": 8, + "Description": "시간 기반 일회용 비밀번호는 신뢰할 수 있는 서비스의 시간 소스를 기준으로 검증되어야 하며, 신뢰할 수 없거나 클라이언트에서 제공한 시간을 기반으로 해서는 안 된다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.6", + "Ordinal": 6, + "Name": "대역 외(Out-of-Band) 인증 메커니즘", + "Items": [ + { + "Shortcode": "V6.6.1", + "Ordinal": 1, + "Description": "공중 교환 전화망(PSTN)을 사용하여 전화나 SMS를 통해 일회용 비밀번호(OTPs)를 전달하는 인증 메커니즘은, 해당 전화번호가 사전에 검증되었을 때만 제공되어야 하며, 더 강력한 대체 방법(예: 시간 기반 일회용 비밀번호)도 제공되어야 하고, 서비스는 사용자에게 이러한 보안 위험에 대한 정보를 제공해야 한다. L3 애플리케이션의 경우, 전화와 SMS는 옵션으로 제공되어서는 안 된다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.6.2", + "Ordinal": 2, + "Description": "대역 외 인증 요청, 코드 또는 토큰은 생성된 원래 인증 요청에만 바인딩되어야 하며, 이전이나 이후의 요청에는 사용할 수 없어야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.6.3", + "Ordinal": 3, + "Description": "코드 기반 대역 외 인증 메커니즘이 속도 제한 등을 통해 무차별 대입 공격으로부터 보호되는지 검증한다. 또한 최소 64비트 이상의 엔트로피를 가진 코드를 사용하는 것도 고려해야한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.6.4", + "Ordinal": 4, + "Description": "다중요소 인증에 푸시 알림이 사용되는 경우, 푸시 폭탄(push bombing) 공격을 방지하기 위해 속도 제한을 적용해야 한다. 또한 숫자 일치 기법 역시 이 위험을 완화할 수 있다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.7", + "Ordinal": 7, + "Name": "암호학적 인증 메커니즘", + "Items": [ + { + "Shortcode": "V6.7.1", + "Ordinal": 1, + "Description": "암호학적 인증 단언(assertion)을 검증하는 데 사용되는 인증서는 수정으로부터 보호되는 방식으로 저장되는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.7.2", + "Ordinal": 2, + "Description": "챌린지 논스(nonce)는 최소 64비트 길이여야 하며, 통계적으로 고유하거나 해당 암호 장치의 수명 동안 고유해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.8", + "Ordinal": 8, + "Name": "ID 제공자(IdP)를 통한 인증", + "Items": [ + { + "Shortcode": "V6.8.1", + "Ordinal": 1, + "Description": "애플리케이션이 다중 ID 제공자(IdP)를 지원하는 경우, 사용자의 신원이 다른 지원 IdP를 통해 위조될 수 없는지 검증한다. (예: 동일한 사용자 식별자를 사용하는 방식). 표준적인 대응책은 애플리케이션이 IdP ID(네임스페이스 역할)와 IdP 내 사용자 ID의 조합을 사용하여 사용자를 등록하고 식별하는 것이다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.8.2", + "Ordinal": 2, + "Description": "인증 단언(예: JWT 또는 SAML 단언)의 디지털 서명이 존재하고 무결성이 항상 유지되는지를 검증한다. 서명이 없거나 유효하지 않은 단언은 거부해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.8.3", + "Ordinal": 3, + "Description": "SAML 단언이 재생 공격의 방지를 위해 고유하게 처리되는지, 유효 기간 내에 단 한 번만 사용되는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.8.4", + "Ordinal": 4, + "Description": "애플리케이션이 별도의 ID 제공자(IdP)를 사용하고 특정 기능에 대해 특정 인증 강도, 방식, 또는 최근성을 요구하는 경우, 애플리케이션은 IdP가 반환한 정보를 사용하여 이를 검증해야 한다. 예를 들어, OIDC가 사용되는 경우, 이는 ‘acr’, ‘amr’, ‘auth_time’(존재하는 경우)과 같은 ID 토큰 클레임을 검증함으로써 달성할 수 있다. IdP가 이 정보를 제공하지 않는 경우, 애플리케이션은 최소 강도의 인증 메커니즘(예: 사용자 이름과 비밀번호를 사용하는 단일요소 인증)이 사용되었다고 가정하는 문서화된 대체 접근법을 가져야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V7", + "Ordinal": 7, + "ShortName": "Session", + "Name": "세션 관리", + "Items": [ + { + "Shortcode": "V7.1", + "Ordinal": 1, + "Name": "세션 관리 문서화", + "Items": [ + { + "Shortcode": "V7.1.1", + "Ordinal": 1, + "Description": "사용자의 세션 비활성 시간 초과 및 절대 최대 세션 수명에 대한 문서가 존재하고, 다른 제어와의 조합에서 적절하며, NIST SP 800-63B 재인증 요구사항에서 벗어날 시 그 근거가 문서에 포함되어 있는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.1.2", + "Ordinal": 2, + "Description": "문서가 하나의 계정에서 허용되는 동시(병렬) 세션 수와 활성 세션 수의 최대값에 도달했을 때의 의도된 동작과 수행할 조치를 정의하는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.1.3", + "Ordinal": 3, + "Description": "통합 신원 관리 생태계(예: SSO 시스템)의 일부로 사용자 세션을 생성하고 관리하는 모든 시스템이 문서화되어 있으며, 세션 수명, 종료, 재인증이 필요한 기타 조건을 조율하기 위한 제어가 포함되어 있는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.2", + "Ordinal": 2, + "Name": "기본 세션 관리 보안", + "Items": [ + { + "Shortcode": "V7.2.1", + "Ordinal": 1, + "Description": "애플리케이션이 모든 세션 토큰 검증을 신뢰할 수 있는 백엔드 서비스에서 수행하는지 검증한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.2.2", + "Ordinal": 2, + "Description": "애플리케이션이 세션 관리를 위해 정적 API 시크릿이나 키가 아닌, 자체 포함 토큰 또는 참조 토큰을 동적으로 생성하여 사용하는지 검증한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.2.3", + "Ordinal": 3, + "Description": "참조 토큰이 사용자 세션을 나타내는 데 사용되는 경우, 그 토큰이 고유하고, 암호학적으로 안전한 의사난수 생성기(CSPRNG)를 사용해 생성되며 최소 128비트의 엔트로피를 갖는지 검증한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.2.4", + "Ordinal": 4, + "Description": "애플리케이션이 사용자 인증(재인증 포함) 시 새로운 세션 토큰을 생성하고 기존 세션 토큰을 종료하는지 검증한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.3", + "Ordinal": 3, + "Name": "세션 타임아웃", + "Items": [ + { + "Shortcode": "V7.3.1", + "Ordinal": 1, + "Description": "위험 분석 및 문서화된 보안 결정에 따라 재인증을 강제하는 비활성 시간 초과가 존재하는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.3.2", + "Ordinal": 2, + "Description": "위험 분석 및 문서화된 보안 결정에 따라 재인증을 강제하는 절대 최대 세션 수명이 존재하는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.4", + "Ordinal": 4, + "Name": "세션 종료", + "Items": [ + { + "Shortcode": "V7.4.1", + "Ordinal": 1, + "Description": "로그아웃이나 만료와 같이 세션 종료가 트리거될 때, 애플리케이션이 해당 세션의 추가 사용을 허용하지 않는지 검증한다. 참조 토큰 또는 상태 유지형 세션의 경우, 이는 애플리케이션 백엔드에서 세션 데이터를 무효화하는 것을 의미한다. 자체 포함 토큰을 사용하는 애플리케이션은 종료된 토큰 목록 유지, 사용자별 날짜·시간 이전에 발급된 토큰 거부, 사용자별 서명 키 회전과 같은 방법을 사용해야 한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.4.2", + "Ordinal": 2, + "Description": "사용자 계정이 비활성화되거나 삭제될 때(예: 직원 퇴사), 애플리케이션이 모든 활성 세션을 종료하는지 검증한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.4.3", + "Ordinal": 3, + "Description": "비밀번호 재설정·복구를 통한 변경, MFA 설정 변경 등 어떤 인증 요소라도 성공적으로 변경 또는 제거한 후, 모든 다른 활성 세션을 종료할 수 있는 옵션을 제공하는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.4.4", + "Ordinal": 4, + "Description": "인증이 필요한 모든 페이지의 로그아웃 기능에 접근하는 것이 쉽고 잘 보이는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.4.5", + "Ordinal": 5, + "Description": "애플리케이션 관리자가 개별 사용자 또는 모든 사용자의 활성 세션을 종료할 수 있는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.5", + "Ordinal": 5, + "Name": "세션 악용 방어", + "Items": [ + { + "Shortcode": "V7.5.1", + "Ordinal": 1, + "Description": "이메일 주소, 전화번호, MFA 구성, 계정 복구에 사용되는 기타 정보 등 인증에 영향을 줄 수 있는 민감한 계정 속성을 변경하기 전에 전체 재인증을 요구하는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.5.2", + "Ordinal": 2, + "Description": "사용자가 현재 활성 세션을 전체 또는 일부 확인하고(최소 요소 한 개에 대한 인증을 다시 수행한 후) 종료할 수 있는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.5.3", + "Ordinal": 3, + "Description": "매우 민감한 거래나 작업을 수행하기 전에 최소 한 요소 인증 또는 2차 검증을 요구하는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.6", + "Ordinal": 6, + "Name": "페더레이션 재인증", + "Items": [ + { + "Shortcode": "V7.6.1", + "Ordinal": 1, + "Description": "RP와 IdP 간 세션 수명과 종료가 문서대로 동작하며, IdP 인증 이벤트 간의 최대 시간이 도달하는 경우 등 필요한 시점에 재인증을 요구하는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.6.2", + "Ordinal": 2, + "Description": "세션 생성 시 사용자 동의 또는 명시적 동작을 요구하여, 사용자 상호작용 없이 새로운 애플리케이션 세션이 생성되지 않도록 하는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V8", + "Ordinal": 8, + "ShortName": "Authorization", + "Name": "권한 부여", + "Items": [ + { + "Shortcode": "V8.1", + "Ordinal": 1, + "Name": "권한 부여 문서화", + "Items": [ + { + "Shortcode": "V8.1.1", + "Ordinal": 1, + "Description": "권한 부여 문서가 소비자 권한과 자원 속성에 따라 기능 수준 및 데이터별 접근을 제한하는 규칙을 정의하는지 검증한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.1.2", + "Ordinal": 2, + "Description": "권한 부여 문서가 소비자 권한과 자원 속성에 따라 필드 수준 접근 제한(읽기 및 쓰기 모두)을 정의하는지 검증한다. 이러한 규칙은 관련 데이터 객체의 상태(state)나 상태값(status)과 같은 다른 속성 값에 의존할 수 있다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.1.3", + "Ordinal": 3, + "Description": "애플리케이션 문서가 인증 및 권한 부여와 관련된 보안 결정을 내리는 데 사용되는 환경적, 맥락적 속성(예: 시간대, 사용자 위치, IP 주소, 디바이스 등)을 정의하는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.1.4", + "Ordinal": 4, + "Description": "인증 및 권한 부여 문서가 기능 수준, 데이터별, 필드 수준 권한 부여에 더해 환경적, 맥락적 요소가 의사 결정에 어떻게 사용되는지 정의하는지 검증한다. 여기에는 평가되는 속성, 위험 임계값, 수행되는 조치(예: 허용, 추가 인증 요청, 거부, 단계적 인증)을 포함하는 것을 권장한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V8.2", + "Ordinal": 2, + "Name": "일반 권한 부여 설계", + "Items": [ + { + "Shortcode": "V8.2.1", + "Ordinal": 1, + "Description": "애플리케이션이 기능 수준의 접근을 명시적 권한이 있는 소비자에게만 허용하는지 검증한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.2.2", + "Ordinal": 2, + "Description": "애플리케이션이 특정 데이터 항목에 대한 명시적 권한이 있는 소비자에게만 데이터별 접근을 허용하여, 안전하지 않은 직접 객체 참조(IDOR) 및 객체 수준 권한 부여 취약점(BOLA)을 방지하는지 검증한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.2.3", + "Ordinal": 3, + "Description": "애플리케이션이 특정 필드에 대한 명시적 권한이 있는 소비자에게만 필드 수준 접근을 허용하여, 객체 속성 수준 권한 부여 취약점(BOPLA)을 방지하는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.2.4", + "Ordinal": 4, + "Description": "애플리케이션 문서에서 정의한 바에 따라, 소비자의 환경적, 맥락적 속성(예: 시간대, 위치, IP 주소 또는 장치)에 기반한 적응형 보안 제어가 인증 및 권한 부여 결정에 구현되는지 검증한다. 이러한 제어는 소비자가 새 세션을 시작할 때뿐만 아니라 기존 세션 중에도 반드시 적용되어야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V8.3", + "Ordinal": 3, + "Name": "운영 수준 권한 부여", + "Items": [ + { + "Shortcode": "V8.3.1", + "Ordinal": 1, + "Description": "애플리케이션이 권한 부여 규칙을 신뢰할 수 있는 서비스 계층에서 적용하고, 클라이언트 측 JavaScript처럼 신뢰할 수 없는 소비자가 조작할 수 있는 제어에 의존하지 않는지 검증한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.3.2", + "Ordinal": 2, + "Description": "권한 부여 결정에 영향을 미치는 값의 변경 사항이 즉시 적용되는지 검증한다. 자체 포함 토큰(self-contained token)과 같이 즉시 적용이 불가능한 경우, 소비자가 더 이상 권한이 없는 작업을 수행할 때 이를 알리고 변경을 되돌리는 완화 제어를 반드시 두어야 한다. 단, 이 방법은 정보 유출을 방지하지는 못한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.3.3", + "Ordinal": 3, + "Description": "객체에 대한 접근이, 대리인이나 이를 대신 수행하는 서비스의 권한이 아닌, 원래 주체(예: 소비자)의 권한에 기반하는지 검증한다. 예를 들어, 소비자가 인증을 위해 자체 포함 토큰을 사용하여 웹 서비스를 호출하고, 해당 서비스가 다른 서비스에 데이터를 요청하는 경우, 두 번째 서비스는 첫 번째 서비스의 머신-투-머신 토큰이 아니라 소비자의 토큰을 사용하여 권한 결정을 내려야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V8.4", + "Ordinal": 4, + "Name": "기타 권한 부여 고려사항", + "Items": [ + { + "Shortcode": "V8.4.1", + "Ordinal": 1, + "Description": "다중 테넌트 애플리케이션이 교차 테넌트 제어를 사용하여, 소비자의 작업이 권한이 없는 다른 테넌트에 영향을 미치지 않도록 하는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.4.2", + "Ordinal": 2, + "Description": "관리 인터페이스 접근이 연속적인 소비자 신원 검증, 장치 보안 상태 평가, 맥락 기반 위험 분석 등 복수의 보안 계층을 포함하는지 검증한다. 네트워크 위치나 신뢰된 엔드포인트가 무단 접근 가능성을 줄일 수는 있더라도, 단독으로 권한 부여 판단의 유일한 요소가 되어서는 안 된다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V9", + "Ordinal": 9, + "ShortName": "Self", + "Name": "자체 포함 토큰(self-contained token)", + "Items": [ + { + "Shortcode": "V9.1", + "Ordinal": 1, + "Name": "토큰 출처 및 무결성", + "Items": [ + { + "Shortcode": "V9.1.1", + "Ordinal": 1, + "Description": "자체 포함 토큰 내용을 허용하기 전에 변조를 방지하기 위해 디지털 서명 또는 메시지 인증 코드(MAC)를 사용하여 토큰의 무결성을 검증해야 한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.1.2", + "Ordinal": 2, + "Description": "주어진 컨텍스트에 대해 자체 포함 토큰을 생성하고 검증할 때, 허용 목록에 있는 알고리즘만 사용될 수 있는지 검증해야 한다. 허용 목록에는 사용 가능한 알고리즘을 모두 포함해야 하며, 이상적으로는 대칭 또는 비대칭 알고리즘 중 하나만을 포함해야 한다. 또한 'None' 알고리즘은 반드시 제외해야 한다. 대칭 및 비대칭 알고리즘 모두를 지원해야 하는 경우, 키 혼동을 방지하기 위해 추가 제어가 필요하다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.1.3", + "Ordinal": 3, + "Description": "자체 포함 토큰을 검증하는 데 사용되는 키 자료가 토큰 발행자를 위한 신뢰할 수 있는 사전 구성된 출처에서 비롯되었는지 검증하여, 공격자가 신뢰할 수 없는 출처 및 키를 지정하는 것을 방지해야 한다. JWT 및 기타 JWS 구조의 경우, 'jku', 'x5u', 'jwk'와 같은 헤더는 신뢰할 수 있는 출처의 허용 목록에 대해 검증되어야 한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V9.2", + "Ordinal": 2, + "Name": "토큰 내용", + "Items": [ + { + "Shortcode": "V9.2.1", + "Ordinal": 1, + "Description": "토큰 데이터에 유효 기간이 존재하는 경우, 검증 시간이 이 유효 기간 내에 있을 때만 토큰 및 해당 내용이 허용되는지 검증해야 한다. 예를 들어, JWT의 경우 'nbf' 및 'exp' 클레임이 검증되어야 한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.2.2", + "Ordinal": 2, + "Description": "토큰을 수신하는 서비스가 토큰 내용을 수락하기 전에 올바른 유형이며 의도된 목적을 위한 것인지 토큰을 검증하는지 확인해야 한다. 예를 들어, 인가 결정에는 액세스 토큰만 허용될 수 있으며, 사용자 인증을 증명하는 데는 ID 토큰만 사용될 수 있다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.2.3", + "Ordinal": 3, + "Description": "서비스가 대상 서비스(audience)와 함께 사용하기 위한 토큰만 허용하는지 검증해야 한다. JWT의 경우, 서비스에 정의된 허용 목록에 대해 'aud' 클레임을 검증함으로써 이를 달성할 수 있다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.2.4", + "Ordinal": 4, + "Description": "토큰 발행자가 다른 대상(audience)에게 토큰을 발행하기 위해 동일한 개인 키를 사용하는 경우, 발행된 토큰이 의도된 대상을 고유하게 식별하는 대상 제한을 포함하는지 검증해야 한다. 이는 토큰이 의도하지 않은 대상에서 재사용되는 것을 방지한다. 대상 식별자가 동적으로 프로비저닝되는 경우, 토큰 발행자는 대상 위장(audience impersonation)을 초래하지 않도록 대상들을 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V10", + "Ordinal": 10, + "ShortName": "OAuth", + "Name": "OAuth와 OIDC", + "Items": [ + { + "Shortcode": "V10.1", + "Ordinal": 1, + "Name": "일반적인 OAuth 및 OIDC 보안", + "Items": [ + { + "Shortcode": "V10.1.1", + "Ordinal": 1, + "Description": "엄격하게 필요한 구성 요소에만 토큰이 전송되는지 검증해야 한다. 예를 들어, 브라우저 기반 JavaScript 애플리케이션에 프론트엔드 전용 백엔드(Backend For Frontend; BFF) 패턴을 사용하는 경우, 액세스 토큰 및 리프레시 토큰은 백엔드에서만 접근 가능해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.1.2", + "Ordinal": 2, + "Description": "클라이언트는 인가 서버에서 제공하는 값(예: 인가 코드 또는 ID 토큰)이 동일한 사용자 에이전트 세션 및 트랜잭션에서 시작된 인가 플로우의 결과인 경우에만 허용하는지 검증해야 한다. 이를 위해 클라이언트가 생성하는 비밀 값(PKCE(Proof Key for Code Exchange)의 'code_verifier', 'state', OIDC의 'nonce' 등)은 추측이 불가능해야 하며, 해당 트랜잭션에 고유해야 하고, 트랜잭션이 시작된 클라이언트와 사용자 에이전트 세션 양쪽에 안전하게 결합(Binding)되어 있어야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.2", + "Ordinal": 2, + "Name": "OAuth 클라이언트", + "Items": [ + { + "Shortcode": "V10.2.1", + "Ordinal": 1, + "Description": "코드 플로우를 사용하는 경우, OAuth 클라이언트는 토큰 요청을 유도하는 사이트 간 요청 위조 공격(Cross-Site Request Forgery; CSRF)에 대한 보호 기능을 갖추고 있는지 검증한다. 이를 위해 인가 요청 시 전송된 'state' 파라미터를 검증하거나, PKCE 기능을 사용해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.2.2", + "Ordinal": 2, + "Description": "OAuth 클라이언트가 둘 이상의 인가 서버와 상호 작용할 수 있는 경우, 믹스업 공격에 대한 방어 대책을 갖는지 검증해야 한다. 예를 들어, 인가 서버가 'iss' 파라미터 값을 반환하도록 요구하고 인가 응답 및 토큰 응답에서 이를 검증할 수 있다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.2.3", + "Ordinal": 3, + "Description": "OAuth 클라이언트가 인가 서버에 대한 요청에서 필요한 범위(또는 기타 인가 파라미터)만 요청하는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.3", + "Ordinal": 3, + "Name": "OAuth 리소스 서버", + "Items": [ + { + "Shortcode": "V10.3.1", + "Ordinal": 1, + "Description": "리소스 서버가 해당 서비스(audience)에 사용하도록 의도된 액세스 토큰만 수락하는지 검증해야 한다. 대상은 구조화된 액세스 토큰(예: JWT의 'aud' 클레임)에 포함될 수 있거나, 토큰 조회 엔드포인트를 사용하여 확인할 수 있다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.3.2", + "Ordinal": 2, + "Description": "리소스 서버가 위임된 인가를 정의하는 액세스 토큰의 클레임을 기반으로 인가 결정을 시행하는지 검증해야 한다. 'sub', 'scope', 'authorization_details'와 같은 클레임이 존재하는 경우, 이는 결정에 반영되어야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.3.3", + "Ordinal": 3, + "Description": "액세스 토큰(JWT 또는 관련 토큰 조회 응답)에서 고유한 사용자를 식별해야 하는 접근 제어 결정이 필요한 경우, 리소스 서버가 다른 사용자에게 재할당될 수 없는 클레임에서 사용자를 식별하는지 검증해야 한다. 일반적으로 이는 'iss' 및 'sub' 클레임의 조합을 사용하는 것을 의미한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.3.4", + "Ordinal": 4, + "Description": "리소스 서버가 특정 인증 강도, 방법 또는 최신성을 요구하는 경우, 제시된 액세스 토큰이 이러한 제약 조건을 충족하는지 검증해야 한다. 예를 들어, 토큰을 제시한 경우 OIDC의 'acr', 'amr' 및 'auth_time' 클레임을 각각 사용해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.3.5", + "Ordinal": 5, + "Description": "리소스 서버가 발신자 제약 액세스 토큰, 즉 OAuth 2용 상호 TLS(Mutual TLS; mTLS) 또는 OAuth 2 소유 증명(Demonstration of Proof of Possession; DPoP)를 요구하여 도난된 액세스 토큰 사용 또는 액세스 토큰 재사용(권한 없는 당사자로부터)을 방지하는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.4", + "Ordinal": 4, + "Name": "OAuth 인가 서버", + "Items": [ + { + "Shortcode": "V10.4.1", + "Ordinal": 1, + "Description": "인가 서버는 클라이언트 별로 사전 등록된 URI의 허용 목록을 기반으로 리디렉션 URI를 정확한 문자열 비교 방식으로 검증해야 한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.2", + "Ordinal": 2, + "Description": "인가 서버가 인가 응답에서 인가 코드를 반환하는 경우, 해당 코드는 토큰 요청에 한번만 사용될 수 있어야 한다. 이미 액세스 토큰을 발급하는 데 사용된 인가 코드를 사용하여 두 번째 요청이 발생하면, 인가 서버는 토큰 요청을 거부하고 해당 인가 코드와 관련된 모든 발급된 토큰을 취소해야 한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.3", + "Ordinal": 3, + "Description": "인가 코드가 단기간만 유효한지 검증해야 한다. 최대 수명은 L1 및 L2 애플리케이션의 경우 최대 10분, L3 애플리케이션의 경우 최대 1분 이내여야 한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.4", + "Ordinal": 4, + "Description": "인가 서버는 특정 클라이언트에 대해, 해당 클라이언트가 사용할 필요가 있는 인가 방식(grant)만 사용하도록 허용해야 한다. token(암시적 플로우) 및 password(리소스 소유자 비밀번호 자격 증명 플로우) 방식은 더 이상 사용되어서는 안 된다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.5", + "Ordinal": 5, + "Description": "인가 서버가 공개 클라이언트에 대한 리프레시 토큰 재사용 공격을 완화하는지 검증해야 한다. 가급적이면 발신자 제약 리프레시 토큰, 즉 소유 증명이나 mTLS를 사용한 인증서 바인딩 액세스 토큰을 사용해야 한다. L1 및 L2 애플리케이션의 경우, 리프레시 토큰 회전(rotation)이 사용될 수 있다. 리프레시 토큰 회전이 사용되는 경우, 인가 서버는 리프레시 토큰을 사용 후 무효화해야 하며, 이미 사용되고 무효화된 리프레시 토큰이 제공되면 해당 인가에 대한 모든 리프레시 토큰을 철회(revoke)해야 한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.6", + "Ordinal": 6, + "Description": "코드 인가 방식(code grant)이 사용되는 경우, 인가 서버가 PKCE를 요구하여 인가 코드 탈취 공격을 완화하는지 검증해야 한다. 인가 요청의 경우, 인가 서버는 유효한 'code_challenge' 값을 요구해야 하며, 'code_challenge_method'값으로 'plain'를 허용해서는 안 된다. 토큰 요청의 경우, 'code_verifier' 파라미터의 검증을 요구해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.7", + "Ordinal": 7, + "Description": "인가 서버가 인증되지 않은 동적 클라이언트 등록을 지원하는 경우, 악의적인 클라이언트 애플리케이션의 위험을 완화하는지 검증해야 한다. 등록된 URI와 같은 클라이언트 메타데이터를 검증하고, 사용자의 동의를 확인해야 하며, 신뢰할 수 없는 클라이언트 애플리케이션으로 인가 요청을 처리하기 전에 사용자에게 경고해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.8", + "Ordinal": 8, + "Description": "슬라이딩 리프레시 토큰 만료(expiration)가 적용되더라도, 리프레시 토큰에 절대 만료 시점(absolute expiration)이 포함되어 있는지 확인한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.9", + "Ordinal": 9, + "Description": "악의적인 클라이언트 또는 도난된 토큰의 위험을 완화하기 위해 인가 서버 사용자 인터페이스를 통해 권한 있는 사용자가 리프레시 토큰 및 참조 액세스 토큰을 철회할 수 있는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.10", + "Ordinal": 10, + "Description": "토큰 요청, 푸시된 인가 요청(Pushed Authorization Request; PAR), 토큰 철회 요청과 같은 클라이언트에서 인가 서버로의 백채널 요청(backchannel request)에 대해 기밀 클라이언트가 인증되는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.11", + "Ordinal": 11, + "Description": "인가 서버 구성이 OAuth 클라이언트에 필요한 범위만 할당하는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.12", + "Ordinal": 12, + "Description": "주어진 클라이언트에 대해 인가 서버가 해당 클라이언트가 사용해야 하는 'response_mode' 값만 허용하는지 검증해야 한다. 예를 들어, 인가 서버가 이 값을 예상 값과 비교하여 검증하거나, PAR 또는 JWT 기반 인가 요청(JWT-secured Authorization Request; JAR)을 사용하여 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.13", + "Ordinal": 13, + "Description": "인가 유형 'code'가 항상 PAR과 함께 사용되는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.14", + "Ordinal": 14, + "Description": "인가 서버가 mTLS를 사용하는 인증서 바인딩 액세스 토큰 또는 소유 증명 바인딩 액세스 토큰을 사용하여 발신자 제약(Proof-of-Possession) 액세스 토큰만 발급하는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.15", + "Ordinal": 15, + "Description": "최종 사용자 장치에서 실행되지 않는 서버에서 동작하는 클라이언트의 경우, 인가 서버가 'authorization_details' 파라미터 값이 클라이언트 백엔드로부터 생성되었는지와 사용자가 해당 값을 변조되지 않았는지를 검증해야 한다. 예를 들어, PAR 또는 JAR의 사용을 요구하여 확인해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.16", + "Ordinal": 16, + "Description": "클라이언트가 기밀 클라이언트인지 검증하고, 인가 서버는 재사용 공격에 강하고 공개키 암호화에 기반한 강력한 클라이언트 인증 방식을 사용하도록 요구해야 한다. 예를 들어, mTLS(tls_client_auth, self_signed_tls_client_auth) 또는 비공개 키 기반 JWT 인증(private_key_jwt) 등이 이에 해당한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.5", + "Ordinal": 5, + "Name": "OIDC 클라이언트", + "Items": [ + { + "Shortcode": "V10.5.1", + "Ordinal": 1, + "Description": "신뢰 당사자로서 클라이언트가 ID 토큰 재사용 공격을 완화하는지 검증해야 한다. 예를 들어, ID 토큰의 'nonce' 클레임이 OpenID 공급자에 전송된 인증 요청(OAuth2에서는 인가 서버에 전송된 인가 요청)에서 전송된 'nonce' 값과 일치하는지 확인해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.5.2", + "Ordinal": 2, + "Description": "클라이언트가 ID 토큰 클레임, 일반적으로 'sub' 클레임에서 사용자를 고유하게 식별하며, 해당 클레임이 ID 공급자 범위 내에서 다른 사용자에게 재할당될 수 없는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.5.3", + "Ordinal": 3, + "Description": "클라이언트는 악의적인 인가 서버가 인가 서버 메타데이터를 통해 다른 인가 서버를 가장하려는 시도를 거부하는지 검증해야 한다. 클라이언트는 인가 서버 메타데이터에 포함된 발급자(issuer) URL이 클라이언트가 예상하는 사전 구성된 발급자 URL과 정확히 일치하지 않는 경우, 해당 메타데이터를 거부해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.5.4", + "Ordinal": 4, + "Description": "클라이언트는 토큰의 aud 클레임 값이 클라이언트의 client_id 값과 동일한지 확인하여 ID 토큰이 해당 클라이언트(audience)를 대상으로 발급되었음을 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.5.5", + "Ordinal": 5, + "Description": "OIDC 백채널 로그아웃을 사용하는 경우, 신뢰 당사자는 강제 로그아웃을 통한 서비스 거부 공격(Denial of Service) 및 로그아웃 플로우에서의 JWT 혼동(cross-JWT confusion)을 완화하는지 검증해야 한다. 클라이언트는 로그아웃 토큰이 'logout+jwt' 값으로 올바르게 지정되어 있는지, 올바른 멤버 이름을 가진 'event' 클레임을 포함하는지, 그리고 'nonce' 클레임을 포함하지 않는지 검증해야 한다. 또한, 짧은 만료 시간(예: 2분)을 갖는 것이 권장된다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.6", + "Ordinal": 6, + "Name": "OpenID 공급자", + "Items": [ + { + "Shortcode": "V10.6.1", + "Ordinal": 1, + "Description": "OpenID 공급자는 response_mode 파라미터 값으로'code', 'ciba', 'id_token' 또는 'id_token code' 만 허용하는지 검증해야 한다. 이 중 'id_token code'(OIDC 하이브리드 플로우)보다는 'code'가 선호되며, 'token'(모든 암시적 플로우)은 사용되어서는 안 된다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.6.2", + "Ordinal": 2, + "Description": "OpenID 공급자가 강제 로그아웃을 통한 서비스 거부 공격을 완화하는지 검증해야 한다. 신뢰 당사자로 부터 시작된 로그아웃 요청에 id_token_hint 등의 파라미터가 포함되어 있는 경우, 이를 검증하거나 최종 사용자로부터 명시적인 확인을 받아야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.7", + "Ordinal": 7, + "Name": "동의 관리", + "Items": [ + { + "Shortcode": "V10.7.1", + "Ordinal": 1, + "Description": "인가 서버가 사용자로부터 각 인가 요청에 대한 명시적인 동의(consent)를 확인하는지 검증해야 한다. 클라이언트의 신원을 보장할 수 없는 경우, 인가 서버는 항상 사용자에게 명시적으로 동의를 요청해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.7.2", + "Ordinal": 2, + "Description": "인가 서버가 사용자 동의를 요청할 때, 동의하는 내용에 대한 충분하고 명확한 정보를 제공하는지 검증해야 한다. 이에 해당하는 경우, 요청된 인가의 성격(일반적으로 범위, 리소스 서버, RAR(Rich Authorization Requests) 인가 세부 정보 기반), 인가된 애플리케이션의 신원, 인가의 유효 기간이 포함되어야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.7.3", + "Ordinal": 3, + "Description": "사용자가 인가 서버를 통해 부여한 동의를 검토, 수정 및 철회할 수 있는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V11", + "Ordinal": 11, + "ShortName": "Cryptography", + "Name": "암호화", + "Items": [ + { + "Shortcode": "V11.1", + "Ordinal": 1, + "Name": "암호화 인벤토리 및 문서화", + "Items": [ + { + "Shortcode": "V11.1.1", + "Ordinal": 1, + "Description": "'NIST SP 800-57'과 같은 암호화 키 관리 및 키 관리 표준을 따르는 암호화 키 수명 주기에 대한 문서화 된 정책이 있는지 검증해야 한다. 여기에는 키가 과도하게 공유되지 않도록 하는 것이 포함된다(예: 공유 비밀의 경우 두 개를 초과하는 엔터티와 공유 및 개인 키의 경우 한 개를 초과하는 엔터티에 공유).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.1.2", + "Ordinal": 2, + "Description": "애플리케이션에서 사용되는 모든 암호화 키, 알고리즘, 인증서를 포함한 암호화 자산 목록(cryptographic inventory)이 작성되고, 유지되며, 정기적으로 업데이트되고 있는지 검증해야 한다. 또한, 각 키가 시스템 내에서 사용 가능한 위치와 사용이 제한되는 위치, 해당 키로 보호할 수 있는 데이터 유형과 보호할 수 없는 데이터 유형이 문서화되어 있어야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.1.3", + "Ordinal": 3, + "Description": "암호화, 해싱, 서명 작업을 포함하는 시스템 내의 모든 암호화 사용 사례를 식별하기 위해, 암호화 사용 탐지 메커니즘이 적용되는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.1.4", + "Ordinal": 4, + "Description": "암호화 자산 목록이 유지 관리되는지 검증해야 한다. 여기에는 미래의 위협에 대응하기 위해 양자 내성 암호(Post-Quantum Cryptography; PQC)와 같은 새로운 암호화 표준으로의 마이그레이션 계획을 설명하는 문서화된 계획이 포함되어야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.2", + "Ordinal": 2, + "Name": "안전한 암호화 구현", + "Items": [ + { + "Shortcode": "V11.2.1", + "Ordinal": 1, + "Description": "암호화 작업에 업계에서 검증된 구현(라이브러리 및 하드웨어 가속 구현 포함)이 사용되는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.2.2", + "Ordinal": 2, + "Description": "난수, 인증 암호화, MAC, 해싱 알고리즘, 키 길이, 라운드, 암호 및 모드를 언제든지 재구성, 업그레이드 또는 교체하여 암호화 해독으로부터 보호할 수 있도록 애플리케이션이 암호화 유연성(crypto agility)을 갖추고 설계되었는지 검증해야 한다. 또한, 키와 비밀번호를 교체하고 데이터를 다시 암호화하는 것도 가능해야 한다. 이를 통해 승인된 PQC 체계(또는 표준)의 고신뢰 구현이 널리 사용 가능해지면 PQC로 원활하게 업그레이드할 수 있다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.2.3", + "Ordinal": 3, + "Description": "모든 암호화 기본 구성요소(primitive)가 알고리즘, 키 크기 및 구성에 따라 최소 128비트의 보안강도를 제공하는지 검증해야 한다. 예를 들어, 256비트 ECC 키는 대략 128비트의 보안을 제공하며, RSA는 128비트의 보안을 달성하기 위해 3072비트 키를 필요로 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.2.4", + "Ordinal": 4, + "Description": "민감한 정보가 누출되는 것을 방지하기 위해 모든 암호화 연산은 상수 시간(constant-time)으로 수행되어야 하며, 비교, 계산, 반환 과정에서 단락(short-circuit) 연산이 없는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.2.5", + "Ordinal": 5, + "Description": "모든 암호화 모듈이 안전하게 실패하고, 패딩 오라클 공격(Padding Oracle attacks)과 같은 취약점을 허용하지 않는 방식으로 오류가 처리되는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.3", + "Ordinal": 3, + "Name": "암호화 알고리즘", + "Items": [ + { + "Shortcode": "V11.3.1", + "Ordinal": 1, + "Description": "안전하지 않은 블록 모드(예: ECB) 및 약한 패딩 방식(예: PKCS#1 v1.5)가 사용되지 않는지 검증해야 한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.3.2", + "Ordinal": 2, + "Description": "GCM을 사용하는 AES와 같이 승인된 암호 및 모드만 사용되는지 검증해야 한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.3.3", + "Ordinal": 3, + "Description": "암호화 된 데이터가 승인된 인증된 암호화 방식을 사용하거나, 승인된 암호화 방식과 승인된 MAC 알고리즘을 조합을 통한 무단 수정으로부터 보호되는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.3.4", + "Ordinal": 4, + "Description": "논스(nonces), 초기화 벡터 및 기타 단일 사용 번호가 둘 이상의 암호화 키 및 데이터 요소 쌍에 사용되지 않는지 검증해야 한다. 생성 방법은 사용되는 알고리즘에 적합해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.3.5", + "Ordinal": 5, + "Description": "암호화 알고리즘과 MAC 알고리즘의 모든 조합이 암호화 후 MAC(Encrypt-then-MAC) 방식으로 동작하는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.4", + "Ordinal": 4, + "Name": "해싱 및 해시 기반 함수", + "Items": [ + { + "Shortcode": "V11.4.1", + "Ordinal": 1, + "Description": "디지털 서명, HMAC, KDF 및 무작위 비트 생성을 포함한 일반적인 암호화 사용 사례에 승인된 해시 함수만 사용되는지 검증해야 한다. MD5와 같이 허용되지 않는 해시 함수는 어떤 암호화 목적으로도 사용해서는 안 된다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.4.2", + "Ordinal": 2, + "Description": "비밀번호가 승인된 '계산 집약적인 키 유도 함수(\"비밀번호 해싱 함수\"라고도 함)'를 사용하여 저장되고, 파라미터 설정이 현재 지침에 따라 구성되었는지 검증해야 한다. 설정은 필요한 보안 수준에 대한 무차별 대입 공격을 충분히 어렵게 만들기 위해 보안과 성능의 균형을 이루어야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.4.3", + "Ordinal": 3, + "Description": "데이터 인증 또는 데이터 무결성의 일부로 디지털 서명에 사용되는 해시 함수가 충돌 저항성을 가지며 적절한 비트 길이를 갖는지 검증해야 한다. 충돌 저항성이 필요한 경우, 출력 길이는 최소 256비트여야 한다. 제2 역상(pre-image) 공격 저항성만 필요한 경우, 출력 길이는 최소 128비트여야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.4.4", + "Ordinal": 4, + "Description": "비밀번호로부터 비밀 키를 유도할 때 애플리케이션이 키 스트레칭(key stretching) 파라미터를 사용하여 승인된 키 유도 함수(key derivation function)를 사용하는지 검증해야 한다. 사용 중인 파라미터는 결과적인 암호화 키를 손상시키는 무차별 대입 공격을 방지하기 위해 보안과 성능의 균형을 이루어야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.5", + "Ordinal": 5, + "Name": "무작위 값", + "Items": [ + { + "Shortcode": "V11.5.1", + "Ordinal": 1, + "Description": "예측 불가능해야 하는 모든 난수 및 문자열이 암호학적으로 안전한 의사 난수 생성기(CSPRNG)를 사용하여 생성되고 최소 128비트의 엔트로피를 갖는지 검증해야 한다. UUID는 이 조건을 충족하지 않는다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.5.2", + "Ordinal": 2, + "Description": "사용 중인 난수 생성 메커니즘이 높은 부하(heavy demand)에서도 안전하게 작동하도록 설계되었는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.6", + "Ordinal": 6, + "Name": "공개 키 암호화", + "Items": [ + { + "Shortcode": "V11.6.1", + "Ordinal": 1, + "Description": "키 생성 및 시딩, 디지털 서명 생성 및 검증에 승인된 암호화 알고리즘 및 작동 모드만 사용되는지 검증해야 한다. 키 생성 알고리즘은 알려진 공격에 취약한 안전하지 않은 키(예: 페르마 인수분해(Fermat factorization)에 취약한 RSA 키)를 생성해서는 안 된다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.6.2", + "Ordinal": 2, + "Description": "키 교환에는 디피-헬만과 같은 승인된 암호화 알고리즘이 사용되어야 하며, 안전한 파라미터를 사용하는지 여부를 중점적으로 검증해야 한다.이는 중간자 공격(adversary-in-the-middle attacks) 또는 암호화 해독으로 이어질 수 있는 키 설정 프로세스에 대한 공격을 방지할 것이다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.7", + "Ordinal": 7, + "Name": "사용 중 데이터 암호화", + "Items": [ + { + "Shortcode": "V11.7.1", + "Ordinal": 1, + "Description": "사용 중인 민감한 데이터를 보호하고 무단 사용자 또는 프로세스의 접근을 방지하기 위해 전체 메모리 암호화가 사용되는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.7.2", + "Ordinal": 2, + "Description": "데이터 최소화가 처리 중에 노출되는 데이터의 양을 최소화하고, 사용 직후 또는 가능한 한 빨리 데이터가 암호화되도록 보장하는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V12", + "Ordinal": 12, + "ShortName": "Secure", + "Name": "보안 통신", + "Items": [ + { + "Shortcode": "V12.1", + "Ordinal": 1, + "Name": "일반 TLS 보안 가이드", + "Items": [ + { + "Shortcode": "V12.1.1", + "Ordinal": 1, + "Description": "TLS 1.2 및 TLS 1.3과 같은 최신 권장 버전의 TLS 프로토콜만 활성화되어 있으며, 그중 최신 버전이 우선되어야 한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.1.2", + "Ordinal": 2, + "Description": "오직 권장되는 암호화 스위트(cipher suites)들이 활성화되어 있으며 그 중 가장 강력한 암호화 스위트로 우선 설정되어 있는지 확인한다. 레벨3 애플리케이션은 순방향 비밀성(forward secrecy)을 제공하는 암호화 스위트만 지원해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.1.3", + "Ordinal": 3, + "Description": "인증이나 권한 부여를 위해 인증서 ID를 사용하기 전에 애플리케이션이 mTLS 클라이언트 인증서가 신뢰할 수 있는지 검증해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.1.4", + "Ordinal": 4, + "Description": "Online Certificate Status Protocol (OCSP) 스테이플링(Stapling)과 같은 적절한 인증서 폐지 프로토콜이 활성화되고 설정되어 있는지 확인해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.1.5", + "Ordinal": 5, + "Description": "TLS 핸드셰이크 프로세스 중 Server Name Indication (SNI)과 같은 민감한 메타 데이터의 노출을 방지하기 위해 애플리케이션 TLS 설정에서 Encrypted Client Hello (ECH)가 활성화되어 있는지 확인해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V12.2", + "Ordinal": 2, + "Name": "외부 서비스와의 HTTPS 통신", + "Items": [ + { + "Shortcode": "V12.2.1", + "Ordinal": 1, + "Description": "TLS는 클라이언트와 외부 HTTP 기반 서비스 간의 모든 연결에 사용되며, 안전하지 않거나 암호화 되어 있지 않은 통신에 대체 동작(fall back)이 발생하지 않는지 확인해야한다. ", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.2.2", + "Ordinal": 2, + "Description": "외부 서비스가 공적으로 신뢰된 TLS 인증서를 사용하는지 확인해야 한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V12.3", + "Ordinal": 3, + "Name": "일반 서비스 간의 통신 보안", + "Items": [ + { + "Shortcode": "V12.3.1", + "Ordinal": 1, + "Description": "애플리케이션간의 모니터링 시스템, 관리 도구, 원격 엑세스 및 SSH, 미들웨어, 데이터베이스, 메인프레임, 파트너 시스템이나 외부 API를 포함한 모든 인바운드와 아웃바운드 통신은 TLS같은 암호화 프로토콜이 사용되는지 확인해야 한다. 이 서버는 안전하지 않거나 암호화 되어있지 않은 프로토콜에 대체 동작(fall back)이 발생하지 않아야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.3.2", + "Ordinal": 2, + "Description": "TLS 클라이언트가 통신하기 전에 TLS서버로 부터 받은 인증서를 검증하는지 확인해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.3.3", + "Ordinal": 3, + "Description": "그리고 TLS 또는 애플리케이션 내의 내부 HTTP 기반 서비스간에 사용된 다른 적절한 전송 암호화 매커니즘이 안전하지 않거나 암호화 되어있지 않은 통신에 대체 동작(fall back)이 발생하지 않는지 확인해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.3.4", + "Ordinal": 4, + "Description": "내부 서버간에 TLS 통신이 신뢰된 인증서를 사용하는지 확인해야 한다. 내부 인증서나 자체 서명(self-signed)인증서를 사용할 경우, 이를 사용하는 서비스는 오직 특정 내부 인증기관(CA)과 자체 서명 인증만을 신뢰하게 설정해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.3.5", + "Ordinal": 5, + "Description": "시스템 내부에서 통신하는 서비스(intra-service communication)는 각 엔드포인트를 검증하기 위해 강력한 인증을 사용해야 한다. 공용키(public-key) 기반 구조와 재전송 공격(replay attacks)에 저항하는 매커니즘을 사용하여 신원보장을 위해 TLS 클라이언트 인증과 같은 강력한 인증 방식을 사용해야 한다. 마이크로서비스 아키텍쳐의 경우 인증서 관리를 간소화 하고 보안을 강화하기 위해 서비스 매시(service mesh)를 사용하는 것을 고려해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V13", + "Ordinal": 13, + "ShortName": "Configuration", + "Name": "설정", + "Items": [ + { + "Shortcode": "V13.1", + "Ordinal": 1, + "Name": "설정 문서", + "Items": [ + { + "Shortcode": "V13.1.1", + "Ordinal": 1, + "Description": "애플리케이션의 모든 통신 요구사항이 문서화 되어 있는지를 검증한다. 이는 애플리케이션이 의존하는 외부 서비스나, 사용자가 애플리케이션이 연결할 외부 위치를 제공하는 경우들을 포함한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.1.2", + "Ordinal": 2, + "Description": "애플리케이션이 사용하는 각각의 서비스들에 대해, 문서가 최대 동시 연결 수(연결 풀 제한)를 정의하고 있는지, 그리고 그 한계에 다다랐을 때 폴백(fallback)이나 복구 메커니즘 등을 포함하여, DoS 공격을 방지하기 위해 애플리케이션이 어떻게 동작하는지를 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.1.3", + "Ordinal": 3, + "Description": "애플리케이션 문서가 모든 외부 시스템이나 애플리케이션이 사용하는 서비스(예시: 데이터베이스, 파일 핸들, 스레드, HTTP 연결)들에 대한 자원-관리 전략을 정의하고 있는지 검증한다.이는 자원-해제 프로시저, 시간초과 설정, 오류 핸들링을 포함하며, 재시도 로직이 구현된 경우 재시도 제한과 지연, 백-오프 알고리즘을 명시해야 한다. 동기 HTTP 요청-응답 명령에 대해서는 짧은 타임아웃에 더해 재시도의 비활성화 혹은 연쇄적인 지연과 자원 고갈을 방지하기 위한 재시도의 엄격한 제한을 의무화해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.1.4", + "Ordinal": 4, + "Description": "애플리케이션 문서가 조직의 위협 모델과 사업적 요구사항에 기반하여, 애플리케이션의 보안과 비밀 정보들의 주기적 갱신 일정에 치명적인 비밀 정보들을 정의하고 있는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V13.2", + "Ordinal": 2, + "Name": "백엔드 통신 설정", + "Items": [ + { + "Shortcode": "V13.2.1", + "Ordinal": 1, + "Description": "API나 미들웨어와 같은 애플리케이션의 표준 사용자 세션 메커니즘을 지원하지 않는 백엔드 애플리케이션 컴포넌트와 데이터 계층 사이의 통신이 인증되어 있는지를 검증한다. 인증은 반드시 개별적인 서비스 계정과 단기간 토큰, 또는 인증서 기반 인증을 사용하고 비밀번호, API 키, 또는 접근 권한이 부여된 공유 계정 등의 자격 증명을 변경하지 않아선 안 된다. ", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.2", + "Ordinal": 2, + "Description": "로컬 또는 운영체제 서비스, API, 미들웨어, 그리고 데이터 계층을 포함한 백엔드 애플리케이션 컴포넌트 간의 통신이 최소 필요 권한이 할당된 계정들로 수행되는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.3", + "Ordinal": 3, + "Description": "만약 자격 증명이 서비스 인증을 위해 필요하다면, 소비자로부터 사용되는 그 자격 증명이 기본 자격 증명이 아님을 검증한다. (예시: root/root 또는 admin/admin)", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.4", + "Ordinal": 4, + "Description": "얼로우리스트가 애플리케이션의 통신이 허가된 외부 리소스나 시스템을 정의하기 위해 사용되는지 검증한다. (예시: 아웃바운드 요청, 데이터 로드, 파일 접근). 이 얼로우리스트는 애플리케이션 계층, 웹 서버, 방화벽 또는 다른 여러 계층의 조합으로 구현할 수 있다. ", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.5", + "Ordinal": 5, + "Description": "웹이나 애플리케이션 서버에 요청을 보내거나 데이터나 파일을 로드 할 수 있는 리소스 또는 시스템의 얼로우리스트가 설정되어 있는지를 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.6", + "Ordinal": 6, + "Description": "애플리케이션이 별도의 서비스와 연결할 때, 각 연결이 최대 병렬연결, 최대 연결 도달 시의 동작, 연결 타임아웃, 재시도 전략 등 문서화된 설정에 따르는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V13.3", + "Ordinal": 3, + "Name": "비밀 정보 관리", + "Items": [ + { + "Shortcode": "V13.3.1", + "Ordinal": 1, + "Description": "키 볼트와 같은 비밀 정보 관리 솔루션이 백엔드 비밀 정보들을 만들고 저장하고, 접근을 제어하고, 파기하기 위해 사용되고 있는지 검증한다. 이는 비밀번호, 키 재료, 데이터베이스와 서드 파티 시스템의 통합, 시간-기반 토큰을 위한 키와 시드, 그리고 API 키들을 포함할 수 있다. 비밀 정보들은 애플리케이션 소스 코드 내부나, 빌드 아티팩트에 포함되어서는 안 된다. L3 애플리케이션에 대해서는, 반드시 HSM과 같은 하드웨어 기반 솔루션을 사용해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.3.2", + "Ordinal": 2, + "Description": "비밀 정보 자원들에 대한 접근이 최소 권한의 원칙을 고수하는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.3.3", + "Ordinal": 3, + "Description": "보안 모듈에 대한 외부의 노출로부터 안전하게 키 재료를 관리하고 보호하기 위해 모든 암호 연산이 고립된 보안 모듈(볼트나, 하드웨어 보안 모듈 등)을 사용하여 수행되는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.3.4", + "Ordinal": 4, + "Description": "애플리케이션의 문서를 기반으로 비밀 정보들이 만료되고 갱신되도록 설정되었는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V13.4", + "Ordinal": 4, + "Name": "의도하지 않은 정보 노출", + "Items": [ + { + "Shortcode": "V13.4.1", + "Ordinal": 1, + "Description": "애플리케이션이 .git 이나 .svn 폴더 같은 소스 코드 관리 메타데이터 없이 배포되었는지, 또는 이 폴더들이 외부적으로든 애플리케이션 자체에서든 접근할 수 없도록 배포되었는지 검증한다. ", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.2", + "Ordinal": 2, + "Description": "실제 운영환경에서 디버깅 기능 노출이나 정보 누출을 방지하기 위해, 모든 컴포넌트에서 디버그 모드가 비활성화되어 있는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.3", + "Ordinal": 3, + "Description": "분명히 의도된 것이 아닌 이상 웹 서버가 폴더 목록을 클라이언트에게 노출하지 않는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.4", + "Ordinal": 4, + "Description": "잠재적인 정보 누출을 방지하기 위해 실제 운영환경에서 HTTP TRACE 메소드 사용이 지원되지 않는지 검증한다. ", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.5", + "Ordinal": 5, + "Description": "분명히 의도된 것이 아닌 이상 문서(내부 API 같은)와 모니터링 엔드포인트가 노출되지 않는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.6", + "Ordinal": 6, + "Description": "애플리케이션이 백엔드 컴포넌트의 자세한 버전 정보를 노출하지 않는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.7", + "Ordinal": 7, + "Description": "웹 계층이 의도적이지 않은 정보, 설정, 소스코드 누출을 방지하기 위해 특정 파일 확장자만 서비스하도록 설정되었는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V14", + "Ordinal": 14, + "ShortName": "Data", + "Name": "데이터 보호", + "Items": [ + { + "Shortcode": "V14.1", + "Ordinal": 1, + "Name": "데이터 보호 문서화", + "Items": [ + { + "Shortcode": "V14.1.1", + "Ordinal": 1, + "Description": "애플리케이션이 생성하고 처리하는 모든 민감한 데이터가 식별되고 보호 수준으로 분류되었는지 확인한다. 여기에는 단순히 인코딩되어 있고 쉽게 디코딩할 수 있는 데이터, 예를 들어 Base64 문자열이나 JWT 내부 평문 페이로드가 포함된다. 보호 수준은 애플리케이션이 준수해야 하는 모든 데이터 보호 및 개인정보 보호 관련 규정과 표준을 반드시 고려해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.1.2", + "Ordinal": 2, + "Description": "모든 민감한 데이터의 보호 수준에 대해 문서화된 요구사항이 있는지 확인한다. 반드시 여기에는(이에 한정되지 않지만) 일반적인 암호화, 무결성 검증, 보존 기간, 데이터 로그 기록 방식, 로그 내 민감한 데이터에 대한 접근 제어, 데이터베이스 암호화 수준, 사용할 개인정보 보호 및 개인정보 보호 강화 기술, 그리고 기타 기밀성 요구사항들 관련하여 포함되어야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V14.2", + "Ordinal": 2, + "Name": "일반 데이터 보호", + "Items": [ + { + "Shortcode": "V14.2.1", + "Ordinal": 1, + "Description": "민감한 데이터는 HTTP 메시지 본문이나 헤더 필드로만 서버에 전송되고, URL과 쿼리 문자열에는 API키나 세션토큰처럼 민감한 정보가 포함되지 않도록 검증한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.2", + "Ordinal": 2, + "Description": "서버 구성 요소에서 로드밸런서나 애플리케이션 캐시와 같은 민감한 데이터가 캐시되지 않게 하거나, 사용 후 해당 데이터를 안전하게 삭제하도록 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.3", + "Ordinal": 3, + "Description": "정의된 민감한 데이터가 애플리케이션의 통제를 벗어난 곳에서 원치 않는 수집을 예방하기 위해 신뢰할 수 없는 대상(예: 사용자 추적기)에게 전송되지 않도록 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.4", + "Ordinal": 4, + "Description": "암호화, 무결성 검증, 보존, 데이터 로그 기록 방식, 로그 내 민감한 데이터 접근 제어, 개인정보 보호 및 개인정보 보호 강화 기술과 관련된 민감한 데이터 통제가, 해당 데이터 보호 수준에 대한 문서에 정의된 대로 구현되었는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.5", + "Ordinal": 5, + "Description": "캐시 메커니즘이 해당 리소스에 대해 예상되는 콘텐츠 유형을 가진 응답만 캐시하고, 민감하거나 동적인 콘텐츠는 캐시하지 않도록 구성되어 있는지 검증한다. 존재하지 않는 파일에 접근했을 때 다른 유효한 파일을 반환하는 대신 웹 서버는 404 또는 302 응답을 반환해야 한다. 이는 Web Cache Deception 공격을 예방한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.6", + "Ordinal": 6, + "Description": "애플리케이션 기능에 필요한 최소한의 민감한 데이터만 반환을 검증한다. 예를 들어, 전체 신용카드 번호가 아닌 일부 숫자만 반환해야 한다. 만약 전체 데이터가 필요한 경우, 사용자가 구체적으로 조회하지 않는 한 사용자 인터페이스에서는 마스킹하는 것이 권장된다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.7", + "Ordinal": 7, + "Description": "민감한 정보는 데이터 보존 분류 기준에 따라 관리되어야 하고, 오래되었거나 불필요한 데이터는 사전에 정의된 작업 또는 상황에 따라 자동으로 삭제되도록 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.8", + "Ordinal": 8, + "Description": "사용자가 제출한 파일의 메타데이터에서 사용자가 저장에 동의하지 않는 한 민감한 정보는 제거를 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V14.3", + "Ordinal": 3, + "Name": "클라이언트 측 데이터 보호", + "Items": [ + { + "Shortcode": "V14.3.1", + "Ordinal": 1, + "Description": "클라이언트나 세션이 종료된 후에 브라우저 DOM과 같은 클라이언트 스토리지에서 인증된 데이터를 삭제되는지 검증한다. 이를 위해 ‘Clear-Site-Data’ HTTP 응답 헤더 필드를 사용할 수 있으나, 세션 종료 시 서버 연결이 불가능한 경우에도 클라이언트 측에서 해당 데이터를 삭제하는 것이 권장된다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.3.2", + "Ordinal": 2, + "Description": "애플리케이션이 브라우저에서 민감한 데이터가 캐시되지 않도록, (Cache-Control: no-store)충분한 캐시 방지 HTTP 응답 헤더 필드를 설정을 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.3.3", + "Ordinal": 3, + "Description": "브라우저 저장소(localStorage, sessionStorage, IndexedDB, 쿠키)에 저장되는 데이터에는 세션 토큰을 제외한 민감 데이터가 포함되지 않도록 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V15", + "Ordinal": 15, + "ShortName": "Secure", + "Name": "보안 코딩 및 아키텍처", + "Items": [ + { + "Shortcode": "V15.1", + "Ordinal": 1, + "Name": "보안 코딩 및 아키텍처 문서화", + "Items": [ + { + "Shortcode": "V15.1.1", + "Ordinal": 1, + "Description": "애플리케이션 문서에 취약점이 존재하는 서드파티 구성요소 버전 및 일반적인 라이브러리 업데이트에 대해, 해당 구성요소로부터 발생할 수 있는 위험을 최소화하기 위한 위험 기반 대응 기한이 정의되어 있는지 확인해야 한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.1.2", + "Ordinal": 2, + "Description": "사용 중인 모든 서드파티 라이브러리에 대해 소프트웨어 자재 명세서(SBOM)와 같은 인벤토리가 유지되고 있으며, 해당 구성요소가 사전에 정의된 신뢰할 수 있고 지속적으로 관리되는 저장소에서 제공되는지 확인해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.1.3", + "Ordinal": 3, + "Description": "애플리케이션 문서에 시간 소모가 크거나 리소스 소비가 많은 기능이 식별되어 있으며, 해당 기능의 과도한 사용으로 인해 가용성이 손실되지 않도록 하는 방법과, 응답 생성이 소비자의 타임아웃보다 오래 걸리는 상황을 방지하는 방법이 포함되어 있는지 확인해야 한다. 가능한 방어 전략에는 비동기 처리, 큐(queue) 사용, 사용자 및 애플리케이션 단위의 병렬 처리 제한 등이 있다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.1.4", + "Ordinal": 4, + "Description": "애플리케이션 문서에 위험한 구성요소로 간주되는 서드파티 라이브러리가 강조되어 있는지 확인해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.1.5", + "Ordinal": 5, + "Description": "애플리케이션 문서에 위험한 기능을 사용하는 애플리케이션의 부분이 강조되어 있는지 확인해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V15.2", + "Ordinal": 2, + "Name": "보안 아키텍처 및 종속성", + "Items": [ + { + "Shortcode": "V15.2.1", + "Ordinal": 1, + "Description": "애플리케이션이 문서화된 업데이트 및 대응 기한을 위반하지 않은 구성요소만 포함하고 있는지 확인해야 한다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.2.2", + "Ordinal": 2, + "Description": "애플리케이션이 시간 소모가 크거나 리소스 소비가 많은 기능의 과도한 사용으로 인한 가용성 손실을 방지하기 위해, 해당 기능에 대한 문서화된 보안 결정 및 전략을 기반으로 방어 조치를 구현하고 있는지 확인해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.2.3", + "Ordinal": 3, + "Description": "운영 환경에 애플리케이션 기능 수행에 필요한 기능만 포함되어 있으며, 테스트 코드, 샘플 코드, 개발용 기능 등 불필요한 기능이 노출되지 않도록 구성되어 있는지 확인해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.2.4", + "Ordinal": 4, + "Description": "서드파티 구성요소 및 그 모든 전이 종속성(transitive dependencies)이 내부 또는 외부의 예상된 저장소에서 가져며, 의존성 혼동(dependency confusion) 공격의 위험이 없는지 확인해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.2.5", + "Ordinal": 5, + "Description": "애플리케이션이 위험한 기능을 포함하거나 위험한 구성요소를 사용하는 부분에 대해 샌드박싱, 캡슐화, 컨테이너화, 네트워크 수준 격리와 같은 추가적인 보호 기법을 구현하여, 애플리케이션의 한 부분이 침해되더라도 공격자가 다른 영역으로 확산하지 못하도록 지연 및 차단하고 있는지 확인해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V15.3", + "Ordinal": 3, + "Name": "방어적(Defensive) 코딩", + "Items": [ + { + "Shortcode": "V15.3.1", + "Ordinal": 1, + "Description": "애플리케이션이 데이터 객체에서 필요한 필드만 선택적으로 반환하고 있는지 확인해야 한다. 예를 들어, 일부 필드는 사용자에게 노출되어서는 안 되므로 전체 데이터 객체를 반환해서는 안 된다.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.2", + "Ordinal": 2, + "Description": "애플리케이션 백엔드에서 외부 URL로 요청을 보낼 때, 의도된 기능이 아닌 경우 리디렉션을 따르지 않도록 구성되어 있는지 확인해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.3", + "Ordinal": 3, + "Description": "애플리케이션이 각 컨트롤러 및 액션 단위로 허용된 필드를 제한함으로써, 대량 할당(mass assignment) 공격에 대한 방어가 구현되어 있는지 확인해야 한다. 예를 들어, 특정 동작에 포함되지 않은 필드 값을 삽입하거나 수정할 수 없어야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.4", + "Ordinal": 4, + "Description": "모든 프록시 및 미들웨어 구성요소가 사용자의 원래 IP 주소를 신뢰 가능한 데이터 필드를 통해 정확하게 전달하고 있으며, 애플리케이션과 웹 서버가 이 값을 로그 기록이나 속도 제한(rate limiting)과 같은 보안 결정에 사용하는지 확인해야 한다. 단, 동적 IP, VPN, 방화벽 등으로 인해 원래 IP조차 완전히 신뢰할 수 없는 점도 고려해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.5", + "Ordinal": 5, + "Description": "애플리케이션이 변수의 타입이 올바른지 명시적으로 확인하고, 엄격한 동등성 비교 및 연산자를 사용하여 타입 혼용(type juggling) 또는 타입 혼동(type confusion)으로 인한 취약점을 방지하고 있는지 확인해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.6", + "Ordinal": 6, + "Description": "JavaScript 코드가 프로토타입 오염(prototype pollution)을 방지할 수 있도록 작성되어 있는지 확인해야 한다. 예를 들어, 객체 리터럴 대신 `Set()` 또는 `Map()`을 사용하는 방식이 권장된다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.7", + "Ordinal": 7, + "Description": "애플리케이션이 HTTP 파라미터 오염(HTTP parameter pollution) 공격에 대한 방어를 구현하고 있는지 확인해야 한다. 특히, 애플리케이션 프레임워크가 요청 파라미터의 출처(쿼리 스트링, 본문, 쿠키, 헤더)를 구분하지 않는 경우 이를 고려해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V15.4", + "Ordinal": 4, + "Name": "안전한 동시성", + "Items": [ + { + "Shortcode": "V15.4.1", + "Ordinal": 1, + "Description": "다중 스레드 코드에서 캐시, 파일, 다수 스레드가 접근하는 메모리 내 객체 등 공유 객체에 접근할 때, 스레드 세이프(thread-safe) 타입과 락·세마포어 같은 동기화 메커니즘을 사용하여 경쟁 상태와 데이터 손상을 피하고 안전하게 접근하는지 확인해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.4.2", + "Ordinal": 2, + "Description": "리소스의 존재 여부나 권한과 같은 상태 검사와, 그 검사 결과에 의존하는 동작이 단일(atomic) 연산으로 수행되어 TOCTOU 경쟁 상태를 방지하는지 확인해야 한다. (예: 파일을 열기 전에 존재 여부를 확인하는 작업과 파일 열기 동작을 분리하지 않기, 접근 권한 검증과 권한 부여를 동일 트랜잭션/원자적 구간에서 수행하기)", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.4.3", + "Ordinal": 3, + "Description": "스레드가 서로를 기다리거나 무한 재시도에 빠지지 않도록 일관된 락 사용을 보장하고, 락 관리 로직을 리소스 관리 책임 코드 내부에 유지하여 외부 클래스 및 코드가 우발적·악의적으로 락을 변경하지 못하도록 하는지 확인해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.4.4", + "Ordinal": 4, + "Description": "**스레드 풀** 활용 등 **리소스 할당 정책**을 통해 공정한 리소스 접근을 보장하고, 우선순위가 낮은 스레드도 합리적 시간 내 진행될 수 있게 하여 **스레드 기아**를 방지하는지 확인해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V16", + "Ordinal": 16, + "ShortName": "Security", + "Name": "보안 로깅과 오류 처리", + "Items": [ + { + "Shortcode": "V16.1", + "Ordinal": 1, + "Name": "보안 로깅 문서화", + "Items": [ + { + "Shortcode": "V16.1.1", + "Ordinal": 1, + "Description": "애플리케이션의 기술 스택의 각 계층에서 수행된 로깅에 대해, 어떤 이벤트들이 로그로 남았는지, 로그의 형식이 무엇인지, 로그가 어디에 저장되었는지, 어떻게 사용되는지, 로그에 대한 접근이 어떻게 제어되는지, 그리고 로그가 얼마나 보관되는지에 대해 문서화한 목록이 존재하는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V16.2", + "Ordinal": 2, + "Name": "일반 로깅", + "Items": [ + { + "Shortcode": "V16.2.1", + "Ordinal": 1, + "Description": "이벤트가 발생했을 때 그 타임라인을 자세히 조사할 수 있도록 각 로그의 항목이 필수적인 메타데이터(언제, 어디서, 누가, 무엇을 등)을 포함하는지 검증한다. ", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.2.2", + "Ordinal": 2, + "Description": "모든 로깅 컴포넌트의 시간 소스가 동기화되어 있는지, 그리고 보안 이벤트 메타데이터에서 타임스탬프가 UTC를 사용하거나 혹은 명시적인 시간대 오프셋을 포함하는지 검증한다. UTC는 분산 시스템 전체에 걸친 일관성을 보장하고, 일광 절약 시간제 전환 시의 혼란을 방지하기 위해 추천된다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.2.3", + "Ordinal": 3, + "Description": "애플리케이션이 로그를 저장만 하는지, 혹은 로그 목록에서 문서화 된 파일이나 서비스로 브로드캐스트하는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.2.4", + "Ordinal": 4, + "Description": "사용 중인 로그 처리기가 로그를 읽고, 또 상호 연관 지을 수 있는지 검증한다. 가능하다면 공통 로깅 형식을 사용하는 것이 좋다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.2.5", + "Ordinal": 5, + "Description": "민감한 데이터를 로깅할때, 애플리케이션이 데이터의 보호 수준을 기반으로 로깅을 수행하는지 검증한다. 예를 들어, 자격 증명이나, 지불 상세 정보 등의 특정 데이터는 로깅 해서는 안 된다. 또한 세션 토큰 등의 데이터는 전체 혹은 일부분이 해싱된, 마스킹 된 상태로 로깅 되어야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V16.3", + "Ordinal": 3, + "Name": "보안 이벤트", + "Items": [ + { + "Shortcode": "V16.3.1", + "Ordinal": 1, + "Description": "성공한 시도와 실패한 시도를 포함하여 모든 인증 명령을 로깅 하는지 검증한다. 인증의 종류나, 사용한 인증 요소 등의 추가적인 메타데이터 또한 수집해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.3.2", + "Ordinal": 2, + "Description": "실패한 인가 시도들도 로깅 하는지 검증한다. L3에 대해서는 반드시 민감한 데이터가 접근되었을 때를 포함하여(민감한 데이터 자체는 제외하고) 모든 인가 결정들의 로그를 포함해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.3.3", + "Ordinal": 3, + "Description": "애플리케이션이 이 문서에서 정의한 보안 이벤트들을 로깅하고, 또한 입력값 확인, 비즈니스 로직, 그리고 자동화 방지 등의 보안 제어를 우회하려는 시도들도 로깅 하는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.3.4", + "Ordinal": 4, + "Description": "애플리케이션이 백엔드 TLS 오류와 같은 예상치 못한 오류나 보안 제어 오류들을 로깅 하는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V16.4", + "Ordinal": 4, + "Name": "로그 보호", + "Items": [ + { + "Shortcode": "V16.4.1", + "Ordinal": 1, + "Description": "로그 삽입을 방지하기 위해 모든 로깅 컴포넌트가 적절히 데이터를 인코딩하는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.4.2", + "Ordinal": 2, + "Description": "로그가 비인가된 접근으로부터 보호되고 수정할 수 없는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.4.3", + "Ordinal": 3, + "Description": "분석, 탐지, 경보, 그리고 에스컬레이션(escalation)을 위해 로그가 논리적으로 분리된 시스템으로 안전하게 전송되는지 검증한다. 애플리케이션이 침해되더라도 로그는 훼손하지 못하도록 보장하는 것이 목적이다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V16.5", + "Ordinal": 5, + "Name": "오류 처리", + "Items": [ + { + "Shortcode": "V16.5.1", + "Ordinal": 1, + "Description": "예상치 못한 혹은 보안 측면에서 민감한 오류가 발생했을 때 스택 흔적, 쿼리, 비밀키, 그리고 토큰 등의 민감한 내부 시스템 데이터의 노출 방지를 보장하기 위해 유저에게 구체화하지 않은 메시지를 반환하는지 검증한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.5.2", + "Ordinal": 2, + "Description": "외부 리소스 접근 오류가 발생하더라도 애플리케이션이 계속해서 안전하게 작동하는지 검증한다. 예를 들어 서킷 브레이커(circuit breaker)나 우아한 성능 저하와 같은 패턴을 사용할 수 있다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.5.3", + "Ordinal": 3, + "Description": "예외가 발생할 때, 검증 로직의 오류에도 불구하고 거래를 처리하는 등의 페일-오픈(fail-open) 상태 방지를 포함하여 애플리케이션이 우아하고 안전하게 실패하는지 검증한다. ", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.5.4", + "Ordinal": 4, + "Description": "처리되지 못한 모든 예외를 처리할 “최후의 수단” 오류 핸들러가 정의되어 있는지 검증한다. 이는 로그 파일에 기록되어야 하는 오류 상세 정보들의 손실을 피하기 위함과 동시에, 오류로 인해 전체 애플리케이션 프로세스가 종료되어 가용성 손실로 이어지지 않도록 보장하기 위함이다. ", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V17", + "Ordinal": 17, + "ShortName": "WebRTC", + "Name": "WebRTC", + "Items": [ + { + "Shortcode": "V17.1", + "Ordinal": 1, + "Name": "TURN 서버", + "Items": [ + { + "Shortcode": "V17.1.1", + "Ordinal": 1, + "Description": "Traversal Using Relays around NAT(TURN) 서비스가 특정 목적을 위해 보존된 주소(예: 내부 네트워크, 브로드캐스트, 루프백)를 제외한 주소에 대해서만 접근을 허용하도록 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.1.2", + "Ordinal": 2, + "Description": "Traversal Using Relays around NAT(TURN) 서비스가 정당한 사용자의 TURN 서버 포트의 대량 개방 시 자원고갈에 취약하지 않도록 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V17.2", + "Ordinal": 2, + "Name": "미디어", + "Items": [ + { + "Shortcode": "V17.2.1", + "Ordinal": 1, + "Description": "데이터그램 전송 계층 보안(DTLS) 인증서의 키가 암호화 키 관리에 대한 문서화된 정책에 따라 관리되고 보호되는지 확인해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.2", + "Ordinal": 2, + "Description": "미디어 서버가 승인된 데이터그램 전송 계층 보안(DTLS) 암호 모음을 사용하고 지원하도록 구성되었는지, 그리고 보안 실시간 전송 프로토콜(DTLS-SRTP)을 위한 키 생성에 사용되는 DTLS 확장을 위한 안전한 보호 프로파일을 구성했는지 확인해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.3", + "Ordinal": 3, + "Description": "미디어 서버에서 보안 실시간 전송 프로토콜(SRTP) 인증이 선택되어 있는지 확인한다. 이를 통해 실시간 전송 프로토콜(RTP) 삽입 공격으로 인한 서비스 거부 상태 발생 또는 오디오/비디오 미디어가 미디어 스트림에 삽입되는 것을 방지할 수 있다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.4", + "Ordinal": 4, + "Description": "미디어 서버가 잘못된 형식의 보안 실시간 전송 프로토콜(SRTP) 패킷을 접했을 때도 수신 미디어 트래픽 처리를 계속할 수 있는지 확인해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.5", + "Ordinal": 5, + "Description": "미디어 서버가 정상 사용자로부터의 보안 실시간 전송 프로토콜(SRTP) 패킷이 대량으로 유입되는 상황에서도 수신 미디어 트래픽 처리를 계속할 수 있는지 확인해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.6", + "Ordinal": 6, + "Description": "미디어 서버가 Datagram Transport Layer Security(DTLS)의 “ClientHello” 경합 조건 취약점에 노출되지 않았는지 확인해야 한다. 이를 위해 해당 미디어 서버가 공개적으로 취약한 것으로 알려져 있는지 확인하거나 경합 조건 테스트를 수행해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.7", + "Ordinal": 7, + "Description": "미디어 서버와 연결된 모든 오디오 또는 비디오 녹화 장치가 합법적인 사용자로부터의 보안 실시간 전송 프로토콜(SRTP) 패킷이 대량으로 유입되는 상황에서도 수신 미디어 트래픽 처리를 계속할 수 있는지 확인해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.8", + "Ordinal": 8, + "Description": "데이터그램 전송 계층 보안(DTLS) 인증서가 세션 설명 프로토콜(SDP) 지문 속성과 대조되어 검증되었는지 확인하고, 검증이 실패할 경우 미디어 스트림을 종료하여 미디어 스트림의 진위성을 보장해야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V17.3", + "Ordinal": 3, + "Name": "신호 처리", + "Items": [ + { + "Shortcode": "V17.3.1", + "Ordinal": 1, + "Description": "신호 서버가 플러드 공격 중에도 합법적인 수신 신호 메시지 처리를 계속할 수 있는지 확인해야 한다. 이는 신호 수준에서 속도 제한을 구현함으로써 달성되어야 한다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.3.2", + "Ordinal": 2, + "Description": "서비스 거부 상태를 유발할 수 있는 잘못된 형식의 신호 메시지를 접했을 때 신호 서버가 정상적인 신호 메시지 처리를 계속할 수 있는지 확인해야 한다. 여기에는 입력 검증 구현, 정수 오버플로우 안전 처리, 버퍼 오버플로우 방지 및 기타 강력한 오류 처리 기법 적용이 포함될 수 있다.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + } + ] +} diff --git a/5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.legacy.xml b/5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.legacy.xml new file mode 100644 index 0000000000..4d6ed002bd --- /dev/null +++ b/5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.legacy.xml @@ -0,0 +1 @@ +Application Security Verification Standard ProjectASVS5.0.0The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.V11Encoding인코딩과 데이터 정제V1.11인코딩 및 데이터 정제 아키텍처V1.1.11입력값 검증은 오직 한 번만 표준 형태로 디코딩 되거나 언이스케이프 되어야 하며, 인코딩된 데이터가 예상될 때만 디코딩 되어야 한다. 이 과정은 입력이 추가로 처리되기 전에 완료되어야 한다. 예를 들어서 입력값 검증이나 데이터 정제 이후에는 수행되면 안 된다.FalseTrue✓True✓V1.1.22애플리케이션이 출력값 인코딩 또는 이스케이핑을 인터프리터가 사용하기 전의 최종 단계로 수행하거나 인터프리터 자체에서 처리하는지 검증해야 한다.FalseTrue✓True✓V1.22인젝션(Injection) 방지V1.2.11HTTP 응답, HTML 문서 또는 XML 문서에 대한 출력값 인코딩이 해당 컨텍스트에 적절한지 검증해야 한다. 예를 들어, 메시지나 문서 구조가 변경되지 않도록 HTML 요소, HTML 속성, HTML 주석, CSS, HTTP 헤더 필드 등에 맞는 문맥별 문자 인코딩이 수행되어야 한다.True✓True✓True✓V1.2.22통합 자원 식별자(Uniform Resource Locator; URL)들을 동적으로 생성할 때 신뢰할 수 없는 데이터가 해당 컨텍스트에 맞게 인코딩되었는지 검증해야 한다(예: 쿼리나 경로 파라미터에 대한 URL 인코딩 또는 base64url 인코딩). 또한, 오직 안전한 URL 프로토콜만이 허용되는지 검증해야 한다(예: javascript: 또는 data:를 허용하지 않음).True✓True✓True✓V1.2.33동적으로 자바스크립트 콘텐츠(JSON 포함)를 생성할 때 메시지나 문서 구조를 바꾸는 것을 방지하기 위해 출력값 인코딩이나 이스케이핑이 사용되고 있는지 검증해야 한다(자바스크립트 또는 JSON 인젝션을 피하기 위함).True✓True✓True✓V1.2.44데이터 선택 혹은 데이터베이스 쿼리(예: SQL, HQL, NoSQL, Cypher)들 파라미터화된 쿼리, 객체 관계 매핑(Object Relational Mapping; ORM), 엔티티 프레임워크, 또는 다른 구조화된 쿼리 언어(Structured Query Language; SQL) 인젝션 및 기타 데이터베이스 인젝션 공격으로부터 보호해 주는 것들을 사용하는지 검증해야 한다. 이는 저장 프로시저를 쓸 때도 마찬가지이다.True✓True✓True✓V1.2.55애플리케이션이 운영체제(Operating System; OS) 명령 인젝션으로부터 보호되며 운영체제 호출 시 파라미터화된 OS 쿼리나 상황에 맞는 명령줄 출력값 인코딩을 사용하는지 검증해야 한다.True✓True✓True✓V1.2.66애플리케이션이 경량 디렉터리 접근 프로토콜(Lightweight Directory Access Protocol; LDAP) 인젝션 취약점에 대해 보호되어 있는지, 또는 LDAP 인젝션을 방지하기 위한 특정 보안 통제가 구현되어 있는지 검증해야 한다.FalseTrue✓True✓V1.2.77애플리케이션이 XPath 인젝션 공격을 쿼리 파라미터나 미리 컴파일된 쿼리들을 사용해 보호되고 있는지 검증해야 한다.FalseTrue✓True✓V1.2.88LaTeX 프로세서가 안전하게 구성되어 있으며("--shell-escape" 플래그 비사용 등) LaTeX 인젝션 공격을 방지하기 위해 허용된 명령어 목록이 사용되고 있는지 검증해야 한다.FalseTrue✓True✓V1.2.99애플리케이션이 정규 표현식에서 특수 문자들을 메타 문자로 잘못 해석하는 것을 방지하기 위해 해당 문자들 이스케이프(보통 백슬래시를 사용)하고 있는지 검증해야 한다.FalseTrue✓True✓V1.2.1010애플리케이션이 쉼표 구분 데이터(Comma Separated Values; CSV) 및 수식 인젝션에 대해 보호되어 있는지 검증해야 한다. 그리고 애플리케이션은 CSV 콘텐츠를 내보낼 때 RFC 4180 2.6과 2.7 부분에 명시된 이스케이핑 규칙을 반드시 따라야 한다. 또한 CSV나 다른 스프레드시트 포맷(XLS, XLSX, ODF 등)으로 내보낼 때 필드 값의 첫 번째가 특수 문자('=', '+', '-', '@', '\t' (탭), '\0' (null 문자) 포함)라면 반드시 작은따옴표로 이스케이프되어야 한다.FalseFalseTrue✓V1.33데이터 정제V1.3.11위지윅(WYSIWYG) 에디터나 이와 유사한 것으로부터 오는 모든 신뢰할 수 없는 HTML 입력들은 잘 알려지고 안전한 HTML 데이터 정제 라이브러리나 프레임워크 기능을 사용해 정제되는지 검증해야 한다.True✓True✓True✓V1.3.22애플리케이션이 eval() 또는 스프링 표현 언어(Spring Expression Language; SpEL) 등과 같은 동적 코드 실행 기능 사용을 피하고 있는지 검증해야 한다. 대안이 없는 경우, 실행 전에 포함되는 모든 사용자 입력이 반드시 정제되어야 한다.True✓True✓True✓V1.3.33잠재적으로 위험한 컨텍스트에 전달되는 데이터가 사전에 정제되어 안전 조치가 적용되는지 검증해야 한다. 예를 들어 해당 컨텍스트에서 안전한 문자만 허용하고 너무 긴 입력값은 잘라내는 등의 조치가 포함된다.FalseTrue✓True✓V1.3.44사용자로부터 제공된 확장 가능한 벡터 그래픽(Scalable Vector Graphics; SVG)의 스크립트 실행 가능 콘텐츠가 애플리케이션에 안전한 태그 및 속성(예: 그래픽 그리기)만 포함하도록 검증 또는 정제되는지 검증해야 한다. 예를 들어 스크립트나 foreignObject는 포함되면 안 된다.FalseTrue✓True✓V1.3.55애플리케이션이 사용자로부터 제공된 스크립트 실행 가능하거나 표현식 템플릿 언어(예: 마크다운, CSS, XSL 스타일시트, BBCode ) 콘텐츠를 정제하거나 비활성화하는지 검증해야 한다.FalseTrue✓True✓V1.3.66애플리케이션이 서버측 요청 위조(Server-side Request Forgery; SSRF) 공격으로부터 보호하기 위해 신뢰할 수 없는 데이터를 프로토콜, 도메인, 경로, 포트의 허용 목록과 대조해 검증하고 다른 서비스를 호출하기 전에 잠재적으로 위험한 문자를 정제(sanitization)하는지 검증해야 한다.FalseTrue✓True✓V1.3.77애플리케이션이 템플릿 인젝션 공격으로부터 보호하기 위해 신뢰할 수 없는 입력값을 기반으로 템플릿을 생성하지 않도록 하는지 검증해야 한다. 대안이 없는 경우에는 템플릿 생성 과정에서 동적으로 포함되는 모든 신뢰할 수 없는 입력값은 정제되거나 엄격히 검증되어야 한다.FalseTrue✓True✓V1.3.88애플리케이션이 자바 명명 및 디렉터리 인터페이스(Java Naming and Directory Interface; JNDI) 쿼리에서 신뢰할 수 없는 입력값을 사용하기 전에 적절히 정제하고 JNDI가 JNDI 인젝션 공격을 방지할 수 있도록 안전하게 구성되어 있는지 검증해야 한다.FalseTrue✓True✓V1.3.99인젝션을 방지하기 위해 애플리케이션이 메모리 캐시(memcache)에 콘텐츠를 전달하기 전에 해당 데이터를 정제하는지 검증해야 한다. FalseTrue✓True✓V1.3.1010사용 시 예상치 못하거나 악의적인 방식으로 작동할 수 있는 포맷 스트링(format string)들은 처리되기 전에 정제되는지 검증해야 한다.FalseTrue✓True✓V1.3.1111간이 전자 우편 전송 프로토콜(Simple Mail Transfer Protocol; SMTP)이나 인터넷 메시지 액세스 프로토콜(Internet Message Access Protocol; IMAP) 인젝션으로부터 보호하기 위해 애플리케이션이 사용자 입력을 메일 시스템으로 보내기 전에 정제를 하는지 검증해야 한다.FalseTrue✓True✓V1.3.1212정규 표현식에 지수형 백트래킹을 유발하는 요소가 없는지, 또한 신뢰할 수 없는 입력값을 정제하여 정규식 기반 서비스 거부 공격(Regular Expression Denial of Service; ReDoS) 또는 런어웨이(Runaway) 정규식 공격을 방지하는지 검증해야 한다.FalseFalseTrue✓V1.44메모리, 스트링, 비관리 코드V1.4.11애플리케이션이 스택, 버퍼, 또는 힙 오버플로를 탐지하거나 방지하기 위해 메모리 안전 문자열, 안전한 메모리 복사 및 포인터 산술을 사용하는지 검증해야 한다.FalseTrue✓True✓V1.4.22정수 오버플로를 방지하기 위해 부호 확인, 범위 검사, 입력값 검증 등의 기법이 사용되고 있는지 검증해야 한다.FalseTrue✓True✓V1.4.33댕글링 포인터(dangling pointer)나 해체 후 사용(Use After Free; UAF) 취약점을 방지하기 위해 동적으로 할당된 메모리와 자원이 적절히 해제되었는지 그리고 해제된 메모리를 참조하는 포인터나 참조가 제거되었거나 null로 설정되었는지를 검증해야 한다.FalseTrue✓True✓V1.55안전한 역직렬화V1.5.11애플리케이션이 확장 가능한 마크업 언어(eXtensible Markup Language; XML) 파서(parser)를 제한적인 설정으로 구성하고 외부 엔티티 해석과 같은 안전하지 않은 기능을 비활성화하여 XML 외부 엔티티(XML eXternal Entity; XXE) 공격을 방지하는지 검증해야 한다.True✓True✓True✓V1.5.22역직렬화 공격을 방지하기 위해 신뢰할 수 없는 데이터의 역직렬화 시 객체 타입 허용 목록 사용 또는 클라이언트 정의 객체 타입 제한과 같은 안전한 입력 처리 방식이 적용되는지 검증해야 한다. 또한 명확히 안전하지 않은 것으로 지정된 역직렬화 메커니즘은 신뢰할 수 없는 입력에 대해 반드시 사용해서는 안 된다.FalseTrue✓True✓V1.5.33애플리케이션에서 동일한 데이터 타입(예: JSON 파서, XML 파서, URL 파서)에 대해 사용되는 서로 다른 파서들이 일관된 방식으로 파싱(parsing)을 수행하고 동일한 문자 인코딩 방식을 사용하는지 검증해야 한다. 이를 통해 JSON 상호운용 취약점이나 원격 파일 포함(Remote File Inclusion; RFI) 및 SSRF 공격에서 악용될 수 있는 서로 다른 URI 또는 파일 파싱 동작 문제를 방지할 수 있다.FalseFalseTrue✓V22Validation유효성 검증 및 비즈니스 로직V2.11유효성 검증 및 비즈니스 로직 문서화V2.1.11애플리케이션 문서에 데이터 항목이 예상되는 구조에 부합하는지 확인하는 입력값 유효성 검증 규칙이 정의되어 있는지 확인한다. 이는 신용카드 번호, 이메일 주소, 전화번호와 같은 일반적인 데이터 형식일 수도 있고, 내부적으로 사용하는 데이터 형식일 수도 있다.True✓True✓True✓V2.1.22애플리케이션 문서에 연관된 데이터 항목들 간의 논리적, 문맥적 일관성을 검증하는 방법이 정의되어 있는지 검증한다. 예를 들어서 세부 주소와 우편번호가 서로 일치하는지 확인하는 경우가 이에 해당한다.FalseTrue✓True✓V2.1.33비즈니스 로직의 제한사항 및 유효성 검증에 대한 요구사항이 사용자별 기준과 애플리케이션 전체에 적용되는 전역적 기준을 모두 포함하여 문서화되어 있는지 검증한다.FalseTrue✓True✓V2.22입력값 검증V2.2.11입력값에 대한 비즈니스 또는 기능적인 기대치를 충족하기 위해서 입력값의 유효성을 검증해야 한다. 이는 허용 값, 패턴 및 범위 목록에 대한 긍정적 검증을 사용하거나, 미리 정의된 규칙에 따라 입력값을 예상 구조 및 논리적 한계와 비교하여 검증해야 한다. L1의 경우, 특정 비즈니스 또는 보안 결정을 내리는 데 초점을 맞출 수 있다. L2 이상의 경우에는 모든 입력값에 적용해야 한다.True✓True✓True✓V2.2.22애플리케이션이 신뢰할 수 있는 서비스 계층에서 입력값 유효성 검사를 시행하도록 설계되었는지 확인해야 한다. 클라이언트 측 유효성 검사는 사용성을 향상시키므로 권장해야 하지만, 보안 제어 수단으로 의존해서는 안된다.True✓True✓True✓V2.2.33사전 정의된 규칙에 따라 관련 데이터 항목의 조합이 합리적인지 애플리케이션에서 확인해야 한다.FalseTrue✓True✓V2.33비즈니스 로직 보안V2.3.11애플리케이션이 예상되는 순차적 단계 순서에 따라 동일한 사용자에 대한 비즈니스 로직 흐름만 처리하고 단계를 건너뛰지 않는지 확인한다.True✓True✓True✓V2.3.22비즈니스 로직 결함이 악용되는 것을 방지하기 위해서 애플리케이션 문서에 따라 비즈니스 로직 제한이 구현되었는지 확인한다.FalseTrue✓True✓V2.3.33비즈니스 로직 수준에서 트랜잭션이 사용되고 있는지 확인하여 비즈니스 로직 작업이 완전히 성공하거나 이전의 올바른 상태로 롤백되는지 확인한다.FalseTrue✓True✓V2.3.44제한된 양의 리소스(ex. 극장 좌석이나 배송 시간대)가 애플리케이션의 로직을 조작하여 이중으로 예약되는 것을 방지하기 위해서 비즈니스 로직 수준 잠금 메커니즘이 사용되는지 확인한다.FalseTrue✓True✓V2.3.55핵심적인 비즈니스 로직 흐름에 무단 또는 우발적인 행위를 방지하기 위해서 다중 사용자 승인이 필요한지 확인해야 한다. 이는 거액 자금 이체, 계약 승인, 기밀 정보 접근, 제조 과정의 안전 무시 등이 포함될 수 있지만, 이에 국한되지는 않는다.FalseFalseTrue✓V2.44자동화 방지V2.4.11데이터 유출, 더미 데이터 생성, 할당량 소진, 속도 제한 위반, 서비스 거부(DoS), 핵심적인 리소스의 과다 사용으로 이어질 수 있는 애플리케이션 기능에 대한 과도한 호출을 방어하기 위해, 자동화 방지 제어 기능이 구현되어 있는지 검증한다.FalseTrue✓True✓V2.4.22비즈니스 로직의 각 단계가 실제 사람이 수행하는 데 필요한 현실적인 시간을 요구하여, 비정상적으로 빠른 속도의 트랜잭션 제출을 방지하는지 검증한다.FalseFalseTrue✓V33Web웹 프론트엔드 보안V3.11웹 프론트엔드 보안 문서V3.1.11애플리케이션 공식 문서에서 애플리케이션이 반드시 지원해야 하는, 예상되는 보안 특징들을 서술하고 있는지 확인한다. (예: HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP), 그리고 다른 관련된 HTTP 보안 메커니즘들). 또한 문서에서 앞선 특징들(유저에게나 경고하거나 접속을 막는 등의)이 유효하지 않을 때 애플리케이션이 어떻게 행동하는지 반드시 정의해야 한다.FalseFalseTrue✓V3.22의도하지 않은 콘텐츠 접근V3.2.11브라우저가 HTTP 응답에 대해 콘텐츠나 기능을 불러올 때, 의도하지 않은 상황이 보안적으로 통제되고 있는지 확인한다(예: API, 유저가 올린 파일, 혹은 다른 리소스에 직접 접근 시). Content-Security-Policy 헤더 필드의 샌드박스 지시어를 사용하거나, Content-Disposition 헤더 필드 내의 attachment disposition 타입을 사용하는 등으로, 불필요한 HTTP 요청 헤더 필드 (Sec-Fetch-* 와 같은)를 제공하지 않을 수 있다.True✓True✓True✓V3.2.22콘텐츠가 HTML로 렌더링되지 않고 텍스트로 표시되도록 하여, HTML이나 JavaScript 등의 의도하지 않은 실행을 방지하는 안전한 렌더링 함수(예: createTextNode, textContent)를 사용하는지 확인한다.True✓True✓True✓V3.2.33애플리케이션이 클라이언트 사이드 JavaScript를 사용할 때, 명시적 변수 사용, 엄격한 타입 검사, 문서에서의 전역 변수 저장 지양, 그리고 네임스페이스 격리 구현 등으로 DOM 클로버링을 막고 있음을 확인한다.FalseFalseTrue✓V3.33쿠키 설정V3.3.11쿠키가 'Secure' 속성을 가지며, 쿠키 이름에 '\__Host-' 접두사가 사용되지 않았고, '__Secure-' 접두사를 사용했는지 확인한다.True✓True✓True✓V3.3.22UI redress 공격, 그리고 CSRF라 알려진 브라우저 기반 요청 위조 공격들에 대한 노출을 제한하기 위해 각 쿠키의 'SameSite' 속성 값이 쿠키의 목적에 맞게 설정되어 있는지 확인한다.FalseTrue✓True✓V3.3.33다른 호스트들과 명시적으로 공유되는 쿠키에 대해서, '__Host-' 접두사를 가지고 있는지 확인한다.FalseTrue✓True✓V3.3.44클라이언트 측 스크립트에서 쿠키의 값에 접근이 가능한 걸 의도하지 않았다면(세션 토큰 등), 쿠키는 반드시 'HttpOnly' 속성을 가져야 하고, 반드시 'Set-Cookie' 헤더 필드를 통해 클라이언트에게 전달돼야 한다.FalseTrue✓True✓V3.3.55애플리케이션이 쿠키를 만들 때, 쿠키 이름과 값의 길이 합이 4096바이트를 넘지 않는지 확인한다. 너무 큰 쿠키는 브라우저에 저장되지 않으며, 요청 전달도 안되고, 해당 쿠키에 의존하는 애플리케이션 기능을 사용하지 못하게 된다.FalseFalseTrue✓V3.44브라우저 보안 메커니즘 헤더V3.4.11이 섹션에서는 애플리케이션의 응답을 처리할 때 브라우저의 보안 기능과, 제한 사항을 활성화하기 위해 HTTP 응답에 설정해야 하는 보안 헤더를 설명한다.True✓True✓True✓V3.4.22교차 출처 리소스 공유(CORS)의 Access-Control-Allow-Origin 헤더 필드가 애플리케이션의 고정 값인지 확인한다. 만약 출처 Origin HTTP 요청 헤더 필드 값을 사용하고 있다면, 신뢰할 수 있는 출처 목록으로 검증한다. 'Access-Control-Allow-Origin: *' 사용이 필요할 때엔, 응답이 민감한 정보를 포함하지 않는지 확인한다.True✓True✓True✓V3.4.33HTTP 응답이 Content-Security-Policy 응답 헤더 필드를 가지고 있는지 확인한다. 이는 브라우저가 신뢰하는 콘텐츠나 리소스만 불러오고 실행하도록 하고, 위험한 JavaScript의 실행을 제한한다. 최소한, object-src 'none' 과 base-uri 'none'이라는 지침, 그리고 허용 목록을 정의하거나 논스, 해쉬의 사용을 포함한다는 전역 정책은 반드시 사용돼야 한다. 3계층 애플리케이션의 경우에는, 논스나 해쉬가 적용된 응답별 정책이 반드시 정의돼야 한다.FalseTrue✓True✓V3.4.44모든 HTTP 응답이 'X-Content-Type-Options: nosniff' 헤더 필드를 포함하는지 확인해야 한다. 이는 브라우저들이 주어진 응답에 대해 콘텐츠 스니핑과 MIME 타입 추측을 하지 않도록, 응답의 Content-Type 헤더 필드 값을 목적지 리소스와 일치하도록 지시한다. 예를 들어서, 응답의 Content-Type이 'text/css'인 스타일만 허용된다고 치자. 이는 기능적으로 브라우저의 Cross-Origin Read Blocking (CORB) 사용 또한 활성화시킨다.FalseTrue✓True✓V3.4.55'Referer' HTTP 요청 헤더 필드를 통해 제 3자 서비스들에 기술적으로 민감한 정보 누출을 막기 위해, 애플리케이션에서 리퍼러 정책을 설정했는지 확인해야 한다. 이는 Referrer-Policy HTTP 응답 헤더 필드나 HTML 속성 항목을 통해 설정할 수 있다. 민감한 데이터는 URL에 있는 경로나 쿼리 데이터, 그리고 내부 비공개 애플리케이션의 경우 hostname도 포함된다.FalseTrue✓True✓V3.4.66웹 애플리케이션이 Content-Security-Policy 헤더 필드의 frame-ancestors를 사용해 모든 HTTP 응답들에 대해 기본적으로 내부 삽입을 할 수 없고, 필요할 때만 특정 리소스에 대해 내부 삽입을 허용하도록 확인한다. X-Frame-Options 헤더 필드가 브라우저에서 지원되더라도, 오래돼서 신뢰할 수 없음을 알아야 한다.FalseTrue✓True✓V3.4.77Content-Security-Policy 헤더 필드에 위반 사항을 보고할 영역이 특정되어 있는지 확인해야 한다.FalseFalseTrue✓V3.4.88문서 렌더링을 시작하는 모든 HTTP 요청(Content-Type text/html과 같은 응답)에 same-origin 지시어나 same-origin-allow-popups이 있는 Cross‑Origin‑Opener‑Policy 헤더 필드를 포함하는지 확인해야 한다. 이는 탭내빙(tabnabbing) 및 프레임 카운팅과 같은 Window 객체에 대한 공유 액세스를 악용하는 공격을 방지할 수 있다.FalseFalseTrue✓V3.55브라우저 출처 구분V3.5.11애플리케이션이 허용되지 않은 교차 출처 요청을 통한 민감한 기능의 사용을 막기 위해 CORS preflight 메커니즘에 의존하지 않는지 확인하고, 이런 요청이 애플리케이션 자체에서 시작된건지 증명해야 한다. 이는 anti-forgery 토큰의 사용과 증명이나 CORS-safelisted 요청 헤더 필드가 아닌 확장 HTTP 헤더 필드를 요구하는 것으로 가능하다. 사이트 간 요청 위조 공격(CSRF)으로 알려진 브라우저 기반의 요청 위조 공격에 대한 방어다.True✓True✓True✓V3.5.22애플리케이션이 민감한 기능의 허용되지 않은 교차 출처 사용을 막기 위해 CORS preflight 메커니즘에 의존하고 있다면, CORS preflight 요청을 작동하지 않는 요청을 호출할 수 있는지 확인해야 한다. 이는 'Origin'과 'Content-Type' 요청 헤더 필드 값을 확인하거나 CORS-safelisted 헤더 필드가 아닌 확장 필드 사용에 대한 확인이 필요하다.True✓True✓True✓V3.5.33민감한 기능이 HTTP 요청으로 POST, PUT, PATCH, DELETE와 같은 적절한 HTTP 방식을 사용하는지, HEAD, OPTIONS, 또는 GET처럼 HTTP 사양이 "안전"으로 정의되지 않는 방식을 사용하는지 확인한다. 또는 Sec-Fetch-* 요청 헤더 필드의 엄격한 검증을 사용하여 요청이 부적절한 교차 출처 호출, 탐색 요청 또는 이미지 소스와 같은 리소스 로드에서 발생하지 않았는지 확인할 수 있다.True✓True✓True✓V3.5.44서로 다른 호스트 이름에 별도의 애플리케이션이 호스팅되어 있는지 확인하여 동일한 출처 정책에서 제공하는 제한 사항을 활용한다. 여기에는 한 출처에서 불러온 문서나 스크립트가 다른 출처의 리소스와 상호 작용할 수 있는 방법과 쿠키에서의 호스트 이름 기반 제한 사항이 포함된다.FalseTrue✓True✓V3.5.55postMessage 인터페이스를 통해 수신한 메시지의 출처를 신뢰할 수 없거나, 구문이 유효하지 않은 경우, 수신한 메시지가 폐기되는지 확인한다.FalseTrue✓True✓V3.5.66Cross-Site Script Inclusion (XSSI) 공격을 피하기 위해, 애플리케이션 아무 곳에서나 JSONP 기능이 활성화되지 않는지 확인한다.FalseFalseTrue✓V3.5.77Cross-Site Script Inclusion (XSSI) 공격을 방지하기 위해 JavaScript 파일과 같은 스크립트 리소스 응답에 승인이 필요한 데이터가 포함되지 않았는지 확인한다.FalseFalseTrue✓V3.5.88인증된 리소스(예: 이미지, 비디오, 스크립트 및 기타 문서)가 의도된 경우에만 사용자를 대신하여 불러와지거나 내장될 수 있는지 확인한다. 이는 Sec-Fetch-* HTTP 요청 헤더 필드를 엄격하게 검증하여 요청이 부적절한 교차 출처 호출에서 발생하지 않았는지 확인하거나 브라우저에 반환된 콘텐츠를 차단하도록 지시하는 제한적인 교차 출처 리소스 정책 HTTP 응답 헤더 필드를 설정하여 달성할 수 있다.FalseFalseTrue✓V3.66외부 리소스 무결성V3.6.11클라이언트 측 자산(예: JavaScript 라이브러리, CSS 또는 웹 폰트)이 정적이고 버전이 지정된 경우에만 외부(예: 콘텐츠 전송 네트워크)로만 호스팅되는지 확인하고, 하위 리소스 무결성(SRI)을 사용하여 자산의 무결성을 검증한다. 이것이 불가능하다면 각 리소스에 대해 이를 정당화하기 위해 문서화된 보안 결정이 필요하다.FalseFalseTrue✓V3.77다른 브라우저 보안 고려사항V3.7.11애플리케이션이 여전히 지원되고 안전하다고 간주되는 클라이언트 측 기술만 사용하는지 확인한다. 이 요구 사항을 충족하지 않는 기술의 예로는 NSAPI 플러그인, Flash, Shockwave, ActiveX, Silverlight, NACL 또는 클라이언트 측 Java applets가 있다.FalseTrue✓True✓V3.7.22애플리케이션이 사용자를 통제하지 못하는 다른 호스트 이름이나 도메인으로 자동으로 리다이렉션할 때, 허용된 목적지로만 리다이렉션 하는지 확인한다.FalseTrue✓True✓V3.7.33사용자가 애플리케이션의 통제 범위를 벗어난 URL로 리다이렉션 될 때 이를 취소할 수 있는 옵션이 있는 알림이 애플리케이션에 표시되는지 확인한다.FalseFalseTrue✓V3.7.44애플리케이션의 최상위 도메인(예: site.tld)가 공공 HSTS preload 목록에 추가되었는지 확인한다. 이렇게 하면 애플리케이션에 TLS를 사용하는 것이 Strict-Transport-Security 응답 헤더 필드에만 의존하지 않고 메인 브라우저에 직접 내장된다.FalseFalseTrue✓V3.7.55애플리케이션에 접근하는 브라우저가 예상한 보안 특징을 가지고 있지 않은 경우, 애플리케이션이 문서에 명시된 대로 동작하는지 확인한다 (유저에게 경고하거나 접근을 차단하는 등).FalseFalseTrue✓V44APIAPI 와 WEB 서비스V4.11일반적인 웹 서비스 보안V4.1.11메세지 본문이 포함된 모든 HTTP 응답에는 실제 내용과 일치하는 Content-Type 헤더 필드가 포함되어 있는지 검증한다. 이때 IANA 미디어 타입(text, /+xml, /xml 등)에 따라 안전한 문자 인코딩 (ex. UTF-8, ISO-8859-1)을 지정하는 charset 파라미터도 포함되어야 한다.True✓True✓True✓V4.1.22사용자가 대면하는 엔드포인트(사람이 직접 웹 브라우저에 접속하는 경우)만 HTTP에서 HTTPS로 자동 리디렉션하고, 그 외에 서비스나 API 엔드포인트는 명백한 리디렉션을 구현하지 않았는지 검증한다. 이는 클라이언트가 실수로 암호화되지 않은 HTTP 요청을 보내고 있음에도, 요청이 자동으로 HTTPS로 리디렉션되어 민감한 데이터의 유출 사실을 발견하지 못하게 되는 상황을 방지하기 위함이다.FalseTrue✓True✓V4.1.33로드 밸런서, 웹 프록시, 백엔드-프론트엔드 서비스 등 중간 계층에서 설정되며, 애플리케이션에서 사용하는 모든 HTTP 헤더 필드를 사용자가 재정의할 수 없는지 확인한다. 예를 들어 X-Real-IP, X-Frowarded-*, X-User-ID 등의 헤더가 포함될 수 있다.FalseTrue✓True✓V4.1.44애플리케이션이나 API에서 명시적으로 지원하는 HTTP 메서드(프리플라이트 요청 시에 OPTIONS 포함)만 사용할 수 있으며, 사용되지 않는 메서드는 차단되어 있는지 확인한다.FalseFalseTrue✓V4.1.55매우 민감하거나 여러 시스템을 거치는 요청이나 거래에 대한 전송 계층 보호에 더하여 메세지별 디지털 서명들을 사용함으로써 추가적인 보증을 제공하는지 확인한다.FalseFalseTrue✓V4.22HTTP 메세지 구조 검증V4.2.11모든 애플리케이션 구성 요소(로드 밸런서, 방화벽, 애플리케이션 서버 포함)가 HTTP 요청 smuggling을 예방하는 HTTP 버전의 적합한 메커니즘을 사용하는지에 대해, 수신되는 HTTP 메세지의 끝을 결정하는지 확인한다. HTTP/1.x에서 Transfer-encoding 헤더 필드가 있는 경우에 RFC 2616에 따라서 Content-Length 헤더는 무시해야 한다. HTTP/2 또는 HTTP/3를 사용할 때 Content-Length 헤더 필드가 있는 경우에 수신기는 DATA 프레임의 길이와 일치하는지 확인해야 한다.FalseTrue✓True✓V4.2.22HTTP 메세지를 생성할 때, 요청 smuggling 공격을 예방하기 위해서 HTTP 프로토콜의 프레이밍 방식에 의해 결정된 Content의 길이와 Content-Length 헤더 필드가 충돌하지 않는지 확인한다. FalseFalseTrue✓V4.2.33응답 분할 및 헤더 인젝션 공격을 예방하기 위해서 애플리케이션이 Transfer-encoding과 같은 connection-specific 헤더 필드를 가진 HTTP/2또는 HTTP/3 메세지를 전송하거나 수락하지 않는지 확인한다.FalseFalseTrue✓V4.2.44헤더 인젝션 공격을 예방하기 위해서, 애플리케이션이 헤더 이름과 값에 CR(\r), LF(\n), CRLF(\r\n)과 같은 줄바꿈 문자가 포함되어 있지 않은 HTTP/2 및 HTTP/3 요청만 허용하는지 확인한다.FalseFalseTrue✓V4.2.55애플리케이션(백엔드 또는 프론트엔드)이 요청을 빌드하고 전송하는 경우, 수신 구성 요소가 수학하기에는 너무 긴 URI(ex. API 호출) 또는 HTTP 요청 헤더 필드(ex. Authorization 또는 Cookie)를 생성하지 않도록 검증, 검열 또는 기타 메커니즘을 사용하는지 확인한다. 이로 인해서 지나치게 긴 요청(ex. 긴 쿠키 헤더 필드)을 보낼 때와 같이 서비스 거부가 발생하여 서버가 항상 오류 상태로 응답할 수 있다.FalseFalseTrue✓V4.33GraphQLV4.3.11쿼리 허용 목록, 깊이 제한, 양 제한 또는 쿼리 비용 분석을 사용하여 값비싼 중첩 쿼리로 인해 GraphQL 또는 데이터 계층 표현식 거부(DOS)를 방지하는지 확인한다.FalseTrue✓True✓V4.3.22GraphQL API가 다른 사용자에 의해 사용되지 않는 한, 운영 환경에서 GraphQL 점검 쿼리들이 비비활성화되어 있는지 확인한다.FalseTrue✓True✓V4.44WebSocketV4.4.11모든 WebSocket 연결에 WebSocket over TLS(WSS)이 사용되는지 확인한다.True✓True✓True✓V4.4.22초기 HTTP WebSocket Handshake 중에 기존 헤더 필드가 애플리케이션에 허용된 기존 목록과 대조되는지 확인한다.FalseTrue✓True✓V4.4.33애플리케이션의 표준 세션 관리를 사용할 수 없는 경우, 관련 세션 관리 보안 요구 사항을 준수하는 전용 토큰이 사용되고 있는지 확인한다.FalseTrue✓True✓V4.4.44기존 HTTPS 세션을 WebSocket 채널로 전환할 때 이전에 인증된 HTTPS 세션을 통해 전용 WebSocket 세션 관리 토큰을 처음 얻거나 검증하는지 확인한다.FalseTrue✓True✓V55File파일 처리V5.11파일 처리 문서화V5.1.11업로드 기능별로 허용되는 파일 형식, 예상되는 파일 확장자, 그리고 최대 크기(압축 해제된 크기 포함)가 문서에 정의되어 있는지 검증해야 한다. 또한, 악성 파일이 탐지될 때 애플리케이션이 어떻게 동작하는지와 같이, 최종 사용자가 파일을 안전하게 다운로드하고 처리할 수 있도록 하는 방법이 문서에 명시되어 있는지 확인해야 한다.FalseTrue✓True✓V5.22파일 업로드 및 콘텐츠V5.2.11애플리케이션이 성능 저하나 서비스 거부 공격(Denial of Service; DoS)을 유발하지 않고 처리할 수 있는 크기의 파일만 허용하는지 검증해야 한다.True✓True✓True✓V5.2.22애플리케이션이 파일 자체 또는 zip 파일과 같은 아카이브 내에서 파일을 허용할 때, 파일 확장자가 예상 파일 확장자와 일치하는지 확인하고 내용이 확장자로 표현된 유형과 일치하는지 확인하는지 검증해야 한다. 여기에는 초기 '매직 바이트(magic bytes)' 확인, 이미지 재작성 수행, 파일 내용 유효성 검사를 위한 전문 라이브러리 사용이 포함되지만 이에 국한되지 않는다. L1의 경우, 특정 비즈니스 또는 보안 결정을 내리는 데 사용되는 파일에만 집중할 수 있다. L2 이상에서는 허용되는 모든 파일에 적용되어야 한다True✓True✓True✓V5.2.33애플리케이션이 압축 파일(예: zip, gz, docx, odt)을 압축 해제하기 전에 허용되는 최대 압축 해제 크기와 최대 파일 수를 확인하는지 검증해야 한다.FalseTrue✓True✓V5.2.44단일 사용자가 너무 많은 파일이나 과도하게 큰 파일로 저장 공간을 채우지 않도록 사용자별 파일 크기 할당량(quota) 및 최대 파일 수가 적용되는지 검증해야 한다.FalseFalseTrue✓V5.2.55애플리케이션이 심볼릭 링크(symlink)를 포함하는 압축 파일 업로드를 허용하지 않는지 검증해야 한다. 단, 이러한 기능이 특별히 요구되는 경우에는 심볼릭 링크할 수 있는 파일의 허용 목록(allowlist)을 강제하는 것이 필요하다.FalseFalseTrue✓V5.2.66픽셀 플러드 공격(Pixel Flood Attack)을 방지하기 위해, 애플리케이션이 업로드된 이미지의 픽셀 크기가 허용된 최대값보다 큰 경우 해당 이미지를 거부하는지 검증해야 한다.FalseFalseTrue✓V5.33파일 저장V5.3.11신뢰할 수 없는 입력으로 업로드되거나 생성되어 공개 폴더에 저장된 파일이 HTTP 요청으로 직접 접근될 때 서버 측 프로그램 코드로 실행되지 않는지 검증해야 한다.True✓True✓True✓V5.3.22애플리케이션이 파일 작업을 위한 파일 경로를 생성할 때, 사용자 제출 파일명 대신 내부적으로 생성되거나 신뢰할 수 있는 데이터를 사용하는지 검증해야 한다. 만약 사용자 제출 파일명 또는 파일 메타데이터를 반드시 사용해야 한다면, 경로 탐색(path traversal), 로컬 또는 원격 파일 포함(Local File Inclusion; LFI, Remote File Inclusion; RFI), 그리고 서버 측 요청 위조(Server-side Request Forgery; SSRF) 공격으로부터 보호하기 위해 엄격한 유효성 검사 및 정제(Sanitization)가 적용되는지 확인해야 한다.True✓True✓True✓V5.3.33파일 압축 해제와 같은 서버 측 파일 처리가 zip slip과 같은 취약점을 방지하기 위해 사용자 제공 경로 정보를 무시하는지 검증해야 한다.FalseFalseTrue✓V5.44파일 다운로드V5.4.11애플리케이션이 JSON, JSONP 또는 URL 파라미터를 포함한 사용자 제출 파일명을 검증하거나 무시하는지 검증해야 하고, 응답의 Content-Disposition 헤더 필드에 파일명을 명시하는지 검증해야 한다.FalseTrue✓True✓V5.4.22제공되는 파일 이름(예: HTTP 응답 헤더 필드 또는 이메일 첨부 파일)이 문서 구조를 보존하고 삽입 공격(Injection Attack)을 방지하기 위해 인코딩되거나 정제되는지 검증해야 한다. (예: RFC 6266 준수)FalseTrue✓True✓V5.4.33신뢰할 수 없는 소스에서 얻은 파일이 알려진 악성 콘텐츠 제공을 방지하기 위해 안티바이러스 스캐너에 의해 검사되는지 검증해야 한다.FalseTrue✓True✓V66Authentication인증V6.11Authentication DocumentationV6.1.11인증 문서가 크리덴셜 스터핑, 비밀번호 무차별 대입 공격 등을 방어하기 위해 속도 제한, 자동화 방지, 적응형 응답(adaptive response)과 같은 제어가 어떻게 사용되는지를 정의한다. 또한, 이러한 제어가 어떻게 구성되는지와 악의적으로 계정을 잠그는 것을 방지하는 방법을 명확히 하는지 검증한다.True✓True✓True✓V6.1.22조직명, 제품명, 시스템 식별자, 프로젝트 코드명, 부서명 또는 역할명 등 문맥적으로 특정된 단어의 변형을 포함하여, 비밀번호에 사용되지 않도록 문서화된 단어 목록이 있는지 검증한다.FalseTrue✓True✓V6.1.33애플리케이션이 여러 인증 경로를 포함하는 경우, 이들 모두가 문서화되어 있으며 각 경로에 대해 일관되게 적용되는 보안 제어와 인증 강도가 정의되어 있는지 검증한다.FalseTrue✓True✓V6.22비밀번호 보안V6.2.11사용자가 설정하는 비밀번호가 최소 8자 이상이어야 하며, 최소 15자 이상을 강력히 권장하는지 검증한다.True✓True✓True✓V6.2.22사용자가 비밀번호를 변경할 수 있는지 검증한다.True✓True✓True✓V6.2.33비밀번호 변경 기능이 사용자의 현재 비밀번호와 새 비밀번호를 요구하는지 검증한다.True✓True✓True✓V6.2.44계정 등록 또는 비밀번호 변경 시 제출된 비밀번호가 최소 3000개의 상위 비밀번호 목록과 비교 및 검사되는지, 이때 애플리케이션 비밀번호 정책(예: 최소 길이)을 만족하는지 검증한다.True✓True✓True✓V6.2.55비밀번호는 어떤 구성도 허용되며, 허용되는 문자 유형에 대한 제한이 없는지 검증한다. 대/소문자, 숫자, 특수문자에 대한 최소 개수 요구사항이 없어야 한다.True✓True✓True✓V6.2.66비밀번호 입력 필드가 type=password를 사용하여 입력을 마스킹하는지 검증한다. 애플리케이션은 사용자가 전체 비밀번호나 마지막 입력 문자를 일시적으로 볼 수 있도록 허용할 수 있다.True✓True✓True✓V6.2.77붙여넣기 기능, 브라우저 비밀번호 도우미, 외부 비밀번호 관리자의 사용이 허용되는지 검증한다.True✓True✓True✓V6.2.88애플리케이션이 비밀번호를 사용자로부터 수신한 그대로 검증하며, 대소문자 변경이나 잘림(truncation)과 같은 수정 없이 처리하는지 검증한다.True✓True✓True✓V6.2.99비밀번호가 최소 64자까지 허용되는지 검증한다.FalseTrue✓True✓V6.2.1010사용자의 비밀번호는 손상되었음이 발견되거나 사용자가 교체할 때까지 유효하며, 애플리케이션이 주기적인 자격 증명 교체를 요구하지 않는지 검증한다.FalseTrue✓True✓V6.2.1111문서화된 문맥별 단어 목록을 사용하여 추측하기 쉬운 비밀번호가 생성되지 않도록 하는지 검증한다.FalseTrue✓True✓V6.2.1212계정 등록 또는 비밀번호 변경 시 제출된 비밀번호가 유출된 비밀번호 집합과 비교 및 검사되는지 검증한다.FalseTrue✓True✓V6.33일반 인증 보안V6.3.11애플리케이션의 보안 문서에 따라 크리덴셜 스터핑 및 비밀번호 무차별 대입 공격을 방지하기 위한 제어가 구현되어 있는지 검증한다.True✓True✓True✓V6.3.22“root”, “admin”, “sa”와 같은 기본 사용자 계정이 애플리케이션에 존재하지 않거나 비활성화되어 있는지 검증한다.True✓True✓True✓V6.3.33애플리케이션 접근 시 반드시 MFA 또는 단일 요소 인증 메커니즘의 조합을 사용하는지 검증한다. L3의 경우, 인증을 수행하려는 사용자의 의도를 검증하기 위해 사용자가 직접 수행하는 동작(예: FIDO 하드웨어 키 또는 모바일 기기에서 버튼을 누르는 행위)을 요구함으로써, 피싱 공격에 대한 침해 및 위장 저항성을 제공하는 하드웨어 기반 인증 메커니즘이 반드시 하나의 요소로 포함되어야 한다. 이 요구사항에서 고려 사항을 완화하려는 경우, 완전히 문서화된 근거와 포괄적인 보완 통제가 반드시 수반되어야 한다.FalseTrue✓True✓V6.3.44여러 인증 경로가 존재하는 경우, 문서화되지 않은 경로가 없어야 하며 보안 제어와 인증 강도가 일관되게 적용되는지 검증한다.FalseTrue✓True✓V6.3.55사용자가 의심스러운 인증 시도에 대해 성공 여부와 관계 없이 알림을 제공받는지 검증한다. 여기에는 비정상적인 위치나 클라이언트에서의 인증 시도, 부분적으로만 성공한 인증(여러 요소 중 하나만 성공한 경우), 장기간 비활성 상태 이후의 인증 시도, 또는 여러 번의 인증 실패 후 성공한 인증이 포함될 수 있다.FalseFalseTrue✓V6.3.66이메일이 단일 또는 다중 요소 인증 메커니즘으로 사용되지 않는지 검증한다.FalseFalseTrue✓V6.3.77자격 증명 재설정, 사용자명/이메일 수정 등 인증 관련 정보 변경 이후 사용자에게 통지되는지 검증한다.FalseFalseTrue✓V6.3.88오류 메시지, HTTP 응답 코드, 응답 시간 차이 등을 통해 유효한 사용자를 유추할 수 없으며, 비밀번호 등록/찾기 기능에도 동일한 보호가 적용되는지 검증한다.FalseFalseTrue✓V6.44인증 요소 수명 주기 및 복구V6.4.11시스템이 생성하는 초기 비밀번호나 활성화 코드가 안전하게 난수로 생성되며, 기존 비밀번호 정책을 따르고, 짧은 기간 내 또는 최초 사용 시 만료되는지 검증한다. 초기 비밀번호는 장기 비밀번호로 허용되지 않아야 한다.True✓True✓True✓V6.4.22비밀번호 힌트나 지식 기반 인증(“비밀 질문”)이 존재하지 않는지 검증한다.True✓True✓True✓V6.4.33분실된 비밀번호에 대한 재설정 절차가 안전하게 구현되며, MFA를 우회하지 않는지 검증한다.FalseTrue✓True✓V6.4.44MFA 요소 분실 시, 등록 시와 동일 수준의 신원 증명이 수행되는지 검증한다.FalseTrue✓True✓V6.4.55만료 예정인 인증 메커니즘에 대한 갱신 안내가 충분한 시간 전에 발송되며, 필요한 경우 자동 알림이 구성되는지 검증한다FalseFalseTrue✓V6.4.66관리자가 사용자 비밀번호 재설정 절차를 시작할 수 있으나, 사용자의 비밀번호를 직접 변경하거나 지정할 수 없는지 검증한다. 이는 관리자가 사용자의 비밀번호를 알지 못하도록 한다.FalseFalseTrue✓V6.55General Multi-factor authentication requirementsV6.5.11조회 secret, 대역 외 인증 요청 및 코드, 시간 기반 일회용 비밀번호가 단 한 번만 성공적으로 사용 가능한지 검증한다.FalseTrue✓True✓V6.5.22애플리케이션 백엔드에 저장될 때, 엔트로피가 112비트 미만인 룩업 시크릿(예: 무작위 영숫자 19자 또는 무작위 숫자 34자)은 32비트 무작위 솔트(salt)를 포함하는 사전 승인된 비밀번호 저장용 해시 알고리즘으로 해시되는지 검증한다. 룩업 시크릿이 112비트 이상의 엔트로피를 가진 경우에는 표준 해시 함수를 사용할 수 있다.FalseTrue✓True✓V6.5.33룩업 시크릿, 대역 외 인증 코드, 그리고 시간 기반 일회용 비밀번호의 시드가 예측 가능한 값을 피하기 위해 암호학적으로 안전한 의사난수 생성기(CSPRNG)를 사용하여 생성되는지 검증한다. FalseTrue✓True✓V6.5.44룩업 시크릿과 대역 외 인증 코드가 최소 20비트의 엔트로피를 가지는지 검증한다. 일반적으로 무작위 영숫자 4자 또는 무작위 숫자 6자가 충분하다.FalseTrue✓True✓V6.5.55대역 외 인증 요청, 코드 또는 토큰과 시간 기반 일회용 비밀번호가 정의된 수명을 가지는지 검증한다. 대역 외 요청의 최대 수명은 10분이어야 하며, TOTP의 최대 수명은 30초이어야 한다.FalseTrue✓True✓V6.5.66도난이나 기타 손실의 경우 모든 인증 요소(물리적 장치 포함)를 해지할 수 있는지 검증한다.FalseFalseTrue✓V6.5.77생체 인식 인증 메커니즘은 반드시 보조 요소로만 사용되어야 하며, “소유하고 있는 것” 또는 “알고 있는 것” 중 하나와 함께 사용되는지 검증한다.FalseFalseTrue✓V6.5.88시간 기반 일회용 비밀번호는 신뢰할 수 있는 서비스의 시간 소스를 기준으로 검증되어야 하며, 신뢰할 수 없거나 클라이언트에서 제공한 시간을 기반으로 해서는 안 된다.FalseFalseTrue✓V6.66대역 외(Out-of-Band) 인증 메커니즘V6.6.11공중 교환 전화망(PSTN)을 사용하여 전화나 SMS를 통해 일회용 비밀번호(OTPs)를 전달하는 인증 메커니즘은, 해당 전화번호가 사전에 검증되었을 때만 제공되어야 하며, 더 강력한 대체 방법(예: 시간 기반 일회용 비밀번호)도 제공되어야 하고, 서비스는 사용자에게 이러한 보안 위험에 대한 정보를 제공해야 한다. L3 애플리케이션의 경우, 전화와 SMS는 옵션으로 제공되어서는 안 된다.FalseTrue✓True✓V6.6.22대역 외 인증 요청, 코드 또는 토큰은 생성된 원래 인증 요청에만 바인딩되어야 하며, 이전이나 이후의 요청에는 사용할 수 없어야 한다.FalseTrue✓True✓V6.6.33코드 기반 대역 외 인증 메커니즘이 속도 제한 등을 통해 무차별 대입 공격으로부터 보호되는지 검증한다. 또한 최소 64비트 이상의 엔트로피를 가진 코드를 사용하는 것도 고려해야한다.FalseTrue✓True✓V6.6.44다중요소 인증에 푸시 알림이 사용되는 경우, 푸시 폭탄(push bombing) 공격을 방지하기 위해 속도 제한을 적용해야 한다. 또한 숫자 일치 기법 역시 이 위험을 완화할 수 있다.FalseFalseTrue✓V6.77암호학적 인증 메커니즘V6.7.11암호학적 인증 단언(assertion)을 검증하는 데 사용되는 인증서는 수정으로부터 보호되는 방식으로 저장되는지 검증한다.FalseFalseTrue✓V6.7.22챌린지 논스(nonce)는 최소 64비트 길이여야 하며, 통계적으로 고유하거나 해당 암호 장치의 수명 동안 고유해야 한다.FalseFalseTrue✓V6.88ID 제공자(IdP)를 통한 인증V6.8.11애플리케이션이 다중 ID 제공자(IdP)를 지원하는 경우, 사용자의 신원이 다른 지원 IdP를 통해 위조될 수 없는지 검증한다. (예: 동일한 사용자 식별자를 사용하는 방식). 표준적인 대응책은 애플리케이션이 IdP ID(네임스페이스 역할)와 IdP 내 사용자 ID의 조합을 사용하여 사용자를 등록하고 식별하는 것이다.FalseTrue✓True✓V6.8.22인증 단언(예: JWT 또는 SAML 단언)의 디지털 서명이 존재하고 무결성이 항상 유지되는지를 검증한다. 서명이 없거나 유효하지 않은 단언은 거부해야 한다.FalseTrue✓True✓V6.8.33SAML 단언이 재생 공격의 방지를 위해 고유하게 처리되는지, 유효 기간 내에 단 한 번만 사용되는지 검증한다.FalseTrue✓True✓V6.8.44애플리케이션이 별도의 ID 제공자(IdP)를 사용하고 특정 기능에 대해 특정 인증 강도, 방식, 또는 최근성을 요구하는 경우, 애플리케이션은 IdP가 반환한 정보를 사용하여 이를 검증해야 한다. 예를 들어, OIDC가 사용되는 경우, 이는 ‘acr’, ‘amr’, ‘auth_time’(존재하는 경우)과 같은 ID 토큰 클레임을 검증함으로써 달성할 수 있다. IdP가 이 정보를 제공하지 않는 경우, 애플리케이션은 최소 강도의 인증 메커니즘(예: 사용자 이름과 비밀번호를 사용하는 단일요소 인증)이 사용되었다고 가정하는 문서화된 대체 접근법을 가져야 한다.FalseTrue✓True✓V77Session세션 관리V7.11세션 관리 문서화V7.1.11사용자의 세션 비활성 시간 초과 및 절대 최대 세션 수명에 대한 문서가 존재하고, 다른 제어와의 조합에서 적절하며, NIST SP 800-63B 재인증 요구사항에서 벗어날 시 그 근거가 문서에 포함되어 있는지 검증한다.FalseTrue✓True✓V7.1.22문서가 하나의 계정에서 허용되는 동시(병렬) 세션 수와 활성 세션 수의 최대값에 도달했을 때의 의도된 동작과 수행할 조치를 정의하는지 검증한다.FalseTrue✓True✓V7.1.33통합 신원 관리 생태계(예: SSO 시스템)의 일부로 사용자 세션을 생성하고 관리하는 모든 시스템이 문서화되어 있으며, 세션 수명, 종료, 재인증이 필요한 기타 조건을 조율하기 위한 제어가 포함되어 있는지 검증한다.FalseTrue✓True✓V7.22기본 세션 관리 보안V7.2.11애플리케이션이 모든 세션 토큰 검증을 신뢰할 수 있는 백엔드 서비스에서 수행하는지 검증한다.True✓True✓True✓V7.2.22애플리케이션이 세션 관리를 위해 정적 API 시크릿이나 키가 아닌, 자체 포함 토큰 또는 참조 토큰을 동적으로 생성하여 사용하는지 검증한다.True✓True✓True✓V7.2.33참조 토큰이 사용자 세션을 나타내는 데 사용되는 경우, 그 토큰이 고유하고, 암호학적으로 안전한 의사난수 생성기(CSPRNG)를 사용해 생성되며 최소 128비트의 엔트로피를 갖는지 검증한다.True✓True✓True✓V7.2.44애플리케이션이 사용자 인증(재인증 포함) 시 새로운 세션 토큰을 생성하고 기존 세션 토큰을 종료하는지 검증한다.True✓True✓True✓V7.33세션 타임아웃V7.3.11위험 분석 및 문서화된 보안 결정에 따라 재인증을 강제하는 비활성 시간 초과가 존재하는지 검증한다.FalseTrue✓True✓V7.3.22위험 분석 및 문서화된 보안 결정에 따라 재인증을 강제하는 절대 최대 세션 수명이 존재하는지 검증한다.FalseTrue✓True✓V7.44세션 종료V7.4.11로그아웃이나 만료와 같이 세션 종료가 트리거될 때, 애플리케이션이 해당 세션의 추가 사용을 허용하지 않는지 검증한다. 참조 토큰 또는 상태 유지형 세션의 경우, 이는 애플리케이션 백엔드에서 세션 데이터를 무효화하는 것을 의미한다. 자체 포함 토큰을 사용하는 애플리케이션은 종료된 토큰 목록 유지, 사용자별 날짜·시간 이전에 발급된 토큰 거부, 사용자별 서명 키 회전과 같은 방법을 사용해야 한다.True✓True✓True✓V7.4.22사용자 계정이 비활성화되거나 삭제될 때(예: 직원 퇴사), 애플리케이션이 모든 활성 세션을 종료하는지 검증한다.True✓True✓True✓V7.4.33비밀번호 재설정·복구를 통한 변경, MFA 설정 변경 등 어떤 인증 요소라도 성공적으로 변경 또는 제거한 후, 모든 다른 활성 세션을 종료할 수 있는 옵션을 제공하는지 검증한다.FalseTrue✓True✓V7.4.44인증이 필요한 모든 페이지의 로그아웃 기능에 접근하는 것이 쉽고 잘 보이는지 검증한다.FalseTrue✓True✓V7.4.55애플리케이션 관리자가 개별 사용자 또는 모든 사용자의 활성 세션을 종료할 수 있는지 검증한다.FalseTrue✓True✓V7.55세션 악용 방어V7.5.11이메일 주소, 전화번호, MFA 구성, 계정 복구에 사용되는 기타 정보 등 인증에 영향을 줄 수 있는 민감한 계정 속성을 변경하기 전에 전체 재인증을 요구하는지 검증한다.FalseTrue✓True✓V7.5.22사용자가 현재 활성 세션을 전체 또는 일부 확인하고(최소 요소 한 개에 대한 인증을 다시 수행한 후) 종료할 수 있는지 검증한다.FalseTrue✓True✓V7.5.33매우 민감한 거래나 작업을 수행하기 전에 최소 한 요소 인증 또는 2차 검증을 요구하는지 검증한다.FalseFalseTrue✓V7.66페더레이션 재인증V7.6.11RP와 IdP 간 세션 수명과 종료가 문서대로 동작하며, IdP 인증 이벤트 간의 최대 시간이 도달하는 경우 등 필요한 시점에 재인증을 요구하는지 검증한다.FalseTrue✓True✓V7.6.22세션 생성 시 사용자 동의 또는 명시적 동작을 요구하여, 사용자 상호작용 없이 새로운 애플리케이션 세션이 생성되지 않도록 하는지 검증한다.FalseTrue✓True✓V88Authorization권한 부여V8.11권한 부여 문서화V8.1.11권한 부여 문서가 소비자 권한과 자원 속성에 따라 기능 수준 및 데이터별 접근을 제한하는 규칙을 정의하는지 검증한다.True✓True✓True✓V8.1.22권한 부여 문서가 소비자 권한과 자원 속성에 따라 필드 수준 접근 제한(읽기 및 쓰기 모두)을 정의하는지 검증한다. 이러한 규칙은 관련 데이터 객체의 상태(state)나 상태값(status)과 같은 다른 속성 값에 의존할 수 있다.FalseTrue✓True✓V8.1.33애플리케이션 문서가 인증 및 권한 부여와 관련된 보안 결정을 내리는 데 사용되는 환경적, 맥락적 속성(예: 시간대, 사용자 위치, IP 주소, 디바이스 등)을 정의하는지 검증한다.FalseFalseTrue✓V8.1.44인증 및 권한 부여 문서가 기능 수준, 데이터별, 필드 수준 권한 부여에 더해 환경적, 맥락적 요소가 의사 결정에 어떻게 사용되는지 정의하는지 검증한다. 여기에는 평가되는 속성, 위험 임계값, 수행되는 조치(예: 허용, 추가 인증 요청, 거부, 단계적 인증)을 포함하는 것을 권장한다.FalseFalseTrue✓V8.22일반 권한 부여 설계V8.2.11애플리케이션이 기능 수준의 접근을 명시적 권한이 있는 소비자에게만 허용하는지 검증한다.True✓True✓True✓V8.2.22애플리케이션이 특정 데이터 항목에 대한 명시적 권한이 있는 소비자에게만 데이터별 접근을 허용하여, 안전하지 않은 직접 객체 참조(IDOR) 및 객체 수준 권한 부여 취약점(BOLA)을 방지하는지 검증한다.True✓True✓True✓V8.2.33애플리케이션이 특정 필드에 대한 명시적 권한이 있는 소비자에게만 필드 수준 접근을 허용하여, 객체 속성 수준 권한 부여 취약점(BOPLA)을 방지하는지 검증한다.FalseTrue✓True✓V8.2.44애플리케이션 문서에서 정의한 바에 따라, 소비자의 환경적, 맥락적 속성(예: 시간대, 위치, IP 주소 또는 장치)에 기반한 적응형 보안 제어가 인증 및 권한 부여 결정에 구현되는지 검증한다. 이러한 제어는 소비자가 새 세션을 시작할 때뿐만 아니라 기존 세션 중에도 반드시 적용되어야 한다.FalseFalseTrue✓V8.33운영 수준 권한 부여V8.3.11애플리케이션이 권한 부여 규칙을 신뢰할 수 있는 서비스 계층에서 적용하고, 클라이언트 측 JavaScript처럼 신뢰할 수 없는 소비자가 조작할 수 있는 제어에 의존하지 않는지 검증한다.True✓True✓True✓V8.3.22권한 부여 결정에 영향을 미치는 값의 변경 사항이 즉시 적용되는지 검증한다. 자체 포함 토큰(self-contained token)과 같이 즉시 적용이 불가능한 경우, 소비자가 더 이상 권한이 없는 작업을 수행할 때 이를 알리고 변경을 되돌리는 완화 제어를 반드시 두어야 한다. 단, 이 방법은 정보 유출을 방지하지는 못한다.FalseFalseTrue✓V8.3.33객체에 대한 접근이, 대리인이나 이를 대신 수행하는 서비스의 권한이 아닌, 원래 주체(예: 소비자)의 권한에 기반하는지 검증한다. 예를 들어, 소비자가 인증을 위해 자체 포함 토큰을 사용하여 웹 서비스를 호출하고, 해당 서비스가 다른 서비스에 데이터를 요청하는 경우, 두 번째 서비스는 첫 번째 서비스의 머신-투-머신 토큰이 아니라 소비자의 토큰을 사용하여 권한 결정을 내려야 한다.FalseFalseTrue✓V8.44기타 권한 부여 고려사항V8.4.11다중 테넌트 애플리케이션이 교차 테넌트 제어를 사용하여, 소비자의 작업이 권한이 없는 다른 테넌트에 영향을 미치지 않도록 하는지 검증한다.FalseTrue✓True✓V8.4.22관리 인터페이스 접근이 연속적인 소비자 신원 검증, 장치 보안 상태 평가, 맥락 기반 위험 분석 등 복수의 보안 계층을 포함하는지 검증한다. 네트워크 위치나 신뢰된 엔드포인트가 무단 접근 가능성을 줄일 수는 있더라도, 단독으로 권한 부여 판단의 유일한 요소가 되어서는 안 된다.FalseFalseTrue✓V99Self자체 포함 토큰(self-contained token)V9.11토큰 출처 및 무결성V9.1.11자체 포함 토큰 내용을 허용하기 전에 변조를 방지하기 위해 디지털 서명 또는 메시지 인증 코드(MAC)를 사용하여 토큰의 무결성을 검증해야 한다.True✓True✓True✓V9.1.22주어진 컨텍스트에 대해 자체 포함 토큰을 생성하고 검증할 때, 허용 목록에 있는 알고리즘만 사용될 수 있는지 검증해야 한다. 허용 목록에는 사용 가능한 알고리즘을 모두 포함해야 하며, 이상적으로는 대칭 또는 비대칭 알고리즘 중 하나만을 포함해야 한다. 또한 'None' 알고리즘은 반드시 제외해야 한다. 대칭 및 비대칭 알고리즘 모두를 지원해야 하는 경우, 키 혼동을 방지하기 위해 추가 제어가 필요하다.True✓True✓True✓V9.1.33자체 포함 토큰을 검증하는 데 사용되는 키 자료가 토큰 발행자를 위한 신뢰할 수 있는 사전 구성된 출처에서 비롯되었는지 검증하여, 공격자가 신뢰할 수 없는 출처 및 키를 지정하는 것을 방지해야 한다. JWT 및 기타 JWS 구조의 경우, 'jku', 'x5u', 'jwk'와 같은 헤더는 신뢰할 수 있는 출처의 허용 목록에 대해 검증되어야 한다.True✓True✓True✓V9.22토큰 내용V9.2.11토큰 데이터에 유효 기간이 존재하는 경우, 검증 시간이 이 유효 기간 내에 있을 때만 토큰 및 해당 내용이 허용되는지 검증해야 한다. 예를 들어, JWT의 경우 'nbf' 및 'exp' 클레임이 검증되어야 한다.True✓True✓True✓V9.2.22토큰을 수신하는 서비스가 토큰 내용을 수락하기 전에 올바른 유형이며 의도된 목적을 위한 것인지 토큰을 검증하는지 확인해야 한다. 예를 들어, 인가 결정에는 액세스 토큰만 허용될 수 있으며, 사용자 인증을 증명하는 데는 ID 토큰만 사용될 수 있다.FalseTrue✓True✓V9.2.33서비스가 대상 서비스(audience)와 함께 사용하기 위한 토큰만 허용하는지 검증해야 한다. JWT의 경우, 서비스에 정의된 허용 목록에 대해 'aud' 클레임을 검증함으로써 이를 달성할 수 있다.FalseTrue✓True✓V9.2.44토큰 발행자가 다른 대상(audience)에게 토큰을 발행하기 위해 동일한 개인 키를 사용하는 경우, 발행된 토큰이 의도된 대상을 고유하게 식별하는 대상 제한을 포함하는지 검증해야 한다. 이는 토큰이 의도하지 않은 대상에서 재사용되는 것을 방지한다. 대상 식별자가 동적으로 프로비저닝되는 경우, 토큰 발행자는 대상 위장(audience impersonation)을 초래하지 않도록 대상들을 검증해야 한다.FalseTrue✓True✓V1010OAuthOAuth와 OIDCV10.11일반적인 OAuth 및 OIDC 보안V10.1.11엄격하게 필요한 구성 요소에만 토큰이 전송되는지 검증해야 한다. 예를 들어, 브라우저 기반 JavaScript 애플리케이션에 프론트엔드 전용 백엔드(Backend For Frontend; BFF) 패턴을 사용하는 경우, 액세스 토큰 및 리프레시 토큰은 백엔드에서만 접근 가능해야 한다.FalseTrue✓True✓V10.1.22클라이언트는 인가 서버에서 제공하는 값(예: 인가 코드 또는 ID 토큰)이 동일한 사용자 에이전트 세션 및 트랜잭션에서 시작된 인가 플로우의 결과인 경우에만 허용하는지 검증해야 한다. 이를 위해 클라이언트가 생성하는 비밀 값(PKCE(Proof Key for Code Exchange)의 'code_verifier', 'state', OIDC의 'nonce' 등)은 추측이 불가능해야 하며, 해당 트랜잭션에 고유해야 하고, 트랜잭션이 시작된 클라이언트와 사용자 에이전트 세션 양쪽에 안전하게 결합(Binding)되어 있어야 한다.FalseTrue✓True✓V10.22OAuth 클라이언트V10.2.11코드 플로우를 사용하는 경우, OAuth 클라이언트는 토큰 요청을 유도하는 사이트 간 요청 위조 공격(Cross-Site Request Forgery; CSRF)에 대한 보호 기능을 갖추고 있는지 검증한다. 이를 위해 인가 요청 시 전송된 'state' 파라미터를 검증하거나, PKCE 기능을 사용해야 한다.FalseTrue✓True✓V10.2.22OAuth 클라이언트가 둘 이상의 인가 서버와 상호 작용할 수 있는 경우, 믹스업 공격에 대한 방어 대책을 갖는지 검증해야 한다. 예를 들어, 인가 서버가 'iss' 파라미터 값을 반환하도록 요구하고 인가 응답 및 토큰 응답에서 이를 검증할 수 있다.FalseTrue✓True✓V10.2.33OAuth 클라이언트가 인가 서버에 대한 요청에서 필요한 범위(또는 기타 인가 파라미터)만 요청하는지 검증해야 한다.FalseFalseTrue✓V10.33OAuth 리소스 서버V10.3.11리소스 서버가 해당 서비스(audience)에 사용하도록 의도된 액세스 토큰만 수락하는지 검증해야 한다. 대상은 구조화된 액세스 토큰(예: JWT의 'aud' 클레임)에 포함될 수 있거나, 토큰 조회 엔드포인트를 사용하여 확인할 수 있다.FalseTrue✓True✓V10.3.22리소스 서버가 위임된 인가를 정의하는 액세스 토큰의 클레임을 기반으로 인가 결정을 시행하는지 검증해야 한다. 'sub', 'scope', 'authorization_details'와 같은 클레임이 존재하는 경우, 이는 결정에 반영되어야 한다.FalseTrue✓True✓V10.3.33액세스 토큰(JWT 또는 관련 토큰 조회 응답)에서 고유한 사용자를 식별해야 하는 접근 제어 결정이 필요한 경우, 리소스 서버가 다른 사용자에게 재할당될 수 없는 클레임에서 사용자를 식별하는지 검증해야 한다. 일반적으로 이는 'iss' 및 'sub' 클레임의 조합을 사용하는 것을 의미한다.FalseTrue✓True✓V10.3.44리소스 서버가 특정 인증 강도, 방법 또는 최신성을 요구하는 경우, 제시된 액세스 토큰이 이러한 제약 조건을 충족하는지 검증해야 한다. 예를 들어, 토큰을 제시한 경우 OIDC의 'acr', 'amr' 및 'auth_time' 클레임을 각각 사용해야 한다.FalseTrue✓True✓V10.3.55리소스 서버가 발신자 제약 액세스 토큰, 즉 OAuth 2용 상호 TLS(Mutual TLS; mTLS) 또는 OAuth 2 소유 증명(Demonstration of Proof of Possession; DPoP)를 요구하여 도난된 액세스 토큰 사용 또는 액세스 토큰 재사용(권한 없는 당사자로부터)을 방지하는지 검증해야 한다.FalseFalseTrue✓V10.44OAuth 인가 서버V10.4.11인가 서버는 클라이언트 별로 사전 등록된 URI의 허용 목록을 기반으로 리디렉션 URI를 정확한 문자열 비교 방식으로 검증해야 한다.True✓True✓True✓V10.4.22인가 서버가 인가 응답에서 인가 코드를 반환하는 경우, 해당 코드는 토큰 요청에 한번만 사용될 수 있어야 한다. 이미 액세스 토큰을 발급하는 데 사용된 인가 코드를 사용하여 두 번째 요청이 발생하면, 인가 서버는 토큰 요청을 거부하고 해당 인가 코드와 관련된 모든 발급된 토큰을 취소해야 한다.True✓True✓True✓V10.4.33인가 코드가 단기간만 유효한지 검증해야 한다. 최대 수명은 L1 및 L2 애플리케이션의 경우 최대 10분, L3 애플리케이션의 경우 최대 1분 이내여야 한다.True✓True✓True✓V10.4.44인가 서버는 특정 클라이언트에 대해, 해당 클라이언트가 사용할 필요가 있는 인가 방식(grant)만 사용하도록 허용해야 한다. token(암시적 플로우) 및 password(리소스 소유자 비밀번호 자격 증명 플로우) 방식은 더 이상 사용되어서는 안 된다.True✓True✓True✓V10.4.55인가 서버가 공개 클라이언트에 대한 리프레시 토큰 재사용 공격을 완화하는지 검증해야 한다. 가급적이면 발신자 제약 리프레시 토큰, 즉 소유 증명이나 mTLS를 사용한 인증서 바인딩 액세스 토큰을 사용해야 한다. L1 및 L2 애플리케이션의 경우, 리프레시 토큰 회전(rotation)이 사용될 수 있다. 리프레시 토큰 회전이 사용되는 경우, 인가 서버는 리프레시 토큰을 사용 후 무효화해야 하며, 이미 사용되고 무효화된 리프레시 토큰이 제공되면 해당 인가에 대한 모든 리프레시 토큰을 철회(revoke)해야 한다.True✓True✓True✓V10.4.66코드 인가 방식(code grant)이 사용되는 경우, 인가 서버가 PKCE를 요구하여 인가 코드 탈취 공격을 완화하는지 검증해야 한다. 인가 요청의 경우, 인가 서버는 유효한 'code_challenge' 값을 요구해야 하며, 'code_challenge_method'값으로 'plain'를 허용해서는 안 된다. 토큰 요청의 경우, 'code_verifier' 파라미터의 검증을 요구해야 한다.FalseTrue✓True✓V10.4.77인가 서버가 인증되지 않은 동적 클라이언트 등록을 지원하는 경우, 악의적인 클라이언트 애플리케이션의 위험을 완화하는지 검증해야 한다. 등록된 URI와 같은 클라이언트 메타데이터를 검증하고, 사용자의 동의를 확인해야 하며, 신뢰할 수 없는 클라이언트 애플리케이션으로 인가 요청을 처리하기 전에 사용자에게 경고해야 한다.FalseTrue✓True✓V10.4.88슬라이딩 리프레시 토큰 만료(expiration)가 적용되더라도, 리프레시 토큰에 절대 만료 시점(absolute expiration)이 포함되어 있는지 확인한다.FalseTrue✓True✓V10.4.99악의적인 클라이언트 또는 도난된 토큰의 위험을 완화하기 위해 인가 서버 사용자 인터페이스를 통해 권한 있는 사용자가 리프레시 토큰 및 참조 액세스 토큰을 철회할 수 있는지 검증해야 한다.FalseTrue✓True✓V10.4.1010토큰 요청, 푸시된 인가 요청(Pushed Authorization Request; PAR), 토큰 철회 요청과 같은 클라이언트에서 인가 서버로의 백채널 요청(backchannel request)에 대해 기밀 클라이언트가 인증되는지 검증해야 한다.FalseTrue✓True✓V10.4.1111인가 서버 구성이 OAuth 클라이언트에 필요한 범위만 할당하는지 검증해야 한다.FalseTrue✓True✓V10.4.1212주어진 클라이언트에 대해 인가 서버가 해당 클라이언트가 사용해야 하는 'response_mode' 값만 허용하는지 검증해야 한다. 예를 들어, 인가 서버가 이 값을 예상 값과 비교하여 검증하거나, PAR 또는 JWT 기반 인가 요청(JWT-secured Authorization Request; JAR)을 사용하여 검증해야 한다.FalseFalseTrue✓V10.4.1313인가 유형 'code'가 항상 PAR과 함께 사용되는지 검증해야 한다.FalseFalseTrue✓V10.4.1414인가 서버가 mTLS를 사용하는 인증서 바인딩 액세스 토큰 또는 소유 증명 바인딩 액세스 토큰을 사용하여 발신자 제약(Proof-of-Possession) 액세스 토큰만 발급하는지 검증해야 한다.FalseFalseTrue✓V10.4.1515최종 사용자 장치에서 실행되지 않는 서버에서 동작하는 클라이언트의 경우, 인가 서버가 'authorization_details' 파라미터 값이 클라이언트 백엔드로부터 생성되었는지와 사용자가 해당 값을 변조되지 않았는지를 검증해야 한다. 예를 들어, PAR 또는 JAR의 사용을 요구하여 확인해야 한다.FalseFalseTrue✓V10.4.1616클라이언트가 기밀 클라이언트인지 검증하고, 인가 서버는 재사용 공격에 강하고 공개키 암호화에 기반한 강력한 클라이언트 인증 방식을 사용하도록 요구해야 한다. 예를 들어, mTLS(tls_client_auth, self_signed_tls_client_auth) 또는 비공개 키 기반 JWT 인증(private_key_jwt) 등이 이에 해당한다.FalseFalseTrue✓V10.55OIDC 클라이언트V10.5.11신뢰 당사자로서 클라이언트가 ID 토큰 재사용 공격을 완화하는지 검증해야 한다. 예를 들어, ID 토큰의 'nonce' 클레임이 OpenID 공급자에 전송된 인증 요청(OAuth2에서는 인가 서버에 전송된 인가 요청)에서 전송된 'nonce' 값과 일치하는지 확인해야 한다.FalseTrue✓True✓V10.5.22클라이언트가 ID 토큰 클레임, 일반적으로 'sub' 클레임에서 사용자를 고유하게 식별하며, 해당 클레임이 ID 공급자 범위 내에서 다른 사용자에게 재할당될 수 없는지 검증해야 한다.FalseTrue✓True✓V10.5.33클라이언트는 악의적인 인가 서버가 인가 서버 메타데이터를 통해 다른 인가 서버를 가장하려는 시도를 거부하는지 검증해야 한다. 클라이언트는 인가 서버 메타데이터에 포함된 발급자(issuer) URL이 클라이언트가 예상하는 사전 구성된 발급자 URL과 정확히 일치하지 않는 경우, 해당 메타데이터를 거부해야 한다.FalseTrue✓True✓V10.5.44클라이언트는 토큰의 aud 클레임 값이 클라이언트의 client_id 값과 동일한지 확인하여 ID 토큰이 해당 클라이언트(audience)를 대상으로 발급되었음을 검증해야 한다.FalseTrue✓True✓V10.5.55OIDC 백채널 로그아웃을 사용하는 경우, 신뢰 당사자는 강제 로그아웃을 통한 서비스 거부 공격(Denial of Service) 및 로그아웃 플로우에서의 JWT 혼동(cross-JWT confusion)을 완화하는지 검증해야 한다. 클라이언트는 로그아웃 토큰이 'logout+jwt' 값으로 올바르게 지정되어 있는지, 올바른 멤버 이름을 가진 'event' 클레임을 포함하는지, 그리고 'nonce' 클레임을 포함하지 않는지 검증해야 한다. 또한, 짧은 만료 시간(예: 2분)을 갖는 것이 권장된다.FalseTrue✓True✓V10.66OpenID 공급자V10.6.11OpenID 공급자는 response_mode 파라미터 값으로'code', 'ciba', 'id_token' 또는 'id_token code' 만 허용하는지 검증해야 한다. 이 중 'id_token code'(OIDC 하이브리드 플로우)보다는 'code'가 선호되며, 'token'(모든 암시적 플로우)은 사용되어서는 안 된다.FalseTrue✓True✓V10.6.22OpenID 공급자가 강제 로그아웃을 통한 서비스 거부 공격을 완화하는지 검증해야 한다. 신뢰 당사자로 부터 시작된 로그아웃 요청에 id_token_hint 등의 파라미터가 포함되어 있는 경우, 이를 검증하거나 최종 사용자로부터 명시적인 확인을 받아야 한다.FalseTrue✓True✓V10.77동의 관리V10.7.11인가 서버가 사용자로부터 각 인가 요청에 대한 명시적인 동의(consent)를 확인하는지 검증해야 한다. 클라이언트의 신원을 보장할 수 없는 경우, 인가 서버는 항상 사용자에게 명시적으로 동의를 요청해야 한다.FalseTrue✓True✓V10.7.22인가 서버가 사용자 동의를 요청할 때, 동의하는 내용에 대한 충분하고 명확한 정보를 제공하는지 검증해야 한다. 이에 해당하는 경우, 요청된 인가의 성격(일반적으로 범위, 리소스 서버, RAR(Rich Authorization Requests) 인가 세부 정보 기반), 인가된 애플리케이션의 신원, 인가의 유효 기간이 포함되어야 한다.FalseTrue✓True✓V10.7.33사용자가 인가 서버를 통해 부여한 동의를 검토, 수정 및 철회할 수 있는지 검증해야 한다.FalseTrue✓True✓V1111Cryptography암호화V11.11암호화 인벤토리 및 문서화V11.1.11'NIST SP 800-57'과 같은 암호화 키 관리 및 키 관리 표준을 따르는 암호화 키 수명 주기에 대한 문서화 된 정책이 있는지 검증해야 한다. 여기에는 키가 과도하게 공유되지 않도록 하는 것이 포함된다(예: 공유 비밀의 경우 두 개를 초과하는 엔터티와 공유 및 개인 키의 경우 한 개를 초과하는 엔터티에 공유).FalseTrue✓True✓V11.1.22애플리케이션에서 사용되는 모든 암호화 키, 알고리즘, 인증서를 포함한 암호화 자산 목록(cryptographic inventory)이 작성되고, 유지되며, 정기적으로 업데이트되고 있는지 검증해야 한다. 또한, 각 키가 시스템 내에서 사용 가능한 위치와 사용이 제한되는 위치, 해당 키로 보호할 수 있는 데이터 유형과 보호할 수 없는 데이터 유형이 문서화되어 있어야 한다.FalseTrue✓True✓V11.1.33암호화, 해싱, 서명 작업을 포함하는 시스템 내의 모든 암호화 사용 사례를 식별하기 위해, 암호화 사용 탐지 메커니즘이 적용되는지 검증해야 한다.FalseFalseTrue✓V11.1.44암호화 자산 목록이 유지 관리되는지 검증해야 한다. 여기에는 미래의 위협에 대응하기 위해 양자 내성 암호(Post-Quantum Cryptography; PQC)와 같은 새로운 암호화 표준으로의 마이그레이션 계획을 설명하는 문서화된 계획이 포함되어야 한다.FalseFalseTrue✓V11.22안전한 암호화 구현V11.2.11암호화 작업에 업계에서 검증된 구현(라이브러리 및 하드웨어 가속 구현 포함)이 사용되는지 검증해야 한다.FalseTrue✓True✓V11.2.22난수, 인증 암호화, MAC, 해싱 알고리즘, 키 길이, 라운드, 암호 및 모드를 언제든지 재구성, 업그레이드 또는 교체하여 암호화 해독으로부터 보호할 수 있도록 애플리케이션이 암호화 유연성(crypto agility)을 갖추고 설계되었는지 검증해야 한다. 또한, 키와 비밀번호를 교체하고 데이터를 다시 암호화하는 것도 가능해야 한다. 이를 통해 승인된 PQC 체계(또는 표준)의 고신뢰 구현이 널리 사용 가능해지면 PQC로 원활하게 업그레이드할 수 있다.FalseTrue✓True✓V11.2.33모든 암호화 기본 구성요소(primitive)가 알고리즘, 키 크기 및 구성에 따라 최소 128비트의 보안강도를 제공하는지 검증해야 한다. 예를 들어, 256비트 ECC 키는 대략 128비트의 보안을 제공하며, RSA는 128비트의 보안을 달성하기 위해 3072비트 키를 필요로 한다.FalseTrue✓True✓V11.2.44민감한 정보가 누출되는 것을 방지하기 위해 모든 암호화 연산은 상수 시간(constant-time)으로 수행되어야 하며, 비교, 계산, 반환 과정에서 단락(short-circuit) 연산이 없는지 검증해야 한다.FalseFalseTrue✓V11.2.55모든 암호화 모듈이 안전하게 실패하고, 패딩 오라클 공격(Padding Oracle attacks)과 같은 취약점을 허용하지 않는 방식으로 오류가 처리되는지 검증해야 한다.FalseFalseTrue✓V11.33암호화 알고리즘V11.3.11안전하지 않은 블록 모드(예: ECB) 및 약한 패딩 방식(예: PKCS#1 v1.5)가 사용되지 않는지 검증해야 한다.True✓True✓True✓V11.3.22GCM을 사용하는 AES와 같이 승인된 암호 및 모드만 사용되는지 검증해야 한다.True✓True✓True✓V11.3.33암호화 된 데이터가 승인된 인증된 암호화 방식을 사용하거나, 승인된 암호화 방식과 승인된 MAC 알고리즘을 조합을 통한 무단 수정으로부터 보호되는지 검증해야 한다.FalseTrue✓True✓V11.3.44논스(nonces), 초기화 벡터 및 기타 단일 사용 번호가 둘 이상의 암호화 키 및 데이터 요소 쌍에 사용되지 않는지 검증해야 한다. 생성 방법은 사용되는 알고리즘에 적합해야 한다.FalseFalseTrue✓V11.3.55암호화 알고리즘과 MAC 알고리즘의 모든 조합이 암호화 후 MAC(Encrypt-then-MAC) 방식으로 동작하는지 검증해야 한다.FalseFalseTrue✓V11.44해싱 및 해시 기반 함수V11.4.11디지털 서명, HMAC, KDF 및 무작위 비트 생성을 포함한 일반적인 암호화 사용 사례에 승인된 해시 함수만 사용되는지 검증해야 한다. MD5와 같이 허용되지 않는 해시 함수는 어떤 암호화 목적으로도 사용해서는 안 된다.True✓True✓True✓V11.4.22비밀번호가 승인된 '계산 집약적인 키 유도 함수("비밀번호 해싱 함수"라고도 함)'를 사용하여 저장되고, 파라미터 설정이 현재 지침에 따라 구성되었는지 검증해야 한다. 설정은 필요한 보안 수준에 대한 무차별 대입 공격을 충분히 어렵게 만들기 위해 보안과 성능의 균형을 이루어야 한다.FalseTrue✓True✓V11.4.33데이터 인증 또는 데이터 무결성의 일부로 디지털 서명에 사용되는 해시 함수가 충돌 저항성을 가지며 적절한 비트 길이를 갖는지 검증해야 한다. 충돌 저항성이 필요한 경우, 출력 길이는 최소 256비트여야 한다. 제2 역상(pre-image) 공격 저항성만 필요한 경우, 출력 길이는 최소 128비트여야 한다.FalseTrue✓True✓V11.4.44비밀번호로부터 비밀 키를 유도할 때 애플리케이션이 키 스트레칭(key stretching) 파라미터를 사용하여 승인된 키 유도 함수(key derivation function)를 사용하는지 검증해야 한다. 사용 중인 파라미터는 결과적인 암호화 키를 손상시키는 무차별 대입 공격을 방지하기 위해 보안과 성능의 균형을 이루어야 한다.FalseTrue✓True✓V11.55무작위 값V11.5.11예측 불가능해야 하는 모든 난수 및 문자열이 암호학적으로 안전한 의사 난수 생성기(CSPRNG)를 사용하여 생성되고 최소 128비트의 엔트로피를 갖는지 검증해야 한다. UUID는 이 조건을 충족하지 않는다.FalseTrue✓True✓V11.5.22사용 중인 난수 생성 메커니즘이 높은 부하(heavy demand)에서도 안전하게 작동하도록 설계되었는지 검증해야 한다.FalseFalseTrue✓V11.66공개 키 암호화V11.6.11키 생성 및 시딩, 디지털 서명 생성 및 검증에 승인된 암호화 알고리즘 및 작동 모드만 사용되는지 검증해야 한다. 키 생성 알고리즘은 알려진 공격에 취약한 안전하지 않은 키(예: 페르마 인수분해(Fermat factorization)에 취약한 RSA 키)를 생성해서는 안 된다.FalseTrue✓True✓V11.6.22키 교환에는 디피-헬만과 같은 승인된 암호화 알고리즘이 사용되어야 하며, 안전한 파라미터를 사용하는지 여부를 중점적으로 검증해야 한다.이는 중간자 공격(adversary-in-the-middle attacks) 또는 암호화 해독으로 이어질 수 있는 키 설정 프로세스에 대한 공격을 방지할 것이다.FalseFalseTrue✓V11.77사용 중 데이터 암호화V11.7.11사용 중인 민감한 데이터를 보호하고 무단 사용자 또는 프로세스의 접근을 방지하기 위해 전체 메모리 암호화가 사용되는지 검증해야 한다.FalseFalseTrue✓V11.7.22데이터 최소화가 처리 중에 노출되는 데이터의 양을 최소화하고, 사용 직후 또는 가능한 한 빨리 데이터가 암호화되도록 보장하는지 검증해야 한다.FalseFalseTrue✓V1212Secure보안 통신V12.11일반 TLS 보안 가이드V12.1.11TLS 1.2 및 TLS 1.3과 같은 최신 권장 버전의 TLS 프로토콜만 활성화되어 있으며, 그중 최신 버전이 우선되어야 한다.True✓True✓True✓V12.1.22오직 권장되는 암호화 스위트(cipher suites)들이 활성화되어 있으며 그 중 가장 강력한 암호화 스위트로 우선 설정되어 있는지 확인한다. 레벨3 애플리케이션은 순방향 비밀성(forward secrecy)을 제공하는 암호화 스위트만 지원해야 한다.FalseTrue✓True✓V12.1.33인증이나 권한 부여를 위해 인증서 ID를 사용하기 전에 애플리케이션이 mTLS 클라이언트 인증서가 신뢰할 수 있는지 검증해야 한다.FalseTrue✓True✓V12.1.44Online Certificate Status Protocol (OCSP) 스테이플링(Stapling)과 같은 적절한 인증서 폐지 프로토콜이 활성화되고 설정되어 있는지 확인해야 한다.FalseFalseTrue✓V12.1.55TLS 핸드셰이크 프로세스 중 Server Name Indication (SNI)과 같은 민감한 메타 데이터의 노출을 방지하기 위해 애플리케이션 TLS 설정에서 Encrypted Client Hello (ECH)가 활성화되어 있는지 확인해야 한다.FalseFalseTrue✓V12.22외부 서비스와의 HTTPS 통신V12.2.11TLS는 클라이언트와 외부 HTTP 기반 서비스 간의 모든 연결에 사용되며, 안전하지 않거나 암호화 되어 있지 않은 통신에 대체 동작(fall back)이 발생하지 않는지 확인해야한다. True✓True✓True✓V12.2.22외부 서비스가 공적으로 신뢰된 TLS 인증서를 사용하는지 확인해야 한다.True✓True✓True✓V12.33일반 서비스 간의 통신 보안V12.3.11애플리케이션간의 모니터링 시스템, 관리 도구, 원격 엑세스 및 SSH, 미들웨어, 데이터베이스, 메인프레임, 파트너 시스템이나 외부 API를 포함한 모든 인바운드와 아웃바운드 통신은 TLS같은 암호화 프로토콜이 사용되는지 확인해야 한다. 이 서버는 안전하지 않거나 암호화 되어있지 않은 프로토콜에 대체 동작(fall back)이 발생하지 않아야 한다.FalseTrue✓True✓V12.3.22TLS 클라이언트가 통신하기 전에 TLS서버로 부터 받은 인증서를 검증하는지 확인해야 한다.FalseTrue✓True✓V12.3.33그리고 TLS 또는 애플리케이션 내의 내부 HTTP 기반 서비스간에 사용된 다른 적절한 전송 암호화 매커니즘이 안전하지 않거나 암호화 되어있지 않은 통신에 대체 동작(fall back)이 발생하지 않는지 확인해야 한다.FalseTrue✓True✓V12.3.44내부 서버간에 TLS 통신이 신뢰된 인증서를 사용하는지 확인해야 한다. 내부 인증서나 자체 서명(self-signed)인증서를 사용할 경우, 이를 사용하는 서비스는 오직 특정 내부 인증기관(CA)과 자체 서명 인증만을 신뢰하게 설정해야 한다.FalseTrue✓True✓V12.3.55시스템 내부에서 통신하는 서비스(intra-service communication)는 각 엔드포인트를 검증하기 위해 강력한 인증을 사용해야 한다. 공용키(public-key) 기반 구조와 재전송 공격(replay attacks)에 저항하는 매커니즘을 사용하여 신원보장을 위해 TLS 클라이언트 인증과 같은 강력한 인증 방식을 사용해야 한다. 마이크로서비스 아키텍쳐의 경우 인증서 관리를 간소화 하고 보안을 강화하기 위해 서비스 매시(service mesh)를 사용하는 것을 고려해야 한다.FalseFalseTrue✓V1313Configuration설정V13.11설정 문서V13.1.11애플리케이션의 모든 통신 요구사항이 문서화 되어 있는지를 검증한다. 이는 애플리케이션이 의존하는 외부 서비스나, 사용자가 애플리케이션이 연결할 외부 위치를 제공하는 경우들을 포함한다.FalseTrue✓True✓V13.1.22애플리케이션이 사용하는 각각의 서비스들에 대해, 문서가 최대 동시 연결 수(연결 풀 제한)를 정의하고 있는지, 그리고 그 한계에 다다랐을 때 폴백(fallback)이나 복구 메커니즘 등을 포함하여, DoS 공격을 방지하기 위해 애플리케이션이 어떻게 동작하는지를 검증한다.FalseFalseTrue✓V13.1.33애플리케이션 문서가 모든 외부 시스템이나 애플리케이션이 사용하는 서비스(예시: 데이터베이스, 파일 핸들, 스레드, HTTP 연결)들에 대한 자원-관리 전략을 정의하고 있는지 검증한다.이는 자원-해제 프로시저, 시간초과 설정, 오류 핸들링을 포함하며, 재시도 로직이 구현된 경우 재시도 제한과 지연, 백-오프 알고리즘을 명시해야 한다. 동기 HTTP 요청-응답 명령에 대해서는 짧은 타임아웃에 더해 재시도의 비활성화 혹은 연쇄적인 지연과 자원 고갈을 방지하기 위한 재시도의 엄격한 제한을 의무화해야 한다.FalseFalseTrue✓V13.1.44애플리케이션 문서가 조직의 위협 모델과 사업적 요구사항에 기반하여, 애플리케이션의 보안과 비밀 정보들의 주기적 갱신 일정에 치명적인 비밀 정보들을 정의하고 있는지 검증한다.FalseFalseTrue✓V13.22백엔드 통신 설정V13.2.11API나 미들웨어와 같은 애플리케이션의 표준 사용자 세션 메커니즘을 지원하지 않는 백엔드 애플리케이션 컴포넌트와 데이터 계층 사이의 통신이 인증되어 있는지를 검증한다. 인증은 반드시 개별적인 서비스 계정과 단기간 토큰, 또는 인증서 기반 인증을 사용하고 비밀번호, API 키, 또는 접근 권한이 부여된 공유 계정 등의 자격 증명을 변경하지 않아선 안 된다. FalseTrue✓True✓V13.2.22로컬 또는 운영체제 서비스, API, 미들웨어, 그리고 데이터 계층을 포함한 백엔드 애플리케이션 컴포넌트 간의 통신이 최소 필요 권한이 할당된 계정들로 수행되는지 검증한다.FalseTrue✓True✓V13.2.33만약 자격 증명이 서비스 인증을 위해 필요하다면, 소비자로부터 사용되는 그 자격 증명이 기본 자격 증명이 아님을 검증한다. (예시: root/root 또는 admin/admin)FalseTrue✓True✓V13.2.44얼로우리스트가 애플리케이션의 통신이 허가된 외부 리소스나 시스템을 정의하기 위해 사용되는지 검증한다. (예시: 아웃바운드 요청, 데이터 로드, 파일 접근). 이 얼로우리스트는 애플리케이션 계층, 웹 서버, 방화벽 또는 다른 여러 계층의 조합으로 구현할 수 있다. FalseTrue✓True✓V13.2.55웹이나 애플리케이션 서버에 요청을 보내거나 데이터나 파일을 로드 할 수 있는 리소스 또는 시스템의 얼로우리스트가 설정되어 있는지를 검증한다.FalseTrue✓True✓V13.2.66애플리케이션이 별도의 서비스와 연결할 때, 각 연결이 최대 병렬연결, 최대 연결 도달 시의 동작, 연결 타임아웃, 재시도 전략 등 문서화된 설정에 따르는지 검증한다.FalseFalseTrue✓V13.33비밀 정보 관리V13.3.11키 볼트와 같은 비밀 정보 관리 솔루션이 백엔드 비밀 정보들을 만들고 저장하고, 접근을 제어하고, 파기하기 위해 사용되고 있는지 검증한다. 이는 비밀번호, 키 재료, 데이터베이스와 서드 파티 시스템의 통합, 시간-기반 토큰을 위한 키와 시드, 그리고 API 키들을 포함할 수 있다. 비밀 정보들은 애플리케이션 소스 코드 내부나, 빌드 아티팩트에 포함되어서는 안 된다. L3 애플리케이션에 대해서는, 반드시 HSM과 같은 하드웨어 기반 솔루션을 사용해야 한다.FalseTrue✓True✓V13.3.22비밀 정보 자원들에 대한 접근이 최소 권한의 원칙을 고수하는지 검증한다.FalseTrue✓True✓V13.3.33보안 모듈에 대한 외부의 노출로부터 안전하게 키 재료를 관리하고 보호하기 위해 모든 암호 연산이 고립된 보안 모듈(볼트나, 하드웨어 보안 모듈 등)을 사용하여 수행되는지 검증한다.FalseFalseTrue✓V13.3.44애플리케이션의 문서를 기반으로 비밀 정보들이 만료되고 갱신되도록 설정되었는지 검증한다.FalseFalseTrue✓V13.44의도하지 않은 정보 노출V13.4.11애플리케이션이 .git 이나 .svn 폴더 같은 소스 코드 관리 메타데이터 없이 배포되었는지, 또는 이 폴더들이 외부적으로든 애플리케이션 자체에서든 접근할 수 없도록 배포되었는지 검증한다. True✓True✓True✓V13.4.22실제 운영환경에서 디버깅 기능 노출이나 정보 누출을 방지하기 위해, 모든 컴포넌트에서 디버그 모드가 비활성화되어 있는지 검증한다.FalseTrue✓True✓V13.4.33분명히 의도된 것이 아닌 이상 웹 서버가 폴더 목록을 클라이언트에게 노출하지 않는지 검증한다.FalseTrue✓True✓V13.4.44잠재적인 정보 누출을 방지하기 위해 실제 운영환경에서 HTTP TRACE 메소드 사용이 지원되지 않는지 검증한다. FalseTrue✓True✓V13.4.55분명히 의도된 것이 아닌 이상 문서(내부 API 같은)와 모니터링 엔드포인트가 노출되지 않는지 검증한다.FalseTrue✓True✓V13.4.66애플리케이션이 백엔드 컴포넌트의 자세한 버전 정보를 노출하지 않는지 검증한다.FalseFalseTrue✓V13.4.77웹 계층이 의도적이지 않은 정보, 설정, 소스코드 누출을 방지하기 위해 특정 파일 확장자만 서비스하도록 설정되었는지 검증한다.FalseFalseTrue✓V1414Data데이터 보호V14.11데이터 보호 문서화V14.1.11애플리케이션이 생성하고 처리하는 모든 민감한 데이터가 식별되고 보호 수준으로 분류되었는지 확인한다. 여기에는 단순히 인코딩되어 있고 쉽게 디코딩할 수 있는 데이터, 예를 들어 Base64 문자열이나 JWT 내부 평문 페이로드가 포함된다. 보호 수준은 애플리케이션이 준수해야 하는 모든 데이터 보호 및 개인정보 보호 관련 규정과 표준을 반드시 고려해야 한다.FalseTrue✓True✓V14.1.22모든 민감한 데이터의 보호 수준에 대해 문서화된 요구사항이 있는지 확인한다. 반드시 여기에는(이에 한정되지 않지만) 일반적인 암호화, 무결성 검증, 보존 기간, 데이터 로그 기록 방식, 로그 내 민감한 데이터에 대한 접근 제어, 데이터베이스 암호화 수준, 사용할 개인정보 보호 및 개인정보 보호 강화 기술, 그리고 기타 기밀성 요구사항들 관련하여 포함되어야 한다.FalseTrue✓True✓V14.22일반 데이터 보호V14.2.11민감한 데이터는 HTTP 메시지 본문이나 헤더 필드로만 서버에 전송되고, URL과 쿼리 문자열에는 API키나 세션토큰처럼 민감한 정보가 포함되지 않도록 검증한다.True✓True✓True✓V14.2.22서버 구성 요소에서 로드밸런서나 애플리케이션 캐시와 같은 민감한 데이터가 캐시되지 않게 하거나, 사용 후 해당 데이터를 안전하게 삭제하도록 검증한다.FalseTrue✓True✓V14.2.33정의된 민감한 데이터가 애플리케이션의 통제를 벗어난 곳에서 원치 않는 수집을 예방하기 위해 신뢰할 수 없는 대상(예: 사용자 추적기)에게 전송되지 않도록 검증한다.FalseTrue✓True✓V14.2.44암호화, 무결성 검증, 보존, 데이터 로그 기록 방식, 로그 내 민감한 데이터 접근 제어, 개인정보 보호 및 개인정보 보호 강화 기술과 관련된 민감한 데이터 통제가, 해당 데이터 보호 수준에 대한 문서에 정의된 대로 구현되었는지 검증한다.FalseTrue✓True✓V14.2.55캐시 메커니즘이 해당 리소스에 대해 예상되는 콘텐츠 유형을 가진 응답만 캐시하고, 민감하거나 동적인 콘텐츠는 캐시하지 않도록 구성되어 있는지 검증한다. 존재하지 않는 파일에 접근했을 때 다른 유효한 파일을 반환하는 대신 웹 서버는 404 또는 302 응답을 반환해야 한다. 이는 Web Cache Deception 공격을 예방한다.FalseFalseTrue✓V14.2.66애플리케이션 기능에 필요한 최소한의 민감한 데이터만 반환을 검증한다. 예를 들어, 전체 신용카드 번호가 아닌 일부 숫자만 반환해야 한다. 만약 전체 데이터가 필요한 경우, 사용자가 구체적으로 조회하지 않는 한 사용자 인터페이스에서는 마스킹하는 것이 권장된다.FalseFalseTrue✓V14.2.77민감한 정보는 데이터 보존 분류 기준에 따라 관리되어야 하고, 오래되었거나 불필요한 데이터는 사전에 정의된 작업 또는 상황에 따라 자동으로 삭제되도록 검증한다.FalseFalseTrue✓V14.2.88사용자가 제출한 파일의 메타데이터에서 사용자가 저장에 동의하지 않는 한 민감한 정보는 제거를 검증한다.FalseFalseTrue✓V14.33클라이언트 측 데이터 보호V14.3.11클라이언트나 세션이 종료된 후에 브라우저 DOM과 같은 클라이언트 스토리지에서 인증된 데이터를 삭제되는지 검증한다. 이를 위해 ‘Clear-Site-Data’ HTTP 응답 헤더 필드를 사용할 수 있으나, 세션 종료 시 서버 연결이 불가능한 경우에도 클라이언트 측에서 해당 데이터를 삭제하는 것이 권장된다.True✓True✓True✓V14.3.22애플리케이션이 브라우저에서 민감한 데이터가 캐시되지 않도록, (Cache-Control: no-store)충분한 캐시 방지 HTTP 응답 헤더 필드를 설정을 검증한다.FalseTrue✓True✓V14.3.33브라우저 저장소(localStorage, sessionStorage, IndexedDB, 쿠키)에 저장되는 데이터에는 세션 토큰을 제외한 민감 데이터가 포함되지 않도록 검증한다.FalseTrue✓True✓V1515Secure보안 코딩 및 아키텍처V15.11보안 코딩 및 아키텍처 문서화V15.1.11애플리케이션 문서에 취약점이 존재하는 서드파티 구성요소 버전 및 일반적인 라이브러리 업데이트에 대해, 해당 구성요소로부터 발생할 수 있는 위험을 최소화하기 위한 위험 기반 대응 기한이 정의되어 있는지 확인해야 한다.True✓True✓True✓V15.1.22사용 중인 모든 서드파티 라이브러리에 대해 소프트웨어 자재 명세서(SBOM)와 같은 인벤토리가 유지되고 있으며, 해당 구성요소가 사전에 정의된 신뢰할 수 있고 지속적으로 관리되는 저장소에서 제공되는지 확인해야 한다.FalseTrue✓True✓V15.1.33애플리케이션 문서에 시간 소모가 크거나 리소스 소비가 많은 기능이 식별되어 있으며, 해당 기능의 과도한 사용으로 인해 가용성이 손실되지 않도록 하는 방법과, 응답 생성이 소비자의 타임아웃보다 오래 걸리는 상황을 방지하는 방법이 포함되어 있는지 확인해야 한다. 가능한 방어 전략에는 비동기 처리, 큐(queue) 사용, 사용자 및 애플리케이션 단위의 병렬 처리 제한 등이 있다.FalseTrue✓True✓V15.1.44애플리케이션 문서에 위험한 구성요소로 간주되는 서드파티 라이브러리가 강조되어 있는지 확인해야 한다.FalseFalseTrue✓V15.1.55애플리케이션 문서에 위험한 기능을 사용하는 애플리케이션의 부분이 강조되어 있는지 확인해야 한다.FalseFalseTrue✓V15.22보안 아키텍처 및 종속성V15.2.11애플리케이션이 문서화된 업데이트 및 대응 기한을 위반하지 않은 구성요소만 포함하고 있는지 확인해야 한다.True✓True✓True✓V15.2.22애플리케이션이 시간 소모가 크거나 리소스 소비가 많은 기능의 과도한 사용으로 인한 가용성 손실을 방지하기 위해, 해당 기능에 대한 문서화된 보안 결정 및 전략을 기반으로 방어 조치를 구현하고 있는지 확인해야 한다.FalseTrue✓True✓V15.2.33운영 환경에 애플리케이션 기능 수행에 필요한 기능만 포함되어 있으며, 테스트 코드, 샘플 코드, 개발용 기능 등 불필요한 기능이 노출되지 않도록 구성되어 있는지 확인해야 한다.FalseTrue✓True✓V15.2.44서드파티 구성요소 및 그 모든 전이 종속성(transitive dependencies)이 내부 또는 외부의 예상된 저장소에서 가져며, 의존성 혼동(dependency confusion) 공격의 위험이 없는지 확인해야 한다.FalseFalseTrue✓V15.2.55애플리케이션이 위험한 기능을 포함하거나 위험한 구성요소를 사용하는 부분에 대해 샌드박싱, 캡슐화, 컨테이너화, 네트워크 수준 격리와 같은 추가적인 보호 기법을 구현하여, 애플리케이션의 한 부분이 침해되더라도 공격자가 다른 영역으로 확산하지 못하도록 지연 및 차단하고 있는지 확인해야 한다.FalseFalseTrue✓V15.33방어적(Defensive) 코딩V15.3.11애플리케이션이 데이터 객체에서 필요한 필드만 선택적으로 반환하고 있는지 확인해야 한다. 예를 들어, 일부 필드는 사용자에게 노출되어서는 안 되므로 전체 데이터 객체를 반환해서는 안 된다.True✓True✓True✓V15.3.22애플리케이션 백엔드에서 외부 URL로 요청을 보낼 때, 의도된 기능이 아닌 경우 리디렉션을 따르지 않도록 구성되어 있는지 확인해야 한다.FalseTrue✓True✓V15.3.33애플리케이션이 각 컨트롤러 및 액션 단위로 허용된 필드를 제한함으로써, 대량 할당(mass assignment) 공격에 대한 방어가 구현되어 있는지 확인해야 한다. 예를 들어, 특정 동작에 포함되지 않은 필드 값을 삽입하거나 수정할 수 없어야 한다.FalseTrue✓True✓V15.3.44모든 프록시 및 미들웨어 구성요소가 사용자의 원래 IP 주소를 신뢰 가능한 데이터 필드를 통해 정확하게 전달하고 있으며, 애플리케이션과 웹 서버가 이 값을 로그 기록이나 속도 제한(rate limiting)과 같은 보안 결정에 사용하는지 확인해야 한다. 단, 동적 IP, VPN, 방화벽 등으로 인해 원래 IP조차 완전히 신뢰할 수 없는 점도 고려해야 한다.FalseTrue✓True✓V15.3.55애플리케이션이 변수의 타입이 올바른지 명시적으로 확인하고, 엄격한 동등성 비교 및 연산자를 사용하여 타입 혼용(type juggling) 또는 타입 혼동(type confusion)으로 인한 취약점을 방지하고 있는지 확인해야 한다.FalseTrue✓True✓V15.3.66JavaScript 코드가 프로토타입 오염(prototype pollution)을 방지할 수 있도록 작성되어 있는지 확인해야 한다. 예를 들어, 객체 리터럴 대신 `Set()` 또는 `Map()`을 사용하는 방식이 권장된다.FalseTrue✓True✓V15.3.77애플리케이션이 HTTP 파라미터 오염(HTTP parameter pollution) 공격에 대한 방어를 구현하고 있는지 확인해야 한다. 특히, 애플리케이션 프레임워크가 요청 파라미터의 출처(쿼리 스트링, 본문, 쿠키, 헤더)를 구분하지 않는 경우 이를 고려해야 한다.FalseTrue✓True✓V15.44안전한 동시성V15.4.11다중 스레드 코드에서 캐시, 파일, 다수 스레드가 접근하는 메모리 내 객체 등 공유 객체에 접근할 때, 스레드 세이프(thread-safe) 타입과 락·세마포어 같은 동기화 메커니즘을 사용하여 경쟁 상태와 데이터 손상을 피하고 안전하게 접근하는지 확인해야 한다.FalseFalseTrue✓V15.4.22리소스의 존재 여부나 권한과 같은 상태 검사와, 그 검사 결과에 의존하는 동작이 단일(atomic) 연산으로 수행되어 TOCTOU 경쟁 상태를 방지하는지 확인해야 한다. (예: 파일을 열기 전에 존재 여부를 확인하는 작업과 파일 열기 동작을 분리하지 않기, 접근 권한 검증과 권한 부여를 동일 트랜잭션/원자적 구간에서 수행하기)FalseFalseTrue✓V15.4.33스레드가 서로를 기다리거나 무한 재시도에 빠지지 않도록 일관된 락 사용을 보장하고, 락 관리 로직을 리소스 관리 책임 코드 내부에 유지하여 외부 클래스 및 코드가 우발적·악의적으로 락을 변경하지 못하도록 하는지 확인해야 한다.FalseFalseTrue✓V15.4.44**스레드 풀** 활용 등 **리소스 할당 정책**을 통해 공정한 리소스 접근을 보장하고, 우선순위가 낮은 스레드도 합리적 시간 내 진행될 수 있게 하여 **스레드 기아**를 방지하는지 확인해야 한다.FalseFalseTrue✓V1616Security보안 로깅과 오류 처리V16.11보안 로깅 문서화V16.1.11애플리케이션의 기술 스택의 각 계층에서 수행된 로깅에 대해, 어떤 이벤트들이 로그로 남았는지, 로그의 형식이 무엇인지, 로그가 어디에 저장되었는지, 어떻게 사용되는지, 로그에 대한 접근이 어떻게 제어되는지, 그리고 로그가 얼마나 보관되는지에 대해 문서화한 목록이 존재하는지 검증한다.FalseTrue✓True✓V16.22일반 로깅V16.2.11이벤트가 발생했을 때 그 타임라인을 자세히 조사할 수 있도록 각 로그의 항목이 필수적인 메타데이터(언제, 어디서, 누가, 무엇을 등)을 포함하는지 검증한다. FalseTrue✓True✓V16.2.22모든 로깅 컴포넌트의 시간 소스가 동기화되어 있는지, 그리고 보안 이벤트 메타데이터에서 타임스탬프가 UTC를 사용하거나 혹은 명시적인 시간대 오프셋을 포함하는지 검증한다. UTC는 분산 시스템 전체에 걸친 일관성을 보장하고, 일광 절약 시간제 전환 시의 혼란을 방지하기 위해 추천된다.FalseTrue✓True✓V16.2.33애플리케이션이 로그를 저장만 하는지, 혹은 로그 목록에서 문서화 된 파일이나 서비스로 브로드캐스트하는지 검증한다.FalseTrue✓True✓V16.2.44사용 중인 로그 처리기가 로그를 읽고, 또 상호 연관 지을 수 있는지 검증한다. 가능하다면 공통 로깅 형식을 사용하는 것이 좋다.FalseTrue✓True✓V16.2.55민감한 데이터를 로깅할때, 애플리케이션이 데이터의 보호 수준을 기반으로 로깅을 수행하는지 검증한다. 예를 들어, 자격 증명이나, 지불 상세 정보 등의 특정 데이터는 로깅 해서는 안 된다. 또한 세션 토큰 등의 데이터는 전체 혹은 일부분이 해싱된, 마스킹 된 상태로 로깅 되어야 한다.FalseTrue✓True✓V16.33보안 이벤트V16.3.11성공한 시도와 실패한 시도를 포함하여 모든 인증 명령을 로깅 하는지 검증한다. 인증의 종류나, 사용한 인증 요소 등의 추가적인 메타데이터 또한 수집해야 한다.FalseTrue✓True✓V16.3.22실패한 인가 시도들도 로깅 하는지 검증한다. L3에 대해서는 반드시 민감한 데이터가 접근되었을 때를 포함하여(민감한 데이터 자체는 제외하고) 모든 인가 결정들의 로그를 포함해야 한다.FalseTrue✓True✓V16.3.33애플리케이션이 이 문서에서 정의한 보안 이벤트들을 로깅하고, 또한 입력값 확인, 비즈니스 로직, 그리고 자동화 방지 등의 보안 제어를 우회하려는 시도들도 로깅 하는지 검증한다.FalseTrue✓True✓V16.3.44애플리케이션이 백엔드 TLS 오류와 같은 예상치 못한 오류나 보안 제어 오류들을 로깅 하는지 검증한다.FalseTrue✓True✓V16.44로그 보호V16.4.11로그 삽입을 방지하기 위해 모든 로깅 컴포넌트가 적절히 데이터를 인코딩하는지 검증한다.FalseTrue✓True✓V16.4.22로그가 비인가된 접근으로부터 보호되고 수정할 수 없는지 검증한다.FalseTrue✓True✓V16.4.33분석, 탐지, 경보, 그리고 에스컬레이션(escalation)을 위해 로그가 논리적으로 분리된 시스템으로 안전하게 전송되는지 검증한다. 애플리케이션이 침해되더라도 로그는 훼손하지 못하도록 보장하는 것이 목적이다.FalseTrue✓True✓V16.55오류 처리V16.5.11예상치 못한 혹은 보안 측면에서 민감한 오류가 발생했을 때 스택 흔적, 쿼리, 비밀키, 그리고 토큰 등의 민감한 내부 시스템 데이터의 노출 방지를 보장하기 위해 유저에게 구체화하지 않은 메시지를 반환하는지 검증한다.FalseTrue✓True✓V16.5.22외부 리소스 접근 오류가 발생하더라도 애플리케이션이 계속해서 안전하게 작동하는지 검증한다. 예를 들어 서킷 브레이커(circuit breaker)나 우아한 성능 저하와 같은 패턴을 사용할 수 있다.FalseTrue✓True✓V16.5.33예외가 발생할 때, 검증 로직의 오류에도 불구하고 거래를 처리하는 등의 페일-오픈(fail-open) 상태 방지를 포함하여 애플리케이션이 우아하고 안전하게 실패하는지 검증한다. FalseTrue✓True✓V16.5.44처리되지 못한 모든 예외를 처리할 “최후의 수단” 오류 핸들러가 정의되어 있는지 검증한다. 이는 로그 파일에 기록되어야 하는 오류 상세 정보들의 손실을 피하기 위함과 동시에, 오류로 인해 전체 애플리케이션 프로세스가 종료되어 가용성 손실로 이어지지 않도록 보장하기 위함이다. FalseFalseTrue✓V1717WebRTCWebRTCV17.11TURN 서버V17.1.11Traversal Using Relays around NAT(TURN) 서비스가 특정 목적을 위해 보존된 주소(예: 내부 네트워크, 브로드캐스트, 루프백)를 제외한 주소에 대해서만 접근을 허용하도록 한다.FalseTrue✓True✓V17.1.22Traversal Using Relays around NAT(TURN) 서비스가 정당한 사용자의 TURN 서버 포트의 대량 개방 시 자원고갈에 취약하지 않도록 한다.FalseFalseTrue✓V17.22미디어V17.2.11데이터그램 전송 계층 보안(DTLS) 인증서의 키가 암호화 키 관리에 대한 문서화된 정책에 따라 관리되고 보호되는지 확인해야 한다.FalseTrue✓True✓V17.2.22미디어 서버가 승인된 데이터그램 전송 계층 보안(DTLS) 암호 모음을 사용하고 지원하도록 구성되었는지, 그리고 보안 실시간 전송 프로토콜(DTLS-SRTP)을 위한 키 생성에 사용되는 DTLS 확장을 위한 안전한 보호 프로파일을 구성했는지 확인해야 한다.FalseTrue✓True✓V17.2.33미디어 서버에서 보안 실시간 전송 프로토콜(SRTP) 인증이 선택되어 있는지 확인한다. 이를 통해 실시간 전송 프로토콜(RTP) 삽입 공격으로 인한 서비스 거부 상태 발생 또는 오디오/비디오 미디어가 미디어 스트림에 삽입되는 것을 방지할 수 있다.FalseTrue✓True✓V17.2.44미디어 서버가 잘못된 형식의 보안 실시간 전송 프로토콜(SRTP) 패킷을 접했을 때도 수신 미디어 트래픽 처리를 계속할 수 있는지 확인해야 한다.FalseTrue✓True✓V17.2.55미디어 서버가 정상 사용자로부터의 보안 실시간 전송 프로토콜(SRTP) 패킷이 대량으로 유입되는 상황에서도 수신 미디어 트래픽 처리를 계속할 수 있는지 확인해야 한다.FalseFalseTrue✓V17.2.66미디어 서버가 Datagram Transport Layer Security(DTLS)의 “ClientHello” 경합 조건 취약점에 노출되지 않았는지 확인해야 한다. 이를 위해 해당 미디어 서버가 공개적으로 취약한 것으로 알려져 있는지 확인하거나 경합 조건 테스트를 수행해야 한다.FalseFalseTrue✓V17.2.77미디어 서버와 연결된 모든 오디오 또는 비디오 녹화 장치가 합법적인 사용자로부터의 보안 실시간 전송 프로토콜(SRTP) 패킷이 대량으로 유입되는 상황에서도 수신 미디어 트래픽 처리를 계속할 수 있는지 확인해야 한다.FalseFalseTrue✓V17.2.88데이터그램 전송 계층 보안(DTLS) 인증서가 세션 설명 프로토콜(SDP) 지문 속성과 대조되어 검증되었는지 확인하고, 검증이 실패할 경우 미디어 스트림을 종료하여 미디어 스트림의 진위성을 보장해야 한다.FalseFalseTrue✓V17.33신호 처리V17.3.11신호 서버가 플러드 공격 중에도 합법적인 수신 신호 메시지 처리를 계속할 수 있는지 확인해야 한다. 이는 신호 수준에서 속도 제한을 구현함으로써 달성되어야 한다.FalseTrue✓True✓V17.3.22서비스 거부 상태를 유발할 수 있는 잘못된 형식의 신호 메시지를 접했을 때 신호 서버가 정상적인 신호 메시지 처리를 계속할 수 있는지 확인해야 한다. 여기에는 입력 검증 구현, 정수 오버플로우 안전 처리, 버퍼 오버플로우 방지 및 기타 강력한 오류 처리 기법 적용이 포함될 수 있다.FalseTrue✓True✓ diff --git a/5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.xml b/5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.xml new file mode 100644 index 0000000000..63359d250f --- /dev/null +++ b/5.0/docs_ko/OWASP_Application_Security_Verification_Standard_5.0.0_ko.xml @@ -0,0 +1 @@ +Application Security Verification Standard ProjectASVS5.0.0The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.V11Encoding인코딩과 데이터 정제V1.11인코딩 및 데이터 정제 아키텍처V1.1.11입력값 검증은 오직 한 번만 표준 형태로 디코딩 되거나 언이스케이프 되어야 하며, 인코딩된 데이터가 예상될 때만 디코딩 되어야 한다. 이 과정은 입력이 추가로 처리되기 전에 완료되어야 한다. 예를 들어서 입력값 검증이나 데이터 정제 이후에는 수행되면 안 된다.2V1.1.22애플리케이션이 출력값 인코딩 또는 이스케이핑을 인터프리터가 사용하기 전의 최종 단계로 수행하거나 인터프리터 자체에서 처리하는지 검증해야 한다.2V1.22인젝션(Injection) 방지V1.2.11HTTP 응답, HTML 문서 또는 XML 문서에 대한 출력값 인코딩이 해당 컨텍스트에 적절한지 검증해야 한다. 예를 들어, 메시지나 문서 구조가 변경되지 않도록 HTML 요소, HTML 속성, HTML 주석, CSS, HTTP 헤더 필드 등에 맞는 문맥별 문자 인코딩이 수행되어야 한다.1V1.2.22통합 자원 식별자(Uniform Resource Locator; URL)들을 동적으로 생성할 때 신뢰할 수 없는 데이터가 해당 컨텍스트에 맞게 인코딩되었는지 검증해야 한다(예: 쿼리나 경로 파라미터에 대한 URL 인코딩 또는 base64url 인코딩). 또한, 오직 안전한 URL 프로토콜만이 허용되는지 검증해야 한다(예: javascript: 또는 data:를 허용하지 않음).1V1.2.33동적으로 자바스크립트 콘텐츠(JSON 포함)를 생성할 때 메시지나 문서 구조를 바꾸는 것을 방지하기 위해 출력값 인코딩이나 이스케이핑이 사용되고 있는지 검증해야 한다(자바스크립트 또는 JSON 인젝션을 피하기 위함).1V1.2.44데이터 선택 혹은 데이터베이스 쿼리(예: SQL, HQL, NoSQL, Cypher)들 파라미터화된 쿼리, 객체 관계 매핑(Object Relational Mapping; ORM), 엔티티 프레임워크, 또는 다른 구조화된 쿼리 언어(Structured Query Language; SQL) 인젝션 및 기타 데이터베이스 인젝션 공격으로부터 보호해 주는 것들을 사용하는지 검증해야 한다. 이는 저장 프로시저를 쓸 때도 마찬가지이다.1V1.2.55애플리케이션이 운영체제(Operating System; OS) 명령 인젝션으로부터 보호되며 운영체제 호출 시 파라미터화된 OS 쿼리나 상황에 맞는 명령줄 출력값 인코딩을 사용하는지 검증해야 한다.1V1.2.66애플리케이션이 경량 디렉터리 접근 프로토콜(Lightweight Directory Access Protocol; LDAP) 인젝션 취약점에 대해 보호되어 있는지, 또는 LDAP 인젝션을 방지하기 위한 특정 보안 통제가 구현되어 있는지 검증해야 한다.2V1.2.77애플리케이션이 XPath 인젝션 공격을 쿼리 파라미터나 미리 컴파일된 쿼리들을 사용해 보호되고 있는지 검증해야 한다.2V1.2.88LaTeX 프로세서가 안전하게 구성되어 있으며("--shell-escape" 플래그 비사용 등) LaTeX 인젝션 공격을 방지하기 위해 허용된 명령어 목록이 사용되고 있는지 검증해야 한다.2V1.2.99애플리케이션이 정규 표현식에서 특수 문자들을 메타 문자로 잘못 해석하는 것을 방지하기 위해 해당 문자들 이스케이프(보통 백슬래시를 사용)하고 있는지 검증해야 한다.2V1.2.1010애플리케이션이 쉼표 구분 데이터(Comma Separated Values; CSV) 및 수식 인젝션에 대해 보호되어 있는지 검증해야 한다. 그리고 애플리케이션은 CSV 콘텐츠를 내보낼 때 RFC 4180 2.6과 2.7 부분에 명시된 이스케이핑 규칙을 반드시 따라야 한다. 또한 CSV나 다른 스프레드시트 포맷(XLS, XLSX, ODF 등)으로 내보낼 때 필드 값의 첫 번째가 특수 문자('=', '+', '-', '@', '\t' (탭), '\0' (null 문자) 포함)라면 반드시 작은따옴표로 이스케이프되어야 한다.3V1.33데이터 정제V1.3.11위지윅(WYSIWYG) 에디터나 이와 유사한 것으로부터 오는 모든 신뢰할 수 없는 HTML 입력들은 잘 알려지고 안전한 HTML 데이터 정제 라이브러리나 프레임워크 기능을 사용해 정제되는지 검증해야 한다.1V1.3.22애플리케이션이 eval() 또는 스프링 표현 언어(Spring Expression Language; SpEL) 등과 같은 동적 코드 실행 기능 사용을 피하고 있는지 검증해야 한다. 대안이 없는 경우, 실행 전에 포함되는 모든 사용자 입력이 반드시 정제되어야 한다.1V1.3.33잠재적으로 위험한 컨텍스트에 전달되는 데이터가 사전에 정제되어 안전 조치가 적용되는지 검증해야 한다. 예를 들어 해당 컨텍스트에서 안전한 문자만 허용하고 너무 긴 입력값은 잘라내는 등의 조치가 포함된다.2V1.3.44사용자로부터 제공된 확장 가능한 벡터 그래픽(Scalable Vector Graphics; SVG)의 스크립트 실행 가능 콘텐츠가 애플리케이션에 안전한 태그 및 속성(예: 그래픽 그리기)만 포함하도록 검증 또는 정제되는지 검증해야 한다. 예를 들어 스크립트나 foreignObject는 포함되면 안 된다.2V1.3.55애플리케이션이 사용자로부터 제공된 스크립트 실행 가능하거나 표현식 템플릿 언어(예: 마크다운, CSS, XSL 스타일시트, BBCode ) 콘텐츠를 정제하거나 비활성화하는지 검증해야 한다.2V1.3.66애플리케이션이 서버측 요청 위조(Server-side Request Forgery; SSRF) 공격으로부터 보호하기 위해 신뢰할 수 없는 데이터를 프로토콜, 도메인, 경로, 포트의 허용 목록과 대조해 검증하고 다른 서비스를 호출하기 전에 잠재적으로 위험한 문자를 정제(sanitization)하는지 검증해야 한다.2V1.3.77애플리케이션이 템플릿 인젝션 공격으로부터 보호하기 위해 신뢰할 수 없는 입력값을 기반으로 템플릿을 생성하지 않도록 하는지 검증해야 한다. 대안이 없는 경우에는 템플릿 생성 과정에서 동적으로 포함되는 모든 신뢰할 수 없는 입력값은 정제되거나 엄격히 검증되어야 한다.2V1.3.88애플리케이션이 자바 명명 및 디렉터리 인터페이스(Java Naming and Directory Interface; JNDI) 쿼리에서 신뢰할 수 없는 입력값을 사용하기 전에 적절히 정제하고 JNDI가 JNDI 인젝션 공격을 방지할 수 있도록 안전하게 구성되어 있는지 검증해야 한다.2V1.3.99인젝션을 방지하기 위해 애플리케이션이 메모리 캐시(memcache)에 콘텐츠를 전달하기 전에 해당 데이터를 정제하는지 검증해야 한다. 2V1.3.1010사용 시 예상치 못하거나 악의적인 방식으로 작동할 수 있는 포맷 스트링(format string)들은 처리되기 전에 정제되는지 검증해야 한다.2V1.3.1111간이 전자 우편 전송 프로토콜(Simple Mail Transfer Protocol; SMTP)이나 인터넷 메시지 액세스 프로토콜(Internet Message Access Protocol; IMAP) 인젝션으로부터 보호하기 위해 애플리케이션이 사용자 입력을 메일 시스템으로 보내기 전에 정제를 하는지 검증해야 한다.2V1.3.1212정규 표현식에 지수형 백트래킹을 유발하는 요소가 없는지, 또한 신뢰할 수 없는 입력값을 정제하여 정규식 기반 서비스 거부 공격(Regular Expression Denial of Service; ReDoS) 또는 런어웨이(Runaway) 정규식 공격을 방지하는지 검증해야 한다.3V1.44메모리, 스트링, 비관리 코드V1.4.11애플리케이션이 스택, 버퍼, 또는 힙 오버플로를 탐지하거나 방지하기 위해 메모리 안전 문자열, 안전한 메모리 복사 및 포인터 산술을 사용하는지 검증해야 한다.2V1.4.22정수 오버플로를 방지하기 위해 부호 확인, 범위 검사, 입력값 검증 등의 기법이 사용되고 있는지 검증해야 한다.2V1.4.33댕글링 포인터(dangling pointer)나 해체 후 사용(Use After Free; UAF) 취약점을 방지하기 위해 동적으로 할당된 메모리와 자원이 적절히 해제되었는지 그리고 해제된 메모리를 참조하는 포인터나 참조가 제거되었거나 null로 설정되었는지를 검증해야 한다.2V1.55안전한 역직렬화V1.5.11애플리케이션이 확장 가능한 마크업 언어(eXtensible Markup Language; XML) 파서(parser)를 제한적인 설정으로 구성하고 외부 엔티티 해석과 같은 안전하지 않은 기능을 비활성화하여 XML 외부 엔티티(XML eXternal Entity; XXE) 공격을 방지하는지 검증해야 한다.1V1.5.22역직렬화 공격을 방지하기 위해 신뢰할 수 없는 데이터의 역직렬화 시 객체 타입 허용 목록 사용 또는 클라이언트 정의 객체 타입 제한과 같은 안전한 입력 처리 방식이 적용되는지 검증해야 한다. 또한 명확히 안전하지 않은 것으로 지정된 역직렬화 메커니즘은 신뢰할 수 없는 입력에 대해 반드시 사용해서는 안 된다.2V1.5.33애플리케이션에서 동일한 데이터 타입(예: JSON 파서, XML 파서, URL 파서)에 대해 사용되는 서로 다른 파서들이 일관된 방식으로 파싱(parsing)을 수행하고 동일한 문자 인코딩 방식을 사용하는지 검증해야 한다. 이를 통해 JSON 상호운용 취약점이나 원격 파일 포함(Remote File Inclusion; RFI) 및 SSRF 공격에서 악용될 수 있는 서로 다른 URI 또는 파일 파싱 동작 문제를 방지할 수 있다.3V22Validation유효성 검증 및 비즈니스 로직V2.11유효성 검증 및 비즈니스 로직 문서화V2.1.11애플리케이션 문서에 데이터 항목이 예상되는 구조에 부합하는지 확인하는 입력값 유효성 검증 규칙이 정의되어 있는지 확인한다. 이는 신용카드 번호, 이메일 주소, 전화번호와 같은 일반적인 데이터 형식일 수도 있고, 내부적으로 사용하는 데이터 형식일 수도 있다.1V2.1.22애플리케이션 문서에 연관된 데이터 항목들 간의 논리적, 문맥적 일관성을 검증하는 방법이 정의되어 있는지 검증한다. 예를 들어서 세부 주소와 우편번호가 서로 일치하는지 확인하는 경우가 이에 해당한다.2V2.1.33비즈니스 로직의 제한사항 및 유효성 검증에 대한 요구사항이 사용자별 기준과 애플리케이션 전체에 적용되는 전역적 기준을 모두 포함하여 문서화되어 있는지 검증한다.2V2.22입력값 검증V2.2.11입력값에 대한 비즈니스 또는 기능적인 기대치를 충족하기 위해서 입력값의 유효성을 검증해야 한다. 이는 허용 값, 패턴 및 범위 목록에 대한 긍정적 검증을 사용하거나, 미리 정의된 규칙에 따라 입력값을 예상 구조 및 논리적 한계와 비교하여 검증해야 한다. L1의 경우, 특정 비즈니스 또는 보안 결정을 내리는 데 초점을 맞출 수 있다. L2 이상의 경우에는 모든 입력값에 적용해야 한다.1V2.2.22애플리케이션이 신뢰할 수 있는 서비스 계층에서 입력값 유효성 검사를 시행하도록 설계되었는지 확인해야 한다. 클라이언트 측 유효성 검사는 사용성을 향상시키므로 권장해야 하지만, 보안 제어 수단으로 의존해서는 안된다.1V2.2.33사전 정의된 규칙에 따라 관련 데이터 항목의 조합이 합리적인지 애플리케이션에서 확인해야 한다.2V2.33비즈니스 로직 보안V2.3.11애플리케이션이 예상되는 순차적 단계 순서에 따라 동일한 사용자에 대한 비즈니스 로직 흐름만 처리하고 단계를 건너뛰지 않는지 확인한다.1V2.3.22비즈니스 로직 결함이 악용되는 것을 방지하기 위해서 애플리케이션 문서에 따라 비즈니스 로직 제한이 구현되었는지 확인한다.2V2.3.33비즈니스 로직 수준에서 트랜잭션이 사용되고 있는지 확인하여 비즈니스 로직 작업이 완전히 성공하거나 이전의 올바른 상태로 롤백되는지 확인한다.2V2.3.44제한된 양의 리소스(ex. 극장 좌석이나 배송 시간대)가 애플리케이션의 로직을 조작하여 이중으로 예약되는 것을 방지하기 위해서 비즈니스 로직 수준 잠금 메커니즘이 사용되는지 확인한다.2V2.3.55핵심적인 비즈니스 로직 흐름에 무단 또는 우발적인 행위를 방지하기 위해서 다중 사용자 승인이 필요한지 확인해야 한다. 이는 거액 자금 이체, 계약 승인, 기밀 정보 접근, 제조 과정의 안전 무시 등이 포함될 수 있지만, 이에 국한되지는 않는다.3V2.44자동화 방지V2.4.11데이터 유출, 더미 데이터 생성, 할당량 소진, 속도 제한 위반, 서비스 거부(DoS), 핵심적인 리소스의 과다 사용으로 이어질 수 있는 애플리케이션 기능에 대한 과도한 호출을 방어하기 위해, 자동화 방지 제어 기능이 구현되어 있는지 검증한다.2V2.4.22비즈니스 로직의 각 단계가 실제 사람이 수행하는 데 필요한 현실적인 시간을 요구하여, 비정상적으로 빠른 속도의 트랜잭션 제출을 방지하는지 검증한다.3V33Web웹 프론트엔드 보안V3.11웹 프론트엔드 보안 문서V3.1.11애플리케이션 공식 문서에서 애플리케이션이 반드시 지원해야 하는, 예상되는 보안 특징들을 서술하고 있는지 확인한다. (예: HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP), 그리고 다른 관련된 HTTP 보안 메커니즘들). 또한 문서에서 앞선 특징들(유저에게나 경고하거나 접속을 막는 등의)이 유효하지 않을 때 애플리케이션이 어떻게 행동하는지 반드시 정의해야 한다.3V3.22의도하지 않은 콘텐츠 접근V3.2.11브라우저가 HTTP 응답에 대해 콘텐츠나 기능을 불러올 때, 의도하지 않은 상황이 보안적으로 통제되고 있는지 확인한다(예: API, 유저가 올린 파일, 혹은 다른 리소스에 직접 접근 시). Content-Security-Policy 헤더 필드의 샌드박스 지시어를 사용하거나, Content-Disposition 헤더 필드 내의 attachment disposition 타입을 사용하는 등으로, 불필요한 HTTP 요청 헤더 필드 (Sec-Fetch-* 와 같은)를 제공하지 않을 수 있다.1V3.2.22콘텐츠가 HTML로 렌더링되지 않고 텍스트로 표시되도록 하여, HTML이나 JavaScript 등의 의도하지 않은 실행을 방지하는 안전한 렌더링 함수(예: createTextNode, textContent)를 사용하는지 확인한다.1V3.2.33애플리케이션이 클라이언트 사이드 JavaScript를 사용할 때, 명시적 변수 사용, 엄격한 타입 검사, 문서에서의 전역 변수 저장 지양, 그리고 네임스페이스 격리 구현 등으로 DOM 클로버링을 막고 있음을 확인한다.3V3.33쿠키 설정V3.3.11쿠키가 'Secure' 속성을 가지며, 쿠키 이름에 '\__Host-' 접두사가 사용되지 않았고, '__Secure-' 접두사를 사용했는지 확인한다.1V3.3.22UI redress 공격, 그리고 CSRF라 알려진 브라우저 기반 요청 위조 공격들에 대한 노출을 제한하기 위해 각 쿠키의 'SameSite' 속성 값이 쿠키의 목적에 맞게 설정되어 있는지 확인한다.2V3.3.33다른 호스트들과 명시적으로 공유되는 쿠키에 대해서, '__Host-' 접두사를 가지고 있는지 확인한다.2V3.3.44클라이언트 측 스크립트에서 쿠키의 값에 접근이 가능한 걸 의도하지 않았다면(세션 토큰 등), 쿠키는 반드시 'HttpOnly' 속성을 가져야 하고, 반드시 'Set-Cookie' 헤더 필드를 통해 클라이언트에게 전달돼야 한다.2V3.3.55애플리케이션이 쿠키를 만들 때, 쿠키 이름과 값의 길이 합이 4096바이트를 넘지 않는지 확인한다. 너무 큰 쿠키는 브라우저에 저장되지 않으며, 요청 전달도 안되고, 해당 쿠키에 의존하는 애플리케이션 기능을 사용하지 못하게 된다.3V3.44브라우저 보안 메커니즘 헤더V3.4.11이 섹션에서는 애플리케이션의 응답을 처리할 때 브라우저의 보안 기능과, 제한 사항을 활성화하기 위해 HTTP 응답에 설정해야 하는 보안 헤더를 설명한다.1V3.4.22교차 출처 리소스 공유(CORS)의 Access-Control-Allow-Origin 헤더 필드가 애플리케이션의 고정 값인지 확인한다. 만약 출처 Origin HTTP 요청 헤더 필드 값을 사용하고 있다면, 신뢰할 수 있는 출처 목록으로 검증한다. 'Access-Control-Allow-Origin: *' 사용이 필요할 때엔, 응답이 민감한 정보를 포함하지 않는지 확인한다.1V3.4.33HTTP 응답이 Content-Security-Policy 응답 헤더 필드를 가지고 있는지 확인한다. 이는 브라우저가 신뢰하는 콘텐츠나 리소스만 불러오고 실행하도록 하고, 위험한 JavaScript의 실행을 제한한다. 최소한, object-src 'none' 과 base-uri 'none'이라는 지침, 그리고 허용 목록을 정의하거나 논스, 해쉬의 사용을 포함한다는 전역 정책은 반드시 사용돼야 한다. 3계층 애플리케이션의 경우에는, 논스나 해쉬가 적용된 응답별 정책이 반드시 정의돼야 한다.2V3.4.44모든 HTTP 응답이 'X-Content-Type-Options: nosniff' 헤더 필드를 포함하는지 확인해야 한다. 이는 브라우저들이 주어진 응답에 대해 콘텐츠 스니핑과 MIME 타입 추측을 하지 않도록, 응답의 Content-Type 헤더 필드 값을 목적지 리소스와 일치하도록 지시한다. 예를 들어서, 응답의 Content-Type이 'text/css'인 스타일만 허용된다고 치자. 이는 기능적으로 브라우저의 Cross-Origin Read Blocking (CORB) 사용 또한 활성화시킨다.2V3.4.55'Referer' HTTP 요청 헤더 필드를 통해 제 3자 서비스들에 기술적으로 민감한 정보 누출을 막기 위해, 애플리케이션에서 리퍼러 정책을 설정했는지 확인해야 한다. 이는 Referrer-Policy HTTP 응답 헤더 필드나 HTML 속성 항목을 통해 설정할 수 있다. 민감한 데이터는 URL에 있는 경로나 쿼리 데이터, 그리고 내부 비공개 애플리케이션의 경우 hostname도 포함된다.2V3.4.66웹 애플리케이션이 Content-Security-Policy 헤더 필드의 frame-ancestors를 사용해 모든 HTTP 응답들에 대해 기본적으로 내부 삽입을 할 수 없고, 필요할 때만 특정 리소스에 대해 내부 삽입을 허용하도록 확인한다. X-Frame-Options 헤더 필드가 브라우저에서 지원되더라도, 오래돼서 신뢰할 수 없음을 알아야 한다.2V3.4.77Content-Security-Policy 헤더 필드에 위반 사항을 보고할 영역이 특정되어 있는지 확인해야 한다.3V3.4.88문서 렌더링을 시작하는 모든 HTTP 요청(Content-Type text/html과 같은 응답)에 same-origin 지시어나 same-origin-allow-popups이 있는 Cross‑Origin‑Opener‑Policy 헤더 필드를 포함하는지 확인해야 한다. 이는 탭내빙(tabnabbing) 및 프레임 카운팅과 같은 Window 객체에 대한 공유 액세스를 악용하는 공격을 방지할 수 있다.3V3.55브라우저 출처 구분V3.5.11애플리케이션이 허용되지 않은 교차 출처 요청을 통한 민감한 기능의 사용을 막기 위해 CORS preflight 메커니즘에 의존하지 않는지 확인하고, 이런 요청이 애플리케이션 자체에서 시작된건지 증명해야 한다. 이는 anti-forgery 토큰의 사용과 증명이나 CORS-safelisted 요청 헤더 필드가 아닌 확장 HTTP 헤더 필드를 요구하는 것으로 가능하다. 사이트 간 요청 위조 공격(CSRF)으로 알려진 브라우저 기반의 요청 위조 공격에 대한 방어다.1V3.5.22애플리케이션이 민감한 기능의 허용되지 않은 교차 출처 사용을 막기 위해 CORS preflight 메커니즘에 의존하고 있다면, CORS preflight 요청을 작동하지 않는 요청을 호출할 수 있는지 확인해야 한다. 이는 'Origin'과 'Content-Type' 요청 헤더 필드 값을 확인하거나 CORS-safelisted 헤더 필드가 아닌 확장 필드 사용에 대한 확인이 필요하다.1V3.5.33민감한 기능이 HTTP 요청으로 POST, PUT, PATCH, DELETE와 같은 적절한 HTTP 방식을 사용하는지, HEAD, OPTIONS, 또는 GET처럼 HTTP 사양이 "안전"으로 정의되지 않는 방식을 사용하는지 확인한다. 또는 Sec-Fetch-* 요청 헤더 필드의 엄격한 검증을 사용하여 요청이 부적절한 교차 출처 호출, 탐색 요청 또는 이미지 소스와 같은 리소스 로드에서 발생하지 않았는지 확인할 수 있다.1V3.5.44서로 다른 호스트 이름에 별도의 애플리케이션이 호스팅되어 있는지 확인하여 동일한 출처 정책에서 제공하는 제한 사항을 활용한다. 여기에는 한 출처에서 불러온 문서나 스크립트가 다른 출처의 리소스와 상호 작용할 수 있는 방법과 쿠키에서의 호스트 이름 기반 제한 사항이 포함된다.2V3.5.55postMessage 인터페이스를 통해 수신한 메시지의 출처를 신뢰할 수 없거나, 구문이 유효하지 않은 경우, 수신한 메시지가 폐기되는지 확인한다.2V3.5.66Cross-Site Script Inclusion (XSSI) 공격을 피하기 위해, 애플리케이션 아무 곳에서나 JSONP 기능이 활성화되지 않는지 확인한다.3V3.5.77Cross-Site Script Inclusion (XSSI) 공격을 방지하기 위해 JavaScript 파일과 같은 스크립트 리소스 응답에 승인이 필요한 데이터가 포함되지 않았는지 확인한다.3V3.5.88인증된 리소스(예: 이미지, 비디오, 스크립트 및 기타 문서)가 의도된 경우에만 사용자를 대신하여 불러와지거나 내장될 수 있는지 확인한다. 이는 Sec-Fetch-* HTTP 요청 헤더 필드를 엄격하게 검증하여 요청이 부적절한 교차 출처 호출에서 발생하지 않았는지 확인하거나 브라우저에 반환된 콘텐츠를 차단하도록 지시하는 제한적인 교차 출처 리소스 정책 HTTP 응답 헤더 필드를 설정하여 달성할 수 있다.3V3.66외부 리소스 무결성V3.6.11클라이언트 측 자산(예: JavaScript 라이브러리, CSS 또는 웹 폰트)이 정적이고 버전이 지정된 경우에만 외부(예: 콘텐츠 전송 네트워크)로만 호스팅되는지 확인하고, 하위 리소스 무결성(SRI)을 사용하여 자산의 무결성을 검증한다. 이것이 불가능하다면 각 리소스에 대해 이를 정당화하기 위해 문서화된 보안 결정이 필요하다.3V3.77다른 브라우저 보안 고려사항V3.7.11애플리케이션이 여전히 지원되고 안전하다고 간주되는 클라이언트 측 기술만 사용하는지 확인한다. 이 요구 사항을 충족하지 않는 기술의 예로는 NSAPI 플러그인, Flash, Shockwave, ActiveX, Silverlight, NACL 또는 클라이언트 측 Java applets가 있다.2V3.7.22애플리케이션이 사용자를 통제하지 못하는 다른 호스트 이름이나 도메인으로 자동으로 리다이렉션할 때, 허용된 목적지로만 리다이렉션 하는지 확인한다.2V3.7.33사용자가 애플리케이션의 통제 범위를 벗어난 URL로 리다이렉션 될 때 이를 취소할 수 있는 옵션이 있는 알림이 애플리케이션에 표시되는지 확인한다.3V3.7.44애플리케이션의 최상위 도메인(예: site.tld)가 공공 HSTS preload 목록에 추가되었는지 확인한다. 이렇게 하면 애플리케이션에 TLS를 사용하는 것이 Strict-Transport-Security 응답 헤더 필드에만 의존하지 않고 메인 브라우저에 직접 내장된다.3V3.7.55애플리케이션에 접근하는 브라우저가 예상한 보안 특징을 가지고 있지 않은 경우, 애플리케이션이 문서에 명시된 대로 동작하는지 확인한다 (유저에게 경고하거나 접근을 차단하는 등).3V44APIAPI 와 WEB 서비스V4.11일반적인 웹 서비스 보안V4.1.11메세지 본문이 포함된 모든 HTTP 응답에는 실제 내용과 일치하는 Content-Type 헤더 필드가 포함되어 있는지 검증한다. 이때 IANA 미디어 타입(text, /+xml, /xml 등)에 따라 안전한 문자 인코딩 (ex. UTF-8, ISO-8859-1)을 지정하는 charset 파라미터도 포함되어야 한다.1V4.1.22사용자가 대면하는 엔드포인트(사람이 직접 웹 브라우저에 접속하는 경우)만 HTTP에서 HTTPS로 자동 리디렉션하고, 그 외에 서비스나 API 엔드포인트는 명백한 리디렉션을 구현하지 않았는지 검증한다. 이는 클라이언트가 실수로 암호화되지 않은 HTTP 요청을 보내고 있음에도, 요청이 자동으로 HTTPS로 리디렉션되어 민감한 데이터의 유출 사실을 발견하지 못하게 되는 상황을 방지하기 위함이다.2V4.1.33로드 밸런서, 웹 프록시, 백엔드-프론트엔드 서비스 등 중간 계층에서 설정되며, 애플리케이션에서 사용하는 모든 HTTP 헤더 필드를 사용자가 재정의할 수 없는지 확인한다. 예를 들어 X-Real-IP, X-Frowarded-*, X-User-ID 등의 헤더가 포함될 수 있다.2V4.1.44애플리케이션이나 API에서 명시적으로 지원하는 HTTP 메서드(프리플라이트 요청 시에 OPTIONS 포함)만 사용할 수 있으며, 사용되지 않는 메서드는 차단되어 있는지 확인한다.3V4.1.55매우 민감하거나 여러 시스템을 거치는 요청이나 거래에 대한 전송 계층 보호에 더하여 메세지별 디지털 서명들을 사용함으로써 추가적인 보증을 제공하는지 확인한다.3V4.22HTTP 메세지 구조 검증V4.2.11모든 애플리케이션 구성 요소(로드 밸런서, 방화벽, 애플리케이션 서버 포함)가 HTTP 요청 smuggling을 예방하는 HTTP 버전의 적합한 메커니즘을 사용하는지에 대해, 수신되는 HTTP 메세지의 끝을 결정하는지 확인한다. HTTP/1.x에서 Transfer-encoding 헤더 필드가 있는 경우에 RFC 2616에 따라서 Content-Length 헤더는 무시해야 한다. HTTP/2 또는 HTTP/3를 사용할 때 Content-Length 헤더 필드가 있는 경우에 수신기는 DATA 프레임의 길이와 일치하는지 확인해야 한다.2V4.2.22HTTP 메세지를 생성할 때, 요청 smuggling 공격을 예방하기 위해서 HTTP 프로토콜의 프레이밍 방식에 의해 결정된 Content의 길이와 Content-Length 헤더 필드가 충돌하지 않는지 확인한다. 3V4.2.33응답 분할 및 헤더 인젝션 공격을 예방하기 위해서 애플리케이션이 Transfer-encoding과 같은 connection-specific 헤더 필드를 가진 HTTP/2또는 HTTP/3 메세지를 전송하거나 수락하지 않는지 확인한다.3V4.2.44헤더 인젝션 공격을 예방하기 위해서, 애플리케이션이 헤더 이름과 값에 CR(\r), LF(\n), CRLF(\r\n)과 같은 줄바꿈 문자가 포함되어 있지 않은 HTTP/2 및 HTTP/3 요청만 허용하는지 확인한다.3V4.2.55애플리케이션(백엔드 또는 프론트엔드)이 요청을 빌드하고 전송하는 경우, 수신 구성 요소가 수학하기에는 너무 긴 URI(ex. API 호출) 또는 HTTP 요청 헤더 필드(ex. Authorization 또는 Cookie)를 생성하지 않도록 검증, 검열 또는 기타 메커니즘을 사용하는지 확인한다. 이로 인해서 지나치게 긴 요청(ex. 긴 쿠키 헤더 필드)을 보낼 때와 같이 서비스 거부가 발생하여 서버가 항상 오류 상태로 응답할 수 있다.3V4.33GraphQLV4.3.11쿼리 허용 목록, 깊이 제한, 양 제한 또는 쿼리 비용 분석을 사용하여 값비싼 중첩 쿼리로 인해 GraphQL 또는 데이터 계층 표현식 거부(DOS)를 방지하는지 확인한다.2V4.3.22GraphQL API가 다른 사용자에 의해 사용되지 않는 한, 운영 환경에서 GraphQL 점검 쿼리들이 비비활성화되어 있는지 확인한다.2V4.44WebSocketV4.4.11모든 WebSocket 연결에 WebSocket over TLS(WSS)이 사용되는지 확인한다.1V4.4.22초기 HTTP WebSocket Handshake 중에 기존 헤더 필드가 애플리케이션에 허용된 기존 목록과 대조되는지 확인한다.2V4.4.33애플리케이션의 표준 세션 관리를 사용할 수 없는 경우, 관련 세션 관리 보안 요구 사항을 준수하는 전용 토큰이 사용되고 있는지 확인한다.2V4.4.44기존 HTTPS 세션을 WebSocket 채널로 전환할 때 이전에 인증된 HTTPS 세션을 통해 전용 WebSocket 세션 관리 토큰을 처음 얻거나 검증하는지 확인한다.2V55File파일 처리V5.11파일 처리 문서화V5.1.11업로드 기능별로 허용되는 파일 형식, 예상되는 파일 확장자, 그리고 최대 크기(압축 해제된 크기 포함)가 문서에 정의되어 있는지 검증해야 한다. 또한, 악성 파일이 탐지될 때 애플리케이션이 어떻게 동작하는지와 같이, 최종 사용자가 파일을 안전하게 다운로드하고 처리할 수 있도록 하는 방법이 문서에 명시되어 있는지 확인해야 한다.2V5.22파일 업로드 및 콘텐츠V5.2.11애플리케이션이 성능 저하나 서비스 거부 공격(Denial of Service; DoS)을 유발하지 않고 처리할 수 있는 크기의 파일만 허용하는지 검증해야 한다.1V5.2.22애플리케이션이 파일 자체 또는 zip 파일과 같은 아카이브 내에서 파일을 허용할 때, 파일 확장자가 예상 파일 확장자와 일치하는지 확인하고 내용이 확장자로 표현된 유형과 일치하는지 확인하는지 검증해야 한다. 여기에는 초기 '매직 바이트(magic bytes)' 확인, 이미지 재작성 수행, 파일 내용 유효성 검사를 위한 전문 라이브러리 사용이 포함되지만 이에 국한되지 않는다. L1의 경우, 특정 비즈니스 또는 보안 결정을 내리는 데 사용되는 파일에만 집중할 수 있다. L2 이상에서는 허용되는 모든 파일에 적용되어야 한다1V5.2.33애플리케이션이 압축 파일(예: zip, gz, docx, odt)을 압축 해제하기 전에 허용되는 최대 압축 해제 크기와 최대 파일 수를 확인하는지 검증해야 한다.2V5.2.44단일 사용자가 너무 많은 파일이나 과도하게 큰 파일로 저장 공간을 채우지 않도록 사용자별 파일 크기 할당량(quota) 및 최대 파일 수가 적용되는지 검증해야 한다.3V5.2.55애플리케이션이 심볼릭 링크(symlink)를 포함하는 압축 파일 업로드를 허용하지 않는지 검증해야 한다. 단, 이러한 기능이 특별히 요구되는 경우에는 심볼릭 링크할 수 있는 파일의 허용 목록(allowlist)을 강제하는 것이 필요하다.3V5.2.66픽셀 플러드 공격(Pixel Flood Attack)을 방지하기 위해, 애플리케이션이 업로드된 이미지의 픽셀 크기가 허용된 최대값보다 큰 경우 해당 이미지를 거부하는지 검증해야 한다.3V5.33파일 저장V5.3.11신뢰할 수 없는 입력으로 업로드되거나 생성되어 공개 폴더에 저장된 파일이 HTTP 요청으로 직접 접근될 때 서버 측 프로그램 코드로 실행되지 않는지 검증해야 한다.1V5.3.22애플리케이션이 파일 작업을 위한 파일 경로를 생성할 때, 사용자 제출 파일명 대신 내부적으로 생성되거나 신뢰할 수 있는 데이터를 사용하는지 검증해야 한다. 만약 사용자 제출 파일명 또는 파일 메타데이터를 반드시 사용해야 한다면, 경로 탐색(path traversal), 로컬 또는 원격 파일 포함(Local File Inclusion; LFI, Remote File Inclusion; RFI), 그리고 서버 측 요청 위조(Server-side Request Forgery; SSRF) 공격으로부터 보호하기 위해 엄격한 유효성 검사 및 정제(Sanitization)가 적용되는지 확인해야 한다.1V5.3.33파일 압축 해제와 같은 서버 측 파일 처리가 zip slip과 같은 취약점을 방지하기 위해 사용자 제공 경로 정보를 무시하는지 검증해야 한다.3V5.44파일 다운로드V5.4.11애플리케이션이 JSON, JSONP 또는 URL 파라미터를 포함한 사용자 제출 파일명을 검증하거나 무시하는지 검증해야 하고, 응답의 Content-Disposition 헤더 필드에 파일명을 명시하는지 검증해야 한다.2V5.4.22제공되는 파일 이름(예: HTTP 응답 헤더 필드 또는 이메일 첨부 파일)이 문서 구조를 보존하고 삽입 공격(Injection Attack)을 방지하기 위해 인코딩되거나 정제되는지 검증해야 한다. (예: RFC 6266 준수)2V5.4.33신뢰할 수 없는 소스에서 얻은 파일이 알려진 악성 콘텐츠 제공을 방지하기 위해 안티바이러스 스캐너에 의해 검사되는지 검증해야 한다.2V66Authentication인증V6.11Authentication DocumentationV6.1.11인증 문서가 크리덴셜 스터핑, 비밀번호 무차별 대입 공격 등을 방어하기 위해 속도 제한, 자동화 방지, 적응형 응답(adaptive response)과 같은 제어가 어떻게 사용되는지를 정의한다. 또한, 이러한 제어가 어떻게 구성되는지와 악의적으로 계정을 잠그는 것을 방지하는 방법을 명확히 하는지 검증한다.1V6.1.22조직명, 제품명, 시스템 식별자, 프로젝트 코드명, 부서명 또는 역할명 등 문맥적으로 특정된 단어의 변형을 포함하여, 비밀번호에 사용되지 않도록 문서화된 단어 목록이 있는지 검증한다.2V6.1.33애플리케이션이 여러 인증 경로를 포함하는 경우, 이들 모두가 문서화되어 있으며 각 경로에 대해 일관되게 적용되는 보안 제어와 인증 강도가 정의되어 있는지 검증한다.2V6.22비밀번호 보안V6.2.11사용자가 설정하는 비밀번호가 최소 8자 이상이어야 하며, 최소 15자 이상을 강력히 권장하는지 검증한다.1V6.2.22사용자가 비밀번호를 변경할 수 있는지 검증한다.1V6.2.33비밀번호 변경 기능이 사용자의 현재 비밀번호와 새 비밀번호를 요구하는지 검증한다.1V6.2.44계정 등록 또는 비밀번호 변경 시 제출된 비밀번호가 최소 3000개의 상위 비밀번호 목록과 비교 및 검사되는지, 이때 애플리케이션 비밀번호 정책(예: 최소 길이)을 만족하는지 검증한다.1V6.2.55비밀번호는 어떤 구성도 허용되며, 허용되는 문자 유형에 대한 제한이 없는지 검증한다. 대/소문자, 숫자, 특수문자에 대한 최소 개수 요구사항이 없어야 한다.1V6.2.66비밀번호 입력 필드가 type=password를 사용하여 입력을 마스킹하는지 검증한다. 애플리케이션은 사용자가 전체 비밀번호나 마지막 입력 문자를 일시적으로 볼 수 있도록 허용할 수 있다.1V6.2.77붙여넣기 기능, 브라우저 비밀번호 도우미, 외부 비밀번호 관리자의 사용이 허용되는지 검증한다.1V6.2.88애플리케이션이 비밀번호를 사용자로부터 수신한 그대로 검증하며, 대소문자 변경이나 잘림(truncation)과 같은 수정 없이 처리하는지 검증한다.1V6.2.99비밀번호가 최소 64자까지 허용되는지 검증한다.2V6.2.1010사용자의 비밀번호는 손상되었음이 발견되거나 사용자가 교체할 때까지 유효하며, 애플리케이션이 주기적인 자격 증명 교체를 요구하지 않는지 검증한다.2V6.2.1111문서화된 문맥별 단어 목록을 사용하여 추측하기 쉬운 비밀번호가 생성되지 않도록 하는지 검증한다.2V6.2.1212계정 등록 또는 비밀번호 변경 시 제출된 비밀번호가 유출된 비밀번호 집합과 비교 및 검사되는지 검증한다.2V6.33일반 인증 보안V6.3.11애플리케이션의 보안 문서에 따라 크리덴셜 스터핑 및 비밀번호 무차별 대입 공격을 방지하기 위한 제어가 구현되어 있는지 검증한다.1V6.3.22“root”, “admin”, “sa”와 같은 기본 사용자 계정이 애플리케이션에 존재하지 않거나 비활성화되어 있는지 검증한다.1V6.3.33애플리케이션 접근 시 반드시 MFA 또는 단일 요소 인증 메커니즘의 조합을 사용하는지 검증한다. L3의 경우, 인증을 수행하려는 사용자의 의도를 검증하기 위해 사용자가 직접 수행하는 동작(예: FIDO 하드웨어 키 또는 모바일 기기에서 버튼을 누르는 행위)을 요구함으로써, 피싱 공격에 대한 침해 및 위장 저항성을 제공하는 하드웨어 기반 인증 메커니즘이 반드시 하나의 요소로 포함되어야 한다. 이 요구사항에서 고려 사항을 완화하려는 경우, 완전히 문서화된 근거와 포괄적인 보완 통제가 반드시 수반되어야 한다.2V6.3.44여러 인증 경로가 존재하는 경우, 문서화되지 않은 경로가 없어야 하며 보안 제어와 인증 강도가 일관되게 적용되는지 검증한다.2V6.3.55사용자가 의심스러운 인증 시도에 대해 성공 여부와 관계 없이 알림을 제공받는지 검증한다. 여기에는 비정상적인 위치나 클라이언트에서의 인증 시도, 부분적으로만 성공한 인증(여러 요소 중 하나만 성공한 경우), 장기간 비활성 상태 이후의 인증 시도, 또는 여러 번의 인증 실패 후 성공한 인증이 포함될 수 있다.3V6.3.66이메일이 단일 또는 다중 요소 인증 메커니즘으로 사용되지 않는지 검증한다.3V6.3.77자격 증명 재설정, 사용자명/이메일 수정 등 인증 관련 정보 변경 이후 사용자에게 통지되는지 검증한다.3V6.3.88오류 메시지, HTTP 응답 코드, 응답 시간 차이 등을 통해 유효한 사용자를 유추할 수 없으며, 비밀번호 등록/찾기 기능에도 동일한 보호가 적용되는지 검증한다.3V6.44인증 요소 수명 주기 및 복구V6.4.11시스템이 생성하는 초기 비밀번호나 활성화 코드가 안전하게 난수로 생성되며, 기존 비밀번호 정책을 따르고, 짧은 기간 내 또는 최초 사용 시 만료되는지 검증한다. 초기 비밀번호는 장기 비밀번호로 허용되지 않아야 한다.1V6.4.22비밀번호 힌트나 지식 기반 인증(“비밀 질문”)이 존재하지 않는지 검증한다.1V6.4.33분실된 비밀번호에 대한 재설정 절차가 안전하게 구현되며, MFA를 우회하지 않는지 검증한다.2V6.4.44MFA 요소 분실 시, 등록 시와 동일 수준의 신원 증명이 수행되는지 검증한다.2V6.4.55만료 예정인 인증 메커니즘에 대한 갱신 안내가 충분한 시간 전에 발송되며, 필요한 경우 자동 알림이 구성되는지 검증한다3V6.4.66관리자가 사용자 비밀번호 재설정 절차를 시작할 수 있으나, 사용자의 비밀번호를 직접 변경하거나 지정할 수 없는지 검증한다. 이는 관리자가 사용자의 비밀번호를 알지 못하도록 한다.3V6.55General Multi-factor authentication requirementsV6.5.11조회 secret, 대역 외 인증 요청 및 코드, 시간 기반 일회용 비밀번호가 단 한 번만 성공적으로 사용 가능한지 검증한다.2V6.5.22애플리케이션 백엔드에 저장될 때, 엔트로피가 112비트 미만인 룩업 시크릿(예: 무작위 영숫자 19자 또는 무작위 숫자 34자)은 32비트 무작위 솔트(salt)를 포함하는 사전 승인된 비밀번호 저장용 해시 알고리즘으로 해시되는지 검증한다. 룩업 시크릿이 112비트 이상의 엔트로피를 가진 경우에는 표준 해시 함수를 사용할 수 있다.2V6.5.33룩업 시크릿, 대역 외 인증 코드, 그리고 시간 기반 일회용 비밀번호의 시드가 예측 가능한 값을 피하기 위해 암호학적으로 안전한 의사난수 생성기(CSPRNG)를 사용하여 생성되는지 검증한다. 2V6.5.44룩업 시크릿과 대역 외 인증 코드가 최소 20비트의 엔트로피를 가지는지 검증한다. 일반적으로 무작위 영숫자 4자 또는 무작위 숫자 6자가 충분하다.2V6.5.55대역 외 인증 요청, 코드 또는 토큰과 시간 기반 일회용 비밀번호가 정의된 수명을 가지는지 검증한다. 대역 외 요청의 최대 수명은 10분이어야 하며, TOTP의 최대 수명은 30초이어야 한다.2V6.5.66도난이나 기타 손실의 경우 모든 인증 요소(물리적 장치 포함)를 해지할 수 있는지 검증한다.3V6.5.77생체 인식 인증 메커니즘은 반드시 보조 요소로만 사용되어야 하며, “소유하고 있는 것” 또는 “알고 있는 것” 중 하나와 함께 사용되는지 검증한다.3V6.5.88시간 기반 일회용 비밀번호는 신뢰할 수 있는 서비스의 시간 소스를 기준으로 검증되어야 하며, 신뢰할 수 없거나 클라이언트에서 제공한 시간을 기반으로 해서는 안 된다.3V6.66대역 외(Out-of-Band) 인증 메커니즘V6.6.11공중 교환 전화망(PSTN)을 사용하여 전화나 SMS를 통해 일회용 비밀번호(OTPs)를 전달하는 인증 메커니즘은, 해당 전화번호가 사전에 검증되었을 때만 제공되어야 하며, 더 강력한 대체 방법(예: 시간 기반 일회용 비밀번호)도 제공되어야 하고, 서비스는 사용자에게 이러한 보안 위험에 대한 정보를 제공해야 한다. L3 애플리케이션의 경우, 전화와 SMS는 옵션으로 제공되어서는 안 된다.2V6.6.22대역 외 인증 요청, 코드 또는 토큰은 생성된 원래 인증 요청에만 바인딩되어야 하며, 이전이나 이후의 요청에는 사용할 수 없어야 한다.2V6.6.33코드 기반 대역 외 인증 메커니즘이 속도 제한 등을 통해 무차별 대입 공격으로부터 보호되는지 검증한다. 또한 최소 64비트 이상의 엔트로피를 가진 코드를 사용하는 것도 고려해야한다.2V6.6.44다중요소 인증에 푸시 알림이 사용되는 경우, 푸시 폭탄(push bombing) 공격을 방지하기 위해 속도 제한을 적용해야 한다. 또한 숫자 일치 기법 역시 이 위험을 완화할 수 있다.3V6.77암호학적 인증 메커니즘V6.7.11암호학적 인증 단언(assertion)을 검증하는 데 사용되는 인증서는 수정으로부터 보호되는 방식으로 저장되는지 검증한다.3V6.7.22챌린지 논스(nonce)는 최소 64비트 길이여야 하며, 통계적으로 고유하거나 해당 암호 장치의 수명 동안 고유해야 한다.3V6.88ID 제공자(IdP)를 통한 인증V6.8.11애플리케이션이 다중 ID 제공자(IdP)를 지원하는 경우, 사용자의 신원이 다른 지원 IdP를 통해 위조될 수 없는지 검증한다. (예: 동일한 사용자 식별자를 사용하는 방식). 표준적인 대응책은 애플리케이션이 IdP ID(네임스페이스 역할)와 IdP 내 사용자 ID의 조합을 사용하여 사용자를 등록하고 식별하는 것이다.2V6.8.22인증 단언(예: JWT 또는 SAML 단언)의 디지털 서명이 존재하고 무결성이 항상 유지되는지를 검증한다. 서명이 없거나 유효하지 않은 단언은 거부해야 한다.2V6.8.33SAML 단언이 재생 공격의 방지를 위해 고유하게 처리되는지, 유효 기간 내에 단 한 번만 사용되는지 검증한다.2V6.8.44애플리케이션이 별도의 ID 제공자(IdP)를 사용하고 특정 기능에 대해 특정 인증 강도, 방식, 또는 최근성을 요구하는 경우, 애플리케이션은 IdP가 반환한 정보를 사용하여 이를 검증해야 한다. 예를 들어, OIDC가 사용되는 경우, 이는 ‘acr’, ‘amr’, ‘auth_time’(존재하는 경우)과 같은 ID 토큰 클레임을 검증함으로써 달성할 수 있다. IdP가 이 정보를 제공하지 않는 경우, 애플리케이션은 최소 강도의 인증 메커니즘(예: 사용자 이름과 비밀번호를 사용하는 단일요소 인증)이 사용되었다고 가정하는 문서화된 대체 접근법을 가져야 한다.2V77Session세션 관리V7.11세션 관리 문서화V7.1.11사용자의 세션 비활성 시간 초과 및 절대 최대 세션 수명에 대한 문서가 존재하고, 다른 제어와의 조합에서 적절하며, NIST SP 800-63B 재인증 요구사항에서 벗어날 시 그 근거가 문서에 포함되어 있는지 검증한다.2V7.1.22문서가 하나의 계정에서 허용되는 동시(병렬) 세션 수와 활성 세션 수의 최대값에 도달했을 때의 의도된 동작과 수행할 조치를 정의하는지 검증한다.2V7.1.33통합 신원 관리 생태계(예: SSO 시스템)의 일부로 사용자 세션을 생성하고 관리하는 모든 시스템이 문서화되어 있으며, 세션 수명, 종료, 재인증이 필요한 기타 조건을 조율하기 위한 제어가 포함되어 있는지 검증한다.2V7.22기본 세션 관리 보안V7.2.11애플리케이션이 모든 세션 토큰 검증을 신뢰할 수 있는 백엔드 서비스에서 수행하는지 검증한다.1V7.2.22애플리케이션이 세션 관리를 위해 정적 API 시크릿이나 키가 아닌, 자체 포함 토큰 또는 참조 토큰을 동적으로 생성하여 사용하는지 검증한다.1V7.2.33참조 토큰이 사용자 세션을 나타내는 데 사용되는 경우, 그 토큰이 고유하고, 암호학적으로 안전한 의사난수 생성기(CSPRNG)를 사용해 생성되며 최소 128비트의 엔트로피를 갖는지 검증한다.1V7.2.44애플리케이션이 사용자 인증(재인증 포함) 시 새로운 세션 토큰을 생성하고 기존 세션 토큰을 종료하는지 검증한다.1V7.33세션 타임아웃V7.3.11위험 분석 및 문서화된 보안 결정에 따라 재인증을 강제하는 비활성 시간 초과가 존재하는지 검증한다.2V7.3.22위험 분석 및 문서화된 보안 결정에 따라 재인증을 강제하는 절대 최대 세션 수명이 존재하는지 검증한다.2V7.44세션 종료V7.4.11로그아웃이나 만료와 같이 세션 종료가 트리거될 때, 애플리케이션이 해당 세션의 추가 사용을 허용하지 않는지 검증한다. 참조 토큰 또는 상태 유지형 세션의 경우, 이는 애플리케이션 백엔드에서 세션 데이터를 무효화하는 것을 의미한다. 자체 포함 토큰을 사용하는 애플리케이션은 종료된 토큰 목록 유지, 사용자별 날짜·시간 이전에 발급된 토큰 거부, 사용자별 서명 키 회전과 같은 방법을 사용해야 한다.1V7.4.22사용자 계정이 비활성화되거나 삭제될 때(예: 직원 퇴사), 애플리케이션이 모든 활성 세션을 종료하는지 검증한다.1V7.4.33비밀번호 재설정·복구를 통한 변경, MFA 설정 변경 등 어떤 인증 요소라도 성공적으로 변경 또는 제거한 후, 모든 다른 활성 세션을 종료할 수 있는 옵션을 제공하는지 검증한다.2V7.4.44인증이 필요한 모든 페이지의 로그아웃 기능에 접근하는 것이 쉽고 잘 보이는지 검증한다.2V7.4.55애플리케이션 관리자가 개별 사용자 또는 모든 사용자의 활성 세션을 종료할 수 있는지 검증한다.2V7.55세션 악용 방어V7.5.11이메일 주소, 전화번호, MFA 구성, 계정 복구에 사용되는 기타 정보 등 인증에 영향을 줄 수 있는 민감한 계정 속성을 변경하기 전에 전체 재인증을 요구하는지 검증한다.2V7.5.22사용자가 현재 활성 세션을 전체 또는 일부 확인하고(최소 요소 한 개에 대한 인증을 다시 수행한 후) 종료할 수 있는지 검증한다.2V7.5.33매우 민감한 거래나 작업을 수행하기 전에 최소 한 요소 인증 또는 2차 검증을 요구하는지 검증한다.3V7.66페더레이션 재인증V7.6.11RP와 IdP 간 세션 수명과 종료가 문서대로 동작하며, IdP 인증 이벤트 간의 최대 시간이 도달하는 경우 등 필요한 시점에 재인증을 요구하는지 검증한다.2V7.6.22세션 생성 시 사용자 동의 또는 명시적 동작을 요구하여, 사용자 상호작용 없이 새로운 애플리케이션 세션이 생성되지 않도록 하는지 검증한다.2V88Authorization권한 부여V8.11권한 부여 문서화V8.1.11권한 부여 문서가 소비자 권한과 자원 속성에 따라 기능 수준 및 데이터별 접근을 제한하는 규칙을 정의하는지 검증한다.1V8.1.22권한 부여 문서가 소비자 권한과 자원 속성에 따라 필드 수준 접근 제한(읽기 및 쓰기 모두)을 정의하는지 검증한다. 이러한 규칙은 관련 데이터 객체의 상태(state)나 상태값(status)과 같은 다른 속성 값에 의존할 수 있다.2V8.1.33애플리케이션 문서가 인증 및 권한 부여와 관련된 보안 결정을 내리는 데 사용되는 환경적, 맥락적 속성(예: 시간대, 사용자 위치, IP 주소, 디바이스 등)을 정의하는지 검증한다.3V8.1.44인증 및 권한 부여 문서가 기능 수준, 데이터별, 필드 수준 권한 부여에 더해 환경적, 맥락적 요소가 의사 결정에 어떻게 사용되는지 정의하는지 검증한다. 여기에는 평가되는 속성, 위험 임계값, 수행되는 조치(예: 허용, 추가 인증 요청, 거부, 단계적 인증)을 포함하는 것을 권장한다.3V8.22일반 권한 부여 설계V8.2.11애플리케이션이 기능 수준의 접근을 명시적 권한이 있는 소비자에게만 허용하는지 검증한다.1V8.2.22애플리케이션이 특정 데이터 항목에 대한 명시적 권한이 있는 소비자에게만 데이터별 접근을 허용하여, 안전하지 않은 직접 객체 참조(IDOR) 및 객체 수준 권한 부여 취약점(BOLA)을 방지하는지 검증한다.1V8.2.33애플리케이션이 특정 필드에 대한 명시적 권한이 있는 소비자에게만 필드 수준 접근을 허용하여, 객체 속성 수준 권한 부여 취약점(BOPLA)을 방지하는지 검증한다.2V8.2.44애플리케이션 문서에서 정의한 바에 따라, 소비자의 환경적, 맥락적 속성(예: 시간대, 위치, IP 주소 또는 장치)에 기반한 적응형 보안 제어가 인증 및 권한 부여 결정에 구현되는지 검증한다. 이러한 제어는 소비자가 새 세션을 시작할 때뿐만 아니라 기존 세션 중에도 반드시 적용되어야 한다.3V8.33운영 수준 권한 부여V8.3.11애플리케이션이 권한 부여 규칙을 신뢰할 수 있는 서비스 계층에서 적용하고, 클라이언트 측 JavaScript처럼 신뢰할 수 없는 소비자가 조작할 수 있는 제어에 의존하지 않는지 검증한다.1V8.3.22권한 부여 결정에 영향을 미치는 값의 변경 사항이 즉시 적용되는지 검증한다. 자체 포함 토큰(self-contained token)과 같이 즉시 적용이 불가능한 경우, 소비자가 더 이상 권한이 없는 작업을 수행할 때 이를 알리고 변경을 되돌리는 완화 제어를 반드시 두어야 한다. 단, 이 방법은 정보 유출을 방지하지는 못한다.3V8.3.33객체에 대한 접근이, 대리인이나 이를 대신 수행하는 서비스의 권한이 아닌, 원래 주체(예: 소비자)의 권한에 기반하는지 검증한다. 예를 들어, 소비자가 인증을 위해 자체 포함 토큰을 사용하여 웹 서비스를 호출하고, 해당 서비스가 다른 서비스에 데이터를 요청하는 경우, 두 번째 서비스는 첫 번째 서비스의 머신-투-머신 토큰이 아니라 소비자의 토큰을 사용하여 권한 결정을 내려야 한다.3V8.44기타 권한 부여 고려사항V8.4.11다중 테넌트 애플리케이션이 교차 테넌트 제어를 사용하여, 소비자의 작업이 권한이 없는 다른 테넌트에 영향을 미치지 않도록 하는지 검증한다.2V8.4.22관리 인터페이스 접근이 연속적인 소비자 신원 검증, 장치 보안 상태 평가, 맥락 기반 위험 분석 등 복수의 보안 계층을 포함하는지 검증한다. 네트워크 위치나 신뢰된 엔드포인트가 무단 접근 가능성을 줄일 수는 있더라도, 단독으로 권한 부여 판단의 유일한 요소가 되어서는 안 된다.3V99Self자체 포함 토큰(self-contained token)V9.11토큰 출처 및 무결성V9.1.11자체 포함 토큰 내용을 허용하기 전에 변조를 방지하기 위해 디지털 서명 또는 메시지 인증 코드(MAC)를 사용하여 토큰의 무결성을 검증해야 한다.1V9.1.22주어진 컨텍스트에 대해 자체 포함 토큰을 생성하고 검증할 때, 허용 목록에 있는 알고리즘만 사용될 수 있는지 검증해야 한다. 허용 목록에는 사용 가능한 알고리즘을 모두 포함해야 하며, 이상적으로는 대칭 또는 비대칭 알고리즘 중 하나만을 포함해야 한다. 또한 'None' 알고리즘은 반드시 제외해야 한다. 대칭 및 비대칭 알고리즘 모두를 지원해야 하는 경우, 키 혼동을 방지하기 위해 추가 제어가 필요하다.1V9.1.33자체 포함 토큰을 검증하는 데 사용되는 키 자료가 토큰 발행자를 위한 신뢰할 수 있는 사전 구성된 출처에서 비롯되었는지 검증하여, 공격자가 신뢰할 수 없는 출처 및 키를 지정하는 것을 방지해야 한다. JWT 및 기타 JWS 구조의 경우, 'jku', 'x5u', 'jwk'와 같은 헤더는 신뢰할 수 있는 출처의 허용 목록에 대해 검증되어야 한다.1V9.22토큰 내용V9.2.11토큰 데이터에 유효 기간이 존재하는 경우, 검증 시간이 이 유효 기간 내에 있을 때만 토큰 및 해당 내용이 허용되는지 검증해야 한다. 예를 들어, JWT의 경우 'nbf' 및 'exp' 클레임이 검증되어야 한다.1V9.2.22토큰을 수신하는 서비스가 토큰 내용을 수락하기 전에 올바른 유형이며 의도된 목적을 위한 것인지 토큰을 검증하는지 확인해야 한다. 예를 들어, 인가 결정에는 액세스 토큰만 허용될 수 있으며, 사용자 인증을 증명하는 데는 ID 토큰만 사용될 수 있다.2V9.2.33서비스가 대상 서비스(audience)와 함께 사용하기 위한 토큰만 허용하는지 검증해야 한다. JWT의 경우, 서비스에 정의된 허용 목록에 대해 'aud' 클레임을 검증함으로써 이를 달성할 수 있다.2V9.2.44토큰 발행자가 다른 대상(audience)에게 토큰을 발행하기 위해 동일한 개인 키를 사용하는 경우, 발행된 토큰이 의도된 대상을 고유하게 식별하는 대상 제한을 포함하는지 검증해야 한다. 이는 토큰이 의도하지 않은 대상에서 재사용되는 것을 방지한다. 대상 식별자가 동적으로 프로비저닝되는 경우, 토큰 발행자는 대상 위장(audience impersonation)을 초래하지 않도록 대상들을 검증해야 한다.2V1010OAuthOAuth와 OIDCV10.11일반적인 OAuth 및 OIDC 보안V10.1.11엄격하게 필요한 구성 요소에만 토큰이 전송되는지 검증해야 한다. 예를 들어, 브라우저 기반 JavaScript 애플리케이션에 프론트엔드 전용 백엔드(Backend For Frontend; BFF) 패턴을 사용하는 경우, 액세스 토큰 및 리프레시 토큰은 백엔드에서만 접근 가능해야 한다.2V10.1.22클라이언트는 인가 서버에서 제공하는 값(예: 인가 코드 또는 ID 토큰)이 동일한 사용자 에이전트 세션 및 트랜잭션에서 시작된 인가 플로우의 결과인 경우에만 허용하는지 검증해야 한다. 이를 위해 클라이언트가 생성하는 비밀 값(PKCE(Proof Key for Code Exchange)의 'code_verifier', 'state', OIDC의 'nonce' 등)은 추측이 불가능해야 하며, 해당 트랜잭션에 고유해야 하고, 트랜잭션이 시작된 클라이언트와 사용자 에이전트 세션 양쪽에 안전하게 결합(Binding)되어 있어야 한다.2V10.22OAuth 클라이언트V10.2.11코드 플로우를 사용하는 경우, OAuth 클라이언트는 토큰 요청을 유도하는 사이트 간 요청 위조 공격(Cross-Site Request Forgery; CSRF)에 대한 보호 기능을 갖추고 있는지 검증한다. 이를 위해 인가 요청 시 전송된 'state' 파라미터를 검증하거나, PKCE 기능을 사용해야 한다.2V10.2.22OAuth 클라이언트가 둘 이상의 인가 서버와 상호 작용할 수 있는 경우, 믹스업 공격에 대한 방어 대책을 갖는지 검증해야 한다. 예를 들어, 인가 서버가 'iss' 파라미터 값을 반환하도록 요구하고 인가 응답 및 토큰 응답에서 이를 검증할 수 있다.2V10.2.33OAuth 클라이언트가 인가 서버에 대한 요청에서 필요한 범위(또는 기타 인가 파라미터)만 요청하는지 검증해야 한다.3V10.33OAuth 리소스 서버V10.3.11리소스 서버가 해당 서비스(audience)에 사용하도록 의도된 액세스 토큰만 수락하는지 검증해야 한다. 대상은 구조화된 액세스 토큰(예: JWT의 'aud' 클레임)에 포함될 수 있거나, 토큰 조회 엔드포인트를 사용하여 확인할 수 있다.2V10.3.22리소스 서버가 위임된 인가를 정의하는 액세스 토큰의 클레임을 기반으로 인가 결정을 시행하는지 검증해야 한다. 'sub', 'scope', 'authorization_details'와 같은 클레임이 존재하는 경우, 이는 결정에 반영되어야 한다.2V10.3.33액세스 토큰(JWT 또는 관련 토큰 조회 응답)에서 고유한 사용자를 식별해야 하는 접근 제어 결정이 필요한 경우, 리소스 서버가 다른 사용자에게 재할당될 수 없는 클레임에서 사용자를 식별하는지 검증해야 한다. 일반적으로 이는 'iss' 및 'sub' 클레임의 조합을 사용하는 것을 의미한다.2V10.3.44리소스 서버가 특정 인증 강도, 방법 또는 최신성을 요구하는 경우, 제시된 액세스 토큰이 이러한 제약 조건을 충족하는지 검증해야 한다. 예를 들어, 토큰을 제시한 경우 OIDC의 'acr', 'amr' 및 'auth_time' 클레임을 각각 사용해야 한다.2V10.3.55리소스 서버가 발신자 제약 액세스 토큰, 즉 OAuth 2용 상호 TLS(Mutual TLS; mTLS) 또는 OAuth 2 소유 증명(Demonstration of Proof of Possession; DPoP)를 요구하여 도난된 액세스 토큰 사용 또는 액세스 토큰 재사용(권한 없는 당사자로부터)을 방지하는지 검증해야 한다.3V10.44OAuth 인가 서버V10.4.11인가 서버는 클라이언트 별로 사전 등록된 URI의 허용 목록을 기반으로 리디렉션 URI를 정확한 문자열 비교 방식으로 검증해야 한다.1V10.4.22인가 서버가 인가 응답에서 인가 코드를 반환하는 경우, 해당 코드는 토큰 요청에 한번만 사용될 수 있어야 한다. 이미 액세스 토큰을 발급하는 데 사용된 인가 코드를 사용하여 두 번째 요청이 발생하면, 인가 서버는 토큰 요청을 거부하고 해당 인가 코드와 관련된 모든 발급된 토큰을 취소해야 한다.1V10.4.33인가 코드가 단기간만 유효한지 검증해야 한다. 최대 수명은 L1 및 L2 애플리케이션의 경우 최대 10분, L3 애플리케이션의 경우 최대 1분 이내여야 한다.1V10.4.44인가 서버는 특정 클라이언트에 대해, 해당 클라이언트가 사용할 필요가 있는 인가 방식(grant)만 사용하도록 허용해야 한다. token(암시적 플로우) 및 password(리소스 소유자 비밀번호 자격 증명 플로우) 방식은 더 이상 사용되어서는 안 된다.1V10.4.55인가 서버가 공개 클라이언트에 대한 리프레시 토큰 재사용 공격을 완화하는지 검증해야 한다. 가급적이면 발신자 제약 리프레시 토큰, 즉 소유 증명이나 mTLS를 사용한 인증서 바인딩 액세스 토큰을 사용해야 한다. L1 및 L2 애플리케이션의 경우, 리프레시 토큰 회전(rotation)이 사용될 수 있다. 리프레시 토큰 회전이 사용되는 경우, 인가 서버는 리프레시 토큰을 사용 후 무효화해야 하며, 이미 사용되고 무효화된 리프레시 토큰이 제공되면 해당 인가에 대한 모든 리프레시 토큰을 철회(revoke)해야 한다.1V10.4.66코드 인가 방식(code grant)이 사용되는 경우, 인가 서버가 PKCE를 요구하여 인가 코드 탈취 공격을 완화하는지 검증해야 한다. 인가 요청의 경우, 인가 서버는 유효한 'code_challenge' 값을 요구해야 하며, 'code_challenge_method'값으로 'plain'를 허용해서는 안 된다. 토큰 요청의 경우, 'code_verifier' 파라미터의 검증을 요구해야 한다.2V10.4.77인가 서버가 인증되지 않은 동적 클라이언트 등록을 지원하는 경우, 악의적인 클라이언트 애플리케이션의 위험을 완화하는지 검증해야 한다. 등록된 URI와 같은 클라이언트 메타데이터를 검증하고, 사용자의 동의를 확인해야 하며, 신뢰할 수 없는 클라이언트 애플리케이션으로 인가 요청을 처리하기 전에 사용자에게 경고해야 한다.2V10.4.88슬라이딩 리프레시 토큰 만료(expiration)가 적용되더라도, 리프레시 토큰에 절대 만료 시점(absolute expiration)이 포함되어 있는지 확인한다.2V10.4.99악의적인 클라이언트 또는 도난된 토큰의 위험을 완화하기 위해 인가 서버 사용자 인터페이스를 통해 권한 있는 사용자가 리프레시 토큰 및 참조 액세스 토큰을 철회할 수 있는지 검증해야 한다.2V10.4.1010토큰 요청, 푸시된 인가 요청(Pushed Authorization Request; PAR), 토큰 철회 요청과 같은 클라이언트에서 인가 서버로의 백채널 요청(backchannel request)에 대해 기밀 클라이언트가 인증되는지 검증해야 한다.2V10.4.1111인가 서버 구성이 OAuth 클라이언트에 필요한 범위만 할당하는지 검증해야 한다.2V10.4.1212주어진 클라이언트에 대해 인가 서버가 해당 클라이언트가 사용해야 하는 'response_mode' 값만 허용하는지 검증해야 한다. 예를 들어, 인가 서버가 이 값을 예상 값과 비교하여 검증하거나, PAR 또는 JWT 기반 인가 요청(JWT-secured Authorization Request; JAR)을 사용하여 검증해야 한다.3V10.4.1313인가 유형 'code'가 항상 PAR과 함께 사용되는지 검증해야 한다.3V10.4.1414인가 서버가 mTLS를 사용하는 인증서 바인딩 액세스 토큰 또는 소유 증명 바인딩 액세스 토큰을 사용하여 발신자 제약(Proof-of-Possession) 액세스 토큰만 발급하는지 검증해야 한다.3V10.4.1515최종 사용자 장치에서 실행되지 않는 서버에서 동작하는 클라이언트의 경우, 인가 서버가 'authorization_details' 파라미터 값이 클라이언트 백엔드로부터 생성되었는지와 사용자가 해당 값을 변조되지 않았는지를 검증해야 한다. 예를 들어, PAR 또는 JAR의 사용을 요구하여 확인해야 한다.3V10.4.1616클라이언트가 기밀 클라이언트인지 검증하고, 인가 서버는 재사용 공격에 강하고 공개키 암호화에 기반한 강력한 클라이언트 인증 방식을 사용하도록 요구해야 한다. 예를 들어, mTLS(tls_client_auth, self_signed_tls_client_auth) 또는 비공개 키 기반 JWT 인증(private_key_jwt) 등이 이에 해당한다.3V10.55OIDC 클라이언트V10.5.11신뢰 당사자로서 클라이언트가 ID 토큰 재사용 공격을 완화하는지 검증해야 한다. 예를 들어, ID 토큰의 'nonce' 클레임이 OpenID 공급자에 전송된 인증 요청(OAuth2에서는 인가 서버에 전송된 인가 요청)에서 전송된 'nonce' 값과 일치하는지 확인해야 한다.2V10.5.22클라이언트가 ID 토큰 클레임, 일반적으로 'sub' 클레임에서 사용자를 고유하게 식별하며, 해당 클레임이 ID 공급자 범위 내에서 다른 사용자에게 재할당될 수 없는지 검증해야 한다.2V10.5.33클라이언트는 악의적인 인가 서버가 인가 서버 메타데이터를 통해 다른 인가 서버를 가장하려는 시도를 거부하는지 검증해야 한다. 클라이언트는 인가 서버 메타데이터에 포함된 발급자(issuer) URL이 클라이언트가 예상하는 사전 구성된 발급자 URL과 정확히 일치하지 않는 경우, 해당 메타데이터를 거부해야 한다.2V10.5.44클라이언트는 토큰의 aud 클레임 값이 클라이언트의 client_id 값과 동일한지 확인하여 ID 토큰이 해당 클라이언트(audience)를 대상으로 발급되었음을 검증해야 한다.2V10.5.55OIDC 백채널 로그아웃을 사용하는 경우, 신뢰 당사자는 강제 로그아웃을 통한 서비스 거부 공격(Denial of Service) 및 로그아웃 플로우에서의 JWT 혼동(cross-JWT confusion)을 완화하는지 검증해야 한다. 클라이언트는 로그아웃 토큰이 'logout+jwt' 값으로 올바르게 지정되어 있는지, 올바른 멤버 이름을 가진 'event' 클레임을 포함하는지, 그리고 'nonce' 클레임을 포함하지 않는지 검증해야 한다. 또한, 짧은 만료 시간(예: 2분)을 갖는 것이 권장된다.2V10.66OpenID 공급자V10.6.11OpenID 공급자는 response_mode 파라미터 값으로'code', 'ciba', 'id_token' 또는 'id_token code' 만 허용하는지 검증해야 한다. 이 중 'id_token code'(OIDC 하이브리드 플로우)보다는 'code'가 선호되며, 'token'(모든 암시적 플로우)은 사용되어서는 안 된다.2V10.6.22OpenID 공급자가 강제 로그아웃을 통한 서비스 거부 공격을 완화하는지 검증해야 한다. 신뢰 당사자로 부터 시작된 로그아웃 요청에 id_token_hint 등의 파라미터가 포함되어 있는 경우, 이를 검증하거나 최종 사용자로부터 명시적인 확인을 받아야 한다.2V10.77동의 관리V10.7.11인가 서버가 사용자로부터 각 인가 요청에 대한 명시적인 동의(consent)를 확인하는지 검증해야 한다. 클라이언트의 신원을 보장할 수 없는 경우, 인가 서버는 항상 사용자에게 명시적으로 동의를 요청해야 한다.2V10.7.22인가 서버가 사용자 동의를 요청할 때, 동의하는 내용에 대한 충분하고 명확한 정보를 제공하는지 검증해야 한다. 이에 해당하는 경우, 요청된 인가의 성격(일반적으로 범위, 리소스 서버, RAR(Rich Authorization Requests) 인가 세부 정보 기반), 인가된 애플리케이션의 신원, 인가의 유효 기간이 포함되어야 한다.2V10.7.33사용자가 인가 서버를 통해 부여한 동의를 검토, 수정 및 철회할 수 있는지 검증해야 한다.2V1111Cryptography암호화V11.11암호화 인벤토리 및 문서화V11.1.11'NIST SP 800-57'과 같은 암호화 키 관리 및 키 관리 표준을 따르는 암호화 키 수명 주기에 대한 문서화 된 정책이 있는지 검증해야 한다. 여기에는 키가 과도하게 공유되지 않도록 하는 것이 포함된다(예: 공유 비밀의 경우 두 개를 초과하는 엔터티와 공유 및 개인 키의 경우 한 개를 초과하는 엔터티에 공유).2V11.1.22애플리케이션에서 사용되는 모든 암호화 키, 알고리즘, 인증서를 포함한 암호화 자산 목록(cryptographic inventory)이 작성되고, 유지되며, 정기적으로 업데이트되고 있는지 검증해야 한다. 또한, 각 키가 시스템 내에서 사용 가능한 위치와 사용이 제한되는 위치, 해당 키로 보호할 수 있는 데이터 유형과 보호할 수 없는 데이터 유형이 문서화되어 있어야 한다.2V11.1.33암호화, 해싱, 서명 작업을 포함하는 시스템 내의 모든 암호화 사용 사례를 식별하기 위해, 암호화 사용 탐지 메커니즘이 적용되는지 검증해야 한다.3V11.1.44암호화 자산 목록이 유지 관리되는지 검증해야 한다. 여기에는 미래의 위협에 대응하기 위해 양자 내성 암호(Post-Quantum Cryptography; PQC)와 같은 새로운 암호화 표준으로의 마이그레이션 계획을 설명하는 문서화된 계획이 포함되어야 한다.3V11.22안전한 암호화 구현V11.2.11암호화 작업에 업계에서 검증된 구현(라이브러리 및 하드웨어 가속 구현 포함)이 사용되는지 검증해야 한다.2V11.2.22난수, 인증 암호화, MAC, 해싱 알고리즘, 키 길이, 라운드, 암호 및 모드를 언제든지 재구성, 업그레이드 또는 교체하여 암호화 해독으로부터 보호할 수 있도록 애플리케이션이 암호화 유연성(crypto agility)을 갖추고 설계되었는지 검증해야 한다. 또한, 키와 비밀번호를 교체하고 데이터를 다시 암호화하는 것도 가능해야 한다. 이를 통해 승인된 PQC 체계(또는 표준)의 고신뢰 구현이 널리 사용 가능해지면 PQC로 원활하게 업그레이드할 수 있다.2V11.2.33모든 암호화 기본 구성요소(primitive)가 알고리즘, 키 크기 및 구성에 따라 최소 128비트의 보안강도를 제공하는지 검증해야 한다. 예를 들어, 256비트 ECC 키는 대략 128비트의 보안을 제공하며, RSA는 128비트의 보안을 달성하기 위해 3072비트 키를 필요로 한다.2V11.2.44민감한 정보가 누출되는 것을 방지하기 위해 모든 암호화 연산은 상수 시간(constant-time)으로 수행되어야 하며, 비교, 계산, 반환 과정에서 단락(short-circuit) 연산이 없는지 검증해야 한다.3V11.2.55모든 암호화 모듈이 안전하게 실패하고, 패딩 오라클 공격(Padding Oracle attacks)과 같은 취약점을 허용하지 않는 방식으로 오류가 처리되는지 검증해야 한다.3V11.33암호화 알고리즘V11.3.11안전하지 않은 블록 모드(예: ECB) 및 약한 패딩 방식(예: PKCS#1 v1.5)가 사용되지 않는지 검증해야 한다.1V11.3.22GCM을 사용하는 AES와 같이 승인된 암호 및 모드만 사용되는지 검증해야 한다.1V11.3.33암호화 된 데이터가 승인된 인증된 암호화 방식을 사용하거나, 승인된 암호화 방식과 승인된 MAC 알고리즘을 조합을 통한 무단 수정으로부터 보호되는지 검증해야 한다.2V11.3.44논스(nonces), 초기화 벡터 및 기타 단일 사용 번호가 둘 이상의 암호화 키 및 데이터 요소 쌍에 사용되지 않는지 검증해야 한다. 생성 방법은 사용되는 알고리즘에 적합해야 한다.3V11.3.55암호화 알고리즘과 MAC 알고리즘의 모든 조합이 암호화 후 MAC(Encrypt-then-MAC) 방식으로 동작하는지 검증해야 한다.3V11.44해싱 및 해시 기반 함수V11.4.11디지털 서명, HMAC, KDF 및 무작위 비트 생성을 포함한 일반적인 암호화 사용 사례에 승인된 해시 함수만 사용되는지 검증해야 한다. MD5와 같이 허용되지 않는 해시 함수는 어떤 암호화 목적으로도 사용해서는 안 된다.1V11.4.22비밀번호가 승인된 '계산 집약적인 키 유도 함수("비밀번호 해싱 함수"라고도 함)'를 사용하여 저장되고, 파라미터 설정이 현재 지침에 따라 구성되었는지 검증해야 한다. 설정은 필요한 보안 수준에 대한 무차별 대입 공격을 충분히 어렵게 만들기 위해 보안과 성능의 균형을 이루어야 한다.2V11.4.33데이터 인증 또는 데이터 무결성의 일부로 디지털 서명에 사용되는 해시 함수가 충돌 저항성을 가지며 적절한 비트 길이를 갖는지 검증해야 한다. 충돌 저항성이 필요한 경우, 출력 길이는 최소 256비트여야 한다. 제2 역상(pre-image) 공격 저항성만 필요한 경우, 출력 길이는 최소 128비트여야 한다.2V11.4.44비밀번호로부터 비밀 키를 유도할 때 애플리케이션이 키 스트레칭(key stretching) 파라미터를 사용하여 승인된 키 유도 함수(key derivation function)를 사용하는지 검증해야 한다. 사용 중인 파라미터는 결과적인 암호화 키를 손상시키는 무차별 대입 공격을 방지하기 위해 보안과 성능의 균형을 이루어야 한다.2V11.55무작위 값V11.5.11예측 불가능해야 하는 모든 난수 및 문자열이 암호학적으로 안전한 의사 난수 생성기(CSPRNG)를 사용하여 생성되고 최소 128비트의 엔트로피를 갖는지 검증해야 한다. UUID는 이 조건을 충족하지 않는다.2V11.5.22사용 중인 난수 생성 메커니즘이 높은 부하(heavy demand)에서도 안전하게 작동하도록 설계되었는지 검증해야 한다.3V11.66공개 키 암호화V11.6.11키 생성 및 시딩, 디지털 서명 생성 및 검증에 승인된 암호화 알고리즘 및 작동 모드만 사용되는지 검증해야 한다. 키 생성 알고리즘은 알려진 공격에 취약한 안전하지 않은 키(예: 페르마 인수분해(Fermat factorization)에 취약한 RSA 키)를 생성해서는 안 된다.2V11.6.22키 교환에는 디피-헬만과 같은 승인된 암호화 알고리즘이 사용되어야 하며, 안전한 파라미터를 사용하는지 여부를 중점적으로 검증해야 한다.이는 중간자 공격(adversary-in-the-middle attacks) 또는 암호화 해독으로 이어질 수 있는 키 설정 프로세스에 대한 공격을 방지할 것이다.3V11.77사용 중 데이터 암호화V11.7.11사용 중인 민감한 데이터를 보호하고 무단 사용자 또는 프로세스의 접근을 방지하기 위해 전체 메모리 암호화가 사용되는지 검증해야 한다.3V11.7.22데이터 최소화가 처리 중에 노출되는 데이터의 양을 최소화하고, 사용 직후 또는 가능한 한 빨리 데이터가 암호화되도록 보장하는지 검증해야 한다.3V1212Secure보안 통신V12.11일반 TLS 보안 가이드V12.1.11TLS 1.2 및 TLS 1.3과 같은 최신 권장 버전의 TLS 프로토콜만 활성화되어 있으며, 그중 최신 버전이 우선되어야 한다.1V12.1.22오직 권장되는 암호화 스위트(cipher suites)들이 활성화되어 있으며 그 중 가장 강력한 암호화 스위트로 우선 설정되어 있는지 확인한다. 레벨3 애플리케이션은 순방향 비밀성(forward secrecy)을 제공하는 암호화 스위트만 지원해야 한다.2V12.1.33인증이나 권한 부여를 위해 인증서 ID를 사용하기 전에 애플리케이션이 mTLS 클라이언트 인증서가 신뢰할 수 있는지 검증해야 한다.2V12.1.44Online Certificate Status Protocol (OCSP) 스테이플링(Stapling)과 같은 적절한 인증서 폐지 프로토콜이 활성화되고 설정되어 있는지 확인해야 한다.3V12.1.55TLS 핸드셰이크 프로세스 중 Server Name Indication (SNI)과 같은 민감한 메타 데이터의 노출을 방지하기 위해 애플리케이션 TLS 설정에서 Encrypted Client Hello (ECH)가 활성화되어 있는지 확인해야 한다.3V12.22외부 서비스와의 HTTPS 통신V12.2.11TLS는 클라이언트와 외부 HTTP 기반 서비스 간의 모든 연결에 사용되며, 안전하지 않거나 암호화 되어 있지 않은 통신에 대체 동작(fall back)이 발생하지 않는지 확인해야한다. 1V12.2.22외부 서비스가 공적으로 신뢰된 TLS 인증서를 사용하는지 확인해야 한다.1V12.33일반 서비스 간의 통신 보안V12.3.11애플리케이션간의 모니터링 시스템, 관리 도구, 원격 엑세스 및 SSH, 미들웨어, 데이터베이스, 메인프레임, 파트너 시스템이나 외부 API를 포함한 모든 인바운드와 아웃바운드 통신은 TLS같은 암호화 프로토콜이 사용되는지 확인해야 한다. 이 서버는 안전하지 않거나 암호화 되어있지 않은 프로토콜에 대체 동작(fall back)이 발생하지 않아야 한다.2V12.3.22TLS 클라이언트가 통신하기 전에 TLS서버로 부터 받은 인증서를 검증하는지 확인해야 한다.2V12.3.33그리고 TLS 또는 애플리케이션 내의 내부 HTTP 기반 서비스간에 사용된 다른 적절한 전송 암호화 매커니즘이 안전하지 않거나 암호화 되어있지 않은 통신에 대체 동작(fall back)이 발생하지 않는지 확인해야 한다.2V12.3.44내부 서버간에 TLS 통신이 신뢰된 인증서를 사용하는지 확인해야 한다. 내부 인증서나 자체 서명(self-signed)인증서를 사용할 경우, 이를 사용하는 서비스는 오직 특정 내부 인증기관(CA)과 자체 서명 인증만을 신뢰하게 설정해야 한다.2V12.3.55시스템 내부에서 통신하는 서비스(intra-service communication)는 각 엔드포인트를 검증하기 위해 강력한 인증을 사용해야 한다. 공용키(public-key) 기반 구조와 재전송 공격(replay attacks)에 저항하는 매커니즘을 사용하여 신원보장을 위해 TLS 클라이언트 인증과 같은 강력한 인증 방식을 사용해야 한다. 마이크로서비스 아키텍쳐의 경우 인증서 관리를 간소화 하고 보안을 강화하기 위해 서비스 매시(service mesh)를 사용하는 것을 고려해야 한다.3V1313Configuration설정V13.11설정 문서V13.1.11애플리케이션의 모든 통신 요구사항이 문서화 되어 있는지를 검증한다. 이는 애플리케이션이 의존하는 외부 서비스나, 사용자가 애플리케이션이 연결할 외부 위치를 제공하는 경우들을 포함한다.2V13.1.22애플리케이션이 사용하는 각각의 서비스들에 대해, 문서가 최대 동시 연결 수(연결 풀 제한)를 정의하고 있는지, 그리고 그 한계에 다다랐을 때 폴백(fallback)이나 복구 메커니즘 등을 포함하여, DoS 공격을 방지하기 위해 애플리케이션이 어떻게 동작하는지를 검증한다.3V13.1.33애플리케이션 문서가 모든 외부 시스템이나 애플리케이션이 사용하는 서비스(예시: 데이터베이스, 파일 핸들, 스레드, HTTP 연결)들에 대한 자원-관리 전략을 정의하고 있는지 검증한다.이는 자원-해제 프로시저, 시간초과 설정, 오류 핸들링을 포함하며, 재시도 로직이 구현된 경우 재시도 제한과 지연, 백-오프 알고리즘을 명시해야 한다. 동기 HTTP 요청-응답 명령에 대해서는 짧은 타임아웃에 더해 재시도의 비활성화 혹은 연쇄적인 지연과 자원 고갈을 방지하기 위한 재시도의 엄격한 제한을 의무화해야 한다.3V13.1.44애플리케이션 문서가 조직의 위협 모델과 사업적 요구사항에 기반하여, 애플리케이션의 보안과 비밀 정보들의 주기적 갱신 일정에 치명적인 비밀 정보들을 정의하고 있는지 검증한다.3V13.22백엔드 통신 설정V13.2.11API나 미들웨어와 같은 애플리케이션의 표준 사용자 세션 메커니즘을 지원하지 않는 백엔드 애플리케이션 컴포넌트와 데이터 계층 사이의 통신이 인증되어 있는지를 검증한다. 인증은 반드시 개별적인 서비스 계정과 단기간 토큰, 또는 인증서 기반 인증을 사용하고 비밀번호, API 키, 또는 접근 권한이 부여된 공유 계정 등의 자격 증명을 변경하지 않아선 안 된다. 2V13.2.22로컬 또는 운영체제 서비스, API, 미들웨어, 그리고 데이터 계층을 포함한 백엔드 애플리케이션 컴포넌트 간의 통신이 최소 필요 권한이 할당된 계정들로 수행되는지 검증한다.2V13.2.33만약 자격 증명이 서비스 인증을 위해 필요하다면, 소비자로부터 사용되는 그 자격 증명이 기본 자격 증명이 아님을 검증한다. (예시: root/root 또는 admin/admin)2V13.2.44얼로우리스트가 애플리케이션의 통신이 허가된 외부 리소스나 시스템을 정의하기 위해 사용되는지 검증한다. (예시: 아웃바운드 요청, 데이터 로드, 파일 접근). 이 얼로우리스트는 애플리케이션 계층, 웹 서버, 방화벽 또는 다른 여러 계층의 조합으로 구현할 수 있다. 2V13.2.55웹이나 애플리케이션 서버에 요청을 보내거나 데이터나 파일을 로드 할 수 있는 리소스 또는 시스템의 얼로우리스트가 설정되어 있는지를 검증한다.2V13.2.66애플리케이션이 별도의 서비스와 연결할 때, 각 연결이 최대 병렬연결, 최대 연결 도달 시의 동작, 연결 타임아웃, 재시도 전략 등 문서화된 설정에 따르는지 검증한다.3V13.33비밀 정보 관리V13.3.11키 볼트와 같은 비밀 정보 관리 솔루션이 백엔드 비밀 정보들을 만들고 저장하고, 접근을 제어하고, 파기하기 위해 사용되고 있는지 검증한다. 이는 비밀번호, 키 재료, 데이터베이스와 서드 파티 시스템의 통합, 시간-기반 토큰을 위한 키와 시드, 그리고 API 키들을 포함할 수 있다. 비밀 정보들은 애플리케이션 소스 코드 내부나, 빌드 아티팩트에 포함되어서는 안 된다. L3 애플리케이션에 대해서는, 반드시 HSM과 같은 하드웨어 기반 솔루션을 사용해야 한다.2V13.3.22비밀 정보 자원들에 대한 접근이 최소 권한의 원칙을 고수하는지 검증한다.2V13.3.33보안 모듈에 대한 외부의 노출로부터 안전하게 키 재료를 관리하고 보호하기 위해 모든 암호 연산이 고립된 보안 모듈(볼트나, 하드웨어 보안 모듈 등)을 사용하여 수행되는지 검증한다.3V13.3.44애플리케이션의 문서를 기반으로 비밀 정보들이 만료되고 갱신되도록 설정되었는지 검증한다.3V13.44의도하지 않은 정보 노출V13.4.11애플리케이션이 .git 이나 .svn 폴더 같은 소스 코드 관리 메타데이터 없이 배포되었는지, 또는 이 폴더들이 외부적으로든 애플리케이션 자체에서든 접근할 수 없도록 배포되었는지 검증한다. 1V13.4.22실제 운영환경에서 디버깅 기능 노출이나 정보 누출을 방지하기 위해, 모든 컴포넌트에서 디버그 모드가 비활성화되어 있는지 검증한다.2V13.4.33분명히 의도된 것이 아닌 이상 웹 서버가 폴더 목록을 클라이언트에게 노출하지 않는지 검증한다.2V13.4.44잠재적인 정보 누출을 방지하기 위해 실제 운영환경에서 HTTP TRACE 메소드 사용이 지원되지 않는지 검증한다. 2V13.4.55분명히 의도된 것이 아닌 이상 문서(내부 API 같은)와 모니터링 엔드포인트가 노출되지 않는지 검증한다.2V13.4.66애플리케이션이 백엔드 컴포넌트의 자세한 버전 정보를 노출하지 않는지 검증한다.3V13.4.77웹 계층이 의도적이지 않은 정보, 설정, 소스코드 누출을 방지하기 위해 특정 파일 확장자만 서비스하도록 설정되었는지 검증한다.3V1414Data데이터 보호V14.11데이터 보호 문서화V14.1.11애플리케이션이 생성하고 처리하는 모든 민감한 데이터가 식별되고 보호 수준으로 분류되었는지 확인한다. 여기에는 단순히 인코딩되어 있고 쉽게 디코딩할 수 있는 데이터, 예를 들어 Base64 문자열이나 JWT 내부 평문 페이로드가 포함된다. 보호 수준은 애플리케이션이 준수해야 하는 모든 데이터 보호 및 개인정보 보호 관련 규정과 표준을 반드시 고려해야 한다.2V14.1.22모든 민감한 데이터의 보호 수준에 대해 문서화된 요구사항이 있는지 확인한다. 반드시 여기에는(이에 한정되지 않지만) 일반적인 암호화, 무결성 검증, 보존 기간, 데이터 로그 기록 방식, 로그 내 민감한 데이터에 대한 접근 제어, 데이터베이스 암호화 수준, 사용할 개인정보 보호 및 개인정보 보호 강화 기술, 그리고 기타 기밀성 요구사항들 관련하여 포함되어야 한다.2V14.22일반 데이터 보호V14.2.11민감한 데이터는 HTTP 메시지 본문이나 헤더 필드로만 서버에 전송되고, URL과 쿼리 문자열에는 API키나 세션토큰처럼 민감한 정보가 포함되지 않도록 검증한다.1V14.2.22서버 구성 요소에서 로드밸런서나 애플리케이션 캐시와 같은 민감한 데이터가 캐시되지 않게 하거나, 사용 후 해당 데이터를 안전하게 삭제하도록 검증한다.2V14.2.33정의된 민감한 데이터가 애플리케이션의 통제를 벗어난 곳에서 원치 않는 수집을 예방하기 위해 신뢰할 수 없는 대상(예: 사용자 추적기)에게 전송되지 않도록 검증한다.2V14.2.44암호화, 무결성 검증, 보존, 데이터 로그 기록 방식, 로그 내 민감한 데이터 접근 제어, 개인정보 보호 및 개인정보 보호 강화 기술과 관련된 민감한 데이터 통제가, 해당 데이터 보호 수준에 대한 문서에 정의된 대로 구현되었는지 검증한다.2V14.2.55캐시 메커니즘이 해당 리소스에 대해 예상되는 콘텐츠 유형을 가진 응답만 캐시하고, 민감하거나 동적인 콘텐츠는 캐시하지 않도록 구성되어 있는지 검증한다. 존재하지 않는 파일에 접근했을 때 다른 유효한 파일을 반환하는 대신 웹 서버는 404 또는 302 응답을 반환해야 한다. 이는 Web Cache Deception 공격을 예방한다.3V14.2.66애플리케이션 기능에 필요한 최소한의 민감한 데이터만 반환을 검증한다. 예를 들어, 전체 신용카드 번호가 아닌 일부 숫자만 반환해야 한다. 만약 전체 데이터가 필요한 경우, 사용자가 구체적으로 조회하지 않는 한 사용자 인터페이스에서는 마스킹하는 것이 권장된다.3V14.2.77민감한 정보는 데이터 보존 분류 기준에 따라 관리되어야 하고, 오래되었거나 불필요한 데이터는 사전에 정의된 작업 또는 상황에 따라 자동으로 삭제되도록 검증한다.3V14.2.88사용자가 제출한 파일의 메타데이터에서 사용자가 저장에 동의하지 않는 한 민감한 정보는 제거를 검증한다.3V14.33클라이언트 측 데이터 보호V14.3.11클라이언트나 세션이 종료된 후에 브라우저 DOM과 같은 클라이언트 스토리지에서 인증된 데이터를 삭제되는지 검증한다. 이를 위해 ‘Clear-Site-Data’ HTTP 응답 헤더 필드를 사용할 수 있으나, 세션 종료 시 서버 연결이 불가능한 경우에도 클라이언트 측에서 해당 데이터를 삭제하는 것이 권장된다.1V14.3.22애플리케이션이 브라우저에서 민감한 데이터가 캐시되지 않도록, (Cache-Control: no-store)충분한 캐시 방지 HTTP 응답 헤더 필드를 설정을 검증한다.2V14.3.33브라우저 저장소(localStorage, sessionStorage, IndexedDB, 쿠키)에 저장되는 데이터에는 세션 토큰을 제외한 민감 데이터가 포함되지 않도록 검증한다.2V1515Secure보안 코딩 및 아키텍처V15.11보안 코딩 및 아키텍처 문서화V15.1.11애플리케이션 문서에 취약점이 존재하는 서드파티 구성요소 버전 및 일반적인 라이브러리 업데이트에 대해, 해당 구성요소로부터 발생할 수 있는 위험을 최소화하기 위한 위험 기반 대응 기한이 정의되어 있는지 확인해야 한다.1V15.1.22사용 중인 모든 서드파티 라이브러리에 대해 소프트웨어 자재 명세서(SBOM)와 같은 인벤토리가 유지되고 있으며, 해당 구성요소가 사전에 정의된 신뢰할 수 있고 지속적으로 관리되는 저장소에서 제공되는지 확인해야 한다.2V15.1.33애플리케이션 문서에 시간 소모가 크거나 리소스 소비가 많은 기능이 식별되어 있으며, 해당 기능의 과도한 사용으로 인해 가용성이 손실되지 않도록 하는 방법과, 응답 생성이 소비자의 타임아웃보다 오래 걸리는 상황을 방지하는 방법이 포함되어 있는지 확인해야 한다. 가능한 방어 전략에는 비동기 처리, 큐(queue) 사용, 사용자 및 애플리케이션 단위의 병렬 처리 제한 등이 있다.2V15.1.44애플리케이션 문서에 위험한 구성요소로 간주되는 서드파티 라이브러리가 강조되어 있는지 확인해야 한다.3V15.1.55애플리케이션 문서에 위험한 기능을 사용하는 애플리케이션의 부분이 강조되어 있는지 확인해야 한다.3V15.22보안 아키텍처 및 종속성V15.2.11애플리케이션이 문서화된 업데이트 및 대응 기한을 위반하지 않은 구성요소만 포함하고 있는지 확인해야 한다.1V15.2.22애플리케이션이 시간 소모가 크거나 리소스 소비가 많은 기능의 과도한 사용으로 인한 가용성 손실을 방지하기 위해, 해당 기능에 대한 문서화된 보안 결정 및 전략을 기반으로 방어 조치를 구현하고 있는지 확인해야 한다.2V15.2.33운영 환경에 애플리케이션 기능 수행에 필요한 기능만 포함되어 있으며, 테스트 코드, 샘플 코드, 개발용 기능 등 불필요한 기능이 노출되지 않도록 구성되어 있는지 확인해야 한다.2V15.2.44서드파티 구성요소 및 그 모든 전이 종속성(transitive dependencies)이 내부 또는 외부의 예상된 저장소에서 가져며, 의존성 혼동(dependency confusion) 공격의 위험이 없는지 확인해야 한다.3V15.2.55애플리케이션이 위험한 기능을 포함하거나 위험한 구성요소를 사용하는 부분에 대해 샌드박싱, 캡슐화, 컨테이너화, 네트워크 수준 격리와 같은 추가적인 보호 기법을 구현하여, 애플리케이션의 한 부분이 침해되더라도 공격자가 다른 영역으로 확산하지 못하도록 지연 및 차단하고 있는지 확인해야 한다.3V15.33방어적(Defensive) 코딩V15.3.11애플리케이션이 데이터 객체에서 필요한 필드만 선택적으로 반환하고 있는지 확인해야 한다. 예를 들어, 일부 필드는 사용자에게 노출되어서는 안 되므로 전체 데이터 객체를 반환해서는 안 된다.1V15.3.22애플리케이션 백엔드에서 외부 URL로 요청을 보낼 때, 의도된 기능이 아닌 경우 리디렉션을 따르지 않도록 구성되어 있는지 확인해야 한다.2V15.3.33애플리케이션이 각 컨트롤러 및 액션 단위로 허용된 필드를 제한함으로써, 대량 할당(mass assignment) 공격에 대한 방어가 구현되어 있는지 확인해야 한다. 예를 들어, 특정 동작에 포함되지 않은 필드 값을 삽입하거나 수정할 수 없어야 한다.2V15.3.44모든 프록시 및 미들웨어 구성요소가 사용자의 원래 IP 주소를 신뢰 가능한 데이터 필드를 통해 정확하게 전달하고 있으며, 애플리케이션과 웹 서버가 이 값을 로그 기록이나 속도 제한(rate limiting)과 같은 보안 결정에 사용하는지 확인해야 한다. 단, 동적 IP, VPN, 방화벽 등으로 인해 원래 IP조차 완전히 신뢰할 수 없는 점도 고려해야 한다.2V15.3.55애플리케이션이 변수의 타입이 올바른지 명시적으로 확인하고, 엄격한 동등성 비교 및 연산자를 사용하여 타입 혼용(type juggling) 또는 타입 혼동(type confusion)으로 인한 취약점을 방지하고 있는지 확인해야 한다.2V15.3.66JavaScript 코드가 프로토타입 오염(prototype pollution)을 방지할 수 있도록 작성되어 있는지 확인해야 한다. 예를 들어, 객체 리터럴 대신 `Set()` 또는 `Map()`을 사용하는 방식이 권장된다.2V15.3.77애플리케이션이 HTTP 파라미터 오염(HTTP parameter pollution) 공격에 대한 방어를 구현하고 있는지 확인해야 한다. 특히, 애플리케이션 프레임워크가 요청 파라미터의 출처(쿼리 스트링, 본문, 쿠키, 헤더)를 구분하지 않는 경우 이를 고려해야 한다.2V15.44안전한 동시성V15.4.11다중 스레드 코드에서 캐시, 파일, 다수 스레드가 접근하는 메모리 내 객체 등 공유 객체에 접근할 때, 스레드 세이프(thread-safe) 타입과 락·세마포어 같은 동기화 메커니즘을 사용하여 경쟁 상태와 데이터 손상을 피하고 안전하게 접근하는지 확인해야 한다.3V15.4.22리소스의 존재 여부나 권한과 같은 상태 검사와, 그 검사 결과에 의존하는 동작이 단일(atomic) 연산으로 수행되어 TOCTOU 경쟁 상태를 방지하는지 확인해야 한다. (예: 파일을 열기 전에 존재 여부를 확인하는 작업과 파일 열기 동작을 분리하지 않기, 접근 권한 검증과 권한 부여를 동일 트랜잭션/원자적 구간에서 수행하기)3V15.4.33스레드가 서로를 기다리거나 무한 재시도에 빠지지 않도록 일관된 락 사용을 보장하고, 락 관리 로직을 리소스 관리 책임 코드 내부에 유지하여 외부 클래스 및 코드가 우발적·악의적으로 락을 변경하지 못하도록 하는지 확인해야 한다.3V15.4.44**스레드 풀** 활용 등 **리소스 할당 정책**을 통해 공정한 리소스 접근을 보장하고, 우선순위가 낮은 스레드도 합리적 시간 내 진행될 수 있게 하여 **스레드 기아**를 방지하는지 확인해야 한다.3V1616Security보안 로깅과 오류 처리V16.11보안 로깅 문서화V16.1.11애플리케이션의 기술 스택의 각 계층에서 수행된 로깅에 대해, 어떤 이벤트들이 로그로 남았는지, 로그의 형식이 무엇인지, 로그가 어디에 저장되었는지, 어떻게 사용되는지, 로그에 대한 접근이 어떻게 제어되는지, 그리고 로그가 얼마나 보관되는지에 대해 문서화한 목록이 존재하는지 검증한다.2V16.22일반 로깅V16.2.11이벤트가 발생했을 때 그 타임라인을 자세히 조사할 수 있도록 각 로그의 항목이 필수적인 메타데이터(언제, 어디서, 누가, 무엇을 등)을 포함하는지 검증한다. 2V16.2.22모든 로깅 컴포넌트의 시간 소스가 동기화되어 있는지, 그리고 보안 이벤트 메타데이터에서 타임스탬프가 UTC를 사용하거나 혹은 명시적인 시간대 오프셋을 포함하는지 검증한다. UTC는 분산 시스템 전체에 걸친 일관성을 보장하고, 일광 절약 시간제 전환 시의 혼란을 방지하기 위해 추천된다.2V16.2.33애플리케이션이 로그를 저장만 하는지, 혹은 로그 목록에서 문서화 된 파일이나 서비스로 브로드캐스트하는지 검증한다.2V16.2.44사용 중인 로그 처리기가 로그를 읽고, 또 상호 연관 지을 수 있는지 검증한다. 가능하다면 공통 로깅 형식을 사용하는 것이 좋다.2V16.2.55민감한 데이터를 로깅할때, 애플리케이션이 데이터의 보호 수준을 기반으로 로깅을 수행하는지 검증한다. 예를 들어, 자격 증명이나, 지불 상세 정보 등의 특정 데이터는 로깅 해서는 안 된다. 또한 세션 토큰 등의 데이터는 전체 혹은 일부분이 해싱된, 마스킹 된 상태로 로깅 되어야 한다.2V16.33보안 이벤트V16.3.11성공한 시도와 실패한 시도를 포함하여 모든 인증 명령을 로깅 하는지 검증한다. 인증의 종류나, 사용한 인증 요소 등의 추가적인 메타데이터 또한 수집해야 한다.2V16.3.22실패한 인가 시도들도 로깅 하는지 검증한다. L3에 대해서는 반드시 민감한 데이터가 접근되었을 때를 포함하여(민감한 데이터 자체는 제외하고) 모든 인가 결정들의 로그를 포함해야 한다.2V16.3.33애플리케이션이 이 문서에서 정의한 보안 이벤트들을 로깅하고, 또한 입력값 확인, 비즈니스 로직, 그리고 자동화 방지 등의 보안 제어를 우회하려는 시도들도 로깅 하는지 검증한다.2V16.3.44애플리케이션이 백엔드 TLS 오류와 같은 예상치 못한 오류나 보안 제어 오류들을 로깅 하는지 검증한다.2V16.44로그 보호V16.4.11로그 삽입을 방지하기 위해 모든 로깅 컴포넌트가 적절히 데이터를 인코딩하는지 검증한다.2V16.4.22로그가 비인가된 접근으로부터 보호되고 수정할 수 없는지 검증한다.2V16.4.33분석, 탐지, 경보, 그리고 에스컬레이션(escalation)을 위해 로그가 논리적으로 분리된 시스템으로 안전하게 전송되는지 검증한다. 애플리케이션이 침해되더라도 로그는 훼손하지 못하도록 보장하는 것이 목적이다.2V16.55오류 처리V16.5.11예상치 못한 혹은 보안 측면에서 민감한 오류가 발생했을 때 스택 흔적, 쿼리, 비밀키, 그리고 토큰 등의 민감한 내부 시스템 데이터의 노출 방지를 보장하기 위해 유저에게 구체화하지 않은 메시지를 반환하는지 검증한다.2V16.5.22외부 리소스 접근 오류가 발생하더라도 애플리케이션이 계속해서 안전하게 작동하는지 검증한다. 예를 들어 서킷 브레이커(circuit breaker)나 우아한 성능 저하와 같은 패턴을 사용할 수 있다.2V16.5.33예외가 발생할 때, 검증 로직의 오류에도 불구하고 거래를 처리하는 등의 페일-오픈(fail-open) 상태 방지를 포함하여 애플리케이션이 우아하고 안전하게 실패하는지 검증한다. 2V16.5.44처리되지 못한 모든 예외를 처리할 “최후의 수단” 오류 핸들러가 정의되어 있는지 검증한다. 이는 로그 파일에 기록되어야 하는 오류 상세 정보들의 손실을 피하기 위함과 동시에, 오류로 인해 전체 애플리케이션 프로세스가 종료되어 가용성 손실로 이어지지 않도록 보장하기 위함이다. 3V1717WebRTCWebRTCV17.11TURN 서버V17.1.11Traversal Using Relays around NAT(TURN) 서비스가 특정 목적을 위해 보존된 주소(예: 내부 네트워크, 브로드캐스트, 루프백)를 제외한 주소에 대해서만 접근을 허용하도록 한다.2V17.1.22Traversal Using Relays around NAT(TURN) 서비스가 정당한 사용자의 TURN 서버 포트의 대량 개방 시 자원고갈에 취약하지 않도록 한다.3V17.22미디어V17.2.11데이터그램 전송 계층 보안(DTLS) 인증서의 키가 암호화 키 관리에 대한 문서화된 정책에 따라 관리되고 보호되는지 확인해야 한다.2V17.2.22미디어 서버가 승인된 데이터그램 전송 계층 보안(DTLS) 암호 모음을 사용하고 지원하도록 구성되었는지, 그리고 보안 실시간 전송 프로토콜(DTLS-SRTP)을 위한 키 생성에 사용되는 DTLS 확장을 위한 안전한 보호 프로파일을 구성했는지 확인해야 한다.2V17.2.33미디어 서버에서 보안 실시간 전송 프로토콜(SRTP) 인증이 선택되어 있는지 확인한다. 이를 통해 실시간 전송 프로토콜(RTP) 삽입 공격으로 인한 서비스 거부 상태 발생 또는 오디오/비디오 미디어가 미디어 스트림에 삽입되는 것을 방지할 수 있다.2V17.2.44미디어 서버가 잘못된 형식의 보안 실시간 전송 프로토콜(SRTP) 패킷을 접했을 때도 수신 미디어 트래픽 처리를 계속할 수 있는지 확인해야 한다.2V17.2.55미디어 서버가 정상 사용자로부터의 보안 실시간 전송 프로토콜(SRTP) 패킷이 대량으로 유입되는 상황에서도 수신 미디어 트래픽 처리를 계속할 수 있는지 확인해야 한다.3V17.2.66미디어 서버가 Datagram Transport Layer Security(DTLS)의 “ClientHello” 경합 조건 취약점에 노출되지 않았는지 확인해야 한다. 이를 위해 해당 미디어 서버가 공개적으로 취약한 것으로 알려져 있는지 확인하거나 경합 조건 테스트를 수행해야 한다.3V17.2.77미디어 서버와 연결된 모든 오디오 또는 비디오 녹화 장치가 합법적인 사용자로부터의 보안 실시간 전송 프로토콜(SRTP) 패킷이 대량으로 유입되는 상황에서도 수신 미디어 트래픽 처리를 계속할 수 있는지 확인해야 한다.3V17.2.88데이터그램 전송 계층 보안(DTLS) 인증서가 세션 설명 프로토콜(SDP) 지문 속성과 대조되어 검증되었는지 확인하고, 검증이 실패할 경우 미디어 스트림을 종료하여 미디어 스트림의 진위성을 보장해야 한다.3V17.33신호 처리V17.3.11신호 서버가 플러드 공격 중에도 합법적인 수신 신호 메시지 처리를 계속할 수 있는지 확인해야 한다. 이는 신호 수준에서 속도 제한을 구현함으로써 달성되어야 한다.2V17.3.22서비스 거부 상태를 유발할 수 있는 잘못된 형식의 신호 메시지를 접했을 때 신호 서버가 정상적인 신호 메시지 처리를 계속할 수 있는지 확인해야 한다. 여기에는 입력 검증 구현, 정수 오버플로우 안전 처리, 버퍼 오버플로우 방지 및 기타 강력한 오류 처리 기법 적용이 포함될 수 있다.2 diff --git a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.cdx.json b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.cdx.json new file mode 100644 index 0000000000..6c2b163dad --- /dev/null +++ b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.cdx.json @@ -0,0 +1,3057 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.6", + "serialNumber": "urn:uuid:a402bfff-35e4-4c36-bc66-be15e7c21d10", + "version": 1, + "metadata": { + "timestamp": "2025-10-15T15:46:01+00:00", + "licenses": [ + { + "license": { + "id": "CC-BY-SA-4.0", + "url": "https://creativecommons.org/licenses/by-sa/4.0/legalcode.txt" + } + } + ], + "supplier": { + "name": "OWASP Foundation", + "url": [ + "https://owasp.org" + ] + } + }, + "declarations": { + "standards": [ + { + "bom-ref": "ASVS-", + "name": "Application Security Verification Standard (ASVS)", + "version": "", + "description": "The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.", + "owner": "Application Security Verification Standard Project", + "requirements": [ + { + "bom-ref": "V1", + "identifier": "V1", + "title": "Кодировка и нейтрализация" + }, + { + "bom-ref": "V1.1", + "identifier": "V1.1", + "title": "Архитектура кодировки и нейтрализации", + "parent": "V1" + }, + { + "bom-ref": "V1.1.1", + "identifier": "V1.1.1", + "text": "Убедитесь, что входные данные декодируются или деэкранируются в каноническую форму (в стандартное представление) только один раз. Декодирование происходит только тогда, когда ожидаются закодированные данные в этой форме, и что это делается перед дальнейшей обработкой входных данных, например, это не выполняется после проверки или нейтрализации.", + "parent": "V1.1" + }, + { + "bom-ref": "V1.1.2", + "identifier": "V1.1.2", + "text": "Убедитесь, что приложение выполняет кодирование и экранирование выходных данных либо в качестве последнего шага перед использованием интерпретатором, для которого оно предназначено, либо самим интерпретатором.", + "parent": "V1.1" + }, + { + "bom-ref": "V1.2", + "identifier": "V1.2", + "title": "Предотвращение инъекций", + "parent": "V1" + }, + { + "bom-ref": "V1.2.1", + "identifier": "V1.2.1", + "text": "Убедитесь, что выходная кодировка для ответа HTTP, документа HTML или документа XML соответствует требуемому контексту, например, кодировка соответствующих символов для элементов HTML, атрибутов HTML, комментариев HTML, CSS или полей заголовка HTTP делается таким способом, чтобы избежать изменения структуры сообщения или документа.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.2", + "identifier": "V1.2.2", + "text": "Убедитесь, что при динамическом построении URL-адресов недоверенные данные кодируются в соответствии с их контекстом (например, кодирование URL-адресов или кодирование base64url для query или path параметров или пути). Убедитесь, что разрешены только безопасные протоколы URL-адресов (например, запрещен javascript: или data:).", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.3", + "identifier": "V1.2.3", + "text": "Убедитесь, что при динамическом построении содержимого JavaScript (включая JSON) используется кодирование или экранирование выходных данных, чтобы избежать изменения структуры сообщения или документа (чтобы избежать JavaScript и JSON-инъекций).", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.4", + "identifier": "V1.2.4", + "text": "Убедитесь, что выборка данных (Redis, Memcached, чтение из файлов, обращение по API) или запросы к базе данных (например, SQL, HQL, NoSQL, Cypher) используют параметризованные запросы, ORM, Entity Frameworks или иным образом защищены от SQL-инъекций и других атак. Это также актуально при написании хранимых процедур.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.5", + "identifier": "V1.2.5", + "text": "Убедитесь, что приложение защищено от внедрения команд ОС и что вызовы операционной системы используют параметризованные запросы к ОС или используют контекстное кодирование вывода командной строки.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.6", + "identifier": "V1.2.6", + "text": "Убедитесь, что приложение защищено от LDAP-инъекций, или что реализованы специальные меры безопасности для их предотвращения.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.7", + "identifier": "V1.2.7", + "text": "Убедитесь, что приложение защищено от атак с использованием XPath-инъекций с помощью параметризации запросов или предварительно скомпилированных запросов.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.8", + "identifier": "V1.2.8", + "text": "Убедитесь, что процессоры LaTeX настроены безопасно (например, не используется флаг «–shell‑escape») и используется разрешенный список команд для предотвращения LaTeX-инъекций.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.9", + "identifier": "V1.2.9", + "text": "Убедитесь, что приложение экранирует специальные символы в регулярных выражениях (обычно с помощью обратной косой черты), чтобы предотвратить их ошибочную интерпретацию как метасимволов.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.10", + "identifier": "V1.2.10", + "text": "Убедитесь, что приложение защищено от внедрения формул CSV (CSV Injection). Приложение должно следовать правилам экранирования, определенным в RFC 4180, разделы 2.6 и 2.7, при экспорте содержимого CSV. Кроме того, при экспорте в CSV или другие форматы электронных таблиц (такие как XLS, XLSX или ODF) специальные символы (включая '=', '+', '-', '@', '\\t' (табуляция), и '\\0' (нулевой символ)) должны экранироваться одинарной кавычкой, если они появляются в качестве первого символа в значении поля.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.3", + "identifier": "V1.3", + "title": "Нейтрализация", + "parent": "V1" + }, + { + "bom-ref": "V1.3.1", + "identifier": "V1.3.1", + "text": "Убедитесь, что все ненадежные входные данные HTML из редакторов WYSIWYG или аналогичных программ нейтрализуются с помощью известных и безопасных библиотек или функций фреймворка для санитизации HTML.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.2", + "identifier": "V1.3.2", + "text": "Убедитесь, что приложение избегает использования eval() или других динамических функций выполнения кода, таких как Spring Expression Language (SpEL). Если нет альтернативы, любой пользовательский ввод должен быть нейтрализован перед выполнением.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.3", + "identifier": "V1.3.3", + "text": "Убедитесь, что данные, передаваемые в потенциально опасный контекст, предварительно нейтрализованы, чтобы обеспечить соблюдение мер безопасности, таких как разрешение только тех символов, которые безопасны для данного контекста, и обрезка слишком длинного ввода.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.4", + "identifier": "V1.3.4", + "text": "Убедитесь, что предоставленный пользователем файл .SVG проверен или нейтрализован, чтобы он содержал только теги и атрибуты (например, относящиеся к рисованию), которые безопасны для приложения, например, не содержат скриптов и foreignObject.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.5", + "identifier": "V1.3.5", + "text": "Убедитесь, что приложение нейтралует или отключает предоставленные пользователем скриптовые данные или выражения шаблонных языков, такие как таблицы стилей Markdown, CSS или XSL, BBCode или аналогичные.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.6", + "identifier": "V1.3.6", + "text": "Убедитесь, что приложение защищено от атак с подделкой запросов на стороне сервера (SSRF), проверяя ненадежные данные по разрешенному списку протоколов, доменов, путей и портов, а также нейтрализуя потенциально опасные символы перед использованием данных для вызова другой службы.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.7", + "identifier": "V1.3.7", + "text": "Убедитесь, что приложение защищено от атак с внедрением шаблонов (template injection), не позволяя создавать шаблоны на основе недоверенных входных данных. Если нет альтернативы, любые недоверенные входные данные, включаемые динамически во время создания шаблона, должны быть нейтрализованы или тщательно провалидированы.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.8", + "identifier": "V1.3.8", + "text": "Убедитесь, что приложение надлежащим образом нейтрализует недоверенные входные данные перед использованием в запросах Java Naming and Directory Interface (JNDI) и что JNDI настроен безопасно для предотвращения атак с использованием JNDI-инъекций.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.9", + "identifier": "V1.3.9", + "text": "Убедитесь, что приложение нейтрализует данные перед отправкой в Memcache, чтобы предотвратить атаки методом инъекций.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.10", + "identifier": "V1.3.10", + "text": "Убедитесь, что строки форматирования, которые могут быть использованы неожидаемым или вредоносным образом, нейтрализуются перед дальнейшим использованием.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.11", + "identifier": "V1.3.11", + "text": "Убедитесь, что приложение нейтрализует вводимые пользователем данные перед передачей в почтовые системы для защиты от SMTP или IMAP-инъекций.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.12", + "identifier": "V1.3.12", + "text": "Убедитесь, что регулярные выражения не содержат элементов, вызывающих экспоненциальный возврат, и убедитесь в нейтрализации недоверенных входных данных для предотвращения атак ReDoS или Runaway Regex.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.4", + "identifier": "V1.4", + "title": "Память, строки и неуправляемый код", + "parent": "V1" + }, + { + "bom-ref": "V1.4.1", + "identifier": "V1.4.1", + "text": "Убедитесь, что для обнаружения или предотвращения ситуаций переполнения стека, буфера или кучи приложение учитывает размер доступной области памяти при строковых операциях, копировании в память, в арифметике указателей и т.п.", + "parent": "V1.4" + }, + { + "bom-ref": "V1.4.2", + "identifier": "V1.4.2", + "text": "Убедитесь, что для предотвращения целочисленного переполнения применяется контроль знака, диапазона и типа допустимых входных данных.", + "parent": "V1.4" + }, + { + "bom-ref": "V1.4.3", + "identifier": "V1.4.3", + "text": "Убедитесь, что динамически выделенная память и ресурсы освобождены, а ссылки или указатели на освобожденную память удалены или установлены в значение null, чтобы предотвратить появление висячих указателей и уязвимостей, связанных с использованием памяти после освобождения.", + "parent": "V1.4" + }, + { + "bom-ref": "V1.5", + "identifier": "V1.5", + "title": "Безопасная десериализация", + "parent": "V1" + }, + { + "bom-ref": "V1.5.1", + "identifier": "V1.5.1", + "text": "Убедитесь, что приложение настраивает XML-парсеры на использование строгой конфигурации и что небезопасные функции, такие как разрешение внешних сущностей, отключены для предотвращения атак XML eXternal Entity (XXE).", + "parent": "V1.5" + }, + { + "bom-ref": "V1.5.2", + "identifier": "V1.5.2", + "text": "Убедитесь, что десериализация недоверенных данных обеспечивает безопасную обработку ввода, например, используя список разрешенных типов объектов или ограничивая типы объектов, определяемые клиентом, для предотвращения атак десериализации. Механизмы десериализации, которые явно определены как небезопасные, не должны использоваться с недоверенным вводом.", + "parent": "V1.5" + }, + { + "bom-ref": "V1.5.3", + "identifier": "V1.5.3", + "text": "Убедитесь, что различные парсеры, используемые в приложении для одного и того же типа данных (например, парсеры JSON, XML, URL), выполняют парсинг согласованным образом и используют один и тот же механизм кодирования символов, чтобы избежать таких проблем, как уязвимости взаимодействия JSON (JSON Interoperability) или различное поведение анализа URI или файлов, которые могут использоваться в атаках удаленного включения файлов (RFI) или подделки запросов на стороне сервера (SSRF).", + "parent": "V1.5" + }, + { + "bom-ref": "V2", + "identifier": "V2", + "title": "Валидация и бизнес-логика" + }, + { + "bom-ref": "V2.1", + "identifier": "V2.1", + "title": "Документация валидации и бизнес-логики", + "parent": "V2" + }, + { + "bom-ref": "V2.1.1", + "identifier": "V2.1.1", + "text": "Убедитесь, что в документации приложения определены правила проверки входных данных на соответствие ожидаемой структуре. Это могут быть распространённые форматы данных, такие как номера кредитных карт, адреса электронной почты, номера телефонов, или внутренний формат данных.", + "parent": "V2.1" + }, + { + "bom-ref": "V2.1.2", + "identifier": "V2.1.2", + "text": "Убедитесь, что в документации приложения указано, как проверять логическую и контекстную согласованность объединенных данных, например, проверять соответствие района и почтового индекса.", + "parent": "V2.1" + }, + { + "bom-ref": "V2.1.3", + "identifier": "V2.1.3", + "text": "Убедитесь, что ожидания относительно ограничений и проверок бизнес-логики задокументированы как для уровня отдельного пользователя, так и для глобального уровня всего приложения.", + "parent": "V2.1" + }, + { + "bom-ref": "V2.2", + "identifier": "V2.2", + "title": "Валидация ввода", + "parent": "V2" + }, + { + "bom-ref": "V2.2.1", + "identifier": "V2.2.1", + "text": "Убедитесь, что входные данные провалидированы для обеспечения соответствия бизнес- или функциональным ожиданиям. Валидация должна осуществляться либо по списку допустимых значений, шаблонов и диапазонов, либо путем сравнения входных данных с ожидаемой структурой и логическими ограничениями в соответствии с предопределенными правилами. Для L1 валидация может быть сосредоточена на входных данных, используемых для принятия конкретных бизнес-решений или решений, связанных с безопасностью. Для L2 и выше это должно применяться ко всем входным данным.", + "parent": "V2.2" + }, + { + "bom-ref": "V2.2.2", + "identifier": "V2.2.2", + "text": "Убедитесь, что приложение разработано с принудительной валидацией входных данных на уровне доверенного сервиса. Хотя проверка на стороне клиента повышает удобство использования и должна поощряться, на неё не следует полагаться как на средство контроля безопасности.", + "parent": "V2.2" + }, + { + "bom-ref": "V2.2.3", + "identifier": "V2.2.3", + "text": "Убедитесь, что приложение обеспечивает обоснованность комбинаций данных в соответствии с предопределенными правилам. Например: возраст должен соответствовать дате рождения; страна и почтовый индекс; количество товара в заказе и на складе.", + "parent": "V2.2" + }, + { + "bom-ref": "V2.3", + "identifier": "V2.3", + "title": "Безопасность бизнес-логики", + "parent": "V2" + }, + { + "bom-ref": "V2.3.1", + "identifier": "V2.3.1", + "text": "Убедитесь, что приложение обрабатывает потоки бизнес-логики для одного и того же пользователя в ожидаемом последовательном порядке шагов и без пропуска шагов.", + "parent": "V2.3" + }, + { + "bom-ref": "V2.3.2", + "identifier": "V2.3.2", + "text": "Убедитесь, что ограничения бизнес-логики реализованы в соответствии с документацией приложения, чтобы избежать эксплуатации её недостатков.", + "parent": "V2.3" + }, + { + "bom-ref": "V2.3.3", + "identifier": "V2.3.3", + "text": "Убедитесь, что транзакции используются на уровне бизнес-логики таким образом, что операция бизнес-логики либо выполняется полностью, либо откатывается к предыдущему корректному состоянию.", + "parent": "V2.3" + }, + { + "bom-ref": "V2.3.4", + "identifier": "V2.3.4", + "text": "Убедитесь, что на уровне бизнес-логики используются механизмы блокировки, чтобы гарантировать невозможность двойного бронирования ограниченных по количеству ресурсов (например, мест в театре или слотов доставки) путем манипулирования логикой приложения.", + "parent": "V2.3" + }, + { + "bom-ref": "V2.3.5", + "identifier": "V2.3.5", + "text": "Убедитесь, что для важных потоков бизнес-логики требуется многопользовательское (multi-user) одобрение, чтобы предотвратить несанкционированные или случайные действия. Потоки бизнес-логики могут включать, помимо прочего, крупные денежные переводы, утверждение контрактов, доступ к секретной информации или обход ограничений безопасности на производстве.", + "parent": "V2.3" + }, + { + "bom-ref": "V2.4", + "identifier": "V2.4", + "title": "Анти-автоматизация", + "parent": "V2" + }, + { + "bom-ref": "V2.4.1", + "identifier": "V2.4.1", + "text": "Убедитесь, что используются средства противодействия автоматизации для защиты от чрезмерных вызовов функций приложения, которые могут привести к утечке данных, созданию ненужных данных, исчерпанию квот, нарушению ограничений скорости, отказу в обслуживании или чрезмерному использованию дорогостоящих ресурсов.", + "parent": "V2.4" + }, + { + "bom-ref": "V2.4.2", + "identifier": "V2.4.2", + "text": "Убедитесь, что потоки бизнес-логики требуют реалистичного человеческого времени, предотвращая чрезмерно быструю отправку транзакций.", + "parent": "V2.4" + }, + { + "bom-ref": "V3", + "identifier": "V3", + "title": "Безопасность веб-интерфейса" + }, + { + "bom-ref": "V3.1", + "identifier": "V3.1", + "title": "Документация по безопасности веб-интерфейса", + "parent": "V3" + }, + { + "bom-ref": "V3.1.1", + "identifier": "V3.1.1", + "text": "Убедитесь, что в документации приложения описаны ожидаемые функции безопасности, которые должны поддерживать браузеры, использующие приложение (такие как HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) и другие соответствующие механизмы безопасности HTTP). В документации также должно быть обязательно определено, как приложение должно себя вести, если некоторые из этих функций недоступны (например, предупреждать пользователя или блокировать доступ).", + "parent": "V3.1" + }, + { + "bom-ref": "V3.2", + "identifier": "V3.2", + "title": "Непреднамеренная интерпретация контента", + "parent": "V3" + }, + { + "bom-ref": "V3.2.1", + "identifier": "V3.2.1", + "text": "Убедитесь, что реализованы меры безопасности, предотвращающие отображение контента или функций браузерами в HTTP-ответах в некорректном контексте (например, запрос API, загруженный пользователем файл или другой ресурс запрашивается напрямую). Возможные способы контроля включают: не обрабатывать содержимое, если поля заголовка HTTP-запроса (например, Sec-Fetch-*) не указывают на корректность контекста; использование заголовка и значения Content-Security-Policy: sandbox directive; или использование заголовка и значения Content-Disposition: attachment.", + "parent": "V3.2" + }, + { + "bom-ref": "V3.2.2", + "identifier": "V3.2.2", + "text": "Убедитесь, что данные, предназначенные для отображения в виде текста, а не визуализации в виде HTML, обрабатывается с использованием безопасных функций визуализации (таких как createTextNode или textContent), чтобы предотвратить непреднамеренное выполнение содержимого, такого как HTML или JavaScript.", + "parent": "V3.2" + }, + { + "bom-ref": "V3.2.3", + "identifier": "V3.2.3", + "text": "Убедитесь, что приложение избегает затирания DOM при использовании JavaScript на стороне клиента, применяя явные объявления переменных, выполняя строгую проверку типов, избегая сохранения глобальных переменных в объекте документа и реализуя изоляцию пространства имен.", + "parent": "V3.2" + }, + { + "bom-ref": "V3.3", + "identifier": "V3.3", + "title": "Настройка файлов cookie", + "parent": "V3" + }, + { + "bom-ref": "V3.3.1", + "identifier": "V3.3.1", + "text": "Убедитесь, что у файлов cookie установлен атрибут «Secure», и если префикс «__Host‑» не используется в названии cookie, необходимо использовать префикс «__Secure‑».", + "parent": "V3.3" + }, + { + "bom-ref": "V3.3.2", + "identifier": "V3.3.2", + "text": "Убедитесь, что значение атрибута SameSite каждой cookie установлено в соответствии с назначением cookie, чтобы ограничить подверженность атакам на восстановление пользовательского интерфейса и атакам с подделкой запросов на уровне браузера, обычно называемым подделкой межсайтовых запросов (CSRF).", + "parent": "V3.3" + }, + { + "bom-ref": "V3.3.3", + "identifier": "V3.3.3", + "text": "Убедитесь, что cookie имеют префикс «__Host‑» в названии, если только они явно не предназначены для совместного использования с другими хостами.", + "parent": "V3.3" + }, + { + "bom-ref": "V3.3.4", + "identifier": "V3.3.4", + "text": "Убедитесь, что если значение cookie не должно быть доступно для клиентских скриптов (например, сессионный токен), для cookie должен быть установлен атрибут «HttpOnly», а само значение должно передаваться клиенту только через поле заголовка «Set-Cookie».", + "parent": "V3.3" + }, + { + "bom-ref": "V3.3.5", + "identifier": "V3.3.5", + "text": "Убедитесь, что при записи cookie приложением общая длина имени и значения cookie не превышает 4096 байт. Слишком большие cookie не будут сохраняться браузером и, следовательно, не будут отправляться с запросами, что помешает пользователю использовать функции приложения, зависящие от этого cookie.", + "parent": "V3.3" + }, + { + "bom-ref": "V3.4", + "identifier": "V3.4", + "title": "Заголовки механизма безопасности браузера", + "parent": "V3" + }, + { + "bom-ref": "V3.4.1", + "identifier": "V3.4.1", + "text": "Убедитесь, что поле заголовка Strict‑Transport‑Security включено во все ответы для реализации политики HTTP Strict Transport Security (HSTS). Необходимо указать максимальное время не менее 1 года, а для L2 и выше политика должна применяться также ко всем поддоменам.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.2", + "identifier": "V3.4.2", + "text": "Убедитесь, что поле заголовка Cross‑Origin Resource Sharing (CORS) «Access‑Control‑Allow‑Origin» имеет фиксированное значение, заданное приложением, или, если используется заголовок Origin, оно проверяется по списку доверенных источников. При необходимости использования «Access‑Control‑Allow‑Origin: *» убедитесь, что ответ не содержит конфиденциальной информации.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.3", + "identifier": "V3.4.3", + "text": "Убедитесь, что HTTP-ответы содержат поле заголовка Content-Security-Policy, которое определяет директивы, гарантирующие загрузку и выполнение браузером только доверенного контента или ресурсов, чтобы ограничить выполнение вредоносного JavaScript. Как минимум, необходимо использовать глобальную политику, включающую директивы object-src «none» и base-uri «none», а также определяющую список разрешенных адресов или использующую одноразовые коды или хэши. Для приложений L3 необходимо определить политику использования 'nonce' или hash-конструкций для каждого ответа.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.4", + "identifier": "V3.4.4", + "text": "Убедитесь, что все HTTP-ответы содержат поле заголовка «X‑Content‑Type‑Options: nosniff». Это предписывает браузерам не использовать анализ контента и определение типа MIME для данного ответа, а также требовать, чтобы значение поля заголовка Content‑Type в ответе соответствовало целевому ресурсу. Например, ответ на запрос стиля принимается только в том случае, если Content‑Type в ответе — «text/css». Это также позволяет браузеру использовать функцию Cross‑Origin Read Blocking (CORB).", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.5", + "identifier": "V3.4.5", + "text": "Убедитесь, что приложение устанавливает политику реферера для предотвращения утечки технически конфиденциальных данных сторонним сервисам через поле заголовка HTTP-запроса «Referer». Это можно сделать с помощью поля заголовка HTTP-ответа «Referrer‑Policy» или через атрибуты HTML-элемента. Конфиденциальные данные могут включать путь и данные запроса в URL-адресе, а для внутренних непубличных приложений также имя хоста.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.6", + "identifier": "V3.4.6", + "text": "Убедитесь, что веб-приложение использует директиву frame‑ancestors поля заголовка Content‑Security‑Policy для каждого HTTP-ответа, чтобы гарантировать невозможность его внедрения по умолчанию и внедрение определённых ресурсов разрешено только при необходимости. Обратите внимание, что поле заголовка X‑Frame‑Options, хотя и поддерживается браузерами, устарело и не может быть использовано в качестве основы.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.7", + "identifier": "V3.4.7", + "text": "Убедитесь, что в поле заголовка Content‑Security‑Policy указано место, куда следует сообщать о нарушениях.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.8", + "identifier": "V3.4.8", + "text": "Убедитесь, что все HTTP-ответы, инициирующие рендеринг документа (например, ответы с типом содержимого text/html), включают поле заголовка Cross-Origin-Opener-Policy с директивой same-origin или same-origin-allow-popups (при необходимости). Это предотвращает атаки, злоупотребляющие общим доступом к объектам Window, такие как Tabnabbing и Frame Counting.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.5", + "identifier": "V3.5", + "title": "Браузерное разделение источников", + "parent": "V3" + }, + { + "bom-ref": "V3.5.1", + "identifier": "V3.5.1", + "text": "Убедитесь, что, если приложение не использует механизм предварительной проверки CORS для предотвращения запрещённых кросс-доменных запросов на использование чувствительного функционала, эти запросы валидируются на предмет их происхождения от самого приложения. Это можно сделать, используя и проверяя специальные токены для защиты от подделки или требуя дополнительные поля HTTP-заголовка, не входящие в список «простых заголовков» (CORS-safelisted request-header). Это необходимо для защиты от атак с подделкой запросов через браузер, широко известных как межсайтовая подделка запросов (CSRF).", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.2", + "identifier": "V3.5.2", + "text": "Убедитесь, что если приложение использует механизм предварительной проверки CORS для предотвращения неразрешённого использования чувствительного функционала между источниками, вызов этого функционала невозможен с помощью запроса, который не запускает предварительную проверку CORS. Для этого может потребоваться проверка значений полей заголовка запроса «Origin» и «Content-Type» или использование дополнительного поля заголовка, не входящего в безопасный список CORS.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.3", + "identifier": "V3.5.3", + "text": "Убедитесь, что HTTP-запросы к чувствительному функционалу используют соответствующие HTTP-методы, такие как POST, PUT, PATCH или DELETE, а не методы, определённые спецификацией HTTP как «безопасные», такие как HEAD, OPTIONS или GET. В качестве альтернативы можно использовать строгую валидацию полей заголовка запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, навигационного запроса или загрузки ресурса (например, источника изображения), где это не ожидается.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.4", + "identifier": "V3.5.4", + "text": "Убедитесь, что отдельные приложения размещены на разных именах хостов, чтобы использовать ограничения, предусмотренные политикой same-origin, включая то, как документы или скрипты, загруженные одним источником, могут взаимодействовать с ресурсами из другого источника, а также ограничения на cookie на основе имени хоста.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.5", + "identifier": "V3.5.5", + "text": "Убедитесь, что сообщения, полученные интерфейсом postMessage, отвергаются, если источник сообщения не является доверенным или если синтаксис сообщения недействителен.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.6", + "identifier": "V3.5.6", + "text": "Убедитесь, что функциональность JSONP не включена нигде в приложении, чтобы избежать атак с использованием межсайтового включения скриптов (XSSI).", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.7", + "identifier": "V3.5.7", + "text": "Убедитесь, что данные, требующие авторизации, не включены в ответы ресурсов скриптов, таких как файлы JavaScript, чтобы предотвратить атаки с использованием межсайтового включения скриптов (XSSI).", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.8", + "identifier": "V3.5.8", + "text": "Убедитесь, что аутентифицированные ресурсы (такие как изображения, видео, скрипты и другие документы) могут быть загружены или внедрены от имени пользователя только по назначению. Этого можно добиться путём строгой валидации полей заголовка HTTP-запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, или путём установки ограничительного поля заголовка HTTP-ответа Cross‑Origin‑Resource‑Policy, чтобы браузер блокировал возвращаемый контент.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.6", + "identifier": "V3.6", + "title": "Целостность внешних ресурсов", + "parent": "V3" + }, + { + "bom-ref": "V3.6.1", + "identifier": "V3.6.1", + "text": "Убедитесь, что клиентские ресурсы, такие как библиотеки JavaScript, CSS или веб-шрифты, размещаются только на внешнем сервере (например, в сети доставки контента (Content Delivery Network)), если ресурс статический и имеет версии, а для проверки целостности ресурса используется механизм проверки целостности подресурсов (SRI). Если это невозможно, для каждого ресурса должно быть задокументировано решение по безопасности, обосновывающее это.", + "parent": "V3.6" + }, + { + "bom-ref": "V3.7", + "identifier": "V3.7", + "title": "Другие соображения по безопасности браузера", + "parent": "V3" + }, + { + "bom-ref": "V3.7.1", + "identifier": "V3.7.1", + "text": "Убедитесь, что приложение использует только те клиентские технологии, которые по-прежнему поддерживаются и считаются безопасными. Примерами технологий, не соответствующих этому требованию, являются плагины NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL или клиентские Java-апплеты.", + "parent": "V3.7" + }, + { + "bom-ref": "V3.7.2", + "identifier": "V3.7.2", + "text": "Убедитесь, что приложение будет автоматически перенаправлять пользователя на другое имя хоста или домен (который не контролируется приложением), только если этот хост или домен указаны в списке разрешенных.", + "parent": "V3.7" + }, + { + "bom-ref": "V3.7.3", + "identifier": "V3.7.3", + "text": "Убедитесь, что приложение отображает уведомление, что пользователь перенаправляется на URL-адрес, находящийся вне контроля приложения, с возможностью отмены навигации.", + "parent": "V3.7" + }, + { + "bom-ref": "V3.7.4", + "identifier": "V3.7.4", + "text": "Убедитесь, что домен верхнего уровня приложения (например, site.tld) ​​добавлен в публичный список предварительной загрузки (preload list) для HTTP Strict Transport Security (HSTS). Это гарантирует, что использование TLS для приложения будет встроено непосредственно в основные браузеры, а не будет полагаться только на поле заголовка ответа Strict-Transport-Security.", + "parent": "V3.7" + }, + { + "bom-ref": "V3.7.5", + "identifier": "V3.7.5", + "text": "Убедитесь, что приложение ведет себя так, как описано в документации (например, предупреждает пользователя или блокирует доступ), если браузер, используемый для доступа к приложению, не поддерживает ожидаемые функции безопасности.", + "parent": "V3.7" + }, + { + "bom-ref": "V4", + "identifier": "V4", + "title": "API и Веб-сервис" + }, + { + "bom-ref": "V4.1", + "identifier": "V4.1", + "title": "Общая безопасность веб-сервисов", + "parent": "V4" + }, + { + "bom-ref": "V4.1.1", + "identifier": "V4.1.1", + "text": "Убедитесь, что каждый HTTP-ответ с телом сообщения содержит заголовок Content-Type, который соответствует фактическому содержимому ответа, таким как «text/», «/+xml» и «/xml», включая параметр charset для указания безопасной кодировки символов (например, UTF-8, ISO-8859-1) согласно IANA Media Types.", + "parent": "V4.1" + }, + { + "bom-ref": "V4.1.2", + "identifier": "V4.1.2", + "text": "Убедитесь, что только конечные точки, предназначенные для взаимодействия с пользователем через веб-браузер, автоматически перенаправляют HTTP на HTTPS, в то время как другие сервисы или конечные точки не реализуют прозрачные редиректы. Это необходимо, чтобы избежать ситуации, когда клиент ошибочно отправляет незашифрованные HTTP-запросы а из-за того, что запрос по HTTP автоматически перенаправляется на HTTPS другим сервисом без обработки на входе, утечка чувствительных данных остаётся незамеченной.", + "parent": "V4.1" + }, + { + "bom-ref": "V4.1.3", + "identifier": "V4.1.3", + "text": "Убедитесь, что любой HTTP-заголовок, используемый приложением и устанавливаемый промежуточным уровнем, таким как балансировщик нагрузки, веб-прокси или backend-for-frontend сервис, не может быть переопределён конечным пользователем. Примеры заголовков: X-Real-IP, X-Forwarded-*, X-User-ID.", + "parent": "V4.1" + }, + { + "bom-ref": "V4.1.4", + "identifier": "V4.1.4", + "text": "Убедитесь, что разрешены только HTTP-методы, которые явно поддерживаются приложением или его API (включая OPTIONS для preflight-запросов), а неиспользуемые методы заблокированы.", + "parent": "V4.1" + }, + { + "bom-ref": "V4.1.5", + "identifier": "V4.1.5", + "text": "Убедитесь, что для особо чувствительных запросов или транзакций, проходящих через несколько систем, используются цифровые подписи на уровне сообщений, дополнительно к транспортным средствам защиты.", + "parent": "V4.1" + }, + { + "bom-ref": "V4.2", + "identifier": "V4.2", + "title": "Валидация структуры HTTP-сообщений", + "parent": "V4" + }, + { + "bom-ref": "V4.2.1", + "identifier": "V4.2.1", + "text": "Убедитесь, что все компоненты приложения (включая балансировщики нагрузки, файрволы и серверы приложений) определяют границы входящих HTTP-сообщений с использованием механизма, соответствующего версии HTTP, чтобы предотвратить HTTP request smuggling. В HTTP/1.x, если присутствует заголовок Transfer-Encoding, заголовок Content-Length должен игнорироваться согласно RFC 2616. При использовании HTTP/2 или HTTP/3, если присутствует Content-Length, веб-сервер должен убедиться, что он совпадает с длиной DATA-фреймов.", + "parent": "V4.2" + }, + { + "bom-ref": "V4.2.2", + "identifier": "V4.2.2", + "text": "Убедитесь, что при генерации HTTP-сообщений заголовок Content-Length не конфликтует с длиной содержимого, определяемой рамками протокола HTTP, чтобы предотвратить HTTP Request Smuggling.", + "parent": "V4.2" + }, + { + "bom-ref": "V4.2.3", + "identifier": "V4.2.3", + "text": "Убедитесь, что приложение не отправляет и не принимает HTTP/2 и HTTP/3 сообщения с заголовками, специфичными для соединения, такими как Transfer-Encoding, чтобы предотвратить HTTP Response Splitting и HTTP Header Injection.", + "parent": "V4.2" + }, + { + "bom-ref": "V4.2.4", + "identifier": "V4.2.4", + "text": "Убедитесь, что приложение принимает HTTP/2 и HTTP/3 запросы только в случае, если поля заголовков и их значения не содержат последовательностей CR (\\r), LF (\\n) или CRLF (\\r\\n), чтобы предотвратить HTTP Header Injection.", + "parent": "V4.2" + }, + { + "bom-ref": "V4.2.5", + "identifier": "V4.2.5", + "text": "Убедитесь, что если приложение (бекенд или фронтенд) формирует и отправляет запросы, оно использует валидацию, очистку или другие механизмы, чтобы не создавать URI (например, для API-вызовов) или HTTP-заголовки (например, Authorization или Cookie) слишком большой длины, чтобы их не принимал приёмник. Это может привести к отказу в обслуживании, например, при отправке слишком длинного запроса (длинный cookie-заголовок), из-за чего сервер постоянно возвращает ошибку.", + "parent": "V4.2" + }, + { + "bom-ref": "V4.3", + "identifier": "V4.3", + "title": "GraphQL", + "parent": "V4" + }, + { + "bom-ref": "V4.3.1", + "identifier": "V4.3.1", + "text": "Убедитесь, что используется белый список запросов, ограничение глубины вложенности, ограничение количества или анализ стоимости запроса, чтобы предотвратить DoS-атаки на уровне GraphQL или слоя данных из-за дорогостоящих вложенных запросов.", + "parent": "V4.3" + }, + { + "bom-ref": "V4.3.2", + "identifier": "V4.3.2", + "text": "Убедитесь, что introspection-запросы GraphQL отключены в продакшен-среде, если GraphQL API не предназначен для использования сторонними клиентами.", + "parent": "V4.3" + }, + { + "bom-ref": "V4.4", + "identifier": "V4.4", + "title": "WebSocket", + "parent": "V4" + }, + { + "bom-ref": "V4.4.1", + "identifier": "V4.4.1", + "text": "Убедитесь, что для всех WebSocket-соединений используется WebSocket поверх TLS (WSS).", + "parent": "V4.4" + }, + { + "bom-ref": "V4.4.2", + "identifier": "V4.4.2", + "text": "Убедитесь, что при первоначальном HTTP WebSocket handshake заголовок Origin проверяется на соответствие списку разрешённых источников для приложения.", + "parent": "V4.4" + }, + { + "bom-ref": "V4.4.3", + "identifier": "V4.4.3", + "text": "Убедитесь, что если стандартное управление сессиями приложения не может быть использовано, применяются специальные токены, соответствующие требованиям безопасности управления сессиями.", + "parent": "V4.4" + }, + { + "bom-ref": "V4.4.4", + "identifier": "V4.4.4", + "text": "Убедитесь, что специальные токены управления сессиями WebSocket изначально получаются или валидируются через ранее аутентифицированную HTTPS-сессию при переходе от HTTPS к WebSocket.", + "parent": "V4.4" + }, + { + "bom-ref": "V5", + "identifier": "V5", + "title": "Работа с файлами" + }, + { + "bom-ref": "V5.1", + "identifier": "V5.1", + "title": "Документация по работе с файлами", + "parent": "V5" + }, + { + "bom-ref": "V5.1.1", + "identifier": "V5.1.1", + "text": "Убедитесь, что документация определяет допустимые типы файлов, ожидаемые расширения и максимальный размер (включая распакованный размер) для каждой функции загрузки. Также убедитесь, что в документации указано, как файлы обезвреживаются для конечных пользователей (например, как приложение ведёт себя при обнаружении вредоносного файла).", + "parent": "V5.1" + }, + { + "bom-ref": "V5.2", + "identifier": "V5.2", + "title": "Загрузка файлов и содержимое", + "parent": "V5" + }, + { + "bom-ref": "V5.2.1", + "identifier": "V5.2.1", + "text": "Убедитесь, что приложение принимает только те файлы, которые может обработать без потери производительности или отказа в обслуживании.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.2.2", + "identifier": "V5.2.2", + "text": "Убедитесь, что при загрузке файла (включая файлы внутри архивов, таких как ZIP) приложение проверяет, соответствует ли расширение ожидаемому, и валидирует, соответствует ли содержимое типу, указанному в расширении. Это включает проверку начальных 'magic bytes', перезапись изображений, использование специализированных библиотек. Для уровня 1 — достаточно проверок для файлов, критичных с точки зрения бизнеса или безопасности. Для уровней 2 и выше — для всех файлов.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.2.3", + "identifier": "V5.2.3", + "text": "Убедитесь, что приложение проверяет архивы (например, zip, gz, docx, odt) на максимально допустимый распакованный размер и максимальное количество файлов до распаковки.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.2.4", + "identifier": "V5.2.4", + "text": "Убедитесь, что для каждого пользователя установлены квоты на общий размер и количество файлов, чтобы один пользователь не мог переполнить хранилище.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.2.5", + "identifier": "V5.2.5", + "text": "Убедитесь, что приложение не позволяет загружать архивы с символьными ссылками (symlinks), если это не требуется по бизнес-логике. Если требуется — разрешён только строго определённый список допустимых символьных ссылок.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.2.6", + "identifier": "V5.2.6", + "text": "Убедитесь, что приложение отклоняет изображения с числом пикселей выше допустимого, чтобы предотвратить атаки 'pixel flood'.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.3", + "identifier": "V5.3", + "title": "Хранение файлов", + "parent": "V5" + }, + { + "bom-ref": "V5.3.1", + "identifier": "V5.3.1", + "text": "Убедитесь, что загруженные или сгенерированные из недоверенного ввода файлы, находящиеся в публичной директории, не исполняются как серверный код при обращении к ним по HTTP.", + "parent": "V5.3" + }, + { + "bom-ref": "V5.3.2", + "identifier": "V5.3.2", + "text": "Убедитесь, что при создании путей к файлам приложение использует внутренние или доверенные данные, а не пользовательские имена файлов. Если использование пользовательских имён или метаданных необходимо — требуется строгая проверка и очистка. Это защита от path traversal, LFI, RFI и SSRF.", + "parent": "V5.3" + }, + { + "bom-ref": "V5.3.3", + "identifier": "V5.3.3", + "text": "Убедитесь, что при обработке файлов на сервере (например, при распаковке) игнорируются пути, заданные пользователем, во избежание уязвимостей типа 'zip slip'.", + "parent": "V5.3" + }, + { + "bom-ref": "V5.4", + "identifier": "V5.4", + "title": "Скачивание файлов", + "parent": "V5" + }, + { + "bom-ref": "V5.4.1", + "identifier": "V5.4.1", + "text": "Убедитесь, что приложение валидирует или игнорирует имена файлов, переданных пользователем (включая в JSON, JSONP или URL-параметре), и указывает имя файла в заголовке Content-Disposition при ответе.", + "parent": "V5.4" + }, + { + "bom-ref": "V5.4.2", + "identifier": "V5.4.2", + "text": "Убедитесь, что имена файлов, передаваемые (например, в HTTP-заголовках или вложениях в email), кодируются или очищаются (например, по RFC 6266), чтобы сохранить структуру документа и предотвратить инъекции.", + "parent": "V5.4" + }, + { + "bom-ref": "V5.4.3", + "identifier": "V5.4.3", + "text": "Убедитесь, что файлы, полученные из недоверенных источников, сканируются антивирусом, чтобы не распространять известное вредоносное содержимое.", + "parent": "V5.4" + }, + { + "bom-ref": "V6", + "identifier": "V6", + "title": "Аутентификация" + }, + { + "bom-ref": "V6.1", + "identifier": "V6.1", + "title": "Документация по аутентификации", + "parent": "V6" + }, + { + "bom-ref": "V6.1.1", + "identifier": "V6.1.1", + "text": "Убедитесь, что в документации приложения описано, как используются механизмы, такие как ограничение частоты запросов (rate limiting), защита от автоматизации и адаптивные реакции, для защиты от атак, таких как подстановка учётных данных и перебор паролей. Документация должна ясно описывать конфигурацию этих механизмов и предотвращение злонамеренной блокировки аккаунтов.", + "parent": "V6.1" + }, + { + "bom-ref": "V6.1.2", + "identifier": "V6.1.2", + "text": "Убедитесь, что задокументирован список контекстно-зависимых слов, запрещённых к использованию в паролях. В него могут входить производные от названий организаций, продуктов, идентификаторов систем, кодовых названий проектов, названий отделов или ролей и тому подобное.", + "parent": "V6.1" + }, + { + "bom-ref": "V6.1.3", + "identifier": "V6.1.3", + "text": "Убедитесь, что если приложение поддерживает несколько способов аутентификации, то все они документированы вместе с описанием применяемых средств защиты и уровнем стойкости аутентификации, которые должны быть одинаково применены ко всем способам.", + "parent": "V6.1" + }, + { + "bom-ref": "V6.2", + "identifier": "V6.2", + "title": "Безопасность паролей", + "parent": "V6" + }, + { + "bom-ref": "V6.2.1", + "identifier": "V6.2.1", + "text": "Убедитесь, что пользовательские пароли содержат не менее 8 символов. Рекомендуется минимальная длина в 15 символов.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.2", + "identifier": "V6.2.2", + "text": "Убедитесь, что пользователи могут менять свои пароли.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.3", + "identifier": "V6.2.3", + "text": "Убедитесь, что для смены пароля требуется ввести как текущий, так и новый пароль.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.4", + "identifier": "V6.2.4", + "text": "Убедитесь, что при регистрации или смене пароля введённый пароль проверяется по списку как минимум из 3000 самых популярных паролей, соответствующих политике (например, минимальной длине).", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.5", + "identifier": "V6.2.5", + "text": "Убедитесь, что допускаются пароли любой структуры, без ограничений на использование определённых символов. Не должно быть требований по обязательному наличию заглавных/строчных букв, цифр или специальных символов.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.6", + "identifier": "V6.2.6", + "text": "Убедитесь, что поля ввода пароля используют type=password для скрытия символов. Разрешено временное отображение всего пароля или последнего введённого символа.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.7", + "identifier": "V6.2.7", + "text": "Убедитесь, что разрешены вставка (paste), использование менеджеров паролей браузера и внешних менеджеров паролей.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.8", + "identifier": "V6.2.8", + "text": "Убедитесь, что пароль проверяется строго в том виде, в котором он был введён пользователем — без обрезки, изменения регистра и других модификаций.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.9", + "identifier": "V6.2.9", + "text": "Убедитесь, что система позволяет использовать пароли длиной не менее 64 символов.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.10", + "identifier": "V6.2.10", + "text": "Убедитесь, что пароль остаётся действительным, пока не будет скомпрометирован или не будет изменён пользователем. Приложение не должно требовать регулярной смены пароля.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.11", + "identifier": "V6.2.11", + "text": "Убедитесь, что используется документированный список контекстно-зависимых слов (например, названия компаний, проектов и т.д.) для предотвращения использования легко угадываемых паролей.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.12", + "identifier": "V6.2.12", + "text": "Убедитесь, что при регистрации или смене пароля проверяется, не входит ли он в список скомпрометированных (утёкших) паролей.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.3", + "identifier": "V6.3", + "title": "Общие требования к безопасности аутентификации", + "parent": "V6" + }, + { + "bom-ref": "V6.3.1", + "identifier": "V6.3.1", + "text": "Убедитесь, что реализованы меры защиты от атак типа credential stuffing (массовая подстановка учётных данных) и brute-force (перебор паролей), согласно документации по безопасности приложения.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.2", + "identifier": "V6.3.2", + "text": "Убедитесь, что в приложении отсутствуют или отключены учётные записи по умолчанию (например, root, admin, sa).", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.3", + "identifier": "V6.3.3", + "text": "Убедитесь, что для доступа к приложению используется либо механизм многофакторной аутентификации, либо комбинация однофакторных. Для уровня L3 один из факторов должен быть аппаратным, обеспечивающим защиту от фишинга, устойчивость к компрометации и подтверждение намерения аутентификации через явное действие пользователя (например, нажатие кнопки на FIDO-ключе или телефоне). Ослабление этих требований допускается только при наличии обоснования и компенсирующих мер.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.4", + "identifier": "V6.3.4", + "text": "Убедитесь, что при наличии нескольких способов аутентификации, они все задокументированы, и для них единообразно применяются меры защиты и уровни доверия.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.5", + "identifier": "V6.3.5", + "text": "Убедитесь, что пользователи получают уведомления о подозрительных попытках аутентификации (удачных и неудачных). Это может включать попытки (например, подключения) с необычного устройства или места, частично успешную MFA, попытку после долгого отсутствия или успешную аутентификацию после серии неудачных.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.6", + "identifier": "V6.3.6", + "text": "Убедитесь, что email не используется ни как однофакторный, ни как многофакторный механизм аутентификации.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.7", + "identifier": "V6.3.7", + "text": "Убедитесь, что пользователи получают уведомление при изменении данных аутентификации, таких как сброс пароля или изменение логина/email.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.8", + "identifier": "V6.3.8", + "text": "Убедитесь, что из сообщений об ошибке, HTTP-кодов ответа или различий во времени ответа нельзя определить, существует ли пользователь с таким логином. Это правило также должно применяться к функциям регистрации и восстановления пароля.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.4", + "identifier": "V6.4", + "title": "Жизненный цикл и восстановление факторов аутентификации", + "parent": "V6" + }, + { + "bom-ref": "V6.4.1", + "identifier": "V6.4.1", + "text": "Убедитесь, что начальные пароли или коды активации, генерируемые системой, создаются с использованием надёжного генератора случайных чисел, соответствуют текущей политике паролей и истекают через короткий период времени либо после первого использования. Эти секреты не должны использоваться как постоянные пароли.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.4.2", + "identifier": "V6.4.2", + "text": "Убедитесь, что в системе отсутствуют подсказки к паролю или вопросы на знание («секретные вопросы»).", + "parent": "V6.4" + }, + { + "bom-ref": "V6.4.3", + "identifier": "V6.4.3", + "text": "Убедитесь, что реализован безопасный процесс сброса забытого пароля, который не обходит активные механизмы многофакторной аутентификации.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.4.4", + "identifier": "V6.4.4", + "text": "Убедитесь, что в случае утраты одного из факторов MFA проводится удостоверение личности (identity proofing) на том же уровне, что и при первичной регистрации.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.4.5", + "identifier": "V6.4.5", + "text": "Убедитесь, что инструкции по обновлению истекающих механизмов аутентификации отправляются заранее, с достаточным запасом времени для выполнения замены, при необходимости с настройкой автоматических напоминаний.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.4.6", + "identifier": "V6.4.6", + "text": "Убедитесь, что администраторы могут инициировать процесс сброса пароля, но не могут задать или выбрать новый пароль за пользователя. Это исключает ситуацию, при которой администратор знает пароль пользователя.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.5", + "identifier": "V6.5", + "title": "Общие требования к многофакторной аутентификации", + "parent": "V6" + }, + { + "bom-ref": "V6.5.1", + "identifier": "V6.5.1", + "text": "Убедитесь, что lookup-секреты, внеполосные коды/запросы и TOTP-коды можно использовать только один раз.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.2", + "identifier": "V6.5.2", + "text": "Убедитесь, что при хранении lookup-секретов с энтропией менее 112 бит (например, 19 случайных буквенно-цифровых символов или 34 случайные цифры) они хэшируются с использованием разрешённого алгоритма хеширования паролей и случайной соли минимум 32 бита. Если у секрета ≥112 бит энтропии — допустимо использовать стандартный хэш.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.3", + "identifier": "V6.5.3", + "text": "Убедитесь, что lookup-секреты, коды внеполосной аутентификации и сиды для TOTP генерируются с использованием криптографически стойкого генератора случайных чисел (CSPRNG), чтобы избежать предсказуемых значений.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.4", + "identifier": "V6.5.4", + "text": "Убедитесь, что lookup-секреты и внеполосные коды аутентификации имеют минимум 20 бит энтропии (достаточно, например, 4 случайных алфавитно-цифровых символов или 6 случайных цифр).", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.5", + "identifier": "V6.5.5", + "text": "Убедитесь, что все внеполосные запросы, коды и токены, а также TOTP-коды имеют ограниченный срок действия. Максимум для out-of-band — 10 минут, для TOTP — 30 секунд.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.6", + "identifier": "V6.5.6", + "text": "Убедитесь, что любой фактор аутентификации (включая физические устройства) может быть отозван в случае кражи или утери.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.7", + "identifier": "V6.5.7", + "text": "Убедитесь, что биометрические механизмы аутентификации используются только как вторичный фактор — в сочетании с «чем-то, что вы знаете» или «чем-то, что у вас есть».", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.8", + "identifier": "V6.5.8", + "text": "Убедитесь, что TOTP-коды проверяются по источнику времени, полученному от доверенного сервиса, а не от клиента или недоверенного источника.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.6", + "identifier": "V6.6", + "title": "Внеполосные механизмы аутентификации", + "parent": "V6" + }, + { + "bom-ref": "V6.6.1", + "identifier": "V6.6.1", + "text": "Убедитесь, что механизмы аутентификации через телефонную сеть общего пользования (PSTN) для доставки одноразовых паролей (OTP) по телефону или SMS используются только в случае предварительной валидации номера, при этом предлагаются альтернативные более безопасные методы (например, TOTP), и пользователю сообщаются риски. Для приложений уровня L3 использование телефона и SMS недопустимо.", + "parent": "V6.6" + }, + { + "bom-ref": "V6.6.2", + "identifier": "V6.6.2", + "text": "Убедитесь, что внеполосные запросы, коды или токены привязаны к исходному запросу аутентификации, для которого они были сгенерированы, и не могут быть использованы повторно для других попыток.", + "parent": "V6.6" + }, + { + "bom-ref": "V6.6.3", + "identifier": "V6.6.3", + "text": "Убедитесь, что внеполосные механизмы на основе кода защищены от атак методом подбора (brute force) путём применения ограничения частоты запросов (rate limiting). Также рекомендуется использовать коды с энтропией не менее 64 бит.", + "parent": "V6.6" + }, + { + "bom-ref": "V6.6.4", + "identifier": "V6.6.4", + "text": "Убедитесь, что при использовании push-уведомлений для MFA применяется ограничение частоты (rate limiting), чтобы предотвратить атаки push-бомбинга. Также может помочь механизм сопоставления номеров (number matching).", + "parent": "V6.6" + }, + { + "bom-ref": "V6.7", + "identifier": "V6.7", + "title": "Криптографические механизмы аутентификации", + "parent": "V6" + }, + { + "bom-ref": "V6.7.1", + "identifier": "V6.7.1", + "text": "Убедитесь, что сертификаты, используемые для проверки криптографических утверждений об аутентификации, хранятся таким образом, чтобы исключить возможность их модификации.", + "parent": "V6.7" + }, + { + "bom-ref": "V6.7.2", + "identifier": "V6.7.2", + "text": "Убедитесь, что nonce (случайная строка), используемая в процессе вызова, имеет длину не менее 64 бит и является статистически уникальной или уникальной на протяжении всего срока службы криптографического устройства.", + "parent": "V6.7" + }, + { + "bom-ref": "V6.8", + "identifier": "V6.8", + "title": "Аутентификация с использованием провайдера идентификаций (IdP)", + "parent": "V6" + }, + { + "bom-ref": "V6.8.1", + "identifier": "V6.8.1", + "text": "Убедитесь, что при поддержке несколькими IdP, невозможно подделать личность пользователя через другой IdP (например, с тем же user ID). Стандартным способом защиты является регистрация пользователя с использованием сочетания ID самого IdP (в качестве пространства имён) и пользовательского ID внутри IdP.", + "parent": "V6.8" + }, + { + "bom-ref": "V6.8.2", + "identifier": "V6.8.2", + "text": "Убедитесь, что наличие и целостность цифровой подписи в утверждениях аутентификации (например, в JWT или SAML) всегда проверяются, а неподписанные или недействительные утверждения отклоняются.", + "parent": "V6.8" + }, + { + "bom-ref": "V6.8.3", + "identifier": "V6.8.3", + "text": "Убедитесь, что SAML-утверждения обрабатываются только один раз в течение периода их действия, чтобы исключить атаки воспроизведения (replay attacks).", + "parent": "V6.8" + }, + { + "bom-ref": "V6.8.4", + "identifier": "V6.8.4", + "text": "Убедитесь, что если приложение использует внешний поставщик идентификации (IdP) и для определенных функций требуется особый уровень, метод или срок действия аутентификации, то приложение использует данные, возвращаемые IdP, для проверки этих условий. Например, при использовании OIDC можно проверить значения полей ID Token — acr, amr, auth_time (если они есть). Если IdP не предоставляет эти данные, приложение должно иметь документированный план действий по умолчанию, предполагающий использование минимально допустимой силы аутентификации (например, одноступенчатая — логин и пароль).", + "parent": "V6.8" + }, + { + "bom-ref": "V7", + "identifier": "V7", + "title": "Управление сессиями" + }, + { + "bom-ref": "V7.1", + "identifier": "V7.1", + "title": "Документация по управлению сессиями", + "parent": "V7" + }, + { + "bom-ref": "V7.1.1", + "identifier": "V7.1.1", + "text": "Убедитесь, что тайм-аут бездействия и абсолютное максимальное время жизни сессии задокументированы, соответствуют другим контрольным мерам и сопровождаются обоснованием любых отклонений от требований повторной аутентификации NIST SP 800-63B.", + "parent": "V7.1" + }, + { + "bom-ref": "V7.1.2", + "identifier": "V7.1.2", + "text": "Убедитесь, что документация определяет допустимое количество одновременных (параллельных) сессий для одного аккаунта, а также поведение системы и действия при достижении этого лимита.", + "parent": "V7.1" + }, + { + "bom-ref": "V7.1.3", + "identifier": "V7.1.3", + "text": "Убедитесь, что все системы, создающие и управляющие сессиями пользователей в рамках федеративной идентификации (например, SSO), задокументированы вместе с механизмами координации сроков действия сессий, условий завершения и случаев, требующих повторной аутентификации.", + "parent": "V7.1" + }, + { + "bom-ref": "V7.2", + "identifier": "V7.2", + "title": "Базовая безопасность сессий", + "parent": "V7" + }, + { + "bom-ref": "V7.2.1", + "identifier": "V7.2.1", + "text": "Убедитесь, что все проверки сессионных токенов выполняются на доверенной серверной стороне.", + "parent": "V7.2" + }, + { + "bom-ref": "V7.2.2", + "identifier": "V7.2.2", + "text": "Убедитесь, что приложение использует либо автономные токены, либо ссылочные токены, которые генерируются динамически, не используя статические API-секреты или ключи.", + "parent": "V7.2" + }, + { + "bom-ref": "V7.2.3", + "identifier": "V7.2.3", + "text": "Убедитесь, что ссылочные токены являются уникальными, создаются с использованием криптографически безопасного генератора псевдослучайных чисел (CSPRNG) и обладают энтропией не менее 128 бит.", + "parent": "V7.2" + }, + { + "bom-ref": "V7.2.4", + "identifier": "V7.2.4", + "text": "Убедитесь, что при аутентификации пользователя (включая повторную) создается новый токен сессии, а текущий — аннулируется.", + "parent": "V7.2" + }, + { + "bom-ref": "V7.3", + "identifier": "V7.3", + "title": "Тайм-ауты сессии", + "parent": "V7" + }, + { + "bom-ref": "V7.3.1", + "identifier": "V7.3.1", + "text": "Убедитесь, что есть тайм-аут бездействия, после которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.", + "parent": "V7.3" + }, + { + "bom-ref": "V7.3.2", + "identifier": "V7.3.2", + "text": "Убедитесь, что установлено абсолютное максимальное время жизни сессии, по истечении которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.", + "parent": "V7.3" + }, + { + "bom-ref": "V7.4", + "identifier": "V7.4", + "title": "Завершение сессий", + "parent": "V7" + }, + { + "bom-ref": "V7.4.1", + "identifier": "V7.4.1", + "text": "Убедитесь, что после завершения сессии (logout, истечение срока) дальнейшее её использование невозможно. Для ссылочных токенов или сессий с сохранением состояния это означает аннулирование на сервере. Для self-contained токенов необходимо реализовать механизм отзыва, например, список отозванных токенов, проверку времени выпуска или ротацию ключей подписи для каждого пользователя.", + "parent": "V7.4" + }, + { + "bom-ref": "V7.4.2", + "identifier": "V7.4.2", + "text": "Убедитесь, что при удалении или отключении пользователя все активные сессии немедленно завершаются.", + "parent": "V7.4" + }, + { + "bom-ref": "V7.4.3", + "identifier": "V7.4.3", + "text": "Убедитесь, что после изменения или удаления факторов аутентификации (например, смена пароля или MFA) приложение предлагает завершить все другие активные сессии.", + "parent": "V7.4" + }, + { + "bom-ref": "V7.4.4", + "identifier": "V7.4.4", + "text": "Убедитесь, что на всех страницах, требующих аутентификации, имеется простой и видимый способ выхода.", + "parent": "V7.4" + }, + { + "bom-ref": "V7.4.5", + "identifier": "V7.4.5", + "text": "Убедитесь, что администраторы могут завершать активные сессии конкретного пользователя или всех пользователей.", + "parent": "V7.4" + }, + { + "bom-ref": "V7.5", + "identifier": "V7.5", + "title": "Защита от злоупотреблений сессией", + "parent": "V7" + }, + { + "bom-ref": "V7.5.1", + "identifier": "V7.5.1", + "text": "Убедитесь, что приложение требует полной повторной аутентификации перед изменением чувствительных атрибутов аккаунта, которые могут влиять на аутентификацию (например, email, номер телефона, настройки MFA или данных восстановления доступа).", + "parent": "V7.5" + }, + { + "bom-ref": "V7.5.2", + "identifier": "V7.5.2", + "text": "Убедитесь, что пользователь может просматривать и (после повторной аутентификации хотя бы по одному фактору) завершать активные сессии.", + "parent": "V7.5" + }, + { + "bom-ref": "V7.5.3", + "identifier": "V7.5.3", + "text": "Убедитесь, что перед выполнением критически важных операций приложение требует повторной аутентификации (по крайней мере, одного фактора) или дополнительной проверки.", + "parent": "V7.5" + }, + { + "bom-ref": "V7.6", + "identifier": "V7.6", + "title": "Федеративная повторная аутентификация", + "parent": "V7" + }, + { + "bom-ref": "V7.6.1", + "identifier": "V7.6.1", + "text": "Убедитесь, что срок действия и завершение сессий между RP и IdP соответствуют документации и включают повторную аутентификацию, если достигнут максимальный допустимый интервал между событиями аутентификации.", + "parent": "V7.6" + }, + { + "bom-ref": "V7.6.2", + "identifier": "V7.6.2", + "text": "Убедитесь, что создание сессии требует согласия пользователя или явного действия, предотвращающего несанкционированное создание сессий без участия пользователя.", + "parent": "V7.6" + }, + { + "bom-ref": "V8", + "identifier": "V8", + "title": "Авторизация" + }, + { + "bom-ref": "V8.1", + "identifier": "V8.1", + "title": "Документация по авторизации", + "parent": "V8" + }, + { + "bom-ref": "V8.1.1", + "identifier": "V8.1.1", + "text": "Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне функций и на уровне данных на основе прав субъекта и атрибутов ресурса.", + "parent": "V8.1" + }, + { + "bom-ref": "V8.1.2", + "identifier": "V8.1.2", + "text": "Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне полей (как на чтение, так и на запись) на основе прав субъекта и атрибутов ресурса. Эти правила могут зависеть от других атрибутов объекта данных, например, статуса.", + "parent": "V8.1" + }, + { + "bom-ref": "V8.1.3", + "identifier": "V8.1.3", + "text": "Убедитесь, что документация определяет, какие атрибуты окружения и контекста (например, время суток, IP-адрес, местоположение, устройство) используются приложением для принятия решений в области аутентификации и авторизации.", + "parent": "V8.1" + }, + { + "bom-ref": "V8.1.4", + "identifier": "V8.1.4", + "text": "Убедитесь, что документация по аутентификации и авторизации определяет, как используются факторы окружения и контекста в принятии решений, наряду с правилами доступа к функциям, данным и полям. Документация должна содержать оцениваемые атрибуты, пороговые значения риска, действия (разрешить, отказать, повысить уровень аутентификации и др.).", + "parent": "V8.1" + }, + { + "bom-ref": "V8.2", + "identifier": "V8.2", + "title": "Архитектура авторизации", + "parent": "V8" + }, + { + "bom-ref": "V8.2.1", + "identifier": "V8.2.1", + "text": "Убедитесь, что приложение обеспечивает доступ на уровне функций (function-level) только субъектам с явными разрешениями.", + "parent": "V8.2" + }, + { + "bom-ref": "V8.2.2", + "identifier": "V8.2.2", + "text": "Убедитесь, что приложение обеспечивает доступ на уровне данных (data-specific) только тем субъектам, которым явно предоставлены права к определённым элементам данных, чтобы предотвратить IDOR (Insecure Direct Object Reference) и BOLA-уязвимости (Broken Object Level Authorization).", + "parent": "V8.2" + }, + { + "bom-ref": "V8.2.3", + "identifier": "V8.2.3", + "text": "Убедитесь, что приложение обеспечивает доступ на уровне полей (field-level) только тем субъектам, которым явно предоставлены права к определённым полям, чтобы предотвратить BOPLA (Broken Object Property Level Authorization).", + "parent": "V8.2" + }, + { + "bom-ref": "V8.2.4", + "identifier": "V8.2.4", + "text": "Убедитесь, что реализованы адаптивные меры безопасности, основанные на атрибутах окружения и контекста субъекта (время, местоположение, IP, устройство), которые используются для принятия решений об аутентификации и авторизации, как это определено в документации приложения. Эти меры должны применяться как при попытке субъекта начать новую сессию, так и во время существующей сессии.", + "parent": "V8.2" + }, + { + "bom-ref": "V8.3", + "identifier": "V8.3", + "title": "Авторизация на уровне операций", + "parent": "V8" + }, + { + "bom-ref": "V8.3.1", + "identifier": "V8.3.1", + "text": "Убедитесь, что правила авторизации реализуются на доверенном сервисном уровне и не зависят от элементов, которые может контролировать клиент (например, JavaScript на стороне клиента).", + "parent": "V8.3" + }, + { + "bom-ref": "V8.3.2", + "identifier": "V8.3.2", + "text": "Убедитесь, что изменения значений, влияющих на авторизацию, применяются немедленно. Если это невозможно (например, при использовании автономных токенов), должны быть реализованы компенсирующие меры: оповещения о попытке несанкционированного действия и откат изменений. Обратите внимание, что данный подход не предотвращает утечку информации.", + "parent": "V8.3" + }, + { + "bom-ref": "V8.3.3", + "identifier": "V8.3.3", + "text": "Убедитесь, что доступ к объекту осуществляется на основе прав субъекта, инициировавшего запрос, а не прав промежуточного сервиса, действующего от его имени. Например, если пользователь обращается к веб-сервису с автономным токеном для аутентификации, а сервис затем запрашивает данные у другого сервиса, второй сервис должен использовать токен пользователя, а не токен первого сервиса для принятия решения о доступе.", + "parent": "V8.3" + }, + { + "bom-ref": "V8.4", + "identifier": "V8.4", + "title": "Прочие аспекты авторизации", + "parent": "V8" + }, + { + "bom-ref": "V8.4.1", + "identifier": "V8.4.1", + "text": "Убедитесь, что в мультитенантных приложениях реализованы механизмы, предотвращающие действия потребителя в отношении арендаторов, к которым у него нет доступа.", + "parent": "V8.4" + }, + { + "bom-ref": "V8.4.2", + "identifier": "V8.4.2", + "text": "Убедитесь, что доступ к административным интерфейсам защищён несколькими уровнями контроля, включая непрерывную проверку личности, контроль защищённости устройства и анализ контекстных рисков. Недостаточно опираться только на IP-адрес или доверенные устройства.", + "parent": "V8.4" + }, + { + "bom-ref": "V9", + "identifier": "V9", + "title": "Автономные токены" + }, + { + "bom-ref": "V9.1", + "identifier": "V9.1", + "title": "Источник токена и его целостность", + "parent": "V9" + }, + { + "bom-ref": "V9.1.1", + "identifier": "V9.1.1", + "text": "Убедитесь, что автономные токены проверяются на целостность с помощью цифровой подписи или MAC, прежде чем доверять их содержимому.", + "parent": "V9.1" + }, + { + "bom-ref": "V9.1.2", + "identifier": "V9.1.2", + "text": "Проверяйте, что автономные токены создаются и проверяются исключительно с помощью алгоритмов из списка допустимых в данном контексте. Список допустимых алгоритмов должен включать только разрешенные алгоритмы (желательно либо только симметричные, либо только асимметричные) и ни в коем случае не содержать алгоритм None. Если необходимо поддерживать оба типа алгоритмов, потребуются дополнительные средства контроля для предотвращения путаницы с ключами (key confusion).", + "parent": "V9.1" + }, + { + "bom-ref": "V9.1.3", + "identifier": "V9.1.3", + "text": "Убедитесь, что ключи, используемые для проверки автономных токенов, получены из доверенных, предварительно настроенных источников. Это предотвращает возможность указания злоумышленниками ненадёжных источников и ключей. Для JWT и других JWS структур заголовки 'jku', 'x5u' и 'jwk' должны проверяться по белому списку.", + "parent": "V9.1" + }, + { + "bom-ref": "V9.2", + "identifier": "V9.2", + "title": "Содержимое токена", + "parent": "V9" + }, + { + "bom-ref": "V9.2.1", + "identifier": "V9.2.1", + "text": "Убедитесь, что при указанном сроке действия токен и его содержимое принимаются только в том случае, если срок действия токена не истёк. Например, для JWT нужно проверить поля 'nbf' и 'exp'.", + "parent": "V9.2" + }, + { + "bom-ref": "V9.2.2", + "identifier": "V9.2.2", + "text": "Убедитесь, что сервис, принимающий токен, проверяет его тип и соответствие назначению перед обработкой содержимого токена. Например, для принятия решений об авторизации могут быть приняты только Access Token, а для подтверждения аутентификации пользователя — только ID Token.", + "parent": "V9.2" + }, + { + "bom-ref": "V9.2.3", + "identifier": "V9.2.3", + "text": "Убедитесь, что сервис принимает только токены, предназначенные для использования с этим сервисом (audience). Для JWT это можно сделать, проверив наличие утверждения «aud» по белому списку, определенному в сервисе.", + "parent": "V9.2" + }, + { + "bom-ref": "V9.2.4", + "identifier": "V9.2.4", + "text": "Убедитесь, что, если эмитент токенов использует один и тот же закрытый ключ для выпуска токенов различным сервисам (audiences), выпущенные токены содержат явное указание целевых сервисов. Это предотвратит повторное использования токенов в не предназначенных для них сервисах. Если идентификатор сервиса (audience identifier) назначается динамически, эмитент токенов должен проверить audiences для исключения подмены получателей (audience impersonation).", + "parent": "V9.2" + }, + { + "bom-ref": "V10", + "identifier": "V10", + "title": "OAuth и OIDC" + }, + { + "bom-ref": "V10.1", + "identifier": "V10.1", + "title": "Общие требования безопасности OAuth и OIDC", + "parent": "V10" + }, + { + "bom-ref": "V10.1.1", + "identifier": "V10.1.1", + "text": "Убедитесь, что токены передаются только тем компонентам, которым они действительно необходимы. Например, при использовании схемы backend-for-frontend для браузерных JavaScript-приложений, access и refresh токены должны быть доступны только на backend.", + "parent": "V10.1" + }, + { + "bom-ref": "V10.1.2", + "identifier": "V10.1.2", + "text": "Убедитесь, что клиент принимает значения от авторизационного сервера (например, authorization code или ID Token) только если они получены в результате авторизационного потока, инициированного в той же сессии пользовательского агента и в рамках той же транзакции. Для этого клиентские секреты, такие как proof key для code exchange (PKCE) — 'code_verifier', 'state' или OIDC 'nonce' — должны быть непредсказуемыми, специфичными для транзакции и надежно привязанными как к клиенту, так и к сессии пользовательского агента, в которой началась транзакция.", + "parent": "V10.1" + }, + { + "bom-ref": "V10.2", + "identifier": "V10.2", + "title": "Клиент OAuth", + "parent": "V10" + }, + { + "bom-ref": "V10.2.1", + "identifier": "V10.2.1", + "text": "Убедитесь, что если используется механизм authorization code flow, OAuth клиент защищён от CSRF, вызывающих запросы токенов либо за счёт использования механизма proof key for code exchange (PKCE), либо за счёт проверки параметра 'state', который был отправлен в запросе авторизации.", + "parent": "V10.2" + }, + { + "bom-ref": "V10.2.2", + "identifier": "V10.2.2", + "text": "Убедитесь, что если OAuth клиент может взаимодействовать с более чем одним сервером авторизации, у него есть защита от атак смешивания (mix-up attacks). Например, клиент должен требовать, чтобы сервер авторизации возвращал параметр 'iss' и проверять его в ответах на авторизацию и токены.", + "parent": "V10.2" + }, + { + "bom-ref": "V10.2.3", + "identifier": "V10.2.3", + "text": "Убедитесь, что OAuth клиент запрашивает только необходимые области доступа (scopes) или другие параметры авторизации в запросах к серверу авторизации.", + "parent": "V10.2" + }, + { + "bom-ref": "V10.3", + "identifier": "V10.3", + "title": "Сервер ресурсов OAuth", + "parent": "V10" + }, + { + "bom-ref": "V10.3.1", + "identifier": "V10.3.1", + "text": "Убедитесь, что сервер ресурсов принимает только те access токены, которые предназначены для использования с этим сервисом (свойство audience). Эта принадлежность сервису может быть включена в структурированный access токен (например, в поле 'aud' в JWT) или проверяться через endpoint интроспекции токена.", + "parent": "V10.3" + }, + { + "bom-ref": "V10.3.2", + "identifier": "V10.3.2", + "text": "Убедитесь, что сервер ресурсов принимает решения по авторизации на основе claims из access токена, определяющих делегированную авторизацию. Если присутствуют claims, такие как 'sub', 'scope' и 'authorization_details', они должны участвовать в принятии решения.", + "parent": "V10.3" + }, + { + "bom-ref": "V10.3.3", + "identifier": "V10.3.3", + "text": "Убедитесь, что если для принятия решения по контролю доступа необходимо однозначно идентифицировать пользователя из access токена (JWT или ответа интроспекции), сервер ресурсов использует claims, которые не могут быть переприсвоены другим пользователям. Обычно это комбинация claims 'iss' и 'sub'.", + "parent": "V10.3" + }, + { + "bom-ref": "V10.3.4", + "identifier": "V10.3.4", + "text": "Убедитесь, что если сервер ресурсов требует определённой силы аутентификации, методов или свежести аутентификации, он проверяет, что предъявленный access токен удовлетворяет этим требованиям. Например, при наличии, могут использоваться claims OIDC 'acr', 'amr' и 'auth_time'.", + "parent": "V10.3" + }, + { + "bom-ref": "V10.3.5", + "identifier": "V10.3.5", + "text": "Убедитесь, что сервер ресурсов предотвращает использование украденных access токенов или их повторное использование (replay) неавторизованными лицами, требуя access токены с подтверждением отправителя — например, Mutual TLS для OAuth 2 или OAuth 2 Demonstration of Proof of Possession (DPoP).", + "parent": "V10.3" + }, + { + "bom-ref": "V10.4", + "identifier": "V10.4", + "title": "Сервер авторизации OAuth", + "parent": "V10" + }, + { + "bom-ref": "V10.4.1", + "identifier": "V10.4.1", + "text": "Убедитесь, что сервер авторизации проверяет URI перенаправления (redirect URI), сверяя его с заранее зарегистрированным списком разрешённых URI для данного клиента (allowlist), используя точное сравнение строк.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.2", + "identifier": "V10.4.2", + "text": "Убедитесь, что если сервер авторизации возвращает authorization code в ответе авторизации, этот код может быть использован только один раз для запроса токена. При втором валидном запросе с уже использованным кодом сервер должен отклонить запрос и отозвать любые токены, связанные с этим кодом.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.3", + "identifier": "V10.4.3", + "text": "Убедитесь, что authorization code имеет короткое время жизни. Максимальная продолжительность — до 10 минут для приложений L1 и L2 и до 1 минуты для приложений L3.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.4", + "identifier": "V10.4.4", + "text": "Убедитесь, что сервер авторизации для конкретного клиента разрешает использование только тех типов авторизации, которые необходимы этому клиенту. Обратите внимание, что тип авторизации Implicit flow и Resource Owner Password Credentials flow больше не должны использоваться.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.5", + "identifier": "V10.4.5", + "text": "Убедитесь, что сервер авторизации предотвращает атаки повторного использования refresh токенов для публичных клиентов, предпочтительно используя sender-constrained refresh токены, такие как DPoP или сертификат-связанные токены с mutual TLS (mTLS). Для L1 и L2 допускается ротация refresh токенов с обязательной их инвалидацией после использования. Если используется ротация, сервер должен отозвать все refresh токены при попытке использовать уже инвалидированный токен.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.6", + "identifier": "V10.4.6", + "text": "Убедитесь, что при использовании типа авторизации «Authorization Code» сервер предотвращает атаки перехвата authorization code, требуя Proof Key for Code Exchange (PKCE). В запросах авторизации сервер должен требовать валидное значение 'code_challenge' и не принимать 'code_challenge_method' со значением 'plain'. В запросах токена обязательно валидировать параметр 'code_verifier'.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.7", + "identifier": "V10.4.7", + "text": "Убедитесь, что если сервер авторизации поддерживает динамическую регистрацию клиентов без аутентификации, он минимизирует риски вредоносных клиентов. Сервер должен валидировать метаданные клиента (например, зарегистрированные URI), обеспечивать согласие пользователя и предупреждать пользователя перед обработкой запроса авторизации от недоверенного клиента.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.8", + "identifier": "V10.4.8", + "text": "Убедитесь, что refresh токены имеют абсолютный срок действия, включая случаи, когда применяется скользящее время истечения срока.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.9", + "identifier": "V10.4.9", + "text": "Убедитесь, что пользователи могут отзывать refresh токены и reference access токены через пользовательский интерфейс сервера авторизации для снижения риска от вредоносных клиентов или кражи токенов.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.10", + "identifier": "V10.4.10", + "text": "Убедитесь, что конфиденциальный клиент аутентифицируется при взаимодействии с сервером авторизации через backchannel, например при запросах токена, pushed authorization requests (PAR) и запросах на отзыв токенов.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.11", + "identifier": "V10.4.11", + "text": "Убедитесь, что конфигурация сервера авторизации назначает OAuth клиенту только необходимые области доступа (scopes).", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.12", + "identifier": "V10.4.12", + "text": "Убедитесь, что для конкретного клиента сервер авторизации разрешает только те значения 'response_mode', которые необходимы этому клиенту. Например, сервер должен валидировать это значение против ожидаемых или использовать pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.13", + "identifier": "V10.4.13", + "text": "Убедитесь, что грант типа 'code' всегда используется вместе с pushed authorization requests (PAR).", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.14", + "identifier": "V10.4.14", + "text": "Убедитесь, что сервер авторизации выдаёт только sender-constrained (Proof-of-Possession) access токены, либо с сертификат-связанными токенами через mutual TLS (mTLS), либо DPoP-bound токены (Demonstration of Proof of Possession).", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.15", + "identifier": "V10.4.15", + "text": "Убедитесь, что для серверного клиента (не выполняющегося на устройстве конечного пользователя) сервер авторизации проверяет, что значение параметра 'authorization_details' исходит из клиентского backend и что пользователь не изменял его. Например, это достигается использованием pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.16", + "identifier": "V10.4.16", + "text": "Убедитесь, что клиент является конфиденциальным и сервер авторизации требует использования сильных методов аутентификации клиента (основанных на криптографии с открытым ключом и устойчивых к атакам повторного воспроизведения), таких как mutual TLS ('tls_client_auth', 'self_signed_tls_client_auth') или private key JWT ('private_key_jwt').", + "parent": "V10.4" + }, + { + "bom-ref": "V10.5", + "identifier": "V10.5", + "title": "Клиент OIDC", + "parent": "V10" + }, + { + "bom-ref": "V10.5.1", + "identifier": "V10.5.1", + "text": "Убедитесь, что клиент (relying party) защищается от повторного использования ID Token (replay-атак). Например, это достигается проверкой того, что значение 'nonce' в ID Token совпадает со значением 'nonce', отправленным в запросе аутентификации провайдеру OpenID (authorization server).", + "parent": "V10.5" + }, + { + "bom-ref": "V10.5.2", + "identifier": "V10.5.2", + "text": "Убедитесь, что клиент однозначно идентифицирует пользователя по утверждениям (claims) ID Token, обычно это 'sub', который не может быть переназначен другому пользователю (в пределах конкретного провайдера идентификации).", + "parent": "V10.5" + }, + { + "bom-ref": "V10.5.3", + "identifier": "V10.5.3", + "text": "Убедитесь, что клиент отклоняет попытки злоумышленного сервера авторизации выдавать себя за другой сервер авторизации через метаданные сервера авторизации. Клиент должен отклонить метаданные, если URL издателя (issuer) в метаданных не совпадает точно с преднастроенным URL издателя, ожидаемым клиентом.", + "parent": "V10.5" + }, + { + "bom-ref": "V10.5.4", + "identifier": "V10.5.4", + "text": "Убедитесь, что клиент проверяет, что ID Token предназначен для него (проверка audience), сравнивая значение 'aud' в токене с 'client_id' клиента.", + "parent": "V10.5" + }, + { + "bom-ref": "V10.5.5", + "identifier": "V10.5.5", + "text": "Убедитесь, что при использовании OIDC back-channel logout клиент снижает риск отказа в обслуживании, вызванный принудительным выходом из системы и путаницей между разными типами JWT (cross-JWT confusion) в процессе логаута. Клиент должен проверить, что токен выхода корректно типизирован со значением 'logout+jwt', содержит claim 'event' с правильным именем участника и не содержит 'nonce'. Также рекомендуется установить короткий срок действия токена (например, 2 минуты).", + "parent": "V10.5" + }, + { + "bom-ref": "V10.6", + "identifier": "V10.6", + "title": "Провайдер OpenID", + "parent": "V10" + }, + { + "bom-ref": "V10.6.1", + "identifier": "V10.6.1", + "text": "Убедитесь, что провайдер OpenID допускает только значения 'code', 'ciba', 'id_token' или 'id_token code' для параметра response mode. При этом предпочтение отдаётся 'code' по сравнению с 'id_token code' (гибридный поток OIDC), а значение 'token' (любой Implicit flow) не должно использоваться.", + "parent": "V10.6" + }, + { + "bom-ref": "V10.6.2", + "identifier": "V10.6.2", + "text": "Убедитесь, что провайдер OpenID предотвращает отказ в обслуживании (DoS) через принудительный выход (logout), запрашивая явное подтверждение от конечного пользователя или, если применимо, проверяя параметры в запросе выхода (инициированном relying party), например параметр 'id_token_hint'.", + "parent": "V10.6" + }, + { + "bom-ref": "V10.7", + "identifier": "V10.7", + "title": "Управление согласием", + "parent": "V10" + }, + { + "bom-ref": "V10.7.1", + "identifier": "V10.7.1", + "text": "Убедитесь, что авторизационный сервер обеспечивает получение согласия пользователя для каждого запроса авторизации. Если личность клиента не может быть подтверждена, сервер авторизации всегда должен явно запрашивать согласие пользователя.", + "parent": "V10.7" + }, + { + "bom-ref": "V10.7.2", + "identifier": "V10.7.2", + "text": "Убедитесь, что при запросе согласия пользователя авторизационный сервер предоставляет достаточную и понятную информацию о том, на что даётся согласие. При необходимости это должно включать характер запрашиваемых разрешений (обычно основанных на scope, ресурсном сервере, деталях авторизации Rich Authorization Requests (RAR)), идентификацию авторизованного приложения и срок действия этих разрешений.", + "parent": "V10.7" + }, + { + "bom-ref": "V10.7.3", + "identifier": "V10.7.3", + "text": "Убедитесь, что пользователь может просматривать, изменять и отзывать согласия, которые он предоставил, через авторизационный сервер.", + "parent": "V10.7" + }, + { + "bom-ref": "V11", + "identifier": "V11", + "title": "Криптография" + }, + { + "bom-ref": "V11.1", + "identifier": "V11.1", + "title": "Инвентаризация и документирование криптографии", + "parent": "V11" + }, + { + "bom-ref": "V11.1.1", + "identifier": "V11.1.1", + "text": "Убедитесь, что задокументирована политика управления криптографическими ключами и описан их жизненный цикл в соответствии со стандартом управления ключей, таким как NIST SP 800-57. Убедитесь, что ключи известны только тем сущностям, которым они должны быть доступны (например, ключи не передавались более чем двум участникам для общих секретов и более чем одному участнику для приватных ключей).", + "parent": "V11.1" + }, + { + "bom-ref": "V11.1.2", + "identifier": "V11.1.2", + "text": "Убедитесь, что проводится инвентаризация криптографических средств, которая непрерывно поддерживается, регулярно обновляется и включает все криптографические ключи, алгоритмы и сертификаты, используемые в приложении. Также должна быть задокументирована информация о том, где ключи могут и не могут использоваться в системе, а также какие типы данных могут и не могут быть защищены с помощью этих ключей.", + "parent": "V11.1" + }, + { + "bom-ref": "V11.1.3", + "identifier": "V11.1.3", + "text": "Убедитесь, что используются механизмы обнаружения криптографии для идентификации всех случаев применения криптографии в системе , включая операции шифрования, хеширования и цифровой подписи.", + "parent": "V11.1" + }, + { + "bom-ref": "V11.1.4", + "identifier": "V11.1.4", + "text": "Убедитесь, что ведётся и поддерживается инвентаризация криптографических средств. В неё должен входить документированный план, описывающий переход на новые криптографические стандарты, такие как постквантовая криптография, чтобы своевременно реагировать на будущие угрозы.", + "parent": "V11.1" + }, + { + "bom-ref": "V11.2", + "identifier": "V11.2", + "title": "Безопасная реализация криптографии", + "parent": "V11" + }, + { + "bom-ref": "V11.2.1", + "identifier": "V11.2.1", + "text": "Убедитесь, что для криптографических операций используются утвержденные в индустрии реализации (включая библиотеки и аппаратные реализации).", + "parent": "V11.2" + }, + { + "bom-ref": "V11.2.2", + "identifier": "V11.2.2", + "text": "Убедитесь, что архитектура приложения поддерживает быструю реконфигурацию, усовершенствование или смену в любой момент случайных чисел, аутентифицированного шифрования, MAC, алгоритмов хеширования, длин ключей, количества раундов, шифров и режимов шифрования для защиты от криптографических атак. Также должна поддерживаться возможность смены ключей, паролей и повторного шифрования данных. Это позволит беспрепятственно перейти на постквантовую криптографию (PQC), как только станут широко доступны высоконадёжные реализации одобренных схем или стандартов PQC.", + "parent": "V11.2" + }, + { + "bom-ref": "V11.2.3", + "identifier": "V11.2.3", + "text": "Убедитесь, что все криптографические примитивы используют как минимум 128-бит стойкости с учетом алгоритма, размера ключа и конфигурации. Например, 256-битный ECC ключ обеспечивает примерно 128 бит безопасности, тогда как для достижения того же уровня безопасности в RSA требуется ключ длиной 3072 бита.", + "parent": "V11.2" + }, + { + "bom-ref": "V11.2.4", + "identifier": "V11.2.4", + "text": "Убедитесь, что все криптографические операции выполняются за константное время, без использования «short-circuit» операций в сравнениях, вычислениях, возвратах функций для избежания утечек информации.", + "parent": "V11.2" + }, + { + "bom-ref": "V11.2.5", + "identifier": "V11.2.5", + "text": "Убедитесь, что все криптографические модули обеспечивают безопасное завершение работы при ошибках, а обработка ошибок реализована таким образом, чтобы не создавать уязвимостей, например, таких как атаки Padding Oracle.", + "parent": "V11.2" + }, + { + "bom-ref": "V11.3", + "identifier": "V11.3", + "title": "Алгоритмы шифрования", + "parent": "V11" + }, + { + "bom-ref": "V11.3.1", + "identifier": "V11.3.1", + "text": "Убедитесь, что не используются небезопасные режимы блочного шифрования (н-р, ECB) и слабые схемы дополнения (padding) (н-р, PKCS#1 v1.5).", + "parent": "V11.3" + }, + { + "bom-ref": "V11.3.2", + "identifier": "V11.3.2", + "text": "Убедитесь, что используются только утверждённые шифры и режимы, такие как AES с GCM.", + "parent": "V11.3" + }, + { + "bom-ref": "V11.3.3", + "identifier": "V11.3.3", + "text": "Убедитесь, что зашифрованные данные защищены от несанкционированного изменения, предпочтительно с использованием утверждённого метода аутентифицированного шифрования или путём комбинирования утверждённого метода шифрования с утверждённым алгоритмом MAC.", + "parent": "V11.3" + }, + { + "bom-ref": "V11.3.4", + "identifier": "V11.3.4", + "text": "Убедитесь, что случайные числа (nonce), векторы инициализации (IV) и другие одноразовые числа не используются более одного раза для одной и той же пары ключа шифрования и элемента данных. Метод их генерации должен соответствовать требованиям используемого алгоритма.", + "parent": "V11.3" + }, + { + "bom-ref": "V11.3.5", + "identifier": "V11.3.5", + "text": "Убедитесь, что любая комбинация алгоритма шифрования и алгоритма MAC работает в режиме encrypt-then-MAC (EtM).", + "parent": "V11.3" + }, + { + "bom-ref": "V11.4", + "identifier": "V11.4", + "title": "Хеширование и функции на основе хеширования", + "parent": "V11" + }, + { + "bom-ref": "V11.4.1", + "identifier": "V11.4.1", + "text": "Убедитесь, что только утвержденные хэш-функции используются для стандартных сценариев использования в криптографии, включая цифровую подпись, HMAC, KDF, генерацию случайных чисел. Запрещено использовать неустойчивые хэш-функции, (н-р, MD5) для любого использования в криптографии.", + "parent": "V11.4" + }, + { + "bom-ref": "V11.4.2", + "identifier": "V11.4.2", + "text": "Убедитесь, что пароли хранятся с использованием утверждённой, вычислительно затратной функции генерации ключа (также известной как «функция хеширования паролей»), с параметрами, настроенными в соответствии с актуальными рекомендациями. Настройки должны обеспечивать баланс между безопасностью и производительностью, чтобы сделать атаки перебором достаточно сложными для требуемого уровня безопасности.", + "parent": "V11.4" + }, + { + "bom-ref": "V11.4.3", + "identifier": "V11.4.3", + "text": "Убедитесь, что хэш-функции, используемые в формировании цифровой подписи, как часть аутентификации и целостности данных, устойчивы к коллизиям и имеют достаточную длину.", + "parent": "V11.4" + }, + { + "bom-ref": "V11.4.4", + "identifier": "V11.4.4", + "text": "Убедитесь, что приложение использует утвержденную функцию генерации ключа с использованием параметров расширения ключа (key stretching) при генерации ключа из пароля. Параметры должны быть сбалансированы с точки зрения безопасности, производительности и устойчивости к атакам полного перебора при компрометации результирующего криптографического ключа.", + "parent": "V11.4" + }, + { + "bom-ref": "V11.5", + "identifier": "V11.5", + "title": "Случайные значения", + "parent": "V11" + }, + { + "bom-ref": "V11.5.1", + "identifier": "V11.5.1", + "text": "Убедитесь, что все случайные числа и строки, которые должны быть непредсказуемы, должны быть сгенерированы с помощью CSPRNG и иметь хотя бы 128 бит энтропии. Учтите, что UUID не удовлетворяют данному условию.", + "parent": "V11.5" + }, + { + "bom-ref": "V11.5.2", + "identifier": "V11.5.2", + "text": "Убедитесь, что механизм генерации случайных чисел является надежным даже при высокой нагрузке.", + "parent": "V11.5" + }, + { + "bom-ref": "V11.6", + "identifier": "V11.6", + "title": "Криптография с публичным ключом", + "parent": "V11" + }, + { + "bom-ref": "V11.6.1", + "identifier": "V11.6.1", + "text": "Убедитесь, что только утвержденные криптографические алгоритмы и режимы операций используются для генерации ключа и инициализации случайного значения для его генерации (seeding), а также для генерации цифровой подписи и верификации. Алгоритмы генерации ключей не должны генерировать небезопасные ключи уязвимые к известным атакам, например, ключи RSA уязвимы к факторизации Ферма.", + "parent": "V11.6" + }, + { + "bom-ref": "V11.6.2", + "identifier": "V11.6.2", + "text": "Убедитесь, что для обмена ключами используются утверждённые криптографические алгоритмы (например, Диффи-Хеллман) с особым вниманием к обеспечению использования безопасных параметров. Это предотвратит атаки на процесс установления ключа, которые могут привести к атакам «человек посередине» или криптографическим взломам.", + "parent": "V11.6" + }, + { + "bom-ref": "V11.7", + "identifier": "V11.7", + "title": "Шифрование данных в процессе использования", + "parent": "V11" + }, + { + "bom-ref": "V11.7.1", + "identifier": "V11.7.1", + "text": "Убедитесь, что используется полное шифрование памяти, которое защищает конфиденциальные данные во время их использования, предотвращая доступ к ним неавторизованных пользователей или процессов.", + "parent": "V11.7" + }, + { + "bom-ref": "V11.7.2", + "identifier": "V11.7.2", + "text": "Убедитесь, что минимизация данных обеспечивает раскрытие минимально необходимого объёма данных во время обработки, а также что данные шифруются сразу после использования или как можно скорее.", + "parent": "V11.7" + }, + { + "bom-ref": "V12", + "identifier": "V12", + "title": "Безопасная коммуникация" + }, + { + "bom-ref": "V12.1", + "identifier": "V12.1", + "title": "Общие рекомендации по безопасности TLS", + "parent": "V12" + }, + { + "bom-ref": "V12.1.1", + "identifier": "V12.1.1", + "text": "Убедитесь, что включены только актуальные и рекомендуемые версии протокола TLS, такие как TLS 1.2 и TLS 1.3. Наиболее свежая версия TLS должна быть выбрана как предпочтительная.", + "parent": "V12.1" + }, + { + "bom-ref": "V12.1.2", + "identifier": "V12.1.2", + "text": "Убедитесь, что включены рекомендуемые шифронаборы (cipher suites), предпочтение также стоит отдать самому сильному шифронабору. L3 приложения должны поддерживать только те наборы шифров (cipher suites), которые обеспечивают прямую (forward) секретность. Пояснение: Прямая секретность (Forward Secrecy, FS) — это криптографическая особенность, при которой сессионные ключи уникальны для каждой сессии и не зависят от долгосрочных ключей. Это гарантирует, что даже при компрометации долгосрочного ключа злоумышленник не сможет расшифровать ранее перехваченные зашифрованные сессии.", + "parent": "V12.1" + }, + { + "bom-ref": "V12.1.3", + "identifier": "V12.1.3", + "text": "Убедитесь, что приложение проверяет доверенность клиентских сертификатов mTLS, прежде чем использовать идентификацию по сертификату для аутентификации или авторизации.", + "parent": "V12.1" + }, + { + "bom-ref": "V12.1.4", + "identifier": "V12.1.4", + "text": "Убедитесь, что включена и настроена правильная проверка отзыва сертификатов, такая как Online Certificate Status Protocol (OCSP) Stapling.", + "parent": "V12.1" + }, + { + "bom-ref": "V12.1.5", + "identifier": "V12.1.5", + "text": "Убедитесь, что в настройках TLS приложения включена функция Encrypted Client Hello (ECH) для предотвращения раскрытия конфиденциальных метаданных, таких как Server Name Indication (SNI), во время процесса TLS-рукопожатия.", + "parent": "V12.1" + }, + { + "bom-ref": "V12.2", + "identifier": "V12.2", + "title": "HTTPS коммуникация с внешними сервисами", + "parent": "V12" + }, + { + "bom-ref": "V12.2.1", + "identifier": "V12.2.1", + "text": "Убедитесь, что для всех соединений между клиентом и внешними HTTP-сервисами используется TLS и не происходит отката к небезопасным или незашифрованным протоколам.", + "parent": "V12.2" + }, + { + "bom-ref": "V12.2.2", + "identifier": "V12.2.2", + "text": "Убедитесь, что внешние сервисы используют публично доверенные TLS-сертификаты.", + "parent": "V12.2" + }, + { + "bom-ref": "V12.3", + "identifier": "V12.3", + "title": "Общая безопасность межсервисного взаимодействия", + "parent": "V12" + }, + { + "bom-ref": "V12.3.1", + "identifier": "V12.3.1", + "text": "Убедитесь, что для всех входящих и исходящих соединений приложения используется зашифрованный протокол, например TLS, включая системы мониторинга, инструменты управления, удалённый доступ и SSH, промежуточное ПО, базы данных, мейнфреймы, партнёрские системы и внешние API. Сервер не должен допускать откат к небезопасным или незашифрованным протоколам.", + "parent": "V12.3" + }, + { + "bom-ref": "V12.3.2", + "identifier": "V12.3.2", + "text": "Убедитесь, что TLS-клиент проверяет сертификат сервера до установления защищенного соединения с TLS-сервером.", + "parent": "V12.3" + }, + { + "bom-ref": "V12.3.3", + "identifier": "V12.3.3", + "text": "Убедитесь, что все внутренние HTTP-взаимодействия между компонентами приложения используют TLS или другой подходящий механизм транспортного шифрования, и не происходит откат к небезопасным или незашифрованным коммуникациям.", + "parent": "V12.3" + }, + { + "bom-ref": "V12.3.4", + "identifier": "V12.3.4", + "text": "Убедитесь, что TLS-соединения между внутренними сервисами используют доверенные сертификаты. Если используются внутренние или самоподписанные сертификаты, потребляющий сервис должен быть настроен на доверие только к конкретным внутренним центрам сертификации (CA) и конкретным самоподписанным сертификатам.", + "parent": "V12.3" + }, + { + "bom-ref": "V12.3.5", + "identifier": "V12.3.5", + "text": "Убедитесь, что сервисы, взаимодействующие внутри системы (intra-service communications), используют строгую аутентификацию для проверки каждого конечного узла. Для проверки подлинности взаимодействующих сторон должны применяться методы строгой аутентификации, такие как аутентификация TLS-клиента, с использованием инфраструктуры открытых ключей и механизмов, устойчивых к атакам повтора (replay attacks). Для микросервисных архитектур рекомендуется использование service mesh для упрощения управления сертификатами и повышения безопасности.", + "parent": "V12.3" + }, + { + "bom-ref": "V13", + "identifier": "V13", + "title": "Конфигурация" + }, + { + "bom-ref": "V13.1", + "identifier": "V13.1", + "title": "Документация конфигурации", + "parent": "V13" + }, + { + "bom-ref": "V13.1.1", + "identifier": "V13.1.1", + "text": "Убедитесь, что все необходимые доступы приложения задокументированы. Сюда должны быть включены как внешние сервисы, от которых зависит приложение, так и сценарии, когда конечный пользователь может задавать адреса для внешнего подключения.", + "parent": "V13.1" + }, + { + "bom-ref": "V13.1.2", + "identifier": "V13.1.2", + "text": "Убедитесь, что для каждого сервиса, используемого приложением, в документации определено максимальное количество одновременных соединений (например, лимиты пула соединений) и описано поведение приложения при достижении этого лимита, включая любые механизмы отказоустойчивости или восстановления, чтобы предотвратить ситуации отказа в обслуживании (DoS).", + "parent": "V13.1" + }, + { + "bom-ref": "V13.1.3", + "identifier": "V13.1.3", + "text": "Убедитесь, что в документации приложения определены стратегии управления ресурсами для каждой внешней системы или сервиса, которые оно использует (например, базы данных, файловые дескрипторы, потоки, HTTP-соединения). Стратегии должны включать процедуры освобождения ресурсов, настройки таймаутов, обработку сбоев, а также, если реализована логика повторных попыток, указание лимитов, задержек и алгоритмов back-off. Для синхронных HTTP-запросов должны быть заданы короткие таймауты, а повторные запросы должны быть отключены, либо строго ограничены по числу попыток, чтобы предотвратить каскадные задержки и истощение ресурсов.", + "parent": "V13.1" + }, + { + "bom-ref": "V13.1.4", + "identifier": "V13.1.4", + "text": "Убедитесь, что в документации приложения определены секреты, критически важные для безопасности приложения, а также установлен график их ротации в соответствии с моделью угроз организации и её бизнес-требованиями.", + "parent": "V13.1" + }, + { + "bom-ref": "V13.2", + "identifier": "V13.2", + "title": "Конфигурация бэкенд соединений", + "parent": "V13" + }, + { + "bom-ref": "V13.2.1", + "identifier": "V13.2.1", + "text": "Убедитесь, что коммуникации между компонентами бэкенда приложения (включая API, промежуточное ПО и уровни данных), которые не поддерживают стандартный механизм пользовательских сессий, проходят с аутентификацией. Аутентификация должна использовать индивидуальные сервисные аккаунты, краткосрочные токены или аутентификацию на основе сертификатов, а не постоянные учётные данные, такие как пароли, API-ключи или общие аккаунты с привилегированным доступом.", + "parent": "V13.2" + }, + { + "bom-ref": "V13.2.2", + "identifier": "V13.2.2", + "text": "Убедитесь, что коммуникации между компонентами бэкенда приложения, включая локальные или системные службы, API, промежуточное ПО и уровни данных, выполняются с использованием аккаунтов, которым назначены минимально необходимые привилегии.", + "parent": "V13.2" + }, + { + "bom-ref": "V13.2.3", + "identifier": "V13.2.3", + "text": "Убедитесь, что если для аутентификации в сервисе используются учётные данные, то используемые потребителем учётные данные не являются стандартными (например, root/root или admin/admin).", + "parent": "V13.2" + }, + { + "bom-ref": "V13.2.4", + "identifier": "V13.2.4", + "text": "Убедитесь, что используется белый список (allowlist) для определения внешних ресурсов или систем, с которыми приложению разрешено взаимодействовать (например, для исходящих запросов, загрузки данных или доступа к файлам). Этот белый список может быть реализован на уровне приложения, веб-сервера, межсетевого экрана или комбинации различных уровней.", + "parent": "V13.2" + }, + { + "bom-ref": "V13.2.5", + "identifier": "V13.2.5", + "text": "Убедитесь, что веб- или прикладной сервер настроен с белым списком ресурсов или систем, к которым сервер может отправлять запросы или из которых может загружать данные и файлы.", + "parent": "V13.2" + }, + { + "bom-ref": "V13.2.6", + "identifier": "V13.2.6", + "text": "Убедитесь, что при подключении приложения к другим сервисам соблюдается задокументированная конфигурация для каждого соединения, включая максимальное количество параллельных соединений, поведение при достижении их максимума, таймауты и стратегии повторных попыток подключения.", + "parent": "V13.2" + }, + { + "bom-ref": "V13.3", + "identifier": "V13.3", + "title": "Управление секретами", + "parent": "V13" + }, + { + "bom-ref": "V13.3.1", + "identifier": "V13.3.1", + "text": "Убедитесь, что для безопасного создания, хранения, контроля доступа и уничтожения секретов бэкенда используется решение для управления секретами, например, хранилище ключей (key vault). Секретами могут быть пароли, ключевой материал, интеграции с базами данных и сторонними системами, ключи и seed-значения для токенов с ограниченным временем действия, другие внутренние секреты и API-ключи. Секреты не должны включаться в исходный код приложения или артефакты сборки. Для приложений уровня L3 необходимо использовать аппаратное решение, например, аппаратный модуль безопасности (HSM).", + "parent": "V13.3" + }, + { + "bom-ref": "V13.3.2", + "identifier": "V13.3.2", + "text": "Убедитесь, что доступ к секретным ресурсам осуществляется в соответствии с принципом минимально необходимых привилегий (least privilege).", + "parent": "V13.3" + }, + { + "bom-ref": "V13.3.3", + "identifier": "V13.3.3", + "text": "Убедитесь, что все криптографические операции выполняются с использованием изолированного модуля безопасности (например, хранилища ключей или аппаратного модуля безопасности), чтобы надежно управлять ключевым материалом и защищать его от утечки за пределы модуля безопасности.", + "parent": "V13.3" + }, + { + "bom-ref": "V13.3.4", + "identifier": "V13.3.4", + "text": "Убедитесь, что секреты настроены на срок действия и ротацию в соответствии с документацией приложения.", + "parent": "V13.3" + }, + { + "bom-ref": "V13.4", + "identifier": "V13.4", + "title": "Непреднамеренная утечка информации", + "parent": "V13" + }, + { + "bom-ref": "V13.4.1", + "identifier": "V13.4.1", + "text": "Убедитесь, что приложение развернуто либо без метаданных систем контроля версий (включая папки .git или .svn), либо так, чтобы эти папки были недоступны как извне, так и для самого приложения.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.2", + "identifier": "V13.4.2", + "text": "Убедитесь, что режимы отладки отключены для всех компонентов в промышленной среде, чтобы предотвратить раскрытие функций отладки и утечку информации.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.3", + "identifier": "V13.4.3", + "text": "Убедитесь, что веб-серверы не показывают клиентам списки содержимого каталогов, если это явно не предусмотрено.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.4", + "identifier": "V13.4.4", + "text": "Убедитесь, что метод HTTP TRACE не поддерживается в продуктовой среде, чтобы избежать потенциальной утечки информации.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.5", + "identifier": "V13.4.5", + "text": "Убедитесь, что документация (например, по внутренним API) и мониторинговые эндпоинты не доступны, если это явно не предусмотрено.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.6", + "identifier": "V13.4.6", + "text": "Убедитесь, что приложение не раскрывает подробную информацию о версиях компонентов бэкенда.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.7", + "identifier": "V13.4.7", + "text": "Убедитесь, что веб-слой настроен на обслуживание только файлов с определёнными расширениями, чтобы предотвратить непреднамеренную утечку информации, конфигураций и исходного кода.", + "parent": "V13.4" + }, + { + "bom-ref": "V14", + "identifier": "V14", + "title": "Защита информации" + }, + { + "bom-ref": "V14.1", + "identifier": "V14.1", + "title": "Документация по защите информации", + "parent": "V14" + }, + { + "bom-ref": "V14.1.1", + "identifier": "V14.1.1", + "text": "Убедитесь, что все конфиденциальные данные, создаваемые и обрабатываемые приложением, идентифицированы и классифицированы по уровням защиты. Включая закодированные данные, которые легко декодируются, например, строки Base64 или незашифрованные данные в полезной нагрузке JWT. Уровни защиты должны учитывать требования по защите данных и конфиденциальности, которым должно соответствовать приложение.", + "parent": "V14.1" + }, + { + "bom-ref": "V14.1.2", + "identifier": "V14.1.2", + "text": "Убедитесь, что для каждого уровня защиты конфиденциальных данных требования к защите задокументированы. Они должны включать (но не ограничиваться) требования по шифрованию, проверке целостности, срокам хранения, способам логирования данных, контролю доступа к чувствительным данным в логах, шифрованию на уровне базы данных, применению технологий повышения конфиденциальности, а также другим требованиям по конфиденциальности.", + "parent": "V14.1" + }, + { + "bom-ref": "V14.2", + "identifier": "V14.2", + "title": "Базовые меры по защите информации", + "parent": "V14" + }, + { + "bom-ref": "V14.2.1", + "identifier": "V14.2.1", + "text": "Убедитесь, что конфиденциальные данные передаются на сервер только в теле HTTP-запроса или в заголовках. URL и строка запроса не должны содержать конфиденциальную информацию, такую как API-ключ или сессионный токен.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.2", + "identifier": "V14.2.2", + "text": "Убедитесь, что приложение предотвращает кэширование конфиденциальных данных в серверных компонентах, таких как балансировщики нагрузки и кэши приложений, либо гарантирует их надежное удаление после использования.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.3", + "identifier": "V14.2.3", + "text": "Убедитесь, что заранее определённые конфиденциальные данные не отправляются ненадёжным сторонам (например, системам трекинга пользователей), чтобы предотвратить нежелательный сбор данных вне контроля приложения.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.4", + "identifier": "V14.2.4", + "text": "Убедитесь, что для конфиденциальных данных реализованы меры по шифрованию, проверке целостности, срокам хранения, способам логирования, контролю доступа к данным в логах, а также применяются технологии повышения конфиденциальности в соответствии с документацией для соответствующего уровня защиты данных.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.5", + "identifier": "V14.2.5", + "text": "Убедитесь, что механизмы кэширования настроены так, чтобы кэшировать только ответы с ожидаемым типом содержимого для данного ресурса и не содержать конфиденциального динамического контента. При обращении к несуществующему файлу, веб-сервер должен возвращать ответ 404 или 302, а не подменять на другой существующий файл, что позволит предотвратить атаки типа Web Cache Deception.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.6", + "identifier": "V14.2.6", + "text": "Убедитесь, что приложение возвращает только минимально необходимый объем конфиденциальных данных для выполнения своей функциональности. Например, показывает только часть цифр номера кредитной карты, а не полный номер. Если требуется отображение полных данных, они должны быть замаскированы в пользовательском интерфейсе, пока пользователь специально не запросил их просмотр.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.7", + "identifier": "V14.2.7", + "text": "Убедитесь, что конфиденциальная информация подлежит классификации по срокам хранения, чтобы устаревшие или ненужные данные удалялись автоматически, по расписанию или по мере необходимости.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.8", + "identifier": "V14.2.8", + "text": "Убедитесь, что конфиденциальная информация удаляется из метаданных файлов, загружаемых пользователями, если пользователь явно не согласился на ее хранение.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.3", + "identifier": "V14.3", + "title": "Защита данных на стороне клиента", + "parent": "V14" + }, + { + "bom-ref": "V14.3.1", + "identifier": "V14.3.1", + "text": "Убедитесь, что аутентифицированные данные очищаются из клиентского хранилища, например, из DOM браузера, после завершения работы клиента или сессии. Заголовок HTTP-ответа Clear-Site-Data может помочь в этом, но клиентская сторона также должна уметь очищать данные, если соединение с сервером недоступно при завершении сессии.", + "parent": "V14.3" + }, + { + "bom-ref": "V14.3.2", + "identifier": "V14.3.2", + "text": "Убедитесь, что приложение устанавливает HTTP-заголовки, достаточные для предотвращения кэширования (например, Cache-Control: no-store), чтобы конфиденциальные данные не сохранялись в браузерах.", + "parent": "V14.3" + }, + { + "bom-ref": "V14.3.3", + "identifier": "V14.3.3", + "text": "Убедитесь, что данные, хранящиеся в браузерном хранилище (например, localStorage, sessionStorage, IndexedDB или cookie), не содержат конфиденциальной информации, за исключением сессионных токенов.", + "parent": "V14.3" + }, + { + "bom-ref": "V15", + "identifier": "V15", + "title": "Безопасная разработка и архитектура" + }, + { + "bom-ref": "V15.1", + "identifier": "V15.1", + "title": "Документация по безопасной разработке и архитектуре", + "parent": "V15" + }, + { + "bom-ref": "V15.1.1", + "identifier": "V15.1.1", + "text": "Убедитесь, что в документации по приложению определены сроки устранения уязвимостей на основе оценки рисков для внешних зависимостей с уязвимостями и для обновления библиотек в целом, чтобы минимизировать риск, связанный с этими компонентами.", + "parent": "V15.1" + }, + { + "bom-ref": "V15.1.2", + "identifier": "V15.1.2", + "text": "Убедитесь, что ведется реестр всех используемых сторонних библиотек (например, Software Bill of Materials, SBOM), с обязательной проверкой, что компоненты получены из предопределенных, доверенных и регулярно поддерживаемых репозиториев.", + "parent": "V15.1" + }, + { + "bom-ref": "V15.1.3", + "identifier": "V15.1.3", + "text": "Убедитесь, что в документации приложения указан функционал, требующий значительных временных или вычислительных ресурсов. Необходимо указать, как предотвратить потерю доступности из-за чрезмерного использования этого функционала и как избежать ситуаций, когда формирование ответа занимает больше времени, чем установленный системой таймаут. Возможные меры защиты могут включать асинхронную обработку, использование очередей и ограничение количества параллельных процессов для каждого пользователя и приложения.", + "parent": "V15.1" + }, + { + "bom-ref": "V15.1.4", + "identifier": "V15.1.4", + "text": "Убедитесь, что в документации приложения указаны внешние библиотеки, которые считаются «компонентами с повышенным риском».", + "parent": "V15.1" + }, + { + "bom-ref": "V15.1.5", + "identifier": "V15.1.5", + "text": "Убедитесь, что в документации приложения выделены те части приложения, в которых используются «функционал с повышенным риском».", + "parent": "V15.1" + }, + { + "bom-ref": "V15.2", + "identifier": "V15.2", + "title": "Архитектура безопасности и зависимости", + "parent": "V15" + }, + { + "bom-ref": "V15.2.1", + "identifier": "V15.2.1", + "text": "Убедитесь, что приложение содержит только те компоненты, которые не нарушили задокументированные сроки обновления и исправления.", + "parent": "V15.2" + }, + { + "bom-ref": "V15.2.2", + "identifier": "V15.2.2", + "text": "Убедитесь, что в приложении реализованы меры защиты от потери доступности из-за функциональности, требующей много времени или ресурсов, на основе задокументированных решений и стратегий безопасности для этого.", + "parent": "V15.2" + }, + { + "bom-ref": "V15.2.3", + "identifier": "V15.2.3", + "text": "Убедитесь, что производственная среда включает только те функции, которые необходимы для работы приложения, и не предоставляет лишние функции, такие как тестовый код, примеры кода и инструменты разработки.", + "parent": "V15.2" + }, + { + "bom-ref": "V15.2.4", + "identifier": "V15.2.4", + "text": "Убедитесь, что сторонние компоненты и все их транзитивные зависимости загружаются только из ожидаемых репозиториев (внутренних или внешних) и отсутствует риск атаки через подмену зависимостей (dependency confusion attack)", + "parent": "V15.2" + }, + { + "bom-ref": "V15.2.5", + "identifier": "V15.2.5", + "text": "Убедитесь, что приложение реализует дополнительные меры защиты для тех частей приложения, которые документированы как содержащие «функционал с повышенным риском» или использующие сторонние библиотеки, считающиеся «функционалом с повышенным риском». Это могут быть такие методы, как «песочница», инкапсуляция, контейнеризация или изоляция на сетевом уровне, чтобы задержать и предотвратить продвижение (pivoting) злоумышленников, скомпрометировавших одну часть приложения, к другим частям приложения.", + "parent": "V15.2" + }, + { + "bom-ref": "V15.3", + "identifier": "V15.3", + "title": "Безопасное программирование", + "parent": "V15" + }, + { + "bom-ref": "V15.3.1", + "identifier": "V15.3.1", + "text": "Убедитесь, что приложение возвращает только необходимое подмножество полей из объекта данных. Например, оно не должно возвращать весь объект данных, поскольку некоторые отдельные поля должны быть недоступны пользователям.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.2", + "identifier": "V15.3.2", + "text": "Убедитесь, что при вызовах внешних URL-адресов бэкэнд приложения настроен так, чтобы не выполнять перенаправления, если только это не предусмотрено функционалом.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.3", + "identifier": "V15.3.3", + "text": "Убедитесь, что в приложении реализованы защитные механизмы против атак типа массового присвоения (mass assignment) путем строгого ограничения разрешенных полей для каждого контроллера и действия, исключая возможность добавления или изменения значений полей, которые не должны быть доступны для данной конкретной операции.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.4", + "identifier": "V15.3.4", + "text": "Убедитесь, что все прокси и промежуточное ПО корректно передают исходный IP-адрес пользователя, используя доверенные поля данных, которые не могут быть изменены конечным пользователем, а приложение и веб-сервер используют это правильное значение для ведения логирования и принятия решений по безопасности, таких как ограничение запросов. При этом следует учитывать, что даже исходный IP-адрес может быть ненадежным из-за динамических IP-адресов, VPN или корпоративных файрволов.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.5", + "identifier": "V15.3.5", + "text": "Убедитесь, что приложение явно проверяет соответствие переменных ожидаемому типу данных и использует строгие операции сравнения. Это необходимо для предотвращения уязвимостей, связанных с type juggling и type confusion, вызванных тем, что код приложения делает предположения о типе переменной.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.6", + "identifier": "V15.3.6", + "text": "Убедитесь, что JavaScript-код написан таким образом, чтобы предотвратить prototype pollution, например, используя Set() или Map() вместо обычных литералов объекта.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.7", + "identifier": "V15.3.7", + "text": "Убедитесь, что приложение защищено от атак типа HTTP Parameter Pollution (HPP), особенно если используемый фреймворк не различает источники параметров запроса (строка запроса, тело запроса, куки или заголовки).", + "parent": "V15.3" + }, + { + "bom-ref": "V15.4", + "identifier": "V15.4", + "title": "Безопасная работа с параллельными процессами", + "parent": "V15" + }, + { + "bom-ref": "V15.4.1", + "identifier": "V15.4.1", + "text": "Убедитесь, что к общим объектам в многопоточном коде (например, кэшам, файлам или объектам в памяти, используемым несколькими потоками) используется безопасный многопоточный доступ и механизмов синхронизации, таких как блокировки или семафоры, чтобы избежать состояний гонки и повреждения данных.", + "parent": "V15.4" + }, + { + "bom-ref": "V15.4.2", + "identifier": "V15.4.2", + "text": "Убедитесь, что проверки состояния ресурса, например его существования или разрешений, а также зависящие от него действия выполняются как одна атомарная операция, чтобы предотвратить условия гонки времени проверки и времени использования (TOCTOU). Например, проверка существования файла перед его открытием или проверка прав доступа пользователя перед его предоставлением.", + "parent": "V15.4" + }, + { + "bom-ref": "V15.4.3", + "identifier": "V15.4.3", + "text": "Убедитесь, что блокировки применяются согласованно, чтобы предотвратить взаимные блокировки потоков (deadlocks) или их бесконечные повторы, а также что логика блокировки инкапсулирована в коде, отвечающем за управление ресурсом. Это гарантирует, что блокировки не могут быть случайно или намеренно изменены внешними классами или кодом.", + "parent": "V15.4" + }, + { + "bom-ref": "V15.4.4", + "identifier": "V15.4.4", + "text": "Убедитесь, что политики распределения ресурсов предотвращают нехватку ресурсов у потоков, обеспечивая справедливый доступ к ресурсам, например, используя пулы потоков, позволяя потокам с более низким приоритетом выполняться в течение разумного периода времени.", + "parent": "V15.4" + }, + { + "bom-ref": "V16", + "identifier": "V16", + "title": "Журналирование событий безопасности и обработка ошибок" + }, + { + "bom-ref": "V16.1", + "identifier": "V16.1", + "title": "Документация по ведению логов", + "parent": "V16" + }, + { + "bom-ref": "V16.1.1", + "identifier": "V16.1.1", + "text": "Убедитесь в существовании реестра, в котором документируется ведение журнала на каждом уровне технологического стека приложения, включая какие события регистрируются, форматы логов, где хранятся эти журналы, как они используются, как контролируется доступ к ним и как долго хранятся журналы.", + "parent": "V16.1" + }, + { + "bom-ref": "V16.2", + "identifier": "V16.2", + "title": "Общее журналирование", + "parent": "V16" + }, + { + "bom-ref": "V16.2.1", + "identifier": "V16.2.1", + "text": "Убедитесь, что каждая запись журнала содержит необходимые метаданные (например, когда, где, кто, что), которые позволят провести подробное исследование временной шкалы, когда произошло событие.", + "parent": "V16.2" + }, + { + "bom-ref": "V16.2.2", + "identifier": "V16.2.2", + "text": "Убедитесь, что все источники времени компонентов системы журналирования синхронизированы, а временные метки в метаданных событий безопасности используют UTC или содержат явное указание смещения часового пояса. Рекомендуется применять UTC для обеспечения согласованности в распределённых системах и предотвращения ошибок при переходе на летнее/зимнее время.", + "parent": "V16.2" + }, + { + "bom-ref": "V16.2.3", + "identifier": "V16.2.3", + "text": "Убедитесь, что приложение записывает и передаёт логи исключительно в те файлы и сервисы, которые указаны в реестре журналирования.", + "parent": "V16.2" + }, + { + "bom-ref": "V16.2.4", + "identifier": "V16.2.4", + "text": "Убедитесь, что логи могут быть прочитаны и коррелированы используемой системой обработки журналов, предпочтительно с использованием общего стандартного формата логирования.", + "parent": "V16.2" + }, + { + "bom-ref": "V16.2.5", + "identifier": "V16.2.5", + "text": "Убедитесь, что приложение применяет соответствующие меры защиты при логировании конфиденциальных данных в зависимости от уровня их чувствительности: например, полностью запрещает запись в логи таких данных, как учетные данные или платежные реквизиты, а для других данных (например, сессионных токенов) использует хеширование или частичное/полное маскирование.", + "parent": "V16.2" + }, + { + "bom-ref": "V16.3", + "identifier": "V16.3", + "title": "Инциденты безопасности", + "parent": "V16" + }, + { + "bom-ref": "V16.3.1", + "identifier": "V16.3.1", + "text": "Убедитесь, что все операции аутентификации регистрируются, включая успешные и неудачные попытки. Также следует фиксировать дополнительные метаданные, такие как тип аутентификации или использованные факторы проверки.", + "parent": "V16.3" + }, + { + "bom-ref": "V16.3.2", + "identifier": "V16.3.2", + "text": "Убедитесь, что ведется журнал неудачных попыток авторизации. Для уровня L3 это должно включать в себя журналирование всех решений об авторизации, включая журналирование доступа к конфиденциальным данным (без регистрации самих конфиденциальных данных).", + "parent": "V16.3" + }, + { + "bom-ref": "V16.3.3", + "identifier": "V16.3.3", + "text": "Убедитесь, что приложение регистрирует все события безопасности, определенные в документации, а также фиксирует попытки обхода механизмов защиты, включая проверку входных данных, бизнес-логики и системы защиты от автоматизированных атак.", + "parent": "V16.3" + }, + { + "bom-ref": "V16.3.4", + "identifier": "V16.3.4", + "text": "Убедитесь, что приложение регистрирует в журналах неожиданные ошибки и сбои механизмов безопасности, включая, например, ошибки TLS-соединения на стороне сервера.", + "parent": "V16.3" + }, + { + "bom-ref": "V16.4", + "identifier": "V16.4", + "title": "Защита журналов", + "parent": "V16" + }, + { + "bom-ref": "V16.4.1", + "identifier": "V16.4.1", + "text": "Убедитесь, что все компоненты системы логирования корректно кодируют данные, чтобы предотвратить атаки типа внедрения в журналы (log injection).", + "parent": "V16.4" + }, + { + "bom-ref": "V16.4.2", + "identifier": "V16.4.2", + "text": "Убедитесь, что логи защищены от неавторизованного доступа и не могут быть модифицированы.", + "parent": "V16.4" + }, + { + "bom-ref": "V16.4.3", + "identifier": "V16.4.3", + "text": "Убедитесь, что логи безопасно передаются в логически изолированную систему для анализа, обнаружения угроз, генерации оповещений и эскалации инцидентов. Это гарантирует сохранность журналов даже в случае компрометации основного приложения.", + "parent": "V16.4" + }, + { + "bom-ref": "V16.5", + "identifier": "V16.5", + "title": "Обработка ошибок", + "parent": "V16" + }, + { + "bom-ref": "V16.5.1", + "identifier": "V16.5.1", + "text": "Убедитесь, что при возникновении непредвиденной или связанной с безопасностью ошибки пользователю возвращается только общее сообщение, гарантируя отсутствие раскрытия конфиденциальных внутренних данных системы, таких как трассировки стека, запросы, секретные ключи и токены.", + "parent": "V16.5" + }, + { + "bom-ref": "V16.5.2", + "identifier": "V16.5.2", + "text": "Убедитесь, что приложение продолжает работать в безопасном режиме при недоступности внешних ресурсов, используя такие механизмы, как автоматические выключатели (circuit breakers) или плавное снижение функциональности (graceful degradation).", + "parent": "V16.5" + }, + { + "bom-ref": "V16.5.3", + "identifier": "V16.5.3", + "text": "Убедитесь, что приложение корректно и безопасно завершает работу при возникновении исключений, предотвращая опасные сценарии по типу «fail-open», когда, например, транзакция ошибочно выполняется, несмотря на ошибки в логике валидации.", + "parent": "V16.5" + }, + { + "bom-ref": "V16.5.4", + "identifier": "V16.5.4", + "text": "Убедитесь, что определён обработчик ошибок «крайние меры», который будет перехватывать все необработанные ошибки. Это необходимо как для предотвращения потери информации об ошибках, которая должна быть записана в файлы журналов, так и для того, чтобы ошибка не остановила весь процесс приложения, что привело бы к потере доступности.", + "parent": "V16.5" + }, + { + "bom-ref": "V17", + "identifier": "V17", + "title": "WebRTC" + }, + { + "bom-ref": "V17.1", + "identifier": "V17.1", + "title": "TURN-сервер", + "parent": "V17" + }, + { + "bom-ref": "V17.1.1", + "identifier": "V17.1.1", + "text": "Убедитесь, что сервис TURN (Traversal Using Relays around NAT) разрешает доступ только к IP-адресам, не зарезервированным для специальных целей (например, внутренние сети, широковещательная рассылка, loopback-адреса). Данное требование применяется как к IPv4, так и к IPv6 адресам.", + "parent": "V17.1" + }, + { + "bom-ref": "V17.1.2", + "identifier": "V17.1.2", + "text": "Убедитесь, что сервис TURN (Traversal Using Relays around NAT) защищен от исчерпания ресурсов при попытках легитимных пользователей открыть чрезмерное количество портов на сервере.", + "parent": "V17.1" + }, + { + "bom-ref": "V17.2", + "identifier": "V17.2", + "title": "Требования к медиасерверам", + "parent": "V17" + }, + { + "bom-ref": "V17.2.1", + "identifier": "V17.2.1", + "text": "Убедитесь, что ключ сертификата Datagram Transport Layer Security (DTLS) управляется и защищается в соответствии с документированной политикой управления криптографическими ключами.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.2", + "identifier": "V17.2.2", + "text": "Убедитесь, что медиасервер настроен на использование только одобренных наборов шифров Datagram Transport Layer Security (DTLS) и защищенного профиля безопасности для расширения DTLS, применяемого при установке ключей для Secure Real-time Transport Protocol (DTLS-SRTP).", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.3", + "identifier": "V17.2.3", + "text": "Убедитесь, что медиасервер проверяет аутентификацию Secure Real-time Transport Protocol (SRTP) для предотвращения атак с внедрением Real-time Transport Protocol (RTP), которые могут привести к отказу в обслуживании (Denial of Service) или вставке поддельного аудио-/видеоконтента в медиапотоки.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.4", + "identifier": "V17.2.4", + "text": "Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика при получении некорректных пакетов Secure Real-time Transport Protocol (SRTP).", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.5", + "identifier": "V17.2.5", + "text": "Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетами Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.6", + "identifier": "V17.2.6", + "text": "Убедитесь, что медиасервер не подвержен уязвимости «Гонка ClientHello» (ClientHello Race Condition) в Datagram Transport Layer Security (DTLS), проверив наличие известных уязвимостей в публичных источниках или выполнив тестирование на воспроизведение условий гонки.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.7", + "identifier": "V17.2.7", + "text": "Убедитесь, что механизмы аудио- и видеозаписи, связанные с медиасервером, способны продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетов Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.8", + "identifier": "V17.2.8", + "text": "Убедитесь, что сертификат Datagram Transport Layer Security (DTLS) проверяется на соответствие атрибуту отпечатка (fingerprint) в Session Description Protocol (SDP), с немедленным прекращением медиапотока в случае несоответствия — это гарантирует подлинность передаваемых данных.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.3", + "identifier": "V17.3", + "title": "Сигнализация", + "parent": "V17" + }, + { + "bom-ref": "V17.3.1", + "identifier": "V17.3.1", + "text": "Убедитесь, что сигнальный сервер способен продолжать обработку легитимных входящих сообщений сигнализации даже в условиях флуд-атаки. Для этого необходимо реализовать механизм ограничения частоты запросов (rate limiting) на уровне сигнализации.", + "parent": "V17.3" + }, + { + "bom-ref": "V17.3.2", + "identifier": "V17.3.2", + "text": "Убедитесь, что сигнальный сервер способен продолжать обработку легитимных сообщений сигнализации даже при получении некорректных сообщений, которые могут вызвать отказ в обслуживании (Denial of Service, DoS). Для этого необходимо реализовать: проверку входных данных (input validation), безопасную обработку целочисленных переполнений (integer overflows), защиту от переполнения буферов (buffer overflows) и другие надежные методы обработки ошибок.", + "parent": "V17.3" + } + ], + "levels": [ + { + "bom-ref": "level-1", + "identifier": "Level 1", + "description": "This level contains the minimum requirements to consider when securing an application and represents a critical starting point.", + "requirements": [ + "V1.2.1", + "V1.2.2", + "V1.2.3", + "V1.2.4", + "V1.2.5", + "V1.3.1", + "V1.3.2", + "V1.5.1", + "V2.1.1", + "V2.2.1", + "V2.2.2", + "V2.3.1", + "V3.2.1", + "V3.2.2", + "V3.3.1", + "V3.4.1", + "V3.4.2", + "V3.5.1", + "V3.5.2", + "V3.5.3", + "V4.1.1", + "V4.4.1", + "V5.2.1", + "V5.2.2", + "V5.3.1", + "V5.3.2", + "V6.1.1", + "V6.2.1", + "V6.2.2", + "V6.2.3", + "V6.2.4", + "V6.2.5", + "V6.2.6", + "V6.2.7", + "V6.2.8", + "V6.3.1", + "V6.3.2", + "V6.4.1", + "V6.4.2", + "V7.2.1", + "V7.2.2", + "V7.2.3", + "V7.2.4", + "V7.4.1", + "V7.4.2", + "V8.1.1", + "V8.2.1", + "V8.2.2", + "V8.3.1", + "V9.1.1", + "V9.1.2", + "V9.1.3", + "V9.2.1", + "V10.4.1", + "V10.4.2", + "V10.4.3", + "V10.4.4", + "V10.4.5", + "V11.3.1", + "V11.3.2", + "V11.4.1", + "V12.1.1", + "V12.2.1", + "V12.2.2", + "V13.4.1", + "V14.2.1", + "V14.3.1", + "V15.1.1", + "V15.2.1", + "V15.3.1" + ] + }, + { + "bom-ref": "level-2", + "identifier": "Level 2", + "description": "ASVS Level 2 requirements generally relate to either less common attacks or more complicated protections against common attacks. They may still be a first layer of defense, or they may require certain preconditions for the attack to be successful.", + "requirements": [ + "V1.1.1", + "V1.1.2", + "V1.2.6", + "V1.2.7", + "V1.2.8", + "V1.2.9", + "V1.3.3", + "V1.3.4", + "V1.3.5", + "V1.3.6", + "V1.3.7", + "V1.3.8", + "V1.3.9", + "V1.3.10", + "V1.3.11", + "V1.4.1", + "V1.4.2", + "V1.4.3", + "V1.5.2", + "V2.1.2", + "V2.1.3", + "V2.2.3", + "V2.3.2", + "V2.3.3", + "V2.3.4", + "V2.4.1", + "V3.3.2", + "V3.3.3", + "V3.3.4", + "V3.4.3", + "V3.4.4", + "V3.4.5", + "V3.4.6", + "V3.5.4", + "V3.5.5", + "V3.7.1", + "V3.7.2", + "V4.1.2", + "V4.1.3", + "V4.2.1", + "V4.3.1", + "V4.3.2", + "V4.4.2", + "V4.4.3", + "V4.4.4", + "V5.1.1", + "V5.2.3", + "V5.4.1", + "V5.4.2", + "V5.4.3", + "V6.1.2", + "V6.1.3", + "V6.2.9", + "V6.2.10", + "V6.2.11", + "V6.2.12", + "V6.3.3", + "V6.3.4", + "V6.4.3", + "V6.4.4", + "V6.5.1", + "V6.5.2", + "V6.5.3", + "V6.5.4", + "V6.5.5", + "V6.6.1", + "V6.6.2", + "V6.6.3", + "V6.8.1", + "V6.8.2", + "V6.8.3", + "V6.8.4", + "V7.1.1", + "V7.1.2", + "V7.1.3", + "V7.3.1", + "V7.3.2", + "V7.4.3", + "V7.4.4", + "V7.4.5", + "V7.5.1", + "V7.5.2", + "V7.6.1", + "V7.6.2", + "V8.1.2", + "V8.2.3", + "V8.4.1", + "V9.2.2", + "V9.2.3", + "V9.2.4", + "V10.1.1", + "V10.1.2", + "V10.2.1", + "V10.2.2", + "V10.3.1", + "V10.3.2", + "V10.3.3", + "V10.3.4", + "V10.4.6", + "V10.4.7", + "V10.4.8", + "V10.4.9", + "V10.4.10", + "V10.4.11", + "V10.5.1", + "V10.5.2", + "V10.5.3", + "V10.5.4", + "V10.5.5", + "V10.6.1", + "V10.6.2", + "V10.7.1", + "V10.7.2", + "V10.7.3", + "V11.1.1", + "V11.1.2", + "V11.2.1", + "V11.2.2", + "V11.2.3", + "V11.3.3", + "V11.4.2", + "V11.4.3", + "V11.4.4", + "V11.5.1", + "V11.6.1", + "V12.1.2", + "V12.1.3", + "V12.3.1", + "V12.3.2", + "V12.3.3", + "V12.3.4", + "V13.1.1", + "V13.2.1", + "V13.2.2", + "V13.2.3", + "V13.2.4", + "V13.2.5", + "V13.3.1", + "V13.3.2", + "V13.4.2", + "V13.4.3", + "V13.4.4", + "V13.4.5", + "V14.1.1", + "V14.1.2", + "V14.2.2", + "V14.2.3", + "V14.2.4", + "V14.3.2", + "V14.3.3", + "V15.1.2", + "V15.1.3", + "V15.2.2", + "V15.2.3", + "V15.3.2", + "V15.3.3", + "V15.3.4", + "V15.3.5", + "V15.3.6", + "V15.3.7", + "V16.1.1", + "V16.2.1", + "V16.2.2", + "V16.2.3", + "V16.2.4", + "V16.2.5", + "V16.3.1", + "V16.3.2", + "V16.3.3", + "V16.3.4", + "V16.4.1", + "V16.4.2", + "V16.4.3", + "V16.5.1", + "V16.5.2", + "V16.5.3", + "V17.1.1", + "V17.2.1", + "V17.2.2", + "V17.2.3", + "V17.2.4", + "V17.3.1", + "V17.3.2" + ] + }, + { + "bom-ref": "level-3", + "identifier": "Level 3", + "description": "ASVS Level 3 should be the goal for applications looking to demonstrate the highest levels of security and requirements in this section are generally either defense-in-depth mechanisms or other useful but hard-to-implement controls.", + "requirements": [ + "V1.2.10", + "V1.3.12", + "V1.5.3", + "V2.3.5", + "V2.4.2", + "V3.1.1", + "V3.2.3", + "V3.3.5", + "V3.4.7", + "V3.4.8", + "V3.5.6", + "V3.5.7", + "V3.5.8", + "V3.6.1", + "V3.7.3", + "V3.7.4", + "V3.7.5", + "V4.1.4", + "V4.1.5", + "V4.2.2", + "V4.2.3", + "V4.2.4", + "V4.2.5", + "V5.2.4", + "V5.2.5", + "V5.2.6", + "V5.3.3", + "V6.3.5", + "V6.3.6", + "V6.3.7", + "V6.3.8", + "V6.4.5", + "V6.4.6", + "V6.5.6", + "V6.5.7", + "V6.5.8", + "V6.6.4", + "V6.7.1", + "V6.7.2", + "V7.5.3", + "V8.1.3", + "V8.1.4", + "V8.2.4", + "V8.3.2", + "V8.3.3", + "V8.4.2", + "V10.2.3", + "V10.3.5", + "V10.4.12", + "V10.4.13", + "V10.4.14", + "V10.4.15", + "V10.4.16", + "V11.1.3", + "V11.1.4", + "V11.2.4", + "V11.2.5", + "V11.3.4", + "V11.3.5", + "V11.5.2", + "V11.6.2", + "V11.7.1", + "V11.7.2", + "V12.1.4", + "V12.1.5", + "V12.3.5", + "V13.1.2", + "V13.1.3", + "V13.1.4", + "V13.2.6", + "V13.3.3", + "V13.3.4", + "V13.4.6", + "V13.4.7", + "V14.2.5", + "V14.2.6", + "V14.2.7", + "V14.2.8", + "V15.1.4", + "V15.1.5", + "V15.2.4", + "V15.2.5", + "V15.4.1", + "V15.4.2", + "V15.4.3", + "V15.4.4", + "V16.5.4", + "V17.1.2", + "V17.2.5", + "V17.2.6", + "V17.2.7", + "V17.2.8" + ] + } + ], + "externalReferences": [ + { + "type": "website", + "url": "https://owasp.org/asvs" + }, + { + "type": "vcs", + "url": "https://github.com/OWASP/ASVS" + }, + { + "type": "issue-tracker", + "url": "https://github.com/OWASP/ASVS/issues" + }, + { + "type": "social", + "url": "https://twitter.com/OWASP_ASVS" + } + ] + } + ] + } +} diff --git a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.csv b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.csv new file mode 100644 index 0000000000..f339063108 --- /dev/null +++ b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.csv @@ -0,0 +1,347 @@ +chapter_id,chapter_name,section_id,section_name,req_id,req_description,L +V1,Кодировка и нейтрализация,V1.1,Архитектура кодировки и нейтрализации,V1.1.1,"Убедитесь, что входные данные декодируются или деэкранируются в каноническую форму (в стандартное представление) только один раз. Декодирование происходит только тогда, когда ожидаются закодированные данные в этой форме, и что это делается перед дальнейшей обработкой входных данных, например, это не выполняется после проверки или нейтрализации.",2 +V1,Кодировка и нейтрализация,V1.1,Архитектура кодировки и нейтрализации,V1.1.2,"Убедитесь, что приложение выполняет кодирование и экранирование выходных данных либо в качестве последнего шага перед использованием интерпретатором, для которого оно предназначено, либо самим интерпретатором.",2 +V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.1,"Убедитесь, что выходная кодировка для ответа HTTP, документа HTML или документа XML соответствует требуемому контексту, например, кодировка соответствующих символов для элементов HTML, атрибутов HTML, комментариев HTML, CSS или полей заголовка HTTP делается таким способом, чтобы избежать изменения структуры сообщения или документа.",1 +V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.2,"Убедитесь, что при динамическом построении URL-адресов недоверенные данные кодируются в соответствии с их контекстом (например, кодирование URL-адресов или кодирование base64url для query или path параметров или пути). Убедитесь, что разрешены только безопасные протоколы URL-адресов (например, запрещен javascript: или data:).",1 +V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.3,"Убедитесь, что при динамическом построении содержимого JavaScript (включая JSON) используется кодирование или экранирование выходных данных, чтобы избежать изменения структуры сообщения или документа (чтобы избежать JavaScript и JSON-инъекций).",1 +V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.4,"Убедитесь, что выборка данных (Redis, Memcached, чтение из файлов, обращение по API) или запросы к базе данных (например, SQL, HQL, NoSQL, Cypher) используют параметризованные запросы, ORM, Entity Frameworks или иным образом защищены от SQL-инъекций и других атак. Это также актуально при написании хранимых процедур.",1 +V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.5,"Убедитесь, что приложение защищено от внедрения команд ОС и что вызовы операционной системы используют параметризованные запросы к ОС или используют контекстное кодирование вывода командной строки.",1 +V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.6,"Убедитесь, что приложение защищено от LDAP-инъекций, или что реализованы специальные меры безопасности для их предотвращения.",2 +V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.7,"Убедитесь, что приложение защищено от атак с использованием XPath-инъекций с помощью параметризации запросов или предварительно скомпилированных запросов.",2 +V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.8,"Убедитесь, что процессоры LaTeX настроены безопасно (например, не используется флаг «–shell‑escape») и используется разрешенный список команд для предотвращения LaTeX-инъекций.",2 +V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.9,"Убедитесь, что приложение экранирует специальные символы в регулярных выражениях (обычно с помощью обратной косой черты), чтобы предотвратить их ошибочную интерпретацию как метасимволов.",2 +V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.10,"Убедитесь, что приложение защищено от внедрения формул CSV (CSV Injection). Приложение должно следовать правилам экранирования, определенным в RFC 4180, разделы 2.6 и 2.7, при экспорте содержимого CSV. Кроме того, при экспорте в CSV или другие форматы электронных таблиц (такие как XLS, XLSX или ODF) специальные символы (включая '=', '+', '-', '@', '\t' (табуляция), и '\0' (нулевой символ)) должны экранироваться одинарной кавычкой, если они появляются в качестве первого символа в значении поля.",3 +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.1,"Убедитесь, что все ненадежные входные данные HTML из редакторов WYSIWYG или аналогичных программ нейтрализуются с помощью известных и безопасных библиотек или функций фреймворка для санитизации HTML.",1 +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.2,"Убедитесь, что приложение избегает использования eval() или других динамических функций выполнения кода, таких как Spring Expression Language (SpEL). Если нет альтернативы, любой пользовательский ввод должен быть нейтрализован перед выполнением.",1 +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.3,"Убедитесь, что данные, передаваемые в потенциально опасный контекст, предварительно нейтрализованы, чтобы обеспечить соблюдение мер безопасности, таких как разрешение только тех символов, которые безопасны для данного контекста, и обрезка слишком длинного ввода.",2 +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.4,"Убедитесь, что предоставленный пользователем файл .SVG проверен или нейтрализован, чтобы он содержал только теги и атрибуты (например, относящиеся к рисованию), которые безопасны для приложения, например, не содержат скриптов и foreignObject.",2 +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.5,"Убедитесь, что приложение нейтралует или отключает предоставленные пользователем скриптовые данные или выражения шаблонных языков, такие как таблицы стилей Markdown, CSS или XSL, BBCode или аналогичные.",2 +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.6,"Убедитесь, что приложение защищено от атак с подделкой запросов на стороне сервера (SSRF), проверяя ненадежные данные по разрешенному списку протоколов, доменов, путей и портов, а также нейтрализуя потенциально опасные символы перед использованием данных для вызова другой службы.",2 +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.7,"Убедитесь, что приложение защищено от атак с внедрением шаблонов (template injection), не позволяя создавать шаблоны на основе недоверенных входных данных. Если нет альтернативы, любые недоверенные входные данные, включаемые динамически во время создания шаблона, должны быть нейтрализованы или тщательно провалидированы.",2 +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.8,"Убедитесь, что приложение надлежащим образом нейтрализует недоверенные входные данные перед использованием в запросах Java Naming and Directory Interface (JNDI) и что JNDI настроен безопасно для предотвращения атак с использованием JNDI-инъекций.",2 +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.9,"Убедитесь, что приложение нейтрализует данные перед отправкой в Memcache, чтобы предотвратить атаки методом инъекций.",2 +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.10,"Убедитесь, что строки форматирования, которые могут быть использованы неожидаемым или вредоносным образом, нейтрализуются перед дальнейшим использованием.",2 +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.11,"Убедитесь, что приложение нейтрализует вводимые пользователем данные перед передачей в почтовые системы для защиты от SMTP или IMAP-инъекций.",2 +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.12,"Убедитесь, что регулярные выражения не содержат элементов, вызывающих экспоненциальный возврат, и убедитесь в нейтрализации недоверенных входных данных для предотвращения атак ReDoS или Runaway Regex.",3 +V1,Кодировка и нейтрализация,V1.4,"Память, строки и неуправляемый код",V1.4.1,"Убедитесь, что для обнаружения или предотвращения ситуаций переполнения стека, буфера или кучи приложение учитывает размер доступной области памяти при строковых операциях, копировании в память, в арифметике указателей и т.п.",2 +V1,Кодировка и нейтрализация,V1.4,"Память, строки и неуправляемый код",V1.4.2,"Убедитесь, что для предотвращения целочисленного переполнения применяется контроль знака, диапазона и типа допустимых входных данных.",2 +V1,Кодировка и нейтрализация,V1.4,"Память, строки и неуправляемый код",V1.4.3,"Убедитесь, что динамически выделенная память и ресурсы освобождены, а ссылки или указатели на освобожденную память удалены или установлены в значение null, чтобы предотвратить появление висячих указателей и уязвимостей, связанных с использованием памяти после освобождения.",2 +V1,Кодировка и нейтрализация,V1.5,Безопасная десериализация,V1.5.1,"Убедитесь, что приложение настраивает XML-парсеры на использование строгой конфигурации и что небезопасные функции, такие как разрешение внешних сущностей, отключены для предотвращения атак XML eXternal Entity (XXE).",1 +V1,Кодировка и нейтрализация,V1.5,Безопасная десериализация,V1.5.2,"Убедитесь, что десериализация недоверенных данных обеспечивает безопасную обработку ввода, например, используя список разрешенных типов объектов или ограничивая типы объектов, определяемые клиентом, для предотвращения атак десериализации. Механизмы десериализации, которые явно определены как небезопасные, не должны использоваться с недоверенным вводом.",2 +V1,Кодировка и нейтрализация,V1.5,Безопасная десериализация,V1.5.3,"Убедитесь, что различные парсеры, используемые в приложении для одного и того же типа данных (например, парсеры JSON, XML, URL), выполняют парсинг согласованным образом и используют один и тот же механизм кодирования символов, чтобы избежать таких проблем, как уязвимости взаимодействия JSON (JSON Interoperability) или различное поведение анализа URI или файлов, которые могут использоваться в атаках удаленного включения файлов (RFI) или подделки запросов на стороне сервера (SSRF).",3 +V2,Валидация и бизнес-логика,V2.1,Документация валидации и бизнес-логики,V2.1.1,"Убедитесь, что в документации приложения определены правила проверки входных данных на соответствие ожидаемой структуре. Это могут быть распространённые форматы данных, такие как номера кредитных карт, адреса электронной почты, номера телефонов, или внутренний формат данных.",1 +V2,Валидация и бизнес-логика,V2.1,Документация валидации и бизнес-логики,V2.1.2,"Убедитесь, что в документации приложения указано, как проверять логическую и контекстную согласованность объединенных данных, например, проверять соответствие района и почтового индекса.",2 +V2,Валидация и бизнес-логика,V2.1,Документация валидации и бизнес-логики,V2.1.3,"Убедитесь, что ожидания относительно ограничений и проверок бизнес-логики задокументированы как для уровня отдельного пользователя, так и для глобального уровня всего приложения.",2 +V2,Валидация и бизнес-логика,V2.2,Валидация ввода,V2.2.1,"Убедитесь, что входные данные провалидированы для обеспечения соответствия бизнес- или функциональным ожиданиям. Валидация должна осуществляться либо по списку допустимых значений, шаблонов и диапазонов, либо путем сравнения входных данных с ожидаемой структурой и логическими ограничениями в соответствии с предопределенными правилами. Для L1 валидация может быть сосредоточена на входных данных, используемых для принятия конкретных бизнес-решений или решений, связанных с безопасностью. Для L2 и выше это должно применяться ко всем входным данным.",1 +V2,Валидация и бизнес-логика,V2.2,Валидация ввода,V2.2.2,"Убедитесь, что приложение разработано с принудительной валидацией входных данных на уровне доверенного сервиса. Хотя проверка на стороне клиента повышает удобство использования и должна поощряться, на неё не следует полагаться как на средство контроля безопасности.",1 +V2,Валидация и бизнес-логика,V2.2,Валидация ввода,V2.2.3,"Убедитесь, что приложение обеспечивает обоснованность комбинаций данных в соответствии с предопределенными правилам. Например: возраст должен соответствовать дате рождения; страна и почтовый индекс; количество товара в заказе и на складе.",2 +V2,Валидация и бизнес-логика,V2.3,Безопасность бизнес-логики,V2.3.1,"Убедитесь, что приложение обрабатывает потоки бизнес-логики для одного и того же пользователя в ожидаемом последовательном порядке шагов и без пропуска шагов.",1 +V2,Валидация и бизнес-логика,V2.3,Безопасность бизнес-логики,V2.3.2,"Убедитесь, что ограничения бизнес-логики реализованы в соответствии с документацией приложения, чтобы избежать эксплуатации её недостатков.",2 +V2,Валидация и бизнес-логика,V2.3,Безопасность бизнес-логики,V2.3.3,"Убедитесь, что транзакции используются на уровне бизнес-логики таким образом, что операция бизнес-логики либо выполняется полностью, либо откатывается к предыдущему корректному состоянию.",2 +V2,Валидация и бизнес-логика,V2.3,Безопасность бизнес-логики,V2.3.4,"Убедитесь, что на уровне бизнес-логики используются механизмы блокировки, чтобы гарантировать невозможность двойного бронирования ограниченных по количеству ресурсов (например, мест в театре или слотов доставки) путем манипулирования логикой приложения.",2 +V2,Валидация и бизнес-логика,V2.3,Безопасность бизнес-логики,V2.3.5,"Убедитесь, что для важных потоков бизнес-логики требуется многопользовательское (multi-user) одобрение, чтобы предотвратить несанкционированные или случайные действия. Потоки бизнес-логики могут включать, помимо прочего, крупные денежные переводы, утверждение контрактов, доступ к секретной информации или обход ограничений безопасности на производстве.",3 +V2,Валидация и бизнес-логика,V2.4,Анти-автоматизация,V2.4.1,"Убедитесь, что используются средства противодействия автоматизации для защиты от чрезмерных вызовов функций приложения, которые могут привести к утечке данных, созданию ненужных данных, исчерпанию квот, нарушению ограничений скорости, отказу в обслуживании или чрезмерному использованию дорогостоящих ресурсов.",2 +V2,Валидация и бизнес-логика,V2.4,Анти-автоматизация,V2.4.2,"Убедитесь, что потоки бизнес-логики требуют реалистичного человеческого времени, предотвращая чрезмерно быструю отправку транзакций.",3 +V3,Безопасность веб-интерфейса,V3.1,Документация по безопасности веб-интерфейса,V3.1.1,"Убедитесь, что в документации приложения описаны ожидаемые функции безопасности, которые должны поддерживать браузеры, использующие приложение (такие как HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) и другие соответствующие механизмы безопасности HTTP). В документации также должно быть обязательно определено, как приложение должно себя вести, если некоторые из этих функций недоступны (например, предупреждать пользователя или блокировать доступ).",3 +V3,Безопасность веб-интерфейса,V3.2,Непреднамеренная интерпретация контента,V3.2.1,"Убедитесь, что реализованы меры безопасности, предотвращающие отображение контента или функций браузерами в HTTP-ответах в некорректном контексте (например, запрос API, загруженный пользователем файл или другой ресурс запрашивается напрямую). Возможные способы контроля включают: не обрабатывать содержимое, если поля заголовка HTTP-запроса (например, Sec-Fetch-*) не указывают на корректность контекста; использование заголовка и значения Content-Security-Policy: sandbox directive; или использование заголовка и значения Content-Disposition: attachment.",1 +V3,Безопасность веб-интерфейса,V3.2,Непреднамеренная интерпретация контента,V3.2.2,"Убедитесь, что данные, предназначенные для отображения в виде текста, а не визуализации в виде HTML, обрабатывается с использованием безопасных функций визуализации (таких как createTextNode или textContent), чтобы предотвратить непреднамеренное выполнение содержимого, такого как HTML или JavaScript.",1 +V3,Безопасность веб-интерфейса,V3.2,Непреднамеренная интерпретация контента,V3.2.3,"Убедитесь, что приложение избегает затирания DOM при использовании JavaScript на стороне клиента, применяя явные объявления переменных, выполняя строгую проверку типов, избегая сохранения глобальных переменных в объекте документа и реализуя изоляцию пространства имен.",3 +V3,Безопасность веб-интерфейса,V3.3,Настройка файлов cookie,V3.3.1,"Убедитесь, что у файлов cookie установлен атрибут «Secure», и если префикс «__Host‑» не используется в названии cookie, необходимо использовать префикс «__Secure‑».",1 +V3,Безопасность веб-интерфейса,V3.3,Настройка файлов cookie,V3.3.2,"Убедитесь, что значение атрибута SameSite каждой cookie установлено в соответствии с назначением cookie, чтобы ограничить подверженность атакам на восстановление пользовательского интерфейса и атакам с подделкой запросов на уровне браузера, обычно называемым подделкой межсайтовых запросов (CSRF).",2 +V3,Безопасность веб-интерфейса,V3.3,Настройка файлов cookie,V3.3.3,"Убедитесь, что cookie имеют префикс «__Host‑» в названии, если только они явно не предназначены для совместного использования с другими хостами.",2 +V3,Безопасность веб-интерфейса,V3.3,Настройка файлов cookie,V3.3.4,"Убедитесь, что если значение cookie не должно быть доступно для клиентских скриптов (например, сессионный токен), для cookie должен быть установлен атрибут «HttpOnly», а само значение должно передаваться клиенту только через поле заголовка «Set-Cookie».",2 +V3,Безопасность веб-интерфейса,V3.3,Настройка файлов cookie,V3.3.5,"Убедитесь, что при записи cookie приложением общая длина имени и значения cookie не превышает 4096 байт. Слишком большие cookie не будут сохраняться браузером и, следовательно, не будут отправляться с запросами, что помешает пользователю использовать функции приложения, зависящие от этого cookie.",3 +V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.1,"Убедитесь, что поле заголовка Strict‑Transport‑Security включено во все ответы для реализации политики HTTP Strict Transport Security (HSTS). Необходимо указать максимальное время не менее 1 года, а для L2 и выше политика должна применяться также ко всем поддоменам.",1 +V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.2,"Убедитесь, что поле заголовка Cross‑Origin Resource Sharing (CORS) «Access‑Control‑Allow‑Origin» имеет фиксированное значение, заданное приложением, или, если используется заголовок Origin, оно проверяется по списку доверенных источников. При необходимости использования «Access‑Control‑Allow‑Origin: *» убедитесь, что ответ не содержит конфиденциальной информации.",1 +V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.3,"Убедитесь, что HTTP-ответы содержат поле заголовка Content-Security-Policy, которое определяет директивы, гарантирующие загрузку и выполнение браузером только доверенного контента или ресурсов, чтобы ограничить выполнение вредоносного JavaScript. Как минимум, необходимо использовать глобальную политику, включающую директивы object-src «none» и base-uri «none», а также определяющую список разрешенных адресов или использующую одноразовые коды или хэши. Для приложений L3 необходимо определить политику использования 'nonce' или hash-конструкций для каждого ответа.",2 +V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.4,"Убедитесь, что все HTTP-ответы содержат поле заголовка «X‑Content‑Type‑Options: nosniff». Это предписывает браузерам не использовать анализ контента и определение типа MIME для данного ответа, а также требовать, чтобы значение поля заголовка Content‑Type в ответе соответствовало целевому ресурсу. Например, ответ на запрос стиля принимается только в том случае, если Content‑Type в ответе — «text/css». Это также позволяет браузеру использовать функцию Cross‑Origin Read Blocking (CORB).",2 +V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.5,"Убедитесь, что приложение устанавливает политику реферера для предотвращения утечки технически конфиденциальных данных сторонним сервисам через поле заголовка HTTP-запроса «Referer». Это можно сделать с помощью поля заголовка HTTP-ответа «Referrer‑Policy» или через атрибуты HTML-элемента. Конфиденциальные данные могут включать путь и данные запроса в URL-адресе, а для внутренних непубличных приложений также имя хоста.",2 +V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.6,"Убедитесь, что веб-приложение использует директиву frame‑ancestors поля заголовка Content‑Security‑Policy для каждого HTTP-ответа, чтобы гарантировать невозможность его внедрения по умолчанию и внедрение определённых ресурсов разрешено только при необходимости. Обратите внимание, что поле заголовка X‑Frame‑Options, хотя и поддерживается браузерами, устарело и не может быть использовано в качестве основы.",2 +V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.7,"Убедитесь, что в поле заголовка Content‑Security‑Policy указано место, куда следует сообщать о нарушениях.",3 +V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.8,"Убедитесь, что все HTTP-ответы, инициирующие рендеринг документа (например, ответы с типом содержимого text/html), включают поле заголовка Cross-Origin-Opener-Policy с директивой same-origin или same-origin-allow-popups (при необходимости). Это предотвращает атаки, злоупотребляющие общим доступом к объектам Window, такие как Tabnabbing и Frame Counting.",3 +V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.1,"Убедитесь, что, если приложение не использует механизм предварительной проверки CORS для предотвращения запрещённых кросс-доменных запросов на использование чувствительного функционала, эти запросы валидируются на предмет их происхождения от самого приложения. Это можно сделать, используя и проверяя специальные токены для защиты от подделки или требуя дополнительные поля HTTP-заголовка, не входящие в список «простых заголовков» (CORS-safelisted request-header). Это необходимо для защиты от атак с подделкой запросов через браузер, широко известных как межсайтовая подделка запросов (CSRF).",1 +V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.2,"Убедитесь, что если приложение использует механизм предварительной проверки CORS для предотвращения неразрешённого использования чувствительного функционала между источниками, вызов этого функционала невозможен с помощью запроса, который не запускает предварительную проверку CORS. Для этого может потребоваться проверка значений полей заголовка запроса «Origin» и «Content-Type» или использование дополнительного поля заголовка, не входящего в безопасный список CORS.",1 +V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.3,"Убедитесь, что HTTP-запросы к чувствительному функционалу используют соответствующие HTTP-методы, такие как POST, PUT, PATCH или DELETE, а не методы, определённые спецификацией HTTP как «безопасные», такие как HEAD, OPTIONS или GET. В качестве альтернативы можно использовать строгую валидацию полей заголовка запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, навигационного запроса или загрузки ресурса (например, источника изображения), где это не ожидается.",1 +V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.4,"Убедитесь, что отдельные приложения размещены на разных именах хостов, чтобы использовать ограничения, предусмотренные политикой same-origin, включая то, как документы или скрипты, загруженные одним источником, могут взаимодействовать с ресурсами из другого источника, а также ограничения на cookie на основе имени хоста.",2 +V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.5,"Убедитесь, что сообщения, полученные интерфейсом postMessage, отвергаются, если источник сообщения не является доверенным или если синтаксис сообщения недействителен.",2 +V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.6,"Убедитесь, что функциональность JSONP не включена нигде в приложении, чтобы избежать атак с использованием межсайтового включения скриптов (XSSI).",3 +V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.7,"Убедитесь, что данные, требующие авторизации, не включены в ответы ресурсов скриптов, таких как файлы JavaScript, чтобы предотвратить атаки с использованием межсайтового включения скриптов (XSSI).",3 +V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.8,"Убедитесь, что аутентифицированные ресурсы (такие как изображения, видео, скрипты и другие документы) могут быть загружены или внедрены от имени пользователя только по назначению. Этого можно добиться путём строгой валидации полей заголовка HTTP-запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, или путём установки ограничительного поля заголовка HTTP-ответа Cross‑Origin‑Resource‑Policy, чтобы браузер блокировал возвращаемый контент.",3 +V3,Безопасность веб-интерфейса,V3.6,Целостность внешних ресурсов,V3.6.1,"Убедитесь, что клиентские ресурсы, такие как библиотеки JavaScript, CSS или веб-шрифты, размещаются только на внешнем сервере (например, в сети доставки контента (Content Delivery Network)), если ресурс статический и имеет версии, а для проверки целостности ресурса используется механизм проверки целостности подресурсов (SRI). Если это невозможно, для каждого ресурса должно быть задокументировано решение по безопасности, обосновывающее это.",3 +V3,Безопасность веб-интерфейса,V3.7,Другие соображения по безопасности браузера,V3.7.1,"Убедитесь, что приложение использует только те клиентские технологии, которые по-прежнему поддерживаются и считаются безопасными. Примерами технологий, не соответствующих этому требованию, являются плагины NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL или клиентские Java-апплеты.",2 +V3,Безопасность веб-интерфейса,V3.7,Другие соображения по безопасности браузера,V3.7.2,"Убедитесь, что приложение будет автоматически перенаправлять пользователя на другое имя хоста или домен (который не контролируется приложением), только если этот хост или домен указаны в списке разрешенных.",2 +V3,Безопасность веб-интерфейса,V3.7,Другие соображения по безопасности браузера,V3.7.3,"Убедитесь, что приложение отображает уведомление, что пользователь перенаправляется на URL-адрес, находящийся вне контроля приложения, с возможностью отмены навигации.",3 +V3,Безопасность веб-интерфейса,V3.7,Другие соображения по безопасности браузера,V3.7.4,"Убедитесь, что домен верхнего уровня приложения (например, site.tld) ​​добавлен в публичный список предварительной загрузки (preload list) для HTTP Strict Transport Security (HSTS). Это гарантирует, что использование TLS для приложения будет встроено непосредственно в основные браузеры, а не будет полагаться только на поле заголовка ответа Strict-Transport-Security.",3 +V3,Безопасность веб-интерфейса,V3.7,Другие соображения по безопасности браузера,V3.7.5,"Убедитесь, что приложение ведет себя так, как описано в документации (например, предупреждает пользователя или блокирует доступ), если браузер, используемый для доступа к приложению, не поддерживает ожидаемые функции безопасности.",3 +V4,API и Веб-сервис,V4.1,Общая безопасность веб-сервисов,V4.1.1,"Убедитесь, что каждый HTTP-ответ с телом сообщения содержит заголовок Content-Type, который соответствует фактическому содержимому ответа, таким как «text/», «/+xml» и «/xml», включая параметр charset для указания безопасной кодировки символов (например, UTF-8, ISO-8859-1) согласно IANA Media Types.",1 +V4,API и Веб-сервис,V4.1,Общая безопасность веб-сервисов,V4.1.2,"Убедитесь, что только конечные точки, предназначенные для взаимодействия с пользователем через веб-браузер, автоматически перенаправляют HTTP на HTTPS, в то время как другие сервисы или конечные точки не реализуют прозрачные редиректы. Это необходимо, чтобы избежать ситуации, когда клиент ошибочно отправляет незашифрованные HTTP-запросы а из-за того, что запрос по HTTP автоматически перенаправляется на HTTPS другим сервисом без обработки на входе, утечка чувствительных данных остаётся незамеченной.",2 +V4,API и Веб-сервис,V4.1,Общая безопасность веб-сервисов,V4.1.3,"Убедитесь, что любой HTTP-заголовок, используемый приложением и устанавливаемый промежуточным уровнем, таким как балансировщик нагрузки, веб-прокси или backend-for-frontend сервис, не может быть переопределён конечным пользователем. Примеры заголовков: X-Real-IP, X-Forwarded-*, X-User-ID.",2 +V4,API и Веб-сервис,V4.1,Общая безопасность веб-сервисов,V4.1.4,"Убедитесь, что разрешены только HTTP-методы, которые явно поддерживаются приложением или его API (включая OPTIONS для preflight-запросов), а неиспользуемые методы заблокированы.",3 +V4,API и Веб-сервис,V4.1,Общая безопасность веб-сервисов,V4.1.5,"Убедитесь, что для особо чувствительных запросов или транзакций, проходящих через несколько систем, используются цифровые подписи на уровне сообщений, дополнительно к транспортным средствам защиты.",3 +V4,API и Веб-сервис,V4.2,Валидация структуры HTTP-сообщений,V4.2.1,"Убедитесь, что все компоненты приложения (включая балансировщики нагрузки, файрволы и серверы приложений) определяют границы входящих HTTP-сообщений с использованием механизма, соответствующего версии HTTP, чтобы предотвратить HTTP request smuggling. В HTTP/1.x, если присутствует заголовок Transfer-Encoding, заголовок Content-Length должен игнорироваться согласно RFC 2616. При использовании HTTP/2 или HTTP/3, если присутствует Content-Length, веб-сервер должен убедиться, что он совпадает с длиной DATA-фреймов.",2 +V4,API и Веб-сервис,V4.2,Валидация структуры HTTP-сообщений,V4.2.2,"Убедитесь, что при генерации HTTP-сообщений заголовок Content-Length не конфликтует с длиной содержимого, определяемой рамками протокола HTTP, чтобы предотвратить HTTP Request Smuggling.",3 +V4,API и Веб-сервис,V4.2,Валидация структуры HTTP-сообщений,V4.2.3,"Убедитесь, что приложение не отправляет и не принимает HTTP/2 и HTTP/3 сообщения с заголовками, специфичными для соединения, такими как Transfer-Encoding, чтобы предотвратить HTTP Response Splitting и HTTP Header Injection.",3 +V4,API и Веб-сервис,V4.2,Валидация структуры HTTP-сообщений,V4.2.4,"Убедитесь, что приложение принимает HTTP/2 и HTTP/3 запросы только в случае, если поля заголовков и их значения не содержат последовательностей CR (\r), LF (\n) или CRLF (\r\n), чтобы предотвратить HTTP Header Injection.",3 +V4,API и Веб-сервис,V4.2,Валидация структуры HTTP-сообщений,V4.2.5,"Убедитесь, что если приложение (бекенд или фронтенд) формирует и отправляет запросы, оно использует валидацию, очистку или другие механизмы, чтобы не создавать URI (например, для API-вызовов) или HTTP-заголовки (например, Authorization или Cookie) слишком большой длины, чтобы их не принимал приёмник. Это может привести к отказу в обслуживании, например, при отправке слишком длинного запроса (длинный cookie-заголовок), из-за чего сервер постоянно возвращает ошибку.",3 +V4,API и Веб-сервис,V4.3,GraphQL,V4.3.1,"Убедитесь, что используется белый список запросов, ограничение глубины вложенности, ограничение количества или анализ стоимости запроса, чтобы предотвратить DoS-атаки на уровне GraphQL или слоя данных из-за дорогостоящих вложенных запросов.",2 +V4,API и Веб-сервис,V4.3,GraphQL,V4.3.2,"Убедитесь, что introspection-запросы GraphQL отключены в продакшен-среде, если GraphQL API не предназначен для использования сторонними клиентами.",2 +V4,API и Веб-сервис,V4.4,WebSocket,V4.4.1,"Убедитесь, что для всех WebSocket-соединений используется WebSocket поверх TLS (WSS).",1 +V4,API и Веб-сервис,V4.4,WebSocket,V4.4.2,"Убедитесь, что при первоначальном HTTP WebSocket handshake заголовок Origin проверяется на соответствие списку разрешённых источников для приложения.",2 +V4,API и Веб-сервис,V4.4,WebSocket,V4.4.3,"Убедитесь, что если стандартное управление сессиями приложения не может быть использовано, применяются специальные токены, соответствующие требованиям безопасности управления сессиями.",2 +V4,API и Веб-сервис,V4.4,WebSocket,V4.4.4,"Убедитесь, что специальные токены управления сессиями WebSocket изначально получаются или валидируются через ранее аутентифицированную HTTPS-сессию при переходе от HTTPS к WebSocket.",2 +V5,Работа с файлами,V5.1,Документация по работе с файлами,V5.1.1,"Убедитесь, что документация определяет допустимые типы файлов, ожидаемые расширения и максимальный размер (включая распакованный размер) для каждой функции загрузки. Также убедитесь, что в документации указано, как файлы обезвреживаются для конечных пользователей (например, как приложение ведёт себя при обнаружении вредоносного файла).",2 +V5,Работа с файлами,V5.2,Загрузка файлов и содержимое,V5.2.1,"Убедитесь, что приложение принимает только те файлы, которые может обработать без потери производительности или отказа в обслуживании.",1 +V5,Работа с файлами,V5.2,Загрузка файлов и содержимое,V5.2.2,"Убедитесь, что при загрузке файла (включая файлы внутри архивов, таких как ZIP) приложение проверяет, соответствует ли расширение ожидаемому, и валидирует, соответствует ли содержимое типу, указанному в расширении. Это включает проверку начальных 'magic bytes', перезапись изображений, использование специализированных библиотек. Для уровня 1 — достаточно проверок для файлов, критичных с точки зрения бизнеса или безопасности. Для уровней 2 и выше — для всех файлов.",1 +V5,Работа с файлами,V5.2,Загрузка файлов и содержимое,V5.2.3,"Убедитесь, что приложение проверяет архивы (например, zip, gz, docx, odt) на максимально допустимый распакованный размер и максимальное количество файлов до распаковки.",2 +V5,Работа с файлами,V5.2,Загрузка файлов и содержимое,V5.2.4,"Убедитесь, что для каждого пользователя установлены квоты на общий размер и количество файлов, чтобы один пользователь не мог переполнить хранилище.",3 +V5,Работа с файлами,V5.2,Загрузка файлов и содержимое,V5.2.5,"Убедитесь, что приложение не позволяет загружать архивы с символьными ссылками (symlinks), если это не требуется по бизнес-логике. Если требуется — разрешён только строго определённый список допустимых символьных ссылок.",3 +V5,Работа с файлами,V5.2,Загрузка файлов и содержимое,V5.2.6,"Убедитесь, что приложение отклоняет изображения с числом пикселей выше допустимого, чтобы предотвратить атаки 'pixel flood'.",3 +V5,Работа с файлами,V5.3,Хранение файлов,V5.3.1,"Убедитесь, что загруженные или сгенерированные из недоверенного ввода файлы, находящиеся в публичной директории, не исполняются как серверный код при обращении к ним по HTTP.",1 +V5,Работа с файлами,V5.3,Хранение файлов,V5.3.2,"Убедитесь, что при создании путей к файлам приложение использует внутренние или доверенные данные, а не пользовательские имена файлов. Если использование пользовательских имён или метаданных необходимо — требуется строгая проверка и очистка. Это защита от path traversal, LFI, RFI и SSRF.",1 +V5,Работа с файлами,V5.3,Хранение файлов,V5.3.3,"Убедитесь, что при обработке файлов на сервере (например, при распаковке) игнорируются пути, заданные пользователем, во избежание уязвимостей типа 'zip slip'.",3 +V5,Работа с файлами,V5.4,Скачивание файлов,V5.4.1,"Убедитесь, что приложение валидирует или игнорирует имена файлов, переданных пользователем (включая в JSON, JSONP или URL-параметре), и указывает имя файла в заголовке Content-Disposition при ответе.",2 +V5,Работа с файлами,V5.4,Скачивание файлов,V5.4.2,"Убедитесь, что имена файлов, передаваемые (например, в HTTP-заголовках или вложениях в email), кодируются или очищаются (например, по RFC 6266), чтобы сохранить структуру документа и предотвратить инъекции.",2 +V5,Работа с файлами,V5.4,Скачивание файлов,V5.4.3,"Убедитесь, что файлы, полученные из недоверенных источников, сканируются антивирусом, чтобы не распространять известное вредоносное содержимое.",2 +V6,Аутентификация,V6.1,Документация по аутентификации,V6.1.1,"Убедитесь, что в документации приложения описано, как используются механизмы, такие как ограничение частоты запросов (rate limiting), защита от автоматизации и адаптивные реакции, для защиты от атак, таких как подстановка учётных данных и перебор паролей. Документация должна ясно описывать конфигурацию этих механизмов и предотвращение злонамеренной блокировки аккаунтов.",1 +V6,Аутентификация,V6.1,Документация по аутентификации,V6.1.2,"Убедитесь, что задокументирован список контекстно-зависимых слов, запрещённых к использованию в паролях. В него могут входить производные от названий организаций, продуктов, идентификаторов систем, кодовых названий проектов, названий отделов или ролей и тому подобное.",2 +V6,Аутентификация,V6.1,Документация по аутентификации,V6.1.3,"Убедитесь, что если приложение поддерживает несколько способов аутентификации, то все они документированы вместе с описанием применяемых средств защиты и уровнем стойкости аутентификации, которые должны быть одинаково применены ко всем способам.",2 +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.1,"Убедитесь, что пользовательские пароли содержат не менее 8 символов. Рекомендуется минимальная длина в 15 символов.",1 +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.2,"Убедитесь, что пользователи могут менять свои пароли.",1 +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.3,"Убедитесь, что для смены пароля требуется ввести как текущий, так и новый пароль.",1 +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.4,"Убедитесь, что при регистрации или смене пароля введённый пароль проверяется по списку как минимум из 3000 самых популярных паролей, соответствующих политике (например, минимальной длине).",1 +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.5,"Убедитесь, что допускаются пароли любой структуры, без ограничений на использование определённых символов. Не должно быть требований по обязательному наличию заглавных/строчных букв, цифр или специальных символов.",1 +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.6,"Убедитесь, что поля ввода пароля используют type=password для скрытия символов. Разрешено временное отображение всего пароля или последнего введённого символа.",1 +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.7,"Убедитесь, что разрешены вставка (paste), использование менеджеров паролей браузера и внешних менеджеров паролей.",1 +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.8,"Убедитесь, что пароль проверяется строго в том виде, в котором он был введён пользователем — без обрезки, изменения регистра и других модификаций.",1 +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.9,"Убедитесь, что система позволяет использовать пароли длиной не менее 64 символов.",2 +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.10,"Убедитесь, что пароль остаётся действительным, пока не будет скомпрометирован или не будет изменён пользователем. Приложение не должно требовать регулярной смены пароля.",2 +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.11,"Убедитесь, что используется документированный список контекстно-зависимых слов (например, названия компаний, проектов и т.д.) для предотвращения использования легко угадываемых паролей.",2 +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.12,"Убедитесь, что при регистрации или смене пароля проверяется, не входит ли он в список скомпрометированных (утёкших) паролей.",2 +V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.1,"Убедитесь, что реализованы меры защиты от атак типа credential stuffing (массовая подстановка учётных данных) и brute-force (перебор паролей), согласно документации по безопасности приложения.",1 +V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.2,"Убедитесь, что в приложении отсутствуют или отключены учётные записи по умолчанию (например, root, admin, sa).",1 +V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.3,"Убедитесь, что для доступа к приложению используется либо механизм многофакторной аутентификации, либо комбинация однофакторных. Для уровня L3 один из факторов должен быть аппаратным, обеспечивающим защиту от фишинга, устойчивость к компрометации и подтверждение намерения аутентификации через явное действие пользователя (например, нажатие кнопки на FIDO-ключе или телефоне). Ослабление этих требований допускается только при наличии обоснования и компенсирующих мер.",2 +V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.4,"Убедитесь, что при наличии нескольких способов аутентификации, они все задокументированы, и для них единообразно применяются меры защиты и уровни доверия.",2 +V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.5,"Убедитесь, что пользователи получают уведомления о подозрительных попытках аутентификации (удачных и неудачных). Это может включать попытки (например, подключения) с необычного устройства или места, частично успешную MFA, попытку после долгого отсутствия или успешную аутентификацию после серии неудачных.",3 +V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.6,"Убедитесь, что email не используется ни как однофакторный, ни как многофакторный механизм аутентификации.",3 +V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.7,"Убедитесь, что пользователи получают уведомление при изменении данных аутентификации, таких как сброс пароля или изменение логина/email.",3 +V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.8,"Убедитесь, что из сообщений об ошибке, HTTP-кодов ответа или различий во времени ответа нельзя определить, существует ли пользователь с таким логином. Это правило также должно применяться к функциям регистрации и восстановления пароля.",3 +V6,Аутентификация,V6.4,Жизненный цикл и восстановление факторов аутентификации,V6.4.1,"Убедитесь, что начальные пароли или коды активации, генерируемые системой, создаются с использованием надёжного генератора случайных чисел, соответствуют текущей политике паролей и истекают через короткий период времени либо после первого использования. Эти секреты не должны использоваться как постоянные пароли.",1 +V6,Аутентификация,V6.4,Жизненный цикл и восстановление факторов аутентификации,V6.4.2,"Убедитесь, что в системе отсутствуют подсказки к паролю или вопросы на знание («секретные вопросы»).",1 +V6,Аутентификация,V6.4,Жизненный цикл и восстановление факторов аутентификации,V6.4.3,"Убедитесь, что реализован безопасный процесс сброса забытого пароля, который не обходит активные механизмы многофакторной аутентификации.",2 +V6,Аутентификация,V6.4,Жизненный цикл и восстановление факторов аутентификации,V6.4.4,"Убедитесь, что в случае утраты одного из факторов MFA проводится удостоверение личности (identity proofing) на том же уровне, что и при первичной регистрации.",2 +V6,Аутентификация,V6.4,Жизненный цикл и восстановление факторов аутентификации,V6.4.5,"Убедитесь, что инструкции по обновлению истекающих механизмов аутентификации отправляются заранее, с достаточным запасом времени для выполнения замены, при необходимости с настройкой автоматических напоминаний.",3 +V6,Аутентификация,V6.4,Жизненный цикл и восстановление факторов аутентификации,V6.4.6,"Убедитесь, что администраторы могут инициировать процесс сброса пароля, но не могут задать или выбрать новый пароль за пользователя. Это исключает ситуацию, при которой администратор знает пароль пользователя.",3 +V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.1,"Убедитесь, что lookup-секреты, внеполосные коды/запросы и TOTP-коды можно использовать только один раз.",2 +V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.2,"Убедитесь, что при хранении lookup-секретов с энтропией менее 112 бит (например, 19 случайных буквенно-цифровых символов или 34 случайные цифры) они хэшируются с использованием разрешённого алгоритма хеширования паролей и случайной соли минимум 32 бита. Если у секрета ≥112 бит энтропии — допустимо использовать стандартный хэш.",2 +V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.3,"Убедитесь, что lookup-секреты, коды внеполосной аутентификации и сиды для TOTP генерируются с использованием криптографически стойкого генератора случайных чисел (CSPRNG), чтобы избежать предсказуемых значений.",2 +V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.4,"Убедитесь, что lookup-секреты и внеполосные коды аутентификации имеют минимум 20 бит энтропии (достаточно, например, 4 случайных алфавитно-цифровых символов или 6 случайных цифр).",2 +V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.5,"Убедитесь, что все внеполосные запросы, коды и токены, а также TOTP-коды имеют ограниченный срок действия. Максимум для out-of-band — 10 минут, для TOTP — 30 секунд.",2 +V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.6,"Убедитесь, что любой фактор аутентификации (включая физические устройства) может быть отозван в случае кражи или утери.",3 +V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.7,"Убедитесь, что биометрические механизмы аутентификации используются только как вторичный фактор — в сочетании с «чем-то, что вы знаете» или «чем-то, что у вас есть».",3 +V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.8,"Убедитесь, что TOTP-коды проверяются по источнику времени, полученному от доверенного сервиса, а не от клиента или недоверенного источника.",3 +V6,Аутентификация,V6.6,Внеполосные механизмы аутентификации,V6.6.1,"Убедитесь, что механизмы аутентификации через телефонную сеть общего пользования (PSTN) для доставки одноразовых паролей (OTP) по телефону или SMS используются только в случае предварительной валидации номера, при этом предлагаются альтернативные более безопасные методы (например, TOTP), и пользователю сообщаются риски. Для приложений уровня L3 использование телефона и SMS недопустимо.",2 +V6,Аутентификация,V6.6,Внеполосные механизмы аутентификации,V6.6.2,"Убедитесь, что внеполосные запросы, коды или токены привязаны к исходному запросу аутентификации, для которого они были сгенерированы, и не могут быть использованы повторно для других попыток.",2 +V6,Аутентификация,V6.6,Внеполосные механизмы аутентификации,V6.6.3,"Убедитесь, что внеполосные механизмы на основе кода защищены от атак методом подбора (brute force) путём применения ограничения частоты запросов (rate limiting). Также рекомендуется использовать коды с энтропией не менее 64 бит.",2 +V6,Аутентификация,V6.6,Внеполосные механизмы аутентификации,V6.6.4,"Убедитесь, что при использовании push-уведомлений для MFA применяется ограничение частоты (rate limiting), чтобы предотвратить атаки push-бомбинга. Также может помочь механизм сопоставления номеров (number matching).",3 +V6,Аутентификация,V6.7,Криптографические механизмы аутентификации,V6.7.1,"Убедитесь, что сертификаты, используемые для проверки криптографических утверждений об аутентификации, хранятся таким образом, чтобы исключить возможность их модификации.",3 +V6,Аутентификация,V6.7,Криптографические механизмы аутентификации,V6.7.2,"Убедитесь, что nonce (случайная строка), используемая в процессе вызова, имеет длину не менее 64 бит и является статистически уникальной или уникальной на протяжении всего срока службы криптографического устройства.",3 +V6,Аутентификация,V6.8,Аутентификация с использованием провайдера идентификаций (IdP),V6.8.1,"Убедитесь, что при поддержке несколькими IdP, невозможно подделать личность пользователя через другой IdP (например, с тем же user ID). Стандартным способом защиты является регистрация пользователя с использованием сочетания ID самого IdP (в качестве пространства имён) и пользовательского ID внутри IdP.",2 +V6,Аутентификация,V6.8,Аутентификация с использованием провайдера идентификаций (IdP),V6.8.2,"Убедитесь, что наличие и целостность цифровой подписи в утверждениях аутентификации (например, в JWT или SAML) всегда проверяются, а неподписанные или недействительные утверждения отклоняются.",2 +V6,Аутентификация,V6.8,Аутентификация с использованием провайдера идентификаций (IdP),V6.8.3,"Убедитесь, что SAML-утверждения обрабатываются только один раз в течение периода их действия, чтобы исключить атаки воспроизведения (replay attacks).",2 +V6,Аутентификация,V6.8,Аутентификация с использованием провайдера идентификаций (IdP),V6.8.4,"Убедитесь, что если приложение использует внешний поставщик идентификации (IdP) и для определенных функций требуется особый уровень, метод или срок действия аутентификации, то приложение использует данные, возвращаемые IdP, для проверки этих условий. Например, при использовании OIDC можно проверить значения полей ID Token — acr, amr, auth_time (если они есть). Если IdP не предоставляет эти данные, приложение должно иметь документированный план действий по умолчанию, предполагающий использование минимально допустимой силы аутентификации (например, одноступенчатая — логин и пароль).",2 +V7,Управление сессиями,V7.1,Документация по управлению сессиями,V7.1.1,"Убедитесь, что тайм-аут бездействия и абсолютное максимальное время жизни сессии задокументированы, соответствуют другим контрольным мерам и сопровождаются обоснованием любых отклонений от требований повторной аутентификации NIST SP 800-63B.",2 +V7,Управление сессиями,V7.1,Документация по управлению сессиями,V7.1.2,"Убедитесь, что документация определяет допустимое количество одновременных (параллельных) сессий для одного аккаунта, а также поведение системы и действия при достижении этого лимита.",2 +V7,Управление сессиями,V7.1,Документация по управлению сессиями,V7.1.3,"Убедитесь, что все системы, создающие и управляющие сессиями пользователей в рамках федеративной идентификации (например, SSO), задокументированы вместе с механизмами координации сроков действия сессий, условий завершения и случаев, требующих повторной аутентификации.",2 +V7,Управление сессиями,V7.2,Базовая безопасность сессий,V7.2.1,"Убедитесь, что все проверки сессионных токенов выполняются на доверенной серверной стороне.",1 +V7,Управление сессиями,V7.2,Базовая безопасность сессий,V7.2.2,"Убедитесь, что приложение использует либо автономные токены, либо ссылочные токены, которые генерируются динамически, не используя статические API-секреты или ключи.",1 +V7,Управление сессиями,V7.2,Базовая безопасность сессий,V7.2.3,"Убедитесь, что ссылочные токены являются уникальными, создаются с использованием криптографически безопасного генератора псевдослучайных чисел (CSPRNG) и обладают энтропией не менее 128 бит.",1 +V7,Управление сессиями,V7.2,Базовая безопасность сессий,V7.2.4,"Убедитесь, что при аутентификации пользователя (включая повторную) создается новый токен сессии, а текущий — аннулируется.",1 +V7,Управление сессиями,V7.3,Тайм-ауты сессии,V7.3.1,"Убедитесь, что есть тайм-аут бездействия, после которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.",2 +V7,Управление сессиями,V7.3,Тайм-ауты сессии,V7.3.2,"Убедитесь, что установлено абсолютное максимальное время жизни сессии, по истечении которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.",2 +V7,Управление сессиями,V7.4,Завершение сессий,V7.4.1,"Убедитесь, что после завершения сессии (logout, истечение срока) дальнейшее её использование невозможно. Для ссылочных токенов или сессий с сохранением состояния это означает аннулирование на сервере. Для self-contained токенов необходимо реализовать механизм отзыва, например, список отозванных токенов, проверку времени выпуска или ротацию ключей подписи для каждого пользователя.",1 +V7,Управление сессиями,V7.4,Завершение сессий,V7.4.2,"Убедитесь, что при удалении или отключении пользователя все активные сессии немедленно завершаются.",1 +V7,Управление сессиями,V7.4,Завершение сессий,V7.4.3,"Убедитесь, что после изменения или удаления факторов аутентификации (например, смена пароля или MFA) приложение предлагает завершить все другие активные сессии.",2 +V7,Управление сессиями,V7.4,Завершение сессий,V7.4.4,"Убедитесь, что на всех страницах, требующих аутентификации, имеется простой и видимый способ выхода.",2 +V7,Управление сессиями,V7.4,Завершение сессий,V7.4.5,"Убедитесь, что администраторы могут завершать активные сессии конкретного пользователя или всех пользователей.",2 +V7,Управление сессиями,V7.5,Защита от злоупотреблений сессией,V7.5.1,"Убедитесь, что приложение требует полной повторной аутентификации перед изменением чувствительных атрибутов аккаунта, которые могут влиять на аутентификацию (например, email, номер телефона, настройки MFA или данных восстановления доступа).",2 +V7,Управление сессиями,V7.5,Защита от злоупотреблений сессией,V7.5.2,"Убедитесь, что пользователь может просматривать и (после повторной аутентификации хотя бы по одному фактору) завершать активные сессии.",2 +V7,Управление сессиями,V7.5,Защита от злоупотреблений сессией,V7.5.3,"Убедитесь, что перед выполнением критически важных операций приложение требует повторной аутентификации (по крайней мере, одного фактора) или дополнительной проверки.",3 +V7,Управление сессиями,V7.6,Федеративная повторная аутентификация,V7.6.1,"Убедитесь, что срок действия и завершение сессий между RP и IdP соответствуют документации и включают повторную аутентификацию, если достигнут максимальный допустимый интервал между событиями аутентификации.",2 +V7,Управление сессиями,V7.6,Федеративная повторная аутентификация,V7.6.2,"Убедитесь, что создание сессии требует согласия пользователя или явного действия, предотвращающего несанкционированное создание сессий без участия пользователя.",2 +V8,Авторизация,V8.1,Документация по авторизации,V8.1.1,"Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне функций и на уровне данных на основе прав субъекта и атрибутов ресурса.",1 +V8,Авторизация,V8.1,Документация по авторизации,V8.1.2,"Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне полей (как на чтение, так и на запись) на основе прав субъекта и атрибутов ресурса. Эти правила могут зависеть от других атрибутов объекта данных, например, статуса.",2 +V8,Авторизация,V8.1,Документация по авторизации,V8.1.3,"Убедитесь, что документация определяет, какие атрибуты окружения и контекста (например, время суток, IP-адрес, местоположение, устройство) используются приложением для принятия решений в области аутентификации и авторизации.",3 +V8,Авторизация,V8.1,Документация по авторизации,V8.1.4,"Убедитесь, что документация по аутентификации и авторизации определяет, как используются факторы окружения и контекста в принятии решений, наряду с правилами доступа к функциям, данным и полям. Документация должна содержать оцениваемые атрибуты, пороговые значения риска, действия (разрешить, отказать, повысить уровень аутентификации и др.).",3 +V8,Авторизация,V8.2,Архитектура авторизации,V8.2.1,"Убедитесь, что приложение обеспечивает доступ на уровне функций (function-level) только субъектам с явными разрешениями.",1 +V8,Авторизация,V8.2,Архитектура авторизации,V8.2.2,"Убедитесь, что приложение обеспечивает доступ на уровне данных (data-specific) только тем субъектам, которым явно предоставлены права к определённым элементам данных, чтобы предотвратить IDOR (Insecure Direct Object Reference) и BOLA-уязвимости (Broken Object Level Authorization).",1 +V8,Авторизация,V8.2,Архитектура авторизации,V8.2.3,"Убедитесь, что приложение обеспечивает доступ на уровне полей (field-level) только тем субъектам, которым явно предоставлены права к определённым полям, чтобы предотвратить BOPLA (Broken Object Property Level Authorization).",2 +V8,Авторизация,V8.2,Архитектура авторизации,V8.2.4,"Убедитесь, что реализованы адаптивные меры безопасности, основанные на атрибутах окружения и контекста субъекта (время, местоположение, IP, устройство), которые используются для принятия решений об аутентификации и авторизации, как это определено в документации приложения. Эти меры должны применяться как при попытке субъекта начать новую сессию, так и во время существующей сессии.",3 +V8,Авторизация,V8.3,Авторизация на уровне операций,V8.3.1,"Убедитесь, что правила авторизации реализуются на доверенном сервисном уровне и не зависят от элементов, которые может контролировать клиент (например, JavaScript на стороне клиента).",1 +V8,Авторизация,V8.3,Авторизация на уровне операций,V8.3.2,"Убедитесь, что изменения значений, влияющих на авторизацию, применяются немедленно. Если это невозможно (например, при использовании автономных токенов), должны быть реализованы компенсирующие меры: оповещения о попытке несанкционированного действия и откат изменений. Обратите внимание, что данный подход не предотвращает утечку информации.",3 +V8,Авторизация,V8.3,Авторизация на уровне операций,V8.3.3,"Убедитесь, что доступ к объекту осуществляется на основе прав субъекта, инициировавшего запрос, а не прав промежуточного сервиса, действующего от его имени. Например, если пользователь обращается к веб-сервису с автономным токеном для аутентификации, а сервис затем запрашивает данные у другого сервиса, второй сервис должен использовать токен пользователя, а не токен первого сервиса для принятия решения о доступе.",3 +V8,Авторизация,V8.4,Прочие аспекты авторизации,V8.4.1,"Убедитесь, что в мультитенантных приложениях реализованы механизмы, предотвращающие действия потребителя в отношении арендаторов, к которым у него нет доступа.",2 +V8,Авторизация,V8.4,Прочие аспекты авторизации,V8.4.2,"Убедитесь, что доступ к административным интерфейсам защищён несколькими уровнями контроля, включая непрерывную проверку личности, контроль защищённости устройства и анализ контекстных рисков. Недостаточно опираться только на IP-адрес или доверенные устройства.",3 +V9,Автономные токены,V9.1,Источник токена и его целостность,V9.1.1,"Убедитесь, что автономные токены проверяются на целостность с помощью цифровой подписи или MAC, прежде чем доверять их содержимому.",1 +V9,Автономные токены,V9.1,Источник токена и его целостность,V9.1.2,"Проверяйте, что автономные токены создаются и проверяются исключительно с помощью алгоритмов из списка допустимых в данном контексте. Список допустимых алгоритмов должен включать только разрешенные алгоритмы (желательно либо только симметричные, либо только асимметричные) и ни в коем случае не содержать алгоритм None. Если необходимо поддерживать оба типа алгоритмов, потребуются дополнительные средства контроля для предотвращения путаницы с ключами (key confusion).",1 +V9,Автономные токены,V9.1,Источник токена и его целостность,V9.1.3,"Убедитесь, что ключи, используемые для проверки автономных токенов, получены из доверенных, предварительно настроенных источников. Это предотвращает возможность указания злоумышленниками ненадёжных источников и ключей. Для JWT и других JWS структур заголовки 'jku', 'x5u' и 'jwk' должны проверяться по белому списку.",1 +V9,Автономные токены,V9.2,Содержимое токена,V9.2.1,"Убедитесь, что при указанном сроке действия токен и его содержимое принимаются только в том случае, если срок действия токена не истёк. Например, для JWT нужно проверить поля 'nbf' и 'exp'.",1 +V9,Автономные токены,V9.2,Содержимое токена,V9.2.2,"Убедитесь, что сервис, принимающий токен, проверяет его тип и соответствие назначению перед обработкой содержимого токена. Например, для принятия решений об авторизации могут быть приняты только Access Token, а для подтверждения аутентификации пользователя — только ID Token.",2 +V9,Автономные токены,V9.2,Содержимое токена,V9.2.3,"Убедитесь, что сервис принимает только токены, предназначенные для использования с этим сервисом (audience). Для JWT это можно сделать, проверив наличие утверждения «aud» по белому списку, определенному в сервисе.",2 +V9,Автономные токены,V9.2,Содержимое токена,V9.2.4,"Убедитесь, что, если эмитент токенов использует один и тот же закрытый ключ для выпуска токенов различным сервисам (audiences), выпущенные токены содержат явное указание целевых сервисов. Это предотвратит повторное использования токенов в не предназначенных для них сервисах. Если идентификатор сервиса (audience identifier) назначается динамически, эмитент токенов должен проверить audiences для исключения подмены получателей (audience impersonation).",2 +V10,OAuth и OIDC,V10.1,Общие требования безопасности OAuth и OIDC,V10.1.1,"Убедитесь, что токены передаются только тем компонентам, которым они действительно необходимы. Например, при использовании схемы backend-for-frontend для браузерных JavaScript-приложений, access и refresh токены должны быть доступны только на backend.",2 +V10,OAuth и OIDC,V10.1,Общие требования безопасности OAuth и OIDC,V10.1.2,"Убедитесь, что клиент принимает значения от авторизационного сервера (например, authorization code или ID Token) только если они получены в результате авторизационного потока, инициированного в той же сессии пользовательского агента и в рамках той же транзакции. Для этого клиентские секреты, такие как proof key для code exchange (PKCE) — 'code_verifier', 'state' или OIDC 'nonce' — должны быть непредсказуемыми, специфичными для транзакции и надежно привязанными как к клиенту, так и к сессии пользовательского агента, в которой началась транзакция.",2 +V10,OAuth и OIDC,V10.2,Клиент OAuth,V10.2.1,"Убедитесь, что если используется механизм authorization code flow, OAuth клиент защищён от CSRF, вызывающих запросы токенов либо за счёт использования механизма proof key for code exchange (PKCE), либо за счёт проверки параметра 'state', который был отправлен в запросе авторизации.",2 +V10,OAuth и OIDC,V10.2,Клиент OAuth,V10.2.2,"Убедитесь, что если OAuth клиент может взаимодействовать с более чем одним сервером авторизации, у него есть защита от атак смешивания (mix-up attacks). Например, клиент должен требовать, чтобы сервер авторизации возвращал параметр 'iss' и проверять его в ответах на авторизацию и токены.",2 +V10,OAuth и OIDC,V10.2,Клиент OAuth,V10.2.3,"Убедитесь, что OAuth клиент запрашивает только необходимые области доступа (scopes) или другие параметры авторизации в запросах к серверу авторизации.",3 +V10,OAuth и OIDC,V10.3,Сервер ресурсов OAuth,V10.3.1,"Убедитесь, что сервер ресурсов принимает только те access токены, которые предназначены для использования с этим сервисом (свойство audience). Эта принадлежность сервису может быть включена в структурированный access токен (например, в поле 'aud' в JWT) или проверяться через endpoint интроспекции токена.",2 +V10,OAuth и OIDC,V10.3,Сервер ресурсов OAuth,V10.3.2,"Убедитесь, что сервер ресурсов принимает решения по авторизации на основе claims из access токена, определяющих делегированную авторизацию. Если присутствуют claims, такие как 'sub', 'scope' и 'authorization_details', они должны участвовать в принятии решения.",2 +V10,OAuth и OIDC,V10.3,Сервер ресурсов OAuth,V10.3.3,"Убедитесь, что если для принятия решения по контролю доступа необходимо однозначно идентифицировать пользователя из access токена (JWT или ответа интроспекции), сервер ресурсов использует claims, которые не могут быть переприсвоены другим пользователям. Обычно это комбинация claims 'iss' и 'sub'.",2 +V10,OAuth и OIDC,V10.3,Сервер ресурсов OAuth,V10.3.4,"Убедитесь, что если сервер ресурсов требует определённой силы аутентификации, методов или свежести аутентификации, он проверяет, что предъявленный access токен удовлетворяет этим требованиям. Например, при наличии, могут использоваться claims OIDC 'acr', 'amr' и 'auth_time'.",2 +V10,OAuth и OIDC,V10.3,Сервер ресурсов OAuth,V10.3.5,"Убедитесь, что сервер ресурсов предотвращает использование украденных access токенов или их повторное использование (replay) неавторизованными лицами, требуя access токены с подтверждением отправителя — например, Mutual TLS для OAuth 2 или OAuth 2 Demonstration of Proof of Possession (DPoP).",3 +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.1,"Убедитесь, что сервер авторизации проверяет URI перенаправления (redirect URI), сверяя его с заранее зарегистрированным списком разрешённых URI для данного клиента (allowlist), используя точное сравнение строк.",1 +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.2,"Убедитесь, что если сервер авторизации возвращает authorization code в ответе авторизации, этот код может быть использован только один раз для запроса токена. При втором валидном запросе с уже использованным кодом сервер должен отклонить запрос и отозвать любые токены, связанные с этим кодом.",1 +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.3,"Убедитесь, что authorization code имеет короткое время жизни. Максимальная продолжительность — до 10 минут для приложений L1 и L2 и до 1 минуты для приложений L3.",1 +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.4,"Убедитесь, что сервер авторизации для конкретного клиента разрешает использование только тех типов авторизации, которые необходимы этому клиенту. Обратите внимание, что тип авторизации Implicit flow и Resource Owner Password Credentials flow больше не должны использоваться.",1 +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.5,"Убедитесь, что сервер авторизации предотвращает атаки повторного использования refresh токенов для публичных клиентов, предпочтительно используя sender-constrained refresh токены, такие как DPoP или сертификат-связанные токены с mutual TLS (mTLS). Для L1 и L2 допускается ротация refresh токенов с обязательной их инвалидацией после использования. Если используется ротация, сервер должен отозвать все refresh токены при попытке использовать уже инвалидированный токен.",1 +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.6,"Убедитесь, что при использовании типа авторизации «Authorization Code» сервер предотвращает атаки перехвата authorization code, требуя Proof Key for Code Exchange (PKCE). В запросах авторизации сервер должен требовать валидное значение 'code_challenge' и не принимать 'code_challenge_method' со значением 'plain'. В запросах токена обязательно валидировать параметр 'code_verifier'.",2 +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.7,"Убедитесь, что если сервер авторизации поддерживает динамическую регистрацию клиентов без аутентификации, он минимизирует риски вредоносных клиентов. Сервер должен валидировать метаданные клиента (например, зарегистрированные URI), обеспечивать согласие пользователя и предупреждать пользователя перед обработкой запроса авторизации от недоверенного клиента.",2 +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.8,"Убедитесь, что refresh токены имеют абсолютный срок действия, включая случаи, когда применяется скользящее время истечения срока.",2 +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.9,"Убедитесь, что пользователи могут отзывать refresh токены и reference access токены через пользовательский интерфейс сервера авторизации для снижения риска от вредоносных клиентов или кражи токенов.",2 +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.10,"Убедитесь, что конфиденциальный клиент аутентифицируется при взаимодействии с сервером авторизации через backchannel, например при запросах токена, pushed authorization requests (PAR) и запросах на отзыв токенов.",2 +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.11,"Убедитесь, что конфигурация сервера авторизации назначает OAuth клиенту только необходимые области доступа (scopes).",2 +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.12,"Убедитесь, что для конкретного клиента сервер авторизации разрешает только те значения 'response_mode', которые необходимы этому клиенту. Например, сервер должен валидировать это значение против ожидаемых или использовать pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).",3 +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.13,"Убедитесь, что грант типа 'code' всегда используется вместе с pushed authorization requests (PAR).",3 +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.14,"Убедитесь, что сервер авторизации выдаёт только sender-constrained (Proof-of-Possession) access токены, либо с сертификат-связанными токенами через mutual TLS (mTLS), либо DPoP-bound токены (Demonstration of Proof of Possession).",3 +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.15,"Убедитесь, что для серверного клиента (не выполняющегося на устройстве конечного пользователя) сервер авторизации проверяет, что значение параметра 'authorization_details' исходит из клиентского backend и что пользователь не изменял его. Например, это достигается использованием pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).",3 +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.16,"Убедитесь, что клиент является конфиденциальным и сервер авторизации требует использования сильных методов аутентификации клиента (основанных на криптографии с открытым ключом и устойчивых к атакам повторного воспроизведения), таких как mutual TLS ('tls_client_auth', 'self_signed_tls_client_auth') или private key JWT ('private_key_jwt').",3 +V10,OAuth и OIDC,V10.5,Клиент OIDC,V10.5.1,"Убедитесь, что клиент (relying party) защищается от повторного использования ID Token (replay-атак). Например, это достигается проверкой того, что значение 'nonce' в ID Token совпадает со значением 'nonce', отправленным в запросе аутентификации провайдеру OpenID (authorization server).",2 +V10,OAuth и OIDC,V10.5,Клиент OIDC,V10.5.2,"Убедитесь, что клиент однозначно идентифицирует пользователя по утверждениям (claims) ID Token, обычно это 'sub', который не может быть переназначен другому пользователю (в пределах конкретного провайдера идентификации).",2 +V10,OAuth и OIDC,V10.5,Клиент OIDC,V10.5.3,"Убедитесь, что клиент отклоняет попытки злоумышленного сервера авторизации выдавать себя за другой сервер авторизации через метаданные сервера авторизации. Клиент должен отклонить метаданные, если URL издателя (issuer) в метаданных не совпадает точно с преднастроенным URL издателя, ожидаемым клиентом.",2 +V10,OAuth и OIDC,V10.5,Клиент OIDC,V10.5.4,"Убедитесь, что клиент проверяет, что ID Token предназначен для него (проверка audience), сравнивая значение 'aud' в токене с 'client_id' клиента.",2 +V10,OAuth и OIDC,V10.5,Клиент OIDC,V10.5.5,"Убедитесь, что при использовании OIDC back-channel logout клиент снижает риск отказа в обслуживании, вызванный принудительным выходом из системы и путаницей между разными типами JWT (cross-JWT confusion) в процессе логаута. Клиент должен проверить, что токен выхода корректно типизирован со значением 'logout+jwt', содержит claim 'event' с правильным именем участника и не содержит 'nonce'. Также рекомендуется установить короткий срок действия токена (например, 2 минуты).",2 +V10,OAuth и OIDC,V10.6,Провайдер OpenID,V10.6.1,"Убедитесь, что провайдер OpenID допускает только значения 'code', 'ciba', 'id_token' или 'id_token code' для параметра response mode. При этом предпочтение отдаётся 'code' по сравнению с 'id_token code' (гибридный поток OIDC), а значение 'token' (любой Implicit flow) не должно использоваться.",2 +V10,OAuth и OIDC,V10.6,Провайдер OpenID,V10.6.2,"Убедитесь, что провайдер OpenID предотвращает отказ в обслуживании (DoS) через принудительный выход (logout), запрашивая явное подтверждение от конечного пользователя или, если применимо, проверяя параметры в запросе выхода (инициированном relying party), например параметр 'id_token_hint'.",2 +V10,OAuth и OIDC,V10.7,Управление согласием,V10.7.1,"Убедитесь, что авторизационный сервер обеспечивает получение согласия пользователя для каждого запроса авторизации. Если личность клиента не может быть подтверждена, сервер авторизации всегда должен явно запрашивать согласие пользователя.",2 +V10,OAuth и OIDC,V10.7,Управление согласием,V10.7.2,"Убедитесь, что при запросе согласия пользователя авторизационный сервер предоставляет достаточную и понятную информацию о том, на что даётся согласие. При необходимости это должно включать характер запрашиваемых разрешений (обычно основанных на scope, ресурсном сервере, деталях авторизации Rich Authorization Requests (RAR)), идентификацию авторизованного приложения и срок действия этих разрешений.",2 +V10,OAuth и OIDC,V10.7,Управление согласием,V10.7.3,"Убедитесь, что пользователь может просматривать, изменять и отзывать согласия, которые он предоставил, через авторизационный сервер.",2 +V11,Криптография,V11.1,Инвентаризация и документирование криптографии,V11.1.1,"Убедитесь, что задокументирована политика управления криптографическими ключами и описан их жизненный цикл в соответствии со стандартом управления ключей, таким как NIST SP 800-57. Убедитесь, что ключи известны только тем сущностям, которым они должны быть доступны (например, ключи не передавались более чем двум участникам для общих секретов и более чем одному участнику для приватных ключей).",2 +V11,Криптография,V11.1,Инвентаризация и документирование криптографии,V11.1.2,"Убедитесь, что проводится инвентаризация криптографических средств, которая непрерывно поддерживается, регулярно обновляется и включает все криптографические ключи, алгоритмы и сертификаты, используемые в приложении. Также должна быть задокументирована информация о том, где ключи могут и не могут использоваться в системе, а также какие типы данных могут и не могут быть защищены с помощью этих ключей.",2 +V11,Криптография,V11.1,Инвентаризация и документирование криптографии,V11.1.3,"Убедитесь, что используются механизмы обнаружения криптографии для идентификации всех случаев применения криптографии в системе , включая операции шифрования, хеширования и цифровой подписи.",3 +V11,Криптография,V11.1,Инвентаризация и документирование криптографии,V11.1.4,"Убедитесь, что ведётся и поддерживается инвентаризация криптографических средств. В неё должен входить документированный план, описывающий переход на новые криптографические стандарты, такие как постквантовая криптография, чтобы своевременно реагировать на будущие угрозы.",3 +V11,Криптография,V11.2,Безопасная реализация криптографии,V11.2.1,"Убедитесь, что для криптографических операций используются утвержденные в индустрии реализации (включая библиотеки и аппаратные реализации).",2 +V11,Криптография,V11.2,Безопасная реализация криптографии,V11.2.2,"Убедитесь, что архитектура приложения поддерживает быструю реконфигурацию, усовершенствование или смену в любой момент случайных чисел, аутентифицированного шифрования, MAC, алгоритмов хеширования, длин ключей, количества раундов, шифров и режимов шифрования для защиты от криптографических атак. Также должна поддерживаться возможность смены ключей, паролей и повторного шифрования данных. Это позволит беспрепятственно перейти на постквантовую криптографию (PQC), как только станут широко доступны высоконадёжные реализации одобренных схем или стандартов PQC.",2 +V11,Криптография,V11.2,Безопасная реализация криптографии,V11.2.3,"Убедитесь, что все криптографические примитивы используют как минимум 128-бит стойкости с учетом алгоритма, размера ключа и конфигурации. Например, 256-битный ECC ключ обеспечивает примерно 128 бит безопасности, тогда как для достижения того же уровня безопасности в RSA требуется ключ длиной 3072 бита.",2 +V11,Криптография,V11.2,Безопасная реализация криптографии,V11.2.4,"Убедитесь, что все криптографические операции выполняются за константное время, без использования «short-circuit» операций в сравнениях, вычислениях, возвратах функций для избежания утечек информации.",3 +V11,Криптография,V11.2,Безопасная реализация криптографии,V11.2.5,"Убедитесь, что все криптографические модули обеспечивают безопасное завершение работы при ошибках, а обработка ошибок реализована таким образом, чтобы не создавать уязвимостей, например, таких как атаки Padding Oracle.",3 +V11,Криптография,V11.3,Алгоритмы шифрования,V11.3.1,"Убедитесь, что не используются небезопасные режимы блочного шифрования (н-р, ECB) и слабые схемы дополнения (padding) (н-р, PKCS#1 v1.5).",1 +V11,Криптография,V11.3,Алгоритмы шифрования,V11.3.2,"Убедитесь, что используются только утверждённые шифры и режимы, такие как AES с GCM.",1 +V11,Криптография,V11.3,Алгоритмы шифрования,V11.3.3,"Убедитесь, что зашифрованные данные защищены от несанкционированного изменения, предпочтительно с использованием утверждённого метода аутентифицированного шифрования или путём комбинирования утверждённого метода шифрования с утверждённым алгоритмом MAC.",2 +V11,Криптография,V11.3,Алгоритмы шифрования,V11.3.4,"Убедитесь, что случайные числа (nonce), векторы инициализации (IV) и другие одноразовые числа не используются более одного раза для одной и той же пары ключа шифрования и элемента данных. Метод их генерации должен соответствовать требованиям используемого алгоритма.",3 +V11,Криптография,V11.3,Алгоритмы шифрования,V11.3.5,"Убедитесь, что любая комбинация алгоритма шифрования и алгоритма MAC работает в режиме encrypt-then-MAC (EtM).",3 +V11,Криптография,V11.4,Хеширование и функции на основе хеширования,V11.4.1,"Убедитесь, что только утвержденные хэш-функции используются для стандартных сценариев использования в криптографии, включая цифровую подпись, HMAC, KDF, генерацию случайных чисел. Запрещено использовать неустойчивые хэш-функции, (н-р, MD5) для любого использования в криптографии.",1 +V11,Криптография,V11.4,Хеширование и функции на основе хеширования,V11.4.2,"Убедитесь, что пароли хранятся с использованием утверждённой, вычислительно затратной функции генерации ключа (также известной как «функция хеширования паролей»), с параметрами, настроенными в соответствии с актуальными рекомендациями. Настройки должны обеспечивать баланс между безопасностью и производительностью, чтобы сделать атаки перебором достаточно сложными для требуемого уровня безопасности.",2 +V11,Криптография,V11.4,Хеширование и функции на основе хеширования,V11.4.3,"Убедитесь, что хэш-функции, используемые в формировании цифровой подписи, как часть аутентификации и целостности данных, устойчивы к коллизиям и имеют достаточную длину.",2 +V11,Криптография,V11.4,Хеширование и функции на основе хеширования,V11.4.4,"Убедитесь, что приложение использует утвержденную функцию генерации ключа с использованием параметров расширения ключа (key stretching) при генерации ключа из пароля. Параметры должны быть сбалансированы с точки зрения безопасности, производительности и устойчивости к атакам полного перебора при компрометации результирующего криптографического ключа.",2 +V11,Криптография,V11.5,Случайные значения,V11.5.1,"Убедитесь, что все случайные числа и строки, которые должны быть непредсказуемы, должны быть сгенерированы с помощью CSPRNG и иметь хотя бы 128 бит энтропии. Учтите, что UUID не удовлетворяют данному условию.",2 +V11,Криптография,V11.5,Случайные значения,V11.5.2,"Убедитесь, что механизм генерации случайных чисел является надежным даже при высокой нагрузке.",3 +V11,Криптография,V11.6,Криптография с публичным ключом,V11.6.1,"Убедитесь, что только утвержденные криптографические алгоритмы и режимы операций используются для генерации ключа и инициализации случайного значения для его генерации (seeding), а также для генерации цифровой подписи и верификации. Алгоритмы генерации ключей не должны генерировать небезопасные ключи уязвимые к известным атакам, например, ключи RSA уязвимы к факторизации Ферма.",2 +V11,Криптография,V11.6,Криптография с публичным ключом,V11.6.2,"Убедитесь, что для обмена ключами используются утверждённые криптографические алгоритмы (например, Диффи-Хеллман) с особым вниманием к обеспечению использования безопасных параметров. Это предотвратит атаки на процесс установления ключа, которые могут привести к атакам «человек посередине» или криптографическим взломам.",3 +V11,Криптография,V11.7,Шифрование данных в процессе использования,V11.7.1,"Убедитесь, что используется полное шифрование памяти, которое защищает конфиденциальные данные во время их использования, предотвращая доступ к ним неавторизованных пользователей или процессов.",3 +V11,Криптография,V11.7,Шифрование данных в процессе использования,V11.7.2,"Убедитесь, что минимизация данных обеспечивает раскрытие минимально необходимого объёма данных во время обработки, а также что данные шифруются сразу после использования или как можно скорее.",3 +V12,Безопасная коммуникация,V12.1,Общие рекомендации по безопасности TLS,V12.1.1,"Убедитесь, что включены только актуальные и рекомендуемые версии протокола TLS, такие как TLS 1.2 и TLS 1.3. Наиболее свежая версия TLS должна быть выбрана как предпочтительная.",1 +V12,Безопасная коммуникация,V12.1,Общие рекомендации по безопасности TLS,V12.1.2,"Убедитесь, что включены рекомендуемые шифронаборы (cipher suites), предпочтение также стоит отдать самому сильному шифронабору. L3 приложения должны поддерживать только те наборы шифров (cipher suites), которые обеспечивают прямую (forward) секретность. Пояснение: Прямая секретность (Forward Secrecy, FS) — это криптографическая особенность, при которой сессионные ключи уникальны для каждой сессии и не зависят от долгосрочных ключей. Это гарантирует, что даже при компрометации долгосрочного ключа злоумышленник не сможет расшифровать ранее перехваченные зашифрованные сессии.",2 +V12,Безопасная коммуникация,V12.1,Общие рекомендации по безопасности TLS,V12.1.3,"Убедитесь, что приложение проверяет доверенность клиентских сертификатов mTLS, прежде чем использовать идентификацию по сертификату для аутентификации или авторизации.",2 +V12,Безопасная коммуникация,V12.1,Общие рекомендации по безопасности TLS,V12.1.4,"Убедитесь, что включена и настроена правильная проверка отзыва сертификатов, такая как Online Certificate Status Protocol (OCSP) Stapling.",3 +V12,Безопасная коммуникация,V12.1,Общие рекомендации по безопасности TLS,V12.1.5,"Убедитесь, что в настройках TLS приложения включена функция Encrypted Client Hello (ECH) для предотвращения раскрытия конфиденциальных метаданных, таких как Server Name Indication (SNI), во время процесса TLS-рукопожатия.",3 +V12,Безопасная коммуникация,V12.2,HTTPS коммуникация с внешними сервисами,V12.2.1,"Убедитесь, что для всех соединений между клиентом и внешними HTTP-сервисами используется TLS и не происходит отката к небезопасным или незашифрованным протоколам.",1 +V12,Безопасная коммуникация,V12.2,HTTPS коммуникация с внешними сервисами,V12.2.2,"Убедитесь, что внешние сервисы используют публично доверенные TLS-сертификаты.",1 +V12,Безопасная коммуникация,V12.3,Общая безопасность межсервисного взаимодействия,V12.3.1,"Убедитесь, что для всех входящих и исходящих соединений приложения используется зашифрованный протокол, например TLS, включая системы мониторинга, инструменты управления, удалённый доступ и SSH, промежуточное ПО, базы данных, мейнфреймы, партнёрские системы и внешние API. Сервер не должен допускать откат к небезопасным или незашифрованным протоколам.",2 +V12,Безопасная коммуникация,V12.3,Общая безопасность межсервисного взаимодействия,V12.3.2,"Убедитесь, что TLS-клиент проверяет сертификат сервера до установления защищенного соединения с TLS-сервером.",2 +V12,Безопасная коммуникация,V12.3,Общая безопасность межсервисного взаимодействия,V12.3.3,"Убедитесь, что все внутренние HTTP-взаимодействия между компонентами приложения используют TLS или другой подходящий механизм транспортного шифрования, и не происходит откат к небезопасным или незашифрованным коммуникациям.",2 +V12,Безопасная коммуникация,V12.3,Общая безопасность межсервисного взаимодействия,V12.3.4,"Убедитесь, что TLS-соединения между внутренними сервисами используют доверенные сертификаты. Если используются внутренние или самоподписанные сертификаты, потребляющий сервис должен быть настроен на доверие только к конкретным внутренним центрам сертификации (CA) и конкретным самоподписанным сертификатам.",2 +V12,Безопасная коммуникация,V12.3,Общая безопасность межсервисного взаимодействия,V12.3.5,"Убедитесь, что сервисы, взаимодействующие внутри системы (intra-service communications), используют строгую аутентификацию для проверки каждого конечного узла. Для проверки подлинности взаимодействующих сторон должны применяться методы строгой аутентификации, такие как аутентификация TLS-клиента, с использованием инфраструктуры открытых ключей и механизмов, устойчивых к атакам повтора (replay attacks). Для микросервисных архитектур рекомендуется использование service mesh для упрощения управления сертификатами и повышения безопасности.",3 +V13,Конфигурация,V13.1,Документация конфигурации,V13.1.1,"Убедитесь, что все необходимые доступы приложения задокументированы. Сюда должны быть включены как внешние сервисы, от которых зависит приложение, так и сценарии, когда конечный пользователь может задавать адреса для внешнего подключения.",2 +V13,Конфигурация,V13.1,Документация конфигурации,V13.1.2,"Убедитесь, что для каждого сервиса, используемого приложением, в документации определено максимальное количество одновременных соединений (например, лимиты пула соединений) и описано поведение приложения при достижении этого лимита, включая любые механизмы отказоустойчивости или восстановления, чтобы предотвратить ситуации отказа в обслуживании (DoS).",3 +V13,Конфигурация,V13.1,Документация конфигурации,V13.1.3,"Убедитесь, что в документации приложения определены стратегии управления ресурсами для каждой внешней системы или сервиса, которые оно использует (например, базы данных, файловые дескрипторы, потоки, HTTP-соединения). Стратегии должны включать процедуры освобождения ресурсов, настройки таймаутов, обработку сбоев, а также, если реализована логика повторных попыток, указание лимитов, задержек и алгоритмов back-off. Для синхронных HTTP-запросов должны быть заданы короткие таймауты, а повторные запросы должны быть отключены, либо строго ограничены по числу попыток, чтобы предотвратить каскадные задержки и истощение ресурсов.",3 +V13,Конфигурация,V13.1,Документация конфигурации,V13.1.4,"Убедитесь, что в документации приложения определены секреты, критически важные для безопасности приложения, а также установлен график их ротации в соответствии с моделью угроз организации и её бизнес-требованиями.",3 +V13,Конфигурация,V13.2,Конфигурация бэкенд соединений,V13.2.1,"Убедитесь, что коммуникации между компонентами бэкенда приложения (включая API, промежуточное ПО и уровни данных), которые не поддерживают стандартный механизм пользовательских сессий, проходят с аутентификацией. Аутентификация должна использовать индивидуальные сервисные аккаунты, краткосрочные токены или аутентификацию на основе сертификатов, а не постоянные учётные данные, такие как пароли, API-ключи или общие аккаунты с привилегированным доступом.",2 +V13,Конфигурация,V13.2,Конфигурация бэкенд соединений,V13.2.2,"Убедитесь, что коммуникации между компонентами бэкенда приложения, включая локальные или системные службы, API, промежуточное ПО и уровни данных, выполняются с использованием аккаунтов, которым назначены минимально необходимые привилегии.",2 +V13,Конфигурация,V13.2,Конфигурация бэкенд соединений,V13.2.3,"Убедитесь, что если для аутентификации в сервисе используются учётные данные, то используемые потребителем учётные данные не являются стандартными (например, root/root или admin/admin).",2 +V13,Конфигурация,V13.2,Конфигурация бэкенд соединений,V13.2.4,"Убедитесь, что используется белый список (allowlist) для определения внешних ресурсов или систем, с которыми приложению разрешено взаимодействовать (например, для исходящих запросов, загрузки данных или доступа к файлам). Этот белый список может быть реализован на уровне приложения, веб-сервера, межсетевого экрана или комбинации различных уровней.",2 +V13,Конфигурация,V13.2,Конфигурация бэкенд соединений,V13.2.5,"Убедитесь, что веб- или прикладной сервер настроен с белым списком ресурсов или систем, к которым сервер может отправлять запросы или из которых может загружать данные и файлы.",2 +V13,Конфигурация,V13.2,Конфигурация бэкенд соединений,V13.2.6,"Убедитесь, что при подключении приложения к другим сервисам соблюдается задокументированная конфигурация для каждого соединения, включая максимальное количество параллельных соединений, поведение при достижении их максимума, таймауты и стратегии повторных попыток подключения.",3 +V13,Конфигурация,V13.3,Управление секретами,V13.3.1,"Убедитесь, что для безопасного создания, хранения, контроля доступа и уничтожения секретов бэкенда используется решение для управления секретами, например, хранилище ключей (key vault). Секретами могут быть пароли, ключевой материал, интеграции с базами данных и сторонними системами, ключи и seed-значения для токенов с ограниченным временем действия, другие внутренние секреты и API-ключи. Секреты не должны включаться в исходный код приложения или артефакты сборки. Для приложений уровня L3 необходимо использовать аппаратное решение, например, аппаратный модуль безопасности (HSM).",2 +V13,Конфигурация,V13.3,Управление секретами,V13.3.2,"Убедитесь, что доступ к секретным ресурсам осуществляется в соответствии с принципом минимально необходимых привилегий (least privilege).",2 +V13,Конфигурация,V13.3,Управление секретами,V13.3.3,"Убедитесь, что все криптографические операции выполняются с использованием изолированного модуля безопасности (например, хранилища ключей или аппаратного модуля безопасности), чтобы надежно управлять ключевым материалом и защищать его от утечки за пределы модуля безопасности.",3 +V13,Конфигурация,V13.3,Управление секретами,V13.3.4,"Убедитесь, что секреты настроены на срок действия и ротацию в соответствии с документацией приложения.",3 +V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.1,"Убедитесь, что приложение развернуто либо без метаданных систем контроля версий (включая папки .git или .svn), либо так, чтобы эти папки были недоступны как извне, так и для самого приложения.",1 +V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.2,"Убедитесь, что режимы отладки отключены для всех компонентов в промышленной среде, чтобы предотвратить раскрытие функций отладки и утечку информации.",2 +V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.3,"Убедитесь, что веб-серверы не показывают клиентам списки содержимого каталогов, если это явно не предусмотрено.",2 +V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.4,"Убедитесь, что метод HTTP TRACE не поддерживается в продуктовой среде, чтобы избежать потенциальной утечки информации.",2 +V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.5,"Убедитесь, что документация (например, по внутренним API) и мониторинговые эндпоинты не доступны, если это явно не предусмотрено.",2 +V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.6,"Убедитесь, что приложение не раскрывает подробную информацию о версиях компонентов бэкенда.",3 +V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.7,"Убедитесь, что веб-слой настроен на обслуживание только файлов с определёнными расширениями, чтобы предотвратить непреднамеренную утечку информации, конфигураций и исходного кода.",3 +V14,Защита информации,V14.1,Документация по защите информации,V14.1.1,"Убедитесь, что все конфиденциальные данные, создаваемые и обрабатываемые приложением, идентифицированы и классифицированы по уровням защиты. Включая закодированные данные, которые легко декодируются, например, строки Base64 или незашифрованные данные в полезной нагрузке JWT. Уровни защиты должны учитывать требования по защите данных и конфиденциальности, которым должно соответствовать приложение.",2 +V14,Защита информации,V14.1,Документация по защите информации,V14.1.2,"Убедитесь, что для каждого уровня защиты конфиденциальных данных требования к защите задокументированы. Они должны включать (но не ограничиваться) требования по шифрованию, проверке целостности, срокам хранения, способам логирования данных, контролю доступа к чувствительным данным в логах, шифрованию на уровне базы данных, применению технологий повышения конфиденциальности, а также другим требованиям по конфиденциальности.",2 +V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.1,"Убедитесь, что конфиденциальные данные передаются на сервер только в теле HTTP-запроса или в заголовках. URL и строка запроса не должны содержать конфиденциальную информацию, такую как API-ключ или сессионный токен.",1 +V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.2,"Убедитесь, что приложение предотвращает кэширование конфиденциальных данных в серверных компонентах, таких как балансировщики нагрузки и кэши приложений, либо гарантирует их надежное удаление после использования.",2 +V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.3,"Убедитесь, что заранее определённые конфиденциальные данные не отправляются ненадёжным сторонам (например, системам трекинга пользователей), чтобы предотвратить нежелательный сбор данных вне контроля приложения.",2 +V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.4,"Убедитесь, что для конфиденциальных данных реализованы меры по шифрованию, проверке целостности, срокам хранения, способам логирования, контролю доступа к данным в логах, а также применяются технологии повышения конфиденциальности в соответствии с документацией для соответствующего уровня защиты данных.",2 +V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.5,"Убедитесь, что механизмы кэширования настроены так, чтобы кэшировать только ответы с ожидаемым типом содержимого для данного ресурса и не содержать конфиденциального динамического контента. При обращении к несуществующему файлу, веб-сервер должен возвращать ответ 404 или 302, а не подменять на другой существующий файл, что позволит предотвратить атаки типа Web Cache Deception.",3 +V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.6,"Убедитесь, что приложение возвращает только минимально необходимый объем конфиденциальных данных для выполнения своей функциональности. Например, показывает только часть цифр номера кредитной карты, а не полный номер. Если требуется отображение полных данных, они должны быть замаскированы в пользовательском интерфейсе, пока пользователь специально не запросил их просмотр.",3 +V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.7,"Убедитесь, что конфиденциальная информация подлежит классификации по срокам хранения, чтобы устаревшие или ненужные данные удалялись автоматически, по расписанию или по мере необходимости.",3 +V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.8,"Убедитесь, что конфиденциальная информация удаляется из метаданных файлов, загружаемых пользователями, если пользователь явно не согласился на ее хранение.",3 +V14,Защита информации,V14.3,Защита данных на стороне клиента,V14.3.1,"Убедитесь, что аутентифицированные данные очищаются из клиентского хранилища, например, из DOM браузера, после завершения работы клиента или сессии. Заголовок HTTP-ответа Clear-Site-Data может помочь в этом, но клиентская сторона также должна уметь очищать данные, если соединение с сервером недоступно при завершении сессии.",1 +V14,Защита информации,V14.3,Защита данных на стороне клиента,V14.3.2,"Убедитесь, что приложение устанавливает HTTP-заголовки, достаточные для предотвращения кэширования (например, Cache-Control: no-store), чтобы конфиденциальные данные не сохранялись в браузерах.",2 +V14,Защита информации,V14.3,Защита данных на стороне клиента,V14.3.3,"Убедитесь, что данные, хранящиеся в браузерном хранилище (например, localStorage, sessionStorage, IndexedDB или cookie), не содержат конфиденциальной информации, за исключением сессионных токенов.",2 +V15,Безопасная разработка и архитектура,V15.1,Документация по безопасной разработке и архитектуре,V15.1.1,"Убедитесь, что в документации по приложению определены сроки устранения уязвимостей на основе оценки рисков для внешних зависимостей с уязвимостями и для обновления библиотек в целом, чтобы минимизировать риск, связанный с этими компонентами.",1 +V15,Безопасная разработка и архитектура,V15.1,Документация по безопасной разработке и архитектуре,V15.1.2,"Убедитесь, что ведется реестр всех используемых сторонних библиотек (например, Software Bill of Materials, SBOM), с обязательной проверкой, что компоненты получены из предопределенных, доверенных и регулярно поддерживаемых репозиториев.",2 +V15,Безопасная разработка и архитектура,V15.1,Документация по безопасной разработке и архитектуре,V15.1.3,"Убедитесь, что в документации приложения указан функционал, требующий значительных временных или вычислительных ресурсов. Необходимо указать, как предотвратить потерю доступности из-за чрезмерного использования этого функционала и как избежать ситуаций, когда формирование ответа занимает больше времени, чем установленный системой таймаут. Возможные меры защиты могут включать асинхронную обработку, использование очередей и ограничение количества параллельных процессов для каждого пользователя и приложения.",2 +V15,Безопасная разработка и архитектура,V15.1,Документация по безопасной разработке и архитектуре,V15.1.4,"Убедитесь, что в документации приложения указаны внешние библиотеки, которые считаются «компонентами с повышенным риском».",3 +V15,Безопасная разработка и архитектура,V15.1,Документация по безопасной разработке и архитектуре,V15.1.5,"Убедитесь, что в документации приложения выделены те части приложения, в которых используются «функционал с повышенным риском».",3 +V15,Безопасная разработка и архитектура,V15.2,Архитектура безопасности и зависимости,V15.2.1,"Убедитесь, что приложение содержит только те компоненты, которые не нарушили задокументированные сроки обновления и исправления.",1 +V15,Безопасная разработка и архитектура,V15.2,Архитектура безопасности и зависимости,V15.2.2,"Убедитесь, что в приложении реализованы меры защиты от потери доступности из-за функциональности, требующей много времени или ресурсов, на основе задокументированных решений и стратегий безопасности для этого.",2 +V15,Безопасная разработка и архитектура,V15.2,Архитектура безопасности и зависимости,V15.2.3,"Убедитесь, что производственная среда включает только те функции, которые необходимы для работы приложения, и не предоставляет лишние функции, такие как тестовый код, примеры кода и инструменты разработки.",2 +V15,Безопасная разработка и архитектура,V15.2,Архитектура безопасности и зависимости,V15.2.4,"Убедитесь, что сторонние компоненты и все их транзитивные зависимости загружаются только из ожидаемых репозиториев (внутренних или внешних) и отсутствует риск атаки через подмену зависимостей (dependency confusion attack)",3 +V15,Безопасная разработка и архитектура,V15.2,Архитектура безопасности и зависимости,V15.2.5,"Убедитесь, что приложение реализует дополнительные меры защиты для тех частей приложения, которые документированы как содержащие «функционал с повышенным риском» или использующие сторонние библиотеки, считающиеся «функционалом с повышенным риском». Это могут быть такие методы, как «песочница», инкапсуляция, контейнеризация или изоляция на сетевом уровне, чтобы задержать и предотвратить продвижение (pivoting) злоумышленников, скомпрометировавших одну часть приложения, к другим частям приложения.",3 +V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.1,"Убедитесь, что приложение возвращает только необходимое подмножество полей из объекта данных. Например, оно не должно возвращать весь объект данных, поскольку некоторые отдельные поля должны быть недоступны пользователям.",1 +V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.2,"Убедитесь, что при вызовах внешних URL-адресов бэкэнд приложения настроен так, чтобы не выполнять перенаправления, если только это не предусмотрено функционалом.",2 +V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.3,"Убедитесь, что в приложении реализованы защитные механизмы против атак типа массового присвоения (mass assignment) путем строгого ограничения разрешенных полей для каждого контроллера и действия, исключая возможность добавления или изменения значений полей, которые не должны быть доступны для данной конкретной операции.",2 +V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.4,"Убедитесь, что все прокси и промежуточное ПО корректно передают исходный IP-адрес пользователя, используя доверенные поля данных, которые не могут быть изменены конечным пользователем, а приложение и веб-сервер используют это правильное значение для ведения логирования и принятия решений по безопасности, таких как ограничение запросов. При этом следует учитывать, что даже исходный IP-адрес может быть ненадежным из-за динамических IP-адресов, VPN или корпоративных файрволов.",2 +V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.5,"Убедитесь, что приложение явно проверяет соответствие переменных ожидаемому типу данных и использует строгие операции сравнения. Это необходимо для предотвращения уязвимостей, связанных с type juggling и type confusion, вызванных тем, что код приложения делает предположения о типе переменной.",2 +V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.6,"Убедитесь, что JavaScript-код написан таким образом, чтобы предотвратить prototype pollution, например, используя Set() или Map() вместо обычных литералов объекта.",2 +V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.7,"Убедитесь, что приложение защищено от атак типа HTTP Parameter Pollution (HPP), особенно если используемый фреймворк не различает источники параметров запроса (строка запроса, тело запроса, куки или заголовки).",2 +V15,Безопасная разработка и архитектура,V15.4,Безопасная работа с параллельными процессами,V15.4.1,"Убедитесь, что к общим объектам в многопоточном коде (например, кэшам, файлам или объектам в памяти, используемым несколькими потоками) используется безопасный многопоточный доступ и механизмов синхронизации, таких как блокировки или семафоры, чтобы избежать состояний гонки и повреждения данных.",3 +V15,Безопасная разработка и архитектура,V15.4,Безопасная работа с параллельными процессами,V15.4.2,"Убедитесь, что проверки состояния ресурса, например его существования или разрешений, а также зависящие от него действия выполняются как одна атомарная операция, чтобы предотвратить условия гонки времени проверки и времени использования (TOCTOU). Например, проверка существования файла перед его открытием или проверка прав доступа пользователя перед его предоставлением.",3 +V15,Безопасная разработка и архитектура,V15.4,Безопасная работа с параллельными процессами,V15.4.3,"Убедитесь, что блокировки применяются согласованно, чтобы предотвратить взаимные блокировки потоков (deadlocks) или их бесконечные повторы, а также что логика блокировки инкапсулирована в коде, отвечающем за управление ресурсом. Это гарантирует, что блокировки не могут быть случайно или намеренно изменены внешними классами или кодом.",3 +V15,Безопасная разработка и архитектура,V15.4,Безопасная работа с параллельными процессами,V15.4.4,"Убедитесь, что политики распределения ресурсов предотвращают нехватку ресурсов у потоков, обеспечивая справедливый доступ к ресурсам, например, используя пулы потоков, позволяя потокам с более низким приоритетом выполняться в течение разумного периода времени.",3 +V16,Журналирование событий безопасности и обработка ошибок,V16.1,Документация по ведению логов,V16.1.1,"Убедитесь в существовании реестра, в котором документируется ведение журнала на каждом уровне технологического стека приложения, включая какие события регистрируются, форматы логов, где хранятся эти журналы, как они используются, как контролируется доступ к ним и как долго хранятся журналы.",2 +V16,Журналирование событий безопасности и обработка ошибок,V16.2,Общее журналирование,V16.2.1,"Убедитесь, что каждая запись журнала содержит необходимые метаданные (например, когда, где, кто, что), которые позволят провести подробное исследование временной шкалы, когда произошло событие.",2 +V16,Журналирование событий безопасности и обработка ошибок,V16.2,Общее журналирование,V16.2.2,"Убедитесь, что все источники времени компонентов системы журналирования синхронизированы, а временные метки в метаданных событий безопасности используют UTC или содержат явное указание смещения часового пояса. Рекомендуется применять UTC для обеспечения согласованности в распределённых системах и предотвращения ошибок при переходе на летнее/зимнее время.",2 +V16,Журналирование событий безопасности и обработка ошибок,V16.2,Общее журналирование,V16.2.3,"Убедитесь, что приложение записывает и передаёт логи исключительно в те файлы и сервисы, которые указаны в реестре журналирования.",2 +V16,Журналирование событий безопасности и обработка ошибок,V16.2,Общее журналирование,V16.2.4,"Убедитесь, что логи могут быть прочитаны и коррелированы используемой системой обработки журналов, предпочтительно с использованием общего стандартного формата логирования.",2 +V16,Журналирование событий безопасности и обработка ошибок,V16.2,Общее журналирование,V16.2.5,"Убедитесь, что приложение применяет соответствующие меры защиты при логировании конфиденциальных данных в зависимости от уровня их чувствительности: например, полностью запрещает запись в логи таких данных, как учетные данные или платежные реквизиты, а для других данных (например, сессионных токенов) использует хеширование или частичное/полное маскирование.",2 +V16,Журналирование событий безопасности и обработка ошибок,V16.3,Инциденты безопасности,V16.3.1,"Убедитесь, что все операции аутентификации регистрируются, включая успешные и неудачные попытки. Также следует фиксировать дополнительные метаданные, такие как тип аутентификации или использованные факторы проверки.",2 +V16,Журналирование событий безопасности и обработка ошибок,V16.3,Инциденты безопасности,V16.3.2,"Убедитесь, что ведется журнал неудачных попыток авторизации. Для уровня L3 это должно включать в себя журналирование всех решений об авторизации, включая журналирование доступа к конфиденциальным данным (без регистрации самих конфиденциальных данных).",2 +V16,Журналирование событий безопасности и обработка ошибок,V16.3,Инциденты безопасности,V16.3.3,"Убедитесь, что приложение регистрирует все события безопасности, определенные в документации, а также фиксирует попытки обхода механизмов защиты, включая проверку входных данных, бизнес-логики и системы защиты от автоматизированных атак.",2 +V16,Журналирование событий безопасности и обработка ошибок,V16.3,Инциденты безопасности,V16.3.4,"Убедитесь, что приложение регистрирует в журналах неожиданные ошибки и сбои механизмов безопасности, включая, например, ошибки TLS-соединения на стороне сервера.",2 +V16,Журналирование событий безопасности и обработка ошибок,V16.4,Защита журналов,V16.4.1,"Убедитесь, что все компоненты системы логирования корректно кодируют данные, чтобы предотвратить атаки типа внедрения в журналы (log injection).",2 +V16,Журналирование событий безопасности и обработка ошибок,V16.4,Защита журналов,V16.4.2,"Убедитесь, что логи защищены от неавторизованного доступа и не могут быть модифицированы.",2 +V16,Журналирование событий безопасности и обработка ошибок,V16.4,Защита журналов,V16.4.3,"Убедитесь, что логи безопасно передаются в логически изолированную систему для анализа, обнаружения угроз, генерации оповещений и эскалации инцидентов. Это гарантирует сохранность журналов даже в случае компрометации основного приложения.",2 +V16,Журналирование событий безопасности и обработка ошибок,V16.5,Обработка ошибок,V16.5.1,"Убедитесь, что при возникновении непредвиденной или связанной с безопасностью ошибки пользователю возвращается только общее сообщение, гарантируя отсутствие раскрытия конфиденциальных внутренних данных системы, таких как трассировки стека, запросы, секретные ключи и токены.",2 +V16,Журналирование событий безопасности и обработка ошибок,V16.5,Обработка ошибок,V16.5.2,"Убедитесь, что приложение продолжает работать в безопасном режиме при недоступности внешних ресурсов, используя такие механизмы, как автоматические выключатели (circuit breakers) или плавное снижение функциональности (graceful degradation).",2 +V16,Журналирование событий безопасности и обработка ошибок,V16.5,Обработка ошибок,V16.5.3,"Убедитесь, что приложение корректно и безопасно завершает работу при возникновении исключений, предотвращая опасные сценарии по типу «fail-open», когда, например, транзакция ошибочно выполняется, несмотря на ошибки в логике валидации.",2 +V16,Журналирование событий безопасности и обработка ошибок,V16.5,Обработка ошибок,V16.5.4,"Убедитесь, что определён обработчик ошибок «крайние меры», который будет перехватывать все необработанные ошибки. Это необходимо как для предотвращения потери информации об ошибках, которая должна быть записана в файлы журналов, так и для того, чтобы ошибка не остановила весь процесс приложения, что привело бы к потере доступности.",3 +V17,WebRTC,V17.1,TURN-сервер,V17.1.1,"Убедитесь, что сервис TURN (Traversal Using Relays around NAT) разрешает доступ только к IP-адресам, не зарезервированным для специальных целей (например, внутренние сети, широковещательная рассылка, loopback-адреса). Данное требование применяется как к IPv4, так и к IPv6 адресам.",2 +V17,WebRTC,V17.1,TURN-сервер,V17.1.2,"Убедитесь, что сервис TURN (Traversal Using Relays around NAT) защищен от исчерпания ресурсов при попытках легитимных пользователей открыть чрезмерное количество портов на сервере.",3 +V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.1,"Убедитесь, что ключ сертификата Datagram Transport Layer Security (DTLS) управляется и защищается в соответствии с документированной политикой управления криптографическими ключами.",2 +V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.2,"Убедитесь, что медиасервер настроен на использование только одобренных наборов шифров Datagram Transport Layer Security (DTLS) и защищенного профиля безопасности для расширения DTLS, применяемого при установке ключей для Secure Real-time Transport Protocol (DTLS-SRTP).",2 +V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.3,"Убедитесь, что медиасервер проверяет аутентификацию Secure Real-time Transport Protocol (SRTP) для предотвращения атак с внедрением Real-time Transport Protocol (RTP), которые могут привести к отказу в обслуживании (Denial of Service) или вставке поддельного аудио-/видеоконтента в медиапотоки.",2 +V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.4,"Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика при получении некорректных пакетов Secure Real-time Transport Protocol (SRTP).",2 +V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.5,"Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетами Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.",3 +V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.6,"Убедитесь, что медиасервер не подвержен уязвимости «Гонка ClientHello» (ClientHello Race Condition) в Datagram Transport Layer Security (DTLS), проверив наличие известных уязвимостей в публичных источниках или выполнив тестирование на воспроизведение условий гонки.",3 +V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.7,"Убедитесь, что механизмы аудио- и видеозаписи, связанные с медиасервером, способны продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетов Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.",3 +V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.8,"Убедитесь, что сертификат Datagram Transport Layer Security (DTLS) проверяется на соответствие атрибуту отпечатка (fingerprint) в Session Description Protocol (SDP), с немедленным прекращением медиапотока в случае несоответствия — это гарантирует подлинность передаваемых данных.",3 +V17,WebRTC,V17.3,Сигнализация,V17.3.1,"Убедитесь, что сигнальный сервер способен продолжать обработку легитимных входящих сообщений сигнализации даже в условиях флуд-атаки. Для этого необходимо реализовать механизм ограничения частоты запросов (rate limiting) на уровне сигнализации.",2 +V17,WebRTC,V17.3,Сигнализация,V17.3.2,"Убедитесь, что сигнальный сервер способен продолжать обработку легитимных сообщений сигнализации даже при получении некорректных сообщений, которые могут вызвать отказ в обслуживании (Denial of Service, DoS). Для этого необходимо реализовать: проверку входных данных (input validation), безопасную обработку целочисленных переполнений (integer overflows), защиту от переполнения буферов (buffer overflows) и другие надежные методы обработки ошибок.",2 + diff --git a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.docx b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.docx new file mode 100644 index 0000000000000000000000000000000000000000..2d46ed8ceaa7499d06776cb46b7e7e0069ceae70 GIT binary patch literal 243966 zcmV)JK)b(CO9KQH00IaI0Kk1uTf7#JoU;J{0JaJM022TJ09!+EZggdCbYE0?aAk8{ zE_iKh#g^G>!!QsN0)1%%O+P@9#)+u4AWgQv@7QikNki;3F?liA znz{GrN-`RZH#&<};DfSe826HH9Dxy5Dl;F(pVODleLNlwrdtOgqEZuv@dD93Fc!oD zG!Kb&U}z+@UUQ^ZKWC1MFFps>?{@E)um-_k2Xl>hG>_EbDTs zVa%P&l;B9itQchn8$D#LMyq?4?^$a}KUY?_puBQmCg%KJj zfwcdieD==fC}iqAQ*xN{Sq7J%cqM(5g8C=ky1>ZoYzD|rk_6cy5C+YH*+>4k2+f2DA7f@(x_W$HnM)p>ObQS6kP96*c4 zVjJsGN!L>>fJ^Y_|8@Q_l)_B`Zm$i{zaBuoTCF5d3O5C4A%W8XTG)h50W?U(nSYi2 zUgFGr4?^ku3Rrxv7b%MCRakKm9eo2(O9KQH00IaI0Kk1uTeo+l@8+Noe~dmdUru;%oQpS5O9KQH00IaI0Kk1uTcxTp zud(|90H9J201*HH0C#V4WG`fIV|8t1ZgehqZEWnldv9Dvb}#x>_EnHT#O;>&erV$4 zdgRAwAdeMGu@xY|MU!k=98;vyq%7{Td)KaAwQ8;3`mNvk+rR(l=0f&iy|FyMwD`)I zp>u<0vijo8((L@=`>&k&$7^p?C(r!--~H{K3$sfzw{O-LS2Fea#pMfkUO97PW#!g| z^XHdmZq#qqmd`ESsxPYF%`G)<)>hO%8}FaLv(%Wq)mWOTFE6Xh-CQ_7JUBRh{$_1{ z@eEz&W;d5vnwy)SslP@8;ESx>;EOb#_acq@LTyDo_wtSTTg!a4rB}|}ZY*A)OI2^q z&oq{nm*!TgGfOuw;8o~9{EZLGzVYGB1^(Qfp}{V$ttXAYQS0W(W*fCTiRryHKl2<{ zP~Td)-7t@L=hkyv!+rIy;V;kVg*3f1dsqMW7W{Fg0spzWa(AJg-MR2#ZQ+$O*XCCi z)ZNej-QS)!pMXDL@m*NHRhy~5a^_Z}zFcp7SU>Z3#qT<6MYA|4wu@%xUS~~zZ3Vu3 z>Sr~?H<>KH`Nn7 zQ%`WHCTmqaL%Xx8-qdkTS#hY}PO+zM_*C6EoU-%0=#ne%>h0;3UKih&dR3^$%R3v# z^k8G>2G0%l_$05@R(g7h->5})TnlV?aCj^_{N>pd`VWp!oiSHxjg_~je=h#@W^G}i z-neUwLv30;<3=z-COE{)AjeY9aj%A-&nc(%9)kM?K(Z`{NnOT<68Zr z)BxVTnEmro_Ba1>duioIL)8)dOZLwn z_UV^IZ)m8O)&3vheWGtEHsE0~;G$gxlO_(IqSft)hkF_Ew^?|j9!86%W)LsB0Cw z{Pjwv?$<1y!JnJ@vTE#lj&k)IzH1JvZ>#f}`OPXksh-8A8f&gU)p-c_PCi=tPMP}8 z0bJr4AFMR^$QI7xwfgx7Cj~a0c7-j5Knb`p!l;hWL~6 z=j{OCMYiz<-UD_Xb{<6E+qu#$`ugIm*r4Z=yLU|N-llp9_~KUez>8KD?%UKOt`>O} z-o?jo|7Uvq$Fj43=?@~agMbP12GO@&FC3c;T#$<17|Kn^k_UQv7#C}|bfi_EePjN8 zh%Lf#Pz0g=dP^Np3-gP0_^Udlbl5rbk%~@-2B$_R)a=fv195b4cw}T8Uy1tE++2NT z<#qh*^ebo78d!io8}R1}{D~jcUO^+9tuN20--WLj9Kcu3oXKFhsGH$pxxzt_x=8H; zOy>NI_^WcbYT50^{P&2r{_bzp-*n7|e_8xc-BZtx{>RMEKD2{AcYgk6?fv@l`2`g) zE-u&4-O?TkjCUk9UcLZcuBLBsd1>Z@i??HIr|7+@m+q=HN9|3SIv3* z{ab2}yjfqmnd!f%;i@sg^=ltqUgpv9XY|h(m-NW+HVcc{omb9GjVa6G|4PrOwoCAj zmD>CQ{o}m;7Cq+jEi;+$=FdATO8#4K7`rphiw)E5CcLCq4ei8UEW!7)KtEOizxFkI zxZ}m8TX!4t@84L-zWe`_wHchOYLk;)yHU^He(%+*SF$&jZZFOPb`w7pUg&6wKY@W> z(??=korC63RgRE4Ll2ds@R|Mro~7I0BZ|7AeCmdJzaOZrGf(?w^o+SmgU0HfIs6^t zhhORbWvc(~WEUHCHI*OMRm5`h=F;MF_Ug(?V}AO!p5E$J+?~xs&f9-65)0S($F;fd=6?~d4^oHD5k?Skb z<;jI;0EbB z-ljpT-@T`Pz5<~soD%9^cg)$Ze}7rck`7|ETlCHn{_f6&g_`^q{PN<`!tI-j;`h!E z7MFhVtU=jg=$k@4VTP5nD7~W{W1I zEux6=6J>Zesw&vl#_3SUfX8EhFql=jiFluwP1!dDu)Zkv9tuJQ(RBNdJ zl+0Q;hvG!pp*ShC2?+2iFB!1es)`r%fu)hu1H^WZC%53E-lw;Guh?(ow8%^2RGnqUuG9;jm7%i6E%5P)#`05WpCDQ&wNiS zG+Abari2yR2Iu$*MJpz|V-lVjilV35wkW3fzM*`Y+NQijM)Fq9s_rSFj!#niDz zgfhy@H6fRVNvvSRkb|>1%^c7m01nm99|sw)JbS$#K-sTg7-}}Z>^#Kmt2b^BrKxC$ zs;xe*KJzJJRT-dOFlxZB02<{ao<-dBA+rylss3WdsdqIqtqOvtPhkSriyfRy_0wlM z(F%9T37N}bQS4|8DVtwjzFkM$?9KU=pWL2y(v}+UJFv+|HKI-R&27MIbDd>utDq21 zzC9d$XQT6=Kj7qsem)qLNV5ew{^s%K+Tn9K1mo(RVO|?B$V0gLwsHq(wscz3j8t9j z)vNDbg@w?BwDSQxOJ|jrx5oK)D&|$It9%Mjvw8;_&d>Cs(U-1dm}zcjI>)aDiuYLK zud7cFO_@)h%Ze{BTdgh!H>7o{u~h(EVWI8eM$>@p9^_HY%gt~i*44juDJLGA$O;W< z6<5ij&d$;Vs=KYjOsS!&zdhoWw8b+*Yfg_0O#$Ta)kN+Qz)Nessf|Qd{7JuT^~8@d zyuH42OW*BxFg|TF_SIE^o`wIyIoPCk0r~dgEB#J8_thGK5Bx#DXf;V2#XeZ4eR%G# zI=@iY*fJl18NY`gpgkS8SUCDNyaqGPz)awG(aNg0o13saHpwFB_rIzpcVE4@$NIzU zVA_qJ(`PylG!Fw=A6sBTR`thV9qFI!!mHfIO$?W6=?fuFe-Nxsb+HyL4E>JvGq!1U z#a^D>g8H8U#NRa(KjodV_E#fiq=b=Cas1NOqtgL$1>JLsdSXF6j@_wmhv!$2Gr5N} zAF}+GV*@X`ue_tPdIJx*R&Ff8yNtfXA@LHooIKOy5Ab!3`~&1(Gc&NHx__aL1J z-|vg-0x-oM7+gI@$mlgg?*P)p{s|5Tk+$5B<>Yll`9NGt=ubvGv+V4L>XPS12JouG zL(+@ba>+`WS^!(T4A8HM+)S^#OuG_rA$?r2cdkwv?Fj={uE{506N!OvK*KwD=DbF= z5<8#3sjWVaN2xi34tdhlx9POn<`u=Slw4H()fd>`YMW!n&#e6R^RCL&WniywSjSby3E?V<^33(X%p?|sqtL)!5+8F zh6nZ#?%@1F46tb_C-T;pH7cuLt4urE;>od0-^DB4thaS@*qK_5j)n;ek ztvBZ9#8rGh_^jI5i?g-H?0^cae(yUkc2VXQZMqMk+rGBN^3YPdtO`yEeo!A(ZANiC z+ow0A#0GGxfjRY=T@45Ht5vf1973i@>_m9722~x|&zOZy4uLTZ=oy)NA(ed>o^OpY zH|=0OfNA)IHk#gG@R?5ylU&UjoFB-ukNSV?K&Wkr4g|#Pc>deRYZH%tAKg1R=YjEs zU!)LLNB0qu7_Nn*Pv(AX?8h)HbZwr(Dh$Hlz-4vjw7gp3LT0=Jh>hq>k4(K@y}L)< z{84Bzdl}6+W0^2M0oo?MnGC!YWw605gcw2_2K3#Y0-D(bADwryf8QL@jW$@LO~xAV zN>ut_mfpIJpsKJx^T^YZm#U`;ibG&~e2g(tMearuda1PsM(>`oTupLR%~yaCseZ5z zcFS5Mu+mI@%uN_>7w|LK=$gp5p2Acx8efG16jqf==WUlLRu3fIN#fe z*m^SzHrse|YCjkVuAhl`0}VEQ6n>=lsoEcZ;4=y8u7>P7!*dWrsTSgud-S*x5x^7q z7qBD`F+B9|6!QUcKYXDLr+3dL+_??j;*OmK9HCgA4};+kNAL+k2ymO?1NgvQwduSdM$;cF`i1ijVl{EX&m=6sbL+}{9=#U69 zDor#rB_Za?*nGdGAR6L9ZG0%N0@`f9E|~(|kan4!p5TU19{{!E#=%poFeFSoUuZ>owqZg=w zg?|JF*m&FBgXwr2t=cbz8-Z6O`-7P(onnjvc_{w&_S@OC~&I;q}7s`E9n? zB;uT!SM&`23K*X_@N9gp2h282Y>6kPpavrPH8NCx!q+60l`!NY_t(-z(46y(X2^eco2~35&u?4ZESn+!|g#5 zK+qrr;-I-2IuruT7B-r@g)6uM+F&X;cX`0;HkQQB#d5Y8&sJ<2okSTOtLjTn%nB#u z<_jIWu98)5E0fT(+3vo=UZ0++JojkHsXH!Gr1+FovJT2itJao3Tt1dO_x}MqVebS- z$KUslCH6yPv18fLcm#1&p0l?MWF;DEae@;AE#m9psfH1&_I)*Q!1wehAp}gcAR#O^ zXpn!^d%`<-O>l+#B`3JY!~qqA4sWb))~}1PM6DGr$Y}CKnSmFXe)%#q$C_;5Bw=7pm8N07RUQ$AyAYg1By7+t z4zL6O=-c5fvHJkE+lo0FO?e@pC?H(wd{adr#sR4SAo~O+YE$5IWQO-J=87YYj+chM zJ$Ol$ITxfU%Thg3W(f%p5bwZ{O+aXA5l_@_)(Ou$Vik!P1Cp(|3#fIQWT2xs7^?AR zn@+UixUPxQJH+k#WB0#7o3}2#U78GXgPt(+4*Xj*$AkiW_s1g)_jh~dsD7qbmYzd^ z8JQ&kI|*5zbpGsX(;j;fXaStX5FD#$47S)G#? zu>tCVtK&7hcvPVSZb?71Vux2sAO7&HCvd!IlrQevX804 zs|J3hIZL3X0x~q}@xW0#56|lSh{IsvI*O6x1S5TdXE_mfFwB^(lrmEQB`E zxi!G>c}1AQAc+@qHY)VlHiBvJ{-L;u!r#~meiT_hxvA!nlggKQCKF>Vvd*~)W}d-j zc$ft_u$BW3WSE~3G*pPZJNL{6#r&LJ`mg=$Dq4hxXs_HSTx0jC@Wik5hqkSsVRPUR zb6_L^@>ut&WU6oO>o4J<_u!1m@tMepTBAq7SzJG27E>mPX;`rPJxkgQwogWB0Ky(} z9ZvxS!dng?p>T(ZZ(%_aE*q?G`qXSVc}!=Jjcg)8OuF6dzOTk`zZR5u;niELQ)b9R zAj$d*2GYoa+Zfxh_-PgI;|eCHXP4;wkTUbuAuRD{1OQSJez)M7Ldkb7MbZ2bQ)Q-I z%#iphuzpN{19BesO~!?1l6M{XFRt#ab(18wFSp##^4ax0C6eAP;Veav@-p4F5uw`_ zKi4{+AB!8GKur1u7kyo52JSYjrN~JsVFOckjBXrK{(*7EYjKNei3~TjnQ#(Rbd?p~ z!eTJhoh49>GXzuQ%ob-igA3>41hJSVoewd8H5FktqvXFMht>prL8!$v5Xa}>UQphs z1-oU#92E59HiQUzIUlf-&2&#<=9M{b=9a7KVA=rkNFJ2HSRkP*bwdqt;(#VJ!~8<}tzF%d}gSnN#{eC;0t=12o$qC_zzFvxo*Al*k;wk6Zjmdx+& zNH!Mae83XP;9m!{@tPcQYP?Kvi#v}lXgK45>h2t>MOz~pxWd#&BERi=g_KDZjR>hC ze-R$b+VJr9{=!M!5JsP~gfxW06AH3kxXEzE9;Z`d#V-Dv0o4QwMePcsqy#aY;%2EW zN_&WiYcqwBgaPIXc3~+3a%6(WbkbSQOkpbR!nv`Sjd}uoc0VTL-sGt{3}hOb z!~x<`80)#mcxgabp|o=w6Ng-*V&MN4g`Z^GRg8+oD+Sekp<|kvi1ir_Eg(zw>mW2} zjWgq0_H0skS~N@!z$QbqDbyr=ryuEy`rQNN0vqa zyN0Wl+9KxVGQoY^(;5M5S>^$84~WkK;8Up~?LnSwFAP0S%wcx%M!mL@UA-&?J(>X z%1ihImQ8^DkrT+2-s{Gwnp!G&ey+k}nw!j%fqgOg-*7MDS&KM;KBf-K@T`b)RHmRd zA{5kO>-Sh3q=@_4KUN#5wY2rdjtoR?Mt4b?cO-c?0)w#Iu=PUKgb2y4aWAwcdvn5iez-Tkg>W^?9-@|bv8DBTBosFJsPkHx!`Wm1bAP_ z!a}HTA9pQD`4IRRA6Z^u84$|Guy@zyxkLVnUx~{n-~o3>`V>vmHaT3#e_=*2DLjdq zM^;urDp=FD$1*Hr8+C1XV7obh#n}d5Hc|hEiTW!hbGltn^&ompI+XzB!7(>l!$py$ z(vP-COYa3ZHSpS31^^fgxDD5PJT@! zL3wx*5?wImg^vtd+WiE1!kngT5|^+zFeoxlgGZkf1vISRgCH2M*j|6pklRd z&mv!G%;6x44u#k2Gt+Y;!{bA>iLtqn>B-^A;n~57+W6?;+{AEgc5r-dbh17?ICd=O z(^o~hh?|f!f3KDJDt$ZJzC11w9!xxM5{=H&d%|Ps5cBk50>x`L2xQr^oOdotV%g+* zIdkJ4dWA$-EQl)<4X)MPaFmQF>~S-Qxxh|{G6F~${5G~*yP{kCaH+_zVIceLcEgcW zgoK3X@lFTfQ$y&CK7Jl0Bv|i>z|nYuAR70slK-!#y=nRh8utdsbInQwtTfsTz~_r3 zKJA)ny1zsQ9@<-Y(|G?w$~!#LF~zzj_7hU&@!R_IE};@6l;^^@6UcmAYJ*#t61h?J zl(xp|IdOm*KE$2e!i2-NuyYAQn4V3Yk-2Yod*|VIdlhrm9m2``5Qe=g%EfJj1L-oV z4|JUzcnQqcKpDPBWTH=LqafgOkb7m$A`e=afbg6Y)lH7>Mqyfm>ec=Pi=h#r!;}bR z>BY$r2Xvw@_H-~e)RT9BfaJj;NgOb~0tn%Yf9rkUxjI}Z0HzV57O6QYAs8SNr;Y{65{t!t(9tgiCWV92J(uxEL(>w zYIAwkFyDVa6APs6yS@T~41k3aqr|$foG=!6(?sa~{F%&57>V^Qo+PUa z-7-Z`YEhrHe4<0j;kr44HD;C>J4+r8mRG2SG*BVCWl0O-x88VVexRM9zHw5P7{Z_s zRndzeUQ`eQ`C%%hOjIfEkH?QKECHg~lHzV1V9kO2I8*&v5*q zTEJG}2R_OH0i2)MAx0NVP=eizSjV(iD*KS@n%iax_Q;4rj>-NggTFsp>UXiU%{C;f z!s|j8fmeYFmayJ-5Dc>(3+*s5<$97_3bwtNj>M3)-&w8t zEVjfB4NnIBdv}b8wxOr;kmMVvfGtNp^|nQ`+>DmV>+TsHhTNGSy;;^N8)S$x;(}~0 z4Pzpt24bXXYlj5WSEQXBH;&sYMRQfon!w8y75bp|i&!vN$WR6X zU|}~sB|PsI4Vx7$)|l}F0?6Pz0@Ig-SePb?n=Y`(2OLc#ol%HNC~@v-y+xC5G1stQ z^|Fv-kZ>gWNf+q-;{6muge->E1bul};#OkcJE0s|zzilo*)_JPMdTMtgafvSb5ANuLFEpbG~W)jN$4{5 z!W}{iZLPRq2g;d%tdm@wc-XNeH5HU*IVE!;j!YVEPYM*N(HRsns`gYg^$ zRzB1(5;@51xraafp%OW9nq%Pqd5)aJN@^xrdDzL{F{yI(Hh=4$C_Oa%h?Jz32Le>` z2apR|3$ql0vmIqZB&@lg+Ml@~-QaDI>xFyGWDUUx?||NriUa-&PxRU3AQB^<#Q&H zm-GJNz~lg;I}w)cBFe#z2%fk(9p~vt+604!zhlEMR{@#TI-Oupduz}Xw#Yr5c&c1> z=x#PExE5e-MmgHN8y=%+gcL*0Vw0`Uo-a$$^4R-_tiMaxlnpW3Mp~C|e|e~qT^`n# zyFAh#i45T}xw;@p%aPt+-6qGntKf0?o4G`i3d>FR9fwp$m#4h4K4pf2sWbN*0+_o0 z81YiFOm~7x#=c;9vJ%ATv6s|>M2)JIU=Ycm*hecF`Rf~2wycR1s>0Bct=F5}%FaaV zoe`x06*B!7U`8F5nFulUeMkCG%YInE7ERD9dE8h**z_?dfxhJ)|5;egh*b+#P!DQ{ zva6V(H5ARNd%>g&aV)IEZ|ykzt&ti>-~5QKJR9FW*_DG;ZC_Z93u|9mJ1_EM_J!nr z(j{i?LaEJys~mAinuf#(PT0<)NO!k{;(DXUSr8U0sz8_}-SY5^B3>=`$gi;9aL;w@ zx#sl}J@jiT(@q;ouS>BwH+8yi6Umre-;aSYMcDd9vzXtEnt$e{FM$OiLAxbOjFiDvBD?!hc-*5$=)?`tH z4IL>P%o{gVb?EoPgH?_vF_qPA(xN=D0zl|}U=dDwB}gQw^9!t(KsQsrlurqqcDc=D zV`ToKKb5fe{FoeP>@(LzV%T663Jn>?-Z4)}x-kGXk|~C`P#X$nhh`qmVMMl&_0W5dIvH}K8!or6VI;t?MV5w|@}_!<5c7cZoKo_(aP`HJC=HGvl}a61 zD$i^^H%IFtHHiSsLAMUccI_F`9wrHGRfr>Ook+PSeAP(QYz`u)4~1KfV{-o7D5zCL ze2JEG*8X5L!2^~;eoA4uboF>$P?|W9YjOCJu_)gG+T*QPBk)>T$Dz@Y2)qWTUUleL z++eSRTi;w<*|H`Uk;{@r(A?sK*hZzrQNkMKUC(;yR8(;bRyt|14~Zp_dtiDuBVMex zFq=sHQ3o{?cR_^X8)hK4L&t}>EJl@%60+!1sYN_I_}B5NAZfP$LUSbhN;}&hmBOu9 zmZ`)yyTp2C@s=~9&fIkpPkA}Pe-X&Hwb1Wqce`W%+ebzNiU$ifXa9^^0VRE zX8%9>Obp=I;%{}4@BXNq@-OIx!)o0ib(-dPdjnE0*4vkOs^(k)2#7%H%(Dat(?1tS zXUn&xc55Un*mdI8@2cgvkE2QVakvle<8a^H$1lQQk^8jyc~Y;uo(@ZH62-)nSeE6H z&y8_2jHLwIu(|Nr%fkaldT?W99-NGA6LDwgyT+T!C#%B1P17Am0bZLZ8;;tZ#C?bs zHM>^)@(^VE^b{N=O(!~mh)l;x^$^9Ws?SHOY?_(Mkk%328hVZ7uNBPVlvk4Z8(S-m z--|GPof7PxJx1#SxJX2m{J5v^Q2U}UqT|r6aR_&WOY1<0;&~B8hKD$*y|{7r=TrppUtQxdl=_z|DjsqnGX=c?6I!$R}J41^xf$NXl4B=yT5=CJ6)h zgJETUZIV+Gn>2t?8}P_OMaHX+1dJBeQ~*7onNfZ)^Dxc z7?7qUHygeXrBv`VMtO&gX)7tc(ODIbxJ9n5t*`6BM3jlSk4iCjtWAT3Qk7mu)%9ko z)@#ucr^jMRzP3XNcx8@mku#JZB3B-!rri>sBGv`+kdR)(2W`{Q_|yQu9U)PYVIhl2 z&E<}aN~zXP0`5-=wtOjMMmm;@ER``jp?rp{ZH)8c1X~EVT+z@9NbC6iK?wi*Dx^Nc_M$2mSZrka9Pqk0QYp9TnsiHrYA2ikRit zakTUN`ac5V^>X}IB%D}rmLRzuNCj1bB3-V^aJ4j$wsapsgN~=VVX#S0(80;`ur4zM zOq}T3$55lGzX!BO455fZN3I6KxCd0V01XT5kny=U5bS2ie6QeYL#Vkk6#?EpBzU}n zb;bLByf{)3fs%eC(<=7>_TLWpP&hO|#zgT+%$#(4LiytV;#Xy=?_(qW;Z?OOkzZ<+ z^BPsZ2I*M%;a^*SrOOuW-80%ek$c&kxM=o7dGA&0-n~^{`Rzu&l#suin&8=r3F}Z< zy9zcJU&5w23Zz*d85>McGJRm(@kk4!C^9r*1Y1B%1hc)sSKwyW%?dRJjW-ArCyFsA z@^1a%o0#;R(|pxywhN}r%F|d00vaePl0-mAYls+T^?Cx6p$(%FK>_7E`}Zw?C|^!n zC%>shuGX4dBu9uyME#@iw2PwucCOwXshCE4biB2g>;>KH!>YYDa87(-h9LPsi_2;` zyn5x5)DlzU);uUcEA3+?3(ev2e%0YdV6IXh3q_<9lHY#y_R0-@$M4mr-??^?v>wXd ztt)yYh-A@XEA;L_{+L{9QEb)qSyQHzJv!xESaPO7=e3HYd7}NOJ0G95mAB3O+x9KW z`BL0BH#*XmkOF7f16&`@pvteC_3+t0-}_AupMIFbQ zx{`r(RtsyOv6Vzq2v|T+P>8Oytl8BJ>KZbFP_3ZPj;ZS8*>4#NDPXNnO)hcY`<%F# zBw$)6wS~(0s{%*Knd@RN3Y?5B!y#^A88LnM5PV=|z0vBgq2W{pp^H-4#oIUWFY^l@ zF7OKFszCM2OSAmLp}|4pc$sgxEBoToP4!-SI_-XAXODy_?d)Y|Vf|!{`a-?7Tpz$$ zcue?N6PaqQSnLU=^EVNb<-A!Ao_(1w7LW6Ysen&=ExZpff7xOE$(SBDPzApdyhpOV z_aybDgyAnrx+D?f&_oJCG2sxR04KFAnf=jJsw`5=OlGo!f-R%x2G5P)J{ePg9UM3f zOUmq>*pkx5$XilTAXJ=qDDxpw8~6sOIDH+WS@9b#$3c&{Noot8%kD27^p7x7|3bcF zPPH7Hw4I{hkmxBWi1KDL`wo+ zUZYwhlwEq180aYi__xB7_(+bSzd{4Q)eH?;W5X8SWp$QRjJJF1+hp^8fl z+d~g-8(q2FNpPU@02Vme<1#HF^P)@ZC_~f~)Bpi94L z%-3sj{HCEG`=%)s(kjq36G zOBxkN)^k?EravLCVCdXmo%^ffvJhteY?0TNnDb-HYW=#GLH;uAug84QZR3Cumks?V zViP)!Nl)YZUoUM-Uu=sw82fKqoG@Y?911Lh*>TN|$#nK$Ykm}KLvjji&2XP>jY}^& z8TRI}iJ#VhlW0T~xf8&@f*}G~l4G+fJvw?sA~_io_|jni#TxAXL@q9O1RcQxQv>2~ z)lxB}bYlYIT*MWuoRCS@CU~rev3Q`#J}Ha)nK-FF5}?mP7#Nq;DM2F_mS#Ta6^{G^ zRBcd;FLl??ODbwnvVp3_;78PpzKEzDBA^dXsFCE~!Ru#@C^bi<4+5nPf)QZl8U5;# z2sp?Z4ownn5z0jtwSPuSOapNb0o}vVSSDz2RVs2a=|W0dx~9`Ea@Zi$G(bGIc@8R< z+U-3l^ZfYEuTzjsv}>()wnU0vWTZOW`NUn%dK$&QN&3RpFI(*{o9J;Xc#Mcjq+b`H zkSHbJ!ZKcdTU_QSKO4_YVl!+DO`R0fXjbFI2^z^Y?!I7vhxAbDs!* zjeA$3V#cn^oXlA`>YI~^y?qD=O10N>swaQea#mz&4Y2;PYRQrRGMf1B9!;=1py`uz zGNv@w~0msUOfgUu3 zCdcERB~ok=xe!~F)c7BLd^$-gnx#Mm;cMM+uHW-fHon@oh31$EYT+g?sidtg}* zfMumlK2tt_UzRhqH{MNk7(!N^6lvqiHJQ8Cq|l33->qanz54dg;3Wv5$B@e<;-xlk z2OBXV1A=8Y_HCtK$I3(t4n_&R()1z}T?U)ox4RlE>uEJMENjgSs|ZYWHAbQ0M(O?1lkmsYd&Z$5o4D>t9R2_Gh-0ot;~1d@xXP^SdpNXvJxpC}VLe#pcV2$ZDTu z-(evh-SXTtdTa+Rw4Q@l%3_LAfHjZwq%cKCDQ=@KFnY;tjB*>lAGPtn2d%Lin->ur zinW9*C+J(14Xwd3L^O`3koar~-R8oy|LnQXo9y5-%=T)eiwb!ona>rW9qc_CCn%?6 z5hDknuR1S&Ri-F9=GI|jeHe)56?rvg)sL^=BvJDfUGYLg_xj}2)NH*rJ~UIC zo}QVQovPPIhHHbhiNU$r$mr0_+~`bgYIbVkSUf@2uYp4zqZ!IF#(2)rZPWs1LJLh<+d;Ank%W^8PFczk$xs9qnO9G;k~O$<$q&P~n^&drRC4o*#v zj~$N^FxOy|7YrVKumo!vOXwV=OzWPUSnrFBl8^}Xnvy-ifS)j_vTCEQC&S`aEdL+r z6_1W!+}}Hdz#ZD=aDT24nQXF~2D)F|3yoz@GKjXf0qDeK0Q;#-s+4d67YoZn1kPCG zXpbee;s3M1-U|N9>VQ}l$|+-CGkz&;*u<&wSw95yU!18fBXQ9%a^?!u!fBwLTKr-4 zYETi6^bD?p$2wDZ{)k^{IssvWN(Uy$sY9HH1IRM!j_p2dC#)6g-;9mZAvVU<)MCeh zeCX$LEL@Bp&nl*JNiYfr_`(XHE41k%_2W#si7Wz&$TvIpdOlS_9{c0_CmS z6gqBrYX^y~>6L@+a(QZ-6b_{(leO}F-GT#CbWDgnQEHEOHS`rS2n`hX<;ZIinz_u z=tpo1-5LjwSEJk{HH=nFQ zG}Yv`G(TulLc;)_sK2I2(vy2HZ^G8Ot;~wH>Y|D3mOl1`j+~CXdc$T|Y>MPQ3T~qw zmqDj${dIWuJ*LD!+J~@otCsx$sw><=knM;N}$5+rC?yB5&<2z z=)nQwdWs2uLm$!W@Vh_q6h}Sr`26PI?V;W&ahL7U(az-Mz|!D(@QHQl9+2a7p#2H3 zckCGD6rO-7gGj_NltjYsX(gaHm2u-q!!YBalUTZqzKT&maL!jZv_g4W*lC+VMf#ItCC8P}s?p zw?z2E>e8Qm`@L7MUdgU4-O7drA;;W_N#{Gehc`q-x=frJ+{KxjqpwR8$#CGru}2XH zx?zy|wq2+xqTXY68VmI8r`$4&%A#)-gTlKt&!r6=M2CaxBV!X&!}YO|(fZ8H%-s0Y z-1Ok^)Wqn_WNormAFPiJkIqg^503p%At25Hh5DFp1lmJnDL;qB>Z>uAW=-$2J!89$ zKxdD44ouYatY{L;PxfxsjscCMMGcdqrtshS+i1*i>#+1K2{oa2D42u^{R~;3=RZg* z`WU1$=8(GDI&=M?z;+O8{xmYcS= zDWJt^DfVP5&;y+JeNLH06$ZLC3ce`6_*I#7=eU&aj3hmQ7J?E~QhB=<|E(vo$m4Jb z1VWo`U}6Y;ON0NG_YQ*fPhgom!$Xk!gVUKn2MuU@BHs>m+c3qef4E&pVOLsMP1uki z;A$?3(K(>fu!L+336X`R|4J02MXWju>D%H6WRSUWu8{Ha~q288_xi?OD{N7#DjmC$iqcu1?H8L?XH8wLiQ6Czu537F; zj*RMT@yO8J%<$Co(A?O>{V2mUC z%guxF3pT(fjFx)zOXTFP8LkTC6R!@Sme|H`M`rl&GX{%$T2`ctY<^Fpr481;h%?4{^AJej7TOwGF zk-aIxYx86jO=~9)xP!%ZVfySA)T#vxEWb{#a3>)`>;$HW4sh0%v(0999Vu$0=UP^y zV2J4tP>$Ao_aH+d;D`kvU$4YA9{XwLB@EfhQ}<2^)Y*OK@y3E+8%#W*GYZlSh@PjK zPISV`0@rC}UU;~g)=ZAuTPolYB`oeETq9kdLp~qcvB{J1ZiW_Mhi-<6m418-XwlKo z8A|!4>zi}yaV`y(Mpj4c^iI&X7Q?R?FM|qtbjbTK^WgftWCaFsSgCw)BGFsIg0@oN z;NeR5iBAog^s|ljwk%=5sCRTvPaYp}93fH%scOL7otxvq#lPh{W;XaXckJ6r`#o5p zZL$s`Vu1;PE;9z9_LinE9dCvf zo4NElHdUK&qG_gmn0kWDqHgcAfzH4lMli&Mb1_Li{)r>CjWCRl9!jt;>~JHpYH(CJ)d^7!Y?SG6B>TXy4E4Pv z(2)b1DAr|T-PF2@1l%go0V%DnU*hsgZKb|YUtZSjBL_sWM+$-30Lvx;GqOiwwRNAa z8!xK^8XuKrN3OAIYK=&3&kE-vcG+Y>f;c>ss1yUBgv1)}#0msOe<^z=W~Mq5wgP>q<9F}44?xtevD_vM zC@Fl>*?SokxdxFI`fjR4yl)ddLml+?)A!)lL9n>fySvQmeb^C#5*FUhu`W7Fip-dk zvRlG`GA46N+DEM4mwW*=Q-3Nk8AiCnb?)29_yHUo0>WoDQgl*pcxgi^a|Q#GMhU!< z@AxLZt$Q}Z?0PM9n&~&5>?=VD3csf@E&;*(#@}#aMH_` zxqyS`6&V2#?KLUr}T@@J{@ch;vNiN{O5h zgue?*+;--JT0FdM3EQ=#s+IAU@;; zxmKL%c9)|9TC;0cv#fGzTr$JNQ&v-p_gEaw-*mBS`sQYS#ifd|3fAryT2L|-%|;7p z5HEp>HQqYxi|jn}ru5)Y-Kp5e?UJ0pBiG;A5={p@zqQHPF+P~r>ymp0hTB^3;G%p7 zPQWuOLM?bC^faRzejvgmO}dG3YIT=y$5n7@mbGiF_*-?KXw({Kt?(hP7t<4@L~#z( z5AF3m_TX4TK0EtNm?tGlJOh(l=%(oi5$>LKP=o5sCX%ycVqm*$;m3`smEO>FV=cas zjhqV$!bu~*B?7dgrQAtK9FzD$I$EaV1z&@Ig=+xU9Ozg;37o(u4&;3>qyccpQvtvU zFXR2g<_PI7VsQl^k|kK@!G5KTSQB8QUGmyKMasSS*g+fQmaOz9Zh zX(&`pHH_Vq_YkixkVK|XB+4+dDrC{rO+0?KWdkYI*EmYE22sDm3rN)8Ks3|`XY8ZKdq3My?sj11C;lc6giILH%+SJ(8WYRmO}$+UfYA#ZbP65pH*3-z-ThBKQtUd5~h01y@f<4~=bJ@H?+i zt|y(7v#-5+^%|7jsQ(T`YO>tAIPok9Ro$AuRbQB2tjoHqykZi^!sY10Sp4b~DWm%cJZd?j{rCu4mdL+*kjY zdp|*lyd%6*1mHGt1L*@gso;XIm1*TZQq8^;mL#-58KmXB6`N?u;|UnXz^p^$ysdPh zc^}R{Rwc0F_r@)9C!I?X!PB}2;4VeY&RRs8o+!g;a$^sw@3ysH%<%UsX46SFskaL{ za2?j%jdbFG7lI*svY8RS#T4G5_X>Px2UnpuBRN|~C7NzAOS&(`0Zl0T`;1!K5NpTE z06S3>O+T~KbCa?VwTY|lQcj1xL~4S$w?h{vI9LIfG0CJ?CVb@v`Rs7L-o6)*^<(}1 zpAHufL7AZmRBS4SO8T}6S9LA1#BjEe?|L9X`-J<4`PJ3V7gTz|B5HhkB)>LRi?40g4Eo5qrT9t;6h&B= zq6_*gmkvlX8C^tFP}CcJWErfQ?C5GBhT)l+&6K@#g|y&IX?kocjIb$mCK zZo+^PO$*EO^vt!eL_5h_ad} zih8V3+VeuYeG9g}0rz7cx3O(KFONBf3^9E;l%2giG!Qhe8$CB@q)*$Zx(xWXv+A5f zi1MK_k)D{U-eUUfEQK81L&2HD#R$OQfeQM7D4!k3wD>#2YF@Q7t4rggh=WS!1EHN| z4);*&5UrLbfjh-FY~?B*2iasvTS+!DSH`TFbg`7GGE{v>R;(!pH1;zexFL& zCEtAz9r9#GHAKjx4eG!02m-FX;g~GtKIue&vjofK8G1;JJ@Dt^h$@l9iO}z;*V%hV z&%1~sQ93JG3FFocQGJ(j$(nX@ykaL#Y~6F@FoXPv1}A+5Q8?={PqvLHfr(i{q@WzH z+H%56I&V5_Oc+{4pSC}z@i)&=9mnsA8&;=IjiVFNmCR%DPzelH#L43Nv`lEs7|P|M z%&QLhHeu6mGpa0X#sF$r;kR3Ek|p*c$#Szw4)^SY<$@O%dpUz@_ad$R5Q}cCD0Vs( zNTpnR#CAfmbVdMyL!~})J(j;C&hQz1Mz*w~m0k?U+CL(vU~zyl$F*zs%NM5+zw(6< z#IMrj(c@+1(USsP7nzL~J8)X?hG4iY3!Km|K)vx0U3Y`%aJi_P4aymOpe9@uQHHq%162-F z=TmVi6a1n}LX^KuIs|HY8t;3raHLtYp~0#6l${-!{ObY7sgdDV_x19|?WRb&`RlDp+8Z4B_MdD_EYK-XTz_g`j2G zkTnX)3q#2IMQ|!hEndSB*;df-)>}q@&c?d<3_zc3mR0DuRhYD{_|1EHF~L=dEnVT? zpg0l%V(BJ|`Z85aMDhcWcob00+Tg25*03R1`+%dw7yDrozOwu=5D;_OW3nw!llG5i zQ4@kwcJ&ASz|poI76B0n-lLx!Ev$05^*Cc^6-7S;BvWpOmVSISlB&3KXxZ@FXv6Yx z)XSD7?=dfVRUEuIQfHQ9wGs6@kqW$W^xs&K{4zTMS*z=p+p+x)HgLbhr-F-C-1ZAj zsD!aki#lPT^trw}k=2PahgK$x7RU{ET~)@+2+|kf&%Re&20^<}+6g_g4O{*cbd40n zH{@vGmD1=t3MIxgDf*LMh^Iqfyb^^^mmP`nRslwG7o`e@2%CURHpy!QoBC-%CC82q zh~T5ddQ9VNfW360*NgcbbF zNYi%7bhP3Mer$@n4aq1^0J`SnoGH$YIKo|@UuB9q6C<*t$lS!_#L%qS%MKN6phsqqR4$_3>$)qHQI+Jq956kY+;qd>9f$jufg9O&;r= z3lJ~QxnC&C0{E1AS|2Cs&l z8UYqQ#nZ3ja9E2a6nNv*nv@v!Obf;0`JFuzi;G_hB1z1DMW@;=%I}Lg2AU)v84+5q z%%F?Raw3f$%aj+k7h~`WoR`}nqB~P%+n{hK=xutw05y`jF5$deOftUaN{azmFP+^O zL)Tzzwc@)tQvS?%xOUFLVjSetFeSyUbP5hmAe{u9v)L; z>d2@f2^S*$8(h?ks?S^~!@Q`jB+m?RF4`zxUu<`TSg(IJC@%Byp z%lyKJ3;d9bj;UW>n&lr34GtQTn)#MHITx31s>kldPQ3lf3 z;vvC88Vo0r1&LCmI=YzVDzk>=7A;WLsIxHx?+0E~MYxZtyLwU5cqkq4nj$twhP)(~JS&+DKi4fbPJh!p#7c zlVz+NXtub=hhd1C6ROw}*-^|;HVwq<@K|8^`p{M-LI^iHBveQZ7Fo6eKIBqaF7+ zV28nUHe(9prX3fkomfxxkkrNRS;JJx(7TLkp9euz?&yb<^@eoMYox!gVu}^B5{1>S zW#)}ZWWp-#Ff|OUK(Fr5_mEDEV3r=INLvm7xG)Rsb|;8>Qn6ZwN8)VB-N$X?VS`0g z&^yAZwZKYv?ze^&@S*D;i4ppxu+%&v0copHw$SCuumiI!X?Rr9+)Yma&D{$=J;z@7 zCN6$SEPPnj=7fPG57*M!tM!Gs>deyON^O3zKAT-z`k=nJJb?RN#8qCQ8-pUd5dlS( z0Tu#^q8=bQ5@*-a8$u2ZotEiiVLya%+eCjA<$ii!{{rnv!S%|L)}|M5ZURv&TfzYu zcKm%H{Rt|D5tSYKM=WdPhG|=wnsma!&)iDU!jC}#;A*pFWD33v>f=Zn}xQ_88>#Kwl$4&pv87!)wM#G1kv)S4nT!!qGuT+)GVR#PkJ)yB+?`IY+2iuyUNqHj!?+8cnq$*!m)tkY{{{+1&RZu79wLPUhj zOfX%M={k+-K^S%Dr?-ClBavXD+3fX!m1P@{Xx{w9MGHY7s6wDcVil3cP zb|BX6Ho5&g$voU#sSE8T4|HpisA?%P~34?lfs zu`U8WQO+UOFN63-n;NAQC0p(Yg)(nHT+J`^`q$bESWSY5XES?uNS7Y|GPb#m3K^B@ zxHxw?3NA44@Ami=Hr>{-O|@u#MM-OSzlbq zURT~wy-{14S3f^{@txNPJUc)Xc#yBfPOG2bl2^0yxyb?|{D&=ESLLzd4P=WuS(!5u z*asy`qAw-w-K>U-@4c>v{j*D2amk~~mo-bOI5rO?&D>f}U~6Gj&`yK+_@6#d%SW6ezq34udSP+H`rRWg(9z;~Xi=9fS!h9&I)$`6ax zgfvnbyr2eS(P;+l0pqawt~1sWKTWb%GOjYPWxr|553rr(enX(Ar=2`Kkn_>mG*_jD zDSU!3a)?2^%;#;mTpxOcPJfS{{m8OD;uE58=k>v{skzb7>4}-K+F)&BXrw+hTN@sn z8y+8k8)^jwvH-Uxu;(apK2K~A4mbNgK69n(M^j*o4apb?#VS0a&F2WU9&-{ zT$}IDvBDptPTl1A;(Nufva>U_mHPWjjl0#Q#f7`tRa+iF_yintvBS2Kg-lV1n_`!s z@KN6)kewis7}xV3AT`${(UQ?oNOAk9;%2OJk|D5MfJYf)i!K|GTOhbGS?qD)$-t?N zRDE@8Yy2X6`>V;ada6m;zKUXd2$!gsl?_5Qa*nH!S7jr?V=A?JoE}x2fG7H%z^M9H zL*W-DwLQ4jX}rkIjk3!_+1c;@So{Xg)f`o07(V)LPi>#e!|;LMc~KdEK%Z8ZN8lrm z;p*G4oRLYw*N|H2O;DrR=d-OKjz6nDVgIa{phiU^i*Ea_oE243)D;U`eS(bzLqV~` z)tQa#Nuf4Nk=s5`l70X+G5zrEe4m51KM^brLh6_+=$dp#BGQMJ@o%6s2bn{5BI-P$ zvf_PRHPe?yJn?c7=nN2VkW~shZuxs9*31GJ0>}t9H;|lPQ`~RGi{!?yxVIS#Zo{%x zqWE3ApP#^|sF4?M2yMYF%~iYb4qan zz54dg^wz!p)@9quhqhOT`!HZ)6TnTZC$SZ{^1yq7UVI0Nm4qB4Ql((Q*wS_9jDchp zDiCQ<$RAk@iw5fesf%Dbkp$_yvF`DdNm&HD>S7vItbK=l)T~;bUtjPPd2hin?Ay8W ztymOI4D}&4HWJL}d+6;V`pOkYie1M8GSeqS-ASEH|8r<~aDd%4(zk1x)R56vitI^=w*kVnI=WX`<( z9>%0L32iAQIc;x2m10kco1l`xCjFDnXUK1|$)DEuQnyQpwIXYZt(0uQ;-L@5Y6c>t zEG`??R)D2>f*1sk71CZW-#+m zh?gGXr~^@0|I{&<_RMXrwUx0+E2t=smdGlVD+9tUcym&$Ftv{Q5vzPl9$V8{w1L48 zaV1vfcZ7gOwBwnf;ufJ`EKVvWTw9_}zkmu5pk{(nH?a-5d*&vkZA_J;mIFZ?n~aLJ z_Oa$#@wRM1K^p5>1uDV%dv>9bHzyhwNG=Jn+PmrFR0zQU>hOU}#rC^sL#z2OtdC(^ z93KE5SmbuGAZXVcka@h4Qd5dpNFyN-M<8r9LbxNp+F%@O&alAYYhg5nns5gUHl}(9 zVe2Nu5Iv&+lk}M!Y&+5{xzjg=z} z4yC~};<2Dw-B?rpgNaCq<#Z9!<3) z^gXKLkZxAxgB^=I^$l+}gII~%JM-E%hbrB9&lSUvh$Fs07w_>zkWI~ue8iT0#1MmH z#02&_Y;C*!5 zaYLk^p#$@bQsgpe{xL`CoRo~6t1yBG$e7S~KLQ4zhV2L@?HPVVQ|*CnEpxiYe$ub8 z7r!dwfesCd%-M%S)qslKq+0uEv$5_q`+AYCepiJCU;D!_42$S6x(8=P;}vRV1**DL zKa4$=9N@p(8wPQ6|I&M$%5h7!jwt!^UD-|<&4x}OKe?Zmm|!Z1ik>Ncd8nu`3$91{ zh8?eLzyzBV0@!2hY(hBo^A0uc8*qvrAgp16LHrqg{n5g7i?ZVXh3T!%jl{f$fgoDr zU!9c4N!&>g9YjJBl}t$Kw}a|zZZ;*sZ8uQ3D1$)CEbuqTSnVR0BhmldbZaqvmE3`l zFmQh)(7v**#t0se-b;GHxuF)uzdACACigHN5+Po!D(fI3$OP}|)hm}O&WkjtIEJ?X zLv`-i*vYL9H^Ak*A~=L+wY1J>#V{_9>4MBhAbb6wY5C@8Pmr{B5%MzirAJ8(NW}ayYI5w zAL!`I!YSy&=}Q)LS<)?fzL7#`!@?q%YzK|)d3}TcYZ5e2ocxX7t!*beJ6oTtFD}>r zeD90-MfJyQ{npBj0T1YFTThNflv<<_*fy_HT71*o#c0w%^@D(AQC=Tb}ato^X=ZmdRK%AvIpt;QVi5 zl`0c#qRi8D4kRLN4UUv)ZszE{XuCo^yCv`{8Xpw96;?Nr`8LBPvv|MlWF->w&2XNY z&Uw31Q%2D&Q^> z8xJcDZ1lb_LVN3zIAR)hUuJwid%$n8mG}J((>)J-qqt{5%qAvNwNxa*(`E{;!*DwL z$+fpG54ckpuGBToQTQ50Q1}Q>zr#mF#9PuIj$7iD=>_@^QOu_o9J_O^Hod^rUFvu5 zsh_Xhy`?Nn?e@x&w#s*`9)kM)Wo5n959hSCdS^-f4!BPXHToA6nZhqGE-l=?xkx|J zzjuDHxb%}B*A{2Zzup!9LJ5Y!;XyWna_nz5=4bU^-&g-tSH$rRtJ8so*xS#~JJ(#n zn>5VL^a)aL@Q_v-x9jFx{Gl2A^Gf5W(@1JV+_~`c8UFc9eQ~AU=)vCqRpd3FwoEth>Z~hN(cy1Fc zzbfs&h&%$YVjH;yXu%{%Vf58ouKjg^3^-H{DBPeZ4NFeQE-Od>EDDQ+&7W;nCMafT z4fv@g0F)2toCl_BD{gwD=d61*0=W%&+A80ZcW)mtaXv+6a?9d+_E5s!xNfUnatuYL zowJpAMGViiANwhKMNvF09ZpuV@F0|Jf@RR}B>XA3Y`NKb>a1B7!N*e}KcuA@KIO)x zWc(-0xP$;+Y=tGzAsV3U8qyAyH>luy}hTiyk#fy66EVW40|FJ~EmBYbi@Ol^QQiMtrPCt6S}2Hd!Vf zWWj@BzQsFN0QLe;{lM*{5hnVWn0sX~8@N5Cw}fZJtieCTiooc!9AN~GNl0O$f9@_&6@{Wk6?AQ_SJUHYGx+t#UI z&wfJJhi<_95|@OIy&UNih0`1)5E0*kr_!Dp(LFX%B+~u@RhVqkAL_|LzrJ|&s(0og zwXwi*$vu&MxOOE(fD8jAENyTz72NUfDHC5p9ovqlZe>Ifs63Dk@6`J{X+dVmK06h5 z;*b>gu4+yt`1>fHUPOt00a_ZxoR1*JnNnddWb7jI z$L@J-z_yqs@`dTza(#UCc4L8U$G_aJH}3M6Zq;-<0G}-;uX+fEB-gzH(sSSOI=uyb zTVqbM-~C8^De`o&sbT6G=|*QiuYFiso@vbATDidEo~^CaE)2Xh1~1kajQm9#gG6-w zQ?u+qVX zH;6{PTHfu$bLHwkC{Oq&`j4M2!QU_5y>+AB2sb#Bv3liLzx~czmF#tt&V8d%yIH@p z)c9c8VZ=QQs!c7sm7630!&MD1*l561GIi_NLXg@ZI9g4#2NK;Ts|hnB0`c5X zp9(G+rN{cXKvk}LFSq!M-Qr`XW{XGjr_Pck1Ui%z+TgGhh!r}=@jF2`0OLW8voP_3 z?G{WYl!BDOj5H{mPcLGtg4w{)(AJDy)%WCy5|TLdt-x5*d2I6>!d`Bs=if}@ ze}S9n@@ubN2@ZgY@hweU=4mIe$YiYVE1rX8Z7msRGjcl#e)LIOz^9u{Gkk91FK_{~ zZ$ijOn!|GaN^Rvv=<7r@oML9)D9#H5?*SaRjJFUJ?T7-ijN?V^4Hd4eJH=(*RbMXr z7rXE$Pu0Q)e;A6OA@iGEu3f8NXH7hVHAD?;6z4jKNQ+v`{XVK0X5ans&-eaq`9^(V z;m`NJs4vgdZq-Q*IsIJ^uVVp^RdV~=+W&D}Gwv9Ww)yz9!9IPtBVO!|m^xKE!aoXp zDmLkR#M{t|&5rPcJZb{Z1taef+n*8(S2L+r6Na#FE9*biBgn(BxpnZ>^}JG<{?# zUzb}=;5}BU=y8o3;)DRbdP4PBUn9xb70^pu2o=693LUMt^&c)rM0<;f*0pXY zP?(0-@=ndDFjP+5fTruhaO(rTR5q0rK<167PAR_YfA+gSzWvT?ufLQ1_@AK55{_Ny znCVyyYb0XN+<6Es4f$sAV9}q|BUIPC!jUa*Ny$szmRy*oiJ-i>37c&{`PL$N*Y1^Z zC(BC4rks+okryDE*kgUz2r9LAFOYaF3b+svST*_`q3(qLgvh6)&?hC-=P!sNt_l;W z>WZn0ClTvtUa)ExR9%JCJlV3)hq z;6^t+r2FlQ+)-JH7R%w_-CzP*1k%J_jO}HuF`89UkhjvovZP1fbi0FcC-2O`JmPr!)@T=vV==oD2J<_o@E5h zI#Tr6d;fIx(tH2(rZM#>{Lj73KQT^s$0@OmoIkSbVwiTxK{O9TR=Q*;>Wn`RN_>r9 zB#Ui#VluO)AdL4;XU*XP=(#v)A@AwtSdE;vIw3#*!L;@#?8&Cx)Vdnb*?};5fFVX$ zZ;<;UtveCfVp}aB;&v<-((dimTMZS@Wv_pvA8}bXYQJ1teE)Xs{d#ux>aEu=>%0zo zk;MT%LBhwWSh8i_ZGUan z2}H=vf?HW(Tcj@Hm7O3ktd!Hb(yLZ)51I0Jl_N~R0*aby6Kz`q0-T*>#1Y%m0SPDf z`w_v+g;l_zzC>_ihPd7_pZ-I(Mq$A=Ms| z?o4k(>eAWbc0*uBOn*&H;u+{=CkAc@^=yif{@h1GiWG=Ssn42*RdY*?`uzKgZ%=D( z$IG4gVt3*xufK7&57F#+YoP|G=u1$(o0H92Td4NntjkEDJl!>5=>;uA^hvh?jV7H& zXEJ>yb5>Bt08TB6RlHSed@#FoXVDR}xPJ9=CHwJ@FD}j2%R<{Y%=>cxJpcarODwr@ zDi$D{KuLmKlc#bshBj473>Ab}zM2dlUlGpLM#diwTK%1I>y{s_Fu7vT4e& zQJ6Ka+>FR2pS&~=FVsAouA;4o@7yF|*{5hIB9aV|1JERmd)-LgAAnmP!%J;`Ex(fe ztaekQ!?nfP?6vuZGDS;`yV)iEV&~LkWM_Z+v)4c%gP&XfJ19$w6{U4k_SJPAr@rgU z@~~sxd#AfREWNK%`$exvu1(>_5=K&{>+-E8hnifE)kfzy&_sW^Twie7{nV6YNqr8d zNT`gQ$Fd3m4>oQn(GBz(S5hBGMp0-DBSaY$462l8<;%LY;+ zH*?JyqMW0GG=!Km?IJG-6u=#m5&T4ejlTX5c`QLk*sE`8;ac2Am)?qKr@UO-FL-UA z8b(MbC@W_PMi;P7q-FvwW@70!OmOj{-_OeJ=(_V zxj=*7-28XyuPqsT{hiy3wL7)D>WA;wKRRhUsFy0DNU_FLNwLP%pi`_dTGc_51~&BR zUX{K=RsX++V%BX#RP08h-+2{DKgU$iF{- zoTbmP-Fu{A?k5+q}?NLl3DgVe_}#-GjR3h{k+z z&RM9=;v8qJ%0fvonHw*CYkld^(lz-XDI=m=_%_gIWZRN;(_OI*5(8UC+=g|nNr4Go z2e*j!d#w1~T&xSQP7p796an*2^8xNtN=9fx(JZ&1sKn;%-Lg0;(ZOVjEx>q`(QDjw zuNiN>73BlE-K_H9iBVGIo@fwF^=tQZ*2gU*-2}Mj9%MvXHqwada=TKCAYHD-gCV{U zo?9i8Mz8b8u`f;+$tE(5KrM6+wjPkFR$)V!;Ku#-%ZiJhe}4YX%ZiKd=_J0axad=S zFnWqAE<`6g$B4>e%~IbP4t0=PX8w2TB(i5l#Xps($pf6Pc|u)lok*$=kw~jg1cZf% zok|QJeXbQ$T#L=&O$E8|dW?FGw98ueEyK5hqFLLiECjrg6=-v7WHn zpf?Wm@mNK0a}|K2O*jg+(Yr^+)~fyl@Y75O^uWsIf_dUyhD8kJ0Jx}}g9yH=6Tz9^ z29h(aZ1MKOLf3gYqkJPGC5VqVV6Q(&9~$d`18kw#0-dTmNra$VAi(J{ADgjLseN6B zf=zMA5kk4HL_gpjG`fT--JoN~{aQWPzh^+C(^ePszvt@ILol*#*aSYog z*dfNs^yVf1lO|zL6dA|&ZnArXE<@7lK~2V&+-AGBGcyz2jY@MyS4Va(eLE~i*5Vtb z9hVM?F0koVNpB)d(jPPqz^GMIx`LpkhtP4E8qgasSC)8{_Lb!kHBYkaL8B=CCJ>Ve zv^4Bv(U&=;cM}wHV`oi}cS(X(c|>d~EU`>UV>vi|NJF5_7WUBEs@OF zDFVk*6k0-!nmV0BSk(2mE>}@65l0+jJobPUB9l@&|+ph6#k(jez>1|(@`Nzr~{Eh3~9pO+132Oj0 zxH>L$u*>~kt}}9qWFls?8&}u9>Gn&8=ZiKurv{Sr1978m%x87D=L<)vCGZ1skvZEI zxP|G@K=PylJuhv~>bVZO)o?|hofX|Se4ye7{v z0dIZ`{iCNGR|{j1l6DQHT*{Dzj?j#8Fa;xf8o^4S*6tZNUi&ZxO%-PDF>5aQ;LoduPevmcb^))WdP7R;&PqK#lqWC*!x;oe1e(%+* zSD*o@Z7h^sY1BVdt5*N@;*EN3CA)f~USIKN#EkAl&Ckej%+JNf((-b4b$+FuU7cyn z-&)Znnx}b|Mvr5bUVHnk?8mj``s`oce2pE)d}*xU^^aVv;51Lt_;F0qd-dt;YJKK* zL(k5&`Z6q~H*e3+)-Pli7v|MmRj;al@UKqCOidieOhNhh>x(l>v$)%qv^hT=^D+5i z=R+ByD{8^a-OZ}JMway&0o~-QwZ-|B`TtRaJ$8A1x>0M~Jsq<&^uEmh#9}lzD%*ws5dQS&;0yNl(v2Zf?w-{Vp(qT)l4Jrk_rgz1{~f2tIPs#Ejk?yc9QOL3^R)%uNqsu4 zUf{G0z1V4abx}(?FDx~1K9=UPXkebbdwXG#|25z9&iSDx>qUnhjoRY->d;=U%`5x! zYWB1Go$U2SP0yN+$#Ev<;jI71cP?kjIH)hGxy-IL>Wh57DRXfX#8Oy4yPL@jBW4JS z&!>JjS{6gPUMWbmnQb%36gQ2Ha+{B8?OYWRFSI3V2{S<~lj?p1bituGZ@Voi#Oz!TgO+p#y~RHPs`75Ykl<37gdI&y35hH> zX%RJ3qYJus0zoF8I;L{U&n+nh3wz?695>l(De-W_4diZD93Gq7?va#g9N|;Edp!UC zk|o^p&(FVP3BP0sp9*r3IxS8SOSrULBvNJ+=frvT+bN2`^2xNs)dBnBUUc{_N9p=P?epldoXd(obxb!~zp*(wJ47ZS>hnS83*$9QF%)#{<+%_xY6o|hi~o0N zF7l3Po45Voj9Zax6x+OCZMqK{ zNleHb(Ybh*$kb;X6B-fE3Yok14Py9H=f0Lf!h&^JEU5b{5k_#5-0V&?zAy6-BLy=I zv?aX8-cka153%XNF^f9C2}=;A$}6|@_uxH>0y&{x6Pbi$Wst}Sktd2rFFbMES0~7f zCHWkhx3m})#FO%YJbR76z8dYf0OmHiJ7aq22PkP}z3C0S2d535K|OiP{vraI@Bq^7 zoFV^p4;Ird&bw`u8W8xo3IXp--6SRFgOm)5Sle-T{!m;iS^MaJd`q^s+PA8hEGE1r zdhL6Z^TA3VX#`+(BPmlNBcL~XzuYzB zm|(#g7voKalMf!+$M6dGpa`^?iL_t*ZFny_hk2u_q+LBr*ku~w2f`-wls}=A-!4gd z9L75dVgeA$t@Tz|&$y73yZzIfyjbXFPudP0aj(a2wkdHu+KHKSe zS;goCdHLr-}$H>wi`5RQC`2ZHey(=(l&+`_FmMhejkD0 zCUMtU;xrBOg6!wf+5R?VSiBS@I1hnFQOi1NAg>w+jC11xwrFBJRDhj9hvwjDPhK91 zMw*du5p-i$1vj`&<7^VHl%ArL(2Lh7EGN>M5n>hS0e)Dn&5l%6+Yv$|;-^V@=0MOB zQQgiXJ2Ar<>1PA7L-2@L#7PZMBp71uY2V$!PH(~!r;K#E84kmzh~W^ewPAfTmP~76 zhGx}nj&;78)DelHEJyQ}M0rkDcoJTW)UiwrI3;Rh7--6+Nj0M)H;z(TQ*yAWjmSE3 z_brH6l2FOL)8i1#;b)AWQg<{mMXk;k@gM}TDh-`C(aJi)OD2@ zw)ZT7gHH~YiKD*J5u{b)%#_U~dX&uw^kzgT_vY~mVvQb6Xvkd&Fak>FQknf=QQ~OT} zBtZ*pir@wyE6y)oEL(0_V&qEiPWS1=oxYqtRjyP)Bq4z$2v+F{fLHL7>@~+_&N1hj zYXP7D8q0;MR4hTbtTorXjPZ?ce4mMIVw@mGs9Vpkk5IP}>Xw$MZaPH(SU{)0s9W5I zOnX?>GDPgM;kMO{bZs01mRJck$kd2!oM&!>)gP~psHemnIyAO4oX!ENhNTw$u3-zH z(w)~#rwF0wu@%g^Y!h11`KGn1Bu)5}tbUr!!g8Z6hH>MABG zeu(|vNu(w21R_%kwxYt702q#u6lOxMR|HW;_#${Pja|{*N?ksx!X5^bO=jUkA_IJ_Fre@J{V@8W~ zf@oS(+LDY9F|LJW6kflyo?;S~Z-`x93&tKk+N>0^kHU)_$K(eOMM|r>Hts#gesqh4 z;7Cu|i;9$tP7HOzvaL{5&hGLy(HkPWI*`700iZp>WQe+{z2gY`kbwYjA+O*Z0#>cm zWNBPw0$A&ZB<&@9F-#q*Dol!wO{WTQ;dkNGHgx+q)miO|MEu3re$bd|7ggFYZL9-M z*wj_Cp#$CD&B$VsG`!+K_eBeIpULw1r2gP4r47=dIQ;FP_4|&$Jp{12zkf`vemF5< z8-Q~fBGGTuBt*KV|DIZCm=}w(C-(3q*xF=_8x8YybYc7}xD~8`GmQrV>;HI4l`mjqOYbeR>L!h&Ij~r@3N^;$IQ`INzf+T**{})ARa79-dM|9 z+m9;Bsi&}xh9rYG$m-{K_1T=I^LV}gs9e~}m&?KJ;wOc*;T^5Sb<`P#@aqvU_+1Zo za}bKuvh0$;s#>F=F~*~^V)`){JF|u^`MLw=z1|ry5aY|GF#moCo>uoCl=8VsIj9t2 znk;Q^Zx+^IAUGghhit86PO>Mg?S7+}y^@ z#9DrJacyyaa&2y5J~zF#o?FjNE-ubZtWD1kVlMt_I?-8z@cWqJQIBi!imMY%1UZc@ z3ZhvOMXD#<9Et;h*Npm86k5`KY~ozLR9lg&X_TW^P*_M$~zQb4T`noib+4Q>YB-ljN*#Ibh7XhBKbtz=N?ZlzKx ztW|>hrQB9|yBHqiI`JR-`O5v3@l0@|7*3Zh@eg;4VaoTpvNgUt9#{%_v4)INW6r~? z^B+~}`o@(~NBk2rkd`BSAU*X^T|wexK7mR{mOs*5A-^7oEU#EPj-PG~m~y1O+ zlk@ZW`RU1tiP^cejm6yh)YSCiWNtpUIzPLSpPHDOS)Z8C4afm)T4|2|DSTQyAJ1D= zLj6(dpvoR{dsu`c`jif3jg~Mhj4O*!|4gK~9boLaL@>UbPWn6|=*D#*`oB$&P*g9u zgX(Iu=M-!-h*lQ8a`mr=x;gz^x4<6>jRn4?Q7k)(Wk<2>Pd1iKk@i|#OPi)C#z&%Y z3_yy~JX>V9oBK%wVqlFh70+c&Y#6@fiQe`-T|K^S-xn1L-l5WMrdN)HZ}2(lcX(qY zXk1_g`iSN;=%fjzi1{^y&a9p#x-^BgsfZUs*OqAcAP)~}i6uh0$HBu?j9#?&-XoaL z)7xuonM~H8eyS#8(O60TDm@P|eBo=J0S@E-?5%ud?Lqc$#@V2PXgkK47tzqjQdo`oZ??M{gFw zbg5iWwVwBaT&0p*d+;!Peb|ENH1{J^NYXS0Mpm^NGTP`r;I$%nW33V)INEVr^&Dr}F| zcc0gHYTB{=pb&TXAFr5!pt~5+sKK=P~-?nhL(;ZkPKCKXNx^k_05xBZ~F<|xc*tk1dsdrBG;n%zyCnN zL(K#F1&)k^5`hXR_*L?}DDfUKq}BXx8n9to!|w`oC9)!?CL|X^iLRZaZXP_@6Sdi8 zIs8@6HH)rH1H!tdLC(+q`9S_WnL-UiomI^%z1+jo$X|m$^<-J(@MGO(O>HFmN_3YR z3N#!I)1SStU~wT;;0((7oRGO%YbZ^}#yG;p4!HK*{SN84iq|diR0Fx;txMg9bF2|R z<1SU*ETBeU7n3=V?TK!O;1^c4F!}fc+_WeFh2H?@=RhJsXNxMxKG3tUSaay~=0DFz z0A0_oj{v$6K$n)FF-0qW!>)nP#SsEIrEx#Q_Ujy1*cT?Ae&T*k1)SLx1? z(xk~2@kX@fbQl|~gmLIfp_0cW`!$64CrQf!85@ZTZ7#%u(1kV^6>x&xm{>QJ^J6V( zAtEH{;agQ94|+(zKSr;!90QrS!gffgeODJ4?dq{ZwC9Yx4} zaO>EeMnlCI5U^Jo-d|Fo)@wM+PTC}ZjV>nk1&rNTxp!;mcmrwfoSaURLLDtzsuaB7 zQhe;;6g_@Kp#tU^SiPD&B*s3}S@6b52&X0MS(yTUyl(?2JZkoms#B>0kd}9h2jOUL zUw&?L^)>`mrICS2@nsBl`w@pg(LC;cUoTs4t!3OOgd6$u$)Of z%i*_;XZRQR+N2|bu}A7E>il`7vVCW3^K*zhtDN%t&UV{qi13ADAn#c2CFY*@?Nu&2 zAP|J~R^e16T*=;mTN}RMGVLoeJqmGzp+gV?TY6p3cP|))u@Cms1EN&N2#)(N>)!gV zwY>4fk)}X16N__bN*_i>*MinxKmy$j3r&XcEC~eIYxpi>0@)Yw8KKL8_KTRjL2946B*8Rc2=++F6vMX2 z-w~moV(`t6&`$~~>U@4;W->QDpUdUe=jInCb8C|uGYhM;xw*Od#p#KS#fi1`jmd$u z@BM08DYX5Qv;Wqk?&{U4%+{ zx|J#Xv+h|EJ1wJ%+5=T=gaS*D+*;Eh)|s(l@^mk2aKYKYrDlVT-c=RsE%x6 z`@J611NbMb#~Y<$xg0LRJEg)Wg{|OTzFd4%TFVD34{{}?Cp32B&b^iKFuPw`Tg$^c z6$h|X+zkJ;w7FS)tUvqqjFUEqxCmXeC1`P_I2Z+G9LMr4al8d!AV}hLY!%JERb?E9 zmzhD>vT3oV948EqSGZtiAj)1R?$=jvb!Y+;w7$bAE=DRifm{~;au;L#Uhp^JFo(Ap z@3+Hyq_(aV)C=Vm_TY4$O{GTCV7= zSmScH`h0OQ25>>#q)=DqWU@TBX(xH3T_e4omQeu5u4?#QtYf=s9EH*@YMI`vitB3> zq~@UYFWC9q0FX>c)a=8q*c&UrC3_-;R7M}|{fyh;@-@CK@=Su_>fh(rD%o;rE!@Di zid%U&2ZGgHIiC$5x_&W2I&+@6{tdnNYO~KbZKIJxyKhz1gWwcE4?6E*U@n`y^4jd7 zghs3INRQD13?Ai^_H%^^UJF>lF?tN01h=PS2Hb8|7jAgSf z{IQ33htFy)-_y7M^MJ0Kp2>q;`2h=Kk*uoeY0w25CMg_QN1(q6cvObC{K1u;!XT!M z?|6Q_{r=Y!jD=&Va@Nnc6?f{+HV7%c7i<;FTZN5{w`ZgP)-=^`2h8+zTl#2Va+_w? z2&GBkIedKL7()!vVK&S#wPw`zBtk|wCw*v~18*Ns+I9KgJ5=>jC1Hapzi z4?BMdCy?rzy1rH}i#cL3uUmpg?wKetCq@K?4iC9VCYM_e-rp>)eadOv`y&oepSQ!5 zRb`#FD1T8zR2D_pLWCg*im{S$Y!;H+q0Ti8;co!UAyuEEss|D)60^~W%Yof(1#1^M z7du$3L{eUNYz1Fa_1o|7T^&{MYRmWqt{TzGZ`9Of&AYmvig9*o(!Z9ObZRBrIG)jKR9m&Kmd*zG|TfBKMkk0&TfZ)&W>Gtgq2d*593ME;TzD zsebzVJfmP>G-cfnHcGjNDvryAxlXxKES0+qVi?BI3pOSLi7fVh_>b1engZT)Op8jZ zq(c9tx`nS=+Et|{=LT@aE8O zuQuAHF2767r)QVy1{d{iDW=|tQ;ccS=mWa14&(^C1@b6j(V?7T)bZ({{bbmtV`skB za8JjD^h`%T8Uh71H94TlW5MZkWZ<5v-gM;a^!Eup*=UQ=B51_)0fVr}^#_%Qo8uAG zxkGtDWxQF;ce8i4^IQ2+mRHekE1^-D*{^F4s!To!{(=>(3Y*epwgX>3tQ{O$66XisK?&V zt#0L3S5@*K-UFPU;lA@|OZmX0ZzE9ui6?Hdb(EjDY1vF%o6R~A0aTo`HXRY8ldP}E zJ0MQyY|wfcy{y1@S>D>SX9SZj^70hU?<8`@5i>(CK=46reLs zlaZzFr*pYyQGfzFdzYe4;ddE3N!bW3JGWGQ*mNVp9?cFiLeGd&YlwTS zVSp7Q2Z8V0-4Jv0|MJoEzr=H%2PPm zA}hFP+eA|iw-42JIhZog z(9wWqT%!_%ikIC=Wn1^mi<8fa8k>v^S?4fC(8dBh-h>$sU9S3=YOn<`ap&$KB0r`Z z_RuCNzWrVVe|k>HuL}SF?HO|Ev*p}IezQJaPYTbrz?&%zjQwNR@CrF+00bbFeR4@8iDDEgjbY(28(WEDDE{hMdrThws^k zw2=8gaf9v`Ag25iS=8d0YwxC3k>6Ev+V0;nX=v+C)~RVn+fjzQvKi3{Tn~$<#h9d+aKKjKzJco-_!E4P}p|`B0>vXRSO-O zcK4W`=WJ{J+~ z#xrsqU3L?kSGDSS4;$A?eoawdl&MSj-@mcovaU-VoK{77wo!jC2qU zKiJS=(z%tk>bi(SYj8Le*wkQ5QymV6Xnqq4cd$kK?73>(N(VL4Xc<~HBU;R2^(DBm zs4+j0Js!-WwpTxvh`NRS-Ht-9vW|LeM&qk07<$Ak#(_!qVNh zt)ZdlEc;|1;Bepm#mb$J?rN7aso4YZew~6a;K4?qp1N~9 zw$PyHweEZrcxIySSrmrk5Y@UQln{0WTz|c?vOIK9WV$J_vngU|TSkDQW}umvVOm3k zE}<=z@y&Ut!#Kp(NH>Ku|4gQ8V0AX32tRK)DP3FbX`1P1-K1~bq=!o01;>u)^|54yjrtUm{zKKqM?^I3SYIw~GOhe66jiK$7ZQ8qy2POO?%XWMA6Zqlu|Lf^%(ISf}8ox!e{x?=fOw$%Hv|`)A4a> z=p+Utpq_ZEEr1%CjIt~7_jV~AwxwVs^Tv0`N2`54)=xqcL>E7RG_*(tKDKgiSyAl% zk?-6T2wlyEOpLIDd+B~(Ar!NZ0y)S?3L(NGhu$!9us4yOXcc>+IoaV3jA(s1aur8IL04pKxS6pQ6aPYxcDjw6^!0 zJ#+X+T6Fu5Zrilewh!N%!uSThV4N#l<&IHRuB=KC> zNk%B+$B-Wtra?y|xFJfGGJ+!+Z@cmtK#q05VLn<}y1SeSZiRd6gG{jUpt$zw zV7gkQ?xAylNq4<}K1F?78P=(kkfAC%(TfT4 zVa)1b)RsS^jibLCM{20l{*#m{)!2Nd2zTsZXgU;{0UyIUm}7!$>(+1Kz>xjo<}y3uDxbtu7`)FS~?8)3*qd z%L6k><$-Bo)U7~lCBCPgYIY!Y+^xTuU$`>l{ttRq#k3{+ZT!@lYg`j8Gw*f0;;lyy z@ehT~&o(vqO9L7Hoj&+{TcIFZp9Up(fTiX2$*I}@;qH|s z`$_SK{zq3k=Sseky@4%2zxmD2i{(l-2>)@T@Y`TLU&$3V%kDtviyE$Bnd|Sc-1&HE zqSq z(nhiLFdf4)Ju!&6bo0)K!Hv!0>S`YBhA%yTJYmALD+?|EEs?J}BNzss&17@ig=`o< zFxy914s{z*O!jcP|7s>!y1NXdn{OjO=smFgVUXb55+y|u)9YCmEXqy~Brf_V^OF&L z>dFG8zqI!iPll^IE%rqQ@K@xz4F);5IY;`fBUga*JI!ajLHq%`M&FZB%HTvJt&;42kQ|VA|~17o?i{GQqDu)P<;@sqy~1+v6aWK^3tR zG?1-A_jD(sNV32PfSQbVoREfFg!cu!`&e$2U1M~NG2~Ok6312OAa`$iqrg}p?vfxb zo$+&MU~AZg=H3IE8Bv-Xs}FfB)iUx4Msx-a#SBv)NHAtN%QMG89yahk%~EA* z5vPXb<)oV}VJ1N$*=VgS5>AiJhTyoz$#LPDkN3r~U6p-#Y35RtGo?X^s*dN>oxPG_ z+x39S|J;Rh>hu_h*h}>D$Bz=RKGk<(KRv5pQoi&C?ni%ahaL(U$hDs(igPCm+O*O5 zXkUnkoWi0%hGL+}+SP9N6xz?4l(NJ2=dgtE3X~+tQ|LN#wHLg?p(vOLFXO~IGFR>N z`CpLu=w+U%&0>N_YQYqN6Einxdkr+d>J{8FJ+P`tUTYcYCti)!L5_Nb0W^W05L@H-a#n%6ZuBb@>_wu>T?DE}A_{Uqt(&Jod zJ-?p)8}-*;hL1SAd~>vZ`@4QqLsE1}+^XeJ22UO(YZo{^fW_AA(2o+g)Jb>|Sdj|e zA9Ioptv-#BnBpEl--oT!6VCH-&DM+AZ)_!PTq{u-n)Bgn4oNfdPA!J?5bwC76=u{c zwLB6-rHFr#u+dRR*BeOKzogbFe5YWdtGbxT4x+_1lpcj&ZFro4bgk%16U-W!<6{E1 zC>oUKVg$K>>x<8$%%7XJY8z8oSAnd3kj1K< zf=X0gqxR73gGyyP8+{}Ls%}iF;<$5FLG-F{=Z{|1mDM-cfm0SY$i+KcKB{@~0BPh> zpBp75s;*y_rfEC33AtS~YO2TG{ACm+(Zs#Vj#WYV;iFGJ*$kgsCVZ*9UEC_?gYx!f zp;Cd@(9kLXgB6EOr8{~CWzz}c@c9pKO=D40Cht;I1K(-A}^ixa}kKu81Ru^+~ zS5e^oE0mKwZK2Ar7@tZ@`rbw~c3T%#8ss@+HHz+VYe(dD9R8!0$Of zSq+KcBr@D--wzl|qPAAK$EvcHe4#S4y2eqptLN88)vi&sD=iW4REnxyhYGL=NcHdn zkq36S@VBKoHKABAg#u3-PC=b!07#mk){Oh9R`2ruZ0ls)wLL-vTnL(ei9XnNbRBmd zbffZYIa^mVNrWu6B{Sk)@XOr>3ji2Lq5~j~seigYdF{6m16YvKvde>>N+a}?ZRAVY z54P5d>kwWf)FW@_w?3&nFmV)g6e{k27Y*zS>NLPy*_*@)nXrdcpP_ayJ#C>3%0QKR9Gk$mY$Z`%78KuxhOnfb+bB zl@VZe`5iMgrA3Yndx$^BJ(Dv&tKc3m!Xa4)T^z!6uj)TEds-Tl(ywqz&$mQvP{A^1_M=79-$j#} znu~wYbg?8HW`fOf0d*cU+p4OPzX+vTF}nUt;jJT>E&Ue`gwz+GHdSf`=T-q(jx-iW zDn<%!+zZC6$B{f(Mtk>ibfy?(N%^*ma%gI%=gsSPC>u#ds#PT}vzx(F#n?xRa>DtW5G;g2<^~jAH3gCH zavPQpxo>%WfyX4YAKpBgb$VDh;~7~V_=+$KJ8QmR7uIkJYE0a5WRXm}a9*WvJ4`O` z%_f%j=B)DGbQWq_|7&wVg}P~OBD|`S8~t2hSqIgbz@e((FKMy0YFuSja#IS9+tKA< ziV&cF&LsIa#44;KCDrs=qQ9G5!a&r*D&I?_vO8^et~M$x>DTR-xYgmLJ`86t%NC+f zu2qwH)qc)(7zi~$>di7q&%%ZHTR>DpCq|xLs4gToEc=f0 zSXGVmP3PovVJ$2c6+zXQI0su5l1=VPa;R0Nl}i-z3{LHJ~6?D=QM>qG$y4qF@tr$DXsUh zk5^X4hb>4uK&cALGA z)yX0Wyn#Ps7YP(#+n|1 zLLVQy729F%Pu82ZK&LQaGYl%zfkQGNSS*2pYO*Y)FV5FO6`pcPSIUf|Wz*kflNz2> z7c;U;ZBG$$)HSlDj}>M}0d-0^D7MI`oVgV`lf(65T6YP!hN5Uhi4<@MDKw+t3Xpfn zitBvgoPIUdZZT-VisBsTJ4xTFNQTnplc2O2p~!3*Qw&Ccd1Oq1FHTNO>T!E_5%hrw z>fifd<-W0BxFX^F%MD865SeF2R56CX;_5aNg^EM17X= zCw|PeV(F8F$I;t$Cyrvh&jT{kXW{;(?c(NU@zP__8R-3y*7nTgAl7zx)|sV!KVJqm z{m&j1*7NV_RX{Hf-)i>`)6`WD6aQ6*4c*xFc#h{8SJPYmTcRe$tknCS&B`K282@Ck zArv}D!$7Uu)4V5Bh}j_AUG-@-*RVZT-g+%WW=@T8$i% z>E!$glU3kezHU`xjUGJpF<+XTvF_e3c8LzC=a5!BF{2hMp6*+ziS*VPNpGE1%KTpU zK&8_k4u@RHwac&Mo=V)aN}B%<{)@txNnTW!EB(r}Ya-gv(P@B+v-bVDt_)Ep!zU!m zd@9xFN@Bm$}k}2l=O7uxAzF(A$i+6@8F;jrUC^RZv*LzQzsIVpVPMA?2P~+j%%RnIERPv(7!V# zWod9k6lmgIiY-Hdraq5&lz?eO2Ly6vBC4bMx`m`Jk*U0rx+mVwHaZ5qZMzWHDSd2X z%dC65!fQK+LeIYbM4jn9$8bqZl!9g~9jgpo3H%+w-I+w50c2g`YMeBu?o;IOoeYDCH2+g9!X|RcOe?mE7oBBkUp;8|TH5nAbFbm6 zaW^m^Jl4^ip|8s?=PpW*gd-fH;n%Z0cT7GM&lIgC*m8NRq`i^)lr~23RHipfohtx{<@SMv1COMNYMdTwEb4Ve6~z0 z;T7aja)Fo(mAK*YtD@E+A_@@=5o6Sc};dTe%_Bf#itH0=@j z!yynd_V7DYsQv_I735#sS)dXIOacDq^4;--b!3qYWuu-9*HJ$ob@%>@vk3GEm zVeXT{TCnQYH4F_9n&}Mr`JR!^)si)+8l1jY5rI60|#&^1Q>Y%K4jTTCquw1fTG)AinTV25KWc3D4lI(%_Z zn#r=WsS*{8K(t4O+3EnDxYJ6NpEK^JavD$xTQ2?!0VSUc22(0Sra5xn1~eelytEEEd-XmTabPNvi+E*9nuG zKo+bz;dEAq12iYCI^lrofzv_jzwBSNVjj=^52o&SS%#S?iYM_54J@JcQ4X98L<>Pj zYK$3g>6;i4ocXi?!7q!Kk#?^Xu0i zk4k%^(q1|uv^2>#$^?h@Jhd@vvVw7|aY^s+t~cI&lXv4oD$`Z%LZI5;h2Iuj(g6w3 z?IR|Q2s0Avv667AJKE}Ok1mcH(T>hsFQHJ)Bz*-u97~p!JRV4z8w#43dBr&{j#I!WP&Ud()j5-F>be;)1E0MHdZ1Fu~F5PTQ5oLSonzgI|ei zU{#l4#mGTI87cYOQLD58umWE>x};a_h{@9ffZ#+Fvk-_xl><$~{I8NOo^~gI-kHDZ zeGHwW0ecLGcso~l5L8OJ&+?^mZd2KWEN6myx0cnHtgPI-HCovHUDzor`b52f-8M8* z`7wt`%}ep6Z6aDxsf{}(h(ZE_Hjz5nDjv&2HI8B2fKIk1f+eqjv#blg`#?!NY#9|} zwLi7VL3$`qjo%fvgYsr!djx58327`OLK=$}q%o6)O}WZ!*Q)KNQ`azQp7(#x}2tnLA0;S?x|>EfVA(<_eqR8G_5)%tf>7ze4#6 z{V(3+h`inBrsn2s`%D$D7*-CFbRhdz>qQ9~q&zKUAF6G*B(}>m9=QWg?EZ+j0 zjY^{har?pRScP8T%%9SPwbn!x^)|o@ZU@vYnkrq7SYi@L(B7e@Lzw;HvfE>xH@id< zo730uTk|sW(>KqPli$UpeqofXYy`z(-$ie|S8;TQaJ zd$X8ZzbZ+`J`PErweUXpZSLWA`03(C@Tjb`+?atFY!pjDuC!XHlyardgAFxkrEp=S zWSIJ_h4;a4w>NWJ=oehv@Bxnf_!Td(+K(^(Vdq~5_0=Cj*VFrPT~GbF`ah*^#5YRC zhr!2%PYc`m^+K+TMdLZ(W)ox)XA@-+7scWC*<3a%8?7y@4!S)JdlE&Q3tGRA|4Hw0 z<3Gf^mPDK#$f-UQl86Z->G4JT5=FngEf_>^!{qD&$Q64O)xJjgK&^Gx64v0{Gp#8X zb`v%J5)8`;yJ)i8S)`Zq&=In+`Z^WneIQ)fTxMN{?@Ij=))KTZ$0=VnX2mt%<$6$c zA&8FPPgUf-O$Z#lgNT3+npL0l$s)~jkj>Ba_Z)Ne4TF!CmBRJiU}0h+I~PgZ2BM=J zk%d7s(zZ0+Lva`>7*jQ`Ys}-68b)h|Z6Kk&h#y81C0EEloLEQ!ev$H1GtC*A#)`hG z`}7q!yKB}jNHjv#x&Hsw@9ENa6h#42L)OPKZh|^*DEmOU$gq zDe+%y64)S8R-D&HRDjfW<3mSud_1;`pFPXo560ep-}*NIN6}5^Shskg&ZgSjzM$QK z(wJl44j7Iz^zHtK$KfRY&_iBM_=sL}(~O>5@Xy$H(0F^M@U1GKM7UVOJH!KsKvE^MP8E7sg4YXMDJd|1Xa9*R51G8jr(u|0^AnYgc|{nRlLIMpW` z9aRQAdB)$3cj6N>BYa81Cm?UT9}fIW6=-|OQa*3Gv4FjAD~2^r{mD$h0_}1kkJ0gu&UNVSsTzg#&RP zZeye`)%P7JJwzVFwPS2KlpcpAu0bfY&T!9FGGJw220K7L5N{f__Se#0*xj>4Ec^od z?0D@F^6)Ljw9vE%)L|9jDgFUPxJDpZs&7)#*+i$FD!h(s>m(i{!!J2TV2y6W2LWM@ z)#gp4{1Qn40!O?0dTl^WieI{ys%c$q zOAC(isKAwoAq@}e^sUnCNqnf;L?49NMGIe=%EoEjXYHVCKw#2T(0b|reJAL|BK3i%P(MH!rDqI^c>~fqoq-NNIQ(4-#m}MrU$^bUB87P3 zRMbq5p@4BjZ)!hBCcWY1p5uF?VzqUw7&E&aXTyQ+)(_~ohwuZgupSONZn|0ZeyOM9JYr zaC_2U2Y^&jkBm69^Z|Mfg<4T3BIvdKEWF4+Q9mP9jCSoh$L*<%SFA6glb*}3&XmI> zGWo+^-v-vR z^Zg}by#4P0yvU-t>ZN%X-plT@H98U=T6X2W3diE5?_*RD==t?gL10u6NJ|EvDjysB zbZ$rFa^%r!RhFxi$p<wf zyqr`XQx+qTuZw7q`V+*X4_gJ2V;(#`F)v-S%>Qcj`@2?`!2pF|(a ze9ODp7?>#B|> zet#$ad|D=cd&i!Pzz!hl9@6&4!U zFQ04vU5Bq3P1OEQ)P=N6)NaCk+p+49NLm4OLL7rIwo@%@K)nwFmDZWHPbP`OLEoVc zt6sIyk`?_)kT*&+6qX3J5}rU7%W2jliB6XGMiafy6MZo)6J637F$#&e&UrRsmp)TB z`C}8~d<&bNn;H7pH{Ha=scVxHX_;~M*2+H4FFDy1o$69#N;OTBcG{`#MScbS@-=Lj z#ySUX)hPWhxy>B0I-fH;Xoqb$45YvF5iQT%G}O*MF(HLL*+4s#J$sSR(YomKx=2qw zFt&d@fnMvi#q5!}??nkMmO7HvV0kg1qPg>$+KxQ+YpvsJ<2`z_McvQNAcz5W@;>nP zk6CTNpru0`rl)?==r zaRVZUPb)6)E9y9p?bY}4*E@68h*Boaw-{D@p&5FrnQOhHO zE{?Ras8nVco0Uw?*;nr^*|xmpXNVjv!d{d;h`9o_o+wdt-b%Zad%D)Jjun;@O$&i zHxmbox4*XAMA%7$bG}(4DcgbbI=5^*Qrgm4m3;>WsdbZYt88eHFat zzv{9cWm&8tZP~4Jc`OXF;KWl;Ae_H&4mRo3i)f6P5UM&kmq!qc@Cd9zog@bqV?wS_$iOdEg^d5_Au z4ZeO5Ib_RBu^BpTOl_~^66_nG^-rV;>ki+Yn?BcPh36J)wF{qjm5R9!W+1|bJ@o|z zW8Dl-pVgjorL_lz&+_ZRT5W(BxkU1Z$RdM3zCa`*+ zCvzGaEiyr2Yi;w93d-N>_ge0==JwnF4rYAJ@$T=n-#0itfE)DqK>v6*I5U6-Cl8sr zhuPZqMLIXz_j~lpjf`5KMy*ey)~8YHlV^V)R@AmF1%QQ62oxVke#|cbrd@=CwNidP z9K%9xGbmRcZEPq@kuk_Ac2TnofsdZW!IV#Ouv&Ul$!9l;rL}zcrAbm@nv^8=usHik~6$*6f+rC~T6t&M#@WP{U z@(%J8`b!a1dqt`lU$UU4S7-$^=MbrPL3u(u&;8OB26wCxtq*xo4s1`<6>x%}&H%C} zC#0a^u?qo(9grna_3sXTB+&|_RNllRFyg;Lf+|8rvV)v5sM_Fr!?8FZS&W)P*cP_c2eCW;6 zlPq70l!Qo_uY=Slv}ze?c;ds?Na?QG;!cn^7|&Yje74|lG+eiI`RY#9Y&7%xJM+`i zTNo=Jfd8!R6IEgh8a$3^8e6$L!SG%fh z+do{7GoB8=SH$J&j>gG;2@9*wur7V7rlv>n-A*d)dlhNU0E<9$zrt8Zm=JW5S$2F5 z!d3DL`pTh)%InSt&na4aL)Ion=K&H2b*Z}`>{DZ46T>aB@*+}c zK&WDilZKq{P3YM9t4X@Zpb8pvG$+;8kFc{GVK3PJLb+$4O-cKJd0RfZdADA!!U(ZcV=jNxTC-ZabtCQ<9a~qTMvs04` zxyb=BzGs5g|8Ci4oG03hGx-UEF1CvR4g&@JKg~sTbWoIj8qq{XDuN@Nh%zn>6<47$ zxPrz`skSgyE^btUO7YYDRv9f!UEtIGz=K?A{c*08=MTY%E0~smOGxZ2VR66bb41b| z-s&@FO}1X`9caxyCjT(f=6cdowm%)tKkJ72K%g6b zf#t-(hf}!EV=~wOF#*0(w6rx6ogOi-M$D^$X9FYV)fMG|GwESoK{@;@qe|z>Of#53 zelGzs5j;hprka_#(FDP9<^Y(C+V9lTfFu$x1D}m4GO5i`6XK{+nEcBQk!8)d+wPF!b+px{< zbdw`yQbY?nl;I43UWh9r{~b%86dm|@h#%fs3Pj5@TI52owXd7MWqUsrhln;nSk+ho z`1F;}gY8nWsQC2b)Y(Y7hOhC;bW6M_F6f#U$1?QQ2yS_>^3hc9?^I6@4~UHRNH|>f zMX;%{DVe-*Bk!*hpxQ*(TkY!_9F`omHwae)K&)o;u178bWdV>lUxmb?5ee)G2o~}i zrtI?uS++#G(-c5QQ9&<6qy<$C?hV7l}2JtmB@qo#Aj6>8S^A_0}Yi<1E5@k-~~H*tZ;w~grapz}6 z6?b)NZEj<6YJPq)pPR_d&acm`O-!tBOm3{rPt46v&a5p?FD&NP2UNwK?Mk=nvT?W< ztsg|;7N)XO?XsQTAm#+jeuH2z;@tW`fW(%s>ji~Os(-> zES86R`om2`+ITi&@E@1g`NheJ$r-+0{i*mR+}&NNdd;Kl ztPSQ3`$f0D6=9E7aYJe*&NQ|Vw_xS5`*-f&9Uu0ayYr}$EpB90!AlvlLx_gKT$A91 z+PEj-zpCxRJ7G{B-il(?4q`#{dSg6in4TP}u#YM7^pJB%{4bz&V805GtF(IG{U!E= zhZQ(>zm(f5hXYnnG=|@Ul9% zRa2H)&T4dwZZhsZ%83f=PS~$V`K9Q90sd1$qbH1Zq%Y;}GOyrFl!WynV_CC=xA4oA z_e~>aH4}Vv>xO<>G1tW{=VH~xw1J*dP4bjv(siyPWCo9AL7Pn@)nDGgqX6l=tB6M~ zc}~PA-{!o^tDtcZ>a(t5df)J50COf5E!hcT?o+znaJnN3w}qFiVVH>5@CWQ7QH1GhUvG2LtaEt}mqQ&t zk1!mflTp;QOKLxKQ-%|LkC9zaxig)WEO7^yeL3cTFm_|*?!AwGHqJw%0CN;aP-FL6 z(i>`qyv$t;z9PYBP4#t6rG}O1T~o$KJT@New5s5^1vKA2P^Kng4~a3Khfl@>=|@jo zP#Ote`T`{ouuR_l89wJ-ZuIG)-;Xv;ZxT)SP{kk6{bPfs;b_o;A?V%7NT0T8SA7||2#dx0iDtS zIUddU{?7RHFe=Z;pX|gg{U$S{ERhZ15~xU|v&6-?B{`^T{y<}7U*1UD0Gv`vn!-4r z!lkJLV%X+wx|zVUDUvfwQdjYHFC_;rwpO1B{Vn*4I!q5KWM|HhvvMHwJw)=#SC}jl zz7Zx8ib$bCa+^q@f)zp1ZPnhM@l^MJz{|WCErq@=h17_kIpGC2Oo98eVPRYl`l18v zI~Q|N9a!w^lZVVl9|x4GBYs-|yZ ztN+BZ(G}nPy8JhrjlL+@=u^4;Vs2t8zc4YC%gs-%O;1kGu1@DC)~BXsCRe9(Q#1Lg z#r({G*ywXX>sx;u+}rl*8Lp&@y*%&y&qi?AhYWSH8TRti)P8KXU7qQ+P7zZ09+fNr z=qY1(lK)ePb~I*c_+ln@Vf8u>NWlhg*KqW#f>R8LuVF6nrwC!~f*jo&c5|76v9=$T zA7tZXthHyVI+qQ3&v!%N@BTaFMopi1t)Z$K--13+Rj-0!_9x(%xlbWJozx8r9Tt$0 zO+`2cWK*BR=%3Qyp7Z=x4AHM>s||j2XZdbM2x(|b2tF3VNAdfF1tF%_-Ie64^=U=4L27%FppCVNC@m@g4m)6<!UEF3VR+PnkoV=_tuhvc$2wH)_gOp$nKY9dD{!K<_H+n*$pIjt`2Mr>A z!^-l9S=cXjs4#P(fiOo1m>*3#dP$LHZXe_N-C05g6Jpu{9s>%VFv9ra#WgaO=t@$@_=X@xMS4hIzqm3)|AluU2q3<=#AfoNL$lrqwKsi;~nh zliJ*%*SQ{k{+y0$QPIWS8;^T+{Ax7Nb&6=azG^3q^V1X$#qDYDISb)UxQV<}xhRT? z?$T9NSy+^f-@RdZzfaVEH+>0ML&L^FD1X=B3GRtR2)9j4Evm@crl+B6&}T^x;n0#w zQA4W!azxWhI=ZWW==ZMFXG&wd;8uJf_YMc1SUk8)E&va&N{YQ`34*%Q*Bo98=~>7; z!E(o}X_|6)-2hgy2U-}QJMNeeQ@W9>|6WBC25wqMKm#Skrm1QKN3_nL z0IhQ_J+#hVQEq8-=nIpuArCEX=BhciFU2l z6{!qf2W{QL^KRLQ(HuIw+p?|j1kW55cpe+jMue+cWkV}}>+chtix`YTiyu{_&QZk1 z2&uiIyRG>U8V3aMkQX@}i#?HENdF7b-pg@XUAusG5g<+{FrC~EA_*{p`Yl7%iXvE}zs;UX#FL=dg!8 z*fc5Ev<`)_F8!Jp6x8CXi2X>Z99>>GW|fIxY_;^Lk`FeDrM3LHRS}S4JjTE>0-X|c z%mDEod8zU`RTmqKm2%;4Y!)6CDoT=3*92aBniV_VFi=9ziKPX}? zCrPp!gB4>Ud8@w1p)su9EzrIR9_A`*4`BTc*)n?98vSBYjecQL)ad8u zXVxbtX6NT}Gt;v(>l5?qx!mGnesMDV>q0I+Ik7l9zp*|wpc?&r(E6846>5f|Uf=gC zx6Qv^0JIp%s7R<}r@bdi7s4R|KVA=RE#JJ8>0+C3F=Kz4_Khj#)fC4Ok6it0Qcx0? zA+UE~nI>1_;;QV>wt|P~MVOtwp!~FH7{hQTW7+YkS?EbZ-U-!W!V!?XELjqcL@i5N zO71;^4|D^Hlr*+g+=AExBAiR!e=AOL2|l9sSoj77{_5=+;`^Sy4GOK#s8NUS&xpkM zf;4affu`jO|z9m%qR4olhKK;TMBjq(xTVZ?vAn%OZ( zT`I`lTIWC$+V6A0a$ztUPV;><8yrc;jB1Sk_o&7=sxb~1N;03G8Y5AHWDtTxFDC|R zv00wxRPfUZ|BDV<9fLavd0dfC_Hs|A$5PC~BH5O%b`!<$}DFH6d&djdOFD%Tg&rhwcuT8CQOwP}( zFXrcF7bfQxXJ$9nW>!}>rq>1pE-rNF4(Ozd!e@Y58ONFhOi8-Cjh_T#%j;c;>GunK z{LZ~N1OXE-PD1h;BgZDYSi+#n&%Qutf+2ihTM#kX`+LAe{tw3@Ev^U1+fjY47ZuZE z+Kyue5{{!kZ|v73UkE>pDS9{(K3uhhjFoq`9h{&A)g-A@3B>4}Z zS>03WfNx`yJDL6vXzEowH}OjYZnaV0&D~-eH`~J-K7-@=lzbJ)z8Yr87sOzD z3X~f_V)m=Nk!M(m|dAiQrTc2rvSu8CgVwAPq}%T9Fc4nR{z zMhqXZ#Zxl!wx&LpJ&-g=TbVyk8_Si$fl$sU<#FH~vNg+z-9-Zfq^8m{-A>`Nx)Mi> z!E*`1KF82f{VqqKHM2z9Onp=fbA+UgkhBq!_ESaD7Se;H87pDha$);C#qG=v)^*^6 zz1wa$WpCRQa#eHv?FTTwTW-^#xJPBPRbHUCU9Up`>`n z6KMF~2n-|qMN08Nnn?ZPut6BujByp6dZ5B4-p~nFTAQD>2T)RgNbK zg#Et2t9<~ph(xirXsUh~{Nm&Ly2WPc!`tHqz&q9upDQAyrF|l{Rkp|3IWaMeZlUd* z<-ZSP&74B0d2W7mv~v2pa#BNtSJN^ZJ5{Kt^9l=6EonH`PVgKEPyj(tz8K!Aw}?6q zS-vB?*|BV7__&Z7@6rOQgQ#ImT=`fjzrC6JJjhilxwTKrLr0uV`}9r^|6Ge*MBDOQ z*nlNIBsO+p1Ys16qQJb<1Tc>QY{NopYB0NIvTKz-e?gQX1io!Zf_P>a-(haQFSCh^ z=q)iMw60l zabes5@aeg1hqX!<2){gMbWIMRci@d6QImy?_n6zPq=Xy#VcPb*Fk2Nge(uZyn#Tcr zR*m9U6u7g`ebg`XYy4CKu%-pb4TSD7qd=;%0xvtT%6$lsZmf>Q{vJPTj%a&nUs(<0iYKec)P4F=; zwkKHp_yVx*hA4it8rMV_tIy`{vwROdS&4hOo_#h#v<1F`Y;d#iNuiS4G}XSJJu0l{ z!!OL2-7yg?%3&IzKHDfd5@_KNDf4kPIBV!Wu5{jS7dG;1pRa{K@?mZ(_euU?`0pth zuGxW3s9Q^amy&Vlv$o-#kC(zx_&C2BtmM}omDEbQpD(N4LR?Yr>A!9iOU{%^$%yq? zy$?t1ZmwK@Tr8~zE0tn+0OW%k5AwN6u<{_EPs@txGp`-T#j;vOY8U<`{7J93zk8%sSaGYIzQJ1Tb4$mK<&`DacXEm<>Fh9l{2i}+WFE2le3Y;7=);dwq6HznQP(3Y+C{)&=1q2i?5E(&lDCO~o!o#FOSM zx@nI5x9NlwXli24q(Gm|D@}n&n;Q6W0S6cuR;_xs$l7g;Qr*5rGNh#X;P0qVU|}Fql{qB8$hZIi_}G3 zh;N5lNH)pNt1zEjKlQgaBcUtm1#t|F#99|vmsS{VVjUX@q$qfXHCfUMXB0e&sQmo? z{ku?BRv#7DL8T?nxL6uYvAQrGCahMPLYk|7EJQ~%T-OGexB_s40`!R7A%b*@&7`CV zRdxIoYbvvkFv2{m(8 zTLfF*&Vj7c*VHaVhBo+7WkC6qF=iOKCXCK^(Px@*2@-WG?R@S29L`VCx9n+x74rb# zP$Yojmo<35Q03SQK=G=&M%nOE(prr^12l7&Iz5x&FFBc=77k;03a`C}@k`>C8)51g zo;Yy}35P!bL2=rVL7171A?xN9_P2J{ZoAl~qIR}Jxivx%|V!nhZ$ zLpi(wGa0EPP=91GI(#Hbnu7rRbD(mA3SE2eTB~+V@5?AGY2)hg62=Jy8EY@p+srA_ zG<&7czRQ719CsnLE*GNEwm6YO527=kg!jTN*B4p8L;v{VK!LtX0-?#bl_9?wDAB+^ z*&q(>4xCFa@9CvJc8x&*xm@mpBIBXW!B3Km>2c0nhIajDG8opOqZZ8SP?hA>!4DVo3b3_Z3*ElNCp{wfYh#jim zM?PD#1Xkll#+TV9+LbL@neDa7Y@`xQl+LWWDNp9xesSr{x2JB#@Y+;Qg7?~V1v+wV z-DSpuI0FBKoQ4{*mncpPgMli9-%V`vp(ZAf#3di5BcUz}jJ_CW5EXuhD~JT5sHqr8 z9ptp4_Ax_QVDpu4jJHo6`vP^V1qN>kJOESk}n z^dLsNsvZy@$GJjq#QG~97Pdf`@cw}K7TTDpS<_0%y3hVkeFsup=HbnNugcWS>Aj<_ zJ5ng}HMn!=3#p_>W|D)<6NpR{KESF|H8W8>utB+!tK>HxZI0_a6(I)vhs}JstorTc z47FAFbR(LOzEj~2Bq|7B#m?WTHYa8<4ag#Q$%b~v&N-tgDRzDV*EarH$E*ii*3-9O zG0!&#V+=$DskDP6;H0!SobW>N+pEFY%F3N_>Cr@aN{krUsPU@j*RMYwHD0|V-E!1; zbtOdGFqleD;}t+MC#?o~zj@ITM8;Kc1$*`x$fXhh+5qf#*QOI%ewP8@ly6`^v=NjJ zM+!hW3F3VM3UjL)j8n2-iTb0Fj-{CGH6U?P9@0ig=%iKm3rFJLaqx!;v;c?95Z7L-dv@*`}GjZn@^2Ar!8DZ?s_g zyI@k&422nkGpjOE$;0TmSotT^mEGc*tUt%d#}KO2fNB54D`C_kUUO{6NwmmIIYh@} zQKc>oTGx=OL@-uLS5D#Z+@Yk!@T#%E0kA|;k>e!ebb7>yqSq~JF;FztZ7~c@^m-Vk zZ!KScoX`ZY$OI2RPB?Gjgi~46WubX@ko9N0?QgR3VGRfvoKkgqaWOIJHzxG@Vy+Ac z>`@=u16yG*8M!GIf`3DeKeT(a9Ai8S1#LA=pO{6X80Gstzdp+MNBMqQLZzwn7@}6nfZB`Gm)qifNdh6u0}vWp&uT@|S$= zvTeq^S9el2k%tg{r?4ebzic^LO4ASuogu~4(!d$w9J%PeB_}MMnwIV^L#!seJ6f)# z(r7L8cP*qQd+jh;wJem8@Q5%Mv7~F|yDV?rL4~-3@VqZD2H3?c7#76^T^u#X4-vDm zOswEEK^rKgayWKld>W9;#0MH?^}5md})LM|*YzeVnS zr!8TmO)7>I#Mf;GC5tm%^9)NbEd(7!PHb`$v33&ZO(V>t=hsJ=$p|w^OQwo;QJ5b*mKaMCny< zkzFfpRdR)`{JMXK5;V^GqQw9K&Oi0Q6s&ZGxvp{geOV(KKzI1N$*63sGJ7mKNKGS{nWh5K&0 zaZc0xSZh!C_~}1dj4bhiFwtCq`1o_eK>Kr*Ez%7e5vgiXT%G6IStKHf!8ITh*+J z<+6zaq9?L2QX5!lWEM&zd|lYjo_t-7u<4Z*PC$D|F+?rL?1&L|oCUU3zhnBKTnDhV zn`(yI)?K2Yv9jw(trd_b9SSvj=<1dt>{X!K-(hwE!iErC@x!IQYM+WhLKVgU(LnXB zYqLRJkHJ!c`u<~s{p(cNk#|C8G0ejOIMF^^rhA+OkG-;P@x|V^XCu6Mgg1}y=ASCw zJewxG*^{u^bQbnGq&jM^_1+6A=^saubwqx@3V-F$SJ5LjFkIg&O+fa@dpONgBGNnr zkobVb<*P{)oEN^FKmRaS*vtgf9L68sTGCPIvA}s-;5X}G zFV)GCuFV#O)fD;;4)>Bw5$Nj8Yrcu{a3E&lC1PssAfKZVvL4r~O5?-tIS5EPQ3~}a z=}`%zwfDz+&gMqby1&ypO{lFt2t?<$I0~@)uWfa!qQb>%-ani4Embl+?)v!ZVFirg zq(6m_{scpRmTs#VH(5+UB&b{+7n^>9yQtIbK5Q!@VMcWULIBK=073|Z*$`<%KqWf<|pdVYPBuaENev_w&J>B-mIv35W#VVl%bfT9Jjm9tiG z?=Eilcav3ZTORFCVoXac`b8wrQs0o6Z%ci0Bdd7?pWO2{?m*$u6&S@AwVwzoqRAV@ z8l|F~o1TE5l+@pFFRj$%-4T5~yVu=LD&WmvW`)I>j@3wzP0^)GPmg9h&KQtVTTZ6K!aeh8G~ zyqVMP&AWK14Y9*v8PiQqU9ZIOsU!8oJ0Bx-9jkWo%sk`+3dCf0K9MeI&A~j}g|0{i zOasxSYhSS+dno@R*OIH_M737dZ1S&C)my&T(vEbyikE{6Ekku(r+*tP@?eQ*u@te; zlZVcCz$6KYO-)E4v4xJlivGzm5RiMJqmiQjVy+(>mM7GIQH{KJ`>7e5eRG~kCD30|Q;o8sBYhq+ zY{6cLnrMi9223;TE`g-vRPYcoET8}znAd+d&M6jq_F;F^4cc|P_=osS!_e^bGOdFD z(H&-(5R6--fzo!2B1uhQBzZqV@P8DrX@uZk3Cy^VCX2hv9dll*Ehh*i$z<3b zziRnuWkg07yyh?}1qJ6*rc~5D@3C2I=g7_T z!&&Y}S_%}GD8kPeXRC(L=Vg{KZVL0k!mQzq={t+m{hj=JA z>*#D0>W#2eKtCfBEZ@yb&Sb&iUU=zg`R;I5US={SF538&;KG>Qu4CQj$jihLB!vz;g#{_V z8krl;si#HW}m=j6e8B7V=KN(?>T%Iutt*nz;9;&TW;rZb!NVs_h6a)Y{IhcWrt}D&M zYeUy)@~-^jBn8;1iA4*moyx*=dqRcqQ;2VNR6F!lg0xdX>-WB^__5L1e={Uvxkzdd z0OQM!$gm1EUH4b&+KNGM6O+-5lX%u;gzl^M5jQ7NylatmGQ3ZO5r%NMW2zOfZq2!zUUh?r@+w924r+jgW}hrQ)ag zE&kYTwVZ>cN0kS~QsH+wwZw-mnMnJZOb;;F*EK0{_>Dq-bKQS*{21%eAPLPed<+K{UjFOSu{w&J43-5yjg-`NgnP3F69~EfHhA&k#y2o@1}`;d{Ra3g;l;JqZO-^@-;ob zIF-0z+nnANE=<%+oSd-W!s(dqfvg(&tUSW9Ek~+iK+xfIOpAf`1Ld_|k&;0o^14T^<(N zRlpWUWw`Q^cxxan2du>Gw#fMb+O=XViAI3p2v8gWia!BBF-<15-89HVWom>inekxL zhepHhv!a)*O&&V}1SLuZQ%Hz%kQAhpd$a>dVa@7xbK8GJHaj={#mZfux3=M~D>_iNV5*a=i2Gq$plZ&wG&Q#p9qgxP7GW=dZd8gVqM1agNTDk7M~&kdrdo+^{QW5(}L z#~&xoPw^HEMg^V?9k*nCQ?X((<`LU(#-H+CR#!+KZQhcmQ%m30mWV)2CJJUwPFe`m zOqSLZ5Sg-o_+HTBes;C2wV4169Gc9jvM%Mvrmp>=U-fw#v@n{(Ld2zodwupi%{J_R3xs( z3vC1@_5At>Od5enX$fi5WQrVa!il@1x8kNU&X`ovp(rC~-Q(+&oa4q?_=WvvVE%-?{Hy}-3yl!5X7?wcWOEfH@ zi~^9PuNA9>1A|k|tEnUBQlqLYnHr6i94|68ZDA3?R6b+{SfN9OUTjG& zG;j4$2dImd3I44&QOW|LPr`2v5=21*GU+GcM|B)bD#BZ&BS?|0K0{0NUjWvWn?qfeotmI|l-FH@roSeF9T}_J*=MGCBr8N6FNCOccwFctd zRW#LVydL*&uEM6Zj;ACJv6%H>U$v}3e%jBvUEMtiYA$NFi~QX{{;qco`FEzdZnZTR z2C`KRg|_Cm0YNlJ#5&E-uzXF{%Em2bELXfU>NuU!t zxntOz*L+j|M1rkGnG=6cT^z<*x_#Lghqd=S!=G`-ieYv;0;=NxSx7dFgERCe?mfSN zl*;z1fdI~?dUDnSr|KD8o|%{0`I)+>t!{{`Fs)UUg*r&!snM>HeXSW+sBfGb#<<~w zqJso&WSR_w@qJx z!rm<9q@{K6lu$vne&cS=(DjaiCx?6slS0>YuRd-a>JQ5|Z-iI%(l@!)Nm&mQfwRZvH2d`;CGl2YBSL>SGf^ZCfIcEF=q#;{uQ(Om2Vm+oHc1h(ts4?#V z#x2sFU2;m+d;u>)V!_Q{n@(y6cma({BgsjwgmJ6W7l|b6dC$v8M9HnzX+!x6F84Gm zA8uA1=&*}r{ZnBe)saOdy!uD`vLbViH&^dvU1bDttQijt*T@<}bpQ8P?$gD49^qdX~rVlf(5l1unHv5$(TmZz)f?`Y5@`vObRrlK(_U-bO?sC+Rh zU!()MT}+kYXBT0ZiCb*eUNts=+0_Sf`|B`bc@e<&_XT~Cw(35n30db%=fkBNy4nG$ zP5^AfhS-1EFpS^oI;mq=b$|9C)wWfleeeuZ5xcU+7!NVbAj|-Yc+3 zRI)6hQw^Wrh$s`dUmK3%7<}KE0TVD@Kf~nH714mDiAD-LSYJ`!n~8ZpWMAG-j8lLG z83ZPQNV_LwgQ&A!c{Jx9f{%(@c|kI6MWy5JBwR=S4 z=|AmVOjAt($pPQG>-oCC&ROI@!mJO>gNNjI?9=?`!CG-^<577SySmf9XQqddtGBm| z2kT-LK{4lqIe0ffQAWZzHFi~b<0(iYYm8>~A*5{fma8HTU9i+23fv64g*8+(oJe4) z`(PT7DP$c(UQCc!kPou=B?r-u?HVKI-Ya|G9^EXNKYq ze>*$4JM87Ehvk7k{&YBoBO+5^WeKE>%$18X%nw97md0e^`r{HkyDhYk z2pytt(i4Ij6mv2o>l(7i*%a{Y1%(zc?p=ig=YSkL4;0H1_*GaxA*3Us0%LB^naGyi zHv-saI;UwM)yDE?G;m1LFYM5m>q=?esKlBw9oBN77Q$70P-@x z`dz2|7rP)uX?hgA=O=BI>ZtIi7)n|y$f^$=CTnlVqSFY7@A>r+5I+Lq(~^j%PUY54 zKUr6TNDm&SzdVgi(bf~yMNiy44}bU&|89e7qCd6UP~)7A$M8p9wobh*ug50yJqKa8 zxY&m@4TmD{*;?Hgj=X0$(!l(0w+A*H=}XLpdm|jODo%pVqzH#I{zO4i3o{Wnanp5= zQE?FKVM~gWj{nIEkv-_fdvtsS9Ph-p!Mb$CggviIbx6OmoN!iSO%nNiK!OoF`qJ83 zzFbC59(KX=HK;rA(n^zcDPub9gCBPOVE^*+P5jkiTgPec30q8)=&~*4U@c=*iE-qT zb&WO?3oLL!vLn2p7>m!bG8)Ac#&VC=3!o@&0r0FdWYmSi_p`k;SsKacL}k~ub4v_Q z`|bDP557I?07PbdQm*IpMoekVZ48~vMA}zXT2z>2EN5ORh zE#@9o9;oh%Vqtx4Al;yo6L!%e@gD6RV5ZyF&&7dk3B%C(2}3uf%p3fjLM$S>Z;m(7 zJBTAcjyb8eNq7a(hLtNrvQ6p~*r0gW(v2Nenxi||@Q0_=QOnigj1z(P0RU0bD9sU} zxl1w-zV0PQ1X#4kah2E-;aIx63}&suuw6!G(C;@+6+$gfn53bnBTot)Rc-Z*h~PNP z5e8{JuEf^gdg5OouBl>*rS4G0&r~^vr*sAoP2H3d6C*YQlk|>-5V7k&;j2%=t2%_4 zaT?s&&TlQ>3~m&+wv@@vnA#P_xt0l?jRao76_Nn$E12=B?0tYev~)T~BgABU<{DN` zeT-I4#@P$qa>x^YBhH#=MI2U9X(e)U3yE9LV5w<^p(!rML(-TXTUog?PR)-OZItUi z)5}1ZhM?PC(E1Me7FsGMOq#J)eBhB0MSd+@`w2mM__7}RL-h-B{bUYHLVY%QHTLE?}BPZP~hMvQ3)eeU7fCE)`vMJR`D}+PT{BecL8H zGo`LvB?>@IGs6;hP;0NG#Ma$UJrdNAUa6segPAT&dDxCYkSC7Q5q?g)6#yTduxy@j0 zGfWpNc+ShWWe`|nxl9rx2>;T4(#Aee>LEJBWqQJ01M2h#xrMI;FU3-1@H}n2irEFt%|5!ZEtudr3|!Pn zZ#EG9)t8(BSG^xw`=efYdL{>B_wwc9qtaSFSWzD_+)-*M`mo%dF7AK*T)9&(Ymj}V1YD_n?srSlZ`f~6HZJq-VIEFdWV zX$qT^rs}jjJ!4D&7HOI;(~{(2>j=)y)H&(m-xJp*I_qQ~}^&eIeN`_AJn zSl4&-E)UK!=3MYURaN7V>7$vl(MS)x0$?EVWH8mi6JHPq=elK1tp1`7;c(y~b?}Ss zd-osQs^jxrJNyF#r%p-`(qT;n9N{eNH3fJVEe%Wof80D^rtcH;UVig)rOp=)O6Bu# z8s3ct7m1ik#^YnaX+lECfHV<58A8ke%=)vsbfTh7OuyBB^eti(J1kMweqyqgBRZ%k8_0?V%eEpw)vSUEB7GrHl#p+I0CG_>Tz%)kt{<>(nm zqN*#uTESkeFDZ4_qII?t5<36*mae*iFoC)XbkT#lMp|`vnUW0%GYCNT0`4J-)5Gu( zle~`l*ghRYq0}MDjNU#X>^T?x)m%;zns;p>FQ%0wq-Jftt0RkRU%%I&)htk>*>lCK)DN80!nFVqfp4ZR9|HaU2k#~!Sa}6bcL;wXl zm4MUrF{`hDy6f#;(B7)ozWV%BpCzLoR4Uu$_pV=us`9n1eC7Jo^(!gAzf&84cVzmk z6Rk%k4EhS|Ff{A=&+?l^#qYUZ-p;R;FF#V=qK^^=mZvmnN!nti#wAjgW^iM!do~c% zt(0PeOzQI1r!$d#V>i;3j@Tk9^YXii9t#%VHAt(i@|MuXtl^q%ToY#xt0KPrUb1@L zo?S`()!?$+J=C(*Pa&jfu%|g=?y~JU&fm>qoe8?2TaTod?LKXvL1?K4 z@VD5)bXRLohXL`MKkM$wKwQ0)l{qo!#l%F~7K2;`Q1D^v_e3-njS3(R|2EJW9u=Kp z;${78bsT2p?h%f`m7e@jZB(fAhns;#=xh)Ty(NhF>Q?#;^33)fHIRKQUT$-ALPRPN zPE8G30q(7kfV($i*96R_CN__i@*DXQuvD>18|^;=Eg!=k4Ra0nG5|$s>J!P=7F!gCdJTj;;M3vs?=yDP|5K!G3Mdv(3WF2ptE)d`G{a+faaV>ZaU1(Nf<{7s z@r*5@YylBp;3pK`)v1p0K$`?KG9G%-8Hs%9$~SQ+;}{MNy&YUQ74(KTz*SKpL1b0b zK(U`*H4#HXtVrG2Yhr$Bw+jOO>)aTC)pQ}Pn0Ozk^Dd$2Lt+MMv##(vZcjS0YgAZ- zfU!zY5S-0j>#LkVT4{e&p~ zBxIK$`I51dvbtv0L5v3!3E%dl0?Md@p%xb60fdznPrVxnzl?-m2HDp)5`MXoj!w1N zrbqe3rP*lVGJm3rNJ>D!0w!~s&EvQnHMnr)=(RYqst%0>C_vHr6hUTjj5tt-c|s`9 zYHlrzK-aSy#Zq>o6lOEwUv%UJf(qe@@rHS|O71lGS#D*mRM@U~N*W4(Bbrk9GbPFb z>~XV{AT{Sk+S8u9;s_9*(3PgI$#BS*UuyJ5>|i~rQ{bqB91tX!#NIt}3EEX35Sg=R zd~3z^JO?P8!Hqlfl^bw)Q5(V?ErLVD9N%a^YRK<9Uo1+M!*Z&|BzfY^q!M*P`hmLk z9M9PMhLV^gOvsOT!=hrj#i6jin@zpmP(>6QtFVKVf>W31M>%ZG;sPsGiMHu+p`MoQ zQn9!ZC?#~-n&2Vif4lY|xAjRr7`yxb-1q<}Deq8bNqTQ@YD?GD~O5Jvq#+0l2t^y)K32lnd20?4oS0ZU!_Slx%wcXRTE2{0P zikXRtaC8I&5f*p=6rm>oUZJ04a{Y(3{&h-#5Exm58>-S{>x*DK zfrFn=HyC0W!55dNooV*>!azH*0@DBidk3V`>$CgA6`{g=}fw6>IYP%7TSh#6j$F6yex)IOHZ|cR6_o0BS&$zhwn2&1`HiL1;{R4lDA^#?5PR z^f8D+Bjuzay%<0^NI)|BPF{~k)E!A1ULVVlDabZy5(!ApfJ(EPataL40V7XCuQX3l zI>l)9$JPwj-mD9v>_}K@M1Qm3Lc&O@lS;*UESFN%mNh;gqSeS)h(YYdv0A)V=pZte ztTjZ|8zk20(tHv$glTh<7xPE{W1QR5YUH#UIju(i9IBCd;-S_>hFJI5)n5)3GPZZB z4+;TO2klg4^ZQ>Y6>_YlT;KTMUFy5P(9zHr2#@2@oG#3GT40u@m;zK1-^wHQzlngg zIp}ikJ^eFN1W+_ep$b4DdLao-BcO!^>3SpRYF@Hwr{;X3H8|8~)~o_#OyZ5kN>f3Q zz+|UL6K;O;Q;lWw6S5s5lZg#h8r&$(k{}zIQTFLF%+?2kg|}jQXGd7jcy476Y{w2! z>PJtQAHqMblu3Wp1(&YC?D7k&)J zT^P}uGtXL0gsrOV?M*~=%U6Yk*WTh1xWT^Sh);~tL(PfWqx4hbHe%zJ8%pd*JY>%v z_dIg!P=}VN6{*m8h z*}TUP3?6FUksE_>Fj~}N5Pe%;-3@HHeQvU^D82HCLGvr)pzHv8day-u?p;#8#N^Tl z(UAx;KY{{UNSPNn>c6_#-(@eWP3zMoC;sM0-R*ikIR(3Yk-RKO+WckKvUt z%eT4fAT~$+z!N`->QF{Zx35AOqE+s>YLqed12Om3_jylF!i1;89;N`fco?BEBbQ4f zJWqV?pr+xg>3@|zYr|ozndRTsqw4A@J$s;v#Kr;Q)3Pjs{KBx5?05|7-w4QXZsci{ zT{|yCI!$0tu^$=eySgHay5CLaSu}Wow;w*}I10Ns!|0u4Yp3(pVuYKcgoCXQXMbmD z;k@Slo)+6L{Q0!lJ}tKACLvtRPqBS~fAqnK9uk;iIay$E3bJvcYh(K}O6J*GO2n?F z%WsJkSNadEj`3qCZ+yns9jc?rZ&Zn7h&Zol35ql@VuiHzNDq`)Kt-rRdkYgB25)M~ zf{CbprK>j?)vuB{_i#!q5XK(-Z*sRZl z;EGjIbTTaLWJvg0z5Cy9mFuO-&iEQI1u>6g(n@05a2t5S9#DeVcC5kFjf~ihT0)Ps~J7{z-tz9-C~uTd$<@9UL&qqf?6rp7(c zEzqi@$CPv^WyoV5euEyfz;U;ACIe$)UP1l+{rY}sC%N_BhTT?P(2ZsK=iB9b)!n^% z4TlD*+sRG9;j90s?(L;FsXm^0`)2j##0h}EDUNJ43rDs%XXD70Y#dp*^f_KM*^-SW zi&S4P7gNRxRUx>;(1W!O1iYE~Xa(7bQY?EU=o(b?XkNz5=(j@%Mp$Ep7H$XUZ*(j? z5w2g6pZ&J~YWvlw7g^z5{x) zjh^8Ye}kJ3lDe;rmek#XXtt8TaLHK6?mfcqk;?+Ck9M6D4ffjVoEIAnPjDZ!Ayc5z z6sR->D*YUQN=rEfD#hCGUNtQF@PiwsgTT3hEnSr+Hd~cid9$v58G9NGGkMD6Rw_ez zK@%$|enJ0~{0c4t=p4bWZQ^4%_kthtw{VZtMY3lRoZxAuw6jxvuv6Kq&jy%gk)@GX zDnOnBpOgcHR-(x*PA4s)$=HVZI7hjGzl1B^!;WmKBNbu|w5AbbGt~uZy)h;EaYUsy zRDy8k(Xcz(p%bM~k2NP|;-G&$Pp4?xp{CRu8EgUwaIImLnp{)f!EYh$8W` zti@B2tL|;cwNMkW&}CHkI(I0urG6@gHly!MLfWHZQr3+Y2F2i3fDL*s5kh||wZDYb z`4S?f@U7w;5hn`P()H1V-h{tv`hr>>p6V>8yFuBFG@5`LKYf%R#p+?>7T$RkY17#&dM zrz^6vQ%)D_6*kA)Wxex>Shf2*X-F})RSKVC zYic0u{F9IiWH|riQNCS{u*IbL`<#RRmaeSk#@}D4=nhag0`jO*984tC3m$D>vPQ9%vvhp_^q z)eQ>_(+_USwW!P2vnjgTCXPRVL=tH2dTkc64o^}Uko^(;*N>3mWDj5o`WYtAd8R9| zCvF!bwo9Om(xDe1wCRKOtf}c4vFTaMi|Glcws>Nmpp4iv*zyWic*r^G0k(-1QPQhk9T$Pof`rtKV#-CUkG zB{Za}NW0}7pQKY?H!B@2B=`6C?v}Tl5>~DJ|Lm9d>U+t|&1)abCZTU(>J~B~)AKXt z^OGCkp*TO!f#{1HB12kw$#{l&oKM27m^??uw>{mfqu#6e0ry=9;xI%lA^?N%unwL+ z@kEsL(*L+$-Q6qy{$6$K(v)Xj1H+NcSUg;{gc(ho61CyJZUaCQib<-V0y3!Bn)Ms2 z;(N1vsdlCC6@UM`TgAQd=6)^xb-OY30ss2nr@uaFrfKjT<)oXY+`ti0aT8)p?rlzl zo!A_wdAJzir8@asJ&8)6HNj4xfSity}f4!fCW@&mz%RE4};>d%W|WzrW%Av~&j zys$&}18Q}2jcj>4yI8GSf*k}1zR+!vGa4`qCIVmc1|_zL^cM{}Gmb{@olgVz$v2Ss z!79q~FjC2he%>I(_hd-WgUhg&r3Rq3u4c7xx%4i;MKU9px&`|M6oOCT{$9d2L*@cs z)ke6pYSpWJUyUT;v>i4?yY#$Z|H1kLuz*@N26WkAx>66j-b9X7ul1{>Z_!2zQU^8H%n<5Im0a?py9cYH6EuJrr#O27Z72leqi zTK=4e`kyF!)*=&tgxRy^ZT76?qO>~2YGrHl?*={TYqDf5C%r!jTkY{@Ugc{>FZ}v! zSl@%;Vra){|A_RvEa9|TdFNsJT*>`(y%dq0vW&Wafp)(M(;N}~W!CO9YRF^{)!+pf z=>sj*en{me6`>RKBuLc-+FZ8eKzWa0~|}}YCvOyLkAc;!bHj@tD;sH=<2nC z?`=v(jxo{cb)z+;iHOX1tGk<%(ycLX1i5=5hB@XY`2>#)jdu|XHe0Wu zoj>=K+*<>(buTbcQ6*BI&e)|bxOQ#g5{;ZAUzT&kYGq*y>hMx4 z>4Rhjl?rCHDZsH3M`>mv4*gh#)oc*ViO}+KxxFM4pRkTb$%jxf;rH<*nUNgnkgZ`Q zEC_eHP-4@bT8~j%kNjX$Z0ph2JZ(fGX;DA`b~ycMx?L5D>T`B+wCjdMg;LX9PMxXh zH*(m?<8U%u`CJSwghuCvx~nU8{b(S2UEo3mGwS%^2k&98>sZ*+nabYYe(I?q7V!Qa ztM9E~K&7cIQ7xda<%D&w)dU)$OBXx<998bc9L2=3<>lT4CaP&S`Qm$6gehnV93(M+y~}?HEltMI0aO=^TMLR(t4>! zeD4x806p^_lj>rV=748|0aK3!f}{Q+RmeW;0jJnG&fu$o8tjq?U?G5x;UCag-KPaLjzKER!r>t340?V-@4ACI zaKh|R?jldb@{YG;nV#ss$u@F}q=D6H9ZR0UBdq|_MIkbk1xX_1b{2Pnqqgj`mn>LZ z$2qJ=sQ-z>Cgw9?6ALzMVx{PpZ;I9X<=x8GxZo2jND*&clIqQYC%-HhMW71)r566O z02D~);Q=Uylo&I}iZ;$vj{{dRw2IrLfi4C{Qb1;k=er?#b%a$x`gKK_92}NN46ytd z-=kXCLW2AjSXqi8Ar!C>U-Y#Nc>6SKD4AJkEKwU9e9HcpQxwI8Kfn55ilUgJC~}gk zuH*CMXR($D-6D_g&>D?dIFi5=p@Cu&`i$r+wz z3V(ObEvXR?M51^gv!vWwU6R~^+R(>7B8`03 zMF!1j=1hP#+!}!b1l!&4fR|MT3?JGln;bK}HZ^J5HX$?kU>h?XWd55#&Up4QzrR}< zW9dJCW=j1}ya>FISp;6Ri@>Wz;?)*{y}ee^W$5mmkEd%1tM_uvU$PN+M?VKP5hG^`zUZ6drW`pM~RBwz?$HSGXw$Ib^+i*>HQt0S?~d+ zvsQ4dCL)e$&LLgkxCY_}mCd_h2Clti=7Vb=%&NpVGQ6Y~-TqdYVCz{ZOE4Yvi!#7U zU&B?xt2DJyBeqfb8I=kfpReq6jEon`OFlAQuwb#@p+9c>!Y!`J^I5jL47RmRSh~Xt zR`qRoi&bU(FRRtx)nU2b)2T8J(!x-U~Kk z@0mf)onLut;2rPo-^2f??0meVvt(Mx^oKXL_`~_Rg;jnA{a5k*W1jSGn)lasD!U&g zHF$xw8(RyDOMmBDo|^rp_>cZ>C_7YDBlTBy%XRmG^~ERa@s~&Y_`mtxwT+wf;uo&W zDVpGVb+fvYT)$f`)sv08vZi(JXeo-#f z$~8jPez;e1WVI)E+15tCY-{uDV##jZttlJzes!z7la$gRU_&wbR_YIv>($-8%2pZK z&-Ze&Uh5-Yuho^sl}yq4+Yf0uZ|>jTscaJUUrrWmX>Rljw!A(sHrU$_(^ye2OPZM8 zsc1@lc9c0;tND?y)!NF!np~^$$Cb^pW5#}2EA5Uouo~eCEsTDJR_9jJO|w_suca$< zV|S~vS*llSdvFl-%H?Ev7Dv83>vJn>$=`4M=GV#Z%C~uP_lSLYFN~0EOAw7Aq*lI)lS}nN&lq|`Ot<(MRj+ zt8;T{_Oe$`uJ6}sDuB9KOK(O+3ASP9ustU$HR3pZt5({si`7tT^NU*bLHgt3FG_pL zxZhWR-#q0q%OeiWagAicJU^nE!iejx4np7!O0fvdO%vJO@@9Q3HQDviz3vfb7tX_9 zuhz=R{CFef5iZ7v6Nz`P-MnF$Ne+*PSdKu4WZCVI$e%4`bx&5-B}{d`7#54^KOMH0 zGJhdd>U`4sQ}}wpQxWd}ESo2Q+VL@roV1H1=YxcL=|L{e&kg$&7wQQ8o4IDHDkU+E(A_hNCzw*ox6lR`Q8ctC7 zfM;O2)wlWbMq1{n3sVyI?CqGrp zD5Ew1i*v7K@iKSTAK>|p@qzIEJFw#wITe9O!bamU0PaxXNitq}EpS%iGH7qZ#?=kI zBHUc?4qgJZ8P!{{ZQzM;JQXl$G5iE6c;J9E^sHBeQFgM{`Y*~`DIbt-#7EHG1zYkN ztl()>3s0{gI8LBJy)dLX$9Bzt)5CV!#7 zOZTu^-bXMss2xK)uy2R3KD1HkJvCq{o|3tUhaF&{5uSCJ{yN`=05+##%a35pI&7zq z*7`FrC};flE|ySF|CN~Yj^PBrE04s$X@K}0(Op_>kM5}_ z5>O*R`dn=Z!Dr?KOb0j~CI;kQ{Sc6LAg`+w&YD5n)FU0x&?-=v)yBCsS_AFJoBCxU zP}tIOy9~m!zlFvINdVg)mcu(UN~=S}LpqlXNtFie9GD%JZfKAJLoX6AB5IrakpS`T zcM-Fy=_sC>VDvDSY8W{^0#6YyCTwU;_eh&IOr{*JAS`F%FIP)Y$A zo6E~v<@uHEg|+p$`R&ry!rI!({Bn79d39l{JdQm4xAXH?=9AtZ(?@J_J}I%X2oiUV zjy1v^_f?k&_Vla{*Bj3;-{KKeTEC9Vk0IL`#D)c!d6&qv?#Oa&bd z9QUwlv&cyT#IT?H-%1Vx4j_EplRgrhn56*rf=|JAE3mj8*aFouZ`1=<`UK`Z(t{3v zm9EQyFEL|HX+&hsVEW{1IKwYdZOVHiW^@SP%qn9w`Uc z=5W0WM(`Qe5ELN=V{eM+IGSd;`#8t-d3>CcJ9$uL3> zTvwON{?sm;u>=+th)}P?&N4gcs%+2av zz4%}DOS|>`d&%|M!~69rc;bhJN_tbO%p4|VLqMi#G)n#YU4}iRN9Z%V+FV=_eRF&S07BdH=O&Ka&L_JPG56& zHcel1#Jz#lk$5iMAlwYuH5G`Dtfzqm6}>AdkF-j?I1@{S-T`?i(tq047HV4I`=wiH z!N?lBxpQ`NzrL|?E7`c2tj*08mshVO19aNptJ+v) zRHrrI)?RuQ&+LoK2M06wg@y^aJbjw9MB1^b85^+~%MV#eZ0_B~?GSR$ZO>-_^|TL- z>WQ0{wp8LV=bqKr23^NJUP-}bJwluX7)Y%KZI$Y|Hl03jOBW}kQWL~{`uDrUOb(p* zY5{|Ip`Y>qW$eFv9H9KDBI}yH_M#aMdBhQd28yaygr&0CncAryQI$V%2w0^pY zFjP&&1s*muuqPbMe`l_P?~gEYNihKsR*S8e4y7qX9~i+Pgp%TS*|B$^=AdF2MmY_a z`#80B!pvmiqC}PdJW`fdS_!Hx{-^-epF(nD<2P4tymNilg~V}x#{$KvFAa30VZk2( z2B2ea4_Vvs7hYDEfRq-U#-PPH(G4XiA(0+5>{ht14y*>uz;SgY9N` zm~b#Lg`fOfxvzXZ{@aYC7#!Tj)iSCHcz_{!nb;cQ&nw7oTfYrr8H{uq&GY@^dmO(`RO$b z-%Si;)PZnDmkiG#ZoxtQ^JIQuO_i;nm_jq&&`2fZuaj{41q%jYB6tDDJ2}+J8m9ud zzJq&MSYDx9q1w+o*RSiZ%TkXqUjh~*eWZjQDFe$53yQicv@pk-;+w$#VjS_1EFFRo zHIP3eF;*T>;VrpDrE+sU9na51o(Fv7;@s*2-FFxmK0WwvaPV`~BN_VOyL~#S6%k5a z(g3``P2Q!@4IL&?d{E&Z;vm?`S@XWHe%QNPt<{U0mD=WhrLIOkyiBU;>o`B{e_BA# ziDBNE{W(Sil=U=}cl?CNIp`~OYm}!z_D{bzS^LNOy zn|`aAO}{m}>9<()5nRPkJ~Xb*-eS`G7Y{-fx`9h;-}$%mMkzfH>*>~4E4lWL5}`=0 z-z}y8Z($B~Qw2={o>=`C3bpEyN%e-EyS2MT(}u^zKc6-{rVWqW#5jvNYIp#&HQLhe z05Za50BeaFB}^uOBKG5K6U@E!cdq|pmhj060QHQSP(JO^IT$`Vt+g#sVS-V|YSW+rmw>QUCwp>bj|I>%#5P_}i|Fi@3 zzc7;L(h8hmy##A|2X3(FK8Tpqll{3SMogU^DxMSmWhgihQx$ayt%RT?pDI&KE~+SQnLHKtvSpF>w; zDL-9}jOwqLzepX$*MSHtnwk?Uxr?*aa9p8#&;wS54Ap~}j|Dy#d)C7WypGVH>A*`p zGzMO2C>4mLo@7Ji)0pGm2)5C}Qe{LWibuCw0Ue*nN)~jl=KZ&qXLaF%5&eVYsNyR$ zX$e=(tM5xWYWJ8(&SU@t_#aG}9w|1TIKV<@bXoE~lg7`5Qk=e^9kS@*2t5MH)vF)m zmm)uTkQv1aWnZ1C;qwFjw1Fja`mZ)ZvS_lbtL@&oW^joUx;Jnxh^N=-ufkzBDoh|4 zTVL!12huG5x)3bx5Gm+1sX9u2skd_!K}DmO3p4D}igtOo@N47WbeSpyakB)Y=>ZX( z>F){^CHO6BZe!27D|vp&CkTMHE?y1=@t!nWmh*nZQhqv#5uX{Z8Q`?2h9=tuuYqhy zW@L$_M7|2N`6N$Nn`j|un~I49(I6-UbQcq(x$Y7>^b1|%PY4$ZusZK-VO&F_4E>|& zsTlF8$W50nKw9E=%b++P4C`SQReI7V1KjgKnHATyc1fNmy=!#O9;0mP^FJy-O!n%v za((kIfR-4-op~$jxCjT|e+r!W*3}sv<#EEMPawQ#&lbT%0u*)5z}LNyHys^r8th-m zPBX z#KATuvu(4&m8NjpX5NOJFBkoGc+rxI8zbC&IqCh?>&3elpOj9Ftm{MX(eG8Hf2@+} zCc3qZY&)3|5*C%s(#}q5CX{k`Ik~x4-ruSgYo*<->b>OG`}b~_YsoLmyX9J`Ua9V; zf4OnEzeENy_}zF zIn6m{1LVjP_L0`Y*D{T06=()^-$)kXv8?g2UL@<#Yol8f`6YbArzj?j>S|(^-*r|> z*TFz(^@4o(;f=Rx{_%*Y@6Nz(H{o%gauTa`Q&H0ZJ+OiWJjq{hIpK#XKP761$2*kt zWe15Uu_l!QZ1zmjU)K7{wnC&T{;1!74xrQ*=|@2s-=A_bz9B$OD58td(fL0%garXC*7`fxF1cJGM-l-dq#l*D zV6ua8T>`MyjP$Tks6tOkAS&w_wPzYu3PRbEgXw#_vb|j?7k^dW*|}Frlgzh&1&H={ zc6KWF>y^#q`hI%f-fz8gJ^ekqvy#PMYj%;97dDKTqBe9sL4xX#1tzay#~IdeNT`zD zUkqeUNy~=Vs;Rtm4kbce^6o!BPkHG(+LNSF<8~QZblIoyUlRkI)Y}4#?nw?Iw)1Pm4x{{ylbT};6YpMUbL%$aw z_2mldfR0Yq{FqyG#Qua+2GgiEjjoJ?mQ`==g*vTi{tG8|VLk zJD=&YjSOZa+#Z$>T(A+mo(&7Be|`(+JN@ILnveo4h7tzp%u=j)fN{Gz zCQXb!Wy|~2#cJt6iVV1>cWPm@$Zwtt8ehua0E9*WJD8>sxU3F0hPw)nqU0#J;oRtT zxG?86;Qiucppnyx^r>I{08e~IuAT*wdaR$S40=n^7E+cvP^5)5*}EvtGHFKRO{*~r znbnv@F)mo%Dz9yAZ7-D9msU#4<+-)h+Y9Bb+ncKk+uQ4_a|>$=>)VTK^W!SItR}tx z?aqT*v<+&$^++1;ab%-?x8FH5$Oa5#<%gC>;OJGt&=sN~a z7}gEUU%({)c0Qu$9lMF37rKh zpO3yx?DyDqh}8zaq@Q|C98LqZU)>WJ*XSHM$%01>lSK)QTQZD!(6r~1{|5dT8_u;s z3&!H1iLi#+i8L^(nM%eneXVHHoYWa@kg{R~9tGU%XRikveKR;NYzr+VSm0?0C;(te z|3y!eI<~2{_OeHuiHJ9WxBsalN>fO#ZTxma7SDth4wmgiOXRuwCKQ>%k?TWPy^d*o z;y}Nb(5VlHnAAN9vMDx$Onnz+=?lNGKsdLWIZ?YRCTjn2Zf<#LX>RNG>eANA*6p?O z*3$CQ>eA-&YPr0=U0T>$UR_%&&##Un)JdbbEAvV3JACyl&Eb&5YVy{58m9X1f#7x{jkXtHzyS^UefP&(_YW%fDq5

o0$idovqDMZEKcS zIc%ok&(0~^1T=Th)Dv{dRUGLFYPe0} zdj&(O-j|kxRSOaT?lhD8wd&UXrkeRKBzyJJozxr@lCAQ`<(=yNd*$7FA*q-5>I&?K zh0|6H(*jI%>DK#v@U9P#Zk+f`G(feWJO>_LpuF|h4oEAye7>P5OfyP7Pc}Rd?pS>% z1CZwd56NK5M7-q8j|$f6o94a?#gYfi!oS1uitSBItcZP9nJi8F2M%-E$iMLCSEr5q zX(K-$9mq7q%26ZVKO!mB&LW^S91#<-Fe&ex(!`?L(W1;IF*WY=C3Ry6!a*u z2~=!vi&R3Dxu6!*KwnB1!U-#Z8do`)9x7L)qu9Lc2M1ETG z-hqhkby3ObP;*?dZp~~~?%z$l(cXR~4ZmgsVq99fSv1fwhh>ET$W4ggpn-~1s48pN zdEkT49UNUr-dhaBY1~rPlNDGK(Nl~Pk}0NW4l$rM&nF95froX_)KP(JsgW?VU9CNU zaNnZ7(POO?C_aTqlveL8$nc@q)j$!5z#k?v@8UPB#%Qg)`LK|@yD2s%%pHVl#QycHl4z#{;~TtIAqf?0^q7F`joXK z=$$@?`+7taiCi)O*&~(XBaER77Jx&t1;iQFLf7rN#AylkFI4uK-qYt4 zYQytu(QuQS^bJ>@E|B7mWRZrJTY!5k=epv0dvY}=&A8`!5=R;L+|a0o2_s)}v2&J;& zi#)71Jrkon6Zs)gwE`X*M0L5q8$LatZYl9eIYpL+!`_S3;x>UUHGD2~{NG@ocbfcW zcc-#jPOg`0^~!c-vs5o98}(9se=oUNtJbTV)tzMKH`h0A&Z>{^r@wn=(spdFQL}2t z=11JGX>U+u+x!%hz+lwtZgGb{{~eU-D{m#&cPi=9CW^hJs<=yjWuz!VNO8V^3&pi- z`T^j&A!BJcB-tMA%7$8xTJr1Cy>fD6cT1fO;P~A5^$k=YwUN3uy1aoUN)_du5}5Kw znw^}u9QO@Tv#Xg*Ppg9I=^wWiSJ##{=T{b2))v-pua!!RORGyOE1Tuj`PJ2O`S#Z4 z_U6Lc^0+#13(2o;-MYCEg-$`kUtlSSgGhi`pqYGW9k@*20Uy8v6-oKx6AbQ8ooDc# zz)ux3`pJR7tzZF_Alg5pE=wd6K%i0+kK_<+-jcQob0aG%%tR1OYy21fd|Kn5*7$Q1 zFD>M##!nH9?mGuC3)$Gtw(pP7;(Jah-us5=jLTSffe4JC2e^OP}Fr_px3Mfn%2 z_?!oN50giykn^(sLaxgCX8*RVSOj2>KK;rt{y!4}kiX5A9bad1cdT069V=VQ>)Q(p z>#Ix4%iHryE1S3Hw-&ZbrG@p<-1hqBV!6CDSK1m^e7(pBw?La z%L2_VTOtqnU=5jNOUK)Ak^f{~(L(fLvk9 zf;kQNrvd-ZI^bW-Z@{1a$EO66Cd5C+>CUI&ydYRmjRIU_@%V`skNZ4}hz)YQmOTW7 zKvtXv#|~CUHM9#6pmPA^3FC4{P%%2wbb2Qa-$y&y*!Y!}HN!yRsIR3xl{fjm_gw+i zNMAT(bOrRwimd+=aD^u%VDYlY8qnVWaOspoQR@LchkWhk4RC?lzdIzE>0{BTJjhC% zO1LWg>Cxo$$Z6(2bs#xX)60V`i4S&^i&F(UzRCkAr z%6aGsh$;U1HIR1+eskus1iv&YV>z`7Z(tR21KF|b?S*JrlLrTF*X>e4Br}!WdaYDc z*R5=plg;YAd;7bDi~$UK$ZQy1UYrJuVkJpk-p9AKB|_Uw@>--Ppre-NM`8%r{SG`d zpkCh-bCm;@1m_2}4wVb#cgG*mv-E&j2vkZw5MR-z47s5b zcg@J+XcReMc4mcfsWl3oz&QPBKwO+Lu#IG z0e)$KNhWhZH9iN;+xT92@2;L3J))FbfXo85jHs!lnE`y#FZEn+T*Q6SZ1bCY>MDqCepa5t;F+m$=}q(Fa1kxu4hkw#3MC>N<-t?s1%C%IGJ zE!PyL{iEILgLHMO)h&O~_A=Hh`>c(8yA_y&>?pj7fa(}()&~Rdci#seuCi%85hRl zE+>MJ(IJWI3A)R`>JA#WwMNo|%B7TXWKdx@linX8xJJ%I71;-=ud~+Ub*OwI)RZCi zB{u-J36}auhGGc;dxIRLz~)evvy?T*G#IpsrKVd%qBEz3ct{+U9@yMuOu85Z;~`(e zyMGB&C3w?)hy6T#OE3)B^NOu+>z?b?P=a{TdzsVvtN_;WTIq^C38v)tHM~rwEzdQ3e@hsD60EM8yNm2 z>!wg9Pl$y-3K;`g?e0=(;eb`P)T43TjRi}Cuf-u*z(RDGTPPEy4r=H}Ekc)Ns_Ekq0r@Y>2P*3}Z^92UWvGXGoIa{WUh; zyTYx}L2A-72;v&gYQ40=OOqojqo8wSaWk;q&ZJ2CpCI|%^4e^=H3#v2*X_5-IQEQ) zT%o}d0Qm8qP*;iyJR<{I8%YTD>(n=ZLIUb54uEBxSj^~oXWp)E%ubrE$u&>NVy@Vp zvP?qo?09y(;C0VJu< z;N2XD7Z|$zUh$9yzD^+bJ?azNP|r~>#46G=c!H*r&Zqxu5nv2Cnm3LVhx*Orc4_mYVs(340~Ek{ zb^4zoB80Aw=++ms36Qz4nKAu_n*w9gE}{HS8Du8b5_W?B#7s)4OA4_|;rEJQm^|V$ z@c%+GyGJyPJyM9!T$PGEt&N7>U*(}(2^Bj|;i<*V^XgMEmyTpt7DJuQH}xtb_A0pn zxQ@!Jm_izs;pnIv=23{A8hDP-I-h0WcY@dUR9XYG7KzY1IYq@}vI6?4251v;o%Kv9 zcPV@K9M1BK1Z>1}9XuK$LSMN(dB|7(tmhWeV%kw>kG)$$C#=aWM`y>A#kg{Enqch@dSDV@|+L4 z+xCv8fu4$uY*sX4_rNaS1O|*wBVq=HzID1V=@R{cl2U#pAWo&4OF?;SJ2GsWP}A!b z#f<7e9th}0eGLirx!_3-^e+uhbl^_Wco#&E(`3D##YHGEqL;&V;mM`o0njV;x^E@D z|CjIpjpWr27t#lPb%u|q*~hVqn1vqjr=6Y*rC&MiN?rK#X;*66mC8->kS8j(uqNt| zP#6(jMI5Y0`h&qqHje@Hi;ieNbTEq0Mm3=5&@n7Qwsr(h*?0j&V5~LPa_U>G>d4rC z!jGV5WiecfPq3ik!M|iotk}@J3_A7>xN0B`b%b!-sSuPSnQXA$)^@Ro@URf!7eq*9L{k}~Tu_s4=fVl#@A_cXj ziajG|!8hL3qLS_+2+k*<569Y|aO53E_nG){I=nx6E191r;h3#tpy354(NWGkb2-KI zvBy@^Gj+b-*uWN0qKdL00Yx1+KW7~?I`z_2Bf1tUEDcjgJqMd+H9ey!3GdKOUOguF zr!qh7G;WOah7lWS+U~IxpT8gEj6#hry+OsCJx#a4*~s`#TO3xLwm{s1G>TqBtyZnp zud4sUR-&|Zud;g;{_n)~n{$6a^3xfJvZ6hM*!D~8_r9b`;%PEd+S#c-*s1K*jm(4( zRcYI}Dk{)h-Kdba!U1f{AB4LEPt1rziw1==N?#^64t1K%5R1z==QJd#?fD#vqc5=A zVOLJs)L1peQ`5Chz5Oh!n)MH(Yb+6LTyhL`c4_j%c2uOTr-a<{Uh20f=^oMF=ZrdgQq z-k>Sb82r^kQ~5dS#qg?FvQbX%tfwXGBWTq^99pg8>$cp$W^PHIfA-ka2bX7nAf5`XiqH4Fvmb<7o2_cRQBaFF|VX zNSWdGM&!&wZ`SYIHpE%B1&%%T(nFsfIGD}?PjjeCt=iv!xUfjrTJf36prA2%Tl38T z$CLxzuYTzLDfE}BSBv#z<9ko+iBDxzpt#MjyDqK-RjeDhI*KLruOKa3rMIO_$OOq_Q4w9hK$9N`UuP_bA%p_>KUg<}@Iu1BmC zC5k)({}iQ`vmL2V*)N_7GCGBrwyFANJ}N&<|ZLwqTeXKt_is= zPPP*lY6Fx6+Q^GSPK#&N36*E2F)U=BWK+}ty1u6&BW?hot9#}0R#7%pWMFSvy6{%i zEqG{l&Cc34lVmOIe_9B$f`c6l(bU>7Vs(3Vch+8V^&6ISKxihT&k~x3IGS4cYPTN8 zc(1v8{RrO7Cy*Lo@7EBe*qoSllyf4=UFmPUw-^ETMLYG1uZ5DH{voAC_HGYtU-!=# ztk8vS|5=c&hXB_zzuI_zTJ0aT`Oi<2+ENTT^{6r2${H|_cHy62=tQ0LZTZY)!t8P1 zqL4HIB!=(hYHXy{%T0~*PB{%)ll!&G$CaJ(o$_=$k9s@jr@Kph3Blyi%%tG-Ap&eo zulM!v3)p=*bLwXVy*4H|W9B8$g7V^#hD#kxp2~9mY9y~lzuajokAWM7FF>jkbQ#|e+Y`YcCy!7AbE@w{8k?*Q`8sn_|L(;mVq0KF z--6VDne{ZDq{EU2F2of|J&?jHn@i-SxMI=aGVD;$#4m>=9PPPR;3MMI6@6Jl97ziD#5Ddq#TcsJe_Ih-1=3gmE;w&inP9A3&(ak%GV-gPe#LVTDX_)-r6 z_be$m8*r0Ho*VdK4)A`E;v}c&p~7%xUQOfeA0U^})64 z@5E=;W%rHj?=cDyLNJ5L*jM$v zcJl_32A@M%(bnaV4q8&I_k9iMAax4bG?}mAATmInn%#-n#yOk8aM`swT8{)nQMR~b zimCG3K}IXjEUFK?B5CYD%?O_@{M)4M!<=_Hm#(blW*_QE^$f9sVKwzIW4NQME(wwe z$|pPSk~t4IIWUwx;tBzR2Zto4&1n9?=@^)t6=DMnCz{cgzce~K=1$%(?UwG8;Xmom+=UxXa#ZcjtFfQ0X6)+4Ig2)SsVK-K-wY{m zG40W%L@9Ujg@=a$giorF=pG{-kS||ZZu&ULic|G-?O-Y9r7zT`qDE0yz zBiOJZ;#BB^KXs=Tv3hbw6%Rw}K?lB7aHJ6JpA)daxEEHTvWFT2?R{(WNDlF?inr27 zKIQ1AZ&(B%0E9z<`34tjp5wN=jCc00{Vx>BIU*Z6lFa?Y8i|aLio)P(rba7R)&t~i z;J6OkT4!<^wSb@Utcf+Vkp`%b0H%N;rw$J@OoWYG`kTM=g32d-OX{RRiJjslL;$WL z(N162F;QNt+apMOUvi`9A(fEj3G8b%*NTMqa%?_*#8+pYrL%b#qzuwH*n2nU8hUXw5+*EW8;QDC@EgLp4=Q#Oj3>IW4+t;(h~<@?_u zJLuq<5{8ooin;_EuzvYcYscXSzcklHNbn=f4g@UuX zQjg`;+3<3}uE4t;eXLs%Ri+$px`$-M)w)D%=2E6OFjNc0js4WXOdA9b;R@u|?0v{) zM6Drnwwav`95_f4>(jeRUT{DY_IbSQNoF*lQCezgrQ@_cigRta?js3Qdr9?DBHF>K zLK~l454stcMCQE|5|D0e1q|zR``MoAP(V`bp#c>x7W#K$r7y!F{#A}X@iKan3&_fV zu>rCX0rZac>>(I8daVua)36F0y^=#YOMwVbsv&mK>}fU>C&ck&wq(8MDe@a1f~Sh< zPg@>@bc@nGLjXq_2XRM%pSYY5!k0ct0*v+pqFEnZ9MGAzn5agf$GKPW2%~d>uJu1TWVijj:nhe%788dP1g_bCcF3U;;i(9; zY{Gpke#p}e>Jo4%u>hes=bSdK4x8lWJ?;rwYs?>p+Rh}j)z21<;7xFVgR1>Q`;F-t zEM(pKgyShg0oLMOLvdM`Xt^Dy5uoKuU*IG2M^iZKg+IUgUUVar z$0HdwTpf@&F}tvp<22YCn4brFo^nv+Ib-eh_DmD)5y9c?tVIy;gb6pk?g5!}gNAP#hr1j%+jiFfj8EB)+ z+|J(h7fAx*baB=R7{G4{cIP|4!0(dC0D6hxLZNCt1*o$bM>C}NrKJ|Ib_fHApFst# z%V9VlOCDrK{He#igy|O1d;&KI)sd_VdPQ)%5%eTPP#sN8ye31FFWLY-=Agcr&q^Iu zb2hfwq?IPO>gp=liJV$9bf`laI=g&t@uvpWJITZjQ)|hc(aQ!QtY;M$*XQiw;zE&l zstBl8)rW7e zrUP~Hj;V3Mgg27;>&QyeuQ3-x?_#JR+a7fEuoNCws8fItHwZPgf=`)#2xO@P`n7KL z5KP$%cz`xB6r17W$e`~a=N5K`s$lZc;v!8~d0Ky%)*q(zho5czA#eJQ!xkRwvc4wR zKo%Y|X=Q^_6%>`gH!$E*w3Jnh#t0eY=M?%ix&8d%2k!||_AWMLov-jXA}wFqU{b62 zlg9AeJZQ@j#;S)R2`h#41ZzKbHKM1lxiu#(TFmwA?NY9k0fS=(A%qOg8JzaNCRDbJ zaW0lQOD(fZb{0(I1WtpxgwG(BQt9&n-wJ@)PO((x$RM@#T?ctmrH1-*B(UQwU4xxC zs?@Y}p!o?8btaY#&ik3C%_f81NjqveuSVrb?(YR}F31&n;o*l1*4hPmkz`2}zORKF zH@(1*x>wmZJk6?76JmXIXq!2;Ii(S}Mh1d)_CiA%Kf<5szApPFVmWpV2R^RHgOLM1 ziQFHw{7fwCO!p$y+<=4~a)62o%|ujChbo$8)kU4Mqo{LAvRS{<*?!$h=bP|aYW5iK zuc4XtMXxou?vYv8nA(IlunGB@3Jz6bn@FU`G zso#Ch#kVfYqXj5Dj(PS>ayj=c8gxQHwJw@enoG2)7HUeiVxkdsAmCJL>=$?OHE_P2 z5G$cg$F7g4LX&Hvz@wn%r%8}o2<}%10-bzNrInX7S(?+m@x{3X#CHiw3btkxWi(84 zg$OA8n*_xKxJOIn6xXo2|?JedEj*BXF=4y5FoR7*3@YZtG&G++x)Y|blz{S^>zkEGQl zH1eO2X>yeb{R|^4Xtz*%rhz2-yr_g|Ifa1^&9ABt{~2Wv<_j#IT!wNRcy54%)%q?U z)f^beGg3RKj?*CAt%X2pMv^Agy2t8=7T!r8?UNqRg#*6mB^MSWfA8Q=#U`<9k!^)i zHWM#qzHw@mMr@VxL-3FlA~bNU&8<5>wTBnmf$CuzV5PHGeSye$g{ z*MTvvKrMtTa{Z?S!Tw5988bNCG^L6Cr~in6@w)YdrS>zvaqbak0LQ0?XT*nR?dN@X z#6Hzts2yd16{INzN5Q+Ng-*kMfhbcn`&8V0SbS8FNIb{$3{wtfLK9F9*6E!*faMz! zo~(1HKa4e+x3NZx4mpH)bxMJvQM9V9t)k83I4-2oqQe|vg?gk)BJRrJmkg|5);+#H z&gc&bPa9iMqfjn;AO`WAYM2N2F{SZFxR<3zfGrxqi!Bm6iT(6plF}W;Rx-RU!W2t0 z#nMc%G(QI{O`i018))xhgEYbRVi#sVzL0nt2vvkF6cs~XEH0=Ks=ndv-@Knt6;XBS zA<-{bJ#@rBs#Mst8~S?c6!H22gDkKvsvhxg7HCJQry$Bl*AmmeyuMQ|)ruRHdb#*^ zsa`@NiXRQJqKfn%1O1P7Sgc>-t^39@%g2U8ti;XSaucdDDEG%2X2X;rz9?3MTSD%D;6 z?;E>Y<^NjVdixjb^)}NKprST^uoXC{5g2B$ERZa!6dE(+Wd`hoN)J2zh9X8S?ba*B&D7VazrTyQ?{=lUv$f~0VSp8N5>|9^v@7~{ zb#q^F!xDAu?dpC#v_^Z$?T5+x)qk$+?38k`Q1c6`<6z;1-B#9n?S8HLPvy;eE>>h= zeQ6vkaUNTT^ol z@9fvA_si+3eYmUk(J#xp<#ZVnD6NS7^+Ea0{tlY)nP0wr^Ml!>`f>UNmGXm}EZf>x zm(5+Sjs5#-b@r;YbmQGnk?(G~t~cg8yLT$P<#J7Vz+ac^5303~a-rDR-R{GX5hJg%>HDxKqdf`8B5s$<-ki$k+GH#gct^Siq$0l8mF|41F0 z0Bm)Lb@4N1$ceAUezxHJ%*v)!(ro(d%SDekxzT@G#HO+738?yeQArvoXyB)mnx3i} zxcZ%8v+#?FG%PDh3h&mE(5(SdJ9ulsbU0jPSR7i$VQJV0&Yz6Kp9#JmqZR??Z-jOt zHuWhtuk@%VD;OBQd@Nr$thW)qZatRDSXA|WUVlyUCljQM@Muu!d%-^~*!LBf4D2Bz zI|9oAOrH(J4Pp_3y|~lxn2`p-i7kxHCdMPd#K7fgHQ-7cE_1EYf!ztg^n!dW(XA1G zr4EhXU8KzP_QXe~FyP-@UD#s)~+1)E3lX-v^1x@4|HKo21A$ZoWK z0gkn;gf{fML1M8?f8GB|X{VsSef2}1X z(Ebzkr~+TZgEO9aYTy_kYx9c7H?EaX&2A(>lYcZy4Hf{H1JVQ7NnhQQAh()o?piPW z#2SY}u(n0p-zB~wsTkS7?bsqrPTM}@79|7BP6P*xUV_0o0G!Wr<07rK3Bbekf*b?V ziD>!!uMbarwgS^%d^U~+5fX6d8ASq$AlTT#6o!q)rE#kCdiY-YPk?&(DGXLx)OJma z?8RDM(5f|F0Hh;e6#W1i&TVvXaBlQQK{OO%y!0%J9~OhrY_Zl;2L}9U1Q?ae(Oq1^ z8B0%7@RT`o_eA4i%*1(mrhsOU)TJfQrAW?r9^u9Fx_89>f zK#tarj`W=mG4=Sp$*JfbwH&U7Us$gd<`x~=a52DaM!}oL+hG1?MCt^++1K#GUdCXP z@J%o1RO>PF&mcoR6VORRPh&ea1FU?MK6pz@-=y!^JH|h4+#tc0u#{lo9)XFlMZ9_q zq;fJeo?d8>%{u!mURP>i;PmI#O~n$9t0f~x=r)^vv8!k=G#Fr6Wo&Jg4R z_PCrcJ&cEc`~d99Q^lKL)9Zz z26lskz(sM0GQqG~*QD^;#!dL~6PrG5|nHh9h6sgNMz^%0_@m$hhIbJl$8%o z8tgLH2>#_~b@wl}EVqgrB?oOao-P#X!kH6&4_GQB|%` zep#?(N0FZjQn&^cAuWZ*Cj9QXwXcb{I{g=Pg^t46Mc?C*T!@?1RWdEs z8R5cuiRL2xVuzhjma2O%V0!2^6tgM&gDf_%c+_gA+hnP7CPf2^5_LEDhE9l3@i|nv zG<4mgIFHeuzsix`UyKW98WZ+<9yuO<`nE)7r;@G(qgl16=uD3& zQAeHW*(s{Zk8opHJ}3h6o3_ZNEwX8g?B~!T%adeXkVVH6Pqkp%hd~fx6eH3BUwQ;F z${9x?Sx8mZR@EK1a1*Odme`F!CM{^sc|$2r`fy=v@L;(dt0vhcBDD(y3IiZlUU?h} zk>@6&uu8B3-(=Oh3!!fE5NC-?=Nk7d6dS{XLnOjVut$1;qMe^6 z8is_ueZVN=$%)9ZTZHUVK20dN06f9bf6BlSq?x-xT(=AsgFCts&4d}c2fs$^paJnh znuvRMFKn%(qc|*TW~+R^yt`H2-F%pAR(H4e_kek+UN3EaG&^DEE9Z@gJSnOL(;N{N zvUqNUEH0~uP5uZZ2uHVVOQ-RSj;oF!H6maV5UD|WcC>J4sd|! z7%Z#Mw~FmwBT&~?56ge>RFOI70MYQKU9{!QF4~Gk1)?N3{NdkLF?-g$*BV!2ZP6zH z>2ipiaXXXHM0-SvO(2d0yR2!)Fp6yA%Lo$N8?IHQ^W>lQ@7&o*SFxa|2J2P$?0$7; zXCDZeAobN7y;WfOJ3L(4*oi_wMr$D4mP0ih^*o2V$Iu)|L_mcApAqC-Y2zs6x>J~x z`**O=7ThB+0;Om^P7z|p&W`dXEwhJET>af>SFjjxjCazotwPJLcyQ;3T+7Hfx%0kg?!6qa7GrfS!B2Q>>gE3s;^}kJI6bw^?3rT`j$yHl}aXY;6%m z5lnT6jK_v^UAuWhAuEM_JRn$kBTUd@2{?2U;3h!cZ{hzDBP#`D&z!rBRQ1Dpl2)bE z1ji`rh}jyEeuJ##F~)RA715$RS3~B*!jo;#2*>ghti#N`(%xQ@{{PCIUB$IK3zZ*w zq;%C7Q`^?{PAxfUa~DBLhy%!;(be=`pDXuE+e%1x%7uV{3BSmm6yq!^^pjtU?qsAa`b8V(gqM`_&sFCo^b812Kf>pksyPrKef zhpu;?#HE7XaXAx0VHaaX&`CQ4IdAsmNsZ}(Fcl-&EBX+EWRDx*U2FmB1{&4Gl&3kTL;+O= zpX-yTl3zS8aEQEAO8pwr#GWVmbUo*<2+Yw*GU1k~?Q7L%bcW$UIV%ZKzuJF9Ep!;& zBezPW9ij3>tWRR((D39OL+QiG#YH7wr=5&m?@%hvH4?t*k)*+ag|Il#d*i0? zw;5FkuT}Uoz)}z^n?w#!pta}MgYc-dNSpCIa*N7JrB`W0!uvK7PCP401=8T)n0D

{Q}R+1M!<(L6qer zk2Bg95d0BgCz*REz?IqaI3(2@G(D3L!J~RQ>zlFX@Y|ce*47&~IwUmIFGcW+W|@RH zOhTViGdf~3nseaCQzCPeJq)Hy4N&NDEf}qw#am(Fqh?l_X2))os^@?YG`On3>70c)K16FQnQ>y78}@H#LXU6z zC7oUIdtDA_{g{QGZWh8-W~Q0J*Klb z3?~2&2y4ZA0n$dfJ~PWs>;2Mw^^Yd}{sEp0xV9lbCf=L=BdQZLovPtRojkQzV{75|rF;DQ5Ypz4W7o-`q1RRIIZ>REc zS$|&#DyLX6P&UQA;Y3C4IQz#u*)#RKwe*&fz4SELeq*mjvbLq90H>^eG4XoNgGIEnE>%e0X9pwBgi<5hF0% ztw&Hc=qeyubR#>Eql-Z@r6UlfYl3PA#}M22(s4Be#*%0)UeJ0VudKjvO~EA>{`~5L zDY#?`F3CxpzLXZ}v4*#6RcB(N+j%tQz3`&()U{EMY?(=Y}q& zrEI{ohGY42bc_NR(rX*$Cv=4nXUzsnSnPaV%BhpcgW``Ygk(Fc92SpEf_3na|2H7; z7PzTTu>W8u{sGceE8;>iM~=8?VQ6aqM_Kfjh@J_v200%#T*?{9MF!1*0Nx5b8-6W` zHJ;#izA%_FtCeJAaAdn3=PDW&5t=h)K_D-TDM>ld>ae>g87<Kg+r8mwBG3#o|}HRU1C z3<&u*c?kplb|BZ0E^O#(0e%B65KSJ=DED?KKRBbHKh!(kI@pjO0*aqdLX=?+dwPdU z?%mYd4>DoAcXzIJ;;fh2A)&#KCqi^WRiDQ`f<4)jX%0=NQ z1LsdjIM694oSROaGkk-A(||V>!$*k0pA)Q!XwA9?aTV$+t_P)%Lq#OZazX;8K!xeCb(Wq-?IKv5bux`59RL!XLmbRv$`Gg3#Qwl%v!pp zXKLMx^UQud(xyi5ujUe$)`s}j%whz{N_wa+uEb$`C=X(=B+4flr}@^vJKo*DhyPL8 z`FKayCut$mAKuvF59j9=SNIw9U&S|&dD6QN@0V*kmEDh$8oa^UjjhGGwZC&MZOwjD z{6~K`l->Q!@2+j!Om6BfzUhD7td&1b_pkcT>vzkgda`l1T&}z8qVI9CR%v}4tMtCY zfM3%X@LaFZ{MUo9=K&8;pi zZ_eLdT3uVey}7kKw>iIXdvk7Ob-g?{zqz!&zB;T!nZHn%d?o4qcjB9GIO&OI=Y2+{ zg)G|60GkEShbkgo6`7m{t$*05E}6w44kJ+ZDms(nPmA-*WAU>8X0GW8YG0b$6>lZ0 z_YZ4L@E21#gL>PK;=Lla%e)PzM5H-3ZP#vIZr{@E_K6mpjS@q5h95%---l}Kvd+kQ z6}<+{2w`&j2`1l?(^I^yue?GRKef6AxLIZ_Ay{i8+#9e+*h1YBuhP~uz;*RNHaHh= z;#rTB$NL9GQAud4a^WA5n}*4EsoH4{LjzRp-86;ex}Wuk2it(R3Ow=k+&kks*J6mi z^V9UUKLa3u(OJN%#6g<6eIs$SUQG~5T9J;Fg)Mx>U~6^ME>To%2bBGI(Iuhp;YTEI zEB2AzoDFT!4jrt&1T2KM-Nub~-oFfj8Rvw1BVK)1$>l5F-=FB$pNB`GJu72u`Dx%Tu*>RTkNqh|0`v-%}$UeRZeXt6oQ*fWDhDNuHq79<>?j; zKU^q2%#_EPUzWsvD_7==9&;ykyc88!w`fDM*qfxUbUe_?^oEk&x8WPoiz+c<=7ugU zeu7#!@fPvR3fA>-Fy=8-#!h=gS+7fD06sp#9}h4sO+86T1Iz&03(;i_IaZSz=TFiT z*J4v>3UKFOiVZb#N7ekZ=J7G(K24c*=?og0CY4zxY+`1j>;?x$-Zy+OHnhcg_LtcwD3zy~Dk8>ieVa?9mB8GvkNWV}^-mQbE zuCrI6%POz(Dn9NB9{PsE>-N8}c$ZNfQV0KYyhmozhvu!$Y_&lk7KppDAde1qcmN$Eqw$X$O4bL*I+nb?aG8c0 zgEEi_NsM6lqX>+mJ&q~Tw8LO2t7-xWsDu)`7F4b&T)C8u{3p2Q6RddYqFG?S@XJD> zi!268uaYSHK2{k|ZFXxX`^HX*O&?-O??=Q48x0U)YoIki5TQ1HuhD}r4Vug|rHhHU z$1kM<)yD}nju<;kL)1n9VTc?#?vG?IfMFO7duA=dw(PuaUAGIkk3#kcgjIpJj^UHU zZRcahwr;u#4#7>S@8C=@KSa+pj`ux6YSnfY$o+gKZo_;6khA97$iU!q@B8UPrsGFyn4dV zPkv_1v{%KWt;0PL z+`-QE4fvuLoV4L5eVvp&i|fsX7{MLu88VXyL8bJJm}t}N>#BOmfG=+elQnr-Zn?KO z`I#n*(NB@*{!%w?#RdZh4|pW1u-lji3)#kl4tlgw_dJoU6)xiWW_h|PyO&Lctb*rs zH;;Tb=V!D@@5c}UG14+|DYiqx%ZBae%yxi5UIh&7q_rl3Z&zQ=t-=&65=^*X`k4yc+iOO6;BVyh!04)@vzlzg$4t8%u0Y-nRT$G#e(cSwrPxv1hl%8=na%? ze5?!iUOAWX(PvaK|53IXPN6=JyjT>8v)BOFWZe}DWX0fQ4`BVeCe*}X#ugSi!`v^b zmfnIkfD2&8xSU%rZKkQeYL*hWM}t7X*5BvP?qoNNGx-_kSM7%JV$nx`1yqD_UB}fl zUQBv_^dV@Go0x#canI3m%xoD0oFN_;J{dkQ4NJMCS>yju>A1=u34)1$jX=r^N~<;? z-t>mdX;z5qrxuEzns;3wfAPjY8xo<&m_t*y5&-aiY|!8&VW}oQvO;Xhf&P=h@Oy-p zBMY0gD@=A05Q`3UYOy5Zy(yR%2fpTx#OA}g>#_iYH`N>lq%AM?mA?SUfsfekKT%M0 zjZun8xuVxanFgx$$XNo&nNB$`GQ^0Wp99)i%5BFdg%l%CesVO#NwcZR58a7Urr)DyUvN?P5n5W+J-k?I0;?gCP|n+%cdpOVF#G zQ1h>8Rg|1`AvH(%%dt5n5*bNfmzs1jWGHI0(D}3{b{Y{l#;g`OgVGLGs{w=e2?SzC z!H05Y11* z4nX!g0AU#8dx`u@8mptGO^;}XR1jV1S=cl@_*+l2Tse|WpHP@-V}@ePAkj`~kaiq` zr0l2Hjw)D=3Wg>weP8}ky$L^WIqG3z9uk0zd#8c{fOsmpIF9Pc%)?MU?y8fYTSG=eo_ zXemxu4_|G|p>W28pVoZ$|HAn* zXRuThGU1J)+fyD_mtZMT%uIY)ua$jieF2BJg;`TH^$qp|$Q|`0O%0`C9*l0gS}X7F zRW^$bPf$$q8w76q-*9AU$+7|42oDX}$OHQIGdQrPHe+vF(wbl}i~}(0{9`Q*XILNc z<9!Cs6VINU3=5A8^|UZA-nSWdI?HGaAoF~He~6KIaHlO~`M?Od0rCp%J`4Tmk)Id| zi#_ioAR2u!&116NCd~6OHBKj8izk8y8u?|V8kcJ_1)2Wq@cV@GX)T;A#7*0*`PHUQ z&Z#|-#ryKiqD^`M@AL?|5}$K$1lu$sZ9Mw^3P0Q6&KvIc*BaC`F;Hj@ll2OyYImv& z(N@AgJA%r5-JuBIFDQv*dw2XRqg#kkee3zC#((&bCM7_ z%buu*dZCc|YlIy^aY^?Gy=-xSFb*oFad<5Q2NfDcIY~CIg3@xrz_5#OmXD*P^sSCdPCUX&3u%fQ zHik0w4mX~~b|5&ypCFc96?K?q`^ljC1yJzX`=83SEf^=UX=X{ripnA`qiiPAE^_@^ z#g_E{hQ&svne2r>pJuYtOg1;6)^d(ASsFJ&;xsIscKAJDOrY!-TlFRzKQ?)~HZ0^5 zuvnWVpWw969C#F!eV_1MX@xY6hv{3yPntrICa&n81eNx~D3Y82@=eVY9AFWrG(8&u z;@W&~q{yxZ1cf6Gbwfdl92$zvf|;o5;-s%fX$J0zCWjMD{%JsInn;cObmu3Rk4`Ff zb+1lO3UFAd@m`?-4IAh`VvAZ^k4~>;CH-=Qpr=JO851Vd41>CY5^w2r)FqLtg90&$ zAA-=nlmIqpzqFH?%}Q-^zfwAP#U;xw=)4uDUmb-{_Vfkr zYm&f=)&Q{Lho+P^Ci=)T1ntBVuIVv+gJYN<5SU$&_(n}ATICz)wV&ElK(Bs)*b3=L z<)}Vyc1G;O@En3V5K+n0LCu~cfI|%xJZ(RpKu0ka>>>V%{Z@$W7J#7+geopgKj* zRVc{=p*SqAi4+Zst>;1w8Y*N&dakaZZAhRRs0~Sa!v7$1K~tjaKSlWRqx8(TY4Dhi zB5Dj^$<@0$Dr;LaP@&-?8sAmVOoOmr76ww4yoA5Q6QY(}Dbev-cfoa^WAgw|OrkOI z6mA)pEJV((ehzcI>FT6EYQl3u$}25`lfugf2_ll50zGblAh#Cb(IYhuDS+6&phTpz z7lxPGTF>f6EG)$&yvHLhI+gIo59j9=SNR#a$G=v|8jK!ckkd^p6&ECp>!bc6yW4Y*IJt?z zjl*kf5d2p11xi2PqYflySk%W*V=?%cK|){^cg9JNWAra+xJch==ZuUL%Hot#VJyVu znV5cWf+hpkPx7MC$1w9Gfq))!=1=*z)4zLO)N__9r@)kjwU63FQ}mnwp`Z<)Q3Kmz^t{~Ea6I7TM94;| z%`ZzdD!IYziR6JGlS}_XkM*h#PN|cm&dqmV9Ow{Jqm-v}rOFe$RcFg%;T9&YdPL($ zGi9DyG}13R1~J{(_>8_nfqh?X}FBt^gR+=a;5{tD(HBf8>TZ@=@UVh z355hu*qyn4vsBucrJd#)4(O$E((4NJT)TOrkZipD4@tJMJrX9YWuTLkkl`CC4(grh ztuw@{3T*b5H0j! z5%);qd+CEc*L_yW%R!?9!rt&}wN1cb&Y zCW9y*ZYt{$bEMjkUnO+HTXt0tClx|2#za+t-B?J#Rz~8hLda1=Y^9Hp>vu*Rj;y~{ zBAorM`o3<6>gX2ts{6IgvKvCgjvg{Z!d5545IT$_wuEC?4&BxO!4jzd(*Xo$DbXeJ zIW1R2KKQYw$)v?GK;Ur7GWo0Xm!S7F!~squ8FLan!QRQaiWzvL6aZyoHLA@Yu~R3Q zNH7qCE_5(1&({5+$0C(*?s1ZWC9Ug!ox4~0M?9fFS?CT_RN>N;U> zI-{!4pqR3oMSm*~?@KolFC@r3(ZO~y0NSipq$4hoK@lFJzEym_vsOT?Ta^yizWT@^ zePB&kz3(!+*x}-0CN2AdMa#Z=WxiP7uk98k>CAYhVA4w^w?6#f*Vd&j@5GOaVtr6O zNI-@&4syiu%B4wnom#GB=2orrak;iv+DSg#Q$^|z$~&cpdr7HQ-A`Zoudm&jO^@tf z{Xc{Y!!BfV513;zM+b7ajt4r?GTUl{#2yHb)THu_E>B`3mEi#$jE8Zlltp27ad8$x zBsOq$uMcZMR0W;1=_Gd8A*+9?G6Z37+CreiDG(cwo2>tF{^R$f0Y9#YOC$-mS|M1> z16{$hSU$Rx1v6W^3Ah{#?R1*x!k=G#Fr6lvP7~z|N2NH*U6FqzpX?G(scZOm z1gJZ-%9uq%-Gt|E6Ma!?mUxU<{pLCJW{wq$#F19{>zEQ5^gAyGcL_Zxn6YNO=ngn? z6h@N)0{&i?9vW4xArUq(td?k=4Hz!523~NrB+oZXR=rFEIhJ~Y*>FmQKcNz!+Wy2` zW_Zh9{lGLQy%$jPg;N0S7J})+ceepdk14yM=CR39d&J@cLE0edQc*jId!aV=nx%u$ z2=NOy++I`J&Fn41DIJ;@vYPXvR^!zh()CcQdtBs~;gVFp6|B>!gUb^m-+L!9!*7u{_2v3Fvl(!$AU+HhdAdDx{%R^N5tVo;mh{_LS0#Iwlu&u#Vq~7_ont_-Wdw60#?IpSAC#>CZ ztlNvangKM5vQr)9-ZBpui8(IgwPo;#u~!qo-KYyl-^Tx8@71l;0xM zg)LXMZR+UUHTLLE%7U1&g_XN3qjnJJ=;uNeZv1EzJ=*$PIvuh42U2Y zBnAoyU0zHpij%{}NClFA9HArW92qRR?H0cssq}zKa1W+#Vhv)I)gZd>w&d7VyFjme zc&l`Nd1YxtW|s6392_#UkRzzX@Hp9XE3_pt^*Un78;DxG(3y-FKMM4?fPhW(Kx~}I zYBA||iF0{G+<-Lr{h=XgdTh+HWt51$M&H`mu?nV3HFzL#YeydX8E*wg9eAaht+Vts zw^~>6T~9IIeh`uc86DPy59{Dip6L%O-it0pPk;whASeUWIXuSM-iNd2iv+8A91#l^ zi4$2CB>s@rm>O49ImftO zC$}MFEII?q^xN?`AI{R}$75>1kB6E}IN&Koc1jrMGGkfCWHGmOe*R1A_m~8vGCyCk z=z_jumP+=|$7D?TPqIv>#V{g83;2#n2cD8I2i)YSERNg4bPdc4?Ju6j4NkU!Jw5|jz);92cDU!di1TahVnD8)4NC-oryygy+5)46jiY^XN54L|h_+}E1f2ig-vH%ZnTD{eKX+m`xplR673r+U^LXG6Ja#h_O8}I3N{O&2rL{L(c{K2H{w( z!>4+x@{U(~{Y9w$mf8zh3DsbUjKAms@bR3!2CIl(gmq#GtE}+({vqrZomNe7XXFVN z_)}5)pn2tfGqndiIWjRgaGA?Km=`;To#zRI<3uL!S$OxAdmv*Kl4-K`DY9Vaue_l? zxUQ{s3M(8TV^(>)RwYy}EZ#;iSW6Pt=i~ylBy7B@xlXMhd&hLvO7h#4IWq zTdl3Fd7kFw#0(JqiUwN%DfiZb#w{r6Z`BqZMTqS8GBF$0@1;Au_@jO=f<@8w9};6x zq^iUps3qPtUHi8-Wd zk(*`ap1R>!Ek%pSxEUzqGCv&2`BBv@Lx!nplbe+))vs1% zgS=<%RX`l89j*JIEPO8cg`b(p=IFxT+hM+dxqDqX$YPOjMQ=FN%r%|#4WnWf2l0?k zb!G9U=;BG?oTsZ{6-@`%1(t1~E|2N1EYUPwB5nuDm6~%38&=gUROtyFkj0rvc5!6Q z37j+DijV%dW|d;K-_y8R6Mi>K`JGH5=sT%pm0o25mYr53ZKT^s5pn`<%Cj_e&%i+R z-n=^(Glj zeCS8nfqb#QZz~>!fr#mR_$n<@4EB`)E{9?04WJ!(d?KULQW?Gah*J zq6Q8_z;8f^^H&iAb|=TVN8P3r{_F(97T~}P7vVN*P^B~34i!C66{V8BOU>X;1huon z^DTxfny6_+4xpY=T&rQ@K5-OpH)K>c7!#0)SEY1uwf zskHX-V6kH{@S9z(T4`!vuA9yt^?^3caRqJwIiikOOa8u^~yHB-YX8sPqAgwe37(c4l{R(8}nt zYY4zynvChE$xwWzdj4 zyyAg>*4_M_rV9_(JL)|nTT;4xV2^;K=%v^~k+=q=1`dRrdXhgvVC1kuBZ_3x)0z^~ zgA&~Zcy#wc_wskHqzLCE!rix@$b?_r?`b|LM5tYys ztr%Yc+3lB13`9F#5Qc9=w={A4o(TYl(l-ij$bFDhKDmLHnOb$jq!wA1)j~M&#J;Zs zE?_VaNc9cXzu^+A`c8zrN#NmlKTNY$(`gk#r)O2UiC&wqi-j1iPR>Lo8#*yn9B zu^q6tbq%%Cza|0m_6Z3FBL?2vq7U4nX32fi*esis3b{!K=1Hh-N!$GWn<;O^Mpy{Q zF{U)t1b7=215{vsoP}CErJx@L;XJm6@P?e)fu5o2#ibql91}UdkYgWr;vy?m+vtR~ zB6vmLMbQ19@T&h~0X{+0PuuP6cM!ks=VB9PO$R&?_cLBa#A}#e3R?JQiVe`jqEO93 zrm)ilmRu=|FWKDNp-rRa&(kD`E<2JJB^;k%T|MXM zZ}KbnKzyY5>F#Hu5dcHFvQPwG@dh2^0~xlHJ@PNb^#go^gXZUZD1!;u6D#|BIJq zBrHGkWm__6dtD8m1Su&d4V$G>I_Q-njdkGZLJ^UD8hlx^E0uKKs+uGZCH3S^xlpQA zx_HTdn9twg!iIItcyBZ@+9@nHSy9CM1%TQ(L}$TGF1l>E%z0p-SoZiU`pm$g>^Gpn zB5*?x1mh=OPtB8^FHuQC@xU_?VSmX3@K8+D{v0$AIxBwW98Or`a`M8Xg?Z_T1Z&E# z-FH2c?M#}2wRGsDuZx}xm5Y={mV}MylO!&n0pFL2=7F~bS$OxUl&=RnRGVX&xh$W7 zCT8ez?3$|~&8V<37tG{LW()AITAaL-_iW1j zPgYB-B-FlfK9xAbUC_UJAzPk7@xMEt7cc~-6drc?VA)D$sHDv(mG(#l0m9oAvsSdz zj!`b!TZB$$)pW?ZS!OP@-AzMo`Tg6ebN7G zd_ly1-rxzYm%*mQuRq}>U^22UnmRJcYpD5%7cIdYA)VncE^{8*(XI{fhlN?cvX#y` zl6|6C1`%$Ec>S@0M`wk|Op46Yy$$KNGB_vZTr_^S&IV%qK~`g^Z43s9hLOi9zj}r1 zn+xS(c#}-&IyXgOX!cex5sD}<4q$8@{|cc<*L`vc`XC9Psy(qz|;F(%k3Nlb$gks6M>9xAZY+3 zTnz9%o0*&*dcjYs{-m1+2pbw`@mNu67ycAu<}EB%{fQ@XT!t!vxeH_r)CLS~wSgj= z3nQC~mLefTtQu(GWyq{p>*Zd;MPQAe^6b0B_jG{&(EfcVXp_MY`Y!C1jV*f7Ye69^ z-OcDN%rTs|Hr*NvtK-}0Gl7i7_R&0Ga>@fcb?%2qUN6Z>=K8@BH0@ymP7%-*(gt$@ za-7K}=$QLy%0eaTKnG!JN*Aoj9c|8-0|qI$+Gh&<-HqTVY{)|(|@!c{iRdQ#6WjCm% zyH_q*<*vnMZrxe9$HhfEDSt(Su? zd+!)dao2DZ!i>eP#s=TXFQx*qJ~vOrLxQ2#ls;DICLlbCPYtChHI<*X1#ue0tvdwWec*+~S~Zg=3;0@-cZkhgoHV>fB8obS<`=iug$&>$H@rx^JUO#F?B(v!yba@HXf#7NbJxxHzzy#p`2tQ?=wJfr9`Cb(`#bl7=OG2U)i zPg~{TZLle2xuJr*Qv_~|*Sw0J6YG;P_tUm)Apc*OkaEO-)BW<5w66jPgQN#w`#j<) zGfs<+v`Wud#MBLzDmJ)V*Y}yAQIuZ50l9BGr6Rd+6-~w^F~kA{oPs2uzk7`y^KMF$ zP=r6a=7=}&%)XS?1ie8wGNkP{Y|GKPR{O}xa3E71q5dEJTl#{7zL9r|+(YU%?u)^& zqH$j$^YvQp!Xd|@Kw9ew$E?1H^koPF%m6tdX%bmWDMmT~0o*54K4j7){MPi;OiG}a z7eW>_51|*NW$RX4dKBHj3s9Lp&f0-+V#hQSoz`(PkvPF+7v7Ao=+sk2gbNU|ZP%tpxXc(Y`qY$$sML)gE0q8^RrdwoDLF#wa#NtP-ID%7}VDkVL&* z6VDh#4u=vW1tR9+bWX+J`kR<|c>vHv4fMef(PoZ#S3@u!UUm&WcF=eC-Tb}xnL$NX zx=A7N?)?>nva{sgbS^VXI5djeq@p^=7xGin5bb~B`&IXvhU^8DBK$t5J0IG<$7KP+k>HrT3N+`E$UqD1TNl$H4B z6Yfc|Z-_38hh(f!GOVo%7W?~O4joZJKs&|~kOpH|(+_w^;FNHy4cWGpC$M)?I+VLd zs2PHB4SQ)MTh7*Z2Ru5 zJECxe8;kXjbV(hPc``S`!{*>$ehO$+p7M3$+wzM01gr@Jm4xQ$1V0M?QdWZ#Q9$t0 z_uQ`uR<*Pww-{3V$e|$F=(6jpc7c)t;?P-z>1E);_`>8$5CbZE2BV1?x*b^~UO4P5soBE+j6Y z(f~5?NScHq+{fZ=9ibRV>pPS=rj&Wc=#jqafV#v#w7!=JMb172mj(~5F~3TZrF_PP zbl~koDxfT9b9s{40wgtEYk#I0Z)*`t7vk!#P3F@3QdW?}lwNHDSSPk&PKW?yv$27@ z5*=d&hFTxWjPjycsTk`fF+5xuq|ilmwm3H*3r1QO{SFn+LU@0V0C;fXvpZ8*GRr%V zpuFK@d_a86wW&~JjBn7X1%oGngpi2oC~%x$sj%#a^2qDXh$eg9My5lcX=)|LeMg^Z zJ3eXZnjqbpgIqngRly=T;ycIbI?m^2iTFl@eb#!3adNITp0|*|un~YP2un%Ki)x+0 z-|1?Nn$2Adgl}=A`R`dA{NyU6)(X(4#3xyUzLfV?ADD$|+A&M;I&@VRjqU9&q8INi zFLK5QwFIvoULY5|^1gOUO2ETb^6b#h6ziqfLu3In3mjep)9bl785m1^4u_@TSK|It z=L%va87}5FJprnbu-M|DOHSED`1+DjsqETLv1<~uvXnwfPz>kQ(R32_ zTHPD-10tEG>MHua20P`cd}}G#LIwU87_lYTjKV_4#dr_#{_%KLANYo(+P#; zRlKaPzkzJ(Iy_7!+=FVPTHUT(zjkeRclWBjYgD$c+Rpklzv_tHzH88xj<`N}2buTG zJ+fdr)(+~OTeUK_z{qw><1F2HZ{b!}+9XQnHTU`uSAkk}e=4diJbvA|wNOggE&$ju7)WSdu@$j&FMoMP-OzSUSVu;){duA zo1<=39_NA5K0*YPN>}PDfcL!D;75s}-SK_@K` zfhvo&S|k`s7w?VMiPBsZh3R>$7ZFWO@pgFg!lod*3i2Rv5r!{7YC%F>*ktLo^8@BF zAY;PmRYlGcpf0VZ4~qkTtql~^#;(+|BZDP1lVB)mcO`d;&AP|PH z8oDnEbkE!sMCrMu`7H(8IVAF*-?gfR4SLC}m?d+2!!DcTeX~k0pUtkFgZ#?-DFOFC zfj|$3(ek(;Plh(webEveuUKL(lE+`DTN3a&Qmo(6kFD=pKd_(ZW9Ux;5e7obav!cA zeD0VjPd&Tph-0>b^ZrSqP8R9Hnib4!5Mc{4u)53b>>acHY|tgD7uDNPx9w~6dV$9$ z_rmjbx$4-ZOL*~l0dnS1PaoDKU)jJ5<0S5*Ev_B`Rh_XGXZJt)ggI zWae5*3yTQjz(eHff{uh+D+!>W0>T??6s9Q_E7Sjagfy#usDhW>M(vOWJ$QtA_R`c~ z198zrhld*=y{=g@#`1v{l&BkN@OC}{s!>J(83D}UEmB}MVH%{~CqV?BeOz70B% z*t(6w7~+c0*QHDoE|6y}>u?~$Wru*t_8cg(U8pi{OtcKB5YLqI7!NW^(gzOyIWO&5 z<#n=TINdAGT3(Wc{chK$FGLpBb;#=yh$5kQAQ)_qQ`#VW$_q_y2slU`;#+dZPZ6|s zrr?&eIs7lhy~G-k9Y-bhz9tN6!bX1SbF(${to3OAQljmHsUule#9OKa0W0)i1YH=V z9&M=bMELOh?8;?-_7&csA#Agr*dkT9&+(=ekni)?IdCd5jfBx!BBLfy^7>q$GdQGU z@Xy?qT{SNWGq`-~PD%^OW19O3Ea|bg>z;(<$?Ueo8n(ZJj+C$Awyk@DE`5kNJm>WW zU5xStqhzeo0X{GRFmW5H>nh!nr2GfB0V=^_L7($Xtk)HW>)wZ+aLN6SgnpOx)jTnW zHq{YVXWq!@hl_WWbe^l+IBC@Zl83Y(3LC>a1Ncat!N5agdPqH%@2U41@#2@|#O8$; z`+J_ogxbi5z8hQdX_-D_eZZ+?vp)^HbY;-m(?q2iR(k2?I6Zf{3gg$q!+3|3_(-$( zylxZInaofet;iPk3CdDSL%|l&HAym&JeNuHBT)(U60^9F)X@V>gLxcXk&ft};~_oXy&H z*9lMZbBmnu#Fuk93@_Lc1>KdInEPi^^18;w5 zFchvR*pQC9WHkLHg;FmcdY#m>!7ojgB1dn|HEX@r-HuW`l*1PL1*$orxuTU_*q_O~ z+q3wjZ9xqPIX$8I-1xv7>bPN&3}#bxO(xK2uXoxci#rgCoutHOHI!Wb;t+4Qc()6x z4qhSm+FL&WH?G?UynaQFuk%d373^4tsekFO!=X}|+4&O7NP-IxhX<*I z8fs(M`oPneOKG*rYqqn6cq5}+B<2pod2bnIdV6klv9VYF&dtRu0y3juq0gmR1*i0^ z^(sJVt`H3bU=A&Pt7z6K2~z)0WW-cy_QouxPnBB_F%VIxJV5|MKYuQ&mYV+do^4+{ zGN9)Sg)AcA+e7~ON>}FKXA;4P(7&|)EggFOoCe&BF!LL;6e{ z|L>q;Wj5gvD5*!td8sy-29r_EVsTuYU_e7q8B4TqPLcz)GpNW6@e1HG%rLpBAhkbJ zNY+kp%?PWt5EV~sq?-lBb(H9R0N_ow;y?27ZKVl{CY z0#%Bsb87tbp_)`kLBuGMon4ah>Vzc?wuX!gyDB z{=OFId#~XKnl@$lO0f7F+4`*|dt@^Gi}yrZws6$giC%nR zOBU8hC?OehB+{|UJggxIilE$e8Mi6r>rCExet(fG*e3o8xrm$KJcjb4AISTzg;+eF zQuH>kISW)TdA3$utG+L#e9>KSaD->*VYZazi*X$uGUhp44ITM|4vXnqJTdXWY&toC z@#Yc@z#W>i;26|guNWortEyG9s+Nh(+}@vC>6+cK@~ijtwBAwjuh8-}xa+EztfI`A zH}~R(3w;R?j873-2f!zJaC|1TS`mK=0g(f)e?^PL4s!mJGqVFPAXa(3WNIj9y4D^R zB;rpkU)R0>fFqJYSr4jYwdMcaLlbjy&T|yr-sh0|{gR{X(rph|_J9RHK#M|1r9o8- zW*N>n&sDvplxiqFO4K4%?C#~VIEYZtCm082UtYTNep*CZuB0O7!W}y=ausHV*mIES zu|T(;{S^1HAOcetptINL!omRp&^yG3AT)Ih_D~&2IXSJHXHMv69w4q!klFDyy2nV? zl|a|I9f5(u;EC&exD*E5Q$NFMNM0pyg2yurJNj@q5;|}kN#0s7r>WYWyA%qjeEwc4 zlEWz+^`Lef(SgYiRPMq9seZ$t?4tHr<>NkeQPfXF7b;zdoa%~sxCt3sQtRjX7Y_8QqT zs-|NZrS4&aZ`_lKP+y_AhMuR1i9Te=e62Q@M5Z5b{m{a}Q^Yp+sV2eCvm$P*wFbZ; z16`ILJBC#E##Lr{hDO0nnsao&6Zn`TooSV?4&h9*XXRv8-k zV^6j#76kg{%0_9gVs%dh=jT$Yh`ds(rcv&c6t--U!h147uv^K`1$(QiH8Yyts;*1~ zGv!KC1TF1NN=bCKJe@3c!c2tCa>Nr{JmxP(T*MjCZW|^L`xR^%|`6Wbc3tjK1{c4ZZOIrS=Qeets@L_(>;mtcvE2 zS+chovW1kaHM6i+=w1)S{K8#EX!;Xu*r}4@fYWu1U6iaab9di zq&@WvWGN4fN-2m`@^B}-Nsc!os3#3?;43kfIrdB!1IDbHwps$>at|N?3b@Rrr!nv{ zRHY{9TCGGxNN&+AY#3#$vemWhh>v^7lN0GElB(x2(&O!vLGb!k93YL;=b40Tmg1d& zh^mMbW4s)So=RU_mwFZ@Uy(6_faJhYw3{tViJ#XO?mXCzhFeV~*j7l?*}M)gweO`% zV45AtyQvQjP0yC!zl}{*WDT)9VT8!QMI=Acd-DU&padtdL{DG89Kp^~D{p!TJsHnn zivGN$jIPf>bcT|dJ<>Ap5Jv={cMQYx9+TI)~ zc9CbCxoj!HR^|x?`h5A$IA&#IIoXdZIbT28mt{=lhZwNOnmJU0=&(H0FcfHmL%v)e zn3nrq^#>h6;V{d-c6W|?7g2kvTUm=*3)Ciqy!W0ZIgqIZnnp9;8W_#;h zJi#RKSZ^o&{1@~;IRFr;0Y54f4TFKWT!S2nv$BnLd!z*US7qR!9%D@@j;TW+J&A>b!rU2oI&TDq`d z7B)%MCRP4HtzXC=YJ>{}hF!2$ zMe|rqa^444KJ(T)dmsd7Zk{Dn&AO#R+Y>RZ>+Y`F+IM61%Tq}vMh zGFMtnPguaC*frW&lm`a*!1e4wYCc8{2?9r7E2PVB2t82SPq6s|9?Gygq)FJSc;8MH z4_%mrmzy1GNJ25J0?8MJiA2~^B!nj2>)I>zk#Mto>3J#tHQD6eesDF|$DUZuz#o3e zmUY+IGacCtsB6mqZax*>!A4dSf`G^)1mJw>sLGh%IYDC$^A>>Z^u@Yg;2(tc);W@1 zsZ!*QM+Rl-F+`q4yxV`;2R}}%V5KXJ8Ftw$8G99CICiaE>?UG*Eu2v@u zV;$09k=YCEfob*p^Q2uJWd}76+TE@^Lfst(O#{{_)G?l6TvmspZfFDo@5zQ9Y^%d* zpPi4u#!3Z-!Je7Q4SY4&ic_mpsby+@M0FBG7|rsI<=EwJGIy-pyeYa1gC6ikF=U5W z9^ltTiXv1@T}xr(xf50S&_pST2-WF;K~2em5Fk7drh#B2KJ?V_4}RAMAuLNJqslm6 zSe&cYJ@CuQ(xQql#Clv|J}A`Yyv3dHBiheA-1YC|7tcw@2HY7P!s;YIWPv@|upN`P zqlk{q2+}|B*(r~XDl>m3Q=~4nQH%G_ZgT)Xi^3iu8ki?`+#nf?!E#LGSD3>cQpsbb z|5m|7JE~i9C#@h3f%OTULioUvZ(NhH7JtuMb???RTy@5AC2nZtRB}Q2D9n9~SJLZK zy2wD~$59)32PE`5#d|(_;Rzt{b4zzpe%Jy`>oZ<({bfq?p7@6x;HcJr%J6=$V4|U? zA`;%k3pg;Z@BoOK6bKr91F<)5Qi>Y9mf(tEpTb-ON}L^sZ-WzNC&7nAbjw#xTbvUI zr{$uK+}~>#A)HA4k!o4++84Yd6k4(~fMLSjA-tkv9wWrEmani+24CD~+Ppev9dp5( zY8yyQ3Vp>Dm6~oE^n?GavIRHIvRScf4n6r@FIyk`)$*Mb?}O`>WP27oShuZKe|tj7 z{3?R2A@Z;sp?}jvKs=@k_2@aFQI5lUXK(@>&!Bp`0|pI9yJRx#&3KX68TaC4i(W4Q zhoFibct1QKOn2>WRvS`Dx_iDP$+eCvIoi~4T@Yl3ar*i*96;@M%8im!bghSAf6;p` z?GgI(Kh`cqUHt0Kg4ksV)mPh}>RW1uDv+o?+z5}NL!`t1{+tT`fCuhvq*#w6={?XR z%TKhp^1;X7d|*0V6&-27dp7WzLK7zDK^KGj<|?*6fJ`2J{8p{p<+51LOeBl?S`ERA>~C?vS>#kY zQ1JeM$q<0?aPNZy5TY1dUXM3u=m*LH$I{6V6utUL#D%BR5^cuZK9`a`j~n8kfLN>8 z@7oH)ISM9gjgcaGZ1S)GvG4o>^nG9<%4;kTIRp}zw+owQmDu!x>t?F$em<`dXSi_F zx=RkpJQO)0P0kIIUXsYxZ8P(Q`g?yk*?mQ<$U+3@K|MhL&LWTEr>Arxd+e;1y_CmEqte-;@&UltlDdQ1*oGzv^(9+0XPvn+4>z+3R#bO^` z&5h5Jc}DlS#%`!?g=Wz+K}F3S6K^6skS3059DXRssv0shwvV9<>=? zdUG{EOcu>m9o{va;OepF>sKPO_c%l5w!!;L=(-S7{&+WKJ;P3pRG!lqPo*1WAIs@Toa9$6l zq69N8v)G7tX{) zy7wj1_O4Ocj=TBUPS*E(@4(vCO;(d;FRn?WB$&^cd*&sDkXFvVzrIMYY;6tZ_F%(UcHNpzg&iXHJ_&C|COdtpn*r~X-oST?vn@K~cRI@W&5iqvUw&ny zb;F9e3_6bu(`2)8EVI%TgC}S!%(H<>o(;?(ICS77ty}Fmn@M(STfcMh5$eje8WH=L zoCAqo6yn|MtcXSgsQl>~#T2h&;KI!S%Akbcb83b#DaFjXc(>?=UEEtSKkCS;{1H>l zzKRHRLF9X$L9JOxnut16kXmJbXv)>RoP734$ozKuqn)g&5RH7mgs$0=mg5YF{kjC$ZsRI zLVQ}KUpJg$;#+#D(For;>)iR(Dg4Puh3^lRdhJE4%!1?8ShUyD)eSn8%d!{m@PQfq z@d^x_toonql1K;V-L)IwQl0*wAY4=&ry|91CQ=+>st#j8yCgBp%K?)Wzg*Y6W-;Hc ziQOf8%;J4IxaV|IHxrpL$|+K((9(BB$i8)-pQHwwm}^>ynGP4zs;lu(z%ijk0Bywy2+3DVfeS@j~6S zCX?TW#XBp@Hvv{jEy4Syu~}vc@Fsn}>415d@WxCh99ojD|E_s;%c?pi=)u9-gQfX9 zu4yi;@e19PTDf4Al0F$zr7a}bdA}x+XdMERn z@d4d=-`?I8-6Y7E_|@I{E4|wCE`?4mu;q8>2Yt8QS{O2Ub=(^%OM2hB1olv@&Ko7; zV>D&v0~!K*IU! z0nQobk%dg_(!9>!LrXupF*hv z6fcFWHW7qvtf#d?hootO@|-)=oSN@t`x}tCaQ5e~y;9WF zwB__J5PON25FvZ+Qd0PNaqC!R?q|r~M+Pnc{{9401*mZ_q5Cywk>DgdyyBwHTSoKX zMeq!!kO;_qAr7=WVAUung^frlyo_A;xf^gMDFPdwt}+T8Lz6F$po36Ig?Q}>wh-gO zaSr#IkRPQb0~;sdxXX0%VAOBDYv7XkD{n$o;Mm+1#09*-kW~m_qiDdOFFQ=Q$e|0X z@$Z~FoypDt<6R3`jk{NPu@g3?{s{wj7g`ifgdBHqK>*!Grfv`TKqoOlCN7u=JQB{j z{ve;MuK?%-iW~yVaH4G@z)>SDrQaiHB&s9-1A1WWM-VT|o}?jXhc|DnD=g`L@>^cm z=8_U(|BX}BY&?J}xuk+j{j81$N^zeCy7ftN9|48&26bP-$hZiAB~q>&-^HOaKXXcg z*BtQFW&2$?GXKmC0Z~(W8mdATIz2R;5JhR;izQUiQh_#xA^>hr zF|3Nk=F~qaJA>jY8qH{!>>kS^Azq;KnIKZSaJ!SFY(t&lQU1l*F+yeVBtM*EAZO;315vf$xAkNpnisgEt+PF z2PiGaTo{|7mg_(C`>P@cv81k$Y@NdJl$t68LC42ZUbm|A9W)Sx6m1|;iQ#F{13$~@Q~hxxg2j07KwZVv|c{QWUgkIOVOkH#R+9-qn&sa4z&D~?1jskg4t6YR@J;9UhwpdjBZC0@q(HHWeM=i* zjsl-!SlmHpx)#3a|3$K8` zjAC7igDXNf)XG92K;8dbucmfA2oy{fa8byJY*4mTslUu47fJ zW|>%Jvb|T`@G%-C99U0q^%BnE<4UdCTjZAQtTUXkUAj(gn`M9?(A8p7bIc91T!B)+ z8}}9~WX+-9pSO$VFYl6jwd!^)7V<(D)}D>RH%%+}rVqz6Q)}Z>nYFA@EEK4rGC7_# za+xV(HD^w(P0dVB77CM76S=NfFMp+qPCkEe6fr1d`q&oIeEoRR4FNO2m>tJ9e)dc9snbn$`@8fw(ht{|kS*KvcNzAblEMEAiuK@^ z^LDAWRpy_t-+MkN+wa^k%0>BKA1MEY`f@xwE|yiD`)$W6vLDy!zx0VXzf5jMV8Xlm z`8CfRsyHb}P7Z53#Vb^unkoNEe5ru{yX2gwja0?Id;LK{d|oowI;oqYFwHkGOV+OSRC^7MLAYq(J9Y<8lz=TB?aC5+F^WU}YF zIKA77iM~A0+40GlJ~`0YK07;`y5;Hhq}Fhu(%D?D4-a(0NZd>|u=ss+pyzJp)0!Ff z{76rXPiMPyOglc(xv9Qdo=x5I^mD`f@nCZV;I!;1n*D>Z{$v3azD)CL@tts2v3m**9TYseu6gS=MBvja3 zCpYI|vu_shpZU0Zo>cnPJ!qc^6wP%NixLJexB!lb{lveA)ch|X=bSHpTObT z9yB_8-aimnGQj3OXRSC9tOT&zz=M2G;Bc1Xl!BE)I1z8IrSw!HmKvg*|RzgAN7hy6CLRwP9Cq20!|T zCH`SAO-zRg@0eqF$Me@V47vDLtIt;au2rsmL?*A!cpaP0w7fRXkT4tlSnGSB&&!TyrmjRp9HM9L(=2NhZC6%@HM1484^7qQkwuvR z*geF?WWcH~yhT4Xz5GM&levrr)K%2ky}dkW5m1H!y`5`)c|B97NGVQn`?h}qD(slB zCZ!NHz+v)GOHQk1&1pZ41Vd><@8mTg+Gx)=Vxr*nMEZ79g=qCbOM z;D`mGPWhR9jm1oGIlB$q0M+_h!2fxf@1bweqN=JOx5?bn9o=k`7)EP=By_57KsniMvwVq067Q5PXjHhSJ@NtZ6WH$a0B9Fk zuH|1Zt^8*B{oB8pyL2S4Q_7h*93 z$cwQMB$4L2pc|B?QA#C8sw;ebetO!vYz-uUPzoKN2N)R}fHV_H;ytdmKn~Qtrx&%V{t$%2u8(RC$BOp>V5NUz|k>aiI<-tW`%Mav>4vCtWg|aIpL4M^&@ToHtV4FbRKCQnt&5^V>^}q(w8ezS1YN z31bJAZ_SgL$;-vh4v%Q`ike|$tqz1_^nizFBpH}f>R-v|5{IG~yw@uq$X@o(%Cm(h zV-pKE^VjJA%yl7)JlceFr*>x~{k>WE<@qjfB#qYn+^O9t*}H32Wn;AXy)eT@Qs0|} zrNaOM-e_9)|^R{V_>gC)~AWiE7eJ#TTSN?ch#XJ+HD#L?UVk*VLnalDyS@z@;%+m zZkEhK)v?P~ffVeb$u^&i-JHL1C51qy03wRWmX>kbZPMxeIb=rUwo$UJ%C&jB#vnUn zkxqe(-JV~(!iHg7ChgDK-_UPelxDDmj_?F??4G7!pCWpS0h_QPHTKmyM7k)* z%p+&dbLhKugk(HIn(99vld*Z2KxoU(z_@^_P+DDKC$WHl%GP7?d;5m<6o0L2`P(ZT zg-75hCUt1)FrE`TO*ko$yBoMd2b|BBbiECPpvGEWNJ8Niv82w<~ouZJ>hOT88MyY z+O7Pq{Ro>R)B`y?p4{~%6IpJ~lf{#@_2;ApAy@k?a*O_J>;Gwe)B3*k`_}i`G@zgv zRr0=sdiRXN;hWa~+xq9$Z(IM?`U8E;|7v~59w8>w0EP!XA)Gl9Pyo>&bU|rDxMEJyY1+zNK&QudV+^ z=l-3CWuU#UW7n_G}9vD*g zXSna*wf^8+yy&F+AL!Dt;(rhS2-|d)!DacVM(Z%e#(s%8+&X>hhw!3E=&es+10WzE zI8-*NjHDQ8$${VtfyL85) zn(Cm1B$tC!HV0G<@eh@?W#8r9z62vAC)x#0egF-G<!RTjqYM``!=&|Bc?d&PBY!3=-g892IhR;YhpT6H2jnY*PFMFlWaJ3a0TLw^JYMZKacFCNen8GKX|N}Jds%V-s6bc0{$=|c zd7-?N-bOeIWv$o~B9^8MJ9J+qNL!)B)y{GaBH(sbg-bV4jEe%KZ4pH>u=LC-x)N#Xt? zCsHS4o8}(br4I!NTZH}9;I}UQP%9$7N7l;t(7!$WR@xF$iqUxef}KSs(7vX3d^p}I zPdpW5^)WpZ^sw+`}e{rmScu;F>BvD5Ih|+4acY2$!S@IC{iF*jG$9L#G>W4+&&kSEl${*!XNiUxHpn zjzH#P(n;;Jtwg3aCc1D0!TJf_cZc2`jozA$c)Gp^DFm)J<%J1v5?F^>oCub|Pl0*t z33SWV9ouVRN=%htSR2iryKOX^=&wHICi4+*zZrRMz`66EbFoj7{Se3-zvQ^(y0;f% zt8vA(3Kc1S4X<$wxLWvQ-h0XehE^Y~Q}l?&4%(6+0|>wNsyQl6V@z5DQg}r`w_zx3 zd)q)$%hN6Enof*B_sKN_p16eI1!gfAh$ov!bzi2=fr2;;QVVr5DB-E z^MW95`8Tp#ZM3KuvU`Np1#msZ`$p1#L2oocvx06uK_%k3Qs9dBv=PR0^aRkIXRTNM zf(4y`oM#fz9rg#eBtD@tV&8Ar@~X4^y^CO^S2i+IK8x} z=sz?67$fGwaT2ERIq~&WROa37s2Qj@R%Hx~`!7T$;EX3?==0ehAIbL8{x#!4&sScS z`}4z{N1P}BP)Ri~H@<-tuyLg4g*L&;0(x^ducW+z|MTXP*x1aoigHMKTV1gu5CNFG zIk#{rvBw{L4v{C$?2R1x`U-oMGgHa>RYOpj|3Qi+$8D-3a zUcuZCveApe-O2Z&ZU7!&d$t$MN7PX>+yBrEq*;NeVMncNS?k)#(1Je*wtE(s<3iocXd|S8 zGOWq1zCW^(iu`cKFbfmrY%#M|SX<4l<;Jtcsf=k%n^Tj;LSbrVCOezW<%(U&JANtUU!J_+2?@h{WQFYNPApUftJ}K8wr5%Gj)*=k1KKR z46z=*Oks&`m!}!w5SV+ z;NJk0^}kww#Bv3^uRO=t#k_&j0m{HnvM*k+4sU+I3?IySD@7^tq@9Y=>y9Y! z@p2VC5D*2x8wkKuLTK;bhMan4c1D{!zwqbRb_Xuk9@JSrC!yDV=zwS3doeK$&wA9R z_By7Le`jtYoy+t^SJlb!g!}D6@67CY;N=D*=9y>^s}JO?f5a?d@CmkPof%IDx}S{% ztv3p7Vx|j?=tc@{BxhcQ);D4{QfNahXcPT{tr;n_p_Vgdp;TE=$pp69W zG6e0tn|&i`quX;>2FK)W?3&A)tVF4`LG{k z8)7sg`5wvlaLV^Y|0wUb&s!gfc2`w*ra$C5mwfH~L}oflWk)YfC&ey*Z)|PFU=;A`37$jXF zJ;_XD$NN}My*(n<7rZ)?;|Y@#a1jd_K5wsxv46q}x1oCWn)*9$arWdn#o1}BlS%uU zmh7jY% zmnwPME``;O@?JhoEI@n7s{=WEu&<~Q%6+xdg%@fQQM_VxM2z9kkLYYWnw;htj`=P~THsv@g3kyE=v+raGQ?Rw~_J^BxGwRKr=f%UP?~ z7q(euJbBw}HZvZ8M)i?xRwch6nd@YW{OybXAd}OX@kuf^IYkz&8&^_foBgtbP!M}q zRy-^-JDHmzW0~0tKa4$PLOw2=otdGJ%Z5I#*Gt*QyiS!au{mAjj3pfN2VT+HOh1PL zxABa<4|1ISKQhxyjAytUJM@<`9UO~oJY(`<^oUJOUiex3h{>nr$k;?S^l80b$UZ({ zt9^9B5>6S%@cR0kS2ROPvW)7dsMOp}c8z++{I`*AL zC8e~Cuzuo1L0ue3hq*m64>b(JaZ)&%yeG?SUJLtOE-ELQ9anOq-ehRlJEUD2&Gcq* ztr9mK+7YGofA4TP>tu{-+=>n@6qXI1QJTJbhD@ox133I1Xrc1W$z7bp;96h>IcJ`xa!LiC-8j7n+V`cj(n&x{)q(7CrWk&s`t zoz84wyf8Uy7INnFggKF&nOe(bXJ)gr#p&!!ajG~oK9!vsFA4~8vYuS${%llmK+A~z zcKCH8aOcS1iyuE3fjhf5%MrM91nwMxJG(u#5xBFLf-wSj4*v-oA>umokw@A35hAY7 zj_e2#H#)K-MBG3f*%2acbYL&{zz#klP8a_6GhQga%Z~eg=S6-^DflNA2YbqUFTY}t zwlwsL#a6!cw6}3`R{&ps^3Q;%Gw`);)~s37eBP*^Jns+98_>310%t=5+W@mZ^UwlU zcB8J7zdd|L|1Y$OG_X80TcH#F_24l+h3Uof-OpPH7)*4d5zjw2s&@ zq~}U<0`=E?2O^V2Rb#XL3A+i?t^a`g{TN!;pAw(zhw1(_J1&JqBrkoWmVy@-=UP4(ANM5H7CxdRz(e+8eQX$PIt8EqL@ z1E36Zx6o(>Q3h8dt5+4 z=t%`!@BH-9YupXI2J;t>*cM>)z;lYh`Fua{C$AW1X2_q2#o+goFDAhpTfgxo7&oCj zvhNpgO{@kZFMSQcqce70^X2iCg5p}-oS#4cy^@Mw{A>Gb>Wo7`>XbYG`ysJ|?^=KG zg)YJ=TX`(zNecf=7iz!*&i?le!d|*KcQ#>&iW<+)O$Bb>fx(q$6ORAixRjOf1$q-$ zhAyUirl&8wCRYgyG=IkElwD80)l88)@7>(V_)gy+THl49KKgeoAc?^_7KmekK{qgW z$WAAkXd&uTmqqZ`mU{!eIVFqmg2fBzyk4{X!At3{fI^V|N|#EdfA5Y>LVcx>dgyK_ z*B^tX%nNmj0TKa8_8m~b>?({7DTlo+6|8^f#`h`vW`MaHhbQn6lc_q3a8L<)OVl#G zqJ9A519`Q96oT&50{uK;)iW`jFhJR}1ketvCt;9~7kIrdw$eIUZaORS|{id4+PHvPdFLD%E2TW*T4TW)H!Zt>S` zVus5b{b96j@z*Vv&EUGxA4cmIcWUpYvlA1rZdLlj=4jpGuiK1Rx0%tpb+B%e-n=(o|j#a}m7zm3){{<^99ZM1H2r#4@s z|4as%vqtL`v0m9+E)!s)8?9IfyV$)2>dcRiM69C)V*tF-f_1Q9^tS9Td}6;Z*i>fn z@>^>U@`BA|W=BUd=G4~KiW}xg>36tbBc??4c;A_70`2{)guVbixe2etAV!V$_uzHEr0{9<%KChs(;2Sn3Tlg0QSDpT@ zsi`pF_1Y(}2z4?>e?G-Q`7GIn;9EhJ0(-(ypzjM?TtKZVxH{OeBS0b7+4LAp>kIm4 zU$nnbfOhna81-b6j(o}hz_4&In-p2Oo4=ON-@PI?ELi``o73nvCwxPLa+d-jVl!qa zY{ZMXSh6Mn2fyYohy};65Om?+UIfsnI`@BX{gz7C3lIiIUU0&WNnc%|{mVHU3)0k! ziG7c^4CofAWBS*0>pOCy>twaX@1tCb6k4K_vA zj7pW5JEpU@yJ0%!NG5wOlXExo>G@v77VPfiF&uD_tc%b(v)u_ASl9QpjV~ogO9s!#gDL4yjqjs0q9QwV3R7;hliW z(D;`KhQ=qHjPYUXCunDK%DW<~h&lFf4?ks7L&b`CvloDa13Ix})&6C2W?lGde0yPX z*{Mk_?Cspouk8*z9PZqc-#c|a;K;aMTO&7%3;8)RcC!ct!YOjII5|1fAF=U?T=KTb z%y?v%x?amnAD5PV$R)+CCQlJjiQgykGL@{n;2V#mSxGqL zz#BwP^>u^DK9(2O0%JMP`e5YyBtqH+$9QHu6GfUm5|2pn$alL-%1BDyFnrQ$DS<1; zDDRO?bB|Q4kNX7UF_AFDXdv#IPI~KT0%Ovp)(6IBJndE=LzNFJmV8Lvt!EG#gO87} zMiL4b53o)$9caL^m(Z8g?hd_GcXjf7omf!&}&lE&X!-3X=UF zw|)Y0{c~Ec`nQk8+dQxR=Gm0Vgy9_Q{H3$w7st0G-R*p`3*F8c{ndqEu%}H=CKJwW z^VN8R-U6)M2^3>v!SOznD?<(VLkMi|%U&2?L2>=l;Hfxc)z~k2&r?Qif67X?PgxY3 zeesC2PTXE|O6@iLAw0GYO&>&!xu)yJA)V(BQ0@N^N~TX?lJxkVTupk15(Yg&3HU#? z_hnaRR_+eLZ&(dj2W$rkar|%C51(MmF1`Yuf_mBWG^qXXApw=eKGdjhG6tQZUtrr4 zk{!=ZlGcl>0juN!Bbbw6xR@-5t_h6(K9 z@XG_%w~6W#P|asReZtsNo~ATSq?n>UV@e&A3se3F;wbPjUVzqm!gV#LU*RcWWCx*t z`~urYu@7SR31dFUwXomKMtLte#e3m*wWl9bx|oLLJ%T2&4SvypQ6AS($#kmm11+Jh zV^bx~93mIU`=SbdfiC+2c4Ff%neB?x^*iq;3IA0Ns&4S`|NXF*!ALOqHv*noCL}zg89^i%DI-_^QXF$?K zr?U@NHa%ot2)ZKC(+#PKptl;k`M<=`&{h!R3FC>LxKn!mx#4>1X?BY$=D=<1296+8 zD}mPqb>m$=s;&NtgikzRyb$A0nCbqwSzTd zU*}J`472k)wj4k4>FkSF;gStqviV}M<=p2I!&tZEDxKiO;Q&xEZ$C@nd#ijrW+$fC3ago}C{3TDR|(db8UK{4o>%O{lzMD({P=(zo_Qkx@+-*P7Fd5lQ3i$$^TFYeKI9B$Fdj%SSo5-% zD*HHaHK;KGMU30~33rs96q}S-M`@-MU|EqWj|tS7d+D4>9oXax0#_>DpK##Ov}7Cl zljn{ETpu%T_l44ByNEjHgx!r&m#XG3?AU(mgm442&YiEOSa;OD4bCgqIs~8VP#y2f z{$KJR1@Ry~1do}p3wk|I@Ckf;YOK(2wT@W_i<)Cq_pVkys&ckNW>uepi2*&#aZ4}+ z^#Zl_BF7jixncqN!f*z_Ta5m5qsIxth zC^0#D9b#P#W+i+Ddv^q9>`by6!j4Tv8+}Byy56KNNXS>nR=vLpn^l@$8YpQjlz&Px0^D zpR+p%H}e(uuBAakc#O3URHr|o7D4t(dJQ-RzcLekn#xRrhiu3KH)|2$kQi3mT1qc1L+FTk)BdX%oeW3SrP z3e%%0*gkf5!)_d);*xnZ`X3*rm*Ly#6=PkhGz`0&afw-QYWomq-(jIkgM;IriibX_Ub}(~@EoiVZn~WY?Hac;ImB@3_t|%!x#phcg_v^T4btmS+W^-glaZIMdC5L% zg7#vb(WR0RBVom1ZNo(h0>YEfgo#W(wmuW35;y%oejbGrKxF zK3mKbX6S#;PR*_vQ&X#xUGYjWEQ$K`HF#Q4K`$O*rYou>LbWv0{o;u7JE4J}KZM)o zi5DTkgA?F`3NKO#VBx(+Egi{dtqGt(0Ef`YpixeTOZj3Oa*2K9*@2iH+=flBT0*lz zlTPNB(ZkSvOJOYSITLa>V(Xa#h7!^1ZEzbOEJuE8f9{6cbe^6}r{hfMD*O>bKSE35 zH}`Sz64p&qU2x5O_8qfBK!~Jq1JOO*YGVLR8@B*z^;2%5;07w0a2~(lz6fkR^HRpB z!vuB@7%~{9MKA+SS zg?=b8J zfXn(hyeee=xP$Zww|f9*hFxJaL2r&UqStyIG&8+lQZjJi3;IDfpTH%;uy7jdUMlSWCtbLoY&h>>l!nbcn?1JcEfy&tO{d45o9FMqxTTJ2jad&*o+`{Qo0gEMBgpi>muPG-;?hCf5{ohv#1dU%XFeL^eta=bxP;nYGYBcHEf`1S-u=1!63Ndk zE~@Avd@gEl`53gyn>_mZ8A$Pw8@=$j%Md5QLwAyrIWUb?=Dpw*(D_%29JqqSk1980 z(Cv!$&D;x8`gmTI(SDY&UoqVcb^jbMaMwaQh>F66r5Jw_k+hc5mFiR2M;6ba4Lw)R;Q}EAOwh0g`)f^jkl>gbe_!xRmn(@Ez8Ul2DxQ9B0D5d$F;^}A5w74% zO50tAP`L;yMBRkgQ(wBx{Ddxl$PFsLi3OV^pv`r5FQ~sigUu2s3dloi+Bt=4$lJF*nScVA0-}-1$C8iD2(bi~y@PAU>#0#`wO=k3s9XXaf)_ z7MuF{F9?DF5jq0=1?YXqTl{>SQlJk?hS&Ab>EH8Dy{%-QLui2-7e60gAtGwSCVWJf zSNQXqvahDF>yID-@fcJ1-uQ*4!zrBxNI!&~l-&P5%lX4=ghq{;O3Pa@F?9Oq4+s&W z?{ozMWX}RX8ZAT|BVlS=SPt~XY50^kKfns+7B?*zMD)oG3s_)Ri~cA{F}6!1K<;o1*5eiqwKKZX!Eb3Aw~kz>nU6>}ymU~gh7Y(XKF zs=tpJ(1TAFE94TpQMbsgbe*pgah3zcU~xCL|Di-P$w7${ zE^fyd>dJ;=8db7r7ft%7>tud|{bzo|G^;T{K>e^R30Gr#mSu}C%Rnr}MAFsLJj!mb zRd)@?By*KY%`wUalPnrl0F^T*`W*U*kpqMfBae1}AH?Nb{zxzkOG@bq@5&wM%@#eY+oE~%ZGejDc za91GZLca|NGIkjS5N!O;3OanpN~4q95c3cTPqaP9f_nM>2Mmn}MW<-` z_+s<)yPspt&WW%n1xooRSg$jTOaY+^Gm*K!2EPQ1&?6r42O|XPiC`RzWSxNRDty+H z-VltBcZ*s}N!hW{Ov6gcx;kE*$H5`0Mmh)c8+^kp@S+IBZiktRMyfsa@ zV8F&n6z!cMS=BrL^;hrBQ46$UY*>yRZ%q@XvD-4Nk87JoHx~5TZf}`R-=(Hxh2(4W zH7c7{ywy#Z7VklYk3J*nzJTr{1$JxEGbyD$m6`J0=S4XbKZ zHlhgEdM!G0<)UNmk{xR2uud-ds$JNOCq@Z7xpW3}0>*=3RC&u5UDU;R%bGCZ+9vg~ zs~fg6G$s#qQ#OkxxoK<~6{{L=O%rB1$0-cSdM;Xp4Z|#v+lI4l)k>w9_D;fX&epmZ zen^&e+1Q3yoh7VwH`L$NSjWdDk|bb#lY0ndNfKc+Paft_Ms(%wT}TCu%ke#*S4a3#L)spcdS^ z8E;_|c0&XMLDAUh%GKO!mG`c_Q6}?-t&-<84{^|*V-bt%yQL^ z7m1us*xz|zZLPuRL$aKUMzw0%WQl$pZ#@%sbQUMs_)9~wnt5~8s8lVpOx7*xyczM9 zG+{p{zhqnG>g2_#%llZJ=BwroU0o6PxM3JE)j-0I&rWfb4m~7N`>yGjTYKb&U0&bV zr3*U0VaE&b&Lr&mJb;N5=sc=5BD zguNfSjRu>=kgVvku?8_o$28+z%QH#$+lC3i_!n3lrq zCF(ovyC>{q6zC}{S*A1F&+RMUGa0(({#A0{h#4xFN!W4N+}))^574=ZG-_?9$WUM# zrn42(Ntj94NqA6UgQwSaixsnQ;brZlGW=Qx-;L8pYBpg5zi5^iD$d*eut z!rsFc8$WGqTb45{3Sh~oIt(VVu)7ymMicfS3U<+Sw&^tNVR6hbF*RQ@oXvPa>Dh$c zh$5Rn0me@o!x>31HjNF#sgZl@MkQXDdNyH)q{^pYvl$GDN6$E;T3 zEo{Qx4i#Ign8^*#rB$`}j7p819_Y2ESiVbEHf$#@HXt{i zu(!YfyXDG;QM7kwFW#-YzqBu1&@H1vSe0QcIAm@-VV}XMY?sYycW}GCw!)Tev&69b z&Q>f-Avd0|>)_DwD=_?!Nb9>MeWfzFZRmNUM-9+m7LSfvLL9+Ka7 ztn#{9jd`ggY|mHN94cZ819VU$7j}Ekv148&33~u#+o^68x9!rfl-Imtlq=*N({W5E zR&*qnN!Y#EpcB~M*dCze)UHaxPROF+d^C}XoyF~yubD~Mv6wfUl3kgjMoqbBM%ik; zJ~qF$%k;)vu2tfxp-jTQ!k$A%o}KOr^0gNV9cpXIqG3HSotP_{ba{qR-ZHH8`%(N= zgS4b~YpeGE_anLCnAJ*QqikBmcv+iVCSfOGmCnH097g-@=8i$FXUABxsKp-(1e(hv z>}s$&KR*7D$n9K}E~@GHoXY6Gi2?A)Ws=T4REH3Vq`1tC_ zLn4?9_Lfz){;_6~i2;=@JdYvF!AA$%qU|_gZom%$*{gp+V+0 zH;mm_0KHr`@%+fnP+EGD)yb+<80UVhwM{xVQm{*V)!Oi+gsWtZ#nCD;Q6brcT@z~D zRVxo7ndM+5$d%jQQG;T<8BIz0uI)Pmre@K?}UAtV~Bl*Hc*{W98W7>8T3Hu>1 z33m>|s9p0`X~#0i2mkrsOYz*2iG3G4Mmb(EWHMnx->Pg` z6?5AdPSY+QlSMZ-nXpHZHy%7Nic5CQ8GPSzGGTARS&e32>GhGkVV2FJwOJ)Mj9Sdt zPtxr?w~R{FD6syn!=mS~ThY6QQ=}GdyfsbOnRviv@Bk+;jJj^oa5l+}np2Kj!!en3 zP4)~9K0p$yU6zFXmSUx_v1>RV&-QbX)%@P7>7?hjxASHpmhj{fc0tq$47dR0680ok ztkns}ip>A@l_I)fRm*0ja-Z6j@kA+MA7K^8-=*UZkR(N_5M#?S%d2**#&o${!Y+aw zeMnZ58X;zpESmAUUgdHLy9N)o=*Vx%LD*j_D&TOYS=x&0$mWuUF;)2J!)V*xaLh6z z&%F1yhyUliT`t@4+>%_vZb_|Dd0-Ds2RvxmXpt4G8n5ARE|+wAgH51X9hP>#tVB1x zgxrv~9+;(=w^hPkh*2%oKC-G^snowrBQoj6fQ&njB^n3CihSR+N@UR}7GsizB;Dbh zjgP|*kR(OM2LzPSbd0Ulcx#%lC$qHV2nl=gh9aVdyuo1=CGPr)S zVdl+p#kAtViIZ+2)CClI98=lJ9JOAbox7H?74Ntt>=>|t7wlEmU6dZ1A<;y)9D^>}f?2lWMFx^?`Tf8w zT9rbzD}6#3GoBnJY{J9%F#M1lP9Wtb%jWvJ6*st+ zbWd+~KiCeR!H_I#zP4vje>3k`JFF@tX5nAb9m6Xyi`;lFijShNHD9!==xmZDJ9d0M z=|2ufEipz(v8a3 z?Nz6`K0xcKU6h2~k+qVYUM)qfN?&QY+ck@NPc>@qEd1yHy;focj`3tEVV`7O%p*N4 zB@HWfZH*qxIg1|Cm}{D_S5k!;qz#zCkgV!^rp0)HY`a)8RJYg`OIByu`evI-9j@*bl*kGGyl_cFJ)jH*33EFj;! zRVEn0{o3Nu(bSg0T0LiL$S(0u_XcjGJ!{{|5sP-+DF zJwoq!fL38$Q@pW3fQ#pr-TEXbPI28F)D+t(_nIu50x9@lxZ*5e!$@RlLd~r$f(Ga3 z?GM@SbnH0T*9ubhwe^fMEpcr#?zP4|PDP!fUzIj@sZYn}>;_V!arB%KH5vD0E4v{E z?el3M-P_1|jWW8Z+-!5~a5T~>8-dff#R78PZ=Kp8yzY)eTq+no z(+2#NP}LE7QgNuHmu%tMlBxN-x3VW9v?V6B!pW?R>;^J+uUD2Y3&7P0)Fj^ERY><5 z)X1y{Z9|;s_d#U5r!&6kfr$l-PO?pznlJljkcsFCcZO#3Ja%9bYY1Gz*bzjWZ3~;~ zbz@kJe-=t7tfQc0V?)`KI7u%x*eTEuqdxMLQ0!6Qh@K*9uI*BMkX|Em9<&Q_^1g&z zw$?&Q0h!gRW!JiLigc)MVKmDTe1y zLglCYIIfdeb_Z)e3*o$ode<+gSBg*xhO1YqM5V)Mw6?%=%=C+{*B)`CEn6x$T55`F?giJJ<~*Y2n(l+mgyJJV2~CVaI?HPdqgxs4 zj4lGqoJ~QZ2u~wwBI(dImF*O0h{KMd1b!ZvLLnmnabe!*f=kg+|On;)n<1d+q9ba$=u)~DUWrLk+k7$8 zNDADDnqoTPnFtGk4RO-v&`266O9Koj%AUk!%~pX@enU*!GmuSkImMZixQy|#eF?LH zraas2YZLlD2V#MAPvR0L_P3GyS;>Oo6Znw+pkv3BJ1 zlydQg`>2Xt%%CRCo^Um3&_YH(Y_=KrDWbU5NR(=7QtfiTk1X1?f*h^V<~0?r1n+o) z33AvIS5NDpLBQ^iUV|nE){f+FtOtcc_IXj0a)X!O5O4igz=&t7l3|uB4PJgT^7Qi{?Bxvr4NR?M{g+7N6hiXD-pS8AlI8J5c$@+&El=5;fN~6s-jm zH5xEg+KhF^#{Q+&2DkN?n&{dqu$SKulWLi;4EdCrn&mp-D{i1k%Q-r*N~!nXjhG?V za;ZtOv!I1>jcSdiX2iBmh)UMYW4n@2Q*C)HIT+-~q~^Eg0m}Hh5;Yp42hBsA-KTP% zFBf8d!Y=fpaf^1;wA0E5ptQbx(^aZH6}S|Rnx9%0n^vrormWHXdD4Z4bAl%vw?s$H zWt|zPOwyDUy2poS)(38LyCdls{59QD{4;a*iYLKFP1`{GV{>bewIu+nQtefjG3`cbUI53fP+d_|OOJHMm4K#9$39tHu!Q?;agNGv zuBbVweL1s8xbfn5^>9NBJ1i-aP!=UFXO<$?Y5pNtZew zXV*J72|&tTrZ<)q$?(gkv$O7Xbbj6bv_Ca4;be4saeZ^PKj~9?7tXdX+nrtGY0ANe z?jfJ-{&oA>S6=&1_<5LxAI&+P`S&ijAKQuw zKi%hWILlpmSiZN_``deAz<u=SS|Je*#cT0|XQR0tg5IzYc+cuK^D>?Sd z?gK>eDrwJV=k(Z4;u$;Xu{z0~ebIqPNQ49e8~~JB{p+_tbz5u)658!}T$9UbNtD2^ zz(U6^u=HP=f6KNK`ng4)Vwv{ z!B3?5{zYwV`(IIH%9=IQj8w}cTv;jIPz!JMI%;XTrE3-?<8cw`;TSI-kNMrrp=D1Q zQLR?IWUp1(HB4I1z>(~lCDQ=^#dmM3?_cP*Rs7<+8>-jLe*fa*#Sx7A;=Aapp)mF! znE41HIYBsH`Rey))&iL)1nB_5{k5-+Vb7NHPhn&y7=z1S8_7yZdqbCkeZ-NUaD2S@ zwNY63?Fm6~LeO70UXH*1R46Nz9q{I4I2HF7zcz|eHSW?0#PkH>;hG=A{r6|5@7Ii0 zOy5u3p9k?c>{$Tu_)`SwzZyaODT3r*jUaiDcukba8bPoIMjg6vZSe>x|g zL-6O_fj6L~Ps(b*SPiQ6I|4xw zErnV~8>1xQ5+(_5tm%>qZVzPF3Hk7jJ9&2;>Ak7|@S9uswxnNG$o-L^G@JdAAh-pL zSuTpZ}U-Yd!G9C6eONUa)E-urRb^y6(=n(`#UUNxl4<= zyVjHUl0LdlsH_OnT4~ZSV}LMNaHA8c*Glm6fRxVZ^Xb&e7&7OUEk3Y+y2rWr z0lvdDP^{U`ty`o#J$wFw?TKFWM9)jjTj#7`CpRhbFQE6(TD8`+t$DeaTcttlqNFlT z$Iqtn^)K%iuY_72BLUc-=PdgoLYLIAYVp7GId(eZ@fSQ%<}Oo#TD9iSr|$~r-)pdrpXsjs@7|#7;)0|{FV4X*Kew%%T7>@ z(@Iar&tHr0L5eP}jNxnPZite;Bz?Yt`ipa+6O?4d)5){R`l$Rco7_qMe7+14__DqK z2B|3kkZVH4T7g4dHz>kB>G=5;&b3xnSs2pA21NJopg!XC`Q(0hGru{7Loia8jGymQ z&6#mq<%{=J0w1FlvRVFo5^rkl2y*ZRRy!b>d;xu$O4BNB7w_nSY2>^*d%m{(6|RD$ z;X7KoD4nwRwkt+DzktmDegAIp0DAETgsMd!lT2qm`Kp?h0ebhlQK?6Vc4SqgRVS-7 zqHN90E{;cSwZcF_mii3w2ha^IqgIJSoQ`t>eTJp^~x;1Jv)xVyW%ySoKqS)2-B?z(9&+(d0-Hz27V)+IQrs! zcjb%X0%1NJJwd#;w(B{f{N(Aa>uCc{$X+aRs9z@e5j^m&n|}wqvO04ytxEd-+aVw%}WYtowAAhV=uVm3vs^a_} zsW2`2q_yyEOW%N)_FBc^2l*&pwAaeo;kPyxnEE+ElG!5pNwP*8#WP1rAVL3Rk#$;p z`VX33piS#x8;TTwdta({*hWM7DK1(W1M-Qm%m~F zcjkinnMgGsE7WmS8CH#Ya}hT-mPZYsV(!H#f47=SP!QQBfIDHXIq)7*<+1mnF#9L~ zyPdM+`?-Nf-PqgU&abs!f1a_0_S*}s9=bGbr4Sn_fP9na)iLe6!c)HP6vMSn;tdg? zC(co6R@UheCjBX}0Uuh5fyFR9G52Lcio%l|XWmB(>IQFt75c5cZyHWK5SY{%M}syUSn%`jTk0B$W3e|ZBr5kgip8!MN{o#O4KOeXIM^5UW(Z1g2Qpz$# z$NUfk{@j}I?IzTzfpJw=IE^BaWoxR4fEf~ErjL=mP!8>nZw}q}m@dfMfd&r&gvkS7 z9P|+SP+b764>yL&qqNQ1gT+4fuVl;Sh@H0DrS$a|T*&;xyQ9BfFz1CcXuqUa*{g@P z*-`q1Kh+s$YB$lNmFw&gNxS+#ieDM~%|#F6FLc}4bwi79cVeT*HQd2I#*U)gF^PO~ zqxJsyje33)UkLjX6DXYhML~An%U(iJ|Nfp8SKr5LacVI#qs4XD-u)@WZq>m5$u61m zOnkns<8wI!ceZi_M00J!Ht7KY`_lti2-Aiq|krE5WR~~uBRS{4m zDk6Pf@)p+^faCV66pr8r4*>klZ6e<-l+Yv{MSYxcI)?2Io;&Fwuoju@O#uwH0<*5@*mrVFr zaQl|E#mlAsp=}vp5;WRdq`FXU{PbjD%Aq@?#}UO??BwKcOWv3`tRzM@&fZE4ynDz z1&FryQZuFU^ydp&t2%xR8pWR(!u*Z{OQ|grG#Ea3HVGOno?!*87p;qB%!2$*<6-{Y zOd?XmJH@s_r1oNPI5xB6Sr2Ulm}C&|VlCg|xaYfpqOs?;VWgE*K6e>gbsOsqQ*R zJ6{cjTtW}AOzf|^4V#7ygnkw&f~ha&!crq90T$`wN%eBYdfYc%dIUEwNNqDA45Ym; zlUKIZB&b7z*N&Q$`y+OL(JM_GuO?3#&4kA|U%e5G7)jI`j$U>O`t47>1BOpE9+Srt z_*-Rcw;KX*7*%MGfuL7>iduf`Rb=4*_1Y!#vmib7P?aOX1UCGaESO;MZp^?7A;LoQ zfkb&muWjU-8SAct?*&sW8MS{-P?=b_=qvET8t>U9@dB%<`+J%-h`E1Z)MTa|<3{p! zj4hJ-hGW$or)tLZUV#GVq*an`P|*>|`kScCx`H99;%X^jkpI?@*s~m2?3U0mHU(m?MFflBQX>irgN$9R^IVMxHB3Y>*6r^OR6WQqw~S zg+$i2?KuXKV5Gjv5jmipZRMU287rJIiVj=8fL5+p*uV@k zphosAH3dIJ1PueoKM$y?Ogxr@6&(>-rss}jYZo*aibUABD8opWB>0rIw&-UUjzi&2 zt-!W423SR|wC$ZwC9;Z^X~4ccE{pocFDASucG&FG*Wo+Q}*Sx_ZgXvbRzOP#%|Fws!55*c#O zvIM0CWaic}rkq&znJ#RSMqy_BpXMfCI;OQO-S^08|m;(igm3D_L%J@#F zkNDf0robYsNTwB*t#k*k>WnNRjj9`3lgwVZk}uZQ-Xo7DJ}VS|VFp<;v(Kavzpi0n zj)hg|C%qQP^ZQ!3H(!SJc!AbT+4X zL^?<2ATO2{2qYr}iO;PH+sVay;5G81x(EEB7KnF3=%#30jlMnsmkUt!HS&5^u)HO; zXk&u0A$n@hv3xChL`59*^{~nYRxchU;6v-XQ)BeCNe%o*7Xs9AOWe59n_%xOPzgCh z9Wlx&MTw;-k=^?CSB<(eVQ!E!ElSB7s2s^|{29#6+f=;R+PCUa7Qh-@wFvTS1p^dB zTCM{)sOqplgKSeiN&ly9*x(fW3h83{*z+qvKmG0zObY{43`c!5DrAV()kq5HQJE#{2hK~#Wco`}^o*BRs={G_$C1QmmTaUa7N~1# zbo2Vdt>aD5h7@vJ5O3s1Z%22-fc))2v`0tbeEbD%|u~E_dRoDj`~m=#Z?u@IXxPRq0AqlAo4Iqr%-&^lpkMi0Ze3tm+~rBHYi< zgz$9%SJ4_I7G)WfX)$!lG!AuKD+rhYtX$owb()0sPplq!7?;N)xf0fr9aGo{6Pbs;DDmTl(qi77t^6pSyp$7h?fMLTb@|0y=8pNL5~PxV zwPeO}{t^x~ga&)+^Z|dC3R7gEZxL)G1JoFg{W20f(hr!gr^|R^n@j}ifaaRYFF~JY zrOwT$A{%bHBUn>8?FB+fstaJ<&;6UuXG2Pn~>TPUw>J-;)67I+)A%1l14>U;& z2Cyqs!^PTZ6moSI!_qTC^;RN^#vSn%4SjFf(GqSek-#g3bR4j$MB!SyBe5SVMA+l_ zj!#EcP_+~oyUlj9FU(5Fb21aJhtXG2^p(rTBy>SK*Pu~ptF%-JeG6gi%@ax9?+5mlccSDxX|jql7RFXy1A?k}on{NdDa?5$L}V=r z`yWF>xWH72*pe~8;NoXCs*v)xu`Y?L1Iu-3et*ff*;Cg28VB zzp^)@4;BkaO{D3P`+=gj-XoF8MeY)}bk&Sskj6!%eTuUtORYJ8Gt5{kXnIZt`&GjU z##kZ6Nl(AyD8u2<;&VdI2M$!?X0laiwz@dF6iw~@Cwy4FAbh^HLnKAiR;~-%I`3WrLWxWWdyGZcc3xg#WrxXkI zi^kGCJ%zhAFAWN^N|L&Trd3w?VF&tUt8tqU!gPqaMJXO!>iuL8ssdt+h~kB8@sm~h z9-MIuF_#<2^C{6Bs_y0%oo3~~Z^A{VXEH}Yc3ciMvM!+%DE!(EwoW2oc2a%H@xY_&{b`c;GEsBe z>#9m&sFU@CeDq;06w=r{k&hKfPe5?zOBi9Rx73oh*Zot5ZkpKo*s(T%bq z|8@wBGhFd5cGh!RDTymNh*_`=6vXP-lDpd;pFe%HV;Ym*v8ujjKQwtT*Y!1X?r`64 zu2RVzcIalJ1WI+(a*;d8=)xf%g$H~#Ok{U>s8#v)krCcq=evcAV^}jn-$2FjVWfw* zzW5_ISX<{8Uv=@*Zs*$()}(-fGg@RWQBfxobqC$E(z!E6y?Hb1j)16xfP=37@LLnB zb|7_wd+9>wo3SdBO!y_nB>(DOW71n)L)`DAD4&dtL$Is|gHs};KhILtInaN|hlTE7 zi<^tA2+b_%AeI)J&W_oNzq!1N^`arND*Yq`6BJIPbbi2fF18i1-C9SZL|B02CmGbH zG<;ZtIDqeq0xeZ1BTZcHnxTTfG1@#%moNSWrfZY(GguOdA-scD!%@S4xxzc9J4Zq* zwGVQ@s?|lSI>@Yw?Wa8@!PqGe^;J1!$sc6M7fnimgl+Ig`0z7`Dt&!q)E;UdF~y7~U*?*44X=Sde@m_`evprR>5(>shuOxZ5Mt1AN*h`(I4!twlU7EfNDl$(!6;Yu$zo}l5f1}p!;hh?(-%kcn;2$ z11ziOb6H)kKe}2ad>H!Sss8?vP9SJ0NjYD_3ND&FiI&^S_d9!UXaBhlKrTtC!3uHNzen=Zlz(}4*EGxs>s!2D90yct zvKnTq(uW8riqgAyWv8aRj~v*)Dz6WUAk!yVG2lA+?0s&gz~agbrv#2PGG$9l1*!4| z>9+F*$2E6oWluQ96|FD}(U=U?peI_i@BOxsnVlc`1RV#%R?|!#z85*`#T-lax~#_U z7qQ?aWqE*+SYo2rr*OTiX=M>rG{SU$zwYMjKoj=>&OTA$N*c&lZNsB&m)rSy-SE1N zMXyv?JhfJSsJ9n?C}QY4ME~uucRvN+7XUi)(31=Dh+soXd&~|SZp?ajG#*9DEH)R_ zHRLBk@={B`X3pSqPdTUB%dR(zO=$l$bYs{lIJ;S+VzysK^A2$jxr8arR@z9lqY%z7 z>*_SL6%I?T5sbJ~)3sELgzuy)qK`BPbgD+|3WqBtYgWu|$Wp^vrB{r)d?k;tX+P0Z z*lhw-(FWxfJ3xWU1Lj6-;_#qu1+~RJ#R*aowe(oD1(ZKK{ZQz>6I~$~!>Vd}wfGnc z2v_iWpkpkkxftY}zOQUC_N7C~`sF2h@Tf=1qjnb8=PctR`Drrm@&lEo>RXP+7kN_0 zYfpZ?Go?gSHa=w*z2eA1i6EPOLl!GbjZH_xt@Ce^M3eQBKU+25rZgUxYG_d1Cy2GQ zgVrHZeVfvG@~GP5O@Y0NUU+Kc;8BY->v89O4v@M1K}tb(QLoW4?nIoCPihCC<8C=WzM6Y$t(nm^IJK5SMeb_WUmtEWK)*h1x&kN7 zYgt<<8*pGQoPamDYqJi~J7*bVZVzLkYt*p=i4BvxNfxOE>S@P^6OVV!_J=L~?;bah z_SjtZemNW9Yg`M(wZLPD3k_Z|md!)!`@z<28@rsnXL42!yd91|w}1XG)gCMEs~R8# z14B>+2Lo;Xn`)cd**V+VIh#2BH`aE-=dAyrrGDN20b|dlmZ+5_Yhg3!un^l+l4zZc zjb#eG=idj04ki-$a$m}vOh*F_C%IAOuTo1TZIYk;?rVYfv;|@1EwwyeXgdUr>9OU6)t;Hmed8slA~5L$I6aCAJ%ZexBE zICXjAPVnpLAo2vWAuNvR3YVNS<|OsR^Lsf5O^Bwb6^H`QupoV|vKWSH@v1)$>3of0 zb!wS`Q2}gmE?!wm_D9(j{2>;y;CLk!y82XS+MCWU1DHx!QJh7}y_Q=zdolbN^`2W& z&C4Uc_9i!@;_{?vKe7RQ?yKBJ$EsaZj%xF=CB7v0x#G>Qr;xEKmK==+xBYgFN#XD! zil4{!>v}dWpxyn24VtgyLZvVn{J6oN(f0cG%6y_iw^u{^t-;LnN&Cll%KqDORbscI zF3Ni)INkGv8Ezl`Y)xE|gSGm8%7?7iuh^TtR_V}@?5pigQOTudlLB>s>8OAsk75rq zLS@o_L14E{ji#AKEBB`V3xNkwqSS;_$U9;GJaUf$!>1DQR2e_mbB#(_iTrvvN7iP) z=c!gd-yXl_AT&Rq^qG!~O;4wBVk>8j)-F z_|Em`X?90Vm7!)XbQnrd<4vLkgFL%oZ`l~==i|`kPPtfx2Nd0#VUq>=D>Z3y_lGCd z9Om}%wEHSz(t8Q9%hB=?3jCq-1*2|nWeTk=dKFB*BR{@Hnv0tVkyA*-l&74eIBmG; zwRWU@zI|qq*c!cfz%0rK6Rd&7q=iCunJs{QE!sWQ;!4xhFfowC#z%ek3wjBkJxqE% z9)COGCkRYvH-7WZwVa5KYGveCfb))49Ws5smF%=^BpvF(RzLSQzJa>4pph+Y)afks zDoMCKIeT8YF>}WvL)x4f5j{@sYSLkzd4@9nIPHDyCp_xMN3Fo}kzvVx-mA3afj(M) z6-yyH??_NdQ0=Ok4X?-KT;(Eixkm#)X`Hb3T?)1|Mt&uKaQHd_SCtkwYa9yYc@m?# zCd65<#{d;2Gf2Z0ZU$VMzWk(zPlFh89=pq2#znVvxVA7Y6z6Z9&R8y{;aZTR$qez=hQ zGihNPLLP^fMl+9ltgXH(+?lss4Zpr&& z2It{5rAGj?U#dso3-ZtT#uX;MoiPR!<1(5Gb{)<7Wd}=6OEZoi>ISftC!q-Us#Kq8P85ANO6!|(~B%|3+mKeDb%N$>rBhV4|ih#DE z;t7QTKP=1D_S!9}-oyu};RC%T({3S;O`t5P2K;>=_Ur)NX4lSdGX!X9kWgwSz?oYn z!evA_1P^B^R3Cn77Q~~Zx!p#nY3wAgh~UP#!?uaigKEEx|toR?Zv@_5{&q+@VuvWol2S z1%8oM@3=mJAx=3)1LLv64|>?|PBIZ1p?$F9IiyNvNzCx1Y}rq9xT`GNVt&zORZTnh zOnBcK$Y*6#=`?5QW5#S!?AVfD>*cSM=68sPA4ArX=3D}iAm>{~kt^3{0VsEZGR5sa zZ7pMOlRJzTn}6Qr6xvRXBYi4ITtWgC`qFMYOPf?UwPC-~O_Du(T$poA*H%UQwzjuN z>rRi{hi>KV(UFEyJqJu@TA+8KMV}Z{L3kjUp#n@Cc9iMmOROj8Jc{Q+8`9>ljHY`c z_7=GYTKn1tZwwt9ckwrVW_~_$`XzeV_7kB=n@$J4xq-YK>Ny}V()x^Bu4-0$8B-*K+cE7>20{j z%psbt;sTB^GqDT#ni*VQ@4-{M((7c*UC9jjZYuv?mMjVl*;A6@h5{)Z`VlgQV>HoL zrpFM3fSeLWn7;&A&7?{(*8~u$gW;gW!g~d$ z@e=1GkLvZ}?wf&>ud1vRwdx3$T@d&LA-B3Ryc08kH7y2#>32lYwd$*9ghBIBpIDMU z)h9fc*Z|84et(fjh)TPh;ZF;0ob*1`=^kd%p}oC~-WFk`eF91w^(_@9oOb0kT>lVY zyZUXwKLl7U295JC0eW(~~-*lNQGNy8N&B@R%?2omc-$fQhcHloignX%(D6)0_=f)hOVPT0SzL+`x@I>XTHI19|tM>R0P9x zc@BqZkoqd$DH4sZ@b`fw&mqe@T&BYx9y`IywH+ZJgB~qW!{od z@X{QUlla;-$vGMwq5&@68)SJ(!#p69ZgJz1Yg<9t9 zf0}9$6n_CqrlL$ipui^NQOPkTf{ogGRKKKj_cV&;;XzK(5NzN4<|O`ubDU#M72As$ z9-f9FBVvIw__G#x&4)6@p-D|(+Vj*YpjDrF3LPPedeyF-0zU*saO2{+u||_Yhfkvr zZ8r*_ry*}i#BJDx4gpv01Lsi4#20FT45>^X3;;k+V2f{4VFBe9jfzau6GFjH`Zz5< zU@b+3OjYphfeNt8yu^rLHK@)oCpi5~sotI&2yXT%rj?kbXd%FH?_0Gva8|%Zfu+5K z)@FQ>Q5{k-*AfQ;#-ZA8ms=J-5k<4KXVbpVg;3V*g{r$uoj3m5`!C^(@KNIE`Wo}D zd|*M!15%L%qFe|O+Op4)>0*)?AF`i@R@)^hxZ(BI-165y`-{~I__m(0>lG}m@lH9Z z&ZY)&*C;UAo^<#;f~yZ_fOQYRmaNC)bGAT)Ng&L{FXjc?rK=9(48}*Uac)HfdWI|92s{R1V7-Q9`1sP)Lq`YHwk|sW7(XKLaBp?ZdDH}#Acq-RBA|F zL=?}KCko$Ku#OVG!4g7VVv$v}w)g}~Gw0n;o@RxSU$^E4*k@i!RkSFf`Y!y5O0k;V zTR*Pwlnte^XmMrV9x>8i_Mk)P1bl(8L89IHMlekdDYvEY1$uC7pF|;d#8Mp|N@0_C z#3-*O+SMf}2x{k+WVAo&C{ejwVM#+&-x9sUbY62i9x}vE?*7w)Nxw5=Fv&ddL^`%G znqdm3elO5Xiw4RBO}vldaeR|U3=v-&9s|H}E4X5?T-&xX#TT2DntK?mQaq0gnBvtR ztNC6|pLqGF)1vNV9Y;w$KJNi5?ch z1(*B^{(T;wY+}(PV15dphB~$WL{PBCz|(I%-#?S`aQq@PNmrFQHZVfawCd9-aP^8E zx~lE6d4se{yNo_@cuPZ2-$Bw&VQgj+Vu1LplqB;(VkJ1L+n%PTXGAWs^&2<`6G=dp z*txw-&?rDBV6AbjF7`oUglwWvCn&qAAT#okJ!?_00F%xxms#7TXVRvK zuCk6(gh&jOCN4~;;b+ov4U|TWs&y5jd1y&*(!NeH$=~~___2kPU9gBJI4zRXkJ)Y!#Ba zK0S%<5JZFFVoBIy77{#oDim~;O?O&j%#4Kl7u2^E>#b}oZ8i+-2a^EX&T-qYA_FRf zB5TN9JUGCQ7UaGermp^;Dp7s8prbbCzg1!}P6b)#?$;Gar$E1#h6(_D*Q_`WfaVY8q z+y;Qtsucx^Dhvfk=5fPr*;;m}O6%&w|1s&T=8t?#bubA_68P!kLTw;{qgUZ_bgp^s!um51=|t_+2j zwbI;X>H&~f&@a*?NEkMPms!!MZ80YQ3jp8T7!0i76fGtks{sF)We*ti00oOkO z7-=16!Yagw>wf_7X9a(xy}tlh#1I^?M4}L}W0^P5ho@|P^5X3^QNYmfg}?25ZJvf83(r?v@Ch#f}Z=1T7>M=r8h~nz*%DklR z?AW}^i&7?2!-u(;gz%ebEpR0`!w=`Ns_;y}qB`-t5hN`y(LyH5?EcgQr`-!8Z$i@~ zOy|-KDS_F=fdvYvqFY}*#$B<*@fYqo<7(3IA|}QmOe+0n?Z?%qUhr@IrNDk50cJnJ zpg@MQoA(F*y!t{_pfB3}FjJ8vQMIzyiOS^Mt1|}xxd;>Dg2J+roUdmbgf%g*krWw# z{dTW2!GwnV0c+4bpTr&p1_wg5k`LLB0;O?>kl`-5GBY36!#JR5X#Ks=RtXQfQh!vLGMbsMX>B5XYg(pjw~ViWwJak7KH+5O7e z#&IM#DB)a)0isbsF`8&FGYZBUzO>7-T9z{}C=f{&%#Q9rJw0o-GNyzSc2qYGiV^qV zCz}aC+750dZY>_uK>QNo7u*HA=TIdZ?$m9OfVSqTJe`Kk3_8p=_t0x31?wq6ix<^qiXuuJ*H zrvqDt5)*mw3$cM$TY@E}q+L3NbhRd8-mPGioZXn_cDSE0cp(aWau^4fdvP~NST9(CY@AIx3 z^gCNt;R!*s8)5aaM2|s@4}O>SVS(0ih5c8A!Sojn>}lWh8z6$iyD?rXb~`#9P>+US^7C?v zH@BXIoSJBcSNv33Lgco%7`QNgsLX+{cZ7pr6Jgg{=eV#Z!4ma*M$&tG(CZ)m8+5*K zaPL2}4&uLVHqeD*TVUC*t`9_a;Kyh(4328*GGD7xwV4v>28@TnS@5#cp9o?F6r7#_ z<;lra^;gQQXp95qWmn_d3OttWy^$B6G-m0^W!eK`@t{aS^9HkCa~EW`hMQ!sVU69m>O2SFxO+2sRTQpyy{MH#u_?hDN#VOirNE3V z--1v{{XVv64YDO4wUX>^U~O<>6>tEY*PG_T-{}~PMS2d+9Zn7+v3k-+b6i@eQmPb- z{}gUC8tUs%1PO#jvgwC z<%X6Pd(gJ`?cqMEviG#mL0Ff%ZLd=Iv#yXym;3nF{0HQ_9YBh6e`r{XT~D3#Pdntp z+%{?4wj-O}8CbUu?3{54qD!}TFAmbr9J@|481uSM7pxzwj|Id|3L+QWKPbs#KHGHs z@!~KR-WaZFiP9_Ex(9sNmmWQALkwxY*}J&3wH9SI*GyYElm{QJpDJ2s)uvobt~DPA zReKaRtrExgGqj@ncsgCb^x`AFCO(N-y=T0#c-1lfVrkdtbfmUo|L%Ckd=^nVdm+D; z$VE{L3FF+?jn6!s$@Mx(L-I%No4)$yH6k6e+I*-6M#P^bHL*vt3wdD%hRyZd;-_0+ zr%TvjE)@k_e;kTZ&T_I%s&~2TS6B_Uti3P(d}(M>e@d??j|_rB_S@0lQT&_j4dS3Nep z^YGT}0$IO-vpaF;i`NeE_~E!fW@E6qCGIDJ*i9iFa})YZON`BO( zBg~Qb42GNE+Hbp!FuGYc-zD6B()w3}mV1S0A|d@3|CJE85!t#OHr4wN|K()6i>+H_ z$qM*~{|apqs(aZ?-+}n=p+8Y(OBlPAN=8^0i2s_p*!(a5E&t1ZD{cSsU)R6<_ho_| z#D6U~I;=XiQ>JY=c4}tOiKZObC6CD%Ny%Dd2Z378Kj!k{ar@-wz9n^tb^FEO!8bM_kn5JJVciynpfp&)js7+EHuTo_ z>DK1c79W5g(LjvxGus2Y{SKbWuKkWTdKEzz`4d}K=!%z;m&lH!ah7gY<^{^HL|PH< zHe!JQIqyR1=T@@Y=hDmJtW&wNAj*&1(#O3-OHP%OY%;Y>q-hz)@^#bZYOlAP5fyyrl3oU+i|nQa7p=52{UgZP6u~XTsbP6dXIf@B;LRiK!l=mFzlu;aEhYGKRMj88 zT+6<>ymp^VM61`Th;NI3SC-bPnXR|vS|;HC0AB9agr*K-rbV}L-?)`WK*fI9iKu0z zm!U+v%fpnk-t9$=}`DTa&Z6{CK zfrRe@uPcX>)1K0jy+4F!8u2o5EPc7G2+!l4aZ7-0udxhr`#t=50~+(TqIIQB=dqKk zm%g8Mj6nQ%vk1h0?c|2m)7;1?Nt6*VHsuejIB;RPS+@P7a}VH)N8XG~3l#V`SJrnMva14IY^_JCv78?BzIQso|2b<2 zyCK@9aV@CGC!CVnSvvN7+;w7(*KEHlQ>;VjlPz-VGbpdS#{@07zHb|VgObrJ8t*yl z*6dh6m?Q{?ZK5>uz;f~F07fwAb&=kRcrCrX)3W^X!Ch`Q^&=}WI-!kphxTbnQ!pUE z>4WniNQhdzeKyQW49?5QNPPaPLLiD~O^cnRp*R|vfG)lvm%MjPmxU1()&JP#qPHrF z1Tl$g93@?+)jd;-?F56-k1;dm#(g5VTTh~Ytyvt_l+6{pWp}Mu*|XU1^IMEJ24D1z z_LjXXrzgA52qVb9;U}Z58=jlz_o*wF$*b819{CGOb8nqBO1cK+zX13Y1b}DlvBf>! zYCAS58yDf$k~E?LkJNh4kQc{XVh)co2OVAqbQc(d`oqh!PsW+WR1+pIbMHADdTY-v z4g#_{U>6WD7p2F9-7&k`FE3dWTRHtkWUoFWs(#`4zJy~*yaHweVuP*Yn;)P5F96oF z+K=Hv1_PV_4GxC(KLFU)#m3OY(Zbg3FZw;t9=F{ULmSlVXQ~^-{rPLDC_z$CagQWw z+1h{1aI#(|E~##`jFt`*P>`=N^E3Ub=-HnlTqTtn zhWTHwgJ}I9Cs}b(&%?5bwX-G<2gzNoa`K7R&7Berk9Kl@J{WxWvwd&x)jm(upZ0qs zVvEbe2U+`Y$Toc5{Gn^ZQQ0tU&etJ@HG6+5`gJtzbbtTg-ntEko{@1@gQb0_^fP?N zC%1GSnkqS36aXno zu|Ibk>YC7xU#u~e_WMfh4t))6l?l9^@6{(7@=f_t05zBl#X1 zv8^uJ98=nGldJiz@dzAuCAXgzW#Ox|Y4~ZbAyAzj3^@E68>^7jSch+~C=FBLSk7Ma z0_7lq4s*$OyTO)g$U64Cyy(jA5I7t?o!`*1JUm~0cl=|})O>s2JMXMArWCcj+;Z7q z!q1nBJ+CvHkM?d+#KmtZm|RhkRv` z=j?pxEpOM8m4~fvPKVE}>Ca3xJ6tP)OnbGBoXpK+vzeWJj`(p)-Q;leufSa{Yy1I@ zyOErAJgi_W#*5e-y~)F2)5}|(o9l};KfjO3k3K!q`E3tJ4csc= zLhGvk$YU4x{Ms_m!};;z?SWj^G|MHU=bn!KUO`AtrI@-jgKqdG^8|Y&k++g*=1 zZ1jlE(|I=1d0c+1ytMc{a5-t2UVaX7@Tjf_rj>;ael3w?D~X7OY&+!p1--A&rv4U| z4n6PBMkTrm_i=>h3{xbu-S0>32+%FxKp zz&y0})l(>G;eP0whC{-<=iJ2qxDHWsXaoaNp;#v4Hz zHVE(Y*8q3yuf6gV@xM!2ObunMPD8x(&eo%2G&s^1ud-uw5wckS)P_4IqZah<5~8W^ z7t>UB(*rpSZq4=uP{}{$ou`16JbDNeF_ZTpRQ zaUHBv7QWQxC9WZ|7@6gg@dRwMGh20epbkcW>O=ZZeOpucZ9vRC1#RXMA1!lNVN83% ztp`Lw);!!PM0031(5?S>X;sk4hf#3bBhtad&npxyVYl^yf6(9be=Px-7FMYL9P`=# z;KkJcx7+9;?doPuejBz0Cj=WH6MXz1>kNPBf0ve_Gfz9frOc{YvDGi3hX^rSM;sow zq5orwJ0+tP^v^-hU~G#mfaFLET%LugDsDGEA|oEb|2_5pZKQzU@mDGAC2NH7Z7yeS z?AFqM_2h2@FxX&0efnGCn9|-vRd9%7W#-tN?PRjeB`gyRIlIPZjlJse`FLMs_`GJ4 zS<7iROJ@-^xR^3%ok3om{zw({Qhb<~zT5PBrKWdB95id?cSo3d*tj!Z)BAO#bM+Tw z+fMaU-D%z4C|3SfJ?5ed;ew*+%ZDh{n``&Hi~0p;K9pHfkJ}#m&-LEffOR{l!54uqw;+Ai${~HV98=dDVK5_Et1+9p3v748;An}8)t1FV+{|_1ZW#Y?_Fi_5; zr+bMwU2{w3_PYb2|1Cd2Cbjv$V#nJ32srL*Yo6vv%oEvMj zgM0|nu0KpCj9jl77Amc}wdS-gmSy&lQFyxrP*cuec6)g3&y1V4G zt}~5ZIPF@sZ<@D?5-j}X!{RHfVX^Z)r2mHwCm)>lCw80vhqHGKuPj&^g=0-@+qRud zjEQYbY}>YNOl)gn+t$R{v3WD+ocBHF+~<3~ANNOh*Q!<3dq1mdRd;pQssa}Rw2>^d z+ce_yFjrRNG!4ff0@@W43EQf1zI1)Xnb?=^@38q2+3GW~FSUBwuJARe9X9vx^G*{( z9?Z>KFvKy$wzyGsz8QF|^A@uR-!jUYj{hps{~yI%1U9LMTz9$bdxM$;Da)z-itM5L zTGHknA>U5=gx|O|{*e02=B@QsO)@`?n0`?Vboq5zg+NDq#@n)dIe{=1IL+ST`*EVD{PS^I;63sD zZHvZwnzjFNY@KEDy6fgaropSGlW(4Po5psUb^agd`!BRpLzi*v)Z>A{I9AV~%EEVM zX^i>j{qPqQ&-czVKj+__;=ffZ0-Xm6#0OL@L!1ZdUyA z&cd9(+9l$%ur7Y2^~xVhNUwav&FU@n0FPwAQrRZhyZ&`K$d1hcqvt>z4s8194_tQC zuh=(mzO!b(U_;i7kMY@A*G~FfCYZ21LN@FY^L^Br*`9}k*SeLb!If2gEc!l zW%KF^;hL!t3J)t*=2QOaN=cs#=B$;Kk^y;!8GCaXBZ?9$&bo41IBiC>HT47-=Hw7N znrUB@sZk~jORrc%oosOWmwED+ZRekCAOBF;oA&`?fYZ*#c+qCd1G*#aXBvRH;(sPuiM+Xw7b}qvKrI( ziY8GhqLpw(A!ilPvstU_e(5SRoSd==)Ye zIy$*q{nNh~prhfs&iUn9%hff_ z(qkX6xfQe7bk=q~J+52I(mtXujFP0^;fz-gmDL~f#8lyng&a!^;p239QHTqe1p_ca zalA6xNubUmU38+_{_OApp2vd{J;DPHVf4!ZVhjM5 z5d{i;`xR<0X?eqW0TIGNZMOjzih_hW!5A9ubCCcK$lBi8eikyT;foM;H&$TQf?bj7 zNPjabCh3s?b3x(!R^No6i%TZZ&tUMt@;dmT0q%pV5!T<*7vXc3HNJs%6 z&sl=l1Tl8wS0X$7kwfm1ny#*6V}#ER!&7H3J6V?t9@hq z`9P6|4&P8Rw3z%rSS!=G;7Q<|eg`?-eQsrOZ(zc zz_>~@lah9e{2;?cT6FX_d=A~j77=@Vz{AJ9=2#(}AhM?wC0czT>Xt_x7>v8f1_S|z z@EGl5MIzV)3D$rOX5jJ0>ic^OBeOw-APO_$20;bv5`rPZLK6AxaE6MNz`{prV&S6C zGIP?d6$eC!b$lUQz7POrPO!Dj);e)fjNnI!_O*%ajc>%L-`oIO&+PYbh~)Xa-(Cmd z0Ua}2+gg&u?Q{159IW5i1*&k8%BuZ@9Y52HCQg3qeEJD4pm4JC(E!!4RsjvnHGv=s zt@A7Daog`~5q;-h4t2K5`|Sa{&Qm1E5U{t(6i|exVsH?Glp{Q1&m{V+w0G0pe*+%- zE_%F%1S`}(CI-_Ih(#_Y(DmD0ka^iY32N^)j*$c2_3T98~HReIW($g?pW>wq)Rs&^K*J zmsX*GSL6hzM>&~V!WzKlmWUFI1tmclaNkuj=1vt}yQCbnY>$oIOzVV^llrF+F4+7d zRjpmUR4xM3xB;_kYh+aDj!@PPksCr(sneJQ7?x2dg&Wj9U#|$x+Clu7{w0_=X`x)S_K5o!222+(DOO`G&0suYGp8}mE{M4 zesj{}iWv4(AO3~!9uYcpYHJ+5+y(~Q^b^xuW&Jh)h=$EID_DJTZmF%@l~#0=ZT*4&h?c+e&8}BNEbUGM*ifp*k7(mgoT?J4PumR}vwR z5be2g;N28tAM@h3#+U!_JMUq3lCzAPwTil#oB5ZAQ;B?ejBG_jm7Gk)LvXp~f%?jB zpfd5$i^>}>rSizGI*t5yYx921cN)Inaufa7pPA@F#Ev(H~9+T%QD9U@d0L_Q_JA9 zfs0?^<~Du{n1?A6(FQgN3z(+Ok{Sf2MGK6FOHyB$<^@cW%z$Wh=7Bqdo7yk#pE~M0i2K<+KK~W2-B;~)m z{Wo(-v+)1TY4HEdsqp{CnV-C1^?l(y(XUzoeevoRgwDO*#`{1(X_?fdN!`6irniwb z7rZyn~;iv*;>O{~o{<*vljB5tlu%zg@8|bVL8LDx?94mYWL70 z!f7ePvbsdVw2Eri0={a%Ftq|fHk^&xr3VI4bMz14kOfp#Pz0?KJx z?6B>=xTe3lCLazy#-6fA0-5+{`LBNG9KH_Kv4hmKz4LO17Qy6}v}N-K4=t9UYg$j8 z`)S|{Y~0A|D^1-7Z>zs5mb$OXvBA`hthVW^I@Ns7X;%=+xDZ z_uX)4q&D0y-HBt8sg)JmI&%k(y76k5UION&=L_y46<-p%q9rAGW{sA;suBy^CECqH zTsH3|9a1%}_s@vh+9qQJNHNk5Kqm+r&Q@9@XSttoo@Gs~;&|aA6n@eS>m=GcF8kFH zRar}2O?M~J`Z)Y4tR##N?)Va=^|?S%>K<9F%2#DFCVkDx zyTnJKuo@I7$u+M>O)KN6G(;Yo$VWTs614c8h+_O&Kc&WqV6b!rwRgKBl`m*S8G%@d z&p7=QYjmLu@GGfd%ZpXd3CMvwLb;_Bz3d_qt!ztzSaDS(OyZu1cu^d^%m;_KNj;jU z%bX;B4zp~FCHdF2LP2{)uOTn6^cWB^6{xW!RwEHr;rE|2fW?HQiA7F(R#wG%0g5vF z2H!)Z1f2khSw!ORBF0qM{I*osS&67k)NB!c#2uvtoDYOO#l*=Jq0GxJ2@SU6H%0B+ z!bDJQ96qp7$^pQ~JdxnzND5iJ%Az9A3T@QpUCb9`*4BXHdg0I8t!-3*tq-G^0KP3v z3ByGAk$2<#a$wh?POO!Yqw2XAC9>red$S7?}G;P>eR{+tl&MUZ#;SRA^kg5=5~ZH*)(qhgH(u(0WM#C$Oe zj@+Y-rR(zW3**wZsBp3iN(!EM>-UWLRpVK_n8R{ZX(nmer%EXg5}s5Qt^t1s^p1pS z!!xV5HnqNBZWL(wh|txlyXWlNQMfxGT`UvxdQZ2r4q|A&?gUwfR=%>qnuOt5JUY*J zYV?CL^rjv=WwB*}#WE$+G~{_ozW7bPH<>W1+nE?>$W+?dOJ8jHYn+*E^7F3BF?HhsRqTPDRo=d6<@c&nR+QJCoW!m z3}n)>;84U$WH7rp$(?w9_6OHdVGJ?Ee(P%3?Hfq?mY6ymY>L7}j!`YsW_N$ndSyv* zbZRV)ka2#TPsVfe)X%zVUoZ9SkbvjBj9B5m9(vOpJG9Op*FrHKJRRHur+TZd$|b<7 znHqc;o0(d7K$@>(a?i?o5=cVzU8R@sZ|l0BbZS(h7a+mOWY)yFoOu=0R{Zu)E^eEI^@oI4bZD*P$PZ^udryptk-kO!rLy-9~b$ zPCvF_a?EQPh4i{;r+y&)*vAMOX>jSDw>z?ugXW=j18bN>!_F6d-W9aIyJ%Gtrn!Vg z<1r=ZIyj&bTSI*^C2;Tu-M7K{1+)8CS@0m|2OY!@chhXP+rW^~QVX^MlU=8Pc6fzr zwhebq(bX)2yySW+@gqP{m74h&m-MXvzD2p%`KC$OVg0eX%x`oD5ot<=j4ETCMkMDT_V>auQZ*wxC zt>Dr!Ser{7>2pO&aD!A_%c_Q30Pfy5XmQVO@)12T-uDbbak;p{(laZaVwmDDh8t0oC4p6D?5 zY3WIwg}_cu>Af_Abl_Po5i?F*Qm!hhGJudhG2Z%tTtZCosV6S#3bZ;U{tj@+T)*cY zNKZmRaiSLSer>YjhaE0f!=Wy#_ROd>8^?w7_@+MB-ml=Ri+e%eO6=^#8$-@NCJ}FB3+>AKz z)kF41yTQg#o4gA8xAL&$^6bVlrLwpR^XGm_|ssZ0f4avujf+DDoA3fp`; zA*4AAHO_GQn`wo+jd1j{9*JYYI>u-15^`;yoM`S&9f@G4pBUHcS2S4;#XVT9ekGCG zRN)z@^!!6pop9M|@Y=|S#uZ87)czRniw)LFaHd`P`4X5{1Op`uijfA%-Y4s*{u?C zfqbEIt&<0zK`IoCgq)C>cyoquBWMuU+fWreDd-QjB@MK@Fg+1dQF{cByu^Zb8Tyb4 zotXw2P1*d0X|7$J#!Wm)UigkS!ICc`BsGtMt~9%;J)@Vf0&OxP@!4V`RQe4v(@Ycp z;+!)xxg+p+xw)}Sb+Sb{u~b@!2iclGv}T;Gsi!XDQwch~=VrTqCP#I#p3xR625Z`S z7sNOmWeac%qY(jfJF#Z_C9hwxlUNHrW}UhZpvIRXYElg+mf+!3@Ktg z_i%5H26sL1deVsmU3|>zIT!IL=Gx6g|@(^YF)dnjk!7-Z)*mBjC)F) zkVkb#gj@G6PT?_9BWl>-6>K-~!Yk$f%)VfsTM6iB$MH|8VH5>xRFWkX?ZI|m>!8f7 zy>^Lj%^aV?6@#^a%O_^jF9L-$NGJN!Ok>TJv^Fu4#UX%K-QPpD zeEy@-weh391#Rbt>0=Z775Tw(|ErPloN;b-y3X91B1vD$yGsU@ z?TT$Fntg{)CSap^1HKv3oZlcd*l^%uB!ohDk{V~bp)E~?@5eExUP4VlHh8yN^I2)d zlnM)wC!3y)jsDxK;=XVFF5=>o(SXfEcRqZK+UWKgx#^s{1zIJ`u`*U2@}yYlz5lCv z#@JLm!?BT=F0h%Cq%p&@77U)0d0YYMI#IWUSF%}QCb6$%EKYSL-y{t7jiQYE?BEmw)D_RfFXbA*%BH>6Vm(@{ICp_(?m6Z0a% zvB007b0e}>gs@>W2{Gbx07c{U$@+b{x>QFUG^#$2o?4^Vkfk{1Tn5XzPnxyYeRmLb zJc_9*fMkbG66?ubo{>^LiK~ZL$BpFDQNhl6d*=-ZPl|IJC1(fyG^jv?wceU#cctVo zMIwB+42886Pd1;e*a=fHn?q>LJL`D%T+s?nG?OflL=%({2bwRl< zu(liMwMUgI&}R3QSMq!UI`~gY#I%>sr)g+6@%c`~loz5>>_}m3LEb1(^SYd6?=Um$ z0eT4~=WWK4<9!LNP}N1_F`>1^Tx?-+zU2$xi6C31ox~ z(E~q_6LC!=2fI_e2XE#RL=_Gf-5X&y_IxdFw9;9W{e>Z(^6uMXRl4TgN|Xtk0InAa zC_zlW#@0NGZF2MF`NLqitXy{vv;vAVmhf8%%W{?_R8eZK%RYh~F-pD(euhep3f~0G z3N(OSH2etSSs8VDj_Pa>e1Azl@2ryDbEc3b2LtNy8yG=w9u{h8Z&`~!I`)F0sGjbR zwgznfynXFJn(3tR2Fj98)I^+=?p8Y0T6t+LREtSty7H%CkHAF)#Doa(H++T=NX#Dj z9s!KOd-*ZL(cInz;lQ6~!_UYys+SEQ;H=K*K zQoTHlL@H*~pxN~P`zaFGfTFB^ol@C@00ANW&uNvBt@Yn5FaL;#lReuT(NBm7v7-jP zr8Li%^gZK2@d3ISfpCabcqkqV&v-+{RU~orezq~jrOWTLVX73 zGPSK~|NdUqGx+QzGe+olA78O?sZp#7%LGA2mf0I{hzD`zSS1dEcbja(Oyul8qkcHi zOWBigNGQa^fDW<5xbir)@-5@!BOqWPpRf^)i03rz=&%=@9=q9)xCXr(;wKc=tNIb# zuh4p2GA3WC3C5J}MqAaD$KvE5T^0>-?k){mJJY~8CHsOSH!3Se-JXvd$_S~PkN-=W z(9UQkJ-?)>@n6s3E7Q#n2U|Nw1|wSslfTZP#R;-<{fvmgHHId++~(%N1?;qfm4d4U@`tv1W;{p@-B-x3Q1Lpi0I?Aw8aTBp9mNctpstbS${F@_hMFTf=b)hOMn~(NTbt=_gk-ZBCvj-M{bA zkTFSWN$=B6oFEZ*q2&r(tJvWS&mlrft#FpUCcQ<~{d$-g*T|MX7=%g-DLHYJK19}gM}TJ3<2nf6KPGidy{d}*!FBam z=R|kTZT$uO&Q&`S+HYMY8bE*j0SSNMpm&uTZHStIvz9|(HZw=Ti-9W|9vVg!Elv~y zOn7qgvk$$LvvB#{2J)To5%Rk(e+p}}yS3aAG#sp0T^iJKuV~m@F3~V&&~rs6SP>qR ztG!x1t}Dj6*%%(eOWyZMs5xY7M&Eqvlk}y*8!7 zsPS~s4>MsqKVet=FrvS)aP$}0Aq)_Dx8+Q>Nju`551Vs=yqDbbE*uA#K1m}UOcwnv zMK~=Bu^-YHe9qKBRI=3*l9QKgDXFzZDBVq@Zm2G_ItTA`# zZM%+De^-4a$;V~?(F%U{_IQF-P#yTMfo~oYB*OOUXw>qZ>(6L-Zb$pG(ZF=D=zYkp zx~l_PB&Ye8THWZ(O?+yq)d~LbRP9=cuW=^e7)m?Is4(wwbxOHv=t7F#QMdRvAvkZ# zBWPD^Q(Kd+YX{Nd0)4KeiRzWemy@g+GNnk7W^P#WX1@czVL$G(j6p;NW9oY3Rzenoh^Qpp8|wqGR}|sNFxQbYGNqgf5DCyuL-Xdfc@a4D<$pH@;cDIqw_Bg}vp0Dt zs9^x>Q3~3}@>Si~3h0lTSwB z94kgV<_(!a=j3GK?qWF#l~`DkTRJEpWL)Sl#pWmZ{#zcD)}YXL2_G5ON^7V$80E8W zR--8zYgYPH8vU9C)32wquTrtBIpb<_$RII@`)MV3r55%nUH_}cKimMzYwEn`X8p`lk zyeU2?iq$IA(GDQ?r+%p9bAZWfOh_nPQ~K=9zGuG?-?AMI5y2IqLu@Q`7#z9sRg7H6 zTt+)E$>I3@pt~o;Y$!;?k>K-VPPF@@Bv*#iR54Mjy2bO5Q(J=;Mkoq4li`Bdxfy4^ zmRX$_H6UVk`@q9ICNtW1Dj--8uKBFUn0pU^?zWab+YjBwrwfkP`*Q!~w`Gni9fns- zH}J8@3kV<1J2j>SLHF5)FAs)W9ncy<_qsZNTh(^&7V{l6N^;I@t2`Rr!V8QB9pRxQ z?S{Vf93HDB^eeRT%Bt!Oezf%^O^{0^_9UQWZAv?s0k4Q5#yCy_WL`te^Igi6Z?-T> zVV7;O9yr>)91orp z>d6rZ@O$4i44z`kkZhjbKkB``-zi-!-(KnpJded3aeqAK^1lL>832O$pnBf#=dl>m zy56_XxdOa(zdK-KoSul}5Ft5cm|A5~xR}O)%mzNP2Mu8BY-VLi;FZ!=)n`DFaE@^t zCGxJR5bM)6`&Yuw_~9`RoM?aZ!FnKSi8zFb z4_Rnp>GX$BjBkkjI9v~#{Lq;x960QbjgcwZK#N<^CN>PZrp|&+Q^)ELIv(MpG{hMV zwe)lHJT*ezI}gVkUSEjszmNnsS0bbFJL zL&3?Xw6Scw>Df|GAAGmiA`fWyBm(amuXPr$8h>KnXm@)}3VzzNbS0RY(~_{k_;%Oj z)RTJg+2v%rK7GWnLKCf;`m|SGy+NvV2{4iw@lQi(98PX`AQb$W4 z!eWOMSPqMcmaC6MFknX=T2_uk+--+v&seOTgHXPD%5z58V4NG`ZrP;Cn=S=PsS3F9 zqFOsJC%st`bG(OYcB-+6_fV#XGH(7131Ux^EU+P(rNy2m%r|wRr(HuwubOyQML)HS zM{D~8n)r&~ypa{JZ5x-zIId))XZ*Oq(nXhc*l3w@(!^4IlxQ9p)Vv{syv7`55Vn*# z&GnT=Tnf%ZgOc5xRqK*?IX$e>98_`=n={3;`a+TeILjrgt`lp_kU9Cott2x})O;9v zfOzKfyGBV=B>x|KcqN_ZHxyb#P%sLIsxx!KlL)P*rHMl~q0uH93(<~23JFXx3ryVK8xfFA$)9a*u;u8CFlWLg$9tw#2|A9k?Go=?st3HYILoyh?G`M z--*(P?CcAU4RiWc+$F^`Lk-*cX&SoICMd@e?v_d~R>d?z$uqRz@bfFq|Q=}c&vFx`>dtb^Y;luWH z%Peqe$d8Y^wV%D+b+VCq(Nvs>bCKTm#1FKgl`Zq>DL^JLFE|mXb(ilgbM(p^JB3E8 zI+7K~&z7WhrYqDSb(`ic7xBmP!Z^!3o>xSkc|{H*IT*^l_W{z1+6@fgtW-+Q2=p{Y z_YcLI>mLu``dI0Z(QCCjwvX7wE?qpdZST4j3lBJ5iaom=ul?PZO>6z3@SKYJEn1J8 zLwPC|%HBPH*r~DJRXY}(ESsv=&zm7^9(ReC91aIvk#q+w9|^wZjQ?I-{GC-;oJa%K zzSg33aQ|h4+Bhj27+U?qZ1|HRE5FW&IeeM;fLE|V#86aIKuGD7$;t^^lC3jrT{-At z+(FmX=Y53N9Lor(mF&2(rnWzzIj>6;R=`<04>m7U#W|{bpWfHY@tp%~vZQbu5u>4X z?n7jDpCQJ4mwB$;@8$iNC zO6`O(6*GxRa3LUtnTvLn;rT-TtSdD8gOA6RcxNc`-3xEmbOc9fi+_iOKurYo7mu>D zUiM5V%A;(RGAlW>NOWEx7amGSO``<&G&QdtMm*qP7HT9NpiB`C_umSdM8(peQpbO4 z9-hI zTVg?82>K!(G!2i&%7;kHu~sLoTWO(!#oTc~zjrk0{=3CK)}C-YP{TK1;sv~h**py7xQoz*pM}Qs!)+};MPCNB5Pvbh_q~!jX==}3Y28=QK4JeR>TsvT((#mLPF}EmW5o z8P07F|5ODE8#q2Xg$9x9GWf+*zf35sg>^vUyt4j2V!BO0l7tXtEh2 z5=tA)uwPERn>YIGl1Qx^=(Ol9{SPuZjTdD*7;N)v1gzpn#kJJNB2tfLRGG*;&ORx! zd~)S73y5%4wC|W~_ydIE6jMkCoJc9)QujC5A9}4q z0v0KPFvCP^bgJxT4L5A3+_Nw&$c+d>dGJy$4B&N2%vTx9D;BV5Xz93>2gWqd8`>mP&Ns$HQ^+ng@bHkr4+(W`oIc10wUI_- zuE5^5{drQ4p%0ipjK1NK%?XAAW?k6yzB`B81ctsIM3f%_?Pxskur5%ObcfaC$96g8 zeIc+;kYbLKWeoV0-&LGHB6yEfvuO)HNVxUq{bV7}IrWD@*}tt={gwl9Vb(7N=DAmI zHpoQgSf4U(PJb9)(ljq(g+pC_g^?)e))Sp3oL+~&0T^vSDnqr~I=@Q18LShw>U=09)Yp2!mLGfu~m>_bzA$yci+^k4W13i9!gwdzniz9XoRA}tmL8(!jiSW zuc7X2Rzc^=ei)d>K1ub|tgXfd2qY#RlS%Wk4opJfRtGJ}H{@QR66^?La5OoOP_G9+ zqR@991Dn~tu+-G@&_5#wU3$E#F0I|rlBrsfGT%vJY_Qn=gd0Z=qa%FW$>@L?WwkD^ z5kh@a?M^nhXy{4jlO-PpIC$A+u|)i|9zXd&Tf{}ssXF|idN^x+y@6v@#Cul!74;)( z31GzckQ8;XT?iip`?MH9QP4OQz#8Kjt|B}}CXP%h$#C_04>NW_xE#P9c=0>`GsJzy z7XIb!6zD~wq}sz?q~LUo#E!f{qcw7^>Ib-gRl}W~{O$gSgzDMeZA^O>T>2i};bXJ> zqEw^vcGz6FL)Q1<7y|2B+tA6J0vzqV2YOn`t;|Hm+LH8E8Bk9YSxTh?};9Wmq*{DlB^ zn*$%7ON4pF*dI{v-5&tCW_=k^Nh(Y>8<*rZucxP3kK&ow-yW&XJ3&@JbqmK98`7W8 z|MswX)Sj`4VXYQ&Xjna^&rg%VOFMpeX!x;QO0eDfTzS@Dny!*hMSqC!ox|7l`Q6oa z`RHu#bh_YjpQA%V*}VOhyC-e?;r-OB?)YZCV5+^LmO7*Lmb=k;X*d=zSunNcd!cH3 z^P{G|yOX-2-dCLvXu5?Nu>33N?2MU#Kj^KRKEubX$1IYXI;5n7PHj`p`kl?*@%ee0L)NUJf|~lfScBQ&Dq-g{ zj%UXz?BLV=xZ4u__^VAvcGWb8OYIJ3ltceTMXlEp<9YjZ`7z?{UhVZxE(Db@{DjSW zgQQ;%9xmGB6<;wnmYX*PZj3VMbKpH_@#h4ajk8=RITL>G0;8GF1(1N_YSM__4EzO( zaIwCdfr}$^BBpnxuEayZ8x9+H4#be!)iT4b`N681@93jB@)9EAn(q*v!BS#X%EcH_ zIty&1EZ)S0J50F&^|J~h-S(7oM6Kh6rg{y4P}S<2l#zxLjbryi2uXuUf{IUo3Q=iL zOM*dKTB2Dna4P=Z?RryA!&Gy@8Ny*9XLiwlFti=yX0YLYf>u(5*jg2T}UfQ zD<2#RaVHn>Tb5r%0q%tFt_8ck6V8$n4-_0E&{j>n;k?k=h%87=af5# z6ZMm!?B#>A{ehpn93x>mbW_As+}9 zUO-w9R4l2RIw4AFr><^H5(Gl&Ecf({O{B6LCJ0E1Yg=(&zvTnidIfQxkp(`!q~)2Q z8);v^CQ5@4g?t)WFKDmF&3W{dL{O-bpqau=tf-q?ag<5Y{llnR)cWq%>{{UQRQ3Ft z8rv^0T25W*`*~klx4Jc*qy6!-JTs<5dT?l+_)W*YrWyrY61 z>Q+UT^v?tD_dIGRb6Sf${`^S2GWtqTpwTgua>$>1QKe z9-}@s&d_6ZYtywV7K3e0awGoa9&TkNO8gEGp=VW`z?)todmBsM-eicXJZvnoYI_7S*4*~R@Jnqx$s+X!R{h={&ls%Iz_Z+{za33X)Ju7qO$v=5wC{Jv=m2< z$J6OfeE9Y8k^;MUEzUs1Y9~*~2aeU8bADz@2Ja`u8>l19hpe1rGi$WcemXgicl%a( zc{#v%Q!-jyUw=xvUb(43&!ZgmX@tJJYLr;BnN1cD*$(C^%@q^yk^0UQ@|^uS*3ko^>#JdPua9S!qS#cD z@pN!=;%MBYbDjyLnh~UYWEQ2qHnf(42pS28Z z?5egV4LtYUx_lj}ZB*%tM636gdlVy;wQHkcSZi*x89^qUh<2=5V4=9MzShUtD2IHa z$r+FKMQS$w^%k2J5l93LYuT!7b54?zP0ZO1TWleuAPkiJ+{THzwf&UT)Sp=CSoD*# zatqNV7n5}n7idiEvcZO_Y6H36U>iD$k#(^IJQviJ?d4JfWp&tP4Mx~ST_y)EjW@s8 zSXrH@+zBBt1@vlqR|Dy42)7qEcE0qk)|{tkFO)QrP(1#G-1U@-ioP5sIP}WGjIrnV z<63@%Nb}96O7rPvGX0>}Z!U%4>3l}YBu36VgqFo)_4KrgUUF1>Q^vddKH z&Ndd|uu)|tjs5c1tKR-*NAa>M-KI4;sR}U45qBN5H7Op~D)I#(htmUKL&4h~E;cPK)vE1B zA;Eg{MjykuXCUBkjm-me1mW`_-$UY0Pfu|j2+P8$2w~+GvTFk&5!T+;ZR+gzhr?&Z zwWi{5b4h3abU&@)t*sG{{AjxjtJ3Hia!I*ptj{)a*&BdPooS@w5m*oTbGQcNJ;cBF z-2fL!PB4kuU{xd(L8~cfxqdlywZs|6+Hh2KJe9<7Ey|qT;ZCAdIt{FgOEq<1MQBBk zlskNln^vVm_o>p$whb@U!!Yl6Vv_NsM^rRwEiR_^w)@cwqaY&{!ve$Q!up;lZ{bU9 z_z6wb!xIw@n?({P-*nuc1<+YHozXskWsu~o>dpyZ-DTzD#(OI?DhifnwkV6+x*QIN zUmIHzS@w#Ugk;`au;YYg!s~Q_s$!*QyZLg(K&2dkrbkTE_I>T%Wp4#qsC}Q^{L~nS z5C`lMhv>OjJHS%-HOkbY687wmg^*SRXqe=nv z2Z=C%Zk;AJnl%tM!&Fj?RKnD>gk0SCNzD56y@%0RODhtv?kSjfS&L~BZH*!qj06FT zslPvfdu!7^THRq2Q{>{0HUvYb_2b)P4$i5^upK`!fmJqG?}bi>)t`}g)#jhEJxeuu z40Nsir=+s-WBigTJ;U<26bw=!^GLgPOu_TXP<#vgynkLuZs6==+zzMxZPlHXCN{0Wq%+fCe}mc8~Q~+_DAZ%6t9Mna=#V;}ib) z>nAhK0k!$U+(dG@EVlZ8GRX+?tFlQ}HIQsl|%&7{^PMQABb+ui2;X}_9IPpN5WXc7?|B5^c5S!>bI(C7!J z!cMRR3E?J~m2FBoE<1)zr_#;e$&h-t)c3k{^esBs7{`3yj)&n3Ey^uAu}~=F5RGK& z7<`{?&zH1p`9it$6+w(vh$h>8dg;Dd{bFQ8;YaO6?r^Ny#xq z@O?JGpJpsR)sAk|)93Mg- z5Y<_n-L#dsJh1Jtj^%quvtH|5weVLsB|&-i|8(deT%gGYL0%iCLT|$mJ!AZ*d{s*PU3A9Wj0oAfK_VrgHE_qbKg8NP(L6hf2$Fvxw z3xORrSWGDK>gp;#W0mzj*DDlq zLdj&7>G%DJbF18uv^LT)?Y{4g;4R2LTO7Kco8>eWI)h4!eiN{Pk~W>!Pflyw^cHCq!BwQ!uulRpqWLR|ZoXUBHs`FcH5H zrrcf+`qoIQTo_OTq7zfR{$GN`H8oKKZA`K>c1L#(tCnl_#hO4j?X>Z26e0nysgEAHn*&6gwNT1wSo`eeC{M5ISt0 zrRr2hsuVasj1WKM9uZHkBa=DIOIkgf;b6cCLC;SMKe6#CEG=cy4ugzG4Dz3_b0#7a zIc(B5^XHQsTeaB%Dx9c0-$*%i8BUL*9SouXpjgjjC&sH6%o@KlH>Sg}I$~5P2}J%!QGvMLvVK|xVyW%yF>8c1PkuYL4&)yOK^8S?(H5uy8C_q!5(|BnorfP zwdPDV?O(P}#EfU22Fqf?G$B6$)klQw{Zp9NDycmKLBjlmXBmATxyybL)FhLrs?kW4 z%T0)eeBCHYqD&`HvKkuCyl@j~1%i8l29_1*2j&wH^uge)m>-nl+0V|tcBLN^T$11% zUJ6$?)9Npfe?Z_sEjJgvsx$INm7k%8NqoGpp_@2G`|IoL0d%>#yWLXjmda0ex;N97 zh+WWO!Jk+2mv(#YNEf5QiBhD+h*)=@Ps0I?Q*ZYMI!@A2CPwBr2bg5K^ZeF#mama& zgw?=EeNlzLiwznH5_&Y>+yW`$3(Bu%?s*q+QnTj@MLL-lyD@d0CgYNym$d1w^69^` zj0K-SC}$TPm+JfMOKa%GZidFIJ*OKURVvl2+knQdkC%VvUp7-zBH=&>-=OgM!MdH~ ziW&y3UBpm}J;fL1_8y2opYxhOd%-QNGrnczslR3#{#&eSAS~eph(dGknOht^ zbseMRlH?yJm&j6-{~I{QqwX@%Fgr5ua4kiOqJz~i1Uf;otG3&=pqSa>KrI+hI}Dt9 zXsp#QrSU8l8FePo#9%SjPx)QAxIgkg(p*vu!(fty33ufn18d7X_((i)64}exd`*xw!kWv4&i$MdnoeqFO!D&((WyI_czpyV)%Am|*;R9k&qJ%Q~&@xNsfE&4~W~ zB=>=Ufkp!{k*{jRU~X~{rP=COfB;E?e?|VGU0wPq=h(NjavE?l`Rn4<+&K1I&fgzE zir&a+htqB19Uo(ak~NQ2Dlev1^9v*{oQ#)`*Gms<3ij~dtr&R$A6`C(D;DPm8v0J< zajD2|Wb64nd-3i(uE+UQWrj(OwCMQVnMe#1gn*qsRzYV$N`aa93Ypcyy>7+CAIxWfpfeyuI3+_-p*V zTk5BU8h*01o$7B5kc>t&`cIQa-w|igLE^UgN`bg?=zMrm+AkbZcM{ouDbGa0uFY7h zb=zh){r@rc1VEh{Fzp^(GPHDDw9BR#mMKQ6HF+HVSxIYo5>LowwThHP#Ub;ut|gIH zd}-=1v!wu&<}u`nte3=Mm7CXql(Z&avDkW9Y&k;)p#r}_;t1vk8Af@dxRLWvSsHe~ zEYy5I?6)3%jI*X-m(zbCEF_!;?7{TB3L{zm!oi0Ikdew8T}`^?Z%FM` ztu?Rt{9D8aPrrb_0!T;h5Kb)@T+UDI=W^P$v$@K|IQN+r=l0O_YBD zQ|w8BXhhqLyT}PbFDZ$Z21c8_*N$Z@^o&GYdQ8pV5LQ4FjhNHeewxnB4gEuDPxszr0)qLrT;da2Wx{eYZ|MYA$O&kB?L=a z&*g?y`XF_pZtTMK9fGs(KBS^_yFIAfK7+SKRutw>coKkR3N{AD75d#i< z2EwObrEYv&EYZl+yU6=K z>~$fqS}bxZT9V?!l{wGGpJ67T-Sn)?MOlFbQIC;BA{ZqUaTCrr^A`djvTv_lBGz3u zC3sSa1p0!G^`3+Q02lTz5fO)y0`eO7@OmUaDv^?bTS5izLNn=4d zga%ipZI7ECT*%dmp>~a^I#~2hv}}xdsVh0#C%e$fWXoZ?Jo=!g7F|cAzTgv?64V-l?89!3xPw zjv;~TRz+)>iWX}BJ~ubwV@%71h3l)eh+h~PP@rCZBkQPzGUfA)*mj@A67sQWZldxJ zsb2266K#082tzQ19jE8VfLE?1|7F(Cqa?{fxcN=))uH!HOrVFMCbG*PEeVQXB&o=V za2F%rAutW2c_zG-&FKekpWQ0ip&_Ax!4@BlOuMuW=qP#eq{dKxlRnRJ0le|carHl& z!^8n{HN*TJF;TsjM)^3Q_r{xp%-zRBi|O4@;vKR}E8BkJXuvF~QfCH+4CG$};Ubqw zL2g9%!uT)X4gNa?5ji{|Jy|TjH?EuUXTg~vloDyWM zl$T%spgwa+kCiV{vO`7b2Z$(H@_{E$3IitlP3jHM%8Mi`32KyK#Dc(|5U(>P<_G1r z8m&^OClbs2m6Cr^-fr_4I>Ml_Pi%P|xZ|WU(8&g1_hl#w)ajy#PKzfI~K&q z`##BthAJD+dyyhi;FDI>R_xFNCKvl!r)w|J$TS`q3S&J0e=VQ4MitN2My5-|!f6Ng z>SFJ!gR0g^lhYq#n0%;OD3|x3pYys%Y2pIUR`+50&XXJ@fk6@V7~ss*no+ixwO~W& z(>INX?!Us<2KB5EKTIT!fQw2pIu&s3GWD+4;vd5Mob&{I+XiVN>(ss&U6EJ3)~?3^ zr#k4<)})N?cB2Lfy>QlH$f>D38xFf3{~W~P=s=J9L)o5wlNsuL1xgg4V5=A+LIZwJ zVqRQUKGaJiXxU2f#e4k7*YWocLhq|!{92~Ys7JF*o8=B=Z#{nq3Fw|Mr*QNZA_99& zK&E{yzo?`$MH;_J6{2&9UXg3zXgn%dKy@C6D)-3Zp=ygN!rSF{`{8Bh(d}JLaBaCJ zWie)<`@WtobuXgHBfpDACaI5$36=4vTA0%$=*TV)tot76>U%DD&d@l^%nE_QA}^P{;5Wb^R}Kpyck4t#ji4Bc11N{pX;3Jl(w za^Ky-a|Kz&}Auz}+1vIY<*~S?h*V;&V9pj7UqIjFbTmL-0QEWfpyR znE<$glwf*bKqh)=ZmI(>d}FK<@oeLF%WO%atsi9AuHhfsp6I=Ymb=Ec(+Z8!CzCW0 zIX<&6`J+Nj3n}N5nW5M7QsYMou}GjIi8@xmGOD5}-Y^(w`x7o=B2V3g_aQsi%=sJl@K|2N#yCTmaYwkm=suu^1E^wU~Z9B^)-Q?hzNySx#&Jp{_*PSrFZ!rf=<*3D36kIeF zU6p+Y8%=O{?!UR*0N$X`gTBVkx2ezl0^5xEoXkF!uzFeOHW&((%b8zYRjV&xQ-5*9 zqgjfzk|y7`W>}dl1^r%JxrT7@hu~Ybs0FU!4jMZ55fE{TmVWlVR6C2}VDoVnqj3){ zu?&TMB!fLk+^G58zRF*}H^%_1kyh1(3*F*LO_J^LkS&F>C;oDVFc?HS&u zP$$op&h6M=#5E$RU~-`n3P%eM0D*{j!-;=(bQP7bg+-HjN7RiRA%dRb7bb;vWp?#b zdr27dZvJLMK<;qGdkj*%`L94-%=;3P9J2}QAOW9Z@(gSpMvwc3dNuu|-1{QYo{{O9 zUi~Y;+7n&xc4K0G&0L`y={BSR73m*RN`xJsf7wL=R9&Z}+)E#%?@{?sOSOqAzd6)6 znv3S63V-zVqxb~UdZr0{L@7ptOZw#Ou2|$c?Gdgw$TGiE^aoL;OoL0!eM}wyQi)eD2KCL-Py?dzR8dd8F z=wqS4VatL@Axz9#BO`!K6Ae?wMtq@uuDy27kC%!V=zzE*dB=E*hz7iZ3kJJdfPgW+ zNn~GAuq|+@vNyd;8iCA8imiX$4A64;|T&YKNN1jTB<^1#3tpJqhuAl1Sv_T|F=Znl1avh+c5OPHOGz)7f1wH1ShQp`T00Hl62 z74DzVChV_g(T{~uVzV>_AWSE+vtrCNW5}PU-+YU`)(gP2OPFl7We^ z;n$wL*^AQGV926AWN2k#YD8mQOxR&R{WAIuK9em7mgwM+W~<;=ofSq1k_*hxl~09z znstyUhF&X5BWT;i7@3fBUSkFf`+>L&l}T@JT*RK0DBqK6kg7L(mP}rJ2ge=m^7_ar zw!7dRmM=&{3+uNIZ}SvdvqV*cHUFtcXXD|iQsnonIUmoU2Z&Tt%7k`(dzqog9CsD0 zaCmJ}L`^^-Hq68*_ugtqofX1kP@R$KENmpnEv~jB;`-DB+FEK+oNyfHEk7)W)^bbM zJ6up3kqXMhzk){;ASa=eyvDBbC%c0b2`5s7RZ@j0d*XJ7BZGz}1_J)S>~(Z=9)W|# zypQ?AP0u1Wet@?`1yWI%maeL*S>F4)sPQ%gai=qy*Vc#M!)s|kX`IKRHRC1&3VI#w zyY&Gbvq85A{`EZF3jcy}U51ILW$=DTT_$%Ungp~&9iY7Cr65654UVxr4q7w3F}9q5 zWnkTlt6Z?DdP1R`u%@$KZJcF5bnbC%Vwl48DhLusNlM)Pr`t<;y{@=q9a`@n%opLF zD=LP7Bf{4SRYe}in_u41L*Kltnbvyi~Rrt!K$2~XXm#h|^l()Wem@ofi zfDrmx8wxi$nl6I!+x5|(`(^S4gUx={KCuP76?H&3?aVIjCL7b|s@a~g6lOOnCZbf{ z-z0d9EL)9OEeh(*@S#Ci5pYu3s_mlSw{2gJr);sN_VtM8Rjl z&LI{?x@l&9uWMWJR0XRtBT9r%H7xB(FJ&$`khE3Q3Z6HDW4HB~oxzJOTW%eDhaXv* zc8sSw+ncwp_42RBzZOh0sY2?0SExVIH8r8*6tg)Bu6v+ZBEa4RPN&79jc@1~-OQ*L z3sg@&rjE&vgP)%c6%N^-#+Gy5zGxA7fF(DvOKW>*7zGD>f|;ladLpGS(rDG8*6S{E z(-R-VUJ(16eB(qEgSl43k~VI*NB{@JXgK(WPSl?eTne^6-s{ZxkDQc9=Ws}kSnl~Z zB5)p8PPD763$ffgUpmVCy&olDq{{P3j|Me~1jQbB5#g2~k@4Lw8vV0LFn4viiW}jl z?ofw`0$gBN4Au)Bd4^E})?+TJXv%Wfub`pKfLlJ4;Mhc=jNd|X^%<*_?mqv3t<&ab z_bv7tJ{Ql1uMpcXw1{UTEUcU=DaYnx*v-_zFz-`Hqd7I?=R?I5Z{s{{zJjiu1h%p; z6GngGS-7u^U)b&PSp32PBVt^bL5iE|O_^#4Llyd+U}u`uVMMLpgV=?XR{MV!3f1}u zc-JfqdwRChse3U0WWvqXMSzYKFT^3_Se3>Y`YkGkiwjUwbUX^G0%>!SwG=8*^WgIzOw#sLgjN6{)E8Fc0Re-!K6}k=>$eMwdu#Oo z`UMzW)8cjejdt;lrnC+UvEEu-vz=v;2;w5+S+TEM{9+^47hjgJ+nE7C!?IAaywJ!c z$Wu~weo1moCkGQ+kURVz88CJb{T+i$zbEG?Waiq(k9~U@hd=U-fQf9BRl~5KSTROvUDs(3`0GV?dUoqH zRzvid>t@qT`(k-23S-jpkzfwoDBiQgS9eti4h`3X7>(i%-LC;j{^{D9bVH*wp^L%1 z_CI)8yW)DK9`;O(>wjMp8u?g8K$C3&LefV@AP^vINC{WC;+LFq2LdISa&>L%`ZAcs zb_9BRH_fdr=O|4o1$XoR!irWIG8k{yKA<6Fis9wF0caCdfLeV0J14!jLEj4j65+rd zKEZrJUlb@ZboR*4I2+vkr>(wcPbJ5&>%v}GTVCB_d3`8d_a1r1|B+Ws`$|Nq z!wHqkAvPaKZjUFi@Yp@DbNPbaXm)?IA_SoDM(=rFbOe%D<>gtaghj-kTHo|^%iY?O z)fiuS<__gGfJ+H=xk?W<82Oc--yA_BYj3-w2@0a&m_@l;C2owe#hgKERRVe!KQMJJ z4Sh?{cv$z}N<&%>mEf!DQtIn939N4dPSeWfQW_#DMe}7tFe-#Y*7=}=<}XvoDj20P z;s((nVZ^{oeeKrc=}|j7?QYe#B;tDUYSGK2>T%uCw6a-1MGSBP5I|dYctt?KLqy#D z>-lk};*pVUhEBDhwD5z8#9)L-DQFdk_igg*e0*SMJ=asR(CEsL{pF$KMnvh#sc6?q z^$l| z2yI6L;AX{28Bys^mJ_7!#xnX?q?AP54GCOX>|yTn${9njJ?JM;89F?bF^6J(J(6#^ zwtoo#&lxETKfB51J)6l4$i7Isd~?9;H$&vL@3V?*nANd^Q=FSq9;9V-dKvKf`hdU) z1Nkom|GEcR!;|N$=Oi3!Gm~D6?0aMzWtfSHM2x^QlUvduK?r!_1*Y#V5bK@%7dT%` z_Sg7}gvI^aRz9QFS>n&1bf0f=gfR|U^RgWy*9z*}2*(5Tcqtb<##1fr|9H7gZd;Lx z5xhY1Xd(3;4G-hWg(wm;I30V{;twygO9UW!Sb;_9cn}&&4pomN4j$HoiNA2pcY7qIW-7d4sYX^_Dg+s|=jZ#dX&w$Br85 zf!tMS2lps-!u zG__!C+h2Lqe%m|@+VhBO8EEHwUO>te*~T8J@>d(D$G|q&U-ecD{nE&Wlc*aw z!fKCX!1LtNg9G9C%;v1S!ebt9{PRKAqollOZx~f`OXJ>0thD6ZcL7&|iv^TMwl;@) zN!9F0OVv@dQPdKsGpx~5`zuUjcTR7y=-c9IcE`$f)y!z*`hN5^LJ~?N_V2@{B;H{` zL1A)th_U#->*;Hv7a#yx`=AV7vlajt#on3jSkoHz z#>H%x%$m88Qs7u(E_eeTU`7E|V>hWF%|F2MUj@nf;>rWQPVIui8k)#+xNgHIHA z;G(DfHk!rR^f?J5q0WgUPVB*x*t9byFoVS>TvnW@4X8IR=8UPhF0Qioy8q@J7F-_j z@3)k7gHe$r%1>-`erDZlXM}{?T|PWfQA<=dWU2lbj#OS556{T~ck#;%U(8_OJ`s?u zbSmrO-Yeq)ON^PnD(|h5$DSsc1v>38GyF_oG(1GgaotHut~#X7NQ4tOu6z}=4tbM0a&*{@ zng|EZw%2ar(l4d`56!2;-Fl`^IFAAqxhOTqD7o~vT(&Kn`NW+RxebFCvS(OsT!Uo7 z<#LBb4Vx>;_xF>D-6XE2Zy|ifv9Qp>o-eY-IO@KZ2DR9hsWUEH+~*2F-a@>JuI0wubq}ne-sFiS4l_q*KHVb6c3KElo^)Y zWSdcQX~?c0m_tIg=Kfl~-D=tN1GF7ZwVg4jDW^xIJh77oahB#l9~(3Ft`lt=4iLtT z;{#+@3jcXg5L95-7`Aa`bSxcATr4`7!9TXa8~T)V*g;W}-rYH{oS3XOBZga3fP{TB z*{cd&;Xo0ZgeX?+ZD2P4E2#;Y5zh9UiT?Hv4`*afzS?@+D8!#>KsfSrh(&*G4=gaT z%KK49NGK)OkSNv<>pJ-Z_`7y`_(aYmWau&!J*O~LeN}8LBej7-&e{2H9T$#@^#yiz z<|5Z}Eo{28!(}pv?3W@uTWWj~@74HRz+ED3g5c!bDH6Il^uO{SwoO2kfE9%OcXt!g1HH{8KzLTy3lFQ7njsQ4g=&6l?Q%V@L{+F- zKD%Yvrl$MUYrm*T%6)Wy#J#j0C*W<5*r(e47yH_LdGxxBbsyjD(bS`v8HH1l?a&A5 zG{ZCvi(k-(vIs^N6qlW#w4nhF$vH@se7Q3s5MSCpmgO<8;IdA0{E-!$DJgthfOg-8 ztr_i1Mh=0wB@My&Oh^s3M?5ja?ym$5OmOK)VKR=C{ysM<1L*{&0q3S4kt@n?(>DGk z$=D5^M`3i`*$|FsV2dIaCHuAS@JTSC5DMpM0m(*r2=){Y1NPl=n@hS4CY7#bWu9-? zM{lZ>sBQe$IvMkS>L<27stoJaVL&kRT8FmEv)zyg{*>1?>K8#OCPBvxU!gPL&-Sc0 zrUj}Owqr=2!4lQ)Akz*q5NK8`DAdq_L96ajc1Xqu2iJlJG)PfMVx(=s)>+5~r&PoY zBV@R7{ERWS&4@;>(XJcKb9Nlwi1}kWN+EqgZC>|IUt)!r)e^Kazy+SH&chj~K zov}dSOSP1>uxhVzg0i-X4ki+ovT&%Ft}-3=M}&1Vahgy?HaUb5*>h;8vWDTlMDrUA zT{WE*2n>=J79p{3%oI}K+Ss|Lcwwh$*m?um>!QuV@5j^8{X9qPUlCzcTR_^+svqcr zlrwlz6W6f`>bJ|C(lofY$&pyJjgsY=qGt!+z!0VI*!IQC{nzdSFOPf!|c9|ux(^_`)685Zc zLVP|+Fe4asw$=-aeE_-Clf&f!daR$%%u#u1S%*oYeYZfiQ)H`yuP>Mp)<4Ezv$8d209889{o4bmRgX%x0<#_7aacIbMK@2YykZVrL$ zcAVTx;6KzMPdroH!q5v=?;m_wEA^+xwrZQ0d)LZt6Vl9PWRJJn?W$%Z{&<%ZbUtRW zc(COHrdvG|K}7pHKak~A50a0^3fc@I1HzLs>c;JhsYyMF>iff(~vLEL1nA9poaj+^r(9)ZO(;AiMXxJ<=#8NVU44346Ya zywPA$)5QoaesG%wGzu1s_6eyc*D6DFY3Pg=Z=8-py7eMsA|jjjG3*n2K+95QPJzV< zuKbzfuHT6E$iTFL@6b8o|M@ETv3L2xzG&6Nkgbn#UzoTBOmL4V&MxZu5p-h!bJ z-cFGIVDOd0jXCqGKqW5w9-ip6&Rm7wg+{;#_t&!{_OR4tI9!gU;ns})z4v=+3_`Y1 zUD?3mB6%V%N{5(hIFhQw$)0+Ce*PF>r;^tEHjj~VZ9L53xGJuPjdvjt8adG1-)YDV z%dXTBZjL;z1~kh@Pj%+oi~oVW-Rl2dw6G8_=(+@)O9C6F%!IqTf)$9JJT2n*nEV*c z%`P0qVxvjTRhrRv3jSK@mc$e!;~4a&EcQu0B+F@WCYA*72qi&ka*IW)1Q@!oCe&eyiW6*6zLgtM_ zjV9V4gLnM~w)W#!`?Bu=kVh^YV3D6F5;}M7c*QH5tN9(EnnEcxX&V|rUVfeuYBLDC zt-$GElsE$sdg5gaCWrpkI@5H`*xD{IM{f%-{5Ia_LhS`jp`+HzeE|O~`1k z|Be*I$Z%ygN8p@)T?W{h!RQJJkHuE9%AxO>}Oe;YMy;)cl z#<$)cn;k@BdgJryDxmnW>wCo%&XXut`sgW~ahAl3mcDCgg-Mp!_$@N(F{Tu%K^k3= zgv!IB@=DMrvUZ0i1ydB~uUHlUqX0Y07sM_dgzH6F*z0?_X9;ZJq{9v&3j!r#tNyJC zODd9fWYN%Haj{~4m1g#GE4O3bAU#&zW*3J1F{TeD7*T~}Njuw6(LSo`3|jtb!FD6& zQmQI#RL!TYjZcjz%2MN-@=JUB2eb@PNucMr&hNW0N+aQ~b}jlqzd+d|nK2yi6%!8Z#ROLm>vkrB2y!uM z4(#f`&h?iJ48^v~uPPvXBcj6L>#I}RU7NVnfJ8}B6icKJlkZRtky?C`h!`^P>0yTl zkaOu0;_!7wY{9UXS26k#ggM2EAyHA@1TKI zRU)nG^W|0J9Ah$o9EbQbGF-#JjwrA8zzk8&x9JAQ*j9=NjQ(d}u?13XxFJ{(Em1v=naZ6LQcQ09Sk$!p!G~lDnqB=3Hda@x)g&E{!OLb=9QIQ=X=?|P z=T_>)Hvn7mp7DS*tkEs%@9r_*lp|M*;zGxG=qYj4cC2@+?}W}H3s^PIm_$Gwm; zuZTY%{=nO5fxtQCJ3dys4z9cRk6M3r za+^kZv)c&~{`Tzq!|fVsT}MByQ4{#lU_u$mLuP<@X!hdMVuj?fV0k?zY&Z}w$c+|y z8Of8&uXxBjRI_t?v$K|R{g@YkJF0B$agI%lyF=^CfJjtU)k{n!NgItpN-NlRtq`;G z^9^c=RoK@JbU9z92yrL=n0R0p~wic4PueRzgf<_rcY=V{?sSoCWMLscD*rh82t>!0#^G~lC7 za&2^Bxm>vIn~o~oB+7;K1CRaF59>-NCg7<^z9oom?rsD%|JwBCdJ}K$r%qn0lYc{3 zEdj=Aak5U^)b2CF;g{Ie$>(l6^?A4pJwZrKiM7!@qxm>kaA`UUh@}L;xO}rvhqR66%e^kqMt)_Im&Csa@DF z`62~-?N{5B`trt!{Bi{O{|Oq~f6Ugt1T8)r_+=_Ue@~criQ)3MoW_(Ht7$@SVM8Er zi5sNtnFQG)(aWH~kgx?*0B< zi*zbY%)D4Bneup?!F$#Bqp^CIkBvxE7GEQaiiTO1(8Shi5>TfKDpyuNAEo^PQMnPX z8cuJy8{37m+cT`4yKc!(Z8A?V)=@4%vZ z;z0YUxpG+t{i-0c)LlyryvhtGbw$tTNnp99*u4l*+CY zB7?K+f+nEoTTe!DG!Y=h?3{=5PoO4^l}mNaH>ROkLly_p;e;IS=)(8vSx~R@vw@Ec zbHQ1l=swpq_MrIl@IWuIBN?(&6AszV6u%B7M1Ad=r<$dGFg~I!2_wlFI94i>?GvNP z0uXpkH}CY+J8Q|4uIfav3B`%CJp6&>0$F<|FwnVRG_^ZK-W9-L*MsXeO&BLAvF0vc z=FAnut117ol~(L0H!iEden%y|cdkz-x(TlY7&#Lb@V)v^A!>eB5T zinvjSxAI)Kz^?_M&|v`_dQD!(KPnVv+#lTzaH#Wx?N;`sOW!ZJnps8&JM^-;Epf)j zrveg&A-mq4|HxP2OR4%OR{VN!F(qh^ zVwDRAQ&=vCLZG~la`T(6)-c)b6n~s9!HyG(YBMNm9RDS#hLH(}N~KSY zP3$X=4hfm~b%r$v8TC(KL4*s1wKE@EFp4Od!!D)X^c6hnA4eQlLdXg_AyF*J!;d&~*gjVyEluJq957gWca-2kVcEY3J7aZxE^}`0%;!(iHmG%C_ z)R!st-VI}gz`wYMkwsd=EzrCINgwFalAKeu;IrF#h3BaJr-$fI%A*{ZI7RNXdf+nI zIxAtT?nn8BW&T1Hu`+x5^i_TV6xfpZ?h~`DQF70Fm4D>){KF?JTP-)pZ=dVAMyBY^ z&v^TB87<6`{6*^NGDlq+>W63UQ^mY41=sP45QE_|cr44w$`vEI6%LU=p3)$#Hxbep zOGhF1AWxm}l)ys(3pSXvKzQUIWUmS)^?{Z=`ZYWnGpYXZTAAetZJgL-v*V+0hnSjBk!;hs!!iXyZaJ}<&CfGBMwbN+|8fz~4L1re(@NBfgjevV?Tw zrm0l`6MV%L%0eCb*lEyXx`f8wDmxp{OMALLe_#Y&D*&>#vMOTH+n%vxa6wBEZIB1! zd(AC{?l_jyZJ=qG!lPv-0AySJ7*SdaGkrsNPl^NBp&{tw+{W+}2XPb8S&dpXkhbdM zEU8SDH21m9JL_5SyY&NO@s475embg!;It!)e@h*!=)G4!9lp8RdX)_F)ZZ=vgK2V1 zwP%*d#r02l;P)M*?`78?HRqwoUYA9_F$$uZyPW!5(PCC|Q6smYZr|8`q_Jm(X0KJ* z9EJEd$KD?Cu4JRml^AW_;@hEf7Dy4mxRTZd{q&R7O~HY?Q>4o!@(Xe9p8x8%#|jy~ z5O*G#s%8V>TQ(x}#ki?@dxn&}fbbFioa~)`L#*cp;p5>L&^tveOkGc;sGwZ17Vx#8 zuprSxWdVlnsIxYE;c>(Jy5x{cyl|?ZhF%n*UW0LlEk;S(j8Q7i#mwH&&!C`CPVQBR zdau*pjoPh2_{52v&J7B8Qn~bHUd}q%Fu`Cq;`}-$MY?EI!iDsoWFMU*ZlY3RK1TEd z$zrQ^xF$nbF`(eRH< z3ZfJwM#ld}lcYY{CoSwuQ5pRM88>;8W12FGI3(~!~5cb;9i&E@;h z@@x*A@o=ze(Vx-v47#8nX-=b8%9)soZ@o3$jmoK72(n$MUL;rx+}@{>vPe9^PH;KK zSr~iESIwRR%%CNY3^8cv56(#FA_CXM7~b*%ZQy2nbb?Ts1fgjlD(QtoPc}lK zu;|RhGdMAS=65AI*$K9xuhxU@|Vav5&G z1y)Ar5x})U6XK#%?27}5jHa=~5{fhC??^woljNXmzJtI z#{PCYa*=;~k0{U5@L&>>@Ffus=9J+vN7ZL^;xDqTi?>`|5C0oUG_hQO@aS0Yy#+E(QF?Zb=m%DNHkah!~c`i+7ZzVBT;C}nM{-D zde(RxaH&*mNVqsCU6L+@}puX)hIOVbz;L3-h`&QMIAuoi-Km;R!SG z)sgRC^gHyk1l0cB7iodopK8+NtmLnoNS$imGm@K8D!0_s`gE^>1c{CLWQIVvY3e8CRZDL&*^Jjy>1Xk}i&|3d7K| zVC&>UiQDl=Jw{?#MwGAcKM7{**zw|{qxTcvLEi~qmsL%W!3cVgcDUTHB6fR=tna%U zy9`}b&#m_T8pr%FR!6gY@io7{qsS)rOl4$qROEAg8@Y1+p%QNIQVW~B66ni*3j6mH zRsFfl;CeDKu9q(&JEnEw-UM_v=3zo_GumR;3Ldmy0ActOc5W6PBj-p%s(enyM$%`) zH6qnMo~__F;c$TYM;g3v3^rKopG9WWKjbdCukc+3U!@n6Ht7v0Is7@h4P=-x4CC(~+as--n zZC>YaBc5K}svSq%1eU{m+Vo|My4u+l=Zf+OpYJC}63{Q12GbT`gvawnuCI2S1H~cY zq-if_@|9U~k~Y3o(BX)lR?^Y5@xNSoW7jA-N2qIZIWQ!e>cE+`!ayk-QNbP(yPEx6 zx5``yKR8uQ)#M(&p&w;D8m|-hTeJcqG~;JwtTm=Fib=cAzJ-zcRgmc4CuHpcPL~dW zoj#ZJ>;XJcEWD;To!BVbx_$FpjOnAfh}&~IM$QTPH#jNS?n**;O0#wwp01V2q{)vG z0>=ootZqYn+M`eia8s-P}F!;s*KaIc_ytb2Dy~?_%HZ0!&-)W5O;N7 zWHOd|(wC|2eq1EFF9?4;=X(vE-FTemU#Ar8JQf+2xu5Uag<6coHpbDnHCubxVQ3mZ z6p~+lo2_q~_HUnB`S!<}RyBTn8&>J(ZTQ!qiqljsFhQkYCpLc-_P2FY7{P}T_zsNh z2d2>@Ltr2dB@y1eUc!x=+K$ak7lY;j~4RgAJfwQtC6)M&!|% zkj;lED5K|S>!)7kS=P036}Ho(X1W>wh4c*4x6WBjcsPj2FfF4OlKYG%ihd^5nPr%` zCrr4Qpc#xK_CLL2?^(P1v1A8ybw{U%0~+Z+$z}bwnTA=5#5O__9+EobhK2baP&{a9 z@3^wM&?&XPg-8xwe{u(oxjMYgy}9xPRzh9m@`3GZ(3mQ%wQTNz8m~VI=fH^ zp7f%Ct&btaDwfFC54T~3i1$ar=v31st6lDneGvLcf5Op_DBY!?ErKz>A(OLqyzS+9 z6Qk~L_OY>pzaRJRi&3_+QflUr)949jk_=}kM}nVs{%pEZ_MkHrL@oxx6?)p0X(zGv zJ}7hx@my!RW0BmFM#p30q|)UTrCgrwe{Bo+d+dWEy(%VZ0whNGy6yb&X-E zv)^{n9dyDUt);dRbB^S~ew{4P-!{5UEuX{wNgx>AJl7r<$`udiR<$p~b&q*dp! zarbnhLxR@e*x%tHCxTZQv&-<S;Q4vGzTJr6Y*Z9d5DXXkrF5RcMPyl>$h(LNC>?utEg zwVdX@?q8ba7`-MF>NlKO31i1CrtVQgN8*M_oBfTp=)f!n(i2mip z`zC&$E@kFuZ4rJn`((qGzYR8;lSt4;%fw|rDyw-keko7qA*z)w;j<3RP#&YpQFjS* zA-XXWEUDawAJ#yxtKY&%2Yg3%eNuh5xl@!sdk4igtWB4~nG)$HdWfp>XdjS*tfQZx z{mVsYab)V8v}EAINSz3>a-(%i+@33KC9 z?-buJjv>$g!sryTAwwBFsz6}R6}LZNG*4|yN&qZ12MoZ@b39i-4YbsiMffe@sK@aj z6~o=;%18>6SV(h*>tv4Vzq{**pCU8w@UbO3=u~(k?AWtL!EU0?3N&pV^-a~5FZXx`Tpsb?AX{cNYN^AkC*ZVMQr3E3 zUF&t9i^`D0i!r*8mXR7aGn5V$H{|#Vo{6U3sUDcJmzDPIY~$`ljjPxKBpT%N&lp1x zIqkH%+0QO&_M2nB?@G6+ z@AI>Ir+Zv2r{%saS##bgmTtzr70&d%$6p?)NPZJnG_9HRG4KaR=(y6~mz!6)+ZFeD zU)joB8@tvn8uJt)s9>E{qb-%4qOb4MQ-k9(lXg9CZ$z(Xqr3K`QkCf%oUFzKAixr`^yGGQrgp8+IN`|zB8OoiQa%$MTg^PlhjV6C7a&cPImnA|37R-0 zomRkKuWRkxIAVT2he0)O{>&lIth+JP@4@J%vk8%;J(W;Jpe{g1(*-9x0t8pC{u_DHTd*`=d4EmT0cA@G2q+-L=pnR)Qx9{*e5ENby zu(n5*L*yJ{L1~M=m!pT^4}JdpPA#}DpdjIr(&Xn$_YwI|y=SbU>orqv-r*@Pe~;s< z-%~C$dme(LDkmYFD)-`dt@w2`(dI7;Uf8>}u;DbsZLhsbQYu+-f9kcvn%&d^?Dg-% zN&O*j|1Yi#eg)dxz%s4y(QhcI$DjZ24vzon<7i=HWM=ZeG;)OH0IeHS|7+y96j9Ux ze!;X56;+ZJ6(t2%G?`jhn?OO)#C|X|RFPt!88AXOG#nVEr$uyhRr&NOLdCFayc;P< zM2IFWSyy)j7j5OMABI=kw{G}c=Dz_WUn)@OS7f9a72qa){kY$@WEThd`@eZUpuxmU z3svLkXC0ew&Eom&lOBvSX-o%fuR>_GqTjU8tZTQWNI<&(E~*fx0ebQ%Ozmf8qA%D` zH96-2e%T*nd{j!I2QKhKAQ0?SifeyT8tDp}XA@&ru!-U++jx|SQQa{z>W3q;KYu8* zu(Gh57(xZV6+7D!vUg(*&k+7Z1|?!01@k=cK?M#DA_)H`ULP(5mKO=>R`u0;%Mc_a z=xZdTn@x%&>_p*6BV$%mL(<+CQ27YbsN};dK47Y!>TM|m^*_BWcQasnVck3fu2PE?Ckn=@~GpXN6*D*?b}F3 zis!?Y`({hs#aR1+yD!^Yhb4@OOxjn72r*Fq>t{AdNG|P5bh7xcx!G7iJV{^AeF z&Cbbcp5!r&oBO5G&CTFi|FPPyTcZo#>-8``?`yRmWFDt~UQgsA2sDUS^dFzZC%^d+ zZcwf@=fQA>N3B3;<1X+0O+$8}*`dM4nE;;P^)qzRCq5*ULV1PJ#BO#3oJi4{Oa>6A zt?}U&r>%89$V;611JE<$^_=5bsjjMQwZkM59E&rREJQAjQjuvej%xbnb7*J^^_{6W zI(0hf3W1u-o13&8;v0%5z6X4{4%(-0hfX?#)O02A-S+OABX~R>>z~rO-BlDaxpTZT zRsI$!X8q)2?0{AK5`;i08iEu@_CaFsa@mZkA(O*OLps|h@9A0eW5&o<{*e^j8Qkyl z&Rvgqw#xto25x9oG<5xN^{b;89@{I<{lC!TW7fZF2me-eG5wl~V>455C--z=>|LDs zWq(T{1pV))Q`k>Jewlj=LcFmdn`FFIsaI<@PW-D1Ddpy34+EEjHVWg@EAkNI!8mcp zjUh@fYmj#L6B&gD;Y_opCr zX5${ihYTDjnDhZS)JW-Ch*(Svw5o;m2~lbxFj9U`e00gc`q57{M}LJOE<^kc`kFyT z(>Mn=8Fh?r8g0-qG1m|87nBU3w|^APM5F~L`qxRtzK-Lx(e{38X!Z2?R-S?Jc|g@x zeRMeeqx`PRr=$Gg#_nn>%h$ZO{tzKX8HU3N6fRIM=4AEaK4Bg_}DB{Mj z>>I4o{jIHwA^NCz^atS2&)lpaj5-=ST;`;~FL8cW88wPMWmGHiFy>RI{$G87FG}HauN_gkVzpat z-FQyEiB=&;YF4Q`S#2a*qE(Z7d3E*fo%)W%Q%^Be1}3h3+WjX7^bc+`-c5d^O?d)b z+0F#TJn6GVcna0NAc2Qlr>ozenJJWW#abJNL!R8r?O9-U^xYzW4bkUGM8=KM*--_< zlq-$wdTA+@DAmmiv*dLmzdcuxwmzP<%qyde@#GE`MfhH9 zL8HG#V9;h7>3p!H7eykte>=7i2;-I9O`YZSI^(S?Wc}GQ0XctB>L=`CnG|>c@u-s$ z)uQ!&Vt$y!(Z{h?z7pz`SCg(<&i3yO#~N;sXvTTU3;At4e)}<*$L(d!?eQ=(tMLGu z`{j!N;9RvQ`XLH*Ro8v%>E4Xu@#g4XqUXP9o;2_;XxYkaNGRj?HLeHx+p{%!FvQ#| zzoLHW)Ad0haxzxs>=twa zIr}@4qX8aQU_ik7&k7yK zlTG=(6UcSD$6l&#i=%j@ZYM*rrSIw&SRUW|_Qrh`vxPw;Xp71GSp5zU=|PnO!lh7x zxTg$UD-8^gSU>=DPm3AL;2i`Jo`0e4!Ufzsx;c_U=?&nMG9wNJRbxx@lq=IYZnMVcT&ZG=|pQA)>AH2%myeA1|c z0A@7RA`ZFxxb_Ws`&V7jNDBXawLp7^k(+X7EP3eqP@-&YS$f#7YUAO}1_`>L#yr2N z{{zO*adBxtC-IqxtRYTfHhPrXXR@swXv`LUedKZlb_VKsTZ^r`E~H~G&Mz!5>7)5$e| zOaon&2VMnwRJ+z4_A+EgBp)Wz>z5~EYbY?w-9>?Z$W12mKPzfo_OwBij!ai`=cQf6 zC{}H%^m@3v(C)iAY+7l0(pzYdgPl4i34>Mbd$oasSIpN<%+vpOnA?HIFJHO^fsHBwC|jQDTRn(h^es&Sds`PMm51U-r|l@))Ri ziOJP!Y;X3OY8}=jh;$n4REv4_i|vhQZ|-kW$uL65!>?e7i|gUxRYU!qeoYoQ-ru^P zB-Z-D9TMAu3UqdhNiqBVr=wZMG>P_#)NK4t#rS z*ge?Pld@RPK_rPwWBlcL!B;BdE^ab#dzcqZVKS6(P8<`|g%g3IPy|B#NRayZ$e+CGUqR%jnz zLJB`*1bZ}X*o5T7RCK8aRp3&{@@FY!pW3wJCb9DoOzniNR0)gS5?{*E&4J_LiZFpi zWpwGra8lB<=PzX1-HuKzVk(|o=Vp1Z4mfB4dA{?wzsw^&UC@LP_pzj{8Y!JFMG$eK z?UXhIKt9#MDF;!x%k!dgT&Vj>(Dc;YsD?g^XPuDdpB?Ad2V%i?@3YpbQVCa$KEM0R zHB{>J+Ji#)t_r1`fT=PA1F+-Fm;IHT77+lpvv_y`JXJ!TWYnLfPAr1ci;E=xp$~QK z*I7?nX7Z!uytvBZ{V0>_eN_Mh2glnS>dggiEvHMx!6@mPPnW8L zaMU$mni%*42Zo1pzQK<9&HLWN;8n+nCpMR%G?;B(dr(;X>$Q9u`>S>AQ&R+Z_?T;C ze5s6afp{1M4385f9?s|RyNhj_-=c`1A ze#rNT`V9pPf>T|UuwqCAym0#<=XX4w=ev_ycsBIvr4&9sKIcU698EC(Y-VHdUnYGY z_PDCX+EU2P6l~IIRr0H0TaFEN6|2b*h0R=jZ1@lxMxP%Ig&~Fia1!%yaV)vXbye38Fz<-np@ha) z0RkeCRe(Deo{lR>|4VJVae$>Fz2xv6@+Wni_D@-9yTXr%OzyBEE$W>cXYZBYm~f-< z_?`Zl5aqO+Tc;%V5QvDT*GS0nxemjC*Z-)-gZnR(D|?l#tV$HC*XCjYH>%TQ`)=>D zxqMub#G4|6*A+V`T~(@k2nNEaN7vzThVEwX@i~D>Pg|mtFRf;+_XtAfK=_nd(?Sc_ zO)a#$*Rfm9Dg^`tFnl!BRj1Od)IAoRsZ=ReBGXJ;@u668fJRk&mUFcBZ4iha>-&ps z#0SftP(XWNx~}3k6S8ygt=94XAo=bYgv)wmr@gs`W0N0+(1GELlmOdI>Tev20>fi( zx|ulDyJOaCrFewsJauNCut7iz80?jff0PyU-w>lb#kk8wy3Ha}=^@NXfaQ6JV{Jat zSiM%~Sb&eUH`;TFDORwbxheS;O;QuSbs4E}DX(U0FDjDDpaZa`CV+R!|DS>S!L$eX zDdKZ%JsgGB+stbK`1t;BV6uR>$M%n=D$+U?w`D*{I`}uB)dX)bU57PE_hqZ6VqfN^)gxIeg zQb}B^as0cxg|??^@<7Y$e*N&Se47v?JY%q9WI$}vzYg|&5(IL~b{9pY{!oJl_tIPl zn&G{(yh*1^Xz=awiKBP5mE9IMk?NL$R?HGe48x!r$QBMs%QU2a6w2FJ z-4?&AE4=;QP}UnsFrzsp9Tg8l_}Y&!%|^Qk0>TJ)eaAGXi2A94dekxu0=kww$ByVf zFD?WPpw>EOR1Ah!|m?8yEz#fEUts#q=c+g#*JeU8J@`P?UwAWRow z0c3}hGHIL@!#4Jk=%oHQFs9>~jLWXuuTiZbicRlMHYaO7^y55V#eZU?F+$BSxuG`| z$X#Cc51s553$re8qn6WU!$2D{|6ae!Bbitsn|Jl%)>s6?-;lePsoSHMH< zBf5bqRsi-dt3-iY^=F`{4>MqiWRXjvv=z(oKNTnQV65$?ZqH^63Wi;m-7!<&W|)kn zzoSw}r2vf3wFqw?EWirIGhKS0%jE~47E&whTa0Z!@>jvl@gz)ImE=4qPs%4C$xDpt z2H?6=IVOvh$>(ut5pkFpJ|u*i0&$+vOGb$U{ZJpe+0^T7S`*03#-D{Z2U1i4vZXv+ z$bS+|wv!spiwOJs`=>g5Vba%3q}PPdsuoRVU;SQK!$)vS7Xob8xR4cnuJ7i}VfQnO zl4IEU4c@Jz=R+v}zPA^|k1;Zp%Wf&5P(F3`+dQH~7@25jcve={c&0faH-c8Mkiy2@ zr)t}_^)lT$j|L<{mTtPs;ulZYj#hx*UPLO*^@O%Mn}E}11SOP2AxtSQ$ix`THCo~P zGQEw2k?Q^m6H|pwoJJ{=aA-eX`7u<)d>F#?(Z+0F{E4O3m+E$r80`_fqxk!?vf(zz zPjhoXIWPZPQI@v8CY=;?rxdAvyBn+Rty>8|y^JBt3i45e{EofYtt!(0dJc4!RKE&D z*b3bil~i_HYj%vL`DhI4C=Ij$CVfL&)MVrszeog91C!A6J(K-~76^&>BZKQi%rILe z9VVdz-}isJ4MUb^^KO=z+zuk0cbf!(4$aGa5yELo4EOpQuaN5u{*)5;5 zlN4RcCbQ(oJ)CLMsujnm-Z*?fKcs?IEs_Vfxiv{=b$YMg-`zCg0;e^R55$Q{F)Y%$ zRtEJJ4j|%x_{dR0^2Dm)%8-T}7w?#wqw=!f?=>wC2|nEBiOPQCh-G-kdUe*cOyRn} z@a^Llh;%m`Or>5I)e98DnCxs)_v_t~N6j2gTTt_8@d5FL%~Ji~B(L2I7AedbRQkUJ?NwtE{e%bKj%?@kUT#tlOn!seCzE&4F)j2xm zb1;kV-pN0ySBIcgTVGy1PyAf9gkvyJAe)4Q*GwDF@*Q66}xUc%JY@5bayQrXI1B?6%NVx)I``=XBZl9(V> z;R1%;P(0PXT|`GJW>4%1`xHOQ$W$whDhP0CZG1F&uBWQ24Qt<`aXcjP(%j3$=;%V}e+YO&;OsP+$dlj^32 z*BUE!Kig5aSnljFSp^SNm59Wr6#tCfP#&cg0aGrL?Xoxbn9h;USoV1srL*KIc+oC@ zLvJ^Lh(*WUkVVZU0CJqCJJZAQdbP|?yar36-$q0#QG)QvP$GSyNLcwv791)BB%>r7 z5q!a9UPeQeW&@z9aq|~M4ak@x-Y?-mBbWaZfCo6)&YCP#i-rt*?@UTjcGI6QTR!n_ z6^YRj)xv>N^)fyVm!g~Psg^pma;=H&yXNNzm#qGl>Se*}KXt3^{cV(ikSi+@L1?l4 z#V{GO)$6L(22a)DiE-N}_?bkc9{#R%yj(Z?xHFJs;ImDmX$vg+ki=iDL`6DBB)Gn- z(Pq9-U95>d-R1_5 zvbScPt;(i652OLTbGC{`j`gd0ReX8$5_OBi>gTM-B?x9yNNM-?_YlGth!uB7{Ura} zqxByjef#m+`B&@5GW`#e4H<+yPD3C`EE=BiXO0_yOcJs~aBq|}KsWUhmCMyj=Xql# zl`kJfVv;LeMZC?D%53BNv=MxCG4-Q6AY@om*qjeVtFPTS&S898vFvqTDQ%B6^23%Ks< z4zw<6@;dL*fZ$iX&H@yy*8u!B5+=F3~Pt8eoyYpSlFkk-u z(no!F0ZG(tae7H*RZcaY$seykCw31K*cz&l*H2&`zhM|Y+o|5qXAeG?Jto1Ca}(p^ ziW0PnWfanJxYMxnl+UuLs!fKmZEgYIO{~X8n*O=AqE@A^w=-2yCaK!mcy!S9Fq9vL z@zEwe@~NGY@_(K`K`uE$=+x}(dN3in`J`-@&m8OY4K0Z z9uZhd5M_zCXCf4Ql;SzvPd3={{z}~t79RWPcRJHf+FX)9G4Zp(ev*-?ZaLpRH%#ZJ z9#;ZK0-2u56%ddzyouVItkYDiBDmU_E))Hx)~nGHmFnNh*VR-`bi-f3q5l&-_y(4x}q&K>wwdLKFNZ-8r*n!65WTSS@k+l%kc^|vo5Je;F>KZTaX zQ+F~L0BN)QohnFAt%mIr?&o5){q;=i+{$kxDq}R?~}n2 z?YtB_pmWBDS)&&^YhVJz#ik+7w}Zg7NyYP zVk(a**TH>4-0Rs!8JYCIdqTSLD}zDeu>4Z|=KZC;=0`T;u47PVvO%YgWRVtm&FK%4 zfG#`%{@i|aw=Pld!Gb+1+yWTfdpIOJNn zBWgm-y=%VrLBstiZ#{6HxtWkp_kue@>mPK|NiHAymJb(Pep=19{jq2NA4af`<_5y7 z3$ri`Nw^VEhBS3z5MNvnm#xRSnnf%m{pa1g386!%JVg79>D{6G6k~*1Fa8*zSe);i z!BiS_F~w6WLR>$0(F0-4!Lr@0xecVb8>73rx>Rp=8r~4ICsk=xx@!Wa@ukAlb#D$! zC4ve#g=276SKD+Z*Dlh*A;1VSiZ8L`(>OntvRh6`tw_t(P(N#j*Kc)})~PJ98cgTL1U*ECq37>dyWDF*Yq0)b8InJR;V>_qh!?nqRsF;$ zzG18k44aNqW0a1gO7!!CvN77h@yxWE0u?3QTnG!T?y5|>?KGNIx(H6uJxpkmC{J7{Ci+>FRXI3SfKYVF z4U?6f5{70%e!VS|T7514NSHK~Lp|Kc{8xsS=pj`xtsi%IO$Oe2o?FAm28E%AloND7 zul2%X1>9~834Yw8oBfNauScSBsWj8Lw}8txb$$MqI+0Fe3Q1H0cNj>v1=~pmG9VC@ zXGe|y^$R@%F>lEK`HOXs10dvcQ>vsnz_okTZcl2!4AHYpXO>mjm`LIGba4m54q%Bz z>!WF!tY%}k$EE@|7rEk}^F?pYTcf%_4ZviLDz)DHDdd|*xfYp0lSSTNd&}ukNaN|*2e1fnGD_&mC+L0`F@c5=ur7ph zhzPjiP!FduZ-rf9GNTVVE;7IBW$<5oDNdm=dL4SDh-=rx(Lkk>qND@%G>!UM0GZ?1&gEtJ1d`%NKvocI*)cO)Dl z@Not-MQ1I;6FmU=*0`f}+RyvmKZ*^4E#B&mUDsVBCWDqz zc!{T6r`J`wqa3_#Xcj1!DNUE(AzUmRQ{;QG2Xch6Ml0G@=Zi0mPCyX*30Zk$U-ZTS zT)zI$$762~;HiAQ)mPLjFZh3HzT;)Ho&By-Bu#$k5{iMewCz-C=776e@qU-Rw>XSN z!}SXsD7PMHOg0(M|AO+Eb$iB#*`tF&EOqGR{H@qsKUe|g<#DB(2;3d}fKs68A+FMN zhiE^FN{$Gu#Z+}H%S^1)UyTam?Kn#9VoermHbERFU7CvNk8#8f-$-EFl`8bwG$716 zRK5>)O$Ema1cDwj9zszJZuUmoReTvn>p>1Dfv5s8DwfCab;JJ?-2Jy;qKJ834^Q!% zg0d3rRssXg_q>h@D;XTK$?UpV&B0qLudr4%6&62$Y~%dEBz$5x>u~hO*LNF>A-kPK)@mag#a;M7hYuY!5 zU)aF8-i;z~EBWxqSa{C|AQDWoN(PUt{7A_~a3O9|Zv8sY;&$}jrsp{pQab#bzTqNu z(}+m?w*d45ar+Q{g$Laz<>dZS)Nm@lSph23uvzoNc5ZGYA~qex^fdqG*Jy#sFYJ1D zznU(3+g^=Lfb@dwp9|vU!r!-lUabah;HbC3=%=}zU*%h>kN!wjE*U#nC$7Zso8X^4 zA=)ArnOjxXEp)ahIb00|Id7Kp1hJX6JOhT!f?u-g_@Dp{Bs%wixlKGDu*@!dJea`x^>C>Up4gHgv4^>k6KQUtT@ zzqGwy6GnI4CjQ5}vWq?(m2z`sJZ^hZm)59J`QA7>5QM|5e z4WnfBUboE-DhhZ@F^a?oB<$upuFbKvTNlf|NvR;KmT zNRS(P8}>>CjwUI*CgG&W;S;%K$|sO^^_9rq0?#O#Lt`s? z+YW|6@jdSQeF2qF?dFQgyhl(pNk`G)kSAf}SjaO4#r2;~N`NL*IrEOqYzVknW@LQ! z?^F{;EBUyxP}?5>Gaw@=u3lyqc+ds)1@EmxIc{x*N9D!deJ1vqK@fUm@%qh$?Zb3r6Nm%@m&TTy`MTJ$MK;#XHn$hXUBQM%I~ zpMTt0_(fxDodolRGUo1Vmu#7Y$3yI;IO^5wfW*&9Od(f&Qh8KJ;qW)r0VC-gsz3rF z>rDSkOG^45@(=!+vwhg#?v9dC2T`7VAD->#4$>Y4B3H)&bklA}`N^UyK;(=or6VlM z@mQ6lbpP+XgWL0G`AdE?1QFQ%QN(8R_XK%WdK?8V$$rz`bzw0+JJAJfe^ue2OTJ`I%? ze<}68BM#h>%+IDTh)DU=D`JTo-U742&I%+I_bxfSJ-lfd@$^y3uS=s8)e2a$cln?| zx72c}8&8aRVzd~+)oXpHE}**@MhQ$ppb#j<5NTa(Hu^B&Ax57xRc=}hsccY?z$`+?PcE^=(kg1&mvNalf!>GgrC8$ z^!Sw08EQ%J&sJ$S40#}`kUx^aPkvC92B07tf~r0dEdOwe(W7xYCkLIJ+|LiU4Mix= zZ&KLlaS>_$DO&v%<@!Wj+*;7mTD_I08)qMz<-3nQtR?|^(YY7fcU$3Db2k|2BE&RX zXs+Tod4-#cd340@#L--$9_bvnEL5GALBs7(#b+P$yv>}iq4jisVz(W(k6-4Qma3J! zo}b!VMj@#&RY<#fxoK4wW{b+A_S^;0stP1bvh8EAU{Lc%T=CChyJbhd=ZF>nS=JG# zKgF&q*o7F)piKR-nBl&tozudP^UhxB(dW{@ucWFMDG+VXG%@op=Ng&>XMx*k%7gRB zL-VWhvxHxfVm=pUatLog07|!n<#ajib2y~Kl#?HGl0kE@1Pg*1uhefAFWhMFoMMJTI_zd@}vUhubG=F^n=zt@>H4@7vH}hZ}?qzy6v_VfcPoT#R z$HiVYls_16+#f~6R1&&|32Grh5=6bl`K|P*Hb;TVhRpH1jPZ5g9+E)W9|E1S&bt^X z9zeYzO0Oj3@x5OQUwNg@h2XM+G$ zFJI##YL*m%TX+R%H`-FyfcIp~((e|w;&M>SC8IT}V?12zyBh+hNd%2dz>c}zn9kt| z(I_Cu92k=Vsvw2W?Il^8^;|uzF@HNq?-}57Z~?vybQ4rNwx%x8IQ=rrV?;Za!}48F zl&KmLl1C?fua)?9>x5Y#>6~cJN}cx2kLP(9FkHKOZLWjswDAB{%NKl1`&nx|h+gwv zKPA1zQTpS?nHg+LZUjG#v#5I_)MU9~A%PJF<_)@#&uVFwmk6`Y4Y7!&0<^v?6j?4H zT+hlBzj^FE`)*_i64*1ZK{?Yg()iCT@ADLfWI=-$D%M|+przuK@4DY4D1sZ0lqP)*-C#8hvW>Ntf_6)_?>x@- zHxi6aMi=Zt*pX3tfq)czdv`qaVnYD_1WSeIwluuqvJ|i-YF%dG5vnN7kVfVmZ?dnF zNJ(q`(V?UPuGWjZAJwJ$Kq0Mrxbs!z=X&d3D&U-3PR;IOS(E8HsQ;Te?-_=sgXXkc zkop!$VwUoSyEs6OCb14T9O2hGvjSUGg;_M=|VG~uCx7-lLI%^T=JDMgf@anb}G3!arihnz>%1*xcgX@pr}oXHV=F^Yjk zHqRn+{&!iC*L7!C>Ekg_AVcxqMu-;3BqE;Z9g+Zo4!B}1yhur)$$oo_O1qoGVCq?m z5yz#ctAK&$9*3*T#h*^qLWPNMS=v8Q8Yi3s@gIl^jhNI_0Fm8r@ePzJ?WyEnc7K3T!V4)dzY|6&dqq zXr7RG>(bY=^joF3fP1d|E}xP*d#oK6@ekMOb)gv6^WPY#y@$!)iWZM+GS!LGShU7d z*d*WA4P-AWIDj$`ePO6rDCC`)X!hFv@aKIUuP=!MZ;+^>9ej_X2{dD-(2=~a9k3f$Sv9tmmG>N2p--BZq>EzT)n*%aMB6pTUNSAO4|{@cy}6)g=Z9Z zX_e^fSWZ`JmAJ57X>U2-Xp^siUs-SQO~B2!+dcf^^}kuj zFei+0VfbidAGj|(9*X=gU`wR<=!?!BgP8d^W2t@S>MbB)*iK@0wrh(pXxoULRXK;x9z`zywdxtVC-Gzy*ZLYW+MF8TsT9!vg;IXhhzwXXn7s!vz{gDM^Z zVKgW-%^{GjdEX~;usLy-K&xt5r@Bue`%`umLPTr~N54Cyx>ib_t>8Z&mt0400~MC(0^ZtV#jwQB+}yqm zw@t$^XVCndR@^u%c$D=0s1drGFDk-0zn)E6{w|{Gsx3Ct=9~F_A8;dwe@2KM^E&tu ztAKhJ{0+96r4IqC7>TP6SuOePd$BSw7b!qMwYb174=hQ98At1)$ukAzTow6{udR=~ z4_l`#zw)i}LbQ29$iL1SO%v=4>l(tNFdq6;TuZCd zYE@^?vn_H993*-u%Czf<-0NNyalXa7MVls;40Xd`z$&vVfTd|3XCy= zUF}z!X>mH>=!o&BW0T1r9$)KFFc!4FU<65%@Oo*jY}aXuYgsFg|LzwN7Y%NTrtT!j zrWys>7cDsHav|p0dgfpMw!`ymvVz~0K!g!Gy~wU~D|^?jJx6}GP$qF`(Nu4VWK6wh zoS)@dlFA;ldwstvd|Mzr%aW&jOr0KgRg!)yHI7n7>Xmv@cT&Fd_GIdth57ynCnOg* zw;n6vBTN3vMH~sYvciGxAhgO1qPHKzPtjVer*u0!8YoMTd$=bg)TMJ{{FGtvIjr-8 zh1MtuYrXm$Z379I_ zclR6>y4ihB8WD$%0aWCckfHh?ri%;bfN@z)@5h>9gz!-aNftP-|B-_*r1U!&nc}(M zEB#uu?parVX<{5XFg$C07qLsS1wE-`h(3J1++&7($d$nFpBtQhWo_B>*r>dUzi?xWOJ z;GDv$-HP|NfG*rz37$4Y8T&Kcj|!WRusU!~PDi7}a|Hhk#YzJHZ6+;m364`fZ`jaZ zn%o-qYfoGeUiu6YevkF-O3~}U8OqGSaC%9Md@!%larOidMh|%6rLL(0AI4=vMhkUjip~x6pfT$I^a2GESIUlyq?opoe-kkdN={`9gn=yNNRWZJVR*gDc z&bS)cpH3>bK{0(z#i6%!>t?O2`S&FvjD{;G)4GMtOFv6=G_jeq^QodY-M!$529IOY zBL7PoNT3TfI4R;c8v;LugBu0}_aa$d67nnDY0mcVF$Uhp3AD#a#|!29c_ET{%0AcI z)H;|`qRBgk1!dH*@vYC*ZTo%Iq9k#zVr=_oU{GiVY_6J)7lMqoLBKqx37Gis&D>~^ zcrPL29Rz9@55(?QZnC!O!O@;)`;6}Dsho;0ky00@ILKZ*3>Ncfwv6hKU5Mgg(Z!1Q z?|gqH{QH6e3i>d?vVx8@6w)IKH=NnAswpOs{AXCA*LJZj7&Mz$#Qr&)$arzAIk!yn zJ}>l!%hB?+V4NN-oC1Y5INs5mBTA!{y>e1bDe4*4>VVr=j+Pr_&q%+{7m=Fmqth+> zLlxG>-X^6m;=HR=$u~$qRUgf7>y#N3;FFwedG3-S8o3NGivM?*gdAaocP;FKHb2^8 zs=3CL!lK0S3tPvx&w1g{QqR>c9}v}XYl4n7&VopLRhi9T$ejU~EoQ?l2H30-ME8{4=q9uB7VU2XBe!S9Y(n4n+LD0Me=4hBhg*v`k}(Cu688Io&)drRh~5h?;A1!S5USP zR{K7GtL#`hk9zQ5-l~z#9wpT0g)W&vyOeWR9Ds+>DZAP=i7G8K-dA#lD2>kBVyO?U zPKUoBv4hlG{1^%yN;91B4K5wQr#~hbQ{`f*t7^%_7rd`p4YR3V5kD!b>WtH{tc98R zDANnGQsT#FteRjZZ-5nI>invLXUFS7!=2szL$OY8!qrOvjf&v2CtIjXrOh--_(O^l z@U?xU6_Lk6?z# zSB{a-ik5R5X_{1VKaOB8q`xeKM)W|4keaD9h^J4gGGF4+k`ymac)BBe({y2IJNiHJ~F4W<{CX5Y%8VS&3@m{d~ak79ZMXA(tv7YsptuRS(U!m3@& zF5q25`iX7#ueY+|Sn<1`@^tLb0VmHwhI#~%Q7~+ymhGQkgTjmew7l;DxuSZV2d`Tk zHz!T`0z_Y;IU+F&V`6!{QzEmwI^Iyx->8SjUQgz8xlLYK#r=!AFBnrao;hUYF!kml zx@_ZvbOv36sXeklW%C<_hmWlrW6LXVc&>SDKtp*F^za?GI&h}2*Ex^s@;&RYW<=@$ zS!t-5v+)+CNV#Njx_(Z4pJXGyFNTfC3uZwY%w;I>T#1jKm zznYal(3cdnG0|`bBM@RnzEMRfvvdRfNPPO*X5}&>cIN+>!>ApLMQIf(I_$x34#bMS z^e!nowtc--t<0(#{1Y6*#nfw*h3=GxTJ@BW0f+NUy1V@$Qbr%vxg*U9E;fHzs+2_` z*0CQG2Rhqoa9ECAF~1&#?=;6ai2Z-aIt!?(w(ji<90{dE=`IQB?m9F`90Vn$yE_D= zOArC2k&tdt8tHDNq&uWLzjf~azVE&7_{KP6=ooshn|=0PYp!QL&u=oKhn6_XIQv*VEPTkgH64Ijw5I zNW=An0O{N@Q`iXpMB$QN=wI)4a6|`=Dji|p2YPvs9HRHM+tl1)cSD9iEFL#(HgLFO z-Fd!!F%drNH>*{uUtjnWQpHo~|Ktf_h*8)hUI(}Bad|E|=tpe7g(lzRIDB%s{8kLM z(gP;n?DzA&Ua~$1)E5u$>p{S8BoU->6ol_RaBM8g%J^=pdUm3d`Kdp(bIj(WiL4jh zDE!p#xR@n*m_BJeabK<$xI-0zkTt{C;fl!k1rjqc9tq}p_{NZl6nak6Sc?6n0-jJm zU=!ijBBVR;$(9%ssgn~4{Ne~J)QkgWnA%Bgh&P+YymG$qy%V7+B*lBzI*3<_FB^hM z(M=PBrVwEb8O>8W32D=f`#7#PhX&L1U{}q(1X#<0ZlbjAOf=QHUyFX z2(_CkmjJ!XCtngZ(vyo|6=AdA?L&8Mem#mXhlGv_79thWr3st*O*Ld+&6o-i_Pv-O zQItk(V~9#Y=*b`vL{f*y_2NJKmKxR_8J3blMyE4s@+x6hB~7RYxRu(_si=|6m!-o^ zM_1)>>da^w+kj~V-Q0;`Q-#p?&sA4&;#$ZfUl+%N?PGB_hL!_O| z<&I26pD{;UYRydMBzYcjg*QE%8CF{CK4vo%iAH&auYxiGW5S{-qv;OVtyIIC_}>3y zbs=A;C~?dxa~QLO6p`JB`dml)a%hn!tkC_L#xp7NUd`kRyti$O;YnIW1BM}aVeQL! zovOoygwM5qQ2uUTW+UOp5%tp;@R6bI-nUwnq5R_a=SswB&Z}Mx?;hz>|D}HIS<17Q z<46~v@5O^t=DoQZ#ldRtb!X;jiA!ri|h3 z)u|T`K^~bf^9{ELyR$_|*77`sheVgi1IwH!Y>zgbf&5xvKcfjL{01OFzMiVe;~FPa z{>~dI_RR@*w^v(Zi;5-1upx17t0qYBTc|wc>l&NnpSQZ~KEY{? z-HdTVq$4YiYJ&P2ujv>^aQC=x!&AeYMGwiE?K}0=M96^eo z^8IdK`bCIKI~3UTd;%ZPU%3||azN!yiFs)4=Nq8hf5vQiVR#>aI>Z+gK%oA(QMi2I zo0JYW7 zaVkF?n43ETyerp;BB7=@FrthEa&5?9ymEQhV z=cu;s<(P!-er`NyUKpe_KGY$w41d!L7LZ_ZGT3kx04$a6ZV!v*2a>a3Zj4t;24n(( zzbD1MiKw`KECV!>CtAJkwMy^sukrjRX@rF<8dyGIC?)Zx(f%gTCcm z#x!LblCwj?KVd z2J61hZuKpvFNUB4gr@BSP%OPaQ^=z)Gz)Y)VhZbvxmtSxz3ln@-E~=??PdjyS!csY zzU6q|`qymK40%D5 zo8Fr%^ol@X;x%?)4AUm)RA(7Ol{H29gnnZid3(_o24`*U@ETZ8`~dzE_r~c;kw`po zyQy20GiyZ)m|8KTZ^+39DkF`G&nny61STb8<)v26KZYA};CuP#{ z*zVf)bq2a|z<0BAyE!G1hPQ>iC5;o&kVy@DTn|M;Dhfs{;)p}Y{7bAkc5)gMT~&_l zhG7j^pbF9&Vj+H2NgLHu%MoKz&k5W6Q~9$TvS@1(q;~vK!qUFgYJbXr0fS#`#93fX zUXCO20U?RexUkW1RYe8&R9ymU=8Ns>0*yA-{N2*@6wL_9(CFl>m5I4OQxmshR~NAUYA3#m>R53lE?EPsE20 zA0JKhe-e;#<9L}e#y}qR1Y~k>XerNRE~SGx&Oy5=HdQy~sKM{Hjb*@1l_? zILiiZ7vQg;(Y{z>fb*}+Y)^Nip~@nbAeVYziwIq{1uo?u?J*#X`qRtsW7={^9=F{6QnTkpZ7=t5?b6(h;E13v$vX|ar7JLC$8;4#nKEpLfVM|2*a4wF zIZH+X@4{-2pMw5xJ{sUAj>n!yzv<1F=SY7bIn0q&>i&p}20grVlwC4uxg&z(;rk+# z_MY2={(^cn4T8r&MXZNd<>Nnt67sw!75K7-5Hp&OW}gbm+BzZ3?`K`bNRJ*6QV~rQ zcMelYnO=k~C9=;Gb3khf*aAQV%MvS>JqRSrIC30=?iY0d;N$pMHKClyXg3bF;dgsF znd|&@kZDp{Bmf}+7r04U?58rbfL)sJ2E%7}mY7L4dm5@NJnp_TKWE)7_T%kB?4$R! zbBuNyJPsoK*x4Q#>Ps&fwdDSi0A8Z${&4siOU(ijTn;e0y$xD~@;tRM0gEUt$CxCc z*CdDNE`Y%Dr|x04XfQ;VE|%vtFW67s@2M5a2|R2w`v@Iq)+%*@xzC+lYX_&3JY$D` zv!B#I+UR4;hQ8;_5sZ(!sjACE(UR8`&l}TzmNG3{Y^4S^Y+Un0jAw> z;4*#$c~PuxFaMb{*Nz9}F1Ya0wB)@<`ZNaAKqJE#4^Wa@T0Io=7V%$E~JinR3uVNjMEA_BYB>W|dsq(Dh zfth}q{W)I);Fi8qo2UaBzB~eqqrH(jQ9+M7KQIuwly9-aoA}SqJ=8i_Z~hkRo1l?L z^VKZ#ihkEsKz(|?Zv)2V5 z@A+fcRFs>jG~VAF4IXUaEc%`E@g*9*CX9dS&^nLOHIRV3{nXG9T+_o2#&m|*nFo8& zREl(lHgZsI_0t*#89k6;g5TaiN9d|M-|}yV#0VV07XN^AtB4I$LPurx<=+RSIAE~sg6~D1{sv@4;z0CTzKSgc?Z^&}9TJwM1c4Cs zjVi(PonbSPC91gl_`>T)NB~jItAz2ID2b+XV`HYKL74V@SSoaLJ5%( z(GPk#F=CYkdEZD*hdH8wp9bKrP074i*D! z)DngU@M)U{zqEp12{EzP1-!;BJi%D)e$8Otc>f`655Q8&)#y^m+jv?jcmP-++1FbyuLQAm0J9K_N-52lbJrDwR%bH8C8DDfWNoKEu zbN(8L;nultE4|B)H6f5MeBP_qv_rk{_P&v-_CYbH%C-dJAT~R74rD%buFfsny&4IH z+Mvnjja%5U*JFHavsqxr>zRYOET0OFJUV#Q#G5PRZ} zyE`+?9)@dP>YJOxY}vdj?q$&p3ck{qQ9tOlmu^nJt!$R8_|Eww7QP=pHpHg39f=Azzb#T?PzPv!wll3rh2e#OT1yEee{NQ8tplwQJahuntDB0>30 zqM(+V+sbaHx@SD#D{Mj$EQxOlF>zdDZjyn^FBYdwRt`?1n~7S8_n*X@sx*!K2m+nR z_uSfCaOjSK(^~&p`A>?3EI3R>uikCqk@Mkw&m{;odhZJ~#}9gc@@*bA=7$QG6CD~B zbZIv>MtdL=##4;tZ~gg-(Itx*g2 _x!o@9f{v>{k;}csWcqqj-=C=ZF`zQRZ$cf z8NK_3X!g3-OE=>g_^-L&`Ga!+t6U?|S403^c z$nyP!935im%@A6w*r?B(3Lrwbm9Vvrrjg@d6yQkc89RWxYEY_GlB_egGg^j|o?I~= zowDqS$YI;VbEbeNXTs$yNY5FWWp>7_SCl3inTeOy~y%CWS`EX4->?KsIWB{qW4jF?9(20l%kQKpKWBOx zZiRV&vbv=a`rXx~jj(W-wBr~8EO%MnU%@g}$J~PqmMIox@b;nZbES)|j-dbeF2+N- zP*`OW6{fv(xwWh2@b-EWSr|!Y>Bc1k{dM^xgcAR$rM9|4ygiahvv{c?BWww|!Zb*_ zI^0Q9Vce1+PI9Q4L zXbKw=L`LHu&4*lmeHege1pTie9vO}qSyimVFE;o&XwX|?&i7JY6Ca|VL=A~Id2$kQ zTje;7zi#ERqE=1+3+T6Q?TQf6@aK7*4b3J!-*oG?58$xO96FU5M3y^FZj+bKsaFI)NS zdVSjI7&S=jOAUKZx|^GDr?(4@-rwhM`6trTB!_5-wZVRtYtZahX?aW!N3a5$f#4VA z%f=);aZX*r`gpKrfo!C2Q~JrJ*9qasH);Vl=psf!*`I!jI`jTdYNKCO*}5IA5_dH% z6`8b(Ews)Pcb`sd{RgFKh>tLD9z{*!SZ_kkk&^UwNn^NA`hpK+9H~=J6M;y4PcF;| zNDq_s6klhmq~a)LQ8aTLaGq&rX2OvgoW55swO)S;v+JFNBJsi~#G1_VgDNY-$Q$BKLAq6pYqxPkWhIih3x+aDZ)3~ zj$is5R>`+-k^w-w2gEAAy$_0?`FYv|$dHIw0kR>OeM8qX>^^<8^?pb$QT+WjarB zYyv|5PW$sBzQpFtak%1=GwtEHimlRUJo`OxSaQZePW$;!{e%lqrlDRrA*Ur-kK@+( z$-!30=sHCsn8|K6Uui}b2~ziH=qd0-BLy`^^YqVbXmR!j?|%!J^`C%wQPEIjgU@)QBdq^^34);KTf zgCNXG;!c5(ex)Ol;c&St9&(6hv9PrUvxKxDK73@M9|Me(Q11OW-p{DNX+F{Xfsl6! zIIoYRN5;qqunhl? zFMu670FY57i=iWF&~d*?03vl>@5i~_{kG6n1y=76_y(y1Lj5eSs^xZfznPB*FvT|e zYZhy&9j*5;k7Ud86_RMolw3H<{P~eWAhZ(g zj94>m?BoAnb|H9S1yB)z|D5PNHVCUYmDDe`;JDna8lnYwcP}2xS~qo&odmh^SkS9}rSd%=Um>1XSu^Fp z9Sev3n%L{&z-VBW^zz+*-sitC?PrvR(&H1~b|(LDcv#7Uf7u$*==WSdCRsl?&y*N# z=lTG~S}sUQar)hOT%M)a1Lzcs7msa`Tcz0m(>r9$58$Qr4wg6u=bykgOgQpsL)#t= za%$3b{KvO|akbaK{`;3WVh<7`tupa(R6l8}7S{04vG(^%uAc zY%tMioqZQh3_PQlVgp9`csvHxZjk?!WSXN1HFL^&)%{V&X>E`$_%T7^1JkI$?`CTX z38sU;1!@GpfM9b?LeqRHOKCPZZt~cEI=FayJiw>Clkq_U@~I7H6&jMu-fsZM z-qP);4QgmGLlfZ{pdR|yBi+J-=ukfV+HSs~pmD#&@!kJ*{&7$_tkMOXJI8xxQ7fQR zJakTo?9{MgZME0W4VqYhyDuJe1whB$o7=vn`@Cka3{EpjH25|i<^5~o2sU7t8ARp0 z^d%UKPkCty(gJ}G$?YbJUM9uS$UdScE`H9TsqRQv;k4Rq=T_$_&Ju>cgTAEy^p8M3m0kDAlAujaTZ^pUD6!DA!wIgXz>iBLQ zyHyuNsca=Cb^&RuyUF*u`eD`(us@dzLxQGW7HKJqmK+vL75oS@>%VaZPE7%gQvJq4 z67!%E6l7!tP@4m4E_2;CYfUNsF2Gu#qJF$uxZP z`uoGL`asPIU@zjJDFO?H-JpM*OC6nDnz;hsk}+|?T}-~ER>;nKC(9Bz08)kYfKNO6 z#KTDvd)bHbz#r~|y}La(5CAnrZo~bH37{igy&3N}gyjFe^8)mGPP1LY=(5@9;IRiz zc{4vViHZf$w}BN7l&>{%MTsRg8@43EnD&=ZAaS9k{rG<0tQ)L(JY|kTd9m#8p8k6f z1T%I^JuRup$w%M|?**{G;210~byGM2KMO60kY@msC`XO!#Aw8v>{7A30f?C;62D)> zmR|xVy3@&&ngGZ>gXm{(c5rB{&^Lh4SI_psn1#85nAV5Hd#B^Xfh$rbSo*q6e`+}6?cK8jGg|?wJK%S3{)fX_ z^=KI$`a1yjFeF2yf(~fV2QwkUl^8f<{#VwrRC4C9BD`2%TQd^#xp?v1pq6E_R6pK& zvaDx-gm3LEZ5Cd%@69zcT-^4oFdUssYXqR=8L)_XvhG>qf)4)x7zYKg*75Yw>#Pxe zyNumQ0v_FlC1LN$PWco!fM-n}ATV;<>*-bjMfD@F5hdqFsGg+&DxyZ0FKE?qYM=}a z{>Aw@aZ&s|4LLBN`kIFL)6K@;w37TrV<>KXQEcse}3HX~G`> z(56-1=AKz*HpUbg1Z$$zU)0OsyW|}eZ0+-N!Rc?_N!+%hnn3ScYft|@PKKzX%xjg- z?)agf%9UX+5BMR_ME{`@Q>n-7X*WwCO#k&Vk!H@P`f;yDX4dzj44$g_~Ng^^Y&YH32X-XeO*@|cGd@q4(f3f=u*HtovG7#6&(`=7;S8)+dWvAjxVuAYZphU4Tl=X@AcdYpF|>{BeZw&x3SYM_f;E*ykx* zT)g$YzV2Tkj_#BN#R|L ze12r`97kdgMm^fk z6*KHgm`Fyjx={e|iaxJaG-TZmum0Q(&3m>?JNP=@7*1|Cp3i%~e?kY5aG?%+5=Z&U z<-?}l39j0Q*dRu#Aj)9uMiiaK*QPi{rDx6Ncb+MFH4PvHm3HpeWxnfeZzpgr1l)P4 z-g^S1djS|JUGHUmg-s;+BiA-K55L%AKS22V6DzsM6L+8yq86X9R<6&w;1#((l%e`i zT3rzp)&BwNCy5rYBR9G9MAiJZqbc&Z2=Vu~LIk2@Ht-J;kp~vKh8Mo&t+Si1>j2 znV5N;>1pX5Pp@n-b+FWFU@IZc0e-Am?2BeK4U=ZAXS-?;1cU?#zwvq0XD;0%Y|UIY z5?m4++MF>U0nw=dtxK|y#)~UxjhaHdqGxR@l=fv{+C0v!$cAj+?dalHOeoAq1o&W&j9R|3cTp{n9yIK2c(_=F$V4lNCkH904fZvW5 z7$SJmM65LB^OQb^nFmo)8uB3UVuH~L>3~9G={iY%-laG^oxg>xlB}U_g17nya1vZV z#d-y5NOT&8t};icN5Mhh!1UtjBTx4ZdC9FtmywX(h zYNy*^^=a38FagDsko$1%J^trs6lN1G8e<;=GI9QS1s)*up_V&KJjS_p8ksau+>a+y zN(^6>XgG9My5(EQnQ7IbaZTnPy@sNI=Wkwuk{3&=qY{Q9+GHUq-eQGlQ%u6{;LnPY z+#g{~2YpiY;k+Wr1f)Ll0e<5no#KFeD7Bqvy9vVs371t)Bvie}KusfX}2atGEtXJ-)aDZPU{ZReF- zyQ6^Pa?pH4XQtlbVGE%G_8fW>k@4q)halZaaF&?#P3Vnjh%aHsWBo#MTwL4^eV^h$ z@sN`(m%#wirXn5)Q97jh5FFiHItx0jq7I}9B?-E1iktR*%;L;d z9244akfI6Bat0CjYE?q<{hQmf7dmDe@IVlekhaFM zGQ5Hj_KtGi>W6a;TggVVEPw3yiOyPz?}jn|xmtgJPe|P(`vEYj!g>kS>GsOC?)kF4 z6Z+u62SHb>USQa&Si?nQa=yJzUOAHjkE_o+{{`g^tn{slo8Nqc+!)YW_XT}mSo=6D z@4`(e2_dk%$MbDa)K~C3pPxf@edFc4eeyOvS+@o-CZJ}nF=E8}`p?cE*)CLw+{jj2 zoifoF;dBiLZAwr!9{kcY8*gxw!a^NJ{AZyMZ!twAjj_53LZhaINi9#L2}T(0;v)}% zqzPA`7bs=Cdxm?Us!e<$;Qr^+9Gq-vj0v6BuSrv5k9lKE8oq)cV9Fw~nc_?}m~ts6 zbBCMwgqv)UYSd@Fm&|5ej^WrjDHy|3UH9?(}C3LjFrO62VJ02DbH!du;Gv)Yu5-YHv0|VpzaFv|($1g_vrppYX%^u3(hlHt;`>EVyyf zD*ndSg9PL z38DgcdbGTlLP1H{$4+-3X03h@Z8-D&ZHDp7DTBR?m4ky$zDJv~=C=!|r-rWUN}k*!oc}z?7xV#fts2M69g)?}8!BaxmU#f9A?K+%Kr(q} z#%nZ%zCY39DCBH1q(a(Ej)+LPNR03dIuKi5+VR_2dF_)TO_+Uu)QeUTL<8Sb0@ho< z0`COd7m-O%WEu8Y#5T@UGQus!SBHrCtdu|^JrY~h9Q>krmvA(0z#>n?!ipdQN(? zA;LHNg><(FZ!ZHl%YPW`EYYktpNu;qWWd}PwBt<^sjqSQavmN>xbC0|5nqK|Tn^hD z))x)u_oSO?f3P~ElJN$;^sfRLLs{VVdhkT;z6oI$L~9}8w0$3&k1>c!z?Hv;mM8ZM`9He+G1dR`eSiAb#Zv*B-y< zh#-i@Kps5E5q_Jd;J7YJ$Ri>aVuA3_v+qLLa(?qT$mn=3hRhNio(1!Blu-QU;o$p< z;J2c0f;q#ayF&uFbo*8OhI%3?DHnGj{IyBb%kF%%?Yq2bc5G;gnSuk49;VT>AXgD_ znGFw-__>t^Dl5XL#B}cZ+Id?+-;A3m0mDu%08u7f$fgD-W$sVccOCp%Jr`!yDb*D) zUO6YtOo>kIJexGCb67%rd-H)*%rVs?rP;7)>8H*&1z4eOEhi9yHghX4fGSX!bh)5L zI^WLoiV@?VQi>9rEa2jBWh^lGu_YKxRlT`Wmd(6fbq!kqL$;7Kw+nhgh)_{K$@p`nsHSs%_PhSWSCu?olLjEzAS*wx zn8J}5Ui^TB!n2?wQldhD*)aHszyfF;MiZop!)>Cd=Yi%lU=)Li%?(G_zA4r~c2~?O zfbVSqm7L8qTg+{j@bK*N_fYiOmaEkyKwv%!wkBZHqsqJ@W;XT=U|x~c`DdSefZ&Yg zP&o<&Sq&q{_o84blJQz%t%!%YwN3w$ZP(c!9OUlvoh4(p^`4X@;B1uxBObzDVA_kf z>_MisdUoDe75XjKT+1We-h(e@;1I79k7U|Mg8zxB((>MsGp|LZ5m)8fA22{9(s0~` zMZ%pv3gV67M5;WmJvA0D!i{u~nbVAPp9l1c*tYtQu8Y&k^Pm+a1I}4_0AtB`;+hWV>e_we#D!27~YD5yFgzxo<=d+X_@_HB2T)U8RFrCTxvDhM5R7g4p zB&h?eK~g?CrwDM=(y{etqg%E#zUJibcA*JthHs$rwUQ&Wz{me-G~^w-b6 zs9GON=QRRtv@1WhetM{O38dDft;YM~XiyTEbb7Vj2G{g;0|zq%n1y4ggChx3vN1_` z1oAdO`YhboNgu6FQaEOa{w);g3X9!uip=zo&kVfb6<8F)VLI|3|9h5zzu|NUXY9I7 zZypYSDGeZ4_~FpTurI(O{{(0hVc$VTL^RVu(37lyO5^l!iBdh=Ou3g?Sdfa+kO48E z>wQY;^NlSvt8pd9KnyAI7Cc12NzVgD(P1Diidc4PxfW>_NZMdWsq8H@tEMYyJ0PD} zEgP7O>h||Ku_%Z70G$q6NfCp$QgFcecpiR&wbaOGL#2I@>Khk558r|Q``M?%1`{Q{ zzH2aeRY@Qv3%W9~f@uOY9}~`Fv={0AmNscCSTJ)RyKpZym9EDjWPYrkq~KhKh0&HJ!49H z{7g6BVao3eB(;maR`>|-N;M1zf(Kz2$-~OZkz5?@zZZrbt4tZq{v6B$2;_Y<)CvNv zI9>BW-83!CJ78Fb4B#RoH|jKt`Z7fI>`oyfApDiR9(I|ysKcAZvwyD26M>SQ_Z8K* zMig996sZL8)to&;-u?NB)w+hTYqvlRF0YK7jburMqE7eN&(+D?qMR_qRG^K7J{U?B z!rRwO?8L%XN$w%Wn|b)p{lX4Q76%j+i!a&{O@D^Of>)&2-ee<5KMw%V+3**7w*@wz zIl1kA^Dmoop`va|F9Px%ZCn0lQ9Z#9V4h1H-gd#xj1+}TWeWJTA0!1n+sV!nRt8*6 z*003pH0p06`;32Ay1rGa~(b2JFlOL2z{4elN!TukVlm z0+eoLxbaPnvo0EbZUsIc`k1#Uak7h`a^SXJS1Q!bLX0Nk3gMsShJbmx<%&U%S62tk z6v=U3^VUR#q`~l~>r?51oiGuzva&)XoPn)8=Dp84o4N2%N>{D_a5^y$5fhtbm0k_4~<)zxJn{Aq?)la^6Y0pVu5-|xx@dq|LVM{dm z@Mk9C`JEZZKspzRSSC(>zGwE4VA0XJ42JE=qkk{`1PGXsnvGtr#JoN~;wHSmqUxPa zul9`RDU&eiRMOIErmk`_HU7C0C~E+q2MQkB(I9Y4Fr73Kw@<+{6dD9!y__g&gS(s6 zbEUw?`BgKWA!=hfnxY1K;RhGQ0#>wtX7|0xlYI_I8m9fHxJGq2+BC+9vgvo)kSF&j z+`abu2AE1hybyH)2$mQ9)93o}~h#D1uQ6(*$rXve-8*SrNB!Pz(| zn^60|oTswLCFI}us_~eeJpTKRYvB;`y5z(3vM8|2gT%qKRYs6g=4~dq7?+eGPuTQXO!|ndV47KH$Hr^Tk59(LH1h7=CC;r z$nfS3hmoviQkvn$p9>4`M#}CWPyA|Q;d;d_K|;>b4vzr?FMb`986l5nkJ$Ypn71&U zyXX1&CMP`J0ua)vXP30HpL>PN>){B*1#(|$5~JBTws)%X0?Tyl#y6Mk5{a8>+kr^lvlI0&J4cKb(ei%{Fj&{_rG;;TXgpNaWTjB zKse)jiuHIt&e}lAB)b_h3d)!pPMhhkU7hi7iZ8#KZCWo@vhb1Gatk1HrE3TMZUasH)hs;ihlE}e%fW1NS}@4Sv4oxwie?PqS)#%om!Tsj{W zZ>H*Kz=}3k@WhhrZ2UwMUZahDRsL!@_LZnY4eST@CJJRQ%hJCpXE)(NH0gKLF0Yp% z#Q6U{WjqLAM+8ZG%6TSOA^sUr^ADO2I0C{#WSuH^eF8uXtWPrqLzB6|%pqcShs?B4 zggGASmW6PHHxug^IQv?Opx-Q3Y?<3PL=hSi@+|NvWea4g&tdAo=;UBYD&wJgjg5|1 z)m@6+`}<$Y$HF`V>{dtOxC|;vNGRwzV1Vh^Z?^T(hRfr8u&Q(_znevpk@<=$>~}L& z;Kcc;1BYwrf3^v1Fy8?9$<)yfcUxb3EX5k^#;&k?q+jv5F|e8PF_UUv+?h146MQJs zDv(^ek5*$WqNv^>fpkWbDeiXDDvpAsdP(>67z}Zncp3Fa^uVYM7Ukem{-BGGNW_fW z5n0H9ASQddN>=rKh&}WJWhmmyz|t4_pM1gquyTdw{aw@5c9CYCi{-2PW3M{T9r~zb z@)4KPBcQ~mGBajr>IOHn;fB1U|3~EmDjsE&xVZQOz(X0DY8Az2vaFcgC%_#U;4 z4)=v;S~SC;1edG1`Rh7)rv&N6!18eP{vbK{@ZT;!l&= zjSw*?M1=#JJdh9vaW8B}X+Z^8Sk*Dd)WzWlA~i%=rRv#v3RquI@eiN^0m{ubUqCaR zX;LZ|5nvedigl{IiUU8VCl`aXB_HsN9X=TGAA^uTI}0(F68X1A0`Au0J;cM5+#b`I zK`0Ik&l?5&aTNd%WBxPW_*y4*(7yRHWTwV8(p)UH_&JVY{k&luz6DrHo=-S`1-|ZR zkO}9;DeQ~^L$!mjihYh>ELF-ecZD~7VQ3+$F&|7N@}**1xOVINUH}{}c~M7aC9`?e zD;BFa!N)O47uH;eg;G9XBdVCr3atD0N+~Kw3Gk<#N2j2+9{Z51Xn7q&1|20I9Jc%B z5U8d?43u+ov~rv#w~|+hgxo9b;Zk~aZocw7xj;#XjZMODMQM`pFS&vnnU{I5es$lI z*n%c{0l>%K`z|gq$G|M}QpK>c^F9lg*uY1KYPp@O8!(~$cKiqE`#rFQ=IOELPD*9iU$NCU=tPmgu%!dq;dl(JX~6C(3ii8ec>l7 zpg1>=r-CmGvw}vSIuMJ6j@@>K8$M|v*LQnd2Q&@~K&{ozb9v}pb+mvX!PB65NCtHAZ_9EZi{t@uXtMhRsEGHy2=%z~b9xj0A_VaW@ zbO+GQ62rO-J-diqy2*PePVd6tW6+dS z-rDu)*!e60_`xVASR})=J2;Zvs&|p8UOAmxo$gt?{bR|<{4ekQ{%>>f z2>{)}+XA1I zyQCqhT`BRkQ=WvdQ>6bE53#b8z@wuHX54y`Wv(Tm=4kF>pL~$K015Vk(Jk;ys{ySq z*MXllDj6HQJo$mSp#5B4^w?ad)}I2;Y1wF96$&c0XWdo8*1t**KaBj~jiOghesOFz zpjWhNwgobMKXkaRtVr*Fy~G$Di68MU>)o;5)+{&)LHhH*3(z`5zeGJ)A?Z1*DSjv> z*@w~R#18|yQOl7g%;Om}>fQcO&yuZ~SHQfj^lN&V!$z8o%#U9zlj*%#IrdD6J(IKJi?p*{g8s+e?V=Z z>CuSidL!m{qy6ER#S_RKP0LV>0oyBSQs!TW8I@x^skCZCj5{e2R z{x|u##6W1@rPrxt|fxhXFv-#ARr>w(G$K_dab_DXN%)2t?IR3N-BamgPGh zZwz^>lezNHw}?e?nGFtWO9>P@KIsKohsN$yXKFyI$`=cm)|vC(-ZC8_Pj*Y`T32CN z$xS_wY5pnvhcjB-7kp)bXO0^-0=gOM`|m|LzbSJ+;R#@(u2~1K?w99_>*O9*b!eCq zU+7+3PQ0`P<00S%A&WkNs^fd;06J0XGv-`$@5H$V&v^$cLzDoVINU93Eg~=UH}XMurTg3n})!WSNwFTJ(_- zR*8T5bZ;#6n_@7COi5UM2h&Ef!51SRK1mI8q_Dkdc$000OvvMV(%)A8?^?2$J{G_p zfmaJ{uGZLYc`6i(;*|*g$wn|F0{@xhzU!V6sJnPYq%$f+wN5!Dc&#J>@uGq5yY zs*@&w7RVT235TtG&i?>3O}TyI`Q%ZYlwUuAM5AooHxa@w`lvFaUIAn6-~Xt1i!UPZ z*ts=3;qy?4dSG{u`=BF^;4PZB)}3w>ad5pX(N_iyGLE^-9%91hrl2Pgu20hA4eL1m zD9n;!>o-^DdIIb!*Zmif1gy|^C>UB+!zNR2fz3+Lnb+zGlct=P*d|E615?gf0}kKo z?vDahA1PS)CM0|=bKr%zMb}=vfo%>X#6-9v5LWfMS?&Ati86x>P*JSgz`pkp zK?jQIAsa5Qk<<<^!tv5IW%Z&_A>j1Z%J$SMCr%dz@4*4*XBL>pP)jB-B50nR#0n_$ ziE|HU_ySshA{O-mfu4I!3vas8%(aM|Dd1m6J5V?Okfkg^A_(VI>L$V>uNcqkxidvSss8%`{jHAv-S@MbFIqczq}vMRfVgpd*zi z`BB9a+7?tG#=F}xG<|8Mtg9oc= zJkqfy28U|aOUWnKz|%4eq@HSRr#=44=DREA;GiJ>d4=2Si$mjOk7!Gln0PAJ7y48D z2CA?}_vzqx_pcTD0i>7)8zqL}`A@rrETqP>8SCd05=OVELA9^f2IFN5++<@&)n>#5 z-7{JM3fgjHS!R#VFg_Vrv$Lt*oyt906+c_;!2|Z1+LaQzw-t~%+rspW&$hS;XfDe8_Pe=HOC;6uV`%$8e-j` z^$z)jLL8Vj1@rOpki1`_=wUqaw(p2kOp0acel)mu=D2=h34G64^%EkcT@_j$;YdNK z)6^5G4;S}{&o`)ZP-&eIN$omp5cc!Km+MJ*NOlnrgmA?NZG^~qHqjB!Xs~N;QYoZi zkJyq{Q;3Aoi-aGQo|7@YIS0|!-$;)9Q2A zi=<_=FTW!gx^)BTY7aD)hxr%??z!p5*I1T!0K8I}SKU_l;M-SJcZ^7=*W zx4yXq^wG|=!loFY(=Q~R+(<*ks~(a&nBlpWiV&qca1LT^K=CRxN#jaJZGK9bk4u|+ zVD|ofO;OhL=3c>I&1hE=?{t^xl$PnIIsAjm={IJ)BDg)vkbnWD_?fR$ZYYtfn}nPY0q=b{7}3YU`fZ&Z1MJ?EFfK=%ap~X8tg0B`{DniN z@rgF9Apefc@x1#&J}jwkQam_X1V=u3aLFeV1ss0e&-$X7S zhVqADNr)yMVFnoi2FU^01-rJRwoBhh!rvbS zLS1aE{>P{-gg6H06RkWhR!C4`B^nrkoRa9*tm(#=_J~l9srK|Y(zV2VD};I`G(vNO@uFc*~6r{AiGyd{^)z)i+0ES6cwsM zgeATgrQ9XRiN4A?s7f|nn;nn-t}F_T*}XGFkTO#UfhdHT2#=u7S+gV~DqKNV7DfR( zp}-43{gnb*p&H<9W?V>PE5>Fy2PFFHvypNE$P-q5X)N0Qyp-&;of2AwPhlbGl4zMMaHoTS*= zemtUiJ^uAel=D`pTohV(sy}{qUeGXgob`KEiI#bY$<5$gsCnHQLooWjHqkkG;yZ~@ zePzl(wRqWAITmWUNb|MEp`&*ro+l7^p#*{oVNJ2oXX`y_p?NB43Z{LD6Z$)I-fm-< z%1sm!FJoEczT<@$7w^G@pJ{52@mCL$7D-bJe42J@do1PhX+RF@4SetHjnhHlxS!|q zgfQqq`JHAp^6RH3F%LPBk()_1(JAWgHwNui_m`dD=JYkQSW)?9;bfLU0++1u|3}wb z09Dnt`@?`Jp>%gjNGaVQ-Ki1^NJtAJ-JsIl-64q5g3^-GARr;q(%m57ck#UcbI$vy z-^?BchS_VceXl#N_yqun<|Qofd0sYAp!LjmgqZnTnqNWA#c}B@&;g-ji!_0uZ3snE znf*C~QJ+1hzK>?vL%ExBFr5qODNYCCupU3%GSs`@tK*RjycfVX3?>(HiZsiKB*^W0~CRYQ}IQ|pgz2bRM^-zQsWJopRA z7M>shiNO6t5=-o^919j=c1=IF9PO;AT)Xpx8D?P0mAIW+zqNuClq(~wbl5cc3`cKH zv-Uw-yR|})(`J$_XEl%F{AP5di=+#JXtmqnvOKJd^4_R_%9v32;XO4v`N$hUs}v;WuW<>&Rrq;SX-~puEqu45bBp>bF2D0d-3o0SXaepoOmZs@M-sCNAw4IH%By#;Rx^F^g z^4a4AIy05L`RO{>3YeEC-N;q8(<-THQ^mO0*y2!=6vZIpRkGk@bv}MdKILu zrXCQ(_!(7d!<@=nkFKdh(otA>ME{}~$NgjFTa@V>+3>na6459bACVc8)eg z4SG+ zBwxY!$`%hv4G(!3_c01KNjr;>P+NfrZShgx&cTyFie1&u#C#K#SiW)@Ghm|g+5vez z?%Eb%UI4YkQsdd~b-g;5JI!WJF7sPksuUB>nZOZ?2@McuA>Q7-uYeKt|6+C(Y8~h@^R;?ib7?v`#{uMxU#$g@BIXhzDMdYw z^ZI*EXKphH=}WlYYi{8;7amfv{V7xuYYfdZ;S`-ra<(saAfafS$_ zUy3RN@FE|Rl27|Zafd4jDX9X$=e|mk5LJGT5yDbV&~4@GUn;x95(T z1kpp2Pss^JM!Plg6g5-%?e-Dp@)-aJZC7DBJi==`ERzyAKV6*hXyFzlgc^V?PrDcVfGC{rP$k9L983)t zFo6ER-{dY7|? z&rU<_VH{oy6}wy;8aYg<-Xu)SFCnH=b3QCL z$M@=3FUu0yqQTBnuki3gSCH-O&UA3m)6+~eGP5I)k zBYs>oTAUo#U3pk~Hpv}J$wP1a@f{1gop5inbnpia>2KvgwvEkB(JRi=xMr)K<3ZPG zK1j=4-zms3dA~|6OJeguSk)9LrB-4%zo`TE2mXLDOV00%w=5!#Kl z4jwDob8@OK#wNwV2N$IpUb2*jYW2E~$s$&~01xkNiQj))Y~RC1%rla~rB$MTGu-dB zhCbw9b0#;YsG)oq&lw5{#t`5d^D4t+eyKk0jS%|+MT6WKrtG9a(Uff_6;_75o_IxC znwdTdp&pyBP8(^0j=^L0YE@v~8R*j7GU`_nQC>G5g3q?P=5ogi`&keIqh}}qOT40E zDzk?MtJpNHQK;m?r6yD^v@sMc$YUfmO0(5t(4;JeFGIZ_;Hkc_`N%39sE>9SMk2ld zb@9D~#Cmq99469uUL(EZfqbw&9y6vnMCKP0@(dM0?+3`I%lTv<&z#Z6e|w`spVxw% zs1rZ~H4Gp|vR5RB4D=D%FX579(JbO!iumEkj-SN`At52j#g~24^E~mbD5baU1v7=3 zqWIC_lsld^PmGiHPL^8HNIZ3*S;)eClmeMnET65uflNr*OYq|bmjk&Ide=qI!*R2& zEge1BIMIQV5uI%THJm_34H^jMe3`%zpe9(z?l*ED7EM*3ju)%d(wza~lZ^b*ZWly38hrEjnY z(dyyr`*Y?3Pr4Ot*#S>yD#!b52j%2B5?P-@!}B~qi;W2#7I8EVZ|s*VQR#b$DMr(z ziS#*~ZR%blqVV-eK{mPREnMm?#+HC@+1#7uCe3s4eQJBJU!$FN?NMYlE9rp+5-60i zu<%;$M(KpyT#nDk^pGsc33%LwP7sy{1$-XHbl)SVvX@8xecki*=VvpaOPuB8HO*|s z`AV^1MyU11+@K1CH@`S6$k)Jnkh7X5BD;{Lr+Unxt)p>&?qnvYk26N#xre3D*@a6p zM|ll-_j!z}XpnWna6dFsWT1hm@pIt4U3z3BL9O1Rvy@i)z;)yvYHIs(Hz<8OsGCRz zfK?PIjSPdiy*+72ZX8q)WpB9TPn=0VDc@t?3MaQc-v%Xf=9)pzz`ROLfifG|>bvd*X0bEVu2R+~A0Rr`8}0 zRo|Jm2xWIMuvmR7emiIpP-M$3APQ#5whL5`w{U@;uKC z&3|tbldz?OqqrxH>M=d?UXjQR!uOEcx>FH%!ksVnIvP;qe8LmvbhoJpt&}E2tGyF? zjM!j46cZbX$GJc9Q5jS7@YByN#Weh)iwP@1Iv*QqY#D0Z98;g$=5MM7_K2KX{4osC z=lvcbu{ zqdSk~a3nOc6rB^WL^Cs_7mWjdB3}|MAa|fu;iOgM=Wi%3%XMk~Xyk`p?yq7Hd~;CD z5_?Kw0>QvMvA)18xRm$JtNtZm^cJp8?Ro)+PtlX!jmVCcjWwn6tTbDagQlsGgOl-H z1ci_c#YA<&>CcUu0kmC)rJk=C9jk4pDW8z2I^(nGrvjR0$%3l@3n?Bu@M}RQ>AfQT z@3_+0YbL!D?*}*9MPpD)t9>y2qXBrW33q3{xny4mjR|~c>%_>Imzb{K-c0$#w{dku zvGPZr5DFIMJweiRhe!f%jg=;;CFK;Jm^Vn%p$#0SqXO}%t5T{OD7OlCp3pLAb;q+Y zOP!f^#+pX=Ur}}R&au%`O$n^>+S0ENOgM6{eWuX`8Nw~9#TO@gD_ruOl(AUssYpbv zTUtfc)A3d7skLvIh2P?+a*;dKAtMr@aa&G~wUHJROamgNekA)URHAy{2Qxi=`}j%D zwp(Y+Jcwr^J;g4?@J$R$CUu#!CO~{vV$f(qR^W7hKj6L?)6o}J^*Utb6hURywpE4H zps|EDuvGau3mt@H$;#aTs$mE6Vl89W=)~S58D@_7%q7sjT^$%p6aW~aC0iW^hh7c+ zdk$NRRJ<5RymT~A(bGWws7xjKSSFl$W`+@m_)!CIJ<9@Q-iAiTcr-5nj|v)Z%T)uj zJ&=HgA~!>|@0Nh$>OE3wi47MkrJ-|Lbve47OxB;t9iEr_sc}}{AZt0k z`{=!keQFx)m4mg-iN=1`z=6@nW1)o%=LNB*I)XR-jl?}aqK5=HbhcsAirLeEvQ(gr zFI{Ct!(-rn!1Z}JYOC?GjV@B-{MuV8-_jO`Qn4gmq|m$3Yoe|EY_k^1V8Dq1o>27+ zgJ{HJPm*MBGH)JPbQ(Ut$*byO+U;aKq$`8z2#hAczj@~%a^lu>zI|{kSjU^Q(0d{+ zN)WUT*k1{-N{=W{)e&;ZQ;5!$@3q9-@bPg#xq?6dDE>rmVl`d2+GS1Je7?5G_Wl08;JJ&_;g_}$g^o5FT9fv) zdx9Ulh0Ii``ZjI+o{`UYW_X&m%9*ILy;V9EbL17aGu`WoyEXXi&g@MV#odsO#FBb2 zAK46{vO2k-xK1hPIs>r{XXuvoGvh09dVY>ecebUPp_1{Qq8$+AD`A3;<~_@URjTnH zC0jk*HC@iOwcpD54_E04%>^+-RoTZ3d5X}G_HFXy{F)t#sd@|U3XwS0!M#PGF8)waRO*o_u zU!53j65W%X{P2y&%Y?fnsyrlV*=DTHkxWLJ8AU8vCLs{z`N$;%3CK=dOxK|!6i6X!(_HfaFNi=RGH0nJWZ#A z8w}V@?)x7?(U@2E>Bat-wnwH?ar`;0^8F5O(o1lbW70z^GJ=_S=Rk# zygK_fDTV-qIW;cfAloH*Zs(6>c%#5;EHIdEX!pccb?XkNq14ynH8tx>6*!Z1!9be8 zdv?p5s)KNzYzcY_EEEIPbA}fLc3CeI6=z;Mis5jGRZEPiY1KY>IxjOiYHTXlB4iPr zs~~KiHW=3Z>eVaa3jg(wC{e1^{QQahiY1nVpWLU>uN_Q##2h=DErnA&a3K1MLdFG= zhnY3#a%Z9wu;6x78yPT}(9C-IgH;gn^*!8(ii(QeP7q-~58H97zXsuE+TQ#-F zhZ`;$g+;etjnOznFd9qgVV6dW3zd=1)Y>-k6#sm1&>fRPZs}iruTWDnY*e2Mm&jfl z4YPJGthrGOQkLxLRuk;$rS5PcastT=*hX$?e-Yy_BbojW|Lap-lak=GrRo7`~^LngS{nl^PWD7uzM?{e^n86`K$qvz<&mX9_p{ z<%V)dq@M}(=r~TBi~8@hH-6RaybmJTll0oby&1Z8mm#G23IDZ@4zca6MvKPVCYuEM z(%$G-INeiu{}&4Ex68R*Q0##bUtj$p1)tV@Jn7{ z;0Kgj^i|fh{>9(PS&ntR)L%u--KGnWE~h{25_Z|nBs@Bj6ulsJA|&cl#UBaq8ItK0 zG%`&z7A(N$ZF={p?8QWgQXIBDsx>xNce$;EVj$V3^F-Zz9Hq=6xnIG(>ZfWuBY?-K=2ectYFL05a!4zVuQc=Vm; zG`!X(av4+nGKGEtk_v{%PfA=a!gq0XNXiz;W5_(%W~O5vXVGzxm>K^dn0?pguhih% z$aJxqI&$)oU9TYZHtx9kDVp(w%X{Hpyq7O=5`rHJklkmhXQicAM+a+YaY1-Q~UA#5q z37xdhZ3$Th;hmY8UKSVfX^X{PyG?fe8WWEQ7=ovz5pOZ>XM_>@6N!nvrn0(M802-g z$qCs-fZyO7A**)gJ?93|vYiONfbCbhDrMQjI}ck%8zAk#WfWXoqniHp`NNjoKGleU z%6iMuU9GluyX_Oo&pQv>8nryqMwI!}La4qEsKh-WHxikssO3*N)z>`XXfl z8a2)(QIDlM$|{c7Gsy0wQF$2mcaM)Be zM-MJW)oYssj<&SW`#`g$49Fp-Bps0b4Ci(a|&W)(8Bp2U9+uijTSU} zRsW2fvcsccC%}KY?yg{_p0~Ppw9|%iv5b$}|80k&dhI9?gZ;^? zgxdgQ6vya(svES#_&@d+bc=+uoWKOZIOHvZssk}zZS#kuN7g~D3pNsV8!FVB zzM=Azc2o<$wmc&nnXD$S1i9Y~IASy)%Lw{OcF`SUJ()2t8i*0&@%={_qpyob0-qQA z7gr=cP8FRtlQH5ljjKpVPB&*N)nibOO`)q-tsVSYLnU3C~{iA?{0sA9!W!b^~X1;*+_gf*Hk6f&-q4nQZF*4RNeCaoT zZL-)nGK-I6K7+^IDe_YqP0FG zrjhrt&pXSgVy;z-3mb1+Qlg@c#rY_Xi-4NU>o$G?F49&mq_bzW)+e0(q^?;`#i<{c zVU;6q6BdN~^Ri7)%_SRTjujUg$)$SF8YWmx@6T|jI2Man-(5@-K&7-_+DHGIQ zNwMzQrf6_4go9lKt6#VwP_|mFHTDg329G0lCi0Q_XTJdGv=ftZr;pZjUdTO-c0Ht` z^$|;lB5p?*l`2MSS6(7LP)IAycZ}#hYAHP_n|4GBk`7hlEq(S#^D_A2K|W5hEj<2S z`EtmQM{51s^$wlIX(p9T6hy>Yyl0&SoiCq)_5h)=e|5fDz^5A=%9wKf?LEvfuhoD* zC!&e^p6+I(KKxK|Se*YaKGi4Zio-gi{`BnjjuI&eD_BAs6ZWJZuPW{yJas zu$tYo+9U|as{8AeASu@iz(}K$J*9!;;T3+xQco5jz4*T~aj5?C8t0@_j~$(S*)(9h74xWX&FbZggH*_neDGaMsI_A$s7 zSVi58Dmh;-M5UoSoa>E!#OLFEbwY4_0eSVLw6(EZ0T8tkpweAX1nLUtX{-R+8-`qj_;9OvfTl}%We0CUTOP{2)@ceUrY@kX6`gQZMQPQ;0Ij} zK4l#{R&|Zb?eUdY9~@3_H^$0ZZpJCbu}aUkhv&dU&;+seM{h!!)A2s1UX@YqXP&6I z+Cm2+0zbNzuVO6_?f6!u>)Q>bVbU*gVMPX5Gd4#*FTMuk&Lv zAF;MiYw8)HtZ_#Dpp{Sz*;76*p$*bIq7(@XGsiwaMv}TAb=Y;baWq{B3BAl1!hvq# zpwIj)n3edhj+B(hAf_DXD$%PP-<{;B|Mdx_^+?iGVZ?GI)cDir4Y?j+g1X5M`8?e9G=r1l+c~D03__oP4#EZ$H_?-bNxa z?Y<>)Iv*hxdYrVqekwLQZ1H6P0vC%NzG-SoLwrUGZ?le&^+k|li4;sqfzaK!bCENu z05NHmPK@98gU!T`sKJb3bQYQ_CAk#v()fg3$A1_ zTT#c2FLCRUjzV92U1kGPv%(XwS8v_6O!hXpl!}Rw#wDeAW$XVK|M`X-y>jyKZ5x}P zd#Vs|A%X5q*ZXT~6KqK96r4t_s1s%Oj0aS=eZ~S&T$98hnh6U~Ih=aT!HNoP)7=*2)8aRqqSUm(azkuk zw`DVe_Hni4ESdcwxwPq2K}0KPCzywQu=7$sUffZR`dDllmOOJr3smd9g}d=RI?F&~ zO*Y3@#}KWiM7Oo*8^*j7fDjPG@3@;Q5av2|se~nL{mHq=UhNRJW?~>lEt&gmcb%@h z&REW6==e$&t^_+?=*ZQu)?T4diDC-%hJg97d24TG$``yriRK<6M>l8H6fXG%@y#yr zw+$t3N-m)c@=dw41j=>{Gj~lW_pqfh+$$HKrk-I#<{u=r z{q*V6eoI$eg0X57VzSqX`3$6_}`Js?=i~f23ehgeF6q zKa)e+e+C#6EaK)7?7zlNQ2=kqqNLMDJ`O4vMiCfk^$0EahdV?c_ZGfFi7?<&gA^XV zLwLEmVK9S!vNio&ihAG@GAJ`Dh`1kcRsj%)_|5@uh<1eg(MHYylkl?0*2quY8Ts@% z+9?`$y5RyHJe^2o{?;E-sSZ;h94Ie#w*B%BVvRv+!qlzxJFQDt(=83UdBMEtKGu_O zHD8C9K}939fiP)pH1IY(4Xs0DHM#+jRmdGaoEY4?N4S?g$TZ|Jk~fka;q6W!k$>uX z?lv!K4lKES&@9;^ugq27vAtSSUckKRJ9eEAuO?bNN9Q5V_UD35tXjzX@<4_2$IEm& zBj;@lOVHqsUCYivD)N(ML#gHXrQq7a#RX@A;2X5GY-$h#SJ}-hf=o+XYsC6Bk^5em zRt9D>rP5_>1)LmCK9hC4nyPT-*ubB9?qTl@lsag~-D%WJsro!+Pp%qK|ACy6N;{5b z>2bbX)QgE~TU%>@CUC`<*gg8PK^uzHu~1b}N)v-o?dV4|vqozXy_qy~Liu!fc~GXx zLG;?Xc+;K14a!YF#+wR(H;)LUC+kNohcf}jK7La9ViOjG4faf_?v~T4iM5CF{0P!F zDb`)U$Y{|42B5sT*B-{Duv>^gQ^eY!+ht1gAgmC0uj>p6f#xpUT0J-;< z7#zrA#9=mQz6*9bH>h)o3MOP$08&1+z71v>l`lwFn7`u=OS$ zy`$6ReI1|a@#N=}G*8`^S(YV8(=5+~C8zk?w?L0V`sb^oMMOgvC|3CJ;&BZ6E(A0M z&moo?41}{}Z!QNyl{yn81=KCe^h72a zUW4@5K(Xj=Y&3$qu^@qu2JI5!kFG`-)?Ql9C>WX=u zR`$P=nccgUl6c(Ley=#EeG=FT z3B6FKZ`mA12hw9;V{bDc)p6(O?3t=FxM_%dg`&MW2r=C&GW>Z#1Q2(izI`)^$ zl6R=@)y22H{?YeCT@7V@!ogf59Xt)b8=J3H(>VK-^)+1XT0d~dD=*^=;g0}f8?#pc zIvI)c_24|$sS9jkAn%aB1XBH=VcE{kV-D|dJ+r*hSsp;@$Le?lR0M}L_SXf6@X;q# z?8<@K)3yqd$GiDb5wkX@#c6lyhOayIShngnKaIp)GvI>uGUQ-8j$H0l*0J}k&-en4 zDO&0yi)At0R+O5Ia~QB}vOjMMf+90pduR6v{~9wyLt#x#cdrCd={v;IybQREl^yT( z@(Mzt8u2Fh*aj$=TE$#snf!a!?V%)bYe-j9>6-Rp>Wq9DiCt@N^6GPv)5bfMMXeNT zf9dlUC?pa?cr{IV9jkPynYt^6(VE!N+JlmxH@v=QirKDhcMwp^#`9$MUKAW&9tx~= zY-97ZS!2hJxOX}eC0YmO-hQzjn+e^ndxbuCj(n`!-aT3ZrG!WQo1i3RXLCV!u`6&Q zp89e&6cH02!Rn(B3-pl}@HT7-Y*&m(WNuJg_=izh>(`O<}VU45f>YXV& z=Y;waXB1A>J*oAsC!ff>sec(qXuakJFCfc~SRUa`=8CViA zyX8H}6S%t-J+B}5i$N)}=>v)p3QNbi8fU{VoW}cSDQ(`G!E2_1ce1*Vq&`rUUkKlg zm{M-Shr(Rla}RQg_)psy+cHs~V(P^px&!JrAl#-skJ92LPYaG@?@1FcP;cT9i+Kt6 zrrv2ezozuIv-6f|PpXAch&lSd5WM@ekCis1ILo?Y+S*?gCq_Cd9dAob0yQc%CS%h@PEvpbay&t%$;Nz2ojK09}*wjA1$}cfFeYTEC*s|ex?s`AzoiZoJ z*`0rh`ye3NGBn93=gJ=GOw5Uw9YNg_L>8@mCZ|1D? z?&Apa^o?M?{@zLVP12D*XRKb8Kwa%}hHzjXL(fi-3TmKma zAD@rNN_>{(ZX&HMW$c%-ajVmfVl;~x?6SyiE()2CbUYa_$cdjVGR|3+cjU7_pKC=+7O>A}Ulqr~-VPLR zQy_T1SJ0B{yBDzk=_LyHvnGTk7Hzd%a3{$fE6Y10*Ul8F`JZw9KZ?e-G}4!JBeB&X zS(bDzv!2YD<`3}1YVqXaI0*>Ybm7EkDp)z2ok2Fer2aL$Sctx?2Lgvge)DSY|Iv>A zmu~^zJ(q+BQdMbypzvrt#L{&Kb|lErMYsqEA|tP>WI~Lqi!lp&Sh_1YMVvr}$v@d! zw8+!XXz+Z$cQ%5K9sA!*qW|3SK(r5c4nxEPKHFZP$>A_!zJL-x8n77B0h9Tr_jbCd z>zgq4np@5O2I<aJX)FTBtVAc0VtFfV?Mq9&X za;(fjJtr?C{sw893k9N>nAjV=qAK2bw_W`7s$ zeI(3RYAVlt91yLvYFPx@)Nqb0mfI}GbN?Z{#)|qe`drt zoJgBt6WZ@JPM1m{7FW$Ch6^hVTE|}b_@tq6TaT$-KbSosKQJT)U9>bIXZBSj^uxN5 z@|!<;;uP=pFXR68b{_|+a|Own?`Cb^`yxMvI;6MkaI~qHHvEE}dIr}QG-fmlHS!+4 zq06~lo*}E^c*!|B|B@HAb#LDSREff{$%AWTtN&aF)Q`~-6+@HXT0s881iXxVrl$|+ zh@_e`RmDzP-!6h4A`{I3WRW+|{kQJD4xO4k&^QrfVhX&rzg42)C--xcR(MIk0r79s zVqK|;Glzlk`l+_$l{rxSumBk>CsF@_?;U9POlm%tMzOKYAY>DFSn_bGCr7J4eIF2X z=6R&5tf2R%&ytpT<1hQ-2g%E;vK*}zm1u+|^L!uFw4_i;v^!kaDfG;=!;X~CbgfwA zOo=Fa3KK$#8;IQ#4W90;SUfHrc#6WGfTsR`3-*5=SS?;DXbP43-yo5&yMk0XNBDdR z)6r{7#0^Y?9=P2lxnx^`LMIbA?er1y)sqYJ{F1DJ&b`I1S;qO1FGGooL=a>AW%uXz z*9-vWPvAvw>Kf|gNl=}$*fyO{y>h8UN5400)<}mIcsBm2Jo1E%w9yQvu zp5MU07*XM4LPolSWBya+TVn9z#-M*NI*?3rl}Ya151b&}Nf@8hcKI=c&{g_Lg|lwM!vwMQGwz+|x8T7zQOjaz|YM7LX^@ z?)sM02O8iKB5sEc`Al8^?;!i%T^)Y$*+69iz~?*A22}$PU?p<30zGCjzu}Acn!C){ zf#Krdqr?Pi3xfoA95Xmbd2B%%1^g)U;K)qw`tr72CgejKL_&Z2u{s$ppLyja9_CuHFD~CvYF09vFHX?FXa5%?PGD_ z$-GuFpw!`j%tLL}qKFFr3h<39ZAOykK@0&C3ps@Ev>S^ErKB$WErsa@euKh9EGY80(oR$EkiDn3;Dq-92PT;^J z!{EP*3g@#pc*P*^gVaV|(dyO`M?KaE#aW$~2nKEzlS3RZpy#V<8@e|yEC znM2RLtX?+{{XGGRpJN;pINV+jGB&}#n5_Sd^16(;P!7YDb%>+@GAjEp9w_74m>b`QAeF5g z!3p;Dd5K`gu(fZ)*zu6r`<;Ruz4Qq&>Gv{YluM0qu(qEkR(SL6d$p~>E%0>`ygI=3 zmwj4WNnA0AGkAGgorO#ijY{_-GQ2o_1r6~xhhb^%a)T62?Tv}!%5X6UYo zSxtOk4K<(PGD(zojY|Z#?qy<92qp8HawGpS?g&Uu)R}qeF`rGawT=7sHdAHkR|c; z=Fqk*ZKE|ARW-<>@YkUtr;BCPlXxc<&|B{uUp@c*Y=BLS`lZiT8RbJ!kU%hNZ6{9q z(J@j~2yD#lvEdWyyL>OjLl)VXAW6s{LJeFJNl#9_@wV-ut@^WPr7NjD)}?8IYd_uI z>6-EeRsFe^#G81LD|szB+hUnDzx3!-$SoZwzhxxj1-O*wJL9dgbnIz{Cd#-iCy!AF z)SdY@zItT>3}6W)>T=tv@D&?q4b~5N#xraBU&AC{c5uZ<{(X+Zl(nVHtXGfmwU3Tb z4Zs{p7vYfh)}mh*f8elz6{pJbIp~Q(ER*4_m&j03XdGhIbO zM|JQjsVJ1W13b)Xo9|G7eV+}x%`JY?KIhJ$^f7x8$O8JbB;^<~<=zx}IiUD*>pkJCvlwDnrJmCSI)$2( z7G<^A!hA#_gn5+JFR%UWA#5UBKN$v7%S@dLvr7`%`z5dC0UA2qY2YPPjuN1sGWY^+ zR|7zE$|QAqVaY{W@3Q;0>SckAnExztTrNi@tRQR~Dc~>12m&hhcvnFu3M;r5a63+L z2U9%s9uWw6-f|6N85Sx3sJOTg5`eGw4Xd$~2U+aqTJtN7pU_pba$dq-hG4gNxBm5A z!!8k%IGt?R^CI@&x!#wb>BEORFwIGfb^tJ84ah6##&f1+fiIrV5JraAvHsEr8Wy`t z{i-m^JKAhQBs>|yt`Z<^m1$?(;U;XuLMj)}N&*1!0Dk-5m5%<|j4t(#tSyF3Mu2Le zr2I6JKhW_RI~K(P2X=LrpPbQ1o;3^Rsur1}jfBhuhV z>SDk;%j;k2<6%?sk?qR-FX`j|9W`^QrYad_Q+@^34wDjPAyoH(1A?hMJVvF`mo)=} z0jSRwcVP$pC}M3H4vMwzaj-HQ+U!1|e3wHc)P+eV?<1j`t* zoMh&?xyvopeE{<+u=!O)q{zjD=o##mLmQ`5Gfje`_uYC&zmqa?M1%vb{~>Hc4*SdM zmfMRd4giuUs@eaLA?kUmR)2aRVuOP5zc>GXzrfQdeXkyah3X!7sYwSQ?58R76$&Pg zyo#i+*SHwqJgoGfn}7Uz>48(<%F**eE%WaoHeiYfKOk#NRbNK{tcuT;*ho$*k&}u zg1yUY7eHNoDt!I`|8z0MHuT0)>dK@_^V`O=RTjEf|FnJo;=ddnnZZ7zBs?T0pazod zwDGOTXw|6^vWt5LCPMlZreWWnX3~Ni2Q{evUFy@lZWb`| zGini#nainqTb#)1ppHS=NojQERZVUo7lX9gv6vLILehT`>h~E=xF1+B4{z^Lva5=Thns~uy}*Q zIGUi3nY|k4d+l!@M~9?uHN0SaTf;=O_}5|zuORuaLJ;VB-lA4vU?LCa`z@q{)vq~F zn3Eaz1Oz5CM9b=%2_Ik14+8urDVg`F0@PR{$KztFpnIrjFGZUJ%sx2_s<6LBwS0Kn z0Btmr$N-KAR5FI*J0dZ7tV_YF3B3#v1qtaEs)JiK9>f3wUy83UaA2=2m5VKG$#7lR zpyn)AnDv`Do4NfYuXdQ&Ur~R~Q!mN=x1&s7rl}|_+2ifm*_nAwSQv^w--KBP$+grF z-hG+9@~se6%m79d5W`c3^WN3s3^*9xD_rAL+no0LHVysx`aSF8f`Gw#V=>f8INm|D z@wb8z7qXEE(VWuV+5}hd{HUkn%-NcF4>Pkw%^X|$XQ%rXqyvqO8;rCrXupop@BrE-Gv$(ao8d2~e`%^uKM7CLGjnq$ z$Bl`R!)|R?*7bJ+V4?;BW%P}HK0aF5F1rh8y-6Y|`6?+gSrL@uZc5~%2_5PWTM;ki z1^#>`N;WZuC5MKGF+e#ff28O^lB9+qOR7sQ2rRX`MAIw3QNweFx7m?IVM(+cua9$)!qWAG^i|*PUd&BJQ(|7g zIeaN!VADs$d^zx<2|{9vw}Av}7rxFH4Mww)5bb=1Y8yAAk>f2Youe?ptUW1?V% zKN2$IoU40FLQ@kLw&0e#JP)FE0KgdYVkP!D!kgi*u4vPM$=Fv?e;1cg{t`bY*CwsO z@z)*K=LGrj@L9r&R8*_+>Hf+h-h(ltFj5}#ftgRSJXR0m<&+I=SpLM5tq{Y zZ0Zi?Pngf3MTRGFFkvjw-KCoi9+Uwl$HL zty6wTrBI^b1!)8~kd96b+?}Z=?>jEpoyDNYN#I6D`e4WA5~o|y`C`m9U;F%7BI|uO zCpFTKPgnik)qF224&gkodw_obS?!B4#EB>Bb~WZMk*f&V_i&qugOP8G`y(JCqDj!w zT>G4E|By)W<-*F*v#l*pv%bmcE$1zfB@Y9}v%Mdw?xGjR#;R>`>FLEkO#Smk?5TYa zkWl~ohtC$WoTa{TEku(d=1wvt#l;Pa!L^MOKT5ewdj={khVY4qmNp+R*IQjZBqUn% zBhrsNcV2v-13s;82cwM-G&G_|CFm%TvBeP(|LeyK6`x#F5y^71eoAG&&PE9FM(szw zi;efb+Vq}5R8HcQzH{f!CZ_*XtxRTat`tYI$s*+IdP7U?4iJe9>TY)%-0E6)>ht~W zb`g*oh^Px)DU56J_9_cCpTykJ7uL|wxD-2tCW5;9;Gq7EsKgiInU$6IphY$eE_(O1 zw1|*JEKk^lA74<2oG#~}U%zg3(p8A_-}n2^?XMD07wT|yXL!AR`*zqmrgW_8>9^|1 zADfC`95L{Ayn+V^I`1up+P{Aq_?d~r?=s_4k#hoC(!vMf6ShdQQc}xFW*H-3e%5fp zm4Wl`0l^k;!a}0wvGws-`EnD&P+8kzeb1Ld-#rCrXzs=^sD6#5`lY?0oE>w;Hy?Gu zcDfiE>z2T6Qg)r>>2GasUv1R)(h(34C|=>Bkp9mvm@gIf)3Zty}p6 zL11l@>iqNgy#f%lGWgX);=6`E*80o;VC?{EmR$`IU)MU=swcCxl;)~{Nve+(cl_H! z#75Ocj7|&3^k@$)&=7 z`Bo-|U&}>`cBOgLdXFjQe@%-2Tpl$QLB3aJA|WBcDt=t#3`m0(3o)DZB6M^uuC_B` zQ2)!#r9ZkR(f?5DG01VboxdNAO-OhRju_?As}7Pkv66oc94BO4+?$=9wOMBOl=^)% zhF~;OZrAbf@FWX47cWg$xUz-mC0`uT$t94y3u2yIESdWaB}vZCS; zq&hrK>)O0fwZ-Nw81?h>Q=zr5cQwmbUJRH3EEEi$0RkEq2pDz08z0ol=0t-a!UEYai4tCse*1eZ!9 zz}M&LqUYbLSz~YO=&0pO#9ll3bOj|0tpDDrV8pnk;PR5Oq;?T{H9xl{v4ZFa z?{n8miLkIJN-9MU#p~C*S9A{Cr)=~r7mD-VACz_bb$;~TaqU4IC^l7BeIJNSOF9`d zj$pneIDzp!FXCT2Azc4eC4#&%)eZ07wh*_ep0P(|Mt)e9&fam%8{b$M89U^kP5f9z zs|y%1dubW7#v62U5zhv$Wv?x*tUSNQKV+%$j<~+q?`%p~%X95C?Dr>JfEGEtKO1Pv z)0rzv=_&=bj~}rf+BuKFG_KjG`o{gZ3E@e~F5mgjig7hA|NTf;D$~1neVr1cGcrm5 zQ^uRayCs&Kl2YW_cs6FesWxaJN9<=3ukF73%#I`PLDcxNKm~uy&AyXC%?CdJ_z3%)!_g8YJ^2hexRZrcjB~dRR zCmF2{Jz2EfV{#?^ZT|ZDz#_cSgk1;K#bm4a zhTR6q>6vc}BW!v#Oz$-r9XW5lw>NWK9aD$%K<&9gu!fSng2JwqQBi(=yS&oGkJ+lR zGBLZe58=N)j+x|NirF1vCc3@P*ZeL$Y2`~9h5z@Q?Mc64#WW?-oxNdr)-K(ok_5=_5{UNQBhIa^V#OBOFUN&?_a4(6>?U&fB$|K24&{*M&F{U z*mVfA-ki-lD!nC*w4UJ8UnTO`L zui_)Fh6+RY!myO^8aZ#)KO`!HT%@@h7Brz1{Zm5i1NxY#foPsc*e6I#n-Kw%&tz z^$)U4nLj@FnIF7e>&DQC3MA56uPX*Y$A)1qDklzv15>GXhdN zHg)03u3^t~gWmOCQ;Dl5C+rcgHtC+-pII|m?D@H+rJ&F?a@|AX_m4$H4u#u}I3pP& zNeLljA9jjaSP*Y|hXmnZUyo8sPvuts!taq2Tw@gvLbHtE5O0=Sx4wYHWb4 z_i*TBm}qI66|-=z|8Wn;cVSUcMZU}mf;jEq>o;4glkz90`$MWPvlRDfTA`;zcW@2| zB!JqUn40=)@4xyzMnFJfV}=v_CXb%RXgGyX;`3`wdL}1(hllSeC*J;~ zV>HzuiNY5kG5tpbN-YPm{}73!9lW4vKPeL;tsyNBDb&!3G-8FB)RS8 zq%K93;9#N*i!J>#2Ev9I=t>r)$%R@P#viln|GxOkOXdFKN=(E=%st80UXSJVRrs*Vsx^zNX z*576YGVGJ4)WdpHrWO{374|jC&o;*^I(`feoZI4=59NnFfBu~N3o8dzd`i*S*qCi? zn$@4*!p8u<#i`$TZCI+Xs|GYyzb-1LR6hO2%S*D`q&5xKP+dG|N-3>%^Wj3nHI7zT zQqrh@TxI4a45mJ5FG7cgv6FH?Uu}W+_H4j}DSG$t6=7-&Yf(W#-SI2e%(pY|c0ue8 zm<+3#m`VTNA{6)&`7(ZcJSmwy0*)*zk};EK%UIrO5QeO`OOpE%1%`$WKb`)W&UM{B zQr_ec06<}0NMfw}e=c%T8kng#+LIH)h$+LBoxK$K_?wf3UnB#PwP;lN5*qoWfX6l5__G5P8*x0D0B^JDTj?3JMt`=xu8RtXTWRCcF2|JsQV1bc=+ zsjZaTEzQmQX~lXYM~B}=pdI*ne|cOJ2M4FYB2xE{Re%6OvT#Nr2rBCv%s|Y3i=Ex6 zOW%H~+BO4LmD4$j#Bp$%Z&FlL765&U`kfn#pcGyJ8B)1W{Ga(V0+K!XDaHH zu)Dpzy(adV;Eyf-|C_^s#lWm)YqepaKp3z|ZTI_)F|e`!vP1K@|C|e)#+NUj`?h7i zz46mSt=x{jiPO7pFG&R+7=A_5G<4;&Ia%lC`W`Y`>n*-?rb}8(OiaLWhv(RG0I<#T zWxK`OpP>t$J#r15@x5f;+7%ZhgZCNCKOY_j%$#1K&tiT)KVN3HV(!<Tnk68bl&5R5T+qf7Qgh2{XK(upyUP)?RNqk6UL27ZV zUPW#Wx&hnEm%M)t)N~1GEH{egCqQH4i&Arn_4Pm`y2hoejMi`b&B(AIh@U|aMdKHs zQRVqXDf%h-$)&kK>#^C}o9>k~M~;EvNGv0R42t$E{}>_KA(kT>g4H2smL6GiOcv<+ zFh&L-g#=c~G9jCkmY-jemtT@v3~~=vqvErl_FC{UFkC&v$RLDd5Cg+%Yp79qrMXF| zMVWc&*gQ4=bgZMbBm;xLJ|hD^ihf})sQ%)T${dIb&;xW2gK(x8FwDJ~8PF`RPKIhm z@d3Ji`8;Ofn?Oqofx(X&AqP{S`jhi>LGb|&0Cer5ueHxs1FheJq5Whk69X_70*dkr ziuIH8i&9};*M%lT;94MtjL!1uprq-1u)&n$#{F&z6IBSmNT)V zC*wt#NV=0ti%arzVFn;uzbZ)ezA_sFL$?$IgD8siE3=`VFUd&FP1OgJhS-cSE>UT^ z1@ys2Ui9$)4-8Upf=&Zwr;x;?9C!#I`(dt%pl9f;IiO);<}xi%@`O!7}bQ-TBr%RsVSL> z`bC~8MuvI?dFh}ufb0fIC4&Wvfo`Y=CSKG?^a3Uea1dmqCZ?noVGY3FhePgp00XcC z7yzicrFWv}HpUkGugwl7gA&gfVE#kZJ#jaRZX;~E&;32ejoog>15n+d%#&J#)o!^- zuOx+885rDwnI6^d@eg-8+t>=*AjqnQXhHzW}5AGBEi|BS$*} z_gScJNI{4c^6#J~W;sCh~E iJk%gaI?BvVOizU-BvxSNV_=X1!s$R(;3i;3U;qG92yJ@+ literal 0 HcmV?d00001 diff --git a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.flat.json b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.flat.json new file mode 100644 index 0000000000..d637dcf5c6 --- /dev/null +++ b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.flat.json @@ -0,0 +1,3109 @@ +{ + "requirements": [ + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.1", + "section_name": "Архитектура кодировки и нейтрализации", + "req_id": "V1.1.1", + "req_description": "Убедитесь, что входные данные декодируются или деэкранируются в каноническую форму (в стандартное представление) только один раз. Декодирование происходит только тогда, когда ожидаются закодированные данные в этой форме, и что это делается перед дальнейшей обработкой входных данных, например, это не выполняется после проверки или нейтрализации.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.1", + "section_name": "Архитектура кодировки и нейтрализации", + "req_id": "V1.1.2", + "req_description": "Убедитесь, что приложение выполняет кодирование и экранирование выходных данных либо в качестве последнего шага перед использованием интерпретатором, для которого оно предназначено, либо самим интерпретатором.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.1", + "req_description": "Убедитесь, что выходная кодировка для ответа HTTP, документа HTML или документа XML соответствует требуемому контексту, например, кодировка соответствующих символов для элементов HTML, атрибутов HTML, комментариев HTML, CSS или полей заголовка HTTP делается таким способом, чтобы избежать изменения структуры сообщения или документа.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.2", + "req_description": "Убедитесь, что при динамическом построении URL-адресов недоверенные данные кодируются в соответствии с их контекстом (например, кодирование URL-адресов или кодирование base64url для query или path параметров или пути). Убедитесь, что разрешены только безопасные протоколы URL-адресов (например, запрещен javascript: или data:).", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.3", + "req_description": "Убедитесь, что при динамическом построении содержимого JavaScript (включая JSON) используется кодирование или экранирование выходных данных, чтобы избежать изменения структуры сообщения или документа (чтобы избежать JavaScript и JSON-инъекций).", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.4", + "req_description": "Убедитесь, что выборка данных (Redis, Memcached, чтение из файлов, обращение по API) или запросы к базе данных (например, SQL, HQL, NoSQL, Cypher) используют параметризованные запросы, ORM, Entity Frameworks или иным образом защищены от SQL-инъекций и других атак. Это также актуально при написании хранимых процедур.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.5", + "req_description": "Убедитесь, что приложение защищено от внедрения команд ОС и что вызовы операционной системы используют параметризованные запросы к ОС или используют контекстное кодирование вывода командной строки.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.6", + "req_description": "Убедитесь, что приложение защищено от LDAP-инъекций, или что реализованы специальные меры безопасности для их предотвращения.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.7", + "req_description": "Убедитесь, что приложение защищено от атак с использованием XPath-инъекций с помощью параметризации запросов или предварительно скомпилированных запросов.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.8", + "req_description": "Убедитесь, что процессоры LaTeX настроены безопасно (например, не используется флаг «–shell‑escape») и используется разрешенный список команд для предотвращения LaTeX-инъекций.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.9", + "req_description": "Убедитесь, что приложение экранирует специальные символы в регулярных выражениях (обычно с помощью обратной косой черты), чтобы предотвратить их ошибочную интерпретацию как метасимволов.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.10", + "req_description": "Убедитесь, что приложение защищено от внедрения формул CSV (CSV Injection). Приложение должно следовать правилам экранирования, определенным в RFC 4180, разделы 2.6 и 2.7, при экспорте содержимого CSV. Кроме того, при экспорте в CSV или другие форматы электронных таблиц (такие как XLS, XLSX или ODF) специальные символы (включая '=', '+', '-', '@', '\\t' (табуляция), и '\\0' (нулевой символ)) должны экранироваться одинарной кавычкой, если они появляются в качестве первого символа в значении поля.", + "L": "3" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.1", + "req_description": "Убедитесь, что все ненадежные входные данные HTML из редакторов WYSIWYG или аналогичных программ нейтрализуются с помощью известных и безопасных библиотек или функций фреймворка для санитизации HTML.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.2", + "req_description": "Убедитесь, что приложение избегает использования eval() или других динамических функций выполнения кода, таких как Spring Expression Language (SpEL). Если нет альтернативы, любой пользовательский ввод должен быть нейтрализован перед выполнением.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.3", + "req_description": "Убедитесь, что данные, передаваемые в потенциально опасный контекст, предварительно нейтрализованы, чтобы обеспечить соблюдение мер безопасности, таких как разрешение только тех символов, которые безопасны для данного контекста, и обрезка слишком длинного ввода.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.4", + "req_description": "Убедитесь, что предоставленный пользователем файл .SVG проверен или нейтрализован, чтобы он содержал только теги и атрибуты (например, относящиеся к рисованию), которые безопасны для приложения, например, не содержат скриптов и foreignObject.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.5", + "req_description": "Убедитесь, что приложение нейтралует или отключает предоставленные пользователем скриптовые данные или выражения шаблонных языков, такие как таблицы стилей Markdown, CSS или XSL, BBCode или аналогичные.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.6", + "req_description": "Убедитесь, что приложение защищено от атак с подделкой запросов на стороне сервера (SSRF), проверяя ненадежные данные по разрешенному списку протоколов, доменов, путей и портов, а также нейтрализуя потенциально опасные символы перед использованием данных для вызова другой службы.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.7", + "req_description": "Убедитесь, что приложение защищено от атак с внедрением шаблонов (template injection), не позволяя создавать шаблоны на основе недоверенных входных данных. Если нет альтернативы, любые недоверенные входные данные, включаемые динамически во время создания шаблона, должны быть нейтрализованы или тщательно провалидированы.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.8", + "req_description": "Убедитесь, что приложение надлежащим образом нейтрализует недоверенные входные данные перед использованием в запросах Java Naming and Directory Interface (JNDI) и что JNDI настроен безопасно для предотвращения атак с использованием JNDI-инъекций.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.9", + "req_description": "Убедитесь, что приложение нейтрализует данные перед отправкой в Memcache, чтобы предотвратить атаки методом инъекций.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.10", + "req_description": "Убедитесь, что строки форматирования, которые могут быть использованы неожидаемым или вредоносным образом, нейтрализуются перед дальнейшим использованием.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.11", + "req_description": "Убедитесь, что приложение нейтрализует вводимые пользователем данные перед передачей в почтовые системы для защиты от SMTP или IMAP-инъекций.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.12", + "req_description": "Убедитесь, что регулярные выражения не содержат элементов, вызывающих экспоненциальный возврат, и убедитесь в нейтрализации недоверенных входных данных для предотвращения атак ReDoS или Runaway Regex.", + "L": "3" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.4", + "section_name": "Память, строки и неуправляемый код", + "req_id": "V1.4.1", + "req_description": "Убедитесь, что для обнаружения или предотвращения ситуаций переполнения стека, буфера или кучи приложение учитывает размер доступной области памяти при строковых операциях, копировании в память, в арифметике указателей и т.п.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.4", + "section_name": "Память, строки и неуправляемый код", + "req_id": "V1.4.2", + "req_description": "Убедитесь, что для предотвращения целочисленного переполнения применяется контроль знака, диапазона и типа допустимых входных данных.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.4", + "section_name": "Память, строки и неуправляемый код", + "req_id": "V1.4.3", + "req_description": "Убедитесь, что динамически выделенная память и ресурсы освобождены, а ссылки или указатели на освобожденную память удалены или установлены в значение null, чтобы предотвратить появление висячих указателей и уязвимостей, связанных с использованием памяти после освобождения.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.5", + "section_name": "Безопасная десериализация", + "req_id": "V1.5.1", + "req_description": "Убедитесь, что приложение настраивает XML-парсеры на использование строгой конфигурации и что небезопасные функции, такие как разрешение внешних сущностей, отключены для предотвращения атак XML eXternal Entity (XXE).", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.5", + "section_name": "Безопасная десериализация", + "req_id": "V1.5.2", + "req_description": "Убедитесь, что десериализация недоверенных данных обеспечивает безопасную обработку ввода, например, используя список разрешенных типов объектов или ограничивая типы объектов, определяемые клиентом, для предотвращения атак десериализации. Механизмы десериализации, которые явно определены как небезопасные, не должны использоваться с недоверенным вводом.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.5", + "section_name": "Безопасная десериализация", + "req_id": "V1.5.3", + "req_description": "Убедитесь, что различные парсеры, используемые в приложении для одного и того же типа данных (например, парсеры JSON, XML, URL), выполняют парсинг согласованным образом и используют один и тот же механизм кодирования символов, чтобы избежать таких проблем, как уязвимости взаимодействия JSON (JSON Interoperability) или различное поведение анализа URI или файлов, которые могут использоваться в атаках удаленного включения файлов (RFI) или подделки запросов на стороне сервера (SSRF).", + "L": "3" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.1", + "section_name": "Документация валидации и бизнес-логики", + "req_id": "V2.1.1", + "req_description": "Убедитесь, что в документации приложения определены правила проверки входных данных на соответствие ожидаемой структуре. Это могут быть распространённые форматы данных, такие как номера кредитных карт, адреса электронной почты, номера телефонов, или внутренний формат данных.", + "L": "1" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.1", + "section_name": "Документация валидации и бизнес-логики", + "req_id": "V2.1.2", + "req_description": "Убедитесь, что в документации приложения указано, как проверять логическую и контекстную согласованность объединенных данных, например, проверять соответствие района и почтового индекса.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.1", + "section_name": "Документация валидации и бизнес-логики", + "req_id": "V2.1.3", + "req_description": "Убедитесь, что ожидания относительно ограничений и проверок бизнес-логики задокументированы как для уровня отдельного пользователя, так и для глобального уровня всего приложения.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.2", + "section_name": "Валидация ввода", + "req_id": "V2.2.1", + "req_description": "Убедитесь, что входные данные провалидированы для обеспечения соответствия бизнес- или функциональным ожиданиям. Валидация должна осуществляться либо по списку допустимых значений, шаблонов и диапазонов, либо путем сравнения входных данных с ожидаемой структурой и логическими ограничениями в соответствии с предопределенными правилами. Для L1 валидация может быть сосредоточена на входных данных, используемых для принятия конкретных бизнес-решений или решений, связанных с безопасностью. Для L2 и выше это должно применяться ко всем входным данным.", + "L": "1" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.2", + "section_name": "Валидация ввода", + "req_id": "V2.2.2", + "req_description": "Убедитесь, что приложение разработано с принудительной валидацией входных данных на уровне доверенного сервиса. Хотя проверка на стороне клиента повышает удобство использования и должна поощряться, на неё не следует полагаться как на средство контроля безопасности.", + "L": "1" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.2", + "section_name": "Валидация ввода", + "req_id": "V2.2.3", + "req_description": "Убедитесь, что приложение обеспечивает обоснованность комбинаций данных в соответствии с предопределенными правилам. Например: возраст должен соответствовать дате рождения; страна и почтовый индекс; количество товара в заказе и на складе.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.3", + "section_name": "Безопасность бизнес-логики", + "req_id": "V2.3.1", + "req_description": "Убедитесь, что приложение обрабатывает потоки бизнес-логики для одного и того же пользователя в ожидаемом последовательном порядке шагов и без пропуска шагов.", + "L": "1" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.3", + "section_name": "Безопасность бизнес-логики", + "req_id": "V2.3.2", + "req_description": "Убедитесь, что ограничения бизнес-логики реализованы в соответствии с документацией приложения, чтобы избежать эксплуатации её недостатков.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.3", + "section_name": "Безопасность бизнес-логики", + "req_id": "V2.3.3", + "req_description": "Убедитесь, что транзакции используются на уровне бизнес-логики таким образом, что операция бизнес-логики либо выполняется полностью, либо откатывается к предыдущему корректному состоянию.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.3", + "section_name": "Безопасность бизнес-логики", + "req_id": "V2.3.4", + "req_description": "Убедитесь, что на уровне бизнес-логики используются механизмы блокировки, чтобы гарантировать невозможность двойного бронирования ограниченных по количеству ресурсов (например, мест в театре или слотов доставки) путем манипулирования логикой приложения.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.3", + "section_name": "Безопасность бизнес-логики", + "req_id": "V2.3.5", + "req_description": "Убедитесь, что для важных потоков бизнес-логики требуется многопользовательское (multi-user) одобрение, чтобы предотвратить несанкционированные или случайные действия. Потоки бизнес-логики могут включать, помимо прочего, крупные денежные переводы, утверждение контрактов, доступ к секретной информации или обход ограничений безопасности на производстве.", + "L": "3" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.4", + "section_name": "Анти-автоматизация", + "req_id": "V2.4.1", + "req_description": "Убедитесь, что используются средства противодействия автоматизации для защиты от чрезмерных вызовов функций приложения, которые могут привести к утечке данных, созданию ненужных данных, исчерпанию квот, нарушению ограничений скорости, отказу в обслуживании или чрезмерному использованию дорогостоящих ресурсов.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.4", + "section_name": "Анти-автоматизация", + "req_id": "V2.4.2", + "req_description": "Убедитесь, что потоки бизнес-логики требуют реалистичного человеческого времени, предотвращая чрезмерно быструю отправку транзакций.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.1", + "section_name": "Документация по безопасности веб-интерфейса", + "req_id": "V3.1.1", + "req_description": "Убедитесь, что в документации приложения описаны ожидаемые функции безопасности, которые должны поддерживать браузеры, использующие приложение (такие как HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) и другие соответствующие механизмы безопасности HTTP). В документации также должно быть обязательно определено, как приложение должно себя вести, если некоторые из этих функций недоступны (например, предупреждать пользователя или блокировать доступ).", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.2", + "section_name": "Непреднамеренная интерпретация контента", + "req_id": "V3.2.1", + "req_description": "Убедитесь, что реализованы меры безопасности, предотвращающие отображение контента или функций браузерами в HTTP-ответах в некорректном контексте (например, запрос API, загруженный пользователем файл или другой ресурс запрашивается напрямую). Возможные способы контроля включают: не обрабатывать содержимое, если поля заголовка HTTP-запроса (например, Sec-Fetch-*) не указывают на корректность контекста; использование заголовка и значения Content-Security-Policy: sandbox directive; или использование заголовка и значения Content-Disposition: attachment.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.2", + "section_name": "Непреднамеренная интерпретация контента", + "req_id": "V3.2.2", + "req_description": "Убедитесь, что данные, предназначенные для отображения в виде текста, а не визуализации в виде HTML, обрабатывается с использованием безопасных функций визуализации (таких как createTextNode или textContent), чтобы предотвратить непреднамеренное выполнение содержимого, такого как HTML или JavaScript.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.2", + "section_name": "Непреднамеренная интерпретация контента", + "req_id": "V3.2.3", + "req_description": "Убедитесь, что приложение избегает затирания DOM при использовании JavaScript на стороне клиента, применяя явные объявления переменных, выполняя строгую проверку типов, избегая сохранения глобальных переменных в объекте документа и реализуя изоляцию пространства имен.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.3", + "section_name": "Настройка файлов cookie", + "req_id": "V3.3.1", + "req_description": "Убедитесь, что у файлов cookie установлен атрибут «Secure», и если префикс «__Host‑» не используется в названии cookie, необходимо использовать префикс «__Secure‑».", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.3", + "section_name": "Настройка файлов cookie", + "req_id": "V3.3.2", + "req_description": "Убедитесь, что значение атрибута SameSite каждой cookie установлено в соответствии с назначением cookie, чтобы ограничить подверженность атакам на восстановление пользовательского интерфейса и атакам с подделкой запросов на уровне браузера, обычно называемым подделкой межсайтовых запросов (CSRF).", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.3", + "section_name": "Настройка файлов cookie", + "req_id": "V3.3.3", + "req_description": "Убедитесь, что cookie имеют префикс «__Host‑» в названии, если только они явно не предназначены для совместного использования с другими хостами.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.3", + "section_name": "Настройка файлов cookie", + "req_id": "V3.3.4", + "req_description": "Убедитесь, что если значение cookie не должно быть доступно для клиентских скриптов (например, сессионный токен), для cookie должен быть установлен атрибут «HttpOnly», а само значение должно передаваться клиенту только через поле заголовка «Set-Cookie».", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.3", + "section_name": "Настройка файлов cookie", + "req_id": "V3.3.5", + "req_description": "Убедитесь, что при записи cookie приложением общая длина имени и значения cookie не превышает 4096 байт. Слишком большие cookie не будут сохраняться браузером и, следовательно, не будут отправляться с запросами, что помешает пользователю использовать функции приложения, зависящие от этого cookie.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.4", + "section_name": "Заголовки механизма безопасности браузера", + "req_id": "V3.4.1", + "req_description": "Убедитесь, что поле заголовка Strict‑Transport‑Security включено во все ответы для реализации политики HTTP Strict Transport Security (HSTS). Необходимо указать максимальное время не менее 1 года, а для L2 и выше политика должна применяться также ко всем поддоменам.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.4", + "section_name": "Заголовки механизма безопасности браузера", + "req_id": "V3.4.2", + "req_description": "Убедитесь, что поле заголовка Cross‑Origin Resource Sharing (CORS) «Access‑Control‑Allow‑Origin» имеет фиксированное значение, заданное приложением, или, если используется заголовок Origin, оно проверяется по списку доверенных источников. При необходимости использования «Access‑Control‑Allow‑Origin: *» убедитесь, что ответ не содержит конфиденциальной информации.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.4", + "section_name": "Заголовки механизма безопасности браузера", + "req_id": "V3.4.3", + "req_description": "Убедитесь, что HTTP-ответы содержат поле заголовка Content-Security-Policy, которое определяет директивы, гарантирующие загрузку и выполнение браузером только доверенного контента или ресурсов, чтобы ограничить выполнение вредоносного JavaScript. Как минимум, необходимо использовать глобальную политику, включающую директивы object-src «none» и base-uri «none», а также определяющую список разрешенных адресов или использующую одноразовые коды или хэши. Для приложений L3 необходимо определить политику использования 'nonce' или hash-конструкций для каждого ответа.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.4", + "section_name": "Заголовки механизма безопасности браузера", + "req_id": "V3.4.4", + "req_description": "Убедитесь, что все HTTP-ответы содержат поле заголовка «X‑Content‑Type‑Options: nosniff». Это предписывает браузерам не использовать анализ контента и определение типа MIME для данного ответа, а также требовать, чтобы значение поля заголовка Content‑Type в ответе соответствовало целевому ресурсу. Например, ответ на запрос стиля принимается только в том случае, если Content‑Type в ответе — «text/css». Это также позволяет браузеру использовать функцию Cross‑Origin Read Blocking (CORB).", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.4", + "section_name": "Заголовки механизма безопасности браузера", + "req_id": "V3.4.5", + "req_description": "Убедитесь, что приложение устанавливает политику реферера для предотвращения утечки технически конфиденциальных данных сторонним сервисам через поле заголовка HTTP-запроса «Referer». Это можно сделать с помощью поля заголовка HTTP-ответа «Referrer‑Policy» или через атрибуты HTML-элемента. Конфиденциальные данные могут включать путь и данные запроса в URL-адресе, а для внутренних непубличных приложений также имя хоста.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.4", + "section_name": "Заголовки механизма безопасности браузера", + "req_id": "V3.4.6", + "req_description": "Убедитесь, что веб-приложение использует директиву frame‑ancestors поля заголовка Content‑Security‑Policy для каждого HTTP-ответа, чтобы гарантировать невозможность его внедрения по умолчанию и внедрение определённых ресурсов разрешено только при необходимости. Обратите внимание, что поле заголовка X‑Frame‑Options, хотя и поддерживается браузерами, устарело и не может быть использовано в качестве основы.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.4", + "section_name": "Заголовки механизма безопасности браузера", + "req_id": "V3.4.7", + "req_description": "Убедитесь, что в поле заголовка Content‑Security‑Policy указано место, куда следует сообщать о нарушениях.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.4", + "section_name": "Заголовки механизма безопасности браузера", + "req_id": "V3.4.8", + "req_description": "Убедитесь, что все HTTP-ответы, инициирующие рендеринг документа (например, ответы с типом содержимого text/html), включают поле заголовка Cross-Origin-Opener-Policy с директивой same-origin или same-origin-allow-popups (при необходимости). Это предотвращает атаки, злоупотребляющие общим доступом к объектам Window, такие как Tabnabbing и Frame Counting.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.5", + "section_name": "Браузерное разделение источников", + "req_id": "V3.5.1", + "req_description": "Убедитесь, что, если приложение не использует механизм предварительной проверки CORS для предотвращения запрещённых кросс-доменных запросов на использование чувствительного функционала, эти запросы валидируются на предмет их происхождения от самого приложения. Это можно сделать, используя и проверяя специальные токены для защиты от подделки или требуя дополнительные поля HTTP-заголовка, не входящие в список «простых заголовков» (CORS-safelisted request-header). Это необходимо для защиты от атак с подделкой запросов через браузер, широко известных как межсайтовая подделка запросов (CSRF).", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.5", + "section_name": "Браузерное разделение источников", + "req_id": "V3.5.2", + "req_description": "Убедитесь, что если приложение использует механизм предварительной проверки CORS для предотвращения неразрешённого использования чувствительного функционала между источниками, вызов этого функционала невозможен с помощью запроса, который не запускает предварительную проверку CORS. Для этого может потребоваться проверка значений полей заголовка запроса «Origin» и «Content-Type» или использование дополнительного поля заголовка, не входящего в безопасный список CORS.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.5", + "section_name": "Браузерное разделение источников", + "req_id": "V3.5.3", + "req_description": "Убедитесь, что HTTP-запросы к чувствительному функционалу используют соответствующие HTTP-методы, такие как POST, PUT, PATCH или DELETE, а не методы, определённые спецификацией HTTP как «безопасные», такие как HEAD, OPTIONS или GET. В качестве альтернативы можно использовать строгую валидацию полей заголовка запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, навигационного запроса или загрузки ресурса (например, источника изображения), где это не ожидается.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.5", + "section_name": "Браузерное разделение источников", + "req_id": "V3.5.4", + "req_description": "Убедитесь, что отдельные приложения размещены на разных именах хостов, чтобы использовать ограничения, предусмотренные политикой same-origin, включая то, как документы или скрипты, загруженные одним источником, могут взаимодействовать с ресурсами из другого источника, а также ограничения на cookie на основе имени хоста.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.5", + "section_name": "Браузерное разделение источников", + "req_id": "V3.5.5", + "req_description": "Убедитесь, что сообщения, полученные интерфейсом postMessage, отвергаются, если источник сообщения не является доверенным или если синтаксис сообщения недействителен.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.5", + "section_name": "Браузерное разделение источников", + "req_id": "V3.5.6", + "req_description": "Убедитесь, что функциональность JSONP не включена нигде в приложении, чтобы избежать атак с использованием межсайтового включения скриптов (XSSI).", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.5", + "section_name": "Браузерное разделение источников", + "req_id": "V3.5.7", + "req_description": "Убедитесь, что данные, требующие авторизации, не включены в ответы ресурсов скриптов, таких как файлы JavaScript, чтобы предотвратить атаки с использованием межсайтового включения скриптов (XSSI).", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.5", + "section_name": "Браузерное разделение источников", + "req_id": "V3.5.8", + "req_description": "Убедитесь, что аутентифицированные ресурсы (такие как изображения, видео, скрипты и другие документы) могут быть загружены или внедрены от имени пользователя только по назначению. Этого можно добиться путём строгой валидации полей заголовка HTTP-запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, или путём установки ограничительного поля заголовка HTTP-ответа Cross‑Origin‑Resource‑Policy, чтобы браузер блокировал возвращаемый контент.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.6", + "section_name": "Целостность внешних ресурсов", + "req_id": "V3.6.1", + "req_description": "Убедитесь, что клиентские ресурсы, такие как библиотеки JavaScript, CSS или веб-шрифты, размещаются только на внешнем сервере (например, в сети доставки контента (Content Delivery Network)), если ресурс статический и имеет версии, а для проверки целостности ресурса используется механизм проверки целостности подресурсов (SRI). Если это невозможно, для каждого ресурса должно быть задокументировано решение по безопасности, обосновывающее это.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.7", + "section_name": "Другие соображения по безопасности браузера", + "req_id": "V3.7.1", + "req_description": "Убедитесь, что приложение использует только те клиентские технологии, которые по-прежнему поддерживаются и считаются безопасными. Примерами технологий, не соответствующих этому требованию, являются плагины NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL или клиентские Java-апплеты.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.7", + "section_name": "Другие соображения по безопасности браузера", + "req_id": "V3.7.2", + "req_description": "Убедитесь, что приложение будет автоматически перенаправлять пользователя на другое имя хоста или домен (который не контролируется приложением), только если этот хост или домен указаны в списке разрешенных.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.7", + "section_name": "Другие соображения по безопасности браузера", + "req_id": "V3.7.3", + "req_description": "Убедитесь, что приложение отображает уведомление, что пользователь перенаправляется на URL-адрес, находящийся вне контроля приложения, с возможностью отмены навигации.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.7", + "section_name": "Другие соображения по безопасности браузера", + "req_id": "V3.7.4", + "req_description": "Убедитесь, что домен верхнего уровня приложения (например, site.tld) ​​добавлен в публичный список предварительной загрузки (preload list) для HTTP Strict Transport Security (HSTS). Это гарантирует, что использование TLS для приложения будет встроено непосредственно в основные браузеры, а не будет полагаться только на поле заголовка ответа Strict-Transport-Security.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.7", + "section_name": "Другие соображения по безопасности браузера", + "req_id": "V3.7.5", + "req_description": "Убедитесь, что приложение ведет себя так, как описано в документации (например, предупреждает пользователя или блокирует доступ), если браузер, используемый для доступа к приложению, не поддерживает ожидаемые функции безопасности.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.1", + "section_name": "Общая безопасность веб-сервисов", + "req_id": "V4.1.1", + "req_description": "Убедитесь, что каждый HTTP-ответ с телом сообщения содержит заголовок Content-Type, который соответствует фактическому содержимому ответа, таким как «text/», «/+xml» и «/xml», включая параметр charset для указания безопасной кодировки символов (например, UTF-8, ISO-8859-1) согласно IANA Media Types.", + "L": "1" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.1", + "section_name": "Общая безопасность веб-сервисов", + "req_id": "V4.1.2", + "req_description": "Убедитесь, что только конечные точки, предназначенные для взаимодействия с пользователем через веб-браузер, автоматически перенаправляют HTTP на HTTPS, в то время как другие сервисы или конечные точки не реализуют прозрачные редиректы. Это необходимо, чтобы избежать ситуации, когда клиент ошибочно отправляет незашифрованные HTTP-запросы а из-за того, что запрос по HTTP автоматически перенаправляется на HTTPS другим сервисом без обработки на входе, утечка чувствительных данных остаётся незамеченной.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.1", + "section_name": "Общая безопасность веб-сервисов", + "req_id": "V4.1.3", + "req_description": "Убедитесь, что любой HTTP-заголовок, используемый приложением и устанавливаемый промежуточным уровнем, таким как балансировщик нагрузки, веб-прокси или backend-for-frontend сервис, не может быть переопределён конечным пользователем. Примеры заголовков: X-Real-IP, X-Forwarded-*, X-User-ID.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.1", + "section_name": "Общая безопасность веб-сервисов", + "req_id": "V4.1.4", + "req_description": "Убедитесь, что разрешены только HTTP-методы, которые явно поддерживаются приложением или его API (включая OPTIONS для preflight-запросов), а неиспользуемые методы заблокированы.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.1", + "section_name": "Общая безопасность веб-сервисов", + "req_id": "V4.1.5", + "req_description": "Убедитесь, что для особо чувствительных запросов или транзакций, проходящих через несколько систем, используются цифровые подписи на уровне сообщений, дополнительно к транспортным средствам защиты.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.2", + "section_name": "Валидация структуры HTTP-сообщений", + "req_id": "V4.2.1", + "req_description": "Убедитесь, что все компоненты приложения (включая балансировщики нагрузки, файрволы и серверы приложений) определяют границы входящих HTTP-сообщений с использованием механизма, соответствующего версии HTTP, чтобы предотвратить HTTP request smuggling. В HTTP/1.x, если присутствует заголовок Transfer-Encoding, заголовок Content-Length должен игнорироваться согласно RFC 2616. При использовании HTTP/2 или HTTP/3, если присутствует Content-Length, веб-сервер должен убедиться, что он совпадает с длиной DATA-фреймов.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.2", + "section_name": "Валидация структуры HTTP-сообщений", + "req_id": "V4.2.2", + "req_description": "Убедитесь, что при генерации HTTP-сообщений заголовок Content-Length не конфликтует с длиной содержимого, определяемой рамками протокола HTTP, чтобы предотвратить HTTP Request Smuggling.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.2", + "section_name": "Валидация структуры HTTP-сообщений", + "req_id": "V4.2.3", + "req_description": "Убедитесь, что приложение не отправляет и не принимает HTTP/2 и HTTP/3 сообщения с заголовками, специфичными для соединения, такими как Transfer-Encoding, чтобы предотвратить HTTP Response Splitting и HTTP Header Injection.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.2", + "section_name": "Валидация структуры HTTP-сообщений", + "req_id": "V4.2.4", + "req_description": "Убедитесь, что приложение принимает HTTP/2 и HTTP/3 запросы только в случае, если поля заголовков и их значения не содержат последовательностей CR (\\r), LF (\\n) или CRLF (\\r\\n), чтобы предотвратить HTTP Header Injection.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.2", + "section_name": "Валидация структуры HTTP-сообщений", + "req_id": "V4.2.5", + "req_description": "Убедитесь, что если приложение (бекенд или фронтенд) формирует и отправляет запросы, оно использует валидацию, очистку или другие механизмы, чтобы не создавать URI (например, для API-вызовов) или HTTP-заголовки (например, Authorization или Cookie) слишком большой длины, чтобы их не принимал приёмник. Это может привести к отказу в обслуживании, например, при отправке слишком длинного запроса (длинный cookie-заголовок), из-за чего сервер постоянно возвращает ошибку.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.3", + "section_name": "GraphQL", + "req_id": "V4.3.1", + "req_description": "Убедитесь, что используется белый список запросов, ограничение глубины вложенности, ограничение количества или анализ стоимости запроса, чтобы предотвратить DoS-атаки на уровне GraphQL или слоя данных из-за дорогостоящих вложенных запросов.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.3", + "section_name": "GraphQL", + "req_id": "V4.3.2", + "req_description": "Убедитесь, что introspection-запросы GraphQL отключены в продакшен-среде, если GraphQL API не предназначен для использования сторонними клиентами.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.1", + "req_description": "Убедитесь, что для всех WebSocket-соединений используется WebSocket поверх TLS (WSS).", + "L": "1" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.2", + "req_description": "Убедитесь, что при первоначальном HTTP WebSocket handshake заголовок Origin проверяется на соответствие списку разрешённых источников для приложения.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.3", + "req_description": "Убедитесь, что если стандартное управление сессиями приложения не может быть использовано, применяются специальные токены, соответствующие требованиям безопасности управления сессиями.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.4", + "req_description": "Убедитесь, что специальные токены управления сессиями WebSocket изначально получаются или валидируются через ранее аутентифицированную HTTPS-сессию при переходе от HTTPS к WebSocket.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.1", + "section_name": "Документация по работе с файлами", + "req_id": "V5.1.1", + "req_description": "Убедитесь, что документация определяет допустимые типы файлов, ожидаемые расширения и максимальный размер (включая распакованный размер) для каждой функции загрузки. Также убедитесь, что в документации указано, как файлы обезвреживаются для конечных пользователей (например, как приложение ведёт себя при обнаружении вредоносного файла).", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.2", + "section_name": "Загрузка файлов и содержимое", + "req_id": "V5.2.1", + "req_description": "Убедитесь, что приложение принимает только те файлы, которые может обработать без потери производительности или отказа в обслуживании.", + "L": "1" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.2", + "section_name": "Загрузка файлов и содержимое", + "req_id": "V5.2.2", + "req_description": "Убедитесь, что при загрузке файла (включая файлы внутри архивов, таких как ZIP) приложение проверяет, соответствует ли расширение ожидаемому, и валидирует, соответствует ли содержимое типу, указанному в расширении. Это включает проверку начальных 'magic bytes', перезапись изображений, использование специализированных библиотек. Для уровня 1 — достаточно проверок для файлов, критичных с точки зрения бизнеса или безопасности. Для уровней 2 и выше — для всех файлов.", + "L": "1" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.2", + "section_name": "Загрузка файлов и содержимое", + "req_id": "V5.2.3", + "req_description": "Убедитесь, что приложение проверяет архивы (например, zip, gz, docx, odt) на максимально допустимый распакованный размер и максимальное количество файлов до распаковки.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.2", + "section_name": "Загрузка файлов и содержимое", + "req_id": "V5.2.4", + "req_description": "Убедитесь, что для каждого пользователя установлены квоты на общий размер и количество файлов, чтобы один пользователь не мог переполнить хранилище.", + "L": "3" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.2", + "section_name": "Загрузка файлов и содержимое", + "req_id": "V5.2.5", + "req_description": "Убедитесь, что приложение не позволяет загружать архивы с символьными ссылками (symlinks), если это не требуется по бизнес-логике. Если требуется — разрешён только строго определённый список допустимых символьных ссылок.", + "L": "3" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.2", + "section_name": "Загрузка файлов и содержимое", + "req_id": "V5.2.6", + "req_description": "Убедитесь, что приложение отклоняет изображения с числом пикселей выше допустимого, чтобы предотвратить атаки 'pixel flood'.", + "L": "3" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.3", + "section_name": "Хранение файлов", + "req_id": "V5.3.1", + "req_description": "Убедитесь, что загруженные или сгенерированные из недоверенного ввода файлы, находящиеся в публичной директории, не исполняются как серверный код при обращении к ним по HTTP.", + "L": "1" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.3", + "section_name": "Хранение файлов", + "req_id": "V5.3.2", + "req_description": "Убедитесь, что при создании путей к файлам приложение использует внутренние или доверенные данные, а не пользовательские имена файлов. Если использование пользовательских имён или метаданных необходимо — требуется строгая проверка и очистка. Это защита от path traversal, LFI, RFI и SSRF.", + "L": "1" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.3", + "section_name": "Хранение файлов", + "req_id": "V5.3.3", + "req_description": "Убедитесь, что при обработке файлов на сервере (например, при распаковке) игнорируются пути, заданные пользователем, во избежание уязвимостей типа 'zip slip'.", + "L": "3" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.4", + "section_name": "Скачивание файлов", + "req_id": "V5.4.1", + "req_description": "Убедитесь, что приложение валидирует или игнорирует имена файлов, переданных пользователем (включая в JSON, JSONP или URL-параметре), и указывает имя файла в заголовке Content-Disposition при ответе.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.4", + "section_name": "Скачивание файлов", + "req_id": "V5.4.2", + "req_description": "Убедитесь, что имена файлов, передаваемые (например, в HTTP-заголовках или вложениях в email), кодируются или очищаются (например, по RFC 6266), чтобы сохранить структуру документа и предотвратить инъекции.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.4", + "section_name": "Скачивание файлов", + "req_id": "V5.4.3", + "req_description": "Убедитесь, что файлы, полученные из недоверенных источников, сканируются антивирусом, чтобы не распространять известное вредоносное содержимое.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.1", + "section_name": "Документация по аутентификации", + "req_id": "V6.1.1", + "req_description": "Убедитесь, что в документации приложения описано, как используются механизмы, такие как ограничение частоты запросов (rate limiting), защита от автоматизации и адаптивные реакции, для защиты от атак, таких как подстановка учётных данных и перебор паролей. Документация должна ясно описывать конфигурацию этих механизмов и предотвращение злонамеренной блокировки аккаунтов.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.1", + "section_name": "Документация по аутентификации", + "req_id": "V6.1.2", + "req_description": "Убедитесь, что задокументирован список контекстно-зависимых слов, запрещённых к использованию в паролях. В него могут входить производные от названий организаций, продуктов, идентификаторов систем, кодовых названий проектов, названий отделов или ролей и тому подобное.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.1", + "section_name": "Документация по аутентификации", + "req_id": "V6.1.3", + "req_description": "Убедитесь, что если приложение поддерживает несколько способов аутентификации, то все они документированы вместе с описанием применяемых средств защиты и уровнем стойкости аутентификации, которые должны быть одинаково применены ко всем способам.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.1", + "req_description": "Убедитесь, что пользовательские пароли содержат не менее 8 символов. Рекомендуется минимальная длина в 15 символов.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.2", + "req_description": "Убедитесь, что пользователи могут менять свои пароли.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.3", + "req_description": "Убедитесь, что для смены пароля требуется ввести как текущий, так и новый пароль.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.4", + "req_description": "Убедитесь, что при регистрации или смене пароля введённый пароль проверяется по списку как минимум из 3000 самых популярных паролей, соответствующих политике (например, минимальной длине).", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.5", + "req_description": "Убедитесь, что допускаются пароли любой структуры, без ограничений на использование определённых символов. Не должно быть требований по обязательному наличию заглавных/строчных букв, цифр или специальных символов.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.6", + "req_description": "Убедитесь, что поля ввода пароля используют type=password для скрытия символов. Разрешено временное отображение всего пароля или последнего введённого символа.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.7", + "req_description": "Убедитесь, что разрешены вставка (paste), использование менеджеров паролей браузера и внешних менеджеров паролей.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.8", + "req_description": "Убедитесь, что пароль проверяется строго в том виде, в котором он был введён пользователем — без обрезки, изменения регистра и других модификаций.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.9", + "req_description": "Убедитесь, что система позволяет использовать пароли длиной не менее 64 символов.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.10", + "req_description": "Убедитесь, что пароль остаётся действительным, пока не будет скомпрометирован или не будет изменён пользователем. Приложение не должно требовать регулярной смены пароля.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.11", + "req_description": "Убедитесь, что используется документированный список контекстно-зависимых слов (например, названия компаний, проектов и т.д.) для предотвращения использования легко угадываемых паролей.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.12", + "req_description": "Убедитесь, что при регистрации или смене пароля проверяется, не входит ли он в список скомпрометированных (утёкших) паролей.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.3", + "section_name": "Общие требования к безопасности аутентификации", + "req_id": "V6.3.1", + "req_description": "Убедитесь, что реализованы меры защиты от атак типа credential stuffing (массовая подстановка учётных данных) и brute-force (перебор паролей), согласно документации по безопасности приложения.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.3", + "section_name": "Общие требования к безопасности аутентификации", + "req_id": "V6.3.2", + "req_description": "Убедитесь, что в приложении отсутствуют или отключены учётные записи по умолчанию (например, root, admin, sa).", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.3", + "section_name": "Общие требования к безопасности аутентификации", + "req_id": "V6.3.3", + "req_description": "Убедитесь, что для доступа к приложению используется либо механизм многофакторной аутентификации, либо комбинация однофакторных. Для уровня L3 один из факторов должен быть аппаратным, обеспечивающим защиту от фишинга, устойчивость к компрометации и подтверждение намерения аутентификации через явное действие пользователя (например, нажатие кнопки на FIDO-ключе или телефоне). Ослабление этих требований допускается только при наличии обоснования и компенсирующих мер.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.3", + "section_name": "Общие требования к безопасности аутентификации", + "req_id": "V6.3.4", + "req_description": "Убедитесь, что при наличии нескольких способов аутентификации, они все задокументированы, и для них единообразно применяются меры защиты и уровни доверия.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.3", + "section_name": "Общие требования к безопасности аутентификации", + "req_id": "V6.3.5", + "req_description": "Убедитесь, что пользователи получают уведомления о подозрительных попытках аутентификации (удачных и неудачных). Это может включать попытки (например, подключения) с необычного устройства или места, частично успешную MFA, попытку после долгого отсутствия или успешную аутентификацию после серии неудачных.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.3", + "section_name": "Общие требования к безопасности аутентификации", + "req_id": "V6.3.6", + "req_description": "Убедитесь, что email не используется ни как однофакторный, ни как многофакторный механизм аутентификации.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.3", + "section_name": "Общие требования к безопасности аутентификации", + "req_id": "V6.3.7", + "req_description": "Убедитесь, что пользователи получают уведомление при изменении данных аутентификации, таких как сброс пароля или изменение логина/email.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.3", + "section_name": "Общие требования к безопасности аутентификации", + "req_id": "V6.3.8", + "req_description": "Убедитесь, что из сообщений об ошибке, HTTP-кодов ответа или различий во времени ответа нельзя определить, существует ли пользователь с таким логином. Это правило также должно применяться к функциям регистрации и восстановления пароля.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.4", + "section_name": "Жизненный цикл и восстановление факторов аутентификации", + "req_id": "V6.4.1", + "req_description": "Убедитесь, что начальные пароли или коды активации, генерируемые системой, создаются с использованием надёжного генератора случайных чисел, соответствуют текущей политике паролей и истекают через короткий период времени либо после первого использования. Эти секреты не должны использоваться как постоянные пароли.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.4", + "section_name": "Жизненный цикл и восстановление факторов аутентификации", + "req_id": "V6.4.2", + "req_description": "Убедитесь, что в системе отсутствуют подсказки к паролю или вопросы на знание («секретные вопросы»).", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.4", + "section_name": "Жизненный цикл и восстановление факторов аутентификации", + "req_id": "V6.4.3", + "req_description": "Убедитесь, что реализован безопасный процесс сброса забытого пароля, который не обходит активные механизмы многофакторной аутентификации.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.4", + "section_name": "Жизненный цикл и восстановление факторов аутентификации", + "req_id": "V6.4.4", + "req_description": "Убедитесь, что в случае утраты одного из факторов MFA проводится удостоверение личности (identity proofing) на том же уровне, что и при первичной регистрации.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.4", + "section_name": "Жизненный цикл и восстановление факторов аутентификации", + "req_id": "V6.4.5", + "req_description": "Убедитесь, что инструкции по обновлению истекающих механизмов аутентификации отправляются заранее, с достаточным запасом времени для выполнения замены, при необходимости с настройкой автоматических напоминаний.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.4", + "section_name": "Жизненный цикл и восстановление факторов аутентификации", + "req_id": "V6.4.6", + "req_description": "Убедитесь, что администраторы могут инициировать процесс сброса пароля, но не могут задать или выбрать новый пароль за пользователя. Это исключает ситуацию, при которой администратор знает пароль пользователя.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.5", + "section_name": "Общие требования к многофакторной аутентификации", + "req_id": "V6.5.1", + "req_description": "Убедитесь, что lookup-секреты, внеполосные коды/запросы и TOTP-коды можно использовать только один раз.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.5", + "section_name": "Общие требования к многофакторной аутентификации", + "req_id": "V6.5.2", + "req_description": "Убедитесь, что при хранении lookup-секретов с энтропией менее 112 бит (например, 19 случайных буквенно-цифровых символов или 34 случайные цифры) они хэшируются с использованием разрешённого алгоритма хеширования паролей и случайной соли минимум 32 бита. Если у секрета ≥112 бит энтропии — допустимо использовать стандартный хэш.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.5", + "section_name": "Общие требования к многофакторной аутентификации", + "req_id": "V6.5.3", + "req_description": "Убедитесь, что lookup-секреты, коды внеполосной аутентификации и сиды для TOTP генерируются с использованием криптографически стойкого генератора случайных чисел (CSPRNG), чтобы избежать предсказуемых значений.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.5", + "section_name": "Общие требования к многофакторной аутентификации", + "req_id": "V6.5.4", + "req_description": "Убедитесь, что lookup-секреты и внеполосные коды аутентификации имеют минимум 20 бит энтропии (достаточно, например, 4 случайных алфавитно-цифровых символов или 6 случайных цифр).", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.5", + "section_name": "Общие требования к многофакторной аутентификации", + "req_id": "V6.5.5", + "req_description": "Убедитесь, что все внеполосные запросы, коды и токены, а также TOTP-коды имеют ограниченный срок действия. Максимум для out-of-band — 10 минут, для TOTP — 30 секунд.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.5", + "section_name": "Общие требования к многофакторной аутентификации", + "req_id": "V6.5.6", + "req_description": "Убедитесь, что любой фактор аутентификации (включая физические устройства) может быть отозван в случае кражи или утери.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.5", + "section_name": "Общие требования к многофакторной аутентификации", + "req_id": "V6.5.7", + "req_description": "Убедитесь, что биометрические механизмы аутентификации используются только как вторичный фактор — в сочетании с «чем-то, что вы знаете» или «чем-то, что у вас есть».", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.5", + "section_name": "Общие требования к многофакторной аутентификации", + "req_id": "V6.5.8", + "req_description": "Убедитесь, что TOTP-коды проверяются по источнику времени, полученному от доверенного сервиса, а не от клиента или недоверенного источника.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.6", + "section_name": "Внеполосные механизмы аутентификации", + "req_id": "V6.6.1", + "req_description": "Убедитесь, что механизмы аутентификации через телефонную сеть общего пользования (PSTN) для доставки одноразовых паролей (OTP) по телефону или SMS используются только в случае предварительной валидации номера, при этом предлагаются альтернативные более безопасные методы (например, TOTP), и пользователю сообщаются риски. Для приложений уровня L3 использование телефона и SMS недопустимо.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.6", + "section_name": "Внеполосные механизмы аутентификации", + "req_id": "V6.6.2", + "req_description": "Убедитесь, что внеполосные запросы, коды или токены привязаны к исходному запросу аутентификации, для которого они были сгенерированы, и не могут быть использованы повторно для других попыток.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.6", + "section_name": "Внеполосные механизмы аутентификации", + "req_id": "V6.6.3", + "req_description": "Убедитесь, что внеполосные механизмы на основе кода защищены от атак методом подбора (brute force) путём применения ограничения частоты запросов (rate limiting). Также рекомендуется использовать коды с энтропией не менее 64 бит.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.6", + "section_name": "Внеполосные механизмы аутентификации", + "req_id": "V6.6.4", + "req_description": "Убедитесь, что при использовании push-уведомлений для MFA применяется ограничение частоты (rate limiting), чтобы предотвратить атаки push-бомбинга. Также может помочь механизм сопоставления номеров (number matching).", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.7", + "section_name": "Криптографические механизмы аутентификации", + "req_id": "V6.7.1", + "req_description": "Убедитесь, что сертификаты, используемые для проверки криптографических утверждений об аутентификации, хранятся таким образом, чтобы исключить возможность их модификации.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.7", + "section_name": "Криптографические механизмы аутентификации", + "req_id": "V6.7.2", + "req_description": "Убедитесь, что nonce (случайная строка), используемая в процессе вызова, имеет длину не менее 64 бит и является статистически уникальной или уникальной на протяжении всего срока службы криптографического устройства.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.8", + "section_name": "Аутентификация с использованием провайдера идентификаций (IdP)", + "req_id": "V6.8.1", + "req_description": "Убедитесь, что при поддержке несколькими IdP, невозможно подделать личность пользователя через другой IdP (например, с тем же user ID). Стандартным способом защиты является регистрация пользователя с использованием сочетания ID самого IdP (в качестве пространства имён) и пользовательского ID внутри IdP.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.8", + "section_name": "Аутентификация с использованием провайдера идентификаций (IdP)", + "req_id": "V6.8.2", + "req_description": "Убедитесь, что наличие и целостность цифровой подписи в утверждениях аутентификации (например, в JWT или SAML) всегда проверяются, а неподписанные или недействительные утверждения отклоняются.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.8", + "section_name": "Аутентификация с использованием провайдера идентификаций (IdP)", + "req_id": "V6.8.3", + "req_description": "Убедитесь, что SAML-утверждения обрабатываются только один раз в течение периода их действия, чтобы исключить атаки воспроизведения (replay attacks).", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.8", + "section_name": "Аутентификация с использованием провайдера идентификаций (IdP)", + "req_id": "V6.8.4", + "req_description": "Убедитесь, что если приложение использует внешний поставщик идентификации (IdP) и для определенных функций требуется особый уровень, метод или срок действия аутентификации, то приложение использует данные, возвращаемые IdP, для проверки этих условий. Например, при использовании OIDC можно проверить значения полей ID Token — acr, amr, auth_time (если они есть). Если IdP не предоставляет эти данные, приложение должно иметь документированный план действий по умолчанию, предполагающий использование минимально допустимой силы аутентификации (например, одноступенчатая — логин и пароль).", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.1", + "section_name": "Документация по управлению сессиями", + "req_id": "V7.1.1", + "req_description": "Убедитесь, что тайм-аут бездействия и абсолютное максимальное время жизни сессии задокументированы, соответствуют другим контрольным мерам и сопровождаются обоснованием любых отклонений от требований повторной аутентификации NIST SP 800-63B.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.1", + "section_name": "Документация по управлению сессиями", + "req_id": "V7.1.2", + "req_description": "Убедитесь, что документация определяет допустимое количество одновременных (параллельных) сессий для одного аккаунта, а также поведение системы и действия при достижении этого лимита.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.1", + "section_name": "Документация по управлению сессиями", + "req_id": "V7.1.3", + "req_description": "Убедитесь, что все системы, создающие и управляющие сессиями пользователей в рамках федеративной идентификации (например, SSO), задокументированы вместе с механизмами координации сроков действия сессий, условий завершения и случаев, требующих повторной аутентификации.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.2", + "section_name": "Базовая безопасность сессий", + "req_id": "V7.2.1", + "req_description": "Убедитесь, что все проверки сессионных токенов выполняются на доверенной серверной стороне.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.2", + "section_name": "Базовая безопасность сессий", + "req_id": "V7.2.2", + "req_description": "Убедитесь, что приложение использует либо автономные токены, либо ссылочные токены, которые генерируются динамически, не используя статические API-секреты или ключи.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.2", + "section_name": "Базовая безопасность сессий", + "req_id": "V7.2.3", + "req_description": "Убедитесь, что ссылочные токены являются уникальными, создаются с использованием криптографически безопасного генератора псевдослучайных чисел (CSPRNG) и обладают энтропией не менее 128 бит.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.2", + "section_name": "Базовая безопасность сессий", + "req_id": "V7.2.4", + "req_description": "Убедитесь, что при аутентификации пользователя (включая повторную) создается новый токен сессии, а текущий — аннулируется.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.3", + "section_name": "Тайм-ауты сессии", + "req_id": "V7.3.1", + "req_description": "Убедитесь, что есть тайм-аут бездействия, после которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.3", + "section_name": "Тайм-ауты сессии", + "req_id": "V7.3.2", + "req_description": "Убедитесь, что установлено абсолютное максимальное время жизни сессии, по истечении которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.4", + "section_name": "Завершение сессий", + "req_id": "V7.4.1", + "req_description": "Убедитесь, что после завершения сессии (logout, истечение срока) дальнейшее её использование невозможно. Для ссылочных токенов или сессий с сохранением состояния это означает аннулирование на сервере. Для self-contained токенов необходимо реализовать механизм отзыва, например, список отозванных токенов, проверку времени выпуска или ротацию ключей подписи для каждого пользователя.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.4", + "section_name": "Завершение сессий", + "req_id": "V7.4.2", + "req_description": "Убедитесь, что при удалении или отключении пользователя все активные сессии немедленно завершаются.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.4", + "section_name": "Завершение сессий", + "req_id": "V7.4.3", + "req_description": "Убедитесь, что после изменения или удаления факторов аутентификации (например, смена пароля или MFA) приложение предлагает завершить все другие активные сессии.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.4", + "section_name": "Завершение сессий", + "req_id": "V7.4.4", + "req_description": "Убедитесь, что на всех страницах, требующих аутентификации, имеется простой и видимый способ выхода.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.4", + "section_name": "Завершение сессий", + "req_id": "V7.4.5", + "req_description": "Убедитесь, что администраторы могут завершать активные сессии конкретного пользователя или всех пользователей.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.5", + "section_name": "Защита от злоупотреблений сессией", + "req_id": "V7.5.1", + "req_description": "Убедитесь, что приложение требует полной повторной аутентификации перед изменением чувствительных атрибутов аккаунта, которые могут влиять на аутентификацию (например, email, номер телефона, настройки MFA или данных восстановления доступа).", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.5", + "section_name": "Защита от злоупотреблений сессией", + "req_id": "V7.5.2", + "req_description": "Убедитесь, что пользователь может просматривать и (после повторной аутентификации хотя бы по одному фактору) завершать активные сессии.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.5", + "section_name": "Защита от злоупотреблений сессией", + "req_id": "V7.5.3", + "req_description": "Убедитесь, что перед выполнением критически важных операций приложение требует повторной аутентификации (по крайней мере, одного фактора) или дополнительной проверки.", + "L": "3" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.6", + "section_name": "Федеративная повторная аутентификация", + "req_id": "V7.6.1", + "req_description": "Убедитесь, что срок действия и завершение сессий между RP и IdP соответствуют документации и включают повторную аутентификацию, если достигнут максимальный допустимый интервал между событиями аутентификации.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.6", + "section_name": "Федеративная повторная аутентификация", + "req_id": "V7.6.2", + "req_description": "Убедитесь, что создание сессии требует согласия пользователя или явного действия, предотвращающего несанкционированное создание сессий без участия пользователя.", + "L": "2" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.1", + "section_name": "Документация по авторизации", + "req_id": "V8.1.1", + "req_description": "Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне функций и на уровне данных на основе прав субъекта и атрибутов ресурса.", + "L": "1" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.1", + "section_name": "Документация по авторизации", + "req_id": "V8.1.2", + "req_description": "Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне полей (как на чтение, так и на запись) на основе прав субъекта и атрибутов ресурса. Эти правила могут зависеть от других атрибутов объекта данных, например, статуса.", + "L": "2" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.1", + "section_name": "Документация по авторизации", + "req_id": "V8.1.3", + "req_description": "Убедитесь, что документация определяет, какие атрибуты окружения и контекста (например, время суток, IP-адрес, местоположение, устройство) используются приложением для принятия решений в области аутентификации и авторизации.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.1", + "section_name": "Документация по авторизации", + "req_id": "V8.1.4", + "req_description": "Убедитесь, что документация по аутентификации и авторизации определяет, как используются факторы окружения и контекста в принятии решений, наряду с правилами доступа к функциям, данным и полям. Документация должна содержать оцениваемые атрибуты, пороговые значения риска, действия (разрешить, отказать, повысить уровень аутентификации и др.).", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.2", + "section_name": "Архитектура авторизации", + "req_id": "V8.2.1", + "req_description": "Убедитесь, что приложение обеспечивает доступ на уровне функций (function-level) только субъектам с явными разрешениями.", + "L": "1" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.2", + "section_name": "Архитектура авторизации", + "req_id": "V8.2.2", + "req_description": "Убедитесь, что приложение обеспечивает доступ на уровне данных (data-specific) только тем субъектам, которым явно предоставлены права к определённым элементам данных, чтобы предотвратить IDOR (Insecure Direct Object Reference) и BOLA-уязвимости (Broken Object Level Authorization).", + "L": "1" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.2", + "section_name": "Архитектура авторизации", + "req_id": "V8.2.3", + "req_description": "Убедитесь, что приложение обеспечивает доступ на уровне полей (field-level) только тем субъектам, которым явно предоставлены права к определённым полям, чтобы предотвратить BOPLA (Broken Object Property Level Authorization).", + "L": "2" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.2", + "section_name": "Архитектура авторизации", + "req_id": "V8.2.4", + "req_description": "Убедитесь, что реализованы адаптивные меры безопасности, основанные на атрибутах окружения и контекста субъекта (время, местоположение, IP, устройство), которые используются для принятия решений об аутентификации и авторизации, как это определено в документации приложения. Эти меры должны применяться как при попытке субъекта начать новую сессию, так и во время существующей сессии.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.3", + "section_name": "Авторизация на уровне операций", + "req_id": "V8.3.1", + "req_description": "Убедитесь, что правила авторизации реализуются на доверенном сервисном уровне и не зависят от элементов, которые может контролировать клиент (например, JavaScript на стороне клиента).", + "L": "1" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.3", + "section_name": "Авторизация на уровне операций", + "req_id": "V8.3.2", + "req_description": "Убедитесь, что изменения значений, влияющих на авторизацию, применяются немедленно. Если это невозможно (например, при использовании автономных токенов), должны быть реализованы компенсирующие меры: оповещения о попытке несанкционированного действия и откат изменений. Обратите внимание, что данный подход не предотвращает утечку информации.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.3", + "section_name": "Авторизация на уровне операций", + "req_id": "V8.3.3", + "req_description": "Убедитесь, что доступ к объекту осуществляется на основе прав субъекта, инициировавшего запрос, а не прав промежуточного сервиса, действующего от его имени. Например, если пользователь обращается к веб-сервису с автономным токеном для аутентификации, а сервис затем запрашивает данные у другого сервиса, второй сервис должен использовать токен пользователя, а не токен первого сервиса для принятия решения о доступе.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.4", + "section_name": "Прочие аспекты авторизации", + "req_id": "V8.4.1", + "req_description": "Убедитесь, что в мультитенантных приложениях реализованы механизмы, предотвращающие действия потребителя в отношении арендаторов, к которым у него нет доступа.", + "L": "2" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.4", + "section_name": "Прочие аспекты авторизации", + "req_id": "V8.4.2", + "req_description": "Убедитесь, что доступ к административным интерфейсам защищён несколькими уровнями контроля, включая непрерывную проверку личности, контроль защищённости устройства и анализ контекстных рисков. Недостаточно опираться только на IP-адрес или доверенные устройства.", + "L": "3" + }, + { + "chapter_id": "V9", + "chapter_name": "Автономные токены", + "section_id": "V9.1", + "section_name": "Источник токена и его целостность", + "req_id": "V9.1.1", + "req_description": "Убедитесь, что автономные токены проверяются на целостность с помощью цифровой подписи или MAC, прежде чем доверять их содержимому.", + "L": "1" + }, + { + "chapter_id": "V9", + "chapter_name": "Автономные токены", + "section_id": "V9.1", + "section_name": "Источник токена и его целостность", + "req_id": "V9.1.2", + "req_description": "Проверяйте, что автономные токены создаются и проверяются исключительно с помощью алгоритмов из списка допустимых в данном контексте. Список допустимых алгоритмов должен включать только разрешенные алгоритмы (желательно либо только симметричные, либо только асимметричные) и ни в коем случае не содержать алгоритм None. Если необходимо поддерживать оба типа алгоритмов, потребуются дополнительные средства контроля для предотвращения путаницы с ключами (key confusion).", + "L": "1" + }, + { + "chapter_id": "V9", + "chapter_name": "Автономные токены", + "section_id": "V9.1", + "section_name": "Источник токена и его целостность", + "req_id": "V9.1.3", + "req_description": "Убедитесь, что ключи, используемые для проверки автономных токенов, получены из доверенных, предварительно настроенных источников. Это предотвращает возможность указания злоумышленниками ненадёжных источников и ключей. Для JWT и других JWS структур заголовки 'jku', 'x5u' и 'jwk' должны проверяться по белому списку.", + "L": "1" + }, + { + "chapter_id": "V9", + "chapter_name": "Автономные токены", + "section_id": "V9.2", + "section_name": "Содержимое токена", + "req_id": "V9.2.1", + "req_description": "Убедитесь, что при указанном сроке действия токен и его содержимое принимаются только в том случае, если срок действия токена не истёк. Например, для JWT нужно проверить поля 'nbf' и 'exp'.", + "L": "1" + }, + { + "chapter_id": "V9", + "chapter_name": "Автономные токены", + "section_id": "V9.2", + "section_name": "Содержимое токена", + "req_id": "V9.2.2", + "req_description": "Убедитесь, что сервис, принимающий токен, проверяет его тип и соответствие назначению перед обработкой содержимого токена. Например, для принятия решений об авторизации могут быть приняты только Access Token, а для подтверждения аутентификации пользователя — только ID Token.", + "L": "2" + }, + { + "chapter_id": "V9", + "chapter_name": "Автономные токены", + "section_id": "V9.2", + "section_name": "Содержимое токена", + "req_id": "V9.2.3", + "req_description": "Убедитесь, что сервис принимает только токены, предназначенные для использования с этим сервисом (audience). Для JWT это можно сделать, проверив наличие утверждения «aud» по белому списку, определенному в сервисе.", + "L": "2" + }, + { + "chapter_id": "V9", + "chapter_name": "Автономные токены", + "section_id": "V9.2", + "section_name": "Содержимое токена", + "req_id": "V9.2.4", + "req_description": "Убедитесь, что, если эмитент токенов использует один и тот же закрытый ключ для выпуска токенов различным сервисам (audiences), выпущенные токены содержат явное указание целевых сервисов. Это предотвратит повторное использования токенов в не предназначенных для них сервисах. Если идентификатор сервиса (audience identifier) назначается динамически, эмитент токенов должен проверить audiences для исключения подмены получателей (audience impersonation).", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.1", + "section_name": "Общие требования безопасности OAuth и OIDC", + "req_id": "V10.1.1", + "req_description": "Убедитесь, что токены передаются только тем компонентам, которым они действительно необходимы. Например, при использовании схемы backend-for-frontend для браузерных JavaScript-приложений, access и refresh токены должны быть доступны только на backend.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.1", + "section_name": "Общие требования безопасности OAuth и OIDC", + "req_id": "V10.1.2", + "req_description": "Убедитесь, что клиент принимает значения от авторизационного сервера (например, authorization code или ID Token) только если они получены в результате авторизационного потока, инициированного в той же сессии пользовательского агента и в рамках той же транзакции. Для этого клиентские секреты, такие как proof key для code exchange (PKCE) — 'code_verifier', 'state' или OIDC 'nonce' — должны быть непредсказуемыми, специфичными для транзакции и надежно привязанными как к клиенту, так и к сессии пользовательского агента, в которой началась транзакция.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.2", + "section_name": "Клиент OAuth", + "req_id": "V10.2.1", + "req_description": "Убедитесь, что если используется механизм authorization code flow, OAuth клиент защищён от CSRF, вызывающих запросы токенов либо за счёт использования механизма proof key for code exchange (PKCE), либо за счёт проверки параметра 'state', который был отправлен в запросе авторизации.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.2", + "section_name": "Клиент OAuth", + "req_id": "V10.2.2", + "req_description": "Убедитесь, что если OAuth клиент может взаимодействовать с более чем одним сервером авторизации, у него есть защита от атак смешивания (mix-up attacks). Например, клиент должен требовать, чтобы сервер авторизации возвращал параметр 'iss' и проверять его в ответах на авторизацию и токены.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.2", + "section_name": "Клиент OAuth", + "req_id": "V10.2.3", + "req_description": "Убедитесь, что OAuth клиент запрашивает только необходимые области доступа (scopes) или другие параметры авторизации в запросах к серверу авторизации.", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.3", + "section_name": "Сервер ресурсов OAuth", + "req_id": "V10.3.1", + "req_description": "Убедитесь, что сервер ресурсов принимает только те access токены, которые предназначены для использования с этим сервисом (свойство audience). Эта принадлежность сервису может быть включена в структурированный access токен (например, в поле 'aud' в JWT) или проверяться через endpoint интроспекции токена.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.3", + "section_name": "Сервер ресурсов OAuth", + "req_id": "V10.3.2", + "req_description": "Убедитесь, что сервер ресурсов принимает решения по авторизации на основе claims из access токена, определяющих делегированную авторизацию. Если присутствуют claims, такие как 'sub', 'scope' и 'authorization_details', они должны участвовать в принятии решения.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.3", + "section_name": "Сервер ресурсов OAuth", + "req_id": "V10.3.3", + "req_description": "Убедитесь, что если для принятия решения по контролю доступа необходимо однозначно идентифицировать пользователя из access токена (JWT или ответа интроспекции), сервер ресурсов использует claims, которые не могут быть переприсвоены другим пользователям. Обычно это комбинация claims 'iss' и 'sub'.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.3", + "section_name": "Сервер ресурсов OAuth", + "req_id": "V10.3.4", + "req_description": "Убедитесь, что если сервер ресурсов требует определённой силы аутентификации, методов или свежести аутентификации, он проверяет, что предъявленный access токен удовлетворяет этим требованиям. Например, при наличии, могут использоваться claims OIDC 'acr', 'amr' и 'auth_time'.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.3", + "section_name": "Сервер ресурсов OAuth", + "req_id": "V10.3.5", + "req_description": "Убедитесь, что сервер ресурсов предотвращает использование украденных access токенов или их повторное использование (replay) неавторизованными лицами, требуя access токены с подтверждением отправителя — например, Mutual TLS для OAuth 2 или OAuth 2 Demonstration of Proof of Possession (DPoP).", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.1", + "req_description": "Убедитесь, что сервер авторизации проверяет URI перенаправления (redirect URI), сверяя его с заранее зарегистрированным списком разрешённых URI для данного клиента (allowlist), используя точное сравнение строк.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.2", + "req_description": "Убедитесь, что если сервер авторизации возвращает authorization code в ответе авторизации, этот код может быть использован только один раз для запроса токена. При втором валидном запросе с уже использованным кодом сервер должен отклонить запрос и отозвать любые токены, связанные с этим кодом.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.3", + "req_description": "Убедитесь, что authorization code имеет короткое время жизни. Максимальная продолжительность — до 10 минут для приложений L1 и L2 и до 1 минуты для приложений L3.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.4", + "req_description": "Убедитесь, что сервер авторизации для конкретного клиента разрешает использование только тех типов авторизации, которые необходимы этому клиенту. Обратите внимание, что тип авторизации Implicit flow и Resource Owner Password Credentials flow больше не должны использоваться.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.5", + "req_description": "Убедитесь, что сервер авторизации предотвращает атаки повторного использования refresh токенов для публичных клиентов, предпочтительно используя sender-constrained refresh токены, такие как DPoP или сертификат-связанные токены с mutual TLS (mTLS). Для L1 и L2 допускается ротация refresh токенов с обязательной их инвалидацией после использования. Если используется ротация, сервер должен отозвать все refresh токены при попытке использовать уже инвалидированный токен.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.6", + "req_description": "Убедитесь, что при использовании типа авторизации «Authorization Code» сервер предотвращает атаки перехвата authorization code, требуя Proof Key for Code Exchange (PKCE). В запросах авторизации сервер должен требовать валидное значение 'code_challenge' и не принимать 'code_challenge_method' со значением 'plain'. В запросах токена обязательно валидировать параметр 'code_verifier'.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.7", + "req_description": "Убедитесь, что если сервер авторизации поддерживает динамическую регистрацию клиентов без аутентификации, он минимизирует риски вредоносных клиентов. Сервер должен валидировать метаданные клиента (например, зарегистрированные URI), обеспечивать согласие пользователя и предупреждать пользователя перед обработкой запроса авторизации от недоверенного клиента.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.8", + "req_description": "Убедитесь, что refresh токены имеют абсолютный срок действия, включая случаи, когда применяется скользящее время истечения срока.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.9", + "req_description": "Убедитесь, что пользователи могут отзывать refresh токены и reference access токены через пользовательский интерфейс сервера авторизации для снижения риска от вредоносных клиентов или кражи токенов.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.10", + "req_description": "Убедитесь, что конфиденциальный клиент аутентифицируется при взаимодействии с сервером авторизации через backchannel, например при запросах токена, pushed authorization requests (PAR) и запросах на отзыв токенов.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.11", + "req_description": "Убедитесь, что конфигурация сервера авторизации назначает OAuth клиенту только необходимые области доступа (scopes).", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.12", + "req_description": "Убедитесь, что для конкретного клиента сервер авторизации разрешает только те значения 'response_mode', которые необходимы этому клиенту. Например, сервер должен валидировать это значение против ожидаемых или использовать pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.13", + "req_description": "Убедитесь, что грант типа 'code' всегда используется вместе с pushed authorization requests (PAR).", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.14", + "req_description": "Убедитесь, что сервер авторизации выдаёт только sender-constrained (Proof-of-Possession) access токены, либо с сертификат-связанными токенами через mutual TLS (mTLS), либо DPoP-bound токены (Demonstration of Proof of Possession).", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.15", + "req_description": "Убедитесь, что для серверного клиента (не выполняющегося на устройстве конечного пользователя) сервер авторизации проверяет, что значение параметра 'authorization_details' исходит из клиентского backend и что пользователь не изменял его. Например, это достигается использованием pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.16", + "req_description": "Убедитесь, что клиент является конфиденциальным и сервер авторизации требует использования сильных методов аутентификации клиента (основанных на криптографии с открытым ключом и устойчивых к атакам повторного воспроизведения), таких как mutual TLS ('tls_client_auth', 'self_signed_tls_client_auth') или private key JWT ('private_key_jwt').", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.5", + "section_name": "Клиент OIDC", + "req_id": "V10.5.1", + "req_description": "Убедитесь, что клиент (relying party) защищается от повторного использования ID Token (replay-атак). Например, это достигается проверкой того, что значение 'nonce' в ID Token совпадает со значением 'nonce', отправленным в запросе аутентификации провайдеру OpenID (authorization server).", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.5", + "section_name": "Клиент OIDC", + "req_id": "V10.5.2", + "req_description": "Убедитесь, что клиент однозначно идентифицирует пользователя по утверждениям (claims) ID Token, обычно это 'sub', который не может быть переназначен другому пользователю (в пределах конкретного провайдера идентификации).", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.5", + "section_name": "Клиент OIDC", + "req_id": "V10.5.3", + "req_description": "Убедитесь, что клиент отклоняет попытки злоумышленного сервера авторизации выдавать себя за другой сервер авторизации через метаданные сервера авторизации. Клиент должен отклонить метаданные, если URL издателя (issuer) в метаданных не совпадает точно с преднастроенным URL издателя, ожидаемым клиентом.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.5", + "section_name": "Клиент OIDC", + "req_id": "V10.5.4", + "req_description": "Убедитесь, что клиент проверяет, что ID Token предназначен для него (проверка audience), сравнивая значение 'aud' в токене с 'client_id' клиента.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.5", + "section_name": "Клиент OIDC", + "req_id": "V10.5.5", + "req_description": "Убедитесь, что при использовании OIDC back-channel logout клиент снижает риск отказа в обслуживании, вызванный принудительным выходом из системы и путаницей между разными типами JWT (cross-JWT confusion) в процессе логаута. Клиент должен проверить, что токен выхода корректно типизирован со значением 'logout+jwt', содержит claim 'event' с правильным именем участника и не содержит 'nonce'. Также рекомендуется установить короткий срок действия токена (например, 2 минуты).", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.6", + "section_name": "Провайдер OpenID", + "req_id": "V10.6.1", + "req_description": "Убедитесь, что провайдер OpenID допускает только значения 'code', 'ciba', 'id_token' или 'id_token code' для параметра response mode. При этом предпочтение отдаётся 'code' по сравнению с 'id_token code' (гибридный поток OIDC), а значение 'token' (любой Implicit flow) не должно использоваться.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.6", + "section_name": "Провайдер OpenID", + "req_id": "V10.6.2", + "req_description": "Убедитесь, что провайдер OpenID предотвращает отказ в обслуживании (DoS) через принудительный выход (logout), запрашивая явное подтверждение от конечного пользователя или, если применимо, проверяя параметры в запросе выхода (инициированном relying party), например параметр 'id_token_hint'.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.7", + "section_name": "Управление согласием", + "req_id": "V10.7.1", + "req_description": "Убедитесь, что авторизационный сервер обеспечивает получение согласия пользователя для каждого запроса авторизации. Если личность клиента не может быть подтверждена, сервер авторизации всегда должен явно запрашивать согласие пользователя.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.7", + "section_name": "Управление согласием", + "req_id": "V10.7.2", + "req_description": "Убедитесь, что при запросе согласия пользователя авторизационный сервер предоставляет достаточную и понятную информацию о том, на что даётся согласие. При необходимости это должно включать характер запрашиваемых разрешений (обычно основанных на scope, ресурсном сервере, деталях авторизации Rich Authorization Requests (RAR)), идентификацию авторизованного приложения и срок действия этих разрешений.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.7", + "section_name": "Управление согласием", + "req_id": "V10.7.3", + "req_description": "Убедитесь, что пользователь может просматривать, изменять и отзывать согласия, которые он предоставил, через авторизационный сервер.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.1", + "section_name": "Инвентаризация и документирование криптографии", + "req_id": "V11.1.1", + "req_description": "Убедитесь, что задокументирована политика управления криптографическими ключами и описан их жизненный цикл в соответствии со стандартом управления ключей, таким как NIST SP 800-57. Убедитесь, что ключи известны только тем сущностям, которым они должны быть доступны (например, ключи не передавались более чем двум участникам для общих секретов и более чем одному участнику для приватных ключей).", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.1", + "section_name": "Инвентаризация и документирование криптографии", + "req_id": "V11.1.2", + "req_description": "Убедитесь, что проводится инвентаризация криптографических средств, которая непрерывно поддерживается, регулярно обновляется и включает все криптографические ключи, алгоритмы и сертификаты, используемые в приложении. Также должна быть задокументирована информация о том, где ключи могут и не могут использоваться в системе, а также какие типы данных могут и не могут быть защищены с помощью этих ключей.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.1", + "section_name": "Инвентаризация и документирование криптографии", + "req_id": "V11.1.3", + "req_description": "Убедитесь, что используются механизмы обнаружения криптографии для идентификации всех случаев применения криптографии в системе , включая операции шифрования, хеширования и цифровой подписи.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.1", + "section_name": "Инвентаризация и документирование криптографии", + "req_id": "V11.1.4", + "req_description": "Убедитесь, что ведётся и поддерживается инвентаризация криптографических средств. В неё должен входить документированный план, описывающий переход на новые криптографические стандарты, такие как постквантовая криптография, чтобы своевременно реагировать на будущие угрозы.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.2", + "section_name": "Безопасная реализация криптографии", + "req_id": "V11.2.1", + "req_description": "Убедитесь, что для криптографических операций используются утвержденные в индустрии реализации (включая библиотеки и аппаратные реализации).", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.2", + "section_name": "Безопасная реализация криптографии", + "req_id": "V11.2.2", + "req_description": "Убедитесь, что архитектура приложения поддерживает быструю реконфигурацию, усовершенствование или смену в любой момент случайных чисел, аутентифицированного шифрования, MAC, алгоритмов хеширования, длин ключей, количества раундов, шифров и режимов шифрования для защиты от криптографических атак. Также должна поддерживаться возможность смены ключей, паролей и повторного шифрования данных. Это позволит беспрепятственно перейти на постквантовую криптографию (PQC), как только станут широко доступны высоконадёжные реализации одобренных схем или стандартов PQC.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.2", + "section_name": "Безопасная реализация криптографии", + "req_id": "V11.2.3", + "req_description": "Убедитесь, что все криптографические примитивы используют как минимум 128-бит стойкости с учетом алгоритма, размера ключа и конфигурации. Например, 256-битный ECC ключ обеспечивает примерно 128 бит безопасности, тогда как для достижения того же уровня безопасности в RSA требуется ключ длиной 3072 бита.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.2", + "section_name": "Безопасная реализация криптографии", + "req_id": "V11.2.4", + "req_description": "Убедитесь, что все криптографические операции выполняются за константное время, без использования «short-circuit» операций в сравнениях, вычислениях, возвратах функций для избежания утечек информации.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.2", + "section_name": "Безопасная реализация криптографии", + "req_id": "V11.2.5", + "req_description": "Убедитесь, что все криптографические модули обеспечивают безопасное завершение работы при ошибках, а обработка ошибок реализована таким образом, чтобы не создавать уязвимостей, например, таких как атаки Padding Oracle.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.3", + "section_name": "Алгоритмы шифрования", + "req_id": "V11.3.1", + "req_description": "Убедитесь, что не используются небезопасные режимы блочного шифрования (н-р, ECB) и слабые схемы дополнения (padding) (н-р, PKCS#1 v1.5).", + "L": "1" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.3", + "section_name": "Алгоритмы шифрования", + "req_id": "V11.3.2", + "req_description": "Убедитесь, что используются только утверждённые шифры и режимы, такие как AES с GCM.", + "L": "1" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.3", + "section_name": "Алгоритмы шифрования", + "req_id": "V11.3.3", + "req_description": "Убедитесь, что зашифрованные данные защищены от несанкционированного изменения, предпочтительно с использованием утверждённого метода аутентифицированного шифрования или путём комбинирования утверждённого метода шифрования с утверждённым алгоритмом MAC.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.3", + "section_name": "Алгоритмы шифрования", + "req_id": "V11.3.4", + "req_description": "Убедитесь, что случайные числа (nonce), векторы инициализации (IV) и другие одноразовые числа не используются более одного раза для одной и той же пары ключа шифрования и элемента данных. Метод их генерации должен соответствовать требованиям используемого алгоритма.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.3", + "section_name": "Алгоритмы шифрования", + "req_id": "V11.3.5", + "req_description": "Убедитесь, что любая комбинация алгоритма шифрования и алгоритма MAC работает в режиме encrypt-then-MAC (EtM).", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.4", + "section_name": "Хеширование и функции на основе хеширования", + "req_id": "V11.4.1", + "req_description": "Убедитесь, что только утвержденные хэш-функции используются для стандартных сценариев использования в криптографии, включая цифровую подпись, HMAC, KDF, генерацию случайных чисел. Запрещено использовать неустойчивые хэш-функции, (н-р, MD5) для любого использования в криптографии.", + "L": "1" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.4", + "section_name": "Хеширование и функции на основе хеширования", + "req_id": "V11.4.2", + "req_description": "Убедитесь, что пароли хранятся с использованием утверждённой, вычислительно затратной функции генерации ключа (также известной как «функция хеширования паролей»), с параметрами, настроенными в соответствии с актуальными рекомендациями. Настройки должны обеспечивать баланс между безопасностью и производительностью, чтобы сделать атаки перебором достаточно сложными для требуемого уровня безопасности.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.4", + "section_name": "Хеширование и функции на основе хеширования", + "req_id": "V11.4.3", + "req_description": "Убедитесь, что хэш-функции, используемые в формировании цифровой подписи, как часть аутентификации и целостности данных, устойчивы к коллизиям и имеют достаточную длину.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.4", + "section_name": "Хеширование и функции на основе хеширования", + "req_id": "V11.4.4", + "req_description": "Убедитесь, что приложение использует утвержденную функцию генерации ключа с использованием параметров расширения ключа (key stretching) при генерации ключа из пароля. Параметры должны быть сбалансированы с точки зрения безопасности, производительности и устойчивости к атакам полного перебора при компрометации результирующего криптографического ключа.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.5", + "section_name": "Случайные значения", + "req_id": "V11.5.1", + "req_description": "Убедитесь, что все случайные числа и строки, которые должны быть непредсказуемы, должны быть сгенерированы с помощью CSPRNG и иметь хотя бы 128 бит энтропии. Учтите, что UUID не удовлетворяют данному условию.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.5", + "section_name": "Случайные значения", + "req_id": "V11.5.2", + "req_description": "Убедитесь, что механизм генерации случайных чисел является надежным даже при высокой нагрузке.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.6", + "section_name": "Криптография с публичным ключом", + "req_id": "V11.6.1", + "req_description": "Убедитесь, что только утвержденные криптографические алгоритмы и режимы операций используются для генерации ключа и инициализации случайного значения для его генерации (seeding), а также для генерации цифровой подписи и верификации. Алгоритмы генерации ключей не должны генерировать небезопасные ключи уязвимые к известным атакам, например, ключи RSA уязвимы к факторизации Ферма.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.6", + "section_name": "Криптография с публичным ключом", + "req_id": "V11.6.2", + "req_description": "Убедитесь, что для обмена ключами используются утверждённые криптографические алгоритмы (например, Диффи-Хеллман) с особым вниманием к обеспечению использования безопасных параметров. Это предотвратит атаки на процесс установления ключа, которые могут привести к атакам «человек посередине» или криптографическим взломам.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.7", + "section_name": "Шифрование данных в процессе использования", + "req_id": "V11.7.1", + "req_description": "Убедитесь, что используется полное шифрование памяти, которое защищает конфиденциальные данные во время их использования, предотвращая доступ к ним неавторизованных пользователей или процессов.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.7", + "section_name": "Шифрование данных в процессе использования", + "req_id": "V11.7.2", + "req_description": "Убедитесь, что минимизация данных обеспечивает раскрытие минимально необходимого объёма данных во время обработки, а также что данные шифруются сразу после использования или как можно скорее.", + "L": "3" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.1", + "section_name": "Общие рекомендации по безопасности TLS", + "req_id": "V12.1.1", + "req_description": "Убедитесь, что включены только актуальные и рекомендуемые версии протокола TLS, такие как TLS 1.2 и TLS 1.3. Наиболее свежая версия TLS должна быть выбрана как предпочтительная.", + "L": "1" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.1", + "section_name": "Общие рекомендации по безопасности TLS", + "req_id": "V12.1.2", + "req_description": "Убедитесь, что включены рекомендуемые шифронаборы (cipher suites), предпочтение также стоит отдать самому сильному шифронабору. L3 приложения должны поддерживать только те наборы шифров (cipher suites), которые обеспечивают прямую (forward) секретность. Пояснение: Прямая секретность (Forward Secrecy, FS) — это криптографическая особенность, при которой сессионные ключи уникальны для каждой сессии и не зависят от долгосрочных ключей. Это гарантирует, что даже при компрометации долгосрочного ключа злоумышленник не сможет расшифровать ранее перехваченные зашифрованные сессии.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.1", + "section_name": "Общие рекомендации по безопасности TLS", + "req_id": "V12.1.3", + "req_description": "Убедитесь, что приложение проверяет доверенность клиентских сертификатов mTLS, прежде чем использовать идентификацию по сертификату для аутентификации или авторизации.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.1", + "section_name": "Общие рекомендации по безопасности TLS", + "req_id": "V12.1.4", + "req_description": "Убедитесь, что включена и настроена правильная проверка отзыва сертификатов, такая как Online Certificate Status Protocol (OCSP) Stapling.", + "L": "3" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.1", + "section_name": "Общие рекомендации по безопасности TLS", + "req_id": "V12.1.5", + "req_description": "Убедитесь, что в настройках TLS приложения включена функция Encrypted Client Hello (ECH) для предотвращения раскрытия конфиденциальных метаданных, таких как Server Name Indication (SNI), во время процесса TLS-рукопожатия.", + "L": "3" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.2", + "section_name": "HTTPS коммуникация с внешними сервисами", + "req_id": "V12.2.1", + "req_description": "Убедитесь, что для всех соединений между клиентом и внешними HTTP-сервисами используется TLS и не происходит отката к небезопасным или незашифрованным протоколам.", + "L": "1" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.2", + "section_name": "HTTPS коммуникация с внешними сервисами", + "req_id": "V12.2.2", + "req_description": "Убедитесь, что внешние сервисы используют публично доверенные TLS-сертификаты.", + "L": "1" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.3", + "section_name": "Общая безопасность межсервисного взаимодействия", + "req_id": "V12.3.1", + "req_description": "Убедитесь, что для всех входящих и исходящих соединений приложения используется зашифрованный протокол, например TLS, включая системы мониторинга, инструменты управления, удалённый доступ и SSH, промежуточное ПО, базы данных, мейнфреймы, партнёрские системы и внешние API. Сервер не должен допускать откат к небезопасным или незашифрованным протоколам.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.3", + "section_name": "Общая безопасность межсервисного взаимодействия", + "req_id": "V12.3.2", + "req_description": "Убедитесь, что TLS-клиент проверяет сертификат сервера до установления защищенного соединения с TLS-сервером.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.3", + "section_name": "Общая безопасность межсервисного взаимодействия", + "req_id": "V12.3.3", + "req_description": "Убедитесь, что все внутренние HTTP-взаимодействия между компонентами приложения используют TLS или другой подходящий механизм транспортного шифрования, и не происходит откат к небезопасным или незашифрованным коммуникациям.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.3", + "section_name": "Общая безопасность межсервисного взаимодействия", + "req_id": "V12.3.4", + "req_description": "Убедитесь, что TLS-соединения между внутренними сервисами используют доверенные сертификаты. Если используются внутренние или самоподписанные сертификаты, потребляющий сервис должен быть настроен на доверие только к конкретным внутренним центрам сертификации (CA) и конкретным самоподписанным сертификатам.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.3", + "section_name": "Общая безопасность межсервисного взаимодействия", + "req_id": "V12.3.5", + "req_description": "Убедитесь, что сервисы, взаимодействующие внутри системы (intra-service communications), используют строгую аутентификацию для проверки каждого конечного узла. Для проверки подлинности взаимодействующих сторон должны применяться методы строгой аутентификации, такие как аутентификация TLS-клиента, с использованием инфраструктуры открытых ключей и механизмов, устойчивых к атакам повтора (replay attacks). Для микросервисных архитектур рекомендуется использование service mesh для упрощения управления сертификатами и повышения безопасности.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.1", + "section_name": "Документация конфигурации", + "req_id": "V13.1.1", + "req_description": "Убедитесь, что все необходимые доступы приложения задокументированы. Сюда должны быть включены как внешние сервисы, от которых зависит приложение, так и сценарии, когда конечный пользователь может задавать адреса для внешнего подключения.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.1", + "section_name": "Документация конфигурации", + "req_id": "V13.1.2", + "req_description": "Убедитесь, что для каждого сервиса, используемого приложением, в документации определено максимальное количество одновременных соединений (например, лимиты пула соединений) и описано поведение приложения при достижении этого лимита, включая любые механизмы отказоустойчивости или восстановления, чтобы предотвратить ситуации отказа в обслуживании (DoS).", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.1", + "section_name": "Документация конфигурации", + "req_id": "V13.1.3", + "req_description": "Убедитесь, что в документации приложения определены стратегии управления ресурсами для каждой внешней системы или сервиса, которые оно использует (например, базы данных, файловые дескрипторы, потоки, HTTP-соединения). Стратегии должны включать процедуры освобождения ресурсов, настройки таймаутов, обработку сбоев, а также, если реализована логика повторных попыток, указание лимитов, задержек и алгоритмов back-off. Для синхронных HTTP-запросов должны быть заданы короткие таймауты, а повторные запросы должны быть отключены, либо строго ограничены по числу попыток, чтобы предотвратить каскадные задержки и истощение ресурсов.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.1", + "section_name": "Документация конфигурации", + "req_id": "V13.1.4", + "req_description": "Убедитесь, что в документации приложения определены секреты, критически важные для безопасности приложения, а также установлен график их ротации в соответствии с моделью угроз организации и её бизнес-требованиями.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.2", + "section_name": "Конфигурация бэкенд соединений", + "req_id": "V13.2.1", + "req_description": "Убедитесь, что коммуникации между компонентами бэкенда приложения (включая API, промежуточное ПО и уровни данных), которые не поддерживают стандартный механизм пользовательских сессий, проходят с аутентификацией. Аутентификация должна использовать индивидуальные сервисные аккаунты, краткосрочные токены или аутентификацию на основе сертификатов, а не постоянные учётные данные, такие как пароли, API-ключи или общие аккаунты с привилегированным доступом.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.2", + "section_name": "Конфигурация бэкенд соединений", + "req_id": "V13.2.2", + "req_description": "Убедитесь, что коммуникации между компонентами бэкенда приложения, включая локальные или системные службы, API, промежуточное ПО и уровни данных, выполняются с использованием аккаунтов, которым назначены минимально необходимые привилегии.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.2", + "section_name": "Конфигурация бэкенд соединений", + "req_id": "V13.2.3", + "req_description": "Убедитесь, что если для аутентификации в сервисе используются учётные данные, то используемые потребителем учётные данные не являются стандартными (например, root/root или admin/admin).", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.2", + "section_name": "Конфигурация бэкенд соединений", + "req_id": "V13.2.4", + "req_description": "Убедитесь, что используется белый список (allowlist) для определения внешних ресурсов или систем, с которыми приложению разрешено взаимодействовать (например, для исходящих запросов, загрузки данных или доступа к файлам). Этот белый список может быть реализован на уровне приложения, веб-сервера, межсетевого экрана или комбинации различных уровней.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.2", + "section_name": "Конфигурация бэкенд соединений", + "req_id": "V13.2.5", + "req_description": "Убедитесь, что веб- или прикладной сервер настроен с белым списком ресурсов или систем, к которым сервер может отправлять запросы или из которых может загружать данные и файлы.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.2", + "section_name": "Конфигурация бэкенд соединений", + "req_id": "V13.2.6", + "req_description": "Убедитесь, что при подключении приложения к другим сервисам соблюдается задокументированная конфигурация для каждого соединения, включая максимальное количество параллельных соединений, поведение при достижении их максимума, таймауты и стратегии повторных попыток подключения.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.3", + "section_name": "Управление секретами", + "req_id": "V13.3.1", + "req_description": "Убедитесь, что для безопасного создания, хранения, контроля доступа и уничтожения секретов бэкенда используется решение для управления секретами, например, хранилище ключей (key vault). Секретами могут быть пароли, ключевой материал, интеграции с базами данных и сторонними системами, ключи и seed-значения для токенов с ограниченным временем действия, другие внутренние секреты и API-ключи. Секреты не должны включаться в исходный код приложения или артефакты сборки. Для приложений уровня L3 необходимо использовать аппаратное решение, например, аппаратный модуль безопасности (HSM).", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.3", + "section_name": "Управление секретами", + "req_id": "V13.3.2", + "req_description": "Убедитесь, что доступ к секретным ресурсам осуществляется в соответствии с принципом минимально необходимых привилегий (least privilege).", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.3", + "section_name": "Управление секретами", + "req_id": "V13.3.3", + "req_description": "Убедитесь, что все криптографические операции выполняются с использованием изолированного модуля безопасности (например, хранилища ключей или аппаратного модуля безопасности), чтобы надежно управлять ключевым материалом и защищать его от утечки за пределы модуля безопасности.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.3", + "section_name": "Управление секретами", + "req_id": "V13.3.4", + "req_description": "Убедитесь, что секреты настроены на срок действия и ротацию в соответствии с документацией приложения.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.4", + "section_name": "Непреднамеренная утечка информации", + "req_id": "V13.4.1", + "req_description": "Убедитесь, что приложение развернуто либо без метаданных систем контроля версий (включая папки .git или .svn), либо так, чтобы эти папки были недоступны как извне, так и для самого приложения.", + "L": "1" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.4", + "section_name": "Непреднамеренная утечка информации", + "req_id": "V13.4.2", + "req_description": "Убедитесь, что режимы отладки отключены для всех компонентов в промышленной среде, чтобы предотвратить раскрытие функций отладки и утечку информации.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.4", + "section_name": "Непреднамеренная утечка информации", + "req_id": "V13.4.3", + "req_description": "Убедитесь, что веб-серверы не показывают клиентам списки содержимого каталогов, если это явно не предусмотрено.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.4", + "section_name": "Непреднамеренная утечка информации", + "req_id": "V13.4.4", + "req_description": "Убедитесь, что метод HTTP TRACE не поддерживается в продуктовой среде, чтобы избежать потенциальной утечки информации.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.4", + "section_name": "Непреднамеренная утечка информации", + "req_id": "V13.4.5", + "req_description": "Убедитесь, что документация (например, по внутренним API) и мониторинговые эндпоинты не доступны, если это явно не предусмотрено.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.4", + "section_name": "Непреднамеренная утечка информации", + "req_id": "V13.4.6", + "req_description": "Убедитесь, что приложение не раскрывает подробную информацию о версиях компонентов бэкенда.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.4", + "section_name": "Непреднамеренная утечка информации", + "req_id": "V13.4.7", + "req_description": "Убедитесь, что веб-слой настроен на обслуживание только файлов с определёнными расширениями, чтобы предотвратить непреднамеренную утечку информации, конфигураций и исходного кода.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.1", + "section_name": "Документация по защите информации", + "req_id": "V14.1.1", + "req_description": "Убедитесь, что все конфиденциальные данные, создаваемые и обрабатываемые приложением, идентифицированы и классифицированы по уровням защиты. Включая закодированные данные, которые легко декодируются, например, строки Base64 или незашифрованные данные в полезной нагрузке JWT. Уровни защиты должны учитывать требования по защите данных и конфиденциальности, которым должно соответствовать приложение.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.1", + "section_name": "Документация по защите информации", + "req_id": "V14.1.2", + "req_description": "Убедитесь, что для каждого уровня защиты конфиденциальных данных требования к защите задокументированы. Они должны включать (но не ограничиваться) требования по шифрованию, проверке целостности, срокам хранения, способам логирования данных, контролю доступа к чувствительным данным в логах, шифрованию на уровне базы данных, применению технологий повышения конфиденциальности, а также другим требованиям по конфиденциальности.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.2", + "section_name": "Базовые меры по защите информации", + "req_id": "V14.2.1", + "req_description": "Убедитесь, что конфиденциальные данные передаются на сервер только в теле HTTP-запроса или в заголовках. URL и строка запроса не должны содержать конфиденциальную информацию, такую как API-ключ или сессионный токен.", + "L": "1" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.2", + "section_name": "Базовые меры по защите информации", + "req_id": "V14.2.2", + "req_description": "Убедитесь, что приложение предотвращает кэширование конфиденциальных данных в серверных компонентах, таких как балансировщики нагрузки и кэши приложений, либо гарантирует их надежное удаление после использования.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.2", + "section_name": "Базовые меры по защите информации", + "req_id": "V14.2.3", + "req_description": "Убедитесь, что заранее определённые конфиденциальные данные не отправляются ненадёжным сторонам (например, системам трекинга пользователей), чтобы предотвратить нежелательный сбор данных вне контроля приложения.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.2", + "section_name": "Базовые меры по защите информации", + "req_id": "V14.2.4", + "req_description": "Убедитесь, что для конфиденциальных данных реализованы меры по шифрованию, проверке целостности, срокам хранения, способам логирования, контролю доступа к данным в логах, а также применяются технологии повышения конфиденциальности в соответствии с документацией для соответствующего уровня защиты данных.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.2", + "section_name": "Базовые меры по защите информации", + "req_id": "V14.2.5", + "req_description": "Убедитесь, что механизмы кэширования настроены так, чтобы кэшировать только ответы с ожидаемым типом содержимого для данного ресурса и не содержать конфиденциального динамического контента. При обращении к несуществующему файлу, веб-сервер должен возвращать ответ 404 или 302, а не подменять на другой существующий файл, что позволит предотвратить атаки типа Web Cache Deception.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.2", + "section_name": "Базовые меры по защите информации", + "req_id": "V14.2.6", + "req_description": "Убедитесь, что приложение возвращает только минимально необходимый объем конфиденциальных данных для выполнения своей функциональности. Например, показывает только часть цифр номера кредитной карты, а не полный номер. Если требуется отображение полных данных, они должны быть замаскированы в пользовательском интерфейсе, пока пользователь специально не запросил их просмотр.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.2", + "section_name": "Базовые меры по защите информации", + "req_id": "V14.2.7", + "req_description": "Убедитесь, что конфиденциальная информация подлежит классификации по срокам хранения, чтобы устаревшие или ненужные данные удалялись автоматически, по расписанию или по мере необходимости.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.2", + "section_name": "Базовые меры по защите информации", + "req_id": "V14.2.8", + "req_description": "Убедитесь, что конфиденциальная информация удаляется из метаданных файлов, загружаемых пользователями, если пользователь явно не согласился на ее хранение.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.3", + "section_name": "Защита данных на стороне клиента", + "req_id": "V14.3.1", + "req_description": "Убедитесь, что аутентифицированные данные очищаются из клиентского хранилища, например, из DOM браузера, после завершения работы клиента или сессии. Заголовок HTTP-ответа Clear-Site-Data может помочь в этом, но клиентская сторона также должна уметь очищать данные, если соединение с сервером недоступно при завершении сессии.", + "L": "1" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.3", + "section_name": "Защита данных на стороне клиента", + "req_id": "V14.3.2", + "req_description": "Убедитесь, что приложение устанавливает HTTP-заголовки, достаточные для предотвращения кэширования (например, Cache-Control: no-store), чтобы конфиденциальные данные не сохранялись в браузерах.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.3", + "section_name": "Защита данных на стороне клиента", + "req_id": "V14.3.3", + "req_description": "Убедитесь, что данные, хранящиеся в браузерном хранилище (например, localStorage, sessionStorage, IndexedDB или cookie), не содержат конфиденциальной информации, за исключением сессионных токенов.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.1", + "section_name": "Документация по безопасной разработке и архитектуре", + "req_id": "V15.1.1", + "req_description": "Убедитесь, что в документации по приложению определены сроки устранения уязвимостей на основе оценки рисков для внешних зависимостей с уязвимостями и для обновления библиотек в целом, чтобы минимизировать риск, связанный с этими компонентами.", + "L": "1" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.1", + "section_name": "Документация по безопасной разработке и архитектуре", + "req_id": "V15.1.2", + "req_description": "Убедитесь, что ведется реестр всех используемых сторонних библиотек (например, Software Bill of Materials, SBOM), с обязательной проверкой, что компоненты получены из предопределенных, доверенных и регулярно поддерживаемых репозиториев.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.1", + "section_name": "Документация по безопасной разработке и архитектуре", + "req_id": "V15.1.3", + "req_description": "Убедитесь, что в документации приложения указан функционал, требующий значительных временных или вычислительных ресурсов. Необходимо указать, как предотвратить потерю доступности из-за чрезмерного использования этого функционала и как избежать ситуаций, когда формирование ответа занимает больше времени, чем установленный системой таймаут. Возможные меры защиты могут включать асинхронную обработку, использование очередей и ограничение количества параллельных процессов для каждого пользователя и приложения.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.1", + "section_name": "Документация по безопасной разработке и архитектуре", + "req_id": "V15.1.4", + "req_description": "Убедитесь, что в документации приложения указаны внешние библиотеки, которые считаются «компонентами с повышенным риском».", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.1", + "section_name": "Документация по безопасной разработке и архитектуре", + "req_id": "V15.1.5", + "req_description": "Убедитесь, что в документации приложения выделены те части приложения, в которых используются «функционал с повышенным риском».", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.2", + "section_name": "Архитектура безопасности и зависимости", + "req_id": "V15.2.1", + "req_description": "Убедитесь, что приложение содержит только те компоненты, которые не нарушили задокументированные сроки обновления и исправления.", + "L": "1" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.2", + "section_name": "Архитектура безопасности и зависимости", + "req_id": "V15.2.2", + "req_description": "Убедитесь, что в приложении реализованы меры защиты от потери доступности из-за функциональности, требующей много времени или ресурсов, на основе задокументированных решений и стратегий безопасности для этого.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.2", + "section_name": "Архитектура безопасности и зависимости", + "req_id": "V15.2.3", + "req_description": "Убедитесь, что производственная среда включает только те функции, которые необходимы для работы приложения, и не предоставляет лишние функции, такие как тестовый код, примеры кода и инструменты разработки.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.2", + "section_name": "Архитектура безопасности и зависимости", + "req_id": "V15.2.4", + "req_description": "Убедитесь, что сторонние компоненты и все их транзитивные зависимости загружаются только из ожидаемых репозиториев (внутренних или внешних) и отсутствует риск атаки через подмену зависимостей (dependency confusion attack)", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.2", + "section_name": "Архитектура безопасности и зависимости", + "req_id": "V15.2.5", + "req_description": "Убедитесь, что приложение реализует дополнительные меры защиты для тех частей приложения, которые документированы как содержащие «функционал с повышенным риском» или использующие сторонние библиотеки, считающиеся «функционалом с повышенным риском». Это могут быть такие методы, как «песочница», инкапсуляция, контейнеризация или изоляция на сетевом уровне, чтобы задержать и предотвратить продвижение (pivoting) злоумышленников, скомпрометировавших одну часть приложения, к другим частям приложения.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.3", + "section_name": "Безопасное программирование", + "req_id": "V15.3.1", + "req_description": "Убедитесь, что приложение возвращает только необходимое подмножество полей из объекта данных. Например, оно не должно возвращать весь объект данных, поскольку некоторые отдельные поля должны быть недоступны пользователям.", + "L": "1" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.3", + "section_name": "Безопасное программирование", + "req_id": "V15.3.2", + "req_description": "Убедитесь, что при вызовах внешних URL-адресов бэкэнд приложения настроен так, чтобы не выполнять перенаправления, если только это не предусмотрено функционалом.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.3", + "section_name": "Безопасное программирование", + "req_id": "V15.3.3", + "req_description": "Убедитесь, что в приложении реализованы защитные механизмы против атак типа массового присвоения (mass assignment) путем строгого ограничения разрешенных полей для каждого контроллера и действия, исключая возможность добавления или изменения значений полей, которые не должны быть доступны для данной конкретной операции.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.3", + "section_name": "Безопасное программирование", + "req_id": "V15.3.4", + "req_description": "Убедитесь, что все прокси и промежуточное ПО корректно передают исходный IP-адрес пользователя, используя доверенные поля данных, которые не могут быть изменены конечным пользователем, а приложение и веб-сервер используют это правильное значение для ведения логирования и принятия решений по безопасности, таких как ограничение запросов. При этом следует учитывать, что даже исходный IP-адрес может быть ненадежным из-за динамических IP-адресов, VPN или корпоративных файрволов.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.3", + "section_name": "Безопасное программирование", + "req_id": "V15.3.5", + "req_description": "Убедитесь, что приложение явно проверяет соответствие переменных ожидаемому типу данных и использует строгие операции сравнения. Это необходимо для предотвращения уязвимостей, связанных с type juggling и type confusion, вызванных тем, что код приложения делает предположения о типе переменной.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.3", + "section_name": "Безопасное программирование", + "req_id": "V15.3.6", + "req_description": "Убедитесь, что JavaScript-код написан таким образом, чтобы предотвратить prototype pollution, например, используя Set() или Map() вместо обычных литералов объекта.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.3", + "section_name": "Безопасное программирование", + "req_id": "V15.3.7", + "req_description": "Убедитесь, что приложение защищено от атак типа HTTP Parameter Pollution (HPP), особенно если используемый фреймворк не различает источники параметров запроса (строка запроса, тело запроса, куки или заголовки).", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.4", + "section_name": "Безопасная работа с параллельными процессами", + "req_id": "V15.4.1", + "req_description": "Убедитесь, что к общим объектам в многопоточном коде (например, кэшам, файлам или объектам в памяти, используемым несколькими потоками) используется безопасный многопоточный доступ и механизмов синхронизации, таких как блокировки или семафоры, чтобы избежать состояний гонки и повреждения данных.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.4", + "section_name": "Безопасная работа с параллельными процессами", + "req_id": "V15.4.2", + "req_description": "Убедитесь, что проверки состояния ресурса, например его существования или разрешений, а также зависящие от него действия выполняются как одна атомарная операция, чтобы предотвратить условия гонки времени проверки и времени использования (TOCTOU). Например, проверка существования файла перед его открытием или проверка прав доступа пользователя перед его предоставлением.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.4", + "section_name": "Безопасная работа с параллельными процессами", + "req_id": "V15.4.3", + "req_description": "Убедитесь, что блокировки применяются согласованно, чтобы предотвратить взаимные блокировки потоков (deadlocks) или их бесконечные повторы, а также что логика блокировки инкапсулирована в коде, отвечающем за управление ресурсом. Это гарантирует, что блокировки не могут быть случайно или намеренно изменены внешними классами или кодом.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.4", + "section_name": "Безопасная работа с параллельными процессами", + "req_id": "V15.4.4", + "req_description": "Убедитесь, что политики распределения ресурсов предотвращают нехватку ресурсов у потоков, обеспечивая справедливый доступ к ресурсам, например, используя пулы потоков, позволяя потокам с более низким приоритетом выполняться в течение разумного периода времени.", + "L": "3" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.1", + "section_name": "Документация по ведению логов", + "req_id": "V16.1.1", + "req_description": "Убедитесь в существовании реестра, в котором документируется ведение журнала на каждом уровне технологического стека приложения, включая какие события регистрируются, форматы логов, где хранятся эти журналы, как они используются, как контролируется доступ к ним и как долго хранятся журналы.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.2", + "section_name": "Общее журналирование", + "req_id": "V16.2.1", + "req_description": "Убедитесь, что каждая запись журнала содержит необходимые метаданные (например, когда, где, кто, что), которые позволят провести подробное исследование временной шкалы, когда произошло событие.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.2", + "section_name": "Общее журналирование", + "req_id": "V16.2.2", + "req_description": "Убедитесь, что все источники времени компонентов системы журналирования синхронизированы, а временные метки в метаданных событий безопасности используют UTC или содержат явное указание смещения часового пояса. Рекомендуется применять UTC для обеспечения согласованности в распределённых системах и предотвращения ошибок при переходе на летнее/зимнее время.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.2", + "section_name": "Общее журналирование", + "req_id": "V16.2.3", + "req_description": "Убедитесь, что приложение записывает и передаёт логи исключительно в те файлы и сервисы, которые указаны в реестре журналирования.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.2", + "section_name": "Общее журналирование", + "req_id": "V16.2.4", + "req_description": "Убедитесь, что логи могут быть прочитаны и коррелированы используемой системой обработки журналов, предпочтительно с использованием общего стандартного формата логирования.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.2", + "section_name": "Общее журналирование", + "req_id": "V16.2.5", + "req_description": "Убедитесь, что приложение применяет соответствующие меры защиты при логировании конфиденциальных данных в зависимости от уровня их чувствительности: например, полностью запрещает запись в логи таких данных, как учетные данные или платежные реквизиты, а для других данных (например, сессионных токенов) использует хеширование или частичное/полное маскирование.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.3", + "section_name": "Инциденты безопасности", + "req_id": "V16.3.1", + "req_description": "Убедитесь, что все операции аутентификации регистрируются, включая успешные и неудачные попытки. Также следует фиксировать дополнительные метаданные, такие как тип аутентификации или использованные факторы проверки.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.3", + "section_name": "Инциденты безопасности", + "req_id": "V16.3.2", + "req_description": "Убедитесь, что ведется журнал неудачных попыток авторизации. Для уровня L3 это должно включать в себя журналирование всех решений об авторизации, включая журналирование доступа к конфиденциальным данным (без регистрации самих конфиденциальных данных).", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.3", + "section_name": "Инциденты безопасности", + "req_id": "V16.3.3", + "req_description": "Убедитесь, что приложение регистрирует все события безопасности, определенные в документации, а также фиксирует попытки обхода механизмов защиты, включая проверку входных данных, бизнес-логики и системы защиты от автоматизированных атак.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.3", + "section_name": "Инциденты безопасности", + "req_id": "V16.3.4", + "req_description": "Убедитесь, что приложение регистрирует в журналах неожиданные ошибки и сбои механизмов безопасности, включая, например, ошибки TLS-соединения на стороне сервера.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.4", + "section_name": "Защита журналов", + "req_id": "V16.4.1", + "req_description": "Убедитесь, что все компоненты системы логирования корректно кодируют данные, чтобы предотвратить атаки типа внедрения в журналы (log injection).", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.4", + "section_name": "Защита журналов", + "req_id": "V16.4.2", + "req_description": "Убедитесь, что логи защищены от неавторизованного доступа и не могут быть модифицированы.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.4", + "section_name": "Защита журналов", + "req_id": "V16.4.3", + "req_description": "Убедитесь, что логи безопасно передаются в логически изолированную систему для анализа, обнаружения угроз, генерации оповещений и эскалации инцидентов. Это гарантирует сохранность журналов даже в случае компрометации основного приложения.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.5", + "section_name": "Обработка ошибок", + "req_id": "V16.5.1", + "req_description": "Убедитесь, что при возникновении непредвиденной или связанной с безопасностью ошибки пользователю возвращается только общее сообщение, гарантируя отсутствие раскрытия конфиденциальных внутренних данных системы, таких как трассировки стека, запросы, секретные ключи и токены.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.5", + "section_name": "Обработка ошибок", + "req_id": "V16.5.2", + "req_description": "Убедитесь, что приложение продолжает работать в безопасном режиме при недоступности внешних ресурсов, используя такие механизмы, как автоматические выключатели (circuit breakers) или плавное снижение функциональности (graceful degradation).", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.5", + "section_name": "Обработка ошибок", + "req_id": "V16.5.3", + "req_description": "Убедитесь, что приложение корректно и безопасно завершает работу при возникновении исключений, предотвращая опасные сценарии по типу «fail-open», когда, например, транзакция ошибочно выполняется, несмотря на ошибки в логике валидации.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.5", + "section_name": "Обработка ошибок", + "req_id": "V16.5.4", + "req_description": "Убедитесь, что определён обработчик ошибок «крайние меры», который будет перехватывать все необработанные ошибки. Это необходимо как для предотвращения потери информации об ошибках, которая должна быть записана в файлы журналов, так и для того, чтобы ошибка не остановила весь процесс приложения, что привело бы к потере доступности.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.1", + "section_name": "TURN-сервер", + "req_id": "V17.1.1", + "req_description": "Убедитесь, что сервис TURN (Traversal Using Relays around NAT) разрешает доступ только к IP-адресам, не зарезервированным для специальных целей (например, внутренние сети, широковещательная рассылка, loopback-адреса). Данное требование применяется как к IPv4, так и к IPv6 адресам.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.1", + "section_name": "TURN-сервер", + "req_id": "V17.1.2", + "req_description": "Убедитесь, что сервис TURN (Traversal Using Relays around NAT) защищен от исчерпания ресурсов при попытках легитимных пользователей открыть чрезмерное количество портов на сервере.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Требования к медиасерверам", + "req_id": "V17.2.1", + "req_description": "Убедитесь, что ключ сертификата Datagram Transport Layer Security (DTLS) управляется и защищается в соответствии с документированной политикой управления криптографическими ключами.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Требования к медиасерверам", + "req_id": "V17.2.2", + "req_description": "Убедитесь, что медиасервер настроен на использование только одобренных наборов шифров Datagram Transport Layer Security (DTLS) и защищенного профиля безопасности для расширения DTLS, применяемого при установке ключей для Secure Real-time Transport Protocol (DTLS-SRTP).", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Требования к медиасерверам", + "req_id": "V17.2.3", + "req_description": "Убедитесь, что медиасервер проверяет аутентификацию Secure Real-time Transport Protocol (SRTP) для предотвращения атак с внедрением Real-time Transport Protocol (RTP), которые могут привести к отказу в обслуживании (Denial of Service) или вставке поддельного аудио-/видеоконтента в медиапотоки.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Требования к медиасерверам", + "req_id": "V17.2.4", + "req_description": "Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика при получении некорректных пакетов Secure Real-time Transport Protocol (SRTP).", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Требования к медиасерверам", + "req_id": "V17.2.5", + "req_description": "Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетами Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Требования к медиасерверам", + "req_id": "V17.2.6", + "req_description": "Убедитесь, что медиасервер не подвержен уязвимости «Гонка ClientHello» (ClientHello Race Condition) в Datagram Transport Layer Security (DTLS), проверив наличие известных уязвимостей в публичных источниках или выполнив тестирование на воспроизведение условий гонки.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Требования к медиасерверам", + "req_id": "V17.2.7", + "req_description": "Убедитесь, что механизмы аудио- и видеозаписи, связанные с медиасервером, способны продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетов Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Требования к медиасерверам", + "req_id": "V17.2.8", + "req_description": "Убедитесь, что сертификат Datagram Transport Layer Security (DTLS) проверяется на соответствие атрибуту отпечатка (fingerprint) в Session Description Protocol (SDP), с немедленным прекращением медиапотока в случае несоответствия — это гарантирует подлинность передаваемых данных.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.3", + "section_name": "Сигнализация", + "req_id": "V17.3.1", + "req_description": "Убедитесь, что сигнальный сервер способен продолжать обработку легитимных входящих сообщений сигнализации даже в условиях флуд-атаки. Для этого необходимо реализовать механизм ограничения частоты запросов (rate limiting) на уровне сигнализации.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.3", + "section_name": "Сигнализация", + "req_id": "V17.3.2", + "req_description": "Убедитесь, что сигнальный сервер способен продолжать обработку легитимных сообщений сигнализации даже при получении некорректных сообщений, которые могут вызвать отказ в обслуживании (Denial of Service, DoS). Для этого необходимо реализовать: проверку входных данных (input validation), безопасную обработку целочисленных переполнений (integer overflows), защиту от переполнения буферов (buffer overflows) и другие надежные методы обработки ошибок.", + "L": "2" + } + ] +} diff --git a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.flat.legacy.json b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.flat.legacy.json new file mode 100644 index 0000000000..04adb2eb46 --- /dev/null +++ b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.flat.legacy.json @@ -0,0 +1,4489 @@ +{ + "requirements": [ + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.1", + "section_name": "Архитектура кодировки и нейтрализации", + "req_id": "V1.1.1", + "req_description": "Убедитесь, что входные данные декодируются или деэкранируются в каноническую форму (в стандартное представление) только один раз. Декодирование происходит только тогда, когда ожидаются закодированные данные в этой форме, и что это делается перед дальнейшей обработкой входных данных, например, это не выполняется после проверки или нейтрализации.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.1", + "section_name": "Архитектура кодировки и нейтрализации", + "req_id": "V1.1.2", + "req_description": "Убедитесь, что приложение выполняет кодирование и экранирование выходных данных либо в качестве последнего шага перед использованием интерпретатором, для которого оно предназначено, либо самим интерпретатором.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.1", + "req_description": "Убедитесь, что выходная кодировка для ответа HTTP, документа HTML или документа XML соответствует требуемому контексту, например, кодировка соответствующих символов для элементов HTML, атрибутов HTML, комментариев HTML, CSS или полей заголовка HTTP делается таким способом, чтобы избежать изменения структуры сообщения или документа.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.2", + "req_description": "Убедитесь, что при динамическом построении URL-адресов недоверенные данные кодируются в соответствии с их контекстом (например, кодирование URL-адресов или кодирование base64url для query или path параметров или пути). Убедитесь, что разрешены только безопасные протоколы URL-адресов (например, запрещен javascript: или data:).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.3", + "req_description": "Убедитесь, что при динамическом построении содержимого JavaScript (включая JSON) используется кодирование или экранирование выходных данных, чтобы избежать изменения структуры сообщения или документа (чтобы избежать JavaScript и JSON-инъекций).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.4", + "req_description": "Убедитесь, что выборка данных (Redis, Memcached, чтение из файлов, обращение по API) или запросы к базе данных (например, SQL, HQL, NoSQL, Cypher) используют параметризованные запросы, ORM, Entity Frameworks или иным образом защищены от SQL-инъекций и других атак. Это также актуально при написании хранимых процедур.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.5", + "req_description": "Убедитесь, что приложение защищено от внедрения команд ОС и что вызовы операционной системы используют параметризованные запросы к ОС или используют контекстное кодирование вывода командной строки.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.6", + "req_description": "Убедитесь, что приложение защищено от LDAP-инъекций, или что реализованы специальные меры безопасности для их предотвращения.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.7", + "req_description": "Убедитесь, что приложение защищено от атак с использованием XPath-инъекций с помощью параметризации запросов или предварительно скомпилированных запросов.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.8", + "req_description": "Убедитесь, что процессоры LaTeX настроены безопасно (например, не используется флаг «–shell‑escape») и используется разрешенный список команд для предотвращения LaTeX-инъекций.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.9", + "req_description": "Убедитесь, что приложение экранирует специальные символы в регулярных выражениях (обычно с помощью обратной косой черты), чтобы предотвратить их ошибочную интерпретацию как метасимволов.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.10", + "req_description": "Убедитесь, что приложение защищено от внедрения формул CSV (CSV Injection). Приложение должно следовать правилам экранирования, определенным в RFC 4180, разделы 2.6 и 2.7, при экспорте содержимого CSV. Кроме того, при экспорте в CSV или другие форматы электронных таблиц (такие как XLS, XLSX или ODF) специальные символы (включая '=', '+', '-', '@', '\\t' (табуляция), и '\\0' (нулевой символ)) должны экранироваться одинарной кавычкой, если они появляются в качестве первого символа в значении поля.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.1", + "req_description": "Убедитесь, что все ненадежные входные данные HTML из редакторов WYSIWYG или аналогичных программ нейтрализуются с помощью известных и безопасных библиотек или функций фреймворка для санитизации HTML.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.2", + "req_description": "Убедитесь, что приложение избегает использования eval() или других динамических функций выполнения кода, таких как Spring Expression Language (SpEL). Если нет альтернативы, любой пользовательский ввод должен быть нейтрализован перед выполнением.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.3", + "req_description": "Убедитесь, что данные, передаваемые в потенциально опасный контекст, предварительно нейтрализованы, чтобы обеспечить соблюдение мер безопасности, таких как разрешение только тех символов, которые безопасны для данного контекста, и обрезка слишком длинного ввода.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.4", + "req_description": "Убедитесь, что предоставленный пользователем файл .SVG проверен или нейтрализован, чтобы он содержал только теги и атрибуты (например, относящиеся к рисованию), которые безопасны для приложения, например, не содержат скриптов и foreignObject.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.5", + "req_description": "Убедитесь, что приложение нейтралует или отключает предоставленные пользователем скриптовые данные или выражения шаблонных языков, такие как таблицы стилей Markdown, CSS или XSL, BBCode или аналогичные.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.6", + "req_description": "Убедитесь, что приложение защищено от атак с подделкой запросов на стороне сервера (SSRF), проверяя ненадежные данные по разрешенному списку протоколов, доменов, путей и портов, а также нейтрализуя потенциально опасные символы перед использованием данных для вызова другой службы.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.7", + "req_description": "Убедитесь, что приложение защищено от атак с внедрением шаблонов (template injection), не позволяя создавать шаблоны на основе недоверенных входных данных. Если нет альтернативы, любые недоверенные входные данные, включаемые динамически во время создания шаблона, должны быть нейтрализованы или тщательно провалидированы.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.8", + "req_description": "Убедитесь, что приложение надлежащим образом нейтрализует недоверенные входные данные перед использованием в запросах Java Naming and Directory Interface (JNDI) и что JNDI настроен безопасно для предотвращения атак с использованием JNDI-инъекций.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.9", + "req_description": "Убедитесь, что приложение нейтрализует данные перед отправкой в Memcache, чтобы предотвратить атаки методом инъекций.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.10", + "req_description": "Убедитесь, что строки форматирования, которые могут быть использованы неожидаемым или вредоносным образом, нейтрализуются перед дальнейшим использованием.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.11", + "req_description": "Убедитесь, что приложение нейтрализует вводимые пользователем данные перед передачей в почтовые системы для защиты от SMTP или IMAP-инъекций.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.12", + "req_description": "Убедитесь, что регулярные выражения не содержат элементов, вызывающих экспоненциальный возврат, и убедитесь в нейтрализации недоверенных входных данных для предотвращения атак ReDoS или Runaway Regex.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.4", + "section_name": "Память, строки и неуправляемый код", + "req_id": "V1.4.1", + "req_description": "Убедитесь, что для обнаружения или предотвращения ситуаций переполнения стека, буфера или кучи приложение учитывает размер доступной области памяти при строковых операциях, копировании в память, в арифметике указателей и т.п.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.4", + "section_name": "Память, строки и неуправляемый код", + "req_id": "V1.4.2", + "req_description": "Убедитесь, что для предотвращения целочисленного переполнения применяется контроль знака, диапазона и типа допустимых входных данных.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.4", + "section_name": "Память, строки и неуправляемый код", + "req_id": "V1.4.3", + "req_description": "Убедитесь, что динамически выделенная память и ресурсы освобождены, а ссылки или указатели на освобожденную память удалены или установлены в значение null, чтобы предотвратить появление висячих указателей и уязвимостей, связанных с использованием памяти после освобождения.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.5", + "section_name": "Безопасная десериализация", + "req_id": "V1.5.1", + "req_description": "Убедитесь, что приложение настраивает XML-парсеры на использование строгой конфигурации и что небезопасные функции, такие как разрешение внешних сущностей, отключены для предотвращения атак XML eXternal Entity (XXE).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.5", + "section_name": "Безопасная десериализация", + "req_id": "V1.5.2", + "req_description": "Убедитесь, что десериализация недоверенных данных обеспечивает безопасную обработку ввода, например, используя список разрешенных типов объектов или ограничивая типы объектов, определяемые клиентом, для предотвращения атак десериализации. Механизмы десериализации, которые явно определены как небезопасные, не должны использоваться с недоверенным вводом.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.5", + "section_name": "Безопасная десериализация", + "req_id": "V1.5.3", + "req_description": "Убедитесь, что различные парсеры, используемые в приложении для одного и того же типа данных (например, парсеры JSON, XML, URL), выполняют парсинг согласованным образом и используют один и тот же механизм кодирования символов, чтобы избежать таких проблем, как уязвимости взаимодействия JSON (JSON Interoperability) или различное поведение анализа URI или файлов, которые могут использоваться в атаках удаленного включения файлов (RFI) или подделки запросов на стороне сервера (SSRF).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.1", + "section_name": "Документация валидации и бизнес-логики", + "req_id": "V2.1.1", + "req_description": "Убедитесь, что в документации приложения определены правила проверки входных данных на соответствие ожидаемой структуре. Это могут быть распространённые форматы данных, такие как номера кредитных карт, адреса электронной почты, номера телефонов, или внутренний формат данных.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.1", + "section_name": "Документация валидации и бизнес-логики", + "req_id": "V2.1.2", + "req_description": "Убедитесь, что в документации приложения указано, как проверять логическую и контекстную согласованность объединенных данных, например, проверять соответствие района и почтового индекса.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.1", + "section_name": "Документация валидации и бизнес-логики", + "req_id": "V2.1.3", + "req_description": "Убедитесь, что ожидания относительно ограничений и проверок бизнес-логики задокументированы как для уровня отдельного пользователя, так и для глобального уровня всего приложения.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.2", + "section_name": "Валидация ввода", + "req_id": "V2.2.1", + "req_description": "Убедитесь, что входные данные провалидированы для обеспечения соответствия бизнес- или функциональным ожиданиям. Валидация должна осуществляться либо по списку допустимых значений, шаблонов и диапазонов, либо путем сравнения входных данных с ожидаемой структурой и логическими ограничениями в соответствии с предопределенными правилами. Для L1 валидация может быть сосредоточена на входных данных, используемых для принятия конкретных бизнес-решений или решений, связанных с безопасностью. Для L2 и выше это должно применяться ко всем входным данным.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.2", + "section_name": "Валидация ввода", + "req_id": "V2.2.2", + "req_description": "Убедитесь, что приложение разработано с принудительной валидацией входных данных на уровне доверенного сервиса. Хотя проверка на стороне клиента повышает удобство использования и должна поощряться, на неё не следует полагаться как на средство контроля безопасности.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.2", + "section_name": "Валидация ввода", + "req_id": "V2.2.3", + "req_description": "Убедитесь, что приложение обеспечивает обоснованность комбинаций данных в соответствии с предопределенными правилам. Например: возраст должен соответствовать дате рождения; страна и почтовый индекс; количество товара в заказе и на складе.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.3", + "section_name": "Безопасность бизнес-логики", + "req_id": "V2.3.1", + "req_description": "Убедитесь, что приложение обрабатывает потоки бизнес-логики для одного и того же пользователя в ожидаемом последовательном порядке шагов и без пропуска шагов.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.3", + "section_name": "Безопасность бизнес-логики", + "req_id": "V2.3.2", + "req_description": "Убедитесь, что ограничения бизнес-логики реализованы в соответствии с документацией приложения, чтобы избежать эксплуатации её недостатков.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.3", + "section_name": "Безопасность бизнес-логики", + "req_id": "V2.3.3", + "req_description": "Убедитесь, что транзакции используются на уровне бизнес-логики таким образом, что операция бизнес-логики либо выполняется полностью, либо откатывается к предыдущему корректному состоянию.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.3", + "section_name": "Безопасность бизнес-логики", + "req_id": "V2.3.4", + "req_description": "Убедитесь, что на уровне бизнес-логики используются механизмы блокировки, чтобы гарантировать невозможность двойного бронирования ограниченных по количеству ресурсов (например, мест в театре или слотов доставки) путем манипулирования логикой приложения.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.3", + "section_name": "Безопасность бизнес-логики", + "req_id": "V2.3.5", + "req_description": "Убедитесь, что для важных потоков бизнес-логики требуется многопользовательское (multi-user) одобрение, чтобы предотвратить несанкционированные или случайные действия. Потоки бизнес-логики могут включать, помимо прочего, крупные денежные переводы, утверждение контрактов, доступ к секретной информации или обход ограничений безопасности на производстве.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.4", + "section_name": "Анти-автоматизация", + "req_id": "V2.4.1", + "req_description": "Убедитесь, что используются средства противодействия автоматизации для защиты от чрезмерных вызовов функций приложения, которые могут привести к утечке данных, созданию ненужных данных, исчерпанию квот, нарушению ограничений скорости, отказу в обслуживании или чрезмерному использованию дорогостоящих ресурсов.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.4", + "section_name": "Анти-автоматизация", + "req_id": "V2.4.2", + "req_description": "Убедитесь, что потоки бизнес-логики требуют реалистичного человеческого времени, предотвращая чрезмерно быструю отправку транзакций.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.1", + "section_name": "Документация по безопасности веб-интерфейса", + "req_id": "V3.1.1", + "req_description": "Убедитесь, что в документации приложения описаны ожидаемые функции безопасности, которые должны поддерживать браузеры, использующие приложение (такие как HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) и другие соответствующие механизмы безопасности HTTP). В документации также должно быть обязательно определено, как приложение должно себя вести, если некоторые из этих функций недоступны (например, предупреждать пользователя или блокировать доступ).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.2", + "section_name": "Непреднамеренная интерпретация контента", + "req_id": "V3.2.1", + "req_description": "Убедитесь, что реализованы меры безопасности, предотвращающие отображение контента или функций браузерами в HTTP-ответах в некорректном контексте (например, запрос API, загруженный пользователем файл или другой ресурс запрашивается напрямую). Возможные способы контроля включают: не обрабатывать содержимое, если поля заголовка HTTP-запроса (например, Sec-Fetch-*) не указывают на корректность контекста; использование заголовка и значения Content-Security-Policy: sandbox directive; или использование заголовка и значения Content-Disposition: attachment.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.2", + "section_name": "Непреднамеренная интерпретация контента", + "req_id": "V3.2.2", + "req_description": "Убедитесь, что данные, предназначенные для отображения в виде текста, а не визуализации в виде HTML, обрабатывается с использованием безопасных функций визуализации (таких как createTextNode или textContent), чтобы предотвратить непреднамеренное выполнение содержимого, такого как HTML или JavaScript.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.2", + "section_name": "Непреднамеренная интерпретация контента", + "req_id": "V3.2.3", + "req_description": "Убедитесь, что приложение избегает затирания DOM при использовании JavaScript на стороне клиента, применяя явные объявления переменных, выполняя строгую проверку типов, избегая сохранения глобальных переменных в объекте документа и реализуя изоляцию пространства имен.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.3", + "section_name": "Настройка файлов cookie", + "req_id": "V3.3.1", + "req_description": "Убедитесь, что у файлов cookie установлен атрибут «Secure», и если префикс «__Host‑» не используется в названии cookie, необходимо использовать префикс «__Secure‑».", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.3", + "section_name": "Настройка файлов cookie", + "req_id": "V3.3.2", + "req_description": "Убедитесь, что значение атрибута SameSite каждой cookie установлено в соответствии с назначением cookie, чтобы ограничить подверженность атакам на восстановление пользовательского интерфейса и атакам с подделкой запросов на уровне браузера, обычно называемым подделкой межсайтовых запросов (CSRF).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.3", + "section_name": "Настройка файлов cookie", + "req_id": "V3.3.3", + "req_description": "Убедитесь, что cookie имеют префикс «__Host‑» в названии, если только они явно не предназначены для совместного использования с другими хостами.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.3", + "section_name": "Настройка файлов cookie", + "req_id": "V3.3.4", + "req_description": "Убедитесь, что если значение cookie не должно быть доступно для клиентских скриптов (например, сессионный токен), для cookie должен быть установлен атрибут «HttpOnly», а само значение должно передаваться клиенту только через поле заголовка «Set-Cookie».", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.3", + "section_name": "Настройка файлов cookie", + "req_id": "V3.3.5", + "req_description": "Убедитесь, что при записи cookie приложением общая длина имени и значения cookie не превышает 4096 байт. Слишком большие cookie не будут сохраняться браузером и, следовательно, не будут отправляться с запросами, что помешает пользователю использовать функции приложения, зависящие от этого cookie.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.4", + "section_name": "Заголовки механизма безопасности браузера", + "req_id": "V3.4.1", + "req_description": "Убедитесь, что поле заголовка Strict‑Transport‑Security включено во все ответы для реализации политики HTTP Strict Transport Security (HSTS). Необходимо указать максимальное время не менее 1 года, а для L2 и выше политика должна применяться также ко всем поддоменам.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.4", + "section_name": "Заголовки механизма безопасности браузера", + "req_id": "V3.4.2", + "req_description": "Убедитесь, что поле заголовка Cross‑Origin Resource Sharing (CORS) «Access‑Control‑Allow‑Origin» имеет фиксированное значение, заданное приложением, или, если используется заголовок Origin, оно проверяется по списку доверенных источников. При необходимости использования «Access‑Control‑Allow‑Origin: *» убедитесь, что ответ не содержит конфиденциальной информации.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.4", + "section_name": "Заголовки механизма безопасности браузера", + "req_id": "V3.4.3", + "req_description": "Убедитесь, что HTTP-ответы содержат поле заголовка Content-Security-Policy, которое определяет директивы, гарантирующие загрузку и выполнение браузером только доверенного контента или ресурсов, чтобы ограничить выполнение вредоносного JavaScript. Как минимум, необходимо использовать глобальную политику, включающую директивы object-src «none» и base-uri «none», а также определяющую список разрешенных адресов или использующую одноразовые коды или хэши. Для приложений L3 необходимо определить политику использования 'nonce' или hash-конструкций для каждого ответа.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.4", + "section_name": "Заголовки механизма безопасности браузера", + "req_id": "V3.4.4", + "req_description": "Убедитесь, что все HTTP-ответы содержат поле заголовка «X‑Content‑Type‑Options: nosniff». Это предписывает браузерам не использовать анализ контента и определение типа MIME для данного ответа, а также требовать, чтобы значение поля заголовка Content‑Type в ответе соответствовало целевому ресурсу. Например, ответ на запрос стиля принимается только в том случае, если Content‑Type в ответе — «text/css». Это также позволяет браузеру использовать функцию Cross‑Origin Read Blocking (CORB).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.4", + "section_name": "Заголовки механизма безопасности браузера", + "req_id": "V3.4.5", + "req_description": "Убедитесь, что приложение устанавливает политику реферера для предотвращения утечки технически конфиденциальных данных сторонним сервисам через поле заголовка HTTP-запроса «Referer». Это можно сделать с помощью поля заголовка HTTP-ответа «Referrer‑Policy» или через атрибуты HTML-элемента. Конфиденциальные данные могут включать путь и данные запроса в URL-адресе, а для внутренних непубличных приложений также имя хоста.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.4", + "section_name": "Заголовки механизма безопасности браузера", + "req_id": "V3.4.6", + "req_description": "Убедитесь, что веб-приложение использует директиву frame‑ancestors поля заголовка Content‑Security‑Policy для каждого HTTP-ответа, чтобы гарантировать невозможность его внедрения по умолчанию и внедрение определённых ресурсов разрешено только при необходимости. Обратите внимание, что поле заголовка X‑Frame‑Options, хотя и поддерживается браузерами, устарело и не может быть использовано в качестве основы.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.4", + "section_name": "Заголовки механизма безопасности браузера", + "req_id": "V3.4.7", + "req_description": "Убедитесь, что в поле заголовка Content‑Security‑Policy указано место, куда следует сообщать о нарушениях.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.4", + "section_name": "Заголовки механизма безопасности браузера", + "req_id": "V3.4.8", + "req_description": "Убедитесь, что все HTTP-ответы, инициирующие рендеринг документа (например, ответы с типом содержимого text/html), включают поле заголовка Cross-Origin-Opener-Policy с директивой same-origin или same-origin-allow-popups (при необходимости). Это предотвращает атаки, злоупотребляющие общим доступом к объектам Window, такие как Tabnabbing и Frame Counting.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.5", + "section_name": "Браузерное разделение источников", + "req_id": "V3.5.1", + "req_description": "Убедитесь, что, если приложение не использует механизм предварительной проверки CORS для предотвращения запрещённых кросс-доменных запросов на использование чувствительного функционала, эти запросы валидируются на предмет их происхождения от самого приложения. Это можно сделать, используя и проверяя специальные токены для защиты от подделки или требуя дополнительные поля HTTP-заголовка, не входящие в список «простых заголовков» (CORS-safelisted request-header). Это необходимо для защиты от атак с подделкой запросов через браузер, широко известных как межсайтовая подделка запросов (CSRF).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.5", + "section_name": "Браузерное разделение источников", + "req_id": "V3.5.2", + "req_description": "Убедитесь, что если приложение использует механизм предварительной проверки CORS для предотвращения неразрешённого использования чувствительного функционала между источниками, вызов этого функционала невозможен с помощью запроса, который не запускает предварительную проверку CORS. Для этого может потребоваться проверка значений полей заголовка запроса «Origin» и «Content-Type» или использование дополнительного поля заголовка, не входящего в безопасный список CORS.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.5", + "section_name": "Браузерное разделение источников", + "req_id": "V3.5.3", + "req_description": "Убедитесь, что HTTP-запросы к чувствительному функционалу используют соответствующие HTTP-методы, такие как POST, PUT, PATCH или DELETE, а не методы, определённые спецификацией HTTP как «безопасные», такие как HEAD, OPTIONS или GET. В качестве альтернативы можно использовать строгую валидацию полей заголовка запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, навигационного запроса или загрузки ресурса (например, источника изображения), где это не ожидается.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.5", + "section_name": "Браузерное разделение источников", + "req_id": "V3.5.4", + "req_description": "Убедитесь, что отдельные приложения размещены на разных именах хостов, чтобы использовать ограничения, предусмотренные политикой same-origin, включая то, как документы или скрипты, загруженные одним источником, могут взаимодействовать с ресурсами из другого источника, а также ограничения на cookie на основе имени хоста.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.5", + "section_name": "Браузерное разделение источников", + "req_id": "V3.5.5", + "req_description": "Убедитесь, что сообщения, полученные интерфейсом postMessage, отвергаются, если источник сообщения не является доверенным или если синтаксис сообщения недействителен.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.5", + "section_name": "Браузерное разделение источников", + "req_id": "V3.5.6", + "req_description": "Убедитесь, что функциональность JSONP не включена нигде в приложении, чтобы избежать атак с использованием межсайтового включения скриптов (XSSI).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.5", + "section_name": "Браузерное разделение источников", + "req_id": "V3.5.7", + "req_description": "Убедитесь, что данные, требующие авторизации, не включены в ответы ресурсов скриптов, таких как файлы JavaScript, чтобы предотвратить атаки с использованием межсайтового включения скриптов (XSSI).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.5", + "section_name": "Браузерное разделение источников", + "req_id": "V3.5.8", + "req_description": "Убедитесь, что аутентифицированные ресурсы (такие как изображения, видео, скрипты и другие документы) могут быть загружены или внедрены от имени пользователя только по назначению. Этого можно добиться путём строгой валидации полей заголовка HTTP-запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, или путём установки ограничительного поля заголовка HTTP-ответа Cross‑Origin‑Resource‑Policy, чтобы браузер блокировал возвращаемый контент.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.6", + "section_name": "Целостность внешних ресурсов", + "req_id": "V3.6.1", + "req_description": "Убедитесь, что клиентские ресурсы, такие как библиотеки JavaScript, CSS или веб-шрифты, размещаются только на внешнем сервере (например, в сети доставки контента (Content Delivery Network)), если ресурс статический и имеет версии, а для проверки целостности ресурса используется механизм проверки целостности подресурсов (SRI). Если это невозможно, для каждого ресурса должно быть задокументировано решение по безопасности, обосновывающее это.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.7", + "section_name": "Другие соображения по безопасности браузера", + "req_id": "V3.7.1", + "req_description": "Убедитесь, что приложение использует только те клиентские технологии, которые по-прежнему поддерживаются и считаются безопасными. Примерами технологий, не соответствующих этому требованию, являются плагины NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL или клиентские Java-апплеты.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.7", + "section_name": "Другие соображения по безопасности браузера", + "req_id": "V3.7.2", + "req_description": "Убедитесь, что приложение будет автоматически перенаправлять пользователя на другое имя хоста или домен (который не контролируется приложением), только если этот хост или домен указаны в списке разрешенных.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.7", + "section_name": "Другие соображения по безопасности браузера", + "req_id": "V3.7.3", + "req_description": "Убедитесь, что приложение отображает уведомление, что пользователь перенаправляется на URL-адрес, находящийся вне контроля приложения, с возможностью отмены навигации.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.7", + "section_name": "Другие соображения по безопасности браузера", + "req_id": "V3.7.4", + "req_description": "Убедитесь, что домен верхнего уровня приложения (например, site.tld) ​​добавлен в публичный список предварительной загрузки (preload list) для HTTP Strict Transport Security (HSTS). Это гарантирует, что использование TLS для приложения будет встроено непосредственно в основные браузеры, а не будет полагаться только на поле заголовка ответа Strict-Transport-Security.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.7", + "section_name": "Другие соображения по безопасности браузера", + "req_id": "V3.7.5", + "req_description": "Убедитесь, что приложение ведет себя так, как описано в документации (например, предупреждает пользователя или блокирует доступ), если браузер, используемый для доступа к приложению, не поддерживает ожидаемые функции безопасности.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.1", + "section_name": "Общая безопасность веб-сервисов", + "req_id": "V4.1.1", + "req_description": "Убедитесь, что каждый HTTP-ответ с телом сообщения содержит заголовок Content-Type, который соответствует фактическому содержимому ответа, таким как «text/», «/+xml» и «/xml», включая параметр charset для указания безопасной кодировки символов (например, UTF-8, ISO-8859-1) согласно IANA Media Types.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.1", + "section_name": "Общая безопасность веб-сервисов", + "req_id": "V4.1.2", + "req_description": "Убедитесь, что только конечные точки, предназначенные для взаимодействия с пользователем через веб-браузер, автоматически перенаправляют HTTP на HTTPS, в то время как другие сервисы или конечные точки не реализуют прозрачные редиректы. Это необходимо, чтобы избежать ситуации, когда клиент ошибочно отправляет незашифрованные HTTP-запросы а из-за того, что запрос по HTTP автоматически перенаправляется на HTTPS другим сервисом без обработки на входе, утечка чувствительных данных остаётся незамеченной.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.1", + "section_name": "Общая безопасность веб-сервисов", + "req_id": "V4.1.3", + "req_description": "Убедитесь, что любой HTTP-заголовок, используемый приложением и устанавливаемый промежуточным уровнем, таким как балансировщик нагрузки, веб-прокси или backend-for-frontend сервис, не может быть переопределён конечным пользователем. Примеры заголовков: X-Real-IP, X-Forwarded-*, X-User-ID.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.1", + "section_name": "Общая безопасность веб-сервисов", + "req_id": "V4.1.4", + "req_description": "Убедитесь, что разрешены только HTTP-методы, которые явно поддерживаются приложением или его API (включая OPTIONS для preflight-запросов), а неиспользуемые методы заблокированы.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.1", + "section_name": "Общая безопасность веб-сервисов", + "req_id": "V4.1.5", + "req_description": "Убедитесь, что для особо чувствительных запросов или транзакций, проходящих через несколько систем, используются цифровые подписи на уровне сообщений, дополнительно к транспортным средствам защиты.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.2", + "section_name": "Валидация структуры HTTP-сообщений", + "req_id": "V4.2.1", + "req_description": "Убедитесь, что все компоненты приложения (включая балансировщики нагрузки, файрволы и серверы приложений) определяют границы входящих HTTP-сообщений с использованием механизма, соответствующего версии HTTP, чтобы предотвратить HTTP request smuggling. В HTTP/1.x, если присутствует заголовок Transfer-Encoding, заголовок Content-Length должен игнорироваться согласно RFC 2616. При использовании HTTP/2 или HTTP/3, если присутствует Content-Length, веб-сервер должен убедиться, что он совпадает с длиной DATA-фреймов.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.2", + "section_name": "Валидация структуры HTTP-сообщений", + "req_id": "V4.2.2", + "req_description": "Убедитесь, что при генерации HTTP-сообщений заголовок Content-Length не конфликтует с длиной содержимого, определяемой рамками протокола HTTP, чтобы предотвратить HTTP Request Smuggling.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.2", + "section_name": "Валидация структуры HTTP-сообщений", + "req_id": "V4.2.3", + "req_description": "Убедитесь, что приложение не отправляет и не принимает HTTP/2 и HTTP/3 сообщения с заголовками, специфичными для соединения, такими как Transfer-Encoding, чтобы предотвратить HTTP Response Splitting и HTTP Header Injection.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.2", + "section_name": "Валидация структуры HTTP-сообщений", + "req_id": "V4.2.4", + "req_description": "Убедитесь, что приложение принимает HTTP/2 и HTTP/3 запросы только в случае, если поля заголовков и их значения не содержат последовательностей CR (\\r), LF (\\n) или CRLF (\\r\\n), чтобы предотвратить HTTP Header Injection.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.2", + "section_name": "Валидация структуры HTTP-сообщений", + "req_id": "V4.2.5", + "req_description": "Убедитесь, что если приложение (бекенд или фронтенд) формирует и отправляет запросы, оно использует валидацию, очистку или другие механизмы, чтобы не создавать URI (например, для API-вызовов) или HTTP-заголовки (например, Authorization или Cookie) слишком большой длины, чтобы их не принимал приёмник. Это может привести к отказу в обслуживании, например, при отправке слишком длинного запроса (длинный cookie-заголовок), из-за чего сервер постоянно возвращает ошибку.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.3", + "section_name": "GraphQL", + "req_id": "V4.3.1", + "req_description": "Убедитесь, что используется белый список запросов, ограничение глубины вложенности, ограничение количества или анализ стоимости запроса, чтобы предотвратить DoS-атаки на уровне GraphQL или слоя данных из-за дорогостоящих вложенных запросов.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.3", + "section_name": "GraphQL", + "req_id": "V4.3.2", + "req_description": "Убедитесь, что introspection-запросы GraphQL отключены в продакшен-среде, если GraphQL API не предназначен для использования сторонними клиентами.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.1", + "req_description": "Убедитесь, что для всех WebSocket-соединений используется WebSocket поверх TLS (WSS).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.2", + "req_description": "Убедитесь, что при первоначальном HTTP WebSocket handshake заголовок Origin проверяется на соответствие списку разрешённых источников для приложения.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.3", + "req_description": "Убедитесь, что если стандартное управление сессиями приложения не может быть использовано, применяются специальные токены, соответствующие требованиям безопасности управления сессиями.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.4", + "req_description": "Убедитесь, что специальные токены управления сессиями WebSocket изначально получаются или валидируются через ранее аутентифицированную HTTPS-сессию при переходе от HTTPS к WebSocket.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.1", + "section_name": "Документация по работе с файлами", + "req_id": "V5.1.1", + "req_description": "Убедитесь, что документация определяет допустимые типы файлов, ожидаемые расширения и максимальный размер (включая распакованный размер) для каждой функции загрузки. Также убедитесь, что в документации указано, как файлы обезвреживаются для конечных пользователей (например, как приложение ведёт себя при обнаружении вредоносного файла).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.2", + "section_name": "Загрузка файлов и содержимое", + "req_id": "V5.2.1", + "req_description": "Убедитесь, что приложение принимает только те файлы, которые может обработать без потери производительности или отказа в обслуживании.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.2", + "section_name": "Загрузка файлов и содержимое", + "req_id": "V5.2.2", + "req_description": "Убедитесь, что при загрузке файла (включая файлы внутри архивов, таких как ZIP) приложение проверяет, соответствует ли расширение ожидаемому, и валидирует, соответствует ли содержимое типу, указанному в расширении. Это включает проверку начальных 'magic bytes', перезапись изображений, использование специализированных библиотек. Для уровня 1 — достаточно проверок для файлов, критичных с точки зрения бизнеса или безопасности. Для уровней 2 и выше — для всех файлов.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.2", + "section_name": "Загрузка файлов и содержимое", + "req_id": "V5.2.3", + "req_description": "Убедитесь, что приложение проверяет архивы (например, zip, gz, docx, odt) на максимально допустимый распакованный размер и максимальное количество файлов до распаковки.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.2", + "section_name": "Загрузка файлов и содержимое", + "req_id": "V5.2.4", + "req_description": "Убедитесь, что для каждого пользователя установлены квоты на общий размер и количество файлов, чтобы один пользователь не мог переполнить хранилище.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.2", + "section_name": "Загрузка файлов и содержимое", + "req_id": "V5.2.5", + "req_description": "Убедитесь, что приложение не позволяет загружать архивы с символьными ссылками (symlinks), если это не требуется по бизнес-логике. Если требуется — разрешён только строго определённый список допустимых символьных ссылок.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.2", + "section_name": "Загрузка файлов и содержимое", + "req_id": "V5.2.6", + "req_description": "Убедитесь, что приложение отклоняет изображения с числом пикселей выше допустимого, чтобы предотвратить атаки 'pixel flood'.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.3", + "section_name": "Хранение файлов", + "req_id": "V5.3.1", + "req_description": "Убедитесь, что загруженные или сгенерированные из недоверенного ввода файлы, находящиеся в публичной директории, не исполняются как серверный код при обращении к ним по HTTP.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.3", + "section_name": "Хранение файлов", + "req_id": "V5.3.2", + "req_description": "Убедитесь, что при создании путей к файлам приложение использует внутренние или доверенные данные, а не пользовательские имена файлов. Если использование пользовательских имён или метаданных необходимо — требуется строгая проверка и очистка. Это защита от path traversal, LFI, RFI и SSRF.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.3", + "section_name": "Хранение файлов", + "req_id": "V5.3.3", + "req_description": "Убедитесь, что при обработке файлов на сервере (например, при распаковке) игнорируются пути, заданные пользователем, во избежание уязвимостей типа 'zip slip'.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.4", + "section_name": "Скачивание файлов", + "req_id": "V5.4.1", + "req_description": "Убедитесь, что приложение валидирует или игнорирует имена файлов, переданных пользователем (включая в JSON, JSONP или URL-параметре), и указывает имя файла в заголовке Content-Disposition при ответе.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.4", + "section_name": "Скачивание файлов", + "req_id": "V5.4.2", + "req_description": "Убедитесь, что имена файлов, передаваемые (например, в HTTP-заголовках или вложениях в email), кодируются или очищаются (например, по RFC 6266), чтобы сохранить структуру документа и предотвратить инъекции.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.4", + "section_name": "Скачивание файлов", + "req_id": "V5.4.3", + "req_description": "Убедитесь, что файлы, полученные из недоверенных источников, сканируются антивирусом, чтобы не распространять известное вредоносное содержимое.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.1", + "section_name": "Документация по аутентификации", + "req_id": "V6.1.1", + "req_description": "Убедитесь, что в документации приложения описано, как используются механизмы, такие как ограничение частоты запросов (rate limiting), защита от автоматизации и адаптивные реакции, для защиты от атак, таких как подстановка учётных данных и перебор паролей. Документация должна ясно описывать конфигурацию этих механизмов и предотвращение злонамеренной блокировки аккаунтов.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.1", + "section_name": "Документация по аутентификации", + "req_id": "V6.1.2", + "req_description": "Убедитесь, что задокументирован список контекстно-зависимых слов, запрещённых к использованию в паролях. В него могут входить производные от названий организаций, продуктов, идентификаторов систем, кодовых названий проектов, названий отделов или ролей и тому подобное.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.1", + "section_name": "Документация по аутентификации", + "req_id": "V6.1.3", + "req_description": "Убедитесь, что если приложение поддерживает несколько способов аутентификации, то все они документированы вместе с описанием применяемых средств защиты и уровнем стойкости аутентификации, которые должны быть одинаково применены ко всем способам.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.1", + "req_description": "Убедитесь, что пользовательские пароли содержат не менее 8 символов. Рекомендуется минимальная длина в 15 символов.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.2", + "req_description": "Убедитесь, что пользователи могут менять свои пароли.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.3", + "req_description": "Убедитесь, что для смены пароля требуется ввести как текущий, так и новый пароль.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.4", + "req_description": "Убедитесь, что при регистрации или смене пароля введённый пароль проверяется по списку как минимум из 3000 самых популярных паролей, соответствующих политике (например, минимальной длине).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.5", + "req_description": "Убедитесь, что допускаются пароли любой структуры, без ограничений на использование определённых символов. Не должно быть требований по обязательному наличию заглавных/строчных букв, цифр или специальных символов.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.6", + "req_description": "Убедитесь, что поля ввода пароля используют type=password для скрытия символов. Разрешено временное отображение всего пароля или последнего введённого символа.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.7", + "req_description": "Убедитесь, что разрешены вставка (paste), использование менеджеров паролей браузера и внешних менеджеров паролей.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.8", + "req_description": "Убедитесь, что пароль проверяется строго в том виде, в котором он был введён пользователем — без обрезки, изменения регистра и других модификаций.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.9", + "req_description": "Убедитесь, что система позволяет использовать пароли длиной не менее 64 символов.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.10", + "req_description": "Убедитесь, что пароль остаётся действительным, пока не будет скомпрометирован или не будет изменён пользователем. Приложение не должно требовать регулярной смены пароля.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.11", + "req_description": "Убедитесь, что используется документированный список контекстно-зависимых слов (например, названия компаний, проектов и т.д.) для предотвращения использования легко угадываемых паролей.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.12", + "req_description": "Убедитесь, что при регистрации или смене пароля проверяется, не входит ли он в список скомпрометированных (утёкших) паролей.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.3", + "section_name": "Общие требования к безопасности аутентификации", + "req_id": "V6.3.1", + "req_description": "Убедитесь, что реализованы меры защиты от атак типа credential stuffing (массовая подстановка учётных данных) и brute-force (перебор паролей), согласно документации по безопасности приложения.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.3", + "section_name": "Общие требования к безопасности аутентификации", + "req_id": "V6.3.2", + "req_description": "Убедитесь, что в приложении отсутствуют или отключены учётные записи по умолчанию (например, root, admin, sa).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.3", + "section_name": "Общие требования к безопасности аутентификации", + "req_id": "V6.3.3", + "req_description": "Убедитесь, что для доступа к приложению используется либо механизм многофакторной аутентификации, либо комбинация однофакторных. Для уровня L3 один из факторов должен быть аппаратным, обеспечивающим защиту от фишинга, устойчивость к компрометации и подтверждение намерения аутентификации через явное действие пользователя (например, нажатие кнопки на FIDO-ключе или телефоне). Ослабление этих требований допускается только при наличии обоснования и компенсирующих мер.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.3", + "section_name": "Общие требования к безопасности аутентификации", + "req_id": "V6.3.4", + "req_description": "Убедитесь, что при наличии нескольких способов аутентификации, они все задокументированы, и для них единообразно применяются меры защиты и уровни доверия.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.3", + "section_name": "Общие требования к безопасности аутентификации", + "req_id": "V6.3.5", + "req_description": "Убедитесь, что пользователи получают уведомления о подозрительных попытках аутентификации (удачных и неудачных). Это может включать попытки (например, подключения) с необычного устройства или места, частично успешную MFA, попытку после долгого отсутствия или успешную аутентификацию после серии неудачных.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.3", + "section_name": "Общие требования к безопасности аутентификации", + "req_id": "V6.3.6", + "req_description": "Убедитесь, что email не используется ни как однофакторный, ни как многофакторный механизм аутентификации.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.3", + "section_name": "Общие требования к безопасности аутентификации", + "req_id": "V6.3.7", + "req_description": "Убедитесь, что пользователи получают уведомление при изменении данных аутентификации, таких как сброс пароля или изменение логина/email.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.3", + "section_name": "Общие требования к безопасности аутентификации", + "req_id": "V6.3.8", + "req_description": "Убедитесь, что из сообщений об ошибке, HTTP-кодов ответа или различий во времени ответа нельзя определить, существует ли пользователь с таким логином. Это правило также должно применяться к функциям регистрации и восстановления пароля.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.4", + "section_name": "Жизненный цикл и восстановление факторов аутентификации", + "req_id": "V6.4.1", + "req_description": "Убедитесь, что начальные пароли или коды активации, генерируемые системой, создаются с использованием надёжного генератора случайных чисел, соответствуют текущей политике паролей и истекают через короткий период времени либо после первого использования. Эти секреты не должны использоваться как постоянные пароли.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.4", + "section_name": "Жизненный цикл и восстановление факторов аутентификации", + "req_id": "V6.4.2", + "req_description": "Убедитесь, что в системе отсутствуют подсказки к паролю или вопросы на знание («секретные вопросы»).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.4", + "section_name": "Жизненный цикл и восстановление факторов аутентификации", + "req_id": "V6.4.3", + "req_description": "Убедитесь, что реализован безопасный процесс сброса забытого пароля, который не обходит активные механизмы многофакторной аутентификации.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.4", + "section_name": "Жизненный цикл и восстановление факторов аутентификации", + "req_id": "V6.4.4", + "req_description": "Убедитесь, что в случае утраты одного из факторов MFA проводится удостоверение личности (identity proofing) на том же уровне, что и при первичной регистрации.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.4", + "section_name": "Жизненный цикл и восстановление факторов аутентификации", + "req_id": "V6.4.5", + "req_description": "Убедитесь, что инструкции по обновлению истекающих механизмов аутентификации отправляются заранее, с достаточным запасом времени для выполнения замены, при необходимости с настройкой автоматических напоминаний.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.4", + "section_name": "Жизненный цикл и восстановление факторов аутентификации", + "req_id": "V6.4.6", + "req_description": "Убедитесь, что администраторы могут инициировать процесс сброса пароля, но не могут задать или выбрать новый пароль за пользователя. Это исключает ситуацию, при которой администратор знает пароль пользователя.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.5", + "section_name": "Общие требования к многофакторной аутентификации", + "req_id": "V6.5.1", + "req_description": "Убедитесь, что lookup-секреты, внеполосные коды/запросы и TOTP-коды можно использовать только один раз.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.5", + "section_name": "Общие требования к многофакторной аутентификации", + "req_id": "V6.5.2", + "req_description": "Убедитесь, что при хранении lookup-секретов с энтропией менее 112 бит (например, 19 случайных буквенно-цифровых символов или 34 случайные цифры) они хэшируются с использованием разрешённого алгоритма хеширования паролей и случайной соли минимум 32 бита. Если у секрета ≥112 бит энтропии — допустимо использовать стандартный хэш.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.5", + "section_name": "Общие требования к многофакторной аутентификации", + "req_id": "V6.5.3", + "req_description": "Убедитесь, что lookup-секреты, коды внеполосной аутентификации и сиды для TOTP генерируются с использованием криптографически стойкого генератора случайных чисел (CSPRNG), чтобы избежать предсказуемых значений.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.5", + "section_name": "Общие требования к многофакторной аутентификации", + "req_id": "V6.5.4", + "req_description": "Убедитесь, что lookup-секреты и внеполосные коды аутентификации имеют минимум 20 бит энтропии (достаточно, например, 4 случайных алфавитно-цифровых символов или 6 случайных цифр).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.5", + "section_name": "Общие требования к многофакторной аутентификации", + "req_id": "V6.5.5", + "req_description": "Убедитесь, что все внеполосные запросы, коды и токены, а также TOTP-коды имеют ограниченный срок действия. Максимум для out-of-band — 10 минут, для TOTP — 30 секунд.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.5", + "section_name": "Общие требования к многофакторной аутентификации", + "req_id": "V6.5.6", + "req_description": "Убедитесь, что любой фактор аутентификации (включая физические устройства) может быть отозван в случае кражи или утери.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.5", + "section_name": "Общие требования к многофакторной аутентификации", + "req_id": "V6.5.7", + "req_description": "Убедитесь, что биометрические механизмы аутентификации используются только как вторичный фактор — в сочетании с «чем-то, что вы знаете» или «чем-то, что у вас есть».", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.5", + "section_name": "Общие требования к многофакторной аутентификации", + "req_id": "V6.5.8", + "req_description": "Убедитесь, что TOTP-коды проверяются по источнику времени, полученному от доверенного сервиса, а не от клиента или недоверенного источника.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.6", + "section_name": "Внеполосные механизмы аутентификации", + "req_id": "V6.6.1", + "req_description": "Убедитесь, что механизмы аутентификации через телефонную сеть общего пользования (PSTN) для доставки одноразовых паролей (OTP) по телефону или SMS используются только в случае предварительной валидации номера, при этом предлагаются альтернативные более безопасные методы (например, TOTP), и пользователю сообщаются риски. Для приложений уровня L3 использование телефона и SMS недопустимо.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.6", + "section_name": "Внеполосные механизмы аутентификации", + "req_id": "V6.6.2", + "req_description": "Убедитесь, что внеполосные запросы, коды или токены привязаны к исходному запросу аутентификации, для которого они были сгенерированы, и не могут быть использованы повторно для других попыток.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.6", + "section_name": "Внеполосные механизмы аутентификации", + "req_id": "V6.6.3", + "req_description": "Убедитесь, что внеполосные механизмы на основе кода защищены от атак методом подбора (brute force) путём применения ограничения частоты запросов (rate limiting). Также рекомендуется использовать коды с энтропией не менее 64 бит.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.6", + "section_name": "Внеполосные механизмы аутентификации", + "req_id": "V6.6.4", + "req_description": "Убедитесь, что при использовании push-уведомлений для MFA применяется ограничение частоты (rate limiting), чтобы предотвратить атаки push-бомбинга. Также может помочь механизм сопоставления номеров (number matching).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.7", + "section_name": "Криптографические механизмы аутентификации", + "req_id": "V6.7.1", + "req_description": "Убедитесь, что сертификаты, используемые для проверки криптографических утверждений об аутентификации, хранятся таким образом, чтобы исключить возможность их модификации.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.7", + "section_name": "Криптографические механизмы аутентификации", + "req_id": "V6.7.2", + "req_description": "Убедитесь, что nonce (случайная строка), используемая в процессе вызова, имеет длину не менее 64 бит и является статистически уникальной или уникальной на протяжении всего срока службы криптографического устройства.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.8", + "section_name": "Аутентификация с использованием провайдера идентификаций (IdP)", + "req_id": "V6.8.1", + "req_description": "Убедитесь, что при поддержке несколькими IdP, невозможно подделать личность пользователя через другой IdP (например, с тем же user ID). Стандартным способом защиты является регистрация пользователя с использованием сочетания ID самого IdP (в качестве пространства имён) и пользовательского ID внутри IdP.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.8", + "section_name": "Аутентификация с использованием провайдера идентификаций (IdP)", + "req_id": "V6.8.2", + "req_description": "Убедитесь, что наличие и целостность цифровой подписи в утверждениях аутентификации (например, в JWT или SAML) всегда проверяются, а неподписанные или недействительные утверждения отклоняются.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.8", + "section_name": "Аутентификация с использованием провайдера идентификаций (IdP)", + "req_id": "V6.8.3", + "req_description": "Убедитесь, что SAML-утверждения обрабатываются только один раз в течение периода их действия, чтобы исключить атаки воспроизведения (replay attacks).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.8", + "section_name": "Аутентификация с использованием провайдера идентификаций (IdP)", + "req_id": "V6.8.4", + "req_description": "Убедитесь, что если приложение использует внешний поставщик идентификации (IdP) и для определенных функций требуется особый уровень, метод или срок действия аутентификации, то приложение использует данные, возвращаемые IdP, для проверки этих условий. Например, при использовании OIDC можно проверить значения полей ID Token — acr, amr, auth_time (если они есть). Если IdP не предоставляет эти данные, приложение должно иметь документированный план действий по умолчанию, предполагающий использование минимально допустимой силы аутентификации (например, одноступенчатая — логин и пароль).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.1", + "section_name": "Документация по управлению сессиями", + "req_id": "V7.1.1", + "req_description": "Убедитесь, что тайм-аут бездействия и абсолютное максимальное время жизни сессии задокументированы, соответствуют другим контрольным мерам и сопровождаются обоснованием любых отклонений от требований повторной аутентификации NIST SP 800-63B.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.1", + "section_name": "Документация по управлению сессиями", + "req_id": "V7.1.2", + "req_description": "Убедитесь, что документация определяет допустимое количество одновременных (параллельных) сессий для одного аккаунта, а также поведение системы и действия при достижении этого лимита.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.1", + "section_name": "Документация по управлению сессиями", + "req_id": "V7.1.3", + "req_description": "Убедитесь, что все системы, создающие и управляющие сессиями пользователей в рамках федеративной идентификации (например, SSO), задокументированы вместе с механизмами координации сроков действия сессий, условий завершения и случаев, требующих повторной аутентификации.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.2", + "section_name": "Базовая безопасность сессий", + "req_id": "V7.2.1", + "req_description": "Убедитесь, что все проверки сессионных токенов выполняются на доверенной серверной стороне.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.2", + "section_name": "Базовая безопасность сессий", + "req_id": "V7.2.2", + "req_description": "Убедитесь, что приложение использует либо автономные токены, либо ссылочные токены, которые генерируются динамически, не используя статические API-секреты или ключи.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.2", + "section_name": "Базовая безопасность сессий", + "req_id": "V7.2.3", + "req_description": "Убедитесь, что ссылочные токены являются уникальными, создаются с использованием криптографически безопасного генератора псевдослучайных чисел (CSPRNG) и обладают энтропией не менее 128 бит.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.2", + "section_name": "Базовая безопасность сессий", + "req_id": "V7.2.4", + "req_description": "Убедитесь, что при аутентификации пользователя (включая повторную) создается новый токен сессии, а текущий — аннулируется.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.3", + "section_name": "Тайм-ауты сессии", + "req_id": "V7.3.1", + "req_description": "Убедитесь, что есть тайм-аут бездействия, после которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.3", + "section_name": "Тайм-ауты сессии", + "req_id": "V7.3.2", + "req_description": "Убедитесь, что установлено абсолютное максимальное время жизни сессии, по истечении которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.4", + "section_name": "Завершение сессий", + "req_id": "V7.4.1", + "req_description": "Убедитесь, что после завершения сессии (logout, истечение срока) дальнейшее её использование невозможно. Для ссылочных токенов или сессий с сохранением состояния это означает аннулирование на сервере. Для self-contained токенов необходимо реализовать механизм отзыва, например, список отозванных токенов, проверку времени выпуска или ротацию ключей подписи для каждого пользователя.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.4", + "section_name": "Завершение сессий", + "req_id": "V7.4.2", + "req_description": "Убедитесь, что при удалении или отключении пользователя все активные сессии немедленно завершаются.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.4", + "section_name": "Завершение сессий", + "req_id": "V7.4.3", + "req_description": "Убедитесь, что после изменения или удаления факторов аутентификации (например, смена пароля или MFA) приложение предлагает завершить все другие активные сессии.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.4", + "section_name": "Завершение сессий", + "req_id": "V7.4.4", + "req_description": "Убедитесь, что на всех страницах, требующих аутентификации, имеется простой и видимый способ выхода.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.4", + "section_name": "Завершение сессий", + "req_id": "V7.4.5", + "req_description": "Убедитесь, что администраторы могут завершать активные сессии конкретного пользователя или всех пользователей.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.5", + "section_name": "Защита от злоупотреблений сессией", + "req_id": "V7.5.1", + "req_description": "Убедитесь, что приложение требует полной повторной аутентификации перед изменением чувствительных атрибутов аккаунта, которые могут влиять на аутентификацию (например, email, номер телефона, настройки MFA или данных восстановления доступа).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.5", + "section_name": "Защита от злоупотреблений сессией", + "req_id": "V7.5.2", + "req_description": "Убедитесь, что пользователь может просматривать и (после повторной аутентификации хотя бы по одному фактору) завершать активные сессии.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.5", + "section_name": "Защита от злоупотреблений сессией", + "req_id": "V7.5.3", + "req_description": "Убедитесь, что перед выполнением критически важных операций приложение требует повторной аутентификации (по крайней мере, одного фактора) или дополнительной проверки.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.6", + "section_name": "Федеративная повторная аутентификация", + "req_id": "V7.6.1", + "req_description": "Убедитесь, что срок действия и завершение сессий между RP и IdP соответствуют документации и включают повторную аутентификацию, если достигнут максимальный допустимый интервал между событиями аутентификации.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.6", + "section_name": "Федеративная повторная аутентификация", + "req_id": "V7.6.2", + "req_description": "Убедитесь, что создание сессии требует согласия пользователя или явного действия, предотвращающего несанкционированное создание сессий без участия пользователя.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.1", + "section_name": "Документация по авторизации", + "req_id": "V8.1.1", + "req_description": "Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне функций и на уровне данных на основе прав субъекта и атрибутов ресурса.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.1", + "section_name": "Документация по авторизации", + "req_id": "V8.1.2", + "req_description": "Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне полей (как на чтение, так и на запись) на основе прав субъекта и атрибутов ресурса. Эти правила могут зависеть от других атрибутов объекта данных, например, статуса.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.1", + "section_name": "Документация по авторизации", + "req_id": "V8.1.3", + "req_description": "Убедитесь, что документация определяет, какие атрибуты окружения и контекста (например, время суток, IP-адрес, местоположение, устройство) используются приложением для принятия решений в области аутентификации и авторизации.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.1", + "section_name": "Документация по авторизации", + "req_id": "V8.1.4", + "req_description": "Убедитесь, что документация по аутентификации и авторизации определяет, как используются факторы окружения и контекста в принятии решений, наряду с правилами доступа к функциям, данным и полям. Документация должна содержать оцениваемые атрибуты, пороговые значения риска, действия (разрешить, отказать, повысить уровень аутентификации и др.).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.2", + "section_name": "Архитектура авторизации", + "req_id": "V8.2.1", + "req_description": "Убедитесь, что приложение обеспечивает доступ на уровне функций (function-level) только субъектам с явными разрешениями.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.2", + "section_name": "Архитектура авторизации", + "req_id": "V8.2.2", + "req_description": "Убедитесь, что приложение обеспечивает доступ на уровне данных (data-specific) только тем субъектам, которым явно предоставлены права к определённым элементам данных, чтобы предотвратить IDOR (Insecure Direct Object Reference) и BOLA-уязвимости (Broken Object Level Authorization).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.2", + "section_name": "Архитектура авторизации", + "req_id": "V8.2.3", + "req_description": "Убедитесь, что приложение обеспечивает доступ на уровне полей (field-level) только тем субъектам, которым явно предоставлены права к определённым полям, чтобы предотвратить BOPLA (Broken Object Property Level Authorization).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.2", + "section_name": "Архитектура авторизации", + "req_id": "V8.2.4", + "req_description": "Убедитесь, что реализованы адаптивные меры безопасности, основанные на атрибутах окружения и контекста субъекта (время, местоположение, IP, устройство), которые используются для принятия решений об аутентификации и авторизации, как это определено в документации приложения. Эти меры должны применяться как при попытке субъекта начать новую сессию, так и во время существующей сессии.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.3", + "section_name": "Авторизация на уровне операций", + "req_id": "V8.3.1", + "req_description": "Убедитесь, что правила авторизации реализуются на доверенном сервисном уровне и не зависят от элементов, которые может контролировать клиент (например, JavaScript на стороне клиента).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.3", + "section_name": "Авторизация на уровне операций", + "req_id": "V8.3.2", + "req_description": "Убедитесь, что изменения значений, влияющих на авторизацию, применяются немедленно. Если это невозможно (например, при использовании автономных токенов), должны быть реализованы компенсирующие меры: оповещения о попытке несанкционированного действия и откат изменений. Обратите внимание, что данный подход не предотвращает утечку информации.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.3", + "section_name": "Авторизация на уровне операций", + "req_id": "V8.3.3", + "req_description": "Убедитесь, что доступ к объекту осуществляется на основе прав субъекта, инициировавшего запрос, а не прав промежуточного сервиса, действующего от его имени. Например, если пользователь обращается к веб-сервису с автономным токеном для аутентификации, а сервис затем запрашивает данные у другого сервиса, второй сервис должен использовать токен пользователя, а не токен первого сервиса для принятия решения о доступе.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.4", + "section_name": "Прочие аспекты авторизации", + "req_id": "V8.4.1", + "req_description": "Убедитесь, что в мультитенантных приложениях реализованы механизмы, предотвращающие действия потребителя в отношении арендаторов, к которым у него нет доступа.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.4", + "section_name": "Прочие аспекты авторизации", + "req_id": "V8.4.2", + "req_description": "Убедитесь, что доступ к административным интерфейсам защищён несколькими уровнями контроля, включая непрерывную проверку личности, контроль защищённости устройства и анализ контекстных рисков. Недостаточно опираться только на IP-адрес или доверенные устройства.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Автономные токены", + "section_id": "V9.1", + "section_name": "Источник токена и его целостность", + "req_id": "V9.1.1", + "req_description": "Убедитесь, что автономные токены проверяются на целостность с помощью цифровой подписи или MAC, прежде чем доверять их содержимому.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Автономные токены", + "section_id": "V9.1", + "section_name": "Источник токена и его целостность", + "req_id": "V9.1.2", + "req_description": "Проверяйте, что автономные токены создаются и проверяются исключительно с помощью алгоритмов из списка допустимых в данном контексте. Список допустимых алгоритмов должен включать только разрешенные алгоритмы (желательно либо только симметричные, либо только асимметричные) и ни в коем случае не содержать алгоритм None. Если необходимо поддерживать оба типа алгоритмов, потребуются дополнительные средства контроля для предотвращения путаницы с ключами (key confusion).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Автономные токены", + "section_id": "V9.1", + "section_name": "Источник токена и его целостность", + "req_id": "V9.1.3", + "req_description": "Убедитесь, что ключи, используемые для проверки автономных токенов, получены из доверенных, предварительно настроенных источников. Это предотвращает возможность указания злоумышленниками ненадёжных источников и ключей. Для JWT и других JWS структур заголовки 'jku', 'x5u' и 'jwk' должны проверяться по белому списку.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Автономные токены", + "section_id": "V9.2", + "section_name": "Содержимое токена", + "req_id": "V9.2.1", + "req_description": "Убедитесь, что при указанном сроке действия токен и его содержимое принимаются только в том случае, если срок действия токена не истёк. Например, для JWT нужно проверить поля 'nbf' и 'exp'.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Автономные токены", + "section_id": "V9.2", + "section_name": "Содержимое токена", + "req_id": "V9.2.2", + "req_description": "Убедитесь, что сервис, принимающий токен, проверяет его тип и соответствие назначению перед обработкой содержимого токена. Например, для принятия решений об авторизации могут быть приняты только Access Token, а для подтверждения аутентификации пользователя — только ID Token.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Автономные токены", + "section_id": "V9.2", + "section_name": "Содержимое токена", + "req_id": "V9.2.3", + "req_description": "Убедитесь, что сервис принимает только токены, предназначенные для использования с этим сервисом (audience). Для JWT это можно сделать, проверив наличие утверждения «aud» по белому списку, определенному в сервисе.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Автономные токены", + "section_id": "V9.2", + "section_name": "Содержимое токена", + "req_id": "V9.2.4", + "req_description": "Убедитесь, что, если эмитент токенов использует один и тот же закрытый ключ для выпуска токенов различным сервисам (audiences), выпущенные токены содержат явное указание целевых сервисов. Это предотвратит повторное использования токенов в не предназначенных для них сервисах. Если идентификатор сервиса (audience identifier) назначается динамически, эмитент токенов должен проверить audiences для исключения подмены получателей (audience impersonation).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.1", + "section_name": "Общие требования безопасности OAuth и OIDC", + "req_id": "V10.1.1", + "req_description": "Убедитесь, что токены передаются только тем компонентам, которым они действительно необходимы. Например, при использовании схемы backend-for-frontend для браузерных JavaScript-приложений, access и refresh токены должны быть доступны только на backend.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.1", + "section_name": "Общие требования безопасности OAuth и OIDC", + "req_id": "V10.1.2", + "req_description": "Убедитесь, что клиент принимает значения от авторизационного сервера (например, authorization code или ID Token) только если они получены в результате авторизационного потока, инициированного в той же сессии пользовательского агента и в рамках той же транзакции. Для этого клиентские секреты, такие как proof key для code exchange (PKCE) — 'code_verifier', 'state' или OIDC 'nonce' — должны быть непредсказуемыми, специфичными для транзакции и надежно привязанными как к клиенту, так и к сессии пользовательского агента, в которой началась транзакция.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.2", + "section_name": "Клиент OAuth", + "req_id": "V10.2.1", + "req_description": "Убедитесь, что если используется механизм authorization code flow, OAuth клиент защищён от CSRF, вызывающих запросы токенов либо за счёт использования механизма proof key for code exchange (PKCE), либо за счёт проверки параметра 'state', который был отправлен в запросе авторизации.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.2", + "section_name": "Клиент OAuth", + "req_id": "V10.2.2", + "req_description": "Убедитесь, что если OAuth клиент может взаимодействовать с более чем одним сервером авторизации, у него есть защита от атак смешивания (mix-up attacks). Например, клиент должен требовать, чтобы сервер авторизации возвращал параметр 'iss' и проверять его в ответах на авторизацию и токены.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.2", + "section_name": "Клиент OAuth", + "req_id": "V10.2.3", + "req_description": "Убедитесь, что OAuth клиент запрашивает только необходимые области доступа (scopes) или другие параметры авторизации в запросах к серверу авторизации.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.3", + "section_name": "Сервер ресурсов OAuth", + "req_id": "V10.3.1", + "req_description": "Убедитесь, что сервер ресурсов принимает только те access токены, которые предназначены для использования с этим сервисом (свойство audience). Эта принадлежность сервису может быть включена в структурированный access токен (например, в поле 'aud' в JWT) или проверяться через endpoint интроспекции токена.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.3", + "section_name": "Сервер ресурсов OAuth", + "req_id": "V10.3.2", + "req_description": "Убедитесь, что сервер ресурсов принимает решения по авторизации на основе claims из access токена, определяющих делегированную авторизацию. Если присутствуют claims, такие как 'sub', 'scope' и 'authorization_details', они должны участвовать в принятии решения.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.3", + "section_name": "Сервер ресурсов OAuth", + "req_id": "V10.3.3", + "req_description": "Убедитесь, что если для принятия решения по контролю доступа необходимо однозначно идентифицировать пользователя из access токена (JWT или ответа интроспекции), сервер ресурсов использует claims, которые не могут быть переприсвоены другим пользователям. Обычно это комбинация claims 'iss' и 'sub'.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.3", + "section_name": "Сервер ресурсов OAuth", + "req_id": "V10.3.4", + "req_description": "Убедитесь, что если сервер ресурсов требует определённой силы аутентификации, методов или свежести аутентификации, он проверяет, что предъявленный access токен удовлетворяет этим требованиям. Например, при наличии, могут использоваться claims OIDC 'acr', 'amr' и 'auth_time'.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.3", + "section_name": "Сервер ресурсов OAuth", + "req_id": "V10.3.5", + "req_description": "Убедитесь, что сервер ресурсов предотвращает использование украденных access токенов или их повторное использование (replay) неавторизованными лицами, требуя access токены с подтверждением отправителя — например, Mutual TLS для OAuth 2 или OAuth 2 Demonstration of Proof of Possession (DPoP).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.1", + "req_description": "Убедитесь, что сервер авторизации проверяет URI перенаправления (redirect URI), сверяя его с заранее зарегистрированным списком разрешённых URI для данного клиента (allowlist), используя точное сравнение строк.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.2", + "req_description": "Убедитесь, что если сервер авторизации возвращает authorization code в ответе авторизации, этот код может быть использован только один раз для запроса токена. При втором валидном запросе с уже использованным кодом сервер должен отклонить запрос и отозвать любые токены, связанные с этим кодом.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.3", + "req_description": "Убедитесь, что authorization code имеет короткое время жизни. Максимальная продолжительность — до 10 минут для приложений L1 и L2 и до 1 минуты для приложений L3.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.4", + "req_description": "Убедитесь, что сервер авторизации для конкретного клиента разрешает использование только тех типов авторизации, которые необходимы этому клиенту. Обратите внимание, что тип авторизации Implicit flow и Resource Owner Password Credentials flow больше не должны использоваться.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.5", + "req_description": "Убедитесь, что сервер авторизации предотвращает атаки повторного использования refresh токенов для публичных клиентов, предпочтительно используя sender-constrained refresh токены, такие как DPoP или сертификат-связанные токены с mutual TLS (mTLS). Для L1 и L2 допускается ротация refresh токенов с обязательной их инвалидацией после использования. Если используется ротация, сервер должен отозвать все refresh токены при попытке использовать уже инвалидированный токен.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.6", + "req_description": "Убедитесь, что при использовании типа авторизации «Authorization Code» сервер предотвращает атаки перехвата authorization code, требуя Proof Key for Code Exchange (PKCE). В запросах авторизации сервер должен требовать валидное значение 'code_challenge' и не принимать 'code_challenge_method' со значением 'plain'. В запросах токена обязательно валидировать параметр 'code_verifier'.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.7", + "req_description": "Убедитесь, что если сервер авторизации поддерживает динамическую регистрацию клиентов без аутентификации, он минимизирует риски вредоносных клиентов. Сервер должен валидировать метаданные клиента (например, зарегистрированные URI), обеспечивать согласие пользователя и предупреждать пользователя перед обработкой запроса авторизации от недоверенного клиента.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.8", + "req_description": "Убедитесь, что refresh токены имеют абсолютный срок действия, включая случаи, когда применяется скользящее время истечения срока.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.9", + "req_description": "Убедитесь, что пользователи могут отзывать refresh токены и reference access токены через пользовательский интерфейс сервера авторизации для снижения риска от вредоносных клиентов или кражи токенов.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.10", + "req_description": "Убедитесь, что конфиденциальный клиент аутентифицируется при взаимодействии с сервером авторизации через backchannel, например при запросах токена, pushed authorization requests (PAR) и запросах на отзыв токенов.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.11", + "req_description": "Убедитесь, что конфигурация сервера авторизации назначает OAuth клиенту только необходимые области доступа (scopes).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.12", + "req_description": "Убедитесь, что для конкретного клиента сервер авторизации разрешает только те значения 'response_mode', которые необходимы этому клиенту. Например, сервер должен валидировать это значение против ожидаемых или использовать pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.13", + "req_description": "Убедитесь, что грант типа 'code' всегда используется вместе с pushed authorization requests (PAR).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.14", + "req_description": "Убедитесь, что сервер авторизации выдаёт только sender-constrained (Proof-of-Possession) access токены, либо с сертификат-связанными токенами через mutual TLS (mTLS), либо DPoP-bound токены (Demonstration of Proof of Possession).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.15", + "req_description": "Убедитесь, что для серверного клиента (не выполняющегося на устройстве конечного пользователя) сервер авторизации проверяет, что значение параметра 'authorization_details' исходит из клиентского backend и что пользователь не изменял его. Например, это достигается использованием pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.16", + "req_description": "Убедитесь, что клиент является конфиденциальным и сервер авторизации требует использования сильных методов аутентификации клиента (основанных на криптографии с открытым ключом и устойчивых к атакам повторного воспроизведения), таких как mutual TLS ('tls_client_auth', 'self_signed_tls_client_auth') или private key JWT ('private_key_jwt').", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.5", + "section_name": "Клиент OIDC", + "req_id": "V10.5.1", + "req_description": "Убедитесь, что клиент (relying party) защищается от повторного использования ID Token (replay-атак). Например, это достигается проверкой того, что значение 'nonce' в ID Token совпадает со значением 'nonce', отправленным в запросе аутентификации провайдеру OpenID (authorization server).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.5", + "section_name": "Клиент OIDC", + "req_id": "V10.5.2", + "req_description": "Убедитесь, что клиент однозначно идентифицирует пользователя по утверждениям (claims) ID Token, обычно это 'sub', который не может быть переназначен другому пользователю (в пределах конкретного провайдера идентификации).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.5", + "section_name": "Клиент OIDC", + "req_id": "V10.5.3", + "req_description": "Убедитесь, что клиент отклоняет попытки злоумышленного сервера авторизации выдавать себя за другой сервер авторизации через метаданные сервера авторизации. Клиент должен отклонить метаданные, если URL издателя (issuer) в метаданных не совпадает точно с преднастроенным URL издателя, ожидаемым клиентом.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.5", + "section_name": "Клиент OIDC", + "req_id": "V10.5.4", + "req_description": "Убедитесь, что клиент проверяет, что ID Token предназначен для него (проверка audience), сравнивая значение 'aud' в токене с 'client_id' клиента.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.5", + "section_name": "Клиент OIDC", + "req_id": "V10.5.5", + "req_description": "Убедитесь, что при использовании OIDC back-channel logout клиент снижает риск отказа в обслуживании, вызванный принудительным выходом из системы и путаницей между разными типами JWT (cross-JWT confusion) в процессе логаута. Клиент должен проверить, что токен выхода корректно типизирован со значением 'logout+jwt', содержит claim 'event' с правильным именем участника и не содержит 'nonce'. Также рекомендуется установить короткий срок действия токена (например, 2 минуты).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.6", + "section_name": "Провайдер OpenID", + "req_id": "V10.6.1", + "req_description": "Убедитесь, что провайдер OpenID допускает только значения 'code', 'ciba', 'id_token' или 'id_token code' для параметра response mode. При этом предпочтение отдаётся 'code' по сравнению с 'id_token code' (гибридный поток OIDC), а значение 'token' (любой Implicit flow) не должно использоваться.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.6", + "section_name": "Провайдер OpenID", + "req_id": "V10.6.2", + "req_description": "Убедитесь, что провайдер OpenID предотвращает отказ в обслуживании (DoS) через принудительный выход (logout), запрашивая явное подтверждение от конечного пользователя или, если применимо, проверяя параметры в запросе выхода (инициированном relying party), например параметр 'id_token_hint'.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.7", + "section_name": "Управление согласием", + "req_id": "V10.7.1", + "req_description": "Убедитесь, что авторизационный сервер обеспечивает получение согласия пользователя для каждого запроса авторизации. Если личность клиента не может быть подтверждена, сервер авторизации всегда должен явно запрашивать согласие пользователя.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.7", + "section_name": "Управление согласием", + "req_id": "V10.7.2", + "req_description": "Убедитесь, что при запросе согласия пользователя авторизационный сервер предоставляет достаточную и понятную информацию о том, на что даётся согласие. При необходимости это должно включать характер запрашиваемых разрешений (обычно основанных на scope, ресурсном сервере, деталях авторизации Rich Authorization Requests (RAR)), идентификацию авторизованного приложения и срок действия этих разрешений.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.7", + "section_name": "Управление согласием", + "req_id": "V10.7.3", + "req_description": "Убедитесь, что пользователь может просматривать, изменять и отзывать согласия, которые он предоставил, через авторизационный сервер.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.1", + "section_name": "Инвентаризация и документирование криптографии", + "req_id": "V11.1.1", + "req_description": "Убедитесь, что задокументирована политика управления криптографическими ключами и описан их жизненный цикл в соответствии со стандартом управления ключей, таким как NIST SP 800-57. Убедитесь, что ключи известны только тем сущностям, которым они должны быть доступны (например, ключи не передавались более чем двум участникам для общих секретов и более чем одному участнику для приватных ключей).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.1", + "section_name": "Инвентаризация и документирование криптографии", + "req_id": "V11.1.2", + "req_description": "Убедитесь, что проводится инвентаризация криптографических средств, которая непрерывно поддерживается, регулярно обновляется и включает все криптографические ключи, алгоритмы и сертификаты, используемые в приложении. Также должна быть задокументирована информация о том, где ключи могут и не могут использоваться в системе, а также какие типы данных могут и не могут быть защищены с помощью этих ключей.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.1", + "section_name": "Инвентаризация и документирование криптографии", + "req_id": "V11.1.3", + "req_description": "Убедитесь, что используются механизмы обнаружения криптографии для идентификации всех случаев применения криптографии в системе , включая операции шифрования, хеширования и цифровой подписи.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.1", + "section_name": "Инвентаризация и документирование криптографии", + "req_id": "V11.1.4", + "req_description": "Убедитесь, что ведётся и поддерживается инвентаризация криптографических средств. В неё должен входить документированный план, описывающий переход на новые криптографические стандарты, такие как постквантовая криптография, чтобы своевременно реагировать на будущие угрозы.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.2", + "section_name": "Безопасная реализация криптографии", + "req_id": "V11.2.1", + "req_description": "Убедитесь, что для криптографических операций используются утвержденные в индустрии реализации (включая библиотеки и аппаратные реализации).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.2", + "section_name": "Безопасная реализация криптографии", + "req_id": "V11.2.2", + "req_description": "Убедитесь, что архитектура приложения поддерживает быструю реконфигурацию, усовершенствование или смену в любой момент случайных чисел, аутентифицированного шифрования, MAC, алгоритмов хеширования, длин ключей, количества раундов, шифров и режимов шифрования для защиты от криптографических атак. Также должна поддерживаться возможность смены ключей, паролей и повторного шифрования данных. Это позволит беспрепятственно перейти на постквантовую криптографию (PQC), как только станут широко доступны высоконадёжные реализации одобренных схем или стандартов PQC.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.2", + "section_name": "Безопасная реализация криптографии", + "req_id": "V11.2.3", + "req_description": "Убедитесь, что все криптографические примитивы используют как минимум 128-бит стойкости с учетом алгоритма, размера ключа и конфигурации. Например, 256-битный ECC ключ обеспечивает примерно 128 бит безопасности, тогда как для достижения того же уровня безопасности в RSA требуется ключ длиной 3072 бита.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.2", + "section_name": "Безопасная реализация криптографии", + "req_id": "V11.2.4", + "req_description": "Убедитесь, что все криптографические операции выполняются за константное время, без использования «short-circuit» операций в сравнениях, вычислениях, возвратах функций для избежания утечек информации.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.2", + "section_name": "Безопасная реализация криптографии", + "req_id": "V11.2.5", + "req_description": "Убедитесь, что все криптографические модули обеспечивают безопасное завершение работы при ошибках, а обработка ошибок реализована таким образом, чтобы не создавать уязвимостей, например, таких как атаки Padding Oracle.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.3", + "section_name": "Алгоритмы шифрования", + "req_id": "V11.3.1", + "req_description": "Убедитесь, что не используются небезопасные режимы блочного шифрования (н-р, ECB) и слабые схемы дополнения (padding) (н-р, PKCS#1 v1.5).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.3", + "section_name": "Алгоритмы шифрования", + "req_id": "V11.3.2", + "req_description": "Убедитесь, что используются только утверждённые шифры и режимы, такие как AES с GCM.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.3", + "section_name": "Алгоритмы шифрования", + "req_id": "V11.3.3", + "req_description": "Убедитесь, что зашифрованные данные защищены от несанкционированного изменения, предпочтительно с использованием утверждённого метода аутентифицированного шифрования или путём комбинирования утверждённого метода шифрования с утверждённым алгоритмом MAC.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.3", + "section_name": "Алгоритмы шифрования", + "req_id": "V11.3.4", + "req_description": "Убедитесь, что случайные числа (nonce), векторы инициализации (IV) и другие одноразовые числа не используются более одного раза для одной и той же пары ключа шифрования и элемента данных. Метод их генерации должен соответствовать требованиям используемого алгоритма.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.3", + "section_name": "Алгоритмы шифрования", + "req_id": "V11.3.5", + "req_description": "Убедитесь, что любая комбинация алгоритма шифрования и алгоритма MAC работает в режиме encrypt-then-MAC (EtM).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.4", + "section_name": "Хеширование и функции на основе хеширования", + "req_id": "V11.4.1", + "req_description": "Убедитесь, что только утвержденные хэш-функции используются для стандартных сценариев использования в криптографии, включая цифровую подпись, HMAC, KDF, генерацию случайных чисел. Запрещено использовать неустойчивые хэш-функции, (н-р, MD5) для любого использования в криптографии.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.4", + "section_name": "Хеширование и функции на основе хеширования", + "req_id": "V11.4.2", + "req_description": "Убедитесь, что пароли хранятся с использованием утверждённой, вычислительно затратной функции генерации ключа (также известной как «функция хеширования паролей»), с параметрами, настроенными в соответствии с актуальными рекомендациями. Настройки должны обеспечивать баланс между безопасностью и производительностью, чтобы сделать атаки перебором достаточно сложными для требуемого уровня безопасности.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.4", + "section_name": "Хеширование и функции на основе хеширования", + "req_id": "V11.4.3", + "req_description": "Убедитесь, что хэш-функции, используемые в формировании цифровой подписи, как часть аутентификации и целостности данных, устойчивы к коллизиям и имеют достаточную длину.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.4", + "section_name": "Хеширование и функции на основе хеширования", + "req_id": "V11.4.4", + "req_description": "Убедитесь, что приложение использует утвержденную функцию генерации ключа с использованием параметров расширения ключа (key stretching) при генерации ключа из пароля. Параметры должны быть сбалансированы с точки зрения безопасности, производительности и устойчивости к атакам полного перебора при компрометации результирующего криптографического ключа.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.5", + "section_name": "Случайные значения", + "req_id": "V11.5.1", + "req_description": "Убедитесь, что все случайные числа и строки, которые должны быть непредсказуемы, должны быть сгенерированы с помощью CSPRNG и иметь хотя бы 128 бит энтропии. Учтите, что UUID не удовлетворяют данному условию.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.5", + "section_name": "Случайные значения", + "req_id": "V11.5.2", + "req_description": "Убедитесь, что механизм генерации случайных чисел является надежным даже при высокой нагрузке.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.6", + "section_name": "Криптография с публичным ключом", + "req_id": "V11.6.1", + "req_description": "Убедитесь, что только утвержденные криптографические алгоритмы и режимы операций используются для генерации ключа и инициализации случайного значения для его генерации (seeding), а также для генерации цифровой подписи и верификации. Алгоритмы генерации ключей не должны генерировать небезопасные ключи уязвимые к известным атакам, например, ключи RSA уязвимы к факторизации Ферма.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.6", + "section_name": "Криптография с публичным ключом", + "req_id": "V11.6.2", + "req_description": "Убедитесь, что для обмена ключами используются утверждённые криптографические алгоритмы (например, Диффи-Хеллман) с особым вниманием к обеспечению использования безопасных параметров. Это предотвратит атаки на процесс установления ключа, которые могут привести к атакам «человек посередине» или криптографическим взломам.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.7", + "section_name": "Шифрование данных в процессе использования", + "req_id": "V11.7.1", + "req_description": "Убедитесь, что используется полное шифрование памяти, которое защищает конфиденциальные данные во время их использования, предотвращая доступ к ним неавторизованных пользователей или процессов.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.7", + "section_name": "Шифрование данных в процессе использования", + "req_id": "V11.7.2", + "req_description": "Убедитесь, что минимизация данных обеспечивает раскрытие минимально необходимого объёма данных во время обработки, а также что данные шифруются сразу после использования или как можно скорее.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.1", + "section_name": "Общие рекомендации по безопасности TLS", + "req_id": "V12.1.1", + "req_description": "Убедитесь, что включены только актуальные и рекомендуемые версии протокола TLS, такие как TLS 1.2 и TLS 1.3. Наиболее свежая версия TLS должна быть выбрана как предпочтительная.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.1", + "section_name": "Общие рекомендации по безопасности TLS", + "req_id": "V12.1.2", + "req_description": "Убедитесь, что включены рекомендуемые шифронаборы (cipher suites), предпочтение также стоит отдать самому сильному шифронабору. L3 приложения должны поддерживать только те наборы шифров (cipher suites), которые обеспечивают прямую (forward) секретность. Пояснение: Прямая секретность (Forward Secrecy, FS) — это криптографическая особенность, при которой сессионные ключи уникальны для каждой сессии и не зависят от долгосрочных ключей. Это гарантирует, что даже при компрометации долгосрочного ключа злоумышленник не сможет расшифровать ранее перехваченные зашифрованные сессии.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.1", + "section_name": "Общие рекомендации по безопасности TLS", + "req_id": "V12.1.3", + "req_description": "Убедитесь, что приложение проверяет доверенность клиентских сертификатов mTLS, прежде чем использовать идентификацию по сертификату для аутентификации или авторизации.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.1", + "section_name": "Общие рекомендации по безопасности TLS", + "req_id": "V12.1.4", + "req_description": "Убедитесь, что включена и настроена правильная проверка отзыва сертификатов, такая как Online Certificate Status Protocol (OCSP) Stapling.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.1", + "section_name": "Общие рекомендации по безопасности TLS", + "req_id": "V12.1.5", + "req_description": "Убедитесь, что в настройках TLS приложения включена функция Encrypted Client Hello (ECH) для предотвращения раскрытия конфиденциальных метаданных, таких как Server Name Indication (SNI), во время процесса TLS-рукопожатия.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.2", + "section_name": "HTTPS коммуникация с внешними сервисами", + "req_id": "V12.2.1", + "req_description": "Убедитесь, что для всех соединений между клиентом и внешними HTTP-сервисами используется TLS и не происходит отката к небезопасным или незашифрованным протоколам.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.2", + "section_name": "HTTPS коммуникация с внешними сервисами", + "req_id": "V12.2.2", + "req_description": "Убедитесь, что внешние сервисы используют публично доверенные TLS-сертификаты.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.3", + "section_name": "Общая безопасность межсервисного взаимодействия", + "req_id": "V12.3.1", + "req_description": "Убедитесь, что для всех входящих и исходящих соединений приложения используется зашифрованный протокол, например TLS, включая системы мониторинга, инструменты управления, удалённый доступ и SSH, промежуточное ПО, базы данных, мейнфреймы, партнёрские системы и внешние API. Сервер не должен допускать откат к небезопасным или незашифрованным протоколам.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.3", + "section_name": "Общая безопасность межсервисного взаимодействия", + "req_id": "V12.3.2", + "req_description": "Убедитесь, что TLS-клиент проверяет сертификат сервера до установления защищенного соединения с TLS-сервером.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.3", + "section_name": "Общая безопасность межсервисного взаимодействия", + "req_id": "V12.3.3", + "req_description": "Убедитесь, что все внутренние HTTP-взаимодействия между компонентами приложения используют TLS или другой подходящий механизм транспортного шифрования, и не происходит откат к небезопасным или незашифрованным коммуникациям.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.3", + "section_name": "Общая безопасность межсервисного взаимодействия", + "req_id": "V12.3.4", + "req_description": "Убедитесь, что TLS-соединения между внутренними сервисами используют доверенные сертификаты. Если используются внутренние или самоподписанные сертификаты, потребляющий сервис должен быть настроен на доверие только к конкретным внутренним центрам сертификации (CA) и конкретным самоподписанным сертификатам.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.3", + "section_name": "Общая безопасность межсервисного взаимодействия", + "req_id": "V12.3.5", + "req_description": "Убедитесь, что сервисы, взаимодействующие внутри системы (intra-service communications), используют строгую аутентификацию для проверки каждого конечного узла. Для проверки подлинности взаимодействующих сторон должны применяться методы строгой аутентификации, такие как аутентификация TLS-клиента, с использованием инфраструктуры открытых ключей и механизмов, устойчивых к атакам повтора (replay attacks). Для микросервисных архитектур рекомендуется использование service mesh для упрощения управления сертификатами и повышения безопасности.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.1", + "section_name": "Документация конфигурации", + "req_id": "V13.1.1", + "req_description": "Убедитесь, что все необходимые доступы приложения задокументированы. Сюда должны быть включены как внешние сервисы, от которых зависит приложение, так и сценарии, когда конечный пользователь может задавать адреса для внешнего подключения.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.1", + "section_name": "Документация конфигурации", + "req_id": "V13.1.2", + "req_description": "Убедитесь, что для каждого сервиса, используемого приложением, в документации определено максимальное количество одновременных соединений (например, лимиты пула соединений) и описано поведение приложения при достижении этого лимита, включая любые механизмы отказоустойчивости или восстановления, чтобы предотвратить ситуации отказа в обслуживании (DoS).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.1", + "section_name": "Документация конфигурации", + "req_id": "V13.1.3", + "req_description": "Убедитесь, что в документации приложения определены стратегии управления ресурсами для каждой внешней системы или сервиса, которые оно использует (например, базы данных, файловые дескрипторы, потоки, HTTP-соединения). Стратегии должны включать процедуры освобождения ресурсов, настройки таймаутов, обработку сбоев, а также, если реализована логика повторных попыток, указание лимитов, задержек и алгоритмов back-off. Для синхронных HTTP-запросов должны быть заданы короткие таймауты, а повторные запросы должны быть отключены, либо строго ограничены по числу попыток, чтобы предотвратить каскадные задержки и истощение ресурсов.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.1", + "section_name": "Документация конфигурации", + "req_id": "V13.1.4", + "req_description": "Убедитесь, что в документации приложения определены секреты, критически важные для безопасности приложения, а также установлен график их ротации в соответствии с моделью угроз организации и её бизнес-требованиями.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.2", + "section_name": "Конфигурация бэкенд соединений", + "req_id": "V13.2.1", + "req_description": "Убедитесь, что коммуникации между компонентами бэкенда приложения (включая API, промежуточное ПО и уровни данных), которые не поддерживают стандартный механизм пользовательских сессий, проходят с аутентификацией. Аутентификация должна использовать индивидуальные сервисные аккаунты, краткосрочные токены или аутентификацию на основе сертификатов, а не постоянные учётные данные, такие как пароли, API-ключи или общие аккаунты с привилегированным доступом.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.2", + "section_name": "Конфигурация бэкенд соединений", + "req_id": "V13.2.2", + "req_description": "Убедитесь, что коммуникации между компонентами бэкенда приложения, включая локальные или системные службы, API, промежуточное ПО и уровни данных, выполняются с использованием аккаунтов, которым назначены минимально необходимые привилегии.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.2", + "section_name": "Конфигурация бэкенд соединений", + "req_id": "V13.2.3", + "req_description": "Убедитесь, что если для аутентификации в сервисе используются учётные данные, то используемые потребителем учётные данные не являются стандартными (например, root/root или admin/admin).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.2", + "section_name": "Конфигурация бэкенд соединений", + "req_id": "V13.2.4", + "req_description": "Убедитесь, что используется белый список (allowlist) для определения внешних ресурсов или систем, с которыми приложению разрешено взаимодействовать (например, для исходящих запросов, загрузки данных или доступа к файлам). Этот белый список может быть реализован на уровне приложения, веб-сервера, межсетевого экрана или комбинации различных уровней.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.2", + "section_name": "Конфигурация бэкенд соединений", + "req_id": "V13.2.5", + "req_description": "Убедитесь, что веб- или прикладной сервер настроен с белым списком ресурсов или систем, к которым сервер может отправлять запросы или из которых может загружать данные и файлы.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.2", + "section_name": "Конфигурация бэкенд соединений", + "req_id": "V13.2.6", + "req_description": "Убедитесь, что при подключении приложения к другим сервисам соблюдается задокументированная конфигурация для каждого соединения, включая максимальное количество параллельных соединений, поведение при достижении их максимума, таймауты и стратегии повторных попыток подключения.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.3", + "section_name": "Управление секретами", + "req_id": "V13.3.1", + "req_description": "Убедитесь, что для безопасного создания, хранения, контроля доступа и уничтожения секретов бэкенда используется решение для управления секретами, например, хранилище ключей (key vault). Секретами могут быть пароли, ключевой материал, интеграции с базами данных и сторонними системами, ключи и seed-значения для токенов с ограниченным временем действия, другие внутренние секреты и API-ключи. Секреты не должны включаться в исходный код приложения или артефакты сборки. Для приложений уровня L3 необходимо использовать аппаратное решение, например, аппаратный модуль безопасности (HSM).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.3", + "section_name": "Управление секретами", + "req_id": "V13.3.2", + "req_description": "Убедитесь, что доступ к секретным ресурсам осуществляется в соответствии с принципом минимально необходимых привилегий (least privilege).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.3", + "section_name": "Управление секретами", + "req_id": "V13.3.3", + "req_description": "Убедитесь, что все криптографические операции выполняются с использованием изолированного модуля безопасности (например, хранилища ключей или аппаратного модуля безопасности), чтобы надежно управлять ключевым материалом и защищать его от утечки за пределы модуля безопасности.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.3", + "section_name": "Управление секретами", + "req_id": "V13.3.4", + "req_description": "Убедитесь, что секреты настроены на срок действия и ротацию в соответствии с документацией приложения.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.4", + "section_name": "Непреднамеренная утечка информации", + "req_id": "V13.4.1", + "req_description": "Убедитесь, что приложение развернуто либо без метаданных систем контроля версий (включая папки .git или .svn), либо так, чтобы эти папки были недоступны как извне, так и для самого приложения.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.4", + "section_name": "Непреднамеренная утечка информации", + "req_id": "V13.4.2", + "req_description": "Убедитесь, что режимы отладки отключены для всех компонентов в промышленной среде, чтобы предотвратить раскрытие функций отладки и утечку информации.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.4", + "section_name": "Непреднамеренная утечка информации", + "req_id": "V13.4.3", + "req_description": "Убедитесь, что веб-серверы не показывают клиентам списки содержимого каталогов, если это явно не предусмотрено.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.4", + "section_name": "Непреднамеренная утечка информации", + "req_id": "V13.4.4", + "req_description": "Убедитесь, что метод HTTP TRACE не поддерживается в продуктовой среде, чтобы избежать потенциальной утечки информации.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.4", + "section_name": "Непреднамеренная утечка информации", + "req_id": "V13.4.5", + "req_description": "Убедитесь, что документация (например, по внутренним API) и мониторинговые эндпоинты не доступны, если это явно не предусмотрено.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.4", + "section_name": "Непреднамеренная утечка информации", + "req_id": "V13.4.6", + "req_description": "Убедитесь, что приложение не раскрывает подробную информацию о версиях компонентов бэкенда.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.4", + "section_name": "Непреднамеренная утечка информации", + "req_id": "V13.4.7", + "req_description": "Убедитесь, что веб-слой настроен на обслуживание только файлов с определёнными расширениями, чтобы предотвратить непреднамеренную утечку информации, конфигураций и исходного кода.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.1", + "section_name": "Документация по защите информации", + "req_id": "V14.1.1", + "req_description": "Убедитесь, что все конфиденциальные данные, создаваемые и обрабатываемые приложением, идентифицированы и классифицированы по уровням защиты. Включая закодированные данные, которые легко декодируются, например, строки Base64 или незашифрованные данные в полезной нагрузке JWT. Уровни защиты должны учитывать требования по защите данных и конфиденциальности, которым должно соответствовать приложение.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.1", + "section_name": "Документация по защите информации", + "req_id": "V14.1.2", + "req_description": "Убедитесь, что для каждого уровня защиты конфиденциальных данных требования к защите задокументированы. Они должны включать (но не ограничиваться) требования по шифрованию, проверке целостности, срокам хранения, способам логирования данных, контролю доступа к чувствительным данным в логах, шифрованию на уровне базы данных, применению технологий повышения конфиденциальности, а также другим требованиям по конфиденциальности.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.2", + "section_name": "Базовые меры по защите информации", + "req_id": "V14.2.1", + "req_description": "Убедитесь, что конфиденциальные данные передаются на сервер только в теле HTTP-запроса или в заголовках. URL и строка запроса не должны содержать конфиденциальную информацию, такую как API-ключ или сессионный токен.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.2", + "section_name": "Базовые меры по защите информации", + "req_id": "V14.2.2", + "req_description": "Убедитесь, что приложение предотвращает кэширование конфиденциальных данных в серверных компонентах, таких как балансировщики нагрузки и кэши приложений, либо гарантирует их надежное удаление после использования.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.2", + "section_name": "Базовые меры по защите информации", + "req_id": "V14.2.3", + "req_description": "Убедитесь, что заранее определённые конфиденциальные данные не отправляются ненадёжным сторонам (например, системам трекинга пользователей), чтобы предотвратить нежелательный сбор данных вне контроля приложения.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.2", + "section_name": "Базовые меры по защите информации", + "req_id": "V14.2.4", + "req_description": "Убедитесь, что для конфиденциальных данных реализованы меры по шифрованию, проверке целостности, срокам хранения, способам логирования, контролю доступа к данным в логах, а также применяются технологии повышения конфиденциальности в соответствии с документацией для соответствующего уровня защиты данных.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.2", + "section_name": "Базовые меры по защите информации", + "req_id": "V14.2.5", + "req_description": "Убедитесь, что механизмы кэширования настроены так, чтобы кэшировать только ответы с ожидаемым типом содержимого для данного ресурса и не содержать конфиденциального динамического контента. При обращении к несуществующему файлу, веб-сервер должен возвращать ответ 404 или 302, а не подменять на другой существующий файл, что позволит предотвратить атаки типа Web Cache Deception.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.2", + "section_name": "Базовые меры по защите информации", + "req_id": "V14.2.6", + "req_description": "Убедитесь, что приложение возвращает только минимально необходимый объем конфиденциальных данных для выполнения своей функциональности. Например, показывает только часть цифр номера кредитной карты, а не полный номер. Если требуется отображение полных данных, они должны быть замаскированы в пользовательском интерфейсе, пока пользователь специально не запросил их просмотр.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.2", + "section_name": "Базовые меры по защите информации", + "req_id": "V14.2.7", + "req_description": "Убедитесь, что конфиденциальная информация подлежит классификации по срокам хранения, чтобы устаревшие или ненужные данные удалялись автоматически, по расписанию или по мере необходимости.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.2", + "section_name": "Базовые меры по защите информации", + "req_id": "V14.2.8", + "req_description": "Убедитесь, что конфиденциальная информация удаляется из метаданных файлов, загружаемых пользователями, если пользователь явно не согласился на ее хранение.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.3", + "section_name": "Защита данных на стороне клиента", + "req_id": "V14.3.1", + "req_description": "Убедитесь, что аутентифицированные данные очищаются из клиентского хранилища, например, из DOM браузера, после завершения работы клиента или сессии. Заголовок HTTP-ответа Clear-Site-Data может помочь в этом, но клиентская сторона также должна уметь очищать данные, если соединение с сервером недоступно при завершении сессии.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.3", + "section_name": "Защита данных на стороне клиента", + "req_id": "V14.3.2", + "req_description": "Убедитесь, что приложение устанавливает HTTP-заголовки, достаточные для предотвращения кэширования (например, Cache-Control: no-store), чтобы конфиденциальные данные не сохранялись в браузерах.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.3", + "section_name": "Защита данных на стороне клиента", + "req_id": "V14.3.3", + "req_description": "Убедитесь, что данные, хранящиеся в браузерном хранилище (например, localStorage, sessionStorage, IndexedDB или cookie), не содержат конфиденциальной информации, за исключением сессионных токенов.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.1", + "section_name": "Документация по безопасной разработке и архитектуре", + "req_id": "V15.1.1", + "req_description": "Убедитесь, что в документации по приложению определены сроки устранения уязвимостей на основе оценки рисков для внешних зависимостей с уязвимостями и для обновления библиотек в целом, чтобы минимизировать риск, связанный с этими компонентами.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.1", + "section_name": "Документация по безопасной разработке и архитектуре", + "req_id": "V15.1.2", + "req_description": "Убедитесь, что ведется реестр всех используемых сторонних библиотек (например, Software Bill of Materials, SBOM), с обязательной проверкой, что компоненты получены из предопределенных, доверенных и регулярно поддерживаемых репозиториев.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.1", + "section_name": "Документация по безопасной разработке и архитектуре", + "req_id": "V15.1.3", + "req_description": "Убедитесь, что в документации приложения указан функционал, требующий значительных временных или вычислительных ресурсов. Необходимо указать, как предотвратить потерю доступности из-за чрезмерного использования этого функционала и как избежать ситуаций, когда формирование ответа занимает больше времени, чем установленный системой таймаут. Возможные меры защиты могут включать асинхронную обработку, использование очередей и ограничение количества параллельных процессов для каждого пользователя и приложения.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.1", + "section_name": "Документация по безопасной разработке и архитектуре", + "req_id": "V15.1.4", + "req_description": "Убедитесь, что в документации приложения указаны внешние библиотеки, которые считаются «компонентами с повышенным риском».", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.1", + "section_name": "Документация по безопасной разработке и архитектуре", + "req_id": "V15.1.5", + "req_description": "Убедитесь, что в документации приложения выделены те части приложения, в которых используются «функционал с повышенным риском».", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.2", + "section_name": "Архитектура безопасности и зависимости", + "req_id": "V15.2.1", + "req_description": "Убедитесь, что приложение содержит только те компоненты, которые не нарушили задокументированные сроки обновления и исправления.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.2", + "section_name": "Архитектура безопасности и зависимости", + "req_id": "V15.2.2", + "req_description": "Убедитесь, что в приложении реализованы меры защиты от потери доступности из-за функциональности, требующей много времени или ресурсов, на основе задокументированных решений и стратегий безопасности для этого.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.2", + "section_name": "Архитектура безопасности и зависимости", + "req_id": "V15.2.3", + "req_description": "Убедитесь, что производственная среда включает только те функции, которые необходимы для работы приложения, и не предоставляет лишние функции, такие как тестовый код, примеры кода и инструменты разработки.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.2", + "section_name": "Архитектура безопасности и зависимости", + "req_id": "V15.2.4", + "req_description": "Убедитесь, что сторонние компоненты и все их транзитивные зависимости загружаются только из ожидаемых репозиториев (внутренних или внешних) и отсутствует риск атаки через подмену зависимостей (dependency confusion attack)", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.2", + "section_name": "Архитектура безопасности и зависимости", + "req_id": "V15.2.5", + "req_description": "Убедитесь, что приложение реализует дополнительные меры защиты для тех частей приложения, которые документированы как содержащие «функционал с повышенным риском» или использующие сторонние библиотеки, считающиеся «функционалом с повышенным риском». Это могут быть такие методы, как «песочница», инкапсуляция, контейнеризация или изоляция на сетевом уровне, чтобы задержать и предотвратить продвижение (pivoting) злоумышленников, скомпрометировавших одну часть приложения, к другим частям приложения.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.3", + "section_name": "Безопасное программирование", + "req_id": "V15.3.1", + "req_description": "Убедитесь, что приложение возвращает только необходимое подмножество полей из объекта данных. Например, оно не должно возвращать весь объект данных, поскольку некоторые отдельные поля должны быть недоступны пользователям.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.3", + "section_name": "Безопасное программирование", + "req_id": "V15.3.2", + "req_description": "Убедитесь, что при вызовах внешних URL-адресов бэкэнд приложения настроен так, чтобы не выполнять перенаправления, если только это не предусмотрено функционалом.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.3", + "section_name": "Безопасное программирование", + "req_id": "V15.3.3", + "req_description": "Убедитесь, что в приложении реализованы защитные механизмы против атак типа массового присвоения (mass assignment) путем строгого ограничения разрешенных полей для каждого контроллера и действия, исключая возможность добавления или изменения значений полей, которые не должны быть доступны для данной конкретной операции.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.3", + "section_name": "Безопасное программирование", + "req_id": "V15.3.4", + "req_description": "Убедитесь, что все прокси и промежуточное ПО корректно передают исходный IP-адрес пользователя, используя доверенные поля данных, которые не могут быть изменены конечным пользователем, а приложение и веб-сервер используют это правильное значение для ведения логирования и принятия решений по безопасности, таких как ограничение запросов. При этом следует учитывать, что даже исходный IP-адрес может быть ненадежным из-за динамических IP-адресов, VPN или корпоративных файрволов.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.3", + "section_name": "Безопасное программирование", + "req_id": "V15.3.5", + "req_description": "Убедитесь, что приложение явно проверяет соответствие переменных ожидаемому типу данных и использует строгие операции сравнения. Это необходимо для предотвращения уязвимостей, связанных с type juggling и type confusion, вызванных тем, что код приложения делает предположения о типе переменной.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.3", + "section_name": "Безопасное программирование", + "req_id": "V15.3.6", + "req_description": "Убедитесь, что JavaScript-код написан таким образом, чтобы предотвратить prototype pollution, например, используя Set() или Map() вместо обычных литералов объекта.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.3", + "section_name": "Безопасное программирование", + "req_id": "V15.3.7", + "req_description": "Убедитесь, что приложение защищено от атак типа HTTP Parameter Pollution (HPP), особенно если используемый фреймворк не различает источники параметров запроса (строка запроса, тело запроса, куки или заголовки).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.4", + "section_name": "Безопасная работа с параллельными процессами", + "req_id": "V15.4.1", + "req_description": "Убедитесь, что к общим объектам в многопоточном коде (например, кэшам, файлам или объектам в памяти, используемым несколькими потоками) используется безопасный многопоточный доступ и механизмов синхронизации, таких как блокировки или семафоры, чтобы избежать состояний гонки и повреждения данных.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.4", + "section_name": "Безопасная работа с параллельными процессами", + "req_id": "V15.4.2", + "req_description": "Убедитесь, что проверки состояния ресурса, например его существования или разрешений, а также зависящие от него действия выполняются как одна атомарная операция, чтобы предотвратить условия гонки времени проверки и времени использования (TOCTOU). Например, проверка существования файла перед его открытием или проверка прав доступа пользователя перед его предоставлением.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.4", + "section_name": "Безопасная работа с параллельными процессами", + "req_id": "V15.4.3", + "req_description": "Убедитесь, что блокировки применяются согласованно, чтобы предотвратить взаимные блокировки потоков (deadlocks) или их бесконечные повторы, а также что логика блокировки инкапсулирована в коде, отвечающем за управление ресурсом. Это гарантирует, что блокировки не могут быть случайно или намеренно изменены внешними классами или кодом.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.4", + "section_name": "Безопасная работа с параллельными процессами", + "req_id": "V15.4.4", + "req_description": "Убедитесь, что политики распределения ресурсов предотвращают нехватку ресурсов у потоков, обеспечивая справедливый доступ к ресурсам, например, используя пулы потоков, позволяя потокам с более низким приоритетом выполняться в течение разумного периода времени.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.1", + "section_name": "Документация по ведению логов", + "req_id": "V16.1.1", + "req_description": "Убедитесь в существовании реестра, в котором документируется ведение журнала на каждом уровне технологического стека приложения, включая какие события регистрируются, форматы логов, где хранятся эти журналы, как они используются, как контролируется доступ к ним и как долго хранятся журналы.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.2", + "section_name": "Общее журналирование", + "req_id": "V16.2.1", + "req_description": "Убедитесь, что каждая запись журнала содержит необходимые метаданные (например, когда, где, кто, что), которые позволят провести подробное исследование временной шкалы, когда произошло событие.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.2", + "section_name": "Общее журналирование", + "req_id": "V16.2.2", + "req_description": "Убедитесь, что все источники времени компонентов системы журналирования синхронизированы, а временные метки в метаданных событий безопасности используют UTC или содержат явное указание смещения часового пояса. Рекомендуется применять UTC для обеспечения согласованности в распределённых системах и предотвращения ошибок при переходе на летнее/зимнее время.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.2", + "section_name": "Общее журналирование", + "req_id": "V16.2.3", + "req_description": "Убедитесь, что приложение записывает и передаёт логи исключительно в те файлы и сервисы, которые указаны в реестре журналирования.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.2", + "section_name": "Общее журналирование", + "req_id": "V16.2.4", + "req_description": "Убедитесь, что логи могут быть прочитаны и коррелированы используемой системой обработки журналов, предпочтительно с использованием общего стандартного формата логирования.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.2", + "section_name": "Общее журналирование", + "req_id": "V16.2.5", + "req_description": "Убедитесь, что приложение применяет соответствующие меры защиты при логировании конфиденциальных данных в зависимости от уровня их чувствительности: например, полностью запрещает запись в логи таких данных, как учетные данные или платежные реквизиты, а для других данных (например, сессионных токенов) использует хеширование или частичное/полное маскирование.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.3", + "section_name": "Инциденты безопасности", + "req_id": "V16.3.1", + "req_description": "Убедитесь, что все операции аутентификации регистрируются, включая успешные и неудачные попытки. Также следует фиксировать дополнительные метаданные, такие как тип аутентификации или использованные факторы проверки.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.3", + "section_name": "Инциденты безопасности", + "req_id": "V16.3.2", + "req_description": "Убедитесь, что ведется журнал неудачных попыток авторизации. Для уровня L3 это должно включать в себя журналирование всех решений об авторизации, включая журналирование доступа к конфиденциальным данным (без регистрации самих конфиденциальных данных).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.3", + "section_name": "Инциденты безопасности", + "req_id": "V16.3.3", + "req_description": "Убедитесь, что приложение регистрирует все события безопасности, определенные в документации, а также фиксирует попытки обхода механизмов защиты, включая проверку входных данных, бизнес-логики и системы защиты от автоматизированных атак.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.3", + "section_name": "Инциденты безопасности", + "req_id": "V16.3.4", + "req_description": "Убедитесь, что приложение регистрирует в журналах неожиданные ошибки и сбои механизмов безопасности, включая, например, ошибки TLS-соединения на стороне сервера.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.4", + "section_name": "Защита журналов", + "req_id": "V16.4.1", + "req_description": "Убедитесь, что все компоненты системы логирования корректно кодируют данные, чтобы предотвратить атаки типа внедрения в журналы (log injection).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.4", + "section_name": "Защита журналов", + "req_id": "V16.4.2", + "req_description": "Убедитесь, что логи защищены от неавторизованного доступа и не могут быть модифицированы.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.4", + "section_name": "Защита журналов", + "req_id": "V16.4.3", + "req_description": "Убедитесь, что логи безопасно передаются в логически изолированную систему для анализа, обнаружения угроз, генерации оповещений и эскалации инцидентов. Это гарантирует сохранность журналов даже в случае компрометации основного приложения.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.5", + "section_name": "Обработка ошибок", + "req_id": "V16.5.1", + "req_description": "Убедитесь, что при возникновении непредвиденной или связанной с безопасностью ошибки пользователю возвращается только общее сообщение, гарантируя отсутствие раскрытия конфиденциальных внутренних данных системы, таких как трассировки стека, запросы, секретные ключи и токены.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.5", + "section_name": "Обработка ошибок", + "req_id": "V16.5.2", + "req_description": "Убедитесь, что приложение продолжает работать в безопасном режиме при недоступности внешних ресурсов, используя такие механизмы, как автоматические выключатели (circuit breakers) или плавное снижение функциональности (graceful degradation).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.5", + "section_name": "Обработка ошибок", + "req_id": "V16.5.3", + "req_description": "Убедитесь, что приложение корректно и безопасно завершает работу при возникновении исключений, предотвращая опасные сценарии по типу «fail-open», когда, например, транзакция ошибочно выполняется, несмотря на ошибки в логике валидации.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.5", + "section_name": "Обработка ошибок", + "req_id": "V16.5.4", + "req_description": "Убедитесь, что определён обработчик ошибок «крайние меры», который будет перехватывать все необработанные ошибки. Это необходимо как для предотвращения потери информации об ошибках, которая должна быть записана в файлы журналов, так и для того, чтобы ошибка не остановила весь процесс приложения, что привело бы к потере доступности.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.1", + "section_name": "TURN-сервер", + "req_id": "V17.1.1", + "req_description": "Убедитесь, что сервис TURN (Traversal Using Relays around NAT) разрешает доступ только к IP-адресам, не зарезервированным для специальных целей (например, внутренние сети, широковещательная рассылка, loopback-адреса). Данное требование применяется как к IPv4, так и к IPv6 адресам.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.1", + "section_name": "TURN-сервер", + "req_id": "V17.1.2", + "req_description": "Убедитесь, что сервис TURN (Traversal Using Relays around NAT) защищен от исчерпания ресурсов при попытках легитимных пользователей открыть чрезмерное количество портов на сервере.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Требования к медиасерверам", + "req_id": "V17.2.1", + "req_description": "Убедитесь, что ключ сертификата Datagram Transport Layer Security (DTLS) управляется и защищается в соответствии с документированной политикой управления криптографическими ключами.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Требования к медиасерверам", + "req_id": "V17.2.2", + "req_description": "Убедитесь, что медиасервер настроен на использование только одобренных наборов шифров Datagram Transport Layer Security (DTLS) и защищенного профиля безопасности для расширения DTLS, применяемого при установке ключей для Secure Real-time Transport Protocol (DTLS-SRTP).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Требования к медиасерверам", + "req_id": "V17.2.3", + "req_description": "Убедитесь, что медиасервер проверяет аутентификацию Secure Real-time Transport Protocol (SRTP) для предотвращения атак с внедрением Real-time Transport Protocol (RTP), которые могут привести к отказу в обслуживании (Denial of Service) или вставке поддельного аудио-/видеоконтента в медиапотоки.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Требования к медиасерверам", + "req_id": "V17.2.4", + "req_description": "Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика при получении некорректных пакетов Secure Real-time Transport Protocol (SRTP).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Требования к медиасерверам", + "req_id": "V17.2.5", + "req_description": "Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетами Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Требования к медиасерверам", + "req_id": "V17.2.6", + "req_description": "Убедитесь, что медиасервер не подвержен уязвимости «Гонка ClientHello» (ClientHello Race Condition) в Datagram Transport Layer Security (DTLS), проверив наличие известных уязвимостей в публичных источниках или выполнив тестирование на воспроизведение условий гонки.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Требования к медиасерверам", + "req_id": "V17.2.7", + "req_description": "Убедитесь, что механизмы аудио- и видеозаписи, связанные с медиасервером, способны продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетов Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Требования к медиасерверам", + "req_id": "V17.2.8", + "req_description": "Убедитесь, что сертификат Datagram Transport Layer Security (DTLS) проверяется на соответствие атрибуту отпечатка (fingerprint) в Session Description Protocol (SDP), с немедленным прекращением медиапотока в случае несоответствия — это гарантирует подлинность передаваемых данных.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.3", + "section_name": "Сигнализация", + "req_id": "V17.3.1", + "req_description": "Убедитесь, что сигнальный сервер способен продолжать обработку легитимных входящих сообщений сигнализации даже в условиях флуд-атаки. Для этого необходимо реализовать механизм ограничения частоты запросов (rate limiting) на уровне сигнализации.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.3", + "section_name": "Сигнализация", + "req_id": "V17.3.2", + "req_description": "Убедитесь, что сигнальный сервер способен продолжать обработку легитимных сообщений сигнализации даже при получении некорректных сообщений, которые могут вызвать отказ в обслуживании (Denial of Service, DoS). Для этого необходимо реализовать: проверку входных данных (input validation), безопасную обработку целочисленных переполнений (integer overflows), защиту от переполнения буферов (buffer overflows) и другие надежные методы обработки ошибок.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + } + ] +} diff --git a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.json b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.json new file mode 100644 index 0000000000..9ba0fb1896 --- /dev/null +++ b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.json @@ -0,0 +1,2774 @@ +{ + "Name": "Application Security Verification Standard Project", + "ShortName": "ASVS", + "Version": "", + "Description": "The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.", + "Requirements": [ + { + "Shortcode": "V1", + "Ordinal": 1, + "ShortName": "Encoding", + "Name": "Кодировка и нейтрализация", + "Items": [ + { + "Shortcode": "V1.1", + "Ordinal": 1, + "Name": "Архитектура кодировки и нейтрализации", + "Items": [ + { + "Shortcode": "V1.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что входные данные декодируются или деэкранируются в каноническую форму (в стандартное представление) только один раз. Декодирование происходит только тогда, когда ожидаются закодированные данные в этой форме, и что это делается перед дальнейшей обработкой входных данных, например, это не выполняется после проверки или нейтрализации.", + "L": "2" + }, + { + "Shortcode": "V1.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение выполняет кодирование и экранирование выходных данных либо в качестве последнего шага перед использованием интерпретатором, для которого оно предназначено, либо самим интерпретатором.", + "L": "2" + } + ] + }, + { + "Shortcode": "V1.2", + "Ordinal": 2, + "Name": "Предотвращение инъекций", + "Items": [ + { + "Shortcode": "V1.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что выходная кодировка для ответа HTTP, документа HTML или документа XML соответствует требуемому контексту, например, кодировка соответствующих символов для элементов HTML, атрибутов HTML, комментариев HTML, CSS или полей заголовка HTTP делается таким способом, чтобы избежать изменения структуры сообщения или документа.", + "L": "1" + }, + { + "Shortcode": "V1.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что при динамическом построении URL-адресов недоверенные данные кодируются в соответствии с их контекстом (например, кодирование URL-адресов или кодирование base64url для query или path параметров или пути). Убедитесь, что разрешены только безопасные протоколы URL-адресов (например, запрещен javascript: или data:).", + "L": "1" + }, + { + "Shortcode": "V1.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что при динамическом построении содержимого JavaScript (включая JSON) используется кодирование или экранирование выходных данных, чтобы избежать изменения структуры сообщения или документа (чтобы избежать JavaScript и JSON-инъекций).", + "L": "1" + }, + { + "Shortcode": "V1.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что выборка данных (Redis, Memcached, чтение из файлов, обращение по API) или запросы к базе данных (например, SQL, HQL, NoSQL, Cypher) используют параметризованные запросы, ORM, Entity Frameworks или иным образом защищены от SQL-инъекций и других атак. Это также актуально при написании хранимых процедур.", + "L": "1" + }, + { + "Shortcode": "V1.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что приложение защищено от внедрения команд ОС и что вызовы операционной системы используют параметризованные запросы к ОС или используют контекстное кодирование вывода командной строки.", + "L": "1" + }, + { + "Shortcode": "V1.2.6", + "Ordinal": 6, + "Description": "Убедитесь, что приложение защищено от LDAP-инъекций, или что реализованы специальные меры безопасности для их предотвращения.", + "L": "2" + }, + { + "Shortcode": "V1.2.7", + "Ordinal": 7, + "Description": "Убедитесь, что приложение защищено от атак с использованием XPath-инъекций с помощью параметризации запросов или предварительно скомпилированных запросов.", + "L": "2" + }, + { + "Shortcode": "V1.2.8", + "Ordinal": 8, + "Description": "Убедитесь, что процессоры LaTeX настроены безопасно (например, не используется флаг «–shell‑escape») и используется разрешенный список команд для предотвращения LaTeX-инъекций.", + "L": "2" + }, + { + "Shortcode": "V1.2.9", + "Ordinal": 9, + "Description": "Убедитесь, что приложение экранирует специальные символы в регулярных выражениях (обычно с помощью обратной косой черты), чтобы предотвратить их ошибочную интерпретацию как метасимволов.", + "L": "2" + }, + { + "Shortcode": "V1.2.10", + "Ordinal": 10, + "Description": "Убедитесь, что приложение защищено от внедрения формул CSV (CSV Injection). Приложение должно следовать правилам экранирования, определенным в RFC 4180, разделы 2.6 и 2.7, при экспорте содержимого CSV. Кроме того, при экспорте в CSV или другие форматы электронных таблиц (такие как XLS, XLSX или ODF) специальные символы (включая '=', '+', '-', '@', '\\t' (табуляция), и '\\0' (нулевой символ)) должны экранироваться одинарной кавычкой, если они появляются в качестве первого символа в значении поля.", + "L": "3" + } + ] + }, + { + "Shortcode": "V1.3", + "Ordinal": 3, + "Name": "Нейтрализация", + "Items": [ + { + "Shortcode": "V1.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что все ненадежные входные данные HTML из редакторов WYSIWYG или аналогичных программ нейтрализуются с помощью известных и безопасных библиотек или функций фреймворка для санитизации HTML.", + "L": "1" + }, + { + "Shortcode": "V1.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение избегает использования eval() или других динамических функций выполнения кода, таких как Spring Expression Language (SpEL). Если нет альтернативы, любой пользовательский ввод должен быть нейтрализован перед выполнением.", + "L": "1" + }, + { + "Shortcode": "V1.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что данные, передаваемые в потенциально опасный контекст, предварительно нейтрализованы, чтобы обеспечить соблюдение мер безопасности, таких как разрешение только тех символов, которые безопасны для данного контекста, и обрезка слишком длинного ввода.", + "L": "2" + }, + { + "Shortcode": "V1.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что предоставленный пользователем файл .SVG проверен или нейтрализован, чтобы он содержал только теги и атрибуты (например, относящиеся к рисованию), которые безопасны для приложения, например, не содержат скриптов и foreignObject.", + "L": "2" + }, + { + "Shortcode": "V1.3.5", + "Ordinal": 5, + "Description": "Убедитесь, что приложение нейтралует или отключает предоставленные пользователем скриптовые данные или выражения шаблонных языков, такие как таблицы стилей Markdown, CSS или XSL, BBCode или аналогичные.", + "L": "2" + }, + { + "Shortcode": "V1.3.6", + "Ordinal": 6, + "Description": "Убедитесь, что приложение защищено от атак с подделкой запросов на стороне сервера (SSRF), проверяя ненадежные данные по разрешенному списку протоколов, доменов, путей и портов, а также нейтрализуя потенциально опасные символы перед использованием данных для вызова другой службы.", + "L": "2" + }, + { + "Shortcode": "V1.3.7", + "Ordinal": 7, + "Description": "Убедитесь, что приложение защищено от атак с внедрением шаблонов (template injection), не позволяя создавать шаблоны на основе недоверенных входных данных. Если нет альтернативы, любые недоверенные входные данные, включаемые динамически во время создания шаблона, должны быть нейтрализованы или тщательно провалидированы.", + "L": "2" + }, + { + "Shortcode": "V1.3.8", + "Ordinal": 8, + "Description": "Убедитесь, что приложение надлежащим образом нейтрализует недоверенные входные данные перед использованием в запросах Java Naming and Directory Interface (JNDI) и что JNDI настроен безопасно для предотвращения атак с использованием JNDI-инъекций.", + "L": "2" + }, + { + "Shortcode": "V1.3.9", + "Ordinal": 9, + "Description": "Убедитесь, что приложение нейтрализует данные перед отправкой в Memcache, чтобы предотвратить атаки методом инъекций.", + "L": "2" + }, + { + "Shortcode": "V1.3.10", + "Ordinal": 10, + "Description": "Убедитесь, что строки форматирования, которые могут быть использованы неожидаемым или вредоносным образом, нейтрализуются перед дальнейшим использованием.", + "L": "2" + }, + { + "Shortcode": "V1.3.11", + "Ordinal": 11, + "Description": "Убедитесь, что приложение нейтрализует вводимые пользователем данные перед передачей в почтовые системы для защиты от SMTP или IMAP-инъекций.", + "L": "2" + }, + { + "Shortcode": "V1.3.12", + "Ordinal": 12, + "Description": "Убедитесь, что регулярные выражения не содержат элементов, вызывающих экспоненциальный возврат, и убедитесь в нейтрализации недоверенных входных данных для предотвращения атак ReDoS или Runaway Regex.", + "L": "3" + } + ] + }, + { + "Shortcode": "V1.4", + "Ordinal": 4, + "Name": "Память, строки и неуправляемый код", + "Items": [ + { + "Shortcode": "V1.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что для обнаружения или предотвращения ситуаций переполнения стека, буфера или кучи приложение учитывает размер доступной области памяти при строковых операциях, копировании в память, в арифметике указателей и т.п.", + "L": "2" + }, + { + "Shortcode": "V1.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что для предотвращения целочисленного переполнения применяется контроль знака, диапазона и типа допустимых входных данных.", + "L": "2" + }, + { + "Shortcode": "V1.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что динамически выделенная память и ресурсы освобождены, а ссылки или указатели на освобожденную память удалены или установлены в значение null, чтобы предотвратить появление висячих указателей и уязвимостей, связанных с использованием памяти после освобождения.", + "L": "2" + } + ] + }, + { + "Shortcode": "V1.5", + "Ordinal": 5, + "Name": "Безопасная десериализация", + "Items": [ + { + "Shortcode": "V1.5.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение настраивает XML-парсеры на использование строгой конфигурации и что небезопасные функции, такие как разрешение внешних сущностей, отключены для предотвращения атак XML eXternal Entity (XXE).", + "L": "1" + }, + { + "Shortcode": "V1.5.2", + "Ordinal": 2, + "Description": "Убедитесь, что десериализация недоверенных данных обеспечивает безопасную обработку ввода, например, используя список разрешенных типов объектов или ограничивая типы объектов, определяемые клиентом, для предотвращения атак десериализации. Механизмы десериализации, которые явно определены как небезопасные, не должны использоваться с недоверенным вводом.", + "L": "2" + }, + { + "Shortcode": "V1.5.3", + "Ordinal": 3, + "Description": "Убедитесь, что различные парсеры, используемые в приложении для одного и того же типа данных (например, парсеры JSON, XML, URL), выполняют парсинг согласованным образом и используют один и тот же механизм кодирования символов, чтобы избежать таких проблем, как уязвимости взаимодействия JSON (JSON Interoperability) или различное поведение анализа URI или файлов, которые могут использоваться в атаках удаленного включения файлов (RFI) или подделки запросов на стороне сервера (SSRF).", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V2", + "Ordinal": 2, + "ShortName": "Validation", + "Name": "Валидация и бизнес-логика", + "Items": [ + { + "Shortcode": "V2.1", + "Ordinal": 1, + "Name": "Документация валидации и бизнес-логики", + "Items": [ + { + "Shortcode": "V2.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что в документации приложения определены правила проверки входных данных на соответствие ожидаемой структуре. Это могут быть распространённые форматы данных, такие как номера кредитных карт, адреса электронной почты, номера телефонов, или внутренний формат данных.", + "L": "1" + }, + { + "Shortcode": "V2.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что в документации приложения указано, как проверять логическую и контекстную согласованность объединенных данных, например, проверять соответствие района и почтового индекса.", + "L": "2" + }, + { + "Shortcode": "V2.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что ожидания относительно ограничений и проверок бизнес-логики задокументированы как для уровня отдельного пользователя, так и для глобального уровня всего приложения.", + "L": "2" + } + ] + }, + { + "Shortcode": "V2.2", + "Ordinal": 2, + "Name": "Валидация ввода", + "Items": [ + { + "Shortcode": "V2.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что входные данные провалидированы для обеспечения соответствия бизнес- или функциональным ожиданиям. Валидация должна осуществляться либо по списку допустимых значений, шаблонов и диапазонов, либо путем сравнения входных данных с ожидаемой структурой и логическими ограничениями в соответствии с предопределенными правилами. Для L1 валидация может быть сосредоточена на входных данных, используемых для принятия конкретных бизнес-решений или решений, связанных с безопасностью. Для L2 и выше это должно применяться ко всем входным данным.", + "L": "1" + }, + { + "Shortcode": "V2.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение разработано с принудительной валидацией входных данных на уровне доверенного сервиса. Хотя проверка на стороне клиента повышает удобство использования и должна поощряться, на неё не следует полагаться как на средство контроля безопасности.", + "L": "1" + }, + { + "Shortcode": "V2.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение обеспечивает обоснованность комбинаций данных в соответствии с предопределенными правилам. Например: возраст должен соответствовать дате рождения; страна и почтовый индекс; количество товара в заказе и на складе.", + "L": "2" + } + ] + }, + { + "Shortcode": "V2.3", + "Ordinal": 3, + "Name": "Безопасность бизнес-логики", + "Items": [ + { + "Shortcode": "V2.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение обрабатывает потоки бизнес-логики для одного и того же пользователя в ожидаемом последовательном порядке шагов и без пропуска шагов.", + "L": "1" + }, + { + "Shortcode": "V2.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что ограничения бизнес-логики реализованы в соответствии с документацией приложения, чтобы избежать эксплуатации её недостатков.", + "L": "2" + }, + { + "Shortcode": "V2.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что транзакции используются на уровне бизнес-логики таким образом, что операция бизнес-логики либо выполняется полностью, либо откатывается к предыдущему корректному состоянию.", + "L": "2" + }, + { + "Shortcode": "V2.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что на уровне бизнес-логики используются механизмы блокировки, чтобы гарантировать невозможность двойного бронирования ограниченных по количеству ресурсов (например, мест в театре или слотов доставки) путем манипулирования логикой приложения.", + "L": "2" + }, + { + "Shortcode": "V2.3.5", + "Ordinal": 5, + "Description": "Убедитесь, что для важных потоков бизнес-логики требуется многопользовательское (multi-user) одобрение, чтобы предотвратить несанкционированные или случайные действия. Потоки бизнес-логики могут включать, помимо прочего, крупные денежные переводы, утверждение контрактов, доступ к секретной информации или обход ограничений безопасности на производстве.", + "L": "3" + } + ] + }, + { + "Shortcode": "V2.4", + "Ordinal": 4, + "Name": "Анти-автоматизация", + "Items": [ + { + "Shortcode": "V2.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что используются средства противодействия автоматизации для защиты от чрезмерных вызовов функций приложения, которые могут привести к утечке данных, созданию ненужных данных, исчерпанию квот, нарушению ограничений скорости, отказу в обслуживании или чрезмерному использованию дорогостоящих ресурсов.", + "L": "2" + }, + { + "Shortcode": "V2.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что потоки бизнес-логики требуют реалистичного человеческого времени, предотвращая чрезмерно быструю отправку транзакций.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V3", + "Ordinal": 3, + "ShortName": "Web", + "Name": "Безопасность веб-интерфейса", + "Items": [ + { + "Shortcode": "V3.1", + "Ordinal": 1, + "Name": "Документация по безопасности веб-интерфейса", + "Items": [ + { + "Shortcode": "V3.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что в документации приложения описаны ожидаемые функции безопасности, которые должны поддерживать браузеры, использующие приложение (такие как HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) и другие соответствующие механизмы безопасности HTTP). В документации также должно быть обязательно определено, как приложение должно себя вести, если некоторые из этих функций недоступны (например, предупреждать пользователя или блокировать доступ).", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.2", + "Ordinal": 2, + "Name": "Непреднамеренная интерпретация контента", + "Items": [ + { + "Shortcode": "V3.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что реализованы меры безопасности, предотвращающие отображение контента или функций браузерами в HTTP-ответах в некорректном контексте (например, запрос API, загруженный пользователем файл или другой ресурс запрашивается напрямую). Возможные способы контроля включают: не обрабатывать содержимое, если поля заголовка HTTP-запроса (например, Sec-Fetch-*) не указывают на корректность контекста; использование заголовка и значения Content-Security-Policy: sandbox directive; или использование заголовка и значения Content-Disposition: attachment.", + "L": "1" + }, + { + "Shortcode": "V3.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что данные, предназначенные для отображения в виде текста, а не визуализации в виде HTML, обрабатывается с использованием безопасных функций визуализации (таких как createTextNode или textContent), чтобы предотвратить непреднамеренное выполнение содержимого, такого как HTML или JavaScript.", + "L": "1" + }, + { + "Shortcode": "V3.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение избегает затирания DOM при использовании JavaScript на стороне клиента, применяя явные объявления переменных, выполняя строгую проверку типов, избегая сохранения глобальных переменных в объекте документа и реализуя изоляцию пространства имен.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.3", + "Ordinal": 3, + "Name": "Настройка файлов cookie", + "Items": [ + { + "Shortcode": "V3.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что у файлов cookie установлен атрибут «Secure», и если префикс «__Host‑» не используется в названии cookie, необходимо использовать префикс «__Secure‑».", + "L": "1" + }, + { + "Shortcode": "V3.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что значение атрибута SameSite каждой cookie установлено в соответствии с назначением cookie, чтобы ограничить подверженность атакам на восстановление пользовательского интерфейса и атакам с подделкой запросов на уровне браузера, обычно называемым подделкой межсайтовых запросов (CSRF).", + "L": "2" + }, + { + "Shortcode": "V3.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что cookie имеют префикс «__Host‑» в названии, если только они явно не предназначены для совместного использования с другими хостами.", + "L": "2" + }, + { + "Shortcode": "V3.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что если значение cookie не должно быть доступно для клиентских скриптов (например, сессионный токен), для cookie должен быть установлен атрибут «HttpOnly», а само значение должно передаваться клиенту только через поле заголовка «Set-Cookie».", + "L": "2" + }, + { + "Shortcode": "V3.3.5", + "Ordinal": 5, + "Description": "Убедитесь, что при записи cookie приложением общая длина имени и значения cookie не превышает 4096 байт. Слишком большие cookie не будут сохраняться браузером и, следовательно, не будут отправляться с запросами, что помешает пользователю использовать функции приложения, зависящие от этого cookie.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.4", + "Ordinal": 4, + "Name": "Заголовки механизма безопасности браузера", + "Items": [ + { + "Shortcode": "V3.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что поле заголовка Strict‑Transport‑Security включено во все ответы для реализации политики HTTP Strict Transport Security (HSTS). Необходимо указать максимальное время не менее 1 года, а для L2 и выше политика должна применяться также ко всем поддоменам.", + "L": "1" + }, + { + "Shortcode": "V3.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что поле заголовка Cross‑Origin Resource Sharing (CORS) «Access‑Control‑Allow‑Origin» имеет фиксированное значение, заданное приложением, или, если используется заголовок Origin, оно проверяется по списку доверенных источников. При необходимости использования «Access‑Control‑Allow‑Origin: *» убедитесь, что ответ не содержит конфиденциальной информации.", + "L": "1" + }, + { + "Shortcode": "V3.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что HTTP-ответы содержат поле заголовка Content-Security-Policy, которое определяет директивы, гарантирующие загрузку и выполнение браузером только доверенного контента или ресурсов, чтобы ограничить выполнение вредоносного JavaScript. Как минимум, необходимо использовать глобальную политику, включающую директивы object-src «none» и base-uri «none», а также определяющую список разрешенных адресов или использующую одноразовые коды или хэши. Для приложений L3 необходимо определить политику использования 'nonce' или hash-конструкций для каждого ответа.", + "L": "2" + }, + { + "Shortcode": "V3.4.4", + "Ordinal": 4, + "Description": "Убедитесь, что все HTTP-ответы содержат поле заголовка «X‑Content‑Type‑Options: nosniff». Это предписывает браузерам не использовать анализ контента и определение типа MIME для данного ответа, а также требовать, чтобы значение поля заголовка Content‑Type в ответе соответствовало целевому ресурсу. Например, ответ на запрос стиля принимается только в том случае, если Content‑Type в ответе — «text/css». Это также позволяет браузеру использовать функцию Cross‑Origin Read Blocking (CORB).", + "L": "2" + }, + { + "Shortcode": "V3.4.5", + "Ordinal": 5, + "Description": "Убедитесь, что приложение устанавливает политику реферера для предотвращения утечки технически конфиденциальных данных сторонним сервисам через поле заголовка HTTP-запроса «Referer». Это можно сделать с помощью поля заголовка HTTP-ответа «Referrer‑Policy» или через атрибуты HTML-элемента. Конфиденциальные данные могут включать путь и данные запроса в URL-адресе, а для внутренних непубличных приложений также имя хоста.", + "L": "2" + }, + { + "Shortcode": "V3.4.6", + "Ordinal": 6, + "Description": "Убедитесь, что веб-приложение использует директиву frame‑ancestors поля заголовка Content‑Security‑Policy для каждого HTTP-ответа, чтобы гарантировать невозможность его внедрения по умолчанию и внедрение определённых ресурсов разрешено только при необходимости. Обратите внимание, что поле заголовка X‑Frame‑Options, хотя и поддерживается браузерами, устарело и не может быть использовано в качестве основы.", + "L": "2" + }, + { + "Shortcode": "V3.4.7", + "Ordinal": 7, + "Description": "Убедитесь, что в поле заголовка Content‑Security‑Policy указано место, куда следует сообщать о нарушениях.", + "L": "3" + }, + { + "Shortcode": "V3.4.8", + "Ordinal": 8, + "Description": "Убедитесь, что все HTTP-ответы, инициирующие рендеринг документа (например, ответы с типом содержимого text/html), включают поле заголовка Cross-Origin-Opener-Policy с директивой same-origin или same-origin-allow-popups (при необходимости). Это предотвращает атаки, злоупотребляющие общим доступом к объектам Window, такие как Tabnabbing и Frame Counting.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.5", + "Ordinal": 5, + "Name": "Браузерное разделение источников", + "Items": [ + { + "Shortcode": "V3.5.1", + "Ordinal": 1, + "Description": "Убедитесь, что, если приложение не использует механизм предварительной проверки CORS для предотвращения запрещённых кросс-доменных запросов на использование чувствительного функционала, эти запросы валидируются на предмет их происхождения от самого приложения. Это можно сделать, используя и проверяя специальные токены для защиты от подделки или требуя дополнительные поля HTTP-заголовка, не входящие в список «простых заголовков» (CORS-safelisted request-header). Это необходимо для защиты от атак с подделкой запросов через браузер, широко известных как межсайтовая подделка запросов (CSRF).", + "L": "1" + }, + { + "Shortcode": "V3.5.2", + "Ordinal": 2, + "Description": "Убедитесь, что если приложение использует механизм предварительной проверки CORS для предотвращения неразрешённого использования чувствительного функционала между источниками, вызов этого функционала невозможен с помощью запроса, который не запускает предварительную проверку CORS. Для этого может потребоваться проверка значений полей заголовка запроса «Origin» и «Content-Type» или использование дополнительного поля заголовка, не входящего в безопасный список CORS.", + "L": "1" + }, + { + "Shortcode": "V3.5.3", + "Ordinal": 3, + "Description": "Убедитесь, что HTTP-запросы к чувствительному функционалу используют соответствующие HTTP-методы, такие как POST, PUT, PATCH или DELETE, а не методы, определённые спецификацией HTTP как «безопасные», такие как HEAD, OPTIONS или GET. В качестве альтернативы можно использовать строгую валидацию полей заголовка запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, навигационного запроса или загрузки ресурса (например, источника изображения), где это не ожидается.", + "L": "1" + }, + { + "Shortcode": "V3.5.4", + "Ordinal": 4, + "Description": "Убедитесь, что отдельные приложения размещены на разных именах хостов, чтобы использовать ограничения, предусмотренные политикой same-origin, включая то, как документы или скрипты, загруженные одним источником, могут взаимодействовать с ресурсами из другого источника, а также ограничения на cookie на основе имени хоста.", + "L": "2" + }, + { + "Shortcode": "V3.5.5", + "Ordinal": 5, + "Description": "Убедитесь, что сообщения, полученные интерфейсом postMessage, отвергаются, если источник сообщения не является доверенным или если синтаксис сообщения недействителен.", + "L": "2" + }, + { + "Shortcode": "V3.5.6", + "Ordinal": 6, + "Description": "Убедитесь, что функциональность JSONP не включена нигде в приложении, чтобы избежать атак с использованием межсайтового включения скриптов (XSSI).", + "L": "3" + }, + { + "Shortcode": "V3.5.7", + "Ordinal": 7, + "Description": "Убедитесь, что данные, требующие авторизации, не включены в ответы ресурсов скриптов, таких как файлы JavaScript, чтобы предотвратить атаки с использованием межсайтового включения скриптов (XSSI).", + "L": "3" + }, + { + "Shortcode": "V3.5.8", + "Ordinal": 8, + "Description": "Убедитесь, что аутентифицированные ресурсы (такие как изображения, видео, скрипты и другие документы) могут быть загружены или внедрены от имени пользователя только по назначению. Этого можно добиться путём строгой валидации полей заголовка HTTP-запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, или путём установки ограничительного поля заголовка HTTP-ответа Cross‑Origin‑Resource‑Policy, чтобы браузер блокировал возвращаемый контент.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.6", + "Ordinal": 6, + "Name": "Целостность внешних ресурсов", + "Items": [ + { + "Shortcode": "V3.6.1", + "Ordinal": 1, + "Description": "Убедитесь, что клиентские ресурсы, такие как библиотеки JavaScript, CSS или веб-шрифты, размещаются только на внешнем сервере (например, в сети доставки контента (Content Delivery Network)), если ресурс статический и имеет версии, а для проверки целостности ресурса используется механизм проверки целостности подресурсов (SRI). Если это невозможно, для каждого ресурса должно быть задокументировано решение по безопасности, обосновывающее это.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.7", + "Ordinal": 7, + "Name": "Другие соображения по безопасности браузера", + "Items": [ + { + "Shortcode": "V3.7.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение использует только те клиентские технологии, которые по-прежнему поддерживаются и считаются безопасными. Примерами технологий, не соответствующих этому требованию, являются плагины NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL или клиентские Java-апплеты.", + "L": "2" + }, + { + "Shortcode": "V3.7.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение будет автоматически перенаправлять пользователя на другое имя хоста или домен (который не контролируется приложением), только если этот хост или домен указаны в списке разрешенных.", + "L": "2" + }, + { + "Shortcode": "V3.7.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение отображает уведомление, что пользователь перенаправляется на URL-адрес, находящийся вне контроля приложения, с возможностью отмены навигации.", + "L": "3" + }, + { + "Shortcode": "V3.7.4", + "Ordinal": 4, + "Description": "Убедитесь, что домен верхнего уровня приложения (например, site.tld) ​​добавлен в публичный список предварительной загрузки (preload list) для HTTP Strict Transport Security (HSTS). Это гарантирует, что использование TLS для приложения будет встроено непосредственно в основные браузеры, а не будет полагаться только на поле заголовка ответа Strict-Transport-Security.", + "L": "3" + }, + { + "Shortcode": "V3.7.5", + "Ordinal": 5, + "Description": "Убедитесь, что приложение ведет себя так, как описано в документации (например, предупреждает пользователя или блокирует доступ), если браузер, используемый для доступа к приложению, не поддерживает ожидаемые функции безопасности.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V4", + "Ordinal": 4, + "ShortName": "API", + "Name": "API и Веб-сервис", + "Items": [ + { + "Shortcode": "V4.1", + "Ordinal": 1, + "Name": "Общая безопасность веб-сервисов", + "Items": [ + { + "Shortcode": "V4.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что каждый HTTP-ответ с телом сообщения содержит заголовок Content-Type, который соответствует фактическому содержимому ответа, таким как «text/», «/+xml» и «/xml», включая параметр charset для указания безопасной кодировки символов (например, UTF-8, ISO-8859-1) согласно IANA Media Types.", + "L": "1" + }, + { + "Shortcode": "V4.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что только конечные точки, предназначенные для взаимодействия с пользователем через веб-браузер, автоматически перенаправляют HTTP на HTTPS, в то время как другие сервисы или конечные точки не реализуют прозрачные редиректы. Это необходимо, чтобы избежать ситуации, когда клиент ошибочно отправляет незашифрованные HTTP-запросы а из-за того, что запрос по HTTP автоматически перенаправляется на HTTPS другим сервисом без обработки на входе, утечка чувствительных данных остаётся незамеченной.", + "L": "2" + }, + { + "Shortcode": "V4.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что любой HTTP-заголовок, используемый приложением и устанавливаемый промежуточным уровнем, таким как балансировщик нагрузки, веб-прокси или backend-for-frontend сервис, не может быть переопределён конечным пользователем. Примеры заголовков: X-Real-IP, X-Forwarded-*, X-User-ID.", + "L": "2" + }, + { + "Shortcode": "V4.1.4", + "Ordinal": 4, + "Description": "Убедитесь, что разрешены только HTTP-методы, которые явно поддерживаются приложением или его API (включая OPTIONS для preflight-запросов), а неиспользуемые методы заблокированы.", + "L": "3" + }, + { + "Shortcode": "V4.1.5", + "Ordinal": 5, + "Description": "Убедитесь, что для особо чувствительных запросов или транзакций, проходящих через несколько систем, используются цифровые подписи на уровне сообщений, дополнительно к транспортным средствам защиты.", + "L": "3" + } + ] + }, + { + "Shortcode": "V4.2", + "Ordinal": 2, + "Name": "Валидация структуры HTTP-сообщений", + "Items": [ + { + "Shortcode": "V4.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что все компоненты приложения (включая балансировщики нагрузки, файрволы и серверы приложений) определяют границы входящих HTTP-сообщений с использованием механизма, соответствующего версии HTTP, чтобы предотвратить HTTP request smuggling. В HTTP/1.x, если присутствует заголовок Transfer-Encoding, заголовок Content-Length должен игнорироваться согласно RFC 2616. При использовании HTTP/2 или HTTP/3, если присутствует Content-Length, веб-сервер должен убедиться, что он совпадает с длиной DATA-фреймов.", + "L": "2" + }, + { + "Shortcode": "V4.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что при генерации HTTP-сообщений заголовок Content-Length не конфликтует с длиной содержимого, определяемой рамками протокола HTTP, чтобы предотвратить HTTP Request Smuggling.", + "L": "3" + }, + { + "Shortcode": "V4.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение не отправляет и не принимает HTTP/2 и HTTP/3 сообщения с заголовками, специфичными для соединения, такими как Transfer-Encoding, чтобы предотвратить HTTP Response Splitting и HTTP Header Injection.", + "L": "3" + }, + { + "Shortcode": "V4.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что приложение принимает HTTP/2 и HTTP/3 запросы только в случае, если поля заголовков и их значения не содержат последовательностей CR (\\r), LF (\\n) или CRLF (\\r\\n), чтобы предотвратить HTTP Header Injection.", + "L": "3" + }, + { + "Shortcode": "V4.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что если приложение (бекенд или фронтенд) формирует и отправляет запросы, оно использует валидацию, очистку или другие механизмы, чтобы не создавать URI (например, для API-вызовов) или HTTP-заголовки (например, Authorization или Cookie) слишком большой длины, чтобы их не принимал приёмник. Это может привести к отказу в обслуживании, например, при отправке слишком длинного запроса (длинный cookie-заголовок), из-за чего сервер постоянно возвращает ошибку.", + "L": "3" + } + ] + }, + { + "Shortcode": "V4.3", + "Ordinal": 3, + "Name": "GraphQL", + "Items": [ + { + "Shortcode": "V4.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что используется белый список запросов, ограничение глубины вложенности, ограничение количества или анализ стоимости запроса, чтобы предотвратить DoS-атаки на уровне GraphQL или слоя данных из-за дорогостоящих вложенных запросов.", + "L": "2" + }, + { + "Shortcode": "V4.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что introspection-запросы GraphQL отключены в продакшен-среде, если GraphQL API не предназначен для использования сторонними клиентами.", + "L": "2" + } + ] + }, + { + "Shortcode": "V4.4", + "Ordinal": 4, + "Name": "WebSocket", + "Items": [ + { + "Shortcode": "V4.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что для всех WebSocket-соединений используется WebSocket поверх TLS (WSS).", + "L": "1" + }, + { + "Shortcode": "V4.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что при первоначальном HTTP WebSocket handshake заголовок Origin проверяется на соответствие списку разрешённых источников для приложения.", + "L": "2" + }, + { + "Shortcode": "V4.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что если стандартное управление сессиями приложения не может быть использовано, применяются специальные токены, соответствующие требованиям безопасности управления сессиями.", + "L": "2" + }, + { + "Shortcode": "V4.4.4", + "Ordinal": 4, + "Description": "Убедитесь, что специальные токены управления сессиями WebSocket изначально получаются или валидируются через ранее аутентифицированную HTTPS-сессию при переходе от HTTPS к WebSocket.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V5", + "Ordinal": 5, + "ShortName": "File", + "Name": "Работа с файлами", + "Items": [ + { + "Shortcode": "V5.1", + "Ordinal": 1, + "Name": "Документация по работе с файлами", + "Items": [ + { + "Shortcode": "V5.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что документация определяет допустимые типы файлов, ожидаемые расширения и максимальный размер (включая распакованный размер) для каждой функции загрузки. Также убедитесь, что в документации указано, как файлы обезвреживаются для конечных пользователей (например, как приложение ведёт себя при обнаружении вредоносного файла).", + "L": "2" + } + ] + }, + { + "Shortcode": "V5.2", + "Ordinal": 2, + "Name": "Загрузка файлов и содержимое", + "Items": [ + { + "Shortcode": "V5.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение принимает только те файлы, которые может обработать без потери производительности или отказа в обслуживании.", + "L": "1" + }, + { + "Shortcode": "V5.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что при загрузке файла (включая файлы внутри архивов, таких как ZIP) приложение проверяет, соответствует ли расширение ожидаемому, и валидирует, соответствует ли содержимое типу, указанному в расширении. Это включает проверку начальных 'magic bytes', перезапись изображений, использование специализированных библиотек. Для уровня 1 — достаточно проверок для файлов, критичных с точки зрения бизнеса или безопасности. Для уровней 2 и выше — для всех файлов.", + "L": "1" + }, + { + "Shortcode": "V5.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение проверяет архивы (например, zip, gz, docx, odt) на максимально допустимый распакованный размер и максимальное количество файлов до распаковки.", + "L": "2" + }, + { + "Shortcode": "V5.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что для каждого пользователя установлены квоты на общий размер и количество файлов, чтобы один пользователь не мог переполнить хранилище.", + "L": "3" + }, + { + "Shortcode": "V5.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что приложение не позволяет загружать архивы с символьными ссылками (symlinks), если это не требуется по бизнес-логике. Если требуется — разрешён только строго определённый список допустимых символьных ссылок.", + "L": "3" + }, + { + "Shortcode": "V5.2.6", + "Ordinal": 6, + "Description": "Убедитесь, что приложение отклоняет изображения с числом пикселей выше допустимого, чтобы предотвратить атаки 'pixel flood'.", + "L": "3" + } + ] + }, + { + "Shortcode": "V5.3", + "Ordinal": 3, + "Name": "Хранение файлов", + "Items": [ + { + "Shortcode": "V5.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что загруженные или сгенерированные из недоверенного ввода файлы, находящиеся в публичной директории, не исполняются как серверный код при обращении к ним по HTTP.", + "L": "1" + }, + { + "Shortcode": "V5.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что при создании путей к файлам приложение использует внутренние или доверенные данные, а не пользовательские имена файлов. Если использование пользовательских имён или метаданных необходимо — требуется строгая проверка и очистка. Это защита от path traversal, LFI, RFI и SSRF.", + "L": "1" + }, + { + "Shortcode": "V5.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что при обработке файлов на сервере (например, при распаковке) игнорируются пути, заданные пользователем, во избежание уязвимостей типа 'zip slip'.", + "L": "3" + } + ] + }, + { + "Shortcode": "V5.4", + "Ordinal": 4, + "Name": "Скачивание файлов", + "Items": [ + { + "Shortcode": "V5.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение валидирует или игнорирует имена файлов, переданных пользователем (включая в JSON, JSONP или URL-параметре), и указывает имя файла в заголовке Content-Disposition при ответе.", + "L": "2" + }, + { + "Shortcode": "V5.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что имена файлов, передаваемые (например, в HTTP-заголовках или вложениях в email), кодируются или очищаются (например, по RFC 6266), чтобы сохранить структуру документа и предотвратить инъекции.", + "L": "2" + }, + { + "Shortcode": "V5.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что файлы, полученные из недоверенных источников, сканируются антивирусом, чтобы не распространять известное вредоносное содержимое.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V6", + "Ordinal": 6, + "ShortName": "Authentication", + "Name": "Аутентификация", + "Items": [ + { + "Shortcode": "V6.1", + "Ordinal": 1, + "Name": "Документация по аутентификации", + "Items": [ + { + "Shortcode": "V6.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что в документации приложения описано, как используются механизмы, такие как ограничение частоты запросов (rate limiting), защита от автоматизации и адаптивные реакции, для защиты от атак, таких как подстановка учётных данных и перебор паролей. Документация должна ясно описывать конфигурацию этих механизмов и предотвращение злонамеренной блокировки аккаунтов.", + "L": "1" + }, + { + "Shortcode": "V6.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что задокументирован список контекстно-зависимых слов, запрещённых к использованию в паролях. В него могут входить производные от названий организаций, продуктов, идентификаторов систем, кодовых названий проектов, названий отделов или ролей и тому подобное.", + "L": "2" + }, + { + "Shortcode": "V6.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что если приложение поддерживает несколько способов аутентификации, то все они документированы вместе с описанием применяемых средств защиты и уровнем стойкости аутентификации, которые должны быть одинаково применены ко всем способам.", + "L": "2" + } + ] + }, + { + "Shortcode": "V6.2", + "Ordinal": 2, + "Name": "Безопасность паролей", + "Items": [ + { + "Shortcode": "V6.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что пользовательские пароли содержат не менее 8 символов. Рекомендуется минимальная длина в 15 символов.", + "L": "1" + }, + { + "Shortcode": "V6.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что пользователи могут менять свои пароли.", + "L": "1" + }, + { + "Shortcode": "V6.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что для смены пароля требуется ввести как текущий, так и новый пароль.", + "L": "1" + }, + { + "Shortcode": "V6.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что при регистрации или смене пароля введённый пароль проверяется по списку как минимум из 3000 самых популярных паролей, соответствующих политике (например, минимальной длине).", + "L": "1" + }, + { + "Shortcode": "V6.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что допускаются пароли любой структуры, без ограничений на использование определённых символов. Не должно быть требований по обязательному наличию заглавных/строчных букв, цифр или специальных символов.", + "L": "1" + }, + { + "Shortcode": "V6.2.6", + "Ordinal": 6, + "Description": "Убедитесь, что поля ввода пароля используют type=password для скрытия символов. Разрешено временное отображение всего пароля или последнего введённого символа.", + "L": "1" + }, + { + "Shortcode": "V6.2.7", + "Ordinal": 7, + "Description": "Убедитесь, что разрешены вставка (paste), использование менеджеров паролей браузера и внешних менеджеров паролей.", + "L": "1" + }, + { + "Shortcode": "V6.2.8", + "Ordinal": 8, + "Description": "Убедитесь, что пароль проверяется строго в том виде, в котором он был введён пользователем — без обрезки, изменения регистра и других модификаций.", + "L": "1" + }, + { + "Shortcode": "V6.2.9", + "Ordinal": 9, + "Description": "Убедитесь, что система позволяет использовать пароли длиной не менее 64 символов.", + "L": "2" + }, + { + "Shortcode": "V6.2.10", + "Ordinal": 10, + "Description": "Убедитесь, что пароль остаётся действительным, пока не будет скомпрометирован или не будет изменён пользователем. Приложение не должно требовать регулярной смены пароля.", + "L": "2" + }, + { + "Shortcode": "V6.2.11", + "Ordinal": 11, + "Description": "Убедитесь, что используется документированный список контекстно-зависимых слов (например, названия компаний, проектов и т.д.) для предотвращения использования легко угадываемых паролей.", + "L": "2" + }, + { + "Shortcode": "V6.2.12", + "Ordinal": 12, + "Description": "Убедитесь, что при регистрации или смене пароля проверяется, не входит ли он в список скомпрометированных (утёкших) паролей.", + "L": "2" + } + ] + }, + { + "Shortcode": "V6.3", + "Ordinal": 3, + "Name": "Общие требования к безопасности аутентификации", + "Items": [ + { + "Shortcode": "V6.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что реализованы меры защиты от атак типа credential stuffing (массовая подстановка учётных данных) и brute-force (перебор паролей), согласно документации по безопасности приложения.", + "L": "1" + }, + { + "Shortcode": "V6.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что в приложении отсутствуют или отключены учётные записи по умолчанию (например, root, admin, sa).", + "L": "1" + }, + { + "Shortcode": "V6.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что для доступа к приложению используется либо механизм многофакторной аутентификации, либо комбинация однофакторных. Для уровня L3 один из факторов должен быть аппаратным, обеспечивающим защиту от фишинга, устойчивость к компрометации и подтверждение намерения аутентификации через явное действие пользователя (например, нажатие кнопки на FIDO-ключе или телефоне). Ослабление этих требований допускается только при наличии обоснования и компенсирующих мер.", + "L": "2" + }, + { + "Shortcode": "V6.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что при наличии нескольких способов аутентификации, они все задокументированы, и для них единообразно применяются меры защиты и уровни доверия.", + "L": "2" + }, + { + "Shortcode": "V6.3.5", + "Ordinal": 5, + "Description": "Убедитесь, что пользователи получают уведомления о подозрительных попытках аутентификации (удачных и неудачных). Это может включать попытки (например, подключения) с необычного устройства или места, частично успешную MFA, попытку после долгого отсутствия или успешную аутентификацию после серии неудачных.", + "L": "3" + }, + { + "Shortcode": "V6.3.6", + "Ordinal": 6, + "Description": "Убедитесь, что email не используется ни как однофакторный, ни как многофакторный механизм аутентификации.", + "L": "3" + }, + { + "Shortcode": "V6.3.7", + "Ordinal": 7, + "Description": "Убедитесь, что пользователи получают уведомление при изменении данных аутентификации, таких как сброс пароля или изменение логина/email.", + "L": "3" + }, + { + "Shortcode": "V6.3.8", + "Ordinal": 8, + "Description": "Убедитесь, что из сообщений об ошибке, HTTP-кодов ответа или различий во времени ответа нельзя определить, существует ли пользователь с таким логином. Это правило также должно применяться к функциям регистрации и восстановления пароля.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.4", + "Ordinal": 4, + "Name": "Жизненный цикл и восстановление факторов аутентификации", + "Items": [ + { + "Shortcode": "V6.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что начальные пароли или коды активации, генерируемые системой, создаются с использованием надёжного генератора случайных чисел, соответствуют текущей политике паролей и истекают через короткий период времени либо после первого использования. Эти секреты не должны использоваться как постоянные пароли.", + "L": "1" + }, + { + "Shortcode": "V6.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что в системе отсутствуют подсказки к паролю или вопросы на знание («секретные вопросы»).", + "L": "1" + }, + { + "Shortcode": "V6.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что реализован безопасный процесс сброса забытого пароля, который не обходит активные механизмы многофакторной аутентификации.", + "L": "2" + }, + { + "Shortcode": "V6.4.4", + "Ordinal": 4, + "Description": "Убедитесь, что в случае утраты одного из факторов MFA проводится удостоверение личности (identity proofing) на том же уровне, что и при первичной регистрации.", + "L": "2" + }, + { + "Shortcode": "V6.4.5", + "Ordinal": 5, + "Description": "Убедитесь, что инструкции по обновлению истекающих механизмов аутентификации отправляются заранее, с достаточным запасом времени для выполнения замены, при необходимости с настройкой автоматических напоминаний.", + "L": "3" + }, + { + "Shortcode": "V6.4.6", + "Ordinal": 6, + "Description": "Убедитесь, что администраторы могут инициировать процесс сброса пароля, но не могут задать или выбрать новый пароль за пользователя. Это исключает ситуацию, при которой администратор знает пароль пользователя.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.5", + "Ordinal": 5, + "Name": "Общие требования к многофакторной аутентификации", + "Items": [ + { + "Shortcode": "V6.5.1", + "Ordinal": 1, + "Description": "Убедитесь, что lookup-секреты, внеполосные коды/запросы и TOTP-коды можно использовать только один раз.", + "L": "2" + }, + { + "Shortcode": "V6.5.2", + "Ordinal": 2, + "Description": "Убедитесь, что при хранении lookup-секретов с энтропией менее 112 бит (например, 19 случайных буквенно-цифровых символов или 34 случайные цифры) они хэшируются с использованием разрешённого алгоритма хеширования паролей и случайной соли минимум 32 бита. Если у секрета ≥112 бит энтропии — допустимо использовать стандартный хэш.", + "L": "2" + }, + { + "Shortcode": "V6.5.3", + "Ordinal": 3, + "Description": "Убедитесь, что lookup-секреты, коды внеполосной аутентификации и сиды для TOTP генерируются с использованием криптографически стойкого генератора случайных чисел (CSPRNG), чтобы избежать предсказуемых значений.", + "L": "2" + }, + { + "Shortcode": "V6.5.4", + "Ordinal": 4, + "Description": "Убедитесь, что lookup-секреты и внеполосные коды аутентификации имеют минимум 20 бит энтропии (достаточно, например, 4 случайных алфавитно-цифровых символов или 6 случайных цифр).", + "L": "2" + }, + { + "Shortcode": "V6.5.5", + "Ordinal": 5, + "Description": "Убедитесь, что все внеполосные запросы, коды и токены, а также TOTP-коды имеют ограниченный срок действия. Максимум для out-of-band — 10 минут, для TOTP — 30 секунд.", + "L": "2" + }, + { + "Shortcode": "V6.5.6", + "Ordinal": 6, + "Description": "Убедитесь, что любой фактор аутентификации (включая физические устройства) может быть отозван в случае кражи или утери.", + "L": "3" + }, + { + "Shortcode": "V6.5.7", + "Ordinal": 7, + "Description": "Убедитесь, что биометрические механизмы аутентификации используются только как вторичный фактор — в сочетании с «чем-то, что вы знаете» или «чем-то, что у вас есть».", + "L": "3" + }, + { + "Shortcode": "V6.5.8", + "Ordinal": 8, + "Description": "Убедитесь, что TOTP-коды проверяются по источнику времени, полученному от доверенного сервиса, а не от клиента или недоверенного источника.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.6", + "Ordinal": 6, + "Name": "Внеполосные механизмы аутентификации", + "Items": [ + { + "Shortcode": "V6.6.1", + "Ordinal": 1, + "Description": "Убедитесь, что механизмы аутентификации через телефонную сеть общего пользования (PSTN) для доставки одноразовых паролей (OTP) по телефону или SMS используются только в случае предварительной валидации номера, при этом предлагаются альтернативные более безопасные методы (например, TOTP), и пользователю сообщаются риски. Для приложений уровня L3 использование телефона и SMS недопустимо.", + "L": "2" + }, + { + "Shortcode": "V6.6.2", + "Ordinal": 2, + "Description": "Убедитесь, что внеполосные запросы, коды или токены привязаны к исходному запросу аутентификации, для которого они были сгенерированы, и не могут быть использованы повторно для других попыток.", + "L": "2" + }, + { + "Shortcode": "V6.6.3", + "Ordinal": 3, + "Description": "Убедитесь, что внеполосные механизмы на основе кода защищены от атак методом подбора (brute force) путём применения ограничения частоты запросов (rate limiting). Также рекомендуется использовать коды с энтропией не менее 64 бит.", + "L": "2" + }, + { + "Shortcode": "V6.6.4", + "Ordinal": 4, + "Description": "Убедитесь, что при использовании push-уведомлений для MFA применяется ограничение частоты (rate limiting), чтобы предотвратить атаки push-бомбинга. Также может помочь механизм сопоставления номеров (number matching).", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.7", + "Ordinal": 7, + "Name": "Криптографические механизмы аутентификации", + "Items": [ + { + "Shortcode": "V6.7.1", + "Ordinal": 1, + "Description": "Убедитесь, что сертификаты, используемые для проверки криптографических утверждений об аутентификации, хранятся таким образом, чтобы исключить возможность их модификации.", + "L": "3" + }, + { + "Shortcode": "V6.7.2", + "Ordinal": 2, + "Description": "Убедитесь, что nonce (случайная строка), используемая в процессе вызова, имеет длину не менее 64 бит и является статистически уникальной или уникальной на протяжении всего срока службы криптографического устройства.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.8", + "Ordinal": 8, + "Name": "Аутентификация с использованием провайдера идентификаций (IdP)", + "Items": [ + { + "Shortcode": "V6.8.1", + "Ordinal": 1, + "Description": "Убедитесь, что при поддержке несколькими IdP, невозможно подделать личность пользователя через другой IdP (например, с тем же user ID). Стандартным способом защиты является регистрация пользователя с использованием сочетания ID самого IdP (в качестве пространства имён) и пользовательского ID внутри IdP.", + "L": "2" + }, + { + "Shortcode": "V6.8.2", + "Ordinal": 2, + "Description": "Убедитесь, что наличие и целостность цифровой подписи в утверждениях аутентификации (например, в JWT или SAML) всегда проверяются, а неподписанные или недействительные утверждения отклоняются.", + "L": "2" + }, + { + "Shortcode": "V6.8.3", + "Ordinal": 3, + "Description": "Убедитесь, что SAML-утверждения обрабатываются только один раз в течение периода их действия, чтобы исключить атаки воспроизведения (replay attacks).", + "L": "2" + }, + { + "Shortcode": "V6.8.4", + "Ordinal": 4, + "Description": "Убедитесь, что если приложение использует внешний поставщик идентификации (IdP) и для определенных функций требуется особый уровень, метод или срок действия аутентификации, то приложение использует данные, возвращаемые IdP, для проверки этих условий. Например, при использовании OIDC можно проверить значения полей ID Token — acr, amr, auth_time (если они есть). Если IdP не предоставляет эти данные, приложение должно иметь документированный план действий по умолчанию, предполагающий использование минимально допустимой силы аутентификации (например, одноступенчатая — логин и пароль).", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V7", + "Ordinal": 7, + "ShortName": "Session", + "Name": "Управление сессиями", + "Items": [ + { + "Shortcode": "V7.1", + "Ordinal": 1, + "Name": "Документация по управлению сессиями", + "Items": [ + { + "Shortcode": "V7.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что тайм-аут бездействия и абсолютное максимальное время жизни сессии задокументированы, соответствуют другим контрольным мерам и сопровождаются обоснованием любых отклонений от требований повторной аутентификации NIST SP 800-63B.", + "L": "2" + }, + { + "Shortcode": "V7.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что документация определяет допустимое количество одновременных (параллельных) сессий для одного аккаунта, а также поведение системы и действия при достижении этого лимита.", + "L": "2" + }, + { + "Shortcode": "V7.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что все системы, создающие и управляющие сессиями пользователей в рамках федеративной идентификации (например, SSO), задокументированы вместе с механизмами координации сроков действия сессий, условий завершения и случаев, требующих повторной аутентификации.", + "L": "2" + } + ] + }, + { + "Shortcode": "V7.2", + "Ordinal": 2, + "Name": "Базовая безопасность сессий", + "Items": [ + { + "Shortcode": "V7.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что все проверки сессионных токенов выполняются на доверенной серверной стороне.", + "L": "1" + }, + { + "Shortcode": "V7.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение использует либо автономные токены, либо ссылочные токены, которые генерируются динамически, не используя статические API-секреты или ключи.", + "L": "1" + }, + { + "Shortcode": "V7.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что ссылочные токены являются уникальными, создаются с использованием криптографически безопасного генератора псевдослучайных чисел (CSPRNG) и обладают энтропией не менее 128 бит.", + "L": "1" + }, + { + "Shortcode": "V7.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что при аутентификации пользователя (включая повторную) создается новый токен сессии, а текущий — аннулируется.", + "L": "1" + } + ] + }, + { + "Shortcode": "V7.3", + "Ordinal": 3, + "Name": "Тайм-ауты сессии", + "Items": [ + { + "Shortcode": "V7.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что есть тайм-аут бездействия, после которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.", + "L": "2" + }, + { + "Shortcode": "V7.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что установлено абсолютное максимальное время жизни сессии, по истечении которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.", + "L": "2" + } + ] + }, + { + "Shortcode": "V7.4", + "Ordinal": 4, + "Name": "Завершение сессий", + "Items": [ + { + "Shortcode": "V7.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что после завершения сессии (logout, истечение срока) дальнейшее её использование невозможно. Для ссылочных токенов или сессий с сохранением состояния это означает аннулирование на сервере. Для self-contained токенов необходимо реализовать механизм отзыва, например, список отозванных токенов, проверку времени выпуска или ротацию ключей подписи для каждого пользователя.", + "L": "1" + }, + { + "Shortcode": "V7.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что при удалении или отключении пользователя все активные сессии немедленно завершаются.", + "L": "1" + }, + { + "Shortcode": "V7.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что после изменения или удаления факторов аутентификации (например, смена пароля или MFA) приложение предлагает завершить все другие активные сессии.", + "L": "2" + }, + { + "Shortcode": "V7.4.4", + "Ordinal": 4, + "Description": "Убедитесь, что на всех страницах, требующих аутентификации, имеется простой и видимый способ выхода.", + "L": "2" + }, + { + "Shortcode": "V7.4.5", + "Ordinal": 5, + "Description": "Убедитесь, что администраторы могут завершать активные сессии конкретного пользователя или всех пользователей.", + "L": "2" + } + ] + }, + { + "Shortcode": "V7.5", + "Ordinal": 5, + "Name": "Защита от злоупотреблений сессией", + "Items": [ + { + "Shortcode": "V7.5.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение требует полной повторной аутентификации перед изменением чувствительных атрибутов аккаунта, которые могут влиять на аутентификацию (например, email, номер телефона, настройки MFA или данных восстановления доступа).", + "L": "2" + }, + { + "Shortcode": "V7.5.2", + "Ordinal": 2, + "Description": "Убедитесь, что пользователь может просматривать и (после повторной аутентификации хотя бы по одному фактору) завершать активные сессии.", + "L": "2" + }, + { + "Shortcode": "V7.5.3", + "Ordinal": 3, + "Description": "Убедитесь, что перед выполнением критически важных операций приложение требует повторной аутентификации (по крайней мере, одного фактора) или дополнительной проверки.", + "L": "3" + } + ] + }, + { + "Shortcode": "V7.6", + "Ordinal": 6, + "Name": "Федеративная повторная аутентификация", + "Items": [ + { + "Shortcode": "V7.6.1", + "Ordinal": 1, + "Description": "Убедитесь, что срок действия и завершение сессий между RP и IdP соответствуют документации и включают повторную аутентификацию, если достигнут максимальный допустимый интервал между событиями аутентификации.", + "L": "2" + }, + { + "Shortcode": "V7.6.2", + "Ordinal": 2, + "Description": "Убедитесь, что создание сессии требует согласия пользователя или явного действия, предотвращающего несанкционированное создание сессий без участия пользователя.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V8", + "Ordinal": 8, + "ShortName": "Authorization", + "Name": "Авторизация", + "Items": [ + { + "Shortcode": "V8.1", + "Ordinal": 1, + "Name": "Документация по авторизации", + "Items": [ + { + "Shortcode": "V8.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне функций и на уровне данных на основе прав субъекта и атрибутов ресурса.", + "L": "1" + }, + { + "Shortcode": "V8.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне полей (как на чтение, так и на запись) на основе прав субъекта и атрибутов ресурса. Эти правила могут зависеть от других атрибутов объекта данных, например, статуса.", + "L": "2" + }, + { + "Shortcode": "V8.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что документация определяет, какие атрибуты окружения и контекста (например, время суток, IP-адрес, местоположение, устройство) используются приложением для принятия решений в области аутентификации и авторизации.", + "L": "3" + }, + { + "Shortcode": "V8.1.4", + "Ordinal": 4, + "Description": "Убедитесь, что документация по аутентификации и авторизации определяет, как используются факторы окружения и контекста в принятии решений, наряду с правилами доступа к функциям, данным и полям. Документация должна содержать оцениваемые атрибуты, пороговые значения риска, действия (разрешить, отказать, повысить уровень аутентификации и др.).", + "L": "3" + } + ] + }, + { + "Shortcode": "V8.2", + "Ordinal": 2, + "Name": "Архитектура авторизации", + "Items": [ + { + "Shortcode": "V8.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение обеспечивает доступ на уровне функций (function-level) только субъектам с явными разрешениями.", + "L": "1" + }, + { + "Shortcode": "V8.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение обеспечивает доступ на уровне данных (data-specific) только тем субъектам, которым явно предоставлены права к определённым элементам данных, чтобы предотвратить IDOR (Insecure Direct Object Reference) и BOLA-уязвимости (Broken Object Level Authorization).", + "L": "1" + }, + { + "Shortcode": "V8.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение обеспечивает доступ на уровне полей (field-level) только тем субъектам, которым явно предоставлены права к определённым полям, чтобы предотвратить BOPLA (Broken Object Property Level Authorization).", + "L": "2" + }, + { + "Shortcode": "V8.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что реализованы адаптивные меры безопасности, основанные на атрибутах окружения и контекста субъекта (время, местоположение, IP, устройство), которые используются для принятия решений об аутентификации и авторизации, как это определено в документации приложения. Эти меры должны применяться как при попытке субъекта начать новую сессию, так и во время существующей сессии.", + "L": "3" + } + ] + }, + { + "Shortcode": "V8.3", + "Ordinal": 3, + "Name": "Авторизация на уровне операций", + "Items": [ + { + "Shortcode": "V8.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что правила авторизации реализуются на доверенном сервисном уровне и не зависят от элементов, которые может контролировать клиент (например, JavaScript на стороне клиента).", + "L": "1" + }, + { + "Shortcode": "V8.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что изменения значений, влияющих на авторизацию, применяются немедленно. Если это невозможно (например, при использовании автономных токенов), должны быть реализованы компенсирующие меры: оповещения о попытке несанкционированного действия и откат изменений. Обратите внимание, что данный подход не предотвращает утечку информации.", + "L": "3" + }, + { + "Shortcode": "V8.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что доступ к объекту осуществляется на основе прав субъекта, инициировавшего запрос, а не прав промежуточного сервиса, действующего от его имени. Например, если пользователь обращается к веб-сервису с автономным токеном для аутентификации, а сервис затем запрашивает данные у другого сервиса, второй сервис должен использовать токен пользователя, а не токен первого сервиса для принятия решения о доступе.", + "L": "3" + } + ] + }, + { + "Shortcode": "V8.4", + "Ordinal": 4, + "Name": "Прочие аспекты авторизации", + "Items": [ + { + "Shortcode": "V8.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что в мультитенантных приложениях реализованы механизмы, предотвращающие действия потребителя в отношении арендаторов, к которым у него нет доступа.", + "L": "2" + }, + { + "Shortcode": "V8.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что доступ к административным интерфейсам защищён несколькими уровнями контроля, включая непрерывную проверку личности, контроль защищённости устройства и анализ контекстных рисков. Недостаточно опираться только на IP-адрес или доверенные устройства.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V9", + "Ordinal": 9, + "ShortName": "Self", + "Name": "Автономные токены", + "Items": [ + { + "Shortcode": "V9.1", + "Ordinal": 1, + "Name": "Источник токена и его целостность", + "Items": [ + { + "Shortcode": "V9.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что автономные токены проверяются на целостность с помощью цифровой подписи или MAC, прежде чем доверять их содержимому.", + "L": "1" + }, + { + "Shortcode": "V9.1.2", + "Ordinal": 2, + "Description": "Проверяйте, что автономные токены создаются и проверяются исключительно с помощью алгоритмов из списка допустимых в данном контексте. Список допустимых алгоритмов должен включать только разрешенные алгоритмы (желательно либо только симметричные, либо только асимметричные) и ни в коем случае не содержать алгоритм None. Если необходимо поддерживать оба типа алгоритмов, потребуются дополнительные средства контроля для предотвращения путаницы с ключами (key confusion).", + "L": "1" + }, + { + "Shortcode": "V9.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что ключи, используемые для проверки автономных токенов, получены из доверенных, предварительно настроенных источников. Это предотвращает возможность указания злоумышленниками ненадёжных источников и ключей. Для JWT и других JWS структур заголовки 'jku', 'x5u' и 'jwk' должны проверяться по белому списку.", + "L": "1" + } + ] + }, + { + "Shortcode": "V9.2", + "Ordinal": 2, + "Name": "Содержимое токена", + "Items": [ + { + "Shortcode": "V9.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что при указанном сроке действия токен и его содержимое принимаются только в том случае, если срок действия токена не истёк. Например, для JWT нужно проверить поля 'nbf' и 'exp'.", + "L": "1" + }, + { + "Shortcode": "V9.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что сервис, принимающий токен, проверяет его тип и соответствие назначению перед обработкой содержимого токена. Например, для принятия решений об авторизации могут быть приняты только Access Token, а для подтверждения аутентификации пользователя — только ID Token.", + "L": "2" + }, + { + "Shortcode": "V9.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что сервис принимает только токены, предназначенные для использования с этим сервисом (audience). Для JWT это можно сделать, проверив наличие утверждения «aud» по белому списку, определенному в сервисе.", + "L": "2" + }, + { + "Shortcode": "V9.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что, если эмитент токенов использует один и тот же закрытый ключ для выпуска токенов различным сервисам (audiences), выпущенные токены содержат явное указание целевых сервисов. Это предотвратит повторное использования токенов в не предназначенных для них сервисах. Если идентификатор сервиса (audience identifier) назначается динамически, эмитент токенов должен проверить audiences для исключения подмены получателей (audience impersonation).", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V10", + "Ordinal": 10, + "ShortName": "OAuth", + "Name": "OAuth и OIDC", + "Items": [ + { + "Shortcode": "V10.1", + "Ordinal": 1, + "Name": "Общие требования безопасности OAuth и OIDC", + "Items": [ + { + "Shortcode": "V10.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что токены передаются только тем компонентам, которым они действительно необходимы. Например, при использовании схемы backend-for-frontend для браузерных JavaScript-приложений, access и refresh токены должны быть доступны только на backend.", + "L": "2" + }, + { + "Shortcode": "V10.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что клиент принимает значения от авторизационного сервера (например, authorization code или ID Token) только если они получены в результате авторизационного потока, инициированного в той же сессии пользовательского агента и в рамках той же транзакции. Для этого клиентские секреты, такие как proof key для code exchange (PKCE) — 'code_verifier', 'state' или OIDC 'nonce' — должны быть непредсказуемыми, специфичными для транзакции и надежно привязанными как к клиенту, так и к сессии пользовательского агента, в которой началась транзакция.", + "L": "2" + } + ] + }, + { + "Shortcode": "V10.2", + "Ordinal": 2, + "Name": "Клиент OAuth", + "Items": [ + { + "Shortcode": "V10.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что если используется механизм authorization code flow, OAuth клиент защищён от CSRF, вызывающих запросы токенов либо за счёт использования механизма proof key for code exchange (PKCE), либо за счёт проверки параметра 'state', который был отправлен в запросе авторизации.", + "L": "2" + }, + { + "Shortcode": "V10.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что если OAuth клиент может взаимодействовать с более чем одним сервером авторизации, у него есть защита от атак смешивания (mix-up attacks). Например, клиент должен требовать, чтобы сервер авторизации возвращал параметр 'iss' и проверять его в ответах на авторизацию и токены.", + "L": "2" + }, + { + "Shortcode": "V10.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что OAuth клиент запрашивает только необходимые области доступа (scopes) или другие параметры авторизации в запросах к серверу авторизации.", + "L": "3" + } + ] + }, + { + "Shortcode": "V10.3", + "Ordinal": 3, + "Name": "Сервер ресурсов OAuth", + "Items": [ + { + "Shortcode": "V10.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что сервер ресурсов принимает только те access токены, которые предназначены для использования с этим сервисом (свойство audience). Эта принадлежность сервису может быть включена в структурированный access токен (например, в поле 'aud' в JWT) или проверяться через endpoint интроспекции токена.", + "L": "2" + }, + { + "Shortcode": "V10.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что сервер ресурсов принимает решения по авторизации на основе claims из access токена, определяющих делегированную авторизацию. Если присутствуют claims, такие как 'sub', 'scope' и 'authorization_details', они должны участвовать в принятии решения.", + "L": "2" + }, + { + "Shortcode": "V10.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что если для принятия решения по контролю доступа необходимо однозначно идентифицировать пользователя из access токена (JWT или ответа интроспекции), сервер ресурсов использует claims, которые не могут быть переприсвоены другим пользователям. Обычно это комбинация claims 'iss' и 'sub'.", + "L": "2" + }, + { + "Shortcode": "V10.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что если сервер ресурсов требует определённой силы аутентификации, методов или свежести аутентификации, он проверяет, что предъявленный access токен удовлетворяет этим требованиям. Например, при наличии, могут использоваться claims OIDC 'acr', 'amr' и 'auth_time'.", + "L": "2" + }, + { + "Shortcode": "V10.3.5", + "Ordinal": 5, + "Description": "Убедитесь, что сервер ресурсов предотвращает использование украденных access токенов или их повторное использование (replay) неавторизованными лицами, требуя access токены с подтверждением отправителя — например, Mutual TLS для OAuth 2 или OAuth 2 Demonstration of Proof of Possession (DPoP).", + "L": "3" + } + ] + }, + { + "Shortcode": "V10.4", + "Ordinal": 4, + "Name": "Сервер авторизации OAuth", + "Items": [ + { + "Shortcode": "V10.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что сервер авторизации проверяет URI перенаправления (redirect URI), сверяя его с заранее зарегистрированным списком разрешённых URI для данного клиента (allowlist), используя точное сравнение строк.", + "L": "1" + }, + { + "Shortcode": "V10.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что если сервер авторизации возвращает authorization code в ответе авторизации, этот код может быть использован только один раз для запроса токена. При втором валидном запросе с уже использованным кодом сервер должен отклонить запрос и отозвать любые токены, связанные с этим кодом.", + "L": "1" + }, + { + "Shortcode": "V10.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что authorization code имеет короткое время жизни. Максимальная продолжительность — до 10 минут для приложений L1 и L2 и до 1 минуты для приложений L3.", + "L": "1" + }, + { + "Shortcode": "V10.4.4", + "Ordinal": 4, + "Description": "Убедитесь, что сервер авторизации для конкретного клиента разрешает использование только тех типов авторизации, которые необходимы этому клиенту. Обратите внимание, что тип авторизации Implicit flow и Resource Owner Password Credentials flow больше не должны использоваться.", + "L": "1" + }, + { + "Shortcode": "V10.4.5", + "Ordinal": 5, + "Description": "Убедитесь, что сервер авторизации предотвращает атаки повторного использования refresh токенов для публичных клиентов, предпочтительно используя sender-constrained refresh токены, такие как DPoP или сертификат-связанные токены с mutual TLS (mTLS). Для L1 и L2 допускается ротация refresh токенов с обязательной их инвалидацией после использования. Если используется ротация, сервер должен отозвать все refresh токены при попытке использовать уже инвалидированный токен.", + "L": "1" + }, + { + "Shortcode": "V10.4.6", + "Ordinal": 6, + "Description": "Убедитесь, что при использовании типа авторизации «Authorization Code» сервер предотвращает атаки перехвата authorization code, требуя Proof Key for Code Exchange (PKCE). В запросах авторизации сервер должен требовать валидное значение 'code_challenge' и не принимать 'code_challenge_method' со значением 'plain'. В запросах токена обязательно валидировать параметр 'code_verifier'.", + "L": "2" + }, + { + "Shortcode": "V10.4.7", + "Ordinal": 7, + "Description": "Убедитесь, что если сервер авторизации поддерживает динамическую регистрацию клиентов без аутентификации, он минимизирует риски вредоносных клиентов. Сервер должен валидировать метаданные клиента (например, зарегистрированные URI), обеспечивать согласие пользователя и предупреждать пользователя перед обработкой запроса авторизации от недоверенного клиента.", + "L": "2" + }, + { + "Shortcode": "V10.4.8", + "Ordinal": 8, + "Description": "Убедитесь, что refresh токены имеют абсолютный срок действия, включая случаи, когда применяется скользящее время истечения срока.", + "L": "2" + }, + { + "Shortcode": "V10.4.9", + "Ordinal": 9, + "Description": "Убедитесь, что пользователи могут отзывать refresh токены и reference access токены через пользовательский интерфейс сервера авторизации для снижения риска от вредоносных клиентов или кражи токенов.", + "L": "2" + }, + { + "Shortcode": "V10.4.10", + "Ordinal": 10, + "Description": "Убедитесь, что конфиденциальный клиент аутентифицируется при взаимодействии с сервером авторизации через backchannel, например при запросах токена, pushed authorization requests (PAR) и запросах на отзыв токенов.", + "L": "2" + }, + { + "Shortcode": "V10.4.11", + "Ordinal": 11, + "Description": "Убедитесь, что конфигурация сервера авторизации назначает OAuth клиенту только необходимые области доступа (scopes).", + "L": "2" + }, + { + "Shortcode": "V10.4.12", + "Ordinal": 12, + "Description": "Убедитесь, что для конкретного клиента сервер авторизации разрешает только те значения 'response_mode', которые необходимы этому клиенту. Например, сервер должен валидировать это значение против ожидаемых или использовать pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).", + "L": "3" + }, + { + "Shortcode": "V10.4.13", + "Ordinal": 13, + "Description": "Убедитесь, что грант типа 'code' всегда используется вместе с pushed authorization requests (PAR).", + "L": "3" + }, + { + "Shortcode": "V10.4.14", + "Ordinal": 14, + "Description": "Убедитесь, что сервер авторизации выдаёт только sender-constrained (Proof-of-Possession) access токены, либо с сертификат-связанными токенами через mutual TLS (mTLS), либо DPoP-bound токены (Demonstration of Proof of Possession).", + "L": "3" + }, + { + "Shortcode": "V10.4.15", + "Ordinal": 15, + "Description": "Убедитесь, что для серверного клиента (не выполняющегося на устройстве конечного пользователя) сервер авторизации проверяет, что значение параметра 'authorization_details' исходит из клиентского backend и что пользователь не изменял его. Например, это достигается использованием pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).", + "L": "3" + }, + { + "Shortcode": "V10.4.16", + "Ordinal": 16, + "Description": "Убедитесь, что клиент является конфиденциальным и сервер авторизации требует использования сильных методов аутентификации клиента (основанных на криптографии с открытым ключом и устойчивых к атакам повторного воспроизведения), таких как mutual TLS ('tls_client_auth', 'self_signed_tls_client_auth') или private key JWT ('private_key_jwt').", + "L": "3" + } + ] + }, + { + "Shortcode": "V10.5", + "Ordinal": 5, + "Name": "Клиент OIDC", + "Items": [ + { + "Shortcode": "V10.5.1", + "Ordinal": 1, + "Description": "Убедитесь, что клиент (relying party) защищается от повторного использования ID Token (replay-атак). Например, это достигается проверкой того, что значение 'nonce' в ID Token совпадает со значением 'nonce', отправленным в запросе аутентификации провайдеру OpenID (authorization server).", + "L": "2" + }, + { + "Shortcode": "V10.5.2", + "Ordinal": 2, + "Description": "Убедитесь, что клиент однозначно идентифицирует пользователя по утверждениям (claims) ID Token, обычно это 'sub', который не может быть переназначен другому пользователю (в пределах конкретного провайдера идентификации).", + "L": "2" + }, + { + "Shortcode": "V10.5.3", + "Ordinal": 3, + "Description": "Убедитесь, что клиент отклоняет попытки злоумышленного сервера авторизации выдавать себя за другой сервер авторизации через метаданные сервера авторизации. Клиент должен отклонить метаданные, если URL издателя (issuer) в метаданных не совпадает точно с преднастроенным URL издателя, ожидаемым клиентом.", + "L": "2" + }, + { + "Shortcode": "V10.5.4", + "Ordinal": 4, + "Description": "Убедитесь, что клиент проверяет, что ID Token предназначен для него (проверка audience), сравнивая значение 'aud' в токене с 'client_id' клиента.", + "L": "2" + }, + { + "Shortcode": "V10.5.5", + "Ordinal": 5, + "Description": "Убедитесь, что при использовании OIDC back-channel logout клиент снижает риск отказа в обслуживании, вызванный принудительным выходом из системы и путаницей между разными типами JWT (cross-JWT confusion) в процессе логаута. Клиент должен проверить, что токен выхода корректно типизирован со значением 'logout+jwt', содержит claim 'event' с правильным именем участника и не содержит 'nonce'. Также рекомендуется установить короткий срок действия токена (например, 2 минуты).", + "L": "2" + } + ] + }, + { + "Shortcode": "V10.6", + "Ordinal": 6, + "Name": "Провайдер OpenID", + "Items": [ + { + "Shortcode": "V10.6.1", + "Ordinal": 1, + "Description": "Убедитесь, что провайдер OpenID допускает только значения 'code', 'ciba', 'id_token' или 'id_token code' для параметра response mode. При этом предпочтение отдаётся 'code' по сравнению с 'id_token code' (гибридный поток OIDC), а значение 'token' (любой Implicit flow) не должно использоваться.", + "L": "2" + }, + { + "Shortcode": "V10.6.2", + "Ordinal": 2, + "Description": "Убедитесь, что провайдер OpenID предотвращает отказ в обслуживании (DoS) через принудительный выход (logout), запрашивая явное подтверждение от конечного пользователя или, если применимо, проверяя параметры в запросе выхода (инициированном relying party), например параметр 'id_token_hint'.", + "L": "2" + } + ] + }, + { + "Shortcode": "V10.7", + "Ordinal": 7, + "Name": "Управление согласием", + "Items": [ + { + "Shortcode": "V10.7.1", + "Ordinal": 1, + "Description": "Убедитесь, что авторизационный сервер обеспечивает получение согласия пользователя для каждого запроса авторизации. Если личность клиента не может быть подтверждена, сервер авторизации всегда должен явно запрашивать согласие пользователя.", + "L": "2" + }, + { + "Shortcode": "V10.7.2", + "Ordinal": 2, + "Description": "Убедитесь, что при запросе согласия пользователя авторизационный сервер предоставляет достаточную и понятную информацию о том, на что даётся согласие. При необходимости это должно включать характер запрашиваемых разрешений (обычно основанных на scope, ресурсном сервере, деталях авторизации Rich Authorization Requests (RAR)), идентификацию авторизованного приложения и срок действия этих разрешений.", + "L": "2" + }, + { + "Shortcode": "V10.7.3", + "Ordinal": 3, + "Description": "Убедитесь, что пользователь может просматривать, изменять и отзывать согласия, которые он предоставил, через авторизационный сервер.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V11", + "Ordinal": 11, + "ShortName": "Cryptography", + "Name": "Криптография", + "Items": [ + { + "Shortcode": "V11.1", + "Ordinal": 1, + "Name": "Инвентаризация и документирование криптографии", + "Items": [ + { + "Shortcode": "V11.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что задокументирована политика управления криптографическими ключами и описан их жизненный цикл в соответствии со стандартом управления ключей, таким как NIST SP 800-57. Убедитесь, что ключи известны только тем сущностям, которым они должны быть доступны (например, ключи не передавались более чем двум участникам для общих секретов и более чем одному участнику для приватных ключей).", + "L": "2" + }, + { + "Shortcode": "V11.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что проводится инвентаризация криптографических средств, которая непрерывно поддерживается, регулярно обновляется и включает все криптографические ключи, алгоритмы и сертификаты, используемые в приложении. Также должна быть задокументирована информация о том, где ключи могут и не могут использоваться в системе, а также какие типы данных могут и не могут быть защищены с помощью этих ключей.", + "L": "2" + }, + { + "Shortcode": "V11.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что используются механизмы обнаружения криптографии для идентификации всех случаев применения криптографии в системе , включая операции шифрования, хеширования и цифровой подписи.", + "L": "3" + }, + { + "Shortcode": "V11.1.4", + "Ordinal": 4, + "Description": "Убедитесь, что ведётся и поддерживается инвентаризация криптографических средств. В неё должен входить документированный план, описывающий переход на новые криптографические стандарты, такие как постквантовая криптография, чтобы своевременно реагировать на будущие угрозы.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.2", + "Ordinal": 2, + "Name": "Безопасная реализация криптографии", + "Items": [ + { + "Shortcode": "V11.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что для криптографических операций используются утвержденные в индустрии реализации (включая библиотеки и аппаратные реализации).", + "L": "2" + }, + { + "Shortcode": "V11.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что архитектура приложения поддерживает быструю реконфигурацию, усовершенствование или смену в любой момент случайных чисел, аутентифицированного шифрования, MAC, алгоритмов хеширования, длин ключей, количества раундов, шифров и режимов шифрования для защиты от криптографических атак. Также должна поддерживаться возможность смены ключей, паролей и повторного шифрования данных. Это позволит беспрепятственно перейти на постквантовую криптографию (PQC), как только станут широко доступны высоконадёжные реализации одобренных схем или стандартов PQC.", + "L": "2" + }, + { + "Shortcode": "V11.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что все криптографические примитивы используют как минимум 128-бит стойкости с учетом алгоритма, размера ключа и конфигурации. Например, 256-битный ECC ключ обеспечивает примерно 128 бит безопасности, тогда как для достижения того же уровня безопасности в RSA требуется ключ длиной 3072 бита.", + "L": "2" + }, + { + "Shortcode": "V11.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что все криптографические операции выполняются за константное время, без использования «short-circuit» операций в сравнениях, вычислениях, возвратах функций для избежания утечек информации.", + "L": "3" + }, + { + "Shortcode": "V11.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что все криптографические модули обеспечивают безопасное завершение работы при ошибках, а обработка ошибок реализована таким образом, чтобы не создавать уязвимостей, например, таких как атаки Padding Oracle.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.3", + "Ordinal": 3, + "Name": "Алгоритмы шифрования", + "Items": [ + { + "Shortcode": "V11.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что не используются небезопасные режимы блочного шифрования (н-р, ECB) и слабые схемы дополнения (padding) (н-р, PKCS#1 v1.5).", + "L": "1" + }, + { + "Shortcode": "V11.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что используются только утверждённые шифры и режимы, такие как AES с GCM.", + "L": "1" + }, + { + "Shortcode": "V11.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что зашифрованные данные защищены от несанкционированного изменения, предпочтительно с использованием утверждённого метода аутентифицированного шифрования или путём комбинирования утверждённого метода шифрования с утверждённым алгоритмом MAC.", + "L": "2" + }, + { + "Shortcode": "V11.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что случайные числа (nonce), векторы инициализации (IV) и другие одноразовые числа не используются более одного раза для одной и той же пары ключа шифрования и элемента данных. Метод их генерации должен соответствовать требованиям используемого алгоритма.", + "L": "3" + }, + { + "Shortcode": "V11.3.5", + "Ordinal": 5, + "Description": "Убедитесь, что любая комбинация алгоритма шифрования и алгоритма MAC работает в режиме encrypt-then-MAC (EtM).", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.4", + "Ordinal": 4, + "Name": "Хеширование и функции на основе хеширования", + "Items": [ + { + "Shortcode": "V11.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что только утвержденные хэш-функции используются для стандартных сценариев использования в криптографии, включая цифровую подпись, HMAC, KDF, генерацию случайных чисел. Запрещено использовать неустойчивые хэш-функции, (н-р, MD5) для любого использования в криптографии.", + "L": "1" + }, + { + "Shortcode": "V11.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что пароли хранятся с использованием утверждённой, вычислительно затратной функции генерации ключа (также известной как «функция хеширования паролей»), с параметрами, настроенными в соответствии с актуальными рекомендациями. Настройки должны обеспечивать баланс между безопасностью и производительностью, чтобы сделать атаки перебором достаточно сложными для требуемого уровня безопасности.", + "L": "2" + }, + { + "Shortcode": "V11.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что хэш-функции, используемые в формировании цифровой подписи, как часть аутентификации и целостности данных, устойчивы к коллизиям и имеют достаточную длину.", + "L": "2" + }, + { + "Shortcode": "V11.4.4", + "Ordinal": 4, + "Description": "Убедитесь, что приложение использует утвержденную функцию генерации ключа с использованием параметров расширения ключа (key stretching) при генерации ключа из пароля. Параметры должны быть сбалансированы с точки зрения безопасности, производительности и устойчивости к атакам полного перебора при компрометации результирующего криптографического ключа.", + "L": "2" + } + ] + }, + { + "Shortcode": "V11.5", + "Ordinal": 5, + "Name": "Случайные значения", + "Items": [ + { + "Shortcode": "V11.5.1", + "Ordinal": 1, + "Description": "Убедитесь, что все случайные числа и строки, которые должны быть непредсказуемы, должны быть сгенерированы с помощью CSPRNG и иметь хотя бы 128 бит энтропии. Учтите, что UUID не удовлетворяют данному условию.", + "L": "2" + }, + { + "Shortcode": "V11.5.2", + "Ordinal": 2, + "Description": "Убедитесь, что механизм генерации случайных чисел является надежным даже при высокой нагрузке.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.6", + "Ordinal": 6, + "Name": "Криптография с публичным ключом", + "Items": [ + { + "Shortcode": "V11.6.1", + "Ordinal": 1, + "Description": "Убедитесь, что только утвержденные криптографические алгоритмы и режимы операций используются для генерации ключа и инициализации случайного значения для его генерации (seeding), а также для генерации цифровой подписи и верификации. Алгоритмы генерации ключей не должны генерировать небезопасные ключи уязвимые к известным атакам, например, ключи RSA уязвимы к факторизации Ферма.", + "L": "2" + }, + { + "Shortcode": "V11.6.2", + "Ordinal": 2, + "Description": "Убедитесь, что для обмена ключами используются утверждённые криптографические алгоритмы (например, Диффи-Хеллман) с особым вниманием к обеспечению использования безопасных параметров. Это предотвратит атаки на процесс установления ключа, которые могут привести к атакам «человек посередине» или криптографическим взломам.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.7", + "Ordinal": 7, + "Name": "Шифрование данных в процессе использования", + "Items": [ + { + "Shortcode": "V11.7.1", + "Ordinal": 1, + "Description": "Убедитесь, что используется полное шифрование памяти, которое защищает конфиденциальные данные во время их использования, предотвращая доступ к ним неавторизованных пользователей или процессов.", + "L": "3" + }, + { + "Shortcode": "V11.7.2", + "Ordinal": 2, + "Description": "Убедитесь, что минимизация данных обеспечивает раскрытие минимально необходимого объёма данных во время обработки, а также что данные шифруются сразу после использования или как можно скорее.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V12", + "Ordinal": 12, + "ShortName": "Secure", + "Name": "Безопасная коммуникация", + "Items": [ + { + "Shortcode": "V12.1", + "Ordinal": 1, + "Name": "Общие рекомендации по безопасности TLS", + "Items": [ + { + "Shortcode": "V12.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что включены только актуальные и рекомендуемые версии протокола TLS, такие как TLS 1.2 и TLS 1.3. Наиболее свежая версия TLS должна быть выбрана как предпочтительная.", + "L": "1" + }, + { + "Shortcode": "V12.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что включены рекомендуемые шифронаборы (cipher suites), предпочтение также стоит отдать самому сильному шифронабору. L3 приложения должны поддерживать только те наборы шифров (cipher suites), которые обеспечивают прямую (forward) секретность. Пояснение: Прямая секретность (Forward Secrecy, FS) — это криптографическая особенность, при которой сессионные ключи уникальны для каждой сессии и не зависят от долгосрочных ключей. Это гарантирует, что даже при компрометации долгосрочного ключа злоумышленник не сможет расшифровать ранее перехваченные зашифрованные сессии.", + "L": "2" + }, + { + "Shortcode": "V12.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение проверяет доверенность клиентских сертификатов mTLS, прежде чем использовать идентификацию по сертификату для аутентификации или авторизации.", + "L": "2" + }, + { + "Shortcode": "V12.1.4", + "Ordinal": 4, + "Description": "Убедитесь, что включена и настроена правильная проверка отзыва сертификатов, такая как Online Certificate Status Protocol (OCSP) Stapling.", + "L": "3" + }, + { + "Shortcode": "V12.1.5", + "Ordinal": 5, + "Description": "Убедитесь, что в настройках TLS приложения включена функция Encrypted Client Hello (ECH) для предотвращения раскрытия конфиденциальных метаданных, таких как Server Name Indication (SNI), во время процесса TLS-рукопожатия.", + "L": "3" + } + ] + }, + { + "Shortcode": "V12.2", + "Ordinal": 2, + "Name": "HTTPS коммуникация с внешними сервисами", + "Items": [ + { + "Shortcode": "V12.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что для всех соединений между клиентом и внешними HTTP-сервисами используется TLS и не происходит отката к небезопасным или незашифрованным протоколам.", + "L": "1" + }, + { + "Shortcode": "V12.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что внешние сервисы используют публично доверенные TLS-сертификаты.", + "L": "1" + } + ] + }, + { + "Shortcode": "V12.3", + "Ordinal": 3, + "Name": "Общая безопасность межсервисного взаимодействия", + "Items": [ + { + "Shortcode": "V12.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что для всех входящих и исходящих соединений приложения используется зашифрованный протокол, например TLS, включая системы мониторинга, инструменты управления, удалённый доступ и SSH, промежуточное ПО, базы данных, мейнфреймы, партнёрские системы и внешние API. Сервер не должен допускать откат к небезопасным или незашифрованным протоколам.", + "L": "2" + }, + { + "Shortcode": "V12.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что TLS-клиент проверяет сертификат сервера до установления защищенного соединения с TLS-сервером.", + "L": "2" + }, + { + "Shortcode": "V12.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что все внутренние HTTP-взаимодействия между компонентами приложения используют TLS или другой подходящий механизм транспортного шифрования, и не происходит откат к небезопасным или незашифрованным коммуникациям.", + "L": "2" + }, + { + "Shortcode": "V12.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что TLS-соединения между внутренними сервисами используют доверенные сертификаты. Если используются внутренние или самоподписанные сертификаты, потребляющий сервис должен быть настроен на доверие только к конкретным внутренним центрам сертификации (CA) и конкретным самоподписанным сертификатам.", + "L": "2" + }, + { + "Shortcode": "V12.3.5", + "Ordinal": 5, + "Description": "Убедитесь, что сервисы, взаимодействующие внутри системы (intra-service communications), используют строгую аутентификацию для проверки каждого конечного узла. Для проверки подлинности взаимодействующих сторон должны применяться методы строгой аутентификации, такие как аутентификация TLS-клиента, с использованием инфраструктуры открытых ключей и механизмов, устойчивых к атакам повтора (replay attacks). Для микросервисных архитектур рекомендуется использование service mesh для упрощения управления сертификатами и повышения безопасности.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V13", + "Ordinal": 13, + "ShortName": "Configuration", + "Name": "Конфигурация", + "Items": [ + { + "Shortcode": "V13.1", + "Ordinal": 1, + "Name": "Документация конфигурации", + "Items": [ + { + "Shortcode": "V13.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что все необходимые доступы приложения задокументированы. Сюда должны быть включены как внешние сервисы, от которых зависит приложение, так и сценарии, когда конечный пользователь может задавать адреса для внешнего подключения.", + "L": "2" + }, + { + "Shortcode": "V13.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что для каждого сервиса, используемого приложением, в документации определено максимальное количество одновременных соединений (например, лимиты пула соединений) и описано поведение приложения при достижении этого лимита, включая любые механизмы отказоустойчивости или восстановления, чтобы предотвратить ситуации отказа в обслуживании (DoS).", + "L": "3" + }, + { + "Shortcode": "V13.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что в документации приложения определены стратегии управления ресурсами для каждой внешней системы или сервиса, которые оно использует (например, базы данных, файловые дескрипторы, потоки, HTTP-соединения). Стратегии должны включать процедуры освобождения ресурсов, настройки таймаутов, обработку сбоев, а также, если реализована логика повторных попыток, указание лимитов, задержек и алгоритмов back-off. Для синхронных HTTP-запросов должны быть заданы короткие таймауты, а повторные запросы должны быть отключены, либо строго ограничены по числу попыток, чтобы предотвратить каскадные задержки и истощение ресурсов.", + "L": "3" + }, + { + "Shortcode": "V13.1.4", + "Ordinal": 4, + "Description": "Убедитесь, что в документации приложения определены секреты, критически важные для безопасности приложения, а также установлен график их ротации в соответствии с моделью угроз организации и её бизнес-требованиями.", + "L": "3" + } + ] + }, + { + "Shortcode": "V13.2", + "Ordinal": 2, + "Name": "Конфигурация бэкенд соединений", + "Items": [ + { + "Shortcode": "V13.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что коммуникации между компонентами бэкенда приложения (включая API, промежуточное ПО и уровни данных), которые не поддерживают стандартный механизм пользовательских сессий, проходят с аутентификацией. Аутентификация должна использовать индивидуальные сервисные аккаунты, краткосрочные токены или аутентификацию на основе сертификатов, а не постоянные учётные данные, такие как пароли, API-ключи или общие аккаунты с привилегированным доступом.", + "L": "2" + }, + { + "Shortcode": "V13.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что коммуникации между компонентами бэкенда приложения, включая локальные или системные службы, API, промежуточное ПО и уровни данных, выполняются с использованием аккаунтов, которым назначены минимально необходимые привилегии.", + "L": "2" + }, + { + "Shortcode": "V13.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что если для аутентификации в сервисе используются учётные данные, то используемые потребителем учётные данные не являются стандартными (например, root/root или admin/admin).", + "L": "2" + }, + { + "Shortcode": "V13.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что используется белый список (allowlist) для определения внешних ресурсов или систем, с которыми приложению разрешено взаимодействовать (например, для исходящих запросов, загрузки данных или доступа к файлам). Этот белый список может быть реализован на уровне приложения, веб-сервера, межсетевого экрана или комбинации различных уровней.", + "L": "2" + }, + { + "Shortcode": "V13.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что веб- или прикладной сервер настроен с белым списком ресурсов или систем, к которым сервер может отправлять запросы или из которых может загружать данные и файлы.", + "L": "2" + }, + { + "Shortcode": "V13.2.6", + "Ordinal": 6, + "Description": "Убедитесь, что при подключении приложения к другим сервисам соблюдается задокументированная конфигурация для каждого соединения, включая максимальное количество параллельных соединений, поведение при достижении их максимума, таймауты и стратегии повторных попыток подключения.", + "L": "3" + } + ] + }, + { + "Shortcode": "V13.3", + "Ordinal": 3, + "Name": "Управление секретами", + "Items": [ + { + "Shortcode": "V13.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что для безопасного создания, хранения, контроля доступа и уничтожения секретов бэкенда используется решение для управления секретами, например, хранилище ключей (key vault). Секретами могут быть пароли, ключевой материал, интеграции с базами данных и сторонними системами, ключи и seed-значения для токенов с ограниченным временем действия, другие внутренние секреты и API-ключи. Секреты не должны включаться в исходный код приложения или артефакты сборки. Для приложений уровня L3 необходимо использовать аппаратное решение, например, аппаратный модуль безопасности (HSM).", + "L": "2" + }, + { + "Shortcode": "V13.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что доступ к секретным ресурсам осуществляется в соответствии с принципом минимально необходимых привилегий (least privilege).", + "L": "2" + }, + { + "Shortcode": "V13.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что все криптографические операции выполняются с использованием изолированного модуля безопасности (например, хранилища ключей или аппаратного модуля безопасности), чтобы надежно управлять ключевым материалом и защищать его от утечки за пределы модуля безопасности.", + "L": "3" + }, + { + "Shortcode": "V13.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что секреты настроены на срок действия и ротацию в соответствии с документацией приложения.", + "L": "3" + } + ] + }, + { + "Shortcode": "V13.4", + "Ordinal": 4, + "Name": "Непреднамеренная утечка информации", + "Items": [ + { + "Shortcode": "V13.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение развернуто либо без метаданных систем контроля версий (включая папки .git или .svn), либо так, чтобы эти папки были недоступны как извне, так и для самого приложения.", + "L": "1" + }, + { + "Shortcode": "V13.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что режимы отладки отключены для всех компонентов в промышленной среде, чтобы предотвратить раскрытие функций отладки и утечку информации.", + "L": "2" + }, + { + "Shortcode": "V13.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что веб-серверы не показывают клиентам списки содержимого каталогов, если это явно не предусмотрено.", + "L": "2" + }, + { + "Shortcode": "V13.4.4", + "Ordinal": 4, + "Description": "Убедитесь, что метод HTTP TRACE не поддерживается в продуктовой среде, чтобы избежать потенциальной утечки информации.", + "L": "2" + }, + { + "Shortcode": "V13.4.5", + "Ordinal": 5, + "Description": "Убедитесь, что документация (например, по внутренним API) и мониторинговые эндпоинты не доступны, если это явно не предусмотрено.", + "L": "2" + }, + { + "Shortcode": "V13.4.6", + "Ordinal": 6, + "Description": "Убедитесь, что приложение не раскрывает подробную информацию о версиях компонентов бэкенда.", + "L": "3" + }, + { + "Shortcode": "V13.4.7", + "Ordinal": 7, + "Description": "Убедитесь, что веб-слой настроен на обслуживание только файлов с определёнными расширениями, чтобы предотвратить непреднамеренную утечку информации, конфигураций и исходного кода.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V14", + "Ordinal": 14, + "ShortName": "Data", + "Name": "Защита информации", + "Items": [ + { + "Shortcode": "V14.1", + "Ordinal": 1, + "Name": "Документация по защите информации", + "Items": [ + { + "Shortcode": "V14.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что все конфиденциальные данные, создаваемые и обрабатываемые приложением, идентифицированы и классифицированы по уровням защиты. Включая закодированные данные, которые легко декодируются, например, строки Base64 или незашифрованные данные в полезной нагрузке JWT. Уровни защиты должны учитывать требования по защите данных и конфиденциальности, которым должно соответствовать приложение.", + "L": "2" + }, + { + "Shortcode": "V14.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что для каждого уровня защиты конфиденциальных данных требования к защите задокументированы. Они должны включать (но не ограничиваться) требования по шифрованию, проверке целостности, срокам хранения, способам логирования данных, контролю доступа к чувствительным данным в логах, шифрованию на уровне базы данных, применению технологий повышения конфиденциальности, а также другим требованиям по конфиденциальности.", + "L": "2" + } + ] + }, + { + "Shortcode": "V14.2", + "Ordinal": 2, + "Name": "Базовые меры по защите информации", + "Items": [ + { + "Shortcode": "V14.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что конфиденциальные данные передаются на сервер только в теле HTTP-запроса или в заголовках. URL и строка запроса не должны содержать конфиденциальную информацию, такую как API-ключ или сессионный токен.", + "L": "1" + }, + { + "Shortcode": "V14.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение предотвращает кэширование конфиденциальных данных в серверных компонентах, таких как балансировщики нагрузки и кэши приложений, либо гарантирует их надежное удаление после использования.", + "L": "2" + }, + { + "Shortcode": "V14.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что заранее определённые конфиденциальные данные не отправляются ненадёжным сторонам (например, системам трекинга пользователей), чтобы предотвратить нежелательный сбор данных вне контроля приложения.", + "L": "2" + }, + { + "Shortcode": "V14.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что для конфиденциальных данных реализованы меры по шифрованию, проверке целостности, срокам хранения, способам логирования, контролю доступа к данным в логах, а также применяются технологии повышения конфиденциальности в соответствии с документацией для соответствующего уровня защиты данных.", + "L": "2" + }, + { + "Shortcode": "V14.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что механизмы кэширования настроены так, чтобы кэшировать только ответы с ожидаемым типом содержимого для данного ресурса и не содержать конфиденциального динамического контента. При обращении к несуществующему файлу, веб-сервер должен возвращать ответ 404 или 302, а не подменять на другой существующий файл, что позволит предотвратить атаки типа Web Cache Deception.", + "L": "3" + }, + { + "Shortcode": "V14.2.6", + "Ordinal": 6, + "Description": "Убедитесь, что приложение возвращает только минимально необходимый объем конфиденциальных данных для выполнения своей функциональности. Например, показывает только часть цифр номера кредитной карты, а не полный номер. Если требуется отображение полных данных, они должны быть замаскированы в пользовательском интерфейсе, пока пользователь специально не запросил их просмотр.", + "L": "3" + }, + { + "Shortcode": "V14.2.7", + "Ordinal": 7, + "Description": "Убедитесь, что конфиденциальная информация подлежит классификации по срокам хранения, чтобы устаревшие или ненужные данные удалялись автоматически, по расписанию или по мере необходимости.", + "L": "3" + }, + { + "Shortcode": "V14.2.8", + "Ordinal": 8, + "Description": "Убедитесь, что конфиденциальная информация удаляется из метаданных файлов, загружаемых пользователями, если пользователь явно не согласился на ее хранение.", + "L": "3" + } + ] + }, + { + "Shortcode": "V14.3", + "Ordinal": 3, + "Name": "Защита данных на стороне клиента", + "Items": [ + { + "Shortcode": "V14.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что аутентифицированные данные очищаются из клиентского хранилища, например, из DOM браузера, после завершения работы клиента или сессии. Заголовок HTTP-ответа Clear-Site-Data может помочь в этом, но клиентская сторона также должна уметь очищать данные, если соединение с сервером недоступно при завершении сессии.", + "L": "1" + }, + { + "Shortcode": "V14.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение устанавливает HTTP-заголовки, достаточные для предотвращения кэширования (например, Cache-Control: no-store), чтобы конфиденциальные данные не сохранялись в браузерах.", + "L": "2" + }, + { + "Shortcode": "V14.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что данные, хранящиеся в браузерном хранилище (например, localStorage, sessionStorage, IndexedDB или cookie), не содержат конфиденциальной информации, за исключением сессионных токенов.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V15", + "Ordinal": 15, + "ShortName": "Secure", + "Name": "Безопасная разработка и архитектура", + "Items": [ + { + "Shortcode": "V15.1", + "Ordinal": 1, + "Name": "Документация по безопасной разработке и архитектуре", + "Items": [ + { + "Shortcode": "V15.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что в документации по приложению определены сроки устранения уязвимостей на основе оценки рисков для внешних зависимостей с уязвимостями и для обновления библиотек в целом, чтобы минимизировать риск, связанный с этими компонентами.", + "L": "1" + }, + { + "Shortcode": "V15.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что ведется реестр всех используемых сторонних библиотек (например, Software Bill of Materials, SBOM), с обязательной проверкой, что компоненты получены из предопределенных, доверенных и регулярно поддерживаемых репозиториев.", + "L": "2" + }, + { + "Shortcode": "V15.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что в документации приложения указан функционал, требующий значительных временных или вычислительных ресурсов. Необходимо указать, как предотвратить потерю доступности из-за чрезмерного использования этого функционала и как избежать ситуаций, когда формирование ответа занимает больше времени, чем установленный системой таймаут. Возможные меры защиты могут включать асинхронную обработку, использование очередей и ограничение количества параллельных процессов для каждого пользователя и приложения.", + "L": "2" + }, + { + "Shortcode": "V15.1.4", + "Ordinal": 4, + "Description": "Убедитесь, что в документации приложения указаны внешние библиотеки, которые считаются «компонентами с повышенным риском».", + "L": "3" + }, + { + "Shortcode": "V15.1.5", + "Ordinal": 5, + "Description": "Убедитесь, что в документации приложения выделены те части приложения, в которых используются «функционал с повышенным риском».", + "L": "3" + } + ] + }, + { + "Shortcode": "V15.2", + "Ordinal": 2, + "Name": "Архитектура безопасности и зависимости", + "Items": [ + { + "Shortcode": "V15.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение содержит только те компоненты, которые не нарушили задокументированные сроки обновления и исправления.", + "L": "1" + }, + { + "Shortcode": "V15.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что в приложении реализованы меры защиты от потери доступности из-за функциональности, требующей много времени или ресурсов, на основе задокументированных решений и стратегий безопасности для этого.", + "L": "2" + }, + { + "Shortcode": "V15.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что производственная среда включает только те функции, которые необходимы для работы приложения, и не предоставляет лишние функции, такие как тестовый код, примеры кода и инструменты разработки.", + "L": "2" + }, + { + "Shortcode": "V15.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что сторонние компоненты и все их транзитивные зависимости загружаются только из ожидаемых репозиториев (внутренних или внешних) и отсутствует риск атаки через подмену зависимостей (dependency confusion attack)", + "L": "3" + }, + { + "Shortcode": "V15.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что приложение реализует дополнительные меры защиты для тех частей приложения, которые документированы как содержащие «функционал с повышенным риском» или использующие сторонние библиотеки, считающиеся «функционалом с повышенным риском». Это могут быть такие методы, как «песочница», инкапсуляция, контейнеризация или изоляция на сетевом уровне, чтобы задержать и предотвратить продвижение (pivoting) злоумышленников, скомпрометировавших одну часть приложения, к другим частям приложения.", + "L": "3" + } + ] + }, + { + "Shortcode": "V15.3", + "Ordinal": 3, + "Name": "Безопасное программирование", + "Items": [ + { + "Shortcode": "V15.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение возвращает только необходимое подмножество полей из объекта данных. Например, оно не должно возвращать весь объект данных, поскольку некоторые отдельные поля должны быть недоступны пользователям.", + "L": "1" + }, + { + "Shortcode": "V15.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что при вызовах внешних URL-адресов бэкэнд приложения настроен так, чтобы не выполнять перенаправления, если только это не предусмотрено функционалом.", + "L": "2" + }, + { + "Shortcode": "V15.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что в приложении реализованы защитные механизмы против атак типа массового присвоения (mass assignment) путем строгого ограничения разрешенных полей для каждого контроллера и действия, исключая возможность добавления или изменения значений полей, которые не должны быть доступны для данной конкретной операции.", + "L": "2" + }, + { + "Shortcode": "V15.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что все прокси и промежуточное ПО корректно передают исходный IP-адрес пользователя, используя доверенные поля данных, которые не могут быть изменены конечным пользователем, а приложение и веб-сервер используют это правильное значение для ведения логирования и принятия решений по безопасности, таких как ограничение запросов. При этом следует учитывать, что даже исходный IP-адрес может быть ненадежным из-за динамических IP-адресов, VPN или корпоративных файрволов.", + "L": "2" + }, + { + "Shortcode": "V15.3.5", + "Ordinal": 5, + "Description": "Убедитесь, что приложение явно проверяет соответствие переменных ожидаемому типу данных и использует строгие операции сравнения. Это необходимо для предотвращения уязвимостей, связанных с type juggling и type confusion, вызванных тем, что код приложения делает предположения о типе переменной.", + "L": "2" + }, + { + "Shortcode": "V15.3.6", + "Ordinal": 6, + "Description": "Убедитесь, что JavaScript-код написан таким образом, чтобы предотвратить prototype pollution, например, используя Set() или Map() вместо обычных литералов объекта.", + "L": "2" + }, + { + "Shortcode": "V15.3.7", + "Ordinal": 7, + "Description": "Убедитесь, что приложение защищено от атак типа HTTP Parameter Pollution (HPP), особенно если используемый фреймворк не различает источники параметров запроса (строка запроса, тело запроса, куки или заголовки).", + "L": "2" + } + ] + }, + { + "Shortcode": "V15.4", + "Ordinal": 4, + "Name": "Безопасная работа с параллельными процессами", + "Items": [ + { + "Shortcode": "V15.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что к общим объектам в многопоточном коде (например, кэшам, файлам или объектам в памяти, используемым несколькими потоками) используется безопасный многопоточный доступ и механизмов синхронизации, таких как блокировки или семафоры, чтобы избежать состояний гонки и повреждения данных.", + "L": "3" + }, + { + "Shortcode": "V15.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что проверки состояния ресурса, например его существования или разрешений, а также зависящие от него действия выполняются как одна атомарная операция, чтобы предотвратить условия гонки времени проверки и времени использования (TOCTOU). Например, проверка существования файла перед его открытием или проверка прав доступа пользователя перед его предоставлением.", + "L": "3" + }, + { + "Shortcode": "V15.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что блокировки применяются согласованно, чтобы предотвратить взаимные блокировки потоков (deadlocks) или их бесконечные повторы, а также что логика блокировки инкапсулирована в коде, отвечающем за управление ресурсом. Это гарантирует, что блокировки не могут быть случайно или намеренно изменены внешними классами или кодом.", + "L": "3" + }, + { + "Shortcode": "V15.4.4", + "Ordinal": 4, + "Description": "Убедитесь, что политики распределения ресурсов предотвращают нехватку ресурсов у потоков, обеспечивая справедливый доступ к ресурсам, например, используя пулы потоков, позволяя потокам с более низким приоритетом выполняться в течение разумного периода времени.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V16", + "Ordinal": 16, + "ShortName": "Security", + "Name": "Журналирование событий безопасности и обработка ошибок", + "Items": [ + { + "Shortcode": "V16.1", + "Ordinal": 1, + "Name": "Документация по ведению логов", + "Items": [ + { + "Shortcode": "V16.1.1", + "Ordinal": 1, + "Description": "Убедитесь в существовании реестра, в котором документируется ведение журнала на каждом уровне технологического стека приложения, включая какие события регистрируются, форматы логов, где хранятся эти журналы, как они используются, как контролируется доступ к ним и как долго хранятся журналы.", + "L": "2" + } + ] + }, + { + "Shortcode": "V16.2", + "Ordinal": 2, + "Name": "Общее журналирование", + "Items": [ + { + "Shortcode": "V16.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что каждая запись журнала содержит необходимые метаданные (например, когда, где, кто, что), которые позволят провести подробное исследование временной шкалы, когда произошло событие.", + "L": "2" + }, + { + "Shortcode": "V16.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что все источники времени компонентов системы журналирования синхронизированы, а временные метки в метаданных событий безопасности используют UTC или содержат явное указание смещения часового пояса. Рекомендуется применять UTC для обеспечения согласованности в распределённых системах и предотвращения ошибок при переходе на летнее/зимнее время.", + "L": "2" + }, + { + "Shortcode": "V16.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение записывает и передаёт логи исключительно в те файлы и сервисы, которые указаны в реестре журналирования.", + "L": "2" + }, + { + "Shortcode": "V16.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что логи могут быть прочитаны и коррелированы используемой системой обработки журналов, предпочтительно с использованием общего стандартного формата логирования.", + "L": "2" + }, + { + "Shortcode": "V16.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что приложение применяет соответствующие меры защиты при логировании конфиденциальных данных в зависимости от уровня их чувствительности: например, полностью запрещает запись в логи таких данных, как учетные данные или платежные реквизиты, а для других данных (например, сессионных токенов) использует хеширование или частичное/полное маскирование.", + "L": "2" + } + ] + }, + { + "Shortcode": "V16.3", + "Ordinal": 3, + "Name": "Инциденты безопасности", + "Items": [ + { + "Shortcode": "V16.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что все операции аутентификации регистрируются, включая успешные и неудачные попытки. Также следует фиксировать дополнительные метаданные, такие как тип аутентификации или использованные факторы проверки.", + "L": "2" + }, + { + "Shortcode": "V16.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что ведется журнал неудачных попыток авторизации. Для уровня L3 это должно включать в себя журналирование всех решений об авторизации, включая журналирование доступа к конфиденциальным данным (без регистрации самих конфиденциальных данных).", + "L": "2" + }, + { + "Shortcode": "V16.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение регистрирует все события безопасности, определенные в документации, а также фиксирует попытки обхода механизмов защиты, включая проверку входных данных, бизнес-логики и системы защиты от автоматизированных атак.", + "L": "2" + }, + { + "Shortcode": "V16.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что приложение регистрирует в журналах неожиданные ошибки и сбои механизмов безопасности, включая, например, ошибки TLS-соединения на стороне сервера.", + "L": "2" + } + ] + }, + { + "Shortcode": "V16.4", + "Ordinal": 4, + "Name": "Защита журналов", + "Items": [ + { + "Shortcode": "V16.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что все компоненты системы логирования корректно кодируют данные, чтобы предотвратить атаки типа внедрения в журналы (log injection).", + "L": "2" + }, + { + "Shortcode": "V16.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что логи защищены от неавторизованного доступа и не могут быть модифицированы.", + "L": "2" + }, + { + "Shortcode": "V16.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что логи безопасно передаются в логически изолированную систему для анализа, обнаружения угроз, генерации оповещений и эскалации инцидентов. Это гарантирует сохранность журналов даже в случае компрометации основного приложения.", + "L": "2" + } + ] + }, + { + "Shortcode": "V16.5", + "Ordinal": 5, + "Name": "Обработка ошибок", + "Items": [ + { + "Shortcode": "V16.5.1", + "Ordinal": 1, + "Description": "Убедитесь, что при возникновении непредвиденной или связанной с безопасностью ошибки пользователю возвращается только общее сообщение, гарантируя отсутствие раскрытия конфиденциальных внутренних данных системы, таких как трассировки стека, запросы, секретные ключи и токены.", + "L": "2" + }, + { + "Shortcode": "V16.5.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение продолжает работать в безопасном режиме при недоступности внешних ресурсов, используя такие механизмы, как автоматические выключатели (circuit breakers) или плавное снижение функциональности (graceful degradation).", + "L": "2" + }, + { + "Shortcode": "V16.5.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение корректно и безопасно завершает работу при возникновении исключений, предотвращая опасные сценарии по типу «fail-open», когда, например, транзакция ошибочно выполняется, несмотря на ошибки в логике валидации.", + "L": "2" + }, + { + "Shortcode": "V16.5.4", + "Ordinal": 4, + "Description": "Убедитесь, что определён обработчик ошибок «крайние меры», который будет перехватывать все необработанные ошибки. Это необходимо как для предотвращения потери информации об ошибках, которая должна быть записана в файлы журналов, так и для того, чтобы ошибка не остановила весь процесс приложения, что привело бы к потере доступности.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V17", + "Ordinal": 17, + "ShortName": "WebRTC", + "Name": "WebRTC", + "Items": [ + { + "Shortcode": "V17.1", + "Ordinal": 1, + "Name": "TURN-сервер", + "Items": [ + { + "Shortcode": "V17.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что сервис TURN (Traversal Using Relays around NAT) разрешает доступ только к IP-адресам, не зарезервированным для специальных целей (например, внутренние сети, широковещательная рассылка, loopback-адреса). Данное требование применяется как к IPv4, так и к IPv6 адресам.", + "L": "2" + }, + { + "Shortcode": "V17.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что сервис TURN (Traversal Using Relays around NAT) защищен от исчерпания ресурсов при попытках легитимных пользователей открыть чрезмерное количество портов на сервере.", + "L": "3" + } + ] + }, + { + "Shortcode": "V17.2", + "Ordinal": 2, + "Name": "Требования к медиасерверам", + "Items": [ + { + "Shortcode": "V17.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что ключ сертификата Datagram Transport Layer Security (DTLS) управляется и защищается в соответствии с документированной политикой управления криптографическими ключами.", + "L": "2" + }, + { + "Shortcode": "V17.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что медиасервер настроен на использование только одобренных наборов шифров Datagram Transport Layer Security (DTLS) и защищенного профиля безопасности для расширения DTLS, применяемого при установке ключей для Secure Real-time Transport Protocol (DTLS-SRTP).", + "L": "2" + }, + { + "Shortcode": "V17.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что медиасервер проверяет аутентификацию Secure Real-time Transport Protocol (SRTP) для предотвращения атак с внедрением Real-time Transport Protocol (RTP), которые могут привести к отказу в обслуживании (Denial of Service) или вставке поддельного аудио-/видеоконтента в медиапотоки.", + "L": "2" + }, + { + "Shortcode": "V17.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика при получении некорректных пакетов Secure Real-time Transport Protocol (SRTP).", + "L": "2" + }, + { + "Shortcode": "V17.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетами Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.", + "L": "3" + }, + { + "Shortcode": "V17.2.6", + "Ordinal": 6, + "Description": "Убедитесь, что медиасервер не подвержен уязвимости «Гонка ClientHello» (ClientHello Race Condition) в Datagram Transport Layer Security (DTLS), проверив наличие известных уязвимостей в публичных источниках или выполнив тестирование на воспроизведение условий гонки.", + "L": "3" + }, + { + "Shortcode": "V17.2.7", + "Ordinal": 7, + "Description": "Убедитесь, что механизмы аудио- и видеозаписи, связанные с медиасервером, способны продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетов Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.", + "L": "3" + }, + { + "Shortcode": "V17.2.8", + "Ordinal": 8, + "Description": "Убедитесь, что сертификат Datagram Transport Layer Security (DTLS) проверяется на соответствие атрибуту отпечатка (fingerprint) в Session Description Protocol (SDP), с немедленным прекращением медиапотока в случае несоответствия — это гарантирует подлинность передаваемых данных.", + "L": "3" + } + ] + }, + { + "Shortcode": "V17.3", + "Ordinal": 3, + "Name": "Сигнализация", + "Items": [ + { + "Shortcode": "V17.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что сигнальный сервер способен продолжать обработку легитимных входящих сообщений сигнализации даже в условиях флуд-атаки. Для этого необходимо реализовать механизм ограничения частоты запросов (rate limiting) на уровне сигнализации.", + "L": "2" + }, + { + "Shortcode": "V17.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что сигнальный сервер способен продолжать обработку легитимных сообщений сигнализации даже при получении некорректных сообщений, которые могут вызвать отказ в обслуживании (Denial of Service, DoS). Для этого необходимо реализовать: проверку входных данных (input validation), безопасную обработку целочисленных переполнений (integer overflows), защиту от переполнения буферов (buffer overflows) и другие надежные методы обработки ошибок.", + "L": "2" + } + ] + } + ] + } + ] +} diff --git a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.csv b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.csv new file mode 100644 index 0000000000..ee9c1f89e8 --- /dev/null +++ b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.csv @@ -0,0 +1,347 @@ +chapter_id,chapter_name,section_id,section_name,req_id,req_description,level1,level2,level3,cwe,nist +V1,Кодировка и нейтрализация,V1.1,Архитектура кодировки и нейтрализации,V1.1.1,"Убедитесь, что входные данные декодируются или деэкранируются в каноническую форму (в стандартное представление) только один раз. Декодирование происходит только тогда, когда ожидаются закодированные данные в этой форме, и что это делается перед дальнейшей обработкой входных данных, например, это не выполняется после проверки или нейтрализации.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.1,Архитектура кодировки и нейтрализации,V1.1.2,"Убедитесь, что приложение выполняет кодирование и экранирование выходных данных либо в качестве последнего шага перед использованием интерпретатором, для которого оно предназначено, либо самим интерпретатором.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.1,"Убедитесь, что выходная кодировка для ответа HTTP, документа HTML или документа XML соответствует требуемому контексту, например, кодировка соответствующих символов для элементов HTML, атрибутов HTML, комментариев HTML, CSS или полей заголовка HTTP делается таким способом, чтобы избежать изменения структуры сообщения или документа.",✓,✓,✓,, +V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.2,"Убедитесь, что при динамическом построении URL-адресов недоверенные данные кодируются в соответствии с их контекстом (например, кодирование URL-адресов или кодирование base64url для query или path параметров или пути). Убедитесь, что разрешены только безопасные протоколы URL-адресов (например, запрещен javascript: или data:).",✓,✓,✓,, +V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.3,"Убедитесь, что при динамическом построении содержимого JavaScript (включая JSON) используется кодирование или экранирование выходных данных, чтобы избежать изменения структуры сообщения или документа (чтобы избежать JavaScript и JSON-инъекций).",✓,✓,✓,, +V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.4,"Убедитесь, что выборка данных (Redis, Memcached, чтение из файлов, обращение по API) или запросы к базе данных (например, SQL, HQL, NoSQL, Cypher) используют параметризованные запросы, ORM, Entity Frameworks или иным образом защищены от SQL-инъекций и других атак. Это также актуально при написании хранимых процедур.",✓,✓,✓,, +V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.5,"Убедитесь, что приложение защищено от внедрения команд ОС и что вызовы операционной системы используют параметризованные запросы к ОС или используют контекстное кодирование вывода командной строки.",✓,✓,✓,, +V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.6,"Убедитесь, что приложение защищено от LDAP-инъекций, или что реализованы специальные меры безопасности для их предотвращения.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.7,"Убедитесь, что приложение защищено от атак с использованием XPath-инъекций с помощью параметризации запросов или предварительно скомпилированных запросов.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.8,"Убедитесь, что процессоры LaTeX настроены безопасно (например, не используется флаг «–shell‑escape») и используется разрешенный список команд для предотвращения LaTeX-инъекций.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.9,"Убедитесь, что приложение экранирует специальные символы в регулярных выражениях (обычно с помощью обратной косой черты), чтобы предотвратить их ошибочную интерпретацию как метасимволов.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.10,"Убедитесь, что приложение защищено от внедрения формул CSV (CSV Injection). Приложение должно следовать правилам экранирования, определенным в RFC 4180, разделы 2.6 и 2.7, при экспорте содержимого CSV. Кроме того, при экспорте в CSV или другие форматы электронных таблиц (такие как XLS, XLSX или ODF) специальные символы (включая '=', '+', '-', '@', '\t' (табуляция), и '\0' (нулевой символ)) должны экранироваться одинарной кавычкой, если они появляются в качестве первого символа в значении поля.",,,✓,, +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.1,"Убедитесь, что все ненадежные входные данные HTML из редакторов WYSIWYG или аналогичных программ нейтрализуются с помощью известных и безопасных библиотек или функций фреймворка для санитизации HTML.",✓,✓,✓,, +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.2,"Убедитесь, что приложение избегает использования eval() или других динамических функций выполнения кода, таких как Spring Expression Language (SpEL). Если нет альтернативы, любой пользовательский ввод должен быть нейтрализован перед выполнением.",✓,✓,✓,, +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.3,"Убедитесь, что данные, передаваемые в потенциально опасный контекст, предварительно нейтрализованы, чтобы обеспечить соблюдение мер безопасности, таких как разрешение только тех символов, которые безопасны для данного контекста, и обрезка слишком длинного ввода.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.4,"Убедитесь, что предоставленный пользователем файл .SVG проверен или нейтрализован, чтобы он содержал только теги и атрибуты (например, относящиеся к рисованию), которые безопасны для приложения, например, не содержат скриптов и foreignObject.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.5,"Убедитесь, что приложение нейтралует или отключает предоставленные пользователем скриптовые данные или выражения шаблонных языков, такие как таблицы стилей Markdown, CSS или XSL, BBCode или аналогичные.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.6,"Убедитесь, что приложение защищено от атак с подделкой запросов на стороне сервера (SSRF), проверяя ненадежные данные по разрешенному списку протоколов, доменов, путей и портов, а также нейтрализуя потенциально опасные символы перед использованием данных для вызова другой службы.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.7,"Убедитесь, что приложение защищено от атак с внедрением шаблонов (template injection), не позволяя создавать шаблоны на основе недоверенных входных данных. Если нет альтернативы, любые недоверенные входные данные, включаемые динамически во время создания шаблона, должны быть нейтрализованы или тщательно провалидированы.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.8,"Убедитесь, что приложение надлежащим образом нейтрализует недоверенные входные данные перед использованием в запросах Java Naming and Directory Interface (JNDI) и что JNDI настроен безопасно для предотвращения атак с использованием JNDI-инъекций.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.9,"Убедитесь, что приложение нейтрализует данные перед отправкой в Memcache, чтобы предотвратить атаки методом инъекций.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.10,"Убедитесь, что строки форматирования, которые могут быть использованы неожидаемым или вредоносным образом, нейтрализуются перед дальнейшим использованием.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.11,"Убедитесь, что приложение нейтрализует вводимые пользователем данные перед передачей в почтовые системы для защиты от SMTP или IMAP-инъекций.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.12,"Убедитесь, что регулярные выражения не содержат элементов, вызывающих экспоненциальный возврат, и убедитесь в нейтрализации недоверенных входных данных для предотвращения атак ReDoS или Runaway Regex.",,,✓,, +V1,Кодировка и нейтрализация,V1.4,"Память, строки и неуправляемый код",V1.4.1,"Убедитесь, что для обнаружения или предотвращения ситуаций переполнения стека, буфера или кучи приложение учитывает размер доступной области памяти при строковых операциях, копировании в память, в арифметике указателей и т.п.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.4,"Память, строки и неуправляемый код",V1.4.2,"Убедитесь, что для предотвращения целочисленного переполнения применяется контроль знака, диапазона и типа допустимых входных данных.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.4,"Память, строки и неуправляемый код",V1.4.3,"Убедитесь, что динамически выделенная память и ресурсы освобождены, а ссылки или указатели на освобожденную память удалены или установлены в значение null, чтобы предотвратить появление висячих указателей и уязвимостей, связанных с использованием памяти после освобождения.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.5,Безопасная десериализация,V1.5.1,"Убедитесь, что приложение настраивает XML-парсеры на использование строгой конфигурации и что небезопасные функции, такие как разрешение внешних сущностей, отключены для предотвращения атак XML eXternal Entity (XXE).",✓,✓,✓,, +V1,Кодировка и нейтрализация,V1.5,Безопасная десериализация,V1.5.2,"Убедитесь, что десериализация недоверенных данных обеспечивает безопасную обработку ввода, например, используя список разрешенных типов объектов или ограничивая типы объектов, определяемые клиентом, для предотвращения атак десериализации. Механизмы десериализации, которые явно определены как небезопасные, не должны использоваться с недоверенным вводом.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.5,Безопасная десериализация,V1.5.3,"Убедитесь, что различные парсеры, используемые в приложении для одного и того же типа данных (например, парсеры JSON, XML, URL), выполняют парсинг согласованным образом и используют один и тот же механизм кодирования символов, чтобы избежать таких проблем, как уязвимости взаимодействия JSON (JSON Interoperability) или различное поведение анализа URI или файлов, которые могут использоваться в атаках удаленного включения файлов (RFI) или подделки запросов на стороне сервера (SSRF).",,,✓,, +V2,Валидация и бизнес-логика,V2.1,Документация валидации и бизнес-логики,V2.1.1,"Убедитесь, что в документации приложения определены правила проверки входных данных на соответствие ожидаемой структуре. Это могут быть распространённые форматы данных, такие как номера кредитных карт, адреса электронной почты, номера телефонов, или внутренний формат данных.",✓,✓,✓,, +V2,Валидация и бизнес-логика,V2.1,Документация валидации и бизнес-логики,V2.1.2,"Убедитесь, что в документации приложения указано, как проверять логическую и контекстную согласованность объединенных данных, например, проверять соответствие района и почтового индекса.",,✓,✓,, +V2,Валидация и бизнес-логика,V2.1,Документация валидации и бизнес-логики,V2.1.3,"Убедитесь, что ожидания относительно ограничений и проверок бизнес-логики задокументированы как для уровня отдельного пользователя, так и для глобального уровня всего приложения.",,✓,✓,, +V2,Валидация и бизнес-логика,V2.2,Валидация ввода,V2.2.1,"Убедитесь, что входные данные провалидированы для обеспечения соответствия бизнес- или функциональным ожиданиям. Валидация должна осуществляться либо по списку допустимых значений, шаблонов и диапазонов, либо путем сравнения входных данных с ожидаемой структурой и логическими ограничениями в соответствии с предопределенными правилами. Для L1 валидация может быть сосредоточена на входных данных, используемых для принятия конкретных бизнес-решений или решений, связанных с безопасностью. Для L2 и выше это должно применяться ко всем входным данным.",✓,✓,✓,, +V2,Валидация и бизнес-логика,V2.2,Валидация ввода,V2.2.2,"Убедитесь, что приложение разработано с принудительной валидацией входных данных на уровне доверенного сервиса. Хотя проверка на стороне клиента повышает удобство использования и должна поощряться, на неё не следует полагаться как на средство контроля безопасности.",✓,✓,✓,, +V2,Валидация и бизнес-логика,V2.2,Валидация ввода,V2.2.3,"Убедитесь, что приложение обеспечивает обоснованность комбинаций данных в соответствии с предопределенными правилам. Например: возраст должен соответствовать дате рождения; страна и почтовый индекс; количество товара в заказе и на складе.",,✓,✓,, +V2,Валидация и бизнес-логика,V2.3,Безопасность бизнес-логики,V2.3.1,"Убедитесь, что приложение обрабатывает потоки бизнес-логики для одного и того же пользователя в ожидаемом последовательном порядке шагов и без пропуска шагов.",✓,✓,✓,, +V2,Валидация и бизнес-логика,V2.3,Безопасность бизнес-логики,V2.3.2,"Убедитесь, что ограничения бизнес-логики реализованы в соответствии с документацией приложения, чтобы избежать эксплуатации её недостатков.",,✓,✓,, +V2,Валидация и бизнес-логика,V2.3,Безопасность бизнес-логики,V2.3.3,"Убедитесь, что транзакции используются на уровне бизнес-логики таким образом, что операция бизнес-логики либо выполняется полностью, либо откатывается к предыдущему корректному состоянию.",,✓,✓,, +V2,Валидация и бизнес-логика,V2.3,Безопасность бизнес-логики,V2.3.4,"Убедитесь, что на уровне бизнес-логики используются механизмы блокировки, чтобы гарантировать невозможность двойного бронирования ограниченных по количеству ресурсов (например, мест в театре или слотов доставки) путем манипулирования логикой приложения.",,✓,✓,, +V2,Валидация и бизнес-логика,V2.3,Безопасность бизнес-логики,V2.3.5,"Убедитесь, что для важных потоков бизнес-логики требуется многопользовательское (multi-user) одобрение, чтобы предотвратить несанкционированные или случайные действия. Потоки бизнес-логики могут включать, помимо прочего, крупные денежные переводы, утверждение контрактов, доступ к секретной информации или обход ограничений безопасности на производстве.",,,✓,, +V2,Валидация и бизнес-логика,V2.4,Анти-автоматизация,V2.4.1,"Убедитесь, что используются средства противодействия автоматизации для защиты от чрезмерных вызовов функций приложения, которые могут привести к утечке данных, созданию ненужных данных, исчерпанию квот, нарушению ограничений скорости, отказу в обслуживании или чрезмерному использованию дорогостоящих ресурсов.",,✓,✓,, +V2,Валидация и бизнес-логика,V2.4,Анти-автоматизация,V2.4.2,"Убедитесь, что потоки бизнес-логики требуют реалистичного человеческого времени, предотвращая чрезмерно быструю отправку транзакций.",,,✓,, +V3,Безопасность веб-интерфейса,V3.1,Документация по безопасности веб-интерфейса,V3.1.1,"Убедитесь, что в документации приложения описаны ожидаемые функции безопасности, которые должны поддерживать браузеры, использующие приложение (такие как HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) и другие соответствующие механизмы безопасности HTTP). В документации также должно быть обязательно определено, как приложение должно себя вести, если некоторые из этих функций недоступны (например, предупреждать пользователя или блокировать доступ).",,,✓,, +V3,Безопасность веб-интерфейса,V3.2,Непреднамеренная интерпретация контента,V3.2.1,"Убедитесь, что реализованы меры безопасности, предотвращающие отображение контента или функций браузерами в HTTP-ответах в некорректном контексте (например, запрос API, загруженный пользователем файл или другой ресурс запрашивается напрямую). Возможные способы контроля включают: не обрабатывать содержимое, если поля заголовка HTTP-запроса (например, Sec-Fetch-*) не указывают на корректность контекста; использование заголовка и значения Content-Security-Policy: sandbox directive; или использование заголовка и значения Content-Disposition: attachment.",✓,✓,✓,, +V3,Безопасность веб-интерфейса,V3.2,Непреднамеренная интерпретация контента,V3.2.2,"Убедитесь, что данные, предназначенные для отображения в виде текста, а не визуализации в виде HTML, обрабатывается с использованием безопасных функций визуализации (таких как createTextNode или textContent), чтобы предотвратить непреднамеренное выполнение содержимого, такого как HTML или JavaScript.",✓,✓,✓,, +V3,Безопасность веб-интерфейса,V3.2,Непреднамеренная интерпретация контента,V3.2.3,"Убедитесь, что приложение избегает затирания DOM при использовании JavaScript на стороне клиента, применяя явные объявления переменных, выполняя строгую проверку типов, избегая сохранения глобальных переменных в объекте документа и реализуя изоляцию пространства имен.",,,✓,, +V3,Безопасность веб-интерфейса,V3.3,Настройка файлов cookie,V3.3.1,"Убедитесь, что у файлов cookie установлен атрибут «Secure», и если префикс «__Host‑» не используется в названии cookie, необходимо использовать префикс «__Secure‑».",✓,✓,✓,, +V3,Безопасность веб-интерфейса,V3.3,Настройка файлов cookie,V3.3.2,"Убедитесь, что значение атрибута SameSite каждой cookie установлено в соответствии с назначением cookie, чтобы ограничить подверженность атакам на восстановление пользовательского интерфейса и атакам с подделкой запросов на уровне браузера, обычно называемым подделкой межсайтовых запросов (CSRF).",,✓,✓,, +V3,Безопасность веб-интерфейса,V3.3,Настройка файлов cookie,V3.3.3,"Убедитесь, что cookie имеют префикс «__Host‑» в названии, если только они явно не предназначены для совместного использования с другими хостами.",,✓,✓,, +V3,Безопасность веб-интерфейса,V3.3,Настройка файлов cookie,V3.3.4,"Убедитесь, что если значение cookie не должно быть доступно для клиентских скриптов (например, сессионный токен), для cookie должен быть установлен атрибут «HttpOnly», а само значение должно передаваться клиенту только через поле заголовка «Set-Cookie».",,✓,✓,, +V3,Безопасность веб-интерфейса,V3.3,Настройка файлов cookie,V3.3.5,"Убедитесь, что при записи cookie приложением общая длина имени и значения cookie не превышает 4096 байт. Слишком большие cookie не будут сохраняться браузером и, следовательно, не будут отправляться с запросами, что помешает пользователю использовать функции приложения, зависящие от этого cookie.",,,✓,, +V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.1,"Убедитесь, что поле заголовка Strict‑Transport‑Security включено во все ответы для реализации политики HTTP Strict Transport Security (HSTS). Необходимо указать максимальное время не менее 1 года, а для L2 и выше политика должна применяться также ко всем поддоменам.",✓,✓,✓,, +V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.2,"Убедитесь, что поле заголовка Cross‑Origin Resource Sharing (CORS) «Access‑Control‑Allow‑Origin» имеет фиксированное значение, заданное приложением, или, если используется заголовок Origin, оно проверяется по списку доверенных источников. При необходимости использования «Access‑Control‑Allow‑Origin: *» убедитесь, что ответ не содержит конфиденциальной информации.",✓,✓,✓,, +V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.3,"Убедитесь, что HTTP-ответы содержат поле заголовка Content-Security-Policy, которое определяет директивы, гарантирующие загрузку и выполнение браузером только доверенного контента или ресурсов, чтобы ограничить выполнение вредоносного JavaScript. Как минимум, необходимо использовать глобальную политику, включающую директивы object-src «none» и base-uri «none», а также определяющую список разрешенных адресов или использующую одноразовые коды или хэши. Для приложений L3 необходимо определить политику использования 'nonce' или hash-конструкций для каждого ответа.",,✓,✓,, +V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.4,"Убедитесь, что все HTTP-ответы содержат поле заголовка «X‑Content‑Type‑Options: nosniff». Это предписывает браузерам не использовать анализ контента и определение типа MIME для данного ответа, а также требовать, чтобы значение поля заголовка Content‑Type в ответе соответствовало целевому ресурсу. Например, ответ на запрос стиля принимается только в том случае, если Content‑Type в ответе — «text/css». Это также позволяет браузеру использовать функцию Cross‑Origin Read Blocking (CORB).",,✓,✓,, +V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.5,"Убедитесь, что приложение устанавливает политику реферера для предотвращения утечки технически конфиденциальных данных сторонним сервисам через поле заголовка HTTP-запроса «Referer». Это можно сделать с помощью поля заголовка HTTP-ответа «Referrer‑Policy» или через атрибуты HTML-элемента. Конфиденциальные данные могут включать путь и данные запроса в URL-адресе, а для внутренних непубличных приложений также имя хоста.",,✓,✓,, +V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.6,"Убедитесь, что веб-приложение использует директиву frame‑ancestors поля заголовка Content‑Security‑Policy для каждого HTTP-ответа, чтобы гарантировать невозможность его внедрения по умолчанию и внедрение определённых ресурсов разрешено только при необходимости. Обратите внимание, что поле заголовка X‑Frame‑Options, хотя и поддерживается браузерами, устарело и не может быть использовано в качестве основы.",,✓,✓,, +V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.7,"Убедитесь, что в поле заголовка Content‑Security‑Policy указано место, куда следует сообщать о нарушениях.",,,✓,, +V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.8,"Убедитесь, что все HTTP-ответы, инициирующие рендеринг документа (например, ответы с типом содержимого text/html), включают поле заголовка Cross-Origin-Opener-Policy с директивой same-origin или same-origin-allow-popups (при необходимости). Это предотвращает атаки, злоупотребляющие общим доступом к объектам Window, такие как Tabnabbing и Frame Counting.",,,✓,, +V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.1,"Убедитесь, что, если приложение не использует механизм предварительной проверки CORS для предотвращения запрещённых кросс-доменных запросов на использование чувствительного функционала, эти запросы валидируются на предмет их происхождения от самого приложения. Это можно сделать, используя и проверяя специальные токены для защиты от подделки или требуя дополнительные поля HTTP-заголовка, не входящие в список «простых заголовков» (CORS-safelisted request-header). Это необходимо для защиты от атак с подделкой запросов через браузер, широко известных как межсайтовая подделка запросов (CSRF).",✓,✓,✓,, +V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.2,"Убедитесь, что если приложение использует механизм предварительной проверки CORS для предотвращения неразрешённого использования чувствительного функционала между источниками, вызов этого функционала невозможен с помощью запроса, который не запускает предварительную проверку CORS. Для этого может потребоваться проверка значений полей заголовка запроса «Origin» и «Content-Type» или использование дополнительного поля заголовка, не входящего в безопасный список CORS.",✓,✓,✓,, +V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.3,"Убедитесь, что HTTP-запросы к чувствительному функционалу используют соответствующие HTTP-методы, такие как POST, PUT, PATCH или DELETE, а не методы, определённые спецификацией HTTP как «безопасные», такие как HEAD, OPTIONS или GET. В качестве альтернативы можно использовать строгую валидацию полей заголовка запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, навигационного запроса или загрузки ресурса (например, источника изображения), где это не ожидается.",✓,✓,✓,, +V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.4,"Убедитесь, что отдельные приложения размещены на разных именах хостов, чтобы использовать ограничения, предусмотренные политикой same-origin, включая то, как документы или скрипты, загруженные одним источником, могут взаимодействовать с ресурсами из другого источника, а также ограничения на cookie на основе имени хоста.",,✓,✓,, +V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.5,"Убедитесь, что сообщения, полученные интерфейсом postMessage, отвергаются, если источник сообщения не является доверенным или если синтаксис сообщения недействителен.",,✓,✓,, +V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.6,"Убедитесь, что функциональность JSONP не включена нигде в приложении, чтобы избежать атак с использованием межсайтового включения скриптов (XSSI).",,,✓,, +V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.7,"Убедитесь, что данные, требующие авторизации, не включены в ответы ресурсов скриптов, таких как файлы JavaScript, чтобы предотвратить атаки с использованием межсайтового включения скриптов (XSSI).",,,✓,, +V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.8,"Убедитесь, что аутентифицированные ресурсы (такие как изображения, видео, скрипты и другие документы) могут быть загружены или внедрены от имени пользователя только по назначению. Этого можно добиться путём строгой валидации полей заголовка HTTP-запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, или путём установки ограничительного поля заголовка HTTP-ответа Cross‑Origin‑Resource‑Policy, чтобы браузер блокировал возвращаемый контент.",,,✓,, +V3,Безопасность веб-интерфейса,V3.6,Целостность внешних ресурсов,V3.6.1,"Убедитесь, что клиентские ресурсы, такие как библиотеки JavaScript, CSS или веб-шрифты, размещаются только на внешнем сервере (например, в сети доставки контента (Content Delivery Network)), если ресурс статический и имеет версии, а для проверки целостности ресурса используется механизм проверки целостности подресурсов (SRI). Если это невозможно, для каждого ресурса должно быть задокументировано решение по безопасности, обосновывающее это.",,,✓,, +V3,Безопасность веб-интерфейса,V3.7,Другие соображения по безопасности браузера,V3.7.1,"Убедитесь, что приложение использует только те клиентские технологии, которые по-прежнему поддерживаются и считаются безопасными. Примерами технологий, не соответствующих этому требованию, являются плагины NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL или клиентские Java-апплеты.",,✓,✓,, +V3,Безопасность веб-интерфейса,V3.7,Другие соображения по безопасности браузера,V3.7.2,"Убедитесь, что приложение будет автоматически перенаправлять пользователя на другое имя хоста или домен (который не контролируется приложением), только если этот хост или домен указаны в списке разрешенных.",,✓,✓,, +V3,Безопасность веб-интерфейса,V3.7,Другие соображения по безопасности браузера,V3.7.3,"Убедитесь, что приложение отображает уведомление, что пользователь перенаправляется на URL-адрес, находящийся вне контроля приложения, с возможностью отмены навигации.",,,✓,, +V3,Безопасность веб-интерфейса,V3.7,Другие соображения по безопасности браузера,V3.7.4,"Убедитесь, что домен верхнего уровня приложения (например, site.tld) ​​добавлен в публичный список предварительной загрузки (preload list) для HTTP Strict Transport Security (HSTS). Это гарантирует, что использование TLS для приложения будет встроено непосредственно в основные браузеры, а не будет полагаться только на поле заголовка ответа Strict-Transport-Security.",,,✓,, +V3,Безопасность веб-интерфейса,V3.7,Другие соображения по безопасности браузера,V3.7.5,"Убедитесь, что приложение ведет себя так, как описано в документации (например, предупреждает пользователя или блокирует доступ), если браузер, используемый для доступа к приложению, не поддерживает ожидаемые функции безопасности.",,,✓,, +V4,API и Веб-сервис,V4.1,Общая безопасность веб-сервисов,V4.1.1,"Убедитесь, что каждый HTTP-ответ с телом сообщения содержит заголовок Content-Type, который соответствует фактическому содержимому ответа, таким как «text/», «/+xml» и «/xml», включая параметр charset для указания безопасной кодировки символов (например, UTF-8, ISO-8859-1) согласно IANA Media Types.",✓,✓,✓,, +V4,API и Веб-сервис,V4.1,Общая безопасность веб-сервисов,V4.1.2,"Убедитесь, что только конечные точки, предназначенные для взаимодействия с пользователем через веб-браузер, автоматически перенаправляют HTTP на HTTPS, в то время как другие сервисы или конечные точки не реализуют прозрачные редиректы. Это необходимо, чтобы избежать ситуации, когда клиент ошибочно отправляет незашифрованные HTTP-запросы а из-за того, что запрос по HTTP автоматически перенаправляется на HTTPS другим сервисом без обработки на входе, утечка чувствительных данных остаётся незамеченной.",,✓,✓,, +V4,API и Веб-сервис,V4.1,Общая безопасность веб-сервисов,V4.1.3,"Убедитесь, что любой HTTP-заголовок, используемый приложением и устанавливаемый промежуточным уровнем, таким как балансировщик нагрузки, веб-прокси или backend-for-frontend сервис, не может быть переопределён конечным пользователем. Примеры заголовков: X-Real-IP, X-Forwarded-*, X-User-ID.",,✓,✓,, +V4,API и Веб-сервис,V4.1,Общая безопасность веб-сервисов,V4.1.4,"Убедитесь, что разрешены только HTTP-методы, которые явно поддерживаются приложением или его API (включая OPTIONS для preflight-запросов), а неиспользуемые методы заблокированы.",,,✓,, +V4,API и Веб-сервис,V4.1,Общая безопасность веб-сервисов,V4.1.5,"Убедитесь, что для особо чувствительных запросов или транзакций, проходящих через несколько систем, используются цифровые подписи на уровне сообщений, дополнительно к транспортным средствам защиты.",,,✓,, +V4,API и Веб-сервис,V4.2,Валидация структуры HTTP-сообщений,V4.2.1,"Убедитесь, что все компоненты приложения (включая балансировщики нагрузки, файрволы и серверы приложений) определяют границы входящих HTTP-сообщений с использованием механизма, соответствующего версии HTTP, чтобы предотвратить HTTP request smuggling. В HTTP/1.x, если присутствует заголовок Transfer-Encoding, заголовок Content-Length должен игнорироваться согласно RFC 2616. При использовании HTTP/2 или HTTP/3, если присутствует Content-Length, веб-сервер должен убедиться, что он совпадает с длиной DATA-фреймов.",,✓,✓,, +V4,API и Веб-сервис,V4.2,Валидация структуры HTTP-сообщений,V4.2.2,"Убедитесь, что при генерации HTTP-сообщений заголовок Content-Length не конфликтует с длиной содержимого, определяемой рамками протокола HTTP, чтобы предотвратить HTTP Request Smuggling.",,,✓,, +V4,API и Веб-сервис,V4.2,Валидация структуры HTTP-сообщений,V4.2.3,"Убедитесь, что приложение не отправляет и не принимает HTTP/2 и HTTP/3 сообщения с заголовками, специфичными для соединения, такими как Transfer-Encoding, чтобы предотвратить HTTP Response Splitting и HTTP Header Injection.",,,✓,, +V4,API и Веб-сервис,V4.2,Валидация структуры HTTP-сообщений,V4.2.4,"Убедитесь, что приложение принимает HTTP/2 и HTTP/3 запросы только в случае, если поля заголовков и их значения не содержат последовательностей CR (\r), LF (\n) или CRLF (\r\n), чтобы предотвратить HTTP Header Injection.",,,✓,, +V4,API и Веб-сервис,V4.2,Валидация структуры HTTP-сообщений,V4.2.5,"Убедитесь, что если приложение (бекенд или фронтенд) формирует и отправляет запросы, оно использует валидацию, очистку или другие механизмы, чтобы не создавать URI (например, для API-вызовов) или HTTP-заголовки (например, Authorization или Cookie) слишком большой длины, чтобы их не принимал приёмник. Это может привести к отказу в обслуживании, например, при отправке слишком длинного запроса (длинный cookie-заголовок), из-за чего сервер постоянно возвращает ошибку.",,,✓,, +V4,API и Веб-сервис,V4.3,GraphQL,V4.3.1,"Убедитесь, что используется белый список запросов, ограничение глубины вложенности, ограничение количества или анализ стоимости запроса, чтобы предотвратить DoS-атаки на уровне GraphQL или слоя данных из-за дорогостоящих вложенных запросов.",,✓,✓,, +V4,API и Веб-сервис,V4.3,GraphQL,V4.3.2,"Убедитесь, что introspection-запросы GraphQL отключены в продакшен-среде, если GraphQL API не предназначен для использования сторонними клиентами.",,✓,✓,, +V4,API и Веб-сервис,V4.4,WebSocket,V4.4.1,"Убедитесь, что для всех WebSocket-соединений используется WebSocket поверх TLS (WSS).",✓,✓,✓,, +V4,API и Веб-сервис,V4.4,WebSocket,V4.4.2,"Убедитесь, что при первоначальном HTTP WebSocket handshake заголовок Origin проверяется на соответствие списку разрешённых источников для приложения.",,✓,✓,, +V4,API и Веб-сервис,V4.4,WebSocket,V4.4.3,"Убедитесь, что если стандартное управление сессиями приложения не может быть использовано, применяются специальные токены, соответствующие требованиям безопасности управления сессиями.",,✓,✓,, +V4,API и Веб-сервис,V4.4,WebSocket,V4.4.4,"Убедитесь, что специальные токены управления сессиями WebSocket изначально получаются или валидируются через ранее аутентифицированную HTTPS-сессию при переходе от HTTPS к WebSocket.",,✓,✓,, +V5,Работа с файлами,V5.1,Документация по работе с файлами,V5.1.1,"Убедитесь, что документация определяет допустимые типы файлов, ожидаемые расширения и максимальный размер (включая распакованный размер) для каждой функции загрузки. Также убедитесь, что в документации указано, как файлы обезвреживаются для конечных пользователей (например, как приложение ведёт себя при обнаружении вредоносного файла).",,✓,✓,, +V5,Работа с файлами,V5.2,Загрузка файлов и содержимое,V5.2.1,"Убедитесь, что приложение принимает только те файлы, которые может обработать без потери производительности или отказа в обслуживании.",✓,✓,✓,, +V5,Работа с файлами,V5.2,Загрузка файлов и содержимое,V5.2.2,"Убедитесь, что при загрузке файла (включая файлы внутри архивов, таких как ZIP) приложение проверяет, соответствует ли расширение ожидаемому, и валидирует, соответствует ли содержимое типу, указанному в расширении. Это включает проверку начальных 'magic bytes', перезапись изображений, использование специализированных библиотек. Для уровня 1 — достаточно проверок для файлов, критичных с точки зрения бизнеса или безопасности. Для уровней 2 и выше — для всех файлов.",✓,✓,✓,, +V5,Работа с файлами,V5.2,Загрузка файлов и содержимое,V5.2.3,"Убедитесь, что приложение проверяет архивы (например, zip, gz, docx, odt) на максимально допустимый распакованный размер и максимальное количество файлов до распаковки.",,✓,✓,, +V5,Работа с файлами,V5.2,Загрузка файлов и содержимое,V5.2.4,"Убедитесь, что для каждого пользователя установлены квоты на общий размер и количество файлов, чтобы один пользователь не мог переполнить хранилище.",,,✓,, +V5,Работа с файлами,V5.2,Загрузка файлов и содержимое,V5.2.5,"Убедитесь, что приложение не позволяет загружать архивы с символьными ссылками (symlinks), если это не требуется по бизнес-логике. Если требуется — разрешён только строго определённый список допустимых символьных ссылок.",,,✓,, +V5,Работа с файлами,V5.2,Загрузка файлов и содержимое,V5.2.6,"Убедитесь, что приложение отклоняет изображения с числом пикселей выше допустимого, чтобы предотвратить атаки 'pixel flood'.",,,✓,, +V5,Работа с файлами,V5.3,Хранение файлов,V5.3.1,"Убедитесь, что загруженные или сгенерированные из недоверенного ввода файлы, находящиеся в публичной директории, не исполняются как серверный код при обращении к ним по HTTP.",✓,✓,✓,, +V5,Работа с файлами,V5.3,Хранение файлов,V5.3.2,"Убедитесь, что при создании путей к файлам приложение использует внутренние или доверенные данные, а не пользовательские имена файлов. Если использование пользовательских имён или метаданных необходимо — требуется строгая проверка и очистка. Это защита от path traversal, LFI, RFI и SSRF.",✓,✓,✓,, +V5,Работа с файлами,V5.3,Хранение файлов,V5.3.3,"Убедитесь, что при обработке файлов на сервере (например, при распаковке) игнорируются пути, заданные пользователем, во избежание уязвимостей типа 'zip slip'.",,,✓,, +V5,Работа с файлами,V5.4,Скачивание файлов,V5.4.1,"Убедитесь, что приложение валидирует или игнорирует имена файлов, переданных пользователем (включая в JSON, JSONP или URL-параметре), и указывает имя файла в заголовке Content-Disposition при ответе.",,✓,✓,, +V5,Работа с файлами,V5.4,Скачивание файлов,V5.4.2,"Убедитесь, что имена файлов, передаваемые (например, в HTTP-заголовках или вложениях в email), кодируются или очищаются (например, по RFC 6266), чтобы сохранить структуру документа и предотвратить инъекции.",,✓,✓,, +V5,Работа с файлами,V5.4,Скачивание файлов,V5.4.3,"Убедитесь, что файлы, полученные из недоверенных источников, сканируются антивирусом, чтобы не распространять известное вредоносное содержимое.",,✓,✓,, +V6,Аутентификация,V6.1,Документация по аутентификации,V6.1.1,"Убедитесь, что в документации приложения описано, как используются механизмы, такие как ограничение частоты запросов (rate limiting), защита от автоматизации и адаптивные реакции, для защиты от атак, таких как подстановка учётных данных и перебор паролей. Документация должна ясно описывать конфигурацию этих механизмов и предотвращение злонамеренной блокировки аккаунтов.",✓,✓,✓,, +V6,Аутентификация,V6.1,Документация по аутентификации,V6.1.2,"Убедитесь, что задокументирован список контекстно-зависимых слов, запрещённых к использованию в паролях. В него могут входить производные от названий организаций, продуктов, идентификаторов систем, кодовых названий проектов, названий отделов или ролей и тому подобное.",,✓,✓,, +V6,Аутентификация,V6.1,Документация по аутентификации,V6.1.3,"Убедитесь, что если приложение поддерживает несколько способов аутентификации, то все они документированы вместе с описанием применяемых средств защиты и уровнем стойкости аутентификации, которые должны быть одинаково применены ко всем способам.",,✓,✓,, +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.1,"Убедитесь, что пользовательские пароли содержат не менее 8 символов. Рекомендуется минимальная длина в 15 символов.",✓,✓,✓,, +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.2,"Убедитесь, что пользователи могут менять свои пароли.",✓,✓,✓,, +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.3,"Убедитесь, что для смены пароля требуется ввести как текущий, так и новый пароль.",✓,✓,✓,, +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.4,"Убедитесь, что при регистрации или смене пароля введённый пароль проверяется по списку как минимум из 3000 самых популярных паролей, соответствующих политике (например, минимальной длине).",✓,✓,✓,, +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.5,"Убедитесь, что допускаются пароли любой структуры, без ограничений на использование определённых символов. Не должно быть требований по обязательному наличию заглавных/строчных букв, цифр или специальных символов.",✓,✓,✓,, +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.6,"Убедитесь, что поля ввода пароля используют type=password для скрытия символов. Разрешено временное отображение всего пароля или последнего введённого символа.",✓,✓,✓,, +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.7,"Убедитесь, что разрешены вставка (paste), использование менеджеров паролей браузера и внешних менеджеров паролей.",✓,✓,✓,, +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.8,"Убедитесь, что пароль проверяется строго в том виде, в котором он был введён пользователем — без обрезки, изменения регистра и других модификаций.",✓,✓,✓,, +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.9,"Убедитесь, что система позволяет использовать пароли длиной не менее 64 символов.",,✓,✓,, +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.10,"Убедитесь, что пароль остаётся действительным, пока не будет скомпрометирован или не будет изменён пользователем. Приложение не должно требовать регулярной смены пароля.",,✓,✓,, +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.11,"Убедитесь, что используется документированный список контекстно-зависимых слов (например, названия компаний, проектов и т.д.) для предотвращения использования легко угадываемых паролей.",,✓,✓,, +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.12,"Убедитесь, что при регистрации или смене пароля проверяется, не входит ли он в список скомпрометированных (утёкших) паролей.",,✓,✓,, +V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.1,"Убедитесь, что реализованы меры защиты от атак типа credential stuffing (массовая подстановка учётных данных) и brute-force (перебор паролей), согласно документации по безопасности приложения.",✓,✓,✓,, +V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.2,"Убедитесь, что в приложении отсутствуют или отключены учётные записи по умолчанию (например, root, admin, sa).",✓,✓,✓,, +V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.3,"Убедитесь, что для доступа к приложению используется либо механизм многофакторной аутентификации, либо комбинация однофакторных. Для уровня L3 один из факторов должен быть аппаратным, обеспечивающим защиту от фишинга, устойчивость к компрометации и подтверждение намерения аутентификации через явное действие пользователя (например, нажатие кнопки на FIDO-ключе или телефоне). Ослабление этих требований допускается только при наличии обоснования и компенсирующих мер.",,✓,✓,, +V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.4,"Убедитесь, что при наличии нескольких способов аутентификации, они все задокументированы, и для них единообразно применяются меры защиты и уровни доверия.",,✓,✓,, +V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.5,"Убедитесь, что пользователи получают уведомления о подозрительных попытках аутентификации (удачных и неудачных). Это может включать попытки (например, подключения) с необычного устройства или места, частично успешную MFA, попытку после долгого отсутствия или успешную аутентификацию после серии неудачных.",,,✓,, +V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.6,"Убедитесь, что email не используется ни как однофакторный, ни как многофакторный механизм аутентификации.",,,✓,, +V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.7,"Убедитесь, что пользователи получают уведомление при изменении данных аутентификации, таких как сброс пароля или изменение логина/email.",,,✓,, +V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.8,"Убедитесь, что из сообщений об ошибке, HTTP-кодов ответа или различий во времени ответа нельзя определить, существует ли пользователь с таким логином. Это правило также должно применяться к функциям регистрации и восстановления пароля.",,,✓,, +V6,Аутентификация,V6.4,Жизненный цикл и восстановление факторов аутентификации,V6.4.1,"Убедитесь, что начальные пароли или коды активации, генерируемые системой, создаются с использованием надёжного генератора случайных чисел, соответствуют текущей политике паролей и истекают через короткий период времени либо после первого использования. Эти секреты не должны использоваться как постоянные пароли.",✓,✓,✓,, +V6,Аутентификация,V6.4,Жизненный цикл и восстановление факторов аутентификации,V6.4.2,"Убедитесь, что в системе отсутствуют подсказки к паролю или вопросы на знание («секретные вопросы»).",✓,✓,✓,, +V6,Аутентификация,V6.4,Жизненный цикл и восстановление факторов аутентификации,V6.4.3,"Убедитесь, что реализован безопасный процесс сброса забытого пароля, который не обходит активные механизмы многофакторной аутентификации.",,✓,✓,, +V6,Аутентификация,V6.4,Жизненный цикл и восстановление факторов аутентификации,V6.4.4,"Убедитесь, что в случае утраты одного из факторов MFA проводится удостоверение личности (identity proofing) на том же уровне, что и при первичной регистрации.",,✓,✓,, +V6,Аутентификация,V6.4,Жизненный цикл и восстановление факторов аутентификации,V6.4.5,"Убедитесь, что инструкции по обновлению истекающих механизмов аутентификации отправляются заранее, с достаточным запасом времени для выполнения замены, при необходимости с настройкой автоматических напоминаний.",,,✓,, +V6,Аутентификация,V6.4,Жизненный цикл и восстановление факторов аутентификации,V6.4.6,"Убедитесь, что администраторы могут инициировать процесс сброса пароля, но не могут задать или выбрать новый пароль за пользователя. Это исключает ситуацию, при которой администратор знает пароль пользователя.",,,✓,, +V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.1,"Убедитесь, что lookup-секреты, внеполосные коды/запросы и TOTP-коды можно использовать только один раз.",,✓,✓,, +V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.2,"Убедитесь, что при хранении lookup-секретов с энтропией менее 112 бит (например, 19 случайных буквенно-цифровых символов или 34 случайные цифры) они хэшируются с использованием разрешённого алгоритма хеширования паролей и случайной соли минимум 32 бита. Если у секрета ≥112 бит энтропии — допустимо использовать стандартный хэш.",,✓,✓,, +V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.3,"Убедитесь, что lookup-секреты, коды внеполосной аутентификации и сиды для TOTP генерируются с использованием криптографически стойкого генератора случайных чисел (CSPRNG), чтобы избежать предсказуемых значений.",,✓,✓,, +V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.4,"Убедитесь, что lookup-секреты и внеполосные коды аутентификации имеют минимум 20 бит энтропии (достаточно, например, 4 случайных алфавитно-цифровых символов или 6 случайных цифр).",,✓,✓,, +V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.5,"Убедитесь, что все внеполосные запросы, коды и токены, а также TOTP-коды имеют ограниченный срок действия. Максимум для out-of-band — 10 минут, для TOTP — 30 секунд.",,✓,✓,, +V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.6,"Убедитесь, что любой фактор аутентификации (включая физические устройства) может быть отозван в случае кражи или утери.",,,✓,, +V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.7,"Убедитесь, что биометрические механизмы аутентификации используются только как вторичный фактор — в сочетании с «чем-то, что вы знаете» или «чем-то, что у вас есть».",,,✓,, +V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.8,"Убедитесь, что TOTP-коды проверяются по источнику времени, полученному от доверенного сервиса, а не от клиента или недоверенного источника.",,,✓,, +V6,Аутентификация,V6.6,Внеполосные механизмы аутентификации,V6.6.1,"Убедитесь, что механизмы аутентификации через телефонную сеть общего пользования (PSTN) для доставки одноразовых паролей (OTP) по телефону или SMS используются только в случае предварительной валидации номера, при этом предлагаются альтернативные более безопасные методы (например, TOTP), и пользователю сообщаются риски. Для приложений уровня L3 использование телефона и SMS недопустимо.",,✓,✓,, +V6,Аутентификация,V6.6,Внеполосные механизмы аутентификации,V6.6.2,"Убедитесь, что внеполосные запросы, коды или токены привязаны к исходному запросу аутентификации, для которого они были сгенерированы, и не могут быть использованы повторно для других попыток.",,✓,✓,, +V6,Аутентификация,V6.6,Внеполосные механизмы аутентификации,V6.6.3,"Убедитесь, что внеполосные механизмы на основе кода защищены от атак методом подбора (brute force) путём применения ограничения частоты запросов (rate limiting). Также рекомендуется использовать коды с энтропией не менее 64 бит.",,✓,✓,, +V6,Аутентификация,V6.6,Внеполосные механизмы аутентификации,V6.6.4,"Убедитесь, что при использовании push-уведомлений для MFA применяется ограничение частоты (rate limiting), чтобы предотвратить атаки push-бомбинга. Также может помочь механизм сопоставления номеров (number matching).",,,✓,, +V6,Аутентификация,V6.7,Криптографические механизмы аутентификации,V6.7.1,"Убедитесь, что сертификаты, используемые для проверки криптографических утверждений об аутентификации, хранятся таким образом, чтобы исключить возможность их модификации.",,,✓,, +V6,Аутентификация,V6.7,Криптографические механизмы аутентификации,V6.7.2,"Убедитесь, что nonce (случайная строка), используемая в процессе вызова, имеет длину не менее 64 бит и является статистически уникальной или уникальной на протяжении всего срока службы криптографического устройства.",,,✓,, +V6,Аутентификация,V6.8,Аутентификация с использованием провайдера идентификаций (IdP),V6.8.1,"Убедитесь, что при поддержке несколькими IdP, невозможно подделать личность пользователя через другой IdP (например, с тем же user ID). Стандартным способом защиты является регистрация пользователя с использованием сочетания ID самого IdP (в качестве пространства имён) и пользовательского ID внутри IdP.",,✓,✓,, +V6,Аутентификация,V6.8,Аутентификация с использованием провайдера идентификаций (IdP),V6.8.2,"Убедитесь, что наличие и целостность цифровой подписи в утверждениях аутентификации (например, в JWT или SAML) всегда проверяются, а неподписанные или недействительные утверждения отклоняются.",,✓,✓,, +V6,Аутентификация,V6.8,Аутентификация с использованием провайдера идентификаций (IdP),V6.8.3,"Убедитесь, что SAML-утверждения обрабатываются только один раз в течение периода их действия, чтобы исключить атаки воспроизведения (replay attacks).",,✓,✓,, +V6,Аутентификация,V6.8,Аутентификация с использованием провайдера идентификаций (IdP),V6.8.4,"Убедитесь, что если приложение использует внешний поставщик идентификации (IdP) и для определенных функций требуется особый уровень, метод или срок действия аутентификации, то приложение использует данные, возвращаемые IdP, для проверки этих условий. Например, при использовании OIDC можно проверить значения полей ID Token — acr, amr, auth_time (если они есть). Если IdP не предоставляет эти данные, приложение должно иметь документированный план действий по умолчанию, предполагающий использование минимально допустимой силы аутентификации (например, одноступенчатая — логин и пароль).",,✓,✓,, +V7,Управление сессиями,V7.1,Документация по управлению сессиями,V7.1.1,"Убедитесь, что тайм-аут бездействия и абсолютное максимальное время жизни сессии задокументированы, соответствуют другим контрольным мерам и сопровождаются обоснованием любых отклонений от требований повторной аутентификации NIST SP 800-63B.",,✓,✓,, +V7,Управление сессиями,V7.1,Документация по управлению сессиями,V7.1.2,"Убедитесь, что документация определяет допустимое количество одновременных (параллельных) сессий для одного аккаунта, а также поведение системы и действия при достижении этого лимита.",,✓,✓,, +V7,Управление сессиями,V7.1,Документация по управлению сессиями,V7.1.3,"Убедитесь, что все системы, создающие и управляющие сессиями пользователей в рамках федеративной идентификации (например, SSO), задокументированы вместе с механизмами координации сроков действия сессий, условий завершения и случаев, требующих повторной аутентификации.",,✓,✓,, +V7,Управление сессиями,V7.2,Базовая безопасность сессий,V7.2.1,"Убедитесь, что все проверки сессионных токенов выполняются на доверенной серверной стороне.",✓,✓,✓,, +V7,Управление сессиями,V7.2,Базовая безопасность сессий,V7.2.2,"Убедитесь, что приложение использует либо автономные токены, либо ссылочные токены, которые генерируются динамически, не используя статические API-секреты или ключи.",✓,✓,✓,, +V7,Управление сессиями,V7.2,Базовая безопасность сессий,V7.2.3,"Убедитесь, что ссылочные токены являются уникальными, создаются с использованием криптографически безопасного генератора псевдослучайных чисел (CSPRNG) и обладают энтропией не менее 128 бит.",✓,✓,✓,, +V7,Управление сессиями,V7.2,Базовая безопасность сессий,V7.2.4,"Убедитесь, что при аутентификации пользователя (включая повторную) создается новый токен сессии, а текущий — аннулируется.",✓,✓,✓,, +V7,Управление сессиями,V7.3,Тайм-ауты сессии,V7.3.1,"Убедитесь, что есть тайм-аут бездействия, после которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.",,✓,✓,, +V7,Управление сессиями,V7.3,Тайм-ауты сессии,V7.3.2,"Убедитесь, что установлено абсолютное максимальное время жизни сессии, по истечении которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.",,✓,✓,, +V7,Управление сессиями,V7.4,Завершение сессий,V7.4.1,"Убедитесь, что после завершения сессии (logout, истечение срока) дальнейшее её использование невозможно. Для ссылочных токенов или сессий с сохранением состояния это означает аннулирование на сервере. Для self-contained токенов необходимо реализовать механизм отзыва, например, список отозванных токенов, проверку времени выпуска или ротацию ключей подписи для каждого пользователя.",✓,✓,✓,, +V7,Управление сессиями,V7.4,Завершение сессий,V7.4.2,"Убедитесь, что при удалении или отключении пользователя все активные сессии немедленно завершаются.",✓,✓,✓,, +V7,Управление сессиями,V7.4,Завершение сессий,V7.4.3,"Убедитесь, что после изменения или удаления факторов аутентификации (например, смена пароля или MFA) приложение предлагает завершить все другие активные сессии.",,✓,✓,, +V7,Управление сессиями,V7.4,Завершение сессий,V7.4.4,"Убедитесь, что на всех страницах, требующих аутентификации, имеется простой и видимый способ выхода.",,✓,✓,, +V7,Управление сессиями,V7.4,Завершение сессий,V7.4.5,"Убедитесь, что администраторы могут завершать активные сессии конкретного пользователя или всех пользователей.",,✓,✓,, +V7,Управление сессиями,V7.5,Защита от злоупотреблений сессией,V7.5.1,"Убедитесь, что приложение требует полной повторной аутентификации перед изменением чувствительных атрибутов аккаунта, которые могут влиять на аутентификацию (например, email, номер телефона, настройки MFA или данных восстановления доступа).",,✓,✓,, +V7,Управление сессиями,V7.5,Защита от злоупотреблений сессией,V7.5.2,"Убедитесь, что пользователь может просматривать и (после повторной аутентификации хотя бы по одному фактору) завершать активные сессии.",,✓,✓,, +V7,Управление сессиями,V7.5,Защита от злоупотреблений сессией,V7.5.3,"Убедитесь, что перед выполнением критически важных операций приложение требует повторной аутентификации (по крайней мере, одного фактора) или дополнительной проверки.",,,✓,, +V7,Управление сессиями,V7.6,Федеративная повторная аутентификация,V7.6.1,"Убедитесь, что срок действия и завершение сессий между RP и IdP соответствуют документации и включают повторную аутентификацию, если достигнут максимальный допустимый интервал между событиями аутентификации.",,✓,✓,, +V7,Управление сессиями,V7.6,Федеративная повторная аутентификация,V7.6.2,"Убедитесь, что создание сессии требует согласия пользователя или явного действия, предотвращающего несанкционированное создание сессий без участия пользователя.",,✓,✓,, +V8,Авторизация,V8.1,Документация по авторизации,V8.1.1,"Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне функций и на уровне данных на основе прав субъекта и атрибутов ресурса.",✓,✓,✓,, +V8,Авторизация,V8.1,Документация по авторизации,V8.1.2,"Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне полей (как на чтение, так и на запись) на основе прав субъекта и атрибутов ресурса. Эти правила могут зависеть от других атрибутов объекта данных, например, статуса.",,✓,✓,, +V8,Авторизация,V8.1,Документация по авторизации,V8.1.3,"Убедитесь, что документация определяет, какие атрибуты окружения и контекста (например, время суток, IP-адрес, местоположение, устройство) используются приложением для принятия решений в области аутентификации и авторизации.",,,✓,, +V8,Авторизация,V8.1,Документация по авторизации,V8.1.4,"Убедитесь, что документация по аутентификации и авторизации определяет, как используются факторы окружения и контекста в принятии решений, наряду с правилами доступа к функциям, данным и полям. Документация должна содержать оцениваемые атрибуты, пороговые значения риска, действия (разрешить, отказать, повысить уровень аутентификации и др.).",,,✓,, +V8,Авторизация,V8.2,Архитектура авторизации,V8.2.1,"Убедитесь, что приложение обеспечивает доступ на уровне функций (function-level) только субъектам с явными разрешениями.",✓,✓,✓,, +V8,Авторизация,V8.2,Архитектура авторизации,V8.2.2,"Убедитесь, что приложение обеспечивает доступ на уровне данных (data-specific) только тем субъектам, которым явно предоставлены права к определённым элементам данных, чтобы предотвратить IDOR (Insecure Direct Object Reference) и BOLA-уязвимости (Broken Object Level Authorization).",✓,✓,✓,, +V8,Авторизация,V8.2,Архитектура авторизации,V8.2.3,"Убедитесь, что приложение обеспечивает доступ на уровне полей (field-level) только тем субъектам, которым явно предоставлены права к определённым полям, чтобы предотвратить BOPLA (Broken Object Property Level Authorization).",,✓,✓,, +V8,Авторизация,V8.2,Архитектура авторизации,V8.2.4,"Убедитесь, что реализованы адаптивные меры безопасности, основанные на атрибутах окружения и контекста субъекта (время, местоположение, IP, устройство), которые используются для принятия решений об аутентификации и авторизации, как это определено в документации приложения. Эти меры должны применяться как при попытке субъекта начать новую сессию, так и во время существующей сессии.",,,✓,, +V8,Авторизация,V8.3,Авторизация на уровне операций,V8.3.1,"Убедитесь, что правила авторизации реализуются на доверенном сервисном уровне и не зависят от элементов, которые может контролировать клиент (например, JavaScript на стороне клиента).",✓,✓,✓,, +V8,Авторизация,V8.3,Авторизация на уровне операций,V8.3.2,"Убедитесь, что изменения значений, влияющих на авторизацию, применяются немедленно. Если это невозможно (например, при использовании автономных токенов), должны быть реализованы компенсирующие меры: оповещения о попытке несанкционированного действия и откат изменений. Обратите внимание, что данный подход не предотвращает утечку информации.",,,✓,, +V8,Авторизация,V8.3,Авторизация на уровне операций,V8.3.3,"Убедитесь, что доступ к объекту осуществляется на основе прав субъекта, инициировавшего запрос, а не прав промежуточного сервиса, действующего от его имени. Например, если пользователь обращается к веб-сервису с автономным токеном для аутентификации, а сервис затем запрашивает данные у другого сервиса, второй сервис должен использовать токен пользователя, а не токен первого сервиса для принятия решения о доступе.",,,✓,, +V8,Авторизация,V8.4,Прочие аспекты авторизации,V8.4.1,"Убедитесь, что в мультитенантных приложениях реализованы механизмы, предотвращающие действия потребителя в отношении арендаторов, к которым у него нет доступа.",,✓,✓,, +V8,Авторизация,V8.4,Прочие аспекты авторизации,V8.4.2,"Убедитесь, что доступ к административным интерфейсам защищён несколькими уровнями контроля, включая непрерывную проверку личности, контроль защищённости устройства и анализ контекстных рисков. Недостаточно опираться только на IP-адрес или доверенные устройства.",,,✓,, +V9,Автономные токены,V9.1,Источник токена и его целостность,V9.1.1,"Убедитесь, что автономные токены проверяются на целостность с помощью цифровой подписи или MAC, прежде чем доверять их содержимому.",✓,✓,✓,, +V9,Автономные токены,V9.1,Источник токена и его целостность,V9.1.2,"Проверяйте, что автономные токены создаются и проверяются исключительно с помощью алгоритмов из списка допустимых в данном контексте. Список допустимых алгоритмов должен включать только разрешенные алгоритмы (желательно либо только симметричные, либо только асимметричные) и ни в коем случае не содержать алгоритм None. Если необходимо поддерживать оба типа алгоритмов, потребуются дополнительные средства контроля для предотвращения путаницы с ключами (key confusion).",✓,✓,✓,, +V9,Автономные токены,V9.1,Источник токена и его целостность,V9.1.3,"Убедитесь, что ключи, используемые для проверки автономных токенов, получены из доверенных, предварительно настроенных источников. Это предотвращает возможность указания злоумышленниками ненадёжных источников и ключей. Для JWT и других JWS структур заголовки 'jku', 'x5u' и 'jwk' должны проверяться по белому списку.",✓,✓,✓,, +V9,Автономные токены,V9.2,Содержимое токена,V9.2.1,"Убедитесь, что при указанном сроке действия токен и его содержимое принимаются только в том случае, если срок действия токена не истёк. Например, для JWT нужно проверить поля 'nbf' и 'exp'.",✓,✓,✓,, +V9,Автономные токены,V9.2,Содержимое токена,V9.2.2,"Убедитесь, что сервис, принимающий токен, проверяет его тип и соответствие назначению перед обработкой содержимого токена. Например, для принятия решений об авторизации могут быть приняты только Access Token, а для подтверждения аутентификации пользователя — только ID Token.",,✓,✓,, +V9,Автономные токены,V9.2,Содержимое токена,V9.2.3,"Убедитесь, что сервис принимает только токены, предназначенные для использования с этим сервисом (audience). Для JWT это можно сделать, проверив наличие утверждения «aud» по белому списку, определенному в сервисе.",,✓,✓,, +V9,Автономные токены,V9.2,Содержимое токена,V9.2.4,"Убедитесь, что, если эмитент токенов использует один и тот же закрытый ключ для выпуска токенов различным сервисам (audiences), выпущенные токены содержат явное указание целевых сервисов. Это предотвратит повторное использования токенов в не предназначенных для них сервисах. Если идентификатор сервиса (audience identifier) назначается динамически, эмитент токенов должен проверить audiences для исключения подмены получателей (audience impersonation).",,✓,✓,, +V10,OAuth и OIDC,V10.1,Общие требования безопасности OAuth и OIDC,V10.1.1,"Убедитесь, что токены передаются только тем компонентам, которым они действительно необходимы. Например, при использовании схемы backend-for-frontend для браузерных JavaScript-приложений, access и refresh токены должны быть доступны только на backend.",,✓,✓,, +V10,OAuth и OIDC,V10.1,Общие требования безопасности OAuth и OIDC,V10.1.2,"Убедитесь, что клиент принимает значения от авторизационного сервера (например, authorization code или ID Token) только если они получены в результате авторизационного потока, инициированного в той же сессии пользовательского агента и в рамках той же транзакции. Для этого клиентские секреты, такие как proof key для code exchange (PKCE) — 'code_verifier', 'state' или OIDC 'nonce' — должны быть непредсказуемыми, специфичными для транзакции и надежно привязанными как к клиенту, так и к сессии пользовательского агента, в которой началась транзакция.",,✓,✓,, +V10,OAuth и OIDC,V10.2,Клиент OAuth,V10.2.1,"Убедитесь, что если используется механизм authorization code flow, OAuth клиент защищён от CSRF, вызывающих запросы токенов либо за счёт использования механизма proof key for code exchange (PKCE), либо за счёт проверки параметра 'state', который был отправлен в запросе авторизации.",,✓,✓,, +V10,OAuth и OIDC,V10.2,Клиент OAuth,V10.2.2,"Убедитесь, что если OAuth клиент может взаимодействовать с более чем одним сервером авторизации, у него есть защита от атак смешивания (mix-up attacks). Например, клиент должен требовать, чтобы сервер авторизации возвращал параметр 'iss' и проверять его в ответах на авторизацию и токены.",,✓,✓,, +V10,OAuth и OIDC,V10.2,Клиент OAuth,V10.2.3,"Убедитесь, что OAuth клиент запрашивает только необходимые области доступа (scopes) или другие параметры авторизации в запросах к серверу авторизации.",,,✓,, +V10,OAuth и OIDC,V10.3,Сервер ресурсов OAuth,V10.3.1,"Убедитесь, что сервер ресурсов принимает только те access токены, которые предназначены для использования с этим сервисом (свойство audience). Эта принадлежность сервису может быть включена в структурированный access токен (например, в поле 'aud' в JWT) или проверяться через endpoint интроспекции токена.",,✓,✓,, +V10,OAuth и OIDC,V10.3,Сервер ресурсов OAuth,V10.3.2,"Убедитесь, что сервер ресурсов принимает решения по авторизации на основе claims из access токена, определяющих делегированную авторизацию. Если присутствуют claims, такие как 'sub', 'scope' и 'authorization_details', они должны участвовать в принятии решения.",,✓,✓,, +V10,OAuth и OIDC,V10.3,Сервер ресурсов OAuth,V10.3.3,"Убедитесь, что если для принятия решения по контролю доступа необходимо однозначно идентифицировать пользователя из access токена (JWT или ответа интроспекции), сервер ресурсов использует claims, которые не могут быть переприсвоены другим пользователям. Обычно это комбинация claims 'iss' и 'sub'.",,✓,✓,, +V10,OAuth и OIDC,V10.3,Сервер ресурсов OAuth,V10.3.4,"Убедитесь, что если сервер ресурсов требует определённой силы аутентификации, методов или свежести аутентификации, он проверяет, что предъявленный access токен удовлетворяет этим требованиям. Например, при наличии, могут использоваться claims OIDC 'acr', 'amr' и 'auth_time'.",,✓,✓,, +V10,OAuth и OIDC,V10.3,Сервер ресурсов OAuth,V10.3.5,"Убедитесь, что сервер ресурсов предотвращает использование украденных access токенов или их повторное использование (replay) неавторизованными лицами, требуя access токены с подтверждением отправителя — например, Mutual TLS для OAuth 2 или OAuth 2 Demonstration of Proof of Possession (DPoP).",,,✓,, +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.1,"Убедитесь, что сервер авторизации проверяет URI перенаправления (redirect URI), сверяя его с заранее зарегистрированным списком разрешённых URI для данного клиента (allowlist), используя точное сравнение строк.",✓,✓,✓,, +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.2,"Убедитесь, что если сервер авторизации возвращает authorization code в ответе авторизации, этот код может быть использован только один раз для запроса токена. При втором валидном запросе с уже использованным кодом сервер должен отклонить запрос и отозвать любые токены, связанные с этим кодом.",✓,✓,✓,, +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.3,"Убедитесь, что authorization code имеет короткое время жизни. Максимальная продолжительность — до 10 минут для приложений L1 и L2 и до 1 минуты для приложений L3.",✓,✓,✓,, +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.4,"Убедитесь, что сервер авторизации для конкретного клиента разрешает использование только тех типов авторизации, которые необходимы этому клиенту. Обратите внимание, что тип авторизации Implicit flow и Resource Owner Password Credentials flow больше не должны использоваться.",✓,✓,✓,, +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.5,"Убедитесь, что сервер авторизации предотвращает атаки повторного использования refresh токенов для публичных клиентов, предпочтительно используя sender-constrained refresh токены, такие как DPoP или сертификат-связанные токены с mutual TLS (mTLS). Для L1 и L2 допускается ротация refresh токенов с обязательной их инвалидацией после использования. Если используется ротация, сервер должен отозвать все refresh токены при попытке использовать уже инвалидированный токен.",✓,✓,✓,, +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.6,"Убедитесь, что при использовании типа авторизации «Authorization Code» сервер предотвращает атаки перехвата authorization code, требуя Proof Key for Code Exchange (PKCE). В запросах авторизации сервер должен требовать валидное значение 'code_challenge' и не принимать 'code_challenge_method' со значением 'plain'. В запросах токена обязательно валидировать параметр 'code_verifier'.",,✓,✓,, +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.7,"Убедитесь, что если сервер авторизации поддерживает динамическую регистрацию клиентов без аутентификации, он минимизирует риски вредоносных клиентов. Сервер должен валидировать метаданные клиента (например, зарегистрированные URI), обеспечивать согласие пользователя и предупреждать пользователя перед обработкой запроса авторизации от недоверенного клиента.",,✓,✓,, +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.8,"Убедитесь, что refresh токены имеют абсолютный срок действия, включая случаи, когда применяется скользящее время истечения срока.",,✓,✓,, +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.9,"Убедитесь, что пользователи могут отзывать refresh токены и reference access токены через пользовательский интерфейс сервера авторизации для снижения риска от вредоносных клиентов или кражи токенов.",,✓,✓,, +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.10,"Убедитесь, что конфиденциальный клиент аутентифицируется при взаимодействии с сервером авторизации через backchannel, например при запросах токена, pushed authorization requests (PAR) и запросах на отзыв токенов.",,✓,✓,, +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.11,"Убедитесь, что конфигурация сервера авторизации назначает OAuth клиенту только необходимые области доступа (scopes).",,✓,✓,, +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.12,"Убедитесь, что для конкретного клиента сервер авторизации разрешает только те значения 'response_mode', которые необходимы этому клиенту. Например, сервер должен валидировать это значение против ожидаемых или использовать pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).",,,✓,, +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.13,"Убедитесь, что грант типа 'code' всегда используется вместе с pushed authorization requests (PAR).",,,✓,, +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.14,"Убедитесь, что сервер авторизации выдаёт только sender-constrained (Proof-of-Possession) access токены, либо с сертификат-связанными токенами через mutual TLS (mTLS), либо DPoP-bound токены (Demonstration of Proof of Possession).",,,✓,, +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.15,"Убедитесь, что для серверного клиента (не выполняющегося на устройстве конечного пользователя) сервер авторизации проверяет, что значение параметра 'authorization_details' исходит из клиентского backend и что пользователь не изменял его. Например, это достигается использованием pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).",,,✓,, +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.16,"Убедитесь, что клиент является конфиденциальным и сервер авторизации требует использования сильных методов аутентификации клиента (основанных на криптографии с открытым ключом и устойчивых к атакам повторного воспроизведения), таких как mutual TLS ('tls_client_auth', 'self_signed_tls_client_auth') или private key JWT ('private_key_jwt').",,,✓,, +V10,OAuth и OIDC,V10.5,Клиент OIDC,V10.5.1,"Убедитесь, что клиент (relying party) защищается от повторного использования ID Token (replay-атак). Например, это достигается проверкой того, что значение 'nonce' в ID Token совпадает со значением 'nonce', отправленным в запросе аутентификации провайдеру OpenID (authorization server).",,✓,✓,, +V10,OAuth и OIDC,V10.5,Клиент OIDC,V10.5.2,"Убедитесь, что клиент однозначно идентифицирует пользователя по утверждениям (claims) ID Token, обычно это 'sub', который не может быть переназначен другому пользователю (в пределах конкретного провайдера идентификации).",,✓,✓,, +V10,OAuth и OIDC,V10.5,Клиент OIDC,V10.5.3,"Убедитесь, что клиент отклоняет попытки злоумышленного сервера авторизации выдавать себя за другой сервер авторизации через метаданные сервера авторизации. Клиент должен отклонить метаданные, если URL издателя (issuer) в метаданных не совпадает точно с преднастроенным URL издателя, ожидаемым клиентом.",,✓,✓,, +V10,OAuth и OIDC,V10.5,Клиент OIDC,V10.5.4,"Убедитесь, что клиент проверяет, что ID Token предназначен для него (проверка audience), сравнивая значение 'aud' в токене с 'client_id' клиента.",,✓,✓,, +V10,OAuth и OIDC,V10.5,Клиент OIDC,V10.5.5,"Убедитесь, что при использовании OIDC back-channel logout клиент снижает риск отказа в обслуживании, вызванный принудительным выходом из системы и путаницей между разными типами JWT (cross-JWT confusion) в процессе логаута. Клиент должен проверить, что токен выхода корректно типизирован со значением 'logout+jwt', содержит claim 'event' с правильным именем участника и не содержит 'nonce'. Также рекомендуется установить короткий срок действия токена (например, 2 минуты).",,✓,✓,, +V10,OAuth и OIDC,V10.6,Провайдер OpenID,V10.6.1,"Убедитесь, что провайдер OpenID допускает только значения 'code', 'ciba', 'id_token' или 'id_token code' для параметра response mode. При этом предпочтение отдаётся 'code' по сравнению с 'id_token code' (гибридный поток OIDC), а значение 'token' (любой Implicit flow) не должно использоваться.",,✓,✓,, +V10,OAuth и OIDC,V10.6,Провайдер OpenID,V10.6.2,"Убедитесь, что провайдер OpenID предотвращает отказ в обслуживании (DoS) через принудительный выход (logout), запрашивая явное подтверждение от конечного пользователя или, если применимо, проверяя параметры в запросе выхода (инициированном relying party), например параметр 'id_token_hint'.",,✓,✓,, +V10,OAuth и OIDC,V10.7,Управление согласием,V10.7.1,"Убедитесь, что авторизационный сервер обеспечивает получение согласия пользователя для каждого запроса авторизации. Если личность клиента не может быть подтверждена, сервер авторизации всегда должен явно запрашивать согласие пользователя.",,✓,✓,, +V10,OAuth и OIDC,V10.7,Управление согласием,V10.7.2,"Убедитесь, что при запросе согласия пользователя авторизационный сервер предоставляет достаточную и понятную информацию о том, на что даётся согласие. При необходимости это должно включать характер запрашиваемых разрешений (обычно основанных на scope, ресурсном сервере, деталях авторизации Rich Authorization Requests (RAR)), идентификацию авторизованного приложения и срок действия этих разрешений.",,✓,✓,, +V10,OAuth и OIDC,V10.7,Управление согласием,V10.7.3,"Убедитесь, что пользователь может просматривать, изменять и отзывать согласия, которые он предоставил, через авторизационный сервер.",,✓,✓,, +V11,Криптография,V11.1,Инвентаризация и документирование криптографии,V11.1.1,"Убедитесь, что задокументирована политика управления криптографическими ключами и описан их жизненный цикл в соответствии со стандартом управления ключей, таким как NIST SP 800-57. Убедитесь, что ключи известны только тем сущностям, которым они должны быть доступны (например, ключи не передавались более чем двум участникам для общих секретов и более чем одному участнику для приватных ключей).",,✓,✓,, +V11,Криптография,V11.1,Инвентаризация и документирование криптографии,V11.1.2,"Убедитесь, что проводится инвентаризация криптографических средств, которая непрерывно поддерживается, регулярно обновляется и включает все криптографические ключи, алгоритмы и сертификаты, используемые в приложении. Также должна быть задокументирована информация о том, где ключи могут и не могут использоваться в системе, а также какие типы данных могут и не могут быть защищены с помощью этих ключей.",,✓,✓,, +V11,Криптография,V11.1,Инвентаризация и документирование криптографии,V11.1.3,"Убедитесь, что используются механизмы обнаружения криптографии для идентификации всех случаев применения криптографии в системе , включая операции шифрования, хеширования и цифровой подписи.",,,✓,, +V11,Криптография,V11.1,Инвентаризация и документирование криптографии,V11.1.4,"Убедитесь, что ведётся и поддерживается инвентаризация криптографических средств. В неё должен входить документированный план, описывающий переход на новые криптографические стандарты, такие как постквантовая криптография, чтобы своевременно реагировать на будущие угрозы.",,,✓,, +V11,Криптография,V11.2,Безопасная реализация криптографии,V11.2.1,"Убедитесь, что для криптографических операций используются утвержденные в индустрии реализации (включая библиотеки и аппаратные реализации).",,✓,✓,, +V11,Криптография,V11.2,Безопасная реализация криптографии,V11.2.2,"Убедитесь, что архитектура приложения поддерживает быструю реконфигурацию, усовершенствование или смену в любой момент случайных чисел, аутентифицированного шифрования, MAC, алгоритмов хеширования, длин ключей, количества раундов, шифров и режимов шифрования для защиты от криптографических атак. Также должна поддерживаться возможность смены ключей, паролей и повторного шифрования данных. Это позволит беспрепятственно перейти на постквантовую криптографию (PQC), как только станут широко доступны высоконадёжные реализации одобренных схем или стандартов PQC.",,✓,✓,, +V11,Криптография,V11.2,Безопасная реализация криптографии,V11.2.3,"Убедитесь, что все криптографические примитивы используют как минимум 128-бит стойкости с учетом алгоритма, размера ключа и конфигурации. Например, 256-битный ECC ключ обеспечивает примерно 128 бит безопасности, тогда как для достижения того же уровня безопасности в RSA требуется ключ длиной 3072 бита.",,✓,✓,, +V11,Криптография,V11.2,Безопасная реализация криптографии,V11.2.4,"Убедитесь, что все криптографические операции выполняются за константное время, без использования «short-circuit» операций в сравнениях, вычислениях, возвратах функций для избежания утечек информации.",,,✓,, +V11,Криптография,V11.2,Безопасная реализация криптографии,V11.2.5,"Убедитесь, что все криптографические модули обеспечивают безопасное завершение работы при ошибках, а обработка ошибок реализована таким образом, чтобы не создавать уязвимостей, например, таких как атаки Padding Oracle.",,,✓,, +V11,Криптография,V11.3,Алгоритмы шифрования,V11.3.1,"Убедитесь, что не используются небезопасные режимы блочного шифрования (н-р, ECB) и слабые схемы дополнения (padding) (н-р, PKCS#1 v1.5).",✓,✓,✓,, +V11,Криптография,V11.3,Алгоритмы шифрования,V11.3.2,"Убедитесь, что используются только утверждённые шифры и режимы, такие как AES с GCM.",✓,✓,✓,, +V11,Криптография,V11.3,Алгоритмы шифрования,V11.3.3,"Убедитесь, что зашифрованные данные защищены от несанкционированного изменения, предпочтительно с использованием утверждённого метода аутентифицированного шифрования или путём комбинирования утверждённого метода шифрования с утверждённым алгоритмом MAC.",,✓,✓,, +V11,Криптография,V11.3,Алгоритмы шифрования,V11.3.4,"Убедитесь, что случайные числа (nonce), векторы инициализации (IV) и другие одноразовые числа не используются более одного раза для одной и той же пары ключа шифрования и элемента данных. Метод их генерации должен соответствовать требованиям используемого алгоритма.",,,✓,, +V11,Криптография,V11.3,Алгоритмы шифрования,V11.3.5,"Убедитесь, что любая комбинация алгоритма шифрования и алгоритма MAC работает в режиме encrypt-then-MAC (EtM).",,,✓,, +V11,Криптография,V11.4,Хеширование и функции на основе хеширования,V11.4.1,"Убедитесь, что только утвержденные хэш-функции используются для стандартных сценариев использования в криптографии, включая цифровую подпись, HMAC, KDF, генерацию случайных чисел. Запрещено использовать неустойчивые хэш-функции, (н-р, MD5) для любого использования в криптографии.",✓,✓,✓,, +V11,Криптография,V11.4,Хеширование и функции на основе хеширования,V11.4.2,"Убедитесь, что пароли хранятся с использованием утверждённой, вычислительно затратной функции генерации ключа (также известной как «функция хеширования паролей»), с параметрами, настроенными в соответствии с актуальными рекомендациями. Настройки должны обеспечивать баланс между безопасностью и производительностью, чтобы сделать атаки перебором достаточно сложными для требуемого уровня безопасности.",,✓,✓,, +V11,Криптография,V11.4,Хеширование и функции на основе хеширования,V11.4.3,"Убедитесь, что хэш-функции, используемые в формировании цифровой подписи, как часть аутентификации и целостности данных, устойчивы к коллизиям и имеют достаточную длину.",,✓,✓,, +V11,Криптография,V11.4,Хеширование и функции на основе хеширования,V11.4.4,"Убедитесь, что приложение использует утвержденную функцию генерации ключа с использованием параметров расширения ключа (key stretching) при генерации ключа из пароля. Параметры должны быть сбалансированы с точки зрения безопасности, производительности и устойчивости к атакам полного перебора при компрометации результирующего криптографического ключа.",,✓,✓,, +V11,Криптография,V11.5,Случайные значения,V11.5.1,"Убедитесь, что все случайные числа и строки, которые должны быть непредсказуемы, должны быть сгенерированы с помощью CSPRNG и иметь хотя бы 128 бит энтропии. Учтите, что UUID не удовлетворяют данному условию.",,✓,✓,, +V11,Криптография,V11.5,Случайные значения,V11.5.2,"Убедитесь, что механизм генерации случайных чисел является надежным даже при высокой нагрузке.",,,✓,, +V11,Криптография,V11.6,Криптография с публичным ключом,V11.6.1,"Убедитесь, что только утвержденные криптографические алгоритмы и режимы операций используются для генерации ключа и инициализации случайного значения для его генерации (seeding), а также для генерации цифровой подписи и верификации. Алгоритмы генерации ключей не должны генерировать небезопасные ключи уязвимые к известным атакам, например, ключи RSA уязвимы к факторизации Ферма.",,✓,✓,, +V11,Криптография,V11.6,Криптография с публичным ключом,V11.6.2,"Убедитесь, что для обмена ключами используются утверждённые криптографические алгоритмы (например, Диффи-Хеллман) с особым вниманием к обеспечению использования безопасных параметров. Это предотвратит атаки на процесс установления ключа, которые могут привести к атакам «человек посередине» или криптографическим взломам.",,,✓,, +V11,Криптография,V11.7,Шифрование данных в процессе использования,V11.7.1,"Убедитесь, что используется полное шифрование памяти, которое защищает конфиденциальные данные во время их использования, предотвращая доступ к ним неавторизованных пользователей или процессов.",,,✓,, +V11,Криптография,V11.7,Шифрование данных в процессе использования,V11.7.2,"Убедитесь, что минимизация данных обеспечивает раскрытие минимально необходимого объёма данных во время обработки, а также что данные шифруются сразу после использования или как можно скорее.",,,✓,, +V12,Безопасная коммуникация,V12.1,Общие рекомендации по безопасности TLS,V12.1.1,"Убедитесь, что включены только актуальные и рекомендуемые версии протокола TLS, такие как TLS 1.2 и TLS 1.3. Наиболее свежая версия TLS должна быть выбрана как предпочтительная.",✓,✓,✓,, +V12,Безопасная коммуникация,V12.1,Общие рекомендации по безопасности TLS,V12.1.2,"Убедитесь, что включены рекомендуемые шифронаборы (cipher suites), предпочтение также стоит отдать самому сильному шифронабору. L3 приложения должны поддерживать только те наборы шифров (cipher suites), которые обеспечивают прямую (forward) секретность. Пояснение: Прямая секретность (Forward Secrecy, FS) — это криптографическая особенность, при которой сессионные ключи уникальны для каждой сессии и не зависят от долгосрочных ключей. Это гарантирует, что даже при компрометации долгосрочного ключа злоумышленник не сможет расшифровать ранее перехваченные зашифрованные сессии.",,✓,✓,, +V12,Безопасная коммуникация,V12.1,Общие рекомендации по безопасности TLS,V12.1.3,"Убедитесь, что приложение проверяет доверенность клиентских сертификатов mTLS, прежде чем использовать идентификацию по сертификату для аутентификации или авторизации.",,✓,✓,, +V12,Безопасная коммуникация,V12.1,Общие рекомендации по безопасности TLS,V12.1.4,"Убедитесь, что включена и настроена правильная проверка отзыва сертификатов, такая как Online Certificate Status Protocol (OCSP) Stapling.",,,✓,, +V12,Безопасная коммуникация,V12.1,Общие рекомендации по безопасности TLS,V12.1.5,"Убедитесь, что в настройках TLS приложения включена функция Encrypted Client Hello (ECH) для предотвращения раскрытия конфиденциальных метаданных, таких как Server Name Indication (SNI), во время процесса TLS-рукопожатия.",,,✓,, +V12,Безопасная коммуникация,V12.2,HTTPS коммуникация с внешними сервисами,V12.2.1,"Убедитесь, что для всех соединений между клиентом и внешними HTTP-сервисами используется TLS и не происходит отката к небезопасным или незашифрованным протоколам.",✓,✓,✓,, +V12,Безопасная коммуникация,V12.2,HTTPS коммуникация с внешними сервисами,V12.2.2,"Убедитесь, что внешние сервисы используют публично доверенные TLS-сертификаты.",✓,✓,✓,, +V12,Безопасная коммуникация,V12.3,Общая безопасность межсервисного взаимодействия,V12.3.1,"Убедитесь, что для всех входящих и исходящих соединений приложения используется зашифрованный протокол, например TLS, включая системы мониторинга, инструменты управления, удалённый доступ и SSH, промежуточное ПО, базы данных, мейнфреймы, партнёрские системы и внешние API. Сервер не должен допускать откат к небезопасным или незашифрованным протоколам.",,✓,✓,, +V12,Безопасная коммуникация,V12.3,Общая безопасность межсервисного взаимодействия,V12.3.2,"Убедитесь, что TLS-клиент проверяет сертификат сервера до установления защищенного соединения с TLS-сервером.",,✓,✓,, +V12,Безопасная коммуникация,V12.3,Общая безопасность межсервисного взаимодействия,V12.3.3,"Убедитесь, что все внутренние HTTP-взаимодействия между компонентами приложения используют TLS или другой подходящий механизм транспортного шифрования, и не происходит откат к небезопасным или незашифрованным коммуникациям.",,✓,✓,, +V12,Безопасная коммуникация,V12.3,Общая безопасность межсервисного взаимодействия,V12.3.4,"Убедитесь, что TLS-соединения между внутренними сервисами используют доверенные сертификаты. Если используются внутренние или самоподписанные сертификаты, потребляющий сервис должен быть настроен на доверие только к конкретным внутренним центрам сертификации (CA) и конкретным самоподписанным сертификатам.",,✓,✓,, +V12,Безопасная коммуникация,V12.3,Общая безопасность межсервисного взаимодействия,V12.3.5,"Убедитесь, что сервисы, взаимодействующие внутри системы (intra-service communications), используют строгую аутентификацию для проверки каждого конечного узла. Для проверки подлинности взаимодействующих сторон должны применяться методы строгой аутентификации, такие как аутентификация TLS-клиента, с использованием инфраструктуры открытых ключей и механизмов, устойчивых к атакам повтора (replay attacks). Для микросервисных архитектур рекомендуется использование service mesh для упрощения управления сертификатами и повышения безопасности.",,,✓,, +V13,Конфигурация,V13.1,Документация конфигурации,V13.1.1,"Убедитесь, что все необходимые доступы приложения задокументированы. Сюда должны быть включены как внешние сервисы, от которых зависит приложение, так и сценарии, когда конечный пользователь может задавать адреса для внешнего подключения.",,✓,✓,, +V13,Конфигурация,V13.1,Документация конфигурации,V13.1.2,"Убедитесь, что для каждого сервиса, используемого приложением, в документации определено максимальное количество одновременных соединений (например, лимиты пула соединений) и описано поведение приложения при достижении этого лимита, включая любые механизмы отказоустойчивости или восстановления, чтобы предотвратить ситуации отказа в обслуживании (DoS).",,,✓,, +V13,Конфигурация,V13.1,Документация конфигурации,V13.1.3,"Убедитесь, что в документации приложения определены стратегии управления ресурсами для каждой внешней системы или сервиса, которые оно использует (например, базы данных, файловые дескрипторы, потоки, HTTP-соединения). Стратегии должны включать процедуры освобождения ресурсов, настройки таймаутов, обработку сбоев, а также, если реализована логика повторных попыток, указание лимитов, задержек и алгоритмов back-off. Для синхронных HTTP-запросов должны быть заданы короткие таймауты, а повторные запросы должны быть отключены, либо строго ограничены по числу попыток, чтобы предотвратить каскадные задержки и истощение ресурсов.",,,✓,, +V13,Конфигурация,V13.1,Документация конфигурации,V13.1.4,"Убедитесь, что в документации приложения определены секреты, критически важные для безопасности приложения, а также установлен график их ротации в соответствии с моделью угроз организации и её бизнес-требованиями.",,,✓,, +V13,Конфигурация,V13.2,Конфигурация бэкенд соединений,V13.2.1,"Убедитесь, что коммуникации между компонентами бэкенда приложения (включая API, промежуточное ПО и уровни данных), которые не поддерживают стандартный механизм пользовательских сессий, проходят с аутентификацией. Аутентификация должна использовать индивидуальные сервисные аккаунты, краткосрочные токены или аутентификацию на основе сертификатов, а не постоянные учётные данные, такие как пароли, API-ключи или общие аккаунты с привилегированным доступом.",,✓,✓,, +V13,Конфигурация,V13.2,Конфигурация бэкенд соединений,V13.2.2,"Убедитесь, что коммуникации между компонентами бэкенда приложения, включая локальные или системные службы, API, промежуточное ПО и уровни данных, выполняются с использованием аккаунтов, которым назначены минимально необходимые привилегии.",,✓,✓,, +V13,Конфигурация,V13.2,Конфигурация бэкенд соединений,V13.2.3,"Убедитесь, что если для аутентификации в сервисе используются учётные данные, то используемые потребителем учётные данные не являются стандартными (например, root/root или admin/admin).",,✓,✓,, +V13,Конфигурация,V13.2,Конфигурация бэкенд соединений,V13.2.4,"Убедитесь, что используется белый список (allowlist) для определения внешних ресурсов или систем, с которыми приложению разрешено взаимодействовать (например, для исходящих запросов, загрузки данных или доступа к файлам). Этот белый список может быть реализован на уровне приложения, веб-сервера, межсетевого экрана или комбинации различных уровней.",,✓,✓,, +V13,Конфигурация,V13.2,Конфигурация бэкенд соединений,V13.2.5,"Убедитесь, что веб- или прикладной сервер настроен с белым списком ресурсов или систем, к которым сервер может отправлять запросы или из которых может загружать данные и файлы.",,✓,✓,, +V13,Конфигурация,V13.2,Конфигурация бэкенд соединений,V13.2.6,"Убедитесь, что при подключении приложения к другим сервисам соблюдается задокументированная конфигурация для каждого соединения, включая максимальное количество параллельных соединений, поведение при достижении их максимума, таймауты и стратегии повторных попыток подключения.",,,✓,, +V13,Конфигурация,V13.3,Управление секретами,V13.3.1,"Убедитесь, что для безопасного создания, хранения, контроля доступа и уничтожения секретов бэкенда используется решение для управления секретами, например, хранилище ключей (key vault). Секретами могут быть пароли, ключевой материал, интеграции с базами данных и сторонними системами, ключи и seed-значения для токенов с ограниченным временем действия, другие внутренние секреты и API-ключи. Секреты не должны включаться в исходный код приложения или артефакты сборки. Для приложений уровня L3 необходимо использовать аппаратное решение, например, аппаратный модуль безопасности (HSM).",,✓,✓,, +V13,Конфигурация,V13.3,Управление секретами,V13.3.2,"Убедитесь, что доступ к секретным ресурсам осуществляется в соответствии с принципом минимально необходимых привилегий (least privilege).",,✓,✓,, +V13,Конфигурация,V13.3,Управление секретами,V13.3.3,"Убедитесь, что все криптографические операции выполняются с использованием изолированного модуля безопасности (например, хранилища ключей или аппаратного модуля безопасности), чтобы надежно управлять ключевым материалом и защищать его от утечки за пределы модуля безопасности.",,,✓,, +V13,Конфигурация,V13.3,Управление секретами,V13.3.4,"Убедитесь, что секреты настроены на срок действия и ротацию в соответствии с документацией приложения.",,,✓,, +V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.1,"Убедитесь, что приложение развернуто либо без метаданных систем контроля версий (включая папки .git или .svn), либо так, чтобы эти папки были недоступны как извне, так и для самого приложения.",✓,✓,✓,, +V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.2,"Убедитесь, что режимы отладки отключены для всех компонентов в промышленной среде, чтобы предотвратить раскрытие функций отладки и утечку информации.",,✓,✓,, +V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.3,"Убедитесь, что веб-серверы не показывают клиентам списки содержимого каталогов, если это явно не предусмотрено.",,✓,✓,, +V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.4,"Убедитесь, что метод HTTP TRACE не поддерживается в продуктовой среде, чтобы избежать потенциальной утечки информации.",,✓,✓,, +V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.5,"Убедитесь, что документация (например, по внутренним API) и мониторинговые эндпоинты не доступны, если это явно не предусмотрено.",,✓,✓,, +V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.6,"Убедитесь, что приложение не раскрывает подробную информацию о версиях компонентов бэкенда.",,,✓,, +V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.7,"Убедитесь, что веб-слой настроен на обслуживание только файлов с определёнными расширениями, чтобы предотвратить непреднамеренную утечку информации, конфигураций и исходного кода.",,,✓,, +V14,Защита информации,V14.1,Документация по защите информации,V14.1.1,"Убедитесь, что все конфиденциальные данные, создаваемые и обрабатываемые приложением, идентифицированы и классифицированы по уровням защиты. Включая закодированные данные, которые легко декодируются, например, строки Base64 или незашифрованные данные в полезной нагрузке JWT. Уровни защиты должны учитывать требования по защите данных и конфиденциальности, которым должно соответствовать приложение.",,✓,✓,, +V14,Защита информации,V14.1,Документация по защите информации,V14.1.2,"Убедитесь, что для каждого уровня защиты конфиденциальных данных требования к защите задокументированы. Они должны включать (но не ограничиваться) требования по шифрованию, проверке целостности, срокам хранения, способам логирования данных, контролю доступа к чувствительным данным в логах, шифрованию на уровне базы данных, применению технологий повышения конфиденциальности, а также другим требованиям по конфиденциальности.",,✓,✓,, +V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.1,"Убедитесь, что конфиденциальные данные передаются на сервер только в теле HTTP-запроса или в заголовках. URL и строка запроса не должны содержать конфиденциальную информацию, такую как API-ключ или сессионный токен.",✓,✓,✓,, +V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.2,"Убедитесь, что приложение предотвращает кэширование конфиденциальных данных в серверных компонентах, таких как балансировщики нагрузки и кэши приложений, либо гарантирует их надежное удаление после использования.",,✓,✓,, +V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.3,"Убедитесь, что заранее определённые конфиденциальные данные не отправляются ненадёжным сторонам (например, системам трекинга пользователей), чтобы предотвратить нежелательный сбор данных вне контроля приложения.",,✓,✓,, +V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.4,"Убедитесь, что для конфиденциальных данных реализованы меры по шифрованию, проверке целостности, срокам хранения, способам логирования, контролю доступа к данным в логах, а также применяются технологии повышения конфиденциальности в соответствии с документацией для соответствующего уровня защиты данных.",,✓,✓,, +V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.5,"Убедитесь, что механизмы кэширования настроены так, чтобы кэшировать только ответы с ожидаемым типом содержимого для данного ресурса и не содержать конфиденциального динамического контента. При обращении к несуществующему файлу, веб-сервер должен возвращать ответ 404 или 302, а не подменять на другой существующий файл, что позволит предотвратить атаки типа Web Cache Deception.",,,✓,, +V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.6,"Убедитесь, что приложение возвращает только минимально необходимый объем конфиденциальных данных для выполнения своей функциональности. Например, показывает только часть цифр номера кредитной карты, а не полный номер. Если требуется отображение полных данных, они должны быть замаскированы в пользовательском интерфейсе, пока пользователь специально не запросил их просмотр.",,,✓,, +V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.7,"Убедитесь, что конфиденциальная информация подлежит классификации по срокам хранения, чтобы устаревшие или ненужные данные удалялись автоматически, по расписанию или по мере необходимости.",,,✓,, +V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.8,"Убедитесь, что конфиденциальная информация удаляется из метаданных файлов, загружаемых пользователями, если пользователь явно не согласился на ее хранение.",,,✓,, +V14,Защита информации,V14.3,Защита данных на стороне клиента,V14.3.1,"Убедитесь, что аутентифицированные данные очищаются из клиентского хранилища, например, из DOM браузера, после завершения работы клиента или сессии. Заголовок HTTP-ответа Clear-Site-Data может помочь в этом, но клиентская сторона также должна уметь очищать данные, если соединение с сервером недоступно при завершении сессии.",✓,✓,✓,, +V14,Защита информации,V14.3,Защита данных на стороне клиента,V14.3.2,"Убедитесь, что приложение устанавливает HTTP-заголовки, достаточные для предотвращения кэширования (например, Cache-Control: no-store), чтобы конфиденциальные данные не сохранялись в браузерах.",,✓,✓,, +V14,Защита информации,V14.3,Защита данных на стороне клиента,V14.3.3,"Убедитесь, что данные, хранящиеся в браузерном хранилище (например, localStorage, sessionStorage, IndexedDB или cookie), не содержат конфиденциальной информации, за исключением сессионных токенов.",,✓,✓,, +V15,Безопасная разработка и архитектура,V15.1,Документация по безопасной разработке и архитектуре,V15.1.1,"Убедитесь, что в документации по приложению определены сроки устранения уязвимостей на основе оценки рисков для внешних зависимостей с уязвимостями и для обновления библиотек в целом, чтобы минимизировать риск, связанный с этими компонентами.",✓,✓,✓,, +V15,Безопасная разработка и архитектура,V15.1,Документация по безопасной разработке и архитектуре,V15.1.2,"Убедитесь, что ведется реестр всех используемых сторонних библиотек (например, Software Bill of Materials, SBOM), с обязательной проверкой, что компоненты получены из предопределенных, доверенных и регулярно поддерживаемых репозиториев.",,✓,✓,, +V15,Безопасная разработка и архитектура,V15.1,Документация по безопасной разработке и архитектуре,V15.1.3,"Убедитесь, что в документации приложения указан функционал, требующий значительных временных или вычислительных ресурсов. Необходимо указать, как предотвратить потерю доступности из-за чрезмерного использования этого функционала и как избежать ситуаций, когда формирование ответа занимает больше времени, чем установленный системой таймаут. Возможные меры защиты могут включать асинхронную обработку, использование очередей и ограничение количества параллельных процессов для каждого пользователя и приложения.",,✓,✓,, +V15,Безопасная разработка и архитектура,V15.1,Документация по безопасной разработке и архитектуре,V15.1.4,"Убедитесь, что в документации приложения указаны внешние библиотеки, которые считаются «компонентами с повышенным риском».",,,✓,, +V15,Безопасная разработка и архитектура,V15.1,Документация по безопасной разработке и архитектуре,V15.1.5,"Убедитесь, что в документации приложения выделены те части приложения, в которых используются «функционал с повышенным риском».",,,✓,, +V15,Безопасная разработка и архитектура,V15.2,Архитектура безопасности и зависимости,V15.2.1,"Убедитесь, что приложение содержит только те компоненты, которые не нарушили задокументированные сроки обновления и исправления.",✓,✓,✓,, +V15,Безопасная разработка и архитектура,V15.2,Архитектура безопасности и зависимости,V15.2.2,"Убедитесь, что в приложении реализованы меры защиты от потери доступности из-за функциональности, требующей много времени или ресурсов, на основе задокументированных решений и стратегий безопасности для этого.",,✓,✓,, +V15,Безопасная разработка и архитектура,V15.2,Архитектура безопасности и зависимости,V15.2.3,"Убедитесь, что производственная среда включает только те функции, которые необходимы для работы приложения, и не предоставляет лишние функции, такие как тестовый код, примеры кода и инструменты разработки.",,✓,✓,, +V15,Безопасная разработка и архитектура,V15.2,Архитектура безопасности и зависимости,V15.2.4,"Убедитесь, что сторонние компоненты и все их транзитивные зависимости загружаются только из ожидаемых репозиториев (внутренних или внешних) и отсутствует риск атаки через подмену зависимостей (dependency confusion attack)",,,✓,, +V15,Безопасная разработка и архитектура,V15.2,Архитектура безопасности и зависимости,V15.2.5,"Убедитесь, что приложение реализует дополнительные меры защиты для тех частей приложения, которые документированы как содержащие «функционал с повышенным риском» или использующие сторонние библиотеки, считающиеся «функционалом с повышенным риском». Это могут быть такие методы, как «песочница», инкапсуляция, контейнеризация или изоляция на сетевом уровне, чтобы задержать и предотвратить продвижение (pivoting) злоумышленников, скомпрометировавших одну часть приложения, к другим частям приложения.",,,✓,, +V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.1,"Убедитесь, что приложение возвращает только необходимое подмножество полей из объекта данных. Например, оно не должно возвращать весь объект данных, поскольку некоторые отдельные поля должны быть недоступны пользователям.",✓,✓,✓,, +V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.2,"Убедитесь, что при вызовах внешних URL-адресов бэкэнд приложения настроен так, чтобы не выполнять перенаправления, если только это не предусмотрено функционалом.",,✓,✓,, +V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.3,"Убедитесь, что в приложении реализованы защитные механизмы против атак типа массового присвоения (mass assignment) путем строгого ограничения разрешенных полей для каждого контроллера и действия, исключая возможность добавления или изменения значений полей, которые не должны быть доступны для данной конкретной операции.",,✓,✓,, +V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.4,"Убедитесь, что все прокси и промежуточное ПО корректно передают исходный IP-адрес пользователя, используя доверенные поля данных, которые не могут быть изменены конечным пользователем, а приложение и веб-сервер используют это правильное значение для ведения логирования и принятия решений по безопасности, таких как ограничение запросов. При этом следует учитывать, что даже исходный IP-адрес может быть ненадежным из-за динамических IP-адресов, VPN или корпоративных файрволов.",,✓,✓,, +V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.5,"Убедитесь, что приложение явно проверяет соответствие переменных ожидаемому типу данных и использует строгие операции сравнения. Это необходимо для предотвращения уязвимостей, связанных с type juggling и type confusion, вызванных тем, что код приложения делает предположения о типе переменной.",,✓,✓,, +V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.6,"Убедитесь, что JavaScript-код написан таким образом, чтобы предотвратить prototype pollution, например, используя Set() или Map() вместо обычных литералов объекта.",,✓,✓,, +V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.7,"Убедитесь, что приложение защищено от атак типа HTTP Parameter Pollution (HPP), особенно если используемый фреймворк не различает источники параметров запроса (строка запроса, тело запроса, куки или заголовки).",,✓,✓,, +V15,Безопасная разработка и архитектура,V15.4,Безопасная работа с параллельными процессами,V15.4.1,"Убедитесь, что к общим объектам в многопоточном коде (например, кэшам, файлам или объектам в памяти, используемым несколькими потоками) используется безопасный многопоточный доступ и механизмов синхронизации, таких как блокировки или семафоры, чтобы избежать состояний гонки и повреждения данных.",,,✓,, +V15,Безопасная разработка и архитектура,V15.4,Безопасная работа с параллельными процессами,V15.4.2,"Убедитесь, что проверки состояния ресурса, например его существования или разрешений, а также зависящие от него действия выполняются как одна атомарная операция, чтобы предотвратить условия гонки времени проверки и времени использования (TOCTOU). Например, проверка существования файла перед его открытием или проверка прав доступа пользователя перед его предоставлением.",,,✓,, +V15,Безопасная разработка и архитектура,V15.4,Безопасная работа с параллельными процессами,V15.4.3,"Убедитесь, что блокировки применяются согласованно, чтобы предотвратить взаимные блокировки потоков (deadlocks) или их бесконечные повторы, а также что логика блокировки инкапсулирована в коде, отвечающем за управление ресурсом. Это гарантирует, что блокировки не могут быть случайно или намеренно изменены внешними классами или кодом.",,,✓,, +V15,Безопасная разработка и архитектура,V15.4,Безопасная работа с параллельными процессами,V15.4.4,"Убедитесь, что политики распределения ресурсов предотвращают нехватку ресурсов у потоков, обеспечивая справедливый доступ к ресурсам, например, используя пулы потоков, позволяя потокам с более низким приоритетом выполняться в течение разумного периода времени.",,,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.1,Документация по ведению логов,V16.1.1,"Убедитесь в существовании реестра, в котором документируется ведение журнала на каждом уровне технологического стека приложения, включая какие события регистрируются, форматы логов, где хранятся эти журналы, как они используются, как контролируется доступ к ним и как долго хранятся журналы.",,✓,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.2,Общее журналирование,V16.2.1,"Убедитесь, что каждая запись журнала содержит необходимые метаданные (например, когда, где, кто, что), которые позволят провести подробное исследование временной шкалы, когда произошло событие.",,✓,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.2,Общее журналирование,V16.2.2,"Убедитесь, что все источники времени компонентов системы журналирования синхронизированы, а временные метки в метаданных событий безопасности используют UTC или содержат явное указание смещения часового пояса. Рекомендуется применять UTC для обеспечения согласованности в распределённых системах и предотвращения ошибок при переходе на летнее/зимнее время.",,✓,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.2,Общее журналирование,V16.2.3,"Убедитесь, что приложение записывает и передаёт логи исключительно в те файлы и сервисы, которые указаны в реестре журналирования.",,✓,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.2,Общее журналирование,V16.2.4,"Убедитесь, что логи могут быть прочитаны и коррелированы используемой системой обработки журналов, предпочтительно с использованием общего стандартного формата логирования.",,✓,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.2,Общее журналирование,V16.2.5,"Убедитесь, что приложение применяет соответствующие меры защиты при логировании конфиденциальных данных в зависимости от уровня их чувствительности: например, полностью запрещает запись в логи таких данных, как учетные данные или платежные реквизиты, а для других данных (например, сессионных токенов) использует хеширование или частичное/полное маскирование.",,✓,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.3,Инциденты безопасности,V16.3.1,"Убедитесь, что все операции аутентификации регистрируются, включая успешные и неудачные попытки. Также следует фиксировать дополнительные метаданные, такие как тип аутентификации или использованные факторы проверки.",,✓,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.3,Инциденты безопасности,V16.3.2,"Убедитесь, что ведется журнал неудачных попыток авторизации. Для уровня L3 это должно включать в себя журналирование всех решений об авторизации, включая журналирование доступа к конфиденциальным данным (без регистрации самих конфиденциальных данных).",,✓,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.3,Инциденты безопасности,V16.3.3,"Убедитесь, что приложение регистрирует все события безопасности, определенные в документации, а также фиксирует попытки обхода механизмов защиты, включая проверку входных данных, бизнес-логики и системы защиты от автоматизированных атак.",,✓,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.3,Инциденты безопасности,V16.3.4,"Убедитесь, что приложение регистрирует в журналах неожиданные ошибки и сбои механизмов безопасности, включая, например, ошибки TLS-соединения на стороне сервера.",,✓,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.4,Защита журналов,V16.4.1,"Убедитесь, что все компоненты системы логирования корректно кодируют данные, чтобы предотвратить атаки типа внедрения в журналы (log injection).",,✓,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.4,Защита журналов,V16.4.2,"Убедитесь, что логи защищены от неавторизованного доступа и не могут быть модифицированы.",,✓,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.4,Защита журналов,V16.4.3,"Убедитесь, что логи безопасно передаются в логически изолированную систему для анализа, обнаружения угроз, генерации оповещений и эскалации инцидентов. Это гарантирует сохранность журналов даже в случае компрометации основного приложения.",,✓,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.5,Обработка ошибок,V16.5.1,"Убедитесь, что при возникновении непредвиденной или связанной с безопасностью ошибки пользователю возвращается только общее сообщение, гарантируя отсутствие раскрытия конфиденциальных внутренних данных системы, таких как трассировки стека, запросы, секретные ключи и токены.",,✓,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.5,Обработка ошибок,V16.5.2,"Убедитесь, что приложение продолжает работать в безопасном режиме при недоступности внешних ресурсов, используя такие механизмы, как автоматические выключатели (circuit breakers) или плавное снижение функциональности (graceful degradation).",,✓,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.5,Обработка ошибок,V16.5.3,"Убедитесь, что приложение корректно и безопасно завершает работу при возникновении исключений, предотвращая опасные сценарии по типу «fail-open», когда, например, транзакция ошибочно выполняется, несмотря на ошибки в логике валидации.",,✓,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.5,Обработка ошибок,V16.5.4,"Убедитесь, что определён обработчик ошибок «крайние меры», который будет перехватывать все необработанные ошибки. Это необходимо как для предотвращения потери информации об ошибках, которая должна быть записана в файлы журналов, так и для того, чтобы ошибка не остановила весь процесс приложения, что привело бы к потере доступности.",,,✓,, +V17,WebRTC,V17.1,TURN-сервер,V17.1.1,"Убедитесь, что сервис TURN (Traversal Using Relays around NAT) разрешает доступ только к IP-адресам, не зарезервированным для специальных целей (например, внутренние сети, широковещательная рассылка, loopback-адреса). Данное требование применяется как к IPv4, так и к IPv6 адресам.",,✓,✓,, +V17,WebRTC,V17.1,TURN-сервер,V17.1.2,"Убедитесь, что сервис TURN (Traversal Using Relays around NAT) защищен от исчерпания ресурсов при попытках легитимных пользователей открыть чрезмерное количество портов на сервере.",,,✓,, +V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.1,"Убедитесь, что ключ сертификата Datagram Transport Layer Security (DTLS) управляется и защищается в соответствии с документированной политикой управления криптографическими ключами.",,✓,✓,, +V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.2,"Убедитесь, что медиасервер настроен на использование только одобренных наборов шифров Datagram Transport Layer Security (DTLS) и защищенного профиля безопасности для расширения DTLS, применяемого при установке ключей для Secure Real-time Transport Protocol (DTLS-SRTP).",,✓,✓,, +V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.3,"Убедитесь, что медиасервер проверяет аутентификацию Secure Real-time Transport Protocol (SRTP) для предотвращения атак с внедрением Real-time Transport Protocol (RTP), которые могут привести к отказу в обслуживании (Denial of Service) или вставке поддельного аудио-/видеоконтента в медиапотоки.",,✓,✓,, +V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.4,"Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика при получении некорректных пакетов Secure Real-time Transport Protocol (SRTP).",,✓,✓,, +V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.5,"Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетами Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.",,,✓,, +V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.6,"Убедитесь, что медиасервер не подвержен уязвимости «Гонка ClientHello» (ClientHello Race Condition) в Datagram Transport Layer Security (DTLS), проверив наличие известных уязвимостей в публичных источниках или выполнив тестирование на воспроизведение условий гонки.",,,✓,, +V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.7,"Убедитесь, что механизмы аудио- и видеозаписи, связанные с медиасервером, способны продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетов Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.",,,✓,, +V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.8,"Убедитесь, что сертификат Datagram Transport Layer Security (DTLS) проверяется на соответствие атрибуту отпечатка (fingerprint) в Session Description Protocol (SDP), с немедленным прекращением медиапотока в случае несоответствия — это гарантирует подлинность передаваемых данных.",,,✓,, +V17,WebRTC,V17.3,Сигнализация,V17.3.1,"Убедитесь, что сигнальный сервер способен продолжать обработку легитимных входящих сообщений сигнализации даже в условиях флуд-атаки. Для этого необходимо реализовать механизм ограничения частоты запросов (rate limiting) на уровне сигнализации.",,✓,✓,, +V17,WebRTC,V17.3,Сигнализация,V17.3.2,"Убедитесь, что сигнальный сервер способен продолжать обработку легитимных сообщений сигнализации даже при получении некорректных сообщений, которые могут вызвать отказ в обслуживании (Denial of Service, DoS). Для этого необходимо реализовать: проверку входных данных (input validation), безопасную обработку целочисленных переполнений (integer overflows), защиту от переполнения буферов (buffer overflows) и другие надежные методы обработки ошибок.",,✓,✓,, + diff --git a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.json b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.json new file mode 100644 index 0000000000..8c9bf3051f --- /dev/null +++ b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.json @@ -0,0 +1,7259 @@ +{ + "Name": "Application Security Verification Standard Project", + "ShortName": "ASVS", + "Version": "", + "Description": "The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.", + "Requirements": [ + { + "Shortcode": "V1", + "Ordinal": 1, + "ShortName": "Encoding", + "Name": "Кодировка и нейтрализация", + "Items": [ + { + "Shortcode": "V1.1", + "Ordinal": 1, + "Name": "Архитектура кодировки и нейтрализации", + "Items": [ + { + "Shortcode": "V1.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что входные данные декодируются или деэкранируются в каноническую форму (в стандартное представление) только один раз. Декодирование происходит только тогда, когда ожидаются закодированные данные в этой форме, и что это делается перед дальнейшей обработкой входных данных, например, это не выполняется после проверки или нейтрализации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение выполняет кодирование и экранирование выходных данных либо в качестве последнего шага перед использованием интерпретатором, для которого оно предназначено, либо самим интерпретатором.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V1.2", + "Ordinal": 2, + "Name": "Предотвращение инъекций", + "Items": [ + { + "Shortcode": "V1.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что выходная кодировка для ответа HTTP, документа HTML или документа XML соответствует требуемому контексту, например, кодировка соответствующих символов для элементов HTML, атрибутов HTML, комментариев HTML, CSS или полей заголовка HTTP делается таким способом, чтобы избежать изменения структуры сообщения или документа.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что при динамическом построении URL-адресов недоверенные данные кодируются в соответствии с их контекстом (например, кодирование URL-адресов или кодирование base64url для query или path параметров или пути). Убедитесь, что разрешены только безопасные протоколы URL-адресов (например, запрещен javascript: или data:).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что при динамическом построении содержимого JavaScript (включая JSON) используется кодирование или экранирование выходных данных, чтобы избежать изменения структуры сообщения или документа (чтобы избежать JavaScript и JSON-инъекций).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что выборка данных (Redis, Memcached, чтение из файлов, обращение по API) или запросы к базе данных (например, SQL, HQL, NoSQL, Cypher) используют параметризованные запросы, ORM, Entity Frameworks или иным образом защищены от SQL-инъекций и других атак. Это также актуально при написании хранимых процедур.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что приложение защищено от внедрения команд ОС и что вызовы операционной системы используют параметризованные запросы к ОС или используют контекстное кодирование вывода командной строки.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.6", + "Ordinal": 6, + "Description": "Убедитесь, что приложение защищено от LDAP-инъекций, или что реализованы специальные меры безопасности для их предотвращения.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.7", + "Ordinal": 7, + "Description": "Убедитесь, что приложение защищено от атак с использованием XPath-инъекций с помощью параметризации запросов или предварительно скомпилированных запросов.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.8", + "Ordinal": 8, + "Description": "Убедитесь, что процессоры LaTeX настроены безопасно (например, не используется флаг «–shell‑escape») и используется разрешенный список команд для предотвращения LaTeX-инъекций.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.9", + "Ordinal": 9, + "Description": "Убедитесь, что приложение экранирует специальные символы в регулярных выражениях (обычно с помощью обратной косой черты), чтобы предотвратить их ошибочную интерпретацию как метасимволов.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.10", + "Ordinal": 10, + "Description": "Убедитесь, что приложение защищено от внедрения формул CSV (CSV Injection). Приложение должно следовать правилам экранирования, определенным в RFC 4180, разделы 2.6 и 2.7, при экспорте содержимого CSV. Кроме того, при экспорте в CSV или другие форматы электронных таблиц (такие как XLS, XLSX или ODF) специальные символы (включая '=', '+', '-', '@', '\\t' (табуляция), и '\\0' (нулевой символ)) должны экранироваться одинарной кавычкой, если они появляются в качестве первого символа в значении поля.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V1.3", + "Ordinal": 3, + "Name": "Нейтрализация", + "Items": [ + { + "Shortcode": "V1.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что все ненадежные входные данные HTML из редакторов WYSIWYG или аналогичных программ нейтрализуются с помощью известных и безопасных библиотек или функций фреймворка для санитизации HTML.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение избегает использования eval() или других динамических функций выполнения кода, таких как Spring Expression Language (SpEL). Если нет альтернативы, любой пользовательский ввод должен быть нейтрализован перед выполнением.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что данные, передаваемые в потенциально опасный контекст, предварительно нейтрализованы, чтобы обеспечить соблюдение мер безопасности, таких как разрешение только тех символов, которые безопасны для данного контекста, и обрезка слишком длинного ввода.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что предоставленный пользователем файл .SVG проверен или нейтрализован, чтобы он содержал только теги и атрибуты (например, относящиеся к рисованию), которые безопасны для приложения, например, не содержат скриптов и foreignObject.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.5", + "Ordinal": 5, + "Description": "Убедитесь, что приложение нейтралует или отключает предоставленные пользователем скриптовые данные или выражения шаблонных языков, такие как таблицы стилей Markdown, CSS или XSL, BBCode или аналогичные.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.6", + "Ordinal": 6, + "Description": "Убедитесь, что приложение защищено от атак с подделкой запросов на стороне сервера (SSRF), проверяя ненадежные данные по разрешенному списку протоколов, доменов, путей и портов, а также нейтрализуя потенциально опасные символы перед использованием данных для вызова другой службы.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.7", + "Ordinal": 7, + "Description": "Убедитесь, что приложение защищено от атак с внедрением шаблонов (template injection), не позволяя создавать шаблоны на основе недоверенных входных данных. Если нет альтернативы, любые недоверенные входные данные, включаемые динамически во время создания шаблона, должны быть нейтрализованы или тщательно провалидированы.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.8", + "Ordinal": 8, + "Description": "Убедитесь, что приложение надлежащим образом нейтрализует недоверенные входные данные перед использованием в запросах Java Naming and Directory Interface (JNDI) и что JNDI настроен безопасно для предотвращения атак с использованием JNDI-инъекций.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.9", + "Ordinal": 9, + "Description": "Убедитесь, что приложение нейтрализует данные перед отправкой в Memcache, чтобы предотвратить атаки методом инъекций.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.10", + "Ordinal": 10, + "Description": "Убедитесь, что строки форматирования, которые могут быть использованы неожидаемым или вредоносным образом, нейтрализуются перед дальнейшим использованием.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.11", + "Ordinal": 11, + "Description": "Убедитесь, что приложение нейтрализует вводимые пользователем данные перед передачей в почтовые системы для защиты от SMTP или IMAP-инъекций.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.12", + "Ordinal": 12, + "Description": "Убедитесь, что регулярные выражения не содержат элементов, вызывающих экспоненциальный возврат, и убедитесь в нейтрализации недоверенных входных данных для предотвращения атак ReDoS или Runaway Regex.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V1.4", + "Ordinal": 4, + "Name": "Память, строки и неуправляемый код", + "Items": [ + { + "Shortcode": "V1.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что для обнаружения или предотвращения ситуаций переполнения стека, буфера или кучи приложение учитывает размер доступной области памяти при строковых операциях, копировании в память, в арифметике указателей и т.п.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что для предотвращения целочисленного переполнения применяется контроль знака, диапазона и типа допустимых входных данных.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что динамически выделенная память и ресурсы освобождены, а ссылки или указатели на освобожденную память удалены или установлены в значение null, чтобы предотвратить появление висячих указателей и уязвимостей, связанных с использованием памяти после освобождения.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V1.5", + "Ordinal": 5, + "Name": "Безопасная десериализация", + "Items": [ + { + "Shortcode": "V1.5.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение настраивает XML-парсеры на использование строгой конфигурации и что небезопасные функции, такие как разрешение внешних сущностей, отключены для предотвращения атак XML eXternal Entity (XXE).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.5.2", + "Ordinal": 2, + "Description": "Убедитесь, что десериализация недоверенных данных обеспечивает безопасную обработку ввода, например, используя список разрешенных типов объектов или ограничивая типы объектов, определяемые клиентом, для предотвращения атак десериализации. Механизмы десериализации, которые явно определены как небезопасные, не должны использоваться с недоверенным вводом.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.5.3", + "Ordinal": 3, + "Description": "Убедитесь, что различные парсеры, используемые в приложении для одного и того же типа данных (например, парсеры JSON, XML, URL), выполняют парсинг согласованным образом и используют один и тот же механизм кодирования символов, чтобы избежать таких проблем, как уязвимости взаимодействия JSON (JSON Interoperability) или различное поведение анализа URI или файлов, которые могут использоваться в атаках удаленного включения файлов (RFI) или подделки запросов на стороне сервера (SSRF).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V2", + "Ordinal": 2, + "ShortName": "Validation", + "Name": "Валидация и бизнес-логика", + "Items": [ + { + "Shortcode": "V2.1", + "Ordinal": 1, + "Name": "Документация валидации и бизнес-логики", + "Items": [ + { + "Shortcode": "V2.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что в документации приложения определены правила проверки входных данных на соответствие ожидаемой структуре. Это могут быть распространённые форматы данных, такие как номера кредитных карт, адреса электронной почты, номера телефонов, или внутренний формат данных.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что в документации приложения указано, как проверять логическую и контекстную согласованность объединенных данных, например, проверять соответствие района и почтового индекса.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что ожидания относительно ограничений и проверок бизнес-логики задокументированы как для уровня отдельного пользователя, так и для глобального уровня всего приложения.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V2.2", + "Ordinal": 2, + "Name": "Валидация ввода", + "Items": [ + { + "Shortcode": "V2.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что входные данные провалидированы для обеспечения соответствия бизнес- или функциональным ожиданиям. Валидация должна осуществляться либо по списку допустимых значений, шаблонов и диапазонов, либо путем сравнения входных данных с ожидаемой структурой и логическими ограничениями в соответствии с предопределенными правилами. Для L1 валидация может быть сосредоточена на входных данных, используемых для принятия конкретных бизнес-решений или решений, связанных с безопасностью. Для L2 и выше это должно применяться ко всем входным данным.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение разработано с принудительной валидацией входных данных на уровне доверенного сервиса. Хотя проверка на стороне клиента повышает удобство использования и должна поощряться, на неё не следует полагаться как на средство контроля безопасности.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение обеспечивает обоснованность комбинаций данных в соответствии с предопределенными правилам. Например: возраст должен соответствовать дате рождения; страна и почтовый индекс; количество товара в заказе и на складе.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V2.3", + "Ordinal": 3, + "Name": "Безопасность бизнес-логики", + "Items": [ + { + "Shortcode": "V2.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение обрабатывает потоки бизнес-логики для одного и того же пользователя в ожидаемом последовательном порядке шагов и без пропуска шагов.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что ограничения бизнес-логики реализованы в соответствии с документацией приложения, чтобы избежать эксплуатации её недостатков.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что транзакции используются на уровне бизнес-логики таким образом, что операция бизнес-логики либо выполняется полностью, либо откатывается к предыдущему корректному состоянию.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что на уровне бизнес-логики используются механизмы блокировки, чтобы гарантировать невозможность двойного бронирования ограниченных по количеству ресурсов (например, мест в театре или слотов доставки) путем манипулирования логикой приложения.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.3.5", + "Ordinal": 5, + "Description": "Убедитесь, что для важных потоков бизнес-логики требуется многопользовательское (multi-user) одобрение, чтобы предотвратить несанкционированные или случайные действия. Потоки бизнес-логики могут включать, помимо прочего, крупные денежные переводы, утверждение контрактов, доступ к секретной информации или обход ограничений безопасности на производстве.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V2.4", + "Ordinal": 4, + "Name": "Анти-автоматизация", + "Items": [ + { + "Shortcode": "V2.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что используются средства противодействия автоматизации для защиты от чрезмерных вызовов функций приложения, которые могут привести к утечке данных, созданию ненужных данных, исчерпанию квот, нарушению ограничений скорости, отказу в обслуживании или чрезмерному использованию дорогостоящих ресурсов.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что потоки бизнес-логики требуют реалистичного человеческого времени, предотвращая чрезмерно быструю отправку транзакций.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V3", + "Ordinal": 3, + "ShortName": "Web", + "Name": "Безопасность веб-интерфейса", + "Items": [ + { + "Shortcode": "V3.1", + "Ordinal": 1, + "Name": "Документация по безопасности веб-интерфейса", + "Items": [ + { + "Shortcode": "V3.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что в документации приложения описаны ожидаемые функции безопасности, которые должны поддерживать браузеры, использующие приложение (такие как HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) и другие соответствующие механизмы безопасности HTTP). В документации также должно быть обязательно определено, как приложение должно себя вести, если некоторые из этих функций недоступны (например, предупреждать пользователя или блокировать доступ).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.2", + "Ordinal": 2, + "Name": "Непреднамеренная интерпретация контента", + "Items": [ + { + "Shortcode": "V3.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что реализованы меры безопасности, предотвращающие отображение контента или функций браузерами в HTTP-ответах в некорректном контексте (например, запрос API, загруженный пользователем файл или другой ресурс запрашивается напрямую). Возможные способы контроля включают: не обрабатывать содержимое, если поля заголовка HTTP-запроса (например, Sec-Fetch-*) не указывают на корректность контекста; использование заголовка и значения Content-Security-Policy: sandbox directive; или использование заголовка и значения Content-Disposition: attachment.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что данные, предназначенные для отображения в виде текста, а не визуализации в виде HTML, обрабатывается с использованием безопасных функций визуализации (таких как createTextNode или textContent), чтобы предотвратить непреднамеренное выполнение содержимого, такого как HTML или JavaScript.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение избегает затирания DOM при использовании JavaScript на стороне клиента, применяя явные объявления переменных, выполняя строгую проверку типов, избегая сохранения глобальных переменных в объекте документа и реализуя изоляцию пространства имен.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.3", + "Ordinal": 3, + "Name": "Настройка файлов cookie", + "Items": [ + { + "Shortcode": "V3.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что у файлов cookie установлен атрибут «Secure», и если префикс «__Host‑» не используется в названии cookie, необходимо использовать префикс «__Secure‑».", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что значение атрибута SameSite каждой cookie установлено в соответствии с назначением cookie, чтобы ограничить подверженность атакам на восстановление пользовательского интерфейса и атакам с подделкой запросов на уровне браузера, обычно называемым подделкой межсайтовых запросов (CSRF).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что cookie имеют префикс «__Host‑» в названии, если только они явно не предназначены для совместного использования с другими хостами.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что если значение cookie не должно быть доступно для клиентских скриптов (например, сессионный токен), для cookie должен быть установлен атрибут «HttpOnly», а само значение должно передаваться клиенту только через поле заголовка «Set-Cookie».", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.3.5", + "Ordinal": 5, + "Description": "Убедитесь, что при записи cookie приложением общая длина имени и значения cookie не превышает 4096 байт. Слишком большие cookie не будут сохраняться браузером и, следовательно, не будут отправляться с запросами, что помешает пользователю использовать функции приложения, зависящие от этого cookie.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.4", + "Ordinal": 4, + "Name": "Заголовки механизма безопасности браузера", + "Items": [ + { + "Shortcode": "V3.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что поле заголовка Strict‑Transport‑Security включено во все ответы для реализации политики HTTP Strict Transport Security (HSTS). Необходимо указать максимальное время не менее 1 года, а для L2 и выше политика должна применяться также ко всем поддоменам.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что поле заголовка Cross‑Origin Resource Sharing (CORS) «Access‑Control‑Allow‑Origin» имеет фиксированное значение, заданное приложением, или, если используется заголовок Origin, оно проверяется по списку доверенных источников. При необходимости использования «Access‑Control‑Allow‑Origin: *» убедитесь, что ответ не содержит конфиденциальной информации.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что HTTP-ответы содержат поле заголовка Content-Security-Policy, которое определяет директивы, гарантирующие загрузку и выполнение браузером только доверенного контента или ресурсов, чтобы ограничить выполнение вредоносного JavaScript. Как минимум, необходимо использовать глобальную политику, включающую директивы object-src «none» и base-uri «none», а также определяющую список разрешенных адресов или использующую одноразовые коды или хэши. Для приложений L3 необходимо определить политику использования 'nonce' или hash-конструкций для каждого ответа.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.4", + "Ordinal": 4, + "Description": "Убедитесь, что все HTTP-ответы содержат поле заголовка «X‑Content‑Type‑Options: nosniff». Это предписывает браузерам не использовать анализ контента и определение типа MIME для данного ответа, а также требовать, чтобы значение поля заголовка Content‑Type в ответе соответствовало целевому ресурсу. Например, ответ на запрос стиля принимается только в том случае, если Content‑Type в ответе — «text/css». Это также позволяет браузеру использовать функцию Cross‑Origin Read Blocking (CORB).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.5", + "Ordinal": 5, + "Description": "Убедитесь, что приложение устанавливает политику реферера для предотвращения утечки технически конфиденциальных данных сторонним сервисам через поле заголовка HTTP-запроса «Referer». Это можно сделать с помощью поля заголовка HTTP-ответа «Referrer‑Policy» или через атрибуты HTML-элемента. Конфиденциальные данные могут включать путь и данные запроса в URL-адресе, а для внутренних непубличных приложений также имя хоста.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.6", + "Ordinal": 6, + "Description": "Убедитесь, что веб-приложение использует директиву frame‑ancestors поля заголовка Content‑Security‑Policy для каждого HTTP-ответа, чтобы гарантировать невозможность его внедрения по умолчанию и внедрение определённых ресурсов разрешено только при необходимости. Обратите внимание, что поле заголовка X‑Frame‑Options, хотя и поддерживается браузерами, устарело и не может быть использовано в качестве основы.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.7", + "Ordinal": 7, + "Description": "Убедитесь, что в поле заголовка Content‑Security‑Policy указано место, куда следует сообщать о нарушениях.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.8", + "Ordinal": 8, + "Description": "Убедитесь, что все HTTP-ответы, инициирующие рендеринг документа (например, ответы с типом содержимого text/html), включают поле заголовка Cross-Origin-Opener-Policy с директивой same-origin или same-origin-allow-popups (при необходимости). Это предотвращает атаки, злоупотребляющие общим доступом к объектам Window, такие как Tabnabbing и Frame Counting.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.5", + "Ordinal": 5, + "Name": "Браузерное разделение источников", + "Items": [ + { + "Shortcode": "V3.5.1", + "Ordinal": 1, + "Description": "Убедитесь, что, если приложение не использует механизм предварительной проверки CORS для предотвращения запрещённых кросс-доменных запросов на использование чувствительного функционала, эти запросы валидируются на предмет их происхождения от самого приложения. Это можно сделать, используя и проверяя специальные токены для защиты от подделки или требуя дополнительные поля HTTP-заголовка, не входящие в список «простых заголовков» (CORS-safelisted request-header). Это необходимо для защиты от атак с подделкой запросов через браузер, широко известных как межсайтовая подделка запросов (CSRF).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.2", + "Ordinal": 2, + "Description": "Убедитесь, что если приложение использует механизм предварительной проверки CORS для предотвращения неразрешённого использования чувствительного функционала между источниками, вызов этого функционала невозможен с помощью запроса, который не запускает предварительную проверку CORS. Для этого может потребоваться проверка значений полей заголовка запроса «Origin» и «Content-Type» или использование дополнительного поля заголовка, не входящего в безопасный список CORS.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.3", + "Ordinal": 3, + "Description": "Убедитесь, что HTTP-запросы к чувствительному функционалу используют соответствующие HTTP-методы, такие как POST, PUT, PATCH или DELETE, а не методы, определённые спецификацией HTTP как «безопасные», такие как HEAD, OPTIONS или GET. В качестве альтернативы можно использовать строгую валидацию полей заголовка запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, навигационного запроса или загрузки ресурса (например, источника изображения), где это не ожидается.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.4", + "Ordinal": 4, + "Description": "Убедитесь, что отдельные приложения размещены на разных именах хостов, чтобы использовать ограничения, предусмотренные политикой same-origin, включая то, как документы или скрипты, загруженные одним источником, могут взаимодействовать с ресурсами из другого источника, а также ограничения на cookie на основе имени хоста.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.5", + "Ordinal": 5, + "Description": "Убедитесь, что сообщения, полученные интерфейсом postMessage, отвергаются, если источник сообщения не является доверенным или если синтаксис сообщения недействителен.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.6", + "Ordinal": 6, + "Description": "Убедитесь, что функциональность JSONP не включена нигде в приложении, чтобы избежать атак с использованием межсайтового включения скриптов (XSSI).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.7", + "Ordinal": 7, + "Description": "Убедитесь, что данные, требующие авторизации, не включены в ответы ресурсов скриптов, таких как файлы JavaScript, чтобы предотвратить атаки с использованием межсайтового включения скриптов (XSSI).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.8", + "Ordinal": 8, + "Description": "Убедитесь, что аутентифицированные ресурсы (такие как изображения, видео, скрипты и другие документы) могут быть загружены или внедрены от имени пользователя только по назначению. Этого можно добиться путём строгой валидации полей заголовка HTTP-запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, или путём установки ограничительного поля заголовка HTTP-ответа Cross‑Origin‑Resource‑Policy, чтобы браузер блокировал возвращаемый контент.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.6", + "Ordinal": 6, + "Name": "Целостность внешних ресурсов", + "Items": [ + { + "Shortcode": "V3.6.1", + "Ordinal": 1, + "Description": "Убедитесь, что клиентские ресурсы, такие как библиотеки JavaScript, CSS или веб-шрифты, размещаются только на внешнем сервере (например, в сети доставки контента (Content Delivery Network)), если ресурс статический и имеет версии, а для проверки целостности ресурса используется механизм проверки целостности подресурсов (SRI). Если это невозможно, для каждого ресурса должно быть задокументировано решение по безопасности, обосновывающее это.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.7", + "Ordinal": 7, + "Name": "Другие соображения по безопасности браузера", + "Items": [ + { + "Shortcode": "V3.7.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение использует только те клиентские технологии, которые по-прежнему поддерживаются и считаются безопасными. Примерами технологий, не соответствующих этому требованию, являются плагины NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL или клиентские Java-апплеты.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.7.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение будет автоматически перенаправлять пользователя на другое имя хоста или домен (который не контролируется приложением), только если этот хост или домен указаны в списке разрешенных.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.7.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение отображает уведомление, что пользователь перенаправляется на URL-адрес, находящийся вне контроля приложения, с возможностью отмены навигации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.7.4", + "Ordinal": 4, + "Description": "Убедитесь, что домен верхнего уровня приложения (например, site.tld) ​​добавлен в публичный список предварительной загрузки (preload list) для HTTP Strict Transport Security (HSTS). Это гарантирует, что использование TLS для приложения будет встроено непосредственно в основные браузеры, а не будет полагаться только на поле заголовка ответа Strict-Transport-Security.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.7.5", + "Ordinal": 5, + "Description": "Убедитесь, что приложение ведет себя так, как описано в документации (например, предупреждает пользователя или блокирует доступ), если браузер, используемый для доступа к приложению, не поддерживает ожидаемые функции безопасности.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V4", + "Ordinal": 4, + "ShortName": "API", + "Name": "API и Веб-сервис", + "Items": [ + { + "Shortcode": "V4.1", + "Ordinal": 1, + "Name": "Общая безопасность веб-сервисов", + "Items": [ + { + "Shortcode": "V4.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что каждый HTTP-ответ с телом сообщения содержит заголовок Content-Type, который соответствует фактическому содержимому ответа, таким как «text/», «/+xml» и «/xml», включая параметр charset для указания безопасной кодировки символов (например, UTF-8, ISO-8859-1) согласно IANA Media Types.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что только конечные точки, предназначенные для взаимодействия с пользователем через веб-браузер, автоматически перенаправляют HTTP на HTTPS, в то время как другие сервисы или конечные точки не реализуют прозрачные редиректы. Это необходимо, чтобы избежать ситуации, когда клиент ошибочно отправляет незашифрованные HTTP-запросы а из-за того, что запрос по HTTP автоматически перенаправляется на HTTPS другим сервисом без обработки на входе, утечка чувствительных данных остаётся незамеченной.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что любой HTTP-заголовок, используемый приложением и устанавливаемый промежуточным уровнем, таким как балансировщик нагрузки, веб-прокси или backend-for-frontend сервис, не может быть переопределён конечным пользователем. Примеры заголовков: X-Real-IP, X-Forwarded-*, X-User-ID.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.1.4", + "Ordinal": 4, + "Description": "Убедитесь, что разрешены только HTTP-методы, которые явно поддерживаются приложением или его API (включая OPTIONS для preflight-запросов), а неиспользуемые методы заблокированы.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.1.5", + "Ordinal": 5, + "Description": "Убедитесь, что для особо чувствительных запросов или транзакций, проходящих через несколько систем, используются цифровые подписи на уровне сообщений, дополнительно к транспортным средствам защиты.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V4.2", + "Ordinal": 2, + "Name": "Валидация структуры HTTP-сообщений", + "Items": [ + { + "Shortcode": "V4.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что все компоненты приложения (включая балансировщики нагрузки, файрволы и серверы приложений) определяют границы входящих HTTP-сообщений с использованием механизма, соответствующего версии HTTP, чтобы предотвратить HTTP request smuggling. В HTTP/1.x, если присутствует заголовок Transfer-Encoding, заголовок Content-Length должен игнорироваться согласно RFC 2616. При использовании HTTP/2 или HTTP/3, если присутствует Content-Length, веб-сервер должен убедиться, что он совпадает с длиной DATA-фреймов.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что при генерации HTTP-сообщений заголовок Content-Length не конфликтует с длиной содержимого, определяемой рамками протокола HTTP, чтобы предотвратить HTTP Request Smuggling.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение не отправляет и не принимает HTTP/2 и HTTP/3 сообщения с заголовками, специфичными для соединения, такими как Transfer-Encoding, чтобы предотвратить HTTP Response Splitting и HTTP Header Injection.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что приложение принимает HTTP/2 и HTTP/3 запросы только в случае, если поля заголовков и их значения не содержат последовательностей CR (\\r), LF (\\n) или CRLF (\\r\\n), чтобы предотвратить HTTP Header Injection.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что если приложение (бекенд или фронтенд) формирует и отправляет запросы, оно использует валидацию, очистку или другие механизмы, чтобы не создавать URI (например, для API-вызовов) или HTTP-заголовки (например, Authorization или Cookie) слишком большой длины, чтобы их не принимал приёмник. Это может привести к отказу в обслуживании, например, при отправке слишком длинного запроса (длинный cookie-заголовок), из-за чего сервер постоянно возвращает ошибку.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V4.3", + "Ordinal": 3, + "Name": "GraphQL", + "Items": [ + { + "Shortcode": "V4.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что используется белый список запросов, ограничение глубины вложенности, ограничение количества или анализ стоимости запроса, чтобы предотвратить DoS-атаки на уровне GraphQL или слоя данных из-за дорогостоящих вложенных запросов.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что introspection-запросы GraphQL отключены в продакшен-среде, если GraphQL API не предназначен для использования сторонними клиентами.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V4.4", + "Ordinal": 4, + "Name": "WebSocket", + "Items": [ + { + "Shortcode": "V4.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что для всех WebSocket-соединений используется WebSocket поверх TLS (WSS).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что при первоначальном HTTP WebSocket handshake заголовок Origin проверяется на соответствие списку разрешённых источников для приложения.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что если стандартное управление сессиями приложения не может быть использовано, применяются специальные токены, соответствующие требованиям безопасности управления сессиями.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.4.4", + "Ordinal": 4, + "Description": "Убедитесь, что специальные токены управления сессиями WebSocket изначально получаются или валидируются через ранее аутентифицированную HTTPS-сессию при переходе от HTTPS к WebSocket.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V5", + "Ordinal": 5, + "ShortName": "File", + "Name": "Работа с файлами", + "Items": [ + { + "Shortcode": "V5.1", + "Ordinal": 1, + "Name": "Документация по работе с файлами", + "Items": [ + { + "Shortcode": "V5.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что документация определяет допустимые типы файлов, ожидаемые расширения и максимальный размер (включая распакованный размер) для каждой функции загрузки. Также убедитесь, что в документации указано, как файлы обезвреживаются для конечных пользователей (например, как приложение ведёт себя при обнаружении вредоносного файла).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V5.2", + "Ordinal": 2, + "Name": "Загрузка файлов и содержимое", + "Items": [ + { + "Shortcode": "V5.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение принимает только те файлы, которые может обработать без потери производительности или отказа в обслуживании.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что при загрузке файла (включая файлы внутри архивов, таких как ZIP) приложение проверяет, соответствует ли расширение ожидаемому, и валидирует, соответствует ли содержимое типу, указанному в расширении. Это включает проверку начальных 'magic bytes', перезапись изображений, использование специализированных библиотек. Для уровня 1 — достаточно проверок для файлов, критичных с точки зрения бизнеса или безопасности. Для уровней 2 и выше — для всех файлов.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение проверяет архивы (например, zip, gz, docx, odt) на максимально допустимый распакованный размер и максимальное количество файлов до распаковки.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что для каждого пользователя установлены квоты на общий размер и количество файлов, чтобы один пользователь не мог переполнить хранилище.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что приложение не позволяет загружать архивы с символьными ссылками (symlinks), если это не требуется по бизнес-логике. Если требуется — разрешён только строго определённый список допустимых символьных ссылок.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.6", + "Ordinal": 6, + "Description": "Убедитесь, что приложение отклоняет изображения с числом пикселей выше допустимого, чтобы предотвратить атаки 'pixel flood'.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V5.3", + "Ordinal": 3, + "Name": "Хранение файлов", + "Items": [ + { + "Shortcode": "V5.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что загруженные или сгенерированные из недоверенного ввода файлы, находящиеся в публичной директории, не исполняются как серверный код при обращении к ним по HTTP.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что при создании путей к файлам приложение использует внутренние или доверенные данные, а не пользовательские имена файлов. Если использование пользовательских имён или метаданных необходимо — требуется строгая проверка и очистка. Это защита от path traversal, LFI, RFI и SSRF.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что при обработке файлов на сервере (например, при распаковке) игнорируются пути, заданные пользователем, во избежание уязвимостей типа 'zip slip'.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V5.4", + "Ordinal": 4, + "Name": "Скачивание файлов", + "Items": [ + { + "Shortcode": "V5.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение валидирует или игнорирует имена файлов, переданных пользователем (включая в JSON, JSONP или URL-параметре), и указывает имя файла в заголовке Content-Disposition при ответе.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что имена файлов, передаваемые (например, в HTTP-заголовках или вложениях в email), кодируются или очищаются (например, по RFC 6266), чтобы сохранить структуру документа и предотвратить инъекции.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что файлы, полученные из недоверенных источников, сканируются антивирусом, чтобы не распространять известное вредоносное содержимое.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V6", + "Ordinal": 6, + "ShortName": "Authentication", + "Name": "Аутентификация", + "Items": [ + { + "Shortcode": "V6.1", + "Ordinal": 1, + "Name": "Документация по аутентификации", + "Items": [ + { + "Shortcode": "V6.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что в документации приложения описано, как используются механизмы, такие как ограничение частоты запросов (rate limiting), защита от автоматизации и адаптивные реакции, для защиты от атак, таких как подстановка учётных данных и перебор паролей. Документация должна ясно описывать конфигурацию этих механизмов и предотвращение злонамеренной блокировки аккаунтов.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что задокументирован список контекстно-зависимых слов, запрещённых к использованию в паролях. В него могут входить производные от названий организаций, продуктов, идентификаторов систем, кодовых названий проектов, названий отделов или ролей и тому подобное.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что если приложение поддерживает несколько способов аутентификации, то все они документированы вместе с описанием применяемых средств защиты и уровнем стойкости аутентификации, которые должны быть одинаково применены ко всем способам.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.2", + "Ordinal": 2, + "Name": "Безопасность паролей", + "Items": [ + { + "Shortcode": "V6.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что пользовательские пароли содержат не менее 8 символов. Рекомендуется минимальная длина в 15 символов.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что пользователи могут менять свои пароли.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что для смены пароля требуется ввести как текущий, так и новый пароль.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что при регистрации или смене пароля введённый пароль проверяется по списку как минимум из 3000 самых популярных паролей, соответствующих политике (например, минимальной длине).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что допускаются пароли любой структуры, без ограничений на использование определённых символов. Не должно быть требований по обязательному наличию заглавных/строчных букв, цифр или специальных символов.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.6", + "Ordinal": 6, + "Description": "Убедитесь, что поля ввода пароля используют type=password для скрытия символов. Разрешено временное отображение всего пароля или последнего введённого символа.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.7", + "Ordinal": 7, + "Description": "Убедитесь, что разрешены вставка (paste), использование менеджеров паролей браузера и внешних менеджеров паролей.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.8", + "Ordinal": 8, + "Description": "Убедитесь, что пароль проверяется строго в том виде, в котором он был введён пользователем — без обрезки, изменения регистра и других модификаций.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.9", + "Ordinal": 9, + "Description": "Убедитесь, что система позволяет использовать пароли длиной не менее 64 символов.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.10", + "Ordinal": 10, + "Description": "Убедитесь, что пароль остаётся действительным, пока не будет скомпрометирован или не будет изменён пользователем. Приложение не должно требовать регулярной смены пароля.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.11", + "Ordinal": 11, + "Description": "Убедитесь, что используется документированный список контекстно-зависимых слов (например, названия компаний, проектов и т.д.) для предотвращения использования легко угадываемых паролей.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.12", + "Ordinal": 12, + "Description": "Убедитесь, что при регистрации или смене пароля проверяется, не входит ли он в список скомпрометированных (утёкших) паролей.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.3", + "Ordinal": 3, + "Name": "Общие требования к безопасности аутентификации", + "Items": [ + { + "Shortcode": "V6.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что реализованы меры защиты от атак типа credential stuffing (массовая подстановка учётных данных) и brute-force (перебор паролей), согласно документации по безопасности приложения.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что в приложении отсутствуют или отключены учётные записи по умолчанию (например, root, admin, sa).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что для доступа к приложению используется либо механизм многофакторной аутентификации, либо комбинация однофакторных. Для уровня L3 один из факторов должен быть аппаратным, обеспечивающим защиту от фишинга, устойчивость к компрометации и подтверждение намерения аутентификации через явное действие пользователя (например, нажатие кнопки на FIDO-ключе или телефоне). Ослабление этих требований допускается только при наличии обоснования и компенсирующих мер.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что при наличии нескольких способов аутентификации, они все задокументированы, и для них единообразно применяются меры защиты и уровни доверия.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.5", + "Ordinal": 5, + "Description": "Убедитесь, что пользователи получают уведомления о подозрительных попытках аутентификации (удачных и неудачных). Это может включать попытки (например, подключения) с необычного устройства или места, частично успешную MFA, попытку после долгого отсутствия или успешную аутентификацию после серии неудачных.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.6", + "Ordinal": 6, + "Description": "Убедитесь, что email не используется ни как однофакторный, ни как многофакторный механизм аутентификации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.7", + "Ordinal": 7, + "Description": "Убедитесь, что пользователи получают уведомление при изменении данных аутентификации, таких как сброс пароля или изменение логина/email.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.8", + "Ordinal": 8, + "Description": "Убедитесь, что из сообщений об ошибке, HTTP-кодов ответа или различий во времени ответа нельзя определить, существует ли пользователь с таким логином. Это правило также должно применяться к функциям регистрации и восстановления пароля.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.4", + "Ordinal": 4, + "Name": "Жизненный цикл и восстановление факторов аутентификации", + "Items": [ + { + "Shortcode": "V6.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что начальные пароли или коды активации, генерируемые системой, создаются с использованием надёжного генератора случайных чисел, соответствуют текущей политике паролей и истекают через короткий период времени либо после первого использования. Эти секреты не должны использоваться как постоянные пароли.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что в системе отсутствуют подсказки к паролю или вопросы на знание («секретные вопросы»).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что реализован безопасный процесс сброса забытого пароля, который не обходит активные механизмы многофакторной аутентификации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.4", + "Ordinal": 4, + "Description": "Убедитесь, что в случае утраты одного из факторов MFA проводится удостоверение личности (identity proofing) на том же уровне, что и при первичной регистрации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.5", + "Ordinal": 5, + "Description": "Убедитесь, что инструкции по обновлению истекающих механизмов аутентификации отправляются заранее, с достаточным запасом времени для выполнения замены, при необходимости с настройкой автоматических напоминаний.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.6", + "Ordinal": 6, + "Description": "Убедитесь, что администраторы могут инициировать процесс сброса пароля, но не могут задать или выбрать новый пароль за пользователя. Это исключает ситуацию, при которой администратор знает пароль пользователя.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.5", + "Ordinal": 5, + "Name": "Общие требования к многофакторной аутентификации", + "Items": [ + { + "Shortcode": "V6.5.1", + "Ordinal": 1, + "Description": "Убедитесь, что lookup-секреты, внеполосные коды/запросы и TOTP-коды можно использовать только один раз.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.2", + "Ordinal": 2, + "Description": "Убедитесь, что при хранении lookup-секретов с энтропией менее 112 бит (например, 19 случайных буквенно-цифровых символов или 34 случайные цифры) они хэшируются с использованием разрешённого алгоритма хеширования паролей и случайной соли минимум 32 бита. Если у секрета ≥112 бит энтропии — допустимо использовать стандартный хэш.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.3", + "Ordinal": 3, + "Description": "Убедитесь, что lookup-секреты, коды внеполосной аутентификации и сиды для TOTP генерируются с использованием криптографически стойкого генератора случайных чисел (CSPRNG), чтобы избежать предсказуемых значений.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.4", + "Ordinal": 4, + "Description": "Убедитесь, что lookup-секреты и внеполосные коды аутентификации имеют минимум 20 бит энтропии (достаточно, например, 4 случайных алфавитно-цифровых символов или 6 случайных цифр).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.5", + "Ordinal": 5, + "Description": "Убедитесь, что все внеполосные запросы, коды и токены, а также TOTP-коды имеют ограниченный срок действия. Максимум для out-of-band — 10 минут, для TOTP — 30 секунд.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.6", + "Ordinal": 6, + "Description": "Убедитесь, что любой фактор аутентификации (включая физические устройства) может быть отозван в случае кражи или утери.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.7", + "Ordinal": 7, + "Description": "Убедитесь, что биометрические механизмы аутентификации используются только как вторичный фактор — в сочетании с «чем-то, что вы знаете» или «чем-то, что у вас есть».", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.8", + "Ordinal": 8, + "Description": "Убедитесь, что TOTP-коды проверяются по источнику времени, полученному от доверенного сервиса, а не от клиента или недоверенного источника.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.6", + "Ordinal": 6, + "Name": "Внеполосные механизмы аутентификации", + "Items": [ + { + "Shortcode": "V6.6.1", + "Ordinal": 1, + "Description": "Убедитесь, что механизмы аутентификации через телефонную сеть общего пользования (PSTN) для доставки одноразовых паролей (OTP) по телефону или SMS используются только в случае предварительной валидации номера, при этом предлагаются альтернативные более безопасные методы (например, TOTP), и пользователю сообщаются риски. Для приложений уровня L3 использование телефона и SMS недопустимо.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.6.2", + "Ordinal": 2, + "Description": "Убедитесь, что внеполосные запросы, коды или токены привязаны к исходному запросу аутентификации, для которого они были сгенерированы, и не могут быть использованы повторно для других попыток.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.6.3", + "Ordinal": 3, + "Description": "Убедитесь, что внеполосные механизмы на основе кода защищены от атак методом подбора (brute force) путём применения ограничения частоты запросов (rate limiting). Также рекомендуется использовать коды с энтропией не менее 64 бит.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.6.4", + "Ordinal": 4, + "Description": "Убедитесь, что при использовании push-уведомлений для MFA применяется ограничение частоты (rate limiting), чтобы предотвратить атаки push-бомбинга. Также может помочь механизм сопоставления номеров (number matching).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.7", + "Ordinal": 7, + "Name": "Криптографические механизмы аутентификации", + "Items": [ + { + "Shortcode": "V6.7.1", + "Ordinal": 1, + "Description": "Убедитесь, что сертификаты, используемые для проверки криптографических утверждений об аутентификации, хранятся таким образом, чтобы исключить возможность их модификации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.7.2", + "Ordinal": 2, + "Description": "Убедитесь, что nonce (случайная строка), используемая в процессе вызова, имеет длину не менее 64 бит и является статистически уникальной или уникальной на протяжении всего срока службы криптографического устройства.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.8", + "Ordinal": 8, + "Name": "Аутентификация с использованием провайдера идентификаций (IdP)", + "Items": [ + { + "Shortcode": "V6.8.1", + "Ordinal": 1, + "Description": "Убедитесь, что при поддержке несколькими IdP, невозможно подделать личность пользователя через другой IdP (например, с тем же user ID). Стандартным способом защиты является регистрация пользователя с использованием сочетания ID самого IdP (в качестве пространства имён) и пользовательского ID внутри IdP.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.8.2", + "Ordinal": 2, + "Description": "Убедитесь, что наличие и целостность цифровой подписи в утверждениях аутентификации (например, в JWT или SAML) всегда проверяются, а неподписанные или недействительные утверждения отклоняются.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.8.3", + "Ordinal": 3, + "Description": "Убедитесь, что SAML-утверждения обрабатываются только один раз в течение периода их действия, чтобы исключить атаки воспроизведения (replay attacks).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.8.4", + "Ordinal": 4, + "Description": "Убедитесь, что если приложение использует внешний поставщик идентификации (IdP) и для определенных функций требуется особый уровень, метод или срок действия аутентификации, то приложение использует данные, возвращаемые IdP, для проверки этих условий. Например, при использовании OIDC можно проверить значения полей ID Token — acr, amr, auth_time (если они есть). Если IdP не предоставляет эти данные, приложение должно иметь документированный план действий по умолчанию, предполагающий использование минимально допустимой силы аутентификации (например, одноступенчатая — логин и пароль).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V7", + "Ordinal": 7, + "ShortName": "Session", + "Name": "Управление сессиями", + "Items": [ + { + "Shortcode": "V7.1", + "Ordinal": 1, + "Name": "Документация по управлению сессиями", + "Items": [ + { + "Shortcode": "V7.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что тайм-аут бездействия и абсолютное максимальное время жизни сессии задокументированы, соответствуют другим контрольным мерам и сопровождаются обоснованием любых отклонений от требований повторной аутентификации NIST SP 800-63B.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что документация определяет допустимое количество одновременных (параллельных) сессий для одного аккаунта, а также поведение системы и действия при достижении этого лимита.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что все системы, создающие и управляющие сессиями пользователей в рамках федеративной идентификации (например, SSO), задокументированы вместе с механизмами координации сроков действия сессий, условий завершения и случаев, требующих повторной аутентификации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.2", + "Ordinal": 2, + "Name": "Базовая безопасность сессий", + "Items": [ + { + "Shortcode": "V7.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что все проверки сессионных токенов выполняются на доверенной серверной стороне.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение использует либо автономные токены, либо ссылочные токены, которые генерируются динамически, не используя статические API-секреты или ключи.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что ссылочные токены являются уникальными, создаются с использованием криптографически безопасного генератора псевдослучайных чисел (CSPRNG) и обладают энтропией не менее 128 бит.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что при аутентификации пользователя (включая повторную) создается новый токен сессии, а текущий — аннулируется.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.3", + "Ordinal": 3, + "Name": "Тайм-ауты сессии", + "Items": [ + { + "Shortcode": "V7.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что есть тайм-аут бездействия, после которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что установлено абсолютное максимальное время жизни сессии, по истечении которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.4", + "Ordinal": 4, + "Name": "Завершение сессий", + "Items": [ + { + "Shortcode": "V7.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что после завершения сессии (logout, истечение срока) дальнейшее её использование невозможно. Для ссылочных токенов или сессий с сохранением состояния это означает аннулирование на сервере. Для self-contained токенов необходимо реализовать механизм отзыва, например, список отозванных токенов, проверку времени выпуска или ротацию ключей подписи для каждого пользователя.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что при удалении или отключении пользователя все активные сессии немедленно завершаются.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что после изменения или удаления факторов аутентификации (например, смена пароля или MFA) приложение предлагает завершить все другие активные сессии.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.4.4", + "Ordinal": 4, + "Description": "Убедитесь, что на всех страницах, требующих аутентификации, имеется простой и видимый способ выхода.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.4.5", + "Ordinal": 5, + "Description": "Убедитесь, что администраторы могут завершать активные сессии конкретного пользователя или всех пользователей.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.5", + "Ordinal": 5, + "Name": "Защита от злоупотреблений сессией", + "Items": [ + { + "Shortcode": "V7.5.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение требует полной повторной аутентификации перед изменением чувствительных атрибутов аккаунта, которые могут влиять на аутентификацию (например, email, номер телефона, настройки MFA или данных восстановления доступа).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.5.2", + "Ordinal": 2, + "Description": "Убедитесь, что пользователь может просматривать и (после повторной аутентификации хотя бы по одному фактору) завершать активные сессии.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.5.3", + "Ordinal": 3, + "Description": "Убедитесь, что перед выполнением критически важных операций приложение требует повторной аутентификации (по крайней мере, одного фактора) или дополнительной проверки.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.6", + "Ordinal": 6, + "Name": "Федеративная повторная аутентификация", + "Items": [ + { + "Shortcode": "V7.6.1", + "Ordinal": 1, + "Description": "Убедитесь, что срок действия и завершение сессий между RP и IdP соответствуют документации и включают повторную аутентификацию, если достигнут максимальный допустимый интервал между событиями аутентификации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.6.2", + "Ordinal": 2, + "Description": "Убедитесь, что создание сессии требует согласия пользователя или явного действия, предотвращающего несанкционированное создание сессий без участия пользователя.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V8", + "Ordinal": 8, + "ShortName": "Authorization", + "Name": "Авторизация", + "Items": [ + { + "Shortcode": "V8.1", + "Ordinal": 1, + "Name": "Документация по авторизации", + "Items": [ + { + "Shortcode": "V8.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне функций и на уровне данных на основе прав субъекта и атрибутов ресурса.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне полей (как на чтение, так и на запись) на основе прав субъекта и атрибутов ресурса. Эти правила могут зависеть от других атрибутов объекта данных, например, статуса.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что документация определяет, какие атрибуты окружения и контекста (например, время суток, IP-адрес, местоположение, устройство) используются приложением для принятия решений в области аутентификации и авторизации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.1.4", + "Ordinal": 4, + "Description": "Убедитесь, что документация по аутентификации и авторизации определяет, как используются факторы окружения и контекста в принятии решений, наряду с правилами доступа к функциям, данным и полям. Документация должна содержать оцениваемые атрибуты, пороговые значения риска, действия (разрешить, отказать, повысить уровень аутентификации и др.).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V8.2", + "Ordinal": 2, + "Name": "Архитектура авторизации", + "Items": [ + { + "Shortcode": "V8.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение обеспечивает доступ на уровне функций (function-level) только субъектам с явными разрешениями.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение обеспечивает доступ на уровне данных (data-specific) только тем субъектам, которым явно предоставлены права к определённым элементам данных, чтобы предотвратить IDOR (Insecure Direct Object Reference) и BOLA-уязвимости (Broken Object Level Authorization).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение обеспечивает доступ на уровне полей (field-level) только тем субъектам, которым явно предоставлены права к определённым полям, чтобы предотвратить BOPLA (Broken Object Property Level Authorization).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что реализованы адаптивные меры безопасности, основанные на атрибутах окружения и контекста субъекта (время, местоположение, IP, устройство), которые используются для принятия решений об аутентификации и авторизации, как это определено в документации приложения. Эти меры должны применяться как при попытке субъекта начать новую сессию, так и во время существующей сессии.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V8.3", + "Ordinal": 3, + "Name": "Авторизация на уровне операций", + "Items": [ + { + "Shortcode": "V8.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что правила авторизации реализуются на доверенном сервисном уровне и не зависят от элементов, которые может контролировать клиент (например, JavaScript на стороне клиента).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что изменения значений, влияющих на авторизацию, применяются немедленно. Если это невозможно (например, при использовании автономных токенов), должны быть реализованы компенсирующие меры: оповещения о попытке несанкционированного действия и откат изменений. Обратите внимание, что данный подход не предотвращает утечку информации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что доступ к объекту осуществляется на основе прав субъекта, инициировавшего запрос, а не прав промежуточного сервиса, действующего от его имени. Например, если пользователь обращается к веб-сервису с автономным токеном для аутентификации, а сервис затем запрашивает данные у другого сервиса, второй сервис должен использовать токен пользователя, а не токен первого сервиса для принятия решения о доступе.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V8.4", + "Ordinal": 4, + "Name": "Прочие аспекты авторизации", + "Items": [ + { + "Shortcode": "V8.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что в мультитенантных приложениях реализованы механизмы, предотвращающие действия потребителя в отношении арендаторов, к которым у него нет доступа.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что доступ к административным интерфейсам защищён несколькими уровнями контроля, включая непрерывную проверку личности, контроль защищённости устройства и анализ контекстных рисков. Недостаточно опираться только на IP-адрес или доверенные устройства.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V9", + "Ordinal": 9, + "ShortName": "Self", + "Name": "Автономные токены", + "Items": [ + { + "Shortcode": "V9.1", + "Ordinal": 1, + "Name": "Источник токена и его целостность", + "Items": [ + { + "Shortcode": "V9.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что автономные токены проверяются на целостность с помощью цифровой подписи или MAC, прежде чем доверять их содержимому.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.1.2", + "Ordinal": 2, + "Description": "Проверяйте, что автономные токены создаются и проверяются исключительно с помощью алгоритмов из списка допустимых в данном контексте. Список допустимых алгоритмов должен включать только разрешенные алгоритмы (желательно либо только симметричные, либо только асимметричные) и ни в коем случае не содержать алгоритм None. Если необходимо поддерживать оба типа алгоритмов, потребуются дополнительные средства контроля для предотвращения путаницы с ключами (key confusion).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что ключи, используемые для проверки автономных токенов, получены из доверенных, предварительно настроенных источников. Это предотвращает возможность указания злоумышленниками ненадёжных источников и ключей. Для JWT и других JWS структур заголовки 'jku', 'x5u' и 'jwk' должны проверяться по белому списку.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V9.2", + "Ordinal": 2, + "Name": "Содержимое токена", + "Items": [ + { + "Shortcode": "V9.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что при указанном сроке действия токен и его содержимое принимаются только в том случае, если срок действия токена не истёк. Например, для JWT нужно проверить поля 'nbf' и 'exp'.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что сервис, принимающий токен, проверяет его тип и соответствие назначению перед обработкой содержимого токена. Например, для принятия решений об авторизации могут быть приняты только Access Token, а для подтверждения аутентификации пользователя — только ID Token.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что сервис принимает только токены, предназначенные для использования с этим сервисом (audience). Для JWT это можно сделать, проверив наличие утверждения «aud» по белому списку, определенному в сервисе.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что, если эмитент токенов использует один и тот же закрытый ключ для выпуска токенов различным сервисам (audiences), выпущенные токены содержат явное указание целевых сервисов. Это предотвратит повторное использования токенов в не предназначенных для них сервисах. Если идентификатор сервиса (audience identifier) назначается динамически, эмитент токенов должен проверить audiences для исключения подмены получателей (audience impersonation).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V10", + "Ordinal": 10, + "ShortName": "OAuth", + "Name": "OAuth и OIDC", + "Items": [ + { + "Shortcode": "V10.1", + "Ordinal": 1, + "Name": "Общие требования безопасности OAuth и OIDC", + "Items": [ + { + "Shortcode": "V10.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что токены передаются только тем компонентам, которым они действительно необходимы. Например, при использовании схемы backend-for-frontend для браузерных JavaScript-приложений, access и refresh токены должны быть доступны только на backend.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что клиент принимает значения от авторизационного сервера (например, authorization code или ID Token) только если они получены в результате авторизационного потока, инициированного в той же сессии пользовательского агента и в рамках той же транзакции. Для этого клиентские секреты, такие как proof key для code exchange (PKCE) — 'code_verifier', 'state' или OIDC 'nonce' — должны быть непредсказуемыми, специфичными для транзакции и надежно привязанными как к клиенту, так и к сессии пользовательского агента, в которой началась транзакция.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.2", + "Ordinal": 2, + "Name": "Клиент OAuth", + "Items": [ + { + "Shortcode": "V10.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что если используется механизм authorization code flow, OAuth клиент защищён от CSRF, вызывающих запросы токенов либо за счёт использования механизма proof key for code exchange (PKCE), либо за счёт проверки параметра 'state', который был отправлен в запросе авторизации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что если OAuth клиент может взаимодействовать с более чем одним сервером авторизации, у него есть защита от атак смешивания (mix-up attacks). Например, клиент должен требовать, чтобы сервер авторизации возвращал параметр 'iss' и проверять его в ответах на авторизацию и токены.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что OAuth клиент запрашивает только необходимые области доступа (scopes) или другие параметры авторизации в запросах к серверу авторизации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.3", + "Ordinal": 3, + "Name": "Сервер ресурсов OAuth", + "Items": [ + { + "Shortcode": "V10.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что сервер ресурсов принимает только те access токены, которые предназначены для использования с этим сервисом (свойство audience). Эта принадлежность сервису может быть включена в структурированный access токен (например, в поле 'aud' в JWT) или проверяться через endpoint интроспекции токена.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что сервер ресурсов принимает решения по авторизации на основе claims из access токена, определяющих делегированную авторизацию. Если присутствуют claims, такие как 'sub', 'scope' и 'authorization_details', они должны участвовать в принятии решения.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что если для принятия решения по контролю доступа необходимо однозначно идентифицировать пользователя из access токена (JWT или ответа интроспекции), сервер ресурсов использует claims, которые не могут быть переприсвоены другим пользователям. Обычно это комбинация claims 'iss' и 'sub'.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что если сервер ресурсов требует определённой силы аутентификации, методов или свежести аутентификации, он проверяет, что предъявленный access токен удовлетворяет этим требованиям. Например, при наличии, могут использоваться claims OIDC 'acr', 'amr' и 'auth_time'.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.3.5", + "Ordinal": 5, + "Description": "Убедитесь, что сервер ресурсов предотвращает использование украденных access токенов или их повторное использование (replay) неавторизованными лицами, требуя access токены с подтверждением отправителя — например, Mutual TLS для OAuth 2 или OAuth 2 Demonstration of Proof of Possession (DPoP).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.4", + "Ordinal": 4, + "Name": "Сервер авторизации OAuth", + "Items": [ + { + "Shortcode": "V10.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что сервер авторизации проверяет URI перенаправления (redirect URI), сверяя его с заранее зарегистрированным списком разрешённых URI для данного клиента (allowlist), используя точное сравнение строк.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что если сервер авторизации возвращает authorization code в ответе авторизации, этот код может быть использован только один раз для запроса токена. При втором валидном запросе с уже использованным кодом сервер должен отклонить запрос и отозвать любые токены, связанные с этим кодом.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что authorization code имеет короткое время жизни. Максимальная продолжительность — до 10 минут для приложений L1 и L2 и до 1 минуты для приложений L3.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.4", + "Ordinal": 4, + "Description": "Убедитесь, что сервер авторизации для конкретного клиента разрешает использование только тех типов авторизации, которые необходимы этому клиенту. Обратите внимание, что тип авторизации Implicit flow и Resource Owner Password Credentials flow больше не должны использоваться.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.5", + "Ordinal": 5, + "Description": "Убедитесь, что сервер авторизации предотвращает атаки повторного использования refresh токенов для публичных клиентов, предпочтительно используя sender-constrained refresh токены, такие как DPoP или сертификат-связанные токены с mutual TLS (mTLS). Для L1 и L2 допускается ротация refresh токенов с обязательной их инвалидацией после использования. Если используется ротация, сервер должен отозвать все refresh токены при попытке использовать уже инвалидированный токен.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.6", + "Ordinal": 6, + "Description": "Убедитесь, что при использовании типа авторизации «Authorization Code» сервер предотвращает атаки перехвата authorization code, требуя Proof Key for Code Exchange (PKCE). В запросах авторизации сервер должен требовать валидное значение 'code_challenge' и не принимать 'code_challenge_method' со значением 'plain'. В запросах токена обязательно валидировать параметр 'code_verifier'.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.7", + "Ordinal": 7, + "Description": "Убедитесь, что если сервер авторизации поддерживает динамическую регистрацию клиентов без аутентификации, он минимизирует риски вредоносных клиентов. Сервер должен валидировать метаданные клиента (например, зарегистрированные URI), обеспечивать согласие пользователя и предупреждать пользователя перед обработкой запроса авторизации от недоверенного клиента.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.8", + "Ordinal": 8, + "Description": "Убедитесь, что refresh токены имеют абсолютный срок действия, включая случаи, когда применяется скользящее время истечения срока.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.9", + "Ordinal": 9, + "Description": "Убедитесь, что пользователи могут отзывать refresh токены и reference access токены через пользовательский интерфейс сервера авторизации для снижения риска от вредоносных клиентов или кражи токенов.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.10", + "Ordinal": 10, + "Description": "Убедитесь, что конфиденциальный клиент аутентифицируется при взаимодействии с сервером авторизации через backchannel, например при запросах токена, pushed authorization requests (PAR) и запросах на отзыв токенов.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.11", + "Ordinal": 11, + "Description": "Убедитесь, что конфигурация сервера авторизации назначает OAuth клиенту только необходимые области доступа (scopes).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.12", + "Ordinal": 12, + "Description": "Убедитесь, что для конкретного клиента сервер авторизации разрешает только те значения 'response_mode', которые необходимы этому клиенту. Например, сервер должен валидировать это значение против ожидаемых или использовать pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.13", + "Ordinal": 13, + "Description": "Убедитесь, что грант типа 'code' всегда используется вместе с pushed authorization requests (PAR).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.14", + "Ordinal": 14, + "Description": "Убедитесь, что сервер авторизации выдаёт только sender-constrained (Proof-of-Possession) access токены, либо с сертификат-связанными токенами через mutual TLS (mTLS), либо DPoP-bound токены (Demonstration of Proof of Possession).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.15", + "Ordinal": 15, + "Description": "Убедитесь, что для серверного клиента (не выполняющегося на устройстве конечного пользователя) сервер авторизации проверяет, что значение параметра 'authorization_details' исходит из клиентского backend и что пользователь не изменял его. Например, это достигается использованием pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.16", + "Ordinal": 16, + "Description": "Убедитесь, что клиент является конфиденциальным и сервер авторизации требует использования сильных методов аутентификации клиента (основанных на криптографии с открытым ключом и устойчивых к атакам повторного воспроизведения), таких как mutual TLS ('tls_client_auth', 'self_signed_tls_client_auth') или private key JWT ('private_key_jwt').", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.5", + "Ordinal": 5, + "Name": "Клиент OIDC", + "Items": [ + { + "Shortcode": "V10.5.1", + "Ordinal": 1, + "Description": "Убедитесь, что клиент (relying party) защищается от повторного использования ID Token (replay-атак). Например, это достигается проверкой того, что значение 'nonce' в ID Token совпадает со значением 'nonce', отправленным в запросе аутентификации провайдеру OpenID (authorization server).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.5.2", + "Ordinal": 2, + "Description": "Убедитесь, что клиент однозначно идентифицирует пользователя по утверждениям (claims) ID Token, обычно это 'sub', который не может быть переназначен другому пользователю (в пределах конкретного провайдера идентификации).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.5.3", + "Ordinal": 3, + "Description": "Убедитесь, что клиент отклоняет попытки злоумышленного сервера авторизации выдавать себя за другой сервер авторизации через метаданные сервера авторизации. Клиент должен отклонить метаданные, если URL издателя (issuer) в метаданных не совпадает точно с преднастроенным URL издателя, ожидаемым клиентом.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.5.4", + "Ordinal": 4, + "Description": "Убедитесь, что клиент проверяет, что ID Token предназначен для него (проверка audience), сравнивая значение 'aud' в токене с 'client_id' клиента.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.5.5", + "Ordinal": 5, + "Description": "Убедитесь, что при использовании OIDC back-channel logout клиент снижает риск отказа в обслуживании, вызванный принудительным выходом из системы и путаницей между разными типами JWT (cross-JWT confusion) в процессе логаута. Клиент должен проверить, что токен выхода корректно типизирован со значением 'logout+jwt', содержит claim 'event' с правильным именем участника и не содержит 'nonce'. Также рекомендуется установить короткий срок действия токена (например, 2 минуты).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.6", + "Ordinal": 6, + "Name": "Провайдер OpenID", + "Items": [ + { + "Shortcode": "V10.6.1", + "Ordinal": 1, + "Description": "Убедитесь, что провайдер OpenID допускает только значения 'code', 'ciba', 'id_token' или 'id_token code' для параметра response mode. При этом предпочтение отдаётся 'code' по сравнению с 'id_token code' (гибридный поток OIDC), а значение 'token' (любой Implicit flow) не должно использоваться.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.6.2", + "Ordinal": 2, + "Description": "Убедитесь, что провайдер OpenID предотвращает отказ в обслуживании (DoS) через принудительный выход (logout), запрашивая явное подтверждение от конечного пользователя или, если применимо, проверяя параметры в запросе выхода (инициированном relying party), например параметр 'id_token_hint'.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.7", + "Ordinal": 7, + "Name": "Управление согласием", + "Items": [ + { + "Shortcode": "V10.7.1", + "Ordinal": 1, + "Description": "Убедитесь, что авторизационный сервер обеспечивает получение согласия пользователя для каждого запроса авторизации. Если личность клиента не может быть подтверждена, сервер авторизации всегда должен явно запрашивать согласие пользователя.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.7.2", + "Ordinal": 2, + "Description": "Убедитесь, что при запросе согласия пользователя авторизационный сервер предоставляет достаточную и понятную информацию о том, на что даётся согласие. При необходимости это должно включать характер запрашиваемых разрешений (обычно основанных на scope, ресурсном сервере, деталях авторизации Rich Authorization Requests (RAR)), идентификацию авторизованного приложения и срок действия этих разрешений.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.7.3", + "Ordinal": 3, + "Description": "Убедитесь, что пользователь может просматривать, изменять и отзывать согласия, которые он предоставил, через авторизационный сервер.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V11", + "Ordinal": 11, + "ShortName": "Cryptography", + "Name": "Криптография", + "Items": [ + { + "Shortcode": "V11.1", + "Ordinal": 1, + "Name": "Инвентаризация и документирование криптографии", + "Items": [ + { + "Shortcode": "V11.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что задокументирована политика управления криптографическими ключами и описан их жизненный цикл в соответствии со стандартом управления ключей, таким как NIST SP 800-57. Убедитесь, что ключи известны только тем сущностям, которым они должны быть доступны (например, ключи не передавались более чем двум участникам для общих секретов и более чем одному участнику для приватных ключей).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что проводится инвентаризация криптографических средств, которая непрерывно поддерживается, регулярно обновляется и включает все криптографические ключи, алгоритмы и сертификаты, используемые в приложении. Также должна быть задокументирована информация о том, где ключи могут и не могут использоваться в системе, а также какие типы данных могут и не могут быть защищены с помощью этих ключей.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что используются механизмы обнаружения криптографии для идентификации всех случаев применения криптографии в системе , включая операции шифрования, хеширования и цифровой подписи.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.1.4", + "Ordinal": 4, + "Description": "Убедитесь, что ведётся и поддерживается инвентаризация криптографических средств. В неё должен входить документированный план, описывающий переход на новые криптографические стандарты, такие как постквантовая криптография, чтобы своевременно реагировать на будущие угрозы.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.2", + "Ordinal": 2, + "Name": "Безопасная реализация криптографии", + "Items": [ + { + "Shortcode": "V11.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что для криптографических операций используются утвержденные в индустрии реализации (включая библиотеки и аппаратные реализации).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что архитектура приложения поддерживает быструю реконфигурацию, усовершенствование или смену в любой момент случайных чисел, аутентифицированного шифрования, MAC, алгоритмов хеширования, длин ключей, количества раундов, шифров и режимов шифрования для защиты от криптографических атак. Также должна поддерживаться возможность смены ключей, паролей и повторного шифрования данных. Это позволит беспрепятственно перейти на постквантовую криптографию (PQC), как только станут широко доступны высоконадёжные реализации одобренных схем или стандартов PQC.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что все криптографические примитивы используют как минимум 128-бит стойкости с учетом алгоритма, размера ключа и конфигурации. Например, 256-битный ECC ключ обеспечивает примерно 128 бит безопасности, тогда как для достижения того же уровня безопасности в RSA требуется ключ длиной 3072 бита.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что все криптографические операции выполняются за константное время, без использования «short-circuit» операций в сравнениях, вычислениях, возвратах функций для избежания утечек информации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что все криптографические модули обеспечивают безопасное завершение работы при ошибках, а обработка ошибок реализована таким образом, чтобы не создавать уязвимостей, например, таких как атаки Padding Oracle.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.3", + "Ordinal": 3, + "Name": "Алгоритмы шифрования", + "Items": [ + { + "Shortcode": "V11.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что не используются небезопасные режимы блочного шифрования (н-р, ECB) и слабые схемы дополнения (padding) (н-р, PKCS#1 v1.5).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что используются только утверждённые шифры и режимы, такие как AES с GCM.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что зашифрованные данные защищены от несанкционированного изменения, предпочтительно с использованием утверждённого метода аутентифицированного шифрования или путём комбинирования утверждённого метода шифрования с утверждённым алгоритмом MAC.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что случайные числа (nonce), векторы инициализации (IV) и другие одноразовые числа не используются более одного раза для одной и той же пары ключа шифрования и элемента данных. Метод их генерации должен соответствовать требованиям используемого алгоритма.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.3.5", + "Ordinal": 5, + "Description": "Убедитесь, что любая комбинация алгоритма шифрования и алгоритма MAC работает в режиме encrypt-then-MAC (EtM).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.4", + "Ordinal": 4, + "Name": "Хеширование и функции на основе хеширования", + "Items": [ + { + "Shortcode": "V11.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что только утвержденные хэш-функции используются для стандартных сценариев использования в криптографии, включая цифровую подпись, HMAC, KDF, генерацию случайных чисел. Запрещено использовать неустойчивые хэш-функции, (н-р, MD5) для любого использования в криптографии.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что пароли хранятся с использованием утверждённой, вычислительно затратной функции генерации ключа (также известной как «функция хеширования паролей»), с параметрами, настроенными в соответствии с актуальными рекомендациями. Настройки должны обеспечивать баланс между безопасностью и производительностью, чтобы сделать атаки перебором достаточно сложными для требуемого уровня безопасности.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что хэш-функции, используемые в формировании цифровой подписи, как часть аутентификации и целостности данных, устойчивы к коллизиям и имеют достаточную длину.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.4.4", + "Ordinal": 4, + "Description": "Убедитесь, что приложение использует утвержденную функцию генерации ключа с использованием параметров расширения ключа (key stretching) при генерации ключа из пароля. Параметры должны быть сбалансированы с точки зрения безопасности, производительности и устойчивости к атакам полного перебора при компрометации результирующего криптографического ключа.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.5", + "Ordinal": 5, + "Name": "Случайные значения", + "Items": [ + { + "Shortcode": "V11.5.1", + "Ordinal": 1, + "Description": "Убедитесь, что все случайные числа и строки, которые должны быть непредсказуемы, должны быть сгенерированы с помощью CSPRNG и иметь хотя бы 128 бит энтропии. Учтите, что UUID не удовлетворяют данному условию.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.5.2", + "Ordinal": 2, + "Description": "Убедитесь, что механизм генерации случайных чисел является надежным даже при высокой нагрузке.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.6", + "Ordinal": 6, + "Name": "Криптография с публичным ключом", + "Items": [ + { + "Shortcode": "V11.6.1", + "Ordinal": 1, + "Description": "Убедитесь, что только утвержденные криптографические алгоритмы и режимы операций используются для генерации ключа и инициализации случайного значения для его генерации (seeding), а также для генерации цифровой подписи и верификации. Алгоритмы генерации ключей не должны генерировать небезопасные ключи уязвимые к известным атакам, например, ключи RSA уязвимы к факторизации Ферма.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.6.2", + "Ordinal": 2, + "Description": "Убедитесь, что для обмена ключами используются утверждённые криптографические алгоритмы (например, Диффи-Хеллман) с особым вниманием к обеспечению использования безопасных параметров. Это предотвратит атаки на процесс установления ключа, которые могут привести к атакам «человек посередине» или криптографическим взломам.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.7", + "Ordinal": 7, + "Name": "Шифрование данных в процессе использования", + "Items": [ + { + "Shortcode": "V11.7.1", + "Ordinal": 1, + "Description": "Убедитесь, что используется полное шифрование памяти, которое защищает конфиденциальные данные во время их использования, предотвращая доступ к ним неавторизованных пользователей или процессов.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.7.2", + "Ordinal": 2, + "Description": "Убедитесь, что минимизация данных обеспечивает раскрытие минимально необходимого объёма данных во время обработки, а также что данные шифруются сразу после использования или как можно скорее.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V12", + "Ordinal": 12, + "ShortName": "Secure", + "Name": "Безопасная коммуникация", + "Items": [ + { + "Shortcode": "V12.1", + "Ordinal": 1, + "Name": "Общие рекомендации по безопасности TLS", + "Items": [ + { + "Shortcode": "V12.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что включены только актуальные и рекомендуемые версии протокола TLS, такие как TLS 1.2 и TLS 1.3. Наиболее свежая версия TLS должна быть выбрана как предпочтительная.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что включены рекомендуемые шифронаборы (cipher suites), предпочтение также стоит отдать самому сильному шифронабору. L3 приложения должны поддерживать только те наборы шифров (cipher suites), которые обеспечивают прямую (forward) секретность. Пояснение: Прямая секретность (Forward Secrecy, FS) — это криптографическая особенность, при которой сессионные ключи уникальны для каждой сессии и не зависят от долгосрочных ключей. Это гарантирует, что даже при компрометации долгосрочного ключа злоумышленник не сможет расшифровать ранее перехваченные зашифрованные сессии.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение проверяет доверенность клиентских сертификатов mTLS, прежде чем использовать идентификацию по сертификату для аутентификации или авторизации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.1.4", + "Ordinal": 4, + "Description": "Убедитесь, что включена и настроена правильная проверка отзыва сертификатов, такая как Online Certificate Status Protocol (OCSP) Stapling.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.1.5", + "Ordinal": 5, + "Description": "Убедитесь, что в настройках TLS приложения включена функция Encrypted Client Hello (ECH) для предотвращения раскрытия конфиденциальных метаданных, таких как Server Name Indication (SNI), во время процесса TLS-рукопожатия.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V12.2", + "Ordinal": 2, + "Name": "HTTPS коммуникация с внешними сервисами", + "Items": [ + { + "Shortcode": "V12.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что для всех соединений между клиентом и внешними HTTP-сервисами используется TLS и не происходит отката к небезопасным или незашифрованным протоколам.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что внешние сервисы используют публично доверенные TLS-сертификаты.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V12.3", + "Ordinal": 3, + "Name": "Общая безопасность межсервисного взаимодействия", + "Items": [ + { + "Shortcode": "V12.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что для всех входящих и исходящих соединений приложения используется зашифрованный протокол, например TLS, включая системы мониторинга, инструменты управления, удалённый доступ и SSH, промежуточное ПО, базы данных, мейнфреймы, партнёрские системы и внешние API. Сервер не должен допускать откат к небезопасным или незашифрованным протоколам.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что TLS-клиент проверяет сертификат сервера до установления защищенного соединения с TLS-сервером.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что все внутренние HTTP-взаимодействия между компонентами приложения используют TLS или другой подходящий механизм транспортного шифрования, и не происходит откат к небезопасным или незашифрованным коммуникациям.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что TLS-соединения между внутренними сервисами используют доверенные сертификаты. Если используются внутренние или самоподписанные сертификаты, потребляющий сервис должен быть настроен на доверие только к конкретным внутренним центрам сертификации (CA) и конкретным самоподписанным сертификатам.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.3.5", + "Ordinal": 5, + "Description": "Убедитесь, что сервисы, взаимодействующие внутри системы (intra-service communications), используют строгую аутентификацию для проверки каждого конечного узла. Для проверки подлинности взаимодействующих сторон должны применяться методы строгой аутентификации, такие как аутентификация TLS-клиента, с использованием инфраструктуры открытых ключей и механизмов, устойчивых к атакам повтора (replay attacks). Для микросервисных архитектур рекомендуется использование service mesh для упрощения управления сертификатами и повышения безопасности.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V13", + "Ordinal": 13, + "ShortName": "Configuration", + "Name": "Конфигурация", + "Items": [ + { + "Shortcode": "V13.1", + "Ordinal": 1, + "Name": "Документация конфигурации", + "Items": [ + { + "Shortcode": "V13.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что все необходимые доступы приложения задокументированы. Сюда должны быть включены как внешние сервисы, от которых зависит приложение, так и сценарии, когда конечный пользователь может задавать адреса для внешнего подключения.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что для каждого сервиса, используемого приложением, в документации определено максимальное количество одновременных соединений (например, лимиты пула соединений) и описано поведение приложения при достижении этого лимита, включая любые механизмы отказоустойчивости или восстановления, чтобы предотвратить ситуации отказа в обслуживании (DoS).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что в документации приложения определены стратегии управления ресурсами для каждой внешней системы или сервиса, которые оно использует (например, базы данных, файловые дескрипторы, потоки, HTTP-соединения). Стратегии должны включать процедуры освобождения ресурсов, настройки таймаутов, обработку сбоев, а также, если реализована логика повторных попыток, указание лимитов, задержек и алгоритмов back-off. Для синхронных HTTP-запросов должны быть заданы короткие таймауты, а повторные запросы должны быть отключены, либо строго ограничены по числу попыток, чтобы предотвратить каскадные задержки и истощение ресурсов.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.1.4", + "Ordinal": 4, + "Description": "Убедитесь, что в документации приложения определены секреты, критически важные для безопасности приложения, а также установлен график их ротации в соответствии с моделью угроз организации и её бизнес-требованиями.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V13.2", + "Ordinal": 2, + "Name": "Конфигурация бэкенд соединений", + "Items": [ + { + "Shortcode": "V13.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что коммуникации между компонентами бэкенда приложения (включая API, промежуточное ПО и уровни данных), которые не поддерживают стандартный механизм пользовательских сессий, проходят с аутентификацией. Аутентификация должна использовать индивидуальные сервисные аккаунты, краткосрочные токены или аутентификацию на основе сертификатов, а не постоянные учётные данные, такие как пароли, API-ключи или общие аккаунты с привилегированным доступом.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что коммуникации между компонентами бэкенда приложения, включая локальные или системные службы, API, промежуточное ПО и уровни данных, выполняются с использованием аккаунтов, которым назначены минимально необходимые привилегии.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что если для аутентификации в сервисе используются учётные данные, то используемые потребителем учётные данные не являются стандартными (например, root/root или admin/admin).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что используется белый список (allowlist) для определения внешних ресурсов или систем, с которыми приложению разрешено взаимодействовать (например, для исходящих запросов, загрузки данных или доступа к файлам). Этот белый список может быть реализован на уровне приложения, веб-сервера, межсетевого экрана или комбинации различных уровней.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что веб- или прикладной сервер настроен с белым списком ресурсов или систем, к которым сервер может отправлять запросы или из которых может загружать данные и файлы.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.6", + "Ordinal": 6, + "Description": "Убедитесь, что при подключении приложения к другим сервисам соблюдается задокументированная конфигурация для каждого соединения, включая максимальное количество параллельных соединений, поведение при достижении их максимума, таймауты и стратегии повторных попыток подключения.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V13.3", + "Ordinal": 3, + "Name": "Управление секретами", + "Items": [ + { + "Shortcode": "V13.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что для безопасного создания, хранения, контроля доступа и уничтожения секретов бэкенда используется решение для управления секретами, например, хранилище ключей (key vault). Секретами могут быть пароли, ключевой материал, интеграции с базами данных и сторонними системами, ключи и seed-значения для токенов с ограниченным временем действия, другие внутренние секреты и API-ключи. Секреты не должны включаться в исходный код приложения или артефакты сборки. Для приложений уровня L3 необходимо использовать аппаратное решение, например, аппаратный модуль безопасности (HSM).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что доступ к секретным ресурсам осуществляется в соответствии с принципом минимально необходимых привилегий (least privilege).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что все криптографические операции выполняются с использованием изолированного модуля безопасности (например, хранилища ключей или аппаратного модуля безопасности), чтобы надежно управлять ключевым материалом и защищать его от утечки за пределы модуля безопасности.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что секреты настроены на срок действия и ротацию в соответствии с документацией приложения.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V13.4", + "Ordinal": 4, + "Name": "Непреднамеренная утечка информации", + "Items": [ + { + "Shortcode": "V13.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение развернуто либо без метаданных систем контроля версий (включая папки .git или .svn), либо так, чтобы эти папки были недоступны как извне, так и для самого приложения.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что режимы отладки отключены для всех компонентов в промышленной среде, чтобы предотвратить раскрытие функций отладки и утечку информации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что веб-серверы не показывают клиентам списки содержимого каталогов, если это явно не предусмотрено.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.4", + "Ordinal": 4, + "Description": "Убедитесь, что метод HTTP TRACE не поддерживается в продуктовой среде, чтобы избежать потенциальной утечки информации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.5", + "Ordinal": 5, + "Description": "Убедитесь, что документация (например, по внутренним API) и мониторинговые эндпоинты не доступны, если это явно не предусмотрено.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.6", + "Ordinal": 6, + "Description": "Убедитесь, что приложение не раскрывает подробную информацию о версиях компонентов бэкенда.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.7", + "Ordinal": 7, + "Description": "Убедитесь, что веб-слой настроен на обслуживание только файлов с определёнными расширениями, чтобы предотвратить непреднамеренную утечку информации, конфигураций и исходного кода.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V14", + "Ordinal": 14, + "ShortName": "Data", + "Name": "Защита информации", + "Items": [ + { + "Shortcode": "V14.1", + "Ordinal": 1, + "Name": "Документация по защите информации", + "Items": [ + { + "Shortcode": "V14.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что все конфиденциальные данные, создаваемые и обрабатываемые приложением, идентифицированы и классифицированы по уровням защиты. Включая закодированные данные, которые легко декодируются, например, строки Base64 или незашифрованные данные в полезной нагрузке JWT. Уровни защиты должны учитывать требования по защите данных и конфиденциальности, которым должно соответствовать приложение.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что для каждого уровня защиты конфиденциальных данных требования к защите задокументированы. Они должны включать (но не ограничиваться) требования по шифрованию, проверке целостности, срокам хранения, способам логирования данных, контролю доступа к чувствительным данным в логах, шифрованию на уровне базы данных, применению технологий повышения конфиденциальности, а также другим требованиям по конфиденциальности.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V14.2", + "Ordinal": 2, + "Name": "Базовые меры по защите информации", + "Items": [ + { + "Shortcode": "V14.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что конфиденциальные данные передаются на сервер только в теле HTTP-запроса или в заголовках. URL и строка запроса не должны содержать конфиденциальную информацию, такую как API-ключ или сессионный токен.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение предотвращает кэширование конфиденциальных данных в серверных компонентах, таких как балансировщики нагрузки и кэши приложений, либо гарантирует их надежное удаление после использования.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что заранее определённые конфиденциальные данные не отправляются ненадёжным сторонам (например, системам трекинга пользователей), чтобы предотвратить нежелательный сбор данных вне контроля приложения.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что для конфиденциальных данных реализованы меры по шифрованию, проверке целостности, срокам хранения, способам логирования, контролю доступа к данным в логах, а также применяются технологии повышения конфиденциальности в соответствии с документацией для соответствующего уровня защиты данных.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что механизмы кэширования настроены так, чтобы кэшировать только ответы с ожидаемым типом содержимого для данного ресурса и не содержать конфиденциального динамического контента. При обращении к несуществующему файлу, веб-сервер должен возвращать ответ 404 или 302, а не подменять на другой существующий файл, что позволит предотвратить атаки типа Web Cache Deception.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.6", + "Ordinal": 6, + "Description": "Убедитесь, что приложение возвращает только минимально необходимый объем конфиденциальных данных для выполнения своей функциональности. Например, показывает только часть цифр номера кредитной карты, а не полный номер. Если требуется отображение полных данных, они должны быть замаскированы в пользовательском интерфейсе, пока пользователь специально не запросил их просмотр.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.7", + "Ordinal": 7, + "Description": "Убедитесь, что конфиденциальная информация подлежит классификации по срокам хранения, чтобы устаревшие или ненужные данные удалялись автоматически, по расписанию или по мере необходимости.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.8", + "Ordinal": 8, + "Description": "Убедитесь, что конфиденциальная информация удаляется из метаданных файлов, загружаемых пользователями, если пользователь явно не согласился на ее хранение.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V14.3", + "Ordinal": 3, + "Name": "Защита данных на стороне клиента", + "Items": [ + { + "Shortcode": "V14.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что аутентифицированные данные очищаются из клиентского хранилища, например, из DOM браузера, после завершения работы клиента или сессии. Заголовок HTTP-ответа Clear-Site-Data может помочь в этом, но клиентская сторона также должна уметь очищать данные, если соединение с сервером недоступно при завершении сессии.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение устанавливает HTTP-заголовки, достаточные для предотвращения кэширования (например, Cache-Control: no-store), чтобы конфиденциальные данные не сохранялись в браузерах.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что данные, хранящиеся в браузерном хранилище (например, localStorage, sessionStorage, IndexedDB или cookie), не содержат конфиденциальной информации, за исключением сессионных токенов.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V15", + "Ordinal": 15, + "ShortName": "Secure", + "Name": "Безопасная разработка и архитектура", + "Items": [ + { + "Shortcode": "V15.1", + "Ordinal": 1, + "Name": "Документация по безопасной разработке и архитектуре", + "Items": [ + { + "Shortcode": "V15.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что в документации по приложению определены сроки устранения уязвимостей на основе оценки рисков для внешних зависимостей с уязвимостями и для обновления библиотек в целом, чтобы минимизировать риск, связанный с этими компонентами.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что ведется реестр всех используемых сторонних библиотек (например, Software Bill of Materials, SBOM), с обязательной проверкой, что компоненты получены из предопределенных, доверенных и регулярно поддерживаемых репозиториев.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что в документации приложения указан функционал, требующий значительных временных или вычислительных ресурсов. Необходимо указать, как предотвратить потерю доступности из-за чрезмерного использования этого функционала и как избежать ситуаций, когда формирование ответа занимает больше времени, чем установленный системой таймаут. Возможные меры защиты могут включать асинхронную обработку, использование очередей и ограничение количества параллельных процессов для каждого пользователя и приложения.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.1.4", + "Ordinal": 4, + "Description": "Убедитесь, что в документации приложения указаны внешние библиотеки, которые считаются «компонентами с повышенным риском».", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.1.5", + "Ordinal": 5, + "Description": "Убедитесь, что в документации приложения выделены те части приложения, в которых используются «функционал с повышенным риском».", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V15.2", + "Ordinal": 2, + "Name": "Архитектура безопасности и зависимости", + "Items": [ + { + "Shortcode": "V15.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение содержит только те компоненты, которые не нарушили задокументированные сроки обновления и исправления.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что в приложении реализованы меры защиты от потери доступности из-за функциональности, требующей много времени или ресурсов, на основе задокументированных решений и стратегий безопасности для этого.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что производственная среда включает только те функции, которые необходимы для работы приложения, и не предоставляет лишние функции, такие как тестовый код, примеры кода и инструменты разработки.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что сторонние компоненты и все их транзитивные зависимости загружаются только из ожидаемых репозиториев (внутренних или внешних) и отсутствует риск атаки через подмену зависимостей (dependency confusion attack)", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что приложение реализует дополнительные меры защиты для тех частей приложения, которые документированы как содержащие «функционал с повышенным риском» или использующие сторонние библиотеки, считающиеся «функционалом с повышенным риском». Это могут быть такие методы, как «песочница», инкапсуляция, контейнеризация или изоляция на сетевом уровне, чтобы задержать и предотвратить продвижение (pivoting) злоумышленников, скомпрометировавших одну часть приложения, к другим частям приложения.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V15.3", + "Ordinal": 3, + "Name": "Безопасное программирование", + "Items": [ + { + "Shortcode": "V15.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение возвращает только необходимое подмножество полей из объекта данных. Например, оно не должно возвращать весь объект данных, поскольку некоторые отдельные поля должны быть недоступны пользователям.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что при вызовах внешних URL-адресов бэкэнд приложения настроен так, чтобы не выполнять перенаправления, если только это не предусмотрено функционалом.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что в приложении реализованы защитные механизмы против атак типа массового присвоения (mass assignment) путем строгого ограничения разрешенных полей для каждого контроллера и действия, исключая возможность добавления или изменения значений полей, которые не должны быть доступны для данной конкретной операции.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что все прокси и промежуточное ПО корректно передают исходный IP-адрес пользователя, используя доверенные поля данных, которые не могут быть изменены конечным пользователем, а приложение и веб-сервер используют это правильное значение для ведения логирования и принятия решений по безопасности, таких как ограничение запросов. При этом следует учитывать, что даже исходный IP-адрес может быть ненадежным из-за динамических IP-адресов, VPN или корпоративных файрволов.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.5", + "Ordinal": 5, + "Description": "Убедитесь, что приложение явно проверяет соответствие переменных ожидаемому типу данных и использует строгие операции сравнения. Это необходимо для предотвращения уязвимостей, связанных с type juggling и type confusion, вызванных тем, что код приложения делает предположения о типе переменной.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.6", + "Ordinal": 6, + "Description": "Убедитесь, что JavaScript-код написан таким образом, чтобы предотвратить prototype pollution, например, используя Set() или Map() вместо обычных литералов объекта.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.7", + "Ordinal": 7, + "Description": "Убедитесь, что приложение защищено от атак типа HTTP Parameter Pollution (HPP), особенно если используемый фреймворк не различает источники параметров запроса (строка запроса, тело запроса, куки или заголовки).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V15.4", + "Ordinal": 4, + "Name": "Безопасная работа с параллельными процессами", + "Items": [ + { + "Shortcode": "V15.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что к общим объектам в многопоточном коде (например, кэшам, файлам или объектам в памяти, используемым несколькими потоками) используется безопасный многопоточный доступ и механизмов синхронизации, таких как блокировки или семафоры, чтобы избежать состояний гонки и повреждения данных.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что проверки состояния ресурса, например его существования или разрешений, а также зависящие от него действия выполняются как одна атомарная операция, чтобы предотвратить условия гонки времени проверки и времени использования (TOCTOU). Например, проверка существования файла перед его открытием или проверка прав доступа пользователя перед его предоставлением.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что блокировки применяются согласованно, чтобы предотвратить взаимные блокировки потоков (deadlocks) или их бесконечные повторы, а также что логика блокировки инкапсулирована в коде, отвечающем за управление ресурсом. Это гарантирует, что блокировки не могут быть случайно или намеренно изменены внешними классами или кодом.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.4.4", + "Ordinal": 4, + "Description": "Убедитесь, что политики распределения ресурсов предотвращают нехватку ресурсов у потоков, обеспечивая справедливый доступ к ресурсам, например, используя пулы потоков, позволяя потокам с более низким приоритетом выполняться в течение разумного периода времени.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V16", + "Ordinal": 16, + "ShortName": "Security", + "Name": "Журналирование событий безопасности и обработка ошибок", + "Items": [ + { + "Shortcode": "V16.1", + "Ordinal": 1, + "Name": "Документация по ведению логов", + "Items": [ + { + "Shortcode": "V16.1.1", + "Ordinal": 1, + "Description": "Убедитесь в существовании реестра, в котором документируется ведение журнала на каждом уровне технологического стека приложения, включая какие события регистрируются, форматы логов, где хранятся эти журналы, как они используются, как контролируется доступ к ним и как долго хранятся журналы.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V16.2", + "Ordinal": 2, + "Name": "Общее журналирование", + "Items": [ + { + "Shortcode": "V16.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что каждая запись журнала содержит необходимые метаданные (например, когда, где, кто, что), которые позволят провести подробное исследование временной шкалы, когда произошло событие.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что все источники времени компонентов системы журналирования синхронизированы, а временные метки в метаданных событий безопасности используют UTC или содержат явное указание смещения часового пояса. Рекомендуется применять UTC для обеспечения согласованности в распределённых системах и предотвращения ошибок при переходе на летнее/зимнее время.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение записывает и передаёт логи исключительно в те файлы и сервисы, которые указаны в реестре журналирования.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что логи могут быть прочитаны и коррелированы используемой системой обработки журналов, предпочтительно с использованием общего стандартного формата логирования.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что приложение применяет соответствующие меры защиты при логировании конфиденциальных данных в зависимости от уровня их чувствительности: например, полностью запрещает запись в логи таких данных, как учетные данные или платежные реквизиты, а для других данных (например, сессионных токенов) использует хеширование или частичное/полное маскирование.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V16.3", + "Ordinal": 3, + "Name": "Инциденты безопасности", + "Items": [ + { + "Shortcode": "V16.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что все операции аутентификации регистрируются, включая успешные и неудачные попытки. Также следует фиксировать дополнительные метаданные, такие как тип аутентификации или использованные факторы проверки.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что ведется журнал неудачных попыток авторизации. Для уровня L3 это должно включать в себя журналирование всех решений об авторизации, включая журналирование доступа к конфиденциальным данным (без регистрации самих конфиденциальных данных).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение регистрирует все события безопасности, определенные в документации, а также фиксирует попытки обхода механизмов защиты, включая проверку входных данных, бизнес-логики и системы защиты от автоматизированных атак.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что приложение регистрирует в журналах неожиданные ошибки и сбои механизмов безопасности, включая, например, ошибки TLS-соединения на стороне сервера.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V16.4", + "Ordinal": 4, + "Name": "Защита журналов", + "Items": [ + { + "Shortcode": "V16.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что все компоненты системы логирования корректно кодируют данные, чтобы предотвратить атаки типа внедрения в журналы (log injection).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что логи защищены от неавторизованного доступа и не могут быть модифицированы.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что логи безопасно передаются в логически изолированную систему для анализа, обнаружения угроз, генерации оповещений и эскалации инцидентов. Это гарантирует сохранность журналов даже в случае компрометации основного приложения.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V16.5", + "Ordinal": 5, + "Name": "Обработка ошибок", + "Items": [ + { + "Shortcode": "V16.5.1", + "Ordinal": 1, + "Description": "Убедитесь, что при возникновении непредвиденной или связанной с безопасностью ошибки пользователю возвращается только общее сообщение, гарантируя отсутствие раскрытия конфиденциальных внутренних данных системы, таких как трассировки стека, запросы, секретные ключи и токены.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.5.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение продолжает работать в безопасном режиме при недоступности внешних ресурсов, используя такие механизмы, как автоматические выключатели (circuit breakers) или плавное снижение функциональности (graceful degradation).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.5.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение корректно и безопасно завершает работу при возникновении исключений, предотвращая опасные сценарии по типу «fail-open», когда, например, транзакция ошибочно выполняется, несмотря на ошибки в логике валидации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.5.4", + "Ordinal": 4, + "Description": "Убедитесь, что определён обработчик ошибок «крайние меры», который будет перехватывать все необработанные ошибки. Это необходимо как для предотвращения потери информации об ошибках, которая должна быть записана в файлы журналов, так и для того, чтобы ошибка не остановила весь процесс приложения, что привело бы к потере доступности.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V17", + "Ordinal": 17, + "ShortName": "WebRTC", + "Name": "WebRTC", + "Items": [ + { + "Shortcode": "V17.1", + "Ordinal": 1, + "Name": "TURN-сервер", + "Items": [ + { + "Shortcode": "V17.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что сервис TURN (Traversal Using Relays around NAT) разрешает доступ только к IP-адресам, не зарезервированным для специальных целей (например, внутренние сети, широковещательная рассылка, loopback-адреса). Данное требование применяется как к IPv4, так и к IPv6 адресам.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что сервис TURN (Traversal Using Relays around NAT) защищен от исчерпания ресурсов при попытках легитимных пользователей открыть чрезмерное количество портов на сервере.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V17.2", + "Ordinal": 2, + "Name": "Требования к медиасерверам", + "Items": [ + { + "Shortcode": "V17.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что ключ сертификата Datagram Transport Layer Security (DTLS) управляется и защищается в соответствии с документированной политикой управления криптографическими ключами.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что медиасервер настроен на использование только одобренных наборов шифров Datagram Transport Layer Security (DTLS) и защищенного профиля безопасности для расширения DTLS, применяемого при установке ключей для Secure Real-time Transport Protocol (DTLS-SRTP).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что медиасервер проверяет аутентификацию Secure Real-time Transport Protocol (SRTP) для предотвращения атак с внедрением Real-time Transport Protocol (RTP), которые могут привести к отказу в обслуживании (Denial of Service) или вставке поддельного аудио-/видеоконтента в медиапотоки.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика при получении некорректных пакетов Secure Real-time Transport Protocol (SRTP).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетами Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.6", + "Ordinal": 6, + "Description": "Убедитесь, что медиасервер не подвержен уязвимости «Гонка ClientHello» (ClientHello Race Condition) в Datagram Transport Layer Security (DTLS), проверив наличие известных уязвимостей в публичных источниках или выполнив тестирование на воспроизведение условий гонки.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.7", + "Ordinal": 7, + "Description": "Убедитесь, что механизмы аудио- и видеозаписи, связанные с медиасервером, способны продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетов Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.8", + "Ordinal": 8, + "Description": "Убедитесь, что сертификат Datagram Transport Layer Security (DTLS) проверяется на соответствие атрибуту отпечатка (fingerprint) в Session Description Protocol (SDP), с немедленным прекращением медиапотока в случае несоответствия — это гарантирует подлинность передаваемых данных.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V17.3", + "Ordinal": 3, + "Name": "Сигнализация", + "Items": [ + { + "Shortcode": "V17.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что сигнальный сервер способен продолжать обработку легитимных входящих сообщений сигнализации даже в условиях флуд-атаки. Для этого необходимо реализовать механизм ограничения частоты запросов (rate limiting) на уровне сигнализации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что сигнальный сервер способен продолжать обработку легитимных сообщений сигнализации даже при получении некорректных сообщений, которые могут вызвать отказ в обслуживании (Denial of Service, DoS). Для этого необходимо реализовать: проверку входных данных (input validation), безопасную обработку целочисленных переполнений (integer overflows), защиту от переполнения буферов (buffer overflows) и другие надежные методы обработки ошибок.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + } + ] +} diff --git a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.xml b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.xml new file mode 100644 index 0000000000..6141d39972 --- /dev/null +++ b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.xml @@ -0,0 +1 @@ +Application Security Verification Standard ProjectASVSThe OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.V11EncodingКодировка и нейтрализацияV1.11Архитектура кодировки и нейтрализацииV1.1.11Убедитесь, что входные данные декодируются или деэкранируются в каноническую форму (в стандартное представление) только один раз. Декодирование происходит только тогда, когда ожидаются закодированные данные в этой форме, и что это делается перед дальнейшей обработкой входных данных, например, это не выполняется после проверки или нейтрализации.FalseTrue✓True✓V1.1.22Убедитесь, что приложение выполняет кодирование и экранирование выходных данных либо в качестве последнего шага перед использованием интерпретатором, для которого оно предназначено, либо самим интерпретатором.FalseTrue✓True✓V1.22Предотвращение инъекцийV1.2.11Убедитесь, что выходная кодировка для ответа HTTP, документа HTML или документа XML соответствует требуемому контексту, например, кодировка соответствующих символов для элементов HTML, атрибутов HTML, комментариев HTML, CSS или полей заголовка HTTP делается таким способом, чтобы избежать изменения структуры сообщения или документа.True✓True✓True✓V1.2.22Убедитесь, что при динамическом построении URL-адресов недоверенные данные кодируются в соответствии с их контекстом (например, кодирование URL-адресов или кодирование base64url для query или path параметров или пути). Убедитесь, что разрешены только безопасные протоколы URL-адресов (например, запрещен javascript: или data:).True✓True✓True✓V1.2.33Убедитесь, что при динамическом построении содержимого JavaScript (включая JSON) используется кодирование или экранирование выходных данных, чтобы избежать изменения структуры сообщения или документа (чтобы избежать JavaScript и JSON-инъекций).True✓True✓True✓V1.2.44Убедитесь, что выборка данных (Redis, Memcached, чтение из файлов, обращение по API) или запросы к базе данных (например, SQL, HQL, NoSQL, Cypher) используют параметризованные запросы, ORM, Entity Frameworks или иным образом защищены от SQL-инъекций и других атак. Это также актуально при написании хранимых процедур.True✓True✓True✓V1.2.55Убедитесь, что приложение защищено от внедрения команд ОС и что вызовы операционной системы используют параметризованные запросы к ОС или используют контекстное кодирование вывода командной строки.True✓True✓True✓V1.2.66Убедитесь, что приложение защищено от LDAP-инъекций, или что реализованы специальные меры безопасности для их предотвращения.FalseTrue✓True✓V1.2.77Убедитесь, что приложение защищено от атак с использованием XPath-инъекций с помощью параметризации запросов или предварительно скомпилированных запросов.FalseTrue✓True✓V1.2.88Убедитесь, что процессоры LaTeX настроены безопасно (например, не используется флаг «–shell‑escape») и используется разрешенный список команд для предотвращения LaTeX-инъекций.FalseTrue✓True✓V1.2.99Убедитесь, что приложение экранирует специальные символы в регулярных выражениях (обычно с помощью обратной косой черты), чтобы предотвратить их ошибочную интерпретацию как метасимволов.FalseTrue✓True✓V1.2.1010Убедитесь, что приложение защищено от внедрения формул CSV (CSV Injection). Приложение должно следовать правилам экранирования, определенным в RFC 4180, разделы 2.6 и 2.7, при экспорте содержимого CSV. Кроме того, при экспорте в CSV или другие форматы электронных таблиц (такие как XLS, XLSX или ODF) специальные символы (включая '=', '+', '-', '@', '\t' (табуляция), и '\0' (нулевой символ)) должны экранироваться одинарной кавычкой, если они появляются в качестве первого символа в значении поля.FalseFalseTrue✓V1.33НейтрализацияV1.3.11Убедитесь, что все ненадежные входные данные HTML из редакторов WYSIWYG или аналогичных программ нейтрализуются с помощью известных и безопасных библиотек или функций фреймворка для санитизации HTML.True✓True✓True✓V1.3.22Убедитесь, что приложение избегает использования eval() или других динамических функций выполнения кода, таких как Spring Expression Language (SpEL). Если нет альтернативы, любой пользовательский ввод должен быть нейтрализован перед выполнением.True✓True✓True✓V1.3.33Убедитесь, что данные, передаваемые в потенциально опасный контекст, предварительно нейтрализованы, чтобы обеспечить соблюдение мер безопасности, таких как разрешение только тех символов, которые безопасны для данного контекста, и обрезка слишком длинного ввода.FalseTrue✓True✓V1.3.44Убедитесь, что предоставленный пользователем файл .SVG проверен или нейтрализован, чтобы он содержал только теги и атрибуты (например, относящиеся к рисованию), которые безопасны для приложения, например, не содержат скриптов и foreignObject.FalseTrue✓True✓V1.3.55Убедитесь, что приложение нейтралует или отключает предоставленные пользователем скриптовые данные или выражения шаблонных языков, такие как таблицы стилей Markdown, CSS или XSL, BBCode или аналогичные.FalseTrue✓True✓V1.3.66Убедитесь, что приложение защищено от атак с подделкой запросов на стороне сервера (SSRF), проверяя ненадежные данные по разрешенному списку протоколов, доменов, путей и портов, а также нейтрализуя потенциально опасные символы перед использованием данных для вызова другой службы.FalseTrue✓True✓V1.3.77Убедитесь, что приложение защищено от атак с внедрением шаблонов (template injection), не позволяя создавать шаблоны на основе недоверенных входных данных. Если нет альтернативы, любые недоверенные входные данные, включаемые динамически во время создания шаблона, должны быть нейтрализованы или тщательно провалидированы.FalseTrue✓True✓V1.3.88Убедитесь, что приложение надлежащим образом нейтрализует недоверенные входные данные перед использованием в запросах Java Naming and Directory Interface (JNDI) и что JNDI настроен безопасно для предотвращения атак с использованием JNDI-инъекций.FalseTrue✓True✓V1.3.99Убедитесь, что приложение нейтрализует данные перед отправкой в Memcache, чтобы предотвратить атаки методом инъекций.FalseTrue✓True✓V1.3.1010Убедитесь, что строки форматирования, которые могут быть использованы неожидаемым или вредоносным образом, нейтрализуются перед дальнейшим использованием.FalseTrue✓True✓V1.3.1111Убедитесь, что приложение нейтрализует вводимые пользователем данные перед передачей в почтовые системы для защиты от SMTP или IMAP-инъекций.FalseTrue✓True✓V1.3.1212Убедитесь, что регулярные выражения не содержат элементов, вызывающих экспоненциальный возврат, и убедитесь в нейтрализации недоверенных входных данных для предотвращения атак ReDoS или Runaway Regex.FalseFalseTrue✓V1.44Память, строки и неуправляемый кодV1.4.11Убедитесь, что для обнаружения или предотвращения ситуаций переполнения стека, буфера или кучи приложение учитывает размер доступной области памяти при строковых операциях, копировании в память, в арифметике указателей и т.п.FalseTrue✓True✓V1.4.22Убедитесь, что для предотвращения целочисленного переполнения применяется контроль знака, диапазона и типа допустимых входных данных.FalseTrue✓True✓V1.4.33Убедитесь, что динамически выделенная память и ресурсы освобождены, а ссылки или указатели на освобожденную память удалены или установлены в значение null, чтобы предотвратить появление висячих указателей и уязвимостей, связанных с использованием памяти после освобождения.FalseTrue✓True✓V1.55Безопасная десериализацияV1.5.11Убедитесь, что приложение настраивает XML-парсеры на использование строгой конфигурации и что небезопасные функции, такие как разрешение внешних сущностей, отключены для предотвращения атак XML eXternal Entity (XXE).True✓True✓True✓V1.5.22Убедитесь, что десериализация недоверенных данных обеспечивает безопасную обработку ввода, например, используя список разрешенных типов объектов или ограничивая типы объектов, определяемые клиентом, для предотвращения атак десериализации. Механизмы десериализации, которые явно определены как небезопасные, не должны использоваться с недоверенным вводом.FalseTrue✓True✓V1.5.33Убедитесь, что различные парсеры, используемые в приложении для одного и того же типа данных (например, парсеры JSON, XML, URL), выполняют парсинг согласованным образом и используют один и тот же механизм кодирования символов, чтобы избежать таких проблем, как уязвимости взаимодействия JSON (JSON Interoperability) или различное поведение анализа URI или файлов, которые могут использоваться в атаках удаленного включения файлов (RFI) или подделки запросов на стороне сервера (SSRF).FalseFalseTrue✓V22ValidationВалидация и бизнес-логикаV2.11Документация валидации и бизнес-логикиV2.1.11Убедитесь, что в документации приложения определены правила проверки входных данных на соответствие ожидаемой структуре. Это могут быть распространённые форматы данных, такие как номера кредитных карт, адреса электронной почты, номера телефонов, или внутренний формат данных.True✓True✓True✓V2.1.22Убедитесь, что в документации приложения указано, как проверять логическую и контекстную согласованность объединенных данных, например, проверять соответствие района и почтового индекса.FalseTrue✓True✓V2.1.33Убедитесь, что ожидания относительно ограничений и проверок бизнес-логики задокументированы как для уровня отдельного пользователя, так и для глобального уровня всего приложения.FalseTrue✓True✓V2.22Валидация вводаV2.2.11Убедитесь, что входные данные провалидированы для обеспечения соответствия бизнес- или функциональным ожиданиям. Валидация должна осуществляться либо по списку допустимых значений, шаблонов и диапазонов, либо путем сравнения входных данных с ожидаемой структурой и логическими ограничениями в соответствии с предопределенными правилами. Для L1 валидация может быть сосредоточена на входных данных, используемых для принятия конкретных бизнес-решений или решений, связанных с безопасностью. Для L2 и выше это должно применяться ко всем входным данным.True✓True✓True✓V2.2.22Убедитесь, что приложение разработано с принудительной валидацией входных данных на уровне доверенного сервиса. Хотя проверка на стороне клиента повышает удобство использования и должна поощряться, на неё не следует полагаться как на средство контроля безопасности.True✓True✓True✓V2.2.33Убедитесь, что приложение обеспечивает обоснованность комбинаций данных в соответствии с предопределенными правилам. Например: возраст должен соответствовать дате рождения; страна и почтовый индекс; количество товара в заказе и на складе.FalseTrue✓True✓V2.33Безопасность бизнес-логикиV2.3.11Убедитесь, что приложение обрабатывает потоки бизнес-логики для одного и того же пользователя в ожидаемом последовательном порядке шагов и без пропуска шагов.True✓True✓True✓V2.3.22Убедитесь, что ограничения бизнес-логики реализованы в соответствии с документацией приложения, чтобы избежать эксплуатации её недостатков.FalseTrue✓True✓V2.3.33Убедитесь, что транзакции используются на уровне бизнес-логики таким образом, что операция бизнес-логики либо выполняется полностью, либо откатывается к предыдущему корректному состоянию.FalseTrue✓True✓V2.3.44Убедитесь, что на уровне бизнес-логики используются механизмы блокировки, чтобы гарантировать невозможность двойного бронирования ограниченных по количеству ресурсов (например, мест в театре или слотов доставки) путем манипулирования логикой приложения.FalseTrue✓True✓V2.3.55Убедитесь, что для важных потоков бизнес-логики требуется многопользовательское (multi-user) одобрение, чтобы предотвратить несанкционированные или случайные действия. Потоки бизнес-логики могут включать, помимо прочего, крупные денежные переводы, утверждение контрактов, доступ к секретной информации или обход ограничений безопасности на производстве.FalseFalseTrue✓V2.44Анти-автоматизацияV2.4.11Убедитесь, что используются средства противодействия автоматизации для защиты от чрезмерных вызовов функций приложения, которые могут привести к утечке данных, созданию ненужных данных, исчерпанию квот, нарушению ограничений скорости, отказу в обслуживании или чрезмерному использованию дорогостоящих ресурсов.FalseTrue✓True✓V2.4.22Убедитесь, что потоки бизнес-логики требуют реалистичного человеческого времени, предотвращая чрезмерно быструю отправку транзакций.FalseFalseTrue✓V33WebБезопасность веб-интерфейсаV3.11Документация по безопасности веб-интерфейсаV3.1.11Убедитесь, что в документации приложения описаны ожидаемые функции безопасности, которые должны поддерживать браузеры, использующие приложение (такие как HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) и другие соответствующие механизмы безопасности HTTP). В документации также должно быть обязательно определено, как приложение должно себя вести, если некоторые из этих функций недоступны (например, предупреждать пользователя или блокировать доступ).FalseFalseTrue✓V3.22Непреднамеренная интерпретация контентаV3.2.11Убедитесь, что реализованы меры безопасности, предотвращающие отображение контента или функций браузерами в HTTP-ответах в некорректном контексте (например, запрос API, загруженный пользователем файл или другой ресурс запрашивается напрямую). Возможные способы контроля включают: не обрабатывать содержимое, если поля заголовка HTTP-запроса (например, Sec-Fetch-*) не указывают на корректность контекста; использование заголовка и значения Content-Security-Policy: sandbox directive; или использование заголовка и значения Content-Disposition: attachment.True✓True✓True✓V3.2.22Убедитесь, что данные, предназначенные для отображения в виде текста, а не визуализации в виде HTML, обрабатывается с использованием безопасных функций визуализации (таких как createTextNode или textContent), чтобы предотвратить непреднамеренное выполнение содержимого, такого как HTML или JavaScript.True✓True✓True✓V3.2.33Убедитесь, что приложение избегает затирания DOM при использовании JavaScript на стороне клиента, применяя явные объявления переменных, выполняя строгую проверку типов, избегая сохранения глобальных переменных в объекте документа и реализуя изоляцию пространства имен.FalseFalseTrue✓V3.33Настройка файлов cookieV3.3.11Убедитесь, что у файлов cookie установлен атрибут «Secure», и если префикс «__Host‑» не используется в названии cookie, необходимо использовать префикс «__Secure‑».True✓True✓True✓V3.3.22Убедитесь, что значение атрибута SameSite каждой cookie установлено в соответствии с назначением cookie, чтобы ограничить подверженность атакам на восстановление пользовательского интерфейса и атакам с подделкой запросов на уровне браузера, обычно называемым подделкой межсайтовых запросов (CSRF).FalseTrue✓True✓V3.3.33Убедитесь, что cookie имеют префикс «__Host‑» в названии, если только они явно не предназначены для совместного использования с другими хостами.FalseTrue✓True✓V3.3.44Убедитесь, что если значение cookie не должно быть доступно для клиентских скриптов (например, сессионный токен), для cookie должен быть установлен атрибут «HttpOnly», а само значение должно передаваться клиенту только через поле заголовка «Set-Cookie».FalseTrue✓True✓V3.3.55Убедитесь, что при записи cookie приложением общая длина имени и значения cookie не превышает 4096 байт. Слишком большие cookie не будут сохраняться браузером и, следовательно, не будут отправляться с запросами, что помешает пользователю использовать функции приложения, зависящие от этого cookie.FalseFalseTrue✓V3.44Заголовки механизма безопасности браузераV3.4.11Убедитесь, что поле заголовка Strict‑Transport‑Security включено во все ответы для реализации политики HTTP Strict Transport Security (HSTS). Необходимо указать максимальное время не менее 1 года, а для L2 и выше политика должна применяться также ко всем поддоменам.True✓True✓True✓V3.4.22Убедитесь, что поле заголовка Cross‑Origin Resource Sharing (CORS) «Access‑Control‑Allow‑Origin» имеет фиксированное значение, заданное приложением, или, если используется заголовок Origin, оно проверяется по списку доверенных источников. При необходимости использования «Access‑Control‑Allow‑Origin: *» убедитесь, что ответ не содержит конфиденциальной информации.True✓True✓True✓V3.4.33Убедитесь, что HTTP-ответы содержат поле заголовка Content-Security-Policy, которое определяет директивы, гарантирующие загрузку и выполнение браузером только доверенного контента или ресурсов, чтобы ограничить выполнение вредоносного JavaScript. Как минимум, необходимо использовать глобальную политику, включающую директивы object-src «none» и base-uri «none», а также определяющую список разрешенных адресов или использующую одноразовые коды или хэши. Для приложений L3 необходимо определить политику использования 'nonce' или hash-конструкций для каждого ответа.FalseTrue✓True✓V3.4.44Убедитесь, что все HTTP-ответы содержат поле заголовка «X‑Content‑Type‑Options: nosniff». Это предписывает браузерам не использовать анализ контента и определение типа MIME для данного ответа, а также требовать, чтобы значение поля заголовка Content‑Type в ответе соответствовало целевому ресурсу. Например, ответ на запрос стиля принимается только в том случае, если Content‑Type в ответе — «text/css». Это также позволяет браузеру использовать функцию Cross‑Origin Read Blocking (CORB).FalseTrue✓True✓V3.4.55Убедитесь, что приложение устанавливает политику реферера для предотвращения утечки технически конфиденциальных данных сторонним сервисам через поле заголовка HTTP-запроса «Referer». Это можно сделать с помощью поля заголовка HTTP-ответа «Referrer‑Policy» или через атрибуты HTML-элемента. Конфиденциальные данные могут включать путь и данные запроса в URL-адресе, а для внутренних непубличных приложений также имя хоста.FalseTrue✓True✓V3.4.66Убедитесь, что веб-приложение использует директиву frame‑ancestors поля заголовка Content‑Security‑Policy для каждого HTTP-ответа, чтобы гарантировать невозможность его внедрения по умолчанию и внедрение определённых ресурсов разрешено только при необходимости. Обратите внимание, что поле заголовка X‑Frame‑Options, хотя и поддерживается браузерами, устарело и не может быть использовано в качестве основы.FalseTrue✓True✓V3.4.77Убедитесь, что в поле заголовка Content‑Security‑Policy указано место, куда следует сообщать о нарушениях.FalseFalseTrue✓V3.4.88Убедитесь, что все HTTP-ответы, инициирующие рендеринг документа (например, ответы с типом содержимого text/html), включают поле заголовка Cross-Origin-Opener-Policy с директивой same-origin или same-origin-allow-popups (при необходимости). Это предотвращает атаки, злоупотребляющие общим доступом к объектам Window, такие как Tabnabbing и Frame Counting.FalseFalseTrue✓V3.55Браузерное разделение источниковV3.5.11Убедитесь, что, если приложение не использует механизм предварительной проверки CORS для предотвращения запрещённых кросс-доменных запросов на использование чувствительного функционала, эти запросы валидируются на предмет их происхождения от самого приложения. Это можно сделать, используя и проверяя специальные токены для защиты от подделки или требуя дополнительные поля HTTP-заголовка, не входящие в список «простых заголовков» (CORS-safelisted request-header). Это необходимо для защиты от атак с подделкой запросов через браузер, широко известных как межсайтовая подделка запросов (CSRF).True✓True✓True✓V3.5.22Убедитесь, что если приложение использует механизм предварительной проверки CORS для предотвращения неразрешённого использования чувствительного функционала между источниками, вызов этого функционала невозможен с помощью запроса, который не запускает предварительную проверку CORS. Для этого может потребоваться проверка значений полей заголовка запроса «Origin» и «Content-Type» или использование дополнительного поля заголовка, не входящего в безопасный список CORS.True✓True✓True✓V3.5.33Убедитесь, что HTTP-запросы к чувствительному функционалу используют соответствующие HTTP-методы, такие как POST, PUT, PATCH или DELETE, а не методы, определённые спецификацией HTTP как «безопасные», такие как HEAD, OPTIONS или GET. В качестве альтернативы можно использовать строгую валидацию полей заголовка запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, навигационного запроса или загрузки ресурса (например, источника изображения), где это не ожидается.True✓True✓True✓V3.5.44Убедитесь, что отдельные приложения размещены на разных именах хостов, чтобы использовать ограничения, предусмотренные политикой same-origin, включая то, как документы или скрипты, загруженные одним источником, могут взаимодействовать с ресурсами из другого источника, а также ограничения на cookie на основе имени хоста.FalseTrue✓True✓V3.5.55Убедитесь, что сообщения, полученные интерфейсом postMessage, отвергаются, если источник сообщения не является доверенным или если синтаксис сообщения недействителен.FalseTrue✓True✓V3.5.66Убедитесь, что функциональность JSONP не включена нигде в приложении, чтобы избежать атак с использованием межсайтового включения скриптов (XSSI).FalseFalseTrue✓V3.5.77Убедитесь, что данные, требующие авторизации, не включены в ответы ресурсов скриптов, таких как файлы JavaScript, чтобы предотвратить атаки с использованием межсайтового включения скриптов (XSSI).FalseFalseTrue✓V3.5.88Убедитесь, что аутентифицированные ресурсы (такие как изображения, видео, скрипты и другие документы) могут быть загружены или внедрены от имени пользователя только по назначению. Этого можно добиться путём строгой валидации полей заголовка HTTP-запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, или путём установки ограничительного поля заголовка HTTP-ответа Cross‑Origin‑Resource‑Policy, чтобы браузер блокировал возвращаемый контент.FalseFalseTrue✓V3.66Целостность внешних ресурсовV3.6.11Убедитесь, что клиентские ресурсы, такие как библиотеки JavaScript, CSS или веб-шрифты, размещаются только на внешнем сервере (например, в сети доставки контента (Content Delivery Network)), если ресурс статический и имеет версии, а для проверки целостности ресурса используется механизм проверки целостности подресурсов (SRI). Если это невозможно, для каждого ресурса должно быть задокументировано решение по безопасности, обосновывающее это.FalseFalseTrue✓V3.77Другие соображения по безопасности браузераV3.7.11Убедитесь, что приложение использует только те клиентские технологии, которые по-прежнему поддерживаются и считаются безопасными. Примерами технологий, не соответствующих этому требованию, являются плагины NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL или клиентские Java-апплеты.FalseTrue✓True✓V3.7.22Убедитесь, что приложение будет автоматически перенаправлять пользователя на другое имя хоста или домен (который не контролируется приложением), только если этот хост или домен указаны в списке разрешенных.FalseTrue✓True✓V3.7.33Убедитесь, что приложение отображает уведомление, что пользователь перенаправляется на URL-адрес, находящийся вне контроля приложения, с возможностью отмены навигации.FalseFalseTrue✓V3.7.44Убедитесь, что домен верхнего уровня приложения (например, site.tld) ​​добавлен в публичный список предварительной загрузки (preload list) для HTTP Strict Transport Security (HSTS). Это гарантирует, что использование TLS для приложения будет встроено непосредственно в основные браузеры, а не будет полагаться только на поле заголовка ответа Strict-Transport-Security.FalseFalseTrue✓V3.7.55Убедитесь, что приложение ведет себя так, как описано в документации (например, предупреждает пользователя или блокирует доступ), если браузер, используемый для доступа к приложению, не поддерживает ожидаемые функции безопасности.FalseFalseTrue✓V44APIAPI и Веб-сервисV4.11Общая безопасность веб-сервисовV4.1.11Убедитесь, что каждый HTTP-ответ с телом сообщения содержит заголовок Content-Type, который соответствует фактическому содержимому ответа, таким как «text/», «/+xml» и «/xml», включая параметр charset для указания безопасной кодировки символов (например, UTF-8, ISO-8859-1) согласно IANA Media Types.True✓True✓True✓V4.1.22Убедитесь, что только конечные точки, предназначенные для взаимодействия с пользователем через веб-браузер, автоматически перенаправляют HTTP на HTTPS, в то время как другие сервисы или конечные точки не реализуют прозрачные редиректы. Это необходимо, чтобы избежать ситуации, когда клиент ошибочно отправляет незашифрованные HTTP-запросы а из-за того, что запрос по HTTP автоматически перенаправляется на HTTPS другим сервисом без обработки на входе, утечка чувствительных данных остаётся незамеченной.FalseTrue✓True✓V4.1.33Убедитесь, что любой HTTP-заголовок, используемый приложением и устанавливаемый промежуточным уровнем, таким как балансировщик нагрузки, веб-прокси или backend-for-frontend сервис, не может быть переопределён конечным пользователем. Примеры заголовков: X-Real-IP, X-Forwarded-*, X-User-ID.FalseTrue✓True✓V4.1.44Убедитесь, что разрешены только HTTP-методы, которые явно поддерживаются приложением или его API (включая OPTIONS для preflight-запросов), а неиспользуемые методы заблокированы.FalseFalseTrue✓V4.1.55Убедитесь, что для особо чувствительных запросов или транзакций, проходящих через несколько систем, используются цифровые подписи на уровне сообщений, дополнительно к транспортным средствам защиты.FalseFalseTrue✓V4.22Валидация структуры HTTP-сообщенийV4.2.11Убедитесь, что все компоненты приложения (включая балансировщики нагрузки, файрволы и серверы приложений) определяют границы входящих HTTP-сообщений с использованием механизма, соответствующего версии HTTP, чтобы предотвратить HTTP request smuggling. В HTTP/1.x, если присутствует заголовок Transfer-Encoding, заголовок Content-Length должен игнорироваться согласно RFC 2616. При использовании HTTP/2 или HTTP/3, если присутствует Content-Length, веб-сервер должен убедиться, что он совпадает с длиной DATA-фреймов.FalseTrue✓True✓V4.2.22Убедитесь, что при генерации HTTP-сообщений заголовок Content-Length не конфликтует с длиной содержимого, определяемой рамками протокола HTTP, чтобы предотвратить HTTP Request Smuggling.FalseFalseTrue✓V4.2.33Убедитесь, что приложение не отправляет и не принимает HTTP/2 и HTTP/3 сообщения с заголовками, специфичными для соединения, такими как Transfer-Encoding, чтобы предотвратить HTTP Response Splitting и HTTP Header Injection.FalseFalseTrue✓V4.2.44Убедитесь, что приложение принимает HTTP/2 и HTTP/3 запросы только в случае, если поля заголовков и их значения не содержат последовательностей CR (\r), LF (\n) или CRLF (\r\n), чтобы предотвратить HTTP Header Injection.FalseFalseTrue✓V4.2.55Убедитесь, что если приложение (бекенд или фронтенд) формирует и отправляет запросы, оно использует валидацию, очистку или другие механизмы, чтобы не создавать URI (например, для API-вызовов) или HTTP-заголовки (например, Authorization или Cookie) слишком большой длины, чтобы их не принимал приёмник. Это может привести к отказу в обслуживании, например, при отправке слишком длинного запроса (длинный cookie-заголовок), из-за чего сервер постоянно возвращает ошибку.FalseFalseTrue✓V4.33GraphQLV4.3.11Убедитесь, что используется белый список запросов, ограничение глубины вложенности, ограничение количества или анализ стоимости запроса, чтобы предотвратить DoS-атаки на уровне GraphQL или слоя данных из-за дорогостоящих вложенных запросов.FalseTrue✓True✓V4.3.22Убедитесь, что introspection-запросы GraphQL отключены в продакшен-среде, если GraphQL API не предназначен для использования сторонними клиентами.FalseTrue✓True✓V4.44WebSocketV4.4.11Убедитесь, что для всех WebSocket-соединений используется WebSocket поверх TLS (WSS).True✓True✓True✓V4.4.22Убедитесь, что при первоначальном HTTP WebSocket handshake заголовок Origin проверяется на соответствие списку разрешённых источников для приложения.FalseTrue✓True✓V4.4.33Убедитесь, что если стандартное управление сессиями приложения не может быть использовано, применяются специальные токены, соответствующие требованиям безопасности управления сессиями.FalseTrue✓True✓V4.4.44Убедитесь, что специальные токены управления сессиями WebSocket изначально получаются или валидируются через ранее аутентифицированную HTTPS-сессию при переходе от HTTPS к WebSocket.FalseTrue✓True✓V55FileРабота с файламиV5.11Документация по работе с файламиV5.1.11Убедитесь, что документация определяет допустимые типы файлов, ожидаемые расширения и максимальный размер (включая распакованный размер) для каждой функции загрузки. Также убедитесь, что в документации указано, как файлы обезвреживаются для конечных пользователей (например, как приложение ведёт себя при обнаружении вредоносного файла).FalseTrue✓True✓V5.22Загрузка файлов и содержимоеV5.2.11Убедитесь, что приложение принимает только те файлы, которые может обработать без потери производительности или отказа в обслуживании.True✓True✓True✓V5.2.22Убедитесь, что при загрузке файла (включая файлы внутри архивов, таких как ZIP) приложение проверяет, соответствует ли расширение ожидаемому, и валидирует, соответствует ли содержимое типу, указанному в расширении. Это включает проверку начальных 'magic bytes', перезапись изображений, использование специализированных библиотек. Для уровня 1 — достаточно проверок для файлов, критичных с точки зрения бизнеса или безопасности. Для уровней 2 и выше — для всех файлов.True✓True✓True✓V5.2.33Убедитесь, что приложение проверяет архивы (например, zip, gz, docx, odt) на максимально допустимый распакованный размер и максимальное количество файлов до распаковки.FalseTrue✓True✓V5.2.44Убедитесь, что для каждого пользователя установлены квоты на общий размер и количество файлов, чтобы один пользователь не мог переполнить хранилище.FalseFalseTrue✓V5.2.55Убедитесь, что приложение не позволяет загружать архивы с символьными ссылками (symlinks), если это не требуется по бизнес-логике. Если требуется — разрешён только строго определённый список допустимых символьных ссылок.FalseFalseTrue✓V5.2.66Убедитесь, что приложение отклоняет изображения с числом пикселей выше допустимого, чтобы предотвратить атаки 'pixel flood'.FalseFalseTrue✓V5.33Хранение файловV5.3.11Убедитесь, что загруженные или сгенерированные из недоверенного ввода файлы, находящиеся в публичной директории, не исполняются как серверный код при обращении к ним по HTTP.True✓True✓True✓V5.3.22Убедитесь, что при создании путей к файлам приложение использует внутренние или доверенные данные, а не пользовательские имена файлов. Если использование пользовательских имён или метаданных необходимо — требуется строгая проверка и очистка. Это защита от path traversal, LFI, RFI и SSRF.True✓True✓True✓V5.3.33Убедитесь, что при обработке файлов на сервере (например, при распаковке) игнорируются пути, заданные пользователем, во избежание уязвимостей типа 'zip slip'.FalseFalseTrue✓V5.44Скачивание файловV5.4.11Убедитесь, что приложение валидирует или игнорирует имена файлов, переданных пользователем (включая в JSON, JSONP или URL-параметре), и указывает имя файла в заголовке Content-Disposition при ответе.FalseTrue✓True✓V5.4.22Убедитесь, что имена файлов, передаваемые (например, в HTTP-заголовках или вложениях в email), кодируются или очищаются (например, по RFC 6266), чтобы сохранить структуру документа и предотвратить инъекции.FalseTrue✓True✓V5.4.33Убедитесь, что файлы, полученные из недоверенных источников, сканируются антивирусом, чтобы не распространять известное вредоносное содержимое.FalseTrue✓True✓V66AuthenticationАутентификацияV6.11Документация по аутентификацииV6.1.11Убедитесь, что в документации приложения описано, как используются механизмы, такие как ограничение частоты запросов (rate limiting), защита от автоматизации и адаптивные реакции, для защиты от атак, таких как подстановка учётных данных и перебор паролей. Документация должна ясно описывать конфигурацию этих механизмов и предотвращение злонамеренной блокировки аккаунтов.True✓True✓True✓V6.1.22Убедитесь, что задокументирован список контекстно-зависимых слов, запрещённых к использованию в паролях. В него могут входить производные от названий организаций, продуктов, идентификаторов систем, кодовых названий проектов, названий отделов или ролей и тому подобное.FalseTrue✓True✓V6.1.33Убедитесь, что если приложение поддерживает несколько способов аутентификации, то все они документированы вместе с описанием применяемых средств защиты и уровнем стойкости аутентификации, которые должны быть одинаково применены ко всем способам.FalseTrue✓True✓V6.22Безопасность паролейV6.2.11Убедитесь, что пользовательские пароли содержат не менее 8 символов. Рекомендуется минимальная длина в 15 символов.True✓True✓True✓V6.2.22Убедитесь, что пользователи могут менять свои пароли.True✓True✓True✓V6.2.33Убедитесь, что для смены пароля требуется ввести как текущий, так и новый пароль.True✓True✓True✓V6.2.44Убедитесь, что при регистрации или смене пароля введённый пароль проверяется по списку как минимум из 3000 самых популярных паролей, соответствующих политике (например, минимальной длине).True✓True✓True✓V6.2.55Убедитесь, что допускаются пароли любой структуры, без ограничений на использование определённых символов. Не должно быть требований по обязательному наличию заглавных/строчных букв, цифр или специальных символов.True✓True✓True✓V6.2.66Убедитесь, что поля ввода пароля используют type=password для скрытия символов. Разрешено временное отображение всего пароля или последнего введённого символа.True✓True✓True✓V6.2.77Убедитесь, что разрешены вставка (paste), использование менеджеров паролей браузера и внешних менеджеров паролей.True✓True✓True✓V6.2.88Убедитесь, что пароль проверяется строго в том виде, в котором он был введён пользователем — без обрезки, изменения регистра и других модификаций.True✓True✓True✓V6.2.99Убедитесь, что система позволяет использовать пароли длиной не менее 64 символов.FalseTrue✓True✓V6.2.1010Убедитесь, что пароль остаётся действительным, пока не будет скомпрометирован или не будет изменён пользователем. Приложение не должно требовать регулярной смены пароля.FalseTrue✓True✓V6.2.1111Убедитесь, что используется документированный список контекстно-зависимых слов (например, названия компаний, проектов и т.д.) для предотвращения использования легко угадываемых паролей.FalseTrue✓True✓V6.2.1212Убедитесь, что при регистрации или смене пароля проверяется, не входит ли он в список скомпрометированных (утёкших) паролей.FalseTrue✓True✓V6.33Общие требования к безопасности аутентификацииV6.3.11Убедитесь, что реализованы меры защиты от атак типа credential stuffing (массовая подстановка учётных данных) и brute-force (перебор паролей), согласно документации по безопасности приложения.True✓True✓True✓V6.3.22Убедитесь, что в приложении отсутствуют или отключены учётные записи по умолчанию (например, root, admin, sa).True✓True✓True✓V6.3.33Убедитесь, что для доступа к приложению используется либо механизм многофакторной аутентификации, либо комбинация однофакторных. Для уровня L3 один из факторов должен быть аппаратным, обеспечивающим защиту от фишинга, устойчивость к компрометации и подтверждение намерения аутентификации через явное действие пользователя (например, нажатие кнопки на FIDO-ключе или телефоне). Ослабление этих требований допускается только при наличии обоснования и компенсирующих мер.FalseTrue✓True✓V6.3.44Убедитесь, что при наличии нескольких способов аутентификации, они все задокументированы, и для них единообразно применяются меры защиты и уровни доверия.FalseTrue✓True✓V6.3.55Убедитесь, что пользователи получают уведомления о подозрительных попытках аутентификации (удачных и неудачных). Это может включать попытки (например, подключения) с необычного устройства или места, частично успешную MFA, попытку после долгого отсутствия или успешную аутентификацию после серии неудачных.FalseFalseTrue✓V6.3.66Убедитесь, что email не используется ни как однофакторный, ни как многофакторный механизм аутентификации.FalseFalseTrue✓V6.3.77Убедитесь, что пользователи получают уведомление при изменении данных аутентификации, таких как сброс пароля или изменение логина/email.FalseFalseTrue✓V6.3.88Убедитесь, что из сообщений об ошибке, HTTP-кодов ответа или различий во времени ответа нельзя определить, существует ли пользователь с таким логином. Это правило также должно применяться к функциям регистрации и восстановления пароля.FalseFalseTrue✓V6.44Жизненный цикл и восстановление факторов аутентификацииV6.4.11Убедитесь, что начальные пароли или коды активации, генерируемые системой, создаются с использованием надёжного генератора случайных чисел, соответствуют текущей политике паролей и истекают через короткий период времени либо после первого использования. Эти секреты не должны использоваться как постоянные пароли.True✓True✓True✓V6.4.22Убедитесь, что в системе отсутствуют подсказки к паролю или вопросы на знание («секретные вопросы»).True✓True✓True✓V6.4.33Убедитесь, что реализован безопасный процесс сброса забытого пароля, который не обходит активные механизмы многофакторной аутентификации.FalseTrue✓True✓V6.4.44Убедитесь, что в случае утраты одного из факторов MFA проводится удостоверение личности (identity proofing) на том же уровне, что и при первичной регистрации.FalseTrue✓True✓V6.4.55Убедитесь, что инструкции по обновлению истекающих механизмов аутентификации отправляются заранее, с достаточным запасом времени для выполнения замены, при необходимости с настройкой автоматических напоминаний.FalseFalseTrue✓V6.4.66Убедитесь, что администраторы могут инициировать процесс сброса пароля, но не могут задать или выбрать новый пароль за пользователя. Это исключает ситуацию, при которой администратор знает пароль пользователя.FalseFalseTrue✓V6.55Общие требования к многофакторной аутентификацииV6.5.11Убедитесь, что lookup-секреты, внеполосные коды/запросы и TOTP-коды можно использовать только один раз.FalseTrue✓True✓V6.5.22Убедитесь, что при хранении lookup-секретов с энтропией менее 112 бит (например, 19 случайных буквенно-цифровых символов или 34 случайные цифры) они хэшируются с использованием разрешённого алгоритма хеширования паролей и случайной соли минимум 32 бита. Если у секрета ≥112 бит энтропии — допустимо использовать стандартный хэш.FalseTrue✓True✓V6.5.33Убедитесь, что lookup-секреты, коды внеполосной аутентификации и сиды для TOTP генерируются с использованием криптографически стойкого генератора случайных чисел (CSPRNG), чтобы избежать предсказуемых значений.FalseTrue✓True✓V6.5.44Убедитесь, что lookup-секреты и внеполосные коды аутентификации имеют минимум 20 бит энтропии (достаточно, например, 4 случайных алфавитно-цифровых символов или 6 случайных цифр).FalseTrue✓True✓V6.5.55Убедитесь, что все внеполосные запросы, коды и токены, а также TOTP-коды имеют ограниченный срок действия. Максимум для out-of-band — 10 минут, для TOTP — 30 секунд.FalseTrue✓True✓V6.5.66Убедитесь, что любой фактор аутентификации (включая физические устройства) может быть отозван в случае кражи или утери.FalseFalseTrue✓V6.5.77Убедитесь, что биометрические механизмы аутентификации используются только как вторичный фактор — в сочетании с «чем-то, что вы знаете» или «чем-то, что у вас есть».FalseFalseTrue✓V6.5.88Убедитесь, что TOTP-коды проверяются по источнику времени, полученному от доверенного сервиса, а не от клиента или недоверенного источника.FalseFalseTrue✓V6.66Внеполосные механизмы аутентификацииV6.6.11Убедитесь, что механизмы аутентификации через телефонную сеть общего пользования (PSTN) для доставки одноразовых паролей (OTP) по телефону или SMS используются только в случае предварительной валидации номера, при этом предлагаются альтернативные более безопасные методы (например, TOTP), и пользователю сообщаются риски. Для приложений уровня L3 использование телефона и SMS недопустимо.FalseTrue✓True✓V6.6.22Убедитесь, что внеполосные запросы, коды или токены привязаны к исходному запросу аутентификации, для которого они были сгенерированы, и не могут быть использованы повторно для других попыток.FalseTrue✓True✓V6.6.33Убедитесь, что внеполосные механизмы на основе кода защищены от атак методом подбора (brute force) путём применения ограничения частоты запросов (rate limiting). Также рекомендуется использовать коды с энтропией не менее 64 бит.FalseTrue✓True✓V6.6.44Убедитесь, что при использовании push-уведомлений для MFA применяется ограничение частоты (rate limiting), чтобы предотвратить атаки push-бомбинга. Также может помочь механизм сопоставления номеров (number matching).FalseFalseTrue✓V6.77Криптографические механизмы аутентификацииV6.7.11Убедитесь, что сертификаты, используемые для проверки криптографических утверждений об аутентификации, хранятся таким образом, чтобы исключить возможность их модификации.FalseFalseTrue✓V6.7.22Убедитесь, что nonce (случайная строка), используемая в процессе вызова, имеет длину не менее 64 бит и является статистически уникальной или уникальной на протяжении всего срока службы криптографического устройства.FalseFalseTrue✓V6.88Аутентификация с использованием провайдера идентификаций (IdP)V6.8.11Убедитесь, что при поддержке несколькими IdP, невозможно подделать личность пользователя через другой IdP (например, с тем же user ID). Стандартным способом защиты является регистрация пользователя с использованием сочетания ID самого IdP (в качестве пространства имён) и пользовательского ID внутри IdP.FalseTrue✓True✓V6.8.22Убедитесь, что наличие и целостность цифровой подписи в утверждениях аутентификации (например, в JWT или SAML) всегда проверяются, а неподписанные или недействительные утверждения отклоняются.FalseTrue✓True✓V6.8.33Убедитесь, что SAML-утверждения обрабатываются только один раз в течение периода их действия, чтобы исключить атаки воспроизведения (replay attacks).FalseTrue✓True✓V6.8.44Убедитесь, что если приложение использует внешний поставщик идентификации (IdP) и для определенных функций требуется особый уровень, метод или срок действия аутентификации, то приложение использует данные, возвращаемые IdP, для проверки этих условий. Например, при использовании OIDC можно проверить значения полей ID Token — acr, amr, auth_time (если они есть). Если IdP не предоставляет эти данные, приложение должно иметь документированный план действий по умолчанию, предполагающий использование минимально допустимой силы аутентификации (например, одноступенчатая — логин и пароль).FalseTrue✓True✓V77SessionУправление сессиямиV7.11Документация по управлению сессиямиV7.1.11Убедитесь, что тайм-аут бездействия и абсолютное максимальное время жизни сессии задокументированы, соответствуют другим контрольным мерам и сопровождаются обоснованием любых отклонений от требований повторной аутентификации NIST SP 800-63B.FalseTrue✓True✓V7.1.22Убедитесь, что документация определяет допустимое количество одновременных (параллельных) сессий для одного аккаунта, а также поведение системы и действия при достижении этого лимита.FalseTrue✓True✓V7.1.33Убедитесь, что все системы, создающие и управляющие сессиями пользователей в рамках федеративной идентификации (например, SSO), задокументированы вместе с механизмами координации сроков действия сессий, условий завершения и случаев, требующих повторной аутентификации.FalseTrue✓True✓V7.22Базовая безопасность сессийV7.2.11Убедитесь, что все проверки сессионных токенов выполняются на доверенной серверной стороне.True✓True✓True✓V7.2.22Убедитесь, что приложение использует либо автономные токены, либо ссылочные токены, которые генерируются динамически, не используя статические API-секреты или ключи.True✓True✓True✓V7.2.33Убедитесь, что ссылочные токены являются уникальными, создаются с использованием криптографически безопасного генератора псевдослучайных чисел (CSPRNG) и обладают энтропией не менее 128 бит.True✓True✓True✓V7.2.44Убедитесь, что при аутентификации пользователя (включая повторную) создается новый токен сессии, а текущий — аннулируется.True✓True✓True✓V7.33Тайм-ауты сессииV7.3.11Убедитесь, что есть тайм-аут бездействия, после которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.FalseTrue✓True✓V7.3.22Убедитесь, что установлено абсолютное максимальное время жизни сессии, по истечении которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.FalseTrue✓True✓V7.44Завершение сессийV7.4.11Убедитесь, что после завершения сессии (logout, истечение срока) дальнейшее её использование невозможно. Для ссылочных токенов или сессий с сохранением состояния это означает аннулирование на сервере. Для self-contained токенов необходимо реализовать механизм отзыва, например, список отозванных токенов, проверку времени выпуска или ротацию ключей подписи для каждого пользователя.True✓True✓True✓V7.4.22Убедитесь, что при удалении или отключении пользователя все активные сессии немедленно завершаются.True✓True✓True✓V7.4.33Убедитесь, что после изменения или удаления факторов аутентификации (например, смена пароля или MFA) приложение предлагает завершить все другие активные сессии.FalseTrue✓True✓V7.4.44Убедитесь, что на всех страницах, требующих аутентификации, имеется простой и видимый способ выхода.FalseTrue✓True✓V7.4.55Убедитесь, что администраторы могут завершать активные сессии конкретного пользователя или всех пользователей.FalseTrue✓True✓V7.55Защита от злоупотреблений сессиейV7.5.11Убедитесь, что приложение требует полной повторной аутентификации перед изменением чувствительных атрибутов аккаунта, которые могут влиять на аутентификацию (например, email, номер телефона, настройки MFA или данных восстановления доступа).FalseTrue✓True✓V7.5.22Убедитесь, что пользователь может просматривать и (после повторной аутентификации хотя бы по одному фактору) завершать активные сессии.FalseTrue✓True✓V7.5.33Убедитесь, что перед выполнением критически важных операций приложение требует повторной аутентификации (по крайней мере, одного фактора) или дополнительной проверки.FalseFalseTrue✓V7.66Федеративная повторная аутентификацияV7.6.11Убедитесь, что срок действия и завершение сессий между RP и IdP соответствуют документации и включают повторную аутентификацию, если достигнут максимальный допустимый интервал между событиями аутентификации.FalseTrue✓True✓V7.6.22Убедитесь, что создание сессии требует согласия пользователя или явного действия, предотвращающего несанкционированное создание сессий без участия пользователя.FalseTrue✓True✓V88AuthorizationАвторизацияV8.11Документация по авторизацииV8.1.11Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне функций и на уровне данных на основе прав субъекта и атрибутов ресурса.True✓True✓True✓V8.1.22Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне полей (как на чтение, так и на запись) на основе прав субъекта и атрибутов ресурса. Эти правила могут зависеть от других атрибутов объекта данных, например, статуса.FalseTrue✓True✓V8.1.33Убедитесь, что документация определяет, какие атрибуты окружения и контекста (например, время суток, IP-адрес, местоположение, устройство) используются приложением для принятия решений в области аутентификации и авторизации.FalseFalseTrue✓V8.1.44Убедитесь, что документация по аутентификации и авторизации определяет, как используются факторы окружения и контекста в принятии решений, наряду с правилами доступа к функциям, данным и полям. Документация должна содержать оцениваемые атрибуты, пороговые значения риска, действия (разрешить, отказать, повысить уровень аутентификации и др.).FalseFalseTrue✓V8.22Архитектура авторизацииV8.2.11Убедитесь, что приложение обеспечивает доступ на уровне функций (function-level) только субъектам с явными разрешениями.True✓True✓True✓V8.2.22Убедитесь, что приложение обеспечивает доступ на уровне данных (data-specific) только тем субъектам, которым явно предоставлены права к определённым элементам данных, чтобы предотвратить IDOR (Insecure Direct Object Reference) и BOLA-уязвимости (Broken Object Level Authorization).True✓True✓True✓V8.2.33Убедитесь, что приложение обеспечивает доступ на уровне полей (field-level) только тем субъектам, которым явно предоставлены права к определённым полям, чтобы предотвратить BOPLA (Broken Object Property Level Authorization).FalseTrue✓True✓V8.2.44Убедитесь, что реализованы адаптивные меры безопасности, основанные на атрибутах окружения и контекста субъекта (время, местоположение, IP, устройство), которые используются для принятия решений об аутентификации и авторизации, как это определено в документации приложения. Эти меры должны применяться как при попытке субъекта начать новую сессию, так и во время существующей сессии.FalseFalseTrue✓V8.33Авторизация на уровне операцийV8.3.11Убедитесь, что правила авторизации реализуются на доверенном сервисном уровне и не зависят от элементов, которые может контролировать клиент (например, JavaScript на стороне клиента).True✓True✓True✓V8.3.22Убедитесь, что изменения значений, влияющих на авторизацию, применяются немедленно. Если это невозможно (например, при использовании автономных токенов), должны быть реализованы компенсирующие меры: оповещения о попытке несанкционированного действия и откат изменений. Обратите внимание, что данный подход не предотвращает утечку информации.FalseFalseTrue✓V8.3.33Убедитесь, что доступ к объекту осуществляется на основе прав субъекта, инициировавшего запрос, а не прав промежуточного сервиса, действующего от его имени. Например, если пользователь обращается к веб-сервису с автономным токеном для аутентификации, а сервис затем запрашивает данные у другого сервиса, второй сервис должен использовать токен пользователя, а не токен первого сервиса для принятия решения о доступе.FalseFalseTrue✓V8.44Прочие аспекты авторизацииV8.4.11Убедитесь, что в мультитенантных приложениях реализованы механизмы, предотвращающие действия потребителя в отношении арендаторов, к которым у него нет доступа.FalseTrue✓True✓V8.4.22Убедитесь, что доступ к административным интерфейсам защищён несколькими уровнями контроля, включая непрерывную проверку личности, контроль защищённости устройства и анализ контекстных рисков. Недостаточно опираться только на IP-адрес или доверенные устройства.FalseFalseTrue✓V99SelfАвтономные токеныV9.11Источник токена и его целостностьV9.1.11Убедитесь, что автономные токены проверяются на целостность с помощью цифровой подписи или MAC, прежде чем доверять их содержимому.True✓True✓True✓V9.1.22Проверяйте, что автономные токены создаются и проверяются исключительно с помощью алгоритмов из списка допустимых в данном контексте. Список допустимых алгоритмов должен включать только разрешенные алгоритмы (желательно либо только симметричные, либо только асимметричные) и ни в коем случае не содержать алгоритм None. Если необходимо поддерживать оба типа алгоритмов, потребуются дополнительные средства контроля для предотвращения путаницы с ключами (key confusion).True✓True✓True✓V9.1.33Убедитесь, что ключи, используемые для проверки автономных токенов, получены из доверенных, предварительно настроенных источников. Это предотвращает возможность указания злоумышленниками ненадёжных источников и ключей. Для JWT и других JWS структур заголовки 'jku', 'x5u' и 'jwk' должны проверяться по белому списку.True✓True✓True✓V9.22Содержимое токенаV9.2.11Убедитесь, что при указанном сроке действия токен и его содержимое принимаются только в том случае, если срок действия токена не истёк. Например, для JWT нужно проверить поля 'nbf' и 'exp'.True✓True✓True✓V9.2.22Убедитесь, что сервис, принимающий токен, проверяет его тип и соответствие назначению перед обработкой содержимого токена. Например, для принятия решений об авторизации могут быть приняты только Access Token, а для подтверждения аутентификации пользователя — только ID Token.FalseTrue✓True✓V9.2.33Убедитесь, что сервис принимает только токены, предназначенные для использования с этим сервисом (audience). Для JWT это можно сделать, проверив наличие утверждения «aud» по белому списку, определенному в сервисе.FalseTrue✓True✓V9.2.44Убедитесь, что, если эмитент токенов использует один и тот же закрытый ключ для выпуска токенов различным сервисам (audiences), выпущенные токены содержат явное указание целевых сервисов. Это предотвратит повторное использования токенов в не предназначенных для них сервисах. Если идентификатор сервиса (audience identifier) назначается динамически, эмитент токенов должен проверить audiences для исключения подмены получателей (audience impersonation).FalseTrue✓True✓V1010OAuthOAuth и OIDCV10.11Общие требования безопасности OAuth и OIDCV10.1.11Убедитесь, что токены передаются только тем компонентам, которым они действительно необходимы. Например, при использовании схемы backend-for-frontend для браузерных JavaScript-приложений, access и refresh токены должны быть доступны только на backend.FalseTrue✓True✓V10.1.22Убедитесь, что клиент принимает значения от авторизационного сервера (например, authorization code или ID Token) только если они получены в результате авторизационного потока, инициированного в той же сессии пользовательского агента и в рамках той же транзакции. Для этого клиентские секреты, такие как proof key для code exchange (PKCE) — 'code_verifier', 'state' или OIDC 'nonce' — должны быть непредсказуемыми, специфичными для транзакции и надежно привязанными как к клиенту, так и к сессии пользовательского агента, в которой началась транзакция.FalseTrue✓True✓V10.22Клиент OAuthV10.2.11Убедитесь, что если используется механизм authorization code flow, OAuth клиент защищён от CSRF, вызывающих запросы токенов либо за счёт использования механизма proof key for code exchange (PKCE), либо за счёт проверки параметра 'state', который был отправлен в запросе авторизации.FalseTrue✓True✓V10.2.22Убедитесь, что если OAuth клиент может взаимодействовать с более чем одним сервером авторизации, у него есть защита от атак смешивания (mix-up attacks). Например, клиент должен требовать, чтобы сервер авторизации возвращал параметр 'iss' и проверять его в ответах на авторизацию и токены.FalseTrue✓True✓V10.2.33Убедитесь, что OAuth клиент запрашивает только необходимые области доступа (scopes) или другие параметры авторизации в запросах к серверу авторизации.FalseFalseTrue✓V10.33Сервер ресурсов OAuthV10.3.11Убедитесь, что сервер ресурсов принимает только те access токены, которые предназначены для использования с этим сервисом (свойство audience). Эта принадлежность сервису может быть включена в структурированный access токен (например, в поле 'aud' в JWT) или проверяться через endpoint интроспекции токена.FalseTrue✓True✓V10.3.22Убедитесь, что сервер ресурсов принимает решения по авторизации на основе claims из access токена, определяющих делегированную авторизацию. Если присутствуют claims, такие как 'sub', 'scope' и 'authorization_details', они должны участвовать в принятии решения.FalseTrue✓True✓V10.3.33Убедитесь, что если для принятия решения по контролю доступа необходимо однозначно идентифицировать пользователя из access токена (JWT или ответа интроспекции), сервер ресурсов использует claims, которые не могут быть переприсвоены другим пользователям. Обычно это комбинация claims 'iss' и 'sub'.FalseTrue✓True✓V10.3.44Убедитесь, что если сервер ресурсов требует определённой силы аутентификации, методов или свежести аутентификации, он проверяет, что предъявленный access токен удовлетворяет этим требованиям. Например, при наличии, могут использоваться claims OIDC 'acr', 'amr' и 'auth_time'.FalseTrue✓True✓V10.3.55Убедитесь, что сервер ресурсов предотвращает использование украденных access токенов или их повторное использование (replay) неавторизованными лицами, требуя access токены с подтверждением отправителя — например, Mutual TLS для OAuth 2 или OAuth 2 Demonstration of Proof of Possession (DPoP).FalseFalseTrue✓V10.44Сервер авторизации OAuthV10.4.11Убедитесь, что сервер авторизации проверяет URI перенаправления (redirect URI), сверяя его с заранее зарегистрированным списком разрешённых URI для данного клиента (allowlist), используя точное сравнение строк.True✓True✓True✓V10.4.22Убедитесь, что если сервер авторизации возвращает authorization code в ответе авторизации, этот код может быть использован только один раз для запроса токена. При втором валидном запросе с уже использованным кодом сервер должен отклонить запрос и отозвать любые токены, связанные с этим кодом.True✓True✓True✓V10.4.33Убедитесь, что authorization code имеет короткое время жизни. Максимальная продолжительность — до 10 минут для приложений L1 и L2 и до 1 минуты для приложений L3.True✓True✓True✓V10.4.44Убедитесь, что сервер авторизации для конкретного клиента разрешает использование только тех типов авторизации, которые необходимы этому клиенту. Обратите внимание, что тип авторизации Implicit flow и Resource Owner Password Credentials flow больше не должны использоваться.True✓True✓True✓V10.4.55Убедитесь, что сервер авторизации предотвращает атаки повторного использования refresh токенов для публичных клиентов, предпочтительно используя sender-constrained refresh токены, такие как DPoP или сертификат-связанные токены с mutual TLS (mTLS). Для L1 и L2 допускается ротация refresh токенов с обязательной их инвалидацией после использования. Если используется ротация, сервер должен отозвать все refresh токены при попытке использовать уже инвалидированный токен.True✓True✓True✓V10.4.66Убедитесь, что при использовании типа авторизации «Authorization Code» сервер предотвращает атаки перехвата authorization code, требуя Proof Key for Code Exchange (PKCE). В запросах авторизации сервер должен требовать валидное значение 'code_challenge' и не принимать 'code_challenge_method' со значением 'plain'. В запросах токена обязательно валидировать параметр 'code_verifier'.FalseTrue✓True✓V10.4.77Убедитесь, что если сервер авторизации поддерживает динамическую регистрацию клиентов без аутентификации, он минимизирует риски вредоносных клиентов. Сервер должен валидировать метаданные клиента (например, зарегистрированные URI), обеспечивать согласие пользователя и предупреждать пользователя перед обработкой запроса авторизации от недоверенного клиента.FalseTrue✓True✓V10.4.88Убедитесь, что refresh токены имеют абсолютный срок действия, включая случаи, когда применяется скользящее время истечения срока.FalseTrue✓True✓V10.4.99Убедитесь, что пользователи могут отзывать refresh токены и reference access токены через пользовательский интерфейс сервера авторизации для снижения риска от вредоносных клиентов или кражи токенов.FalseTrue✓True✓V10.4.1010Убедитесь, что конфиденциальный клиент аутентифицируется при взаимодействии с сервером авторизации через backchannel, например при запросах токена, pushed authorization requests (PAR) и запросах на отзыв токенов.FalseTrue✓True✓V10.4.1111Убедитесь, что конфигурация сервера авторизации назначает OAuth клиенту только необходимые области доступа (scopes).FalseTrue✓True✓V10.4.1212Убедитесь, что для конкретного клиента сервер авторизации разрешает только те значения 'response_mode', которые необходимы этому клиенту. Например, сервер должен валидировать это значение против ожидаемых или использовать pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).FalseFalseTrue✓V10.4.1313Убедитесь, что грант типа 'code' всегда используется вместе с pushed authorization requests (PAR).FalseFalseTrue✓V10.4.1414Убедитесь, что сервер авторизации выдаёт только sender-constrained (Proof-of-Possession) access токены, либо с сертификат-связанными токенами через mutual TLS (mTLS), либо DPoP-bound токены (Demonstration of Proof of Possession).FalseFalseTrue✓V10.4.1515Убедитесь, что для серверного клиента (не выполняющегося на устройстве конечного пользователя) сервер авторизации проверяет, что значение параметра 'authorization_details' исходит из клиентского backend и что пользователь не изменял его. Например, это достигается использованием pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).FalseFalseTrue✓V10.4.1616Убедитесь, что клиент является конфиденциальным и сервер авторизации требует использования сильных методов аутентификации клиента (основанных на криптографии с открытым ключом и устойчивых к атакам повторного воспроизведения), таких как mutual TLS ('tls_client_auth', 'self_signed_tls_client_auth') или private key JWT ('private_key_jwt').FalseFalseTrue✓V10.55Клиент OIDCV10.5.11Убедитесь, что клиент (relying party) защищается от повторного использования ID Token (replay-атак). Например, это достигается проверкой того, что значение 'nonce' в ID Token совпадает со значением 'nonce', отправленным в запросе аутентификации провайдеру OpenID (authorization server).FalseTrue✓True✓V10.5.22Убедитесь, что клиент однозначно идентифицирует пользователя по утверждениям (claims) ID Token, обычно это 'sub', который не может быть переназначен другому пользователю (в пределах конкретного провайдера идентификации).FalseTrue✓True✓V10.5.33Убедитесь, что клиент отклоняет попытки злоумышленного сервера авторизации выдавать себя за другой сервер авторизации через метаданные сервера авторизации. Клиент должен отклонить метаданные, если URL издателя (issuer) в метаданных не совпадает точно с преднастроенным URL издателя, ожидаемым клиентом.FalseTrue✓True✓V10.5.44Убедитесь, что клиент проверяет, что ID Token предназначен для него (проверка audience), сравнивая значение 'aud' в токене с 'client_id' клиента.FalseTrue✓True✓V10.5.55Убедитесь, что при использовании OIDC back-channel logout клиент снижает риск отказа в обслуживании, вызванный принудительным выходом из системы и путаницей между разными типами JWT (cross-JWT confusion) в процессе логаута. Клиент должен проверить, что токен выхода корректно типизирован со значением 'logout+jwt', содержит claim 'event' с правильным именем участника и не содержит 'nonce'. Также рекомендуется установить короткий срок действия токена (например, 2 минуты).FalseTrue✓True✓V10.66Провайдер OpenIDV10.6.11Убедитесь, что провайдер OpenID допускает только значения 'code', 'ciba', 'id_token' или 'id_token code' для параметра response mode. При этом предпочтение отдаётся 'code' по сравнению с 'id_token code' (гибридный поток OIDC), а значение 'token' (любой Implicit flow) не должно использоваться.FalseTrue✓True✓V10.6.22Убедитесь, что провайдер OpenID предотвращает отказ в обслуживании (DoS) через принудительный выход (logout), запрашивая явное подтверждение от конечного пользователя или, если применимо, проверяя параметры в запросе выхода (инициированном relying party), например параметр 'id_token_hint'.FalseTrue✓True✓V10.77Управление согласиемV10.7.11Убедитесь, что авторизационный сервер обеспечивает получение согласия пользователя для каждого запроса авторизации. Если личность клиента не может быть подтверждена, сервер авторизации всегда должен явно запрашивать согласие пользователя.FalseTrue✓True✓V10.7.22Убедитесь, что при запросе согласия пользователя авторизационный сервер предоставляет достаточную и понятную информацию о том, на что даётся согласие. При необходимости это должно включать характер запрашиваемых разрешений (обычно основанных на scope, ресурсном сервере, деталях авторизации Rich Authorization Requests (RAR)), идентификацию авторизованного приложения и срок действия этих разрешений.FalseTrue✓True✓V10.7.33Убедитесь, что пользователь может просматривать, изменять и отзывать согласия, которые он предоставил, через авторизационный сервер.FalseTrue✓True✓V1111CryptographyКриптографияV11.11Инвентаризация и документирование криптографииV11.1.11Убедитесь, что задокументирована политика управления криптографическими ключами и описан их жизненный цикл в соответствии со стандартом управления ключей, таким как NIST SP 800-57. Убедитесь, что ключи известны только тем сущностям, которым они должны быть доступны (например, ключи не передавались более чем двум участникам для общих секретов и более чем одному участнику для приватных ключей).FalseTrue✓True✓V11.1.22Убедитесь, что проводится инвентаризация криптографических средств, которая непрерывно поддерживается, регулярно обновляется и включает все криптографические ключи, алгоритмы и сертификаты, используемые в приложении. Также должна быть задокументирована информация о том, где ключи могут и не могут использоваться в системе, а также какие типы данных могут и не могут быть защищены с помощью этих ключей.FalseTrue✓True✓V11.1.33Убедитесь, что используются механизмы обнаружения криптографии для идентификации всех случаев применения криптографии в системе , включая операции шифрования, хеширования и цифровой подписи.FalseFalseTrue✓V11.1.44Убедитесь, что ведётся и поддерживается инвентаризация криптографических средств. В неё должен входить документированный план, описывающий переход на новые криптографические стандарты, такие как постквантовая криптография, чтобы своевременно реагировать на будущие угрозы.FalseFalseTrue✓V11.22Безопасная реализация криптографииV11.2.11Убедитесь, что для криптографических операций используются утвержденные в индустрии реализации (включая библиотеки и аппаратные реализации).FalseTrue✓True✓V11.2.22Убедитесь, что архитектура приложения поддерживает быструю реконфигурацию, усовершенствование или смену в любой момент случайных чисел, аутентифицированного шифрования, MAC, алгоритмов хеширования, длин ключей, количества раундов, шифров и режимов шифрования для защиты от криптографических атак. Также должна поддерживаться возможность смены ключей, паролей и повторного шифрования данных. Это позволит беспрепятственно перейти на постквантовую криптографию (PQC), как только станут широко доступны высоконадёжные реализации одобренных схем или стандартов PQC.FalseTrue✓True✓V11.2.33Убедитесь, что все криптографические примитивы используют как минимум 128-бит стойкости с учетом алгоритма, размера ключа и конфигурации. Например, 256-битный ECC ключ обеспечивает примерно 128 бит безопасности, тогда как для достижения того же уровня безопасности в RSA требуется ключ длиной 3072 бита.FalseTrue✓True✓V11.2.44Убедитесь, что все криптографические операции выполняются за константное время, без использования «short-circuit» операций в сравнениях, вычислениях, возвратах функций для избежания утечек информации.FalseFalseTrue✓V11.2.55Убедитесь, что все криптографические модули обеспечивают безопасное завершение работы при ошибках, а обработка ошибок реализована таким образом, чтобы не создавать уязвимостей, например, таких как атаки Padding Oracle.FalseFalseTrue✓V11.33Алгоритмы шифрованияV11.3.11Убедитесь, что не используются небезопасные режимы блочного шифрования (н-р, ECB) и слабые схемы дополнения (padding) (н-р, PKCS#1 v1.5).True✓True✓True✓V11.3.22Убедитесь, что используются только утверждённые шифры и режимы, такие как AES с GCM.True✓True✓True✓V11.3.33Убедитесь, что зашифрованные данные защищены от несанкционированного изменения, предпочтительно с использованием утверждённого метода аутентифицированного шифрования или путём комбинирования утверждённого метода шифрования с утверждённым алгоритмом MAC.FalseTrue✓True✓V11.3.44Убедитесь, что случайные числа (nonce), векторы инициализации (IV) и другие одноразовые числа не используются более одного раза для одной и той же пары ключа шифрования и элемента данных. Метод их генерации должен соответствовать требованиям используемого алгоритма.FalseFalseTrue✓V11.3.55Убедитесь, что любая комбинация алгоритма шифрования и алгоритма MAC работает в режиме encrypt-then-MAC (EtM).FalseFalseTrue✓V11.44Хеширование и функции на основе хешированияV11.4.11Убедитесь, что только утвержденные хэш-функции используются для стандартных сценариев использования в криптографии, включая цифровую подпись, HMAC, KDF, генерацию случайных чисел. Запрещено использовать неустойчивые хэш-функции, (н-р, MD5) для любого использования в криптографии.True✓True✓True✓V11.4.22Убедитесь, что пароли хранятся с использованием утверждённой, вычислительно затратной функции генерации ключа (также известной как «функция хеширования паролей»), с параметрами, настроенными в соответствии с актуальными рекомендациями. Настройки должны обеспечивать баланс между безопасностью и производительностью, чтобы сделать атаки перебором достаточно сложными для требуемого уровня безопасности.FalseTrue✓True✓V11.4.33Убедитесь, что хэш-функции, используемые в формировании цифровой подписи, как часть аутентификации и целостности данных, устойчивы к коллизиям и имеют достаточную длину.FalseTrue✓True✓V11.4.44Убедитесь, что приложение использует утвержденную функцию генерации ключа с использованием параметров расширения ключа (key stretching) при генерации ключа из пароля. Параметры должны быть сбалансированы с точки зрения безопасности, производительности и устойчивости к атакам полного перебора при компрометации результирующего криптографического ключа.FalseTrue✓True✓V11.55Случайные значенияV11.5.11Убедитесь, что все случайные числа и строки, которые должны быть непредсказуемы, должны быть сгенерированы с помощью CSPRNG и иметь хотя бы 128 бит энтропии. Учтите, что UUID не удовлетворяют данному условию.FalseTrue✓True✓V11.5.22Убедитесь, что механизм генерации случайных чисел является надежным даже при высокой нагрузке.FalseFalseTrue✓V11.66Криптография с публичным ключомV11.6.11Убедитесь, что только утвержденные криптографические алгоритмы и режимы операций используются для генерации ключа и инициализации случайного значения для его генерации (seeding), а также для генерации цифровой подписи и верификации. Алгоритмы генерации ключей не должны генерировать небезопасные ключи уязвимые к известным атакам, например, ключи RSA уязвимы к факторизации Ферма.FalseTrue✓True✓V11.6.22Убедитесь, что для обмена ключами используются утверждённые криптографические алгоритмы (например, Диффи-Хеллман) с особым вниманием к обеспечению использования безопасных параметров. Это предотвратит атаки на процесс установления ключа, которые могут привести к атакам «человек посередине» или криптографическим взломам.FalseFalseTrue✓V11.77Шифрование данных в процессе использованияV11.7.11Убедитесь, что используется полное шифрование памяти, которое защищает конфиденциальные данные во время их использования, предотвращая доступ к ним неавторизованных пользователей или процессов.FalseFalseTrue✓V11.7.22Убедитесь, что минимизация данных обеспечивает раскрытие минимально необходимого объёма данных во время обработки, а также что данные шифруются сразу после использования или как можно скорее.FalseFalseTrue✓V1212SecureБезопасная коммуникацияV12.11Общие рекомендации по безопасности TLSV12.1.11Убедитесь, что включены только актуальные и рекомендуемые версии протокола TLS, такие как TLS 1.2 и TLS 1.3. Наиболее свежая версия TLS должна быть выбрана как предпочтительная.True✓True✓True✓V12.1.22Убедитесь, что включены рекомендуемые шифронаборы (cipher suites), предпочтение также стоит отдать самому сильному шифронабору. L3 приложения должны поддерживать только те наборы шифров (cipher suites), которые обеспечивают прямую (forward) секретность. Пояснение: Прямая секретность (Forward Secrecy, FS) — это криптографическая особенность, при которой сессионные ключи уникальны для каждой сессии и не зависят от долгосрочных ключей. Это гарантирует, что даже при компрометации долгосрочного ключа злоумышленник не сможет расшифровать ранее перехваченные зашифрованные сессии.FalseTrue✓True✓V12.1.33Убедитесь, что приложение проверяет доверенность клиентских сертификатов mTLS, прежде чем использовать идентификацию по сертификату для аутентификации или авторизации.FalseTrue✓True✓V12.1.44Убедитесь, что включена и настроена правильная проверка отзыва сертификатов, такая как Online Certificate Status Protocol (OCSP) Stapling.FalseFalseTrue✓V12.1.55Убедитесь, что в настройках TLS приложения включена функция Encrypted Client Hello (ECH) для предотвращения раскрытия конфиденциальных метаданных, таких как Server Name Indication (SNI), во время процесса TLS-рукопожатия.FalseFalseTrue✓V12.22HTTPS коммуникация с внешними сервисамиV12.2.11Убедитесь, что для всех соединений между клиентом и внешними HTTP-сервисами используется TLS и не происходит отката к небезопасным или незашифрованным протоколам.True✓True✓True✓V12.2.22Убедитесь, что внешние сервисы используют публично доверенные TLS-сертификаты.True✓True✓True✓V12.33Общая безопасность межсервисного взаимодействияV12.3.11Убедитесь, что для всех входящих и исходящих соединений приложения используется зашифрованный протокол, например TLS, включая системы мониторинга, инструменты управления, удалённый доступ и SSH, промежуточное ПО, базы данных, мейнфреймы, партнёрские системы и внешние API. Сервер не должен допускать откат к небезопасным или незашифрованным протоколам.FalseTrue✓True✓V12.3.22Убедитесь, что TLS-клиент проверяет сертификат сервера до установления защищенного соединения с TLS-сервером.FalseTrue✓True✓V12.3.33Убедитесь, что все внутренние HTTP-взаимодействия между компонентами приложения используют TLS или другой подходящий механизм транспортного шифрования, и не происходит откат к небезопасным или незашифрованным коммуникациям.FalseTrue✓True✓V12.3.44Убедитесь, что TLS-соединения между внутренними сервисами используют доверенные сертификаты. Если используются внутренние или самоподписанные сертификаты, потребляющий сервис должен быть настроен на доверие только к конкретным внутренним центрам сертификации (CA) и конкретным самоподписанным сертификатам.FalseTrue✓True✓V12.3.55Убедитесь, что сервисы, взаимодействующие внутри системы (intra-service communications), используют строгую аутентификацию для проверки каждого конечного узла. Для проверки подлинности взаимодействующих сторон должны применяться методы строгой аутентификации, такие как аутентификация TLS-клиента, с использованием инфраструктуры открытых ключей и механизмов, устойчивых к атакам повтора (replay attacks). Для микросервисных архитектур рекомендуется использование service mesh для упрощения управления сертификатами и повышения безопасности.FalseFalseTrue✓V1313ConfigurationКонфигурацияV13.11Документация конфигурацииV13.1.11Убедитесь, что все необходимые доступы приложения задокументированы. Сюда должны быть включены как внешние сервисы, от которых зависит приложение, так и сценарии, когда конечный пользователь может задавать адреса для внешнего подключения.FalseTrue✓True✓V13.1.22Убедитесь, что для каждого сервиса, используемого приложением, в документации определено максимальное количество одновременных соединений (например, лимиты пула соединений) и описано поведение приложения при достижении этого лимита, включая любые механизмы отказоустойчивости или восстановления, чтобы предотвратить ситуации отказа в обслуживании (DoS).FalseFalseTrue✓V13.1.33Убедитесь, что в документации приложения определены стратегии управления ресурсами для каждой внешней системы или сервиса, которые оно использует (например, базы данных, файловые дескрипторы, потоки, HTTP-соединения). Стратегии должны включать процедуры освобождения ресурсов, настройки таймаутов, обработку сбоев, а также, если реализована логика повторных попыток, указание лимитов, задержек и алгоритмов back-off. Для синхронных HTTP-запросов должны быть заданы короткие таймауты, а повторные запросы должны быть отключены, либо строго ограничены по числу попыток, чтобы предотвратить каскадные задержки и истощение ресурсов.FalseFalseTrue✓V13.1.44Убедитесь, что в документации приложения определены секреты, критически важные для безопасности приложения, а также установлен график их ротации в соответствии с моделью угроз организации и её бизнес-требованиями.FalseFalseTrue✓V13.22Конфигурация бэкенд соединенийV13.2.11Убедитесь, что коммуникации между компонентами бэкенда приложения (включая API, промежуточное ПО и уровни данных), которые не поддерживают стандартный механизм пользовательских сессий, проходят с аутентификацией. Аутентификация должна использовать индивидуальные сервисные аккаунты, краткосрочные токены или аутентификацию на основе сертификатов, а не постоянные учётные данные, такие как пароли, API-ключи или общие аккаунты с привилегированным доступом.FalseTrue✓True✓V13.2.22Убедитесь, что коммуникации между компонентами бэкенда приложения, включая локальные или системные службы, API, промежуточное ПО и уровни данных, выполняются с использованием аккаунтов, которым назначены минимально необходимые привилегии.FalseTrue✓True✓V13.2.33Убедитесь, что если для аутентификации в сервисе используются учётные данные, то используемые потребителем учётные данные не являются стандартными (например, root/root или admin/admin).FalseTrue✓True✓V13.2.44Убедитесь, что используется белый список (allowlist) для определения внешних ресурсов или систем, с которыми приложению разрешено взаимодействовать (например, для исходящих запросов, загрузки данных или доступа к файлам). Этот белый список может быть реализован на уровне приложения, веб-сервера, межсетевого экрана или комбинации различных уровней.FalseTrue✓True✓V13.2.55Убедитесь, что веб- или прикладной сервер настроен с белым списком ресурсов или систем, к которым сервер может отправлять запросы или из которых может загружать данные и файлы.FalseTrue✓True✓V13.2.66Убедитесь, что при подключении приложения к другим сервисам соблюдается задокументированная конфигурация для каждого соединения, включая максимальное количество параллельных соединений, поведение при достижении их максимума, таймауты и стратегии повторных попыток подключения.FalseFalseTrue✓V13.33Управление секретамиV13.3.11Убедитесь, что для безопасного создания, хранения, контроля доступа и уничтожения секретов бэкенда используется решение для управления секретами, например, хранилище ключей (key vault). Секретами могут быть пароли, ключевой материал, интеграции с базами данных и сторонними системами, ключи и seed-значения для токенов с ограниченным временем действия, другие внутренние секреты и API-ключи. Секреты не должны включаться в исходный код приложения или артефакты сборки. Для приложений уровня L3 необходимо использовать аппаратное решение, например, аппаратный модуль безопасности (HSM).FalseTrue✓True✓V13.3.22Убедитесь, что доступ к секретным ресурсам осуществляется в соответствии с принципом минимально необходимых привилегий (least privilege).FalseTrue✓True✓V13.3.33Убедитесь, что все криптографические операции выполняются с использованием изолированного модуля безопасности (например, хранилища ключей или аппаратного модуля безопасности), чтобы надежно управлять ключевым материалом и защищать его от утечки за пределы модуля безопасности.FalseFalseTrue✓V13.3.44Убедитесь, что секреты настроены на срок действия и ротацию в соответствии с документацией приложения.FalseFalseTrue✓V13.44Непреднамеренная утечка информацииV13.4.11Убедитесь, что приложение развернуто либо без метаданных систем контроля версий (включая папки .git или .svn), либо так, чтобы эти папки были недоступны как извне, так и для самого приложения.True✓True✓True✓V13.4.22Убедитесь, что режимы отладки отключены для всех компонентов в промышленной среде, чтобы предотвратить раскрытие функций отладки и утечку информации.FalseTrue✓True✓V13.4.33Убедитесь, что веб-серверы не показывают клиентам списки содержимого каталогов, если это явно не предусмотрено.FalseTrue✓True✓V13.4.44Убедитесь, что метод HTTP TRACE не поддерживается в продуктовой среде, чтобы избежать потенциальной утечки информации.FalseTrue✓True✓V13.4.55Убедитесь, что документация (например, по внутренним API) и мониторинговые эндпоинты не доступны, если это явно не предусмотрено.FalseTrue✓True✓V13.4.66Убедитесь, что приложение не раскрывает подробную информацию о версиях компонентов бэкенда.FalseFalseTrue✓V13.4.77Убедитесь, что веб-слой настроен на обслуживание только файлов с определёнными расширениями, чтобы предотвратить непреднамеренную утечку информации, конфигураций и исходного кода.FalseFalseTrue✓V1414DataЗащита информацииV14.11Документация по защите информацииV14.1.11Убедитесь, что все конфиденциальные данные, создаваемые и обрабатываемые приложением, идентифицированы и классифицированы по уровням защиты. Включая закодированные данные, которые легко декодируются, например, строки Base64 или незашифрованные данные в полезной нагрузке JWT. Уровни защиты должны учитывать требования по защите данных и конфиденциальности, которым должно соответствовать приложение.FalseTrue✓True✓V14.1.22Убедитесь, что для каждого уровня защиты конфиденциальных данных требования к защите задокументированы. Они должны включать (но не ограничиваться) требования по шифрованию, проверке целостности, срокам хранения, способам логирования данных, контролю доступа к чувствительным данным в логах, шифрованию на уровне базы данных, применению технологий повышения конфиденциальности, а также другим требованиям по конфиденциальности.FalseTrue✓True✓V14.22Базовые меры по защите информацииV14.2.11Убедитесь, что конфиденциальные данные передаются на сервер только в теле HTTP-запроса или в заголовках. URL и строка запроса не должны содержать конфиденциальную информацию, такую как API-ключ или сессионный токен.True✓True✓True✓V14.2.22Убедитесь, что приложение предотвращает кэширование конфиденциальных данных в серверных компонентах, таких как балансировщики нагрузки и кэши приложений, либо гарантирует их надежное удаление после использования.FalseTrue✓True✓V14.2.33Убедитесь, что заранее определённые конфиденциальные данные не отправляются ненадёжным сторонам (например, системам трекинга пользователей), чтобы предотвратить нежелательный сбор данных вне контроля приложения.FalseTrue✓True✓V14.2.44Убедитесь, что для конфиденциальных данных реализованы меры по шифрованию, проверке целостности, срокам хранения, способам логирования, контролю доступа к данным в логах, а также применяются технологии повышения конфиденциальности в соответствии с документацией для соответствующего уровня защиты данных.FalseTrue✓True✓V14.2.55Убедитесь, что механизмы кэширования настроены так, чтобы кэшировать только ответы с ожидаемым типом содержимого для данного ресурса и не содержать конфиденциального динамического контента. При обращении к несуществующему файлу, веб-сервер должен возвращать ответ 404 или 302, а не подменять на другой существующий файл, что позволит предотвратить атаки типа Web Cache Deception.FalseFalseTrue✓V14.2.66Убедитесь, что приложение возвращает только минимально необходимый объем конфиденциальных данных для выполнения своей функциональности. Например, показывает только часть цифр номера кредитной карты, а не полный номер. Если требуется отображение полных данных, они должны быть замаскированы в пользовательском интерфейсе, пока пользователь специально не запросил их просмотр.FalseFalseTrue✓V14.2.77Убедитесь, что конфиденциальная информация подлежит классификации по срокам хранения, чтобы устаревшие или ненужные данные удалялись автоматически, по расписанию или по мере необходимости.FalseFalseTrue✓V14.2.88Убедитесь, что конфиденциальная информация удаляется из метаданных файлов, загружаемых пользователями, если пользователь явно не согласился на ее хранение.FalseFalseTrue✓V14.33Защита данных на стороне клиентаV14.3.11Убедитесь, что аутентифицированные данные очищаются из клиентского хранилища, например, из DOM браузера, после завершения работы клиента или сессии. Заголовок HTTP-ответа Clear-Site-Data может помочь в этом, но клиентская сторона также должна уметь очищать данные, если соединение с сервером недоступно при завершении сессии.True✓True✓True✓V14.3.22Убедитесь, что приложение устанавливает HTTP-заголовки, достаточные для предотвращения кэширования (например, Cache-Control: no-store), чтобы конфиденциальные данные не сохранялись в браузерах.FalseTrue✓True✓V14.3.33Убедитесь, что данные, хранящиеся в браузерном хранилище (например, localStorage, sessionStorage, IndexedDB или cookie), не содержат конфиденциальной информации, за исключением сессионных токенов.FalseTrue✓True✓V1515SecureБезопасная разработка и архитектураV15.11Документация по безопасной разработке и архитектуреV15.1.11Убедитесь, что в документации по приложению определены сроки устранения уязвимостей на основе оценки рисков для внешних зависимостей с уязвимостями и для обновления библиотек в целом, чтобы минимизировать риск, связанный с этими компонентами.True✓True✓True✓V15.1.22Убедитесь, что ведется реестр всех используемых сторонних библиотек (например, Software Bill of Materials, SBOM), с обязательной проверкой, что компоненты получены из предопределенных, доверенных и регулярно поддерживаемых репозиториев.FalseTrue✓True✓V15.1.33Убедитесь, что в документации приложения указан функционал, требующий значительных временных или вычислительных ресурсов. Необходимо указать, как предотвратить потерю доступности из-за чрезмерного использования этого функционала и как избежать ситуаций, когда формирование ответа занимает больше времени, чем установленный системой таймаут. Возможные меры защиты могут включать асинхронную обработку, использование очередей и ограничение количества параллельных процессов для каждого пользователя и приложения.FalseTrue✓True✓V15.1.44Убедитесь, что в документации приложения указаны внешние библиотеки, которые считаются «компонентами с повышенным риском».FalseFalseTrue✓V15.1.55Убедитесь, что в документации приложения выделены те части приложения, в которых используются «функционал с повышенным риском».FalseFalseTrue✓V15.22Архитектура безопасности и зависимостиV15.2.11Убедитесь, что приложение содержит только те компоненты, которые не нарушили задокументированные сроки обновления и исправления.True✓True✓True✓V15.2.22Убедитесь, что в приложении реализованы меры защиты от потери доступности из-за функциональности, требующей много времени или ресурсов, на основе задокументированных решений и стратегий безопасности для этого.FalseTrue✓True✓V15.2.33Убедитесь, что производственная среда включает только те функции, которые необходимы для работы приложения, и не предоставляет лишние функции, такие как тестовый код, примеры кода и инструменты разработки.FalseTrue✓True✓V15.2.44Убедитесь, что сторонние компоненты и все их транзитивные зависимости загружаются только из ожидаемых репозиториев (внутренних или внешних) и отсутствует риск атаки через подмену зависимостей (dependency confusion attack)FalseFalseTrue✓V15.2.55Убедитесь, что приложение реализует дополнительные меры защиты для тех частей приложения, которые документированы как содержащие «функционал с повышенным риском» или использующие сторонние библиотеки, считающиеся «функционалом с повышенным риском». Это могут быть такие методы, как «песочница», инкапсуляция, контейнеризация или изоляция на сетевом уровне, чтобы задержать и предотвратить продвижение (pivoting) злоумышленников, скомпрометировавших одну часть приложения, к другим частям приложения.FalseFalseTrue✓V15.33Безопасное программированиеV15.3.11Убедитесь, что приложение возвращает только необходимое подмножество полей из объекта данных. Например, оно не должно возвращать весь объект данных, поскольку некоторые отдельные поля должны быть недоступны пользователям.True✓True✓True✓V15.3.22Убедитесь, что при вызовах внешних URL-адресов бэкэнд приложения настроен так, чтобы не выполнять перенаправления, если только это не предусмотрено функционалом.FalseTrue✓True✓V15.3.33Убедитесь, что в приложении реализованы защитные механизмы против атак типа массового присвоения (mass assignment) путем строгого ограничения разрешенных полей для каждого контроллера и действия, исключая возможность добавления или изменения значений полей, которые не должны быть доступны для данной конкретной операции.FalseTrue✓True✓V15.3.44Убедитесь, что все прокси и промежуточное ПО корректно передают исходный IP-адрес пользователя, используя доверенные поля данных, которые не могут быть изменены конечным пользователем, а приложение и веб-сервер используют это правильное значение для ведения логирования и принятия решений по безопасности, таких как ограничение запросов. При этом следует учитывать, что даже исходный IP-адрес может быть ненадежным из-за динамических IP-адресов, VPN или корпоративных файрволов.FalseTrue✓True✓V15.3.55Убедитесь, что приложение явно проверяет соответствие переменных ожидаемому типу данных и использует строгие операции сравнения. Это необходимо для предотвращения уязвимостей, связанных с type juggling и type confusion, вызванных тем, что код приложения делает предположения о типе переменной.FalseTrue✓True✓V15.3.66Убедитесь, что JavaScript-код написан таким образом, чтобы предотвратить prototype pollution, например, используя Set() или Map() вместо обычных литералов объекта.FalseTrue✓True✓V15.3.77Убедитесь, что приложение защищено от атак типа HTTP Parameter Pollution (HPP), особенно если используемый фреймворк не различает источники параметров запроса (строка запроса, тело запроса, куки или заголовки).FalseTrue✓True✓V15.44Безопасная работа с параллельными процессамиV15.4.11Убедитесь, что к общим объектам в многопоточном коде (например, кэшам, файлам или объектам в памяти, используемым несколькими потоками) используется безопасный многопоточный доступ и механизмов синхронизации, таких как блокировки или семафоры, чтобы избежать состояний гонки и повреждения данных.FalseFalseTrue✓V15.4.22Убедитесь, что проверки состояния ресурса, например его существования или разрешений, а также зависящие от него действия выполняются как одна атомарная операция, чтобы предотвратить условия гонки времени проверки и времени использования (TOCTOU). Например, проверка существования файла перед его открытием или проверка прав доступа пользователя перед его предоставлением.FalseFalseTrue✓V15.4.33Убедитесь, что блокировки применяются согласованно, чтобы предотвратить взаимные блокировки потоков (deadlocks) или их бесконечные повторы, а также что логика блокировки инкапсулирована в коде, отвечающем за управление ресурсом. Это гарантирует, что блокировки не могут быть случайно или намеренно изменены внешними классами или кодом.FalseFalseTrue✓V15.4.44Убедитесь, что политики распределения ресурсов предотвращают нехватку ресурсов у потоков, обеспечивая справедливый доступ к ресурсам, например, используя пулы потоков, позволяя потокам с более низким приоритетом выполняться в течение разумного периода времени.FalseFalseTrue✓V1616SecurityЖурналирование событий безопасности и обработка ошибокV16.11Документация по ведению логовV16.1.11Убедитесь в существовании реестра, в котором документируется ведение журнала на каждом уровне технологического стека приложения, включая какие события регистрируются, форматы логов, где хранятся эти журналы, как они используются, как контролируется доступ к ним и как долго хранятся журналы.FalseTrue✓True✓V16.22Общее журналированиеV16.2.11Убедитесь, что каждая запись журнала содержит необходимые метаданные (например, когда, где, кто, что), которые позволят провести подробное исследование временной шкалы, когда произошло событие.FalseTrue✓True✓V16.2.22Убедитесь, что все источники времени компонентов системы журналирования синхронизированы, а временные метки в метаданных событий безопасности используют UTC или содержат явное указание смещения часового пояса. Рекомендуется применять UTC для обеспечения согласованности в распределённых системах и предотвращения ошибок при переходе на летнее/зимнее время.FalseTrue✓True✓V16.2.33Убедитесь, что приложение записывает и передаёт логи исключительно в те файлы и сервисы, которые указаны в реестре журналирования.FalseTrue✓True✓V16.2.44Убедитесь, что логи могут быть прочитаны и коррелированы используемой системой обработки журналов, предпочтительно с использованием общего стандартного формата логирования.FalseTrue✓True✓V16.2.55Убедитесь, что приложение применяет соответствующие меры защиты при логировании конфиденциальных данных в зависимости от уровня их чувствительности: например, полностью запрещает запись в логи таких данных, как учетные данные или платежные реквизиты, а для других данных (например, сессионных токенов) использует хеширование или частичное/полное маскирование.FalseTrue✓True✓V16.33Инциденты безопасностиV16.3.11Убедитесь, что все операции аутентификации регистрируются, включая успешные и неудачные попытки. Также следует фиксировать дополнительные метаданные, такие как тип аутентификации или использованные факторы проверки.FalseTrue✓True✓V16.3.22Убедитесь, что ведется журнал неудачных попыток авторизации. Для уровня L3 это должно включать в себя журналирование всех решений об авторизации, включая журналирование доступа к конфиденциальным данным (без регистрации самих конфиденциальных данных).FalseTrue✓True✓V16.3.33Убедитесь, что приложение регистрирует все события безопасности, определенные в документации, а также фиксирует попытки обхода механизмов защиты, включая проверку входных данных, бизнес-логики и системы защиты от автоматизированных атак.FalseTrue✓True✓V16.3.44Убедитесь, что приложение регистрирует в журналах неожиданные ошибки и сбои механизмов безопасности, включая, например, ошибки TLS-соединения на стороне сервера.FalseTrue✓True✓V16.44Защита журналовV16.4.11Убедитесь, что все компоненты системы логирования корректно кодируют данные, чтобы предотвратить атаки типа внедрения в журналы (log injection).FalseTrue✓True✓V16.4.22Убедитесь, что логи защищены от неавторизованного доступа и не могут быть модифицированы.FalseTrue✓True✓V16.4.33Убедитесь, что логи безопасно передаются в логически изолированную систему для анализа, обнаружения угроз, генерации оповещений и эскалации инцидентов. Это гарантирует сохранность журналов даже в случае компрометации основного приложения.FalseTrue✓True✓V16.55Обработка ошибокV16.5.11Убедитесь, что при возникновении непредвиденной или связанной с безопасностью ошибки пользователю возвращается только общее сообщение, гарантируя отсутствие раскрытия конфиденциальных внутренних данных системы, таких как трассировки стека, запросы, секретные ключи и токены.FalseTrue✓True✓V16.5.22Убедитесь, что приложение продолжает работать в безопасном режиме при недоступности внешних ресурсов, используя такие механизмы, как автоматические выключатели (circuit breakers) или плавное снижение функциональности (graceful degradation).FalseTrue✓True✓V16.5.33Убедитесь, что приложение корректно и безопасно завершает работу при возникновении исключений, предотвращая опасные сценарии по типу «fail-open», когда, например, транзакция ошибочно выполняется, несмотря на ошибки в логике валидации.FalseTrue✓True✓V16.5.44Убедитесь, что определён обработчик ошибок «крайние меры», который будет перехватывать все необработанные ошибки. Это необходимо как для предотвращения потери информации об ошибках, которая должна быть записана в файлы журналов, так и для того, чтобы ошибка не остановила весь процесс приложения, что привело бы к потере доступности.FalseFalseTrue✓V1717WebRTCWebRTCV17.11TURN-серверV17.1.11Убедитесь, что сервис TURN (Traversal Using Relays around NAT) разрешает доступ только к IP-адресам, не зарезервированным для специальных целей (например, внутренние сети, широковещательная рассылка, loopback-адреса). Данное требование применяется как к IPv4, так и к IPv6 адресам.FalseTrue✓True✓V17.1.22Убедитесь, что сервис TURN (Traversal Using Relays around NAT) защищен от исчерпания ресурсов при попытках легитимных пользователей открыть чрезмерное количество портов на сервере.FalseFalseTrue✓V17.22Требования к медиасерверамV17.2.11Убедитесь, что ключ сертификата Datagram Transport Layer Security (DTLS) управляется и защищается в соответствии с документированной политикой управления криптографическими ключами.FalseTrue✓True✓V17.2.22Убедитесь, что медиасервер настроен на использование только одобренных наборов шифров Datagram Transport Layer Security (DTLS) и защищенного профиля безопасности для расширения DTLS, применяемого при установке ключей для Secure Real-time Transport Protocol (DTLS-SRTP).FalseTrue✓True✓V17.2.33Убедитесь, что медиасервер проверяет аутентификацию Secure Real-time Transport Protocol (SRTP) для предотвращения атак с внедрением Real-time Transport Protocol (RTP), которые могут привести к отказу в обслуживании (Denial of Service) или вставке поддельного аудио-/видеоконтента в медиапотоки.FalseTrue✓True✓V17.2.44Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика при получении некорректных пакетов Secure Real-time Transport Protocol (SRTP).FalseTrue✓True✓V17.2.55Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетами Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.FalseFalseTrue✓V17.2.66Убедитесь, что медиасервер не подвержен уязвимости «Гонка ClientHello» (ClientHello Race Condition) в Datagram Transport Layer Security (DTLS), проверив наличие известных уязвимостей в публичных источниках или выполнив тестирование на воспроизведение условий гонки.FalseFalseTrue✓V17.2.77Убедитесь, что механизмы аудио- и видеозаписи, связанные с медиасервером, способны продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетов Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.FalseFalseTrue✓V17.2.88Убедитесь, что сертификат Datagram Transport Layer Security (DTLS) проверяется на соответствие атрибуту отпечатка (fingerprint) в Session Description Protocol (SDP), с немедленным прекращением медиапотока в случае несоответствия — это гарантирует подлинность передаваемых данных.FalseFalseTrue✓V17.33СигнализацияV17.3.11Убедитесь, что сигнальный сервер способен продолжать обработку легитимных входящих сообщений сигнализации даже в условиях флуд-атаки. Для этого необходимо реализовать механизм ограничения частоты запросов (rate limiting) на уровне сигнализации.FalseTrue✓True✓V17.3.22Убедитесь, что сигнальный сервер способен продолжать обработку легитимных сообщений сигнализации даже при получении некорректных сообщений, которые могут вызвать отказ в обслуживании (Denial of Service, DoS). Для этого необходимо реализовать: проверку входных данных (input validation), безопасную обработку целочисленных переполнений (integer overflows), защиту от переполнения буферов (buffer overflows) и другие надежные методы обработки ошибок.FalseTrue✓True✓ diff --git a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.xml b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.xml new file mode 100644 index 0000000000..ef668c334f --- /dev/null +++ b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.xml @@ -0,0 +1 @@ +Application Security Verification Standard ProjectASVSThe OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.V11EncodingКодировка и нейтрализацияV1.11Архитектура кодировки и нейтрализацииV1.1.11Убедитесь, что входные данные декодируются или деэкранируются в каноническую форму (в стандартное представление) только один раз. Декодирование происходит только тогда, когда ожидаются закодированные данные в этой форме, и что это делается перед дальнейшей обработкой входных данных, например, это не выполняется после проверки или нейтрализации.2V1.1.22Убедитесь, что приложение выполняет кодирование и экранирование выходных данных либо в качестве последнего шага перед использованием интерпретатором, для которого оно предназначено, либо самим интерпретатором.2V1.22Предотвращение инъекцийV1.2.11Убедитесь, что выходная кодировка для ответа HTTP, документа HTML или документа XML соответствует требуемому контексту, например, кодировка соответствующих символов для элементов HTML, атрибутов HTML, комментариев HTML, CSS или полей заголовка HTTP делается таким способом, чтобы избежать изменения структуры сообщения или документа.1V1.2.22Убедитесь, что при динамическом построении URL-адресов недоверенные данные кодируются в соответствии с их контекстом (например, кодирование URL-адресов или кодирование base64url для query или path параметров или пути). Убедитесь, что разрешены только безопасные протоколы URL-адресов (например, запрещен javascript: или data:).1V1.2.33Убедитесь, что при динамическом построении содержимого JavaScript (включая JSON) используется кодирование или экранирование выходных данных, чтобы избежать изменения структуры сообщения или документа (чтобы избежать JavaScript и JSON-инъекций).1V1.2.44Убедитесь, что выборка данных (Redis, Memcached, чтение из файлов, обращение по API) или запросы к базе данных (например, SQL, HQL, NoSQL, Cypher) используют параметризованные запросы, ORM, Entity Frameworks или иным образом защищены от SQL-инъекций и других атак. Это также актуально при написании хранимых процедур.1V1.2.55Убедитесь, что приложение защищено от внедрения команд ОС и что вызовы операционной системы используют параметризованные запросы к ОС или используют контекстное кодирование вывода командной строки.1V1.2.66Убедитесь, что приложение защищено от LDAP-инъекций, или что реализованы специальные меры безопасности для их предотвращения.2V1.2.77Убедитесь, что приложение защищено от атак с использованием XPath-инъекций с помощью параметризации запросов или предварительно скомпилированных запросов.2V1.2.88Убедитесь, что процессоры LaTeX настроены безопасно (например, не используется флаг «–shell‑escape») и используется разрешенный список команд для предотвращения LaTeX-инъекций.2V1.2.99Убедитесь, что приложение экранирует специальные символы в регулярных выражениях (обычно с помощью обратной косой черты), чтобы предотвратить их ошибочную интерпретацию как метасимволов.2V1.2.1010Убедитесь, что приложение защищено от внедрения формул CSV (CSV Injection). Приложение должно следовать правилам экранирования, определенным в RFC 4180, разделы 2.6 и 2.7, при экспорте содержимого CSV. Кроме того, при экспорте в CSV или другие форматы электронных таблиц (такие как XLS, XLSX или ODF) специальные символы (включая '=', '+', '-', '@', '\t' (табуляция), и '\0' (нулевой символ)) должны экранироваться одинарной кавычкой, если они появляются в качестве первого символа в значении поля.3V1.33НейтрализацияV1.3.11Убедитесь, что все ненадежные входные данные HTML из редакторов WYSIWYG или аналогичных программ нейтрализуются с помощью известных и безопасных библиотек или функций фреймворка для санитизации HTML.1V1.3.22Убедитесь, что приложение избегает использования eval() или других динамических функций выполнения кода, таких как Spring Expression Language (SpEL). Если нет альтернативы, любой пользовательский ввод должен быть нейтрализован перед выполнением.1V1.3.33Убедитесь, что данные, передаваемые в потенциально опасный контекст, предварительно нейтрализованы, чтобы обеспечить соблюдение мер безопасности, таких как разрешение только тех символов, которые безопасны для данного контекста, и обрезка слишком длинного ввода.2V1.3.44Убедитесь, что предоставленный пользователем файл .SVG проверен или нейтрализован, чтобы он содержал только теги и атрибуты (например, относящиеся к рисованию), которые безопасны для приложения, например, не содержат скриптов и foreignObject.2V1.3.55Убедитесь, что приложение нейтралует или отключает предоставленные пользователем скриптовые данные или выражения шаблонных языков, такие как таблицы стилей Markdown, CSS или XSL, BBCode или аналогичные.2V1.3.66Убедитесь, что приложение защищено от атак с подделкой запросов на стороне сервера (SSRF), проверяя ненадежные данные по разрешенному списку протоколов, доменов, путей и портов, а также нейтрализуя потенциально опасные символы перед использованием данных для вызова другой службы.2V1.3.77Убедитесь, что приложение защищено от атак с внедрением шаблонов (template injection), не позволяя создавать шаблоны на основе недоверенных входных данных. Если нет альтернативы, любые недоверенные входные данные, включаемые динамически во время создания шаблона, должны быть нейтрализованы или тщательно провалидированы.2V1.3.88Убедитесь, что приложение надлежащим образом нейтрализует недоверенные входные данные перед использованием в запросах Java Naming and Directory Interface (JNDI) и что JNDI настроен безопасно для предотвращения атак с использованием JNDI-инъекций.2V1.3.99Убедитесь, что приложение нейтрализует данные перед отправкой в Memcache, чтобы предотвратить атаки методом инъекций.2V1.3.1010Убедитесь, что строки форматирования, которые могут быть использованы неожидаемым или вредоносным образом, нейтрализуются перед дальнейшим использованием.2V1.3.1111Убедитесь, что приложение нейтрализует вводимые пользователем данные перед передачей в почтовые системы для защиты от SMTP или IMAP-инъекций.2V1.3.1212Убедитесь, что регулярные выражения не содержат элементов, вызывающих экспоненциальный возврат, и убедитесь в нейтрализации недоверенных входных данных для предотвращения атак ReDoS или Runaway Regex.3V1.44Память, строки и неуправляемый кодV1.4.11Убедитесь, что для обнаружения или предотвращения ситуаций переполнения стека, буфера или кучи приложение учитывает размер доступной области памяти при строковых операциях, копировании в память, в арифметике указателей и т.п.2V1.4.22Убедитесь, что для предотвращения целочисленного переполнения применяется контроль знака, диапазона и типа допустимых входных данных.2V1.4.33Убедитесь, что динамически выделенная память и ресурсы освобождены, а ссылки или указатели на освобожденную память удалены или установлены в значение null, чтобы предотвратить появление висячих указателей и уязвимостей, связанных с использованием памяти после освобождения.2V1.55Безопасная десериализацияV1.5.11Убедитесь, что приложение настраивает XML-парсеры на использование строгой конфигурации и что небезопасные функции, такие как разрешение внешних сущностей, отключены для предотвращения атак XML eXternal Entity (XXE).1V1.5.22Убедитесь, что десериализация недоверенных данных обеспечивает безопасную обработку ввода, например, используя список разрешенных типов объектов или ограничивая типы объектов, определяемые клиентом, для предотвращения атак десериализации. Механизмы десериализации, которые явно определены как небезопасные, не должны использоваться с недоверенным вводом.2V1.5.33Убедитесь, что различные парсеры, используемые в приложении для одного и того же типа данных (например, парсеры JSON, XML, URL), выполняют парсинг согласованным образом и используют один и тот же механизм кодирования символов, чтобы избежать таких проблем, как уязвимости взаимодействия JSON (JSON Interoperability) или различное поведение анализа URI или файлов, которые могут использоваться в атаках удаленного включения файлов (RFI) или подделки запросов на стороне сервера (SSRF).3V22ValidationВалидация и бизнес-логикаV2.11Документация валидации и бизнес-логикиV2.1.11Убедитесь, что в документации приложения определены правила проверки входных данных на соответствие ожидаемой структуре. Это могут быть распространённые форматы данных, такие как номера кредитных карт, адреса электронной почты, номера телефонов, или внутренний формат данных.1V2.1.22Убедитесь, что в документации приложения указано, как проверять логическую и контекстную согласованность объединенных данных, например, проверять соответствие района и почтового индекса.2V2.1.33Убедитесь, что ожидания относительно ограничений и проверок бизнес-логики задокументированы как для уровня отдельного пользователя, так и для глобального уровня всего приложения.2V2.22Валидация вводаV2.2.11Убедитесь, что входные данные провалидированы для обеспечения соответствия бизнес- или функциональным ожиданиям. Валидация должна осуществляться либо по списку допустимых значений, шаблонов и диапазонов, либо путем сравнения входных данных с ожидаемой структурой и логическими ограничениями в соответствии с предопределенными правилами. Для L1 валидация может быть сосредоточена на входных данных, используемых для принятия конкретных бизнес-решений или решений, связанных с безопасностью. Для L2 и выше это должно применяться ко всем входным данным.1V2.2.22Убедитесь, что приложение разработано с принудительной валидацией входных данных на уровне доверенного сервиса. Хотя проверка на стороне клиента повышает удобство использования и должна поощряться, на неё не следует полагаться как на средство контроля безопасности.1V2.2.33Убедитесь, что приложение обеспечивает обоснованность комбинаций данных в соответствии с предопределенными правилам. Например: возраст должен соответствовать дате рождения; страна и почтовый индекс; количество товара в заказе и на складе.2V2.33Безопасность бизнес-логикиV2.3.11Убедитесь, что приложение обрабатывает потоки бизнес-логики для одного и того же пользователя в ожидаемом последовательном порядке шагов и без пропуска шагов.1V2.3.22Убедитесь, что ограничения бизнес-логики реализованы в соответствии с документацией приложения, чтобы избежать эксплуатации её недостатков.2V2.3.33Убедитесь, что транзакции используются на уровне бизнес-логики таким образом, что операция бизнес-логики либо выполняется полностью, либо откатывается к предыдущему корректному состоянию.2V2.3.44Убедитесь, что на уровне бизнес-логики используются механизмы блокировки, чтобы гарантировать невозможность двойного бронирования ограниченных по количеству ресурсов (например, мест в театре или слотов доставки) путем манипулирования логикой приложения.2V2.3.55Убедитесь, что для важных потоков бизнес-логики требуется многопользовательское (multi-user) одобрение, чтобы предотвратить несанкционированные или случайные действия. Потоки бизнес-логики могут включать, помимо прочего, крупные денежные переводы, утверждение контрактов, доступ к секретной информации или обход ограничений безопасности на производстве.3V2.44Анти-автоматизацияV2.4.11Убедитесь, что используются средства противодействия автоматизации для защиты от чрезмерных вызовов функций приложения, которые могут привести к утечке данных, созданию ненужных данных, исчерпанию квот, нарушению ограничений скорости, отказу в обслуживании или чрезмерному использованию дорогостоящих ресурсов.2V2.4.22Убедитесь, что потоки бизнес-логики требуют реалистичного человеческого времени, предотвращая чрезмерно быструю отправку транзакций.3V33WebБезопасность веб-интерфейсаV3.11Документация по безопасности веб-интерфейсаV3.1.11Убедитесь, что в документации приложения описаны ожидаемые функции безопасности, которые должны поддерживать браузеры, использующие приложение (такие как HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) и другие соответствующие механизмы безопасности HTTP). В документации также должно быть обязательно определено, как приложение должно себя вести, если некоторые из этих функций недоступны (например, предупреждать пользователя или блокировать доступ).3V3.22Непреднамеренная интерпретация контентаV3.2.11Убедитесь, что реализованы меры безопасности, предотвращающие отображение контента или функций браузерами в HTTP-ответах в некорректном контексте (например, запрос API, загруженный пользователем файл или другой ресурс запрашивается напрямую). Возможные способы контроля включают: не обрабатывать содержимое, если поля заголовка HTTP-запроса (например, Sec-Fetch-*) не указывают на корректность контекста; использование заголовка и значения Content-Security-Policy: sandbox directive; или использование заголовка и значения Content-Disposition: attachment.1V3.2.22Убедитесь, что данные, предназначенные для отображения в виде текста, а не визуализации в виде HTML, обрабатывается с использованием безопасных функций визуализации (таких как createTextNode или textContent), чтобы предотвратить непреднамеренное выполнение содержимого, такого как HTML или JavaScript.1V3.2.33Убедитесь, что приложение избегает затирания DOM при использовании JavaScript на стороне клиента, применяя явные объявления переменных, выполняя строгую проверку типов, избегая сохранения глобальных переменных в объекте документа и реализуя изоляцию пространства имен.3V3.33Настройка файлов cookieV3.3.11Убедитесь, что у файлов cookie установлен атрибут «Secure», и если префикс «__Host‑» не используется в названии cookie, необходимо использовать префикс «__Secure‑».1V3.3.22Убедитесь, что значение атрибута SameSite каждой cookie установлено в соответствии с назначением cookie, чтобы ограничить подверженность атакам на восстановление пользовательского интерфейса и атакам с подделкой запросов на уровне браузера, обычно называемым подделкой межсайтовых запросов (CSRF).2V3.3.33Убедитесь, что cookie имеют префикс «__Host‑» в названии, если только они явно не предназначены для совместного использования с другими хостами.2V3.3.44Убедитесь, что если значение cookie не должно быть доступно для клиентских скриптов (например, сессионный токен), для cookie должен быть установлен атрибут «HttpOnly», а само значение должно передаваться клиенту только через поле заголовка «Set-Cookie».2V3.3.55Убедитесь, что при записи cookie приложением общая длина имени и значения cookie не превышает 4096 байт. Слишком большие cookie не будут сохраняться браузером и, следовательно, не будут отправляться с запросами, что помешает пользователю использовать функции приложения, зависящие от этого cookie.3V3.44Заголовки механизма безопасности браузераV3.4.11Убедитесь, что поле заголовка Strict‑Transport‑Security включено во все ответы для реализации политики HTTP Strict Transport Security (HSTS). Необходимо указать максимальное время не менее 1 года, а для L2 и выше политика должна применяться также ко всем поддоменам.1V3.4.22Убедитесь, что поле заголовка Cross‑Origin Resource Sharing (CORS) «Access‑Control‑Allow‑Origin» имеет фиксированное значение, заданное приложением, или, если используется заголовок Origin, оно проверяется по списку доверенных источников. При необходимости использования «Access‑Control‑Allow‑Origin: *» убедитесь, что ответ не содержит конфиденциальной информации.1V3.4.33Убедитесь, что HTTP-ответы содержат поле заголовка Content-Security-Policy, которое определяет директивы, гарантирующие загрузку и выполнение браузером только доверенного контента или ресурсов, чтобы ограничить выполнение вредоносного JavaScript. Как минимум, необходимо использовать глобальную политику, включающую директивы object-src «none» и base-uri «none», а также определяющую список разрешенных адресов или использующую одноразовые коды или хэши. Для приложений L3 необходимо определить политику использования 'nonce' или hash-конструкций для каждого ответа.2V3.4.44Убедитесь, что все HTTP-ответы содержат поле заголовка «X‑Content‑Type‑Options: nosniff». Это предписывает браузерам не использовать анализ контента и определение типа MIME для данного ответа, а также требовать, чтобы значение поля заголовка Content‑Type в ответе соответствовало целевому ресурсу. Например, ответ на запрос стиля принимается только в том случае, если Content‑Type в ответе — «text/css». Это также позволяет браузеру использовать функцию Cross‑Origin Read Blocking (CORB).2V3.4.55Убедитесь, что приложение устанавливает политику реферера для предотвращения утечки технически конфиденциальных данных сторонним сервисам через поле заголовка HTTP-запроса «Referer». Это можно сделать с помощью поля заголовка HTTP-ответа «Referrer‑Policy» или через атрибуты HTML-элемента. Конфиденциальные данные могут включать путь и данные запроса в URL-адресе, а для внутренних непубличных приложений также имя хоста.2V3.4.66Убедитесь, что веб-приложение использует директиву frame‑ancestors поля заголовка Content‑Security‑Policy для каждого HTTP-ответа, чтобы гарантировать невозможность его внедрения по умолчанию и внедрение определённых ресурсов разрешено только при необходимости. Обратите внимание, что поле заголовка X‑Frame‑Options, хотя и поддерживается браузерами, устарело и не может быть использовано в качестве основы.2V3.4.77Убедитесь, что в поле заголовка Content‑Security‑Policy указано место, куда следует сообщать о нарушениях.3V3.4.88Убедитесь, что все HTTP-ответы, инициирующие рендеринг документа (например, ответы с типом содержимого text/html), включают поле заголовка Cross-Origin-Opener-Policy с директивой same-origin или same-origin-allow-popups (при необходимости). Это предотвращает атаки, злоупотребляющие общим доступом к объектам Window, такие как Tabnabbing и Frame Counting.3V3.55Браузерное разделение источниковV3.5.11Убедитесь, что, если приложение не использует механизм предварительной проверки CORS для предотвращения запрещённых кросс-доменных запросов на использование чувствительного функционала, эти запросы валидируются на предмет их происхождения от самого приложения. Это можно сделать, используя и проверяя специальные токены для защиты от подделки или требуя дополнительные поля HTTP-заголовка, не входящие в список «простых заголовков» (CORS-safelisted request-header). Это необходимо для защиты от атак с подделкой запросов через браузер, широко известных как межсайтовая подделка запросов (CSRF).1V3.5.22Убедитесь, что если приложение использует механизм предварительной проверки CORS для предотвращения неразрешённого использования чувствительного функционала между источниками, вызов этого функционала невозможен с помощью запроса, который не запускает предварительную проверку CORS. Для этого может потребоваться проверка значений полей заголовка запроса «Origin» и «Content-Type» или использование дополнительного поля заголовка, не входящего в безопасный список CORS.1V3.5.33Убедитесь, что HTTP-запросы к чувствительному функционалу используют соответствующие HTTP-методы, такие как POST, PUT, PATCH или DELETE, а не методы, определённые спецификацией HTTP как «безопасные», такие как HEAD, OPTIONS или GET. В качестве альтернативы можно использовать строгую валидацию полей заголовка запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, навигационного запроса или загрузки ресурса (например, источника изображения), где это не ожидается.1V3.5.44Убедитесь, что отдельные приложения размещены на разных именах хостов, чтобы использовать ограничения, предусмотренные политикой same-origin, включая то, как документы или скрипты, загруженные одним источником, могут взаимодействовать с ресурсами из другого источника, а также ограничения на cookie на основе имени хоста.2V3.5.55Убедитесь, что сообщения, полученные интерфейсом postMessage, отвергаются, если источник сообщения не является доверенным или если синтаксис сообщения недействителен.2V3.5.66Убедитесь, что функциональность JSONP не включена нигде в приложении, чтобы избежать атак с использованием межсайтового включения скриптов (XSSI).3V3.5.77Убедитесь, что данные, требующие авторизации, не включены в ответы ресурсов скриптов, таких как файлы JavaScript, чтобы предотвратить атаки с использованием межсайтового включения скриптов (XSSI).3V3.5.88Убедитесь, что аутентифицированные ресурсы (такие как изображения, видео, скрипты и другие документы) могут быть загружены или внедрены от имени пользователя только по назначению. Этого можно добиться путём строгой валидации полей заголовка HTTP-запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, или путём установки ограничительного поля заголовка HTTP-ответа Cross‑Origin‑Resource‑Policy, чтобы браузер блокировал возвращаемый контент.3V3.66Целостность внешних ресурсовV3.6.11Убедитесь, что клиентские ресурсы, такие как библиотеки JavaScript, CSS или веб-шрифты, размещаются только на внешнем сервере (например, в сети доставки контента (Content Delivery Network)), если ресурс статический и имеет версии, а для проверки целостности ресурса используется механизм проверки целостности подресурсов (SRI). Если это невозможно, для каждого ресурса должно быть задокументировано решение по безопасности, обосновывающее это.3V3.77Другие соображения по безопасности браузераV3.7.11Убедитесь, что приложение использует только те клиентские технологии, которые по-прежнему поддерживаются и считаются безопасными. Примерами технологий, не соответствующих этому требованию, являются плагины NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL или клиентские Java-апплеты.2V3.7.22Убедитесь, что приложение будет автоматически перенаправлять пользователя на другое имя хоста или домен (который не контролируется приложением), только если этот хост или домен указаны в списке разрешенных.2V3.7.33Убедитесь, что приложение отображает уведомление, что пользователь перенаправляется на URL-адрес, находящийся вне контроля приложения, с возможностью отмены навигации.3V3.7.44Убедитесь, что домен верхнего уровня приложения (например, site.tld) ​​добавлен в публичный список предварительной загрузки (preload list) для HTTP Strict Transport Security (HSTS). Это гарантирует, что использование TLS для приложения будет встроено непосредственно в основные браузеры, а не будет полагаться только на поле заголовка ответа Strict-Transport-Security.3V3.7.55Убедитесь, что приложение ведет себя так, как описано в документации (например, предупреждает пользователя или блокирует доступ), если браузер, используемый для доступа к приложению, не поддерживает ожидаемые функции безопасности.3V44APIAPI и Веб-сервисV4.11Общая безопасность веб-сервисовV4.1.11Убедитесь, что каждый HTTP-ответ с телом сообщения содержит заголовок Content-Type, который соответствует фактическому содержимому ответа, таким как «text/», «/+xml» и «/xml», включая параметр charset для указания безопасной кодировки символов (например, UTF-8, ISO-8859-1) согласно IANA Media Types.1V4.1.22Убедитесь, что только конечные точки, предназначенные для взаимодействия с пользователем через веб-браузер, автоматически перенаправляют HTTP на HTTPS, в то время как другие сервисы или конечные точки не реализуют прозрачные редиректы. Это необходимо, чтобы избежать ситуации, когда клиент ошибочно отправляет незашифрованные HTTP-запросы а из-за того, что запрос по HTTP автоматически перенаправляется на HTTPS другим сервисом без обработки на входе, утечка чувствительных данных остаётся незамеченной.2V4.1.33Убедитесь, что любой HTTP-заголовок, используемый приложением и устанавливаемый промежуточным уровнем, таким как балансировщик нагрузки, веб-прокси или backend-for-frontend сервис, не может быть переопределён конечным пользователем. Примеры заголовков: X-Real-IP, X-Forwarded-*, X-User-ID.2V4.1.44Убедитесь, что разрешены только HTTP-методы, которые явно поддерживаются приложением или его API (включая OPTIONS для preflight-запросов), а неиспользуемые методы заблокированы.3V4.1.55Убедитесь, что для особо чувствительных запросов или транзакций, проходящих через несколько систем, используются цифровые подписи на уровне сообщений, дополнительно к транспортным средствам защиты.3V4.22Валидация структуры HTTP-сообщенийV4.2.11Убедитесь, что все компоненты приложения (включая балансировщики нагрузки, файрволы и серверы приложений) определяют границы входящих HTTP-сообщений с использованием механизма, соответствующего версии HTTP, чтобы предотвратить HTTP request smuggling. В HTTP/1.x, если присутствует заголовок Transfer-Encoding, заголовок Content-Length должен игнорироваться согласно RFC 2616. При использовании HTTP/2 или HTTP/3, если присутствует Content-Length, веб-сервер должен убедиться, что он совпадает с длиной DATA-фреймов.2V4.2.22Убедитесь, что при генерации HTTP-сообщений заголовок Content-Length не конфликтует с длиной содержимого, определяемой рамками протокола HTTP, чтобы предотвратить HTTP Request Smuggling.3V4.2.33Убедитесь, что приложение не отправляет и не принимает HTTP/2 и HTTP/3 сообщения с заголовками, специфичными для соединения, такими как Transfer-Encoding, чтобы предотвратить HTTP Response Splitting и HTTP Header Injection.3V4.2.44Убедитесь, что приложение принимает HTTP/2 и HTTP/3 запросы только в случае, если поля заголовков и их значения не содержат последовательностей CR (\r), LF (\n) или CRLF (\r\n), чтобы предотвратить HTTP Header Injection.3V4.2.55Убедитесь, что если приложение (бекенд или фронтенд) формирует и отправляет запросы, оно использует валидацию, очистку или другие механизмы, чтобы не создавать URI (например, для API-вызовов) или HTTP-заголовки (например, Authorization или Cookie) слишком большой длины, чтобы их не принимал приёмник. Это может привести к отказу в обслуживании, например, при отправке слишком длинного запроса (длинный cookie-заголовок), из-за чего сервер постоянно возвращает ошибку.3V4.33GraphQLV4.3.11Убедитесь, что используется белый список запросов, ограничение глубины вложенности, ограничение количества или анализ стоимости запроса, чтобы предотвратить DoS-атаки на уровне GraphQL или слоя данных из-за дорогостоящих вложенных запросов.2V4.3.22Убедитесь, что introspection-запросы GraphQL отключены в продакшен-среде, если GraphQL API не предназначен для использования сторонними клиентами.2V4.44WebSocketV4.4.11Убедитесь, что для всех WebSocket-соединений используется WebSocket поверх TLS (WSS).1V4.4.22Убедитесь, что при первоначальном HTTP WebSocket handshake заголовок Origin проверяется на соответствие списку разрешённых источников для приложения.2V4.4.33Убедитесь, что если стандартное управление сессиями приложения не может быть использовано, применяются специальные токены, соответствующие требованиям безопасности управления сессиями.2V4.4.44Убедитесь, что специальные токены управления сессиями WebSocket изначально получаются или валидируются через ранее аутентифицированную HTTPS-сессию при переходе от HTTPS к WebSocket.2V55FileРабота с файламиV5.11Документация по работе с файламиV5.1.11Убедитесь, что документация определяет допустимые типы файлов, ожидаемые расширения и максимальный размер (включая распакованный размер) для каждой функции загрузки. Также убедитесь, что в документации указано, как файлы обезвреживаются для конечных пользователей (например, как приложение ведёт себя при обнаружении вредоносного файла).2V5.22Загрузка файлов и содержимоеV5.2.11Убедитесь, что приложение принимает только те файлы, которые может обработать без потери производительности или отказа в обслуживании.1V5.2.22Убедитесь, что при загрузке файла (включая файлы внутри архивов, таких как ZIP) приложение проверяет, соответствует ли расширение ожидаемому, и валидирует, соответствует ли содержимое типу, указанному в расширении. Это включает проверку начальных 'magic bytes', перезапись изображений, использование специализированных библиотек. Для уровня 1 — достаточно проверок для файлов, критичных с точки зрения бизнеса или безопасности. Для уровней 2 и выше — для всех файлов.1V5.2.33Убедитесь, что приложение проверяет архивы (например, zip, gz, docx, odt) на максимально допустимый распакованный размер и максимальное количество файлов до распаковки.2V5.2.44Убедитесь, что для каждого пользователя установлены квоты на общий размер и количество файлов, чтобы один пользователь не мог переполнить хранилище.3V5.2.55Убедитесь, что приложение не позволяет загружать архивы с символьными ссылками (symlinks), если это не требуется по бизнес-логике. Если требуется — разрешён только строго определённый список допустимых символьных ссылок.3V5.2.66Убедитесь, что приложение отклоняет изображения с числом пикселей выше допустимого, чтобы предотвратить атаки 'pixel flood'.3V5.33Хранение файловV5.3.11Убедитесь, что загруженные или сгенерированные из недоверенного ввода файлы, находящиеся в публичной директории, не исполняются как серверный код при обращении к ним по HTTP.1V5.3.22Убедитесь, что при создании путей к файлам приложение использует внутренние или доверенные данные, а не пользовательские имена файлов. Если использование пользовательских имён или метаданных необходимо — требуется строгая проверка и очистка. Это защита от path traversal, LFI, RFI и SSRF.1V5.3.33Убедитесь, что при обработке файлов на сервере (например, при распаковке) игнорируются пути, заданные пользователем, во избежание уязвимостей типа 'zip slip'.3V5.44Скачивание файловV5.4.11Убедитесь, что приложение валидирует или игнорирует имена файлов, переданных пользователем (включая в JSON, JSONP или URL-параметре), и указывает имя файла в заголовке Content-Disposition при ответе.2V5.4.22Убедитесь, что имена файлов, передаваемые (например, в HTTP-заголовках или вложениях в email), кодируются или очищаются (например, по RFC 6266), чтобы сохранить структуру документа и предотвратить инъекции.2V5.4.33Убедитесь, что файлы, полученные из недоверенных источников, сканируются антивирусом, чтобы не распространять известное вредоносное содержимое.2V66AuthenticationАутентификацияV6.11Документация по аутентификацииV6.1.11Убедитесь, что в документации приложения описано, как используются механизмы, такие как ограничение частоты запросов (rate limiting), защита от автоматизации и адаптивные реакции, для защиты от атак, таких как подстановка учётных данных и перебор паролей. Документация должна ясно описывать конфигурацию этих механизмов и предотвращение злонамеренной блокировки аккаунтов.1V6.1.22Убедитесь, что задокументирован список контекстно-зависимых слов, запрещённых к использованию в паролях. В него могут входить производные от названий организаций, продуктов, идентификаторов систем, кодовых названий проектов, названий отделов или ролей и тому подобное.2V6.1.33Убедитесь, что если приложение поддерживает несколько способов аутентификации, то все они документированы вместе с описанием применяемых средств защиты и уровнем стойкости аутентификации, которые должны быть одинаково применены ко всем способам.2V6.22Безопасность паролейV6.2.11Убедитесь, что пользовательские пароли содержат не менее 8 символов. Рекомендуется минимальная длина в 15 символов.1V6.2.22Убедитесь, что пользователи могут менять свои пароли.1V6.2.33Убедитесь, что для смены пароля требуется ввести как текущий, так и новый пароль.1V6.2.44Убедитесь, что при регистрации или смене пароля введённый пароль проверяется по списку как минимум из 3000 самых популярных паролей, соответствующих политике (например, минимальной длине).1V6.2.55Убедитесь, что допускаются пароли любой структуры, без ограничений на использование определённых символов. Не должно быть требований по обязательному наличию заглавных/строчных букв, цифр или специальных символов.1V6.2.66Убедитесь, что поля ввода пароля используют type=password для скрытия символов. Разрешено временное отображение всего пароля или последнего введённого символа.1V6.2.77Убедитесь, что разрешены вставка (paste), использование менеджеров паролей браузера и внешних менеджеров паролей.1V6.2.88Убедитесь, что пароль проверяется строго в том виде, в котором он был введён пользователем — без обрезки, изменения регистра и других модификаций.1V6.2.99Убедитесь, что система позволяет использовать пароли длиной не менее 64 символов.2V6.2.1010Убедитесь, что пароль остаётся действительным, пока не будет скомпрометирован или не будет изменён пользователем. Приложение не должно требовать регулярной смены пароля.2V6.2.1111Убедитесь, что используется документированный список контекстно-зависимых слов (например, названия компаний, проектов и т.д.) для предотвращения использования легко угадываемых паролей.2V6.2.1212Убедитесь, что при регистрации или смене пароля проверяется, не входит ли он в список скомпрометированных (утёкших) паролей.2V6.33Общие требования к безопасности аутентификацииV6.3.11Убедитесь, что реализованы меры защиты от атак типа credential stuffing (массовая подстановка учётных данных) и brute-force (перебор паролей), согласно документации по безопасности приложения.1V6.3.22Убедитесь, что в приложении отсутствуют или отключены учётные записи по умолчанию (например, root, admin, sa).1V6.3.33Убедитесь, что для доступа к приложению используется либо механизм многофакторной аутентификации, либо комбинация однофакторных. Для уровня L3 один из факторов должен быть аппаратным, обеспечивающим защиту от фишинга, устойчивость к компрометации и подтверждение намерения аутентификации через явное действие пользователя (например, нажатие кнопки на FIDO-ключе или телефоне). Ослабление этих требований допускается только при наличии обоснования и компенсирующих мер.2V6.3.44Убедитесь, что при наличии нескольких способов аутентификации, они все задокументированы, и для них единообразно применяются меры защиты и уровни доверия.2V6.3.55Убедитесь, что пользователи получают уведомления о подозрительных попытках аутентификации (удачных и неудачных). Это может включать попытки (например, подключения) с необычного устройства или места, частично успешную MFA, попытку после долгого отсутствия или успешную аутентификацию после серии неудачных.3V6.3.66Убедитесь, что email не используется ни как однофакторный, ни как многофакторный механизм аутентификации.3V6.3.77Убедитесь, что пользователи получают уведомление при изменении данных аутентификации, таких как сброс пароля или изменение логина/email.3V6.3.88Убедитесь, что из сообщений об ошибке, HTTP-кодов ответа или различий во времени ответа нельзя определить, существует ли пользователь с таким логином. Это правило также должно применяться к функциям регистрации и восстановления пароля.3V6.44Жизненный цикл и восстановление факторов аутентификацииV6.4.11Убедитесь, что начальные пароли или коды активации, генерируемые системой, создаются с использованием надёжного генератора случайных чисел, соответствуют текущей политике паролей и истекают через короткий период времени либо после первого использования. Эти секреты не должны использоваться как постоянные пароли.1V6.4.22Убедитесь, что в системе отсутствуют подсказки к паролю или вопросы на знание («секретные вопросы»).1V6.4.33Убедитесь, что реализован безопасный процесс сброса забытого пароля, который не обходит активные механизмы многофакторной аутентификации.2V6.4.44Убедитесь, что в случае утраты одного из факторов MFA проводится удостоверение личности (identity proofing) на том же уровне, что и при первичной регистрации.2V6.4.55Убедитесь, что инструкции по обновлению истекающих механизмов аутентификации отправляются заранее, с достаточным запасом времени для выполнения замены, при необходимости с настройкой автоматических напоминаний.3V6.4.66Убедитесь, что администраторы могут инициировать процесс сброса пароля, но не могут задать или выбрать новый пароль за пользователя. Это исключает ситуацию, при которой администратор знает пароль пользователя.3V6.55Общие требования к многофакторной аутентификацииV6.5.11Убедитесь, что lookup-секреты, внеполосные коды/запросы и TOTP-коды можно использовать только один раз.2V6.5.22Убедитесь, что при хранении lookup-секретов с энтропией менее 112 бит (например, 19 случайных буквенно-цифровых символов или 34 случайные цифры) они хэшируются с использованием разрешённого алгоритма хеширования паролей и случайной соли минимум 32 бита. Если у секрета ≥112 бит энтропии — допустимо использовать стандартный хэш.2V6.5.33Убедитесь, что lookup-секреты, коды внеполосной аутентификации и сиды для TOTP генерируются с использованием криптографически стойкого генератора случайных чисел (CSPRNG), чтобы избежать предсказуемых значений.2V6.5.44Убедитесь, что lookup-секреты и внеполосные коды аутентификации имеют минимум 20 бит энтропии (достаточно, например, 4 случайных алфавитно-цифровых символов или 6 случайных цифр).2V6.5.55Убедитесь, что все внеполосные запросы, коды и токены, а также TOTP-коды имеют ограниченный срок действия. Максимум для out-of-band — 10 минут, для TOTP — 30 секунд.2V6.5.66Убедитесь, что любой фактор аутентификации (включая физические устройства) может быть отозван в случае кражи или утери.3V6.5.77Убедитесь, что биометрические механизмы аутентификации используются только как вторичный фактор — в сочетании с «чем-то, что вы знаете» или «чем-то, что у вас есть».3V6.5.88Убедитесь, что TOTP-коды проверяются по источнику времени, полученному от доверенного сервиса, а не от клиента или недоверенного источника.3V6.66Внеполосные механизмы аутентификацииV6.6.11Убедитесь, что механизмы аутентификации через телефонную сеть общего пользования (PSTN) для доставки одноразовых паролей (OTP) по телефону или SMS используются только в случае предварительной валидации номера, при этом предлагаются альтернативные более безопасные методы (например, TOTP), и пользователю сообщаются риски. Для приложений уровня L3 использование телефона и SMS недопустимо.2V6.6.22Убедитесь, что внеполосные запросы, коды или токены привязаны к исходному запросу аутентификации, для которого они были сгенерированы, и не могут быть использованы повторно для других попыток.2V6.6.33Убедитесь, что внеполосные механизмы на основе кода защищены от атак методом подбора (brute force) путём применения ограничения частоты запросов (rate limiting). Также рекомендуется использовать коды с энтропией не менее 64 бит.2V6.6.44Убедитесь, что при использовании push-уведомлений для MFA применяется ограничение частоты (rate limiting), чтобы предотвратить атаки push-бомбинга. Также может помочь механизм сопоставления номеров (number matching).3V6.77Криптографические механизмы аутентификацииV6.7.11Убедитесь, что сертификаты, используемые для проверки криптографических утверждений об аутентификации, хранятся таким образом, чтобы исключить возможность их модификации.3V6.7.22Убедитесь, что nonce (случайная строка), используемая в процессе вызова, имеет длину не менее 64 бит и является статистически уникальной или уникальной на протяжении всего срока службы криптографического устройства.3V6.88Аутентификация с использованием провайдера идентификаций (IdP)V6.8.11Убедитесь, что при поддержке несколькими IdP, невозможно подделать личность пользователя через другой IdP (например, с тем же user ID). Стандартным способом защиты является регистрация пользователя с использованием сочетания ID самого IdP (в качестве пространства имён) и пользовательского ID внутри IdP.2V6.8.22Убедитесь, что наличие и целостность цифровой подписи в утверждениях аутентификации (например, в JWT или SAML) всегда проверяются, а неподписанные или недействительные утверждения отклоняются.2V6.8.33Убедитесь, что SAML-утверждения обрабатываются только один раз в течение периода их действия, чтобы исключить атаки воспроизведения (replay attacks).2V6.8.44Убедитесь, что если приложение использует внешний поставщик идентификации (IdP) и для определенных функций требуется особый уровень, метод или срок действия аутентификации, то приложение использует данные, возвращаемые IdP, для проверки этих условий. Например, при использовании OIDC можно проверить значения полей ID Token — acr, amr, auth_time (если они есть). Если IdP не предоставляет эти данные, приложение должно иметь документированный план действий по умолчанию, предполагающий использование минимально допустимой силы аутентификации (например, одноступенчатая — логин и пароль).2V77SessionУправление сессиямиV7.11Документация по управлению сессиямиV7.1.11Убедитесь, что тайм-аут бездействия и абсолютное максимальное время жизни сессии задокументированы, соответствуют другим контрольным мерам и сопровождаются обоснованием любых отклонений от требований повторной аутентификации NIST SP 800-63B.2V7.1.22Убедитесь, что документация определяет допустимое количество одновременных (параллельных) сессий для одного аккаунта, а также поведение системы и действия при достижении этого лимита.2V7.1.33Убедитесь, что все системы, создающие и управляющие сессиями пользователей в рамках федеративной идентификации (например, SSO), задокументированы вместе с механизмами координации сроков действия сессий, условий завершения и случаев, требующих повторной аутентификации.2V7.22Базовая безопасность сессийV7.2.11Убедитесь, что все проверки сессионных токенов выполняются на доверенной серверной стороне.1V7.2.22Убедитесь, что приложение использует либо автономные токены, либо ссылочные токены, которые генерируются динамически, не используя статические API-секреты или ключи.1V7.2.33Убедитесь, что ссылочные токены являются уникальными, создаются с использованием криптографически безопасного генератора псевдослучайных чисел (CSPRNG) и обладают энтропией не менее 128 бит.1V7.2.44Убедитесь, что при аутентификации пользователя (включая повторную) создается новый токен сессии, а текущий — аннулируется.1V7.33Тайм-ауты сессииV7.3.11Убедитесь, что есть тайм-аут бездействия, после которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.2V7.3.22Убедитесь, что установлено абсолютное максимальное время жизни сессии, по истечении которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.2V7.44Завершение сессийV7.4.11Убедитесь, что после завершения сессии (logout, истечение срока) дальнейшее её использование невозможно. Для ссылочных токенов или сессий с сохранением состояния это означает аннулирование на сервере. Для self-contained токенов необходимо реализовать механизм отзыва, например, список отозванных токенов, проверку времени выпуска или ротацию ключей подписи для каждого пользователя.1V7.4.22Убедитесь, что при удалении или отключении пользователя все активные сессии немедленно завершаются.1V7.4.33Убедитесь, что после изменения или удаления факторов аутентификации (например, смена пароля или MFA) приложение предлагает завершить все другие активные сессии.2V7.4.44Убедитесь, что на всех страницах, требующих аутентификации, имеется простой и видимый способ выхода.2V7.4.55Убедитесь, что администраторы могут завершать активные сессии конкретного пользователя или всех пользователей.2V7.55Защита от злоупотреблений сессиейV7.5.11Убедитесь, что приложение требует полной повторной аутентификации перед изменением чувствительных атрибутов аккаунта, которые могут влиять на аутентификацию (например, email, номер телефона, настройки MFA или данных восстановления доступа).2V7.5.22Убедитесь, что пользователь может просматривать и (после повторной аутентификации хотя бы по одному фактору) завершать активные сессии.2V7.5.33Убедитесь, что перед выполнением критически важных операций приложение требует повторной аутентификации (по крайней мере, одного фактора) или дополнительной проверки.3V7.66Федеративная повторная аутентификацияV7.6.11Убедитесь, что срок действия и завершение сессий между RP и IdP соответствуют документации и включают повторную аутентификацию, если достигнут максимальный допустимый интервал между событиями аутентификации.2V7.6.22Убедитесь, что создание сессии требует согласия пользователя или явного действия, предотвращающего несанкционированное создание сессий без участия пользователя.2V88AuthorizationАвторизацияV8.11Документация по авторизацииV8.1.11Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне функций и на уровне данных на основе прав субъекта и атрибутов ресурса.1V8.1.22Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне полей (как на чтение, так и на запись) на основе прав субъекта и атрибутов ресурса. Эти правила могут зависеть от других атрибутов объекта данных, например, статуса.2V8.1.33Убедитесь, что документация определяет, какие атрибуты окружения и контекста (например, время суток, IP-адрес, местоположение, устройство) используются приложением для принятия решений в области аутентификации и авторизации.3V8.1.44Убедитесь, что документация по аутентификации и авторизации определяет, как используются факторы окружения и контекста в принятии решений, наряду с правилами доступа к функциям, данным и полям. Документация должна содержать оцениваемые атрибуты, пороговые значения риска, действия (разрешить, отказать, повысить уровень аутентификации и др.).3V8.22Архитектура авторизацииV8.2.11Убедитесь, что приложение обеспечивает доступ на уровне функций (function-level) только субъектам с явными разрешениями.1V8.2.22Убедитесь, что приложение обеспечивает доступ на уровне данных (data-specific) только тем субъектам, которым явно предоставлены права к определённым элементам данных, чтобы предотвратить IDOR (Insecure Direct Object Reference) и BOLA-уязвимости (Broken Object Level Authorization).1V8.2.33Убедитесь, что приложение обеспечивает доступ на уровне полей (field-level) только тем субъектам, которым явно предоставлены права к определённым полям, чтобы предотвратить BOPLA (Broken Object Property Level Authorization).2V8.2.44Убедитесь, что реализованы адаптивные меры безопасности, основанные на атрибутах окружения и контекста субъекта (время, местоположение, IP, устройство), которые используются для принятия решений об аутентификации и авторизации, как это определено в документации приложения. Эти меры должны применяться как при попытке субъекта начать новую сессию, так и во время существующей сессии.3V8.33Авторизация на уровне операцийV8.3.11Убедитесь, что правила авторизации реализуются на доверенном сервисном уровне и не зависят от элементов, которые может контролировать клиент (например, JavaScript на стороне клиента).1V8.3.22Убедитесь, что изменения значений, влияющих на авторизацию, применяются немедленно. Если это невозможно (например, при использовании автономных токенов), должны быть реализованы компенсирующие меры: оповещения о попытке несанкционированного действия и откат изменений. Обратите внимание, что данный подход не предотвращает утечку информации.3V8.3.33Убедитесь, что доступ к объекту осуществляется на основе прав субъекта, инициировавшего запрос, а не прав промежуточного сервиса, действующего от его имени. Например, если пользователь обращается к веб-сервису с автономным токеном для аутентификации, а сервис затем запрашивает данные у другого сервиса, второй сервис должен использовать токен пользователя, а не токен первого сервиса для принятия решения о доступе.3V8.44Прочие аспекты авторизацииV8.4.11Убедитесь, что в мультитенантных приложениях реализованы механизмы, предотвращающие действия потребителя в отношении арендаторов, к которым у него нет доступа.2V8.4.22Убедитесь, что доступ к административным интерфейсам защищён несколькими уровнями контроля, включая непрерывную проверку личности, контроль защищённости устройства и анализ контекстных рисков. Недостаточно опираться только на IP-адрес или доверенные устройства.3V99SelfАвтономные токеныV9.11Источник токена и его целостностьV9.1.11Убедитесь, что автономные токены проверяются на целостность с помощью цифровой подписи или MAC, прежде чем доверять их содержимому.1V9.1.22Проверяйте, что автономные токены создаются и проверяются исключительно с помощью алгоритмов из списка допустимых в данном контексте. Список допустимых алгоритмов должен включать только разрешенные алгоритмы (желательно либо только симметричные, либо только асимметричные) и ни в коем случае не содержать алгоритм None. Если необходимо поддерживать оба типа алгоритмов, потребуются дополнительные средства контроля для предотвращения путаницы с ключами (key confusion).1V9.1.33Убедитесь, что ключи, используемые для проверки автономных токенов, получены из доверенных, предварительно настроенных источников. Это предотвращает возможность указания злоумышленниками ненадёжных источников и ключей. Для JWT и других JWS структур заголовки 'jku', 'x5u' и 'jwk' должны проверяться по белому списку.1V9.22Содержимое токенаV9.2.11Убедитесь, что при указанном сроке действия токен и его содержимое принимаются только в том случае, если срок действия токена не истёк. Например, для JWT нужно проверить поля 'nbf' и 'exp'.1V9.2.22Убедитесь, что сервис, принимающий токен, проверяет его тип и соответствие назначению перед обработкой содержимого токена. Например, для принятия решений об авторизации могут быть приняты только Access Token, а для подтверждения аутентификации пользователя — только ID Token.2V9.2.33Убедитесь, что сервис принимает только токены, предназначенные для использования с этим сервисом (audience). Для JWT это можно сделать, проверив наличие утверждения «aud» по белому списку, определенному в сервисе.2V9.2.44Убедитесь, что, если эмитент токенов использует один и тот же закрытый ключ для выпуска токенов различным сервисам (audiences), выпущенные токены содержат явное указание целевых сервисов. Это предотвратит повторное использования токенов в не предназначенных для них сервисах. Если идентификатор сервиса (audience identifier) назначается динамически, эмитент токенов должен проверить audiences для исключения подмены получателей (audience impersonation).2V1010OAuthOAuth и OIDCV10.11Общие требования безопасности OAuth и OIDCV10.1.11Убедитесь, что токены передаются только тем компонентам, которым они действительно необходимы. Например, при использовании схемы backend-for-frontend для браузерных JavaScript-приложений, access и refresh токены должны быть доступны только на backend.2V10.1.22Убедитесь, что клиент принимает значения от авторизационного сервера (например, authorization code или ID Token) только если они получены в результате авторизационного потока, инициированного в той же сессии пользовательского агента и в рамках той же транзакции. Для этого клиентские секреты, такие как proof key для code exchange (PKCE) — 'code_verifier', 'state' или OIDC 'nonce' — должны быть непредсказуемыми, специфичными для транзакции и надежно привязанными как к клиенту, так и к сессии пользовательского агента, в которой началась транзакция.2V10.22Клиент OAuthV10.2.11Убедитесь, что если используется механизм authorization code flow, OAuth клиент защищён от CSRF, вызывающих запросы токенов либо за счёт использования механизма proof key for code exchange (PKCE), либо за счёт проверки параметра 'state', который был отправлен в запросе авторизации.2V10.2.22Убедитесь, что если OAuth клиент может взаимодействовать с более чем одним сервером авторизации, у него есть защита от атак смешивания (mix-up attacks). Например, клиент должен требовать, чтобы сервер авторизации возвращал параметр 'iss' и проверять его в ответах на авторизацию и токены.2V10.2.33Убедитесь, что OAuth клиент запрашивает только необходимые области доступа (scopes) или другие параметры авторизации в запросах к серверу авторизации.3V10.33Сервер ресурсов OAuthV10.3.11Убедитесь, что сервер ресурсов принимает только те access токены, которые предназначены для использования с этим сервисом (свойство audience). Эта принадлежность сервису может быть включена в структурированный access токен (например, в поле 'aud' в JWT) или проверяться через endpoint интроспекции токена.2V10.3.22Убедитесь, что сервер ресурсов принимает решения по авторизации на основе claims из access токена, определяющих делегированную авторизацию. Если присутствуют claims, такие как 'sub', 'scope' и 'authorization_details', они должны участвовать в принятии решения.2V10.3.33Убедитесь, что если для принятия решения по контролю доступа необходимо однозначно идентифицировать пользователя из access токена (JWT или ответа интроспекции), сервер ресурсов использует claims, которые не могут быть переприсвоены другим пользователям. Обычно это комбинация claims 'iss' и 'sub'.2V10.3.44Убедитесь, что если сервер ресурсов требует определённой силы аутентификации, методов или свежести аутентификации, он проверяет, что предъявленный access токен удовлетворяет этим требованиям. Например, при наличии, могут использоваться claims OIDC 'acr', 'amr' и 'auth_time'.2V10.3.55Убедитесь, что сервер ресурсов предотвращает использование украденных access токенов или их повторное использование (replay) неавторизованными лицами, требуя access токены с подтверждением отправителя — например, Mutual TLS для OAuth 2 или OAuth 2 Demonstration of Proof of Possession (DPoP).3V10.44Сервер авторизации OAuthV10.4.11Убедитесь, что сервер авторизации проверяет URI перенаправления (redirect URI), сверяя его с заранее зарегистрированным списком разрешённых URI для данного клиента (allowlist), используя точное сравнение строк.1V10.4.22Убедитесь, что если сервер авторизации возвращает authorization code в ответе авторизации, этот код может быть использован только один раз для запроса токена. При втором валидном запросе с уже использованным кодом сервер должен отклонить запрос и отозвать любые токены, связанные с этим кодом.1V10.4.33Убедитесь, что authorization code имеет короткое время жизни. Максимальная продолжительность — до 10 минут для приложений L1 и L2 и до 1 минуты для приложений L3.1V10.4.44Убедитесь, что сервер авторизации для конкретного клиента разрешает использование только тех типов авторизации, которые необходимы этому клиенту. Обратите внимание, что тип авторизации Implicit flow и Resource Owner Password Credentials flow больше не должны использоваться.1V10.4.55Убедитесь, что сервер авторизации предотвращает атаки повторного использования refresh токенов для публичных клиентов, предпочтительно используя sender-constrained refresh токены, такие как DPoP или сертификат-связанные токены с mutual TLS (mTLS). Для L1 и L2 допускается ротация refresh токенов с обязательной их инвалидацией после использования. Если используется ротация, сервер должен отозвать все refresh токены при попытке использовать уже инвалидированный токен.1V10.4.66Убедитесь, что при использовании типа авторизации «Authorization Code» сервер предотвращает атаки перехвата authorization code, требуя Proof Key for Code Exchange (PKCE). В запросах авторизации сервер должен требовать валидное значение 'code_challenge' и не принимать 'code_challenge_method' со значением 'plain'. В запросах токена обязательно валидировать параметр 'code_verifier'.2V10.4.77Убедитесь, что если сервер авторизации поддерживает динамическую регистрацию клиентов без аутентификации, он минимизирует риски вредоносных клиентов. Сервер должен валидировать метаданные клиента (например, зарегистрированные URI), обеспечивать согласие пользователя и предупреждать пользователя перед обработкой запроса авторизации от недоверенного клиента.2V10.4.88Убедитесь, что refresh токены имеют абсолютный срок действия, включая случаи, когда применяется скользящее время истечения срока.2V10.4.99Убедитесь, что пользователи могут отзывать refresh токены и reference access токены через пользовательский интерфейс сервера авторизации для снижения риска от вредоносных клиентов или кражи токенов.2V10.4.1010Убедитесь, что конфиденциальный клиент аутентифицируется при взаимодействии с сервером авторизации через backchannel, например при запросах токена, pushed authorization requests (PAR) и запросах на отзыв токенов.2V10.4.1111Убедитесь, что конфигурация сервера авторизации назначает OAuth клиенту только необходимые области доступа (scopes).2V10.4.1212Убедитесь, что для конкретного клиента сервер авторизации разрешает только те значения 'response_mode', которые необходимы этому клиенту. Например, сервер должен валидировать это значение против ожидаемых или использовать pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).3V10.4.1313Убедитесь, что грант типа 'code' всегда используется вместе с pushed authorization requests (PAR).3V10.4.1414Убедитесь, что сервер авторизации выдаёт только sender-constrained (Proof-of-Possession) access токены, либо с сертификат-связанными токенами через mutual TLS (mTLS), либо DPoP-bound токены (Demonstration of Proof of Possession).3V10.4.1515Убедитесь, что для серверного клиента (не выполняющегося на устройстве конечного пользователя) сервер авторизации проверяет, что значение параметра 'authorization_details' исходит из клиентского backend и что пользователь не изменял его. Например, это достигается использованием pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).3V10.4.1616Убедитесь, что клиент является конфиденциальным и сервер авторизации требует использования сильных методов аутентификации клиента (основанных на криптографии с открытым ключом и устойчивых к атакам повторного воспроизведения), таких как mutual TLS ('tls_client_auth', 'self_signed_tls_client_auth') или private key JWT ('private_key_jwt').3V10.55Клиент OIDCV10.5.11Убедитесь, что клиент (relying party) защищается от повторного использования ID Token (replay-атак). Например, это достигается проверкой того, что значение 'nonce' в ID Token совпадает со значением 'nonce', отправленным в запросе аутентификации провайдеру OpenID (authorization server).2V10.5.22Убедитесь, что клиент однозначно идентифицирует пользователя по утверждениям (claims) ID Token, обычно это 'sub', который не может быть переназначен другому пользователю (в пределах конкретного провайдера идентификации).2V10.5.33Убедитесь, что клиент отклоняет попытки злоумышленного сервера авторизации выдавать себя за другой сервер авторизации через метаданные сервера авторизации. Клиент должен отклонить метаданные, если URL издателя (issuer) в метаданных не совпадает точно с преднастроенным URL издателя, ожидаемым клиентом.2V10.5.44Убедитесь, что клиент проверяет, что ID Token предназначен для него (проверка audience), сравнивая значение 'aud' в токене с 'client_id' клиента.2V10.5.55Убедитесь, что при использовании OIDC back-channel logout клиент снижает риск отказа в обслуживании, вызванный принудительным выходом из системы и путаницей между разными типами JWT (cross-JWT confusion) в процессе логаута. Клиент должен проверить, что токен выхода корректно типизирован со значением 'logout+jwt', содержит claim 'event' с правильным именем участника и не содержит 'nonce'. Также рекомендуется установить короткий срок действия токена (например, 2 минуты).2V10.66Провайдер OpenIDV10.6.11Убедитесь, что провайдер OpenID допускает только значения 'code', 'ciba', 'id_token' или 'id_token code' для параметра response mode. При этом предпочтение отдаётся 'code' по сравнению с 'id_token code' (гибридный поток OIDC), а значение 'token' (любой Implicit flow) не должно использоваться.2V10.6.22Убедитесь, что провайдер OpenID предотвращает отказ в обслуживании (DoS) через принудительный выход (logout), запрашивая явное подтверждение от конечного пользователя или, если применимо, проверяя параметры в запросе выхода (инициированном relying party), например параметр 'id_token_hint'.2V10.77Управление согласиемV10.7.11Убедитесь, что авторизационный сервер обеспечивает получение согласия пользователя для каждого запроса авторизации. Если личность клиента не может быть подтверждена, сервер авторизации всегда должен явно запрашивать согласие пользователя.2V10.7.22Убедитесь, что при запросе согласия пользователя авторизационный сервер предоставляет достаточную и понятную информацию о том, на что даётся согласие. При необходимости это должно включать характер запрашиваемых разрешений (обычно основанных на scope, ресурсном сервере, деталях авторизации Rich Authorization Requests (RAR)), идентификацию авторизованного приложения и срок действия этих разрешений.2V10.7.33Убедитесь, что пользователь может просматривать, изменять и отзывать согласия, которые он предоставил, через авторизационный сервер.2V1111CryptographyКриптографияV11.11Инвентаризация и документирование криптографииV11.1.11Убедитесь, что задокументирована политика управления криптографическими ключами и описан их жизненный цикл в соответствии со стандартом управления ключей, таким как NIST SP 800-57. Убедитесь, что ключи известны только тем сущностям, которым они должны быть доступны (например, ключи не передавались более чем двум участникам для общих секретов и более чем одному участнику для приватных ключей).2V11.1.22Убедитесь, что проводится инвентаризация криптографических средств, которая непрерывно поддерживается, регулярно обновляется и включает все криптографические ключи, алгоритмы и сертификаты, используемые в приложении. Также должна быть задокументирована информация о том, где ключи могут и не могут использоваться в системе, а также какие типы данных могут и не могут быть защищены с помощью этих ключей.2V11.1.33Убедитесь, что используются механизмы обнаружения криптографии для идентификации всех случаев применения криптографии в системе , включая операции шифрования, хеширования и цифровой подписи.3V11.1.44Убедитесь, что ведётся и поддерживается инвентаризация криптографических средств. В неё должен входить документированный план, описывающий переход на новые криптографические стандарты, такие как постквантовая криптография, чтобы своевременно реагировать на будущие угрозы.3V11.22Безопасная реализация криптографииV11.2.11Убедитесь, что для криптографических операций используются утвержденные в индустрии реализации (включая библиотеки и аппаратные реализации).2V11.2.22Убедитесь, что архитектура приложения поддерживает быструю реконфигурацию, усовершенствование или смену в любой момент случайных чисел, аутентифицированного шифрования, MAC, алгоритмов хеширования, длин ключей, количества раундов, шифров и режимов шифрования для защиты от криптографических атак. Также должна поддерживаться возможность смены ключей, паролей и повторного шифрования данных. Это позволит беспрепятственно перейти на постквантовую криптографию (PQC), как только станут широко доступны высоконадёжные реализации одобренных схем или стандартов PQC.2V11.2.33Убедитесь, что все криптографические примитивы используют как минимум 128-бит стойкости с учетом алгоритма, размера ключа и конфигурации. Например, 256-битный ECC ключ обеспечивает примерно 128 бит безопасности, тогда как для достижения того же уровня безопасности в RSA требуется ключ длиной 3072 бита.2V11.2.44Убедитесь, что все криптографические операции выполняются за константное время, без использования «short-circuit» операций в сравнениях, вычислениях, возвратах функций для избежания утечек информации.3V11.2.55Убедитесь, что все криптографические модули обеспечивают безопасное завершение работы при ошибках, а обработка ошибок реализована таким образом, чтобы не создавать уязвимостей, например, таких как атаки Padding Oracle.3V11.33Алгоритмы шифрованияV11.3.11Убедитесь, что не используются небезопасные режимы блочного шифрования (н-р, ECB) и слабые схемы дополнения (padding) (н-р, PKCS#1 v1.5).1V11.3.22Убедитесь, что используются только утверждённые шифры и режимы, такие как AES с GCM.1V11.3.33Убедитесь, что зашифрованные данные защищены от несанкционированного изменения, предпочтительно с использованием утверждённого метода аутентифицированного шифрования или путём комбинирования утверждённого метода шифрования с утверждённым алгоритмом MAC.2V11.3.44Убедитесь, что случайные числа (nonce), векторы инициализации (IV) и другие одноразовые числа не используются более одного раза для одной и той же пары ключа шифрования и элемента данных. Метод их генерации должен соответствовать требованиям используемого алгоритма.3V11.3.55Убедитесь, что любая комбинация алгоритма шифрования и алгоритма MAC работает в режиме encrypt-then-MAC (EtM).3V11.44Хеширование и функции на основе хешированияV11.4.11Убедитесь, что только утвержденные хэш-функции используются для стандартных сценариев использования в криптографии, включая цифровую подпись, HMAC, KDF, генерацию случайных чисел. Запрещено использовать неустойчивые хэш-функции, (н-р, MD5) для любого использования в криптографии.1V11.4.22Убедитесь, что пароли хранятся с использованием утверждённой, вычислительно затратной функции генерации ключа (также известной как «функция хеширования паролей»), с параметрами, настроенными в соответствии с актуальными рекомендациями. Настройки должны обеспечивать баланс между безопасностью и производительностью, чтобы сделать атаки перебором достаточно сложными для требуемого уровня безопасности.2V11.4.33Убедитесь, что хэш-функции, используемые в формировании цифровой подписи, как часть аутентификации и целостности данных, устойчивы к коллизиям и имеют достаточную длину.2V11.4.44Убедитесь, что приложение использует утвержденную функцию генерации ключа с использованием параметров расширения ключа (key stretching) при генерации ключа из пароля. Параметры должны быть сбалансированы с точки зрения безопасности, производительности и устойчивости к атакам полного перебора при компрометации результирующего криптографического ключа.2V11.55Случайные значенияV11.5.11Убедитесь, что все случайные числа и строки, которые должны быть непредсказуемы, должны быть сгенерированы с помощью CSPRNG и иметь хотя бы 128 бит энтропии. Учтите, что UUID не удовлетворяют данному условию.2V11.5.22Убедитесь, что механизм генерации случайных чисел является надежным даже при высокой нагрузке.3V11.66Криптография с публичным ключомV11.6.11Убедитесь, что только утвержденные криптографические алгоритмы и режимы операций используются для генерации ключа и инициализации случайного значения для его генерации (seeding), а также для генерации цифровой подписи и верификации. Алгоритмы генерации ключей не должны генерировать небезопасные ключи уязвимые к известным атакам, например, ключи RSA уязвимы к факторизации Ферма.2V11.6.22Убедитесь, что для обмена ключами используются утверждённые криптографические алгоритмы (например, Диффи-Хеллман) с особым вниманием к обеспечению использования безопасных параметров. Это предотвратит атаки на процесс установления ключа, которые могут привести к атакам «человек посередине» или криптографическим взломам.3V11.77Шифрование данных в процессе использованияV11.7.11Убедитесь, что используется полное шифрование памяти, которое защищает конфиденциальные данные во время их использования, предотвращая доступ к ним неавторизованных пользователей или процессов.3V11.7.22Убедитесь, что минимизация данных обеспечивает раскрытие минимально необходимого объёма данных во время обработки, а также что данные шифруются сразу после использования или как можно скорее.3V1212SecureБезопасная коммуникацияV12.11Общие рекомендации по безопасности TLSV12.1.11Убедитесь, что включены только актуальные и рекомендуемые версии протокола TLS, такие как TLS 1.2 и TLS 1.3. Наиболее свежая версия TLS должна быть выбрана как предпочтительная.1V12.1.22Убедитесь, что включены рекомендуемые шифронаборы (cipher suites), предпочтение также стоит отдать самому сильному шифронабору. L3 приложения должны поддерживать только те наборы шифров (cipher suites), которые обеспечивают прямую (forward) секретность. Пояснение: Прямая секретность (Forward Secrecy, FS) — это криптографическая особенность, при которой сессионные ключи уникальны для каждой сессии и не зависят от долгосрочных ключей. Это гарантирует, что даже при компрометации долгосрочного ключа злоумышленник не сможет расшифровать ранее перехваченные зашифрованные сессии.2V12.1.33Убедитесь, что приложение проверяет доверенность клиентских сертификатов mTLS, прежде чем использовать идентификацию по сертификату для аутентификации или авторизации.2V12.1.44Убедитесь, что включена и настроена правильная проверка отзыва сертификатов, такая как Online Certificate Status Protocol (OCSP) Stapling.3V12.1.55Убедитесь, что в настройках TLS приложения включена функция Encrypted Client Hello (ECH) для предотвращения раскрытия конфиденциальных метаданных, таких как Server Name Indication (SNI), во время процесса TLS-рукопожатия.3V12.22HTTPS коммуникация с внешними сервисамиV12.2.11Убедитесь, что для всех соединений между клиентом и внешними HTTP-сервисами используется TLS и не происходит отката к небезопасным или незашифрованным протоколам.1V12.2.22Убедитесь, что внешние сервисы используют публично доверенные TLS-сертификаты.1V12.33Общая безопасность межсервисного взаимодействияV12.3.11Убедитесь, что для всех входящих и исходящих соединений приложения используется зашифрованный протокол, например TLS, включая системы мониторинга, инструменты управления, удалённый доступ и SSH, промежуточное ПО, базы данных, мейнфреймы, партнёрские системы и внешние API. Сервер не должен допускать откат к небезопасным или незашифрованным протоколам.2V12.3.22Убедитесь, что TLS-клиент проверяет сертификат сервера до установления защищенного соединения с TLS-сервером.2V12.3.33Убедитесь, что все внутренние HTTP-взаимодействия между компонентами приложения используют TLS или другой подходящий механизм транспортного шифрования, и не происходит откат к небезопасным или незашифрованным коммуникациям.2V12.3.44Убедитесь, что TLS-соединения между внутренними сервисами используют доверенные сертификаты. Если используются внутренние или самоподписанные сертификаты, потребляющий сервис должен быть настроен на доверие только к конкретным внутренним центрам сертификации (CA) и конкретным самоподписанным сертификатам.2V12.3.55Убедитесь, что сервисы, взаимодействующие внутри системы (intra-service communications), используют строгую аутентификацию для проверки каждого конечного узла. Для проверки подлинности взаимодействующих сторон должны применяться методы строгой аутентификации, такие как аутентификация TLS-клиента, с использованием инфраструктуры открытых ключей и механизмов, устойчивых к атакам повтора (replay attacks). Для микросервисных архитектур рекомендуется использование service mesh для упрощения управления сертификатами и повышения безопасности.3V1313ConfigurationКонфигурацияV13.11Документация конфигурацииV13.1.11Убедитесь, что все необходимые доступы приложения задокументированы. Сюда должны быть включены как внешние сервисы, от которых зависит приложение, так и сценарии, когда конечный пользователь может задавать адреса для внешнего подключения.2V13.1.22Убедитесь, что для каждого сервиса, используемого приложением, в документации определено максимальное количество одновременных соединений (например, лимиты пула соединений) и описано поведение приложения при достижении этого лимита, включая любые механизмы отказоустойчивости или восстановления, чтобы предотвратить ситуации отказа в обслуживании (DoS).3V13.1.33Убедитесь, что в документации приложения определены стратегии управления ресурсами для каждой внешней системы или сервиса, которые оно использует (например, базы данных, файловые дескрипторы, потоки, HTTP-соединения). Стратегии должны включать процедуры освобождения ресурсов, настройки таймаутов, обработку сбоев, а также, если реализована логика повторных попыток, указание лимитов, задержек и алгоритмов back-off. Для синхронных HTTP-запросов должны быть заданы короткие таймауты, а повторные запросы должны быть отключены, либо строго ограничены по числу попыток, чтобы предотвратить каскадные задержки и истощение ресурсов.3V13.1.44Убедитесь, что в документации приложения определены секреты, критически важные для безопасности приложения, а также установлен график их ротации в соответствии с моделью угроз организации и её бизнес-требованиями.3V13.22Конфигурация бэкенд соединенийV13.2.11Убедитесь, что коммуникации между компонентами бэкенда приложения (включая API, промежуточное ПО и уровни данных), которые не поддерживают стандартный механизм пользовательских сессий, проходят с аутентификацией. Аутентификация должна использовать индивидуальные сервисные аккаунты, краткосрочные токены или аутентификацию на основе сертификатов, а не постоянные учётные данные, такие как пароли, API-ключи или общие аккаунты с привилегированным доступом.2V13.2.22Убедитесь, что коммуникации между компонентами бэкенда приложения, включая локальные или системные службы, API, промежуточное ПО и уровни данных, выполняются с использованием аккаунтов, которым назначены минимально необходимые привилегии.2V13.2.33Убедитесь, что если для аутентификации в сервисе используются учётные данные, то используемые потребителем учётные данные не являются стандартными (например, root/root или admin/admin).2V13.2.44Убедитесь, что используется белый список (allowlist) для определения внешних ресурсов или систем, с которыми приложению разрешено взаимодействовать (например, для исходящих запросов, загрузки данных или доступа к файлам). Этот белый список может быть реализован на уровне приложения, веб-сервера, межсетевого экрана или комбинации различных уровней.2V13.2.55Убедитесь, что веб- или прикладной сервер настроен с белым списком ресурсов или систем, к которым сервер может отправлять запросы или из которых может загружать данные и файлы.2V13.2.66Убедитесь, что при подключении приложения к другим сервисам соблюдается задокументированная конфигурация для каждого соединения, включая максимальное количество параллельных соединений, поведение при достижении их максимума, таймауты и стратегии повторных попыток подключения.3V13.33Управление секретамиV13.3.11Убедитесь, что для безопасного создания, хранения, контроля доступа и уничтожения секретов бэкенда используется решение для управления секретами, например, хранилище ключей (key vault). Секретами могут быть пароли, ключевой материал, интеграции с базами данных и сторонними системами, ключи и seed-значения для токенов с ограниченным временем действия, другие внутренние секреты и API-ключи. Секреты не должны включаться в исходный код приложения или артефакты сборки. Для приложений уровня L3 необходимо использовать аппаратное решение, например, аппаратный модуль безопасности (HSM).2V13.3.22Убедитесь, что доступ к секретным ресурсам осуществляется в соответствии с принципом минимально необходимых привилегий (least privilege).2V13.3.33Убедитесь, что все криптографические операции выполняются с использованием изолированного модуля безопасности (например, хранилища ключей или аппаратного модуля безопасности), чтобы надежно управлять ключевым материалом и защищать его от утечки за пределы модуля безопасности.3V13.3.44Убедитесь, что секреты настроены на срок действия и ротацию в соответствии с документацией приложения.3V13.44Непреднамеренная утечка информацииV13.4.11Убедитесь, что приложение развернуто либо без метаданных систем контроля версий (включая папки .git или .svn), либо так, чтобы эти папки были недоступны как извне, так и для самого приложения.1V13.4.22Убедитесь, что режимы отладки отключены для всех компонентов в промышленной среде, чтобы предотвратить раскрытие функций отладки и утечку информации.2V13.4.33Убедитесь, что веб-серверы не показывают клиентам списки содержимого каталогов, если это явно не предусмотрено.2V13.4.44Убедитесь, что метод HTTP TRACE не поддерживается в продуктовой среде, чтобы избежать потенциальной утечки информации.2V13.4.55Убедитесь, что документация (например, по внутренним API) и мониторинговые эндпоинты не доступны, если это явно не предусмотрено.2V13.4.66Убедитесь, что приложение не раскрывает подробную информацию о версиях компонентов бэкенда.3V13.4.77Убедитесь, что веб-слой настроен на обслуживание только файлов с определёнными расширениями, чтобы предотвратить непреднамеренную утечку информации, конфигураций и исходного кода.3V1414DataЗащита информацииV14.11Документация по защите информацииV14.1.11Убедитесь, что все конфиденциальные данные, создаваемые и обрабатываемые приложением, идентифицированы и классифицированы по уровням защиты. Включая закодированные данные, которые легко декодируются, например, строки Base64 или незашифрованные данные в полезной нагрузке JWT. Уровни защиты должны учитывать требования по защите данных и конфиденциальности, которым должно соответствовать приложение.2V14.1.22Убедитесь, что для каждого уровня защиты конфиденциальных данных требования к защите задокументированы. Они должны включать (но не ограничиваться) требования по шифрованию, проверке целостности, срокам хранения, способам логирования данных, контролю доступа к чувствительным данным в логах, шифрованию на уровне базы данных, применению технологий повышения конфиденциальности, а также другим требованиям по конфиденциальности.2V14.22Базовые меры по защите информацииV14.2.11Убедитесь, что конфиденциальные данные передаются на сервер только в теле HTTP-запроса или в заголовках. URL и строка запроса не должны содержать конфиденциальную информацию, такую как API-ключ или сессионный токен.1V14.2.22Убедитесь, что приложение предотвращает кэширование конфиденциальных данных в серверных компонентах, таких как балансировщики нагрузки и кэши приложений, либо гарантирует их надежное удаление после использования.2V14.2.33Убедитесь, что заранее определённые конфиденциальные данные не отправляются ненадёжным сторонам (например, системам трекинга пользователей), чтобы предотвратить нежелательный сбор данных вне контроля приложения.2V14.2.44Убедитесь, что для конфиденциальных данных реализованы меры по шифрованию, проверке целостности, срокам хранения, способам логирования, контролю доступа к данным в логах, а также применяются технологии повышения конфиденциальности в соответствии с документацией для соответствующего уровня защиты данных.2V14.2.55Убедитесь, что механизмы кэширования настроены так, чтобы кэшировать только ответы с ожидаемым типом содержимого для данного ресурса и не содержать конфиденциального динамического контента. При обращении к несуществующему файлу, веб-сервер должен возвращать ответ 404 или 302, а не подменять на другой существующий файл, что позволит предотвратить атаки типа Web Cache Deception.3V14.2.66Убедитесь, что приложение возвращает только минимально необходимый объем конфиденциальных данных для выполнения своей функциональности. Например, показывает только часть цифр номера кредитной карты, а не полный номер. Если требуется отображение полных данных, они должны быть замаскированы в пользовательском интерфейсе, пока пользователь специально не запросил их просмотр.3V14.2.77Убедитесь, что конфиденциальная информация подлежит классификации по срокам хранения, чтобы устаревшие или ненужные данные удалялись автоматически, по расписанию или по мере необходимости.3V14.2.88Убедитесь, что конфиденциальная информация удаляется из метаданных файлов, загружаемых пользователями, если пользователь явно не согласился на ее хранение.3V14.33Защита данных на стороне клиентаV14.3.11Убедитесь, что аутентифицированные данные очищаются из клиентского хранилища, например, из DOM браузера, после завершения работы клиента или сессии. Заголовок HTTP-ответа Clear-Site-Data может помочь в этом, но клиентская сторона также должна уметь очищать данные, если соединение с сервером недоступно при завершении сессии.1V14.3.22Убедитесь, что приложение устанавливает HTTP-заголовки, достаточные для предотвращения кэширования (например, Cache-Control: no-store), чтобы конфиденциальные данные не сохранялись в браузерах.2V14.3.33Убедитесь, что данные, хранящиеся в браузерном хранилище (например, localStorage, sessionStorage, IndexedDB или cookie), не содержат конфиденциальной информации, за исключением сессионных токенов.2V1515SecureБезопасная разработка и архитектураV15.11Документация по безопасной разработке и архитектуреV15.1.11Убедитесь, что в документации по приложению определены сроки устранения уязвимостей на основе оценки рисков для внешних зависимостей с уязвимостями и для обновления библиотек в целом, чтобы минимизировать риск, связанный с этими компонентами.1V15.1.22Убедитесь, что ведется реестр всех используемых сторонних библиотек (например, Software Bill of Materials, SBOM), с обязательной проверкой, что компоненты получены из предопределенных, доверенных и регулярно поддерживаемых репозиториев.2V15.1.33Убедитесь, что в документации приложения указан функционал, требующий значительных временных или вычислительных ресурсов. Необходимо указать, как предотвратить потерю доступности из-за чрезмерного использования этого функционала и как избежать ситуаций, когда формирование ответа занимает больше времени, чем установленный системой таймаут. Возможные меры защиты могут включать асинхронную обработку, использование очередей и ограничение количества параллельных процессов для каждого пользователя и приложения.2V15.1.44Убедитесь, что в документации приложения указаны внешние библиотеки, которые считаются «компонентами с повышенным риском».3V15.1.55Убедитесь, что в документации приложения выделены те части приложения, в которых используются «функционал с повышенным риском».3V15.22Архитектура безопасности и зависимостиV15.2.11Убедитесь, что приложение содержит только те компоненты, которые не нарушили задокументированные сроки обновления и исправления.1V15.2.22Убедитесь, что в приложении реализованы меры защиты от потери доступности из-за функциональности, требующей много времени или ресурсов, на основе задокументированных решений и стратегий безопасности для этого.2V15.2.33Убедитесь, что производственная среда включает только те функции, которые необходимы для работы приложения, и не предоставляет лишние функции, такие как тестовый код, примеры кода и инструменты разработки.2V15.2.44Убедитесь, что сторонние компоненты и все их транзитивные зависимости загружаются только из ожидаемых репозиториев (внутренних или внешних) и отсутствует риск атаки через подмену зависимостей (dependency confusion attack)3V15.2.55Убедитесь, что приложение реализует дополнительные меры защиты для тех частей приложения, которые документированы как содержащие «функционал с повышенным риском» или использующие сторонние библиотеки, считающиеся «функционалом с повышенным риском». Это могут быть такие методы, как «песочница», инкапсуляция, контейнеризация или изоляция на сетевом уровне, чтобы задержать и предотвратить продвижение (pivoting) злоумышленников, скомпрометировавших одну часть приложения, к другим частям приложения.3V15.33Безопасное программированиеV15.3.11Убедитесь, что приложение возвращает только необходимое подмножество полей из объекта данных. Например, оно не должно возвращать весь объект данных, поскольку некоторые отдельные поля должны быть недоступны пользователям.1V15.3.22Убедитесь, что при вызовах внешних URL-адресов бэкэнд приложения настроен так, чтобы не выполнять перенаправления, если только это не предусмотрено функционалом.2V15.3.33Убедитесь, что в приложении реализованы защитные механизмы против атак типа массового присвоения (mass assignment) путем строгого ограничения разрешенных полей для каждого контроллера и действия, исключая возможность добавления или изменения значений полей, которые не должны быть доступны для данной конкретной операции.2V15.3.44Убедитесь, что все прокси и промежуточное ПО корректно передают исходный IP-адрес пользователя, используя доверенные поля данных, которые не могут быть изменены конечным пользователем, а приложение и веб-сервер используют это правильное значение для ведения логирования и принятия решений по безопасности, таких как ограничение запросов. При этом следует учитывать, что даже исходный IP-адрес может быть ненадежным из-за динамических IP-адресов, VPN или корпоративных файрволов.2V15.3.55Убедитесь, что приложение явно проверяет соответствие переменных ожидаемому типу данных и использует строгие операции сравнения. Это необходимо для предотвращения уязвимостей, связанных с type juggling и type confusion, вызванных тем, что код приложения делает предположения о типе переменной.2V15.3.66Убедитесь, что JavaScript-код написан таким образом, чтобы предотвратить prototype pollution, например, используя Set() или Map() вместо обычных литералов объекта.2V15.3.77Убедитесь, что приложение защищено от атак типа HTTP Parameter Pollution (HPP), особенно если используемый фреймворк не различает источники параметров запроса (строка запроса, тело запроса, куки или заголовки).2V15.44Безопасная работа с параллельными процессамиV15.4.11Убедитесь, что к общим объектам в многопоточном коде (например, кэшам, файлам или объектам в памяти, используемым несколькими потоками) используется безопасный многопоточный доступ и механизмов синхронизации, таких как блокировки или семафоры, чтобы избежать состояний гонки и повреждения данных.3V15.4.22Убедитесь, что проверки состояния ресурса, например его существования или разрешений, а также зависящие от него действия выполняются как одна атомарная операция, чтобы предотвратить условия гонки времени проверки и времени использования (TOCTOU). Например, проверка существования файла перед его открытием или проверка прав доступа пользователя перед его предоставлением.3V15.4.33Убедитесь, что блокировки применяются согласованно, чтобы предотвратить взаимные блокировки потоков (deadlocks) или их бесконечные повторы, а также что логика блокировки инкапсулирована в коде, отвечающем за управление ресурсом. Это гарантирует, что блокировки не могут быть случайно или намеренно изменены внешними классами или кодом.3V15.4.44Убедитесь, что политики распределения ресурсов предотвращают нехватку ресурсов у потоков, обеспечивая справедливый доступ к ресурсам, например, используя пулы потоков, позволяя потокам с более низким приоритетом выполняться в течение разумного периода времени.3V1616SecurityЖурналирование событий безопасности и обработка ошибокV16.11Документация по ведению логовV16.1.11Убедитесь в существовании реестра, в котором документируется ведение журнала на каждом уровне технологического стека приложения, включая какие события регистрируются, форматы логов, где хранятся эти журналы, как они используются, как контролируется доступ к ним и как долго хранятся журналы.2V16.22Общее журналированиеV16.2.11Убедитесь, что каждая запись журнала содержит необходимые метаданные (например, когда, где, кто, что), которые позволят провести подробное исследование временной шкалы, когда произошло событие.2V16.2.22Убедитесь, что все источники времени компонентов системы журналирования синхронизированы, а временные метки в метаданных событий безопасности используют UTC или содержат явное указание смещения часового пояса. Рекомендуется применять UTC для обеспечения согласованности в распределённых системах и предотвращения ошибок при переходе на летнее/зимнее время.2V16.2.33Убедитесь, что приложение записывает и передаёт логи исключительно в те файлы и сервисы, которые указаны в реестре журналирования.2V16.2.44Убедитесь, что логи могут быть прочитаны и коррелированы используемой системой обработки журналов, предпочтительно с использованием общего стандартного формата логирования.2V16.2.55Убедитесь, что приложение применяет соответствующие меры защиты при логировании конфиденциальных данных в зависимости от уровня их чувствительности: например, полностью запрещает запись в логи таких данных, как учетные данные или платежные реквизиты, а для других данных (например, сессионных токенов) использует хеширование или частичное/полное маскирование.2V16.33Инциденты безопасностиV16.3.11Убедитесь, что все операции аутентификации регистрируются, включая успешные и неудачные попытки. Также следует фиксировать дополнительные метаданные, такие как тип аутентификации или использованные факторы проверки.2V16.3.22Убедитесь, что ведется журнал неудачных попыток авторизации. Для уровня L3 это должно включать в себя журналирование всех решений об авторизации, включая журналирование доступа к конфиденциальным данным (без регистрации самих конфиденциальных данных).2V16.3.33Убедитесь, что приложение регистрирует все события безопасности, определенные в документации, а также фиксирует попытки обхода механизмов защиты, включая проверку входных данных, бизнес-логики и системы защиты от автоматизированных атак.2V16.3.44Убедитесь, что приложение регистрирует в журналах неожиданные ошибки и сбои механизмов безопасности, включая, например, ошибки TLS-соединения на стороне сервера.2V16.44Защита журналовV16.4.11Убедитесь, что все компоненты системы логирования корректно кодируют данные, чтобы предотвратить атаки типа внедрения в журналы (log injection).2V16.4.22Убедитесь, что логи защищены от неавторизованного доступа и не могут быть модифицированы.2V16.4.33Убедитесь, что логи безопасно передаются в логически изолированную систему для анализа, обнаружения угроз, генерации оповещений и эскалации инцидентов. Это гарантирует сохранность журналов даже в случае компрометации основного приложения.2V16.55Обработка ошибокV16.5.11Убедитесь, что при возникновении непредвиденной или связанной с безопасностью ошибки пользователю возвращается только общее сообщение, гарантируя отсутствие раскрытия конфиденциальных внутренних данных системы, таких как трассировки стека, запросы, секретные ключи и токены.2V16.5.22Убедитесь, что приложение продолжает работать в безопасном режиме при недоступности внешних ресурсов, используя такие механизмы, как автоматические выключатели (circuit breakers) или плавное снижение функциональности (graceful degradation).2V16.5.33Убедитесь, что приложение корректно и безопасно завершает работу при возникновении исключений, предотвращая опасные сценарии по типу «fail-open», когда, например, транзакция ошибочно выполняется, несмотря на ошибки в логике валидации.2V16.5.44Убедитесь, что определён обработчик ошибок «крайние меры», который будет перехватывать все необработанные ошибки. Это необходимо как для предотвращения потери информации об ошибках, которая должна быть записана в файлы журналов, так и для того, чтобы ошибка не остановила весь процесс приложения, что привело бы к потере доступности.3V1717WebRTCWebRTCV17.11TURN-серверV17.1.11Убедитесь, что сервис TURN (Traversal Using Relays around NAT) разрешает доступ только к IP-адресам, не зарезервированным для специальных целей (например, внутренние сети, широковещательная рассылка, loopback-адреса). Данное требование применяется как к IPv4, так и к IPv6 адресам.2V17.1.22Убедитесь, что сервис TURN (Traversal Using Relays around NAT) защищен от исчерпания ресурсов при попытках легитимных пользователей открыть чрезмерное количество портов на сервере.3V17.22Требования к медиасерверамV17.2.11Убедитесь, что ключ сертификата Datagram Transport Layer Security (DTLS) управляется и защищается в соответствии с документированной политикой управления криптографическими ключами.2V17.2.22Убедитесь, что медиасервер настроен на использование только одобренных наборов шифров Datagram Transport Layer Security (DTLS) и защищенного профиля безопасности для расширения DTLS, применяемого при установке ключей для Secure Real-time Transport Protocol (DTLS-SRTP).2V17.2.33Убедитесь, что медиасервер проверяет аутентификацию Secure Real-time Transport Protocol (SRTP) для предотвращения атак с внедрением Real-time Transport Protocol (RTP), которые могут привести к отказу в обслуживании (Denial of Service) или вставке поддельного аудио-/видеоконтента в медиапотоки.2V17.2.44Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика при получении некорректных пакетов Secure Real-time Transport Protocol (SRTP).2V17.2.55Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетами Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.3V17.2.66Убедитесь, что медиасервер не подвержен уязвимости «Гонка ClientHello» (ClientHello Race Condition) в Datagram Transport Layer Security (DTLS), проверив наличие известных уязвимостей в публичных источниках или выполнив тестирование на воспроизведение условий гонки.3V17.2.77Убедитесь, что механизмы аудио- и видеозаписи, связанные с медиасервером, способны продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетов Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.3V17.2.88Убедитесь, что сертификат Datagram Transport Layer Security (DTLS) проверяется на соответствие атрибуту отпечатка (fingerprint) в Session Description Protocol (SDP), с немедленным прекращением медиапотока в случае несоответствия — это гарантирует подлинность передаваемых данных.3V17.33СигнализацияV17.3.11Убедитесь, что сигнальный сервер способен продолжать обработку легитимных входящих сообщений сигнализации даже в условиях флуд-атаки. Для этого необходимо реализовать механизм ограничения частоты запросов (rate limiting) на уровне сигнализации.2V17.3.22Убедитесь, что сигнальный сервер способен продолжать обработку легитимных сообщений сигнализации даже при получении некорректных сообщений, которые могут вызвать отказ в обслуживании (Denial of Service, DoS). Для этого необходимо реализовать: проверку входных данных (input validation), безопасную обработку целочисленных переполнений (integer overflows), защиту от переполнения буферов (buffer overflows) и другие надежные методы обработки ошибок.2 diff --git a/5.0/docs_ru/ru b/5.0/docs_ru/ru new file mode 100644 index 0000000000..e69de29bb2 diff --git a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.cdx.json b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.cdx.json new file mode 100644 index 0000000000..0a861097af --- /dev/null +++ b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.cdx.json @@ -0,0 +1,3029 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.6", + "serialNumber": "urn:uuid:43ba8da1-08c5-467c-8d5f-003dcc94f473", + "version": 1, + "metadata": { + "timestamp": "2025-10-12T15:34:49+00:00", + "licenses": [ + { + "license": { + "id": "CC-BY-SA-4.0", + "url": "https://creativecommons.org/licenses/by-sa/4.0/legalcode.txt" + } + } + ], + "supplier": { + "name": "OWASP Foundation", + "url": [ + "https://owasp.org" + ] + } + }, + "declarations": { + "standards": [ + { + "bom-ref": "ASVS-", + "name": "Application Security Verification Standard (ASVS)", + "version": "", + "description": "The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.", + "owner": "Application Security Verification Standard Project", + "requirements": [ + { + "bom-ref": "V1", + "identifier": "V1", + "title": "Kodlama (Encoding) ve Temizleme" + }, + { + "bom-ref": "V1.1", + "identifier": "V1.1", + "title": "Kodlama ve Temizleme Mimarisi", + "parent": "V1" + }, + { + "bom-ref": "V1.1.1", + "identifier": "V1.1.1", + "text": "Girdinin yalnızca bir kez kanonik forma (canonical form) çözümlendiği veya kaçış işlemlerinin kaldırıldığı, bu işlemin yalnızca verinin bu biçimde beklenmesi durumunda yapıldığı ve bu işlemin girdi doğrulama veya temizleme işlemlerinden sonra değil, önce gerçekleştiği doğrulanmalıdır.", + "parent": "V1.1" + }, + { + "bom-ref": "V1.1.2", + "identifier": "V1.1.2", + "text": "Uygulamanın, çıktıyı kullanılması gereken yorumlayıcıya verilmeden hemen önce veya yorumlayıcının kendisi tarafından çıktı kodlaması ya da kaçış işlemi yaptığı doğrulanmalıdır.", + "parent": "V1.1" + }, + { + "bom-ref": "V1.2", + "identifier": "V1.2", + "title": "Enjeksiyon Önleme", + "parent": "V1" + }, + { + "bom-ref": "V1.2.1", + "identifier": "V1.2.1", + "text": "HTTP yanıtı, HTML veya XML belgesi için yapılan çıktı kodlamasının; HTML elemanları, HTML öznitelikleri, HTML yorumları, CSS ya da HTTP başlık alanları gibi bağlamlara uygun olduğu doğrulanmalıdır. Böylece mesaj veya belge yapısının bozulması önlenir.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.2", + "identifier": "V1.2.2", + "text": "Dinamik olarak URL oluşturulurken, güvenilmeyen verinin bağlamına göre (örneğin, sorgu veya yol parametreleri için URL kodlaması ya da base64url kodlaması) kodlandığı doğrulanmalıdır. Yalnızca güvenli URL protokollerine izin verilmelidir (örneğin, javascript: veya data: yasaklanmalıdır).", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.3", + "identifier": "V1.2.3", + "text": "JavaScript içeriği (JSON dahil) dinamik olarak oluşturulurken çıktı kodlama/kaçış kullanıldığı doğrulanmalıdır. Böylece mesaj veya belge yapısı değiştirilmemiş olur (JavaScript ve JSON enjeksiyonlarının önüne geçilir).", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.4", + "identifier": "V1.2.4", + "text": "Veri sorguları veya veritabanı sorguları (SQL, HQL, NoSQL, Cypher vb.) için parametreli sorgular, ORM’ler, entity framework’ler kullanıldığı ya da SQL enjeksiyonu ve diğer veritabanı enjeksiyon saldırılarına karşı koruma sağlandığı doğrulanmalıdır. Bu durum, saklı yordam (stored procedure) yazarken de geçerlidir.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.5", + "identifier": "V1.2.5", + "text": "Uygulamanın işletim sistemi komut enjeksiyonlarına karşı korunduğu ve işletim sistemi çağrılarında parametreli OS sorguları veya bağlama özgü komut satırı çıktı kodlamasının kullanıldığı doğrulanmalıdır.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.6", + "identifier": "V1.2.6", + "text": "Uygulamanın LDAP enjeksiyon zafiyetlerine karşı korunduğu ya da LDAP enjeksiyonlarını önlemek için özel güvenlik kontrollerinin uygulandığı doğrulanmalıdır.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.7", + "identifier": "V1.2.7", + "text": "XPath enjeksiyon saldırılarına karşı, sorgu parametrelemesi veya önceden derlenmiş sorgular kullanılarak koruma sağlandığı doğrulanmalıdır.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.8", + "identifier": "V1.2.8", + "text": "LaTeX işlemcilerinin güvenli şekilde yapılandırıldığı (örneğin, --shell-escape bayrağının kullanılmadığı) ve yalnızca izin verilen komutlardan oluşan bir listeyle çalıştırıldığı doğrulanmalıdır.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.9", + "identifier": "V1.2.9", + "text": "Düzenli ifadelerde (regex) özel karakterlerin (genellikle ters eğik çizgi \\ ile) kaçırılarak meta karakter olarak yorumlanmalarının önlendiği doğrulanmalıdır.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.10", + "identifier": "V1.2.10", + "text": "Uygulamanın CSV ve formül enjeksiyonlarına karşı korunduğu doğrulanmalıdır. Uygulama, CSV içeriği dışa aktarırken RFC 4180 Bölüm 2.6 ve 2.7'de tanımlanan kaçış kurallarına uymalıdır. Ayrıca, CSV veya diğer tablo formatlarına (XLS, XLSX, ODF gibi) aktarım yapılırken, alanın ilk karakteri olarak çıkan özel karakterler ('=', '+', '-', '@', '\\t' (sekme), '\\0' (null karakter)) tek tırnak (') ile kaçırılmalıdır.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.3", + "identifier": "V1.3", + "title": "Temizleme (Sanitization)", + "parent": "V1" + }, + { + "bom-ref": "V1.3.1", + "identifier": "V1.3.1", + "text": "WYSIWYG editörlerinden veya benzer kaynaklardan gelen tüm güvenilmeyen HTML girdilerinin, bilinen ve güvenli bir HTML temizleme kütüphanesi ya da çerçeve özelliği ile temizlendiği doğrulanmalıdır.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.2", + "identifier": "V1.3.2", + "text": "Uygulamanın eval() veya Spring Expression Language (SpEL) gibi dinamik kod çalıştırma özelliklerini kullanmaktan kaçındığı doğrulanmalıdır. Alternatif yoksa, kullanıcı girdisi çalıştırılmadan önce mutlaka temizlenmelidir.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.3", + "identifier": "V1.3.3", + "text": "Potansiyel olarak tehlikeli bir bağlamda kullanılacak verilerin, bu bağlama uygun karakterlere izin vermek ve çok uzun girdileri kısaltmak gibi güvenlik önlemleriyle önceden temizlendiği doğrulanmalıdır.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.4", + "identifier": "V1.3.4", + "text": "Kullanıcı tarafından sağlanan SVG içeriğinin, yalnızca güvenli etiket ve özellikler (örneğin grafik çizme ile ilgili) içerdiğinden emin olmak için onaylandığı veya temizlendiği doğrulanmalıdır (ör. script veya foreignObject içermemelidir).", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.5", + "identifier": "V1.3.5", + "text": "Markdown, CSS, XSL stil sayfaları, BBCode veya benzeri ifade şablon dillerinde kullanıcı girdisinin temizlendiği veya bu tür özelliklerin devre dışı bırakıldığı doğrulanmalıdır.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.6", + "identifier": "V1.3.6", + "text": "Uygulamanın, güvenilmeyen verileri başka servislere iletmeden önce izinli protokol, alan adı, yol ve port listelerine göre doğruladığı ve tehlikeli karakterleri temizlediği doğrulanarak SSRF (Sunucu Taraflı İstek Sahteciliği) saldırılarına karşı korunduğu doğrulanmalıdır.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.7", + "identifier": "V1.3.7", + "text": "Uygulamanın şablon enjeksiyon saldırılarına karşı, güvenilmeyen girdilere dayalı şablon oluşturmayı engellediği; eğer bu kaçınılmazsa, bu girdilerin mutlaka temizlendiği veya sıkı şekilde onaylandığı doğrulanmalıdır.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.8", + "identifier": "V1.3.8", + "text": "JNDI sorgularında kullanılmadan önce güvenilmeyen girdilerin temizlendiği ve JNDI'nin enjeksiyonlara karşı güvenli şekilde yapılandırıldığı doğrulanmalıdır.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.9", + "identifier": "V1.3.9", + "text": "Memcache’e gönderilmeden önce içeriğin temizlenerek enjeksiyon saldırılarına karşı korunduğu doğrulanmalıdır.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.10", + "identifier": "V1.3.10", + "text": "Format dizgilerinin (format strings) beklenmeyen veya zararlı şekilde çözümlenmesini önlemek için işlenmeden önce temizlendiği doğrulanmalıdır.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.11", + "identifier": "V1.3.11", + "text": "SMTP veya IMAP enjeksiyonlarını önlemek için, kullanıcı girdisinin posta sistemlerine iletilmeden önce temizlendiği doğrulanmalıdır.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.12", + "identifier": "V1.3.12", + "text": "Regex girdilerinin üstel geri izlemeye (exponential backtracking) neden olan öğeler içermediği ve güvenilmeyen girdilerin ReDoS (Regex Denial of Service) gibi saldırılara karşı temizlendiği doğrulanmalıdır.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.4", + "identifier": "V1.4", + "title": "Bellek, Dizgi ve Yönetilmeyen Kod", + "parent": "V1" + }, + { + "bom-ref": "V1.4.1", + "identifier": "V1.4.1", + "text": "Yığın, arabellek (buffer) veya yığın belleği taşmalarını önlemek ya da tespit etmek amacıyla, bellek güvenli dizgi işlemlerinin, daha güvenli bellek kopyalama ve işaretçi aritmetiğinin kullanıldığı doğrulanmalıdır.", + "parent": "V1.4" + }, + { + "bom-ref": "V1.4.2", + "identifier": "V1.4.2", + "text": "Tamsayı taşmalarını önlemek için işaret (sign), aralık (range) ve giriş doğrulama tekniklerinin kullanıldığı doğrulanmalıdır.", + "parent": "V1.4" + }, + { + "bom-ref": "V1.4.3", + "identifier": "V1.4.3", + "text": "Dinamik olarak ayrılan belleğin ve kaynakların serbest bırakıldığı ve boşaltılan belleklere ait referansların veya işaretçilerin kaldırıldığı veya null yapıldığı doğrulanmalıdır (dangling pointer ve use-after-free zafiyetlerine karşı).", + "parent": "V1.4" + }, + { + "bom-ref": "V1.5", + "identifier": "V1.5", + "title": "Güvenli Ters Serileştirme (Safe Deserialization)", + "parent": "V1" + }, + { + "bom-ref": "V1.5.1", + "identifier": "V1.5.1", + "text": "XML ayrıştırıcılarının (parser) kısıtlayıcı şekilde yapılandırıldığı ve dış varlık çözümleme (external entity resolution) gibi güvensiz özelliklerin XXE (XML eXternal Entity) saldırılarına karşı devre dışı bırakıldığı doğrulanmalıdır .", + "parent": "V1.5" + }, + { + "bom-ref": "V1.5.2", + "identifier": "V1.5.2", + "text": "Güvenilmeyen verilerin ters serileştirilmesinde, nesne türleri için izinli liste kullanımı veya istemci tanımlı nesne türlerinin kısıtlanması gibi güvenli giriş işleme önlemlerinin uygulandığı doğrulanmalıdır. Güvensiz olarak tanımlanmış ters serileştirme mekanizmaları, güvenilmeyen girdilerle kullanılmamalıdır.", + "parent": "V1.5" + }, + { + "bom-ref": "V1.5.3", + "identifier": "V1.5.3", + "text": "Aynı veri türü için uygulamada kullanılan farklı parser'ların (ör. JSON, XML, URL parser'ları), veriyi tutarlı şekilde ayrıştırdığı ve aynı karakter kodlamasını kullandığı doğrulanmalıdır. Böylece JSON birlikte çalışabilirlik açıkları, URI veya dosya ayrıştırma farkları gibi sorunlar nedeniyle RFI veya SSRF saldırılarının istismar edilmesi önlenir.", + "parent": "V1.5" + }, + { + "bom-ref": "V2", + "identifier": "V2", + "title": "Doğrulama ve İş Mantığı" + }, + { + "bom-ref": "V2.1", + "identifier": "V2.1", + "title": "Doğrulama ve İş Mantığı Dokümantasyonu", + "parent": "V2" + }, + { + "bom-ref": "V2.1.1", + "identifier": "V2.1.1", + "text": "Uygulama dokümantasyonunda, veri öğelerinin beklenen yapıya göre nasıl doğrulanacağına ilişkin giriş doğrulama kurallarının tanımlandığı doğrulanmalıdır. Bu; kredi kartı numaraları, e-posta adresleri, telefon numaraları gibi yaygın veri biçimleri olabileceği gibi iç sistemlere özel biçimler de olabilir.", + "parent": "V2.1" + }, + { + "bom-ref": "V2.1.2", + "identifier": "V2.1.2", + "text": "Uygulama dokümantasyonunda, birleştirilmiş veri öğelerinin mantıksal ve bağlamsal tutarlılığının nasıl doğrulanacağı tanımlanmalıdır (örneğin, mahalle ve posta kodunun eşleşip eşleşmediğinin kontrolü).", + "parent": "V2.1" + }, + { + "bom-ref": "V2.1.3", + "identifier": "V2.1.3", + "text": "Hem kullanıcı bazında hem de uygulama genelinde geçerli olacak şekilde, iş mantığı sınırları ve doğrulama beklentilerinin belgelendiği doğrulanmalıdır.", + "parent": "V2.1" + }, + { + "bom-ref": "V2.2", + "identifier": "V2.2", + "title": "Girdi Doğrulama", + "parent": "V2" + }, + { + "bom-ref": "V2.2.1", + "identifier": "V2.2.1", + "text": "Girdilerin, işlevsel ya da iş gereksinimlerine uygunluğunun doğrulandığı teyit edilmelidir. Bu işlem; izinli değerler, desenler ve aralıklar listesine karşı pozitif doğrulama ile ya da girdinin beklenen yapıya ve mantıksal sınırlara uygunluğunun önceden tanımlanmış kurallara göre karşılaştırılması ile yapılmalıdır. Seviye 1 için bu, güvenlik veya iş kararlarında kullanılan girdilere odaklanabilir. Seviye 2 ve üstü için tüm girdilere uygulanmalıdır.", + "parent": "V2.2" + }, + { + "bom-ref": "V2.2.2", + "identifier": "V2.2.2", + "text": "Uygulamanın, güvenilir bir servis katmanında girdi doğrulama zorunluluğu uygulayacak şekilde tasarlandığı doğrulanmalıdır. İstemci tarafında gerçekleştirilen doğrulama, kullanılabilirliği artırabilir ve teşvik edilmelidir. Ancak bu doğrulama,güvenlik kontrolü olarak kabul edilmemelidir.", + "parent": "V2.2" + }, + { + "bom-ref": "V2.2.3", + "identifier": "V2.2.3", + "text": "Uygulamanın, ilişkili veri öğelerinin önceden tanımlanmış kurallara göre makul olup olmadığını kontrol ettiği doğrulanmalıdır.", + "parent": "V2.2" + }, + { + "bom-ref": "V2.3", + "identifier": "V2.3", + "title": "İş Mantığı Güvenliği", + "parent": "V2" + }, + { + "bom-ref": "V2.3.1", + "identifier": "V2.3.1", + "text": "Uygulamanın, aynı kullanıcı için iş mantığı akışlarını yalnızca beklenen adım sırasına göre ve adım atlamadan işlediği doğrulanmalıdır.", + "parent": "V2.3" + }, + { + "bom-ref": "V2.3.2", + "identifier": "V2.3.2", + "text": "İş mantığı sınırlarının, uygulama dokümantasyonuna uygun şekilde uygulandığı doğrulanmalıdır.", + "parent": "V2.3" + }, + { + "bom-ref": "V2.3.3", + "identifier": "V2.3.3", + "text": "İş mantığı seviyesinde işlemlerin (transaction) kullanıldığı ve bir iş mantığı işleminin ya bütünüyle başarıyla tamamlandığı ya da önceki geçerli duruma geri döndürüldüğü (rollback) doğrulanmalıdır.", + "parent": "V2.3" + }, + { + "bom-ref": "V2.3.4", + "identifier": "V2.3.4", + "text": "İş mantığı düzeyinde kilitleme mekanizmalarının, sınırlı kaynakların (ör. sinema koltukları, teslimat zamanları) uygulamanın mantığı manipüle edilerek çift rezervasyona neden olmamasını sağladığı doğrulanmalıdır.", + "parent": "V2.3" + }, + { + "bom-ref": "V2.3.5", + "identifier": "V2.3.5", + "text": "Yüksek değerli iş mantığı akışlarının, yetkisiz veya kazara gerçekleşebilecek işlemleri önlemek için çoklu kullanıcı onayı gerektirdiği doğrulanmalıdır. Bu işlemler büyük para transferleri, sözleşme onayları, gizli bilgilere erişim veya üretimde güvenlik kurallarının geçersiz kılınmaları gibi durumları içerebilir.", + "parent": "V2.3" + }, + { + "bom-ref": "V2.4", + "identifier": "V2.4", + "title": "Otomasyon Karşıtı Önlemler", + "parent": "V2" + }, + { + "bom-ref": "V2.4.1", + "identifier": "V2.4.1", + "text": "Uygulama işlevlerine yönelik aşırı miktardaki çağrılara karşı; veri sızdırma, anlamsız veri üretme, kota tüketme, hız sınırının aşılması, hizmet reddi (DoS) ya da maliyetli kaynakların aşırı kullanımı gibi risklere karşı otomasyon karşıtı kontrollerin bulunduğu doğrulanmalıdır.", + "parent": "V2.4" + }, + { + "bom-ref": "V2.4.2", + "identifier": "V2.4.2", + "text": "İş mantığı akışlarının, aşırı hızlı işlem gönderimlerini önleyecek şekilde gerçekçi insan zamanlaması gerektirdiği doğrulanmalıdır.", + "parent": "V2.4" + }, + { + "bom-ref": "V3", + "identifier": "V3", + "title": "Web Ön Uç (Frontend) Güvenliği" + }, + { + "bom-ref": "V3.1", + "identifier": "V3.1", + "title": "Web Frontend Güvenlik Dokümantasyonu", + "parent": "V3" + }, + { + "bom-ref": "V3.1.1", + "identifier": "V3.1.1", + "text": "Uygulama dokümantasyonunda, uygulamayı kullanan tarayıcıların desteklemesi gereken güvenlik özelliklerinin (ör. HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) ve diğer ilgili HTTP güvenlik mekanizmaları) tanımlandığı doğrulanmalıdır. Ayrıca bu özelliklerin mevcut olmadığı durumlarda uygulamanın nasıl davranması gerektiği (ör. kullanıcıyı uyarmak veya erişimi engellemek) de tanımlanmalıdır.", + "parent": "V3.1" + }, + { + "bom-ref": "V3.2", + "identifier": "V3.2", + "title": "İçeriğin Yanlış Yorumlanması", + "parent": "V3" + }, + { + "bom-ref": "V3.2.1", + "identifier": "V3.2.1", + "text": "Tarayıcıların HTTP yanıtlarında içerik veya işlevi yanlış bir bağlamda sunmalarını önlemek amacıyla güvenlik kontrollerinin uygulandığı doğrulanmalıdır (ör. API, kullanıcı tarafından yüklenen dosya veya başka bir kaynağın doğrudan çağrılması durumunda). Olası kontroller arasında; yalnızca HTTP istek başlıklarının (ör. Sec-Fetch-\\*) doğru bağlamı gösterdiği durumlarda içeriğin sunulması, Content-Security-Policy başlığında \"sandbox\" yönergesinin kullanılması veya Content-Disposition başlığında \"attachment\" biçiminin kullanılması yer alabilir.", + "parent": "V3.2" + }, + { + "bom-ref": "V3.2.2", + "identifier": "V3.2.2", + "text": "HTML yerine metin olarak görüntülenmesi amaçlanan içeriğin, HTML veya JavaScript gibi içeriklerin istenmeden çalıştırılmasını önleyecek şekilde \"createTextNode\" veya \"textContent\" gibi güvenli işleme fonksiyonlarıyla işlendiği doğrulanmalıdır.", + "parent": "V3.2" + }, + { + "bom-ref": "V3.2.3", + "identifier": "V3.2.3", + "text": "Uygulamanın istemci tarafı JavaScript kullanırken açık değişken tanımlamaları yaparak, sıkı tür kontrolü uygulayarak, global değişkenleri document nesnesine kaydetmekten kaçınarak ve ad alanı izolasyonu sağlayarak DOM clobbering’den kaçındığı doğrulanmalıdır.", + "parent": "V3.2" + }, + { + "bom-ref": "V3.3", + "identifier": "V3.3", + "title": "Çerez Yapılandırması", + "parent": "V3" + }, + { + "bom-ref": "V3.3.1", + "identifier": "V3.3.1", + "text": "Çerezlerin 'Secure' niteliğine sahip olduğu ve eğer çerez adı '\\__Host-' ön eki ile başlamıyorsa, '__Secure-' ön ekinin kullanıldığı doğrulanmalıdır.", + "parent": "V3.3" + }, + { + "bom-ref": "V3.3.2", + "identifier": "V3.3.2", + "text": "Kullanıcı arayüzü kandırma saldırılarına ve tarayıcı tabanlı istek sahteciliği saldırılarına (CSRF) karşı koruma sağlamak amacıyla, her çerezin 'SameSite' niteliğinin kullanım amacına uygun şekilde ayarlandığı doğrulanmalıdır.", + "parent": "V3.3" + }, + { + "bom-ref": "V3.3.3", + "identifier": "V3.3.3", + "text": "Çerez adı, diğer sunucularla paylaşılmak üzere açıkça tasarlanmadığı sürece '__Host-' ön eki ile tanımlanmalıdır.", + "parent": "V3.3" + }, + { + "bom-ref": "V3.3.4", + "identifier": "V3.3.4", + "text": "Bir çerez değeri istemci tarafı betikleri tarafından erişilememesi gereken bir veri içeriyorsa (ör. oturum token'ı), çerezin 'HttpOnly' niteliğine sahip olduğu ve aynı değerin (ör. oturum token'ı) yalnızca 'Set-Cookie' başlığı ile istemciye iletildiği doğrulanmalıdır.", + "parent": "V3.3" + }, + { + "bom-ref": "V3.3.5", + "identifier": "V3.3.5", + "text": "Uygulama bir çerez oluştururken, çerez adı ve değerinin toplam uzunluğunun 4096 baytı aşmadığı doğrulanmalıdır. Çok büyük çerezler tarayıcı tarafından saklanmaz ve isteklerle gönderilmez; bu da çereze bağlı çalışan uygulama işlevlerinin bozulmasına yol açabilir.", + "parent": "V3.3" + }, + { + "bom-ref": "V3.4", + "identifier": "V3.4", + "title": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", + "parent": "V3" + }, + { + "bom-ref": "V3.4.2", + "identifier": "V3.4.2", + "text": "Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header'ı, uygulama tarafından sabit bir değer olarak tanımlanmalı veya gelen Origin header değeri güvenilir origin’lerden oluşan bir izinli listeye karşı doğrulanmalıdır. ‘Access-Control-Allow-Origin: *’ kullanılması gerekiyorsa, yanıtın hassas bilgi içermediği doğrulanmalıdır.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.3", + "identifier": "V3.4.3", + "text": "HTTP yanıtlarında Content-Security-Policy header'ı bulunduğu ve bu header'ın yalnızca güvenilen içeriklerin veya kaynakların yüklenmesini ve çalıştırılmasını sağlayan yönergeler içerdiği doğrulanmalıdır. Minimum olarak \"global policy\", object-src 'none', base-uri 'none' yönergelerini içermeli ve izinli liste, nonce veya hash temelli bir yapı içermelidir. Seviye 3 uygulamalarında her yanıt için nonce veya hash içeren özel bir politika tanımlanmalıdır.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.4", + "identifier": "V3.4.4", + "text": "Tüm HTTP yanıtlarının 'X-Content-Type-Options: nosniff' header'ını içerdiği doğrulanmalıdır. Bu, tarayıcıya içerik türünü tahmin etmeyi bırakmasını ve yanıtın Content-Type header'ında belirtilen MIME türünün, beklenen kaynak türüyle eşleşmesini zorunlu kılar. Ayrıca bu, tarayıcıda CORB (Cross-Origin Read Blocking) özelliğini etkinleştirir.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.5", + "identifier": "V3.4.5", + "text": "Uygulamanın, 'Referer' başlığı yoluyla üçüncü taraflara teknik olarak hassas verilerin sızmasını önlemek için bir 'referrer policy' belirlediği doğrulanmalıdır. Bu, Referrer-Policy HTTP header'ıyla veya HTML öğe nitelikleriyle (element attributes) sağlanabilir. Sızabilecek hassas bilgiler, URL’deki yol ve sorgu parametreleri ile sınırlı uygulamalarda hostname bilgisini içerebilir.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.6", + "identifier": "V3.4.6", + "text": "Uygulamanın, Content-Security-Policy header'ı altında 'frame-ancestors' yönergesini her HTTP yanıtında tanımladığı ve bu sayede içeriklerin varsayılan olarak başka sayfalara gömülmesini engellediği doğrulanmalıdır. Gerekli durumlarda özel olarak izin verildiğinden emin olunmalıdır. 'X-Frame-Options' header'ı, tarayıcılar tarafından desteklenmesine rağmen, artık güncel değildir ve güvenlik amacıyla kullanılmamalıdır.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.8", + "identifier": "V3.4.8", + "text": "Bir belgenin işlenmesini ve sunulmasını başlatan tüm HTTP yanıtlarında (örneğin 'text/html' tipi yanıtlar), 'Cross-Origin-Opener-Policy' header'ı 'same-origin' veya 'same-origin-allow-popups' yönergeleriyle birlikte yer almalıdır. Bu, tabnabbing ve frame counting gibi, pencere nesnelerine paylaşımlı erişimi sömüren saldırılara karşı koruma sağlar.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.5", + "identifier": "V3.5", + "title": "Tarayıcı Menşei Ayırımı", + "parent": "V3" + }, + { + "bom-ref": "V3.5.1", + "identifier": "V3.5.1", + "text": "Uygulama, hassas işlevselliğe yönelik izinsiz cross-origin istekleri önlemek için CORS preflight mekanizmasına güvenmiyorsa, bu tür isteklerin gerçekten uygulamadan geldiği doğrulanmalıdır. Bu, anti-forgery token kullanımı veya CORS tarafından güvenli kabul edilmeyen özel HTTP header'larının zorunlu kılınmasıyla yapılabilir. Bu, tarayıcı tabanlı istek sahteciliği (CSRF) saldırılarına karşı bir savunmadır.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.2", + "identifier": "V3.5.2", + "text": "Uygulama, hassas işlevlerin izinsiz cross-origin çağrılmasını önlemek için CORS preflight mekanizmasına güveniyorsa, bu işlevlerin bir CORS-preflight isteğini tetiklemeden çağrılamadığı doğrulanmalıdır. Bu, 'Origin' ve 'Content-Type' header'larının doğrulanmasını veya CORS-safelisted olmayan bir header'ın ve alanın kullanılmasını gerektirebilir.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.4", + "identifier": "V3.5.4", + "text": "Farklı uygulamaların farklı hostname'lerde barındırıldığı ve böylece Same-Origin Policy tarafından sağlanan kısıtlamalardan (örneğin çerez erişim sınırları, kaynaklar arası etkileşim kontrolleri) faydalanıldığı doğrulanmalıdır.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.6", + "identifier": "V3.5.6", + "text": "Uygulamanın herhangi bir yerinde JSONP işlevselliğinin etkin olmadığı doğrulanmalıdır. Bu, XSSI (Cross-Site Script Inclusion) saldırılarını önlemek içindir.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.7", + "identifier": "V3.5.7", + "text": "Yetkilendirme gerektiren verilerin, JavaScript dosyaları gibi betik kaynaklarının yanıtlarında yer almadığı, XSSI saldırılarını önlemek için doğrulanmalıdır.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.8", + "identifier": "V3.5.8", + "text": "Kimliği doğrulanmış kaynakların (örneğin görseller, videolar, betikler ve belgeler) yalnızca gerçekten amaçlandığında kullanıcı adına yüklenebildiği veya gömülebildiği doğrulanmalıdır. Bu, isteğin uygun olmayan bir çapraz kaynak çağrısından kaynaklanmadığından emin olmak için Sec-Fetch-* HTTP istek başlığı alanlarının sıkı bir şekilde doğrulanmasıyla veya tarayıcıya döndürülen içeriği engelleme talimatı vermek için kısıtlayıcı bir Cross-Origin-Resource-Policy HTTP yanıt başlığı alanı ayarlayarak gerçekleştirilebilir.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.6", + "identifier": "V3.6", + "title": "Harici Kaynak Bütünlüğü", + "parent": "V3" + }, + { + "bom-ref": "V3.6.1", + "identifier": "V3.6.1", + "text": "JavaScript kütüphaneleri, CSS veya web fontları gibi istemci tarafı varlıkların yalnızca statik ve sürümlü olması, varlığın bütünlüğünü doğrulamak için Subresource Integrity (SRI) kullanılması durumunda harici olarak (örneğin, bir İçerik Dağıtım Ağı üzerinde) barındırıldığı doğrulanmalıdır. Bu mümkün değilse, her bir kaynak için bunu gerekçelendiren belgelenmiş bir güvenlik kararı bulunmalıdır.", + "parent": "V3.6" + }, + { + "bom-ref": "V3.7", + "identifier": "V3.7", + "title": "Diğer Tarayıcı Güvenliği Hususları", + "parent": "V3" + }, + { + "bom-ref": "V3.7.1", + "identifier": "V3.7.1", + "text": "Uygulamanın yalnızca hâlâ desteklenen ve güvenli kabul edilen istemci tarafı teknolojileri kullandığı doğrulanmalıdır. Bu gereksinimi karşılamayan teknolojilere örnek olarak NSAPI eklentileri, Flash, Shockwave, ActiveX, Silverlight, NACL veya istemci tarafı Java applet’leri verilebilir.", + "parent": "V3.7" + }, + { + "bom-ref": "V3.7.2", + "identifier": "V3.7.2", + "text": "Uygulamanın, yalnızca hedef adres bir izinli listede yer alıyorsa kullanıcıyı otomatik olarak farklı bir ana makine adına veya uygulamanın kontrolünde olmayan bir etki alanına yönlendirdiği doğrulanmalıdır.", + "parent": "V3.7" + }, + { + "bom-ref": "V3.7.3", + "identifier": "V3.7.3", + "text": "Uygulamanın, kullanıcı uygulamanın kontrolü dışındaki bir URL’ye yönlendirildiğinde, yönlendirme hakkında bir bildirim gösterdiği ve kullanıcının bu gezintiyi iptal edebilmesi için bir seçenek sunduğu doğrulanmalıdır.", + "parent": "V3.7" + }, + { + "bom-ref": "V3.7.4", + "identifier": "V3.7.4", + "text": "Uygulamanın en üst düzey etki alanının (örneğin, site.tld) HTTP Strict Transport Security (HSTS) için genel preload listesine eklendiği doğrulanmalıdır. Bu, uygulamanın TLS kullanımının ana tarayıcılar tarafından doğrudan tanınmasını ve yalnızca Strict-Transport-Security yanıt header'ına bağlı kalınmamasını sağlar.", + "parent": "V3.7" + }, + { + "bom-ref": "V3.7.5", + "identifier": "V3.7.5", + "text": "Uygulamaya erişen tarayıcının beklenen güvenlik özelliklerini desteklememesi durumunda, uygulamanın dokümantasyona uygun şekilde davrandığı (örneğin kullanıcıyı uyarma veya erişimi engelleme) doğrulanmalıdır.", + "parent": "V3.7" + }, + { + "bom-ref": "V4", + "identifier": "V4", + "title": "API ve Web Servisi" + }, + { + "bom-ref": "V4.1", + "identifier": "V4.1", + "title": "Genel Web Servisi Güvenliği", + "parent": "V4" + }, + { + "bom-ref": "V4.1.1", + "identifier": "V4.1.1", + "text": "İleti gövdesi içeren her HTTP yanıtında, yanıtın gerçek içeriğiyle eşleşen bir Content-Type header alanı bulunduğu ve güvenli karakter kodlamasını (örneğin, UTF-8, ISO-8859-1) belirtmek üzere charset parametresi içerdiği doğrulanmalıdır. Bu işlem, IANA Medya Türleri'nden \"text/\", \"/+xml\" ve \"/xml\" gibi içerikler için geçerlidir.", + "parent": "V4.1" + }, + { + "bom-ref": "V4.1.2", + "identifier": "V4.1.2", + "text": "Yalnızca kullanıcı arayüzüne yönelik uç noktaların (manuel olarak web tarayıcısı ile erişilmesi amaçlanan) otomatik olarak HTTP'den HTTPS'e yönlendirme yaptığı ve diğer hizmetlerin veya uç noktaların şeffaf yönlendirme gerçekleştirmediği doğrulanmalıdır. Bu, istemcinin farkında olmadan şifrelenmemiş HTTP istekleri göndermesi ve bu isteklerin otomatik olarak HTTPS'e yönlendirilmesi sonucunda hassas verilerin sızmasının fark edilmemesi riskini önlemek içindir.", + "parent": "V4.1" + }, + { + "bom-ref": "V4.1.3", + "identifier": "V4.1.3", + "text": "Uygulama tarafından kullanılan ve yük dengeleyici, web proxy veya frontend için backend hizmeti gibi bir ara katman tarafından ayarlanan herhangi bir HTTP başlık alanının, son kullanıcı tarafından geçersiz kılınamayacağı doğrulanmalıdır. Örnek başlıklar arasında X-Real-IP, X-Forwarded-* veya X-User-ID yer alabilir.", + "parent": "V4.1" + }, + { + "bom-ref": "V4.1.4", + "identifier": "V4.1.4", + "text": "Uygulama veya API tarafından açıkça desteklenen HTTP yöntemlerinin (preflight istekleri sırasında OPTIONS dahil) dışında hiçbir yöntemin kullanılmadığı ve kullanılmayan yöntemlerin engellendiği doğrulanmalıdır.", + "parent": "V4.1" + }, + { + "bom-ref": "V4.1.5", + "identifier": "V4.1.5", + "text": "Çok hassas istekler veya birçok sistemden geçen işlemler için, taşıma katmanı güvenliğinin üzerine ek bir güvence sağlamak amacıyla, her iletiye özel dijital imzaların kullanıldığı doğrulanmalıdır.", + "parent": "V4.1" + }, + { + "bom-ref": "V4.2", + "identifier": "V4.2", + "title": "HTTP İleti Yapısı Doğrulama", + "parent": "V4" + }, + { + "bom-ref": "V4.2.1", + "identifier": "V4.2.1", + "text": "Tüm uygulama bileşenlerinin (yük dengeleyiciler, güvenlik duvarları ve uygulama sunucuları dahil) HTTP sürümüne uygun mekanizmaları kullanarak gelen HTTP iletilerinin sınırlarını belirlediği ve bu sayede HTTP istek kaçakçılığına karşı koruma sağlandığı doğrulanmalıdır. HTTP/1.x sürümünde Transfer-Encoding başlık alanı varsa, RFC 2616'ya göre Content-Length başlığı göz ardı edilmelidir. HTTP/2 veya HTTP/3 kullanıldığında, Content-Length başlığı varsa, alıcının bu değerin DATA çerçevelerinin uzunluğuyla tutarlı olduğunu doğrulaması gerekir.", + "parent": "V4.2" + }, + { + "bom-ref": "V4.2.2", + "identifier": "V4.2.2", + "text": "HTTP iletileri üretilirken, Content-Length başlığının, HTTP protokolünün çerçeveleme yöntemine göre belirlenen içerik uzunluğu ile çelişmediği doğrulanmalıdır. Bu, istek kaçakçılığı saldırılarını önlemek için gereklidir.", + "parent": "V4.2" + }, + { + "bom-ref": "V4.2.3", + "identifier": "V4.2.3", + "text": "Uygulamanın, yanıt bölme ve header enjeksiyonu saldırılarını önlemek amacıyla, bağlantıya özel başlık alanları (örneğin Transfer-Encoding) içeren HTTP/2 veya HTTP/3 iletilerini göndermediği ve kabul etmediği doğrulanmalıdır.", + "parent": "V4.2" + }, + { + "bom-ref": "V4.2.4", + "identifier": "V4.2.4", + "text": "Uygulamanın yalnızca başlık alanları ve değerleri CR (\\r), LF (\\n) veya CRLF (\\r\\n) karakter dizileri içermeyen HTTP/2 ve HTTP/3 isteklerini kabul ettiği doğrulanmalıdır. Bu, başlık enjeksiyonu saldırılarını önlemek içindir.", + "parent": "V4.2" + }, + { + "bom-ref": "V4.2.5", + "identifier": "V4.2.5", + "text": "Uygulama (backend veya frontend) istek oluşturuyor ve gönderiyorsa, URI'ler (örneğin API çağrıları için) veya HTTP istek başlıkları (örneğin Authorization veya Cookie) gibi bileşenlerin, alıcı sistemler tarafından kabul edilemeyecek kadar uzun olmamasını sağlamak amacıyla doğrulama, temizleme veya diğer mekanizmaları kullandığı doğrulanmalıdır. Bu tür çok uzun istekler (örneğin çok uzun bir Cookie başlığı) gönderildiğinde sunucunun sürekli hata durumu döndürmesiyle hizmet reddi oluşabilir.", + "parent": "V4.2" + }, + { + "bom-ref": "V4.3", + "identifier": "V4.3", + "title": "GraphQL", + "parent": "V4" + }, + { + "bom-ref": "V4.3.1", + "identifier": "V4.3.1", + "text": "Maliyetli ve iç içe geçmiş sorgular sonucu oluşabilecek GraphQL veya veri katmanı ifadelerine yönelik Hizmet Reddi (DoS) saldırılarını önlemek için, sorgu izin listesi (allowlist), derinlik sınırlandırması, sorgu sayısı sınırlandırması veya sorgu maliyeti analizi kullanıldığı doğrulanmalıdır.", + "parent": "V4.3" + }, + { + "bom-ref": "V4.3.2", + "identifier": "V4.3.2", + "text": "GraphQL introspection (iç yapı sorgulama) sorgularının, GraphQL API'nin üçüncü taraflar tarafından kullanılmasına yönelik olmadığı sürece, üretim ortamında devre dışı bırakıldığı doğrulanmalıdır.", + "parent": "V4.3" + }, + { + "bom-ref": "V4.4", + "identifier": "V4.4", + "title": "WebSocket", + "parent": "V4" + }, + { + "bom-ref": "V4.4.1", + "identifier": "V4.4.1", + "text": "Tüm WebSocket bağlantılarında TLS üzerinden WebSocket (WSS) kullanıldığı doğrulanmalıdır.", + "parent": "V4.4" + }, + { + "bom-ref": "V4.4.2", + "identifier": "V4.4.2", + "text": "WebSocket'in başlangıçtaki HTTP el sıkışması (handshake) sırasında, Origin başlık alanının uygulama için izin verilen origin listesiyle karşılaştırılarak kontrol edildiği doğrulanmalıdır.", + "parent": "V4.4" + }, + { + "bom-ref": "V4.4.3", + "identifier": "V4.4.3", + "text": "Uygulamanın standart oturum yönetimi kullanılamıyorsa, bunun yerine ilgili Oturum Yönetimi güvenlik gereksinimlerine uygun özel token'ların kullanıldığı doğrulanmalıdır.", + "parent": "V4.4" + }, + { + "bom-ref": "V4.4.4", + "identifier": "V4.4.4", + "text": "HTTPS oturumu WebSocket kanalına geçerken, özel WebSocket oturum yönetim token’larının önceki şekilde kimliği doğrulanmış HTTPS oturumu aracılığıyla elde edildiği veya doğrulandığı doğrulanmalıdır.", + "parent": "V4.4" + }, + { + "bom-ref": "V5", + "identifier": "V5", + "title": "Dosya İşleme" + }, + { + "bom-ref": "V5.1", + "identifier": "V5.1", + "title": "Dosya İşleme Dokümantasyonu", + "parent": "V5" + }, + { + "bom-ref": "V5.1.1", + "identifier": "V5.1.1", + "text": "Dokümantasyonun, her yükleme özelliği için izin verilen dosya türlerini, beklenen dosya uzantılarını ve maksimum boyutu (açılmış hali dahil) tanımladığı doğrulanmalıdır. Ayrıca, dosyaların son kullanıcılar için nasıl güvenli hâle getirileceği (örneğin kötü amaçlı bir dosya tespit edildiğinde uygulamanın nasıl davranacağı) gibi bilgilerin de belgede yer aldığı doğrulanmalıdır.", + "parent": "V5.1" + }, + { + "bom-ref": "V5.2", + "identifier": "V5.2", + "title": "Dosya Yükleme ve İçerik", + "parent": "V5" + }, + { + "bom-ref": "V5.2.1", + "identifier": "V5.2.1", + "text": "Uygulamanın, yalnızca performans kaybına veya hizmet reddine yol açmayacak boyuttaki dosyaları kabul ettiği doğrulanmalıdır.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.2.2", + "identifier": "V5.2.2", + "text": "Uygulama bir dosyayı, doğrudan veya bir arşiv (ör. zip dosyası) içinde kabul ettiğinde, dosya uzantısının beklenen uzantıyla eşleşip eşleşmediğini kontrol ettiği ve içeriğin uzantı tarafından temsil edilen türle uyumlu olduğunu doğruladığı kontrol edilmelidir. Bu; ilk 'magic byte' kontrolü, görüntü yeniden yazımı ve dosya içeriği doğrulama için özel kütüphanelerin kullanımı gibi yöntemleri içerir. Seviye 1 için bu, yalnızca iş veya güvenlik kararlarında kullanılan dosyalarla sınırlı olabilir. Seviye 2 ve üzeri için tüm dosyalar bu kontrole tabi olmalıdır.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.2.3", + "identifier": "V5.2.3", + "text": "Sıkıştırılmış dosyaların (ör. zip, gz, docx, odt) açılmadan önce, izin verilen maksimum açılmış boyuta ve maksimum dosya sayısına göre kontrol edildiği doğrulanmalıdır.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.2.4", + "identifier": "V5.2.4", + "text": "Her kullanıcı için dosya boyutu kotası ve maksimum dosya sayısının uygulandığı doğrulanmalıdır. Böylece tek bir kullanıcının çok sayıda veya aşırı büyük dosya yükleyerek depolama alanını doldurması engellenir.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.2.5", + "identifier": "V5.2.5", + "text": "Uygulamanın, içinde sembolik bağlantılar (symlink) bulunan sıkıştırılmış dosyaların yüklenmesine yalnızca bu durum özel olarak gerekli olduğunda izin verdiği doğrulanmalıdır. Bu durumda, sembolik bağlantı verilebilecek dosyaların bir izinli listesi uygulanmalıdır.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.2.6", + "identifier": "V5.2.6", + "text": "Uygulamanın, piksel boyutu izin verilen maksimum değeri aşan görüntü dosyalarının yüklenmesini reddettiği doğrulanmalıdır. Bu, pixel flood saldırılarını önlemek için gereklidir.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.3", + "identifier": "V5.3", + "title": "Dosya Depolama", + "parent": "V5" + }, + { + "bom-ref": "V5.3.1", + "identifier": "V5.3.1", + "text": "Güvenilmeyen girdilerle yüklenen veya oluşturulan ve herkese açık klasörlerde depolanan dosyaların, bir HTTP isteğiyle doğrudan erişildiğinde sunucu taraflı program kodu olarak çalıştırılmadığı doğrulanmalıdır.", + "parent": "V5.3" + }, + { + "bom-ref": "V5.3.2", + "identifier": "V5.3.2", + "text": "Uygulamanın, dosya işlemleri için dosya yollarını oluştururken kullanıcı tarafından gönderilen dosya adlarını değil, dahili olarak oluşturulan veya güvenilir verileri kullandığı; eğer kullanıcı tarafından gönderilen dosya adları veya meta veriler kullanılacaksa, sıkı doğrulama ve temizleme işlemlerinin uygulandığı doğrulanmalıdır. Bu, yol geçişi (path traversal), yerel veya uzak dosya dahil etme (LFI, RFI) ve sunucu tarafı istek sahteciliği (SSRF) saldırılarına karşı koruma sağlar.", + "parent": "V5.3" + }, + { + "bom-ref": "V5.3.3", + "identifier": "V5.3.3", + "text": "Sunucu tarafında gerçekleşen dosya işlemlerinin (örneğin dosya açma/decompress işlemi), kullanıcı tarafından sağlanan yol bilgilerini yok saydığı ve zip slip gibi güvenlik açıklarını önlediği doğrulanmalıdır.", + "parent": "V5.3" + }, + { + "bom-ref": "V5.4", + "identifier": "V5.4", + "title": "Dosya İndirme", + "parent": "V5" + }, + { + "bom-ref": "V5.4.1", + "identifier": "V5.4.1", + "text": "Uygulamanın, kullanıcı tarafından gönderilen dosya adlarını (ör. JSON, JSONP veya URL parametresinde) doğruladığı veya göz ardı ettiği ve yanıtın Content-Disposition başlık alanında bir dosya adı belirttiği doğrulanmalıdır.", + "parent": "V5.4" + }, + { + "bom-ref": "V5.4.2", + "identifier": "V5.4.2", + "text": "Sunulan dosya adlarının (örneğin HTTP yanıt header'larında veya e-posta eklerinde), belge yapısını korumak ve enjeksiyon saldırılarını önlemek için kodlandığı veya temizlendiği (ör. RFC 6266’ya uygun) doğrulanmalıdır.", + "parent": "V5.4" + }, + { + "bom-ref": "V5.4.3", + "identifier": "V5.4.3", + "text": "Güvenilmeyen kaynaklardan elde edilen dosyaların, bilinen kötü amaçlı içeriklerin sunulmasını önlemek amacıyla antivirüs tarayıcılarıyla tarandığı doğrulanmalıdır.", + "parent": "V5.4" + }, + { + "bom-ref": "V6", + "identifier": "V6", + "title": "Kimlik Doğrulama" + }, + { + "bom-ref": "V6.1", + "identifier": "V6.1", + "title": "Kimlik Doğrulama Dokümantasyonu", + "parent": "V6" + }, + { + "bom-ref": "V6.1.1", + "identifier": "V6.1.1", + "text": "Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırılarına karşı oran sınırlama (rate limiting), otomasyon karşıtı önlemler ve uyarlanabilir yanıt gibi kontrollerin nasıl kullanıldığını açıklayan bir uygulama dokümantasyonu bulunduğu doğrulanmalıdır. Dokümantasyon, bu kontrollerin nasıl yapılandırıldığını ve kötü niyetli hesap kilitlemenin nasıl önlendiğini açıkça ortaya koymalıdır.", + "parent": "V6.1" + }, + { + "bom-ref": "V6.1.2", + "identifier": "V6.1.2", + "text": "Parolalarda kullanılmasını önlemek amacıyla, bağlama özgü sözcüklerin (örneğin kurum adlarının permütasyonları, ürün adları, sistem tanımlayıcıları, proje kod adları, departman veya rol adları vb.) bulunduğu belgelenmiş bir liste mevcut olduğu doğrulanmalıdır.", + "parent": "V6.1" + }, + { + "bom-ref": "V6.1.3", + "identifier": "V6.1.3", + "text": "Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, bunların tümünün belgelenmiş olduğu ve her yol için tutarlı şekilde uygulanması gereken güvenlik kontrolleri ile kimlik doğrulama gücünün tanımlandığı doğrulanmalıdır.", + "parent": "V6.1" + }, + { + "bom-ref": "V6.2", + "identifier": "V6.2", + "title": "Parola Güvenliği", + "parent": "V6" + }, + { + "bom-ref": "V6.2.1", + "identifier": "V6.2.1", + "text": "Kullanıcı tarafından belirlenen parolaların en az 8 karakter uzunluğunda olması sağlanmalı, ancak 15 karakter ve üzeri uzunlukta parolalar olmaları şiddetle tavsiye edilir.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.2", + "identifier": "V6.2.2", + "text": "Kullanıcıların parolalarını değiştirebilmeleri sağlanmalıdır.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.3", + "identifier": "V6.2.3", + "text": "Parola değiştirme işlevinin hem mevcut hem de yeni parolayı gerektirdiği doğrulanmalıdır.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.4", + "identifier": "V6.2.4", + "text": "Kayıt veya parola değişimi sırasında girilen parolaların, uygulamanın parola politikasına (örneğin minimum uzunluk) uyan ilk 3000 yaygın parolaya karşı kontrol edildiği doğrulanmalıdır.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.5", + "identifier": "V6.2.5", + "text": "Her tür karakterin kullanılmasına izin verildiği ve büyük/küçük harf, sayı veya özel karakter şartlarının zorunlu tutulmadığı doğrulanmalıdır.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.6", + "identifier": "V6.2.6", + "text": "Parola giriş alanlarının, girdiyi maskelemek için \"type=password\" kullandığı doğrulanmalıdır. Uygulamalar, kullanıcının tüm maskelenmiş parolayı ya da son girilen karakteri geçici olarak görüntülemesine izin verebilir.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.7", + "identifier": "V6.2.7", + "text": "\"Yapıştır\" özelliğinin, tarayıcı parola yardımcılarının ve harici parola yöneticilerinin kullanımına izin verildiği doğrulanmalıdır.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.8", + "identifier": "V6.2.8", + "text": "Uygulamanın, kullanıcıdan aldığı parolayı herhangi bir şekilde değiştirmeden, örneğin kesmeden veya harf büyüklüğünü değiştirmeden, tam olarak doğruladığı teyit edilmelidir.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.9", + "identifier": "V6.2.9", + "text": "En az 64 karakter uzunluğundaki parolalara izin verildiği doğrulanmalıdır.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.10", + "identifier": "V6.2.10", + "text": "Kullanıcının parolasının, yalnızca ele geçirildiği tespit edildiğinde veya kullanıcı tarafından yenilendiğinde geçerliliğini yitirdiği doğrulanmalıdır. Uygulama, belirli aralıklarla parola yenilenmesini zorunlu kılmamalıdır.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.11", + "identifier": "V6.2.11", + "text": "Tahmin edilmesi kolay parolaların oluşturulmasını önlemek amacıyla, bağlama özgü kelimelerin yer aldığı belgelenmiş listenin parola doğrulamada kullanıldığı teyit edilmelidir.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.12", + "identifier": "V6.2.12", + "text": "Kayıt veya parola değişikliği sırasında girilen parolaların, ele geçirilmiş parolalar listesine karşı kontrol edildiği doğrulanmalıdır.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.3", + "identifier": "V6.3", + "title": "Genel Kimlik Doğrulama Güvenliği", + "parent": "V6" + }, + { + "bom-ref": "V6.3.1", + "identifier": "V6.3.1", + "text": "Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırıları gibi saldırıları önlemeye yönelik kontrollerin, uygulamanın güvenlik dokümantasyonuna göre uygulandığı doğrulanmalıdır.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.2", + "identifier": "V6.3.2", + "text": "\"root\", \"admin\" veya \"sa\" gibi varsayılan kullanıcı hesaplarının uygulamada yer almadığı veya devre dışı bırakıldığı doğrulanmalıdır.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.3", + "identifier": "V6.3.3", + "text": "Uygulamaya erişim için ya çok faktörlü bir kimlik doğrulama mekanizması ya da tek faktörlü mekanizmaların kombinasyonu kullanılmalıdır. Seviye 3 için, bu faktörlerden biri, oltalama saldırılarına karşı direnç sağlayan ve kimlik doğrulama niyetini bir kullanıcı etkileşimi (örneğin FIDO donanım anahtarında bir düğmeye basma veya mobil telefonda bir onay) gerektirerek doğrulayan donanım tabanlı bir kimlik doğrulayıcı olmalıdır. Bu gereksinimdeki herhangi bir esneklik için, gerekçesi belgelenmiş ve riskleri azaltıcı kapsamlı kontroller içeren bir plan gereklidir.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.4", + "identifier": "V6.3.4", + "text": "Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, belgelendirilmemiş bir yol bulunmadığı ve tüm yollar için güvenlik kontrolleri ile kimlik doğrulama gücünün tutarlı şekilde uygulandığı doğrulanmalıdır.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.5", + "identifier": "V6.3.5", + "text": "Başarılı veya başarısız şüpheli kimlik doğrulama girişimlerinin kullanıcıya bildirildiği doğrulanmalıdır. Bu, olağandışı bir konum veya istemciden gelen girişimler, yalnızca bir faktörle yapılan kısmen başarılı doğrulamalar, uzun süreli inaktiflik sonrası yapılan girişimler veya birçok başarısız denemeden sonraki başarılı girişimler gibi durumları içerebilir.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.6", + "identifier": "V6.3.6", + "text": "E-postanın, tek faktörlü ya da çok faktörlü kimlik doğrulama mekanizması olarak kullanılmadığı doğrulanmalıdır.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.7", + "identifier": "V6.3.7", + "text": "Kimlik doğrulama detaylarında yapılan güncellemeler sonrasında (örneğin kimlik bilgisi sıfırlama, kullanıcı adı veya e-posta adresi değişiklikleri), kullanıcıların bilgilendirildiği doğrulanmalıdır.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.8", + "identifier": "V6.3.8", + "text": "Başarısız kimlik doğrulama girişimlerinden, geçerli kullanıcıların hata mesajları, HTTP yanıt kodları veya farklı yanıt süreleri gibi sonuçlara dayanarak tespit edilemediği doğrulanmalıdır. Bu koruma, kayıt ve \"parolamı unuttum\" işlevselliğinde de geçerli olmalıdır.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.4", + "identifier": "V6.4", + "title": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", + "parent": "V6" + }, + { + "bom-ref": "V6.4.1", + "identifier": "V6.4.1", + "text": "Sistem tarafından oluşturulan ilk parolaların veya etkinleştirme kodlarının güvenli bir şekilde rastgele üretildiği, mevcut parola politikasına uygun olduğu, kısa bir süre içinde veya ilk kullanım sonrasında geçerliliğini yitirdiği doğrulanmalıdır. Bu başlangıç sırları uzun vadeli parola olarak kullanılmasına izin verilmemelidir.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.4.2", + "identifier": "V6.4.2", + "text": "Parola ipuçlarının veya \"gizli sorular\" olarak bilinen, bilgiye dayalı kimlik doğrulama mekanizmalarının mevcut olmadığı doğrulanmalıdır.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.4.3", + "identifier": "V6.4.3", + "text": "Unutulmuş parolanın sıfırlanması için, etkin olan çok faktörlü kimlik doğrulama mekanizmalarını atlamayan güvenli bir sürecin uygulandığı doğrulanmalıdır.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.4.4", + "identifier": "V6.4.4", + "text": "Çok faktörlü kimlik doğrulama faktörlerinden biri kaybolursa, kayıt sırasında uygulanan kimlik kanıtlama seviyesiyle aynı seviyede kimlik doğrulama yapıldığı doğrulanmalıdır.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.4.5", + "identifier": "V6.4.5", + "text": "Süresi dolacak kimlik doğrulama mekanizmalarının yenilenmesine ilişkin talimatların, süresi dolmadan önce tamamlanacak şekilde yeterli sürede gönderildiği ve gerekiyorsa otomatik hatırlatıcıların yapılandırıldığı doğrulanmalıdır.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.4.6", + "identifier": "V6.4.6", + "text": "Yönetici yetkisi olan kullanıcıların, kullanıcının parola sıfırlama sürecini başlatabildiği ancak kullanıcının yeni parolasını belirleyemediği veya değiştiremediği doğrulanmalıdır. Bu, yönetici yetkisi olan kullanıcıların, kullanıcı parolasını bilmesini engeller.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.5", + "identifier": "V6.5", + "title": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "parent": "V6" + }, + { + "bom-ref": "V6.5.1", + "identifier": "V6.5.1", + "text": "Arama sırları, bant dışı kimlik doğrulama istekleri veya kodları ve zamana dayalı tek kullanımlık parolaların (TOTP) yalnızca bir kez kullanılabildiği doğrulanmalıdır.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.2", + "identifier": "V6.5.2", + "text": "Uygulamanın backend tarafında saklanırken, 112 bitten az entropiye sahip (örneğin 19 rastgele harf-rakam karakteri veya 34 rastgele rakam) arama sırlarının, 32-bit rastgele bir salt içeren onaylı bir parola saklama algoritmasıyla hash’lendiği doğrulanmalıdır. Gizli bilginin entropisi 112 bit veya daha fazlaysa standart bir hash fonksiyonu kullanılabilir.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.3", + "identifier": "V6.5.3", + "text": "Arama sırları, bant dışı kimlik doğrulama kodları ve zamana dayalı tek kullanımlık parola seed'lerinin, öngörülebilir değerlerden kaçınmak için Kriptografik Olarak Güvenli Sözde Rastgele Sayı Üreteci (CSPRNG) ile oluşturulduğu doğrulanmalıdır.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.4", + "identifier": "V6.5.4", + "text": "Arama sırlarının ve bant dışı kimlik doğrulama kodlarının en az 20 bit entropiye (genellikle 4 rastgele harf-rakam karakteri veya 6 rastgele rakam) sahip olduğu doğrulanmalıdır.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.5", + "identifier": "V6.5.5", + "text": "Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının ve zamana dayalı tek kullanımlık parolaların (TOTP) belirli bir ömre sahip olduğu doğrulanmalıdır. Bant dışı istekler en fazla 10 dakika, TOTP’ler ise en fazla 30 saniye geçerli olmalıdır.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.6", + "identifier": "V6.5.6", + "text": "Herhangi bir kimlik doğrulama faktörünün (fiziksel cihazlar dahil) çalınması veya kaybı durumunda iptal edilebildiği doğrulanmalıdır.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.7", + "identifier": "V6.5.7", + "text": "Biyometrik kimlik doğrulama mekanizmalarının yalnızca ikincil faktör olarak, “sahip olduğunuz bir şey” veya “bildiğiniz bir şey” ile birlikte kullanıldığı doğrulanmalıdır.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.8", + "identifier": "V6.5.8", + "text": "Zamana dayalı tek kullanımlık parolaların (TOTP) doğrulamasının, güvenilir bir hizmetten alınan zaman kaynağına dayanarak yapıldığı ve güvenilir olmayan veya istemci tarafından sağlanan zaman kaynağına dayanmadığı doğrulanmalıdır.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.6", + "identifier": "V6.6", + "title": "Bant Dışı Kimlik Doğrulama Mekanizmaları", + "parent": "V6" + }, + { + "bom-ref": "V6.6.1", + "identifier": "V6.6.1", + "text": "Tek kullanımlık parolaların (OTP) telefon veya SMS ile Public Switched Telephone Network (PSTN) üzerinden iletildiği kimlik doğrulama mekanizmalarının, yalnızca telefon numarası önceden doğrulanmışsa, alternatif daha güçlü yöntemler (örneğin TOTP) de sunuluyorsa ve kullanıcıya güvenlik riskleri hakkında bilgi veriliyorsa sunulduğu doğrulanmalıdır. Seviye 3 uygulamalar için telefon ve SMS seçenekleri sunulmamalıdır.", + "parent": "V6.6" + }, + { + "bom-ref": "V6.6.2", + "identifier": "V6.6.2", + "text": "Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının, oluşturuldukları özgün kimlik doğrulama isteğiyle bağlantılı olduğu ve daha önceki ya da sonraki bir istek için kullanılamadığı doğrulanmalıdır.", + "parent": "V6.6" + }, + { + "bom-ref": "V6.6.3", + "identifier": "V6.6.3", + "text": "Kod tabanlı bant dışı kimlik doğrulama mekanizmalarının, oran sınırlaması ile kaba kuvvet saldırılarına karşı korunduğu doğrulanmalıdır. En az 64 bit entropiye sahip kodlar kullanılması da değerlendirilmelidir.", + "parent": "V6.6" + }, + { + "bom-ref": "V6.6.4", + "identifier": "V6.6.4", + "text": "Çok faktörlü kimlik doğrulama için push bildirimleri kullanılıyorsa, push bombing saldırılarına karşı oran sınırlamasının kullanıldığı doğrulanmalıdır. “Numara eşleştirme” de bu riski azaltabilir.", + "parent": "V6.6" + }, + { + "bom-ref": "V6.7", + "identifier": "V6.7", + "title": "Kriptografik Kimlik Doğrulama Mekanizması", + "parent": "V6" + }, + { + "bom-ref": "V6.7.1", + "identifier": "V6.7.1", + "text": "Kriptografik kimlik doğrulama beyanlarını doğrulamak için kullanılan sertifikaların, değiştirilmeye karşı korumalı şekilde saklandığı doğrulanmalıdır.", + "parent": "V6.7" + }, + { + "bom-ref": "V6.7.2", + "identifier": "V6.7.2", + "text": "Challenge nonce değerinin en az 64 bit uzunluğunda olduğu ve istatistiksel olarak benzersiz ya da cihazın ömrü boyunca benzersiz olduğu doğrulanmalıdır.", + "parent": "V6.7" + }, + { + "bom-ref": "V6.8", + "identifier": "V6.8", + "title": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", + "parent": "V6" + }, + { + "bom-ref": "V6.8.1", + "identifier": "V6.8.1", + "text": "Uygulama birden fazla kimlik sağlayıcıyı (IdP) destekliyorsa, başka bir desteklenen kimlik sağlayıcı aracılığıyla (örneğin aynı kullanıcı tanımlayıcısını kullanarak) kullanıcının kimliğinin taklit edilemediği doğrulanmalıdır. Standart önlem, uygulamanın kullanıcıyı IdP kimliği (bir ad alanı işlevi görür) ve IdP içindeki kullanıcı kimliğinin birleşimiyle kaydetmesi ve tanımlamasıdır.", + "parent": "V6.8" + }, + { + "bom-ref": "V6.8.2", + "identifier": "V6.8.2", + "text": "Kimlik doğrulama beyanları üzerindeki dijital imzaların (örneğin JWT veya SAML beyanları) varlığı ve bütünlüğünün her zaman doğrulandığı ve imzasız veya geçersiz imzalı beyanların reddedildiği doğrulanmalıdır.", + "parent": "V6.8" + }, + { + "bom-ref": "V6.8.3", + "identifier": "V6.8.3", + "text": "SAML beyanlarının benzersiz biçimde işlendiği ve yalnızca geçerlilik süresi içinde bir kez kullanıldığı, tekrar oynatma (replay) saldırılarını önlemek amacıyla doğrulanmalıdır.", + "parent": "V6.8" + }, + { + "bom-ref": "V6.8.4", + "identifier": "V6.8.4", + "text": "Uygulama ayrı bir Kimlik Sağlayıcı (IdP) kullanıyorsa ve belirli işlemler için belirli kimlik doğrulama gücü, yöntemleri veya zaman bilgisi bekliyorsa, uygulamanın bu bilgileri IdP tarafından döndürülen veriler üzerinden doğruladığı teyit edilmelidir. Örneğin OIDC kullanılıyorsa, bu durum ID Token üzerindeki 'acr', 'amr' ve 'auth_time' gibi claim’lerin (varsa) doğrulanması ile sağlanabilir. Eğer IdP bu bilgileri sağlamıyorsa, uygulamanın asgari kimlik doğrulama gücünün kullanıldığını varsayan (örneğin yalnızca kullanıcı adı ve parola ile tek faktörlü doğrulama) belgelenmiş bir yedek yaklaşımı olmalıdır.", + "parent": "V6.8" + }, + { + "bom-ref": "V7", + "identifier": "V7", + "title": "Oturum Yönetimi" + }, + { + "bom-ref": "V7.1", + "identifier": "V7.1", + "title": "Oturum Yönetim Dokümantasyonu", + "parent": "V7" + }, + { + "bom-ref": "V7.1.1", + "identifier": "V7.1.1", + "text": "Kullanıcının oturum inaktivite zaman aşımı süresi ve mutlak maksimum oturum süresinin belgelendiği, diğer kontrollerle birlikte uygun olduğu ve NIST SP 800-63B yeniden kimlik doğrulama gereksinimlerinden herhangi bir sapma varsa gerekçesinin belgede yer aldığı doğrulanmalıdır.", + "parent": "V7.1" + }, + { + "bom-ref": "V7.1.2", + "identifier": "V7.1.2", + "text": "Belgede bir hesap için kaç adet eşzamanlı (paralel) oturuma izin verildiği ile birlikte, maksimum aktif oturum sayısına ulaşıldığında uygulanacak davranış ve işlemlerin tanımlandığı doğrulanmalıdır.", + "parent": "V7.1" + }, + { + "bom-ref": "V7.1.3", + "identifier": "V7.1.3", + "text": "Birleşik kimlik yönetim ekosisteminin bir parçası olarak kullanıcı oturumu oluşturan ve yöneten tüm sistemlerin, oturum ömrü, sonlandırma ve yeniden kimlik doğrulama gerektiren diğer koşulların nasıl koordine edildiğini açıklayan kontrollerle birlikte belgede yer aldığı doğrulanmalıdır.", + "parent": "V7.1" + }, + { + "bom-ref": "V7.2", + "identifier": "V7.2", + "title": "Temel Oturum Yönetimi Güvenliği", + "parent": "V7" + }, + { + "bom-ref": "V7.2.1", + "identifier": "V7.2.1", + "text": "Uygulamanın tüm oturum token'ı doğrulama işlemlerini güvenilir bir backend servisi aracılığıyla gerçekleştirdiği doğrulanmalıdır.", + "parent": "V7.2" + }, + { + "bom-ref": "V7.2.2", + "identifier": "V7.2.2", + "text": "Uygulamanın, statik API gizli anahtarları veya sabit değerler yerine, oturum yönetimi için dinamik olarak oluşturulan kendi kendine yeterli veya referans token'ları kullandığı doğrulanmalıdır.", + "parent": "V7.2" + }, + { + "bom-ref": "V7.2.3", + "identifier": "V7.2.3", + "text": "Uygulama kullanıcı oturumlarını temsil etmek için referans token'ları kullanıyorsa, bu token'ların benzersiz olduğu, kriptografik olarak güvenli bir sözde rastgele sayı üreteci (CSPRNG) kullanılarak üretildiği ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır.", + "parent": "V7.2" + }, + { + "bom-ref": "V7.2.4", + "identifier": "V7.2.4", + "text": "Uygulamanın, kullanıcı kimlik doğrulaması (yeniden kimlik doğrulama dahil) sırasında yeni bir oturum token'ı oluşturduğu ve mevcut oturum token'ını sonlandırdığı doğrulanmalıdır.", + "parent": "V7.2" + }, + { + "bom-ref": "V7.3", + "identifier": "V7.3", + "title": "Oturum Zaman Aşımı", + "parent": "V7" + }, + { + "bom-ref": "V7.3.1", + "identifier": "V7.3.1", + "text": "Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde bir hareketsizlik zaman aşımı bulunduğu doğrulanmalıdır.", + "parent": "V7.3" + }, + { + "bom-ref": "V7.3.2", + "identifier": "V7.3.2", + "text": "Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde mutlak bir maksimum oturum süresi bulunduğu doğrulanmalıdır.", + "parent": "V7.3" + }, + { + "bom-ref": "V7.4", + "identifier": "V7.4", + "title": "Oturum Sonlandırma", + "parent": "V7" + }, + { + "bom-ref": "V7.4.1", + "identifier": "V7.4.1", + "text": "Oturum sonlandırma tetiklendiğinde (örneğin, çıkış yapıldığında veya süre dolduğunda), uygulamanın oturumun daha fazla kullanılmasına izin vermediği doğrulanmalıdır. Referans token'lar veya durum bilgili oturumlar için bu, oturum verilerinin uygulama arka ucunda geçersiz kılınması anlamına gelir. Kapsamlı token kullanan uygulamaların; sonlandırılmış token listesi tutmak, kullanıcıya özel tarih ve saatten önce oluşturulan token'ları reddetmek veya kullanıcıya özel imzalama anahtarını yenilemek gibi bir çözüm uygulaması gerekir.", + "parent": "V7.4" + }, + { + "bom-ref": "V7.4.2", + "identifier": "V7.4.2", + "text": "Bir kullanıcı hesabı devre dışı bırakıldığında veya silindiğinde (örneğin bir çalışanın şirketten ayrılması), uygulamanın tüm aktif oturumları sonlandırdığı doğrulanmalıdır.", + "parent": "V7.4" + }, + { + "bom-ref": "V7.4.3", + "identifier": "V7.4.3", + "text": "Herhangi bir kimlik doğrulama faktörünün başarılı bir şekilde değiştirilmesi veya kaldırılmasından (şifre sıfırlama veya kurtarma yoluyla yapılan değişiklikler dahil ve varsa MFA ayarları güncellemeleri dahil) sonra, uygulamanın diğer tüm aktif oturumları sonlandırma seçeneği sunduğu doğrulanmalıdır.", + "parent": "V7.4" + }, + { + "bom-ref": "V7.4.4", + "identifier": "V7.4.4", + "text": "Kimlik doğrulama gerektiren tüm sayfalarda kolay erişilebilir ve görünür bir çıkış yap (logout) işlevi bulunduğu doğrulanmalıdır.", + "parent": "V7.4" + }, + { + "bom-ref": "V7.4.5", + "identifier": "V7.4.5", + "text": "Uygulama yöneticilerinin, bireysel bir kullanıcının veya tüm kullanıcıların aktif oturumlarını sonlandırabilme yetkisine sahip olduğu doğrulanmalıdır.", + "parent": "V7.4" + }, + { + "bom-ref": "V7.5", + "identifier": "V7.5", + "title": "Oturum Kötüye Kullanımına Karşı Savunmalar", + "parent": "V7" + }, + { + "bom-ref": "V7.5.1", + "identifier": "V7.5.1", + "text": "E-posta adresi, telefon numarası, MFA yapılandırması veya hesap kurtarmada kullanılan diğer bilgiler gibi kimlik doğrulamayı etkileyebilecek hassas hesap özniteliklerinde değişiklik yapılmadan önce uygulamanın tam yeniden kimlik doğrulama gerektirdiği doğrulanmalıdır.", + "parent": "V7.5" + }, + { + "bom-ref": "V7.5.2", + "identifier": "V7.5.2", + "text": "Kullanıcıların, (en az bir faktörle yeniden kimlik doğrulama yaptıktan sonra) mevcut tüm aktif oturumları görüntüleyebilmesi ve sonlandırabilmesinin mümkün olduğu doğrulanmalıdır.", + "parent": "V7.5" + }, + { + "bom-ref": "V7.5.3", + "identifier": "V7.5.3", + "text": "Uygulamanın, son derece hassas işlemler veya operasyonlar gerçekleştirilmeden önce en az bir faktörle ek kimlik doğrulaması veya ikincil bir doğrulama gerektirdiği doğrulanmalıdır.", + "parent": "V7.5" + }, + { + "bom-ref": "V7.6", + "identifier": "V7.6", + "title": "Birleşik Yeniden Kimlik Doğrulama", + "parent": "V7" + }, + { + "bom-ref": "V7.6.1", + "identifier": "V7.6.1", + "text": "Güvenen Taraf (RP) ile Kimlik Sağlayıcı (IdP) arasındaki oturum süresi ve oturum sonlandırma davranışlarının belgelenmiş olduğu ve, örneğin IdP kimlik doğrulama olayları arasında maksimum süreye ulaşıldığında yeniden kimlik doğrulamanın gerekli kılındığı doğrulanmalıdır.", + "parent": "V7.6" + }, + { + "bom-ref": "V7.6.2", + "identifier": "V7.6.2", + "text": "Yeni bir oturum oluşturulmasının, kullanıcı onayı veya açık bir eylem gerektirdiği; kullanıcı etkileşimi olmaksızın yeni uygulama oturumlarının oluşturulmasının önlendiği doğrulanmalıdır.", + "parent": "V7.6" + }, + { + "bom-ref": "V8", + "identifier": "V8", + "title": "Yetkilendirme" + }, + { + "bom-ref": "V8.1", + "identifier": "V8.1", + "title": "Yetkilendirme Dokümantasyonu", + "parent": "V8" + }, + { + "bom-ref": "V8.1.1", + "identifier": "V8.1.1", + "text": "Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak işlev düzeyinde ve veriye özel erişim kısıtlamaları için kuralları tanımladığı doğrulanmalıdır.", + "parent": "V8.1" + }, + { + "bom-ref": "V8.1.2", + "identifier": "V8.1.2", + "text": "Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak alan (field) düzeyinde erişim kısıtlamaları (hem okuma hem yazma) için kuralları tanımladığı doğrulanmalıdır. Bu kuralların, ilgili veri nesnesinin durum veya statü gibi diğer özniteliklerine bağlı olabileceği unutulmamalıdır.", + "parent": "V8.1" + }, + { + "bom-ref": "V8.1.3", + "identifier": "V8.1.3", + "text": "Uygulamanın dokümantasyonunun, kimlik doğrulama ve yetkilendirme ile ilgili güvenlik kararlarının alınmasında kullanılan çevresel ve bağlamsal öznitelikleri (günün saati, kullanıcı konumu, IP adresi veya cihaz gibi) tanımladığı doğrulanmalıdır.", + "parent": "V8.1" + }, + { + "bom-ref": "V8.1.4", + "identifier": "V8.1.4", + "text": "Kimlik doğrulama ve yetkilendirme dokümantasyonunun; işlev düzeyinde, veriye özel ve alan düzeyinde yetkilendirmenin yanı sıra çevresel ve bağlamsal faktörlerin karar almada nasıl kullanıldığını tanımladığı doğrulanmalıdır. Bu, değerlendirilen öznitelikleri, risk eşiklerini ve alınan aksiyonları (ör. izin ver, doğrulama iste, reddet, step-up kimlik doğrulama) içermelidir.", + "parent": "V8.1" + }, + { + "bom-ref": "V8.2", + "identifier": "V8.2", + "title": "Genel Yetkilendirme Tasarımı", + "parent": "V8" + }, + { + "bom-ref": "V8.2.1", + "identifier": "V8.2.1", + "text": "Uygulamanın, işlev düzeyindeki erişimin yalnızca açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır.", + "parent": "V8.2" + }, + { + "bom-ref": "V8.2.2", + "identifier": "V8.2.2", + "text": "Uygulamanın, veriye özel erişimin yalnızca belirli veri öğelerine açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, doğrudan nesne referansı güvenlik açıkları (IDOR) ve bozuk nesne düzeyinde yetkilendirme (BOLA) risklerini azaltır.", + "parent": "V8.2" + }, + { + "bom-ref": "V8.2.3", + "identifier": "V8.2.3", + "text": "Uygulamanın, alan (field) düzeyindeki erişimin yalnızca belirli alanlara açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, bozuk nesne özelliği düzeyinde yetkilendirme (BOPLA) risklerini azaltır.", + "parent": "V8.2" + }, + { + "bom-ref": "V8.2.4", + "identifier": "V8.2.4", + "text": "Tüketicinin çevresel ve bağlamsal özniteliklerine (ör. günün saati, konum, IP adresi veya cihaz) dayalı uyarlanabilir güvenlik kontrollerinin, uygulama dokümantasyonunda tanımlandığı şekilde, kimlik doğrulama ve yetkilendirme kararları için uygulandığı doğrulanmalıdır. Bu kontroller, tüketici yeni bir oturum başlatmaya çalışırken ve mevcut bir oturum sırasında uygulanmalıdır.", + "parent": "V8.2" + }, + { + "bom-ref": "V8.3", + "identifier": "V8.3", + "title": "İşlem Düzeyinde Yetkilendirme", + "parent": "V8" + }, + { + "bom-ref": "V8.3.1", + "identifier": "V8.3.1", + "text": "Uygulamanın yetkilendirme kurallarını güvenilir bir servis katmanında uyguladığı ve istemci taraflı JavaScript gibi güvenilmeyen tüketiciler tarafından değiştirilebilecek kontrollerle yetinmediği doğrulanmalıdır.", + "parent": "V8.3" + }, + { + "bom-ref": "V8.3.2", + "identifier": "V8.3.2", + "text": "Yetkilendirme kararlarının temelini oluşturan değerlerdeki değişikliklerin hemen uygulandığı doğrulanmalıdır. Değişikliklerin anında uygulanamadığı durumlarda (örneğin self-contained token içindeki verilere güveniliyorsa), tüketici artık yetkili olmadığı hâlde bir işlem gerçekleştirdiğinde uyarı verecek ve değişikliği geri alacak önlemler uygulanmalıdır. Bu alternatifin bilgi sızıntısını önlemeyeceği unutulmamalıdır.", + "parent": "V8.3" + }, + { + "bom-ref": "V8.3.3", + "identifier": "V8.3.3", + "text": "Bir nesneye erişimin, herhangi bir aracı veya onun adına hareket eden bir servis yerine yalnızca erişimi başlatan öznenin (ör. tüketici) izinlerine dayandığı doğrulanmalıdır. Örneğin, bir tüketici kimlik doğrulama için bir self-contained token kullanarak bir web servis çağırırsa ve bu servis başka bir servisten veri talep ederse, ikinci servis izin kararlarını verirken birinci servisin makine-makine token'ı yerine tüketicinin token'ını kullanmalıdır.", + "parent": "V8.3" + }, + { + "bom-ref": "V8.4", + "identifier": "V8.4", + "title": "Diğer Yetkilendirme Hususları", + "parent": "V8" + }, + { + "bom-ref": "V8.4.1", + "identifier": "V8.4.1", + "text": "Multi-tenant uygulamaların, tüketici işlemlerinin izinli olmadıkları tenant'lar üzerinde asla etkili olmamasını sağlamak için tenant'lar arası kontroller kullandığı doğrulanmalıdır.", + "parent": "V8.4" + }, + { + "bom-ref": "V8.4.2", + "identifier": "V8.4.2", + "text": "Yönetici arayüzlerine erişimin, sürekli tüketici kimlik doğrulaması, cihaz güvenlik durumu değerlendirmesi ve bağlamsal risk analizi dahil olmak üzere çok katmanlı güvenlik içerdiği doğrulanmalıdır. Yetkilendirme için yalnızca ağ konumu veya güvenilir uç noktalar yeterli olmamalıdır; ancak bu tür faktörler yetkisiz erişim olasılığını azaltabilir.", + "parent": "V8.4" + }, + { + "bom-ref": "V9", + "identifier": "V9", + "title": "Kendi İçinde Taşıyıcı Token (Self-contained Token)" + }, + { + "bom-ref": "V9.1", + "identifier": "V9.1", + "title": "Token Kaynağı ve Bütünlüğü", + "parent": "V9" + }, + { + "bom-ref": "V9.1.1", + "identifier": "V9.1.1", + "text": "Self-contained token'ların içerikleri kabul edilmeden önce, oynama (tampering) saldırılarına karşı dijital imza veya MAC ile doğrulama yapıldığı doğrulanmalıdır.", + "parent": "V9.1" + }, + { + "bom-ref": "V9.1.2", + "identifier": "V9.1.2", + "text": "Belirli bir bağlam için yalnızca bir allowlist üzerinde bulunan algoritmaların self-contained token oluşturmak ve doğrulamak için kullanılabildiği doğrulanmalıdır. Bu allowlist, yalnızca simetrik ya da yalnızca asimetrik algoritmaları içermeli ve kesinlikle 'None' algoritmasını içermemelidir. Hem simetrik hem de asimetrik algoritmalar desteklenmek zorundaysa, anahtar karışıklığını (key confusion) önlemek için ek kontroller uygulanmalıdır.", + "parent": "V9.1" + }, + { + "bom-ref": "V9.1.3", + "identifier": "V9.1.3", + "text": "Self-contained token'ları doğrulamak için kullanılan anahtar malzemesinin, token issuer için önceden yapılandırılmış güvenilir kaynaklardan alındığı doğrulanmalıdır. Bu, saldırganların güvenilmeyen kaynak ve anahtarları belirtmesini engeller. JWT ve diğer JWS yapılarında 'jku', 'x5u' ve 'jwk' gibi header'lar güvenilir kaynaklardan oluşan bir allowlist'e göre doğrulanmalıdır.", + "parent": "V9.1" + }, + { + "bom-ref": "V9.2", + "identifier": "V9.2", + "title": "Token İçeriği", + "parent": "V9" + }, + { + "bom-ref": "V9.2.1", + "identifier": "V9.2.1", + "text": "Token verisinde bir geçerlilik zaman aralığı (validity time span) varsa, yalnızca doğrulama zamanı bu zaman aralığı içerisindeyse token ve içeriği kabul edilmelidir. Örneğin, JWT'ler için 'nbf' ve 'exp' claim'leri doğrulanmalıdır.", + "parent": "V9.2" + }, + { + "bom-ref": "V9.2.2", + "identifier": "V9.2.2", + "text": "Token'ı alan hizmetin, token içeriğini kabul etmeden önce bu token'ın doğru türde olduğunu ve sunulma amacına uygun olduğunu doğruladığı teyit edilmelidir. Örneğin, yalnızca erişim token'ları yetkilendirme kararları için, yalnızca ID Token'lar kullanıcı kimlik doğrulamasını kanıtlamak için kullanılabilir.", + "parent": "V9.2" + }, + { + "bom-ref": "V9.2.3", + "identifier": "V9.2.3", + "text": "Hizmetin yalnızca kendisiyle kullanılması amaçlanan (audience) token'ları kabul ettiği doğrulanmalıdır. JWT'lerde bu, 'aud' claim'inin hizmet içinde tanımlı bir allowlist ile doğrulanması yoluyla sağlanabilir.", + "parent": "V9.2" + }, + { + "bom-ref": "V9.2.4", + "identifier": "V9.2.4", + "text": "Eğer bir token issuer, farklı audience'lara token oluşturmak için aynı private key'i kullanıyorsa, oluşturulan token'ların hedef audience'ları benzersiz şekilde tanımlayan bir audience kısıtlaması içerdiği doğrulanmalıdır. Bu, bir token'ın farklı bir audience ile yeniden kullanılmasını önler. Audience tanımlayıcısı dinamik olarak sağlanıyorsa, token issuer bu audience'ları doğrulamalı ve audience taklitlerinin (impersonation) önüne geçmelidir.", + "parent": "V9.2" + }, + { + "bom-ref": "V10", + "identifier": "V10", + "title": "OAuth ve OIDC" + }, + { + "bom-ref": "V10.1", + "identifier": "V10.1", + "title": "Genel OAuth ve OIDC Güvenliği", + "parent": "V10" + }, + { + "bom-ref": "V10.1.1", + "identifier": "V10.1.1", + "text": "Token'ların yalnızca kesinlikle ihtiyaç duyan bileşenlere gönderildiği doğrulanmalıdır. Örneğin, tarayıcı tabanlı JavaScript uygulamaları için bir backend-for-frontend modeli kullanıldığında, access ve refresh token'lara yalnızca backend'in erişebilmesi gerekir.", + "parent": "V10.1" + }, + { + "bom-ref": "V10.1.2", + "identifier": "V10.1.2", + "text": "Authorization server'dan gelen değerler (örneğin authorization code veya ID Token gibi) yalnızca aynı user agent oturumu ve işlemi tarafından başlatılmış bir yetkilendirme akışının sonucuysa kabul edildiği doğrulanmalıdır. Bu, client tarafından oluşturulan secret’ların 'proof key for code exchange' (PKCE) ‘code_verifier’, ‘state’ veya OIDC ‘nonce’ gibi tahmin edilemez, işleme özgü ve hem client’a hem de işlem başlatılan user agent oturumuna güvenli bir şekilde bağlı olmasını gerektirir.", + "parent": "V10.1" + }, + { + "bom-ref": "V10.2", + "identifier": "V10.2", + "title": "OAuth İstemcisi", + "parent": "V10" + }, + { + "bom-ref": "V10.2.1", + "identifier": "V10.2.1", + "text": "Code flow kullanılıyorsa, OAuth client’ın token taleplerini tetikleyen CSRF saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Bu genellikle PKCE kullanılarak veya authorization isteğinde gönderilen ‘state’ parametresinin kontrolü ile sağlanır.", + "parent": "V10.2" + }, + { + "bom-ref": "V10.2.2", + "identifier": "V10.2.2", + "text": "OAuth istemcisi birden fazla AS ile etkileşime girebiliyorsa, mix-up saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Örneğin, authorization server’ın 'iss' parametresini döndürmesi zorunlu kılınabilir ve bu parametrenin hem authorization yanıtında hem de token yanıtında doğrulanması gerekir.", + "parent": "V10.2" + }, + { + "bom-ref": "V10.2.3", + "identifier": "V10.2.3", + "text": "OAuth istemcisinin authorization server’a yaptığı taleplerde yalnızca gerekli scope’ları (veya diğer yetkilendirme parametrelerini) talep ettiği doğrulanmalıdır.", + "parent": "V10.2" + }, + { + "bom-ref": "V10.3", + "identifier": "V10.3", + "title": "OAuth Kaynak Sunucusu (RS)", + "parent": "V10" + }, + { + "bom-ref": "V10.3.1", + "identifier": "V10.3.1", + "text": "RS'nin yalnızca bu servisle kullanılmak üzere tasarlanmış access token’ları kabul ettiği doğrulanmalıdır (audience kontrolü). Audience bilgisi yapılandırılmış token’larda (örneğin JWT içindeki ‘aud’ claim’i) yer alabilir veya token introspection endpoint aracılığıyla kontrol edilebilir.", + "parent": "V10.3" + }, + { + "bom-ref": "V10.3.2", + "identifier": "V10.3.2", + "text": "RS'nin, access token’dan gelen claim’lere dayanarak yetki devri tanımına uygun şekilde yetkilendirme kararları uyguladığı doğrulanmalıdır. ‘sub’, ‘scope’ ve ‘authorization_details’ gibi claim’ler varsa, bu kararın parçası olmalıdır.", + "parent": "V10.3" + }, + { + "bom-ref": "V10.3.3", + "identifier": "V10.3.3", + "text": "Erişim kontrolü kararında, access token’dan (JWT veya ilgili token introspection yanıtı) benzersiz bir kullanıcının tanımlanması gerekiyorsa, RS'nin başka kullanıcılara devredilemeyecek claim’ler ile kullanıcıyı tanımladığı doğrulanmalıdır. Genellikle bu, ‘iss’ ve ‘sub’ claim’lerinin birlikte kullanılması anlamına gelir.", + "parent": "V10.3" + }, + { + "bom-ref": "V10.3.4", + "identifier": "V10.3.4", + "text": "RS'nin belirli bir kimlik doğrulama gücü, yöntemi veya güncelliği (recentness) gerektirmesi durumunda, sunulan access token’ın bu kısıtlamaları karşıladığını doğruladığı, örneğin, OIDC ‘acr’, ‘amr’ ve ‘auth_time’ claim’leri kullanılarak doğrulanmalıdır. ", + "parent": "V10.3" + }, + { + "bom-ref": "V10.3.5", + "identifier": "V10.3.5", + "text": "RS'nin, (yetkisiz taraflarca) çalınmış veya tekrar edilen access token’ların kullanımını önlemek için sender-constrained access token’lar kullandığı doğrulanmalıdır. Bu, OAuth 2 için Mutual TLS veya OAuth 2 Demonstration of Proof of Possession (DPoP) ile sağlanabilir.", + "parent": "V10.3" + }, + { + "bom-ref": "V10.4", + "identifier": "V10.4", + "title": "OAuth Yetkilendirme Sunucusu (AS)", + "parent": "V10" + }, + { + "bom-ref": "V10.4.1", + "identifier": "V10.4.1", + "text": "AS'nin, istemciye özel önceden kaydedilmiş URI’lerden oluşan bir allowlist kullanarak redirect URI’leri tam dize karşılaştırması ile doğruladığı doğrulanmalıdır.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.2", + "identifier": "V10.4.2", + "text": "AS'nin, \"authorization response\" içinde \"authorization code\" döndürdüğü durumlarda, bu kodun yalnızca bir kez kullanılabildiği doğrulanmalıdır. Daha önce access token vermek için kullanılmış bir authorization code ile yapılan ikinci geçerli token isteği reddedilmeli ve ilgili tüm token’lar iptal edilmelidir.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.3", + "identifier": "V10.4.3", + "text": "Authorization code’un kısa ömürlü olduğu doğrulanmalıdır. L1 ve L2 uygulamalar için maksimum yaşam süresi 10 dakika, L3 uygulamalar için 1 dakikadır.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.4", + "identifier": "V10.4.4", + "text": "Belirli bir istemci için AS'nin yalnızca o istemcinin ihtiyaç duyduğu grant türlerine izin verdiği doğrulanmalıdır. \"Token\" (Implicit flow) ve \"password\" (Resource Owner Password Credentials flow) grant türlerinin artık kullanılmaması gerekir.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.5", + "identifier": "V10.4.5", + "text": "AS'nin, açık istemciler için refresh token replay saldırılarını azalttığı doğrulanmalıdır. Tercihen sender-constrained refresh token’lar (DPoP veya mutual TLS ile certificate-bound access token’lar) kullanılmalıdır. L1 ve L2 uygulamalar için refresh token rotation kullanılabilir. Rotation kullanılıyorsa, AS refresh token’ı kullanım sonrası geçersiz kılmalı ve geçersiz bir refresh token sunulması durumunda o yetkilendirme ile ilişkili tüm refresh token’ları iptal etmelidir.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.6", + "identifier": "V10.4.6", + "text": "Code grant kullanılıyorsa, AS'nin authorization code interception saldırılarına karşı koruma sağladığı doğrulanmalıdır. Yetkilendirme isteğinde geçerli bir \"code_challenge\" değeri zorunlu olmalı ve \"code_challenge_method\" olarak \"plain\" kabul edilmemelidir. Token isteğinde ise \"code_verifier\" parametresi doğrulanmalıdır.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.7", + "identifier": "V10.4.7", + "text": "AS'nin, kimlik doğrulaması yapılmamış dinamik istemci kaydını desteklemesi durumunda, kötü niyetli istemci uygulamalarına karşı riskleri azalttığı doğrulanmalıdır. Kayıtlı URI’ler gibi client metadata’sı doğrulanmalı, kullanıcı onayı alınmalı ve güvenilmeyen bir client uygulamasıyla yapılan yetkilendirme isteği işlenmeden önce kullanıcı uyarılmalıdır.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.8", + "identifier": "V10.4.8", + "text": "Refresh token’ların, sliding expiration kullanılsa bile mutlak bir sona erme süresine sahip olduğu doğrulanmalıdır.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.9", + "identifier": "V10.4.9", + "text": "Yetkili bir kullanıcı tarafından AS kullanıcı arayüzü üzerinden refresh token’ların ve reference access token’ların iptal edilebildiği doğrulanmalıdır.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.10", + "identifier": "V10.4.10", + "text": "Gizli istemcilerin token istekleri, pushed authorization request (PAR) ve token iptal istekleri gibi server’a yapılan backchannel isteklerinde kimliğinin kontrol edildiği doğrulanmalıdır.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.11", + "identifier": "V10.4.11", + "text": "AS yapılandırmasının, OAuth istemcisine yalnızca gerekli scope’ları atadığı doğrulanmalıdır.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.12", + "identifier": "V10.4.12", + "text": "Belirli bir client için, authorization server’ın yalnızca client’ın ihtiyaç duyduğu 'response_mode' değerine izin verdiği doğrulanmalıdır. Örneğin, bu değer ya beklenenlerle karşılaştırılarak doğrulanmalı ya da PAR veya JAR kullanılmalıdır.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.13", + "identifier": "V10.4.13", + "text": "\"Code\" grant türünün daima pushed authorization request (PAR) ile birlikte kullanıldığı doğrulanmalıdır.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.14", + "identifier": "V10.4.14", + "text": "AS'nin yalnızca sender-constrained (Proof-of-Possession) access token’lar ürettiği doğrulanmalıdır. Bu, mutual TLS ile certificate-bound access token ya da DPoP ile DPoP-bound access token olabilir.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.15", + "identifier": "V10.4.15", + "text": "Sunucu taraflı istemciler için (kullanıcı cihazında çalışmayan), AS'nin \"authorization_details\" parametresinin istemci backend'i tarafından sağlandığını ve kullanıcı tarafından değiştirilmediğini doğruladığı, örneğin pushed authorization request (PAR) or JWT-secured Authorization Request (JAR) zorunlu kılınarak doğrulanmalıdır.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.16", + "identifier": "V10.4.16", + "text": "Bir istemci gizli ise, AS'nin güçlü istemci kimlik doğrulama yöntemlerini zorunlu kıldığı doğrulanmalıdır. Bu yöntemler, public-key cryptography’ye dayalı ve replay saldırılarına karşı dayanıklı olmalı, örneğin mutual TLS (\"tls_client_auth\", \"self_signed_tls_client_auth\") veya private key JWT (\"private_key_jwt\") gibi.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.5", + "identifier": "V10.5", + "title": "OIDC İstemcisi", + "parent": "V10" + }, + { + "bom-ref": "V10.5.1", + "identifier": "V10.5.1", + "text": "İstemcinin (relying party olarak) ID Token replay saldırılarını azalttığı doğrulanmalıdır. Örneğin, ID Token’daki 'nonce' claim’inin, OpenID Provider’a gönderilen kimlik doğrulama isteğindeki 'nonce' değeriyle eşleştiği doğrulanmalıdır.", + "parent": "V10.5" + }, + { + "bom-ref": "V10.5.2", + "identifier": "V10.5.2", + "text": "İstemcinin kullanıcıyı ID Token claim’lerinden (genellikle, başka kullanıcılarla yeniden atanamayan 'sub' claim’i) benzersiz şekilde tanımladığı doğrulanmalıdır.", + "parent": "V10.5" + }, + { + "bom-ref": "V10.5.3", + "identifier": "V10.5.3", + "text": "İstemcinin, kötü niyetli bir AS'nin başka bir AS'yi taklit etmesini AS metadata’sı üzerinden reddettiği doğrulanmalıdır. AS metadata’sındaki issuer URL’si, istemci tarafından beklenen önceden yapılandırılmış issuer URL’siyle tam olarak eşleşmiyorsa, metadata reddedilmelidir.", + "parent": "V10.5" + }, + { + "bom-ref": "V10.5.4", + "identifier": "V10.5.4", + "text": "İstemcinin, ID Token’ın kendisi için (audience) kullanılması amaçlandığını doğruladığı doğrulanmalıdır. Bu, token’daki 'aud' claim’inin istemcinin 'client_id' değeriyle eşit olup olmadığının kontrol edilmesiyle yapılır.", + "parent": "V10.5" + }, + { + "bom-ref": "V10.5.5", + "identifier": "V10.5.5", + "text": "OIDC back-channel logout kullanıldığında, relying party’nin \"forced logout\" ve \"logout\" akışında \"cross-JWT confusion\" gibi saldırılara karşı koruma sağladığı doğrulanmalıdır. Client, logout token’ın 'logout+jwt' türünde olduğunu, 'event' claim’inin doğru üyeye sahip olduğunu ve 'nonce' claim’i içermediğini doğrulamalıdır. Ayrıca token için kısa bir sona erme süresi (örneğin 2 dakika) önerilir.", + "parent": "V10.5" + }, + { + "bom-ref": "V10.6", + "identifier": "V10.6", + "title": "OpenID Provider", + "parent": "V10" + }, + { + "bom-ref": "V10.6.1", + "identifier": "V10.6.1", + "text": "OpenID Provider’ın yalnızca 'code', 'ciba', 'id_token' veya 'id_token code' response mode değerlerine izin verdiği doğrulanmalıdır. 'code' değeri, 'id_token code' (OIDC Hybrid flow) yerine tercih edilmelidir. 'token' (Implicit flow) kullanılmamalıdır.", + "parent": "V10.6" + }, + { + "bom-ref": "V10.6.2", + "identifier": "V10.6.2", + "text": "OpenID Provider’ın forced logout yoluyla yapılan hizmet reddi saldırılarını önlediği doğrulanmalıdır. Bu, son kullanıcıdan açık onay alınarak veya varsa logout isteğinde (relying party tarafından başlatılan) bulunan parametrelerin, örneğin 'id_token_hint', doğrulanmasıyla yapılabilir.", + "parent": "V10.6" + }, + { + "bom-ref": "V10.7", + "identifier": "V10.7", + "title": "Onay (Consent) Yönetimi", + "parent": "V10" + }, + { + "bom-ref": "V10.7.1", + "identifier": "V10.7.1", + "text": "AS'nin her yetkilendirme isteği için kullanıcının onayını aldığı doğrulanmalıdır. İstemcinin kimliği garanti altına alınamıyorsa, AS daima kullanıcıdan açıkça onay istemelidir.", + "parent": "V10.7" + }, + { + "bom-ref": "V10.7.2", + "identifier": "V10.7.2", + "text": "AS'nin kullanıcıdan onay istediğinde, neye onay verildiğini açık ve yeterli şekilde gösterdiği doğrulanmalıdır. Uygun olduğunda bu bilgiler, istenen yetkilendirmelerin doğasını (genellikle scope, resource server, RAR gibi detaylara dayalı), yetkilendirilmiş uygulamanın kimliğini ve bu yetkilendirmelerin süresini içermelidir.", + "parent": "V10.7" + }, + { + "bom-ref": "V10.7.3", + "identifier": "V10.7.3", + "text": "Kullanıcının, AS üzerinden verdiği onayları görüntüleyebildiği, değiştirebildiği ve iptal edebildiği doğrulanmalıdır.", + "parent": "V10.7" + }, + { + "bom-ref": "V11", + "identifier": "V11", + "title": "Kriptografi" + }, + { + "bom-ref": "V11.1", + "identifier": "V11.1", + "title": "Kriptografik Envanter ve Dokümantasyon", + "parent": "V11" + }, + { + "bom-ref": "V11.1.1", + "identifier": "V11.1.1", + "text": "Kriptografik anahtarların yönetimi için belgelenmiş bir politika ve NIST SP 800-57 gibi bir anahtar yönetim standardını izleyen bir kriptografik anahtar yaşam döngüsü tanımlandığı doğrulanmalıdır. Bu, anahtarların aşırı miktarda paylaşılmadığını (örneğin, paylaşılan sırlar için ikiden fazla tarafla veya özel anahtarlar için birden fazla tarafla) garanti altına almalıdır.", + "parent": "V11.1" + }, + { + "bom-ref": "V11.1.2", + "identifier": "V11.1.2", + "text": "Tüm kriptografik anahtarlar, algoritmalar ve uygulama tarafından kullanılan sertifikaları içeren bir kriptografik envanterin oluşturulduğu, sürdürüldüğü ve düzenli olarak güncellendiği doğrulanmalıdır. Bu envanter ayrıca, sistemde anahtarların nerede kullanılabileceğini ve kullanılamayacağını, ve hangi veri türlerinin bu anahtarlarla korunup korunamayacağını da belgelemelidir.", + "parent": "V11.1" + }, + { + "bom-ref": "V11.1.3", + "identifier": "V11.1.3", + "text": "Sistem içerisinde şifreleme, özetleme ve imzalama işlemleri dahil olmak üzere kriptografi kullanımının tüm örneklerini tespit etmek için kriptografik keşif mekanizmalarının kullanıldığı doğrulanmalıdır.", + "parent": "V11.1" + }, + { + "bom-ref": "V11.1.4", + "identifier": "V11.1.4", + "text": "Kriptografik bir envanterin sürdürüldüğü doğrulanmalıdır. Bu envanter, gelecekteki tehditlere karşı tepki verebilmek amacıyla post-kuantum kriptografiye geçiş yolunu belirten belgelenmiş bir plan içermelidir.", + "parent": "V11.1" + }, + { + "bom-ref": "V11.2", + "identifier": "V11.2", + "title": "Güvenli Kriptografi Uygulaması", + "parent": "V11" + }, + { + "bom-ref": "V11.2.1", + "identifier": "V11.2.1", + "text": "Kriptografik işlemler için sektör tarafından doğrulanmış uygulamaların (kütüphaneler ve donanım hızlandırmalı uygulamalar dahil) kullanıldığı doğrulanmalıdır.", + "parent": "V11.2" + }, + { + "bom-ref": "V11.2.2", + "identifier": "V11.2.2", + "text": "Uygulamanın, rastgele sayı üreticileri, kimliği doğrulanmış şifreleme, MAC veya özetleme algoritmaları, anahtar uzunlukları, turlar, şifreler ve modların herhangi bir zamanda yeniden yapılandırılabilir, yükseltilebilir veya değiştirilebilir olacağı şekilde kripto çevikliği (crypto agility) ile tasarlandığı doğrulanmalıdır. Aynı şekilde, anahtarların ve parolaların değiştirilebilmesi ve verilerin yeniden şifrelenebilmesi mümkün olmalıdır. Bu, onaylanmış PQC şemalarının yüksek güvenlikli uygulamaları yaygın olarak kullanılabilir hale geldiğinde sorunsuz geçişe olanak tanır.", + "parent": "V11.2" + }, + { + "bom-ref": "V11.2.3", + "identifier": "V11.2.3", + "text": "Tüm kriptografik ilkeliklerin, algoritma, anahtar boyutu ve yapılandırmaya göre minimum 128 bit güvenlik sağladığı doğrulanmalıdır. Örneğin, 256-bit ECC anahtarı yaklaşık 128 bit güvenlik sağlarken, RSA için aynı güvenliği elde etmek 3072-bit anahtar gerektirir.", + "parent": "V11.2" + }, + { + "bom-ref": "V11.2.4", + "identifier": "V11.2.4", + "text": "Tüm kriptografik işlemlerin sabit süreli (constant-time) olduğu, karşılaştırmalarda, hesaplamalarda veya geri dönüşlerde kısa devre (short-circuit) işlemleri yapılmadığı doğrulanmalıdır; bu, bilgi sızıntısını önlemek için gereklidir.", + "parent": "V11.2" + }, + { + "bom-ref": "V11.2.5", + "identifier": "V11.2.5", + "text": "Tüm kriptografik modüllerin güvenli şekilde hata verdiği ve hataların, padding oracle saldırıları gibi zafiyetleri mümkün kılmayacak şekilde ele alındığı doğrulanmalıdır.", + "parent": "V11.2" + }, + { + "bom-ref": "V11.3", + "identifier": "V11.3", + "title": "Şifreleme Algoritmaları", + "parent": "V11" + }, + { + "bom-ref": "V11.3.1", + "identifier": "V11.3.1", + "text": "Güvensiz blok modlarının (örneğin, ECB) ve zayıf doldurma (padding) şemalarının (örneğin, PKCS#1 v1.5) kullanılmadığı doğrulanmalıdır.", + "parent": "V11.3" + }, + { + "bom-ref": "V11.3.2", + "identifier": "V11.3.2", + "text": "Yalnızca AES ile GCM gibi onaylı şifreleme algoritmalarının ve modlarının kullanıldığı doğrulanmalıdır.", + "parent": "V11.3" + }, + { + "bom-ref": "V11.3.3", + "identifier": "V11.3.3", + "text": "Şifrelenmiş verilerin yetkisiz değişikliklere karşı korunduğu doğrulanmalıdır. Tercihen bu koruma, onaylı bir kimliği doğrulanmış şifreleme yöntemi kullanılarak ya da onaylı bir şifreleme yöntemi ile onaylı bir MAC algoritmasının kombinasyonu ile sağlanmalıdır.", + "parent": "V11.3" + }, + { + "bom-ref": "V11.3.4", + "identifier": "V11.3.4", + "text": "Sayılar, başlatma vektörleri (IV) ve diğer tek kullanımlık değerlerin, aynı şifreleme anahtarı ve veri öğesi çifti için birden fazla kez kullanılmadığı doğrulanmalıdır. Oluşturma yöntemi kullanılan algoritmaya uygun olmalıdır.", + "parent": "V11.3" + }, + { + "bom-ref": "V11.3.5", + "identifier": "V11.3.5", + "text": "Şifreleme algoritması ve MAC algoritması kombinasyonlarının \"encrypt-then-MAC\" modunda çalıştığı doğrulanmalıdır.", + "parent": "V11.3" + }, + { + "bom-ref": "V11.4", + "identifier": "V11.4", + "title": "Hashing ve Hash Tabanlı Fonksiyonlar", + "parent": "V11" + }, + { + "bom-ref": "V11.4.1", + "identifier": "V11.4.1", + "text": "Dijital imzalar, HMAC, KDF ve rastgele bit üretimi gibi genel kriptografik kullanım senaryolarında yalnızca onaylı hash fonksiyonlarının kullanıldığı doğrulanmalıdır. MD5 gibi yasaklı hash fonksiyonları hiçbir kriptografik amaçla kullanılmamalıdır.", + "parent": "V11.4" + }, + { + "bom-ref": "V11.4.2", + "identifier": "V11.4.2", + "text": "Parolaların, onaylı, hesaplama açısından yoğun ve mevcut rehberliğe göre yapılandırılmış bir anahtar türetme fonksiyonu (diğer adıyla parola hash'leme fonksiyonu) kullanılarak saklandığı doğrulanmalıdır. Ayarlar, güvenlik ve performans dengesini sağlayarak kaba kuvvet saldırılarını zorlaştırmalıdır.", + "parent": "V11.4" + }, + { + "bom-ref": "V11.4.3", + "identifier": "V11.4.3", + "text": "Dijital imzalarda kullanılan hash fonksiyonlarının, veri bütünlüğü ve kimlik doğrulama amacıyla kullanıldığında çakışmaya karşı dayanıklı ve yeterli bit uzunluğuna sahip olduğu doğrulanmalıdır. Çakışma dayanıklılığı gerekiyorsa çıktı uzunluğu en az 256 bit olmalıdır. Sadece ikinci ön-görüntü (2nd pre-iamge) saldırılarına karşı dayanıklılık gerekiyorsa çıktı uzunluğu en az 128 bit olmalıdır.", + "parent": "V11.4" + }, + { + "bom-ref": "V11.4.4", + "identifier": "V11.4.4", + "text": "Parolalardan gizli anahtarlar türetilirken, onaylı anahtar türetme fonksiyonlarının anahtar uzatma (key stretching) parametreleriyle birlikte kullanıldığı doğrulanmalıdır. Bu parametreler, kaba kuvvet saldırılarını önleyecek şekilde güvenlik ve performans dengesine sahip olmalıdır.", + "parent": "V11.4" + }, + { + "bom-ref": "V11.5", + "identifier": "V11.5", + "title": "Rastgele Değerler", + "parent": "V11" + }, + { + "bom-ref": "V11.5.1", + "identifier": "V11.5.1", + "text": "Tahmin edilemez olması amaçlanan tüm rastgele sayıların ve dizelerin, CSPRNG ile oluşturulduğu ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. UUID'lerin bu koşulu dikkate almadığını unutmayın.", + "parent": "V11.5" + }, + { + "bom-ref": "V11.5.2", + "identifier": "V11.5.2", + "text": "Kullanılan rastgele sayı üretim mekanizmasının, yoğun talep altında dahi güvenli çalışacak şekilde tasarlandığı doğrulanmalıdır.", + "parent": "V11.5" + }, + { + "bom-ref": "V11.6", + "identifier": "V11.6", + "title": "Açık Anahtar (Public Key) Kriptografisi", + "parent": "V11" + }, + { + "bom-ref": "V11.6.1", + "identifier": "V11.6.1", + "text": "Anahtar üretimi, tohumlama (seeding) ve dijital imza üretimi ve doğrulama için yalnızca onaylı kriptografik algoritmalar ve çalışma modlarının kullanıldığı doğrulanmalıdır. Anahtar üretim algoritmaları, bilinen saldırılara karşı savunmasız anahtarlar üretmemelidir. Örneğin, Fermat çarpanlama yöntemine karşı savunmasız RSA anahtarları oluşturulmamalıdır.", + "parent": "V11.6" + }, + { + "bom-ref": "V11.6.2", + "identifier": "V11.6.2", + "text": "Anahtar değişimi için yalnızca onaylı kriptografik algoritmaların kullanıldığı doğrulanmalıdır (örneğin Diffie-Hellman). Kullanılan parametrelerin güvenli olması gerektiğine dikkat edilmelidir. Bu, anahtar kurulum sürecine yönelik saldırıları önleyecek ve araya girme (adversary-in-the-middle) ya da kriptografik kırılmaları engelleyecektir.", + "parent": "V11.6" + }, + { + "bom-ref": "V11.7", + "identifier": "V11.7", + "title": "Kullanım Halindeki Verilerin Kriptografisi", + "parent": "V11" + }, + { + "bom-ref": "V11.7.1", + "identifier": "V11.7.1", + "text": "Hassas verilerin kullanım sırasında korunmasını sağlamak amacıyla, yetkisiz kullanıcıların veya süreçlerin bu verilere erişmesini engelleyen tam bellek şifrelemesinin kullanıldığı doğrulanmalıdır.", + "parent": "V11.7" + }, + { + "bom-ref": "V11.7.2", + "identifier": "V11.7.2", + "text": "Veri asgariyetinin sağlandığı, yani işleme sırasında mümkün olan en az miktarda verinin ortaya çıktığı ve verilerin kullanımdan hemen sonra veya mümkün olan en kısa sürede şifrelendiği doğrulanmalıdır.", + "parent": "V11.7" + }, + { + "bom-ref": "V12", + "identifier": "V12", + "title": "Güvenli İletişim" + }, + { + "bom-ref": "V12.1", + "identifier": "V12.1", + "title": "Genel TLS Güvenlik Rehberi", + "parent": "V12" + }, + { + "bom-ref": "V12.1.1", + "identifier": "V12.1.1", + "text": "Yalnızca TLS protokolünün en güncel ve önerilen sürümlerinin (örneğin TLS 1.2 ve TLS 1.3) etkinleştirildiği ve en son sürümün varsayılan olarak tercih edildiği doğrulanmalıdır.", + "parent": "V12.1" + }, + { + "bom-ref": "V12.1.2", + "identifier": "V12.1.2", + "text": "Yalnızca önerilen şifre takımlarının (cipher suite) etkinleştirildiği ve en güçlü şifre takımlarının tercih edildiği doğrulanmalıdır. Seviye 3 (L3) uygulamalar yalnızca ileri gizlilik (forward secrecy) sağlayan şifre takımlarını desteklemelidir.", + "parent": "V12.1" + }, + { + "bom-ref": "V12.1.3", + "identifier": "V12.1.3", + "text": "Uygulamanın, mTLS istemci sertifikalarını kimlik doğrulama veya yetkilendirme amacıyla kullanmadan önce bu sertifikaların güvendiği sertifikalar arasında olduğunu doğruladığı kontrol edilmelidir.", + "parent": "V12.1" + }, + { + "bom-ref": "V12.1.4", + "identifier": "V12.1.4", + "text": "Online Certificate Status Protocol (OCSP) Stapling gibi geçerli bir sertifika iptal kontrolü yönteminin etkinleştirildiği ve yapılandırıldığı doğrulanmalıdır.", + "parent": "V12.1" + }, + { + "bom-ref": "V12.1.5", + "identifier": "V12.1.5", + "text": "TLS el sıkışma (handshake) sürecinde Server Name Indication (SNI) gibi hassas meta verilerin ifşa edilmesini önlemek için, uygulamanın TLS yapılandırmasında Encrypted Client Hello (ECH) özelliğinin etkinleştirildiği doğrulanmalıdır.", + "parent": "V12.1" + }, + { + "bom-ref": "V12.2", + "identifier": "V12.2", + "title": "Dışa Açık Hizmetlerle HTTPS İletişimi", + "parent": "V12" + }, + { + "bom-ref": "V12.2.1", + "identifier": "V12.2.1", + "text": "İstemci ile dışa açık, HTTP tabanlı hizmetler arasındaki tüm bağlantılarda TLS kullanıldığı ve bu bağlantıların güvensiz ya da şifrelenmemiş iletişime geri dönmediği doğrulanmalıdır.", + "parent": "V12.2" + }, + { + "bom-ref": "V12.2.2", + "identifier": "V12.2.2", + "text": "Dışa açık hizmetlerin herkese açık olarak güvenilen TLS sertifikaları kullandığı doğrulanmalıdır.", + "parent": "V12.2" + }, + { + "bom-ref": "V12.3", + "identifier": "V12.3", + "title": "Genel Servisler Arası İletişim Güvenliği", + "parent": "V12" + }, + { + "bom-ref": "V12.3.1", + "identifier": "V12.3.1", + "text": "Uygulamaya gelen ve uygulamadan çıkan tüm bağlantılarda izleme sistemleri, yönetim araçları, uzaktan erişim ve SSH, ara yazılımlar, veritabanları, ana sistemler (mainframe), iş ortağı sistemleri ya da dış API'ler dahil olmak üzere TLS gibi şifreli bir protokolün kullanıldığı ve güvensiz ya da şifrelenmemiş protokollere geri dönülmediği doğrulanmalıdır.", + "parent": "V12.3" + }, + { + "bom-ref": "V12.3.2", + "identifier": "V12.3.2", + "text": "TLS istemcilerinin bir TLS sunucusu ile iletişime geçmeden önce alınan sertifikaları doğruladığı kontrol edilmelidir.", + "parent": "V12.3" + }, + { + "bom-ref": "V12.3.3", + "identifier": "V12.3.3", + "text": "Uygulama içindeki HTTP tabanlı iç hizmetler arasında gerçekleşen tüm bağlantılarda TLS ya da uygun başka bir aktarım şifreleme mekanizmasının kullanıldığı ve güvensiz ya da şifrelenmemiş iletişime geri dönülmediği doğrulanmalıdır.", + "parent": "V12.3" + }, + { + "bom-ref": "V12.3.4", + "identifier": "V12.3.4", + "text": "İç hizmetler arasındaki TLS bağlantılarında güvenilir sertifikaların kullanıldığı doğrulanmalıdır. İç sistemlerde oluşturulmuş ya da kendinden imzalı (self-signed) sertifikalar kullanılıyorsa, bu sertifikalara güvenen hizmetlerin yalnızca belirli dahili sertifika otoritelerine (CA) ve belirli kendinden imzalı sertifikalara güvenecek şekilde yapılandırıldıkları doğrulanmalıdır.", + "parent": "V12.3" + }, + { + "bom-ref": "V12.3.5", + "identifier": "V12.3.5", + "text": "Sistem içindeki hizmetlerin birbiriyle iletişim kurarken her bir uç noktanın kimliğini doğrulamak için güçlü kimlik doğrulama yöntemlerinin kullanıldığı doğrulanmalıdır. Bu yöntemler arasında, açık anahtar altyapısı (public-key infrastructure) kullanan ve tekrar oynatma saldırılarına karşı dayanıklı olan TLS istemci kimlik doğrulaması gibi yöntemler yer almalıdır. Mikroservis mimarilerinde, sertifika yönetimini basitleştirmek ve güvenliği artırmak amacıyla bir servis ağı (service mesh) kullanılması değerlendirilmelidir.", + "parent": "V12.3" + }, + { + "bom-ref": "V13", + "identifier": "V13", + "title": "Konfigürasyon" + }, + { + "bom-ref": "V13.1", + "identifier": "V13.1", + "title": "Konfigürasyon Dokümantasyonu", + "parent": "V13" + }, + { + "bom-ref": "V13.1.1", + "identifier": "V13.1.1", + "text": "Uygulamanın tüm iletişim ihtiyaçlarının dokümante edildiği doğrulanmalıdır. Buna, uygulamanın bağımlı olduğu dış hizmetler ve son kullanıcının uygulamanın bağlantı kurmasını sağlayabileceği dış konumlar da dahil olmalıdır.", + "parent": "V13.1" + }, + { + "bom-ref": "V13.1.2", + "identifier": "V13.1.2", + "text": "Uygulamanın kullandığı her bir hizmet için, dokümantasyonda eşzamanlı bağlantı sayısı (örn. bağlantı havuzu limitleri) ve bu sınır aşıldığında uygulamanın davranışı, geri dönüş veya kurtarma mekanizmaları da dahil olmak üzere hizmet reddi koşullarını önlemek için tanımlandığı doğrulanmalıdır.", + "parent": "V13.1" + }, + { + "bom-ref": "V13.1.3", + "identifier": "V13.1.3", + "text": "Uygulamanın, kullandığı her bir dış sistem veya hizmet (örn. veritabanları, dosya tanıtıcıları, iş parçacıkları, HTTP bağlantıları) için kaynak yönetimi stratejilerini tanımladığı doğrulanmalıdır. Bu stratejiler, kaynak serbest bırakma prosedürlerini, zaman aşımı ayarlarını, hata durumlarını ve tekrar deneme mantığı uygulanmışsa sınırları, gecikmeleri ve geri çekilme (back-off) algoritmalarını içermelidir. Senkron HTTP istek–yanıt işlemleri için kısa zaman aşımı süreleri zorunlu tutulmalı ve tekrar eden denemeler devre dışı bırakılmalı ya da sıkı şekilde sınırlandırılmalıdır.", + "parent": "V13.1" + }, + { + "bom-ref": "V13.1.4", + "identifier": "V13.1.4", + "text": "Uygulamanın, güvenlik açısından kritik olan gizli verileri tanımladığı ve kuruluşun tehdit modeli ve iş ihtiyaçlarına göre bu verilerin döndürülme (rotation) zamanlamasının belgelendiği doğrulanmalıdır.", + "parent": "V13.1" + }, + { + "bom-ref": "V13.2", + "identifier": "V13.2", + "title": "Backend İletişim Konfigürasyonu", + "parent": "V13" + }, + { + "bom-ref": "V13.2.1", + "identifier": "V13.2.1", + "text": "Uygulamanın, standart kullanıcı oturum mekanizmasını desteklemeyen backend bileşenleri (örneğin API'ler, ara katmanlar, veri katmanları) arasında gerçekleşen iletişimlerin kimlik doğrulamasıyla korunduğu doğrulanmalıdır. Kimlik doğrulama; bireysel hizmet hesapları, kısa ömürlü token'lar ya da sertifika tabanlı kimlik doğrulama ile yapılmalıdır ve parola, API anahtarı ya da ayrıcalıklı erişime sahip paylaşımlı hesaplar gibi sabit kimlik bilgileri kullanılmamalıdır.", + "parent": "V13.2" + }, + { + "bom-ref": "V13.2.2", + "identifier": "V13.2.2", + "text": "Uygulamanın backend bileşenleri arasında (yerel hizmetler, işletim sistemi hizmetleri, API'ler, ara katmanlar ve veri katmanları dahil) gerçekleştirilen iletişimlerin, yalnızca gerekli en az ayrıcalığa sahip hesaplarla yapıldığı doğrulanmalıdır.", + "parent": "V13.2" + }, + { + "bom-ref": "V13.2.3", + "identifier": "V13.2.3", + "text": "Bir hizmet kimlik doğrulaması için bir kimlik bilgisi kullanılması gerekiyorsa, bu kimlik bilgisinin varsayılan bir değer (örneğin root/root veya admin/admin) olmadığının doğrulanması gereklidir.", + "parent": "V13.2" + }, + { + "bom-ref": "V13.2.4", + "identifier": "V13.2.4", + "text": "Uygulamanın iletişim kurmasına izin verilen dış kaynaklar ya da sistemlerin, bir allowlist (izinli liste) ile tanımlandığı doğrulanmalıdır. Bu liste, uygulama katmanında, web sunucusunda, güvenlik duvarında veya farklı katmanların birleşiminde uygulanabilir.", + "parent": "V13.2" + }, + { + "bom-ref": "V13.2.5", + "identifier": "V13.2.5", + "text": "Web veya uygulama sunucusunun, dış sistemlere veri veya dosya gönderimi veya yüklemesi yaparken sadece belirli kaynaklara izin verecek şekilde allowlist ile yapılandırıldığı doğrulanmalıdır.", + "parent": "V13.2" + }, + { + "bom-ref": "V13.2.6", + "identifier": "V13.2.6", + "text": "Uygulamanın farklı hizmetlere bağlantı kurduğu durumlarda, bu bağlantılar için belgelenmiş yapılandırmaları (örn. maksimum eşzamanlı bağlantı, bağlantı limiti aşıldığında davranış, zaman aşımı, tekrar deneme stratejileri) takip ettiğinin doğrulanması gereklidir.", + "parent": "V13.2" + }, + { + "bom-ref": "V13.3", + "identifier": "V13.3", + "title": "Gizli Bilgi Yönetimi", + "parent": "V13" + }, + { + "bom-ref": "V13.3.1", + "identifier": "V13.3.1", + "text": "Parolalar, anahtar materyalleri, veritabanı ve üçüncü parti sistemlerle entegrasyon bilgileri, zaman tabanlı token'lar için tohum (seed) bilgileri, dahili gizli veriler ve API anahtarları gibi backend sırlarının güvenli bir şekilde oluşturulması, saklanması, erişim denetiminin sağlanması ve imha edilmesi için bir gizli bilgi yönetim çözümünün (örneğin key vault) kullanıldığı doğrulanmalıdır. Bu gizli bilgiler uygulama kaynak koduna dahil edilmemeli ve yapı çıktılarında yer almamalıdır. Seviye 3 uygulamalar için donanım destekli bir çözüm (örneğin HSM) gereklidir.", + "parent": "V13.3" + }, + { + "bom-ref": "V13.3.2", + "identifier": "V13.3.2", + "text": "Gizli bilgilere erişimin en az ayrıcalık prensibine uygun şekilde yapılandırıldığı doğrulanmalıdır.", + "parent": "V13.3" + }, + { + "bom-ref": "V13.3.3", + "identifier": "V13.3.3", + "text": "Tüm kriptografik işlemlerin, anahtar materyallerinin güvenli bir şekilde yönetilmesi ve dışarıya sızmasının engellenmesi amacıyla, izole edilmiş bir güvenlik modülü (örneğin vault ya da donanım güvenlik modülü) aracılığıyla gerçekleştirildiği doğrulanmalıdır.", + "parent": "V13.3" + }, + { + "bom-ref": "V13.3.4", + "identifier": "V13.3.4", + "text": "Uygulamanın belgelerinde belirtildiği şekilde gizli bilgilerin süresinin dolacak şekilde yapılandırıldığı ve düzenli olarak döndürüldüğü doğrulanmalıdır.", + "parent": "V13.3" + }, + { + "bom-ref": "V13.4", + "identifier": "V13.4", + "title": "İstenmeyen Bilgi Sızıntısı", + "parent": "V13" + }, + { + "bom-ref": "V13.4.1", + "identifier": "V13.4.1", + "text": "Uygulamanın .git veya .svn klasörleri gibi kaynak kontrolüyle ilgili metadata içermeyecek şekilde deploy edildiğini ya da bu klasörlerin hem dış erişime hem de uygulama erişimine kapalı olduğu doğrulanmalıdır.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.2", + "identifier": "V13.4.2", + "text": "Tüm bileşenler için üretim ortamlarında hata ayıklama (debug) modlarının devre dışı bırakıldığı doğrulanmalıdır.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.3", + "identifier": "V13.4.3", + "text": "Web sunucularının, açık şekilde istenmediği sürece dizin listelemesi (directory listing) özelliğini istemcilere sunmadığı doğrulanmalıdır.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.4", + "identifier": "V13.4.4", + "text": "HTTP TRACE metodunun üretim ortamlarında desteklenmediği, böylece potansiyel bilgi sızıntılarının önlendiği doğrulanmalıdır.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.5", + "identifier": "V13.4.5", + "text": "Belgeler (örneğin dahili API belgeleri) ve izleme uç noktalarının (monitoring endpoints) yalnızca açıkça belirtildiği durumlarda erişilebilir olduğu doğrulanmalıdır.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.6", + "identifier": "V13.4.6", + "text": "Uygulamanın arka uç bileşenlerinin ayrıntılı sürüm bilgilerini ifşa etmediği doğrulanmalıdır.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.7", + "identifier": "V13.4.7", + "text": "Web katmanının yalnızca belirli dosya uzantılarına sahip dosyaları sunacak şekilde yapılandırıldığı, bu sayede istem dışı bilgi, yapılandırma ya da kaynak kod sızıntılarının önlendiği doğrulanmalıdır.", + "parent": "V13.4" + }, + { + "bom-ref": "V14", + "identifier": "V14", + "title": "Veri Koruma" + }, + { + "bom-ref": "V14.1", + "identifier": "V14.1", + "title": "Veri Koruma Dokümantasyonu", + "parent": "V14" + }, + { + "bom-ref": "V14.1.1", + "identifier": "V14.1.1", + "text": "Uygulama tarafından oluşturulan ve işlenen tüm hassas verilerin tanımlanıp, koruma seviyelerine göre sınıflandırıldığından emin olun. Bu, yalnızca kodlanmış (örneğin Base64 stringleri ya da JWT içindeki düz metin yükler gibi) ve bu nedenle kolayca çözülebilir verileri de içermelidir. Koruma seviyeleri, uygulamanın uymakla yükümlü olduğu veri koruma ve gizlilik düzenlemeleri ile standartlarını dikkate almalıdır.", + "parent": "V14.1" + }, + { + "bom-ref": "V14.1.2", + "identifier": "V14.1.2", + "text": "Tüm hassas veri koruma seviyeleri için belgelenmiş bir koruma gereksinimleri seti tanımlandığından emin olun. Bu gereksinimler genel şifreleme, bütünlük doğrulama, saklama süresi, verinin nasıl günlüğe kaydedileceği, günlüklerdeki hassas verilere erişim kontrolleri, veritabanı düzeyinde şifreleme, gizlilik ve gizliliği artırıcı teknolojiler ile diğer gizlilik gereksinimlerini kapsamalıdır.", + "parent": "V14.1" + }, + { + "bom-ref": "V14.2", + "identifier": "V14.2", + "title": "Genel Veri Koruması", + "parent": "V14" + }, + { + "bom-ref": "V14.2.1", + "identifier": "V14.2.1", + "text": "Hassas verilerin yalnızca HTTP message body veya header alanlarında sunucuya gönderildiği ve URL ile sorgu parametrelerinin, API anahtarı veya session token’ı gibi hassas bilgiler içermediği doğrulanmalıdır.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.2", + "identifier": "V14.2.2", + "text": "Hassas verilerin, yük dengeleyiciler ve uygulama önbellekleri gibi sunucu bileşenlerinde önbelleğe alınmasının engellendiği veya kullanım sonrası bu verilerin güvenli biçimde temizlendiği doğrulanmalıdır.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.3", + "identifier": "V14.2.3", + "text": "Uygulama kontrolü dışında veri toplanmasını engellemek için, tanımlanmış hassas verilerin, kullanıcı izleyicileri gibi güvensiz taraflara gönderilmediği doğrulanmalıdır.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.4", + "identifier": "V14.2.4", + "text": "Hassas verilere yönelik şifreleme, bütünlük doğrulama, veri saklama, loglama yöntemi, loglardaki erişim kontrolleri, gizlilik teknolojileri gibi kontrollerin, söz konusu verinin belgelenmiş koruma seviyesinde tanımlandığı şekilde uygulandığı doğrulanmalıdır.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.5", + "identifier": "V14.2.5", + "text": "Önbellekleme mekanizmalarının yalnızca belirli içerik türüne sahip yanıtları önbelleğe alacak şekilde yapılandırıldığı ve hassas, dinamik içeriklerin önbelleğe alınmadığı doğrulanmalıdır. Web sunucusu, mevcut olmayan bir dosya talebinde geçerli ama farklı bir dosya döndürmek yerine 404 veya 302 cevabı vermelidir. Bu, Web Cache Deception saldırılarını önlemeye yardımcı olur.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.6", + "identifier": "V14.2.6", + "text": "Uygulamanın yalnızca işlevsellik için gerekli olan asgari hassas veriyi döndürdüğü doğrulanmalıdır. Örneğin, kredi kartı numarasının yalnızca bazı rakamlarının döndürülmesi; tam numaranın döndürülmesi gerekiyorsa, kullanıcı arayüzünde gizlenmiş (maskelenmiş) şekilde sunulması gerekir, aksi kullanıcı özel olarak görüntülemek istemedikçe gösterilmemelidir.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.7", + "identifier": "V14.2.7", + "text": "Hassas bilgilerin, veri saklama sınıflandırmasına tabi tutulduğu, geçerliliğini yitirmiş veya artık gerekli olmayan verilerin belirlenmiş bir zaman çizelgesiyle ya da gerektiğinde otomatik olarak silindiği doğrulanmalıdır.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.8", + "identifier": "V14.2.8", + "text": "Kullanıcı tarafından yüklenen dosyaların meta verilerinden hassas bilgilerin çıkarıldığı veya bu bilgilerin yalnızca kullanıcıdan açık onay alındığında saklandığı doğrulanmalıdır.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.3", + "identifier": "V14.3", + "title": "İstemci Tarafı Veri Koruması", + "parent": "V14" + }, + { + "bom-ref": "V14.3.1", + "identifier": "V14.3.1", + "text": "Kimliği doğrulanmış verilerin, istemci veya oturum sonlandığında istemci depolamasından (örneğin tarayıcı DOM’undan) temizlendiği doğrulanmalıdır. 'Clear-Site-Data' HTTP response header bu konuda yardımcı olabilir ancak istemci tarafı, sunucu bağlantısı mevcut olmadığında da temizlik işlemini yapabiliyor olmalıdır.", + "parent": "V14.3" + }, + { + "bom-ref": "V14.3.2", + "identifier": "V14.3.2", + "text": "Uygulamanın, tarayıcılarda hassas verilerin önbelleğe alınmasını önlemek amacıyla yeterli anti-önbellekleme HTTP response header (örneğin Cache-Control: no-store) ayarladığı doğrulanmalıdır.", + "parent": "V14.3" + }, + { + "bom-ref": "V14.3.3", + "identifier": "V14.3.3", + "text": "Tarayıcıda depolanan verilerin (örneğin localStorage, sessionStorage, IndexedDB veya çerezler) hassas veri içermediği, yalnızca session token’larının istisna olarak kabul edildiği doğrulanmalıdır.", + "parent": "V14.3" + }, + { + "bom-ref": "V15", + "identifier": "V15", + "title": "Güvenli Kodlama ve Mimari" + }, + { + "bom-ref": "V15.1", + "identifier": "V15.1", + "title": "Güvenli Kodlama ve Mimari Dokümantasyonu", + "parent": "V15" + }, + { + "bom-ref": "V15.1.1", + "identifier": "V15.1.1", + "text": "Güvenlik açığı içeren üçüncü taraf bileşen sürümleri ve genel olarak kütüphane güncellemeleri için, uygulama dokümantasyonunda risk bazlı düzeltme zamanlarının tanımlandığı doğrulanmalıdır.", + "parent": "V15.1" + }, + { + "bom-ref": "V15.1.2", + "identifier": "V15.1.2", + "text": "Yazılım bileşen listesi (Software Bill of Materials - SBOM) gibi bir envanterin tutulduğu, kullanılan tüm üçüncü taraf kütüphanelerin önceden tanımlanmış, güvenilir ve düzenli olarak güncellenen depolardan alındığı doğrulanmalıdır.", + "parent": "V15.1" + }, + { + "bom-ref": "V15.1.3", + "identifier": "V15.1.3", + "text": "Uygulama dokümantasyonunda zaman veya kaynak açısından yoğun işlevlerin tanımlandığı, bu işlevlerin aşırı kullanımı durumunda kullanılabilirlik kaybının nasıl önleneceği ve yanıt oluşturma süresinin istemci zaman aşımını aşmaması için hangi önlemlerin alındığı belirtilmelidir. Örnek savunmalar kuyruklama, eşzamansız işleme, kullanıcı başına ve uygulama genelinde paralel işlem sınırlarını içerebilir.", + "parent": "V15.1" + }, + { + "bom-ref": "V15.1.4", + "identifier": "V15.1.4", + "text": "Uygulama dokümantasyonunda \"riskli bileşenler\" olarak değerlendirilen üçüncü taraf kütüphanelerin vurgulandığı doğrulanmalıdır.", + "parent": "V15.1" + }, + { + "bom-ref": "V15.1.5", + "identifier": "V15.1.5", + "text": "Uygulama dokümantasyonunda \"tehlikeli işlevsellik\" içeren uygulama bölümlerinin açıkça belirtildiği doğrulanmalıdır.", + "parent": "V15.1" + }, + { + "bom-ref": "V15.2", + "identifier": "V15.2", + "title": "Güvenlik Mimarisi ve Bağımlılıklar", + "parent": "V15" + }, + { + "bom-ref": "V15.2.1", + "identifier": "V15.2.1", + "text": "Uygulamanın yalnızca, belgelenmiş güncelleme ve düzeltme sürelerini aşmamış bileşenleri içerdiği doğrulanmalıdır.", + "parent": "V15.2" + }, + { + "bom-ref": "V15.2.2", + "identifier": "V15.2.2", + "text": "Uygulamanın, belgelenmiş güvenlik kararları ve stratejilere dayanarak, zaman veya kaynak açısından yoğun işlevlerin neden olabileceği kullanılabilirlik kaybına karşı savunmalar uyguladığı doğrulanmalıdır.", + "parent": "V15.2" + }, + { + "bom-ref": "V15.2.3", + "identifier": "V15.2.3", + "text": "Üretim ortamının yalnızca uygulamanın çalışması için gerekli işlevleri içerdiği ve test kodları, örnek kod parçaları veya geliştirme işlevleri gibi gereksiz işlevsellikleri açığa çıkarmadığı doğrulanmalıdır.", + "parent": "V15.2" + }, + { + "bom-ref": "V15.2.4", + "identifier": "V15.2.4", + "text": "Üçüncü taraf bileşenlerin ve bunların tüm transitif bağımlılıklarının beklenen depolardan (iç kaynaklı ya da harici) alındığı ve bağımlılık karışıklığı (dependency confusion) saldırılarına açık olmadığı doğrulanmalıdır.", + "parent": "V15.2" + }, + { + "bom-ref": "V15.2.5", + "identifier": "V15.2.5", + "text": "Uygulamanın, “tehlikeli işlevsellik” içeren veya “riskli bileşenler” kullanan bölümlerine ek korumalar uyguladığı doğrulanmalıdır. Bu korumalar sandbox, kapsülleme, konteynerleştirme veya ağ düzeyinde izolasyon gibi teknikler aracılığıyla, bir uygulama bölümünün ele geçirilmesi durumunda saldırganın diğer bölümlere sıçramasını geciktirmeyi veya engellemeyi amaçlamalıdır.", + "parent": "V15.2" + }, + { + "bom-ref": "V15.3", + "identifier": "V15.3", + "title": "Savunmacı Kodlama", + "parent": "V15" + }, + { + "bom-ref": "V15.3.1", + "identifier": "V15.3.1", + "text": "Uygulamanın yalnızca gerekli alanların bir alt kümesini veri nesnesinden döndürdüğü doğrulanmalıdır. Örneğin, bazı alanlara kullanıcıların erişmemesi gerektiğinden tüm veri nesnesi döndürülmemelidir.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.2", + "identifier": "V15.3.2", + "text": "Uygulama backend'i harici URL’lere çağrı yaptığında, yalnızca amaçlanan işlevsellik söz konusuysa yönlendirmeleri takip edecek şekilde yapılandırıldığının doğrulanması gerekir.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.3", + "identifier": "V15.3.3", + "text": "Uygulamanın, kitlesel atama saldırılarına karşı, her bir controller ve eylem için izin verilen alanları sınırlandırarak savunmalar sağladığı doğrulanmalıdır. Örneğin, bir alan değeri, bu işlemde değiştirilmesi amaçlanmadıysa eklenememeli veya güncellenememelidir.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.4", + "identifier": "V15.3.4", + "text": "Tüm proxy ve ara katman bileşenlerinin kullanıcının orijinal IP adresini, uç kullanıcı tarafından değiştirilemeyecek güvenilir veri alanları kullanarak doğru şekilde ilettiği ve uygulamanın ve web sunucusunun bu doğru değeri, loglama ve hız sınırlama gibi güvenlik kararları için kullandığı doğrulanmalıdır. Ayrıca, orijinal IP adresinin bile dinamik IP'ler, VPN'ler veya kurumsal güvenlik duvarları nedeniyle güvenilir olmayabileceği dikkate alınmalıdır.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.5", + "identifier": "V15.3.5", + "text": "Uygulamanın değişkenlerin doğru türde olduğunu açıkça doğruladığı ve sıkı eşitlik ve karşılaştırma işlemleri kullandığı doğrulanmalıdır. Bu, değişken türüyle ilgili varsayımlardan kaynaklanan tür oynama (type juggling) veya tür karışıklığı (type confusion) güvenlik açıklarını önlemek içindir.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.6", + "identifier": "V15.3.6", + "text": "JavaScript kodunun prototip zehirleme (prototype pollution) saldırılarını önleyecek şekilde yazıldığı, örneğin, nesne literal’leri yerine Set() veya Map() gibi yapılar kullanıldığı doğrulanmalıdır.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.7", + "identifier": "V15.3.7", + "text": "Uygulamanın, özellikle framework'ün istek parametrelerinin kaynağı (sorgu dizgisi, gövde parametreleri, çerezler veya başlık alanları) arasında ayrım yapmadığı durumlarda, HTTP parametre kirliliği (HTTP parameter pollution) saldırılarına karşı savunmalar uyguladığı doğrulanmalıdır.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.4", + "identifier": "V15.4", + "title": "Güvenli Eş Zamanlılık (Concurrency)", + "parent": "V15" + }, + { + "bom-ref": "V15.4.1", + "identifier": "V15.4.1", + "text": "Çok iş parçacıklı kodda (örneğin cache'ler, dosyalar veya birden fazla iş parçacığı tarafından erişilen bellek içi nesneler gibi) paylaşılan nesnelere yalnızca thread-safe (iş parçacığı güvenli) türler ve kilitleme (lock) veya semaphore gibi senkronizasyon mekanizmaları kullanılarak erişildiği doğrulanmalıdır. Bu, yarış durumlarını ve veri bozulmasını önlemeye yöneliktir.", + "parent": "V15.4" + }, + { + "bom-ref": "V15.4.2", + "identifier": "V15.4.2", + "text": "Bir kaynağın durumu üzerindeki kontroller (örneğin varlığı ya da izinleri gibi) ile bu kontrole bağlı eylemlerin tek bir atomik işlem olarak gerçekleştirildiği doğrulanmalıdır. Bu, TOCTOU (time-of-check to time-of-use) yarış durumlarını önlemeye yöneliktir. Bir dosyanın varlığının kontrol edilip ardından açılması veya bir kullanıcının erişiminin doğrulanıp ardından yetki verilmesi gibi işlemler buna örnektir.", + "parent": "V15.4" + }, + { + "bom-ref": "V15.4.3", + "identifier": "V15.4.3", + "text": "Kilitlerin (locks) tutarlı biçimde kullanıldığı, iş parçacıklarının birbirini beklemesi ya da sonsuz döngüye girmesi (deadlock veya livelock) gibi durumların önlendiği doğrulanmalıdır. Ayrıca, kilitleme mantığı, kaynağı yöneten kod içinde kalmalı ve dış sınıflar veya dış kodlar tarafından istemeden veya kötü niyetli şekilde değiştirilememelidir.", + "parent": "V15.4" + }, + { + "bom-ref": "V15.4.4", + "identifier": "V15.4.4", + "text": "Kaynak tahsis politikalarının, iş parçacığı açlığını önleyecek şekilde, kaynaklara adil erişimi sağladığı doğrulanmalıdır. Örneğin, thread pool (iş parçacığı havuzu) kullanımı, düşük öncelikli iş parçacıklarının da makul sürelerde çalışabilmesi için uygulanmalıdır.", + "parent": "V15.4" + }, + { + "bom-ref": "V16", + "identifier": "V16", + "title": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi" + }, + { + "bom-ref": "V16.1", + "identifier": "V16.1", + "title": "Güvenlik Loglaması Dokümantasyonu", + "parent": "V16" + }, + { + "bom-ref": "V16.1.1", + "identifier": "V16.1.1", + "text": "Uygulamanın teknoloji yığını boyunca her katmanda hangi olayların loglandığını, log formatlarını, logların nereye yazıldığını, nasıl kullanıldığını, erişimin nasıl kontrol edildiğini ve logların ne kadar süre saklandığını belgeleyen bir envanterin mevcut olduğu doğrulanmalıdır.", + "parent": "V16.1" + }, + { + "bom-ref": "V16.2", + "identifier": "V16.2", + "title": "Genel Loglama", + "parent": "V16" + }, + { + "bom-ref": "V16.2.1", + "identifier": "V16.2.1", + "text": "Her bir log girdisinin, olayın ne zaman, nerede, kim tarafından ve ne olduğuna dair detaylı bir zaman çizelgesi oluşturulmasına olanak tanıyacak gerekli meta verileri içerdiği doğrulanmalıdır.", + "parent": "V16.2" + }, + { + "bom-ref": "V16.2.2", + "identifier": "V16.2.2", + "text": "Tüm loglama bileşenlerinin zaman kaynaklarının senkronize olduğu ve güvenlik olayı meta verisindeki zaman damgalarının UTC kullanarak ya da açık zaman dilimi ofsetiyle belirtildiği doğrulanmalıdır. UTC kullanımı, özellikle yaz saati uygulamaları nedeniyle oluşabilecek karışıklıkları önlemek için tavsiye edilir.", + "parent": "V16.2" + }, + { + "bom-ref": "V16.2.3", + "identifier": "V16.2.3", + "text": "Uygulamanın yalnızca log envanterinde belgelenmiş dosya ve hizmetlere log yazdığı ya da ilettiği doğrulanmalıdır.", + "parent": "V16.2" + }, + { + "bom-ref": "V16.2.4", + "identifier": "V16.2.4", + "text": "Logların kullanılan log işleyici (log processor) tarafından okunabildiği ve ilişkilendirilebildiği doğrulanmalıdır. Tercihen yaygın bir log formatı kullanılmalıdır.", + "parent": "V16.2" + }, + { + "bom-ref": "V16.2.5", + "identifier": "V16.2.5", + "text": "Hassas veriler loglanırken, uygulamanın veri koruma seviyesine uygun olarak loglama yaptığı doğrulanmalıdır. Örneğin kimlik bilgileri veya ödeme detayları gibi bazı verilerin loglanmasına izin verilmemelidir. Session token’ları gibi veriler ise yalnızca tamamen ya da kısmen maskelenmiş ya da hash’lenmiş olarak loglanmalıdır.", + "parent": "V16.2" + }, + { + "bom-ref": "V16.3", + "identifier": "V16.3", + "title": "Güvenlik Olayları", + "parent": "V16" + }, + { + "bom-ref": "V16.3.1", + "identifier": "V16.3.1", + "text": "Tüm kimlik doğrulama işlemlerinin (başarılı ve başarısız girişimler dahil) loglandığı doğrulanmalıdır. Kullanılan kimlik doğrulama türü veya faktörleri gibi ek meta veriler de toplanmalıdır.", + "parent": "V16.3" + }, + { + "bom-ref": "V16.3.2", + "identifier": "V16.3.2", + "text": "Başarısız yetkilendirme girişimlerinin loglandığı doğrulanmalıdır. Seviye 3 uygulamalar için, tüm yetkilendirme kararlarının ve hassas verilere erişim olaylarının (verinin kendisi olmadan) loglandığı da doğrulanmalıdır.", + "parent": "V16.3" + }, + { + "bom-ref": "V16.3.3", + "identifier": "V16.3.3", + "text": "Uygulamanın, belgelenmiş güvenlik olaylarını ve güvenlik kontrollerini aşma girişimlerini (girdi doğrulama, iş mantığı, otomasyon karşıtı kontroller vb.) logladığı doğrulanmalıdır.", + "parent": "V16.3" + }, + { + "bom-ref": "V16.3.4", + "identifier": "V16.3.4", + "text": "Beklenmeyen hatalar ve güvenlik kontrolü başarısızlıkları (örneğin backend TLS hataları gibi) loglandığı doğrulanmalıdır.", + "parent": "V16.3" + }, + { + "bom-ref": "V16.4", + "identifier": "V16.4", + "title": "Log Koruması", + "parent": "V16" + }, + { + "bom-ref": "V16.4.1", + "identifier": "V16.4.1", + "text": "Tüm loglama bileşenlerinin, log enjeksiyonunu (log injection) önlemek amacıyla verileri uygun biçimde encode ettiği doğrulanmalıdır.", + "parent": "V16.4" + }, + { + "bom-ref": "V16.4.2", + "identifier": "V16.4.2", + "text": "Logların yetkisiz erişime karşı korunduğu ve değiştirilemez olduğu doğrulanmalıdır.", + "parent": "V16.4" + }, + { + "bom-ref": "V16.4.3", + "identifier": "V16.4.3", + "text": "Logların analiz, tespit, uyarı ve yükseltme amacıyla mantıksal olarak ayrı bir sisteme güvenli biçimde iletildiği doğrulanmalıdır. Böylece uygulama ihlal edilse bile logların tehlikeye girmesi önlenmiş olur.", + "parent": "V16.4" + }, + { + "bom-ref": "V16.5", + "identifier": "V16.5", + "title": "Hata Yönetimi", + "parent": "V16" + }, + { + "bom-ref": "V16.5.1", + "identifier": "V16.5.1", + "text": "Beklenmedik ya da güvenlikle ilgili bir hata oluştuğunda, tüketiciye genel bir mesaj döndürüldüğü ve yığın izleri (stack trace), sorgular, gizli anahtarlar, token’lar gibi hassas sistem içi verilerin açıklanmadığı doğrulanmalıdır.", + "parent": "V16.5" + }, + { + "bom-ref": "V16.5.2", + "identifier": "V16.5.2", + "text": "Uygulamanın, dış kaynaklara erişim başarısız olduğunda bile güvenli şekilde çalışmaya devam ettiği doğrulanmalıdır. Örneğin, circuit breaker ya da graceful degradation gibi desenler kullanılmalıdır.", + "parent": "V16.5" + }, + { + "bom-ref": "V16.5.3", + "identifier": "V16.5.3", + "text": "Uygulamanın hata durumlarında güvenli ve düzenli şekilde başarısız olduğu doğrulanmalıdır. Bu, örneğin doğrulama hatalarına rağmen işlemlerin işlenmesine yol açabilecek fail-open durumlarını önlemelidir.", + "parent": "V16.5" + }, + { + "bom-ref": "V16.5.4", + "identifier": "V16.5.4", + "text": "Ele alınmamış tüm istisnaları yakalayacak şekilde tanımlanmış bir “son çare hata yöneticisi” bulunduğu doğrulanmalıdır. Bu, hem loglara gitmesi gereken hata detaylarının kaybolmaması hem de tüm uygulama sürecinin çökerek hizmet dışı kalmasının önlenmesi açısından önemlidir.", + "parent": "V16.5" + }, + { + "bom-ref": "V17", + "identifier": "V17", + "title": "WebRTC" + }, + { + "bom-ref": "V17.1", + "identifier": "V17.1", + "title": "TURN Sunucusu", + "parent": "V17" + }, + { + "bom-ref": "V17.1.1", + "identifier": "V17.1.1", + "text": "TURN hizmetinin yalnızca özel amaçlar için ayrılmamış IP adreslerine (ör. iç ağlar, yayın adresleri, loopback) erişime izin verdiği doğrulanmalıdır. Bu gereksinim hem IPv4 hem de IPv6 adresleri için geçerlidir.", + "parent": "V17.1" + }, + { + "bom-ref": "V17.1.2", + "identifier": "V17.1.2", + "text": "TURN hizmetinin, meşru kullanıcıların sunucuda çok sayıda bağlantı noktası açmaya çalışması durumunda kaynak tüketimi saldırılarına karşı dayanıklı olduğu doğrulanmalıdır.", + "parent": "V17.1" + }, + { + "bom-ref": "V17.2", + "identifier": "V17.2", + "title": "Medya", + "parent": "V17" + }, + { + "bom-ref": "V17.2.1", + "identifier": "V17.2.1", + "text": "DTLS sertifikası anahtarının, belgelenmiş kriptografik anahtar yönetim politikasına uygun şekilde yönetildiği ve korunduğu doğrulanmalıdır.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.2", + "identifier": "V17.2.2", + "text": "Medya sunucusunun onaylı DTLS şifre takımlarını (cipher suites) ve Güvenli Gerçek Zamanlı Aktarım Protokolü (Secure Real-time Transport Protocol - SRTP) için anahtarlar oluşturmaya yönelik DTLS Uzantısı için güvenli bir koruma profilini kullanacak ve destekleyecek şekilde yapılandırıldığı (DTLS-SRTP) doğrulanmalıdır.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.3", + "identifier": "V17.2.3", + "text": "Real-time Transport Protocol (RTP) injection saldırılarının bir hizmet reddi durumuna veya medya akışlarına ses veya video medyası eklenmesine yol açmasını önlemek için medya sunucusunda Güvenli SRTP kimlik doğrulamasının kontrol edildiği doğrulanmalıdır.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.4", + "identifier": "V17.2.4", + "text": "Verify that the media server is able to continue processing incoming media traffic when encountering malformed Secure Real-time Transport Protocol (SRTP) packets.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.5", + "identifier": "V17.2.5", + "text": "Medya sunucusunun, meşru kullanıcılardan gelen SRTP flood'ı sırasında gelen medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.6", + "identifier": "V17.2.6", + "text": "Medya sunucusunun DTLS içinde yer alan \"ClientHello\" yarış durumu güvenlik açığına karşı savunmasız olmadığı, medya sunucusunun güvenlik açığına sahip olduğunun açıkça bilinip bilinmediği kontrol edilerek veya yarış koşulu testi gerçekleştirilerek doğrulanmalıdır.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.7", + "identifier": "V17.2.7", + "text": "Medya sunucusuna bağlı ses veya video kayıt mekanizmalarının, meşru kullanıcı kaynaklı SRTP flood'ı sırasında medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.8", + "identifier": "V17.2.8", + "text": "DTLS sertifikasının, SDP (Session Description Protocol) fingerprint özelliği ile karşılaştırıldığı ve doğrulama başarısız olursa medya akışının sonlandırıldığı, medya akışının özgünlüğünü sağlamak için doğrulanmalıdır.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.3", + "identifier": "V17.3", + "title": "Sinyalizasyon", + "parent": "V17" + }, + { + "bom-ref": "V17.3.1", + "identifier": "V17.3.1", + "text": "Sinyalizasyon sunucusunun, flood saldırısı altında bile meşru sinyalizasyon mesajlarını işlemeye devam edebildiği doğrulanmalıdır. Bu, sinyalizasyon düzeyinde oran sınırlaması uygulanarak sağlanmalıdır.", + "parent": "V17.3" + }, + { + "bom-ref": "V17.3.2", + "identifier": "V17.3.2", + "text": "Sinyalizasyon sunucusunun, hizmet reddine yol açabilecek şekilde yapılandırılmış bozuk sinyalizasyon mesajlarıyla karşılaştığında bile meşru mesajları işlemeye devam edebildiği doğrulanmalıdır. Bu, girdi doğrulaması, integer overflow ve buffer overflow'a karşı savunma ve sağlam hata işleme teknikleri ile sağlanmalıdır.", + "parent": "V17.3" + } + ], + "levels": [ + { + "bom-ref": "level-1", + "identifier": "Level 1", + "description": "This level contains the minimum requirements to consider when securing an application and represents a critical starting point.", + "requirements": [ + "V1.2.1", + "V1.2.2", + "V1.2.3", + "V1.2.4", + "V1.2.5", + "V1.3.1", + "V1.3.2", + "V1.5.1", + "V2.1.1", + "V2.2.1", + "V2.2.2", + "V2.3.1", + "V3.2.1", + "V3.2.2", + "V3.3.1", + "V3.4.2", + "V3.5.1", + "V3.5.2", + "V4.1.1", + "V4.4.1", + "V5.2.1", + "V5.2.2", + "V5.3.1", + "V5.3.2", + "V6.1.1", + "V6.2.1", + "V6.2.2", + "V6.2.3", + "V6.2.4", + "V6.2.5", + "V6.2.6", + "V6.2.7", + "V6.2.8", + "V6.3.1", + "V6.3.2", + "V6.4.1", + "V6.4.2", + "V7.2.1", + "V7.2.2", + "V7.2.3", + "V7.2.4", + "V7.4.1", + "V7.4.2", + "V8.1.1", + "V8.2.1", + "V8.2.2", + "V8.3.1", + "V9.1.1", + "V9.1.2", + "V9.1.3", + "V9.2.1", + "V10.4.1", + "V10.4.2", + "V10.4.3", + "V10.4.4", + "V10.4.5", + "V11.3.1", + "V11.3.2", + "V11.4.1", + "V12.1.1", + "V12.2.1", + "V12.2.2", + "V13.4.1", + "V14.2.1", + "V14.3.1", + "V15.1.1", + "V15.2.1", + "V15.3.1" + ] + }, + { + "bom-ref": "level-2", + "identifier": "Level 2", + "description": "ASVS Level 2 requirements generally relate to either less common attacks or more complicated protections against common attacks. They may still be a first layer of defense, or they may require certain preconditions for the attack to be successful.", + "requirements": [ + "V1.1.1", + "V1.1.2", + "V1.2.6", + "V1.2.7", + "V1.2.8", + "V1.2.9", + "V1.3.3", + "V1.3.4", + "V1.3.5", + "V1.3.6", + "V1.3.7", + "V1.3.8", + "V1.3.9", + "V1.3.10", + "V1.3.11", + "V1.4.1", + "V1.4.2", + "V1.4.3", + "V1.5.2", + "V2.1.2", + "V2.1.3", + "V2.2.3", + "V2.3.2", + "V2.3.3", + "V2.3.4", + "V2.4.1", + "V3.3.2", + "V3.3.3", + "V3.3.4", + "V3.4.3", + "V3.4.4", + "V3.4.5", + "V3.4.6", + "V3.5.4", + "V3.7.1", + "V3.7.2", + "V4.1.2", + "V4.1.3", + "V4.2.1", + "V4.3.1", + "V4.3.2", + "V4.4.2", + "V4.4.3", + "V4.4.4", + "V5.1.1", + "V5.2.3", + "V5.4.1", + "V5.4.2", + "V5.4.3", + "V6.1.2", + "V6.1.3", + "V6.2.9", + "V6.2.10", + "V6.2.11", + "V6.2.12", + "V6.3.3", + "V6.3.4", + "V6.4.3", + "V6.4.4", + "V6.5.1", + "V6.5.2", + "V6.5.3", + "V6.5.4", + "V6.5.5", + "V6.6.1", + "V6.6.2", + "V6.6.3", + "V6.8.1", + "V6.8.2", + "V6.8.3", + "V6.8.4", + "V7.1.1", + "V7.1.2", + "V7.1.3", + "V7.3.1", + "V7.3.2", + "V7.4.3", + "V7.4.4", + "V7.4.5", + "V7.5.1", + "V7.5.2", + "V7.6.1", + "V7.6.2", + "V8.1.2", + "V8.2.3", + "V8.4.1", + "V9.2.2", + "V9.2.3", + "V9.2.4", + "V10.1.1", + "V10.1.2", + "V10.2.1", + "V10.2.2", + "V10.3.1", + "V10.3.2", + "V10.3.3", + "V10.3.4", + "V10.4.6", + "V10.4.7", + "V10.4.8", + "V10.4.9", + "V10.4.10", + "V10.4.11", + "V10.5.1", + "V10.5.2", + "V10.5.3", + "V10.5.4", + "V10.5.5", + "V10.6.1", + "V10.6.2", + "V10.7.1", + "V10.7.2", + "V10.7.3", + "V11.1.1", + "V11.1.2", + "V11.2.1", + "V11.2.2", + "V11.2.3", + "V11.3.3", + "V11.4.2", + "V11.4.3", + "V11.4.4", + "V11.5.1", + "V11.6.1", + "V12.1.2", + "V12.1.3", + "V12.3.1", + "V12.3.2", + "V12.3.3", + "V12.3.4", + "V13.1.1", + "V13.2.1", + "V13.2.2", + "V13.2.3", + "V13.2.4", + "V13.2.5", + "V13.3.1", + "V13.3.2", + "V13.4.2", + "V13.4.3", + "V13.4.4", + "V13.4.5", + "V14.1.1", + "V14.1.2", + "V14.2.2", + "V14.2.3", + "V14.2.4", + "V14.3.2", + "V14.3.3", + "V15.1.2", + "V15.1.3", + "V15.2.2", + "V15.2.3", + "V15.3.2", + "V15.3.3", + "V15.3.4", + "V15.3.5", + "V15.3.6", + "V15.3.7", + "V16.1.1", + "V16.2.1", + "V16.2.2", + "V16.2.3", + "V16.2.4", + "V16.2.5", + "V16.3.1", + "V16.3.2", + "V16.3.3", + "V16.3.4", + "V16.4.1", + "V16.4.2", + "V16.4.3", + "V16.5.1", + "V16.5.2", + "V16.5.3", + "V17.1.1", + "V17.2.1", + "V17.2.2", + "V17.2.3", + "V17.2.4", + "V17.3.1", + "V17.3.2" + ] + }, + { + "bom-ref": "level-3", + "identifier": "Level 3", + "description": "ASVS Level 3 should be the goal for applications looking to demonstrate the highest levels of security and requirements in this section are generally either defense-in-depth mechanisms or other useful but hard-to-implement controls.", + "requirements": [ + "V1.2.10", + "V1.3.12", + "V1.5.3", + "V2.3.5", + "V2.4.2", + "V3.1.1", + "V3.2.3", + "V3.3.5", + "V3.4.8", + "V3.5.6", + "V3.5.7", + "V3.5.8", + "V3.6.1", + "V3.7.3", + "V3.7.4", + "V3.7.5", + "V4.1.4", + "V4.1.5", + "V4.2.2", + "V4.2.3", + "V4.2.4", + "V4.2.5", + "V5.2.4", + "V5.2.5", + "V5.2.6", + "V5.3.3", + "V6.3.5", + "V6.3.6", + "V6.3.7", + "V6.3.8", + "V6.4.5", + "V6.4.6", + "V6.5.6", + "V6.5.7", + "V6.5.8", + "V6.6.4", + "V6.7.1", + "V6.7.2", + "V7.5.3", + "V8.1.3", + "V8.1.4", + "V8.2.4", + "V8.3.2", + "V8.3.3", + "V8.4.2", + "V10.2.3", + "V10.3.5", + "V10.4.12", + "V10.4.13", + "V10.4.14", + "V10.4.15", + "V10.4.16", + "V11.1.3", + "V11.1.4", + "V11.2.4", + "V11.2.5", + "V11.3.4", + "V11.3.5", + "V11.5.2", + "V11.6.2", + "V11.7.1", + "V11.7.2", + "V12.1.4", + "V12.1.5", + "V12.3.5", + "V13.1.2", + "V13.1.3", + "V13.1.4", + "V13.2.6", + "V13.3.3", + "V13.3.4", + "V13.4.6", + "V13.4.7", + "V14.2.5", + "V14.2.6", + "V14.2.7", + "V14.2.8", + "V15.1.4", + "V15.1.5", + "V15.2.4", + "V15.2.5", + "V15.4.1", + "V15.4.2", + "V15.4.3", + "V15.4.4", + "V16.5.4", + "V17.1.2", + "V17.2.5", + "V17.2.6", + "V17.2.7", + "V17.2.8" + ] + } + ], + "externalReferences": [ + { + "type": "website", + "url": "https://owasp.org/asvs" + }, + { + "type": "vcs", + "url": "https://github.com/OWASP/ASVS" + }, + { + "type": "issue-tracker", + "url": "https://github.com/OWASP/ASVS/issues" + }, + { + "type": "social", + "url": "https://twitter.com/OWASP_ASVS" + } + ] + } + ] + } +} diff --git a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.csv b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.csv new file mode 100644 index 0000000000..487b444c7d --- /dev/null +++ b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.csv @@ -0,0 +1,343 @@ +chapter_id,chapter_name,section_id,section_name,req_id,req_description,L +V1,Kodlama (Encoding) ve Temizleme,V1.1,Kodlama ve Temizleme Mimarisi,V1.1.1,"Girdinin yalnızca bir kez kanonik forma (canonical form) çözümlendiği veya kaçış işlemlerinin kaldırıldığı, bu işlemin yalnızca verinin bu biçimde beklenmesi durumunda yapıldığı ve bu işlemin girdi doğrulama veya temizleme işlemlerinden sonra değil, önce gerçekleştiği doğrulanmalıdır.",2 +V1,Kodlama (Encoding) ve Temizleme,V1.1,Kodlama ve Temizleme Mimarisi,V1.1.2,"Uygulamanın, çıktıyı kullanılması gereken yorumlayıcıya verilmeden hemen önce veya yorumlayıcının kendisi tarafından çıktı kodlaması ya da kaçış işlemi yaptığı doğrulanmalıdır.",2 +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.1,"HTTP yanıtı, HTML veya XML belgesi için yapılan çıktı kodlamasının; HTML elemanları, HTML öznitelikleri, HTML yorumları, CSS ya da HTTP başlık alanları gibi bağlamlara uygun olduğu doğrulanmalıdır. Böylece mesaj veya belge yapısının bozulması önlenir.",1 +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.2,"Dinamik olarak URL oluşturulurken, güvenilmeyen verinin bağlamına göre (örneğin, sorgu veya yol parametreleri için URL kodlaması ya da base64url kodlaması) kodlandığı doğrulanmalıdır. Yalnızca güvenli URL protokollerine izin verilmelidir (örneğin, javascript: veya data: yasaklanmalıdır).",1 +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.3,JavaScript içeriği (JSON dahil) dinamik olarak oluşturulurken çıktı kodlama/kaçış kullanıldığı doğrulanmalıdır. Böylece mesaj veya belge yapısı değiştirilmemiş olur (JavaScript ve JSON enjeksiyonlarının önüne geçilir).,1 +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.4,"Veri sorguları veya veritabanı sorguları (SQL, HQL, NoSQL, Cypher vb.) için parametreli sorgular, ORM’ler, entity framework’ler kullanıldığı ya da SQL enjeksiyonu ve diğer veritabanı enjeksiyon saldırılarına karşı koruma sağlandığı doğrulanmalıdır. Bu durum, saklı yordam (stored procedure) yazarken de geçerlidir.",1 +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.5,Uygulamanın işletim sistemi komut enjeksiyonlarına karşı korunduğu ve işletim sistemi çağrılarında parametreli OS sorguları veya bağlama özgü komut satırı çıktı kodlamasının kullanıldığı doğrulanmalıdır.,1 +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.6,Uygulamanın LDAP enjeksiyon zafiyetlerine karşı korunduğu ya da LDAP enjeksiyonlarını önlemek için özel güvenlik kontrollerinin uygulandığı doğrulanmalıdır.,2 +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.7,"XPath enjeksiyon saldırılarına karşı, sorgu parametrelemesi veya önceden derlenmiş sorgular kullanılarak koruma sağlandığı doğrulanmalıdır.",2 +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.8,"LaTeX işlemcilerinin güvenli şekilde yapılandırıldığı (örneğin, --shell-escape bayrağının kullanılmadığı) ve yalnızca izin verilen komutlardan oluşan bir listeyle çalıştırıldığı doğrulanmalıdır.",2 +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.9,Düzenli ifadelerde (regex) özel karakterlerin (genellikle ters eğik çizgi \ ile) kaçırılarak meta karakter olarak yorumlanmalarının önlendiği doğrulanmalıdır.,2 +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.10,"Uygulamanın CSV ve formül enjeksiyonlarına karşı korunduğu doğrulanmalıdır. Uygulama, CSV içeriği dışa aktarırken RFC 4180 Bölüm 2.6 ve 2.7'de tanımlanan kaçış kurallarına uymalıdır. Ayrıca, CSV veya diğer tablo formatlarına (XLS, XLSX, ODF gibi) aktarım yapılırken, alanın ilk karakteri olarak çıkan özel karakterler ('=', '+', '-', '@', '\t' (sekme), '\0' (null karakter)) tek tırnak (') ile kaçırılmalıdır.",3 +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.1,"WYSIWYG editörlerinden veya benzer kaynaklardan gelen tüm güvenilmeyen HTML girdilerinin, bilinen ve güvenli bir HTML temizleme kütüphanesi ya da çerçeve özelliği ile temizlendiği doğrulanmalıdır.",1 +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.2,"Uygulamanın eval() veya Spring Expression Language (SpEL) gibi dinamik kod çalıştırma özelliklerini kullanmaktan kaçındığı doğrulanmalıdır. Alternatif yoksa, kullanıcı girdisi çalıştırılmadan önce mutlaka temizlenmelidir.",1 +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.3,"Potansiyel olarak tehlikeli bir bağlamda kullanılacak verilerin, bu bağlama uygun karakterlere izin vermek ve çok uzun girdileri kısaltmak gibi güvenlik önlemleriyle önceden temizlendiği doğrulanmalıdır.",2 +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.4,"Kullanıcı tarafından sağlanan SVG içeriğinin, yalnızca güvenli etiket ve özellikler (örneğin grafik çizme ile ilgili) içerdiğinden emin olmak için onaylandığı veya temizlendiği doğrulanmalıdır (ör. script veya foreignObject içermemelidir).",2 +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.5,"Markdown, CSS, XSL stil sayfaları, BBCode veya benzeri ifade şablon dillerinde kullanıcı girdisinin temizlendiği veya bu tür özelliklerin devre dışı bırakıldığı doğrulanmalıdır.",2 +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.6,"Uygulamanın, güvenilmeyen verileri başka servislere iletmeden önce izinli protokol, alan adı, yol ve port listelerine göre doğruladığı ve tehlikeli karakterleri temizlediği doğrulanarak SSRF (Sunucu Taraflı İstek Sahteciliği) saldırılarına karşı korunduğu doğrulanmalıdır.",2 +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.7,"Uygulamanın şablon enjeksiyon saldırılarına karşı, güvenilmeyen girdilere dayalı şablon oluşturmayı engellediği; eğer bu kaçınılmazsa, bu girdilerin mutlaka temizlendiği veya sıkı şekilde onaylandığı doğrulanmalıdır.",2 +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.8,JNDI sorgularında kullanılmadan önce güvenilmeyen girdilerin temizlendiği ve JNDI'nin enjeksiyonlara karşı güvenli şekilde yapılandırıldığı doğrulanmalıdır.,2 +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.9,Memcache’e gönderilmeden önce içeriğin temizlenerek enjeksiyon saldırılarına karşı korunduğu doğrulanmalıdır.,2 +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.10,Format dizgilerinin (format strings) beklenmeyen veya zararlı şekilde çözümlenmesini önlemek için işlenmeden önce temizlendiği doğrulanmalıdır.,2 +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.11,"SMTP veya IMAP enjeksiyonlarını önlemek için, kullanıcı girdisinin posta sistemlerine iletilmeden önce temizlendiği doğrulanmalıdır.",2 +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.12,Regex girdilerinin üstel geri izlemeye (exponential backtracking) neden olan öğeler içermediği ve güvenilmeyen girdilerin ReDoS (Regex Denial of Service) gibi saldırılara karşı temizlendiği doğrulanmalıdır.,3 +V1,Kodlama (Encoding) ve Temizleme,V1.4,"Bellek, Dizgi ve Yönetilmeyen Kod",V1.4.1,"Yığın, arabellek (buffer) veya yığın belleği taşmalarını önlemek ya da tespit etmek amacıyla, bellek güvenli dizgi işlemlerinin, daha güvenli bellek kopyalama ve işaretçi aritmetiğinin kullanıldığı doğrulanmalıdır.",2 +V1,Kodlama (Encoding) ve Temizleme,V1.4,"Bellek, Dizgi ve Yönetilmeyen Kod",V1.4.2,"Tamsayı taşmalarını önlemek için işaret (sign), aralık (range) ve giriş doğrulama tekniklerinin kullanıldığı doğrulanmalıdır.",2 +V1,Kodlama (Encoding) ve Temizleme,V1.4,"Bellek, Dizgi ve Yönetilmeyen Kod",V1.4.3,Dinamik olarak ayrılan belleğin ve kaynakların serbest bırakıldığı ve boşaltılan belleklere ait referansların veya işaretçilerin kaldırıldığı veya null yapıldığı doğrulanmalıdır (dangling pointer ve use-after-free zafiyetlerine karşı).,2 +V1,Kodlama (Encoding) ve Temizleme,V1.5,Güvenli Ters Serileştirme (Safe Deserialization),V1.5.1,XML ayrıştırıcılarının (parser) kısıtlayıcı şekilde yapılandırıldığı ve dış varlık çözümleme (external entity resolution) gibi güvensiz özelliklerin XXE (XML eXternal Entity) saldırılarına karşı devre dışı bırakıldığı doğrulanmalıdır .,1 +V1,Kodlama (Encoding) ve Temizleme,V1.5,Güvenli Ters Serileştirme (Safe Deserialization),V1.5.2,"Güvenilmeyen verilerin ters serileştirilmesinde, nesne türleri için izinli liste kullanımı veya istemci tanımlı nesne türlerinin kısıtlanması gibi güvenli giriş işleme önlemlerinin uygulandığı doğrulanmalıdır. Güvensiz olarak tanımlanmış ters serileştirme mekanizmaları, güvenilmeyen girdilerle kullanılmamalıdır.",2 +V1,Kodlama (Encoding) ve Temizleme,V1.5,Güvenli Ters Serileştirme (Safe Deserialization),V1.5.3,"Aynı veri türü için uygulamada kullanılan farklı parser'ların (ör. JSON, XML, URL parser'ları), veriyi tutarlı şekilde ayrıştırdığı ve aynı karakter kodlamasını kullandığı doğrulanmalıdır. Böylece JSON birlikte çalışabilirlik açıkları, URI veya dosya ayrıştırma farkları gibi sorunlar nedeniyle RFI veya SSRF saldırılarının istismar edilmesi önlenir.",3 +V2,Doğrulama ve İş Mantığı,V2.1,Doğrulama ve İş Mantığı Dokümantasyonu,V2.1.1,"Uygulama dokümantasyonunda, veri öğelerinin beklenen yapıya göre nasıl doğrulanacağına ilişkin giriş doğrulama kurallarının tanımlandığı doğrulanmalıdır. Bu; kredi kartı numaraları, e-posta adresleri, telefon numaraları gibi yaygın veri biçimleri olabileceği gibi iç sistemlere özel biçimler de olabilir.",1 +V2,Doğrulama ve İş Mantığı,V2.1,Doğrulama ve İş Mantığı Dokümantasyonu,V2.1.2,"Uygulama dokümantasyonunda, birleştirilmiş veri öğelerinin mantıksal ve bağlamsal tutarlılığının nasıl doğrulanacağı tanımlanmalıdır (örneğin, mahalle ve posta kodunun eşleşip eşleşmediğinin kontrolü).",2 +V2,Doğrulama ve İş Mantığı,V2.1,Doğrulama ve İş Mantığı Dokümantasyonu,V2.1.3,"Hem kullanıcı bazında hem de uygulama genelinde geçerli olacak şekilde, iş mantığı sınırları ve doğrulama beklentilerinin belgelendiği doğrulanmalıdır.",2 +V2,Doğrulama ve İş Mantığı,V2.2,Girdi Doğrulama,V2.2.1,"Girdilerin, işlevsel ya da iş gereksinimlerine uygunluğunun doğrulandığı teyit edilmelidir. Bu işlem; izinli değerler, desenler ve aralıklar listesine karşı pozitif doğrulama ile ya da girdinin beklenen yapıya ve mantıksal sınırlara uygunluğunun önceden tanımlanmış kurallara göre karşılaştırılması ile yapılmalıdır. Seviye 1 için bu, güvenlik veya iş kararlarında kullanılan girdilere odaklanabilir. Seviye 2 ve üstü için tüm girdilere uygulanmalıdır.",1 +V2,Doğrulama ve İş Mantığı,V2.2,Girdi Doğrulama,V2.2.2,"Uygulamanın, güvenilir bir servis katmanında girdi doğrulama zorunluluğu uygulayacak şekilde tasarlandığı doğrulanmalıdır. İstemci tarafında gerçekleştirilen doğrulama, kullanılabilirliği artırabilir ve teşvik edilmelidir. Ancak bu doğrulama,güvenlik kontrolü olarak kabul edilmemelidir.",1 +V2,Doğrulama ve İş Mantığı,V2.2,Girdi Doğrulama,V2.2.3,"Uygulamanın, ilişkili veri öğelerinin önceden tanımlanmış kurallara göre makul olup olmadığını kontrol ettiği doğrulanmalıdır.",2 +V2,Doğrulama ve İş Mantığı,V2.3,İş Mantığı Güvenliği,V2.3.1,"Uygulamanın, aynı kullanıcı için iş mantığı akışlarını yalnızca beklenen adım sırasına göre ve adım atlamadan işlediği doğrulanmalıdır.",1 +V2,Doğrulama ve İş Mantığı,V2.3,İş Mantığı Güvenliği,V2.3.2,"İş mantığı sınırlarının, uygulama dokümantasyonuna uygun şekilde uygulandığı doğrulanmalıdır.",2 +V2,Doğrulama ve İş Mantığı,V2.3,İş Mantığı Güvenliği,V2.3.3,İş mantığı seviyesinde işlemlerin (transaction) kullanıldığı ve bir iş mantığı işleminin ya bütünüyle başarıyla tamamlandığı ya da önceki geçerli duruma geri döndürüldüğü (rollback) doğrulanmalıdır.,2 +V2,Doğrulama ve İş Mantığı,V2.3,İş Mantığı Güvenliği,V2.3.4,"İş mantığı düzeyinde kilitleme mekanizmalarının, sınırlı kaynakların (ör. sinema koltukları, teslimat zamanları) uygulamanın mantığı manipüle edilerek çift rezervasyona neden olmamasını sağladığı doğrulanmalıdır.",2 +V2,Doğrulama ve İş Mantığı,V2.3,İş Mantığı Güvenliği,V2.3.5,"Yüksek değerli iş mantığı akışlarının, yetkisiz veya kazara gerçekleşebilecek işlemleri önlemek için çoklu kullanıcı onayı gerektirdiği doğrulanmalıdır. Bu işlemler büyük para transferleri, sözleşme onayları, gizli bilgilere erişim veya üretimde güvenlik kurallarının geçersiz kılınmaları gibi durumları içerebilir.",3 +V2,Doğrulama ve İş Mantığı,V2.4,Otomasyon Karşıtı Önlemler,V2.4.1,"Uygulama işlevlerine yönelik aşırı miktardaki çağrılara karşı; veri sızdırma, anlamsız veri üretme, kota tüketme, hız sınırının aşılması, hizmet reddi (DoS) ya da maliyetli kaynakların aşırı kullanımı gibi risklere karşı otomasyon karşıtı kontrollerin bulunduğu doğrulanmalıdır.",2 +V2,Doğrulama ve İş Mantığı,V2.4,Otomasyon Karşıtı Önlemler,V2.4.2,"İş mantığı akışlarının, aşırı hızlı işlem gönderimlerini önleyecek şekilde gerçekçi insan zamanlaması gerektirdiği doğrulanmalıdır.",3 +V3,Web Ön Uç (Frontend) Güvenliği,V3.1,Web Frontend Güvenlik Dokümantasyonu,V3.1.1,"Uygulama dokümantasyonunda, uygulamayı kullanan tarayıcıların desteklemesi gereken güvenlik özelliklerinin (ör. HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) ve diğer ilgili HTTP güvenlik mekanizmaları) tanımlandığı doğrulanmalıdır. Ayrıca bu özelliklerin mevcut olmadığı durumlarda uygulamanın nasıl davranması gerektiği (ör. kullanıcıyı uyarmak veya erişimi engellemek) de tanımlanmalıdır.",3 +V3,Web Ön Uç (Frontend) Güvenliği,V3.2,İçeriğin Yanlış Yorumlanması,V3.2.1,"Tarayıcıların HTTP yanıtlarında içerik veya işlevi yanlış bir bağlamda sunmalarını önlemek amacıyla güvenlik kontrollerinin uygulandığı doğrulanmalıdır (ör. API, kullanıcı tarafından yüklenen dosya veya başka bir kaynağın doğrudan çağrılması durumunda). Olası kontroller arasında; yalnızca HTTP istek başlıklarının (ör. Sec-Fetch-\*) doğru bağlamı gösterdiği durumlarda içeriğin sunulması, Content-Security-Policy başlığında ""sandbox"" yönergesinin kullanılması veya Content-Disposition başlığında ""attachment"" biçiminin kullanılması yer alabilir.",1 +V3,Web Ön Uç (Frontend) Güvenliği,V3.2,İçeriğin Yanlış Yorumlanması,V3.2.2,"HTML yerine metin olarak görüntülenmesi amaçlanan içeriğin, HTML veya JavaScript gibi içeriklerin istenmeden çalıştırılmasını önleyecek şekilde ""createTextNode"" veya ""textContent"" gibi güvenli işleme fonksiyonlarıyla işlendiği doğrulanmalıdır.",1 +V3,Web Ön Uç (Frontend) Güvenliği,V3.2,İçeriğin Yanlış Yorumlanması,V3.2.3,"Uygulamanın istemci tarafı JavaScript kullanırken açık değişken tanımlamaları yaparak, sıkı tür kontrolü uygulayarak, global değişkenleri document nesnesine kaydetmekten kaçınarak ve ad alanı izolasyonu sağlayarak DOM clobbering’den kaçındığı doğrulanmalıdır.",3 +V3,Web Ön Uç (Frontend) Güvenliği,V3.3,Çerez Yapılandırması,V3.3.1,"Çerezlerin 'Secure' niteliğine sahip olduğu ve eğer çerez adı '\__Host-' ön eki ile başlamıyorsa, '__Secure-' ön ekinin kullanıldığı doğrulanmalıdır.",1 +V3,Web Ön Uç (Frontend) Güvenliği,V3.3,Çerez Yapılandırması,V3.3.2,"Kullanıcı arayüzü kandırma saldırılarına ve tarayıcı tabanlı istek sahteciliği saldırılarına (CSRF) karşı koruma sağlamak amacıyla, her çerezin 'SameSite' niteliğinin kullanım amacına uygun şekilde ayarlandığı doğrulanmalıdır.",2 +V3,Web Ön Uç (Frontend) Güvenliği,V3.3,Çerez Yapılandırması,V3.3.3,"Çerez adı, diğer sunucularla paylaşılmak üzere açıkça tasarlanmadığı sürece '__Host-' ön eki ile tanımlanmalıdır.",2 +V3,Web Ön Uç (Frontend) Güvenliği,V3.3,Çerez Yapılandırması,V3.3.4,"Bir çerez değeri istemci tarafı betikleri tarafından erişilememesi gereken bir veri içeriyorsa (ör. oturum token'ı), çerezin 'HttpOnly' niteliğine sahip olduğu ve aynı değerin (ör. oturum token'ı) yalnızca 'Set-Cookie' başlığı ile istemciye iletildiği doğrulanmalıdır.",2 +V3,Web Ön Uç (Frontend) Güvenliği,V3.3,Çerez Yapılandırması,V3.3.5,"Uygulama bir çerez oluştururken, çerez adı ve değerinin toplam uzunluğunun 4096 baytı aşmadığı doğrulanmalıdır. Çok büyük çerezler tarayıcı tarafından saklanmaz ve isteklerle gönderilmez; bu da çereze bağlı çalışan uygulama işlevlerinin bozulmasına yol açabilir.",3 +V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.2,"Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header'ı, uygulama tarafından sabit bir değer olarak tanımlanmalı veya gelen Origin header değeri güvenilir origin’lerden oluşan bir izinli listeye karşı doğrulanmalıdır. ‘Access-Control-Allow-Origin: *’ kullanılması gerekiyorsa, yanıtın hassas bilgi içermediği doğrulanmalıdır.",1 +V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.3,"HTTP yanıtlarında Content-Security-Policy header'ı bulunduğu ve bu header'ın yalnızca güvenilen içeriklerin veya kaynakların yüklenmesini ve çalıştırılmasını sağlayan yönergeler içerdiği doğrulanmalıdır. Minimum olarak ""global policy"", object-src 'none', base-uri 'none' yönergelerini içermeli ve izinli liste, nonce veya hash temelli bir yapı içermelidir. Seviye 3 uygulamalarında her yanıt için nonce veya hash içeren özel bir politika tanımlanmalıdır.",2 +V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.4,"Tüm HTTP yanıtlarının 'X-Content-Type-Options: nosniff' header'ını içerdiği doğrulanmalıdır. Bu, tarayıcıya içerik türünü tahmin etmeyi bırakmasını ve yanıtın Content-Type header'ında belirtilen MIME türünün, beklenen kaynak türüyle eşleşmesini zorunlu kılar. Ayrıca bu, tarayıcıda CORB (Cross-Origin Read Blocking) özelliğini etkinleştirir.",2 +V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.5,"Uygulamanın, 'Referer' başlığı yoluyla üçüncü taraflara teknik olarak hassas verilerin sızmasını önlemek için bir 'referrer policy' belirlediği doğrulanmalıdır. Bu, Referrer-Policy HTTP header'ıyla veya HTML öğe nitelikleriyle (element attributes) sağlanabilir. Sızabilecek hassas bilgiler, URL’deki yol ve sorgu parametreleri ile sınırlı uygulamalarda hostname bilgisini içerebilir.",2 +V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.6,"Uygulamanın, Content-Security-Policy header'ı altında 'frame-ancestors' yönergesini her HTTP yanıtında tanımladığı ve bu sayede içeriklerin varsayılan olarak başka sayfalara gömülmesini engellediği doğrulanmalıdır. Gerekli durumlarda özel olarak izin verildiğinden emin olunmalıdır. 'X-Frame-Options' header'ı, tarayıcılar tarafından desteklenmesine rağmen, artık güncel değildir ve güvenlik amacıyla kullanılmamalıdır.",2 +V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.8,"Bir belgenin işlenmesini ve sunulmasını başlatan tüm HTTP yanıtlarında (örneğin 'text/html' tipi yanıtlar), 'Cross-Origin-Opener-Policy' header'ı 'same-origin' veya 'same-origin-allow-popups' yönergeleriyle birlikte yer almalıdır. Bu, tabnabbing ve frame counting gibi, pencere nesnelerine paylaşımlı erişimi sömüren saldırılara karşı koruma sağlar.",3 +V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.1,"Uygulama, hassas işlevselliğe yönelik izinsiz cross-origin istekleri önlemek için CORS preflight mekanizmasına güvenmiyorsa, bu tür isteklerin gerçekten uygulamadan geldiği doğrulanmalıdır. Bu, anti-forgery token kullanımı veya CORS tarafından güvenli kabul edilmeyen özel HTTP header'larının zorunlu kılınmasıyla yapılabilir. Bu, tarayıcı tabanlı istek sahteciliği (CSRF) saldırılarına karşı bir savunmadır.",1 +V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.2,"Uygulama, hassas işlevlerin izinsiz cross-origin çağrılmasını önlemek için CORS preflight mekanizmasına güveniyorsa, bu işlevlerin bir CORS-preflight isteğini tetiklemeden çağrılamadığı doğrulanmalıdır. Bu, 'Origin' ve 'Content-Type' header'larının doğrulanmasını veya CORS-safelisted olmayan bir header'ın ve alanın kullanılmasını gerektirebilir.",1 +V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.4,"Farklı uygulamaların farklı hostname'lerde barındırıldığı ve böylece Same-Origin Policy tarafından sağlanan kısıtlamalardan (örneğin çerez erişim sınırları, kaynaklar arası etkileşim kontrolleri) faydalanıldığı doğrulanmalıdır.",2 +V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.6,"Uygulamanın herhangi bir yerinde JSONP işlevselliğinin etkin olmadığı doğrulanmalıdır. Bu, XSSI (Cross-Site Script Inclusion) saldırılarını önlemek içindir.",3 +V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.7,"Yetkilendirme gerektiren verilerin, JavaScript dosyaları gibi betik kaynaklarının yanıtlarında yer almadığı, XSSI saldırılarını önlemek için doğrulanmalıdır.",3 +V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.8,"Kimliği doğrulanmış kaynakların (örneğin görseller, videolar, betikler ve belgeler) yalnızca gerçekten amaçlandığında kullanıcı adına yüklenebildiği veya gömülebildiği doğrulanmalıdır. Bu, isteğin uygun olmayan bir çapraz kaynak çağrısından kaynaklanmadığından emin olmak için Sec-Fetch-* HTTP istek başlığı alanlarının sıkı bir şekilde doğrulanmasıyla veya tarayıcıya döndürülen içeriği engelleme talimatı vermek için kısıtlayıcı bir Cross-Origin-Resource-Policy HTTP yanıt başlığı alanı ayarlayarak gerçekleştirilebilir.",3 +V3,Web Ön Uç (Frontend) Güvenliği,V3.6,Harici Kaynak Bütünlüğü,V3.6.1,"JavaScript kütüphaneleri, CSS veya web fontları gibi istemci tarafı varlıkların yalnızca statik ve sürümlü olması, varlığın bütünlüğünü doğrulamak için Subresource Integrity (SRI) kullanılması durumunda harici olarak (örneğin, bir İçerik Dağıtım Ağı üzerinde) barındırıldığı doğrulanmalıdır. Bu mümkün değilse, her bir kaynak için bunu gerekçelendiren belgelenmiş bir güvenlik kararı bulunmalıdır.",3 +V3,Web Ön Uç (Frontend) Güvenliği,V3.7,Diğer Tarayıcı Güvenliği Hususları,V3.7.1,"Uygulamanın yalnızca hâlâ desteklenen ve güvenli kabul edilen istemci tarafı teknolojileri kullandığı doğrulanmalıdır. Bu gereksinimi karşılamayan teknolojilere örnek olarak NSAPI eklentileri, Flash, Shockwave, ActiveX, Silverlight, NACL veya istemci tarafı Java applet’leri verilebilir.",2 +V3,Web Ön Uç (Frontend) Güvenliği,V3.7,Diğer Tarayıcı Güvenliği Hususları,V3.7.2,"Uygulamanın, yalnızca hedef adres bir izinli listede yer alıyorsa kullanıcıyı otomatik olarak farklı bir ana makine adına veya uygulamanın kontrolünde olmayan bir etki alanına yönlendirdiği doğrulanmalıdır.",2 +V3,Web Ön Uç (Frontend) Güvenliği,V3.7,Diğer Tarayıcı Güvenliği Hususları,V3.7.3,"Uygulamanın, kullanıcı uygulamanın kontrolü dışındaki bir URL’ye yönlendirildiğinde, yönlendirme hakkında bir bildirim gösterdiği ve kullanıcının bu gezintiyi iptal edebilmesi için bir seçenek sunduğu doğrulanmalıdır.",3 +V3,Web Ön Uç (Frontend) Güvenliği,V3.7,Diğer Tarayıcı Güvenliği Hususları,V3.7.4,"Uygulamanın en üst düzey etki alanının (örneğin, site.tld) HTTP Strict Transport Security (HSTS) için genel preload listesine eklendiği doğrulanmalıdır. Bu, uygulamanın TLS kullanımının ana tarayıcılar tarafından doğrudan tanınmasını ve yalnızca Strict-Transport-Security yanıt header'ına bağlı kalınmamasını sağlar.",3 +V3,Web Ön Uç (Frontend) Güvenliği,V3.7,Diğer Tarayıcı Güvenliği Hususları,V3.7.5,"Uygulamaya erişen tarayıcının beklenen güvenlik özelliklerini desteklememesi durumunda, uygulamanın dokümantasyona uygun şekilde davrandığı (örneğin kullanıcıyı uyarma veya erişimi engelleme) doğrulanmalıdır.",3 +V4,API ve Web Servisi,V4.1,Genel Web Servisi Güvenliği,V4.1.1,"İleti gövdesi içeren her HTTP yanıtında, yanıtın gerçek içeriğiyle eşleşen bir Content-Type header alanı bulunduğu ve güvenli karakter kodlamasını (örneğin, UTF-8, ISO-8859-1) belirtmek üzere charset parametresi içerdiği doğrulanmalıdır. Bu işlem, IANA Medya Türleri'nden ""text/"", ""/+xml"" ve ""/xml"" gibi içerikler için geçerlidir.",1 +V4,API ve Web Servisi,V4.1,Genel Web Servisi Güvenliği,V4.1.2,"Yalnızca kullanıcı arayüzüne yönelik uç noktaların (manuel olarak web tarayıcısı ile erişilmesi amaçlanan) otomatik olarak HTTP'den HTTPS'e yönlendirme yaptığı ve diğer hizmetlerin veya uç noktaların şeffaf yönlendirme gerçekleştirmediği doğrulanmalıdır. Bu, istemcinin farkında olmadan şifrelenmemiş HTTP istekleri göndermesi ve bu isteklerin otomatik olarak HTTPS'e yönlendirilmesi sonucunda hassas verilerin sızmasının fark edilmemesi riskini önlemek içindir.",2 +V4,API ve Web Servisi,V4.1,Genel Web Servisi Güvenliği,V4.1.3,"Uygulama tarafından kullanılan ve yük dengeleyici, web proxy veya frontend için backend hizmeti gibi bir ara katman tarafından ayarlanan herhangi bir HTTP başlık alanının, son kullanıcı tarafından geçersiz kılınamayacağı doğrulanmalıdır. Örnek başlıklar arasında X-Real-IP, X-Forwarded-* veya X-User-ID yer alabilir.",2 +V4,API ve Web Servisi,V4.1,Genel Web Servisi Güvenliği,V4.1.4,Uygulama veya API tarafından açıkça desteklenen HTTP yöntemlerinin (preflight istekleri sırasında OPTIONS dahil) dışında hiçbir yöntemin kullanılmadığı ve kullanılmayan yöntemlerin engellendiği doğrulanmalıdır.,3 +V4,API ve Web Servisi,V4.1,Genel Web Servisi Güvenliği,V4.1.5,"Çok hassas istekler veya birçok sistemden geçen işlemler için, taşıma katmanı güvenliğinin üzerine ek bir güvence sağlamak amacıyla, her iletiye özel dijital imzaların kullanıldığı doğrulanmalıdır.",3 +V4,API ve Web Servisi,V4.2,HTTP İleti Yapısı Doğrulama,V4.2.1,"Tüm uygulama bileşenlerinin (yük dengeleyiciler, güvenlik duvarları ve uygulama sunucuları dahil) HTTP sürümüne uygun mekanizmaları kullanarak gelen HTTP iletilerinin sınırlarını belirlediği ve bu sayede HTTP istek kaçakçılığına karşı koruma sağlandığı doğrulanmalıdır. HTTP/1.x sürümünde Transfer-Encoding başlık alanı varsa, RFC 2616'ya göre Content-Length başlığı göz ardı edilmelidir. HTTP/2 veya HTTP/3 kullanıldığında, Content-Length başlığı varsa, alıcının bu değerin DATA çerçevelerinin uzunluğuyla tutarlı olduğunu doğrulaması gerekir.",2 +V4,API ve Web Servisi,V4.2,HTTP İleti Yapısı Doğrulama,V4.2.2,"HTTP iletileri üretilirken, Content-Length başlığının, HTTP protokolünün çerçeveleme yöntemine göre belirlenen içerik uzunluğu ile çelişmediği doğrulanmalıdır. Bu, istek kaçakçılığı saldırılarını önlemek için gereklidir.",3 +V4,API ve Web Servisi,V4.2,HTTP İleti Yapısı Doğrulama,V4.2.3,"Uygulamanın, yanıt bölme ve header enjeksiyonu saldırılarını önlemek amacıyla, bağlantıya özel başlık alanları (örneğin Transfer-Encoding) içeren HTTP/2 veya HTTP/3 iletilerini göndermediği ve kabul etmediği doğrulanmalıdır.",3 +V4,API ve Web Servisi,V4.2,HTTP İleti Yapısı Doğrulama,V4.2.4,"Uygulamanın yalnızca başlık alanları ve değerleri CR (\r), LF (\n) veya CRLF (\r\n) karakter dizileri içermeyen HTTP/2 ve HTTP/3 isteklerini kabul ettiği doğrulanmalıdır. Bu, başlık enjeksiyonu saldırılarını önlemek içindir.",3 +V4,API ve Web Servisi,V4.2,HTTP İleti Yapısı Doğrulama,V4.2.5,"Uygulama (backend veya frontend) istek oluşturuyor ve gönderiyorsa, URI'ler (örneğin API çağrıları için) veya HTTP istek başlıkları (örneğin Authorization veya Cookie) gibi bileşenlerin, alıcı sistemler tarafından kabul edilemeyecek kadar uzun olmamasını sağlamak amacıyla doğrulama, temizleme veya diğer mekanizmaları kullandığı doğrulanmalıdır. Bu tür çok uzun istekler (örneğin çok uzun bir Cookie başlığı) gönderildiğinde sunucunun sürekli hata durumu döndürmesiyle hizmet reddi oluşabilir.",3 +V4,API ve Web Servisi,V4.3,GraphQL,V4.3.1,"Maliyetli ve iç içe geçmiş sorgular sonucu oluşabilecek GraphQL veya veri katmanı ifadelerine yönelik Hizmet Reddi (DoS) saldırılarını önlemek için, sorgu izin listesi (allowlist), derinlik sınırlandırması, sorgu sayısı sınırlandırması veya sorgu maliyeti analizi kullanıldığı doğrulanmalıdır.",2 +V4,API ve Web Servisi,V4.3,GraphQL,V4.3.2,"GraphQL introspection (iç yapı sorgulama) sorgularının, GraphQL API'nin üçüncü taraflar tarafından kullanılmasına yönelik olmadığı sürece, üretim ortamında devre dışı bırakıldığı doğrulanmalıdır.",2 +V4,API ve Web Servisi,V4.4,WebSocket,V4.4.1,Tüm WebSocket bağlantılarında TLS üzerinden WebSocket (WSS) kullanıldığı doğrulanmalıdır.,1 +V4,API ve Web Servisi,V4.4,WebSocket,V4.4.2,"WebSocket'in başlangıçtaki HTTP el sıkışması (handshake) sırasında, Origin başlık alanının uygulama için izin verilen origin listesiyle karşılaştırılarak kontrol edildiği doğrulanmalıdır.",2 +V4,API ve Web Servisi,V4.4,WebSocket,V4.4.3,"Uygulamanın standart oturum yönetimi kullanılamıyorsa, bunun yerine ilgili Oturum Yönetimi güvenlik gereksinimlerine uygun özel token'ların kullanıldığı doğrulanmalıdır.",2 +V4,API ve Web Servisi,V4.4,WebSocket,V4.4.4,"HTTPS oturumu WebSocket kanalına geçerken, özel WebSocket oturum yönetim token’larının önceki şekilde kimliği doğrulanmış HTTPS oturumu aracılığıyla elde edildiği veya doğrulandığı doğrulanmalıdır.",2 +V5,Dosya İşleme,V5.1,Dosya İşleme Dokümantasyonu,V5.1.1,"Dokümantasyonun, her yükleme özelliği için izin verilen dosya türlerini, beklenen dosya uzantılarını ve maksimum boyutu (açılmış hali dahil) tanımladığı doğrulanmalıdır. Ayrıca, dosyaların son kullanıcılar için nasıl güvenli hâle getirileceği (örneğin kötü amaçlı bir dosya tespit edildiğinde uygulamanın nasıl davranacağı) gibi bilgilerin de belgede yer aldığı doğrulanmalıdır.",2 +V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.1,"Uygulamanın, yalnızca performans kaybına veya hizmet reddine yol açmayacak boyuttaki dosyaları kabul ettiği doğrulanmalıdır.",1 +V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.2,"Uygulama bir dosyayı, doğrudan veya bir arşiv (ör. zip dosyası) içinde kabul ettiğinde, dosya uzantısının beklenen uzantıyla eşleşip eşleşmediğini kontrol ettiği ve içeriğin uzantı tarafından temsil edilen türle uyumlu olduğunu doğruladığı kontrol edilmelidir. Bu; ilk 'magic byte' kontrolü, görüntü yeniden yazımı ve dosya içeriği doğrulama için özel kütüphanelerin kullanımı gibi yöntemleri içerir. Seviye 1 için bu, yalnızca iş veya güvenlik kararlarında kullanılan dosyalarla sınırlı olabilir. Seviye 2 ve üzeri için tüm dosyalar bu kontrole tabi olmalıdır.",1 +V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.3,"Sıkıştırılmış dosyaların (ör. zip, gz, docx, odt) açılmadan önce, izin verilen maksimum açılmış boyuta ve maksimum dosya sayısına göre kontrol edildiği doğrulanmalıdır.",2 +V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.4,Her kullanıcı için dosya boyutu kotası ve maksimum dosya sayısının uygulandığı doğrulanmalıdır. Böylece tek bir kullanıcının çok sayıda veya aşırı büyük dosya yükleyerek depolama alanını doldurması engellenir.,3 +V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.5,"Uygulamanın, içinde sembolik bağlantılar (symlink) bulunan sıkıştırılmış dosyaların yüklenmesine yalnızca bu durum özel olarak gerekli olduğunda izin verdiği doğrulanmalıdır. Bu durumda, sembolik bağlantı verilebilecek dosyaların bir izinli listesi uygulanmalıdır.",3 +V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.6,"Uygulamanın, piksel boyutu izin verilen maksimum değeri aşan görüntü dosyalarının yüklenmesini reddettiği doğrulanmalıdır. Bu, pixel flood saldırılarını önlemek için gereklidir.",3 +V5,Dosya İşleme,V5.3,Dosya Depolama,V5.3.1,"Güvenilmeyen girdilerle yüklenen veya oluşturulan ve herkese açık klasörlerde depolanan dosyaların, bir HTTP isteğiyle doğrudan erişildiğinde sunucu taraflı program kodu olarak çalıştırılmadığı doğrulanmalıdır.",1 +V5,Dosya İşleme,V5.3,Dosya Depolama,V5.3.2,"Uygulamanın, dosya işlemleri için dosya yollarını oluştururken kullanıcı tarafından gönderilen dosya adlarını değil, dahili olarak oluşturulan veya güvenilir verileri kullandığı; eğer kullanıcı tarafından gönderilen dosya adları veya meta veriler kullanılacaksa, sıkı doğrulama ve temizleme işlemlerinin uygulandığı doğrulanmalıdır. Bu, yol geçişi (path traversal), yerel veya uzak dosya dahil etme (LFI, RFI) ve sunucu tarafı istek sahteciliği (SSRF) saldırılarına karşı koruma sağlar.",1 +V5,Dosya İşleme,V5.3,Dosya Depolama,V5.3.3,"Sunucu tarafında gerçekleşen dosya işlemlerinin (örneğin dosya açma/decompress işlemi), kullanıcı tarafından sağlanan yol bilgilerini yok saydığı ve zip slip gibi güvenlik açıklarını önlediği doğrulanmalıdır.",3 +V5,Dosya İşleme,V5.4,Dosya İndirme,V5.4.1,"Uygulamanın, kullanıcı tarafından gönderilen dosya adlarını (ör. JSON, JSONP veya URL parametresinde) doğruladığı veya göz ardı ettiği ve yanıtın Content-Disposition başlık alanında bir dosya adı belirttiği doğrulanmalıdır.",2 +V5,Dosya İşleme,V5.4,Dosya İndirme,V5.4.2,"Sunulan dosya adlarının (örneğin HTTP yanıt header'larında veya e-posta eklerinde), belge yapısını korumak ve enjeksiyon saldırılarını önlemek için kodlandığı veya temizlendiği (ör. RFC 6266’ya uygun) doğrulanmalıdır.",2 +V5,Dosya İşleme,V5.4,Dosya İndirme,V5.4.3,"Güvenilmeyen kaynaklardan elde edilen dosyaların, bilinen kötü amaçlı içeriklerin sunulmasını önlemek amacıyla antivirüs tarayıcılarıyla tarandığı doğrulanmalıdır.",2 +V6,Kimlik Doğrulama,V6.1,Kimlik Doğrulama Dokümantasyonu,V6.1.1,"Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırılarına karşı oran sınırlama (rate limiting), otomasyon karşıtı önlemler ve uyarlanabilir yanıt gibi kontrollerin nasıl kullanıldığını açıklayan bir uygulama dokümantasyonu bulunduğu doğrulanmalıdır. Dokümantasyon, bu kontrollerin nasıl yapılandırıldığını ve kötü niyetli hesap kilitlemenin nasıl önlendiğini açıkça ortaya koymalıdır.",1 +V6,Kimlik Doğrulama,V6.1,Kimlik Doğrulama Dokümantasyonu,V6.1.2,"Parolalarda kullanılmasını önlemek amacıyla, bağlama özgü sözcüklerin (örneğin kurum adlarının permütasyonları, ürün adları, sistem tanımlayıcıları, proje kod adları, departman veya rol adları vb.) bulunduğu belgelenmiş bir liste mevcut olduğu doğrulanmalıdır.",2 +V6,Kimlik Doğrulama,V6.1,Kimlik Doğrulama Dokümantasyonu,V6.1.3,"Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, bunların tümünün belgelenmiş olduğu ve her yol için tutarlı şekilde uygulanması gereken güvenlik kontrolleri ile kimlik doğrulama gücünün tanımlandığı doğrulanmalıdır.",2 +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.1,"Kullanıcı tarafından belirlenen parolaların en az 8 karakter uzunluğunda olması sağlanmalı, ancak 15 karakter ve üzeri uzunlukta parolalar olmaları şiddetle tavsiye edilir.",1 +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.2,Kullanıcıların parolalarını değiştirebilmeleri sağlanmalıdır.,1 +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.3,Parola değiştirme işlevinin hem mevcut hem de yeni parolayı gerektirdiği doğrulanmalıdır.,1 +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.4,"Kayıt veya parola değişimi sırasında girilen parolaların, uygulamanın parola politikasına (örneğin minimum uzunluk) uyan ilk 3000 yaygın parolaya karşı kontrol edildiği doğrulanmalıdır.",1 +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.5,"Her tür karakterin kullanılmasına izin verildiği ve büyük/küçük harf, sayı veya özel karakter şartlarının zorunlu tutulmadığı doğrulanmalıdır.",1 +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.6,"Parola giriş alanlarının, girdiyi maskelemek için ""type=password"" kullandığı doğrulanmalıdır. Uygulamalar, kullanıcının tüm maskelenmiş parolayı ya da son girilen karakteri geçici olarak görüntülemesine izin verebilir.",1 +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.7,"""Yapıştır"" özelliğinin, tarayıcı parola yardımcılarının ve harici parola yöneticilerinin kullanımına izin verildiği doğrulanmalıdır.",1 +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.8,"Uygulamanın, kullanıcıdan aldığı parolayı herhangi bir şekilde değiştirmeden, örneğin kesmeden veya harf büyüklüğünü değiştirmeden, tam olarak doğruladığı teyit edilmelidir.",1 +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.9,En az 64 karakter uzunluğundaki parolalara izin verildiği doğrulanmalıdır.,2 +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.10,"Kullanıcının parolasının, yalnızca ele geçirildiği tespit edildiğinde veya kullanıcı tarafından yenilendiğinde geçerliliğini yitirdiği doğrulanmalıdır. Uygulama, belirli aralıklarla parola yenilenmesini zorunlu kılmamalıdır.",2 +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.11,"Tahmin edilmesi kolay parolaların oluşturulmasını önlemek amacıyla, bağlama özgü kelimelerin yer aldığı belgelenmiş listenin parola doğrulamada kullanıldığı teyit edilmelidir.",2 +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.12,"Kayıt veya parola değişikliği sırasında girilen parolaların, ele geçirilmiş parolalar listesine karşı kontrol edildiği doğrulanmalıdır.",2 +V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.1,"Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırıları gibi saldırıları önlemeye yönelik kontrollerin, uygulamanın güvenlik dokümantasyonuna göre uygulandığı doğrulanmalıdır.",1 +V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.2,"""root"", ""admin"" veya ""sa"" gibi varsayılan kullanıcı hesaplarının uygulamada yer almadığı veya devre dışı bırakıldığı doğrulanmalıdır.",1 +V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.3,"Uygulamaya erişim için ya çok faktörlü bir kimlik doğrulama mekanizması ya da tek faktörlü mekanizmaların kombinasyonu kullanılmalıdır. Seviye 3 için, bu faktörlerden biri, oltalama saldırılarına karşı direnç sağlayan ve kimlik doğrulama niyetini bir kullanıcı etkileşimi (örneğin FIDO donanım anahtarında bir düğmeye basma veya mobil telefonda bir onay) gerektirerek doğrulayan donanım tabanlı bir kimlik doğrulayıcı olmalıdır. Bu gereksinimdeki herhangi bir esneklik için, gerekçesi belgelenmiş ve riskleri azaltıcı kapsamlı kontroller içeren bir plan gereklidir.",2 +V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.4,"Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, belgelendirilmemiş bir yol bulunmadığı ve tüm yollar için güvenlik kontrolleri ile kimlik doğrulama gücünün tutarlı şekilde uygulandığı doğrulanmalıdır.",2 +V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.5,"Başarılı veya başarısız şüpheli kimlik doğrulama girişimlerinin kullanıcıya bildirildiği doğrulanmalıdır. Bu, olağandışı bir konum veya istemciden gelen girişimler, yalnızca bir faktörle yapılan kısmen başarılı doğrulamalar, uzun süreli inaktiflik sonrası yapılan girişimler veya birçok başarısız denemeden sonraki başarılı girişimler gibi durumları içerebilir.",3 +V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.6,"E-postanın, tek faktörlü ya da çok faktörlü kimlik doğrulama mekanizması olarak kullanılmadığı doğrulanmalıdır.",3 +V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.7,"Kimlik doğrulama detaylarında yapılan güncellemeler sonrasında (örneğin kimlik bilgisi sıfırlama, kullanıcı adı veya e-posta adresi değişiklikleri), kullanıcıların bilgilendirildiği doğrulanmalıdır.",3 +V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.8,"Başarısız kimlik doğrulama girişimlerinden, geçerli kullanıcıların hata mesajları, HTTP yanıt kodları veya farklı yanıt süreleri gibi sonuçlara dayanarak tespit edilemediği doğrulanmalıdır. Bu koruma, kayıt ve ""parolamı unuttum"" işlevselliğinde de geçerli olmalıdır.",3 +V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.1,"Sistem tarafından oluşturulan ilk parolaların veya etkinleştirme kodlarının güvenli bir şekilde rastgele üretildiği, mevcut parola politikasına uygun olduğu, kısa bir süre içinde veya ilk kullanım sonrasında geçerliliğini yitirdiği doğrulanmalıdır. Bu başlangıç sırları uzun vadeli parola olarak kullanılmasına izin verilmemelidir.",1 +V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.2,"Parola ipuçlarının veya ""gizli sorular"" olarak bilinen, bilgiye dayalı kimlik doğrulama mekanizmalarının mevcut olmadığı doğrulanmalıdır.",1 +V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.3,"Unutulmuş parolanın sıfırlanması için, etkin olan çok faktörlü kimlik doğrulama mekanizmalarını atlamayan güvenli bir sürecin uygulandığı doğrulanmalıdır.",2 +V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.4,"Çok faktörlü kimlik doğrulama faktörlerinden biri kaybolursa, kayıt sırasında uygulanan kimlik kanıtlama seviyesiyle aynı seviyede kimlik doğrulama yapıldığı doğrulanmalıdır.",2 +V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.5,"Süresi dolacak kimlik doğrulama mekanizmalarının yenilenmesine ilişkin talimatların, süresi dolmadan önce tamamlanacak şekilde yeterli sürede gönderildiği ve gerekiyorsa otomatik hatırlatıcıların yapılandırıldığı doğrulanmalıdır.",3 +V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.6,"Yönetici yetkisi olan kullanıcıların, kullanıcının parola sıfırlama sürecini başlatabildiği ancak kullanıcının yeni parolasını belirleyemediği veya değiştiremediği doğrulanmalıdır. Bu, yönetici yetkisi olan kullanıcıların, kullanıcı parolasını bilmesini engeller.",3 +V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.1,"Arama sırları, bant dışı kimlik doğrulama istekleri veya kodları ve zamana dayalı tek kullanımlık parolaların (TOTP) yalnızca bir kez kullanılabildiği doğrulanmalıdır.",2 +V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.2,"Uygulamanın backend tarafında saklanırken, 112 bitten az entropiye sahip (örneğin 19 rastgele harf-rakam karakteri veya 34 rastgele rakam) arama sırlarının, 32-bit rastgele bir salt içeren onaylı bir parola saklama algoritmasıyla hash’lendiği doğrulanmalıdır. Gizli bilginin entropisi 112 bit veya daha fazlaysa standart bir hash fonksiyonu kullanılabilir.",2 +V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.3,"Arama sırları, bant dışı kimlik doğrulama kodları ve zamana dayalı tek kullanımlık parola seed'lerinin, öngörülebilir değerlerden kaçınmak için Kriptografik Olarak Güvenli Sözde Rastgele Sayı Üreteci (CSPRNG) ile oluşturulduğu doğrulanmalıdır.",2 +V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.4,Arama sırlarının ve bant dışı kimlik doğrulama kodlarının en az 20 bit entropiye (genellikle 4 rastgele harf-rakam karakteri veya 6 rastgele rakam) sahip olduğu doğrulanmalıdır.,2 +V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.5,"Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının ve zamana dayalı tek kullanımlık parolaların (TOTP) belirli bir ömre sahip olduğu doğrulanmalıdır. Bant dışı istekler en fazla 10 dakika, TOTP’ler ise en fazla 30 saniye geçerli olmalıdır.",2 +V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.6,Herhangi bir kimlik doğrulama faktörünün (fiziksel cihazlar dahil) çalınması veya kaybı durumunda iptal edilebildiği doğrulanmalıdır.,3 +V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.7,"Biyometrik kimlik doğrulama mekanizmalarının yalnızca ikincil faktör olarak, “sahip olduğunuz bir şey” veya “bildiğiniz bir şey” ile birlikte kullanıldığı doğrulanmalıdır.",3 +V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.8,"Zamana dayalı tek kullanımlık parolaların (TOTP) doğrulamasının, güvenilir bir hizmetten alınan zaman kaynağına dayanarak yapıldığı ve güvenilir olmayan veya istemci tarafından sağlanan zaman kaynağına dayanmadığı doğrulanmalıdır.",3 +V6,Kimlik Doğrulama,V6.6,Bant Dışı Kimlik Doğrulama Mekanizmaları,V6.6.1,"Tek kullanımlık parolaların (OTP) telefon veya SMS ile Public Switched Telephone Network (PSTN) üzerinden iletildiği kimlik doğrulama mekanizmalarının, yalnızca telefon numarası önceden doğrulanmışsa, alternatif daha güçlü yöntemler (örneğin TOTP) de sunuluyorsa ve kullanıcıya güvenlik riskleri hakkında bilgi veriliyorsa sunulduğu doğrulanmalıdır. Seviye 3 uygulamalar için telefon ve SMS seçenekleri sunulmamalıdır.",2 +V6,Kimlik Doğrulama,V6.6,Bant Dışı Kimlik Doğrulama Mekanizmaları,V6.6.2,"Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının, oluşturuldukları özgün kimlik doğrulama isteğiyle bağlantılı olduğu ve daha önceki ya da sonraki bir istek için kullanılamadığı doğrulanmalıdır.",2 +V6,Kimlik Doğrulama,V6.6,Bant Dışı Kimlik Doğrulama Mekanizmaları,V6.6.3,"Kod tabanlı bant dışı kimlik doğrulama mekanizmalarının, oran sınırlaması ile kaba kuvvet saldırılarına karşı korunduğu doğrulanmalıdır. En az 64 bit entropiye sahip kodlar kullanılması da değerlendirilmelidir.",2 +V6,Kimlik Doğrulama,V6.6,Bant Dışı Kimlik Doğrulama Mekanizmaları,V6.6.4,"Çok faktörlü kimlik doğrulama için push bildirimleri kullanılıyorsa, push bombing saldırılarına karşı oran sınırlamasının kullanıldığı doğrulanmalıdır. “Numara eşleştirme” de bu riski azaltabilir.",3 +V6,Kimlik Doğrulama,V6.7,Kriptografik Kimlik Doğrulama Mekanizması,V6.7.1,"Kriptografik kimlik doğrulama beyanlarını doğrulamak için kullanılan sertifikaların, değiştirilmeye karşı korumalı şekilde saklandığı doğrulanmalıdır.",3 +V6,Kimlik Doğrulama,V6.7,Kriptografik Kimlik Doğrulama Mekanizması,V6.7.2,Challenge nonce değerinin en az 64 bit uzunluğunda olduğu ve istatistiksel olarak benzersiz ya da cihazın ömrü boyunca benzersiz olduğu doğrulanmalıdır.,3 +V6,Kimlik Doğrulama,V6.8,Kimlik Sağlayıcısı ile Kimlik Doğrulama,V6.8.1,"Uygulama birden fazla kimlik sağlayıcıyı (IdP) destekliyorsa, başka bir desteklenen kimlik sağlayıcı aracılığıyla (örneğin aynı kullanıcı tanımlayıcısını kullanarak) kullanıcının kimliğinin taklit edilemediği doğrulanmalıdır. Standart önlem, uygulamanın kullanıcıyı IdP kimliği (bir ad alanı işlevi görür) ve IdP içindeki kullanıcı kimliğinin birleşimiyle kaydetmesi ve tanımlamasıdır.",2 +V6,Kimlik Doğrulama,V6.8,Kimlik Sağlayıcısı ile Kimlik Doğrulama,V6.8.2,Kimlik doğrulama beyanları üzerindeki dijital imzaların (örneğin JWT veya SAML beyanları) varlığı ve bütünlüğünün her zaman doğrulandığı ve imzasız veya geçersiz imzalı beyanların reddedildiği doğrulanmalıdır.,2 +V6,Kimlik Doğrulama,V6.8,Kimlik Sağlayıcısı ile Kimlik Doğrulama,V6.8.3,"SAML beyanlarının benzersiz biçimde işlendiği ve yalnızca geçerlilik süresi içinde bir kez kullanıldığı, tekrar oynatma (replay) saldırılarını önlemek amacıyla doğrulanmalıdır.",2 +V6,Kimlik Doğrulama,V6.8,Kimlik Sağlayıcısı ile Kimlik Doğrulama,V6.8.4,"Uygulama ayrı bir Kimlik Sağlayıcı (IdP) kullanıyorsa ve belirli işlemler için belirli kimlik doğrulama gücü, yöntemleri veya zaman bilgisi bekliyorsa, uygulamanın bu bilgileri IdP tarafından döndürülen veriler üzerinden doğruladığı teyit edilmelidir. Örneğin OIDC kullanılıyorsa, bu durum ID Token üzerindeki 'acr', 'amr' ve 'auth_time' gibi claim’lerin (varsa) doğrulanması ile sağlanabilir. Eğer IdP bu bilgileri sağlamıyorsa, uygulamanın asgari kimlik doğrulama gücünün kullanıldığını varsayan (örneğin yalnızca kullanıcı adı ve parola ile tek faktörlü doğrulama) belgelenmiş bir yedek yaklaşımı olmalıdır.",2 +V7,Oturum Yönetimi,V7.1,Oturum Yönetim Dokümantasyonu,V7.1.1,"Kullanıcının oturum inaktivite zaman aşımı süresi ve mutlak maksimum oturum süresinin belgelendiği, diğer kontrollerle birlikte uygun olduğu ve NIST SP 800-63B yeniden kimlik doğrulama gereksinimlerinden herhangi bir sapma varsa gerekçesinin belgede yer aldığı doğrulanmalıdır.",2 +V7,Oturum Yönetimi,V7.1,Oturum Yönetim Dokümantasyonu,V7.1.2,"Belgede bir hesap için kaç adet eşzamanlı (paralel) oturuma izin verildiği ile birlikte, maksimum aktif oturum sayısına ulaşıldığında uygulanacak davranış ve işlemlerin tanımlandığı doğrulanmalıdır.",2 +V7,Oturum Yönetimi,V7.1,Oturum Yönetim Dokümantasyonu,V7.1.3,"Birleşik kimlik yönetim ekosisteminin bir parçası olarak kullanıcı oturumu oluşturan ve yöneten tüm sistemlerin, oturum ömrü, sonlandırma ve yeniden kimlik doğrulama gerektiren diğer koşulların nasıl koordine edildiğini açıklayan kontrollerle birlikte belgede yer aldığı doğrulanmalıdır.",2 +V7,Oturum Yönetimi,V7.2,Temel Oturum Yönetimi Güvenliği,V7.2.1,Uygulamanın tüm oturum token'ı doğrulama işlemlerini güvenilir bir backend servisi aracılığıyla gerçekleştirdiği doğrulanmalıdır.,1 +V7,Oturum Yönetimi,V7.2,Temel Oturum Yönetimi Güvenliği,V7.2.2,"Uygulamanın, statik API gizli anahtarları veya sabit değerler yerine, oturum yönetimi için dinamik olarak oluşturulan kendi kendine yeterli veya referans token'ları kullandığı doğrulanmalıdır.",1 +V7,Oturum Yönetimi,V7.2,Temel Oturum Yönetimi Güvenliği,V7.2.3,"Uygulama kullanıcı oturumlarını temsil etmek için referans token'ları kullanıyorsa, bu token'ların benzersiz olduğu, kriptografik olarak güvenli bir sözde rastgele sayı üreteci (CSPRNG) kullanılarak üretildiği ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır.",1 +V7,Oturum Yönetimi,V7.2,Temel Oturum Yönetimi Güvenliği,V7.2.4,"Uygulamanın, kullanıcı kimlik doğrulaması (yeniden kimlik doğrulama dahil) sırasında yeni bir oturum token'ı oluşturduğu ve mevcut oturum token'ını sonlandırdığı doğrulanmalıdır.",1 +V7,Oturum Yönetimi,V7.3,Oturum Zaman Aşımı,V7.3.1,Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde bir hareketsizlik zaman aşımı bulunduğu doğrulanmalıdır.,2 +V7,Oturum Yönetimi,V7.3,Oturum Zaman Aşımı,V7.3.2,Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde mutlak bir maksimum oturum süresi bulunduğu doğrulanmalıdır.,2 +V7,Oturum Yönetimi,V7.4,Oturum Sonlandırma,V7.4.1,"Oturum sonlandırma tetiklendiğinde (örneğin, çıkış yapıldığında veya süre dolduğunda), uygulamanın oturumun daha fazla kullanılmasına izin vermediği doğrulanmalıdır. Referans token'lar veya durum bilgili oturumlar için bu, oturum verilerinin uygulama arka ucunda geçersiz kılınması anlamına gelir. Kapsamlı token kullanan uygulamaların; sonlandırılmış token listesi tutmak, kullanıcıya özel tarih ve saatten önce oluşturulan token'ları reddetmek veya kullanıcıya özel imzalama anahtarını yenilemek gibi bir çözüm uygulaması gerekir.",1 +V7,Oturum Yönetimi,V7.4,Oturum Sonlandırma,V7.4.2,"Bir kullanıcı hesabı devre dışı bırakıldığında veya silindiğinde (örneğin bir çalışanın şirketten ayrılması), uygulamanın tüm aktif oturumları sonlandırdığı doğrulanmalıdır.",1 +V7,Oturum Yönetimi,V7.4,Oturum Sonlandırma,V7.4.3,"Herhangi bir kimlik doğrulama faktörünün başarılı bir şekilde değiştirilmesi veya kaldırılmasından (şifre sıfırlama veya kurtarma yoluyla yapılan değişiklikler dahil ve varsa MFA ayarları güncellemeleri dahil) sonra, uygulamanın diğer tüm aktif oturumları sonlandırma seçeneği sunduğu doğrulanmalıdır.",2 +V7,Oturum Yönetimi,V7.4,Oturum Sonlandırma,V7.4.4,Kimlik doğrulama gerektiren tüm sayfalarda kolay erişilebilir ve görünür bir çıkış yap (logout) işlevi bulunduğu doğrulanmalıdır.,2 +V7,Oturum Yönetimi,V7.4,Oturum Sonlandırma,V7.4.5,"Uygulama yöneticilerinin, bireysel bir kullanıcının veya tüm kullanıcıların aktif oturumlarını sonlandırabilme yetkisine sahip olduğu doğrulanmalıdır.",2 +V7,Oturum Yönetimi,V7.5,Oturum Kötüye Kullanımına Karşı Savunmalar,V7.5.1,"E-posta adresi, telefon numarası, MFA yapılandırması veya hesap kurtarmada kullanılan diğer bilgiler gibi kimlik doğrulamayı etkileyebilecek hassas hesap özniteliklerinde değişiklik yapılmadan önce uygulamanın tam yeniden kimlik doğrulama gerektirdiği doğrulanmalıdır.",2 +V7,Oturum Yönetimi,V7.5,Oturum Kötüye Kullanımına Karşı Savunmalar,V7.5.2,"Kullanıcıların, (en az bir faktörle yeniden kimlik doğrulama yaptıktan sonra) mevcut tüm aktif oturumları görüntüleyebilmesi ve sonlandırabilmesinin mümkün olduğu doğrulanmalıdır.",2 +V7,Oturum Yönetimi,V7.5,Oturum Kötüye Kullanımına Karşı Savunmalar,V7.5.3,"Uygulamanın, son derece hassas işlemler veya operasyonlar gerçekleştirilmeden önce en az bir faktörle ek kimlik doğrulaması veya ikincil bir doğrulama gerektirdiği doğrulanmalıdır.",3 +V7,Oturum Yönetimi,V7.6,Birleşik Yeniden Kimlik Doğrulama,V7.6.1,"Güvenen Taraf (RP) ile Kimlik Sağlayıcı (IdP) arasındaki oturum süresi ve oturum sonlandırma davranışlarının belgelenmiş olduğu ve, örneğin IdP kimlik doğrulama olayları arasında maksimum süreye ulaşıldığında yeniden kimlik doğrulamanın gerekli kılındığı doğrulanmalıdır.",2 +V7,Oturum Yönetimi,V7.6,Birleşik Yeniden Kimlik Doğrulama,V7.6.2,"Yeni bir oturum oluşturulmasının, kullanıcı onayı veya açık bir eylem gerektirdiği; kullanıcı etkileşimi olmaksızın yeni uygulama oturumlarının oluşturulmasının önlendiği doğrulanmalıdır.",2 +V8,Yetkilendirme,V8.1,Yetkilendirme Dokümantasyonu,V8.1.1,"Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak işlev düzeyinde ve veriye özel erişim kısıtlamaları için kuralları tanımladığı doğrulanmalıdır.",1 +V8,Yetkilendirme,V8.1,Yetkilendirme Dokümantasyonu,V8.1.2,"Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak alan (field) düzeyinde erişim kısıtlamaları (hem okuma hem yazma) için kuralları tanımladığı doğrulanmalıdır. Bu kuralların, ilgili veri nesnesinin durum veya statü gibi diğer özniteliklerine bağlı olabileceği unutulmamalıdır.",2 +V8,Yetkilendirme,V8.1,Yetkilendirme Dokümantasyonu,V8.1.3,"Uygulamanın dokümantasyonunun, kimlik doğrulama ve yetkilendirme ile ilgili güvenlik kararlarının alınmasında kullanılan çevresel ve bağlamsal öznitelikleri (günün saati, kullanıcı konumu, IP adresi veya cihaz gibi) tanımladığı doğrulanmalıdır.",3 +V8,Yetkilendirme,V8.1,Yetkilendirme Dokümantasyonu,V8.1.4,"Kimlik doğrulama ve yetkilendirme dokümantasyonunun; işlev düzeyinde, veriye özel ve alan düzeyinde yetkilendirmenin yanı sıra çevresel ve bağlamsal faktörlerin karar almada nasıl kullanıldığını tanımladığı doğrulanmalıdır. Bu, değerlendirilen öznitelikleri, risk eşiklerini ve alınan aksiyonları (ör. izin ver, doğrulama iste, reddet, step-up kimlik doğrulama) içermelidir.",3 +V8,Yetkilendirme,V8.2,Genel Yetkilendirme Tasarımı,V8.2.1,"Uygulamanın, işlev düzeyindeki erişimin yalnızca açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır.",1 +V8,Yetkilendirme,V8.2,Genel Yetkilendirme Tasarımı,V8.2.2,"Uygulamanın, veriye özel erişimin yalnızca belirli veri öğelerine açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, doğrudan nesne referansı güvenlik açıkları (IDOR) ve bozuk nesne düzeyinde yetkilendirme (BOLA) risklerini azaltır.",1 +V8,Yetkilendirme,V8.2,Genel Yetkilendirme Tasarımı,V8.2.3,"Uygulamanın, alan (field) düzeyindeki erişimin yalnızca belirli alanlara açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, bozuk nesne özelliği düzeyinde yetkilendirme (BOPLA) risklerini azaltır.",2 +V8,Yetkilendirme,V8.2,Genel Yetkilendirme Tasarımı,V8.2.4,"Tüketicinin çevresel ve bağlamsal özniteliklerine (ör. günün saati, konum, IP adresi veya cihaz) dayalı uyarlanabilir güvenlik kontrollerinin, uygulama dokümantasyonunda tanımlandığı şekilde, kimlik doğrulama ve yetkilendirme kararları için uygulandığı doğrulanmalıdır. Bu kontroller, tüketici yeni bir oturum başlatmaya çalışırken ve mevcut bir oturum sırasında uygulanmalıdır.",3 +V8,Yetkilendirme,V8.3,İşlem Düzeyinde Yetkilendirme,V8.3.1,Uygulamanın yetkilendirme kurallarını güvenilir bir servis katmanında uyguladığı ve istemci taraflı JavaScript gibi güvenilmeyen tüketiciler tarafından değiştirilebilecek kontrollerle yetinmediği doğrulanmalıdır.,1 +V8,Yetkilendirme,V8.3,İşlem Düzeyinde Yetkilendirme,V8.3.2,"Yetkilendirme kararlarının temelini oluşturan değerlerdeki değişikliklerin hemen uygulandığı doğrulanmalıdır. Değişikliklerin anında uygulanamadığı durumlarda (örneğin self-contained token içindeki verilere güveniliyorsa), tüketici artık yetkili olmadığı hâlde bir işlem gerçekleştirdiğinde uyarı verecek ve değişikliği geri alacak önlemler uygulanmalıdır. Bu alternatifin bilgi sızıntısını önlemeyeceği unutulmamalıdır.",3 +V8,Yetkilendirme,V8.3,İşlem Düzeyinde Yetkilendirme,V8.3.3,"Bir nesneye erişimin, herhangi bir aracı veya onun adına hareket eden bir servis yerine yalnızca erişimi başlatan öznenin (ör. tüketici) izinlerine dayandığı doğrulanmalıdır. Örneğin, bir tüketici kimlik doğrulama için bir self-contained token kullanarak bir web servis çağırırsa ve bu servis başka bir servisten veri talep ederse, ikinci servis izin kararlarını verirken birinci servisin makine-makine token'ı yerine tüketicinin token'ını kullanmalıdır.",3 +V8,Yetkilendirme,V8.4,Diğer Yetkilendirme Hususları,V8.4.1,"Multi-tenant uygulamaların, tüketici işlemlerinin izinli olmadıkları tenant'lar üzerinde asla etkili olmamasını sağlamak için tenant'lar arası kontroller kullandığı doğrulanmalıdır.",2 +V8,Yetkilendirme,V8.4,Diğer Yetkilendirme Hususları,V8.4.2,"Yönetici arayüzlerine erişimin, sürekli tüketici kimlik doğrulaması, cihaz güvenlik durumu değerlendirmesi ve bağlamsal risk analizi dahil olmak üzere çok katmanlı güvenlik içerdiği doğrulanmalıdır. Yetkilendirme için yalnızca ağ konumu veya güvenilir uç noktalar yeterli olmamalıdır; ancak bu tür faktörler yetkisiz erişim olasılığını azaltabilir.",3 +V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.1,Token Kaynağı ve Bütünlüğü,V9.1.1,"Self-contained token'ların içerikleri kabul edilmeden önce, oynama (tampering) saldırılarına karşı dijital imza veya MAC ile doğrulama yapıldığı doğrulanmalıdır.",1 +V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.1,Token Kaynağı ve Bütünlüğü,V9.1.2,"Belirli bir bağlam için yalnızca bir allowlist üzerinde bulunan algoritmaların self-contained token oluşturmak ve doğrulamak için kullanılabildiği doğrulanmalıdır. Bu allowlist, yalnızca simetrik ya da yalnızca asimetrik algoritmaları içermeli ve kesinlikle 'None' algoritmasını içermemelidir. Hem simetrik hem de asimetrik algoritmalar desteklenmek zorundaysa, anahtar karışıklığını (key confusion) önlemek için ek kontroller uygulanmalıdır.",1 +V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.1,Token Kaynağı ve Bütünlüğü,V9.1.3,"Self-contained token'ları doğrulamak için kullanılan anahtar malzemesinin, token issuer için önceden yapılandırılmış güvenilir kaynaklardan alındığı doğrulanmalıdır. Bu, saldırganların güvenilmeyen kaynak ve anahtarları belirtmesini engeller. JWT ve diğer JWS yapılarında 'jku', 'x5u' ve 'jwk' gibi header'lar güvenilir kaynaklardan oluşan bir allowlist'e göre doğrulanmalıdır.",1 +V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.2,Token İçeriği,V9.2.1,"Token verisinde bir geçerlilik zaman aralığı (validity time span) varsa, yalnızca doğrulama zamanı bu zaman aralığı içerisindeyse token ve içeriği kabul edilmelidir. Örneğin, JWT'ler için 'nbf' ve 'exp' claim'leri doğrulanmalıdır.",1 +V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.2,Token İçeriği,V9.2.2,"Token'ı alan hizmetin, token içeriğini kabul etmeden önce bu token'ın doğru türde olduğunu ve sunulma amacına uygun olduğunu doğruladığı teyit edilmelidir. Örneğin, yalnızca erişim token'ları yetkilendirme kararları için, yalnızca ID Token'lar kullanıcı kimlik doğrulamasını kanıtlamak için kullanılabilir.",2 +V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.2,Token İçeriği,V9.2.3,"Hizmetin yalnızca kendisiyle kullanılması amaçlanan (audience) token'ları kabul ettiği doğrulanmalıdır. JWT'lerde bu, 'aud' claim'inin hizmet içinde tanımlı bir allowlist ile doğrulanması yoluyla sağlanabilir.",2 +V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.2,Token İçeriği,V9.2.4,"Eğer bir token issuer, farklı audience'lara token oluşturmak için aynı private key'i kullanıyorsa, oluşturulan token'ların hedef audience'ları benzersiz şekilde tanımlayan bir audience kısıtlaması içerdiği doğrulanmalıdır. Bu, bir token'ın farklı bir audience ile yeniden kullanılmasını önler. Audience tanımlayıcısı dinamik olarak sağlanıyorsa, token issuer bu audience'ları doğrulamalı ve audience taklitlerinin (impersonation) önüne geçmelidir.",2 +V10,OAuth ve OIDC,V10.1,Genel OAuth ve OIDC Güvenliği,V10.1.1,"Token'ların yalnızca kesinlikle ihtiyaç duyan bileşenlere gönderildiği doğrulanmalıdır. Örneğin, tarayıcı tabanlı JavaScript uygulamaları için bir backend-for-frontend modeli kullanıldığında, access ve refresh token'lara yalnızca backend'in erişebilmesi gerekir.",2 +V10,OAuth ve OIDC,V10.1,Genel OAuth ve OIDC Güvenliği,V10.1.2,"Authorization server'dan gelen değerler (örneğin authorization code veya ID Token gibi) yalnızca aynı user agent oturumu ve işlemi tarafından başlatılmış bir yetkilendirme akışının sonucuysa kabul edildiği doğrulanmalıdır. Bu, client tarafından oluşturulan secret’ların 'proof key for code exchange' (PKCE) ‘code_verifier’, ‘state’ veya OIDC ‘nonce’ gibi tahmin edilemez, işleme özgü ve hem client’a hem de işlem başlatılan user agent oturumuna güvenli bir şekilde bağlı olmasını gerektirir.",2 +V10,OAuth ve OIDC,V10.2,OAuth İstemcisi,V10.2.1,"Code flow kullanılıyorsa, OAuth client’ın token taleplerini tetikleyen CSRF saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Bu genellikle PKCE kullanılarak veya authorization isteğinde gönderilen ‘state’ parametresinin kontrolü ile sağlanır.",2 +V10,OAuth ve OIDC,V10.2,OAuth İstemcisi,V10.2.2,"OAuth istemcisi birden fazla AS ile etkileşime girebiliyorsa, mix-up saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Örneğin, authorization server’ın 'iss' parametresini döndürmesi zorunlu kılınabilir ve bu parametrenin hem authorization yanıtında hem de token yanıtında doğrulanması gerekir.",2 +V10,OAuth ve OIDC,V10.2,OAuth İstemcisi,V10.2.3,OAuth istemcisinin authorization server’a yaptığı taleplerde yalnızca gerekli scope’ları (veya diğer yetkilendirme parametrelerini) talep ettiği doğrulanmalıdır.,3 +V10,OAuth ve OIDC,V10.3,OAuth Kaynak Sunucusu (RS),V10.3.1,RS'nin yalnızca bu servisle kullanılmak üzere tasarlanmış access token’ları kabul ettiği doğrulanmalıdır (audience kontrolü). Audience bilgisi yapılandırılmış token’larda (örneğin JWT içindeki ‘aud’ claim’i) yer alabilir veya token introspection endpoint aracılığıyla kontrol edilebilir.,2 +V10,OAuth ve OIDC,V10.3,OAuth Kaynak Sunucusu (RS),V10.3.2,"RS'nin, access token’dan gelen claim’lere dayanarak yetki devri tanımına uygun şekilde yetkilendirme kararları uyguladığı doğrulanmalıdır. ‘sub’, ‘scope’ ve ‘authorization_details’ gibi claim’ler varsa, bu kararın parçası olmalıdır.",2 +V10,OAuth ve OIDC,V10.3,OAuth Kaynak Sunucusu (RS),V10.3.3,"Erişim kontrolü kararında, access token’dan (JWT veya ilgili token introspection yanıtı) benzersiz bir kullanıcının tanımlanması gerekiyorsa, RS'nin başka kullanıcılara devredilemeyecek claim’ler ile kullanıcıyı tanımladığı doğrulanmalıdır. Genellikle bu, ‘iss’ ve ‘sub’ claim’lerinin birlikte kullanılması anlamına gelir.",2 +V10,OAuth ve OIDC,V10.3,OAuth Kaynak Sunucusu (RS),V10.3.4,"RS'nin belirli bir kimlik doğrulama gücü, yöntemi veya güncelliği (recentness) gerektirmesi durumunda, sunulan access token’ın bu kısıtlamaları karşıladığını doğruladığı, örneğin, OIDC ‘acr’, ‘amr’ ve ‘auth_time’ claim’leri kullanılarak doğrulanmalıdır. ",2 +V10,OAuth ve OIDC,V10.3,OAuth Kaynak Sunucusu (RS),V10.3.5,"RS'nin, (yetkisiz taraflarca) çalınmış veya tekrar edilen access token’ların kullanımını önlemek için sender-constrained access token’lar kullandığı doğrulanmalıdır. Bu, OAuth 2 için Mutual TLS veya OAuth 2 Demonstration of Proof of Possession (DPoP) ile sağlanabilir.",3 +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.1,"AS'nin, istemciye özel önceden kaydedilmiş URI’lerden oluşan bir allowlist kullanarak redirect URI’leri tam dize karşılaştırması ile doğruladığı doğrulanmalıdır.",1 +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.2,"AS'nin, ""authorization response"" içinde ""authorization code"" döndürdüğü durumlarda, bu kodun yalnızca bir kez kullanılabildiği doğrulanmalıdır. Daha önce access token vermek için kullanılmış bir authorization code ile yapılan ikinci geçerli token isteği reddedilmeli ve ilgili tüm token’lar iptal edilmelidir.",1 +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.3,"Authorization code’un kısa ömürlü olduğu doğrulanmalıdır. L1 ve L2 uygulamalar için maksimum yaşam süresi 10 dakika, L3 uygulamalar için 1 dakikadır.",1 +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.4,"Belirli bir istemci için AS'nin yalnızca o istemcinin ihtiyaç duyduğu grant türlerine izin verdiği doğrulanmalıdır. ""Token"" (Implicit flow) ve ""password"" (Resource Owner Password Credentials flow) grant türlerinin artık kullanılmaması gerekir.",1 +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.5,"AS'nin, açık istemciler için refresh token replay saldırılarını azalttığı doğrulanmalıdır. Tercihen sender-constrained refresh token’lar (DPoP veya mutual TLS ile certificate-bound access token’lar) kullanılmalıdır. L1 ve L2 uygulamalar için refresh token rotation kullanılabilir. Rotation kullanılıyorsa, AS refresh token’ı kullanım sonrası geçersiz kılmalı ve geçersiz bir refresh token sunulması durumunda o yetkilendirme ile ilişkili tüm refresh token’ları iptal etmelidir.",1 +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.6,"Code grant kullanılıyorsa, AS'nin authorization code interception saldırılarına karşı koruma sağladığı doğrulanmalıdır. Yetkilendirme isteğinde geçerli bir ""code_challenge"" değeri zorunlu olmalı ve ""code_challenge_method"" olarak ""plain"" kabul edilmemelidir. Token isteğinde ise ""code_verifier"" parametresi doğrulanmalıdır.",2 +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.7,"AS'nin, kimlik doğrulaması yapılmamış dinamik istemci kaydını desteklemesi durumunda, kötü niyetli istemci uygulamalarına karşı riskleri azalttığı doğrulanmalıdır. Kayıtlı URI’ler gibi client metadata’sı doğrulanmalı, kullanıcı onayı alınmalı ve güvenilmeyen bir client uygulamasıyla yapılan yetkilendirme isteği işlenmeden önce kullanıcı uyarılmalıdır.",2 +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.8,"Refresh token’ların, sliding expiration kullanılsa bile mutlak bir sona erme süresine sahip olduğu doğrulanmalıdır.",2 +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.9,Yetkili bir kullanıcı tarafından AS kullanıcı arayüzü üzerinden refresh token’ların ve reference access token’ların iptal edilebildiği doğrulanmalıdır.,2 +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.10,"Gizli istemcilerin token istekleri, pushed authorization request (PAR) ve token iptal istekleri gibi server’a yapılan backchannel isteklerinde kimliğinin kontrol edildiği doğrulanmalıdır.",2 +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.11,"AS yapılandırmasının, OAuth istemcisine yalnızca gerekli scope’ları atadığı doğrulanmalıdır.",2 +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.12,"Belirli bir client için, authorization server’ın yalnızca client’ın ihtiyaç duyduğu 'response_mode' değerine izin verdiği doğrulanmalıdır. Örneğin, bu değer ya beklenenlerle karşılaştırılarak doğrulanmalı ya da PAR veya JAR kullanılmalıdır.",3 +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.13,"""Code"" grant türünün daima pushed authorization request (PAR) ile birlikte kullanıldığı doğrulanmalıdır.",3 +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.14,"AS'nin yalnızca sender-constrained (Proof-of-Possession) access token’lar ürettiği doğrulanmalıdır. Bu, mutual TLS ile certificate-bound access token ya da DPoP ile DPoP-bound access token olabilir.",3 +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.15,"Sunucu taraflı istemciler için (kullanıcı cihazında çalışmayan), AS'nin ""authorization_details"" parametresinin istemci backend'i tarafından sağlandığını ve kullanıcı tarafından değiştirilmediğini doğruladığı, örneğin pushed authorization request (PAR) or JWT-secured Authorization Request (JAR) zorunlu kılınarak doğrulanmalıdır.",3 +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.16,"Bir istemci gizli ise, AS'nin güçlü istemci kimlik doğrulama yöntemlerini zorunlu kıldığı doğrulanmalıdır. Bu yöntemler, public-key cryptography’ye dayalı ve replay saldırılarına karşı dayanıklı olmalı, örneğin mutual TLS (""tls_client_auth"", ""self_signed_tls_client_auth"") veya private key JWT (""private_key_jwt"") gibi.",3 +V10,OAuth ve OIDC,V10.5,OIDC İstemcisi,V10.5.1,"İstemcinin (relying party olarak) ID Token replay saldırılarını azalttığı doğrulanmalıdır. Örneğin, ID Token’daki 'nonce' claim’inin, OpenID Provider’a gönderilen kimlik doğrulama isteğindeki 'nonce' değeriyle eşleştiği doğrulanmalıdır.",2 +V10,OAuth ve OIDC,V10.5,OIDC İstemcisi,V10.5.2,"İstemcinin kullanıcıyı ID Token claim’lerinden (genellikle, başka kullanıcılarla yeniden atanamayan 'sub' claim’i) benzersiz şekilde tanımladığı doğrulanmalıdır.",2 +V10,OAuth ve OIDC,V10.5,OIDC İstemcisi,V10.5.3,"İstemcinin, kötü niyetli bir AS'nin başka bir AS'yi taklit etmesini AS metadata’sı üzerinden reddettiği doğrulanmalıdır. AS metadata’sındaki issuer URL’si, istemci tarafından beklenen önceden yapılandırılmış issuer URL’siyle tam olarak eşleşmiyorsa, metadata reddedilmelidir.",2 +V10,OAuth ve OIDC,V10.5,OIDC İstemcisi,V10.5.4,"İstemcinin, ID Token’ın kendisi için (audience) kullanılması amaçlandığını doğruladığı doğrulanmalıdır. Bu, token’daki 'aud' claim’inin istemcinin 'client_id' değeriyle eşit olup olmadığının kontrol edilmesiyle yapılır.",2 +V10,OAuth ve OIDC,V10.5,OIDC İstemcisi,V10.5.5,"OIDC back-channel logout kullanıldığında, relying party’nin ""forced logout"" ve ""logout"" akışında ""cross-JWT confusion"" gibi saldırılara karşı koruma sağladığı doğrulanmalıdır. Client, logout token’ın 'logout+jwt' türünde olduğunu, 'event' claim’inin doğru üyeye sahip olduğunu ve 'nonce' claim’i içermediğini doğrulamalıdır. Ayrıca token için kısa bir sona erme süresi (örneğin 2 dakika) önerilir.",2 +V10,OAuth ve OIDC,V10.6,OpenID Provider,V10.6.1,"OpenID Provider’ın yalnızca 'code', 'ciba', 'id_token' veya 'id_token code' response mode değerlerine izin verdiği doğrulanmalıdır. 'code' değeri, 'id_token code' (OIDC Hybrid flow) yerine tercih edilmelidir. 'token' (Implicit flow) kullanılmamalıdır.",2 +V10,OAuth ve OIDC,V10.6,OpenID Provider,V10.6.2,"OpenID Provider’ın forced logout yoluyla yapılan hizmet reddi saldırılarını önlediği doğrulanmalıdır. Bu, son kullanıcıdan açık onay alınarak veya varsa logout isteğinde (relying party tarafından başlatılan) bulunan parametrelerin, örneğin 'id_token_hint', doğrulanmasıyla yapılabilir.",2 +V10,OAuth ve OIDC,V10.7,Onay (Consent) Yönetimi,V10.7.1,"AS'nin her yetkilendirme isteği için kullanıcının onayını aldığı doğrulanmalıdır. İstemcinin kimliği garanti altına alınamıyorsa, AS daima kullanıcıdan açıkça onay istemelidir.",2 +V10,OAuth ve OIDC,V10.7,Onay (Consent) Yönetimi,V10.7.2,"AS'nin kullanıcıdan onay istediğinde, neye onay verildiğini açık ve yeterli şekilde gösterdiği doğrulanmalıdır. Uygun olduğunda bu bilgiler, istenen yetkilendirmelerin doğasını (genellikle scope, resource server, RAR gibi detaylara dayalı), yetkilendirilmiş uygulamanın kimliğini ve bu yetkilendirmelerin süresini içermelidir.",2 +V10,OAuth ve OIDC,V10.7,Onay (Consent) Yönetimi,V10.7.3,"Kullanıcının, AS üzerinden verdiği onayları görüntüleyebildiği, değiştirebildiği ve iptal edebildiği doğrulanmalıdır.",2 +V11,Kriptografi,V11.1,Kriptografik Envanter ve Dokümantasyon,V11.1.1,"Kriptografik anahtarların yönetimi için belgelenmiş bir politika ve NIST SP 800-57 gibi bir anahtar yönetim standardını izleyen bir kriptografik anahtar yaşam döngüsü tanımlandığı doğrulanmalıdır. Bu, anahtarların aşırı miktarda paylaşılmadığını (örneğin, paylaşılan sırlar için ikiden fazla tarafla veya özel anahtarlar için birden fazla tarafla) garanti altına almalıdır.",2 +V11,Kriptografi,V11.1,Kriptografik Envanter ve Dokümantasyon,V11.1.2,"Tüm kriptografik anahtarlar, algoritmalar ve uygulama tarafından kullanılan sertifikaları içeren bir kriptografik envanterin oluşturulduğu, sürdürüldüğü ve düzenli olarak güncellendiği doğrulanmalıdır. Bu envanter ayrıca, sistemde anahtarların nerede kullanılabileceğini ve kullanılamayacağını, ve hangi veri türlerinin bu anahtarlarla korunup korunamayacağını da belgelemelidir.",2 +V11,Kriptografi,V11.1,Kriptografik Envanter ve Dokümantasyon,V11.1.3,"Sistem içerisinde şifreleme, özetleme ve imzalama işlemleri dahil olmak üzere kriptografi kullanımının tüm örneklerini tespit etmek için kriptografik keşif mekanizmalarının kullanıldığı doğrulanmalıdır.",3 +V11,Kriptografi,V11.1,Kriptografik Envanter ve Dokümantasyon,V11.1.4,"Kriptografik bir envanterin sürdürüldüğü doğrulanmalıdır. Bu envanter, gelecekteki tehditlere karşı tepki verebilmek amacıyla post-kuantum kriptografiye geçiş yolunu belirten belgelenmiş bir plan içermelidir.",3 +V11,Kriptografi,V11.2,Güvenli Kriptografi Uygulaması,V11.2.1,Kriptografik işlemler için sektör tarafından doğrulanmış uygulamaların (kütüphaneler ve donanım hızlandırmalı uygulamalar dahil) kullanıldığı doğrulanmalıdır.,2 +V11,Kriptografi,V11.2,Güvenli Kriptografi Uygulaması,V11.2.2,"Uygulamanın, rastgele sayı üreticileri, kimliği doğrulanmış şifreleme, MAC veya özetleme algoritmaları, anahtar uzunlukları, turlar, şifreler ve modların herhangi bir zamanda yeniden yapılandırılabilir, yükseltilebilir veya değiştirilebilir olacağı şekilde kripto çevikliği (crypto agility) ile tasarlandığı doğrulanmalıdır. Aynı şekilde, anahtarların ve parolaların değiştirilebilmesi ve verilerin yeniden şifrelenebilmesi mümkün olmalıdır. Bu, onaylanmış PQC şemalarının yüksek güvenlikli uygulamaları yaygın olarak kullanılabilir hale geldiğinde sorunsuz geçişe olanak tanır.",2 +V11,Kriptografi,V11.2,Güvenli Kriptografi Uygulaması,V11.2.3,"Tüm kriptografik ilkeliklerin, algoritma, anahtar boyutu ve yapılandırmaya göre minimum 128 bit güvenlik sağladığı doğrulanmalıdır. Örneğin, 256-bit ECC anahtarı yaklaşık 128 bit güvenlik sağlarken, RSA için aynı güvenliği elde etmek 3072-bit anahtar gerektirir.",2 +V11,Kriptografi,V11.2,Güvenli Kriptografi Uygulaması,V11.2.4,"Tüm kriptografik işlemlerin sabit süreli (constant-time) olduğu, karşılaştırmalarda, hesaplamalarda veya geri dönüşlerde kısa devre (short-circuit) işlemleri yapılmadığı doğrulanmalıdır; bu, bilgi sızıntısını önlemek için gereklidir.",3 +V11,Kriptografi,V11.2,Güvenli Kriptografi Uygulaması,V11.2.5,"Tüm kriptografik modüllerin güvenli şekilde hata verdiği ve hataların, padding oracle saldırıları gibi zafiyetleri mümkün kılmayacak şekilde ele alındığı doğrulanmalıdır.",3 +V11,Kriptografi,V11.3,Şifreleme Algoritmaları,V11.3.1,"Güvensiz blok modlarının (örneğin, ECB) ve zayıf doldurma (padding) şemalarının (örneğin, PKCS#1 v1.5) kullanılmadığı doğrulanmalıdır.",1 +V11,Kriptografi,V11.3,Şifreleme Algoritmaları,V11.3.2,Yalnızca AES ile GCM gibi onaylı şifreleme algoritmalarının ve modlarının kullanıldığı doğrulanmalıdır.,1 +V11,Kriptografi,V11.3,Şifreleme Algoritmaları,V11.3.3,"Şifrelenmiş verilerin yetkisiz değişikliklere karşı korunduğu doğrulanmalıdır. Tercihen bu koruma, onaylı bir kimliği doğrulanmış şifreleme yöntemi kullanılarak ya da onaylı bir şifreleme yöntemi ile onaylı bir MAC algoritmasının kombinasyonu ile sağlanmalıdır.",2 +V11,Kriptografi,V11.3,Şifreleme Algoritmaları,V11.3.4,"Sayılar, başlatma vektörleri (IV) ve diğer tek kullanımlık değerlerin, aynı şifreleme anahtarı ve veri öğesi çifti için birden fazla kez kullanılmadığı doğrulanmalıdır. Oluşturma yöntemi kullanılan algoritmaya uygun olmalıdır.",3 +V11,Kriptografi,V11.3,Şifreleme Algoritmaları,V11.3.5,"Şifreleme algoritması ve MAC algoritması kombinasyonlarının ""encrypt-then-MAC"" modunda çalıştığı doğrulanmalıdır.",3 +V11,Kriptografi,V11.4,Hashing ve Hash Tabanlı Fonksiyonlar,V11.4.1,"Dijital imzalar, HMAC, KDF ve rastgele bit üretimi gibi genel kriptografik kullanım senaryolarında yalnızca onaylı hash fonksiyonlarının kullanıldığı doğrulanmalıdır. MD5 gibi yasaklı hash fonksiyonları hiçbir kriptografik amaçla kullanılmamalıdır.",1 +V11,Kriptografi,V11.4,Hashing ve Hash Tabanlı Fonksiyonlar,V11.4.2,"Parolaların, onaylı, hesaplama açısından yoğun ve mevcut rehberliğe göre yapılandırılmış bir anahtar türetme fonksiyonu (diğer adıyla parola hash'leme fonksiyonu) kullanılarak saklandığı doğrulanmalıdır. Ayarlar, güvenlik ve performans dengesini sağlayarak kaba kuvvet saldırılarını zorlaştırmalıdır.",2 +V11,Kriptografi,V11.4,Hashing ve Hash Tabanlı Fonksiyonlar,V11.4.3,"Dijital imzalarda kullanılan hash fonksiyonlarının, veri bütünlüğü ve kimlik doğrulama amacıyla kullanıldığında çakışmaya karşı dayanıklı ve yeterli bit uzunluğuna sahip olduğu doğrulanmalıdır. Çakışma dayanıklılığı gerekiyorsa çıktı uzunluğu en az 256 bit olmalıdır. Sadece ikinci ön-görüntü (2nd pre-iamge) saldırılarına karşı dayanıklılık gerekiyorsa çıktı uzunluğu en az 128 bit olmalıdır.",2 +V11,Kriptografi,V11.4,Hashing ve Hash Tabanlı Fonksiyonlar,V11.4.4,"Parolalardan gizli anahtarlar türetilirken, onaylı anahtar türetme fonksiyonlarının anahtar uzatma (key stretching) parametreleriyle birlikte kullanıldığı doğrulanmalıdır. Bu parametreler, kaba kuvvet saldırılarını önleyecek şekilde güvenlik ve performans dengesine sahip olmalıdır.",2 +V11,Kriptografi,V11.5,Rastgele Değerler,V11.5.1,"Tahmin edilemez olması amaçlanan tüm rastgele sayıların ve dizelerin, CSPRNG ile oluşturulduğu ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. UUID'lerin bu koşulu dikkate almadığını unutmayın.",2 +V11,Kriptografi,V11.5,Rastgele Değerler,V11.5.2,"Kullanılan rastgele sayı üretim mekanizmasının, yoğun talep altında dahi güvenli çalışacak şekilde tasarlandığı doğrulanmalıdır.",3 +V11,Kriptografi,V11.6,Açık Anahtar (Public Key) Kriptografisi,V11.6.1,"Anahtar üretimi, tohumlama (seeding) ve dijital imza üretimi ve doğrulama için yalnızca onaylı kriptografik algoritmalar ve çalışma modlarının kullanıldığı doğrulanmalıdır. Anahtar üretim algoritmaları, bilinen saldırılara karşı savunmasız anahtarlar üretmemelidir. Örneğin, Fermat çarpanlama yöntemine karşı savunmasız RSA anahtarları oluşturulmamalıdır.",2 +V11,Kriptografi,V11.6,Açık Anahtar (Public Key) Kriptografisi,V11.6.2,"Anahtar değişimi için yalnızca onaylı kriptografik algoritmaların kullanıldığı doğrulanmalıdır (örneğin Diffie-Hellman). Kullanılan parametrelerin güvenli olması gerektiğine dikkat edilmelidir. Bu, anahtar kurulum sürecine yönelik saldırıları önleyecek ve araya girme (adversary-in-the-middle) ya da kriptografik kırılmaları engelleyecektir.",3 +V11,Kriptografi,V11.7,Kullanım Halindeki Verilerin Kriptografisi,V11.7.1,"Hassas verilerin kullanım sırasında korunmasını sağlamak amacıyla, yetkisiz kullanıcıların veya süreçlerin bu verilere erişmesini engelleyen tam bellek şifrelemesinin kullanıldığı doğrulanmalıdır.",3 +V11,Kriptografi,V11.7,Kullanım Halindeki Verilerin Kriptografisi,V11.7.2,"Veri asgariyetinin sağlandığı, yani işleme sırasında mümkün olan en az miktarda verinin ortaya çıktığı ve verilerin kullanımdan hemen sonra veya mümkün olan en kısa sürede şifrelendiği doğrulanmalıdır.",3 +V12,Güvenli İletişim,V12.1,Genel TLS Güvenlik Rehberi,V12.1.1,Yalnızca TLS protokolünün en güncel ve önerilen sürümlerinin (örneğin TLS 1.2 ve TLS 1.3) etkinleştirildiği ve en son sürümün varsayılan olarak tercih edildiği doğrulanmalıdır.,1 +V12,Güvenli İletişim,V12.1,Genel TLS Güvenlik Rehberi,V12.1.2,Yalnızca önerilen şifre takımlarının (cipher suite) etkinleştirildiği ve en güçlü şifre takımlarının tercih edildiği doğrulanmalıdır. Seviye 3 (L3) uygulamalar yalnızca ileri gizlilik (forward secrecy) sağlayan şifre takımlarını desteklemelidir.,2 +V12,Güvenli İletişim,V12.1,Genel TLS Güvenlik Rehberi,V12.1.3,"Uygulamanın, mTLS istemci sertifikalarını kimlik doğrulama veya yetkilendirme amacıyla kullanmadan önce bu sertifikaların güvendiği sertifikalar arasında olduğunu doğruladığı kontrol edilmelidir.",2 +V12,Güvenli İletişim,V12.1,Genel TLS Güvenlik Rehberi,V12.1.4,Online Certificate Status Protocol (OCSP) Stapling gibi geçerli bir sertifika iptal kontrolü yönteminin etkinleştirildiği ve yapılandırıldığı doğrulanmalıdır.,3 +V12,Güvenli İletişim,V12.1,Genel TLS Güvenlik Rehberi,V12.1.5,"TLS el sıkışma (handshake) sürecinde Server Name Indication (SNI) gibi hassas meta verilerin ifşa edilmesini önlemek için, uygulamanın TLS yapılandırmasında Encrypted Client Hello (ECH) özelliğinin etkinleştirildiği doğrulanmalıdır.",3 +V12,Güvenli İletişim,V12.2,Dışa Açık Hizmetlerle HTTPS İletişimi,V12.2.1,"İstemci ile dışa açık, HTTP tabanlı hizmetler arasındaki tüm bağlantılarda TLS kullanıldığı ve bu bağlantıların güvensiz ya da şifrelenmemiş iletişime geri dönmediği doğrulanmalıdır.",1 +V12,Güvenli İletişim,V12.2,Dışa Açık Hizmetlerle HTTPS İletişimi,V12.2.2,Dışa açık hizmetlerin herkese açık olarak güvenilen TLS sertifikaları kullandığı doğrulanmalıdır.,1 +V12,Güvenli İletişim,V12.3,Genel Servisler Arası İletişim Güvenliği,V12.3.1,"Uygulamaya gelen ve uygulamadan çıkan tüm bağlantılarda izleme sistemleri, yönetim araçları, uzaktan erişim ve SSH, ara yazılımlar, veritabanları, ana sistemler (mainframe), iş ortağı sistemleri ya da dış API'ler dahil olmak üzere TLS gibi şifreli bir protokolün kullanıldığı ve güvensiz ya da şifrelenmemiş protokollere geri dönülmediği doğrulanmalıdır.",2 +V12,Güvenli İletişim,V12.3,Genel Servisler Arası İletişim Güvenliği,V12.3.2,TLS istemcilerinin bir TLS sunucusu ile iletişime geçmeden önce alınan sertifikaları doğruladığı kontrol edilmelidir.,2 +V12,Güvenli İletişim,V12.3,Genel Servisler Arası İletişim Güvenliği,V12.3.3,Uygulama içindeki HTTP tabanlı iç hizmetler arasında gerçekleşen tüm bağlantılarda TLS ya da uygun başka bir aktarım şifreleme mekanizmasının kullanıldığı ve güvensiz ya da şifrelenmemiş iletişime geri dönülmediği doğrulanmalıdır.,2 +V12,Güvenli İletişim,V12.3,Genel Servisler Arası İletişim Güvenliği,V12.3.4,"İç hizmetler arasındaki TLS bağlantılarında güvenilir sertifikaların kullanıldığı doğrulanmalıdır. İç sistemlerde oluşturulmuş ya da kendinden imzalı (self-signed) sertifikalar kullanılıyorsa, bu sertifikalara güvenen hizmetlerin yalnızca belirli dahili sertifika otoritelerine (CA) ve belirli kendinden imzalı sertifikalara güvenecek şekilde yapılandırıldıkları doğrulanmalıdır.",2 +V12,Güvenli İletişim,V12.3,Genel Servisler Arası İletişim Güvenliği,V12.3.5,"Sistem içindeki hizmetlerin birbiriyle iletişim kurarken her bir uç noktanın kimliğini doğrulamak için güçlü kimlik doğrulama yöntemlerinin kullanıldığı doğrulanmalıdır. Bu yöntemler arasında, açık anahtar altyapısı (public-key infrastructure) kullanan ve tekrar oynatma saldırılarına karşı dayanıklı olan TLS istemci kimlik doğrulaması gibi yöntemler yer almalıdır. Mikroservis mimarilerinde, sertifika yönetimini basitleştirmek ve güvenliği artırmak amacıyla bir servis ağı (service mesh) kullanılması değerlendirilmelidir.",3 +V13,Konfigürasyon,V13.1,Konfigürasyon Dokümantasyonu,V13.1.1,"Uygulamanın tüm iletişim ihtiyaçlarının dokümante edildiği doğrulanmalıdır. Buna, uygulamanın bağımlı olduğu dış hizmetler ve son kullanıcının uygulamanın bağlantı kurmasını sağlayabileceği dış konumlar da dahil olmalıdır.",2 +V13,Konfigürasyon,V13.1,Konfigürasyon Dokümantasyonu,V13.1.2,"Uygulamanın kullandığı her bir hizmet için, dokümantasyonda eşzamanlı bağlantı sayısı (örn. bağlantı havuzu limitleri) ve bu sınır aşıldığında uygulamanın davranışı, geri dönüş veya kurtarma mekanizmaları da dahil olmak üzere hizmet reddi koşullarını önlemek için tanımlandığı doğrulanmalıdır.",3 +V13,Konfigürasyon,V13.1,Konfigürasyon Dokümantasyonu,V13.1.3,"Uygulamanın, kullandığı her bir dış sistem veya hizmet (örn. veritabanları, dosya tanıtıcıları, iş parçacıkları, HTTP bağlantıları) için kaynak yönetimi stratejilerini tanımladığı doğrulanmalıdır. Bu stratejiler, kaynak serbest bırakma prosedürlerini, zaman aşımı ayarlarını, hata durumlarını ve tekrar deneme mantığı uygulanmışsa sınırları, gecikmeleri ve geri çekilme (back-off) algoritmalarını içermelidir. Senkron HTTP istek–yanıt işlemleri için kısa zaman aşımı süreleri zorunlu tutulmalı ve tekrar eden denemeler devre dışı bırakılmalı ya da sıkı şekilde sınırlandırılmalıdır.",3 +V13,Konfigürasyon,V13.1,Konfigürasyon Dokümantasyonu,V13.1.4,"Uygulamanın, güvenlik açısından kritik olan gizli verileri tanımladığı ve kuruluşun tehdit modeli ve iş ihtiyaçlarına göre bu verilerin döndürülme (rotation) zamanlamasının belgelendiği doğrulanmalıdır.",3 +V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.1,"Uygulamanın, standart kullanıcı oturum mekanizmasını desteklemeyen backend bileşenleri (örneğin API'ler, ara katmanlar, veri katmanları) arasında gerçekleşen iletişimlerin kimlik doğrulamasıyla korunduğu doğrulanmalıdır. Kimlik doğrulama; bireysel hizmet hesapları, kısa ömürlü token'lar ya da sertifika tabanlı kimlik doğrulama ile yapılmalıdır ve parola, API anahtarı ya da ayrıcalıklı erişime sahip paylaşımlı hesaplar gibi sabit kimlik bilgileri kullanılmamalıdır.",2 +V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.2,"Uygulamanın backend bileşenleri arasında (yerel hizmetler, işletim sistemi hizmetleri, API'ler, ara katmanlar ve veri katmanları dahil) gerçekleştirilen iletişimlerin, yalnızca gerekli en az ayrıcalığa sahip hesaplarla yapıldığı doğrulanmalıdır.",2 +V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.3,"Bir hizmet kimlik doğrulaması için bir kimlik bilgisi kullanılması gerekiyorsa, bu kimlik bilgisinin varsayılan bir değer (örneğin root/root veya admin/admin) olmadığının doğrulanması gereklidir.",2 +V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.4,"Uygulamanın iletişim kurmasına izin verilen dış kaynaklar ya da sistemlerin, bir allowlist (izinli liste) ile tanımlandığı doğrulanmalıdır. Bu liste, uygulama katmanında, web sunucusunda, güvenlik duvarında veya farklı katmanların birleşiminde uygulanabilir.",2 +V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.5,"Web veya uygulama sunucusunun, dış sistemlere veri veya dosya gönderimi veya yüklemesi yaparken sadece belirli kaynaklara izin verecek şekilde allowlist ile yapılandırıldığı doğrulanmalıdır.",2 +V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.6,"Uygulamanın farklı hizmetlere bağlantı kurduğu durumlarda, bu bağlantılar için belgelenmiş yapılandırmaları (örn. maksimum eşzamanlı bağlantı, bağlantı limiti aşıldığında davranış, zaman aşımı, tekrar deneme stratejileri) takip ettiğinin doğrulanması gereklidir.",3 +V13,Konfigürasyon,V13.3,Gizli Bilgi Yönetimi,V13.3.1,"Parolalar, anahtar materyalleri, veritabanı ve üçüncü parti sistemlerle entegrasyon bilgileri, zaman tabanlı token'lar için tohum (seed) bilgileri, dahili gizli veriler ve API anahtarları gibi backend sırlarının güvenli bir şekilde oluşturulması, saklanması, erişim denetiminin sağlanması ve imha edilmesi için bir gizli bilgi yönetim çözümünün (örneğin key vault) kullanıldığı doğrulanmalıdır. Bu gizli bilgiler uygulama kaynak koduna dahil edilmemeli ve yapı çıktılarında yer almamalıdır. Seviye 3 uygulamalar için donanım destekli bir çözüm (örneğin HSM) gereklidir.",2 +V13,Konfigürasyon,V13.3,Gizli Bilgi Yönetimi,V13.3.2,Gizli bilgilere erişimin en az ayrıcalık prensibine uygun şekilde yapılandırıldığı doğrulanmalıdır.,2 +V13,Konfigürasyon,V13.3,Gizli Bilgi Yönetimi,V13.3.3,"Tüm kriptografik işlemlerin, anahtar materyallerinin güvenli bir şekilde yönetilmesi ve dışarıya sızmasının engellenmesi amacıyla, izole edilmiş bir güvenlik modülü (örneğin vault ya da donanım güvenlik modülü) aracılığıyla gerçekleştirildiği doğrulanmalıdır.",3 +V13,Konfigürasyon,V13.3,Gizli Bilgi Yönetimi,V13.3.4,Uygulamanın belgelerinde belirtildiği şekilde gizli bilgilerin süresinin dolacak şekilde yapılandırıldığı ve düzenli olarak döndürüldüğü doğrulanmalıdır.,3 +V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.1,Uygulamanın .git veya .svn klasörleri gibi kaynak kontrolüyle ilgili metadata içermeyecek şekilde deploy edildiğini ya da bu klasörlerin hem dış erişime hem de uygulama erişimine kapalı olduğu doğrulanmalıdır.,1 +V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.2,Tüm bileşenler için üretim ortamlarında hata ayıklama (debug) modlarının devre dışı bırakıldığı doğrulanmalıdır.,2 +V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.3,"Web sunucularının, açık şekilde istenmediği sürece dizin listelemesi (directory listing) özelliğini istemcilere sunmadığı doğrulanmalıdır.",2 +V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.4,"HTTP TRACE metodunun üretim ortamlarında desteklenmediği, böylece potansiyel bilgi sızıntılarının önlendiği doğrulanmalıdır.",2 +V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.5,Belgeler (örneğin dahili API belgeleri) ve izleme uç noktalarının (monitoring endpoints) yalnızca açıkça belirtildiği durumlarda erişilebilir olduğu doğrulanmalıdır.,2 +V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.6,Uygulamanın arka uç bileşenlerinin ayrıntılı sürüm bilgilerini ifşa etmediği doğrulanmalıdır.,3 +V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.7,"Web katmanının yalnızca belirli dosya uzantılarına sahip dosyaları sunacak şekilde yapılandırıldığı, bu sayede istem dışı bilgi, yapılandırma ya da kaynak kod sızıntılarının önlendiği doğrulanmalıdır.",3 +V14,Veri Koruma,V14.1,Veri Koruma Dokümantasyonu,V14.1.1,"Uygulama tarafından oluşturulan ve işlenen tüm hassas verilerin tanımlanıp, koruma seviyelerine göre sınıflandırıldığından emin olun. Bu, yalnızca kodlanmış (örneğin Base64 stringleri ya da JWT içindeki düz metin yükler gibi) ve bu nedenle kolayca çözülebilir verileri de içermelidir. Koruma seviyeleri, uygulamanın uymakla yükümlü olduğu veri koruma ve gizlilik düzenlemeleri ile standartlarını dikkate almalıdır.",2 +V14,Veri Koruma,V14.1,Veri Koruma Dokümantasyonu,V14.1.2,"Tüm hassas veri koruma seviyeleri için belgelenmiş bir koruma gereksinimleri seti tanımlandığından emin olun. Bu gereksinimler genel şifreleme, bütünlük doğrulama, saklama süresi, verinin nasıl günlüğe kaydedileceği, günlüklerdeki hassas verilere erişim kontrolleri, veritabanı düzeyinde şifreleme, gizlilik ve gizliliği artırıcı teknolojiler ile diğer gizlilik gereksinimlerini kapsamalıdır.",2 +V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.1,"Hassas verilerin yalnızca HTTP message body veya header alanlarında sunucuya gönderildiği ve URL ile sorgu parametrelerinin, API anahtarı veya session token’ı gibi hassas bilgiler içermediği doğrulanmalıdır.",1 +V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.2,"Hassas verilerin, yük dengeleyiciler ve uygulama önbellekleri gibi sunucu bileşenlerinde önbelleğe alınmasının engellendiği veya kullanım sonrası bu verilerin güvenli biçimde temizlendiği doğrulanmalıdır.",2 +V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.3,"Uygulama kontrolü dışında veri toplanmasını engellemek için, tanımlanmış hassas verilerin, kullanıcı izleyicileri gibi güvensiz taraflara gönderilmediği doğrulanmalıdır.",2 +V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.4,"Hassas verilere yönelik şifreleme, bütünlük doğrulama, veri saklama, loglama yöntemi, loglardaki erişim kontrolleri, gizlilik teknolojileri gibi kontrollerin, söz konusu verinin belgelenmiş koruma seviyesinde tanımlandığı şekilde uygulandığı doğrulanmalıdır.",2 +V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.5,"Önbellekleme mekanizmalarının yalnızca belirli içerik türüne sahip yanıtları önbelleğe alacak şekilde yapılandırıldığı ve hassas, dinamik içeriklerin önbelleğe alınmadığı doğrulanmalıdır. Web sunucusu, mevcut olmayan bir dosya talebinde geçerli ama farklı bir dosya döndürmek yerine 404 veya 302 cevabı vermelidir. Bu, Web Cache Deception saldırılarını önlemeye yardımcı olur.",3 +V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.6,"Uygulamanın yalnızca işlevsellik için gerekli olan asgari hassas veriyi döndürdüğü doğrulanmalıdır. Örneğin, kredi kartı numarasının yalnızca bazı rakamlarının döndürülmesi; tam numaranın döndürülmesi gerekiyorsa, kullanıcı arayüzünde gizlenmiş (maskelenmiş) şekilde sunulması gerekir, aksi kullanıcı özel olarak görüntülemek istemedikçe gösterilmemelidir.",3 +V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.7,"Hassas bilgilerin, veri saklama sınıflandırmasına tabi tutulduğu, geçerliliğini yitirmiş veya artık gerekli olmayan verilerin belirlenmiş bir zaman çizelgesiyle ya da gerektiğinde otomatik olarak silindiği doğrulanmalıdır.",3 +V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.8,Kullanıcı tarafından yüklenen dosyaların meta verilerinden hassas bilgilerin çıkarıldığı veya bu bilgilerin yalnızca kullanıcıdan açık onay alındığında saklandığı doğrulanmalıdır.,3 +V14,Veri Koruma,V14.3,İstemci Tarafı Veri Koruması,V14.3.1,"Kimliği doğrulanmış verilerin, istemci veya oturum sonlandığında istemci depolamasından (örneğin tarayıcı DOM’undan) temizlendiği doğrulanmalıdır. 'Clear-Site-Data' HTTP response header bu konuda yardımcı olabilir ancak istemci tarafı, sunucu bağlantısı mevcut olmadığında da temizlik işlemini yapabiliyor olmalıdır.",1 +V14,Veri Koruma,V14.3,İstemci Tarafı Veri Koruması,V14.3.2,"Uygulamanın, tarayıcılarda hassas verilerin önbelleğe alınmasını önlemek amacıyla yeterli anti-önbellekleme HTTP response header (örneğin Cache-Control: no-store) ayarladığı doğrulanmalıdır.",2 +V14,Veri Koruma,V14.3,İstemci Tarafı Veri Koruması,V14.3.3,"Tarayıcıda depolanan verilerin (örneğin localStorage, sessionStorage, IndexedDB veya çerezler) hassas veri içermediği, yalnızca session token’larının istisna olarak kabul edildiği doğrulanmalıdır.",2 +V15,Güvenli Kodlama ve Mimari,V15.1,Güvenli Kodlama ve Mimari Dokümantasyonu,V15.1.1,"Güvenlik açığı içeren üçüncü taraf bileşen sürümleri ve genel olarak kütüphane güncellemeleri için, uygulama dokümantasyonunda risk bazlı düzeltme zamanlarının tanımlandığı doğrulanmalıdır.",1 +V15,Güvenli Kodlama ve Mimari,V15.1,Güvenli Kodlama ve Mimari Dokümantasyonu,V15.1.2,"Yazılım bileşen listesi (Software Bill of Materials - SBOM) gibi bir envanterin tutulduğu, kullanılan tüm üçüncü taraf kütüphanelerin önceden tanımlanmış, güvenilir ve düzenli olarak güncellenen depolardan alındığı doğrulanmalıdır.",2 +V15,Güvenli Kodlama ve Mimari,V15.1,Güvenli Kodlama ve Mimari Dokümantasyonu,V15.1.3,"Uygulama dokümantasyonunda zaman veya kaynak açısından yoğun işlevlerin tanımlandığı, bu işlevlerin aşırı kullanımı durumunda kullanılabilirlik kaybının nasıl önleneceği ve yanıt oluşturma süresinin istemci zaman aşımını aşmaması için hangi önlemlerin alındığı belirtilmelidir. Örnek savunmalar kuyruklama, eşzamansız işleme, kullanıcı başına ve uygulama genelinde paralel işlem sınırlarını içerebilir.",2 +V15,Güvenli Kodlama ve Mimari,V15.1,Güvenli Kodlama ve Mimari Dokümantasyonu,V15.1.4,"Uygulama dokümantasyonunda ""riskli bileşenler"" olarak değerlendirilen üçüncü taraf kütüphanelerin vurgulandığı doğrulanmalıdır.",3 +V15,Güvenli Kodlama ve Mimari,V15.1,Güvenli Kodlama ve Mimari Dokümantasyonu,V15.1.5,"Uygulama dokümantasyonunda ""tehlikeli işlevsellik"" içeren uygulama bölümlerinin açıkça belirtildiği doğrulanmalıdır.",3 +V15,Güvenli Kodlama ve Mimari,V15.2,Güvenlik Mimarisi ve Bağımlılıklar,V15.2.1,"Uygulamanın yalnızca, belgelenmiş güncelleme ve düzeltme sürelerini aşmamış bileşenleri içerdiği doğrulanmalıdır.",1 +V15,Güvenli Kodlama ve Mimari,V15.2,Güvenlik Mimarisi ve Bağımlılıklar,V15.2.2,"Uygulamanın, belgelenmiş güvenlik kararları ve stratejilere dayanarak, zaman veya kaynak açısından yoğun işlevlerin neden olabileceği kullanılabilirlik kaybına karşı savunmalar uyguladığı doğrulanmalıdır.",2 +V15,Güvenli Kodlama ve Mimari,V15.2,Güvenlik Mimarisi ve Bağımlılıklar,V15.2.3,"Üretim ortamının yalnızca uygulamanın çalışması için gerekli işlevleri içerdiği ve test kodları, örnek kod parçaları veya geliştirme işlevleri gibi gereksiz işlevsellikleri açığa çıkarmadığı doğrulanmalıdır.",2 +V15,Güvenli Kodlama ve Mimari,V15.2,Güvenlik Mimarisi ve Bağımlılıklar,V15.2.4,Üçüncü taraf bileşenlerin ve bunların tüm transitif bağımlılıklarının beklenen depolardan (iç kaynaklı ya da harici) alındığı ve bağımlılık karışıklığı (dependency confusion) saldırılarına açık olmadığı doğrulanmalıdır.,3 +V15,Güvenli Kodlama ve Mimari,V15.2,Güvenlik Mimarisi ve Bağımlılıklar,V15.2.5,"Uygulamanın, “tehlikeli işlevsellik” içeren veya “riskli bileşenler” kullanan bölümlerine ek korumalar uyguladığı doğrulanmalıdır. Bu korumalar sandbox, kapsülleme, konteynerleştirme veya ağ düzeyinde izolasyon gibi teknikler aracılığıyla, bir uygulama bölümünün ele geçirilmesi durumunda saldırganın diğer bölümlere sıçramasını geciktirmeyi veya engellemeyi amaçlamalıdır.",3 +V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.1,"Uygulamanın yalnızca gerekli alanların bir alt kümesini veri nesnesinden döndürdüğü doğrulanmalıdır. Örneğin, bazı alanlara kullanıcıların erişmemesi gerektiğinden tüm veri nesnesi döndürülmemelidir.",1 +V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.2,"Uygulama backend'i harici URL’lere çağrı yaptığında, yalnızca amaçlanan işlevsellik söz konusuysa yönlendirmeleri takip edecek şekilde yapılandırıldığının doğrulanması gerekir.",2 +V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.3,"Uygulamanın, kitlesel atama saldırılarına karşı, her bir controller ve eylem için izin verilen alanları sınırlandırarak savunmalar sağladığı doğrulanmalıdır. Örneğin, bir alan değeri, bu işlemde değiştirilmesi amaçlanmadıysa eklenememeli veya güncellenememelidir.",2 +V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.4,"Tüm proxy ve ara katman bileşenlerinin kullanıcının orijinal IP adresini, uç kullanıcı tarafından değiştirilemeyecek güvenilir veri alanları kullanarak doğru şekilde ilettiği ve uygulamanın ve web sunucusunun bu doğru değeri, loglama ve hız sınırlama gibi güvenlik kararları için kullandığı doğrulanmalıdır. Ayrıca, orijinal IP adresinin bile dinamik IP'ler, VPN'ler veya kurumsal güvenlik duvarları nedeniyle güvenilir olmayabileceği dikkate alınmalıdır.",2 +V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.5,"Uygulamanın değişkenlerin doğru türde olduğunu açıkça doğruladığı ve sıkı eşitlik ve karşılaştırma işlemleri kullandığı doğrulanmalıdır. Bu, değişken türüyle ilgili varsayımlardan kaynaklanan tür oynama (type juggling) veya tür karışıklığı (type confusion) güvenlik açıklarını önlemek içindir.",2 +V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.6,"JavaScript kodunun prototip zehirleme (prototype pollution) saldırılarını önleyecek şekilde yazıldığı, örneğin, nesne literal’leri yerine Set() veya Map() gibi yapılar kullanıldığı doğrulanmalıdır.",2 +V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.7,"Uygulamanın, özellikle framework'ün istek parametrelerinin kaynağı (sorgu dizgisi, gövde parametreleri, çerezler veya başlık alanları) arasında ayrım yapmadığı durumlarda, HTTP parametre kirliliği (HTTP parameter pollution) saldırılarına karşı savunmalar uyguladığı doğrulanmalıdır.",2 +V15,Güvenli Kodlama ve Mimari,V15.4,Güvenli Eş Zamanlılık (Concurrency),V15.4.1,"Çok iş parçacıklı kodda (örneğin cache'ler, dosyalar veya birden fazla iş parçacığı tarafından erişilen bellek içi nesneler gibi) paylaşılan nesnelere yalnızca thread-safe (iş parçacığı güvenli) türler ve kilitleme (lock) veya semaphore gibi senkronizasyon mekanizmaları kullanılarak erişildiği doğrulanmalıdır. Bu, yarış durumlarını ve veri bozulmasını önlemeye yöneliktir.",3 +V15,Güvenli Kodlama ve Mimari,V15.4,Güvenli Eş Zamanlılık (Concurrency),V15.4.2,"Bir kaynağın durumu üzerindeki kontroller (örneğin varlığı ya da izinleri gibi) ile bu kontrole bağlı eylemlerin tek bir atomik işlem olarak gerçekleştirildiği doğrulanmalıdır. Bu, TOCTOU (time-of-check to time-of-use) yarış durumlarını önlemeye yöneliktir. Bir dosyanın varlığının kontrol edilip ardından açılması veya bir kullanıcının erişiminin doğrulanıp ardından yetki verilmesi gibi işlemler buna örnektir.",3 +V15,Güvenli Kodlama ve Mimari,V15.4,Güvenli Eş Zamanlılık (Concurrency),V15.4.3,"Kilitlerin (locks) tutarlı biçimde kullanıldığı, iş parçacıklarının birbirini beklemesi ya da sonsuz döngüye girmesi (deadlock veya livelock) gibi durumların önlendiği doğrulanmalıdır. Ayrıca, kilitleme mantığı, kaynağı yöneten kod içinde kalmalı ve dış sınıflar veya dış kodlar tarafından istemeden veya kötü niyetli şekilde değiştirilememelidir.",3 +V15,Güvenli Kodlama ve Mimari,V15.4,Güvenli Eş Zamanlılık (Concurrency),V15.4.4,"Kaynak tahsis politikalarının, iş parçacığı açlığını önleyecek şekilde, kaynaklara adil erişimi sağladığı doğrulanmalıdır. Örneğin, thread pool (iş parçacığı havuzu) kullanımı, düşük öncelikli iş parçacıklarının da makul sürelerde çalışabilmesi için uygulanmalıdır.",3 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.1,Güvenlik Loglaması Dokümantasyonu,V16.1.1,"Uygulamanın teknoloji yığını boyunca her katmanda hangi olayların loglandığını, log formatlarını, logların nereye yazıldığını, nasıl kullanıldığını, erişimin nasıl kontrol edildiğini ve logların ne kadar süre saklandığını belgeleyen bir envanterin mevcut olduğu doğrulanmalıdır.",2 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.2,Genel Loglama,V16.2.1,"Her bir log girdisinin, olayın ne zaman, nerede, kim tarafından ve ne olduğuna dair detaylı bir zaman çizelgesi oluşturulmasına olanak tanıyacak gerekli meta verileri içerdiği doğrulanmalıdır.",2 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.2,Genel Loglama,V16.2.2,"Tüm loglama bileşenlerinin zaman kaynaklarının senkronize olduğu ve güvenlik olayı meta verisindeki zaman damgalarının UTC kullanarak ya da açık zaman dilimi ofsetiyle belirtildiği doğrulanmalıdır. UTC kullanımı, özellikle yaz saati uygulamaları nedeniyle oluşabilecek karışıklıkları önlemek için tavsiye edilir.",2 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.2,Genel Loglama,V16.2.3,Uygulamanın yalnızca log envanterinde belgelenmiş dosya ve hizmetlere log yazdığı ya da ilettiği doğrulanmalıdır.,2 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.2,Genel Loglama,V16.2.4,Logların kullanılan log işleyici (log processor) tarafından okunabildiği ve ilişkilendirilebildiği doğrulanmalıdır. Tercihen yaygın bir log formatı kullanılmalıdır.,2 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.2,Genel Loglama,V16.2.5,"Hassas veriler loglanırken, uygulamanın veri koruma seviyesine uygun olarak loglama yaptığı doğrulanmalıdır. Örneğin kimlik bilgileri veya ödeme detayları gibi bazı verilerin loglanmasına izin verilmemelidir. Session token’ları gibi veriler ise yalnızca tamamen ya da kısmen maskelenmiş ya da hash’lenmiş olarak loglanmalıdır.",2 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.3,Güvenlik Olayları,V16.3.1,Tüm kimlik doğrulama işlemlerinin (başarılı ve başarısız girişimler dahil) loglandığı doğrulanmalıdır. Kullanılan kimlik doğrulama türü veya faktörleri gibi ek meta veriler de toplanmalıdır.,2 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.3,Güvenlik Olayları,V16.3.2,"Başarısız yetkilendirme girişimlerinin loglandığı doğrulanmalıdır. Seviye 3 uygulamalar için, tüm yetkilendirme kararlarının ve hassas verilere erişim olaylarının (verinin kendisi olmadan) loglandığı da doğrulanmalıdır.",2 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.3,Güvenlik Olayları,V16.3.3,"Uygulamanın, belgelenmiş güvenlik olaylarını ve güvenlik kontrollerini aşma girişimlerini (girdi doğrulama, iş mantığı, otomasyon karşıtı kontroller vb.) logladığı doğrulanmalıdır.",2 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.3,Güvenlik Olayları,V16.3.4,Beklenmeyen hatalar ve güvenlik kontrolü başarısızlıkları (örneğin backend TLS hataları gibi) loglandığı doğrulanmalıdır.,2 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.4,Log Koruması,V16.4.1,"Tüm loglama bileşenlerinin, log enjeksiyonunu (log injection) önlemek amacıyla verileri uygun biçimde encode ettiği doğrulanmalıdır.",2 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.4,Log Koruması,V16.4.2,Logların yetkisiz erişime karşı korunduğu ve değiştirilemez olduğu doğrulanmalıdır.,2 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.4,Log Koruması,V16.4.3,"Logların analiz, tespit, uyarı ve yükseltme amacıyla mantıksal olarak ayrı bir sisteme güvenli biçimde iletildiği doğrulanmalıdır. Böylece uygulama ihlal edilse bile logların tehlikeye girmesi önlenmiş olur.",2 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.5,Hata Yönetimi,V16.5.1,"Beklenmedik ya da güvenlikle ilgili bir hata oluştuğunda, tüketiciye genel bir mesaj döndürüldüğü ve yığın izleri (stack trace), sorgular, gizli anahtarlar, token’lar gibi hassas sistem içi verilerin açıklanmadığı doğrulanmalıdır.",2 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.5,Hata Yönetimi,V16.5.2,"Uygulamanın, dış kaynaklara erişim başarısız olduğunda bile güvenli şekilde çalışmaya devam ettiği doğrulanmalıdır. Örneğin, circuit breaker ya da graceful degradation gibi desenler kullanılmalıdır.",2 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.5,Hata Yönetimi,V16.5.3,"Uygulamanın hata durumlarında güvenli ve düzenli şekilde başarısız olduğu doğrulanmalıdır. Bu, örneğin doğrulama hatalarına rağmen işlemlerin işlenmesine yol açabilecek fail-open durumlarını önlemelidir.",2 +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.5,Hata Yönetimi,V16.5.4,"Ele alınmamış tüm istisnaları yakalayacak şekilde tanımlanmış bir “son çare hata yöneticisi” bulunduğu doğrulanmalıdır. Bu, hem loglara gitmesi gereken hata detaylarının kaybolmaması hem de tüm uygulama sürecinin çökerek hizmet dışı kalmasının önlenmesi açısından önemlidir.",3 +V17,WebRTC,V17.1,TURN Sunucusu,V17.1.1,"TURN hizmetinin yalnızca özel amaçlar için ayrılmamış IP adreslerine (ör. iç ağlar, yayın adresleri, loopback) erişime izin verdiği doğrulanmalıdır. Bu gereksinim hem IPv4 hem de IPv6 adresleri için geçerlidir.",2 +V17,WebRTC,V17.1,TURN Sunucusu,V17.1.2,"TURN hizmetinin, meşru kullanıcıların sunucuda çok sayıda bağlantı noktası açmaya çalışması durumunda kaynak tüketimi saldırılarına karşı dayanıklı olduğu doğrulanmalıdır.",3 +V17,WebRTC,V17.2,Medya,V17.2.1,"DTLS sertifikası anahtarının, belgelenmiş kriptografik anahtar yönetim politikasına uygun şekilde yönetildiği ve korunduğu doğrulanmalıdır.",2 +V17,WebRTC,V17.2,Medya,V17.2.2,Medya sunucusunun onaylı DTLS şifre takımlarını (cipher suites) ve Güvenli Gerçek Zamanlı Aktarım Protokolü (Secure Real-time Transport Protocol - SRTP) için anahtarlar oluşturmaya yönelik DTLS Uzantısı için güvenli bir koruma profilini kullanacak ve destekleyecek şekilde yapılandırıldığı (DTLS-SRTP) doğrulanmalıdır.,2 +V17,WebRTC,V17.2,Medya,V17.2.3,Real-time Transport Protocol (RTP) injection saldırılarının bir hizmet reddi durumuna veya medya akışlarına ses veya video medyası eklenmesine yol açmasını önlemek için medya sunucusunda Güvenli SRTP kimlik doğrulamasının kontrol edildiği doğrulanmalıdır.,2 +V17,WebRTC,V17.2,Medya,V17.2.4,Verify that the media server is able to continue processing incoming media traffic when encountering malformed Secure Real-time Transport Protocol (SRTP) packets.,2 +V17,WebRTC,V17.2,Medya,V17.2.5,"Medya sunucusunun, meşru kullanıcılardan gelen SRTP flood'ı sırasında gelen medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.",3 +V17,WebRTC,V17.2,Medya,V17.2.6,"Medya sunucusunun DTLS içinde yer alan ""ClientHello"" yarış durumu güvenlik açığına karşı savunmasız olmadığı, medya sunucusunun güvenlik açığına sahip olduğunun açıkça bilinip bilinmediği kontrol edilerek veya yarış koşulu testi gerçekleştirilerek doğrulanmalıdır.",3 +V17,WebRTC,V17.2,Medya,V17.2.7,"Medya sunucusuna bağlı ses veya video kayıt mekanizmalarının, meşru kullanıcı kaynaklı SRTP flood'ı sırasında medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.",3 +V17,WebRTC,V17.2,Medya,V17.2.8,"DTLS sertifikasının, SDP (Session Description Protocol) fingerprint özelliği ile karşılaştırıldığı ve doğrulama başarısız olursa medya akışının sonlandırıldığı, medya akışının özgünlüğünü sağlamak için doğrulanmalıdır.",3 +V17,WebRTC,V17.3,Sinyalizasyon,V17.3.1,"Sinyalizasyon sunucusunun, flood saldırısı altında bile meşru sinyalizasyon mesajlarını işlemeye devam edebildiği doğrulanmalıdır. Bu, sinyalizasyon düzeyinde oran sınırlaması uygulanarak sağlanmalıdır.",2 +V17,WebRTC,V17.3,Sinyalizasyon,V17.3.2,"Sinyalizasyon sunucusunun, hizmet reddine yol açabilecek şekilde yapılandırılmış bozuk sinyalizasyon mesajlarıyla karşılaştığında bile meşru mesajları işlemeye devam edebildiği doğrulanmalıdır. Bu, girdi doğrulaması, integer overflow ve buffer overflow'a karşı savunma ve sağlam hata işleme teknikleri ile sağlanmalıdır.",2 + diff --git a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.docx b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.docx new file mode 100644 index 0000000000000000000000000000000000000000..17f91f91bee1f780c3d84af2af21621c8de993ed GIT binary patch literal 223892 zcmV)WK(4<~O9KQH00IaI09brXTf7#JoU;J{0JaJM022TJ09!+EZggdCbYE0?aAk8{ zE_iKh#g^G>!!QsN0)1%%O+P@9#)+u4AWgQv@7QikNki;3F?liA znz{GrN-`RZH#&<};DfSe826HH9Dxy5Dl;F(pVODleLNlwrdtOgqEZuv@dD93Fc!oD zG!Kb&U}z+@UUQ^ZKWC1MFFps>?{@E)um-_k2Xl>hG>_EbDTs zVa%P&l;B9itQchn8$D#LMyq?4?^$a}KUY?_puBQmCg%KJj zfwcdieD==fC}iqAQ*xN{Sq7J%cqM(5g8C=ky1>ZoYzD|rk_6cy5C+YH*+>4k2+f2DA7f@(x_W$HnM)p>ObQS6kP96*c4 zVjJsGN!L>>fJ^Y_|8@Q_l)_B`Zm$i{zaBuoTCF5d3O5C4A%W8XTG)h50W?U(nSYi2 zUgFGr4?^ku3Rrxv7b%MCRakKm9eo2(O9KQH00IaI09brXTeo+l@8+Noe~dmdUru;%oQpS5O9KQH00IaI09brXTNav8 zs+p_-0B=JL01*HH0C#V4WG`fIV|8t1ZgehqZEWnl+in}#nkM)vfoxPk>LG1XXE|$E zkI(6CJMFfVC!m1FB4bgCWH3S<2RX^By4w%Xz(yA^GamGfF?Ty}^2%2&=Zn;n%zs*^ zAVrH#k*0R3YQrgs!H5;>@E^bb`~T^`{4z?Tb6u24p8e^o?w!t8kwlA)7yJ--mgbGt0K5QEAPGi(^sceb$0LW-LikGN2M%*I-R|{Bb8)d$!$hgxlKM8Bz^rz24HSdotm2zpL>%+r>cVY zE>DxQ(%dco(^qwo-IH6jM@hfP%Y0C^`}yb|-$njozHvV98|S0cT=%xyxx&41(#$v1 zRo*Nv)Z0s@_blmu#vR~WRbANEdwcd7_XwB%5r6mYu+GpVX-uDZIR*FMaYW z(E`^#z4&mhvo!hmE?LqO9_1h370Y~uqe^A5D&mj724A{sR^ig6II4Tqf~)a8%93%O zE$LNu?{w~T7JQ3Gs#@d?UaIlOU&|$pf2*^#J9GGDT*-fUgdlKVtD<_<``P>LsY+8_ zjO|HLJ$TD}5IxMZ3dCATZ)vaoE=&Gwl2``z`P13$>OKXEEwJ^V&1)C&tt<S6RRdGwF} zz0RwzyX|fMA^Mlo=wBw$ztlJcdxtp#DD{~t%r3h0DxJk8tGyzGS9G_|8dslB96Uq!^j!UcNfAG~ET(=7Il!nd>rZh+EzeOBO3t z`&12wAAg0PuR6}H1;#1DtBSrcPg(HzKS_$Rg1xU!3Uzk+8Hy$HR6yi}b>zfqD;gy* zQ>iLi(TPrz-``b9k@R7D;SZHAtEirgR0f~pwI_1BVFW62pi7XJ8qamoieQu%@1s&x zAAjwC{FSZ;>ny4+J`8omH;iC4)PN=;v$u+B87qGU2KMpS5&k}GMM?JiI~D0_q=zyX z`Wf#V+m{(e$;JC5i-vWY;+Ine8&LP*GIMA9ES!ZCUFadG_GE>%7-G)c0tX#(KJH{u;*25WlK~GxM z4m8R%BDL3wST#kLDv`^F@KBwhsjK5B$q5;E(_;`54t_iXp_nF_rXN8vqTS#B1>A#f z=Wu5qrmqh|c&D?qy}ieC4p$8Zx?er!YkPnC3RW_ue+&AzqJQ~P)I>!T>#`4@rC{@B zC5(scj6Z$#RYYqI&)}7QZH!U)uDVC_m-M|KLAR@@E|NcB=l=6Q!B1!_^AFiMJQJq{ zf9ZdF?#6oOE*$a`UEY;J-#J5NNaNj}HC}TAzMaBHyvX~*GRksL8rg}yUljSoUZz(_~QUB zegjXSyL+G94ey4(m9Rmg-rJXX4DY7uD*p;^@XMeW;eWwpiGHD#9h>!4xL@XOmb>oz zXK*Z@>U3ZRDQXO z-;&oX&+KH<%HIukl>a-P6L%o)dgtV-XYU#A8aaRq9Ddnl3m)_b;9sFNv%rHM=4ay~ zIXSJO|NZ}gZ0Q`dQNTpUr#gD|!~LVz(UZIeZG*#~Ey=HSG!JS}OT&u~pfCS`4Sot1 zSpiEngwv47QP}y)-ldRngzCY3$69f(=T2LpVNO6NJj_RcIb*nefN{v`Aw7@dW-0cjWPHAMTkU&i?z|;JX#ytk3^~ ze)`19!108cujC0o_s!o^Jy>KXKZf%gy#W0@W1a50@vL}Mf6mL(=wbA<$jh=RF@v$) zwG;PcrtiE~-Te~(~DI*lII)oD)`)hFlgu04`7WXs+>*|P6s%f)*XTfe^> zsrE@x_v&Q`my5rcXTauwXZ(kiF5Sa}nbPI6|GpN|=s52s3QUgE42>dOrc9Kb9>k3bDn3W9vC2KN|E@}E=z|CuvuS5bfa^VHvgQ-5*t@trQ( zV9x7NnzVjjUL#i{)bhOH^Trw`Z?D{OeXkH zkHAx2t7G)6RH`4n&~N7{y)Q1l;Z#NsRgvlOT20;&?A{`eo~pY42W8N~JQ;N8WYCX$ zTU)BLr{Z33r`y>*(7nTMtPeYby`8=8;g0U@@AM8k@%9oW(F_TM8HPt1Kjp-n&eECN zeBOXQJJ}$^GU7OL;uwQBUPcGB?Bikd_}~Ba-^M!9!&Jw~a0Q{H$27d%JHN~tq8(d| zLn@OY4S1OR{w|5mRZ%KR%wa;S(!+%Aa&qw@>to_=q$zC`^UGu-xQ%4P(u)t(0Mz5t zr23}r!3*Ov;l6pQ#*w;s4->P37hfa~iQ!uur;hF)eSZ{n?{sL?8GO(^7V{7V#aX>@(R)6mHz#m9>Qc4FkkSxlRId0^l{gf@W+b}m@=LI zzD#+gMrJEF_8>hLZbE5$|6cGX+{b#HT(TKwh{?l-m~s1N9tDmoE19$x5zV9PB--8`i` zuWB+s{w*D%d@R(Egi$nx)5qa_JQHwPN+Pt%&r;a=!wANPf1p{%0kBA@5Q31AkZDDu z91c=xa52#f@|L)}8ImsLV6UJ+;EU zE7B2O$%l7jbW4yq@GY4}){$^I=B+B#ht)+fm!zO+czIH7CL32&oI9G+m=ZUmD9b^R zmhNX(pkdCznMsB`tEdb!Q3;|5VCw6B9oJXRY;AYv z3GOWqwq*qu{I3lcO1f>Bw3Bp*)36LFgxl`Oe{yu+dvb(gL$A=-eNaa|Saduwg+5Ov z<2-BOW*s8_szQ@6!pXQa@ksK`moWUpy-$umt4I7plAfp5TbCJ!51+;6kKInkDoy#; z6%BdZw%_UsJPZ_VxCdXsB;WHC8SP!W5n2)2H@p!1?y-WCu7=H^$n|BV|NUS8uLZ6) z8oFgwG?;~+hK4sZFu{e!@P9Aq?Go6bBs|#uMOjjh>rq;xW(;H}DXbtTA3gOI4{S=< zWS|{kVTM^UY$(7S z-ZPz>LyJbJ4~^O#qPNQb@}KNuM+A6)^~p5e5nM5tg1EK=YFr5axp==AL}3L7>VZzt zdCW+&*&PVSt02rLjQbH77U(P8i=5WsljK%nXfLOQ=$V`HQp5_a4}a<5H&z;zMhs;H zBCAwmn8qlX!1r`7p^X7cTvQx7=&6tI=sd*r7#;=V@^%ZN*eY^x@gc1!FHRI#s|w+# zqI29>QO2PeCW{0@5C!6Cm5fn7!lR0$B;A#fhy;Izo@n-Erf{Q!0D%$Xkk(@vpBlx? z3wZ=`pR~R#8d^}OgAu3;?~GPWid%UIXAE3B)DLhjMkOwp-S`*@NEPo@-ok8EmUMGx zE}~s9r7iBr7@}^=xYOgrJY}Tu0ic9PI3qGftm-L|f$M?SmFgV5Re1+qxl*=-bz$X+ zTPngGAnnaMJSxF+b@$wklG2zvG{Z11)UYMkJu)BssJ?Dk*Eq}g zp!L`%KZ*GJ34<9h(KvB7gaGgKlq|v&PAA*CAOCjo9$sSTAO7w>*cZQn?><6#ikkHI zcOd7Y?cI*|?&O1L|BUl@Nbrkf#Baev17NneOL+2W-x>6_5!~^`hl$Q)qtixvs^J0* zX*70hV3DGSfvW2qjWx!qq2C7I98|E9pgCa8aUW=WeX(g}i+xID&oEfG<{7Np&R|vL zc?oBs%>g`k?`7DhUO4NidCtm=QJ7M5^fF%%qc4`YGaQ}5GUNPD@Is0eVc=-Q%hyY) zkskBNqm!hUuuzH6ZZ#hbX)}Z_ps|DT#w2Q7n9Ors=nJ}^!0pcAxl}^nDJH&K%Xg6Q zh6%_`|1Pkx$qe97tNneT#<9XZq{@ca!cd$7(`EwaVT_;9tH&yc<|gCBZbwv{d>AHr z1pl6*4TEYI$4QZ5x3O&u!jBi`DQLcmZ2Zg>KZLQ&LL*wp1|3+@JKG3j1rZ)W(vM#3 z6kT#yj$97$N}XU^D&o2P-tzLC@kKZ`4${z@nHl+{<$5gh*_v52f>VWd#Rz<76hpWf z2S%x(-I#J+3XcT+6X#P~ojBIb;Oz)p6e3-JNgA3PV+6{n1CgEelhk3f`N;CZ#i$id6O;(3jp)Q_&vNB2 zi4J4gK~@7UGrABJxjR=mhW>%t=}wyh=53d32|Sm_tm=5pSWi;PsNT&naQUcv(E@Ri zJJEM+gQo1J&@t2g!IR*hf8;{@5Q~$VrGJ_12$ZmFdSr6OPF0a$EUm6;jCml!KO;$w z)~g0>!ISIjiZJ5NJCe5%Ce?=Y7_@Gsrl2C(ITP3t4h0MtgO?87FdtGJi1ngTfh@c~cy)!*1G@z@LF$r1(YRpw~ma?m1*(VOMyfb5l~S>o&(6h;?+Ei$rt!0!6? zi0+k{aIYP!8W$2k1>gCMM@13D^AM?o$>eH9fq@4)1LMHD^S&9D6kxL?M&L2`L}d;E zx!M?*gdGNY#axAkig%IBsf#4xto7Ml5~IeCt&j&_Q0@rdN>@WV8OaEDHT*3n03U6E z(6-{$@=jM0u1T=a!E?wFf&*a@f8KgE2is4=T>`5WOWZwti3aya5-hJsC=vFbfC+iQ zhItjM+g`=0m4(Z&qpa{>l_B+wmULK}uy^jsdI|N!h@xWwnQ=gk&lv2Ul4XFAQ_+K@ zc{lu+r6?t8)x?DsdR{n|;^9UIv*cs*#lM#*3%*^5BEmcw?KRK?rPVN*5#Bsj%$H77 zTCGyBe*7B=pwjv1E!d%PRH6V9t(~Vyl?yfiR=a}3TgWg^)JSy__n;;$1i-CB&(gyD-PM!0^$f0k4TV(d1uB?*66rOrze zrAF6NYH}zUdNK>aZvu6PSXl7#(FUag5L!6Txt13D=)f)bV z1<|G55GKfu?w(Gk+*=z;A3Hj}HCfI&SVj1i7R;@dAl>y1TdfF#PJV9j7~kVL&i#2k zsjs?l%NIE$KS~wrzV`7`mgSMbQ;z5eq%OJlcon-ILxOB@G`$t&!+KozDPqV1hu}S# zPt7O*P?FPQIi}`V57l|0BufX9%%FSV^FG{*0EVSHP0r}qr3obx1Y^Oh_`CwkZLh%6 zZO^5+qxSA!z)l~+q*KU1G-a$MDrjPT2C9X+2CFitG!8a5f046$1?A$54Z$m%X;Jyc zh@25(ZUn;Z9t_QmjZs}zo3fSYY=JrkBjopYb?WSo^HQ?H(MEZi*J-?I@MxDrC$2XF z1#dazddgUjDIV5}u=K64@&PO#n7`j99xOyuI=jtoDa^Y=?kPkG*~@lQ$7 zmvu(LR*nNT6e67unPWaBcBMvY6_YYE8E9jj$}p{px*pTcJE1hmNKwFB1j5X;E=x+v z2ho-Y097*q+KO?>2Bgh;ki)AEt?i*pAJkJYt%f!0*&!aF3T0!ZM@g8T!4=k(iJ%3k zmzV=7Q%3Do#aOcdG5{R-G|V3KyKN`6?XcX-kZu9qd=`LwRYLElORB^Cq@OFfpFOH$W=Q8% z6yL)&CX<8%dKAj{&lx;(0J|Nh@l=(iDk&cB;e-71hQN0;O1#_}rZZOts=x#)__w9% z38r0?z*<<~6!?^6LiGE)WKeK12jL*r!rZ1Xt;6pp14Z@sVmJnBk1?qzZcmW`BE)_X zT$65t3dogCx@sd2!Q*`2l8L};3=tRJ7V_ZmBS#bvCg}`=Ku{x-1l3OJ6F49bmt;Zk zNG*$^go|i#%j#%?va&FYkQqdn za$qBZP<`Zdo-M4BN%6s$&fHl3Y&@E~#qh8&6d#Y1z%miyfz>#eU>6V73e9K(zvA$l zO1wfj9EFONEode@ z4pnTo8VAjQT4?+Xr>IG>B#DR1Wpy@8B>8OsIo?;i<^!w4&dwGRl@wdq`d2cBZNTsj zl_&EbTQfH~?Qk!H3}-{7vRrBIHRll{LlcN;Fmpo6hm5hHUc6 zjids|6fKKT8d(AfKjv<@aX2F4m~lu(p~pB9!D`G7?|`z6ZT8m~?tLeEU8pKCG$t(@ zba49KI45b?n??IUK8ggkJZ2$!dHZB#Wv`GCfLY@H>3MQ#*z8Q*DrytjS~M*@lm80nc2o6k%w9Agla&s3~egyLsfS(!~xsT zuzSeT#9)=F%3J1-6k*H$mP^2ZqqsN`Rn(oMNV^= z+0|xDJV70M62V$QPiKUpW-S=r_`H^Sc%DJ+z}JmO-|y*(C)9iidRW&%l%t5|unl@{Nfq*yXgDO} zlM$Y4FA$fSP%>F;zKcsw;Sdq=o{lNn#P$#+*tra{$s4 z)@Bv&{!@}^7ObZ{?L`;zB?*-X+aPtx5oT z=XhQ?E`YF2Q6s|X(PIp2xEf;F;HOhL(R5%?t^qZl=r>+1iRA+7{M@wH4$|HlhgK?r}aWjV9I-%rX~_y!xy< z*g`lLVZrGt7UVf7Zw`bJ%_yHL-qF4#>Ltuf5(ArACKKQ0rwT5VdT2hX=pVYB4kZP~ z(q>hHTwKP2PJ~x#+X4f8sElJQWGzgfoN>{TIS!skZvs=f#ac=y&_e=;&{HGPP02sz z07ILGoi7&hbY8=g9x#H9g(<6k#EDu;DC#0ZnbL`kJ%zMbF6umO zb0;$$5;p9m>`kiKIOAh*37Au!S>21W$`WIlbMG7BVlTxBMY09TcPd>*P*7)?FleR97kJ z=;#d2L&eM-ba7%#0*+Eqd3%Z(wGD#ppw?dtFbkS9pz5o7p(iX0xI#0x*#cGHS5vMF za-g~v6CfImwc|D!xdI{0;erKEJ5BDdKn?Fqso||9s^P6wso{&iph@YRjb7~st|Y($ zBC5t|bsCGjFBAJQfounjo-+7CwYke`6JtsC5wRw517|OpM#%XW>Yym=s*l{qN1{^M zppfy4E=94nru6$}fJ3EEzX$@y*RrNod6ouDmEk*>{!AI)*o0Or3K2nmla!n#nEe*KLfIdlmzrToI%_o?!|(Q2JK8&x;$*IHdDf_;z-u4(XM9Ieo?<-Tnf$ zvd*jyZk|)|(e0r$j+6@}IPMZWVN^uesF-&TLh5plgftAkOo?YuegCkHM-09A)g_aC zUc9CN2u{%K*h7d?<`AmzVv(y)P;*pAK^$t5`^ZKNITHf;>P;JV=8-$>c;pU*@oAed zYrD2wZs~F$=-&{g$cA-;=dFxwlKLhw#=OU*+@%X{&dGwzVjqQ-IgxltR+~O1mz6OH zDygY^PQ6Kq7Xm7AV!`F8gW+2)b&PJPG?`Ech&$Fao{x}igwYXsKaxi=f+D!eOLY5e z^A?ke-*tRQ9MrwSi&+jWlS)}pX|DzOj8%$B>V8n%JW62EFi_>g*^$?mOm_||5j&Wo z*bGIk6SnYMq}Upj)E@JoaTP$6X^K_Tu^%fA{^65YUl~J{!wK0C;X&{9c>z8I+=u_f z7^#MoMq4g*cq#%sxr>AeNPDRk42cl5j(lpW4X+dmq)!xH&yYb)>J9Is zd4>PG+fAZdf)%v=^0#I2a~cSP|E$?!X{KO3m}V3;q^Qdfrd~z8dCY3l;dCHI6rsL^ ziQdy)f};#IsN=I2IxD{|$TtqujJPM2R_0goubbDez!;FhoHqx9fw-})tYjBb0&@Z5 zkL3}Qa$YJlbo{}CB&`YqOK&pjS50&xo?7@jobms)Q;+ajWS9|k<%SNq^n7i5Isk^EWnO7IQ zb2!y~s$Euvs`Ssvl5(*8l*m10l?Tp;psq!H=cW2NFYdfdGWhqks`{sE5$D-h+WS7> zEZLps(iQK{Pm3`pE%wfvu2&3p=HYxHT9$;5l$~h!K243crMg7h6jb?;Q;1aEPgV?d z196=hg*vcU#cscK zc?0RI%66UPK*YwXoM6>$S*KAHvJ-+i2$^`%xoGuM5Zc3hRAMe#^_t$w{A5B6wx=>i$A?uojctt ztk!ka#MeU<8RAX~XO>qFa%mXanw4?V?DChe$B4Aan7~H=-t@>R0=h*@M#bDzMrsck zzuyYmu6iF@f~y8=`*?2k!3;BR9&f^Kr{NI7)U*wXd|7@Knd{~uE8hb)rJbql@_HMK zA98U<3a{Y8a+a5n2ZR!G-88(KAu3JMc7kaf62o12%bT>H{ z{E7v5%8Y9)oO2T!4jHEMKtz_;SUc!a`SD#MsivWaDOgF3 zW2{wbK^4qzz&j^Ev&p$5w23!cY(S&jE|ZBLNC?!?lzSaLMTzoXU$oExKg#<xQL~4!I98@c7~#zA^nP1*W$q8ObIV+VSX{Jsd_VX zKjAr(!P!8`P-xjCLefYOp&v44O>|BPlsPD+X+^W!ER6{ijn@(AN8Q=k+uA+Y@5DR1 zJNw)5;ZDD^-QVrU2U|Nko$mhNaB#R2FC{}yOB5<{5M1AKX!1V1?x0f918h=;H32J2 zn^@{>8Wr#Pi{DPPFmj-)NIsuH%>JmzDP%;!;J?>JPgTk2;i)Rj(B;BQ?){Hx^|hQY zH0$o*@7$!o{qEih|Fk4o$>r^qr_k1zQ$}U1Jjw(Y<6DzC1VP=sv%SDzuGz=g{(K*2 zIlE|Ck*ofxI;+qjVuLzq0QNxOYCkB>dJwmHxq}Re|^OFMERpIV8@Vt6bep%SGw;0SHe+QXv%v{w z${tHd#9Tf%;1F;9M?A!9d~)G`YcW-iv!8{39=2|_h7%QE&O&^{#oJ1Z){R2{_c|$H zU9-xQay^#_7b)x25MIU!@71^aS!}-{b0!g3KdH1vGH`cEv;6zJ+Q!`C%c{EOgfG&( zKU^?=@m)~fPaGrIVI1+CNZ+52>MGLqaMzhb`f|8M{PNguJT!fui}!F<;RD9b!0{Yu zL^&kWmzQ~gqq0y*Zul@NRVpJY74sI_R$*9QVSrB@q44<-9nF5WvN-;6;MY;A*4y4* z2HzuA^|F6bv`M^Q5}Y>`C9MdCk{3*tgQ3YHXcib03mRwB3n9@QSyHFz>cKB}w9ZkS z$;_ZEYcJJjN0Eb+gn#($FV$-QbAhYnwHLbozb$FxerPa)gNgiOA(`OX>=;rL?L}pB zYf8PWiyd`qa^7^4(*pz=xZUoZ!2ThoWZ~1>cu=oPaBrscb>seTVW4t}wx(nWFmF;h z>aNX2jiJSJIp5~hz353^j8tX4b|VHEKw?;&33^~!<9fup7BB^~9u~YTfArG^$N7>L z=;Al9N2CQN6Gn+`VQen!$a<~{0jXKGLncQ;7)bOlz;^1g8!X4NZb(aXsKM8GmFY_DuW#I2xP}9g^+O0i6uy z?I0eiPcUWA$hysAo!i|C;T_|o4Q@k)WTqq4##HyRx^g;9#Km9C1EY;6^29|2&u4oK z&mFv>#XNBySzAK&JJgS+(8I8giH~k5KaFje!ZP5>4qbB#JgOFDgdEG`Sb0>14}@~x ze6ck<6VGRp`x_(u6YNH0`ibR)UHmr2oyOV!CewAZebJ|J0XHYtudtFI8=HP+w!i#T zw*QI0m?P8I+N(A)B;-P^WOx8&d_k=jlRudaWh%yb_ia<*QbNeHxe{-N9B9(ecpuFx zjo&?-F08TAtgTEn#j>h`q{ha{Py57GiHJ)I2mS6j$yECXu0X*Wk6}o?C6zeH$|^0f zvVwvJwt>JjpSe-x9tXEng$T08o2U&gW+6GsTu?rcoLz}c+JDGxk%P*nhGDZN7!lM` zA()wd8*?{Xux&g>g&+H!Ztw7LZ)bn28+W$U?w;!I?sfd`yM39!fRS6}jXv$6FnGmt{9HhHtJ+*wx5;pQg@V+u0nAu4vXoJA`AmT$d|6&n zS0B!Rp{f3M0U5gmz+y2(5upFj+??HAePpKA$wPx5@`^mkPK^z2DH`eXeqF)Ercig* z=!IaYFt9VO(J*k#sm4gAP$;zx&Ml3CP`3K4I0=<~*``Qb947D|LSPO#h(2Zk4yQK< z87@uL;IUvBdvDq}^><{$ao_KG{YM;+yN5sat;M;m1ZK$gd5j9X9;3pKz1{7DuIhIV z2K{)ubFj7F8SHH9!`;4CgU+DS?W&!<-QE5&4k_<6Zad7qeTd)DoQcRpXx<=WIF)&S zsq@O4b9Q$FSQQggwkJbE9ev0VeBJ2V>n$c;}>5FLwY)8v(8|W224=zd(s{I3} znX7}ydy6ev)KQI@rjzpqG1OUr1P&~(05X^bFX%H*c$WznQM#q!x=ROD1I_eIK3@=A zd^pADmJaoJsgx*4tecKFO}1zfv_(jKbVrMZtZ;Y;}h)`i}Hm{*W zCwE9NsN``+II}ey(3YXBjJZ1T4H+GjxCA5ZaXPTygj)vHLo7ryt z`aG#8OD&aHqmo|w`G8s&DdMSy;f<-^pw*DD%x4OdV)7SwfV_s+L)H(M@Q1N(MM0Mk zjBeUIxV^tI4E+FV_%&&afvqdgnw5>%0u=jM*5~KCa=cl@fc@gp{nt4ENB{MOpVP-b z{djcb4t_GLZwhlg2IHkNR*I5aW@17#!+k1k-@}qb+I!R!VajR2=+iXnjj<7(8&JzV zg`+{H&~U^|-Zp zWuKFr8Db8hWf~*{Oj*E%XJW4j{u`6?@Oht-4m3XJc_%$p=t_Do&T6AW=f{6ZTt6l* znd($GHVb68q3>?k2e(W`yb3v!wd=9g?VykxmGy)x-leIMi^21r2&2&KGEgQ7E42fg zQyKCkGemMB3=z%(oX@72Aa%NA?)63kl@VFvL)X{uj3ZNXYawUIoVm0|9(mA@2YZKG zgTem(e&-Mz-|qH)r@ObkyWQ{Zc6JZ8JA;0&qYk!~Qha0=+BNAu!t`4f-Io)t#C}C5 z;4zv#=qF$Ng}R4=c>bbR?X*Z@%ould9v@Nek5Wp@3f}ARqIiuRl>aQW&b2VI(AK~=;?h7 zZe{ZynYf&b2b>#H<4VERQEyShm%o79)@1JSKAKnUz1NwJ^`BAS#7eh)mc%7T`(Mj5 zC1uUeT-9cNA|k2Mr*TrT*fwHnlvl~QX`6?Rw`rrsP8s-g(oO@psL`0C3RB^KAulaY z^Pdw_J!x7xaf-_22geFwm$hZcn4%Q7^=ivcz&#IQA1wxsGFLvj1fse)S>@iDvZD=a zB&6vy?xP9cg7-mRVkqnMEAtbWK_ci6L^Fi%% z-G=F`Y}3W7o}cal3-u@@PC=i;f8>=jH+vo?;K!YKKaP9*yPa*-)w>5-yr z-RkwXy1QFS>3Dz8S%y4#^~3$6*Ic76*;IKO8}njy89h>?6ZzwF)9i4VM8|bikLp!P z4H|7L5dJ-a1dllHOc|F#@`9);EAD$>li6N|o2fgwsF!a?%upVrn*U_Dp{<#85yV%)fKVKDe^+hmyeuc(`? zux8hoEj9}fSVXm$+3?$yW!Su?GkXoL%(k~V4CAK_*)5at^E>xkQ)2(fd+y4r>rGb2 z9T7uD>LQm@eXnU@D=)1uL}kQI3OHVs9$AXuiOtk=NLCus3qcG8p6bHmp#Bt_#>_?a zs9U{Wp;ET6kkz(`%i`s#-*}H&)yh4keu+bDD~)n?q@+iOsn%fk*pLhx5_=NKX97X!s$er7t@hJ5OTvV~t;=9xI?v!pU# znx-1ULM_*3)ND?WnZHdgKA5@{jLyL@z0?=uIBnGR!Hj%B&=c1WI|T43Ms4<(GsSjM zx&QhZ=w}9pNeGvErDJq#Q-;moqaZyr=>Z)fHaFpIO~?f+aJvvTN& z^;^X|^;@8~LeLU-0xu0G+!Sf}to}q^mve#Y+NME0Mo~C;UBD%0qEESvG(HL}m}rPp zWO$CfX&EMP&B zxMj&cF${6>9{WiOCYmguNitR#xwn*{jl1^LkW#sHcY|!Vz%K7mmVnE;-P0XiGd8BU zlaW_`r&tis#UKDoIVg1|hi40pcy(sdgW8c)kED{Wj`CrRuVn1U=GsgBp)7u80wT)C zOTxyhBwYlekpsq~t#2alh2XR&D zKM%~bw?9+*hfs+n>wuTR!&apUSg&8w(9l}2LC>C~V3_$NRR%o3c>|MjFpWq3EU2Nz zBIZgtB(h@D=p9SPA{1d3;=fFhZ6 z4-T^B1MNJtwe8w))j5?Wb5mf52X!ii)s{{&qxiC`m+`VC_yW>-SJ@mp%v_dNV$R~p z%|x1K6`FrkdV*;wA*v?vaU$)18S0+qC*`K)LpJ*OCuw2v}K~*boPOvE8c^3XiP1XV)d$l4gn{z>R&-@`}}7n;JF-J`=;@V`Re z3-iT`2PYZF>+pHBcintVfoFO({3kj~&X8gr%~T}-9qnwz4DCo&VhcFM3cAq(nr-z< zI!@ENKJYA|6AG>dy?X!Up^Cn9)lA5j5$kEzoW zoZ_>5l7N&TYBf9^ewQ=n-{Ru(@X_)?xr3;ew6d*ZsnhPI(Xi{bUClbSW-?!p`@$`X zO!2tS0?eTvU&Z=9M<74A-MF9Z3|9`tAZNoV62}2CqmH`ISG#%LvA!hA$?+HZ!}JrQM_SDwt|jsD1b(u+rO@ldYO#l@=h_Fa21E26-N=gk3P(z1rBk$s&-jJvRA#A=kCkRUnBa@FseM!)*}FWaD&LVCR@fr#sq{+G zL+h$*Yatlo2bF)2;3)d=`gJt6~VgmwY`Vms4Mq^~eX`2&|c6MzS~x~%|A zLtQXRBt`Ji=3?*#_6r)B+@=-7Nk)I4dA;7ODM)5G`}kPFv$7eVm3}gZi(r;XYkG&? zZEjMs5@F>wPLp1dRGYKzrrb-fS%lOQ01hLJ0UrnDliX+gK>sRjqE;2QXg7w zf%JswM3`{Xmb^S5GTpl8%F^@l_LX~09H;lu<*2v4d8oGozf^hqaCfi2y?-$1?DzZK zt!=#<>w~?n+TJ_t$Ag{jPG772xO-Lcya<5jeCN(DH2u#FERZEfK=Km(WY*?U*eK@8 zzW%-k^5ed#?JK{|A{qXtbnjK^7Ace_;3v+b-+2h;5qxz{_=cTyiIgnVNp|nE=hkS) zlbCirEfG)BkJ5N=Fp6lP(^3yK=XypWM6nu^DWBnN6x3vrNj}hzFqJE-acNB>MQTyT z&{r@`S}ZHTbj#WV?;|EDkqjc!CA-+_<;8K8un2%Y&6m*w1vy1PMF(kLml zcV98F992-k$SBbBoN&ff-~a#t{H7bg9h+9D-Oizp&E5Ei?SsvTHpOsyp&Rh5ATDVX zyeV)AAWS9;zuO_g5fOg)+9l?i&^T$qL=wVxOdUcqojH@i7S>Qi1h&sM6NCsSL$fwc zDr9YCbS0gp5^~XJAq>LEP60MnU^c{K2P^`I=;38cwp+64POzrI z>r_W>%S#2)hYnSB7S&K zJ6fB|d?u|%IUA>04Kl#S?m44kA@S5*mixqhHD8H+2_j$nb{jI=2jSmkF)Ryk-cH+a`{oTV|r8`?&+i_=m zptj=9?!lq%9V}yC`PuF0Cl*F7NAnFYGyV1AuNnA>-)qT9eSs~=c8&2_{MJbgYt6a9 zr{)DreVnOBpIP}vJYl#mrwj`;Z-TwivUi&GFkKk{^;8zd6WlY0;vpNYRRW49;+h?U z4;Vdv&da__OYuHTMITq_lND)bvS$2Un+18hF?K$-L!)Z1~y0e1j8a(sb+K-jN`LBO)4z* z4BCz|#0BGth5(E^R63Ldg%3@u;-(R<&kOwV_jfdbnBEggilDPGqnc+JC9TNfqQNXr zn2-!n+h8vXXp!jV8Vynf^Mmj0hh6;;Xp%*KjU|@8!aLyoN!ZK@g2v>eI2doGQhmlW z9F-o&$qHl779+-SV+#iXaQx8_;N*|!ezh{pgM*se={{vm8vm&qZp-HxwVE>r& zIB+u03sa&Tvhi#j9lhFYu;g%qlUTc0iI32;;htIi7eg1?R@Mwdpd1VbK}m2kRg80% z^W?dWRb~kT{G&+6-$t|$rjuf8Ta2&LUv=~{hbQ1mJV%n!Qv=Gbl)Td1D7RmUZx1t$56HaO^( z76aBZZ7SEDW}7Zzn&gG$%M^*t3yYKI_;0;xh`Chf%K%bOwbnAY-K0RU&zMXM*jLU6#0AZO ziO)1oD?uP||9aAUH%OydYnbi#8CeQq>~OE`PIQI&nMIHgUwE&8FhqAC`Uy^IK+L@H zqyT#z<}o_b{kll1@g{AUW0-W=OO@&o*fn%nGTap^^YD$SgOs=^jucd4Xva{NGTEZB z`a?c~%y)vC%?wrAl(w@-LUeK!^o7irKhJ`%_ z!J?s}6Nhqo&r2h-=%lF6W<~72pj9iaLyVq5BE_kk9L6YN=U^GKb!wc7QW?kFrkyZk zoq+!!9@=x5JUYiI7VgF#L`#u^WIixHt)!;jbtN<%4u?K(xro*V5IXVYkE{m`t`+HW zn6U7)65HL=;k8lUo959aNb)L~DC{j9{i7P4eI04rPukLyk;J9*^!aQ4S$J0tQheVv zJKl98H@?fvv|9Ul#GGMXVW|3n>YQ1+tRuu}$wHHD$=+xne91CI67sO14^H zHHnZa{nsHY%YhN8G}>jWFWJ`!;N*Nw&4k@xtmp%k54QO_#d zpVZa0tISlQ6=*;_{NXW9(znk{eN(tJW~a?u8j;JfK1U#7Wl$t@-*4tw+xMxb_IG#V z?XBK+=WwU9w-xVf@96HJ*V{kbI_!70_Vj-DP}_>&Yt0PMBs@xfPAZi~&p~8iTEM5d zk2W49C-mvF7=w`2IC@%x8->+eP9@WMaPjj&}?-OMd^xB!Vwyl zHW;9y!1u*(MTKFfiw~@{R}w<-TRWUy{IB%le+5NBHpA@ANr@hgX-US>GdLPVeZ(&? zqQ6!Ip|rJul+mTYWMJ8NA4`PN(3w~)7ugsXT#+P@<&!72TCUS-CW^!Yp&SBY)>+uOhw_+Y%$pEVuvy#h}Mde_TzxdRERn z2Hbt00e82zyS2T$v)kJq><#vJw)O^{ozDL5;bCvkQ)=sAXM1aFtG5)!ZBes7Xf*^W zQ2IKS+#A%iKY*tFP9|`59Jg~u#$#%Eytlp+K2Za7v^+uKfWN%&VIK}$9 zix3P|rB8CW6Ss~aOF2wop(1BirdETiHbC=Mnrr=0?W4M~fJ5BFBW;tF)`;<=x955m z+EJtzraKW6F#~95oK(+>z~^hvW<``F*4Agf;hHI7y2%$d?Juth*q>Vy;K37^XtZsn z+0?&F;ItjHyv-zEungN@>ZFdt5l|uxXXQ~if-i=);)%iqf6JKJFVW1Cb*a$SFnj>HR|<}kz$(QRoP9K8wf(*84td)uY2H?VW9=s zrb>ghRAiYAyA-}Ev^SqqV;-*2k~-YgX$~r1=}}dIV5;oyA4c7+4u||$;e);hGr?2} zPv`Ls!jZD_v06aFEU&hGv}6sn$jD7b5Kbs=-Yhw@sAvn$^4OZta${T`Q$4uiov<(_ zBZE){{hvf6SWre&#GyPxSt}M3SHX!lGp2xU&@q`Zu$Zr~X-$kn;B#6+dI3ByEuz}zcYQi0`9lf*}ST?d@!%*=D@3A z!J^={Bey`b?wADO3B@RuA+?aTAbRXSGWyATb(ec~%#$VWVNAZbX7i83Kr1>ddq%JM}o^vEfo* zsewUIE&_Y0HwVgU1M_8y4gQw}1NSlTNUa_;V-w9Dn7L^^M>I@i9rdNu)MG0YBx3Mo zK^0DMw>VN=EjMg@uZaEiiU$=3gVXbhpT>CSbXD5Ol!bYIuSrIDbyB?0W0D=% z1(E~yM4?)7G>=voqz`pw=WXF6D*8jx@ezd}5`DU`^w>dNM+P}d-WQf!ReDaXgEjBG z)TYl<04|ze33k%FId|TITsxU7c3#kRYs_Ejy{OESm*mMJ3>47vf zgMZC>2GrU?zv)FY6$j12G4G?xOCt{El}2utn zZ9KMkB3Phf^VF+H4!klCIa6)6QI-*Vel86y?$Z-iCfF=q$w&~~Mq_QttqN<|p*2N8 zKypk>m4y3vYGL%84>4h@7BPH}KoB*$Q82B@80XHVTuRR7ZO&yPHq0JQFJuApvk(#i z?QO(-D5h^3Cgk0jGu=#PHw_%q{0hlLedaUyO?4|bMMPG=ax?ULnxkbcJo!ffFy-Ul z;N4$ZKJDwX0LXlXQlAISJlOMf`W>g$eP!Ne1pRUnv){v0eHgk`<^s=MT}a&_ z{DwXZH}))W%V^>bsTUt{s>f;5Oj}H5%U5K~_vEWO*VXs30x;=1jkhwu>BD=Yfu_~i?qA6$B;#0H;nmoNyv)t6da3+JKzhA2*ow!XdyOd!pZx%Tuf}Jv=~P|i zc<|o3q7V4|1sqWL;{Z4Cn;br)a4~p|{2OJv=);HDPdt;q;OD^~vizF|uqO7m@4er+ z&ZM)|G3UY``_m$c@y8SRFWiyGx3#xphPc?@?*{j*_#uUT7>WwmE;6L5sI~o;xv0(uoj*sj>uj< zsJm{xmpww+E4_!MD7h=aW8{mUlYy88_%dpGqOp%amZOhC8TDwRPrvp-vf>{$ zEkzLpfj-)9aK?xZt!7sNATrz26T!ocfrvB_u2y|$z?_Z-iDB&?y|aJ6sZyrPO?sk3 z#PS#$q2lt%}Rx2$9dK!+v@5u!UesFt?03R6xJYL8W>!H3-LOyREBKgUYEdWzn%o`koTKMSvR%K zE|ui2CF!Lx4&k`XOk1`Y_nviUR1lnIbSXBk$C=Rz6l=5H=Ym5N9GuHMBW>EC@Q@{h zW1JeRJ_ur?i=htanp!fI@No^6%+|P%3^$qSM6)((2|E|a;^2ZBJ|B@r&iTFc4 zw0(H-p}P2R1|As)-vUp~#q?x$L;uW6uXwFu?VmWF!}X!uLB_VtuHAPDrpj` zgtadBIom@bf+W9NmX-! z@SJ7&IYvB66!S~b3)!+nraH9xOhQnzb=8;L_H%a3jo9()<=#A!9+;x-zkBn-qlOYt z+w6R)YwvAf2QG%%;v}JQa#AmU=&*bEtSOJCr%JuIQx~cC(WXRSLHxT(}V7?_C~%hP6}ac_^r=O2mfwK@`ihHY>}+rU}+ z(FRqSQ2XUg+c;JZP2<2!X@tAh)3G6gd0Y9@qI!0-j~aHfH+Jx_Xw1&@b#;df=+oTG z2K=ZE7n%&eXF?id=; z*=UegZ(f?RWnqID;AL;~V#t4=-u^7};VIrOt*Ly2$z}X8x+}oBG+|`H$rzvlb}bs2 z_N8<6g==|NGVBx4*lHAQlvQ5n7!^lf!xefHJ!eJdI@Z>2y#xz)dt^TU$n37wk@3U6 z9;q2u_QO6K)zy?_4fkQj#`w9O{`$px*r0a%!U^yX)T^VZqiTaB!urUMFQq&1Wgf_t zw9V}%zSd2=x4xVB#iRSLeIe?xT4Z|G&Sl};_?qobFHv+;j@!hJ%%;V^IUDh2C(*X< z?61{E{PDG_POqZDjpOL~i&9lE7DC^c6menDF-BB2TCQK&5V+lT*ShTv)@s|mP{;a5 zNpAFQnZtBesL{2_Y!^Q^@bCZnKgv^`rfmW^W8KKOPy$5F{8X@fc{Ah%4*HCc`X;^v zS00aOixka+F=fkKAN3ohzHj>WJzT5p`-u5}6DH!|el{D0KGDByioV5)ouO%p7j2xl zgez95M!0veiC8i@NuvM#|H9_mj2w881SJSrWpC5SsAi@DKtcu<;&ZzZm!1~stkq5o z49SN_-=lCt_}9gU^lDzvEEn9|l=xx1P#YDws|bO{a6j_A-#mF3?Q{=1rs+%smNt$7 z>>R9w^%&Gt7J1P&Q>~LJA`G{Wwoqbz7qoOa;80d_O* zzHFM|8D@VTXp53Gw=RryhMUT8 z7!dQif$egcOBPO)LkKV#)7S7}UrjL$l&19<9O|JGt{E5>lHzf(>72uR3%s54_q%Uz zfwzAw=x__XU0#G~d(D8iKm2s`?1!J8qPZc|Ok9#D;3w+tFjV6Vfp`=*XC4XS9}eM( z1g9m5Xz689gk{WgVYLQII=a+V1A284Wg^*6OH&ewIZA~t6klb5eNzIWH#@Puy=JJ{ zARemW4jaOEb94rK?j(Br3tn4dXNeaoJE_$PT8w9pUr3$50T6yXzYVq50YI_lVDMKv{e0b~k3NtrDpCfdreEeJ-#eCe zm$qIJ_b+3ju<3y3DEs6Cm+o15@|~zO7;gB=ATM-slD+Evtos53e*= zP^hk(#=|4bK_0z`$|^~bQ)r;1Tu`GruJsVC7q~TW293;xn-@8qu|>h(Zmm+TypJ2xpgKZNg~g+n&%mfQWj?ESo6sM$Y%`{bXi_s*~;BD|w?^$yTtPJCV&lY6@vm%SO+3j_O7kNT>As$u((&d*{;rzOV2 zbQX;|QC+oO@K$TDD&w$TnARr*@&xB-a$-vZHW>K{P8No7%gqK&Ht5O;by)GWrAL6s zjn$f^QHG7zZQ0wv)rxoCdL_G#ULL>Z-Sq6`Rf_9o#_(~wp5FvZ#UZ) z+-&QWs(ORfxCeL zQVBy^6Yo-E@Qr?yA4MBHj7M+@HeVb>M;Hz0Yr}i(DQKsiZ`#gX1hP2;_||N69su7C z1K`_EyN52|uua+v+470yy^{Gy8vP|<;C7-1^yF6bh^mTU>3{Mcja>ROreWSdu7@$d zK|jwz5kpFF*AZoso`IuIN#w zZNf@`X;TQXO8x#0`>Ybk&(H}(h@X?zhGW65A?pPk_RXkJWrfHJVS5}=11jp$J*M7s z)kvH01N_8owQO#Vs4p`|6iHRO8Rw4{iK?YlC;*%(p3X{Hy!z3Z`FR=PY(xR0Po=Kdi7wS3qd7WIZvOWF~zE3+TUQ*n~{dtSIITcHKNr8>zZPea_k`^uu+xy*;pCk zXD6*;#0fk^ny}nR#+sY$uI#KCu>B}~#4XNM`0=p$S$u?=@6GiGqp};yJ?gel` zkRQZr{=mKVY%7Y}t+wi|wqBUG2J@*J7tH5tWMsx1^@2I3Mv%JbVYlfi*aNm5$ze-k zdu4kIZlR|@jusk3vC2xnhR(@AHg%^uqwr-^&KUMMnS~jOVcVw&JUz=3TsN}wOWjrj z_@zB4w4P1(bOYf-b6x1eIWF{J$GOlyZf|uvJG=32U+Ke6Z+GYLV9+_-+S-ei?rz1Z zKhXQ}zHM54-A?pw^wj9bW8~>LBB+FMxi*f}Ku3@8`b4FxE;0MQ(OhlhdSOazF`<@c z=<1A0MAl<)$Toz?beS25hG{EZk?$xS7o<@MMU#l6r1W3DMZO+BqS9WQRP@h%hDd)i z)8T27ub3DLn zb^b5@YEW8OiZ`L)S#xepZ5`8&JGVP)MoA3amZ^Q9ey92H;=@Q~6*c6h)=MrPVlcyo zgu^z8oQ@0%Dk#-c3fSEei~279m#ykU#Xq?dJ@*ET#l`YAViDLC##K$QFF8gi%&Ok@ zkGOTkZ(Z@fKUaKr&0KM86G4WgDXr-n%mGDN&s0&OQ$8exQQ4kFp8~y{3*;2akQ07vU)V&3e^ zq1`oe*q_eC{7##8+;A(yZpLIHl7ZzlgAfQXA$)^&?`(NuGN+#y3j_Wf-h_-mbEq<} zZLc*bBpkpNq4u&CS7WCYgZ)xtXO_8TTcit6e|C!0w}eLOHukWjQ?p*Nhx_AA?)(d!VX0(Zg~=1w8`zV$MB%KY9N<9P337C zMPsv+kO8N-jOt3=E2#MdSmU5=Do1I`d=d?p3J3m7c=+-X{`E!%E(yK9YkXvzWD_od zN&??Jk*^b!zoEQ{j<2keas=Pu#9W!IZF{3X1|m2#*8HppNVl`?LLgpHY8g?EH}3YU zid;Ox#KS;MQsgm7Peila`{d)Zdc;2@>3M3sE14Ad@L6pB*zI)o%z*5-F5d@k*r(tx z!luuLQ9&zFJc|#zUp2*A5l*`K&R16wa<6{4fApH!+Mi`uDTu}AuM2eF>BonsT2;}} zsn%6I&(k^q+hgZW=U((MO<;=JNB9T%_-0Jd-ZCZ#dw0R^>E|&Y zvK*!O&6tn<>zxmfKdFgXp`gD(Vt<`Xf~- z);Kq0imur!xSt^xRhk!eZpbZvhE8b?cOrKjtd;NUG&8>?3yXsP^Ycm?Ly%c1|bACp2pPsR*u*HMguNZsF}3d4s3VQ-=JMbt-$aYZW6=wb>+3*i=S{{sIuN>Z%&22rA7 zI3^Lo@Jy*nUgcmPC&Na7*em`xbJZ;dYRZ9cs_j5Lplxd?b?589tA2tRE#Y-yVhZ76 zndx07aroiIZ`H+zv6q5_8PCAO%5D7+UlL^mz)G+W4imOwrPRch?BI6I8r`u4nngE( z^GOTg$aPvcsO0S8LrM^%mKge2as#)jxbZbMRl_nPtVe>kO0gj66WxH3;6$Bb=<3QG z^rU&_gwZ_(`(r=e+1c+YwY#gkdY}&ay&bjJ-`O8*b@zIDYj?lf-|uhrmVzYQy3?Jn zYvI!XwzaZQd@!iShHF5{zHWZ*P8|Kv@-f_AODDnICWXr|Cxlci5?iL4aPbz=Qo=T| zIj~feB5r?5LtVUAHlsT$ndK$sGCg)FV@Wlm(xD;-__U&?2)9tPh5vr{?Jd;o7HYQa z5q=(o03_|2LCuVDJOi2Ank58@$V6uhF&iu4&&yDLrJlFZ=ccB%nmLK<1_ZbI)Fm;*K@ z0%|*mQ_==96hRj2m~kbN#sGke;Bn>obO>Y_AQlqm1?YG;VK!b zG^waGtEf0^V?zWOH<*9}2hS?FT$8(IP;abW&6bm4{Gf(dC~|ei&9@sgm{KJLs-Ys2 zN?HO3B$+%<4s%Ix%1r9a&TN-OA0%yy@V%B`$!V30F*1y=pTld#%GQitDd=|{ea~zc zh~R1SzqY)FjI<9Iy89yC7{6w)0g}j=ri!>?Zyp~V6B>QU+g$*+W)<;I-y9#mrtOnD zcq__cJ)xL&oRmXGxyom_<0{pYM@Xbo708=&|25L4(%$2aM{}C7UGHLJ5nZS!tgS&b z5D4L=yoBvN*X?wu6?f*sxYSLKs`>M@J`1|#xf@1sY=ziIo+<*tXdjqvjTM=6ClM>| z`Dhw(lR!Mps1rSU9$cs~-yPQgL=TM3-YarF9`H_Bt$G5NU={|sl%t`ZIM}lIMW}rF z>Epbx?!(tn@8ZMQyfOz`TbQL`nIlC9W3ui}v5f@QgvTI7Hy-6jo6OmS9W#;Z9G*O{ z=iaq0^Y8zUCac(p^3s#7VB6MMkRUBVOO#2nx$U-;xICtm?;-}yQfNsxbvPI(Z>1sx z9xy^$C}%g|^Ek?m?K4=tn6l3KeM6T$4b10-Z9c+e+i6|aC6Ux|!KqL5bj|s+!)wn3 zQ0o7ve;U4R1l|Um8!Q39)3p||eN1QF7T1(yH;gVmEKS@m@+z3Fs*({LWi-RFFI}%r zWg}pz12x)Qi)nf zo+bql+@PVknq_p{XUz0(q;JL8+Zey;>Hu9m>}9pBxAXzGIh`*T`?<~OEHBQtwPrb; zrR}Rf}suq6fvb5;$EmI zyYy(IqO*LGV2e@Dip0ivJW}ftPUW27wq7jVMIKe-MO=r+u*ljZo=o=2g511LrsPwk z)6_2!@7Jg+`U8VKj^D@P$A-l3Kh^g{`R#e~n3$2oKQTAnB7O6rtZX$ecPF-Avyg!` z4VT{Rq|?@#CY{38XxK{?qaxG`4K`cF7noDyA1HCe=}^et83&SD&! z38qCRiV?7hhBoNvIprheGeb$OHpXu$Y0Cidg1fB!{_Y$OP9R)N7}dX>J7YG2WGEDT z$LY4s@KVmidgZagGvWBsr&F$1)c_*}yLEnev8w)qq^tJlrmGHubk%mF5TI?2DNNOp z5?9+(;KZlynF|K_t^sV{NL4knq8Q}4crQ)Zn@JoY!w3ET@f~>HF)`nu+!O1D>?Z+l zJMM`9n_8;#nj@f-VCQ-;{W^${RwyDH79ia13{=3aU%K$$Z~f9+zjS@|_V$|jrJ>#y zf*=o%VoA9#sVm4Rx@TIiTelE}-iXUtN)nE&(@}WRCs@X4{P0YvxBa zi=rCU0h!a|Q}8|sD>%LVX`Z(=+e$YZMz_6Y?#I+tB27_pV#PJFh&HJ7O!b*TbE;7Q zSDiG)o#C2JFx-WBfQqmL_!g#n5GIu=3-0Yf4w;d=Ly0dz?GYqEaf>ztCd5pk9kaz5 zZ6MyNM=hIfH}SGJ@y=RrVy^t9J&e9|MQN>&dXmMY5u8Ns=XEt;5{shw` z2K6;nuZ%^_zfBmePxm$yu*rmQYv~E61T>b`BqKqRGOi@nUS6V6YQy>g-+oBY)okQf z#+crJY>~tL*RrDu*VGWLPlpw&F5IVM$zEY_^<2y*{ zyp#ucmGWbR0$$z)^EOa*8>qSsRNY8xV%=IH+Dbo0PY6oFR-4R{WEbzj{%mxf{+csV z7@X$^q3568&(tR8~b^(jUoPGK#p;_O}%Ct?~mH2^Lo&AyB?*P$H2ZEKC{154)(6K zjQ%i#V0S5ult1WRbfo)rfy|0c+T*Qz(X;HVu8@Q^iJ6vh`P|3XIcG~DuK(1WJ*Y84 zRhH3<{3PkG?~Kj0M6)Vsqti0tW$%+a7ODPeqR(|4G1b60daK4Ix@-NkCRWMnl)8B$ z4<-B-0w@F*q@RC zt6}rK&Uv|JDt)gc<_Z%qL-Tf zpT^p2;#Wvu+NJ+&wcOk#_c!=l^k3IQ|NYoG*x8Qvq+dnH7=Jj+K@(Z$ZsVJy>T%N?A>}_t z4O!XR>|};)oFf_?7Sh4NoMS&#rF!Mo;G**Hzkb#V5M{33Hlt<*T=Kx}jcLf1VX)wo zFO`4E1BgG+B&ONO5R$N1ZQhAqrA&C@AU29iC}Q=sS7<@AMr3s%A6@2PpJ05opXjQ8 z+WyZ5N^GW${Mp~&+a`183?fgP_)14Cy0)?C+G5ek!==9M55%wMUArJN5-e#i|7D^3 zFN+$9;0eVEYFp&=bu2cep#wA%`zQfhx=biuyoQsis!H`wM=;X0m{(@{o;9fqNV}!} zUWP7NGVWpF`6L?8F#~}{x}wTjVjq~Yb;VjHhuBHD788Lo(V;q5+y>ba%%cio9})#E z+y{;2nI^VTJRx{uEe>uUQ*;_x6Ti(D8q)F(FV6Q`%uNNeBJy`FCWbbiF;^^)*&xq` zWirmWO2ah=yD6ZXn=bX1TWSYUjQTOo1s32al3eZ!O)j1`tT z45^rCh(_+khr;7^F)TH7$w`{`RO;Q0Irj2?jTS5wShSug{&bB&1Xl=XAY}9STx5yCJ z@b1EZgs4_s9o&Cl_js#5(e)#<7Y?jy7Q6aG5>KeP6t9 zg?HwhGj42KrR+O~t~VaRax;ViBZD-e=*FfpiVFN}RZw4hnQ7*=v^EI0E1Xz+gNzoc zfiCNb!)wZsw1o4StB|_1N#1RQ?>54B8{xa5_Q}%uL>8V@)(9lDmS*Mu&jqfgkkw+I z&%Z5c;8{{>LVIPJ8<&EX;GzwX_EaS+Du!56A{fYj`)}XmWz~kCP>x4PB#;R00LAgf zc~PnsU&$}(UmL_nZjQ-xvpt5Tv#cyUpU=J6we)QOi+*UVwdpRqNCN4gPu#&odTxY` zeW$;=@$l%)lg%pt?poCInYa78ND8o{kKl-|nXK>*@kr)xn*RoUrd$4-6&~_+3k!%N zhKi$Q@HLph>BBC7oe`ZOQ-Rbg+NSD$hh!$4btoC)Nd%YVaxJv}xR#r~$(GDdv+#Uk z8z-?)nAIbhia_;rB|R5>ZDNDjn_WfAnZxtf? zZ$>!&ri;WSa~yp>BDd#cqmBJx?7bEEbm!V0L}dQW&)~aJJ@Gmu>~s$Iz`+}1jX&(U z(LDaF=;AN=&~g>o@MLJcJ1JaJ8OumbD7q-E4pVI_!PAkRd`%?pN^T}Skukw(+U0ri zPLGNKISBGeZ83+R?05Gi*X$3*lNheZ143Bx4T$X=3M0D%w*BzquO;2XB)-g3TpnN+B<)mXCyDo@Q<^92b7f&y z;(|4S<1h{-0npn3{NjJV`}Q^fe;a^bUyEevJV}c~Y_T_yFTSo=w-cS^X#&pMtXA9@ zGhpG!cWK+ZSV*XdL`mvrrZVAjzQxBNGAB_t8e`E7MH{5??@0a9RwvE)0t)Z2AJarU zN8&%SqvzgCDy?WFV0Bq=Fm`>yt_o{wo8Rof_tJ@x7M{QzVI^4(@rlD2UL&bJTEOGwg_HTV0ULUxeGmI5yWaM%6mU+Q1NBa zUyDFsmS@Wg0k)!^Ds>yS?ce{qeop0zc+w*DxjD73gjx{{xv%+nf}S|#ZdPK+5!lXs zIre&LZd-lod~75XCdndJUGvsVeVwtJPY-ZL-)$~x$%<&*a#7^wOlc$d-&!2xAKOML z9*@s-`_&oIqTPcnU1rH(uoh?B*TA24*B;bSi9~@cRV2UjP`3$$0#&95#@{={-`>raWhwxtlO_x`1 z9)KqhItnU|9;A7H2wuXbi79d<&yOgsUtIg9i0t(PLOf$}CNb^LmVJP0Z}js39lsXyPK3TN@tZ1Z7^F)YM#Mq^p9gOvcP*_= zx}J?tZn_}eTeJBLyHs8!+@R8Gxz+QFNRI(-^R@zKrmXU!Tnp*pQxlNq_5ZW?F3W9W zS-SA6AkN@~cn;~*U3TS2zNX90w2$TNtn5h!NPr>|AixGdIjQ&uHR}iHh>q@vKH-R- zcv?Nlkw-_)7pW)t*KOYbkPwI83Efwm2S6=*_|) ztkh=wyugqu@%0F{P+-81hrSZ^9$$S_LrKDrHQ#qV!%Af0P*ZT$C)dXul+O^l2GM|8 z;>wLV;FrqGanop-0at;pgOV^j`qe~g$GKPNTpb3E+B#ITy8m6$HM zVPUZf&D#upO2fL?S}~d>*EeXh>U)0K;5_DFqKpmB@wJSTYJ2a-5=>wWD~1#1!9*%5l<) zqoRx^ky)@#I}%~LVgmDa>xK=Dzf$;}7mRqqtYvq9X%!TRs)E}Q@lj)=# zL7Lr!A+>49_oKKBh2^SNob5wC-bZKy_&~}zyg@ciNpA(YWxC!3Ne1$e89GElO%Dc* zG3(YGwgtuO`OT>GH}JT{KjtHRm1t8l!gt?c-8kx*__+tc@gMKQsE7Z~Nz-jj*xn-> z+xtD=)jQR9ZTS3)p5e0ryk|6GX5|d3`lGSomPj8VSRkPw5mCQCO*}{?86!V+GJJVa z>hd$kNP0vl-kEO$X7IA~0654dr@a|?raVT3-Nls8g%?|8Ii(M&W=ZPS0&KDKNgEn7 z2f;gkVIO9}4B5Aq#6)X)OJ_9;0ylTP7{cUA=1k0(I9y;NVg8v#T#3mYmsN*ZKDHuk zj=0q~qM1W>=svN&CL;dj+e3HK>2h{%k&b}JG1|;&WP>)eSX`LepN5#VX#^~w=>pG3 z`9`=C-Ql_#-^y1$_enXDdf4LPVAZ-duadwZ(Ys2+NYWZYpr{E9^D3Muw)Odl<*QLy zLN&7~EET_wz%m}@ocXhJ+6C-*qawuS)fr7>3Qv=vPA@D`YyHEnHw0IPUS2bk#-&R~ zswYGBJSZ8_^y-6`X7FNTLUE4IishIATm|lhLYnZ`&$)*`_bx=(ll!^4V8aNybPSx& zzU8#u0`9+L_^}1tudfzy)H=Yu>P~bUPHXI^>G%hW)GH+%zpyh}QAT;y zrqWU?R>VfQwPIZwysu?ZHmxL?XyFe-Lih%h0?%Xs#X;>Ow?rbjxid(TTH@gCL}+Zf zqix+-$l}Py=v7Fyp%r`d^{cbDYulUcaLliN{OUj9>Dx!&wZg-;rm6Ax$;&5ipR{64 zsM^I`b=-Ibk5KCRAfFl*z=&Q`Ou`}>;vh0f8?ts;JLD8pnzPgm)}RL-kv@A z+MUd+*KeP{`r)hs%owQ1u z9#gk%!tJSaQrtmF-C$9Wc*PXp^%>5@buSyWd-eMaVRY1v>bXrTm&<@L{b_|H34do0 zQi{$@kOCUAk2mj{32o7>qlqaTn1WYY`gf%=k=buCRfc7tbV(4eHEvN?^EK%OUX*=H!ujHrJtD2oSbM zv)VfZTR$y9$_V1ZUPPhB_uH zN*@DxoL{8leT=%hGJepNcTxP|xn~J7FByowjz^~bTrr+LhfjLWOuuJuo_DIOpM>I{ z^6Unk9#RT7QC^pVg-?GI#;3iAT#~|rr#EdJ_$qi0j7KbAT3&W8^CmcEH@fd+UtEAQo z*1k8I7Sn=Ea!sMhiT9Z27#buAFns+^Kfo6WQ!0D3VLk&N($Wb|Xq!+q{EzohiBuK* z`7A3m^={nN;|xyJw0ZQSB3!^x(>AQxhBYgAo+KPDGX%8_YStIjoUA*jS@OGfYTzak z8D0Hna`m5v{Dn%9O%VSut$WTePO~KYl?s;?fX|#T!04_=3a5_`g#{Y>YN1E*h$fQz z;q3JFbB`X7dqZ9CDY&Ik*E<_!gZQ0)0rAA?po}iUzrfF;0g2ra|gih8yE^v$8(6zTi7=%M6pQ(}X2Wl8!w3zMM8=@o zeJj(o>*vkZ#M9PP%Z|C}$sCQd&@v^%t=6@EIu0RCjAP;IrSW@aZo+Cj?1)^|=k3R! zyZ6!6!`>;Q8HBi#(x>_VKF^yQ!cVWjELMaBc-<&tQ4Rx|^?9*-H5*&y6Sd?CX zRfd`4_}pGpm+Hy)$|UIAQ1M9Rb7`31NLP~i0lRe~yQ9!zabL;VU2k8W*^`ni3YYqe z==JEbOhJ*V`A1Ebtpt2gQ`Ar>p&nu2))p* zIItU5G5y@~g9`jbty$LxEA}2_@zqCUwje-jO_DzFFLD$6TP@>Ch%}uM;RnS&ntn)k zGdo{}^Iu%ZJ6u%AJFwV>h=v-x0PNzPYDTWKQ1`~%;I7JWkNuGkVew_+8-b}P{nNF# zPp4!43nX@lE;7lYz%QQ%>W6!~dwc4E^tzj0wG ze|ib|6J+jva7l%DqVWxury(vnsN${c-z{u@9v)fE&%>TSiFy}d?_JpM;gd&2bko>r zZ;3$W9}Yb%NJHxOQ`m=1MK@{;W18bUt6?j3njZ6~_YQ9QxXXlkFN8DhlcA{({7BqbvEH;YrkV_gt2NS%@S54LPse1 z`3nF@K)1h(xsHEA8pU@(cle@8@7VRSk{BI{x1q#54EsJX9HU*N-(saOMIM}lBq!t^iWO5#qE8@{F{%e) zY3L6|!eGjHDX3Y2-%?SeL?2EqEBJl$+BSKa#hIDoW$x|u$b@V+V?!*~f~$bLde5kQ zW%(Q%S8-SS+TILYPeUY>EQ5`qz?;d&sO?EIH|E~7-#vCsj?Np-c%0dFzPQE9x;~y3QqWlH>Ptyvx8gH? z^S^&vQXynrL^Nxp+*@iv+Oi%D`__{$y3NQjZwn`SH<`HuPm6Zph8G6<)(B4~(%oe4tuy$0=mI$)AuSD0 zh@^BQNJYa^l>G>hRC!1^yM{x5=w8a5032TjC0WrdNy|?tjK=iFJSt*rleT_Pf0Hp*xUJiX zv1%?%vB(IHDMMb1&FgR$4Wce>;YptTHsifC%qiXr6x_)lpsI=Nxkv{3BVx~iK(8EE zluCH!7V9exV+HLH8PSa`a7-7C-0?yVXSZTQQS{pc8yNU=vAS3PO88rKBg688o9HjS zH=&>Op1F{zQCw^RSQ~dtneu0p z?6Gm?b&^Op6ekW{HlG4ub=vfVozDyWQIvEnY$NQes}Dr!!dHx(O0q?fW&IQZw)O)k zD9U^!Sj&uflkrq&#O=aUUHx;W70s3Pu|b1fU44LG78J~2ltm6TH4;ed&_4~b1Sx$Pij6LehfG_EpCdZnp_51ALq@MJ%+}C@o@7u5hYp>UHd`(ZJ zRw5O8cPFN3B#sAr1tT95W2IC?kyjJblCE%|#PD}N#$P6ieMqs2z$1*quDMN^{)(eO z$oos|^0;rXCpNuQ1j3pL4nvQDz9e!(a1cerZW2kk{6;!pFYijn%}h2CKMprWtmS4; z5t4M+$DBKEwPL}y6=5yrNR|fIg&g?HWaw3=_|Ahif=*twOKFU9r;NSL+ zRBK~YdKF_q(UDMBC1Le!Nx253d2Oj1gAJ4<)YDD^%Swmpl_lG5ZeERm3=!D__FG98O zc-AM_^};i~oR+NqXn-OnNV`Utbz4dJeCN@wih3ok;aCZ_BS{C(w?8g{(VHiER%S5` z(jwuEWpv}vR0l%YEwa~BO|TamtE3V<^3Xu=c9Sx9gHyPkcT*@vT3A!w?CQdPOKZw% z}7BdDix_DojoaOr4}L&G^>9h9aWW9ELDAEI2a zJGMr>QloBX-M7Lj(qMqtbQBOExb;VGydCF*EWS;r>%Dxs+&e_y?#jeOTWat--$?DMJ?jR_j_MOSJ;aX07g;j><2?emXIaij zG4jYtg!IQZ3Vv<*d+f#-ksREMWKtdD=3N5gxOQTkPRmi2N0&Tr#v6;~7(1$qX{C5N z2asxc4c~7lg>X*|C~6A)oC|*l45&=8J0)=k!j6I5rBv0-TtQ?0cMUHQ2`W>GpPoWj z{~aw9^;^dB(Hy50fp+wlp}909X-(lhnBEbS+{iC|8MD^>&ImO?lX9w>^i{XBcY53E z{qe%;{fSe(Kj=}t`=63EmFW-E%*S1o=w6046IuqwA{A*d0V$e{bJ z;!O?bPv_$NDVJ^8d0TegmYp{;ggR(h+4*}vfh9#x34sy#If~nW23sweJcc`0L` zup2J&P$9g$K7zpFugrWGhsh@k!{qx;n0$z{s6_@5V!5V3`4Hz$&*%i%}Q=gU20~j06W0r79+CSkjvnwWj&G=^9{0cF)`2-P`kK z43-6BeE#I^Q^&rs^LBiAbfnPdMG1}=zMlj#!cvq>&~)+ds$L`reL;7i$#w!u zFS@_$rBnE-eGUFV5;#G$n9m8>e1g~Z@vWMKtMm&(4C~w84e&)L1{TEf+nd+!{B(BK*~CD8vxg23TNcP`gMfH~28;ec3p)Sw zUsoSW|k(t>Fj0BTCNCTa?A-!&;4nm!+n#>Od@pdFB#nF1})wu%ziLIb1P&s&wV=W%>Dn zM%cEY96*Ipl^NTk< zPnTlTJ@OvoJ-knUIZIy1Y7;-b~kligh7BD&q**Jw#N4 z(YD}^Fn71|`SR*xj9fc~49!;ZdxJGX-W$ZfDfp1!&>SF8f2v*<2|s70bBLYp*MiUmfK_6+vpAZLQh{PBL81k-IR zX8E6g^KRRU*|uWV{e+)a06JkO$@ax3jZQHj{I{tK#aR1+;#Okd^F)46cJPT#9=XsN>h+RoV%kHCU;^@FyR<8 zg97J*YYsv_U$m;~f166y;X+)`;e98l*_WV386}Ea$eik$0-AjZXnt1P0PObD-}shy z8}RClND5G4@i%u+HrJ=ZhYF+*s~u?hhTjQ6~L*0p73w#f*Tqt=mh{AkF1BrKd^QOal>E7n90 zAtBKPMV9xx%V@%{E-)hG!RF94B~l=F;%7xsr=x56IkiSvUjZ&Fe-j=896D2|6ERVq z36UdRUBfAml;OCDbcKWidpP;0<7C=ENu$D58{MM$bRJH>^`gWLmsZyb`TJl0ZHZTp z{qtzx^=IWW%>94=>%Xt*;k7P(mk3y{KBkywKsXm6)@_C&USpvPAS=*cnk`EuZDQ6uP#jCDBdVKD9dy1WTYI{nY7a|k3idz`>X^5W91+Bay*rS@s zp#e-)GnG5-Gxgu4JVit%HrDUP=v3AQq1^q5<|MY>bS>VrUGS(g!Rgs!15T!*y(jFM zOLUKe-@0BFlpRm%2Q=zSc$2PMq|gNiyU;)fy6@B@c(1A1vQ$xtZJ~R2Z<{T{NTK+U zMJg|{eq=6E#EP?0h7af3lfjZMCSthyeTKCtJ?&%NnITm~!i-l9By`oZvHh!$Oe|=X z4rV;$UTcKGi?F}IO$f#Ly@@mn?Y880GOTb`q=L^P9QQLk-yIyjw^Pi<*kSLmGMArf zF!fv~%_hgqve4#2nljyogex*GW@eH&umpQnj(edf7hMWb+YJvcUSEwgSIT2_eYm5V zJk~miu?=UhJt--zOY@F}*Zs zYBdC_9I_&f68o8jI5a#04+%-Ro%(bC3VpOzT2u`MQH4rW?x`aOR5%_RlXr9ef?5PB zj8OhxO}j6HfZ6r{wmpDt4`3tD`?itcJaZfy>AJILGwzl0C&LfMs%9e`cPT>YR(fD9 z1)Th>`OfYz^&QXLHL7G7Sc>qisRWCHVTBS;I77f)Px1^-i!mzPPE~MRbM2dh4cP3; zSlcLT+^AIw!b)-}a*7eNEYTsPHfj<F5__`Wtf%Sq6@@W z=+&B%F5~349>vkiKLuZZ9G1SivQ>2+K$MP2AhZ8jmGO(vV#PE|Wk3wqFkyD7`-gLH zxNW_iiC>PqGWX#TAXM)l)HsLWoy9^geN}IvWg;GEZ|CLH=O|3@90^99?T+OmA{s6H zQ5g;*hF0yIoxOQlW6zqSrLf)aE8g!dtAsn&f<+NaYgTU%*Q_njn(QBJU4IjV19&F5 zav`sezMfZDk;eB}X~?G3%x{~@K3J5> z9_>1*?4g3`Ge_u}GTB27%jesCiA*+P1>%tUfG$cC>|8Qd6hqESM3#~LXhK3gTH#;% zNlDPN>vBqP-$=Ip?R75P5RX??(^S`$heaycGnN{u{Yh__SpU)i8o2EULH}`-+S34A z2H0)VyG?q(zNEKp)Jkr;@L6#`x7z=F_UeZ&{r5G8x<9^o=}q7o5RT_q;0wY|4GARq zfKk{o$Rk#JL8qz|j2=hDBr77C_O3GT1QxE!!^^Ws(Z*oyHoF7gHnt~>i8ai~GF2z? zWi4&i6k;VIO+}(Q*OlauR#93gamUKT!Lq$uQ z_Z5+5?jMU>9o6(ZTZ3M^LANW(b4!ynuYqY36$=&BO<1cjCK1*wt7AzLnKJOtimDs6 zvOGU6ql+lN`dH9`FjFH^{9F9de;+=bBNccy=WKKMbk;Id|F!bz9H^?!2(P5T*XZSG zOMg$;`-ihKEY|n*|99h79O(OfyEyIRkmsCbBM)>`bU~R=zJzaq22u?X2MC$F3 zYSE{2zq^M`=fXpP@agrEvy@4}+n*Vf?s=yq6VkVFk|NtzhNB=V!SN8F5fK4kwU7%( z1$;DL&ojnV@9JHm8yRZB&(!y_0Ji~7uzl+o1r4f^l!_(jH|CxdBX!39C5fbsCPiq8}o%bRHL^qX8TQHPalqQ(K|2@%Hc+IJ_8(D%P_8rK9|r z3BE{NO%Y_sp@tpJSO~oohfcRbF9&NCmy9jL6V3=%GHHCxTxt7Sxbx|Z)NXjn(!he% z!L90*eLhxI0H6*J;mlJ?mDYGCuexG4GxHf~E4<#%_EWdcZwU_|d_C8Q5H$tu3%UM| zY_7lKdwcb;{Z9D);LZ)FOA9FfaIdLNh~Y|Y`&gn$<+N0Cu!^h3UAww8k_9o)#DDdB zR0sft2&%Fpts9pTzpDq2ZIyU7@z_UePxmh%CwSv zIaWE1rl6=1LhPP}U5nPjd4$TLU_A(?(A?!qMb38=7XAc|n*`IGacCVav<9i7eBqCP z*^eOV;%wI1_T44}hjD|p3ncMcmDFr*mIbZgu8d8CeM3fY4#tKBkpa!daKEJ?bz#8Is@r!MP=s6WuMYk+B0Vq%jHYmY+VJK zo$tdjN(+SniYMh^S#(sDP46)gsh*hCmI(Ih_dWv#yWZ>PKOm?u%<;S`sH990SuQ=a zR(uQWB)m8b43#eymt)4%B8>$yUtInE={*IK1-9O(LfDG$s>W9*T|Vzwm`c;D70cXL z6TQ(Ttt*@WvsNsiDj#dHizt^A2?q~V$r<9k+SwDBI=i}v3M6?m-%aB##e^~myH?}D zZ5V3?cYW%bsZ<^DUdZrgTH~lTtp)3C@RzwmMbF$?AaZbFG@$qsNz*>SO8*BqwITOI z;4kd30I3dVSQ1XTTqm8;XRv1aP$spg{B*K^5H7* zjj#ISu2^~S|9$XCx1yf!u0`c8{`6l3@|JS7o+jz$av#0hR=Bqn?rnv8GYbf9Wx5uS# zZo>q~bi)7fK0;bKVn)6wFl^w^u5AT?%`WP;jb;9YqhmysSIYzyNee+f(dgrcHpfc_i$cZl>*`u0|4e)FaV>lcjPYH6Pz%@eLI1fYcVgiLX9lZ6WqXem?9n zfjS$#NNA{d?2q?;UYbVdB~BY8Qw12?oJP#1n_s)Qqved{85bg{&?eGlYROsTff>f3 zMG0_=y3XRF(K2Ofs&-8LqIj3(!BTfwSAE*y25bb-{Ai%m-I@RbA@OCYxzl7q86F!# z0Z?^VX?MXBMgz@bXxO}yP$rC&`v~V&MYkLJ^EdQKt2XqKkaL7;F_^m*TgZ$QK!o45 zm>g6DHlr59cwp#CnA+CQaSNyy@$k} zI|}oWpPomm9m=gaJ1-5w6o(fzt}HC*XClD}k(r9ulBi(+(h6FDp8Fo zAKn`Ex{SJAJ*&6=XpG7$qQc_Ecoe&Bss?DxO~ByDdOH?5(HVGFbKpD3Sb|<-?5Jvo zHkhb7WYPZfdE?EqW$ml^#pRf(@2@W~JM17P-N){z=(suLAe&bxz9nS(cp;13u{$(; z&^t#IWy9$3`Z3f8jNoh-9{vKLYI|__I&@uXV-E2E4-LgPE$1BIAZFachG0zq6olNc z#5-8kyJX=EGq&a106~{rAn1juY1-6p1y6i#ivPeylQUw6@m;ID53yNBZ z2ilEfSb{KJ9Qr}Y3w-V|KibaQdN*278yxv!Y4)LQCSKJa!esdc zg|9REwvrN~5}t4`g|4D9h!6k1_~U(8O2C6PEaF{=BO1+7EL2Uq+M54Y(gJ#nk|YLL zR>mC%b!RDMGIT->08N&pXjg5OQhW(p511uu0Zb8ctR8^4dT7hTh5`r1)y1)e?1J2zQ^6?1=LOchk?PW|;Eh z74xP3zYpGF69Dw)9C)k#fQM`NfDMX>U+x1Qtzjyl0WP@~&v>!wk&xpRGdsd+G%^CL zWi`afDS9@JD7F(4{D|8LiCaF;c0!^x^}Mzz>aLyxhzWWsKhyH%M()k#QeO*&bj z>7i8f_dL9T>SxPLceA_1ZBx))4(gLRgN9Z+y22DF@g|@mmjryqMYffq^OiWqjy&EW&h zku+TcfVqAET4G|~+BC*96bnt9@=}?_VTy2B{Jp6@nV*W1BxLa8u*~5;gt*0&oE!#m z2Rr1v;03DHzZox6pqGgjug={nW5|T(bXA1l)e>sQhb;)mU)gZMk z73zvV?q*Y=-m*Q`2z*+x0Vv>8z1y*F=+l-Ub_;*{^6~r@{ zaINszIit5+C@5ppF;>isDlc`1(LBII>PCE@aLu7Dr(jm-T>3y?C#@X z%K#ZaE5=VWt{6MrSp{XTEVatID_NY?7}tk+Bw1kTD@i<&IjLU5(j5>YDv?&1=?0@9 z*R`g_;>KgwP?#?Bfhy0yodYcbxewP$l%}+9c0xF`_r}0kWR<^ zmngYNbm>~m1Ah5DP(R$;-8)pzrr$MxzufE-oaVT&XS(dPgVp)zL~FdZ{rUe9dz`-a zSQ7cSVeBcEN`&3Vo|gXgcHX{v`?~cX=%JsM-eWUS)<(xMwY%D?%T<2Z znsgC!ZMC1S7x*KeLqAMysv@LRfQqw#>Fv-Z1l-n6sa^l+Z-^indq4Bc3bVv`KTOBS z5z5=(?dcC42sX0<>Af{4=Csc4jy40*lXWRh~IMS1hBGQEF$67HIYribVaZPaC zj)_NR;F9uqI&G(5ug&{|i)`d%`8)Hd*k2|F2OEmsHZl}>lC9|Uq4Wy`JSbgj8o0or zDz89-uhdbFy%Xfa(%!D?4Wr8lX~Ec7HIStMv$nu0fqX;?NWoH702xxo_4}pWQrVdl z;WWs4IXI^#dMEKf-w`JPuT{NVS@ zw0%{4xcLp(ZkS#oI)>AVG#dHQT=SXH$phA-{VGz=$smz}+2Ja^e*Ob)tZCPVIgy?_ z!i*5k_~Y3_*hMk^^@pdAkfP7D@nnAF5@!d^)Z_9#Qv=Ee{CvdI%0J+WiT~sSHgt}^+(%qJ0UdtCqc(lS z)l<+N-HK!Hi!!vGtcS1eZeWTrp_J9Q$ij^uB3VT?=egi2s zWVo^LP|uw5kax)myTTdGOOvI=$T@puR6Pza4dl=ChuYtF-0YTmLs-)a?htAN_WeN| zrh$c{m68;gL5wwp|Y?k1fqlGU|RO~M1}2m3v^t9dQu!hTZfiYT)9C~_Xv5B15ddVYd+j*=i$$nrk&ixE{X z()s<%XH@7VG#_$G$mc8~_4%b4inU_mTA3AazY>mM?B3xs;7zJoDtA}^k%whCh`gOgXRqJ<@T^18v+0mfopXD9tliez1s6Q6yK8D` z+|1(X<$RXx?~-FRN6HTM->IbN9p2W%nrk=Bc7X*S-Y~i*|LIsHnUgbe zt?c@<;%=oBiGjh@@8dkY-Y`Aq;nkyhn%iw}*FzQ6*zekXny3iPOAdD7Hpr^D5flcS zZu;#46Mkn?P0mGd%h>;pZslqw0f=m)q~l$EKy#7l1I|JHSs%fv$QVY-QxHb@qQ$d8 zDdc8DSC3jo`1H_j(%uA+t?Lj`9HoOOQ3fgCi7hbYCPn?04CSd^58rXSRw&{+0jt2( z_&I@_absGGoM+}J!=^e9c(#zsVR%ydDMyHSPNu9@X!CZt!%JGN zldgub8Ixlh%28*Yo%ypD++vf)M{kLnM`Zjr_U|0r{QX^YJe| zLc9`>F9MD_nh{DPUG2}Z4IZw4?Hp9=9YDu~b{2i#KfHSWnkmb)`6wTFP4&nc*T8{3 zhoyowIq!L|&))ukcRBn1jOvtzj=6TZKOhCi(mkuFS}yk%tKSHlI9V-hVva?w;?lf1 zb2F7l`qJyV+Z;n*#ibi}#VRg5H^Zs!p}Uf!Mf1l<_X4L=bJ-g=FITCMhrzQ1>O~em z(zzIS-sUPMVxg2~N5CnO>bKAS(oZu~qlT~bBFC%ageQF`S~?qhmN-qXt2ZfY zw}rX+e&FytJ^P0<1?5F;891qo>^eU+8V_+bvho|_sO7r+p+qQV|L=eOca}Nvi^4A) zvdBR6SCpm8W)(gXJCY0fD5QF)lXkty|3+ zG}`rwX%UH3G`8a>OCuo}`>u6_>7BSQ8hDYpN;3<58==`o06k636jjbTF(xdlLO0gzuC0P?tH0LZu3RNW{7 ztp!n-zP+CIlW5?by^G4hC=9%}@S@2m1E=;wSiZ~h*xSL3uTv{HNK5J_eF%#`Y&(-HzcgccP3MX+9TI2bU6|hc`o{7ZTBR-lqo@;c@C|CHlsEAfjNsPdh!GZ@CR-Pi}tcF8Y_s z!kKc#p#^9~G7dpse=0RCQuA%+IKVBtv-efb+}xerx4N_U{oTC>dnfn%M~C6j;b6EI z_ID3=`-A&?!~I|w?1ue*|8Re>rta*Ci-TX#oh|OJH|spowH!VkDaRAnG^{b685E0= zI<|;n8(xbBp|S>NLL3=Ld?DPIW@^A`2v7l=N&3#C!k=-SI<_^)?fvIaX@qIzbC{lP zT|7zkpSunB_bc=>R3U7I3mT04BthCjFU_jF5?{*wsE&I6t+XHbYceWSfj>w0fTzIx ziV28;nFf>QL(i3*9qS}G(oc19rK%Q`FkQFed$hJ=E51Wr6-Ux9-Q=l#GivC~QP#@C z5wcRDvM?oBGm$6edHBTFc)6~w6U;E(x(t)rd+(y}a*ZpLum`0@sXeB}qnW48c7IK= zi>MxBe+!F5s6fgpBK5c9+#pj^J7#K9OtgAU-erk!%%#@*Qs(@##Wp-%rg^nSi$;oC z{!&sLYG}ne@dT)l@{U`$_4{E$YUE?4!CzCxg%jblDpT`Dq9J- zZFBJpmQJ?K#r2iRPFmJnye3%eLtvO{5ghZ2db=R?;EH7gm+=)ty`jCwn(HidYP=Nj zRa2$S={RimoJqs6_C>Amk(>5Qy^S6~Mx1Wi?z|RAjDerVE zMMH6ySSbjVM+Da>9v4#q7D>Y^$dRE^m3Yq z-s$76_bM(Sd4G+)jOXy?GAd_W0C<*V=WtD`dC~|p=K4rYE$0Gnqo=SKXf|E%?K|W& z%Dd`~bdjGz*vzH5NO|=!W>ux=99}`Z$aDps4r88V9Pvv1nU_Xo z$ReHrdxt3L!p9840S@XXa>@)MMrv|eRg-H0C&MlvXG|nXT)2y-T>#{1S06%F4Gp3g ziJv_`aX7|HdLHbqtFbmER79TrvxOiOuvWIk8hUTf7Lbuf9W_$9&T6xjTeXjcvM}2OcbnjD6WonVE$+80!BtF+ z4WW|jQ%Pq54rv6L5@s(F^aobjV_(iUM)Rd%+H?t|VH{9X5IruQBo=^`J0bSjT{5EA zM78Dxn80*u0gQ^EQW9c}QQ3hwWEP3aohgDvcJro30o6XxYO^u}Q*OR>jMJuZ<)m8drwQ=Aa{vj9)_f)pRs8c+kgjhWVFqq6R|EYYvy z6zo7mq0nQDxqpq2BZ);v80c>H(w~2ND@ga#?_XM%0Hf3a4-x8JeT4iYh0x^Fd*N*w z!P&@E5PG**)Dn0*FvLp}3v*?F9)t89bv?|>!vIBKHio`w(=EAOAlZuLF%ht?B=ylN zqS6d`%~T8Anpp`&FGpvHsOX9-trJa)h2pGiocoXy&r-}Xy`4NnA)ZbZlxRowVCw@u zjJ77aZWC=61XhPWK2GA2RW($uBj{~{yXL`V-$bNTtaDn{34nqWW5{+1zc z5nRB;R!%Sixg))X-iV=vP2>|G3JdlLa`g&x1vb#l;F5X}<;}}*Ch<|d;^Dn|{`gS? z&=;P7050D1$KG2U%&^ZS=eu1c!s6eSc(p%R1`+f3zyA9YuU;Q?Y^hH;Uf(CYGXaFOpjYHuBC+{|;9|J3ot-X)O1%jk zpWqkgem>vXP)JujCaKhg4~0lQD{3@{ubru&!$5y06yf;X73Ds2*Ny`q5(!H14ajaF za5}4^Q{j`91q<6HA=Fl5+gT@l#8rnXOwQ_-s zlG1^=Vo~WM^*~E$7&k(qRxH2eQqy=n?{RcaIhyVwAv7$+ennAT6ALuerWIPTBv*yJ z2bSm*yf-e+z%QdLMZzraWi$*2vjN=XdvJ~C5TmE%hAh|dS`F&y>Hpb~byzVa*{h#U zVHMtnMTtFG+C<*rz1=_Q9}Tm-Vo4jaP%Flu@MRM4Nh4WmFVE}&)vU6P48w}Ls*P~2dt3qo>~k@O--mpc2<;)Hn0z3Gchtm)tb20x zdwKP77FK^Ly$Pwx^0&$@Kz^h!t**QO$9rOJ$4NKu>SIxQ0aj*b)sIpcu)?Jl(77Ta zVK&ix#aa9DXL;4@Z5=V7*s+A~0Ri+(1B7Mpu2=e_G2){c03aPpJ=TdI_wss-T5CQe z0rg`3b_C9Vd&hKOW7?R=twDX-6ajx1Q5jmQI=t;v87}p`>8JPk@*}sm;fJ?J{S?B~ zSR`_#&CZzzcoakm^NOS)@zsagewjzTeTki$VL}ilrXa}zo;0U{THKa|F1|$#xbeJS zYqjJvt4XUXZOgH#ptRQroUe99R9b3Pzuce#)F<``_*1p{2t=%w zmQhmr((+QC-ZyN5?x}K%jrAG1%bZvL6!yKRIT$TU53A!H+~!g@yqlrxX);acbM~~# z&|YAa#zdIJtrEkwv?%(N;c>KrxD7mv$6;!j*9@Ep?Z|+d-g%^m!>#N1n_yvPEk6BC zFUDK*A=+nYhQ1vM>&iI|xaNFtp*YS1Cm+1GSIr1}K^DVP_-RQ~1JkvPL&1HkDWdn- zz3*LxI&a~oc8m_O7N%O*IHi;Uzk~_wgjjKt)0{{Wc5xnPtXV{Sx&{QX7kQZC=$@ue zqbM(dfF6S+3ndzR@KujvZ2R&Ukd;DMS%5wu5n@VJ^pJ48l!f5FBsNTaj4;L}l<|9F zeK9)|1#@#7CL_&8kNzEGd?=Xcm@d8 zIk$7EyW^F4Y_jV_(TLI)Sxhgz9h|@nhtovyi{d|%uqZm}Q;#iHFk1(s2r1L<%F=o0 z1!Ii(FT(0t^UN>?%oO7yJm&+f6>op_#gT!{^Q(3~IP;APA1*F@7iKu>g%yF1Y+X=f zV-|Bez50L{ytA`c9rx3*#5cUtR0g~tTtrb=ij{B4#3(ud16JOVT+`&zi6tk>XT3GH zU&TwzAdU{g#sOK^i{pzNuUz1iCWF5CwGgjb52!QV%^{fBWGFOlf_BZFJQORSG3^kn zMGqQZeemG8D3NuO_5ns1I}-@`k}y%Ri*L#0F_hny$?cl`Ayde*OR!8=a3NBPvVkUS zlYlSvajMx!Qc-PF0j_Dviv!;cVn*3?!)@1?$wQf))8srlc?jdo${*0M!D_EQPyi|n zD0a6>dN+E8pG0#_zlEY^J&uo@0Aj^VmV&eVsWS_Hjjv|9T74Y+@qQ{r5ii9jOyFl( z9$;FgN2qXIU*Zy?*lavQzFv3!&ASD_+Xp8Ls}uK~>coDp#O_+HYu!6HRl+qDDE1*g zf?L-**>ek&YphY&v;<ojlvQNd>yv_Qy zS>HD6`+Bmz{g!2YKic&~I@~KR(4q6QV@_52#C8pN#lAm?vB!j0MqEveLAhvJk(b?-aKRoMHxb#^zBGGIE z%$>Qnf4@;JYjfBxH{JZ(NejTPx=to&#RXVP*qNW{2Vh4@2b;E}_K9UJe6fu&wZaYM zvvv7b=nQMGq_(CmH+)TAdU1|_e_@XQz{&9sRCZ5A%bqIUuPLoRPzn7%Qmf!p?siw1 zyxhFfr>LU8#g5MXVuEH{ghhcfm!s%c2w>qe6JwQBq~x_Vz~z{DGLXBas{Rf3R`?|b zzZRh)Iar9E8QDFHG(`KJtd!eSVd$FE)Sd$~uu;nktbJQD*p>{oC4&u(3l3UVGI(R- zm#W~KMn9!6Npm9vsyuFkX+|9|U3q05w^VB>;CSp6SN+xpw(_Bt|??aR3Yn`b+0=PSe>4! zD1=rCSg~qVL=M#%Rjz7vFb!$tN||?d_R1ljC0M0(l^KzxL3o=$giEAu*S*87<3@=P zoi7%lbU}>~O-?r4h(D}9Df}^~jWphsVSf#AovO9w^X_G+1#!gE-S|lm?fEf{QM!Ys zU`&VDW#L`03RrBpEBf{ZBj{e^iRi;7Ji6*QA&q?1RzS)SxQJcNuNy0)@fnyZ#9Ro0 zHkerK_2c?zbqV?+2&fue$6U4I1#$t!RhY0=xQ$YGBbCv_Dg+CxK{YANcVC$uWDS1LY`aI0k2J_1O_1ZWwn# zK;I8@gd(1Pk=bsOz-Qo{iMJj+{fuh&bZ4EvK4gPWw)BT%<{tQ1u&~VULqD*EoM`&f8i5w4t zTHl)vru8#LB?}(%CGf~OiV@-QLXi%h+4L}qjG@YF@U6Ab_-Sb!`5h#Xgn{9-gww^T z(`$8UIP9Vk&BOS9i6}mrYI2*S?y*Ij<<-dl%M$U2QSS7O5K-MHnW+oh>uAMTslm2T+~g7{`mZ|^u`1lrf4pbs zAOcTl+eBi`4x#EoD7>|?*D{{_RrZkDZK&<)^nYj1h}8R+!tpCK!Z;s_c9RHKx-R*+ zI;Mp{OJYsAKbGca>g|BN4s#;(7}6N)*jJ7=2Um*8J2+>=Oet|Kb#Y8UNC%LTWAy1f z%<}!yQ?Pu6oPiV$96Ti$#9^cwuvwZ{iIb(#b?w%GXToX9khUOda(z98t9I{{c7X!w z!YmeypN9kd*$~4P@ZzKg=!GcQr>aC~vFBJY$$k5wKvh!?OcC?PrS5_r$x3L|y z%GfjjORAd#6?Au*=n9zt`fiLtK8;){8KbMNN(^CDALpV-Sg;bofpJt|`E=7TP`9ho zQzd>uoqo?!{Ou2q{iBn^;r-yj$$rq^^H28r;ovaXJwDj;cZdGre&F|q{WaC?k5t|M zg~DdMFxU)8uwDot^ufM+P^-;^J*H3zrtSEiY53rera(QrpEcMbUggkgg zbt$2Cm8}aklETCQDpe1BhlW$JD2i+mA9l5p0`?f0^oNAY!$BA;t#iIQxJuTtkA=v> zDFA5NC{0mSDRlYc8w_4=$^_PCCsju+E6Tp8rbJzDhX+6~f>Ux_>hFR^i!@V zbreE>P7z7+eFRsqxhqlMYTCt2ESk9OYf8G>ZK3S|en5f0s>W7k1T!pt=HMcghcrr) zjDVViIk6ftRK>+6jdAu~Tx64#hjH^X3tc&a)N2rNjbVfR=YntdMkRs0g(ZOl2fBCM z(Mf#g<}8Z#KmGCKTko`hS6-*Qv$|AvhaUjl3!YdHMaa41<>9EWD8@<|s2p?m zXPdq*{qt@5x=ml(8z3FGEPbt=CvXrT)7*U3ZeI=F#!+<&0lZq)0Om4WbJtKBUxap< z8C84h83XnKITz3mVx}VKL1tkS`Q6P>&;qgA9Pq|wrwhj|OK5+tjFKBzn*zsI#@Dly z>Ms;;F_WBWUbw;ix6bnV3;m~_@;xYXlO{^f|y}m>@G6VY zoiCMBPLcCZQ|bh&o2f_ayB=hLVF{NO6sa}%dO=%eIxhUgn`B8;MmPltSBHy07(Q(p zl8rg;S8(h&$9G{+j^aLq_$wpP;=w^3?jm*@*UgXc=|GFl^qyt#E z(9k2(30y_7z%~3CF%-yDK4bhPk|UH04z!@Mssalt-xrg&F7-&H(&f;>k`4|wrwq8s zGhFvuC*87kWAzcCJJ&>aM&a1YV$_Afzs-CI5;~t{xY)(D@`A3?u*0q5 zrD2f@bS9ALD)dYq!lNSI_UaPB_LPfN$D0 z^={5ZSc&v+B8TZ4%B%`v(qyq0p-N;in0L+9+c}r{OB`a4DulG~uww|;pT8DJC+~ql zH1aQL3v@Q{c(@+6({4L&``}{DjO*6_Z9PKiy79?H$mfD}9yk|e!Dq@n5#~78*zMYm zRr7(ZqI8hdjb*TvBc zxAmUkZ7a2-xB9ksRW|zcH`-dfpPKd&5jmtK58Ass)iAnQ6fAtYbe*asHW?=kroc?;X0^67ltjN;a>FuP zbCs>5tL0N-AyZ9ls~+g&Y=(ubR(1*ex}3QJvfQW~X)2FWY?u7-x&pg?K)Y2?6{_$kAohMarTVI`aD?SlI4#B zj|&fD@3C=}*JBOWjp3{E`#IFIR6rj`u%yUIMQ0HH3JZl`h$&LA%DeZ+3g zu4t4o^OAsKG+rSH6C>*?Eac(M5Hj2P$F}~lt$%zy^^dkmO*zfU*?gF6Rf-zl9u?vq z?Xy>f0B}?b(pgk4;AemKFZ{CsDz0+ZTwN3S%UmqAqa0$hzG^NP6H5@2Mj53G7|B~^ z$D5s0woQ!c=Q*J%17DG#7gI4cBPRAlQrC3O*TMpXl7u%3X&=|#>h1*y2TYbJBWv(W zi)S11gkf(0rtCvX5D4Ksh1B$H!h#=~-ADRC9Xou601(sQnI#;f?umF;QF7z>qe&n> zB`~nafitN6!U>jePn~1n0-5)~w^dYX(KZJ8knx6j3fat%c*JoYOQ!frMRlk`pxLGX zVm2EnaL}?U5R%qYS!EWQN>3NIokbDOjFmz^11YPAMh$VeC=z-^I%6F~BE@COMe4#T zo%FdUPjCTFz4aFA*l0COvKMaptAEvs8+d=S5$k!gs9MldHth2XwdcFAuRaZ=y?Fne zq;9E@Fjc?8j}!aWM=wJj%YY*@2`9KPIqD=avyOTf;R#$_TYL{C)%_^9UW)WkKD;;V z@gKHsv@CLI*E?LXX#PkWypI>B-wSzq_V%6h`>@BLzzX_cG%cnDeFurAB-dLw?Dqi1Po~j}_<-p~2c@WQ33P*G( zFD+KShKOllVU$P&S?ag&yqFN9Bq>U*7=&?svNTHwWNdoS z)Eb^oy}!v(^8Ugo`KXzUW-ZhaUnv=l3G;4Et+ID;*JL!O({hyM(Irt%R+nXk{4=Xu zq_r^iI16!m>KWWv-^}}6m6pcYlKWQT`jnMd}ue6tuYfq@f>dz@lAur(=Px2_y>fZaid;6?%3a8+kr;ohjlfwtz zE3{#6|K2VRL#6@c)>!@~td>RBO5hK=Y*$otr0|SotWk71#{SK`$u=6(iS<+`)yxLI zG?{XN$V5R9siDw8;z#3-`qVyG;H)xMH1u((6w*`%dRZ7Ve4!v?WVx8?g`g+;K?%5t zz?D2q^z3TxD~a40#!z@$zlcg(_7$61G;_hB$yvkd^9xbF94<3EXC}Km4M~yk&u6cG zAm2(xUwAuz{^>1&F3(QCe+ij@@b=2h?nXMk=|kvIDzYLr5_rm2&mTWhnxteUSQA2$ zOPUfs^FB zck$O!>V!MXneam0nFyqvJKvSVwaLhBBdoN|sjZFHE_~M9f#V{lPU*8*Dk2c9KvD&+ z8gHmfVUAGQwz#=1Zf=X4UrTZGLF?FS<_9pObVyz(7S6!_G?6n?%Y}56r`sw0@dTaU zc?Vpa5_6`j_=;}O3!-16(oei-d?`}S-=99BwvsEHV+Oc4po+Q4NT3I;BdB>eH;!{d zd_PIDcS%%~)}c!x$QYj|=a7__I_hdnkrbE+PvQ&P0NpeNjkqs|{5(v&eil0qDI!QT za#A7l2z0FLmHIdCbDEKVqT9i^lzOVp*Ry!>mXpx@w29dp5sfs3Mpo+yc(hpQakz@N@I6Bh`wpR$ikb{CBmOmHQiG=bYOd;z}uqgBA zpWa%8$$$RoOg%7D(YC^={Tff#=F_^Z_=LY5t?v^q^VApZIK_T_7q?B)!P+s|b(3dAFz&xsYLc?}1as+Ltnxu1~M2XtggzD{OM`jqa>Q zH4lhtO7en#rHXc?98ZOKVwlsCxRp|u)JpLkO8Q83Adm<@nNIl6u{|VW*Iv26?#zDJ zzlP)Q>OeqEwt*NBWXdQ4ai9=jzq24LO!v|;PiF0JIw5x{-q$$-*`Z&y#wy=o2ttxJ- zircEDG+ zN_fcwkJxOhU5w8{y7R1%=?5BSRA;19%ap=_H4_543x;JX=W0dhn)ZjS2whte$%ns9 zTCp62Q($A+POYxr%eAXk{np@7hzCi5OS-j~Tzj0-mRd*9sTF*)`B2mvga)mEo=akG zk5Nvk37FMulb5-aaht zCd1Spw2nXQJB7fiP|g++-pkFmI9)`nPwMUX(;y0A+jJ_%s&-a6w?(7RbLtVbqcR7d zrd02@QpV9@m=HQD2B^yJ(yQY1haj4$ zt${gw6E4;H=3a3Um8v?n6Crq`$Wj8bQ&aQmV;WM<)>0DsTgol(EhM4e-)o+5Sqr@U zYn^b>a|5>?-q_z=$MA*=#kQw6ykV9T)6oq_I#zca?~vMo+V3-^fNtjAlpFa2;mV6= zCM;{;ud*K4zgsx#b!5$YUF_}lGJjf*5FMOF!C);DBzwCq+)5zo zW-f#lXW!c~F!O*9Fdsr`UO6?-KsnXGkCDH&Bcuvm5MJbwLaU?!sszKo&F}{uVR!%{ z4Qg0T9r*?(V^hp0iYQD0-d*V-yB%aDmkL)!ttJ8!I`0y`nA6wKIeZVj9advDJyLvu z(O~BDaW+5tTuVQu3}d2nVW{IZ8L*`A7%P*A2}KqJ-XM};@6{wsA*p_prD-@Qy&c>E z9rJY*k@^Y*_Qti<+FiNG$;56Rf}CcgmI^k5Z6aZWD&bkiq*IM|=_(t5Fo>TS^jwkSHQ0ys<;Ub;+0e^`CdKmH)=$yOOFTm%@KZUfl|SvW8( z*Mye#_5yVMS+6DIL)Yaqz0-YbY*)Bl*p1hUk$|+CTxVji~C-i(EVe3y>qd zM)D-cf&}bBIUhfYT!|g=&hy}PhtP_-*SG?ivck_{$HE5ouaV=(<7 zB$|x+1sn!*LvNt_306&CAuCygT!5|BC3mPY8#P*Lsk12;)U<8ki6(glM|PGt7~9y- z$G#d{iaq9?U|xbi)LAa6$)DOv)JpP*s4o_EmRH9E2D|qALa*CR(^W+ z4`(j*0>v9HD%M(imRB#GxN9SGI`RT)m8Ud+3092M-&J+wad`PHM{1S{Rq8MX@Fx(MEWZ7&FA7aH!Tcfg^6o2~W8!D>bgB}0P{x^5hX1EoKuW@BoOs}O^W`gZgTABbN zx+KFks8gf<7mt?0vYX2@4A!7cIT%RXdOD@@4Wd$9t`CT;` z;O_uPB>1vZO<<#sUfG67+oQUul!J^ZIqdr}MWZ(;L9D_j z_z9B@ImaUvZD3t5rRA-r$nl`mb?2`3aaOcO$*$xZ@P7W7@V_o67kp}pT&+F*spj0R^Ag{Q(Q80z5cbz}m+se&kPx;3pJGhHaqgjC-Bxs9 z#gR_Zj2%)e%+Z@O0fVQIdz@*8s;*s6Q2m;G9PyD_MEI{kG-9Zv&{f^>8qqnqK9u=? zEb(fp|15R&|GTE=CS!@ZZuX9o$s)jFLT?qFtvHWAT6vOr>b5kb8tDhPL*JY^$%g)P zl2W8ZVC#DkHk|SFqiUan!;`F#{467U1aBq8WK2Wh%;HsN&SwqRo5P*4mZI9~m;6mQ zgujp6HMjB0Svu8q(Z*70GwBtX{(%8vm(L4MIJCS zQ?dfvyf3c_AylQMbx}9R4npYOUXM;(7b(=UC?3}`l#Ms$-ftzkcxG;V_r}_-1&h+f zrs3qV{k0mwu|CIo^jTQXw3=DR{-l^!Ro_nWZl`$Hi2B}6@vaNuj~=XzW4s1vZ%^zf zb}}y-mC+1I9fB#hGq7`nbqA6>{2emtd=Y(`1ueulLlIp2eb$Ju!(gDYQDP16%{A5)jHwYIwL=Dfx zUEmg!u(I~Yduaj}8CI8Og>Q|$FCK1TFp+alX8?y$M%po~t#q->K;0zIvLTKS5qO_g zJ^XEeYLx9DF5G$j;?a{%E0ziu=NAN84x=z%+v2oi&ax=|vK4tDDjtQQ{SKOW=ifmjWf{SaOH1*vQzV2rT??16l2{wj~ zb`&b#z|;MkcMC?|_7^M2oVaQHz9jG($Fr`qeP43qPk&Q)y2Cu(NvtdAy2gmJ$WQ}( znn-IMOtAE4nuZh3&qsWAns7kt0xLY86;^sXR(Ikd|J-{D=hsse$V%(a)=chn?YLLT z12f=}dMF}za>hy)r7oYLQPa>*5(A)mN%xTS*F!t7q2y0uIVvgtmpW>w zW7{FkIfqZ5*VVedl*?}_P4bs2-;N1X7nLfvrLJwMYg_8t%v8T^jCGGNVZ<(&-Fp?9 z1$L@B_Qaf82uA%RoCu=VYMebfd-HU@2nNF7XdF(Vg{k8-Pg}r>4={nOOy1Ht@75de zoD*d>U4C05x?nSNu?b4Og=Nk}>x!`-TX{)nST;5=0ciQ2Z&!J*GN^z7b3i1*$cu3* zb3{~D!%-R7Pu!c0#4U`Y-+IW0yn>BxRl%E32<&uPv4^9gXx|R@0`zoOA6b-|q&$)- zA`KC#=m_)aw-Mb{IIb-BOr|R_Ae91x(%Lk?s8C;RTLJ6w744#}tN4nvR_E6{l@zQ> z#lt8O0&;NcdOukVBs;|*n;5R99XiYfi0_v3wbgR0(c#N3;=F5_G2T*+e1D;q<^FxQ za&;h;E1rYwsk%!qFV&*l8x&XDn=|i^_tR8ZLUDdv3~t5X%j0!}FAM*%Pjer3FY<0;$GIvLTLYL`nD~IB9=5j{^#fPm;?k!Eaqibii&;n{sZA@m z6T*%hF+tk4Ppk;--H)r7TQdb{zDort$P&($x+0Y&AtsZALBb7FE z)TVgUv8Y_>AS|M0l|JiM;M#ZGxIxI5W48QMzq8iEUmDG@$5~N ztiM=Qe%fE#7H>yWoa!vCaAPe|&v7bOzaWGqO4?D@B`}z^8=zveeerG zZMC%Gwedc@UFFv&Qjjv8I%N(PqTlxGJ1jtqGqYUOX$lflRlj421ytyC2|=yt!t8Q@ zbb)mIi4ertApoXv0z5qg);J>uP20L7D?$~9DRr+!8kjD}X)9bxTlzvR@v!SWR6kdr zEM+hv*iBg%+DW-kjLnH{M7(-$+Air9+Q@G!vu5S`}x4{2$Wru zRACVRdcuq5p9TMF$gv%x|sT9DtzhlCJ?!+wJ%rxep*ib z#C!Yl%xD?hF=8gZ%!S%=<*qKY+M%pJ8CSmiw%HUAi zFgvv52mg%88Z~3pEC|pZwQFRZ`lX1@!H4`(CdDtJZh+rRD~?(f5wDzJ^ucOrG~YaZ z%Gw zbh9O*g;nVsHRkl&NDgZrWI%kR&E|0Ltch~rvNXT2DTwWAM>A=VvXccanyF|Cj9vS(^45pmu9_>0v zG%0-sA+=Osd*l6PyE@pXHLGH^Q&R2)GabV|z`pjPF~OI6Xi+cs8&qz_eq2Ojl#W5h z>@jO|6_K~M>mhY^3_I%OLBsp@loV1rcbsx9@#q2 za~}!f&}LbSMk&Y5b;qqZ2j8}a-+t%$7)f}dl1K-zbl8don)pTWF3Xn#{jP0|-l(CU zS0sY?S{}}Ol!qdLTgdWN>=CCka}-6gaSp8>*WGwu*RKATNu6E#C!_A=aKFO8CW$|* z&hjHL=F(5fazVH1E$N4ZjqR@nepzluaT{xF+FBT34#K>QhDgj6_WId0ZEBx&Y=gc@ zTu}L#S;_H7wU+6)p=@S=0 zIexVs@wE~73uLV&QG4CV@??&P=ug3*{lG7M_*GH6MAspE%~HIUQn*y{E3u-WOF?o! zjA7-%mf9i?mg)lWtSKO1rs~utOR(=eo%y*F)Nl9NYWLdxR_(P$VLI4(1)f>yxflL6 ziSkN9R`{f@f@x!d#K@@52L|hfghS(cZ&4e^Sr1xeS)7eT)j2jt%mXrd`&Y>O zef9AYoU>LtPMb6AR8(_BVzL<}Y&u)vqW;|03|EX@*=>~_KC?;MS)b7~O6g?pdXs4} zLX>!=iT_Vi2qCEAu%DtDlA=!?5{RvZ z-j#*64PI4|(PjaVv?2pRhw63YjSyaL4kBvv4XIs_D7&#LsevfB&L{J=EXpCVtF>C! zR;gG9kFS7Lzl@iK4y_A;FLlG4be?S*!TwZ~KTr?5k7q+lT7^js^4L5&Co@>}UV(nr+mo*K9F4Zd+FHN0xd^P^1>1B&Ft+wWR8*^8@V8DClzm)Hz;h0S*;?Sh^> zv>>!fjWD!8C+AlmuRf5T(7btTMXDp}QMOqv=0>pIhy}EM5)FE&dOXNylQN?j_!*Oc zEB0*Z|N#3^CaDQ9_u7|PS;W+kx?!@J_3u|G!yb5!^c6AQvIbs=ijEZ`FRy zt=NNYW0H?-u>`Gwa|6|a?Y>;?zHApH!rGU$Q4dm?t;l5PpUtor6em$hbGxMGeR@`% z*>G^lL9nP|cFwJEJ$?-y^(4*|spf zbxML(XL_9-{bkljnm|!IR?3aJ!9i!qbVBVxV~;M99{u-BQ>ASW{nh)pcHwHM%Yvwm zo*KAFvh!?O)*ym30O}MdT7;t+W;q=8^5{$5WnGo#mXIH`Xhr-OBQG+fRxHgR&x)dl z-Sa_~4yTB0Y{fe9RFqZY`wTvlM|28x)n2ybnp$y4@?-t)W$^^-Iwb{84LPuk+@>v2 ztOxccQodgop60mPCusPTYr)er z3e~95$J4XT0I)Qx2({uQZY7vSm&lPd)7v37H2N!{s*_Fwk(x6wL4z8Y=UtN4k+Kzb zHJa`$OIUZ{>O&S=A6)oSu(*D?#YQas^Kag5u@PHr#JZpGvuhK_EyG6C&o^i4x)ovO z(n1WIrx-hk`pcpBHt!=w!7t^~yyELq#+|jpw$-XEuQsx-rOAcFz(W!Pp#k{f?Deg2 z7oX7?XxH{@kD={QUHrRQA7VA(r=PK%l|&XkU-jintzmooS5+6m;qTu zKf`THkp~M)k%w+6@}!6MN5mTNoIM=>4a;b}wh6xz?-knn&Lh5I$NO2`vEfs%r8HR= z=B{(}687Nq%%ui!j0m@V>`w|G_V#GZNJYml*vbL@THElO9Sqzxo}nuz(nn!vcjq z2z;c6?9*f~1|4{N1cN)fhnbA=Vk*Y4hD(?f7LjhETSuP~F7@X04HFh4OVf;CIl|7; z>Dt#9A#WutzyM24TZ|tPp0MG06#KhI32gVyI`&SxMlN2so}0X@H7KFWnYd?|r5H8@ zVwE7!O<*%Aa`vvpsbv`3QMy=&+`ldw_ra8#SlQl#b>w1i%nj}; z@e&e~MAI7tD4{*{FB6~rBF7AWy7qa}>6rf#B^Sy6&)&NkAJw_$A9zVN%vf#Ja!*# zV@9sb`Vg6&4x}i9?m*soWR_&8C*2V&{GGj{8vZ4?>z1RdKUE?(5dg~|e=KqVC; zQUs?$^=$Nc=^t;uJ5_o@P8vEUs`q@!li+xHR&cajD}X^bJlcO8TnwaR3qD8UcbLO` zpXKo?C(06s=y(M~bg+H9A^J9WB1H~1#Yn7og}9oDeH%J#kC#7e$2*UmA-fplxU#&? zLYV{tw&gBTaz^DOz-%N|186Xd^%$@H?WK>`(c#`Lak3==$SGD3UHAEBe|BQP2j-M@ekyf4ZuFK8l~kz14D*%ws3A;qJQR%Q*grAVmfeLmZ&9%7&vM>yN9lq&3x6hB-HCNNJ|bx zaFBLk=FRi1x|C)MUNA4iix8G}76+)d!%@%D|jvxeRtz>+~*hFqRw>e0OsG!dvmQr+bUxs3|`jRLc+UcL$3~ z6Gz)FYHX(y=Ml?6T;3WewsR+-*iP`$UZU3a>q{ty_C6JLOh*hw|I@!ZJKMLt)4P;W zUMhZ?6S~M}C+YGaY_H~rs}A)!hF{FkznKqyusgo ziH4d3i>w}}mn6KbtC?so;M(bQ0i;h2i#3S7g|*h_Dm5}h(lMC5N> zlPUDhh4xHv&4gJ5uO18p-geN-CgT(-JYeVW?c^FBlHi*>U0`j!G~(q7@1d-$FMa%- z<=_H~1;ZlHbFATi_8N94g5Tlhkt;}GkMxaYs^5h&ReCpfB`x^FJL)sqEY)5|w^6%I z-uyb1us#nZt5YIC3(O)HB>f8yawUVOac~-RT=yja7X^kVFZmoUb%S3@t^@(4j8k|u z8Zt)9A=oAFjp{7Tkeeb5P{sZE-1%3U?ZK zip3gR2w}7g{-AzX>f(mOg^;Er>yQ6=XInl#I2Qfgz1_ob|MF6Zz3rpRu-8A{J-8Hm zhdaH4o$#Q)3O5}Bibq~Z5eHAxYk}x5G>Wq9k?!wE<3H))H zXpdTJ>5a)HFzzGMt!WGJ7AZ#`aK;@NM(~OvN;kl>+Kr7(2Ho!GFd}f33A(D$CH9S> zp~Yg7;?)Xnhk^BO09VG-SC1vLEWp1V$73W$9wZ_mhjs!{lDPSR%hxjtX;n8wHv?Nk z+x#skMqrqwT8&|ns3WHlj2*6qwC*wiGd(A4Qdg+!2?2wH!F68wq#43Q1nx!N-G=B6 zO~h!Z+YXB?Mdl#b$YXl%ZP&8|OB;sL*qXLI>;Rae%fXu#jJ;}d0)MOz%gNluWT|WH z#b-R4s+TzH;k04L=M_QDIyTp`;#XS7NclWtHIZ;#A2L1~w&@h+Y>J;Jy5q1rAJ9yhYA)hjV6JgHc(=V`; zIj2Rsyr-w9tTc&G!Yk_V^Dh{d^ zBsjQz$`vX1^$*$grfG4(=ij{FG%Z%{XVbK}^gH~69WCH+H>_##WldsC?O!$=<5h}6 zd0b+#Ukbg;QI_CVgelwL`xo7dpnD!1Z*O-Fj#Q9F8S!ea%|>0gQ%tcfCS8!Do5|Pc ztbF=8JqG`2D8r6B#xR0#E(a%LggrX=sYkExP_(w4Lj=dDa56O-QB2ZB?4(djd?MIk z#C%BNTwM=el+XNNtEPQ(jr)8WKJ%K@hdJw=Ta#&fZVt{b9btIv3ns~d)+uvDV8z18 z{@X7l28Yy**>;oP@W-cLV78%?UkMYG6GLAAe0CRep+GQ4a$9-L;2HWe zGld&Pzt%hqct_+LtNu&-1xkc*tdL@D?;0yc=~YDCspMsnM~-uC>|6tBA}B{R;y?Y< zV4_K_Y?~g=)y%tQ^>B8{3RSAJpgf<=)U<6jo7yplQ^7iss4&G+!w{QBiAv~G@29NK z=&MXVl@(}9;Yte@X^WB4-l{1Ha2Ot4R?Br>#cq8x-xj?4^)TLMNnCmE8m{fma$d7~ ze`aZJt26|MpH87&Cj&}3ifMVpeq=OPhE-rhJHniUPAoX~JCVdnjXolh^rU01WtFnd zfy9lg$?fx>x885wFKBH(I9gZ-IQH;Ek9Ipc_u@i{I(p{^_j6TMfZf1gG2HCYJA38( zO8+}WJhBku_V7B%NSg(zC-j3bCmXdrmKIw>LlMPdh$BRK#2!bglk(G zV+}BAYaE8}l2N4%tK`F*kJU7plO;;qCK==;i-ao>fgx2pc+q|H&5Ng}TlM8vT>~+h zXdl!;#S^|=m30nYqQ5srT0EHkn5T~YB?W~PsggUAGVkONa?AH-EETi~PFpI!bcE3D z*klc3+}%n=@v8VXwBJZ?W;RK@aO>J6yEe(LO|olUy{FwKC%cSGulAO@)!h0|wDMI- z%B}e3Be?e?2tuj)im`H*GMr}sdxfo6!y@SXmP3fGb#&*~JQm$;SPsaArnQ3{b{TY# zVauM70y8SV^a*C(eo1<66I?;e??XfU3R(_|d0Ps=f9o%G3a7ZpV1 zY)-VGOGb6=(2BQL^qQGIwyn#aCEPxJ!Z&7VkId(pssCCa2hGy}0)uPtmguQl{d|I- z39O@)lPwRfu_zOKGD)3NSF^(C!H67gL6^iU_owl9#D7LnmVRtKRH-=(9KKL8%vpJFUhgp zEGx@iR+^RKnoTYHk%w6n?0SGG*m6uzQ)fP7rc^I)rawk4O3|&_jCAbFh%$Fv3j~6C*ANvX3y^eL(JHBJSs?6?Q z@Z0~RFBzP8m%Oi(?#a_GTHWdM6Zqfmw&qJ!u;lSA0-Kp2Mm0`)lb{ltGn;i9*&_EQ zzj*i0H~Ga)ezCz@^IpU9i(Ex3qG`}eve+h2C|T&h%ATG+p?b~~^E{WZ@PXqAUS`lz z+woR4LE!%Q{N-u)|J(_#cOD&hT3ze2=`MI_>tS`xN+SNnR3>q&#k|IhmJA+uV$8LQm35qFEZW(pYRred59quuhF*h@!(Dt7Vdr?Ylk7N1;XP}yE z{cD~>+G|)2sf*h()kBni;1C07st!^V+w(E za92Gv#Og}uu7buj@E&IIrB>H0EK{llc1qYsI&j-}y3ndRhQWa%Iis5oIF%@Gye6*G zm!`n95=(6g>~P27I_MwmZtubW9fiko_psmF+d1qX9v)uq^>+`&_D%@rlE*umJ7MX$ zu>Ihoo<$wsV(!mgdVPxyv;LA`pg5!gm4-lr_d_cfCcBgv@wGnc& z$3(H@;tHz_0;AYjn=>-uFwm@m zC*}N~OC>Pt0FQ%~%Ee%2gu2t%y)tgKcl1^zbx2OwXF#N?E!(2f(4&_5WtI;`S}@TT zsljS`T7qdpd;!^E$vuM-JrFbh7hUBP9%m` za%(=Vm48d|?e0foQ5&2fUHb{ztkl2R&2Y22il#6V93mIqc@S|=U}WueeI_$Q9+>UB zpmIVhmXn|;;qd-|3jVNRiJ>g1`68OQJl41J-JXoSGqgXm^$>P+f}P*4bo=71O`0`e zjVHsxROaE%!c^w2kLEk*Xg|JV>OHGUT^|hZr9{aKAhYz=`kC5 zhDdMtmw9SREm0KhOcQf{Vty^f05hb-z|1W>c3Gh$l_Hm-9-q9#4Vrc(E=mhS6idI| zXz#E@$ zOfgzGezsbhC-N5I#=Cbf&bVS0DKybXgQ99|yp%T+nehXL4J1ks?3CNPS~oN#8IpUZ%Vzt@f` z{Qk~uJwfI6XIgJD0hP+s%PHF`OChe6=F8O0o2$IICi!&vK)#dtP?UJj`3ME@9Mrm_ zmg1flDL`BjA1ADAFzR5b!IOrgaWt_Z9}R`%Vyhbi51)U^?=?N*GHbeT2PEsT9gx ze@g3%AmxtW*M%4&^K(MAM$1)4mmAZtGinh5K?y&uaBzzy0jx)A5l15+&D(aii3rz?UyV{o&5` z-j2Q@^Q-x`U~d3mK%c+6w)yU070q`)%3jb#Y*kcFf(u!c*y{Rh9EI{*^UupHhvQ&h zabQ`K>M%K-c}*I$!&MBL2T!|W+hUUj=V-Zu^WBT{Zm_ez-I-aJ8v6Xl%YA-d&hi#x zP`4&mJL8@2jr~)YQ=higc;(w(IuJUAFukM+az5Rk8ZG-fbT_&HizQSe~TA z{%dDvXB9imOTGw7^z^@uMiKZWT(Qqm*DVjIe%;5KBm$p$q921R5)7j0P@>qUah34* z;I6=SWi`cXenM4K^Q$=WvnP?FQqpB{Px*+lj^H1$DyduC7P`xRrasHsc=rVe&;?-1 z%CJL-;Ct?b6xX@HLN0i8V}#SA@3!Q9efJNoLW`ctP9An;se)}^aAN$^s2#xeEE0{Y z_Ur&g#CozOjr{qS@|7Rn;h33~Fl+}UF@Q0&FrBGgSpkX~nMIiz%`DT?PXTUy_3s|R23bTF39X8u&HN^tBC^tV4YUY_~=XuK) z{TkaNA%LtkM=nVVDVCI2sM7luv#q69pZli%f%)U~EX7AHW1l&4el~Mk8 zR>2s%R#Fy6$(4KycLd(YruSo%gnih`=picewL(-wnG3UzV=CjyaLiKeGYL^_N2CZ! zWu`fELOPeKz0JZ|t7Xz-iMeb$2M7UNn>$B~8=x<|9`6hbU@;YbNF}xf>>U zt#UzyBtb*Eh*1f_)#5Yb%+EwOSY17hy)vPs0{tolNuv(rl)o0sFlC2wrNQIc$Lg$D6kR= zGpR417(?sLY4>~!KOQAmJX8#Im>gCSkq!T%5n|bu8NupoK-`$as$a}2`MM3%+6V;YODDFC13(T$eP#((&!@~gF2mq7iQu&a2m{ZstMK_2msd>o zqt4}egOvMXklmYk=q%()02-6FAw&14)=EVcBQ-wA3xsPzPvnmyxs2~hWq>5 z;qK96Ev~opJn3$5MyV&=ApBex+2G92FD}lzPWkiR@}{l>!4)Iw-PPDAO32~O1tliB zm7zJ+Aub@{Z6~%=a80g4m*yV!YU%HyN)@#%q)D zT31(Lw_zEtPybXQ6{!W7H4+S zi3(hDPH4$-oJdoRhjrk-{K@V(9ru0TFM`NQQfZWdXK0_8$0UMXT0cqcj&f93Dz+u& zN5L5rY`Y*Pg5J+8kxu#6Z+(pj;p5?*yrp;JM{fMcjUV|S{m7;XHS1U#TjkMv!-YvF zfhftYK&Z9;Vl?HBC%qCzZ4C$+8qg8KNybwVml!DLya&KFy4~k(JO;eSDUogsNmT$- zRqVO)F9i~=8#r)lD5CTdxdpb`*l$Gumrs@^ixzfvM;T~(a{hvu5$iydxa3l<%%l!5 zk?RzXYklF*`Mr)E;90Zuvt6r)4rQkoBj09diw=CNAs+PTqfcoV)@S{?`r`u zbVaxG#39v!zi7fB#1~LqL3bOp3YlDXis&kp;g%0OaHvH|W@QFntM3|4=jKK%0;dOy zIaZpZ)J0@S=Hz+O#)|U zacvWJ0r(&3vzRp-sk#KQAR&GY_lYsgr8Gm|pXMK8eVD)2;(c_>gF&;+B7zixLOV~l zm4UH8v+G8?N}DQ@k}Mu`Gp!M^B6m=chT@E(%*TD0`cmtpF|}?fV|dOWo1~;*a~q{4 z&Jej!sF}y4>=20#+WVg1y}J@nucJ863QDg9!)Pc}VLy~@XHn2G7!Gt#6v!y7IvZlU z2ea0&$XRsF?VnO`7Q6%pS1tNiAGi2ouvKk<(2_5R)oQHU`K1N@g`^Tk^GGFD((3zA zNhS954SjJ7{LxBCB|58o{FQ`_KOE(251)wRqw# zx#@R_W4mOQiZ`9ExGZ6gD)sd|`$_go9AP+H6ygZa4C^hdux=|@z-4i~n9JhWZH(RP z#B?(^AHmO;*5qtJK;<{oO90u-IM2zV>w}EIh24+q&bwopBoiL-aYo zvEuwO;V?~k&r;c0;)(Qg0)dMj=!+O6yl&Pu_IztL(U3g45^q%e_KWE>RXLtns*Dfd zIfDNfRfdD2$54QyINOlC`UicQ*o-LL*O(a-P)z}%W%#&cm1WHc3~n#6byKR#MgvYe zwtbJ4##Zeyll-NI(JGFS31`>l(}UD45DPo!kG;O=3n=|=B8`V9xxe`n%4^UWTR5JVu~*|@gq{*=pj^D6Wf&hfvk|eq=dzZxm3RJfyDv6Xt(t`?g2X_7$dp zdNR49v=1_)#9~y;n|T|szy>U^0Sl~SMsTljZPuQ%L^UJ3(rRre+ka{nS^1eB)FI)+CP1*MmfVBnGa)j(X2r{f?27nD4W zEd{n#xIr-z+u$WTfvce1g>O1iiaEn zTr0Q)LOQSp6SR;uvy)w3ZdHYTbku6JcDgc+bJ$23^^8OfzyJInRJbY?r@3arj5N1+ z!_%rY}?*W(-yy#awBvWNfN49+}EWR_ZqrJ0{sx5@Dqu(Td~yvqCXz zS}_SEGlc~vB;p^Ma(Px#UU`e>hpOqaAIj1Ce-{q^)x_m?=1ID+X9!XkZ9gWLvBHFlbQq_Ajv6mI74AVB}EdbP<2r* zd3!UFlnuS`%s2nVo*{Lm#G*H5I4Nhh6uqM7h8BvB)S$aH3Ux+4*gBmQdQle)?f651 znidsqV7v!KYxo?gpkt-wOx|lXTpYV&k;s~au8&gjl*{Yra@Cd!M-XHSui#T5aGY>^ zy2GVrz`xH*zxuxT@c-7@%Lc3J3bQ!4Rd#G{S;yF9Q#aYvO*VBso!X|g@cT}!*+yOQ zgbZ=V!z#4i;nPF)GA)qc?0}KWX6g76tWaE%cdA?q`)>@O=QRjKK8=4Jc#-JYa6eS( z+M1yHW%XzOhKT|>DP*E^0|Qxzk&19R*u435h~f3k$DqvMIq^}5osa@VgLyO!53}%5 z?5*Lw+bY?@?miOWqzH1gG#b{8%1z@uc;^=)YUZe&Y^@1+kBRG&Q|1NxDA^x&!Po7%Gg`~WxpSJm z?k#sd6BXCYq;5O?2FjULigk82eELPGIiRgR5o&I&Pbzrr?Yvp3;3u{+Qj2LQV}qCyk+g zK7QNS>lfH-b90G)R)GC0Y->kjQ!LG@GEC`z$MG=z=4qQdB9kP0pTMU<3x5u4C;mfj zk@s<%dKso<=qEO{p_Xygxbj~1OusOFVAG)C_*%pG$nGyiPJWBC4bY6?BoHANRcS$G zST+{FT#Ij3BNxhHl3f_XGIlh^LbjiGQ!WJO8L1?9g?VoHY^Xk++fikvQ%$v)~lHDd}RgCqXJD;P7T>@@M^-^`B3E- zYBBfIxa=dViu6##MKpwfyB^BXcCSyMjc694VNn^?T5!8k=yj{oTS%D?ZnZ2+O=!9{ z{>hgXix$$G9q;?aqP-54_B!Mic1($XRRyBG;2BjCpHSP|U-ac_bHgjB3Gu~E8X?72 z%ziG*EemdN+yxTO)5TDOGftg~rBko)N~a~(6DHyk?+)t3el8Br?lsdJt-F zc)nI?!nxf$U1Q}X33R`7V{gp;w&28-OtWbkIJ^RO>VR3eK24Mv1vdR>A)Y1Ou*Gdk z7GGn_-jpm>=$|!>E$*Ch=2Sb-1PVj&Ve*McI5TO$3S2=)P6w3Uy7`Fdc5s(m(o7t# zE49yO2^;U#GlPAPb$7-$G`J zYcWpBty{BTTzM{pn_D12W1NL!1I^$Y94ZtPIm%1`=o0Mct*cH%%GHnJhYYin`yy4% zibqyIq5EvlyRWwz?B%X`q}Mc3Jm0gGdJ>V&vtM(F1Nc>1z?@B`>Z@HqRbRi zs|Im_Yl$a*ZIR1q{a%$ux7D;|c73p~2_cdlhC3@s4o4aSopumSvxJ+TDC0m2y-C&% zv+(94mb0C;kJfa}T&h>h*`H8-zE4DAXy;gQua@;54#KqI6QIFG4bvNpktStiwGxgs z@~diQfk6C)$~+|t0g?`ix~eDcK%(J~PrrbfKLlG`oWNR04t0FsC$RQA=mMt%-BDRA zkG5b{nXLVQBt!VZDxcMLFMMA)t(*TO9rn6BY+I+1rd)#{xiXi^Vd57N5dLFUK3Zy9 z1CgU29&UN9o9GCmczU&UKv5ea3r~_@6F#PBiRhFHfxVlLSnCM#s4&tLRl2i6Vh6qg zWUG_%iD7k~Mrj|*ZYe$%OfiBo!Q9Y#?LW+F1^34OSs30-;!-N!aM0Rn3~{nnSm>}7 zCmCbI61wK3^~PLp_rpbU^LMqiwNlu zL4(_Vi3pt1o;(UeG5t4qCs=u+nkqr%qS}_Dp@1v-a-#~s&TUWbRrCg3Of;ovMZN@H z7`$Y(zyLYVbsvI+4yR9?s!;b%isF(tkW18M-rStR8q z6S&C)ehnXFlL=g*!@1wEOrYm*KDvq&;_6Xxo$6IksfPC=n`=^s!*IJMa&9_tPdx3!4C;3D{@%<>6+48fnTvh1jfNWAE95wpR@?3QbG&B_B2iNnR) zlhdcTvtn&$Ja1LgO+?xN+Xz0GAR$sP%1V(I;4>wvG-WdscEzKBd~G_~*WS*W1u1=^ zQjBgATh(8&+-fqA#Au{s!i*SzwV~E9OCyx9NUs90rBN28WwGTnqVS4&^FdVdm=^Ts z(=V=(N4NGC*zLxLF}Wwj4MZu&0GVIcWo29QO3MDDqej^g zI&P-#0&S^Ag@;h_CuG zrS+GCh4q)CIpQ2EAu)fb;vD<>hQ65j|9HvL6HNGzv)0IQTu2I%f@i2T@ojMG2~fa9 z3eG62Gz2>hUW-&*N&2h$S#{uUCkudP_RYNSju#l{-nK`FwBNzXSBELaZ)>4<(*)QL ze!$G!OS(j@nbc1tN9Cp}2(Y(`x%71f0jLH;6)4N?U&vJClg#DrbJ-ef>xWC6+1EOr zgry(KDODp={4|kmqX*TG1~`Xv$~P5-C^Upoa&-!eqB?_ViSVp`mMvOYD*vyeJundI zRaD<}Kt(Xs;bOWXhoY^C+v!l)HFZ6UcU+}iP_Ixx-3Kn!6!j*=6gX6xi&2pM<1nZ+J-F+||52*ix^d7R<^j$Fu1j~v4hCYh1*i=p;Ur1!}ldi7CL!=o( z2kvzKRke4hz!UQ=%4!)FR!c63fCBK$qBurn8rHJF;(vvvgIb;0*=wZ*sl3l*K42@6!9SdYZ5}fWM`QLIz!oQ9cibzk{-*6Vb; zb=vNFtE=(uJB|w3h+#gnq&G0CpZ*D!_S&$?Hf~r0sdZe2$k8@`r>b+QswzyLtMYi; zbEzKfxK7pmsHnh2T{r7%NvQnb@50#b?{pw=+aJt3%l92Jw?;I(jVrHYh8dF1=Wgr> zYAGd>4o{^yf;tGF(*% zC0iHE+psf3d;qFn(YeW2Hy_JONoR&1;Eg%ZQoc1w@TcoB*sx*dWOIXcBt-?}NcWbQ zQ5sK&st*Yrqw8@@>T?>88!4Mu9!clZZW$@`6!%kdiXZ7(5Q$oeOia!m>g7y&nXXAuA6z)a4Z-DkixI-Y`T}kx?};en z;XV>nfZs!_J7=B$^y7si2aXFgR+*_g9T{Pm0#S>YsCW^sk%&oO=$=1as52W!C@X>l zFRKq(A$!IR68q-yqA+IIN~5cO*G^Eab^B^IOpLcR-=;~`*l4V=iSo5B8SXbu^5>#5 z<7TH<9e)h7WYB??L`ng3VTS8#b^`i8x{YS&tB0EqF%8=mf6!*cjyI zkgw}Q3L6WJu$)u19h1IANjVixQAjgx2e#{~Mk`iP0%-Cw)|9o^E%B7xogpST8;GL- zGxbX9h;y^Qf?b=~T2rWIEGA6rg`Pxu(^elllP;~qxX4C`O1?3jF;yfz_Nj6Ati*hq zux1n1Y{Hrc6xKA2xBhuGMzQe(!B2-0zQ2NXDGMh`_l;+eNHiH~s3|BNc1eZo14rWB z+gI$OXZh6_iDO_pELmYJ#g0Osv7N3^z%{YDui0YslCJz5Lw}+ojdelBtaaDNe&Z=xhF>LxDD-?Jir=mZQ!I|vK5dn8Ad>B@he1fBs!*@fH%u2?M zn|*8DqOsp>mUuhUsFHSF5R*?`5>6CXBKK0?NC~4XbOBpc;E>tGIruq2O!@5~g$*M& zUcNKs#T35HMJ$GPMexLei|F4__Eepr?t5Pj$92r$2N1PP8A3&5IlO_j!1IgscDCh^ zB*A?4BzBOzHForO`ZSdgMys$rn4E;umsqSL_YrZU@Z2%Xb&aagM4=62>RkKT)~tr8 z=Y9$WXMyXsRVvRqYh4O(!HE8dDzj~~Q|O-cNrbRvG+f5#FgnRjSl)ANL~H<;x(3HQ z!7$CI=*AV%gmgrLP*l)CS(y!m5(Y=>F5ni{CW>BrTRv`-Ex&Y@JQtL~_yt5^xa3~Q zO=B%Elxa1chz^zp%Vd6TGhTx;}sEdqlD2{l`9S&V{CB)Nv}uLmAZC zy|dC#va@r_C5vx^H0u;)mdmXGqF`{w)+Y*B^Fl-8ge{DL5@Q?gRH>I1acn5b`U2eQ z41x)4S!G0w`S%M5VE-z^vnRYOqPH$#56iba1hk8faT^7y_!^tnL_)$M6|;ST>yl#m zQarEbk*O#5*qy^Zvl7OPhsr*4pl|4l*=HW_Eth@9Hnv|^AwZxO z>iMHf)I>L?OBRO3hU311b-%%hBXWEW=!du_cuEA^RD*|1t3zMIU(iPo{sZuBw^IvrD#XkhXlhIVB*5H zueTDzH~MSq+1dHqtsn!x^*WO8*JRk1ykJ*`tvX!Y@d!t!$Z{~e7w8zLvNVSIG`)&a zDT#geds)8E@^~#qac_HjxuZCTWoH?uzC{vlIZsf_*t3jN*QWQDabn|#arVRzpuwMO zVum}*HN!g8+d#xIXEEOoz=(p8fK%RLcxEG2ibcPf_uXFQJ1>ge*>|h22OZs=&>{YS zq3B%8&M<87c*$49aO*W)u{P4IkHz=r6Ikxw_Qsn}U`dp5)t+iX zZ*nVa5Mu$w#bI+s$k#yg8e)9`Q$Z!=R8tXa)Ha=jVV|62ubjm6)G$s@u~+Es);Tz` zMI-cuG?lJaH3WSa3nIr`EEU605-DN9h(7bk`h12aZp^giyL#nTh8MhkbqkaY6>FI|)_Y}QP#m{sHHa41B3vytN0_LBO zwhwlX}?+$?ZAHy!sGDqG5-I4c)7RNUk!fa;L*;4mE>!2w3$1)Mo{=Q z!ZlUt3+ElbvouPpD)gz-7tfR1wLELzp@o5vEjXe_*V34VwccBHqsQ>1xdKXgDh=FH zq0ClH7Fg1%rgojfa_?M>r5wO$BIl=zOTN?PRz<={Nq$*1g~?qi#H$-Oq()^oP~Tf4 z#%!j%0pm9kIdbGFx>eI$M|%T_p-^2p4v_UBm+eZ5adw+9lC<|QUGDZ$F4n=Ab7M4Z zwVWYHT@!vNW=8mLf!GbjnoLRcR){ByV7Hx8YGI480Vz^o4wXkk&P^0Y2{U4{jtHDX zBc3Zd?05^h9|w1GO{Iv(Q~8cuCG@{S-kzyW9Iyw5PryAiEU3e7*3HM84>upv{>?|m zK$wR$NC~TQ%>I|=`l;1CuAm05(XlBx(3n7+n&LmH=ZHI)6K?fUlE=8TPr$K-^WmjQ zvJoM)g=DSdxorVo)rjBvE6d8Pw_U%P1~}Pc^){zi!MU7iC}boPzWbTi-GU=Wntjc6 zPlu8lK4R*z91TP&sgH`fR*02NHL0K@aPuo1i zYrN(`<2XA1g1xi}66F}9Bxzif#qDO7<$ICK;7ODuSWbN{O7i0iEVDj&^Lk5VAi9xSY!VTH!N^~U7aTJ;kWiNN@#$1-%)!+4igGrxO|@!@P?s4Y`G{=aZTngS z^ImIwCz^M&@SX1#tdQ(aavvAV{n65``xGXa%un5H`pj}k!Z7Xuv+_V_bl4w3SG2Q% z0!j*C#H6PdW5qJd+Ja0h%hChLU}3V8mY)`#Uk%&mXQ9gv89yypSfJp2i1Z~;Z-Qaf z>Tcbsq4i%4PXxy|oH6AremtJ!W5p!{O9fpMyV!I+!tbN+(cPrN(#ILs zEOw=)&$u-x?U)TsWxtI6^*lZG2QbGtBSe;8Q=(oZ61=y4=mA`ic3sEI3fNLa2y*F> zGUZSyOu-7bsyg*ITqJc~ZTBno(Ivk=jY5@`lsa5skyuG7%0*tpsT7y0uAn zExbl8jG|-+J0aPK0)v5e4kS~>qZ%kRlS3WIR&_Zh?h6(HElx2N3!6qbhFA2H zCd5CAOECVFj%mS}B{G)wCqX|;FUJMJS}PRl!tjqK>tx_-o^5ZMmVxJLG$Kc{2Kn^{ z=d&6yPV6rt@Ykt7$bfcfWXipjlZbeBd$`Iid5NVti6rC`|MZKiS!=RNyz`qBl48YG z>*gfE04~aB$|nj0U4_9r&VKwH+ug2_kRA_;%x~g+=RfU(mplhzBTLf#Kb;UK7w%2+)$}>3C zkV~Qw!&7XXMYnRsXe%S@WtfnSU26pJ_s0y=VX#{sWZ-VVFI$-841OA4UBS7pw%T~X zGApA|FqH!&-Ny_re})Hw&ytL}PsY&&n?=gowpYUNkxxz@53ROSEHOX+m zv5FIlx*QeKNL6^ec3T(jikFG=XjI~By0l6I&XPv&z+pL{Wt$#Rn$p&N7ONb^VwHs| z<*<1)s9kNzRZbTK`~gI=!h%zM#$~G z=52v~777Pq>_WS)qCBLAFB~jtowmI)Mq7n$O@ocSqa+`OondiQCNOqMAWFQ*??3-X z0FP1x@c+>jSXEl0SB(_3v{bVm6XMw1Q`<+@Dl;rZM*9YCC;iA{pbbtCj;aLDcnNTx zj#(F{QL6S-V!#FCLYA+qP1$Kvc3RVDy=m&>zUleLa6nG5eS`xl^x72}g%f<(-V(Av z7OAtfR1Pl|rODhSnihSLD)%(99Y6>u^FyJ+q?uS17H14sCU`wIfKJ`F*4Slw?d`u= zC9ezIt4DeE*9n30aH|*P&}VVrq(>zxg=p`m2ev9dKsc&`$6PiSHG z8Yy$fsZpnKk}Gx*hu@c_E)Z9_P2M}Y#_2evIGKNM=82`T3kKLTW+o-(d;Bz)gS+5) z&9}8^ikiGj-4OA>8p4shjE6IRCb_0? z92FM3hGv)7em*z1!l!3ktP9v`9$-Eg#ZtL3IvqQmBHEsv0yIpH82$!}0c?(u0vppd zm0Z*_3^ox zYy)*>{+-PZxbzv*EQRquiEGjAV@e;(E3{?Yx+XG5r+!k6Ii@z$P!J||;V3>1kohwg z2`~Q>Q9g)|;clH$-!F;6~`v z(3;+^6!0MM(sJQJ%l!&2Hh;SPH-V$#AM>m0M+>X#$9{Ev-_m)*e%@gQ9!8dRU~lY? z^Bi$xt17tfTSnfezx@*YU(V%&)~UVzR?V0!x}85X+XAj?Nt;yVJyF&Z)(`d}ovyA5n0+HHy(zAJy$y9! zTw9^{wBNAe+Rfjx*k5nC6*ddOdvTOD`zX?(lQcvSj9vzNKv9n6E>=XGUAo=e7lREj z70d*{6kHlm4XxW-@bgI`IIy;W9O()N&|c6f#3ckIvlrA0_Z9`gDkqJ|rjkP#++$Qk zQOF_elv%EH8!FofM85+5p`-$wh9FGFsYjXHtVZGeWM*ScdE=raUoV?#VtX5KPo&|v zFPj&1uQ?EXzhTwECx~;>@kgqVVHQaiM-H2^I~y?rs;r%XfEpa7rV!>J2RJaa%5XZ{JTAjLwT37nLq`F5 zShT#5V`=buyfn>Z>@~NUAzc`*T3HmO$?akHi%=a{n<={dDcY>c=u6%> zNO&4|j$#YhG|3>rykPsnDq}SZ)vj)-wh=1I;eQBC>9J0Fq1o<>EG@=U!ic~QHo+~4 z*!r=vi9;l|X&ol1OqesB0$ux`H(5gMyAwYs0r9(kr>1$gI{^) zx-^~uf685o-o8(qh}2@sRUPJJPr;kRILKrOXAr54EWNJ%1Z!65^(A*`mts&v1*W;8 zGKz(nF?HDhn*^AXYi^rj3B>XuM3A?J7T*b5z@8@D6zn!Np5{PYkEdggnx>7|+TVV; z`4}^6E~X-*xvK$8`=Nke8*+qDn)YDKF;ocmo1DP=()O6+MF~9Aj<3~}Ux|p_L)DZ& z)Hn3yGLS0~;XXIDrE{I^hR-AfbN4B~Ce3>25LLq8(gZep<;k~RWmi`Ugb_SPW$M3ZcE{SKyneHD#3QSstp}^v z@4k*`s~tqbq2=UHm0DsIjEUso)53gBk;Em8R>H*;QskHscC|>gcD1*u!X5uPggy0Bgz%!DFfZL(D`WJg9OPCg5;-jGgag~_zF zedEJjqnfOkt71^UGc9CN-tm}}47jIO=L^cgv zi|t}sC@eM1D_T!HcCJmg>!u*Tl>6BfkO1x=E!C)LqwRUR!d5YdJd=ijPUFrm6+i@>bSmP!YkS-mf*yyVzj?{6mBcqh$ zmgYj`*}#J8UIy+t#2zp7RKa}Z$`<#m5tYPkNxhcxaiBn;X)@|}*| z4(+7c;aHV-u^T)iK}6+Qd<{3^Y9?;vsiKQ=^Lktj&;prUG#%j(e9oD`fI7!@SThl( zGF=s1&}2U+=xMlf2|R2B3%V7sEFPzdx(CZ=RAws)l}Nz=#v53)*WnmKhdDr_$fRdF zo76MhchF^hN*lZ0d>|g(1og*su%%-sjbAkS+*XgA`?0`(>)X)F=f%-O$$XIJyg?e3 zl7oR*OmQvB6)O)M2g}f9&M~kF2TAS_{W{&eL#quqpk9%Q-iM?l4HsZEJT)D%WT%Sb zkxh!;jW8(Cdy;deHn&99a39!F<>lUR4&hpFzKjezn;uOLVR4A*(NqkJzm0Po8J24f z<^5=ypFqfo^C1**U0^UK#B1lR=X+s&xOr}Xn?7}%Q4OZ7SaiIBIsSD#tB*%4TiPur8{h#1_RL`Xj*_O z^#R+M0oEwL+ib$dK>g+!wsLD@g#xzn*+MbAvRI$s-NmU(c);}-mHAUY08e-b=6zX! z!-fO!Sy4adqza+q^aw(@3tpipBa@x1G7B(!DANg4c*kSq2Ya2;Fu|@1SVI||x|uM` zo-oZqhtA<9!=>J)E<)+cnGmp<+Sj5f%nRynz+ZqdhCZs>5PWP_;*}d#vrv(*Oftc? zolyA0g~bW-hqdsZqde=&qR8^C+I)i%5Yha;T9&xCXvw^gc|RIRH0jBeX4bR$L$?`b zW00#d$YwFBJoghk9EihfCj#pV`A{Ay5_|9tFrFwd8>XqRX=m3yhNZh(48_$z52|ge zj#*?*{x!sm54*x#PsDr%vo_WyM^fQXl39p((1kgK5V|sh2f{u#dp48PD!e8%xcwo` z5Rzd0^sfT{1=onpILTvY~p~U z(HHv~d2CY-=Ui#waNO5}g{pR3rva?>Q#teM{B$BP-Kmm%h)*945dPw|y>rD0;YE?E zi)&nwNh2yi5tGY%m2yPOpzy=ZN5;eP4-|>Zm2?RBTq!nAH_qvzT6!im7nEY8M^n9_ zk(Saj$>o&Oo&kpK`W-T)h7n5~WiiG~AjK}#RtmjBjwd>i4$Hn& zsw1Yb5$WrM96HU16K%4to2=_5>$;x)YSUQ5DU~$~54NyO+@4w*?wDwmIS2jdKzXr> z7$sXisG`YphIGmBR+#!ON5=OJ*=IXElvV0Zs~sP zCxP}6y4c~gVX?aO&ptvIgO~a;_m%k3O-nOb6{4FD6Wx!cuyavryN+U9KM}GUD!`lW zI8yx+EYAUt1gGv}b5R1pe2@AkI05OgYV>SlMeeYs>nWH0M_EgZwjvl`G@g+6Thpn8QGZadA&JXqUd zx4La;6Ktu9+xt;p+gXe_a}Xo5fGX5e%RS*=*h{nCn_a39r?rqI^XAtHI=W8HcaR9~ zk}D)jAz4S$G684?K<4#R@PY9f8t>vb@$sTKad+E~6AwBVR(B?vS7lX!;=yhBTkZ)W zpyf?fo+2a_EG;5&8xjW_dZ+*mEEg#;9N>&F#j)8YGrtXf6Mo=dH{nM!mikRmcZK`< zLBqn2C(a7U$*mf|6zvsQ*i7eV!< z6YvFAx>ivNWVS|al&y9^azT_FBZeRJH3lVB(b_JKkgL0D;Z@u}#CvZ6icZGpA*F{K zZrja@cl>IZqEfajwz~XU+1o>9-t0uqx&oR_mJ*1eycWYn5w**G+mG`8I4Xl)E=7!V zSUlg*_AkfiI$R-~j(8`Th#DRQQvn-j`06dUS<#l)1XIUMrmYfVbQCvOXh5ha~$B-46ff<`isuf6>?tN!~mG3vm~ zYe@JQ*r=l-Rb@7YPjlO>v0NSar2H%JCcMX5e9_y!Ix+f zE<`ufC#2HNhnrtxJe%sj)3{_7I4IOPRnBDwu};hwja(J(!oa?K;Cc6bbXm58XBpur zqx|Lr#Oaq=%C!K@HPD>V3%t{(17DD;lsDn9n%u0})QHLB&*&MN*D1Aq&_;$4&y`G6 zKAevAYxq3}^+L7#g+#Tpo~5K!b8fN-X^T{o)(2vCyvB?s*LW(f;%7)kYf^^0I;&Ej zGIR)(J+*+9uqQuMwSXgiLtji_zPl2Z_uCSfKh1NbF&Alw^61quS|;WD5=U$$lkip(ph$~sF$&l@>V#pMq`+X@ZEO9vYS7Jeq48<)1~>nOSvEN%{;W=EdmhusdS3_>bU=^F-9q>N3i~P$H8>KJP!N(**V+vD z*sr#wpRKno)wNg8H4;|4AOWqs%5u!9Q>9!{t1sCXIj*dWx4Ze9|3t$9 zi}bwUZ}rQfbUy($F(RB|^YYA#BVlebgbBrdQ_>Nb7*e8GiI>Sx#waVGzH zB1)tWQIL7q%7)`qZzlT7A`tLD@ayvHs4s&~aC$C8cgwspO66Uv_vB4`8+n|Zzi0>D zvzG+LRdf8Ck-C8MHdXYmJ|KZmx;M^4(1mBeM3zaoct0|hPi$6fOWf?t{8gIkm82Ka z(7Zt=Smp`Lk&`ty%t`ddmKG=q3e6fjm#OmWyxy)qF5d=fu2mvVqxd*yG+DJ3Q*SuC zX2#I4Yq$frV6w)@cQ>YGR40?F*TiV_I*(KZ4)$UW-r9T|OzC!zrHG&pFwI=TfvlF2 z5GcKFlZv#3N1D#SBstvHJ3BJBdzVXxlaQUx+g3bMG~w~F68Ejs%dcNe{p#B0SItV{ zq=HmyFgR`sQ-bLM%BL-P&v^WYeCbQLD>V&=8Rbhwa39gICMCGCvhRPnG=|9BOvVmLln!{Csdc(b& zj}z8TP2d%L3}wxIq3IRaz?F;%4oP>^{h_Pmw#Y@b4_uU}kC2y2VN7bS)KWNV=e!0H zRBm!dZJ^zSR7blW)zQ(Toer!MX$J;$+#eS!5&?qC1Q+k#ejjwzW$u5oQG_{s8?B36 zK(L0O+IIz}4Bkq3m*D5+85maZ{mI2vphqMfvyX?y;85e=J|^Nz^68Yv7L(1C+I|AC zr69|}08E8?D8mWUEs`+&OfuV*Work57;+}G{S(cXr!x>5g)h!=(wN*!(C(vA@Jh-dS62Y;O~d_60?y>(<=RIjsHOlZWi*gV!>^22Yv$!GP}O< zg_T=D?tg}Px(No!itG;?hdAd~a61J-E-n5NKQ$6JGyAx1e%F^0W?K(2S;d6oYt+zo z7cfelSG|xsV)wD{RquAlfm@X~y&Js7)8C^P?Tg^p71c|GvD4~!x~ZZfc@%WNd)E$L zpTd7)w9(Q%N`XCKb&I^uxBME#jPva*hdds>lg)P{V#_6pIUaQ7eZ?zS(^;{}Kbpx-g8f;Z8i}t%7Yx*Ub@Urh2*E|= z;Cm~HcWL5|&9#OAKtR90@$f~|AnTW)c6o?!;4x&(eG|R$<)zHG6mp69%pg?1gsnWB zzwnuO#$?=LOLy{wVr4H~Ga`T(gP$c;i=x=i#bLsO=XS)vY3gppMpjJ?Pkp9(XfT6s=9jqN zsnCT$t1p9*lzFGjI{2p>sZ-9~rk(791?vkRR!tM6Diwv3hB2Qozwb-k8X2KlXE5Th z9}I&FtU8P`*wbDKc$WsrwB<^bU`Mh-;`uv5kEo21U0JjCzC;R+3{HIs3#M&EqV{>+ z!m6eQC2^GkUR5W^8;7q2xpbc8PS;o&V%ZTIH<^``hW$;-8cdG-AP%=KmZ*Yc_XjM9 zp#3?I7CepNLq%l&{fq8J&^-^1x3_=)`TsuH4c^M@NB`gdyW0+)bYBD)Z{fr3-JR`S z_;WXC?QZWL;3qp<3P;P-dbyEDS2eW-naoWFXp;fjWPsK)er}q;9c^v!_cDUbhofKK zfVg~Aq5h0(b}F++nT?4h4%pAMioSf56}55rUz#5huX)y{X6Dm!w4NLt z)`#7s6LjBRoNwt^$arH8QoyD2qx*d~r3_MGkr8gppyYH$d3K5Xj>hf9LKHC{aRyHR~=k+!mXy=4+eHkZ|=65yX^VC|OSP{-y;=zxsg^dPruSs=&1&!c0V1)> zNl*?%3ICC3OA#6+e2Jo70Y*AOnFW0?l_(ucEvbh{g(&T3L;MT>s06R&GJ+dHZ9F6> z9J9hBd@mA&m&!1>%?8op#dm~c(Pgo*za`sWvy}5@9F;i*rjW5yU|F=JQFiqApZ|eq zCrrr~3QQ(TleSWH3n^_Ve7fGR zmFzoBB6uOsWs+o#NcK%w;aRyg4uFeFLPQ5;OB98;R?ObavlnXBiQ&u}s6P?O!xvk(mOa*^iv{!9*sb*Q`aic7ACT+;p);&ANEDOu= zI^^=kd)^8z!Q+A>)KvnN`21oAtmniRFx{uuhHh!jD}w@;ysu@+a-O z16da|O_)3|z4P(*;&ZrySMFQcJ?|DU`>#mnbet9h27Z;y6$Cao^a7c zmxzQn9m3AtRKYu6hlraCl4>v}p)O_R3m*6blFu~dQ7Q7u+4S;P>le0hHx zA`WDK7rMQZPKxj_ymP|hQG^Ki>#_PiDErK4ZoQ<-g3`B$_KtY6h%uI-o4Nhi=WD%9#@-o=h zn!dBW?4evTE1@!!Dqlb&l$a;`?M4#l@d-z@Fi6~%;S;I+ww35L)M6{(g&QlnTC;N;t&tFExzaAM~Vz3(qba-8&vEE$87_*(om z8jgp7E*-v#E+y?ct=Ho+5iuMP7j(oMu6Nx0eVE^T^tYa6qG0}mySf~@&y`*3E`Xb7 zM36-w_uvGR4#PXO{jCmpqu970HWZ=F@4#L5#w_2__8>3JB{0nS+(l*9A41;yE=d z-0fOr8$QJ#dVde@T^Y1K{S&EHUSTDzh*mju_(H6Z$A5BB($#fJ_%>WssG1}kCJb#A zK5|bRqm`60_fEI=Z!0aM4tPFSGM}&v;R;{V6U}iOI=L!rvM*6=hh_qfDhx6+PUKGW z7Jfl5jg?3wA3nbMz$_{X4oipA1eeILnmI(jR@_JBk$q}qou}0R5T*)H@TS|9rW^jI z9X5U&pJ_EV(;)%lx5}AnuIE&J3|_&Vn<6PuyapmnCCP^Ueu|19Ra!9`oW}G|BFI9) zvY0WVR`D>dbOv2h%s+v{o>&GRou>_6XCWA(>bq{eL4~*O1b6bAz22X0`u@kDdJQXMer0ZtkS|OdReX0AD?ao_{#pml0(k$+G#k&jqTDfve6qY zvr#fm#<92A*`jEo-j)tegEx5z6C6JZqoiGX8D~0L&L_pGJ|tQ_4yc{`F+gIZkrS{) zlng^rjo3(J*%Q@MmZ*@dvn>k1gQ(&MU_PS^B2sXeo+$TzmCN@TbGSK?1W9mee#DsK zj0g=PMlP^0Dv0#~dCXztClGh3x;eL#xtTB~j|fS%=3&h290jw=NF+uj=seG`hbcFH z&=bTz6j7b_$OgR{(VzmFotr;04_}_~z!8JMbC&sy_Eg*fM1tu9l3uP|V~w zxi^cpdYuNHQJ5mDaB``b5Gx}4%ZIQ_pXOOnbh?Ni=~537g#Gghq?ZaX4ZPtHE!=t@+DN2F z#iCQ>%I~O&As)u^Fku?9(ID!h9_1J=*79gH;lrDc$tpK~pS3eVIl0oMyq(a?{D#}H z>KQ&cEg~_vPRWCFJwp9kC3R@Ncz~}^B*}zPmogX?avWwI@S4JG7{KlHWKKyVhyb#@ z@|Lv-kZu~o%6ljSnCB&?j+o_LjdFiwnRIj>-hTfKw*}|!;64l;tY*WrLT$Nm_+XkY zzU{VeK68!=TBmdm^SzNZx0u_&+sq+?isK@9sq+5!QBYCnIvx3=hi}yd3VKyjboH?w zR!gAn=v$Ki;J)>dqOpTj4Rw-UbVnJayxP!9wZGT_qsV5aoGvU}0HvvcRZ zwklNM;|Z=)=}>Q!j~E%g^Jq^UfGDNMJNrk!|NM_onlRM)!GkxtrGY8$#$|Zo(nP~C zZ)S81&8?fC&rF8cVJ=+htWbo7dTJ1I%jbO8WTKdm&9M>4Q)VO!m27-iJ^1vm*a&mj zRH)C)I9oCfG*}j_wS17)3QpivT1jVLh=O1L{Z|+~X>RbzqM^W86~mf`ThBY2VBWnS z)YkPbIOz;qmCDY~)bwILW_8o?q7h6Mfgu)9qzd}Gl8ok6(q>2dMOV(03 zxCL3EoKhB}s0>gwLa$0CS|gV&Ts`au^xpm1r{D8entZ;5k<0H>*s@d2Yx=_ClcR(1 z5Q3HOz~v5JoT>cZ8`79w)%^VK#n~G@KPTBxmZ+P?iv!VBXti~OxIl!9w8j_txWF=| z`xQjQ1-8(fzusyG@48Q%H%hoN)PSXzPa*_X5qCBv>1ZOPk@sp-l%NnKg@vCOzjfvm zzK$z44L*#e{<+A*_ae6)g=*wcqlg1~XIa-CTthU(QW5CSz3HaYR2aIw#$p3GBlHiLg3BiQnlNUz4?YGu><`Mlu(jPe;L`M9j~|{6 zgkca^{L=V+b#i^__Sl2Mi{WrwLpksRS z>6f7OJ8d(uEHRs5FZRXw{$xR<{2T_`tNPX&o`b@ZSnc5iscCZtw-3(Tji! zeiHi{Tu)dx9zu5QMGB{jt|^TZ4P`bigVs~(I(vhf*rL*xx9T`wcfR?ZbrzDXHbHK) zL)Fe)6H#+FoD4(^-bbZn&UVVFPD@rT73!f3Xy75m0x!}LyvrX1xXUVQ!}_83le593 z^wGi2W6%3HxoJiO(1^o3Ah2I+HaN#cnp?M`9O8X0{r`Fm@3=*XZiD@U^&#KVXT*d~ z(BcCpZs(oO0+|>DX7842-%_dgn~ygiG)*dQS+pOkIsd2bo9}t^hNvc0p?>g^uq}je zNfpLLg)Nkj2wH_qE;}gXA)-`<{OJ~|Z0E{XSaUObmGwmue1{X$pqW;+H@y1Jpp?86 zuSMwAKd&`5)BZMkUP*7-1ZX}r=m|DMu{&K zBpi972lR$t!xGYuvT+fdW;pj=GVbd{?hn)~N)e&1s$dz0D}P!hhHRsAZ=a@J7BsoQ2rC6Z{atyH@1&*!UC%}A)d-zYEc{Xt~hO?<|y`e?575x1Go@>OD-vg)U za|NybK=$KeJls;1-G|^Fz8)vol@I64^6L9;-TW!LOe24ZS$z0A-5BBr@!bki9yeZ{1|ZL^`8MV=+AThrd?jB{6nvQJ(AUcbvwXOyw(l^2m=3$p#?Bf7(ffI1-B ziyyN*3Ev}_xE4=zo@Y24SN1-Ti-F&WaTZ<2TqT4Y3~L&>k;g=81Zo>gop|Dey5E=x zgoA(Xpe!*ucpZ@ph%L=MO?54}HGA{AuOfOiSKOm7)*1Gwge)?j5!Chh`(bv!cle#TUU__W0O-cnpa9e$^uy*n~kA^CV!c|dpx0Tj` zQ@qy-XMXhMW?R?Z>c&0TtjOA4q?hi?h+QX6P%)}v#9RH_u5nKMI{P-BpfOXGuS+XlJCN)yGSJvEo1b7)c3)I>Dc~E zZ%ehM#UKi7OUugM6}6sRe=)LedE;`bgn(}|K4&teRNTFc)2Z_HDdXh|Wg6IbsqQPb z&>mPOOXa& zbslx@wnK}6*acWy9n6`w%PGY{N_`3ZFENx_s>(AtXP0zQRQ=$YNeE3 z$PCB+u@h>k7#39dTz@{Dw=$Vv%hI{XR|el~y*;n8BzRRQCVrmeDs!jOs)d7R;+VH4 z-HLu$X*An85|%zD(Kv1T1Mk|n2*M6;bl&T55;gZzV{PtqAmuQo|H8H!d@%S&O2nzU znRopyXPCj(a6gELw~Tmr=b{~^5D-paUDFH9-4PGtDe4?*KxjKckcv510la9J9>hWKPWT6yPS_vG~}kD74C?KMs<`J9OIP*A_BYe~Go z4*3gij#L=Ox3$GRAKIZoCzR@TZmkX$K@}dsr-=9IcHeC2_TKPeWU^dAvdiddoNG+D znOuKyRE$^7kN>W|ou6^}st9p4civZKyXXs@fZ^T%>>QnVkHZ0V@-U!V?z^Pj-Fb^I z`J>gUNImgL_(FCUqDqe67QrU`R=8%MUnbmPKp_Xde%QmERXel=@;K4bu{2fjM6S|> zx`4U^tSE$_Oa@C21z$d z$BI0@kZ~G3xj;n~UH8(Y(bBEd+fA1s60jO$f~}N;Fe(*eM}#7NSv#ooHwFX@m~&iLmtAAm=o8oa&C zqnCeGM6py+Ch)Xke&&qlP-R_px)J_@FORXEDe{?8CznRI^_WEz>0N9Z)ugqYysFNk z#(IZPQGxa3X5qsYDXe5ZqMxEtB-}p4DJ*mxyly}wvt?j1gZteAJySn1Q8tDiDI$Mv z{+_3}Am-l&=6$we6xv0aF(%k1>l?%Mib8ghlk>1k5>04yaahN#~`%f-Zl0g+{F= zg#lg~uSOtsA)+aQcW;s1!t|us9BQt1LWF53j{OI)h_UG9nJk#In6*q-+V0&wn=SQe zLO$N7n8C{}>oK7oW*2xbWp|%F3swo^G9M=eyxu|180;S$9^#kcL1qm2C2~*rWhC!{ z4!p~&!#Vi1l4t4>&sOO$i$0bG*@hTyr3;tI*j4;=%aa<=!#m!me=_=hBHPaTp|?>h zGRNM6-a-YlWIhD&m3~pHt}laYp_#o(h(hc7cP&pGQcqFl!1^lWv?90KsGQvhp$;`Ch zpIoeLd%1Y0;89P};mB1^%GX8l(T{L9EHlbFNE4dP!#>yll?;N1DWM$n{_*1nyQ4(u zRU&Kp&X5HiJ2U2YovoI5gi?`}+PqbYTSOz^&QBAam`?)EJw&=Z|JyHe60{g#OQFm8 zi|;Xtkw|ec5sE)OUUoQ^&l`$L`Jb`C&Lw)9 znbCyl1O%ohoilMl4k*Qy21TiqvbOiItHb@)0!9(lR; zJXN;WA=yPsOCk)EEx9HoX4*=>ME%2IiBz9J$Xsd}!Ju^sD~&`<^p?Z$>BaDFjvt#5 zaFfJiV=*c;j?T!`Jp|uJ+YG6}6%nmYC#gs#MYKB9%IS&UE2kDDreK1-vF#-JTphvL zH%tP5BM~D|h5l(%xR|5y!g3?Xt0sU`tcSp6me)JBXkJVFJdu_;-zDbO`9Oo*B&%Wt zE2Y!h>Jp_m0r2q5hVWr19?rI>?J1PkGRa0*Gl1!GDf^Rtvbxgm*{f5nOKH@9VD?8z z%!>!Mq5S{ty<2Y^NtQ19R|36(fs8HMyi2MuLMDJk9rfQ-yGm8qk~XbHmGnADgg>2EK(7gePLT#+S%WPL;iB(H*ep_7vS-Wy3CRPeK+8sHud0bb1oAcQkrJ8oBJU;k zTg34;*b%tYC1gfArQFKwS4D^6y?viZ(pL&aYXW#`JMdyAQ(YN52ut9(bGD1HPu7GL zZ0rX7oV=iLGiOt|E!AlTZ?RSIGV z27zqV%cmFrJ=q^g8#-l>D5W#yu7CIOk^pm3J68OJY5d~uvKSVz23SfVObhWeasRO1 zx-b_v2u%Sj1aaa(7&mO`%AV=Z-mj&b^lO>XDy>8hix4lNM<=2BLv)aoy@t~rBU8CU z$emlR=T`j4bzyNYq_i{XoR)d7-iW2m=oi5^sXy1sWnN>9rwyX5u%r4I{012S7aEfY zI{J^AS8+fNDcZ04fw~;}jE30p0>Qcm=oS)bE8>kJ+w%%AemRzMjxubYGG$~$ER`_H z_hik9yH+))8jAvv*}`y9*)y#;nEI~=JPZ*O9k25~icAH9H{bp$PQ19Qb6TqS5-A?d6Aq%MU+J z!736|YZZc=mWVAbV3ml7pb;8L_MXzkw-JjC&O|R#QLFf4iPaJ>d78VcG91(mi;i;i zOUD_3u4*KK5J(DMJx<&mi%t?k)Tis4?%)cjue(gb_tLev%8}jRGDM`4J9t(B*%BN@ z$)U_`CeMy{>lSJRUxP2%nFxnBrHLekA zAA;x^Hb*bZJmMmL6o>fl!Yvk4 zY0NaX6{QApL*nc%G@Mg0L6!2ApqHpva1wU$ABIhogG`&FV~UZmuq2|7$^cPtee>fe zTWo$pNgcOM*CAqje`Dn3^g~YA2V1(Na26By$21*aKF2ie;9l4V`L3a{`kNPLX#}V< zUof!U15gOO$TdZF#1{VND2&yPxUa7v;y}qgCOu5YGLwQ7x3@oDEX?po;UXj=0;eaE z3T2^Mf}JIV2|P!g#vsCn7(%w;cTlUIwg7Ut3Suq5;KX#3bU*AE?>0)h8&CWH?zUTN zn}irQf@GiI5h5&r|9~K61>z)K9vz{&(-l%%Dxq9-9C4NE z%x^q}yCHQ|37a;HR6mDe7$;)LHiZj7#-#@>jr2y{b=lgv9-r~1E^ZB4+_s*d&Es|8 z4LnV+5lGY^pC?#f95;{@;SV7eR94rvszl+%Whp)m*%L{Lod_&!tLl4Ri0K9)lKwHI zEY3%i#1DS+*;u8Hyy>2;5z<7==U6bo!HSleOq$D;Q$E&YigYENam)8mn;i3CJGrH9 zNay_R_FQex)SZOpKeD|oTGb``D*Ohnod7gslyKHe5s>`M7HwI3Jnr8!=bZwUj6M1y z`PG^Y52nICN?y_szl-i(S@j8WHkyIu(d9zcU9iB5eBhMAGw-*4ymzInYj8C!Wv!ZRtTGK@*BPu**ACg23sG6 zUV$5P8pFl7KuDK`A)6(=D>nthBeGAHK-FABx=S0vo)CEb?@{_xkgcP!&s;>G+)sG# zat67qFn!_2AKxC%C93W6*YNiJQwaDf%AG_Uz3Dl6Y zt#?nmDbI#VvXpAvWHy&*rpss|JkXL@UEk7`f~o_{}%F6wyy{PU5DZ3zo~5#BE>RJJq~TOy!9V+>*@GvP2g4<{L? zEweyZSiN_5dClJ)AsHk z;H66)ST?gNy-KV(!>Hw?d&}SJ+jFD4@q$~4Dui=&JOvS`$2dP z2Vj8MqK_E3^X;=l(Z}=6%YrNWKwylUw;G@q*jglSZVJq)GVgA z(6q16_4T#fStG23-l!5XH>=lBY4-tbkR)DwsghogBW^P7d(wK&JpqHJ5-0OkR5EX6 zfa_YxZGv+GKjUK-BiaSpx2OG_+cS#SBY-1tJuA5_NqJZ&2oP@1VC0O3@-T^{S1gh{ zJA0vhvv!_yvjXZktGPWA_8IS0<_85`HnsZRvu=i1Q)MXElxJHOsgS!_DrBoRug4fL z91J~V3@6}o7RdPo1u8WMI40@hm>3mA^pbNqrcMoW;px)6q5F~4Of&XMpMispTv4-T z@uZUq#z1Url@%j}dbYq^1H;tjoLsU`k2$Eq@62a0 zOffnd(gc|ntLP(N_MFEKdQvY(H?{Vjl&xwpM_CY9&{v+GRD;U5uE{MVGQl3OlwU>7H0AMV#j|(HiYI1z7v_?{c?eqeZXH(kSRU5$j-gn(%68 z!h#y3F1}9$N3cX!F7%!+cw>}JdBFoqyL#MeEMZg7u&h;Ac}o_XmI8`dePdyJYZ(`f z-&KAb?OXb+PJ+2}_IR6gk=$=(%Ke?G-2ZvEwbwVQy(XnHmi+laq8UrxZi*~&DP*#>#cf;33r!6cyjOpZ-=68P{5GNKfC(mi1c)b(iTR?jPoeRWC!d$L_VWTt z213OJ2AJ`R;}?a$Q}-TAq_J&oZc$yWRk!apu)%L|IqKVi#H4_1A* zQ>pdMm(^JxnC^Wm$Q_VUJNIpR1JnP=UGtS#Sp`>CftAfVvz}(CwdWlJ>CdvlmCbax zl35j_k^&B>#EmM1%~DYQ+rbayWIAL5nql987%R})dtAk9YPyg3RdMyL2+t++nFDGv zgAr`dGU2n;5h(yJ*%b4)P(m3YB$9(5i86gUwH4g9SkmzfOOx@Tm_sk1R1!o11kc7# z(M4$q3~uJ95xf+@PW+@EbGZ}9K3E9-$i96Z!?y&SvS`1DJ+T~YER!@lfX5a@x;5E& z(Tc~#%2;`Bu((B5?1@ZUfmg0t`OO?@UDUVP}HEsIBz2R zdI~`j=1isj-7#;;57X#;8s{Y4$40qWJeN*XcjXzBX5Frq9sTzo%sj@~AX}Xmv#U!T z?wO7~MF5iNU)xb&ak6#F2Gp3$Eo|%b#eIuQL8EU2zhe@{M08z7@HQL1abqL^U<^k{ zJtr)# z#v;p%;VI`?;86(ty8O+NgcIIQbtae|as>}b4rZb~U%>ekum6klY z!$7w5rLe^kPLMC#BxXOM<|~-%nYQb){UDREJnWR7`Z*CuS4x1v5pir)N-b13(oh8L zMcXry5ij4AXh_}8qRvpvGKCZxNIY`U?*|SLwrvp&$L4=1D%RqAlOUS7U~K$XkPCi< zW{QuIKgtw5W%w*aaV~yE1WdiW{jg$u*o7L^y$s7)`?AUCE`>U8awEJDNkLl2Sd- zk*&7LrRUi{2*@&wECRJ~YCan>HxLyy`yb8%()Z!}2VnXC>6Cnk!cmkfpt`_WwUe2Q zyOU1Js_*oxjh!~@wd=e6om#VDwoTJ8b{cyPqg89~v|3fR(`y!f_2FfOeGOH9*3q}m zQp91-E*#`%Oj@}8k67cIk>nCC4i!b!K@D+93^t<_58}C^L{hFl)($xl1<4MnZIfWqf4Ni3!I5FlR{yAxdiKnWE`c&kaTI*^5#A5s zDS!L}jY1E3^Ll#Z;qy~qVtBKU8+zfvXF_wcsrsw>hxo$-&yE~dy@Q|6yy1Fp_QBFg z{`x8Pmy|NqdNrm|dhW+QH}T~F{)H#X`PEvx@u4X8{Z}({2<4>wWOA~wC|*M7M=beO z{3S#F_uPNz45!8A^$%A@{JzclkI|W??MdL3arTYj_KN zZoo}|3Uo`bz>}n&P3G8lxnU=HdYaVgP+?l$Ry0a^pzGD16{6~7_wT8!&mehAcrgvi< zuj0W|Gk8q6ua$V`^%Y_!9@ccCL%_+_Ywq%pk=LBr=1ko4#Si4L+u0_sUmw2NCTD;8 zsqAZfz+F4PaD)#SFrU1JQ9PgDNC1pE3S4v-xeZFS>{-w6+#+ZF!1Jp+IuJX2WXgXI z@@}-I0OWfw{DDjpaj@HDMBOlQQdrF~tiFpGCL-Y@?#v2*i|w{k+22PZk_ykm>0$1~ z^g-(P@Y=+lG6C#$12ZPW$W6+tN3s(}NQVx0Wy8G?k)~xDoJePJ=necnH-7L=CIrK7 z3dGi@L5O*pl{n+25O}ByH3~V5M|rNzp4n$ixoVLICZq43U6@_vK9FAZT?BXccH=4P zdH>b*(u24L!>qDLB@zeRDOTHg^qjf^-rRW=V||xwdLX$MqmM6hQis^{{TWTZ`zN^2 zviphoJaX%Cc5&`8cdbl?6gd#qxs_#}}EGgc+; ziygW1je9iEOmjly#p{EeR%7qU1bfWQ9AX1Ug7p*G9fFt1>~LV=fAy+r^px&NB9u;G z4$V8d`%seR<7G*g85cs59C)M2{v>2s8JGI@7tV@0Ho8gl5W>upNQ8g@7YhY$A=D9i zDF_BtOv&T4bE%(V0~*nchA2Y_%QP2>kmVndjM(~$Ub|6=?_KOn#eGwD!*WS%Im$-v zN$JQ;m4N956D$ZQ*?JCD*Xm>qc2eMhe}PSY`^5?vmh0IFpvJLmB=o%zmu*K?MV?%9 z+4Rx1Iuz*2Ke)W89A4}nFM-YruYh6_!Z9CwuX<xFxg!)=HMYIqMv31i3Cj97^&0XpoYJBLDTJ`0Eq?G>@JtMOkw$4U582Y@w6Le)-90$SoCPXLkt*T zpLsA5L{0)2TA~YAg3y#WaC&rtakbc=@sb=O6oiDxGr7Rx5I|M%gn$0!uM(n%Bbbea zuxlZ9PZm}PVz?oq#%gNP_)h^TT#42zk)9I$LhQv9(90zB;NL_3@^VI(+5xRUf2#f>&e+q8EG5=P>Qxeqn2~fS-0;a$ruK83!%_}T(cB#< zSsgj_X+PYs$dg#4RI)^~v-RjxhzOGIfP_Ov)Jlo#xyHjC6gJ$FkrP)AZqXbSzj%E> zcAJ?QkQ>&>)K-^K$Gy>3SAsK^0NSzP3>oPtFJ}}4xE2q-Y|7t>o|T94NO-czYH~O!}ZG{JY2HhGu`nY z8F*X>hOn1H>!&QJsED^CdT`|rayK4lkf?|N<90Gb{8x?5}5eCb4)(d+^;Yc;6838^rKThU6v{a&)l&LXFA& z+h5_m=^&BHMhWIM*$aG-ieHO$-f-98 zz6jqtETC5~We4%oWu2P<*ukD_5$RIV$z^@guDe5HS#A2xio;j1F#)#b&8uhy5Z@Sg$-izOJc<`xjO zcmn#`BVZM693c~tB^iU02>Xj-YSXYESluE@=teGrRSu~;5K+WwMKp#eu~v3lJ{10( z#`G+5`{joD=~{L1TZ&y7&N>Iv+SUMmm#(80jpS{3i~8`CUbIb)Tm$jGDwjj%Rg$pv1LSBqcPJk3Q+!cV0h;kS*D+x~$lLuDnyXJl2zY?*Q zq}2>bfEE*^(}j!T4XoKUDH$*y0TpZ}BA(nf1v93J?=YLM0yTt{ zeg_B+*0?QrgN59J|0fe_!^bxUCG93bO2l{&Kun;`5c_rjJMBk^c}eIEsnvI9zK4A& zd}hJ71Y9P(3=n04v|rX=?umqfXc9SgLMFPei;e>75L2Qs z!?`k}ub*Lgw_m<}zWw6fegPJ-LUCfSt%%D^AQQrF6MTFAU@gLMn2~KtuuOyTEDp!x z)90`twil!_+&%cPO(4(UYnaVJdyy>|TP9rmeA(S5KOg;!uTL*NPE$WZK7!{e8JMuu zV_+usGP{uM?WGcLWCeL8K-pZe*ramp)6ob{a3T3Os$RV-Zi1~7HX$F?aElU=vqpb% zB2KDdjz!e+NgyXQM&@xT-c-nOw(JFi5AZmp|r0#iOS}>-LLM+lKH3iTW&F3fy#)^{0In zUfm&Z>aK*L1r)Xvz9ySJtFGjdu>jOov*ykX#izZ1Z@Z$S1HTdQRAL=C)>ICdY~+dc zNIe)%F>DtcPfOjwc4Wyz7bs*XIN|UzMsxAvl)mB*#O;5^M9_`Qwx_vw$87xR^*m_` zK_QDKf*U|78&A8Dg=}a7N4hM&2vE85IcV`FuWO39-N-eXZpB7PR%6A2Q~R57?Gd+@==gx^Ev;CF=oGowb8%7L|t`F6{8LY{nl zc50PNnlGC_N?bvG^6`Ab93^Ltg1pQpiN68W2`5UNKhh&f6zl@(EvnA`ZoP=m@|89n zupa2BQ;mEZz7A?igvtZ4rbaPg?wDd-hpA5*f51B%md@fJKobw9|O`jV`_3b&gy>uIkmQe^o3m=AgN@BJ^ zdmA!0L?kU{!oCWpH#R-40L#39ud=jb0{KShtSO(>)Pb+&fPSpsGx9YLhXf32&*0)C zlZI4Gr*nAUguqGDPo|EHOEMs-C00?mlN>PtqP-s^m<$6=5m@@E2AyznHX+ zZ^N%#8uEVZCQ1J|MaJY2=-W+yXFlZMs`uky2@=18UlJ{j;R_RNC5DAq!nv@>wNMC| z5P?_BMRCAC|MFLbXq>X#ZJM%~rG+$v_frv*sh1byI^){QIy}f!Pf|uwh|T((1+{bE zb-&;5$tc1@m-e@o$_CjOMo-z%ZeRMLA^bIRLz)B@SIoz<)TCh?9ysqvCmNHsRi>&AY$WcM~3l zn#F%+!N8``0uc{*b>C<8tVlvF1tNwWyedftufjTIi6r#bGs7%ceb%5F+GCkaG{|a- zq;|}=9?Sf8a!GsCML%(RhBNcimpn7uEDIwP5{1ikFbVPD#%QxUnTiSh+^g5yd%fNM zZmZR9_V@Po40EsFG-`dL$69Qs)!MB!`wgRr;E=39m`2}(lT7)Q#d?>x|DA82MXy1V zTAYNmXM31rZt^Q0Qd{M(`4aL?1aZ=FJu8*LY$j{MO&3m~Qs(we97pfDlRdmXmEOZ$z*S=p)k{twl-Fn2(HUk$g75GOc$2qS-3h7nnPV z&Lt!lw7vb61d%H#+nXlsW4Fd_a&q_@-xpmPMSdpc-H}Ajq{C$@>=@<>_$`^_^_Hmk z2$@Sv?C?o%WCAu!enMsK$0BBR(@YvO=7fdJpTah#55LS;Uhtb#-3aCzgP^|4zl)2T z4&~Pq(UE+A8>VeyKDr3PB`LW{5ef$LaC+0~i1}=C5rl-FV3MRE!n`gDwLoOA-vMn* z=5%j6#_u7XSKHfN7`J=!`>(E7Ezb95womJ`o64D9*%gfPEn!9}xWRelv{d$6_f4l! zY1K;6+NN36-1JB^FsWDXEN(UYD_RZa67X4h*i3VvTlUG>tybM**{nb-4V!HQ+FCPOqdal^jX+ytK0^)dRcTmlBh=QL**1)}VYKI9w3DOKaN6ef zTvtBZKSe%!ey`|4Hq)G}E!Xw~3Ai&7!HmG6ws_IUG$$I6v%@*o94x50cZ6IT@mxmwk!xTkr{X>~X8z=Q$oxBX)f*06j%iWfIOdkdXwRS8oi&>z z>1G>KZtiB1r81kcK}Ac%-oj0@Vet)%uPuu=$|J(RKbw8S-9-!VS~*yIM}NU?qqdVJ zxU)&~n8f^lq0Z=EAMyPhXrIlhW(Y7ONV~STxyioQvwm=KK(=N8*rS`swIgd06nGKF z*b>(Ky)@Q2J1mKUQUL5itx>O*SZIAeELI9+k7iACnY3cDJ6h29%VPM?y``hI`O?wZ zqQdsHsBlDm&!&}tT9|lV5!YqqchrnNrl{~-j7_?70G>c$zwG4~5+18kHX?~4ijPt~ zQUq}R!t%LAnC1Hsnb0xCb}IObba5HNjH)3l_^v}mBcLG*=tvOa#`A6L%iu-?b`5dO zWp|7o*8YsgEW{e30H$Lj>Uz4oOoAR#P<`&N0NYdqJ>mUV*Q-_$1S)Z<6!lV80Ucur zARKs<77hy$Vf6XCm}g!pZwv-CcNG{ocnd zo0KI+ObH6YNqNc{)9l+8h<$stGW)wm@{GL~d|dw@wH;*RUB$;fe7O6FV=6mnc=qL=dogldOe3NvI z;R0m;5}iH63*<#oyW?Eiu<|`d^*(6+^$PmMD`hI7t!Ym0OE*iYHL`-E+4R!f|LyzC zZr~xRU?Qy`z!-X7iS)vNX0y;h@2+x2GKtk=v&uSd;(yH=~#oBbY*;a?w&$2|ta zHSVB#8B^u!-=|~|ed!P3)mShgSe3G%As`h@zggU=e(`dv)8z_4&WhTOO1vG<5POt> zrgv7HBk=e=#LvE?4q0W5lVxJSEn!|Ik3_v$#y&38!3xL-ZSA% zy-l{`Cfjk7?O62GHrbBLWQx{10^~|o=_1#pORnutHSk1DyPIb3tHdwpC z_S*H`y+)B~R)+{j^zAcu$QiS!%Wo7ofK0VI`eYym5Q7i#1rHpNX?67T;!LaiXQ;2Q zcAIoWgVw|ge===|8}Q$8fHQe|rk(ch>7`vy!CqMGQ{~%drYK%SsT8Dl@WHt7G$B)g1TB4W{@Z+Emic8DANsg!+4r#<%*aaGl>P3M~I0FBM%j49uCPxw^KPk zIq3ek8X4DK76308&vDrs^oCAAzbzHdJSNRccR5v}@XYG<1KvYr{f7rF8aHy}3vQ3? zL@ibnfe+uB@td`3E3vGSUp>q(*(eSs`j2m)1yn6LPCFiNf4$>qSzlQSSDZx-iEiQ0*wLIJI7u?uuFZAsu@4vcUHQ(;B??t0h*;OFU!zd#;f7u54 zIX1J}CIK@>@WS8Z4(F#^tF7qPYH#S4pKgs^#c%LpL$~~NYt?I#Zt!A5x4ct3sni<{ zLAMZISR16Vsn8@lDETUx$t=$3bCB0-^f7j|evuMB$CTdmq17_SY*?ty0da0teHb;Dwh zA{ZuwZ3y-Vg28QBu6((&6RcfpK7SM2RVLVOZEtfVb55<_H-~H^^dCvEjnIE2!8Stw zkp$Za{YMgP1%*ETbAQq0Jbr!pv)!y*nMSJU?&qCWwXs`m8@qcAx@*?<8oN97n$f7$ zn!OgS*Jy9AU)yQN&wDU;<}pQ=XDpysi%jT9w3JretYIV=bDIpfZ*t<KDW z4iKhYiF(0+VyU4_+l<6lSja6Figk!oA?EWJDtQY=gLnV=m%n1_aa@i_xD6kPV%d@J zg`VZvqKMFBWb5`f-^FYrmt3B9Uv;~uF9?iI`m@I~zQg1>h1N^C?M?%a^^KCiB@3oo{*}4;Vd=D08 z=q>LqC?z)K0|kOhn9<4Cf56U#Ds!>C3P)y1c7XvTDxSR{M9cOhj; zghi5}aXxi6@xbLgevRGdw~;o-Z*%-M$FEc%mYd_ZIey>I@jHRzSF1n2zkVU3)e3~R z+s!I)*>KzQaa&oeoDH|FJGbqhc215OWXoa`X8w6dgCTJ|lRZBK%R+q1w&nt8xmeF- zq^~-=Zj(L@Lc+$(pIi@_&o(@{be`-Sbt?xT1xvw$jRIPbG@E;OaD-Mz)h)2XxUrjs zQLs6G&v*WgOLP7-gJ8_E+a2to4ZA)2I?p|OQfpLO72vyau$*SVk;@??=|y5d7NhVL zIva&IK=In}*OF^_H8I>eEA z*zJ(5BU2QkZj&Rk+1xFMN4v43U!&NqX11hSHnWttjNxa+Dbvd3Z4y^~mxNz-_412c z@rGNTBvuXtvncpAg(fDzu}Z=#njHnI8(h28-QY^hFW6JyqKl0My5;a|HVZIkcdNB5 z2;~iXWU@!M=(ZCZF8Q5Kk7aX-xN@jF5lu@1ep8anjHc$qpq0359@D5~fjg_2*|@V+ zO*L+es2fI3CGcEP+E@AZnfK94;jl^&f?*H8dlUfsV;o&4a&XdBgOhK6iw7s&^xzAq zQHTdDo={AUbO|S@V}Ck$F^j%FGq2wtZfI)GcR*IJ)T>WV0MXq=xLH6KVMH~0@&cFI zZKA0;_^YV#bm;iUP-8|opp$dH`zRddh~Rg&NiQO)ug6_d{KQ^^6u-Ilg=40`>?)}y5KXYu0IXms$PYZGD3fT;6o~4Go=kpNj`lp}*u1&vv zb|{(L{^o|v(cLAasoAXrcRTBQpGa`~#TVh8Opj!lrN3q$%E8e0P*fyzd7eNR_OC;% zjLGd6OW;IIzW&1yNEZ?{LZC&sAfkg18&$gwvqC0B^+_5YBZSY1=ZDmhGR~w@?8BvS z`y~i{bqknmY_m|t+)zCe7#*V_buq4HviL&qY%>DchfkRTa`Zq<=5JZls?Mp<>Cb9e z>UBG%UNfs=Rzf-s_ylK|SBb7Y##d;O!ym|HGDhYCXYGJgSbG3h@3+sDdJ$^=v3T}# z>F_@){UGUpgepV|^hFsKrn*SCI^CbTFG%ZUH9k7GU&xT&eEo+n_{O)GyNw@XUmc2| zCJ6t6Kr#xXWP%+XMOQ48u;O#(3Q!i4-|(0t$4vIM!>-cewt`n*KeL!ql^6y#g?YUs z`;i;D#APP@L<|mR3FhL!gi%}i&1VFsO)NSJ5LE>k-IJZU1fGpJE7T5|@6wR>GUjOj3CYryF-s5J#QLLQIJ1aZhm)W7{zoKJNUOm0~e zm;m!H-1yXh!VQxOVE`qu1*%aV#(q>+&t^^ zFz(}#7E1a=$U(;tgqgxHrM?f(FyIN8Tk|XImIQ2iC~u`ir1>$;2G;FwmXOM>K)OPG zf|8fl%(g3*>s`Ck&$bi2VM^0M(oruE%qVzfNG(gs-vHQlgfa=|o4{)!vjXKnK*l0e zP`4-Ph{ma$1*?oau=0qqpSbE!3tX#2zfC6;&hn7Kg%q&3fh|5OU`7O5{p4l%2~1%x zm?%b%zI_hC5VTikv%dZvWw*g&%~7GFO;OfhVcTjS@L-DN4?&E9N(jeU?lNMNB|kt7 zGP$W^8Da@UF*n`#@;~4{v+$%u0tJo-;--sb$OLy6Z)P9Q2)qGIF@eLu=ca3UZsVisotfN#xA$fz706~e(VM(vozUVanZ?T8Ty-xfou z>nk+^EW)!rbL$Vdp0Iwhi z6cEq#98f7>Lwev*RHM+(m{Qp!Nm1ic z_f_hoNf{(__JQK4jB$8hHB7#HVn8*VZM&UnhhB_!t)G-%|86pBD*=K81kHfrp++|W z99N)&MJFz`@C#DinyRZIlg5VB!jf}7btD9fi9$}i(FABF@sDM5a><~Q#>k>6M-_++ z#7L$Ir%qLt5Pd&fdXatf;^35$;qfPEX%(Z}>EDdo|GaT|$n5yIg8T(D6dmETC-mNV zO5c9LEi)rGZJ7$IHUJq9EG@ZIu{v&5@<=fNZnN|`20X0<3S%?gO%{gYYMgp01thfx zHTi`aWei$E7Hlilv0Pm$r^|GSiwE8ow~TVQC0Ci!{o&e|W`XBMfv`d1*+?lf^&88e{bCgeW}IkB-#!b) z0q3Y$N7&J?BQT7~hiG28vG78LCw94;l%)7p8En*@^%tguw57E4*|3Kujz!WQ8dNqCB~HQJa|!(~MQSjDUx&$Df;iIz z9*ygea#Q(Q`I_ty@^R_{B0~B&^AEIK139K zk?Vi{<-Z>BZS;4g7q09ukdJ*3Vh)e}OmNa|HbE~H-hD_B6U}co_2z^-puYoOTB;9% z8$ZUKe~b)qsMvS%9QiIj=26T2zY8LyNCBALQ<=PFJt8((2F6aLEH_Xk7WOXYB}AZL zx(TQ9l$5rxgNQ>D11+&=;t0*6m z;Jdoxg~l48W7fj=R0|XgWLUSq0gt0I9aIV-tWBl)iv}bw(c@0xSOrtn#z*(EbU1=B z;yFF4-U}!V@yb+hy$~%&m^~2o91|9uG&w{|m6U`+lUNORL}BN^z8MUH?UZdYq!^T$ z2p2Rg3(h=D7e{?T(gaQ8v{#(lPmb(g3()JJw7bCJbpYk?mPEQkawk#<&@vxraRH zg`NWjx0U#sOrflYsOpHL5@*(8`E@jlaWK19n5<1>6)je_C|ac>AcR`{^w`Ka?9@-7 zh$IvMwnA6MokJ*chg@4Zr{?m~;L!dmx*?5Ko*IU)MBGyTX<;NLvATs$Dzkj%_)1BY zsZJY+0P^T}DwU;=z3l3Xy=czbmZtLM&}TFxXQ=RVcR&t?_-A*>SePT4QU%vfYRcDGJw~Oh#H{r0{1xa*}q3DuKK$kxQb^x0AFkzr)Qp67-v@pWp6^Kj%8;_l zcmPwxY%uXL8Yrne5-`)j&ci7OsK(rE6Hw5@zR>M&(D{zKGryfy)C?hK z_vPSgLe391dYZ7>VLUM{Z=8>&nzNBSISJDnuL)J({@afy9njV=!Pocl(NuGtvqSk! zWYHoB`s#YQs1xr%?FvXYf@K7tGUTGJ=DO*tK#jg840~jA(xueQM@-EI@#QdbP3CvK zRT8QT38UE#w5(vrLmmvXYJZo_Ivv;a*)JY(5=stHk288?rGLI4Zx#KBf7@z^-P)XKeOh=r!Tmcg$zbgzS6nV0aA#Js5iV z9K5@lO`j_<5d(%_A<8Z!jBd-tr+iQehMqeqv7Uax4TJioN4nhSgD4*hX|`p2ZUkcV zb(DUWoV`YgrXO; zFMN_dV>z#7-Mx>*1jP7HN7XFJ6{6X2ajvL4s2E<4+7IV0KBK%_xOUA(h5@I{=FHzK zb1Q)phS@bAUy_eBr>kI3v*BP}U&GKVbZ#=0T2B-yb%)G%avBMHnvI0300*!1ug!oN zPbTYQD*RqO;=6gUkM}ey_*fqvf|5U4mw3@zci@o=8s+s%?`bv+IE-KM#rW%}@E&sC zA|F|pH;r>ovo&G**JAKB;np(`Bog^I?z#Ew`#sIpgM;H&=!kQFT?D{64Sh@#IlP|a zQcqBWZ`pcqyR=7&6tGLs6Iw#k|;jgUJ-#FSX_ zQnRLbaY`-pi(9C`M-l-In$4z_Ou zT6-?UrP(AF}VWFffKL<7U37O{=EaNa*?4NoyVTyQ47$?HRiTgT|jL3A9zyY-(VgpBjHn z__h-QQJJs1d3vj+JN6LL;LbG5bw^42L;1DxaA#e2eTGr3_HNdMF%Lb&U;Fonk&Cy- zZ;mc6KjfpSW&_0MgCSUQp1F<^^@&9ws&Jih18-h zTM8XhpM^v6hD}(`3ske2F@(c5W`5|cQiZ@m!srfOj7Hqf1WH@hN}IZM{AkQAO8t<# zrH<8rHAL-vr=+P_ZI?r@qX0UjE@$@nkmk)6YiicuJE2X3Hz0*T2(6F^%9_nJ2oCa^ z`WQ#ZM^nw}J5Hc4$6phYc3{e&tW!{$uh=+WaHgqQVFz7Z4ZkKtJ*SaP&Wr=<=5vNL zH7okqt}9?8x}K_CHz$g2tEt(d=+dhzYMy(MzxuYN?!JzGFB^Sj*++7pxy;F6lyzs=jd4Hn-Mlp%E!{QQ zyK?Xq;@E{`(QLPvfib+M{>@&Qi>wYNJ?2+BqfwU``Itwu36h?`sxy#gOX8CE8a~gA z|CLG*?eoxOLGTgu%6zP(*+%He@vmY072>2!5kei#+@6=KFyoPK`cN$ZmMqfwWZr^93q458+B4bDx>!Bp+dQH{^i-;xtxO=q;p?X3OP_ zS}yG#eOU7OT)0%-<=@n|ZkX@YtMx2HZP{n%lv5|yanaoY90xx1de~hQj?J1#qSrnJ zq8&1q=kpBcZux!1Odc3vA$>)ct$2M1LyvSLJEw<0ci(Rhh7WM`6=KzebkW`RoBFm* zuiLx3trCkliLOB2c|+=wH=gaV{*~wF3&-ki|4oN5K3^ALfD6j%PkT(yYRZ@x}0KaySJjH@RSg z0nh7P)7{e>?+4FUGguR{cB2Ued$a5FF;=DIEd0~mF+32nXjNNTcoe0UeA%X=Z;^8^ zw|`xCqjAg*^4x2-E~yzE{|Z!}Q|jc!MAF@9oZ4dSH6iEm?f-`@c=mn9$2=cOq3%ZI z1Fz?YgB7CZLZWCkNBXu`>DgISDV3BvjyPCP5$HRIxBt6uV}WBnUeaun4B~lI)}^H3 z(u?|VFgqNMX-=AIwn{=Vg9;ThSQDzAFpjuDo@d%DU#*DlR^kCOBJ7D}vUN!k?{e48 ztK{f5c)WgiO?@V(u&Qe0LP}{iW4P^&f$K_aJgdHv`wTH_a;kWmEt1P2JEV~t+ALTX zJ@1_t^|(vk(O!?{YwX?D-Prp|OkqvvIf+O=y5gRd%VuutZUe5yo)pq^XW7am`^1bZ zFUaMCZR_qe9uK}IeA=gxh_e*U2eK;LN0iZaX%+TbtBvQ zSAo)Z)`Y0XwC8h%HDUh0NBQ*ew(j2N$Gu6by^hlK&}Y{o#n-;cM_A2Haadm*X4}7wrQ9bY`?9$5xMV;T(6KW#LE^z z=R5Or%^9`BTwcMp?l$BOwHt*5?4D83 z>24%`MsL`M{^ih%2E%aK*w&d=0m4(zfV`%5&cmqLDxj{(`!M)AO1pPh@SBUMnhk?1 z82A%&8NXQ$u4W+~w}o%2tmpB$95^fcswEE%R0Rj=JQ~GptYfm`FRat!v`oD=vR@xAh+L z5qAR$=d0Pss&-%6dNnKCBcD&G8w?{Wa;V?f+sV7;W$QxkX-K-%!X`uc0wvn}Xsf|j z=m2HSW}m@@;=r}`=JtO@Jv%4NL|bRib8R%n$QX zQ8(c1n44ZSu#3U8T($`94jJ|^3(g~dl#@-hx9T1WjMZQyrm#Znx{x@!(~%73N4D)% zjENETc$T@k>=XKiA+!oP@+Y6jIl{%WfE<7lWDN6VbLeidJ!CMG(YinizV(^Q2x7z7 zIZYGYy|p>cpkA*PQtz~EIrz?V>5%+VIm<^{&9=?uapjU3L%vGVFKaf3Lr}-B$UYtV zUcUC6ZQaeddvfeGA?Q2S$L1SX<9x6oZQaejuUOxa!>|o~(yr5k%NdclO>%j3cGkJb$5fi_lS>Ex?_$+CN_WvVs8PN*$t<>6wm9l~L(-+8 zm(N+Cz3;a-3~=xjXB^$VzI`_Ed)%DNJD)&tQefx{x-S75#UVJM7qV*v&EZ4NkkIOjFj~FZ(BI zoBWuE)!f}Ymo1q1HN{@Sc~6jLZJP%}?|N;z82`jw&m3SQDb2 zurYVZ3D4K)sja)$wiq5qUmEa?Ndq>(i+5oO_{9 zj&1(!|93gN=0-jw2i=XPM+2MRs0pm9G|HOVB{f+T+>no$41_Ia^HEu|eGtl7T*s4G z6CQp~1MU-QQSzSVELqpxqZ*rYu9i?(NEO|1LM#lyB&PUpR%Xw#8R(RP!TyHkZJg59 z-FOoFi*4=CR9St1rvMyW#nb1kgK9wCma!Hqu zsY!#ps-9-$KV)=FT^_6w3uVpbmnew(aD8h7@sZ$NA`~ z9fpW|_PRI%u;4U*Kcu$qzR@9fMq>2cED()VBIq&2B%2GGt6g+kce`jYIt-qPNwTu~ zqT}Ukf!o&IV%lU5M@QhAFzFd4l48qJgaOS(Pt9hHoPZdAO-Op|Q>Pc%{aobK-S!&B z1{3Cnu1jq9o#$iT=Q+3Xv8V2i*9I&jf?Fw|KI_p!@`IKwOW#q<^0@GFXI|-UeSL)! zsBm}81MaPhxwy|js^)cO=x&rQ*BZ2V^3-;1v#2E zn~y^t3h<6o+RJ(DHCs>DI0MA)uwe%4C|El-`$UfE#Lb!KrMoFNh4I&fTVEqaJQ<4) zv&_vI57XVgyN{EAIoM(fD@56a#L;XQU9rd?WKv~mE7feVfPU|tF*|qLjHQbq1uB0M z`C+~UCEdNQ>7-)O$qF5qtl3<84!MMvp6BN)J=Wdm8YU2rza}L0Y?C-Sqtv>)T$^mn ze7a8V91punxwl_@KFI0I)!ii9!CCm>TBSzo?uZ?PoM(33TsA9lx9wLjwjMuS@s1 zed_n9Pf?GfpvvXb;&ycRvhD?9_;r+`7tFo=-{gWtIkO#hba%7vz^m@6mpts~?n!OH zwM`9c#O*S79=e1_=Hwd9HUs|DuN&(U+kF!aa$!5~=!q=6R&E874pYib`oA=CD4 zk4-4c=b_rs-CDZqIn3pBU9MwL7A;~j&=#+9YB!qg88Bxolld^bvWM4%uot3bQZ9;W zHfKiM@P<(#SmaBfqwM2M4quYX$j_}V>ISb8lQ2UugS8Z`+_uTVkcLC*Dl=Ep66L8TaR259)jDpQ>!U9K_F!q6NnXX^Wu+xs8)~m+Vws7 zSiN=bE4eiKys5Z|peYaNv!J!BL__XX>#YR-f`_V7m`?A{;$z{bo~!`}P# zT5bA$ll5t2#|+)~ym0YPnhS@x|ND*mhPZ!L)#*?A+z%d}Q+@FdMuYARd@%guA8PI0 zrg-W#ysqt4tI0Ru9wxYHVdy#VSyO&Z4h35WcLe-7h(htF_)N|_`3w*I^oKql3{!uG z-YEVQcUjYCd0001YZ*pWWUvgz^b1!6X zV|8t1ZgehqZEP-bWo&cRU0ajeHnRRJDf{J|2Z-WT($;2Ev$m6X*G^`wNwRfbR3Hh7 zkVt?FfYNAw{b^7$7RL(-vJ$U*bE%O;3H%yt^bOsOKYw@M)Zc8G(p-vfUxcIai*J}H zWXZ+q+ZVsweNUz@zWd9cKd_n__=c`{tG|Jt2>tDg%9!>~L7TMam_~wqP6*J$y_;_&yYdFMeqh27Y@)kR1{97Y>)hFFzI12x$hqIT=pH z-#_;(4+41`oqa{<16ZgkKJPdmhKsf#sLHwUa5Ppgv`cET> zp0myun1jQxrxC=TBKX7Sz=t6D6u}?PiKh_!ad+SiXz8P}8ZcJFN=}3R!%=H>>X!pi z!APp+Vslj7;~|T~Ei~LC=em;ZQr?e1Py~4`SHW6KLAZcPf*UKE^O~DI*><&fddIE2 zJB;*RmH_z8J$zfxFDm5zouD`!|2si&3mCIv%xEx8K=#TV)op)|x1wbCH}hZTqssI= z_4O%;qR*mWa4ERyK*b5ei~bIaSN76kZm;#^y`;~s6Dmr=l#+@xOlx3J6pt_(F8C`Z zKq~&=rXK@!;q3DmbV%K+N=gmZ+yWll;+Ou_oE4pdwYd04$8>*RoK#2I^;CoP2sb*C zdMj&Q>~Yc=|Bk1tq}F844O@I*|FVyB@jZNpDWF)ftzEZBd3tue#OjG&^hD1K#arvF zU?(@qeg`wFeQV@O(YE5nVs4}Yv5S(*S$s8-uYZ2O$f;)K;-B+5_NO_UT~8;omuZb! z-%PKk&x#*u7PnOEom3@G`oin^^sQ(+v-lMrV2SquM$z>uw(;fY*G=DXK7w~M!8&5HghA{RJubUnwuldF~0kT~hO-fn-Q>sMLOysN3g zY2L-*^=t7xNYTZO)_f)G4N=k;#n)RlKU?1`LP=IQonB4WN9BjvR*SOh`O-_^%l7db zq@n;otO%`F;AESsK@l&A$Jbjpw@MmmU`Xp!*4=-D`UvCe$^GzVes}bvF;W+e)2peQ zGi~=+7w@S6K1M5K!{~ZxbXRd$skc$W&VQZP(Hl3uTA z?kZ(zwD4=J#!xi5o{#So6}pwmEZ)&QQ^*(W?D_}!3tRLwWcuLVK|P) z2^R29x7BJGzGXI3!g9MEyM~d4W;)3CMAIM{jRO?$GnYA`RWTA=o6$;cgSN}-$2~tC zl*~|G1N#Ki@tC9&(tZZOx!+p1!PZPkH!%q zs_)F~iA^0U8@QHJe^Cb8*1IAaFEO@6=cn*IaC`3Xt zp12(H)A%PrYrq9WBs!Dmv!u^t5-3cPCvz#S9UC>=DAo^)0_McEOrOClsi8s1U}g`2 zzaR`FG-1kk;##I2{LvHo^VkjND2 z^Ee4@TNHc!QRu#w!vi4XUBBe zuZ#W~c|XmLd1zm^zTq0apH7a6f?rqWT*EmQ{Yya`Ml`FJ#O8#9kzFul_|k6FgFn%s zNYjg48%&pwH^G7a8f$bm&TuRY*JhI+{h-wL>!Npr2K?wFESz(V88;j3_k3OS*O+m$ z1c?!vT%!jDF< zk!#EFNNXb>cwN(ecqYg%b4#-heq(v?BK&hPSq5P(QML z7rf)zEaY;rcge4BFm&-S#XFUuwxqN$Z+Z zkkyFx?i@;f#mxv*q+oSFZrkN>+a`b?cK5;Ig8fclq}tND)Q2l0`;kp`hCko&^4n=R zW!ZR=rxP#=V6n`mQBu+}i|H&YB1W@33Uj(d5iU$!C96PB)#bfT3bhogJX9$1uu@lA z!~pCKUnZua6$Y$X>d=HktTq1-y|e6t0qtb$Shqv8AP~W>!T>dOg=>aTO-=QWy{U^L z29S);udu(qyZQT@m>5PszP7a~I#6^M01m($MCJz;#u14&j1f_JQrC!T>gQwQ(APt?2{U^1pFW20#CHGruLaPasJ~W8igd z8$8qpU>gt&{pyd@+wbVCt%|waAGECF+Qt;J2XNugkEfT4nr4CDWfcFRRWPebM zi96Q7Z|}ecN8!9@6GtTL8SX6?ALxFDBJP&C{DmRfe4nBSv1P7Gogq*~<$G{QQDAlL zNe{5TeQ4-w$@E*3GaMd%<_g>o5dV$xhW#KL_V5E$1*dZ=P{4N8EIxy+L07YRQOWuN z1K`A!e>emznOgl-bxa6`LT9J(d3)$@Qiwgwui(b4a6ryn!T15>zcUcPf9DJd2cKt% zcU0*gF#t_nG3g;tPMg;<&tVv*P?%_mE5Boa_dmo1=QrWWbyoLUrKCqvcca`i`mBHatWakn8#CZLlmL(2Z zo49Ip253J}n+bwLhq=7kOJ#T`2pi9c?-cdu5d6v1FferA^-@Gy$g(I1G zH17OXa$yn_yEv&U`DBQduGh4@m7StB#{f9a&TBDna10f8+wyT!T`|o-vsI4`#otR5 zA}#g=R!@^r^kn3+A%J0pLsh#PFAs?+#^W4?&`Ui+Z(c}aeq?onV_s(-v~p>7RIxe7 z;&o0uJ0NojV{y8{fHiYf;0&aDBwBP*R&I+ zW*UVtoOrf3?yAm8;yDh@k-E}dhG=;nE8d})+00cXGsN21e?Fjq>MAfCLY2)OQ(Gx< zY&B=Dl;;85Uuj+PAGjH#u-((i`N{p2ivk9FJ;wkxb7eF?2P?}P0oECgSb91=uNr72 z>xQF{2dQU~(V8}3@?wCRP0uR@S~C>sJee!S^BGQVs4i<1teR!#b(i&cG?HCxPxuj_ z@+GZNSh8t)-r%yS^vswo3asPvCIJ;v>>Jr>65~)^u2R_{-nQj+jYDL)O3;Q-6>TcH z)vVp)&|HbfQJ`wW%P>XZ*`}U+3#wbe43-=x&%A<0u=O-3u(}Rpd4{#_?z!2c!0Ji1 zu*XdBdd;>tQbSy=ET5qT9;oXGMRI!Ps%?G-mY1?y)i{_o^JIenT8SfEp1C^Y50UQ4 zhT>RUo``r(!88<_aUApN>b>#|ZKb5dVHS+f`?EPKxvG#@1Rk%;W~qP-z#(6!=gqC0 ziM*mUiuP@(r$i;^Mlh{+T%#~xve3f@QgL0=EkWTbrlDtnf%C;tIEs_;`S?q&`yOdH zpq^h{1qGQ^Y{2N@A~6Sz{b)rwPrLf(}Y>M^`*9r0Qs@n~Gl zIG$r|I{*f&jO7$XiE!c*xr*`?(UlY^{F}_PZ)-c5q$qrGPu9r+Xz=>y_qUzmOB9ov zdTP!}+Hf$(B?`ukJt40WbS|p_u+}wGw#kj{TY*EQd2+~0P{I#P$!LtDNk!^v@cInz zmhCv)6UU}w;#qp74TFJBRvSiWhXHZwI#POwn0>Fts}%|%k+?dRJi}Tuz{Oe|wTPb5 zl9DyNWH|DCQcv`@WLp%HH}i79mMMy2N;6MTq2wzrxLBhIg{7{OHHTmuMuncDPzjkQ zMYU9L!wyH)Y3eCSFO}WH(I^5oiK`#nGpsvikW}fUo+_OZ?zf}r0Y}f}%#)wWN`~X8 z`pk8j#t^7Yqg_4VV1e+w$g=Syy5v+y6n0kT>Dt8ZS+SNlBthmnhj4&(SuoYrwIs#9 z=yHxDjm}dTvg9>yw^Y=W2^uHg|btQK=y1}KMsz9zAu31Yv9BC4s9LhD=Su1Loo}kzk%{<+R*R)}p3fAF=quw>$ z@_SGd`~d~)rk(_vH7mI;432=Z=OlnNTQ-cZw>XN16Cdj`#hQIlNfe2SnJ2Sy%{sV- zVudB19p*J}mM|C&agcf%rmulx4O#9=ERJq;-Yd7kdIEQBD~_W?Aak99^bBy9a}=zQ zc)AFzHCSK`B3?*5y<*q8gYWAN3IUdQ8mw)=mo$}BNO-{${Mu~bmj+xk6bJSto@%_! zZil5{$g^crGp>*@zomk;W=tw-x5}OrV<2Hc~1KQNn(yduB zMH>`rES-4xfEN|56)kCj!vy!Fs5V^5NFa&PdZ4bUSb@Kg(;9{LO=cb|TbZ!BN{n|U%(Y)%r{@w(=;v6%>ZCnbuU<;>&qwyT;y2yUy$Q5cOAPeHcb zZ{%%hY(x}=&QRq2q@F@jMYkM0v>Hd$#&ZmV%8>*`Gf%fK#a0q#mev%7 zg2+6_$t$)qILff5=Y4dwR7iAg;z?TtoSG}XLQ&tCdQ<}7tQeS%IC#L*tU*auYXdhy z5e3UUwwIEvKw{NK=Y@c#8*ZZ>7_g?EX0V!yhH~=LI}~6&;TfGHX{edT=Z!2~$a-&Z zv=_=eXK;WaV3geB@Mls_Dc<2gPq8W)ijYU**%Wy?f7EtL!+oOW%NzF_ z8xu{mV^3_`wr$&XGD#+$I1}5pZQI7g$;6nu=bZD?yVkwyuJ@1bU0wV8RCjgPQ{7#k z>Z%huZ@04dDDWElT-EoORy*#+y{~jdS;35~)y*3?4U`a?$sR}QYUwx;`OIT0%=K24 z1k)~qAnf-IeKYB`ZMk5gA&mE=8`i?ATNoK0JYtG<8D4vOYc;g43j5csf{Y@frFOgWN|gtNMK+t!tJ3ylGY(aPD)^|a2!aOkrI z1NGZEkA-Fuw>?bqmz}vyf~Wm4pE0t&o5}07=i+K9E{xN&`TcdZXhl<>4L#kWLe2N_(Z`C z?$V~&drD&IkyCn!6!VFax07vu8p9Bs;}}e2w$o}H-YqiEGRC(hY|fQ3=H#TmITuRT z4aqlr8z{DaWK~uS?03ADSdp^{*?^t1EE-W7g#tfWP|lmT>`dm^BZwF-fsAT0iOjQr zPW8Y!4zQPV1jwa($-Qsh_DQ(L25Huxbfj+HCd13N?nr*?=eY(%Hgr-*-1;iXQ$OG_ z7Z{8=%7^4alshBm8j~p&v+2sES*MB%eMtRe!$zT@@79x_wQ(1{FW4jdYW*o}aY z-cl?}nM|-y&0tl&fHxaHYlp&|UD@MXZ-qRlk>+=&<=@fy0Zlw3@QwDegvkfjKX0ZZ zVNEkU@)%By)RRvOMS?C=zN&)!M$@V`(9I|#+Q0`u$fJ#(hS!eES(cm(Pv09B_K0FB zjJoj)5xp3zJA;Doa()Gl(&+t~+~6|U;ERDQ`E`~icOdB(Nt5gPp_j=czZi8Z;yL`Q z1|BSPDfjBgO=a22^qvm{Y zQ_jz0LMbXOS#>nzjQDea+nvX_u%q0;s=3KCs*GrRm9L>qBa4f=TGmdase*>5BJsjF z03tC70j|$Yco`|YQr>Eoh*wFM(M-|c4QFw8peNvSWT`p_RJExMQgoh^5)D|1WY8lP zE=C7V93Ro?{m=z*LN$Fo`hyZJSoyhqNwIY9D$U_27u0n{+ES@ChAxpWzrd^9c)LGBDzt_lTl0}*DjR5Z^ zRELg>0iWAeqm_~>21z^jjAv1r>P?igD0(ln@WeX~B1&KD3@e{-!nI}1xlh2S@}dp; z-q5{9Q&MI+C>=}EjfUda$PbPXm-C;4JLF~ddtxqwse(b9i^Yc!559`hy<^^h9^Ln| z&7Rg8kTfDE*bWFGgwcg!y5IpxK@#WkS^hE)aCpE8VR=jn0xTmY{ki;CL9lI8;5XX# zCenS3aM$r?8?fvik}SG=4md{3j0ScK*D0UF?9*7`q7zsXAkTl6>=X&i7YPP(exqAb zeFrmzU{SODL5y%>tUfkE^~(yr+e|B8tE@_dgB=ul;X2vgvX&z93^5@*PN$-o1~F`R zo4$Yg06Sg{<`1H{uL(Bm3i!ag9$mmzQpi(ipZjnrnM%ORnbKu|{h;opxOZ z4YJv?lemTF5P?s%xg|UO85zr0+XksABd#!`DVZs&^`6hsvy*#Cn+7SqTch~>nL2i- zZ$!$dVF#*{pm?*_{jmi5yYUWQwapG@LQRq$D8ZziOm(L)gU*)Dsh?PSf6XMNdkj{H zbgRSVXQc28&FOK_@0h(c&g%q>>2)Mh>lx_qRV~cWvk}=Dg5CWhbu;|hO2Yo2LaQ=&D7c&as?4mY0Xvw?`+)r&Lp0viGZj83jgU60-NH0d)TH1ldcuU2K zO3T^d9L2c3FEd?n=$$lD=(cvk>K@awB0>GV={g-)3Hue$(}NDzPNV7&qS!hIW$6#I z$~%r&y56aFPutsX;IPn~U@gT&-EWwq!;~>pu)4ILrooXNLEIa2F5s2ieHx9*@{pfE4#&) zsKgaR1UxOoU&hIGGt<;jt`5^MhUD+*K;tvO42c{D=0@ zbR4YI+$zv*7-;#g*X&N?)zJgumn#fxe;?R?3j`gh8WghR;1;y(WxarmJ_zypsXV50Il5+KNelq=!dDnXnF{C*m)uIRTCANyJ_fQLXJPnwC6^y zu(|*0D%FJk0nwy3dHEAZ?H6@M|3z#eoxEkgOht>qM3&ce19W}Q>@A-YE7Ie91cdMT zPoepIOg7`w{0lpE^Q&B#R#R50Lh^pEPTt({LNWw=WD6ZrxKE>G#j!>J$v$@$P-vf<+z34+6S#Z_^u@_||%IO^x_Ugm} z6O8TQn&v}nz2)kw2|C{_w;O_ZPzzvZVD0yXb@}}b4h@-K^zkr?tZfEcC&3zDbaB5( zl{u`q%}(qJYQB&ih8FsZwC^aI1`d`*gZ;Eg%oe9LlfR(yu*UdUEe{tdS~IJI6cyFZ zNeanbynmP;ZlGvwcU7V1&zJ!ZDN_s&%b;DegkStj0!=J* zvC_a1)#d}xhiKZ1QuR%TiI;Sgluy^m% zwK7CXY{B(LS|t{kObpqS6g^r|V(44py>kJfh%=QS+0>%xvyJ__Vkh;^o`na@j0s(FVq;_ zwmk6$R(coW(j(5{&h`1=?ua`&X6Ryh(6?`hFVs6dmqUjV+aLduCX;A45pC@Z;&PN` zAaH&0;0fXKltaW(NokLZ>XhaZOB`2adFYgLL-L!E?$8aa{3H71>5au~b<`{Kvk8tV zkn&^!AT~Ib3d=!W5iT`3#F(~IDy2QvGbk**roJJDwcP7}5d1GvR}0uj6~YGrc~S=j z!TVpNZf0-qVrTDS>ipkKJ!PFO;e(p5Bj;MCi*3= zR1pKVH~N~%FzCA?KL}u@?ryr#AesXhafd1laROo%V$$tehP5^8*UO*j?-Y%-1A~G{ zpK0J?=tR{!ZFj^va4u^+4(Vu*F4qLMq+brWa_h)ttP3T_zk%9`+`uGqyb7b`uyo(e z#|E}}Ja{5_$!wO3QGw5y19{!e-L=(JnO?t^ℜ;Sqr^fS>m2k8O8{nC4pq8T9CST zrc06k&Z(6tLYnjVXM$DxOGmn{;4211bn7P9v(HrW({w2s;ImPIC!U3#=6K2^6zo(V zAk1gJ=8IDERlAEuc1ciw5oj;Q_-g(R{qGAkUN`*z5NJ6H=af=`O8cUe`Qw4ux+rU_ z3As}o3g4SUpBFW^PTe;!UKhCh!KfZ;};LmZGMUvwBCZOa(8sm^!ia(f{}Dp z-*%}_?Y<^-k#=s>J@5EbLy&3SxOg#YW`8Fz)25}OJ02$tq;G$X(d*v=oxL2 zjUv{Ii=l6JsA{Ym>x-KzMSu4Xdigp(KKlM-=681@Zd^czeT=EhZax%h1$+#I_yeH# z51cGr<{dOjmsR@ros%=MeU6mTyIFvpqT5{0nz;S~(8>B$mUcK77B1J2YQ~glI#a{! z=~DAlwwPBZS(XRzZf?)PZ`f5qEr;4#tyn2_k5D{fT;?gb&A;z}02=f!038Jc(9yn7 zp;p{bC!1GdN%$A-@v8A^ofY$6>oC~YIq+TYfdIPH9+WS@&Jx2_>U`fN6Ag==pm-Dk z{?|gg=rzdZh+iu@4HI7ZHQ|G3fPd`Ml7b6NW7*afC(ItZ#^1ywo25&+{NpaB0|yUOyg`(HByC zvW=Gsg7x=6vppXwj=H6yBF_B87@`df-8edWHFqY@TEp{9`w<5T47h8tD$kMaU_zuZ1^;*69gdx_eWhxPd%01>n(tQ0TUGmD^?W?>@7P{5YCBXqC%jmz5{z>N+T zu4+sv_6D>u_Zr`Q^_=Sm{63^=q$-}!mWK!PiPUzzw=l2+qFUFVHb^0FXM~(A# zQj$1R9AbojE6pXN^baJoWI8a^Q5Vtbw?%thQ+T0UdPUd=p8{^lIcD^YqNj!+V?uY= zZQ%0xzcd2V?XweKCfSIIIgsC6J3Pnkm^9}p7&a}&A z{;i~0k0_F8puk8rejA7An(S1(l1&sW3nS^U#L zOfSMBrOmDlZL<&S8}`R5e}9q^oqLzTF15q9J^|~!bta#JMpbtm7%qfq(r3?03%1$n zif?``t*tS7vtz0w205hnh1Xf~qsZTuWHL^Y3{;SHVMnYrg0U#0e6@wM35R z&FRZ`r}Kg_M(rJ41cALC4hIh`hS@ueS@~y6&83y#Z^0ok(yBAV zUDKtx_ZsH)|*h? zYPzG5FgM(Z%YP+Dt^umPZHUt?Vt@GbpH&y%e8aj}AlH;VBQC7Zlft4M zBc(e<6>VX7OsW9mmDNY$qGFS(8q>%h=^yj8L=iWreqyRev}G`$b&4hD8T#@xeDK4V z0KtO7c)E>O3?2;S{0oADvwq7FRvE^^8$)Uvr4h*L(=WK!hs{O)?ScWOm(#{_S;qLH zb{GecqY`wNekB?Vg4F?I96V)_!y+@RxX+-0H?)b?YfjJLgP_ami=GIW2=%cx)htjo zrPa~%j2ePhJ;}e5#<^au&lca(TlfM=aias5qpej$)p&<{DO#(|w@_%SOFob3!1kI% z_cKl0%>(Ikmr1&gD;{d8?g75^1I*Rq&Zu8Cb|QO4==N3sVoaYWJ$aVI6556~9sk@r zg6Kx&^)vji#kg+_@qpUX7uT3TtFo zD*M&PGE?_$WnD+EVpK>Q{mDJF6(|?h4E1PKcPtR|uD5>Up2*Y1<~DOBCUh=tdHHo= z{x4LI4BZLZ?R}uF*O2?MgufF5K|UzVB{-f~ggf%r-U2`^E~6v~zz-XIE5}g73~@pu zlAmw6V?K3HSD6090bh7ao0+31aUnTE}hh6;xgEB*aL zW23U077?Ofw*fO5>SJpJsTPhCXEXt7v==c}Y{wcMQ<4VICRGMBa_m?&pS$2PNh;X4 z6LHm80g%+_T`!ZyHHhtP@A`lj`bRwUYxFbgHEC*KI~#&|;6-#sk$ZwijIi@TmrIIq zLx&9OmEwfWZg~Rd&{~^6UtYjZY6hOLvNhbIW~tp3D>@&lX>kYt+`OZ0XKpdW_T$9) z#8>zf4B#g(F`zcP;}(8!YK!Wq70iIzUp`)1tTSQ}$w2(Qq=Bm<3*ZGf&@U8v3JBcqi5OTk2L2L zB~BQPI>Jp*TR^DG2ZNPg2_#c!i29FT;6pA6)P-`J1x2y0?@1uuG}ie9efALe3IU|g zyXCfiV9Cp6`mg{QZHPKSkjg$3I(i?x+t`2TbKqAG$zGQ4VSniJS?4W;ZGKW8kUq=5 z){~XD+5zb^X!W@1KlHhHvNB<`4%qtt+Qg%fr{qMP#>j1_fW;sRFaR%XMRAcU$ zXc+AHIHJewnfP#hD5d9$;~Q5omK(q#sauXW=E3057Fip&$?fRE6TeU3~OlSKcJMOkTf{UPIo z-sM4fb^yZS^}hS=3LJ}k@Zcygy*|AOFyR;)%^qfFysO2({UF`VJu4h)h~}m zAtF*H{ow=(4M=dEihji?EK1r^&2j56l4%NL5qs+yQysNp0w&f+$w8MIsjDlpXBB_pnlF-sJnA$5c1L1>F`9*aVEiq{!oQzW2@Cx ztHeN(RCt;q;^}LvNWBbIC|FbX9d#_2g@hAM*15KmF3geH`?_*aKYtTKCgVV*z_LOE zwvIIJH@O&g=~&V5#zIl?rP2*6;0V;%tx(EVk>@v$0ZxV2au_-kDP>0pk3!?l!;hZJ zI*xSb!@#{eD4MIPQw0G;bVgQmzleUJOo+L6kg}hMsK;jwJys`pN$ApAu7rfk44vH< z3Idaf^Jeb-lJwh+R0i1doHO25vNL)Wke+%#ng|ez&fvS6g6W z7ObV!f@njjwj4*G+66DN2At76;(faH9&gm zun$RHrj%^iaO!tlXvGW^>$Gk=Y|bHn!h>6y1czm@R&!R?1b`m)NP<{5*NbEi^yWc>`eo2P z#N`SrKs-WVmmBgFcBkurQiBNI1w{k5rbkPpBM#DQuu2wrn;jP&j0T=XV?BW061On^ zT8QweakYn@w#9-H>3ke)(IaCMNxE0TU|fu$DxRUo@=SmRab6oRp#|~6@-+)rm@{%A zk@!;~+AH_o?FFO3B)BK^MZtCs8geh)_T(L}W0?WszBWb?=te7t$~r zy$~#Q`_y%OaZok`8_pW3ORN~#FrI^ltFl+ITVK6 znSKU}4nim#@S?X?{e~Lo8sLZDP-SYMA|%lqMoC*ZWjCn;iFXtsl;#(3l@-yYso_(h z8FF#^Ju4kpC=ds@zcXf{Jb^&2^mI|Sz+0_o^nf(MnB=u&lGg1DIjptGK-4S4iB378 zIC!=v?YJkje{n(=+b30syLiC$RM*Bt`BM!%HCQ@>Y}BTo^2YS^ks8psbSPZ|@AAa3 z4%J8AaNU>eyeE6;qq9SSclABlEOe!K(63N?Q|V=T1(1;)**ppoWv9u(;p7e?wqU~y zC#aGN4KOaRb2fzrW~Dil=prZ_a(eYY1{K3tc`x$M3dQoA>jl=n?6BzEVMM+R@#LU_ znD_U%4D^Brnjva28q#b)h@w}(tmtXEqDH7@WPSzYXvc*rAl)-bJ5AbRFt zsQ0qH{0luJH}o-tG0rMQ5cj1*qh3ZAww;&Da^dGwu1l%eU~e+?J$1@>`%ZL6E@^Ivc9@R7LO5W zq4ashp5b+kfz;DLl<;v&X*uVYop?Evyp%Ix_2wL+ZOP?g zM4c5){)I1FxdFQPy9A1bE?jE!P8}{f4hOQ!Qa$3gE;EiAC>vdMVJQBh#!FzXyGG{AP5 zpreO0ik2Q+m^yYO{;a1&e5v0kdx(>4Jc}Ic!MAm}E60{o(VbLr%n{pCHVwI{aj^C{ zx0D?VEPmM2^-cq>QU?wsP}ueHXccZruYMLyt3@M_AJ9@RUdBss;%_AISd9j=OESvn z7a;Wl`+)07s+fMsyPnc+Z9UCGdqoE8_{`7s+FOp6lqo#Yj;YXr!tqVb5RzT;_!fg* z#>px&+IHT6!y8e7&W}_v zGFHn2XrYoRFLg50WT-a9QdPuH*$TBmuC^J;4(<-0cw|Y735xi*3k#jFx>>@Lz%UI3 zD%;*+LQmvuWk;E~^a6PUgy;U#}Ly?8TY>Bh&S zq^?!?{94d=_#J~v@+R&m9@;;Ig$0@RKFLl`Zq>%8(3qxytgGsBOf!*WlmSudhhw z`h`K>dQ(b|;H>I0FU-)OY(91)e7G(lrzrV@={1k|coSxVrIu4KEp*fkE3-`Sb+`Kf zrd8`nug7_`>3v=i2baxY*PY6A;k9{bT5Y;|Ox~3MDvjS|rt!BRhV5M|d06n9Mz=Hk zh4A%WGuB#gcpM{))!Kv^@yh|C0%d)AD1Jp@G4Enfoq%<8Jw_^bhT z%x2YsdvZ2GQ#}*P+1dam@oyWcZ-s>hiei4IhkGmg8QcE;j?PbhEOH~%WGOz2XZ`FY z6`0l792nlvUN>1%ZASg$uh}`Ng-O1hAEsz~nB)xd$VQl9spVGvG?6md zEAHPP^w~IJTig6zTT1ri6K^|}`F;z{vQMZ_a~2@*7J>5=nCD!d8tI$tbM_Q@kNiQ; zKB^YSK=kaiLz%k}_UnhSY_zH3vlYm6F%?-EK@&i#MqP5U2?PXI7qfm%K>cUaQH%`y zp31+_^F)kxk4~@;N`>`z6A`9%WgJoU(3R!JN1Ye=okclp>C}atwAS{7gmIh*ecaa= zXpY1tnh4l$%T8x(y0KZca|3;U&~vr!W-CO|Z&-*I9K9?_10**P$0$XHx`HZ?7|Qi{ z+If$J1Y>>wtNPP%w7G{qr-1|Asq9wmfXOWo>B!>qh+r1|xP6;B)Vxwt5eE%FXxH4N zMhm4#pTZLJ`Q)~~pMs0di%cnA!TW*FG2(oQCCQD@$~IB?tZL`wJ$#9uC%FX6iJ+o` z(Def!(h5>dRr4*JabNqq{fL0dGl694xe&WTz51(xg zKMnuAx!4`&5JwU4%5#v?9q;sQFEwFh8SIAT8VlM%AAT*D&~;dyx+uKh28cce?6`B0 z!bBm@zBg>B3~MiifqYh&Zc+klam040bh6`Oa(VE<(Rhg;E5yK1^G6NU ze+^RZB*AN(6xcA+XJYtT7?8I;T zmgq0?%qn?GN>2hL&%<48^>S7Ux~zYZ=L(kua)RPhj+i@^G_l{3Wh6I$ljq&4a3Fc! ztpk#0!@tRM?bYApxi~}t8Ic@tjCl5bedD{ePXf*ty(mVX-H=PTQ^{5)mJ4p2EqHc9 z+v~Z`vcQ+HhKnjsy#8x#;SYJXLpVH${EIvn9rPzm920bt*yGa%XY+TFEUUBw$un8& ztPRY1g7pP?z3nEDJXgI0{vppr`{pe>t(vQ~T6OuB&sp%zh2naOAYyv;k*@uT-F2U# z2-}h13vbS`rKs&r2rUqrCq!7a=k!)a7CF*^oltjO1$%`Z5qD|79ujfUzb;{m1ynjU z5`=&+)1M}OAx?-b#z^**@HzHr_cU-d7pqt<%fF^@YP7ObU#_##SOwVq*7$iF$2M^g zDLu4N3XSZ|01u$OLet;BX80j7Q`|+z0`7Inl+3q!Y3GWBAE}~EE>VfVS+%^5)~3VN zw{sIPwAcg|ujA}RKNL^uQ#>tkbZpUCTwo|iWT}Pdip$Dh(HP?0{5OxR-HotX$}HI)6NP| z>9mWs=*6QJ=TK$~45gV}J%SO_IFM5K-pVyUh-|nW(!G7J4&}p(Fb=W^g#+X~GVp)C zJmZxkXUulrtE_doVjR=KFPyp?msXSx8LpEt$3h>TsDD?F`9QhI_fCTRTwaS);w8VpYq$A%g+QB!d|Oye=W8I8=7 zXPkU+&+10ke$%+UOmK%Y*v1jj4PN8r-smzQ?<6hbIp!A6LPrgPMz8!ALlfFCiVsvI zV6fCFjh_FV#SZEHk%I)MG*0=_l@^wG{7T4N6L;T@@50wkQK^6?}1viyh3V zB3;vprajuGceD8LX;rZo`WJk*bG0=xb+WWG|AU<`eoWf!i=htd4>HsY zW7l@C6vRskC>{_;t=a@k7){s7#70Pb7Z}Y-(~h%7;-rbw3GO^6Ie(piKc}XlN=xQ# zNGG6O7d`)7fUTrjMYq`fI*dB_@iQYf>UmT)p?co*;pls(o1A=tO;d+N{iD6y?+-e^ z!ykTk_v!>wb!UT~37F#YaKSddY_jzP+nIW{Y~}T{7QF3JpXcw-M7hRO&JGWc?rmDJ zXzA(aHJRE*iV5J_QQT9xzf{OkBf~q+t_I`NCS#83=&0zK5pci8<*zQXY?Bf^@@be; zSRKT6w2^G}qd1FYF6u_$pVH=+aVB&EFccSgO8v6%u`}1F(W<@Y-gzS0D5|rIwK!?5 z{F2K_si$=5?gm|y-`M^A&ur>4b?FmqlsTL?6diAWPK{PXrwp?EzVW&*`)bF!S#W&H zv+1+;Qno<@JpAL;)ygP!cknN=Q*MkKT`HeFw@>a&^ag4smefzJbUoV{-`_I^JG{2T z+5GSOnYuL&$2IHpFbR5$^h{|dFE<#92Lq(}y`z$EDWk`xH&#E+^bRTtzkGr2ILax+ z`U0)D*-K-|iRgD~%(A|0drD!;Nv7_%!Oef#`MvF|AOlymRnuQ<1D^8iXvnd9Vxmk| za}%zutTv&AiKtK*CHccpt$C zl!#NeCY@Af7gt{@VCmQ;`KA&r1z91%c^RG_@_3pGb6ih9&ds>!V@5bo4J+j3#STjc z?|l-xWbG23+vUp(yyh2+?|3?&fTPvxWwra>nE@Yp?Xj)-(;d{eveLJ|o6qeXvc*kW z>3#o-#?`gYVS_uw_G>I_6X$ctXZp*SEdA-@QM0Q%-P@bX4S)ZS>5l<@v&CIcCr#{% zuIcd<7HV;C*2yhD-o%eMzIJ+lngwBCCf+Mmba@=lab}^#Q3p<1q$RgauFPvg52k!8Yy^Xm$}}wOlJ~z~pHYTKrsw#$WyX?EVN;ep z(+?=N$q1zGR@>Z8*lhLjFH*U;Qn_6-*It@^A2^(~&8`SS9X%`Sx>8EQhq;O*S&AZJ zAX<-kyP*yZSTx?kQ=t|ESSUr;VLwiAT%ZdC4;y}*#Fhy1Vj+InbR+ktL-Ycl%b{ME zyB43>IRU-H4^Gqkk%n<>!A)_ArPYA)xkH{>U)$B+Pol~oAY2y53WIjEA`agRI!-4qcIN;6HT+Pgk<)N4w zOphdU@Z=pg{!0h-n&mbkq!VNcUT9NU z&B&Zdml_H(H_{h=6=G(EO$avA!U23{0q#f9qNqsFX+}mmxIf6u3J1W&vg{6qK9|Ok ztG*erft#+&4oA@y+s-^==|^Qz$2Vj|>+o{O`W-tPn9^!w}+nLF2?ZU`W z&|xg{)wXaG!f?Rbc|Z_g&cU8Ruz+F#UiyDR>jKWc^a8t{k&dSR-eIWm`z@Dz!vSXh zR)VKnT7UY>h9KbR#VnxDef*eueLE|+71NR(j0HR$bn-8CS^(5Pp;f5#vvyD^^NJQs zjVq`TJdBnx#|KWR|46ZCWVD0-GI|DKS#AdZ9%+fqy);w7>CTI9%q{TmUH|Vv@(Y}D zNnx(oz)$XSxNu^&6#t!*KL>!$0t3v`pAg%O&h{q-$5>`Yw(a>22D@y$5`ob38(ij? z>t5fF_hmYQ4b${$cKdl6%c$Yyq+y#hvdYv)%HWs6vDVn`}h*G|}^(?w-TmqwAI@JOeTs2-y zqZA~IF;-mgk{|0tPnfnMInu-LAwU$j@nja&}I!Udd&v(pIo}I{wu!$M=3!^FP9cl za6_q|n`UTC4#MJ*9y$Ghh2x@70x{jvwvdCyqNpi}7+Ai@|EqkF!c8u)NFb&EagrIJ zlL&|Zl}sB_td1%CfjZTVm2E*xp{eslIa zK$@tpmX<|&s^EboixlLa0}U_(`uRT>9@nDkDyHa-ao^Fv*E=i{0~6E_=HJ;cL;XK= z#Q5ABcec5l=}&?zH#3(1DLs&gV1F06dPJayh&!htcwnhMpLcU>QRb~!t|_H*>R6>f zcJj?EB4^0owWn?solQQ@`@HaFS5w7)-|CM?swvO!%+$7Z`D^vIpy3TJAs5~qq{5@H^Xdn$iE^-76uBbu0ne)&qTK%v zH}p@(l_931SVT+p7Iwbjl*}IV=z{vk{lL?yEdF*c@O0ap)-LlLZlobApGUOrj~PI0 zX9PPe$lw0;r?ivj2>#<7O#x<#+sq2g{^ucf_h{W)Gk`L%^v0_T=ReNaZCDLSj^NTC%7q?Bk+8K27g*PqpNRqM{&qWHk*zut16Hd)+Z2HpwcYOiecoka z$cw3I3ywI3*dFk$);}GOW!`EQ89u$V@#IfM`u|Ze7eGwvqt;$6``@B}hnD5gc}4Zo zdo619jg)UAeZp_p8h=Q6X7$y6D+s*ssC71ZJ0)4K)i@p*U=}&@^d(M|Cs>W);Sw*( z;;Y*%+u~$;1pZH3@PlN2`cv9vA;=YQvl5w>_>8A{`Dy}rEO?r&+5h8IU&Z`!n*TlV z{B4WccABOCacrG=@}~3lL8jiPx`TI~XPer7nq~g4=zCzaOMRzF?9}6-;W&2ppz4As zlQic1^M1q&n)iFhS%7O#hj@=#d9dq1p7?;8b(rfwo%{eBb%g6c8F2e7%5}gl_G_gY z-q}}I;O`Rg+1E}!l=TXQC6rfQ;wFvex(lzQi>1;{h@ zU^ZBuvCL`hD2dFPSd!vygm;TjnaoENgf=Ld{zPW}YRL`xMjgSB6gN8qv{Hl!wZfBSj6cZMHPi57;{ORkVd7beMakX+SIXoH>){c$spk;L>?%2#&xGEzW(aDyL zjk0NVg>cQx7>%0+JL4&Lb)~3J25Z*FM%j=&-GZ&DlmShd1$SK~HG(ER+V;x?aFF03 zHVm`AZ)V0BaLm18^|i90X~5T$KW00Bn|=Ik7WTK9*dH^Q6_wPQQU=3{8ee@sKjz=- zvI)nhqO0GlS+}l!cz-QE2M zId{aQzN&NdC1YI2bbeHs?FY|)|6mkxsjOVOJ_(|w%-I8+#qU%KarM*9I@Vp{$^xp|%Jxmy+$T-|DsglSIB zP!ypNQ6vpl-TJ67anKXULRc9X%-h{IzgyP*kC1rWCwuy~-zPd61MWf5XWN~fPw!^; zW==O({_l4;&6FRf@gsTmue0{t#}|XXfGhv@j&GUXb@loF5Z-(9eYT%2&r?4TuISv| zo*Y)X9fLNvVm2GkT5qPu^@^F>Mht||z8kc=;?==q_QyOimiuF)#u7vMxm;c511@GE zE*N3hUl|-E&}UIDJJ9XT+xg}>V$6U=!JrhJ)W37T zILNO1cpHY>R~7rr+tYvjee`%1)q(TQ`u=0FV`9i%6aT*JDXCK}4@LD$nbC4-(R?m6 zG{2wsEJ1977@Nr}kpuq75m!-lXXl9t^6z$|pRPU*vTm2$?)5|;H>+1y-63|Ll)$ea z_I`fxKiO`_y}ihK>J~Ri?3my}u}$U&)XD$K=sI49MdT;5^^olRJ)Lnz-i>sL(wvwm z3*{hxK2V^k%R7_=D<(hiwS{q9;52y7pq-rdKD(l@H?fh$r!HAcerfJ$R4biFQ(C>U z`QQcjwqJ>`KhO&}wFgZO=;xVF@D?GEEJI-F2B5mE(2?NcWHFgJkGlz3Ak+i(oHar^ z8Q|0d&A>qBpFle>u<<9*4GiF=gBIJR-e-NuBw$}|w*55V_X&-fod45~O?FUi%O_Zd zG&sqx%yI~s3p1u@F3udoX5E2zKK?K%!=zUAL6wcJS4cz=>Fz(Cwj;#*y~np~C<)1p zB=&?)NZ{Nhnn+2zgcZmDD2vX%M$h4!IKpC&4|w=kH|#5<6GV>VV%1`jy`B_l`*IQPu1`+3?)lw#F0_tS$Xfa ztN#`<_Fd#;4Fy54e@qOnIT)KBD z@#E2pE9B75-(K8KB{0_&?DhhDN!)weM@FA#{XV{>*{8l(HliIe`0sd(Kj=*(mONb0bHo3$Ne|3~f+HcyZaLtAR}_-` z31Q)+cQCTBcp6(++%D;Bm;k3hVA|{GH_RKw50Bt@ePUd_2%bUmH!`H-buu?L(Nu1s zH>{E61A~2Y(dUdD_SP6K!S{>|ANpx;6206CfzW7Yf>@u{gKXTIO|r z7JKyLX>S#&6}bZuR<(alY-QPd-LV|CMk@~aa?{sFcN;Sb+GjGJ?IK-mGWadg3rcp3 zl7Fr!l0PBZd*#r#F~l+EC18y=_n{}}VRn+El#8YEOA{AUiI+=}d|8Zad1R%WO!-4- znbx7k%5Ja<@z9Iv8xN(*$gT#pyr`{ZzgGO0vatfkilkz+!P=sjL>hswGE57EtO2=S zN&4hDJ1mkV8$Iv(5gU;(EYokACQB?AMw zNP$rp_lsa?JXc4f7mPN%q$^?Ev7$EWS!{}+$Q=qOtyJjFT8m_GXvFv@UhUUhfE6_u z$f6oVNnsPQ3~eKZ;olZ&0|DigUqRKiQNXL3TuDGp-@UA;`+64t6~8X1+=v1C$9O?W z8>J}uf0O->aZ!`d|7mIXe{HGwe`lGSv|uB;aGn@YrTBUA`VNfNv(C=L2mKCS&>BY><6WBi$C0jq1~#dFF(6N2*_m|vLW!wr;nKE^fF zkZNebgupmVSJ@{lq=tp#a=58e0qgkZvOWmT862acg6A$QE?L;dMziqpP1S|vbcd=g z35&|zBdbW4rF846A_=ofs$DCj$^oO4a%9;E)-P_|aG$hB4+w{>U@Ai*X_V=3Q}5&u z4S{qhgpqym6GPJ%N2_b~Xh`!0oO1GE(I4Q>9f50QL_GjZBH*;uJ(fL=DCK;^q7~@? zOk1+lePW2zeMFijoILzt$V?~zX6;XBoq@7ZN5>d&XPpp`zm|?ulgferHslpx7#4;3 zXZh*{z;wWI09s80lO`VyJ;9lBL;;)ld-YIqe_$U$RM{jBNjZWZ(b2|39+D z`za)2_`6R$P*0#?uFoD$MCxEubi4H{hnl0$wa;*tx4+)Qy2+@EeC4N%ruo&SzEJ4a z){XbwvTLT)-!J_V$0AcNEwp##3Lf>~(KNfdn3tZ<`xT}1lF%6~DZxE!yzEn%nBOMR zW*O$Tc`xadqIt7_M%3Cm8N*MCnR*C5L0Esb(h@bx^^E&0Yi1M2gBYo3PCcxf=;*v0 zP)k&4D|J2H^_|Ag=^(#?Fg~J#(B8+-K3wxgaq2dustlHw;Bh#AkSdn|X4PMc%Q5YD z9;!&*Io@l`gpd*c1lH<&xcJh+#0kb(gP<48V)&KbY*{A!?f=8pI|ug?JbS~*iEZ1q zZQC|ZY}>YNoY>ZhZGYqB#I}<+zgu;m=iaB@KXztzw{~i)r>CcTy64j}w-*8>>HB2y zYCnb9gv>1`?+PD<(t1d+6xX5wHLa|-$_ROUG9T@@Tgb8)5yj-KVOpID!EpH+YX44E zI$y|`DgvV&!#_2+2nx;$;c+ z3O^j;7R^|m9!rwM1h&G7~_=R3N5OSj|LK#bUqbE|-&1rj|J! zSy`1A1t=;UoBWTElJtTk=Mjm;L`5`w|7u4 z?fn?V1@P@@${401kA0gLSA%bVVT)C}`yfQ8Ch>0Y-qNLzSwEfIlTsNJ^i#w`Bm0^;Rd#RT8BH>9_ z;~ENdLhnkNH9oib=+GDlrIk#YUisM zu1gx7$D{N9q((oiKyT@DP!(SlSguep&p=+JxSA?xC#kc{WR$d%DO;LK9a6HD~fkFpq zTrioZCECU_Eu&VWLsEOSDzCixeA%sn(`KwI?9twOrH|Jvh<{68Qk9rk7PHfaV?UdU zq6zzT!Ee_b#fKJ3?M%-ZU%qxpNb_490z^VUJv1zKfXmWHY^j}EQ)WNFd|w^*O! zCnulgAML+7)@9YuHEgQNSt|gfrK-a;I~{weibjd`Ph|A0cDbwDvVFgPIk!7q`>^E5 z_GCUMPALYM(Pf`)9e6X4i>E1Z57$!cLT6^dW0?l@3^+w5-C1#*%SipIaA<;4a?a}P z_!Oozb}c?tmCj{gmTYqHb=ZD74AmLL4+{O3WAFl&g{#ea>?!VK{=fJSG0mmC9L+1T zTAw=Be^`H7af}?zn+vw*bVjpqcZg=TJP7Va4mTWIMJO~+$3=mWdh{dFei+h8)V60kuV?W9&34C9NYCwx{>NN-Da8;3Ga{7j&bhF2bWd!ws4XrAgfu|`R>9DWY`xq~$J zmaJ<-x0bPJJ*S1-h6Yt*YiUlW1rICI!3-}hSv@85 zUB0E)9L*10eBf0*ks89?n#Y={HII5NszSj*l_)nO@?uM85Q(e&oY1g-NI~}6UQov3 z;MFklToFIkEiIKY^w520yc=v!jWa;RY+cvV49eMJ}!!If3e4z~u<*Q&J8Ch3H>buEt|+qj&mi-U{j4|0CbVyA0{mrs9f)_x zM>|76B#oMdY6%BTQuG%sc-81`G?BFYhi&$~fblFO+G4nNNE)A1f5QH}pjPfqYMilM zmx7c?bd>+H@}kK?;2^K^S)N5Y^eUf>nV=~pUlUUuM97|;X!}GiDX#p|mk@IUQk$0e zaCyYsxbGQEPeMU)suA^hYqlGJ9VuSNp(&^F%BV7*z=iYtp}EjGsN}DYdrXljIn9qU z!(ds*J3#N-pd1}DV`*lneR+07#WjuOwrJ_zfty#ED)K7q?NHxyenA;3vo#N?@V57S z>j1$Xz%h(TAgPI%%mc>Yueyod@82g-&0nope1!{AsTSO`sk`n8wZN!5c+iLX46Uz6 zu+mVGhQBkcw1lfrSG8rOmn-`|XuKm-7V~A4{x$kYD)EX@x<5=nG8{?4Jea8&eD^!k z(jtL5C=}WW-JMLrax7!rx+JQcw033Wut zLrzRNFc3n%qDmM}WD2f_t^`^X`ufS9cI?!tggIUTI8~9Ib>sG|6#7vrbAh+~=i#o- zaVEav4*za&8O~y@bDY6eTH#(39K)Pv;&{-m$$5vQeESy{nujxIBG}m%#*M}`ZI&Ym zFIJmBDWrBact&b{|0StTx$L!g?G(ZjN~Ce>6(xeZ>CpGO&qJxUOMnvIj^c9G( zbu)4GsD@Y~U#bRl^WZZ`hl7%k6EYKT%@J;f4CDG5tAnM4{KK}Uf$|ilCt@n;jN(y{ zT+*#TA5o*T&_biBSll$vcWBVMOC%|X+|?ym@kfN9=26m@VK;YV^buB~O+_R=UrvV1 zyhCQ1YvEsBaAhWU2A-_6G?lGQwW=hR&It1&0|Y{8C)k^N>m$CDq0@VBbp~d0)Rr2U zY@=eZW^D9;Pr_j~C5c0U0@SU6X2*}npG0GB&~{f5KTPq0I_y7bvuC!f$Y#r$LL-(A z&X3n!hT$~C*B^X9OaBCV6><}FyMF{w7=^I<!?q-O&~yJFaYT3yD>yYjfG~k~t<|Zo3ZeHJ4wKXBiQ%TAdm> z7q2qDURZ8yJF7C=>t@$(SzC{q?c!tbAjO%Z=uVOrEQfP_{nLaQA9bCmX#B{+lzcy2E0iaAW zkoM`8MP(P2%UNxh}0_4qRU}tCe@veN}-?)dk{9-a>_taYmAEzPIHDQ%fhM7lxLYvq$_QJhWeFBOkdTg^8OjeVyq z>p4HXK#+ihD;$1yB%V{TKpdT_#xQfkGxbNc?s9F*QD?akEnb4V$i7+UHM`%xFL` z!25ycFHJm(nVL(fF1-}i(}w~Rl|~YGFY&HBsg>iR-HXodyI(wMt{s$|UG%dc0#UXG z0PEgrsZok#_+D8GTWOwLK6~*~rcySi@Ve(AM_YyEYvtQlR{{8nXNpTtB`3GsnGJP! zeV>C1@I6v!le;hnXKuz0og>z-)d$KS_d4G2Xg_=2yY;sYknojrCuB$?y zUKRNl+ZDN^ih#zmB_0;wdyA1tdaIR2C3?o&y-J}uv)2o=O$kcxF*R074z{YUJT7*5 zG958JmSFr;Uow4eJHq_)pGlh!1nDnzwMb&87v9?wm--*~pOrn2qY{n`y6qVJhlb)& zqr8+MPrO!!!}Nak1AQ?$Nu&PlE7IGumUEln(givkx}V!Frl3OqrA5v9_F{K#}^fh1GR3* zTlbGL!yclSQF5;4mB0ShT8$@bQDgZwc&PgZ{@;F{CWN{7_X`}TmY?s;7la_Rl%~JX9-u9Ug&X*Vn>WoXn~)j zlBdEq1GNDOVi%1(27gsWon4?h9|k*EF)TQ*X7`>eX34{Ve1-uf2ra-uE$^>r3q;3W zG8Q$^SL|rQ4lFp(4W^k*nQWpg`$kR1N$YK=Q?FN$(LuGEHl?e48TATYMnFu8lK8-9 z2!p`vQ|J@G7=BckFdonEUlI=feLnh%Tt`l+3i|^r-r7QGF2@PR8`?FUX+zD$G1j5+ z)xPOkqLc39Z6Z=Nrvb%g@V}`@U!oRs_NkR^gFEER^Tl)dkHTd*~l2^SwXk!R-fx37d{_crV(! z9trh1oZHNfw&Uk#Mc?qNi|hnpz++<7=CxL-IxG`78CiCJ&=DT^xpR%gFTDFyJ7yx+ zz&XvMsea17tRq4p9tL#q6~?vanKhWK)32bQp+drDG$Nj}jN_wzFna7(W8ymWO7P#1 zSnrz0aDT!ZamkqcrKcFvdYkRl*PcsLL-bj+B)EID>>bR56I2|Fjy`ATyzM#>Y{86dJT4(Or^(J{4)`bs{v?<15LOt+62M-1-a3gG<|sw_8+7jJ{XUiC1ox=pp?EggpXzq2_lIQl8^ z+xMpYVq)0k!HkiEq`4Hq)vL2_gLR8c?yoe8FQW!`{)h|#Zu{^4Dj)xY;6Ok`Ko*hi z>A*isCkzS%g!sdF|A*j44i5jJcaG|$-3B9KH^zwoV)tlDjs#4wc>*`3lZ6$C`UQ(f zjZG1%R6-2W^Lba2vAUgClsrqiMR(XU*J~F0bh6l5lVWEv-~~fBc|cc)7%7Sf9tUPfiMlqLcK|?Wpj{s zxxRLNq+IlVSikiz9TDHXCPF;a-{B8R^MHyOgH2V5c&{LhIWH2Fi2SW=bLFljr?jeW zC#fvyHo~%W&Dof`fAB?=TsS~Gor)5Uuc1xAx5N7270B|6vXj;`;yF8>_RUF9ziIGW zpy@lw6V2>1T&|tj`3G*1trZ!B%8MyEaa6uUHu}ea<}?$!2tU83^~`;0N&><34OkaM zcQ5P%1p+SAyOKKZ-6fkq{`~tD`Nl!-EiYi)~EOa^L z&B@O`@>a>h6>uNScgjb|@4ositjq4v_CU~dxMp*0RL{MpWp}+o!<Da;Ng;N1lIwg8=<+Ii(;dd^z+pKfl0%fKdJ?yO_8-yV%?QhhutD=k2l?QNs*| z_r1VDO5u=7w3DBT7R#i^y>O655lJsh*27CI03w%oPlhaKlHr|tHYhy<4%Of9LtJ4O zZ&K|4C}V1b4)sr1;vt8P463M~`R%Vxrn>Y^5x|=nHDP2n{mh)N1O6Nf8NLdQ4ZPJ> z>z0C&z__%PK^M?k)2sj0p+W^mGD!!vrwb~1!#(CZo{oR1OZ49D$@SfI0UXjb=I`NA zk*&OMzBfvzRjCaiV{etoU^m``l{tEet;aN+kZW(3UfcJ1i9TnO#QzbF+SJ+hPY|n- zRy<*j=d^zqFVgb)1=>iTLS_fi;Xf9Xu8j_R@!cE&5$zjj9P+K{veT!9+(4Nb;=`0c z1FT$dD*hmzk|Ckn%i`+lp-*(e>$ZwlaBkC=Gem>c?YEJ_)*J@Yh+alNK1}*6JvhL% z=et-?0OOYQql%?(%P4l*gBJfCWHXRBa@L1E@~;izU*lCsfVL1^4rMra4BohnEDgDm z%LM0dMZMRCMjO!%wcu??ulh2p@t!r)V&@gEsK20u z-=eIT$Cn}T4ab@I2Tam{)O=r7$nK#*>&yQmBPx~2c1V5(JQ^Da2<^WYCl?DdTQi3L zDw+N>>=#;c(KsBKy%=u#mQC3q7vy9Tp5l2*)mT_k+j=O!$hgp< zOD#_e1Gl{>Z9$+OlD@KRRRE}W7?txLHsfhp02@OptwC*q+4r;gcj@! z2N`8}N*SnGlUwcQP(f%Ih3uw1L9vTB`6^ylH+Y%C&0Lu};4n&jL`%7cQr7F(Dvv&FOQu z23`Zk{3~{~LgCZ*D>;)^BEmLrA8AELLOcab0HxR$3iboIME)DQ`{NS z)5S$?8kR4@&g_la7$GUx%tnjm7v@~~+UE7%G=PZN9fOYwm@H^NseoXAaV_RV$31#o z>hI_nvMK5}zg%&=KUM~=eynob=rO!wdVoztUxE8^K4>s433|>q{e&Id>w(k>dNwo! z+N*c^wps3?QId1!+7!^}7hhpC=?Rad=r#>(ZXR@c;S@}q66X#cuaVNU@{ z)unWR9`cDAVNBp8K;|{Zyx5~mgRzHJnJ{xMRmW04yYqi?RFe_|y(0Xhbu0(GV=?gp zgwM!}hIedox;#&4umAOObm;8xb~1cgY#>h{!0-FeG<=3FOR{zL_-yd;`Ji&MdVj4i z@H!E9%>DJ8&;Ne8%5W)I2x8#-c@d8>tM7aNnlHfH@b@R(fy)b#JR$_g98xi<^|uU z?Ou}9LDADOpP70HVl>57^JPJ-emCaStE$_BQ`p}2vHigShZz8as$$D3b zn#mXT%}$T^l+c%bYj=W~1szE{448)=m%j9??;aQXjoD*{HJVuU^q2k0+D%fO>q`^a zvA_(J=F!wnXRaOxN*pyYEII;|vIbiEFct@-;7V9bw0uJ(f*}X$@QO+#;$8iGoEw8Ce!>dPwN(K-b`r_O7+V-A1c71CF$LYxbq`qt4p0#qL(T?q-pDSSO|ND zRFNIgJT3MtVWGJjJuLtoy=LlD9sSHY5v}7JXv%NtW-}*I*FK?uaZ<(3!1Q^OrH3x# zsM$L0w1uViIN35dq;*pk8NeK46tR*$%e8u`CJpDMMagc-s&h@eni)}T2_iL(&6(z1 zdnLsIoa2_$(2X@=%$)k=QI?$`YB>ruL_GH`rd1Xb&Hv94UPbTq1BDh51eC(5=G>C- zG)kvsW$MU7XuO36gTd)cMu8bSUWu@^xw^8E!QJ@MSH?lTkVWc^5I(*?VrtEn66BDr zN()G2YM42T$Q-b*FXkv$i>@>OGHlZ#MwB_?;8=8GoHwZEDJ78|ZrsUF)6|Fsi$n8pp{LgMQuw?z7unvQ&|*nF7;A}n1l_7i zJsH5I581qzCgZ$;<+xqm|5iB-AF;1rVTDsiesa>Q`|9hdmy6VorshJNkMyxGai|NW zYF$WA@oNh6iW7lafA!Hi&!DooTWGwdD^+>&d__iYwn_s+zh&Wi8GoW6g0sTwbxq`z zSL7&~gQ3#*;8I3ew}}Cal}g1Gfu6?X@u^gMF@u^?6 z^n}x++_%T^KG=KR0vHU3=TtUq(|O(+DNwUg_3it|PL1`c-nHan-BP=8(F$(&yhps^ zbTsUaq(5x^{FA-&|4}9Wqj|EpkOl#MG|vXO|7AGZxu_Z$+x(ZV|1V8WVS^EK^g8(o zuV|Bqp`@;ekkTcal@qosS8vp|df3ghi>_zD_ZY7=p7F9?s_Vv<+VPO)q9IvW31{UZ z)UsF|=eXf>_P`*|f8lbAC5_vJ7!9ra06e?*95GHz_O$-$Rq_?p8G0= z(%t>|H2G4>o3LFSzWTUw+F?|#c?OVI?jVe*oJ~xE3l1U7T(YMM&lmP@L#Z_oY%-zD zH%poCQFy1WD>Oz|LJSrhH5nvOBF4dX)jO%AfU;fMqU^{j*>#Crcq9`wgA&Z!+_H8Q z@sNXAsF`$#GEF!#a64og6-$ds6aS@kbU`Ojn=Q~msvvG$i!Ii?aIb$t3=dmlv0~?B z&O_+HZMGjxrrofgCR^;a!El5>M9W=1CPeWk4VS4UN56pWvPnA(s{_R ze>~+;%<2GZUpNscY=rW%-49NCH~W3<=G>wB6>gOU#WARaSezsu^Jov)m^F8%SebF? zJ}|~AXX?O&v|^l%K-mQngk3(-(W*srIaMinxAaRgAWRC?Kl6R>Ag%c!KczDk?T_U|G_B7xNIdR2T^ujXX zyjr1zMm!1GG9zWq0w^%8)Yw8a)q)WTr2~32ATQCw7kz$3q}~H$R`i};kxX9eP1OM! z+wv9xt29~}kltKE>eY%W8(qLTAWc?Cu3BLQ9;uEdhRKFML?}TqgLKG=lm;gK$P{uc zWnkdf+554t+vD&4xM$K(ks6z|wJ zpRK1mH6xJDHNK<>qc7Q!JdyE zvzd#_&w+98Nt$%}mzlFv!IS;R`R|)QH!Q6PFr!ro@(68drQi zpCqwiqTpo60x?+2XCHdJeV(oe$Rv0Oqs1AD#+8s`1&_-Fd$dFiuF`Jv=ezEk%=0W-_Q0B()xQIl+YAt-NC>N#2(II6uD$?OIynW?>re=WZ*M;1xB@R}TO9;K&< zE2U<=;Ti^VV%SQfor{mQ4!;cAg#@h91ffTX0Cei?7EO0-XWaA9EXd6WLIv>BZVX@z zD$F-ot7}%UXlR+Z)rY1uuba9oQa?Bqbrg4IAgMx$S2Z9ltbq0TcDk|+nRYbnw3$Z|i4jEBaiTNE`}+9`vPt;DhG zRda|Q4Y0_t;x9=}U7P`kCylXYWUk=;j)O%~uaPh4e~kW-(XC0w0v0{k^!~d?I|Ro5 zUPP2%0-b0)@UU)>({x9*=e0E)e3*QWXsN)naO{Us1fr>bbNei#9cFZwZu85esvy1kMTyDOt4dqbowtxY_~ba$)16+up(?l^s&{D;`Q4HB=$ZuY>i%x z$ezmF;>9f6P_)9)q1W=!hhfP&KLMz_TQyMma$iQ~@h{SSb%6EwAc5rM6EYcI)}d)g z+}e;Og{J%~RDxY$42~ApG3t%bXB7JG6JQJbHF42c8cLcU|*JlD2keAf>`6cBh`c_$RvvHgRlM;eusI^*~7nmoB_Q_meqPWiWHpzNF2zUwA!NqHHu(?HBAo= z3ik(JlIrLC_i>#$aGCpbN6)Pa%hJuRll3>t0WXUa<=7#v80f>qZ{+*g8zN6aqZkJ8 z+0+soXZ_*NKxA-Uf$|JNG+&l0Bpyawd>vvDF|1_Xrq z--eO9nX$_Mn7bFba`p%8h+)@YZv?PA9Qg2DBFt;1ftN*MftL^f+v})mQem?BgcOfO z0|V_w6z}B0&S*{EDY7D}dpNfEu)#w9kEgBU&a5pATaBhmV^OtnHP`XdA}4uAL8Pj~y(+g zna-wq>a6yA?q=7O(fG^hq8WhymAd_%VqIfzH+5B`za}BjY#a0C>YtGFb7ltqkdIpW zEI*4ri)d=XjV*cGPd2ObIeHD-vFO_9Q5B71{oK^);uz-HkTYg`5scdRCJ)99 zd^qKXj-WzS4TWDWIY9gd?{;0eHM1OU^}CocPJ>rf z^*%3*7oD?}Cy4jMW$by41kvYy8ZhxK{wW-7466RnRmZ8~3p@9Y8U$!J?H1hokKq^(Dzls`{iZn~3I!T5Nqty=BEQesuh$C*&N3T&n=-z7vk&3FI}vI-*I_f>MlY~Y2b`wab} zsy8&NAdMuN#2y3}k^z+hk(dGzqSB(40)?=)MzdnzRQ|iy{S0oxP5GY|l9u=6KHg8? z!4s4ug}iXMD_+L-X7$p)!lM?ci)p236+*+oALJwbNe4*G4<`g_lOf~BJuMDcc}Osd z7Ip&-aU1WYJxclqho(RfLq^9vVM{SEHn5tPC;B-pB3~73{4P^OWZZQ5QSbBDK1LFV z#j)#bBmVQed`vk8+C&ubK7ZvyG-5@Ij^dj}+n)mkyUjrV_vaH}(6Dw+M`q(ukI3uH zLbw2}IL(khQ{?hKVtyFKl4JXgoKyY+PBcK4vY!vmUJ*ZaHBQp5Dr*3*nJFMji(E%V zbLSTk(`3hY*2?$MY1Quo*%*MZB{YH3{EZ`Ym7&j+?394x-=}SEhp{9%*?l-u#Qy!K z6*i{t$Z{EKc(F0c!d{{AMJZ{UIIYT(_^TT2E$Qwrd@k{iIkkNm<8BFGZcUIA&9++!4gbeP26a#}=4l7uZ z1eQ01Xp3$)l=oYr9xoXP*rUw)rTxKl1wk1hknyA*nuI9j-TL}*Dc}g@^W3v{cG0RH zn7@9dxp$Nf3|c>dZd4Hum{{TCOIe=_dXNqbYNIp>Q7B}P^@H?#-Ce}qNQQ)~2wEuJ z#fy4)l*X8)JU)$k#BA*Stgb~~FEy|4>G6XCloAzE^#H!i zg>q0|O+AiJ2mwVVByE6%dI2>~T;teS!!*gpw7*;%CzYqp9db;%syMCIt2kBlB46gy z<2xv!uDDVy?HY;vaSHAaNpbz3}=Q+IEid3(CF{(O6GYi(tJJiW-5>8owI#|9f(t8sf%?Ky;- zZGs^1nNwb=)w5P(Q#1ZaS)QD2@;mu~3TmWR9a$={0Bq3vxRcBU5PkCfm40JV*Gr+* zHIjD3pMO`DtI=5#$S5@~<#sY=WNl;BNFouZIWfu5XLE1Yvo0QoZAo$`@!}b2VfJKp4GbSKHW+Z3jSV>VK%@4r+$_DYz%FeFQ(yXXyS=L_qE4buvmB0AD z-ej95+PCg+d-MUo1ffR#t5CmDDU~EPCIt;WgtO zApbN^!_^Vrhds-x{W-3p?sgNgj9d3O3*?(FOZ*dpQpMuO9fHj~S(aY9>dE7k7YxhaDqV$HbYu~0yVbo6e<5I4E*h>vp`fkeocx9?C0r>K z@hrDGq#%b@4BJd35)QcO-a}^hRA*$~$tuyWplS4-aXyIVE>S|~Q&Co_uDgO!$*<%w z!`arcmw?A>IJ07E$tdaV)qjS=oj3P=U?3wKR$f%LRa_yQoSoJ14%eIyab%Z7X~Y7z zCuoYcnla0PHQ}*cB5Ias3Ne;Wh^mzbAcWZIzVxWJfQL&B0R3%eG|6tU0?&1_RBNr8 zf{!+IrBL7;%(IOh65UvjXn217kU}s}3iF$%8UP1r>FK|*GO_5V=jE4T%dVyyqOQ=G*yTcv(=~?jeL*+%l%pHs z33#rkt2-;DhbkJdE1FEOOM1)>-J0+Iu(7hbPP z<(Q`)8bF%IJ@xADwz8(C;TB~?r~l6{sXJP!TU|Nqx8-*eFk6P`h6*59C{w{{{1k$2 z7w?KHJ@Zea9?mdT$ZI1+9+c>vcwByCHHj*pBtoRdlC!WwIF!NTjgUwbI(G7-vpRoq z|Iu8Fu&P2qh|$a-*l@6pr>iY%YmHjRaR|`!D!^Xgw9L?Za(S!zuuR1JOF@rOtIrSqDHG{#4YWr zxiQzwZGQ+VeXf~~M_?oD-w^=FcZ7dm%m^1rUND8)Xk8>6L8m2TwQ)6lz04KI)_7cW zGM&U25M#;i^dMO-lL6YprJg>tCbT9<${h*drd8|Gf2sDd@4!pqd8(T*!kG%wyeEcg4y=B z;8zPn85C=oLrg3IhkOv(Y$kVSen&!4u55R%)$z*ZMoD4S(pT~JwzAY`xIvN?59gZm>ui;7WSTRRJdmV;tc4K)lpiCRxI zWG@kDX6*Njg`om>D`<8e>TOn5R*e#fB8l)N-3Cp3ENd`qmbsKTsie7i8M%b%i@5FC zXCI@hj!yLDhPPnybv>q8tSyRsC=xgU- zmrZau>|Pu3xD`vL)sKebbKQjtC#U?0w=WjjLmG?4`N`z+IUY|Y2!5L*sIiW0;a%5* zOuD9?_^BycADhM-Ehgz|xPKf@aY&i2HOE66GD-w{r}J1wrO8t@TS;xpO3>0=c6u%O zGyb%kol(=!&?F-`MdN6Dv(}@bq0tY|M4Vy?62eU}tJ;-yU3ZO|&tzJDk|FhPYwq{x z8CrF-F;4h@oQ%R3TUA!*XU`NPPD z!jIaG+~t1VdhLJh-D-NO%)!f*mX>FZ;QwlbL%{%gMOO7%=2(y;49L@_nE!3 z4sV&dRoZ165F%1tKezFAs^AZ>>-%)W5Y=0r-?EpyKD6(%jpuvHumyClTLmhek)XT= zemnJ{#WEn%VjUhpOp``+R-GmJl^e9buhifB%z=OCFQ7g(s8%{ytsj zZ&ugy6;`9&10aH4Eo?J){h+oo#nrm@P42WaIApR>%B{@Tl+-d-F5l3BWzNz z@^3u(5@+Y53~w2fl8(+51DF3$BfZy3_9+G!>x#GsaimPoVkAB9JK0vNZm|G;W{eWEY5={FVrQ2Dv0pg6WbVFXxB;s)l04r$==RL9InJi+w>Lvv(n z@UVf`DcNr;QXJVn*K_r34*NW_$O1G+H^*$G`IkaumI#f5pSPkvjxm+S_8Y$(92VT zzTZ{>;*&F2I;x~yMp@4ovMzDI8k?DNICTx&Q4;TjAAZ9 zuwKbdP1moOwf<&r&PHM<%x*&%|M>;;M^9hUfY?GvThHcqyWL0(mi&#dT-;AsaooX8 zug72EuT7`DE5FlE(Ir+2>}N<2&xYr&_WRq_HZM{n%*H;SJ_r9MLZv8?YVWI_RdT9D zn|5&SUWaKY%dS+XiokLZ6uczU!8N-C)HsGYpe%Y+6Oz;Z#_-UCbNMB$()x>j5QtQ0 zrist-hwL{2O=9tyI*kO`y!a@P_pRbYvUFTU%aN(fD_7xmMqtnWp*4A$p`~~jeIO`H zh9|{1){BcDt@LY}Ljsu1Q~u^|PW=s}x*wQP%hg%0=7OYIIW@#Ek(UQDWE->i-{$6~ zKXsn&ey`-Fh0@D|?%kXPY!7&7(D%*Kwe3MC+|@)-f+SH1Ec(Ou%cy_z?8l>lj-ynh ziIMr;Au6%%5}(zB#e0M*UM*vUzKDFl)fS~VAq|pGUZEtx71>V&_L8$0k=bjd0=0CT z?WDR+i*ae{HC4KcTzXlSvA|0|!o^kBwfaBS)eYnlS3_e!-`SRXjdCsXE@*Sl*W3B! z4>lCJa2TV#Phi;6aKm0wWgV^7K5WSE1I?LKv42zX^8-d=@~ zeFDFCiD!BybFhIv1m8WF1^PD5Sgv%8ylM_oTmPq*gC~OT*ZkJ+zreq(GSIT})!#D> z&sS=i@Je|=MZh@^%zq!h^qe5%5f+>zmCBG-oDZE~Q}mcrvUxs=02QbTGOGCG2= zs&v}4A(+`&j&cD<(!UXN_Gh~Ud)~${r5o-5a!>kp^D8(G%#63M_iJ|yQr57t zc9eYoFHi5I_1~9=8v2eEu_^Gb#G3_N2XSs(E++-#e+(0wsoYSfrhS72sTmmDK{Cgu zNO23gku!MY8sbeY+Y}jmyK@%MO!6V37&lxaw`V9}W5D|Mdf@o)GkRQrF!1Y5`h&n~ z^9cEaw^2g9h_-Pngfc+c!mFr3Vd1ap6gfSzAs~ricyDVWFzLrX&;Mu|Vi_H~tb|kT5?@n7u*(~vd-I;p^ITRjBGKx)k{}IH}5d`^T@{f3hIo+VOa}`^XfI@*`vMqE|yJiE4;<%1@z|= zX&e?@2zCB84l&Rm@x>nzUkKzN3l`g5Y*O@!6dZP&dV!vYMx61-t8xt|6xdRzAft$INCNgS+%Oj(A!uZ< z9I6AGsWm1yRqTWMySQ7NgL{gXuC%Vv2R@yG$`wS zaxrnhL5YdvjBaLJ3brH2& zoyDz6S(kXHC;&C|cadrRJc{hIzUQ-;6ek?%EZqObRhHzyKnq`$It9pS&BRIfRF>by!!>w;aQLMeAl{;cglJEq91uc)b{3uXpw zp%itT{FkP4cSrM7W$>k(T)*ufK0|8Q|4-7sd(9}Qf6ar>;nfJm;ab`<{#f6mpNIx+ zE+5hwVZk&;H$(PDB})*JsFA}Jz5Ge?RNdH_gZmfzz+-S_`EF-mgDK|yQ6`Uic59<%K!Y$Y`kC)5T@;`Yjm1ZQ^$j*&& z-dIbPvNq?Wun;9FK_gmB=nR-|-zwd>=J>!ezUHI9NYspI&Pb1D% zXKT~V{NS2TQD9`QaO~_9Z<3Kg`oPToTUl{{j1e=lJR{zA$sEL{e{iV~=XQr(N!xEd zXzqFck#;3<-Ua;e*-zome~`CDjJ2W>vr!VHUoH&!)_%0}{+*^5f1H)%nPBzk*u;Yn zLSVO{d@^%kKqCeYI>lq$bd!T-6bZqvsF@!LX+fbv&l6xV$w)zNv5s!X3nCN9XgS4| zu}=kYe%%`VaoiQd5}DMfb{GdXxlRu&l#h@&{hPBFmVP@!n1m9m6X{KuifIbK1}t}Y z`61NJjM5+S{2C~X>Xa}RkcDY-q2G1C>%#&8RE~6NL^ePoXIr0u{GvdQ_H4yZ4s`_A zah?iIe#3hUcL1q$kVjOGS#`8zQim#>pR3GK;PJfWvI+-G#6*XcIVYn$^~j9K%gecu z6J4g*uoX$LqK^d zk=?ex20X18p6%~!--ke@#5dar|82X1m2_nrh2MayE5Qk>#q#p)%|>`GN(NZ}Up^zN z$mKsums>HN-YcaflXIN-6*z4PKPhQ^pH8LY3fPNZW*B>)`he47bn)K^ck_rSK*46p^3uOIAx72b~+GF=F*7<$lf4UxWm3oTB)`497>4 z3xaNj-i{7%-Ckq*7|EUppyYGU&>1uvseG^BjAfkdqDkA3GUpj{jKS0apYQ{- zIYW~k`TNc&UWkC9YzPYuS~i1vbzSw;CMe%{{59z}9carXm&z1wMw2W;W)ry~(ZbYtmj4abeG;P7CxeZs zEusKzThQx^ot;m8a5K%Z%X81b&wGQ+BN$^!@Ld^Igy5CC$n7h_$ zGS4^BbXOzr1c3fd*sMPJp)% z^fb2KD!J`&(%>ygO8B+HXo@Qg56oG_I%M*u8!4|0SGO)lW*h4Nqw6iB>WG#oVdUZt z32woii$idCmteu&-QC?Cf)fG+m*DR1?(Xh7H*e;f_07D@T77?XuXVet>s0Ms-KWnk z@E;yiVHb-UW||Edo6XrtOGJ8BX$4zO1uPsuvQZ`6kYz(%R@?#Cn5!7+%UmAZAgy>g z;2{#nXgywXWYj?b9Ju!5g74eLco?=Xwm;)wp1cqe5YW#+gKO$|uzn~;(bNSw>#oFZ zf9r@6H8|)tdfLe0jFE-?t3K#)-5f&%@`0T_XG$;94{rN}DptKABx-%@smH4G9K51I zpS2DZQilIXIu{SW%Qa@omIrr|uKn^yk-?*9p6+XX7S{NIYvH+A7bgT)Cj(&2@3%h# zaC-|%2GWpH+M@QD=nPIaEzAr%EwPtP54;v#F@P56n~q+bon*@mUl*l7 zG+p=AEK{6tLzM)}Ddc_A4ZU;UY}?>wQm#(&Xq+lE%X1ngcUYi)F7a$UJ?LsyV)Q^R z3aP6=teP3Hh$?S{I{?ySr+($*fIsg=1hxX~N8jR6n>G zn5e&+i$=_e#@s%WVrN@{(s$K3ZYU72H^F3Acn~hW%$4PnexYbgrlC*FBv1!MAwUXV z6n6aM&##Z~pAWmsS|F^a;6XDq_Fn=fh(3+M`{+{i2gP+_a(Czk2S{4IB`5zd4unRz zuI{Dk{n=Fyzh-}9uZt+7w?7yF@$r_{{Temq8Q|Jzee|uv$GpM5hhk;^{AycF26o;- zE_r~Kn{wD}*L4{L@;P9hhqy8mPeg;}TLFMnxhMj(;PeTrLi?+tKx%Fzu!AnQPh^;g zvfDCgU^2+qVEsse1H}Fq@dCe8ARtD)(y&61G2l(M`dllJIznCSZJN)+GlZXmgm$ZM znzj~;+DXCF;|t649YS}JuUcWeUL*JFOHd0l$T+A<+seB4*6QJKU4C*n13bEd_PXmn zUMD_w^Q_WhveLVmf@`Fqn_$S4E~b98l`lVoO$=g-Mlcm>#E-viOffT<@q0fzarEQh z^~3+!pya!P+pBHeML@(ZSV#sf0B{h-#^PZwMC0sVVCoNkPXN15pYWMaXOBWVp!3nM zX0#PvnMO{S39%fgrmO!`|KuI3F}vOSe%8B)wxf5KNSQEQJhNqU9$kl|^oawNKrlkE z7YIbe9f^)n^In zeAbJI_>e_V3kmobnWJlEJAByP->L2`;nE$3_JmB!@ZwVn)*R<_yB!(%W9kxJU%NI1 zC{KHzSR`oo^uszFpzJgu;Zl4rd56k_TC7P}_Sv@5&O|sDRq(yL2gTEm+AW3eJzPEl zT--Bjd&xB0eurQ=6e3!KGM&+oz?Ht_vnYIdZ8L8ao8l%`()(}%-?hY|I!qe#O9&Uc zz_PaXl;h6K`lMVI9vU?DAfn+->ZJNO<@UaoQ+Smdpqq&dn(KF;=A5VIG#}Kj`wu*F)8|#wi181 zML^Q|Z^o;8C=2goHw2lf2l41r{?S0K#M( zQ?sD^ngCWmi<$JjU{~@>neNAO?X#cd`uvIM*PGe`EHQKWze%x%91ic;V)R*G$lpGW z5D^eX0520QIK+kuCe}x_`o$K!*MNw-g0$B9PueGhHSgwx^-h%TT0JJUem!$TBYi51 zLV^~X$>-tE@aZi6u!MX2R2z9es?9M1ksM+AFFi|bQY`$1F}^pV)OBqd8Xyy}&wiT% z!@4K>h05@KXH>|BnK0LlqK~38bDBg}bPL-B?&9jeKB_(M4VK6Mn+E1jE$)U1v<9*A zS_|G|*VelIV}-D<88e=4{`U|`M&z;0IyO@MVOcIpm?7|*Ul7#+epoPL!<;+Ifz{>+ z5B}BqM$@oi#5Xvac8IGJ_h>6g1<``h>^HoyY#NJyGTz|)n+TOq#!m7cP=M?N60+a6 z6+c*QC5YLPLe1k#g<0b^TkPn*sbe7Eon)?}n{e^%)#bd;?ytKQu(IoY#i{`%mCt#x>MC&b&C$^6A$3tD_)NX4?i?lj^%Y}sB?OhNH7cV_ zy}~mOBVz+(MwkAO*a{M&F3HZ%B{kZj;?-!Kzdt<-c3e`>`5q9wj48`=L07DKaUA zu#eg$_2|`bLJ`B%^TSI$8XM_aLb;PYTXd=|k8UZWgyngx3fRC|LXclq6BfXjoNYaT z%$_|kbrCm%|@(M(GrR z)jvzs9%$<8(Xk6z?D$t*QOpovLH&VKqR>XyzUyC4sTJ~7j6Woe$c}=a9rx$=+Z;!g zu-`mu5W0dT)U!%zx_;9S@cjTYROWX>N}Z?Ds79^Pp68?`I)ptZ@-h6(jwk|iC66g- zPavJGJ6lNyCik55hBXUK%{JTIVo%hX95| zI6nEyudCIkt0453>a>ELs#gRPHh%SI6;N32`I#?J<;mw!xiH}7)=Z=3%9zZ6lc|jW z9VMENO~AG+iP8U4SOfg} zQ$>Lf8IdzbxFineC5MtvY1mlMreo_cg_KwXokHl4U)P9;-XE%S^Ls(8ybYkguO4a@ znNs*H`0P7_qzwguIY0pQnc1M1PdB>TMt#%b_1yH%Ld}3ZsL%ZD#T0xq)eERy6iAR27`o_k6PKP{5MR;C`UK5SCjs~F z;)$?7kI+*on4an;g{lYpl_H0qP}opXjQo-4(O>U02M6l6hsl=s1MfvbwU%Z^vi!=x zAC@$d5Cd?NzIXU2&tj$mOwf`%whFiC!3aC@a|smP8w3eb zBGAXV&wND$;foDmcO!SQQgQN$S5Tyei-_MY{kl6Z^O2+Q>nFyLt!-7^oyI7##n;)nZen3JLvC2cznwb> zD_pKeXRujykA{#gf}8aUppH`lYVh=I9d+LLf6WJog#fpB_;dNaP@qWAS;Ib}Epc`q zH@ctP6zqbp@;hOzxU~yq@fbxjf;|}b2!4vppjpwN8aJaCPkkd{w+iG{1d36#hnHtdOSj>a=_S>LmA zc#TMnSOq3bqZ*uELqU@A1Pp}V&+zpF+(fb?cI?e*8<4~xiGRhNHfrxsS{z#1wt?Vr zHA@aSqsPw9Pi6ry3^ar*A<468J7d3qMZ}v}U3YWN-q?};HoEl08N{s%ml))DnHr!w z^dmR7A(Tqm#%fEw%b$vE8s&DGs4m><(-cyp0??!Io}qQ2|8wlO`&FNf6r{x_s9;DZL~{bRRk-j0kwKm-T84Eoy74 z^^MwwSac_D75XoU8XOlijZCJl0y;Q82%r@!ygb17J~aC775ADl~m6Ziy@YTg0FUBBDkV#%8nm$DUTnD5Kyv%ybw@e0O zAnQE!;`JV*_Y|S~uIDncUPj9nc42l_iNA*a@rCcl%RK@;4CF~5-c<+kH#aWOHzy&O z>*=%_Bwxdt$b$_H#UlBh7@Xtx@dLr*&Odo=12Nx7e}MBuW`dT#h?(BKZsgKyoW><5 z(|o)}6GYl-%u2TmUCF6!A{_S8;wGMN8BF|XKH=sxylF%#L~!qtEs>q}LJO>Mt-T*r z%tsNM!fx5A5WRn%Uch(E6O(p5ulcxR{4nq>l673P%u23 z{DbZULt zMeZSoJLYMx?Lk~txHFid;ZNPpdz7U3%vU}q{PQ`KI+iBe8gb>!aWmy%v|-dDs8h`0 zW1GuQ$S&+2A`v%*6|8n;tIFvS$TdCaD+I*k`mA3EjEFsg{r!VwZV{vKyjD|JgwMMG zB+Y$NxD6V_*nvfIf-`>NaD#}7{dnh;`SDiHqb8?a`5j-$9`=-WmhZkR3Dm~GprAr_ zj^nb6cy)&3E!aBkcZv3}_TFr@%Za|ltodl88kX*yYLC>fV6B}`w@Iy-=qvb*#AO2{ zfHX@rDS9J?l8M|UD+rnMKXBskQH9!L&1n4&KIIP#$i4`D0XJX1HFueLb)Wtu^<2q) z^hD$9aW4Np-W2a}LFXuhw6Ol6L?u8M_>0xj;77IpXF-S=NmD?HTpEBHS;zS3a}#{y zo5^VUQ3~J0tAGJa$#9HJEZ;MRZqA_3gsAAw>l4eai{6#4nV=9+qQ7Q)FMMdF+G9S zkvMkL-lNE*!zW-GlV^yuC}9)u`>2S+C;3%TrJa}ESBKz$lF*Z%5*D@k1>z{lSm?Zr z+L;aru{Ya1xWd9_s4U15J&|ll+)}P?LoWi`GyVUAV6Ue*z~a>0y~ot#HL*x?{6?O?Buzx2MeCn4jH67{#Xn^-tyoOPZY4-9>D-asg0rJ*#bYlPTTClioQS`^9gS_r zbJTwhS2Db`&@ zvFg0?a&d@=o73)KO1-*o{aN=xf#`BCYRLr6h9QS@VH-#oV_J_l={FPyZhM2-#%8MT zuH;%T|C+pqw#KfoHt4F)>JTc4Yo$V*rrOiN`V@8Bina*{29+s7>vKl=M@p}>wf;<^$+Edj53ydrGc#skhNX*tFjPl03 zN_YqUtePA+k}(YIzX(Fl%1=^T7THKkswIKR$Degl+!)!eA3AW;a$YR&$D!1uA4S|14TowjaCi7Sv0) z4DSxP6xU$;zU~ltR=E6NU70P3Se3Hq=D9hTcrZ35vyZpxfB!N`H%Z0h?f6k*c$4GCutMK^pKNxQLR4uzzoh1A2P~Ey=%$RfOaY+gTVMF1;OA{ zKn1o#G%nD3P>c#Dpm-=h0b4?6mlKul%h)Gf_H}PUCzPK?O}q=@QEOZeg6P`Qfou`L zKk}I5tXEzGM*#!^DD201#A_viSQA`yShtH!j;WTPD74MWa=e1yJCh`YtztlVGUD^t zLu7GK7Tm5yhhXf!3T>WawI&wuA*-q1BZO2)jQ%NPiAI+<)2+sU8mN}vj3IdnOIWjo zOx;I^uUZ7Lm*SQIJl_**>5HWGb<eoT!GB? z>PIjMA-qMtvjce^efhWjg$gE4ly4W}^?lkAWNea(5{LQ`Uu4pNI_tk@G!GidOK)kO zJO!f&mWRQnBwGoASBbIwMyHN3=|!-U8rHO8Hq3AWJf86|Lm1Uo7IX96 z0GXtt{l#8d%;YD=@SK#4{dnQ-8z9RuviTlp1k-}M$W6ZbPD(H#c-^BSH4w+2vtvGj{6ciBZH*AEn~X-faVKFQB$@Tp>lV33%TQ!YgvAahOU`o9sY839V_3tp zZ5{IYc;SCs2lDX6Ch1`+L-JpVUD0LHM00ueJu?5f_rO@1mo7iaCv$0p3)+GT+&M4- z^Me$pLG~nztG7ATkI%&C?EydsD|VSEnlA)DqnC&t&uDnWmu++7N*>?f3p=PIQ%hRD zEjud$B`{!Z5vN1C;3_8@%JzO}<0+ZihgbJ?4ZcEfz`OUq20$Ua9wGh4;3h zid*#BKl$Iq~%L^xn%#A*ud(79;V>V1UhTS@b&=?zvb{SZ_m5s~#sTt3peN3G%24&^Q-8 z$$@7lMipzb(dVsTZZ3x3X#qGB4>mxa4tIG8%NI3%T)_4|{yv5n|M#+#gu46Gkkc2B7YT``GV!qpPG@yR|gM9UHx5cpbnRg0cK_h z6ljrQkN`3@e^R}y)db*!hk1%?N=E^^TGLORxOcQ(9D(HCAW08`d5H*BDuu4RZu8t$ys8MWgqOO9J{T4+!RF6k-Gty z4Ek&1RQ(lwV>90jtrbA;^Juptr8_j4mP#k*9{dyk%d4Zu{CG^v86wj2Qdla2H*fAE{%DTPBD>EPpQ9ixfYoB)*UdxGhpj7vu|C znw}1FY+K-s#wZR0wpbQGpGbQ&?pvfz-(vN~`pbBLX~YVkHwY@jc-7cov35}zU3-2w z@yWk$dtEYwaK*_KKe!2|oyK#crEZ&oOyO!;cFFGRhP$UC@k%yJx)x|35kK<0B-|2O+V+O2cr@;y&@$ZVmQXZ@fjxUh3WBR7Ebwme@KeQaljC#7Zw0T(Bp=%NJ3AQs4heCOAopLU9RZLQ7 zL52#?gm=p83D7K1DVCP)D%*QsgLmD-iuI__e*V`P=n;H}rC||Lp7sQNOr(&@s?pt8 zoOrv1%>ScSB88Z@!l~dL{TyY7cuH@yQ$*0O^AosQaJvH`gukPHgI`#c|f-jpw$b7oN}?(8dhw!oREMYJ9)h`L?9Vv;(b;_=K?ssw}uzm_AM$E{i4@lo8ejA|9 z*&b-&8JMJ~oJfU`Ucmpk4i|?6m|Fl^hwBS!^z>K6%+=Pxh|$bg-^keEKiWivDJwSr zS%ZskO8{8o{;J+!_2s_1dXH6r-LiM-o;jC#8J#2?Aep1^>5%&t>4l6y31&r=Lp2LQ zi!}V^Drd{CcZD&Oj?E<~GH9Q4rm0#sa5qg%vK=RVLwEm&zd3C9HEa?w#cA1i6igvLvWC@rJ%RYS)WWrO34bcI=Lm4S$SSEuJW`l4MTE0O?L~)3_^Z5=h(w$^0^}hm#a=I zwW#*+?_WjJ4srPM9o}!ad~I~m8{OhnJqT>`=~>EpW~$6Sw}(p0cJt1!20TJq=p-B_1*2fmuORf4wOs4()U_; zDYX+T=F|2*^i1BbDjXStCn0$iAv(J_<5!+EeV^%!yRn%#dZ|eG30=Mb7^%X}IBrt8 zOACQtU{xcXxoOqm;>>sJLaL9eir^Z~#m0n7(UL~chgRN16j%;I$~ ze3VrY52bC_?E6DfJcFGeOA+AjRU~fu{Px7peS%{VLdM+Cy43j&>R=oNj`Z7auBP*u zm42hk<5$`oQenO}eTyc2vv@$;PbXnrg4Yb?IZYdEue~3YO`Zr{-NNOkwO|g;Lbwb2iqx0Qb?J3+eZ#<^#2FRV+9jJ_CP*H)`AbS)70RQrS}N zmMh%(Pvc0J_E~u1b8>4h8^<4do1F|#29%bin0*$cDi?AfvHv~F*870?S@m(2(TQ2^ zs*F4Dg%lpyGP{I!5QzMBZopxh1a9sgZ&9c1?X{~)Mb({!VV5^AJr7ZWN@5aDlp9qG zu{<36p@Bft9`ztK)(xb920n)|^ z11W<1Ux3E)S8NRgXfc^Ukf;Fd9YNd$hT~ufl@TLm{n+=pH9o%u&Mr-_I9Z|Vdjbqt zbMtROyAT+ePp=bhCcAetlAqS&aYmA56o7Z}17xZ=sV{&xkGHQHUnWvSObQhe$PY*9 zJeIxQ>ngT+SP0dn@xEnHP%%mq7+RT+1FDs~N)*-3hN)E{%GP3(Luiee@t^&5JIo8H zYB3u;D6S>wEbMMsqf&5`{Hr0yfn(v+OC^Q?SK<9f1f4s>vR1D173a=FifKA`SKib#9?PPE^~GXmdh;1ANPnR9~egm4NddBSbJ*NAZBrla+e! zN6^XkKVsBG+`9G-BB^Rd7fD)^RX50ERuj>XR)qVCjl*%DSk{(EsC$~3R}U0^?MN$( zAOs{DpK-DO_EV=acdV%V%+Nor$7K6uAU2CLBLA&ox~tRSN!L?~G4Iq*c$eb}t55W4 zptqCAjs)4h9-Cxqf>(XF`X4hTG>nYDlHoHpZ1 zRkp`phhoQG9C*icgseK{>usIWpV;mvZS$qG?!a-LB#7o0TXB*7<-p<3tuFh#ky7X_ zGb$~|dP^a=bEZQhybiAb7&;Z?^SFa+q{J`7JN^dh`9Law*Vts1mfn|vT@xG?j@dOT zKZ80~J9#V3(PHHT#OpbudPyhV@YN9;5%u^XwG@LNacxrc^8 z9Tvd$z25y$wN!4(<-vImn=&`RdTCd(`0bpdfoX`K<$FfE8TRPtgm3HsWZRp=Zz)sx zAUf<>S!ckSjlk6u#`8Pw?BIm}kSma2 zUSz3BLaDlCKbFpFlW`m_3DD^+f=4kOEnU)+nqw34+%O~#nl_M|k8T}EgjQV4Ql$xJ%pIjW@LpgY+ znBEwoTv`FpcPha9)dOah(W$e}k_G3Cdv!|mO1M6w2#Hlh1QfiA}7*#LbzqS&*?Qi^y zg5@5}(g9so6%V1sRWOs+1b1Js0b5k~-RzqfZlYbBgf!;E=CxlMb+8wdCW;!moo5}s zoANsM0HbgZqPCLlR06S^kwrfzjg)rY$)OHhUv9jJ`@89E7JI|E3k!7w*BVX(LQ_NgUd@N}&Dmbc;no>5eZ9Y)hFhjFeDXkAfoXoH`hrTIT zs&T|cnEdf-(K_`b^QB)(X@h=DW_FgdJ#h&L;9t49y>saEiCAhPR?EDEN&BTSfICO`xDl9!(s=c+UZLvzqt zl{xpY=5bZD&mo#WkylA8j8OB9eu^bhLDQICBHGc|M$cO}FJDIHMSyar)yJ9AxmNJV zo|MKJ3TIrg_<2^wB0(=!cRTd#Dl$>BU|7uY%ZYe5jW|x6LR>CJ#69tRqh_jDbh>Wl zWic;<#m)6PKH`j>6Su`n+>vLg{ju(&?(MlQs3`w$mK%Q?NBA$6`zsx8?C>v^6CU&z z{X*+ppwd*3ziNv8@TFq;)(ls{ zng~pzCJhVJt?da&i)|wWSH~FGaPL~fNqcYYLS^8Grh+J=6%0CB3xdL=F&0f@|CF5D z7H@CO-@KeUy%XuZ#)|nf_5&-iKHsyeu#9IQ{0+D{g%tz$yETyp@sl%XCY*o z@_g+kN7OG9z2)r5gdR`A=n%)HawLQAA?$Qzmans%;9l-Qr#btu3LvPPpU{%JkTAV`Ef=zyZ1)BihF{w5W_1mm|*T(5Cf#Lm*Z)^!|fDy~LVo#uob2_a%^u16hG@=}* zh?v<&4e!|+z!?|59guG!;W%g72}&WI;i{E|Oofw`Y{E_NU^r+SWNj2Mj&RW2j(_rN zdOCVN$lUVEkb z3{CvBZ7|)KA>l3?Y(yvNnOu0OH~v@n8&f16O^DX^Ty-3_n0f$|atV-U9ks;-eTX9`g61__$uc~nTv690XV;MR)Rq zW=1xS-5GY>j<_1qS`PoQZUpz=&4bWOhMk#)$H+SPCQ&jYWhw5t<`kM_6T_1ClVHHt zi0Y&>Tgm48c@1B%gmp zc09KBYvbnCZ9cM_>O6YK{t!9K|D-k(!WBAi_#9Tq$Ww9c5%lfILrU>Lh&cjK-ahin`XCKb;uF!ZC<+v9^)7_|0 zM7KZQXx7(C8tc($w?X?vtQ;mOrkUh7&3p~|LQ8{)o63!y%wV){s&Wa>KaE#6je0hZ z&Aob}jLPfYKMyGNaMzyHDr47|@QqQ(S&PhG1`jr_3nF;Z1K)sQJ-`%NWC#qz{&<4h zmkYR2!@IA*of7`oQx2$*u`XNpS?mn`Q8-N@#QY9n? zS*BHuY`M+U@TqqClfaHX+Qu34F;`n5DTYP#d{WQhIN^`@YU4CRm)J2!Lp0q{#Gc1D ztQ`v%Z>CJ&w)TkB5I`O62dT8rCc^-8fyi25?0tNT%zz-zJ&G$e^({w68#=kh=Ronk zs}D}U5hvT1nP&{CpN!P&R3$ zA+ReN%DfV^#L-31^)1SA|ZM8xkEF?A& zvkp;rbHE@Fyf0AayxB@GsLGKA+7bnF=fJ5sqi=)k-)1DB&oKMe&}lf!@y-}F|LUH9K!^r5qzFD^VTe7FD+HySPw`p>`-i`%w;zg=IfyF73wX@EQ{;!}GL&tC9Ei@0_zOyRA^Vlk zt7~mQDaM0+iOU{ z1s4Sx#mTVZpcBM8GfF9Q&f=OjM5@r2H2C(y&ayp~LiPTs{uS!IfUOqIg;WT4lPx7KNNg&} z9-@^#tn=ogC3=j^xW&VgV5>vM7`*#uQ(Lv<*p4{{Y9D2h@6Y~K-)znA4d3dDp9@$s zO9v-qkMl}?Cj0z_Lnx!4)yac;6#&v`O~;sDNr5 z)!b9HNh_?hOJ_w%1Tt0zNW^4xt!O6;xM!Et{9|F&AtKQ-6D^SUiG%RPP!X_RtSk&9MXJquTMC3Z4 z$Q<*Ph5y*aLy+f8ME{d(0w>&?KgXqK^+PJPb=>de~g%gDRr~ISx_ktdlGS`NVori`3xhM)KC*@cRMaS6Z_pFTI#O%~l z&({~>C+gUaGl>jEntDge3ATPZfsKFHq~_4gc(LIE1NFO{wxV7XLdkDbonT5I3$da2G9>kKA*(nkghJ?%Rml;X z{$y|=b|229ArFyJ3LR3|+F%4|wOQbB?NmxB+&hGW!UuNcx3y<H!`-cIZr{6Ngj~j;STO^)FEH(F2=)8We`)^% zPt=-$uf$gyp!LlKD>n+d77VmH_rgdSin()wn>E!58=g8Q#ifH#+=@oq@CN9uGR*yc z+kTq;RO5NlC~Hph?c>PjwmIzgJr3#6mD#Ag&XmtT`KOcuxxE$Sq%Z$3XZ@#)|Bthx zCaNQPfQZnWZ@CwGbsTbElXk)qi|~!;&mdv7>}3p>7Tb5O@7bKp^LnBa9y^Hcc5-z4 z7>iCJXb&?m0oBO;)v9)FUKjj=y8%{qNHXy3!$9Pg*moJ)6x`v+NDY*)=S(Ne=ZxGIH(MJefZOmrd!2?!uat)4XB2_VKvrWtuwZVHy8{6`H|B^Rf?;34gsfr!kbxgc(9kLT zuuO?M&>>J?5fNXN(F`m?5D_7s5fNYZ$x<c&xuKt&{ zr2yFf)V4hR0hRXI7;6Bfo>+Qd8i^!tnwXdvHb6=O7FLRsIB$BJ@(Tg_^mN|z^cN+F zX{1Oe*PiLCwvVpwF8VwDqd(F;KMvgYn`$4%TQA&wS-9=jF{ZMq(ct0Y!2X}xVvvAL z=Ak5;qyPuR!^H*`-NX6XOv=mg%~pZdPKS-u-IQtBv;c)=qe^cqHKH#Q)fc z$OQ_1#uB>O;;|#feq+#0aXgq9X>vT+<$W)JK6KGUvB+L1#A75TF^9Wza{&5}9#kEkw`Y#=|@F{6ZU_0&H z_eXKKJa)sfINg=xvN`j-vz1PY<#XnF=-Z%Fx`W`zg+mY%z8H!PJ#Ls%)Mv9+8t&f-7dv#30no!+!lApDTRjdUI4o%F=O+*o<5o*GLnoCT z3`?^KET(eqq@FJHy=x0gcCTat5dXck3;K!4Zg7sL5bo_sry3npe6KN`AY7_MOn-Se z!@y>vj==~+BMmVcN)UC}8zu*NEv41{MoO-pklV#-0BPqYD8l!#gC@ShpzsFi=#CB>+O03`hWv1xw+ zjUVl7V{8wAunc}1q-&NkmdQS}Pp@V4(qN7L>C^7z`>KL2#L-OgLR4mOvVW~aJV^q( zwWc?>p5?#o+XM&M=K)qz>1=;{sHoB5(+29>WczfG<7?JicL^7#_?d|2{k-Mc=4xAM z_lGN)U;qGfKBYANp8?+K2s+udj9q3Yq-v|_PJi_ELaAzvCjG(q562c+_Dy#Pkltsi z*VDD+5wme&l%_&hn9x6l0%WNg8R$+w$3`GIHGABZ{#LIRde>}HVz*lCEZt@2G#M{V z6AS*CO8s4PIEA)2xO5;2XJ(0_k@w$Ohb;seTHz`W(*i6;oh0Ltl%eS&Y2&it*r(eg z6>9l7r*26^QJ5;;pv0 z%BL{uR^Tvy==_n(=5gQlMCCLHg(U;!Am96=VTpE81W1)_AkVuI?cev=C=D{q70zSo z{jxWU%P@par#0>KNZVnfhXoaAae6Xtjt>n;?IN5^K6_Ppt%m5|81dKhD1^6@!tD-w z5u+Jw(k5eB)B~|ZC~p`GlAYubu;PrWrAf2DRi&lMgoF|0UExSw|A{wYL157t@ts%u zIqcTUWHZI`se7fD69wY2t?s|@Gs6K&MN;JT77Hnw!<{&&sCxMnry2ipcxNW;3Kr=8H7fkA(a)ms@i{ z-qCT30>uz*fmn3H7>zAOFyOZwvCV3u=K5HFG#-M3ozg%5DnU#GGD1vrkfNgp!*M8q zoY`Sl0*=S7lR{Hj7Tryd*km+KsY&Xy`BZ+e(RkKVABr~VKT+C073A6{bkvqNIK%yI z(MY4kDt(8bKHpQ9$6vObfPC>-hGZJmgp_hk$rL(`?xg_Tf9Cz;S5ORFdq8)lHJNP* z;oRR${5Gm07O!=chf3gUW02KZe*V2ILBMo?Y5+6-oY((1RTx z@0P-6CCqS~;$YdCbEV%>K>;L@!D^nhlCG8bFXVCin?=@6>KrBA{BJK0sXw?~79}i8 zr68VBFK=!VzdD}`f7A6QmrSIXD^_gyC+6r$gM7NYSw+C*rS9=?PG9z|vcbPWB_0q( zzIk!MIF`wgDpsoLk;Q2rbrx0rPb<_DK=+ZtLpPE97qk!wdDMMg?!E~k%Yq7mP6UV& zrJ{s;g0B*vRhbB$IH>=L2kpY36hb=}@I2b2Du#iZW===&;_qvfi zS}xDroyghvDy4|=&kPoZoBU-?rE`F%+hP*!bg}+DhKT?Cb$m4t;FZ=%nd3$BgWEM_ z7aW{V#$TB7A91lk3_<|Wn41#i;@ts4UO@8LUt25C1lna)Br7*^{d*%mkJO7bV*Lw+ z{PzA{{rZc?>tprn^#~)g(IBe(1$9wbb*@FD_{@4it&R_{osq9j#s*S1u22toh+ofoUQyVj(97?R38^e7CxxxP0GR8_tzX zSBLZ=%%=sE}z7ByHo_DqO!3BoYcz-mV z+#6IrDbnLGnJuBIO8l`6j0Hhnk6_IT3J z-Qi^EnzF3$r7EM5{dzH)poRj!+5c6Hp<`oHft17-qH@-Ken;c#8tnae=^*k!Rgo(G zXKlBb`u8q5U4EG%U&sUzDdUs+RoP=RDjt%{XY(w3Q0zsAd!@EBz}oWXURRM&o{azC zuHQRNXK9b=E4fPbxZpk7=;%mE=qw>V4Se7BZP zJ=gCOgOUh5CfzR_rtf3cM+72SczwpnWsV0i1U2p>m`gS8wI;V-r4cxaBouzY+y6n= zS3gAk23sR82uMgucXyYB)B@7orP3`8(%qnxbh9)_cPo-of;0jW(%rld-+O<0_5K69 zpL%A_oO5R8?lGdwCr(q!#juWl-pPNV0Ffl=F{6B=OB$G}+>aUPS>;x9(94`1m2!~6 zWLTDhr>V#$e;WhlAvc)L{V4zJx~mJabacA9hakfWHcYLd;{E;Yxo+R}LBn#xKcj^v z6*#FQ(h%G#-^=yq1TdjaQen@0r$1+QtO~QWs-NG=G8B|3KWEWZzq!5L6(%RL#K@zK zO4H`OJ&x5ZSb%O5RahmJ>6p%Z&-tKMAe8;@TX{%Sf}~XH)ppmr4WAuXp(J{B_G&Oe zLzsgJ!}Z;DDg|~3Rm3HP6jqCbq!#M$^mDx6-QA7HapGq`!~;@0;6UfL9G7(1`*$`g zdq6E2F=$Z|8R{I_V9M(DWUhCbnD(VKnJ+V$_eBmh22$1j%l9vx-0}96oA{rz=~72N zXG@YxX1(l$QIS!$hWQc-X{+YTU|xp&Gr!1ma)a339DWB5^|&1FV~|Ncq_O<;Iu|N= zTlr?gsSn9mw)DtUwKWuuvB-Y5R`vl? z$t65L>Uo0EYVLp@0|_pjb=xE#PUUfOz_9x#@>phgxCt4;kRiO`v_Vs{V>5}xE)0>2 zmsUSYX!_Kr-u)(ZK7@Q8vy&-iw_g`O)JiuUg#?Pb}lg z|M{L96~KFV{tO^b9nZUqJo1xyEr^tl6+`7v$y5olxD!LWtT6!csg6!LC@LLZ=M|$b zJ1<4ePAp8SnX&}di0S`2aejRu7i{%DYOXASx@q?L-Ce9=(4BqWFGT7nSI!BTEHyF$ zC(dHYU)gB^8DKlh`zIh$CFDuRY%aFr5}ll%C;Jb)scF5+`uCTa^6=$6xy%xDd6nvY zSpY#q6l@Ij<^x+xE0UOMOnO2-Xo3y6aW5qy%K8>lB^n?db@ZDh22MPO2=LC;*|TxH z?mY-zc^CDM!(}WBp0=O^Fc$x$R7m5-T*EstLq7BLD=byLQTBNKU# z-Y@9hQkXJIL})5(`9>`W)QmJCMYZ_WpL5Pj^vXlcV9hx;FQ0y3%Mm;!k!J z-qDz6UcUS%Ra*MTb}_^Pt&Z-**nhoAIArZ45Cv9<3DtS-!RXt!KZZW7+*sXLa+(fM z+s@X;M+|Ub_xaIN8&mraCbJE~;;BrpDmwMq`e=O0^S?j$Eop7aUbXW;MB@@v%8%d#v zB^CahaTm`Jl`AHCw!=_oJso4ib@$K1lZ_1?xP-ru+g>_1%*Y6xL=b0N@4Aw5!^nF5 zlTIEKaHLF0w@-R8XHwzb*`X8h%A1X*(!etJ6vpKh!pNVnO$fM8sH|)M4Ohx!!1KP3 zd1Y*zJ$e1>sTi!RAu0VG@NS@xMN626z$s$@x}~8g8o@<$!G-vH^cwztqiy1x{L4#opBcEC8s};{iU_U2n}LrC!E+ zHxt>|GzHO57HXor$orJaeo+EYdfb2;N$B* zfhi*1o?8LQ_0+_p8I!pzTBFu&I2Q_ zzZyn#Q<+W~c%>|n#Bgld{%o^P9DwpkpK8p;sx0YEc@_VP8p}^1@4vtV z^l(Wnmnt%BV=aeLIMxAmmSi@ZCI{k}%?or!MfkmE{7zT3wQBcY`ZjcYdKJp8QpPl2<@VME^`ds_We#|^{l!Gmg_gl60xqE+MVTZZp(+(BrhSop zDxC9~X{9iYokcHps)KPOfjQji2sW4X@1iL zJh5b=tWzbLiGQXm_0n$SW+~?1Z&sP8=1PVq`>bSvD~iE#zc|Qwh-8JOads`TeXkPV z!WfahAfvUA2yDy!^@xoTA60T%8Me48l=vKlrwe(Eqb9MQhX+s`jK50bEg!UXkj5hS ze-1Gl&16|}+oHsvFV?_YU{%+?Mk*u86}{ zQ>BA|8?yLbyCNW+ST2`+<$JGXX~V0+?m0<+sh}bG?~+4Ov6D%NCrj9iwp_P9p)c~e zw21E0+lYA&5Oxy*Z=fr~R05)b6kKrNY^@#3!@%|7&ey$R6ssC5*&k@+W})Vcul~B} zm++ai%ec^CAMfjd&9OY;;gR*b53~x5Z@$JPzP~(fnMZU3b*MvBCt$@2!1?8b7PwbM z0!Dq18CN`uN*cWdCNKQ2Jedcvv7fv-oi-{MbX)SkNqv!FI+CtKtC&g+Dnhp+f<5p8 zmZ=})>}XSX?7D0k?HJ##8qOE zrqR4gIB*!Pa0wN+7))Yyu{Gb5`p2s_l<9PZ4tI&(Qvdl;QFoK$r}evEB`^O=QI@Wu z7NZP&y9~Kut2?LNje9Xby(}S1iV88r!tZ+VnpI{0jvQF*sea`s2<7@ss;S&|Hr&_^ zbFtWTF`Cc%Sq+WtFjCOs{GyS`jZ8z&c1`!@o07<+9xAwYlnnC~@h*;DFgNu9duvJ2&Ud;+hrE5-A}@%b&{ zCX4m>c3v`HJQw1b*=ex!%bv%lEJWW;OB*kHeO#!XgqC6~gUBY%IY z#h?z0Q@eJ2gLOa)uU4c0wz)OPX0>~--Q8Z-)H~+<@J4v<^5mI5$ zLHh)qI4(Pz+~aDe_<=J=)D_h_T)0PhV!K%TZCucPzEK5K9`sw|1vRyq>M{SwCqdtaScmScI|-CVMiQsMq9OH(0f|4^%mJ^C)> zycvi2=10LWnEI#yB2+JNYV-HEREsj%Dm~Buc%eAiZQs6_BZFktq{;{p<4!n%D&G#0 zLsj#CoC$|del*dk)|!<`Af&Yj(dW6HsIAnkeu;hVDNUe|x;yvjC0KT{e#^OUEy4fp zB+TZs`(Z|y_Wi|btZJRrRG1I%?X`3)sq7zKTN^dYMQ3C6zrdSJCliwP2+ZSjTf=gx zz0Gt5{Gb{%nvg~+60fc-Mm-8rCZ6rOJNqE#C}b@8+z&Ha2^2hORk&ud??=I9A=jA$Wuv9A=F!H@MEkWN&|Ho%5B-N=39WGWY>@U$M z72>s!=b~9^1NYe2jd->2IY`8oc&HzskYiRs|5ba?mJZ%dKwX6rASwm!EA3 z)ExhD-3|$UrctQ}zdpaaSTlFo?oT%I*`n9717Gw3nZJ6ms%(yUaBWAu?OdUTWCK&W z`{A!|VC@-=R0K{EaW^Q-@+CsilP05I{X;$Q%Y-nSOuh$L*?DhLmQ=_+dt=7gx^&WO zUlx>i&epML@qU$WA_#i4AXG_@lXyl;R`$BjT#-q9`;SjwjcDT!o(HIx8qG^Ez~0*-4t-EMu)Ha z>WmcA`6-fF4N%OPyu39&t21mJuEr**UtOL4IihMCWbv?p;rtcy{6rw~d{%b{9rxb= zTYo|j9aG*JXSqJ_A&8!+5br0AwDv8HE$i8&rb&WRb!=9#Nb|Hmu_>oa{Oj(k|`(Jz0?f0DQoaof}HZ(h(6bl#x{ z$**dS9WYpw0Q}bF+kt!fyX2XtFiurD{xO_3UT3Z4=FDfa^bnmcQE*YMv(P^Jv0;Vb zGHLc#WeIs>eYQKt4f=sW!YeI~iHMGGEYJpf_SgNxAvel(a_5;<8n&$s ztPk#OS6<(NgO~`2{6CAVMAVOr=p42ui=RP&sDh$%9)gP_M#$w^d(jtT+q5E|$}I~{ zs_Fmr%MzV9dA~)8_y&ePaV?C^#d)h0DYA&xj5kr({G>bZbyv~*PN9LNi@W{uo-I-zB_JZmk4}K=tPdYl)J?Beg-Bf<+Q3VJjNmG-# zA|f)z*D<@}HCjrQM3>uBr4nD%TeT14T)tFw^5j}? zP0=VdU=ohb=Ip^ItV214`{vSm%4k+aYO{&WU9t$!S6t-0_KWkX=Ew6*PU|&-F4Vqv zH%a4>|Gb78h>+Q&3g$tD0dio16-rr*s(v;B*ALf3cEcs+&ZWBbdD7a3oZRf*UoGNsLe7R zH6Tx|gzpjW<#{#Oar$-z$e@j(^L;`48{NuuQp1zhu%2vNw#Ciz8u_vSFu{W?+(P4D z^QNEjoeqGxe{(H;afgprCDkbxB=B^FxTDu=Q}msAB+2>ubo9FqK`qf!Bt{;+CSpfoLK?m4~kOYqg0SdiJI zL((Z6Hoxb@4VORjY&YL0CE&Nn7Vm_#W~Hjcv1Y$axRCOeX<6SfM!0 zD?K8s{+(Bi*KVHv;Ip$7twLu0E*=gJHJ~=9e>?;WgrnyU1p<{bMV}b)aa2ZBY7oOv zcDuIFhsOPH|3TgOl|oQ?th!+wuP+?5T)5tL908xnI->@vWm@zVuRjpSOW>I+HW-CG zj`9(|qaXwTy?gDbOUQL6g*U$1`KM}=+kWN`#l!)P_s#5Rs8fN6XrJW|>40sXVhxJ^`rUUo?R0Mm^+(DXkWfOytMVJ6) zNJ}pc<;gi|>DmW3^Qigc|Dt;*F?NrMQ>P=bI+zmS@|ikP4#?){k^b zNp6uHOn_K(v}$#4YymQNeQZZZhuZaa9S13Qa;0{KhZd+by35Vnc4u)_qi8`;I0C!6 zTBb7jc2M^Z07iJF^b}Vijn}1w+iFr~Syrx^?olg}VY9QWUPZBWzlMel>bXJLQnQPk z-BJ^kTh)Afx%V$qtdLjCU4KSeMRKC;eax=~mW%mbx{)bKe$o3E(%3Yw^6OT-q=TtwAB{d^AA*HH{nlvY zb2vm#ytCf2-#%doBc4xBi}zE59QYyhER!AI$AzE~3fAp|vO~OH>6xfle{+#0a7d8@ zl0gHbbQG<0@9c&79`UXT{H}V5`nMAYPq(jm(|4yt+;Ip`@%l4`y-uvg%UvDX(MdQZ zuZp|HaQ|sG zn#zyHapb*KjXe9r@Nu~y;eU)3%L4H3crRW{I$DObR2O6UeuEy)sS- z7( z$j=w0GAoo)4+WE^N~othh5z!vB2!XjT(irzplSaLuQMB@_@HpCkTRk+_|;w{+<=>n z0a2G-#+g4jh6ZGs7s}K1yYu)$lUHYd=n@$=Rvh0}AKYpR7 zAmw8^^r4-tPbi^3-kMYlz^BUstC@3^hUVb)fTDE5+Xe}9?& zP9DiFGz-{eO41d!i5Ch-l!Tt_0*z44WLekxY~iWNF-T%Rl9nH;FQ&Hve7^qhM0cf?;Qf4#%q3kzr0bn8Y0cI*E7 z6w}fCZuAG$?U4{pmmW5$%)xu-FE9_oU`5E&qY8I%#9QuuYE@clR~@8e;5g{!0)4&fMPMuW z;Lu1!*Bd|*OmRvF4=qo8%0+f1ZBS|M>2GpBd~MtH7#B4iiKB0@NW&~Dn(zex{eav) zKw1{SGWm3TcOhXsnct`gmucLn^=2zKHyQ$e=v_myQGY1H`p0SrnMajqvmw| zvROY_z9qhubhkdR$;!LltXmLBoFp<#E1fR;Q7SuEAE-QQwN3Gpk<<6?{h)h{Zg6;u z=kojgQq?RRO*Tm&jgPf*S$=m;wwk#;d>QAucO15WYPx&W`}H-0T0x6i|@s2I~&W1@BBh z37STbqeYD6mZ}^B7iH2wfsT&<5J+UoGM#FW&t_gL{+lorY_9IcttXLriy2*WFRlgL z7WLJR>R?Sy?M?n-Wkkud zWe}tt0(wY8hfC`uXM@OmF2qn6Hex`bYuTq1O;}X{RcMvhrtx4pI&;~c|4DCWlMLym ziMu`Bp;#gl@RWQig>gw4kQkZF8gkhulShjhfplFJFqF=t1}Gqk_VhmtP@BJXfS?JpSuBH<&X$?4m?4-ycuMpmv`o78-PW&yxGZ23w6hRD0@kX?L{j!RbEnO! zoL_^ah|wC_pXr=pg3@hP%E)bu(^0T1`u?I7vVJXK+!r|WZ?_#ihw$JBl|6gE%->n`!WB@Nt=&d+8l zi24-PD{h4!(F9rM<^+_AM~6JYF2U3*sq|r*p2cD6Dn(qm+k9ZqEwNhcB#>kq8-^jf zy`<wtC%-Mdsz<+1Z@g#L_yMt zY((SAGixoZ2J?Nexx0?rtJ3UePy0CFUrb6qiuwdgiTLRlaf-Cu${9zG@It1#jg9I=A1X<@tPd9+1XtOh2{ z+E~qp)u6@IT5B(N-aalX9Ty)?(*T3m-1Dv5jR@S?YwUD!Qu>W&Zc@+l3V$!;F_P*? zJ#&qDDChX);A*su>TU+gBYiCLe&_Ur)-rC!Z#ixqJ)3~>(CiDHh(fE$sIyL2G`+sC(GV@Ozw zLsxNt7ZQjd8cohGWQTQm3RKr$9qD9@u7U873~YbMj4FCMaWVp+^iER7genkvQ;Oh- ziHRMpCmRjKbp?70(%JL|mE8_;U;$kS`2zGtf zGFp#5mh4-iSLfIVNT+MuM9nmLC_?DMc7Q2UEhHq5QT9$dv1j9$ zO(gk@WY$`Pfn(xv9yWw;$DqaS+Zw}1fT|S=T+)7ge)|op`nBPw^rm;RF6*b}2u-CfGRFSTB86O0wRIv*}%vid!kd8_K~^4rKeD{fJ~5|=8a+|9=|+W@`KYXbtA?5ZKa46oLx&8(_G>GUKHobUo;GS( z(_XDt!7i9}Yu+@#6+&tg87#5#dq8-G!__2YG;s`Sw7X)E9-|u9Xh25s_RbU{Da-cn&} zDGR&+$%EGFAomaQ>er5oKx;yOU{tq4RB)4^4x1o^EH|O|Jc_i_UUgS~3QqW#5SNO| z3-@iX`9gBr*N&%=39bkKetAf0^X#H*9|lDsWR0QFl=SswFyoHnAbv7_E?cwry{U9%k;96SrJ)l^HUY{x#d*vER;5wtpWev^jX&+JR>}>)x6A?XfpFp-Tbfs!y3)< zILA*-@UbSeIKGaMIO|%IK*WG#oQU&hjqZoJ?{iR*PBafP-wedZ`57QT6lB0u^ZJ_w zRtqPOp1pi3kMbz`qH#X7-(wXTJwM`Ye#T*P&xQo7395sS2jO$rQXGcg!_!BEe#16b zrEXlu3i?z;6Zt$%^j*QD68Mm_n3^C}_3nDeGRt(1#FJs{XB2bnug?A~DG9o5?ak92`o2 z;j6gZ7D15nfEG`!rojI(23W0`p+r^pKf3x3pIP@&-R`4!Fv_R!9xQLFCn`kiQcnY0 z7J5O|heaz-AC5&cF0#tl<0DkJjJ+Y~6I+h=9;$ZF1YD7En*(#iq#GB$UL{{DyhS{6 z6?TM_HMryLaY-lKrq*7@ai0Cc#^^mr`BJoSRGq0on#Qg@`iV>WbxnWvf}$g^ff$Ox z#lxX(Pseh9{u=SPuZ{A8H1HagHrCPiFqTLwj*j#^X_+R(v;GSg!5+s&ZyV1A>9PER zJ!$cQ#JuRiP2fgN%l74q3lS&1V4)@D^W?N`5p124kGKRTA1|GF>5N|x4&upz_QaGNIq`lqh0_52iO6)MOQ&^vWfI)O^Nn==V4{>V?`CPsI z1mp0E89`7tswd5Tva4hR@X_#K`J&(_+X zvhcIgBWe~p6NIw9%Q^209D1<)!FbzU7j!QHOsY-S*u;F(3YFlj&G4ezZ*ZcvN}~s|7eL(?z^>M_>q~kKEnA47N-`*fQvUOew9O7Ccb; zessv4jpyYNygjGmR=_u=XF#xn>N9F7DZW6Oba zON}rBD2gB_9CR#g;w(Sb3=@OGFpbxuXU)j6S4qhZ_kKTPv}W3Sg8ws0b8i!l~&`^9@$>4-^h z8!N%@w_jHfBMFf|ean{$|d%ud>|f*`6O*;&@F9y)*axUrCeCl8O zqRs1cyj<9gNSp;ey~w^~BYVfbHAi8m@Kxf#f|iZs(k>Ia%vGMF04oyqymTjQx5^K)OLoKRg6-Mg$w53PhR7M?@hOAGru zgPv7nki2k-IC<7&GpXO^Sw~ZH)Wtsr)sW4N^HYHk^4R1Dzg(pu{`|i0ooyk8z&py1 z4NIOc0AsQnm&QezN83#v0Sv6xKgy6N*7mu4rrUv4(mQ3};Px>Fe51##EXs36X5h#z zroiw&NS6}J0oP?UwHI%W9U?^iQo6u-ZBssp`O{ZN6EgyjJLR7XHeG8PPfg!O_Ycn4 z+(zw?ZNQH!8)J>4b_Kr6=?+G~&@WIgL6BekDd5bKLJ?JS5Q4so8GS-zJzbFqT#VmD z8IxmlhE~eMtvQ4Q=^r?HV{U)2vtqFG(c`E++U_$G{0FM7!1)uWZZpA)0>%gnWh90W z6}(8siE`VJ@EXu3r>9x$HAHxdZVg3xk;x!f{M;#DFnr(-eQveKl^4FaAX5gJu;rlaM3_7LJae;|&|0XMIlpxa&< z?wivBb)mW`9{A~(M$aW#C`qtsgV1lUD>WsIlivw-3J=(b^%AEGI*^3P=$~~!-?!lA zTh&<|y*ssF+LR&ztqx`t@p9M{yj=mrvHe~IpIU7?=bP7?rp+X;TlLwI=2jkA^na%? zc_$04?Vwuf$T8#IrENLiNm9v^{$}5CPkV5{DSq(mzHh_G0y+eGt*s0?Tkxi4hCi^S z@i+;#E+QF>X1t(F={=IVRKVRqxv}T$`M4_0e|ewaXnXv7_y{0t>lLeqhBGaEZmM5M zl_Mc&L?ztMCf=3~n9SFhD>>IOfx)Q%GYepth$nY9`sywswVYJ&ZJ5e%jln~Ogd_n+ zN}qWaC&riwHV+NRCw6$GE2?&(B3eS&K8&{cbLb3CeR*uO#rl|f!l z{B0@5PxG#6PKy1fJ+#0{-sgvwfY}CvX4+(p^1g_7?G=G5uLab3h$9>&Pj}jG;cW(I zE1N+*KqvNguWDz24XC!iE6jQQd{GW=`o3(y1K!0d?uTRk(fk4|9aXc~tuu2#?K<#i z9brpm=)>9W>^I=Epxjxc$)jbiw>CPWkF0tU=xb4kHK!`mX#wBZl$*4BQOw-(> zxyv0!cR|%8D@a`d-Q4lR?Iuux)&t}qZ)WW(@cg5l?#>>Z3`h|^)KZ^CV@K|;8X=8tTyhkMYb`+l${hw$6#d=xiq(sluFl=H0@5f*w%lVPk>=OO!ywGdDcUF|59}Ex>6{&SW zdq-oA1ig0l@^KZ7gjaa8BYu6^v)mvD7N#|!sMHi6y-v9aH3VA++fRj2XB{QVzCj{t zhR^&qPS}6}pX_+UYli~G#I>JA>c3_ZD&%Fs)$ntM{8-D$#%eQa%i?$4Ty0+>^CIA7 z9;;v6qiEn)2OVji29fuwv6&-Kod$Q2NZAQdxQlj49v$H_<)=n;N7?2|r_g=*BSRL3 zBWa>0bRVS^!_BWHOwnM!fVFm65Z5^f!GeWXkE%C{2sN6+giaj39ON^rD;lOHoLjhK zakaALUD+j}XjKJpb2J4IqcZo4`h6-}Mqrbm7+jS;T06w{xLK=CB16S3uZ9JT%u2`~ z1foXavHM9yk}Bj%tNpq6hQ?wVyzYxC(CCQ4F4Cvud`bcNAJrsPVCMFDMTDOehx-N3LOUtPplV;2QA=F_N8T~OIJXNLw7VtsW; zF9Q9ZwPW2pf1?<=wD_h{+1E%iB_>yFQN#DUT)@Jr3*#2?t|kxT+WF(HqBH{2`Juqb z4Igm)C}f~Z6b&8QE@sK$@f9#;1U$?89*`?x(7sRE^zQe#nNWbl(`WBc*~D;gJ#~~R z>@SbjRSnl`k?_`1gj{b@mRIoqVC;#;6^&*NSUXN~oX3`~zmd>TS^!6RBwAP`r0( zULRRn<`B3NumuC<$*>}}-D^NkVXt!@?Zs=(L9M9Neu|P%bLY1kG~#8_uyn(mkA2eh z!oJwH;!oH_>2bcR-x@6o+9U|6gXLCDw;venqQr+>Wjl+IhcwUC<+BMG`X~4#Jvwsm zX#jPW!aSNsJ4VQ3^>*``6%02G>M2>7qSp_cRDz<6$faj7kN?6qO@zyq+-{3Q|padhn~c0P_ll9ind^xXI2%e zy9piAcH3AdM9lWZxMc$K6{e5Oy6Q+touQ)o_`}F_Dpg-MS=I&jN;;8JK|=zI5CR2b zIM!W5=H{iKPv9Y1u+w`-O|&nouC{Z}8`+5Aw(iv~>?B5AtmU?SQyEZqBx53;znw(qh2|9+=~#c|&qkFuOvME)tn~cB$iz6&9BSyL zR_|NYZSwKN8$hWm&#(AiFt$7N-2!_* zo*p&qoHW7-^3bij{tHM|^*J9~!nAW#CYs)?mg?nQ=mWQ1KA3zmUScXYd^swE2Smc( znJU&>%t5gF1P((b+ndR$qfv3-f#7s>_g1sKzF(kqz z9zUrpMgL;~PblHog!wh`X%61!iA@MM%LoVLI%<@t#{)A=)3i3ki%o4&0VZ_+4&M}# z=CxxT#4Ev<2SF$6r;0&-6=4k-FO;L}D5cEIf*nuLw|w!`2)_lMz5t;J94v<*xbe+l zbrmE)06HaS2U^kg3m1 zYu?qY=?nZp+!}=q`($Yw1bjIK6ChjO^y!Zy( zNR0#8^-+YPEm8ryyKqcgXD%C}PtKoR__0^P;$k;Z`<^o%kiUWVu>{|};(S`7f z$cPE{byKN8GxdbrI}$}h`h0DPbu+1x)J6DJ-pp_&jfyh237gSKWb!K<#V1o5j2Kjv zRQ>)tpH;A@8iw%JmS8%iNfTDt-_iSs;o09)p6f_njxO_rmAEmeF-VvXsHawA`}Qn{ zCu^1t8;2Bz_5Q;CqV&B4pH;h&e7^S=8xcRIh>zOvdnxMveXBJo@?4+YE8%wwo-Hca z_m5MCE)AQ`(ipTRA7237iwEN^*D3qweHZI#!XHB7pL7=VjaregZ^Uq2Hp^O9qMxN> zlxtAX{ioe*N*Ui?oqF=%7Lo`t-Eh0JJ6VL}{8}V)7yBv-Kn5^!XZ$ zPh9i%G&xBN53@UNGsYF3>S+XB3QOXYjXx7|rFD}r5|39|`?zQ;Vl1&RrF(xGV4AZB z&fN^!KO&+L$<%F6t(7Jj$yP45fxVNsz7=ua*XO}RskV4*?x{Y7M|<+=>?%!qe3M7< z(EO*U>G1^IRI{;5((>ehqsF}7l(sAj)>B*9M}yEB-15#rnn1vb6+0dTZeZYA&>P?=Lg9%}o=Rw(!Gge|WI_6NWY z@df$gsy=NKsv5q>75BdMa=V948qT@y&fA7ucSyn^NSR1-iu0BtiK8Glio-FS`Y4Zi zLy?8TpBE!_8#~Ux!k;ncF_(7@@E_^O(e$}UMYOA_i(G9|X}PY8&|A9z75sY3Bsc~POKBM??yfvb|Wb|k}H{jZ%@nRKvk3(LLVLeJ)CAOAf=$v z8!Ff*Q3%>&l%nvzI0gMoWf|1Sq{-{9877?r!>!f;bsYlpx5j;UsCq&Nx1S$_=wX%X zw`>=P`t0hXaU>{3HR&9T?|mc|i(Y?;lC69fh%S=JrB`QVD)R?OPf_eNi4-KzG5XB? zv%LkPKFx~Tc~y>D>j92w=+39MgN~&U@;8S%xR&9s2S5M`eo3P7y#@?es@U27E&>Z6 zWk%natQGgq1_b}NH2ZdfvX+S~AS6$9d){kS+~Hhf`%O~`301c;r=ZCv^Je5Lq-l;9 zza6*;dNhPB6?t%QJQhkOdx_B45ec zP{E?ts5}qqmRBX?jA>A|gD!63$H>>jkKCUTzxo!#xLaVpr) z^_lSDty>7hV}6P6&el%|wcM#XUf}H0_^r)pyY9?mn#J{-Bfl|kKG~x7ZazuP!TvG= ze8fRN6=Ovm+S`nNdo$b`TK>Ekg%0DJ_6|ca40dM_$CcHK_4{H zA0DuZ)C>IWv?fNK>zY$&%|tLNkmAmS#1P`%@{qUrm|DM(*9!eIVNlb zS-q|>&W{PAOjVFMQ1C(*_tli%vw#@JO`ufgyn!mH3-i60e`ez4NnH}0v-OA9$a<;~ z_)FZ{ets5?#C~ZvbNl4XTFyd4rHtM?5r>dP zEsOaueFUqKzAGWvqxvL7YZ2LAypS`Q0sry?^=JwiM*IyGl? zYGHR~>Q?mX;*EcD1}S`?3{W`gs@|?yNRHb@*kiw}rW{gi7m^5f2#+G*wE8lFO2B3D z=U~T~htIGJ9s%L$(bQ0ifP^cDR@wv|X%rsl$-$&1Ka;wY4CXioa#LKoe#}v;&uue# zQ(HsueHQPsi3q4=1GbBCR*|WdSLhz*UzypS?nFZsge^f|>VYjhbj=pHlpA|vKr?EW zr|}5_3UIO(NfMF@_k}riYurYCr)l@}9nBK$C}ngMeS+LM$EQ{(|L*3(@yWS^O$`?w zXY-3fj)u>Kk7m@A)jfduvbnTgBRE?kH!3u+%N{g)H#05U1VYu>*mQF9e@9QZDA@~u zHv1YzM=vsR2QW0|Cs?h$Gkcq>N)z?Vp#Z(z66}Xw+BPTEh=ibPXUYA0(w)Q_qP zRVD;1qBI?2l3(Z%9ilpe2`szK2zesG5Ph0B9z9-=Ph$5}N@N5Oddw1_!yTFx&KhnD zXV==nnM4fi&^r5R!=sHswmfJoXTIRa_^TRQ>t`=DDw8E<;+3!yr%g78(rIemeoL2n z&}YA_ngd;%+XCu{#H3XsA81Ao?axRA&3Fr?4k6o=15;d9zt4b)<%7aPeybR3arbK| z64~$QY(mGhCR9!#!$$Xb=x|u|!>fAq1W8|g8cZ38=38XX)u|^y_Xlk{A;;xjMh2Xl ztqz(@_)jYE511wMT56=bPj{X09a#KA1tRt-Gq8do^ArbT(qvn9lR+Z%*+c~@PKk_I zZ|ljk3hDA|U%_RlEtDZ*klwtaAW%9P6={uyvxCT>#F`Gz@=!cRMMC->mB#*VZ?WdZ znpZ{ZD>%bh&=Kf$`h@HbG3R2PN&Wi=*0k_Pizth)CjtLhxJMr!13$IRkV)nD-n`Lp zlSJIS_i{ymaVH$Oj8P!UWvceFpEwKbc%Gd67$%zYTJQ_k&*u}vHL8hZBXsonMci-a zmorQ>$|C#)V$Yv0&7XCGBlLI-R!pa|WK(+4vQNl)5a{oZCHy%lejj6z-|W?oG9BS7 z)v(aVI4c%2RXN{>XNRcv7rc#tTl!9Asu}d~72={D?Ts~y2)Z}>fQ8T%e9L`agu7jP zNX;4puq~F?L1QS3wakmlmt54*M={fSQT(DOKjL>me~EUQA0{*}f${5$J|{@juX49T z3av1FN1yJ_5I5@xb0qS09Wd|8Wq&BlNy3fhXZAXB=h)+YsOKPu1~HRr-fzLDI7mkc z$z~Rf?D^`q`6a0L9*y5kMYstnKKhv>KQy**md@uVXd&aMYw)ieS{IVL1mKePo*Em2 zYeMLw&!mf+h1-LslV#HNkOH_hL~R^o0w=}z@OT3pp=)k@zvdm1A}|Fz{ru0ZA~ull z9TnJr%^whBp1s9|4>Oji=4o61{0=Yjgz@+spx5&)XD?h~98c2B*PvG<9<*M|*07}^ zAK5*O9TJiz2Mr;r8#RKNf4-XuuTUKJV2E;SSO+z9uFeqkBIRi?{wCvG|9@nC1yEJp z`o6%Ck`C!EC8WDUIwS=pr4Jz8Em9I9DJ?18A&qo*E8X24{@1y`d++C+|ID7z8T>x> z*=Mh{-uHQ*m|$y*=?Xb*$K%_J1>Y$byfh&qJlato2YQr}0M9##*$~HeofPRU!;k)h zv-a0>7YiOfH*@x9Q^(ClVn%{etxx$hsFdJK|9VgvKlNdh4~f>0U0I-6E8-AJA8kk8c*X;*`HhY`rWZ&n7qhcKPZFLY7ELQh zz1SLP5P-(VtNSXT!41xTue7D)_Svf*Mv1Hq(C4oM8E(Dnj$%MwlnK6E!HYh<=3VMV z-#<-Mb&rZTly}78hp^bFvmpz?^Yt!Su2l#~)CSF7?_5GoJ)XFo3HmYiDUs(FqzM+GKsT+g(m$sKC6FsVG#ZYdK zFM&uQi`RJmU?wM@JZ0mQ@0SXygzal%70c1a$6-$VZcnLrdyy!-mX@ZvtX*{J%tbse zir6DO%QR`oXYQ^mwtv!GWirwH5M^)Ox|c960juB&9*(AjMw)QOYgzjTr!>u15~Cv* zmvHHn^wQD1?L8wqPfr@OUM)V+dBk=^W^u}D@%%b!F6jHYs@@6z@0ybeU`u>gfPw8C zd6xuOeo@%%GO{o?y1DSh7{6)UnF`aeSRm*`{KKWq2{YX>a9AH$FZ)RmmjN?V(Q9y- zM0Gs=(|Zj>jh=`6Eipr$U%gvKjQOO6%7~5)^Sia1nj+i~31cY6^S1ZDqj$@|2jQ}{ z;l6m`_(0tftNJRwck10hdhuFZpUqJ zpr~it8Ts22x6I_ zg3bB+HGjJCZZBLnhhH5w;!E>Huos>1_snK3JzSKdxgl1xU2lsJ)fnQ#KQqg5g&VRv z{3z(MhgC_j1T8%X7S4eTUr3hb%mP3z!LwiFEyo12nUIh`th zWV9KE2EJqVpRr#7Gsg~V;CRsGf+x3|tn`ABAQX!6=WK0TJ-F7{shzN3gtYS%0w{MG zp5MVXRnOFm2(~F^C9wLC4>{9B*GAEP)QWObE*4apgokJ^UvKZJ+WFpYAqpYrEZ;e$ zqrELdg)8=(S#GZ{z&#+DHj9xQHo_8@El7o=slk{u<;Gp|iDRaF*#gdVaJ9&!XhK_4 z55H%<;Q^Dwp#_`w4Ij`0ZItgyf_}FUw{-jT zj7pY~SDSq7G-$1nmj}sjiI36F!iUA0-8qQ3pxF)+Z`-(`)GBF-FoPdLdM9SG+*uNS$&X4?yBSLNE+F8*w3}UeS=wQ zaCqN1)p_g}WHmSlhT(=#h&G$$eJtmgG0ZRiV_w$bvC!>TbU~#e$!B zt#}n>et`1Cb`YqNzvgxTLqet9WU~L?ND+3}c24QDLzC{`B>@BNULdQe{`@g!?&o2k3dYPWa8ekcJs`jhJ? zYlB%tO~TwFO}GByr@)|T)QsULSG!Z_R~E9kH+<96B>Gd8QY*}0-5a4g$gsWFrd0eK}&`y z8YvLD|JRe8f+mX9*Jt}~-nBkbpamKu0k1`WRG{iO{X+emMK?Pn|K2mx(XDE-Sp7Al zW)UrbGUEcnp7sHHu+V7r^f?@YNqyBet#NL6w16g5{6U_Oezh}<;drGx26BvRvADgi zX$fhCe~fCO9|?$*(p-mMcoLC+(|o1bhmd#iJ8n#%g?)K%vGloN;yyrH2?4Is5;pPu zzpD(zpFt&kPD=ey755Nc8*n}qAZ>))*b*LhGwkZ!pZhkOso5kZz)RN%a+M~3n!U}O2YtW>15Wt=yO^aOS%&_H7r-Vx2rQ$Dmx4!Ar6+tUfDx(V#sK#H zUiD&oCD^@#Ut2UqTXN+p`(> zUtn+OTMV627q$4oqY3-PHmI7#%10D|nk`**Gh&U@@!0>d*@fVSp2e(b3 zONH4WV*nyXG+30Lf#Rp2|M~Ea5nC>Gc*m_#R#mE=@AMvcTpbK-{GJkn??r&8RU$qO zAK>f8Boi=MLZ0RNYsL62Kmb^x-)JXp%RNgD`$3}wW%&0EAo|juZH+M~Yn9TT>(LC+ z4b!%>e#)xD4D)FPGo9f1k^YBIU?-Wl&4jVQhT@Gj*!EzKffp1rtbiyVgUg`O1N5H~ zjPo?XW)9hJdSZ1P)`#cL;C;TZAadKP1~`ziRkNf&P|Lf-2zy@iz(h*BHN{^xqylR3z^S zhuHw3e*%X?0WiUS%VYhUlE9jy5(UBO;5RVG-q!7```FlMh9b;8NIm@5E8WTsZ&x<* z_WeR*e$!#AeZc=s{;`qSp=tb%T@!u3kjtfKxal0=*{C&(v{m1}Flc55?7kQ<6#x@= zPcGZmp39npQka`jyg~IuxaZX5iRPf;w~thg%b9^7KIOG3Pz!u`O#Xhd@O8o$8W~i2 z;-VMq8fx~08&P$T& z)p7_7?0^@LAH<0s>)iy`xB{**aP3GKl01Fbz-rS4QYstq$vxmS*3;~LTlF|&7|@@~ zgdiVhUKeU9i4-5_&*c9IF&nsZ1WZkS^%DK20uu9&#Yl*V@}M>cuDMM0)m9pkeBHon zfs(@at~{QjHN;Cudi$Vwzpe0>V#fE}#Isr0;q~u}Pvw!S1F*gLBAv{?SkMFJ$2rsy zNhRM_VMj6s4tR=5_tf%PxdAfF9|nP{kRJHcjy-jAkic5;qCE10@n9eBFAexXO_9_1 z=hY;@k#62i3>ZT4em{5s_j(SqJ;I36UlD=hj~sI6etsh=5pnC?=&%Ug{;3&ar zV4<&;<$?Z7(;3LLqT~NKoW>8{kW#W*J?<(x{Bzj^E3X0fijmUu_XvjB2e*S0+h~5TfIUOzrbogB#Qnd1v zc~=Epr`88hGwA`v88hFoqeqpSFc_e)G<$&=*L)1m-Y^l@UCB^{(=?l2lFiqSNFZE z3@2x^>i$T%2F#-FEC*INV8TBL;-G-7bqsyP2FoX(y=OfM{BAvl#UY=`&UqC!0cTAP zSYYIIG|;U97u8rmBTCBoq;ioAToKi~y}_uCLmg>&=%3@OH3$MMzO6#0fHyuUbi3sX zwTjU!(<4B0c*O%ZnCA{$&Go`k`NAgl2<*(y&*S!ifi|tu4%gfYlQD+y5ZDu;|8l(y zd`Q|=#?rpL6qv2{OyIH^(*StidPmyt2{L#cB_3!Rn|<^E+53O%*Z;Mez2Y8Gdjp?6 zD%s~bwP--x{3##L9O z$Qy4Brnld&k7G5^@9(|=va^0rbWl$qNiX{cAok5UTdl)rAtrJ$FMrq^VScr!1CXqi z9pY`fhwfKqr5J&z9&yvJc!BjHJAo|7hnNt4uk zc|oPPepJOOiy{t7t#AsNGnM9_(Y8dz!0_+8yI4~G+7!#%>NdHfwvRF!pVpbyMwTV9 z3n0U<*JiB&mbB(B_&G(`RjYsAV|#_J4w(Pw)_J@vyonrfCX6S;U)#(F_KIF_R@G%( zk8k!Lh8NshXYIW0?+mARnl2YSKR=~|h&xe-JpDrX#wmJB?+iyZI_l#ys*jX`SWQSe zO>a%H3rj9q%pcs7^=cY{2rBi`r`vqb)Al|8r66GErFb6jlOFh^CwG6A@fI?X;0s&d z!FmMu?<-1TiTlfudXQ>N+t6EcQ-T3rv=6Fr3D@pNgNASJ zSE21+wRg|obdZo#0@b`&%fkgzdF^^w+d@1r)bKqvPFSeK=6pS*8_R2;zrq{=PGoxJ z5067-{Ync9!jn==!aqBIfS^z_2D(x{g8%O|hqIJjQW5{{^qae-XAHfP#mv!imw}DA z7(4h_zp$=aRMkydw4U#&Lg3)yAbiG`;fb8OCs-OetRy%j+)ycyw~z_)Wkz$Ak}W#> z@SWEC@cT92G<)$+=IaIH(8-&e4KAAMzZomh6TES}O|P&xxx7*_hU~aFM zzoDjsku|xQ_1OY|`dn^DhJ8S*u5hkO2>ZuvxUgIIXYa`Pn4V7YZkgY3sdOCzJOrel zwCKt*X%&?<+PVsQT^&)`+?e8WyH&zn-`=W&|551b+k;=VpM9>+3Fhh?&8yg7WbG!j zd|vO1&suvPJ^oqrflyD?81#vk7VDTy`Obw?*nJiHrCL6dGr*n}t$nvkiG+rhHjGS= zCr2?cdMsO6(sC@9-7IiCN5Pzsh0~-*42Eov&@cRu7OO_OGd*sA&&svxM#~ZZ&!-d< z~$ii^CpAt0p{n(}bZKa=D6$A?6<`DGj;d zcrZY8LK<+Pv2>m$zwA~Rna$hAQchA=Gr?Wk2R;c-pkloNH6$7hLwBjYv|IkshwCTL zfaOI8ikX|cAS+FzoK~s6%@#NrR%F8}GAc9+wI(V|6>fHW4Auy`KZ67mQ$nue`OkQX z&ne6%Th+&7{l8)VvjiT&^&^)#ia)`=br_vCP&kYsQ;ZK?6K_0rRJ`Y1%${r0p>a;) z8oQN70`K2~I3*9JWM_pYl1Q_Kgjg#S-nxi{&CZVnJ!#;RF`e|&%IM4T1QVe8$OHBp zv2+SgA9|iI6NW@u&!%WL0#7#O$yGYqy<(!6GIKKkyXA@b!^cYh&TIWfgv&mBaa!RW z=b*D}lGtaTW&6)9mI?a5pRdR6F0WMsvtWgEuRHcQmbdXc&Burl#Qf1dz?Z(>Wj`qn z`i&L*N6FYBgOxNx9uB>PZxK5&7dW~;@|@G#$Y+KWbWQyUvSo^D`$FP0j z|E`%&j|3_0QoQg_?yemL9M+HrQw0+QT(-na`(raWaumh|4;v+E0y7+e1ingzQ0(yT z^fT)D2m`X8pBdzC#yEnNv_R@Sptit1%YYjKkASc}o{{bm2zPLj)2~q>)oUSMFJSaj zdJuerL^i-qFMVgaP-W5UR;kMSNcm!FEn6JOp(4teQMDy0#c1Eif1!Rn-?*J*^ox1_ zJs;6UYth39#y@xK=jRToN3|UUQ59Cp$PV{6&h;-=Y#q>sj-myep?!d`Rlbgc!svK^ zo3wf%30_yP0KY}0PRz9J^1I)>LtN<6b*_v0fUp+(OU{XlPy&Mg{tvEqqk_J?&*j2A zvhzC+$DK3Zv?Sdc;4vX><{T+Xtgrw464hq0T=-6=3VO~+V}#v3@^MR?vgv3_!)&6_ zUJ?^|1pc3mLafyko-`7A_YsAfR#S3iGF9M{(H>5ng2`pLQ zA6xDv^YW0l1Dzi7_sup#0MlRo{^s)gXd8Qna$BJ)@G!HnUOwOWn722Zs7}at%}OG0 z&C0;KarFlayqI+mkep!Rf#g$*$D-sEP8(-O6zu1x2oLI>9Gyz@-aQGqUnyA61nix+ z`D^i=xI@4>Z*C&yS~XuLF1hkG(Yng12jl_e-3HHZ?^G97fs};qZah3ZDPaD{!=rzp z`lh4B2!UY{>)4vL;|+X@searK$A|ne{QD38d1b+alT!9Gwjw8>YUG=UoexZR#31D} zv|jFRll$VZHegA}=XlC-;Tw^vQ)x;gD%x`N@|YNGTnO-y9UbIc$7-4_zIaG8n%5)u zIOtwW&cGV{Eo^h%a$a45Df%KOB|a}&im6oDA)w6##kD_ihiE7h&$sw4BA**NZz#HR zjdJ|+B45$_e`!-cUFi&~a@GnQ2EuFQ{I6f?4`^ z{`BDt@Oa(0!}s0=u?e6w6OqmzJi9Faz7f_I)C~q0W2`NAI5lAj-%b@3KpA1tafIDf zao!$`Iqn~TgodyQEHB#of_#7acY#s#J8J-b?I_vE9|>3k%aC1{=n^0F0?d=_BF_vL}UBJTn@LZo_v{5f?8lzoPK z!zd}2b|HLq39~D%ytEyAJgM(lQR2S|45B_xrD;X1B;qt187A>@DfytJ085GK+Vg(z z36*{~VWJ2KJ2}9JGVV$yB{1RJ;cP?q(bU?d5R*=cF2C{WCF!^1h?K62X`_0(Wq9Aa zXi`!86u0CS!{+6mI@R);1-f+{00`R3skj2DKtaOwqAKY^2ltz2=>L>blvrf`SI4X4 z9|E6Pf?%qut=-Zrrk%=L01GHK+RRqa!6RTabd#q_4=8sV80{%WXj)as_8d~yAI zIAVR<89EItFi``o@LBb!zTFTr8N2&4t;*>9b51^jb40PL7z2Q;x{>{75s->xydGaC z>}GCdJ+N%keX);?*mJqNZ0xepo16fct+F8EA>;WM;c}_Z_srXQ}2^4(|RB z_+kc+al3FyX1&Duo|-DI9Gp1vSX3BsR;=%X0Ff}m2`6T8SNd>>C%OZv(t`HPc#JR? z!XJ$67KA^!0I!H@Z-{kXnpIi=qo|jl&&mZh)?HjCd%pgDJ61(IUk6#2THpSC=P}4! zRtqVg5}t{B-=4WYPyQjNcO}KS2Pp&TOvX<{m%ye%(lsbS?QaE?@)6mEz(*|&OaE6y z>$dv$?7Y2h6d{e!9i;b~tI{nSIEDx_Gxo-ow@)hdH!d<&td6B}n*cW2ofp+GJ6yL6 zRBKYuiGeRPNO6ohecCQV>-xGMhSK?&gd(W}!w8eJFi5!hb2owdEY#RRAEjPGC~}zI zR~q34lg(#_%=DPo46N{SObVe89l6;5_7boaP6v0vrrZ4P@gPWP0K&rPV{5~He~Y{` zfKi0hf{KV}t`omENgkQT;qfx1T9%noACr&(6{R5qynpxSrBP0npGqQj*0h-vj z%Si3P9*ICsVphFP8-OeaA@uE5LsgsVo%8*)OTczEkCGB)II;G%s+{7v*VdX?I~JB* z!XpwcnF#WAbwnjI&DVE!owSjrzuDu$pnqmL&9mlAX-}W)=Go2oTmYqZ;rDVcp*_jQ zkq_WS*h6rGLhZ@LQ2u*kSW!xp5o|9&9>514)ZsQDXvOYc_}D|!%Crl@GF}2-WW*+& z77=fT@ZP-{csRI!X|G3|Ca>yof8pA`P~rZBl$HA(*}Fyr+)_BHIN;S>JV)I7`IW`0 zhOm1tUlj(gj9!dpNCqR%_S(+Zzr05}V~8wA84Z3koFa&Os1e_ViKm>@ON=}B_@C#6 z6_O+dTvRMFwLdlQ4~qt_O0vGoLXdjl4@_r6U+LZFTPJdGz5mU(V$O+-yd|{+obPDc z^Abh$1UdnEE`DUk3F}*!2xR6PzgNdm!iVR(Ss6k~z*m#yJMra2UTl1p(xq@Txt_3cOiw5~g!MY;a^4)GxX=~jXf-()%JBVc_i;Q7!; z`XYUiSpt;N zz$mj_r2R=XL_^;^{S&SJ|GZ#}bglg(g<6HuxKgA&!qokj1g9IS;2?ee-7ea%hYI`< zz{^S?1Ry6zA$|l164#wRYKgbX!NZa*V(9dk;zbQaj3)4;ku_Hc7$OTwMoZCA2o;82 zraU#^vbedvR{iB-lPUuJ$s3URf<#k1GL9(b$a*(qnI;eR&U||DV8%X}#z`Xj4LdK- zJ?liE@Z|C(y3HBt-&;RE97dQ%lZP`gkJpbclb+v^_0DJ4dM9#~NEmf0Xz4Uk);JiO z_HX!08-dXS1-H%EN6;piP8*5YCgU0k4gs-Vb~v@c!`<4Y;)f@Bm2+J|s^dBuA_fPc zM_0uBP}==pho0m~UPmO2vwkz2V>;~Z>f=ON^tx-2 zgcNNzmY2y;i3X4gd&EW}Arc4uh*=>Or4d=(Tg19V-oq!aNTKsy%Tt{I;ggrd;w)Hp zF|D>O55zVWg1pHvSWy*-(|c9cPaNYge;s^~6y8NS;um;-$2SMyp7T_z5t=_UwHBjo zbV>tk(5_hKt(SpUX0(p+1JZU-49LLAu5AmBc`InaSve@1kq0s_Q7~q{4dS|{sKilqV)z7<%o!c(%=N}8jz6pV+1g;R&Gr1^`f~a zwt{128#rxpZJrK42LUsz1g#8|hSdJ|)C9nS?5(2paZ4_M;msS5!&uBDHA0OO3kn`a zOCKOled?lMc*Q+_T=w!Vw*dnWUOl53A-8+4=$|E!w=kP?;GTGw9U5Z+9MY+OEo)`H z@SJtHdPK;hCt)dX6gRCC*TS0HDoOMA-M+zHV%}|x^IVTZ_Hd{m4bF)9Q&ApM>-g@u zpy=jRh4p-W+?(d}r!3k(qM{j84*H+5x%5Kl!@ky4ti_$IN94Z5KymK%Sn8zNJ@Sxg z5G}d>0zShAS%AGU9w4n{0duGyx-q`36p46_8vxpVLBg%G45}yfKM(hopla+0vg9c$ zH;QRTK0BOVq&rkefcqu^foCkOWb`$l7HcK>XPbWnmrmWP9|GLF*+JoM9zajRLx!jl zY`zIt@4eU(OkVD`-rgWt47%7X>Ki zh>~ji9n+Qk=2x8~gZB&F6>m+xYYdVP`G!K8|c`FTJd1s zELvol(?3iR92E5Y0|8|#WTxM4=E&&mXjwA-v09C_jz{G~^83$!rj$;FxChywCt^4Z z%8Cd`XxSjZbo@8###rO^X&%^Bx|9NbA-sI~9a+fdZYJM>1GN*IbNPRc2`rFr0Qh8T zD93wkZ{3!o4ECZ{+1%1@cwHD+O?jC}wXYsbnl|vGOSSSP*8fDPJ}acC+9iQ>MUW}% z_0TGefvtL3_xu!uxJ|we-xoPDYS#?6^D2AP%}XR~#$}HvXn-G?HCrj8@;S&>I+`*V z{`H5FS9xE(LV#iAD$VDI=9`^Djd~}`H-An&>fLwg!;{EIok~ss5}(5KEJH&#u!R*T zD1iPSlnWDC(!= zGcax;KX=@%aZgLy6Bz1ebl4c!{-V6hF&H@iKM)DUHqsAc8KV`d`b9ZB>1E45f>f?+!2v}6uEuwlq8(y8<)`jD8G zR0PzPynr)y{Ako~976v5BFJ1)_-~8^Jguca5I0kDTMT0c!7m^@Zw&a4D+2>Dru~Jc zw>l|9wk_8|b2T<$=AtP@FR%?877V}OS%9tN#iZkR!0V0xns6@cg04sqs{IkO$m{gg za)m5YcW84aLn~2@`A`axHx=vRtxJDxK47@yhM!y%|H`dewOG3gJdI4avf_jK zkZZLgR8p_r#aoU$2OtSiQ3-f$NX;+(if>><<`tfssh&S1HeiUJ5A5UrcrPt8MQU2+ zrifx@Z;<+yBQ4;22*ysVN&x;{4J-$DkTFc1-)RCX|#n^Vh0`t?+iH>|S)h;z$C3i!e>%4zheKVUM` zvDwUV!IBnoymuyaz~C?+)LI>!PG%_PQM~Fy=>e+aifLLkIdgf5ltvOv!C}q+#p?fs zQZpeRof>gte|DTbS?98vVg?6LjOpr%2`d&>NO&vA_t+X&5y@brhCAY=)`bgJDU$%r zo%FotSx8kO%v2!KDHxvu)=9n#-=cxSi-zq%-#*OXIK#0n#sFU!Vj(xS>*TLgNt`{& z`*7apbDF@9=}Q6y`XOoBj+HeSTsPt}OF#arP(Z z-a_@B@q1KSqF3iY*TjNzrct2%WoC8PBLGeVAk%Wf^S5$?QMP@3mGCkjC$wf;g zmh)e$b^Ej~J$bQA=?!p$d5(VX^ej<0-|m*ean+JTIn8@{HPA$yhrg~Z-yJx!wl!5g z(1j;WamsxD`vqE%q0G>R<97MY$EaG7UA~vFYS0%Af_-5_l{}D%SWz$5K#c2lcg0S| z@9^>AcTGf1sLk*~6JEhcZ@$O*4k*RipM_r2scq%E-(J|X8@}5Z`}Iub6WJWr5^L{| z<5jPz+s`rIy>5EHOHT<_Vt$&H`#^eQUqMO8O~$o%dYRjsfvii$PjX20_g#U%Z(vz0 zH1g*trzS1n+Vi@{r7_R`FhU4Vs#s!tpD;{<@z@>6@X8_*;wUiDvc<|%fivAs-Fn{< z7)YtCGAM@Bd{R?UO4BoJHv`PZ7MRpo8z$~4ibXFZE^%% z7YME6&f;hJb(QC8iwd~%YP_6rD{%>px+#)<$BW>-O`L74s#*DD%xSzaK)4_1BZub! zJ=p?hFLqY+*s~0yeiWEPVo0~4dpEID4|y-e`9laS22Cm1_kF+4d#`0+elUiS)DdJG zGRvz84l2?WQ;z>VgJ7`9(by3T7XyK^12$KSQ*J0XV8_e@D^6{0IzyGVWNP`DRB=1R z=m#s%s82k8m|sm0dija)NiTCN=6prtl*vv+jUK}hI3knIW@-C5OzKK9eiI+M`lK^{ zYOUu86izqo2@GR{_AN0sD5Y_!(LL|5eIgN-m-*S}{|*-~e=r@q&-c1MX=c-~>Ebi) zLYt$EPL&W7LxT6dy~q)*vCaUvimd7;Nb=FQnTUl)k4Ta*1eg_I!3%$%J5k7R+vY7@ z4ZcG32et7SKpeb`%UHuJoOh=*fCz~|g!@l%(JZ~lds5GUgki}&NwM{F?zoV1g#Q)~ zQ8JW(qoV;bZr#bgttTL7YwTg2MN3=(1^dz1Hh8C10oIpe$448UgoRa>^vGPmc0M;^ ze7;L-Ki_>;CPG)4f{OKdPo{I_DTQ@J)^n~iydGX7ym$eHb|8DV3r&meb1I4O69{9{THHTHs`p%v2L z0C6&4pQuWCgyh#ujA!EB5{UscNZW3qEq}kH;P27MjWoULF`Vy2eeSfQr!1aA9%x#J zBMn&JNRcv4X@-(vv69otMzv0Q{H zRy|<7RwsV*9Nke!34`dHyqfWK9pl*+!9P%{SZgpcEXYCr#B?aBcucM>7$ZXkGfp^S zx=3%=JtdCOv!}nZ{3oR!vFomB3Ts(X|%Sjp7i32h_;~C^pP*A>fEw4Ow zgUSamWf-ODXg+83eXS8m;{8u4>o<>lgql7w@=Bc-!{BjwkY7uSsAlmSO?mUOY1yBj zq#yeOOcRHp@%DW$4tVydzZAoZD2RYm?JQsYJ@1NK=abE0Pc<@UZu(Zya89$K5p7BS z0{f?Z0P9fSo9RmNPf^aa(A2tcJUCdPBjnC%Em`j_C@sEg05Huzh5tx;tLvh-4B*Uh zX^w(vhT7q05sqpluBY7ojMOz7VCiPQSlS?WgVv*9OlH!(x}JP(3F0AO1R;xl{>sxo z(t~J3DbJa5&^+Vk8{K2nC}UFani)yfDP#=f1yDD!Zk1^fpsS4ORVf^m_gZoTB^J6UeVdxzp78YBW7$9nFXNh>{y{U$p zamxj%s-L%S@*f|eXXRRUYlH<2r3otZzh<76ASjG|rdfe^PH-@uQmqgOBvazhT97u9 z1-=-$&}nK-dkUMo#&=m}h=knUX9MkJf7g;l^ija<5pcCo=Ie~#ugnBvQoIqyJKGF| ze8PJ!ap-)Y2dOd5!8zG26^=LzkjJ%t2aF0*txVg;BixkxM6jYd!fOP;x3uD z)t~PWv2(sI)>i@pGWPjzy~KnsOu#%I3X`3%riZU?Ty@L8k- zkkGZDBPKJxfMzA&$OC=Ks3Geix&@T)fRuC5h|T-9Czii5mV%jgQk?sr*8r3~M;`Fo zbRAWjSmppijE5ltA(e?Osrk~pn7~2ikqe(qZfe; z0o_|0D*-h7i>@YY1_zj*86c0Lj*Nd)z&t5|1-Q(|&p)2y^=}1;SokYAdaiXX+}R2< z=R$Hu|G!#0P&faOp)5us%Ffz32E!25{kBa?Lo8Y5Hgb)kSN{6=y#)oD#q#;%+2yg} z07*F8wvJUb4HSjT%FRL2Gc!Nk7|ucxS;-u-rxGDQDSwJM2pCzoB(bLbIsFMHuKpKF zly+*z+?wZ7i73dUkbg#4;1|z)5*y2wv&mtNt!985(uU=n!$7CF7n+|=Lf1qYap(lM zh@_QVu-ECf3c|xSrS@vU(p}-c#Ja`d^SWXKvx&}T1UvE5wiShOtId^piYWnFI~2|Wo6<558W zGu)Zv@ToHR9OkL@{g~iQlfycyJ$2qpc?793>t5$uJ>)ww!aR+*B5j|NSWy9_zjlNp zVR$xZy~}`s`#OHR-R2vX+c+}@>5FVG9#PQ~g17KSUlp-LML0cv&@RlvC{ z>YCWaS}!i3*VL^R)A^P|=5YqzySC|%`%(yQxOl5D(PLG5gBjRa716}skLBNufxiXH zo%satQF&y zLRT6{xJmZl-~@5RhO7n2xwp{ZFKDo8?oueEG*MX-){=>Y&8n;oACqn1KaJ`^=~*IkSGmFilV((S4*H;?kzYgJLUC+F=H}!h^SsC(-Jx9s z;t~M#$+n&##XXwnjp@6Q={~@|@;cZ&(5wzC87M^jPi z&uAD~_P@W?duHP^s>=oq67P&KB}7#)kaZ6^d3R`>@?AAOjbo~@W!Fb7^X;ps>i+pSw6U(#g62qo(=W!K-APG{RX!%S zGsAT*5hhBr;~2u+l*TRBApKH2X8lvrd_v094WsYh_Y`hLZ|)HY_KXfiu`bt_T~aRx zXpZ-BIDE#9R|R%{F~p%uQ~b=+DKiw$VWi-*6SMrY_1hhW=vUb-OKdXDx zptgz_qO0EfEmOkRhwko~qAEkJ4VMS*YQkgnm$X$xmNGndM-Kr=xmGO3ZGBF3qm;-N zVq#r~DYXpIlS^ey*=-0YE!!Li!uo2Y6n=h45b7dhwSA-ZAmT{uue5SFm_Z*4Do{WK za&o*+i-rqteC=YU`x7Xb3)?d*>8(p2p|4n<7J#MBRKu;GZ^lsh2N)dnTZ?qnX#NT6 z$TQ@6Y$9~k#}*>R3E8_z@IyNQU$iU6*YIFvB22M^aHVbm4zx9nAr-ROx~v$qfYNXj zCfBYY0m^TJa6~~&M7a3%jvB@3;i2-nGMW^cXB4>p$WzH+6sit-Gvfjp8&Ouvc>vK@ zU5u9TL!PqeOJULuyjBbO+CQ$05Kt(PWQ*t6#8UMWP+o{S4B%TNZW z6WiWW)BeQ~NjUM(76QMUIeibS^5*!l>mbS6{sWcf?Zo%YaL4Tu*>IH56hFMI+>ayF zU#vc>h_^04Ozwu}gU##L83NG`wTUjt;{(Kl^_3_;sK&^=$+l3ZR}h^Zl;5e)(W#&A#N6aWMlL2*MCZtR z)ePEguCKeQ=k+x*SdjT-V9qQ<_)ZxUfIze=VTs2b&`O3fu-YAF9t5>OfMjF4_2%gS zqh!le{_!JFil#gd;`oGY=Rm260v#YfNj_i92JI8s`n~XEyt=&;6!14Y!OV&;f**#r!l$)g6BavEYs+nYm_{ZKU#|4*urH0ula=(pl=&J3AQ}BFv}OhN~!F zfIE9bR`l!XFUNL0ttC%Z^#HWgl$0tM5MyMRaGYvyZk>k!UymDgtoOwkeKIvi{@#Qz z+LW+SlS5*0L1xKRMX9qNY4*txpj#e^jOnvcli^IbeJYna#^Lgwb9zg}#sBN7!n9wA ztUmwTln`A}a|DUx7E~>9k@aq&IP$lbRgOfw)R}>0314-$n(2o5moE8oJkQ*wEcT+ zNl4Qbs((Uw(w$)fjk$8p>SCjNC3r8d`yn;9i^?gf3ne&MSYiN^6hSB9QMBY>cD=H} zCwJp$B=|krsTv%^(1R?sZ$aU!N7LFZ=`5r)ssB)d?O9h`XKiG_=^!qT*j`+CMnLDclHa z&n@BBS!gMD!R+bE{)x=;FTLZAsPH5DiXrqxkvD`*i4c7bsKaUwK5PGc(adU(V(Y@l z({9JRlR{P-!PpOvQOCl8Z%KrJ?TiDOsO^=GLX#=8?TEuSo>x1=Hovlky#xjCI86Ka z-fHwaSdQoBfJD1{xieV<$pBaLc)_+#RXrC9zCnv zPe6PZgK0uE1%j_^ap7O#LMCtwk+6umm;?no^Mt8OE{BfKO+&~|RC)+`=c+LMWz&~H zh|YH>$X*=c;nSR8N{P*uyOSq+jc)91<}PllhleU;bFSZjMl2>gSd5AA=tNTob31JZ zK&0OxgN3CY+wRm~hy;Lsegj=rT*1f3CszN%@(#c{P^DKJ^!ip(b+WF4Nn56@`QbmW zBt(&mcwOZT58N!V(F^KJxNEev^BGLLx1qxLUZikDEzT8aHbW6Twen;D9Xf;iE}#0Q z4;6bH|7C!P5+GjWVvzG{e<G zK)bzi^-KUYJn4oMe{#BCEk{8;h0p#BZY7r<@SyE0%_b&!Y-c4%lQG|+`vZnY;({u4 z5OyAM12&*iBO}5Ig@17yf`0r_$2}O2m~z|pyYLTunQbGV;t)C-oWkAr_j>^`A>^)= zYmDD%Qz8&HDT}vP-fDZ|;RYUSL=q?sX%{p;L5FGLjHmMtK|`npxaFxDpR@=fc`uZc zT`fSU;Tk%@GA_e;grm#;O|`}6$1ZOq{SqPyhAN8NrM?nXRmy_GCqzmdU@%;g!d2J^ z{t5{%zMy?>2T*?3NM&^cxLy7ir6q;%MLD;B7G{>7fk;2VyVPLkV!2(T%@B0m=g{Mw z9OlTyL`MJMX9CZWmdZD@njgbJXBD~O?hJSXw~9zqt0`=Ha$H-d5Nd8HM;ut{jDeMa zzJrQ_qFNA8>iV$s6XC{Z_Oj;ZE1=n)X|4bKk)qnd?Pscj;G}ffk=g&TG zuW-k2FaFLJ0(Pq{-B3U_=YKuYsU{lQOBLb;zw2`&C(lqZ^u#r8kh-_$rVyDM;ab$+ zfY$AEbx4~_sTPb52>(nR4cs#QRQWN`@cE4X}?Alx8DSkl1xFI_Z)-dPm!t*CMyXd z05xUIQ%CHoaJnQZqQB~*?Cv*LEIBu=aa}PJs=d%)+sjWs)L#Co0AkzN%w)Zi95qB+ z)hsWX7K>5p=S{r=tiLsDUS&ueXhqa40H@R{bXT0>6&x3^3N<7Ov6FRMe1zw*)3~uR z!7(ZK6YLMvFLk(3;fb+&7@mvVR2=TF(q{cMvQv1hGd{GF2g&4uYJmhk zd131P-EM9x>U&a(K899>QLTqEH6I!Bi&sr=oRfsDcmO?ous!~)sKjxAg^+tPo%406 zK3!zscQt*`f329HEl>jZFrFhEG#KN6*O*fkA^k_iaPYI}7yu2jm!4%Nj*287JyT|; zKOKlypr%?HA`={VKjpHYD&YKS#_?4R2=5GWYipklEd5;3I2(q?va{>P?t^6)`iQ|h z9G@v(!8zr*mm0I^BK5m)$u*cKR5lo6$Xk-eNUD`(s>Yy5Sx&%8y>*bOzILE%6$zw| z_UP|~{Q=d*A4ZAw?pD6|O6846%j0v+tex$b!?9*laGOw2IXybns zDAVS&L%!++QvnPE2qRxqCWVa*5jbw*kYrG8;KEG&uw`cN;zQx#;br5?f9ZK&`&X9H z+75y+h5Ewy>4{`^?|M_?#MA4|4iqA99WX3pdVZMzyFvxuZ3x0js@Ng3~+deXeZ(DA`Ijy}~a zJU=5}LK*-!JswWPnWtU;F21t7LNYa?4+Fz`=3^dB>w;y$%k#sJv#aLA>O^gen^XZv z{T6eZzrY?ut%s){#E}hj(j6#UPPjS?S-yA2NY@VVBt!De4mp4=HY0dZ$l5Zoe^#ML zq3s(c%Ua=bi(Mi;?uu*NtR{>8+M}NN8|tipPM1g|I(#A;4)~af3@lUZYg|| zqk^=)jm0=uF&2aozAmsZr~$^CV@_*w^~lgF%Wk7+|X1j#S&HMMdE^=xw-4y-pi>0vVvBbgb|I z(6^JSiDWQ{iULj}6Cm8)kvJ?n4j_oqC(lLT;qH;8tR|RWmyiN@LM4BS)EB{jqF4~( z<#@eHe7<0?ER&*RqDR92j`sX;F&$8;$b1rBxA*`<;fvJ(RrPtQX#9YIIP7ick-aGz zYkcvmW+8z3E_HrZ@)QLTt3_gLp&Nijw$%pQ@+VE^JB9ps2MpW zaA^-hH$q(v)P-l#Dxr*2$qncLdI6wC_!oU3vzc)3z79i%%7g5KEuxIUBhMUc?JR!+ zPiI!ekii}5Vaym z+29l1s3;U`L1ONafyLLRJo8UwJOv+zH-Vxze`n#u2Wa>dylFiM?5SCpldJB^G9_85 zT3c8-7>YlW2}+aA)h68B?$ZTR_ZgLWe`Ij3wOu4PB~o$4W71CnY?@6=&OA)`c&w1A zyk26BLj8H1mzldJgLBoR`&}Y2$Yr&D7(vm1c&!fZ&f;LxF&_*j@W5CnM%tp(Y>(|A z`6uuG<4J|8^&CMYOmYnY;xwlyd|$QgR;f*;WbT*(_{H#MR>(f6*VNr{9{vU z`q%yOEYGFx%z9(ZqK6SwoPD$2>!~D%)c73gH-#izdN$ap^??q7kz(V+_31XJTrYVn z=8F_~f{w%2g|&?HAb?h@wkhm>iTjq^;rb9q9L#vfX$^=*2Fjh$q06)OIa(QRH4J?;)IOmCGyz3 zS)tQr3=F7cy?yYEV|4Rg1jUkO{RA_R)pMPVXLP`21Ha6j^Tt%7Z#!-^Lt7#1n?tWS zYSBpAuf%n$-5gU=!CpDq(Dv0h&>Co9^l_P}L5K5!P+j$rFD=^F(?Ei^_}DbI5ib=o z7Xiyso;tp4hZzNzo=c0fXX49Y3v7%oT<`kbS1K23i%qUjnkJm@+u}3VS#fvJ0AMhn zi2*vH+9i6C&l>}Yl7mS+IV91kczh-wYfGq)l5pV>M$;ZKm;n7vv6Jw%N9+C3`ISH; zPuAMt^-B@_&^^HYl>kxcpDR*y1l@AvqqF4(p&0vqeopZ0#N0XobJbP~uW55JuBgcS z&)#LOJv;z0Ia9A&nuac$sM{Zec0u6y6McZ$`o!vlIq|?@cY|eK^Gx90&E?|%)%6u% zSvFhO4~P;<2ntGfsDLyQf~0gR4bt7+pmZxBT_Pn)2!hg*B1j`4(%l`3`0wX^&pDsL zkB?k%>CD{sp4zi#t+o4F!lm0VXS2@5-U@}M??juuJXPF|H`QO>4H~G>;hzp=f~c~eDcU%p zKK0Awv6&Tn2!TY>I^VQ8aUDCn9l}t1i$<`mYX0r&>p<*LaKYogVvnMus9^FM54_Cr zS3)LGZ|0G}+rhMZ7C0zW#9cpSrfI|~wjXe0uuh~ZIrjDom5&i;)8p6SNsBhaHO?dw za!lw#$r1@6=njKO2ojK;0xh_n?{{wvyCs#yJHQn>O)k0VgN2Bvsbq<@m%OEh7q`CK z)+=?B3+5xixynXU6@2rArY3UC?jva$ZJdyR-RNG>J_L=g$YkHTGdwLGZZ)Uj1!5$k zrk~RiTzAwv;b)mEjZmjUe%N)jqQrvN0~Lqwzr*y&A*41TpICtlelZK* zs8*F6X>oAzU29tO;GzQ;qa<(qJ9TN+y+(o>#}+aAV8pZ{hd`+9f)uCgyHbK7;5Fv! zP1Ln|<0*J_L{X9Js&Si`eoVb}Ea`@gI!a)7&5WXraE4?7?i8+*^;AylpIo-jdXy+L znddBYkyWTtWLQzH`o8sy#L$qT311Vx`IG0;0%mEwksSd60awa`R^OpNR-okNP2`m+ zw&;EDIe~RX|g}rH`Iz{DsTouY3UF0C=ELqfm78>mS-IA(^^Fg-spd03ktaYN()a z*_G<(<}=$BLO-8p_P0G@xM$IR2?zusk>8EGXjj;tqA$JZm zBZ=b#+#NKU>j@T4Zi=ax?0u`0WAzco9B1d&hoa*Vw#(Fh4vOJq;Ho}`&=!oJcy)1g7 zbEFuM;_nBypfCt$?`%aDT4d8tFxo#ue6^Wfb?IqZ>3F~BTf(@6!Ft`SzX}_0E-W=z zZe-a0&)c6U_uN~dxbRGgsgcDeME?w0@I}853?*Ji4hD}BEZl4FGY?)rdDtDEXKxDfnGp?vrn`rUMdTo~x$6?lNxreXNWWFS%)E8(~B|p+s$8V|4}O7*1IMaI-cF;r1mTIg`YKBZ$hu` zi27{d(?zV@p$~5~<~`TeCbYRxZ(e`XX#KLTxG&ZjcF&Z;C!_|A!GaN#NHodC$@UjY z)K1M`n6;9J^3OBdcgmeu&qQuG@^(uW^yL(UyhXo8TVX{VRP>ef`k|(eQo!Tsn>4}V zuW9!`3b<`%5*{3g-afhFLP*r5aA`2uuV3O5pMgoDAz%I_?uJ*|r4L8LW#jQ2F|6=# zJ6_w0$b^uryN=e(#FId=8R3sv);nq z3Asp<4;gmSxs9d0b-6n__}m>a+Jrvdc#5^tEPr?m#1E}1j*L<*E60hrw$%HV$sP@y@@}f^bON+RATBC z6F;Vms?{+6<5=CTc|2~5*QWL+Q$Ic~(CP8G$xsR0;gu(0wKgi|8|NJpHEJa1$0Zk_ z)P4Ga?VkHgyY=l#(B-g5RZHcZ0t&QrYdYx35ew;yBrdOs3AC+ItKut&eYkYeRf>|p z6I_B$px|J1v7PY9BSxO~8>d_NOv8k)NxE=zxG{~m-%SxodV#IU$xqkaNGHtaKiRLd z=vEndMS}^fOQK(5-^++33?dQ|%A>GUEeQ3w)8K;Uc8gc<3*im*OjXyq+ofC4Ji(g* zn)0R32DY@ChU(zhfzQA`(27bJ^9t9gF9+1t@fKoi2ib%9O4<3b5|~lE+UIPmo1gHR2GrV-lDB!)ZRM72x|**O>D6!+@W9Oj zji);#Q_or6IoN7JKUutl(fwtMta9Zb5u3$0AmJte8HI8DPtKg{f#?SHl}mHGvzmnh zSuT(S!7%(Ky@Jyfg6hV%N!nJS&9gQl_G|K#>;4f^KQG^&V+i>1s^cz zkz|B^CpqbewHnKqxgCNX>-BXmlEL3iIf2KArOzFehh1Ky#c23Ssq$G=R2RC*a-~@G zLld~wt5grmQ5_OyPJ-foIfOa* zLn3l^0AgQw$!)}+;yw@@U{(W#AXPDHVtv@^Oc8}P(4w5o0vx0#WLe6p@6eeDJ)>PX+e&GF&ytF zGa?9TGI=e$w>XHKIZ%)7s;!RLyNTViT#8cPEyhL*Wl0e*yw5yBC2^e?r8;4ZNM0w` zSy6RTcd&5E0;+X% z5mfC0=oQjmwjAlVCOVnZfP!{aK7J1QO$&+8)^f5{_ZAsF)o@l8LELVEx)8}q#pbvd za5H!qy)~MP#yiyqpwo67@~tjvlNo-`H0ssxvS#h;Z8G?6krWEp%^!0TX@NpoZnkAW z^G;3HxOBo9HB>x8k-NlBTLtNSaiJY1*%lmrEq~M>$R)P=<$RmQ`~;)?IywqUHGy4w ze)}V9&>kQ(464jE4Ss)tRSxHFcWWn8Y@QV43#4eN7@-_EPtlUppcU$T->-{m{5(^vRmtLAX%u?Vvg7laP%-xtz(`|}SX06F z5OAq%p)(7RUc6r!SrvZzjIh%vJ?W2EyeWZ7N@H8f+ji@-5KN^8P1M!FN`pD+=^kc0 zPy7$m_=n7Tb*a2w=xAs){(c=2az1#IvhgpB2XTe2Bwe|;qThCMD{~tH#$WFXf-L@S zJ3~g#Y&U&V;u5#`!nJKzIagL{oG9$ak`F+(!16KOY)cWu1{L^o9ilmY3uAH}~;?yK+ z?c%!WYLTVE&ah?Eu=*(gc;-35gS>EKgT~xCT>9uZ95n}Yz}My8D^ycqDNRP8qK=C+ z7-!Q9H4GN0NFE*DDjZJG^Ul%6<-b;9Fo#t+z@nXhGxEyqhxGD^cXMP4a78CSQ(CDr zIp%h1S^}b|rpZuyp?RB+?0LZl1P-WwBxDw8RpP|*Uo18I&H^#<)<`eONcMn^fR;Ny zk8T&hv4g#O>s!Uhm7|$tE^_8xnfPn*`bIt={aTZr(23%Jal_}zg8Ew|%<&DH+cQr< z@N(Ms(aLVV5WFP6*A-g@h#9sZ^jmm~jPyw-a?HA#V=>#8A&q~O3GmVy=ZK44Yfw_+hcx-XfaW@LIamg+tu|A~{ zNw&))b|}5k2$F-_goWpaZ_ZhE+`A=nz>wi1?b!UJMi{;yx^TA>4eRnXqZ<<&y=5T&5^P8xh)G)dK}e* zw;a_JF1T>%h!v7Why&m-;KBlH<9p9y>dDV(#9D_F79+~%@yc3=_IjHjxzDp|d{`o~ z^n8x!G`U7%Gw;9BlaSnXhSE`06~!vBdBtrGV>h*gntxI3FcxnMUZ!DjC1Q>|Mimx1Q*VcVT2a z^s_CA2ZRzVnNFo?6uMXkCTCjWl?3@|Nyy!Q1u3eVajRd< z!A2o*PHfO)IP0hL$`FjcXzF`hN{wOzFU>iUg=}v-ul2>R#yIo$`MXU8r)EVZ;4NRf zX_4$}gp`Vj6~`wg3$P7(aLHlqF0EYhz)c&Q?>h?MaiN0l&Br(A6i1m+SIO87nlVO8 z9U1m0Zu$*}pt~mtgEtcyEWbbgfRz{HBFWY7`zw+ul~!5w)IKHmI(DSPO2|nG^}j`2 zjU$mFiBMsSJRHZl!W&Z&A{AOW;q%2wK_hho9OiAz8WvKc;kWHlwTEv&757-)y9WK_ z>olz}$ecX~Jeo4F8s7N$>~1v$PNm2;tX;n#G`roj9!>qA(qf9lai3J&WIR8*8MG73 zBH!BkC>_pk$vu8oWD=P?c|Z+R>z&yGpGl%*Va1CWJR8~ki9bT5 zh)k(2cqVej%9n}!A$Mq^nU~-J-ISs0^Akw%dCOevbjIAlUxh z?iqt0Sy1|RB0%K{VKACBBjsd;Qmpe_3NBehGFy0%PL3uvs+A&*5+AfH%A@ ztIm@Vn-uRQfdaIF%>OK)wcnMvNS9^PE_!(>MqR zN(mirK4L?u(o0PkzqZQOyns8=RHvB}#+~kGHTF^^FRBzG8WDAbNh?DkH)*M;onk7n z^oT6O*?2C-;@4>7Bkv&7(1x$R5N(TUbpeU|Z|*-lW^S7SOKul5OEyT$pDS(Io-KZz z&$RA8e4db?>WOf+hStT+5Bcr5)o||10Ts@ zw0jc=2kZ%aFEG=dQGyt_{B~v`oV0}12CedlJa9yv&t# z?b5h|m!mIG>fkz#tzIRi;={NjsX}z^TT*fg^?0g<2f242KOC*JwY36h0>{&0d+ok8 z>Il@f*^06fs#xqw=Rl>9S*>q(PGPK z11Xf2`n(zNCqd<>R;i+B8dExSYMw19|_<7i+= zvk;$2iB;tgSQHZ3R8q1fr8Y(4%xzaP#hy0YmnS2MMRL{kd{~bA_zB(>An%Yq0#bdi ze(BcM16JQC9n+kWDK0?j$7y&4mxV>vch`i4^Ux-hZQlj8r%icOuU9iAf~GAl^Anzw zb)UCtac!08-Ver~)8l~aWjKRvIdgbcSjFA5I_3#JBx|aTDU!tTSdwip%%;b+dG=wQ z4-}c1TiZL1cvqOf8;WdbxN|0yLf0vd>QOM#S9VtY#LWi>)#w*thc-aLR4d{j$>iO! zYK^!Wzk+%;m8M}Qw#LAp;fi}T9k(t!DfLsA(#K0h>U~|lw+e`a5CIe9=W$CG8Yw@< zGFV-4w(=t9<&LWD9A~m`+3p3@vf&JgqYoLYkC*g~8s^~{>a5{IXMDEyM3Ls6>6d+0 z!;=x4H33-DKhO>}TRVn|A(Wuqy$(uJ_BJOpC)>ArmEkD|j{xRRm3)O=)gd|76W11p=CgkwY<=O`NC+ua?Gegb=v;!Qo=fXDsz zI+HzwR+Klnr{>yylf13AenipKO&kj@MAi?jDz&F<{UFp8IVN+l>P)S5KYCBvLHW}# zS`Fs+XM)Mpi&5=5Gnx!V?p|xv%(v@zHfp11$U};wr#5`YxI(r!p3LZm{G^wSX?Tln zfPTI0ha!93&x`fK4#eJ4ygm`Q6Fn~1a0vo)H4a{+WKZ93VsA=3 zeji&a1l}D`zX9Pk;eC+yRPo)}NF7*T1busqRj@XvgfTF}0XW7F|F;<1Qci<)i{!JQzoBqnWrzDGz#;|D_e5W@( zXQlo8lF+bbSs$1<=2iqICZ|u;FbY`I9ZsL`CT1&jVVK(bP22~8VoTp3A+5XpDNB~u z3e)rX&NTx0^tNL6In0e2_M2uNJ4t?}BT0Tt5_0D@(?jZW!>ul9Jgc<+k{iy~a|TV8 zssSb2JxEc~U#Y(=yOB*wwB^YIve|ew-7Jt}RhZ zdyM?AJ=%Z)8*wOm{~-KCSeVcsjapX*j@L$98%ourMA*~h{;+fPR5`DV72e4D{GGy! zGV2~E=5Is@=u!C0Wql^|kLETM#CfKo)xndrX(-62W6Xw0mSt+VAE)lB!bCx_ zrBZx*SD!g}n^847r(d%%RH6Vbpn6KPC9|3I*NOlWq5g%+t*B*k+O{FYI*|_D2 zdLgR$3>HZ=4>##dZ4GaFY*It_=Th@F!MCe^B3&OiC2Ny#Ifjba0x6?cf`Sp;i(j-L z|NWWmVvNDS4Tfop*KN5h4%5w;$+sMHS(b%y@is$*Tcj_)*~xEu?!Obf`~DF+r(FYL z;kvrwHe@GxK3tk}OsbwKSoL4K{vSnSQyjG~-9Tu$U-Ei7hiPYKY~x$#v1)?5@$8o` zGi$<*(U8A%JT-}Cf~5Y{J)C`lj0XaTL~8x)r~jiJ{f}<}@BaKM7aUc^0fNG%riH8N z3G7Iaql1w`&Cc;47GB)1Orn3E zxaWx0{uB=L3*=B6G)JZ8jC*$b_;xsoh6d@s@ z7dnL%+%q2Am(r8j$Rgm}(hEb@@S4feNnPUytiPWU0f71#7_XER-n$n;w9>L^9%xeo z*^;;(-!7#akCI+uoF?>#Ye6KqZ0v=l3!R&Vgu-rv{~1o>?b*fi8Z`-moE>pYhW5pa zIKQoIuz@?(44S6h9bfXV6t;KnmW#gBiLy!r2l_;NAEX26L0Yn2O9Da8D&>F7W~ zxnA>dfS+F)Ca2Y~;`zO)Bho$nE1-*(#_!6qjEc2iGx(Zrt}|ZdPWK}IsgL_0REZ<> zuGx0hrfQ$mFh;-5qSL{;PTIgj7RpI{f6$mwDNxSQenFFc^L2)#yfcz>^rJ85@rLTI zIj9mv;*o|`Nml+n4=5jCp~yrezch#Q4&UEhm)IhQ+FE1A8_-!})LOqGzT-@xvTs zuv~5j^?Yr^yu_&JhfEY3*9by3@%zPE3!T|&-RZl4pfk%MR=5FrZ@SmhGB2F6F1{5- z)_VP5xv*F{GMVdZuZjhke4_pSsz!l#rafMaRHl2`JbOxXsWl7;F-{AL(l_~2Hp3#a}~+90)rJ?%SWe2N;^LnZ^^SVQ1(Yk`X%0-#-#g$g7nXd;C3FRBQp8I z`VWAdKq@YaHoLtS_c(n|yw-Lficn5o@CS063Xt&9n8MicF$BC0W5x-{C#qU{XS4QK z2gBV&Fi%?t$3=ugm11jyz&XpNYf_?-1P$Bj@&RmVe_>fPRS(P7=P8vN6to6A0a-%H#?w2Sst&tpBW$%|Kn=8e2&n{oTum06K;>VW#RUVfcKuTn2ea-l< zS!F|?zegab^rXb@sQzwf7wXIb{9aJuK=PYhYHYOYZJK{vz{Vbw=V3%cWxHthUH(gA z*n|4ee=s_5nC2)I-%0j3`085lAWLMPE9B|FYr=2eg$YolBa`6)a;In{%pOudBL+40 z>^kpnV#jzJ!VTw;LfSHLiC?CwqPI5yN`9oy_(4q|PpJO!OHvnTfQtxv>^tQ$e*Diy z_P3hunD9cPgdvX-Bd9I(US@O7U?t|V z1!)w>N0|d#X7b0rm#q@vZ(G1K;3&LRe&(+shd|Z5s0iy1aRv^VG^hjiVnv81fk;gM zflLD5_%tiV@I!>>5)#zNuH(&YG6TV)3%H-)%&*=$93Pd;Z7Bgt9j-Z8A5YtjUtyT( z56GtRabc4SsB77s5x+kJu~qXzic4pJZ(MFOm^=+a*CQ*`cTfJ+L*NN|J563C%w7RUYOty(|ja$&rm9)9G!NLMyV{Q%)98uokc_bV@ z&&&vigxr3NkOjf?Q)Z6Z8$_@f$8)Lrxf5Gc7!|a+k4zC6K7eX)DiD zq^H(f+wc99NhRnU4(Xzk`z5qL$0!V0Tbj&TrC5K*C$S2_ID_eetm3|Ew5!7Roz`&U z6|R2>HI|NJ)W7x!4HG|cG(D_!9}woufx+{@`n>0~;gkUx0kf7kOzwt9FPBp@Vw}>+ zSeV0&`R!ig_^m+@;b#(?(;i9{SWM%#W~8NUeuu?)78MJ_$)~uiK!Oc;n3XnPApra4 z8LT$fc!|4Q+e6cb9R=YO(4{6K^~VfD{<k z`;=LkoJe7)OcS|JDYSQi;>)RH%u{3DPrpn#tpaokMHe;lN}<`A=mK!_$SWV6JFOGe z(X5OIAgN`hMwuy+g!X2^XR(KhhI;~d3FSkVvA)s!18!FtKyz|eYjh%$3)Nmd>)NQ5 z1U6!>UChYcY>CMH$W7GXQ??NV2HwcW{C4ykkiCG@d6YAZOv`uhR=7jcIqXH4q`X7I z!u+TJzTVZZ#Fgv4Za>|eTW)AfQ`XFmguV2`YVm6I^Q*dTB1T~v$w-GnmOr`P$Tt0W z@OviMuVC&0OjsGt6*ME+6OzCe&!vwfA!u8D-eYA(Lak3Qt!yhe86ZBs1~wv)-k*x&U4T2Aa}cs1eUo< zJiMMT;V-VE%8=1XppOYg4EbQ?3w8$7<({lFNS(9$&Pz%{z&gw6Ug+Xtmi3eTnE8wJ z@&Bx5Ce~0PA!ouXeWT5&SdJgVGkEXvcn$%BY{{dlp59;#yZLQcLEi});GES*SNN2f zN%@$xfXRBKW@N2YQ^)?{TU}uNj4s>sQk=F>C^Wz{hEq;5)ATfQN%ic(ISXulc|kE! zA%0qV`^AX*afM8y&?mbdpN75?GqOfU0j^&QmLaFzMJ0>P`4lGrNfcJ?zRkGp{Y|m< z+n%5eI`;n_{{Mb}-Y9va6pM@D8G_WL0}!@#%1oKGk+x5v`1vZ2y%*L_LC>Hm5O|Jb zvF1xaPo@^fN?1|Xn99rWd6p}eJiPqV;@Wep(%N>mIYyoZvCq$$K!=dO&Jz zdGt+T3h%%@E#_$}ZmS-@u5`gddCc7ls1JqV*qU#fQ5Og4UGm%jb@jf$;r^v>^C`9w z7Zy^N#^f7c)*mllr-=(n+YKr@W$VZc^BcO#b=3&eK%Tj*eJM0pcBzNcg{qzrziydH z*{86a<;M?24B~sft}q=s`TArWseyrG|6wO6FBUvMskSxWh_UY4oXlTOu7ja(~G$;)M(_t7_! zsT7$iR4eX_p%OKl3Btbb1RMl5!!~6|4wLgHI_Q*1+(3kJ7y(NXJ;V4CC*N(mNmRx}#{3XXyjnRH z_ga!OJx_VsO%~MKFeRD}S4TLAVd{Fr@m1GeHI`1s%28o`&g$4P1D=57oIM!C-)2`76v1(f*Dajf+Eeh#kWgj?3a02P* zo1UjD#n?UP1^eSz^t&SXPh$M=;+|hgx1{mMo^Cw%;e$xln+|qL)VcR(17B5rEiDRX z-?P7ub<;+ZObOO>DSs2rhW(F&yvArFz~zIW$ygiBC^2nllN?6?CNZL!e^(`ps_x?XHEcVKsP@ zf@Urf#YIJR^I_HXqjM!3CY?Ry=KYt5h!)l#EY@0{-6tek2_({u`QbYMCL8j!dh89= z-&a6j{LwUdFCW4}`O}okEc-rg1#T#-Q{3l8mejHu>=pq1Xw z&a3__Si{XfgZ5VTAZGcoF8cFI8*}B@Gd0=i3Sg4z;>I8T(TR8%nkY|_Bd-uwU-*%Q zPB8#LAd;;(Puovd*~K7EGmz#wzBEp`_^uo6#fulatt-Vyh5y$Znb?6%Cn@UXW{+1p zO>ll06#rI_k&2M|Br%$hkYM?AMDQ3$gXXib>$QS3G)?ZdlR^;xd;XmE;G9Ueme>Q3 z>RFAv8a-cBDy(>nr5Do;vRF-I^iko$bVJT*+@kSuK^;g+zK@ zO7Gsi^YwnL_oqRGDJhYazpn#16v4gOSP-EtPF4!%r;wA8>4&2Zm&>X;H$-jmxbues z0|Vu$9c$f9bLHlPM*$0k%M3i-oV+{$fHjBzF|LIb&&Lc{&2O%bzL5crMIXfbk~L!a zDWXF{dM0p)pHoDTzXEPgA@c^Y(}J*1_7FI>L*R9k+pKBE$H#lmNSk>dzsL2>2M`Jq zJw1InDud>qme-~fRxUexZV6;Zzp3pM)#Bbh%sgx1XnPr{Gy;5mu8*|58&xYTEp2Vp zJc)QKNAJ&|r;5#M#&+HibYg6N_Oruo&64oMyNgsVjc<>Ybrbuq8T3#Bru}(raUGqs zr>uHK?%hHZPda*wjmtx+s#V~GkH z3|Y(aEG#X(KR?yFUf~;ke!kn)gs__H+_%U-dpI96W?*+J#Fnf5xg@!}7^HoChpT1p zItatKYOUf6=Ys}>amqH&kMCt8iX1_^G42#5ckcMRBtFT=CSKh9(O;xzJbU(Rx0yh}tZ%k`PkWBx&k=-&;Q|f#5N8eA z)?_WDd&&b-?m#7c+?<|;MZWfvC-3*&rR?$C;hk5N=2zI^%hh9&cOnPf{# zi#!uE^B}-)MFKNhraQa3KKmvPi8?_RxR&MT)PJ?LSqz;ag}J${QnI6SQx(IdLiWdRqkg^{Hp)ec z+3jOXhYWcPZBBX2Cz(3+%kc!hMVq4ev)8b}s3^p3A3sV12~FW=nS-&P2j1wXQS2~$ z0)oK`Yc10QXU~fEp2Wl};wjUqpFD}QlIYei&X3!1a13n0`Q*7FA$kGOIChQT_2Me!_|vV8Vy`B^*Bp zVZnxE$Ips8O<@x-t7>>PPgdBSoHOrwfpmCR+715?>!YAO)P(7chusZpW!k|>?ZJBW zoq_9B5B>Pjrl+TOA@R87a=Cd}M1+%M-V)v4i-Q!Djve;;-UD0T-mZ#5L3#N=CAJbj zD*44L93~Mv#KHR}9E^W&NSk%AAyJaejE-u);!MG)g^dfqBH@&4bYDd%OHd(0?GS{2cEjp9g~ICpT~p6yD5+rnIH`;Mwye7bBlvRvZU~qFV0`9 z&2uQ2aN#?oA})XM9`)6y4o9izC3;k5)|k}Pm%b@Sq@}$-s!c-O}3XA)whP`o}Jb@F#)wsOGU^j4m*p z^J2$tFfwBFk@qp9C9~p@k-dVue9OUL2e;hpTCGuypC}SCIHtgBP`ta`n79)AThbSzTvwu&A8~1k2#z(r;;l_2+`#@ zm>?EY1gw7#4P_V_H1Ee8zGpo`-}~5?<6-%Uc<}S*s+=#o9L;EauIn#-li5UpubGgR z)Bd;5`QMF4+p8N6sJj#OKVCu9Cnqcni%3#rsFpS+K0as3gkk3*jRYe#b)!ty#q)nX z!{Hs6R1`6fvO>X6+xz^**7E4J@weT6g-2O3yHw3^r$n>&12#wiwHce31gY-^{OKbg zP??!v2dCrGQ67pS<1crZleYF+AbXlyZPYn7_Gw^1RW9-7dkur}I#G0A~&-BJUCcDDWqpxca#gs9WujB3i!}bU1TtaP&!T09Dh;)^treC?g9tE=>b??wNdJd}RI zhVVAr64#s8nORxYbam6WJI{%NTZCJ>hic>%*T4hI?eL$xA4=0xA+z~QXQEp z;I0f8tDooPQp&BraC2YXZcvJMQb>=aef6W2}2+6`8h2WFZ)tdyL{Td64%ST_atp*1N`G7cEw$%fkv(twg zT99kIB#QLbv*cvrXfgL6H^FTiq+^zwkWx?!8fnf0Ms}CUZI^`Y&CSgfp%0h;TH=Kp zvSF$T@|9%a-3OQY_V-l|aQ2r%nA#LldoVfr`@8nbGlV$i8UxSYk<(8I|MJ`z1j7fI zxb79qr&@HS$u+XSk|D}T5;M`()>dp2UN~(AfX}mA$-8!RFLQoc{9fXLQ~Im?o~tT# zH#54`?!)AizBjLZw9xIsou9Vn-aBU7T`}3=Go(jI_OK9HV&J+XDj7=-yc7J#Q9!!_nR;=4eupqxX~6 z?80A;fB@yDuao>v+J&Yi9C3yD1(BEKwN@Bf`L%?lGUmqj7}{>K_Duy z5C{U~fBfxBOVrlJ$=Jq8Pu1Pd*inbY&D!eE3MyTnZ!AEeKB)HmZ-r-}T0IA2D@Rrq zP!zE>z`e>tMucWNYYb4b7j{uFU1VuU9D$h*CWi1nF0+E&gxgzgBYUgWUIHR(|*Uf66;Lxm*4F z1b-T|20>s>2sW2FgZQIy?aQeDTI9Dk__I8P%^89bXw)9e|9gi#Bm7T!LtATPfBa*B zKZ_d|Y>$XQ^M4nAL4=BcUQl$fwR2=Ov~@84@2fNaXCML=2w@iLnt&XdB4`K%-fyo? za`l(u`gV5zE&b~-RuC3hYlg;8&iy%zrAdA%ZRqUiWNZE33Vv<=g)-d)4HOP1Mj$T# z*1Qnee_r0n%-GtP^`Gx-r&Yn>MEh_Q-k=owPy5Hy{LlV2POAC_R{yiWukVmX%SIjs zeOHP3r~NbN|5M)4*vSco&j0NH>l^4E3?uBpctXa=N`L)QzxJQvuEqu`f7I~r10eoc z3x@QI-j#795Xis3*YKU?KQ&kz8=32~I!GC@v$5FOm?Fo(ug`Fm`etS}JcBO`-rqZM z()d3$m>KIE89SV6!0%0}<9ES;Az*;tOP5;wR+{59^RIBfH$)DePMCkcmu9g3tu*^- zrMrG~oj<+p1Q^i&tVYPmW9)Eh+vHD{uM(U^AS7YZ|K2vX({H6uZF?Mtafc2{FaK3q z-u<`Ir&`VYTouVKbay`tf0AFj9g*eppVI#>guht+e~Z_zo%ezsr>+Jnp!%z#F5gos z`sY>ts0i6S72?AL)19qp1OoZ@_qo*M_n(UX9Y^NY`liPJ8AxYg@*xn!@FxL&S}=r( GfcSq9TX~`Y literal 0 HcmV?d00001 diff --git a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.flat.json b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.flat.json new file mode 100644 index 0000000000..54ef32c420 --- /dev/null +++ b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.flat.json @@ -0,0 +1,3073 @@ +{ + "requirements": [ + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.1", + "section_name": "Kodlama ve Temizleme Mimarisi", + "req_id": "V1.1.1", + "req_description": "Girdinin yalnızca bir kez kanonik forma (canonical form) çözümlendiği veya kaçış işlemlerinin kaldırıldığı, bu işlemin yalnızca verinin bu biçimde beklenmesi durumunda yapıldığı ve bu işlemin girdi doğrulama veya temizleme işlemlerinden sonra değil, önce gerçekleştiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.1", + "section_name": "Kodlama ve Temizleme Mimarisi", + "req_id": "V1.1.2", + "req_description": "Uygulamanın, çıktıyı kullanılması gereken yorumlayıcıya verilmeden hemen önce veya yorumlayıcının kendisi tarafından çıktı kodlaması ya da kaçış işlemi yaptığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.1", + "req_description": "HTTP yanıtı, HTML veya XML belgesi için yapılan çıktı kodlamasının; HTML elemanları, HTML öznitelikleri, HTML yorumları, CSS ya da HTTP başlık alanları gibi bağlamlara uygun olduğu doğrulanmalıdır. Böylece mesaj veya belge yapısının bozulması önlenir.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.2", + "req_description": "Dinamik olarak URL oluşturulurken, güvenilmeyen verinin bağlamına göre (örneğin, sorgu veya yol parametreleri için URL kodlaması ya da base64url kodlaması) kodlandığı doğrulanmalıdır. Yalnızca güvenli URL protokollerine izin verilmelidir (örneğin, javascript: veya data: yasaklanmalıdır).", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.3", + "req_description": "JavaScript içeriği (JSON dahil) dinamik olarak oluşturulurken çıktı kodlama/kaçış kullanıldığı doğrulanmalıdır. Böylece mesaj veya belge yapısı değiştirilmemiş olur (JavaScript ve JSON enjeksiyonlarının önüne geçilir).", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.4", + "req_description": "Veri sorguları veya veritabanı sorguları (SQL, HQL, NoSQL, Cypher vb.) için parametreli sorgular, ORM’ler, entity framework’ler kullanıldığı ya da SQL enjeksiyonu ve diğer veritabanı enjeksiyon saldırılarına karşı koruma sağlandığı doğrulanmalıdır. Bu durum, saklı yordam (stored procedure) yazarken de geçerlidir.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.5", + "req_description": "Uygulamanın işletim sistemi komut enjeksiyonlarına karşı korunduğu ve işletim sistemi çağrılarında parametreli OS sorguları veya bağlama özgü komut satırı çıktı kodlamasının kullanıldığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.6", + "req_description": "Uygulamanın LDAP enjeksiyon zafiyetlerine karşı korunduğu ya da LDAP enjeksiyonlarını önlemek için özel güvenlik kontrollerinin uygulandığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.7", + "req_description": "XPath enjeksiyon saldırılarına karşı, sorgu parametrelemesi veya önceden derlenmiş sorgular kullanılarak koruma sağlandığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.8", + "req_description": "LaTeX işlemcilerinin güvenli şekilde yapılandırıldığı (örneğin, --shell-escape bayrağının kullanılmadığı) ve yalnızca izin verilen komutlardan oluşan bir listeyle çalıştırıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.9", + "req_description": "Düzenli ifadelerde (regex) özel karakterlerin (genellikle ters eğik çizgi \\ ile) kaçırılarak meta karakter olarak yorumlanmalarının önlendiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.10", + "req_description": "Uygulamanın CSV ve formül enjeksiyonlarına karşı korunduğu doğrulanmalıdır. Uygulama, CSV içeriği dışa aktarırken RFC 4180 Bölüm 2.6 ve 2.7'de tanımlanan kaçış kurallarına uymalıdır. Ayrıca, CSV veya diğer tablo formatlarına (XLS, XLSX, ODF gibi) aktarım yapılırken, alanın ilk karakteri olarak çıkan özel karakterler ('=', '+', '-', '@', '\\t' (sekme), '\\0' (null karakter)) tek tırnak (') ile kaçırılmalıdır.", + "L": "3" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.1", + "req_description": "WYSIWYG editörlerinden veya benzer kaynaklardan gelen tüm güvenilmeyen HTML girdilerinin, bilinen ve güvenli bir HTML temizleme kütüphanesi ya da çerçeve özelliği ile temizlendiği doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.2", + "req_description": "Uygulamanın eval() veya Spring Expression Language (SpEL) gibi dinamik kod çalıştırma özelliklerini kullanmaktan kaçındığı doğrulanmalıdır. Alternatif yoksa, kullanıcı girdisi çalıştırılmadan önce mutlaka temizlenmelidir.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.3", + "req_description": "Potansiyel olarak tehlikeli bir bağlamda kullanılacak verilerin, bu bağlama uygun karakterlere izin vermek ve çok uzun girdileri kısaltmak gibi güvenlik önlemleriyle önceden temizlendiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.4", + "req_description": "Kullanıcı tarafından sağlanan SVG içeriğinin, yalnızca güvenli etiket ve özellikler (örneğin grafik çizme ile ilgili) içerdiğinden emin olmak için onaylandığı veya temizlendiği doğrulanmalıdır (ör. script veya foreignObject içermemelidir).", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.5", + "req_description": "Markdown, CSS, XSL stil sayfaları, BBCode veya benzeri ifade şablon dillerinde kullanıcı girdisinin temizlendiği veya bu tür özelliklerin devre dışı bırakıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.6", + "req_description": "Uygulamanın, güvenilmeyen verileri başka servislere iletmeden önce izinli protokol, alan adı, yol ve port listelerine göre doğruladığı ve tehlikeli karakterleri temizlediği doğrulanarak SSRF (Sunucu Taraflı İstek Sahteciliği) saldırılarına karşı korunduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.7", + "req_description": "Uygulamanın şablon enjeksiyon saldırılarına karşı, güvenilmeyen girdilere dayalı şablon oluşturmayı engellediği; eğer bu kaçınılmazsa, bu girdilerin mutlaka temizlendiği veya sıkı şekilde onaylandığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.8", + "req_description": "JNDI sorgularında kullanılmadan önce güvenilmeyen girdilerin temizlendiği ve JNDI'nin enjeksiyonlara karşı güvenli şekilde yapılandırıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.9", + "req_description": "Memcache’e gönderilmeden önce içeriğin temizlenerek enjeksiyon saldırılarına karşı korunduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.10", + "req_description": "Format dizgilerinin (format strings) beklenmeyen veya zararlı şekilde çözümlenmesini önlemek için işlenmeden önce temizlendiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.11", + "req_description": "SMTP veya IMAP enjeksiyonlarını önlemek için, kullanıcı girdisinin posta sistemlerine iletilmeden önce temizlendiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.12", + "req_description": "Regex girdilerinin üstel geri izlemeye (exponential backtracking) neden olan öğeler içermediği ve güvenilmeyen girdilerin ReDoS (Regex Denial of Service) gibi saldırılara karşı temizlendiği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.4", + "section_name": "Bellek, Dizgi ve Yönetilmeyen Kod", + "req_id": "V1.4.1", + "req_description": "Yığın, arabellek (buffer) veya yığın belleği taşmalarını önlemek ya da tespit etmek amacıyla, bellek güvenli dizgi işlemlerinin, daha güvenli bellek kopyalama ve işaretçi aritmetiğinin kullanıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.4", + "section_name": "Bellek, Dizgi ve Yönetilmeyen Kod", + "req_id": "V1.4.2", + "req_description": "Tamsayı taşmalarını önlemek için işaret (sign), aralık (range) ve giriş doğrulama tekniklerinin kullanıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.4", + "section_name": "Bellek, Dizgi ve Yönetilmeyen Kod", + "req_id": "V1.4.3", + "req_description": "Dinamik olarak ayrılan belleğin ve kaynakların serbest bırakıldığı ve boşaltılan belleklere ait referansların veya işaretçilerin kaldırıldığı veya null yapıldığı doğrulanmalıdır (dangling pointer ve use-after-free zafiyetlerine karşı).", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.5", + "section_name": "Güvenli Ters Serileştirme (Safe Deserialization)", + "req_id": "V1.5.1", + "req_description": "XML ayrıştırıcılarının (parser) kısıtlayıcı şekilde yapılandırıldığı ve dış varlık çözümleme (external entity resolution) gibi güvensiz özelliklerin XXE (XML eXternal Entity) saldırılarına karşı devre dışı bırakıldığı doğrulanmalıdır .", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.5", + "section_name": "Güvenli Ters Serileştirme (Safe Deserialization)", + "req_id": "V1.5.2", + "req_description": "Güvenilmeyen verilerin ters serileştirilmesinde, nesne türleri için izinli liste kullanımı veya istemci tanımlı nesne türlerinin kısıtlanması gibi güvenli giriş işleme önlemlerinin uygulandığı doğrulanmalıdır. Güvensiz olarak tanımlanmış ters serileştirme mekanizmaları, güvenilmeyen girdilerle kullanılmamalıdır.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.5", + "section_name": "Güvenli Ters Serileştirme (Safe Deserialization)", + "req_id": "V1.5.3", + "req_description": "Aynı veri türü için uygulamada kullanılan farklı parser'ların (ör. JSON, XML, URL parser'ları), veriyi tutarlı şekilde ayrıştırdığı ve aynı karakter kodlamasını kullandığı doğrulanmalıdır. Böylece JSON birlikte çalışabilirlik açıkları, URI veya dosya ayrıştırma farkları gibi sorunlar nedeniyle RFI veya SSRF saldırılarının istismar edilmesi önlenir.", + "L": "3" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.1", + "section_name": "Doğrulama ve İş Mantığı Dokümantasyonu", + "req_id": "V2.1.1", + "req_description": "Uygulama dokümantasyonunda, veri öğelerinin beklenen yapıya göre nasıl doğrulanacağına ilişkin giriş doğrulama kurallarının tanımlandığı doğrulanmalıdır. Bu; kredi kartı numaraları, e-posta adresleri, telefon numaraları gibi yaygın veri biçimleri olabileceği gibi iç sistemlere özel biçimler de olabilir.", + "L": "1" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.1", + "section_name": "Doğrulama ve İş Mantığı Dokümantasyonu", + "req_id": "V2.1.2", + "req_description": "Uygulama dokümantasyonunda, birleştirilmiş veri öğelerinin mantıksal ve bağlamsal tutarlılığının nasıl doğrulanacağı tanımlanmalıdır (örneğin, mahalle ve posta kodunun eşleşip eşleşmediğinin kontrolü).", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.1", + "section_name": "Doğrulama ve İş Mantığı Dokümantasyonu", + "req_id": "V2.1.3", + "req_description": "Hem kullanıcı bazında hem de uygulama genelinde geçerli olacak şekilde, iş mantığı sınırları ve doğrulama beklentilerinin belgelendiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.2", + "section_name": "Girdi Doğrulama", + "req_id": "V2.2.1", + "req_description": "Girdilerin, işlevsel ya da iş gereksinimlerine uygunluğunun doğrulandığı teyit edilmelidir. Bu işlem; izinli değerler, desenler ve aralıklar listesine karşı pozitif doğrulama ile ya da girdinin beklenen yapıya ve mantıksal sınırlara uygunluğunun önceden tanımlanmış kurallara göre karşılaştırılması ile yapılmalıdır. Seviye 1 için bu, güvenlik veya iş kararlarında kullanılan girdilere odaklanabilir. Seviye 2 ve üstü için tüm girdilere uygulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.2", + "section_name": "Girdi Doğrulama", + "req_id": "V2.2.2", + "req_description": "Uygulamanın, güvenilir bir servis katmanında girdi doğrulama zorunluluğu uygulayacak şekilde tasarlandığı doğrulanmalıdır. İstemci tarafında gerçekleştirilen doğrulama, kullanılabilirliği artırabilir ve teşvik edilmelidir. Ancak bu doğrulama,güvenlik kontrolü olarak kabul edilmemelidir.", + "L": "1" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.2", + "section_name": "Girdi Doğrulama", + "req_id": "V2.2.3", + "req_description": "Uygulamanın, ilişkili veri öğelerinin önceden tanımlanmış kurallara göre makul olup olmadığını kontrol ettiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.3", + "section_name": "İş Mantığı Güvenliği", + "req_id": "V2.3.1", + "req_description": "Uygulamanın, aynı kullanıcı için iş mantığı akışlarını yalnızca beklenen adım sırasına göre ve adım atlamadan işlediği doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.3", + "section_name": "İş Mantığı Güvenliği", + "req_id": "V2.3.2", + "req_description": "İş mantığı sınırlarının, uygulama dokümantasyonuna uygun şekilde uygulandığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.3", + "section_name": "İş Mantığı Güvenliği", + "req_id": "V2.3.3", + "req_description": "İş mantığı seviyesinde işlemlerin (transaction) kullanıldığı ve bir iş mantığı işleminin ya bütünüyle başarıyla tamamlandığı ya da önceki geçerli duruma geri döndürüldüğü (rollback) doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.3", + "section_name": "İş Mantığı Güvenliği", + "req_id": "V2.3.4", + "req_description": "İş mantığı düzeyinde kilitleme mekanizmalarının, sınırlı kaynakların (ör. sinema koltukları, teslimat zamanları) uygulamanın mantığı manipüle edilerek çift rezervasyona neden olmamasını sağladığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.3", + "section_name": "İş Mantığı Güvenliği", + "req_id": "V2.3.5", + "req_description": "Yüksek değerli iş mantığı akışlarının, yetkisiz veya kazara gerçekleşebilecek işlemleri önlemek için çoklu kullanıcı onayı gerektirdiği doğrulanmalıdır. Bu işlemler büyük para transferleri, sözleşme onayları, gizli bilgilere erişim veya üretimde güvenlik kurallarının geçersiz kılınmaları gibi durumları içerebilir.", + "L": "3" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.4", + "section_name": "Otomasyon Karşıtı Önlemler", + "req_id": "V2.4.1", + "req_description": "Uygulama işlevlerine yönelik aşırı miktardaki çağrılara karşı; veri sızdırma, anlamsız veri üretme, kota tüketme, hız sınırının aşılması, hizmet reddi (DoS) ya da maliyetli kaynakların aşırı kullanımı gibi risklere karşı otomasyon karşıtı kontrollerin bulunduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.4", + "section_name": "Otomasyon Karşıtı Önlemler", + "req_id": "V2.4.2", + "req_description": "İş mantığı akışlarının, aşırı hızlı işlem gönderimlerini önleyecek şekilde gerçekçi insan zamanlaması gerektirdiği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.1", + "section_name": "Web Frontend Güvenlik Dokümantasyonu", + "req_id": "V3.1.1", + "req_description": "Uygulama dokümantasyonunda, uygulamayı kullanan tarayıcıların desteklemesi gereken güvenlik özelliklerinin (ör. HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) ve diğer ilgili HTTP güvenlik mekanizmaları) tanımlandığı doğrulanmalıdır. Ayrıca bu özelliklerin mevcut olmadığı durumlarda uygulamanın nasıl davranması gerektiği (ör. kullanıcıyı uyarmak veya erişimi engellemek) de tanımlanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.2", + "section_name": "İçeriğin Yanlış Yorumlanması", + "req_id": "V3.2.1", + "req_description": "Tarayıcıların HTTP yanıtlarında içerik veya işlevi yanlış bir bağlamda sunmalarını önlemek amacıyla güvenlik kontrollerinin uygulandığı doğrulanmalıdır (ör. API, kullanıcı tarafından yüklenen dosya veya başka bir kaynağın doğrudan çağrılması durumunda). Olası kontroller arasında; yalnızca HTTP istek başlıklarının (ör. Sec-Fetch-\\*) doğru bağlamı gösterdiği durumlarda içeriğin sunulması, Content-Security-Policy başlığında \"sandbox\" yönergesinin kullanılması veya Content-Disposition başlığında \"attachment\" biçiminin kullanılması yer alabilir.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.2", + "section_name": "İçeriğin Yanlış Yorumlanması", + "req_id": "V3.2.2", + "req_description": "HTML yerine metin olarak görüntülenmesi amaçlanan içeriğin, HTML veya JavaScript gibi içeriklerin istenmeden çalıştırılmasını önleyecek şekilde \"createTextNode\" veya \"textContent\" gibi güvenli işleme fonksiyonlarıyla işlendiği doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.2", + "section_name": "İçeriğin Yanlış Yorumlanması", + "req_id": "V3.2.3", + "req_description": "Uygulamanın istemci tarafı JavaScript kullanırken açık değişken tanımlamaları yaparak, sıkı tür kontrolü uygulayarak, global değişkenleri document nesnesine kaydetmekten kaçınarak ve ad alanı izolasyonu sağlayarak DOM clobbering’den kaçındığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.3", + "section_name": "Çerez Yapılandırması", + "req_id": "V3.3.1", + "req_description": "Çerezlerin 'Secure' niteliğine sahip olduğu ve eğer çerez adı '\\__Host-' ön eki ile başlamıyorsa, '__Secure-' ön ekinin kullanıldığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.3", + "section_name": "Çerez Yapılandırması", + "req_id": "V3.3.2", + "req_description": "Kullanıcı arayüzü kandırma saldırılarına ve tarayıcı tabanlı istek sahteciliği saldırılarına (CSRF) karşı koruma sağlamak amacıyla, her çerezin 'SameSite' niteliğinin kullanım amacına uygun şekilde ayarlandığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.3", + "section_name": "Çerez Yapılandırması", + "req_id": "V3.3.3", + "req_description": "Çerez adı, diğer sunucularla paylaşılmak üzere açıkça tasarlanmadığı sürece '__Host-' ön eki ile tanımlanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.3", + "section_name": "Çerez Yapılandırması", + "req_id": "V3.3.4", + "req_description": "Bir çerez değeri istemci tarafı betikleri tarafından erişilememesi gereken bir veri içeriyorsa (ör. oturum token'ı), çerezin 'HttpOnly' niteliğine sahip olduğu ve aynı değerin (ör. oturum token'ı) yalnızca 'Set-Cookie' başlığı ile istemciye iletildiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.3", + "section_name": "Çerez Yapılandırması", + "req_id": "V3.3.5", + "req_description": "Uygulama bir çerez oluştururken, çerez adı ve değerinin toplam uzunluğunun 4096 baytı aşmadığı doğrulanmalıdır. Çok büyük çerezler tarayıcı tarafından saklanmaz ve isteklerle gönderilmez; bu da çereze bağlı çalışan uygulama işlevlerinin bozulmasına yol açabilir.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.4", + "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", + "req_id": "V3.4.2", + "req_description": "Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header'ı, uygulama tarafından sabit bir değer olarak tanımlanmalı veya gelen Origin header değeri güvenilir origin’lerden oluşan bir izinli listeye karşı doğrulanmalıdır. ‘Access-Control-Allow-Origin: *’ kullanılması gerekiyorsa, yanıtın hassas bilgi içermediği doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.4", + "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", + "req_id": "V3.4.3", + "req_description": "HTTP yanıtlarında Content-Security-Policy header'ı bulunduğu ve bu header'ın yalnızca güvenilen içeriklerin veya kaynakların yüklenmesini ve çalıştırılmasını sağlayan yönergeler içerdiği doğrulanmalıdır. Minimum olarak \"global policy\", object-src 'none', base-uri 'none' yönergelerini içermeli ve izinli liste, nonce veya hash temelli bir yapı içermelidir. Seviye 3 uygulamalarında her yanıt için nonce veya hash içeren özel bir politika tanımlanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.4", + "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", + "req_id": "V3.4.4", + "req_description": "Tüm HTTP yanıtlarının 'X-Content-Type-Options: nosniff' header'ını içerdiği doğrulanmalıdır. Bu, tarayıcıya içerik türünü tahmin etmeyi bırakmasını ve yanıtın Content-Type header'ında belirtilen MIME türünün, beklenen kaynak türüyle eşleşmesini zorunlu kılar. Ayrıca bu, tarayıcıda CORB (Cross-Origin Read Blocking) özelliğini etkinleştirir.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.4", + "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", + "req_id": "V3.4.5", + "req_description": "Uygulamanın, 'Referer' başlığı yoluyla üçüncü taraflara teknik olarak hassas verilerin sızmasını önlemek için bir 'referrer policy' belirlediği doğrulanmalıdır. Bu, Referrer-Policy HTTP header'ıyla veya HTML öğe nitelikleriyle (element attributes) sağlanabilir. Sızabilecek hassas bilgiler, URL’deki yol ve sorgu parametreleri ile sınırlı uygulamalarda hostname bilgisini içerebilir.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.4", + "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", + "req_id": "V3.4.6", + "req_description": "Uygulamanın, Content-Security-Policy header'ı altında 'frame-ancestors' yönergesini her HTTP yanıtında tanımladığı ve bu sayede içeriklerin varsayılan olarak başka sayfalara gömülmesini engellediği doğrulanmalıdır. Gerekli durumlarda özel olarak izin verildiğinden emin olunmalıdır. 'X-Frame-Options' header'ı, tarayıcılar tarafından desteklenmesine rağmen, artık güncel değildir ve güvenlik amacıyla kullanılmamalıdır.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.4", + "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", + "req_id": "V3.4.8", + "req_description": "Bir belgenin işlenmesini ve sunulmasını başlatan tüm HTTP yanıtlarında (örneğin 'text/html' tipi yanıtlar), 'Cross-Origin-Opener-Policy' header'ı 'same-origin' veya 'same-origin-allow-popups' yönergeleriyle birlikte yer almalıdır. Bu, tabnabbing ve frame counting gibi, pencere nesnelerine paylaşımlı erişimi sömüren saldırılara karşı koruma sağlar.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.5", + "section_name": "Tarayıcı Menşei Ayırımı", + "req_id": "V3.5.1", + "req_description": "Uygulama, hassas işlevselliğe yönelik izinsiz cross-origin istekleri önlemek için CORS preflight mekanizmasına güvenmiyorsa, bu tür isteklerin gerçekten uygulamadan geldiği doğrulanmalıdır. Bu, anti-forgery token kullanımı veya CORS tarafından güvenli kabul edilmeyen özel HTTP header'larının zorunlu kılınmasıyla yapılabilir. Bu, tarayıcı tabanlı istek sahteciliği (CSRF) saldırılarına karşı bir savunmadır.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.5", + "section_name": "Tarayıcı Menşei Ayırımı", + "req_id": "V3.5.2", + "req_description": "Uygulama, hassas işlevlerin izinsiz cross-origin çağrılmasını önlemek için CORS preflight mekanizmasına güveniyorsa, bu işlevlerin bir CORS-preflight isteğini tetiklemeden çağrılamadığı doğrulanmalıdır. Bu, 'Origin' ve 'Content-Type' header'larının doğrulanmasını veya CORS-safelisted olmayan bir header'ın ve alanın kullanılmasını gerektirebilir.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.5", + "section_name": "Tarayıcı Menşei Ayırımı", + "req_id": "V3.5.4", + "req_description": "Farklı uygulamaların farklı hostname'lerde barındırıldığı ve böylece Same-Origin Policy tarafından sağlanan kısıtlamalardan (örneğin çerez erişim sınırları, kaynaklar arası etkileşim kontrolleri) faydalanıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.5", + "section_name": "Tarayıcı Menşei Ayırımı", + "req_id": "V3.5.6", + "req_description": "Uygulamanın herhangi bir yerinde JSONP işlevselliğinin etkin olmadığı doğrulanmalıdır. Bu, XSSI (Cross-Site Script Inclusion) saldırılarını önlemek içindir.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.5", + "section_name": "Tarayıcı Menşei Ayırımı", + "req_id": "V3.5.7", + "req_description": "Yetkilendirme gerektiren verilerin, JavaScript dosyaları gibi betik kaynaklarının yanıtlarında yer almadığı, XSSI saldırılarını önlemek için doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.5", + "section_name": "Tarayıcı Menşei Ayırımı", + "req_id": "V3.5.8", + "req_description": "Kimliği doğrulanmış kaynakların (örneğin görseller, videolar, betikler ve belgeler) yalnızca gerçekten amaçlandığında kullanıcı adına yüklenebildiği veya gömülebildiği doğrulanmalıdır. Bu, isteğin uygun olmayan bir çapraz kaynak çağrısından kaynaklanmadığından emin olmak için Sec-Fetch-* HTTP istek başlığı alanlarının sıkı bir şekilde doğrulanmasıyla veya tarayıcıya döndürülen içeriği engelleme talimatı vermek için kısıtlayıcı bir Cross-Origin-Resource-Policy HTTP yanıt başlığı alanı ayarlayarak gerçekleştirilebilir.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.6", + "section_name": "Harici Kaynak Bütünlüğü", + "req_id": "V3.6.1", + "req_description": "JavaScript kütüphaneleri, CSS veya web fontları gibi istemci tarafı varlıkların yalnızca statik ve sürümlü olması, varlığın bütünlüğünü doğrulamak için Subresource Integrity (SRI) kullanılması durumunda harici olarak (örneğin, bir İçerik Dağıtım Ağı üzerinde) barındırıldığı doğrulanmalıdır. Bu mümkün değilse, her bir kaynak için bunu gerekçelendiren belgelenmiş bir güvenlik kararı bulunmalıdır.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.7", + "section_name": "Diğer Tarayıcı Güvenliği Hususları", + "req_id": "V3.7.1", + "req_description": "Uygulamanın yalnızca hâlâ desteklenen ve güvenli kabul edilen istemci tarafı teknolojileri kullandığı doğrulanmalıdır. Bu gereksinimi karşılamayan teknolojilere örnek olarak NSAPI eklentileri, Flash, Shockwave, ActiveX, Silverlight, NACL veya istemci tarafı Java applet’leri verilebilir.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.7", + "section_name": "Diğer Tarayıcı Güvenliği Hususları", + "req_id": "V3.7.2", + "req_description": "Uygulamanın, yalnızca hedef adres bir izinli listede yer alıyorsa kullanıcıyı otomatik olarak farklı bir ana makine adına veya uygulamanın kontrolünde olmayan bir etki alanına yönlendirdiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.7", + "section_name": "Diğer Tarayıcı Güvenliği Hususları", + "req_id": "V3.7.3", + "req_description": "Uygulamanın, kullanıcı uygulamanın kontrolü dışındaki bir URL’ye yönlendirildiğinde, yönlendirme hakkında bir bildirim gösterdiği ve kullanıcının bu gezintiyi iptal edebilmesi için bir seçenek sunduğu doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.7", + "section_name": "Diğer Tarayıcı Güvenliği Hususları", + "req_id": "V3.7.4", + "req_description": "Uygulamanın en üst düzey etki alanının (örneğin, site.tld) HTTP Strict Transport Security (HSTS) için genel preload listesine eklendiği doğrulanmalıdır. Bu, uygulamanın TLS kullanımının ana tarayıcılar tarafından doğrudan tanınmasını ve yalnızca Strict-Transport-Security yanıt header'ına bağlı kalınmamasını sağlar.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.7", + "section_name": "Diğer Tarayıcı Güvenliği Hususları", + "req_id": "V3.7.5", + "req_description": "Uygulamaya erişen tarayıcının beklenen güvenlik özelliklerini desteklememesi durumunda, uygulamanın dokümantasyona uygun şekilde davrandığı (örneğin kullanıcıyı uyarma veya erişimi engelleme) doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.1", + "section_name": "Genel Web Servisi Güvenliği", + "req_id": "V4.1.1", + "req_description": "İleti gövdesi içeren her HTTP yanıtında, yanıtın gerçek içeriğiyle eşleşen bir Content-Type header alanı bulunduğu ve güvenli karakter kodlamasını (örneğin, UTF-8, ISO-8859-1) belirtmek üzere charset parametresi içerdiği doğrulanmalıdır. Bu işlem, IANA Medya Türleri'nden \"text/\", \"/+xml\" ve \"/xml\" gibi içerikler için geçerlidir.", + "L": "1" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.1", + "section_name": "Genel Web Servisi Güvenliği", + "req_id": "V4.1.2", + "req_description": "Yalnızca kullanıcı arayüzüne yönelik uç noktaların (manuel olarak web tarayıcısı ile erişilmesi amaçlanan) otomatik olarak HTTP'den HTTPS'e yönlendirme yaptığı ve diğer hizmetlerin veya uç noktaların şeffaf yönlendirme gerçekleştirmediği doğrulanmalıdır. Bu, istemcinin farkında olmadan şifrelenmemiş HTTP istekleri göndermesi ve bu isteklerin otomatik olarak HTTPS'e yönlendirilmesi sonucunda hassas verilerin sızmasının fark edilmemesi riskini önlemek içindir.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.1", + "section_name": "Genel Web Servisi Güvenliği", + "req_id": "V4.1.3", + "req_description": "Uygulama tarafından kullanılan ve yük dengeleyici, web proxy veya frontend için backend hizmeti gibi bir ara katman tarafından ayarlanan herhangi bir HTTP başlık alanının, son kullanıcı tarafından geçersiz kılınamayacağı doğrulanmalıdır. Örnek başlıklar arasında X-Real-IP, X-Forwarded-* veya X-User-ID yer alabilir.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.1", + "section_name": "Genel Web Servisi Güvenliği", + "req_id": "V4.1.4", + "req_description": "Uygulama veya API tarafından açıkça desteklenen HTTP yöntemlerinin (preflight istekleri sırasında OPTIONS dahil) dışında hiçbir yöntemin kullanılmadığı ve kullanılmayan yöntemlerin engellendiği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.1", + "section_name": "Genel Web Servisi Güvenliği", + "req_id": "V4.1.5", + "req_description": "Çok hassas istekler veya birçok sistemden geçen işlemler için, taşıma katmanı güvenliğinin üzerine ek bir güvence sağlamak amacıyla, her iletiye özel dijital imzaların kullanıldığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.2", + "section_name": "HTTP İleti Yapısı Doğrulama", + "req_id": "V4.2.1", + "req_description": "Tüm uygulama bileşenlerinin (yük dengeleyiciler, güvenlik duvarları ve uygulama sunucuları dahil) HTTP sürümüne uygun mekanizmaları kullanarak gelen HTTP iletilerinin sınırlarını belirlediği ve bu sayede HTTP istek kaçakçılığına karşı koruma sağlandığı doğrulanmalıdır. HTTP/1.x sürümünde Transfer-Encoding başlık alanı varsa, RFC 2616'ya göre Content-Length başlığı göz ardı edilmelidir. HTTP/2 veya HTTP/3 kullanıldığında, Content-Length başlığı varsa, alıcının bu değerin DATA çerçevelerinin uzunluğuyla tutarlı olduğunu doğrulaması gerekir.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.2", + "section_name": "HTTP İleti Yapısı Doğrulama", + "req_id": "V4.2.2", + "req_description": "HTTP iletileri üretilirken, Content-Length başlığının, HTTP protokolünün çerçeveleme yöntemine göre belirlenen içerik uzunluğu ile çelişmediği doğrulanmalıdır. Bu, istek kaçakçılığı saldırılarını önlemek için gereklidir.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.2", + "section_name": "HTTP İleti Yapısı Doğrulama", + "req_id": "V4.2.3", + "req_description": "Uygulamanın, yanıt bölme ve header enjeksiyonu saldırılarını önlemek amacıyla, bağlantıya özel başlık alanları (örneğin Transfer-Encoding) içeren HTTP/2 veya HTTP/3 iletilerini göndermediği ve kabul etmediği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.2", + "section_name": "HTTP İleti Yapısı Doğrulama", + "req_id": "V4.2.4", + "req_description": "Uygulamanın yalnızca başlık alanları ve değerleri CR (\\r), LF (\\n) veya CRLF (\\r\\n) karakter dizileri içermeyen HTTP/2 ve HTTP/3 isteklerini kabul ettiği doğrulanmalıdır. Bu, başlık enjeksiyonu saldırılarını önlemek içindir.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.2", + "section_name": "HTTP İleti Yapısı Doğrulama", + "req_id": "V4.2.5", + "req_description": "Uygulama (backend veya frontend) istek oluşturuyor ve gönderiyorsa, URI'ler (örneğin API çağrıları için) veya HTTP istek başlıkları (örneğin Authorization veya Cookie) gibi bileşenlerin, alıcı sistemler tarafından kabul edilemeyecek kadar uzun olmamasını sağlamak amacıyla doğrulama, temizleme veya diğer mekanizmaları kullandığı doğrulanmalıdır. Bu tür çok uzun istekler (örneğin çok uzun bir Cookie başlığı) gönderildiğinde sunucunun sürekli hata durumu döndürmesiyle hizmet reddi oluşabilir.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.3", + "section_name": "GraphQL", + "req_id": "V4.3.1", + "req_description": "Maliyetli ve iç içe geçmiş sorgular sonucu oluşabilecek GraphQL veya veri katmanı ifadelerine yönelik Hizmet Reddi (DoS) saldırılarını önlemek için, sorgu izin listesi (allowlist), derinlik sınırlandırması, sorgu sayısı sınırlandırması veya sorgu maliyeti analizi kullanıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.3", + "section_name": "GraphQL", + "req_id": "V4.3.2", + "req_description": "GraphQL introspection (iç yapı sorgulama) sorgularının, GraphQL API'nin üçüncü taraflar tarafından kullanılmasına yönelik olmadığı sürece, üretim ortamında devre dışı bırakıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.1", + "req_description": "Tüm WebSocket bağlantılarında TLS üzerinden WebSocket (WSS) kullanıldığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.2", + "req_description": "WebSocket'in başlangıçtaki HTTP el sıkışması (handshake) sırasında, Origin başlık alanının uygulama için izin verilen origin listesiyle karşılaştırılarak kontrol edildiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.3", + "req_description": "Uygulamanın standart oturum yönetimi kullanılamıyorsa, bunun yerine ilgili Oturum Yönetimi güvenlik gereksinimlerine uygun özel token'ların kullanıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.4", + "req_description": "HTTPS oturumu WebSocket kanalına geçerken, özel WebSocket oturum yönetim token’larının önceki şekilde kimliği doğrulanmış HTTPS oturumu aracılığıyla elde edildiği veya doğrulandığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.1", + "section_name": "Dosya İşleme Dokümantasyonu", + "req_id": "V5.1.1", + "req_description": "Dokümantasyonun, her yükleme özelliği için izin verilen dosya türlerini, beklenen dosya uzantılarını ve maksimum boyutu (açılmış hali dahil) tanımladığı doğrulanmalıdır. Ayrıca, dosyaların son kullanıcılar için nasıl güvenli hâle getirileceği (örneğin kötü amaçlı bir dosya tespit edildiğinde uygulamanın nasıl davranacağı) gibi bilgilerin de belgede yer aldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.2", + "section_name": "Dosya Yükleme ve İçerik", + "req_id": "V5.2.1", + "req_description": "Uygulamanın, yalnızca performans kaybına veya hizmet reddine yol açmayacak boyuttaki dosyaları kabul ettiği doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.2", + "section_name": "Dosya Yükleme ve İçerik", + "req_id": "V5.2.2", + "req_description": "Uygulama bir dosyayı, doğrudan veya bir arşiv (ör. zip dosyası) içinde kabul ettiğinde, dosya uzantısının beklenen uzantıyla eşleşip eşleşmediğini kontrol ettiği ve içeriğin uzantı tarafından temsil edilen türle uyumlu olduğunu doğruladığı kontrol edilmelidir. Bu; ilk 'magic byte' kontrolü, görüntü yeniden yazımı ve dosya içeriği doğrulama için özel kütüphanelerin kullanımı gibi yöntemleri içerir. Seviye 1 için bu, yalnızca iş veya güvenlik kararlarında kullanılan dosyalarla sınırlı olabilir. Seviye 2 ve üzeri için tüm dosyalar bu kontrole tabi olmalıdır.", + "L": "1" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.2", + "section_name": "Dosya Yükleme ve İçerik", + "req_id": "V5.2.3", + "req_description": "Sıkıştırılmış dosyaların (ör. zip, gz, docx, odt) açılmadan önce, izin verilen maksimum açılmış boyuta ve maksimum dosya sayısına göre kontrol edildiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.2", + "section_name": "Dosya Yükleme ve İçerik", + "req_id": "V5.2.4", + "req_description": "Her kullanıcı için dosya boyutu kotası ve maksimum dosya sayısının uygulandığı doğrulanmalıdır. Böylece tek bir kullanıcının çok sayıda veya aşırı büyük dosya yükleyerek depolama alanını doldurması engellenir.", + "L": "3" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.2", + "section_name": "Dosya Yükleme ve İçerik", + "req_id": "V5.2.5", + "req_description": "Uygulamanın, içinde sembolik bağlantılar (symlink) bulunan sıkıştırılmış dosyaların yüklenmesine yalnızca bu durum özel olarak gerekli olduğunda izin verdiği doğrulanmalıdır. Bu durumda, sembolik bağlantı verilebilecek dosyaların bir izinli listesi uygulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.2", + "section_name": "Dosya Yükleme ve İçerik", + "req_id": "V5.2.6", + "req_description": "Uygulamanın, piksel boyutu izin verilen maksimum değeri aşan görüntü dosyalarının yüklenmesini reddettiği doğrulanmalıdır. Bu, pixel flood saldırılarını önlemek için gereklidir.", + "L": "3" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.3", + "section_name": "Dosya Depolama", + "req_id": "V5.3.1", + "req_description": "Güvenilmeyen girdilerle yüklenen veya oluşturulan ve herkese açık klasörlerde depolanan dosyaların, bir HTTP isteğiyle doğrudan erişildiğinde sunucu taraflı program kodu olarak çalıştırılmadığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.3", + "section_name": "Dosya Depolama", + "req_id": "V5.3.2", + "req_description": "Uygulamanın, dosya işlemleri için dosya yollarını oluştururken kullanıcı tarafından gönderilen dosya adlarını değil, dahili olarak oluşturulan veya güvenilir verileri kullandığı; eğer kullanıcı tarafından gönderilen dosya adları veya meta veriler kullanılacaksa, sıkı doğrulama ve temizleme işlemlerinin uygulandığı doğrulanmalıdır. Bu, yol geçişi (path traversal), yerel veya uzak dosya dahil etme (LFI, RFI) ve sunucu tarafı istek sahteciliği (SSRF) saldırılarına karşı koruma sağlar.", + "L": "1" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.3", + "section_name": "Dosya Depolama", + "req_id": "V5.3.3", + "req_description": "Sunucu tarafında gerçekleşen dosya işlemlerinin (örneğin dosya açma/decompress işlemi), kullanıcı tarafından sağlanan yol bilgilerini yok saydığı ve zip slip gibi güvenlik açıklarını önlediği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.4", + "section_name": "Dosya İndirme", + "req_id": "V5.4.1", + "req_description": "Uygulamanın, kullanıcı tarafından gönderilen dosya adlarını (ör. JSON, JSONP veya URL parametresinde) doğruladığı veya göz ardı ettiği ve yanıtın Content-Disposition başlık alanında bir dosya adı belirttiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.4", + "section_name": "Dosya İndirme", + "req_id": "V5.4.2", + "req_description": "Sunulan dosya adlarının (örneğin HTTP yanıt header'larında veya e-posta eklerinde), belge yapısını korumak ve enjeksiyon saldırılarını önlemek için kodlandığı veya temizlendiği (ör. RFC 6266’ya uygun) doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.4", + "section_name": "Dosya İndirme", + "req_id": "V5.4.3", + "req_description": "Güvenilmeyen kaynaklardan elde edilen dosyaların, bilinen kötü amaçlı içeriklerin sunulmasını önlemek amacıyla antivirüs tarayıcılarıyla tarandığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.1", + "section_name": "Kimlik Doğrulama Dokümantasyonu", + "req_id": "V6.1.1", + "req_description": "Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırılarına karşı oran sınırlama (rate limiting), otomasyon karşıtı önlemler ve uyarlanabilir yanıt gibi kontrollerin nasıl kullanıldığını açıklayan bir uygulama dokümantasyonu bulunduğu doğrulanmalıdır. Dokümantasyon, bu kontrollerin nasıl yapılandırıldığını ve kötü niyetli hesap kilitlemenin nasıl önlendiğini açıkça ortaya koymalıdır.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.1", + "section_name": "Kimlik Doğrulama Dokümantasyonu", + "req_id": "V6.1.2", + "req_description": "Parolalarda kullanılmasını önlemek amacıyla, bağlama özgü sözcüklerin (örneğin kurum adlarının permütasyonları, ürün adları, sistem tanımlayıcıları, proje kod adları, departman veya rol adları vb.) bulunduğu belgelenmiş bir liste mevcut olduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.1", + "section_name": "Kimlik Doğrulama Dokümantasyonu", + "req_id": "V6.1.3", + "req_description": "Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, bunların tümünün belgelenmiş olduğu ve her yol için tutarlı şekilde uygulanması gereken güvenlik kontrolleri ile kimlik doğrulama gücünün tanımlandığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.1", + "req_description": "Kullanıcı tarafından belirlenen parolaların en az 8 karakter uzunluğunda olması sağlanmalı, ancak 15 karakter ve üzeri uzunlukta parolalar olmaları şiddetle tavsiye edilir.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.2", + "req_description": "Kullanıcıların parolalarını değiştirebilmeleri sağlanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.3", + "req_description": "Parola değiştirme işlevinin hem mevcut hem de yeni parolayı gerektirdiği doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.4", + "req_description": "Kayıt veya parola değişimi sırasında girilen parolaların, uygulamanın parola politikasına (örneğin minimum uzunluk) uyan ilk 3000 yaygın parolaya karşı kontrol edildiği doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.5", + "req_description": "Her tür karakterin kullanılmasına izin verildiği ve büyük/küçük harf, sayı veya özel karakter şartlarının zorunlu tutulmadığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.6", + "req_description": "Parola giriş alanlarının, girdiyi maskelemek için \"type=password\" kullandığı doğrulanmalıdır. Uygulamalar, kullanıcının tüm maskelenmiş parolayı ya da son girilen karakteri geçici olarak görüntülemesine izin verebilir.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.7", + "req_description": "\"Yapıştır\" özelliğinin, tarayıcı parola yardımcılarının ve harici parola yöneticilerinin kullanımına izin verildiği doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.8", + "req_description": "Uygulamanın, kullanıcıdan aldığı parolayı herhangi bir şekilde değiştirmeden, örneğin kesmeden veya harf büyüklüğünü değiştirmeden, tam olarak doğruladığı teyit edilmelidir.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.9", + "req_description": "En az 64 karakter uzunluğundaki parolalara izin verildiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.10", + "req_description": "Kullanıcının parolasının, yalnızca ele geçirildiği tespit edildiğinde veya kullanıcı tarafından yenilendiğinde geçerliliğini yitirdiği doğrulanmalıdır. Uygulama, belirli aralıklarla parola yenilenmesini zorunlu kılmamalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.11", + "req_description": "Tahmin edilmesi kolay parolaların oluşturulmasını önlemek amacıyla, bağlama özgü kelimelerin yer aldığı belgelenmiş listenin parola doğrulamada kullanıldığı teyit edilmelidir.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.12", + "req_description": "Kayıt veya parola değişikliği sırasında girilen parolaların, ele geçirilmiş parolalar listesine karşı kontrol edildiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.3", + "section_name": "Genel Kimlik Doğrulama Güvenliği", + "req_id": "V6.3.1", + "req_description": "Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırıları gibi saldırıları önlemeye yönelik kontrollerin, uygulamanın güvenlik dokümantasyonuna göre uygulandığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.3", + "section_name": "Genel Kimlik Doğrulama Güvenliği", + "req_id": "V6.3.2", + "req_description": "\"root\", \"admin\" veya \"sa\" gibi varsayılan kullanıcı hesaplarının uygulamada yer almadığı veya devre dışı bırakıldığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.3", + "section_name": "Genel Kimlik Doğrulama Güvenliği", + "req_id": "V6.3.3", + "req_description": "Uygulamaya erişim için ya çok faktörlü bir kimlik doğrulama mekanizması ya da tek faktörlü mekanizmaların kombinasyonu kullanılmalıdır. Seviye 3 için, bu faktörlerden biri, oltalama saldırılarına karşı direnç sağlayan ve kimlik doğrulama niyetini bir kullanıcı etkileşimi (örneğin FIDO donanım anahtarında bir düğmeye basma veya mobil telefonda bir onay) gerektirerek doğrulayan donanım tabanlı bir kimlik doğrulayıcı olmalıdır. Bu gereksinimdeki herhangi bir esneklik için, gerekçesi belgelenmiş ve riskleri azaltıcı kapsamlı kontroller içeren bir plan gereklidir.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.3", + "section_name": "Genel Kimlik Doğrulama Güvenliği", + "req_id": "V6.3.4", + "req_description": "Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, belgelendirilmemiş bir yol bulunmadığı ve tüm yollar için güvenlik kontrolleri ile kimlik doğrulama gücünün tutarlı şekilde uygulandığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.3", + "section_name": "Genel Kimlik Doğrulama Güvenliği", + "req_id": "V6.3.5", + "req_description": "Başarılı veya başarısız şüpheli kimlik doğrulama girişimlerinin kullanıcıya bildirildiği doğrulanmalıdır. Bu, olağandışı bir konum veya istemciden gelen girişimler, yalnızca bir faktörle yapılan kısmen başarılı doğrulamalar, uzun süreli inaktiflik sonrası yapılan girişimler veya birçok başarısız denemeden sonraki başarılı girişimler gibi durumları içerebilir.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.3", + "section_name": "Genel Kimlik Doğrulama Güvenliği", + "req_id": "V6.3.6", + "req_description": "E-postanın, tek faktörlü ya da çok faktörlü kimlik doğrulama mekanizması olarak kullanılmadığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.3", + "section_name": "Genel Kimlik Doğrulama Güvenliği", + "req_id": "V6.3.7", + "req_description": "Kimlik doğrulama detaylarında yapılan güncellemeler sonrasında (örneğin kimlik bilgisi sıfırlama, kullanıcı adı veya e-posta adresi değişiklikleri), kullanıcıların bilgilendirildiği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.3", + "section_name": "Genel Kimlik Doğrulama Güvenliği", + "req_id": "V6.3.8", + "req_description": "Başarısız kimlik doğrulama girişimlerinden, geçerli kullanıcıların hata mesajları, HTTP yanıt kodları veya farklı yanıt süreleri gibi sonuçlara dayanarak tespit edilemediği doğrulanmalıdır. Bu koruma, kayıt ve \"parolamı unuttum\" işlevselliğinde de geçerli olmalıdır.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.4", + "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", + "req_id": "V6.4.1", + "req_description": "Sistem tarafından oluşturulan ilk parolaların veya etkinleştirme kodlarının güvenli bir şekilde rastgele üretildiği, mevcut parola politikasına uygun olduğu, kısa bir süre içinde veya ilk kullanım sonrasında geçerliliğini yitirdiği doğrulanmalıdır. Bu başlangıç sırları uzun vadeli parola olarak kullanılmasına izin verilmemelidir.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.4", + "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", + "req_id": "V6.4.2", + "req_description": "Parola ipuçlarının veya \"gizli sorular\" olarak bilinen, bilgiye dayalı kimlik doğrulama mekanizmalarının mevcut olmadığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.4", + "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", + "req_id": "V6.4.3", + "req_description": "Unutulmuş parolanın sıfırlanması için, etkin olan çok faktörlü kimlik doğrulama mekanizmalarını atlamayan güvenli bir sürecin uygulandığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.4", + "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", + "req_id": "V6.4.4", + "req_description": "Çok faktörlü kimlik doğrulama faktörlerinden biri kaybolursa, kayıt sırasında uygulanan kimlik kanıtlama seviyesiyle aynı seviyede kimlik doğrulama yapıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.4", + "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", + "req_id": "V6.4.5", + "req_description": "Süresi dolacak kimlik doğrulama mekanizmalarının yenilenmesine ilişkin talimatların, süresi dolmadan önce tamamlanacak şekilde yeterli sürede gönderildiği ve gerekiyorsa otomatik hatırlatıcıların yapılandırıldığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.4", + "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", + "req_id": "V6.4.6", + "req_description": "Yönetici yetkisi olan kullanıcıların, kullanıcının parola sıfırlama sürecini başlatabildiği ancak kullanıcının yeni parolasını belirleyemediği veya değiştiremediği doğrulanmalıdır. Bu, yönetici yetkisi olan kullanıcıların, kullanıcı parolasını bilmesini engeller.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.5", + "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "req_id": "V6.5.1", + "req_description": "Arama sırları, bant dışı kimlik doğrulama istekleri veya kodları ve zamana dayalı tek kullanımlık parolaların (TOTP) yalnızca bir kez kullanılabildiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.5", + "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "req_id": "V6.5.2", + "req_description": "Uygulamanın backend tarafında saklanırken, 112 bitten az entropiye sahip (örneğin 19 rastgele harf-rakam karakteri veya 34 rastgele rakam) arama sırlarının, 32-bit rastgele bir salt içeren onaylı bir parola saklama algoritmasıyla hash’lendiği doğrulanmalıdır. Gizli bilginin entropisi 112 bit veya daha fazlaysa standart bir hash fonksiyonu kullanılabilir.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.5", + "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "req_id": "V6.5.3", + "req_description": "Arama sırları, bant dışı kimlik doğrulama kodları ve zamana dayalı tek kullanımlık parola seed'lerinin, öngörülebilir değerlerden kaçınmak için Kriptografik Olarak Güvenli Sözde Rastgele Sayı Üreteci (CSPRNG) ile oluşturulduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.5", + "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "req_id": "V6.5.4", + "req_description": "Arama sırlarının ve bant dışı kimlik doğrulama kodlarının en az 20 bit entropiye (genellikle 4 rastgele harf-rakam karakteri veya 6 rastgele rakam) sahip olduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.5", + "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "req_id": "V6.5.5", + "req_description": "Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının ve zamana dayalı tek kullanımlık parolaların (TOTP) belirli bir ömre sahip olduğu doğrulanmalıdır. Bant dışı istekler en fazla 10 dakika, TOTP’ler ise en fazla 30 saniye geçerli olmalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.5", + "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "req_id": "V6.5.6", + "req_description": "Herhangi bir kimlik doğrulama faktörünün (fiziksel cihazlar dahil) çalınması veya kaybı durumunda iptal edilebildiği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.5", + "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "req_id": "V6.5.7", + "req_description": "Biyometrik kimlik doğrulama mekanizmalarının yalnızca ikincil faktör olarak, “sahip olduğunuz bir şey” veya “bildiğiniz bir şey” ile birlikte kullanıldığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.5", + "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "req_id": "V6.5.8", + "req_description": "Zamana dayalı tek kullanımlık parolaların (TOTP) doğrulamasının, güvenilir bir hizmetten alınan zaman kaynağına dayanarak yapıldığı ve güvenilir olmayan veya istemci tarafından sağlanan zaman kaynağına dayanmadığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.6", + "section_name": "Bant Dışı Kimlik Doğrulama Mekanizmaları", + "req_id": "V6.6.1", + "req_description": "Tek kullanımlık parolaların (OTP) telefon veya SMS ile Public Switched Telephone Network (PSTN) üzerinden iletildiği kimlik doğrulama mekanizmalarının, yalnızca telefon numarası önceden doğrulanmışsa, alternatif daha güçlü yöntemler (örneğin TOTP) de sunuluyorsa ve kullanıcıya güvenlik riskleri hakkında bilgi veriliyorsa sunulduğu doğrulanmalıdır. Seviye 3 uygulamalar için telefon ve SMS seçenekleri sunulmamalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.6", + "section_name": "Bant Dışı Kimlik Doğrulama Mekanizmaları", + "req_id": "V6.6.2", + "req_description": "Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının, oluşturuldukları özgün kimlik doğrulama isteğiyle bağlantılı olduğu ve daha önceki ya da sonraki bir istek için kullanılamadığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.6", + "section_name": "Bant Dışı Kimlik Doğrulama Mekanizmaları", + "req_id": "V6.6.3", + "req_description": "Kod tabanlı bant dışı kimlik doğrulama mekanizmalarının, oran sınırlaması ile kaba kuvvet saldırılarına karşı korunduğu doğrulanmalıdır. En az 64 bit entropiye sahip kodlar kullanılması da değerlendirilmelidir.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.6", + "section_name": "Bant Dışı Kimlik Doğrulama Mekanizmaları", + "req_id": "V6.6.4", + "req_description": "Çok faktörlü kimlik doğrulama için push bildirimleri kullanılıyorsa, push bombing saldırılarına karşı oran sınırlamasının kullanıldığı doğrulanmalıdır. “Numara eşleştirme” de bu riski azaltabilir.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.7", + "section_name": "Kriptografik Kimlik Doğrulama Mekanizması", + "req_id": "V6.7.1", + "req_description": "Kriptografik kimlik doğrulama beyanlarını doğrulamak için kullanılan sertifikaların, değiştirilmeye karşı korumalı şekilde saklandığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.7", + "section_name": "Kriptografik Kimlik Doğrulama Mekanizması", + "req_id": "V6.7.2", + "req_description": "Challenge nonce değerinin en az 64 bit uzunluğunda olduğu ve istatistiksel olarak benzersiz ya da cihazın ömrü boyunca benzersiz olduğu doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.8", + "section_name": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", + "req_id": "V6.8.1", + "req_description": "Uygulama birden fazla kimlik sağlayıcıyı (IdP) destekliyorsa, başka bir desteklenen kimlik sağlayıcı aracılığıyla (örneğin aynı kullanıcı tanımlayıcısını kullanarak) kullanıcının kimliğinin taklit edilemediği doğrulanmalıdır. Standart önlem, uygulamanın kullanıcıyı IdP kimliği (bir ad alanı işlevi görür) ve IdP içindeki kullanıcı kimliğinin birleşimiyle kaydetmesi ve tanımlamasıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.8", + "section_name": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", + "req_id": "V6.8.2", + "req_description": "Kimlik doğrulama beyanları üzerindeki dijital imzaların (örneğin JWT veya SAML beyanları) varlığı ve bütünlüğünün her zaman doğrulandığı ve imzasız veya geçersiz imzalı beyanların reddedildiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.8", + "section_name": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", + "req_id": "V6.8.3", + "req_description": "SAML beyanlarının benzersiz biçimde işlendiği ve yalnızca geçerlilik süresi içinde bir kez kullanıldığı, tekrar oynatma (replay) saldırılarını önlemek amacıyla doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.8", + "section_name": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", + "req_id": "V6.8.4", + "req_description": "Uygulama ayrı bir Kimlik Sağlayıcı (IdP) kullanıyorsa ve belirli işlemler için belirli kimlik doğrulama gücü, yöntemleri veya zaman bilgisi bekliyorsa, uygulamanın bu bilgileri IdP tarafından döndürülen veriler üzerinden doğruladığı teyit edilmelidir. Örneğin OIDC kullanılıyorsa, bu durum ID Token üzerindeki 'acr', 'amr' ve 'auth_time' gibi claim’lerin (varsa) doğrulanması ile sağlanabilir. Eğer IdP bu bilgileri sağlamıyorsa, uygulamanın asgari kimlik doğrulama gücünün kullanıldığını varsayan (örneğin yalnızca kullanıcı adı ve parola ile tek faktörlü doğrulama) belgelenmiş bir yedek yaklaşımı olmalıdır.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.1", + "section_name": "Oturum Yönetim Dokümantasyonu", + "req_id": "V7.1.1", + "req_description": "Kullanıcının oturum inaktivite zaman aşımı süresi ve mutlak maksimum oturum süresinin belgelendiği, diğer kontrollerle birlikte uygun olduğu ve NIST SP 800-63B yeniden kimlik doğrulama gereksinimlerinden herhangi bir sapma varsa gerekçesinin belgede yer aldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.1", + "section_name": "Oturum Yönetim Dokümantasyonu", + "req_id": "V7.1.2", + "req_description": "Belgede bir hesap için kaç adet eşzamanlı (paralel) oturuma izin verildiği ile birlikte, maksimum aktif oturum sayısına ulaşıldığında uygulanacak davranış ve işlemlerin tanımlandığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.1", + "section_name": "Oturum Yönetim Dokümantasyonu", + "req_id": "V7.1.3", + "req_description": "Birleşik kimlik yönetim ekosisteminin bir parçası olarak kullanıcı oturumu oluşturan ve yöneten tüm sistemlerin, oturum ömrü, sonlandırma ve yeniden kimlik doğrulama gerektiren diğer koşulların nasıl koordine edildiğini açıklayan kontrollerle birlikte belgede yer aldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.2", + "section_name": "Temel Oturum Yönetimi Güvenliği", + "req_id": "V7.2.1", + "req_description": "Uygulamanın tüm oturum token'ı doğrulama işlemlerini güvenilir bir backend servisi aracılığıyla gerçekleştirdiği doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.2", + "section_name": "Temel Oturum Yönetimi Güvenliği", + "req_id": "V7.2.2", + "req_description": "Uygulamanın, statik API gizli anahtarları veya sabit değerler yerine, oturum yönetimi için dinamik olarak oluşturulan kendi kendine yeterli veya referans token'ları kullandığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.2", + "section_name": "Temel Oturum Yönetimi Güvenliği", + "req_id": "V7.2.3", + "req_description": "Uygulama kullanıcı oturumlarını temsil etmek için referans token'ları kullanıyorsa, bu token'ların benzersiz olduğu, kriptografik olarak güvenli bir sözde rastgele sayı üreteci (CSPRNG) kullanılarak üretildiği ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.2", + "section_name": "Temel Oturum Yönetimi Güvenliği", + "req_id": "V7.2.4", + "req_description": "Uygulamanın, kullanıcı kimlik doğrulaması (yeniden kimlik doğrulama dahil) sırasında yeni bir oturum token'ı oluşturduğu ve mevcut oturum token'ını sonlandırdığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.3", + "section_name": "Oturum Zaman Aşımı", + "req_id": "V7.3.1", + "req_description": "Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde bir hareketsizlik zaman aşımı bulunduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.3", + "section_name": "Oturum Zaman Aşımı", + "req_id": "V7.3.2", + "req_description": "Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde mutlak bir maksimum oturum süresi bulunduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.4", + "section_name": "Oturum Sonlandırma", + "req_id": "V7.4.1", + "req_description": "Oturum sonlandırma tetiklendiğinde (örneğin, çıkış yapıldığında veya süre dolduğunda), uygulamanın oturumun daha fazla kullanılmasına izin vermediği doğrulanmalıdır. Referans token'lar veya durum bilgili oturumlar için bu, oturum verilerinin uygulama arka ucunda geçersiz kılınması anlamına gelir. Kapsamlı token kullanan uygulamaların; sonlandırılmış token listesi tutmak, kullanıcıya özel tarih ve saatten önce oluşturulan token'ları reddetmek veya kullanıcıya özel imzalama anahtarını yenilemek gibi bir çözüm uygulaması gerekir.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.4", + "section_name": "Oturum Sonlandırma", + "req_id": "V7.4.2", + "req_description": "Bir kullanıcı hesabı devre dışı bırakıldığında veya silindiğinde (örneğin bir çalışanın şirketten ayrılması), uygulamanın tüm aktif oturumları sonlandırdığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.4", + "section_name": "Oturum Sonlandırma", + "req_id": "V7.4.3", + "req_description": "Herhangi bir kimlik doğrulama faktörünün başarılı bir şekilde değiştirilmesi veya kaldırılmasından (şifre sıfırlama veya kurtarma yoluyla yapılan değişiklikler dahil ve varsa MFA ayarları güncellemeleri dahil) sonra, uygulamanın diğer tüm aktif oturumları sonlandırma seçeneği sunduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.4", + "section_name": "Oturum Sonlandırma", + "req_id": "V7.4.4", + "req_description": "Kimlik doğrulama gerektiren tüm sayfalarda kolay erişilebilir ve görünür bir çıkış yap (logout) işlevi bulunduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.4", + "section_name": "Oturum Sonlandırma", + "req_id": "V7.4.5", + "req_description": "Uygulama yöneticilerinin, bireysel bir kullanıcının veya tüm kullanıcıların aktif oturumlarını sonlandırabilme yetkisine sahip olduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.5", + "section_name": "Oturum Kötüye Kullanımına Karşı Savunmalar", + "req_id": "V7.5.1", + "req_description": "E-posta adresi, telefon numarası, MFA yapılandırması veya hesap kurtarmada kullanılan diğer bilgiler gibi kimlik doğrulamayı etkileyebilecek hassas hesap özniteliklerinde değişiklik yapılmadan önce uygulamanın tam yeniden kimlik doğrulama gerektirdiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.5", + "section_name": "Oturum Kötüye Kullanımına Karşı Savunmalar", + "req_id": "V7.5.2", + "req_description": "Kullanıcıların, (en az bir faktörle yeniden kimlik doğrulama yaptıktan sonra) mevcut tüm aktif oturumları görüntüleyebilmesi ve sonlandırabilmesinin mümkün olduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.5", + "section_name": "Oturum Kötüye Kullanımına Karşı Savunmalar", + "req_id": "V7.5.3", + "req_description": "Uygulamanın, son derece hassas işlemler veya operasyonlar gerçekleştirilmeden önce en az bir faktörle ek kimlik doğrulaması veya ikincil bir doğrulama gerektirdiği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.6", + "section_name": "Birleşik Yeniden Kimlik Doğrulama", + "req_id": "V7.6.1", + "req_description": "Güvenen Taraf (RP) ile Kimlik Sağlayıcı (IdP) arasındaki oturum süresi ve oturum sonlandırma davranışlarının belgelenmiş olduğu ve, örneğin IdP kimlik doğrulama olayları arasında maksimum süreye ulaşıldığında yeniden kimlik doğrulamanın gerekli kılındığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.6", + "section_name": "Birleşik Yeniden Kimlik Doğrulama", + "req_id": "V7.6.2", + "req_description": "Yeni bir oturum oluşturulmasının, kullanıcı onayı veya açık bir eylem gerektirdiği; kullanıcı etkileşimi olmaksızın yeni uygulama oturumlarının oluşturulmasının önlendiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.1", + "section_name": "Yetkilendirme Dokümantasyonu", + "req_id": "V8.1.1", + "req_description": "Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak işlev düzeyinde ve veriye özel erişim kısıtlamaları için kuralları tanımladığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.1", + "section_name": "Yetkilendirme Dokümantasyonu", + "req_id": "V8.1.2", + "req_description": "Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak alan (field) düzeyinde erişim kısıtlamaları (hem okuma hem yazma) için kuralları tanımladığı doğrulanmalıdır. Bu kuralların, ilgili veri nesnesinin durum veya statü gibi diğer özniteliklerine bağlı olabileceği unutulmamalıdır.", + "L": "2" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.1", + "section_name": "Yetkilendirme Dokümantasyonu", + "req_id": "V8.1.3", + "req_description": "Uygulamanın dokümantasyonunun, kimlik doğrulama ve yetkilendirme ile ilgili güvenlik kararlarının alınmasında kullanılan çevresel ve bağlamsal öznitelikleri (günün saati, kullanıcı konumu, IP adresi veya cihaz gibi) tanımladığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.1", + "section_name": "Yetkilendirme Dokümantasyonu", + "req_id": "V8.1.4", + "req_description": "Kimlik doğrulama ve yetkilendirme dokümantasyonunun; işlev düzeyinde, veriye özel ve alan düzeyinde yetkilendirmenin yanı sıra çevresel ve bağlamsal faktörlerin karar almada nasıl kullanıldığını tanımladığı doğrulanmalıdır. Bu, değerlendirilen öznitelikleri, risk eşiklerini ve alınan aksiyonları (ör. izin ver, doğrulama iste, reddet, step-up kimlik doğrulama) içermelidir.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.2", + "section_name": "Genel Yetkilendirme Tasarımı", + "req_id": "V8.2.1", + "req_description": "Uygulamanın, işlev düzeyindeki erişimin yalnızca açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.2", + "section_name": "Genel Yetkilendirme Tasarımı", + "req_id": "V8.2.2", + "req_description": "Uygulamanın, veriye özel erişimin yalnızca belirli veri öğelerine açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, doğrudan nesne referansı güvenlik açıkları (IDOR) ve bozuk nesne düzeyinde yetkilendirme (BOLA) risklerini azaltır.", + "L": "1" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.2", + "section_name": "Genel Yetkilendirme Tasarımı", + "req_id": "V8.2.3", + "req_description": "Uygulamanın, alan (field) düzeyindeki erişimin yalnızca belirli alanlara açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, bozuk nesne özelliği düzeyinde yetkilendirme (BOPLA) risklerini azaltır.", + "L": "2" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.2", + "section_name": "Genel Yetkilendirme Tasarımı", + "req_id": "V8.2.4", + "req_description": "Tüketicinin çevresel ve bağlamsal özniteliklerine (ör. günün saati, konum, IP adresi veya cihaz) dayalı uyarlanabilir güvenlik kontrollerinin, uygulama dokümantasyonunda tanımlandığı şekilde, kimlik doğrulama ve yetkilendirme kararları için uygulandığı doğrulanmalıdır. Bu kontroller, tüketici yeni bir oturum başlatmaya çalışırken ve mevcut bir oturum sırasında uygulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.3", + "section_name": "İşlem Düzeyinde Yetkilendirme", + "req_id": "V8.3.1", + "req_description": "Uygulamanın yetkilendirme kurallarını güvenilir bir servis katmanında uyguladığı ve istemci taraflı JavaScript gibi güvenilmeyen tüketiciler tarafından değiştirilebilecek kontrollerle yetinmediği doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.3", + "section_name": "İşlem Düzeyinde Yetkilendirme", + "req_id": "V8.3.2", + "req_description": "Yetkilendirme kararlarının temelini oluşturan değerlerdeki değişikliklerin hemen uygulandığı doğrulanmalıdır. Değişikliklerin anında uygulanamadığı durumlarda (örneğin self-contained token içindeki verilere güveniliyorsa), tüketici artık yetkili olmadığı hâlde bir işlem gerçekleştirdiğinde uyarı verecek ve değişikliği geri alacak önlemler uygulanmalıdır. Bu alternatifin bilgi sızıntısını önlemeyeceği unutulmamalıdır.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.3", + "section_name": "İşlem Düzeyinde Yetkilendirme", + "req_id": "V8.3.3", + "req_description": "Bir nesneye erişimin, herhangi bir aracı veya onun adına hareket eden bir servis yerine yalnızca erişimi başlatan öznenin (ör. tüketici) izinlerine dayandığı doğrulanmalıdır. Örneğin, bir tüketici kimlik doğrulama için bir self-contained token kullanarak bir web servis çağırırsa ve bu servis başka bir servisten veri talep ederse, ikinci servis izin kararlarını verirken birinci servisin makine-makine token'ı yerine tüketicinin token'ını kullanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.4", + "section_name": "Diğer Yetkilendirme Hususları", + "req_id": "V8.4.1", + "req_description": "Multi-tenant uygulamaların, tüketici işlemlerinin izinli olmadıkları tenant'lar üzerinde asla etkili olmamasını sağlamak için tenant'lar arası kontroller kullandığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.4", + "section_name": "Diğer Yetkilendirme Hususları", + "req_id": "V8.4.2", + "req_description": "Yönetici arayüzlerine erişimin, sürekli tüketici kimlik doğrulaması, cihaz güvenlik durumu değerlendirmesi ve bağlamsal risk analizi dahil olmak üzere çok katmanlı güvenlik içerdiği doğrulanmalıdır. Yetkilendirme için yalnızca ağ konumu veya güvenilir uç noktalar yeterli olmamalıdır; ancak bu tür faktörler yetkisiz erişim olasılığını azaltabilir.", + "L": "3" + }, + { + "chapter_id": "V9", + "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", + "section_id": "V9.1", + "section_name": "Token Kaynağı ve Bütünlüğü", + "req_id": "V9.1.1", + "req_description": "Self-contained token'ların içerikleri kabul edilmeden önce, oynama (tampering) saldırılarına karşı dijital imza veya MAC ile doğrulama yapıldığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V9", + "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", + "section_id": "V9.1", + "section_name": "Token Kaynağı ve Bütünlüğü", + "req_id": "V9.1.2", + "req_description": "Belirli bir bağlam için yalnızca bir allowlist üzerinde bulunan algoritmaların self-contained token oluşturmak ve doğrulamak için kullanılabildiği doğrulanmalıdır. Bu allowlist, yalnızca simetrik ya da yalnızca asimetrik algoritmaları içermeli ve kesinlikle 'None' algoritmasını içermemelidir. Hem simetrik hem de asimetrik algoritmalar desteklenmek zorundaysa, anahtar karışıklığını (key confusion) önlemek için ek kontroller uygulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V9", + "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", + "section_id": "V9.1", + "section_name": "Token Kaynağı ve Bütünlüğü", + "req_id": "V9.1.3", + "req_description": "Self-contained token'ları doğrulamak için kullanılan anahtar malzemesinin, token issuer için önceden yapılandırılmış güvenilir kaynaklardan alındığı doğrulanmalıdır. Bu, saldırganların güvenilmeyen kaynak ve anahtarları belirtmesini engeller. JWT ve diğer JWS yapılarında 'jku', 'x5u' ve 'jwk' gibi header'lar güvenilir kaynaklardan oluşan bir allowlist'e göre doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V9", + "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", + "section_id": "V9.2", + "section_name": "Token İçeriği", + "req_id": "V9.2.1", + "req_description": "Token verisinde bir geçerlilik zaman aralığı (validity time span) varsa, yalnızca doğrulama zamanı bu zaman aralığı içerisindeyse token ve içeriği kabul edilmelidir. Örneğin, JWT'ler için 'nbf' ve 'exp' claim'leri doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V9", + "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", + "section_id": "V9.2", + "section_name": "Token İçeriği", + "req_id": "V9.2.2", + "req_description": "Token'ı alan hizmetin, token içeriğini kabul etmeden önce bu token'ın doğru türde olduğunu ve sunulma amacına uygun olduğunu doğruladığı teyit edilmelidir. Örneğin, yalnızca erişim token'ları yetkilendirme kararları için, yalnızca ID Token'lar kullanıcı kimlik doğrulamasını kanıtlamak için kullanılabilir.", + "L": "2" + }, + { + "chapter_id": "V9", + "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", + "section_id": "V9.2", + "section_name": "Token İçeriği", + "req_id": "V9.2.3", + "req_description": "Hizmetin yalnızca kendisiyle kullanılması amaçlanan (audience) token'ları kabul ettiği doğrulanmalıdır. JWT'lerde bu, 'aud' claim'inin hizmet içinde tanımlı bir allowlist ile doğrulanması yoluyla sağlanabilir.", + "L": "2" + }, + { + "chapter_id": "V9", + "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", + "section_id": "V9.2", + "section_name": "Token İçeriği", + "req_id": "V9.2.4", + "req_description": "Eğer bir token issuer, farklı audience'lara token oluşturmak için aynı private key'i kullanıyorsa, oluşturulan token'ların hedef audience'ları benzersiz şekilde tanımlayan bir audience kısıtlaması içerdiği doğrulanmalıdır. Bu, bir token'ın farklı bir audience ile yeniden kullanılmasını önler. Audience tanımlayıcısı dinamik olarak sağlanıyorsa, token issuer bu audience'ları doğrulamalı ve audience taklitlerinin (impersonation) önüne geçmelidir.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.1", + "section_name": "Genel OAuth ve OIDC Güvenliği", + "req_id": "V10.1.1", + "req_description": "Token'ların yalnızca kesinlikle ihtiyaç duyan bileşenlere gönderildiği doğrulanmalıdır. Örneğin, tarayıcı tabanlı JavaScript uygulamaları için bir backend-for-frontend modeli kullanıldığında, access ve refresh token'lara yalnızca backend'in erişebilmesi gerekir.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.1", + "section_name": "Genel OAuth ve OIDC Güvenliği", + "req_id": "V10.1.2", + "req_description": "Authorization server'dan gelen değerler (örneğin authorization code veya ID Token gibi) yalnızca aynı user agent oturumu ve işlemi tarafından başlatılmış bir yetkilendirme akışının sonucuysa kabul edildiği doğrulanmalıdır. Bu, client tarafından oluşturulan secret’ların 'proof key for code exchange' (PKCE) ‘code_verifier’, ‘state’ veya OIDC ‘nonce’ gibi tahmin edilemez, işleme özgü ve hem client’a hem de işlem başlatılan user agent oturumuna güvenli bir şekilde bağlı olmasını gerektirir.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.2", + "section_name": "OAuth İstemcisi", + "req_id": "V10.2.1", + "req_description": "Code flow kullanılıyorsa, OAuth client’ın token taleplerini tetikleyen CSRF saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Bu genellikle PKCE kullanılarak veya authorization isteğinde gönderilen ‘state’ parametresinin kontrolü ile sağlanır.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.2", + "section_name": "OAuth İstemcisi", + "req_id": "V10.2.2", + "req_description": "OAuth istemcisi birden fazla AS ile etkileşime girebiliyorsa, mix-up saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Örneğin, authorization server’ın 'iss' parametresini döndürmesi zorunlu kılınabilir ve bu parametrenin hem authorization yanıtında hem de token yanıtında doğrulanması gerekir.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.2", + "section_name": "OAuth İstemcisi", + "req_id": "V10.2.3", + "req_description": "OAuth istemcisinin authorization server’a yaptığı taleplerde yalnızca gerekli scope’ları (veya diğer yetkilendirme parametrelerini) talep ettiği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.3", + "section_name": "OAuth Kaynak Sunucusu (RS)", + "req_id": "V10.3.1", + "req_description": "RS'nin yalnızca bu servisle kullanılmak üzere tasarlanmış access token’ları kabul ettiği doğrulanmalıdır (audience kontrolü). Audience bilgisi yapılandırılmış token’larda (örneğin JWT içindeki ‘aud’ claim’i) yer alabilir veya token introspection endpoint aracılığıyla kontrol edilebilir.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.3", + "section_name": "OAuth Kaynak Sunucusu (RS)", + "req_id": "V10.3.2", + "req_description": "RS'nin, access token’dan gelen claim’lere dayanarak yetki devri tanımına uygun şekilde yetkilendirme kararları uyguladığı doğrulanmalıdır. ‘sub’, ‘scope’ ve ‘authorization_details’ gibi claim’ler varsa, bu kararın parçası olmalıdır.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.3", + "section_name": "OAuth Kaynak Sunucusu (RS)", + "req_id": "V10.3.3", + "req_description": "Erişim kontrolü kararında, access token’dan (JWT veya ilgili token introspection yanıtı) benzersiz bir kullanıcının tanımlanması gerekiyorsa, RS'nin başka kullanıcılara devredilemeyecek claim’ler ile kullanıcıyı tanımladığı doğrulanmalıdır. Genellikle bu, ‘iss’ ve ‘sub’ claim’lerinin birlikte kullanılması anlamına gelir.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.3", + "section_name": "OAuth Kaynak Sunucusu (RS)", + "req_id": "V10.3.4", + "req_description": "RS'nin belirli bir kimlik doğrulama gücü, yöntemi veya güncelliği (recentness) gerektirmesi durumunda, sunulan access token’ın bu kısıtlamaları karşıladığını doğruladığı, örneğin, OIDC ‘acr’, ‘amr’ ve ‘auth_time’ claim’leri kullanılarak doğrulanmalıdır. ", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.3", + "section_name": "OAuth Kaynak Sunucusu (RS)", + "req_id": "V10.3.5", + "req_description": "RS'nin, (yetkisiz taraflarca) çalınmış veya tekrar edilen access token’ların kullanımını önlemek için sender-constrained access token’lar kullandığı doğrulanmalıdır. Bu, OAuth 2 için Mutual TLS veya OAuth 2 Demonstration of Proof of Possession (DPoP) ile sağlanabilir.", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.1", + "req_description": "AS'nin, istemciye özel önceden kaydedilmiş URI’lerden oluşan bir allowlist kullanarak redirect URI’leri tam dize karşılaştırması ile doğruladığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.2", + "req_description": "AS'nin, \"authorization response\" içinde \"authorization code\" döndürdüğü durumlarda, bu kodun yalnızca bir kez kullanılabildiği doğrulanmalıdır. Daha önce access token vermek için kullanılmış bir authorization code ile yapılan ikinci geçerli token isteği reddedilmeli ve ilgili tüm token’lar iptal edilmelidir.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.3", + "req_description": "Authorization code’un kısa ömürlü olduğu doğrulanmalıdır. L1 ve L2 uygulamalar için maksimum yaşam süresi 10 dakika, L3 uygulamalar için 1 dakikadır.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.4", + "req_description": "Belirli bir istemci için AS'nin yalnızca o istemcinin ihtiyaç duyduğu grant türlerine izin verdiği doğrulanmalıdır. \"Token\" (Implicit flow) ve \"password\" (Resource Owner Password Credentials flow) grant türlerinin artık kullanılmaması gerekir.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.5", + "req_description": "AS'nin, açık istemciler için refresh token replay saldırılarını azalttığı doğrulanmalıdır. Tercihen sender-constrained refresh token’lar (DPoP veya mutual TLS ile certificate-bound access token’lar) kullanılmalıdır. L1 ve L2 uygulamalar için refresh token rotation kullanılabilir. Rotation kullanılıyorsa, AS refresh token’ı kullanım sonrası geçersiz kılmalı ve geçersiz bir refresh token sunulması durumunda o yetkilendirme ile ilişkili tüm refresh token’ları iptal etmelidir.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.6", + "req_description": "Code grant kullanılıyorsa, AS'nin authorization code interception saldırılarına karşı koruma sağladığı doğrulanmalıdır. Yetkilendirme isteğinde geçerli bir \"code_challenge\" değeri zorunlu olmalı ve \"code_challenge_method\" olarak \"plain\" kabul edilmemelidir. Token isteğinde ise \"code_verifier\" parametresi doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.7", + "req_description": "AS'nin, kimlik doğrulaması yapılmamış dinamik istemci kaydını desteklemesi durumunda, kötü niyetli istemci uygulamalarına karşı riskleri azalttığı doğrulanmalıdır. Kayıtlı URI’ler gibi client metadata’sı doğrulanmalı, kullanıcı onayı alınmalı ve güvenilmeyen bir client uygulamasıyla yapılan yetkilendirme isteği işlenmeden önce kullanıcı uyarılmalıdır.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.8", + "req_description": "Refresh token’ların, sliding expiration kullanılsa bile mutlak bir sona erme süresine sahip olduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.9", + "req_description": "Yetkili bir kullanıcı tarafından AS kullanıcı arayüzü üzerinden refresh token’ların ve reference access token’ların iptal edilebildiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.10", + "req_description": "Gizli istemcilerin token istekleri, pushed authorization request (PAR) ve token iptal istekleri gibi server’a yapılan backchannel isteklerinde kimliğinin kontrol edildiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.11", + "req_description": "AS yapılandırmasının, OAuth istemcisine yalnızca gerekli scope’ları atadığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.12", + "req_description": "Belirli bir client için, authorization server’ın yalnızca client’ın ihtiyaç duyduğu 'response_mode' değerine izin verdiği doğrulanmalıdır. Örneğin, bu değer ya beklenenlerle karşılaştırılarak doğrulanmalı ya da PAR veya JAR kullanılmalıdır.", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.13", + "req_description": "\"Code\" grant türünün daima pushed authorization request (PAR) ile birlikte kullanıldığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.14", + "req_description": "AS'nin yalnızca sender-constrained (Proof-of-Possession) access token’lar ürettiği doğrulanmalıdır. Bu, mutual TLS ile certificate-bound access token ya da DPoP ile DPoP-bound access token olabilir.", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.15", + "req_description": "Sunucu taraflı istemciler için (kullanıcı cihazında çalışmayan), AS'nin \"authorization_details\" parametresinin istemci backend'i tarafından sağlandığını ve kullanıcı tarafından değiştirilmediğini doğruladığı, örneğin pushed authorization request (PAR) or JWT-secured Authorization Request (JAR) zorunlu kılınarak doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.16", + "req_description": "Bir istemci gizli ise, AS'nin güçlü istemci kimlik doğrulama yöntemlerini zorunlu kıldığı doğrulanmalıdır. Bu yöntemler, public-key cryptography’ye dayalı ve replay saldırılarına karşı dayanıklı olmalı, örneğin mutual TLS (\"tls_client_auth\", \"self_signed_tls_client_auth\") veya private key JWT (\"private_key_jwt\") gibi.", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.5", + "section_name": "OIDC İstemcisi", + "req_id": "V10.5.1", + "req_description": "İstemcinin (relying party olarak) ID Token replay saldırılarını azalttığı doğrulanmalıdır. Örneğin, ID Token’daki 'nonce' claim’inin, OpenID Provider’a gönderilen kimlik doğrulama isteğindeki 'nonce' değeriyle eşleştiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.5", + "section_name": "OIDC İstemcisi", + "req_id": "V10.5.2", + "req_description": "İstemcinin kullanıcıyı ID Token claim’lerinden (genellikle, başka kullanıcılarla yeniden atanamayan 'sub' claim’i) benzersiz şekilde tanımladığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.5", + "section_name": "OIDC İstemcisi", + "req_id": "V10.5.3", + "req_description": "İstemcinin, kötü niyetli bir AS'nin başka bir AS'yi taklit etmesini AS metadata’sı üzerinden reddettiği doğrulanmalıdır. AS metadata’sındaki issuer URL’si, istemci tarafından beklenen önceden yapılandırılmış issuer URL’siyle tam olarak eşleşmiyorsa, metadata reddedilmelidir.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.5", + "section_name": "OIDC İstemcisi", + "req_id": "V10.5.4", + "req_description": "İstemcinin, ID Token’ın kendisi için (audience) kullanılması amaçlandığını doğruladığı doğrulanmalıdır. Bu, token’daki 'aud' claim’inin istemcinin 'client_id' değeriyle eşit olup olmadığının kontrol edilmesiyle yapılır.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.5", + "section_name": "OIDC İstemcisi", + "req_id": "V10.5.5", + "req_description": "OIDC back-channel logout kullanıldığında, relying party’nin \"forced logout\" ve \"logout\" akışında \"cross-JWT confusion\" gibi saldırılara karşı koruma sağladığı doğrulanmalıdır. Client, logout token’ın 'logout+jwt' türünde olduğunu, 'event' claim’inin doğru üyeye sahip olduğunu ve 'nonce' claim’i içermediğini doğrulamalıdır. Ayrıca token için kısa bir sona erme süresi (örneğin 2 dakika) önerilir.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.6", + "section_name": "OpenID Provider", + "req_id": "V10.6.1", + "req_description": "OpenID Provider’ın yalnızca 'code', 'ciba', 'id_token' veya 'id_token code' response mode değerlerine izin verdiği doğrulanmalıdır. 'code' değeri, 'id_token code' (OIDC Hybrid flow) yerine tercih edilmelidir. 'token' (Implicit flow) kullanılmamalıdır.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.6", + "section_name": "OpenID Provider", + "req_id": "V10.6.2", + "req_description": "OpenID Provider’ın forced logout yoluyla yapılan hizmet reddi saldırılarını önlediği doğrulanmalıdır. Bu, son kullanıcıdan açık onay alınarak veya varsa logout isteğinde (relying party tarafından başlatılan) bulunan parametrelerin, örneğin 'id_token_hint', doğrulanmasıyla yapılabilir.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.7", + "section_name": "Onay (Consent) Yönetimi", + "req_id": "V10.7.1", + "req_description": "AS'nin her yetkilendirme isteği için kullanıcının onayını aldığı doğrulanmalıdır. İstemcinin kimliği garanti altına alınamıyorsa, AS daima kullanıcıdan açıkça onay istemelidir.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.7", + "section_name": "Onay (Consent) Yönetimi", + "req_id": "V10.7.2", + "req_description": "AS'nin kullanıcıdan onay istediğinde, neye onay verildiğini açık ve yeterli şekilde gösterdiği doğrulanmalıdır. Uygun olduğunda bu bilgiler, istenen yetkilendirmelerin doğasını (genellikle scope, resource server, RAR gibi detaylara dayalı), yetkilendirilmiş uygulamanın kimliğini ve bu yetkilendirmelerin süresini içermelidir.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.7", + "section_name": "Onay (Consent) Yönetimi", + "req_id": "V10.7.3", + "req_description": "Kullanıcının, AS üzerinden verdiği onayları görüntüleyebildiği, değiştirebildiği ve iptal edebildiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.1", + "section_name": "Kriptografik Envanter ve Dokümantasyon", + "req_id": "V11.1.1", + "req_description": "Kriptografik anahtarların yönetimi için belgelenmiş bir politika ve NIST SP 800-57 gibi bir anahtar yönetim standardını izleyen bir kriptografik anahtar yaşam döngüsü tanımlandığı doğrulanmalıdır. Bu, anahtarların aşırı miktarda paylaşılmadığını (örneğin, paylaşılan sırlar için ikiden fazla tarafla veya özel anahtarlar için birden fazla tarafla) garanti altına almalıdır.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.1", + "section_name": "Kriptografik Envanter ve Dokümantasyon", + "req_id": "V11.1.2", + "req_description": "Tüm kriptografik anahtarlar, algoritmalar ve uygulama tarafından kullanılan sertifikaları içeren bir kriptografik envanterin oluşturulduğu, sürdürüldüğü ve düzenli olarak güncellendiği doğrulanmalıdır. Bu envanter ayrıca, sistemde anahtarların nerede kullanılabileceğini ve kullanılamayacağını, ve hangi veri türlerinin bu anahtarlarla korunup korunamayacağını da belgelemelidir.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.1", + "section_name": "Kriptografik Envanter ve Dokümantasyon", + "req_id": "V11.1.3", + "req_description": "Sistem içerisinde şifreleme, özetleme ve imzalama işlemleri dahil olmak üzere kriptografi kullanımının tüm örneklerini tespit etmek için kriptografik keşif mekanizmalarının kullanıldığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.1", + "section_name": "Kriptografik Envanter ve Dokümantasyon", + "req_id": "V11.1.4", + "req_description": "Kriptografik bir envanterin sürdürüldüğü doğrulanmalıdır. Bu envanter, gelecekteki tehditlere karşı tepki verebilmek amacıyla post-kuantum kriptografiye geçiş yolunu belirten belgelenmiş bir plan içermelidir.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.2", + "section_name": "Güvenli Kriptografi Uygulaması", + "req_id": "V11.2.1", + "req_description": "Kriptografik işlemler için sektör tarafından doğrulanmış uygulamaların (kütüphaneler ve donanım hızlandırmalı uygulamalar dahil) kullanıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.2", + "section_name": "Güvenli Kriptografi Uygulaması", + "req_id": "V11.2.2", + "req_description": "Uygulamanın, rastgele sayı üreticileri, kimliği doğrulanmış şifreleme, MAC veya özetleme algoritmaları, anahtar uzunlukları, turlar, şifreler ve modların herhangi bir zamanda yeniden yapılandırılabilir, yükseltilebilir veya değiştirilebilir olacağı şekilde kripto çevikliği (crypto agility) ile tasarlandığı doğrulanmalıdır. Aynı şekilde, anahtarların ve parolaların değiştirilebilmesi ve verilerin yeniden şifrelenebilmesi mümkün olmalıdır. Bu, onaylanmış PQC şemalarının yüksek güvenlikli uygulamaları yaygın olarak kullanılabilir hale geldiğinde sorunsuz geçişe olanak tanır.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.2", + "section_name": "Güvenli Kriptografi Uygulaması", + "req_id": "V11.2.3", + "req_description": "Tüm kriptografik ilkeliklerin, algoritma, anahtar boyutu ve yapılandırmaya göre minimum 128 bit güvenlik sağladığı doğrulanmalıdır. Örneğin, 256-bit ECC anahtarı yaklaşık 128 bit güvenlik sağlarken, RSA için aynı güvenliği elde etmek 3072-bit anahtar gerektirir.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.2", + "section_name": "Güvenli Kriptografi Uygulaması", + "req_id": "V11.2.4", + "req_description": "Tüm kriptografik işlemlerin sabit süreli (constant-time) olduğu, karşılaştırmalarda, hesaplamalarda veya geri dönüşlerde kısa devre (short-circuit) işlemleri yapılmadığı doğrulanmalıdır; bu, bilgi sızıntısını önlemek için gereklidir.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.2", + "section_name": "Güvenli Kriptografi Uygulaması", + "req_id": "V11.2.5", + "req_description": "Tüm kriptografik modüllerin güvenli şekilde hata verdiği ve hataların, padding oracle saldırıları gibi zafiyetleri mümkün kılmayacak şekilde ele alındığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.3", + "section_name": "Şifreleme Algoritmaları", + "req_id": "V11.3.1", + "req_description": "Güvensiz blok modlarının (örneğin, ECB) ve zayıf doldurma (padding) şemalarının (örneğin, PKCS#1 v1.5) kullanılmadığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.3", + "section_name": "Şifreleme Algoritmaları", + "req_id": "V11.3.2", + "req_description": "Yalnızca AES ile GCM gibi onaylı şifreleme algoritmalarının ve modlarının kullanıldığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.3", + "section_name": "Şifreleme Algoritmaları", + "req_id": "V11.3.3", + "req_description": "Şifrelenmiş verilerin yetkisiz değişikliklere karşı korunduğu doğrulanmalıdır. Tercihen bu koruma, onaylı bir kimliği doğrulanmış şifreleme yöntemi kullanılarak ya da onaylı bir şifreleme yöntemi ile onaylı bir MAC algoritmasının kombinasyonu ile sağlanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.3", + "section_name": "Şifreleme Algoritmaları", + "req_id": "V11.3.4", + "req_description": "Sayılar, başlatma vektörleri (IV) ve diğer tek kullanımlık değerlerin, aynı şifreleme anahtarı ve veri öğesi çifti için birden fazla kez kullanılmadığı doğrulanmalıdır. Oluşturma yöntemi kullanılan algoritmaya uygun olmalıdır.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.3", + "section_name": "Şifreleme Algoritmaları", + "req_id": "V11.3.5", + "req_description": "Şifreleme algoritması ve MAC algoritması kombinasyonlarının \"encrypt-then-MAC\" modunda çalıştığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.4", + "section_name": "Hashing ve Hash Tabanlı Fonksiyonlar", + "req_id": "V11.4.1", + "req_description": "Dijital imzalar, HMAC, KDF ve rastgele bit üretimi gibi genel kriptografik kullanım senaryolarında yalnızca onaylı hash fonksiyonlarının kullanıldığı doğrulanmalıdır. MD5 gibi yasaklı hash fonksiyonları hiçbir kriptografik amaçla kullanılmamalıdır.", + "L": "1" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.4", + "section_name": "Hashing ve Hash Tabanlı Fonksiyonlar", + "req_id": "V11.4.2", + "req_description": "Parolaların, onaylı, hesaplama açısından yoğun ve mevcut rehberliğe göre yapılandırılmış bir anahtar türetme fonksiyonu (diğer adıyla parola hash'leme fonksiyonu) kullanılarak saklandığı doğrulanmalıdır. Ayarlar, güvenlik ve performans dengesini sağlayarak kaba kuvvet saldırılarını zorlaştırmalıdır.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.4", + "section_name": "Hashing ve Hash Tabanlı Fonksiyonlar", + "req_id": "V11.4.3", + "req_description": "Dijital imzalarda kullanılan hash fonksiyonlarının, veri bütünlüğü ve kimlik doğrulama amacıyla kullanıldığında çakışmaya karşı dayanıklı ve yeterli bit uzunluğuna sahip olduğu doğrulanmalıdır. Çakışma dayanıklılığı gerekiyorsa çıktı uzunluğu en az 256 bit olmalıdır. Sadece ikinci ön-görüntü (2nd pre-iamge) saldırılarına karşı dayanıklılık gerekiyorsa çıktı uzunluğu en az 128 bit olmalıdır.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.4", + "section_name": "Hashing ve Hash Tabanlı Fonksiyonlar", + "req_id": "V11.4.4", + "req_description": "Parolalardan gizli anahtarlar türetilirken, onaylı anahtar türetme fonksiyonlarının anahtar uzatma (key stretching) parametreleriyle birlikte kullanıldığı doğrulanmalıdır. Bu parametreler, kaba kuvvet saldırılarını önleyecek şekilde güvenlik ve performans dengesine sahip olmalıdır.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.5", + "section_name": "Rastgele Değerler", + "req_id": "V11.5.1", + "req_description": "Tahmin edilemez olması amaçlanan tüm rastgele sayıların ve dizelerin, CSPRNG ile oluşturulduğu ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. UUID'lerin bu koşulu dikkate almadığını unutmayın.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.5", + "section_name": "Rastgele Değerler", + "req_id": "V11.5.2", + "req_description": "Kullanılan rastgele sayı üretim mekanizmasının, yoğun talep altında dahi güvenli çalışacak şekilde tasarlandığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.6", + "section_name": "Açık Anahtar (Public Key) Kriptografisi", + "req_id": "V11.6.1", + "req_description": "Anahtar üretimi, tohumlama (seeding) ve dijital imza üretimi ve doğrulama için yalnızca onaylı kriptografik algoritmalar ve çalışma modlarının kullanıldığı doğrulanmalıdır. Anahtar üretim algoritmaları, bilinen saldırılara karşı savunmasız anahtarlar üretmemelidir. Örneğin, Fermat çarpanlama yöntemine karşı savunmasız RSA anahtarları oluşturulmamalıdır.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.6", + "section_name": "Açık Anahtar (Public Key) Kriptografisi", + "req_id": "V11.6.2", + "req_description": "Anahtar değişimi için yalnızca onaylı kriptografik algoritmaların kullanıldığı doğrulanmalıdır (örneğin Diffie-Hellman). Kullanılan parametrelerin güvenli olması gerektiğine dikkat edilmelidir. Bu, anahtar kurulum sürecine yönelik saldırıları önleyecek ve araya girme (adversary-in-the-middle) ya da kriptografik kırılmaları engelleyecektir.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.7", + "section_name": "Kullanım Halindeki Verilerin Kriptografisi", + "req_id": "V11.7.1", + "req_description": "Hassas verilerin kullanım sırasında korunmasını sağlamak amacıyla, yetkisiz kullanıcıların veya süreçlerin bu verilere erişmesini engelleyen tam bellek şifrelemesinin kullanıldığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.7", + "section_name": "Kullanım Halindeki Verilerin Kriptografisi", + "req_id": "V11.7.2", + "req_description": "Veri asgariyetinin sağlandığı, yani işleme sırasında mümkün olan en az miktarda verinin ortaya çıktığı ve verilerin kullanımdan hemen sonra veya mümkün olan en kısa sürede şifrelendiği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.1", + "section_name": "Genel TLS Güvenlik Rehberi", + "req_id": "V12.1.1", + "req_description": "Yalnızca TLS protokolünün en güncel ve önerilen sürümlerinin (örneğin TLS 1.2 ve TLS 1.3) etkinleştirildiği ve en son sürümün varsayılan olarak tercih edildiği doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.1", + "section_name": "Genel TLS Güvenlik Rehberi", + "req_id": "V12.1.2", + "req_description": "Yalnızca önerilen şifre takımlarının (cipher suite) etkinleştirildiği ve en güçlü şifre takımlarının tercih edildiği doğrulanmalıdır. Seviye 3 (L3) uygulamalar yalnızca ileri gizlilik (forward secrecy) sağlayan şifre takımlarını desteklemelidir.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.1", + "section_name": "Genel TLS Güvenlik Rehberi", + "req_id": "V12.1.3", + "req_description": "Uygulamanın, mTLS istemci sertifikalarını kimlik doğrulama veya yetkilendirme amacıyla kullanmadan önce bu sertifikaların güvendiği sertifikalar arasında olduğunu doğruladığı kontrol edilmelidir.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.1", + "section_name": "Genel TLS Güvenlik Rehberi", + "req_id": "V12.1.4", + "req_description": "Online Certificate Status Protocol (OCSP) Stapling gibi geçerli bir sertifika iptal kontrolü yönteminin etkinleştirildiği ve yapılandırıldığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.1", + "section_name": "Genel TLS Güvenlik Rehberi", + "req_id": "V12.1.5", + "req_description": "TLS el sıkışma (handshake) sürecinde Server Name Indication (SNI) gibi hassas meta verilerin ifşa edilmesini önlemek için, uygulamanın TLS yapılandırmasında Encrypted Client Hello (ECH) özelliğinin etkinleştirildiği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.2", + "section_name": "Dışa Açık Hizmetlerle HTTPS İletişimi", + "req_id": "V12.2.1", + "req_description": "İstemci ile dışa açık, HTTP tabanlı hizmetler arasındaki tüm bağlantılarda TLS kullanıldığı ve bu bağlantıların güvensiz ya da şifrelenmemiş iletişime geri dönmediği doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.2", + "section_name": "Dışa Açık Hizmetlerle HTTPS İletişimi", + "req_id": "V12.2.2", + "req_description": "Dışa açık hizmetlerin herkese açık olarak güvenilen TLS sertifikaları kullandığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.3", + "section_name": "Genel Servisler Arası İletişim Güvenliği", + "req_id": "V12.3.1", + "req_description": "Uygulamaya gelen ve uygulamadan çıkan tüm bağlantılarda izleme sistemleri, yönetim araçları, uzaktan erişim ve SSH, ara yazılımlar, veritabanları, ana sistemler (mainframe), iş ortağı sistemleri ya da dış API'ler dahil olmak üzere TLS gibi şifreli bir protokolün kullanıldığı ve güvensiz ya da şifrelenmemiş protokollere geri dönülmediği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.3", + "section_name": "Genel Servisler Arası İletişim Güvenliği", + "req_id": "V12.3.2", + "req_description": "TLS istemcilerinin bir TLS sunucusu ile iletişime geçmeden önce alınan sertifikaları doğruladığı kontrol edilmelidir.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.3", + "section_name": "Genel Servisler Arası İletişim Güvenliği", + "req_id": "V12.3.3", + "req_description": "Uygulama içindeki HTTP tabanlı iç hizmetler arasında gerçekleşen tüm bağlantılarda TLS ya da uygun başka bir aktarım şifreleme mekanizmasının kullanıldığı ve güvensiz ya da şifrelenmemiş iletişime geri dönülmediği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.3", + "section_name": "Genel Servisler Arası İletişim Güvenliği", + "req_id": "V12.3.4", + "req_description": "İç hizmetler arasındaki TLS bağlantılarında güvenilir sertifikaların kullanıldığı doğrulanmalıdır. İç sistemlerde oluşturulmuş ya da kendinden imzalı (self-signed) sertifikalar kullanılıyorsa, bu sertifikalara güvenen hizmetlerin yalnızca belirli dahili sertifika otoritelerine (CA) ve belirli kendinden imzalı sertifikalara güvenecek şekilde yapılandırıldıkları doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.3", + "section_name": "Genel Servisler Arası İletişim Güvenliği", + "req_id": "V12.3.5", + "req_description": "Sistem içindeki hizmetlerin birbiriyle iletişim kurarken her bir uç noktanın kimliğini doğrulamak için güçlü kimlik doğrulama yöntemlerinin kullanıldığı doğrulanmalıdır. Bu yöntemler arasında, açık anahtar altyapısı (public-key infrastructure) kullanan ve tekrar oynatma saldırılarına karşı dayanıklı olan TLS istemci kimlik doğrulaması gibi yöntemler yer almalıdır. Mikroservis mimarilerinde, sertifika yönetimini basitleştirmek ve güvenliği artırmak amacıyla bir servis ağı (service mesh) kullanılması değerlendirilmelidir.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.1", + "section_name": "Konfigürasyon Dokümantasyonu", + "req_id": "V13.1.1", + "req_description": "Uygulamanın tüm iletişim ihtiyaçlarının dokümante edildiği doğrulanmalıdır. Buna, uygulamanın bağımlı olduğu dış hizmetler ve son kullanıcının uygulamanın bağlantı kurmasını sağlayabileceği dış konumlar da dahil olmalıdır.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.1", + "section_name": "Konfigürasyon Dokümantasyonu", + "req_id": "V13.1.2", + "req_description": "Uygulamanın kullandığı her bir hizmet için, dokümantasyonda eşzamanlı bağlantı sayısı (örn. bağlantı havuzu limitleri) ve bu sınır aşıldığında uygulamanın davranışı, geri dönüş veya kurtarma mekanizmaları da dahil olmak üzere hizmet reddi koşullarını önlemek için tanımlandığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.1", + "section_name": "Konfigürasyon Dokümantasyonu", + "req_id": "V13.1.3", + "req_description": "Uygulamanın, kullandığı her bir dış sistem veya hizmet (örn. veritabanları, dosya tanıtıcıları, iş parçacıkları, HTTP bağlantıları) için kaynak yönetimi stratejilerini tanımladığı doğrulanmalıdır. Bu stratejiler, kaynak serbest bırakma prosedürlerini, zaman aşımı ayarlarını, hata durumlarını ve tekrar deneme mantığı uygulanmışsa sınırları, gecikmeleri ve geri çekilme (back-off) algoritmalarını içermelidir. Senkron HTTP istek–yanıt işlemleri için kısa zaman aşımı süreleri zorunlu tutulmalı ve tekrar eden denemeler devre dışı bırakılmalı ya da sıkı şekilde sınırlandırılmalıdır.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.1", + "section_name": "Konfigürasyon Dokümantasyonu", + "req_id": "V13.1.4", + "req_description": "Uygulamanın, güvenlik açısından kritik olan gizli verileri tanımladığı ve kuruluşun tehdit modeli ve iş ihtiyaçlarına göre bu verilerin döndürülme (rotation) zamanlamasının belgelendiği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.2", + "section_name": "Backend İletişim Konfigürasyonu", + "req_id": "V13.2.1", + "req_description": "Uygulamanın, standart kullanıcı oturum mekanizmasını desteklemeyen backend bileşenleri (örneğin API'ler, ara katmanlar, veri katmanları) arasında gerçekleşen iletişimlerin kimlik doğrulamasıyla korunduğu doğrulanmalıdır. Kimlik doğrulama; bireysel hizmet hesapları, kısa ömürlü token'lar ya da sertifika tabanlı kimlik doğrulama ile yapılmalıdır ve parola, API anahtarı ya da ayrıcalıklı erişime sahip paylaşımlı hesaplar gibi sabit kimlik bilgileri kullanılmamalıdır.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.2", + "section_name": "Backend İletişim Konfigürasyonu", + "req_id": "V13.2.2", + "req_description": "Uygulamanın backend bileşenleri arasında (yerel hizmetler, işletim sistemi hizmetleri, API'ler, ara katmanlar ve veri katmanları dahil) gerçekleştirilen iletişimlerin, yalnızca gerekli en az ayrıcalığa sahip hesaplarla yapıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.2", + "section_name": "Backend İletişim Konfigürasyonu", + "req_id": "V13.2.3", + "req_description": "Bir hizmet kimlik doğrulaması için bir kimlik bilgisi kullanılması gerekiyorsa, bu kimlik bilgisinin varsayılan bir değer (örneğin root/root veya admin/admin) olmadığının doğrulanması gereklidir.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.2", + "section_name": "Backend İletişim Konfigürasyonu", + "req_id": "V13.2.4", + "req_description": "Uygulamanın iletişim kurmasına izin verilen dış kaynaklar ya da sistemlerin, bir allowlist (izinli liste) ile tanımlandığı doğrulanmalıdır. Bu liste, uygulama katmanında, web sunucusunda, güvenlik duvarında veya farklı katmanların birleşiminde uygulanabilir.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.2", + "section_name": "Backend İletişim Konfigürasyonu", + "req_id": "V13.2.5", + "req_description": "Web veya uygulama sunucusunun, dış sistemlere veri veya dosya gönderimi veya yüklemesi yaparken sadece belirli kaynaklara izin verecek şekilde allowlist ile yapılandırıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.2", + "section_name": "Backend İletişim Konfigürasyonu", + "req_id": "V13.2.6", + "req_description": "Uygulamanın farklı hizmetlere bağlantı kurduğu durumlarda, bu bağlantılar için belgelenmiş yapılandırmaları (örn. maksimum eşzamanlı bağlantı, bağlantı limiti aşıldığında davranış, zaman aşımı, tekrar deneme stratejileri) takip ettiğinin doğrulanması gereklidir.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.3", + "section_name": "Gizli Bilgi Yönetimi", + "req_id": "V13.3.1", + "req_description": "Parolalar, anahtar materyalleri, veritabanı ve üçüncü parti sistemlerle entegrasyon bilgileri, zaman tabanlı token'lar için tohum (seed) bilgileri, dahili gizli veriler ve API anahtarları gibi backend sırlarının güvenli bir şekilde oluşturulması, saklanması, erişim denetiminin sağlanması ve imha edilmesi için bir gizli bilgi yönetim çözümünün (örneğin key vault) kullanıldığı doğrulanmalıdır. Bu gizli bilgiler uygulama kaynak koduna dahil edilmemeli ve yapı çıktılarında yer almamalıdır. Seviye 3 uygulamalar için donanım destekli bir çözüm (örneğin HSM) gereklidir.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.3", + "section_name": "Gizli Bilgi Yönetimi", + "req_id": "V13.3.2", + "req_description": "Gizli bilgilere erişimin en az ayrıcalık prensibine uygun şekilde yapılandırıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.3", + "section_name": "Gizli Bilgi Yönetimi", + "req_id": "V13.3.3", + "req_description": "Tüm kriptografik işlemlerin, anahtar materyallerinin güvenli bir şekilde yönetilmesi ve dışarıya sızmasının engellenmesi amacıyla, izole edilmiş bir güvenlik modülü (örneğin vault ya da donanım güvenlik modülü) aracılığıyla gerçekleştirildiği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.3", + "section_name": "Gizli Bilgi Yönetimi", + "req_id": "V13.3.4", + "req_description": "Uygulamanın belgelerinde belirtildiği şekilde gizli bilgilerin süresinin dolacak şekilde yapılandırıldığı ve düzenli olarak döndürüldüğü doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.4", + "section_name": "İstenmeyen Bilgi Sızıntısı", + "req_id": "V13.4.1", + "req_description": "Uygulamanın .git veya .svn klasörleri gibi kaynak kontrolüyle ilgili metadata içermeyecek şekilde deploy edildiğini ya da bu klasörlerin hem dış erişime hem de uygulama erişimine kapalı olduğu doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.4", + "section_name": "İstenmeyen Bilgi Sızıntısı", + "req_id": "V13.4.2", + "req_description": "Tüm bileşenler için üretim ortamlarında hata ayıklama (debug) modlarının devre dışı bırakıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.4", + "section_name": "İstenmeyen Bilgi Sızıntısı", + "req_id": "V13.4.3", + "req_description": "Web sunucularının, açık şekilde istenmediği sürece dizin listelemesi (directory listing) özelliğini istemcilere sunmadığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.4", + "section_name": "İstenmeyen Bilgi Sızıntısı", + "req_id": "V13.4.4", + "req_description": "HTTP TRACE metodunun üretim ortamlarında desteklenmediği, böylece potansiyel bilgi sızıntılarının önlendiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.4", + "section_name": "İstenmeyen Bilgi Sızıntısı", + "req_id": "V13.4.5", + "req_description": "Belgeler (örneğin dahili API belgeleri) ve izleme uç noktalarının (monitoring endpoints) yalnızca açıkça belirtildiği durumlarda erişilebilir olduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.4", + "section_name": "İstenmeyen Bilgi Sızıntısı", + "req_id": "V13.4.6", + "req_description": "Uygulamanın arka uç bileşenlerinin ayrıntılı sürüm bilgilerini ifşa etmediği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.4", + "section_name": "İstenmeyen Bilgi Sızıntısı", + "req_id": "V13.4.7", + "req_description": "Web katmanının yalnızca belirli dosya uzantılarına sahip dosyaları sunacak şekilde yapılandırıldığı, bu sayede istem dışı bilgi, yapılandırma ya da kaynak kod sızıntılarının önlendiği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.1", + "section_name": "Veri Koruma Dokümantasyonu", + "req_id": "V14.1.1", + "req_description": "Uygulama tarafından oluşturulan ve işlenen tüm hassas verilerin tanımlanıp, koruma seviyelerine göre sınıflandırıldığından emin olun. Bu, yalnızca kodlanmış (örneğin Base64 stringleri ya da JWT içindeki düz metin yükler gibi) ve bu nedenle kolayca çözülebilir verileri de içermelidir. Koruma seviyeleri, uygulamanın uymakla yükümlü olduğu veri koruma ve gizlilik düzenlemeleri ile standartlarını dikkate almalıdır.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.1", + "section_name": "Veri Koruma Dokümantasyonu", + "req_id": "V14.1.2", + "req_description": "Tüm hassas veri koruma seviyeleri için belgelenmiş bir koruma gereksinimleri seti tanımlandığından emin olun. Bu gereksinimler genel şifreleme, bütünlük doğrulama, saklama süresi, verinin nasıl günlüğe kaydedileceği, günlüklerdeki hassas verilere erişim kontrolleri, veritabanı düzeyinde şifreleme, gizlilik ve gizliliği artırıcı teknolojiler ile diğer gizlilik gereksinimlerini kapsamalıdır.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.2", + "section_name": "Genel Veri Koruması", + "req_id": "V14.2.1", + "req_description": "Hassas verilerin yalnızca HTTP message body veya header alanlarında sunucuya gönderildiği ve URL ile sorgu parametrelerinin, API anahtarı veya session token’ı gibi hassas bilgiler içermediği doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.2", + "section_name": "Genel Veri Koruması", + "req_id": "V14.2.2", + "req_description": "Hassas verilerin, yük dengeleyiciler ve uygulama önbellekleri gibi sunucu bileşenlerinde önbelleğe alınmasının engellendiği veya kullanım sonrası bu verilerin güvenli biçimde temizlendiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.2", + "section_name": "Genel Veri Koruması", + "req_id": "V14.2.3", + "req_description": "Uygulama kontrolü dışında veri toplanmasını engellemek için, tanımlanmış hassas verilerin, kullanıcı izleyicileri gibi güvensiz taraflara gönderilmediği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.2", + "section_name": "Genel Veri Koruması", + "req_id": "V14.2.4", + "req_description": "Hassas verilere yönelik şifreleme, bütünlük doğrulama, veri saklama, loglama yöntemi, loglardaki erişim kontrolleri, gizlilik teknolojileri gibi kontrollerin, söz konusu verinin belgelenmiş koruma seviyesinde tanımlandığı şekilde uygulandığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.2", + "section_name": "Genel Veri Koruması", + "req_id": "V14.2.5", + "req_description": "Önbellekleme mekanizmalarının yalnızca belirli içerik türüne sahip yanıtları önbelleğe alacak şekilde yapılandırıldığı ve hassas, dinamik içeriklerin önbelleğe alınmadığı doğrulanmalıdır. Web sunucusu, mevcut olmayan bir dosya talebinde geçerli ama farklı bir dosya döndürmek yerine 404 veya 302 cevabı vermelidir. Bu, Web Cache Deception saldırılarını önlemeye yardımcı olur.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.2", + "section_name": "Genel Veri Koruması", + "req_id": "V14.2.6", + "req_description": "Uygulamanın yalnızca işlevsellik için gerekli olan asgari hassas veriyi döndürdüğü doğrulanmalıdır. Örneğin, kredi kartı numarasının yalnızca bazı rakamlarının döndürülmesi; tam numaranın döndürülmesi gerekiyorsa, kullanıcı arayüzünde gizlenmiş (maskelenmiş) şekilde sunulması gerekir, aksi kullanıcı özel olarak görüntülemek istemedikçe gösterilmemelidir.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.2", + "section_name": "Genel Veri Koruması", + "req_id": "V14.2.7", + "req_description": "Hassas bilgilerin, veri saklama sınıflandırmasına tabi tutulduğu, geçerliliğini yitirmiş veya artık gerekli olmayan verilerin belirlenmiş bir zaman çizelgesiyle ya da gerektiğinde otomatik olarak silindiği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.2", + "section_name": "Genel Veri Koruması", + "req_id": "V14.2.8", + "req_description": "Kullanıcı tarafından yüklenen dosyaların meta verilerinden hassas bilgilerin çıkarıldığı veya bu bilgilerin yalnızca kullanıcıdan açık onay alındığında saklandığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.3", + "section_name": "İstemci Tarafı Veri Koruması", + "req_id": "V14.3.1", + "req_description": "Kimliği doğrulanmış verilerin, istemci veya oturum sonlandığında istemci depolamasından (örneğin tarayıcı DOM’undan) temizlendiği doğrulanmalıdır. 'Clear-Site-Data' HTTP response header bu konuda yardımcı olabilir ancak istemci tarafı, sunucu bağlantısı mevcut olmadığında da temizlik işlemini yapabiliyor olmalıdır.", + "L": "1" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.3", + "section_name": "İstemci Tarafı Veri Koruması", + "req_id": "V14.3.2", + "req_description": "Uygulamanın, tarayıcılarda hassas verilerin önbelleğe alınmasını önlemek amacıyla yeterli anti-önbellekleme HTTP response header (örneğin Cache-Control: no-store) ayarladığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.3", + "section_name": "İstemci Tarafı Veri Koruması", + "req_id": "V14.3.3", + "req_description": "Tarayıcıda depolanan verilerin (örneğin localStorage, sessionStorage, IndexedDB veya çerezler) hassas veri içermediği, yalnızca session token’larının istisna olarak kabul edildiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.1", + "section_name": "Güvenli Kodlama ve Mimari Dokümantasyonu", + "req_id": "V15.1.1", + "req_description": "Güvenlik açığı içeren üçüncü taraf bileşen sürümleri ve genel olarak kütüphane güncellemeleri için, uygulama dokümantasyonunda risk bazlı düzeltme zamanlarının tanımlandığı doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.1", + "section_name": "Güvenli Kodlama ve Mimari Dokümantasyonu", + "req_id": "V15.1.2", + "req_description": "Yazılım bileşen listesi (Software Bill of Materials - SBOM) gibi bir envanterin tutulduğu, kullanılan tüm üçüncü taraf kütüphanelerin önceden tanımlanmış, güvenilir ve düzenli olarak güncellenen depolardan alındığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.1", + "section_name": "Güvenli Kodlama ve Mimari Dokümantasyonu", + "req_id": "V15.1.3", + "req_description": "Uygulama dokümantasyonunda zaman veya kaynak açısından yoğun işlevlerin tanımlandığı, bu işlevlerin aşırı kullanımı durumunda kullanılabilirlik kaybının nasıl önleneceği ve yanıt oluşturma süresinin istemci zaman aşımını aşmaması için hangi önlemlerin alındığı belirtilmelidir. Örnek savunmalar kuyruklama, eşzamansız işleme, kullanıcı başına ve uygulama genelinde paralel işlem sınırlarını içerebilir.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.1", + "section_name": "Güvenli Kodlama ve Mimari Dokümantasyonu", + "req_id": "V15.1.4", + "req_description": "Uygulama dokümantasyonunda \"riskli bileşenler\" olarak değerlendirilen üçüncü taraf kütüphanelerin vurgulandığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.1", + "section_name": "Güvenli Kodlama ve Mimari Dokümantasyonu", + "req_id": "V15.1.5", + "req_description": "Uygulama dokümantasyonunda \"tehlikeli işlevsellik\" içeren uygulama bölümlerinin açıkça belirtildiği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.2", + "section_name": "Güvenlik Mimarisi ve Bağımlılıklar", + "req_id": "V15.2.1", + "req_description": "Uygulamanın yalnızca, belgelenmiş güncelleme ve düzeltme sürelerini aşmamış bileşenleri içerdiği doğrulanmalıdır.", + "L": "1" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.2", + "section_name": "Güvenlik Mimarisi ve Bağımlılıklar", + "req_id": "V15.2.2", + "req_description": "Uygulamanın, belgelenmiş güvenlik kararları ve stratejilere dayanarak, zaman veya kaynak açısından yoğun işlevlerin neden olabileceği kullanılabilirlik kaybına karşı savunmalar uyguladığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.2", + "section_name": "Güvenlik Mimarisi ve Bağımlılıklar", + "req_id": "V15.2.3", + "req_description": "Üretim ortamının yalnızca uygulamanın çalışması için gerekli işlevleri içerdiği ve test kodları, örnek kod parçaları veya geliştirme işlevleri gibi gereksiz işlevsellikleri açığa çıkarmadığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.2", + "section_name": "Güvenlik Mimarisi ve Bağımlılıklar", + "req_id": "V15.2.4", + "req_description": "Üçüncü taraf bileşenlerin ve bunların tüm transitif bağımlılıklarının beklenen depolardan (iç kaynaklı ya da harici) alındığı ve bağımlılık karışıklığı (dependency confusion) saldırılarına açık olmadığı doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.2", + "section_name": "Güvenlik Mimarisi ve Bağımlılıklar", + "req_id": "V15.2.5", + "req_description": "Uygulamanın, “tehlikeli işlevsellik” içeren veya “riskli bileşenler” kullanan bölümlerine ek korumalar uyguladığı doğrulanmalıdır. Bu korumalar sandbox, kapsülleme, konteynerleştirme veya ağ düzeyinde izolasyon gibi teknikler aracılığıyla, bir uygulama bölümünün ele geçirilmesi durumunda saldırganın diğer bölümlere sıçramasını geciktirmeyi veya engellemeyi amaçlamalıdır.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.3", + "section_name": "Savunmacı Kodlama", + "req_id": "V15.3.1", + "req_description": "Uygulamanın yalnızca gerekli alanların bir alt kümesini veri nesnesinden döndürdüğü doğrulanmalıdır. Örneğin, bazı alanlara kullanıcıların erişmemesi gerektiğinden tüm veri nesnesi döndürülmemelidir.", + "L": "1" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.3", + "section_name": "Savunmacı Kodlama", + "req_id": "V15.3.2", + "req_description": "Uygulama backend'i harici URL’lere çağrı yaptığında, yalnızca amaçlanan işlevsellik söz konusuysa yönlendirmeleri takip edecek şekilde yapılandırıldığının doğrulanması gerekir.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.3", + "section_name": "Savunmacı Kodlama", + "req_id": "V15.3.3", + "req_description": "Uygulamanın, kitlesel atama saldırılarına karşı, her bir controller ve eylem için izin verilen alanları sınırlandırarak savunmalar sağladığı doğrulanmalıdır. Örneğin, bir alan değeri, bu işlemde değiştirilmesi amaçlanmadıysa eklenememeli veya güncellenememelidir.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.3", + "section_name": "Savunmacı Kodlama", + "req_id": "V15.3.4", + "req_description": "Tüm proxy ve ara katman bileşenlerinin kullanıcının orijinal IP adresini, uç kullanıcı tarafından değiştirilemeyecek güvenilir veri alanları kullanarak doğru şekilde ilettiği ve uygulamanın ve web sunucusunun bu doğru değeri, loglama ve hız sınırlama gibi güvenlik kararları için kullandığı doğrulanmalıdır. Ayrıca, orijinal IP adresinin bile dinamik IP'ler, VPN'ler veya kurumsal güvenlik duvarları nedeniyle güvenilir olmayabileceği dikkate alınmalıdır.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.3", + "section_name": "Savunmacı Kodlama", + "req_id": "V15.3.5", + "req_description": "Uygulamanın değişkenlerin doğru türde olduğunu açıkça doğruladığı ve sıkı eşitlik ve karşılaştırma işlemleri kullandığı doğrulanmalıdır. Bu, değişken türüyle ilgili varsayımlardan kaynaklanan tür oynama (type juggling) veya tür karışıklığı (type confusion) güvenlik açıklarını önlemek içindir.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.3", + "section_name": "Savunmacı Kodlama", + "req_id": "V15.3.6", + "req_description": "JavaScript kodunun prototip zehirleme (prototype pollution) saldırılarını önleyecek şekilde yazıldığı, örneğin, nesne literal’leri yerine Set() veya Map() gibi yapılar kullanıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.3", + "section_name": "Savunmacı Kodlama", + "req_id": "V15.3.7", + "req_description": "Uygulamanın, özellikle framework'ün istek parametrelerinin kaynağı (sorgu dizgisi, gövde parametreleri, çerezler veya başlık alanları) arasında ayrım yapmadığı durumlarda, HTTP parametre kirliliği (HTTP parameter pollution) saldırılarına karşı savunmalar uyguladığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.4", + "section_name": "Güvenli Eş Zamanlılık (Concurrency)", + "req_id": "V15.4.1", + "req_description": "Çok iş parçacıklı kodda (örneğin cache'ler, dosyalar veya birden fazla iş parçacığı tarafından erişilen bellek içi nesneler gibi) paylaşılan nesnelere yalnızca thread-safe (iş parçacığı güvenli) türler ve kilitleme (lock) veya semaphore gibi senkronizasyon mekanizmaları kullanılarak erişildiği doğrulanmalıdır. Bu, yarış durumlarını ve veri bozulmasını önlemeye yöneliktir.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.4", + "section_name": "Güvenli Eş Zamanlılık (Concurrency)", + "req_id": "V15.4.2", + "req_description": "Bir kaynağın durumu üzerindeki kontroller (örneğin varlığı ya da izinleri gibi) ile bu kontrole bağlı eylemlerin tek bir atomik işlem olarak gerçekleştirildiği doğrulanmalıdır. Bu, TOCTOU (time-of-check to time-of-use) yarış durumlarını önlemeye yöneliktir. Bir dosyanın varlığının kontrol edilip ardından açılması veya bir kullanıcının erişiminin doğrulanıp ardından yetki verilmesi gibi işlemler buna örnektir.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.4", + "section_name": "Güvenli Eş Zamanlılık (Concurrency)", + "req_id": "V15.4.3", + "req_description": "Kilitlerin (locks) tutarlı biçimde kullanıldığı, iş parçacıklarının birbirini beklemesi ya da sonsuz döngüye girmesi (deadlock veya livelock) gibi durumların önlendiği doğrulanmalıdır. Ayrıca, kilitleme mantığı, kaynağı yöneten kod içinde kalmalı ve dış sınıflar veya dış kodlar tarafından istemeden veya kötü niyetli şekilde değiştirilememelidir.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.4", + "section_name": "Güvenli Eş Zamanlılık (Concurrency)", + "req_id": "V15.4.4", + "req_description": "Kaynak tahsis politikalarının, iş parçacığı açlığını önleyecek şekilde, kaynaklara adil erişimi sağladığı doğrulanmalıdır. Örneğin, thread pool (iş parçacığı havuzu) kullanımı, düşük öncelikli iş parçacıklarının da makul sürelerde çalışabilmesi için uygulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.1", + "section_name": "Güvenlik Loglaması Dokümantasyonu", + "req_id": "V16.1.1", + "req_description": "Uygulamanın teknoloji yığını boyunca her katmanda hangi olayların loglandığını, log formatlarını, logların nereye yazıldığını, nasıl kullanıldığını, erişimin nasıl kontrol edildiğini ve logların ne kadar süre saklandığını belgeleyen bir envanterin mevcut olduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.2", + "section_name": "Genel Loglama", + "req_id": "V16.2.1", + "req_description": "Her bir log girdisinin, olayın ne zaman, nerede, kim tarafından ve ne olduğuna dair detaylı bir zaman çizelgesi oluşturulmasına olanak tanıyacak gerekli meta verileri içerdiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.2", + "section_name": "Genel Loglama", + "req_id": "V16.2.2", + "req_description": "Tüm loglama bileşenlerinin zaman kaynaklarının senkronize olduğu ve güvenlik olayı meta verisindeki zaman damgalarının UTC kullanarak ya da açık zaman dilimi ofsetiyle belirtildiği doğrulanmalıdır. UTC kullanımı, özellikle yaz saati uygulamaları nedeniyle oluşabilecek karışıklıkları önlemek için tavsiye edilir.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.2", + "section_name": "Genel Loglama", + "req_id": "V16.2.3", + "req_description": "Uygulamanın yalnızca log envanterinde belgelenmiş dosya ve hizmetlere log yazdığı ya da ilettiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.2", + "section_name": "Genel Loglama", + "req_id": "V16.2.4", + "req_description": "Logların kullanılan log işleyici (log processor) tarafından okunabildiği ve ilişkilendirilebildiği doğrulanmalıdır. Tercihen yaygın bir log formatı kullanılmalıdır.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.2", + "section_name": "Genel Loglama", + "req_id": "V16.2.5", + "req_description": "Hassas veriler loglanırken, uygulamanın veri koruma seviyesine uygun olarak loglama yaptığı doğrulanmalıdır. Örneğin kimlik bilgileri veya ödeme detayları gibi bazı verilerin loglanmasına izin verilmemelidir. Session token’ları gibi veriler ise yalnızca tamamen ya da kısmen maskelenmiş ya da hash’lenmiş olarak loglanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.3", + "section_name": "Güvenlik Olayları", + "req_id": "V16.3.1", + "req_description": "Tüm kimlik doğrulama işlemlerinin (başarılı ve başarısız girişimler dahil) loglandığı doğrulanmalıdır. Kullanılan kimlik doğrulama türü veya faktörleri gibi ek meta veriler de toplanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.3", + "section_name": "Güvenlik Olayları", + "req_id": "V16.3.2", + "req_description": "Başarısız yetkilendirme girişimlerinin loglandığı doğrulanmalıdır. Seviye 3 uygulamalar için, tüm yetkilendirme kararlarının ve hassas verilere erişim olaylarının (verinin kendisi olmadan) loglandığı da doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.3", + "section_name": "Güvenlik Olayları", + "req_id": "V16.3.3", + "req_description": "Uygulamanın, belgelenmiş güvenlik olaylarını ve güvenlik kontrollerini aşma girişimlerini (girdi doğrulama, iş mantığı, otomasyon karşıtı kontroller vb.) logladığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.3", + "section_name": "Güvenlik Olayları", + "req_id": "V16.3.4", + "req_description": "Beklenmeyen hatalar ve güvenlik kontrolü başarısızlıkları (örneğin backend TLS hataları gibi) loglandığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.4", + "section_name": "Log Koruması", + "req_id": "V16.4.1", + "req_description": "Tüm loglama bileşenlerinin, log enjeksiyonunu (log injection) önlemek amacıyla verileri uygun biçimde encode ettiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.4", + "section_name": "Log Koruması", + "req_id": "V16.4.2", + "req_description": "Logların yetkisiz erişime karşı korunduğu ve değiştirilemez olduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.4", + "section_name": "Log Koruması", + "req_id": "V16.4.3", + "req_description": "Logların analiz, tespit, uyarı ve yükseltme amacıyla mantıksal olarak ayrı bir sisteme güvenli biçimde iletildiği doğrulanmalıdır. Böylece uygulama ihlal edilse bile logların tehlikeye girmesi önlenmiş olur.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.5", + "section_name": "Hata Yönetimi", + "req_id": "V16.5.1", + "req_description": "Beklenmedik ya da güvenlikle ilgili bir hata oluştuğunda, tüketiciye genel bir mesaj döndürüldüğü ve yığın izleri (stack trace), sorgular, gizli anahtarlar, token’lar gibi hassas sistem içi verilerin açıklanmadığı doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.5", + "section_name": "Hata Yönetimi", + "req_id": "V16.5.2", + "req_description": "Uygulamanın, dış kaynaklara erişim başarısız olduğunda bile güvenli şekilde çalışmaya devam ettiği doğrulanmalıdır. Örneğin, circuit breaker ya da graceful degradation gibi desenler kullanılmalıdır.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.5", + "section_name": "Hata Yönetimi", + "req_id": "V16.5.3", + "req_description": "Uygulamanın hata durumlarında güvenli ve düzenli şekilde başarısız olduğu doğrulanmalıdır. Bu, örneğin doğrulama hatalarına rağmen işlemlerin işlenmesine yol açabilecek fail-open durumlarını önlemelidir.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.5", + "section_name": "Hata Yönetimi", + "req_id": "V16.5.4", + "req_description": "Ele alınmamış tüm istisnaları yakalayacak şekilde tanımlanmış bir “son çare hata yöneticisi” bulunduğu doğrulanmalıdır. Bu, hem loglara gitmesi gereken hata detaylarının kaybolmaması hem de tüm uygulama sürecinin çökerek hizmet dışı kalmasının önlenmesi açısından önemlidir.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.1", + "section_name": "TURN Sunucusu", + "req_id": "V17.1.1", + "req_description": "TURN hizmetinin yalnızca özel amaçlar için ayrılmamış IP adreslerine (ör. iç ağlar, yayın adresleri, loopback) erişime izin verdiği doğrulanmalıdır. Bu gereksinim hem IPv4 hem de IPv6 adresleri için geçerlidir.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.1", + "section_name": "TURN Sunucusu", + "req_id": "V17.1.2", + "req_description": "TURN hizmetinin, meşru kullanıcıların sunucuda çok sayıda bağlantı noktası açmaya çalışması durumunda kaynak tüketimi saldırılarına karşı dayanıklı olduğu doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Medya", + "req_id": "V17.2.1", + "req_description": "DTLS sertifikası anahtarının, belgelenmiş kriptografik anahtar yönetim politikasına uygun şekilde yönetildiği ve korunduğu doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Medya", + "req_id": "V17.2.2", + "req_description": "Medya sunucusunun onaylı DTLS şifre takımlarını (cipher suites) ve Güvenli Gerçek Zamanlı Aktarım Protokolü (Secure Real-time Transport Protocol - SRTP) için anahtarlar oluşturmaya yönelik DTLS Uzantısı için güvenli bir koruma profilini kullanacak ve destekleyecek şekilde yapılandırıldığı (DTLS-SRTP) doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Medya", + "req_id": "V17.2.3", + "req_description": "Real-time Transport Protocol (RTP) injection saldırılarının bir hizmet reddi durumuna veya medya akışlarına ses veya video medyası eklenmesine yol açmasını önlemek için medya sunucusunda Güvenli SRTP kimlik doğrulamasının kontrol edildiği doğrulanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Medya", + "req_id": "V17.2.4", + "req_description": "Verify that the media server is able to continue processing incoming media traffic when encountering malformed Secure Real-time Transport Protocol (SRTP) packets.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Medya", + "req_id": "V17.2.5", + "req_description": "Medya sunucusunun, meşru kullanıcılardan gelen SRTP flood'ı sırasında gelen medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Medya", + "req_id": "V17.2.6", + "req_description": "Medya sunucusunun DTLS içinde yer alan \"ClientHello\" yarış durumu güvenlik açığına karşı savunmasız olmadığı, medya sunucusunun güvenlik açığına sahip olduğunun açıkça bilinip bilinmediği kontrol edilerek veya yarış koşulu testi gerçekleştirilerek doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Medya", + "req_id": "V17.2.7", + "req_description": "Medya sunucusuna bağlı ses veya video kayıt mekanizmalarının, meşru kullanıcı kaynaklı SRTP flood'ı sırasında medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Medya", + "req_id": "V17.2.8", + "req_description": "DTLS sertifikasının, SDP (Session Description Protocol) fingerprint özelliği ile karşılaştırıldığı ve doğrulama başarısız olursa medya akışının sonlandırıldığı, medya akışının özgünlüğünü sağlamak için doğrulanmalıdır.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.3", + "section_name": "Sinyalizasyon", + "req_id": "V17.3.1", + "req_description": "Sinyalizasyon sunucusunun, flood saldırısı altında bile meşru sinyalizasyon mesajlarını işlemeye devam edebildiği doğrulanmalıdır. Bu, sinyalizasyon düzeyinde oran sınırlaması uygulanarak sağlanmalıdır.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.3", + "section_name": "Sinyalizasyon", + "req_id": "V17.3.2", + "req_description": "Sinyalizasyon sunucusunun, hizmet reddine yol açabilecek şekilde yapılandırılmış bozuk sinyalizasyon mesajlarıyla karşılaştığında bile meşru mesajları işlemeye devam edebildiği doğrulanmalıdır. Bu, girdi doğrulaması, integer overflow ve buffer overflow'a karşı savunma ve sağlam hata işleme teknikleri ile sağlanmalıdır.", + "L": "2" + } + ] +} diff --git a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.flat.legacy.json b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.flat.legacy.json new file mode 100644 index 0000000000..500f60643c --- /dev/null +++ b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.flat.legacy.json @@ -0,0 +1,4437 @@ +{ + "requirements": [ + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.1", + "section_name": "Kodlama ve Temizleme Mimarisi", + "req_id": "V1.1.1", + "req_description": "Girdinin yalnızca bir kez kanonik forma (canonical form) çözümlendiği veya kaçış işlemlerinin kaldırıldığı, bu işlemin yalnızca verinin bu biçimde beklenmesi durumunda yapıldığı ve bu işlemin girdi doğrulama veya temizleme işlemlerinden sonra değil, önce gerçekleştiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.1", + "section_name": "Kodlama ve Temizleme Mimarisi", + "req_id": "V1.1.2", + "req_description": "Uygulamanın, çıktıyı kullanılması gereken yorumlayıcıya verilmeden hemen önce veya yorumlayıcının kendisi tarafından çıktı kodlaması ya da kaçış işlemi yaptığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.1", + "req_description": "HTTP yanıtı, HTML veya XML belgesi için yapılan çıktı kodlamasının; HTML elemanları, HTML öznitelikleri, HTML yorumları, CSS ya da HTTP başlık alanları gibi bağlamlara uygun olduğu doğrulanmalıdır. Böylece mesaj veya belge yapısının bozulması önlenir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.2", + "req_description": "Dinamik olarak URL oluşturulurken, güvenilmeyen verinin bağlamına göre (örneğin, sorgu veya yol parametreleri için URL kodlaması ya da base64url kodlaması) kodlandığı doğrulanmalıdır. Yalnızca güvenli URL protokollerine izin verilmelidir (örneğin, javascript: veya data: yasaklanmalıdır).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.3", + "req_description": "JavaScript içeriği (JSON dahil) dinamik olarak oluşturulurken çıktı kodlama/kaçış kullanıldığı doğrulanmalıdır. Böylece mesaj veya belge yapısı değiştirilmemiş olur (JavaScript ve JSON enjeksiyonlarının önüne geçilir).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.4", + "req_description": "Veri sorguları veya veritabanı sorguları (SQL, HQL, NoSQL, Cypher vb.) için parametreli sorgular, ORM’ler, entity framework’ler kullanıldığı ya da SQL enjeksiyonu ve diğer veritabanı enjeksiyon saldırılarına karşı koruma sağlandığı doğrulanmalıdır. Bu durum, saklı yordam (stored procedure) yazarken de geçerlidir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.5", + "req_description": "Uygulamanın işletim sistemi komut enjeksiyonlarına karşı korunduğu ve işletim sistemi çağrılarında parametreli OS sorguları veya bağlama özgü komut satırı çıktı kodlamasının kullanıldığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.6", + "req_description": "Uygulamanın LDAP enjeksiyon zafiyetlerine karşı korunduğu ya da LDAP enjeksiyonlarını önlemek için özel güvenlik kontrollerinin uygulandığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.7", + "req_description": "XPath enjeksiyon saldırılarına karşı, sorgu parametrelemesi veya önceden derlenmiş sorgular kullanılarak koruma sağlandığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.8", + "req_description": "LaTeX işlemcilerinin güvenli şekilde yapılandırıldığı (örneğin, --shell-escape bayrağının kullanılmadığı) ve yalnızca izin verilen komutlardan oluşan bir listeyle çalıştırıldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.9", + "req_description": "Düzenli ifadelerde (regex) özel karakterlerin (genellikle ters eğik çizgi \\ ile) kaçırılarak meta karakter olarak yorumlanmalarının önlendiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.2", + "section_name": "Enjeksiyon Önleme", + "req_id": "V1.2.10", + "req_description": "Uygulamanın CSV ve formül enjeksiyonlarına karşı korunduğu doğrulanmalıdır. Uygulama, CSV içeriği dışa aktarırken RFC 4180 Bölüm 2.6 ve 2.7'de tanımlanan kaçış kurallarına uymalıdır. Ayrıca, CSV veya diğer tablo formatlarına (XLS, XLSX, ODF gibi) aktarım yapılırken, alanın ilk karakteri olarak çıkan özel karakterler ('=', '+', '-', '@', '\\t' (sekme), '\\0' (null karakter)) tek tırnak (') ile kaçırılmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.1", + "req_description": "WYSIWYG editörlerinden veya benzer kaynaklardan gelen tüm güvenilmeyen HTML girdilerinin, bilinen ve güvenli bir HTML temizleme kütüphanesi ya da çerçeve özelliği ile temizlendiği doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.2", + "req_description": "Uygulamanın eval() veya Spring Expression Language (SpEL) gibi dinamik kod çalıştırma özelliklerini kullanmaktan kaçındığı doğrulanmalıdır. Alternatif yoksa, kullanıcı girdisi çalıştırılmadan önce mutlaka temizlenmelidir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.3", + "req_description": "Potansiyel olarak tehlikeli bir bağlamda kullanılacak verilerin, bu bağlama uygun karakterlere izin vermek ve çok uzun girdileri kısaltmak gibi güvenlik önlemleriyle önceden temizlendiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.4", + "req_description": "Kullanıcı tarafından sağlanan SVG içeriğinin, yalnızca güvenli etiket ve özellikler (örneğin grafik çizme ile ilgili) içerdiğinden emin olmak için onaylandığı veya temizlendiği doğrulanmalıdır (ör. script veya foreignObject içermemelidir).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.5", + "req_description": "Markdown, CSS, XSL stil sayfaları, BBCode veya benzeri ifade şablon dillerinde kullanıcı girdisinin temizlendiği veya bu tür özelliklerin devre dışı bırakıldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.6", + "req_description": "Uygulamanın, güvenilmeyen verileri başka servislere iletmeden önce izinli protokol, alan adı, yol ve port listelerine göre doğruladığı ve tehlikeli karakterleri temizlediği doğrulanarak SSRF (Sunucu Taraflı İstek Sahteciliği) saldırılarına karşı korunduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.7", + "req_description": "Uygulamanın şablon enjeksiyon saldırılarına karşı, güvenilmeyen girdilere dayalı şablon oluşturmayı engellediği; eğer bu kaçınılmazsa, bu girdilerin mutlaka temizlendiği veya sıkı şekilde onaylandığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.8", + "req_description": "JNDI sorgularında kullanılmadan önce güvenilmeyen girdilerin temizlendiği ve JNDI'nin enjeksiyonlara karşı güvenli şekilde yapılandırıldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.9", + "req_description": "Memcache’e gönderilmeden önce içeriğin temizlenerek enjeksiyon saldırılarına karşı korunduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.10", + "req_description": "Format dizgilerinin (format strings) beklenmeyen veya zararlı şekilde çözümlenmesini önlemek için işlenmeden önce temizlendiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.11", + "req_description": "SMTP veya IMAP enjeksiyonlarını önlemek için, kullanıcı girdisinin posta sistemlerine iletilmeden önce temizlendiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.3", + "section_name": "Temizleme (Sanitization)", + "req_id": "V1.3.12", + "req_description": "Regex girdilerinin üstel geri izlemeye (exponential backtracking) neden olan öğeler içermediği ve güvenilmeyen girdilerin ReDoS (Regex Denial of Service) gibi saldırılara karşı temizlendiği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.4", + "section_name": "Bellek, Dizgi ve Yönetilmeyen Kod", + "req_id": "V1.4.1", + "req_description": "Yığın, arabellek (buffer) veya yığın belleği taşmalarını önlemek ya da tespit etmek amacıyla, bellek güvenli dizgi işlemlerinin, daha güvenli bellek kopyalama ve işaretçi aritmetiğinin kullanıldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.4", + "section_name": "Bellek, Dizgi ve Yönetilmeyen Kod", + "req_id": "V1.4.2", + "req_description": "Tamsayı taşmalarını önlemek için işaret (sign), aralık (range) ve giriş doğrulama tekniklerinin kullanıldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.4", + "section_name": "Bellek, Dizgi ve Yönetilmeyen Kod", + "req_id": "V1.4.3", + "req_description": "Dinamik olarak ayrılan belleğin ve kaynakların serbest bırakıldığı ve boşaltılan belleklere ait referansların veya işaretçilerin kaldırıldığı veya null yapıldığı doğrulanmalıdır (dangling pointer ve use-after-free zafiyetlerine karşı).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.5", + "section_name": "Güvenli Ters Serileştirme (Safe Deserialization)", + "req_id": "V1.5.1", + "req_description": "XML ayrıştırıcılarının (parser) kısıtlayıcı şekilde yapılandırıldığı ve dış varlık çözümleme (external entity resolution) gibi güvensiz özelliklerin XXE (XML eXternal Entity) saldırılarına karşı devre dışı bırakıldığı doğrulanmalıdır .", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.5", + "section_name": "Güvenli Ters Serileştirme (Safe Deserialization)", + "req_id": "V1.5.2", + "req_description": "Güvenilmeyen verilerin ters serileştirilmesinde, nesne türleri için izinli liste kullanımı veya istemci tanımlı nesne türlerinin kısıtlanması gibi güvenli giriş işleme önlemlerinin uygulandığı doğrulanmalıdır. Güvensiz olarak tanımlanmış ters serileştirme mekanizmaları, güvenilmeyen girdilerle kullanılmamalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Kodlama (Encoding) ve Temizleme", + "section_id": "V1.5", + "section_name": "Güvenli Ters Serileştirme (Safe Deserialization)", + "req_id": "V1.5.3", + "req_description": "Aynı veri türü için uygulamada kullanılan farklı parser'ların (ör. JSON, XML, URL parser'ları), veriyi tutarlı şekilde ayrıştırdığı ve aynı karakter kodlamasını kullandığı doğrulanmalıdır. Böylece JSON birlikte çalışabilirlik açıkları, URI veya dosya ayrıştırma farkları gibi sorunlar nedeniyle RFI veya SSRF saldırılarının istismar edilmesi önlenir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.1", + "section_name": "Doğrulama ve İş Mantığı Dokümantasyonu", + "req_id": "V2.1.1", + "req_description": "Uygulama dokümantasyonunda, veri öğelerinin beklenen yapıya göre nasıl doğrulanacağına ilişkin giriş doğrulama kurallarının tanımlandığı doğrulanmalıdır. Bu; kredi kartı numaraları, e-posta adresleri, telefon numaraları gibi yaygın veri biçimleri olabileceği gibi iç sistemlere özel biçimler de olabilir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.1", + "section_name": "Doğrulama ve İş Mantığı Dokümantasyonu", + "req_id": "V2.1.2", + "req_description": "Uygulama dokümantasyonunda, birleştirilmiş veri öğelerinin mantıksal ve bağlamsal tutarlılığının nasıl doğrulanacağı tanımlanmalıdır (örneğin, mahalle ve posta kodunun eşleşip eşleşmediğinin kontrolü).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.1", + "section_name": "Doğrulama ve İş Mantığı Dokümantasyonu", + "req_id": "V2.1.3", + "req_description": "Hem kullanıcı bazında hem de uygulama genelinde geçerli olacak şekilde, iş mantığı sınırları ve doğrulama beklentilerinin belgelendiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.2", + "section_name": "Girdi Doğrulama", + "req_id": "V2.2.1", + "req_description": "Girdilerin, işlevsel ya da iş gereksinimlerine uygunluğunun doğrulandığı teyit edilmelidir. Bu işlem; izinli değerler, desenler ve aralıklar listesine karşı pozitif doğrulama ile ya da girdinin beklenen yapıya ve mantıksal sınırlara uygunluğunun önceden tanımlanmış kurallara göre karşılaştırılması ile yapılmalıdır. Seviye 1 için bu, güvenlik veya iş kararlarında kullanılan girdilere odaklanabilir. Seviye 2 ve üstü için tüm girdilere uygulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.2", + "section_name": "Girdi Doğrulama", + "req_id": "V2.2.2", + "req_description": "Uygulamanın, güvenilir bir servis katmanında girdi doğrulama zorunluluğu uygulayacak şekilde tasarlandığı doğrulanmalıdır. İstemci tarafında gerçekleştirilen doğrulama, kullanılabilirliği artırabilir ve teşvik edilmelidir. Ancak bu doğrulama,güvenlik kontrolü olarak kabul edilmemelidir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.2", + "section_name": "Girdi Doğrulama", + "req_id": "V2.2.3", + "req_description": "Uygulamanın, ilişkili veri öğelerinin önceden tanımlanmış kurallara göre makul olup olmadığını kontrol ettiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.3", + "section_name": "İş Mantığı Güvenliği", + "req_id": "V2.3.1", + "req_description": "Uygulamanın, aynı kullanıcı için iş mantığı akışlarını yalnızca beklenen adım sırasına göre ve adım atlamadan işlediği doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.3", + "section_name": "İş Mantığı Güvenliği", + "req_id": "V2.3.2", + "req_description": "İş mantığı sınırlarının, uygulama dokümantasyonuna uygun şekilde uygulandığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.3", + "section_name": "İş Mantığı Güvenliği", + "req_id": "V2.3.3", + "req_description": "İş mantığı seviyesinde işlemlerin (transaction) kullanıldığı ve bir iş mantığı işleminin ya bütünüyle başarıyla tamamlandığı ya da önceki geçerli duruma geri döndürüldüğü (rollback) doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.3", + "section_name": "İş Mantığı Güvenliği", + "req_id": "V2.3.4", + "req_description": "İş mantığı düzeyinde kilitleme mekanizmalarının, sınırlı kaynakların (ör. sinema koltukları, teslimat zamanları) uygulamanın mantığı manipüle edilerek çift rezervasyona neden olmamasını sağladığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.3", + "section_name": "İş Mantığı Güvenliği", + "req_id": "V2.3.5", + "req_description": "Yüksek değerli iş mantığı akışlarının, yetkisiz veya kazara gerçekleşebilecek işlemleri önlemek için çoklu kullanıcı onayı gerektirdiği doğrulanmalıdır. Bu işlemler büyük para transferleri, sözleşme onayları, gizli bilgilere erişim veya üretimde güvenlik kurallarının geçersiz kılınmaları gibi durumları içerebilir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.4", + "section_name": "Otomasyon Karşıtı Önlemler", + "req_id": "V2.4.1", + "req_description": "Uygulama işlevlerine yönelik aşırı miktardaki çağrılara karşı; veri sızdırma, anlamsız veri üretme, kota tüketme, hız sınırının aşılması, hizmet reddi (DoS) ya da maliyetli kaynakların aşırı kullanımı gibi risklere karşı otomasyon karşıtı kontrollerin bulunduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Doğrulama ve İş Mantığı", + "section_id": "V2.4", + "section_name": "Otomasyon Karşıtı Önlemler", + "req_id": "V2.4.2", + "req_description": "İş mantığı akışlarının, aşırı hızlı işlem gönderimlerini önleyecek şekilde gerçekçi insan zamanlaması gerektirdiği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.1", + "section_name": "Web Frontend Güvenlik Dokümantasyonu", + "req_id": "V3.1.1", + "req_description": "Uygulama dokümantasyonunda, uygulamayı kullanan tarayıcıların desteklemesi gereken güvenlik özelliklerinin (ör. HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) ve diğer ilgili HTTP güvenlik mekanizmaları) tanımlandığı doğrulanmalıdır. Ayrıca bu özelliklerin mevcut olmadığı durumlarda uygulamanın nasıl davranması gerektiği (ör. kullanıcıyı uyarmak veya erişimi engellemek) de tanımlanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.2", + "section_name": "İçeriğin Yanlış Yorumlanması", + "req_id": "V3.2.1", + "req_description": "Tarayıcıların HTTP yanıtlarında içerik veya işlevi yanlış bir bağlamda sunmalarını önlemek amacıyla güvenlik kontrollerinin uygulandığı doğrulanmalıdır (ör. API, kullanıcı tarafından yüklenen dosya veya başka bir kaynağın doğrudan çağrılması durumunda). Olası kontroller arasında; yalnızca HTTP istek başlıklarının (ör. Sec-Fetch-\\*) doğru bağlamı gösterdiği durumlarda içeriğin sunulması, Content-Security-Policy başlığında \"sandbox\" yönergesinin kullanılması veya Content-Disposition başlığında \"attachment\" biçiminin kullanılması yer alabilir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.2", + "section_name": "İçeriğin Yanlış Yorumlanması", + "req_id": "V3.2.2", + "req_description": "HTML yerine metin olarak görüntülenmesi amaçlanan içeriğin, HTML veya JavaScript gibi içeriklerin istenmeden çalıştırılmasını önleyecek şekilde \"createTextNode\" veya \"textContent\" gibi güvenli işleme fonksiyonlarıyla işlendiği doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.2", + "section_name": "İçeriğin Yanlış Yorumlanması", + "req_id": "V3.2.3", + "req_description": "Uygulamanın istemci tarafı JavaScript kullanırken açık değişken tanımlamaları yaparak, sıkı tür kontrolü uygulayarak, global değişkenleri document nesnesine kaydetmekten kaçınarak ve ad alanı izolasyonu sağlayarak DOM clobbering’den kaçındığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.3", + "section_name": "Çerez Yapılandırması", + "req_id": "V3.3.1", + "req_description": "Çerezlerin 'Secure' niteliğine sahip olduğu ve eğer çerez adı '\\__Host-' ön eki ile başlamıyorsa, '__Secure-' ön ekinin kullanıldığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.3", + "section_name": "Çerez Yapılandırması", + "req_id": "V3.3.2", + "req_description": "Kullanıcı arayüzü kandırma saldırılarına ve tarayıcı tabanlı istek sahteciliği saldırılarına (CSRF) karşı koruma sağlamak amacıyla, her çerezin 'SameSite' niteliğinin kullanım amacına uygun şekilde ayarlandığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.3", + "section_name": "Çerez Yapılandırması", + "req_id": "V3.3.3", + "req_description": "Çerez adı, diğer sunucularla paylaşılmak üzere açıkça tasarlanmadığı sürece '__Host-' ön eki ile tanımlanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.3", + "section_name": "Çerez Yapılandırması", + "req_id": "V3.3.4", + "req_description": "Bir çerez değeri istemci tarafı betikleri tarafından erişilememesi gereken bir veri içeriyorsa (ör. oturum token'ı), çerezin 'HttpOnly' niteliğine sahip olduğu ve aynı değerin (ör. oturum token'ı) yalnızca 'Set-Cookie' başlığı ile istemciye iletildiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.3", + "section_name": "Çerez Yapılandırması", + "req_id": "V3.3.5", + "req_description": "Uygulama bir çerez oluştururken, çerez adı ve değerinin toplam uzunluğunun 4096 baytı aşmadığı doğrulanmalıdır. Çok büyük çerezler tarayıcı tarafından saklanmaz ve isteklerle gönderilmez; bu da çereze bağlı çalışan uygulama işlevlerinin bozulmasına yol açabilir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.4", + "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", + "req_id": "V3.4.2", + "req_description": "Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header'ı, uygulama tarafından sabit bir değer olarak tanımlanmalı veya gelen Origin header değeri güvenilir origin’lerden oluşan bir izinli listeye karşı doğrulanmalıdır. ‘Access-Control-Allow-Origin: *’ kullanılması gerekiyorsa, yanıtın hassas bilgi içermediği doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.4", + "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", + "req_id": "V3.4.3", + "req_description": "HTTP yanıtlarında Content-Security-Policy header'ı bulunduğu ve bu header'ın yalnızca güvenilen içeriklerin veya kaynakların yüklenmesini ve çalıştırılmasını sağlayan yönergeler içerdiği doğrulanmalıdır. Minimum olarak \"global policy\", object-src 'none', base-uri 'none' yönergelerini içermeli ve izinli liste, nonce veya hash temelli bir yapı içermelidir. Seviye 3 uygulamalarında her yanıt için nonce veya hash içeren özel bir politika tanımlanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.4", + "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", + "req_id": "V3.4.4", + "req_description": "Tüm HTTP yanıtlarının 'X-Content-Type-Options: nosniff' header'ını içerdiği doğrulanmalıdır. Bu, tarayıcıya içerik türünü tahmin etmeyi bırakmasını ve yanıtın Content-Type header'ında belirtilen MIME türünün, beklenen kaynak türüyle eşleşmesini zorunlu kılar. Ayrıca bu, tarayıcıda CORB (Cross-Origin Read Blocking) özelliğini etkinleştirir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.4", + "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", + "req_id": "V3.4.5", + "req_description": "Uygulamanın, 'Referer' başlığı yoluyla üçüncü taraflara teknik olarak hassas verilerin sızmasını önlemek için bir 'referrer policy' belirlediği doğrulanmalıdır. Bu, Referrer-Policy HTTP header'ıyla veya HTML öğe nitelikleriyle (element attributes) sağlanabilir. Sızabilecek hassas bilgiler, URL’deki yol ve sorgu parametreleri ile sınırlı uygulamalarda hostname bilgisini içerebilir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.4", + "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", + "req_id": "V3.4.6", + "req_description": "Uygulamanın, Content-Security-Policy header'ı altında 'frame-ancestors' yönergesini her HTTP yanıtında tanımladığı ve bu sayede içeriklerin varsayılan olarak başka sayfalara gömülmesini engellediği doğrulanmalıdır. Gerekli durumlarda özel olarak izin verildiğinden emin olunmalıdır. 'X-Frame-Options' header'ı, tarayıcılar tarafından desteklenmesine rağmen, artık güncel değildir ve güvenlik amacıyla kullanılmamalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.4", + "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", + "req_id": "V3.4.8", + "req_description": "Bir belgenin işlenmesini ve sunulmasını başlatan tüm HTTP yanıtlarında (örneğin 'text/html' tipi yanıtlar), 'Cross-Origin-Opener-Policy' header'ı 'same-origin' veya 'same-origin-allow-popups' yönergeleriyle birlikte yer almalıdır. Bu, tabnabbing ve frame counting gibi, pencere nesnelerine paylaşımlı erişimi sömüren saldırılara karşı koruma sağlar.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.5", + "section_name": "Tarayıcı Menşei Ayırımı", + "req_id": "V3.5.1", + "req_description": "Uygulama, hassas işlevselliğe yönelik izinsiz cross-origin istekleri önlemek için CORS preflight mekanizmasına güvenmiyorsa, bu tür isteklerin gerçekten uygulamadan geldiği doğrulanmalıdır. Bu, anti-forgery token kullanımı veya CORS tarafından güvenli kabul edilmeyen özel HTTP header'larının zorunlu kılınmasıyla yapılabilir. Bu, tarayıcı tabanlı istek sahteciliği (CSRF) saldırılarına karşı bir savunmadır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.5", + "section_name": "Tarayıcı Menşei Ayırımı", + "req_id": "V3.5.2", + "req_description": "Uygulama, hassas işlevlerin izinsiz cross-origin çağrılmasını önlemek için CORS preflight mekanizmasına güveniyorsa, bu işlevlerin bir CORS-preflight isteğini tetiklemeden çağrılamadığı doğrulanmalıdır. Bu, 'Origin' ve 'Content-Type' header'larının doğrulanmasını veya CORS-safelisted olmayan bir header'ın ve alanın kullanılmasını gerektirebilir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.5", + "section_name": "Tarayıcı Menşei Ayırımı", + "req_id": "V3.5.4", + "req_description": "Farklı uygulamaların farklı hostname'lerde barındırıldığı ve böylece Same-Origin Policy tarafından sağlanan kısıtlamalardan (örneğin çerez erişim sınırları, kaynaklar arası etkileşim kontrolleri) faydalanıldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.5", + "section_name": "Tarayıcı Menşei Ayırımı", + "req_id": "V3.5.6", + "req_description": "Uygulamanın herhangi bir yerinde JSONP işlevselliğinin etkin olmadığı doğrulanmalıdır. Bu, XSSI (Cross-Site Script Inclusion) saldırılarını önlemek içindir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.5", + "section_name": "Tarayıcı Menşei Ayırımı", + "req_id": "V3.5.7", + "req_description": "Yetkilendirme gerektiren verilerin, JavaScript dosyaları gibi betik kaynaklarının yanıtlarında yer almadığı, XSSI saldırılarını önlemek için doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.5", + "section_name": "Tarayıcı Menşei Ayırımı", + "req_id": "V3.5.8", + "req_description": "Kimliği doğrulanmış kaynakların (örneğin görseller, videolar, betikler ve belgeler) yalnızca gerçekten amaçlandığında kullanıcı adına yüklenebildiği veya gömülebildiği doğrulanmalıdır. Bu, isteğin uygun olmayan bir çapraz kaynak çağrısından kaynaklanmadığından emin olmak için Sec-Fetch-* HTTP istek başlığı alanlarının sıkı bir şekilde doğrulanmasıyla veya tarayıcıya döndürülen içeriği engelleme talimatı vermek için kısıtlayıcı bir Cross-Origin-Resource-Policy HTTP yanıt başlığı alanı ayarlayarak gerçekleştirilebilir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.6", + "section_name": "Harici Kaynak Bütünlüğü", + "req_id": "V3.6.1", + "req_description": "JavaScript kütüphaneleri, CSS veya web fontları gibi istemci tarafı varlıkların yalnızca statik ve sürümlü olması, varlığın bütünlüğünü doğrulamak için Subresource Integrity (SRI) kullanılması durumunda harici olarak (örneğin, bir İçerik Dağıtım Ağı üzerinde) barındırıldığı doğrulanmalıdır. Bu mümkün değilse, her bir kaynak için bunu gerekçelendiren belgelenmiş bir güvenlik kararı bulunmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.7", + "section_name": "Diğer Tarayıcı Güvenliği Hususları", + "req_id": "V3.7.1", + "req_description": "Uygulamanın yalnızca hâlâ desteklenen ve güvenli kabul edilen istemci tarafı teknolojileri kullandığı doğrulanmalıdır. Bu gereksinimi karşılamayan teknolojilere örnek olarak NSAPI eklentileri, Flash, Shockwave, ActiveX, Silverlight, NACL veya istemci tarafı Java applet’leri verilebilir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.7", + "section_name": "Diğer Tarayıcı Güvenliği Hususları", + "req_id": "V3.7.2", + "req_description": "Uygulamanın, yalnızca hedef adres bir izinli listede yer alıyorsa kullanıcıyı otomatik olarak farklı bir ana makine adına veya uygulamanın kontrolünde olmayan bir etki alanına yönlendirdiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.7", + "section_name": "Diğer Tarayıcı Güvenliği Hususları", + "req_id": "V3.7.3", + "req_description": "Uygulamanın, kullanıcı uygulamanın kontrolü dışındaki bir URL’ye yönlendirildiğinde, yönlendirme hakkında bir bildirim gösterdiği ve kullanıcının bu gezintiyi iptal edebilmesi için bir seçenek sunduğu doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.7", + "section_name": "Diğer Tarayıcı Güvenliği Hususları", + "req_id": "V3.7.4", + "req_description": "Uygulamanın en üst düzey etki alanının (örneğin, site.tld) HTTP Strict Transport Security (HSTS) için genel preload listesine eklendiği doğrulanmalıdır. Bu, uygulamanın TLS kullanımının ana tarayıcılar tarafından doğrudan tanınmasını ve yalnızca Strict-Transport-Security yanıt header'ına bağlı kalınmamasını sağlar.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Web Ön Uç (Frontend) Güvenliği", + "section_id": "V3.7", + "section_name": "Diğer Tarayıcı Güvenliği Hususları", + "req_id": "V3.7.5", + "req_description": "Uygulamaya erişen tarayıcının beklenen güvenlik özelliklerini desteklememesi durumunda, uygulamanın dokümantasyona uygun şekilde davrandığı (örneğin kullanıcıyı uyarma veya erişimi engelleme) doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.1", + "section_name": "Genel Web Servisi Güvenliği", + "req_id": "V4.1.1", + "req_description": "İleti gövdesi içeren her HTTP yanıtında, yanıtın gerçek içeriğiyle eşleşen bir Content-Type header alanı bulunduğu ve güvenli karakter kodlamasını (örneğin, UTF-8, ISO-8859-1) belirtmek üzere charset parametresi içerdiği doğrulanmalıdır. Bu işlem, IANA Medya Türleri'nden \"text/\", \"/+xml\" ve \"/xml\" gibi içerikler için geçerlidir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.1", + "section_name": "Genel Web Servisi Güvenliği", + "req_id": "V4.1.2", + "req_description": "Yalnızca kullanıcı arayüzüne yönelik uç noktaların (manuel olarak web tarayıcısı ile erişilmesi amaçlanan) otomatik olarak HTTP'den HTTPS'e yönlendirme yaptığı ve diğer hizmetlerin veya uç noktaların şeffaf yönlendirme gerçekleştirmediği doğrulanmalıdır. Bu, istemcinin farkında olmadan şifrelenmemiş HTTP istekleri göndermesi ve bu isteklerin otomatik olarak HTTPS'e yönlendirilmesi sonucunda hassas verilerin sızmasının fark edilmemesi riskini önlemek içindir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.1", + "section_name": "Genel Web Servisi Güvenliği", + "req_id": "V4.1.3", + "req_description": "Uygulama tarafından kullanılan ve yük dengeleyici, web proxy veya frontend için backend hizmeti gibi bir ara katman tarafından ayarlanan herhangi bir HTTP başlık alanının, son kullanıcı tarafından geçersiz kılınamayacağı doğrulanmalıdır. Örnek başlıklar arasında X-Real-IP, X-Forwarded-* veya X-User-ID yer alabilir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.1", + "section_name": "Genel Web Servisi Güvenliği", + "req_id": "V4.1.4", + "req_description": "Uygulama veya API tarafından açıkça desteklenen HTTP yöntemlerinin (preflight istekleri sırasında OPTIONS dahil) dışında hiçbir yöntemin kullanılmadığı ve kullanılmayan yöntemlerin engellendiği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.1", + "section_name": "Genel Web Servisi Güvenliği", + "req_id": "V4.1.5", + "req_description": "Çok hassas istekler veya birçok sistemden geçen işlemler için, taşıma katmanı güvenliğinin üzerine ek bir güvence sağlamak amacıyla, her iletiye özel dijital imzaların kullanıldığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.2", + "section_name": "HTTP İleti Yapısı Doğrulama", + "req_id": "V4.2.1", + "req_description": "Tüm uygulama bileşenlerinin (yük dengeleyiciler, güvenlik duvarları ve uygulama sunucuları dahil) HTTP sürümüne uygun mekanizmaları kullanarak gelen HTTP iletilerinin sınırlarını belirlediği ve bu sayede HTTP istek kaçakçılığına karşı koruma sağlandığı doğrulanmalıdır. HTTP/1.x sürümünde Transfer-Encoding başlık alanı varsa, RFC 2616'ya göre Content-Length başlığı göz ardı edilmelidir. HTTP/2 veya HTTP/3 kullanıldığında, Content-Length başlığı varsa, alıcının bu değerin DATA çerçevelerinin uzunluğuyla tutarlı olduğunu doğrulaması gerekir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.2", + "section_name": "HTTP İleti Yapısı Doğrulama", + "req_id": "V4.2.2", + "req_description": "HTTP iletileri üretilirken, Content-Length başlığının, HTTP protokolünün çerçeveleme yöntemine göre belirlenen içerik uzunluğu ile çelişmediği doğrulanmalıdır. Bu, istek kaçakçılığı saldırılarını önlemek için gereklidir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.2", + "section_name": "HTTP İleti Yapısı Doğrulama", + "req_id": "V4.2.3", + "req_description": "Uygulamanın, yanıt bölme ve header enjeksiyonu saldırılarını önlemek amacıyla, bağlantıya özel başlık alanları (örneğin Transfer-Encoding) içeren HTTP/2 veya HTTP/3 iletilerini göndermediği ve kabul etmediği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.2", + "section_name": "HTTP İleti Yapısı Doğrulama", + "req_id": "V4.2.4", + "req_description": "Uygulamanın yalnızca başlık alanları ve değerleri CR (\\r), LF (\\n) veya CRLF (\\r\\n) karakter dizileri içermeyen HTTP/2 ve HTTP/3 isteklerini kabul ettiği doğrulanmalıdır. Bu, başlık enjeksiyonu saldırılarını önlemek içindir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.2", + "section_name": "HTTP İleti Yapısı Doğrulama", + "req_id": "V4.2.5", + "req_description": "Uygulama (backend veya frontend) istek oluşturuyor ve gönderiyorsa, URI'ler (örneğin API çağrıları için) veya HTTP istek başlıkları (örneğin Authorization veya Cookie) gibi bileşenlerin, alıcı sistemler tarafından kabul edilemeyecek kadar uzun olmamasını sağlamak amacıyla doğrulama, temizleme veya diğer mekanizmaları kullandığı doğrulanmalıdır. Bu tür çok uzun istekler (örneğin çok uzun bir Cookie başlığı) gönderildiğinde sunucunun sürekli hata durumu döndürmesiyle hizmet reddi oluşabilir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.3", + "section_name": "GraphQL", + "req_id": "V4.3.1", + "req_description": "Maliyetli ve iç içe geçmiş sorgular sonucu oluşabilecek GraphQL veya veri katmanı ifadelerine yönelik Hizmet Reddi (DoS) saldırılarını önlemek için, sorgu izin listesi (allowlist), derinlik sınırlandırması, sorgu sayısı sınırlandırması veya sorgu maliyeti analizi kullanıldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.3", + "section_name": "GraphQL", + "req_id": "V4.3.2", + "req_description": "GraphQL introspection (iç yapı sorgulama) sorgularının, GraphQL API'nin üçüncü taraflar tarafından kullanılmasına yönelik olmadığı sürece, üretim ortamında devre dışı bırakıldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.1", + "req_description": "Tüm WebSocket bağlantılarında TLS üzerinden WebSocket (WSS) kullanıldığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.2", + "req_description": "WebSocket'in başlangıçtaki HTTP el sıkışması (handshake) sırasında, Origin başlık alanının uygulama için izin verilen origin listesiyle karşılaştırılarak kontrol edildiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.3", + "req_description": "Uygulamanın standart oturum yönetimi kullanılamıyorsa, bunun yerine ilgili Oturum Yönetimi güvenlik gereksinimlerine uygun özel token'ların kullanıldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API ve Web Servisi", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.4", + "req_description": "HTTPS oturumu WebSocket kanalına geçerken, özel WebSocket oturum yönetim token’larının önceki şekilde kimliği doğrulanmış HTTPS oturumu aracılığıyla elde edildiği veya doğrulandığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.1", + "section_name": "Dosya İşleme Dokümantasyonu", + "req_id": "V5.1.1", + "req_description": "Dokümantasyonun, her yükleme özelliği için izin verilen dosya türlerini, beklenen dosya uzantılarını ve maksimum boyutu (açılmış hali dahil) tanımladığı doğrulanmalıdır. Ayrıca, dosyaların son kullanıcılar için nasıl güvenli hâle getirileceği (örneğin kötü amaçlı bir dosya tespit edildiğinde uygulamanın nasıl davranacağı) gibi bilgilerin de belgede yer aldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.2", + "section_name": "Dosya Yükleme ve İçerik", + "req_id": "V5.2.1", + "req_description": "Uygulamanın, yalnızca performans kaybına veya hizmet reddine yol açmayacak boyuttaki dosyaları kabul ettiği doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.2", + "section_name": "Dosya Yükleme ve İçerik", + "req_id": "V5.2.2", + "req_description": "Uygulama bir dosyayı, doğrudan veya bir arşiv (ör. zip dosyası) içinde kabul ettiğinde, dosya uzantısının beklenen uzantıyla eşleşip eşleşmediğini kontrol ettiği ve içeriğin uzantı tarafından temsil edilen türle uyumlu olduğunu doğruladığı kontrol edilmelidir. Bu; ilk 'magic byte' kontrolü, görüntü yeniden yazımı ve dosya içeriği doğrulama için özel kütüphanelerin kullanımı gibi yöntemleri içerir. Seviye 1 için bu, yalnızca iş veya güvenlik kararlarında kullanılan dosyalarla sınırlı olabilir. Seviye 2 ve üzeri için tüm dosyalar bu kontrole tabi olmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.2", + "section_name": "Dosya Yükleme ve İçerik", + "req_id": "V5.2.3", + "req_description": "Sıkıştırılmış dosyaların (ör. zip, gz, docx, odt) açılmadan önce, izin verilen maksimum açılmış boyuta ve maksimum dosya sayısına göre kontrol edildiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.2", + "section_name": "Dosya Yükleme ve İçerik", + "req_id": "V5.2.4", + "req_description": "Her kullanıcı için dosya boyutu kotası ve maksimum dosya sayısının uygulandığı doğrulanmalıdır. Böylece tek bir kullanıcının çok sayıda veya aşırı büyük dosya yükleyerek depolama alanını doldurması engellenir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.2", + "section_name": "Dosya Yükleme ve İçerik", + "req_id": "V5.2.5", + "req_description": "Uygulamanın, içinde sembolik bağlantılar (symlink) bulunan sıkıştırılmış dosyaların yüklenmesine yalnızca bu durum özel olarak gerekli olduğunda izin verdiği doğrulanmalıdır. Bu durumda, sembolik bağlantı verilebilecek dosyaların bir izinli listesi uygulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.2", + "section_name": "Dosya Yükleme ve İçerik", + "req_id": "V5.2.6", + "req_description": "Uygulamanın, piksel boyutu izin verilen maksimum değeri aşan görüntü dosyalarının yüklenmesini reddettiği doğrulanmalıdır. Bu, pixel flood saldırılarını önlemek için gereklidir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.3", + "section_name": "Dosya Depolama", + "req_id": "V5.3.1", + "req_description": "Güvenilmeyen girdilerle yüklenen veya oluşturulan ve herkese açık klasörlerde depolanan dosyaların, bir HTTP isteğiyle doğrudan erişildiğinde sunucu taraflı program kodu olarak çalıştırılmadığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.3", + "section_name": "Dosya Depolama", + "req_id": "V5.3.2", + "req_description": "Uygulamanın, dosya işlemleri için dosya yollarını oluştururken kullanıcı tarafından gönderilen dosya adlarını değil, dahili olarak oluşturulan veya güvenilir verileri kullandığı; eğer kullanıcı tarafından gönderilen dosya adları veya meta veriler kullanılacaksa, sıkı doğrulama ve temizleme işlemlerinin uygulandığı doğrulanmalıdır. Bu, yol geçişi (path traversal), yerel veya uzak dosya dahil etme (LFI, RFI) ve sunucu tarafı istek sahteciliği (SSRF) saldırılarına karşı koruma sağlar.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.3", + "section_name": "Dosya Depolama", + "req_id": "V5.3.3", + "req_description": "Sunucu tarafında gerçekleşen dosya işlemlerinin (örneğin dosya açma/decompress işlemi), kullanıcı tarafından sağlanan yol bilgilerini yok saydığı ve zip slip gibi güvenlik açıklarını önlediği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.4", + "section_name": "Dosya İndirme", + "req_id": "V5.4.1", + "req_description": "Uygulamanın, kullanıcı tarafından gönderilen dosya adlarını (ör. JSON, JSONP veya URL parametresinde) doğruladığı veya göz ardı ettiği ve yanıtın Content-Disposition başlık alanında bir dosya adı belirttiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.4", + "section_name": "Dosya İndirme", + "req_id": "V5.4.2", + "req_description": "Sunulan dosya adlarının (örneğin HTTP yanıt header'larında veya e-posta eklerinde), belge yapısını korumak ve enjeksiyon saldırılarını önlemek için kodlandığı veya temizlendiği (ör. RFC 6266’ya uygun) doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Dosya İşleme", + "section_id": "V5.4", + "section_name": "Dosya İndirme", + "req_id": "V5.4.3", + "req_description": "Güvenilmeyen kaynaklardan elde edilen dosyaların, bilinen kötü amaçlı içeriklerin sunulmasını önlemek amacıyla antivirüs tarayıcılarıyla tarandığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.1", + "section_name": "Kimlik Doğrulama Dokümantasyonu", + "req_id": "V6.1.1", + "req_description": "Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırılarına karşı oran sınırlama (rate limiting), otomasyon karşıtı önlemler ve uyarlanabilir yanıt gibi kontrollerin nasıl kullanıldığını açıklayan bir uygulama dokümantasyonu bulunduğu doğrulanmalıdır. Dokümantasyon, bu kontrollerin nasıl yapılandırıldığını ve kötü niyetli hesap kilitlemenin nasıl önlendiğini açıkça ortaya koymalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.1", + "section_name": "Kimlik Doğrulama Dokümantasyonu", + "req_id": "V6.1.2", + "req_description": "Parolalarda kullanılmasını önlemek amacıyla, bağlama özgü sözcüklerin (örneğin kurum adlarının permütasyonları, ürün adları, sistem tanımlayıcıları, proje kod adları, departman veya rol adları vb.) bulunduğu belgelenmiş bir liste mevcut olduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.1", + "section_name": "Kimlik Doğrulama Dokümantasyonu", + "req_id": "V6.1.3", + "req_description": "Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, bunların tümünün belgelenmiş olduğu ve her yol için tutarlı şekilde uygulanması gereken güvenlik kontrolleri ile kimlik doğrulama gücünün tanımlandığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.1", + "req_description": "Kullanıcı tarafından belirlenen parolaların en az 8 karakter uzunluğunda olması sağlanmalı, ancak 15 karakter ve üzeri uzunlukta parolalar olmaları şiddetle tavsiye edilir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.2", + "req_description": "Kullanıcıların parolalarını değiştirebilmeleri sağlanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.3", + "req_description": "Parola değiştirme işlevinin hem mevcut hem de yeni parolayı gerektirdiği doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.4", + "req_description": "Kayıt veya parola değişimi sırasında girilen parolaların, uygulamanın parola politikasına (örneğin minimum uzunluk) uyan ilk 3000 yaygın parolaya karşı kontrol edildiği doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.5", + "req_description": "Her tür karakterin kullanılmasına izin verildiği ve büyük/küçük harf, sayı veya özel karakter şartlarının zorunlu tutulmadığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.6", + "req_description": "Parola giriş alanlarının, girdiyi maskelemek için \"type=password\" kullandığı doğrulanmalıdır. Uygulamalar, kullanıcının tüm maskelenmiş parolayı ya da son girilen karakteri geçici olarak görüntülemesine izin verebilir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.7", + "req_description": "\"Yapıştır\" özelliğinin, tarayıcı parola yardımcılarının ve harici parola yöneticilerinin kullanımına izin verildiği doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.8", + "req_description": "Uygulamanın, kullanıcıdan aldığı parolayı herhangi bir şekilde değiştirmeden, örneğin kesmeden veya harf büyüklüğünü değiştirmeden, tam olarak doğruladığı teyit edilmelidir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.9", + "req_description": "En az 64 karakter uzunluğundaki parolalara izin verildiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.10", + "req_description": "Kullanıcının parolasının, yalnızca ele geçirildiği tespit edildiğinde veya kullanıcı tarafından yenilendiğinde geçerliliğini yitirdiği doğrulanmalıdır. Uygulama, belirli aralıklarla parola yenilenmesini zorunlu kılmamalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.11", + "req_description": "Tahmin edilmesi kolay parolaların oluşturulmasını önlemek amacıyla, bağlama özgü kelimelerin yer aldığı belgelenmiş listenin parola doğrulamada kullanıldığı teyit edilmelidir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.2", + "section_name": "Parola Güvenliği", + "req_id": "V6.2.12", + "req_description": "Kayıt veya parola değişikliği sırasında girilen parolaların, ele geçirilmiş parolalar listesine karşı kontrol edildiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.3", + "section_name": "Genel Kimlik Doğrulama Güvenliği", + "req_id": "V6.3.1", + "req_description": "Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırıları gibi saldırıları önlemeye yönelik kontrollerin, uygulamanın güvenlik dokümantasyonuna göre uygulandığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.3", + "section_name": "Genel Kimlik Doğrulama Güvenliği", + "req_id": "V6.3.2", + "req_description": "\"root\", \"admin\" veya \"sa\" gibi varsayılan kullanıcı hesaplarının uygulamada yer almadığı veya devre dışı bırakıldığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.3", + "section_name": "Genel Kimlik Doğrulama Güvenliği", + "req_id": "V6.3.3", + "req_description": "Uygulamaya erişim için ya çok faktörlü bir kimlik doğrulama mekanizması ya da tek faktörlü mekanizmaların kombinasyonu kullanılmalıdır. Seviye 3 için, bu faktörlerden biri, oltalama saldırılarına karşı direnç sağlayan ve kimlik doğrulama niyetini bir kullanıcı etkileşimi (örneğin FIDO donanım anahtarında bir düğmeye basma veya mobil telefonda bir onay) gerektirerek doğrulayan donanım tabanlı bir kimlik doğrulayıcı olmalıdır. Bu gereksinimdeki herhangi bir esneklik için, gerekçesi belgelenmiş ve riskleri azaltıcı kapsamlı kontroller içeren bir plan gereklidir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.3", + "section_name": "Genel Kimlik Doğrulama Güvenliği", + "req_id": "V6.3.4", + "req_description": "Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, belgelendirilmemiş bir yol bulunmadığı ve tüm yollar için güvenlik kontrolleri ile kimlik doğrulama gücünün tutarlı şekilde uygulandığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.3", + "section_name": "Genel Kimlik Doğrulama Güvenliği", + "req_id": "V6.3.5", + "req_description": "Başarılı veya başarısız şüpheli kimlik doğrulama girişimlerinin kullanıcıya bildirildiği doğrulanmalıdır. Bu, olağandışı bir konum veya istemciden gelen girişimler, yalnızca bir faktörle yapılan kısmen başarılı doğrulamalar, uzun süreli inaktiflik sonrası yapılan girişimler veya birçok başarısız denemeden sonraki başarılı girişimler gibi durumları içerebilir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.3", + "section_name": "Genel Kimlik Doğrulama Güvenliği", + "req_id": "V6.3.6", + "req_description": "E-postanın, tek faktörlü ya da çok faktörlü kimlik doğrulama mekanizması olarak kullanılmadığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.3", + "section_name": "Genel Kimlik Doğrulama Güvenliği", + "req_id": "V6.3.7", + "req_description": "Kimlik doğrulama detaylarında yapılan güncellemeler sonrasında (örneğin kimlik bilgisi sıfırlama, kullanıcı adı veya e-posta adresi değişiklikleri), kullanıcıların bilgilendirildiği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.3", + "section_name": "Genel Kimlik Doğrulama Güvenliği", + "req_id": "V6.3.8", + "req_description": "Başarısız kimlik doğrulama girişimlerinden, geçerli kullanıcıların hata mesajları, HTTP yanıt kodları veya farklı yanıt süreleri gibi sonuçlara dayanarak tespit edilemediği doğrulanmalıdır. Bu koruma, kayıt ve \"parolamı unuttum\" işlevselliğinde de geçerli olmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.4", + "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", + "req_id": "V6.4.1", + "req_description": "Sistem tarafından oluşturulan ilk parolaların veya etkinleştirme kodlarının güvenli bir şekilde rastgele üretildiği, mevcut parola politikasına uygun olduğu, kısa bir süre içinde veya ilk kullanım sonrasında geçerliliğini yitirdiği doğrulanmalıdır. Bu başlangıç sırları uzun vadeli parola olarak kullanılmasına izin verilmemelidir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.4", + "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", + "req_id": "V6.4.2", + "req_description": "Parola ipuçlarının veya \"gizli sorular\" olarak bilinen, bilgiye dayalı kimlik doğrulama mekanizmalarının mevcut olmadığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.4", + "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", + "req_id": "V6.4.3", + "req_description": "Unutulmuş parolanın sıfırlanması için, etkin olan çok faktörlü kimlik doğrulama mekanizmalarını atlamayan güvenli bir sürecin uygulandığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.4", + "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", + "req_id": "V6.4.4", + "req_description": "Çok faktörlü kimlik doğrulama faktörlerinden biri kaybolursa, kayıt sırasında uygulanan kimlik kanıtlama seviyesiyle aynı seviyede kimlik doğrulama yapıldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.4", + "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", + "req_id": "V6.4.5", + "req_description": "Süresi dolacak kimlik doğrulama mekanizmalarının yenilenmesine ilişkin talimatların, süresi dolmadan önce tamamlanacak şekilde yeterli sürede gönderildiği ve gerekiyorsa otomatik hatırlatıcıların yapılandırıldığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.4", + "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", + "req_id": "V6.4.6", + "req_description": "Yönetici yetkisi olan kullanıcıların, kullanıcının parola sıfırlama sürecini başlatabildiği ancak kullanıcının yeni parolasını belirleyemediği veya değiştiremediği doğrulanmalıdır. Bu, yönetici yetkisi olan kullanıcıların, kullanıcı parolasını bilmesini engeller.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.5", + "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "req_id": "V6.5.1", + "req_description": "Arama sırları, bant dışı kimlik doğrulama istekleri veya kodları ve zamana dayalı tek kullanımlık parolaların (TOTP) yalnızca bir kez kullanılabildiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.5", + "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "req_id": "V6.5.2", + "req_description": "Uygulamanın backend tarafında saklanırken, 112 bitten az entropiye sahip (örneğin 19 rastgele harf-rakam karakteri veya 34 rastgele rakam) arama sırlarının, 32-bit rastgele bir salt içeren onaylı bir parola saklama algoritmasıyla hash’lendiği doğrulanmalıdır. Gizli bilginin entropisi 112 bit veya daha fazlaysa standart bir hash fonksiyonu kullanılabilir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.5", + "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "req_id": "V6.5.3", + "req_description": "Arama sırları, bant dışı kimlik doğrulama kodları ve zamana dayalı tek kullanımlık parola seed'lerinin, öngörülebilir değerlerden kaçınmak için Kriptografik Olarak Güvenli Sözde Rastgele Sayı Üreteci (CSPRNG) ile oluşturulduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.5", + "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "req_id": "V6.5.4", + "req_description": "Arama sırlarının ve bant dışı kimlik doğrulama kodlarının en az 20 bit entropiye (genellikle 4 rastgele harf-rakam karakteri veya 6 rastgele rakam) sahip olduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.5", + "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "req_id": "V6.5.5", + "req_description": "Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının ve zamana dayalı tek kullanımlık parolaların (TOTP) belirli bir ömre sahip olduğu doğrulanmalıdır. Bant dışı istekler en fazla 10 dakika, TOTP’ler ise en fazla 30 saniye geçerli olmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.5", + "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "req_id": "V6.5.6", + "req_description": "Herhangi bir kimlik doğrulama faktörünün (fiziksel cihazlar dahil) çalınması veya kaybı durumunda iptal edilebildiği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.5", + "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "req_id": "V6.5.7", + "req_description": "Biyometrik kimlik doğrulama mekanizmalarının yalnızca ikincil faktör olarak, “sahip olduğunuz bir şey” veya “bildiğiniz bir şey” ile birlikte kullanıldığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.5", + "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "req_id": "V6.5.8", + "req_description": "Zamana dayalı tek kullanımlık parolaların (TOTP) doğrulamasının, güvenilir bir hizmetten alınan zaman kaynağına dayanarak yapıldığı ve güvenilir olmayan veya istemci tarafından sağlanan zaman kaynağına dayanmadığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.6", + "section_name": "Bant Dışı Kimlik Doğrulama Mekanizmaları", + "req_id": "V6.6.1", + "req_description": "Tek kullanımlık parolaların (OTP) telefon veya SMS ile Public Switched Telephone Network (PSTN) üzerinden iletildiği kimlik doğrulama mekanizmalarının, yalnızca telefon numarası önceden doğrulanmışsa, alternatif daha güçlü yöntemler (örneğin TOTP) de sunuluyorsa ve kullanıcıya güvenlik riskleri hakkında bilgi veriliyorsa sunulduğu doğrulanmalıdır. Seviye 3 uygulamalar için telefon ve SMS seçenekleri sunulmamalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.6", + "section_name": "Bant Dışı Kimlik Doğrulama Mekanizmaları", + "req_id": "V6.6.2", + "req_description": "Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının, oluşturuldukları özgün kimlik doğrulama isteğiyle bağlantılı olduğu ve daha önceki ya da sonraki bir istek için kullanılamadığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.6", + "section_name": "Bant Dışı Kimlik Doğrulama Mekanizmaları", + "req_id": "V6.6.3", + "req_description": "Kod tabanlı bant dışı kimlik doğrulama mekanizmalarının, oran sınırlaması ile kaba kuvvet saldırılarına karşı korunduğu doğrulanmalıdır. En az 64 bit entropiye sahip kodlar kullanılması da değerlendirilmelidir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.6", + "section_name": "Bant Dışı Kimlik Doğrulama Mekanizmaları", + "req_id": "V6.6.4", + "req_description": "Çok faktörlü kimlik doğrulama için push bildirimleri kullanılıyorsa, push bombing saldırılarına karşı oran sınırlamasının kullanıldığı doğrulanmalıdır. “Numara eşleştirme” de bu riski azaltabilir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.7", + "section_name": "Kriptografik Kimlik Doğrulama Mekanizması", + "req_id": "V6.7.1", + "req_description": "Kriptografik kimlik doğrulama beyanlarını doğrulamak için kullanılan sertifikaların, değiştirilmeye karşı korumalı şekilde saklandığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.7", + "section_name": "Kriptografik Kimlik Doğrulama Mekanizması", + "req_id": "V6.7.2", + "req_description": "Challenge nonce değerinin en az 64 bit uzunluğunda olduğu ve istatistiksel olarak benzersiz ya da cihazın ömrü boyunca benzersiz olduğu doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.8", + "section_name": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", + "req_id": "V6.8.1", + "req_description": "Uygulama birden fazla kimlik sağlayıcıyı (IdP) destekliyorsa, başka bir desteklenen kimlik sağlayıcı aracılığıyla (örneğin aynı kullanıcı tanımlayıcısını kullanarak) kullanıcının kimliğinin taklit edilemediği doğrulanmalıdır. Standart önlem, uygulamanın kullanıcıyı IdP kimliği (bir ad alanı işlevi görür) ve IdP içindeki kullanıcı kimliğinin birleşimiyle kaydetmesi ve tanımlamasıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.8", + "section_name": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", + "req_id": "V6.8.2", + "req_description": "Kimlik doğrulama beyanları üzerindeki dijital imzaların (örneğin JWT veya SAML beyanları) varlığı ve bütünlüğünün her zaman doğrulandığı ve imzasız veya geçersiz imzalı beyanların reddedildiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.8", + "section_name": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", + "req_id": "V6.8.3", + "req_description": "SAML beyanlarının benzersiz biçimde işlendiği ve yalnızca geçerlilik süresi içinde bir kez kullanıldığı, tekrar oynatma (replay) saldırılarını önlemek amacıyla doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Kimlik Doğrulama", + "section_id": "V6.8", + "section_name": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", + "req_id": "V6.8.4", + "req_description": "Uygulama ayrı bir Kimlik Sağlayıcı (IdP) kullanıyorsa ve belirli işlemler için belirli kimlik doğrulama gücü, yöntemleri veya zaman bilgisi bekliyorsa, uygulamanın bu bilgileri IdP tarafından döndürülen veriler üzerinden doğruladığı teyit edilmelidir. Örneğin OIDC kullanılıyorsa, bu durum ID Token üzerindeki 'acr', 'amr' ve 'auth_time' gibi claim’lerin (varsa) doğrulanması ile sağlanabilir. Eğer IdP bu bilgileri sağlamıyorsa, uygulamanın asgari kimlik doğrulama gücünün kullanıldığını varsayan (örneğin yalnızca kullanıcı adı ve parola ile tek faktörlü doğrulama) belgelenmiş bir yedek yaklaşımı olmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.1", + "section_name": "Oturum Yönetim Dokümantasyonu", + "req_id": "V7.1.1", + "req_description": "Kullanıcının oturum inaktivite zaman aşımı süresi ve mutlak maksimum oturum süresinin belgelendiği, diğer kontrollerle birlikte uygun olduğu ve NIST SP 800-63B yeniden kimlik doğrulama gereksinimlerinden herhangi bir sapma varsa gerekçesinin belgede yer aldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.1", + "section_name": "Oturum Yönetim Dokümantasyonu", + "req_id": "V7.1.2", + "req_description": "Belgede bir hesap için kaç adet eşzamanlı (paralel) oturuma izin verildiği ile birlikte, maksimum aktif oturum sayısına ulaşıldığında uygulanacak davranış ve işlemlerin tanımlandığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.1", + "section_name": "Oturum Yönetim Dokümantasyonu", + "req_id": "V7.1.3", + "req_description": "Birleşik kimlik yönetim ekosisteminin bir parçası olarak kullanıcı oturumu oluşturan ve yöneten tüm sistemlerin, oturum ömrü, sonlandırma ve yeniden kimlik doğrulama gerektiren diğer koşulların nasıl koordine edildiğini açıklayan kontrollerle birlikte belgede yer aldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.2", + "section_name": "Temel Oturum Yönetimi Güvenliği", + "req_id": "V7.2.1", + "req_description": "Uygulamanın tüm oturum token'ı doğrulama işlemlerini güvenilir bir backend servisi aracılığıyla gerçekleştirdiği doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.2", + "section_name": "Temel Oturum Yönetimi Güvenliği", + "req_id": "V7.2.2", + "req_description": "Uygulamanın, statik API gizli anahtarları veya sabit değerler yerine, oturum yönetimi için dinamik olarak oluşturulan kendi kendine yeterli veya referans token'ları kullandığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.2", + "section_name": "Temel Oturum Yönetimi Güvenliği", + "req_id": "V7.2.3", + "req_description": "Uygulama kullanıcı oturumlarını temsil etmek için referans token'ları kullanıyorsa, bu token'ların benzersiz olduğu, kriptografik olarak güvenli bir sözde rastgele sayı üreteci (CSPRNG) kullanılarak üretildiği ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.2", + "section_name": "Temel Oturum Yönetimi Güvenliği", + "req_id": "V7.2.4", + "req_description": "Uygulamanın, kullanıcı kimlik doğrulaması (yeniden kimlik doğrulama dahil) sırasında yeni bir oturum token'ı oluşturduğu ve mevcut oturum token'ını sonlandırdığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.3", + "section_name": "Oturum Zaman Aşımı", + "req_id": "V7.3.1", + "req_description": "Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde bir hareketsizlik zaman aşımı bulunduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.3", + "section_name": "Oturum Zaman Aşımı", + "req_id": "V7.3.2", + "req_description": "Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde mutlak bir maksimum oturum süresi bulunduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.4", + "section_name": "Oturum Sonlandırma", + "req_id": "V7.4.1", + "req_description": "Oturum sonlandırma tetiklendiğinde (örneğin, çıkış yapıldığında veya süre dolduğunda), uygulamanın oturumun daha fazla kullanılmasına izin vermediği doğrulanmalıdır. Referans token'lar veya durum bilgili oturumlar için bu, oturum verilerinin uygulama arka ucunda geçersiz kılınması anlamına gelir. Kapsamlı token kullanan uygulamaların; sonlandırılmış token listesi tutmak, kullanıcıya özel tarih ve saatten önce oluşturulan token'ları reddetmek veya kullanıcıya özel imzalama anahtarını yenilemek gibi bir çözüm uygulaması gerekir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.4", + "section_name": "Oturum Sonlandırma", + "req_id": "V7.4.2", + "req_description": "Bir kullanıcı hesabı devre dışı bırakıldığında veya silindiğinde (örneğin bir çalışanın şirketten ayrılması), uygulamanın tüm aktif oturumları sonlandırdığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.4", + "section_name": "Oturum Sonlandırma", + "req_id": "V7.4.3", + "req_description": "Herhangi bir kimlik doğrulama faktörünün başarılı bir şekilde değiştirilmesi veya kaldırılmasından (şifre sıfırlama veya kurtarma yoluyla yapılan değişiklikler dahil ve varsa MFA ayarları güncellemeleri dahil) sonra, uygulamanın diğer tüm aktif oturumları sonlandırma seçeneği sunduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.4", + "section_name": "Oturum Sonlandırma", + "req_id": "V7.4.4", + "req_description": "Kimlik doğrulama gerektiren tüm sayfalarda kolay erişilebilir ve görünür bir çıkış yap (logout) işlevi bulunduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.4", + "section_name": "Oturum Sonlandırma", + "req_id": "V7.4.5", + "req_description": "Uygulama yöneticilerinin, bireysel bir kullanıcının veya tüm kullanıcıların aktif oturumlarını sonlandırabilme yetkisine sahip olduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.5", + "section_name": "Oturum Kötüye Kullanımına Karşı Savunmalar", + "req_id": "V7.5.1", + "req_description": "E-posta adresi, telefon numarası, MFA yapılandırması veya hesap kurtarmada kullanılan diğer bilgiler gibi kimlik doğrulamayı etkileyebilecek hassas hesap özniteliklerinde değişiklik yapılmadan önce uygulamanın tam yeniden kimlik doğrulama gerektirdiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.5", + "section_name": "Oturum Kötüye Kullanımına Karşı Savunmalar", + "req_id": "V7.5.2", + "req_description": "Kullanıcıların, (en az bir faktörle yeniden kimlik doğrulama yaptıktan sonra) mevcut tüm aktif oturumları görüntüleyebilmesi ve sonlandırabilmesinin mümkün olduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.5", + "section_name": "Oturum Kötüye Kullanımına Karşı Savunmalar", + "req_id": "V7.5.3", + "req_description": "Uygulamanın, son derece hassas işlemler veya operasyonlar gerçekleştirilmeden önce en az bir faktörle ek kimlik doğrulaması veya ikincil bir doğrulama gerektirdiği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.6", + "section_name": "Birleşik Yeniden Kimlik Doğrulama", + "req_id": "V7.6.1", + "req_description": "Güvenen Taraf (RP) ile Kimlik Sağlayıcı (IdP) arasındaki oturum süresi ve oturum sonlandırma davranışlarının belgelenmiş olduğu ve, örneğin IdP kimlik doğrulama olayları arasında maksimum süreye ulaşıldığında yeniden kimlik doğrulamanın gerekli kılındığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Oturum Yönetimi", + "section_id": "V7.6", + "section_name": "Birleşik Yeniden Kimlik Doğrulama", + "req_id": "V7.6.2", + "req_description": "Yeni bir oturum oluşturulmasının, kullanıcı onayı veya açık bir eylem gerektirdiği; kullanıcı etkileşimi olmaksızın yeni uygulama oturumlarının oluşturulmasının önlendiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.1", + "section_name": "Yetkilendirme Dokümantasyonu", + "req_id": "V8.1.1", + "req_description": "Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak işlev düzeyinde ve veriye özel erişim kısıtlamaları için kuralları tanımladığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.1", + "section_name": "Yetkilendirme Dokümantasyonu", + "req_id": "V8.1.2", + "req_description": "Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak alan (field) düzeyinde erişim kısıtlamaları (hem okuma hem yazma) için kuralları tanımladığı doğrulanmalıdır. Bu kuralların, ilgili veri nesnesinin durum veya statü gibi diğer özniteliklerine bağlı olabileceği unutulmamalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.1", + "section_name": "Yetkilendirme Dokümantasyonu", + "req_id": "V8.1.3", + "req_description": "Uygulamanın dokümantasyonunun, kimlik doğrulama ve yetkilendirme ile ilgili güvenlik kararlarının alınmasında kullanılan çevresel ve bağlamsal öznitelikleri (günün saati, kullanıcı konumu, IP adresi veya cihaz gibi) tanımladığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.1", + "section_name": "Yetkilendirme Dokümantasyonu", + "req_id": "V8.1.4", + "req_description": "Kimlik doğrulama ve yetkilendirme dokümantasyonunun; işlev düzeyinde, veriye özel ve alan düzeyinde yetkilendirmenin yanı sıra çevresel ve bağlamsal faktörlerin karar almada nasıl kullanıldığını tanımladığı doğrulanmalıdır. Bu, değerlendirilen öznitelikleri, risk eşiklerini ve alınan aksiyonları (ör. izin ver, doğrulama iste, reddet, step-up kimlik doğrulama) içermelidir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.2", + "section_name": "Genel Yetkilendirme Tasarımı", + "req_id": "V8.2.1", + "req_description": "Uygulamanın, işlev düzeyindeki erişimin yalnızca açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.2", + "section_name": "Genel Yetkilendirme Tasarımı", + "req_id": "V8.2.2", + "req_description": "Uygulamanın, veriye özel erişimin yalnızca belirli veri öğelerine açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, doğrudan nesne referansı güvenlik açıkları (IDOR) ve bozuk nesne düzeyinde yetkilendirme (BOLA) risklerini azaltır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.2", + "section_name": "Genel Yetkilendirme Tasarımı", + "req_id": "V8.2.3", + "req_description": "Uygulamanın, alan (field) düzeyindeki erişimin yalnızca belirli alanlara açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, bozuk nesne özelliği düzeyinde yetkilendirme (BOPLA) risklerini azaltır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.2", + "section_name": "Genel Yetkilendirme Tasarımı", + "req_id": "V8.2.4", + "req_description": "Tüketicinin çevresel ve bağlamsal özniteliklerine (ör. günün saati, konum, IP adresi veya cihaz) dayalı uyarlanabilir güvenlik kontrollerinin, uygulama dokümantasyonunda tanımlandığı şekilde, kimlik doğrulama ve yetkilendirme kararları için uygulandığı doğrulanmalıdır. Bu kontroller, tüketici yeni bir oturum başlatmaya çalışırken ve mevcut bir oturum sırasında uygulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.3", + "section_name": "İşlem Düzeyinde Yetkilendirme", + "req_id": "V8.3.1", + "req_description": "Uygulamanın yetkilendirme kurallarını güvenilir bir servis katmanında uyguladığı ve istemci taraflı JavaScript gibi güvenilmeyen tüketiciler tarafından değiştirilebilecek kontrollerle yetinmediği doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.3", + "section_name": "İşlem Düzeyinde Yetkilendirme", + "req_id": "V8.3.2", + "req_description": "Yetkilendirme kararlarının temelini oluşturan değerlerdeki değişikliklerin hemen uygulandığı doğrulanmalıdır. Değişikliklerin anında uygulanamadığı durumlarda (örneğin self-contained token içindeki verilere güveniliyorsa), tüketici artık yetkili olmadığı hâlde bir işlem gerçekleştirdiğinde uyarı verecek ve değişikliği geri alacak önlemler uygulanmalıdır. Bu alternatifin bilgi sızıntısını önlemeyeceği unutulmamalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.3", + "section_name": "İşlem Düzeyinde Yetkilendirme", + "req_id": "V8.3.3", + "req_description": "Bir nesneye erişimin, herhangi bir aracı veya onun adına hareket eden bir servis yerine yalnızca erişimi başlatan öznenin (ör. tüketici) izinlerine dayandığı doğrulanmalıdır. Örneğin, bir tüketici kimlik doğrulama için bir self-contained token kullanarak bir web servis çağırırsa ve bu servis başka bir servisten veri talep ederse, ikinci servis izin kararlarını verirken birinci servisin makine-makine token'ı yerine tüketicinin token'ını kullanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.4", + "section_name": "Diğer Yetkilendirme Hususları", + "req_id": "V8.4.1", + "req_description": "Multi-tenant uygulamaların, tüketici işlemlerinin izinli olmadıkları tenant'lar üzerinde asla etkili olmamasını sağlamak için tenant'lar arası kontroller kullandığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Yetkilendirme", + "section_id": "V8.4", + "section_name": "Diğer Yetkilendirme Hususları", + "req_id": "V8.4.2", + "req_description": "Yönetici arayüzlerine erişimin, sürekli tüketici kimlik doğrulaması, cihaz güvenlik durumu değerlendirmesi ve bağlamsal risk analizi dahil olmak üzere çok katmanlı güvenlik içerdiği doğrulanmalıdır. Yetkilendirme için yalnızca ağ konumu veya güvenilir uç noktalar yeterli olmamalıdır; ancak bu tür faktörler yetkisiz erişim olasılığını azaltabilir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", + "section_id": "V9.1", + "section_name": "Token Kaynağı ve Bütünlüğü", + "req_id": "V9.1.1", + "req_description": "Self-contained token'ların içerikleri kabul edilmeden önce, oynama (tampering) saldırılarına karşı dijital imza veya MAC ile doğrulama yapıldığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", + "section_id": "V9.1", + "section_name": "Token Kaynağı ve Bütünlüğü", + "req_id": "V9.1.2", + "req_description": "Belirli bir bağlam için yalnızca bir allowlist üzerinde bulunan algoritmaların self-contained token oluşturmak ve doğrulamak için kullanılabildiği doğrulanmalıdır. Bu allowlist, yalnızca simetrik ya da yalnızca asimetrik algoritmaları içermeli ve kesinlikle 'None' algoritmasını içermemelidir. Hem simetrik hem de asimetrik algoritmalar desteklenmek zorundaysa, anahtar karışıklığını (key confusion) önlemek için ek kontroller uygulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", + "section_id": "V9.1", + "section_name": "Token Kaynağı ve Bütünlüğü", + "req_id": "V9.1.3", + "req_description": "Self-contained token'ları doğrulamak için kullanılan anahtar malzemesinin, token issuer için önceden yapılandırılmış güvenilir kaynaklardan alındığı doğrulanmalıdır. Bu, saldırganların güvenilmeyen kaynak ve anahtarları belirtmesini engeller. JWT ve diğer JWS yapılarında 'jku', 'x5u' ve 'jwk' gibi header'lar güvenilir kaynaklardan oluşan bir allowlist'e göre doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", + "section_id": "V9.2", + "section_name": "Token İçeriği", + "req_id": "V9.2.1", + "req_description": "Token verisinde bir geçerlilik zaman aralığı (validity time span) varsa, yalnızca doğrulama zamanı bu zaman aralığı içerisindeyse token ve içeriği kabul edilmelidir. Örneğin, JWT'ler için 'nbf' ve 'exp' claim'leri doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", + "section_id": "V9.2", + "section_name": "Token İçeriği", + "req_id": "V9.2.2", + "req_description": "Token'ı alan hizmetin, token içeriğini kabul etmeden önce bu token'ın doğru türde olduğunu ve sunulma amacına uygun olduğunu doğruladığı teyit edilmelidir. Örneğin, yalnızca erişim token'ları yetkilendirme kararları için, yalnızca ID Token'lar kullanıcı kimlik doğrulamasını kanıtlamak için kullanılabilir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", + "section_id": "V9.2", + "section_name": "Token İçeriği", + "req_id": "V9.2.3", + "req_description": "Hizmetin yalnızca kendisiyle kullanılması amaçlanan (audience) token'ları kabul ettiği doğrulanmalıdır. JWT'lerde bu, 'aud' claim'inin hizmet içinde tanımlı bir allowlist ile doğrulanması yoluyla sağlanabilir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", + "section_id": "V9.2", + "section_name": "Token İçeriği", + "req_id": "V9.2.4", + "req_description": "Eğer bir token issuer, farklı audience'lara token oluşturmak için aynı private key'i kullanıyorsa, oluşturulan token'ların hedef audience'ları benzersiz şekilde tanımlayan bir audience kısıtlaması içerdiği doğrulanmalıdır. Bu, bir token'ın farklı bir audience ile yeniden kullanılmasını önler. Audience tanımlayıcısı dinamik olarak sağlanıyorsa, token issuer bu audience'ları doğrulamalı ve audience taklitlerinin (impersonation) önüne geçmelidir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.1", + "section_name": "Genel OAuth ve OIDC Güvenliği", + "req_id": "V10.1.1", + "req_description": "Token'ların yalnızca kesinlikle ihtiyaç duyan bileşenlere gönderildiği doğrulanmalıdır. Örneğin, tarayıcı tabanlı JavaScript uygulamaları için bir backend-for-frontend modeli kullanıldığında, access ve refresh token'lara yalnızca backend'in erişebilmesi gerekir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.1", + "section_name": "Genel OAuth ve OIDC Güvenliği", + "req_id": "V10.1.2", + "req_description": "Authorization server'dan gelen değerler (örneğin authorization code veya ID Token gibi) yalnızca aynı user agent oturumu ve işlemi tarafından başlatılmış bir yetkilendirme akışının sonucuysa kabul edildiği doğrulanmalıdır. Bu, client tarafından oluşturulan secret’ların 'proof key for code exchange' (PKCE) ‘code_verifier’, ‘state’ veya OIDC ‘nonce’ gibi tahmin edilemez, işleme özgü ve hem client’a hem de işlem başlatılan user agent oturumuna güvenli bir şekilde bağlı olmasını gerektirir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.2", + "section_name": "OAuth İstemcisi", + "req_id": "V10.2.1", + "req_description": "Code flow kullanılıyorsa, OAuth client’ın token taleplerini tetikleyen CSRF saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Bu genellikle PKCE kullanılarak veya authorization isteğinde gönderilen ‘state’ parametresinin kontrolü ile sağlanır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.2", + "section_name": "OAuth İstemcisi", + "req_id": "V10.2.2", + "req_description": "OAuth istemcisi birden fazla AS ile etkileşime girebiliyorsa, mix-up saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Örneğin, authorization server’ın 'iss' parametresini döndürmesi zorunlu kılınabilir ve bu parametrenin hem authorization yanıtında hem de token yanıtında doğrulanması gerekir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.2", + "section_name": "OAuth İstemcisi", + "req_id": "V10.2.3", + "req_description": "OAuth istemcisinin authorization server’a yaptığı taleplerde yalnızca gerekli scope’ları (veya diğer yetkilendirme parametrelerini) talep ettiği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.3", + "section_name": "OAuth Kaynak Sunucusu (RS)", + "req_id": "V10.3.1", + "req_description": "RS'nin yalnızca bu servisle kullanılmak üzere tasarlanmış access token’ları kabul ettiği doğrulanmalıdır (audience kontrolü). Audience bilgisi yapılandırılmış token’larda (örneğin JWT içindeki ‘aud’ claim’i) yer alabilir veya token introspection endpoint aracılığıyla kontrol edilebilir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.3", + "section_name": "OAuth Kaynak Sunucusu (RS)", + "req_id": "V10.3.2", + "req_description": "RS'nin, access token’dan gelen claim’lere dayanarak yetki devri tanımına uygun şekilde yetkilendirme kararları uyguladığı doğrulanmalıdır. ‘sub’, ‘scope’ ve ‘authorization_details’ gibi claim’ler varsa, bu kararın parçası olmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.3", + "section_name": "OAuth Kaynak Sunucusu (RS)", + "req_id": "V10.3.3", + "req_description": "Erişim kontrolü kararında, access token’dan (JWT veya ilgili token introspection yanıtı) benzersiz bir kullanıcının tanımlanması gerekiyorsa, RS'nin başka kullanıcılara devredilemeyecek claim’ler ile kullanıcıyı tanımladığı doğrulanmalıdır. Genellikle bu, ‘iss’ ve ‘sub’ claim’lerinin birlikte kullanılması anlamına gelir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.3", + "section_name": "OAuth Kaynak Sunucusu (RS)", + "req_id": "V10.3.4", + "req_description": "RS'nin belirli bir kimlik doğrulama gücü, yöntemi veya güncelliği (recentness) gerektirmesi durumunda, sunulan access token’ın bu kısıtlamaları karşıladığını doğruladığı, örneğin, OIDC ‘acr’, ‘amr’ ve ‘auth_time’ claim’leri kullanılarak doğrulanmalıdır. ", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.3", + "section_name": "OAuth Kaynak Sunucusu (RS)", + "req_id": "V10.3.5", + "req_description": "RS'nin, (yetkisiz taraflarca) çalınmış veya tekrar edilen access token’ların kullanımını önlemek için sender-constrained access token’lar kullandığı doğrulanmalıdır. Bu, OAuth 2 için Mutual TLS veya OAuth 2 Demonstration of Proof of Possession (DPoP) ile sağlanabilir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.1", + "req_description": "AS'nin, istemciye özel önceden kaydedilmiş URI’lerden oluşan bir allowlist kullanarak redirect URI’leri tam dize karşılaştırması ile doğruladığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.2", + "req_description": "AS'nin, \"authorization response\" içinde \"authorization code\" döndürdüğü durumlarda, bu kodun yalnızca bir kez kullanılabildiği doğrulanmalıdır. Daha önce access token vermek için kullanılmış bir authorization code ile yapılan ikinci geçerli token isteği reddedilmeli ve ilgili tüm token’lar iptal edilmelidir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.3", + "req_description": "Authorization code’un kısa ömürlü olduğu doğrulanmalıdır. L1 ve L2 uygulamalar için maksimum yaşam süresi 10 dakika, L3 uygulamalar için 1 dakikadır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.4", + "req_description": "Belirli bir istemci için AS'nin yalnızca o istemcinin ihtiyaç duyduğu grant türlerine izin verdiği doğrulanmalıdır. \"Token\" (Implicit flow) ve \"password\" (Resource Owner Password Credentials flow) grant türlerinin artık kullanılmaması gerekir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.5", + "req_description": "AS'nin, açık istemciler için refresh token replay saldırılarını azalttığı doğrulanmalıdır. Tercihen sender-constrained refresh token’lar (DPoP veya mutual TLS ile certificate-bound access token’lar) kullanılmalıdır. L1 ve L2 uygulamalar için refresh token rotation kullanılabilir. Rotation kullanılıyorsa, AS refresh token’ı kullanım sonrası geçersiz kılmalı ve geçersiz bir refresh token sunulması durumunda o yetkilendirme ile ilişkili tüm refresh token’ları iptal etmelidir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.6", + "req_description": "Code grant kullanılıyorsa, AS'nin authorization code interception saldırılarına karşı koruma sağladığı doğrulanmalıdır. Yetkilendirme isteğinde geçerli bir \"code_challenge\" değeri zorunlu olmalı ve \"code_challenge_method\" olarak \"plain\" kabul edilmemelidir. Token isteğinde ise \"code_verifier\" parametresi doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.7", + "req_description": "AS'nin, kimlik doğrulaması yapılmamış dinamik istemci kaydını desteklemesi durumunda, kötü niyetli istemci uygulamalarına karşı riskleri azalttığı doğrulanmalıdır. Kayıtlı URI’ler gibi client metadata’sı doğrulanmalı, kullanıcı onayı alınmalı ve güvenilmeyen bir client uygulamasıyla yapılan yetkilendirme isteği işlenmeden önce kullanıcı uyarılmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.8", + "req_description": "Refresh token’ların, sliding expiration kullanılsa bile mutlak bir sona erme süresine sahip olduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.9", + "req_description": "Yetkili bir kullanıcı tarafından AS kullanıcı arayüzü üzerinden refresh token’ların ve reference access token’ların iptal edilebildiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.10", + "req_description": "Gizli istemcilerin token istekleri, pushed authorization request (PAR) ve token iptal istekleri gibi server’a yapılan backchannel isteklerinde kimliğinin kontrol edildiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.11", + "req_description": "AS yapılandırmasının, OAuth istemcisine yalnızca gerekli scope’ları atadığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.12", + "req_description": "Belirli bir client için, authorization server’ın yalnızca client’ın ihtiyaç duyduğu 'response_mode' değerine izin verdiği doğrulanmalıdır. Örneğin, bu değer ya beklenenlerle karşılaştırılarak doğrulanmalı ya da PAR veya JAR kullanılmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.13", + "req_description": "\"Code\" grant türünün daima pushed authorization request (PAR) ile birlikte kullanıldığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.14", + "req_description": "AS'nin yalnızca sender-constrained (Proof-of-Possession) access token’lar ürettiği doğrulanmalıdır. Bu, mutual TLS ile certificate-bound access token ya da DPoP ile DPoP-bound access token olabilir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.15", + "req_description": "Sunucu taraflı istemciler için (kullanıcı cihazında çalışmayan), AS'nin \"authorization_details\" parametresinin istemci backend'i tarafından sağlandığını ve kullanıcı tarafından değiştirilmediğini doğruladığı, örneğin pushed authorization request (PAR) or JWT-secured Authorization Request (JAR) zorunlu kılınarak doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.4", + "section_name": "OAuth Yetkilendirme Sunucusu (AS)", + "req_id": "V10.4.16", + "req_description": "Bir istemci gizli ise, AS'nin güçlü istemci kimlik doğrulama yöntemlerini zorunlu kıldığı doğrulanmalıdır. Bu yöntemler, public-key cryptography’ye dayalı ve replay saldırılarına karşı dayanıklı olmalı, örneğin mutual TLS (\"tls_client_auth\", \"self_signed_tls_client_auth\") veya private key JWT (\"private_key_jwt\") gibi.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.5", + "section_name": "OIDC İstemcisi", + "req_id": "V10.5.1", + "req_description": "İstemcinin (relying party olarak) ID Token replay saldırılarını azalttığı doğrulanmalıdır. Örneğin, ID Token’daki 'nonce' claim’inin, OpenID Provider’a gönderilen kimlik doğrulama isteğindeki 'nonce' değeriyle eşleştiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.5", + "section_name": "OIDC İstemcisi", + "req_id": "V10.5.2", + "req_description": "İstemcinin kullanıcıyı ID Token claim’lerinden (genellikle, başka kullanıcılarla yeniden atanamayan 'sub' claim’i) benzersiz şekilde tanımladığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.5", + "section_name": "OIDC İstemcisi", + "req_id": "V10.5.3", + "req_description": "İstemcinin, kötü niyetli bir AS'nin başka bir AS'yi taklit etmesini AS metadata’sı üzerinden reddettiği doğrulanmalıdır. AS metadata’sındaki issuer URL’si, istemci tarafından beklenen önceden yapılandırılmış issuer URL’siyle tam olarak eşleşmiyorsa, metadata reddedilmelidir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.5", + "section_name": "OIDC İstemcisi", + "req_id": "V10.5.4", + "req_description": "İstemcinin, ID Token’ın kendisi için (audience) kullanılması amaçlandığını doğruladığı doğrulanmalıdır. Bu, token’daki 'aud' claim’inin istemcinin 'client_id' değeriyle eşit olup olmadığının kontrol edilmesiyle yapılır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.5", + "section_name": "OIDC İstemcisi", + "req_id": "V10.5.5", + "req_description": "OIDC back-channel logout kullanıldığında, relying party’nin \"forced logout\" ve \"logout\" akışında \"cross-JWT confusion\" gibi saldırılara karşı koruma sağladığı doğrulanmalıdır. Client, logout token’ın 'logout+jwt' türünde olduğunu, 'event' claim’inin doğru üyeye sahip olduğunu ve 'nonce' claim’i içermediğini doğrulamalıdır. Ayrıca token için kısa bir sona erme süresi (örneğin 2 dakika) önerilir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.6", + "section_name": "OpenID Provider", + "req_id": "V10.6.1", + "req_description": "OpenID Provider’ın yalnızca 'code', 'ciba', 'id_token' veya 'id_token code' response mode değerlerine izin verdiği doğrulanmalıdır. 'code' değeri, 'id_token code' (OIDC Hybrid flow) yerine tercih edilmelidir. 'token' (Implicit flow) kullanılmamalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.6", + "section_name": "OpenID Provider", + "req_id": "V10.6.2", + "req_description": "OpenID Provider’ın forced logout yoluyla yapılan hizmet reddi saldırılarını önlediği doğrulanmalıdır. Bu, son kullanıcıdan açık onay alınarak veya varsa logout isteğinde (relying party tarafından başlatılan) bulunan parametrelerin, örneğin 'id_token_hint', doğrulanmasıyla yapılabilir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.7", + "section_name": "Onay (Consent) Yönetimi", + "req_id": "V10.7.1", + "req_description": "AS'nin her yetkilendirme isteği için kullanıcının onayını aldığı doğrulanmalıdır. İstemcinin kimliği garanti altına alınamıyorsa, AS daima kullanıcıdan açıkça onay istemelidir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.7", + "section_name": "Onay (Consent) Yönetimi", + "req_id": "V10.7.2", + "req_description": "AS'nin kullanıcıdan onay istediğinde, neye onay verildiğini açık ve yeterli şekilde gösterdiği doğrulanmalıdır. Uygun olduğunda bu bilgiler, istenen yetkilendirmelerin doğasını (genellikle scope, resource server, RAR gibi detaylara dayalı), yetkilendirilmiş uygulamanın kimliğini ve bu yetkilendirmelerin süresini içermelidir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth ve OIDC", + "section_id": "V10.7", + "section_name": "Onay (Consent) Yönetimi", + "req_id": "V10.7.3", + "req_description": "Kullanıcının, AS üzerinden verdiği onayları görüntüleyebildiği, değiştirebildiği ve iptal edebildiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.1", + "section_name": "Kriptografik Envanter ve Dokümantasyon", + "req_id": "V11.1.1", + "req_description": "Kriptografik anahtarların yönetimi için belgelenmiş bir politika ve NIST SP 800-57 gibi bir anahtar yönetim standardını izleyen bir kriptografik anahtar yaşam döngüsü tanımlandığı doğrulanmalıdır. Bu, anahtarların aşırı miktarda paylaşılmadığını (örneğin, paylaşılan sırlar için ikiden fazla tarafla veya özel anahtarlar için birden fazla tarafla) garanti altına almalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.1", + "section_name": "Kriptografik Envanter ve Dokümantasyon", + "req_id": "V11.1.2", + "req_description": "Tüm kriptografik anahtarlar, algoritmalar ve uygulama tarafından kullanılan sertifikaları içeren bir kriptografik envanterin oluşturulduğu, sürdürüldüğü ve düzenli olarak güncellendiği doğrulanmalıdır. Bu envanter ayrıca, sistemde anahtarların nerede kullanılabileceğini ve kullanılamayacağını, ve hangi veri türlerinin bu anahtarlarla korunup korunamayacağını da belgelemelidir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.1", + "section_name": "Kriptografik Envanter ve Dokümantasyon", + "req_id": "V11.1.3", + "req_description": "Sistem içerisinde şifreleme, özetleme ve imzalama işlemleri dahil olmak üzere kriptografi kullanımının tüm örneklerini tespit etmek için kriptografik keşif mekanizmalarının kullanıldığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.1", + "section_name": "Kriptografik Envanter ve Dokümantasyon", + "req_id": "V11.1.4", + "req_description": "Kriptografik bir envanterin sürdürüldüğü doğrulanmalıdır. Bu envanter, gelecekteki tehditlere karşı tepki verebilmek amacıyla post-kuantum kriptografiye geçiş yolunu belirten belgelenmiş bir plan içermelidir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.2", + "section_name": "Güvenli Kriptografi Uygulaması", + "req_id": "V11.2.1", + "req_description": "Kriptografik işlemler için sektör tarafından doğrulanmış uygulamaların (kütüphaneler ve donanım hızlandırmalı uygulamalar dahil) kullanıldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.2", + "section_name": "Güvenli Kriptografi Uygulaması", + "req_id": "V11.2.2", + "req_description": "Uygulamanın, rastgele sayı üreticileri, kimliği doğrulanmış şifreleme, MAC veya özetleme algoritmaları, anahtar uzunlukları, turlar, şifreler ve modların herhangi bir zamanda yeniden yapılandırılabilir, yükseltilebilir veya değiştirilebilir olacağı şekilde kripto çevikliği (crypto agility) ile tasarlandığı doğrulanmalıdır. Aynı şekilde, anahtarların ve parolaların değiştirilebilmesi ve verilerin yeniden şifrelenebilmesi mümkün olmalıdır. Bu, onaylanmış PQC şemalarının yüksek güvenlikli uygulamaları yaygın olarak kullanılabilir hale geldiğinde sorunsuz geçişe olanak tanır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.2", + "section_name": "Güvenli Kriptografi Uygulaması", + "req_id": "V11.2.3", + "req_description": "Tüm kriptografik ilkeliklerin, algoritma, anahtar boyutu ve yapılandırmaya göre minimum 128 bit güvenlik sağladığı doğrulanmalıdır. Örneğin, 256-bit ECC anahtarı yaklaşık 128 bit güvenlik sağlarken, RSA için aynı güvenliği elde etmek 3072-bit anahtar gerektirir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.2", + "section_name": "Güvenli Kriptografi Uygulaması", + "req_id": "V11.2.4", + "req_description": "Tüm kriptografik işlemlerin sabit süreli (constant-time) olduğu, karşılaştırmalarda, hesaplamalarda veya geri dönüşlerde kısa devre (short-circuit) işlemleri yapılmadığı doğrulanmalıdır; bu, bilgi sızıntısını önlemek için gereklidir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.2", + "section_name": "Güvenli Kriptografi Uygulaması", + "req_id": "V11.2.5", + "req_description": "Tüm kriptografik modüllerin güvenli şekilde hata verdiği ve hataların, padding oracle saldırıları gibi zafiyetleri mümkün kılmayacak şekilde ele alındığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.3", + "section_name": "Şifreleme Algoritmaları", + "req_id": "V11.3.1", + "req_description": "Güvensiz blok modlarının (örneğin, ECB) ve zayıf doldurma (padding) şemalarının (örneğin, PKCS#1 v1.5) kullanılmadığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.3", + "section_name": "Şifreleme Algoritmaları", + "req_id": "V11.3.2", + "req_description": "Yalnızca AES ile GCM gibi onaylı şifreleme algoritmalarının ve modlarının kullanıldığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.3", + "section_name": "Şifreleme Algoritmaları", + "req_id": "V11.3.3", + "req_description": "Şifrelenmiş verilerin yetkisiz değişikliklere karşı korunduğu doğrulanmalıdır. Tercihen bu koruma, onaylı bir kimliği doğrulanmış şifreleme yöntemi kullanılarak ya da onaylı bir şifreleme yöntemi ile onaylı bir MAC algoritmasının kombinasyonu ile sağlanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.3", + "section_name": "Şifreleme Algoritmaları", + "req_id": "V11.3.4", + "req_description": "Sayılar, başlatma vektörleri (IV) ve diğer tek kullanımlık değerlerin, aynı şifreleme anahtarı ve veri öğesi çifti için birden fazla kez kullanılmadığı doğrulanmalıdır. Oluşturma yöntemi kullanılan algoritmaya uygun olmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.3", + "section_name": "Şifreleme Algoritmaları", + "req_id": "V11.3.5", + "req_description": "Şifreleme algoritması ve MAC algoritması kombinasyonlarının \"encrypt-then-MAC\" modunda çalıştığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.4", + "section_name": "Hashing ve Hash Tabanlı Fonksiyonlar", + "req_id": "V11.4.1", + "req_description": "Dijital imzalar, HMAC, KDF ve rastgele bit üretimi gibi genel kriptografik kullanım senaryolarında yalnızca onaylı hash fonksiyonlarının kullanıldığı doğrulanmalıdır. MD5 gibi yasaklı hash fonksiyonları hiçbir kriptografik amaçla kullanılmamalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.4", + "section_name": "Hashing ve Hash Tabanlı Fonksiyonlar", + "req_id": "V11.4.2", + "req_description": "Parolaların, onaylı, hesaplama açısından yoğun ve mevcut rehberliğe göre yapılandırılmış bir anahtar türetme fonksiyonu (diğer adıyla parola hash'leme fonksiyonu) kullanılarak saklandığı doğrulanmalıdır. Ayarlar, güvenlik ve performans dengesini sağlayarak kaba kuvvet saldırılarını zorlaştırmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.4", + "section_name": "Hashing ve Hash Tabanlı Fonksiyonlar", + "req_id": "V11.4.3", + "req_description": "Dijital imzalarda kullanılan hash fonksiyonlarının, veri bütünlüğü ve kimlik doğrulama amacıyla kullanıldığında çakışmaya karşı dayanıklı ve yeterli bit uzunluğuna sahip olduğu doğrulanmalıdır. Çakışma dayanıklılığı gerekiyorsa çıktı uzunluğu en az 256 bit olmalıdır. Sadece ikinci ön-görüntü (2nd pre-iamge) saldırılarına karşı dayanıklılık gerekiyorsa çıktı uzunluğu en az 128 bit olmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.4", + "section_name": "Hashing ve Hash Tabanlı Fonksiyonlar", + "req_id": "V11.4.4", + "req_description": "Parolalardan gizli anahtarlar türetilirken, onaylı anahtar türetme fonksiyonlarının anahtar uzatma (key stretching) parametreleriyle birlikte kullanıldığı doğrulanmalıdır. Bu parametreler, kaba kuvvet saldırılarını önleyecek şekilde güvenlik ve performans dengesine sahip olmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.5", + "section_name": "Rastgele Değerler", + "req_id": "V11.5.1", + "req_description": "Tahmin edilemez olması amaçlanan tüm rastgele sayıların ve dizelerin, CSPRNG ile oluşturulduğu ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. UUID'lerin bu koşulu dikkate almadığını unutmayın.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.5", + "section_name": "Rastgele Değerler", + "req_id": "V11.5.2", + "req_description": "Kullanılan rastgele sayı üretim mekanizmasının, yoğun talep altında dahi güvenli çalışacak şekilde tasarlandığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.6", + "section_name": "Açık Anahtar (Public Key) Kriptografisi", + "req_id": "V11.6.1", + "req_description": "Anahtar üretimi, tohumlama (seeding) ve dijital imza üretimi ve doğrulama için yalnızca onaylı kriptografik algoritmalar ve çalışma modlarının kullanıldığı doğrulanmalıdır. Anahtar üretim algoritmaları, bilinen saldırılara karşı savunmasız anahtarlar üretmemelidir. Örneğin, Fermat çarpanlama yöntemine karşı savunmasız RSA anahtarları oluşturulmamalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.6", + "section_name": "Açık Anahtar (Public Key) Kriptografisi", + "req_id": "V11.6.2", + "req_description": "Anahtar değişimi için yalnızca onaylı kriptografik algoritmaların kullanıldığı doğrulanmalıdır (örneğin Diffie-Hellman). Kullanılan parametrelerin güvenli olması gerektiğine dikkat edilmelidir. Bu, anahtar kurulum sürecine yönelik saldırıları önleyecek ve araya girme (adversary-in-the-middle) ya da kriptografik kırılmaları engelleyecektir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.7", + "section_name": "Kullanım Halindeki Verilerin Kriptografisi", + "req_id": "V11.7.1", + "req_description": "Hassas verilerin kullanım sırasında korunmasını sağlamak amacıyla, yetkisiz kullanıcıların veya süreçlerin bu verilere erişmesini engelleyen tam bellek şifrelemesinin kullanıldığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Kriptografi", + "section_id": "V11.7", + "section_name": "Kullanım Halindeki Verilerin Kriptografisi", + "req_id": "V11.7.2", + "req_description": "Veri asgariyetinin sağlandığı, yani işleme sırasında mümkün olan en az miktarda verinin ortaya çıktığı ve verilerin kullanımdan hemen sonra veya mümkün olan en kısa sürede şifrelendiği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.1", + "section_name": "Genel TLS Güvenlik Rehberi", + "req_id": "V12.1.1", + "req_description": "Yalnızca TLS protokolünün en güncel ve önerilen sürümlerinin (örneğin TLS 1.2 ve TLS 1.3) etkinleştirildiği ve en son sürümün varsayılan olarak tercih edildiği doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.1", + "section_name": "Genel TLS Güvenlik Rehberi", + "req_id": "V12.1.2", + "req_description": "Yalnızca önerilen şifre takımlarının (cipher suite) etkinleştirildiği ve en güçlü şifre takımlarının tercih edildiği doğrulanmalıdır. Seviye 3 (L3) uygulamalar yalnızca ileri gizlilik (forward secrecy) sağlayan şifre takımlarını desteklemelidir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.1", + "section_name": "Genel TLS Güvenlik Rehberi", + "req_id": "V12.1.3", + "req_description": "Uygulamanın, mTLS istemci sertifikalarını kimlik doğrulama veya yetkilendirme amacıyla kullanmadan önce bu sertifikaların güvendiği sertifikalar arasında olduğunu doğruladığı kontrol edilmelidir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.1", + "section_name": "Genel TLS Güvenlik Rehberi", + "req_id": "V12.1.4", + "req_description": "Online Certificate Status Protocol (OCSP) Stapling gibi geçerli bir sertifika iptal kontrolü yönteminin etkinleştirildiği ve yapılandırıldığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.1", + "section_name": "Genel TLS Güvenlik Rehberi", + "req_id": "V12.1.5", + "req_description": "TLS el sıkışma (handshake) sürecinde Server Name Indication (SNI) gibi hassas meta verilerin ifşa edilmesini önlemek için, uygulamanın TLS yapılandırmasında Encrypted Client Hello (ECH) özelliğinin etkinleştirildiği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.2", + "section_name": "Dışa Açık Hizmetlerle HTTPS İletişimi", + "req_id": "V12.2.1", + "req_description": "İstemci ile dışa açık, HTTP tabanlı hizmetler arasındaki tüm bağlantılarda TLS kullanıldığı ve bu bağlantıların güvensiz ya da şifrelenmemiş iletişime geri dönmediği doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.2", + "section_name": "Dışa Açık Hizmetlerle HTTPS İletişimi", + "req_id": "V12.2.2", + "req_description": "Dışa açık hizmetlerin herkese açık olarak güvenilen TLS sertifikaları kullandığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.3", + "section_name": "Genel Servisler Arası İletişim Güvenliği", + "req_id": "V12.3.1", + "req_description": "Uygulamaya gelen ve uygulamadan çıkan tüm bağlantılarda izleme sistemleri, yönetim araçları, uzaktan erişim ve SSH, ara yazılımlar, veritabanları, ana sistemler (mainframe), iş ortağı sistemleri ya da dış API'ler dahil olmak üzere TLS gibi şifreli bir protokolün kullanıldığı ve güvensiz ya da şifrelenmemiş protokollere geri dönülmediği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.3", + "section_name": "Genel Servisler Arası İletişim Güvenliği", + "req_id": "V12.3.2", + "req_description": "TLS istemcilerinin bir TLS sunucusu ile iletişime geçmeden önce alınan sertifikaları doğruladığı kontrol edilmelidir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.3", + "section_name": "Genel Servisler Arası İletişim Güvenliği", + "req_id": "V12.3.3", + "req_description": "Uygulama içindeki HTTP tabanlı iç hizmetler arasında gerçekleşen tüm bağlantılarda TLS ya da uygun başka bir aktarım şifreleme mekanizmasının kullanıldığı ve güvensiz ya da şifrelenmemiş iletişime geri dönülmediği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.3", + "section_name": "Genel Servisler Arası İletişim Güvenliği", + "req_id": "V12.3.4", + "req_description": "İç hizmetler arasındaki TLS bağlantılarında güvenilir sertifikaların kullanıldığı doğrulanmalıdır. İç sistemlerde oluşturulmuş ya da kendinden imzalı (self-signed) sertifikalar kullanılıyorsa, bu sertifikalara güvenen hizmetlerin yalnızca belirli dahili sertifika otoritelerine (CA) ve belirli kendinden imzalı sertifikalara güvenecek şekilde yapılandırıldıkları doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Güvenli İletişim", + "section_id": "V12.3", + "section_name": "Genel Servisler Arası İletişim Güvenliği", + "req_id": "V12.3.5", + "req_description": "Sistem içindeki hizmetlerin birbiriyle iletişim kurarken her bir uç noktanın kimliğini doğrulamak için güçlü kimlik doğrulama yöntemlerinin kullanıldığı doğrulanmalıdır. Bu yöntemler arasında, açık anahtar altyapısı (public-key infrastructure) kullanan ve tekrar oynatma saldırılarına karşı dayanıklı olan TLS istemci kimlik doğrulaması gibi yöntemler yer almalıdır. Mikroservis mimarilerinde, sertifika yönetimini basitleştirmek ve güvenliği artırmak amacıyla bir servis ağı (service mesh) kullanılması değerlendirilmelidir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.1", + "section_name": "Konfigürasyon Dokümantasyonu", + "req_id": "V13.1.1", + "req_description": "Uygulamanın tüm iletişim ihtiyaçlarının dokümante edildiği doğrulanmalıdır. Buna, uygulamanın bağımlı olduğu dış hizmetler ve son kullanıcının uygulamanın bağlantı kurmasını sağlayabileceği dış konumlar da dahil olmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.1", + "section_name": "Konfigürasyon Dokümantasyonu", + "req_id": "V13.1.2", + "req_description": "Uygulamanın kullandığı her bir hizmet için, dokümantasyonda eşzamanlı bağlantı sayısı (örn. bağlantı havuzu limitleri) ve bu sınır aşıldığında uygulamanın davranışı, geri dönüş veya kurtarma mekanizmaları da dahil olmak üzere hizmet reddi koşullarını önlemek için tanımlandığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.1", + "section_name": "Konfigürasyon Dokümantasyonu", + "req_id": "V13.1.3", + "req_description": "Uygulamanın, kullandığı her bir dış sistem veya hizmet (örn. veritabanları, dosya tanıtıcıları, iş parçacıkları, HTTP bağlantıları) için kaynak yönetimi stratejilerini tanımladığı doğrulanmalıdır. Bu stratejiler, kaynak serbest bırakma prosedürlerini, zaman aşımı ayarlarını, hata durumlarını ve tekrar deneme mantığı uygulanmışsa sınırları, gecikmeleri ve geri çekilme (back-off) algoritmalarını içermelidir. Senkron HTTP istek–yanıt işlemleri için kısa zaman aşımı süreleri zorunlu tutulmalı ve tekrar eden denemeler devre dışı bırakılmalı ya da sıkı şekilde sınırlandırılmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.1", + "section_name": "Konfigürasyon Dokümantasyonu", + "req_id": "V13.1.4", + "req_description": "Uygulamanın, güvenlik açısından kritik olan gizli verileri tanımladığı ve kuruluşun tehdit modeli ve iş ihtiyaçlarına göre bu verilerin döndürülme (rotation) zamanlamasının belgelendiği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.2", + "section_name": "Backend İletişim Konfigürasyonu", + "req_id": "V13.2.1", + "req_description": "Uygulamanın, standart kullanıcı oturum mekanizmasını desteklemeyen backend bileşenleri (örneğin API'ler, ara katmanlar, veri katmanları) arasında gerçekleşen iletişimlerin kimlik doğrulamasıyla korunduğu doğrulanmalıdır. Kimlik doğrulama; bireysel hizmet hesapları, kısa ömürlü token'lar ya da sertifika tabanlı kimlik doğrulama ile yapılmalıdır ve parola, API anahtarı ya da ayrıcalıklı erişime sahip paylaşımlı hesaplar gibi sabit kimlik bilgileri kullanılmamalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.2", + "section_name": "Backend İletişim Konfigürasyonu", + "req_id": "V13.2.2", + "req_description": "Uygulamanın backend bileşenleri arasında (yerel hizmetler, işletim sistemi hizmetleri, API'ler, ara katmanlar ve veri katmanları dahil) gerçekleştirilen iletişimlerin, yalnızca gerekli en az ayrıcalığa sahip hesaplarla yapıldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.2", + "section_name": "Backend İletişim Konfigürasyonu", + "req_id": "V13.2.3", + "req_description": "Bir hizmet kimlik doğrulaması için bir kimlik bilgisi kullanılması gerekiyorsa, bu kimlik bilgisinin varsayılan bir değer (örneğin root/root veya admin/admin) olmadığının doğrulanması gereklidir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.2", + "section_name": "Backend İletişim Konfigürasyonu", + "req_id": "V13.2.4", + "req_description": "Uygulamanın iletişim kurmasına izin verilen dış kaynaklar ya da sistemlerin, bir allowlist (izinli liste) ile tanımlandığı doğrulanmalıdır. Bu liste, uygulama katmanında, web sunucusunda, güvenlik duvarında veya farklı katmanların birleşiminde uygulanabilir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.2", + "section_name": "Backend İletişim Konfigürasyonu", + "req_id": "V13.2.5", + "req_description": "Web veya uygulama sunucusunun, dış sistemlere veri veya dosya gönderimi veya yüklemesi yaparken sadece belirli kaynaklara izin verecek şekilde allowlist ile yapılandırıldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.2", + "section_name": "Backend İletişim Konfigürasyonu", + "req_id": "V13.2.6", + "req_description": "Uygulamanın farklı hizmetlere bağlantı kurduğu durumlarda, bu bağlantılar için belgelenmiş yapılandırmaları (örn. maksimum eşzamanlı bağlantı, bağlantı limiti aşıldığında davranış, zaman aşımı, tekrar deneme stratejileri) takip ettiğinin doğrulanması gereklidir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.3", + "section_name": "Gizli Bilgi Yönetimi", + "req_id": "V13.3.1", + "req_description": "Parolalar, anahtar materyalleri, veritabanı ve üçüncü parti sistemlerle entegrasyon bilgileri, zaman tabanlı token'lar için tohum (seed) bilgileri, dahili gizli veriler ve API anahtarları gibi backend sırlarının güvenli bir şekilde oluşturulması, saklanması, erişim denetiminin sağlanması ve imha edilmesi için bir gizli bilgi yönetim çözümünün (örneğin key vault) kullanıldığı doğrulanmalıdır. Bu gizli bilgiler uygulama kaynak koduna dahil edilmemeli ve yapı çıktılarında yer almamalıdır. Seviye 3 uygulamalar için donanım destekli bir çözüm (örneğin HSM) gereklidir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.3", + "section_name": "Gizli Bilgi Yönetimi", + "req_id": "V13.3.2", + "req_description": "Gizli bilgilere erişimin en az ayrıcalık prensibine uygun şekilde yapılandırıldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.3", + "section_name": "Gizli Bilgi Yönetimi", + "req_id": "V13.3.3", + "req_description": "Tüm kriptografik işlemlerin, anahtar materyallerinin güvenli bir şekilde yönetilmesi ve dışarıya sızmasının engellenmesi amacıyla, izole edilmiş bir güvenlik modülü (örneğin vault ya da donanım güvenlik modülü) aracılığıyla gerçekleştirildiği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.3", + "section_name": "Gizli Bilgi Yönetimi", + "req_id": "V13.3.4", + "req_description": "Uygulamanın belgelerinde belirtildiği şekilde gizli bilgilerin süresinin dolacak şekilde yapılandırıldığı ve düzenli olarak döndürüldüğü doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.4", + "section_name": "İstenmeyen Bilgi Sızıntısı", + "req_id": "V13.4.1", + "req_description": "Uygulamanın .git veya .svn klasörleri gibi kaynak kontrolüyle ilgili metadata içermeyecek şekilde deploy edildiğini ya da bu klasörlerin hem dış erişime hem de uygulama erişimine kapalı olduğu doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.4", + "section_name": "İstenmeyen Bilgi Sızıntısı", + "req_id": "V13.4.2", + "req_description": "Tüm bileşenler için üretim ortamlarında hata ayıklama (debug) modlarının devre dışı bırakıldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.4", + "section_name": "İstenmeyen Bilgi Sızıntısı", + "req_id": "V13.4.3", + "req_description": "Web sunucularının, açık şekilde istenmediği sürece dizin listelemesi (directory listing) özelliğini istemcilere sunmadığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.4", + "section_name": "İstenmeyen Bilgi Sızıntısı", + "req_id": "V13.4.4", + "req_description": "HTTP TRACE metodunun üretim ortamlarında desteklenmediği, böylece potansiyel bilgi sızıntılarının önlendiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.4", + "section_name": "İstenmeyen Bilgi Sızıntısı", + "req_id": "V13.4.5", + "req_description": "Belgeler (örneğin dahili API belgeleri) ve izleme uç noktalarının (monitoring endpoints) yalnızca açıkça belirtildiği durumlarda erişilebilir olduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.4", + "section_name": "İstenmeyen Bilgi Sızıntısı", + "req_id": "V13.4.6", + "req_description": "Uygulamanın arka uç bileşenlerinin ayrıntılı sürüm bilgilerini ifşa etmediği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Konfigürasyon", + "section_id": "V13.4", + "section_name": "İstenmeyen Bilgi Sızıntısı", + "req_id": "V13.4.7", + "req_description": "Web katmanının yalnızca belirli dosya uzantılarına sahip dosyaları sunacak şekilde yapılandırıldığı, bu sayede istem dışı bilgi, yapılandırma ya da kaynak kod sızıntılarının önlendiği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.1", + "section_name": "Veri Koruma Dokümantasyonu", + "req_id": "V14.1.1", + "req_description": "Uygulama tarafından oluşturulan ve işlenen tüm hassas verilerin tanımlanıp, koruma seviyelerine göre sınıflandırıldığından emin olun. Bu, yalnızca kodlanmış (örneğin Base64 stringleri ya da JWT içindeki düz metin yükler gibi) ve bu nedenle kolayca çözülebilir verileri de içermelidir. Koruma seviyeleri, uygulamanın uymakla yükümlü olduğu veri koruma ve gizlilik düzenlemeleri ile standartlarını dikkate almalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.1", + "section_name": "Veri Koruma Dokümantasyonu", + "req_id": "V14.1.2", + "req_description": "Tüm hassas veri koruma seviyeleri için belgelenmiş bir koruma gereksinimleri seti tanımlandığından emin olun. Bu gereksinimler genel şifreleme, bütünlük doğrulama, saklama süresi, verinin nasıl günlüğe kaydedileceği, günlüklerdeki hassas verilere erişim kontrolleri, veritabanı düzeyinde şifreleme, gizlilik ve gizliliği artırıcı teknolojiler ile diğer gizlilik gereksinimlerini kapsamalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.2", + "section_name": "Genel Veri Koruması", + "req_id": "V14.2.1", + "req_description": "Hassas verilerin yalnızca HTTP message body veya header alanlarında sunucuya gönderildiği ve URL ile sorgu parametrelerinin, API anahtarı veya session token’ı gibi hassas bilgiler içermediği doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.2", + "section_name": "Genel Veri Koruması", + "req_id": "V14.2.2", + "req_description": "Hassas verilerin, yük dengeleyiciler ve uygulama önbellekleri gibi sunucu bileşenlerinde önbelleğe alınmasının engellendiği veya kullanım sonrası bu verilerin güvenli biçimde temizlendiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.2", + "section_name": "Genel Veri Koruması", + "req_id": "V14.2.3", + "req_description": "Uygulama kontrolü dışında veri toplanmasını engellemek için, tanımlanmış hassas verilerin, kullanıcı izleyicileri gibi güvensiz taraflara gönderilmediği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.2", + "section_name": "Genel Veri Koruması", + "req_id": "V14.2.4", + "req_description": "Hassas verilere yönelik şifreleme, bütünlük doğrulama, veri saklama, loglama yöntemi, loglardaki erişim kontrolleri, gizlilik teknolojileri gibi kontrollerin, söz konusu verinin belgelenmiş koruma seviyesinde tanımlandığı şekilde uygulandığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.2", + "section_name": "Genel Veri Koruması", + "req_id": "V14.2.5", + "req_description": "Önbellekleme mekanizmalarının yalnızca belirli içerik türüne sahip yanıtları önbelleğe alacak şekilde yapılandırıldığı ve hassas, dinamik içeriklerin önbelleğe alınmadığı doğrulanmalıdır. Web sunucusu, mevcut olmayan bir dosya talebinde geçerli ama farklı bir dosya döndürmek yerine 404 veya 302 cevabı vermelidir. Bu, Web Cache Deception saldırılarını önlemeye yardımcı olur.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.2", + "section_name": "Genel Veri Koruması", + "req_id": "V14.2.6", + "req_description": "Uygulamanın yalnızca işlevsellik için gerekli olan asgari hassas veriyi döndürdüğü doğrulanmalıdır. Örneğin, kredi kartı numarasının yalnızca bazı rakamlarının döndürülmesi; tam numaranın döndürülmesi gerekiyorsa, kullanıcı arayüzünde gizlenmiş (maskelenmiş) şekilde sunulması gerekir, aksi kullanıcı özel olarak görüntülemek istemedikçe gösterilmemelidir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.2", + "section_name": "Genel Veri Koruması", + "req_id": "V14.2.7", + "req_description": "Hassas bilgilerin, veri saklama sınıflandırmasına tabi tutulduğu, geçerliliğini yitirmiş veya artık gerekli olmayan verilerin belirlenmiş bir zaman çizelgesiyle ya da gerektiğinde otomatik olarak silindiği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.2", + "section_name": "Genel Veri Koruması", + "req_id": "V14.2.8", + "req_description": "Kullanıcı tarafından yüklenen dosyaların meta verilerinden hassas bilgilerin çıkarıldığı veya bu bilgilerin yalnızca kullanıcıdan açık onay alındığında saklandığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.3", + "section_name": "İstemci Tarafı Veri Koruması", + "req_id": "V14.3.1", + "req_description": "Kimliği doğrulanmış verilerin, istemci veya oturum sonlandığında istemci depolamasından (örneğin tarayıcı DOM’undan) temizlendiği doğrulanmalıdır. 'Clear-Site-Data' HTTP response header bu konuda yardımcı olabilir ancak istemci tarafı, sunucu bağlantısı mevcut olmadığında da temizlik işlemini yapabiliyor olmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.3", + "section_name": "İstemci Tarafı Veri Koruması", + "req_id": "V14.3.2", + "req_description": "Uygulamanın, tarayıcılarda hassas verilerin önbelleğe alınmasını önlemek amacıyla yeterli anti-önbellekleme HTTP response header (örneğin Cache-Control: no-store) ayarladığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Veri Koruma", + "section_id": "V14.3", + "section_name": "İstemci Tarafı Veri Koruması", + "req_id": "V14.3.3", + "req_description": "Tarayıcıda depolanan verilerin (örneğin localStorage, sessionStorage, IndexedDB veya çerezler) hassas veri içermediği, yalnızca session token’larının istisna olarak kabul edildiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.1", + "section_name": "Güvenli Kodlama ve Mimari Dokümantasyonu", + "req_id": "V15.1.1", + "req_description": "Güvenlik açığı içeren üçüncü taraf bileşen sürümleri ve genel olarak kütüphane güncellemeleri için, uygulama dokümantasyonunda risk bazlı düzeltme zamanlarının tanımlandığı doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.1", + "section_name": "Güvenli Kodlama ve Mimari Dokümantasyonu", + "req_id": "V15.1.2", + "req_description": "Yazılım bileşen listesi (Software Bill of Materials - SBOM) gibi bir envanterin tutulduğu, kullanılan tüm üçüncü taraf kütüphanelerin önceden tanımlanmış, güvenilir ve düzenli olarak güncellenen depolardan alındığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.1", + "section_name": "Güvenli Kodlama ve Mimari Dokümantasyonu", + "req_id": "V15.1.3", + "req_description": "Uygulama dokümantasyonunda zaman veya kaynak açısından yoğun işlevlerin tanımlandığı, bu işlevlerin aşırı kullanımı durumunda kullanılabilirlik kaybının nasıl önleneceği ve yanıt oluşturma süresinin istemci zaman aşımını aşmaması için hangi önlemlerin alındığı belirtilmelidir. Örnek savunmalar kuyruklama, eşzamansız işleme, kullanıcı başına ve uygulama genelinde paralel işlem sınırlarını içerebilir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.1", + "section_name": "Güvenli Kodlama ve Mimari Dokümantasyonu", + "req_id": "V15.1.4", + "req_description": "Uygulama dokümantasyonunda \"riskli bileşenler\" olarak değerlendirilen üçüncü taraf kütüphanelerin vurgulandığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.1", + "section_name": "Güvenli Kodlama ve Mimari Dokümantasyonu", + "req_id": "V15.1.5", + "req_description": "Uygulama dokümantasyonunda \"tehlikeli işlevsellik\" içeren uygulama bölümlerinin açıkça belirtildiği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.2", + "section_name": "Güvenlik Mimarisi ve Bağımlılıklar", + "req_id": "V15.2.1", + "req_description": "Uygulamanın yalnızca, belgelenmiş güncelleme ve düzeltme sürelerini aşmamış bileşenleri içerdiği doğrulanmalıdır.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.2", + "section_name": "Güvenlik Mimarisi ve Bağımlılıklar", + "req_id": "V15.2.2", + "req_description": "Uygulamanın, belgelenmiş güvenlik kararları ve stratejilere dayanarak, zaman veya kaynak açısından yoğun işlevlerin neden olabileceği kullanılabilirlik kaybına karşı savunmalar uyguladığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.2", + "section_name": "Güvenlik Mimarisi ve Bağımlılıklar", + "req_id": "V15.2.3", + "req_description": "Üretim ortamının yalnızca uygulamanın çalışması için gerekli işlevleri içerdiği ve test kodları, örnek kod parçaları veya geliştirme işlevleri gibi gereksiz işlevsellikleri açığa çıkarmadığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.2", + "section_name": "Güvenlik Mimarisi ve Bağımlılıklar", + "req_id": "V15.2.4", + "req_description": "Üçüncü taraf bileşenlerin ve bunların tüm transitif bağımlılıklarının beklenen depolardan (iç kaynaklı ya da harici) alındığı ve bağımlılık karışıklığı (dependency confusion) saldırılarına açık olmadığı doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.2", + "section_name": "Güvenlik Mimarisi ve Bağımlılıklar", + "req_id": "V15.2.5", + "req_description": "Uygulamanın, “tehlikeli işlevsellik” içeren veya “riskli bileşenler” kullanan bölümlerine ek korumalar uyguladığı doğrulanmalıdır. Bu korumalar sandbox, kapsülleme, konteynerleştirme veya ağ düzeyinde izolasyon gibi teknikler aracılığıyla, bir uygulama bölümünün ele geçirilmesi durumunda saldırganın diğer bölümlere sıçramasını geciktirmeyi veya engellemeyi amaçlamalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.3", + "section_name": "Savunmacı Kodlama", + "req_id": "V15.3.1", + "req_description": "Uygulamanın yalnızca gerekli alanların bir alt kümesini veri nesnesinden döndürdüğü doğrulanmalıdır. Örneğin, bazı alanlara kullanıcıların erişmemesi gerektiğinden tüm veri nesnesi döndürülmemelidir.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.3", + "section_name": "Savunmacı Kodlama", + "req_id": "V15.3.2", + "req_description": "Uygulama backend'i harici URL’lere çağrı yaptığında, yalnızca amaçlanan işlevsellik söz konusuysa yönlendirmeleri takip edecek şekilde yapılandırıldığının doğrulanması gerekir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.3", + "section_name": "Savunmacı Kodlama", + "req_id": "V15.3.3", + "req_description": "Uygulamanın, kitlesel atama saldırılarına karşı, her bir controller ve eylem için izin verilen alanları sınırlandırarak savunmalar sağladığı doğrulanmalıdır. Örneğin, bir alan değeri, bu işlemde değiştirilmesi amaçlanmadıysa eklenememeli veya güncellenememelidir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.3", + "section_name": "Savunmacı Kodlama", + "req_id": "V15.3.4", + "req_description": "Tüm proxy ve ara katman bileşenlerinin kullanıcının orijinal IP adresini, uç kullanıcı tarafından değiştirilemeyecek güvenilir veri alanları kullanarak doğru şekilde ilettiği ve uygulamanın ve web sunucusunun bu doğru değeri, loglama ve hız sınırlama gibi güvenlik kararları için kullandığı doğrulanmalıdır. Ayrıca, orijinal IP adresinin bile dinamik IP'ler, VPN'ler veya kurumsal güvenlik duvarları nedeniyle güvenilir olmayabileceği dikkate alınmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.3", + "section_name": "Savunmacı Kodlama", + "req_id": "V15.3.5", + "req_description": "Uygulamanın değişkenlerin doğru türde olduğunu açıkça doğruladığı ve sıkı eşitlik ve karşılaştırma işlemleri kullandığı doğrulanmalıdır. Bu, değişken türüyle ilgili varsayımlardan kaynaklanan tür oynama (type juggling) veya tür karışıklığı (type confusion) güvenlik açıklarını önlemek içindir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.3", + "section_name": "Savunmacı Kodlama", + "req_id": "V15.3.6", + "req_description": "JavaScript kodunun prototip zehirleme (prototype pollution) saldırılarını önleyecek şekilde yazıldığı, örneğin, nesne literal’leri yerine Set() veya Map() gibi yapılar kullanıldığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.3", + "section_name": "Savunmacı Kodlama", + "req_id": "V15.3.7", + "req_description": "Uygulamanın, özellikle framework'ün istek parametrelerinin kaynağı (sorgu dizgisi, gövde parametreleri, çerezler veya başlık alanları) arasında ayrım yapmadığı durumlarda, HTTP parametre kirliliği (HTTP parameter pollution) saldırılarına karşı savunmalar uyguladığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.4", + "section_name": "Güvenli Eş Zamanlılık (Concurrency)", + "req_id": "V15.4.1", + "req_description": "Çok iş parçacıklı kodda (örneğin cache'ler, dosyalar veya birden fazla iş parçacığı tarafından erişilen bellek içi nesneler gibi) paylaşılan nesnelere yalnızca thread-safe (iş parçacığı güvenli) türler ve kilitleme (lock) veya semaphore gibi senkronizasyon mekanizmaları kullanılarak erişildiği doğrulanmalıdır. Bu, yarış durumlarını ve veri bozulmasını önlemeye yöneliktir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.4", + "section_name": "Güvenli Eş Zamanlılık (Concurrency)", + "req_id": "V15.4.2", + "req_description": "Bir kaynağın durumu üzerindeki kontroller (örneğin varlığı ya da izinleri gibi) ile bu kontrole bağlı eylemlerin tek bir atomik işlem olarak gerçekleştirildiği doğrulanmalıdır. Bu, TOCTOU (time-of-check to time-of-use) yarış durumlarını önlemeye yöneliktir. Bir dosyanın varlığının kontrol edilip ardından açılması veya bir kullanıcının erişiminin doğrulanıp ardından yetki verilmesi gibi işlemler buna örnektir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.4", + "section_name": "Güvenli Eş Zamanlılık (Concurrency)", + "req_id": "V15.4.3", + "req_description": "Kilitlerin (locks) tutarlı biçimde kullanıldığı, iş parçacıklarının birbirini beklemesi ya da sonsuz döngüye girmesi (deadlock veya livelock) gibi durumların önlendiği doğrulanmalıdır. Ayrıca, kilitleme mantığı, kaynağı yöneten kod içinde kalmalı ve dış sınıflar veya dış kodlar tarafından istemeden veya kötü niyetli şekilde değiştirilememelidir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Güvenli Kodlama ve Mimari", + "section_id": "V15.4", + "section_name": "Güvenli Eş Zamanlılık (Concurrency)", + "req_id": "V15.4.4", + "req_description": "Kaynak tahsis politikalarının, iş parçacığı açlığını önleyecek şekilde, kaynaklara adil erişimi sağladığı doğrulanmalıdır. Örneğin, thread pool (iş parçacığı havuzu) kullanımı, düşük öncelikli iş parçacıklarının da makul sürelerde çalışabilmesi için uygulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.1", + "section_name": "Güvenlik Loglaması Dokümantasyonu", + "req_id": "V16.1.1", + "req_description": "Uygulamanın teknoloji yığını boyunca her katmanda hangi olayların loglandığını, log formatlarını, logların nereye yazıldığını, nasıl kullanıldığını, erişimin nasıl kontrol edildiğini ve logların ne kadar süre saklandığını belgeleyen bir envanterin mevcut olduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.2", + "section_name": "Genel Loglama", + "req_id": "V16.2.1", + "req_description": "Her bir log girdisinin, olayın ne zaman, nerede, kim tarafından ve ne olduğuna dair detaylı bir zaman çizelgesi oluşturulmasına olanak tanıyacak gerekli meta verileri içerdiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.2", + "section_name": "Genel Loglama", + "req_id": "V16.2.2", + "req_description": "Tüm loglama bileşenlerinin zaman kaynaklarının senkronize olduğu ve güvenlik olayı meta verisindeki zaman damgalarının UTC kullanarak ya da açık zaman dilimi ofsetiyle belirtildiği doğrulanmalıdır. UTC kullanımı, özellikle yaz saati uygulamaları nedeniyle oluşabilecek karışıklıkları önlemek için tavsiye edilir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.2", + "section_name": "Genel Loglama", + "req_id": "V16.2.3", + "req_description": "Uygulamanın yalnızca log envanterinde belgelenmiş dosya ve hizmetlere log yazdığı ya da ilettiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.2", + "section_name": "Genel Loglama", + "req_id": "V16.2.4", + "req_description": "Logların kullanılan log işleyici (log processor) tarafından okunabildiği ve ilişkilendirilebildiği doğrulanmalıdır. Tercihen yaygın bir log formatı kullanılmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.2", + "section_name": "Genel Loglama", + "req_id": "V16.2.5", + "req_description": "Hassas veriler loglanırken, uygulamanın veri koruma seviyesine uygun olarak loglama yaptığı doğrulanmalıdır. Örneğin kimlik bilgileri veya ödeme detayları gibi bazı verilerin loglanmasına izin verilmemelidir. Session token’ları gibi veriler ise yalnızca tamamen ya da kısmen maskelenmiş ya da hash’lenmiş olarak loglanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.3", + "section_name": "Güvenlik Olayları", + "req_id": "V16.3.1", + "req_description": "Tüm kimlik doğrulama işlemlerinin (başarılı ve başarısız girişimler dahil) loglandığı doğrulanmalıdır. Kullanılan kimlik doğrulama türü veya faktörleri gibi ek meta veriler de toplanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.3", + "section_name": "Güvenlik Olayları", + "req_id": "V16.3.2", + "req_description": "Başarısız yetkilendirme girişimlerinin loglandığı doğrulanmalıdır. Seviye 3 uygulamalar için, tüm yetkilendirme kararlarının ve hassas verilere erişim olaylarının (verinin kendisi olmadan) loglandığı da doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.3", + "section_name": "Güvenlik Olayları", + "req_id": "V16.3.3", + "req_description": "Uygulamanın, belgelenmiş güvenlik olaylarını ve güvenlik kontrollerini aşma girişimlerini (girdi doğrulama, iş mantığı, otomasyon karşıtı kontroller vb.) logladığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.3", + "section_name": "Güvenlik Olayları", + "req_id": "V16.3.4", + "req_description": "Beklenmeyen hatalar ve güvenlik kontrolü başarısızlıkları (örneğin backend TLS hataları gibi) loglandığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.4", + "section_name": "Log Koruması", + "req_id": "V16.4.1", + "req_description": "Tüm loglama bileşenlerinin, log enjeksiyonunu (log injection) önlemek amacıyla verileri uygun biçimde encode ettiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.4", + "section_name": "Log Koruması", + "req_id": "V16.4.2", + "req_description": "Logların yetkisiz erişime karşı korunduğu ve değiştirilemez olduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.4", + "section_name": "Log Koruması", + "req_id": "V16.4.3", + "req_description": "Logların analiz, tespit, uyarı ve yükseltme amacıyla mantıksal olarak ayrı bir sisteme güvenli biçimde iletildiği doğrulanmalıdır. Böylece uygulama ihlal edilse bile logların tehlikeye girmesi önlenmiş olur.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.5", + "section_name": "Hata Yönetimi", + "req_id": "V16.5.1", + "req_description": "Beklenmedik ya da güvenlikle ilgili bir hata oluştuğunda, tüketiciye genel bir mesaj döndürüldüğü ve yığın izleri (stack trace), sorgular, gizli anahtarlar, token’lar gibi hassas sistem içi verilerin açıklanmadığı doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.5", + "section_name": "Hata Yönetimi", + "req_id": "V16.5.2", + "req_description": "Uygulamanın, dış kaynaklara erişim başarısız olduğunda bile güvenli şekilde çalışmaya devam ettiği doğrulanmalıdır. Örneğin, circuit breaker ya da graceful degradation gibi desenler kullanılmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.5", + "section_name": "Hata Yönetimi", + "req_id": "V16.5.3", + "req_description": "Uygulamanın hata durumlarında güvenli ve düzenli şekilde başarısız olduğu doğrulanmalıdır. Bu, örneğin doğrulama hatalarına rağmen işlemlerin işlenmesine yol açabilecek fail-open durumlarını önlemelidir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "section_id": "V16.5", + "section_name": "Hata Yönetimi", + "req_id": "V16.5.4", + "req_description": "Ele alınmamış tüm istisnaları yakalayacak şekilde tanımlanmış bir “son çare hata yöneticisi” bulunduğu doğrulanmalıdır. Bu, hem loglara gitmesi gereken hata detaylarının kaybolmaması hem de tüm uygulama sürecinin çökerek hizmet dışı kalmasının önlenmesi açısından önemlidir.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.1", + "section_name": "TURN Sunucusu", + "req_id": "V17.1.1", + "req_description": "TURN hizmetinin yalnızca özel amaçlar için ayrılmamış IP adreslerine (ör. iç ağlar, yayın adresleri, loopback) erişime izin verdiği doğrulanmalıdır. Bu gereksinim hem IPv4 hem de IPv6 adresleri için geçerlidir.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.1", + "section_name": "TURN Sunucusu", + "req_id": "V17.1.2", + "req_description": "TURN hizmetinin, meşru kullanıcıların sunucuda çok sayıda bağlantı noktası açmaya çalışması durumunda kaynak tüketimi saldırılarına karşı dayanıklı olduğu doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Medya", + "req_id": "V17.2.1", + "req_description": "DTLS sertifikası anahtarının, belgelenmiş kriptografik anahtar yönetim politikasına uygun şekilde yönetildiği ve korunduğu doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Medya", + "req_id": "V17.2.2", + "req_description": "Medya sunucusunun onaylı DTLS şifre takımlarını (cipher suites) ve Güvenli Gerçek Zamanlı Aktarım Protokolü (Secure Real-time Transport Protocol - SRTP) için anahtarlar oluşturmaya yönelik DTLS Uzantısı için güvenli bir koruma profilini kullanacak ve destekleyecek şekilde yapılandırıldığı (DTLS-SRTP) doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Medya", + "req_id": "V17.2.3", + "req_description": "Real-time Transport Protocol (RTP) injection saldırılarının bir hizmet reddi durumuna veya medya akışlarına ses veya video medyası eklenmesine yol açmasını önlemek için medya sunucusunda Güvenli SRTP kimlik doğrulamasının kontrol edildiği doğrulanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Medya", + "req_id": "V17.2.4", + "req_description": "Verify that the media server is able to continue processing incoming media traffic when encountering malformed Secure Real-time Transport Protocol (SRTP) packets.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Medya", + "req_id": "V17.2.5", + "req_description": "Medya sunucusunun, meşru kullanıcılardan gelen SRTP flood'ı sırasında gelen medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Medya", + "req_id": "V17.2.6", + "req_description": "Medya sunucusunun DTLS içinde yer alan \"ClientHello\" yarış durumu güvenlik açığına karşı savunmasız olmadığı, medya sunucusunun güvenlik açığına sahip olduğunun açıkça bilinip bilinmediği kontrol edilerek veya yarış koşulu testi gerçekleştirilerek doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Medya", + "req_id": "V17.2.7", + "req_description": "Medya sunucusuna bağlı ses veya video kayıt mekanizmalarının, meşru kullanıcı kaynaklı SRTP flood'ı sırasında medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Medya", + "req_id": "V17.2.8", + "req_description": "DTLS sertifikasının, SDP (Session Description Protocol) fingerprint özelliği ile karşılaştırıldığı ve doğrulama başarısız olursa medya akışının sonlandırıldığı, medya akışının özgünlüğünü sağlamak için doğrulanmalıdır.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.3", + "section_name": "Sinyalizasyon", + "req_id": "V17.3.1", + "req_description": "Sinyalizasyon sunucusunun, flood saldırısı altında bile meşru sinyalizasyon mesajlarını işlemeye devam edebildiği doğrulanmalıdır. Bu, sinyalizasyon düzeyinde oran sınırlaması uygulanarak sağlanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.3", + "section_name": "Sinyalizasyon", + "req_id": "V17.3.2", + "req_description": "Sinyalizasyon sunucusunun, hizmet reddine yol açabilecek şekilde yapılandırılmış bozuk sinyalizasyon mesajlarıyla karşılaştığında bile meşru mesajları işlemeye devam edebildiği doğrulanmalıdır. Bu, girdi doğrulaması, integer overflow ve buffer overflow'a karşı savunma ve sağlam hata işleme teknikleri ile sağlanmalıdır.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + } + ] +} diff --git a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.json b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.json new file mode 100644 index 0000000000..e5bc5ab39c --- /dev/null +++ b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.json @@ -0,0 +1,2750 @@ +{ + "Name": "Application Security Verification Standard Project", + "ShortName": "ASVS", + "Version": "", + "Description": "The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.", + "Requirements": [ + { + "Shortcode": "V1", + "Ordinal": 1, + "ShortName": "Encoding", + "Name": "Kodlama (Encoding) ve Temizleme", + "Items": [ + { + "Shortcode": "V1.1", + "Ordinal": 1, + "Name": "Kodlama ve Temizleme Mimarisi", + "Items": [ + { + "Shortcode": "V1.1.1", + "Ordinal": 1, + "Description": "Girdinin yalnızca bir kez kanonik forma (canonical form) çözümlendiği veya kaçış işlemlerinin kaldırıldığı, bu işlemin yalnızca verinin bu biçimde beklenmesi durumunda yapıldığı ve bu işlemin girdi doğrulama veya temizleme işlemlerinden sonra değil, önce gerçekleştiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V1.1.2", + "Ordinal": 2, + "Description": "Uygulamanın, çıktıyı kullanılması gereken yorumlayıcıya verilmeden hemen önce veya yorumlayıcının kendisi tarafından çıktı kodlaması ya da kaçış işlemi yaptığı doğrulanmalıdır.", + "L": "2" + } + ] + }, + { + "Shortcode": "V1.2", + "Ordinal": 2, + "Name": "Enjeksiyon Önleme", + "Items": [ + { + "Shortcode": "V1.2.1", + "Ordinal": 1, + "Description": "HTTP yanıtı, HTML veya XML belgesi için yapılan çıktı kodlamasının; HTML elemanları, HTML öznitelikleri, HTML yorumları, CSS ya da HTTP başlık alanları gibi bağlamlara uygun olduğu doğrulanmalıdır. Böylece mesaj veya belge yapısının bozulması önlenir.", + "L": "1" + }, + { + "Shortcode": "V1.2.2", + "Ordinal": 2, + "Description": "Dinamik olarak URL oluşturulurken, güvenilmeyen verinin bağlamına göre (örneğin, sorgu veya yol parametreleri için URL kodlaması ya da base64url kodlaması) kodlandığı doğrulanmalıdır. Yalnızca güvenli URL protokollerine izin verilmelidir (örneğin, javascript: veya data: yasaklanmalıdır).", + "L": "1" + }, + { + "Shortcode": "V1.2.3", + "Ordinal": 3, + "Description": "JavaScript içeriği (JSON dahil) dinamik olarak oluşturulurken çıktı kodlama/kaçış kullanıldığı doğrulanmalıdır. Böylece mesaj veya belge yapısı değiştirilmemiş olur (JavaScript ve JSON enjeksiyonlarının önüne geçilir).", + "L": "1" + }, + { + "Shortcode": "V1.2.4", + "Ordinal": 4, + "Description": "Veri sorguları veya veritabanı sorguları (SQL, HQL, NoSQL, Cypher vb.) için parametreli sorgular, ORM’ler, entity framework’ler kullanıldığı ya da SQL enjeksiyonu ve diğer veritabanı enjeksiyon saldırılarına karşı koruma sağlandığı doğrulanmalıdır. Bu durum, saklı yordam (stored procedure) yazarken de geçerlidir.", + "L": "1" + }, + { + "Shortcode": "V1.2.5", + "Ordinal": 5, + "Description": "Uygulamanın işletim sistemi komut enjeksiyonlarına karşı korunduğu ve işletim sistemi çağrılarında parametreli OS sorguları veya bağlama özgü komut satırı çıktı kodlamasının kullanıldığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V1.2.6", + "Ordinal": 6, + "Description": "Uygulamanın LDAP enjeksiyon zafiyetlerine karşı korunduğu ya da LDAP enjeksiyonlarını önlemek için özel güvenlik kontrollerinin uygulandığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V1.2.7", + "Ordinal": 7, + "Description": "XPath enjeksiyon saldırılarına karşı, sorgu parametrelemesi veya önceden derlenmiş sorgular kullanılarak koruma sağlandığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V1.2.8", + "Ordinal": 8, + "Description": "LaTeX işlemcilerinin güvenli şekilde yapılandırıldığı (örneğin, --shell-escape bayrağının kullanılmadığı) ve yalnızca izin verilen komutlardan oluşan bir listeyle çalıştırıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V1.2.9", + "Ordinal": 9, + "Description": "Düzenli ifadelerde (regex) özel karakterlerin (genellikle ters eğik çizgi \\ ile) kaçırılarak meta karakter olarak yorumlanmalarının önlendiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V1.2.10", + "Ordinal": 10, + "Description": "Uygulamanın CSV ve formül enjeksiyonlarına karşı korunduğu doğrulanmalıdır. Uygulama, CSV içeriği dışa aktarırken RFC 4180 Bölüm 2.6 ve 2.7'de tanımlanan kaçış kurallarına uymalıdır. Ayrıca, CSV veya diğer tablo formatlarına (XLS, XLSX, ODF gibi) aktarım yapılırken, alanın ilk karakteri olarak çıkan özel karakterler ('=', '+', '-', '@', '\\t' (sekme), '\\0' (null karakter)) tek tırnak (') ile kaçırılmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V1.3", + "Ordinal": 3, + "Name": "Temizleme (Sanitization)", + "Items": [ + { + "Shortcode": "V1.3.1", + "Ordinal": 1, + "Description": "WYSIWYG editörlerinden veya benzer kaynaklardan gelen tüm güvenilmeyen HTML girdilerinin, bilinen ve güvenli bir HTML temizleme kütüphanesi ya da çerçeve özelliği ile temizlendiği doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V1.3.2", + "Ordinal": 2, + "Description": "Uygulamanın eval() veya Spring Expression Language (SpEL) gibi dinamik kod çalıştırma özelliklerini kullanmaktan kaçındığı doğrulanmalıdır. Alternatif yoksa, kullanıcı girdisi çalıştırılmadan önce mutlaka temizlenmelidir.", + "L": "1" + }, + { + "Shortcode": "V1.3.3", + "Ordinal": 3, + "Description": "Potansiyel olarak tehlikeli bir bağlamda kullanılacak verilerin, bu bağlama uygun karakterlere izin vermek ve çok uzun girdileri kısaltmak gibi güvenlik önlemleriyle önceden temizlendiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V1.3.4", + "Ordinal": 4, + "Description": "Kullanıcı tarafından sağlanan SVG içeriğinin, yalnızca güvenli etiket ve özellikler (örneğin grafik çizme ile ilgili) içerdiğinden emin olmak için onaylandığı veya temizlendiği doğrulanmalıdır (ör. script veya foreignObject içermemelidir).", + "L": "2" + }, + { + "Shortcode": "V1.3.5", + "Ordinal": 5, + "Description": "Markdown, CSS, XSL stil sayfaları, BBCode veya benzeri ifade şablon dillerinde kullanıcı girdisinin temizlendiği veya bu tür özelliklerin devre dışı bırakıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V1.3.6", + "Ordinal": 6, + "Description": "Uygulamanın, güvenilmeyen verileri başka servislere iletmeden önce izinli protokol, alan adı, yol ve port listelerine göre doğruladığı ve tehlikeli karakterleri temizlediği doğrulanarak SSRF (Sunucu Taraflı İstek Sahteciliği) saldırılarına karşı korunduğu doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V1.3.7", + "Ordinal": 7, + "Description": "Uygulamanın şablon enjeksiyon saldırılarına karşı, güvenilmeyen girdilere dayalı şablon oluşturmayı engellediği; eğer bu kaçınılmazsa, bu girdilerin mutlaka temizlendiği veya sıkı şekilde onaylandığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V1.3.8", + "Ordinal": 8, + "Description": "JNDI sorgularında kullanılmadan önce güvenilmeyen girdilerin temizlendiği ve JNDI'nin enjeksiyonlara karşı güvenli şekilde yapılandırıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V1.3.9", + "Ordinal": 9, + "Description": "Memcache’e gönderilmeden önce içeriğin temizlenerek enjeksiyon saldırılarına karşı korunduğu doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V1.3.10", + "Ordinal": 10, + "Description": "Format dizgilerinin (format strings) beklenmeyen veya zararlı şekilde çözümlenmesini önlemek için işlenmeden önce temizlendiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V1.3.11", + "Ordinal": 11, + "Description": "SMTP veya IMAP enjeksiyonlarını önlemek için, kullanıcı girdisinin posta sistemlerine iletilmeden önce temizlendiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V1.3.12", + "Ordinal": 12, + "Description": "Regex girdilerinin üstel geri izlemeye (exponential backtracking) neden olan öğeler içermediği ve güvenilmeyen girdilerin ReDoS (Regex Denial of Service) gibi saldırılara karşı temizlendiği doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V1.4", + "Ordinal": 4, + "Name": "Bellek, Dizgi ve Yönetilmeyen Kod", + "Items": [ + { + "Shortcode": "V1.4.1", + "Ordinal": 1, + "Description": "Yığın, arabellek (buffer) veya yığın belleği taşmalarını önlemek ya da tespit etmek amacıyla, bellek güvenli dizgi işlemlerinin, daha güvenli bellek kopyalama ve işaretçi aritmetiğinin kullanıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V1.4.2", + "Ordinal": 2, + "Description": "Tamsayı taşmalarını önlemek için işaret (sign), aralık (range) ve giriş doğrulama tekniklerinin kullanıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V1.4.3", + "Ordinal": 3, + "Description": "Dinamik olarak ayrılan belleğin ve kaynakların serbest bırakıldığı ve boşaltılan belleklere ait referansların veya işaretçilerin kaldırıldığı veya null yapıldığı doğrulanmalıdır (dangling pointer ve use-after-free zafiyetlerine karşı).", + "L": "2" + } + ] + }, + { + "Shortcode": "V1.5", + "Ordinal": 5, + "Name": "Güvenli Ters Serileştirme (Safe Deserialization)", + "Items": [ + { + "Shortcode": "V1.5.1", + "Ordinal": 1, + "Description": "XML ayrıştırıcılarının (parser) kısıtlayıcı şekilde yapılandırıldığı ve dış varlık çözümleme (external entity resolution) gibi güvensiz özelliklerin XXE (XML eXternal Entity) saldırılarına karşı devre dışı bırakıldığı doğrulanmalıdır .", + "L": "1" + }, + { + "Shortcode": "V1.5.2", + "Ordinal": 2, + "Description": "Güvenilmeyen verilerin ters serileştirilmesinde, nesne türleri için izinli liste kullanımı veya istemci tanımlı nesne türlerinin kısıtlanması gibi güvenli giriş işleme önlemlerinin uygulandığı doğrulanmalıdır. Güvensiz olarak tanımlanmış ters serileştirme mekanizmaları, güvenilmeyen girdilerle kullanılmamalıdır.", + "L": "2" + }, + { + "Shortcode": "V1.5.3", + "Ordinal": 3, + "Description": "Aynı veri türü için uygulamada kullanılan farklı parser'ların (ör. JSON, XML, URL parser'ları), veriyi tutarlı şekilde ayrıştırdığı ve aynı karakter kodlamasını kullandığı doğrulanmalıdır. Böylece JSON birlikte çalışabilirlik açıkları, URI veya dosya ayrıştırma farkları gibi sorunlar nedeniyle RFI veya SSRF saldırılarının istismar edilmesi önlenir.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V2", + "Ordinal": 2, + "ShortName": "Validation", + "Name": "Doğrulama ve İş Mantığı", + "Items": [ + { + "Shortcode": "V2.1", + "Ordinal": 1, + "Name": "Doğrulama ve İş Mantığı Dokümantasyonu", + "Items": [ + { + "Shortcode": "V2.1.1", + "Ordinal": 1, + "Description": "Uygulama dokümantasyonunda, veri öğelerinin beklenen yapıya göre nasıl doğrulanacağına ilişkin giriş doğrulama kurallarının tanımlandığı doğrulanmalıdır. Bu; kredi kartı numaraları, e-posta adresleri, telefon numaraları gibi yaygın veri biçimleri olabileceği gibi iç sistemlere özel biçimler de olabilir.", + "L": "1" + }, + { + "Shortcode": "V2.1.2", + "Ordinal": 2, + "Description": "Uygulama dokümantasyonunda, birleştirilmiş veri öğelerinin mantıksal ve bağlamsal tutarlılığının nasıl doğrulanacağı tanımlanmalıdır (örneğin, mahalle ve posta kodunun eşleşip eşleşmediğinin kontrolü).", + "L": "2" + }, + { + "Shortcode": "V2.1.3", + "Ordinal": 3, + "Description": "Hem kullanıcı bazında hem de uygulama genelinde geçerli olacak şekilde, iş mantığı sınırları ve doğrulama beklentilerinin belgelendiği doğrulanmalıdır.", + "L": "2" + } + ] + }, + { + "Shortcode": "V2.2", + "Ordinal": 2, + "Name": "Girdi Doğrulama", + "Items": [ + { + "Shortcode": "V2.2.1", + "Ordinal": 1, + "Description": "Girdilerin, işlevsel ya da iş gereksinimlerine uygunluğunun doğrulandığı teyit edilmelidir. Bu işlem; izinli değerler, desenler ve aralıklar listesine karşı pozitif doğrulama ile ya da girdinin beklenen yapıya ve mantıksal sınırlara uygunluğunun önceden tanımlanmış kurallara göre karşılaştırılması ile yapılmalıdır. Seviye 1 için bu, güvenlik veya iş kararlarında kullanılan girdilere odaklanabilir. Seviye 2 ve üstü için tüm girdilere uygulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V2.2.2", + "Ordinal": 2, + "Description": "Uygulamanın, güvenilir bir servis katmanında girdi doğrulama zorunluluğu uygulayacak şekilde tasarlandığı doğrulanmalıdır. İstemci tarafında gerçekleştirilen doğrulama, kullanılabilirliği artırabilir ve teşvik edilmelidir. Ancak bu doğrulama,güvenlik kontrolü olarak kabul edilmemelidir.", + "L": "1" + }, + { + "Shortcode": "V2.2.3", + "Ordinal": 3, + "Description": "Uygulamanın, ilişkili veri öğelerinin önceden tanımlanmış kurallara göre makul olup olmadığını kontrol ettiği doğrulanmalıdır.", + "L": "2" + } + ] + }, + { + "Shortcode": "V2.3", + "Ordinal": 3, + "Name": "İş Mantığı Güvenliği", + "Items": [ + { + "Shortcode": "V2.3.1", + "Ordinal": 1, + "Description": "Uygulamanın, aynı kullanıcı için iş mantığı akışlarını yalnızca beklenen adım sırasına göre ve adım atlamadan işlediği doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V2.3.2", + "Ordinal": 2, + "Description": "İş mantığı sınırlarının, uygulama dokümantasyonuna uygun şekilde uygulandığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V2.3.3", + "Ordinal": 3, + "Description": "İş mantığı seviyesinde işlemlerin (transaction) kullanıldığı ve bir iş mantığı işleminin ya bütünüyle başarıyla tamamlandığı ya da önceki geçerli duruma geri döndürüldüğü (rollback) doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V2.3.4", + "Ordinal": 4, + "Description": "İş mantığı düzeyinde kilitleme mekanizmalarının, sınırlı kaynakların (ör. sinema koltukları, teslimat zamanları) uygulamanın mantığı manipüle edilerek çift rezervasyona neden olmamasını sağladığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V2.3.5", + "Ordinal": 5, + "Description": "Yüksek değerli iş mantığı akışlarının, yetkisiz veya kazara gerçekleşebilecek işlemleri önlemek için çoklu kullanıcı onayı gerektirdiği doğrulanmalıdır. Bu işlemler büyük para transferleri, sözleşme onayları, gizli bilgilere erişim veya üretimde güvenlik kurallarının geçersiz kılınmaları gibi durumları içerebilir.", + "L": "3" + } + ] + }, + { + "Shortcode": "V2.4", + "Ordinal": 4, + "Name": "Otomasyon Karşıtı Önlemler", + "Items": [ + { + "Shortcode": "V2.4.1", + "Ordinal": 1, + "Description": "Uygulama işlevlerine yönelik aşırı miktardaki çağrılara karşı; veri sızdırma, anlamsız veri üretme, kota tüketme, hız sınırının aşılması, hizmet reddi (DoS) ya da maliyetli kaynakların aşırı kullanımı gibi risklere karşı otomasyon karşıtı kontrollerin bulunduğu doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V2.4.2", + "Ordinal": 2, + "Description": "İş mantığı akışlarının, aşırı hızlı işlem gönderimlerini önleyecek şekilde gerçekçi insan zamanlaması gerektirdiği doğrulanmalıdır.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V3", + "Ordinal": 3, + "ShortName": "Web", + "Name": "Web Ön Uç (Frontend) Güvenliği", + "Items": [ + { + "Shortcode": "V3.1", + "Ordinal": 1, + "Name": "Web Frontend Güvenlik Dokümantasyonu", + "Items": [ + { + "Shortcode": "V3.1.1", + "Ordinal": 1, + "Description": "Uygulama dokümantasyonunda, uygulamayı kullanan tarayıcıların desteklemesi gereken güvenlik özelliklerinin (ör. HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) ve diğer ilgili HTTP güvenlik mekanizmaları) tanımlandığı doğrulanmalıdır. Ayrıca bu özelliklerin mevcut olmadığı durumlarda uygulamanın nasıl davranması gerektiği (ör. kullanıcıyı uyarmak veya erişimi engellemek) de tanımlanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.2", + "Ordinal": 2, + "Name": "İçeriğin Yanlış Yorumlanması", + "Items": [ + { + "Shortcode": "V3.2.1", + "Ordinal": 1, + "Description": "Tarayıcıların HTTP yanıtlarında içerik veya işlevi yanlış bir bağlamda sunmalarını önlemek amacıyla güvenlik kontrollerinin uygulandığı doğrulanmalıdır (ör. API, kullanıcı tarafından yüklenen dosya veya başka bir kaynağın doğrudan çağrılması durumunda). Olası kontroller arasında; yalnızca HTTP istek başlıklarının (ör. Sec-Fetch-\\*) doğru bağlamı gösterdiği durumlarda içeriğin sunulması, Content-Security-Policy başlığında \"sandbox\" yönergesinin kullanılması veya Content-Disposition başlığında \"attachment\" biçiminin kullanılması yer alabilir.", + "L": "1" + }, + { + "Shortcode": "V3.2.2", + "Ordinal": 2, + "Description": "HTML yerine metin olarak görüntülenmesi amaçlanan içeriğin, HTML veya JavaScript gibi içeriklerin istenmeden çalıştırılmasını önleyecek şekilde \"createTextNode\" veya \"textContent\" gibi güvenli işleme fonksiyonlarıyla işlendiği doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V3.2.3", + "Ordinal": 3, + "Description": "Uygulamanın istemci tarafı JavaScript kullanırken açık değişken tanımlamaları yaparak, sıkı tür kontrolü uygulayarak, global değişkenleri document nesnesine kaydetmekten kaçınarak ve ad alanı izolasyonu sağlayarak DOM clobbering’den kaçındığı doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.3", + "Ordinal": 3, + "Name": "Çerez Yapılandırması", + "Items": [ + { + "Shortcode": "V3.3.1", + "Ordinal": 1, + "Description": "Çerezlerin 'Secure' niteliğine sahip olduğu ve eğer çerez adı '\\__Host-' ön eki ile başlamıyorsa, '__Secure-' ön ekinin kullanıldığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V3.3.2", + "Ordinal": 2, + "Description": "Kullanıcı arayüzü kandırma saldırılarına ve tarayıcı tabanlı istek sahteciliği saldırılarına (CSRF) karşı koruma sağlamak amacıyla, her çerezin 'SameSite' niteliğinin kullanım amacına uygun şekilde ayarlandığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V3.3.3", + "Ordinal": 3, + "Description": "Çerez adı, diğer sunucularla paylaşılmak üzere açıkça tasarlanmadığı sürece '__Host-' ön eki ile tanımlanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V3.3.4", + "Ordinal": 4, + "Description": "Bir çerez değeri istemci tarafı betikleri tarafından erişilememesi gereken bir veri içeriyorsa (ör. oturum token'ı), çerezin 'HttpOnly' niteliğine sahip olduğu ve aynı değerin (ör. oturum token'ı) yalnızca 'Set-Cookie' başlığı ile istemciye iletildiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V3.3.5", + "Ordinal": 5, + "Description": "Uygulama bir çerez oluştururken, çerez adı ve değerinin toplam uzunluğunun 4096 baytı aşmadığı doğrulanmalıdır. Çok büyük çerezler tarayıcı tarafından saklanmaz ve isteklerle gönderilmez; bu da çereze bağlı çalışan uygulama işlevlerinin bozulmasına yol açabilir.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.4", + "Ordinal": 4, + "Name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", + "Items": [ + { + "Shortcode": "V3.4.2", + "Ordinal": 2, + "Description": "Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header'ı, uygulama tarafından sabit bir değer olarak tanımlanmalı veya gelen Origin header değeri güvenilir origin’lerden oluşan bir izinli listeye karşı doğrulanmalıdır. ‘Access-Control-Allow-Origin: *’ kullanılması gerekiyorsa, yanıtın hassas bilgi içermediği doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V3.4.3", + "Ordinal": 3, + "Description": "HTTP yanıtlarında Content-Security-Policy header'ı bulunduğu ve bu header'ın yalnızca güvenilen içeriklerin veya kaynakların yüklenmesini ve çalıştırılmasını sağlayan yönergeler içerdiği doğrulanmalıdır. Minimum olarak \"global policy\", object-src 'none', base-uri 'none' yönergelerini içermeli ve izinli liste, nonce veya hash temelli bir yapı içermelidir. Seviye 3 uygulamalarında her yanıt için nonce veya hash içeren özel bir politika tanımlanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V3.4.4", + "Ordinal": 4, + "Description": "Tüm HTTP yanıtlarının 'X-Content-Type-Options: nosniff' header'ını içerdiği doğrulanmalıdır. Bu, tarayıcıya içerik türünü tahmin etmeyi bırakmasını ve yanıtın Content-Type header'ında belirtilen MIME türünün, beklenen kaynak türüyle eşleşmesini zorunlu kılar. Ayrıca bu, tarayıcıda CORB (Cross-Origin Read Blocking) özelliğini etkinleştirir.", + "L": "2" + }, + { + "Shortcode": "V3.4.5", + "Ordinal": 5, + "Description": "Uygulamanın, 'Referer' başlığı yoluyla üçüncü taraflara teknik olarak hassas verilerin sızmasını önlemek için bir 'referrer policy' belirlediği doğrulanmalıdır. Bu, Referrer-Policy HTTP header'ıyla veya HTML öğe nitelikleriyle (element attributes) sağlanabilir. Sızabilecek hassas bilgiler, URL’deki yol ve sorgu parametreleri ile sınırlı uygulamalarda hostname bilgisini içerebilir.", + "L": "2" + }, + { + "Shortcode": "V3.4.6", + "Ordinal": 6, + "Description": "Uygulamanın, Content-Security-Policy header'ı altında 'frame-ancestors' yönergesini her HTTP yanıtında tanımladığı ve bu sayede içeriklerin varsayılan olarak başka sayfalara gömülmesini engellediği doğrulanmalıdır. Gerekli durumlarda özel olarak izin verildiğinden emin olunmalıdır. 'X-Frame-Options' header'ı, tarayıcılar tarafından desteklenmesine rağmen, artık güncel değildir ve güvenlik amacıyla kullanılmamalıdır.", + "L": "2" + }, + { + "Shortcode": "V3.4.8", + "Ordinal": 8, + "Description": "Bir belgenin işlenmesini ve sunulmasını başlatan tüm HTTP yanıtlarında (örneğin 'text/html' tipi yanıtlar), 'Cross-Origin-Opener-Policy' header'ı 'same-origin' veya 'same-origin-allow-popups' yönergeleriyle birlikte yer almalıdır. Bu, tabnabbing ve frame counting gibi, pencere nesnelerine paylaşımlı erişimi sömüren saldırılara karşı koruma sağlar.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.5", + "Ordinal": 5, + "Name": "Tarayıcı Menşei Ayırımı", + "Items": [ + { + "Shortcode": "V3.5.1", + "Ordinal": 1, + "Description": "Uygulama, hassas işlevselliğe yönelik izinsiz cross-origin istekleri önlemek için CORS preflight mekanizmasına güvenmiyorsa, bu tür isteklerin gerçekten uygulamadan geldiği doğrulanmalıdır. Bu, anti-forgery token kullanımı veya CORS tarafından güvenli kabul edilmeyen özel HTTP header'larının zorunlu kılınmasıyla yapılabilir. Bu, tarayıcı tabanlı istek sahteciliği (CSRF) saldırılarına karşı bir savunmadır.", + "L": "1" + }, + { + "Shortcode": "V3.5.2", + "Ordinal": 2, + "Description": "Uygulama, hassas işlevlerin izinsiz cross-origin çağrılmasını önlemek için CORS preflight mekanizmasına güveniyorsa, bu işlevlerin bir CORS-preflight isteğini tetiklemeden çağrılamadığı doğrulanmalıdır. Bu, 'Origin' ve 'Content-Type' header'larının doğrulanmasını veya CORS-safelisted olmayan bir header'ın ve alanın kullanılmasını gerektirebilir.", + "L": "1" + }, + { + "Shortcode": "V3.5.4", + "Ordinal": 4, + "Description": "Farklı uygulamaların farklı hostname'lerde barındırıldığı ve böylece Same-Origin Policy tarafından sağlanan kısıtlamalardan (örneğin çerez erişim sınırları, kaynaklar arası etkileşim kontrolleri) faydalanıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V3.5.6", + "Ordinal": 6, + "Description": "Uygulamanın herhangi bir yerinde JSONP işlevselliğinin etkin olmadığı doğrulanmalıdır. Bu, XSSI (Cross-Site Script Inclusion) saldırılarını önlemek içindir.", + "L": "3" + }, + { + "Shortcode": "V3.5.7", + "Ordinal": 7, + "Description": "Yetkilendirme gerektiren verilerin, JavaScript dosyaları gibi betik kaynaklarının yanıtlarında yer almadığı, XSSI saldırılarını önlemek için doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V3.5.8", + "Ordinal": 8, + "Description": "Kimliği doğrulanmış kaynakların (örneğin görseller, videolar, betikler ve belgeler) yalnızca gerçekten amaçlandığında kullanıcı adına yüklenebildiği veya gömülebildiği doğrulanmalıdır. Bu, isteğin uygun olmayan bir çapraz kaynak çağrısından kaynaklanmadığından emin olmak için Sec-Fetch-* HTTP istek başlığı alanlarının sıkı bir şekilde doğrulanmasıyla veya tarayıcıya döndürülen içeriği engelleme talimatı vermek için kısıtlayıcı bir Cross-Origin-Resource-Policy HTTP yanıt başlığı alanı ayarlayarak gerçekleştirilebilir.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.6", + "Ordinal": 6, + "Name": "Harici Kaynak Bütünlüğü", + "Items": [ + { + "Shortcode": "V3.6.1", + "Ordinal": 1, + "Description": "JavaScript kütüphaneleri, CSS veya web fontları gibi istemci tarafı varlıkların yalnızca statik ve sürümlü olması, varlığın bütünlüğünü doğrulamak için Subresource Integrity (SRI) kullanılması durumunda harici olarak (örneğin, bir İçerik Dağıtım Ağı üzerinde) barındırıldığı doğrulanmalıdır. Bu mümkün değilse, her bir kaynak için bunu gerekçelendiren belgelenmiş bir güvenlik kararı bulunmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.7", + "Ordinal": 7, + "Name": "Diğer Tarayıcı Güvenliği Hususları", + "Items": [ + { + "Shortcode": "V3.7.1", + "Ordinal": 1, + "Description": "Uygulamanın yalnızca hâlâ desteklenen ve güvenli kabul edilen istemci tarafı teknolojileri kullandığı doğrulanmalıdır. Bu gereksinimi karşılamayan teknolojilere örnek olarak NSAPI eklentileri, Flash, Shockwave, ActiveX, Silverlight, NACL veya istemci tarafı Java applet’leri verilebilir.", + "L": "2" + }, + { + "Shortcode": "V3.7.2", + "Ordinal": 2, + "Description": "Uygulamanın, yalnızca hedef adres bir izinli listede yer alıyorsa kullanıcıyı otomatik olarak farklı bir ana makine adına veya uygulamanın kontrolünde olmayan bir etki alanına yönlendirdiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V3.7.3", + "Ordinal": 3, + "Description": "Uygulamanın, kullanıcı uygulamanın kontrolü dışındaki bir URL’ye yönlendirildiğinde, yönlendirme hakkında bir bildirim gösterdiği ve kullanıcının bu gezintiyi iptal edebilmesi için bir seçenek sunduğu doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V3.7.4", + "Ordinal": 4, + "Description": "Uygulamanın en üst düzey etki alanının (örneğin, site.tld) HTTP Strict Transport Security (HSTS) için genel preload listesine eklendiği doğrulanmalıdır. Bu, uygulamanın TLS kullanımının ana tarayıcılar tarafından doğrudan tanınmasını ve yalnızca Strict-Transport-Security yanıt header'ına bağlı kalınmamasını sağlar.", + "L": "3" + }, + { + "Shortcode": "V3.7.5", + "Ordinal": 5, + "Description": "Uygulamaya erişen tarayıcının beklenen güvenlik özelliklerini desteklememesi durumunda, uygulamanın dokümantasyona uygun şekilde davrandığı (örneğin kullanıcıyı uyarma veya erişimi engelleme) doğrulanmalıdır.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V4", + "Ordinal": 4, + "ShortName": "API", + "Name": "API ve Web Servisi", + "Items": [ + { + "Shortcode": "V4.1", + "Ordinal": 1, + "Name": "Genel Web Servisi Güvenliği", + "Items": [ + { + "Shortcode": "V4.1.1", + "Ordinal": 1, + "Description": "İleti gövdesi içeren her HTTP yanıtında, yanıtın gerçek içeriğiyle eşleşen bir Content-Type header alanı bulunduğu ve güvenli karakter kodlamasını (örneğin, UTF-8, ISO-8859-1) belirtmek üzere charset parametresi içerdiği doğrulanmalıdır. Bu işlem, IANA Medya Türleri'nden \"text/\", \"/+xml\" ve \"/xml\" gibi içerikler için geçerlidir.", + "L": "1" + }, + { + "Shortcode": "V4.1.2", + "Ordinal": 2, + "Description": "Yalnızca kullanıcı arayüzüne yönelik uç noktaların (manuel olarak web tarayıcısı ile erişilmesi amaçlanan) otomatik olarak HTTP'den HTTPS'e yönlendirme yaptığı ve diğer hizmetlerin veya uç noktaların şeffaf yönlendirme gerçekleştirmediği doğrulanmalıdır. Bu, istemcinin farkında olmadan şifrelenmemiş HTTP istekleri göndermesi ve bu isteklerin otomatik olarak HTTPS'e yönlendirilmesi sonucunda hassas verilerin sızmasının fark edilmemesi riskini önlemek içindir.", + "L": "2" + }, + { + "Shortcode": "V4.1.3", + "Ordinal": 3, + "Description": "Uygulama tarafından kullanılan ve yük dengeleyici, web proxy veya frontend için backend hizmeti gibi bir ara katman tarafından ayarlanan herhangi bir HTTP başlık alanının, son kullanıcı tarafından geçersiz kılınamayacağı doğrulanmalıdır. Örnek başlıklar arasında X-Real-IP, X-Forwarded-* veya X-User-ID yer alabilir.", + "L": "2" + }, + { + "Shortcode": "V4.1.4", + "Ordinal": 4, + "Description": "Uygulama veya API tarafından açıkça desteklenen HTTP yöntemlerinin (preflight istekleri sırasında OPTIONS dahil) dışında hiçbir yöntemin kullanılmadığı ve kullanılmayan yöntemlerin engellendiği doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V4.1.5", + "Ordinal": 5, + "Description": "Çok hassas istekler veya birçok sistemden geçen işlemler için, taşıma katmanı güvenliğinin üzerine ek bir güvence sağlamak amacıyla, her iletiye özel dijital imzaların kullanıldığı doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V4.2", + "Ordinal": 2, + "Name": "HTTP İleti Yapısı Doğrulama", + "Items": [ + { + "Shortcode": "V4.2.1", + "Ordinal": 1, + "Description": "Tüm uygulama bileşenlerinin (yük dengeleyiciler, güvenlik duvarları ve uygulama sunucuları dahil) HTTP sürümüne uygun mekanizmaları kullanarak gelen HTTP iletilerinin sınırlarını belirlediği ve bu sayede HTTP istek kaçakçılığına karşı koruma sağlandığı doğrulanmalıdır. HTTP/1.x sürümünde Transfer-Encoding başlık alanı varsa, RFC 2616'ya göre Content-Length başlığı göz ardı edilmelidir. HTTP/2 veya HTTP/3 kullanıldığında, Content-Length başlığı varsa, alıcının bu değerin DATA çerçevelerinin uzunluğuyla tutarlı olduğunu doğrulaması gerekir.", + "L": "2" + }, + { + "Shortcode": "V4.2.2", + "Ordinal": 2, + "Description": "HTTP iletileri üretilirken, Content-Length başlığının, HTTP protokolünün çerçeveleme yöntemine göre belirlenen içerik uzunluğu ile çelişmediği doğrulanmalıdır. Bu, istek kaçakçılığı saldırılarını önlemek için gereklidir.", + "L": "3" + }, + { + "Shortcode": "V4.2.3", + "Ordinal": 3, + "Description": "Uygulamanın, yanıt bölme ve header enjeksiyonu saldırılarını önlemek amacıyla, bağlantıya özel başlık alanları (örneğin Transfer-Encoding) içeren HTTP/2 veya HTTP/3 iletilerini göndermediği ve kabul etmediği doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V4.2.4", + "Ordinal": 4, + "Description": "Uygulamanın yalnızca başlık alanları ve değerleri CR (\\r), LF (\\n) veya CRLF (\\r\\n) karakter dizileri içermeyen HTTP/2 ve HTTP/3 isteklerini kabul ettiği doğrulanmalıdır. Bu, başlık enjeksiyonu saldırılarını önlemek içindir.", + "L": "3" + }, + { + "Shortcode": "V4.2.5", + "Ordinal": 5, + "Description": "Uygulama (backend veya frontend) istek oluşturuyor ve gönderiyorsa, URI'ler (örneğin API çağrıları için) veya HTTP istek başlıkları (örneğin Authorization veya Cookie) gibi bileşenlerin, alıcı sistemler tarafından kabul edilemeyecek kadar uzun olmamasını sağlamak amacıyla doğrulama, temizleme veya diğer mekanizmaları kullandığı doğrulanmalıdır. Bu tür çok uzun istekler (örneğin çok uzun bir Cookie başlığı) gönderildiğinde sunucunun sürekli hata durumu döndürmesiyle hizmet reddi oluşabilir.", + "L": "3" + } + ] + }, + { + "Shortcode": "V4.3", + "Ordinal": 3, + "Name": "GraphQL", + "Items": [ + { + "Shortcode": "V4.3.1", + "Ordinal": 1, + "Description": "Maliyetli ve iç içe geçmiş sorgular sonucu oluşabilecek GraphQL veya veri katmanı ifadelerine yönelik Hizmet Reddi (DoS) saldırılarını önlemek için, sorgu izin listesi (allowlist), derinlik sınırlandırması, sorgu sayısı sınırlandırması veya sorgu maliyeti analizi kullanıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V4.3.2", + "Ordinal": 2, + "Description": "GraphQL introspection (iç yapı sorgulama) sorgularının, GraphQL API'nin üçüncü taraflar tarafından kullanılmasına yönelik olmadığı sürece, üretim ortamında devre dışı bırakıldığı doğrulanmalıdır.", + "L": "2" + } + ] + }, + { + "Shortcode": "V4.4", + "Ordinal": 4, + "Name": "WebSocket", + "Items": [ + { + "Shortcode": "V4.4.1", + "Ordinal": 1, + "Description": "Tüm WebSocket bağlantılarında TLS üzerinden WebSocket (WSS) kullanıldığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V4.4.2", + "Ordinal": 2, + "Description": "WebSocket'in başlangıçtaki HTTP el sıkışması (handshake) sırasında, Origin başlık alanının uygulama için izin verilen origin listesiyle karşılaştırılarak kontrol edildiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V4.4.3", + "Ordinal": 3, + "Description": "Uygulamanın standart oturum yönetimi kullanılamıyorsa, bunun yerine ilgili Oturum Yönetimi güvenlik gereksinimlerine uygun özel token'ların kullanıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V4.4.4", + "Ordinal": 4, + "Description": "HTTPS oturumu WebSocket kanalına geçerken, özel WebSocket oturum yönetim token’larının önceki şekilde kimliği doğrulanmış HTTPS oturumu aracılığıyla elde edildiği veya doğrulandığı doğrulanmalıdır.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V5", + "Ordinal": 5, + "ShortName": "File", + "Name": "Dosya İşleme", + "Items": [ + { + "Shortcode": "V5.1", + "Ordinal": 1, + "Name": "Dosya İşleme Dokümantasyonu", + "Items": [ + { + "Shortcode": "V5.1.1", + "Ordinal": 1, + "Description": "Dokümantasyonun, her yükleme özelliği için izin verilen dosya türlerini, beklenen dosya uzantılarını ve maksimum boyutu (açılmış hali dahil) tanımladığı doğrulanmalıdır. Ayrıca, dosyaların son kullanıcılar için nasıl güvenli hâle getirileceği (örneğin kötü amaçlı bir dosya tespit edildiğinde uygulamanın nasıl davranacağı) gibi bilgilerin de belgede yer aldığı doğrulanmalıdır.", + "L": "2" + } + ] + }, + { + "Shortcode": "V5.2", + "Ordinal": 2, + "Name": "Dosya Yükleme ve İçerik", + "Items": [ + { + "Shortcode": "V5.2.1", + "Ordinal": 1, + "Description": "Uygulamanın, yalnızca performans kaybına veya hizmet reddine yol açmayacak boyuttaki dosyaları kabul ettiği doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V5.2.2", + "Ordinal": 2, + "Description": "Uygulama bir dosyayı, doğrudan veya bir arşiv (ör. zip dosyası) içinde kabul ettiğinde, dosya uzantısının beklenen uzantıyla eşleşip eşleşmediğini kontrol ettiği ve içeriğin uzantı tarafından temsil edilen türle uyumlu olduğunu doğruladığı kontrol edilmelidir. Bu; ilk 'magic byte' kontrolü, görüntü yeniden yazımı ve dosya içeriği doğrulama için özel kütüphanelerin kullanımı gibi yöntemleri içerir. Seviye 1 için bu, yalnızca iş veya güvenlik kararlarında kullanılan dosyalarla sınırlı olabilir. Seviye 2 ve üzeri için tüm dosyalar bu kontrole tabi olmalıdır.", + "L": "1" + }, + { + "Shortcode": "V5.2.3", + "Ordinal": 3, + "Description": "Sıkıştırılmış dosyaların (ör. zip, gz, docx, odt) açılmadan önce, izin verilen maksimum açılmış boyuta ve maksimum dosya sayısına göre kontrol edildiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V5.2.4", + "Ordinal": 4, + "Description": "Her kullanıcı için dosya boyutu kotası ve maksimum dosya sayısının uygulandığı doğrulanmalıdır. Böylece tek bir kullanıcının çok sayıda veya aşırı büyük dosya yükleyerek depolama alanını doldurması engellenir.", + "L": "3" + }, + { + "Shortcode": "V5.2.5", + "Ordinal": 5, + "Description": "Uygulamanın, içinde sembolik bağlantılar (symlink) bulunan sıkıştırılmış dosyaların yüklenmesine yalnızca bu durum özel olarak gerekli olduğunda izin verdiği doğrulanmalıdır. Bu durumda, sembolik bağlantı verilebilecek dosyaların bir izinli listesi uygulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V5.2.6", + "Ordinal": 6, + "Description": "Uygulamanın, piksel boyutu izin verilen maksimum değeri aşan görüntü dosyalarının yüklenmesini reddettiği doğrulanmalıdır. Bu, pixel flood saldırılarını önlemek için gereklidir.", + "L": "3" + } + ] + }, + { + "Shortcode": "V5.3", + "Ordinal": 3, + "Name": "Dosya Depolama", + "Items": [ + { + "Shortcode": "V5.3.1", + "Ordinal": 1, + "Description": "Güvenilmeyen girdilerle yüklenen veya oluşturulan ve herkese açık klasörlerde depolanan dosyaların, bir HTTP isteğiyle doğrudan erişildiğinde sunucu taraflı program kodu olarak çalıştırılmadığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V5.3.2", + "Ordinal": 2, + "Description": "Uygulamanın, dosya işlemleri için dosya yollarını oluştururken kullanıcı tarafından gönderilen dosya adlarını değil, dahili olarak oluşturulan veya güvenilir verileri kullandığı; eğer kullanıcı tarafından gönderilen dosya adları veya meta veriler kullanılacaksa, sıkı doğrulama ve temizleme işlemlerinin uygulandığı doğrulanmalıdır. Bu, yol geçişi (path traversal), yerel veya uzak dosya dahil etme (LFI, RFI) ve sunucu tarafı istek sahteciliği (SSRF) saldırılarına karşı koruma sağlar.", + "L": "1" + }, + { + "Shortcode": "V5.3.3", + "Ordinal": 3, + "Description": "Sunucu tarafında gerçekleşen dosya işlemlerinin (örneğin dosya açma/decompress işlemi), kullanıcı tarafından sağlanan yol bilgilerini yok saydığı ve zip slip gibi güvenlik açıklarını önlediği doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V5.4", + "Ordinal": 4, + "Name": "Dosya İndirme", + "Items": [ + { + "Shortcode": "V5.4.1", + "Ordinal": 1, + "Description": "Uygulamanın, kullanıcı tarafından gönderilen dosya adlarını (ör. JSON, JSONP veya URL parametresinde) doğruladığı veya göz ardı ettiği ve yanıtın Content-Disposition başlık alanında bir dosya adı belirttiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V5.4.2", + "Ordinal": 2, + "Description": "Sunulan dosya adlarının (örneğin HTTP yanıt header'larında veya e-posta eklerinde), belge yapısını korumak ve enjeksiyon saldırılarını önlemek için kodlandığı veya temizlendiği (ör. RFC 6266’ya uygun) doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V5.4.3", + "Ordinal": 3, + "Description": "Güvenilmeyen kaynaklardan elde edilen dosyaların, bilinen kötü amaçlı içeriklerin sunulmasını önlemek amacıyla antivirüs tarayıcılarıyla tarandığı doğrulanmalıdır.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V6", + "Ordinal": 6, + "ShortName": "Authentication", + "Name": "Kimlik Doğrulama", + "Items": [ + { + "Shortcode": "V6.1", + "Ordinal": 1, + "Name": "Kimlik Doğrulama Dokümantasyonu", + "Items": [ + { + "Shortcode": "V6.1.1", + "Ordinal": 1, + "Description": "Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırılarına karşı oran sınırlama (rate limiting), otomasyon karşıtı önlemler ve uyarlanabilir yanıt gibi kontrollerin nasıl kullanıldığını açıklayan bir uygulama dokümantasyonu bulunduğu doğrulanmalıdır. Dokümantasyon, bu kontrollerin nasıl yapılandırıldığını ve kötü niyetli hesap kilitlemenin nasıl önlendiğini açıkça ortaya koymalıdır.", + "L": "1" + }, + { + "Shortcode": "V6.1.2", + "Ordinal": 2, + "Description": "Parolalarda kullanılmasını önlemek amacıyla, bağlama özgü sözcüklerin (örneğin kurum adlarının permütasyonları, ürün adları, sistem tanımlayıcıları, proje kod adları, departman veya rol adları vb.) bulunduğu belgelenmiş bir liste mevcut olduğu doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V6.1.3", + "Ordinal": 3, + "Description": "Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, bunların tümünün belgelenmiş olduğu ve her yol için tutarlı şekilde uygulanması gereken güvenlik kontrolleri ile kimlik doğrulama gücünün tanımlandığı doğrulanmalıdır.", + "L": "2" + } + ] + }, + { + "Shortcode": "V6.2", + "Ordinal": 2, + "Name": "Parola Güvenliği", + "Items": [ + { + "Shortcode": "V6.2.1", + "Ordinal": 1, + "Description": "Kullanıcı tarafından belirlenen parolaların en az 8 karakter uzunluğunda olması sağlanmalı, ancak 15 karakter ve üzeri uzunlukta parolalar olmaları şiddetle tavsiye edilir.", + "L": "1" + }, + { + "Shortcode": "V6.2.2", + "Ordinal": 2, + "Description": "Kullanıcıların parolalarını değiştirebilmeleri sağlanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V6.2.3", + "Ordinal": 3, + "Description": "Parola değiştirme işlevinin hem mevcut hem de yeni parolayı gerektirdiği doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V6.2.4", + "Ordinal": 4, + "Description": "Kayıt veya parola değişimi sırasında girilen parolaların, uygulamanın parola politikasına (örneğin minimum uzunluk) uyan ilk 3000 yaygın parolaya karşı kontrol edildiği doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V6.2.5", + "Ordinal": 5, + "Description": "Her tür karakterin kullanılmasına izin verildiği ve büyük/küçük harf, sayı veya özel karakter şartlarının zorunlu tutulmadığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V6.2.6", + "Ordinal": 6, + "Description": "Parola giriş alanlarının, girdiyi maskelemek için \"type=password\" kullandığı doğrulanmalıdır. Uygulamalar, kullanıcının tüm maskelenmiş parolayı ya da son girilen karakteri geçici olarak görüntülemesine izin verebilir.", + "L": "1" + }, + { + "Shortcode": "V6.2.7", + "Ordinal": 7, + "Description": "\"Yapıştır\" özelliğinin, tarayıcı parola yardımcılarının ve harici parola yöneticilerinin kullanımına izin verildiği doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V6.2.8", + "Ordinal": 8, + "Description": "Uygulamanın, kullanıcıdan aldığı parolayı herhangi bir şekilde değiştirmeden, örneğin kesmeden veya harf büyüklüğünü değiştirmeden, tam olarak doğruladığı teyit edilmelidir.", + "L": "1" + }, + { + "Shortcode": "V6.2.9", + "Ordinal": 9, + "Description": "En az 64 karakter uzunluğundaki parolalara izin verildiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V6.2.10", + "Ordinal": 10, + "Description": "Kullanıcının parolasının, yalnızca ele geçirildiği tespit edildiğinde veya kullanıcı tarafından yenilendiğinde geçerliliğini yitirdiği doğrulanmalıdır. Uygulama, belirli aralıklarla parola yenilenmesini zorunlu kılmamalıdır.", + "L": "2" + }, + { + "Shortcode": "V6.2.11", + "Ordinal": 11, + "Description": "Tahmin edilmesi kolay parolaların oluşturulmasını önlemek amacıyla, bağlama özgü kelimelerin yer aldığı belgelenmiş listenin parola doğrulamada kullanıldığı teyit edilmelidir.", + "L": "2" + }, + { + "Shortcode": "V6.2.12", + "Ordinal": 12, + "Description": "Kayıt veya parola değişikliği sırasında girilen parolaların, ele geçirilmiş parolalar listesine karşı kontrol edildiği doğrulanmalıdır.", + "L": "2" + } + ] + }, + { + "Shortcode": "V6.3", + "Ordinal": 3, + "Name": "Genel Kimlik Doğrulama Güvenliği", + "Items": [ + { + "Shortcode": "V6.3.1", + "Ordinal": 1, + "Description": "Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırıları gibi saldırıları önlemeye yönelik kontrollerin, uygulamanın güvenlik dokümantasyonuna göre uygulandığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V6.3.2", + "Ordinal": 2, + "Description": "\"root\", \"admin\" veya \"sa\" gibi varsayılan kullanıcı hesaplarının uygulamada yer almadığı veya devre dışı bırakıldığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V6.3.3", + "Ordinal": 3, + "Description": "Uygulamaya erişim için ya çok faktörlü bir kimlik doğrulama mekanizması ya da tek faktörlü mekanizmaların kombinasyonu kullanılmalıdır. Seviye 3 için, bu faktörlerden biri, oltalama saldırılarına karşı direnç sağlayan ve kimlik doğrulama niyetini bir kullanıcı etkileşimi (örneğin FIDO donanım anahtarında bir düğmeye basma veya mobil telefonda bir onay) gerektirerek doğrulayan donanım tabanlı bir kimlik doğrulayıcı olmalıdır. Bu gereksinimdeki herhangi bir esneklik için, gerekçesi belgelenmiş ve riskleri azaltıcı kapsamlı kontroller içeren bir plan gereklidir.", + "L": "2" + }, + { + "Shortcode": "V6.3.4", + "Ordinal": 4, + "Description": "Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, belgelendirilmemiş bir yol bulunmadığı ve tüm yollar için güvenlik kontrolleri ile kimlik doğrulama gücünün tutarlı şekilde uygulandığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V6.3.5", + "Ordinal": 5, + "Description": "Başarılı veya başarısız şüpheli kimlik doğrulama girişimlerinin kullanıcıya bildirildiği doğrulanmalıdır. Bu, olağandışı bir konum veya istemciden gelen girişimler, yalnızca bir faktörle yapılan kısmen başarılı doğrulamalar, uzun süreli inaktiflik sonrası yapılan girişimler veya birçok başarısız denemeden sonraki başarılı girişimler gibi durumları içerebilir.", + "L": "3" + }, + { + "Shortcode": "V6.3.6", + "Ordinal": 6, + "Description": "E-postanın, tek faktörlü ya da çok faktörlü kimlik doğrulama mekanizması olarak kullanılmadığı doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V6.3.7", + "Ordinal": 7, + "Description": "Kimlik doğrulama detaylarında yapılan güncellemeler sonrasında (örneğin kimlik bilgisi sıfırlama, kullanıcı adı veya e-posta adresi değişiklikleri), kullanıcıların bilgilendirildiği doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V6.3.8", + "Ordinal": 8, + "Description": "Başarısız kimlik doğrulama girişimlerinden, geçerli kullanıcıların hata mesajları, HTTP yanıt kodları veya farklı yanıt süreleri gibi sonuçlara dayanarak tespit edilemediği doğrulanmalıdır. Bu koruma, kayıt ve \"parolamı unuttum\" işlevselliğinde de geçerli olmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.4", + "Ordinal": 4, + "Name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", + "Items": [ + { + "Shortcode": "V6.4.1", + "Ordinal": 1, + "Description": "Sistem tarafından oluşturulan ilk parolaların veya etkinleştirme kodlarının güvenli bir şekilde rastgele üretildiği, mevcut parola politikasına uygun olduğu, kısa bir süre içinde veya ilk kullanım sonrasında geçerliliğini yitirdiği doğrulanmalıdır. Bu başlangıç sırları uzun vadeli parola olarak kullanılmasına izin verilmemelidir.", + "L": "1" + }, + { + "Shortcode": "V6.4.2", + "Ordinal": 2, + "Description": "Parola ipuçlarının veya \"gizli sorular\" olarak bilinen, bilgiye dayalı kimlik doğrulama mekanizmalarının mevcut olmadığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V6.4.3", + "Ordinal": 3, + "Description": "Unutulmuş parolanın sıfırlanması için, etkin olan çok faktörlü kimlik doğrulama mekanizmalarını atlamayan güvenli bir sürecin uygulandığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V6.4.4", + "Ordinal": 4, + "Description": "Çok faktörlü kimlik doğrulama faktörlerinden biri kaybolursa, kayıt sırasında uygulanan kimlik kanıtlama seviyesiyle aynı seviyede kimlik doğrulama yapıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V6.4.5", + "Ordinal": 5, + "Description": "Süresi dolacak kimlik doğrulama mekanizmalarının yenilenmesine ilişkin talimatların, süresi dolmadan önce tamamlanacak şekilde yeterli sürede gönderildiği ve gerekiyorsa otomatik hatırlatıcıların yapılandırıldığı doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V6.4.6", + "Ordinal": 6, + "Description": "Yönetici yetkisi olan kullanıcıların, kullanıcının parola sıfırlama sürecini başlatabildiği ancak kullanıcının yeni parolasını belirleyemediği veya değiştiremediği doğrulanmalıdır. Bu, yönetici yetkisi olan kullanıcıların, kullanıcı parolasını bilmesini engeller.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.5", + "Ordinal": 5, + "Name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "Items": [ + { + "Shortcode": "V6.5.1", + "Ordinal": 1, + "Description": "Arama sırları, bant dışı kimlik doğrulama istekleri veya kodları ve zamana dayalı tek kullanımlık parolaların (TOTP) yalnızca bir kez kullanılabildiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V6.5.2", + "Ordinal": 2, + "Description": "Uygulamanın backend tarafında saklanırken, 112 bitten az entropiye sahip (örneğin 19 rastgele harf-rakam karakteri veya 34 rastgele rakam) arama sırlarının, 32-bit rastgele bir salt içeren onaylı bir parola saklama algoritmasıyla hash’lendiği doğrulanmalıdır. Gizli bilginin entropisi 112 bit veya daha fazlaysa standart bir hash fonksiyonu kullanılabilir.", + "L": "2" + }, + { + "Shortcode": "V6.5.3", + "Ordinal": 3, + "Description": "Arama sırları, bant dışı kimlik doğrulama kodları ve zamana dayalı tek kullanımlık parola seed'lerinin, öngörülebilir değerlerden kaçınmak için Kriptografik Olarak Güvenli Sözde Rastgele Sayı Üreteci (CSPRNG) ile oluşturulduğu doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V6.5.4", + "Ordinal": 4, + "Description": "Arama sırlarının ve bant dışı kimlik doğrulama kodlarının en az 20 bit entropiye (genellikle 4 rastgele harf-rakam karakteri veya 6 rastgele rakam) sahip olduğu doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V6.5.5", + "Ordinal": 5, + "Description": "Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının ve zamana dayalı tek kullanımlık parolaların (TOTP) belirli bir ömre sahip olduğu doğrulanmalıdır. Bant dışı istekler en fazla 10 dakika, TOTP’ler ise en fazla 30 saniye geçerli olmalıdır.", + "L": "2" + }, + { + "Shortcode": "V6.5.6", + "Ordinal": 6, + "Description": "Herhangi bir kimlik doğrulama faktörünün (fiziksel cihazlar dahil) çalınması veya kaybı durumunda iptal edilebildiği doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V6.5.7", + "Ordinal": 7, + "Description": "Biyometrik kimlik doğrulama mekanizmalarının yalnızca ikincil faktör olarak, “sahip olduğunuz bir şey” veya “bildiğiniz bir şey” ile birlikte kullanıldığı doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V6.5.8", + "Ordinal": 8, + "Description": "Zamana dayalı tek kullanımlık parolaların (TOTP) doğrulamasının, güvenilir bir hizmetten alınan zaman kaynağına dayanarak yapıldığı ve güvenilir olmayan veya istemci tarafından sağlanan zaman kaynağına dayanmadığı doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.6", + "Ordinal": 6, + "Name": "Bant Dışı Kimlik Doğrulama Mekanizmaları", + "Items": [ + { + "Shortcode": "V6.6.1", + "Ordinal": 1, + "Description": "Tek kullanımlık parolaların (OTP) telefon veya SMS ile Public Switched Telephone Network (PSTN) üzerinden iletildiği kimlik doğrulama mekanizmalarının, yalnızca telefon numarası önceden doğrulanmışsa, alternatif daha güçlü yöntemler (örneğin TOTP) de sunuluyorsa ve kullanıcıya güvenlik riskleri hakkında bilgi veriliyorsa sunulduğu doğrulanmalıdır. Seviye 3 uygulamalar için telefon ve SMS seçenekleri sunulmamalıdır.", + "L": "2" + }, + { + "Shortcode": "V6.6.2", + "Ordinal": 2, + "Description": "Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının, oluşturuldukları özgün kimlik doğrulama isteğiyle bağlantılı olduğu ve daha önceki ya da sonraki bir istek için kullanılamadığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V6.6.3", + "Ordinal": 3, + "Description": "Kod tabanlı bant dışı kimlik doğrulama mekanizmalarının, oran sınırlaması ile kaba kuvvet saldırılarına karşı korunduğu doğrulanmalıdır. En az 64 bit entropiye sahip kodlar kullanılması da değerlendirilmelidir.", + "L": "2" + }, + { + "Shortcode": "V6.6.4", + "Ordinal": 4, + "Description": "Çok faktörlü kimlik doğrulama için push bildirimleri kullanılıyorsa, push bombing saldırılarına karşı oran sınırlamasının kullanıldığı doğrulanmalıdır. “Numara eşleştirme” de bu riski azaltabilir.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.7", + "Ordinal": 7, + "Name": "Kriptografik Kimlik Doğrulama Mekanizması", + "Items": [ + { + "Shortcode": "V6.7.1", + "Ordinal": 1, + "Description": "Kriptografik kimlik doğrulama beyanlarını doğrulamak için kullanılan sertifikaların, değiştirilmeye karşı korumalı şekilde saklandığı doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V6.7.2", + "Ordinal": 2, + "Description": "Challenge nonce değerinin en az 64 bit uzunluğunda olduğu ve istatistiksel olarak benzersiz ya da cihazın ömrü boyunca benzersiz olduğu doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.8", + "Ordinal": 8, + "Name": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", + "Items": [ + { + "Shortcode": "V6.8.1", + "Ordinal": 1, + "Description": "Uygulama birden fazla kimlik sağlayıcıyı (IdP) destekliyorsa, başka bir desteklenen kimlik sağlayıcı aracılığıyla (örneğin aynı kullanıcı tanımlayıcısını kullanarak) kullanıcının kimliğinin taklit edilemediği doğrulanmalıdır. Standart önlem, uygulamanın kullanıcıyı IdP kimliği (bir ad alanı işlevi görür) ve IdP içindeki kullanıcı kimliğinin birleşimiyle kaydetmesi ve tanımlamasıdır.", + "L": "2" + }, + { + "Shortcode": "V6.8.2", + "Ordinal": 2, + "Description": "Kimlik doğrulama beyanları üzerindeki dijital imzaların (örneğin JWT veya SAML beyanları) varlığı ve bütünlüğünün her zaman doğrulandığı ve imzasız veya geçersiz imzalı beyanların reddedildiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V6.8.3", + "Ordinal": 3, + "Description": "SAML beyanlarının benzersiz biçimde işlendiği ve yalnızca geçerlilik süresi içinde bir kez kullanıldığı, tekrar oynatma (replay) saldırılarını önlemek amacıyla doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V6.8.4", + "Ordinal": 4, + "Description": "Uygulama ayrı bir Kimlik Sağlayıcı (IdP) kullanıyorsa ve belirli işlemler için belirli kimlik doğrulama gücü, yöntemleri veya zaman bilgisi bekliyorsa, uygulamanın bu bilgileri IdP tarafından döndürülen veriler üzerinden doğruladığı teyit edilmelidir. Örneğin OIDC kullanılıyorsa, bu durum ID Token üzerindeki 'acr', 'amr' ve 'auth_time' gibi claim’lerin (varsa) doğrulanması ile sağlanabilir. Eğer IdP bu bilgileri sağlamıyorsa, uygulamanın asgari kimlik doğrulama gücünün kullanıldığını varsayan (örneğin yalnızca kullanıcı adı ve parola ile tek faktörlü doğrulama) belgelenmiş bir yedek yaklaşımı olmalıdır.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V7", + "Ordinal": 7, + "ShortName": "Session", + "Name": "Oturum Yönetimi", + "Items": [ + { + "Shortcode": "V7.1", + "Ordinal": 1, + "Name": "Oturum Yönetim Dokümantasyonu", + "Items": [ + { + "Shortcode": "V7.1.1", + "Ordinal": 1, + "Description": "Kullanıcının oturum inaktivite zaman aşımı süresi ve mutlak maksimum oturum süresinin belgelendiği, diğer kontrollerle birlikte uygun olduğu ve NIST SP 800-63B yeniden kimlik doğrulama gereksinimlerinden herhangi bir sapma varsa gerekçesinin belgede yer aldığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V7.1.2", + "Ordinal": 2, + "Description": "Belgede bir hesap için kaç adet eşzamanlı (paralel) oturuma izin verildiği ile birlikte, maksimum aktif oturum sayısına ulaşıldığında uygulanacak davranış ve işlemlerin tanımlandığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V7.1.3", + "Ordinal": 3, + "Description": "Birleşik kimlik yönetim ekosisteminin bir parçası olarak kullanıcı oturumu oluşturan ve yöneten tüm sistemlerin, oturum ömrü, sonlandırma ve yeniden kimlik doğrulama gerektiren diğer koşulların nasıl koordine edildiğini açıklayan kontrollerle birlikte belgede yer aldığı doğrulanmalıdır.", + "L": "2" + } + ] + }, + { + "Shortcode": "V7.2", + "Ordinal": 2, + "Name": "Temel Oturum Yönetimi Güvenliği", + "Items": [ + { + "Shortcode": "V7.2.1", + "Ordinal": 1, + "Description": "Uygulamanın tüm oturum token'ı doğrulama işlemlerini güvenilir bir backend servisi aracılığıyla gerçekleştirdiği doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V7.2.2", + "Ordinal": 2, + "Description": "Uygulamanın, statik API gizli anahtarları veya sabit değerler yerine, oturum yönetimi için dinamik olarak oluşturulan kendi kendine yeterli veya referans token'ları kullandığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V7.2.3", + "Ordinal": 3, + "Description": "Uygulama kullanıcı oturumlarını temsil etmek için referans token'ları kullanıyorsa, bu token'ların benzersiz olduğu, kriptografik olarak güvenli bir sözde rastgele sayı üreteci (CSPRNG) kullanılarak üretildiği ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V7.2.4", + "Ordinal": 4, + "Description": "Uygulamanın, kullanıcı kimlik doğrulaması (yeniden kimlik doğrulama dahil) sırasında yeni bir oturum token'ı oluşturduğu ve mevcut oturum token'ını sonlandırdığı doğrulanmalıdır.", + "L": "1" + } + ] + }, + { + "Shortcode": "V7.3", + "Ordinal": 3, + "Name": "Oturum Zaman Aşımı", + "Items": [ + { + "Shortcode": "V7.3.1", + "Ordinal": 1, + "Description": "Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde bir hareketsizlik zaman aşımı bulunduğu doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V7.3.2", + "Ordinal": 2, + "Description": "Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde mutlak bir maksimum oturum süresi bulunduğu doğrulanmalıdır.", + "L": "2" + } + ] + }, + { + "Shortcode": "V7.4", + "Ordinal": 4, + "Name": "Oturum Sonlandırma", + "Items": [ + { + "Shortcode": "V7.4.1", + "Ordinal": 1, + "Description": "Oturum sonlandırma tetiklendiğinde (örneğin, çıkış yapıldığında veya süre dolduğunda), uygulamanın oturumun daha fazla kullanılmasına izin vermediği doğrulanmalıdır. Referans token'lar veya durum bilgili oturumlar için bu, oturum verilerinin uygulama arka ucunda geçersiz kılınması anlamına gelir. Kapsamlı token kullanan uygulamaların; sonlandırılmış token listesi tutmak, kullanıcıya özel tarih ve saatten önce oluşturulan token'ları reddetmek veya kullanıcıya özel imzalama anahtarını yenilemek gibi bir çözüm uygulaması gerekir.", + "L": "1" + }, + { + "Shortcode": "V7.4.2", + "Ordinal": 2, + "Description": "Bir kullanıcı hesabı devre dışı bırakıldığında veya silindiğinde (örneğin bir çalışanın şirketten ayrılması), uygulamanın tüm aktif oturumları sonlandırdığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V7.4.3", + "Ordinal": 3, + "Description": "Herhangi bir kimlik doğrulama faktörünün başarılı bir şekilde değiştirilmesi veya kaldırılmasından (şifre sıfırlama veya kurtarma yoluyla yapılan değişiklikler dahil ve varsa MFA ayarları güncellemeleri dahil) sonra, uygulamanın diğer tüm aktif oturumları sonlandırma seçeneği sunduğu doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V7.4.4", + "Ordinal": 4, + "Description": "Kimlik doğrulama gerektiren tüm sayfalarda kolay erişilebilir ve görünür bir çıkış yap (logout) işlevi bulunduğu doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V7.4.5", + "Ordinal": 5, + "Description": "Uygulama yöneticilerinin, bireysel bir kullanıcının veya tüm kullanıcıların aktif oturumlarını sonlandırabilme yetkisine sahip olduğu doğrulanmalıdır.", + "L": "2" + } + ] + }, + { + "Shortcode": "V7.5", + "Ordinal": 5, + "Name": "Oturum Kötüye Kullanımına Karşı Savunmalar", + "Items": [ + { + "Shortcode": "V7.5.1", + "Ordinal": 1, + "Description": "E-posta adresi, telefon numarası, MFA yapılandırması veya hesap kurtarmada kullanılan diğer bilgiler gibi kimlik doğrulamayı etkileyebilecek hassas hesap özniteliklerinde değişiklik yapılmadan önce uygulamanın tam yeniden kimlik doğrulama gerektirdiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V7.5.2", + "Ordinal": 2, + "Description": "Kullanıcıların, (en az bir faktörle yeniden kimlik doğrulama yaptıktan sonra) mevcut tüm aktif oturumları görüntüleyebilmesi ve sonlandırabilmesinin mümkün olduğu doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V7.5.3", + "Ordinal": 3, + "Description": "Uygulamanın, son derece hassas işlemler veya operasyonlar gerçekleştirilmeden önce en az bir faktörle ek kimlik doğrulaması veya ikincil bir doğrulama gerektirdiği doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V7.6", + "Ordinal": 6, + "Name": "Birleşik Yeniden Kimlik Doğrulama", + "Items": [ + { + "Shortcode": "V7.6.1", + "Ordinal": 1, + "Description": "Güvenen Taraf (RP) ile Kimlik Sağlayıcı (IdP) arasındaki oturum süresi ve oturum sonlandırma davranışlarının belgelenmiş olduğu ve, örneğin IdP kimlik doğrulama olayları arasında maksimum süreye ulaşıldığında yeniden kimlik doğrulamanın gerekli kılındığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V7.6.2", + "Ordinal": 2, + "Description": "Yeni bir oturum oluşturulmasının, kullanıcı onayı veya açık bir eylem gerektirdiği; kullanıcı etkileşimi olmaksızın yeni uygulama oturumlarının oluşturulmasının önlendiği doğrulanmalıdır.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V8", + "Ordinal": 8, + "ShortName": "Authorization", + "Name": "Yetkilendirme", + "Items": [ + { + "Shortcode": "V8.1", + "Ordinal": 1, + "Name": "Yetkilendirme Dokümantasyonu", + "Items": [ + { + "Shortcode": "V8.1.1", + "Ordinal": 1, + "Description": "Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak işlev düzeyinde ve veriye özel erişim kısıtlamaları için kuralları tanımladığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V8.1.2", + "Ordinal": 2, + "Description": "Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak alan (field) düzeyinde erişim kısıtlamaları (hem okuma hem yazma) için kuralları tanımladığı doğrulanmalıdır. Bu kuralların, ilgili veri nesnesinin durum veya statü gibi diğer özniteliklerine bağlı olabileceği unutulmamalıdır.", + "L": "2" + }, + { + "Shortcode": "V8.1.3", + "Ordinal": 3, + "Description": "Uygulamanın dokümantasyonunun, kimlik doğrulama ve yetkilendirme ile ilgili güvenlik kararlarının alınmasında kullanılan çevresel ve bağlamsal öznitelikleri (günün saati, kullanıcı konumu, IP adresi veya cihaz gibi) tanımladığı doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V8.1.4", + "Ordinal": 4, + "Description": "Kimlik doğrulama ve yetkilendirme dokümantasyonunun; işlev düzeyinde, veriye özel ve alan düzeyinde yetkilendirmenin yanı sıra çevresel ve bağlamsal faktörlerin karar almada nasıl kullanıldığını tanımladığı doğrulanmalıdır. Bu, değerlendirilen öznitelikleri, risk eşiklerini ve alınan aksiyonları (ör. izin ver, doğrulama iste, reddet, step-up kimlik doğrulama) içermelidir.", + "L": "3" + } + ] + }, + { + "Shortcode": "V8.2", + "Ordinal": 2, + "Name": "Genel Yetkilendirme Tasarımı", + "Items": [ + { + "Shortcode": "V8.2.1", + "Ordinal": 1, + "Description": "Uygulamanın, işlev düzeyindeki erişimin yalnızca açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V8.2.2", + "Ordinal": 2, + "Description": "Uygulamanın, veriye özel erişimin yalnızca belirli veri öğelerine açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, doğrudan nesne referansı güvenlik açıkları (IDOR) ve bozuk nesne düzeyinde yetkilendirme (BOLA) risklerini azaltır.", + "L": "1" + }, + { + "Shortcode": "V8.2.3", + "Ordinal": 3, + "Description": "Uygulamanın, alan (field) düzeyindeki erişimin yalnızca belirli alanlara açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, bozuk nesne özelliği düzeyinde yetkilendirme (BOPLA) risklerini azaltır.", + "L": "2" + }, + { + "Shortcode": "V8.2.4", + "Ordinal": 4, + "Description": "Tüketicinin çevresel ve bağlamsal özniteliklerine (ör. günün saati, konum, IP adresi veya cihaz) dayalı uyarlanabilir güvenlik kontrollerinin, uygulama dokümantasyonunda tanımlandığı şekilde, kimlik doğrulama ve yetkilendirme kararları için uygulandığı doğrulanmalıdır. Bu kontroller, tüketici yeni bir oturum başlatmaya çalışırken ve mevcut bir oturum sırasında uygulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V8.3", + "Ordinal": 3, + "Name": "İşlem Düzeyinde Yetkilendirme", + "Items": [ + { + "Shortcode": "V8.3.1", + "Ordinal": 1, + "Description": "Uygulamanın yetkilendirme kurallarını güvenilir bir servis katmanında uyguladığı ve istemci taraflı JavaScript gibi güvenilmeyen tüketiciler tarafından değiştirilebilecek kontrollerle yetinmediği doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V8.3.2", + "Ordinal": 2, + "Description": "Yetkilendirme kararlarının temelini oluşturan değerlerdeki değişikliklerin hemen uygulandığı doğrulanmalıdır. Değişikliklerin anında uygulanamadığı durumlarda (örneğin self-contained token içindeki verilere güveniliyorsa), tüketici artık yetkili olmadığı hâlde bir işlem gerçekleştirdiğinde uyarı verecek ve değişikliği geri alacak önlemler uygulanmalıdır. Bu alternatifin bilgi sızıntısını önlemeyeceği unutulmamalıdır.", + "L": "3" + }, + { + "Shortcode": "V8.3.3", + "Ordinal": 3, + "Description": "Bir nesneye erişimin, herhangi bir aracı veya onun adına hareket eden bir servis yerine yalnızca erişimi başlatan öznenin (ör. tüketici) izinlerine dayandığı doğrulanmalıdır. Örneğin, bir tüketici kimlik doğrulama için bir self-contained token kullanarak bir web servis çağırırsa ve bu servis başka bir servisten veri talep ederse, ikinci servis izin kararlarını verirken birinci servisin makine-makine token'ı yerine tüketicinin token'ını kullanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V8.4", + "Ordinal": 4, + "Name": "Diğer Yetkilendirme Hususları", + "Items": [ + { + "Shortcode": "V8.4.1", + "Ordinal": 1, + "Description": "Multi-tenant uygulamaların, tüketici işlemlerinin izinli olmadıkları tenant'lar üzerinde asla etkili olmamasını sağlamak için tenant'lar arası kontroller kullandığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V8.4.2", + "Ordinal": 2, + "Description": "Yönetici arayüzlerine erişimin, sürekli tüketici kimlik doğrulaması, cihaz güvenlik durumu değerlendirmesi ve bağlamsal risk analizi dahil olmak üzere çok katmanlı güvenlik içerdiği doğrulanmalıdır. Yetkilendirme için yalnızca ağ konumu veya güvenilir uç noktalar yeterli olmamalıdır; ancak bu tür faktörler yetkisiz erişim olasılığını azaltabilir.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V9", + "Ordinal": 9, + "ShortName": "Self", + "Name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", + "Items": [ + { + "Shortcode": "V9.1", + "Ordinal": 1, + "Name": "Token Kaynağı ve Bütünlüğü", + "Items": [ + { + "Shortcode": "V9.1.1", + "Ordinal": 1, + "Description": "Self-contained token'ların içerikleri kabul edilmeden önce, oynama (tampering) saldırılarına karşı dijital imza veya MAC ile doğrulama yapıldığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V9.1.2", + "Ordinal": 2, + "Description": "Belirli bir bağlam için yalnızca bir allowlist üzerinde bulunan algoritmaların self-contained token oluşturmak ve doğrulamak için kullanılabildiği doğrulanmalıdır. Bu allowlist, yalnızca simetrik ya da yalnızca asimetrik algoritmaları içermeli ve kesinlikle 'None' algoritmasını içermemelidir. Hem simetrik hem de asimetrik algoritmalar desteklenmek zorundaysa, anahtar karışıklığını (key confusion) önlemek için ek kontroller uygulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V9.1.3", + "Ordinal": 3, + "Description": "Self-contained token'ları doğrulamak için kullanılan anahtar malzemesinin, token issuer için önceden yapılandırılmış güvenilir kaynaklardan alındığı doğrulanmalıdır. Bu, saldırganların güvenilmeyen kaynak ve anahtarları belirtmesini engeller. JWT ve diğer JWS yapılarında 'jku', 'x5u' ve 'jwk' gibi header'lar güvenilir kaynaklardan oluşan bir allowlist'e göre doğrulanmalıdır.", + "L": "1" + } + ] + }, + { + "Shortcode": "V9.2", + "Ordinal": 2, + "Name": "Token İçeriği", + "Items": [ + { + "Shortcode": "V9.2.1", + "Ordinal": 1, + "Description": "Token verisinde bir geçerlilik zaman aralığı (validity time span) varsa, yalnızca doğrulama zamanı bu zaman aralığı içerisindeyse token ve içeriği kabul edilmelidir. Örneğin, JWT'ler için 'nbf' ve 'exp' claim'leri doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V9.2.2", + "Ordinal": 2, + "Description": "Token'ı alan hizmetin, token içeriğini kabul etmeden önce bu token'ın doğru türde olduğunu ve sunulma amacına uygun olduğunu doğruladığı teyit edilmelidir. Örneğin, yalnızca erişim token'ları yetkilendirme kararları için, yalnızca ID Token'lar kullanıcı kimlik doğrulamasını kanıtlamak için kullanılabilir.", + "L": "2" + }, + { + "Shortcode": "V9.2.3", + "Ordinal": 3, + "Description": "Hizmetin yalnızca kendisiyle kullanılması amaçlanan (audience) token'ları kabul ettiği doğrulanmalıdır. JWT'lerde bu, 'aud' claim'inin hizmet içinde tanımlı bir allowlist ile doğrulanması yoluyla sağlanabilir.", + "L": "2" + }, + { + "Shortcode": "V9.2.4", + "Ordinal": 4, + "Description": "Eğer bir token issuer, farklı audience'lara token oluşturmak için aynı private key'i kullanıyorsa, oluşturulan token'ların hedef audience'ları benzersiz şekilde tanımlayan bir audience kısıtlaması içerdiği doğrulanmalıdır. Bu, bir token'ın farklı bir audience ile yeniden kullanılmasını önler. Audience tanımlayıcısı dinamik olarak sağlanıyorsa, token issuer bu audience'ları doğrulamalı ve audience taklitlerinin (impersonation) önüne geçmelidir.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V10", + "Ordinal": 10, + "ShortName": "OAuth", + "Name": "OAuth ve OIDC", + "Items": [ + { + "Shortcode": "V10.1", + "Ordinal": 1, + "Name": "Genel OAuth ve OIDC Güvenliği", + "Items": [ + { + "Shortcode": "V10.1.1", + "Ordinal": 1, + "Description": "Token'ların yalnızca kesinlikle ihtiyaç duyan bileşenlere gönderildiği doğrulanmalıdır. Örneğin, tarayıcı tabanlı JavaScript uygulamaları için bir backend-for-frontend modeli kullanıldığında, access ve refresh token'lara yalnızca backend'in erişebilmesi gerekir.", + "L": "2" + }, + { + "Shortcode": "V10.1.2", + "Ordinal": 2, + "Description": "Authorization server'dan gelen değerler (örneğin authorization code veya ID Token gibi) yalnızca aynı user agent oturumu ve işlemi tarafından başlatılmış bir yetkilendirme akışının sonucuysa kabul edildiği doğrulanmalıdır. Bu, client tarafından oluşturulan secret’ların 'proof key for code exchange' (PKCE) ‘code_verifier’, ‘state’ veya OIDC ‘nonce’ gibi tahmin edilemez, işleme özgü ve hem client’a hem de işlem başlatılan user agent oturumuna güvenli bir şekilde bağlı olmasını gerektirir.", + "L": "2" + } + ] + }, + { + "Shortcode": "V10.2", + "Ordinal": 2, + "Name": "OAuth İstemcisi", + "Items": [ + { + "Shortcode": "V10.2.1", + "Ordinal": 1, + "Description": "Code flow kullanılıyorsa, OAuth client’ın token taleplerini tetikleyen CSRF saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Bu genellikle PKCE kullanılarak veya authorization isteğinde gönderilen ‘state’ parametresinin kontrolü ile sağlanır.", + "L": "2" + }, + { + "Shortcode": "V10.2.2", + "Ordinal": 2, + "Description": "OAuth istemcisi birden fazla AS ile etkileşime girebiliyorsa, mix-up saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Örneğin, authorization server’ın 'iss' parametresini döndürmesi zorunlu kılınabilir ve bu parametrenin hem authorization yanıtında hem de token yanıtında doğrulanması gerekir.", + "L": "2" + }, + { + "Shortcode": "V10.2.3", + "Ordinal": 3, + "Description": "OAuth istemcisinin authorization server’a yaptığı taleplerde yalnızca gerekli scope’ları (veya diğer yetkilendirme parametrelerini) talep ettiği doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V10.3", + "Ordinal": 3, + "Name": "OAuth Kaynak Sunucusu (RS)", + "Items": [ + { + "Shortcode": "V10.3.1", + "Ordinal": 1, + "Description": "RS'nin yalnızca bu servisle kullanılmak üzere tasarlanmış access token’ları kabul ettiği doğrulanmalıdır (audience kontrolü). Audience bilgisi yapılandırılmış token’larda (örneğin JWT içindeki ‘aud’ claim’i) yer alabilir veya token introspection endpoint aracılığıyla kontrol edilebilir.", + "L": "2" + }, + { + "Shortcode": "V10.3.2", + "Ordinal": 2, + "Description": "RS'nin, access token’dan gelen claim’lere dayanarak yetki devri tanımına uygun şekilde yetkilendirme kararları uyguladığı doğrulanmalıdır. ‘sub’, ‘scope’ ve ‘authorization_details’ gibi claim’ler varsa, bu kararın parçası olmalıdır.", + "L": "2" + }, + { + "Shortcode": "V10.3.3", + "Ordinal": 3, + "Description": "Erişim kontrolü kararında, access token’dan (JWT veya ilgili token introspection yanıtı) benzersiz bir kullanıcının tanımlanması gerekiyorsa, RS'nin başka kullanıcılara devredilemeyecek claim’ler ile kullanıcıyı tanımladığı doğrulanmalıdır. Genellikle bu, ‘iss’ ve ‘sub’ claim’lerinin birlikte kullanılması anlamına gelir.", + "L": "2" + }, + { + "Shortcode": "V10.3.4", + "Ordinal": 4, + "Description": "RS'nin belirli bir kimlik doğrulama gücü, yöntemi veya güncelliği (recentness) gerektirmesi durumunda, sunulan access token’ın bu kısıtlamaları karşıladığını doğruladığı, örneğin, OIDC ‘acr’, ‘amr’ ve ‘auth_time’ claim’leri kullanılarak doğrulanmalıdır. ", + "L": "2" + }, + { + "Shortcode": "V10.3.5", + "Ordinal": 5, + "Description": "RS'nin, (yetkisiz taraflarca) çalınmış veya tekrar edilen access token’ların kullanımını önlemek için sender-constrained access token’lar kullandığı doğrulanmalıdır. Bu, OAuth 2 için Mutual TLS veya OAuth 2 Demonstration of Proof of Possession (DPoP) ile sağlanabilir.", + "L": "3" + } + ] + }, + { + "Shortcode": "V10.4", + "Ordinal": 4, + "Name": "OAuth Yetkilendirme Sunucusu (AS)", + "Items": [ + { + "Shortcode": "V10.4.1", + "Ordinal": 1, + "Description": "AS'nin, istemciye özel önceden kaydedilmiş URI’lerden oluşan bir allowlist kullanarak redirect URI’leri tam dize karşılaştırması ile doğruladığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V10.4.2", + "Ordinal": 2, + "Description": "AS'nin, \"authorization response\" içinde \"authorization code\" döndürdüğü durumlarda, bu kodun yalnızca bir kez kullanılabildiği doğrulanmalıdır. Daha önce access token vermek için kullanılmış bir authorization code ile yapılan ikinci geçerli token isteği reddedilmeli ve ilgili tüm token’lar iptal edilmelidir.", + "L": "1" + }, + { + "Shortcode": "V10.4.3", + "Ordinal": 3, + "Description": "Authorization code’un kısa ömürlü olduğu doğrulanmalıdır. L1 ve L2 uygulamalar için maksimum yaşam süresi 10 dakika, L3 uygulamalar için 1 dakikadır.", + "L": "1" + }, + { + "Shortcode": "V10.4.4", + "Ordinal": 4, + "Description": "Belirli bir istemci için AS'nin yalnızca o istemcinin ihtiyaç duyduğu grant türlerine izin verdiği doğrulanmalıdır. \"Token\" (Implicit flow) ve \"password\" (Resource Owner Password Credentials flow) grant türlerinin artık kullanılmaması gerekir.", + "L": "1" + }, + { + "Shortcode": "V10.4.5", + "Ordinal": 5, + "Description": "AS'nin, açık istemciler için refresh token replay saldırılarını azalttığı doğrulanmalıdır. Tercihen sender-constrained refresh token’lar (DPoP veya mutual TLS ile certificate-bound access token’lar) kullanılmalıdır. L1 ve L2 uygulamalar için refresh token rotation kullanılabilir. Rotation kullanılıyorsa, AS refresh token’ı kullanım sonrası geçersiz kılmalı ve geçersiz bir refresh token sunulması durumunda o yetkilendirme ile ilişkili tüm refresh token’ları iptal etmelidir.", + "L": "1" + }, + { + "Shortcode": "V10.4.6", + "Ordinal": 6, + "Description": "Code grant kullanılıyorsa, AS'nin authorization code interception saldırılarına karşı koruma sağladığı doğrulanmalıdır. Yetkilendirme isteğinde geçerli bir \"code_challenge\" değeri zorunlu olmalı ve \"code_challenge_method\" olarak \"plain\" kabul edilmemelidir. Token isteğinde ise \"code_verifier\" parametresi doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V10.4.7", + "Ordinal": 7, + "Description": "AS'nin, kimlik doğrulaması yapılmamış dinamik istemci kaydını desteklemesi durumunda, kötü niyetli istemci uygulamalarına karşı riskleri azalttığı doğrulanmalıdır. Kayıtlı URI’ler gibi client metadata’sı doğrulanmalı, kullanıcı onayı alınmalı ve güvenilmeyen bir client uygulamasıyla yapılan yetkilendirme isteği işlenmeden önce kullanıcı uyarılmalıdır.", + "L": "2" + }, + { + "Shortcode": "V10.4.8", + "Ordinal": 8, + "Description": "Refresh token’ların, sliding expiration kullanılsa bile mutlak bir sona erme süresine sahip olduğu doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V10.4.9", + "Ordinal": 9, + "Description": "Yetkili bir kullanıcı tarafından AS kullanıcı arayüzü üzerinden refresh token’ların ve reference access token’ların iptal edilebildiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V10.4.10", + "Ordinal": 10, + "Description": "Gizli istemcilerin token istekleri, pushed authorization request (PAR) ve token iptal istekleri gibi server’a yapılan backchannel isteklerinde kimliğinin kontrol edildiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V10.4.11", + "Ordinal": 11, + "Description": "AS yapılandırmasının, OAuth istemcisine yalnızca gerekli scope’ları atadığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V10.4.12", + "Ordinal": 12, + "Description": "Belirli bir client için, authorization server’ın yalnızca client’ın ihtiyaç duyduğu 'response_mode' değerine izin verdiği doğrulanmalıdır. Örneğin, bu değer ya beklenenlerle karşılaştırılarak doğrulanmalı ya da PAR veya JAR kullanılmalıdır.", + "L": "3" + }, + { + "Shortcode": "V10.4.13", + "Ordinal": 13, + "Description": "\"Code\" grant türünün daima pushed authorization request (PAR) ile birlikte kullanıldığı doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V10.4.14", + "Ordinal": 14, + "Description": "AS'nin yalnızca sender-constrained (Proof-of-Possession) access token’lar ürettiği doğrulanmalıdır. Bu, mutual TLS ile certificate-bound access token ya da DPoP ile DPoP-bound access token olabilir.", + "L": "3" + }, + { + "Shortcode": "V10.4.15", + "Ordinal": 15, + "Description": "Sunucu taraflı istemciler için (kullanıcı cihazında çalışmayan), AS'nin \"authorization_details\" parametresinin istemci backend'i tarafından sağlandığını ve kullanıcı tarafından değiştirilmediğini doğruladığı, örneğin pushed authorization request (PAR) or JWT-secured Authorization Request (JAR) zorunlu kılınarak doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V10.4.16", + "Ordinal": 16, + "Description": "Bir istemci gizli ise, AS'nin güçlü istemci kimlik doğrulama yöntemlerini zorunlu kıldığı doğrulanmalıdır. Bu yöntemler, public-key cryptography’ye dayalı ve replay saldırılarına karşı dayanıklı olmalı, örneğin mutual TLS (\"tls_client_auth\", \"self_signed_tls_client_auth\") veya private key JWT (\"private_key_jwt\") gibi.", + "L": "3" + } + ] + }, + { + "Shortcode": "V10.5", + "Ordinal": 5, + "Name": "OIDC İstemcisi", + "Items": [ + { + "Shortcode": "V10.5.1", + "Ordinal": 1, + "Description": "İstemcinin (relying party olarak) ID Token replay saldırılarını azalttığı doğrulanmalıdır. Örneğin, ID Token’daki 'nonce' claim’inin, OpenID Provider’a gönderilen kimlik doğrulama isteğindeki 'nonce' değeriyle eşleştiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V10.5.2", + "Ordinal": 2, + "Description": "İstemcinin kullanıcıyı ID Token claim’lerinden (genellikle, başka kullanıcılarla yeniden atanamayan 'sub' claim’i) benzersiz şekilde tanımladığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V10.5.3", + "Ordinal": 3, + "Description": "İstemcinin, kötü niyetli bir AS'nin başka bir AS'yi taklit etmesini AS metadata’sı üzerinden reddettiği doğrulanmalıdır. AS metadata’sındaki issuer URL’si, istemci tarafından beklenen önceden yapılandırılmış issuer URL’siyle tam olarak eşleşmiyorsa, metadata reddedilmelidir.", + "L": "2" + }, + { + "Shortcode": "V10.5.4", + "Ordinal": 4, + "Description": "İstemcinin, ID Token’ın kendisi için (audience) kullanılması amaçlandığını doğruladığı doğrulanmalıdır. Bu, token’daki 'aud' claim’inin istemcinin 'client_id' değeriyle eşit olup olmadığının kontrol edilmesiyle yapılır.", + "L": "2" + }, + { + "Shortcode": "V10.5.5", + "Ordinal": 5, + "Description": "OIDC back-channel logout kullanıldığında, relying party’nin \"forced logout\" ve \"logout\" akışında \"cross-JWT confusion\" gibi saldırılara karşı koruma sağladığı doğrulanmalıdır. Client, logout token’ın 'logout+jwt' türünde olduğunu, 'event' claim’inin doğru üyeye sahip olduğunu ve 'nonce' claim’i içermediğini doğrulamalıdır. Ayrıca token için kısa bir sona erme süresi (örneğin 2 dakika) önerilir.", + "L": "2" + } + ] + }, + { + "Shortcode": "V10.6", + "Ordinal": 6, + "Name": "OpenID Provider", + "Items": [ + { + "Shortcode": "V10.6.1", + "Ordinal": 1, + "Description": "OpenID Provider’ın yalnızca 'code', 'ciba', 'id_token' veya 'id_token code' response mode değerlerine izin verdiği doğrulanmalıdır. 'code' değeri, 'id_token code' (OIDC Hybrid flow) yerine tercih edilmelidir. 'token' (Implicit flow) kullanılmamalıdır.", + "L": "2" + }, + { + "Shortcode": "V10.6.2", + "Ordinal": 2, + "Description": "OpenID Provider’ın forced logout yoluyla yapılan hizmet reddi saldırılarını önlediği doğrulanmalıdır. Bu, son kullanıcıdan açık onay alınarak veya varsa logout isteğinde (relying party tarafından başlatılan) bulunan parametrelerin, örneğin 'id_token_hint', doğrulanmasıyla yapılabilir.", + "L": "2" + } + ] + }, + { + "Shortcode": "V10.7", + "Ordinal": 7, + "Name": "Onay (Consent) Yönetimi", + "Items": [ + { + "Shortcode": "V10.7.1", + "Ordinal": 1, + "Description": "AS'nin her yetkilendirme isteği için kullanıcının onayını aldığı doğrulanmalıdır. İstemcinin kimliği garanti altına alınamıyorsa, AS daima kullanıcıdan açıkça onay istemelidir.", + "L": "2" + }, + { + "Shortcode": "V10.7.2", + "Ordinal": 2, + "Description": "AS'nin kullanıcıdan onay istediğinde, neye onay verildiğini açık ve yeterli şekilde gösterdiği doğrulanmalıdır. Uygun olduğunda bu bilgiler, istenen yetkilendirmelerin doğasını (genellikle scope, resource server, RAR gibi detaylara dayalı), yetkilendirilmiş uygulamanın kimliğini ve bu yetkilendirmelerin süresini içermelidir.", + "L": "2" + }, + { + "Shortcode": "V10.7.3", + "Ordinal": 3, + "Description": "Kullanıcının, AS üzerinden verdiği onayları görüntüleyebildiği, değiştirebildiği ve iptal edebildiği doğrulanmalıdır.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V11", + "Ordinal": 11, + "ShortName": "Cryptography", + "Name": "Kriptografi", + "Items": [ + { + "Shortcode": "V11.1", + "Ordinal": 1, + "Name": "Kriptografik Envanter ve Dokümantasyon", + "Items": [ + { + "Shortcode": "V11.1.1", + "Ordinal": 1, + "Description": "Kriptografik anahtarların yönetimi için belgelenmiş bir politika ve NIST SP 800-57 gibi bir anahtar yönetim standardını izleyen bir kriptografik anahtar yaşam döngüsü tanımlandığı doğrulanmalıdır. Bu, anahtarların aşırı miktarda paylaşılmadığını (örneğin, paylaşılan sırlar için ikiden fazla tarafla veya özel anahtarlar için birden fazla tarafla) garanti altına almalıdır.", + "L": "2" + }, + { + "Shortcode": "V11.1.2", + "Ordinal": 2, + "Description": "Tüm kriptografik anahtarlar, algoritmalar ve uygulama tarafından kullanılan sertifikaları içeren bir kriptografik envanterin oluşturulduğu, sürdürüldüğü ve düzenli olarak güncellendiği doğrulanmalıdır. Bu envanter ayrıca, sistemde anahtarların nerede kullanılabileceğini ve kullanılamayacağını, ve hangi veri türlerinin bu anahtarlarla korunup korunamayacağını da belgelemelidir.", + "L": "2" + }, + { + "Shortcode": "V11.1.3", + "Ordinal": 3, + "Description": "Sistem içerisinde şifreleme, özetleme ve imzalama işlemleri dahil olmak üzere kriptografi kullanımının tüm örneklerini tespit etmek için kriptografik keşif mekanizmalarının kullanıldığı doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V11.1.4", + "Ordinal": 4, + "Description": "Kriptografik bir envanterin sürdürüldüğü doğrulanmalıdır. Bu envanter, gelecekteki tehditlere karşı tepki verebilmek amacıyla post-kuantum kriptografiye geçiş yolunu belirten belgelenmiş bir plan içermelidir.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.2", + "Ordinal": 2, + "Name": "Güvenli Kriptografi Uygulaması", + "Items": [ + { + "Shortcode": "V11.2.1", + "Ordinal": 1, + "Description": "Kriptografik işlemler için sektör tarafından doğrulanmış uygulamaların (kütüphaneler ve donanım hızlandırmalı uygulamalar dahil) kullanıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V11.2.2", + "Ordinal": 2, + "Description": "Uygulamanın, rastgele sayı üreticileri, kimliği doğrulanmış şifreleme, MAC veya özetleme algoritmaları, anahtar uzunlukları, turlar, şifreler ve modların herhangi bir zamanda yeniden yapılandırılabilir, yükseltilebilir veya değiştirilebilir olacağı şekilde kripto çevikliği (crypto agility) ile tasarlandığı doğrulanmalıdır. Aynı şekilde, anahtarların ve parolaların değiştirilebilmesi ve verilerin yeniden şifrelenebilmesi mümkün olmalıdır. Bu, onaylanmış PQC şemalarının yüksek güvenlikli uygulamaları yaygın olarak kullanılabilir hale geldiğinde sorunsuz geçişe olanak tanır.", + "L": "2" + }, + { + "Shortcode": "V11.2.3", + "Ordinal": 3, + "Description": "Tüm kriptografik ilkeliklerin, algoritma, anahtar boyutu ve yapılandırmaya göre minimum 128 bit güvenlik sağladığı doğrulanmalıdır. Örneğin, 256-bit ECC anahtarı yaklaşık 128 bit güvenlik sağlarken, RSA için aynı güvenliği elde etmek 3072-bit anahtar gerektirir.", + "L": "2" + }, + { + "Shortcode": "V11.2.4", + "Ordinal": 4, + "Description": "Tüm kriptografik işlemlerin sabit süreli (constant-time) olduğu, karşılaştırmalarda, hesaplamalarda veya geri dönüşlerde kısa devre (short-circuit) işlemleri yapılmadığı doğrulanmalıdır; bu, bilgi sızıntısını önlemek için gereklidir.", + "L": "3" + }, + { + "Shortcode": "V11.2.5", + "Ordinal": 5, + "Description": "Tüm kriptografik modüllerin güvenli şekilde hata verdiği ve hataların, padding oracle saldırıları gibi zafiyetleri mümkün kılmayacak şekilde ele alındığı doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.3", + "Ordinal": 3, + "Name": "Şifreleme Algoritmaları", + "Items": [ + { + "Shortcode": "V11.3.1", + "Ordinal": 1, + "Description": "Güvensiz blok modlarının (örneğin, ECB) ve zayıf doldurma (padding) şemalarının (örneğin, PKCS#1 v1.5) kullanılmadığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V11.3.2", + "Ordinal": 2, + "Description": "Yalnızca AES ile GCM gibi onaylı şifreleme algoritmalarının ve modlarının kullanıldığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V11.3.3", + "Ordinal": 3, + "Description": "Şifrelenmiş verilerin yetkisiz değişikliklere karşı korunduğu doğrulanmalıdır. Tercihen bu koruma, onaylı bir kimliği doğrulanmış şifreleme yöntemi kullanılarak ya da onaylı bir şifreleme yöntemi ile onaylı bir MAC algoritmasının kombinasyonu ile sağlanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V11.3.4", + "Ordinal": 4, + "Description": "Sayılar, başlatma vektörleri (IV) ve diğer tek kullanımlık değerlerin, aynı şifreleme anahtarı ve veri öğesi çifti için birden fazla kez kullanılmadığı doğrulanmalıdır. Oluşturma yöntemi kullanılan algoritmaya uygun olmalıdır.", + "L": "3" + }, + { + "Shortcode": "V11.3.5", + "Ordinal": 5, + "Description": "Şifreleme algoritması ve MAC algoritması kombinasyonlarının \"encrypt-then-MAC\" modunda çalıştığı doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.4", + "Ordinal": 4, + "Name": "Hashing ve Hash Tabanlı Fonksiyonlar", + "Items": [ + { + "Shortcode": "V11.4.1", + "Ordinal": 1, + "Description": "Dijital imzalar, HMAC, KDF ve rastgele bit üretimi gibi genel kriptografik kullanım senaryolarında yalnızca onaylı hash fonksiyonlarının kullanıldığı doğrulanmalıdır. MD5 gibi yasaklı hash fonksiyonları hiçbir kriptografik amaçla kullanılmamalıdır.", + "L": "1" + }, + { + "Shortcode": "V11.4.2", + "Ordinal": 2, + "Description": "Parolaların, onaylı, hesaplama açısından yoğun ve mevcut rehberliğe göre yapılandırılmış bir anahtar türetme fonksiyonu (diğer adıyla parola hash'leme fonksiyonu) kullanılarak saklandığı doğrulanmalıdır. Ayarlar, güvenlik ve performans dengesini sağlayarak kaba kuvvet saldırılarını zorlaştırmalıdır.", + "L": "2" + }, + { + "Shortcode": "V11.4.3", + "Ordinal": 3, + "Description": "Dijital imzalarda kullanılan hash fonksiyonlarının, veri bütünlüğü ve kimlik doğrulama amacıyla kullanıldığında çakışmaya karşı dayanıklı ve yeterli bit uzunluğuna sahip olduğu doğrulanmalıdır. Çakışma dayanıklılığı gerekiyorsa çıktı uzunluğu en az 256 bit olmalıdır. Sadece ikinci ön-görüntü (2nd pre-iamge) saldırılarına karşı dayanıklılık gerekiyorsa çıktı uzunluğu en az 128 bit olmalıdır.", + "L": "2" + }, + { + "Shortcode": "V11.4.4", + "Ordinal": 4, + "Description": "Parolalardan gizli anahtarlar türetilirken, onaylı anahtar türetme fonksiyonlarının anahtar uzatma (key stretching) parametreleriyle birlikte kullanıldığı doğrulanmalıdır. Bu parametreler, kaba kuvvet saldırılarını önleyecek şekilde güvenlik ve performans dengesine sahip olmalıdır.", + "L": "2" + } + ] + }, + { + "Shortcode": "V11.5", + "Ordinal": 5, + "Name": "Rastgele Değerler", + "Items": [ + { + "Shortcode": "V11.5.1", + "Ordinal": 1, + "Description": "Tahmin edilemez olması amaçlanan tüm rastgele sayıların ve dizelerin, CSPRNG ile oluşturulduğu ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. UUID'lerin bu koşulu dikkate almadığını unutmayın.", + "L": "2" + }, + { + "Shortcode": "V11.5.2", + "Ordinal": 2, + "Description": "Kullanılan rastgele sayı üretim mekanizmasının, yoğun talep altında dahi güvenli çalışacak şekilde tasarlandığı doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.6", + "Ordinal": 6, + "Name": "Açık Anahtar (Public Key) Kriptografisi", + "Items": [ + { + "Shortcode": "V11.6.1", + "Ordinal": 1, + "Description": "Anahtar üretimi, tohumlama (seeding) ve dijital imza üretimi ve doğrulama için yalnızca onaylı kriptografik algoritmalar ve çalışma modlarının kullanıldığı doğrulanmalıdır. Anahtar üretim algoritmaları, bilinen saldırılara karşı savunmasız anahtarlar üretmemelidir. Örneğin, Fermat çarpanlama yöntemine karşı savunmasız RSA anahtarları oluşturulmamalıdır.", + "L": "2" + }, + { + "Shortcode": "V11.6.2", + "Ordinal": 2, + "Description": "Anahtar değişimi için yalnızca onaylı kriptografik algoritmaların kullanıldığı doğrulanmalıdır (örneğin Diffie-Hellman). Kullanılan parametrelerin güvenli olması gerektiğine dikkat edilmelidir. Bu, anahtar kurulum sürecine yönelik saldırıları önleyecek ve araya girme (adversary-in-the-middle) ya da kriptografik kırılmaları engelleyecektir.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.7", + "Ordinal": 7, + "Name": "Kullanım Halindeki Verilerin Kriptografisi", + "Items": [ + { + "Shortcode": "V11.7.1", + "Ordinal": 1, + "Description": "Hassas verilerin kullanım sırasında korunmasını sağlamak amacıyla, yetkisiz kullanıcıların veya süreçlerin bu verilere erişmesini engelleyen tam bellek şifrelemesinin kullanıldığı doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V11.7.2", + "Ordinal": 2, + "Description": "Veri asgariyetinin sağlandığı, yani işleme sırasında mümkün olan en az miktarda verinin ortaya çıktığı ve verilerin kullanımdan hemen sonra veya mümkün olan en kısa sürede şifrelendiği doğrulanmalıdır.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V12", + "Ordinal": 12, + "ShortName": "Secure", + "Name": "Güvenli İletişim", + "Items": [ + { + "Shortcode": "V12.1", + "Ordinal": 1, + "Name": "Genel TLS Güvenlik Rehberi", + "Items": [ + { + "Shortcode": "V12.1.1", + "Ordinal": 1, + "Description": "Yalnızca TLS protokolünün en güncel ve önerilen sürümlerinin (örneğin TLS 1.2 ve TLS 1.3) etkinleştirildiği ve en son sürümün varsayılan olarak tercih edildiği doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V12.1.2", + "Ordinal": 2, + "Description": "Yalnızca önerilen şifre takımlarının (cipher suite) etkinleştirildiği ve en güçlü şifre takımlarının tercih edildiği doğrulanmalıdır. Seviye 3 (L3) uygulamalar yalnızca ileri gizlilik (forward secrecy) sağlayan şifre takımlarını desteklemelidir.", + "L": "2" + }, + { + "Shortcode": "V12.1.3", + "Ordinal": 3, + "Description": "Uygulamanın, mTLS istemci sertifikalarını kimlik doğrulama veya yetkilendirme amacıyla kullanmadan önce bu sertifikaların güvendiği sertifikalar arasında olduğunu doğruladığı kontrol edilmelidir.", + "L": "2" + }, + { + "Shortcode": "V12.1.4", + "Ordinal": 4, + "Description": "Online Certificate Status Protocol (OCSP) Stapling gibi geçerli bir sertifika iptal kontrolü yönteminin etkinleştirildiği ve yapılandırıldığı doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V12.1.5", + "Ordinal": 5, + "Description": "TLS el sıkışma (handshake) sürecinde Server Name Indication (SNI) gibi hassas meta verilerin ifşa edilmesini önlemek için, uygulamanın TLS yapılandırmasında Encrypted Client Hello (ECH) özelliğinin etkinleştirildiği doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V12.2", + "Ordinal": 2, + "Name": "Dışa Açık Hizmetlerle HTTPS İletişimi", + "Items": [ + { + "Shortcode": "V12.2.1", + "Ordinal": 1, + "Description": "İstemci ile dışa açık, HTTP tabanlı hizmetler arasındaki tüm bağlantılarda TLS kullanıldığı ve bu bağlantıların güvensiz ya da şifrelenmemiş iletişime geri dönmediği doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V12.2.2", + "Ordinal": 2, + "Description": "Dışa açık hizmetlerin herkese açık olarak güvenilen TLS sertifikaları kullandığı doğrulanmalıdır.", + "L": "1" + } + ] + }, + { + "Shortcode": "V12.3", + "Ordinal": 3, + "Name": "Genel Servisler Arası İletişim Güvenliği", + "Items": [ + { + "Shortcode": "V12.3.1", + "Ordinal": 1, + "Description": "Uygulamaya gelen ve uygulamadan çıkan tüm bağlantılarda izleme sistemleri, yönetim araçları, uzaktan erişim ve SSH, ara yazılımlar, veritabanları, ana sistemler (mainframe), iş ortağı sistemleri ya da dış API'ler dahil olmak üzere TLS gibi şifreli bir protokolün kullanıldığı ve güvensiz ya da şifrelenmemiş protokollere geri dönülmediği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V12.3.2", + "Ordinal": 2, + "Description": "TLS istemcilerinin bir TLS sunucusu ile iletişime geçmeden önce alınan sertifikaları doğruladığı kontrol edilmelidir.", + "L": "2" + }, + { + "Shortcode": "V12.3.3", + "Ordinal": 3, + "Description": "Uygulama içindeki HTTP tabanlı iç hizmetler arasında gerçekleşen tüm bağlantılarda TLS ya da uygun başka bir aktarım şifreleme mekanizmasının kullanıldığı ve güvensiz ya da şifrelenmemiş iletişime geri dönülmediği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V12.3.4", + "Ordinal": 4, + "Description": "İç hizmetler arasındaki TLS bağlantılarında güvenilir sertifikaların kullanıldığı doğrulanmalıdır. İç sistemlerde oluşturulmuş ya da kendinden imzalı (self-signed) sertifikalar kullanılıyorsa, bu sertifikalara güvenen hizmetlerin yalnızca belirli dahili sertifika otoritelerine (CA) ve belirli kendinden imzalı sertifikalara güvenecek şekilde yapılandırıldıkları doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V12.3.5", + "Ordinal": 5, + "Description": "Sistem içindeki hizmetlerin birbiriyle iletişim kurarken her bir uç noktanın kimliğini doğrulamak için güçlü kimlik doğrulama yöntemlerinin kullanıldığı doğrulanmalıdır. Bu yöntemler arasında, açık anahtar altyapısı (public-key infrastructure) kullanan ve tekrar oynatma saldırılarına karşı dayanıklı olan TLS istemci kimlik doğrulaması gibi yöntemler yer almalıdır. Mikroservis mimarilerinde, sertifika yönetimini basitleştirmek ve güvenliği artırmak amacıyla bir servis ağı (service mesh) kullanılması değerlendirilmelidir.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V13", + "Ordinal": 13, + "ShortName": "Configuration", + "Name": "Konfigürasyon", + "Items": [ + { + "Shortcode": "V13.1", + "Ordinal": 1, + "Name": "Konfigürasyon Dokümantasyonu", + "Items": [ + { + "Shortcode": "V13.1.1", + "Ordinal": 1, + "Description": "Uygulamanın tüm iletişim ihtiyaçlarının dokümante edildiği doğrulanmalıdır. Buna, uygulamanın bağımlı olduğu dış hizmetler ve son kullanıcının uygulamanın bağlantı kurmasını sağlayabileceği dış konumlar da dahil olmalıdır.", + "L": "2" + }, + { + "Shortcode": "V13.1.2", + "Ordinal": 2, + "Description": "Uygulamanın kullandığı her bir hizmet için, dokümantasyonda eşzamanlı bağlantı sayısı (örn. bağlantı havuzu limitleri) ve bu sınır aşıldığında uygulamanın davranışı, geri dönüş veya kurtarma mekanizmaları da dahil olmak üzere hizmet reddi koşullarını önlemek için tanımlandığı doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V13.1.3", + "Ordinal": 3, + "Description": "Uygulamanın, kullandığı her bir dış sistem veya hizmet (örn. veritabanları, dosya tanıtıcıları, iş parçacıkları, HTTP bağlantıları) için kaynak yönetimi stratejilerini tanımladığı doğrulanmalıdır. Bu stratejiler, kaynak serbest bırakma prosedürlerini, zaman aşımı ayarlarını, hata durumlarını ve tekrar deneme mantığı uygulanmışsa sınırları, gecikmeleri ve geri çekilme (back-off) algoritmalarını içermelidir. Senkron HTTP istek–yanıt işlemleri için kısa zaman aşımı süreleri zorunlu tutulmalı ve tekrar eden denemeler devre dışı bırakılmalı ya da sıkı şekilde sınırlandırılmalıdır.", + "L": "3" + }, + { + "Shortcode": "V13.1.4", + "Ordinal": 4, + "Description": "Uygulamanın, güvenlik açısından kritik olan gizli verileri tanımladığı ve kuruluşun tehdit modeli ve iş ihtiyaçlarına göre bu verilerin döndürülme (rotation) zamanlamasının belgelendiği doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V13.2", + "Ordinal": 2, + "Name": "Backend İletişim Konfigürasyonu", + "Items": [ + { + "Shortcode": "V13.2.1", + "Ordinal": 1, + "Description": "Uygulamanın, standart kullanıcı oturum mekanizmasını desteklemeyen backend bileşenleri (örneğin API'ler, ara katmanlar, veri katmanları) arasında gerçekleşen iletişimlerin kimlik doğrulamasıyla korunduğu doğrulanmalıdır. Kimlik doğrulama; bireysel hizmet hesapları, kısa ömürlü token'lar ya da sertifika tabanlı kimlik doğrulama ile yapılmalıdır ve parola, API anahtarı ya da ayrıcalıklı erişime sahip paylaşımlı hesaplar gibi sabit kimlik bilgileri kullanılmamalıdır.", + "L": "2" + }, + { + "Shortcode": "V13.2.2", + "Ordinal": 2, + "Description": "Uygulamanın backend bileşenleri arasında (yerel hizmetler, işletim sistemi hizmetleri, API'ler, ara katmanlar ve veri katmanları dahil) gerçekleştirilen iletişimlerin, yalnızca gerekli en az ayrıcalığa sahip hesaplarla yapıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V13.2.3", + "Ordinal": 3, + "Description": "Bir hizmet kimlik doğrulaması için bir kimlik bilgisi kullanılması gerekiyorsa, bu kimlik bilgisinin varsayılan bir değer (örneğin root/root veya admin/admin) olmadığının doğrulanması gereklidir.", + "L": "2" + }, + { + "Shortcode": "V13.2.4", + "Ordinal": 4, + "Description": "Uygulamanın iletişim kurmasına izin verilen dış kaynaklar ya da sistemlerin, bir allowlist (izinli liste) ile tanımlandığı doğrulanmalıdır. Bu liste, uygulama katmanında, web sunucusunda, güvenlik duvarında veya farklı katmanların birleşiminde uygulanabilir.", + "L": "2" + }, + { + "Shortcode": "V13.2.5", + "Ordinal": 5, + "Description": "Web veya uygulama sunucusunun, dış sistemlere veri veya dosya gönderimi veya yüklemesi yaparken sadece belirli kaynaklara izin verecek şekilde allowlist ile yapılandırıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V13.2.6", + "Ordinal": 6, + "Description": "Uygulamanın farklı hizmetlere bağlantı kurduğu durumlarda, bu bağlantılar için belgelenmiş yapılandırmaları (örn. maksimum eşzamanlı bağlantı, bağlantı limiti aşıldığında davranış, zaman aşımı, tekrar deneme stratejileri) takip ettiğinin doğrulanması gereklidir.", + "L": "3" + } + ] + }, + { + "Shortcode": "V13.3", + "Ordinal": 3, + "Name": "Gizli Bilgi Yönetimi", + "Items": [ + { + "Shortcode": "V13.3.1", + "Ordinal": 1, + "Description": "Parolalar, anahtar materyalleri, veritabanı ve üçüncü parti sistemlerle entegrasyon bilgileri, zaman tabanlı token'lar için tohum (seed) bilgileri, dahili gizli veriler ve API anahtarları gibi backend sırlarının güvenli bir şekilde oluşturulması, saklanması, erişim denetiminin sağlanması ve imha edilmesi için bir gizli bilgi yönetim çözümünün (örneğin key vault) kullanıldığı doğrulanmalıdır. Bu gizli bilgiler uygulama kaynak koduna dahil edilmemeli ve yapı çıktılarında yer almamalıdır. Seviye 3 uygulamalar için donanım destekli bir çözüm (örneğin HSM) gereklidir.", + "L": "2" + }, + { + "Shortcode": "V13.3.2", + "Ordinal": 2, + "Description": "Gizli bilgilere erişimin en az ayrıcalık prensibine uygun şekilde yapılandırıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V13.3.3", + "Ordinal": 3, + "Description": "Tüm kriptografik işlemlerin, anahtar materyallerinin güvenli bir şekilde yönetilmesi ve dışarıya sızmasının engellenmesi amacıyla, izole edilmiş bir güvenlik modülü (örneğin vault ya da donanım güvenlik modülü) aracılığıyla gerçekleştirildiği doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V13.3.4", + "Ordinal": 4, + "Description": "Uygulamanın belgelerinde belirtildiği şekilde gizli bilgilerin süresinin dolacak şekilde yapılandırıldığı ve düzenli olarak döndürüldüğü doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V13.4", + "Ordinal": 4, + "Name": "İstenmeyen Bilgi Sızıntısı", + "Items": [ + { + "Shortcode": "V13.4.1", + "Ordinal": 1, + "Description": "Uygulamanın .git veya .svn klasörleri gibi kaynak kontrolüyle ilgili metadata içermeyecek şekilde deploy edildiğini ya da bu klasörlerin hem dış erişime hem de uygulama erişimine kapalı olduğu doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V13.4.2", + "Ordinal": 2, + "Description": "Tüm bileşenler için üretim ortamlarında hata ayıklama (debug) modlarının devre dışı bırakıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V13.4.3", + "Ordinal": 3, + "Description": "Web sunucularının, açık şekilde istenmediği sürece dizin listelemesi (directory listing) özelliğini istemcilere sunmadığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V13.4.4", + "Ordinal": 4, + "Description": "HTTP TRACE metodunun üretim ortamlarında desteklenmediği, böylece potansiyel bilgi sızıntılarının önlendiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V13.4.5", + "Ordinal": 5, + "Description": "Belgeler (örneğin dahili API belgeleri) ve izleme uç noktalarının (monitoring endpoints) yalnızca açıkça belirtildiği durumlarda erişilebilir olduğu doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V13.4.6", + "Ordinal": 6, + "Description": "Uygulamanın arka uç bileşenlerinin ayrıntılı sürüm bilgilerini ifşa etmediği doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V13.4.7", + "Ordinal": 7, + "Description": "Web katmanının yalnızca belirli dosya uzantılarına sahip dosyaları sunacak şekilde yapılandırıldığı, bu sayede istem dışı bilgi, yapılandırma ya da kaynak kod sızıntılarının önlendiği doğrulanmalıdır.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V14", + "Ordinal": 14, + "ShortName": "Data", + "Name": "Veri Koruma", + "Items": [ + { + "Shortcode": "V14.1", + "Ordinal": 1, + "Name": "Veri Koruma Dokümantasyonu", + "Items": [ + { + "Shortcode": "V14.1.1", + "Ordinal": 1, + "Description": "Uygulama tarafından oluşturulan ve işlenen tüm hassas verilerin tanımlanıp, koruma seviyelerine göre sınıflandırıldığından emin olun. Bu, yalnızca kodlanmış (örneğin Base64 stringleri ya da JWT içindeki düz metin yükler gibi) ve bu nedenle kolayca çözülebilir verileri de içermelidir. Koruma seviyeleri, uygulamanın uymakla yükümlü olduğu veri koruma ve gizlilik düzenlemeleri ile standartlarını dikkate almalıdır.", + "L": "2" + }, + { + "Shortcode": "V14.1.2", + "Ordinal": 2, + "Description": "Tüm hassas veri koruma seviyeleri için belgelenmiş bir koruma gereksinimleri seti tanımlandığından emin olun. Bu gereksinimler genel şifreleme, bütünlük doğrulama, saklama süresi, verinin nasıl günlüğe kaydedileceği, günlüklerdeki hassas verilere erişim kontrolleri, veritabanı düzeyinde şifreleme, gizlilik ve gizliliği artırıcı teknolojiler ile diğer gizlilik gereksinimlerini kapsamalıdır.", + "L": "2" + } + ] + }, + { + "Shortcode": "V14.2", + "Ordinal": 2, + "Name": "Genel Veri Koruması", + "Items": [ + { + "Shortcode": "V14.2.1", + "Ordinal": 1, + "Description": "Hassas verilerin yalnızca HTTP message body veya header alanlarında sunucuya gönderildiği ve URL ile sorgu parametrelerinin, API anahtarı veya session token’ı gibi hassas bilgiler içermediği doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V14.2.2", + "Ordinal": 2, + "Description": "Hassas verilerin, yük dengeleyiciler ve uygulama önbellekleri gibi sunucu bileşenlerinde önbelleğe alınmasının engellendiği veya kullanım sonrası bu verilerin güvenli biçimde temizlendiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V14.2.3", + "Ordinal": 3, + "Description": "Uygulama kontrolü dışında veri toplanmasını engellemek için, tanımlanmış hassas verilerin, kullanıcı izleyicileri gibi güvensiz taraflara gönderilmediği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V14.2.4", + "Ordinal": 4, + "Description": "Hassas verilere yönelik şifreleme, bütünlük doğrulama, veri saklama, loglama yöntemi, loglardaki erişim kontrolleri, gizlilik teknolojileri gibi kontrollerin, söz konusu verinin belgelenmiş koruma seviyesinde tanımlandığı şekilde uygulandığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V14.2.5", + "Ordinal": 5, + "Description": "Önbellekleme mekanizmalarının yalnızca belirli içerik türüne sahip yanıtları önbelleğe alacak şekilde yapılandırıldığı ve hassas, dinamik içeriklerin önbelleğe alınmadığı doğrulanmalıdır. Web sunucusu, mevcut olmayan bir dosya talebinde geçerli ama farklı bir dosya döndürmek yerine 404 veya 302 cevabı vermelidir. Bu, Web Cache Deception saldırılarını önlemeye yardımcı olur.", + "L": "3" + }, + { + "Shortcode": "V14.2.6", + "Ordinal": 6, + "Description": "Uygulamanın yalnızca işlevsellik için gerekli olan asgari hassas veriyi döndürdüğü doğrulanmalıdır. Örneğin, kredi kartı numarasının yalnızca bazı rakamlarının döndürülmesi; tam numaranın döndürülmesi gerekiyorsa, kullanıcı arayüzünde gizlenmiş (maskelenmiş) şekilde sunulması gerekir, aksi kullanıcı özel olarak görüntülemek istemedikçe gösterilmemelidir.", + "L": "3" + }, + { + "Shortcode": "V14.2.7", + "Ordinal": 7, + "Description": "Hassas bilgilerin, veri saklama sınıflandırmasına tabi tutulduğu, geçerliliğini yitirmiş veya artık gerekli olmayan verilerin belirlenmiş bir zaman çizelgesiyle ya da gerektiğinde otomatik olarak silindiği doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V14.2.8", + "Ordinal": 8, + "Description": "Kullanıcı tarafından yüklenen dosyaların meta verilerinden hassas bilgilerin çıkarıldığı veya bu bilgilerin yalnızca kullanıcıdan açık onay alındığında saklandığı doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V14.3", + "Ordinal": 3, + "Name": "İstemci Tarafı Veri Koruması", + "Items": [ + { + "Shortcode": "V14.3.1", + "Ordinal": 1, + "Description": "Kimliği doğrulanmış verilerin, istemci veya oturum sonlandığında istemci depolamasından (örneğin tarayıcı DOM’undan) temizlendiği doğrulanmalıdır. 'Clear-Site-Data' HTTP response header bu konuda yardımcı olabilir ancak istemci tarafı, sunucu bağlantısı mevcut olmadığında da temizlik işlemini yapabiliyor olmalıdır.", + "L": "1" + }, + { + "Shortcode": "V14.3.2", + "Ordinal": 2, + "Description": "Uygulamanın, tarayıcılarda hassas verilerin önbelleğe alınmasını önlemek amacıyla yeterli anti-önbellekleme HTTP response header (örneğin Cache-Control: no-store) ayarladığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V14.3.3", + "Ordinal": 3, + "Description": "Tarayıcıda depolanan verilerin (örneğin localStorage, sessionStorage, IndexedDB veya çerezler) hassas veri içermediği, yalnızca session token’larının istisna olarak kabul edildiği doğrulanmalıdır.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V15", + "Ordinal": 15, + "ShortName": "Secure", + "Name": "Güvenli Kodlama ve Mimari", + "Items": [ + { + "Shortcode": "V15.1", + "Ordinal": 1, + "Name": "Güvenli Kodlama ve Mimari Dokümantasyonu", + "Items": [ + { + "Shortcode": "V15.1.1", + "Ordinal": 1, + "Description": "Güvenlik açığı içeren üçüncü taraf bileşen sürümleri ve genel olarak kütüphane güncellemeleri için, uygulama dokümantasyonunda risk bazlı düzeltme zamanlarının tanımlandığı doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V15.1.2", + "Ordinal": 2, + "Description": "Yazılım bileşen listesi (Software Bill of Materials - SBOM) gibi bir envanterin tutulduğu, kullanılan tüm üçüncü taraf kütüphanelerin önceden tanımlanmış, güvenilir ve düzenli olarak güncellenen depolardan alındığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V15.1.3", + "Ordinal": 3, + "Description": "Uygulama dokümantasyonunda zaman veya kaynak açısından yoğun işlevlerin tanımlandığı, bu işlevlerin aşırı kullanımı durumunda kullanılabilirlik kaybının nasıl önleneceği ve yanıt oluşturma süresinin istemci zaman aşımını aşmaması için hangi önlemlerin alındığı belirtilmelidir. Örnek savunmalar kuyruklama, eşzamansız işleme, kullanıcı başına ve uygulama genelinde paralel işlem sınırlarını içerebilir.", + "L": "2" + }, + { + "Shortcode": "V15.1.4", + "Ordinal": 4, + "Description": "Uygulama dokümantasyonunda \"riskli bileşenler\" olarak değerlendirilen üçüncü taraf kütüphanelerin vurgulandığı doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V15.1.5", + "Ordinal": 5, + "Description": "Uygulama dokümantasyonunda \"tehlikeli işlevsellik\" içeren uygulama bölümlerinin açıkça belirtildiği doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V15.2", + "Ordinal": 2, + "Name": "Güvenlik Mimarisi ve Bağımlılıklar", + "Items": [ + { + "Shortcode": "V15.2.1", + "Ordinal": 1, + "Description": "Uygulamanın yalnızca, belgelenmiş güncelleme ve düzeltme sürelerini aşmamış bileşenleri içerdiği doğrulanmalıdır.", + "L": "1" + }, + { + "Shortcode": "V15.2.2", + "Ordinal": 2, + "Description": "Uygulamanın, belgelenmiş güvenlik kararları ve stratejilere dayanarak, zaman veya kaynak açısından yoğun işlevlerin neden olabileceği kullanılabilirlik kaybına karşı savunmalar uyguladığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V15.2.3", + "Ordinal": 3, + "Description": "Üretim ortamının yalnızca uygulamanın çalışması için gerekli işlevleri içerdiği ve test kodları, örnek kod parçaları veya geliştirme işlevleri gibi gereksiz işlevsellikleri açığa çıkarmadığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V15.2.4", + "Ordinal": 4, + "Description": "Üçüncü taraf bileşenlerin ve bunların tüm transitif bağımlılıklarının beklenen depolardan (iç kaynaklı ya da harici) alındığı ve bağımlılık karışıklığı (dependency confusion) saldırılarına açık olmadığı doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V15.2.5", + "Ordinal": 5, + "Description": "Uygulamanın, “tehlikeli işlevsellik” içeren veya “riskli bileşenler” kullanan bölümlerine ek korumalar uyguladığı doğrulanmalıdır. Bu korumalar sandbox, kapsülleme, konteynerleştirme veya ağ düzeyinde izolasyon gibi teknikler aracılığıyla, bir uygulama bölümünün ele geçirilmesi durumunda saldırganın diğer bölümlere sıçramasını geciktirmeyi veya engellemeyi amaçlamalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V15.3", + "Ordinal": 3, + "Name": "Savunmacı Kodlama", + "Items": [ + { + "Shortcode": "V15.3.1", + "Ordinal": 1, + "Description": "Uygulamanın yalnızca gerekli alanların bir alt kümesini veri nesnesinden döndürdüğü doğrulanmalıdır. Örneğin, bazı alanlara kullanıcıların erişmemesi gerektiğinden tüm veri nesnesi döndürülmemelidir.", + "L": "1" + }, + { + "Shortcode": "V15.3.2", + "Ordinal": 2, + "Description": "Uygulama backend'i harici URL’lere çağrı yaptığında, yalnızca amaçlanan işlevsellik söz konusuysa yönlendirmeleri takip edecek şekilde yapılandırıldığının doğrulanması gerekir.", + "L": "2" + }, + { + "Shortcode": "V15.3.3", + "Ordinal": 3, + "Description": "Uygulamanın, kitlesel atama saldırılarına karşı, her bir controller ve eylem için izin verilen alanları sınırlandırarak savunmalar sağladığı doğrulanmalıdır. Örneğin, bir alan değeri, bu işlemde değiştirilmesi amaçlanmadıysa eklenememeli veya güncellenememelidir.", + "L": "2" + }, + { + "Shortcode": "V15.3.4", + "Ordinal": 4, + "Description": "Tüm proxy ve ara katman bileşenlerinin kullanıcının orijinal IP adresini, uç kullanıcı tarafından değiştirilemeyecek güvenilir veri alanları kullanarak doğru şekilde ilettiği ve uygulamanın ve web sunucusunun bu doğru değeri, loglama ve hız sınırlama gibi güvenlik kararları için kullandığı doğrulanmalıdır. Ayrıca, orijinal IP adresinin bile dinamik IP'ler, VPN'ler veya kurumsal güvenlik duvarları nedeniyle güvenilir olmayabileceği dikkate alınmalıdır.", + "L": "2" + }, + { + "Shortcode": "V15.3.5", + "Ordinal": 5, + "Description": "Uygulamanın değişkenlerin doğru türde olduğunu açıkça doğruladığı ve sıkı eşitlik ve karşılaştırma işlemleri kullandığı doğrulanmalıdır. Bu, değişken türüyle ilgili varsayımlardan kaynaklanan tür oynama (type juggling) veya tür karışıklığı (type confusion) güvenlik açıklarını önlemek içindir.", + "L": "2" + }, + { + "Shortcode": "V15.3.6", + "Ordinal": 6, + "Description": "JavaScript kodunun prototip zehirleme (prototype pollution) saldırılarını önleyecek şekilde yazıldığı, örneğin, nesne literal’leri yerine Set() veya Map() gibi yapılar kullanıldığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V15.3.7", + "Ordinal": 7, + "Description": "Uygulamanın, özellikle framework'ün istek parametrelerinin kaynağı (sorgu dizgisi, gövde parametreleri, çerezler veya başlık alanları) arasında ayrım yapmadığı durumlarda, HTTP parametre kirliliği (HTTP parameter pollution) saldırılarına karşı savunmalar uyguladığı doğrulanmalıdır.", + "L": "2" + } + ] + }, + { + "Shortcode": "V15.4", + "Ordinal": 4, + "Name": "Güvenli Eş Zamanlılık (Concurrency)", + "Items": [ + { + "Shortcode": "V15.4.1", + "Ordinal": 1, + "Description": "Çok iş parçacıklı kodda (örneğin cache'ler, dosyalar veya birden fazla iş parçacığı tarafından erişilen bellek içi nesneler gibi) paylaşılan nesnelere yalnızca thread-safe (iş parçacığı güvenli) türler ve kilitleme (lock) veya semaphore gibi senkronizasyon mekanizmaları kullanılarak erişildiği doğrulanmalıdır. Bu, yarış durumlarını ve veri bozulmasını önlemeye yöneliktir.", + "L": "3" + }, + { + "Shortcode": "V15.4.2", + "Ordinal": 2, + "Description": "Bir kaynağın durumu üzerindeki kontroller (örneğin varlığı ya da izinleri gibi) ile bu kontrole bağlı eylemlerin tek bir atomik işlem olarak gerçekleştirildiği doğrulanmalıdır. Bu, TOCTOU (time-of-check to time-of-use) yarış durumlarını önlemeye yöneliktir. Bir dosyanın varlığının kontrol edilip ardından açılması veya bir kullanıcının erişiminin doğrulanıp ardından yetki verilmesi gibi işlemler buna örnektir.", + "L": "3" + }, + { + "Shortcode": "V15.4.3", + "Ordinal": 3, + "Description": "Kilitlerin (locks) tutarlı biçimde kullanıldığı, iş parçacıklarının birbirini beklemesi ya da sonsuz döngüye girmesi (deadlock veya livelock) gibi durumların önlendiği doğrulanmalıdır. Ayrıca, kilitleme mantığı, kaynağı yöneten kod içinde kalmalı ve dış sınıflar veya dış kodlar tarafından istemeden veya kötü niyetli şekilde değiştirilememelidir.", + "L": "3" + }, + { + "Shortcode": "V15.4.4", + "Ordinal": 4, + "Description": "Kaynak tahsis politikalarının, iş parçacığı açlığını önleyecek şekilde, kaynaklara adil erişimi sağladığı doğrulanmalıdır. Örneğin, thread pool (iş parçacığı havuzu) kullanımı, düşük öncelikli iş parçacıklarının da makul sürelerde çalışabilmesi için uygulanmalıdır.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V16", + "Ordinal": 16, + "ShortName": "Security", + "Name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "Items": [ + { + "Shortcode": "V16.1", + "Ordinal": 1, + "Name": "Güvenlik Loglaması Dokümantasyonu", + "Items": [ + { + "Shortcode": "V16.1.1", + "Ordinal": 1, + "Description": "Uygulamanın teknoloji yığını boyunca her katmanda hangi olayların loglandığını, log formatlarını, logların nereye yazıldığını, nasıl kullanıldığını, erişimin nasıl kontrol edildiğini ve logların ne kadar süre saklandığını belgeleyen bir envanterin mevcut olduğu doğrulanmalıdır.", + "L": "2" + } + ] + }, + { + "Shortcode": "V16.2", + "Ordinal": 2, + "Name": "Genel Loglama", + "Items": [ + { + "Shortcode": "V16.2.1", + "Ordinal": 1, + "Description": "Her bir log girdisinin, olayın ne zaman, nerede, kim tarafından ve ne olduğuna dair detaylı bir zaman çizelgesi oluşturulmasına olanak tanıyacak gerekli meta verileri içerdiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V16.2.2", + "Ordinal": 2, + "Description": "Tüm loglama bileşenlerinin zaman kaynaklarının senkronize olduğu ve güvenlik olayı meta verisindeki zaman damgalarının UTC kullanarak ya da açık zaman dilimi ofsetiyle belirtildiği doğrulanmalıdır. UTC kullanımı, özellikle yaz saati uygulamaları nedeniyle oluşabilecek karışıklıkları önlemek için tavsiye edilir.", + "L": "2" + }, + { + "Shortcode": "V16.2.3", + "Ordinal": 3, + "Description": "Uygulamanın yalnızca log envanterinde belgelenmiş dosya ve hizmetlere log yazdığı ya da ilettiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V16.2.4", + "Ordinal": 4, + "Description": "Logların kullanılan log işleyici (log processor) tarafından okunabildiği ve ilişkilendirilebildiği doğrulanmalıdır. Tercihen yaygın bir log formatı kullanılmalıdır.", + "L": "2" + }, + { + "Shortcode": "V16.2.5", + "Ordinal": 5, + "Description": "Hassas veriler loglanırken, uygulamanın veri koruma seviyesine uygun olarak loglama yaptığı doğrulanmalıdır. Örneğin kimlik bilgileri veya ödeme detayları gibi bazı verilerin loglanmasına izin verilmemelidir. Session token’ları gibi veriler ise yalnızca tamamen ya da kısmen maskelenmiş ya da hash’lenmiş olarak loglanmalıdır.", + "L": "2" + } + ] + }, + { + "Shortcode": "V16.3", + "Ordinal": 3, + "Name": "Güvenlik Olayları", + "Items": [ + { + "Shortcode": "V16.3.1", + "Ordinal": 1, + "Description": "Tüm kimlik doğrulama işlemlerinin (başarılı ve başarısız girişimler dahil) loglandığı doğrulanmalıdır. Kullanılan kimlik doğrulama türü veya faktörleri gibi ek meta veriler de toplanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V16.3.2", + "Ordinal": 2, + "Description": "Başarısız yetkilendirme girişimlerinin loglandığı doğrulanmalıdır. Seviye 3 uygulamalar için, tüm yetkilendirme kararlarının ve hassas verilere erişim olaylarının (verinin kendisi olmadan) loglandığı da doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V16.3.3", + "Ordinal": 3, + "Description": "Uygulamanın, belgelenmiş güvenlik olaylarını ve güvenlik kontrollerini aşma girişimlerini (girdi doğrulama, iş mantığı, otomasyon karşıtı kontroller vb.) logladığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V16.3.4", + "Ordinal": 4, + "Description": "Beklenmeyen hatalar ve güvenlik kontrolü başarısızlıkları (örneğin backend TLS hataları gibi) loglandığı doğrulanmalıdır.", + "L": "2" + } + ] + }, + { + "Shortcode": "V16.4", + "Ordinal": 4, + "Name": "Log Koruması", + "Items": [ + { + "Shortcode": "V16.4.1", + "Ordinal": 1, + "Description": "Tüm loglama bileşenlerinin, log enjeksiyonunu (log injection) önlemek amacıyla verileri uygun biçimde encode ettiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V16.4.2", + "Ordinal": 2, + "Description": "Logların yetkisiz erişime karşı korunduğu ve değiştirilemez olduğu doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V16.4.3", + "Ordinal": 3, + "Description": "Logların analiz, tespit, uyarı ve yükseltme amacıyla mantıksal olarak ayrı bir sisteme güvenli biçimde iletildiği doğrulanmalıdır. Böylece uygulama ihlal edilse bile logların tehlikeye girmesi önlenmiş olur.", + "L": "2" + } + ] + }, + { + "Shortcode": "V16.5", + "Ordinal": 5, + "Name": "Hata Yönetimi", + "Items": [ + { + "Shortcode": "V16.5.1", + "Ordinal": 1, + "Description": "Beklenmedik ya da güvenlikle ilgili bir hata oluştuğunda, tüketiciye genel bir mesaj döndürüldüğü ve yığın izleri (stack trace), sorgular, gizli anahtarlar, token’lar gibi hassas sistem içi verilerin açıklanmadığı doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V16.5.2", + "Ordinal": 2, + "Description": "Uygulamanın, dış kaynaklara erişim başarısız olduğunda bile güvenli şekilde çalışmaya devam ettiği doğrulanmalıdır. Örneğin, circuit breaker ya da graceful degradation gibi desenler kullanılmalıdır.", + "L": "2" + }, + { + "Shortcode": "V16.5.3", + "Ordinal": 3, + "Description": "Uygulamanın hata durumlarında güvenli ve düzenli şekilde başarısız olduğu doğrulanmalıdır. Bu, örneğin doğrulama hatalarına rağmen işlemlerin işlenmesine yol açabilecek fail-open durumlarını önlemelidir.", + "L": "2" + }, + { + "Shortcode": "V16.5.4", + "Ordinal": 4, + "Description": "Ele alınmamış tüm istisnaları yakalayacak şekilde tanımlanmış bir “son çare hata yöneticisi” bulunduğu doğrulanmalıdır. Bu, hem loglara gitmesi gereken hata detaylarının kaybolmaması hem de tüm uygulama sürecinin çökerek hizmet dışı kalmasının önlenmesi açısından önemlidir.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V17", + "Ordinal": 17, + "ShortName": "WebRTC", + "Name": "WebRTC", + "Items": [ + { + "Shortcode": "V17.1", + "Ordinal": 1, + "Name": "TURN Sunucusu", + "Items": [ + { + "Shortcode": "V17.1.1", + "Ordinal": 1, + "Description": "TURN hizmetinin yalnızca özel amaçlar için ayrılmamış IP adreslerine (ör. iç ağlar, yayın adresleri, loopback) erişime izin verdiği doğrulanmalıdır. Bu gereksinim hem IPv4 hem de IPv6 adresleri için geçerlidir.", + "L": "2" + }, + { + "Shortcode": "V17.1.2", + "Ordinal": 2, + "Description": "TURN hizmetinin, meşru kullanıcıların sunucuda çok sayıda bağlantı noktası açmaya çalışması durumunda kaynak tüketimi saldırılarına karşı dayanıklı olduğu doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V17.2", + "Ordinal": 2, + "Name": "Medya", + "Items": [ + { + "Shortcode": "V17.2.1", + "Ordinal": 1, + "Description": "DTLS sertifikası anahtarının, belgelenmiş kriptografik anahtar yönetim politikasına uygun şekilde yönetildiği ve korunduğu doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V17.2.2", + "Ordinal": 2, + "Description": "Medya sunucusunun onaylı DTLS şifre takımlarını (cipher suites) ve Güvenli Gerçek Zamanlı Aktarım Protokolü (Secure Real-time Transport Protocol - SRTP) için anahtarlar oluşturmaya yönelik DTLS Uzantısı için güvenli bir koruma profilini kullanacak ve destekleyecek şekilde yapılandırıldığı (DTLS-SRTP) doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V17.2.3", + "Ordinal": 3, + "Description": "Real-time Transport Protocol (RTP) injection saldırılarının bir hizmet reddi durumuna veya medya akışlarına ses veya video medyası eklenmesine yol açmasını önlemek için medya sunucusunda Güvenli SRTP kimlik doğrulamasının kontrol edildiği doğrulanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V17.2.4", + "Ordinal": 4, + "Description": "Verify that the media server is able to continue processing incoming media traffic when encountering malformed Secure Real-time Transport Protocol (SRTP) packets.", + "L": "2" + }, + { + "Shortcode": "V17.2.5", + "Ordinal": 5, + "Description": "Medya sunucusunun, meşru kullanıcılardan gelen SRTP flood'ı sırasında gelen medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V17.2.6", + "Ordinal": 6, + "Description": "Medya sunucusunun DTLS içinde yer alan \"ClientHello\" yarış durumu güvenlik açığına karşı savunmasız olmadığı, medya sunucusunun güvenlik açığına sahip olduğunun açıkça bilinip bilinmediği kontrol edilerek veya yarış koşulu testi gerçekleştirilerek doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V17.2.7", + "Ordinal": 7, + "Description": "Medya sunucusuna bağlı ses veya video kayıt mekanizmalarının, meşru kullanıcı kaynaklı SRTP flood'ı sırasında medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.", + "L": "3" + }, + { + "Shortcode": "V17.2.8", + "Ordinal": 8, + "Description": "DTLS sertifikasının, SDP (Session Description Protocol) fingerprint özelliği ile karşılaştırıldığı ve doğrulama başarısız olursa medya akışının sonlandırıldığı, medya akışının özgünlüğünü sağlamak için doğrulanmalıdır.", + "L": "3" + } + ] + }, + { + "Shortcode": "V17.3", + "Ordinal": 3, + "Name": "Sinyalizasyon", + "Items": [ + { + "Shortcode": "V17.3.1", + "Ordinal": 1, + "Description": "Sinyalizasyon sunucusunun, flood saldırısı altında bile meşru sinyalizasyon mesajlarını işlemeye devam edebildiği doğrulanmalıdır. Bu, sinyalizasyon düzeyinde oran sınırlaması uygulanarak sağlanmalıdır.", + "L": "2" + }, + { + "Shortcode": "V17.3.2", + "Ordinal": 2, + "Description": "Sinyalizasyon sunucusunun, hizmet reddine yol açabilecek şekilde yapılandırılmış bozuk sinyalizasyon mesajlarıyla karşılaştığında bile meşru mesajları işlemeye devam edebildiği doğrulanmalıdır. Bu, girdi doğrulaması, integer overflow ve buffer overflow'a karşı savunma ve sağlam hata işleme teknikleri ile sağlanmalıdır.", + "L": "2" + } + ] + } + ] + } + ] +} diff --git a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.csv b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.csv new file mode 100644 index 0000000000..5e3bcb81df --- /dev/null +++ b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.csv @@ -0,0 +1,343 @@ +chapter_id,chapter_name,section_id,section_name,req_id,req_description,level1,level2,level3,cwe,nist +V1,Kodlama (Encoding) ve Temizleme,V1.1,Kodlama ve Temizleme Mimarisi,V1.1.1,"Girdinin yalnızca bir kez kanonik forma (canonical form) çözümlendiği veya kaçış işlemlerinin kaldırıldığı, bu işlemin yalnızca verinin bu biçimde beklenmesi durumunda yapıldığı ve bu işlemin girdi doğrulama veya temizleme işlemlerinden sonra değil, önce gerçekleştiği doğrulanmalıdır.",,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.1,Kodlama ve Temizleme Mimarisi,V1.1.2,"Uygulamanın, çıktıyı kullanılması gereken yorumlayıcıya verilmeden hemen önce veya yorumlayıcının kendisi tarafından çıktı kodlaması ya da kaçış işlemi yaptığı doğrulanmalıdır.",,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.1,"HTTP yanıtı, HTML veya XML belgesi için yapılan çıktı kodlamasının; HTML elemanları, HTML öznitelikleri, HTML yorumları, CSS ya da HTTP başlık alanları gibi bağlamlara uygun olduğu doğrulanmalıdır. Böylece mesaj veya belge yapısının bozulması önlenir.",✓,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.2,"Dinamik olarak URL oluşturulurken, güvenilmeyen verinin bağlamına göre (örneğin, sorgu veya yol parametreleri için URL kodlaması ya da base64url kodlaması) kodlandığı doğrulanmalıdır. Yalnızca güvenli URL protokollerine izin verilmelidir (örneğin, javascript: veya data: yasaklanmalıdır).",✓,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.3,JavaScript içeriği (JSON dahil) dinamik olarak oluşturulurken çıktı kodlama/kaçış kullanıldığı doğrulanmalıdır. Böylece mesaj veya belge yapısı değiştirilmemiş olur (JavaScript ve JSON enjeksiyonlarının önüne geçilir).,✓,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.4,"Veri sorguları veya veritabanı sorguları (SQL, HQL, NoSQL, Cypher vb.) için parametreli sorgular, ORM’ler, entity framework’ler kullanıldığı ya da SQL enjeksiyonu ve diğer veritabanı enjeksiyon saldırılarına karşı koruma sağlandığı doğrulanmalıdır. Bu durum, saklı yordam (stored procedure) yazarken de geçerlidir.",✓,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.5,Uygulamanın işletim sistemi komut enjeksiyonlarına karşı korunduğu ve işletim sistemi çağrılarında parametreli OS sorguları veya bağlama özgü komut satırı çıktı kodlamasının kullanıldığı doğrulanmalıdır.,✓,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.6,Uygulamanın LDAP enjeksiyon zafiyetlerine karşı korunduğu ya da LDAP enjeksiyonlarını önlemek için özel güvenlik kontrollerinin uygulandığı doğrulanmalıdır.,,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.7,"XPath enjeksiyon saldırılarına karşı, sorgu parametrelemesi veya önceden derlenmiş sorgular kullanılarak koruma sağlandığı doğrulanmalıdır.",,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.8,"LaTeX işlemcilerinin güvenli şekilde yapılandırıldığı (örneğin, --shell-escape bayrağının kullanılmadığı) ve yalnızca izin verilen komutlardan oluşan bir listeyle çalıştırıldığı doğrulanmalıdır.",,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.9,Düzenli ifadelerde (regex) özel karakterlerin (genellikle ters eğik çizgi \ ile) kaçırılarak meta karakter olarak yorumlanmalarının önlendiği doğrulanmalıdır.,,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.10,"Uygulamanın CSV ve formül enjeksiyonlarına karşı korunduğu doğrulanmalıdır. Uygulama, CSV içeriği dışa aktarırken RFC 4180 Bölüm 2.6 ve 2.7'de tanımlanan kaçış kurallarına uymalıdır. Ayrıca, CSV veya diğer tablo formatlarına (XLS, XLSX, ODF gibi) aktarım yapılırken, alanın ilk karakteri olarak çıkan özel karakterler ('=', '+', '-', '@', '\t' (sekme), '\0' (null karakter)) tek tırnak (') ile kaçırılmalıdır.",,,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.1,"WYSIWYG editörlerinden veya benzer kaynaklardan gelen tüm güvenilmeyen HTML girdilerinin, bilinen ve güvenli bir HTML temizleme kütüphanesi ya da çerçeve özelliği ile temizlendiği doğrulanmalıdır.",✓,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.2,"Uygulamanın eval() veya Spring Expression Language (SpEL) gibi dinamik kod çalıştırma özelliklerini kullanmaktan kaçındığı doğrulanmalıdır. Alternatif yoksa, kullanıcı girdisi çalıştırılmadan önce mutlaka temizlenmelidir.",✓,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.3,"Potansiyel olarak tehlikeli bir bağlamda kullanılacak verilerin, bu bağlama uygun karakterlere izin vermek ve çok uzun girdileri kısaltmak gibi güvenlik önlemleriyle önceden temizlendiği doğrulanmalıdır.",,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.4,"Kullanıcı tarafından sağlanan SVG içeriğinin, yalnızca güvenli etiket ve özellikler (örneğin grafik çizme ile ilgili) içerdiğinden emin olmak için onaylandığı veya temizlendiği doğrulanmalıdır (ör. script veya foreignObject içermemelidir).",,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.5,"Markdown, CSS, XSL stil sayfaları, BBCode veya benzeri ifade şablon dillerinde kullanıcı girdisinin temizlendiği veya bu tür özelliklerin devre dışı bırakıldığı doğrulanmalıdır.",,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.6,"Uygulamanın, güvenilmeyen verileri başka servislere iletmeden önce izinli protokol, alan adı, yol ve port listelerine göre doğruladığı ve tehlikeli karakterleri temizlediği doğrulanarak SSRF (Sunucu Taraflı İstek Sahteciliği) saldırılarına karşı korunduğu doğrulanmalıdır.",,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.7,"Uygulamanın şablon enjeksiyon saldırılarına karşı, güvenilmeyen girdilere dayalı şablon oluşturmayı engellediği; eğer bu kaçınılmazsa, bu girdilerin mutlaka temizlendiği veya sıkı şekilde onaylandığı doğrulanmalıdır.",,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.8,JNDI sorgularında kullanılmadan önce güvenilmeyen girdilerin temizlendiği ve JNDI'nin enjeksiyonlara karşı güvenli şekilde yapılandırıldığı doğrulanmalıdır.,,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.9,Memcache’e gönderilmeden önce içeriğin temizlenerek enjeksiyon saldırılarına karşı korunduğu doğrulanmalıdır.,,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.10,Format dizgilerinin (format strings) beklenmeyen veya zararlı şekilde çözümlenmesini önlemek için işlenmeden önce temizlendiği doğrulanmalıdır.,,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.11,"SMTP veya IMAP enjeksiyonlarını önlemek için, kullanıcı girdisinin posta sistemlerine iletilmeden önce temizlendiği doğrulanmalıdır.",,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.12,Regex girdilerinin üstel geri izlemeye (exponential backtracking) neden olan öğeler içermediği ve güvenilmeyen girdilerin ReDoS (Regex Denial of Service) gibi saldırılara karşı temizlendiği doğrulanmalıdır.,,,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.4,"Bellek, Dizgi ve Yönetilmeyen Kod",V1.4.1,"Yığın, arabellek (buffer) veya yığın belleği taşmalarını önlemek ya da tespit etmek amacıyla, bellek güvenli dizgi işlemlerinin, daha güvenli bellek kopyalama ve işaretçi aritmetiğinin kullanıldığı doğrulanmalıdır.",,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.4,"Bellek, Dizgi ve Yönetilmeyen Kod",V1.4.2,"Tamsayı taşmalarını önlemek için işaret (sign), aralık (range) ve giriş doğrulama tekniklerinin kullanıldığı doğrulanmalıdır.",,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.4,"Bellek, Dizgi ve Yönetilmeyen Kod",V1.4.3,Dinamik olarak ayrılan belleğin ve kaynakların serbest bırakıldığı ve boşaltılan belleklere ait referansların veya işaretçilerin kaldırıldığı veya null yapıldığı doğrulanmalıdır (dangling pointer ve use-after-free zafiyetlerine karşı).,,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.5,Güvenli Ters Serileştirme (Safe Deserialization),V1.5.1,XML ayrıştırıcılarının (parser) kısıtlayıcı şekilde yapılandırıldığı ve dış varlık çözümleme (external entity resolution) gibi güvensiz özelliklerin XXE (XML eXternal Entity) saldırılarına karşı devre dışı bırakıldığı doğrulanmalıdır .,✓,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.5,Güvenli Ters Serileştirme (Safe Deserialization),V1.5.2,"Güvenilmeyen verilerin ters serileştirilmesinde, nesne türleri için izinli liste kullanımı veya istemci tanımlı nesne türlerinin kısıtlanması gibi güvenli giriş işleme önlemlerinin uygulandığı doğrulanmalıdır. Güvensiz olarak tanımlanmış ters serileştirme mekanizmaları, güvenilmeyen girdilerle kullanılmamalıdır.",,✓,✓,, +V1,Kodlama (Encoding) ve Temizleme,V1.5,Güvenli Ters Serileştirme (Safe Deserialization),V1.5.3,"Aynı veri türü için uygulamada kullanılan farklı parser'ların (ör. JSON, XML, URL parser'ları), veriyi tutarlı şekilde ayrıştırdığı ve aynı karakter kodlamasını kullandığı doğrulanmalıdır. Böylece JSON birlikte çalışabilirlik açıkları, URI veya dosya ayrıştırma farkları gibi sorunlar nedeniyle RFI veya SSRF saldırılarının istismar edilmesi önlenir.",,,✓,, +V2,Doğrulama ve İş Mantığı,V2.1,Doğrulama ve İş Mantığı Dokümantasyonu,V2.1.1,"Uygulama dokümantasyonunda, veri öğelerinin beklenen yapıya göre nasıl doğrulanacağına ilişkin giriş doğrulama kurallarının tanımlandığı doğrulanmalıdır. Bu; kredi kartı numaraları, e-posta adresleri, telefon numaraları gibi yaygın veri biçimleri olabileceği gibi iç sistemlere özel biçimler de olabilir.",✓,✓,✓,, +V2,Doğrulama ve İş Mantığı,V2.1,Doğrulama ve İş Mantığı Dokümantasyonu,V2.1.2,"Uygulama dokümantasyonunda, birleştirilmiş veri öğelerinin mantıksal ve bağlamsal tutarlılığının nasıl doğrulanacağı tanımlanmalıdır (örneğin, mahalle ve posta kodunun eşleşip eşleşmediğinin kontrolü).",,✓,✓,, +V2,Doğrulama ve İş Mantığı,V2.1,Doğrulama ve İş Mantığı Dokümantasyonu,V2.1.3,"Hem kullanıcı bazında hem de uygulama genelinde geçerli olacak şekilde, iş mantığı sınırları ve doğrulama beklentilerinin belgelendiği doğrulanmalıdır.",,✓,✓,, +V2,Doğrulama ve İş Mantığı,V2.2,Girdi Doğrulama,V2.2.1,"Girdilerin, işlevsel ya da iş gereksinimlerine uygunluğunun doğrulandığı teyit edilmelidir. Bu işlem; izinli değerler, desenler ve aralıklar listesine karşı pozitif doğrulama ile ya da girdinin beklenen yapıya ve mantıksal sınırlara uygunluğunun önceden tanımlanmış kurallara göre karşılaştırılması ile yapılmalıdır. Seviye 1 için bu, güvenlik veya iş kararlarında kullanılan girdilere odaklanabilir. Seviye 2 ve üstü için tüm girdilere uygulanmalıdır.",✓,✓,✓,, +V2,Doğrulama ve İş Mantığı,V2.2,Girdi Doğrulama,V2.2.2,"Uygulamanın, güvenilir bir servis katmanında girdi doğrulama zorunluluğu uygulayacak şekilde tasarlandığı doğrulanmalıdır. İstemci tarafında gerçekleştirilen doğrulama, kullanılabilirliği artırabilir ve teşvik edilmelidir. Ancak bu doğrulama,güvenlik kontrolü olarak kabul edilmemelidir.",✓,✓,✓,, +V2,Doğrulama ve İş Mantığı,V2.2,Girdi Doğrulama,V2.2.3,"Uygulamanın, ilişkili veri öğelerinin önceden tanımlanmış kurallara göre makul olup olmadığını kontrol ettiği doğrulanmalıdır.",,✓,✓,, +V2,Doğrulama ve İş Mantığı,V2.3,İş Mantığı Güvenliği,V2.3.1,"Uygulamanın, aynı kullanıcı için iş mantığı akışlarını yalnızca beklenen adım sırasına göre ve adım atlamadan işlediği doğrulanmalıdır.",✓,✓,✓,, +V2,Doğrulama ve İş Mantığı,V2.3,İş Mantığı Güvenliği,V2.3.2,"İş mantığı sınırlarının, uygulama dokümantasyonuna uygun şekilde uygulandığı doğrulanmalıdır.",,✓,✓,, +V2,Doğrulama ve İş Mantığı,V2.3,İş Mantığı Güvenliği,V2.3.3,İş mantığı seviyesinde işlemlerin (transaction) kullanıldığı ve bir iş mantığı işleminin ya bütünüyle başarıyla tamamlandığı ya da önceki geçerli duruma geri döndürüldüğü (rollback) doğrulanmalıdır.,,✓,✓,, +V2,Doğrulama ve İş Mantığı,V2.3,İş Mantığı Güvenliği,V2.3.4,"İş mantığı düzeyinde kilitleme mekanizmalarının, sınırlı kaynakların (ör. sinema koltukları, teslimat zamanları) uygulamanın mantığı manipüle edilerek çift rezervasyona neden olmamasını sağladığı doğrulanmalıdır.",,✓,✓,, +V2,Doğrulama ve İş Mantığı,V2.3,İş Mantığı Güvenliği,V2.3.5,"Yüksek değerli iş mantığı akışlarının, yetkisiz veya kazara gerçekleşebilecek işlemleri önlemek için çoklu kullanıcı onayı gerektirdiği doğrulanmalıdır. Bu işlemler büyük para transferleri, sözleşme onayları, gizli bilgilere erişim veya üretimde güvenlik kurallarının geçersiz kılınmaları gibi durumları içerebilir.",,,✓,, +V2,Doğrulama ve İş Mantığı,V2.4,Otomasyon Karşıtı Önlemler,V2.4.1,"Uygulama işlevlerine yönelik aşırı miktardaki çağrılara karşı; veri sızdırma, anlamsız veri üretme, kota tüketme, hız sınırının aşılması, hizmet reddi (DoS) ya da maliyetli kaynakların aşırı kullanımı gibi risklere karşı otomasyon karşıtı kontrollerin bulunduğu doğrulanmalıdır.",,✓,✓,, +V2,Doğrulama ve İş Mantığı,V2.4,Otomasyon Karşıtı Önlemler,V2.4.2,"İş mantığı akışlarının, aşırı hızlı işlem gönderimlerini önleyecek şekilde gerçekçi insan zamanlaması gerektirdiği doğrulanmalıdır.",,,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.1,Web Frontend Güvenlik Dokümantasyonu,V3.1.1,"Uygulama dokümantasyonunda, uygulamayı kullanan tarayıcıların desteklemesi gereken güvenlik özelliklerinin (ör. HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) ve diğer ilgili HTTP güvenlik mekanizmaları) tanımlandığı doğrulanmalıdır. Ayrıca bu özelliklerin mevcut olmadığı durumlarda uygulamanın nasıl davranması gerektiği (ör. kullanıcıyı uyarmak veya erişimi engellemek) de tanımlanmalıdır.",,,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.2,İçeriğin Yanlış Yorumlanması,V3.2.1,"Tarayıcıların HTTP yanıtlarında içerik veya işlevi yanlış bir bağlamda sunmalarını önlemek amacıyla güvenlik kontrollerinin uygulandığı doğrulanmalıdır (ör. API, kullanıcı tarafından yüklenen dosya veya başka bir kaynağın doğrudan çağrılması durumunda). Olası kontroller arasında; yalnızca HTTP istek başlıklarının (ör. Sec-Fetch-\*) doğru bağlamı gösterdiği durumlarda içeriğin sunulması, Content-Security-Policy başlığında ""sandbox"" yönergesinin kullanılması veya Content-Disposition başlığında ""attachment"" biçiminin kullanılması yer alabilir.",✓,✓,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.2,İçeriğin Yanlış Yorumlanması,V3.2.2,"HTML yerine metin olarak görüntülenmesi amaçlanan içeriğin, HTML veya JavaScript gibi içeriklerin istenmeden çalıştırılmasını önleyecek şekilde ""createTextNode"" veya ""textContent"" gibi güvenli işleme fonksiyonlarıyla işlendiği doğrulanmalıdır.",✓,✓,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.2,İçeriğin Yanlış Yorumlanması,V3.2.3,"Uygulamanın istemci tarafı JavaScript kullanırken açık değişken tanımlamaları yaparak, sıkı tür kontrolü uygulayarak, global değişkenleri document nesnesine kaydetmekten kaçınarak ve ad alanı izolasyonu sağlayarak DOM clobbering’den kaçındığı doğrulanmalıdır.",,,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.3,Çerez Yapılandırması,V3.3.1,"Çerezlerin 'Secure' niteliğine sahip olduğu ve eğer çerez adı '\__Host-' ön eki ile başlamıyorsa, '__Secure-' ön ekinin kullanıldığı doğrulanmalıdır.",✓,✓,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.3,Çerez Yapılandırması,V3.3.2,"Kullanıcı arayüzü kandırma saldırılarına ve tarayıcı tabanlı istek sahteciliği saldırılarına (CSRF) karşı koruma sağlamak amacıyla, her çerezin 'SameSite' niteliğinin kullanım amacına uygun şekilde ayarlandığı doğrulanmalıdır.",,✓,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.3,Çerez Yapılandırması,V3.3.3,"Çerez adı, diğer sunucularla paylaşılmak üzere açıkça tasarlanmadığı sürece '__Host-' ön eki ile tanımlanmalıdır.",,✓,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.3,Çerez Yapılandırması,V3.3.4,"Bir çerez değeri istemci tarafı betikleri tarafından erişilememesi gereken bir veri içeriyorsa (ör. oturum token'ı), çerezin 'HttpOnly' niteliğine sahip olduğu ve aynı değerin (ör. oturum token'ı) yalnızca 'Set-Cookie' başlığı ile istemciye iletildiği doğrulanmalıdır.",,✓,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.3,Çerez Yapılandırması,V3.3.5,"Uygulama bir çerez oluştururken, çerez adı ve değerinin toplam uzunluğunun 4096 baytı aşmadığı doğrulanmalıdır. Çok büyük çerezler tarayıcı tarafından saklanmaz ve isteklerle gönderilmez; bu da çereze bağlı çalışan uygulama işlevlerinin bozulmasına yol açabilir.",,,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.2,"Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header'ı, uygulama tarafından sabit bir değer olarak tanımlanmalı veya gelen Origin header değeri güvenilir origin’lerden oluşan bir izinli listeye karşı doğrulanmalıdır. ‘Access-Control-Allow-Origin: *’ kullanılması gerekiyorsa, yanıtın hassas bilgi içermediği doğrulanmalıdır.",✓,✓,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.3,"HTTP yanıtlarında Content-Security-Policy header'ı bulunduğu ve bu header'ın yalnızca güvenilen içeriklerin veya kaynakların yüklenmesini ve çalıştırılmasını sağlayan yönergeler içerdiği doğrulanmalıdır. Minimum olarak ""global policy"", object-src 'none', base-uri 'none' yönergelerini içermeli ve izinli liste, nonce veya hash temelli bir yapı içermelidir. Seviye 3 uygulamalarında her yanıt için nonce veya hash içeren özel bir politika tanımlanmalıdır.",,✓,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.4,"Tüm HTTP yanıtlarının 'X-Content-Type-Options: nosniff' header'ını içerdiği doğrulanmalıdır. Bu, tarayıcıya içerik türünü tahmin etmeyi bırakmasını ve yanıtın Content-Type header'ında belirtilen MIME türünün, beklenen kaynak türüyle eşleşmesini zorunlu kılar. Ayrıca bu, tarayıcıda CORB (Cross-Origin Read Blocking) özelliğini etkinleştirir.",,✓,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.5,"Uygulamanın, 'Referer' başlığı yoluyla üçüncü taraflara teknik olarak hassas verilerin sızmasını önlemek için bir 'referrer policy' belirlediği doğrulanmalıdır. Bu, Referrer-Policy HTTP header'ıyla veya HTML öğe nitelikleriyle (element attributes) sağlanabilir. Sızabilecek hassas bilgiler, URL’deki yol ve sorgu parametreleri ile sınırlı uygulamalarda hostname bilgisini içerebilir.",,✓,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.6,"Uygulamanın, Content-Security-Policy header'ı altında 'frame-ancestors' yönergesini her HTTP yanıtında tanımladığı ve bu sayede içeriklerin varsayılan olarak başka sayfalara gömülmesini engellediği doğrulanmalıdır. Gerekli durumlarda özel olarak izin verildiğinden emin olunmalıdır. 'X-Frame-Options' header'ı, tarayıcılar tarafından desteklenmesine rağmen, artık güncel değildir ve güvenlik amacıyla kullanılmamalıdır.",,✓,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.8,"Bir belgenin işlenmesini ve sunulmasını başlatan tüm HTTP yanıtlarında (örneğin 'text/html' tipi yanıtlar), 'Cross-Origin-Opener-Policy' header'ı 'same-origin' veya 'same-origin-allow-popups' yönergeleriyle birlikte yer almalıdır. Bu, tabnabbing ve frame counting gibi, pencere nesnelerine paylaşımlı erişimi sömüren saldırılara karşı koruma sağlar.",,,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.1,"Uygulama, hassas işlevselliğe yönelik izinsiz cross-origin istekleri önlemek için CORS preflight mekanizmasına güvenmiyorsa, bu tür isteklerin gerçekten uygulamadan geldiği doğrulanmalıdır. Bu, anti-forgery token kullanımı veya CORS tarafından güvenli kabul edilmeyen özel HTTP header'larının zorunlu kılınmasıyla yapılabilir. Bu, tarayıcı tabanlı istek sahteciliği (CSRF) saldırılarına karşı bir savunmadır.",✓,✓,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.2,"Uygulama, hassas işlevlerin izinsiz cross-origin çağrılmasını önlemek için CORS preflight mekanizmasına güveniyorsa, bu işlevlerin bir CORS-preflight isteğini tetiklemeden çağrılamadığı doğrulanmalıdır. Bu, 'Origin' ve 'Content-Type' header'larının doğrulanmasını veya CORS-safelisted olmayan bir header'ın ve alanın kullanılmasını gerektirebilir.",✓,✓,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.4,"Farklı uygulamaların farklı hostname'lerde barındırıldığı ve böylece Same-Origin Policy tarafından sağlanan kısıtlamalardan (örneğin çerez erişim sınırları, kaynaklar arası etkileşim kontrolleri) faydalanıldığı doğrulanmalıdır.",,✓,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.6,"Uygulamanın herhangi bir yerinde JSONP işlevselliğinin etkin olmadığı doğrulanmalıdır. Bu, XSSI (Cross-Site Script Inclusion) saldırılarını önlemek içindir.",,,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.7,"Yetkilendirme gerektiren verilerin, JavaScript dosyaları gibi betik kaynaklarının yanıtlarında yer almadığı, XSSI saldırılarını önlemek için doğrulanmalıdır.",,,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.8,"Kimliği doğrulanmış kaynakların (örneğin görseller, videolar, betikler ve belgeler) yalnızca gerçekten amaçlandığında kullanıcı adına yüklenebildiği veya gömülebildiği doğrulanmalıdır. Bu, isteğin uygun olmayan bir çapraz kaynak çağrısından kaynaklanmadığından emin olmak için Sec-Fetch-* HTTP istek başlığı alanlarının sıkı bir şekilde doğrulanmasıyla veya tarayıcıya döndürülen içeriği engelleme talimatı vermek için kısıtlayıcı bir Cross-Origin-Resource-Policy HTTP yanıt başlığı alanı ayarlayarak gerçekleştirilebilir.",,,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.6,Harici Kaynak Bütünlüğü,V3.6.1,"JavaScript kütüphaneleri, CSS veya web fontları gibi istemci tarafı varlıkların yalnızca statik ve sürümlü olması, varlığın bütünlüğünü doğrulamak için Subresource Integrity (SRI) kullanılması durumunda harici olarak (örneğin, bir İçerik Dağıtım Ağı üzerinde) barındırıldığı doğrulanmalıdır. Bu mümkün değilse, her bir kaynak için bunu gerekçelendiren belgelenmiş bir güvenlik kararı bulunmalıdır.",,,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.7,Diğer Tarayıcı Güvenliği Hususları,V3.7.1,"Uygulamanın yalnızca hâlâ desteklenen ve güvenli kabul edilen istemci tarafı teknolojileri kullandığı doğrulanmalıdır. Bu gereksinimi karşılamayan teknolojilere örnek olarak NSAPI eklentileri, Flash, Shockwave, ActiveX, Silverlight, NACL veya istemci tarafı Java applet’leri verilebilir.",,✓,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.7,Diğer Tarayıcı Güvenliği Hususları,V3.7.2,"Uygulamanın, yalnızca hedef adres bir izinli listede yer alıyorsa kullanıcıyı otomatik olarak farklı bir ana makine adına veya uygulamanın kontrolünde olmayan bir etki alanına yönlendirdiği doğrulanmalıdır.",,✓,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.7,Diğer Tarayıcı Güvenliği Hususları,V3.7.3,"Uygulamanın, kullanıcı uygulamanın kontrolü dışındaki bir URL’ye yönlendirildiğinde, yönlendirme hakkında bir bildirim gösterdiği ve kullanıcının bu gezintiyi iptal edebilmesi için bir seçenek sunduğu doğrulanmalıdır.",,,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.7,Diğer Tarayıcı Güvenliği Hususları,V3.7.4,"Uygulamanın en üst düzey etki alanının (örneğin, site.tld) HTTP Strict Transport Security (HSTS) için genel preload listesine eklendiği doğrulanmalıdır. Bu, uygulamanın TLS kullanımının ana tarayıcılar tarafından doğrudan tanınmasını ve yalnızca Strict-Transport-Security yanıt header'ına bağlı kalınmamasını sağlar.",,,✓,, +V3,Web Ön Uç (Frontend) Güvenliği,V3.7,Diğer Tarayıcı Güvenliği Hususları,V3.7.5,"Uygulamaya erişen tarayıcının beklenen güvenlik özelliklerini desteklememesi durumunda, uygulamanın dokümantasyona uygun şekilde davrandığı (örneğin kullanıcıyı uyarma veya erişimi engelleme) doğrulanmalıdır.",,,✓,, +V4,API ve Web Servisi,V4.1,Genel Web Servisi Güvenliği,V4.1.1,"İleti gövdesi içeren her HTTP yanıtında, yanıtın gerçek içeriğiyle eşleşen bir Content-Type header alanı bulunduğu ve güvenli karakter kodlamasını (örneğin, UTF-8, ISO-8859-1) belirtmek üzere charset parametresi içerdiği doğrulanmalıdır. Bu işlem, IANA Medya Türleri'nden ""text/"", ""/+xml"" ve ""/xml"" gibi içerikler için geçerlidir.",✓,✓,✓,, +V4,API ve Web Servisi,V4.1,Genel Web Servisi Güvenliği,V4.1.2,"Yalnızca kullanıcı arayüzüne yönelik uç noktaların (manuel olarak web tarayıcısı ile erişilmesi amaçlanan) otomatik olarak HTTP'den HTTPS'e yönlendirme yaptığı ve diğer hizmetlerin veya uç noktaların şeffaf yönlendirme gerçekleştirmediği doğrulanmalıdır. Bu, istemcinin farkında olmadan şifrelenmemiş HTTP istekleri göndermesi ve bu isteklerin otomatik olarak HTTPS'e yönlendirilmesi sonucunda hassas verilerin sızmasının fark edilmemesi riskini önlemek içindir.",,✓,✓,, +V4,API ve Web Servisi,V4.1,Genel Web Servisi Güvenliği,V4.1.3,"Uygulama tarafından kullanılan ve yük dengeleyici, web proxy veya frontend için backend hizmeti gibi bir ara katman tarafından ayarlanan herhangi bir HTTP başlık alanının, son kullanıcı tarafından geçersiz kılınamayacağı doğrulanmalıdır. Örnek başlıklar arasında X-Real-IP, X-Forwarded-* veya X-User-ID yer alabilir.",,✓,✓,, +V4,API ve Web Servisi,V4.1,Genel Web Servisi Güvenliği,V4.1.4,Uygulama veya API tarafından açıkça desteklenen HTTP yöntemlerinin (preflight istekleri sırasında OPTIONS dahil) dışında hiçbir yöntemin kullanılmadığı ve kullanılmayan yöntemlerin engellendiği doğrulanmalıdır.,,,✓,, +V4,API ve Web Servisi,V4.1,Genel Web Servisi Güvenliği,V4.1.5,"Çok hassas istekler veya birçok sistemden geçen işlemler için, taşıma katmanı güvenliğinin üzerine ek bir güvence sağlamak amacıyla, her iletiye özel dijital imzaların kullanıldığı doğrulanmalıdır.",,,✓,, +V4,API ve Web Servisi,V4.2,HTTP İleti Yapısı Doğrulama,V4.2.1,"Tüm uygulama bileşenlerinin (yük dengeleyiciler, güvenlik duvarları ve uygulama sunucuları dahil) HTTP sürümüne uygun mekanizmaları kullanarak gelen HTTP iletilerinin sınırlarını belirlediği ve bu sayede HTTP istek kaçakçılığına karşı koruma sağlandığı doğrulanmalıdır. HTTP/1.x sürümünde Transfer-Encoding başlık alanı varsa, RFC 2616'ya göre Content-Length başlığı göz ardı edilmelidir. HTTP/2 veya HTTP/3 kullanıldığında, Content-Length başlığı varsa, alıcının bu değerin DATA çerçevelerinin uzunluğuyla tutarlı olduğunu doğrulaması gerekir.",,✓,✓,, +V4,API ve Web Servisi,V4.2,HTTP İleti Yapısı Doğrulama,V4.2.2,"HTTP iletileri üretilirken, Content-Length başlığının, HTTP protokolünün çerçeveleme yöntemine göre belirlenen içerik uzunluğu ile çelişmediği doğrulanmalıdır. Bu, istek kaçakçılığı saldırılarını önlemek için gereklidir.",,,✓,, +V4,API ve Web Servisi,V4.2,HTTP İleti Yapısı Doğrulama,V4.2.3,"Uygulamanın, yanıt bölme ve header enjeksiyonu saldırılarını önlemek amacıyla, bağlantıya özel başlık alanları (örneğin Transfer-Encoding) içeren HTTP/2 veya HTTP/3 iletilerini göndermediği ve kabul etmediği doğrulanmalıdır.",,,✓,, +V4,API ve Web Servisi,V4.2,HTTP İleti Yapısı Doğrulama,V4.2.4,"Uygulamanın yalnızca başlık alanları ve değerleri CR (\r), LF (\n) veya CRLF (\r\n) karakter dizileri içermeyen HTTP/2 ve HTTP/3 isteklerini kabul ettiği doğrulanmalıdır. Bu, başlık enjeksiyonu saldırılarını önlemek içindir.",,,✓,, +V4,API ve Web Servisi,V4.2,HTTP İleti Yapısı Doğrulama,V4.2.5,"Uygulama (backend veya frontend) istek oluşturuyor ve gönderiyorsa, URI'ler (örneğin API çağrıları için) veya HTTP istek başlıkları (örneğin Authorization veya Cookie) gibi bileşenlerin, alıcı sistemler tarafından kabul edilemeyecek kadar uzun olmamasını sağlamak amacıyla doğrulama, temizleme veya diğer mekanizmaları kullandığı doğrulanmalıdır. Bu tür çok uzun istekler (örneğin çok uzun bir Cookie başlığı) gönderildiğinde sunucunun sürekli hata durumu döndürmesiyle hizmet reddi oluşabilir.",,,✓,, +V4,API ve Web Servisi,V4.3,GraphQL,V4.3.1,"Maliyetli ve iç içe geçmiş sorgular sonucu oluşabilecek GraphQL veya veri katmanı ifadelerine yönelik Hizmet Reddi (DoS) saldırılarını önlemek için, sorgu izin listesi (allowlist), derinlik sınırlandırması, sorgu sayısı sınırlandırması veya sorgu maliyeti analizi kullanıldığı doğrulanmalıdır.",,✓,✓,, +V4,API ve Web Servisi,V4.3,GraphQL,V4.3.2,"GraphQL introspection (iç yapı sorgulama) sorgularının, GraphQL API'nin üçüncü taraflar tarafından kullanılmasına yönelik olmadığı sürece, üretim ortamında devre dışı bırakıldığı doğrulanmalıdır.",,✓,✓,, +V4,API ve Web Servisi,V4.4,WebSocket,V4.4.1,Tüm WebSocket bağlantılarında TLS üzerinden WebSocket (WSS) kullanıldığı doğrulanmalıdır.,✓,✓,✓,, +V4,API ve Web Servisi,V4.4,WebSocket,V4.4.2,"WebSocket'in başlangıçtaki HTTP el sıkışması (handshake) sırasında, Origin başlık alanının uygulama için izin verilen origin listesiyle karşılaştırılarak kontrol edildiği doğrulanmalıdır.",,✓,✓,, +V4,API ve Web Servisi,V4.4,WebSocket,V4.4.3,"Uygulamanın standart oturum yönetimi kullanılamıyorsa, bunun yerine ilgili Oturum Yönetimi güvenlik gereksinimlerine uygun özel token'ların kullanıldığı doğrulanmalıdır.",,✓,✓,, +V4,API ve Web Servisi,V4.4,WebSocket,V4.4.4,"HTTPS oturumu WebSocket kanalına geçerken, özel WebSocket oturum yönetim token’larının önceki şekilde kimliği doğrulanmış HTTPS oturumu aracılığıyla elde edildiği veya doğrulandığı doğrulanmalıdır.",,✓,✓,, +V5,Dosya İşleme,V5.1,Dosya İşleme Dokümantasyonu,V5.1.1,"Dokümantasyonun, her yükleme özelliği için izin verilen dosya türlerini, beklenen dosya uzantılarını ve maksimum boyutu (açılmış hali dahil) tanımladığı doğrulanmalıdır. Ayrıca, dosyaların son kullanıcılar için nasıl güvenli hâle getirileceği (örneğin kötü amaçlı bir dosya tespit edildiğinde uygulamanın nasıl davranacağı) gibi bilgilerin de belgede yer aldığı doğrulanmalıdır.",,✓,✓,, +V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.1,"Uygulamanın, yalnızca performans kaybına veya hizmet reddine yol açmayacak boyuttaki dosyaları kabul ettiği doğrulanmalıdır.",✓,✓,✓,, +V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.2,"Uygulama bir dosyayı, doğrudan veya bir arşiv (ör. zip dosyası) içinde kabul ettiğinde, dosya uzantısının beklenen uzantıyla eşleşip eşleşmediğini kontrol ettiği ve içeriğin uzantı tarafından temsil edilen türle uyumlu olduğunu doğruladığı kontrol edilmelidir. Bu; ilk 'magic byte' kontrolü, görüntü yeniden yazımı ve dosya içeriği doğrulama için özel kütüphanelerin kullanımı gibi yöntemleri içerir. Seviye 1 için bu, yalnızca iş veya güvenlik kararlarında kullanılan dosyalarla sınırlı olabilir. Seviye 2 ve üzeri için tüm dosyalar bu kontrole tabi olmalıdır.",✓,✓,✓,, +V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.3,"Sıkıştırılmış dosyaların (ör. zip, gz, docx, odt) açılmadan önce, izin verilen maksimum açılmış boyuta ve maksimum dosya sayısına göre kontrol edildiği doğrulanmalıdır.",,✓,✓,, +V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.4,Her kullanıcı için dosya boyutu kotası ve maksimum dosya sayısının uygulandığı doğrulanmalıdır. Böylece tek bir kullanıcının çok sayıda veya aşırı büyük dosya yükleyerek depolama alanını doldurması engellenir.,,,✓,, +V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.5,"Uygulamanın, içinde sembolik bağlantılar (symlink) bulunan sıkıştırılmış dosyaların yüklenmesine yalnızca bu durum özel olarak gerekli olduğunda izin verdiği doğrulanmalıdır. Bu durumda, sembolik bağlantı verilebilecek dosyaların bir izinli listesi uygulanmalıdır.",,,✓,, +V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.6,"Uygulamanın, piksel boyutu izin verilen maksimum değeri aşan görüntü dosyalarının yüklenmesini reddettiği doğrulanmalıdır. Bu, pixel flood saldırılarını önlemek için gereklidir.",,,✓,, +V5,Dosya İşleme,V5.3,Dosya Depolama,V5.3.1,"Güvenilmeyen girdilerle yüklenen veya oluşturulan ve herkese açık klasörlerde depolanan dosyaların, bir HTTP isteğiyle doğrudan erişildiğinde sunucu taraflı program kodu olarak çalıştırılmadığı doğrulanmalıdır.",✓,✓,✓,, +V5,Dosya İşleme,V5.3,Dosya Depolama,V5.3.2,"Uygulamanın, dosya işlemleri için dosya yollarını oluştururken kullanıcı tarafından gönderilen dosya adlarını değil, dahili olarak oluşturulan veya güvenilir verileri kullandığı; eğer kullanıcı tarafından gönderilen dosya adları veya meta veriler kullanılacaksa, sıkı doğrulama ve temizleme işlemlerinin uygulandığı doğrulanmalıdır. Bu, yol geçişi (path traversal), yerel veya uzak dosya dahil etme (LFI, RFI) ve sunucu tarafı istek sahteciliği (SSRF) saldırılarına karşı koruma sağlar.",✓,✓,✓,, +V5,Dosya İşleme,V5.3,Dosya Depolama,V5.3.3,"Sunucu tarafında gerçekleşen dosya işlemlerinin (örneğin dosya açma/decompress işlemi), kullanıcı tarafından sağlanan yol bilgilerini yok saydığı ve zip slip gibi güvenlik açıklarını önlediği doğrulanmalıdır.",,,✓,, +V5,Dosya İşleme,V5.4,Dosya İndirme,V5.4.1,"Uygulamanın, kullanıcı tarafından gönderilen dosya adlarını (ör. JSON, JSONP veya URL parametresinde) doğruladığı veya göz ardı ettiği ve yanıtın Content-Disposition başlık alanında bir dosya adı belirttiği doğrulanmalıdır.",,✓,✓,, +V5,Dosya İşleme,V5.4,Dosya İndirme,V5.4.2,"Sunulan dosya adlarının (örneğin HTTP yanıt header'larında veya e-posta eklerinde), belge yapısını korumak ve enjeksiyon saldırılarını önlemek için kodlandığı veya temizlendiği (ör. RFC 6266’ya uygun) doğrulanmalıdır.",,✓,✓,, +V5,Dosya İşleme,V5.4,Dosya İndirme,V5.4.3,"Güvenilmeyen kaynaklardan elde edilen dosyaların, bilinen kötü amaçlı içeriklerin sunulmasını önlemek amacıyla antivirüs tarayıcılarıyla tarandığı doğrulanmalıdır.",,✓,✓,, +V6,Kimlik Doğrulama,V6.1,Kimlik Doğrulama Dokümantasyonu,V6.1.1,"Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırılarına karşı oran sınırlama (rate limiting), otomasyon karşıtı önlemler ve uyarlanabilir yanıt gibi kontrollerin nasıl kullanıldığını açıklayan bir uygulama dokümantasyonu bulunduğu doğrulanmalıdır. Dokümantasyon, bu kontrollerin nasıl yapılandırıldığını ve kötü niyetli hesap kilitlemenin nasıl önlendiğini açıkça ortaya koymalıdır.",✓,✓,✓,, +V6,Kimlik Doğrulama,V6.1,Kimlik Doğrulama Dokümantasyonu,V6.1.2,"Parolalarda kullanılmasını önlemek amacıyla, bağlama özgü sözcüklerin (örneğin kurum adlarının permütasyonları, ürün adları, sistem tanımlayıcıları, proje kod adları, departman veya rol adları vb.) bulunduğu belgelenmiş bir liste mevcut olduğu doğrulanmalıdır.",,✓,✓,, +V6,Kimlik Doğrulama,V6.1,Kimlik Doğrulama Dokümantasyonu,V6.1.3,"Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, bunların tümünün belgelenmiş olduğu ve her yol için tutarlı şekilde uygulanması gereken güvenlik kontrolleri ile kimlik doğrulama gücünün tanımlandığı doğrulanmalıdır.",,✓,✓,, +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.1,"Kullanıcı tarafından belirlenen parolaların en az 8 karakter uzunluğunda olması sağlanmalı, ancak 15 karakter ve üzeri uzunlukta parolalar olmaları şiddetle tavsiye edilir.",✓,✓,✓,, +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.2,Kullanıcıların parolalarını değiştirebilmeleri sağlanmalıdır.,✓,✓,✓,, +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.3,Parola değiştirme işlevinin hem mevcut hem de yeni parolayı gerektirdiği doğrulanmalıdır.,✓,✓,✓,, +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.4,"Kayıt veya parola değişimi sırasında girilen parolaların, uygulamanın parola politikasına (örneğin minimum uzunluk) uyan ilk 3000 yaygın parolaya karşı kontrol edildiği doğrulanmalıdır.",✓,✓,✓,, +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.5,"Her tür karakterin kullanılmasına izin verildiği ve büyük/küçük harf, sayı veya özel karakter şartlarının zorunlu tutulmadığı doğrulanmalıdır.",✓,✓,✓,, +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.6,"Parola giriş alanlarının, girdiyi maskelemek için ""type=password"" kullandığı doğrulanmalıdır. Uygulamalar, kullanıcının tüm maskelenmiş parolayı ya da son girilen karakteri geçici olarak görüntülemesine izin verebilir.",✓,✓,✓,, +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.7,"""Yapıştır"" özelliğinin, tarayıcı parola yardımcılarının ve harici parola yöneticilerinin kullanımına izin verildiği doğrulanmalıdır.",✓,✓,✓,, +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.8,"Uygulamanın, kullanıcıdan aldığı parolayı herhangi bir şekilde değiştirmeden, örneğin kesmeden veya harf büyüklüğünü değiştirmeden, tam olarak doğruladığı teyit edilmelidir.",✓,✓,✓,, +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.9,En az 64 karakter uzunluğundaki parolalara izin verildiği doğrulanmalıdır.,,✓,✓,, +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.10,"Kullanıcının parolasının, yalnızca ele geçirildiği tespit edildiğinde veya kullanıcı tarafından yenilendiğinde geçerliliğini yitirdiği doğrulanmalıdır. Uygulama, belirli aralıklarla parola yenilenmesini zorunlu kılmamalıdır.",,✓,✓,, +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.11,"Tahmin edilmesi kolay parolaların oluşturulmasını önlemek amacıyla, bağlama özgü kelimelerin yer aldığı belgelenmiş listenin parola doğrulamada kullanıldığı teyit edilmelidir.",,✓,✓,, +V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.12,"Kayıt veya parola değişikliği sırasında girilen parolaların, ele geçirilmiş parolalar listesine karşı kontrol edildiği doğrulanmalıdır.",,✓,✓,, +V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.1,"Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırıları gibi saldırıları önlemeye yönelik kontrollerin, uygulamanın güvenlik dokümantasyonuna göre uygulandığı doğrulanmalıdır.",✓,✓,✓,, +V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.2,"""root"", ""admin"" veya ""sa"" gibi varsayılan kullanıcı hesaplarının uygulamada yer almadığı veya devre dışı bırakıldığı doğrulanmalıdır.",✓,✓,✓,, +V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.3,"Uygulamaya erişim için ya çok faktörlü bir kimlik doğrulama mekanizması ya da tek faktörlü mekanizmaların kombinasyonu kullanılmalıdır. Seviye 3 için, bu faktörlerden biri, oltalama saldırılarına karşı direnç sağlayan ve kimlik doğrulama niyetini bir kullanıcı etkileşimi (örneğin FIDO donanım anahtarında bir düğmeye basma veya mobil telefonda bir onay) gerektirerek doğrulayan donanım tabanlı bir kimlik doğrulayıcı olmalıdır. Bu gereksinimdeki herhangi bir esneklik için, gerekçesi belgelenmiş ve riskleri azaltıcı kapsamlı kontroller içeren bir plan gereklidir.",,✓,✓,, +V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.4,"Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, belgelendirilmemiş bir yol bulunmadığı ve tüm yollar için güvenlik kontrolleri ile kimlik doğrulama gücünün tutarlı şekilde uygulandığı doğrulanmalıdır.",,✓,✓,, +V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.5,"Başarılı veya başarısız şüpheli kimlik doğrulama girişimlerinin kullanıcıya bildirildiği doğrulanmalıdır. Bu, olağandışı bir konum veya istemciden gelen girişimler, yalnızca bir faktörle yapılan kısmen başarılı doğrulamalar, uzun süreli inaktiflik sonrası yapılan girişimler veya birçok başarısız denemeden sonraki başarılı girişimler gibi durumları içerebilir.",,,✓,, +V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.6,"E-postanın, tek faktörlü ya da çok faktörlü kimlik doğrulama mekanizması olarak kullanılmadığı doğrulanmalıdır.",,,✓,, +V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.7,"Kimlik doğrulama detaylarında yapılan güncellemeler sonrasında (örneğin kimlik bilgisi sıfırlama, kullanıcı adı veya e-posta adresi değişiklikleri), kullanıcıların bilgilendirildiği doğrulanmalıdır.",,,✓,, +V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.8,"Başarısız kimlik doğrulama girişimlerinden, geçerli kullanıcıların hata mesajları, HTTP yanıt kodları veya farklı yanıt süreleri gibi sonuçlara dayanarak tespit edilemediği doğrulanmalıdır. Bu koruma, kayıt ve ""parolamı unuttum"" işlevselliğinde de geçerli olmalıdır.",,,✓,, +V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.1,"Sistem tarafından oluşturulan ilk parolaların veya etkinleştirme kodlarının güvenli bir şekilde rastgele üretildiği, mevcut parola politikasına uygun olduğu, kısa bir süre içinde veya ilk kullanım sonrasında geçerliliğini yitirdiği doğrulanmalıdır. Bu başlangıç sırları uzun vadeli parola olarak kullanılmasına izin verilmemelidir.",✓,✓,✓,, +V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.2,"Parola ipuçlarının veya ""gizli sorular"" olarak bilinen, bilgiye dayalı kimlik doğrulama mekanizmalarının mevcut olmadığı doğrulanmalıdır.",✓,✓,✓,, +V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.3,"Unutulmuş parolanın sıfırlanması için, etkin olan çok faktörlü kimlik doğrulama mekanizmalarını atlamayan güvenli bir sürecin uygulandığı doğrulanmalıdır.",,✓,✓,, +V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.4,"Çok faktörlü kimlik doğrulama faktörlerinden biri kaybolursa, kayıt sırasında uygulanan kimlik kanıtlama seviyesiyle aynı seviyede kimlik doğrulama yapıldığı doğrulanmalıdır.",,✓,✓,, +V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.5,"Süresi dolacak kimlik doğrulama mekanizmalarının yenilenmesine ilişkin talimatların, süresi dolmadan önce tamamlanacak şekilde yeterli sürede gönderildiği ve gerekiyorsa otomatik hatırlatıcıların yapılandırıldığı doğrulanmalıdır.",,,✓,, +V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.6,"Yönetici yetkisi olan kullanıcıların, kullanıcının parola sıfırlama sürecini başlatabildiği ancak kullanıcının yeni parolasını belirleyemediği veya değiştiremediği doğrulanmalıdır. Bu, yönetici yetkisi olan kullanıcıların, kullanıcı parolasını bilmesini engeller.",,,✓,, +V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.1,"Arama sırları, bant dışı kimlik doğrulama istekleri veya kodları ve zamana dayalı tek kullanımlık parolaların (TOTP) yalnızca bir kez kullanılabildiği doğrulanmalıdır.",,✓,✓,, +V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.2,"Uygulamanın backend tarafında saklanırken, 112 bitten az entropiye sahip (örneğin 19 rastgele harf-rakam karakteri veya 34 rastgele rakam) arama sırlarının, 32-bit rastgele bir salt içeren onaylı bir parola saklama algoritmasıyla hash’lendiği doğrulanmalıdır. Gizli bilginin entropisi 112 bit veya daha fazlaysa standart bir hash fonksiyonu kullanılabilir.",,✓,✓,, +V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.3,"Arama sırları, bant dışı kimlik doğrulama kodları ve zamana dayalı tek kullanımlık parola seed'lerinin, öngörülebilir değerlerden kaçınmak için Kriptografik Olarak Güvenli Sözde Rastgele Sayı Üreteci (CSPRNG) ile oluşturulduğu doğrulanmalıdır.",,✓,✓,, +V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.4,Arama sırlarının ve bant dışı kimlik doğrulama kodlarının en az 20 bit entropiye (genellikle 4 rastgele harf-rakam karakteri veya 6 rastgele rakam) sahip olduğu doğrulanmalıdır.,,✓,✓,, +V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.5,"Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının ve zamana dayalı tek kullanımlık parolaların (TOTP) belirli bir ömre sahip olduğu doğrulanmalıdır. Bant dışı istekler en fazla 10 dakika, TOTP’ler ise en fazla 30 saniye geçerli olmalıdır.",,✓,✓,, +V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.6,Herhangi bir kimlik doğrulama faktörünün (fiziksel cihazlar dahil) çalınması veya kaybı durumunda iptal edilebildiği doğrulanmalıdır.,,,✓,, +V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.7,"Biyometrik kimlik doğrulama mekanizmalarının yalnızca ikincil faktör olarak, “sahip olduğunuz bir şey” veya “bildiğiniz bir şey” ile birlikte kullanıldığı doğrulanmalıdır.",,,✓,, +V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.8,"Zamana dayalı tek kullanımlık parolaların (TOTP) doğrulamasının, güvenilir bir hizmetten alınan zaman kaynağına dayanarak yapıldığı ve güvenilir olmayan veya istemci tarafından sağlanan zaman kaynağına dayanmadığı doğrulanmalıdır.",,,✓,, +V6,Kimlik Doğrulama,V6.6,Bant Dışı Kimlik Doğrulama Mekanizmaları,V6.6.1,"Tek kullanımlık parolaların (OTP) telefon veya SMS ile Public Switched Telephone Network (PSTN) üzerinden iletildiği kimlik doğrulama mekanizmalarının, yalnızca telefon numarası önceden doğrulanmışsa, alternatif daha güçlü yöntemler (örneğin TOTP) de sunuluyorsa ve kullanıcıya güvenlik riskleri hakkında bilgi veriliyorsa sunulduğu doğrulanmalıdır. Seviye 3 uygulamalar için telefon ve SMS seçenekleri sunulmamalıdır.",,✓,✓,, +V6,Kimlik Doğrulama,V6.6,Bant Dışı Kimlik Doğrulama Mekanizmaları,V6.6.2,"Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının, oluşturuldukları özgün kimlik doğrulama isteğiyle bağlantılı olduğu ve daha önceki ya da sonraki bir istek için kullanılamadığı doğrulanmalıdır.",,✓,✓,, +V6,Kimlik Doğrulama,V6.6,Bant Dışı Kimlik Doğrulama Mekanizmaları,V6.6.3,"Kod tabanlı bant dışı kimlik doğrulama mekanizmalarının, oran sınırlaması ile kaba kuvvet saldırılarına karşı korunduğu doğrulanmalıdır. En az 64 bit entropiye sahip kodlar kullanılması da değerlendirilmelidir.",,✓,✓,, +V6,Kimlik Doğrulama,V6.6,Bant Dışı Kimlik Doğrulama Mekanizmaları,V6.6.4,"Çok faktörlü kimlik doğrulama için push bildirimleri kullanılıyorsa, push bombing saldırılarına karşı oran sınırlamasının kullanıldığı doğrulanmalıdır. “Numara eşleştirme” de bu riski azaltabilir.",,,✓,, +V6,Kimlik Doğrulama,V6.7,Kriptografik Kimlik Doğrulama Mekanizması,V6.7.1,"Kriptografik kimlik doğrulama beyanlarını doğrulamak için kullanılan sertifikaların, değiştirilmeye karşı korumalı şekilde saklandığı doğrulanmalıdır.",,,✓,, +V6,Kimlik Doğrulama,V6.7,Kriptografik Kimlik Doğrulama Mekanizması,V6.7.2,Challenge nonce değerinin en az 64 bit uzunluğunda olduğu ve istatistiksel olarak benzersiz ya da cihazın ömrü boyunca benzersiz olduğu doğrulanmalıdır.,,,✓,, +V6,Kimlik Doğrulama,V6.8,Kimlik Sağlayıcısı ile Kimlik Doğrulama,V6.8.1,"Uygulama birden fazla kimlik sağlayıcıyı (IdP) destekliyorsa, başka bir desteklenen kimlik sağlayıcı aracılığıyla (örneğin aynı kullanıcı tanımlayıcısını kullanarak) kullanıcının kimliğinin taklit edilemediği doğrulanmalıdır. Standart önlem, uygulamanın kullanıcıyı IdP kimliği (bir ad alanı işlevi görür) ve IdP içindeki kullanıcı kimliğinin birleşimiyle kaydetmesi ve tanımlamasıdır.",,✓,✓,, +V6,Kimlik Doğrulama,V6.8,Kimlik Sağlayıcısı ile Kimlik Doğrulama,V6.8.2,Kimlik doğrulama beyanları üzerindeki dijital imzaların (örneğin JWT veya SAML beyanları) varlığı ve bütünlüğünün her zaman doğrulandığı ve imzasız veya geçersiz imzalı beyanların reddedildiği doğrulanmalıdır.,,✓,✓,, +V6,Kimlik Doğrulama,V6.8,Kimlik Sağlayıcısı ile Kimlik Doğrulama,V6.8.3,"SAML beyanlarının benzersiz biçimde işlendiği ve yalnızca geçerlilik süresi içinde bir kez kullanıldığı, tekrar oynatma (replay) saldırılarını önlemek amacıyla doğrulanmalıdır.",,✓,✓,, +V6,Kimlik Doğrulama,V6.8,Kimlik Sağlayıcısı ile Kimlik Doğrulama,V6.8.4,"Uygulama ayrı bir Kimlik Sağlayıcı (IdP) kullanıyorsa ve belirli işlemler için belirli kimlik doğrulama gücü, yöntemleri veya zaman bilgisi bekliyorsa, uygulamanın bu bilgileri IdP tarafından döndürülen veriler üzerinden doğruladığı teyit edilmelidir. Örneğin OIDC kullanılıyorsa, bu durum ID Token üzerindeki 'acr', 'amr' ve 'auth_time' gibi claim’lerin (varsa) doğrulanması ile sağlanabilir. Eğer IdP bu bilgileri sağlamıyorsa, uygulamanın asgari kimlik doğrulama gücünün kullanıldığını varsayan (örneğin yalnızca kullanıcı adı ve parola ile tek faktörlü doğrulama) belgelenmiş bir yedek yaklaşımı olmalıdır.",,✓,✓,, +V7,Oturum Yönetimi,V7.1,Oturum Yönetim Dokümantasyonu,V7.1.1,"Kullanıcının oturum inaktivite zaman aşımı süresi ve mutlak maksimum oturum süresinin belgelendiği, diğer kontrollerle birlikte uygun olduğu ve NIST SP 800-63B yeniden kimlik doğrulama gereksinimlerinden herhangi bir sapma varsa gerekçesinin belgede yer aldığı doğrulanmalıdır.",,✓,✓,, +V7,Oturum Yönetimi,V7.1,Oturum Yönetim Dokümantasyonu,V7.1.2,"Belgede bir hesap için kaç adet eşzamanlı (paralel) oturuma izin verildiği ile birlikte, maksimum aktif oturum sayısına ulaşıldığında uygulanacak davranış ve işlemlerin tanımlandığı doğrulanmalıdır.",,✓,✓,, +V7,Oturum Yönetimi,V7.1,Oturum Yönetim Dokümantasyonu,V7.1.3,"Birleşik kimlik yönetim ekosisteminin bir parçası olarak kullanıcı oturumu oluşturan ve yöneten tüm sistemlerin, oturum ömrü, sonlandırma ve yeniden kimlik doğrulama gerektiren diğer koşulların nasıl koordine edildiğini açıklayan kontrollerle birlikte belgede yer aldığı doğrulanmalıdır.",,✓,✓,, +V7,Oturum Yönetimi,V7.2,Temel Oturum Yönetimi Güvenliği,V7.2.1,Uygulamanın tüm oturum token'ı doğrulama işlemlerini güvenilir bir backend servisi aracılığıyla gerçekleştirdiği doğrulanmalıdır.,✓,✓,✓,, +V7,Oturum Yönetimi,V7.2,Temel Oturum Yönetimi Güvenliği,V7.2.2,"Uygulamanın, statik API gizli anahtarları veya sabit değerler yerine, oturum yönetimi için dinamik olarak oluşturulan kendi kendine yeterli veya referans token'ları kullandığı doğrulanmalıdır.",✓,✓,✓,, +V7,Oturum Yönetimi,V7.2,Temel Oturum Yönetimi Güvenliği,V7.2.3,"Uygulama kullanıcı oturumlarını temsil etmek için referans token'ları kullanıyorsa, bu token'ların benzersiz olduğu, kriptografik olarak güvenli bir sözde rastgele sayı üreteci (CSPRNG) kullanılarak üretildiği ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır.",✓,✓,✓,, +V7,Oturum Yönetimi,V7.2,Temel Oturum Yönetimi Güvenliği,V7.2.4,"Uygulamanın, kullanıcı kimlik doğrulaması (yeniden kimlik doğrulama dahil) sırasında yeni bir oturum token'ı oluşturduğu ve mevcut oturum token'ını sonlandırdığı doğrulanmalıdır.",✓,✓,✓,, +V7,Oturum Yönetimi,V7.3,Oturum Zaman Aşımı,V7.3.1,Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde bir hareketsizlik zaman aşımı bulunduğu doğrulanmalıdır.,,✓,✓,, +V7,Oturum Yönetimi,V7.3,Oturum Zaman Aşımı,V7.3.2,Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde mutlak bir maksimum oturum süresi bulunduğu doğrulanmalıdır.,,✓,✓,, +V7,Oturum Yönetimi,V7.4,Oturum Sonlandırma,V7.4.1,"Oturum sonlandırma tetiklendiğinde (örneğin, çıkış yapıldığında veya süre dolduğunda), uygulamanın oturumun daha fazla kullanılmasına izin vermediği doğrulanmalıdır. Referans token'lar veya durum bilgili oturumlar için bu, oturum verilerinin uygulama arka ucunda geçersiz kılınması anlamına gelir. Kapsamlı token kullanan uygulamaların; sonlandırılmış token listesi tutmak, kullanıcıya özel tarih ve saatten önce oluşturulan token'ları reddetmek veya kullanıcıya özel imzalama anahtarını yenilemek gibi bir çözüm uygulaması gerekir.",✓,✓,✓,, +V7,Oturum Yönetimi,V7.4,Oturum Sonlandırma,V7.4.2,"Bir kullanıcı hesabı devre dışı bırakıldığında veya silindiğinde (örneğin bir çalışanın şirketten ayrılması), uygulamanın tüm aktif oturumları sonlandırdığı doğrulanmalıdır.",✓,✓,✓,, +V7,Oturum Yönetimi,V7.4,Oturum Sonlandırma,V7.4.3,"Herhangi bir kimlik doğrulama faktörünün başarılı bir şekilde değiştirilmesi veya kaldırılmasından (şifre sıfırlama veya kurtarma yoluyla yapılan değişiklikler dahil ve varsa MFA ayarları güncellemeleri dahil) sonra, uygulamanın diğer tüm aktif oturumları sonlandırma seçeneği sunduğu doğrulanmalıdır.",,✓,✓,, +V7,Oturum Yönetimi,V7.4,Oturum Sonlandırma,V7.4.4,Kimlik doğrulama gerektiren tüm sayfalarda kolay erişilebilir ve görünür bir çıkış yap (logout) işlevi bulunduğu doğrulanmalıdır.,,✓,✓,, +V7,Oturum Yönetimi,V7.4,Oturum Sonlandırma,V7.4.5,"Uygulama yöneticilerinin, bireysel bir kullanıcının veya tüm kullanıcıların aktif oturumlarını sonlandırabilme yetkisine sahip olduğu doğrulanmalıdır.",,✓,✓,, +V7,Oturum Yönetimi,V7.5,Oturum Kötüye Kullanımına Karşı Savunmalar,V7.5.1,"E-posta adresi, telefon numarası, MFA yapılandırması veya hesap kurtarmada kullanılan diğer bilgiler gibi kimlik doğrulamayı etkileyebilecek hassas hesap özniteliklerinde değişiklik yapılmadan önce uygulamanın tam yeniden kimlik doğrulama gerektirdiği doğrulanmalıdır.",,✓,✓,, +V7,Oturum Yönetimi,V7.5,Oturum Kötüye Kullanımına Karşı Savunmalar,V7.5.2,"Kullanıcıların, (en az bir faktörle yeniden kimlik doğrulama yaptıktan sonra) mevcut tüm aktif oturumları görüntüleyebilmesi ve sonlandırabilmesinin mümkün olduğu doğrulanmalıdır.",,✓,✓,, +V7,Oturum Yönetimi,V7.5,Oturum Kötüye Kullanımına Karşı Savunmalar,V7.5.3,"Uygulamanın, son derece hassas işlemler veya operasyonlar gerçekleştirilmeden önce en az bir faktörle ek kimlik doğrulaması veya ikincil bir doğrulama gerektirdiği doğrulanmalıdır.",,,✓,, +V7,Oturum Yönetimi,V7.6,Birleşik Yeniden Kimlik Doğrulama,V7.6.1,"Güvenen Taraf (RP) ile Kimlik Sağlayıcı (IdP) arasındaki oturum süresi ve oturum sonlandırma davranışlarının belgelenmiş olduğu ve, örneğin IdP kimlik doğrulama olayları arasında maksimum süreye ulaşıldığında yeniden kimlik doğrulamanın gerekli kılındığı doğrulanmalıdır.",,✓,✓,, +V7,Oturum Yönetimi,V7.6,Birleşik Yeniden Kimlik Doğrulama,V7.6.2,"Yeni bir oturum oluşturulmasının, kullanıcı onayı veya açık bir eylem gerektirdiği; kullanıcı etkileşimi olmaksızın yeni uygulama oturumlarının oluşturulmasının önlendiği doğrulanmalıdır.",,✓,✓,, +V8,Yetkilendirme,V8.1,Yetkilendirme Dokümantasyonu,V8.1.1,"Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak işlev düzeyinde ve veriye özel erişim kısıtlamaları için kuralları tanımladığı doğrulanmalıdır.",✓,✓,✓,, +V8,Yetkilendirme,V8.1,Yetkilendirme Dokümantasyonu,V8.1.2,"Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak alan (field) düzeyinde erişim kısıtlamaları (hem okuma hem yazma) için kuralları tanımladığı doğrulanmalıdır. Bu kuralların, ilgili veri nesnesinin durum veya statü gibi diğer özniteliklerine bağlı olabileceği unutulmamalıdır.",,✓,✓,, +V8,Yetkilendirme,V8.1,Yetkilendirme Dokümantasyonu,V8.1.3,"Uygulamanın dokümantasyonunun, kimlik doğrulama ve yetkilendirme ile ilgili güvenlik kararlarının alınmasında kullanılan çevresel ve bağlamsal öznitelikleri (günün saati, kullanıcı konumu, IP adresi veya cihaz gibi) tanımladığı doğrulanmalıdır.",,,✓,, +V8,Yetkilendirme,V8.1,Yetkilendirme Dokümantasyonu,V8.1.4,"Kimlik doğrulama ve yetkilendirme dokümantasyonunun; işlev düzeyinde, veriye özel ve alan düzeyinde yetkilendirmenin yanı sıra çevresel ve bağlamsal faktörlerin karar almada nasıl kullanıldığını tanımladığı doğrulanmalıdır. Bu, değerlendirilen öznitelikleri, risk eşiklerini ve alınan aksiyonları (ör. izin ver, doğrulama iste, reddet, step-up kimlik doğrulama) içermelidir.",,,✓,, +V8,Yetkilendirme,V8.2,Genel Yetkilendirme Tasarımı,V8.2.1,"Uygulamanın, işlev düzeyindeki erişimin yalnızca açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır.",✓,✓,✓,, +V8,Yetkilendirme,V8.2,Genel Yetkilendirme Tasarımı,V8.2.2,"Uygulamanın, veriye özel erişimin yalnızca belirli veri öğelerine açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, doğrudan nesne referansı güvenlik açıkları (IDOR) ve bozuk nesne düzeyinde yetkilendirme (BOLA) risklerini azaltır.",✓,✓,✓,, +V8,Yetkilendirme,V8.2,Genel Yetkilendirme Tasarımı,V8.2.3,"Uygulamanın, alan (field) düzeyindeki erişimin yalnızca belirli alanlara açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, bozuk nesne özelliği düzeyinde yetkilendirme (BOPLA) risklerini azaltır.",,✓,✓,, +V8,Yetkilendirme,V8.2,Genel Yetkilendirme Tasarımı,V8.2.4,"Tüketicinin çevresel ve bağlamsal özniteliklerine (ör. günün saati, konum, IP adresi veya cihaz) dayalı uyarlanabilir güvenlik kontrollerinin, uygulama dokümantasyonunda tanımlandığı şekilde, kimlik doğrulama ve yetkilendirme kararları için uygulandığı doğrulanmalıdır. Bu kontroller, tüketici yeni bir oturum başlatmaya çalışırken ve mevcut bir oturum sırasında uygulanmalıdır.",,,✓,, +V8,Yetkilendirme,V8.3,İşlem Düzeyinde Yetkilendirme,V8.3.1,Uygulamanın yetkilendirme kurallarını güvenilir bir servis katmanında uyguladığı ve istemci taraflı JavaScript gibi güvenilmeyen tüketiciler tarafından değiştirilebilecek kontrollerle yetinmediği doğrulanmalıdır.,✓,✓,✓,, +V8,Yetkilendirme,V8.3,İşlem Düzeyinde Yetkilendirme,V8.3.2,"Yetkilendirme kararlarının temelini oluşturan değerlerdeki değişikliklerin hemen uygulandığı doğrulanmalıdır. Değişikliklerin anında uygulanamadığı durumlarda (örneğin self-contained token içindeki verilere güveniliyorsa), tüketici artık yetkili olmadığı hâlde bir işlem gerçekleştirdiğinde uyarı verecek ve değişikliği geri alacak önlemler uygulanmalıdır. Bu alternatifin bilgi sızıntısını önlemeyeceği unutulmamalıdır.",,,✓,, +V8,Yetkilendirme,V8.3,İşlem Düzeyinde Yetkilendirme,V8.3.3,"Bir nesneye erişimin, herhangi bir aracı veya onun adına hareket eden bir servis yerine yalnızca erişimi başlatan öznenin (ör. tüketici) izinlerine dayandığı doğrulanmalıdır. Örneğin, bir tüketici kimlik doğrulama için bir self-contained token kullanarak bir web servis çağırırsa ve bu servis başka bir servisten veri talep ederse, ikinci servis izin kararlarını verirken birinci servisin makine-makine token'ı yerine tüketicinin token'ını kullanmalıdır.",,,✓,, +V8,Yetkilendirme,V8.4,Diğer Yetkilendirme Hususları,V8.4.1,"Multi-tenant uygulamaların, tüketici işlemlerinin izinli olmadıkları tenant'lar üzerinde asla etkili olmamasını sağlamak için tenant'lar arası kontroller kullandığı doğrulanmalıdır.",,✓,✓,, +V8,Yetkilendirme,V8.4,Diğer Yetkilendirme Hususları,V8.4.2,"Yönetici arayüzlerine erişimin, sürekli tüketici kimlik doğrulaması, cihaz güvenlik durumu değerlendirmesi ve bağlamsal risk analizi dahil olmak üzere çok katmanlı güvenlik içerdiği doğrulanmalıdır. Yetkilendirme için yalnızca ağ konumu veya güvenilir uç noktalar yeterli olmamalıdır; ancak bu tür faktörler yetkisiz erişim olasılığını azaltabilir.",,,✓,, +V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.1,Token Kaynağı ve Bütünlüğü,V9.1.1,"Self-contained token'ların içerikleri kabul edilmeden önce, oynama (tampering) saldırılarına karşı dijital imza veya MAC ile doğrulama yapıldığı doğrulanmalıdır.",✓,✓,✓,, +V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.1,Token Kaynağı ve Bütünlüğü,V9.1.2,"Belirli bir bağlam için yalnızca bir allowlist üzerinde bulunan algoritmaların self-contained token oluşturmak ve doğrulamak için kullanılabildiği doğrulanmalıdır. Bu allowlist, yalnızca simetrik ya da yalnızca asimetrik algoritmaları içermeli ve kesinlikle 'None' algoritmasını içermemelidir. Hem simetrik hem de asimetrik algoritmalar desteklenmek zorundaysa, anahtar karışıklığını (key confusion) önlemek için ek kontroller uygulanmalıdır.",✓,✓,✓,, +V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.1,Token Kaynağı ve Bütünlüğü,V9.1.3,"Self-contained token'ları doğrulamak için kullanılan anahtar malzemesinin, token issuer için önceden yapılandırılmış güvenilir kaynaklardan alındığı doğrulanmalıdır. Bu, saldırganların güvenilmeyen kaynak ve anahtarları belirtmesini engeller. JWT ve diğer JWS yapılarında 'jku', 'x5u' ve 'jwk' gibi header'lar güvenilir kaynaklardan oluşan bir allowlist'e göre doğrulanmalıdır.",✓,✓,✓,, +V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.2,Token İçeriği,V9.2.1,"Token verisinde bir geçerlilik zaman aralığı (validity time span) varsa, yalnızca doğrulama zamanı bu zaman aralığı içerisindeyse token ve içeriği kabul edilmelidir. Örneğin, JWT'ler için 'nbf' ve 'exp' claim'leri doğrulanmalıdır.",✓,✓,✓,, +V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.2,Token İçeriği,V9.2.2,"Token'ı alan hizmetin, token içeriğini kabul etmeden önce bu token'ın doğru türde olduğunu ve sunulma amacına uygun olduğunu doğruladığı teyit edilmelidir. Örneğin, yalnızca erişim token'ları yetkilendirme kararları için, yalnızca ID Token'lar kullanıcı kimlik doğrulamasını kanıtlamak için kullanılabilir.",,✓,✓,, +V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.2,Token İçeriği,V9.2.3,"Hizmetin yalnızca kendisiyle kullanılması amaçlanan (audience) token'ları kabul ettiği doğrulanmalıdır. JWT'lerde bu, 'aud' claim'inin hizmet içinde tanımlı bir allowlist ile doğrulanması yoluyla sağlanabilir.",,✓,✓,, +V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.2,Token İçeriği,V9.2.4,"Eğer bir token issuer, farklı audience'lara token oluşturmak için aynı private key'i kullanıyorsa, oluşturulan token'ların hedef audience'ları benzersiz şekilde tanımlayan bir audience kısıtlaması içerdiği doğrulanmalıdır. Bu, bir token'ın farklı bir audience ile yeniden kullanılmasını önler. Audience tanımlayıcısı dinamik olarak sağlanıyorsa, token issuer bu audience'ları doğrulamalı ve audience taklitlerinin (impersonation) önüne geçmelidir.",,✓,✓,, +V10,OAuth ve OIDC,V10.1,Genel OAuth ve OIDC Güvenliği,V10.1.1,"Token'ların yalnızca kesinlikle ihtiyaç duyan bileşenlere gönderildiği doğrulanmalıdır. Örneğin, tarayıcı tabanlı JavaScript uygulamaları için bir backend-for-frontend modeli kullanıldığında, access ve refresh token'lara yalnızca backend'in erişebilmesi gerekir.",,✓,✓,, +V10,OAuth ve OIDC,V10.1,Genel OAuth ve OIDC Güvenliği,V10.1.2,"Authorization server'dan gelen değerler (örneğin authorization code veya ID Token gibi) yalnızca aynı user agent oturumu ve işlemi tarafından başlatılmış bir yetkilendirme akışının sonucuysa kabul edildiği doğrulanmalıdır. Bu, client tarafından oluşturulan secret’ların 'proof key for code exchange' (PKCE) ‘code_verifier’, ‘state’ veya OIDC ‘nonce’ gibi tahmin edilemez, işleme özgü ve hem client’a hem de işlem başlatılan user agent oturumuna güvenli bir şekilde bağlı olmasını gerektirir.",,✓,✓,, +V10,OAuth ve OIDC,V10.2,OAuth İstemcisi,V10.2.1,"Code flow kullanılıyorsa, OAuth client’ın token taleplerini tetikleyen CSRF saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Bu genellikle PKCE kullanılarak veya authorization isteğinde gönderilen ‘state’ parametresinin kontrolü ile sağlanır.",,✓,✓,, +V10,OAuth ve OIDC,V10.2,OAuth İstemcisi,V10.2.2,"OAuth istemcisi birden fazla AS ile etkileşime girebiliyorsa, mix-up saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Örneğin, authorization server’ın 'iss' parametresini döndürmesi zorunlu kılınabilir ve bu parametrenin hem authorization yanıtında hem de token yanıtında doğrulanması gerekir.",,✓,✓,, +V10,OAuth ve OIDC,V10.2,OAuth İstemcisi,V10.2.3,OAuth istemcisinin authorization server’a yaptığı taleplerde yalnızca gerekli scope’ları (veya diğer yetkilendirme parametrelerini) talep ettiği doğrulanmalıdır.,,,✓,, +V10,OAuth ve OIDC,V10.3,OAuth Kaynak Sunucusu (RS),V10.3.1,RS'nin yalnızca bu servisle kullanılmak üzere tasarlanmış access token’ları kabul ettiği doğrulanmalıdır (audience kontrolü). Audience bilgisi yapılandırılmış token’larda (örneğin JWT içindeki ‘aud’ claim’i) yer alabilir veya token introspection endpoint aracılığıyla kontrol edilebilir.,,✓,✓,, +V10,OAuth ve OIDC,V10.3,OAuth Kaynak Sunucusu (RS),V10.3.2,"RS'nin, access token’dan gelen claim’lere dayanarak yetki devri tanımına uygun şekilde yetkilendirme kararları uyguladığı doğrulanmalıdır. ‘sub’, ‘scope’ ve ‘authorization_details’ gibi claim’ler varsa, bu kararın parçası olmalıdır.",,✓,✓,, +V10,OAuth ve OIDC,V10.3,OAuth Kaynak Sunucusu (RS),V10.3.3,"Erişim kontrolü kararında, access token’dan (JWT veya ilgili token introspection yanıtı) benzersiz bir kullanıcının tanımlanması gerekiyorsa, RS'nin başka kullanıcılara devredilemeyecek claim’ler ile kullanıcıyı tanımladığı doğrulanmalıdır. Genellikle bu, ‘iss’ ve ‘sub’ claim’lerinin birlikte kullanılması anlamına gelir.",,✓,✓,, +V10,OAuth ve OIDC,V10.3,OAuth Kaynak Sunucusu (RS),V10.3.4,"RS'nin belirli bir kimlik doğrulama gücü, yöntemi veya güncelliği (recentness) gerektirmesi durumunda, sunulan access token’ın bu kısıtlamaları karşıladığını doğruladığı, örneğin, OIDC ‘acr’, ‘amr’ ve ‘auth_time’ claim’leri kullanılarak doğrulanmalıdır. ",,✓,✓,, +V10,OAuth ve OIDC,V10.3,OAuth Kaynak Sunucusu (RS),V10.3.5,"RS'nin, (yetkisiz taraflarca) çalınmış veya tekrar edilen access token’ların kullanımını önlemek için sender-constrained access token’lar kullandığı doğrulanmalıdır. Bu, OAuth 2 için Mutual TLS veya OAuth 2 Demonstration of Proof of Possession (DPoP) ile sağlanabilir.",,,✓,, +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.1,"AS'nin, istemciye özel önceden kaydedilmiş URI’lerden oluşan bir allowlist kullanarak redirect URI’leri tam dize karşılaştırması ile doğruladığı doğrulanmalıdır.",✓,✓,✓,, +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.2,"AS'nin, ""authorization response"" içinde ""authorization code"" döndürdüğü durumlarda, bu kodun yalnızca bir kez kullanılabildiği doğrulanmalıdır. Daha önce access token vermek için kullanılmış bir authorization code ile yapılan ikinci geçerli token isteği reddedilmeli ve ilgili tüm token’lar iptal edilmelidir.",✓,✓,✓,, +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.3,"Authorization code’un kısa ömürlü olduğu doğrulanmalıdır. L1 ve L2 uygulamalar için maksimum yaşam süresi 10 dakika, L3 uygulamalar için 1 dakikadır.",✓,✓,✓,, +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.4,"Belirli bir istemci için AS'nin yalnızca o istemcinin ihtiyaç duyduğu grant türlerine izin verdiği doğrulanmalıdır. ""Token"" (Implicit flow) ve ""password"" (Resource Owner Password Credentials flow) grant türlerinin artık kullanılmaması gerekir.",✓,✓,✓,, +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.5,"AS'nin, açık istemciler için refresh token replay saldırılarını azalttığı doğrulanmalıdır. Tercihen sender-constrained refresh token’lar (DPoP veya mutual TLS ile certificate-bound access token’lar) kullanılmalıdır. L1 ve L2 uygulamalar için refresh token rotation kullanılabilir. Rotation kullanılıyorsa, AS refresh token’ı kullanım sonrası geçersiz kılmalı ve geçersiz bir refresh token sunulması durumunda o yetkilendirme ile ilişkili tüm refresh token’ları iptal etmelidir.",✓,✓,✓,, +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.6,"Code grant kullanılıyorsa, AS'nin authorization code interception saldırılarına karşı koruma sağladığı doğrulanmalıdır. Yetkilendirme isteğinde geçerli bir ""code_challenge"" değeri zorunlu olmalı ve ""code_challenge_method"" olarak ""plain"" kabul edilmemelidir. Token isteğinde ise ""code_verifier"" parametresi doğrulanmalıdır.",,✓,✓,, +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.7,"AS'nin, kimlik doğrulaması yapılmamış dinamik istemci kaydını desteklemesi durumunda, kötü niyetli istemci uygulamalarına karşı riskleri azalttığı doğrulanmalıdır. Kayıtlı URI’ler gibi client metadata’sı doğrulanmalı, kullanıcı onayı alınmalı ve güvenilmeyen bir client uygulamasıyla yapılan yetkilendirme isteği işlenmeden önce kullanıcı uyarılmalıdır.",,✓,✓,, +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.8,"Refresh token’ların, sliding expiration kullanılsa bile mutlak bir sona erme süresine sahip olduğu doğrulanmalıdır.",,✓,✓,, +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.9,Yetkili bir kullanıcı tarafından AS kullanıcı arayüzü üzerinden refresh token’ların ve reference access token’ların iptal edilebildiği doğrulanmalıdır.,,✓,✓,, +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.10,"Gizli istemcilerin token istekleri, pushed authorization request (PAR) ve token iptal istekleri gibi server’a yapılan backchannel isteklerinde kimliğinin kontrol edildiği doğrulanmalıdır.",,✓,✓,, +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.11,"AS yapılandırmasının, OAuth istemcisine yalnızca gerekli scope’ları atadığı doğrulanmalıdır.",,✓,✓,, +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.12,"Belirli bir client için, authorization server’ın yalnızca client’ın ihtiyaç duyduğu 'response_mode' değerine izin verdiği doğrulanmalıdır. Örneğin, bu değer ya beklenenlerle karşılaştırılarak doğrulanmalı ya da PAR veya JAR kullanılmalıdır.",,,✓,, +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.13,"""Code"" grant türünün daima pushed authorization request (PAR) ile birlikte kullanıldığı doğrulanmalıdır.",,,✓,, +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.14,"AS'nin yalnızca sender-constrained (Proof-of-Possession) access token’lar ürettiği doğrulanmalıdır. Bu, mutual TLS ile certificate-bound access token ya da DPoP ile DPoP-bound access token olabilir.",,,✓,, +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.15,"Sunucu taraflı istemciler için (kullanıcı cihazında çalışmayan), AS'nin ""authorization_details"" parametresinin istemci backend'i tarafından sağlandığını ve kullanıcı tarafından değiştirilmediğini doğruladığı, örneğin pushed authorization request (PAR) or JWT-secured Authorization Request (JAR) zorunlu kılınarak doğrulanmalıdır.",,,✓,, +V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.16,"Bir istemci gizli ise, AS'nin güçlü istemci kimlik doğrulama yöntemlerini zorunlu kıldığı doğrulanmalıdır. Bu yöntemler, public-key cryptography’ye dayalı ve replay saldırılarına karşı dayanıklı olmalı, örneğin mutual TLS (""tls_client_auth"", ""self_signed_tls_client_auth"") veya private key JWT (""private_key_jwt"") gibi.",,,✓,, +V10,OAuth ve OIDC,V10.5,OIDC İstemcisi,V10.5.1,"İstemcinin (relying party olarak) ID Token replay saldırılarını azalttığı doğrulanmalıdır. Örneğin, ID Token’daki 'nonce' claim’inin, OpenID Provider’a gönderilen kimlik doğrulama isteğindeki 'nonce' değeriyle eşleştiği doğrulanmalıdır.",,✓,✓,, +V10,OAuth ve OIDC,V10.5,OIDC İstemcisi,V10.5.2,"İstemcinin kullanıcıyı ID Token claim’lerinden (genellikle, başka kullanıcılarla yeniden atanamayan 'sub' claim’i) benzersiz şekilde tanımladığı doğrulanmalıdır.",,✓,✓,, +V10,OAuth ve OIDC,V10.5,OIDC İstemcisi,V10.5.3,"İstemcinin, kötü niyetli bir AS'nin başka bir AS'yi taklit etmesini AS metadata’sı üzerinden reddettiği doğrulanmalıdır. AS metadata’sındaki issuer URL’si, istemci tarafından beklenen önceden yapılandırılmış issuer URL’siyle tam olarak eşleşmiyorsa, metadata reddedilmelidir.",,✓,✓,, +V10,OAuth ve OIDC,V10.5,OIDC İstemcisi,V10.5.4,"İstemcinin, ID Token’ın kendisi için (audience) kullanılması amaçlandığını doğruladığı doğrulanmalıdır. Bu, token’daki 'aud' claim’inin istemcinin 'client_id' değeriyle eşit olup olmadığının kontrol edilmesiyle yapılır.",,✓,✓,, +V10,OAuth ve OIDC,V10.5,OIDC İstemcisi,V10.5.5,"OIDC back-channel logout kullanıldığında, relying party’nin ""forced logout"" ve ""logout"" akışında ""cross-JWT confusion"" gibi saldırılara karşı koruma sağladığı doğrulanmalıdır. Client, logout token’ın 'logout+jwt' türünde olduğunu, 'event' claim’inin doğru üyeye sahip olduğunu ve 'nonce' claim’i içermediğini doğrulamalıdır. Ayrıca token için kısa bir sona erme süresi (örneğin 2 dakika) önerilir.",,✓,✓,, +V10,OAuth ve OIDC,V10.6,OpenID Provider,V10.6.1,"OpenID Provider’ın yalnızca 'code', 'ciba', 'id_token' veya 'id_token code' response mode değerlerine izin verdiği doğrulanmalıdır. 'code' değeri, 'id_token code' (OIDC Hybrid flow) yerine tercih edilmelidir. 'token' (Implicit flow) kullanılmamalıdır.",,✓,✓,, +V10,OAuth ve OIDC,V10.6,OpenID Provider,V10.6.2,"OpenID Provider’ın forced logout yoluyla yapılan hizmet reddi saldırılarını önlediği doğrulanmalıdır. Bu, son kullanıcıdan açık onay alınarak veya varsa logout isteğinde (relying party tarafından başlatılan) bulunan parametrelerin, örneğin 'id_token_hint', doğrulanmasıyla yapılabilir.",,✓,✓,, +V10,OAuth ve OIDC,V10.7,Onay (Consent) Yönetimi,V10.7.1,"AS'nin her yetkilendirme isteği için kullanıcının onayını aldığı doğrulanmalıdır. İstemcinin kimliği garanti altına alınamıyorsa, AS daima kullanıcıdan açıkça onay istemelidir.",,✓,✓,, +V10,OAuth ve OIDC,V10.7,Onay (Consent) Yönetimi,V10.7.2,"AS'nin kullanıcıdan onay istediğinde, neye onay verildiğini açık ve yeterli şekilde gösterdiği doğrulanmalıdır. Uygun olduğunda bu bilgiler, istenen yetkilendirmelerin doğasını (genellikle scope, resource server, RAR gibi detaylara dayalı), yetkilendirilmiş uygulamanın kimliğini ve bu yetkilendirmelerin süresini içermelidir.",,✓,✓,, +V10,OAuth ve OIDC,V10.7,Onay (Consent) Yönetimi,V10.7.3,"Kullanıcının, AS üzerinden verdiği onayları görüntüleyebildiği, değiştirebildiği ve iptal edebildiği doğrulanmalıdır.",,✓,✓,, +V11,Kriptografi,V11.1,Kriptografik Envanter ve Dokümantasyon,V11.1.1,"Kriptografik anahtarların yönetimi için belgelenmiş bir politika ve NIST SP 800-57 gibi bir anahtar yönetim standardını izleyen bir kriptografik anahtar yaşam döngüsü tanımlandığı doğrulanmalıdır. Bu, anahtarların aşırı miktarda paylaşılmadığını (örneğin, paylaşılan sırlar için ikiden fazla tarafla veya özel anahtarlar için birden fazla tarafla) garanti altına almalıdır.",,✓,✓,, +V11,Kriptografi,V11.1,Kriptografik Envanter ve Dokümantasyon,V11.1.2,"Tüm kriptografik anahtarlar, algoritmalar ve uygulama tarafından kullanılan sertifikaları içeren bir kriptografik envanterin oluşturulduğu, sürdürüldüğü ve düzenli olarak güncellendiği doğrulanmalıdır. Bu envanter ayrıca, sistemde anahtarların nerede kullanılabileceğini ve kullanılamayacağını, ve hangi veri türlerinin bu anahtarlarla korunup korunamayacağını da belgelemelidir.",,✓,✓,, +V11,Kriptografi,V11.1,Kriptografik Envanter ve Dokümantasyon,V11.1.3,"Sistem içerisinde şifreleme, özetleme ve imzalama işlemleri dahil olmak üzere kriptografi kullanımının tüm örneklerini tespit etmek için kriptografik keşif mekanizmalarının kullanıldığı doğrulanmalıdır.",,,✓,, +V11,Kriptografi,V11.1,Kriptografik Envanter ve Dokümantasyon,V11.1.4,"Kriptografik bir envanterin sürdürüldüğü doğrulanmalıdır. Bu envanter, gelecekteki tehditlere karşı tepki verebilmek amacıyla post-kuantum kriptografiye geçiş yolunu belirten belgelenmiş bir plan içermelidir.",,,✓,, +V11,Kriptografi,V11.2,Güvenli Kriptografi Uygulaması,V11.2.1,Kriptografik işlemler için sektör tarafından doğrulanmış uygulamaların (kütüphaneler ve donanım hızlandırmalı uygulamalar dahil) kullanıldığı doğrulanmalıdır.,,✓,✓,, +V11,Kriptografi,V11.2,Güvenli Kriptografi Uygulaması,V11.2.2,"Uygulamanın, rastgele sayı üreticileri, kimliği doğrulanmış şifreleme, MAC veya özetleme algoritmaları, anahtar uzunlukları, turlar, şifreler ve modların herhangi bir zamanda yeniden yapılandırılabilir, yükseltilebilir veya değiştirilebilir olacağı şekilde kripto çevikliği (crypto agility) ile tasarlandığı doğrulanmalıdır. Aynı şekilde, anahtarların ve parolaların değiştirilebilmesi ve verilerin yeniden şifrelenebilmesi mümkün olmalıdır. Bu, onaylanmış PQC şemalarının yüksek güvenlikli uygulamaları yaygın olarak kullanılabilir hale geldiğinde sorunsuz geçişe olanak tanır.",,✓,✓,, +V11,Kriptografi,V11.2,Güvenli Kriptografi Uygulaması,V11.2.3,"Tüm kriptografik ilkeliklerin, algoritma, anahtar boyutu ve yapılandırmaya göre minimum 128 bit güvenlik sağladığı doğrulanmalıdır. Örneğin, 256-bit ECC anahtarı yaklaşık 128 bit güvenlik sağlarken, RSA için aynı güvenliği elde etmek 3072-bit anahtar gerektirir.",,✓,✓,, +V11,Kriptografi,V11.2,Güvenli Kriptografi Uygulaması,V11.2.4,"Tüm kriptografik işlemlerin sabit süreli (constant-time) olduğu, karşılaştırmalarda, hesaplamalarda veya geri dönüşlerde kısa devre (short-circuit) işlemleri yapılmadığı doğrulanmalıdır; bu, bilgi sızıntısını önlemek için gereklidir.",,,✓,, +V11,Kriptografi,V11.2,Güvenli Kriptografi Uygulaması,V11.2.5,"Tüm kriptografik modüllerin güvenli şekilde hata verdiği ve hataların, padding oracle saldırıları gibi zafiyetleri mümkün kılmayacak şekilde ele alındığı doğrulanmalıdır.",,,✓,, +V11,Kriptografi,V11.3,Şifreleme Algoritmaları,V11.3.1,"Güvensiz blok modlarının (örneğin, ECB) ve zayıf doldurma (padding) şemalarının (örneğin, PKCS#1 v1.5) kullanılmadığı doğrulanmalıdır.",✓,✓,✓,, +V11,Kriptografi,V11.3,Şifreleme Algoritmaları,V11.3.2,Yalnızca AES ile GCM gibi onaylı şifreleme algoritmalarının ve modlarının kullanıldığı doğrulanmalıdır.,✓,✓,✓,, +V11,Kriptografi,V11.3,Şifreleme Algoritmaları,V11.3.3,"Şifrelenmiş verilerin yetkisiz değişikliklere karşı korunduğu doğrulanmalıdır. Tercihen bu koruma, onaylı bir kimliği doğrulanmış şifreleme yöntemi kullanılarak ya da onaylı bir şifreleme yöntemi ile onaylı bir MAC algoritmasının kombinasyonu ile sağlanmalıdır.",,✓,✓,, +V11,Kriptografi,V11.3,Şifreleme Algoritmaları,V11.3.4,"Sayılar, başlatma vektörleri (IV) ve diğer tek kullanımlık değerlerin, aynı şifreleme anahtarı ve veri öğesi çifti için birden fazla kez kullanılmadığı doğrulanmalıdır. Oluşturma yöntemi kullanılan algoritmaya uygun olmalıdır.",,,✓,, +V11,Kriptografi,V11.3,Şifreleme Algoritmaları,V11.3.5,"Şifreleme algoritması ve MAC algoritması kombinasyonlarının ""encrypt-then-MAC"" modunda çalıştığı doğrulanmalıdır.",,,✓,, +V11,Kriptografi,V11.4,Hashing ve Hash Tabanlı Fonksiyonlar,V11.4.1,"Dijital imzalar, HMAC, KDF ve rastgele bit üretimi gibi genel kriptografik kullanım senaryolarında yalnızca onaylı hash fonksiyonlarının kullanıldığı doğrulanmalıdır. MD5 gibi yasaklı hash fonksiyonları hiçbir kriptografik amaçla kullanılmamalıdır.",✓,✓,✓,, +V11,Kriptografi,V11.4,Hashing ve Hash Tabanlı Fonksiyonlar,V11.4.2,"Parolaların, onaylı, hesaplama açısından yoğun ve mevcut rehberliğe göre yapılandırılmış bir anahtar türetme fonksiyonu (diğer adıyla parola hash'leme fonksiyonu) kullanılarak saklandığı doğrulanmalıdır. Ayarlar, güvenlik ve performans dengesini sağlayarak kaba kuvvet saldırılarını zorlaştırmalıdır.",,✓,✓,, +V11,Kriptografi,V11.4,Hashing ve Hash Tabanlı Fonksiyonlar,V11.4.3,"Dijital imzalarda kullanılan hash fonksiyonlarının, veri bütünlüğü ve kimlik doğrulama amacıyla kullanıldığında çakışmaya karşı dayanıklı ve yeterli bit uzunluğuna sahip olduğu doğrulanmalıdır. Çakışma dayanıklılığı gerekiyorsa çıktı uzunluğu en az 256 bit olmalıdır. Sadece ikinci ön-görüntü (2nd pre-iamge) saldırılarına karşı dayanıklılık gerekiyorsa çıktı uzunluğu en az 128 bit olmalıdır.",,✓,✓,, +V11,Kriptografi,V11.4,Hashing ve Hash Tabanlı Fonksiyonlar,V11.4.4,"Parolalardan gizli anahtarlar türetilirken, onaylı anahtar türetme fonksiyonlarının anahtar uzatma (key stretching) parametreleriyle birlikte kullanıldığı doğrulanmalıdır. Bu parametreler, kaba kuvvet saldırılarını önleyecek şekilde güvenlik ve performans dengesine sahip olmalıdır.",,✓,✓,, +V11,Kriptografi,V11.5,Rastgele Değerler,V11.5.1,"Tahmin edilemez olması amaçlanan tüm rastgele sayıların ve dizelerin, CSPRNG ile oluşturulduğu ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. UUID'lerin bu koşulu dikkate almadığını unutmayın.",,✓,✓,, +V11,Kriptografi,V11.5,Rastgele Değerler,V11.5.2,"Kullanılan rastgele sayı üretim mekanizmasının, yoğun talep altında dahi güvenli çalışacak şekilde tasarlandığı doğrulanmalıdır.",,,✓,, +V11,Kriptografi,V11.6,Açık Anahtar (Public Key) Kriptografisi,V11.6.1,"Anahtar üretimi, tohumlama (seeding) ve dijital imza üretimi ve doğrulama için yalnızca onaylı kriptografik algoritmalar ve çalışma modlarının kullanıldığı doğrulanmalıdır. Anahtar üretim algoritmaları, bilinen saldırılara karşı savunmasız anahtarlar üretmemelidir. Örneğin, Fermat çarpanlama yöntemine karşı savunmasız RSA anahtarları oluşturulmamalıdır.",,✓,✓,, +V11,Kriptografi,V11.6,Açık Anahtar (Public Key) Kriptografisi,V11.6.2,"Anahtar değişimi için yalnızca onaylı kriptografik algoritmaların kullanıldığı doğrulanmalıdır (örneğin Diffie-Hellman). Kullanılan parametrelerin güvenli olması gerektiğine dikkat edilmelidir. Bu, anahtar kurulum sürecine yönelik saldırıları önleyecek ve araya girme (adversary-in-the-middle) ya da kriptografik kırılmaları engelleyecektir.",,,✓,, +V11,Kriptografi,V11.7,Kullanım Halindeki Verilerin Kriptografisi,V11.7.1,"Hassas verilerin kullanım sırasında korunmasını sağlamak amacıyla, yetkisiz kullanıcıların veya süreçlerin bu verilere erişmesini engelleyen tam bellek şifrelemesinin kullanıldığı doğrulanmalıdır.",,,✓,, +V11,Kriptografi,V11.7,Kullanım Halindeki Verilerin Kriptografisi,V11.7.2,"Veri asgariyetinin sağlandığı, yani işleme sırasında mümkün olan en az miktarda verinin ortaya çıktığı ve verilerin kullanımdan hemen sonra veya mümkün olan en kısa sürede şifrelendiği doğrulanmalıdır.",,,✓,, +V12,Güvenli İletişim,V12.1,Genel TLS Güvenlik Rehberi,V12.1.1,Yalnızca TLS protokolünün en güncel ve önerilen sürümlerinin (örneğin TLS 1.2 ve TLS 1.3) etkinleştirildiği ve en son sürümün varsayılan olarak tercih edildiği doğrulanmalıdır.,✓,✓,✓,, +V12,Güvenli İletişim,V12.1,Genel TLS Güvenlik Rehberi,V12.1.2,Yalnızca önerilen şifre takımlarının (cipher suite) etkinleştirildiği ve en güçlü şifre takımlarının tercih edildiği doğrulanmalıdır. Seviye 3 (L3) uygulamalar yalnızca ileri gizlilik (forward secrecy) sağlayan şifre takımlarını desteklemelidir.,,✓,✓,, +V12,Güvenli İletişim,V12.1,Genel TLS Güvenlik Rehberi,V12.1.3,"Uygulamanın, mTLS istemci sertifikalarını kimlik doğrulama veya yetkilendirme amacıyla kullanmadan önce bu sertifikaların güvendiği sertifikalar arasında olduğunu doğruladığı kontrol edilmelidir.",,✓,✓,, +V12,Güvenli İletişim,V12.1,Genel TLS Güvenlik Rehberi,V12.1.4,Online Certificate Status Protocol (OCSP) Stapling gibi geçerli bir sertifika iptal kontrolü yönteminin etkinleştirildiği ve yapılandırıldığı doğrulanmalıdır.,,,✓,, +V12,Güvenli İletişim,V12.1,Genel TLS Güvenlik Rehberi,V12.1.5,"TLS el sıkışma (handshake) sürecinde Server Name Indication (SNI) gibi hassas meta verilerin ifşa edilmesini önlemek için, uygulamanın TLS yapılandırmasında Encrypted Client Hello (ECH) özelliğinin etkinleştirildiği doğrulanmalıdır.",,,✓,, +V12,Güvenli İletişim,V12.2,Dışa Açık Hizmetlerle HTTPS İletişimi,V12.2.1,"İstemci ile dışa açık, HTTP tabanlı hizmetler arasındaki tüm bağlantılarda TLS kullanıldığı ve bu bağlantıların güvensiz ya da şifrelenmemiş iletişime geri dönmediği doğrulanmalıdır.",✓,✓,✓,, +V12,Güvenli İletişim,V12.2,Dışa Açık Hizmetlerle HTTPS İletişimi,V12.2.2,Dışa açık hizmetlerin herkese açık olarak güvenilen TLS sertifikaları kullandığı doğrulanmalıdır.,✓,✓,✓,, +V12,Güvenli İletişim,V12.3,Genel Servisler Arası İletişim Güvenliği,V12.3.1,"Uygulamaya gelen ve uygulamadan çıkan tüm bağlantılarda izleme sistemleri, yönetim araçları, uzaktan erişim ve SSH, ara yazılımlar, veritabanları, ana sistemler (mainframe), iş ortağı sistemleri ya da dış API'ler dahil olmak üzere TLS gibi şifreli bir protokolün kullanıldığı ve güvensiz ya da şifrelenmemiş protokollere geri dönülmediği doğrulanmalıdır.",,✓,✓,, +V12,Güvenli İletişim,V12.3,Genel Servisler Arası İletişim Güvenliği,V12.3.2,TLS istemcilerinin bir TLS sunucusu ile iletişime geçmeden önce alınan sertifikaları doğruladığı kontrol edilmelidir.,,✓,✓,, +V12,Güvenli İletişim,V12.3,Genel Servisler Arası İletişim Güvenliği,V12.3.3,Uygulama içindeki HTTP tabanlı iç hizmetler arasında gerçekleşen tüm bağlantılarda TLS ya da uygun başka bir aktarım şifreleme mekanizmasının kullanıldığı ve güvensiz ya da şifrelenmemiş iletişime geri dönülmediği doğrulanmalıdır.,,✓,✓,, +V12,Güvenli İletişim,V12.3,Genel Servisler Arası İletişim Güvenliği,V12.3.4,"İç hizmetler arasındaki TLS bağlantılarında güvenilir sertifikaların kullanıldığı doğrulanmalıdır. İç sistemlerde oluşturulmuş ya da kendinden imzalı (self-signed) sertifikalar kullanılıyorsa, bu sertifikalara güvenen hizmetlerin yalnızca belirli dahili sertifika otoritelerine (CA) ve belirli kendinden imzalı sertifikalara güvenecek şekilde yapılandırıldıkları doğrulanmalıdır.",,✓,✓,, +V12,Güvenli İletişim,V12.3,Genel Servisler Arası İletişim Güvenliği,V12.3.5,"Sistem içindeki hizmetlerin birbiriyle iletişim kurarken her bir uç noktanın kimliğini doğrulamak için güçlü kimlik doğrulama yöntemlerinin kullanıldığı doğrulanmalıdır. Bu yöntemler arasında, açık anahtar altyapısı (public-key infrastructure) kullanan ve tekrar oynatma saldırılarına karşı dayanıklı olan TLS istemci kimlik doğrulaması gibi yöntemler yer almalıdır. Mikroservis mimarilerinde, sertifika yönetimini basitleştirmek ve güvenliği artırmak amacıyla bir servis ağı (service mesh) kullanılması değerlendirilmelidir.",,,✓,, +V13,Konfigürasyon,V13.1,Konfigürasyon Dokümantasyonu,V13.1.1,"Uygulamanın tüm iletişim ihtiyaçlarının dokümante edildiği doğrulanmalıdır. Buna, uygulamanın bağımlı olduğu dış hizmetler ve son kullanıcının uygulamanın bağlantı kurmasını sağlayabileceği dış konumlar da dahil olmalıdır.",,✓,✓,, +V13,Konfigürasyon,V13.1,Konfigürasyon Dokümantasyonu,V13.1.2,"Uygulamanın kullandığı her bir hizmet için, dokümantasyonda eşzamanlı bağlantı sayısı (örn. bağlantı havuzu limitleri) ve bu sınır aşıldığında uygulamanın davranışı, geri dönüş veya kurtarma mekanizmaları da dahil olmak üzere hizmet reddi koşullarını önlemek için tanımlandığı doğrulanmalıdır.",,,✓,, +V13,Konfigürasyon,V13.1,Konfigürasyon Dokümantasyonu,V13.1.3,"Uygulamanın, kullandığı her bir dış sistem veya hizmet (örn. veritabanları, dosya tanıtıcıları, iş parçacıkları, HTTP bağlantıları) için kaynak yönetimi stratejilerini tanımladığı doğrulanmalıdır. Bu stratejiler, kaynak serbest bırakma prosedürlerini, zaman aşımı ayarlarını, hata durumlarını ve tekrar deneme mantığı uygulanmışsa sınırları, gecikmeleri ve geri çekilme (back-off) algoritmalarını içermelidir. Senkron HTTP istek–yanıt işlemleri için kısa zaman aşımı süreleri zorunlu tutulmalı ve tekrar eden denemeler devre dışı bırakılmalı ya da sıkı şekilde sınırlandırılmalıdır.",,,✓,, +V13,Konfigürasyon,V13.1,Konfigürasyon Dokümantasyonu,V13.1.4,"Uygulamanın, güvenlik açısından kritik olan gizli verileri tanımladığı ve kuruluşun tehdit modeli ve iş ihtiyaçlarına göre bu verilerin döndürülme (rotation) zamanlamasının belgelendiği doğrulanmalıdır.",,,✓,, +V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.1,"Uygulamanın, standart kullanıcı oturum mekanizmasını desteklemeyen backend bileşenleri (örneğin API'ler, ara katmanlar, veri katmanları) arasında gerçekleşen iletişimlerin kimlik doğrulamasıyla korunduğu doğrulanmalıdır. Kimlik doğrulama; bireysel hizmet hesapları, kısa ömürlü token'lar ya da sertifika tabanlı kimlik doğrulama ile yapılmalıdır ve parola, API anahtarı ya da ayrıcalıklı erişime sahip paylaşımlı hesaplar gibi sabit kimlik bilgileri kullanılmamalıdır.",,✓,✓,, +V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.2,"Uygulamanın backend bileşenleri arasında (yerel hizmetler, işletim sistemi hizmetleri, API'ler, ara katmanlar ve veri katmanları dahil) gerçekleştirilen iletişimlerin, yalnızca gerekli en az ayrıcalığa sahip hesaplarla yapıldığı doğrulanmalıdır.",,✓,✓,, +V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.3,"Bir hizmet kimlik doğrulaması için bir kimlik bilgisi kullanılması gerekiyorsa, bu kimlik bilgisinin varsayılan bir değer (örneğin root/root veya admin/admin) olmadığının doğrulanması gereklidir.",,✓,✓,, +V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.4,"Uygulamanın iletişim kurmasına izin verilen dış kaynaklar ya da sistemlerin, bir allowlist (izinli liste) ile tanımlandığı doğrulanmalıdır. Bu liste, uygulama katmanında, web sunucusunda, güvenlik duvarında veya farklı katmanların birleşiminde uygulanabilir.",,✓,✓,, +V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.5,"Web veya uygulama sunucusunun, dış sistemlere veri veya dosya gönderimi veya yüklemesi yaparken sadece belirli kaynaklara izin verecek şekilde allowlist ile yapılandırıldığı doğrulanmalıdır.",,✓,✓,, +V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.6,"Uygulamanın farklı hizmetlere bağlantı kurduğu durumlarda, bu bağlantılar için belgelenmiş yapılandırmaları (örn. maksimum eşzamanlı bağlantı, bağlantı limiti aşıldığında davranış, zaman aşımı, tekrar deneme stratejileri) takip ettiğinin doğrulanması gereklidir.",,,✓,, +V13,Konfigürasyon,V13.3,Gizli Bilgi Yönetimi,V13.3.1,"Parolalar, anahtar materyalleri, veritabanı ve üçüncü parti sistemlerle entegrasyon bilgileri, zaman tabanlı token'lar için tohum (seed) bilgileri, dahili gizli veriler ve API anahtarları gibi backend sırlarının güvenli bir şekilde oluşturulması, saklanması, erişim denetiminin sağlanması ve imha edilmesi için bir gizli bilgi yönetim çözümünün (örneğin key vault) kullanıldığı doğrulanmalıdır. Bu gizli bilgiler uygulama kaynak koduna dahil edilmemeli ve yapı çıktılarında yer almamalıdır. Seviye 3 uygulamalar için donanım destekli bir çözüm (örneğin HSM) gereklidir.",,✓,✓,, +V13,Konfigürasyon,V13.3,Gizli Bilgi Yönetimi,V13.3.2,Gizli bilgilere erişimin en az ayrıcalık prensibine uygun şekilde yapılandırıldığı doğrulanmalıdır.,,✓,✓,, +V13,Konfigürasyon,V13.3,Gizli Bilgi Yönetimi,V13.3.3,"Tüm kriptografik işlemlerin, anahtar materyallerinin güvenli bir şekilde yönetilmesi ve dışarıya sızmasının engellenmesi amacıyla, izole edilmiş bir güvenlik modülü (örneğin vault ya da donanım güvenlik modülü) aracılığıyla gerçekleştirildiği doğrulanmalıdır.",,,✓,, +V13,Konfigürasyon,V13.3,Gizli Bilgi Yönetimi,V13.3.4,Uygulamanın belgelerinde belirtildiği şekilde gizli bilgilerin süresinin dolacak şekilde yapılandırıldığı ve düzenli olarak döndürüldüğü doğrulanmalıdır.,,,✓,, +V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.1,Uygulamanın .git veya .svn klasörleri gibi kaynak kontrolüyle ilgili metadata içermeyecek şekilde deploy edildiğini ya da bu klasörlerin hem dış erişime hem de uygulama erişimine kapalı olduğu doğrulanmalıdır.,✓,✓,✓,, +V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.2,Tüm bileşenler için üretim ortamlarında hata ayıklama (debug) modlarının devre dışı bırakıldığı doğrulanmalıdır.,,✓,✓,, +V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.3,"Web sunucularının, açık şekilde istenmediği sürece dizin listelemesi (directory listing) özelliğini istemcilere sunmadığı doğrulanmalıdır.",,✓,✓,, +V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.4,"HTTP TRACE metodunun üretim ortamlarında desteklenmediği, böylece potansiyel bilgi sızıntılarının önlendiği doğrulanmalıdır.",,✓,✓,, +V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.5,Belgeler (örneğin dahili API belgeleri) ve izleme uç noktalarının (monitoring endpoints) yalnızca açıkça belirtildiği durumlarda erişilebilir olduğu doğrulanmalıdır.,,✓,✓,, +V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.6,Uygulamanın arka uç bileşenlerinin ayrıntılı sürüm bilgilerini ifşa etmediği doğrulanmalıdır.,,,✓,, +V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.7,"Web katmanının yalnızca belirli dosya uzantılarına sahip dosyaları sunacak şekilde yapılandırıldığı, bu sayede istem dışı bilgi, yapılandırma ya da kaynak kod sızıntılarının önlendiği doğrulanmalıdır.",,,✓,, +V14,Veri Koruma,V14.1,Veri Koruma Dokümantasyonu,V14.1.1,"Uygulama tarafından oluşturulan ve işlenen tüm hassas verilerin tanımlanıp, koruma seviyelerine göre sınıflandırıldığından emin olun. Bu, yalnızca kodlanmış (örneğin Base64 stringleri ya da JWT içindeki düz metin yükler gibi) ve bu nedenle kolayca çözülebilir verileri de içermelidir. Koruma seviyeleri, uygulamanın uymakla yükümlü olduğu veri koruma ve gizlilik düzenlemeleri ile standartlarını dikkate almalıdır.",,✓,✓,, +V14,Veri Koruma,V14.1,Veri Koruma Dokümantasyonu,V14.1.2,"Tüm hassas veri koruma seviyeleri için belgelenmiş bir koruma gereksinimleri seti tanımlandığından emin olun. Bu gereksinimler genel şifreleme, bütünlük doğrulama, saklama süresi, verinin nasıl günlüğe kaydedileceği, günlüklerdeki hassas verilere erişim kontrolleri, veritabanı düzeyinde şifreleme, gizlilik ve gizliliği artırıcı teknolojiler ile diğer gizlilik gereksinimlerini kapsamalıdır.",,✓,✓,, +V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.1,"Hassas verilerin yalnızca HTTP message body veya header alanlarında sunucuya gönderildiği ve URL ile sorgu parametrelerinin, API anahtarı veya session token’ı gibi hassas bilgiler içermediği doğrulanmalıdır.",✓,✓,✓,, +V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.2,"Hassas verilerin, yük dengeleyiciler ve uygulama önbellekleri gibi sunucu bileşenlerinde önbelleğe alınmasının engellendiği veya kullanım sonrası bu verilerin güvenli biçimde temizlendiği doğrulanmalıdır.",,✓,✓,, +V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.3,"Uygulama kontrolü dışında veri toplanmasını engellemek için, tanımlanmış hassas verilerin, kullanıcı izleyicileri gibi güvensiz taraflara gönderilmediği doğrulanmalıdır.",,✓,✓,, +V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.4,"Hassas verilere yönelik şifreleme, bütünlük doğrulama, veri saklama, loglama yöntemi, loglardaki erişim kontrolleri, gizlilik teknolojileri gibi kontrollerin, söz konusu verinin belgelenmiş koruma seviyesinde tanımlandığı şekilde uygulandığı doğrulanmalıdır.",,✓,✓,, +V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.5,"Önbellekleme mekanizmalarının yalnızca belirli içerik türüne sahip yanıtları önbelleğe alacak şekilde yapılandırıldığı ve hassas, dinamik içeriklerin önbelleğe alınmadığı doğrulanmalıdır. Web sunucusu, mevcut olmayan bir dosya talebinde geçerli ama farklı bir dosya döndürmek yerine 404 veya 302 cevabı vermelidir. Bu, Web Cache Deception saldırılarını önlemeye yardımcı olur.",,,✓,, +V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.6,"Uygulamanın yalnızca işlevsellik için gerekli olan asgari hassas veriyi döndürdüğü doğrulanmalıdır. Örneğin, kredi kartı numarasının yalnızca bazı rakamlarının döndürülmesi; tam numaranın döndürülmesi gerekiyorsa, kullanıcı arayüzünde gizlenmiş (maskelenmiş) şekilde sunulması gerekir, aksi kullanıcı özel olarak görüntülemek istemedikçe gösterilmemelidir.",,,✓,, +V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.7,"Hassas bilgilerin, veri saklama sınıflandırmasına tabi tutulduğu, geçerliliğini yitirmiş veya artık gerekli olmayan verilerin belirlenmiş bir zaman çizelgesiyle ya da gerektiğinde otomatik olarak silindiği doğrulanmalıdır.",,,✓,, +V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.8,Kullanıcı tarafından yüklenen dosyaların meta verilerinden hassas bilgilerin çıkarıldığı veya bu bilgilerin yalnızca kullanıcıdan açık onay alındığında saklandığı doğrulanmalıdır.,,,✓,, +V14,Veri Koruma,V14.3,İstemci Tarafı Veri Koruması,V14.3.1,"Kimliği doğrulanmış verilerin, istemci veya oturum sonlandığında istemci depolamasından (örneğin tarayıcı DOM’undan) temizlendiği doğrulanmalıdır. 'Clear-Site-Data' HTTP response header bu konuda yardımcı olabilir ancak istemci tarafı, sunucu bağlantısı mevcut olmadığında da temizlik işlemini yapabiliyor olmalıdır.",✓,✓,✓,, +V14,Veri Koruma,V14.3,İstemci Tarafı Veri Koruması,V14.3.2,"Uygulamanın, tarayıcılarda hassas verilerin önbelleğe alınmasını önlemek amacıyla yeterli anti-önbellekleme HTTP response header (örneğin Cache-Control: no-store) ayarladığı doğrulanmalıdır.",,✓,✓,, +V14,Veri Koruma,V14.3,İstemci Tarafı Veri Koruması,V14.3.3,"Tarayıcıda depolanan verilerin (örneğin localStorage, sessionStorage, IndexedDB veya çerezler) hassas veri içermediği, yalnızca session token’larının istisna olarak kabul edildiği doğrulanmalıdır.",,✓,✓,, +V15,Güvenli Kodlama ve Mimari,V15.1,Güvenli Kodlama ve Mimari Dokümantasyonu,V15.1.1,"Güvenlik açığı içeren üçüncü taraf bileşen sürümleri ve genel olarak kütüphane güncellemeleri için, uygulama dokümantasyonunda risk bazlı düzeltme zamanlarının tanımlandığı doğrulanmalıdır.",✓,✓,✓,, +V15,Güvenli Kodlama ve Mimari,V15.1,Güvenli Kodlama ve Mimari Dokümantasyonu,V15.1.2,"Yazılım bileşen listesi (Software Bill of Materials - SBOM) gibi bir envanterin tutulduğu, kullanılan tüm üçüncü taraf kütüphanelerin önceden tanımlanmış, güvenilir ve düzenli olarak güncellenen depolardan alındığı doğrulanmalıdır.",,✓,✓,, +V15,Güvenli Kodlama ve Mimari,V15.1,Güvenli Kodlama ve Mimari Dokümantasyonu,V15.1.3,"Uygulama dokümantasyonunda zaman veya kaynak açısından yoğun işlevlerin tanımlandığı, bu işlevlerin aşırı kullanımı durumunda kullanılabilirlik kaybının nasıl önleneceği ve yanıt oluşturma süresinin istemci zaman aşımını aşmaması için hangi önlemlerin alındığı belirtilmelidir. Örnek savunmalar kuyruklama, eşzamansız işleme, kullanıcı başına ve uygulama genelinde paralel işlem sınırlarını içerebilir.",,✓,✓,, +V15,Güvenli Kodlama ve Mimari,V15.1,Güvenli Kodlama ve Mimari Dokümantasyonu,V15.1.4,"Uygulama dokümantasyonunda ""riskli bileşenler"" olarak değerlendirilen üçüncü taraf kütüphanelerin vurgulandığı doğrulanmalıdır.",,,✓,, +V15,Güvenli Kodlama ve Mimari,V15.1,Güvenli Kodlama ve Mimari Dokümantasyonu,V15.1.5,"Uygulama dokümantasyonunda ""tehlikeli işlevsellik"" içeren uygulama bölümlerinin açıkça belirtildiği doğrulanmalıdır.",,,✓,, +V15,Güvenli Kodlama ve Mimari,V15.2,Güvenlik Mimarisi ve Bağımlılıklar,V15.2.1,"Uygulamanın yalnızca, belgelenmiş güncelleme ve düzeltme sürelerini aşmamış bileşenleri içerdiği doğrulanmalıdır.",✓,✓,✓,, +V15,Güvenli Kodlama ve Mimari,V15.2,Güvenlik Mimarisi ve Bağımlılıklar,V15.2.2,"Uygulamanın, belgelenmiş güvenlik kararları ve stratejilere dayanarak, zaman veya kaynak açısından yoğun işlevlerin neden olabileceği kullanılabilirlik kaybına karşı savunmalar uyguladığı doğrulanmalıdır.",,✓,✓,, +V15,Güvenli Kodlama ve Mimari,V15.2,Güvenlik Mimarisi ve Bağımlılıklar,V15.2.3,"Üretim ortamının yalnızca uygulamanın çalışması için gerekli işlevleri içerdiği ve test kodları, örnek kod parçaları veya geliştirme işlevleri gibi gereksiz işlevsellikleri açığa çıkarmadığı doğrulanmalıdır.",,✓,✓,, +V15,Güvenli Kodlama ve Mimari,V15.2,Güvenlik Mimarisi ve Bağımlılıklar,V15.2.4,Üçüncü taraf bileşenlerin ve bunların tüm transitif bağımlılıklarının beklenen depolardan (iç kaynaklı ya da harici) alındığı ve bağımlılık karışıklığı (dependency confusion) saldırılarına açık olmadığı doğrulanmalıdır.,,,✓,, +V15,Güvenli Kodlama ve Mimari,V15.2,Güvenlik Mimarisi ve Bağımlılıklar,V15.2.5,"Uygulamanın, “tehlikeli işlevsellik” içeren veya “riskli bileşenler” kullanan bölümlerine ek korumalar uyguladığı doğrulanmalıdır. Bu korumalar sandbox, kapsülleme, konteynerleştirme veya ağ düzeyinde izolasyon gibi teknikler aracılığıyla, bir uygulama bölümünün ele geçirilmesi durumunda saldırganın diğer bölümlere sıçramasını geciktirmeyi veya engellemeyi amaçlamalıdır.",,,✓,, +V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.1,"Uygulamanın yalnızca gerekli alanların bir alt kümesini veri nesnesinden döndürdüğü doğrulanmalıdır. Örneğin, bazı alanlara kullanıcıların erişmemesi gerektiğinden tüm veri nesnesi döndürülmemelidir.",✓,✓,✓,, +V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.2,"Uygulama backend'i harici URL’lere çağrı yaptığında, yalnızca amaçlanan işlevsellik söz konusuysa yönlendirmeleri takip edecek şekilde yapılandırıldığının doğrulanması gerekir.",,✓,✓,, +V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.3,"Uygulamanın, kitlesel atama saldırılarına karşı, her bir controller ve eylem için izin verilen alanları sınırlandırarak savunmalar sağladığı doğrulanmalıdır. Örneğin, bir alan değeri, bu işlemde değiştirilmesi amaçlanmadıysa eklenememeli veya güncellenememelidir.",,✓,✓,, +V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.4,"Tüm proxy ve ara katman bileşenlerinin kullanıcının orijinal IP adresini, uç kullanıcı tarafından değiştirilemeyecek güvenilir veri alanları kullanarak doğru şekilde ilettiği ve uygulamanın ve web sunucusunun bu doğru değeri, loglama ve hız sınırlama gibi güvenlik kararları için kullandığı doğrulanmalıdır. Ayrıca, orijinal IP adresinin bile dinamik IP'ler, VPN'ler veya kurumsal güvenlik duvarları nedeniyle güvenilir olmayabileceği dikkate alınmalıdır.",,✓,✓,, +V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.5,"Uygulamanın değişkenlerin doğru türde olduğunu açıkça doğruladığı ve sıkı eşitlik ve karşılaştırma işlemleri kullandığı doğrulanmalıdır. Bu, değişken türüyle ilgili varsayımlardan kaynaklanan tür oynama (type juggling) veya tür karışıklığı (type confusion) güvenlik açıklarını önlemek içindir.",,✓,✓,, +V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.6,"JavaScript kodunun prototip zehirleme (prototype pollution) saldırılarını önleyecek şekilde yazıldığı, örneğin, nesne literal’leri yerine Set() veya Map() gibi yapılar kullanıldığı doğrulanmalıdır.",,✓,✓,, +V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.7,"Uygulamanın, özellikle framework'ün istek parametrelerinin kaynağı (sorgu dizgisi, gövde parametreleri, çerezler veya başlık alanları) arasında ayrım yapmadığı durumlarda, HTTP parametre kirliliği (HTTP parameter pollution) saldırılarına karşı savunmalar uyguladığı doğrulanmalıdır.",,✓,✓,, +V15,Güvenli Kodlama ve Mimari,V15.4,Güvenli Eş Zamanlılık (Concurrency),V15.4.1,"Çok iş parçacıklı kodda (örneğin cache'ler, dosyalar veya birden fazla iş parçacığı tarafından erişilen bellek içi nesneler gibi) paylaşılan nesnelere yalnızca thread-safe (iş parçacığı güvenli) türler ve kilitleme (lock) veya semaphore gibi senkronizasyon mekanizmaları kullanılarak erişildiği doğrulanmalıdır. Bu, yarış durumlarını ve veri bozulmasını önlemeye yöneliktir.",,,✓,, +V15,Güvenli Kodlama ve Mimari,V15.4,Güvenli Eş Zamanlılık (Concurrency),V15.4.2,"Bir kaynağın durumu üzerindeki kontroller (örneğin varlığı ya da izinleri gibi) ile bu kontrole bağlı eylemlerin tek bir atomik işlem olarak gerçekleştirildiği doğrulanmalıdır. Bu, TOCTOU (time-of-check to time-of-use) yarış durumlarını önlemeye yöneliktir. Bir dosyanın varlığının kontrol edilip ardından açılması veya bir kullanıcının erişiminin doğrulanıp ardından yetki verilmesi gibi işlemler buna örnektir.",,,✓,, +V15,Güvenli Kodlama ve Mimari,V15.4,Güvenli Eş Zamanlılık (Concurrency),V15.4.3,"Kilitlerin (locks) tutarlı biçimde kullanıldığı, iş parçacıklarının birbirini beklemesi ya da sonsuz döngüye girmesi (deadlock veya livelock) gibi durumların önlendiği doğrulanmalıdır. Ayrıca, kilitleme mantığı, kaynağı yöneten kod içinde kalmalı ve dış sınıflar veya dış kodlar tarafından istemeden veya kötü niyetli şekilde değiştirilememelidir.",,,✓,, +V15,Güvenli Kodlama ve Mimari,V15.4,Güvenli Eş Zamanlılık (Concurrency),V15.4.4,"Kaynak tahsis politikalarının, iş parçacığı açlığını önleyecek şekilde, kaynaklara adil erişimi sağladığı doğrulanmalıdır. Örneğin, thread pool (iş parçacığı havuzu) kullanımı, düşük öncelikli iş parçacıklarının da makul sürelerde çalışabilmesi için uygulanmalıdır.",,,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.1,Güvenlik Loglaması Dokümantasyonu,V16.1.1,"Uygulamanın teknoloji yığını boyunca her katmanda hangi olayların loglandığını, log formatlarını, logların nereye yazıldığını, nasıl kullanıldığını, erişimin nasıl kontrol edildiğini ve logların ne kadar süre saklandığını belgeleyen bir envanterin mevcut olduğu doğrulanmalıdır.",,✓,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.2,Genel Loglama,V16.2.1,"Her bir log girdisinin, olayın ne zaman, nerede, kim tarafından ve ne olduğuna dair detaylı bir zaman çizelgesi oluşturulmasına olanak tanıyacak gerekli meta verileri içerdiği doğrulanmalıdır.",,✓,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.2,Genel Loglama,V16.2.2,"Tüm loglama bileşenlerinin zaman kaynaklarının senkronize olduğu ve güvenlik olayı meta verisindeki zaman damgalarının UTC kullanarak ya da açık zaman dilimi ofsetiyle belirtildiği doğrulanmalıdır. UTC kullanımı, özellikle yaz saati uygulamaları nedeniyle oluşabilecek karışıklıkları önlemek için tavsiye edilir.",,✓,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.2,Genel Loglama,V16.2.3,Uygulamanın yalnızca log envanterinde belgelenmiş dosya ve hizmetlere log yazdığı ya da ilettiği doğrulanmalıdır.,,✓,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.2,Genel Loglama,V16.2.4,Logların kullanılan log işleyici (log processor) tarafından okunabildiği ve ilişkilendirilebildiği doğrulanmalıdır. Tercihen yaygın bir log formatı kullanılmalıdır.,,✓,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.2,Genel Loglama,V16.2.5,"Hassas veriler loglanırken, uygulamanın veri koruma seviyesine uygun olarak loglama yaptığı doğrulanmalıdır. Örneğin kimlik bilgileri veya ödeme detayları gibi bazı verilerin loglanmasına izin verilmemelidir. Session token’ları gibi veriler ise yalnızca tamamen ya da kısmen maskelenmiş ya da hash’lenmiş olarak loglanmalıdır.",,✓,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.3,Güvenlik Olayları,V16.3.1,Tüm kimlik doğrulama işlemlerinin (başarılı ve başarısız girişimler dahil) loglandığı doğrulanmalıdır. Kullanılan kimlik doğrulama türü veya faktörleri gibi ek meta veriler de toplanmalıdır.,,✓,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.3,Güvenlik Olayları,V16.3.2,"Başarısız yetkilendirme girişimlerinin loglandığı doğrulanmalıdır. Seviye 3 uygulamalar için, tüm yetkilendirme kararlarının ve hassas verilere erişim olaylarının (verinin kendisi olmadan) loglandığı da doğrulanmalıdır.",,✓,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.3,Güvenlik Olayları,V16.3.3,"Uygulamanın, belgelenmiş güvenlik olaylarını ve güvenlik kontrollerini aşma girişimlerini (girdi doğrulama, iş mantığı, otomasyon karşıtı kontroller vb.) logladığı doğrulanmalıdır.",,✓,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.3,Güvenlik Olayları,V16.3.4,Beklenmeyen hatalar ve güvenlik kontrolü başarısızlıkları (örneğin backend TLS hataları gibi) loglandığı doğrulanmalıdır.,,✓,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.4,Log Koruması,V16.4.1,"Tüm loglama bileşenlerinin, log enjeksiyonunu (log injection) önlemek amacıyla verileri uygun biçimde encode ettiği doğrulanmalıdır.",,✓,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.4,Log Koruması,V16.4.2,Logların yetkisiz erişime karşı korunduğu ve değiştirilemez olduğu doğrulanmalıdır.,,✓,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.4,Log Koruması,V16.4.3,"Logların analiz, tespit, uyarı ve yükseltme amacıyla mantıksal olarak ayrı bir sisteme güvenli biçimde iletildiği doğrulanmalıdır. Böylece uygulama ihlal edilse bile logların tehlikeye girmesi önlenmiş olur.",,✓,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.5,Hata Yönetimi,V16.5.1,"Beklenmedik ya da güvenlikle ilgili bir hata oluştuğunda, tüketiciye genel bir mesaj döndürüldüğü ve yığın izleri (stack trace), sorgular, gizli anahtarlar, token’lar gibi hassas sistem içi verilerin açıklanmadığı doğrulanmalıdır.",,✓,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.5,Hata Yönetimi,V16.5.2,"Uygulamanın, dış kaynaklara erişim başarısız olduğunda bile güvenli şekilde çalışmaya devam ettiği doğrulanmalıdır. Örneğin, circuit breaker ya da graceful degradation gibi desenler kullanılmalıdır.",,✓,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.5,Hata Yönetimi,V16.5.3,"Uygulamanın hata durumlarında güvenli ve düzenli şekilde başarısız olduğu doğrulanmalıdır. Bu, örneğin doğrulama hatalarına rağmen işlemlerin işlenmesine yol açabilecek fail-open durumlarını önlemelidir.",,✓,✓,, +V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.5,Hata Yönetimi,V16.5.4,"Ele alınmamış tüm istisnaları yakalayacak şekilde tanımlanmış bir “son çare hata yöneticisi” bulunduğu doğrulanmalıdır. Bu, hem loglara gitmesi gereken hata detaylarının kaybolmaması hem de tüm uygulama sürecinin çökerek hizmet dışı kalmasının önlenmesi açısından önemlidir.",,,✓,, +V17,WebRTC,V17.1,TURN Sunucusu,V17.1.1,"TURN hizmetinin yalnızca özel amaçlar için ayrılmamış IP adreslerine (ör. iç ağlar, yayın adresleri, loopback) erişime izin verdiği doğrulanmalıdır. Bu gereksinim hem IPv4 hem de IPv6 adresleri için geçerlidir.",,✓,✓,, +V17,WebRTC,V17.1,TURN Sunucusu,V17.1.2,"TURN hizmetinin, meşru kullanıcıların sunucuda çok sayıda bağlantı noktası açmaya çalışması durumunda kaynak tüketimi saldırılarına karşı dayanıklı olduğu doğrulanmalıdır.",,,✓,, +V17,WebRTC,V17.2,Medya,V17.2.1,"DTLS sertifikası anahtarının, belgelenmiş kriptografik anahtar yönetim politikasına uygun şekilde yönetildiği ve korunduğu doğrulanmalıdır.",,✓,✓,, +V17,WebRTC,V17.2,Medya,V17.2.2,Medya sunucusunun onaylı DTLS şifre takımlarını (cipher suites) ve Güvenli Gerçek Zamanlı Aktarım Protokolü (Secure Real-time Transport Protocol - SRTP) için anahtarlar oluşturmaya yönelik DTLS Uzantısı için güvenli bir koruma profilini kullanacak ve destekleyecek şekilde yapılandırıldığı (DTLS-SRTP) doğrulanmalıdır.,,✓,✓,, +V17,WebRTC,V17.2,Medya,V17.2.3,Real-time Transport Protocol (RTP) injection saldırılarının bir hizmet reddi durumuna veya medya akışlarına ses veya video medyası eklenmesine yol açmasını önlemek için medya sunucusunda Güvenli SRTP kimlik doğrulamasının kontrol edildiği doğrulanmalıdır.,,✓,✓,, +V17,WebRTC,V17.2,Medya,V17.2.4,Verify that the media server is able to continue processing incoming media traffic when encountering malformed Secure Real-time Transport Protocol (SRTP) packets.,,✓,✓,, +V17,WebRTC,V17.2,Medya,V17.2.5,"Medya sunucusunun, meşru kullanıcılardan gelen SRTP flood'ı sırasında gelen medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.",,,✓,, +V17,WebRTC,V17.2,Medya,V17.2.6,"Medya sunucusunun DTLS içinde yer alan ""ClientHello"" yarış durumu güvenlik açığına karşı savunmasız olmadığı, medya sunucusunun güvenlik açığına sahip olduğunun açıkça bilinip bilinmediği kontrol edilerek veya yarış koşulu testi gerçekleştirilerek doğrulanmalıdır.",,,✓,, +V17,WebRTC,V17.2,Medya,V17.2.7,"Medya sunucusuna bağlı ses veya video kayıt mekanizmalarının, meşru kullanıcı kaynaklı SRTP flood'ı sırasında medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.",,,✓,, +V17,WebRTC,V17.2,Medya,V17.2.8,"DTLS sertifikasının, SDP (Session Description Protocol) fingerprint özelliği ile karşılaştırıldığı ve doğrulama başarısız olursa medya akışının sonlandırıldığı, medya akışının özgünlüğünü sağlamak için doğrulanmalıdır.",,,✓,, +V17,WebRTC,V17.3,Sinyalizasyon,V17.3.1,"Sinyalizasyon sunucusunun, flood saldırısı altında bile meşru sinyalizasyon mesajlarını işlemeye devam edebildiği doğrulanmalıdır. Bu, sinyalizasyon düzeyinde oran sınırlaması uygulanarak sağlanmalıdır.",,✓,✓,, +V17,WebRTC,V17.3,Sinyalizasyon,V17.3.2,"Sinyalizasyon sunucusunun, hizmet reddine yol açabilecek şekilde yapılandırılmış bozuk sinyalizasyon mesajlarıyla karşılaştığında bile meşru mesajları işlemeye devam edebildiği doğrulanmalıdır. Bu, girdi doğrulaması, integer overflow ve buffer overflow'a karşı savunma ve sağlam hata işleme teknikleri ile sağlanmalıdır.",,✓,✓,, + diff --git a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.json b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.json new file mode 100644 index 0000000000..52c7591547 --- /dev/null +++ b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.json @@ -0,0 +1,7183 @@ +{ + "Name": "Application Security Verification Standard Project", + "ShortName": "ASVS", + "Version": "", + "Description": "The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.", + "Requirements": [ + { + "Shortcode": "V1", + "Ordinal": 1, + "ShortName": "Encoding", + "Name": "Kodlama (Encoding) ve Temizleme", + "Items": [ + { + "Shortcode": "V1.1", + "Ordinal": 1, + "Name": "Kodlama ve Temizleme Mimarisi", + "Items": [ + { + "Shortcode": "V1.1.1", + "Ordinal": 1, + "Description": "Girdinin yalnızca bir kez kanonik forma (canonical form) çözümlendiği veya kaçış işlemlerinin kaldırıldığı, bu işlemin yalnızca verinin bu biçimde beklenmesi durumunda yapıldığı ve bu işlemin girdi doğrulama veya temizleme işlemlerinden sonra değil, önce gerçekleştiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.1.2", + "Ordinal": 2, + "Description": "Uygulamanın, çıktıyı kullanılması gereken yorumlayıcıya verilmeden hemen önce veya yorumlayıcının kendisi tarafından çıktı kodlaması ya da kaçış işlemi yaptığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V1.2", + "Ordinal": 2, + "Name": "Enjeksiyon Önleme", + "Items": [ + { + "Shortcode": "V1.2.1", + "Ordinal": 1, + "Description": "HTTP yanıtı, HTML veya XML belgesi için yapılan çıktı kodlamasının; HTML elemanları, HTML öznitelikleri, HTML yorumları, CSS ya da HTTP başlık alanları gibi bağlamlara uygun olduğu doğrulanmalıdır. Böylece mesaj veya belge yapısının bozulması önlenir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.2", + "Ordinal": 2, + "Description": "Dinamik olarak URL oluşturulurken, güvenilmeyen verinin bağlamına göre (örneğin, sorgu veya yol parametreleri için URL kodlaması ya da base64url kodlaması) kodlandığı doğrulanmalıdır. Yalnızca güvenli URL protokollerine izin verilmelidir (örneğin, javascript: veya data: yasaklanmalıdır).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.3", + "Ordinal": 3, + "Description": "JavaScript içeriği (JSON dahil) dinamik olarak oluşturulurken çıktı kodlama/kaçış kullanıldığı doğrulanmalıdır. Böylece mesaj veya belge yapısı değiştirilmemiş olur (JavaScript ve JSON enjeksiyonlarının önüne geçilir).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.4", + "Ordinal": 4, + "Description": "Veri sorguları veya veritabanı sorguları (SQL, HQL, NoSQL, Cypher vb.) için parametreli sorgular, ORM’ler, entity framework’ler kullanıldığı ya da SQL enjeksiyonu ve diğer veritabanı enjeksiyon saldırılarına karşı koruma sağlandığı doğrulanmalıdır. Bu durum, saklı yordam (stored procedure) yazarken de geçerlidir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.5", + "Ordinal": 5, + "Description": "Uygulamanın işletim sistemi komut enjeksiyonlarına karşı korunduğu ve işletim sistemi çağrılarında parametreli OS sorguları veya bağlama özgü komut satırı çıktı kodlamasının kullanıldığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.6", + "Ordinal": 6, + "Description": "Uygulamanın LDAP enjeksiyon zafiyetlerine karşı korunduğu ya da LDAP enjeksiyonlarını önlemek için özel güvenlik kontrollerinin uygulandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.7", + "Ordinal": 7, + "Description": "XPath enjeksiyon saldırılarına karşı, sorgu parametrelemesi veya önceden derlenmiş sorgular kullanılarak koruma sağlandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.8", + "Ordinal": 8, + "Description": "LaTeX işlemcilerinin güvenli şekilde yapılandırıldığı (örneğin, --shell-escape bayrağının kullanılmadığı) ve yalnızca izin verilen komutlardan oluşan bir listeyle çalıştırıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.9", + "Ordinal": 9, + "Description": "Düzenli ifadelerde (regex) özel karakterlerin (genellikle ters eğik çizgi \\ ile) kaçırılarak meta karakter olarak yorumlanmalarının önlendiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.10", + "Ordinal": 10, + "Description": "Uygulamanın CSV ve formül enjeksiyonlarına karşı korunduğu doğrulanmalıdır. Uygulama, CSV içeriği dışa aktarırken RFC 4180 Bölüm 2.6 ve 2.7'de tanımlanan kaçış kurallarına uymalıdır. Ayrıca, CSV veya diğer tablo formatlarına (XLS, XLSX, ODF gibi) aktarım yapılırken, alanın ilk karakteri olarak çıkan özel karakterler ('=', '+', '-', '@', '\\t' (sekme), '\\0' (null karakter)) tek tırnak (') ile kaçırılmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V1.3", + "Ordinal": 3, + "Name": "Temizleme (Sanitization)", + "Items": [ + { + "Shortcode": "V1.3.1", + "Ordinal": 1, + "Description": "WYSIWYG editörlerinden veya benzer kaynaklardan gelen tüm güvenilmeyen HTML girdilerinin, bilinen ve güvenli bir HTML temizleme kütüphanesi ya da çerçeve özelliği ile temizlendiği doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.2", + "Ordinal": 2, + "Description": "Uygulamanın eval() veya Spring Expression Language (SpEL) gibi dinamik kod çalıştırma özelliklerini kullanmaktan kaçındığı doğrulanmalıdır. Alternatif yoksa, kullanıcı girdisi çalıştırılmadan önce mutlaka temizlenmelidir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.3", + "Ordinal": 3, + "Description": "Potansiyel olarak tehlikeli bir bağlamda kullanılacak verilerin, bu bağlama uygun karakterlere izin vermek ve çok uzun girdileri kısaltmak gibi güvenlik önlemleriyle önceden temizlendiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.4", + "Ordinal": 4, + "Description": "Kullanıcı tarafından sağlanan SVG içeriğinin, yalnızca güvenli etiket ve özellikler (örneğin grafik çizme ile ilgili) içerdiğinden emin olmak için onaylandığı veya temizlendiği doğrulanmalıdır (ör. script veya foreignObject içermemelidir).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.5", + "Ordinal": 5, + "Description": "Markdown, CSS, XSL stil sayfaları, BBCode veya benzeri ifade şablon dillerinde kullanıcı girdisinin temizlendiği veya bu tür özelliklerin devre dışı bırakıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.6", + "Ordinal": 6, + "Description": "Uygulamanın, güvenilmeyen verileri başka servislere iletmeden önce izinli protokol, alan adı, yol ve port listelerine göre doğruladığı ve tehlikeli karakterleri temizlediği doğrulanarak SSRF (Sunucu Taraflı İstek Sahteciliği) saldırılarına karşı korunduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.7", + "Ordinal": 7, + "Description": "Uygulamanın şablon enjeksiyon saldırılarına karşı, güvenilmeyen girdilere dayalı şablon oluşturmayı engellediği; eğer bu kaçınılmazsa, bu girdilerin mutlaka temizlendiği veya sıkı şekilde onaylandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.8", + "Ordinal": 8, + "Description": "JNDI sorgularında kullanılmadan önce güvenilmeyen girdilerin temizlendiği ve JNDI'nin enjeksiyonlara karşı güvenli şekilde yapılandırıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.9", + "Ordinal": 9, + "Description": "Memcache’e gönderilmeden önce içeriğin temizlenerek enjeksiyon saldırılarına karşı korunduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.10", + "Ordinal": 10, + "Description": "Format dizgilerinin (format strings) beklenmeyen veya zararlı şekilde çözümlenmesini önlemek için işlenmeden önce temizlendiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.11", + "Ordinal": 11, + "Description": "SMTP veya IMAP enjeksiyonlarını önlemek için, kullanıcı girdisinin posta sistemlerine iletilmeden önce temizlendiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.12", + "Ordinal": 12, + "Description": "Regex girdilerinin üstel geri izlemeye (exponential backtracking) neden olan öğeler içermediği ve güvenilmeyen girdilerin ReDoS (Regex Denial of Service) gibi saldırılara karşı temizlendiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V1.4", + "Ordinal": 4, + "Name": "Bellek, Dizgi ve Yönetilmeyen Kod", + "Items": [ + { + "Shortcode": "V1.4.1", + "Ordinal": 1, + "Description": "Yığın, arabellek (buffer) veya yığın belleği taşmalarını önlemek ya da tespit etmek amacıyla, bellek güvenli dizgi işlemlerinin, daha güvenli bellek kopyalama ve işaretçi aritmetiğinin kullanıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.4.2", + "Ordinal": 2, + "Description": "Tamsayı taşmalarını önlemek için işaret (sign), aralık (range) ve giriş doğrulama tekniklerinin kullanıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.4.3", + "Ordinal": 3, + "Description": "Dinamik olarak ayrılan belleğin ve kaynakların serbest bırakıldığı ve boşaltılan belleklere ait referansların veya işaretçilerin kaldırıldığı veya null yapıldığı doğrulanmalıdır (dangling pointer ve use-after-free zafiyetlerine karşı).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V1.5", + "Ordinal": 5, + "Name": "Güvenli Ters Serileştirme (Safe Deserialization)", + "Items": [ + { + "Shortcode": "V1.5.1", + "Ordinal": 1, + "Description": "XML ayrıştırıcılarının (parser) kısıtlayıcı şekilde yapılandırıldığı ve dış varlık çözümleme (external entity resolution) gibi güvensiz özelliklerin XXE (XML eXternal Entity) saldırılarına karşı devre dışı bırakıldığı doğrulanmalıdır .", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.5.2", + "Ordinal": 2, + "Description": "Güvenilmeyen verilerin ters serileştirilmesinde, nesne türleri için izinli liste kullanımı veya istemci tanımlı nesne türlerinin kısıtlanması gibi güvenli giriş işleme önlemlerinin uygulandığı doğrulanmalıdır. Güvensiz olarak tanımlanmış ters serileştirme mekanizmaları, güvenilmeyen girdilerle kullanılmamalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.5.3", + "Ordinal": 3, + "Description": "Aynı veri türü için uygulamada kullanılan farklı parser'ların (ör. JSON, XML, URL parser'ları), veriyi tutarlı şekilde ayrıştırdığı ve aynı karakter kodlamasını kullandığı doğrulanmalıdır. Böylece JSON birlikte çalışabilirlik açıkları, URI veya dosya ayrıştırma farkları gibi sorunlar nedeniyle RFI veya SSRF saldırılarının istismar edilmesi önlenir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V2", + "Ordinal": 2, + "ShortName": "Validation", + "Name": "Doğrulama ve İş Mantığı", + "Items": [ + { + "Shortcode": "V2.1", + "Ordinal": 1, + "Name": "Doğrulama ve İş Mantığı Dokümantasyonu", + "Items": [ + { + "Shortcode": "V2.1.1", + "Ordinal": 1, + "Description": "Uygulama dokümantasyonunda, veri öğelerinin beklenen yapıya göre nasıl doğrulanacağına ilişkin giriş doğrulama kurallarının tanımlandığı doğrulanmalıdır. Bu; kredi kartı numaraları, e-posta adresleri, telefon numaraları gibi yaygın veri biçimleri olabileceği gibi iç sistemlere özel biçimler de olabilir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.1.2", + "Ordinal": 2, + "Description": "Uygulama dokümantasyonunda, birleştirilmiş veri öğelerinin mantıksal ve bağlamsal tutarlılığının nasıl doğrulanacağı tanımlanmalıdır (örneğin, mahalle ve posta kodunun eşleşip eşleşmediğinin kontrolü).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.1.3", + "Ordinal": 3, + "Description": "Hem kullanıcı bazında hem de uygulama genelinde geçerli olacak şekilde, iş mantığı sınırları ve doğrulama beklentilerinin belgelendiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V2.2", + "Ordinal": 2, + "Name": "Girdi Doğrulama", + "Items": [ + { + "Shortcode": "V2.2.1", + "Ordinal": 1, + "Description": "Girdilerin, işlevsel ya da iş gereksinimlerine uygunluğunun doğrulandığı teyit edilmelidir. Bu işlem; izinli değerler, desenler ve aralıklar listesine karşı pozitif doğrulama ile ya da girdinin beklenen yapıya ve mantıksal sınırlara uygunluğunun önceden tanımlanmış kurallara göre karşılaştırılması ile yapılmalıdır. Seviye 1 için bu, güvenlik veya iş kararlarında kullanılan girdilere odaklanabilir. Seviye 2 ve üstü için tüm girdilere uygulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.2.2", + "Ordinal": 2, + "Description": "Uygulamanın, güvenilir bir servis katmanında girdi doğrulama zorunluluğu uygulayacak şekilde tasarlandığı doğrulanmalıdır. İstemci tarafında gerçekleştirilen doğrulama, kullanılabilirliği artırabilir ve teşvik edilmelidir. Ancak bu doğrulama,güvenlik kontrolü olarak kabul edilmemelidir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.2.3", + "Ordinal": 3, + "Description": "Uygulamanın, ilişkili veri öğelerinin önceden tanımlanmış kurallara göre makul olup olmadığını kontrol ettiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V2.3", + "Ordinal": 3, + "Name": "İş Mantığı Güvenliği", + "Items": [ + { + "Shortcode": "V2.3.1", + "Ordinal": 1, + "Description": "Uygulamanın, aynı kullanıcı için iş mantığı akışlarını yalnızca beklenen adım sırasına göre ve adım atlamadan işlediği doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.3.2", + "Ordinal": 2, + "Description": "İş mantığı sınırlarının, uygulama dokümantasyonuna uygun şekilde uygulandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.3.3", + "Ordinal": 3, + "Description": "İş mantığı seviyesinde işlemlerin (transaction) kullanıldığı ve bir iş mantığı işleminin ya bütünüyle başarıyla tamamlandığı ya da önceki geçerli duruma geri döndürüldüğü (rollback) doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.3.4", + "Ordinal": 4, + "Description": "İş mantığı düzeyinde kilitleme mekanizmalarının, sınırlı kaynakların (ör. sinema koltukları, teslimat zamanları) uygulamanın mantığı manipüle edilerek çift rezervasyona neden olmamasını sağladığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.3.5", + "Ordinal": 5, + "Description": "Yüksek değerli iş mantığı akışlarının, yetkisiz veya kazara gerçekleşebilecek işlemleri önlemek için çoklu kullanıcı onayı gerektirdiği doğrulanmalıdır. Bu işlemler büyük para transferleri, sözleşme onayları, gizli bilgilere erişim veya üretimde güvenlik kurallarının geçersiz kılınmaları gibi durumları içerebilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V2.4", + "Ordinal": 4, + "Name": "Otomasyon Karşıtı Önlemler", + "Items": [ + { + "Shortcode": "V2.4.1", + "Ordinal": 1, + "Description": "Uygulama işlevlerine yönelik aşırı miktardaki çağrılara karşı; veri sızdırma, anlamsız veri üretme, kota tüketme, hız sınırının aşılması, hizmet reddi (DoS) ya da maliyetli kaynakların aşırı kullanımı gibi risklere karşı otomasyon karşıtı kontrollerin bulunduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.4.2", + "Ordinal": 2, + "Description": "İş mantığı akışlarının, aşırı hızlı işlem gönderimlerini önleyecek şekilde gerçekçi insan zamanlaması gerektirdiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V3", + "Ordinal": 3, + "ShortName": "Web", + "Name": "Web Ön Uç (Frontend) Güvenliği", + "Items": [ + { + "Shortcode": "V3.1", + "Ordinal": 1, + "Name": "Web Frontend Güvenlik Dokümantasyonu", + "Items": [ + { + "Shortcode": "V3.1.1", + "Ordinal": 1, + "Description": "Uygulama dokümantasyonunda, uygulamayı kullanan tarayıcıların desteklemesi gereken güvenlik özelliklerinin (ör. HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) ve diğer ilgili HTTP güvenlik mekanizmaları) tanımlandığı doğrulanmalıdır. Ayrıca bu özelliklerin mevcut olmadığı durumlarda uygulamanın nasıl davranması gerektiği (ör. kullanıcıyı uyarmak veya erişimi engellemek) de tanımlanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.2", + "Ordinal": 2, + "Name": "İçeriğin Yanlış Yorumlanması", + "Items": [ + { + "Shortcode": "V3.2.1", + "Ordinal": 1, + "Description": "Tarayıcıların HTTP yanıtlarında içerik veya işlevi yanlış bir bağlamda sunmalarını önlemek amacıyla güvenlik kontrollerinin uygulandığı doğrulanmalıdır (ör. API, kullanıcı tarafından yüklenen dosya veya başka bir kaynağın doğrudan çağrılması durumunda). Olası kontroller arasında; yalnızca HTTP istek başlıklarının (ör. Sec-Fetch-\\*) doğru bağlamı gösterdiği durumlarda içeriğin sunulması, Content-Security-Policy başlığında \"sandbox\" yönergesinin kullanılması veya Content-Disposition başlığında \"attachment\" biçiminin kullanılması yer alabilir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.2.2", + "Ordinal": 2, + "Description": "HTML yerine metin olarak görüntülenmesi amaçlanan içeriğin, HTML veya JavaScript gibi içeriklerin istenmeden çalıştırılmasını önleyecek şekilde \"createTextNode\" veya \"textContent\" gibi güvenli işleme fonksiyonlarıyla işlendiği doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.2.3", + "Ordinal": 3, + "Description": "Uygulamanın istemci tarafı JavaScript kullanırken açık değişken tanımlamaları yaparak, sıkı tür kontrolü uygulayarak, global değişkenleri document nesnesine kaydetmekten kaçınarak ve ad alanı izolasyonu sağlayarak DOM clobbering’den kaçındığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.3", + "Ordinal": 3, + "Name": "Çerez Yapılandırması", + "Items": [ + { + "Shortcode": "V3.3.1", + "Ordinal": 1, + "Description": "Çerezlerin 'Secure' niteliğine sahip olduğu ve eğer çerez adı '\\__Host-' ön eki ile başlamıyorsa, '__Secure-' ön ekinin kullanıldığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.3.2", + "Ordinal": 2, + "Description": "Kullanıcı arayüzü kandırma saldırılarına ve tarayıcı tabanlı istek sahteciliği saldırılarına (CSRF) karşı koruma sağlamak amacıyla, her çerezin 'SameSite' niteliğinin kullanım amacına uygun şekilde ayarlandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.3.3", + "Ordinal": 3, + "Description": "Çerez adı, diğer sunucularla paylaşılmak üzere açıkça tasarlanmadığı sürece '__Host-' ön eki ile tanımlanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.3.4", + "Ordinal": 4, + "Description": "Bir çerez değeri istemci tarafı betikleri tarafından erişilememesi gereken bir veri içeriyorsa (ör. oturum token'ı), çerezin 'HttpOnly' niteliğine sahip olduğu ve aynı değerin (ör. oturum token'ı) yalnızca 'Set-Cookie' başlığı ile istemciye iletildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.3.5", + "Ordinal": 5, + "Description": "Uygulama bir çerez oluştururken, çerez adı ve değerinin toplam uzunluğunun 4096 baytı aşmadığı doğrulanmalıdır. Çok büyük çerezler tarayıcı tarafından saklanmaz ve isteklerle gönderilmez; bu da çereze bağlı çalışan uygulama işlevlerinin bozulmasına yol açabilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.4", + "Ordinal": 4, + "Name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", + "Items": [ + { + "Shortcode": "V3.4.2", + "Ordinal": 2, + "Description": "Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header'ı, uygulama tarafından sabit bir değer olarak tanımlanmalı veya gelen Origin header değeri güvenilir origin’lerden oluşan bir izinli listeye karşı doğrulanmalıdır. ‘Access-Control-Allow-Origin: *’ kullanılması gerekiyorsa, yanıtın hassas bilgi içermediği doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.3", + "Ordinal": 3, + "Description": "HTTP yanıtlarında Content-Security-Policy header'ı bulunduğu ve bu header'ın yalnızca güvenilen içeriklerin veya kaynakların yüklenmesini ve çalıştırılmasını sağlayan yönergeler içerdiği doğrulanmalıdır. Minimum olarak \"global policy\", object-src 'none', base-uri 'none' yönergelerini içermeli ve izinli liste, nonce veya hash temelli bir yapı içermelidir. Seviye 3 uygulamalarında her yanıt için nonce veya hash içeren özel bir politika tanımlanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.4", + "Ordinal": 4, + "Description": "Tüm HTTP yanıtlarının 'X-Content-Type-Options: nosniff' header'ını içerdiği doğrulanmalıdır. Bu, tarayıcıya içerik türünü tahmin etmeyi bırakmasını ve yanıtın Content-Type header'ında belirtilen MIME türünün, beklenen kaynak türüyle eşleşmesini zorunlu kılar. Ayrıca bu, tarayıcıda CORB (Cross-Origin Read Blocking) özelliğini etkinleştirir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.5", + "Ordinal": 5, + "Description": "Uygulamanın, 'Referer' başlığı yoluyla üçüncü taraflara teknik olarak hassas verilerin sızmasını önlemek için bir 'referrer policy' belirlediği doğrulanmalıdır. Bu, Referrer-Policy HTTP header'ıyla veya HTML öğe nitelikleriyle (element attributes) sağlanabilir. Sızabilecek hassas bilgiler, URL’deki yol ve sorgu parametreleri ile sınırlı uygulamalarda hostname bilgisini içerebilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.6", + "Ordinal": 6, + "Description": "Uygulamanın, Content-Security-Policy header'ı altında 'frame-ancestors' yönergesini her HTTP yanıtında tanımladığı ve bu sayede içeriklerin varsayılan olarak başka sayfalara gömülmesini engellediği doğrulanmalıdır. Gerekli durumlarda özel olarak izin verildiğinden emin olunmalıdır. 'X-Frame-Options' header'ı, tarayıcılar tarafından desteklenmesine rağmen, artık güncel değildir ve güvenlik amacıyla kullanılmamalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.8", + "Ordinal": 8, + "Description": "Bir belgenin işlenmesini ve sunulmasını başlatan tüm HTTP yanıtlarında (örneğin 'text/html' tipi yanıtlar), 'Cross-Origin-Opener-Policy' header'ı 'same-origin' veya 'same-origin-allow-popups' yönergeleriyle birlikte yer almalıdır. Bu, tabnabbing ve frame counting gibi, pencere nesnelerine paylaşımlı erişimi sömüren saldırılara karşı koruma sağlar.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.5", + "Ordinal": 5, + "Name": "Tarayıcı Menşei Ayırımı", + "Items": [ + { + "Shortcode": "V3.5.1", + "Ordinal": 1, + "Description": "Uygulama, hassas işlevselliğe yönelik izinsiz cross-origin istekleri önlemek için CORS preflight mekanizmasına güvenmiyorsa, bu tür isteklerin gerçekten uygulamadan geldiği doğrulanmalıdır. Bu, anti-forgery token kullanımı veya CORS tarafından güvenli kabul edilmeyen özel HTTP header'larının zorunlu kılınmasıyla yapılabilir. Bu, tarayıcı tabanlı istek sahteciliği (CSRF) saldırılarına karşı bir savunmadır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.2", + "Ordinal": 2, + "Description": "Uygulama, hassas işlevlerin izinsiz cross-origin çağrılmasını önlemek için CORS preflight mekanizmasına güveniyorsa, bu işlevlerin bir CORS-preflight isteğini tetiklemeden çağrılamadığı doğrulanmalıdır. Bu, 'Origin' ve 'Content-Type' header'larının doğrulanmasını veya CORS-safelisted olmayan bir header'ın ve alanın kullanılmasını gerektirebilir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.4", + "Ordinal": 4, + "Description": "Farklı uygulamaların farklı hostname'lerde barındırıldığı ve böylece Same-Origin Policy tarafından sağlanan kısıtlamalardan (örneğin çerez erişim sınırları, kaynaklar arası etkileşim kontrolleri) faydalanıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.6", + "Ordinal": 6, + "Description": "Uygulamanın herhangi bir yerinde JSONP işlevselliğinin etkin olmadığı doğrulanmalıdır. Bu, XSSI (Cross-Site Script Inclusion) saldırılarını önlemek içindir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.7", + "Ordinal": 7, + "Description": "Yetkilendirme gerektiren verilerin, JavaScript dosyaları gibi betik kaynaklarının yanıtlarında yer almadığı, XSSI saldırılarını önlemek için doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.8", + "Ordinal": 8, + "Description": "Kimliği doğrulanmış kaynakların (örneğin görseller, videolar, betikler ve belgeler) yalnızca gerçekten amaçlandığında kullanıcı adına yüklenebildiği veya gömülebildiği doğrulanmalıdır. Bu, isteğin uygun olmayan bir çapraz kaynak çağrısından kaynaklanmadığından emin olmak için Sec-Fetch-* HTTP istek başlığı alanlarının sıkı bir şekilde doğrulanmasıyla veya tarayıcıya döndürülen içeriği engelleme talimatı vermek için kısıtlayıcı bir Cross-Origin-Resource-Policy HTTP yanıt başlığı alanı ayarlayarak gerçekleştirilebilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.6", + "Ordinal": 6, + "Name": "Harici Kaynak Bütünlüğü", + "Items": [ + { + "Shortcode": "V3.6.1", + "Ordinal": 1, + "Description": "JavaScript kütüphaneleri, CSS veya web fontları gibi istemci tarafı varlıkların yalnızca statik ve sürümlü olması, varlığın bütünlüğünü doğrulamak için Subresource Integrity (SRI) kullanılması durumunda harici olarak (örneğin, bir İçerik Dağıtım Ağı üzerinde) barındırıldığı doğrulanmalıdır. Bu mümkün değilse, her bir kaynak için bunu gerekçelendiren belgelenmiş bir güvenlik kararı bulunmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.7", + "Ordinal": 7, + "Name": "Diğer Tarayıcı Güvenliği Hususları", + "Items": [ + { + "Shortcode": "V3.7.1", + "Ordinal": 1, + "Description": "Uygulamanın yalnızca hâlâ desteklenen ve güvenli kabul edilen istemci tarafı teknolojileri kullandığı doğrulanmalıdır. Bu gereksinimi karşılamayan teknolojilere örnek olarak NSAPI eklentileri, Flash, Shockwave, ActiveX, Silverlight, NACL veya istemci tarafı Java applet’leri verilebilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.7.2", + "Ordinal": 2, + "Description": "Uygulamanın, yalnızca hedef adres bir izinli listede yer alıyorsa kullanıcıyı otomatik olarak farklı bir ana makine adına veya uygulamanın kontrolünde olmayan bir etki alanına yönlendirdiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.7.3", + "Ordinal": 3, + "Description": "Uygulamanın, kullanıcı uygulamanın kontrolü dışındaki bir URL’ye yönlendirildiğinde, yönlendirme hakkında bir bildirim gösterdiği ve kullanıcının bu gezintiyi iptal edebilmesi için bir seçenek sunduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.7.4", + "Ordinal": 4, + "Description": "Uygulamanın en üst düzey etki alanının (örneğin, site.tld) HTTP Strict Transport Security (HSTS) için genel preload listesine eklendiği doğrulanmalıdır. Bu, uygulamanın TLS kullanımının ana tarayıcılar tarafından doğrudan tanınmasını ve yalnızca Strict-Transport-Security yanıt header'ına bağlı kalınmamasını sağlar.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.7.5", + "Ordinal": 5, + "Description": "Uygulamaya erişen tarayıcının beklenen güvenlik özelliklerini desteklememesi durumunda, uygulamanın dokümantasyona uygun şekilde davrandığı (örneğin kullanıcıyı uyarma veya erişimi engelleme) doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V4", + "Ordinal": 4, + "ShortName": "API", + "Name": "API ve Web Servisi", + "Items": [ + { + "Shortcode": "V4.1", + "Ordinal": 1, + "Name": "Genel Web Servisi Güvenliği", + "Items": [ + { + "Shortcode": "V4.1.1", + "Ordinal": 1, + "Description": "İleti gövdesi içeren her HTTP yanıtında, yanıtın gerçek içeriğiyle eşleşen bir Content-Type header alanı bulunduğu ve güvenli karakter kodlamasını (örneğin, UTF-8, ISO-8859-1) belirtmek üzere charset parametresi içerdiği doğrulanmalıdır. Bu işlem, IANA Medya Türleri'nden \"text/\", \"/+xml\" ve \"/xml\" gibi içerikler için geçerlidir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.1.2", + "Ordinal": 2, + "Description": "Yalnızca kullanıcı arayüzüne yönelik uç noktaların (manuel olarak web tarayıcısı ile erişilmesi amaçlanan) otomatik olarak HTTP'den HTTPS'e yönlendirme yaptığı ve diğer hizmetlerin veya uç noktaların şeffaf yönlendirme gerçekleştirmediği doğrulanmalıdır. Bu, istemcinin farkında olmadan şifrelenmemiş HTTP istekleri göndermesi ve bu isteklerin otomatik olarak HTTPS'e yönlendirilmesi sonucunda hassas verilerin sızmasının fark edilmemesi riskini önlemek içindir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.1.3", + "Ordinal": 3, + "Description": "Uygulama tarafından kullanılan ve yük dengeleyici, web proxy veya frontend için backend hizmeti gibi bir ara katman tarafından ayarlanan herhangi bir HTTP başlık alanının, son kullanıcı tarafından geçersiz kılınamayacağı doğrulanmalıdır. Örnek başlıklar arasında X-Real-IP, X-Forwarded-* veya X-User-ID yer alabilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.1.4", + "Ordinal": 4, + "Description": "Uygulama veya API tarafından açıkça desteklenen HTTP yöntemlerinin (preflight istekleri sırasında OPTIONS dahil) dışında hiçbir yöntemin kullanılmadığı ve kullanılmayan yöntemlerin engellendiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.1.5", + "Ordinal": 5, + "Description": "Çok hassas istekler veya birçok sistemden geçen işlemler için, taşıma katmanı güvenliğinin üzerine ek bir güvence sağlamak amacıyla, her iletiye özel dijital imzaların kullanıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V4.2", + "Ordinal": 2, + "Name": "HTTP İleti Yapısı Doğrulama", + "Items": [ + { + "Shortcode": "V4.2.1", + "Ordinal": 1, + "Description": "Tüm uygulama bileşenlerinin (yük dengeleyiciler, güvenlik duvarları ve uygulama sunucuları dahil) HTTP sürümüne uygun mekanizmaları kullanarak gelen HTTP iletilerinin sınırlarını belirlediği ve bu sayede HTTP istek kaçakçılığına karşı koruma sağlandığı doğrulanmalıdır. HTTP/1.x sürümünde Transfer-Encoding başlık alanı varsa, RFC 2616'ya göre Content-Length başlığı göz ardı edilmelidir. HTTP/2 veya HTTP/3 kullanıldığında, Content-Length başlığı varsa, alıcının bu değerin DATA çerçevelerinin uzunluğuyla tutarlı olduğunu doğrulaması gerekir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.2.2", + "Ordinal": 2, + "Description": "HTTP iletileri üretilirken, Content-Length başlığının, HTTP protokolünün çerçeveleme yöntemine göre belirlenen içerik uzunluğu ile çelişmediği doğrulanmalıdır. Bu, istek kaçakçılığı saldırılarını önlemek için gereklidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.2.3", + "Ordinal": 3, + "Description": "Uygulamanın, yanıt bölme ve header enjeksiyonu saldırılarını önlemek amacıyla, bağlantıya özel başlık alanları (örneğin Transfer-Encoding) içeren HTTP/2 veya HTTP/3 iletilerini göndermediği ve kabul etmediği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.2.4", + "Ordinal": 4, + "Description": "Uygulamanın yalnızca başlık alanları ve değerleri CR (\\r), LF (\\n) veya CRLF (\\r\\n) karakter dizileri içermeyen HTTP/2 ve HTTP/3 isteklerini kabul ettiği doğrulanmalıdır. Bu, başlık enjeksiyonu saldırılarını önlemek içindir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.2.5", + "Ordinal": 5, + "Description": "Uygulama (backend veya frontend) istek oluşturuyor ve gönderiyorsa, URI'ler (örneğin API çağrıları için) veya HTTP istek başlıkları (örneğin Authorization veya Cookie) gibi bileşenlerin, alıcı sistemler tarafından kabul edilemeyecek kadar uzun olmamasını sağlamak amacıyla doğrulama, temizleme veya diğer mekanizmaları kullandığı doğrulanmalıdır. Bu tür çok uzun istekler (örneğin çok uzun bir Cookie başlığı) gönderildiğinde sunucunun sürekli hata durumu döndürmesiyle hizmet reddi oluşabilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V4.3", + "Ordinal": 3, + "Name": "GraphQL", + "Items": [ + { + "Shortcode": "V4.3.1", + "Ordinal": 1, + "Description": "Maliyetli ve iç içe geçmiş sorgular sonucu oluşabilecek GraphQL veya veri katmanı ifadelerine yönelik Hizmet Reddi (DoS) saldırılarını önlemek için, sorgu izin listesi (allowlist), derinlik sınırlandırması, sorgu sayısı sınırlandırması veya sorgu maliyeti analizi kullanıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.3.2", + "Ordinal": 2, + "Description": "GraphQL introspection (iç yapı sorgulama) sorgularının, GraphQL API'nin üçüncü taraflar tarafından kullanılmasına yönelik olmadığı sürece, üretim ortamında devre dışı bırakıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V4.4", + "Ordinal": 4, + "Name": "WebSocket", + "Items": [ + { + "Shortcode": "V4.4.1", + "Ordinal": 1, + "Description": "Tüm WebSocket bağlantılarında TLS üzerinden WebSocket (WSS) kullanıldığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.4.2", + "Ordinal": 2, + "Description": "WebSocket'in başlangıçtaki HTTP el sıkışması (handshake) sırasında, Origin başlık alanının uygulama için izin verilen origin listesiyle karşılaştırılarak kontrol edildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.4.3", + "Ordinal": 3, + "Description": "Uygulamanın standart oturum yönetimi kullanılamıyorsa, bunun yerine ilgili Oturum Yönetimi güvenlik gereksinimlerine uygun özel token'ların kullanıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.4.4", + "Ordinal": 4, + "Description": "HTTPS oturumu WebSocket kanalına geçerken, özel WebSocket oturum yönetim token’larının önceki şekilde kimliği doğrulanmış HTTPS oturumu aracılığıyla elde edildiği veya doğrulandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V5", + "Ordinal": 5, + "ShortName": "File", + "Name": "Dosya İşleme", + "Items": [ + { + "Shortcode": "V5.1", + "Ordinal": 1, + "Name": "Dosya İşleme Dokümantasyonu", + "Items": [ + { + "Shortcode": "V5.1.1", + "Ordinal": 1, + "Description": "Dokümantasyonun, her yükleme özelliği için izin verilen dosya türlerini, beklenen dosya uzantılarını ve maksimum boyutu (açılmış hali dahil) tanımladığı doğrulanmalıdır. Ayrıca, dosyaların son kullanıcılar için nasıl güvenli hâle getirileceği (örneğin kötü amaçlı bir dosya tespit edildiğinde uygulamanın nasıl davranacağı) gibi bilgilerin de belgede yer aldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V5.2", + "Ordinal": 2, + "Name": "Dosya Yükleme ve İçerik", + "Items": [ + { + "Shortcode": "V5.2.1", + "Ordinal": 1, + "Description": "Uygulamanın, yalnızca performans kaybına veya hizmet reddine yol açmayacak boyuttaki dosyaları kabul ettiği doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.2", + "Ordinal": 2, + "Description": "Uygulama bir dosyayı, doğrudan veya bir arşiv (ör. zip dosyası) içinde kabul ettiğinde, dosya uzantısının beklenen uzantıyla eşleşip eşleşmediğini kontrol ettiği ve içeriğin uzantı tarafından temsil edilen türle uyumlu olduğunu doğruladığı kontrol edilmelidir. Bu; ilk 'magic byte' kontrolü, görüntü yeniden yazımı ve dosya içeriği doğrulama için özel kütüphanelerin kullanımı gibi yöntemleri içerir. Seviye 1 için bu, yalnızca iş veya güvenlik kararlarında kullanılan dosyalarla sınırlı olabilir. Seviye 2 ve üzeri için tüm dosyalar bu kontrole tabi olmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.3", + "Ordinal": 3, + "Description": "Sıkıştırılmış dosyaların (ör. zip, gz, docx, odt) açılmadan önce, izin verilen maksimum açılmış boyuta ve maksimum dosya sayısına göre kontrol edildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.4", + "Ordinal": 4, + "Description": "Her kullanıcı için dosya boyutu kotası ve maksimum dosya sayısının uygulandığı doğrulanmalıdır. Böylece tek bir kullanıcının çok sayıda veya aşırı büyük dosya yükleyerek depolama alanını doldurması engellenir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.5", + "Ordinal": 5, + "Description": "Uygulamanın, içinde sembolik bağlantılar (symlink) bulunan sıkıştırılmış dosyaların yüklenmesine yalnızca bu durum özel olarak gerekli olduğunda izin verdiği doğrulanmalıdır. Bu durumda, sembolik bağlantı verilebilecek dosyaların bir izinli listesi uygulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.6", + "Ordinal": 6, + "Description": "Uygulamanın, piksel boyutu izin verilen maksimum değeri aşan görüntü dosyalarının yüklenmesini reddettiği doğrulanmalıdır. Bu, pixel flood saldırılarını önlemek için gereklidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V5.3", + "Ordinal": 3, + "Name": "Dosya Depolama", + "Items": [ + { + "Shortcode": "V5.3.1", + "Ordinal": 1, + "Description": "Güvenilmeyen girdilerle yüklenen veya oluşturulan ve herkese açık klasörlerde depolanan dosyaların, bir HTTP isteğiyle doğrudan erişildiğinde sunucu taraflı program kodu olarak çalıştırılmadığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.3.2", + "Ordinal": 2, + "Description": "Uygulamanın, dosya işlemleri için dosya yollarını oluştururken kullanıcı tarafından gönderilen dosya adlarını değil, dahili olarak oluşturulan veya güvenilir verileri kullandığı; eğer kullanıcı tarafından gönderilen dosya adları veya meta veriler kullanılacaksa, sıkı doğrulama ve temizleme işlemlerinin uygulandığı doğrulanmalıdır. Bu, yol geçişi (path traversal), yerel veya uzak dosya dahil etme (LFI, RFI) ve sunucu tarafı istek sahteciliği (SSRF) saldırılarına karşı koruma sağlar.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.3.3", + "Ordinal": 3, + "Description": "Sunucu tarafında gerçekleşen dosya işlemlerinin (örneğin dosya açma/decompress işlemi), kullanıcı tarafından sağlanan yol bilgilerini yok saydığı ve zip slip gibi güvenlik açıklarını önlediği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V5.4", + "Ordinal": 4, + "Name": "Dosya İndirme", + "Items": [ + { + "Shortcode": "V5.4.1", + "Ordinal": 1, + "Description": "Uygulamanın, kullanıcı tarafından gönderilen dosya adlarını (ör. JSON, JSONP veya URL parametresinde) doğruladığı veya göz ardı ettiği ve yanıtın Content-Disposition başlık alanında bir dosya adı belirttiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.4.2", + "Ordinal": 2, + "Description": "Sunulan dosya adlarının (örneğin HTTP yanıt header'larında veya e-posta eklerinde), belge yapısını korumak ve enjeksiyon saldırılarını önlemek için kodlandığı veya temizlendiği (ör. RFC 6266’ya uygun) doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.4.3", + "Ordinal": 3, + "Description": "Güvenilmeyen kaynaklardan elde edilen dosyaların, bilinen kötü amaçlı içeriklerin sunulmasını önlemek amacıyla antivirüs tarayıcılarıyla tarandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V6", + "Ordinal": 6, + "ShortName": "Authentication", + "Name": "Kimlik Doğrulama", + "Items": [ + { + "Shortcode": "V6.1", + "Ordinal": 1, + "Name": "Kimlik Doğrulama Dokümantasyonu", + "Items": [ + { + "Shortcode": "V6.1.1", + "Ordinal": 1, + "Description": "Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırılarına karşı oran sınırlama (rate limiting), otomasyon karşıtı önlemler ve uyarlanabilir yanıt gibi kontrollerin nasıl kullanıldığını açıklayan bir uygulama dokümantasyonu bulunduğu doğrulanmalıdır. Dokümantasyon, bu kontrollerin nasıl yapılandırıldığını ve kötü niyetli hesap kilitlemenin nasıl önlendiğini açıkça ortaya koymalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.1.2", + "Ordinal": 2, + "Description": "Parolalarda kullanılmasını önlemek amacıyla, bağlama özgü sözcüklerin (örneğin kurum adlarının permütasyonları, ürün adları, sistem tanımlayıcıları, proje kod adları, departman veya rol adları vb.) bulunduğu belgelenmiş bir liste mevcut olduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.1.3", + "Ordinal": 3, + "Description": "Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, bunların tümünün belgelenmiş olduğu ve her yol için tutarlı şekilde uygulanması gereken güvenlik kontrolleri ile kimlik doğrulama gücünün tanımlandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.2", + "Ordinal": 2, + "Name": "Parola Güvenliği", + "Items": [ + { + "Shortcode": "V6.2.1", + "Ordinal": 1, + "Description": "Kullanıcı tarafından belirlenen parolaların en az 8 karakter uzunluğunda olması sağlanmalı, ancak 15 karakter ve üzeri uzunlukta parolalar olmaları şiddetle tavsiye edilir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.2", + "Ordinal": 2, + "Description": "Kullanıcıların parolalarını değiştirebilmeleri sağlanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.3", + "Ordinal": 3, + "Description": "Parola değiştirme işlevinin hem mevcut hem de yeni parolayı gerektirdiği doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.4", + "Ordinal": 4, + "Description": "Kayıt veya parola değişimi sırasında girilen parolaların, uygulamanın parola politikasına (örneğin minimum uzunluk) uyan ilk 3000 yaygın parolaya karşı kontrol edildiği doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.5", + "Ordinal": 5, + "Description": "Her tür karakterin kullanılmasına izin verildiği ve büyük/küçük harf, sayı veya özel karakter şartlarının zorunlu tutulmadığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.6", + "Ordinal": 6, + "Description": "Parola giriş alanlarının, girdiyi maskelemek için \"type=password\" kullandığı doğrulanmalıdır. Uygulamalar, kullanıcının tüm maskelenmiş parolayı ya da son girilen karakteri geçici olarak görüntülemesine izin verebilir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.7", + "Ordinal": 7, + "Description": "\"Yapıştır\" özelliğinin, tarayıcı parola yardımcılarının ve harici parola yöneticilerinin kullanımına izin verildiği doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.8", + "Ordinal": 8, + "Description": "Uygulamanın, kullanıcıdan aldığı parolayı herhangi bir şekilde değiştirmeden, örneğin kesmeden veya harf büyüklüğünü değiştirmeden, tam olarak doğruladığı teyit edilmelidir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.9", + "Ordinal": 9, + "Description": "En az 64 karakter uzunluğundaki parolalara izin verildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.10", + "Ordinal": 10, + "Description": "Kullanıcının parolasının, yalnızca ele geçirildiği tespit edildiğinde veya kullanıcı tarafından yenilendiğinde geçerliliğini yitirdiği doğrulanmalıdır. Uygulama, belirli aralıklarla parola yenilenmesini zorunlu kılmamalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.11", + "Ordinal": 11, + "Description": "Tahmin edilmesi kolay parolaların oluşturulmasını önlemek amacıyla, bağlama özgü kelimelerin yer aldığı belgelenmiş listenin parola doğrulamada kullanıldığı teyit edilmelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.12", + "Ordinal": 12, + "Description": "Kayıt veya parola değişikliği sırasında girilen parolaların, ele geçirilmiş parolalar listesine karşı kontrol edildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.3", + "Ordinal": 3, + "Name": "Genel Kimlik Doğrulama Güvenliği", + "Items": [ + { + "Shortcode": "V6.3.1", + "Ordinal": 1, + "Description": "Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırıları gibi saldırıları önlemeye yönelik kontrollerin, uygulamanın güvenlik dokümantasyonuna göre uygulandığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.2", + "Ordinal": 2, + "Description": "\"root\", \"admin\" veya \"sa\" gibi varsayılan kullanıcı hesaplarının uygulamada yer almadığı veya devre dışı bırakıldığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.3", + "Ordinal": 3, + "Description": "Uygulamaya erişim için ya çok faktörlü bir kimlik doğrulama mekanizması ya da tek faktörlü mekanizmaların kombinasyonu kullanılmalıdır. Seviye 3 için, bu faktörlerden biri, oltalama saldırılarına karşı direnç sağlayan ve kimlik doğrulama niyetini bir kullanıcı etkileşimi (örneğin FIDO donanım anahtarında bir düğmeye basma veya mobil telefonda bir onay) gerektirerek doğrulayan donanım tabanlı bir kimlik doğrulayıcı olmalıdır. Bu gereksinimdeki herhangi bir esneklik için, gerekçesi belgelenmiş ve riskleri azaltıcı kapsamlı kontroller içeren bir plan gereklidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.4", + "Ordinal": 4, + "Description": "Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, belgelendirilmemiş bir yol bulunmadığı ve tüm yollar için güvenlik kontrolleri ile kimlik doğrulama gücünün tutarlı şekilde uygulandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.5", + "Ordinal": 5, + "Description": "Başarılı veya başarısız şüpheli kimlik doğrulama girişimlerinin kullanıcıya bildirildiği doğrulanmalıdır. Bu, olağandışı bir konum veya istemciden gelen girişimler, yalnızca bir faktörle yapılan kısmen başarılı doğrulamalar, uzun süreli inaktiflik sonrası yapılan girişimler veya birçok başarısız denemeden sonraki başarılı girişimler gibi durumları içerebilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.6", + "Ordinal": 6, + "Description": "E-postanın, tek faktörlü ya da çok faktörlü kimlik doğrulama mekanizması olarak kullanılmadığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.7", + "Ordinal": 7, + "Description": "Kimlik doğrulama detaylarında yapılan güncellemeler sonrasında (örneğin kimlik bilgisi sıfırlama, kullanıcı adı veya e-posta adresi değişiklikleri), kullanıcıların bilgilendirildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.8", + "Ordinal": 8, + "Description": "Başarısız kimlik doğrulama girişimlerinden, geçerli kullanıcıların hata mesajları, HTTP yanıt kodları veya farklı yanıt süreleri gibi sonuçlara dayanarak tespit edilemediği doğrulanmalıdır. Bu koruma, kayıt ve \"parolamı unuttum\" işlevselliğinde de geçerli olmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.4", + "Ordinal": 4, + "Name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", + "Items": [ + { + "Shortcode": "V6.4.1", + "Ordinal": 1, + "Description": "Sistem tarafından oluşturulan ilk parolaların veya etkinleştirme kodlarının güvenli bir şekilde rastgele üretildiği, mevcut parola politikasına uygun olduğu, kısa bir süre içinde veya ilk kullanım sonrasında geçerliliğini yitirdiği doğrulanmalıdır. Bu başlangıç sırları uzun vadeli parola olarak kullanılmasına izin verilmemelidir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.2", + "Ordinal": 2, + "Description": "Parola ipuçlarının veya \"gizli sorular\" olarak bilinen, bilgiye dayalı kimlik doğrulama mekanizmalarının mevcut olmadığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.3", + "Ordinal": 3, + "Description": "Unutulmuş parolanın sıfırlanması için, etkin olan çok faktörlü kimlik doğrulama mekanizmalarını atlamayan güvenli bir sürecin uygulandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.4", + "Ordinal": 4, + "Description": "Çok faktörlü kimlik doğrulama faktörlerinden biri kaybolursa, kayıt sırasında uygulanan kimlik kanıtlama seviyesiyle aynı seviyede kimlik doğrulama yapıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.5", + "Ordinal": 5, + "Description": "Süresi dolacak kimlik doğrulama mekanizmalarının yenilenmesine ilişkin talimatların, süresi dolmadan önce tamamlanacak şekilde yeterli sürede gönderildiği ve gerekiyorsa otomatik hatırlatıcıların yapılandırıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.6", + "Ordinal": 6, + "Description": "Yönetici yetkisi olan kullanıcıların, kullanıcının parola sıfırlama sürecini başlatabildiği ancak kullanıcının yeni parolasını belirleyemediği veya değiştiremediği doğrulanmalıdır. Bu, yönetici yetkisi olan kullanıcıların, kullanıcı parolasını bilmesini engeller.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.5", + "Ordinal": 5, + "Name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", + "Items": [ + { + "Shortcode": "V6.5.1", + "Ordinal": 1, + "Description": "Arama sırları, bant dışı kimlik doğrulama istekleri veya kodları ve zamana dayalı tek kullanımlık parolaların (TOTP) yalnızca bir kez kullanılabildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.2", + "Ordinal": 2, + "Description": "Uygulamanın backend tarafında saklanırken, 112 bitten az entropiye sahip (örneğin 19 rastgele harf-rakam karakteri veya 34 rastgele rakam) arama sırlarının, 32-bit rastgele bir salt içeren onaylı bir parola saklama algoritmasıyla hash’lendiği doğrulanmalıdır. Gizli bilginin entropisi 112 bit veya daha fazlaysa standart bir hash fonksiyonu kullanılabilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.3", + "Ordinal": 3, + "Description": "Arama sırları, bant dışı kimlik doğrulama kodları ve zamana dayalı tek kullanımlık parola seed'lerinin, öngörülebilir değerlerden kaçınmak için Kriptografik Olarak Güvenli Sözde Rastgele Sayı Üreteci (CSPRNG) ile oluşturulduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.4", + "Ordinal": 4, + "Description": "Arama sırlarının ve bant dışı kimlik doğrulama kodlarının en az 20 bit entropiye (genellikle 4 rastgele harf-rakam karakteri veya 6 rastgele rakam) sahip olduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.5", + "Ordinal": 5, + "Description": "Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının ve zamana dayalı tek kullanımlık parolaların (TOTP) belirli bir ömre sahip olduğu doğrulanmalıdır. Bant dışı istekler en fazla 10 dakika, TOTP’ler ise en fazla 30 saniye geçerli olmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.6", + "Ordinal": 6, + "Description": "Herhangi bir kimlik doğrulama faktörünün (fiziksel cihazlar dahil) çalınması veya kaybı durumunda iptal edilebildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.7", + "Ordinal": 7, + "Description": "Biyometrik kimlik doğrulama mekanizmalarının yalnızca ikincil faktör olarak, “sahip olduğunuz bir şey” veya “bildiğiniz bir şey” ile birlikte kullanıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.8", + "Ordinal": 8, + "Description": "Zamana dayalı tek kullanımlık parolaların (TOTP) doğrulamasının, güvenilir bir hizmetten alınan zaman kaynağına dayanarak yapıldığı ve güvenilir olmayan veya istemci tarafından sağlanan zaman kaynağına dayanmadığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.6", + "Ordinal": 6, + "Name": "Bant Dışı Kimlik Doğrulama Mekanizmaları", + "Items": [ + { + "Shortcode": "V6.6.1", + "Ordinal": 1, + "Description": "Tek kullanımlık parolaların (OTP) telefon veya SMS ile Public Switched Telephone Network (PSTN) üzerinden iletildiği kimlik doğrulama mekanizmalarının, yalnızca telefon numarası önceden doğrulanmışsa, alternatif daha güçlü yöntemler (örneğin TOTP) de sunuluyorsa ve kullanıcıya güvenlik riskleri hakkında bilgi veriliyorsa sunulduğu doğrulanmalıdır. Seviye 3 uygulamalar için telefon ve SMS seçenekleri sunulmamalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.6.2", + "Ordinal": 2, + "Description": "Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının, oluşturuldukları özgün kimlik doğrulama isteğiyle bağlantılı olduğu ve daha önceki ya da sonraki bir istek için kullanılamadığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.6.3", + "Ordinal": 3, + "Description": "Kod tabanlı bant dışı kimlik doğrulama mekanizmalarının, oran sınırlaması ile kaba kuvvet saldırılarına karşı korunduğu doğrulanmalıdır. En az 64 bit entropiye sahip kodlar kullanılması da değerlendirilmelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.6.4", + "Ordinal": 4, + "Description": "Çok faktörlü kimlik doğrulama için push bildirimleri kullanılıyorsa, push bombing saldırılarına karşı oran sınırlamasının kullanıldığı doğrulanmalıdır. “Numara eşleştirme” de bu riski azaltabilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.7", + "Ordinal": 7, + "Name": "Kriptografik Kimlik Doğrulama Mekanizması", + "Items": [ + { + "Shortcode": "V6.7.1", + "Ordinal": 1, + "Description": "Kriptografik kimlik doğrulama beyanlarını doğrulamak için kullanılan sertifikaların, değiştirilmeye karşı korumalı şekilde saklandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.7.2", + "Ordinal": 2, + "Description": "Challenge nonce değerinin en az 64 bit uzunluğunda olduğu ve istatistiksel olarak benzersiz ya da cihazın ömrü boyunca benzersiz olduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.8", + "Ordinal": 8, + "Name": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", + "Items": [ + { + "Shortcode": "V6.8.1", + "Ordinal": 1, + "Description": "Uygulama birden fazla kimlik sağlayıcıyı (IdP) destekliyorsa, başka bir desteklenen kimlik sağlayıcı aracılığıyla (örneğin aynı kullanıcı tanımlayıcısını kullanarak) kullanıcının kimliğinin taklit edilemediği doğrulanmalıdır. Standart önlem, uygulamanın kullanıcıyı IdP kimliği (bir ad alanı işlevi görür) ve IdP içindeki kullanıcı kimliğinin birleşimiyle kaydetmesi ve tanımlamasıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.8.2", + "Ordinal": 2, + "Description": "Kimlik doğrulama beyanları üzerindeki dijital imzaların (örneğin JWT veya SAML beyanları) varlığı ve bütünlüğünün her zaman doğrulandığı ve imzasız veya geçersiz imzalı beyanların reddedildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.8.3", + "Ordinal": 3, + "Description": "SAML beyanlarının benzersiz biçimde işlendiği ve yalnızca geçerlilik süresi içinde bir kez kullanıldığı, tekrar oynatma (replay) saldırılarını önlemek amacıyla doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.8.4", + "Ordinal": 4, + "Description": "Uygulama ayrı bir Kimlik Sağlayıcı (IdP) kullanıyorsa ve belirli işlemler için belirli kimlik doğrulama gücü, yöntemleri veya zaman bilgisi bekliyorsa, uygulamanın bu bilgileri IdP tarafından döndürülen veriler üzerinden doğruladığı teyit edilmelidir. Örneğin OIDC kullanılıyorsa, bu durum ID Token üzerindeki 'acr', 'amr' ve 'auth_time' gibi claim’lerin (varsa) doğrulanması ile sağlanabilir. Eğer IdP bu bilgileri sağlamıyorsa, uygulamanın asgari kimlik doğrulama gücünün kullanıldığını varsayan (örneğin yalnızca kullanıcı adı ve parola ile tek faktörlü doğrulama) belgelenmiş bir yedek yaklaşımı olmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V7", + "Ordinal": 7, + "ShortName": "Session", + "Name": "Oturum Yönetimi", + "Items": [ + { + "Shortcode": "V7.1", + "Ordinal": 1, + "Name": "Oturum Yönetim Dokümantasyonu", + "Items": [ + { + "Shortcode": "V7.1.1", + "Ordinal": 1, + "Description": "Kullanıcının oturum inaktivite zaman aşımı süresi ve mutlak maksimum oturum süresinin belgelendiği, diğer kontrollerle birlikte uygun olduğu ve NIST SP 800-63B yeniden kimlik doğrulama gereksinimlerinden herhangi bir sapma varsa gerekçesinin belgede yer aldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.1.2", + "Ordinal": 2, + "Description": "Belgede bir hesap için kaç adet eşzamanlı (paralel) oturuma izin verildiği ile birlikte, maksimum aktif oturum sayısına ulaşıldığında uygulanacak davranış ve işlemlerin tanımlandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.1.3", + "Ordinal": 3, + "Description": "Birleşik kimlik yönetim ekosisteminin bir parçası olarak kullanıcı oturumu oluşturan ve yöneten tüm sistemlerin, oturum ömrü, sonlandırma ve yeniden kimlik doğrulama gerektiren diğer koşulların nasıl koordine edildiğini açıklayan kontrollerle birlikte belgede yer aldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.2", + "Ordinal": 2, + "Name": "Temel Oturum Yönetimi Güvenliği", + "Items": [ + { + "Shortcode": "V7.2.1", + "Ordinal": 1, + "Description": "Uygulamanın tüm oturum token'ı doğrulama işlemlerini güvenilir bir backend servisi aracılığıyla gerçekleştirdiği doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.2.2", + "Ordinal": 2, + "Description": "Uygulamanın, statik API gizli anahtarları veya sabit değerler yerine, oturum yönetimi için dinamik olarak oluşturulan kendi kendine yeterli veya referans token'ları kullandığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.2.3", + "Ordinal": 3, + "Description": "Uygulama kullanıcı oturumlarını temsil etmek için referans token'ları kullanıyorsa, bu token'ların benzersiz olduğu, kriptografik olarak güvenli bir sözde rastgele sayı üreteci (CSPRNG) kullanılarak üretildiği ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.2.4", + "Ordinal": 4, + "Description": "Uygulamanın, kullanıcı kimlik doğrulaması (yeniden kimlik doğrulama dahil) sırasında yeni bir oturum token'ı oluşturduğu ve mevcut oturum token'ını sonlandırdığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.3", + "Ordinal": 3, + "Name": "Oturum Zaman Aşımı", + "Items": [ + { + "Shortcode": "V7.3.1", + "Ordinal": 1, + "Description": "Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde bir hareketsizlik zaman aşımı bulunduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.3.2", + "Ordinal": 2, + "Description": "Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde mutlak bir maksimum oturum süresi bulunduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.4", + "Ordinal": 4, + "Name": "Oturum Sonlandırma", + "Items": [ + { + "Shortcode": "V7.4.1", + "Ordinal": 1, + "Description": "Oturum sonlandırma tetiklendiğinde (örneğin, çıkış yapıldığında veya süre dolduğunda), uygulamanın oturumun daha fazla kullanılmasına izin vermediği doğrulanmalıdır. Referans token'lar veya durum bilgili oturumlar için bu, oturum verilerinin uygulama arka ucunda geçersiz kılınması anlamına gelir. Kapsamlı token kullanan uygulamaların; sonlandırılmış token listesi tutmak, kullanıcıya özel tarih ve saatten önce oluşturulan token'ları reddetmek veya kullanıcıya özel imzalama anahtarını yenilemek gibi bir çözüm uygulaması gerekir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.4.2", + "Ordinal": 2, + "Description": "Bir kullanıcı hesabı devre dışı bırakıldığında veya silindiğinde (örneğin bir çalışanın şirketten ayrılması), uygulamanın tüm aktif oturumları sonlandırdığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.4.3", + "Ordinal": 3, + "Description": "Herhangi bir kimlik doğrulama faktörünün başarılı bir şekilde değiştirilmesi veya kaldırılmasından (şifre sıfırlama veya kurtarma yoluyla yapılan değişiklikler dahil ve varsa MFA ayarları güncellemeleri dahil) sonra, uygulamanın diğer tüm aktif oturumları sonlandırma seçeneği sunduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.4.4", + "Ordinal": 4, + "Description": "Kimlik doğrulama gerektiren tüm sayfalarda kolay erişilebilir ve görünür bir çıkış yap (logout) işlevi bulunduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.4.5", + "Ordinal": 5, + "Description": "Uygulama yöneticilerinin, bireysel bir kullanıcının veya tüm kullanıcıların aktif oturumlarını sonlandırabilme yetkisine sahip olduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.5", + "Ordinal": 5, + "Name": "Oturum Kötüye Kullanımına Karşı Savunmalar", + "Items": [ + { + "Shortcode": "V7.5.1", + "Ordinal": 1, + "Description": "E-posta adresi, telefon numarası, MFA yapılandırması veya hesap kurtarmada kullanılan diğer bilgiler gibi kimlik doğrulamayı etkileyebilecek hassas hesap özniteliklerinde değişiklik yapılmadan önce uygulamanın tam yeniden kimlik doğrulama gerektirdiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.5.2", + "Ordinal": 2, + "Description": "Kullanıcıların, (en az bir faktörle yeniden kimlik doğrulama yaptıktan sonra) mevcut tüm aktif oturumları görüntüleyebilmesi ve sonlandırabilmesinin mümkün olduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.5.3", + "Ordinal": 3, + "Description": "Uygulamanın, son derece hassas işlemler veya operasyonlar gerçekleştirilmeden önce en az bir faktörle ek kimlik doğrulaması veya ikincil bir doğrulama gerektirdiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.6", + "Ordinal": 6, + "Name": "Birleşik Yeniden Kimlik Doğrulama", + "Items": [ + { + "Shortcode": "V7.6.1", + "Ordinal": 1, + "Description": "Güvenen Taraf (RP) ile Kimlik Sağlayıcı (IdP) arasındaki oturum süresi ve oturum sonlandırma davranışlarının belgelenmiş olduğu ve, örneğin IdP kimlik doğrulama olayları arasında maksimum süreye ulaşıldığında yeniden kimlik doğrulamanın gerekli kılındığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.6.2", + "Ordinal": 2, + "Description": "Yeni bir oturum oluşturulmasının, kullanıcı onayı veya açık bir eylem gerektirdiği; kullanıcı etkileşimi olmaksızın yeni uygulama oturumlarının oluşturulmasının önlendiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V8", + "Ordinal": 8, + "ShortName": "Authorization", + "Name": "Yetkilendirme", + "Items": [ + { + "Shortcode": "V8.1", + "Ordinal": 1, + "Name": "Yetkilendirme Dokümantasyonu", + "Items": [ + { + "Shortcode": "V8.1.1", + "Ordinal": 1, + "Description": "Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak işlev düzeyinde ve veriye özel erişim kısıtlamaları için kuralları tanımladığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.1.2", + "Ordinal": 2, + "Description": "Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak alan (field) düzeyinde erişim kısıtlamaları (hem okuma hem yazma) için kuralları tanımladığı doğrulanmalıdır. Bu kuralların, ilgili veri nesnesinin durum veya statü gibi diğer özniteliklerine bağlı olabileceği unutulmamalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.1.3", + "Ordinal": 3, + "Description": "Uygulamanın dokümantasyonunun, kimlik doğrulama ve yetkilendirme ile ilgili güvenlik kararlarının alınmasında kullanılan çevresel ve bağlamsal öznitelikleri (günün saati, kullanıcı konumu, IP adresi veya cihaz gibi) tanımladığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.1.4", + "Ordinal": 4, + "Description": "Kimlik doğrulama ve yetkilendirme dokümantasyonunun; işlev düzeyinde, veriye özel ve alan düzeyinde yetkilendirmenin yanı sıra çevresel ve bağlamsal faktörlerin karar almada nasıl kullanıldığını tanımladığı doğrulanmalıdır. Bu, değerlendirilen öznitelikleri, risk eşiklerini ve alınan aksiyonları (ör. izin ver, doğrulama iste, reddet, step-up kimlik doğrulama) içermelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V8.2", + "Ordinal": 2, + "Name": "Genel Yetkilendirme Tasarımı", + "Items": [ + { + "Shortcode": "V8.2.1", + "Ordinal": 1, + "Description": "Uygulamanın, işlev düzeyindeki erişimin yalnızca açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.2.2", + "Ordinal": 2, + "Description": "Uygulamanın, veriye özel erişimin yalnızca belirli veri öğelerine açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, doğrudan nesne referansı güvenlik açıkları (IDOR) ve bozuk nesne düzeyinde yetkilendirme (BOLA) risklerini azaltır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.2.3", + "Ordinal": 3, + "Description": "Uygulamanın, alan (field) düzeyindeki erişimin yalnızca belirli alanlara açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, bozuk nesne özelliği düzeyinde yetkilendirme (BOPLA) risklerini azaltır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.2.4", + "Ordinal": 4, + "Description": "Tüketicinin çevresel ve bağlamsal özniteliklerine (ör. günün saati, konum, IP adresi veya cihaz) dayalı uyarlanabilir güvenlik kontrollerinin, uygulama dokümantasyonunda tanımlandığı şekilde, kimlik doğrulama ve yetkilendirme kararları için uygulandığı doğrulanmalıdır. Bu kontroller, tüketici yeni bir oturum başlatmaya çalışırken ve mevcut bir oturum sırasında uygulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V8.3", + "Ordinal": 3, + "Name": "İşlem Düzeyinde Yetkilendirme", + "Items": [ + { + "Shortcode": "V8.3.1", + "Ordinal": 1, + "Description": "Uygulamanın yetkilendirme kurallarını güvenilir bir servis katmanında uyguladığı ve istemci taraflı JavaScript gibi güvenilmeyen tüketiciler tarafından değiştirilebilecek kontrollerle yetinmediği doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.3.2", + "Ordinal": 2, + "Description": "Yetkilendirme kararlarının temelini oluşturan değerlerdeki değişikliklerin hemen uygulandığı doğrulanmalıdır. Değişikliklerin anında uygulanamadığı durumlarda (örneğin self-contained token içindeki verilere güveniliyorsa), tüketici artık yetkili olmadığı hâlde bir işlem gerçekleştirdiğinde uyarı verecek ve değişikliği geri alacak önlemler uygulanmalıdır. Bu alternatifin bilgi sızıntısını önlemeyeceği unutulmamalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.3.3", + "Ordinal": 3, + "Description": "Bir nesneye erişimin, herhangi bir aracı veya onun adına hareket eden bir servis yerine yalnızca erişimi başlatan öznenin (ör. tüketici) izinlerine dayandığı doğrulanmalıdır. Örneğin, bir tüketici kimlik doğrulama için bir self-contained token kullanarak bir web servis çağırırsa ve bu servis başka bir servisten veri talep ederse, ikinci servis izin kararlarını verirken birinci servisin makine-makine token'ı yerine tüketicinin token'ını kullanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V8.4", + "Ordinal": 4, + "Name": "Diğer Yetkilendirme Hususları", + "Items": [ + { + "Shortcode": "V8.4.1", + "Ordinal": 1, + "Description": "Multi-tenant uygulamaların, tüketici işlemlerinin izinli olmadıkları tenant'lar üzerinde asla etkili olmamasını sağlamak için tenant'lar arası kontroller kullandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.4.2", + "Ordinal": 2, + "Description": "Yönetici arayüzlerine erişimin, sürekli tüketici kimlik doğrulaması, cihaz güvenlik durumu değerlendirmesi ve bağlamsal risk analizi dahil olmak üzere çok katmanlı güvenlik içerdiği doğrulanmalıdır. Yetkilendirme için yalnızca ağ konumu veya güvenilir uç noktalar yeterli olmamalıdır; ancak bu tür faktörler yetkisiz erişim olasılığını azaltabilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V9", + "Ordinal": 9, + "ShortName": "Self", + "Name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", + "Items": [ + { + "Shortcode": "V9.1", + "Ordinal": 1, + "Name": "Token Kaynağı ve Bütünlüğü", + "Items": [ + { + "Shortcode": "V9.1.1", + "Ordinal": 1, + "Description": "Self-contained token'ların içerikleri kabul edilmeden önce, oynama (tampering) saldırılarına karşı dijital imza veya MAC ile doğrulama yapıldığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.1.2", + "Ordinal": 2, + "Description": "Belirli bir bağlam için yalnızca bir allowlist üzerinde bulunan algoritmaların self-contained token oluşturmak ve doğrulamak için kullanılabildiği doğrulanmalıdır. Bu allowlist, yalnızca simetrik ya da yalnızca asimetrik algoritmaları içermeli ve kesinlikle 'None' algoritmasını içermemelidir. Hem simetrik hem de asimetrik algoritmalar desteklenmek zorundaysa, anahtar karışıklığını (key confusion) önlemek için ek kontroller uygulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.1.3", + "Ordinal": 3, + "Description": "Self-contained token'ları doğrulamak için kullanılan anahtar malzemesinin, token issuer için önceden yapılandırılmış güvenilir kaynaklardan alındığı doğrulanmalıdır. Bu, saldırganların güvenilmeyen kaynak ve anahtarları belirtmesini engeller. JWT ve diğer JWS yapılarında 'jku', 'x5u' ve 'jwk' gibi header'lar güvenilir kaynaklardan oluşan bir allowlist'e göre doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V9.2", + "Ordinal": 2, + "Name": "Token İçeriği", + "Items": [ + { + "Shortcode": "V9.2.1", + "Ordinal": 1, + "Description": "Token verisinde bir geçerlilik zaman aralığı (validity time span) varsa, yalnızca doğrulama zamanı bu zaman aralığı içerisindeyse token ve içeriği kabul edilmelidir. Örneğin, JWT'ler için 'nbf' ve 'exp' claim'leri doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.2.2", + "Ordinal": 2, + "Description": "Token'ı alan hizmetin, token içeriğini kabul etmeden önce bu token'ın doğru türde olduğunu ve sunulma amacına uygun olduğunu doğruladığı teyit edilmelidir. Örneğin, yalnızca erişim token'ları yetkilendirme kararları için, yalnızca ID Token'lar kullanıcı kimlik doğrulamasını kanıtlamak için kullanılabilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.2.3", + "Ordinal": 3, + "Description": "Hizmetin yalnızca kendisiyle kullanılması amaçlanan (audience) token'ları kabul ettiği doğrulanmalıdır. JWT'lerde bu, 'aud' claim'inin hizmet içinde tanımlı bir allowlist ile doğrulanması yoluyla sağlanabilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.2.4", + "Ordinal": 4, + "Description": "Eğer bir token issuer, farklı audience'lara token oluşturmak için aynı private key'i kullanıyorsa, oluşturulan token'ların hedef audience'ları benzersiz şekilde tanımlayan bir audience kısıtlaması içerdiği doğrulanmalıdır. Bu, bir token'ın farklı bir audience ile yeniden kullanılmasını önler. Audience tanımlayıcısı dinamik olarak sağlanıyorsa, token issuer bu audience'ları doğrulamalı ve audience taklitlerinin (impersonation) önüne geçmelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V10", + "Ordinal": 10, + "ShortName": "OAuth", + "Name": "OAuth ve OIDC", + "Items": [ + { + "Shortcode": "V10.1", + "Ordinal": 1, + "Name": "Genel OAuth ve OIDC Güvenliği", + "Items": [ + { + "Shortcode": "V10.1.1", + "Ordinal": 1, + "Description": "Token'ların yalnızca kesinlikle ihtiyaç duyan bileşenlere gönderildiği doğrulanmalıdır. Örneğin, tarayıcı tabanlı JavaScript uygulamaları için bir backend-for-frontend modeli kullanıldığında, access ve refresh token'lara yalnızca backend'in erişebilmesi gerekir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.1.2", + "Ordinal": 2, + "Description": "Authorization server'dan gelen değerler (örneğin authorization code veya ID Token gibi) yalnızca aynı user agent oturumu ve işlemi tarafından başlatılmış bir yetkilendirme akışının sonucuysa kabul edildiği doğrulanmalıdır. Bu, client tarafından oluşturulan secret’ların 'proof key for code exchange' (PKCE) ‘code_verifier’, ‘state’ veya OIDC ‘nonce’ gibi tahmin edilemez, işleme özgü ve hem client’a hem de işlem başlatılan user agent oturumuna güvenli bir şekilde bağlı olmasını gerektirir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.2", + "Ordinal": 2, + "Name": "OAuth İstemcisi", + "Items": [ + { + "Shortcode": "V10.2.1", + "Ordinal": 1, + "Description": "Code flow kullanılıyorsa, OAuth client’ın token taleplerini tetikleyen CSRF saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Bu genellikle PKCE kullanılarak veya authorization isteğinde gönderilen ‘state’ parametresinin kontrolü ile sağlanır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.2.2", + "Ordinal": 2, + "Description": "OAuth istemcisi birden fazla AS ile etkileşime girebiliyorsa, mix-up saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Örneğin, authorization server’ın 'iss' parametresini döndürmesi zorunlu kılınabilir ve bu parametrenin hem authorization yanıtında hem de token yanıtında doğrulanması gerekir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.2.3", + "Ordinal": 3, + "Description": "OAuth istemcisinin authorization server’a yaptığı taleplerde yalnızca gerekli scope’ları (veya diğer yetkilendirme parametrelerini) talep ettiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.3", + "Ordinal": 3, + "Name": "OAuth Kaynak Sunucusu (RS)", + "Items": [ + { + "Shortcode": "V10.3.1", + "Ordinal": 1, + "Description": "RS'nin yalnızca bu servisle kullanılmak üzere tasarlanmış access token’ları kabul ettiği doğrulanmalıdır (audience kontrolü). Audience bilgisi yapılandırılmış token’larda (örneğin JWT içindeki ‘aud’ claim’i) yer alabilir veya token introspection endpoint aracılığıyla kontrol edilebilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.3.2", + "Ordinal": 2, + "Description": "RS'nin, access token’dan gelen claim’lere dayanarak yetki devri tanımına uygun şekilde yetkilendirme kararları uyguladığı doğrulanmalıdır. ‘sub’, ‘scope’ ve ‘authorization_details’ gibi claim’ler varsa, bu kararın parçası olmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.3.3", + "Ordinal": 3, + "Description": "Erişim kontrolü kararında, access token’dan (JWT veya ilgili token introspection yanıtı) benzersiz bir kullanıcının tanımlanması gerekiyorsa, RS'nin başka kullanıcılara devredilemeyecek claim’ler ile kullanıcıyı tanımladığı doğrulanmalıdır. Genellikle bu, ‘iss’ ve ‘sub’ claim’lerinin birlikte kullanılması anlamına gelir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.3.4", + "Ordinal": 4, + "Description": "RS'nin belirli bir kimlik doğrulama gücü, yöntemi veya güncelliği (recentness) gerektirmesi durumunda, sunulan access token’ın bu kısıtlamaları karşıladığını doğruladığı, örneğin, OIDC ‘acr’, ‘amr’ ve ‘auth_time’ claim’leri kullanılarak doğrulanmalıdır. ", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.3.5", + "Ordinal": 5, + "Description": "RS'nin, (yetkisiz taraflarca) çalınmış veya tekrar edilen access token’ların kullanımını önlemek için sender-constrained access token’lar kullandığı doğrulanmalıdır. Bu, OAuth 2 için Mutual TLS veya OAuth 2 Demonstration of Proof of Possession (DPoP) ile sağlanabilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.4", + "Ordinal": 4, + "Name": "OAuth Yetkilendirme Sunucusu (AS)", + "Items": [ + { + "Shortcode": "V10.4.1", + "Ordinal": 1, + "Description": "AS'nin, istemciye özel önceden kaydedilmiş URI’lerden oluşan bir allowlist kullanarak redirect URI’leri tam dize karşılaştırması ile doğruladığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.2", + "Ordinal": 2, + "Description": "AS'nin, \"authorization response\" içinde \"authorization code\" döndürdüğü durumlarda, bu kodun yalnızca bir kez kullanılabildiği doğrulanmalıdır. Daha önce access token vermek için kullanılmış bir authorization code ile yapılan ikinci geçerli token isteği reddedilmeli ve ilgili tüm token’lar iptal edilmelidir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.3", + "Ordinal": 3, + "Description": "Authorization code’un kısa ömürlü olduğu doğrulanmalıdır. L1 ve L2 uygulamalar için maksimum yaşam süresi 10 dakika, L3 uygulamalar için 1 dakikadır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.4", + "Ordinal": 4, + "Description": "Belirli bir istemci için AS'nin yalnızca o istemcinin ihtiyaç duyduğu grant türlerine izin verdiği doğrulanmalıdır. \"Token\" (Implicit flow) ve \"password\" (Resource Owner Password Credentials flow) grant türlerinin artık kullanılmaması gerekir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.5", + "Ordinal": 5, + "Description": "AS'nin, açık istemciler için refresh token replay saldırılarını azalttığı doğrulanmalıdır. Tercihen sender-constrained refresh token’lar (DPoP veya mutual TLS ile certificate-bound access token’lar) kullanılmalıdır. L1 ve L2 uygulamalar için refresh token rotation kullanılabilir. Rotation kullanılıyorsa, AS refresh token’ı kullanım sonrası geçersiz kılmalı ve geçersiz bir refresh token sunulması durumunda o yetkilendirme ile ilişkili tüm refresh token’ları iptal etmelidir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.6", + "Ordinal": 6, + "Description": "Code grant kullanılıyorsa, AS'nin authorization code interception saldırılarına karşı koruma sağladığı doğrulanmalıdır. Yetkilendirme isteğinde geçerli bir \"code_challenge\" değeri zorunlu olmalı ve \"code_challenge_method\" olarak \"plain\" kabul edilmemelidir. Token isteğinde ise \"code_verifier\" parametresi doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.7", + "Ordinal": 7, + "Description": "AS'nin, kimlik doğrulaması yapılmamış dinamik istemci kaydını desteklemesi durumunda, kötü niyetli istemci uygulamalarına karşı riskleri azalttığı doğrulanmalıdır. Kayıtlı URI’ler gibi client metadata’sı doğrulanmalı, kullanıcı onayı alınmalı ve güvenilmeyen bir client uygulamasıyla yapılan yetkilendirme isteği işlenmeden önce kullanıcı uyarılmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.8", + "Ordinal": 8, + "Description": "Refresh token’ların, sliding expiration kullanılsa bile mutlak bir sona erme süresine sahip olduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.9", + "Ordinal": 9, + "Description": "Yetkili bir kullanıcı tarafından AS kullanıcı arayüzü üzerinden refresh token’ların ve reference access token’ların iptal edilebildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.10", + "Ordinal": 10, + "Description": "Gizli istemcilerin token istekleri, pushed authorization request (PAR) ve token iptal istekleri gibi server’a yapılan backchannel isteklerinde kimliğinin kontrol edildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.11", + "Ordinal": 11, + "Description": "AS yapılandırmasının, OAuth istemcisine yalnızca gerekli scope’ları atadığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.12", + "Ordinal": 12, + "Description": "Belirli bir client için, authorization server’ın yalnızca client’ın ihtiyaç duyduğu 'response_mode' değerine izin verdiği doğrulanmalıdır. Örneğin, bu değer ya beklenenlerle karşılaştırılarak doğrulanmalı ya da PAR veya JAR kullanılmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.13", + "Ordinal": 13, + "Description": "\"Code\" grant türünün daima pushed authorization request (PAR) ile birlikte kullanıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.14", + "Ordinal": 14, + "Description": "AS'nin yalnızca sender-constrained (Proof-of-Possession) access token’lar ürettiği doğrulanmalıdır. Bu, mutual TLS ile certificate-bound access token ya da DPoP ile DPoP-bound access token olabilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.15", + "Ordinal": 15, + "Description": "Sunucu taraflı istemciler için (kullanıcı cihazında çalışmayan), AS'nin \"authorization_details\" parametresinin istemci backend'i tarafından sağlandığını ve kullanıcı tarafından değiştirilmediğini doğruladığı, örneğin pushed authorization request (PAR) or JWT-secured Authorization Request (JAR) zorunlu kılınarak doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.16", + "Ordinal": 16, + "Description": "Bir istemci gizli ise, AS'nin güçlü istemci kimlik doğrulama yöntemlerini zorunlu kıldığı doğrulanmalıdır. Bu yöntemler, public-key cryptography’ye dayalı ve replay saldırılarına karşı dayanıklı olmalı, örneğin mutual TLS (\"tls_client_auth\", \"self_signed_tls_client_auth\") veya private key JWT (\"private_key_jwt\") gibi.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.5", + "Ordinal": 5, + "Name": "OIDC İstemcisi", + "Items": [ + { + "Shortcode": "V10.5.1", + "Ordinal": 1, + "Description": "İstemcinin (relying party olarak) ID Token replay saldırılarını azalttığı doğrulanmalıdır. Örneğin, ID Token’daki 'nonce' claim’inin, OpenID Provider’a gönderilen kimlik doğrulama isteğindeki 'nonce' değeriyle eşleştiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.5.2", + "Ordinal": 2, + "Description": "İstemcinin kullanıcıyı ID Token claim’lerinden (genellikle, başka kullanıcılarla yeniden atanamayan 'sub' claim’i) benzersiz şekilde tanımladığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.5.3", + "Ordinal": 3, + "Description": "İstemcinin, kötü niyetli bir AS'nin başka bir AS'yi taklit etmesini AS metadata’sı üzerinden reddettiği doğrulanmalıdır. AS metadata’sındaki issuer URL’si, istemci tarafından beklenen önceden yapılandırılmış issuer URL’siyle tam olarak eşleşmiyorsa, metadata reddedilmelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.5.4", + "Ordinal": 4, + "Description": "İstemcinin, ID Token’ın kendisi için (audience) kullanılması amaçlandığını doğruladığı doğrulanmalıdır. Bu, token’daki 'aud' claim’inin istemcinin 'client_id' değeriyle eşit olup olmadığının kontrol edilmesiyle yapılır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.5.5", + "Ordinal": 5, + "Description": "OIDC back-channel logout kullanıldığında, relying party’nin \"forced logout\" ve \"logout\" akışında \"cross-JWT confusion\" gibi saldırılara karşı koruma sağladığı doğrulanmalıdır. Client, logout token’ın 'logout+jwt' türünde olduğunu, 'event' claim’inin doğru üyeye sahip olduğunu ve 'nonce' claim’i içermediğini doğrulamalıdır. Ayrıca token için kısa bir sona erme süresi (örneğin 2 dakika) önerilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.6", + "Ordinal": 6, + "Name": "OpenID Provider", + "Items": [ + { + "Shortcode": "V10.6.1", + "Ordinal": 1, + "Description": "OpenID Provider’ın yalnızca 'code', 'ciba', 'id_token' veya 'id_token code' response mode değerlerine izin verdiği doğrulanmalıdır. 'code' değeri, 'id_token code' (OIDC Hybrid flow) yerine tercih edilmelidir. 'token' (Implicit flow) kullanılmamalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.6.2", + "Ordinal": 2, + "Description": "OpenID Provider’ın forced logout yoluyla yapılan hizmet reddi saldırılarını önlediği doğrulanmalıdır. Bu, son kullanıcıdan açık onay alınarak veya varsa logout isteğinde (relying party tarafından başlatılan) bulunan parametrelerin, örneğin 'id_token_hint', doğrulanmasıyla yapılabilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.7", + "Ordinal": 7, + "Name": "Onay (Consent) Yönetimi", + "Items": [ + { + "Shortcode": "V10.7.1", + "Ordinal": 1, + "Description": "AS'nin her yetkilendirme isteği için kullanıcının onayını aldığı doğrulanmalıdır. İstemcinin kimliği garanti altına alınamıyorsa, AS daima kullanıcıdan açıkça onay istemelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.7.2", + "Ordinal": 2, + "Description": "AS'nin kullanıcıdan onay istediğinde, neye onay verildiğini açık ve yeterli şekilde gösterdiği doğrulanmalıdır. Uygun olduğunda bu bilgiler, istenen yetkilendirmelerin doğasını (genellikle scope, resource server, RAR gibi detaylara dayalı), yetkilendirilmiş uygulamanın kimliğini ve bu yetkilendirmelerin süresini içermelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.7.3", + "Ordinal": 3, + "Description": "Kullanıcının, AS üzerinden verdiği onayları görüntüleyebildiği, değiştirebildiği ve iptal edebildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V11", + "Ordinal": 11, + "ShortName": "Cryptography", + "Name": "Kriptografi", + "Items": [ + { + "Shortcode": "V11.1", + "Ordinal": 1, + "Name": "Kriptografik Envanter ve Dokümantasyon", + "Items": [ + { + "Shortcode": "V11.1.1", + "Ordinal": 1, + "Description": "Kriptografik anahtarların yönetimi için belgelenmiş bir politika ve NIST SP 800-57 gibi bir anahtar yönetim standardını izleyen bir kriptografik anahtar yaşam döngüsü tanımlandığı doğrulanmalıdır. Bu, anahtarların aşırı miktarda paylaşılmadığını (örneğin, paylaşılan sırlar için ikiden fazla tarafla veya özel anahtarlar için birden fazla tarafla) garanti altına almalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.1.2", + "Ordinal": 2, + "Description": "Tüm kriptografik anahtarlar, algoritmalar ve uygulama tarafından kullanılan sertifikaları içeren bir kriptografik envanterin oluşturulduğu, sürdürüldüğü ve düzenli olarak güncellendiği doğrulanmalıdır. Bu envanter ayrıca, sistemde anahtarların nerede kullanılabileceğini ve kullanılamayacağını, ve hangi veri türlerinin bu anahtarlarla korunup korunamayacağını da belgelemelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.1.3", + "Ordinal": 3, + "Description": "Sistem içerisinde şifreleme, özetleme ve imzalama işlemleri dahil olmak üzere kriptografi kullanımının tüm örneklerini tespit etmek için kriptografik keşif mekanizmalarının kullanıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.1.4", + "Ordinal": 4, + "Description": "Kriptografik bir envanterin sürdürüldüğü doğrulanmalıdır. Bu envanter, gelecekteki tehditlere karşı tepki verebilmek amacıyla post-kuantum kriptografiye geçiş yolunu belirten belgelenmiş bir plan içermelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.2", + "Ordinal": 2, + "Name": "Güvenli Kriptografi Uygulaması", + "Items": [ + { + "Shortcode": "V11.2.1", + "Ordinal": 1, + "Description": "Kriptografik işlemler için sektör tarafından doğrulanmış uygulamaların (kütüphaneler ve donanım hızlandırmalı uygulamalar dahil) kullanıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.2.2", + "Ordinal": 2, + "Description": "Uygulamanın, rastgele sayı üreticileri, kimliği doğrulanmış şifreleme, MAC veya özetleme algoritmaları, anahtar uzunlukları, turlar, şifreler ve modların herhangi bir zamanda yeniden yapılandırılabilir, yükseltilebilir veya değiştirilebilir olacağı şekilde kripto çevikliği (crypto agility) ile tasarlandığı doğrulanmalıdır. Aynı şekilde, anahtarların ve parolaların değiştirilebilmesi ve verilerin yeniden şifrelenebilmesi mümkün olmalıdır. Bu, onaylanmış PQC şemalarının yüksek güvenlikli uygulamaları yaygın olarak kullanılabilir hale geldiğinde sorunsuz geçişe olanak tanır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.2.3", + "Ordinal": 3, + "Description": "Tüm kriptografik ilkeliklerin, algoritma, anahtar boyutu ve yapılandırmaya göre minimum 128 bit güvenlik sağladığı doğrulanmalıdır. Örneğin, 256-bit ECC anahtarı yaklaşık 128 bit güvenlik sağlarken, RSA için aynı güvenliği elde etmek 3072-bit anahtar gerektirir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.2.4", + "Ordinal": 4, + "Description": "Tüm kriptografik işlemlerin sabit süreli (constant-time) olduğu, karşılaştırmalarda, hesaplamalarda veya geri dönüşlerde kısa devre (short-circuit) işlemleri yapılmadığı doğrulanmalıdır; bu, bilgi sızıntısını önlemek için gereklidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.2.5", + "Ordinal": 5, + "Description": "Tüm kriptografik modüllerin güvenli şekilde hata verdiği ve hataların, padding oracle saldırıları gibi zafiyetleri mümkün kılmayacak şekilde ele alındığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.3", + "Ordinal": 3, + "Name": "Şifreleme Algoritmaları", + "Items": [ + { + "Shortcode": "V11.3.1", + "Ordinal": 1, + "Description": "Güvensiz blok modlarının (örneğin, ECB) ve zayıf doldurma (padding) şemalarının (örneğin, PKCS#1 v1.5) kullanılmadığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.3.2", + "Ordinal": 2, + "Description": "Yalnızca AES ile GCM gibi onaylı şifreleme algoritmalarının ve modlarının kullanıldığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.3.3", + "Ordinal": 3, + "Description": "Şifrelenmiş verilerin yetkisiz değişikliklere karşı korunduğu doğrulanmalıdır. Tercihen bu koruma, onaylı bir kimliği doğrulanmış şifreleme yöntemi kullanılarak ya da onaylı bir şifreleme yöntemi ile onaylı bir MAC algoritmasının kombinasyonu ile sağlanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.3.4", + "Ordinal": 4, + "Description": "Sayılar, başlatma vektörleri (IV) ve diğer tek kullanımlık değerlerin, aynı şifreleme anahtarı ve veri öğesi çifti için birden fazla kez kullanılmadığı doğrulanmalıdır. Oluşturma yöntemi kullanılan algoritmaya uygun olmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.3.5", + "Ordinal": 5, + "Description": "Şifreleme algoritması ve MAC algoritması kombinasyonlarının \"encrypt-then-MAC\" modunda çalıştığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.4", + "Ordinal": 4, + "Name": "Hashing ve Hash Tabanlı Fonksiyonlar", + "Items": [ + { + "Shortcode": "V11.4.1", + "Ordinal": 1, + "Description": "Dijital imzalar, HMAC, KDF ve rastgele bit üretimi gibi genel kriptografik kullanım senaryolarında yalnızca onaylı hash fonksiyonlarının kullanıldığı doğrulanmalıdır. MD5 gibi yasaklı hash fonksiyonları hiçbir kriptografik amaçla kullanılmamalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.4.2", + "Ordinal": 2, + "Description": "Parolaların, onaylı, hesaplama açısından yoğun ve mevcut rehberliğe göre yapılandırılmış bir anahtar türetme fonksiyonu (diğer adıyla parola hash'leme fonksiyonu) kullanılarak saklandığı doğrulanmalıdır. Ayarlar, güvenlik ve performans dengesini sağlayarak kaba kuvvet saldırılarını zorlaştırmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.4.3", + "Ordinal": 3, + "Description": "Dijital imzalarda kullanılan hash fonksiyonlarının, veri bütünlüğü ve kimlik doğrulama amacıyla kullanıldığında çakışmaya karşı dayanıklı ve yeterli bit uzunluğuna sahip olduğu doğrulanmalıdır. Çakışma dayanıklılığı gerekiyorsa çıktı uzunluğu en az 256 bit olmalıdır. Sadece ikinci ön-görüntü (2nd pre-iamge) saldırılarına karşı dayanıklılık gerekiyorsa çıktı uzunluğu en az 128 bit olmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.4.4", + "Ordinal": 4, + "Description": "Parolalardan gizli anahtarlar türetilirken, onaylı anahtar türetme fonksiyonlarının anahtar uzatma (key stretching) parametreleriyle birlikte kullanıldığı doğrulanmalıdır. Bu parametreler, kaba kuvvet saldırılarını önleyecek şekilde güvenlik ve performans dengesine sahip olmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.5", + "Ordinal": 5, + "Name": "Rastgele Değerler", + "Items": [ + { + "Shortcode": "V11.5.1", + "Ordinal": 1, + "Description": "Tahmin edilemez olması amaçlanan tüm rastgele sayıların ve dizelerin, CSPRNG ile oluşturulduğu ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. UUID'lerin bu koşulu dikkate almadığını unutmayın.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.5.2", + "Ordinal": 2, + "Description": "Kullanılan rastgele sayı üretim mekanizmasının, yoğun talep altında dahi güvenli çalışacak şekilde tasarlandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.6", + "Ordinal": 6, + "Name": "Açık Anahtar (Public Key) Kriptografisi", + "Items": [ + { + "Shortcode": "V11.6.1", + "Ordinal": 1, + "Description": "Anahtar üretimi, tohumlama (seeding) ve dijital imza üretimi ve doğrulama için yalnızca onaylı kriptografik algoritmalar ve çalışma modlarının kullanıldığı doğrulanmalıdır. Anahtar üretim algoritmaları, bilinen saldırılara karşı savunmasız anahtarlar üretmemelidir. Örneğin, Fermat çarpanlama yöntemine karşı savunmasız RSA anahtarları oluşturulmamalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.6.2", + "Ordinal": 2, + "Description": "Anahtar değişimi için yalnızca onaylı kriptografik algoritmaların kullanıldığı doğrulanmalıdır (örneğin Diffie-Hellman). Kullanılan parametrelerin güvenli olması gerektiğine dikkat edilmelidir. Bu, anahtar kurulum sürecine yönelik saldırıları önleyecek ve araya girme (adversary-in-the-middle) ya da kriptografik kırılmaları engelleyecektir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.7", + "Ordinal": 7, + "Name": "Kullanım Halindeki Verilerin Kriptografisi", + "Items": [ + { + "Shortcode": "V11.7.1", + "Ordinal": 1, + "Description": "Hassas verilerin kullanım sırasında korunmasını sağlamak amacıyla, yetkisiz kullanıcıların veya süreçlerin bu verilere erişmesini engelleyen tam bellek şifrelemesinin kullanıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.7.2", + "Ordinal": 2, + "Description": "Veri asgariyetinin sağlandığı, yani işleme sırasında mümkün olan en az miktarda verinin ortaya çıktığı ve verilerin kullanımdan hemen sonra veya mümkün olan en kısa sürede şifrelendiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V12", + "Ordinal": 12, + "ShortName": "Secure", + "Name": "Güvenli İletişim", + "Items": [ + { + "Shortcode": "V12.1", + "Ordinal": 1, + "Name": "Genel TLS Güvenlik Rehberi", + "Items": [ + { + "Shortcode": "V12.1.1", + "Ordinal": 1, + "Description": "Yalnızca TLS protokolünün en güncel ve önerilen sürümlerinin (örneğin TLS 1.2 ve TLS 1.3) etkinleştirildiği ve en son sürümün varsayılan olarak tercih edildiği doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.1.2", + "Ordinal": 2, + "Description": "Yalnızca önerilen şifre takımlarının (cipher suite) etkinleştirildiği ve en güçlü şifre takımlarının tercih edildiği doğrulanmalıdır. Seviye 3 (L3) uygulamalar yalnızca ileri gizlilik (forward secrecy) sağlayan şifre takımlarını desteklemelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.1.3", + "Ordinal": 3, + "Description": "Uygulamanın, mTLS istemci sertifikalarını kimlik doğrulama veya yetkilendirme amacıyla kullanmadan önce bu sertifikaların güvendiği sertifikalar arasında olduğunu doğruladığı kontrol edilmelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.1.4", + "Ordinal": 4, + "Description": "Online Certificate Status Protocol (OCSP) Stapling gibi geçerli bir sertifika iptal kontrolü yönteminin etkinleştirildiği ve yapılandırıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.1.5", + "Ordinal": 5, + "Description": "TLS el sıkışma (handshake) sürecinde Server Name Indication (SNI) gibi hassas meta verilerin ifşa edilmesini önlemek için, uygulamanın TLS yapılandırmasında Encrypted Client Hello (ECH) özelliğinin etkinleştirildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V12.2", + "Ordinal": 2, + "Name": "Dışa Açık Hizmetlerle HTTPS İletişimi", + "Items": [ + { + "Shortcode": "V12.2.1", + "Ordinal": 1, + "Description": "İstemci ile dışa açık, HTTP tabanlı hizmetler arasındaki tüm bağlantılarda TLS kullanıldığı ve bu bağlantıların güvensiz ya da şifrelenmemiş iletişime geri dönmediği doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.2.2", + "Ordinal": 2, + "Description": "Dışa açık hizmetlerin herkese açık olarak güvenilen TLS sertifikaları kullandığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V12.3", + "Ordinal": 3, + "Name": "Genel Servisler Arası İletişim Güvenliği", + "Items": [ + { + "Shortcode": "V12.3.1", + "Ordinal": 1, + "Description": "Uygulamaya gelen ve uygulamadan çıkan tüm bağlantılarda izleme sistemleri, yönetim araçları, uzaktan erişim ve SSH, ara yazılımlar, veritabanları, ana sistemler (mainframe), iş ortağı sistemleri ya da dış API'ler dahil olmak üzere TLS gibi şifreli bir protokolün kullanıldığı ve güvensiz ya da şifrelenmemiş protokollere geri dönülmediği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.3.2", + "Ordinal": 2, + "Description": "TLS istemcilerinin bir TLS sunucusu ile iletişime geçmeden önce alınan sertifikaları doğruladığı kontrol edilmelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.3.3", + "Ordinal": 3, + "Description": "Uygulama içindeki HTTP tabanlı iç hizmetler arasında gerçekleşen tüm bağlantılarda TLS ya da uygun başka bir aktarım şifreleme mekanizmasının kullanıldığı ve güvensiz ya da şifrelenmemiş iletişime geri dönülmediği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.3.4", + "Ordinal": 4, + "Description": "İç hizmetler arasındaki TLS bağlantılarında güvenilir sertifikaların kullanıldığı doğrulanmalıdır. İç sistemlerde oluşturulmuş ya da kendinden imzalı (self-signed) sertifikalar kullanılıyorsa, bu sertifikalara güvenen hizmetlerin yalnızca belirli dahili sertifika otoritelerine (CA) ve belirli kendinden imzalı sertifikalara güvenecek şekilde yapılandırıldıkları doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.3.5", + "Ordinal": 5, + "Description": "Sistem içindeki hizmetlerin birbiriyle iletişim kurarken her bir uç noktanın kimliğini doğrulamak için güçlü kimlik doğrulama yöntemlerinin kullanıldığı doğrulanmalıdır. Bu yöntemler arasında, açık anahtar altyapısı (public-key infrastructure) kullanan ve tekrar oynatma saldırılarına karşı dayanıklı olan TLS istemci kimlik doğrulaması gibi yöntemler yer almalıdır. Mikroservis mimarilerinde, sertifika yönetimini basitleştirmek ve güvenliği artırmak amacıyla bir servis ağı (service mesh) kullanılması değerlendirilmelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V13", + "Ordinal": 13, + "ShortName": "Configuration", + "Name": "Konfigürasyon", + "Items": [ + { + "Shortcode": "V13.1", + "Ordinal": 1, + "Name": "Konfigürasyon Dokümantasyonu", + "Items": [ + { + "Shortcode": "V13.1.1", + "Ordinal": 1, + "Description": "Uygulamanın tüm iletişim ihtiyaçlarının dokümante edildiği doğrulanmalıdır. Buna, uygulamanın bağımlı olduğu dış hizmetler ve son kullanıcının uygulamanın bağlantı kurmasını sağlayabileceği dış konumlar da dahil olmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.1.2", + "Ordinal": 2, + "Description": "Uygulamanın kullandığı her bir hizmet için, dokümantasyonda eşzamanlı bağlantı sayısı (örn. bağlantı havuzu limitleri) ve bu sınır aşıldığında uygulamanın davranışı, geri dönüş veya kurtarma mekanizmaları da dahil olmak üzere hizmet reddi koşullarını önlemek için tanımlandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.1.3", + "Ordinal": 3, + "Description": "Uygulamanın, kullandığı her bir dış sistem veya hizmet (örn. veritabanları, dosya tanıtıcıları, iş parçacıkları, HTTP bağlantıları) için kaynak yönetimi stratejilerini tanımladığı doğrulanmalıdır. Bu stratejiler, kaynak serbest bırakma prosedürlerini, zaman aşımı ayarlarını, hata durumlarını ve tekrar deneme mantığı uygulanmışsa sınırları, gecikmeleri ve geri çekilme (back-off) algoritmalarını içermelidir. Senkron HTTP istek–yanıt işlemleri için kısa zaman aşımı süreleri zorunlu tutulmalı ve tekrar eden denemeler devre dışı bırakılmalı ya da sıkı şekilde sınırlandırılmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.1.4", + "Ordinal": 4, + "Description": "Uygulamanın, güvenlik açısından kritik olan gizli verileri tanımladığı ve kuruluşun tehdit modeli ve iş ihtiyaçlarına göre bu verilerin döndürülme (rotation) zamanlamasının belgelendiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V13.2", + "Ordinal": 2, + "Name": "Backend İletişim Konfigürasyonu", + "Items": [ + { + "Shortcode": "V13.2.1", + "Ordinal": 1, + "Description": "Uygulamanın, standart kullanıcı oturum mekanizmasını desteklemeyen backend bileşenleri (örneğin API'ler, ara katmanlar, veri katmanları) arasında gerçekleşen iletişimlerin kimlik doğrulamasıyla korunduğu doğrulanmalıdır. Kimlik doğrulama; bireysel hizmet hesapları, kısa ömürlü token'lar ya da sertifika tabanlı kimlik doğrulama ile yapılmalıdır ve parola, API anahtarı ya da ayrıcalıklı erişime sahip paylaşımlı hesaplar gibi sabit kimlik bilgileri kullanılmamalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.2", + "Ordinal": 2, + "Description": "Uygulamanın backend bileşenleri arasında (yerel hizmetler, işletim sistemi hizmetleri, API'ler, ara katmanlar ve veri katmanları dahil) gerçekleştirilen iletişimlerin, yalnızca gerekli en az ayrıcalığa sahip hesaplarla yapıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.3", + "Ordinal": 3, + "Description": "Bir hizmet kimlik doğrulaması için bir kimlik bilgisi kullanılması gerekiyorsa, bu kimlik bilgisinin varsayılan bir değer (örneğin root/root veya admin/admin) olmadığının doğrulanması gereklidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.4", + "Ordinal": 4, + "Description": "Uygulamanın iletişim kurmasına izin verilen dış kaynaklar ya da sistemlerin, bir allowlist (izinli liste) ile tanımlandığı doğrulanmalıdır. Bu liste, uygulama katmanında, web sunucusunda, güvenlik duvarında veya farklı katmanların birleşiminde uygulanabilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.5", + "Ordinal": 5, + "Description": "Web veya uygulama sunucusunun, dış sistemlere veri veya dosya gönderimi veya yüklemesi yaparken sadece belirli kaynaklara izin verecek şekilde allowlist ile yapılandırıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.6", + "Ordinal": 6, + "Description": "Uygulamanın farklı hizmetlere bağlantı kurduğu durumlarda, bu bağlantılar için belgelenmiş yapılandırmaları (örn. maksimum eşzamanlı bağlantı, bağlantı limiti aşıldığında davranış, zaman aşımı, tekrar deneme stratejileri) takip ettiğinin doğrulanması gereklidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V13.3", + "Ordinal": 3, + "Name": "Gizli Bilgi Yönetimi", + "Items": [ + { + "Shortcode": "V13.3.1", + "Ordinal": 1, + "Description": "Parolalar, anahtar materyalleri, veritabanı ve üçüncü parti sistemlerle entegrasyon bilgileri, zaman tabanlı token'lar için tohum (seed) bilgileri, dahili gizli veriler ve API anahtarları gibi backend sırlarının güvenli bir şekilde oluşturulması, saklanması, erişim denetiminin sağlanması ve imha edilmesi için bir gizli bilgi yönetim çözümünün (örneğin key vault) kullanıldığı doğrulanmalıdır. Bu gizli bilgiler uygulama kaynak koduna dahil edilmemeli ve yapı çıktılarında yer almamalıdır. Seviye 3 uygulamalar için donanım destekli bir çözüm (örneğin HSM) gereklidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.3.2", + "Ordinal": 2, + "Description": "Gizli bilgilere erişimin en az ayrıcalık prensibine uygun şekilde yapılandırıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.3.3", + "Ordinal": 3, + "Description": "Tüm kriptografik işlemlerin, anahtar materyallerinin güvenli bir şekilde yönetilmesi ve dışarıya sızmasının engellenmesi amacıyla, izole edilmiş bir güvenlik modülü (örneğin vault ya da donanım güvenlik modülü) aracılığıyla gerçekleştirildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.3.4", + "Ordinal": 4, + "Description": "Uygulamanın belgelerinde belirtildiği şekilde gizli bilgilerin süresinin dolacak şekilde yapılandırıldığı ve düzenli olarak döndürüldüğü doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V13.4", + "Ordinal": 4, + "Name": "İstenmeyen Bilgi Sızıntısı", + "Items": [ + { + "Shortcode": "V13.4.1", + "Ordinal": 1, + "Description": "Uygulamanın .git veya .svn klasörleri gibi kaynak kontrolüyle ilgili metadata içermeyecek şekilde deploy edildiğini ya da bu klasörlerin hem dış erişime hem de uygulama erişimine kapalı olduğu doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.2", + "Ordinal": 2, + "Description": "Tüm bileşenler için üretim ortamlarında hata ayıklama (debug) modlarının devre dışı bırakıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.3", + "Ordinal": 3, + "Description": "Web sunucularının, açık şekilde istenmediği sürece dizin listelemesi (directory listing) özelliğini istemcilere sunmadığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.4", + "Ordinal": 4, + "Description": "HTTP TRACE metodunun üretim ortamlarında desteklenmediği, böylece potansiyel bilgi sızıntılarının önlendiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.5", + "Ordinal": 5, + "Description": "Belgeler (örneğin dahili API belgeleri) ve izleme uç noktalarının (monitoring endpoints) yalnızca açıkça belirtildiği durumlarda erişilebilir olduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.6", + "Ordinal": 6, + "Description": "Uygulamanın arka uç bileşenlerinin ayrıntılı sürüm bilgilerini ifşa etmediği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.7", + "Ordinal": 7, + "Description": "Web katmanının yalnızca belirli dosya uzantılarına sahip dosyaları sunacak şekilde yapılandırıldığı, bu sayede istem dışı bilgi, yapılandırma ya da kaynak kod sızıntılarının önlendiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V14", + "Ordinal": 14, + "ShortName": "Data", + "Name": "Veri Koruma", + "Items": [ + { + "Shortcode": "V14.1", + "Ordinal": 1, + "Name": "Veri Koruma Dokümantasyonu", + "Items": [ + { + "Shortcode": "V14.1.1", + "Ordinal": 1, + "Description": "Uygulama tarafından oluşturulan ve işlenen tüm hassas verilerin tanımlanıp, koruma seviyelerine göre sınıflandırıldığından emin olun. Bu, yalnızca kodlanmış (örneğin Base64 stringleri ya da JWT içindeki düz metin yükler gibi) ve bu nedenle kolayca çözülebilir verileri de içermelidir. Koruma seviyeleri, uygulamanın uymakla yükümlü olduğu veri koruma ve gizlilik düzenlemeleri ile standartlarını dikkate almalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.1.2", + "Ordinal": 2, + "Description": "Tüm hassas veri koruma seviyeleri için belgelenmiş bir koruma gereksinimleri seti tanımlandığından emin olun. Bu gereksinimler genel şifreleme, bütünlük doğrulama, saklama süresi, verinin nasıl günlüğe kaydedileceği, günlüklerdeki hassas verilere erişim kontrolleri, veritabanı düzeyinde şifreleme, gizlilik ve gizliliği artırıcı teknolojiler ile diğer gizlilik gereksinimlerini kapsamalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V14.2", + "Ordinal": 2, + "Name": "Genel Veri Koruması", + "Items": [ + { + "Shortcode": "V14.2.1", + "Ordinal": 1, + "Description": "Hassas verilerin yalnızca HTTP message body veya header alanlarında sunucuya gönderildiği ve URL ile sorgu parametrelerinin, API anahtarı veya session token’ı gibi hassas bilgiler içermediği doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.2", + "Ordinal": 2, + "Description": "Hassas verilerin, yük dengeleyiciler ve uygulama önbellekleri gibi sunucu bileşenlerinde önbelleğe alınmasının engellendiği veya kullanım sonrası bu verilerin güvenli biçimde temizlendiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.3", + "Ordinal": 3, + "Description": "Uygulama kontrolü dışında veri toplanmasını engellemek için, tanımlanmış hassas verilerin, kullanıcı izleyicileri gibi güvensiz taraflara gönderilmediği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.4", + "Ordinal": 4, + "Description": "Hassas verilere yönelik şifreleme, bütünlük doğrulama, veri saklama, loglama yöntemi, loglardaki erişim kontrolleri, gizlilik teknolojileri gibi kontrollerin, söz konusu verinin belgelenmiş koruma seviyesinde tanımlandığı şekilde uygulandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.5", + "Ordinal": 5, + "Description": "Önbellekleme mekanizmalarının yalnızca belirli içerik türüne sahip yanıtları önbelleğe alacak şekilde yapılandırıldığı ve hassas, dinamik içeriklerin önbelleğe alınmadığı doğrulanmalıdır. Web sunucusu, mevcut olmayan bir dosya talebinde geçerli ama farklı bir dosya döndürmek yerine 404 veya 302 cevabı vermelidir. Bu, Web Cache Deception saldırılarını önlemeye yardımcı olur.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.6", + "Ordinal": 6, + "Description": "Uygulamanın yalnızca işlevsellik için gerekli olan asgari hassas veriyi döndürdüğü doğrulanmalıdır. Örneğin, kredi kartı numarasının yalnızca bazı rakamlarının döndürülmesi; tam numaranın döndürülmesi gerekiyorsa, kullanıcı arayüzünde gizlenmiş (maskelenmiş) şekilde sunulması gerekir, aksi kullanıcı özel olarak görüntülemek istemedikçe gösterilmemelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.7", + "Ordinal": 7, + "Description": "Hassas bilgilerin, veri saklama sınıflandırmasına tabi tutulduğu, geçerliliğini yitirmiş veya artık gerekli olmayan verilerin belirlenmiş bir zaman çizelgesiyle ya da gerektiğinde otomatik olarak silindiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.8", + "Ordinal": 8, + "Description": "Kullanıcı tarafından yüklenen dosyaların meta verilerinden hassas bilgilerin çıkarıldığı veya bu bilgilerin yalnızca kullanıcıdan açık onay alındığında saklandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V14.3", + "Ordinal": 3, + "Name": "İstemci Tarafı Veri Koruması", + "Items": [ + { + "Shortcode": "V14.3.1", + "Ordinal": 1, + "Description": "Kimliği doğrulanmış verilerin, istemci veya oturum sonlandığında istemci depolamasından (örneğin tarayıcı DOM’undan) temizlendiği doğrulanmalıdır. 'Clear-Site-Data' HTTP response header bu konuda yardımcı olabilir ancak istemci tarafı, sunucu bağlantısı mevcut olmadığında da temizlik işlemini yapabiliyor olmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.3.2", + "Ordinal": 2, + "Description": "Uygulamanın, tarayıcılarda hassas verilerin önbelleğe alınmasını önlemek amacıyla yeterli anti-önbellekleme HTTP response header (örneğin Cache-Control: no-store) ayarladığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.3.3", + "Ordinal": 3, + "Description": "Tarayıcıda depolanan verilerin (örneğin localStorage, sessionStorage, IndexedDB veya çerezler) hassas veri içermediği, yalnızca session token’larının istisna olarak kabul edildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V15", + "Ordinal": 15, + "ShortName": "Secure", + "Name": "Güvenli Kodlama ve Mimari", + "Items": [ + { + "Shortcode": "V15.1", + "Ordinal": 1, + "Name": "Güvenli Kodlama ve Mimari Dokümantasyonu", + "Items": [ + { + "Shortcode": "V15.1.1", + "Ordinal": 1, + "Description": "Güvenlik açığı içeren üçüncü taraf bileşen sürümleri ve genel olarak kütüphane güncellemeleri için, uygulama dokümantasyonunda risk bazlı düzeltme zamanlarının tanımlandığı doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.1.2", + "Ordinal": 2, + "Description": "Yazılım bileşen listesi (Software Bill of Materials - SBOM) gibi bir envanterin tutulduğu, kullanılan tüm üçüncü taraf kütüphanelerin önceden tanımlanmış, güvenilir ve düzenli olarak güncellenen depolardan alındığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.1.3", + "Ordinal": 3, + "Description": "Uygulama dokümantasyonunda zaman veya kaynak açısından yoğun işlevlerin tanımlandığı, bu işlevlerin aşırı kullanımı durumunda kullanılabilirlik kaybının nasıl önleneceği ve yanıt oluşturma süresinin istemci zaman aşımını aşmaması için hangi önlemlerin alındığı belirtilmelidir. Örnek savunmalar kuyruklama, eşzamansız işleme, kullanıcı başına ve uygulama genelinde paralel işlem sınırlarını içerebilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.1.4", + "Ordinal": 4, + "Description": "Uygulama dokümantasyonunda \"riskli bileşenler\" olarak değerlendirilen üçüncü taraf kütüphanelerin vurgulandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.1.5", + "Ordinal": 5, + "Description": "Uygulama dokümantasyonunda \"tehlikeli işlevsellik\" içeren uygulama bölümlerinin açıkça belirtildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V15.2", + "Ordinal": 2, + "Name": "Güvenlik Mimarisi ve Bağımlılıklar", + "Items": [ + { + "Shortcode": "V15.2.1", + "Ordinal": 1, + "Description": "Uygulamanın yalnızca, belgelenmiş güncelleme ve düzeltme sürelerini aşmamış bileşenleri içerdiği doğrulanmalıdır.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.2.2", + "Ordinal": 2, + "Description": "Uygulamanın, belgelenmiş güvenlik kararları ve stratejilere dayanarak, zaman veya kaynak açısından yoğun işlevlerin neden olabileceği kullanılabilirlik kaybına karşı savunmalar uyguladığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.2.3", + "Ordinal": 3, + "Description": "Üretim ortamının yalnızca uygulamanın çalışması için gerekli işlevleri içerdiği ve test kodları, örnek kod parçaları veya geliştirme işlevleri gibi gereksiz işlevsellikleri açığa çıkarmadığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.2.4", + "Ordinal": 4, + "Description": "Üçüncü taraf bileşenlerin ve bunların tüm transitif bağımlılıklarının beklenen depolardan (iç kaynaklı ya da harici) alındığı ve bağımlılık karışıklığı (dependency confusion) saldırılarına açık olmadığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.2.5", + "Ordinal": 5, + "Description": "Uygulamanın, “tehlikeli işlevsellik” içeren veya “riskli bileşenler” kullanan bölümlerine ek korumalar uyguladığı doğrulanmalıdır. Bu korumalar sandbox, kapsülleme, konteynerleştirme veya ağ düzeyinde izolasyon gibi teknikler aracılığıyla, bir uygulama bölümünün ele geçirilmesi durumunda saldırganın diğer bölümlere sıçramasını geciktirmeyi veya engellemeyi amaçlamalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V15.3", + "Ordinal": 3, + "Name": "Savunmacı Kodlama", + "Items": [ + { + "Shortcode": "V15.3.1", + "Ordinal": 1, + "Description": "Uygulamanın yalnızca gerekli alanların bir alt kümesini veri nesnesinden döndürdüğü doğrulanmalıdır. Örneğin, bazı alanlara kullanıcıların erişmemesi gerektiğinden tüm veri nesnesi döndürülmemelidir.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.2", + "Ordinal": 2, + "Description": "Uygulama backend'i harici URL’lere çağrı yaptığında, yalnızca amaçlanan işlevsellik söz konusuysa yönlendirmeleri takip edecek şekilde yapılandırıldığının doğrulanması gerekir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.3", + "Ordinal": 3, + "Description": "Uygulamanın, kitlesel atama saldırılarına karşı, her bir controller ve eylem için izin verilen alanları sınırlandırarak savunmalar sağladığı doğrulanmalıdır. Örneğin, bir alan değeri, bu işlemde değiştirilmesi amaçlanmadıysa eklenememeli veya güncellenememelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.4", + "Ordinal": 4, + "Description": "Tüm proxy ve ara katman bileşenlerinin kullanıcının orijinal IP adresini, uç kullanıcı tarafından değiştirilemeyecek güvenilir veri alanları kullanarak doğru şekilde ilettiği ve uygulamanın ve web sunucusunun bu doğru değeri, loglama ve hız sınırlama gibi güvenlik kararları için kullandığı doğrulanmalıdır. Ayrıca, orijinal IP adresinin bile dinamik IP'ler, VPN'ler veya kurumsal güvenlik duvarları nedeniyle güvenilir olmayabileceği dikkate alınmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.5", + "Ordinal": 5, + "Description": "Uygulamanın değişkenlerin doğru türde olduğunu açıkça doğruladığı ve sıkı eşitlik ve karşılaştırma işlemleri kullandığı doğrulanmalıdır. Bu, değişken türüyle ilgili varsayımlardan kaynaklanan tür oynama (type juggling) veya tür karışıklığı (type confusion) güvenlik açıklarını önlemek içindir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.6", + "Ordinal": 6, + "Description": "JavaScript kodunun prototip zehirleme (prototype pollution) saldırılarını önleyecek şekilde yazıldığı, örneğin, nesne literal’leri yerine Set() veya Map() gibi yapılar kullanıldığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.7", + "Ordinal": 7, + "Description": "Uygulamanın, özellikle framework'ün istek parametrelerinin kaynağı (sorgu dizgisi, gövde parametreleri, çerezler veya başlık alanları) arasında ayrım yapmadığı durumlarda, HTTP parametre kirliliği (HTTP parameter pollution) saldırılarına karşı savunmalar uyguladığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V15.4", + "Ordinal": 4, + "Name": "Güvenli Eş Zamanlılık (Concurrency)", + "Items": [ + { + "Shortcode": "V15.4.1", + "Ordinal": 1, + "Description": "Çok iş parçacıklı kodda (örneğin cache'ler, dosyalar veya birden fazla iş parçacığı tarafından erişilen bellek içi nesneler gibi) paylaşılan nesnelere yalnızca thread-safe (iş parçacığı güvenli) türler ve kilitleme (lock) veya semaphore gibi senkronizasyon mekanizmaları kullanılarak erişildiği doğrulanmalıdır. Bu, yarış durumlarını ve veri bozulmasını önlemeye yöneliktir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.4.2", + "Ordinal": 2, + "Description": "Bir kaynağın durumu üzerindeki kontroller (örneğin varlığı ya da izinleri gibi) ile bu kontrole bağlı eylemlerin tek bir atomik işlem olarak gerçekleştirildiği doğrulanmalıdır. Bu, TOCTOU (time-of-check to time-of-use) yarış durumlarını önlemeye yöneliktir. Bir dosyanın varlığının kontrol edilip ardından açılması veya bir kullanıcının erişiminin doğrulanıp ardından yetki verilmesi gibi işlemler buna örnektir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.4.3", + "Ordinal": 3, + "Description": "Kilitlerin (locks) tutarlı biçimde kullanıldığı, iş parçacıklarının birbirini beklemesi ya da sonsuz döngüye girmesi (deadlock veya livelock) gibi durumların önlendiği doğrulanmalıdır. Ayrıca, kilitleme mantığı, kaynağı yöneten kod içinde kalmalı ve dış sınıflar veya dış kodlar tarafından istemeden veya kötü niyetli şekilde değiştirilememelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.4.4", + "Ordinal": 4, + "Description": "Kaynak tahsis politikalarının, iş parçacığı açlığını önleyecek şekilde, kaynaklara adil erişimi sağladığı doğrulanmalıdır. Örneğin, thread pool (iş parçacığı havuzu) kullanımı, düşük öncelikli iş parçacıklarının da makul sürelerde çalışabilmesi için uygulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V16", + "Ordinal": 16, + "ShortName": "Security", + "Name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", + "Items": [ + { + "Shortcode": "V16.1", + "Ordinal": 1, + "Name": "Güvenlik Loglaması Dokümantasyonu", + "Items": [ + { + "Shortcode": "V16.1.1", + "Ordinal": 1, + "Description": "Uygulamanın teknoloji yığını boyunca her katmanda hangi olayların loglandığını, log formatlarını, logların nereye yazıldığını, nasıl kullanıldığını, erişimin nasıl kontrol edildiğini ve logların ne kadar süre saklandığını belgeleyen bir envanterin mevcut olduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V16.2", + "Ordinal": 2, + "Name": "Genel Loglama", + "Items": [ + { + "Shortcode": "V16.2.1", + "Ordinal": 1, + "Description": "Her bir log girdisinin, olayın ne zaman, nerede, kim tarafından ve ne olduğuna dair detaylı bir zaman çizelgesi oluşturulmasına olanak tanıyacak gerekli meta verileri içerdiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.2.2", + "Ordinal": 2, + "Description": "Tüm loglama bileşenlerinin zaman kaynaklarının senkronize olduğu ve güvenlik olayı meta verisindeki zaman damgalarının UTC kullanarak ya da açık zaman dilimi ofsetiyle belirtildiği doğrulanmalıdır. UTC kullanımı, özellikle yaz saati uygulamaları nedeniyle oluşabilecek karışıklıkları önlemek için tavsiye edilir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.2.3", + "Ordinal": 3, + "Description": "Uygulamanın yalnızca log envanterinde belgelenmiş dosya ve hizmetlere log yazdığı ya da ilettiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.2.4", + "Ordinal": 4, + "Description": "Logların kullanılan log işleyici (log processor) tarafından okunabildiği ve ilişkilendirilebildiği doğrulanmalıdır. Tercihen yaygın bir log formatı kullanılmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.2.5", + "Ordinal": 5, + "Description": "Hassas veriler loglanırken, uygulamanın veri koruma seviyesine uygun olarak loglama yaptığı doğrulanmalıdır. Örneğin kimlik bilgileri veya ödeme detayları gibi bazı verilerin loglanmasına izin verilmemelidir. Session token’ları gibi veriler ise yalnızca tamamen ya da kısmen maskelenmiş ya da hash’lenmiş olarak loglanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V16.3", + "Ordinal": 3, + "Name": "Güvenlik Olayları", + "Items": [ + { + "Shortcode": "V16.3.1", + "Ordinal": 1, + "Description": "Tüm kimlik doğrulama işlemlerinin (başarılı ve başarısız girişimler dahil) loglandığı doğrulanmalıdır. Kullanılan kimlik doğrulama türü veya faktörleri gibi ek meta veriler de toplanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.3.2", + "Ordinal": 2, + "Description": "Başarısız yetkilendirme girişimlerinin loglandığı doğrulanmalıdır. Seviye 3 uygulamalar için, tüm yetkilendirme kararlarının ve hassas verilere erişim olaylarının (verinin kendisi olmadan) loglandığı da doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.3.3", + "Ordinal": 3, + "Description": "Uygulamanın, belgelenmiş güvenlik olaylarını ve güvenlik kontrollerini aşma girişimlerini (girdi doğrulama, iş mantığı, otomasyon karşıtı kontroller vb.) logladığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.3.4", + "Ordinal": 4, + "Description": "Beklenmeyen hatalar ve güvenlik kontrolü başarısızlıkları (örneğin backend TLS hataları gibi) loglandığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V16.4", + "Ordinal": 4, + "Name": "Log Koruması", + "Items": [ + { + "Shortcode": "V16.4.1", + "Ordinal": 1, + "Description": "Tüm loglama bileşenlerinin, log enjeksiyonunu (log injection) önlemek amacıyla verileri uygun biçimde encode ettiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.4.2", + "Ordinal": 2, + "Description": "Logların yetkisiz erişime karşı korunduğu ve değiştirilemez olduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.4.3", + "Ordinal": 3, + "Description": "Logların analiz, tespit, uyarı ve yükseltme amacıyla mantıksal olarak ayrı bir sisteme güvenli biçimde iletildiği doğrulanmalıdır. Böylece uygulama ihlal edilse bile logların tehlikeye girmesi önlenmiş olur.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V16.5", + "Ordinal": 5, + "Name": "Hata Yönetimi", + "Items": [ + { + "Shortcode": "V16.5.1", + "Ordinal": 1, + "Description": "Beklenmedik ya da güvenlikle ilgili bir hata oluştuğunda, tüketiciye genel bir mesaj döndürüldüğü ve yığın izleri (stack trace), sorgular, gizli anahtarlar, token’lar gibi hassas sistem içi verilerin açıklanmadığı doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.5.2", + "Ordinal": 2, + "Description": "Uygulamanın, dış kaynaklara erişim başarısız olduğunda bile güvenli şekilde çalışmaya devam ettiği doğrulanmalıdır. Örneğin, circuit breaker ya da graceful degradation gibi desenler kullanılmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.5.3", + "Ordinal": 3, + "Description": "Uygulamanın hata durumlarında güvenli ve düzenli şekilde başarısız olduğu doğrulanmalıdır. Bu, örneğin doğrulama hatalarına rağmen işlemlerin işlenmesine yol açabilecek fail-open durumlarını önlemelidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.5.4", + "Ordinal": 4, + "Description": "Ele alınmamış tüm istisnaları yakalayacak şekilde tanımlanmış bir “son çare hata yöneticisi” bulunduğu doğrulanmalıdır. Bu, hem loglara gitmesi gereken hata detaylarının kaybolmaması hem de tüm uygulama sürecinin çökerek hizmet dışı kalmasının önlenmesi açısından önemlidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V17", + "Ordinal": 17, + "ShortName": "WebRTC", + "Name": "WebRTC", + "Items": [ + { + "Shortcode": "V17.1", + "Ordinal": 1, + "Name": "TURN Sunucusu", + "Items": [ + { + "Shortcode": "V17.1.1", + "Ordinal": 1, + "Description": "TURN hizmetinin yalnızca özel amaçlar için ayrılmamış IP adreslerine (ör. iç ağlar, yayın adresleri, loopback) erişime izin verdiği doğrulanmalıdır. Bu gereksinim hem IPv4 hem de IPv6 adresleri için geçerlidir.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.1.2", + "Ordinal": 2, + "Description": "TURN hizmetinin, meşru kullanıcıların sunucuda çok sayıda bağlantı noktası açmaya çalışması durumunda kaynak tüketimi saldırılarına karşı dayanıklı olduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V17.2", + "Ordinal": 2, + "Name": "Medya", + "Items": [ + { + "Shortcode": "V17.2.1", + "Ordinal": 1, + "Description": "DTLS sertifikası anahtarının, belgelenmiş kriptografik anahtar yönetim politikasına uygun şekilde yönetildiği ve korunduğu doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.2", + "Ordinal": 2, + "Description": "Medya sunucusunun onaylı DTLS şifre takımlarını (cipher suites) ve Güvenli Gerçek Zamanlı Aktarım Protokolü (Secure Real-time Transport Protocol - SRTP) için anahtarlar oluşturmaya yönelik DTLS Uzantısı için güvenli bir koruma profilini kullanacak ve destekleyecek şekilde yapılandırıldığı (DTLS-SRTP) doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.3", + "Ordinal": 3, + "Description": "Real-time Transport Protocol (RTP) injection saldırılarının bir hizmet reddi durumuna veya medya akışlarına ses veya video medyası eklenmesine yol açmasını önlemek için medya sunucusunda Güvenli SRTP kimlik doğrulamasının kontrol edildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.4", + "Ordinal": 4, + "Description": "Verify that the media server is able to continue processing incoming media traffic when encountering malformed Secure Real-time Transport Protocol (SRTP) packets.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.5", + "Ordinal": 5, + "Description": "Medya sunucusunun, meşru kullanıcılardan gelen SRTP flood'ı sırasında gelen medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.6", + "Ordinal": 6, + "Description": "Medya sunucusunun DTLS içinde yer alan \"ClientHello\" yarış durumu güvenlik açığına karşı savunmasız olmadığı, medya sunucusunun güvenlik açığına sahip olduğunun açıkça bilinip bilinmediği kontrol edilerek veya yarış koşulu testi gerçekleştirilerek doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.7", + "Ordinal": 7, + "Description": "Medya sunucusuna bağlı ses veya video kayıt mekanizmalarının, meşru kullanıcı kaynaklı SRTP flood'ı sırasında medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.8", + "Ordinal": 8, + "Description": "DTLS sertifikasının, SDP (Session Description Protocol) fingerprint özelliği ile karşılaştırıldığı ve doğrulama başarısız olursa medya akışının sonlandırıldığı, medya akışının özgünlüğünü sağlamak için doğrulanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V17.3", + "Ordinal": 3, + "Name": "Sinyalizasyon", + "Items": [ + { + "Shortcode": "V17.3.1", + "Ordinal": 1, + "Description": "Sinyalizasyon sunucusunun, flood saldırısı altında bile meşru sinyalizasyon mesajlarını işlemeye devam edebildiği doğrulanmalıdır. Bu, sinyalizasyon düzeyinde oran sınırlaması uygulanarak sağlanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.3.2", + "Ordinal": 2, + "Description": "Sinyalizasyon sunucusunun, hizmet reddine yol açabilecek şekilde yapılandırılmış bozuk sinyalizasyon mesajlarıyla karşılaştığında bile meşru mesajları işlemeye devam edebildiği doğrulanmalıdır. Bu, girdi doğrulaması, integer overflow ve buffer overflow'a karşı savunma ve sağlam hata işleme teknikleri ile sağlanmalıdır.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + } + ] +} diff --git a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.xml b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.xml new file mode 100644 index 0000000000..cfd57f8eca --- /dev/null +++ b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.xml @@ -0,0 +1 @@ +Application Security Verification Standard ProjectASVSThe OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.V11EncodingKodlama (Encoding) ve TemizlemeV1.11Kodlama ve Temizleme MimarisiV1.1.11Girdinin yalnızca bir kez kanonik forma (canonical form) çözümlendiği veya kaçış işlemlerinin kaldırıldığı, bu işlemin yalnızca verinin bu biçimde beklenmesi durumunda yapıldığı ve bu işlemin girdi doğrulama veya temizleme işlemlerinden sonra değil, önce gerçekleştiği doğrulanmalıdır.FalseTrue✓True✓V1.1.22Uygulamanın, çıktıyı kullanılması gereken yorumlayıcıya verilmeden hemen önce veya yorumlayıcının kendisi tarafından çıktı kodlaması ya da kaçış işlemi yaptığı doğrulanmalıdır.FalseTrue✓True✓V1.22Enjeksiyon ÖnlemeV1.2.11HTTP yanıtı, HTML veya XML belgesi için yapılan çıktı kodlamasının; HTML elemanları, HTML öznitelikleri, HTML yorumları, CSS ya da HTTP başlık alanları gibi bağlamlara uygun olduğu doğrulanmalıdır. Böylece mesaj veya belge yapısının bozulması önlenir.True✓True✓True✓V1.2.22Dinamik olarak URL oluşturulurken, güvenilmeyen verinin bağlamına göre (örneğin, sorgu veya yol parametreleri için URL kodlaması ya da base64url kodlaması) kodlandığı doğrulanmalıdır. Yalnızca güvenli URL protokollerine izin verilmelidir (örneğin, javascript: veya data: yasaklanmalıdır).True✓True✓True✓V1.2.33JavaScript içeriği (JSON dahil) dinamik olarak oluşturulurken çıktı kodlama/kaçış kullanıldığı doğrulanmalıdır. Böylece mesaj veya belge yapısı değiştirilmemiş olur (JavaScript ve JSON enjeksiyonlarının önüne geçilir).True✓True✓True✓V1.2.44Veri sorguları veya veritabanı sorguları (SQL, HQL, NoSQL, Cypher vb.) için parametreli sorgular, ORM’ler, entity framework’ler kullanıldığı ya da SQL enjeksiyonu ve diğer veritabanı enjeksiyon saldırılarına karşı koruma sağlandığı doğrulanmalıdır. Bu durum, saklı yordam (stored procedure) yazarken de geçerlidir.True✓True✓True✓V1.2.55Uygulamanın işletim sistemi komut enjeksiyonlarına karşı korunduğu ve işletim sistemi çağrılarında parametreli OS sorguları veya bağlama özgü komut satırı çıktı kodlamasının kullanıldığı doğrulanmalıdır.True✓True✓True✓V1.2.66Uygulamanın LDAP enjeksiyon zafiyetlerine karşı korunduğu ya da LDAP enjeksiyonlarını önlemek için özel güvenlik kontrollerinin uygulandığı doğrulanmalıdır.FalseTrue✓True✓V1.2.77XPath enjeksiyon saldırılarına karşı, sorgu parametrelemesi veya önceden derlenmiş sorgular kullanılarak koruma sağlandığı doğrulanmalıdır.FalseTrue✓True✓V1.2.88LaTeX işlemcilerinin güvenli şekilde yapılandırıldığı (örneğin, --shell-escape bayrağının kullanılmadığı) ve yalnızca izin verilen komutlardan oluşan bir listeyle çalıştırıldığı doğrulanmalıdır.FalseTrue✓True✓V1.2.99Düzenli ifadelerde (regex) özel karakterlerin (genellikle ters eğik çizgi \ ile) kaçırılarak meta karakter olarak yorumlanmalarının önlendiği doğrulanmalıdır.FalseTrue✓True✓V1.2.1010Uygulamanın CSV ve formül enjeksiyonlarına karşı korunduğu doğrulanmalıdır. Uygulama, CSV içeriği dışa aktarırken RFC 4180 Bölüm 2.6 ve 2.7'de tanımlanan kaçış kurallarına uymalıdır. Ayrıca, CSV veya diğer tablo formatlarına (XLS, XLSX, ODF gibi) aktarım yapılırken, alanın ilk karakteri olarak çıkan özel karakterler ('=', '+', '-', '@', '\t' (sekme), '\0' (null karakter)) tek tırnak (') ile kaçırılmalıdır.FalseFalseTrue✓V1.33Temizleme (Sanitization)V1.3.11WYSIWYG editörlerinden veya benzer kaynaklardan gelen tüm güvenilmeyen HTML girdilerinin, bilinen ve güvenli bir HTML temizleme kütüphanesi ya da çerçeve özelliği ile temizlendiği doğrulanmalıdır.True✓True✓True✓V1.3.22Uygulamanın eval() veya Spring Expression Language (SpEL) gibi dinamik kod çalıştırma özelliklerini kullanmaktan kaçındığı doğrulanmalıdır. Alternatif yoksa, kullanıcı girdisi çalıştırılmadan önce mutlaka temizlenmelidir.True✓True✓True✓V1.3.33Potansiyel olarak tehlikeli bir bağlamda kullanılacak verilerin, bu bağlama uygun karakterlere izin vermek ve çok uzun girdileri kısaltmak gibi güvenlik önlemleriyle önceden temizlendiği doğrulanmalıdır.FalseTrue✓True✓V1.3.44Kullanıcı tarafından sağlanan SVG içeriğinin, yalnızca güvenli etiket ve özellikler (örneğin grafik çizme ile ilgili) içerdiğinden emin olmak için onaylandığı veya temizlendiği doğrulanmalıdır (ör. script veya foreignObject içermemelidir).FalseTrue✓True✓V1.3.55Markdown, CSS, XSL stil sayfaları, BBCode veya benzeri ifade şablon dillerinde kullanıcı girdisinin temizlendiği veya bu tür özelliklerin devre dışı bırakıldığı doğrulanmalıdır.FalseTrue✓True✓V1.3.66Uygulamanın, güvenilmeyen verileri başka servislere iletmeden önce izinli protokol, alan adı, yol ve port listelerine göre doğruladığı ve tehlikeli karakterleri temizlediği doğrulanarak SSRF (Sunucu Taraflı İstek Sahteciliği) saldırılarına karşı korunduğu doğrulanmalıdır.FalseTrue✓True✓V1.3.77Uygulamanın şablon enjeksiyon saldırılarına karşı, güvenilmeyen girdilere dayalı şablon oluşturmayı engellediği; eğer bu kaçınılmazsa, bu girdilerin mutlaka temizlendiği veya sıkı şekilde onaylandığı doğrulanmalıdır.FalseTrue✓True✓V1.3.88JNDI sorgularında kullanılmadan önce güvenilmeyen girdilerin temizlendiği ve JNDI'nin enjeksiyonlara karşı güvenli şekilde yapılandırıldığı doğrulanmalıdır.FalseTrue✓True✓V1.3.99Memcache’e gönderilmeden önce içeriğin temizlenerek enjeksiyon saldırılarına karşı korunduğu doğrulanmalıdır.FalseTrue✓True✓V1.3.1010Format dizgilerinin (format strings) beklenmeyen veya zararlı şekilde çözümlenmesini önlemek için işlenmeden önce temizlendiği doğrulanmalıdır.FalseTrue✓True✓V1.3.1111SMTP veya IMAP enjeksiyonlarını önlemek için, kullanıcı girdisinin posta sistemlerine iletilmeden önce temizlendiği doğrulanmalıdır.FalseTrue✓True✓V1.3.1212Regex girdilerinin üstel geri izlemeye (exponential backtracking) neden olan öğeler içermediği ve güvenilmeyen girdilerin ReDoS (Regex Denial of Service) gibi saldırılara karşı temizlendiği doğrulanmalıdır.FalseFalseTrue✓V1.44Bellek, Dizgi ve Yönetilmeyen KodV1.4.11Yığın, arabellek (buffer) veya yığın belleği taşmalarını önlemek ya da tespit etmek amacıyla, bellek güvenli dizgi işlemlerinin, daha güvenli bellek kopyalama ve işaretçi aritmetiğinin kullanıldığı doğrulanmalıdır.FalseTrue✓True✓V1.4.22Tamsayı taşmalarını önlemek için işaret (sign), aralık (range) ve giriş doğrulama tekniklerinin kullanıldığı doğrulanmalıdır.FalseTrue✓True✓V1.4.33Dinamik olarak ayrılan belleğin ve kaynakların serbest bırakıldığı ve boşaltılan belleklere ait referansların veya işaretçilerin kaldırıldığı veya null yapıldığı doğrulanmalıdır (dangling pointer ve use-after-free zafiyetlerine karşı).FalseTrue✓True✓V1.55Güvenli Ters Serileştirme (Safe Deserialization)V1.5.11XML ayrıştırıcılarının (parser) kısıtlayıcı şekilde yapılandırıldığı ve dış varlık çözümleme (external entity resolution) gibi güvensiz özelliklerin XXE (XML eXternal Entity) saldırılarına karşı devre dışı bırakıldığı doğrulanmalıdır .True✓True✓True✓V1.5.22Güvenilmeyen verilerin ters serileştirilmesinde, nesne türleri için izinli liste kullanımı veya istemci tanımlı nesne türlerinin kısıtlanması gibi güvenli giriş işleme önlemlerinin uygulandığı doğrulanmalıdır. Güvensiz olarak tanımlanmış ters serileştirme mekanizmaları, güvenilmeyen girdilerle kullanılmamalıdır.FalseTrue✓True✓V1.5.33Aynı veri türü için uygulamada kullanılan farklı parser'ların (ör. JSON, XML, URL parser'ları), veriyi tutarlı şekilde ayrıştırdığı ve aynı karakter kodlamasını kullandığı doğrulanmalıdır. Böylece JSON birlikte çalışabilirlik açıkları, URI veya dosya ayrıştırma farkları gibi sorunlar nedeniyle RFI veya SSRF saldırılarının istismar edilmesi önlenir.FalseFalseTrue✓V22ValidationDoğrulama ve İş MantığıV2.11Doğrulama ve İş Mantığı DokümantasyonuV2.1.11Uygulama dokümantasyonunda, veri öğelerinin beklenen yapıya göre nasıl doğrulanacağına ilişkin giriş doğrulama kurallarının tanımlandığı doğrulanmalıdır. Bu; kredi kartı numaraları, e-posta adresleri, telefon numaraları gibi yaygın veri biçimleri olabileceği gibi iç sistemlere özel biçimler de olabilir.True✓True✓True✓V2.1.22Uygulama dokümantasyonunda, birleştirilmiş veri öğelerinin mantıksal ve bağlamsal tutarlılığının nasıl doğrulanacağı tanımlanmalıdır (örneğin, mahalle ve posta kodunun eşleşip eşleşmediğinin kontrolü).FalseTrue✓True✓V2.1.33Hem kullanıcı bazında hem de uygulama genelinde geçerli olacak şekilde, iş mantığı sınırları ve doğrulama beklentilerinin belgelendiği doğrulanmalıdır.FalseTrue✓True✓V2.22Girdi DoğrulamaV2.2.11Girdilerin, işlevsel ya da iş gereksinimlerine uygunluğunun doğrulandığı teyit edilmelidir. Bu işlem; izinli değerler, desenler ve aralıklar listesine karşı pozitif doğrulama ile ya da girdinin beklenen yapıya ve mantıksal sınırlara uygunluğunun önceden tanımlanmış kurallara göre karşılaştırılması ile yapılmalıdır. Seviye 1 için bu, güvenlik veya iş kararlarında kullanılan girdilere odaklanabilir. Seviye 2 ve üstü için tüm girdilere uygulanmalıdır.True✓True✓True✓V2.2.22Uygulamanın, güvenilir bir servis katmanında girdi doğrulama zorunluluğu uygulayacak şekilde tasarlandığı doğrulanmalıdır. İstemci tarafında gerçekleştirilen doğrulama, kullanılabilirliği artırabilir ve teşvik edilmelidir. Ancak bu doğrulama,güvenlik kontrolü olarak kabul edilmemelidir.True✓True✓True✓V2.2.33Uygulamanın, ilişkili veri öğelerinin önceden tanımlanmış kurallara göre makul olup olmadığını kontrol ettiği doğrulanmalıdır.FalseTrue✓True✓V2.33İş Mantığı GüvenliğiV2.3.11Uygulamanın, aynı kullanıcı için iş mantığı akışlarını yalnızca beklenen adım sırasına göre ve adım atlamadan işlediği doğrulanmalıdır.True✓True✓True✓V2.3.22İş mantığı sınırlarının, uygulama dokümantasyonuna uygun şekilde uygulandığı doğrulanmalıdır.FalseTrue✓True✓V2.3.33İş mantığı seviyesinde işlemlerin (transaction) kullanıldığı ve bir iş mantığı işleminin ya bütünüyle başarıyla tamamlandığı ya da önceki geçerli duruma geri döndürüldüğü (rollback) doğrulanmalıdır.FalseTrue✓True✓V2.3.44İş mantığı düzeyinde kilitleme mekanizmalarının, sınırlı kaynakların (ör. sinema koltukları, teslimat zamanları) uygulamanın mantığı manipüle edilerek çift rezervasyona neden olmamasını sağladığı doğrulanmalıdır.FalseTrue✓True✓V2.3.55Yüksek değerli iş mantığı akışlarının, yetkisiz veya kazara gerçekleşebilecek işlemleri önlemek için çoklu kullanıcı onayı gerektirdiği doğrulanmalıdır. Bu işlemler büyük para transferleri, sözleşme onayları, gizli bilgilere erişim veya üretimde güvenlik kurallarının geçersiz kılınmaları gibi durumları içerebilir.FalseFalseTrue✓V2.44Otomasyon Karşıtı ÖnlemlerV2.4.11Uygulama işlevlerine yönelik aşırı miktardaki çağrılara karşı; veri sızdırma, anlamsız veri üretme, kota tüketme, hız sınırının aşılması, hizmet reddi (DoS) ya da maliyetli kaynakların aşırı kullanımı gibi risklere karşı otomasyon karşıtı kontrollerin bulunduğu doğrulanmalıdır.FalseTrue✓True✓V2.4.22İş mantığı akışlarının, aşırı hızlı işlem gönderimlerini önleyecek şekilde gerçekçi insan zamanlaması gerektirdiği doğrulanmalıdır.FalseFalseTrue✓V33WebWeb Ön Uç (Frontend) GüvenliğiV3.11Web Frontend Güvenlik DokümantasyonuV3.1.11Uygulama dokümantasyonunda, uygulamayı kullanan tarayıcıların desteklemesi gereken güvenlik özelliklerinin (ör. HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) ve diğer ilgili HTTP güvenlik mekanizmaları) tanımlandığı doğrulanmalıdır. Ayrıca bu özelliklerin mevcut olmadığı durumlarda uygulamanın nasıl davranması gerektiği (ör. kullanıcıyı uyarmak veya erişimi engellemek) de tanımlanmalıdır.FalseFalseTrue✓V3.22İçeriğin Yanlış YorumlanmasıV3.2.11Tarayıcıların HTTP yanıtlarında içerik veya işlevi yanlış bir bağlamda sunmalarını önlemek amacıyla güvenlik kontrollerinin uygulandığı doğrulanmalıdır (ör. API, kullanıcı tarafından yüklenen dosya veya başka bir kaynağın doğrudan çağrılması durumunda). Olası kontroller arasında; yalnızca HTTP istek başlıklarının (ör. Sec-Fetch-\*) doğru bağlamı gösterdiği durumlarda içeriğin sunulması, Content-Security-Policy başlığında "sandbox" yönergesinin kullanılması veya Content-Disposition başlığında "attachment" biçiminin kullanılması yer alabilir.True✓True✓True✓V3.2.22HTML yerine metin olarak görüntülenmesi amaçlanan içeriğin, HTML veya JavaScript gibi içeriklerin istenmeden çalıştırılmasını önleyecek şekilde "createTextNode" veya "textContent" gibi güvenli işleme fonksiyonlarıyla işlendiği doğrulanmalıdır.True✓True✓True✓V3.2.33Uygulamanın istemci tarafı JavaScript kullanırken açık değişken tanımlamaları yaparak, sıkı tür kontrolü uygulayarak, global değişkenleri document nesnesine kaydetmekten kaçınarak ve ad alanı izolasyonu sağlayarak DOM clobbering’den kaçındığı doğrulanmalıdır.FalseFalseTrue✓V3.33Çerez YapılandırmasıV3.3.11Çerezlerin 'Secure' niteliğine sahip olduğu ve eğer çerez adı '\__Host-' ön eki ile başlamıyorsa, '__Secure-' ön ekinin kullanıldığı doğrulanmalıdır.True✓True✓True✓V3.3.22Kullanıcı arayüzü kandırma saldırılarına ve tarayıcı tabanlı istek sahteciliği saldırılarına (CSRF) karşı koruma sağlamak amacıyla, her çerezin 'SameSite' niteliğinin kullanım amacına uygun şekilde ayarlandığı doğrulanmalıdır.FalseTrue✓True✓V3.3.33Çerez adı, diğer sunucularla paylaşılmak üzere açıkça tasarlanmadığı sürece '__Host-' ön eki ile tanımlanmalıdır.FalseTrue✓True✓V3.3.44Bir çerez değeri istemci tarafı betikleri tarafından erişilememesi gereken bir veri içeriyorsa (ör. oturum token'ı), çerezin 'HttpOnly' niteliğine sahip olduğu ve aynı değerin (ör. oturum token'ı) yalnızca 'Set-Cookie' başlığı ile istemciye iletildiği doğrulanmalıdır.FalseTrue✓True✓V3.3.55Uygulama bir çerez oluştururken, çerez adı ve değerinin toplam uzunluğunun 4096 baytı aşmadığı doğrulanmalıdır. Çok büyük çerezler tarayıcı tarafından saklanmaz ve isteklerle gönderilmez; bu da çereze bağlı çalışan uygulama işlevlerinin bozulmasına yol açabilir.FalseFalseTrue✓V3.44Tarayıcı Güvenlik Mekanizması Başlıkları (Header)V3.4.22Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header'ı, uygulama tarafından sabit bir değer olarak tanımlanmalı veya gelen Origin header değeri güvenilir origin’lerden oluşan bir izinli listeye karşı doğrulanmalıdır. ‘Access-Control-Allow-Origin: *’ kullanılması gerekiyorsa, yanıtın hassas bilgi içermediği doğrulanmalıdır.True✓True✓True✓V3.4.33HTTP yanıtlarında Content-Security-Policy header'ı bulunduğu ve bu header'ın yalnızca güvenilen içeriklerin veya kaynakların yüklenmesini ve çalıştırılmasını sağlayan yönergeler içerdiği doğrulanmalıdır. Minimum olarak "global policy", object-src 'none', base-uri 'none' yönergelerini içermeli ve izinli liste, nonce veya hash temelli bir yapı içermelidir. Seviye 3 uygulamalarında her yanıt için nonce veya hash içeren özel bir politika tanımlanmalıdır.FalseTrue✓True✓V3.4.44Tüm HTTP yanıtlarının 'X-Content-Type-Options: nosniff' header'ını içerdiği doğrulanmalıdır. Bu, tarayıcıya içerik türünü tahmin etmeyi bırakmasını ve yanıtın Content-Type header'ında belirtilen MIME türünün, beklenen kaynak türüyle eşleşmesini zorunlu kılar. Ayrıca bu, tarayıcıda CORB (Cross-Origin Read Blocking) özelliğini etkinleştirir.FalseTrue✓True✓V3.4.55Uygulamanın, 'Referer' başlığı yoluyla üçüncü taraflara teknik olarak hassas verilerin sızmasını önlemek için bir 'referrer policy' belirlediği doğrulanmalıdır. Bu, Referrer-Policy HTTP header'ıyla veya HTML öğe nitelikleriyle (element attributes) sağlanabilir. Sızabilecek hassas bilgiler, URL’deki yol ve sorgu parametreleri ile sınırlı uygulamalarda hostname bilgisini içerebilir.FalseTrue✓True✓V3.4.66Uygulamanın, Content-Security-Policy header'ı altında 'frame-ancestors' yönergesini her HTTP yanıtında tanımladığı ve bu sayede içeriklerin varsayılan olarak başka sayfalara gömülmesini engellediği doğrulanmalıdır. Gerekli durumlarda özel olarak izin verildiğinden emin olunmalıdır. 'X-Frame-Options' header'ı, tarayıcılar tarafından desteklenmesine rağmen, artık güncel değildir ve güvenlik amacıyla kullanılmamalıdır.FalseTrue✓True✓V3.4.88Bir belgenin işlenmesini ve sunulmasını başlatan tüm HTTP yanıtlarında (örneğin 'text/html' tipi yanıtlar), 'Cross-Origin-Opener-Policy' header'ı 'same-origin' veya 'same-origin-allow-popups' yönergeleriyle birlikte yer almalıdır. Bu, tabnabbing ve frame counting gibi, pencere nesnelerine paylaşımlı erişimi sömüren saldırılara karşı koruma sağlar.FalseFalseTrue✓V3.55Tarayıcı Menşei AyırımıV3.5.11Uygulama, hassas işlevselliğe yönelik izinsiz cross-origin istekleri önlemek için CORS preflight mekanizmasına güvenmiyorsa, bu tür isteklerin gerçekten uygulamadan geldiği doğrulanmalıdır. Bu, anti-forgery token kullanımı veya CORS tarafından güvenli kabul edilmeyen özel HTTP header'larının zorunlu kılınmasıyla yapılabilir. Bu, tarayıcı tabanlı istek sahteciliği (CSRF) saldırılarına karşı bir savunmadır.True✓True✓True✓V3.5.22Uygulama, hassas işlevlerin izinsiz cross-origin çağrılmasını önlemek için CORS preflight mekanizmasına güveniyorsa, bu işlevlerin bir CORS-preflight isteğini tetiklemeden çağrılamadığı doğrulanmalıdır. Bu, 'Origin' ve 'Content-Type' header'larının doğrulanmasını veya CORS-safelisted olmayan bir header'ın ve alanın kullanılmasını gerektirebilir.True✓True✓True✓V3.5.44Farklı uygulamaların farklı hostname'lerde barındırıldığı ve böylece Same-Origin Policy tarafından sağlanan kısıtlamalardan (örneğin çerez erişim sınırları, kaynaklar arası etkileşim kontrolleri) faydalanıldığı doğrulanmalıdır.FalseTrue✓True✓V3.5.66Uygulamanın herhangi bir yerinde JSONP işlevselliğinin etkin olmadığı doğrulanmalıdır. Bu, XSSI (Cross-Site Script Inclusion) saldırılarını önlemek içindir.FalseFalseTrue✓V3.5.77Yetkilendirme gerektiren verilerin, JavaScript dosyaları gibi betik kaynaklarının yanıtlarında yer almadığı, XSSI saldırılarını önlemek için doğrulanmalıdır.FalseFalseTrue✓V3.5.88Kimliği doğrulanmış kaynakların (örneğin görseller, videolar, betikler ve belgeler) yalnızca gerçekten amaçlandığında kullanıcı adına yüklenebildiği veya gömülebildiği doğrulanmalıdır. Bu, isteğin uygun olmayan bir çapraz kaynak çağrısından kaynaklanmadığından emin olmak için Sec-Fetch-* HTTP istek başlığı alanlarının sıkı bir şekilde doğrulanmasıyla veya tarayıcıya döndürülen içeriği engelleme talimatı vermek için kısıtlayıcı bir Cross-Origin-Resource-Policy HTTP yanıt başlığı alanı ayarlayarak gerçekleştirilebilir.FalseFalseTrue✓V3.66Harici Kaynak BütünlüğüV3.6.11JavaScript kütüphaneleri, CSS veya web fontları gibi istemci tarafı varlıkların yalnızca statik ve sürümlü olması, varlığın bütünlüğünü doğrulamak için Subresource Integrity (SRI) kullanılması durumunda harici olarak (örneğin, bir İçerik Dağıtım Ağı üzerinde) barındırıldığı doğrulanmalıdır. Bu mümkün değilse, her bir kaynak için bunu gerekçelendiren belgelenmiş bir güvenlik kararı bulunmalıdır.FalseFalseTrue✓V3.77Diğer Tarayıcı Güvenliği HususlarıV3.7.11Uygulamanın yalnızca hâlâ desteklenen ve güvenli kabul edilen istemci tarafı teknolojileri kullandığı doğrulanmalıdır. Bu gereksinimi karşılamayan teknolojilere örnek olarak NSAPI eklentileri, Flash, Shockwave, ActiveX, Silverlight, NACL veya istemci tarafı Java applet’leri verilebilir.FalseTrue✓True✓V3.7.22Uygulamanın, yalnızca hedef adres bir izinli listede yer alıyorsa kullanıcıyı otomatik olarak farklı bir ana makine adına veya uygulamanın kontrolünde olmayan bir etki alanına yönlendirdiği doğrulanmalıdır.FalseTrue✓True✓V3.7.33Uygulamanın, kullanıcı uygulamanın kontrolü dışındaki bir URL’ye yönlendirildiğinde, yönlendirme hakkında bir bildirim gösterdiği ve kullanıcının bu gezintiyi iptal edebilmesi için bir seçenek sunduğu doğrulanmalıdır.FalseFalseTrue✓V3.7.44Uygulamanın en üst düzey etki alanının (örneğin, site.tld) HTTP Strict Transport Security (HSTS) için genel preload listesine eklendiği doğrulanmalıdır. Bu, uygulamanın TLS kullanımının ana tarayıcılar tarafından doğrudan tanınmasını ve yalnızca Strict-Transport-Security yanıt header'ına bağlı kalınmamasını sağlar.FalseFalseTrue✓V3.7.55Uygulamaya erişen tarayıcının beklenen güvenlik özelliklerini desteklememesi durumunda, uygulamanın dokümantasyona uygun şekilde davrandığı (örneğin kullanıcıyı uyarma veya erişimi engelleme) doğrulanmalıdır.FalseFalseTrue✓V44APIAPI ve Web ServisiV4.11Genel Web Servisi GüvenliğiV4.1.11İleti gövdesi içeren her HTTP yanıtında, yanıtın gerçek içeriğiyle eşleşen bir Content-Type header alanı bulunduğu ve güvenli karakter kodlamasını (örneğin, UTF-8, ISO-8859-1) belirtmek üzere charset parametresi içerdiği doğrulanmalıdır. Bu işlem, IANA Medya Türleri'nden "text/", "/+xml" ve "/xml" gibi içerikler için geçerlidir.True✓True✓True✓V4.1.22Yalnızca kullanıcı arayüzüne yönelik uç noktaların (manuel olarak web tarayıcısı ile erişilmesi amaçlanan) otomatik olarak HTTP'den HTTPS'e yönlendirme yaptığı ve diğer hizmetlerin veya uç noktaların şeffaf yönlendirme gerçekleştirmediği doğrulanmalıdır. Bu, istemcinin farkında olmadan şifrelenmemiş HTTP istekleri göndermesi ve bu isteklerin otomatik olarak HTTPS'e yönlendirilmesi sonucunda hassas verilerin sızmasının fark edilmemesi riskini önlemek içindir.FalseTrue✓True✓V4.1.33Uygulama tarafından kullanılan ve yük dengeleyici, web proxy veya frontend için backend hizmeti gibi bir ara katman tarafından ayarlanan herhangi bir HTTP başlık alanının, son kullanıcı tarafından geçersiz kılınamayacağı doğrulanmalıdır. Örnek başlıklar arasında X-Real-IP, X-Forwarded-* veya X-User-ID yer alabilir.FalseTrue✓True✓V4.1.44Uygulama veya API tarafından açıkça desteklenen HTTP yöntemlerinin (preflight istekleri sırasında OPTIONS dahil) dışında hiçbir yöntemin kullanılmadığı ve kullanılmayan yöntemlerin engellendiği doğrulanmalıdır.FalseFalseTrue✓V4.1.55Çok hassas istekler veya birçok sistemden geçen işlemler için, taşıma katmanı güvenliğinin üzerine ek bir güvence sağlamak amacıyla, her iletiye özel dijital imzaların kullanıldığı doğrulanmalıdır.FalseFalseTrue✓V4.22HTTP İleti Yapısı DoğrulamaV4.2.11Tüm uygulama bileşenlerinin (yük dengeleyiciler, güvenlik duvarları ve uygulama sunucuları dahil) HTTP sürümüne uygun mekanizmaları kullanarak gelen HTTP iletilerinin sınırlarını belirlediği ve bu sayede HTTP istek kaçakçılığına karşı koruma sağlandığı doğrulanmalıdır. HTTP/1.x sürümünde Transfer-Encoding başlık alanı varsa, RFC 2616'ya göre Content-Length başlığı göz ardı edilmelidir. HTTP/2 veya HTTP/3 kullanıldığında, Content-Length başlığı varsa, alıcının bu değerin DATA çerçevelerinin uzunluğuyla tutarlı olduğunu doğrulaması gerekir.FalseTrue✓True✓V4.2.22HTTP iletileri üretilirken, Content-Length başlığının, HTTP protokolünün çerçeveleme yöntemine göre belirlenen içerik uzunluğu ile çelişmediği doğrulanmalıdır. Bu, istek kaçakçılığı saldırılarını önlemek için gereklidir.FalseFalseTrue✓V4.2.33Uygulamanın, yanıt bölme ve header enjeksiyonu saldırılarını önlemek amacıyla, bağlantıya özel başlık alanları (örneğin Transfer-Encoding) içeren HTTP/2 veya HTTP/3 iletilerini göndermediği ve kabul etmediği doğrulanmalıdır.FalseFalseTrue✓V4.2.44Uygulamanın yalnızca başlık alanları ve değerleri CR (\r), LF (\n) veya CRLF (\r\n) karakter dizileri içermeyen HTTP/2 ve HTTP/3 isteklerini kabul ettiği doğrulanmalıdır. Bu, başlık enjeksiyonu saldırılarını önlemek içindir.FalseFalseTrue✓V4.2.55Uygulama (backend veya frontend) istek oluşturuyor ve gönderiyorsa, URI'ler (örneğin API çağrıları için) veya HTTP istek başlıkları (örneğin Authorization veya Cookie) gibi bileşenlerin, alıcı sistemler tarafından kabul edilemeyecek kadar uzun olmamasını sağlamak amacıyla doğrulama, temizleme veya diğer mekanizmaları kullandığı doğrulanmalıdır. Bu tür çok uzun istekler (örneğin çok uzun bir Cookie başlığı) gönderildiğinde sunucunun sürekli hata durumu döndürmesiyle hizmet reddi oluşabilir.FalseFalseTrue✓V4.33GraphQLV4.3.11Maliyetli ve iç içe geçmiş sorgular sonucu oluşabilecek GraphQL veya veri katmanı ifadelerine yönelik Hizmet Reddi (DoS) saldırılarını önlemek için, sorgu izin listesi (allowlist), derinlik sınırlandırması, sorgu sayısı sınırlandırması veya sorgu maliyeti analizi kullanıldığı doğrulanmalıdır.FalseTrue✓True✓V4.3.22GraphQL introspection (iç yapı sorgulama) sorgularının, GraphQL API'nin üçüncü taraflar tarafından kullanılmasına yönelik olmadığı sürece, üretim ortamında devre dışı bırakıldığı doğrulanmalıdır.FalseTrue✓True✓V4.44WebSocketV4.4.11Tüm WebSocket bağlantılarında TLS üzerinden WebSocket (WSS) kullanıldığı doğrulanmalıdır.True✓True✓True✓V4.4.22WebSocket'in başlangıçtaki HTTP el sıkışması (handshake) sırasında, Origin başlık alanının uygulama için izin verilen origin listesiyle karşılaştırılarak kontrol edildiği doğrulanmalıdır.FalseTrue✓True✓V4.4.33Uygulamanın standart oturum yönetimi kullanılamıyorsa, bunun yerine ilgili Oturum Yönetimi güvenlik gereksinimlerine uygun özel token'ların kullanıldığı doğrulanmalıdır.FalseTrue✓True✓V4.4.44HTTPS oturumu WebSocket kanalına geçerken, özel WebSocket oturum yönetim token’larının önceki şekilde kimliği doğrulanmış HTTPS oturumu aracılığıyla elde edildiği veya doğrulandığı doğrulanmalıdır.FalseTrue✓True✓V55FileDosya İşlemeV5.11Dosya İşleme DokümantasyonuV5.1.11Dokümantasyonun, her yükleme özelliği için izin verilen dosya türlerini, beklenen dosya uzantılarını ve maksimum boyutu (açılmış hali dahil) tanımladığı doğrulanmalıdır. Ayrıca, dosyaların son kullanıcılar için nasıl güvenli hâle getirileceği (örneğin kötü amaçlı bir dosya tespit edildiğinde uygulamanın nasıl davranacağı) gibi bilgilerin de belgede yer aldığı doğrulanmalıdır.FalseTrue✓True✓V5.22Dosya Yükleme ve İçerikV5.2.11Uygulamanın, yalnızca performans kaybına veya hizmet reddine yol açmayacak boyuttaki dosyaları kabul ettiği doğrulanmalıdır.True✓True✓True✓V5.2.22Uygulama bir dosyayı, doğrudan veya bir arşiv (ör. zip dosyası) içinde kabul ettiğinde, dosya uzantısının beklenen uzantıyla eşleşip eşleşmediğini kontrol ettiği ve içeriğin uzantı tarafından temsil edilen türle uyumlu olduğunu doğruladığı kontrol edilmelidir. Bu; ilk 'magic byte' kontrolü, görüntü yeniden yazımı ve dosya içeriği doğrulama için özel kütüphanelerin kullanımı gibi yöntemleri içerir. Seviye 1 için bu, yalnızca iş veya güvenlik kararlarında kullanılan dosyalarla sınırlı olabilir. Seviye 2 ve üzeri için tüm dosyalar bu kontrole tabi olmalıdır.True✓True✓True✓V5.2.33Sıkıştırılmış dosyaların (ör. zip, gz, docx, odt) açılmadan önce, izin verilen maksimum açılmış boyuta ve maksimum dosya sayısına göre kontrol edildiği doğrulanmalıdır.FalseTrue✓True✓V5.2.44Her kullanıcı için dosya boyutu kotası ve maksimum dosya sayısının uygulandığı doğrulanmalıdır. Böylece tek bir kullanıcının çok sayıda veya aşırı büyük dosya yükleyerek depolama alanını doldurması engellenir.FalseFalseTrue✓V5.2.55Uygulamanın, içinde sembolik bağlantılar (symlink) bulunan sıkıştırılmış dosyaların yüklenmesine yalnızca bu durum özel olarak gerekli olduğunda izin verdiği doğrulanmalıdır. Bu durumda, sembolik bağlantı verilebilecek dosyaların bir izinli listesi uygulanmalıdır.FalseFalseTrue✓V5.2.66Uygulamanın, piksel boyutu izin verilen maksimum değeri aşan görüntü dosyalarının yüklenmesini reddettiği doğrulanmalıdır. Bu, pixel flood saldırılarını önlemek için gereklidir.FalseFalseTrue✓V5.33Dosya DepolamaV5.3.11Güvenilmeyen girdilerle yüklenen veya oluşturulan ve herkese açık klasörlerde depolanan dosyaların, bir HTTP isteğiyle doğrudan erişildiğinde sunucu taraflı program kodu olarak çalıştırılmadığı doğrulanmalıdır.True✓True✓True✓V5.3.22Uygulamanın, dosya işlemleri için dosya yollarını oluştururken kullanıcı tarafından gönderilen dosya adlarını değil, dahili olarak oluşturulan veya güvenilir verileri kullandığı; eğer kullanıcı tarafından gönderilen dosya adları veya meta veriler kullanılacaksa, sıkı doğrulama ve temizleme işlemlerinin uygulandığı doğrulanmalıdır. Bu, yol geçişi (path traversal), yerel veya uzak dosya dahil etme (LFI, RFI) ve sunucu tarafı istek sahteciliği (SSRF) saldırılarına karşı koruma sağlar.True✓True✓True✓V5.3.33Sunucu tarafında gerçekleşen dosya işlemlerinin (örneğin dosya açma/decompress işlemi), kullanıcı tarafından sağlanan yol bilgilerini yok saydığı ve zip slip gibi güvenlik açıklarını önlediği doğrulanmalıdır.FalseFalseTrue✓V5.44Dosya İndirmeV5.4.11Uygulamanın, kullanıcı tarafından gönderilen dosya adlarını (ör. JSON, JSONP veya URL parametresinde) doğruladığı veya göz ardı ettiği ve yanıtın Content-Disposition başlık alanında bir dosya adı belirttiği doğrulanmalıdır.FalseTrue✓True✓V5.4.22Sunulan dosya adlarının (örneğin HTTP yanıt header'larında veya e-posta eklerinde), belge yapısını korumak ve enjeksiyon saldırılarını önlemek için kodlandığı veya temizlendiği (ör. RFC 6266’ya uygun) doğrulanmalıdır.FalseTrue✓True✓V5.4.33Güvenilmeyen kaynaklardan elde edilen dosyaların, bilinen kötü amaçlı içeriklerin sunulmasını önlemek amacıyla antivirüs tarayıcılarıyla tarandığı doğrulanmalıdır.FalseTrue✓True✓V66AuthenticationKimlik DoğrulamaV6.11Kimlik Doğrulama DokümantasyonuV6.1.11Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırılarına karşı oran sınırlama (rate limiting), otomasyon karşıtı önlemler ve uyarlanabilir yanıt gibi kontrollerin nasıl kullanıldığını açıklayan bir uygulama dokümantasyonu bulunduğu doğrulanmalıdır. Dokümantasyon, bu kontrollerin nasıl yapılandırıldığını ve kötü niyetli hesap kilitlemenin nasıl önlendiğini açıkça ortaya koymalıdır.True✓True✓True✓V6.1.22Parolalarda kullanılmasını önlemek amacıyla, bağlama özgü sözcüklerin (örneğin kurum adlarının permütasyonları, ürün adları, sistem tanımlayıcıları, proje kod adları, departman veya rol adları vb.) bulunduğu belgelenmiş bir liste mevcut olduğu doğrulanmalıdır.FalseTrue✓True✓V6.1.33Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, bunların tümünün belgelenmiş olduğu ve her yol için tutarlı şekilde uygulanması gereken güvenlik kontrolleri ile kimlik doğrulama gücünün tanımlandığı doğrulanmalıdır.FalseTrue✓True✓V6.22Parola GüvenliğiV6.2.11Kullanıcı tarafından belirlenen parolaların en az 8 karakter uzunluğunda olması sağlanmalı, ancak 15 karakter ve üzeri uzunlukta parolalar olmaları şiddetle tavsiye edilir.True✓True✓True✓V6.2.22Kullanıcıların parolalarını değiştirebilmeleri sağlanmalıdır.True✓True✓True✓V6.2.33Parola değiştirme işlevinin hem mevcut hem de yeni parolayı gerektirdiği doğrulanmalıdır.True✓True✓True✓V6.2.44Kayıt veya parola değişimi sırasında girilen parolaların, uygulamanın parola politikasına (örneğin minimum uzunluk) uyan ilk 3000 yaygın parolaya karşı kontrol edildiği doğrulanmalıdır.True✓True✓True✓V6.2.55Her tür karakterin kullanılmasına izin verildiği ve büyük/küçük harf, sayı veya özel karakter şartlarının zorunlu tutulmadığı doğrulanmalıdır.True✓True✓True✓V6.2.66Parola giriş alanlarının, girdiyi maskelemek için "type=password" kullandığı doğrulanmalıdır. Uygulamalar, kullanıcının tüm maskelenmiş parolayı ya da son girilen karakteri geçici olarak görüntülemesine izin verebilir.True✓True✓True✓V6.2.77"Yapıştır" özelliğinin, tarayıcı parola yardımcılarının ve harici parola yöneticilerinin kullanımına izin verildiği doğrulanmalıdır.True✓True✓True✓V6.2.88Uygulamanın, kullanıcıdan aldığı parolayı herhangi bir şekilde değiştirmeden, örneğin kesmeden veya harf büyüklüğünü değiştirmeden, tam olarak doğruladığı teyit edilmelidir.True✓True✓True✓V6.2.99En az 64 karakter uzunluğundaki parolalara izin verildiği doğrulanmalıdır.FalseTrue✓True✓V6.2.1010Kullanıcının parolasının, yalnızca ele geçirildiği tespit edildiğinde veya kullanıcı tarafından yenilendiğinde geçerliliğini yitirdiği doğrulanmalıdır. Uygulama, belirli aralıklarla parola yenilenmesini zorunlu kılmamalıdır.FalseTrue✓True✓V6.2.1111Tahmin edilmesi kolay parolaların oluşturulmasını önlemek amacıyla, bağlama özgü kelimelerin yer aldığı belgelenmiş listenin parola doğrulamada kullanıldığı teyit edilmelidir.FalseTrue✓True✓V6.2.1212Kayıt veya parola değişikliği sırasında girilen parolaların, ele geçirilmiş parolalar listesine karşı kontrol edildiği doğrulanmalıdır.FalseTrue✓True✓V6.33Genel Kimlik Doğrulama GüvenliğiV6.3.11Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırıları gibi saldırıları önlemeye yönelik kontrollerin, uygulamanın güvenlik dokümantasyonuna göre uygulandığı doğrulanmalıdır.True✓True✓True✓V6.3.22"root", "admin" veya "sa" gibi varsayılan kullanıcı hesaplarının uygulamada yer almadığı veya devre dışı bırakıldığı doğrulanmalıdır.True✓True✓True✓V6.3.33Uygulamaya erişim için ya çok faktörlü bir kimlik doğrulama mekanizması ya da tek faktörlü mekanizmaların kombinasyonu kullanılmalıdır. Seviye 3 için, bu faktörlerden biri, oltalama saldırılarına karşı direnç sağlayan ve kimlik doğrulama niyetini bir kullanıcı etkileşimi (örneğin FIDO donanım anahtarında bir düğmeye basma veya mobil telefonda bir onay) gerektirerek doğrulayan donanım tabanlı bir kimlik doğrulayıcı olmalıdır. Bu gereksinimdeki herhangi bir esneklik için, gerekçesi belgelenmiş ve riskleri azaltıcı kapsamlı kontroller içeren bir plan gereklidir.FalseTrue✓True✓V6.3.44Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, belgelendirilmemiş bir yol bulunmadığı ve tüm yollar için güvenlik kontrolleri ile kimlik doğrulama gücünün tutarlı şekilde uygulandığı doğrulanmalıdır.FalseTrue✓True✓V6.3.55Başarılı veya başarısız şüpheli kimlik doğrulama girişimlerinin kullanıcıya bildirildiği doğrulanmalıdır. Bu, olağandışı bir konum veya istemciden gelen girişimler, yalnızca bir faktörle yapılan kısmen başarılı doğrulamalar, uzun süreli inaktiflik sonrası yapılan girişimler veya birçok başarısız denemeden sonraki başarılı girişimler gibi durumları içerebilir.FalseFalseTrue✓V6.3.66E-postanın, tek faktörlü ya da çok faktörlü kimlik doğrulama mekanizması olarak kullanılmadığı doğrulanmalıdır.FalseFalseTrue✓V6.3.77Kimlik doğrulama detaylarında yapılan güncellemeler sonrasında (örneğin kimlik bilgisi sıfırlama, kullanıcı adı veya e-posta adresi değişiklikleri), kullanıcıların bilgilendirildiği doğrulanmalıdır.FalseFalseTrue✓V6.3.88Başarısız kimlik doğrulama girişimlerinden, geçerli kullanıcıların hata mesajları, HTTP yanıt kodları veya farklı yanıt süreleri gibi sonuçlara dayanarak tespit edilemediği doğrulanmalıdır. Bu koruma, kayıt ve "parolamı unuttum" işlevselliğinde de geçerli olmalıdır.FalseFalseTrue✓V6.44Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve KurtarmaV6.4.11Sistem tarafından oluşturulan ilk parolaların veya etkinleştirme kodlarının güvenli bir şekilde rastgele üretildiği, mevcut parola politikasına uygun olduğu, kısa bir süre içinde veya ilk kullanım sonrasında geçerliliğini yitirdiği doğrulanmalıdır. Bu başlangıç sırları uzun vadeli parola olarak kullanılmasına izin verilmemelidir.True✓True✓True✓V6.4.22Parola ipuçlarının veya "gizli sorular" olarak bilinen, bilgiye dayalı kimlik doğrulama mekanizmalarının mevcut olmadığı doğrulanmalıdır.True✓True✓True✓V6.4.33Unutulmuş parolanın sıfırlanması için, etkin olan çok faktörlü kimlik doğrulama mekanizmalarını atlamayan güvenli bir sürecin uygulandığı doğrulanmalıdır.FalseTrue✓True✓V6.4.44Çok faktörlü kimlik doğrulama faktörlerinden biri kaybolursa, kayıt sırasında uygulanan kimlik kanıtlama seviyesiyle aynı seviyede kimlik doğrulama yapıldığı doğrulanmalıdır.FalseTrue✓True✓V6.4.55Süresi dolacak kimlik doğrulama mekanizmalarının yenilenmesine ilişkin talimatların, süresi dolmadan önce tamamlanacak şekilde yeterli sürede gönderildiği ve gerekiyorsa otomatik hatırlatıcıların yapılandırıldığı doğrulanmalıdır.FalseFalseTrue✓V6.4.66Yönetici yetkisi olan kullanıcıların, kullanıcının parola sıfırlama sürecini başlatabildiği ancak kullanıcının yeni parolasını belirleyemediği veya değiştiremediği doğrulanmalıdır. Bu, yönetici yetkisi olan kullanıcıların, kullanıcı parolasını bilmesini engeller.FalseFalseTrue✓V6.55Çok Faktörlü Kimlik Doğrulama İçin Genel GereksinimlerV6.5.11Arama sırları, bant dışı kimlik doğrulama istekleri veya kodları ve zamana dayalı tek kullanımlık parolaların (TOTP) yalnızca bir kez kullanılabildiği doğrulanmalıdır.FalseTrue✓True✓V6.5.22Uygulamanın backend tarafında saklanırken, 112 bitten az entropiye sahip (örneğin 19 rastgele harf-rakam karakteri veya 34 rastgele rakam) arama sırlarının, 32-bit rastgele bir salt içeren onaylı bir parola saklama algoritmasıyla hash’lendiği doğrulanmalıdır. Gizli bilginin entropisi 112 bit veya daha fazlaysa standart bir hash fonksiyonu kullanılabilir.FalseTrue✓True✓V6.5.33Arama sırları, bant dışı kimlik doğrulama kodları ve zamana dayalı tek kullanımlık parola seed'lerinin, öngörülebilir değerlerden kaçınmak için Kriptografik Olarak Güvenli Sözde Rastgele Sayı Üreteci (CSPRNG) ile oluşturulduğu doğrulanmalıdır.FalseTrue✓True✓V6.5.44Arama sırlarının ve bant dışı kimlik doğrulama kodlarının en az 20 bit entropiye (genellikle 4 rastgele harf-rakam karakteri veya 6 rastgele rakam) sahip olduğu doğrulanmalıdır.FalseTrue✓True✓V6.5.55Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının ve zamana dayalı tek kullanımlık parolaların (TOTP) belirli bir ömre sahip olduğu doğrulanmalıdır. Bant dışı istekler en fazla 10 dakika, TOTP’ler ise en fazla 30 saniye geçerli olmalıdır.FalseTrue✓True✓V6.5.66Herhangi bir kimlik doğrulama faktörünün (fiziksel cihazlar dahil) çalınması veya kaybı durumunda iptal edilebildiği doğrulanmalıdır.FalseFalseTrue✓V6.5.77Biyometrik kimlik doğrulama mekanizmalarının yalnızca ikincil faktör olarak, “sahip olduğunuz bir şey” veya “bildiğiniz bir şey” ile birlikte kullanıldığı doğrulanmalıdır.FalseFalseTrue✓V6.5.88Zamana dayalı tek kullanımlık parolaların (TOTP) doğrulamasının, güvenilir bir hizmetten alınan zaman kaynağına dayanarak yapıldığı ve güvenilir olmayan veya istemci tarafından sağlanan zaman kaynağına dayanmadığı doğrulanmalıdır.FalseFalseTrue✓V6.66Bant Dışı Kimlik Doğrulama MekanizmalarıV6.6.11Tek kullanımlık parolaların (OTP) telefon veya SMS ile Public Switched Telephone Network (PSTN) üzerinden iletildiği kimlik doğrulama mekanizmalarının, yalnızca telefon numarası önceden doğrulanmışsa, alternatif daha güçlü yöntemler (örneğin TOTP) de sunuluyorsa ve kullanıcıya güvenlik riskleri hakkında bilgi veriliyorsa sunulduğu doğrulanmalıdır. Seviye 3 uygulamalar için telefon ve SMS seçenekleri sunulmamalıdır.FalseTrue✓True✓V6.6.22Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının, oluşturuldukları özgün kimlik doğrulama isteğiyle bağlantılı olduğu ve daha önceki ya da sonraki bir istek için kullanılamadığı doğrulanmalıdır.FalseTrue✓True✓V6.6.33Kod tabanlı bant dışı kimlik doğrulama mekanizmalarının, oran sınırlaması ile kaba kuvvet saldırılarına karşı korunduğu doğrulanmalıdır. En az 64 bit entropiye sahip kodlar kullanılması da değerlendirilmelidir.FalseTrue✓True✓V6.6.44Çok faktörlü kimlik doğrulama için push bildirimleri kullanılıyorsa, push bombing saldırılarına karşı oran sınırlamasının kullanıldığı doğrulanmalıdır. “Numara eşleştirme” de bu riski azaltabilir.FalseFalseTrue✓V6.77Kriptografik Kimlik Doğrulama MekanizmasıV6.7.11Kriptografik kimlik doğrulama beyanlarını doğrulamak için kullanılan sertifikaların, değiştirilmeye karşı korumalı şekilde saklandığı doğrulanmalıdır.FalseFalseTrue✓V6.7.22Challenge nonce değerinin en az 64 bit uzunluğunda olduğu ve istatistiksel olarak benzersiz ya da cihazın ömrü boyunca benzersiz olduğu doğrulanmalıdır.FalseFalseTrue✓V6.88Kimlik Sağlayıcısı ile Kimlik DoğrulamaV6.8.11Uygulama birden fazla kimlik sağlayıcıyı (IdP) destekliyorsa, başka bir desteklenen kimlik sağlayıcı aracılığıyla (örneğin aynı kullanıcı tanımlayıcısını kullanarak) kullanıcının kimliğinin taklit edilemediği doğrulanmalıdır. Standart önlem, uygulamanın kullanıcıyı IdP kimliği (bir ad alanı işlevi görür) ve IdP içindeki kullanıcı kimliğinin birleşimiyle kaydetmesi ve tanımlamasıdır.FalseTrue✓True✓V6.8.22Kimlik doğrulama beyanları üzerindeki dijital imzaların (örneğin JWT veya SAML beyanları) varlığı ve bütünlüğünün her zaman doğrulandığı ve imzasız veya geçersiz imzalı beyanların reddedildiği doğrulanmalıdır.FalseTrue✓True✓V6.8.33SAML beyanlarının benzersiz biçimde işlendiği ve yalnızca geçerlilik süresi içinde bir kez kullanıldığı, tekrar oynatma (replay) saldırılarını önlemek amacıyla doğrulanmalıdır.FalseTrue✓True✓V6.8.44Uygulama ayrı bir Kimlik Sağlayıcı (IdP) kullanıyorsa ve belirli işlemler için belirli kimlik doğrulama gücü, yöntemleri veya zaman bilgisi bekliyorsa, uygulamanın bu bilgileri IdP tarafından döndürülen veriler üzerinden doğruladığı teyit edilmelidir. Örneğin OIDC kullanılıyorsa, bu durum ID Token üzerindeki 'acr', 'amr' ve 'auth_time' gibi claim’lerin (varsa) doğrulanması ile sağlanabilir. Eğer IdP bu bilgileri sağlamıyorsa, uygulamanın asgari kimlik doğrulama gücünün kullanıldığını varsayan (örneğin yalnızca kullanıcı adı ve parola ile tek faktörlü doğrulama) belgelenmiş bir yedek yaklaşımı olmalıdır.FalseTrue✓True✓V77SessionOturum YönetimiV7.11Oturum Yönetim DokümantasyonuV7.1.11Kullanıcının oturum inaktivite zaman aşımı süresi ve mutlak maksimum oturum süresinin belgelendiği, diğer kontrollerle birlikte uygun olduğu ve NIST SP 800-63B yeniden kimlik doğrulama gereksinimlerinden herhangi bir sapma varsa gerekçesinin belgede yer aldığı doğrulanmalıdır.FalseTrue✓True✓V7.1.22Belgede bir hesap için kaç adet eşzamanlı (paralel) oturuma izin verildiği ile birlikte, maksimum aktif oturum sayısına ulaşıldığında uygulanacak davranış ve işlemlerin tanımlandığı doğrulanmalıdır.FalseTrue✓True✓V7.1.33Birleşik kimlik yönetim ekosisteminin bir parçası olarak kullanıcı oturumu oluşturan ve yöneten tüm sistemlerin, oturum ömrü, sonlandırma ve yeniden kimlik doğrulama gerektiren diğer koşulların nasıl koordine edildiğini açıklayan kontrollerle birlikte belgede yer aldığı doğrulanmalıdır.FalseTrue✓True✓V7.22Temel Oturum Yönetimi GüvenliğiV7.2.11Uygulamanın tüm oturum token'ı doğrulama işlemlerini güvenilir bir backend servisi aracılığıyla gerçekleştirdiği doğrulanmalıdır.True✓True✓True✓V7.2.22Uygulamanın, statik API gizli anahtarları veya sabit değerler yerine, oturum yönetimi için dinamik olarak oluşturulan kendi kendine yeterli veya referans token'ları kullandığı doğrulanmalıdır.True✓True✓True✓V7.2.33Uygulama kullanıcı oturumlarını temsil etmek için referans token'ları kullanıyorsa, bu token'ların benzersiz olduğu, kriptografik olarak güvenli bir sözde rastgele sayı üreteci (CSPRNG) kullanılarak üretildiği ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır.True✓True✓True✓V7.2.44Uygulamanın, kullanıcı kimlik doğrulaması (yeniden kimlik doğrulama dahil) sırasında yeni bir oturum token'ı oluşturduğu ve mevcut oturum token'ını sonlandırdığı doğrulanmalıdır.True✓True✓True✓V7.33Oturum Zaman AşımıV7.3.11Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde bir hareketsizlik zaman aşımı bulunduğu doğrulanmalıdır.FalseTrue✓True✓V7.3.22Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde mutlak bir maksimum oturum süresi bulunduğu doğrulanmalıdır.FalseTrue✓True✓V7.44Oturum SonlandırmaV7.4.11Oturum sonlandırma tetiklendiğinde (örneğin, çıkış yapıldığında veya süre dolduğunda), uygulamanın oturumun daha fazla kullanılmasına izin vermediği doğrulanmalıdır. Referans token'lar veya durum bilgili oturumlar için bu, oturum verilerinin uygulama arka ucunda geçersiz kılınması anlamına gelir. Kapsamlı token kullanan uygulamaların; sonlandırılmış token listesi tutmak, kullanıcıya özel tarih ve saatten önce oluşturulan token'ları reddetmek veya kullanıcıya özel imzalama anahtarını yenilemek gibi bir çözüm uygulaması gerekir.True✓True✓True✓V7.4.22Bir kullanıcı hesabı devre dışı bırakıldığında veya silindiğinde (örneğin bir çalışanın şirketten ayrılması), uygulamanın tüm aktif oturumları sonlandırdığı doğrulanmalıdır.True✓True✓True✓V7.4.33Herhangi bir kimlik doğrulama faktörünün başarılı bir şekilde değiştirilmesi veya kaldırılmasından (şifre sıfırlama veya kurtarma yoluyla yapılan değişiklikler dahil ve varsa MFA ayarları güncellemeleri dahil) sonra, uygulamanın diğer tüm aktif oturumları sonlandırma seçeneği sunduğu doğrulanmalıdır.FalseTrue✓True✓V7.4.44Kimlik doğrulama gerektiren tüm sayfalarda kolay erişilebilir ve görünür bir çıkış yap (logout) işlevi bulunduğu doğrulanmalıdır.FalseTrue✓True✓V7.4.55Uygulama yöneticilerinin, bireysel bir kullanıcının veya tüm kullanıcıların aktif oturumlarını sonlandırabilme yetkisine sahip olduğu doğrulanmalıdır.FalseTrue✓True✓V7.55Oturum Kötüye Kullanımına Karşı SavunmalarV7.5.11E-posta adresi, telefon numarası, MFA yapılandırması veya hesap kurtarmada kullanılan diğer bilgiler gibi kimlik doğrulamayı etkileyebilecek hassas hesap özniteliklerinde değişiklik yapılmadan önce uygulamanın tam yeniden kimlik doğrulama gerektirdiği doğrulanmalıdır.FalseTrue✓True✓V7.5.22Kullanıcıların, (en az bir faktörle yeniden kimlik doğrulama yaptıktan sonra) mevcut tüm aktif oturumları görüntüleyebilmesi ve sonlandırabilmesinin mümkün olduğu doğrulanmalıdır.FalseTrue✓True✓V7.5.33Uygulamanın, son derece hassas işlemler veya operasyonlar gerçekleştirilmeden önce en az bir faktörle ek kimlik doğrulaması veya ikincil bir doğrulama gerektirdiği doğrulanmalıdır.FalseFalseTrue✓V7.66Birleşik Yeniden Kimlik DoğrulamaV7.6.11Güvenen Taraf (RP) ile Kimlik Sağlayıcı (IdP) arasındaki oturum süresi ve oturum sonlandırma davranışlarının belgelenmiş olduğu ve, örneğin IdP kimlik doğrulama olayları arasında maksimum süreye ulaşıldığında yeniden kimlik doğrulamanın gerekli kılındığı doğrulanmalıdır.FalseTrue✓True✓V7.6.22Yeni bir oturum oluşturulmasının, kullanıcı onayı veya açık bir eylem gerektirdiği; kullanıcı etkileşimi olmaksızın yeni uygulama oturumlarının oluşturulmasının önlendiği doğrulanmalıdır.FalseTrue✓True✓V88AuthorizationYetkilendirmeV8.11Yetkilendirme DokümantasyonuV8.1.11Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak işlev düzeyinde ve veriye özel erişim kısıtlamaları için kuralları tanımladığı doğrulanmalıdır.True✓True✓True✓V8.1.22Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak alan (field) düzeyinde erişim kısıtlamaları (hem okuma hem yazma) için kuralları tanımladığı doğrulanmalıdır. Bu kuralların, ilgili veri nesnesinin durum veya statü gibi diğer özniteliklerine bağlı olabileceği unutulmamalıdır.FalseTrue✓True✓V8.1.33Uygulamanın dokümantasyonunun, kimlik doğrulama ve yetkilendirme ile ilgili güvenlik kararlarının alınmasında kullanılan çevresel ve bağlamsal öznitelikleri (günün saati, kullanıcı konumu, IP adresi veya cihaz gibi) tanımladığı doğrulanmalıdır.FalseFalseTrue✓V8.1.44Kimlik doğrulama ve yetkilendirme dokümantasyonunun; işlev düzeyinde, veriye özel ve alan düzeyinde yetkilendirmenin yanı sıra çevresel ve bağlamsal faktörlerin karar almada nasıl kullanıldığını tanımladığı doğrulanmalıdır. Bu, değerlendirilen öznitelikleri, risk eşiklerini ve alınan aksiyonları (ör. izin ver, doğrulama iste, reddet, step-up kimlik doğrulama) içermelidir.FalseFalseTrue✓V8.22Genel Yetkilendirme TasarımıV8.2.11Uygulamanın, işlev düzeyindeki erişimin yalnızca açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır.True✓True✓True✓V8.2.22Uygulamanın, veriye özel erişimin yalnızca belirli veri öğelerine açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, doğrudan nesne referansı güvenlik açıkları (IDOR) ve bozuk nesne düzeyinde yetkilendirme (BOLA) risklerini azaltır.True✓True✓True✓V8.2.33Uygulamanın, alan (field) düzeyindeki erişimin yalnızca belirli alanlara açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, bozuk nesne özelliği düzeyinde yetkilendirme (BOPLA) risklerini azaltır.FalseTrue✓True✓V8.2.44Tüketicinin çevresel ve bağlamsal özniteliklerine (ör. günün saati, konum, IP adresi veya cihaz) dayalı uyarlanabilir güvenlik kontrollerinin, uygulama dokümantasyonunda tanımlandığı şekilde, kimlik doğrulama ve yetkilendirme kararları için uygulandığı doğrulanmalıdır. Bu kontroller, tüketici yeni bir oturum başlatmaya çalışırken ve mevcut bir oturum sırasında uygulanmalıdır.FalseFalseTrue✓V8.33İşlem Düzeyinde YetkilendirmeV8.3.11Uygulamanın yetkilendirme kurallarını güvenilir bir servis katmanında uyguladığı ve istemci taraflı JavaScript gibi güvenilmeyen tüketiciler tarafından değiştirilebilecek kontrollerle yetinmediği doğrulanmalıdır.True✓True✓True✓V8.3.22Yetkilendirme kararlarının temelini oluşturan değerlerdeki değişikliklerin hemen uygulandığı doğrulanmalıdır. Değişikliklerin anında uygulanamadığı durumlarda (örneğin self-contained token içindeki verilere güveniliyorsa), tüketici artık yetkili olmadığı hâlde bir işlem gerçekleştirdiğinde uyarı verecek ve değişikliği geri alacak önlemler uygulanmalıdır. Bu alternatifin bilgi sızıntısını önlemeyeceği unutulmamalıdır.FalseFalseTrue✓V8.3.33Bir nesneye erişimin, herhangi bir aracı veya onun adına hareket eden bir servis yerine yalnızca erişimi başlatan öznenin (ör. tüketici) izinlerine dayandığı doğrulanmalıdır. Örneğin, bir tüketici kimlik doğrulama için bir self-contained token kullanarak bir web servis çağırırsa ve bu servis başka bir servisten veri talep ederse, ikinci servis izin kararlarını verirken birinci servisin makine-makine token'ı yerine tüketicinin token'ını kullanmalıdır.FalseFalseTrue✓V8.44Diğer Yetkilendirme HususlarıV8.4.11Multi-tenant uygulamaların, tüketici işlemlerinin izinli olmadıkları tenant'lar üzerinde asla etkili olmamasını sağlamak için tenant'lar arası kontroller kullandığı doğrulanmalıdır.FalseTrue✓True✓V8.4.22Yönetici arayüzlerine erişimin, sürekli tüketici kimlik doğrulaması, cihaz güvenlik durumu değerlendirmesi ve bağlamsal risk analizi dahil olmak üzere çok katmanlı güvenlik içerdiği doğrulanmalıdır. Yetkilendirme için yalnızca ağ konumu veya güvenilir uç noktalar yeterli olmamalıdır; ancak bu tür faktörler yetkisiz erişim olasılığını azaltabilir.FalseFalseTrue✓V99SelfKendi İçinde Taşıyıcı Token (Self-contained Token)V9.11Token Kaynağı ve BütünlüğüV9.1.11Self-contained token'ların içerikleri kabul edilmeden önce, oynama (tampering) saldırılarına karşı dijital imza veya MAC ile doğrulama yapıldığı doğrulanmalıdır.True✓True✓True✓V9.1.22Belirli bir bağlam için yalnızca bir allowlist üzerinde bulunan algoritmaların self-contained token oluşturmak ve doğrulamak için kullanılabildiği doğrulanmalıdır. Bu allowlist, yalnızca simetrik ya da yalnızca asimetrik algoritmaları içermeli ve kesinlikle 'None' algoritmasını içermemelidir. Hem simetrik hem de asimetrik algoritmalar desteklenmek zorundaysa, anahtar karışıklığını (key confusion) önlemek için ek kontroller uygulanmalıdır.True✓True✓True✓V9.1.33Self-contained token'ları doğrulamak için kullanılan anahtar malzemesinin, token issuer için önceden yapılandırılmış güvenilir kaynaklardan alındığı doğrulanmalıdır. Bu, saldırganların güvenilmeyen kaynak ve anahtarları belirtmesini engeller. JWT ve diğer JWS yapılarında 'jku', 'x5u' ve 'jwk' gibi header'lar güvenilir kaynaklardan oluşan bir allowlist'e göre doğrulanmalıdır.True✓True✓True✓V9.22Token İçeriğiV9.2.11Token verisinde bir geçerlilik zaman aralığı (validity time span) varsa, yalnızca doğrulama zamanı bu zaman aralığı içerisindeyse token ve içeriği kabul edilmelidir. Örneğin, JWT'ler için 'nbf' ve 'exp' claim'leri doğrulanmalıdır.True✓True✓True✓V9.2.22Token'ı alan hizmetin, token içeriğini kabul etmeden önce bu token'ın doğru türde olduğunu ve sunulma amacına uygun olduğunu doğruladığı teyit edilmelidir. Örneğin, yalnızca erişim token'ları yetkilendirme kararları için, yalnızca ID Token'lar kullanıcı kimlik doğrulamasını kanıtlamak için kullanılabilir.FalseTrue✓True✓V9.2.33Hizmetin yalnızca kendisiyle kullanılması amaçlanan (audience) token'ları kabul ettiği doğrulanmalıdır. JWT'lerde bu, 'aud' claim'inin hizmet içinde tanımlı bir allowlist ile doğrulanması yoluyla sağlanabilir.FalseTrue✓True✓V9.2.44Eğer bir token issuer, farklı audience'lara token oluşturmak için aynı private key'i kullanıyorsa, oluşturulan token'ların hedef audience'ları benzersiz şekilde tanımlayan bir audience kısıtlaması içerdiği doğrulanmalıdır. Bu, bir token'ın farklı bir audience ile yeniden kullanılmasını önler. Audience tanımlayıcısı dinamik olarak sağlanıyorsa, token issuer bu audience'ları doğrulamalı ve audience taklitlerinin (impersonation) önüne geçmelidir.FalseTrue✓True✓V1010OAuthOAuth ve OIDCV10.11Genel OAuth ve OIDC GüvenliğiV10.1.11Token'ların yalnızca kesinlikle ihtiyaç duyan bileşenlere gönderildiği doğrulanmalıdır. Örneğin, tarayıcı tabanlı JavaScript uygulamaları için bir backend-for-frontend modeli kullanıldığında, access ve refresh token'lara yalnızca backend'in erişebilmesi gerekir.FalseTrue✓True✓V10.1.22Authorization server'dan gelen değerler (örneğin authorization code veya ID Token gibi) yalnızca aynı user agent oturumu ve işlemi tarafından başlatılmış bir yetkilendirme akışının sonucuysa kabul edildiği doğrulanmalıdır. Bu, client tarafından oluşturulan secret’ların 'proof key for code exchange' (PKCE) ‘code_verifier’, ‘state’ veya OIDC ‘nonce’ gibi tahmin edilemez, işleme özgü ve hem client’a hem de işlem başlatılan user agent oturumuna güvenli bir şekilde bağlı olmasını gerektirir.FalseTrue✓True✓V10.22OAuth İstemcisiV10.2.11Code flow kullanılıyorsa, OAuth client’ın token taleplerini tetikleyen CSRF saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Bu genellikle PKCE kullanılarak veya authorization isteğinde gönderilen ‘state’ parametresinin kontrolü ile sağlanır.FalseTrue✓True✓V10.2.22OAuth istemcisi birden fazla AS ile etkileşime girebiliyorsa, mix-up saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Örneğin, authorization server’ın 'iss' parametresini döndürmesi zorunlu kılınabilir ve bu parametrenin hem authorization yanıtında hem de token yanıtında doğrulanması gerekir.FalseTrue✓True✓V10.2.33OAuth istemcisinin authorization server’a yaptığı taleplerde yalnızca gerekli scope’ları (veya diğer yetkilendirme parametrelerini) talep ettiği doğrulanmalıdır.FalseFalseTrue✓V10.33OAuth Kaynak Sunucusu (RS)V10.3.11RS'nin yalnızca bu servisle kullanılmak üzere tasarlanmış access token’ları kabul ettiği doğrulanmalıdır (audience kontrolü). Audience bilgisi yapılandırılmış token’larda (örneğin JWT içindeki ‘aud’ claim’i) yer alabilir veya token introspection endpoint aracılığıyla kontrol edilebilir.FalseTrue✓True✓V10.3.22RS'nin, access token’dan gelen claim’lere dayanarak yetki devri tanımına uygun şekilde yetkilendirme kararları uyguladığı doğrulanmalıdır. ‘sub’, ‘scope’ ve ‘authorization_details’ gibi claim’ler varsa, bu kararın parçası olmalıdır.FalseTrue✓True✓V10.3.33Erişim kontrolü kararında, access token’dan (JWT veya ilgili token introspection yanıtı) benzersiz bir kullanıcının tanımlanması gerekiyorsa, RS'nin başka kullanıcılara devredilemeyecek claim’ler ile kullanıcıyı tanımladığı doğrulanmalıdır. Genellikle bu, ‘iss’ ve ‘sub’ claim’lerinin birlikte kullanılması anlamına gelir.FalseTrue✓True✓V10.3.44RS'nin belirli bir kimlik doğrulama gücü, yöntemi veya güncelliği (recentness) gerektirmesi durumunda, sunulan access token’ın bu kısıtlamaları karşıladığını doğruladığı, örneğin, OIDC ‘acr’, ‘amr’ ve ‘auth_time’ claim’leri kullanılarak doğrulanmalıdır. FalseTrue✓True✓V10.3.55RS'nin, (yetkisiz taraflarca) çalınmış veya tekrar edilen access token’ların kullanımını önlemek için sender-constrained access token’lar kullandığı doğrulanmalıdır. Bu, OAuth 2 için Mutual TLS veya OAuth 2 Demonstration of Proof of Possession (DPoP) ile sağlanabilir.FalseFalseTrue✓V10.44OAuth Yetkilendirme Sunucusu (AS)V10.4.11AS'nin, istemciye özel önceden kaydedilmiş URI’lerden oluşan bir allowlist kullanarak redirect URI’leri tam dize karşılaştırması ile doğruladığı doğrulanmalıdır.True✓True✓True✓V10.4.22AS'nin, "authorization response" içinde "authorization code" döndürdüğü durumlarda, bu kodun yalnızca bir kez kullanılabildiği doğrulanmalıdır. Daha önce access token vermek için kullanılmış bir authorization code ile yapılan ikinci geçerli token isteği reddedilmeli ve ilgili tüm token’lar iptal edilmelidir.True✓True✓True✓V10.4.33Authorization code’un kısa ömürlü olduğu doğrulanmalıdır. L1 ve L2 uygulamalar için maksimum yaşam süresi 10 dakika, L3 uygulamalar için 1 dakikadır.True✓True✓True✓V10.4.44Belirli bir istemci için AS'nin yalnızca o istemcinin ihtiyaç duyduğu grant türlerine izin verdiği doğrulanmalıdır. "Token" (Implicit flow) ve "password" (Resource Owner Password Credentials flow) grant türlerinin artık kullanılmaması gerekir.True✓True✓True✓V10.4.55AS'nin, açık istemciler için refresh token replay saldırılarını azalttığı doğrulanmalıdır. Tercihen sender-constrained refresh token’lar (DPoP veya mutual TLS ile certificate-bound access token’lar) kullanılmalıdır. L1 ve L2 uygulamalar için refresh token rotation kullanılabilir. Rotation kullanılıyorsa, AS refresh token’ı kullanım sonrası geçersiz kılmalı ve geçersiz bir refresh token sunulması durumunda o yetkilendirme ile ilişkili tüm refresh token’ları iptal etmelidir.True✓True✓True✓V10.4.66Code grant kullanılıyorsa, AS'nin authorization code interception saldırılarına karşı koruma sağladığı doğrulanmalıdır. Yetkilendirme isteğinde geçerli bir "code_challenge" değeri zorunlu olmalı ve "code_challenge_method" olarak "plain" kabul edilmemelidir. Token isteğinde ise "code_verifier" parametresi doğrulanmalıdır.FalseTrue✓True✓V10.4.77AS'nin, kimlik doğrulaması yapılmamış dinamik istemci kaydını desteklemesi durumunda, kötü niyetli istemci uygulamalarına karşı riskleri azalttığı doğrulanmalıdır. Kayıtlı URI’ler gibi client metadata’sı doğrulanmalı, kullanıcı onayı alınmalı ve güvenilmeyen bir client uygulamasıyla yapılan yetkilendirme isteği işlenmeden önce kullanıcı uyarılmalıdır.FalseTrue✓True✓V10.4.88Refresh token’ların, sliding expiration kullanılsa bile mutlak bir sona erme süresine sahip olduğu doğrulanmalıdır.FalseTrue✓True✓V10.4.99Yetkili bir kullanıcı tarafından AS kullanıcı arayüzü üzerinden refresh token’ların ve reference access token’ların iptal edilebildiği doğrulanmalıdır.FalseTrue✓True✓V10.4.1010Gizli istemcilerin token istekleri, pushed authorization request (PAR) ve token iptal istekleri gibi server’a yapılan backchannel isteklerinde kimliğinin kontrol edildiği doğrulanmalıdır.FalseTrue✓True✓V10.4.1111AS yapılandırmasının, OAuth istemcisine yalnızca gerekli scope’ları atadığı doğrulanmalıdır.FalseTrue✓True✓V10.4.1212Belirli bir client için, authorization server’ın yalnızca client’ın ihtiyaç duyduğu 'response_mode' değerine izin verdiği doğrulanmalıdır. Örneğin, bu değer ya beklenenlerle karşılaştırılarak doğrulanmalı ya da PAR veya JAR kullanılmalıdır.FalseFalseTrue✓V10.4.1313"Code" grant türünün daima pushed authorization request (PAR) ile birlikte kullanıldığı doğrulanmalıdır.FalseFalseTrue✓V10.4.1414AS'nin yalnızca sender-constrained (Proof-of-Possession) access token’lar ürettiği doğrulanmalıdır. Bu, mutual TLS ile certificate-bound access token ya da DPoP ile DPoP-bound access token olabilir.FalseFalseTrue✓V10.4.1515Sunucu taraflı istemciler için (kullanıcı cihazında çalışmayan), AS'nin "authorization_details" parametresinin istemci backend'i tarafından sağlandığını ve kullanıcı tarafından değiştirilmediğini doğruladığı, örneğin pushed authorization request (PAR) or JWT-secured Authorization Request (JAR) zorunlu kılınarak doğrulanmalıdır.FalseFalseTrue✓V10.4.1616Bir istemci gizli ise, AS'nin güçlü istemci kimlik doğrulama yöntemlerini zorunlu kıldığı doğrulanmalıdır. Bu yöntemler, public-key cryptography’ye dayalı ve replay saldırılarına karşı dayanıklı olmalı, örneğin mutual TLS ("tls_client_auth", "self_signed_tls_client_auth") veya private key JWT ("private_key_jwt") gibi.FalseFalseTrue✓V10.55OIDC İstemcisiV10.5.11İstemcinin (relying party olarak) ID Token replay saldırılarını azalttığı doğrulanmalıdır. Örneğin, ID Token’daki 'nonce' claim’inin, OpenID Provider’a gönderilen kimlik doğrulama isteğindeki 'nonce' değeriyle eşleştiği doğrulanmalıdır.FalseTrue✓True✓V10.5.22İstemcinin kullanıcıyı ID Token claim’lerinden (genellikle, başka kullanıcılarla yeniden atanamayan 'sub' claim’i) benzersiz şekilde tanımladığı doğrulanmalıdır.FalseTrue✓True✓V10.5.33İstemcinin, kötü niyetli bir AS'nin başka bir AS'yi taklit etmesini AS metadata’sı üzerinden reddettiği doğrulanmalıdır. AS metadata’sındaki issuer URL’si, istemci tarafından beklenen önceden yapılandırılmış issuer URL’siyle tam olarak eşleşmiyorsa, metadata reddedilmelidir.FalseTrue✓True✓V10.5.44İstemcinin, ID Token’ın kendisi için (audience) kullanılması amaçlandığını doğruladığı doğrulanmalıdır. Bu, token’daki 'aud' claim’inin istemcinin 'client_id' değeriyle eşit olup olmadığının kontrol edilmesiyle yapılır.FalseTrue✓True✓V10.5.55OIDC back-channel logout kullanıldığında, relying party’nin "forced logout" ve "logout" akışında "cross-JWT confusion" gibi saldırılara karşı koruma sağladığı doğrulanmalıdır. Client, logout token’ın 'logout+jwt' türünde olduğunu, 'event' claim’inin doğru üyeye sahip olduğunu ve 'nonce' claim’i içermediğini doğrulamalıdır. Ayrıca token için kısa bir sona erme süresi (örneğin 2 dakika) önerilir.FalseTrue✓True✓V10.66OpenID ProviderV10.6.11OpenID Provider’ın yalnızca 'code', 'ciba', 'id_token' veya 'id_token code' response mode değerlerine izin verdiği doğrulanmalıdır. 'code' değeri, 'id_token code' (OIDC Hybrid flow) yerine tercih edilmelidir. 'token' (Implicit flow) kullanılmamalıdır.FalseTrue✓True✓V10.6.22OpenID Provider’ın forced logout yoluyla yapılan hizmet reddi saldırılarını önlediği doğrulanmalıdır. Bu, son kullanıcıdan açık onay alınarak veya varsa logout isteğinde (relying party tarafından başlatılan) bulunan parametrelerin, örneğin 'id_token_hint', doğrulanmasıyla yapılabilir.FalseTrue✓True✓V10.77Onay (Consent) YönetimiV10.7.11AS'nin her yetkilendirme isteği için kullanıcının onayını aldığı doğrulanmalıdır. İstemcinin kimliği garanti altına alınamıyorsa, AS daima kullanıcıdan açıkça onay istemelidir.FalseTrue✓True✓V10.7.22AS'nin kullanıcıdan onay istediğinde, neye onay verildiğini açık ve yeterli şekilde gösterdiği doğrulanmalıdır. Uygun olduğunda bu bilgiler, istenen yetkilendirmelerin doğasını (genellikle scope, resource server, RAR gibi detaylara dayalı), yetkilendirilmiş uygulamanın kimliğini ve bu yetkilendirmelerin süresini içermelidir.FalseTrue✓True✓V10.7.33Kullanıcının, AS üzerinden verdiği onayları görüntüleyebildiği, değiştirebildiği ve iptal edebildiği doğrulanmalıdır.FalseTrue✓True✓V1111CryptographyKriptografiV11.11Kriptografik Envanter ve DokümantasyonV11.1.11Kriptografik anahtarların yönetimi için belgelenmiş bir politika ve NIST SP 800-57 gibi bir anahtar yönetim standardını izleyen bir kriptografik anahtar yaşam döngüsü tanımlandığı doğrulanmalıdır. Bu, anahtarların aşırı miktarda paylaşılmadığını (örneğin, paylaşılan sırlar için ikiden fazla tarafla veya özel anahtarlar için birden fazla tarafla) garanti altına almalıdır.FalseTrue✓True✓V11.1.22Tüm kriptografik anahtarlar, algoritmalar ve uygulama tarafından kullanılan sertifikaları içeren bir kriptografik envanterin oluşturulduğu, sürdürüldüğü ve düzenli olarak güncellendiği doğrulanmalıdır. Bu envanter ayrıca, sistemde anahtarların nerede kullanılabileceğini ve kullanılamayacağını, ve hangi veri türlerinin bu anahtarlarla korunup korunamayacağını da belgelemelidir.FalseTrue✓True✓V11.1.33Sistem içerisinde şifreleme, özetleme ve imzalama işlemleri dahil olmak üzere kriptografi kullanımının tüm örneklerini tespit etmek için kriptografik keşif mekanizmalarının kullanıldığı doğrulanmalıdır.FalseFalseTrue✓V11.1.44Kriptografik bir envanterin sürdürüldüğü doğrulanmalıdır. Bu envanter, gelecekteki tehditlere karşı tepki verebilmek amacıyla post-kuantum kriptografiye geçiş yolunu belirten belgelenmiş bir plan içermelidir.FalseFalseTrue✓V11.22Güvenli Kriptografi UygulamasıV11.2.11Kriptografik işlemler için sektör tarafından doğrulanmış uygulamaların (kütüphaneler ve donanım hızlandırmalı uygulamalar dahil) kullanıldığı doğrulanmalıdır.FalseTrue✓True✓V11.2.22Uygulamanın, rastgele sayı üreticileri, kimliği doğrulanmış şifreleme, MAC veya özetleme algoritmaları, anahtar uzunlukları, turlar, şifreler ve modların herhangi bir zamanda yeniden yapılandırılabilir, yükseltilebilir veya değiştirilebilir olacağı şekilde kripto çevikliği (crypto agility) ile tasarlandığı doğrulanmalıdır. Aynı şekilde, anahtarların ve parolaların değiştirilebilmesi ve verilerin yeniden şifrelenebilmesi mümkün olmalıdır. Bu, onaylanmış PQC şemalarının yüksek güvenlikli uygulamaları yaygın olarak kullanılabilir hale geldiğinde sorunsuz geçişe olanak tanır.FalseTrue✓True✓V11.2.33Tüm kriptografik ilkeliklerin, algoritma, anahtar boyutu ve yapılandırmaya göre minimum 128 bit güvenlik sağladığı doğrulanmalıdır. Örneğin, 256-bit ECC anahtarı yaklaşık 128 bit güvenlik sağlarken, RSA için aynı güvenliği elde etmek 3072-bit anahtar gerektirir.FalseTrue✓True✓V11.2.44Tüm kriptografik işlemlerin sabit süreli (constant-time) olduğu, karşılaştırmalarda, hesaplamalarda veya geri dönüşlerde kısa devre (short-circuit) işlemleri yapılmadığı doğrulanmalıdır; bu, bilgi sızıntısını önlemek için gereklidir.FalseFalseTrue✓V11.2.55Tüm kriptografik modüllerin güvenli şekilde hata verdiği ve hataların, padding oracle saldırıları gibi zafiyetleri mümkün kılmayacak şekilde ele alındığı doğrulanmalıdır.FalseFalseTrue✓V11.33Şifreleme AlgoritmalarıV11.3.11Güvensiz blok modlarının (örneğin, ECB) ve zayıf doldurma (padding) şemalarının (örneğin, PKCS#1 v1.5) kullanılmadığı doğrulanmalıdır.True✓True✓True✓V11.3.22Yalnızca AES ile GCM gibi onaylı şifreleme algoritmalarının ve modlarının kullanıldığı doğrulanmalıdır.True✓True✓True✓V11.3.33Şifrelenmiş verilerin yetkisiz değişikliklere karşı korunduğu doğrulanmalıdır. Tercihen bu koruma, onaylı bir kimliği doğrulanmış şifreleme yöntemi kullanılarak ya da onaylı bir şifreleme yöntemi ile onaylı bir MAC algoritmasının kombinasyonu ile sağlanmalıdır.FalseTrue✓True✓V11.3.44Sayılar, başlatma vektörleri (IV) ve diğer tek kullanımlık değerlerin, aynı şifreleme anahtarı ve veri öğesi çifti için birden fazla kez kullanılmadığı doğrulanmalıdır. Oluşturma yöntemi kullanılan algoritmaya uygun olmalıdır.FalseFalseTrue✓V11.3.55Şifreleme algoritması ve MAC algoritması kombinasyonlarının "encrypt-then-MAC" modunda çalıştığı doğrulanmalıdır.FalseFalseTrue✓V11.44Hashing ve Hash Tabanlı FonksiyonlarV11.4.11Dijital imzalar, HMAC, KDF ve rastgele bit üretimi gibi genel kriptografik kullanım senaryolarında yalnızca onaylı hash fonksiyonlarının kullanıldığı doğrulanmalıdır. MD5 gibi yasaklı hash fonksiyonları hiçbir kriptografik amaçla kullanılmamalıdır.True✓True✓True✓V11.4.22Parolaların, onaylı, hesaplama açısından yoğun ve mevcut rehberliğe göre yapılandırılmış bir anahtar türetme fonksiyonu (diğer adıyla parola hash'leme fonksiyonu) kullanılarak saklandığı doğrulanmalıdır. Ayarlar, güvenlik ve performans dengesini sağlayarak kaba kuvvet saldırılarını zorlaştırmalıdır.FalseTrue✓True✓V11.4.33Dijital imzalarda kullanılan hash fonksiyonlarının, veri bütünlüğü ve kimlik doğrulama amacıyla kullanıldığında çakışmaya karşı dayanıklı ve yeterli bit uzunluğuna sahip olduğu doğrulanmalıdır. Çakışma dayanıklılığı gerekiyorsa çıktı uzunluğu en az 256 bit olmalıdır. Sadece ikinci ön-görüntü (2nd pre-iamge) saldırılarına karşı dayanıklılık gerekiyorsa çıktı uzunluğu en az 128 bit olmalıdır.FalseTrue✓True✓V11.4.44Parolalardan gizli anahtarlar türetilirken, onaylı anahtar türetme fonksiyonlarının anahtar uzatma (key stretching) parametreleriyle birlikte kullanıldığı doğrulanmalıdır. Bu parametreler, kaba kuvvet saldırılarını önleyecek şekilde güvenlik ve performans dengesine sahip olmalıdır.FalseTrue✓True✓V11.55Rastgele DeğerlerV11.5.11Tahmin edilemez olması amaçlanan tüm rastgele sayıların ve dizelerin, CSPRNG ile oluşturulduğu ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. UUID'lerin bu koşulu dikkate almadığını unutmayın.FalseTrue✓True✓V11.5.22Kullanılan rastgele sayı üretim mekanizmasının, yoğun talep altında dahi güvenli çalışacak şekilde tasarlandığı doğrulanmalıdır.FalseFalseTrue✓V11.66Açık Anahtar (Public Key) KriptografisiV11.6.11Anahtar üretimi, tohumlama (seeding) ve dijital imza üretimi ve doğrulama için yalnızca onaylı kriptografik algoritmalar ve çalışma modlarının kullanıldığı doğrulanmalıdır. Anahtar üretim algoritmaları, bilinen saldırılara karşı savunmasız anahtarlar üretmemelidir. Örneğin, Fermat çarpanlama yöntemine karşı savunmasız RSA anahtarları oluşturulmamalıdır.FalseTrue✓True✓V11.6.22Anahtar değişimi için yalnızca onaylı kriptografik algoritmaların kullanıldığı doğrulanmalıdır (örneğin Diffie-Hellman). Kullanılan parametrelerin güvenli olması gerektiğine dikkat edilmelidir. Bu, anahtar kurulum sürecine yönelik saldırıları önleyecek ve araya girme (adversary-in-the-middle) ya da kriptografik kırılmaları engelleyecektir.FalseFalseTrue✓V11.77Kullanım Halindeki Verilerin KriptografisiV11.7.11Hassas verilerin kullanım sırasında korunmasını sağlamak amacıyla, yetkisiz kullanıcıların veya süreçlerin bu verilere erişmesini engelleyen tam bellek şifrelemesinin kullanıldığı doğrulanmalıdır.FalseFalseTrue✓V11.7.22Veri asgariyetinin sağlandığı, yani işleme sırasında mümkün olan en az miktarda verinin ortaya çıktığı ve verilerin kullanımdan hemen sonra veya mümkün olan en kısa sürede şifrelendiği doğrulanmalıdır.FalseFalseTrue✓V1212SecureGüvenli İletişimV12.11Genel TLS Güvenlik RehberiV12.1.11Yalnızca TLS protokolünün en güncel ve önerilen sürümlerinin (örneğin TLS 1.2 ve TLS 1.3) etkinleştirildiği ve en son sürümün varsayılan olarak tercih edildiği doğrulanmalıdır.True✓True✓True✓V12.1.22Yalnızca önerilen şifre takımlarının (cipher suite) etkinleştirildiği ve en güçlü şifre takımlarının tercih edildiği doğrulanmalıdır. Seviye 3 (L3) uygulamalar yalnızca ileri gizlilik (forward secrecy) sağlayan şifre takımlarını desteklemelidir.FalseTrue✓True✓V12.1.33Uygulamanın, mTLS istemci sertifikalarını kimlik doğrulama veya yetkilendirme amacıyla kullanmadan önce bu sertifikaların güvendiği sertifikalar arasında olduğunu doğruladığı kontrol edilmelidir.FalseTrue✓True✓V12.1.44Online Certificate Status Protocol (OCSP) Stapling gibi geçerli bir sertifika iptal kontrolü yönteminin etkinleştirildiği ve yapılandırıldığı doğrulanmalıdır.FalseFalseTrue✓V12.1.55TLS el sıkışma (handshake) sürecinde Server Name Indication (SNI) gibi hassas meta verilerin ifşa edilmesini önlemek için, uygulamanın TLS yapılandırmasında Encrypted Client Hello (ECH) özelliğinin etkinleştirildiği doğrulanmalıdır.FalseFalseTrue✓V12.22Dışa Açık Hizmetlerle HTTPS İletişimiV12.2.11İstemci ile dışa açık, HTTP tabanlı hizmetler arasındaki tüm bağlantılarda TLS kullanıldığı ve bu bağlantıların güvensiz ya da şifrelenmemiş iletişime geri dönmediği doğrulanmalıdır.True✓True✓True✓V12.2.22Dışa açık hizmetlerin herkese açık olarak güvenilen TLS sertifikaları kullandığı doğrulanmalıdır.True✓True✓True✓V12.33Genel Servisler Arası İletişim GüvenliğiV12.3.11Uygulamaya gelen ve uygulamadan çıkan tüm bağlantılarda izleme sistemleri, yönetim araçları, uzaktan erişim ve SSH, ara yazılımlar, veritabanları, ana sistemler (mainframe), iş ortağı sistemleri ya da dış API'ler dahil olmak üzere TLS gibi şifreli bir protokolün kullanıldığı ve güvensiz ya da şifrelenmemiş protokollere geri dönülmediği doğrulanmalıdır.FalseTrue✓True✓V12.3.22TLS istemcilerinin bir TLS sunucusu ile iletişime geçmeden önce alınan sertifikaları doğruladığı kontrol edilmelidir.FalseTrue✓True✓V12.3.33Uygulama içindeki HTTP tabanlı iç hizmetler arasında gerçekleşen tüm bağlantılarda TLS ya da uygun başka bir aktarım şifreleme mekanizmasının kullanıldığı ve güvensiz ya da şifrelenmemiş iletişime geri dönülmediği doğrulanmalıdır.FalseTrue✓True✓V12.3.44İç hizmetler arasındaki TLS bağlantılarında güvenilir sertifikaların kullanıldığı doğrulanmalıdır. İç sistemlerde oluşturulmuş ya da kendinden imzalı (self-signed) sertifikalar kullanılıyorsa, bu sertifikalara güvenen hizmetlerin yalnızca belirli dahili sertifika otoritelerine (CA) ve belirli kendinden imzalı sertifikalara güvenecek şekilde yapılandırıldıkları doğrulanmalıdır.FalseTrue✓True✓V12.3.55Sistem içindeki hizmetlerin birbiriyle iletişim kurarken her bir uç noktanın kimliğini doğrulamak için güçlü kimlik doğrulama yöntemlerinin kullanıldığı doğrulanmalıdır. Bu yöntemler arasında, açık anahtar altyapısı (public-key infrastructure) kullanan ve tekrar oynatma saldırılarına karşı dayanıklı olan TLS istemci kimlik doğrulaması gibi yöntemler yer almalıdır. Mikroservis mimarilerinde, sertifika yönetimini basitleştirmek ve güvenliği artırmak amacıyla bir servis ağı (service mesh) kullanılması değerlendirilmelidir.FalseFalseTrue✓V1313ConfigurationKonfigürasyonV13.11Konfigürasyon DokümantasyonuV13.1.11Uygulamanın tüm iletişim ihtiyaçlarının dokümante edildiği doğrulanmalıdır. Buna, uygulamanın bağımlı olduğu dış hizmetler ve son kullanıcının uygulamanın bağlantı kurmasını sağlayabileceği dış konumlar da dahil olmalıdır.FalseTrue✓True✓V13.1.22Uygulamanın kullandığı her bir hizmet için, dokümantasyonda eşzamanlı bağlantı sayısı (örn. bağlantı havuzu limitleri) ve bu sınır aşıldığında uygulamanın davranışı, geri dönüş veya kurtarma mekanizmaları da dahil olmak üzere hizmet reddi koşullarını önlemek için tanımlandığı doğrulanmalıdır.FalseFalseTrue✓V13.1.33Uygulamanın, kullandığı her bir dış sistem veya hizmet (örn. veritabanları, dosya tanıtıcıları, iş parçacıkları, HTTP bağlantıları) için kaynak yönetimi stratejilerini tanımladığı doğrulanmalıdır. Bu stratejiler, kaynak serbest bırakma prosedürlerini, zaman aşımı ayarlarını, hata durumlarını ve tekrar deneme mantığı uygulanmışsa sınırları, gecikmeleri ve geri çekilme (back-off) algoritmalarını içermelidir. Senkron HTTP istek–yanıt işlemleri için kısa zaman aşımı süreleri zorunlu tutulmalı ve tekrar eden denemeler devre dışı bırakılmalı ya da sıkı şekilde sınırlandırılmalıdır.FalseFalseTrue✓V13.1.44Uygulamanın, güvenlik açısından kritik olan gizli verileri tanımladığı ve kuruluşun tehdit modeli ve iş ihtiyaçlarına göre bu verilerin döndürülme (rotation) zamanlamasının belgelendiği doğrulanmalıdır.FalseFalseTrue✓V13.22Backend İletişim KonfigürasyonuV13.2.11Uygulamanın, standart kullanıcı oturum mekanizmasını desteklemeyen backend bileşenleri (örneğin API'ler, ara katmanlar, veri katmanları) arasında gerçekleşen iletişimlerin kimlik doğrulamasıyla korunduğu doğrulanmalıdır. Kimlik doğrulama; bireysel hizmet hesapları, kısa ömürlü token'lar ya da sertifika tabanlı kimlik doğrulama ile yapılmalıdır ve parola, API anahtarı ya da ayrıcalıklı erişime sahip paylaşımlı hesaplar gibi sabit kimlik bilgileri kullanılmamalıdır.FalseTrue✓True✓V13.2.22Uygulamanın backend bileşenleri arasında (yerel hizmetler, işletim sistemi hizmetleri, API'ler, ara katmanlar ve veri katmanları dahil) gerçekleştirilen iletişimlerin, yalnızca gerekli en az ayrıcalığa sahip hesaplarla yapıldığı doğrulanmalıdır.FalseTrue✓True✓V13.2.33Bir hizmet kimlik doğrulaması için bir kimlik bilgisi kullanılması gerekiyorsa, bu kimlik bilgisinin varsayılan bir değer (örneğin root/root veya admin/admin) olmadığının doğrulanması gereklidir.FalseTrue✓True✓V13.2.44Uygulamanın iletişim kurmasına izin verilen dış kaynaklar ya da sistemlerin, bir allowlist (izinli liste) ile tanımlandığı doğrulanmalıdır. Bu liste, uygulama katmanında, web sunucusunda, güvenlik duvarında veya farklı katmanların birleşiminde uygulanabilir.FalseTrue✓True✓V13.2.55Web veya uygulama sunucusunun, dış sistemlere veri veya dosya gönderimi veya yüklemesi yaparken sadece belirli kaynaklara izin verecek şekilde allowlist ile yapılandırıldığı doğrulanmalıdır.FalseTrue✓True✓V13.2.66Uygulamanın farklı hizmetlere bağlantı kurduğu durumlarda, bu bağlantılar için belgelenmiş yapılandırmaları (örn. maksimum eşzamanlı bağlantı, bağlantı limiti aşıldığında davranış, zaman aşımı, tekrar deneme stratejileri) takip ettiğinin doğrulanması gereklidir.FalseFalseTrue✓V13.33Gizli Bilgi YönetimiV13.3.11Parolalar, anahtar materyalleri, veritabanı ve üçüncü parti sistemlerle entegrasyon bilgileri, zaman tabanlı token'lar için tohum (seed) bilgileri, dahili gizli veriler ve API anahtarları gibi backend sırlarının güvenli bir şekilde oluşturulması, saklanması, erişim denetiminin sağlanması ve imha edilmesi için bir gizli bilgi yönetim çözümünün (örneğin key vault) kullanıldığı doğrulanmalıdır. Bu gizli bilgiler uygulama kaynak koduna dahil edilmemeli ve yapı çıktılarında yer almamalıdır. Seviye 3 uygulamalar için donanım destekli bir çözüm (örneğin HSM) gereklidir.FalseTrue✓True✓V13.3.22Gizli bilgilere erişimin en az ayrıcalık prensibine uygun şekilde yapılandırıldığı doğrulanmalıdır.FalseTrue✓True✓V13.3.33Tüm kriptografik işlemlerin, anahtar materyallerinin güvenli bir şekilde yönetilmesi ve dışarıya sızmasının engellenmesi amacıyla, izole edilmiş bir güvenlik modülü (örneğin vault ya da donanım güvenlik modülü) aracılığıyla gerçekleştirildiği doğrulanmalıdır.FalseFalseTrue✓V13.3.44Uygulamanın belgelerinde belirtildiği şekilde gizli bilgilerin süresinin dolacak şekilde yapılandırıldığı ve düzenli olarak döndürüldüğü doğrulanmalıdır.FalseFalseTrue✓V13.44İstenmeyen Bilgi SızıntısıV13.4.11Uygulamanın .git veya .svn klasörleri gibi kaynak kontrolüyle ilgili metadata içermeyecek şekilde deploy edildiğini ya da bu klasörlerin hem dış erişime hem de uygulama erişimine kapalı olduğu doğrulanmalıdır.True✓True✓True✓V13.4.22Tüm bileşenler için üretim ortamlarında hata ayıklama (debug) modlarının devre dışı bırakıldığı doğrulanmalıdır.FalseTrue✓True✓V13.4.33Web sunucularının, açık şekilde istenmediği sürece dizin listelemesi (directory listing) özelliğini istemcilere sunmadığı doğrulanmalıdır.FalseTrue✓True✓V13.4.44HTTP TRACE metodunun üretim ortamlarında desteklenmediği, böylece potansiyel bilgi sızıntılarının önlendiği doğrulanmalıdır.FalseTrue✓True✓V13.4.55Belgeler (örneğin dahili API belgeleri) ve izleme uç noktalarının (monitoring endpoints) yalnızca açıkça belirtildiği durumlarda erişilebilir olduğu doğrulanmalıdır.FalseTrue✓True✓V13.4.66Uygulamanın arka uç bileşenlerinin ayrıntılı sürüm bilgilerini ifşa etmediği doğrulanmalıdır.FalseFalseTrue✓V13.4.77Web katmanının yalnızca belirli dosya uzantılarına sahip dosyaları sunacak şekilde yapılandırıldığı, bu sayede istem dışı bilgi, yapılandırma ya da kaynak kod sızıntılarının önlendiği doğrulanmalıdır.FalseFalseTrue✓V1414DataVeri KorumaV14.11Veri Koruma DokümantasyonuV14.1.11Uygulama tarafından oluşturulan ve işlenen tüm hassas verilerin tanımlanıp, koruma seviyelerine göre sınıflandırıldığından emin olun. Bu, yalnızca kodlanmış (örneğin Base64 stringleri ya da JWT içindeki düz metin yükler gibi) ve bu nedenle kolayca çözülebilir verileri de içermelidir. Koruma seviyeleri, uygulamanın uymakla yükümlü olduğu veri koruma ve gizlilik düzenlemeleri ile standartlarını dikkate almalıdır.FalseTrue✓True✓V14.1.22Tüm hassas veri koruma seviyeleri için belgelenmiş bir koruma gereksinimleri seti tanımlandığından emin olun. Bu gereksinimler genel şifreleme, bütünlük doğrulama, saklama süresi, verinin nasıl günlüğe kaydedileceği, günlüklerdeki hassas verilere erişim kontrolleri, veritabanı düzeyinde şifreleme, gizlilik ve gizliliği artırıcı teknolojiler ile diğer gizlilik gereksinimlerini kapsamalıdır.FalseTrue✓True✓V14.22Genel Veri KorumasıV14.2.11Hassas verilerin yalnızca HTTP message body veya header alanlarında sunucuya gönderildiği ve URL ile sorgu parametrelerinin, API anahtarı veya session token’ı gibi hassas bilgiler içermediği doğrulanmalıdır.True✓True✓True✓V14.2.22Hassas verilerin, yük dengeleyiciler ve uygulama önbellekleri gibi sunucu bileşenlerinde önbelleğe alınmasının engellendiği veya kullanım sonrası bu verilerin güvenli biçimde temizlendiği doğrulanmalıdır.FalseTrue✓True✓V14.2.33Uygulama kontrolü dışında veri toplanmasını engellemek için, tanımlanmış hassas verilerin, kullanıcı izleyicileri gibi güvensiz taraflara gönderilmediği doğrulanmalıdır.FalseTrue✓True✓V14.2.44Hassas verilere yönelik şifreleme, bütünlük doğrulama, veri saklama, loglama yöntemi, loglardaki erişim kontrolleri, gizlilik teknolojileri gibi kontrollerin, söz konusu verinin belgelenmiş koruma seviyesinde tanımlandığı şekilde uygulandığı doğrulanmalıdır.FalseTrue✓True✓V14.2.55Önbellekleme mekanizmalarının yalnızca belirli içerik türüne sahip yanıtları önbelleğe alacak şekilde yapılandırıldığı ve hassas, dinamik içeriklerin önbelleğe alınmadığı doğrulanmalıdır. Web sunucusu, mevcut olmayan bir dosya talebinde geçerli ama farklı bir dosya döndürmek yerine 404 veya 302 cevabı vermelidir. Bu, Web Cache Deception saldırılarını önlemeye yardımcı olur.FalseFalseTrue✓V14.2.66Uygulamanın yalnızca işlevsellik için gerekli olan asgari hassas veriyi döndürdüğü doğrulanmalıdır. Örneğin, kredi kartı numarasının yalnızca bazı rakamlarının döndürülmesi; tam numaranın döndürülmesi gerekiyorsa, kullanıcı arayüzünde gizlenmiş (maskelenmiş) şekilde sunulması gerekir, aksi kullanıcı özel olarak görüntülemek istemedikçe gösterilmemelidir.FalseFalseTrue✓V14.2.77Hassas bilgilerin, veri saklama sınıflandırmasına tabi tutulduğu, geçerliliğini yitirmiş veya artık gerekli olmayan verilerin belirlenmiş bir zaman çizelgesiyle ya da gerektiğinde otomatik olarak silindiği doğrulanmalıdır.FalseFalseTrue✓V14.2.88Kullanıcı tarafından yüklenen dosyaların meta verilerinden hassas bilgilerin çıkarıldığı veya bu bilgilerin yalnızca kullanıcıdan açık onay alındığında saklandığı doğrulanmalıdır.FalseFalseTrue✓V14.33İstemci Tarafı Veri KorumasıV14.3.11Kimliği doğrulanmış verilerin, istemci veya oturum sonlandığında istemci depolamasından (örneğin tarayıcı DOM’undan) temizlendiği doğrulanmalıdır. 'Clear-Site-Data' HTTP response header bu konuda yardımcı olabilir ancak istemci tarafı, sunucu bağlantısı mevcut olmadığında da temizlik işlemini yapabiliyor olmalıdır.True✓True✓True✓V14.3.22Uygulamanın, tarayıcılarda hassas verilerin önbelleğe alınmasını önlemek amacıyla yeterli anti-önbellekleme HTTP response header (örneğin Cache-Control: no-store) ayarladığı doğrulanmalıdır.FalseTrue✓True✓V14.3.33Tarayıcıda depolanan verilerin (örneğin localStorage, sessionStorage, IndexedDB veya çerezler) hassas veri içermediği, yalnızca session token’larının istisna olarak kabul edildiği doğrulanmalıdır.FalseTrue✓True✓V1515SecureGüvenli Kodlama ve MimariV15.11Güvenli Kodlama ve Mimari DokümantasyonuV15.1.11Güvenlik açığı içeren üçüncü taraf bileşen sürümleri ve genel olarak kütüphane güncellemeleri için, uygulama dokümantasyonunda risk bazlı düzeltme zamanlarının tanımlandığı doğrulanmalıdır.True✓True✓True✓V15.1.22Yazılım bileşen listesi (Software Bill of Materials - SBOM) gibi bir envanterin tutulduğu, kullanılan tüm üçüncü taraf kütüphanelerin önceden tanımlanmış, güvenilir ve düzenli olarak güncellenen depolardan alındığı doğrulanmalıdır.FalseTrue✓True✓V15.1.33Uygulama dokümantasyonunda zaman veya kaynak açısından yoğun işlevlerin tanımlandığı, bu işlevlerin aşırı kullanımı durumunda kullanılabilirlik kaybının nasıl önleneceği ve yanıt oluşturma süresinin istemci zaman aşımını aşmaması için hangi önlemlerin alındığı belirtilmelidir. Örnek savunmalar kuyruklama, eşzamansız işleme, kullanıcı başına ve uygulama genelinde paralel işlem sınırlarını içerebilir.FalseTrue✓True✓V15.1.44Uygulama dokümantasyonunda "riskli bileşenler" olarak değerlendirilen üçüncü taraf kütüphanelerin vurgulandığı doğrulanmalıdır.FalseFalseTrue✓V15.1.55Uygulama dokümantasyonunda "tehlikeli işlevsellik" içeren uygulama bölümlerinin açıkça belirtildiği doğrulanmalıdır.FalseFalseTrue✓V15.22Güvenlik Mimarisi ve BağımlılıklarV15.2.11Uygulamanın yalnızca, belgelenmiş güncelleme ve düzeltme sürelerini aşmamış bileşenleri içerdiği doğrulanmalıdır.True✓True✓True✓V15.2.22Uygulamanın, belgelenmiş güvenlik kararları ve stratejilere dayanarak, zaman veya kaynak açısından yoğun işlevlerin neden olabileceği kullanılabilirlik kaybına karşı savunmalar uyguladığı doğrulanmalıdır.FalseTrue✓True✓V15.2.33Üretim ortamının yalnızca uygulamanın çalışması için gerekli işlevleri içerdiği ve test kodları, örnek kod parçaları veya geliştirme işlevleri gibi gereksiz işlevsellikleri açığa çıkarmadığı doğrulanmalıdır.FalseTrue✓True✓V15.2.44Üçüncü taraf bileşenlerin ve bunların tüm transitif bağımlılıklarının beklenen depolardan (iç kaynaklı ya da harici) alındığı ve bağımlılık karışıklığı (dependency confusion) saldırılarına açık olmadığı doğrulanmalıdır.FalseFalseTrue✓V15.2.55Uygulamanın, “tehlikeli işlevsellik” içeren veya “riskli bileşenler” kullanan bölümlerine ek korumalar uyguladığı doğrulanmalıdır. Bu korumalar sandbox, kapsülleme, konteynerleştirme veya ağ düzeyinde izolasyon gibi teknikler aracılığıyla, bir uygulama bölümünün ele geçirilmesi durumunda saldırganın diğer bölümlere sıçramasını geciktirmeyi veya engellemeyi amaçlamalıdır.FalseFalseTrue✓V15.33Savunmacı KodlamaV15.3.11Uygulamanın yalnızca gerekli alanların bir alt kümesini veri nesnesinden döndürdüğü doğrulanmalıdır. Örneğin, bazı alanlara kullanıcıların erişmemesi gerektiğinden tüm veri nesnesi döndürülmemelidir.True✓True✓True✓V15.3.22Uygulama backend'i harici URL’lere çağrı yaptığında, yalnızca amaçlanan işlevsellik söz konusuysa yönlendirmeleri takip edecek şekilde yapılandırıldığının doğrulanması gerekir.FalseTrue✓True✓V15.3.33Uygulamanın, kitlesel atama saldırılarına karşı, her bir controller ve eylem için izin verilen alanları sınırlandırarak savunmalar sağladığı doğrulanmalıdır. Örneğin, bir alan değeri, bu işlemde değiştirilmesi amaçlanmadıysa eklenememeli veya güncellenememelidir.FalseTrue✓True✓V15.3.44Tüm proxy ve ara katman bileşenlerinin kullanıcının orijinal IP adresini, uç kullanıcı tarafından değiştirilemeyecek güvenilir veri alanları kullanarak doğru şekilde ilettiği ve uygulamanın ve web sunucusunun bu doğru değeri, loglama ve hız sınırlama gibi güvenlik kararları için kullandığı doğrulanmalıdır. Ayrıca, orijinal IP adresinin bile dinamik IP'ler, VPN'ler veya kurumsal güvenlik duvarları nedeniyle güvenilir olmayabileceği dikkate alınmalıdır.FalseTrue✓True✓V15.3.55Uygulamanın değişkenlerin doğru türde olduğunu açıkça doğruladığı ve sıkı eşitlik ve karşılaştırma işlemleri kullandığı doğrulanmalıdır. Bu, değişken türüyle ilgili varsayımlardan kaynaklanan tür oynama (type juggling) veya tür karışıklığı (type confusion) güvenlik açıklarını önlemek içindir.FalseTrue✓True✓V15.3.66JavaScript kodunun prototip zehirleme (prototype pollution) saldırılarını önleyecek şekilde yazıldığı, örneğin, nesne literal’leri yerine Set() veya Map() gibi yapılar kullanıldığı doğrulanmalıdır.FalseTrue✓True✓V15.3.77Uygulamanın, özellikle framework'ün istek parametrelerinin kaynağı (sorgu dizgisi, gövde parametreleri, çerezler veya başlık alanları) arasında ayrım yapmadığı durumlarda, HTTP parametre kirliliği (HTTP parameter pollution) saldırılarına karşı savunmalar uyguladığı doğrulanmalıdır.FalseTrue✓True✓V15.44Güvenli Eş Zamanlılık (Concurrency)V15.4.11Çok iş parçacıklı kodda (örneğin cache'ler, dosyalar veya birden fazla iş parçacığı tarafından erişilen bellek içi nesneler gibi) paylaşılan nesnelere yalnızca thread-safe (iş parçacığı güvenli) türler ve kilitleme (lock) veya semaphore gibi senkronizasyon mekanizmaları kullanılarak erişildiği doğrulanmalıdır. Bu, yarış durumlarını ve veri bozulmasını önlemeye yöneliktir.FalseFalseTrue✓V15.4.22Bir kaynağın durumu üzerindeki kontroller (örneğin varlığı ya da izinleri gibi) ile bu kontrole bağlı eylemlerin tek bir atomik işlem olarak gerçekleştirildiği doğrulanmalıdır. Bu, TOCTOU (time-of-check to time-of-use) yarış durumlarını önlemeye yöneliktir. Bir dosyanın varlığının kontrol edilip ardından açılması veya bir kullanıcının erişiminin doğrulanıp ardından yetki verilmesi gibi işlemler buna örnektir.FalseFalseTrue✓V15.4.33Kilitlerin (locks) tutarlı biçimde kullanıldığı, iş parçacıklarının birbirini beklemesi ya da sonsuz döngüye girmesi (deadlock veya livelock) gibi durumların önlendiği doğrulanmalıdır. Ayrıca, kilitleme mantığı, kaynağı yöneten kod içinde kalmalı ve dış sınıflar veya dış kodlar tarafından istemeden veya kötü niyetli şekilde değiştirilememelidir.FalseFalseTrue✓V15.4.44Kaynak tahsis politikalarının, iş parçacığı açlığını önleyecek şekilde, kaynaklara adil erişimi sağladığı doğrulanmalıdır. Örneğin, thread pool (iş parçacığı havuzu) kullanımı, düşük öncelikli iş parçacıklarının da makul sürelerde çalışabilmesi için uygulanmalıdır.FalseFalseTrue✓V1616SecurityGüvenlik Günlüklemesi (Logging) ve Hata YönetimiV16.11Güvenlik Loglaması DokümantasyonuV16.1.11Uygulamanın teknoloji yığını boyunca her katmanda hangi olayların loglandığını, log formatlarını, logların nereye yazıldığını, nasıl kullanıldığını, erişimin nasıl kontrol edildiğini ve logların ne kadar süre saklandığını belgeleyen bir envanterin mevcut olduğu doğrulanmalıdır.FalseTrue✓True✓V16.22Genel LoglamaV16.2.11Her bir log girdisinin, olayın ne zaman, nerede, kim tarafından ve ne olduğuna dair detaylı bir zaman çizelgesi oluşturulmasına olanak tanıyacak gerekli meta verileri içerdiği doğrulanmalıdır.FalseTrue✓True✓V16.2.22Tüm loglama bileşenlerinin zaman kaynaklarının senkronize olduğu ve güvenlik olayı meta verisindeki zaman damgalarının UTC kullanarak ya da açık zaman dilimi ofsetiyle belirtildiği doğrulanmalıdır. UTC kullanımı, özellikle yaz saati uygulamaları nedeniyle oluşabilecek karışıklıkları önlemek için tavsiye edilir.FalseTrue✓True✓V16.2.33Uygulamanın yalnızca log envanterinde belgelenmiş dosya ve hizmetlere log yazdığı ya da ilettiği doğrulanmalıdır.FalseTrue✓True✓V16.2.44Logların kullanılan log işleyici (log processor) tarafından okunabildiği ve ilişkilendirilebildiği doğrulanmalıdır. Tercihen yaygın bir log formatı kullanılmalıdır.FalseTrue✓True✓V16.2.55Hassas veriler loglanırken, uygulamanın veri koruma seviyesine uygun olarak loglama yaptığı doğrulanmalıdır. Örneğin kimlik bilgileri veya ödeme detayları gibi bazı verilerin loglanmasına izin verilmemelidir. Session token’ları gibi veriler ise yalnızca tamamen ya da kısmen maskelenmiş ya da hash’lenmiş olarak loglanmalıdır.FalseTrue✓True✓V16.33Güvenlik OlaylarıV16.3.11Tüm kimlik doğrulama işlemlerinin (başarılı ve başarısız girişimler dahil) loglandığı doğrulanmalıdır. Kullanılan kimlik doğrulama türü veya faktörleri gibi ek meta veriler de toplanmalıdır.FalseTrue✓True✓V16.3.22Başarısız yetkilendirme girişimlerinin loglandığı doğrulanmalıdır. Seviye 3 uygulamalar için, tüm yetkilendirme kararlarının ve hassas verilere erişim olaylarının (verinin kendisi olmadan) loglandığı da doğrulanmalıdır.FalseTrue✓True✓V16.3.33Uygulamanın, belgelenmiş güvenlik olaylarını ve güvenlik kontrollerini aşma girişimlerini (girdi doğrulama, iş mantığı, otomasyon karşıtı kontroller vb.) logladığı doğrulanmalıdır.FalseTrue✓True✓V16.3.44Beklenmeyen hatalar ve güvenlik kontrolü başarısızlıkları (örneğin backend TLS hataları gibi) loglandığı doğrulanmalıdır.FalseTrue✓True✓V16.44Log KorumasıV16.4.11Tüm loglama bileşenlerinin, log enjeksiyonunu (log injection) önlemek amacıyla verileri uygun biçimde encode ettiği doğrulanmalıdır.FalseTrue✓True✓V16.4.22Logların yetkisiz erişime karşı korunduğu ve değiştirilemez olduğu doğrulanmalıdır.FalseTrue✓True✓V16.4.33Logların analiz, tespit, uyarı ve yükseltme amacıyla mantıksal olarak ayrı bir sisteme güvenli biçimde iletildiği doğrulanmalıdır. Böylece uygulama ihlal edilse bile logların tehlikeye girmesi önlenmiş olur.FalseTrue✓True✓V16.55Hata YönetimiV16.5.11Beklenmedik ya da güvenlikle ilgili bir hata oluştuğunda, tüketiciye genel bir mesaj döndürüldüğü ve yığın izleri (stack trace), sorgular, gizli anahtarlar, token’lar gibi hassas sistem içi verilerin açıklanmadığı doğrulanmalıdır.FalseTrue✓True✓V16.5.22Uygulamanın, dış kaynaklara erişim başarısız olduğunda bile güvenli şekilde çalışmaya devam ettiği doğrulanmalıdır. Örneğin, circuit breaker ya da graceful degradation gibi desenler kullanılmalıdır.FalseTrue✓True✓V16.5.33Uygulamanın hata durumlarında güvenli ve düzenli şekilde başarısız olduğu doğrulanmalıdır. Bu, örneğin doğrulama hatalarına rağmen işlemlerin işlenmesine yol açabilecek fail-open durumlarını önlemelidir.FalseTrue✓True✓V16.5.44Ele alınmamış tüm istisnaları yakalayacak şekilde tanımlanmış bir “son çare hata yöneticisi” bulunduğu doğrulanmalıdır. Bu, hem loglara gitmesi gereken hata detaylarının kaybolmaması hem de tüm uygulama sürecinin çökerek hizmet dışı kalmasının önlenmesi açısından önemlidir.FalseFalseTrue✓V1717WebRTCWebRTCV17.11TURN SunucusuV17.1.11TURN hizmetinin yalnızca özel amaçlar için ayrılmamış IP adreslerine (ör. iç ağlar, yayın adresleri, loopback) erişime izin verdiği doğrulanmalıdır. Bu gereksinim hem IPv4 hem de IPv6 adresleri için geçerlidir.FalseTrue✓True✓V17.1.22TURN hizmetinin, meşru kullanıcıların sunucuda çok sayıda bağlantı noktası açmaya çalışması durumunda kaynak tüketimi saldırılarına karşı dayanıklı olduğu doğrulanmalıdır.FalseFalseTrue✓V17.22MedyaV17.2.11DTLS sertifikası anahtarının, belgelenmiş kriptografik anahtar yönetim politikasına uygun şekilde yönetildiği ve korunduğu doğrulanmalıdır.FalseTrue✓True✓V17.2.22Medya sunucusunun onaylı DTLS şifre takımlarını (cipher suites) ve Güvenli Gerçek Zamanlı Aktarım Protokolü (Secure Real-time Transport Protocol - SRTP) için anahtarlar oluşturmaya yönelik DTLS Uzantısı için güvenli bir koruma profilini kullanacak ve destekleyecek şekilde yapılandırıldığı (DTLS-SRTP) doğrulanmalıdır.FalseTrue✓True✓V17.2.33Real-time Transport Protocol (RTP) injection saldırılarının bir hizmet reddi durumuna veya medya akışlarına ses veya video medyası eklenmesine yol açmasını önlemek için medya sunucusunda Güvenli SRTP kimlik doğrulamasının kontrol edildiği doğrulanmalıdır.FalseTrue✓True✓V17.2.44Verify that the media server is able to continue processing incoming media traffic when encountering malformed Secure Real-time Transport Protocol (SRTP) packets.FalseTrue✓True✓V17.2.55Medya sunucusunun, meşru kullanıcılardan gelen SRTP flood'ı sırasında gelen medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.FalseFalseTrue✓V17.2.66Medya sunucusunun DTLS içinde yer alan "ClientHello" yarış durumu güvenlik açığına karşı savunmasız olmadığı, medya sunucusunun güvenlik açığına sahip olduğunun açıkça bilinip bilinmediği kontrol edilerek veya yarış koşulu testi gerçekleştirilerek doğrulanmalıdır.FalseFalseTrue✓V17.2.77Medya sunucusuna bağlı ses veya video kayıt mekanizmalarının, meşru kullanıcı kaynaklı SRTP flood'ı sırasında medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.FalseFalseTrue✓V17.2.88DTLS sertifikasının, SDP (Session Description Protocol) fingerprint özelliği ile karşılaştırıldığı ve doğrulama başarısız olursa medya akışının sonlandırıldığı, medya akışının özgünlüğünü sağlamak için doğrulanmalıdır.FalseFalseTrue✓V17.33SinyalizasyonV17.3.11Sinyalizasyon sunucusunun, flood saldırısı altında bile meşru sinyalizasyon mesajlarını işlemeye devam edebildiği doğrulanmalıdır. Bu, sinyalizasyon düzeyinde oran sınırlaması uygulanarak sağlanmalıdır.FalseTrue✓True✓V17.3.22Sinyalizasyon sunucusunun, hizmet reddine yol açabilecek şekilde yapılandırılmış bozuk sinyalizasyon mesajlarıyla karşılaştığında bile meşru mesajları işlemeye devam edebildiği doğrulanmalıdır. Bu, girdi doğrulaması, integer overflow ve buffer overflow'a karşı savunma ve sağlam hata işleme teknikleri ile sağlanmalıdır.FalseTrue✓True✓ diff --git a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.xml b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.xml new file mode 100644 index 0000000000..2b8087fa93 --- /dev/null +++ b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.xml @@ -0,0 +1 @@ +Application Security Verification Standard ProjectASVSThe OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.V11EncodingKodlama (Encoding) ve TemizlemeV1.11Kodlama ve Temizleme MimarisiV1.1.11Girdinin yalnızca bir kez kanonik forma (canonical form) çözümlendiği veya kaçış işlemlerinin kaldırıldığı, bu işlemin yalnızca verinin bu biçimde beklenmesi durumunda yapıldığı ve bu işlemin girdi doğrulama veya temizleme işlemlerinden sonra değil, önce gerçekleştiği doğrulanmalıdır.2V1.1.22Uygulamanın, çıktıyı kullanılması gereken yorumlayıcıya verilmeden hemen önce veya yorumlayıcının kendisi tarafından çıktı kodlaması ya da kaçış işlemi yaptığı doğrulanmalıdır.2V1.22Enjeksiyon ÖnlemeV1.2.11HTTP yanıtı, HTML veya XML belgesi için yapılan çıktı kodlamasının; HTML elemanları, HTML öznitelikleri, HTML yorumları, CSS ya da HTTP başlık alanları gibi bağlamlara uygun olduğu doğrulanmalıdır. Böylece mesaj veya belge yapısının bozulması önlenir.1V1.2.22Dinamik olarak URL oluşturulurken, güvenilmeyen verinin bağlamına göre (örneğin, sorgu veya yol parametreleri için URL kodlaması ya da base64url kodlaması) kodlandığı doğrulanmalıdır. Yalnızca güvenli URL protokollerine izin verilmelidir (örneğin, javascript: veya data: yasaklanmalıdır).1V1.2.33JavaScript içeriği (JSON dahil) dinamik olarak oluşturulurken çıktı kodlama/kaçış kullanıldığı doğrulanmalıdır. Böylece mesaj veya belge yapısı değiştirilmemiş olur (JavaScript ve JSON enjeksiyonlarının önüne geçilir).1V1.2.44Veri sorguları veya veritabanı sorguları (SQL, HQL, NoSQL, Cypher vb.) için parametreli sorgular, ORM’ler, entity framework’ler kullanıldığı ya da SQL enjeksiyonu ve diğer veritabanı enjeksiyon saldırılarına karşı koruma sağlandığı doğrulanmalıdır. Bu durum, saklı yordam (stored procedure) yazarken de geçerlidir.1V1.2.55Uygulamanın işletim sistemi komut enjeksiyonlarına karşı korunduğu ve işletim sistemi çağrılarında parametreli OS sorguları veya bağlama özgü komut satırı çıktı kodlamasının kullanıldığı doğrulanmalıdır.1V1.2.66Uygulamanın LDAP enjeksiyon zafiyetlerine karşı korunduğu ya da LDAP enjeksiyonlarını önlemek için özel güvenlik kontrollerinin uygulandığı doğrulanmalıdır.2V1.2.77XPath enjeksiyon saldırılarına karşı, sorgu parametrelemesi veya önceden derlenmiş sorgular kullanılarak koruma sağlandığı doğrulanmalıdır.2V1.2.88LaTeX işlemcilerinin güvenli şekilde yapılandırıldığı (örneğin, --shell-escape bayrağının kullanılmadığı) ve yalnızca izin verilen komutlardan oluşan bir listeyle çalıştırıldığı doğrulanmalıdır.2V1.2.99Düzenli ifadelerde (regex) özel karakterlerin (genellikle ters eğik çizgi \ ile) kaçırılarak meta karakter olarak yorumlanmalarının önlendiği doğrulanmalıdır.2V1.2.1010Uygulamanın CSV ve formül enjeksiyonlarına karşı korunduğu doğrulanmalıdır. Uygulama, CSV içeriği dışa aktarırken RFC 4180 Bölüm 2.6 ve 2.7'de tanımlanan kaçış kurallarına uymalıdır. Ayrıca, CSV veya diğer tablo formatlarına (XLS, XLSX, ODF gibi) aktarım yapılırken, alanın ilk karakteri olarak çıkan özel karakterler ('=', '+', '-', '@', '\t' (sekme), '\0' (null karakter)) tek tırnak (') ile kaçırılmalıdır.3V1.33Temizleme (Sanitization)V1.3.11WYSIWYG editörlerinden veya benzer kaynaklardan gelen tüm güvenilmeyen HTML girdilerinin, bilinen ve güvenli bir HTML temizleme kütüphanesi ya da çerçeve özelliği ile temizlendiği doğrulanmalıdır.1V1.3.22Uygulamanın eval() veya Spring Expression Language (SpEL) gibi dinamik kod çalıştırma özelliklerini kullanmaktan kaçındığı doğrulanmalıdır. Alternatif yoksa, kullanıcı girdisi çalıştırılmadan önce mutlaka temizlenmelidir.1V1.3.33Potansiyel olarak tehlikeli bir bağlamda kullanılacak verilerin, bu bağlama uygun karakterlere izin vermek ve çok uzun girdileri kısaltmak gibi güvenlik önlemleriyle önceden temizlendiği doğrulanmalıdır.2V1.3.44Kullanıcı tarafından sağlanan SVG içeriğinin, yalnızca güvenli etiket ve özellikler (örneğin grafik çizme ile ilgili) içerdiğinden emin olmak için onaylandığı veya temizlendiği doğrulanmalıdır (ör. script veya foreignObject içermemelidir).2V1.3.55Markdown, CSS, XSL stil sayfaları, BBCode veya benzeri ifade şablon dillerinde kullanıcı girdisinin temizlendiği veya bu tür özelliklerin devre dışı bırakıldığı doğrulanmalıdır.2V1.3.66Uygulamanın, güvenilmeyen verileri başka servislere iletmeden önce izinli protokol, alan adı, yol ve port listelerine göre doğruladığı ve tehlikeli karakterleri temizlediği doğrulanarak SSRF (Sunucu Taraflı İstek Sahteciliği) saldırılarına karşı korunduğu doğrulanmalıdır.2V1.3.77Uygulamanın şablon enjeksiyon saldırılarına karşı, güvenilmeyen girdilere dayalı şablon oluşturmayı engellediği; eğer bu kaçınılmazsa, bu girdilerin mutlaka temizlendiği veya sıkı şekilde onaylandığı doğrulanmalıdır.2V1.3.88JNDI sorgularında kullanılmadan önce güvenilmeyen girdilerin temizlendiği ve JNDI'nin enjeksiyonlara karşı güvenli şekilde yapılandırıldığı doğrulanmalıdır.2V1.3.99Memcache’e gönderilmeden önce içeriğin temizlenerek enjeksiyon saldırılarına karşı korunduğu doğrulanmalıdır.2V1.3.1010Format dizgilerinin (format strings) beklenmeyen veya zararlı şekilde çözümlenmesini önlemek için işlenmeden önce temizlendiği doğrulanmalıdır.2V1.3.1111SMTP veya IMAP enjeksiyonlarını önlemek için, kullanıcı girdisinin posta sistemlerine iletilmeden önce temizlendiği doğrulanmalıdır.2V1.3.1212Regex girdilerinin üstel geri izlemeye (exponential backtracking) neden olan öğeler içermediği ve güvenilmeyen girdilerin ReDoS (Regex Denial of Service) gibi saldırılara karşı temizlendiği doğrulanmalıdır.3V1.44Bellek, Dizgi ve Yönetilmeyen KodV1.4.11Yığın, arabellek (buffer) veya yığın belleği taşmalarını önlemek ya da tespit etmek amacıyla, bellek güvenli dizgi işlemlerinin, daha güvenli bellek kopyalama ve işaretçi aritmetiğinin kullanıldığı doğrulanmalıdır.2V1.4.22Tamsayı taşmalarını önlemek için işaret (sign), aralık (range) ve giriş doğrulama tekniklerinin kullanıldığı doğrulanmalıdır.2V1.4.33Dinamik olarak ayrılan belleğin ve kaynakların serbest bırakıldığı ve boşaltılan belleklere ait referansların veya işaretçilerin kaldırıldığı veya null yapıldığı doğrulanmalıdır (dangling pointer ve use-after-free zafiyetlerine karşı).2V1.55Güvenli Ters Serileştirme (Safe Deserialization)V1.5.11XML ayrıştırıcılarının (parser) kısıtlayıcı şekilde yapılandırıldığı ve dış varlık çözümleme (external entity resolution) gibi güvensiz özelliklerin XXE (XML eXternal Entity) saldırılarına karşı devre dışı bırakıldığı doğrulanmalıdır .1V1.5.22Güvenilmeyen verilerin ters serileştirilmesinde, nesne türleri için izinli liste kullanımı veya istemci tanımlı nesne türlerinin kısıtlanması gibi güvenli giriş işleme önlemlerinin uygulandığı doğrulanmalıdır. Güvensiz olarak tanımlanmış ters serileştirme mekanizmaları, güvenilmeyen girdilerle kullanılmamalıdır.2V1.5.33Aynı veri türü için uygulamada kullanılan farklı parser'ların (ör. JSON, XML, URL parser'ları), veriyi tutarlı şekilde ayrıştırdığı ve aynı karakter kodlamasını kullandığı doğrulanmalıdır. Böylece JSON birlikte çalışabilirlik açıkları, URI veya dosya ayrıştırma farkları gibi sorunlar nedeniyle RFI veya SSRF saldırılarının istismar edilmesi önlenir.3V22ValidationDoğrulama ve İş MantığıV2.11Doğrulama ve İş Mantığı DokümantasyonuV2.1.11Uygulama dokümantasyonunda, veri öğelerinin beklenen yapıya göre nasıl doğrulanacağına ilişkin giriş doğrulama kurallarının tanımlandığı doğrulanmalıdır. Bu; kredi kartı numaraları, e-posta adresleri, telefon numaraları gibi yaygın veri biçimleri olabileceği gibi iç sistemlere özel biçimler de olabilir.1V2.1.22Uygulama dokümantasyonunda, birleştirilmiş veri öğelerinin mantıksal ve bağlamsal tutarlılığının nasıl doğrulanacağı tanımlanmalıdır (örneğin, mahalle ve posta kodunun eşleşip eşleşmediğinin kontrolü).2V2.1.33Hem kullanıcı bazında hem de uygulama genelinde geçerli olacak şekilde, iş mantığı sınırları ve doğrulama beklentilerinin belgelendiği doğrulanmalıdır.2V2.22Girdi DoğrulamaV2.2.11Girdilerin, işlevsel ya da iş gereksinimlerine uygunluğunun doğrulandığı teyit edilmelidir. Bu işlem; izinli değerler, desenler ve aralıklar listesine karşı pozitif doğrulama ile ya da girdinin beklenen yapıya ve mantıksal sınırlara uygunluğunun önceden tanımlanmış kurallara göre karşılaştırılması ile yapılmalıdır. Seviye 1 için bu, güvenlik veya iş kararlarında kullanılan girdilere odaklanabilir. Seviye 2 ve üstü için tüm girdilere uygulanmalıdır.1V2.2.22Uygulamanın, güvenilir bir servis katmanında girdi doğrulama zorunluluğu uygulayacak şekilde tasarlandığı doğrulanmalıdır. İstemci tarafında gerçekleştirilen doğrulama, kullanılabilirliği artırabilir ve teşvik edilmelidir. Ancak bu doğrulama,güvenlik kontrolü olarak kabul edilmemelidir.1V2.2.33Uygulamanın, ilişkili veri öğelerinin önceden tanımlanmış kurallara göre makul olup olmadığını kontrol ettiği doğrulanmalıdır.2V2.33İş Mantığı GüvenliğiV2.3.11Uygulamanın, aynı kullanıcı için iş mantığı akışlarını yalnızca beklenen adım sırasına göre ve adım atlamadan işlediği doğrulanmalıdır.1V2.3.22İş mantığı sınırlarının, uygulama dokümantasyonuna uygun şekilde uygulandığı doğrulanmalıdır.2V2.3.33İş mantığı seviyesinde işlemlerin (transaction) kullanıldığı ve bir iş mantığı işleminin ya bütünüyle başarıyla tamamlandığı ya da önceki geçerli duruma geri döndürüldüğü (rollback) doğrulanmalıdır.2V2.3.44İş mantığı düzeyinde kilitleme mekanizmalarının, sınırlı kaynakların (ör. sinema koltukları, teslimat zamanları) uygulamanın mantığı manipüle edilerek çift rezervasyona neden olmamasını sağladığı doğrulanmalıdır.2V2.3.55Yüksek değerli iş mantığı akışlarının, yetkisiz veya kazara gerçekleşebilecek işlemleri önlemek için çoklu kullanıcı onayı gerektirdiği doğrulanmalıdır. Bu işlemler büyük para transferleri, sözleşme onayları, gizli bilgilere erişim veya üretimde güvenlik kurallarının geçersiz kılınmaları gibi durumları içerebilir.3V2.44Otomasyon Karşıtı ÖnlemlerV2.4.11Uygulama işlevlerine yönelik aşırı miktardaki çağrılara karşı; veri sızdırma, anlamsız veri üretme, kota tüketme, hız sınırının aşılması, hizmet reddi (DoS) ya da maliyetli kaynakların aşırı kullanımı gibi risklere karşı otomasyon karşıtı kontrollerin bulunduğu doğrulanmalıdır.2V2.4.22İş mantığı akışlarının, aşırı hızlı işlem gönderimlerini önleyecek şekilde gerçekçi insan zamanlaması gerektirdiği doğrulanmalıdır.3V33WebWeb Ön Uç (Frontend) GüvenliğiV3.11Web Frontend Güvenlik DokümantasyonuV3.1.11Uygulama dokümantasyonunda, uygulamayı kullanan tarayıcıların desteklemesi gereken güvenlik özelliklerinin (ör. HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) ve diğer ilgili HTTP güvenlik mekanizmaları) tanımlandığı doğrulanmalıdır. Ayrıca bu özelliklerin mevcut olmadığı durumlarda uygulamanın nasıl davranması gerektiği (ör. kullanıcıyı uyarmak veya erişimi engellemek) de tanımlanmalıdır.3V3.22İçeriğin Yanlış YorumlanmasıV3.2.11Tarayıcıların HTTP yanıtlarında içerik veya işlevi yanlış bir bağlamda sunmalarını önlemek amacıyla güvenlik kontrollerinin uygulandığı doğrulanmalıdır (ör. API, kullanıcı tarafından yüklenen dosya veya başka bir kaynağın doğrudan çağrılması durumunda). Olası kontroller arasında; yalnızca HTTP istek başlıklarının (ör. Sec-Fetch-\*) doğru bağlamı gösterdiği durumlarda içeriğin sunulması, Content-Security-Policy başlığında "sandbox" yönergesinin kullanılması veya Content-Disposition başlığında "attachment" biçiminin kullanılması yer alabilir.1V3.2.22HTML yerine metin olarak görüntülenmesi amaçlanan içeriğin, HTML veya JavaScript gibi içeriklerin istenmeden çalıştırılmasını önleyecek şekilde "createTextNode" veya "textContent" gibi güvenli işleme fonksiyonlarıyla işlendiği doğrulanmalıdır.1V3.2.33Uygulamanın istemci tarafı JavaScript kullanırken açık değişken tanımlamaları yaparak, sıkı tür kontrolü uygulayarak, global değişkenleri document nesnesine kaydetmekten kaçınarak ve ad alanı izolasyonu sağlayarak DOM clobbering’den kaçındığı doğrulanmalıdır.3V3.33Çerez YapılandırmasıV3.3.11Çerezlerin 'Secure' niteliğine sahip olduğu ve eğer çerez adı '\__Host-' ön eki ile başlamıyorsa, '__Secure-' ön ekinin kullanıldığı doğrulanmalıdır.1V3.3.22Kullanıcı arayüzü kandırma saldırılarına ve tarayıcı tabanlı istek sahteciliği saldırılarına (CSRF) karşı koruma sağlamak amacıyla, her çerezin 'SameSite' niteliğinin kullanım amacına uygun şekilde ayarlandığı doğrulanmalıdır.2V3.3.33Çerez adı, diğer sunucularla paylaşılmak üzere açıkça tasarlanmadığı sürece '__Host-' ön eki ile tanımlanmalıdır.2V3.3.44Bir çerez değeri istemci tarafı betikleri tarafından erişilememesi gereken bir veri içeriyorsa (ör. oturum token'ı), çerezin 'HttpOnly' niteliğine sahip olduğu ve aynı değerin (ör. oturum token'ı) yalnızca 'Set-Cookie' başlığı ile istemciye iletildiği doğrulanmalıdır.2V3.3.55Uygulama bir çerez oluştururken, çerez adı ve değerinin toplam uzunluğunun 4096 baytı aşmadığı doğrulanmalıdır. Çok büyük çerezler tarayıcı tarafından saklanmaz ve isteklerle gönderilmez; bu da çereze bağlı çalışan uygulama işlevlerinin bozulmasına yol açabilir.3V3.44Tarayıcı Güvenlik Mekanizması Başlıkları (Header)V3.4.22Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header'ı, uygulama tarafından sabit bir değer olarak tanımlanmalı veya gelen Origin header değeri güvenilir origin’lerden oluşan bir izinli listeye karşı doğrulanmalıdır. ‘Access-Control-Allow-Origin: *’ kullanılması gerekiyorsa, yanıtın hassas bilgi içermediği doğrulanmalıdır.1V3.4.33HTTP yanıtlarında Content-Security-Policy header'ı bulunduğu ve bu header'ın yalnızca güvenilen içeriklerin veya kaynakların yüklenmesini ve çalıştırılmasını sağlayan yönergeler içerdiği doğrulanmalıdır. Minimum olarak "global policy", object-src 'none', base-uri 'none' yönergelerini içermeli ve izinli liste, nonce veya hash temelli bir yapı içermelidir. Seviye 3 uygulamalarında her yanıt için nonce veya hash içeren özel bir politika tanımlanmalıdır.2V3.4.44Tüm HTTP yanıtlarının 'X-Content-Type-Options: nosniff' header'ını içerdiği doğrulanmalıdır. Bu, tarayıcıya içerik türünü tahmin etmeyi bırakmasını ve yanıtın Content-Type header'ında belirtilen MIME türünün, beklenen kaynak türüyle eşleşmesini zorunlu kılar. Ayrıca bu, tarayıcıda CORB (Cross-Origin Read Blocking) özelliğini etkinleştirir.2V3.4.55Uygulamanın, 'Referer' başlığı yoluyla üçüncü taraflara teknik olarak hassas verilerin sızmasını önlemek için bir 'referrer policy' belirlediği doğrulanmalıdır. Bu, Referrer-Policy HTTP header'ıyla veya HTML öğe nitelikleriyle (element attributes) sağlanabilir. Sızabilecek hassas bilgiler, URL’deki yol ve sorgu parametreleri ile sınırlı uygulamalarda hostname bilgisini içerebilir.2V3.4.66Uygulamanın, Content-Security-Policy header'ı altında 'frame-ancestors' yönergesini her HTTP yanıtında tanımladığı ve bu sayede içeriklerin varsayılan olarak başka sayfalara gömülmesini engellediği doğrulanmalıdır. Gerekli durumlarda özel olarak izin verildiğinden emin olunmalıdır. 'X-Frame-Options' header'ı, tarayıcılar tarafından desteklenmesine rağmen, artık güncel değildir ve güvenlik amacıyla kullanılmamalıdır.2V3.4.88Bir belgenin işlenmesini ve sunulmasını başlatan tüm HTTP yanıtlarında (örneğin 'text/html' tipi yanıtlar), 'Cross-Origin-Opener-Policy' header'ı 'same-origin' veya 'same-origin-allow-popups' yönergeleriyle birlikte yer almalıdır. Bu, tabnabbing ve frame counting gibi, pencere nesnelerine paylaşımlı erişimi sömüren saldırılara karşı koruma sağlar.3V3.55Tarayıcı Menşei AyırımıV3.5.11Uygulama, hassas işlevselliğe yönelik izinsiz cross-origin istekleri önlemek için CORS preflight mekanizmasına güvenmiyorsa, bu tür isteklerin gerçekten uygulamadan geldiği doğrulanmalıdır. Bu, anti-forgery token kullanımı veya CORS tarafından güvenli kabul edilmeyen özel HTTP header'larının zorunlu kılınmasıyla yapılabilir. Bu, tarayıcı tabanlı istek sahteciliği (CSRF) saldırılarına karşı bir savunmadır.1V3.5.22Uygulama, hassas işlevlerin izinsiz cross-origin çağrılmasını önlemek için CORS preflight mekanizmasına güveniyorsa, bu işlevlerin bir CORS-preflight isteğini tetiklemeden çağrılamadığı doğrulanmalıdır. Bu, 'Origin' ve 'Content-Type' header'larının doğrulanmasını veya CORS-safelisted olmayan bir header'ın ve alanın kullanılmasını gerektirebilir.1V3.5.44Farklı uygulamaların farklı hostname'lerde barındırıldığı ve böylece Same-Origin Policy tarafından sağlanan kısıtlamalardan (örneğin çerez erişim sınırları, kaynaklar arası etkileşim kontrolleri) faydalanıldığı doğrulanmalıdır.2V3.5.66Uygulamanın herhangi bir yerinde JSONP işlevselliğinin etkin olmadığı doğrulanmalıdır. Bu, XSSI (Cross-Site Script Inclusion) saldırılarını önlemek içindir.3V3.5.77Yetkilendirme gerektiren verilerin, JavaScript dosyaları gibi betik kaynaklarının yanıtlarında yer almadığı, XSSI saldırılarını önlemek için doğrulanmalıdır.3V3.5.88Kimliği doğrulanmış kaynakların (örneğin görseller, videolar, betikler ve belgeler) yalnızca gerçekten amaçlandığında kullanıcı adına yüklenebildiği veya gömülebildiği doğrulanmalıdır. Bu, isteğin uygun olmayan bir çapraz kaynak çağrısından kaynaklanmadığından emin olmak için Sec-Fetch-* HTTP istek başlığı alanlarının sıkı bir şekilde doğrulanmasıyla veya tarayıcıya döndürülen içeriği engelleme talimatı vermek için kısıtlayıcı bir Cross-Origin-Resource-Policy HTTP yanıt başlığı alanı ayarlayarak gerçekleştirilebilir.3V3.66Harici Kaynak BütünlüğüV3.6.11JavaScript kütüphaneleri, CSS veya web fontları gibi istemci tarafı varlıkların yalnızca statik ve sürümlü olması, varlığın bütünlüğünü doğrulamak için Subresource Integrity (SRI) kullanılması durumunda harici olarak (örneğin, bir İçerik Dağıtım Ağı üzerinde) barındırıldığı doğrulanmalıdır. Bu mümkün değilse, her bir kaynak için bunu gerekçelendiren belgelenmiş bir güvenlik kararı bulunmalıdır.3V3.77Diğer Tarayıcı Güvenliği HususlarıV3.7.11Uygulamanın yalnızca hâlâ desteklenen ve güvenli kabul edilen istemci tarafı teknolojileri kullandığı doğrulanmalıdır. Bu gereksinimi karşılamayan teknolojilere örnek olarak NSAPI eklentileri, Flash, Shockwave, ActiveX, Silverlight, NACL veya istemci tarafı Java applet’leri verilebilir.2V3.7.22Uygulamanın, yalnızca hedef adres bir izinli listede yer alıyorsa kullanıcıyı otomatik olarak farklı bir ana makine adına veya uygulamanın kontrolünde olmayan bir etki alanına yönlendirdiği doğrulanmalıdır.2V3.7.33Uygulamanın, kullanıcı uygulamanın kontrolü dışındaki bir URL’ye yönlendirildiğinde, yönlendirme hakkında bir bildirim gösterdiği ve kullanıcının bu gezintiyi iptal edebilmesi için bir seçenek sunduğu doğrulanmalıdır.3V3.7.44Uygulamanın en üst düzey etki alanının (örneğin, site.tld) HTTP Strict Transport Security (HSTS) için genel preload listesine eklendiği doğrulanmalıdır. Bu, uygulamanın TLS kullanımının ana tarayıcılar tarafından doğrudan tanınmasını ve yalnızca Strict-Transport-Security yanıt header'ına bağlı kalınmamasını sağlar.3V3.7.55Uygulamaya erişen tarayıcının beklenen güvenlik özelliklerini desteklememesi durumunda, uygulamanın dokümantasyona uygun şekilde davrandığı (örneğin kullanıcıyı uyarma veya erişimi engelleme) doğrulanmalıdır.3V44APIAPI ve Web ServisiV4.11Genel Web Servisi GüvenliğiV4.1.11İleti gövdesi içeren her HTTP yanıtında, yanıtın gerçek içeriğiyle eşleşen bir Content-Type header alanı bulunduğu ve güvenli karakter kodlamasını (örneğin, UTF-8, ISO-8859-1) belirtmek üzere charset parametresi içerdiği doğrulanmalıdır. Bu işlem, IANA Medya Türleri'nden "text/", "/+xml" ve "/xml" gibi içerikler için geçerlidir.1V4.1.22Yalnızca kullanıcı arayüzüne yönelik uç noktaların (manuel olarak web tarayıcısı ile erişilmesi amaçlanan) otomatik olarak HTTP'den HTTPS'e yönlendirme yaptığı ve diğer hizmetlerin veya uç noktaların şeffaf yönlendirme gerçekleştirmediği doğrulanmalıdır. Bu, istemcinin farkında olmadan şifrelenmemiş HTTP istekleri göndermesi ve bu isteklerin otomatik olarak HTTPS'e yönlendirilmesi sonucunda hassas verilerin sızmasının fark edilmemesi riskini önlemek içindir.2V4.1.33Uygulama tarafından kullanılan ve yük dengeleyici, web proxy veya frontend için backend hizmeti gibi bir ara katman tarafından ayarlanan herhangi bir HTTP başlık alanının, son kullanıcı tarafından geçersiz kılınamayacağı doğrulanmalıdır. Örnek başlıklar arasında X-Real-IP, X-Forwarded-* veya X-User-ID yer alabilir.2V4.1.44Uygulama veya API tarafından açıkça desteklenen HTTP yöntemlerinin (preflight istekleri sırasında OPTIONS dahil) dışında hiçbir yöntemin kullanılmadığı ve kullanılmayan yöntemlerin engellendiği doğrulanmalıdır.3V4.1.55Çok hassas istekler veya birçok sistemden geçen işlemler için, taşıma katmanı güvenliğinin üzerine ek bir güvence sağlamak amacıyla, her iletiye özel dijital imzaların kullanıldığı doğrulanmalıdır.3V4.22HTTP İleti Yapısı DoğrulamaV4.2.11Tüm uygulama bileşenlerinin (yük dengeleyiciler, güvenlik duvarları ve uygulama sunucuları dahil) HTTP sürümüne uygun mekanizmaları kullanarak gelen HTTP iletilerinin sınırlarını belirlediği ve bu sayede HTTP istek kaçakçılığına karşı koruma sağlandığı doğrulanmalıdır. HTTP/1.x sürümünde Transfer-Encoding başlık alanı varsa, RFC 2616'ya göre Content-Length başlığı göz ardı edilmelidir. HTTP/2 veya HTTP/3 kullanıldığında, Content-Length başlığı varsa, alıcının bu değerin DATA çerçevelerinin uzunluğuyla tutarlı olduğunu doğrulaması gerekir.2V4.2.22HTTP iletileri üretilirken, Content-Length başlığının, HTTP protokolünün çerçeveleme yöntemine göre belirlenen içerik uzunluğu ile çelişmediği doğrulanmalıdır. Bu, istek kaçakçılığı saldırılarını önlemek için gereklidir.3V4.2.33Uygulamanın, yanıt bölme ve header enjeksiyonu saldırılarını önlemek amacıyla, bağlantıya özel başlık alanları (örneğin Transfer-Encoding) içeren HTTP/2 veya HTTP/3 iletilerini göndermediği ve kabul etmediği doğrulanmalıdır.3V4.2.44Uygulamanın yalnızca başlık alanları ve değerleri CR (\r), LF (\n) veya CRLF (\r\n) karakter dizileri içermeyen HTTP/2 ve HTTP/3 isteklerini kabul ettiği doğrulanmalıdır. Bu, başlık enjeksiyonu saldırılarını önlemek içindir.3V4.2.55Uygulama (backend veya frontend) istek oluşturuyor ve gönderiyorsa, URI'ler (örneğin API çağrıları için) veya HTTP istek başlıkları (örneğin Authorization veya Cookie) gibi bileşenlerin, alıcı sistemler tarafından kabul edilemeyecek kadar uzun olmamasını sağlamak amacıyla doğrulama, temizleme veya diğer mekanizmaları kullandığı doğrulanmalıdır. Bu tür çok uzun istekler (örneğin çok uzun bir Cookie başlığı) gönderildiğinde sunucunun sürekli hata durumu döndürmesiyle hizmet reddi oluşabilir.3V4.33GraphQLV4.3.11Maliyetli ve iç içe geçmiş sorgular sonucu oluşabilecek GraphQL veya veri katmanı ifadelerine yönelik Hizmet Reddi (DoS) saldırılarını önlemek için, sorgu izin listesi (allowlist), derinlik sınırlandırması, sorgu sayısı sınırlandırması veya sorgu maliyeti analizi kullanıldığı doğrulanmalıdır.2V4.3.22GraphQL introspection (iç yapı sorgulama) sorgularının, GraphQL API'nin üçüncü taraflar tarafından kullanılmasına yönelik olmadığı sürece, üretim ortamında devre dışı bırakıldığı doğrulanmalıdır.2V4.44WebSocketV4.4.11Tüm WebSocket bağlantılarında TLS üzerinden WebSocket (WSS) kullanıldığı doğrulanmalıdır.1V4.4.22WebSocket'in başlangıçtaki HTTP el sıkışması (handshake) sırasında, Origin başlık alanının uygulama için izin verilen origin listesiyle karşılaştırılarak kontrol edildiği doğrulanmalıdır.2V4.4.33Uygulamanın standart oturum yönetimi kullanılamıyorsa, bunun yerine ilgili Oturum Yönetimi güvenlik gereksinimlerine uygun özel token'ların kullanıldığı doğrulanmalıdır.2V4.4.44HTTPS oturumu WebSocket kanalına geçerken, özel WebSocket oturum yönetim token’larının önceki şekilde kimliği doğrulanmış HTTPS oturumu aracılığıyla elde edildiği veya doğrulandığı doğrulanmalıdır.2V55FileDosya İşlemeV5.11Dosya İşleme DokümantasyonuV5.1.11Dokümantasyonun, her yükleme özelliği için izin verilen dosya türlerini, beklenen dosya uzantılarını ve maksimum boyutu (açılmış hali dahil) tanımladığı doğrulanmalıdır. Ayrıca, dosyaların son kullanıcılar için nasıl güvenli hâle getirileceği (örneğin kötü amaçlı bir dosya tespit edildiğinde uygulamanın nasıl davranacağı) gibi bilgilerin de belgede yer aldığı doğrulanmalıdır.2V5.22Dosya Yükleme ve İçerikV5.2.11Uygulamanın, yalnızca performans kaybına veya hizmet reddine yol açmayacak boyuttaki dosyaları kabul ettiği doğrulanmalıdır.1V5.2.22Uygulama bir dosyayı, doğrudan veya bir arşiv (ör. zip dosyası) içinde kabul ettiğinde, dosya uzantısının beklenen uzantıyla eşleşip eşleşmediğini kontrol ettiği ve içeriğin uzantı tarafından temsil edilen türle uyumlu olduğunu doğruladığı kontrol edilmelidir. Bu; ilk 'magic byte' kontrolü, görüntü yeniden yazımı ve dosya içeriği doğrulama için özel kütüphanelerin kullanımı gibi yöntemleri içerir. Seviye 1 için bu, yalnızca iş veya güvenlik kararlarında kullanılan dosyalarla sınırlı olabilir. Seviye 2 ve üzeri için tüm dosyalar bu kontrole tabi olmalıdır.1V5.2.33Sıkıştırılmış dosyaların (ör. zip, gz, docx, odt) açılmadan önce, izin verilen maksimum açılmış boyuta ve maksimum dosya sayısına göre kontrol edildiği doğrulanmalıdır.2V5.2.44Her kullanıcı için dosya boyutu kotası ve maksimum dosya sayısının uygulandığı doğrulanmalıdır. Böylece tek bir kullanıcının çok sayıda veya aşırı büyük dosya yükleyerek depolama alanını doldurması engellenir.3V5.2.55Uygulamanın, içinde sembolik bağlantılar (symlink) bulunan sıkıştırılmış dosyaların yüklenmesine yalnızca bu durum özel olarak gerekli olduğunda izin verdiği doğrulanmalıdır. Bu durumda, sembolik bağlantı verilebilecek dosyaların bir izinli listesi uygulanmalıdır.3V5.2.66Uygulamanın, piksel boyutu izin verilen maksimum değeri aşan görüntü dosyalarının yüklenmesini reddettiği doğrulanmalıdır. Bu, pixel flood saldırılarını önlemek için gereklidir.3V5.33Dosya DepolamaV5.3.11Güvenilmeyen girdilerle yüklenen veya oluşturulan ve herkese açık klasörlerde depolanan dosyaların, bir HTTP isteğiyle doğrudan erişildiğinde sunucu taraflı program kodu olarak çalıştırılmadığı doğrulanmalıdır.1V5.3.22Uygulamanın, dosya işlemleri için dosya yollarını oluştururken kullanıcı tarafından gönderilen dosya adlarını değil, dahili olarak oluşturulan veya güvenilir verileri kullandığı; eğer kullanıcı tarafından gönderilen dosya adları veya meta veriler kullanılacaksa, sıkı doğrulama ve temizleme işlemlerinin uygulandığı doğrulanmalıdır. Bu, yol geçişi (path traversal), yerel veya uzak dosya dahil etme (LFI, RFI) ve sunucu tarafı istek sahteciliği (SSRF) saldırılarına karşı koruma sağlar.1V5.3.33Sunucu tarafında gerçekleşen dosya işlemlerinin (örneğin dosya açma/decompress işlemi), kullanıcı tarafından sağlanan yol bilgilerini yok saydığı ve zip slip gibi güvenlik açıklarını önlediği doğrulanmalıdır.3V5.44Dosya İndirmeV5.4.11Uygulamanın, kullanıcı tarafından gönderilen dosya adlarını (ör. JSON, JSONP veya URL parametresinde) doğruladığı veya göz ardı ettiği ve yanıtın Content-Disposition başlık alanında bir dosya adı belirttiği doğrulanmalıdır.2V5.4.22Sunulan dosya adlarının (örneğin HTTP yanıt header'larında veya e-posta eklerinde), belge yapısını korumak ve enjeksiyon saldırılarını önlemek için kodlandığı veya temizlendiği (ör. RFC 6266’ya uygun) doğrulanmalıdır.2V5.4.33Güvenilmeyen kaynaklardan elde edilen dosyaların, bilinen kötü amaçlı içeriklerin sunulmasını önlemek amacıyla antivirüs tarayıcılarıyla tarandığı doğrulanmalıdır.2V66AuthenticationKimlik DoğrulamaV6.11Kimlik Doğrulama DokümantasyonuV6.1.11Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırılarına karşı oran sınırlama (rate limiting), otomasyon karşıtı önlemler ve uyarlanabilir yanıt gibi kontrollerin nasıl kullanıldığını açıklayan bir uygulama dokümantasyonu bulunduğu doğrulanmalıdır. Dokümantasyon, bu kontrollerin nasıl yapılandırıldığını ve kötü niyetli hesap kilitlemenin nasıl önlendiğini açıkça ortaya koymalıdır.1V6.1.22Parolalarda kullanılmasını önlemek amacıyla, bağlama özgü sözcüklerin (örneğin kurum adlarının permütasyonları, ürün adları, sistem tanımlayıcıları, proje kod adları, departman veya rol adları vb.) bulunduğu belgelenmiş bir liste mevcut olduğu doğrulanmalıdır.2V6.1.33Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, bunların tümünün belgelenmiş olduğu ve her yol için tutarlı şekilde uygulanması gereken güvenlik kontrolleri ile kimlik doğrulama gücünün tanımlandığı doğrulanmalıdır.2V6.22Parola GüvenliğiV6.2.11Kullanıcı tarafından belirlenen parolaların en az 8 karakter uzunluğunda olması sağlanmalı, ancak 15 karakter ve üzeri uzunlukta parolalar olmaları şiddetle tavsiye edilir.1V6.2.22Kullanıcıların parolalarını değiştirebilmeleri sağlanmalıdır.1V6.2.33Parola değiştirme işlevinin hem mevcut hem de yeni parolayı gerektirdiği doğrulanmalıdır.1V6.2.44Kayıt veya parola değişimi sırasında girilen parolaların, uygulamanın parola politikasına (örneğin minimum uzunluk) uyan ilk 3000 yaygın parolaya karşı kontrol edildiği doğrulanmalıdır.1V6.2.55Her tür karakterin kullanılmasına izin verildiği ve büyük/küçük harf, sayı veya özel karakter şartlarının zorunlu tutulmadığı doğrulanmalıdır.1V6.2.66Parola giriş alanlarının, girdiyi maskelemek için "type=password" kullandığı doğrulanmalıdır. Uygulamalar, kullanıcının tüm maskelenmiş parolayı ya da son girilen karakteri geçici olarak görüntülemesine izin verebilir.1V6.2.77"Yapıştır" özelliğinin, tarayıcı parola yardımcılarının ve harici parola yöneticilerinin kullanımına izin verildiği doğrulanmalıdır.1V6.2.88Uygulamanın, kullanıcıdan aldığı parolayı herhangi bir şekilde değiştirmeden, örneğin kesmeden veya harf büyüklüğünü değiştirmeden, tam olarak doğruladığı teyit edilmelidir.1V6.2.99En az 64 karakter uzunluğundaki parolalara izin verildiği doğrulanmalıdır.2V6.2.1010Kullanıcının parolasının, yalnızca ele geçirildiği tespit edildiğinde veya kullanıcı tarafından yenilendiğinde geçerliliğini yitirdiği doğrulanmalıdır. Uygulama, belirli aralıklarla parola yenilenmesini zorunlu kılmamalıdır.2V6.2.1111Tahmin edilmesi kolay parolaların oluşturulmasını önlemek amacıyla, bağlama özgü kelimelerin yer aldığı belgelenmiş listenin parola doğrulamada kullanıldığı teyit edilmelidir.2V6.2.1212Kayıt veya parola değişikliği sırasında girilen parolaların, ele geçirilmiş parolalar listesine karşı kontrol edildiği doğrulanmalıdır.2V6.33Genel Kimlik Doğrulama GüvenliğiV6.3.11Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırıları gibi saldırıları önlemeye yönelik kontrollerin, uygulamanın güvenlik dokümantasyonuna göre uygulandığı doğrulanmalıdır.1V6.3.22"root", "admin" veya "sa" gibi varsayılan kullanıcı hesaplarının uygulamada yer almadığı veya devre dışı bırakıldığı doğrulanmalıdır.1V6.3.33Uygulamaya erişim için ya çok faktörlü bir kimlik doğrulama mekanizması ya da tek faktörlü mekanizmaların kombinasyonu kullanılmalıdır. Seviye 3 için, bu faktörlerden biri, oltalama saldırılarına karşı direnç sağlayan ve kimlik doğrulama niyetini bir kullanıcı etkileşimi (örneğin FIDO donanım anahtarında bir düğmeye basma veya mobil telefonda bir onay) gerektirerek doğrulayan donanım tabanlı bir kimlik doğrulayıcı olmalıdır. Bu gereksinimdeki herhangi bir esneklik için, gerekçesi belgelenmiş ve riskleri azaltıcı kapsamlı kontroller içeren bir plan gereklidir.2V6.3.44Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, belgelendirilmemiş bir yol bulunmadığı ve tüm yollar için güvenlik kontrolleri ile kimlik doğrulama gücünün tutarlı şekilde uygulandığı doğrulanmalıdır.2V6.3.55Başarılı veya başarısız şüpheli kimlik doğrulama girişimlerinin kullanıcıya bildirildiği doğrulanmalıdır. Bu, olağandışı bir konum veya istemciden gelen girişimler, yalnızca bir faktörle yapılan kısmen başarılı doğrulamalar, uzun süreli inaktiflik sonrası yapılan girişimler veya birçok başarısız denemeden sonraki başarılı girişimler gibi durumları içerebilir.3V6.3.66E-postanın, tek faktörlü ya da çok faktörlü kimlik doğrulama mekanizması olarak kullanılmadığı doğrulanmalıdır.3V6.3.77Kimlik doğrulama detaylarında yapılan güncellemeler sonrasında (örneğin kimlik bilgisi sıfırlama, kullanıcı adı veya e-posta adresi değişiklikleri), kullanıcıların bilgilendirildiği doğrulanmalıdır.3V6.3.88Başarısız kimlik doğrulama girişimlerinden, geçerli kullanıcıların hata mesajları, HTTP yanıt kodları veya farklı yanıt süreleri gibi sonuçlara dayanarak tespit edilemediği doğrulanmalıdır. Bu koruma, kayıt ve "parolamı unuttum" işlevselliğinde de geçerli olmalıdır.3V6.44Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve KurtarmaV6.4.11Sistem tarafından oluşturulan ilk parolaların veya etkinleştirme kodlarının güvenli bir şekilde rastgele üretildiği, mevcut parola politikasına uygun olduğu, kısa bir süre içinde veya ilk kullanım sonrasında geçerliliğini yitirdiği doğrulanmalıdır. Bu başlangıç sırları uzun vadeli parola olarak kullanılmasına izin verilmemelidir.1V6.4.22Parola ipuçlarının veya "gizli sorular" olarak bilinen, bilgiye dayalı kimlik doğrulama mekanizmalarının mevcut olmadığı doğrulanmalıdır.1V6.4.33Unutulmuş parolanın sıfırlanması için, etkin olan çok faktörlü kimlik doğrulama mekanizmalarını atlamayan güvenli bir sürecin uygulandığı doğrulanmalıdır.2V6.4.44Çok faktörlü kimlik doğrulama faktörlerinden biri kaybolursa, kayıt sırasında uygulanan kimlik kanıtlama seviyesiyle aynı seviyede kimlik doğrulama yapıldığı doğrulanmalıdır.2V6.4.55Süresi dolacak kimlik doğrulama mekanizmalarının yenilenmesine ilişkin talimatların, süresi dolmadan önce tamamlanacak şekilde yeterli sürede gönderildiği ve gerekiyorsa otomatik hatırlatıcıların yapılandırıldığı doğrulanmalıdır.3V6.4.66Yönetici yetkisi olan kullanıcıların, kullanıcının parola sıfırlama sürecini başlatabildiği ancak kullanıcının yeni parolasını belirleyemediği veya değiştiremediği doğrulanmalıdır. Bu, yönetici yetkisi olan kullanıcıların, kullanıcı parolasını bilmesini engeller.3V6.55Çok Faktörlü Kimlik Doğrulama İçin Genel GereksinimlerV6.5.11Arama sırları, bant dışı kimlik doğrulama istekleri veya kodları ve zamana dayalı tek kullanımlık parolaların (TOTP) yalnızca bir kez kullanılabildiği doğrulanmalıdır.2V6.5.22Uygulamanın backend tarafında saklanırken, 112 bitten az entropiye sahip (örneğin 19 rastgele harf-rakam karakteri veya 34 rastgele rakam) arama sırlarının, 32-bit rastgele bir salt içeren onaylı bir parola saklama algoritmasıyla hash’lendiği doğrulanmalıdır. Gizli bilginin entropisi 112 bit veya daha fazlaysa standart bir hash fonksiyonu kullanılabilir.2V6.5.33Arama sırları, bant dışı kimlik doğrulama kodları ve zamana dayalı tek kullanımlık parola seed'lerinin, öngörülebilir değerlerden kaçınmak için Kriptografik Olarak Güvenli Sözde Rastgele Sayı Üreteci (CSPRNG) ile oluşturulduğu doğrulanmalıdır.2V6.5.44Arama sırlarının ve bant dışı kimlik doğrulama kodlarının en az 20 bit entropiye (genellikle 4 rastgele harf-rakam karakteri veya 6 rastgele rakam) sahip olduğu doğrulanmalıdır.2V6.5.55Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının ve zamana dayalı tek kullanımlık parolaların (TOTP) belirli bir ömre sahip olduğu doğrulanmalıdır. Bant dışı istekler en fazla 10 dakika, TOTP’ler ise en fazla 30 saniye geçerli olmalıdır.2V6.5.66Herhangi bir kimlik doğrulama faktörünün (fiziksel cihazlar dahil) çalınması veya kaybı durumunda iptal edilebildiği doğrulanmalıdır.3V6.5.77Biyometrik kimlik doğrulama mekanizmalarının yalnızca ikincil faktör olarak, “sahip olduğunuz bir şey” veya “bildiğiniz bir şey” ile birlikte kullanıldığı doğrulanmalıdır.3V6.5.88Zamana dayalı tek kullanımlık parolaların (TOTP) doğrulamasının, güvenilir bir hizmetten alınan zaman kaynağına dayanarak yapıldığı ve güvenilir olmayan veya istemci tarafından sağlanan zaman kaynağına dayanmadığı doğrulanmalıdır.3V6.66Bant Dışı Kimlik Doğrulama MekanizmalarıV6.6.11Tek kullanımlık parolaların (OTP) telefon veya SMS ile Public Switched Telephone Network (PSTN) üzerinden iletildiği kimlik doğrulama mekanizmalarının, yalnızca telefon numarası önceden doğrulanmışsa, alternatif daha güçlü yöntemler (örneğin TOTP) de sunuluyorsa ve kullanıcıya güvenlik riskleri hakkında bilgi veriliyorsa sunulduğu doğrulanmalıdır. Seviye 3 uygulamalar için telefon ve SMS seçenekleri sunulmamalıdır.2V6.6.22Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının, oluşturuldukları özgün kimlik doğrulama isteğiyle bağlantılı olduğu ve daha önceki ya da sonraki bir istek için kullanılamadığı doğrulanmalıdır.2V6.6.33Kod tabanlı bant dışı kimlik doğrulama mekanizmalarının, oran sınırlaması ile kaba kuvvet saldırılarına karşı korunduğu doğrulanmalıdır. En az 64 bit entropiye sahip kodlar kullanılması da değerlendirilmelidir.2V6.6.44Çok faktörlü kimlik doğrulama için push bildirimleri kullanılıyorsa, push bombing saldırılarına karşı oran sınırlamasının kullanıldığı doğrulanmalıdır. “Numara eşleştirme” de bu riski azaltabilir.3V6.77Kriptografik Kimlik Doğrulama MekanizmasıV6.7.11Kriptografik kimlik doğrulama beyanlarını doğrulamak için kullanılan sertifikaların, değiştirilmeye karşı korumalı şekilde saklandığı doğrulanmalıdır.3V6.7.22Challenge nonce değerinin en az 64 bit uzunluğunda olduğu ve istatistiksel olarak benzersiz ya da cihazın ömrü boyunca benzersiz olduğu doğrulanmalıdır.3V6.88Kimlik Sağlayıcısı ile Kimlik DoğrulamaV6.8.11Uygulama birden fazla kimlik sağlayıcıyı (IdP) destekliyorsa, başka bir desteklenen kimlik sağlayıcı aracılığıyla (örneğin aynı kullanıcı tanımlayıcısını kullanarak) kullanıcının kimliğinin taklit edilemediği doğrulanmalıdır. Standart önlem, uygulamanın kullanıcıyı IdP kimliği (bir ad alanı işlevi görür) ve IdP içindeki kullanıcı kimliğinin birleşimiyle kaydetmesi ve tanımlamasıdır.2V6.8.22Kimlik doğrulama beyanları üzerindeki dijital imzaların (örneğin JWT veya SAML beyanları) varlığı ve bütünlüğünün her zaman doğrulandığı ve imzasız veya geçersiz imzalı beyanların reddedildiği doğrulanmalıdır.2V6.8.33SAML beyanlarının benzersiz biçimde işlendiği ve yalnızca geçerlilik süresi içinde bir kez kullanıldığı, tekrar oynatma (replay) saldırılarını önlemek amacıyla doğrulanmalıdır.2V6.8.44Uygulama ayrı bir Kimlik Sağlayıcı (IdP) kullanıyorsa ve belirli işlemler için belirli kimlik doğrulama gücü, yöntemleri veya zaman bilgisi bekliyorsa, uygulamanın bu bilgileri IdP tarafından döndürülen veriler üzerinden doğruladığı teyit edilmelidir. Örneğin OIDC kullanılıyorsa, bu durum ID Token üzerindeki 'acr', 'amr' ve 'auth_time' gibi claim’lerin (varsa) doğrulanması ile sağlanabilir. Eğer IdP bu bilgileri sağlamıyorsa, uygulamanın asgari kimlik doğrulama gücünün kullanıldığını varsayan (örneğin yalnızca kullanıcı adı ve parola ile tek faktörlü doğrulama) belgelenmiş bir yedek yaklaşımı olmalıdır.2V77SessionOturum YönetimiV7.11Oturum Yönetim DokümantasyonuV7.1.11Kullanıcının oturum inaktivite zaman aşımı süresi ve mutlak maksimum oturum süresinin belgelendiği, diğer kontrollerle birlikte uygun olduğu ve NIST SP 800-63B yeniden kimlik doğrulama gereksinimlerinden herhangi bir sapma varsa gerekçesinin belgede yer aldığı doğrulanmalıdır.2V7.1.22Belgede bir hesap için kaç adet eşzamanlı (paralel) oturuma izin verildiği ile birlikte, maksimum aktif oturum sayısına ulaşıldığında uygulanacak davranış ve işlemlerin tanımlandığı doğrulanmalıdır.2V7.1.33Birleşik kimlik yönetim ekosisteminin bir parçası olarak kullanıcı oturumu oluşturan ve yöneten tüm sistemlerin, oturum ömrü, sonlandırma ve yeniden kimlik doğrulama gerektiren diğer koşulların nasıl koordine edildiğini açıklayan kontrollerle birlikte belgede yer aldığı doğrulanmalıdır.2V7.22Temel Oturum Yönetimi GüvenliğiV7.2.11Uygulamanın tüm oturum token'ı doğrulama işlemlerini güvenilir bir backend servisi aracılığıyla gerçekleştirdiği doğrulanmalıdır.1V7.2.22Uygulamanın, statik API gizli anahtarları veya sabit değerler yerine, oturum yönetimi için dinamik olarak oluşturulan kendi kendine yeterli veya referans token'ları kullandığı doğrulanmalıdır.1V7.2.33Uygulama kullanıcı oturumlarını temsil etmek için referans token'ları kullanıyorsa, bu token'ların benzersiz olduğu, kriptografik olarak güvenli bir sözde rastgele sayı üreteci (CSPRNG) kullanılarak üretildiği ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır.1V7.2.44Uygulamanın, kullanıcı kimlik doğrulaması (yeniden kimlik doğrulama dahil) sırasında yeni bir oturum token'ı oluşturduğu ve mevcut oturum token'ını sonlandırdığı doğrulanmalıdır.1V7.33Oturum Zaman AşımıV7.3.11Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde bir hareketsizlik zaman aşımı bulunduğu doğrulanmalıdır.2V7.3.22Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde mutlak bir maksimum oturum süresi bulunduğu doğrulanmalıdır.2V7.44Oturum SonlandırmaV7.4.11Oturum sonlandırma tetiklendiğinde (örneğin, çıkış yapıldığında veya süre dolduğunda), uygulamanın oturumun daha fazla kullanılmasına izin vermediği doğrulanmalıdır. Referans token'lar veya durum bilgili oturumlar için bu, oturum verilerinin uygulama arka ucunda geçersiz kılınması anlamına gelir. Kapsamlı token kullanan uygulamaların; sonlandırılmış token listesi tutmak, kullanıcıya özel tarih ve saatten önce oluşturulan token'ları reddetmek veya kullanıcıya özel imzalama anahtarını yenilemek gibi bir çözüm uygulaması gerekir.1V7.4.22Bir kullanıcı hesabı devre dışı bırakıldığında veya silindiğinde (örneğin bir çalışanın şirketten ayrılması), uygulamanın tüm aktif oturumları sonlandırdığı doğrulanmalıdır.1V7.4.33Herhangi bir kimlik doğrulama faktörünün başarılı bir şekilde değiştirilmesi veya kaldırılmasından (şifre sıfırlama veya kurtarma yoluyla yapılan değişiklikler dahil ve varsa MFA ayarları güncellemeleri dahil) sonra, uygulamanın diğer tüm aktif oturumları sonlandırma seçeneği sunduğu doğrulanmalıdır.2V7.4.44Kimlik doğrulama gerektiren tüm sayfalarda kolay erişilebilir ve görünür bir çıkış yap (logout) işlevi bulunduğu doğrulanmalıdır.2V7.4.55Uygulama yöneticilerinin, bireysel bir kullanıcının veya tüm kullanıcıların aktif oturumlarını sonlandırabilme yetkisine sahip olduğu doğrulanmalıdır.2V7.55Oturum Kötüye Kullanımına Karşı SavunmalarV7.5.11E-posta adresi, telefon numarası, MFA yapılandırması veya hesap kurtarmada kullanılan diğer bilgiler gibi kimlik doğrulamayı etkileyebilecek hassas hesap özniteliklerinde değişiklik yapılmadan önce uygulamanın tam yeniden kimlik doğrulama gerektirdiği doğrulanmalıdır.2V7.5.22Kullanıcıların, (en az bir faktörle yeniden kimlik doğrulama yaptıktan sonra) mevcut tüm aktif oturumları görüntüleyebilmesi ve sonlandırabilmesinin mümkün olduğu doğrulanmalıdır.2V7.5.33Uygulamanın, son derece hassas işlemler veya operasyonlar gerçekleştirilmeden önce en az bir faktörle ek kimlik doğrulaması veya ikincil bir doğrulama gerektirdiği doğrulanmalıdır.3V7.66Birleşik Yeniden Kimlik DoğrulamaV7.6.11Güvenen Taraf (RP) ile Kimlik Sağlayıcı (IdP) arasındaki oturum süresi ve oturum sonlandırma davranışlarının belgelenmiş olduğu ve, örneğin IdP kimlik doğrulama olayları arasında maksimum süreye ulaşıldığında yeniden kimlik doğrulamanın gerekli kılındığı doğrulanmalıdır.2V7.6.22Yeni bir oturum oluşturulmasının, kullanıcı onayı veya açık bir eylem gerektirdiği; kullanıcı etkileşimi olmaksızın yeni uygulama oturumlarının oluşturulmasının önlendiği doğrulanmalıdır.2V88AuthorizationYetkilendirmeV8.11Yetkilendirme DokümantasyonuV8.1.11Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak işlev düzeyinde ve veriye özel erişim kısıtlamaları için kuralları tanımladığı doğrulanmalıdır.1V8.1.22Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak alan (field) düzeyinde erişim kısıtlamaları (hem okuma hem yazma) için kuralları tanımladığı doğrulanmalıdır. Bu kuralların, ilgili veri nesnesinin durum veya statü gibi diğer özniteliklerine bağlı olabileceği unutulmamalıdır.2V8.1.33Uygulamanın dokümantasyonunun, kimlik doğrulama ve yetkilendirme ile ilgili güvenlik kararlarının alınmasında kullanılan çevresel ve bağlamsal öznitelikleri (günün saati, kullanıcı konumu, IP adresi veya cihaz gibi) tanımladığı doğrulanmalıdır.3V8.1.44Kimlik doğrulama ve yetkilendirme dokümantasyonunun; işlev düzeyinde, veriye özel ve alan düzeyinde yetkilendirmenin yanı sıra çevresel ve bağlamsal faktörlerin karar almada nasıl kullanıldığını tanımladığı doğrulanmalıdır. Bu, değerlendirilen öznitelikleri, risk eşiklerini ve alınan aksiyonları (ör. izin ver, doğrulama iste, reddet, step-up kimlik doğrulama) içermelidir.3V8.22Genel Yetkilendirme TasarımıV8.2.11Uygulamanın, işlev düzeyindeki erişimin yalnızca açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır.1V8.2.22Uygulamanın, veriye özel erişimin yalnızca belirli veri öğelerine açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, doğrudan nesne referansı güvenlik açıkları (IDOR) ve bozuk nesne düzeyinde yetkilendirme (BOLA) risklerini azaltır.1V8.2.33Uygulamanın, alan (field) düzeyindeki erişimin yalnızca belirli alanlara açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, bozuk nesne özelliği düzeyinde yetkilendirme (BOPLA) risklerini azaltır.2V8.2.44Tüketicinin çevresel ve bağlamsal özniteliklerine (ör. günün saati, konum, IP adresi veya cihaz) dayalı uyarlanabilir güvenlik kontrollerinin, uygulama dokümantasyonunda tanımlandığı şekilde, kimlik doğrulama ve yetkilendirme kararları için uygulandığı doğrulanmalıdır. Bu kontroller, tüketici yeni bir oturum başlatmaya çalışırken ve mevcut bir oturum sırasında uygulanmalıdır.3V8.33İşlem Düzeyinde YetkilendirmeV8.3.11Uygulamanın yetkilendirme kurallarını güvenilir bir servis katmanında uyguladığı ve istemci taraflı JavaScript gibi güvenilmeyen tüketiciler tarafından değiştirilebilecek kontrollerle yetinmediği doğrulanmalıdır.1V8.3.22Yetkilendirme kararlarının temelini oluşturan değerlerdeki değişikliklerin hemen uygulandığı doğrulanmalıdır. Değişikliklerin anında uygulanamadığı durumlarda (örneğin self-contained token içindeki verilere güveniliyorsa), tüketici artık yetkili olmadığı hâlde bir işlem gerçekleştirdiğinde uyarı verecek ve değişikliği geri alacak önlemler uygulanmalıdır. Bu alternatifin bilgi sızıntısını önlemeyeceği unutulmamalıdır.3V8.3.33Bir nesneye erişimin, herhangi bir aracı veya onun adına hareket eden bir servis yerine yalnızca erişimi başlatan öznenin (ör. tüketici) izinlerine dayandığı doğrulanmalıdır. Örneğin, bir tüketici kimlik doğrulama için bir self-contained token kullanarak bir web servis çağırırsa ve bu servis başka bir servisten veri talep ederse, ikinci servis izin kararlarını verirken birinci servisin makine-makine token'ı yerine tüketicinin token'ını kullanmalıdır.3V8.44Diğer Yetkilendirme HususlarıV8.4.11Multi-tenant uygulamaların, tüketici işlemlerinin izinli olmadıkları tenant'lar üzerinde asla etkili olmamasını sağlamak için tenant'lar arası kontroller kullandığı doğrulanmalıdır.2V8.4.22Yönetici arayüzlerine erişimin, sürekli tüketici kimlik doğrulaması, cihaz güvenlik durumu değerlendirmesi ve bağlamsal risk analizi dahil olmak üzere çok katmanlı güvenlik içerdiği doğrulanmalıdır. Yetkilendirme için yalnızca ağ konumu veya güvenilir uç noktalar yeterli olmamalıdır; ancak bu tür faktörler yetkisiz erişim olasılığını azaltabilir.3V99SelfKendi İçinde Taşıyıcı Token (Self-contained Token)V9.11Token Kaynağı ve BütünlüğüV9.1.11Self-contained token'ların içerikleri kabul edilmeden önce, oynama (tampering) saldırılarına karşı dijital imza veya MAC ile doğrulama yapıldığı doğrulanmalıdır.1V9.1.22Belirli bir bağlam için yalnızca bir allowlist üzerinde bulunan algoritmaların self-contained token oluşturmak ve doğrulamak için kullanılabildiği doğrulanmalıdır. Bu allowlist, yalnızca simetrik ya da yalnızca asimetrik algoritmaları içermeli ve kesinlikle 'None' algoritmasını içermemelidir. Hem simetrik hem de asimetrik algoritmalar desteklenmek zorundaysa, anahtar karışıklığını (key confusion) önlemek için ek kontroller uygulanmalıdır.1V9.1.33Self-contained token'ları doğrulamak için kullanılan anahtar malzemesinin, token issuer için önceden yapılandırılmış güvenilir kaynaklardan alındığı doğrulanmalıdır. Bu, saldırganların güvenilmeyen kaynak ve anahtarları belirtmesini engeller. JWT ve diğer JWS yapılarında 'jku', 'x5u' ve 'jwk' gibi header'lar güvenilir kaynaklardan oluşan bir allowlist'e göre doğrulanmalıdır.1V9.22Token İçeriğiV9.2.11Token verisinde bir geçerlilik zaman aralığı (validity time span) varsa, yalnızca doğrulama zamanı bu zaman aralığı içerisindeyse token ve içeriği kabul edilmelidir. Örneğin, JWT'ler için 'nbf' ve 'exp' claim'leri doğrulanmalıdır.1V9.2.22Token'ı alan hizmetin, token içeriğini kabul etmeden önce bu token'ın doğru türde olduğunu ve sunulma amacına uygun olduğunu doğruladığı teyit edilmelidir. Örneğin, yalnızca erişim token'ları yetkilendirme kararları için, yalnızca ID Token'lar kullanıcı kimlik doğrulamasını kanıtlamak için kullanılabilir.2V9.2.33Hizmetin yalnızca kendisiyle kullanılması amaçlanan (audience) token'ları kabul ettiği doğrulanmalıdır. JWT'lerde bu, 'aud' claim'inin hizmet içinde tanımlı bir allowlist ile doğrulanması yoluyla sağlanabilir.2V9.2.44Eğer bir token issuer, farklı audience'lara token oluşturmak için aynı private key'i kullanıyorsa, oluşturulan token'ların hedef audience'ları benzersiz şekilde tanımlayan bir audience kısıtlaması içerdiği doğrulanmalıdır. Bu, bir token'ın farklı bir audience ile yeniden kullanılmasını önler. Audience tanımlayıcısı dinamik olarak sağlanıyorsa, token issuer bu audience'ları doğrulamalı ve audience taklitlerinin (impersonation) önüne geçmelidir.2V1010OAuthOAuth ve OIDCV10.11Genel OAuth ve OIDC GüvenliğiV10.1.11Token'ların yalnızca kesinlikle ihtiyaç duyan bileşenlere gönderildiği doğrulanmalıdır. Örneğin, tarayıcı tabanlı JavaScript uygulamaları için bir backend-for-frontend modeli kullanıldığında, access ve refresh token'lara yalnızca backend'in erişebilmesi gerekir.2V10.1.22Authorization server'dan gelen değerler (örneğin authorization code veya ID Token gibi) yalnızca aynı user agent oturumu ve işlemi tarafından başlatılmış bir yetkilendirme akışının sonucuysa kabul edildiği doğrulanmalıdır. Bu, client tarafından oluşturulan secret’ların 'proof key for code exchange' (PKCE) ‘code_verifier’, ‘state’ veya OIDC ‘nonce’ gibi tahmin edilemez, işleme özgü ve hem client’a hem de işlem başlatılan user agent oturumuna güvenli bir şekilde bağlı olmasını gerektirir.2V10.22OAuth İstemcisiV10.2.11Code flow kullanılıyorsa, OAuth client’ın token taleplerini tetikleyen CSRF saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Bu genellikle PKCE kullanılarak veya authorization isteğinde gönderilen ‘state’ parametresinin kontrolü ile sağlanır.2V10.2.22OAuth istemcisi birden fazla AS ile etkileşime girebiliyorsa, mix-up saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Örneğin, authorization server’ın 'iss' parametresini döndürmesi zorunlu kılınabilir ve bu parametrenin hem authorization yanıtında hem de token yanıtında doğrulanması gerekir.2V10.2.33OAuth istemcisinin authorization server’a yaptığı taleplerde yalnızca gerekli scope’ları (veya diğer yetkilendirme parametrelerini) talep ettiği doğrulanmalıdır.3V10.33OAuth Kaynak Sunucusu (RS)V10.3.11RS'nin yalnızca bu servisle kullanılmak üzere tasarlanmış access token’ları kabul ettiği doğrulanmalıdır (audience kontrolü). Audience bilgisi yapılandırılmış token’larda (örneğin JWT içindeki ‘aud’ claim’i) yer alabilir veya token introspection endpoint aracılığıyla kontrol edilebilir.2V10.3.22RS'nin, access token’dan gelen claim’lere dayanarak yetki devri tanımına uygun şekilde yetkilendirme kararları uyguladığı doğrulanmalıdır. ‘sub’, ‘scope’ ve ‘authorization_details’ gibi claim’ler varsa, bu kararın parçası olmalıdır.2V10.3.33Erişim kontrolü kararında, access token’dan (JWT veya ilgili token introspection yanıtı) benzersiz bir kullanıcının tanımlanması gerekiyorsa, RS'nin başka kullanıcılara devredilemeyecek claim’ler ile kullanıcıyı tanımladığı doğrulanmalıdır. Genellikle bu, ‘iss’ ve ‘sub’ claim’lerinin birlikte kullanılması anlamına gelir.2V10.3.44RS'nin belirli bir kimlik doğrulama gücü, yöntemi veya güncelliği (recentness) gerektirmesi durumunda, sunulan access token’ın bu kısıtlamaları karşıladığını doğruladığı, örneğin, OIDC ‘acr’, ‘amr’ ve ‘auth_time’ claim’leri kullanılarak doğrulanmalıdır. 2V10.3.55RS'nin, (yetkisiz taraflarca) çalınmış veya tekrar edilen access token’ların kullanımını önlemek için sender-constrained access token’lar kullandığı doğrulanmalıdır. Bu, OAuth 2 için Mutual TLS veya OAuth 2 Demonstration of Proof of Possession (DPoP) ile sağlanabilir.3V10.44OAuth Yetkilendirme Sunucusu (AS)V10.4.11AS'nin, istemciye özel önceden kaydedilmiş URI’lerden oluşan bir allowlist kullanarak redirect URI’leri tam dize karşılaştırması ile doğruladığı doğrulanmalıdır.1V10.4.22AS'nin, "authorization response" içinde "authorization code" döndürdüğü durumlarda, bu kodun yalnızca bir kez kullanılabildiği doğrulanmalıdır. Daha önce access token vermek için kullanılmış bir authorization code ile yapılan ikinci geçerli token isteği reddedilmeli ve ilgili tüm token’lar iptal edilmelidir.1V10.4.33Authorization code’un kısa ömürlü olduğu doğrulanmalıdır. L1 ve L2 uygulamalar için maksimum yaşam süresi 10 dakika, L3 uygulamalar için 1 dakikadır.1V10.4.44Belirli bir istemci için AS'nin yalnızca o istemcinin ihtiyaç duyduğu grant türlerine izin verdiği doğrulanmalıdır. "Token" (Implicit flow) ve "password" (Resource Owner Password Credentials flow) grant türlerinin artık kullanılmaması gerekir.1V10.4.55AS'nin, açık istemciler için refresh token replay saldırılarını azalttığı doğrulanmalıdır. Tercihen sender-constrained refresh token’lar (DPoP veya mutual TLS ile certificate-bound access token’lar) kullanılmalıdır. L1 ve L2 uygulamalar için refresh token rotation kullanılabilir. Rotation kullanılıyorsa, AS refresh token’ı kullanım sonrası geçersiz kılmalı ve geçersiz bir refresh token sunulması durumunda o yetkilendirme ile ilişkili tüm refresh token’ları iptal etmelidir.1V10.4.66Code grant kullanılıyorsa, AS'nin authorization code interception saldırılarına karşı koruma sağladığı doğrulanmalıdır. Yetkilendirme isteğinde geçerli bir "code_challenge" değeri zorunlu olmalı ve "code_challenge_method" olarak "plain" kabul edilmemelidir. Token isteğinde ise "code_verifier" parametresi doğrulanmalıdır.2V10.4.77AS'nin, kimlik doğrulaması yapılmamış dinamik istemci kaydını desteklemesi durumunda, kötü niyetli istemci uygulamalarına karşı riskleri azalttığı doğrulanmalıdır. Kayıtlı URI’ler gibi client metadata’sı doğrulanmalı, kullanıcı onayı alınmalı ve güvenilmeyen bir client uygulamasıyla yapılan yetkilendirme isteği işlenmeden önce kullanıcı uyarılmalıdır.2V10.4.88Refresh token’ların, sliding expiration kullanılsa bile mutlak bir sona erme süresine sahip olduğu doğrulanmalıdır.2V10.4.99Yetkili bir kullanıcı tarafından AS kullanıcı arayüzü üzerinden refresh token’ların ve reference access token’ların iptal edilebildiği doğrulanmalıdır.2V10.4.1010Gizli istemcilerin token istekleri, pushed authorization request (PAR) ve token iptal istekleri gibi server’a yapılan backchannel isteklerinde kimliğinin kontrol edildiği doğrulanmalıdır.2V10.4.1111AS yapılandırmasının, OAuth istemcisine yalnızca gerekli scope’ları atadığı doğrulanmalıdır.2V10.4.1212Belirli bir client için, authorization server’ın yalnızca client’ın ihtiyaç duyduğu 'response_mode' değerine izin verdiği doğrulanmalıdır. Örneğin, bu değer ya beklenenlerle karşılaştırılarak doğrulanmalı ya da PAR veya JAR kullanılmalıdır.3V10.4.1313"Code" grant türünün daima pushed authorization request (PAR) ile birlikte kullanıldığı doğrulanmalıdır.3V10.4.1414AS'nin yalnızca sender-constrained (Proof-of-Possession) access token’lar ürettiği doğrulanmalıdır. Bu, mutual TLS ile certificate-bound access token ya da DPoP ile DPoP-bound access token olabilir.3V10.4.1515Sunucu taraflı istemciler için (kullanıcı cihazında çalışmayan), AS'nin "authorization_details" parametresinin istemci backend'i tarafından sağlandığını ve kullanıcı tarafından değiştirilmediğini doğruladığı, örneğin pushed authorization request (PAR) or JWT-secured Authorization Request (JAR) zorunlu kılınarak doğrulanmalıdır.3V10.4.1616Bir istemci gizli ise, AS'nin güçlü istemci kimlik doğrulama yöntemlerini zorunlu kıldığı doğrulanmalıdır. Bu yöntemler, public-key cryptography’ye dayalı ve replay saldırılarına karşı dayanıklı olmalı, örneğin mutual TLS ("tls_client_auth", "self_signed_tls_client_auth") veya private key JWT ("private_key_jwt") gibi.3V10.55OIDC İstemcisiV10.5.11İstemcinin (relying party olarak) ID Token replay saldırılarını azalttığı doğrulanmalıdır. Örneğin, ID Token’daki 'nonce' claim’inin, OpenID Provider’a gönderilen kimlik doğrulama isteğindeki 'nonce' değeriyle eşleştiği doğrulanmalıdır.2V10.5.22İstemcinin kullanıcıyı ID Token claim’lerinden (genellikle, başka kullanıcılarla yeniden atanamayan 'sub' claim’i) benzersiz şekilde tanımladığı doğrulanmalıdır.2V10.5.33İstemcinin, kötü niyetli bir AS'nin başka bir AS'yi taklit etmesini AS metadata’sı üzerinden reddettiği doğrulanmalıdır. AS metadata’sındaki issuer URL’si, istemci tarafından beklenen önceden yapılandırılmış issuer URL’siyle tam olarak eşleşmiyorsa, metadata reddedilmelidir.2V10.5.44İstemcinin, ID Token’ın kendisi için (audience) kullanılması amaçlandığını doğruladığı doğrulanmalıdır. Bu, token’daki 'aud' claim’inin istemcinin 'client_id' değeriyle eşit olup olmadığının kontrol edilmesiyle yapılır.2V10.5.55OIDC back-channel logout kullanıldığında, relying party’nin "forced logout" ve "logout" akışında "cross-JWT confusion" gibi saldırılara karşı koruma sağladığı doğrulanmalıdır. Client, logout token’ın 'logout+jwt' türünde olduğunu, 'event' claim’inin doğru üyeye sahip olduğunu ve 'nonce' claim’i içermediğini doğrulamalıdır. Ayrıca token için kısa bir sona erme süresi (örneğin 2 dakika) önerilir.2V10.66OpenID ProviderV10.6.11OpenID Provider’ın yalnızca 'code', 'ciba', 'id_token' veya 'id_token code' response mode değerlerine izin verdiği doğrulanmalıdır. 'code' değeri, 'id_token code' (OIDC Hybrid flow) yerine tercih edilmelidir. 'token' (Implicit flow) kullanılmamalıdır.2V10.6.22OpenID Provider’ın forced logout yoluyla yapılan hizmet reddi saldırılarını önlediği doğrulanmalıdır. Bu, son kullanıcıdan açık onay alınarak veya varsa logout isteğinde (relying party tarafından başlatılan) bulunan parametrelerin, örneğin 'id_token_hint', doğrulanmasıyla yapılabilir.2V10.77Onay (Consent) YönetimiV10.7.11AS'nin her yetkilendirme isteği için kullanıcının onayını aldığı doğrulanmalıdır. İstemcinin kimliği garanti altına alınamıyorsa, AS daima kullanıcıdan açıkça onay istemelidir.2V10.7.22AS'nin kullanıcıdan onay istediğinde, neye onay verildiğini açık ve yeterli şekilde gösterdiği doğrulanmalıdır. Uygun olduğunda bu bilgiler, istenen yetkilendirmelerin doğasını (genellikle scope, resource server, RAR gibi detaylara dayalı), yetkilendirilmiş uygulamanın kimliğini ve bu yetkilendirmelerin süresini içermelidir.2V10.7.33Kullanıcının, AS üzerinden verdiği onayları görüntüleyebildiği, değiştirebildiği ve iptal edebildiği doğrulanmalıdır.2V1111CryptographyKriptografiV11.11Kriptografik Envanter ve DokümantasyonV11.1.11Kriptografik anahtarların yönetimi için belgelenmiş bir politika ve NIST SP 800-57 gibi bir anahtar yönetim standardını izleyen bir kriptografik anahtar yaşam döngüsü tanımlandığı doğrulanmalıdır. Bu, anahtarların aşırı miktarda paylaşılmadığını (örneğin, paylaşılan sırlar için ikiden fazla tarafla veya özel anahtarlar için birden fazla tarafla) garanti altına almalıdır.2V11.1.22Tüm kriptografik anahtarlar, algoritmalar ve uygulama tarafından kullanılan sertifikaları içeren bir kriptografik envanterin oluşturulduğu, sürdürüldüğü ve düzenli olarak güncellendiği doğrulanmalıdır. Bu envanter ayrıca, sistemde anahtarların nerede kullanılabileceğini ve kullanılamayacağını, ve hangi veri türlerinin bu anahtarlarla korunup korunamayacağını da belgelemelidir.2V11.1.33Sistem içerisinde şifreleme, özetleme ve imzalama işlemleri dahil olmak üzere kriptografi kullanımının tüm örneklerini tespit etmek için kriptografik keşif mekanizmalarının kullanıldığı doğrulanmalıdır.3V11.1.44Kriptografik bir envanterin sürdürüldüğü doğrulanmalıdır. Bu envanter, gelecekteki tehditlere karşı tepki verebilmek amacıyla post-kuantum kriptografiye geçiş yolunu belirten belgelenmiş bir plan içermelidir.3V11.22Güvenli Kriptografi UygulamasıV11.2.11Kriptografik işlemler için sektör tarafından doğrulanmış uygulamaların (kütüphaneler ve donanım hızlandırmalı uygulamalar dahil) kullanıldığı doğrulanmalıdır.2V11.2.22Uygulamanın, rastgele sayı üreticileri, kimliği doğrulanmış şifreleme, MAC veya özetleme algoritmaları, anahtar uzunlukları, turlar, şifreler ve modların herhangi bir zamanda yeniden yapılandırılabilir, yükseltilebilir veya değiştirilebilir olacağı şekilde kripto çevikliği (crypto agility) ile tasarlandığı doğrulanmalıdır. Aynı şekilde, anahtarların ve parolaların değiştirilebilmesi ve verilerin yeniden şifrelenebilmesi mümkün olmalıdır. Bu, onaylanmış PQC şemalarının yüksek güvenlikli uygulamaları yaygın olarak kullanılabilir hale geldiğinde sorunsuz geçişe olanak tanır.2V11.2.33Tüm kriptografik ilkeliklerin, algoritma, anahtar boyutu ve yapılandırmaya göre minimum 128 bit güvenlik sağladığı doğrulanmalıdır. Örneğin, 256-bit ECC anahtarı yaklaşık 128 bit güvenlik sağlarken, RSA için aynı güvenliği elde etmek 3072-bit anahtar gerektirir.2V11.2.44Tüm kriptografik işlemlerin sabit süreli (constant-time) olduğu, karşılaştırmalarda, hesaplamalarda veya geri dönüşlerde kısa devre (short-circuit) işlemleri yapılmadığı doğrulanmalıdır; bu, bilgi sızıntısını önlemek için gereklidir.3V11.2.55Tüm kriptografik modüllerin güvenli şekilde hata verdiği ve hataların, padding oracle saldırıları gibi zafiyetleri mümkün kılmayacak şekilde ele alındığı doğrulanmalıdır.3V11.33Şifreleme AlgoritmalarıV11.3.11Güvensiz blok modlarının (örneğin, ECB) ve zayıf doldurma (padding) şemalarının (örneğin, PKCS#1 v1.5) kullanılmadığı doğrulanmalıdır.1V11.3.22Yalnızca AES ile GCM gibi onaylı şifreleme algoritmalarının ve modlarının kullanıldığı doğrulanmalıdır.1V11.3.33Şifrelenmiş verilerin yetkisiz değişikliklere karşı korunduğu doğrulanmalıdır. Tercihen bu koruma, onaylı bir kimliği doğrulanmış şifreleme yöntemi kullanılarak ya da onaylı bir şifreleme yöntemi ile onaylı bir MAC algoritmasının kombinasyonu ile sağlanmalıdır.2V11.3.44Sayılar, başlatma vektörleri (IV) ve diğer tek kullanımlık değerlerin, aynı şifreleme anahtarı ve veri öğesi çifti için birden fazla kez kullanılmadığı doğrulanmalıdır. Oluşturma yöntemi kullanılan algoritmaya uygun olmalıdır.3V11.3.55Şifreleme algoritması ve MAC algoritması kombinasyonlarının "encrypt-then-MAC" modunda çalıştığı doğrulanmalıdır.3V11.44Hashing ve Hash Tabanlı FonksiyonlarV11.4.11Dijital imzalar, HMAC, KDF ve rastgele bit üretimi gibi genel kriptografik kullanım senaryolarında yalnızca onaylı hash fonksiyonlarının kullanıldığı doğrulanmalıdır. MD5 gibi yasaklı hash fonksiyonları hiçbir kriptografik amaçla kullanılmamalıdır.1V11.4.22Parolaların, onaylı, hesaplama açısından yoğun ve mevcut rehberliğe göre yapılandırılmış bir anahtar türetme fonksiyonu (diğer adıyla parola hash'leme fonksiyonu) kullanılarak saklandığı doğrulanmalıdır. Ayarlar, güvenlik ve performans dengesini sağlayarak kaba kuvvet saldırılarını zorlaştırmalıdır.2V11.4.33Dijital imzalarda kullanılan hash fonksiyonlarının, veri bütünlüğü ve kimlik doğrulama amacıyla kullanıldığında çakışmaya karşı dayanıklı ve yeterli bit uzunluğuna sahip olduğu doğrulanmalıdır. Çakışma dayanıklılığı gerekiyorsa çıktı uzunluğu en az 256 bit olmalıdır. Sadece ikinci ön-görüntü (2nd pre-iamge) saldırılarına karşı dayanıklılık gerekiyorsa çıktı uzunluğu en az 128 bit olmalıdır.2V11.4.44Parolalardan gizli anahtarlar türetilirken, onaylı anahtar türetme fonksiyonlarının anahtar uzatma (key stretching) parametreleriyle birlikte kullanıldığı doğrulanmalıdır. Bu parametreler, kaba kuvvet saldırılarını önleyecek şekilde güvenlik ve performans dengesine sahip olmalıdır.2V11.55Rastgele DeğerlerV11.5.11Tahmin edilemez olması amaçlanan tüm rastgele sayıların ve dizelerin, CSPRNG ile oluşturulduğu ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. UUID'lerin bu koşulu dikkate almadığını unutmayın.2V11.5.22Kullanılan rastgele sayı üretim mekanizmasının, yoğun talep altında dahi güvenli çalışacak şekilde tasarlandığı doğrulanmalıdır.3V11.66Açık Anahtar (Public Key) KriptografisiV11.6.11Anahtar üretimi, tohumlama (seeding) ve dijital imza üretimi ve doğrulama için yalnızca onaylı kriptografik algoritmalar ve çalışma modlarının kullanıldığı doğrulanmalıdır. Anahtar üretim algoritmaları, bilinen saldırılara karşı savunmasız anahtarlar üretmemelidir. Örneğin, Fermat çarpanlama yöntemine karşı savunmasız RSA anahtarları oluşturulmamalıdır.2V11.6.22Anahtar değişimi için yalnızca onaylı kriptografik algoritmaların kullanıldığı doğrulanmalıdır (örneğin Diffie-Hellman). Kullanılan parametrelerin güvenli olması gerektiğine dikkat edilmelidir. Bu, anahtar kurulum sürecine yönelik saldırıları önleyecek ve araya girme (adversary-in-the-middle) ya da kriptografik kırılmaları engelleyecektir.3V11.77Kullanım Halindeki Verilerin KriptografisiV11.7.11Hassas verilerin kullanım sırasında korunmasını sağlamak amacıyla, yetkisiz kullanıcıların veya süreçlerin bu verilere erişmesini engelleyen tam bellek şifrelemesinin kullanıldığı doğrulanmalıdır.3V11.7.22Veri asgariyetinin sağlandığı, yani işleme sırasında mümkün olan en az miktarda verinin ortaya çıktığı ve verilerin kullanımdan hemen sonra veya mümkün olan en kısa sürede şifrelendiği doğrulanmalıdır.3V1212SecureGüvenli İletişimV12.11Genel TLS Güvenlik RehberiV12.1.11Yalnızca TLS protokolünün en güncel ve önerilen sürümlerinin (örneğin TLS 1.2 ve TLS 1.3) etkinleştirildiği ve en son sürümün varsayılan olarak tercih edildiği doğrulanmalıdır.1V12.1.22Yalnızca önerilen şifre takımlarının (cipher suite) etkinleştirildiği ve en güçlü şifre takımlarının tercih edildiği doğrulanmalıdır. Seviye 3 (L3) uygulamalar yalnızca ileri gizlilik (forward secrecy) sağlayan şifre takımlarını desteklemelidir.2V12.1.33Uygulamanın, mTLS istemci sertifikalarını kimlik doğrulama veya yetkilendirme amacıyla kullanmadan önce bu sertifikaların güvendiği sertifikalar arasında olduğunu doğruladığı kontrol edilmelidir.2V12.1.44Online Certificate Status Protocol (OCSP) Stapling gibi geçerli bir sertifika iptal kontrolü yönteminin etkinleştirildiği ve yapılandırıldığı doğrulanmalıdır.3V12.1.55TLS el sıkışma (handshake) sürecinde Server Name Indication (SNI) gibi hassas meta verilerin ifşa edilmesini önlemek için, uygulamanın TLS yapılandırmasında Encrypted Client Hello (ECH) özelliğinin etkinleştirildiği doğrulanmalıdır.3V12.22Dışa Açık Hizmetlerle HTTPS İletişimiV12.2.11İstemci ile dışa açık, HTTP tabanlı hizmetler arasındaki tüm bağlantılarda TLS kullanıldığı ve bu bağlantıların güvensiz ya da şifrelenmemiş iletişime geri dönmediği doğrulanmalıdır.1V12.2.22Dışa açık hizmetlerin herkese açık olarak güvenilen TLS sertifikaları kullandığı doğrulanmalıdır.1V12.33Genel Servisler Arası İletişim GüvenliğiV12.3.11Uygulamaya gelen ve uygulamadan çıkan tüm bağlantılarda izleme sistemleri, yönetim araçları, uzaktan erişim ve SSH, ara yazılımlar, veritabanları, ana sistemler (mainframe), iş ortağı sistemleri ya da dış API'ler dahil olmak üzere TLS gibi şifreli bir protokolün kullanıldığı ve güvensiz ya da şifrelenmemiş protokollere geri dönülmediği doğrulanmalıdır.2V12.3.22TLS istemcilerinin bir TLS sunucusu ile iletişime geçmeden önce alınan sertifikaları doğruladığı kontrol edilmelidir.2V12.3.33Uygulama içindeki HTTP tabanlı iç hizmetler arasında gerçekleşen tüm bağlantılarda TLS ya da uygun başka bir aktarım şifreleme mekanizmasının kullanıldığı ve güvensiz ya da şifrelenmemiş iletişime geri dönülmediği doğrulanmalıdır.2V12.3.44İç hizmetler arasındaki TLS bağlantılarında güvenilir sertifikaların kullanıldığı doğrulanmalıdır. İç sistemlerde oluşturulmuş ya da kendinden imzalı (self-signed) sertifikalar kullanılıyorsa, bu sertifikalara güvenen hizmetlerin yalnızca belirli dahili sertifika otoritelerine (CA) ve belirli kendinden imzalı sertifikalara güvenecek şekilde yapılandırıldıkları doğrulanmalıdır.2V12.3.55Sistem içindeki hizmetlerin birbiriyle iletişim kurarken her bir uç noktanın kimliğini doğrulamak için güçlü kimlik doğrulama yöntemlerinin kullanıldığı doğrulanmalıdır. Bu yöntemler arasında, açık anahtar altyapısı (public-key infrastructure) kullanan ve tekrar oynatma saldırılarına karşı dayanıklı olan TLS istemci kimlik doğrulaması gibi yöntemler yer almalıdır. Mikroservis mimarilerinde, sertifika yönetimini basitleştirmek ve güvenliği artırmak amacıyla bir servis ağı (service mesh) kullanılması değerlendirilmelidir.3V1313ConfigurationKonfigürasyonV13.11Konfigürasyon DokümantasyonuV13.1.11Uygulamanın tüm iletişim ihtiyaçlarının dokümante edildiği doğrulanmalıdır. Buna, uygulamanın bağımlı olduğu dış hizmetler ve son kullanıcının uygulamanın bağlantı kurmasını sağlayabileceği dış konumlar da dahil olmalıdır.2V13.1.22Uygulamanın kullandığı her bir hizmet için, dokümantasyonda eşzamanlı bağlantı sayısı (örn. bağlantı havuzu limitleri) ve bu sınır aşıldığında uygulamanın davranışı, geri dönüş veya kurtarma mekanizmaları da dahil olmak üzere hizmet reddi koşullarını önlemek için tanımlandığı doğrulanmalıdır.3V13.1.33Uygulamanın, kullandığı her bir dış sistem veya hizmet (örn. veritabanları, dosya tanıtıcıları, iş parçacıkları, HTTP bağlantıları) için kaynak yönetimi stratejilerini tanımladığı doğrulanmalıdır. Bu stratejiler, kaynak serbest bırakma prosedürlerini, zaman aşımı ayarlarını, hata durumlarını ve tekrar deneme mantığı uygulanmışsa sınırları, gecikmeleri ve geri çekilme (back-off) algoritmalarını içermelidir. Senkron HTTP istek–yanıt işlemleri için kısa zaman aşımı süreleri zorunlu tutulmalı ve tekrar eden denemeler devre dışı bırakılmalı ya da sıkı şekilde sınırlandırılmalıdır.3V13.1.44Uygulamanın, güvenlik açısından kritik olan gizli verileri tanımladığı ve kuruluşun tehdit modeli ve iş ihtiyaçlarına göre bu verilerin döndürülme (rotation) zamanlamasının belgelendiği doğrulanmalıdır.3V13.22Backend İletişim KonfigürasyonuV13.2.11Uygulamanın, standart kullanıcı oturum mekanizmasını desteklemeyen backend bileşenleri (örneğin API'ler, ara katmanlar, veri katmanları) arasında gerçekleşen iletişimlerin kimlik doğrulamasıyla korunduğu doğrulanmalıdır. Kimlik doğrulama; bireysel hizmet hesapları, kısa ömürlü token'lar ya da sertifika tabanlı kimlik doğrulama ile yapılmalıdır ve parola, API anahtarı ya da ayrıcalıklı erişime sahip paylaşımlı hesaplar gibi sabit kimlik bilgileri kullanılmamalıdır.2V13.2.22Uygulamanın backend bileşenleri arasında (yerel hizmetler, işletim sistemi hizmetleri, API'ler, ara katmanlar ve veri katmanları dahil) gerçekleştirilen iletişimlerin, yalnızca gerekli en az ayrıcalığa sahip hesaplarla yapıldığı doğrulanmalıdır.2V13.2.33Bir hizmet kimlik doğrulaması için bir kimlik bilgisi kullanılması gerekiyorsa, bu kimlik bilgisinin varsayılan bir değer (örneğin root/root veya admin/admin) olmadığının doğrulanması gereklidir.2V13.2.44Uygulamanın iletişim kurmasına izin verilen dış kaynaklar ya da sistemlerin, bir allowlist (izinli liste) ile tanımlandığı doğrulanmalıdır. Bu liste, uygulama katmanında, web sunucusunda, güvenlik duvarında veya farklı katmanların birleşiminde uygulanabilir.2V13.2.55Web veya uygulama sunucusunun, dış sistemlere veri veya dosya gönderimi veya yüklemesi yaparken sadece belirli kaynaklara izin verecek şekilde allowlist ile yapılandırıldığı doğrulanmalıdır.2V13.2.66Uygulamanın farklı hizmetlere bağlantı kurduğu durumlarda, bu bağlantılar için belgelenmiş yapılandırmaları (örn. maksimum eşzamanlı bağlantı, bağlantı limiti aşıldığında davranış, zaman aşımı, tekrar deneme stratejileri) takip ettiğinin doğrulanması gereklidir.3V13.33Gizli Bilgi YönetimiV13.3.11Parolalar, anahtar materyalleri, veritabanı ve üçüncü parti sistemlerle entegrasyon bilgileri, zaman tabanlı token'lar için tohum (seed) bilgileri, dahili gizli veriler ve API anahtarları gibi backend sırlarının güvenli bir şekilde oluşturulması, saklanması, erişim denetiminin sağlanması ve imha edilmesi için bir gizli bilgi yönetim çözümünün (örneğin key vault) kullanıldığı doğrulanmalıdır. Bu gizli bilgiler uygulama kaynak koduna dahil edilmemeli ve yapı çıktılarında yer almamalıdır. Seviye 3 uygulamalar için donanım destekli bir çözüm (örneğin HSM) gereklidir.2V13.3.22Gizli bilgilere erişimin en az ayrıcalık prensibine uygun şekilde yapılandırıldığı doğrulanmalıdır.2V13.3.33Tüm kriptografik işlemlerin, anahtar materyallerinin güvenli bir şekilde yönetilmesi ve dışarıya sızmasının engellenmesi amacıyla, izole edilmiş bir güvenlik modülü (örneğin vault ya da donanım güvenlik modülü) aracılığıyla gerçekleştirildiği doğrulanmalıdır.3V13.3.44Uygulamanın belgelerinde belirtildiği şekilde gizli bilgilerin süresinin dolacak şekilde yapılandırıldığı ve düzenli olarak döndürüldüğü doğrulanmalıdır.3V13.44İstenmeyen Bilgi SızıntısıV13.4.11Uygulamanın .git veya .svn klasörleri gibi kaynak kontrolüyle ilgili metadata içermeyecek şekilde deploy edildiğini ya da bu klasörlerin hem dış erişime hem de uygulama erişimine kapalı olduğu doğrulanmalıdır.1V13.4.22Tüm bileşenler için üretim ortamlarında hata ayıklama (debug) modlarının devre dışı bırakıldığı doğrulanmalıdır.2V13.4.33Web sunucularının, açık şekilde istenmediği sürece dizin listelemesi (directory listing) özelliğini istemcilere sunmadığı doğrulanmalıdır.2V13.4.44HTTP TRACE metodunun üretim ortamlarında desteklenmediği, böylece potansiyel bilgi sızıntılarının önlendiği doğrulanmalıdır.2V13.4.55Belgeler (örneğin dahili API belgeleri) ve izleme uç noktalarının (monitoring endpoints) yalnızca açıkça belirtildiği durumlarda erişilebilir olduğu doğrulanmalıdır.2V13.4.66Uygulamanın arka uç bileşenlerinin ayrıntılı sürüm bilgilerini ifşa etmediği doğrulanmalıdır.3V13.4.77Web katmanının yalnızca belirli dosya uzantılarına sahip dosyaları sunacak şekilde yapılandırıldığı, bu sayede istem dışı bilgi, yapılandırma ya da kaynak kod sızıntılarının önlendiği doğrulanmalıdır.3V1414DataVeri KorumaV14.11Veri Koruma DokümantasyonuV14.1.11Uygulama tarafından oluşturulan ve işlenen tüm hassas verilerin tanımlanıp, koruma seviyelerine göre sınıflandırıldığından emin olun. Bu, yalnızca kodlanmış (örneğin Base64 stringleri ya da JWT içindeki düz metin yükler gibi) ve bu nedenle kolayca çözülebilir verileri de içermelidir. Koruma seviyeleri, uygulamanın uymakla yükümlü olduğu veri koruma ve gizlilik düzenlemeleri ile standartlarını dikkate almalıdır.2V14.1.22Tüm hassas veri koruma seviyeleri için belgelenmiş bir koruma gereksinimleri seti tanımlandığından emin olun. Bu gereksinimler genel şifreleme, bütünlük doğrulama, saklama süresi, verinin nasıl günlüğe kaydedileceği, günlüklerdeki hassas verilere erişim kontrolleri, veritabanı düzeyinde şifreleme, gizlilik ve gizliliği artırıcı teknolojiler ile diğer gizlilik gereksinimlerini kapsamalıdır.2V14.22Genel Veri KorumasıV14.2.11Hassas verilerin yalnızca HTTP message body veya header alanlarında sunucuya gönderildiği ve URL ile sorgu parametrelerinin, API anahtarı veya session token’ı gibi hassas bilgiler içermediği doğrulanmalıdır.1V14.2.22Hassas verilerin, yük dengeleyiciler ve uygulama önbellekleri gibi sunucu bileşenlerinde önbelleğe alınmasının engellendiği veya kullanım sonrası bu verilerin güvenli biçimde temizlendiği doğrulanmalıdır.2V14.2.33Uygulama kontrolü dışında veri toplanmasını engellemek için, tanımlanmış hassas verilerin, kullanıcı izleyicileri gibi güvensiz taraflara gönderilmediği doğrulanmalıdır.2V14.2.44Hassas verilere yönelik şifreleme, bütünlük doğrulama, veri saklama, loglama yöntemi, loglardaki erişim kontrolleri, gizlilik teknolojileri gibi kontrollerin, söz konusu verinin belgelenmiş koruma seviyesinde tanımlandığı şekilde uygulandığı doğrulanmalıdır.2V14.2.55Önbellekleme mekanizmalarının yalnızca belirli içerik türüne sahip yanıtları önbelleğe alacak şekilde yapılandırıldığı ve hassas, dinamik içeriklerin önbelleğe alınmadığı doğrulanmalıdır. Web sunucusu, mevcut olmayan bir dosya talebinde geçerli ama farklı bir dosya döndürmek yerine 404 veya 302 cevabı vermelidir. Bu, Web Cache Deception saldırılarını önlemeye yardımcı olur.3V14.2.66Uygulamanın yalnızca işlevsellik için gerekli olan asgari hassas veriyi döndürdüğü doğrulanmalıdır. Örneğin, kredi kartı numarasının yalnızca bazı rakamlarının döndürülmesi; tam numaranın döndürülmesi gerekiyorsa, kullanıcı arayüzünde gizlenmiş (maskelenmiş) şekilde sunulması gerekir, aksi kullanıcı özel olarak görüntülemek istemedikçe gösterilmemelidir.3V14.2.77Hassas bilgilerin, veri saklama sınıflandırmasına tabi tutulduğu, geçerliliğini yitirmiş veya artık gerekli olmayan verilerin belirlenmiş bir zaman çizelgesiyle ya da gerektiğinde otomatik olarak silindiği doğrulanmalıdır.3V14.2.88Kullanıcı tarafından yüklenen dosyaların meta verilerinden hassas bilgilerin çıkarıldığı veya bu bilgilerin yalnızca kullanıcıdan açık onay alındığında saklandığı doğrulanmalıdır.3V14.33İstemci Tarafı Veri KorumasıV14.3.11Kimliği doğrulanmış verilerin, istemci veya oturum sonlandığında istemci depolamasından (örneğin tarayıcı DOM’undan) temizlendiği doğrulanmalıdır. 'Clear-Site-Data' HTTP response header bu konuda yardımcı olabilir ancak istemci tarafı, sunucu bağlantısı mevcut olmadığında da temizlik işlemini yapabiliyor olmalıdır.1V14.3.22Uygulamanın, tarayıcılarda hassas verilerin önbelleğe alınmasını önlemek amacıyla yeterli anti-önbellekleme HTTP response header (örneğin Cache-Control: no-store) ayarladığı doğrulanmalıdır.2V14.3.33Tarayıcıda depolanan verilerin (örneğin localStorage, sessionStorage, IndexedDB veya çerezler) hassas veri içermediği, yalnızca session token’larının istisna olarak kabul edildiği doğrulanmalıdır.2V1515SecureGüvenli Kodlama ve MimariV15.11Güvenli Kodlama ve Mimari DokümantasyonuV15.1.11Güvenlik açığı içeren üçüncü taraf bileşen sürümleri ve genel olarak kütüphane güncellemeleri için, uygulama dokümantasyonunda risk bazlı düzeltme zamanlarının tanımlandığı doğrulanmalıdır.1V15.1.22Yazılım bileşen listesi (Software Bill of Materials - SBOM) gibi bir envanterin tutulduğu, kullanılan tüm üçüncü taraf kütüphanelerin önceden tanımlanmış, güvenilir ve düzenli olarak güncellenen depolardan alındığı doğrulanmalıdır.2V15.1.33Uygulama dokümantasyonunda zaman veya kaynak açısından yoğun işlevlerin tanımlandığı, bu işlevlerin aşırı kullanımı durumunda kullanılabilirlik kaybının nasıl önleneceği ve yanıt oluşturma süresinin istemci zaman aşımını aşmaması için hangi önlemlerin alındığı belirtilmelidir. Örnek savunmalar kuyruklama, eşzamansız işleme, kullanıcı başına ve uygulama genelinde paralel işlem sınırlarını içerebilir.2V15.1.44Uygulama dokümantasyonunda "riskli bileşenler" olarak değerlendirilen üçüncü taraf kütüphanelerin vurgulandığı doğrulanmalıdır.3V15.1.55Uygulama dokümantasyonunda "tehlikeli işlevsellik" içeren uygulama bölümlerinin açıkça belirtildiği doğrulanmalıdır.3V15.22Güvenlik Mimarisi ve BağımlılıklarV15.2.11Uygulamanın yalnızca, belgelenmiş güncelleme ve düzeltme sürelerini aşmamış bileşenleri içerdiği doğrulanmalıdır.1V15.2.22Uygulamanın, belgelenmiş güvenlik kararları ve stratejilere dayanarak, zaman veya kaynak açısından yoğun işlevlerin neden olabileceği kullanılabilirlik kaybına karşı savunmalar uyguladığı doğrulanmalıdır.2V15.2.33Üretim ortamının yalnızca uygulamanın çalışması için gerekli işlevleri içerdiği ve test kodları, örnek kod parçaları veya geliştirme işlevleri gibi gereksiz işlevsellikleri açığa çıkarmadığı doğrulanmalıdır.2V15.2.44Üçüncü taraf bileşenlerin ve bunların tüm transitif bağımlılıklarının beklenen depolardan (iç kaynaklı ya da harici) alındığı ve bağımlılık karışıklığı (dependency confusion) saldırılarına açık olmadığı doğrulanmalıdır.3V15.2.55Uygulamanın, “tehlikeli işlevsellik” içeren veya “riskli bileşenler” kullanan bölümlerine ek korumalar uyguladığı doğrulanmalıdır. Bu korumalar sandbox, kapsülleme, konteynerleştirme veya ağ düzeyinde izolasyon gibi teknikler aracılığıyla, bir uygulama bölümünün ele geçirilmesi durumunda saldırganın diğer bölümlere sıçramasını geciktirmeyi veya engellemeyi amaçlamalıdır.3V15.33Savunmacı KodlamaV15.3.11Uygulamanın yalnızca gerekli alanların bir alt kümesini veri nesnesinden döndürdüğü doğrulanmalıdır. Örneğin, bazı alanlara kullanıcıların erişmemesi gerektiğinden tüm veri nesnesi döndürülmemelidir.1V15.3.22Uygulama backend'i harici URL’lere çağrı yaptığında, yalnızca amaçlanan işlevsellik söz konusuysa yönlendirmeleri takip edecek şekilde yapılandırıldığının doğrulanması gerekir.2V15.3.33Uygulamanın, kitlesel atama saldırılarına karşı, her bir controller ve eylem için izin verilen alanları sınırlandırarak savunmalar sağladığı doğrulanmalıdır. Örneğin, bir alan değeri, bu işlemde değiştirilmesi amaçlanmadıysa eklenememeli veya güncellenememelidir.2V15.3.44Tüm proxy ve ara katman bileşenlerinin kullanıcının orijinal IP adresini, uç kullanıcı tarafından değiştirilemeyecek güvenilir veri alanları kullanarak doğru şekilde ilettiği ve uygulamanın ve web sunucusunun bu doğru değeri, loglama ve hız sınırlama gibi güvenlik kararları için kullandığı doğrulanmalıdır. Ayrıca, orijinal IP adresinin bile dinamik IP'ler, VPN'ler veya kurumsal güvenlik duvarları nedeniyle güvenilir olmayabileceği dikkate alınmalıdır.2V15.3.55Uygulamanın değişkenlerin doğru türde olduğunu açıkça doğruladığı ve sıkı eşitlik ve karşılaştırma işlemleri kullandığı doğrulanmalıdır. Bu, değişken türüyle ilgili varsayımlardan kaynaklanan tür oynama (type juggling) veya tür karışıklığı (type confusion) güvenlik açıklarını önlemek içindir.2V15.3.66JavaScript kodunun prototip zehirleme (prototype pollution) saldırılarını önleyecek şekilde yazıldığı, örneğin, nesne literal’leri yerine Set() veya Map() gibi yapılar kullanıldığı doğrulanmalıdır.2V15.3.77Uygulamanın, özellikle framework'ün istek parametrelerinin kaynağı (sorgu dizgisi, gövde parametreleri, çerezler veya başlık alanları) arasında ayrım yapmadığı durumlarda, HTTP parametre kirliliği (HTTP parameter pollution) saldırılarına karşı savunmalar uyguladığı doğrulanmalıdır.2V15.44Güvenli Eş Zamanlılık (Concurrency)V15.4.11Çok iş parçacıklı kodda (örneğin cache'ler, dosyalar veya birden fazla iş parçacığı tarafından erişilen bellek içi nesneler gibi) paylaşılan nesnelere yalnızca thread-safe (iş parçacığı güvenli) türler ve kilitleme (lock) veya semaphore gibi senkronizasyon mekanizmaları kullanılarak erişildiği doğrulanmalıdır. Bu, yarış durumlarını ve veri bozulmasını önlemeye yöneliktir.3V15.4.22Bir kaynağın durumu üzerindeki kontroller (örneğin varlığı ya da izinleri gibi) ile bu kontrole bağlı eylemlerin tek bir atomik işlem olarak gerçekleştirildiği doğrulanmalıdır. Bu, TOCTOU (time-of-check to time-of-use) yarış durumlarını önlemeye yöneliktir. Bir dosyanın varlığının kontrol edilip ardından açılması veya bir kullanıcının erişiminin doğrulanıp ardından yetki verilmesi gibi işlemler buna örnektir.3V15.4.33Kilitlerin (locks) tutarlı biçimde kullanıldığı, iş parçacıklarının birbirini beklemesi ya da sonsuz döngüye girmesi (deadlock veya livelock) gibi durumların önlendiği doğrulanmalıdır. Ayrıca, kilitleme mantığı, kaynağı yöneten kod içinde kalmalı ve dış sınıflar veya dış kodlar tarafından istemeden veya kötü niyetli şekilde değiştirilememelidir.3V15.4.44Kaynak tahsis politikalarının, iş parçacığı açlığını önleyecek şekilde, kaynaklara adil erişimi sağladığı doğrulanmalıdır. Örneğin, thread pool (iş parçacığı havuzu) kullanımı, düşük öncelikli iş parçacıklarının da makul sürelerde çalışabilmesi için uygulanmalıdır.3V1616SecurityGüvenlik Günlüklemesi (Logging) ve Hata YönetimiV16.11Güvenlik Loglaması DokümantasyonuV16.1.11Uygulamanın teknoloji yığını boyunca her katmanda hangi olayların loglandığını, log formatlarını, logların nereye yazıldığını, nasıl kullanıldığını, erişimin nasıl kontrol edildiğini ve logların ne kadar süre saklandığını belgeleyen bir envanterin mevcut olduğu doğrulanmalıdır.2V16.22Genel LoglamaV16.2.11Her bir log girdisinin, olayın ne zaman, nerede, kim tarafından ve ne olduğuna dair detaylı bir zaman çizelgesi oluşturulmasına olanak tanıyacak gerekli meta verileri içerdiği doğrulanmalıdır.2V16.2.22Tüm loglama bileşenlerinin zaman kaynaklarının senkronize olduğu ve güvenlik olayı meta verisindeki zaman damgalarının UTC kullanarak ya da açık zaman dilimi ofsetiyle belirtildiği doğrulanmalıdır. UTC kullanımı, özellikle yaz saati uygulamaları nedeniyle oluşabilecek karışıklıkları önlemek için tavsiye edilir.2V16.2.33Uygulamanın yalnızca log envanterinde belgelenmiş dosya ve hizmetlere log yazdığı ya da ilettiği doğrulanmalıdır.2V16.2.44Logların kullanılan log işleyici (log processor) tarafından okunabildiği ve ilişkilendirilebildiği doğrulanmalıdır. Tercihen yaygın bir log formatı kullanılmalıdır.2V16.2.55Hassas veriler loglanırken, uygulamanın veri koruma seviyesine uygun olarak loglama yaptığı doğrulanmalıdır. Örneğin kimlik bilgileri veya ödeme detayları gibi bazı verilerin loglanmasına izin verilmemelidir. Session token’ları gibi veriler ise yalnızca tamamen ya da kısmen maskelenmiş ya da hash’lenmiş olarak loglanmalıdır.2V16.33Güvenlik OlaylarıV16.3.11Tüm kimlik doğrulama işlemlerinin (başarılı ve başarısız girişimler dahil) loglandığı doğrulanmalıdır. Kullanılan kimlik doğrulama türü veya faktörleri gibi ek meta veriler de toplanmalıdır.2V16.3.22Başarısız yetkilendirme girişimlerinin loglandığı doğrulanmalıdır. Seviye 3 uygulamalar için, tüm yetkilendirme kararlarının ve hassas verilere erişim olaylarının (verinin kendisi olmadan) loglandığı da doğrulanmalıdır.2V16.3.33Uygulamanın, belgelenmiş güvenlik olaylarını ve güvenlik kontrollerini aşma girişimlerini (girdi doğrulama, iş mantığı, otomasyon karşıtı kontroller vb.) logladığı doğrulanmalıdır.2V16.3.44Beklenmeyen hatalar ve güvenlik kontrolü başarısızlıkları (örneğin backend TLS hataları gibi) loglandığı doğrulanmalıdır.2V16.44Log KorumasıV16.4.11Tüm loglama bileşenlerinin, log enjeksiyonunu (log injection) önlemek amacıyla verileri uygun biçimde encode ettiği doğrulanmalıdır.2V16.4.22Logların yetkisiz erişime karşı korunduğu ve değiştirilemez olduğu doğrulanmalıdır.2V16.4.33Logların analiz, tespit, uyarı ve yükseltme amacıyla mantıksal olarak ayrı bir sisteme güvenli biçimde iletildiği doğrulanmalıdır. Böylece uygulama ihlal edilse bile logların tehlikeye girmesi önlenmiş olur.2V16.55Hata YönetimiV16.5.11Beklenmedik ya da güvenlikle ilgili bir hata oluştuğunda, tüketiciye genel bir mesaj döndürüldüğü ve yığın izleri (stack trace), sorgular, gizli anahtarlar, token’lar gibi hassas sistem içi verilerin açıklanmadığı doğrulanmalıdır.2V16.5.22Uygulamanın, dış kaynaklara erişim başarısız olduğunda bile güvenli şekilde çalışmaya devam ettiği doğrulanmalıdır. Örneğin, circuit breaker ya da graceful degradation gibi desenler kullanılmalıdır.2V16.5.33Uygulamanın hata durumlarında güvenli ve düzenli şekilde başarısız olduğu doğrulanmalıdır. Bu, örneğin doğrulama hatalarına rağmen işlemlerin işlenmesine yol açabilecek fail-open durumlarını önlemelidir.2V16.5.44Ele alınmamış tüm istisnaları yakalayacak şekilde tanımlanmış bir “son çare hata yöneticisi” bulunduğu doğrulanmalıdır. Bu, hem loglara gitmesi gereken hata detaylarının kaybolmaması hem de tüm uygulama sürecinin çökerek hizmet dışı kalmasının önlenmesi açısından önemlidir.3V1717WebRTCWebRTCV17.11TURN SunucusuV17.1.11TURN hizmetinin yalnızca özel amaçlar için ayrılmamış IP adreslerine (ör. iç ağlar, yayın adresleri, loopback) erişime izin verdiği doğrulanmalıdır. Bu gereksinim hem IPv4 hem de IPv6 adresleri için geçerlidir.2V17.1.22TURN hizmetinin, meşru kullanıcıların sunucuda çok sayıda bağlantı noktası açmaya çalışması durumunda kaynak tüketimi saldırılarına karşı dayanıklı olduğu doğrulanmalıdır.3V17.22MedyaV17.2.11DTLS sertifikası anahtarının, belgelenmiş kriptografik anahtar yönetim politikasına uygun şekilde yönetildiği ve korunduğu doğrulanmalıdır.2V17.2.22Medya sunucusunun onaylı DTLS şifre takımlarını (cipher suites) ve Güvenli Gerçek Zamanlı Aktarım Protokolü (Secure Real-time Transport Protocol - SRTP) için anahtarlar oluşturmaya yönelik DTLS Uzantısı için güvenli bir koruma profilini kullanacak ve destekleyecek şekilde yapılandırıldığı (DTLS-SRTP) doğrulanmalıdır.2V17.2.33Real-time Transport Protocol (RTP) injection saldırılarının bir hizmet reddi durumuna veya medya akışlarına ses veya video medyası eklenmesine yol açmasını önlemek için medya sunucusunda Güvenli SRTP kimlik doğrulamasının kontrol edildiği doğrulanmalıdır.2V17.2.44Verify that the media server is able to continue processing incoming media traffic when encountering malformed Secure Real-time Transport Protocol (SRTP) packets.2V17.2.55Medya sunucusunun, meşru kullanıcılardan gelen SRTP flood'ı sırasında gelen medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.3V17.2.66Medya sunucusunun DTLS içinde yer alan "ClientHello" yarış durumu güvenlik açığına karşı savunmasız olmadığı, medya sunucusunun güvenlik açığına sahip olduğunun açıkça bilinip bilinmediği kontrol edilerek veya yarış koşulu testi gerçekleştirilerek doğrulanmalıdır.3V17.2.77Medya sunucusuna bağlı ses veya video kayıt mekanizmalarının, meşru kullanıcı kaynaklı SRTP flood'ı sırasında medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.3V17.2.88DTLS sertifikasının, SDP (Session Description Protocol) fingerprint özelliği ile karşılaştırıldığı ve doğrulama başarısız olursa medya akışının sonlandırıldığı, medya akışının özgünlüğünü sağlamak için doğrulanmalıdır.3V17.33SinyalizasyonV17.3.11Sinyalizasyon sunucusunun, flood saldırısı altında bile meşru sinyalizasyon mesajlarını işlemeye devam edebildiği doğrulanmalıdır. Bu, sinyalizasyon düzeyinde oran sınırlaması uygulanarak sağlanmalıdır.2V17.3.22Sinyalizasyon sunucusunun, hizmet reddine yol açabilecek şekilde yapılandırılmış bozuk sinyalizasyon mesajlarıyla karşılaştığında bile meşru mesajları işlemeye devam edebildiği doğrulanmalıdır. Bu, girdi doğrulaması, integer overflow ve buffer overflow'a karşı savunma ve sağlam hata işleme teknikleri ile sağlanmalıdır.2 diff --git a/5.0/docs_tr/tr b/5.0/docs_tr/tr new file mode 100644 index 0000000000..e69de29bb2 diff --git a/5.0/en/0x01-Frontispiece.md b/5.0/en/0x01-Frontispiece.md index 6c63b4d983..b6ad6346a2 100644 --- a/5.0/en/0x01-Frontispiece.md +++ b/5.0/en/0x01-Frontispiece.md @@ -18,9 +18,10 @@ For any reuse or distribution, you must clearly communicate the license terms of ## Project Leads -| | | | -|---------------------- |----------------- |----------------- | -| Daniel Cuthbert | Elar Lang | Josh C Grossman | +| | | +|---------------------- |----------------- | +| Elar Lang | Josh C Grossman | +| Jim Manico | Daniel Cuthbert | ## Working Group @@ -42,4 +43,4 @@ We have included a list of the other contributors in Appendix E. If a credit is missing from the 5.x credit list, please log a ticket at GitHub to be recognized in future 5.x updates. -The Application Security Verification Standard builds on the work of those involved in ASVS 1.0 (2008) through 4.0 (2019). Much of the structure and many of the verification items that remain in ASVS today were originally written by Andrew van der Stock, Mike Boberski, Jeff Williams, and Dave Wichers, among numerous other contributors. We would also like to acknowledge Jim Manico for his significant and long-standing contributions to ASVS, starting as a Lead Author from version 1.0 (2009) and serving as a Project Lead from ASVS 4.0 through to after the release of ASVS 5.0. Thank you to everyone who has contributed in the past. For a comprehensive list of earlier contributors, please consult each prior version. +The Application Security Verification Standard builds on the work of those involved in ASVS 1.0 (2008) through 4.0 (2019). Much of the structure and many of the verification items that remain in ASVS today were originally written by Andrew van der Stock, Mike Boberski, Jeff Williams, and Dave Wichers, among numerous other contributors. Thank you to everyone who has contributed in the past. For a comprehensive list of earlier contributors, please consult each prior version. diff --git a/5.0/en/0x03-What-is-the-ASVS.md b/5.0/en/0x03-What-is-the-ASVS.md index 3709ed0157..925ecb33b6 100644 --- a/5.0/en/0x03-What-is-the-ASVS.md +++ b/5.0/en/0x03-What-is-the-ASVS.md @@ -120,7 +120,7 @@ For example, an early-stage startup that is only collecting limited sensitive da The ASVS is made up of a total of around 350 requirements which are divided into 17 chapters, each of which is further divided into sections. -The aim of the chapter and section division is to simplify choosing or filtering out chapters and sections based on what is relevant for the application. For example, for a machine-to-machine API, the requirements in chapter V3 related to web frontends will not be relevant. If there is no use of OAuth or WebRTC, then those chapters can be ignored as well. +The aim of the chapter and section division is to simplify choosing or filtering out chapters and sections based on the what is relevant for the application. For example, for a machine-to-machine API, the requirements in chapter V3 related to web frontends will not be relevant. If there is no use of OAuth or WebRTC, then those chapters can be ignored as well. ### Release strategy @@ -136,13 +136,9 @@ The above specifically relates to the requirements in the ASVS. Changes to surro Several of the points described above, such as documentation requirements and the levels mechanism, provide the ability to use the ASVS in a more flexible and organization-specific way. -Additionally, organizations are strongly encouraged to create an organization- or domain-specific fork. +Additionally, organizations are strongly encouraged to create an organization- or domain-specific fork that adjusts requirements based on the specific characteristics and risk levels of their applications. However, it is important to maintain traceability so that passing requirement 4.1.1 means the same across all versions. -### Forking the ASVS - -Organizations can benefit from adopting ASVS by choosing one of the three levels or by creating a domain-specific fork that adjusts requirements per application risk level. This type of fork is encouraged, provided that it maintains traceability so that passing requirement 4.1.1 means the same across all versions. - -Ideally, each organization should create its own tailored ASVS, omitting irrelevant sections (e.g., GraphQL, Websockets, SOAP, if unused). Forking should start with ASVS Level 1 as a baseline, advancing to Levels 2 or 3 based on the application’s risk. +Ideally, each organization should create its own tailored ASVS, omitting irrelevant sections (e.g., GraphQL, WebSockets, SOAP, if unused). An organization-specific ASVS version or supplement is also a good place to provide organization-specific implementation guidance, detailing libraries or resources to use when complying with requirements. ### How to Reference ASVS Requirements @@ -162,17 +158,23 @@ If identifiers are used without including the `v` element then they sho ASVS requirement lists are made available in CSV, JSON, and other formats which may be useful for reference or programmatic use. +### Forking the ASVS + +Organizations can benefit from adopting ASVS by choosing one of the three levels or by creating a domain-specific fork that adjusts requirements per application risk level. This type of fork is encouraged, provided that it maintains traceability so that passing requirement 4.1.1 means the same across all versions. + +Ideally, each organization should create its own tailored ASVS, omitting irrelevant sections (e.g., GraphQL, Websockets, SOAP, if unused). Forking should start with ASVS Level 1 as a baseline, advancing to Levels 2 or 3 based on the application’s risk. + ## Use cases for the ASVS The ASVS can be used to assess the security of an application and this is explored in more depth in the next chapter. However, several other potential uses for the ASVS (or a forked version) have been identified. ### As Detailed Security Architecture Guidance -One of the more common uses for the Application Security Verification Standard is as a resource for security architects. There are limited resources available for how to build a secure application architecture, especially with modern applications. ASVS can be used to fill in those gaps by allowing security architects to choose better controls for common problems, such as data protection patterns and input validation strategies. The architecture and documentation requirements will be particularly useful for this. +One of the more common uses for the Application Security Verification Standard is as a resource for security architects. There are limited resources available for how to build a secure application archiecture, especially with modern applications. ASVS can be used to fill in those gaps by allowing security architects to choose better controls for common problems, such as data protection patterns and input validation strategies. The architecture and documentation requirements will be particularly useful for this. ### As a Specialized Secure Coding Reference -The ASVS can be used as a basis for preparing a secure coding reference during application development, helping developers to make sure that they keep security in mind when they build software. Whilst the ASVS can be the base, organizations should prepare their own specific guidance which is clear and unified and ideally be prepared based on guidance from security engineers or security architects. As an extension to this, organizations are encouraged wherever possible to prepare approved security mechanisms and libraries that can be referenced in the guidance and used by developers. +The ASVS can be used as a basis for preparing a secure coding reference during application development, helping developers to make sure that they keep security in mind when they build software. Whilst the ASVS can be the base, prganizations should prepare their own specific guidance which is clear and unified and ideally be prepared based on guidance from security engineers or security architects. As an extension to this, organizations are encouraged wherever possible to prepare approved security mechanisms and libraries that can be referenced in the guidance and used by developers. ### As a Guide for Automated Unit and Integration Tests diff --git a/5.0/en/0x04-Assessment_and_Certification.md b/5.0/en/0x04-Assessment_and_Certification.md index eaf6392f70..da84e85661 100644 --- a/5.0/en/0x04-Assessment_and_Certification.md +++ b/5.0/en/0x04-Assessment_and_Certification.md @@ -8,11 +8,11 @@ Organizations may offer assurance services, provided they do not claim official ## How to Verify ASVS Compliance -The ASVS is deliberately not prescriptive about exactly how to verify compliance at the level of a testing guide. However, it is important to highlight some key points. +The ASVS is deliberately not presciptive about exactly how to verify compliance at the level of a testing guide. However, it is important to highlight some key points. ### Verification reporting -Traditional penetration testing reports issues “by exception,” only listing failures. However, an ASVS certification report should include scope, a summary of all requirements checked, the requirements where exceptions were noted, and guidance on resolving issues. Some requirements may be non-applicable (e.g., session management in stateless APIs), and this must be noted in the report. +Traditional penetration testing reports issues “by exception,” only listing failures. However, an ASVS certification report should include scope, a summary of all requirements checked, the requirements where execptions were noted, and guidance on resolving issues. Some requirements may be non-applicable (e.g., session management in stateless APIs), and this must be noted in the report. ### Scope of Verification @@ -32,7 +32,7 @@ The use of automation to verify ASVS requirements is a topic that is constantly When automated security testing tools such as Dynamic and Static Application Security Testing tools (DAST and SAST) are correctly implemented in the build pipeline, they may be able to identify some security issues that should never exist. However, without careful configuration and tuning they will not provide the required coverage and the level of noise will prevent real security issues from being identified and mitigated. -Whilst this may provide coverage of some of the more basic and straightforward technical requirements such as those relating to output encoding or sanitization, it is critical to note that these tools will be unable entirely to verify many of the more complicated ASVS requirements or those that relate to business logic and access control. +Whilst this may provide coverage of some of the more basic and straightforward technical requirements such as those relating to output encoding or sanitiation, it is critical to note that these tools will be unable entirely to verify many of the more complicated ASVS requirements or those that relate to business logic and access control. For less straightforward requirements, it is likely that automation can still be utilized but application specific verifications will need to be written to achieve this. These may be similar to unit and integration tests that the organization may already be using. It may therefore be possible to use this existing test automation infrastructure to write these ASVS specific tests. Whilst doing this will require short term investment, the long term benefits being able to continually verify these ASVS requirements will be significant. diff --git a/5.0/en/0x21-V12-Secure-Communication.md b/5.0/en/0x21-V12-Secure-Communication.md index 4c443480b2..08013d3b6e 100644 --- a/5.0/en/0x21-V12-Secure-Communication.md +++ b/5.0/en/0x21-V12-Secure-Communication.md @@ -8,7 +8,7 @@ The general concepts promoted by this chapter include: * Ensuring that communications are encrypted externally, and ideally internally as well. * Configuring encryption mechanisms using the latest guidance, including preferred algorithms and ciphers. -* Using signed certificates to ensure that communications are not being intercepted by unauthorized parties. +* Ensuring that communications are not being intercepted by unauthorized parties through the use of signed certificates. In addition to outlining general principles and best practices, the ASVS also provides more in-depth technical information about cryptographic strength in Appendix C - Cryptography Standards. diff --git a/5.0/en/0x90-Appendix-A_Glossary.md b/5.0/en/0x90-Appendix-A_Glossary.md index f751b15d21..146baa7b95 100644 --- a/5.0/en/0x90-Appendix-A_Glossary.md +++ b/5.0/en/0x90-Appendix-A_Glossary.md @@ -57,7 +57,7 @@ * **Self-Contained Token** – A token that encapsulates one or more attributes that do not rely on server-side state or other external storage. These tokens ensure the authenticity and integrity of their contained attributes, enabling secure, "stateless" information exchange across systems. Self-contained tokens are generally secured using cryptographic techniques, such as digital signatures or message authentication codes (MACs), to ensure the authenticity, integrity, and in some cases the confidentiality of its data. Common examples include SAML Assertions and JWTs. * **Server-side Request Forgery** (SSRF) – An attack that abuses functionality on the server to read or update internal resources. The attacker supplies or modifies a URL, which the code running on the server will read or submit data to. * **Session Description Protocol** (SDP) – A message format for setting up multimedia session (used for example in WebRTC). Defined in RFC 4566. -* **Session Identifier** or **Session ID** – A key which identifies a stateful session stored at the back end. Will be transferred to and from the client either as or inside a "Reference Token". +* **Session Identifier** or **Session ID** – A key which identifies a stateful session stored at the back end. Will be transfered to and from the client either as or inside a "Reference Token". * **Session Token** – A "catch-all" phrase used in this standard to refer to the token or value used in either stateless session mechanisms (which use a self-contained token) or stateful session mechanisms (which use a reference token). * **Session Traversal Utilities for NAT** (STUN) – A protocol used to assist NAT traversal in order to establish peer-to-peer communications. Defined in RFC 3489. * **Single-factor authenticator** – A mechanism to check that a user is authenticated. It should either be something you know (memorized secrets, passwords, passphrases, PINs), something you are (biometrics, fingerprint, face scans), or something you have (OTP tokens, a cryptographic device such as a smart card). @@ -68,7 +68,7 @@ * **SQL Injection** (SQLi) – A code injection technique used to attack data-driven applications, in which malicious SQL statements are inserted into an entry point. * **Stateful Session Mechanism** – In a stateful session mechanism, the application retains session state at the backend which typically corresponds to a session token, generated using a cryptographically secure pseudo-random number generator (CSPRNG), which is issued to the end user. * **Stateless Session Mechanism** – A stateless session mechanism will use a self-contained token which is passed to clients, and contains session information that is not necessarily stored within the service which then receives and validates the token. In reality, a service will need to have access to some session information (such as a JWT revocation list) in order to be able to enforce required security controls. -* **Static application security testing** (SAST) – A set of technologies designed to analyze application source code, byte code and binaries for coding and design conditions that are indicative of security vulnerabilities. SAST solutions analyze an application from the “inside out” in a non-running state. +* **Static application security testing** (SAST) – A set of technologies designed to analyze application source code, byte code and binaries for coding and design conditions that are indicative of security vulnerabilities. SAST solutions analyze an application from the “inside out” in a nonrunning state. * **Threat Modeling** – A technique consisting of developing increasingly refined security architectures to identify threat agents, security zones, security controls, and important technical and business assets. * **Time-of-check to time-of-use** (TOCTOU) – A situation where an application checks the state of a resource before using that resource, but the resource's state can be changed between the check and the use. This can invalidate the results of the check and cause a situation where the application performs invalid actions due to this state mismatch. * **Time based One-time Passwords** (TOTPs) - A method of generating an OTP where the current time acts as part of the algorithm to generate the password. diff --git a/5.0/en/0x91-Appendix-B_References.md b/5.0/en/0x91-Appendix-B_References.md index 4e989d6977..a0fdd1babb 100644 --- a/5.0/en/0x91-Appendix-B_References.md +++ b/5.0/en/0x91-Appendix-B_References.md @@ -36,4 +36,8 @@ Similarly, the following websites are most likely to be useful to users/adopters 1. SecLists Github: [https://github.com/danielmiessler/SecLists](https://github.com/danielmiessler/SecLists) 2. MITRE Common Weakness Enumeration: [https://cwe.mitre.org/](https://cwe.mitre.org/) -3. PCI Security Standards: [https://www.pcisecuritystandards.org/standards/](https://www.pcisecuritystandards.org/standards/) +3. PCI Security Standards Council: [https://www.pcisecuritystandards.org/](https://www.pcisecuritystandards.org/) +4. PCI Data Security Standard (DSS) v3.2.1 Requirements and Security Assessment Procedures: [https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf](https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf) +5. PCI Software Security Framework - Secure Software Requirements and Assessment Procedures: [https://www.pcisecuritystandards.org/documents/PCI-Secure-Software-Standard-v1_0.pdf](https://www.pcisecuritystandards.org/documents/PCI-Secure-Software-Standard-v1_0.pdf) +6. PCI Secure Software Lifecycle (Secure SLC) Requirements and Assessment Procedures: [https://www.pcisecuritystandards.org/documents/PCI-Secure-SLC-Standard-v1_0.pdf](https://www.pcisecuritystandards.org/documents/PCI-Secure-SLC-Standard-v1_0.pdf) +7. OWASP ASVS 4.0 Testing Guide [https://github.com/BlazingWind/OWASP-ASVS-4.0-testing-guide](https://github.com/BlazingWind/OWASP-ASVS-4.0-testing-guide) diff --git a/5.0/en/0x92-Appendix-C_Cryptography.md b/5.0/en/0x92-Appendix-C_Cryptography.md index bc6c0aaee8..93f5cebec4 100644 --- a/5.0/en/0x92-Appendix-C_Cryptography.md +++ b/5.0/en/0x92-Appendix-C_Cryptography.md @@ -5,7 +5,7 @@ The "Cryptography" chapter goes beyond simply defining best practices. It aims t This appendix defines the level of approval for different cryptographic mechanisms: * Approved (A) mechanisms can be used in applications. -* Legacy mechanisms (L) should not be used in applications but might still be used for compatibility with existing legacy applications or code only. While the usage of such these mechanisms is currently not considered to be a vulnerability in itself, they should be replaced by more secure and future-proof mechanisms as soon as possible. +* Legacy mechanisms (L) should not be used in applications but might still be used for compatibility with existing legacy applications or code onyly. While the usage of such these mechanisms is currently not considered to be a vulnerability in itself, they should be replaced by more secure and future-proof mechanisms as soon as possible. * Disallowed mechanisms (D) must not be used because they are currently considered broken or do not provide sufficient security. This list may be overridden in the context of a given application for various reasons including: @@ -27,10 +27,10 @@ It is important to ensure that all cryptographic assets, such as algorithms, key The relative security strengths for various cryptographic systems are in this table (from [NIST SP 800-57 Part 1](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final), p.71): -| Security Strength | Symmetric Key Algorithms | Finite Field | Integer Factorization | Elliptic Curve | -| -- | -- | -- | -- | -- | +| Security Strength | Symmetric Key Algorithms | Finite Field | Integer Factorisation | Elliptic Curve | +|--|--|--|--|--| | <= 80 | 2TDEA | L = 1024
N = 160 | k = 1024 | f = 160-223 | -| 112 | 3TDEA | L = 2048
N = 224 | k = 2048 | f = 224-255 | +| 112 | 3TDEA | L = 2048
N = 224 | k = 2048 | f = 224-255 | | 128 | AES-128 | L = 3072
N = 256 | k = 3072 | f = 256-383 | | 192 | AES-192 | L = 7680
N = 384 | k = 7680 | f = 384-511 | | 256 | AES-256 | L = 15360
N = 512 | k = 15360 | f = 512+ | @@ -38,7 +38,7 @@ The relative security strengths for various cryptographic systems are in this ta Example of applications: * Finite Field Cryptography: DSA, FFDH, MQV -* Integer Factorization Cryptography: RSA +* Integer Factorisation Cryptography: RSA * Elliptic Curve Cryptography: ECDSA, EdDSA, ECDH, MQV Note: that this section assumes that no quantum computer exists; if such a computer would exist, the estimates for the last 3 columns would be no longer valid. @@ -49,7 +49,7 @@ This section provides additional information for V11.5 Random Values. | Name | Version/Reference | Notes | Status | -| :--- | :---- | :---- | :-: | +|:---|:----|:----|:-:| | `/dev/random` | Linux 4.8+ [(Oct 2016)](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=818e607b57c94ade9824dad63a96c2ea6b21baf3), also found in iOS, Android, and other Linux-based POSIX operating systems. Based on [RFC7539](https://datatracker.ietf.org/doc/html/rfc7539) | Utilizing ChaCha20 stream. Found in iOS [`SecRandomCopyBytes`](https://developer.apple.com/documentation/security/secrandomcopybytes(_:_:_:)?language=objc) and Android [`Secure Random`](https://developer.android.com/reference/java/security/SecureRandom) with the correct settings provided to each. | A | | `/dev/urandom` | Linux kernel's special file for providing random data | Provides high-quality, entropy sources from hardware randomness | A | | `AES-CTR-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | As used in common implementations, such as [Windows CNG API `BCryptGenRandom`](https://learn.microsoft.com/en-us/windows/win32/api/bcrypt/nf-bcrypt-bcryptgenrandom) set by [`BCRYPT_RNG_ALGORITHM`](https://learn.microsoft.com/en-us/windows/win32/seccng/cng-algorithm-identifiers). | A | @@ -67,7 +67,7 @@ for V11.3 Encryption Algorithms. Approved cipher algorithms are listed in order of preference. | Symmetric Key Algorithms | Reference | Status | -| ------ | ------ | :-: | +| ------ | ------ |:-:| | AES-256 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | A | | Salsa20 | [Salsa 20 specification](https://cr.yp.to/snuffle/spec.pdf) | A | | XChaCha20 | [XChaCha20 Draft](https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-xchacha-03) | A | @@ -79,7 +79,7 @@ Approved cipher algorithms are listed in order of preference. | TDEA (3DES/3DEA) | | D | | IDEA | | D | | RC4 | | D | -| Blowfish | | D | +| Blowfish| | D | | ARC4 | | D | | DES | | D | @@ -90,7 +90,7 @@ Block ciphers, such as AES, can be used with different modes of operations. Many Approved modes are listed in order of preference. | Mode | Authenticated | Reference | Status | Restriction | -| -- | -- | -- | :-: | -- | +|--|--|--|:-:|--| | GCM | Yes | [NIST SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | | | CCM | Yes | [NIST SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | | | CBC | No | [NIST SP 800-38A](https://csrc.nist.gov/pubs/sp/800/38/a/final) | L | | @@ -104,7 +104,7 @@ Notes: * All encrypted messages must be authenticated. For ANY use of CBC mode there MUST be an associated hashing MAC algorithm to validate the message. In general, this MUST be applied in the Encrypt-Then-Hash method (but TLS 1.2 uses Hash-Then-Encrypt instead). If this cannot be guaranteed, then CBC MUST NOT be used. The only application where encryption without a MAC algorithm is allowed is disk encryption. * If CBC is used, it shall be guaranteed that the verification of the padding is performed in constant time. -* When using CCM-8, the MAC tag only has 64 bits of security. This does not conform to requirement 11.2.3 which requires at least 128 bits of security. +* When using CCM-8, the MAC tag only has 64 bits of security. This does not conform to requirement 6.2.9 which requires at least 128 bits of security. * Disk encryption is considered out of scope for the ASVS. Therefore this appendix does not list any approved method for disk encryption. For this usage, encryption without authentication is usually accepted and the XTS, XEX and LRW modes are typically used. ### Key Wrapping @@ -117,7 +117,7 @@ However, serious consideration should be given to understanding the nature (e.g. Specifically, AES-256 MUST be used for key wrapping, following [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) and considering forward-looking provisions against the quantum threat. Cipher modes using AES are the following, in order of preference: | Key Wrapping | Reference | Status | -| -- | -- | :-: | +|--|--|:-:| | KW | [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) | A | | KWP | [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) | A | @@ -132,15 +132,15 @@ The application should preferably use an approved AEAD scheme. It might alternat MAC-then-encrypt is still allowed for compatibility with legacy applications. It is used in TLS v1.2 with old ciphers suites. | AEAD mechanism | Reference | Status | -| --- | --------- | :-: | -| AES-GCM | [SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | -| AES-CCM | [SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | -| ChaCha-Poly1305 | [RFC 7539](https://datatracker.ietf.org/doc/html/rfc7539) | A | -| AEGIS-256 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | -| AEGIS-128 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | -| AEGIS-128L | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | -| Encrypt-then-MAC | | A | -| MAC-then-encrypt | | L | +|---|---------|:-:| +|AES-GCM | [SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | +|AES-CCM | [SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | +|ChaCha-Poly1305 | [RFC 7539](https://datatracker.ietf.org/doc/html/rfc7539) | A | +|AEGIS-256 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +|AEGIS-128 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +|AEGIS-128L| [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +|Encrypt-then-MAC | | A | +|MAC-then-encrypt | | L | ## Hash Functions @@ -153,18 +153,18 @@ The following table lists hash functions approved in general cryptographic use c * Approved hash functions provide strong collision resistance and are suitable for high-security applications. * Some of these algorithms offer strong resistance to attacks when used with proper cryptographic key management, and so are additionally approved for HMAC, KDF, and RBG functions. -* Hash function with less than 254 bit of output have insufficient collision resistance and must not be used for digital signature or other applications requiring collision resistance. For other usages, they might be used for compatibility and verification ONLY with legacy systems but must not be used in new designs. +* Hash function with less than 254 bit of output have insufficient collision resistancea and must not be used for digital signature or other applications requiring collision resistance. For other usages, they might be used for compatibility and verification ONLY with legacy systems but must not be used in new designs. | Hash function | Reference | Status | Restrictions | -| ------ | ----------- | :-: | ---------- | -| SHA3-512 | [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | -| SHA-512 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | -| SHA3-384 | [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | -| SHA-384 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | -| SHA3-256 | [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | -| SHA-512/256 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | -| SHA-256 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | -| SHAKE256 | [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| ------ | ----------- |:-:| ---------- | +| SHA3-512 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| SHA-512 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHA3-384 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| SHA-384 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHA3-256 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| SHA-512/256 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHA-256 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHAKE256 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | | BLAKE2s | [BLAKE2: simpler, smaller, fast as MD5](https://eprint.iacr.org/2013/322) | A | | | BLAKE2b | [BLAKE2: simpler, smaller, fast as MD5](https://eprint.iacr.org/2013/322) | A | | | BLAKE3 | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | | @@ -172,7 +172,7 @@ The following table lists hash functions approved in general cryptographic use c | SHA-512/224 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | L | Not suitable for HMAC, KDF, RBG, digital signatures | | SHA3-224 | [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | L | Not suitable for HMAC, KDF, RBG, digital signatures | | SHA-1 | [RFC 3174](https://www.rfc-editor.org/info/rfc3174) & [RFC 6194](https://www.rfc-editor.org/info/rfc6194) | L | Not suitable for HMAC, KDF, RBG, digital signatures | -| CRC (any length) | | D | | +| CRC (any length) | | D | | | MD4 | [RFC 1320](https://www.rfc-editor.org/info/rfc1320) | D | | | MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | | @@ -180,14 +180,14 @@ The following table lists hash functions approved in general cryptographic use c For secure password hashing, dedicated hash functions must be used. These slow-hashing algorithms mitigate brute-force and dictionary attacks by increasing the computational difficulty of password cracking. -| KDF | Reference | Required Parameters | Status | -| ---------- | --------- | ------------ | :-: | +| KDF | Reference | Required Parameters | Status | +| ---------- | --------- | ------------ |:-:| | argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1 | A | -| | | t = 2: m ≥ 19456 (19 MiB), p = 1 | A | -| | | t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | -| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8 | A | -| | | p = 2: N ≥ 2^16 (64 MiB), r = 8 | A | -| | | p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | +| | | t = 2: m ≥ 19456 (19 MiB), p = 1 | A | +| | | t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | +| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8 | A | +| | | p = 2: N ≥ 2^16 (64 MiB), r = 8 | A | +| | | p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | | bcrypt | [A Future-Adaptable Password Scheme](https://www.researchgate.net/publication/2519476_A_Future-Adaptable_Password_Scheme) | cost ≥ 10 | A | | PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 210,000 | A | | PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 600,000 | A | @@ -199,22 +199,22 @@ Approved password-based key derivations functions can be used for password stora ### General Key Derivation Functions -| KDF | Reference | Status | -| ---------------- | -------- |:-: | -| HKDF | [RFC 5869](https://www.rfc-editor.org/info/rfc5869) | A | -| TLS 1.2 PRF | [RFC 5248](https://www.rfc-editor.org/info/rfc5248) | L | -| MD5-based KDFs | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | +| KDF | Reference | Status | +| ---------------- | -------- |:-:| +| HKDF | [RFC 5869](https://www.rfc-editor.org/info/rfc5869) | A | +| TLS 1.2 PRF | [RFC 5248](https://www.rfc-editor.org/info/rfc5248) | L | +| MD5-based KDFs | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | | SHA-1-based KDFs | [RFC 3174](https://www.rfc-editor.org/info/rfc3174) & [RFC 6194](https://www.rfc-editor.org/info/rfc6194) | D | ### Password-based Key Derivation Functions -| KDF | Reference | Required Parameters | Status | -| ---------- | --------- | ------------ | :-: | -| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1 | A | -| | | t = 2: m ≥ 19456 (19 MiB), p = 1 | A | -| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8 | A | -| | | p = 2: N ≥ 2^16 (64 MiB), r = 8 | A | -| | | p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | +| KDF | Reference | Required Parameters | Status | +| ---------- | --------- | ------------ |:-:| +| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1 | A | +| | | t = 2: m ≥ 19456 (19 MiB), p = 1 | A | +| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8 | A | +| | | p = 2: N ≥ 2^16 (64 MiB), r = 8 | A | +| | | p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | | PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 210,000 | A | | PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 600,000 | A | | PBKDF2-HMAC-SHA-1 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 1,300,000 | L | @@ -228,8 +228,8 @@ for V11.6 Public Key Cryptography. A security strength of 112 bits or above MUST be ensured for all Key Exchange schemes, and their implementation MUST follow the parameter choices in the following table. -| Scheme | Domain Parameters | Forward Secrecy | Status | -| -- | -- | -- | :-: | +| Scheme | Domain Parameters | Forward Secrecy |Status | +|--|--|--|:-:| | Finite Field Diffie-Hellman (FFDH) | L >= 3072 & N >= 256 | Yes | A | | Elliptic Curve Diffie-Hellman (ECDH) | f >= 256-383 | Yes | A | | Encrypted key transport with RSA-PKCS#1 v1.5 | | No | D | @@ -277,19 +277,19 @@ The following groups are approved for implementations of Diffie-Hellman key exch Message Authentication Codes (MACs) are cryptographic constructs used to verify the integrity and authenticity of a message. A MAC takes a message and a secret key as inputs and produces a fixed-size tag (the MAC value). MACs are widely used in secure communication protocols (e.g., TLS/SSL) to ensure that messages exchanged between parties are authentic and intact. -| MAC Algorithm | Reference | Status | -| ---------- | --------------- | :-: | -| HMAC-SHA-256 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | -| HMAC-SHA-384 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | -| HMAC-SHA-512 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | -| KMAC128 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | -| KMAC256 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | -| BLAKE3 (keyed_hash mode) | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | -| AES-CMAC | [RFC 4493](https://datatracker.ietf.org/doc/html/rfc4493) & [NIST SP 800-38B](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38b.pdf) | A | -| AES-GMAC | [NIST SP 800-38D](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf) | A | -| Poly1305-AES | [The Poly1305-AES message-authentication code](https://cr.yp.to/mac/poly1305-20050329.pdf) | A | -| HMAC-SHA-1 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | L | -| HMAC-MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | +| MAC Algorithm | Reference | Status | +| ---------- | --------------- |:-:| +| HMAC-SHA-256 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| HMAC-SHA-384 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| HMAC-SHA-512 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| KMAC128 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | +| KMAC256 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | +| BLAKE3 (keyed_hash mode) | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | +| AES-CMAC | [RFC 4493](https://datatracker.ietf.org/doc/html/rfc4493) & [NIST SP 800-38B](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38b.pdf) | A | +| AES-GMAC | [NIST SP 800-38D](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf) | A | +| Poly1305-AES | [The Poly1305-AES message-authentication code](https://cr.yp.to/mac/poly1305-20050329.pdf) | A | +| HMAC-SHA-1 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | L | +| HMAC-MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | ## Digital Signatures @@ -306,6 +306,6 @@ Signature schemes MUST use approved key sizes and parameters per [NIST SP 800-57 ## Post-Quantum Encryption Standards -Post-quantum cryptography (PQC) implementations should follow [FIPS-203](https://csrc.nist.gov/pubs/fips/203/ipd), [FIPS-204](https://csrc.nist.gov/pubs/fips/204/ipd), and [FIPS-205](https://csrc.nist.gov/pubs/fips/205/ipd). At this time, there are not many hardened code examples or reference implementations available for these standards. For further details, see the [NIST announcement of the first three finalized post-quantum encryption standards (August 2024)](https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards). +PQC implementations must be in line with [FIPS-203](https://csrc.nist.gov/pubs/fips/203/ipd)/[204](https://csrc.nist.gov/pubs/fips/204/ipd)/[205](https://csrc.nist.gov/pubs/fips/205/ipd) as there is minimal hardened code nor implementation reference yet. https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards The proposed [mlkem768x25519](https://datatracker.ietf.org/doc/draft-kwiatkowski-tls-ecdhe-mlkem/03/) post-quantum hybrid TLS key agreement method is supported by major browsers such as [Firefox release 132](https://www.mozilla.org/en-US/firefox/132.0/releasenotes/) and [Chrome release 131](https://security.googleblog.com/2024/09/a-new-path-for-kyber-on-web.html). It may be used in cryptographic testing environments or when available within industry- or government-approved libraries. diff --git a/5.0/en/0x93-Appendix-D_Recommendations.md b/5.0/en/0x93-Appendix-D_Recommendations.md index 33fb030374..496dd5ba61 100644 --- a/5.0/en/0x93-Appendix-D_Recommendations.md +++ b/5.0/en/0x93-Appendix-D_Recommendations.md @@ -44,6 +44,6 @@ There are a number of security processes which were removed from ASVS 5.0 but ar References: * [OWASP Threat Modeling Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html) -* [OWASP Threat modeling](https://owasp.org/www-project-threat-modeling/) +* [OWASP Threat modeling](https://owasp.org/www-community/Application_Threat_Modeling) * [OWASP Software Assurance Maturity Model Project](https://owasp.org/www-project-samm/) * [Microsoft SDL](https://www.microsoft.com/en-us/securityengineering/sdl/) diff --git a/5.0/en/0x94-Appendix-E_Contributors.md b/5.0/en/0x94-Appendix-E_Contributors.md index 8e807bf9c7..88508b2fdc 100644 --- a/5.0/en/0x94-Appendix-E_Contributors.md +++ b/5.0/en/0x94-Appendix-E_Contributors.md @@ -5,67 +5,67 @@ We gratefully acknowledge the contributions of the following people who have com If you are aware of any mistakes or would like your name to appear differently, please let us know. | | | | | -| --- | --- | --- | --- | -| Johan Sydseter ([sydseter](https://github.com/sydseter)) | luis servin ([lfservin](https://github.com/lfservin)) | Oleksii Dovydkov ([oleksiidov](https://github.com/oleksiidov)) | IZUKA Masahiro ([maizuka](https://github.com/maizuka)) | -| James Sulinski ([jsulinski](https://github.com/jsulinski)) | Eli Saad ([ThunderSon](https://github.com/ThunderSon)) | [kkshitish9](https://github.com/kkshitish9) | Andrew van der Stock ([vanderaj](https://github.com/vanderaj)) | -| Rick M ([kingthorin](https://github.com/kingthorin)) | Bankde Eakasit ([Bankde](https://github.com/Bankde)) | Michael Gargiullo ([mgargiullo](https://github.com/mgargiullo)) | Raphael Dunant ([Racater](https://github.com/Racater)) | -| Cesar Kohl ([cesarkohl](https://github.com/cesarkohl)) | [inaz0](https://github.com/inaz0) | Joerg Bruenner ([JoergBruenner](https://github.com/JoergBruenner)) | David Deatherage ([securitydave](https://github.com/securitydave)) | -| John Carroll ([yosignals](https://github.com/yosignals)) | Jim Fenton ([jimfenton](https://github.com/jimfenton)) | Matteo Pace ([M4tteoP](https://github.com/M4tteoP)) | Sebastien gioria ([SPoint42](https://github.com/SPoint42)) | -| Steven van der Baan ([vdbaan](https://github.com/vdbaan)) | Jeremy Bonghwan Choi ([jeremychoi](https://github.com/jeremychoi)) | [craig-shony](https://github.com/craig-shony) | Riccardo Sirigu ([ricsirigu](https://github.com/ricsirigu)) | -| Tomasz Wrobel ([tw2as](https://github.com/tw2as)) | Alena Dubeshko ([belalena](https://github.com/belalena)) | Rafael Green ([RafaelGreen1](https://github.com/RafaelGreen1)) | [mjang-cobalt](https://github.com/mjang-cobalt) | -| [clallier94](https://github.com/clallier94) | Kevin W. Wall ([kwwall](https://github.com/kwwall)) | Jordan Sherman ([jsherm-fwdsec](https://github.com/jsherm-fwdsec) / [deleterepo](https://github.com/deleterepo)) | Ingo Rauner ([ingo-rauner](https://github.com/ingo-rauner)) | -| Dirk Wetter ([drwetter](https://github.com/drwetter)) | Moshe Zioni ([moshe-apiiro](https://github.com/moshe-apiiro)) | Patrick Dwyer ([coderpatros](https://github.com/coderpatros)) | David Clarke ([davidclarke-au](https://github.com/davidclarke-au)) | -| Takaharu Ogasa ([takaharuogasa](https://github.com/takaharuogasa)) | Arkadii Yakovets ([arkid15r](https://github.com/arkid15r)) | Motoyasu Saburi ([motoyasu-saburi](https://github.com/motoyasu-saburi)) | [leirn](https://github.com/leirn) | -| [wet-certitude](https://github.com/wet-certitude) | [timhemel](https://github.com/timhemel) | RL Thornton ([thornshadow99](https://github.com/thornshadow99)) | Thomas Bandt ([aspnetde](https://github.com/aspnetde)) | -| Roel Storms ([roelstorms](https://github.com/roelstorms)) | Jeroen Willemsen ([commjoen](https://github.com/commjoen)) | [anonymous-31](https://github.com/anonymous-31) | Kamran Saifullah ([deFr0ggy](https://github.com/deFr0ggy)) | -| Steve Springett ([stevespringett](https://github.com/stevespringett)) | Spyros ([northdpole](https://github.com/northdpole)) | Hans Herrera ([hansphp](https://github.com/hansphp)) | [Marx314](https://github.com/Marx314) | -| [CarlosAllendes](https://github.com/CarlosAllendes) | Yonah Russ ([yruss972](https://github.com/yruss972)) | Sander Maijers ([sanmai-NL](https://github.com/sanmai-NL)) | Luboš Bretschneider ([bretik](https://github.com/bretik)) | -| Eva Sarafianou ([esarafianou](https://github.com/esarafianou)) | Ata Seren [ataseren](https://github.com/ataseren) | Steve Thomas ([Sc00bz](https://github.com/Sc00bz)) | Dominique RIGHETTO ([righettod](https://github.com/righettod)) | -| Steven van der Baan ([svdb-ncc](https://github.com/svdb-ncc)) | Michael Vacarella ([Aif4thah](https://github.com/Aif4thah)) | Tonimir Kisasondi ([tkisason](https://github.com/tkisason)) | Stefan Streichsbier ([streichsbaer](https://github.com/streichsbaer)) | -| [hi-unc1e](https://github.com/hi-unc1e) | sb3k ([starbuck3000](https://github.com/starbuck3000)) | [mario-platt](https://github.com/mario-platt) | Devdatta Akhawe ([devd](https://github.com/devd)) | -| Michael Gissing ([scolytus](https://github.com/scolytus)) | Jet Anderson ([thatsjet](https://github.com/thatsjet)) | Dave Wichers ([davewichers](https://github.com/davewichers)) | Jonny Schnittger ([JonnySchnittger](https://github.com/JonnySchnittger)) | -| Silvia Väli ([silviavali](https://github.com/silviavali)) | [jackgates73](https://github.com/jackgates73) | [1songb1rd](https://github.com/1songb1rd) | Timur - ([timurozkul](https://github.com/timurozkul)) | -| Gareth Heyes ([hackvertor](https://github.com/hackvertor)) | [appills](https://github.com/appills) | [suvikaartinen](https://github.com/suvikaartinen) | chaals ([chaals](https://github.com/chaals)) | -| DanielPharos ([AtlasHackert](https://github.com/AtlasHackert)) | will Farrell ([willfarrell](https://github.com/willfarrell)) | Alina Vasiljeva ([avasiljeva](https://github.com/avasiljeva)) | Paul McCann ([ismisepaul](https://github.com/ismisepaul)) | -| Sage ([SajjadPourali](https://github.com/SajjadPourali)) | [rbsec](https://github.com/rbsec) | Benedikt Bauer ([mastacheata](https://github.com/mastacheata)) | James Jardine ([jamesjardine](https://github.com/jamesjardine)) | -| Mark Burnett ([m8urnett](https://github.com/m8urnett)) | [dschwarz91](https://github.com/dschwarz91) | Cyber-AppSec ([Cyber-AppSec](https://github.com/Cyber-AppSec)) | [Tib3rius](https://github.com/Tib3rius) | -| BitnessWise ([bitnesswise](https://github.com/bitnesswise)) | damienbod ([damienbod](https://github.com/damienbod)) | Jared Meit ([jmeit-fwdsec](https://github.com/jmeit-fwdsec)) | Stefan Seelmann ([sseelmann](https://github.com/sseelmann)) | -| Brendan O'Connor ([ussjoin](https://github.com/ussjoin)) | Andrei Titov ([andrettv](https://github.com/andrettv)) | Hans-Petter Fjeld ([atluxity](https://github.com/atluxity)) | [markehack](https://github.com/markehack) | -| Neil Madden ([NeilMadden](https://github.com/NeilMadden)) | Michael Geramb ([mgeramb](https://github.com/mgeramb)) | Osama Elnaggar ([ossie-git](https://github.com/ossie-git)) | [mackowski](https://github.com/mackowski) | -| Ravi Balla ([raviballa](https://github.com/raviballa)) | Hazana ([hazanasec](https://github.com/hazanasec)) | David Means ([dmeans82](https://github.com/dmeans82)) | Alexander Stein ([tohch4](https://github.com/tohch4)) | -| BaeSenseii ([baesenseii](https://github.com/baesenseii)) | Vincent De Schutter ([VincentDS](https://github.com/VincentDS)) | S Bani ([sbani](https://github.com/sbani)) | Mitsuaki Akiyama ([mak1yama](https://github.com/mak1yama)) | -| Christopher Loessl ([hashier](https://github.com/hashier)) | [victorxm](https://github.com/victorxm) | Michal Rada ([michalradacz](https://github.com/michalradacz)) | Veeresh Devireddy ([drveresh](https://github.com/drveresh)) | -| [MaknaSEO](https://github.com/MaknaSEO) | [darkzero2022](https://github.com/darkzero2022) | Liam ([LiamDobbelaere](https://github.com/LiamDobbelaere)) | Frank Denis ([jedisct1](https://github.com/jedisct1)) | -| Otto Sulin ([ottosulin](https://github.com/ottosulin)) | [carllaw6885](https://github.com/carllaw6885) | Anders Johan Holmefjord ([aholmis](https://github.com/aholmis)) | Richard Fritsch ([rfricz](https://github.com/rfricz)) | -| [mesutgungor](https://github.com/mesutgungor) | Scott Helme ([ScottHelme](https://github.com/ScottHelme)) | Carlo Reggiani ([carloreggiani](https://github.com/carloreggiani)) | Suyash Srivastava ([suyash5053](https://github.com/suyash5053)) | -| Mark Potter ([markonweb](https://github.com/markonweb)) | Arjan Lamers ([alamers](https://github.com/alamers)) | Gøran Breivik ([gobrtg](https://github.com/gobrtg)) | [flo-blg](https://github.com/flo-blg) | -| Guillaume Déflache ([guillaume-d](https://github.com/guillaume-d)) | Toufik Airane ([toufik-airane](https://github.com/toufik-airane)) | Keith Hoodlet ([securingdev](https://github.com/securingdev)) | Sinner ([SoftwareSinner](https://github.com/SoftwareSinner)) | -| [iloving](https://github.com/iloving) | Jeroen Beckers ([TheDauntless](https://github.com/TheDauntless)) | Joubin Jabbari ([joubin](https://github.com/joubin)) | yu fujioka ([fujiokayu](https://github.com/fujiokayu)) | -| execjosh ([execjosh](https://github.com/execjosh)) | Alicja Kario ([tomato42](https://github.com/tomato42)) | Sidney Ribeiro ([srjsoftware](https://github.com/srjsoftware)) | Gabriel Marquet ([Gby56](https://github.com/Gby56)) | -| Drew Schulz ([drschulz](https://github.com/drschulz)) | [bedirhan](https://github.com/bedirhan) | [muralito](https://github.com/muralito) | Ronnie Flathers ([ropnop](https://github.com/ropnop)) | -| Philippe De Ryck ([philippederyck](https://github.com/philippederyck)) | Malte ([mal33](https://github.com/mal33)) | [MazeOfThoughts](https://github.com/MazeOfThoughts) | Andreas Falk ([andifalk](https://github.com/andifalk)) | -| Javi ([javixeneize](https://github.com/javixeneize)) | Daniel Hahn ([averell23](https://github.com/averell23)) | [borislav-c](https://github.com/borislav-c) | Robin Wood ([digininja](https://github.com/digininja)) | -| [miro2ns](https://github.com/miro2ns) | Jan Dockx ([jandockx](https://github.com/jandockx)) | [vipinsaini434](https://github.com/vipinsaini434) | [priyanshukumar397](https://github.com/priyanshukumar397) | -| Nat Sakimura ([sakimura](https://github.com/sakimura)) | Benjamin Häublein ([BenjaminHae](https://github.com/BenjaminHae)) | [unknown-user-from](https://github.com/unknown-user-from) | Ali Ramazan TAŞDELEN ([alitasdln](https://github.com/alitasdln)) | -| Pedro Escaleira ([oEscal](https://github.com/oEscal)) | Josh ([josh-hemphill](https://github.com/josh-hemphill)) | Tim Würtele ([SECtim](https://github.com/SECtim)) | AviD ([avidouglen](https://github.com/avidouglen)) | -| SheHacksPurple ([shehackspurple](https://github.com/shehackspurple)) | [fcerullo-cycubix](https://github.com/fcerullo-cycubix) | Hector Eryx Paredes Camacho ([heryxpc](https://github.com/heryxpc)) | Irene Michlin ([irene221b](https://github.com/irene221b)) | -| Jonah Y-M ([TG-Techie](https://github.com/TG-Techie)) | Dhiraj Bahroos ([bahroos](https://github.com/bahroos)) | Jef Meijvis ([jefmeijvis](https://github.com/jefmeijvis)) | [IzmaDoesItbeta](https://github.com/IzmaDoesItbeta) | -| Abdessamad TEMMAR ([TmmmmmR](https://github.com/TmmmmmR)) | [sectroyer](https://github.com/sectroyer) | Soh Satoh ([sohsatoh](https://github.com/sohsatoh)) | [regoravalaz](https://github.com/regoravalaz) | -| james-t ([james-bitherder](https://github.com/james-bitherder)) | Aram Hovsepyan ([aramhovsepyan](https://github.com/aramhovsepyan)) | [JaimeGomezGarciaSan](https://github.com/JaimeGomezGarciaSan) | [ValdiGit01](https://github.com/ValdiGit01) | -| iwatachan ([ishowta](https://github.com/ishowta)) | Vinod Anandan ([VinodAnandan](https://github.com/VinodAnandan)) | Kevin Kien ([KevinKien](https://github.com/KevinKien)) | [paul-williamson-swoop](https://github.com/paul-williamson-swoop) | -| [endergzr](https://github.com/endergzr) | Radhwan Alshamamri ([Rado0z](https://github.com/Rado0z)) | Grant Ongers ([rewtd](https://github.com/rewtd)) | Cure53 ([cure53](https://github.com/cure53)) | -| [AliR2Linux](https://github.com/AliR2Linux) | Ads Dawson ([GangGreenTemperTatum](https://github.com/GangGreenTemperTatum)) | William Reyor ([BillReyor](https://github.com/BillReyor)) | gabe ([gcrow](https://github.com/gcrow)) | -| [mascotter](https://github.com/mascotter) | [luissaiz](https://github.com/luissaiz) | Suren Manukyan ([vx-sec](https://github.com/vx-sec)) | Piotr Gliźniewicz ([pglizniewicz](https://github.com/pglizniewicz)) | -| Tadeusz Wachowski ([tadeuszwachowski](https://github.com/tadeuszwachowski)) | Nasir aka Nate ([andesec](https://github.com/andesec)) | [settantasette](https://github.com/settantasette) | Lars Haulin ([LarsH](https://github.com/LarsH)) | -| Terence Eden ([edent](https://github.com/edent)) | [JasmineScholz](https://github.com/JasmineScholz) | Arun Sivadasan ([teavanist](https://github.com/teavanist)) | Yusuf GÜR ([yusuffgur](https://github.com/yusuffgur)) | -| Troy Marshall ([troymarshall](https://github.com/troymarshall)) | Tanner Prynn ([tprynn](https://github.com/tprynn)) | Nick K. ([nickific](https://github.com/nickific)) | [raoul361](https://github.com/raoul361) | -| Azeem Ilyas ([TheAxZim](https://github.com/TheAxZim)) | Evo Stamatov ([avioli](https://github.com/avioli)) | Tim Potter ([timpotter87](https://github.com/timpotter87)) | Gavin Ray ([GavinRay97](https://github.com/GavinRay97)) | -| monis ([demideus](https://github.com/demideus)) | Marcin Hoppe ([MarcinHoppe](https://github.com/MarcinHoppe)) | Grambulf ([ramshazar](https://github.com/ramshazar)) | Jordan Pike ([computersarebad](https://github.com/computersarebad)) | -| Jason Rogers ([jason-invision](https://github.com/jason-invision)) | Ben Hall ([benbhall](https://github.com/benbhall)) | JamesPoppyCock ([jamesly123](https://github.com/jamesly123)) | WhiteHackLabs ([whitehacklabs](https://github.com/whitehacklabs)) | -| Alex Gaynor ([alex](https://github.com/alex)) | Filip van Laenen ([filipvanlaenen](https://github.com/filipvanlaenen)) | [jeurgen](https://github.com/jeurgen) | [GraoMelo](https://github.com/GraoMelo) | -| Andreas Kurtz ([ay-kay](https://github.com/ay-kay)) | Tom Tervoort ([TomTervoort](https://github.com/TomTervoort)) | old man ([deveras](https://github.com/deveras)) | Marco Schnüriger ([marcortw](https://github.com/marcortw)) | -| [stiiin](https://github.com/stiiin) | infoseclearn ([teaminfoseclearn](https://github.com/teaminfoseclearn)) | [hljupkij](https://github.com/hljupkij) | Noe ([nmarher](https://github.com/nmarher)) | -| Lyz ([lyz-code](https://github.com/lyz-code)) | Martin Riedel ([mrtnrdl](https://github.com/mrtnrdl)) | KIM Jaesuck ([tcaesvk](https://github.com/tcaesvk)) | Barbara Schachner ([bschach](https://github.com/bschach)) | -| René Reuter ([AresSec](https://github.com/AresSec)) | [carhackpils](https://github.com/carhackpils) | Tyler ([tyler2cr](https://github.com/tyler2cr)) | Hugo ([hasousa](https://github.com/hasousa)) | -| Wouter Bloeyaert ([Someniak](https://github.com/Someniak)) | Mark de Rijk ([markderijkinfosec](https://github.com/markderijkinfosec)) | Ramin ([picohub](https://github.com/picohub)) | Philip D. Turner ([philipdturner](https://github.com/philipdturner)) | -| Will Chatham ([willc](https://github.com/willc)) | | | | +|---|---|---|---| +| Johan Sydseter ([sydseter](https://github.com/sydseter)) | luis servin ([lfservin](https://github.com/lfservin)) | Oleksii Dovydkov ([oleksiidov](https://github.com/oleksiidov)) | IZUKA Masahiro ([maizuka](https://github.com/maizuka)) | +| James Sulinski ([jsulinski](https://github.com/jsulinski)) | Eli Saad ([ThunderSon](https://github.com/ThunderSon)) | [kkshitish9](https://github.com/kkshitish9) | Andrew van der Stock ([vanderaj](https://github.com/vanderaj)) | +| Rick M ([kingthorin](https://github.com/kingthorin)) | Bankde Eakasit ([Bankde](https://github.com/Bankde)) | Michael Gargiullo ([mgargiullo](https://github.com/mgargiullo)) | Raphael Dunant ([Racater](https://github.com/Racater)) | +| Cesar Kohl ([cesarkohl](https://github.com/cesarkohl)) | [inaz0](https://github.com/inaz0) | Joerg Bruenner ([JoergBruenner](https://github.com/JoergBruenner)) | David Deatherage ([securitydave](https://github.com/securitydave)) | +| John Carroll ([yosignals](https://github.com/yosignals)) | Jim Fenton ([jimfenton](https://github.com/jimfenton)) | Matteo Pace ([M4tteoP](https://github.com/M4tteoP)) | Sebastien gioria ([SPoint42](https://github.com/SPoint42)) | +| Steven van der Baan ([vdbaan](https://github.com/vdbaan)) | Jeremy Bonghwan Choi ([jeremychoi](https://github.com/jeremychoi)) | [craig-shony](https://github.com/craig-shony) | Riccardo Sirigu ([ricsirigu](https://github.com/ricsirigu)) | +| Tomasz Wrobel ([tw2as](https://github.com/tw2as)) | Alena Dubeshko ([belalena](https://github.com/belalena)) | Rafael Green ([RafaelGreen1](https://github.com/RafaelGreen1)) | [mjang-cobalt](https://github.com/mjang-cobalt) | +| [clallier94](https://github.com/clallier94) | Kevin W. Wall ([kwwall](https://github.com/kwwall)) | Jordan Sherman ([jsherm-fwdsec](https://github.com/jsherm-fwdsec) / [deleterepo](https://github.com/deleterepo)) | Ingo Rauner ([ingo-rauner](https://github.com/ingo-rauner)) | +| Dirk Wetter ([drwetter](https://github.com/drwetter)) | Moshe Zioni ([moshe-apiiro](https://github.com/moshe-apiiro)) | Patrick Dwyer ([coderpatros](https://github.com/coderpatros)) | David Clarke ([davidclarke-au](https://github.com/davidclarke-au)) | +| Takaharu Ogasa ([takaharuogasa](https://github.com/takaharuogasa)) | Arkadii Yakovets ([arkid15r](https://github.com/arkid15r)) | Motoyasu Saburi ([motoyasu-saburi](https://github.com/motoyasu-saburi)) | [leirn](https://github.com/leirn) | +| [wet-certitude](https://github.com/wet-certitude) | [timhemel](https://github.com/timhemel) | RL Thornton ([thornshadow99](https://github.com/thornshadow99)) | Thomas Bandt ([aspnetde](https://github.com/aspnetde)) | +| Roel Storms ([roelstorms](https://github.com/roelstorms)) | Jeroen Willemsen ([commjoen](https://github.com/commjoen)) | [anonymous-31](https://github.com/anonymous-31) | Kamran Saifullah ([deFr0ggy](https://github.com/deFr0ggy)) | +| Steve Springett ([stevespringett](https://github.com/stevespringett)) | Spyros ([northdpole](https://github.com/northdpole)) | Hans Herrera ([hansphp](https://github.com/hansphp)) | [Marx314](https://github.com/Marx314) | +| [CarlosAllendes](https://github.com/CarlosAllendes) | Yonah Russ ([yruss972](https://github.com/yruss972)) | Sander Maijers ([sanmai-NL](https://github.com/sanmai-NL)) | Luboš Bretschneider ([bretik](https://github.com/bretik)) | +| Eva Sarafianou ([esarafianou](https://github.com/esarafianou)) | [ataseren](https://github.com/ataseren) | Steve Thomas ([Sc00bz](https://github.com/Sc00bz)) | Dominique RIGHETTO ([righettod](https://github.com/righettod)) | +| Steven van der Baan ([svdb-ncc](https://github.com/svdb-ncc)) | Michael Vacarella ([Aif4thah](https://github.com/Aif4thah)) | Tonimir Kisasondi ([tkisason](https://github.com/tkisason)) | Stefan Streichsbier ([streichsbaer](https://github.com/streichsbaer)) | +| [hi-unc1e](https://github.com/hi-unc1e) | sb3k ([starbuck3000](https://github.com/starbuck3000)) | [mario-platt](https://github.com/mario-platt) | Devdatta Akhawe ([devd](https://github.com/devd)) | +| Michael Gissing ([scolytus](https://github.com/scolytus)) | Jet Anderson ([thatsjet](https://github.com/thatsjet)) | Dave Wichers ([davewichers](https://github.com/davewichers)) | Jonny Schnittger ([JonnySchnittger](https://github.com/JonnySchnittger)) | +| Silvia Väli ([silviavali](https://github.com/silviavali)) | [jackgates73](https://github.com/jackgates73) | [1songb1rd](https://github.com/1songb1rd) | Timur - ([timurozkul](https://github.com/timurozkul)) | +| Gareth Heyes ([hackvertor](https://github.com/hackvertor)) | [appills](https://github.com/appills) | [suvikaartinen](https://github.com/suvikaartinen) | chaals ([chaals](https://github.com/chaals)) | +| DanielPharos ([AtlasHackert](https://github.com/AtlasHackert)) | will Farrell ([willfarrell](https://github.com/willfarrell)) | Alina Vasiljeva ([avasiljeva](https://github.com/avasiljeva)) | Paul McCann ([ismisepaul](https://github.com/ismisepaul)) | +| Sage ([SajjadPourali](https://github.com/SajjadPourali)) | [rbsec](https://github.com/rbsec) | Benedikt Bauer ([mastacheata](https://github.com/mastacheata)) | James Jardine ([jamesjardine](https://github.com/jamesjardine)) | +| Mark Burnett ([m8urnett](https://github.com/m8urnett)) | [dschwarz91](https://github.com/dschwarz91) | Cyber-AppSec ([Cyber-AppSec](https://github.com/Cyber-AppSec)) | [Tib3rius](https://github.com/Tib3rius) | +| BitnessWise ([bitnesswise](https://github.com/bitnesswise)) | damienbod ([damienbod](https://github.com/damienbod)) | Jared Meit ([jmeit-fwdsec](https://github.com/jmeit-fwdsec)) | Stefan Seelmann ([sseelmann](https://github.com/sseelmann)) | +| Brendan O'Connor ([ussjoin](https://github.com/ussjoin)) | Andrei Titov ([andrettv](https://github.com/andrettv)) | Hans-Petter Fjeld ([atluxity](https://github.com/atluxity)) | [markehack](https://github.com/markehack) | +| Neil Madden ([NeilMadden](https://github.com/NeilMadden)) | Michael Geramb ([mgeramb](https://github.com/mgeramb)) | Osama Elnaggar ([ossie-git](https://github.com/ossie-git)) | [mackowski](https://github.com/mackowski) | +| Ravi Balla ([raviballa](https://github.com/raviballa)) | Hazana ([hazanasec](https://github.com/hazanasec)) | David Means ([dmeans82](https://github.com/dmeans82)) | Alexander Stein ([tohch4](https://github.com/tohch4)) | +| BaeSenseii ([baesenseii](https://github.com/baesenseii)) | Vincent De Schutter ([VincentDS](https://github.com/VincentDS)) | S Bani ([sbani](https://github.com/sbani)) | Mitsuaki Akiyama ([mak1yama](https://github.com/mak1yama)) | +| Christopher Loessl ([hashier](https://github.com/hashier)) | [victorxm](https://github.com/victorxm) | Michal Rada ([michalradacz](https://github.com/michalradacz)) | Veeresh Devireddy ([drveresh](https://github.com/drveresh)) | +| [MaknaSEO](https://github.com/MaknaSEO) | [darkzero2022](https://github.com/darkzero2022) | Liam ([LiamDobbelaere](https://github.com/LiamDobbelaere)) | Frank Denis ([jedisct1](https://github.com/jedisct1)) | +| Otto Sulin ([ottosulin](https://github.com/ottosulin)) | [carllaw6885](https://github.com/carllaw6885) | Anders Johan Holmefjord ([aholmis](https://github.com/aholmis)) | Richard Fritsch ([rfricz](https://github.com/rfricz)) | +| [mesutgungor](https://github.com/mesutgungor) | Scott Helme ([ScottHelme](https://github.com/ScottHelme)) | Carlo Reggiani ([carloreggiani](https://github.com/carloreggiani)) | Suyash Srivastava ([suyash5053](https://github.com/suyash5053)) | +| Mark Potter ([markonweb](https://github.com/markonweb)) | Arjan Lamers ([alamers](https://github.com/alamers)) | Gøran Breivik ([gobrtg](https://github.com/gobrtg)) | [flo-blg](https://github.com/flo-blg) | +| Guillaume Déflache ([guillaume-d](https://github.com/guillaume-d)) | Toufik Airane ([toufik-airane](https://github.com/toufik-airane)) | Keith Hoodlet ([securingdev](https://github.com/securingdev)) | Sinner ([SoftwareSinner](https://github.com/SoftwareSinner)) | +| [iloving](https://github.com/iloving) | Jeroen Beckers ([TheDauntless](https://github.com/TheDauntless)) | Joubin Jabbari ([joubin](https://github.com/joubin)) | yu fujioka ([fujiokayu](https://github.com/fujiokayu)) | +| execjosh ([execjosh](https://github.com/execjosh)) | Alicja Kario ([tomato42](https://github.com/tomato42)) | Sidney Ribeiro ([srjsoftware](https://github.com/srjsoftware)) | Gabriel Marquet ([Gby56](https://github.com/Gby56)) | +| Drew Schulz ([drschulz](https://github.com/drschulz)) | [bedirhan](https://github.com/bedirhan) | [muralito](https://github.com/muralito) | Ronnie Flathers ([ropnop](https://github.com/ropnop)) | +| Philippe De Ryck ([philippederyck](https://github.com/philippederyck)) | Malte ([mal33](https://github.com/mal33)) | [MazeOfThoughts](https://github.com/MazeOfThoughts) | Andreas Falk ([andifalk](https://github.com/andifalk)) | +| Javi ([javixeneize](https://github.com/javixeneize)) | Daniel Hahn ([averell23](https://github.com/averell23)) | [borislav-c](https://github.com/borislav-c) | Robin Wood ([digininja](https://github.com/digininja)) | +| [miro2ns](https://github.com/miro2ns) | Jan Dockx ([jandockx](https://github.com/jandockx)) | [vipinsaini434](https://github.com/vipinsaini434) | [priyanshukumar397](https://github.com/priyanshukumar397) | +| Nat Sakimura ([sakimura](https://github.com/sakimura)) | Benjamin Häublein ([BenjaminHae](https://github.com/BenjaminHae)) | [unknown-user-from](https://github.com/unknown-user-from) | Ali Ramazan TAŞDELEN ([alitasdln](https://github.com/alitasdln)) | +| Pedro Escaleira ([oEscal](https://github.com/oEscal)) | Josh ([josh-hemphill](https://github.com/josh-hemphill)) | Tim Würtele ([SECtim](https://github.com/SECtim)) | AviD ([avidouglen](https://github.com/avidouglen)) | +| SheHacksPurple ([shehackspurple](https://github.com/shehackspurple)) | [fcerullo-cycubix](https://github.com/fcerullo-cycubix) | Hector Eryx Paredes Camacho ([heryxpc](https://github.com/heryxpc)) | Irene Michlin ([irene221b](https://github.com/irene221b)) | +| Jonah Y-M ([TG-Techie](https://github.com/TG-Techie)) | Dhiraj Bahroos ([bahroos](https://github.com/bahroos)) | Jef Meijvis ([jefmeijvis](https://github.com/jefmeijvis)) | [IzmaDoesItbeta](https://github.com/IzmaDoesItbeta) | +| Abdessamad TEMMAR ([TmmmmmR](https://github.com/TmmmmmR)) | [sectroyer](https://github.com/sectroyer) | Soh Satoh ([sohsatoh](https://github.com/sohsatoh)) | [regoravalaz](https://github.com/regoravalaz) | +| james-t ([james-bitherder](https://github.com/james-bitherder)) | Aram Hovsepyan ([aramhovsepyan](https://github.com/aramhovsepyan)) | [JaimeGomezGarciaSan](https://github.com/JaimeGomezGarciaSan) | [ValdiGit01](https://github.com/ValdiGit01) | +| iwatachan ([ishowta](https://github.com/ishowta)) | Vinod Anandan ([VinodAnandan](https://github.com/VinodAnandan)) | Kevin Kien ([KevinKien](https://github.com/KevinKien)) | [paul-williamson-swoop](https://github.com/paul-williamson-swoop) | +| [endergzr](https://github.com/endergzr) | Radhwan Alshamamri ([Rado0z](https://github.com/Rado0z)) | Grant Ongers ([rewtd](https://github.com/rewtd)) | Cure53 ([cure53](https://github.com/cure53)) | +| [AliR2Linux](https://github.com/AliR2Linux) | Ads Dawson ([GangGreenTemperTatum](https://github.com/GangGreenTemperTatum)) | William Reyor ([BillReyor](https://github.com/BillReyor)) | gabe ([gcrow](https://github.com/gcrow)) | +| [mascotter](https://github.com/mascotter) | [luissaiz](https://github.com/luissaiz) | Suren Manukyan ([vx-sec](https://github.com/vx-sec)) | Piotr Gliźniewicz ([pglizniewicz](https://github.com/pglizniewicz)) | +| Tadeusz Wachowski ([tadeuszwachowski](https://github.com/tadeuszwachowski)) | Nasir aka Nate ([andesec](https://github.com/andesec)) | [settantasette](https://github.com/settantasette) | Lars Haulin ([LarsH](https://github.com/LarsH)) | +| Terence Eden ([edent](https://github.com/edent)) | [JasmineScholz](https://github.com/JasmineScholz) | Arun Sivadasan ([teavanist](https://github.com/teavanist)) | Yusuf GÜR ([yusuffgur](https://github.com/yusuffgur)) | +| Troy Marshall ([troymarshall](https://github.com/troymarshall)) | Tanner Prynn ([tprynn](https://github.com/tprynn)) | Nick K. ([nickific](https://github.com/nickific)) | [raoul361](https://github.com/raoul361) | +| Azeem Ilyas ([TheAxZim](https://github.com/TheAxZim)) | Evo Stamatov ([avioli](https://github.com/avioli)) | Tim Potter ([timpotter87](https://github.com/timpotter87)) | Gavin Ray ([GavinRay97](https://github.com/GavinRay97)) | +| monis ([demideus](https://github.com/demideus)) | Marcin Hoppe ([MarcinHoppe](https://github.com/MarcinHoppe)) | Grambulf ([ramshazar](https://github.com/ramshazar)) | Jordan Pike ([computersarebad](https://github.com/computersarebad)) | +| Jason Rogers ([jason-invision](https://github.com/jason-invision)) | Ben Hall ([benbhall](https://github.com/benbhall)) | JamesPoppyCock ([jamesly123](https://github.com/jamesly123)) | WhiteHackLabs ([whitehacklabs](https://github.com/whitehacklabs)) | +| Alex Gaynor ([alex](https://github.com/alex)) | Filip van Laenen ([filipvanlaenen](https://github.com/filipvanlaenen)) | [jeurgen](https://github.com/jeurgen) | [GraoMelo](https://github.com/GraoMelo) | +| Andreas Kurtz ([ay-kay](https://github.com/ay-kay)) | Tom Tervoort ([TomTervoort](https://github.com/TomTervoort)) | old man ([deveras](https://github.com/deveras)) | Marco Schnüriger ([marcortw](https://github.com/marcortw)) | +| [stiiin](https://github.com/stiiin) | infoseclearn ([teaminfoseclearn](https://github.com/teaminfoseclearn)) | [hljupkij](https://github.com/hljupkij) | Noe ([nmarher](https://github.com/nmarher)) | +| Lyz ([lyz-code](https://github.com/lyz-code)) | Martin Riedel ([mrtnrdl](https://github.com/mrtnrdl)) | KIM Jaesuck ([tcaesvk](https://github.com/tcaesvk)) | Barbara Schachner ([bschach](https://github.com/bschach)) | +| René Reuter ([AresSec](https://github.com/AresSec)) | [carhackpils](https://github.com/carhackpils) | Tyler ([tyler2cr](https://github.com/tyler2cr)) | Hugo ([hasousa](https://github.com/hasousa)) | +| Wouter Bloeyaert ([Someniak](https://github.com/Someniak)) | Mark de Rijk ([markderijkinfosec](https://github.com/markderijkinfosec)) | Ramin ([picohub](https://github.com/picohub)) | Philip D. Turner ([philipdturner](https://github.com/philipdturner)) | +| Will Chatham ([willc](https://github.com/willc)) | | | | diff --git a/5.0/fr/0x00-Header.yaml b/5.0/fr/0x00-Header.yaml new file mode 100644 index 0000000000..baa283a0b7 --- /dev/null +++ b/5.0/fr/0x00-Header.yaml @@ -0,0 +1,16 @@ +--- + title: "Référentiel de vérification de la sécurité des applications" + subtitle: "Version 5.0.0" + date: Mai 2025 + titlepage: true + titlepage-rule-height: 0 + titlepage-logo: "images/owasp_logo_1c_notext.png" + table-use-row-colors: true + toc: true + toc-own-page: true + geometry: "left=2cm,right=2cm,top=3cm,bottom=3cm" + CJKmainfont: "Noto Sans CJK JP" + mainfont: "Source Serif 4" + sansfont: "Source Sans 3" +--- + diff --git a/5.0/fr/0x01-Frontispiece.md b/5.0/fr/0x01-Frontispiece.md new file mode 100644 index 0000000000..17644d009b --- /dev/null +++ b/5.0/fr/0x01-Frontispiece.md @@ -0,0 +1,46 @@ +# Frontispice + +## À propos du référentiel + +Le Référentiel de vérification de la sécurité des applications (Application Security Verification Standard) est une liste d'exigences de sécurité des applications que les architectes, les développeurs, les testeurs, les professionnels de la sécurité, les fournisseurs d'outils et les consommateurs peuvent utiliser pour définir, créer, tester et vérifier des applications sécurisées. + +## Copyright et licence + +Version 5.0.0, Mai 2025 + +![license](../images/license.png) + +Copyright © 2008-2025 La Fondation OWASP. + +Ce document est publié sous la [licence Creative Commons Attribution ShareAlike 4.0](https://creativecommons.org/licenses/by-sa/4.0/). + +Pour toute réutilisation ou distribution, vous devez indiquer clairement aux autres les termes de la licence de ce travail. + +## Chefs de projet + +| | | +|---------------------- |----------------- | +| Elar Lang | Josh C Grossman | +| Jim Manico | Daniel Cuthbert | + +## Groupes de travail + +| | | | | +|---------------- |------------------ |------------------- |----------------- | +| Tobias Ahnoff | Ralph Andalis | Ryan Armstrong | Gabriel Corona | +| Meghan Jacquot | Shanni Prutchi | Iman Sharafaldin | Eden Yardeni | + +## Autres contributeurs majeurs + +| | | +|------------------ |-------------------| +| Sjoerd Langkemper | Isaac Lewis | +| Mark Carney | Sandro Gauci | + +## Contributeurs et relecteurs + +Nous avons inclus une liste des autres contributeurs dans l’annexe E. + +S'il manque un crédit dans la liste des crédits 5.0, veuillez enregistrer un ticket sur GitHub pour être reconnu dans les futures mises à jour. + +Le référentiel de vérification de la sécurité des applications repose sur les épaules des personnes concernées, de ASVS 1.0 en 2008 à 4.0 en 2019. Une grande partie de la structure et des éléments de vérification qui sont encore dans l'ASVS aujourd'hui ont été écrits à l'origine par Andrew van der Stock, Mike Boberski, Jeff Williams et/ou Dave Wichers, mais il y a beaucoup plus de contributeurs. Merci à tous ceux qui y ont participé précédemment. Pour une liste complète de tous ceux qui ont contribué aux versions précédentes, veuillez consulter chaque version antérieure. diff --git a/5.0/fr/0x02-Preface.md b/5.0/fr/0x02-Preface.md new file mode 100644 index 0000000000..6322e99ace --- /dev/null +++ b/5.0/fr/0x02-Preface.md @@ -0,0 +1,29 @@ +# Préface + +Bienvenue dans la version 5.0 du référentiel de vérification de la sécurité des applications (ASVS). + +## Introduction + +Lancé à l'origine en 2008 grâce à une collaboration communautaire mondiale, l'ASVS définit un ensemble exhaustif d'exigences de sécurité pour la conception, le développement et le test d'applications et de services Web modernes. + +Après la sortie d'ASVS 4.0 en 2019 et sa mise à jour mineure (v4.0.3) en 2021, la version 5.0 représente une étape importante, modernisée pour refléter les dernières avancées en matière de sécurité logicielle. + +ASVS 5.0 est le résultat de nombreuses contributions des chefs de projet, des membres du groupe de travail et de la communauté OWASP au sens large pour mettre à jour et améliorer ce référentiel important. + +## Principes derrière la version 5.0 + +Cette révision majeure a été élaborée en gardant à l’esprit plusieurs principes clés : + +* Périmètre et orientation affinées : Cette version du référentiel a été conçue pour s'aligner plus directement sur les piliers fondamentaux de son nom : Application, Sécurité, Vérification et Référentiel. Les exigences ont été réécrites afin de mettre l'accent sur la prévention des failles de sécurité plutôt que d'imposer des implémentations techniques spécifiques. Les textes des exigences sont explicites et expliquent leur raison d'être. + +* Prise en charge des décisions de sécurité documentées : ASVS 5.0 introduit des exigences de documentation des décisions de sécurité clés. Cela améliore la traçabilité et prend en charge les implémentations qui dépendent du contexte, permettant aux organisations d'adapter leur posture de sécurité à leurs besoins et risques spécifiques. + +* Niveaux mis à jour : Bien qu'ASVS conserve son modèle à trois niveaux, les définitions des niveaux ont évolué pour faciliter son adoption. Le niveau 1 est conçu comme la première étape de l'adoption d'ASVS, fournissant la première couche de défense. Le niveau 2 offre une vue d'ensemble des pratiques de sécurité standard, et le niveau 3 répond aux exigences avancées de haute assurance. + +* Contenu restructuré et enrichi : ASVS 5.0 comprend environ 350 exigences réparties en 17 chapitres. Les chapitres ont été réorganisés pour plus de clarté et de praticité. Un mappage bidirectionnel entre les versions 4.0 et 5.0 est fourni pour faciliter la migration. + +## Regard vers l'avenir + +Tout comme la sécurisation d'une application n'est jamais vraiment achevée, l'ASVS ne l'est pas non plus. Bien que la version 5.0 soit une version majeure, le développement se poursuit. Cette version permet à la communauté de bénéficier des améliorations et des ajouts accumulés, et pose également les bases de futures améliorations. Cela pourrait inclure des efforts communautaires pour créer des guides de mise en œuvre et de vérification, basés sur les exigences de base. + +ASVS 5.0 est conçu pour servir de base fiable au développement de logiciels sécurisés. La communauté est invitée à adopter, contribuer et développer ce référentiel afin de faire progresser collectivement la sécurité des applications. diff --git a/5.0/fr/0x03-What-is-the-ASVS.md b/5.0/fr/0x03-What-is-the-ASVS.md new file mode 100644 index 0000000000..fe9cf4ebac --- /dev/null +++ b/5.0/fr/0x03-What-is-the-ASVS.md @@ -0,0 +1,195 @@ +# Qu'est-ce que l'ASVS ? + +Le Référentiel de vérification de la sécurité des applications (ASVS) définit des exigences de sécurité pour les applications et services web. Elle constitue une ressource précieuse pour quiconque souhaite concevoir, développer et maintenir des applications sécurisées ou évaluer leur sécurité. + +Ce chapitre décrit les aspects essentiels de l'utilisation de l'ASVS, notamment son champ d'application, la structure de ses niveaux de priorité et ses principaux cas d'utilisation. + +## Périmètre de l'ASVS + +Le périmètre de l'ASVS est définie par son nom : Application, Sécurité, Vérification et Référentiel. Elle établit les exigences incluses ou exclues, avec pour objectif principal d'identifier les principes de sécurité à respecter. Elle prend également en compte les exigences de documentation, qui servent de base aux exigences de mise en œuvre. + +Il n'existe aucun périmètre pour les attaquants. Par conséquent, les exigences de l'ASVS doivent être évaluées parallèlement aux recommandations relatives aux autres aspects du cycle de vie des applications, notamment les processus CI/CD, l'hébergement et les activités opérationnelles. + +### Application + +ASVS définit une « application » comme le produit logiciel en cours de développement, dans lequel des contrôles de sécurité doivent être intégrés. ASVS ne prescrit pas les activités du cycle de développement ni la manière dont l'application doit être construite via un pipeline CI/CD ; il spécifie plutôt les résultats de sécurité à atteindre au sein même du produit. + +Les composants qui traitent, modifient ou valident le trafic HTTP, tels que les pares-feux d'applications web (WAF), les équilibreurs de charge ou les proxys, peuvent être considérés comme faisant partie de l'application à ces fins spécifiques, car certains contrôles de sécurité en dépendent directement ou peuvent être implémentés par leur intermédiaire. Ces composants doivent être pris en compte pour les exigences liées aux réponses mises en cache, à la limitation du débit ou à la restriction des connexions entrantes et sortantes en fonction de la source et de la destination. + +À l'inverse, ASVS exclut généralement les exigences qui ne concernent pas directement l'application ou dont la configuration ne relève pas de sa responsabilité. Par exemple, les problèmes DNS sont généralement gérés par une équipe ou une fonction distincte. + +De même, si l'application est responsable de la manière dont elle consomme les entrées et produit les sorties, l'interaction d'un processus externe avec l'application ou ses données est considérée comme hors du périmètre d'ASVS. Par exemple, la sauvegarde de l'application ou de ses données relève généralement de la responsabilité d'un processus externe et n'est pas contrôlée par l'application ou ses développeurs. + +### Sécurité + +Chaque exigence doit avoir un impact démontrable sur la sécurité. L'absence d'exigence doit entraîner une application moins sécurisée, et sa mise en œuvre doit réduire la probabilité ou l'impact d'un risque de sécurité. + +Toutes les autres considérations, telles que les aspects fonctionnels, le style de code ou les exigences de politique, sont hors du périmètre d'application. + +### Vérification + +L'exigence doit être vérifiable et la vérification doit aboutir à une décision d'échec ou de réussite. + +### Référentiel + +L'ASVS est conçue comme un recueil d'exigences de sécurité à mettre en œuvre pour se conformer au référentiel. Cela signifie que les exigences se limitent à la définition de l'objectif de sécurité à atteindre. D'autres informations connexes peuvent être intégrées à l'ASVS ou reliées par des mappings. + +Plus précisément, l'OWASP comporte de nombreux projets, et l'ASVS évite délibérément tout chevauchement avec le contenu d'autres projets. Par exemple, les développeurs peuvent se demander : « Comment implémenter une exigence particulière dans ma technologie ou mon environnement ? » Cette question devrait être traitée par le projet « Cheat-Sheets ». Les vérificateurs peuvent se demander : « Comment tester cette exigence dans cet environnement ? » Cette question devrait être traitée par le projet « Web Security Testing Guide ». + +Bien que l'ASVS ne soit pas uniquement destiné aux experts en sécurité, il attend du lecteur des connaissances techniques pour comprendre le contenu ou la capacité à rechercher des concepts spécifiques. + +### Exigence + +Le terme « exigence » est utilisé spécifiquement dans l'ASVS car il décrit ce qui doit être accompli pour la satisfaire. L'ASVS ne contient que des exigences (doit) et ne contient pas de recommandations (devrait) comme condition principale. + +En d'autres termes, les recommandations, qu'elles constituent une solution parmi d'autres ou des considérations de style de code, ne répondent pas à la définition d'une exigence. + +Les exigences de l'ASVS visent à répondre à des principes de sécurité spécifiques sans être trop spécifiques à une implémentation ou à une technologie, tout en étant explicites quant à leur raison d'être. Cela signifie également que les exigences ne sont pas construites autour d'une méthode de vérification ou d'une implémentation particulière. + +### Décisions de sécurité documentées + +En matière de sécurité logicielle, planifier la conception de la sécurité et les mécanismes à utiliser en amont permettra une implémentation plus cohérente et fiable du produit fini ou de la fonctionnalité. + +De plus, pour certaines exigences, la mise en œuvre sera complexe et très spécifique aux besoins de l'application. Parmi les exemples courants, on peut citer les autorisations, la validation des entrées et les contrôles de protection autour de différents niveaux de données sensibles. + +Pour tenir compte de cela, plutôt que de formuler des affirmations générales telles que « toutes les données doivent être chiffrées » ou de tenter de couvrir tous les cas d'utilisation possibles dans une exigence, des exigences de documentation ont été incluses, exigeant que l'approche et la configuration du développeur d'applications pour ces types de contrôles soient documentées. Ceci peut ensuite être vérifié pour en vérifier la pertinence, puis la mise en œuvre réelle peut être comparée à la documentation afin d'évaluer si elle répond aux attentes. + +Ces exigences visent à documenter les décisions prises par l'organisation développant l'application concernant la mise en œuvre de certaines exigences de sécurité. + +Les exigences de documentation figurent toujours dans la première section d'un chapitre (bien que tous les chapitres n'en disposent pas) et sont toujours associées à une exigence de mise en œuvre, où les décisions documentées doivent être effectivement mises en œuvre. L'essentiel est de distinguer la vérification de la documentation et de la mise en œuvre effective. + +L'inclusion de ces exigences repose sur deux facteurs clés. Le premier est qu'une exigence de sécurité implique souvent l'application de règles, par exemple concernant les types de fichiers autorisés à être téléchargés, les contrôles métier à appliquer et les caractères autorisés pour un champ particulier. Ces règles diffèrent d'une application à l'autre ; par conséquent, l'ASVS ne peut pas les définir de manière prescriptive, et un aide-mémoire ou une réponse plus détaillée ne serait d'aucune utilité dans ce cas précis. De même, sans documentation de ces décisions, il sera impossible de vérifier les exigences qui les mettent en œuvre. + +Le deuxième facteur est que, pour certaines exigences, il est important d'offrir au développement d'applications une certaine flexibilité quant à la manière de répondre à des défis de sécurité particuliers. Par exemple, dans les versions précédentes d'ASVS, les règles d'expiration de session étaient très strictes. En pratique, de nombreuses applications, notamment celles destinées aux utilisateurs, ont des règles beaucoup plus souples et préfèrent mettre en œuvre d'autres contrôles d'atténuation. Les exigences de documentation permettent donc explicitement cette flexibilité. + +Il est clair que les développeurs ne sont pas censés prendre et documenter ces décisions individuellement, mais que l'organisation dans son ensemble les prend et s'assure qu'elles sont communiquées aux développeurs, qui s'assurent ensuite de les respecter. + +Fournir aux développeurs des spécifications et des conceptions pour de nouvelles fonctionnalités est une étape standard du développement logiciel. De même, les développeurs sont censés utiliser des composants et des mécanismes d'interface utilisateur communs plutôt que de prendre leurs propres décisions à chaque fois. Par conséquent, étendre ce principe à la sécurité ne devrait pas être perçu comme surprenant ou controversé. + +La manière d'y parvenir est également flexible. Les décisions de sécurité peuvent être documentées dans un document littéral, auquel les développeurs sont tenus de se référer. Alternativement, elles peuvent être documentées et implémentées dans une bibliothèque de code commune que tous les développeurs sont tenus d'utiliser. Dans les deux cas, le résultat souhaité est atteint. + +## Niveaux de vérification de la sécurité des applications + +L'ASVS définit trois niveaux de vérification de la sécurité, chaque niveau augmentant en profondeur et en complexité. L'objectif général est que les organisations commencent par le premier niveau pour répondre aux préoccupations de sécurité les plus critiques, puis progressent vers les niveaux supérieurs en fonction des besoins de l'organisation et des applications. Les niveaux peuvent être présentés comme L1, L2 et L3 dans le document et dans les textes d'exigences. + +Chaque niveau ASVS indique les exigences de sécurité à atteindre à partir de ce niveau, les exigences des niveaux supérieurs restants étant des recommandations. + +Afin d'éviter les doublons ou les exigences obsolètes aux niveaux supérieurs, certaines exigences s'appliquent à un niveau particulier, mais sont soumises à des conditions plus strictes pour les niveaux supérieurs. + +### Évaluation des niveaux + +Les niveaux sont définis par une évaluation de priorité de chaque exigence, basée sur l'expérience de mise en œuvre et de test des exigences de sécurité. L'accent est mis principalement sur la balance entre la réduction des risques et les efforts nécessaires à la mise en œuvre de l'exigence. Un autre facteur clé est de maintenir une faible barrière à l'entrée. + +La réduction des risques évalue dans quelle mesure l'exigence réduit le niveau de risque de sécurité au sein de l'application, en tenant compte des facteurs d'impact classiques de confidentialité, d'intégrité et de disponibilité, et en déterminant s'il s'agit d'une couche de défense principale ou d'une défense en profondeur. + +Les discussions rigoureuses autour des critères et des décisions de nivellement ont abouti à une répartition qui devrait s'appliquer à la grande majorité des cas, tout en admettant qu'elle ne soit pas parfaitement adaptée à toutes les situations. Cela signifie que, dans certains cas, les organisations peuvent souhaiter prioriser les exigences d'un niveau supérieur en amont, en fonction de leurs propres considérations de risque. + +Les types d'exigences à chaque niveau peuvent être caractérisés comme suit. + +### Niveau 1 + +Ce niveau contient les exigences minimales à prendre en compte pour sécuriser une application et constitue un point de départ essentiel. Il comprend environ 20 % des exigences de l'ASVS. L'objectif est de réduire au minimum les exigences afin de réduire les obstacles à l'entrée. + +Ces exigences sont généralement critiques ou basiques, et constituent la première couche de défense pour prévenir les attaques courantes. Elles ne nécessitent pas d'autres vulnérabilités ou conditions préalables pour être exploitables. + +Outre les exigences de la première couche de défense, certaines exigences ont moins d'impact aux niveaux supérieurs, comme celles relatives aux mots de passe. Celles-ci sont plus importantes pour le Niveau 1, car à partir de ces niveaux, les exigences d'authentification multifacteur deviennent pertinentes. + +Le Niveau 1 n'est pas nécessairement testable par un testeur externe sans accès interne à la documentation ou au code (comme les tests « boîte noire »), bien que le nombre réduit d'exigences devrait faciliter sa vérification. + +### Niveau 2 + +La plupart des applications devraient s'efforcer d'atteindre ce niveau de sécurité. Environ 50 % des exigences de l'ASVS sont de niveau 2, ce qui signifie qu'une application doit implémenter environ 70 % des exigences de l'ASVS (l'ensemble des exigences de niveau 1 et 2) pour être conforme à ce niveau. + +Ces exigences concernent généralement des attaques moins courantes ou des protections plus complexes contre les attaques courantes. Elles peuvent constituer une première couche de défense ou nécessiter certaines conditions préalables pour que l'attaque réussisse. + +### Niveau 3 + +Ce niveau doit être l'objectif des applications souhaitant démontrer les plus hauts niveaux de sécurité et représente environ 30 % des exigences à respecter. + +Les exigences de cette section concernent généralement des mécanismes de défense en profondeur ou d'autres contrôles utiles, mais difficiles à mettre en œuvre. + +### Quel niveau atteindre ? + +Les niveaux de priorité visent à refléter la maturité de l'organisation et de l'application en matière de sécurité applicative. Plutôt que d'imposer un niveau de sécurité normatif pour une application, l'organisation doit analyser ses risques et déterminer le niveau qu'elle estime approprié, en fonction de la sensibilité de l'application et, bien sûr, des attentes de ses utilisateurs. + +Par exemple, une jeune start-up qui ne collecte que des données sensibles limitées peut décider de se concentrer sur le niveau 1 pour ses objectifs de sécurité initiaux, tandis qu'une banque peut avoir du mal à justifier auprès de ses clients un niveau inférieur au niveau 3 pour son application de banque en ligne. + +## Comment utiliser l'ASVS ? + +### Structure de l'ASVS + +L'ASVS comprend environ 350 exigences, réparties en 17 chapitres, chacun étant lui-même subdivisé en sections. + +L'objectif de cette division est de simplifier la sélection ou le filtrage des chapitres et sections en fonction de leur pertinence pour l'application. Par exemple, pour une API machine-to-machine, les exigences du chapitre V3 relatives aux interfaces web ne seront pas pertinentes. Si OAuth ou WebRTC n'est pas utilisé, ces chapitres peuvent également être ignorés. + +### Stratégie de publication + +Les publications ASVS suivent le modèle « Majeure.Mineure.Correctif » et les numéros indiquent les modifications apportées. Pour une publication majeure, le premier numéro change, pour une publication mineure, le deuxième, et pour une publication corrective, le troisième. + +* Publication majeure : Réorganisation complète, presque tout peut avoir changé, y compris les numéros d'exigences. Une réévaluation de conformité sera nécessaire (par exemple, 4.0.3 -> 5.0.0). +* Publication mineure : Des exigences peuvent être ajoutées ou supprimées, mais la numérotation globale reste inchangée. Une réévaluation de conformité sera nécessaire, mais devrait être plus simple (par exemple, 5.0.0 -> 5.1.0). +* Publication corrective : Des exigences peuvent être supprimées (par exemple, si elles sont dupliquées ou obsolètes) ou assouplies, mais une application conforme à la publication précédente sera également conforme à la publication corrective (par exemple, 5.0.0 -> 5.0.1). + +Les informations ci-dessus concernent spécifiquement les exigences de l'ASVS. Les modifications apportées au texte environnant et à d'autres contenus, tels que les annexes, ne seront pas considérées comme des modifications majeures. + +### Flexibilité avec l'ASVS + +Plusieurs points décrits ci-dessus, tels que les exigences de documentation et le mécanisme de niveaux, permettent une utilisation de l'ASVS plus flexible et plus spécifique à l'organisation. + +De plus, il est fortement encouragé aux organisations de créer un fork spécifique à l'organisation ou au domaine, afin d'ajuster les exigences en fonction des caractéristiques et des niveaux de risque de leurs applications. Cependant, il est important de maintenir une traçabilité afin que la conformité à l'exigence 4.1.1 soit identique pour toutes les versions. + +Idéalement, chaque organisation devrait créer son propre ASVS personnalisé, en supprimant les sections non pertinentes (par exemple, GraphQL, WebSockets, SOAP, si elles ne sont pas utilisées). Une version ou un supplément ASVS spécifique à l'organisation est également un bon support pour fournir des conseils d'implémentation spécifiques à l'organisation, détaillant les bibliothèques ou les ressources à utiliser pour se conformer aux exigences. + +### Comment référencer les exigences de l'ASVS ? + +Chaque exigence possède un identifiant au format `.

.`, où chaque élément est un numéro. Par exemple, « 1.11.3 ». + +* La valeur `` correspond au chapitre d'où provient l'exigence ; par exemple, toutes les exigences `1.#.#` proviennent du chapitre 'Encodage et nettoyage'. +* La valeur `
` correspond à la section de ce chapitre où apparaît l'exigence ; par exemple, toutes les exigences `1.2.#` se trouvent dans la section 'Prévention des injections' du chapitre 'Encodage et nettoyage'. +* La valeur `` identifie l'exigence spécifique au sein du chapitre et de la section, par exemple, `1.2.5` qui, dans la version 5.0.0 de ce référentiel, est : + +> Vérifiez que l'application protège contre l'injection de commandes du système d'exploitation et que les appels du système d'exploitation utilisent des requêtes OS paramétrées ou un encodage contextuel de la sortie de ligne de commande. + +Les identifiants pouvant varier d'une version à l'autre du référentiel, il est préférable, pour les autres documents, rapports ou outils, d'utiliser le format suivant : `v-.
.`, où 'version' correspond à la balise de version ASVS. Par exemple, 'v5.0.0-1.2.5' désigne spécifiquement la 5ème exigence de la section 'Prévention des injections' du chapitre 'Encodage et nettoyage' de la version 5.0.0. (Ceci pourrait être résumé par `v-`.) + +Remarque : Le `v` précédant le numéro de version dans le format doit toujours être en minuscule. + +Si des identifiants sont utilisés sans inclure l'élément `v`, ils doivent être considérés comme faisant référence au contenu le plus récent du Référentiel de vérification de la sécurité des applications. À mesure que le référentiel évolue, cela devient problématique ; c'est pourquoi les rédacteurs et les développeurs doivent inclure l'élément « version ». + +Les listes d'exigences de l'ASVS sont disponibles aux formats CSV, JSON et autres, utiles à des fins de référence ou d'utilisation programmatique. + +### Forker l'ASVS + +Les organisations peuvent tirer profit de l'adoption d'ASVS en choisissant l'un des trois niveaux ou en créant un fork spécifique au domaine qui ajuste les exigences en fonction du niveau de risque applicatif. Ce type de fork est encouragé, à condition de garantir la traçabilité de l'exigence 4.1.1, garantissant ainsi la même cohérence pour toutes les versions. + +Idéalement, chaque organisation devrait créer son propre ASVS personnalisé, en supprimant les sections non pertinentes (par exemple, GraphQL, Websockets, SOAP, si elles ne sont pas utilisées). Le fork doit commencer par le niveau 1 d'ASVS comme référence, puis progresser vers les niveaux 2 ou 3 en fonction du risque de l'application. + +## Cas d'utilisation de l'ASVS + +L'ASVS peut être utilisé pour évaluer la sécurité d'une application, ce point étant approfondi dans le chapitre suivant. Cependant, plusieurs autres utilisations potentielles de l'ASVS (ou d'une version dérivée) ont été identifiées. + +### En tant que conseil détaillé sur l'architecture de sécurité + +L'une des utilisations les plus courantes du Référentiel de vérification de la sécurité des applications (ASVS) est de servir de ressource aux architectes de sécurité. Les ressources disponibles pour construire une architecture applicative sécurisée sont limitées, notamment pour les applications modernes. L'ASVS peut combler ces lacunes en permettant aux architectes de sécurité de choisir de meilleurs contrôles pour les problèmes courants, tels que les modèles de protection des données et les stratégies de validation des entrées. Les exigences en matière d'architecture et de documentation seront particulièrement utiles à cet égard. + +### Référence spécialisée en developpement sécurisé + +L'ASVS peut servir de base à la préparation d'une référence de développement sécurisé lors du développement d'applications, aidant ainsi les développeurs à prendre en compte la sécurité lors de la création de logiciels. Bien que l'ASVS puisse servir de base, les organisations doivent élaborer leurs propres directives claires et unifiées, idéalement basées sur les recommandations des ingénieurs ou architectes de sécurité. De plus, les organisations sont encouragées, dans la mesure du possible, à préparer des mécanismes et bibliothèques de sécurité approuvés, référencés dans les directives et utilisables par les développeurs. + +### Guide pour les tests unitaires et d'intégration automatisés + +L'ASVS est conçu pour être hautement testable. Certaines vérifications seront techniques, tandis que d'autres exigences (telles que les exigences d'architecture et de documentation) pourront nécessiter une revue de documentation ou d'architecture. En créant des tests unitaires et d'intégration qui testent et analysent par fuzzing des cas d'abus spécifiques et pertinents liés aux exigences, vérifiables par des moyens techniques, il devrait être plus facile de vérifier le bon fonctionnement de ces contrôles à chaque build. Par exemple, des tests supplémentaires peuvent être créés pour la suite de tests d'un contrôleur de connexion afin de tester la présence de valeur par défaut courante pour le paramètre username, l'énumération des comptes, le force brute, l'injection LDAP et SQL, et les attaques XSS. De même, un test sur le paramètre password doit inclure les mots de passe courants, la longueur des mots de passe, l'injection d'octets nuls, la suppression du paramètre, les attaques XSS, etc. + +### Pour la formation au développement sécurisé + +L'ASVS peut également servir à définir les caractéristiques d'un logiciel sécurisé. De nombreux cours de « codage sécurisé » se résument à des cours de piratage éthique, avec quelques conseils de codage. Cela n'aide pas forcément les développeurs à écrire du code plus sécurisé. Les cours de développement sécurisé peuvent plutôt utiliser l'ASVS en mettant l'accent sur ses mécanismes positifs, plutôt que sur les 10 principes négatifs à éviter. La structure de l'ASVS offre également une structure logique pour aborder les différents sujets liés à la sécurisation d'une application. + +### En tant que cadre pour l'approvisionnement des logiciels sécurisés + +L'ASVS est un cadre idéal pour faciliter l'approvisionnement des logiciels sécurisés ou l'acquisition de services de développement de développement sur mesure. L'acheteur peut simplement exiger que le logiciel qu'il souhaite acquérir soit développé au niveau X de l'ASVS et demander au vendeur de prouver que le logiciel satisfait à ce niveau. + +## Appliquer l'ASVS en pratique + +Les menaces varient selon les motivations. Certains secteurs disposent de ressources informatiques et technologiques spécifiques et d'exigences de conformité réglementaire spécifiques à leur domaine. + +Il est fortement recommandé aux organisations d'analyser en profondeur les caractéristiques de risque spécifiques à leur activité et de déterminer le niveau d'ASVS approprié en fonction de ces risques et des exigences métier. diff --git a/5.0/fr/0x04-Assessment_and_Certification.md b/5.0/fr/0x04-Assessment_and_Certification.md new file mode 100644 index 0000000000..b6805320ce --- /dev/null +++ b/5.0/fr/0x04-Assessment_and_Certification.md @@ -0,0 +1,47 @@ +# Évaluation et certification + +## Position de l'OWASP sur les certifications et marques de confiance ASVS + +L'OWASP, en tant qu'organisation à but non lucratif neutre, ne certifie actuellement aucun vendeur, vérificateur ou logiciel. Toutes ces assertions d'assurance, marques de confiance ou certifications ne sont pas officiellement vérifiées, enregistrées ou certifiées par l'OWASP, de sorte qu'une organisation qui s'appuie sur ce point de vue doit être prudente quant à la confiance placée dans une tierce partie ou une marque de confiance revendiquant la certification ASVS. + +Cela ne devrait pas empêcher les organisations d'offrir de tels services d'assurance, tant qu'elles ne revendiquent pas la certification officielle de l'OWASP. + +## Comment vérifier la conformité ASVS + +L'ASVS n'est volontairement pas prescriptif quant à la manière précise de vérifier la conformité au niveau d'un guide de tests. Il est toutefois important de souligner certains points clés. + +### Rapport de vérification + +Les tests d'intrusion traditionnels signalent les problèmes « par exception », en ne listant que les échecs. Cependant, un rapport de certification ASVS doit inclure le périmètre, un résumé de toutes les exigences vérifiées, les exigences pour lesquelles des exceptions ont été constatées et des conseils pour résoudre les problèmes. Certaines exigences peuvent ne pas être applicables (par exemple, la gestion des sessions dans les API sans état), et cela doit être mentionné dans le rapport. + +### Périmètre de la vérification + +Une organisation développant une application n'implémentera généralement pas toutes les exigences, certaines pouvant être non pertinentes ou moins importantes selon les fonctionnalités de l'application. Le vérificateur doit préciser le périmètre de la vérification, notamment le niveau que l'organisation souhaite atteindre et les exigences incluses. Il doit s'agir de ce qui a été inclus plutôt que de ce qui ne l'a pas été. Il doit également fournir un avis sur les raisons justifiant l'exclusion des exigences non implémentées. + +Cela devrait permettre au consommateur d’un rapport de vérification de comprendre le contexte de la vérification et de prendre une décision éclairée sur le niveau de confiance qu’il peut accorder à l’application. + +Les organismes de certification peuvent choisir leurs méthodes de test, mais devraient les indiquer dans le rapport, et elles devraient idéalement être reproductibles. Différentes méthodes, comme les tests d'intrusion manuels ou l'analyse du code source, peuvent être utilisées pour vérifier des aspects tels que la validation des entrées, selon l'application et les exigences. + +### Mécanismes de vérification + +Plusieurs techniques différentes peuvent être utilisées pour vérifier une même exigence ASVS. Outre les tests d'intrusion (utilisant des "credentials" valides pour une couverture complète de l'application), la vérification des exigences ASVS peut nécessiter l'accès à la documentation, au code source, à la configuration et aux personnes impliquées dans le processus de développement. Ceci est particulièrement vrai pour la vérification des exigences L2 et L3. Il est courant de fournir des preuves solides des résultats au moyen d'une documentation détaillée, pouvant inclure des documents de travail, des captures d'écran, des scripts et des journaux de tests. L'exécution d'un outil automatisé sans tests approfondis ne suffit pas à obtenir la certification, car chaque exigence doit être testée de manière vérifiable. + +L'utilisation de l'automatisation pour vérifier les exigences ASVS est un sujet qui suscite un intérêt constant. Il est donc important de clarifier certains points relatifs aux tests automatisés et en boîte noire. + +#### Le rôle des outils de test de sécurité automatisés + +Lorsque des outils de tests de sécurité automatisés, tels que les tests de sécurité dynamiques et statiques des applications (DAST et SAST), sont correctement implémentés dans le pipeline de développement, ils peuvent identifier des problèmes de sécurité qui ne devraient jamais exister. Cependant, sans une configuration et un réglage minutieux, ils n'offriront pas la couverture requise et leur niveau de bruit empêchera l'identification et la résolution des véritables problèmes de sécurité. + +Bien que cela puisse couvrir certaines des exigences techniques les plus basiques et les plus simples, telles que celles relatives à l'encodage ou à l'assainissement de sortie, il est essentiel de noter que ces outils ne seront pas entièrement en mesure de vérifier bon nombre des exigences ASVS les plus complexes ou celles liées à la logique métier et au contrôle d'accès. + +Pour les exigences moins simples, l'automatisation reste probablement envisageable, mais des vérifications spécifiques à l'application devront être écrites pour y parvenir. Ces vérifications peuvent être similaires aux tests unitaires et d'intégration déjà utilisés par l'organisation. Il est donc possible d'utiliser l'infrastructure d'automatisation des tests existante pour écrire ces tests spécifiques à ASVS. Bien que cela nécessite un investissement à court terme, les avantages à long terme de la vérification continue des exigences ASVS seront significatifs. + +En résumé, testable en utilisant l'automatisation != exécuter un outil sur étagère. + +#### Le rôle des tests de pénétration + +Bien que L1 dans la version 4.0 ait été optimisé pour les tests de « boîte noire » (sans documentation et sans source), même dans ce cas, le standard était clair sur le fait qu'il ne s'agissait pas d'une activité d'assurance efficace et qu'elle devait être activement découragée. + +Les tests sans accès aux informations supplémentaires nécessaires constituent un mécanisme sous-productifs et inefficaces de vérification de la sécurité, car ils ne permettent pas d’examiner le code source, d’identifier les menaces et les contrôles manquants, et d’effectuer un test beaucoup plus approfondi dans un délai plus court. + +Il est fortement encouragé d'effectuer des tests d'intrusion basés sur la documentation ou le code source (hybrides), avec un accès complet aux développeurs et à la documentation de l'application, plutôt que des tests d'intrusion traditionnels. Cela sera certainement nécessaire pour vérifier de nombreuses exigences ASVS. diff --git a/5.0/fr/0x05-For-Users-Of-4.0.md b/5.0/fr/0x05-For-Users-Of-4.0.md new file mode 100644 index 0000000000..be7360d367 --- /dev/null +++ b/5.0/fr/0x05-For-Users-Of-4.0.md @@ -0,0 +1,90 @@ +# Modifications par rapport à la version 4.x + +## Introduction + +Les utilisateurs familiarisés avec la version 4.x du référentiel trouveront utile de consulter les principales modifications apportées à la version 5.0, notamment les mises à jour de contenu, de périmètre et de philosophie sous-jacente. + +Sur les 286 exigences de la version 4.0.3, seules 11 restent inchangées, tandis que 15 ont subi des ajustements grammaticaux mineurs sans altérer leur sens. Au total, 109 exigences (38 %) ne sont plus des exigences distinctes dans la version 5.0 : 50 ont été simplement supprimées, 28 ont été supprimées car doublons et 31 ont été fusionnées avec d'autres exigences. Les autres ont été révisées. Même les exigences n'ayant pas subi de modifications substantielles ont des identifiants différents à la suite d'une réorganisation ou une restructuration. + +Pour faciliter l'adoption de la version 5.0, des documents de correspondance sont fournis pour aider les utilisateurs à identifier les correspondances entre les exigences de la version 4.x et celles de la version 5.0. Ces correspondances ne sont pas liées au numéro de version et peuvent être mises à jour ou clarifiées si nécessaire. + +## Philosophie des exigences + +### Périmètre et orientation + +La version 4.x incluait des exigences qui ne correspondaient pas au périmètre prévu du référentiel ; celles-ci ont été supprimées. Les exigences qui ne répondaient pas aux critères du périmètre de la version 5.0 ou qui n'étaient pas vérifiables ont également été exclues. + +### Priorité aux objectifs de sécurité plutôt qu'aux mécanismes + +Dans la version 4.x, de nombreuses exigences se concentraient sur des mécanismes spécifiques plutôt que sur les objectifs de sécurité sous-jacents. Dans la version 5.0, les exigences sont centrées sur les objectifs de sécurité, ne référençant des mécanismes particuliers que lorsqu'ils constituent la seule solution pratique, ou les fournissant à titre d'exemple ou de conseil complémentaire. + +Cette approche reconnaît que plusieurs méthodes peuvent exister pour atteindre un objectif de sécurité donné et évite toute prescription inutile susceptible de limiter la flexibilité organisationnelle. + +De plus, les exigences traitant d'une même préoccupation de sécurité ont été consolidées lorsque cela était opportun. + +### Décisions de sécurité documentées + +Bien que le concept de décisions de sécurité documentées puisse paraître nouveau dans la version 5.0, il s'agit d'une évolution des exigences antérieures liées à l'application des politiques et à la modélisation des menaces dans la version 4.0. Auparavant, certaines exigences exigeaient implicitement une analyse pour éclairer la mise en œuvre des contrôles de sécurité, comme la détermination des connexions réseau autorisées. + +Afin de garantir la disponibilité des informations nécessaires à la mise en œuvre et à la vérification, ces attentes sont désormais explicitement définies comme des exigences de documentation, ce qui les rend claires, actionnables et vérifiables. + +## Modifications structurelles et nouveaux chapitres + +Plusieurs chapitres de la version 5.0 introduisent du contenu entièrement nouveau : + +* OAuth et OIDC – Compte tenu de l’adoption généralisée de ces protocoles pour la délégation d’accès et l’authentification unique, des exigences spécifiques ont été ajoutées pour répondre aux divers scénarios rencontrés par les développeurs. Ce domaine pourrait à terme évoluer vers une norme autonome, similaire à la gestion des exigences mobiles et IoT dans les versions précédentes. +* WebRTC – Avec la popularité croissante de cette technologie, ses considérations et défis de sécurité spécifiques sont désormais abordés dans une section dédiée. + +Des efforts ont également été déployés pour garantir que les chapitres et sections soient organisés autour d’ensembles cohérents d’exigences connexes. + +Cette restructuration a conduit à la création de chapitres supplémentaires : + +* Jetons autonomes – Auparavant regroupés sous la rubrique « gestion de session », les jetons autonomes sont désormais reconnus comme un mécanisme distinct et un élément fondamental de la communication sans état (comme dans OAuth et OIDC). En raison de leurs implications spécifiques en matière de sécurité, elles sont traitées dans un chapitre dédié, avec l'introduction de nouvelles exigences dans la version 5.x. +* Sécurité du frontend web – Avec la complexité croissante des applications basées sur un navigateur et l'essor des architectures exclusivement basées sur des API, les exigences de sécurité du frontend ont été séparées dans un chapitre dédié. +* Codage et architecture sécurisés – Les nouvelles exigences concernant les pratiques de sécurité générales qui ne cadraient pas avec les chapitres existants ont été regroupées ici. + +D'autres modifications organisationnelles ont été apportées à la version 5.0 afin de clarifier l'intention. Par exemple, les exigences de validation des entrées ont été déplacées avec la logique métier, reflétant ainsi leur rôle dans l'application des règles métier, plutôt que d'être regroupées avec le nettoyage et l'encodage. + +L'ancien chapitre « Architecture » ​​de la version 1 a été supprimé. Sa section initiale contenait des exigences hors du périmètre, tandis que les sections suivantes ont été redistribuées aux chapitres concernés, les exigences étant dédupliquées et clarifiées si nécessaire. + +## Suppression des correspondances directes avec d'autres normes + +Les correspondances directes avec d'autres normes ont été supprimées du corps du référentiel. L'objectif est de préparer une correspondance avec le projet OWASP Common Requirement Enumeration (CRE), qui reliera ASVS à divers projets OWASP et normes externes. + +Les correspondances directes avec CWE et NIST ne sont plus maintenues, comme expliqué ci-dessous. + +### Couplage réduit avec les directives du NIST sur l'identité numérique + +Les directives du NIST sur l'identité numérique (SP 800-63) (https://pages.nist.gov/800-63-3/) servent depuis longtemps de référence pour les contrôles d'authentification et d'autorisation. Dans la version 4.x, certains chapitres étaient étroitement alignés sur la structure et la terminologie du NIST. + +Si ces directives demeurent une référence importante, un alignement strict a engendré des difficultés, notamment une terminologie moins reconnue, la duplication d'exigences similaires et des correspondances incomplètes. La version 5.0 s'éloigne de cette approche pour plus de clarté et de pertinence. + +### S'éloigner de l'énumération des faiblesses communes (CWE) + +L'[Énumération des Faiblesses Communes (CWE)](https://cwe.mitre.org/) fournit une taxonomie utile des faiblesses de sécurité logicielle. Cependant, des défis tels que les CWE par catégorie, les difficultés de correspondance des exigences à une CWE unique et la présence de mappages imprécis dans la version 4.x ont conduit à la décision d'abandonner les mappages CWE directs dans la version 5.0. + +## Repenser les définitions de niveaux + +La version 4.x décrivait les niveaux comme L1 (« Minimum »), L2 (« Standard ») et L3 (« Avancé »), ce qui implique que toutes les applications manipulant des données sensibles doivent au moins atteindre le niveau L2. + +La version 5.0 corrige plusieurs problèmes liés à cette approche, décrits dans les paragraphes suivants. + +En pratique, alors que la version 4.x utilisait des graduations pour les indicateurs de niveau, la version 5.x utilise un simple numéro pour tous les formats du référentiel, notamment Markdown, PDF, DOCX, CSV, JSON et XML. Pour des raisons de rétrocompatibilité, les anciennes versions des sorties CSV, JSON et XML utilisant encore des graduations sont également générées. + +### Niveau d'entrée simplifié + +Les retours ont indiqué que le nombre important d'exigences de niveau 1 (environ 120), combiné à sa désignation comme niveau « minimum », insuffisant pour la plupart des applications, freinait l'adoption. La version 5.0 vise à lever cet obstacle en définissant le niveau 1 principalement autour des exigences de défense de première couche, ce qui se traduit par des exigences plus claires et moins nombreuses à ce niveau. À titre d'exemple, la version 4.0.3 comptait 128 exigences de niveau 1 sur un total de 278, soit 46 %. La version 5.0.0 compte 70 exigences de niveau 1 sur un total de 345, soit 20 %. + +### L'illusion de la testabilité + +Un facteur clé dans le choix des contrôles de niveau 1 dans la version 4.x était leur aptitude à être évalués par des tests d'intrusion externes de type « boîte noire ». Cependant, cette approche n'était pas totalement conforme à l'objectif du niveau 1 en tant qu'ensemble minimal de contrôles de sécurité. Certains utilisateurs ont fait valoir que le niveau 1 était insuffisant pour sécuriser les applications, tandis que d’autres ont trouvé qu’il était trop difficile à tester. + +S'appuyer sur la testabilité comme critère est à la fois relatif et parfois trompeur. Le fait qu'une exigence soit testable ne garantit pas qu'elle puisse être testée de manière automatisée ou simple. De plus, les exigences les plus facilement testables ne sont pas toujours celles qui ont le plus grand impact sur la sécurité ou les plus simples à mettre en œuvre. + +Par conséquent, dans la version 5.0, les décisions de niveau ont été prises principalement en fonction de la réduction des risques et en tenant compte de l'effort de mise en œuvre. + +### Pas seulement une question de risque + +L'utilisation de niveaux prescriptifs, basés sur les risques, imposant un niveau spécifique à certaines applications s'est avérée trop rigide. En pratique, la priorisation et la mise en œuvre des contrôles de sécurité dépendent de multiples facteurs, notamment la réduction des risques et les efforts nécessaires à leur mise en œuvre. + +Par conséquent, les organisations sont encouragées à atteindre le niveau qu'elles estiment devoir atteindre en fonction de leur maturité et du message qu'elles souhaitent transmettre à leurs utilisateurs. diff --git a/5.0/fr/0x10-V1-Encoding-and-Sanitization.md b/5.0/fr/0x10-V1-Encoding-and-Sanitization.md new file mode 100644 index 0000000000..6c022ba7a5 --- /dev/null +++ b/5.0/fr/0x10-V1-Encoding-and-Sanitization.md @@ -0,0 +1,103 @@ +# V1 Encodage et nettoyage + +## Objectif de contrôle + +Ce chapitre aborde les failles de sécurité les plus courantes des applications web liées au traitement non sécurisé de données non fiables. Ces failles peuvent entraîner diverses vulnérabilités techniques, où les données non fiables sont interprétées selon les règles syntaxiques de l'interpréteur concerné. + +Pour les applications web modernes, il est toujours préférable d'utiliser des API plus sûres, telles que les requêtes paramétrées, l'échappement automatique ou les Framework de création de modèles. Dans le cas contraire, un encodage, un échappement ou un nettoyage des sorties soigneusement effectués deviennent essentiels à la sécurité de l'application. + +La validation des entrées constitue un mécanisme de défense en profondeur contre les contenus inattendus ou dangereux. Cependant, son objectif principal étant de garantir que le contenu entrant répond aux attentes fonctionnelles et métier, les exigences afférentes sont décrites dans le chapitre « Validation et logique métier ». + +## V1.1 Architecture d'encodage et de nettoyage + +Les sections ci-dessous présentent les exigences spécifiques à la syntaxe ou à l'interpréteur pour traiter en toute sécurité les contenus non sécurisés afin d'éviter les failles de sécurité. Ces exigences précisent l'ordre et le lieu de traitement. Elles visent également à garantir que les données soient stockées dans leur état d'origine et ne soient pas stockées sous une forme encodée ou échappée (par exemple, encodage HTML), afin d'éviter les problèmes de double encodage. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **1.1.1** | Vérifiez que l'entrée est décodée ou non échappée vers une forme canonique une seule fois, elle n'est décodée que lorsque des données codées sous cette forme sont attendues, et que cela est fait avant de traiter davantage l'entrée, par exemple, elle n'est pas effectuée après la validation ou la désinfection de l'entrée. | 2 | +| **1.1.2** | Vérifiez que l'application effectue l'encodage et l'échappement de sortie soit comme étape finale avant d'être utilisée par l'interpréteur pour lequel elle est destinée, soit par l'interpréteur lui-même. | 2 | + +## V1.2 Prévention des injections + +L'encodage ou l'échappement de sortie, effectué à proximité d'un contexte potentiellement dangereux, est essentiel pour la sécurité de toute application. Généralement, l'encodage et l'échappement de sortie ne sont pas conservés, mais servent à sécuriser la sortie pour une utilisation immédiate dans l'interpréteur approprié. Une tentative d'exécution trop précoce peut entraîner une altération du contenu ou rendre l'encodage ou l'échappement inefficaces. + +Dans de nombreux cas, les bibliothèques logicielles incluent des fonctions sûres ou plus sûres qui exécutent cela automatiquement, même s'il est nécessaire de s'assurer qu'elles sont correctes pour le contexte actuel. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **1.2.1** | Vérifiez que l'encodage de sortie d'une réponse HTTP, d'un document HTML ou d'un document XML est pertinent pour le contexte requis, comme l'encodage des caractères pertinents pour les éléments HTML, les attributs HTML, les commentaires HTML, les CSS ou les champs d'en-tête HTTP, pour éviter de modifier la structure du message ou du document. | 1 | +| **1.2.2** | Vérifiez que, lors de la création dynamique d'URL, les données non fiables sont encodées en fonction de leur contexte (par exemple, encodage d'URL ou encodage base64url pour les paramètres de requête ou de chemin). Assurez-vous que seuls les schémas d'URL sûrs sont autorisés (par exemple, interdire javascript: ou data:). | 1 | +| **1.2.3** | Vérifiez que l'encodage ou l'échappement de sortie est utilisé lors de la création dynamique de contenu JavaScript (y compris JSON), pour éviter de modifier la structure du message ou du document (pour éviter l'injection JavaScript et JSON). | 1 | +| **1.2.4** | Vérifiez que la sélection de données ou les requêtes de base de données (par exemple, SQL, HQL, NoSQL, Cypher) utilisent des requêtes paramétrées, des ORM, des Framework d'entités ou sont protégées contre les injections SQL et autres attaques par injection de base de données. Ceci est également pertinent lors de l'écriture de procédures stockées. | 1 | +| **1.2.5** | Vérifiez que l’application protège contre l’injection de commandes du système d’exploitation et que les appels du système d’exploitation utilisent des requêtes du système d’exploitation paramétrées ou utilisent un encodage de sortie de ligne de commande contextuelle. | 1 | +| **1.2.6** | Vérifiez que l’application protège contre les vulnérabilités d’injection LDAP ou que des contrôles de sécurité spécifiques pour empêcher l’injection LDAP ont été mis en œuvre. | 2 | +| **1.2.7** | Vérifiez que l’application est protégée contre les attaques par injection XPath en utilisant la paramétrisation des requêtes ou des requêtes précompilées. | 2 | +| **1.2.8** | Vérifiez que les processeurs LaTeX sont configurés de manière sécurisée (par exemple, en n'utilisant pas l'indicateur « --shell-escape ») et qu'une liste d’autorisations de commandes est utilisée pour empêcher les attaques par injection LaTeX. | 2 | +| **1.2.9** | Vérifiez que l'application échappe les caractères spéciaux dans les expressions régulières (généralement à l'aide d'une barre oblique inverse) pour éviter qu'ils ne soient mal interprétés comme des métacaractères. | 2 | +| **1.2.10** | Vérifiez que l'application est protégée contre les injections CSV et injections de formules. L'application doit respecter les règles d'échappement définies dans les sections 2.6 et 2.7 de la RFC 4180 lors de l'export de contenu CSV. De plus, lors de l'export au format CSV ou vers d'autres formats de tableur (tels que XLS, XLSX ou ODF), les caractères spéciaux (notamment « = », « + », « - », « @ », « \t » (tabulation) et « \0 » (caractère null)) doivent être protégés par une apostrophe s'ils apparaissent en premier dans une valeur de champ. | 3 | + +Remarque : L'utilisation de requêtes paramétrées ou l'échappement SQL ne sont pas toujours suffisants. Les parties de requête telles que les noms de table et de colonne (y compris les noms de colonne « ORDER BY ») ne peuvent pas être échappées. L'inclusion de données utilisateur échappées dans ces champs entraîne l'échec des requêtes ou une injection SQL. + +## V1.3 Nettoyage + +La protection idéale contre l'utilisation de contenu non fiable dans un contexte dangereux est d'utiliser un encodage ou un échappement spécifique au contexte, qui conserve la même signification sémantique du contenu dangereux mais le rend sûr pour une utilisation dans ce contexte particulier, comme expliqué plus en détail dans la section précédente. + +Lorsque cela n'est pas possible, un nettoyage devient nécessaire, supprimant les caractères ou contenus potentiellement dangereux. Dans certains cas, cela peut modifier la signification sémantique de la saisie, mais pour des raisons de sécurité, il peut n'y avoir aucune autre solution. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **1.3.1** | Vérifiez que toutes les entrées HTML non fiables provenant d'éditeurs WYSIWYG ou similaires sont nettoyées à l'aide d'une bibliothèque ou d'une fonctionnalité de Framework de nettoyage HTML bien connue et sécurisée. | 1 | +| **1.3.2** | Vérifiez que l'application évite d'utiliser eval() ou d'autres fonctionnalités d'exécution de code dynamique telles que Spring Expression Language (SpEL). En l'absence d'alternative, toute saisie utilisateur incluse doit être nettoyée avant d'être exécutée. | 1 | +| **1.3.3** | Vérifiez que les données transmises à un contexte potentiellement dangereux sont préalablement nettoyées pour appliquer des mesures de sécurité, telles qu'autoriser uniquement des caractères sûrs pour ce contexte et raccourcir des entrées trop longues. | 2 | +| **1.3.4** | Vérifiez que le contenu Scalable Vector Graphics (SVG) scriptable fourni par l'utilisateur est validé ou nettoyé pour contenir uniquement des balises et des attributs (tels que des graphiques de dessin) qui sont sûrs pour l'application, par exemple, ne contiennent pas de scripts et d'objets étrangers. | 2 | +| **1.3.5** | Vérifiez que l'application nettoie ou désactive le contenu du langage de modèle d'expression ou de script fourni par l'utilisateur, tel que les feuilles de style CSS, le Markdown ou XSL, BBCode ou similaire. | 2 | +| **1.3.6** | Vérifiez que l'application protège contre les attaques de falsification de requête côté serveur (SSRF), en validant les données non fiables par rapport à une liste d'autorisation de protocoles, de domaines, de chemins et de ports et en nettoyant les caractères potentiellement dangereux avant d'utiliser les données pour appeler un autre service. | 2 | +| **1.3.7** | Vérifiez que l'application se protège contre les attaques par injection de modèles en interdisant la création de modèles basés sur des entrées non fiables. En l'absence d'alternative, toute entrée non fiable incluse dynamiquement lors de la création du modèle doit être nettoyée ou rigoureusement validée. | 2 | +| **1.3.8** | Vérifiez que l’application nettoie correctement les entrées non fiables avant utilisation dans les requêtes Java Naming and Directory Interface (JNDI) et que JNDI est configuré de manière sécurisée pour empêcher les attaques par injection JNDI. | 2 | +| **1.3.9** | Vérifiez que l’application nettoie le contenu avant qu’il ne soit envoyé à memcache pour éviter les attaques par injection. | 2 | +| **1.3.10** | Vérifiez que les chaînes de format susceptibles d'être résolues de manière inattendue ou malveillante lors de leur utilisation sont nettoyées avant d'être traitées. | 2 | +| **1.3.11** | Vérifiez que l'application nettoie les entrées utilisateur avant de les transmettre aux systèmes de messagerie pour se protéger contre l'injection SMTP ou IMAP. | 2 | +| **1.3.12** | Vérifiez que les expressions régulières sont exemptes d'éléments provoquant "backtracking" exponentiel et assurez-vous que les entrées non fiables sont nettoyées pour atténuer les attaques ReDoS ou Runaway Regex. | 3 | + +## V1.4 Mémoire, chaine de caractères et code à mémoire non-managée + +Les exigences suivantes traitent des risques associés à une utilisation non sécurisée de la mémoire, qui s’appliquent généralement lorsque l’application utilise un langage système ou un code à mémoire non-managée. + +Dans certains cas, il peut être possible d'y parvenir en définissant des indicateurs de compilateur qui activent les protections contre les dépassements de tampon et les avertissements, y compris la randomisation de la pile et la prévention de l'exécution des données, et qui interrompent la construction si des opérations de pointeur, de mémoire, de chaîne de format, d'entier ou de chaine de caractères non sûres sont trouvées. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **1.4.1** | Vérifiez que l'application utilise des chaînes memory-safe, une copie de mémoire et une arithmétique de pointeur renforcée pour détecter ou empêcher les débordements de pile, de tampon ou de tas. | 2 | +| **1.4.2** | Vérifiez que les techniques de validation du signe, de la plage et de l’entrée sont utilisées pour éviter les dépassements d’entiers. | 2 | +| **1.4.3** | Vérifiez que la mémoire et les ressources allouées dynamiquement sont libérées et que les références ou les pointeurs vers la mémoire libérée sont supprimés ou définis à null pour éviter les "dangling pointer" et les vulnérabilités d'utilisation après libération. | 2 | + +## V1.5 Désérialisation sécurisée + +La conversion de données stockées ou transmises en objets applicatifs (désérialisation) a toujours été à l'origine de diverses vulnérabilités par injection de code. Il est important d'effectuer ce processus avec précaution et de manière sécurisée pour éviter ce type de problèmes. + +En particulier, certaines méthodes de désérialisation ont été identifiées par la documentation des langages de programmation ou des Framework comme étant non sécurisées et ne peuvent être sécurisées avec des données non fiables. Pour chaque mécanisme utilisé, une vérification rigoureuse doit être effectuée. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **1.5.1** | Vérifiez que l'application configure les "parser" XML pour utiliser une configuration restrictive et que les fonctionnalités non sûres telles que la résolution d'entités externes sont désactivées pour empêcher les attaques XML eXternal Entity (XXE). | 1 | +| **1.5.2** | Vérifiez que la désérialisation des données non fiables garantit une gestion sécurisée des entrées, par exemple en utilisant une liste d'autorisation de types d'objets ou en limitant les types d'objets définis par le client, afin d'empêcher les attaques par désérialisation. Les mécanismes de désérialisation explicitement définis comme non sécurisés ne doivent pas être utilisés avec des entrées non fiables. | 2 | +| **1.5.3** | Vérifiez que les différents "parser" utilisés dans l'application pour le même type de données (par exemple, les "parser" JSON, les "parser" XML, les "parser" d'URL) effectuent l'analyse de manière cohérente et utilisent le même mécanisme d'encodage de caractères pour éviter des problèmes tels que les vulnérabilités d'interopérabilité JSON ou un comportement d'analyse d'URI ou de fichier différent exploité dans les attaques d'inclusion de fichiers à distance (RFI) ou de falsification de requête côté serveur (SSRF). | 3 | + +## Références + +Pour plus d'informations, voir également : + +* [OWASP LDAP Injection Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html) +* [OWASP Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) +* [OWASP DOM Based Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html) +* [OWASP XML External Entity Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html) +* [OWASP Web Security Testing Guide: Client-Side Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/11-Client-side_Testing) +* [OWASP Java Encoding Project](https://owasp.org/owasp-java-encoder/) +* [DOMPurify - Client-side HTML Sanitization Library](https://github.com/cure53/DOMPurify) +* [RFC4180 - Common Format and MIME Type for Comma-Separated Values (CSV) Files](https://datatracker.ietf.org/doc/html/rfc4180#section-2) + +Pour plus d'informations, notamment sur les problèmes de désérialisation ou d'analyse, veuillez consulter : + +* [OWASP Deserialization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) +* [An Exploration of JSON Interoperability Vulnerabilities](https://bishopfox.com/blog/json-interoperability-vulnerabilities) +* [Orange Tsai - A New Era of SSRF Exploiting URL Parser In Trending Programming Languages](https://www.blackhat.com/docs/us-17/thursday/us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf) diff --git a/5.0/fr/0x11-V2-Validation-and-Business-Logic.md b/5.0/fr/0x11-V2-Validation-and-Business-Logic.md new file mode 100644 index 0000000000..98c9dec4b1 --- /dev/null +++ b/5.0/fr/0x11-V2-Validation-and-Business-Logic.md @@ -0,0 +1,73 @@ +# V2 Validation et logique métier + +## Objectif de contrôle + +Ce chapitre vise à garantir qu'une application vérifiée répond aux objectifs de haut niveau suivants : + +* Les entrées reçues par l'application correspondent aux attentes métier ou fonctionnelles. +* Le flux logique métier est séquentiel, traité dans l’ordre et ne peut pas être contourné. +* La logique métier inclut des limites et des contrôles pour détecter et prévenir les attaques automatisées, telles que les transferts continus de petits fonds ou l'ajout d'un million d'amis un par un. +* Les flux logiques métier à haute valeur ajoutée ont pris en compte les cas d'abus et les acteurs malveillants, et disposent de protections contre l'usurpation d'identité, la falsification, la divulgation d'informations et les attaques par élévation de privilèges. + +## V2.1 Validation et documentation de la logique métier + +La documentation de validation et de logique métier doit définir clairement les limites de la logique métier, les règles de validation et la cohérence contextuelle des éléments de données combinés, afin que ce qui doit être implémenté dans l'application soit clair. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **2.1.1** | Vérifiez que la documentation de l'application définit des règles de validation des entrées pour vérifier la validité des éléments de données par rapport à la structure attendue. Il peut s'agir de formats de données courants tels que des numéros de carte de crédit, des adresses e-mail ou des numéros de téléphone, ou d'un format de données interne. | 1 | +| **2.1.2** | Vérifiez que la documentation de l'application définit comment valider la cohérence logique et contextuelle des éléments de données combinés, par exemple en vérifiant que la banlieue et le code postal correspondent. | 2 | +| **2.1.3** | Vérifiez que les attentes en matière de limites et de validations de la logique métier sont documentées, y compris par utilisateur et globalement dans l'application. | 2 | + +## V2.2 Validation des entrées + +Des contrôles de validation des entrées efficaces renforcent les attentes métier ou fonctionnelles concernant le type de données que l'application s'attend à recevoir. Cela garantit une bonne qualité des données et réduit la surface d'attaque. Cependant, cela ne supprime ni ne remplace la nécessité d'utiliser un codage, un paramétrage ou un nettoyage corrects lors de l'utilisation des données dans un autre composant ou pour leur présentation en sortie. + +Dans ce contexte, les « entrées » peuvent provenir d'une grande variété de sources, notamment des champs de formulaire HTML, des requêtes REST, des paramètres d'URL, des champs d'en-tête HTTP, des cookies, des fichiers sur disque, des bases de données et des API externes. + +Un contrôle de logique métier peut vérifier qu'une entrée particulière est un nombre inférieur à 100. Une attente fonctionnelle peut vérifier qu'un nombre est inférieur à un certain seuil, car ce nombre contrôle le nombre de fois qu'une boucle particulière aura lieu, et un nombre élevé pourrait entraîner un traitement excessif et une condition potentielle de déni de service. + +Bien que la validation de schéma ne soit pas explicitement obligatoire, elle peut être le mécanisme le plus efficace pour une couverture de validation complète des API HTTP ou d'autres interfaces qui utilisent JSON ou XML. + +Veuillez noter les points suivants concernant la validation du schéma : + +* La « version publiée » de la spécification de validation du schéma JSON est considérée comme prête pour la production, mais pas à proprement parler « stable ». Lorsque vous utilisez la validation du schéma JSON, assurez-vous qu'il n'y a aucune lacune par rapport aux instructions des exigences ci-dessous. +* Toutes les bibliothèques de validation de schéma JSON utilisées doivent également être surveillées et mises à jour si nécessaire une fois la norme formalisée. +* La validation DTD ne doit pas être utilisée et l'évaluation DTD du Framework doit être désactivée pour éviter les problèmes liés aux attaques XXE contre les DTD. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **2.2.1** | Vérifier que les entrées sont validées afin de respecter les attentes métier ou fonctionnelles. Cette validation doit être basée sur une liste de valeurs, de modèles et de plages autorisées, ou sur la comparaison des entrées avec une structure attendue et des limites logiques selon des règles prédéfinies. Pour le niveau 1, cette validation peut se concentrer sur les entrées utilisées pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau 2, elle doit s'appliquer à toutes les entrées. | 1 | +| **2.2.2** | Vérifiez que l'application est conçue pour appliquer la validation des entrées au niveau d'une couche de service de confiance. Bien que la validation côté client améliore l'ergonomie et doit être encouragée, elle ne doit pas être considérée comme un contrôle de sécurité. | 1 | +| **2.2.3** | Vérifiez que l’application garantit que les combinaisons d’éléments de données associés sont raisonnables selon les règles prédéfinies. | 2 | + +## V2.3 Sécurité de la logique métier + +Cette section examine les exigences clés pour garantir que l’application applique les processus de logique métier de manière correcte et n’est pas vulnérable aux attaques qui exploitent la logique et le flux de l’application. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **2.3.1** | Vérifiez que l’application traitera uniquement les flux de logique métier pour le même utilisateur dans l’ordre séquentiel attendu et sans sauter d’étapes. | 1 | +| **2.3.2** | Vérifiez que les limites de la logique métier sont implémentées conformément à la documentation de l'application, afin d'éviter que des failles de la logique métier ne soient pas exploitées. | 2 | +| **2.3.3** | Vérifiez que les transactions sont utilisées au niveau de la logique métier de telle sorte qu'une opération de logique métier réussisse dans son intégralité ou qu'elle soit restaurée à l'état correct précédent. | 2 | +| **2.3.4** | Vérifiez que les mécanismes de verrouillage au niveau de la logique métier sont utilisés pour garantir que les ressources en quantité limitée (telles que les sièges de théâtre ou les créneaux de livraison) ne peuvent pas être réservées deux fois en manipulant la logique de l'application. | 2 | +| **2.3.5** | Vérifiez que les flux logiques métier à forte valeur ajoutée nécessitent l'approbation de plusieurs utilisateurs afin d'éviter toute action non autorisée ou accidentelle. Cela peut inclure, sans s'y limiter, les transferts monétaires importants, les approbations de contrats, l'accès à des informations classifiées ou les contournements de sécurité dans le secteur manufacturier. | 3 | + +## V2.4 Anti-automatisation + +Cette section comprend des contrôles anti-automatisation pour garantir que les interactions de type humaine sont requises et que les demandes automatisées excessives sont évitées. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **2.4.1** | Vérifiez que des contrôles anti-automatisation sont en place pour protéger contre les appels excessifs aux fonctions d'application qui pourraient conduire à l'exfiltration de données, à la création de données inutiles, à l'épuisement des quotas, aux violations de limites de débit, au déni de service ou à la surutilisation de ressources coûteuses. | 2 | +| **2.4.2** | Vérifiez que les flux logiques métier nécessitent un timing humain réaliste, évitant ainsi des soumissions de transactions excessivement rapides. | 3 | + +## Références + +Pour plus d'informations, voir également : + +* [OWASP Web Security Testing Guide 4.2: Input Validation Testing](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/README.html) +* [OWASP Web Security Testing Guide 4.2: Business Logic Testing](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/10-Business_Logic_Testing/README) +* La lutte contre l'automatisation peut se faire de différentes manières, notamment par l'utilisation de l'[OWASP Automated Threats to Web Applications](https://owasp.org/www-project-automated-threats-to-web-applications/) +* [OWASP Input Validation Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html) +* [JSON Schema](https://json-schema.org/specification.html) diff --git a/5.0/fr/0x12-V3-Web-Frontend-Security.md b/5.0/fr/0x12-V3-Web-Frontend-Security.md new file mode 100644 index 0000000000..2e74c3eb55 --- /dev/null +++ b/5.0/fr/0x12-V3-Web-Frontend-Security.md @@ -0,0 +1,100 @@ +# V3 Sécurité du frontend Web + +## Objectif de contrôle + +Cette catégorie se concentre sur les exigences visant à protéger contre les attaques exécutées via un frontend web. Ces exigences ne s'appliquent pas aux solutions "machine-to-machine". + +## V3.1 Documentation sur la sécurité du frontend Web + +Cette section décrit les fonctionnalités de sécurité du navigateur qui doivent être spécifiées dans la documentation de l'application. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **3.1.1** | Vérifiez que la documentation de l'application indique les fonctionnalités de sécurité attendues que les navigateurs utilisant l'application doivent prendre en charge (telles que HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) et autres mécanismes de sécurité HTTP pertinents). Elle doit également définir le comportement de l'application lorsque certaines de ces fonctionnalités ne sont pas disponibles (par exemple, avertir l'utilisateur ou bloquer l'accès). | 3 | + +## V3.2 Interprétation non intentionnelle du contenu + +Le rendu de contenu ou de fonctionnalité dans un contexte incorrect peut entraîner l'exécution ou l'affichage de contenu malveillant. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **3.2.1** | Vérifiez que des contrôles de sécurité sont en place pour empêcher les navigateurs d'afficher du contenu ou des fonctionnalités dans les réponses HTTP dans un contexte incorrect (par exemple, lorsqu'une API, un fichier téléchargé par l'utilisateur ou une autre ressource est demandée directement). Les contrôles possibles peuvent inclure : ne pas transmettre le contenu sauf si les champs d'en-tête de requête HTTP (tels que Sec-Fetch-\*) indiquent qu'il s'agit du contexte correct, utiliser la directive sandbox du champ d'en-tête Content-Security-Policy ou utiliser le type de disposition de pièce jointe dans le champ d'en-tête Content-Disposition. | 1 | +| **3.2.2** | Vérifiez que le contenu destiné à être affiché sous forme de texte, plutôt que rendu sous forme de HTML, est géré à l'aide de fonctions de rendu sécurisées (telles que createTextNode ou textContent) pour empêcher l'exécution involontaire de contenu tel que HTML ou JavaScript. | 1 | +| **3.2.3** | Vérifiez que l'application évite l'écrasement du DOM lors de l'utilisation de JavaScript côté client en utilisant des déclarations de variables explicites, en effectuant une vérification de type stricte, en évitant de stocker des variables globales sur l'objet document et en implémentant l'isolation de l'espace de nommage. | 3 | + +## V3.3 Configuration des cookies + +Cette section décrit les exigences de configuration sécurisée des cookies sensibles afin de fournir un niveau d'assurance plus élevé qu'ils ont été créés par l'application elle-même et d'empêcher que leur contenu ne fuite ou ne soit modifié de manière inappropriée. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **3.3.1** | Vérifiez que les cookies ont l'attribut « Secure » ​​défini et si le préfixe « \__Host- » n'est pas utilisé pour le nom du cookie, le préfixe « __Secure- » doit être utilisé pour le nom du cookie. | 1 | +| **3.3.2** | Vérifiez que la valeur de l'attribut « SameSite » de chaque cookie est définie en fonction de l'objectif du cookie, afin de limiter l'exposition aux attaques de réparation de l'interface utilisateur et aux attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF). | 2 | +| **3.3.3** | Vérifiez que les cookies ont le préfixe « __Host- » pour le nom du cookie, sauf s'ils sont explicitement conçus pour être partagés avec d'autres hôtes. | 2 | +| **3.3.4** | Vérifiez que si la valeur d'un cookie n'est pas censée être accessible aux scripts côté client (comme un jeton de session), le cookie doit avoir l'attribut « HttpOnly » défini et la même valeur (par exemple, un jeton de session) ne doit être transférée au client que via le champ d'en-tête « Set-Cookie ». | 2 | +| **3.3.5** | Vérifiez que lorsque l'application écrit un cookie, la longueur combinée du nom et de la valeur du cookie ne dépasse pas 4 096 octets. Les cookies trop volumineux ne seront pas stockés par le navigateur et ne seront donc pas envoyés avec les requêtes, empêchant ainsi l'utilisateur d'utiliser les fonctionnalités de l'application qui reposent sur ce cookie. | 3 | + +## V3.4 En-têtes du mécanisme de sécurité du navigateur + +Cette section décrit les en-têtes de sécurité qui doivent être définis sur les réponses HTTP pour activer les fonctionnalités et restrictions de sécurité du navigateur lors du traitement des réponses de l'application. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **3.4.1** | Vérifiez qu'un champ d'en-tête Strict-Transport-Security est inclus dans toutes les réponses afin d'appliquer une politique HTTP Strict Transport Security (HSTS). Une durée maximale d'au moins un an doit être définie, et pour les niveaux L2 et supérieurs, la politique doit également s'appliquer à tous les sous-domaines. | 1 | +| **3.4.2** | Vérifiez que le champ d'en-tête Access-Control-Allow-Origin du partage de ressources cross-origine (CORS) est une valeur fixe de l'application ou, si la valeur du champ d'en-tête de requête HTTP Origin est utilisée, qu'elle est validée par rapport à une liste d'origines approuvées. Si « Access-Control-Allow-Origin: * » doit être utilisé, vérifiez que la réponse ne contient aucune information sensible. | 1 | +| **3.4.3** | Vérifiez que les réponses HTTP incluent un champ d'en-tête de réponse Content-Security-Policy qui définit des directives garantissant que le navigateur charge et exécute uniquement du contenu ou des ressources fiables, afin de limiter l'exécution de JavaScript malveillant. Au minimum, une politique globale doit être utilisée, incluant les directives object-src 'none' et base-uri 'none', et définissant soit une lliste d’autorisations, soit des valeurs nonces ou des hachages. Pour une application L3, une politique par réponse avec des valeurs nonces ou des hachages doit être définie. | 2 | +| **3.4.4** | Vérifiez que toutes les réponses HTTP contiennent un champ d'en-tête « X-Content-Type-Options: nosniff ». Cela indique aux navigateurs de ne pas utiliser l'analyse de contenu ni la détection du type MIME pour la réponse donnée, et d'exiger que la valeur du champ d'en-tête « Content-Type » de la réponse corresponde à la ressource de destination. Par exemple, la réponse à une demande de style n'est acceptée que si le type de contenu de la réponse est « text/css ». Cela permet également au navigateur d'utiliser la fonctionnalité de blocage de lecture inter-origines (CORB). | 2 | +| **3.4.5** | Vérifiez que l'application définit une politique de référencement afin d'empêcher la fuite de données techniquement sensibles vers des services tiers via le champ d'en-tête de requête HTTP « Referer ». Cela peut être effectué via le champ d'en-tête de réponse HTTP « Referrer-Policy » ou via les attributs d'élément HTML. Les données sensibles peuvent inclure le chemin d'accès et les données de requête dans l'URL, et pour les applications internes non publiques, le nom d'hôte. | 2 | +| **3.4.6** | Vérifiez que l'application Web utilise la directive frame-ancestors du champ d'en-tête Content-Security-Policy pour chaque réponse HTTP afin de garantir qu'elle ne peut pas être intégrée par défaut et que l'intégration de ressources spécifiques n'est autorisée qu'en cas de nécessité. Notez que le champ d'en-tête X-Frame-Options, bien que pris en charge par les navigateurs, est obsolète et n'est pas forcément fiable. | 2 | +| **3.4.7** | Vérifiez que le champ d’en-tête Content-Security-Policy spécifie un emplacement pour signaler les violations. | 3 | +| **3.4.8** | Vérifiez que toutes les réponses HTTP qui lancent le rendu d'un document (comme les réponses de type text/html) incluent le champ d'en-tête 'Cross-Origin-Opener-Policy' avec la directive 'same-origin' ou s'ame-origin-allow-popups', selon les besoins. Cela empêche les attaques abusant de l'accès partagé aux objets Window, telles que le tabnabbing et le comptage d'images. | 3 | + +## V3.5 Séparation de l'origine du navigateur + +Lorsqu'elle accepte une demande d'accès à une fonctionnalité sensible du côté du serveur, l'application doit s'assurer que la demande est initiée par l'application elle-même ou par un tiers de confiance et qu'elle n'a pas été falsifiée par un attaquant. + +Les fonctionnalités sensibles dans ce contexte peuvent inclure l'acceptation de soumission de formulaires pour des utilisateurs authentifiés et non authentifiés (comme une demande d'authentification), des opérations de changement d'état ou des fonctionnalités exigeantes en ressources (comme l'exportation de données). + +Les principales protections sont les politiques de sécurité du navigateur, comme la politique de même origine pour JavaScript et la logique SameSite pour les cookies. Le mécanisme de requête de pré-vérification cross-origin CORS est une autre protection courante. Ce mécanisme est essentiel pour les "endpoints" conçus pour être appelés depuis une origine différente, mais il peut également constituer un mécanisme utile de prévention contre la falsification de requêtes pour les "endpoints" qui ne sont pas conçus pour être appelés depuis une origine différente. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **3.5.1** | Vérifiez que, si l'application ne s'appuie pas sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher les requêtes inter-origines non autorisées d'utiliser des fonctionnalités sensibles, ces requêtes sont validées afin de garantir leur origine. Cela peut se faire en utilisant et en validant des jetons anti-falsification ou en exigeant des champs d'en-tête HTTP supplémentaires qui ne sont pas des champs d'en-tête de requête CORS safelist. Ceci permet de se protéger contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF). | 1 | +| **3.5.2** | Vérifiez que, si l'application s'appuie sur le mécanisme de requête de pré-vérification cross-origin CORS pour empêcher l'utilisation inter-origines non autorisée de fonctionnalités sensibles, il est impossible d'appeler la fonctionnalité avec une requête qui ne déclenche pas de requête de pré-vérification cross-origin CORS. Cela peut nécessiter de vérifier les valeurs des champs d'en-tête de requête 'Origin' et 'Content-Type' ou d'utiliser un champ d'en-tête supplémentaire qui n'est pas un champ d'en-tête de la liste de sécurité CORS. | 1 | +| **3.5.3** | Vérifiez que les requêtes HTTP destinées aux fonctionnalités sensibles utilisent des méthodes HTTP appropriées, telles que POST, PUT, PATCH ou DELETE, et non des méthodes définies comme « sûres » par la spécification HTTP, telles que HEAD, OPTIONS ou GET. Une validation stricte des champs d'en-tête de requête Sec-Fetch-* peut également être utilisée pour garantir que la requête ne provient pas d'un appel inter-origines inapproprié, d'une requête de navigation ou d'un chargement de ressources (comme une source d'image) inattendu. | 1 | +| **3.5.4** | Vérifiez que des applications distinctes sont hébergées sur des noms d'hôte différents pour tirer parti des restrictions fournies par la politique de même origine, y compris la manière dont les documents ou scripts chargés par une origine peuvent interagir avec les ressources d'une autre origine et les restrictions basées sur le nom d'hôte sur les cookies. | 2 | +| **3.5.5** | Vérifiez que les messages reçus par l'interface postMessage sont rejetés si l'origine du message n'est pas digne de confiance ou si la syntaxe du message n'est pas valide. | 2 | +| **3.5.6** | Vérifiez que la fonctionnalité JSONP n'est activée nulle part dans l'application pour éviter les attaques Cross-Site Script Inclusion (XSSI). | 3 | +| **3.5.7** | Vérifiez que les données nécessitant une autorisation ne sont pas incluses dans les réponses des ressources de script, comme les fichiers JavaScript, pour empêcher les attaques par inclusion de script intersite (XSSI). | 3 | +| **3.5.8** | Vérifiez que les ressources authentifiées (telles que les images, les vidéos, les scripts et autres documents) peuvent être chargées ou intégrées pour le compte de l'utilisateur uniquement lorsque cela est prévu. Cela peut être réalisé en validant strictement les champs d'en-tête de requête HTTP Sec-Fetch-* afin de garantir que la requête ne provient pas d'un appel cross-origin inapproprié, ou en définissant un champ d'en-tête de réponse HTTP Cross-Origin-Resource-Policy restrictif pour indiquer au navigateur de bloquer le contenu renvoyé. | 3 | + +## V3.6 Intégrité des ressources externes + +Cette section fournit des conseils pour l’hébergement sécurisé de contenu sur des sites tiers. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **3.6.1** | Vérifiez que les ressources côté client, telles que les bibliothèques JavaScript, les feuilles de style CSS ou les polices web, sont hébergées en externe (par exemple, sur un réseau de diffusion de contenu) uniquement si la ressource est statique et versionnée, et si l'intégrité des sous-ressources (SRI) est utilisée pour valider l'intégrité de la ressource. Si cela n'est pas possible, une décision de sécurité documentée doit justifier cette décision pour chaque ressource. | 3 | + +## V3.7 Autres considérations sur la sécurité du navigateur + +Cette section comprend divers autres contrôles de sécurité et fonctionnalités de sécurité de navigateur modernes nécessaires pour la sécurité du navigateur côté client. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **3.7.1** | Vérifiez que l'application utilise uniquement des technologies côté client toujours prises en charge et considérées comme sécurisées. Parmi les technologies qui ne répondent pas à cette exigence figurent les plugins NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL ou les applets Java côté client. | 2 | +| **3.7.2** | Vérifiez que l'application redirigera automatiquement l'utilisateur vers un nom d'hôte ou un domaine différent (qui n'est pas contrôlé par l'application) uniquement lorsque la destination apparaît sur une liste d'autorisation. | 2 | +| **3.7.3** | Vérifiez que le domaine de premier niveau de l'application (par exemple, site.tld) ​​est ajouté à la liste de préchargement publique pour HTTP Strict Transport Security (HSTS). Cela garantit que l'utilisation de TLS pour l'application est intégrée directement dans les principaux navigateurs, plutôt que de dépendre uniquement du champ d'en-tête de réponse Strict-Transport-Security. | 3 | +| **3.7.4** | Vérifiez que l'application affiche une notification lorsque l'utilisateur est redirigé vers une URL hors du contrôle de l'application, avec une option pour annuler la navigation. | 3 | +| **3.7.5** | Vérifiez que l'application se comporte comme documenté (par exemple, en avertissant l'utilisateur ou en bloquant l'accès) si le navigateur utilisé pour accéder à l'application ne prend pas en charge les fonctionnalités de sécurité attendues. | 3 | + +## Références + +Pour plus d'informations, voir également : + +* [Set-Cookie __Host- prefix details](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#cookie_prefixes) +* [OWASP Content Security Policy Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html) +* [OWASP Secure Headers Project](https://owasp.org/www-project-secure-headers/) +* [OWASP Cross-Site Request Forgery Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html) +* [HSTS Browser Preload List submission form](https://hstspreload.org/) +* [OWASP DOM Clobbering Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/DOM_Clobbering_Prevention_Cheat_Sheet.html) diff --git a/5.0/fr/0x13-V4-API-and-Web-Service.md b/5.0/fr/0x13-V4-API-and-Web-Service.md new file mode 100644 index 0000000000..92f8afa0bd --- /dev/null +++ b/5.0/fr/0x13-V4-API-and-Web-Service.md @@ -0,0 +1,64 @@ +# V4 API et service Web + +## Objectif de contrôle + +Plusieurs considérations s'appliquent spécifiquement aux applications exposant des API destinées aux navigateurs web ou à d'autres consommateurs (généralement via JSON, XML ou GraphQL). Ce chapitre présente les configurations et mécanismes de sécurité pertinents à appliquer. + +Notez que les problèmes d’authentification, de gestion de session et de validation des entrées des autres chapitres s’appliquent également aux API. Ce chapitre ne peut donc pas être sorti de son contexte ni testé de manière isolée. + +## V4.1 Sécurité du service Web générique + +Cette section aborde les considérations générales sur la sécurité des services Web et, par conséquent, les pratiques d’hygiène de base des services Web. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **4.1.1** | Vérifiez que chaque réponse HTTP avec un corps de message contient un champ d'en-tête Content-Type qui correspond au contenu réel de la réponse, y compris le paramètre charset pour spécifier un codage de caractères sécurisé (par exemple, UTF-8, ISO-8859-1) conformément aux types de médias IANA, tels que « text/ », « /+xml » et « /xml ». | 1 | +| **4.1.2** | Vérifiez que seuls les terminaux utilisateurs (destinés à l'accès manuel via un navigateur web) redirigent automatiquement de HTTP vers HTTPS, tandis que les autres services ou terminaux n'implémentent pas de redirections transparentes. Cela permet d'éviter qu'un client envoie par erreur des requêtes HTTP non chiffrées, mais que, comme ces requêtes sont automatiquement redirigées vers HTTPS, la fuite de données sensibles passe inaperçue. | 2 | +| **4.1.3** | Vérifiez que tout champ d'en-tête HTTP utilisé par l'application et défini par une couche intermédiaire, telle qu'un équilibreur de charge, un proxy web ou un service backend-for-frontend, ne peut pas être remplacé par l'utilisateur final. Les exemples d'en-têtes peuvent inclure X-Real-IP, X-Forwarded-*, ou X-User-ID. | 2 | +| **4.1.4** | Vérifiez que seules les méthodes HTTP explicitement prises en charge par l'application ou son API (y compris les OPTIONS lors des demandes de contrôle en amont) peuvent être utilisées et que les méthodes inutilisées sont bloquées. | 3 | +| **4.1.5** | Vérifier que les signatures numériques par message sont utilisées pour fournir une assurance supplémentaire en plus des protections de transport pour les demandes ou les transactions qui sont très sensibles ou qui traversent un certain nombre de systèmes. | 3 | + +## V4.2 Validation de la structure des messages HTTP + +Cette section explique comment la structure et les champs d'en-tête d'un message HTTP doivent être validés afin de prévenir les attaques telles que la contrebande de requêtes, le fractionnement de réponses, l'injection d'en-têtes et le déni de service via des messages HTTP trop longs. + +Ces exigences sont pertinentes pour le traitement et la génération de messages HTTP généraux, mais sont particulièrement importantes lors de la conversion de messages HTTP entre différentes versions HTTP. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **4.2.1** | Vérifiez que tous les composants de l'application (y compris les équilibreurs de charge, les pares-feux et les serveurs d'applications) déterminent les limites des messages HTTP entrants à l'aide du mécanisme approprié à la version HTTP afin d'empêcher la contrebande de requêtes HTTP. Dans HTTP/1.x, si un champ d'en-tête Transfer-Encoding est présent, l'en-tête Content-Length doit être ignoré conformément à la RFC 2616. Avec HTTP/2 ou HTTP/3, si un champ d'en-tête Content-Length est présent, le récepteur doit s'assurer qu'il est cohérent avec la longueur des trames DATA. | 2 | +| **4.2.2** | Vérifier que, lors de la génération de messages HTTP, le champ d'en-tête Content-Length n'entre pas en conflit avec la longueur du contenu déterminée par le cadrage du protocole HTTP, afin d'empêcher les attaques de type « request smuggling ». | 3 | +| **4.2.3** | Vérifiez que l'application n'envoie ni n'accepte de messages HTTP/2 ou HTTP/3 avec des champs d'en-tête spécifiques à la connexion, tels que Transfer-Encoding, afin d'éviter les attaques par fractionnement de la réponse et par injection d'en-tête. | 3 | +| **4.2.4** | Vérifiez que l'application n'accepte que les requêtes HTTP/2 et HTTP/3 dont les champs et valeurs d'en-tête ne contiennent pas de séquences CR (\r), LF (\n) ou CRLF (\r\n), afin d'éviter les attaques par injection d'en-tête. | 3 | +| **4.2.5** | Vérifiez que, si l'application (backend ou frontend) construit et envoie des requêtes, elle utilise des mécanismes de validation, d'assainissement ou autres pour éviter de créer des URI (comme pour les appels API) ou des champs d'en-tête de requête HTTP (comme Authorization ou Cookie) qui sont trop longs pour être acceptés par le composant récepteur. Cela pourrait entraîner un déni de service, par exemple lors de l'envoi d'une requête trop longue (par exemple, un long champ d'en-tête de cookie), ce qui fait que le serveur répond toujours avec un statut d'erreur. | 3 | + +## V4.3 GraphQL + +GraphQL est de plus en plus utilisé pour créer des clients riches en données, peu couplés à divers services backend. Cette section aborde les considérations de sécurité pour GraphQL. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **4.3.1** | Vérifiez qu'une liste d'autorisation de requête, une limitation de profondeur, une limitation de quantité ou une analyse des coûts de requête est utilisée pour empêcher le déni de service (DoS) de GraphQL ou d'expression de la couche données en raison de requêtes imbriquées coûteuses. | 2 | +| **4.3.2** | Vérifiez que les requêtes d’introspection GraphQL sont désactivées dans l’environnement de production, sauf si l’API GraphQL est destinée à être utilisée par d’autres parties. | 2 | + +## V4.4 WebSocket + +WebSocket est un protocole de communication qui fournit un canal de communication bidirectionnel simultané via une seule connexion TCP. Il a été normalisé par l'IETF sous la RFC 6455 en 2011 et se distingue de HTTP, bien qu'il soit conçu pour fonctionner sur les ports HTTP 443 et 80. + +Cette section fournit les principales exigences de sécurité pour empêcher les attaques liées à la sécurité des communications et à la gestion des sessions qui exploitent spécifiquement ce canal de communication en temps réel. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **4.4.1** | Vérifiez que WebSocket sur TLS (WSS) est utilisé pour toutes les connexions WebSocket. | 1 | +| **4.4.2** | Vérifiez que, lors de la négociation HTTP WebSocket initiale, le champ d’en-tête 'Origin' est vérifié par rapport à une liste d’origines autorisées pour l’application. | 2 | +| **4.4.3** | Vérifiez que, si la gestion de session standard de l'application ne peut pas être utilisée, des jetons dédiés sont utilisés à cet effet, qui sont conformes aux exigences de sécurité de gestion de session pertinentes. | 2 | +| **4.4.4** | Vérifiez que les jetons de gestion de session WebSocket dédiés sont initialement obtenus ou validés via la session HTTPS précédemment authentifiée lors de la transition d'une session HTTPS existante vers un canal WebSocket. | 2 | + +## Références + +Pour plus d'informations, voir également : + +* [OWASP REST Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html) +* Resources on GraphQL Authorization from [graphql.org](https://graphql.org/learn/authorization/) and [Apollo](https://www.apollographql.com/docs/apollo-server/security/authentication/#authorization-methods). +* [OWASP Web Security Testing Guide: GraphQL Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/12-API_Testing/01-Testing_GraphQL) +* [OWASP Web Security Testing Guide: Testing WebSockets](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/11-Client-side_Testing/10-Testing_WebSockets) diff --git a/5.0/fr/0x14-V5-File-Handling.md b/5.0/fr/0x14-V5-File-Handling.md new file mode 100644 index 0000000000..74a11f7a7d --- /dev/null +++ b/5.0/fr/0x14-V5-File-Handling.md @@ -0,0 +1,54 @@ +# V5 Gestion des fichiers + +## Objectif de contrôle + +L'utilisation de fichiers peut présenter divers risques pour l'application, notamment le déni de service, l'accès non autorisé et l'épuisement de l'espace de stockage. Ce chapitre présente les exigences pour gérer ces risques. + +## V5.1 Documentation sur la gestion des fichiers + +Cette section comprend l’obligation de documenter les caractéristiques attendues des fichiers acceptés par l’application, comme condition préalable nécessaire au développement et à la vérification des contrôles de sécurité pertinents. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **5.1.1** | Vérifiez que la documentation définit les types de fichiers autorisés, les extensions de fichiers attendues et la taille maximale (y compris la taille décompressée) pour chaque fonctionnalité de Téléversement. De plus, assurez-vous que la documentation précise comment les fichiers sont sécurisés pour le téléchargement et le traitement des utilisateurs finaux, par exemple le comportement de l'application lorsqu'un fichier malveillant est détecté.| 2 | + +## V5.2 Téléversement de fichiers et contenu + +La fonctionnalité de téléversement de fichiers est une source majeure de fichiers non fiables. Cette section décrit les exigences permettant de garantir que la présence, le volume ou le contenu de ces fichiers ne nuisent pas à l'application. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **5.2.1** | Vérifiez que l'application n'acceptera que des fichiers d'une taille qu'elle peut traiter sans provoquer de perte de performances ou d'attaque par déni de service. | 1 | +| **5.2.2** | Vérifiez que lorsque l'application accepte un fichier, seul ou dans une archive telle qu'un fichier zip, elle vérifie si l'extension de fichier correspond à une extension attendue et que le contenu correspond au type représenté par l'extension. Cela inclut, sans s'y limiter, la vérification des « octets magiques » initiaux, la réécriture d'images et l'utilisation de bibliothèques spécialisées pour la validation du contenu des fichiers. Pour le niveau L1, cela peut se concentrer uniquement sur les fichiers utilisés pour prendre des décisions métier ou de sécurité spécifiques. À partir du niveau L2, cela doit s'appliquer à tous les fichiers acceptés. | 1 | +| **5.2.3** | Vérifiez que l'application vérifie les fichiers compressés (par exemple, zip, gz, docx, odt) par rapport à la taille maximale autorisée non compressée et au nombre maximal de fichiers avant de décompresser le fichier. | 2 | +| **5.2.4** | Vérifiez qu'un quota de taille de fichier et un nombre maximal de fichiers par utilisateur sont appliqués pour garantir qu'un seul utilisateur ne puisse pas remplir le stockage avec trop de fichiers ou des fichiers excessivement volumineux. | 3 | +| **5.2.5** | Vérifiez que l'application n'autorise pas le téléversement de fichiers compressés contenant des liens symboliques, sauf si cela est spécifiquement requis (auquel cas il sera nécessaire d'appliquer une liste d'autorisation des fichiers vers lesquels il est possible de créer des liens symboliques).| 3 | +| **5.2.6** | Vérifiez que l'application rejette les images téléversées avec une taille de pixel supérieure au maximum autorisé, afin d'éviter les attaques par inondation de pixels.| 3 | + +## V5.3 Stockage de fichiers + +Cette section comprend des exigences visant à empêcher l'exécution inappropriée des fichiers après leur téléversement, à détecter le contenu dangereux et à éviter que des données non fiables ne soient utilisées pour contrôler l'emplacement de stockage des fichiers. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **5.3.1** | Vérifiez que les fichiers téléversés ou générés par une entrée non fiable et stockés dans un dossier public ne sont pas exécutés en tant que code de programme côté serveur lorsqu'ils sont accessibles directement avec une requête HTTP. | 1 | +| **5.3.2** | Vérifiez que lorsque l'application crée des chemins d'accès pour les opérations sur les fichiers, elle utilise des données générées en interne ou fiables plutôt que des noms de fichiers soumis par l'utilisateur. Si des noms de fichiers ou des métadonnées de fichiers soumis par l'utilisateur doivent être utilisés, une validation et un nettoyage stricts doivent être appliqués. Ceci permet de se protéger contre les attaques par traversée de chemin, l'inclusion de fichiers locaux ou distants (LFI, RFI) et la falsification de requêtes côté serveur (SSRF). | 1 | +| **5.3.3** | Vérifiez que le traitement des fichiers côté serveur, comme la décompression des fichiers, ignore les informations de chemin fournies par l'utilisateur pour éviter les vulnérabilités telles que le "zip slip". | 3 | + +## V5.4 Téléchargement de fichier + +Cette section décrit les exigences visant à atténuer les risques liés au téléchargement de fichiers, notamment les attaques par traversée de chemin et par injection. Elle s'assure également qu'ils ne contiennent pas de contenu dangereux. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **5.4.1** | Vérifiez que l’application valide ou ignore les noms de fichiers soumis par l’utilisateur, y compris dans un paramètre JSON, JSONP ou URL et spécifie un nom de fichier dans le champ d’en-tête Content-Disposition de la réponse. | 2 | +| **5.4.2** | Vérifiez que les noms de fichiers servis (par exemple, dans les champs d'en-tête de réponse HTTP ou les pièces jointes aux e-mails) sont encodés ou nettoyés (par exemple, conformément à la RFC 6266) pour préserver la structure du document et empêcher les attaques par injection. | 2 | +| **5.4.3** | Vérifiez que les fichiers obtenus à partir de sources non fiables sont analysés par des scanners antivirus pour empêcher la diffusion de contenu malveillant connu. | 2 | + +## Références + +Pour plus d'informations, voir également : + +* [OWASP File Upload Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html) +* [Example of using symlinks for arbitrary file read](https://hackerone.com/reports/1439593) +* [Explanation of "Magic Bytes" from Wikipedia](https://en.wikipedia.org/wiki/List_of_file_signatures) diff --git a/5.0/fr/0x15-V6-Authentication.md b/5.0/fr/0x15-V6-Authentication.md new file mode 100644 index 0000000000..9120b56135 --- /dev/null +++ b/5.0/fr/0x15-V6-Authentication.md @@ -0,0 +1,166 @@ +# V6 Authentification + +## Objectif de contrôle + +L'authentification est le processus permettant d'établir ou de confirmer l'authenticité d'une personne ou d'un appareil. Elle consiste à vérifier les déclarations d'une personne ou d'un appareil, à garantir la résistance à l'usurpation d'identité et à empêcher la récupération ou l'interception des mots de passe. + +Le [NIST SP 800-63](https://pages.nist.gov/800-63-3/) est une norme moderne, fondée sur des preuves, qui est précieuse pour les organisations du monde entier, mais qui est particulièrement pertinente pour les agences américaines et ceux qui intéragissent avec les agences américaines. + +Bien que de nombreuses exigences de ce chapitre soient basées sur la deuxième section de la norme (appelée NIST SP 800-63B « Directives relatives à l'identité numérique - Authentification et gestion du cycle de vie »), ce chapitre se concentre sur les menaces courantes et les faiblesses d'authentification fréquemment exploitées. Il ne prétend pas couvrir tous les points de la norme de manière exhaustive. Pour les cas où une conformité totale à la norme NIST SP 800-63 est nécessaire, veuillez vous référer à cette dernière. + +De plus, la terminologie du NIST SP 800-63 peut parfois différer, et ce chapitre utilise souvent une terminologie plus communément comprise pour améliorer la clarté. + +Une fonctionnalité commune aux applications plus avancées est la possibilité d'adapter les étapes d'authentification requises en fonction de divers facteurs de risque. Cette fonctionnalité est abordée dans le chapitre « Autorisation », car ces mécanismes doivent également être pris en compte dans les décisions d'autorisation. + +## V6.1 Documentation d'authentification + +Cette section détaille les exigences relatives à la documentation d'authentification à conserver pour une application. Elle est essentielle à la mise en œuvre et à l'évaluation de la configuration des contrôles d'authentification pertinents. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **6.1.1** | Vérifiez que la documentation de l'application définit comment les contrôles, tels que la limitation de débit, l'anti-automatisation et la réponse adaptative, sont utilisés pour se défendre contre les attaques telles que le « credential stuffing » et la force brute des mots de passe. La documentation doit expliquer clairement comment ces contrôles sont configurés et empêcher le blocage malveillant des comptes. | 1 | +| **6.1.2** | Vérifiez qu'une liste de mots spécifiques au contexte est documentée afin d'empêcher leur utilisation dans les mots de passe. Cette liste peut inclure des permutations de noms d'organisations, de produits, d'identifiants de systèmes, de noms de codes de projets, de noms de services ou de rôles, etc. | 2 | +| **6.1.3** | Vérifiez que, si l'application inclut plusieurs voies d'authentification, celles-ci sont toutes documentées avec les contrôles de sécurité et la force d'authentification qui doivent être appliqués de manière cohérente. | 2 | + +## V6.2 Sécurité des mots de passe + +Les mots de passe, appelés « secrets mémorisés » par la norme NIST SP 800-63, comprennent les mots de passe, les phrases de passe, les codes PIN, les schémas de déverrouillage et choisir « le bon chaton » ou d'un autre élément d'image. Ils sont généralement considérés comme « quelque chose que vous connaissez » et sont souvent utilisés comme mécanisme d'authentification à facteur unique. + +Cette section contient donc des exigences visant à garantir la création et la gestion sécurisées des mots de passe. La plupart des exigences sont de niveau 1, car elles sont les plus importantes à ce niveau. À partir du niveau 2, des mécanismes d'authentification multifacteur sont requis, les mots de passe pouvant être l'un de ces facteurs. + +Les exigences de cette section concernent principalement le chapitre [§ 5.1.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver) du [Guide du NIST](https://pages.nist.gov/800-63-3/sp800-63b.html). + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **6.2.1** | Vérifiez que les mots de passe définis par l'utilisateur comportent au moins 8 caractères, bien qu'un minimum de 15 caractères soit fortement recommandé. | 1 | +| **6.2.2** | Vérifiez que les utilisateurs peuvent modifier leur mot de passe. | 1 | +| **6.2.3** | Vérifiez que la fonctionnalité de changement de mot de passe nécessite le mot de passe actuel et le nouveau mot de passe de l'utilisateur. | 1 | +| **6.2.4** | Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou du changement de mot de passe sont vérifiés par rapport à un ensemble disponible d'au moins 3 000 mots de passe principaux qui correspondent à la politique de mot de passe de l'application, par exemple la longueur minimale. | 1 | +| **6.2.5** | Vérifiez que les mots de passe peuvent être utilisés, quelle que soit leur composition, sans restriction quant au type de caractères autorisés. Aucun nombre minimal de majuscules ou de minuscules, de chiffres ou de caractères spéciaux ne doit être exigé. | 1 | +| **6.2.6** | Vérifiez que les champs de saisie du mot de passe utilisent type=password pour masquer la saisie. Les applications peuvent permettre à l'utilisateur d'afficher temporairement l'intégralité du mot de passe masqué ou le dernier caractère saisi. | 1 | +| **6.2.7** | Vérifiez que la fonctionnalité « coller », les assistants de mot de passe du navigateur et les gestionnaires de mots de passe externes sont autorisés. | 1 | +| **6.2.8** | Vérifiez que l'application vérifie le mot de passe de l'utilisateur exactement tel qu'il a été reçu de l'utilisateur, sans aucune modification telle qu'une troncature ou une transformation de casse. | 1 | +| **6.2.9** | Vérifiez que les mots de passe d’au moins 64 caractères sont autorisés. | 2 | +| **6.2.10** | Vérifiez que le mot de passe d'un utilisateur reste valide jusqu'à ce qu'il soit découvert comme compromis ou qu'il soit renouvelé. L'application ne doit pas exiger de renouvellement périodique des identifiants. | 2 | +| **6.2.11** | Vérifiez que la liste documentée de mots spécifiques au contexte est utilisée pour éviter la création de mots de passe faciles à deviner. | 2 | +| **6.2.12** | Vérifiez que les mots de passe soumis lors de l'enregistrement du compte ou des modifications de mot de passe sont vérifiés par rapport à un ensemble de mots de passe fuités. | 2 | + +## V6.3 Sécurité générale de l'authentification + +Cette section contient les exigences générales relatives à la sécurité des mécanismes d'authentification et définit les différentes attentes en matière de niveaux. Les applications L2 doivent recourir à l'authentification multifacteur (MFA). Les applications L3 doivent utiliser une authentification matérielle, réalisée dans un environnement d'exécution certifié et approuvé (TEE). Cela peut inclure des clés d'accès liées à l'appareil, des authentificateurs eIDAS à niveau d'assurance élevé (LoA), des authentificateurs avec l'assurance NIST Authenticator Assurance Level 3 (AAL3) ou un mécanisme équivalent. + +Bien qu'il s'agisse d'une position relativement agressive concernant l'authentification multifacteur, il est essentiel de relever le niveau à ce sujet pour protéger les utilisateurs, et toute tentative d'assouplissement de ces exigences doit être accompagnée d'un plan clair sur la manière dont les risques liés à l'authentification seront atténués, en tenant compte des orientations et des recherches du NIST sur le sujet. + +Veuillez noter qu'au moment de la publication, la norme NIST SP 800-63 considère l'email comme [non acceptable](https://pages.nist.gov/800-63-FAQ/#q-b11) comme mécanisme d'authentification ([copie archivée](https://pages.nist.gov/800-63-FAQ/#q-b11)). + +Les exigences de cette section concernent diverses sections du [Guide du NIST](https://pages.nist.gov/800-63-3/sp800-63b.html), incluant : [§ 4.2.1](https://pages.nist.gov/800-63-3/sp800-63b.html#421-permitted-authenticator-types), [§ 4.3.1](https://pages.nist.gov/800-63-3/sp800-63b.html#431-permitted-authenticator-types), [§ 5.2.2](https://pages.nist.gov/800-63-3/sp800-63b.html#522-rate-limiting-throttling), et [§ 6.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#-612-post-enrollment-binding). + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **6.3.1** | Vérifiez que les contrôles visant à empêcher les attaques telles que le bourrage d'informations d'identification et la force brute des mots de passe sont mis en œuvre conformément à la documentation de sécurité de l'application. | 1 | +| **6.3.2** | Vérifiez que les comptes d’utilisateur par défaut (par exemple, « root », « admin » ou « sa ») ne sont pas présents dans l’application ou sont désactivés. | 1 | +| **6.3.3** | Vérifiez que l’application exige que les utilisateurs utilisent un mécanisme d’authentification multifacteur ou une combinaison de mécanismes d’authentification à facteur unique. | 2 | +| **6.3.4** | Vérifiez que, si l’application inclut plusieurs voies d’authentification, il n’existe aucune voie non documentée et que les contrôles de sécurité et la force d’authentification sont appliqués de manière cohérente. | 2 | +| **6.3.5** | Vérifiez que les utilisateurs sont informés des tentatives d'authentification suspectes (réussies ou non). Il peut s'agir de tentatives d'authentification provenant d'un emplacement ou d'un client inhabituel, d'une authentification partiellement réussie (un seul facteur parmi plusieurs), d'une tentative d'authentification après une longue période d'inactivité ou d'une authentification réussie après plusieurs tentatives infructueuses. | 3 | +| **6.3.6** | Vérifiez que le courrier électronique n’est pas utilisé comme mécanisme d’authentification à facteur unique ou à facteurs multiples. | 3 | +| **6.3.7** | Vérifiez que les utilisateurs sont avertis après les mises à jour des détails d'authentification, telles que les réinitialisations d'informations d'identification ou la modification du nom d'utilisateur ou de l'adresse e-mail. | 3 | +| **6.3.8** | Vérifiez que les utilisateurs valides ne peuvent pas être déduits d'échecs d'authentification, par exemple en se basant sur des messages d'erreur, des codes de réponse HTTP ou des temps de réponse différents. Les fonctionnalités d'inscription et de mot de passe oublié doivent également bénéficier de cette protection. | 3 | + +## V6.4 Cycle de vie et récupération du facteur d'authentification + +Les facteurs d'authentification peuvent inclure des mots de passe, des jetons logiciels, des jetons matériels et des dispositifs biométriques. La gestion sécurisée du cycle de vie de ces mécanismes est essentielle à la sécurité d'une application, et cette section présente les exigences afférentes. + +Les exigences de cette section concernent principalement les chapitres [§ 5.1.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver) ou [§ 6.1.2.3](https://pages.nist.gov/800-63-3/sp800-63b.html#replacement) of [Guide du NIST](https://pages.nist.gov/800-63-3/sp800-63b.html). + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **6.4.1** | Vérifiez que les mots de passe initiaux ou les codes d'activation générés par le système sont générés de manière aléatoire et sécurisée, qu'ils respectent la politique de mots de passe en vigueur et qu'ils expirent après une courte période ou après leur première utilisation. Ces secrets initiaux ne doivent pas devenir des mots de passe permanents. | 1 | +| **6.4.2** | Vérifiez que les indices de mot de passe ou l'authentification basée sur les connaissances (appelées « questions secrètes ») ne sont pas présents. | 1 | +| **6.4.3** | Vérifiez qu'un processus sécurisé de réinitialisation d'un mot de passe oublié est mis en œuvre, qui ne contourne aucun mécanisme d'authentification multifacteur activé. | 2 | +| **6.4.4** | Vérifiez que si un facteur d'authentification multifacteur est perdu, la preuve de vérification d'identité est effectuée au même niveau que lors de l'inscription. | 2 | +| **6.4.5** | Vérifiez que les instructions de renouvellement des mécanismes d'authentification qui expirent sont envoyées avec suffisamment de temps pour être exécutées avant l'expiration de l'ancien mécanisme d'authentification, en configurant des rappels automatiques si nécessaire. | 3 | +| **6.4.6** | Vérifiez que les administrateurs peuvent initier la réinitialisation du mot de passe de l'utilisateur, mais que cela ne leur permet pas de modifier ou de choisir son mot de passe. Cela évite qu'ils ne connaissent le mot de passe de l'utilisateur. | 3 | + +## V6.5 Exigences générales en matière d'authentification multifacteur + +Cette section fournit des conseils généraux qui seront pertinents pour différentes méthodes d’authentification multifacteur. + +Les mécanismes comprennent : + +* Secret recherché dans une table +* Mots de passe à usage unique basés sur le temps (TOTP) +* Mécanismes out-of-band + +Les secrets de recherche sont des listes pré-générées de codes secrets, similaires aux numéros d'autorisation de transaction (TAN), aux codes de récupération des réseaux sociaux ou à une grille contenant un ensemble de valeurs aléatoires. Ce type de mécanisme d'authentification est considéré comme « quelque chose que vous possédez », car les codes sont volontairement non mémorisables et doivent donc être stockés quelque part. + +Les mots de passe à usage unique basés sur le temps (TOTP) sont des jetons physiques ou logiciels qui affichent un code pseudo-aléatoire à usage unique et changeant en permanence. Ce type de mécanisme d'authentification est considéré comme « quelque chose que vous possédez ». Les TOTP multifactoriels sont similaires aux TOTP à simple facteur", mais nécessitent la saisie d'un code PIN valide, un déverrouillage biométrique, une clé USB ou un appairage NFC, ou d'une valeur supplémentaire (comme des calculateurs de signature de transaction) pour créer le mot de passe à usage unique (OTP) final. + +Des détails sur les mécanismes out-of-band seront fournis dans la section suivante. + +Les exigences de ces sections concernent principalement les chapitres [§ 5.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#-512-look-up-secrets), [§ 5.1.3](https://pages.nist.gov/800-63-3/sp800-63b.html#-513-out-of-band-devices), [§ 5.1.4.2](https://pages.nist.gov/800-63-3/sp800-63b.html#5142-single-factor-otp-verifiers), [§ 5.1.5.2](https://pages.nist.gov/800-63-3/sp800-63b.html#5152-multi-factor-otp-verifiers), [§ 5.2.1](https://pages.nist.gov/800-63-3/sp800-63b.html#521-physical-authenticators), et [§ 5.2.3](https://pages.nist.gov/800-63-3/sp800-63b.html#523-use-of-biometrics) du [Guide du NIST](https://pages.nist.gov/800-63-3/sp800-63b.html). + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **6.5.1** | Vérifiez que les secrets de recherche, les demandes ou codes d'authentification out-of-band et les mots de passe à usage unique basés sur le temps (TOTP) ne peuvent être utilisés avec succès qu'une seule fois. | 2 | +| **6.5.2** | Vérifiez que, lors de leur stockage dans le backend de l'application, les secrets de recherche comportant moins de 112 bits d'entropie (19 caractères alphanumériques aléatoires ou 34 chiffres aléatoires) sont hachés avec un algorithme de hachage de stockage de mots de passe approuvé, intégrant un sel aléatoire de 32 bits. Une fonction de hachage standard peut être utilisée si le secret comporte 112 bits d'entropie ou plus. | 2 | +| **6.5.3** | Vérifiez que les secrets de recherche, le code d'authentification out-of-band et les mots de passe à usage unique basés sur le temps sont générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) pour éviter les valeurs prévisibles. | 2 | +| **6.5.4** | Vérifiez que les secrets de recherche et les codes d'authentification out-of-band ont un minimum de 20 bits d'entropie (généralement 4 caractères alphanumériques aléatoires ou 6 chiffres aléatoires suffisent). | 2 | +| **6.5.5** | Vérifiez que les requêtes, codes ou jetons d'authentification out-of-band, ainsi que les mots de passe à usage unique (TOTP), ont une durée de vie définie. Les requêtes out-of-band doivent avoir une durée de vie maximale de 10 minutes et les TOTP, de 30 secondes. | 2 | +| **6.5.6** | Vérifiez que tout facteur d’authentification (y compris les appareils physiques) peut être révoqué en cas de vol ou autre perte. | 3 | +| **6.5.7** | Vérifiez que les mécanismes d’authentification biométrique ne sont utilisés que comme facteurs secondaires, avec quelque chose que vous possédez ou quelque chose que vous savez. | 3 | +| **6.5.8** | Vérifiez que les mots de passe à usage unique basés sur le temps (TOTP) sont vérifiés en fonction d'une source temporelle provenant d'un service de confiance et non d'une heure non fiable ou fournie par le client. | 3 | + +## V6.6 Mécanismes d'authentification out-of-band + +Cela implique généralement que le serveur d'authentification communique avec un appareil physique via un canal secondaire sécurisé. Par exemple, l'envoi de notifications push aux appareils mobiles. Ce type de mécanisme d'authentification est considéré comme « quelque chose que vous possédez ». + +Les mécanismes d'authentification out-of-band non sécurisés tels que le courrier électronique et la VoIP ne sont pas autorisés. L'authentification PSTN et SMS est actuellement considérée comme des [mécanismes d'authentification « restreints »](https://pages.nist.gov/800-63-FAQ/#q-b01) par le NIST et devrait être déconseillée au profit des mots de passe à usage unique basés sur le temps (TOTP), d'un mécanisme cryptographique ou similaire. La norme NIST SP 800-63B [§ 5.1.3.3](https://pages.nist.gov/800-63-3/sp800-63b.html#-5133-authentication-using-the-public-switched-telephone-network) recommande de traiter les risques d'échange d'appareil, de changement de carte SIM, de portage de numéro ou d'autres comportements anormaux, si l'authentification out-of-band par téléphone ou SMS doit absolument être prise en charge. Bien que cette section ASVS n'impose pas cela comme une exigence, le fait de ne pas prendre ces précautions pour une application L2 sensible ou une application L3 doit être considéré comme un signal d'alarme important. + +Notez que le NIST a également récemment publié des directives [déconseillant l'utilisation des notifications push](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#fig-3). Bien que cette section ASVS ne le fasse pas, il est important d'être conscient des risques de « push bombing ». + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **6.6.1** | Vérifier que les mécanismes d'authentification utilisant le réseau téléphonique public commuté (RTPC) pour la transmission de mots de passe à usage unique (OTP) par téléphone ou SMS ne sont proposés que lorsque le numéro de téléphone a été préalablement validé. D'autres méthodes plus robustes (telles que les mots de passe à usage unique à durée déterminée) sont également proposées, et que le service informe les utilisateurs des risques de sécurité qu'elles présentent. Pour les applications de niveau 3, le téléphone et les SMS ne doivent pas être disponibles. | 2 | +| **6.6.2** | Vérifiez que les demandes d’authentification out-of-band, les codes ou les jetons sont liés à la demande d’authentification d’origine pour laquelle ils ont été générés et ne sont pas utilisables pour une demande précédente ou ultérieure. | 2 | +| **6.6.3** | Vérifiez qu'un mécanisme d'authentification out-of-band basé sur du code est protégé contre les attaques par force brute grâce au "rate limiting". Envisagez également d'utiliser un code avec au moins 64 bits d'entropie. | 2 | +| **6.6.4** | Vérifiez que, lorsque les notifications push sont utilisées pour l'authentification multifacteur, le "rate limiting" est appliqué afin d'empêcher les attaques de type « push bombing ». La concordance des numéros peut également atténuer ce risque. | 3 | + +## V6.7 Mécanisme d'authentification cryptographique + +Les mécanismes d'authentification cryptographique incluent les cartes à puce ou les clés FIDO. L'utilisateur doit connecter ou appairer le dispositif cryptographique à l'ordinateur pour finaliser l'authentification. Le serveur d'authentification envoie un nonce de défi au dispositif ou au logiciel cryptographique, qui calcule une réponse à partir d'une clé cryptographique stockée de manière sécurisée. Les exigences de cette section fournissent des conseils spécifiques à la mise en œuvre de ces mécanismes, les conseils sur les algorithmes cryptographiques étant traités dans le chapitre « Cryptographie ». + +Lorsque des clés partagées ou secrètes sont utilisées pour l'authentification cryptographique, elles doivent être stockées à l'aide des mêmes mécanismes que les autres secrets système, comme documenté dans la section « Gestion des secrets » du chapitre « Configuration ». + +Les exigences de cette section concernent principalement le chapitre [§ 5.1.7.2](https://pages.nist.gov/800-63-3/sp800-63b.html#sfcdv) du [Guide du NIST](https://pages.nist.gov/800-63-3/sp800-63b.html). + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **6.7.1** | Vérifiez que les certificats utilisés pour vérifier les assertions d’authentification cryptographique sont stockés de manière à les protéger contre toute modification. | 3 | +| **6.7.2** | Vérifiez que le nonce de défi a une longueur d'au moins 64 bits et qu'il est statistiquement unique ou unique sur toute la durée de vie du périphérique cryptographique. | 3 | + +## V6.8 Authentification avec un fournisseur d'identité + +Les fournisseurs d'identité (IdP) fournissent une identité fédérée aux utilisateurs. Ces derniers possèdent souvent plusieurs identités auprès de plusieurs IdP, comme une identité d'entreprise utilisant Azure AD, Okta, Ping Identity ou Google, ou une identité grand public utilisant Facebook, Twitter, Google ou WeChat, pour ne citer que quelques alternatives courantes. Cette liste ne constitue pas une recommandation pour ces entreprises ou services, mais simplement un encouragement aux développeurs à prendre en compte le fait que de nombreux utilisateurs possèdent de nombreuses identités établies. Les organisations devraient envisager l'intégration avec les identités utilisateur existantes, en fonction du profil de risque lié à la fiabilité de la vérification d'identité de l'IdP. Par exemple, il est peu probable qu'une organisation gouvernementale accepte une identité de réseau social comme identifiant pour des systèmes sensibles, car il est facile de créer de fausses identités ou des identités jetables, tandis qu'une entreprise de jeux mobiles pourrait avoir besoin de s'intégrer aux principales plateformes de réseaux sociaux pour développer sa base de joueurs actifs. + +L'utilisation sécurisée de fournisseurs d'identité externes nécessite une configuration et une vérification rigoureuses afin d'éviter l'usurpation d'identité ou la falsification d'assertions. Cette section décrit les exigences pour gérer ces risques. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **6.8.1** | Vérifiez que, si l'application prend en charge plusieurs fournisseurs d'identité (IdP), l'identité de l'utilisateur ne peut pas être usurpée via un autre fournisseur d'identité pris en charge (par exemple, en utilisant le même identifiant utilisateur). La mesure standard consisterait à ce que l'application enregistre et identifie l'utilisateur à l'aide d'une combinaison de l'ID du fournisseur d'identité (servant d'espace de noms) et de l'ID de l'utilisateur dans le fournisseur d'identité. | 2 | +| **6.8.2** | Vérifiez que la présence et l'intégrité des signatures numériques sur les assertions d'authentification (par exemple sur les assertions JWT ou SAML) sont toujours validées, en rejetant toutes les assertions non signées ou ayant des signatures non valides. | 2 | +| **6.8.3** | Vérifiez que les assertions SAML sont traitées de manière unique et utilisées une seule fois au cours de la période de validité pour éviter les attaques par rejeu. | 2 | +| **6.8.4** | Si une application utilise un fournisseur d'identité (IdP) distinct et attend une force, des méthodes ou une date d'authentification spécifiques pour des fonctions spécifiques, vérifiez que l'application les vérifie à l'aide des informations renvoyées par l'IdP. Par exemple, si OIDC est utilisé, cela peut être réalisé en validant les affirmations de jeton d'identification telles que « acr », « amr » et « auth_time » (le cas échéant). Si l'IdP ne fournit pas ces informations, l'application doit disposer d'une approche de secours documentée qui suppose que le mécanisme d'authentification de force minimale a été utilisé (par exemple, une authentification à facteur unique avec nom d'utilisateur et mot de passe). | 2 | + +## Références + +Pour plus d'informations, voir également : + +* [NIST SP 800-63 - Digital Identity Guidelines](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-3.pdf) +* [NIST SP 800-63B - Authentication and Lifecycle Management](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf) +* [NIST SP 800-63 FAQ](https://pages.nist.gov/800-63-FAQ/) +* [OWASP Web Security Testing Guide: Testing for Authentication](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/04-Authentication_Testing) +* [OWASP Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html) +* [OWASP Forgot Password Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html) +* [OWASP Choosing and Using Security Questions Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Choosing_and_Using_Security_Questions_Cheat_Sheet.html) +* [CISA Guidance on "Number Matching"](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implement-number-matching-in-mfa-applications-508c.pdf) +* [Details on the FIDO Alliance](https://fidoalliance.org/) diff --git a/5.0/fr/0x16-V7-Session-Management.md b/5.0/fr/0x16-V7-Session-Management.md new file mode 100644 index 0000000000..18e5450eed --- /dev/null +++ b/5.0/fr/0x16-V7-Session-Management.md @@ -0,0 +1,91 @@ +# V7 Gestion des sessions + +## Objectif de contrôle + +Les mécanismes de gestion de session permettent aux applications de corréler les interactions entre utilisateurs et appareils au fil du temps, même avec des protocoles de communication sans état (comme HTTP). Les applications modernes peuvent utiliser plusieurs jetons de session aux caractéristiques et objectifs distincts. Un système de gestion de session sécurisé empêche les attaquants d'obtenir, d'utiliser ou d'abuser de la session d'une victime. Les applications gérant des sessions doivent garantir le respect des exigences de gestion de session de haut niveau suivantes : + +* Les sessions sont uniques à chaque individu et ne peuvent être ni devinées ni partagées. +* Les sessions sont invalidées lorsqu'elles ne sont plus nécessaires et expirent pendant les périodes d'inactivité. + +De nombreuses exigences de ce chapitre concernent des contrôles sélectionnés de [NIST SP 800-63 Digital Identity Guidelines](https://pages.nist.gov/800-63-4/), en se concentrant sur les menaces courantes et les faiblesses d'authentification couramment exploitées. + +Notez que les exigences relatives aux détails d’implémentation spécifiques de certains mécanismes de gestion de session peuvent être trouvées ailleurs : + +* Les cookies HTTP sont un mécanisme courant de sécurisation des jetons de session. Les exigences de sécurité spécifiques aux cookies sont décrites dans le chapitre « Sécurité de l'interface web ». +* Les jetons autonomes sont fréquemment utilisés pour maintenir les sessions. Les exigences de sécurité spécifiques sont décrites dans le chapitre « Jetons autonomes ». + +## V7.1 Documentation sur la gestion des sessions + +Il n'existe pas de modèle unique convenant à toutes les applications. Il est donc impossible de définir des limites universelles et adaptées à tous les cas. Une analyse des risques, accompagnée de décisions de sécurité documentées relatives à la gestion des sessions, doit être réalisée avant la mise en œuvre et les tests. Cela garantit que le système de gestion des sessions est adapté aux exigences spécifiques de l'application. + +Que le mécanisme de session choisi soit avec ou sans état, l'analyse doit être complète et documentée afin de démontrer que la solution sélectionnée est capable de satisfaire à toutes les exigences de sécurité pertinentes. L'interaction avec les mécanismes d'authentification unique (SSO) utilisés doit également être prise en compte. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **7.1.1** | Vérifiez que le délai d'inactivité de la session de l'utilisateur et la durée de vie maximale absolue de la session sont documentés, sont appropriés en combinaison avec d'autres contrôles et que la documentation inclut une justification de tout écart par rapport aux exigences de réauthentification NIST SP 800-63B. | 2 | +| **7.1.2** | Vérifiez que la documentation définit le nombre de sessions simultanées (parallèles) autorisées pour un compte ainsi que les comportements et actions prévus à entreprendre lorsque le nombre maximal de sessions actives est atteint. | 2 | +| **7.1.3** | Vérifiez que tous les systèmes qui créent et gèrent des sessions utilisateur dans le cadre d'un écosystème de gestion des identités fédérées (tels que les systèmes SSO) sont documentés avec des contrôles pour coordonner la durée de vie des sessions, la résiliation et toute autre condition nécessitant une réauthentification. | 2 | + +## V7.2 Sécurité fondamentale de la gestion des sessions + +Cette section satisfait aux exigences essentielles des sessions sécurisées en vérifiant que les jetons de session sont générés et validés de manière sécurisée. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **7.2.1** | Vérifiez que l’application effectue toutes les vérifications des jetons de session à l’aide d’un service backend de confiance. | 1 | +| **7.2.2** | Vérifiez que l'application utilise des jetons autonomes ou de référence générés dynamiquement pour la gestion des sessions, c'est-à-dire sans utiliser de secrets et de clés d'API statiques. | 1 | +| **7.2.3** | Vérifiez que si des jetons par référence sont utilisés pour représenter les sessions utilisateur, ils sont uniques et générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et possèdent au moins 128 bits d'entropie. | 1 | +| **7.2.4** | Vérifiez que l’application génère un nouveau jeton de session lors de l’authentification de l’utilisateur, y compris la réauthentification, et met fin au jeton de session actuel. | 1 | + +## V7.3 Délai d'expiration de la session + +Les mécanismes de temporisation de session servent à minimiser les risques de détournement de session et autres formes d'abus. Les temporisations doivent respecter des décisions de sécurité documentées. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **7.3.1** | Vérifiez qu’il existe un délai d’inactivité tel que la réauthentification soit appliquée conformément à l’analyse des risques et aux décisions de sécurité documentées. | 2 | +| **7.3.2** | Vérifiez qu'il existe une durée de vie maximale absolue de la session de sorte que la réauthentification soit appliquée conformément à l'analyse des risques et aux décisions de sécurité documentées. | 2 | + +## V7.4 Fin de session + +La fin de session peut être gérée soit par l'application elle-même, soit par le fournisseur d'authentification unique (SSO) si ce dernier gère la session à sa place. Il peut être nécessaire de déterminer si le fournisseur d'authentification unique est concerné par les exigences de cette section, car certaines peuvent être contrôlées par lui. + +La fin de session doit entraîner une réauthentification et être effective dans l'ensemble de l'application, de la connexion fédérée (si présente) et de toutes les parties utilisatrices. + +Pour les mécanismes de session avec état, la terminaison implique généralement l'invalidation de la session sur le serveur principal. Dans le cas de jetons autonomes, des mesures supplémentaires sont nécessaires pour révoquer ou bloquer ces jetons, car ils pourraient sinon rester valides jusqu'à leur expiration. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **7.4.1** | Vérifiez que lorsque la fin de session est déclenchée (par exemple, déconnexion ou expiration), l'application interdit toute utilisation ultérieure de la session. Pour les jetons par référence ou les sessions avec état, cela implique l'invalidation des données de session au niveau du backend de l'application. Les applications utilisant des jetons autonomes nécessiteront une solution, comme la gestion d'une liste des jetons terminés, l'interdiction des jetons produits avant une date et une heure spécifique à chaque utilisateur ou la rotation d'une clé de signature spécifique à chaque utilisateur. | 1 | +| **7.4.2** | Vérifiez que l'application met fin à toutes les sessions actives lorsqu'un compte utilisateur est désactivé ou supprimé (par exemple, lorsqu'un employé quitte l'entreprise). | 1 | +| **7.4.3** | Vérifiez que l'application offre la possibilité de mettre fin à toutes les autres sessions actives après une modification ou une suppression réussie de tout facteur d'authentification (y compris la modification du mot de passe via une réinitialisation ou une récupération et, le cas échéant, une mise à jour des paramètres MFA). | 2 | +| **7.4.4** | Vérifiez que toutes les pages nécessitant une authentification disposent d’un accès facile et visible à la fonctionnalité de déconnexion. | 2 | +| **7.4.5** | Vérifiez que les administrateurs d’applications sont en mesure de mettre fin aux sessions actives pour un utilisateur individuel ou pour tous les utilisateurs. | 2 | + +## V7.5 Défenses contre les abus de session + +Cette section décrit les exigences visant à atténuer le risque posé par les sessions actives détournées ou utilisées abusivement par des vecteurs s'appuyant sur l'existence et les capacités des sessions utilisateur actives. Par exemple, l'exécution de contenu malveillant pour forcer un navigateur authentifié à effectuer une action en utilisant la session de la victime. + +Veuillez noter que les instructions spécifiques au niveau dans le chapitre « Authentification » doivent être prises en compte lors de l'examen des exigences de cette section. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **7.5.1** | Vérifiez que l'application nécessite une réauthentification complète avant d'autoriser les modifications des attributs de compte sensibles qui peuvent affecter l'authentification, tels que l'adresse e-mail, le numéro de téléphone, la configuration MFA ou d'autres informations utilisées dans la récupération de compte. | 2 | +| **7.5.2** | Vérifiez que les utilisateurs peuvent afficher et (après s'être authentifiés à nouveau avec au moins un facteur) terminer une ou toutes les sessions actuellement actives. | 2 | +| **7.5.3** | Vérifiez que l’application nécessite une authentification supplémentaire avec au moins un facteur ou une vérification secondaire avant d’effectuer des transactions ou des opérations hautement sensibles. | 3 | + +## V7.6 Réauthentification fédérée + +Cette section s'adresse aux développeurs de code de partie utilisatrice (RP) ou de fournisseur d'identité (IdP). Ces exigences découlent de la norme [NIST SP 800-63C](https://pages.nist.gov/800-63-4/sp800-63c.html) relative à la fédération et aux assertions. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **7.6.1** | Vérifiez que la durée de vie et la fin de la session entre les parties de confiance (RP) et les fournisseurs d'identité (IdP) se comportent comme documenté, en exigeant une réauthentification si nécessaire, par exemple lorsque le temps maximal entre les événements d'authentification IdP est atteint. | 2 | +| **7.6.2** | Vérifiez que la création d'une session nécessite soit le consentement de l'utilisateur, soit une action explicite, empêchant ainsi la création de nouvelles sessions d'application sans interaction de l'utilisateur. | 2 | + +## Références + +Pour plus d'informations, voir également : + +* [OWASP Web Security Testing Guide: Session Management Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/06-Session_Management_Testing) +* [OWASP Session Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html) diff --git a/5.0/fr/0x17-V8-Authorization.md b/5.0/fr/0x17-V8-Authorization.md new file mode 100644 index 0000000000..1b3d4630fe --- /dev/null +++ b/5.0/fr/0x17-V8-Authorization.md @@ -0,0 +1,56 @@ +# V8 Autorisation + +## Objectif de contrôle + +L'autorisation garantit que l'accès est accordé uniquement aux utilisateurs autorisés (utilisateurs, serveurs et autres clients). Pour appliquer le principe du moindre privilège (POLP), les applications vérifiées doivent répondre aux exigences générales suivantes : + +* Documenter les règles d'autorisation des documents, y compris les facteurs de prise de décision et les contextes environnementaux. +* Les consommateurs ne devraient avoir accès qu'aux ressources autorisées par leurs droits définis. + +## V8.1 Documentation d'autorisation + +Une documentation exhaustive des autorisations est essentielle pour garantir que les décisions de sécurité sont appliquées de manière cohérente, vérifiables et conformes aux politiques de l'organisation. Cela réduit le risque d'accès non autorisé en clarifiant les exigences de sécurité et en les rendant applicables aux développeurs, administrateurs et testeurs. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **8.1.1** | Vérifiez que la documentation d’autorisation définit des règles de restriction de l’accès au niveau de la fonction et aux données en fonction des autorisations du consommateur et des attributs des ressources. | 1 | +| **8.1.2** | Vérifiez que la documentation d'autorisation définit les règles de restriction d'accès au niveau des champs (lecture et écriture) en fonction des autorisations des consommateurs et des attributs des ressources. Notez que ces règles peuvent dépendre d'autres valeurs d'attributs de l'objet de données concerné, telles que l'état ou le statut. | 2 | +| **8.1.3** | Vérifiez que la documentation de l'application définit les attributs environnementaux et contextuels (y compris, mais sans s'y limiter, l'heure de la journée, l'emplacement de l'utilisateur, l'adresse IP ou l'appareil) qui sont utilisés dans l'application pour prendre des décisions de sécurité, y compris celles relatives à l'authentification et à l'autorisation. | 3 | +| **8.1.4** | Vérifier que la documentation d'authentification et d'autorisation définit l'utilisation des facteurs environnementaux et contextuels dans la prise de décision, en plus des autorisations au niveau des fonctions, des données et des champs. Cela doit inclure les attributs évalués, les seuils de risque et les actions entreprises (par exemple, autorisation, contestation, refus, renforcement de l'authentification). | 3 | + +## V8.2 Conception d'autorisation générale + +La mise en œuvre de contrôles d’autorisation granulaires aux niveaux de la fonction, des données et des champs garantis que les consommateurs ne pourront accéder qu’à ce qui leur a été explicitement accordé. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **8.2.1** | Vérifiez que l’application garantit que l’accès basé sur la fonction est limité aux consommateurs disposant d’autorisations explicites. | 1 | +| **8.2.2** | Vérifiez que l'application garantit que l'accès spécifique aux données est limité aux consommateurs disposant d'autorisations explicites sur des éléments de données spécifiques afin d'atténuer les références d'objet directes non sécurisées (IDOR) et les autorisations de niveau d'objet rompues (BOLA). | 1 | +| **8.2.3** | Vérifiez que l'application garantit que l'accès au niveau du champ est limité aux consommateurs disposant d'autorisations explicites sur des champs spécifiques afin d'atténuer les problèmes d'autorisation au niveau de la propriété d'objet (BOPLA). | 2 | +| **8.2.4** | Vérifiez que les contrôles de sécurité adaptatifs basés sur les attributs environnementaux et contextuels du consommateur (tels que l'heure, la localisation, l'adresse IP ou l'appareil) sont mis en œuvre pour les décisions d'authentification et d'autorisation, comme défini dans la documentation de l'application. Ces contrôles doivent être appliqués lorsque le consommateur tente de démarrer une nouvelle session et également pendant une session existante. | 3 | + +## V8.3 Autorisation par opération + +L'application immédiate des modifications d'autorisation dans le niveau approprié de l'architecture d'une application est essentielle pour empêcher les actions non autorisées, en particulier dans les environnements dynamiques. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **8.3.1** | Vérifier que l'application applique les règles d'autorisations au niveau de la couche service de confiance et ne s’appuie pas sur des contrôles qu’un consommateur non approuvé pourrait manipuler, comme JavaScript côté client. | 1 | +| **8.3.2** | Vérifiez que les modifications apportées aux valeurs sur lesquelles reposent les décisions d'autorisation sont appliquées immédiatement. Lorsque les modifications ne peuvent pas être appliquées immédiatement (par exemple, en s'appuyant sur des données de jetons autonomes), des contrôles d'atténuation doivent être mis en place pour alerter un consommateur lorsqu'il effectue une action alors qu'il n'est plus autorisé à le faire et annuler la modification. Notez que cette solution alternative ne limiterait pas les fuites d'informations. | 3 | +| **8.3.3** | Vérifiez que l'accès à un objet repose sur les autorisations du sujet d'origine (par exemple, le consommateur), et non sur celles d'un intermédiaire ou d'un service agissant en son nom. Par exemple, si un consommateur appelle un service web à l'aide d'un jeton d'authentification autonome, et que ce service demande ensuite des données à un autre service, ce dernier utilisera le jeton du consommateur, plutôt qu'un jeton inter-machine du premier service, pour prendre les décisions d'autorisation. | 3 | + +## V8.4 Autres considérations relatives à l'autorisation + +Des considérations supplémentaires concernant l’autorisation, en particulier pour les interfaces administratives et les environnements multi-tenants, aident à empêcher tout accès non autorisé. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **8.4.1** | Vérifiez que les applications multi-tenants utilisent des contrôles inter-tenants pour garantir que les opérations des consommateurs n'affecteront jamais les tenants avec lesquels ils ne sont pas autorisés à interagir. | 2 | +| **8.4.2** | Vérifiez que l'accès aux interfaces administratives intègre plusieurs couches de sécurité, notamment la vérification continue de l'identité du consommateur, l'évaluation de la posture de sécurité des appareils et l'analyse contextuelle des risques, garantissant que l'emplacement du réseau ou les endpoints approuvés ne sont pas les seuls facteurs d'autorisation, même s'ils peuvent réduire la probabilité d'accès non autorisé. | 3 | + +## Références + +Pour plus d'informations, voir également : + +* [OWASP Web Security Testing Guide: Authorization](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/05-Authorization_Testing) +* [OWASP Authorization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html) diff --git a/5.0/fr/0x18-V9-Self-contained-Tokens.md b/5.0/fr/0x18-V9-Self-contained-Tokens.md new file mode 100644 index 0000000000..e347810721 --- /dev/null +++ b/5.0/fr/0x18-V9-Self-contained-Tokens.md @@ -0,0 +1,36 @@ +# V9 Jetons autonomes + +## Objectif de contrôle + +Le concept de jeton autonome est mentionné dans la RFC 6749 OAuth 2.0 originale de 2012. Il désigne un jeton contenant des données ou des déclarations sur lesquelles un service récepteur s'appuie pour prendre des décisions de sécurité. Il convient de le distinguer d'un simple jeton contenant uniquement un identifiant, qu'un service récepteur utilise pour rechercher des données localement. Les exemples les plus courants de jetons autonomes sont les jetons Web JSON (JWT) et les assertions SAML. + +L'utilisation de jetons autonomes est devenue très répandue, même en dehors d'OAuth et d'OIDC. Parallèlement, la sécurité de ce mécanisme repose sur la capacité à valider l'intégrité du jeton et à garantir sa validité dans un contexte particulier. Ce processus présente de nombreux pièges, et ce chapitre détaille les mécanismes que les applications devraient mettre en place pour les éviter. + +## V9.1 Source et intégrité du jeton + +Cette section comprend des exigences visant à garantir que le jeton a été produit par une partie de confiance et n’a pas été falsifié. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **9.1.1** | Vérifiez que les jetons autonomes sont validés à l'aide de leur signature numérique ou MAC pour les protéger contre toute falsification avant d'accepter le contenu du jeton. | 1 | +| **9.1.2** | Vérifiez que seuls les algorithmes d'une liste d’autorisations peuvent être utilisés pour créer et vérifier des jetons autonomes, dans un contexte donné. La liste d'autorisation doit inclure les algorithmes autorisés, idéalement symétriques ou asymétriques, et ne doit pas inclure l'algorithme « Aucun ». Si les algorithmes symétriques et asymétriques doivent être pris en charge, des contrôles supplémentaires seront nécessaires pour éviter toute confusion de clés. | 1 | +| **9.1.3** | Vérifiez que les clés utilisées pour valider les jetons autonomes proviennent de sources préconfigurées et fiables pour l'émetteur du jeton, empêchant ainsi les attaquants de spécifier des sources et des clés non fiables. Pour les JWT et autres structures JWS, les en-têtes tels que « jku », « x5u » et « jwk » doivent être validés par rapport à une liste d'autorisation de sources fiables. | 1 | + +## V9.2 Contenu du jeton + +Avant de prendre des décisions de sécurité basées sur le contenu d'un jeton autonome, il est nécessaire de vérifier que le jeton a été présenté pendant sa période de validité et qu'il est destiné à être utilisé par le service destinataire et pour l'usage pour lequel il a été présenté. Cela permet d'éviter toute utilisation croisée non sécurisée entre différents services ou avec différents types de jetons provenant du même émetteur. + +Les exigences spécifiques pour OAuth et OIDC sont couvertes dans le chapitre dédié. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **9.2.1** | Vérifiez que, si une période de validité est indiquée dans les données du jeton, celui-ci et son contenu ne sont acceptés que si la date de vérification est comprise dans cette période. Par exemple, pour les JWT, les déclarations « nbf » et « exp » doivent être vérifiées. | 1 | +| **9.2.2** | Vérifiez que le service recevant un jeton valide le type de jeton et son utilisation avant d'en accepter le contenu. Par exemple, seuls les jetons d'accès peuvent être acceptés pour les décisions d'autorisation, et seuls les jetons d'identification peuvent être utilisés pour prouver l'authentification des utilisateurs. | 2 | +| **9.2.3** | Vérifiez que le service accepte uniquement les jetons destinés à être utilisés avec ce service (audience). Pour les JWT, cela peut être réalisé en validant la déclaration « aud » par rapport à une liste d'autorisation définie dans le service. | 2 | +| **9.2.4** | Si un émetteur de jetons utilise la même clé privée pour émettre des jetons destinés à différentes audiences, vérifiez que les jetons émis contiennent une restriction d'audience identifiant de manière unique les audiences visées. Cela empêchera la réutilisation d'un jeton avec une audience non prévue. Si l'identifiant d'audience est provisionné dynamiquement, l'émetteur de jetons doit valider ces audiences afin de garantir qu'elles n'entraînent pas d'usurpation d'identité. | 2 | + +## Références + +Pour plus d'informations, voir également : + +* [OWASP JSON Web Token Cheat Sheet for Java Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_for_Java_Cheat_Sheet.html) (mais il contient des orientations générales utiles) diff --git a/5.0/fr/0x19-V10-OAuth-and-OIDC.md b/5.0/fr/0x19-V10-OAuth-and-OIDC.md new file mode 100644 index 0000000000..51ad34fcce --- /dev/null +++ b/5.0/fr/0x19-V10-OAuth-and-OIDC.md @@ -0,0 +1,169 @@ +# V10 Oauth et OIDC + +## Objectif de contrôle + +OAuth2 (appelé OAuth dans ce chapitre) est un framework standard pour l'autorisation déléguée. Par exemple, grâce à OAuth, une application cliente peut accéder aux API (ressources serveur) au nom d'un utilisateur, à condition que ce dernier l'ait autorisée. + +OAuth n'est pas conçu pour l'authentification dOauth et OIDCes utilisateurs. Le Framework OpenID Connect (OIDC) étend OAuth en ajoutant une couche d'identité utilisateur. OIDC prend en charge des fonctionnalités telles que la standardisation des informations utilisateur, l'authentification unique (SSO) et la gestion des sessions. OIDC étant une extension d'OAuth, les exigences OAuth décrites dans ce chapitre s'appliquent également à OIDC. + +Les rôles suivants sont définis dans OAuth : + +* Le client OAuth est l'application qui tente d'accéder aux ressources du serveur (par exemple, en appelant une API à l'aide du jeton d'accès émis). Il s'agit souvent d'une application côté serveur. + * Un client confidentiel est un client capable de maintenir la confidentialité des informations d’identification qu’il utilise pour s’authentifier auprès du serveur d’autorisation. + * Un client public n'est pas en mesure de préserver la confidentialité des informations d'identification nécessaires à l'authentification auprès du serveur d'autorisation. Par conséquent, au lieu de s'authentifier (par exemple, à l'aide des paramètres « client_id » et « client_secret »), il s'identifie uniquement (à l'aide du paramètre « client_id »). +* Le serveur de ressources OAuth (RS) est l’API du serveur qui expose les ressources aux clients OAuth. +* Le serveur d'autorisation OAuth (AS) est une application serveur qui émet des jetons d'accès aux clients OAuth. Ces jetons permettent aux clients OAuth d'accéder aux ressources RS, soit pour le compte d'un utilisateur final, soit pour leur propre compte. L'AS est souvent une application distincte, mais (le cas échéant) il peut être intégré à un RS approprié. +* Le propriétaire de la ressource (RO) est l'utilisateur final qui autorise les clients OAuth à obtenir en son nom un accès limité aux ressources hébergées sur le serveur de ressources. Le propriétaire de la ressource consent à cette autorisation déléguée en interagissant avec le serveur d'autorisation. + +Les rôles suivants sont définis dans OIDC : + +* La partie de confiance (RP) est l'application cliente qui demande l'authentification de l'utilisateur final via le fournisseur OpenID. Elle joue le rôle de client OAuth. +* Le fournisseur OpenID (OP) est un AS OAuth capable d'authentifier l'utilisateur final et de fournir des déclarations OIDC à un RP. L'OP peut être le fournisseur d'identité (IdP), mais dans les scénarios fédérés, l'OP et le fournisseur d'identité (où l'utilisateur final s'authentifie) peuvent être des applications serveur différentes. + +OAuth et OIDC ont été initialement conçus pour les applications tierces. Aujourd'hui, ils sont également souvent utilisés par les applications propriétaires. Cependant, lorsqu'ils sont utilisés dans des scénarios propriétaires, comme l'authentification et la gestion de session, le protocole ajoute une certaine complexité, ce qui peut engendrer de nouveaux défis de sécurité. + +OAuth et OIDC peuvent être utilisés pour de nombreux types d'applications, mais l'accent d'ASVS et les exigences de ce chapitre portent sur les applications Web et les API. + +Étant donné que OAuth et OIDC peuvent être considérés comme une logique au-dessus des technologies Web, les exigences générales des autres chapitres s'appliquent toujours et ce chapitre ne peut pas être sorti de son contexte. + +Ce chapitre présente les meilleures pratiques actuelles pour OAuth2 et OIDC, conformément aux spécifications disponibles sur et . Même si les RFC sont considérées comme matures, elles sont fréquemment mises à jour. Il est donc important de se conformer aux dernières versions lors de l'application des exigences de ce chapitre. Consultez la section Références pour plus de détails. + +Compte tenu de la complexité du domaine, il est essentiel qu’une solution OAuth ou OIDC sécurisée utilise des serveurs d’autorisation standard bien connus du secteur et applique la configuration de sécurité recommandée. + +La terminologie utilisée dans ce chapitre est conforme aux RFC OAuth et aux spécifications OIDC ; mais notez que la terminologie OIDC n'est utilisée que pour les exigences spécifiques à OIDC, sinon, la terminologie OAuth est utilisée. + +Dans le contexte d'OAuth et d'OIDC, le terme « jeton » dans ce chapitre fait référence à : + +* Les jetons d'accès, qui ne peuvent être consommés que par le serveur de sécurité (RS) et qui peuvent être des jetons de référence validés par introspection ou des jetons autonomes validés à l'aide d'un matériau clé. +* Jetons de rafraîchissement, qui ne seront consommés que par le serveur d'autorisation qui a émis le jeton. +* Jetons d'identification OIDC, qui ne doivent être consommés que par le client qui a déclenché le flux d'autorisation. + +Les niveaux de risque pour certaines exigences de ce chapitre varient selon que le client est confidentiel ou public. L'utilisation d'une authentification client forte limitant de nombreux vecteurs d'attaque, certaines exigences peuvent être assouplies lors de l'utilisation d'un client confidentiel pour les applications L1. + +## V10.1 Sécurité générique OAuth et OIDC + +Cette section couvre les exigences architecturales génériques qui s’appliquent à toutes les applications utilisant OAuth ou OIDC. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **10.1.1** | Vérifiez que les jetons sont envoyés uniquement aux composants qui en ont absolument besoin. Par exemple, lors de l'utilisation d'un modèle backend-for-frontend pour les applications JavaScript basées sur un navigateur, les jetons d'accès et d'actualisation ne doivent être accessibles qu'au backend. | 2 | +| **10.1.2** | Vérifiez que le client n'accepte les valeurs du serveur d'autorisation (telles que le code d'autorisation ou le jeton d'identification) que si elles résultent d'un flux d'autorisation initié par la même session d'agent utilisateur et la même transaction. Cela nécessite que les secrets générés par le client, tels que la clé de preuve pour l'échange de codes (PKCE) « code_verifier », « state » ou le nonce OIDC, ne puissent être devinés, soient spécifiques à la transaction et soient liés de manière sécurisée au client et à la session d'agent utilisateur au cours de laquelle la transaction a été initiée. | 2 | + +## V10.2 Client OAuth + +Ces exigences détaillent les responsabilités des applications clientes OAuth. Le client peut être, par exemple, un serveur web backend (souvent utilisé comme backend pour frontend, BFF), une intégration de service backend ou une application monopage frontend (SPA, également appelée application basée sur un navigateur). + +En général, les clients backend sont considérés comme confidentiels et les clients frontend comme publics. Cependant, les applications natives exécutées sur l'appareil de l'utilisateur final peuvent être considérées comme confidentielles lorsqu'elles s'enregistrent dynamiquement des clients OAuth. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **10.2.1** | Vérifiez que, si le flux de code est utilisé, le client OAuth dispose d'une protection contre les attaques de falsification de requêtes basées sur le navigateur, communément appelées falsification de requêtes intersites (CSRF), qui déclenchent des demandes de jetons, soit en utilisant la fonctionnalité de clé de preuve pour l'échange de code (PKCE), soit en vérifiant le paramètre « state » envoyé dans la demande d'autorisation. | 2 | +| **10.2.2** | Vérifiez que, si le client OAuth peut interagir avec plusieurs serveurs d'autorisation, il dispose d'une protection contre les attaques par confusion. Par exemple, il peut exiger que le serveur d'autorisation renvoie la valeur du paramètre « iss » et la valide dans la réponse d'autorisation et la réponse du jeton. | 2 | +| **10.2.3** | Vérifiez que le client OAuth demande uniquement les portées requises (ou d’autres paramètres d’autorisation) dans les requêtes adressées au serveur d’autorisation. | 3 | + +## V10.3 Serveur de ressources OAuth + +Dans le contexte d'ASVS et de ce chapitre, le serveur de ressources est une API. Pour fournir un accès sécurisé, le serveur de ressources doit : + +* Valider le jeton d'accès, conformément au format du jeton et aux spécifications du protocole, par exemple, validation JWT ou introspection du jeton OAuth. +* S'il est valide, appliquer les décisions d'autorisation en fonction des informations du jeton d'accès et des autorisations accordées. Par exemple, le serveur de ressources doit vérifier que le client (agissant au nom du RO) est autorisé à accéder à la ressource demandée. + +Par conséquent, les exigences répertoriées ici sont spécifiques à OAuth ou OIDC et doivent être exécutées après la validation du jeton et avant d'effectuer l'autorisation basée sur les informations du jeton. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **10.3.1** | Vérifiez que le serveur de ressources accepte uniquement les jetons d'accès destinés à être utilisés avec ce service (audience). L'audience peut être incluse dans un jeton d'accès structuré (comme la déclaration « aud » dans JWT) ou vérifiée à l'aide du endpoint d'introspection de jeton. | 2 | +| **10.3.2** | Vérifiez que le serveur de ressources applique les décisions d'autorisation en fonction des déclarations du jeton d'accès définissant l'autorisation déléguée. Si des déclarations telles que « sub », « scope » et « authorization_details » sont présentes, elles doivent être prises en compte dans la décision. | 2 | +| **10.3.3** | Vérifiez que si une décision de contrôle d'accès nécessite l'identification d'un utilisateur unique à partir d'un jeton d'accès (JWT ou réponse d'introspection de jeton associé), le serveur de ressources identifie l'utilisateur à partir de déclarations non ré attribuables à d'autres utilisateurs. En général, cela implique l'utilisation d'une combinaison de déclarations « iss » et « sub ». | 2 | +| **10.3.4** | Si le serveur de ressources requiert une force d'authentification, des méthodes ou une date d'expiration spécifiques, vérifiez que le jeton d'accès présenté respecte ces contraintes. Par exemple, s'il est présent, utilisez les déclarations OIDC « acr », « amr » et « auth_time » respectivement. | 2 | +| **10.3.5** | Vérifiez que le serveur de ressources empêche l'utilisation de jetons d'accès volés ou la relecture de jetons d'accès (de parties non autorisées) en exigeant des jetons d'accès limités par l'expéditeur, soit Mutual TLS pour OAuth 2, soit OAuth 2 Demonstration of Proof of Possession (DPoP). | 3 | + +## V10.4 Serveur d'autorisation OAuth + +Ces exigences détaillent les responsabilités des serveurs d’autorisation OAuth, y compris les fournisseurs OpenID. + +Pour l'authentification client, la méthode « self_signed_tls_client_auth » est autorisée avec les prérequis requis par la [section 2.2](https://datatracker.ietf.org/doc/html/rfc8705#name-self-signed-certificate-mut) de la [RFC 8705](https://datatracker.ietf.org/doc/html/rfc8705). + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **10.4.1** | Vérifiez que le serveur d'autorisation valide les URI de redirection en fonction d'une liste d'autorisation spécifique au client d'URI préenregistrés à l'aide d'une comparaison de chaînes exacte. | 1 | +| **10.4.2** | Vérifiez que, si le serveur d'autorisation renvoie le code d'autorisation dans la réponse, celui-ci ne peut être utilisé qu'une seule fois pour une demande de jeton. Pour la deuxième demande valide avec un code d'autorisation déjà utilisé pour émettre un jeton d'accès, le serveur d'autorisation doit rejeter la demande de jeton et révoquer tous les jetons émis liés au code d'autorisation. | 1 | +| **10.4.3** | Vérifiez que le code d'autorisation est de courte durée. La durée de vie maximale peut atteindre 10 minutes pour les applications L1 et L2 et 1 minute pour les applications L3. | 1 | +| **10.4.4** | Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement l'utilisation des autorisations nécessaires à ce client. Notez que les autorisations « token » (flux implicite) et « password » (flux d'informations d'identification du propriétaire de la ressource) ne doivent plus être utilisées. | 1 | +| **10.4.5** | Vérifiez que le serveur d'autorisation atténue les attaques par rejeu de jetons d'actualisation pour les clients publics, de préférence en utilisant des jetons d'actualisation limités par l'expéditeur, par exemple des jetons DPoP (Demonstrating Proof of Possession) ou des jetons d'accès liés à un certificat utilisant le protocole TLS mutuel (mTLS). Pour les applications L1 et L2, la rotation des jetons d'actualisation peut être utilisée. Si cette rotation est utilisée, le serveur d'autorisation doit invalider le jeton d'actualisation après utilisation et révoquer tous les jetons d'actualisation de cette autorisation si un jeton d'actualisation déjà utilisé et invalidé est fourni. | 1 | +| **10.4.6** | Vérifiez que, si l'octroi de code est utilisé, le serveur d'autorisation atténue les attaques par interception de code en exigeant une clé de preuve pour l'échange de code (PKCE). Pour les demandes d'autorisation, le serveur d'autorisation doit exiger une valeur « code_challenge » valide et ne doit pas accepter une valeur « plain » pour « code_challenge_method ». Pour une demande de jeton, il doit exiger la validation du paramètre « code_verifier ». | 2 | +| **10.4.7** | Vérifiez que si le serveur d'autorisation prend en charge l'enregistrement dynamique des clients non authentifiés, il réduit le risque d'applications clientes malveillantes. Il doit valider les métadonnées clientes, telles que les URI enregistrés, garantir le consentement de l'utilisateur et l'avertir avant de traiter une demande d'autorisation avec une application cliente non approuvée. | 2 | +| **10.4.8** | Vérifiez que les jetons d’actualisation ont une expiration absolue, y compris si l’expiration du jeton d’actualisation glissant est appliquée. | 2 | +| **10.4.9** | Vérifiez que les jetons d'actualisation et les jetons d'accès de référence peuvent être révoqués par un utilisateur autorisé à l'aide de l'interface utilisateur du serveur d'autorisation, afin d'atténuer le risque de clients malveillants ou de jetons volés. | 2 | +| **10.4.10** | Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton. | 2 | +| **10.4.11** | Vérifiez que le client confidentiel est authentifié pour les demandes de back-channel client-serveur autorisé telles que les demandes de jeton, les demandes d'autorisation poussée (PAR) et les demandes de révocation de jeton. | 2 | +| **10.4.12** | Vérifiez que, pour un client donné, le serveur d'autorisation autorise uniquement la valeur « response_mode » dont ce client a besoin. Par exemple, en vérifiant cette valeur par rapport aux valeurs attendues ou en utilisant une requête d'autorisation poussée (PAR) ou une requête d'autorisation sécurisée par JWT (JAR). | 3 | +| **10.4.13** | Vérifiez que le type d'Autorisation « code » est toujours utilisé avec les demandes d'autorisation poussées (PAR). | 3 | +| **10.4.14** | Vérifiez que le serveur d'autorisation émet uniquement des jetons d'accès limités à l'expéditeur (preuve de possession), soit avec des jetons d'accès liés au certificat utilisant TLS mutuel (mTLS), soit avec des jetons d'accès liés au DPoP (démonstration de preuve de possession). | 3 | +| **10.4.15** | Vérifiez que, pour un client côté serveur (non exécuté sur l'appareil de l'utilisateur final), le serveur d'autorisation garantit que la valeur du paramètre « authorization_details » provient du backend client et que l'utilisateur ne l'a pas altérée. Par exemple, en exigeant l'utilisation d'une demande d'autorisation poussée (PAR) ou d'une demande d'autorisation sécurisée par JWT (JAR). | 3 | +| **10.4.16** | Vérifiez que le client est confidentiel et que le serveur d'autorisation requiert l'utilisation de méthodes d'authentification client fortes (basées sur la cryptographie à clé publique et résistantes aux attaques par relecture), telles que TLS mutuel ('tls_client_auth', 'self_signed_tls_client_auth') ou JWT à clé privée ('private_key_jwt'). | 3 | + +## V10.5 Client OIDC + +Étant donné que la partie utilisatrice d'OIDC agit en tant que client OAuth, les exigences de la section « Client OAuth » s'appliquent également. + +Notez que la section « Authentification avec un fournisseur d’identité » du chapitre « Authentification » contient également des exigences générales pertinentes. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **10.5.1** | Vérifiez que le client (en tant que partie utilisatrice) atténue les attaques par rejeu de jeton d'identification. Par exemple, en vous assurant que la valeur « nonce » du jeton d'identification correspond à la valeur « nonce » envoyée dans la demande d'authentification au fournisseur OpenID (appelée demande d'autorisation envoyée au serveur d'autorisation dans OAuth2). | 2 | +| **10.5.2** | Vérifiez que le client identifie de manière unique l'utilisateur à partir des déclarations de jeton d'identification, généralement la déclaration « sub », qui ne peut pas être réaffectée à d'autres utilisateurs (pour la portée d'un fournisseur d'identité). | 2 | +| **10.5.3** | Vérifiez que le client rejette les tentatives d'un serveur d'autorisation malveillant d'usurper l'identité d'un autre serveur d'autorisation via ses métadonnées. Le client doit rejeter les métadonnées du serveur d'autorisation si l'URL de l'émetteur figurant dans ces métadonnées ne correspond pas exactement à l'URL d'émetteur préconfigurée attendue par le client. | 2 | +| **10.5.4** | Vérifiez que le client valide que le jeton d'identification est destiné à être utilisé pour ce client (audience) en vérifiant que la déclaration « aud » du jeton est égale à la valeur « client_id » pour le client. | 2 | +| **10.5.5** | Vérifiez que, lors de l'utilisation de la déconnexion du back-channel OIDC, la partie utilisatrice atténue les risques de déni de service liés à la déconnexion forcée et à la confusion entre JWT dans le flux de déconnexion. Le client doit vérifier que le jeton de déconnexion est correctement typé avec la valeur « logout+jwt », qu'il contient la déclaration « event » avec le nom de membre correct et qu'il ne contient pas de déclaration « nonce ». Il est également recommandé d'utiliser une expiration courte (par exemple, 2 minutes). | 2 | + +## V10.6 Fournisseur OpenID + +Étant donné que les fournisseurs OpenID agissent comme des serveurs d'autorisation OAuth, les exigences de la section « Serveur d'autorisation OAuth » s'appliquent également. + +Notez que si vous utilisez le flux de jeton d'identification (et non le flux de code), aucun jeton d'accès n'est émis et de nombreuses exigences pour OAuth AS ne sont pas applicables. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **10.6.1** | Vérifiez que le fournisseur OpenID n'autorise que les valeurs « code », « ciba », « id_token » ou « id_token code » pour le mode de réponse. Notez que « code » est préférable à « id_token code » (flux hybride OIDC) et que « token » (tout flux implicite) ne doit pas être utilisé. | 2 | +| **10.6.2** | Vérifiez que le fournisseur OpenID atténue les risques de déni de service liés à la déconnexion forcée. Pour ce faire, obtenez une confirmation explicite de l'utilisateur final ou, le cas échéant, validez les paramètres de la requête de déconnexion (initiée par la partie utilisatrice), comme « id_token_hint ». | 2 | + +## V10.7 Gestion du consentement + +Ces exigences couvrent la vérification du consentement de l'utilisateur par le serveur d'autorisation. Sans vérification appropriée du consentement de l'utilisateur, un acteur malveillant peut obtenir des autorisations au nom de l'utilisateur par usurpation d'identité ou ingénierie sociale. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **10.7.1** | Vérifiez que le serveur d'autorisation garantit le consentement de l'utilisateur à chaque demande d'autorisation. Si l'identité du client ne peut être garantie, le serveur d'autorisation doit toujours demander explicitement le consentement de l'utilisateur. | 2 | +| **10.7.2** | Vérifiez que lorsque le serveur d'autorisation demande le consentement de l'utilisateur, il fournit des informations claires et suffisantes sur ce qui est consenti. Le cas échéant, ces informations doivent inclure la nature des autorisations demandées (généralement en fonction de la portée, du serveur de ressources et des détails d'autorisation RAR), l'identité de l'application autorisée et la durée de vie de ces autorisations. | 2 | +| **10.7.3** | Vérifiez que l’utilisateur peut consulter, modifier et révoquer les consentements qu’il a accordés via le serveur d’autorisation. | 2 | + +## Références + +Pour plus d'informations, voir également : + +* [oauth.net](https://oauth.net/) +* [OWASP OAuth 2.0 Protocol Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/OAuth2_Cheat_Sheet.html) + +Pour les exigences liées à OAuth dans ASVS, les RFC publiées et à l'état de projet suivantes sont utilisées : + +* [RFC6749 The OAuth 2.0 Authorization Framework](https://datatracker.ietf.org/doc/html/rfc6749) +* [RFC6750 The OAuth 2.0 Authorization Framework: Bearer Token Usage](https://datatracker.ietf.org/doc/html/rfc6750) +* [RFC6819 OAuth 2.0 Threat Model and Security Considerations](https://datatracker.ietf.org/doc/html/rfc6819) +* [RFC7636 Proof Key for Code Exchange by OAuth Public Clients](https://datatracker.ietf.org/doc/html/rfc7636) +* [RFC7591 OAuth 2.0 Dynamic Client Registration Protocol](https://datatracker.ietf.org/doc/html/rfc7591) +* [RFC8628 OAuth 2.0 Device Authorization Grant](https://datatracker.ietf.org/doc/html/rfc8628) +* [RFC8707 Resource Indicators for OAuth 2.0](https://datatracker.ietf.org/doc/html/rfc8707) +* [RFC9068 JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens](https://datatracker.ietf.org/doc/html/rfc9068) +* [RFC9126 OAuth 2.0 Pushed Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9126) +* [RFC9207 OAuth 2.0 Authorization Server Issuer Identification](https://datatracker.ietf.org/doc/html/rfc9207) +* [RFC9396 OAuth 2.0 Rich Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9396) +* [RFC9449 OAuth 2.0 Demonstrating Proof of Possession (DPoP)](https://datatracker.ietf.org/doc/html/rfc9449) +* [RFC9700 Best Current Practice for OAuth 2.0 Security](https://datatracker.ietf.org/doc/html/rfc9700) +* [draft OAuth 2.0 for Browser-Based Applications](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-browser-based-apps) +* [draft The OAuth 2.1 Authorization Framework](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-12) + +Pour plus d'informations sur OpenID Connect, veuillez consulter : + +* [OpenID Connect Core 1.0](https://openid.net/specs/openid-connect-core-1_0.html) +* [FAPI 2.0 Security Profile](https://openid.net/specs/fapi-security-profile-2_0-final.html) diff --git a/5.0/fr/0x20-V11-Cryptography.md b/5.0/fr/0x20-V11-Cryptography.md new file mode 100644 index 0000000000..033da4784a --- /dev/null +++ b/5.0/fr/0x20-V11-Cryptography.md @@ -0,0 +1,107 @@ +# V11 Cryptographie + +## Objectif de contrôle + +L'objectif de ce chapitre est de définir les meilleures pratiques pour l'utilisation générale de la cryptographie, ainsi que d'inculquer une compréhension fondamentale des principes cryptographiques et d'encourager une évolution vers des approches plus résilientes et modernes. Il encourage les actions suivantes : + +* Mise en œuvre de systèmes cryptographiques robustes, sécurisés, adaptables à l'évolution des menaces et pérennes. +* Utilisation de mécanismes cryptographiques sécurisés et conformes aux meilleures pratiques du secteur. +* Maintien d'un système de gestion des clés cryptographiques sécurisé, avec des contrôles d'accès et des audits appropriés. +* Évaluation régulière du paysage cryptographique pour identifier les nouveaux risques et adapter les algorithmes en conséquence. +* Identification et gestion des cas d'utilisation cryptographiques tout au long du cycle de vie de l'application afin de garantir la prise en compte et la sécurité de tous les actifs cryptographiques. + +Outre les principes généraux et les bonnes pratiques, ce document fournit également des informations techniques plus détaillées sur les exigences de l'annexe V – Normes de cryptographie. Cela inclut les algorithmes et les modes considérés comme « approuvés » aux fins des exigences de ce chapitre. + +Les exigences qui utilisent la cryptographie pour résoudre un problème distinct, comme la gestion des secrets ou la sécurité des communications, figureront dans différentes parties de la norme. + +## V11.1 Inventaire et documentation cryptographiques + +Les applications doivent être conçues avec une architecture cryptographique robuste afin de protéger les données selon leur classification. Chiffrer tout est un gaspillage ; ne rien chiffrer est une négligence juridique. Un équilibre doit être trouvé, généralement lors de la conception architecturale ou de haut niveau, des sprints de conception ou des pics d'architecture. Concevoir la cryptographie au fur et à mesure ou la moderniser coûtera inévitablement beaucoup plus cher à mettre en œuvre de manière sécurisée que de l'intégrer dès le départ. + +Il est important de veiller à ce que tous les actifs cryptographiques soient régulièrement découverts, inventoriés et évalués. Veuillez consulter l'annexe pour plus d'informations sur la procédure à suivre. + +Il est également crucial de pérenniser les systèmes cryptographiques face à l'essor futur de l'informatique quantique. La cryptographie post-quantique (PQC) désigne les algorithmes cryptographiques conçus pour résister aux attaques des ordinateurs quantiques, qui sont susceptibles de casser des algorithmes largement utilisés tels que RSA et la cryptographie à courbe elliptique (ECC). + +Veuillez consulter l'annexe pour obtenir des conseils actualisés sur les primitives et les normes PQC approuvées. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **11.1.1** | Vérifiez qu’il existe une politique documentée pour la gestion des clés cryptographiques et un cycle de vie des clés cryptographiques qui suit une norme de gestion des clés telle que NIST SP 800-57. Cela devrait inclure la garantie que les clés ne sont pas sur-partagées (par exemple, avec plus de deux entités pour les secrets partagés et plus d’une entité pour les clés privées). | 2 | +| **11.1.2** | Vérifiez qu'un inventaire cryptographique est réalisé, maintenu et régulièrement mis à jour, et qu'il inclut toutes les clés, algorithmes et certificats cryptographiques utilisés par l'application. Il doit également documenter les emplacements du système où les clés peuvent ou non être utilisées, ainsi que les types de données qui peuvent ou non être protégées par ces clés. | 2 | +| **11.1.3** | Vérifiez que les mécanismes de découverte cryptographique sont utilisés pour identifier toutes les instances de cryptographie dans le système, y compris les opérations de chiffrement, de hachage et de signature. | 3 | +| **11.1.4** | Vérifier la tenue d'un inventaire cryptographique. Celui-ci doit inclure un plan documenté décrivant la migration vers de nouvelles normes cryptographiques, telles que la cryptographie post-quantique, afin de réagir aux menaces futures. | 3 | + +## V11.2 Mise en œuvre sécurisée de la cryptographie + +Cette section définit les exigences relatives à la sélection, à la mise en œuvre et à la gestion continue des algorithmes cryptographiques de base d'une application. L'objectif est de garantir que seules des primitives cryptographiques robustes et reconnues par l'industrie soient déployées, conformément aux normes en vigueur (par exemple, NIST, ISO/IEC) et aux meilleures pratiques. Les organisations doivent s'assurer que chaque composant cryptographique est sélectionné sur la base de preuves validées par des pairs et de tests de sécurité pratiques. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **11.2.1** | Vérifiez que les implémentations validées par l’industrie (y compris les bibliothèques et les implémentations accélérées par le matériel) sont utilisées pour les opérations cryptographiques. | 2 | +| **11.2.2** | Vérifiez que l'application est conçue avec une agilité cryptographique, de sorte que les nombres aléatoires, le chiffrement authentifié, le MAC ou les algorithmes de hachage, les longueurs de clés, les tours, les chiffrements et les modes puissent être reconfigurés, mis à niveau ou échangés à tout moment, afin de se protéger contre les failles cryptographiques. De même, il doit être possible de remplacer les clés et les mots de passe, ainsi que de rechiffrer les données. Cela permettra des mises à niveau transparentes vers la cryptographie post-quantique (PQC), une fois que des implémentations hautement sécurisées de schémas ou de normes PQC approuvés seront largement disponibles. | 2 | +| **11.2.3** | Vérifiez que toutes les primitives cryptographiques utilisent un minimum de 128 bits de sécurité en fonction de l'algorithme, de la taille de la clé et de la configuration. Par exemple, une clé ECC de 256 bits offre environ 128 bits de sécurité, tandis que RSA nécessite une clé de 3072 bits pour atteindre 128 bits de sécurité. | 2 | +| **11.2.4** | Vérifiez que toutes les opérations cryptographiques sont à temps constant, sans opérations de « court-circuit » dans les comparaisons, les calculs ou les retours, pour éviter toute fuite d'informations. | 3 | +| **11.2.5** | Vérifiez que tous les modules cryptographiques échouent en toute sécurité et que les erreurs sont gérées de manière à ne pas permettre de vulnérabilités, telles que les attaques Padding Oracle. | 3 | + +## V11.3 Algorithmes de chiffrement + +Les algorithmes de chiffrement authentifiés basés sur AES et CHACHA20 constituent l’épine dorsale de la pratique cryptographique moderne. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **11.3.1** | Vérifiez que les modes de bloc non sécurisés (par exemple, ECB) et les schémas de remplissage faibles (par exemple, PKCS#1 v1.5) ne sont pas utilisés. | 1 | +| **11.3.2** | Vérifiez que seuls les chiffrements et modes approuvés tels que AES avec GCM sont utilisés. | 1 | +| **11.3.3** | Vérifiez que les données chiffrées sont protégées contre toute modification non autorisée, de préférence en utilisant une méthode de chiffrement authentifiée approuvée ou en combinant une méthode de chiffrement approuvée avec un algorithme MAC approuvé. | 2 | +| **11.3.4** | Vérifiez que les nonces, les vecteurs d'initialisation et autres nombres à usage unique ne sont pas utilisés pour plus d'une paire clé de chiffrement/élément de données. La méthode de génération doit être adaptée à l'algorithme utilisé. | 3 | +| **11.3.5** | Vérifiez que toute combinaison d'un algorithme de chiffrement et d'un algorithme MAC fonctionne en mode chiffrement puis MAC. | 3 | + +## V11.4 Hachage et fonctions basées sur le hachage + +Les hachages cryptographiques sont utilisés dans une grande variété de protocoles cryptographiques, tels que les signatures numériques, HMAC, les fonctions de dérivation de clés (KDF), la génération de bits aléatoires et le stockage de mots de passe. La sécurité d'un système cryptographique dépend des fonctions de hachage sous-jacentes utilisées. Cette section décrit les exigences relatives à l'utilisation de fonctions de hachage sécurisées dans les opérations cryptographiques. + +Pour le stockage des mots de passe, ainsi que pour l'annexe sur la cryptographie, la [OWASP Password Storage Cheatsheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#password-hashing-algorithms) fournira également un contexte et des conseils utiles. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **11.4.1** | Vérifiez que seules les fonctions de hachage approuvées sont utilisées pour les cas d'utilisation cryptographiques généraux, notamment les signatures numériques, HMAC, KDF et la génération de bits aléatoires. Les fonctions de hachage non autorisées, telles que MD5, ne doivent pas être utilisées à des fins cryptographiques. | 1 | +| **11.4.2** | Vérifiez que les mots de passe sont stockés à l'aide d'une fonction de dérivation de clés approuvée et gourmande en ressources de calcul (également appelée « fonction de hachage de mots de passe »), dont les paramètres sont configurés conformément aux directives en vigueur. Ces paramètres doivent équilibrer sécurité et performances afin de rendre les attaques par force brute suffisamment difficiles pour le niveau de sécurité requis. | 2 | +| **11.4.3** | Vérifiez que les fonctions de hachage utilisées dans les signatures numériques, dans le cadre de l'authentification ou de l'intégrité des données, sont résistantes aux collisions et possèdent des longueurs de bits appropriées. Si la résistance aux collisions est requise, la longueur de sortie doit être d'au moins 256 bits. Si seule la résistance aux attaques de seconde pré-image est requise, la longueur de sortie doit être d'au moins 128 bits. | 2 | +| **11.4.4** | Vérifiez que l'application utilise des fonctions de dérivation de clés approuvées avec des paramètres d'extension de clés lors de la dérivation de clés secrètes à partir de mots de passe. Les paramètres utilisés doivent concilier sécurité et performances afin d'empêcher les attaques par force brute de compromettre la clé cryptographique obtenue. | 2 | + +## V11.5 Valeurs aléatoires + +La génération de nombres pseudo-aléatoires cryptographiquement sécurisée (CSPRNG) est extrêmement difficile à mettre en œuvre. En général, les bonnes sources d'entropie d'un système s'épuisent rapidement si elles sont surexploitées, tandis que des sources moins aléatoires peuvent conduire à des clés et des secrets prévisibles. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **11.5.1** | Vérifiez que tous les nombres et chaînes aléatoires destinés à être non devinables doivent être générés à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG) et posséder au moins 128 bits d'entropie. Notez que les UUID ne respectent pas cette condition. | 2 | +| **11.5.2** | Vérifiez que le mécanisme de génération de nombres aléatoires utilisé est conçu pour fonctionner en toute sécurité, même en cas de forte demande. | 3 | + +## V11.6 Cryptographie à clé publique + +La cryptographie à clé publique sera utilisée lorsqu'il est impossible ou non souhaitable de partager une clé secrète entre plusieurs parties. + +Dans ce contexte, des mécanismes d'échange de clés approuvés, tels que Diffie-Hellman et Elliptic Curve Diffie-Hellman (ECDH), sont nécessaires pour garantir la sécurité du cryptosystème face aux menaces modernes. Le chapitre « Communication sécurisée » décrit les exigences pour TLS. Les exigences de cette section sont donc destinées aux situations où la cryptographie à clé publique est utilisée dans des cas d'utilisation autres que TLS. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **11.6.1** | Vérifier que seuls des algorithmes cryptographiques et des modes opératoires approuvés sont utilisés pour la génération et l'amorçage des clés, ainsi que pour la génération et la vérification des signatures numériques. Les algorithmes de génération de clés ne doivent pas générer de clés non sécurisées et vulnérables aux attaques connues, par exemple les clés RSA vulnérables à la factorisation de Fermat. | 2 | +| **11.6.2** | Vérifiez que des algorithmes cryptographiques approuvés sont utilisés pour l'échange de clés (tels que Diffie-Hellman), en veillant à ce que les mécanismes d'échange de clés utilisent des paramètres sécurisés. Cela permettra d'éviter les attaques contre le processus d'établissement des clés, susceptibles de conduire à des attaques de type « adversaire du milieu » ou à des failles cryptographiques. | 3 | + +## V11.7 Cryptographie des données en cours d'utilisation + +La protection des données pendant leur traitement est "le nec plus ultra". Des techniques telles que le chiffrement intégral de la mémoire, le chiffrement des données en transit et s'assurer que le les données sont chiffrés le plus tôt possible après utilisation. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **11.7.1** | Vérifiez que le chiffrement complet de la mémoire est utilisé pour protéger les données sensibles pendant leur utilisation, empêchant ainsi l'accès par des utilisateurs ou des processus non autorisés. | 3 | +| **11.7.2** | Vérifiez que la minimisation des données garantit que la quantité minimale de données est exposée pendant le traitement et assurez-vous que les données sont chiffrées immédiatement après utilisation ou dès que possible. | 3 | + +## Références + +Pour plus d'informations, voir également : + +* [OWASP Web Security Testing Guide: Testing for Weak Cryptography](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography) +* [OWASP Cryptographic Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html) +* [FIPS 140-3](https://csrc.nist.gov/pubs/fips/140-3/final) +* [NIST SP 800-57](https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final) diff --git a/5.0/fr/0x21-V12-Secure-Communication.md b/5.0/fr/0x21-V12-Secure-Communication.md new file mode 100644 index 0000000000..a2555e4ea7 --- /dev/null +++ b/5.0/fr/0x21-V12-Secure-Communication.md @@ -0,0 +1,57 @@ +# V12 Communication sécurisée + +## Objectif de contrôle + +Ce chapitre comprend des exigences relatives aux mécanismes spécifiques qui doivent être mis en place pour protéger les données en transit, à la fois entre un client utilisateur final et un service backend, ainsi qu'entre les services internes et backend. + +Les concepts généraux promus par ce chapitre sont les suivants + +* S'assurer que les communications sont chiffrées à l'extérieur et, idéalement, à l'intérieur. +* Configurer les mécanismes de chiffrement en utilisant les dernières recommandations, y compris les algorithmes et les chiffrements préférés. +* S'assurer que les communications ne sont pas interceptées par des parties non autorisées à l'aide de certificats signés. + +Outre les principes généraux et les meilleures pratiques, l'ASVS fournit également des informations techniques plus approfondies sur la puissance cryptographique dans l'annexe C - Normes de cryptographie. + +## V12.1 Conseils généraux de sécurité TLS + +Cette section fournit des conseils initiaux sur la sécurisation des communications TLS. Des outils à jour doivent être utilisés pour vérifier régulièrement la configuration TLS. + +Bien que l'utilisation de certificats TLS génériques ne soit pas intrinsèquement dangereuse, la compromission d'un certificat déployé dans tous les environnements (par exemple, production, préproduction, développement et test) peut compromettre la sécurité des applications qui l'utilisent. Une protection et une gestion appropriées, ainsi que l'utilisation de certificats TLS distincts dans différents environnements, sont recommandées si possible. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **12.1.1** | Vérifiez que seules les dernières versions recommandées du protocole TLS sont activées, telles que TLS 1.2 et TLS 1.3. La dernière version du protocole TLS doit être privilégiée. | 1 | +| **12.1.2** | Vérifiez que seules les suites de chiffrement recommandées sont activées, les suites de chiffrement les plus puissantes étant définies comme préférées. Les applications L3 doivent uniquement prendre en charge les suites de chiffrement assurant la confidentialité persistante (forward secrecy). | 2 | +| **12.1.3** | Vérifiez que l’application valide que les certificats clients mTLS sont approuvés avant d’utiliser l’identité du certificat pour l’authentification ou l’autorisation. | 2 | +| **12.1.4** | Vérifiez que la révocation de certification appropriée, telle que l'agrafage du protocole OCSP (Online Certificate Status Protocol), est activée et configurée. | 3 | +| **12.1.5** | Vérifiez que Encrypted Client Hello (ECH) est activé dans les paramètres TLS de l'application pour empêcher l'exposition de métadonnées sensibles, telles que l'indication du nom du serveur (SNI), pendant les processus de négociation TLS. | 3 | + +## V12.2 Communication HTTPS avec des services externes + +Assurez-vous que tout le trafic HTTP vers les services externes exposés par l'application est envoyé chiffré, avec des certificats de confiance publique. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **12.2.1** | Vérifiez que TLS est utilisé pour toute connectivité entre un client et des services externes basés sur HTTP, et ne recourt pas à des communications non sécurisées ou non chiffrées. | 1 | +| **12.2.2** | Vérifiez que les services externes utilisent des certificats TLS publiquement approuvés. | 1 | + +## V12.3 Sécurité des communications entre services généraux + +Les communications serveur (internes et externes) ne se limitent pas au protocole HTTP. Les connexions vers et depuis d'autres systèmes doivent également être sécurisées, idéalement via TLS. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **12.3.1** | Vérifiez qu'un protocole chiffré tel que TLS est utilisé pour toutes les connexions entrantes et sortantes vers et depuis l'application, y compris les systèmes de surveillance, les outils de gestion, l'accès à distance et SSH, les intergiciels, les bases de données, les mainframes, les systèmes partenaires ou les API externes. Le serveur ne doit pas recourir à des protocoles non sécurisés ou non chiffrés. | 2 | +| **12.3.2** | Vérifiez que les clients TLS valident les certificats reçus avant de communiquer avec un serveur TLS. | 2 | +| **12.3.3** | Vérifiez que TLS ou un autre mécanisme de chiffrement de transport approprié est utilisé pour toute connectivité entre les services internes basés sur HTTP au sein de l'application et ne se replie pas vers des communications non sécurisées ou non chiffrées. | 2 | +| **12.3.4** | Vérifiez que les connexions TLS entre les services internes utilisent des certificats de confiance. Lorsque des certificats générés en interne ou auto-signés sont utilisés, le service consommateur doit être configuré pour n'approuver que des autorités de certification internes spécifiques et des certificats auto-signés spécifiques. | 2 | +| **12.3.5** | Vérifiez que les services communiquant en interne au sein d'un système (communications intra-services) utilisent une authentification forte pour garantir la vérification de chaque endpoint. Des méthodes d'authentification forte, telles que l'authentification client TLS, doivent être utilisées pour garantir l'identité, en utilisant une infrastructure à clé publique et des mécanismes résistants aux attaques par rejeu. Pour les architectures de microservices, envisagez d'utiliser un maillage de services pour simplifier la gestion des certificats et renforcer la sécurité. | 3 | + +## Références + +Pour plus d'informations, voir également : + +* [OWASP - Transport Layer Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html) +* [Mozilla's Server Side TLS configuration guide](https://wiki.mozilla.org/Security/Server_Side_TLS) +* [Mozilla's tool to generate known good TLS configurations](https://ssl-config.mozilla.org/). +* [O-Saft - OWASP Project to validate TLS configuration](https://owasp.org/www-project-o-saft/) diff --git a/5.0/fr/0x22-V13-Configuration.md b/5.0/fr/0x22-V13-Configuration.md new file mode 100644 index 0000000000..7ff625280d --- /dev/null +++ b/5.0/fr/0x22-V13-Configuration.md @@ -0,0 +1,68 @@ +# V13 Configuration + +## Objectif de contrôle + +La configuration par défaut de l'application doit être sécurisée pour une utilisation sur Internet. + +Ce chapitre fournit des conseils sur les différentes configurations nécessaires pour y parvenir, y compris celles appliquées pendant le développement, la construction et le déploiement. + +Les sujets abordés incluent la prévention des fuites de données, la gestion sécurisée des communications entre les composants et la protection des secrets. + +## V13.1 Documentation de configuration + +Cette section décrit les exigences de documentation relatives à la communication de l'application avec les services internes et externes, ainsi que les techniques permettant d'éviter toute perte de disponibilité due à l'inaccessibilité des services. Elle aborde également la documentation relative aux secrets. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **13.1.1** | Vérifiez que tous les besoins de communication de l'application sont documentés. Cela doit inclure les services externes dont l'application dépend et les cas où un utilisateur final pourrait fournir un emplacement externe auquel l'application se connectera. | 2 | +| **13.1.2** | Vérifiez que pour chaque service utilisé par l'application, la documentation définit le nombre maximal de connexions simultanées (par exemple, les limites du pool de connexions) et le comportement de l'application lorsque cette limite est atteinte, y compris les mécanismes de secours ou de récupération, pour éviter les conditions de déni de service. | 3 | +| **13.1.3** | Vérifiez que la documentation de l'application définit des stratégies de gestion des ressources pour chaque système ou service externe utilisé (par exemple, bases de données, descripteurs de fichiers, threads, connexions HTTP). Cela doit inclure les procédures de libération des ressources, les paramètres de délai d'expiration, la gestion des échecs et l'implémentation de la logique de nouvelle tentative, en spécifiant les limites de nouvelle tentative, les délais et les algorithmes de retour arrière. Pour les opérations de requête-réponse HTTP synchrones, la documentation doit imposer des délais d'expiration courts et soit désactiver les nouvelles tentatives, soit les limiter strictement afin d'éviter les retards en cascade et l'épuisement des ressources. | 3 | +| **13.1.4** | Vérifiez que la documentation de l'application définit les secrets essentiels à la sécurité de l'application et un calendrier de rotation de ceux-ci, en fonction du modèle de menace et des exigences commerciales de l'organisation. | 3 | + +## V13.2 Configuration de la communication backend + +Les applications interagissent avec plusieurs services, notamment des API, des bases de données ou d'autres composants. Ceux-ci peuvent être considérés comme internes à l'application, mais non inclus dans les mécanismes de contrôle d'accès standard de l'application, ou être entièrement externes. Dans les deux cas, il est nécessaire de configurer l'application pour interagir en toute sécurité avec ces composants et, si nécessaire, de protéger cette configuration. + +Remarque : le chapitre « Communication sécurisée » fournit des conseils pour le chiffrement en transit. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **13.2.1** | Vérifiez que les communications entre les composants de l'application backend qui ne prennent pas en charge le mécanisme de session utilisateur standard de l'application, notamment les API, les intergiciels et les couches de données, sont authentifiées. L'authentification doit utiliser des comptes de service individuels, des jetons à court terme ou une authentification par certificat, et non des identifiants immuables tels que des mots de passe, des clés API ou des comptes partagés avec accès privilégié. | 2 | +| **13.2.2** | Vérifiez que les communications entre les composants de l'application backend, y compris les services locaux ou du système d'exploitation, les API, les intergiciels et les couches de données, sont effectuées avec des comptes dotés des privilèges les moins nécessaires. | 2 | +| **13.2.3** | Vérifiez que si des informations d’identification doivent être utilisées pour l’authentification du service, les informations d’identification utilisées par le consommateur ne sont pas des informations d’identification par défaut (par exemple, root/root ou admin/admin). | 2 | +| **13.2.4** | Vérifiez qu'une liste d’autorisations est utilisée pour définir les ressources ou systèmes externes avec lesquels l'application est autorisée à communiquer (par exemple, pour les requêtes sortantes, les chargements de données ou l'accès aux fichiers). Cette liste d'autorisation peut être implémentée au niveau de la couche applicative, du serveur web, du pare-feu ou d'une combinaison de différentes couches. | 2 | +| **13.2.5** | Vérifiez que le serveur Web ou d’application est configuré avec une liste autorisée de ressources ou de systèmes vers lesquels le serveur peut envoyer des requêtes ou charger des données ou des fichiers. | 2 | +| **13.2.6** | Vérifiez que lorsque l'application se connecte à des services distincts, elle suit la configuration documentée pour chaque connexion, comme le nombre maximal de connexions parallèles, le comportement lorsque le nombre maximal de connexions autorisées est atteint, les délais d'expiration de connexion et les stratégies de nouvelle tentative. | 3 | + +## V13.3 Gestion des secrets + +La gestion des secrets est une tâche de configuration essentielle pour garantir la protection des données utilisées dans l'application. Les exigences spécifiques en matière de cryptographie sont décrites dans le chapitre « Cryptographie », mais cette section se concentre sur les aspects de gestion et de traitement des secrets. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **13.3.1** | Vérifiez qu'une solution de gestion des secrets, telle qu'un coffre-fort de clés, est utilisée pour créer, stocker, contrôler l'accès et détruire en toute sécurité les secrets backend. Ceux-ci peuvent inclure des mots de passe, du matériel de clé, des intégrations avec des bases de données et des systèmes tiers, des clés et des graines pour des jetons temporels, d'autres secrets internes et des clés API. Les secrets ne doivent pas être inclus dans le code source de l'application ni dans les artefacts de build. Pour une application L3, cela doit impliquer une solution matérielle telle qu'un HSM. | 2 | +| **13.3.2** | Vérifiez que l’accès aux ressources secrètes respecte le principe du moindre privilège. | 2 | +| **13.3.3** | Vérifiez que toutes les opérations cryptographiques sont effectuées à l'aide d'un module de sécurité isolé (tel qu'un coffre-fort ou un module de sécurité matériel) pour gérer et protéger en toute sécurité le matériel clé contre toute exposition en dehors du module de sécurité. | 3 | +| **13.3.4** | Vérifiez que les secrets sont configurés pour expirer et être renouvelés en fonction de la documentation de l'application. | 3 | + +## V13.4 Fuite d'informations involontaire + +Les configurations de production doivent être renforcées afin d'éviter la divulgation de données inutiles. Nombre de ces problèmes sont rarement considérés comme des risques importants, mais sont souvent associés à d'autres vulnérabilités. Si ces problèmes ne sont pas présents par défaut, la barre est plus haute pour les attaques contre une application. + +Par exemple, masquer la version des composants côté serveur n'élimine pas la nécessité de corriger tous les composants, et désactiver la liste des dossiers ne supprime pas la nécessité d'utiliser des contrôles d'autorisation ou de garder les fichiers loin du dossier public, mais cela place la barre plus haut. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **13.4.1** | Vérifiez que l'application est déployée soit sans aucune métadonnée de contrôle de source, y compris les dossiers .git ou .svn, soit de manière à ce que ces dossiers soient inaccessibles à la fois en externe et à l'application elle-même. | 1 | +| **13.4.2** | Vérifiez que les modes de débogage sont désactivés pour tous les composants dans les environnements de production afin d’éviter l’exposition des fonctionnalités de débogage et la fuite d’informations. | 2 | +| **13.4.3** | Vérifiez que les serveurs Web n’exposent pas les listes de répertoires aux clients, sauf si cela est explicitement prévu. | 2 | +| **13.4.4** | Vérifiez que l’utilisation de la méthode HTTP TRACE n’est pas prise en charge dans les environnements de production, afin d’éviter toute fuite d’informations potentielle. | 2 | +| **13.4.5** | Vérifiez que la documentation (comme pour les API internes) et les endpoints de surveillance ne sont pas exposés, sauf si cela est explicitement prévu. | 2 | +| **13.4.6** | Vérifiez que l’application n’expose pas d’informations de version détaillées des composants backend. | 3 | +| **13.4.7** | Vérifiez que la couche web est configuré pour servir uniquement les fichiers avec des extensions de fichier spécifiques afin d’éviter toute fuite involontaire d’informations, de configuration et de code source. | 3 | + +## Références + +Pour plus d'informations, voir également : + +* [OWASP Web Security Testing Guide: Configuration and Deployment Management Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing) diff --git a/5.0/fr/0x23-V14-Data-Protection.md b/5.0/fr/0x23-V14-Data-Protection.md new file mode 100644 index 0000000000..b037d03866 --- /dev/null +++ b/5.0/fr/0x23-V14-Data-Protection.md @@ -0,0 +1,60 @@ +# V14 Protection des données + +## Objectif de contrôle + +Les applications ne peuvent pas prendre en compte tous les modèles d’utilisation et comportements des utilisateurs et doivent donc mettre en œuvre des contrôles pour limiter l’accès non autorisé aux données sensibles sur les appareils clients. + +Ce chapitre comprend les exigences relatives à la définition des données à protéger, de la manière dont elles doivent être protégées et des mécanismes spécifiques à mettre en œuvre ou des pièges à éviter. + +Un autre élément à prendre en compte pour la protection des données est l'extraction massive, la modification ou l'utilisation excessive. Les exigences de chaque système étant probablement très différentes, déterminer ce qui est « anormal » doit tenir compte du modèle de menace et du risque métier. Du point de vue d'ASVS, la détection de ces problèmes est traitée dans le chapitre « Journalisation de sécurité et gestion des erreurs », et la définition de limites dans le chapitre « Validation et logique métier ». + +## V14.1 Documentation sur la protection des données + +Une condition préalable essentielle à la protection des données est de catégoriser les données considérées comme sensibles. Il existe probablement plusieurs niveaux de sensibilité, et pour chaque niveau, les contrôles requis pour protéger les données seront différents. + +Il existe diverses réglementations et lois sur la confidentialité qui régissent la manière dont les applications doivent gérer le stockage, l'utilisation et la transmission des informations personnelles sensibles. Cette section ne vise plus à reproduire ces types de législation sur la protection des données ou la confidentialité, mais se concentre plutôt sur les considérations techniques clés pour la protection des données sensibles. Veuillez consulter les lois et réglementations locales et, si nécessaire, faire appel à un spécialiste de la confidentialité ou à un avocat qualifié. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **14.1.1** | Vérifiez que toutes les données sensibles créées et traitées par l'application ont été identifiées et classées selon leur niveau de protection. Cela inclut les données uniquement codées et donc facilement déchiffrables, telles que les chaînes Base64 ou la charge utile en texte clair d'un JWT. Les niveaux de protection doivent tenir compte des réglementations et normes de protection des données et de confidentialité auxquelles l'application est tenue de se conformer. | 2 | +| **14.1.2** | Vérifier que tous les niveaux de protection des données sensibles sont assortis d'un ensemble documenté d'exigences de protection. Cela doit inclure (sans s'y limiter) les exigences relatives au chiffrement général, à la vérification de l'intégrité, à la conservation, à la journalisation des données, aux contrôles d'accès aux données sensibles dans les journaux, au chiffrement au niveau de la base de données, aux technologies de confidentialité et de renforcement de la confidentialité à utiliser, ainsi qu'aux autres exigences de confidentialité. | 2 | + +## V14.2 Protection générale des données + +Cette section présente diverses exigences pratiques relatives à la protection des données. La plupart sont spécifiques à des problématiques particulières, telles que les fuites involontaires de données, mais il existe également une exigence générale de mise en œuvre de contrôles de protection en fonction du niveau de protection requis pour chaque donnée. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **14.2.1** | Vérifiez que les données sensibles sont uniquement envoyées au serveur dans les champs de corps ou d’en-tête du message HTTP, et que l’URL et la chaîne de requête ne contiennent pas d’informations sensibles, telles qu’une clé API ou un jeton de session. | 1 | +| **14.2.2** | Vérifiez que l’application empêche la mise en cache des données sensibles dans les composants du serveur, tels que les équilibreurs de charge et les caches d’application, ou garantit que les données sont purgées en toute sécurité après utilisation. | 2 | +| **14.2.3** | Vérifiez que les données sensibles définies ne sont pas envoyées à des parties non fiables (par exemple, des trackers d'utilisateurs) pour empêcher la collecte indésirable de données en dehors du contrôle de l'application. | 2 | +| **14.2.4** | Vérifiez que les contrôles autour des données sensibles liés au chiffrement, à la vérification de l'intégrité, à la conservation, à la manière dont les données doivent être enregistrées, aux contrôles d'accès autour des données sensibles dans les journaux, à la confidentialité et aux technologies d'amélioration de la confidentialité, sont mis en œuvre comme défini dans la documentation pour le niveau de protection des données spécifiques. | 2 | +| **14.2.5** | Vérifiez que les mécanismes de mise en cache sont configurés pour ne mettre en cache que les réponses dont le type de contenu est conforme à la ressource et qui ne contiennent pas de contenu sensible et dynamique. Le serveur web doit renvoyer une réponse 404 ou 302 lors de l'accès à un fichier inexistant plutôt qu'un fichier valide différent. Cela devrait empêcher les attaques par empoisonnement de cache web. | 3 | +| **14.2.6** | Vérifiez que l'application ne renvoie que les données sensibles minimales requises pour son fonctionnement. Par exemple, ne renvoyez que certains chiffres d'un numéro de carte de crédit, et non le numéro complet. Si les données complètes sont requises, elles doivent être masquées dans l'interface utilisateur, sauf si l'utilisateur les consulte spécifiquement. | 3 | +| **14.2.7** | Vérifiez que les informations sensibles sont soumises à une classification de conservation des données, en veillant à ce que les données obsolètes ou inutiles soient supprimées automatiquement, selon un calendrier défini ou selon les besoins de la situation. | 3 | +| **14.2.8** | Vérifiez que les informations sensibles sont supprimées des métadonnées des fichiers soumis par l'utilisateur, sauf si le stockage est autorisé par l'utilisateur. | 3 | + +## V14.3 Protection des données côté client + +Cette section contient des exigences empêchant la fuite de données de manière spécifique du côté client ou de l'agent utilisateur d'une application. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **14.3.1** | Vérifiez que les données authentifiées sont effacées du stockage client, comme le DOM du navigateur, après la fin du client ou de la session. Le champ d'en-tête de réponse HTTP « Clear-Site-Data » peut être utile, mais le côté client devrait également pouvoir effectuer la correction si la connexion au serveur n'est pas disponible à la fin de la session. | 1 | +| **14.3.2** | Vérifiez que l'application définit suffisamment de champs d'en-tête de réponse HTTP anti-caching (c'est-à-dire Cache-Control : no-store) afin que les données sensibles ne soient pas mises en cache dans les navigateurs. | 2 | +| **14.3.3** | Vérifiez que les données stockées dans le stockage du navigateur (telles que localStorage, sessionStorage, IndexedDB ou les cookies) ne contiennent pas de données sensibles, à l'exception des jetons de session. | 2 | + +## Références + +Pour plus d'informations, voir également : + +* [Consider using the Security Headers website to check security and anti-caching header fields](https://securityheaders.com/) +* [Documentation about anti-caching headers by Mozilla](https://developer.mozilla.org/en-US/docs/Web/HTTP/Caching) +* [OWASP Secure Headers project](https://owasp.org/www-project-secure-headers/) +* [OWASP Privacy Risks Project](https://owasp.org/www-project-top-10-privacy-risks/) +* [OWASP User Privacy Protection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/User_Privacy_Protection_Cheat_Sheet.html) +* [Australian Privacy Principle 11 - Security of personal information](https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-11-app-11-security-of-personal-information) +* [European Union General Data Protection Regulation (GDPR) overview](https://www.edps.europa.eu/data-protection_en) +* [European Union Data Protection Supervisor - Internet Privacy Engineering Network](https://www.edps.europa.eu/data-protection/ipen-internet-privacy-engineering-network_en) +* [Information on the "Clear-Site-Data" header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Clear-Site-Data) +* [White paper on Web Cache Deception](https://www.blackhat.com/docs/us-17/wednesday/us-17-Gil-Web-Cache-Deception-Attack-wp.pdf) diff --git a/5.0/fr/0x24-V15-Secure-Coding-and-Architecture.md b/5.0/fr/0x24-V15-Secure-Coding-and-Architecture.md new file mode 100644 index 0000000000..536544ca11 --- /dev/null +++ b/5.0/fr/0x24-V15-Secure-Coding-and-Architecture.md @@ -0,0 +1,77 @@ +# V15 Développement et architecture sécurisés + +## Objectif de contrôle + +De nombreuses exigences de l'ASVS se rapportent soit à un domaine particulier de la sécurité, comme l'authentification ou l'autorisation, soit à un type particulier de fonctionnalité de l'application, comme la journalisation ou la gestion des fichiers. + +Ce chapitre présente les exigences générales de sécurité à prendre en compte lors de la conception et du développement d'applications. Ces exigences portent non seulement sur la propreté de l'architecture et la qualité du code, mais aussi sur les pratiques spécifiques d'architecture et de codage nécessaires à la sécurité des applications. + +## V15.1 Documentation sur le développement et l'architecture sécurisés + +De nombreuses exigences pour établir une architecture sécurisée et défendable dépendent d’une documentation claire des décisions prises concernant la mise en œuvre de contrôles de sécurité spécifiques et des composants utilisés dans l’application. + +Cette section décrit les exigences en matière de documentation, notamment l’identification des composants considérés comme contenant des « fonctionnalités dangereuses » ou comme des « composants à risque ». + +Un composant présentant une « fonctionnalité dangereuse » peut être un composant développé en interne ou par un tiers, effectuant des opérations telles que la désérialisation de données non fiables, l'analyse de fichiers bruts ou binaires, l'exécution de code dynamique ou la manipulation directe de la mémoire. Les vulnérabilités dans ces types d'opérations présentent un risque élevé de compromettre l'application et d'exposer potentiellement son infrastructure sous-jacente. + +Un « composant à risque » est une bibliothèque tierce (c'est-à-dire non développée en interne) dont les contrôles de sécurité concernant ses processus de développement ou ses fonctionnalités sont absents ou mal implémentés. Il peut s'agir, par exemple, de composants mal entretenus, non pris en charge, en fin de vie ou présentant des antécédents de vulnérabilités importantes. + +Cette section souligne également l’importance de définir des délais appropriés pour traiter les vulnérabilités des composants tiers. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **15.1.1** | Vérifiez que la documentation de l'application définit les délais de correction basés sur les risques pour les versions de composants tiers présentant des vulnérabilités et pour la mise à jour des bibliothèques en général, afin de minimiser les risques liés à ces composants. | 1 | +| **15.1.2** | Vérifiez qu'un catalogue d'inventaire, tel qu'une nomenclature logicielle (SBOM), est conservé pour toutes les bibliothèques tierces utilisées, y compris en vérifiant que les composants proviennent de référentiels prédéfinis, fiables et continuellement maintenus. | 2 | +| **15.1.3** | Vérifiez que la documentation de l'application identifie les fonctionnalités consommatrices en temps ou gourmandes en ressources. Elle doit notamment indiquer comment prévenir une perte de disponibilité due à une utilisation excessive de ces fonctionnalités et éviter que la génération d'une réponse ne prenne plus de temps que le délai d'expiration du consommateur. Les mesures de protection potentielles peuvent inclure le traitement asynchrone, l'utilisation de files d'attente et la limitation des processus parallèles par utilisateur et par application. | 2 | +| **15.1.4** | Vérifiez que la documentation de l’application met en évidence les bibliothèques tierces qui sont considérées comme des « composants à risque ». | 3 | +| **15.1.5** | Vérifiez que la documentation de l’application met en évidence les parties de l’application où des « fonctionnalités dangereuses » sont utilisées. | 3 | + +## V15.2 Architecture de sécurité et dépendances + +Cette section inclut les exigences relatives à la gestion des dépendances et des composants risqués, obsolètes ou non sécurisés. + +Elle inclut également l'utilisation de techniques au niveau architectural telles que le sandboxing, l'encapsulation, la conteneurisation et l'isolation du réseau pour réduire l'impact de l'utilisation d'« opérations dangereuses » ou de « composants risqués » (tels que définis dans la section précédente) et éviter la perte de disponibilité due à une utilisation excessive de fonctionnalités exigeantes en ressources. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **15.2.1** | Vérifiez que l’application contient uniquement des composants qui n’ont pas dépassé les délais de mise à jour et de correction documentés. | 1 | +| **15.2.2** | Vérifiez que l'application a mis en œuvre des défenses contre la perte de disponibilité due à des fonctionnalités qui prennent du temps ou qui nécessitent des ressources, sur la base des décisions et stratégies de sécurité documentées à cet effet. | 2 | +| **15.2.3** | Vérifiez que l'environnement de production inclut uniquement les fonctionnalités nécessaires au fonctionnement de l'application et n'expose pas de fonctionnalités superflues telles que du code de test, des exemples d'extraits et des fonctionnalités de développement. | 2 | +| **15.2.4** | Vérifiez que les composants tiers et toutes leurs dépendances transitives sont inclus à partir du référentiel attendu, qu'il soit détenu en interne ou qu'il s'agisse d'une source externe, et qu'il n'y a aucun risque d'attaque par confusion de dépendances. | 3 | +| **15.2.5** | Vérifiez que l'application implémente des protections supplémentaires autour des parties documentées comme contenant des « fonctionnalités dangereuses » ou utilisant des bibliothèques tierces considérées comme des « composants à risque ». Cela peut inclure des techniques telles que le sandboxing, l'encapsulation, la conteneurisation ou l'isolation au niveau du réseau pour retarder et dissuader les attaquants qui compromettent une partie de l'application de se propager ailleurs. | 3 | + +## V15.3 Développement défensif + +Cette section couvre les types de vulnérabilités, y compris le jonglage de types, la pollution de prototypes et autres, qui résultent de l'utilisation de modèles de codage non sécurisés dans un langage particulier. Certaines peuvent ne pas être pertinentes pour tous les langages, tandis que d'autres bénéficieront de correctifs spécifiques à chaque langage ou pourront être liées à la façon dont un langage ou un Framework particulier gère une fonctionnalité telle que les paramètres HTTP. Elle aborde également le risque lié à l'absence de validation cryptographique des mises à jour d'applications. + +Elle prend également en compte les risques liés à l'utilisation d'objets pour représenter des éléments de données, ainsi qu'à leur acceptation et leur renvoi via des API externes. Dans ce cas, l'application doit s'assurer que les champs de données non accessibles en écriture ne sont pas modifiés par l'utilisateur (affectation de masse) et que l'API sélectionne les champs de données renvoyés. Lorsque l'accès aux champs dépend des autorisations de l'utilisateur, il convient d'en tenir compte dans le contexte des exigences de contrôle d'accès au niveau des champs décrites dans le chapitre « Autorisation ». + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **15.3.1** | Vérifiez que l'application ne renvoie que le sous-ensemble requis de champs d'un objet de données. Par exemple, elle ne doit pas renvoyer un objet de données entier, car certains champs individuels ne doivent pas être accessibles aux utilisateurs. | 1 | +| **15.3.2** | Vérifiez que lorsque le backend de l'application effectue des appels vers des URL externes, il est configuré pour ne pas suivre les redirections, sauf s'il s'agit d'une fonctionnalité prévue. | 2 | +| **15.3.3** | Vérifiez que l'application dispose de contre-mesures pour se protéger contre les attaques d'affectation de masse en limitant les champs autorisés par contrôleur et action, par exemple, il n'est pas possible d'insérer ou de mettre à jour une valeur de champ lorsqu'elle n'était pas destinée à faire partie de cette action. | 2 | +| **15.3.4** | Vérifiez que tous les composants proxy et middleware transfèrent correctement l'adresse IP d'origine de l'utilisateur à l'aide de champs de données fiables qui ne peuvent pas être manipulés par l'utilisateur final, et que l'application et le serveur Web utilisent cette valeur correcte pour la journalisation et les décisions de sécurité telles que la limitation du débit, en tenant compte du fait que même l'adresse IP d'origine peut ne pas être fiable en raison d'adresses IP dynamiques, de VPN ou de pare-feu d'entreprise. | 2 | +| **15.3.5** | Vérifiez que l'application garantit explicitement que les variables sont du type correct et effectue des opérations d'égalité et de comparaison strictes. Cela permet d'éviter les vulnérabilités liées à la confusion de types, causées par des hypothèses du code de l'application sur le type d'une variable. | 2 | +| **15.3.6** | Vérifiez que le code JavaScript est écrit de manière à éviter la pollution du prototype, par exemple en utilisant Set() ou Map() au lieu de littéraux d'objet. | 2 | +| **15.3.7** | Vérifiez que l'application dispose de défenses contre les attaques de pollution des paramètres HTTP, en particulier si le Framework d'application ne fait aucune distinction quant à la source des paramètres de requête (chaîne de requête, paramètres de corps, cookies ou champs d'en-tête). | 2 | + +## V15.4 Concurrence sécurisée + +Les problèmes de concurrence tels que les situations de concurrence, les vulnérabilités TOCTOU (Time-of-Check-to-Time-of-Use), les interblocages, les livelock, la privation de threads et les synchronisations incorrectes peuvent entraîner des comportements imprévisibles et des risques de sécurité. Cette section présente diverses techniques et stratégies pour atténuer ces risques. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **15.4.1** | Vérifiez que les objets partagés dans le code multithread (tels que les caches, les fichiers ou les objets en mémoire accessibles par plusieurs threads) sont accessibles en toute sécurité à l'aide de types thread-safe et de mécanismes de synchronisation tels que des verrous ou des sémaphores pour éviter les conditions de concurrence et la corruption des données. | 3 | +| **15.4.2** | Vérifiez que les vérifications de l'état d'une ressource, comme son existence ou ses autorisations, et des actions qui en dépendent, sont effectuées en une seule opération atomique afin d'éviter les situations de concurrence entre le moment de la vérification et le moment de l'utilisation (TOCTOU). Par exemple, vérifier l'existence d'un fichier avant de l'ouvrir ou l'accès d'un utilisateur avant de l'accorder. | 3 | +| **15.4.3** | Vérifiez que les verrous sont utilisés de manière cohérente pour éviter que les threads ne se bloquent, que ce soit en s'attendant les uns les autres ou en réessayant sans fin, et que la logique de verrouillage reste dans le code responsable de la gestion de la ressource pour garantir que les verrous ne peuvent pas être modifiés par inadvertance ou de manière malveillante par des classes ou du code externes. | 3 | +| **15.4.4** | Vérifiez que les politiques d'allocation des ressources empêchent la saturation de threads en garantissant un accès équitable aux ressources, par exemple en exploitant les pools de threads, permettant aux threads de priorité inférieure de continuer dans un délai raisonnable. | 3 | + +## Références + +Pour plus d'informations, voir également : + +* [OWASP Prototype Pollution Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html) +* [OWASP Mass Assignment Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html) +* [OWASP CycloneDX Bill of Materials Specification](https://owasp.org/www-project-cyclonedx/) +* [OWASP Web Security Testing Guide: Testing for HTTP Parameter Pollution](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/07-Input_Validation_Testing/04-Testing_for_HTTP_Parameter_Pollution) diff --git a/5.0/fr/0x25-V16-Security-Logging-and-Error-Handling.md b/5.0/fr/0x25-V16-Security-Logging-and-Error-Handling.md new file mode 100644 index 0000000000..38b7b7fe55 --- /dev/null +++ b/5.0/fr/0x25-V16-Security-Logging-and-Error-Handling.md @@ -0,0 +1,84 @@ +# V16 Journalisation de sécurité et gestion des erreurs + +## Objectif de contrôle + +Les journaux de sécurité se distinguent des journaux d'erreurs ou de performances et servent à enregistrer les événements liés à la sécurité, tels que les décisions d'authentification, les décisions de contrôle d'accès et les tentatives de contournement des contrôles de sécurité, comme la validation des entrées ou la validation de la logique métier. Leur objectif est de faciliter la détection, la réponse et l'investigation en fournissant des données structurées et à haut niveau de signal aux outils d'analyse tels que les SIEM. + +Les journaux ne doivent pas contenir de données personnelles sensibles, sauf obligation légale, et toutes les données enregistrées doivent être protégées comme des ressources de grande valeur. La journalisation ne doit pas compromettre la confidentialité ni la sécurité du système. Les applications doivent également être sécurisées, évitant toute divulgation ou interruption inutile. + +Pour des conseils de mise en œuvre détaillés, consultez les aide-mémoire de l'OWASP indiquées dans la section Références. + +## V16.1 Documentation sur la journalisation de sécurité + +Cette section garantit un inventaire clair et complet de la journalisation de l'ensemble de la pile applicative. Ceci est essentiel pour une surveillance efficace de la sécurité, une réponse aux incidents et une conformité optimale. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **16.1.1** | Vérifiez qu'il existe un inventaire documentant la journalisation effectuée à chaque couche de la pile technologique de l'application, les événements enregistrés, les formats de journal, l'endroit où cette journalisation est stockée, la manière dont elle est utilisée, la manière dont l'accès à celle-ci est contrôlé et la durée de conservation des journaux. | 2 | + +## V16.2 Journalisation générale + +La présente section énonce des exigences visant à garantir que les journaux de sécurité sont structurés de manière cohérente et contiennent les métadonnées attendues. L'objectif est de rendre les journaux lisibles par une machine et analysables par des systèmes et des outils distribués. + +Les événements de sécurité impliquent souvent des données sensibles. Si ces données sont enregistrées sans surveillance, les journaux eux-mêmes deviennent classifiés et donc soumis à des exigences de chiffrement, à des politiques de conservation plus strictes et à une divulgation potentielle lors des audits. + +Il est donc essentiel de ne loguer que ce qui est nécessaire et de traiter les données des journaux avec le même soin que les autres ressources sensibles. + +Les exigences ci-dessous établissent les exigences fondamentales pour la journalisation des métadonnées, la synchronisation, le format et le contrôle. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **16.2.1** | Vérifiez que chaque entrée de journal inclut les métadonnées nécessaires (telles que quand, où, qui, quoi) qui permettraient une enquête détaillée sur la chronologie lorsqu'un événement se produit. | 2 | +| **16.2.2** | Vérifiez que les sources de temps de tous les composants de journalisation sont synchronisées et que les horodatages des métadonnées des événements de sécurité utilisent le temps UTC ou incluent un décalage horaire explicite. L'UTC est recommandé pour garantir la cohérence entre les systèmes distribués et éviter toute confusion lors du passage à l'heure d'été. | 2 | +| **16.2.3** | Vérifiez que l’application stocke ou diffuse uniquement les journaux vers les fichiers et services documentés dans l’inventaire des journaux. | 2 | +| **16.2.4** | Vérifiez que les journaux peuvent être lus et corrélés par le processeur de journaux utilisé, de préférence en utilisant un format de journalisation commun. | 2 | +| **16.2.5** | Vérifiez que l'application applique la journalisation en fonction du niveau de protection des données lors de la journalisation de données sensibles. Par exemple, certaines données, comme les identifiants ou les informations de paiement, peuvent être interdites. D'autres données, comme les jetons de session, ne peuvent être enregistrées que par hachage ou masquage, en totalité ou en partie. | 2 | + +## V16.3 Événements de sécurité + +Cette section définit les exigences relatives à la journalisation des événements de sécurité au sein de l'application. La capture de ces événements est essentielle pour détecter les comportements suspects, faciliter les enquêtes et respecter les obligations de conformité. + +Cette section décrit les types d'événements à journaliser, sans toutefois prétendre à l'exhaustivité. Chaque application présente des facteurs de risque et un contexte opérationnel spécifiques. + +Notez que si ASVS inclut la journalisation des événements de sécurité, les alertes et la corrélation (par exemple, les règles SIEM ou l'infrastructure de surveillance) sont considérées comme hors du périmètre et sont gérées par les systèmes opérationnels et de surveillance. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **16.3.1** | Vérifiez que toutes les opérations d'authentification sont enregistrées, y compris les tentatives réussies et infructueuses. Des métadonnées supplémentaires, telles que le type d'authentification ou les facteurs utilisés, doivent également être collectées. | 2 | +| **16.3.2** | Vérifier que les tentatives d'autorisation infructueuses sont logguées. Pour le niveau 3, cela doit inclure la journalisation de toutes les décisions d'autorisation, y compris lors de l'accès à des données sensibles (sans journalisation des données sensibles elles-mêmes). | 2 | +| **16.3.3** | Vérifiez que l'application enregistre les événements de sécurité définis dans la documentation et enregistre également les tentatives de contournement des contrôles de sécurité, tels que la validation des entrées, la logique métier et l'anti-automatisation. | 2 | +| **16.3.4** | Vérifiez que l’application enregistre les erreurs inattendues et les échecs de contrôle de sécurité tels que les échecs TLS du backend. | 2 | + +## V16.4 Protection des journaux + +Les journaux sont des artefacts d'investigation précieux et doivent être protégés. S'ils peuvent être facilement modifiés ou supprimés, ils perdent leur intégrité et deviennent peu fiables pour les enquêtes sur les incidents ou les procédures légales. Ils peuvent exposer le comportement interne des applications ou des métadonnées sensibles, ce qui en fait une cible de choix pour les attaquants. + +Cette section définit les exigences visant à garantir la protection des journaux contre les accès non autorisés, les falsifications et les divulgations, ainsi que leur transmission et leur stockage sécurisés dans des systèmes sécurisés et isolés. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **16.4.1** | Vérifiez que tous les composants de journalisation codent correctement les données pour empêcher l’injection de journaux. | 2 | +| **16.4.2** | Vérifiez que les journaux sont protégés contre tout accès non autorisé et ne peuvent pas être modifiés. | 2 | +| **16.4.3** | Vérifiez que les journaux sont transmis de manière sécurisée à un système logique distinct pour analyse, détection, alerte et remontée des informations. L'objectif est de garantir qu'en cas de violation de l'application, les journaux ne seront pas compromis. | 2 | + +## V16.5 Gestion des erreurs + +Cette section définit les exigences visant à garantir que les applications échouent proprement et sécurisée sans divulguer de détails internes sensibles. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **16.5.1** | Vérifiez qu'un message générique est renvoyé au consommateur lorsqu'une erreur inattendue ou sensible à la sécurité se produit, garantissant ainsi l'absence d'exposition de données système internes sensibles telles que les traces de pile, les requêtes, les clés secrètes et les jetons. | 2 | +| **16.5.2** | Vérifiez que l'application continue de fonctionner en toute sécurité lorsque l'accès aux ressources externes échoue, par exemple, en utilisant des modèles tels que des disjoncteurs ou une dégradation progressive. | 2 | +| **16.5.3** | Vérifiez que l'application échoue proprement et sécurisée, y compris lorsqu'une exception se produit, en évitant les accès en cas d'erreur telles que le traitement d'une transaction malgré les erreurs résultant de la logique de validation. | 2 | +| **16.5.4** | Vérifiez qu'un gestionnaire d'erreurs de « dernier recours » est défini pour intercepter toutes les exceptions non gérées. Cela permet d'éviter la perte des informations d'erreur qui doivent être loguées dans les fichiers journaux et de garantir qu'une erreur ne paralyse pas l'ensemble du processus applicatif, entraînant une perte de disponibilité. | 3 | + +Remarque : Certains langages (dont Swift, Go et, par des pratiques de conception courantes, de nombreux langages fonctionnels) ne prennent pas en charge les exceptions ni les gestionnaires d'événements de dernier recours. Dans ce cas, les architectes et les développeurs doivent utiliser une méthode compatible avec les modèles, les langages ou les frameworks pour garantir que les applications peuvent gérer en toute sécurité les événements exceptionnels, inattendus ou liés à la sécurité. + +## Références + +Pour plus d'informations, voir également : + +* [OWASP Web Security Testing Guide: Testing for Error Handling](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/README) +* [OWASP Authentication Cheat Sheet section about error messages](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#authentication-and-error-messages) +* [OWASP Logging Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html) +* [OWASP Application Logging Vocabulary Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Vocabulary_Cheat_Sheet.html) diff --git a/5.0/fr/0x26-V17-WebRTC.md b/5.0/fr/0x26-V17-WebRTC.md new file mode 100644 index 0000000000..aeeda82a98 --- /dev/null +++ b/5.0/fr/0x26-V17-WebRTC.md @@ -0,0 +1,75 @@ +# V17 WebRTC + +## Objectif de contrôle + +La communication Web en temps réel (WebRTC) permet l'échange de voix, de vidéo et de données en temps réel dans les applications modernes. Avec l'adoption croissante de cette technologie, la sécurisation de l'infrastructure WebRTC devient cruciale. Cette section présente les exigences de sécurité pour les acteurs qui développent, hébergent ou intègrent des systèmes WebRTC. + +Le marché du WebRTC peut être classé en trois segments : + +1. Développeurs de produits : Fournisseurs propriétaires et open source qui créent et fournissent des produits et solutions WebRTC. Leur objectif est de développer des technologies WebRTC robustes et sécurisées, utilisables par d'autres. + +2. Plateformes de communication en tant que service (CPaaS) : fournisseurs proposant des API, des SDK et l'infrastructure ou les plateformes nécessaires pour exploiter les fonctionnalités WebRTC. Les fournisseurs CPaaS peuvent utiliser des produits de la première catégorie ou développer leur propre logiciel WebRTC pour offrir ces services. + +3. Fournisseurs de services : organisations qui exploitent les produits de développeurs ou de fournisseurs CPaaS, ou qui développent leurs propres solutions WebRTC. Elles créent et implémentent des applications pour les conférences en ligne, la santé, l'apprentissage en ligne et d'autres domaines où la communication en temps réel est essentielle. + +Les exigences de sécurité décrites ici s'adressent principalement aux développeurs de produits, aux CPaaS et aux fournisseurs de services qui : + +* utilisent des solutions open source pour développer leurs applications WebRTC ; +* utilisent des produits WebRTC commerciaux au sein de leur infrastructure ; +* utilisent des solutions WebRTC développées en interne ou intègrent divers composants dans une offre de services cohérente. + +Il est important de noter que ces exigences de sécurité ne s'appliquent pas aux développeurs qui utilisent exclusivement les SDK et les API fournis par les fournisseurs CPaaS. Pour ces développeurs, les fournisseurs CPaaS sont généralement responsables de la plupart des problèmes de sécurité sous-jacents à leurs plateformes, et une norme de sécurité générique comme ASVS peut ne pas répondre pleinement à leurs besoins. + +## V17.1 Serveur TURN + +Cette section définit les exigences de sécurité pour les systèmes utilisant leurs propres serveurs TURN (Traversal Using Relays around NAT). Les serveurs TURN contribuent au relais des médias dans les environnements réseau restrictifs, mais peuvent présenter des risques en cas de mauvaise configuration. Ces contrôles se concentrent sur le filtrage sécurisé des adresses et la protection contre l'épuisement des ressources. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **17.1.1** | Vérifiez que le service TURN (Traversal Using Relays around NAT) autorise uniquement l'accès aux adresses IP non réservées à des fins spécifiques (par exemple, réseaux internes, diffusion, bouclage). Notez que cela s'applique aux adresses IPv4 et IPv6. | 2 | +| **17.1.2** | Vérifiez que le service Traversal Using Relays around NAT (TURN) n'est pas susceptible d'épuiser ses ressources lorsque des utilisateurs légitimes tentent d'ouvrir un grand nombre de ports sur le serveur TURN. | 3 | + +## V17.2 Média + +Ces exigences s'appliquent uniquement aux systèmes hébergeant leurs propres serveurs multimédias WebRTC, tels que les unités de transfert sélectif (SFU), les unités de contrôle multipoint (MCU), les serveurs d'enregistrement ou les serveurs de passerelle. Les serveurs multimédias gèrent et distribuent les flux multimédias, ce qui rend leur sécurité essentielle pour protéger les communications entre homologues. La protection des flux multimédias est primordiale dans les applications WebRTC pour prévenir les écoutes clandestines, les falsifications et les attaques par déni de service susceptibles de compromettre la confidentialité des utilisateurs et la qualité des communications. + +En particulier, il est nécessaire de mettre en œuvre des protections contre les attaques par saturation, telles que la limitation du débit, la validation des horodatages, l'utilisation d'horloges synchronisées pour correspondre aux intervalles en temps réel et la gestion des tampons afin d'éviter les débordements et de maintenir une synchronisation correcte. Si les paquets d'une session multimédia spécifique arrivent trop rapidement, les paquets excédentaires doivent être rejetés. Il est également important de protéger le système contre les paquets malformés en implémentant la validation des entrées, en gérant en toute sécurité les dépassements d'entiers, en prévenant les dépassements de tampon et en utilisant d'autres techniques robustes de gestion des erreurs. + +Les systèmes qui s'appuient uniquement sur la communication multimédia peer-to-peer entre navigateurs Web, sans l'intervention de serveurs multimédias intermédiaires, sont exclus de ces exigences de sécurité spécifiques liées aux médias. + +Cette section traite de l'utilisation de la sécurité de la couche de transport des datagrammes (DTLS) dans le contexte de WebRTC. L'exigence relative à la mise en place d'une politique documentée de gestion des clés cryptographiques est décrite dans le chapitre « Cryptographie ». Des informations sur les méthodes cryptographiques approuvées sont disponibles dans l'annexe Cryptographie de l'ASVS ou dans des documents tels que NIST SP 800-52 Rev. 2 ou BSI TR-02102-2 (version 2025-01). + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **17.2.1** | Vérifiez que la clé du certificat Datagram Transport Layer Security (DTLS) est gérée et protégée conformément à la politique documentée de gestion des clés cryptographiques. | 2 | +| **17.2.2** | Vérifiez que le serveur multimédia est configuré pour utiliser et prendre en charge les suites de chiffrement DTLS (Datagram Transport Layer Security) approuvées et un profil de protection sécurisé pour l'extension DTLS pour l'établissement de clés pour le protocole de transport en temps réel sécurisé (DTLS-SRTP). | 2 | +| **17.2.3** | Vérifiez que l'authentification SRTP (Secure Real-time Transport Protocol) est vérifiée sur le serveur multimédia pour empêcher les attaques par injection RTP (Real-time Transport Protocol) d'entraîner une condition de déni de service ou l'insertion de médias audio ou vidéo dans les flux multimédias. | 2 | +| **17.2.4** | Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant lorsqu'il rencontre des paquets SRTP (Secure Real-time Transport Protocol) mal formés. | 2 | +| **17.2.5** | Vérifiez que le serveur multimédia est en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes. | 3 | +| **17.2.6** | Vérifiez que le serveur multimédia n'est pas sensible à la vulnérabilité de condition de concurrence « ClientHello » dans Datagram Transport Layer Security (DTLS) en vérifiant si le serveur multimédia est publiquement connu comme étant vulnérable ou en effectuant le test de condition de concurrence. | 3 | +| **17.2.7** | Vérifiez que tous les mécanismes d'enregistrement audio ou vidéo associés au serveur multimédia sont en mesure de continuer à traiter le trafic multimédia entrant pendant un flot de paquets SRTP (Secure Real-time Transport Protocol) provenant d'utilisateurs légitimes. | 3 | +| **17.2.8** | Vérifiez que le certificat Datagram Transport Layer Security (DTLS) est vérifié par rapport à l'attribut d'empreinte cryptographique du protocole de description de session (SDP), en mettant fin au flux multimédia si la vérification échoue, pour garantir l'authenticité du flux multimédia. | 3 | + +## V17.3 Signalisation + +Cette section définit les exigences pour les systèmes qui exploitent leurs propres serveurs de signalisation WebRTC. La signalisation coordonne les communications "pair à pair" et doit être résiliente face aux attaques susceptibles de perturber l'établissement ou le contrôle des sessions. + +Pour garantir une signalisation sécurisée, les systèmes doivent gérer correctement les entrées malformées et rester disponibles sous charge. + +| # | Description | Niveau | +| :---: | :--- | :---: | +| **17.3.1** | Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation entrants légitimes lors d'une attaque par saturation. Cela peut être réalisé en implémentant une limitation de débit au niveau de la signalisation. | 2 | +| **17.3.2** | Vérifiez que le serveur de signalisation est capable de continuer à traiter les messages de signalisation légitimes en cas de message mal formé susceptible de provoquer un déni de service. Cela peut inclure la validation des entrées, la gestion sécurisée des dépassements d'entiers, la prévention des dépassements de tampon et l'utilisation d'autres techniques robustes de gestion des erreurs. | 2 | + +## Références + +Pour plus d'informations, voir également : + +* Le WebRTC DTLS ClientHello DoS est mieux documenté ici : [Article du blog d'Enable Security destiné aux professionnels de la sécurité](https://www.enablesecurity.com/blog/novel-dos-vulnerability-affecting-webrtc-media-servers/) et ici [livre blanc destiné aux développeurs WebRTC](https://www.enablesecurity.com/blog/webrtc-hello-race-conditions-paper/) +* [RFC 3550 - RTP: A Transport Protocol for Real-Time Applications](https://www.rfc-editor.org/rfc/rfc3550) +* [RFC 3711 - The Secure Real-time Transport Protocol (SRTP)](https://datatracker.ietf.org/doc/html/rfc3711) +* [RFC 5764 - Datagram Transport Layer Security (DTLS) Extension to Establish Keys for the Secure Real-time Transport Protocol (SRTP))](https://datatracker.ietf.org/doc/html/rfc5764) +* [RFC 8825 - Overview: Real-Time Protocols for Browser-Based Applications](https://www.rfc-editor.org/info/rfc8825) +* [RFC 8826 - Security Considerations for WebRTC](https://www.rfc-editor.org/info/rfc8826) +* [RFC 8827 - WebRTC Security Architecture](https://www.rfc-editor.org/info/rfc8827) +* [DTLS-SRTP Protection Profiles](https://www.iana.org/assignments/srtp-protection/srtp-protection.xhtml) diff --git a/5.0/fr/0x90-Appendix-A_Glossary.md b/5.0/fr/0x90-Appendix-A_Glossary.md new file mode 100644 index 0000000000..ebcad83488 --- /dev/null +++ b/5.0/fr/0x90-Appendix-A_Glossary.md @@ -0,0 +1,89 @@ +# Annexe A : Glossaire + +* **Architecture de sécurité** – Abstraction de la conception d'une application qui identifie et décrit où et comment les contrôles de sécurité sont utilisés, et identifie et décrit également l'emplacement et la sensibilité des données utilisateur et applicatives. +* **Address Space Layout Randomization (ASLR)** - Une technique pour rendre plus difficile l'exploitation des bugs de corruption de la mémoire. +* **Analyse de la composition logicielle** (SCA) – Ensemble de technologies conçues pour analyser la composition, les dépendances, les bibliothèques et les packages des applications afin de détecter les vulnérabilités de sécurité des versions de composants spécifiques utilisées. À ne pas confondre avec l'analyse du code source, communément appelée SAST. +* **Authentification** – Vérification de l'identité revendiquée par un utilisateur d'application. +* **Authentification client TLS**, également appelée **TLS mutuel** (mTLS) - Dans une connexion TLS standard, un client peut utiliser le certificat fourni par le serveur pour valider son identité. Lorsque l'authentification client TLS est utilisée, le client utilise également sa propre clé privée et son propre certificat pour permettre au serveur de valider également son identité. +* **Authentificateur à facteur unique** – Mécanisme permettant de vérifier l'authentification d'un utilisateur. Il peut s'agir d'un élément que vous connaissez (secrets mémorisés, mots de passe, phrases secrètes, codes PIN), d'une information que vous êtes (biométrie, empreinte digitale, reconnaissance faciale) ou d'un élément que vous possédez (jetons OTP, dispositif cryptographique tel qu'une carte à puce). +* **Authentification multifacteur** (MFA) - Authentification qui inclut au moins deux facteurs uniques. +* **Authentification par authentification unique** (SSO) – Elle se produit lorsqu'un utilisateur se connecte à une application et est ensuite automatiquement connecté à d'autres applications sans avoir à se réauthentifier. Par exemple, lorsqu'il se connecte à Google, il sera automatiquement connecté à d'autres services Google tels que YouTube, Google Docs et Gmail. +* **Bill of Materials logiciels** (SBOM) – Liste structurée et complète de tous les composants, modules, bibliothèques, Framework et autres ressources nécessaires à la création ou à l'assemblage d'une application logicielle. +* **Certificat X.509** – Un certificat X.509 est un certificat numérique qui utilise la norme internationale d'infrastructure à clés publiques (PKI) X.509, largement acceptée, pour vérifier qu'une clé publique appartient à l'identité de l'utilisateur, de l'ordinateur ou du service contenue dans le certificat. +* **Code d'authentification de message** (MAC) - Somme de contrôle cryptographique des données, calculée par un algorithme de génération de MAC, utilisée pour garantir leur intégrité et leur authenticité. +* **Communication Web en temps réel** (WebRTC) – Pile de protocoles et API web associée, utilisées pour le transport de flux multimédias dans les applications web, généralement dans le cadre de téléconférences. Basée sur SRTP, SRTCP, DTLS, SDP et STUN/TURN. +* **Configuration de sécurité** – Configuration d'exécution d'une application qui affecte l'utilisation des contrôles de sécurité. +* **Contrôle de sécurité** – Fonction ou composant qui effectue un contrôle de sécurité (par exemple, un contrôle d'autorisation) ou, lorsqu'il est appelé, produit un effet de sécurité (par exemple, la génération d'un enregistrement d'audit). +* **Composant** – Unité de code autonome, avec des interfaces disque et réseau associées, qui communique avec d'autres composants. +* **Couche de service sécurisé** – Tout point d'application de contrôle sécurisé, tel qu'un microservice, une API sans serveur, côté serveur, une API sécurisée sur un appareil client doté d'un démarrage sécurisé, des API partenaires ou externes, etc. Le terme « sécurisé » signifie qu'il n'y a aucun risque qu'un utilisateur non sécurisé puisse contourner ou ignorer la couche ou les contrôles implémentés à cette couche. +* **Cross-Site Scripting** (XSS) – Vulnérabilité de sécurité généralement présente dans les applications web, permettant l'injection de scripts côté client dans le contenu. +* **Cycle de vie du développement logiciel** (SDLC) – Processus étape par étape de développement d'un logiciel, depuis les exigences initiales jusqu'au déploiement et à la maintenance. +* **Datagram Transport Layer Security** (DTLS) – Protocole cryptographique assurant la sécurité des communications sur une connexion réseau. Basé sur le protocole TLS, il est adapté à la protection des protocoles orientés datagrammes (généralement via UDP). Défini dans la RFC 9147 pour DTLS 1.3. +* **Délai d'inactivité** – Durée pendant laquelle une session peut rester active en l'absence d'interaction de l'utilisateur avec l'application. Il s'agit d'un élément de l'expiration de la session. +* **Durée de vie maximale absolue d'une session** – Également appelée « délai d'expiration global » par le NIST, il s'agit de la durée maximale pendant laquelle une session peut rester active après authentification, quelle que soit l'interaction de l'utilisateur. Il s'agit d'un élément de l'expiration de la session. +* **Entité externe XML** (XXE) – Type d'entité XML permettant d'accéder à du contenu local ou distant via un identifiant système déclaré. Cela peut conduire à diverses attaques par injection. +* **Énumération des faiblesses courantes** (CWE) – Liste communautaire des faiblesses courantes en matière de sécurité logicielle. Elle sert de langage commun, de critère de mesure pour les outils de sécurité logicielle et de référence pour l'identification, l'atténuation et la prévention des faiblesses. +* **Environnement d'exécution sécurisé** (TEE) - Un environnement de traitement isolé dans lequel les applications peuvent être exécutées en toute sécurité, indépendamment du reste du système. +* **Extension de sécurité de la couche de transport de datagrammes pour l'établissement de clés pour le protocole de transport sécurisé en temps réel** (DTLS-SRTP) – Mécanisme d'utilisation d'une négociation DTLS pour l'établissement des clés d'une session SRTP. Définie dans la RFC 5764. +* **Falsification de requête côté serveur** (SSRF) – Attaque qui exploite les fonctionnalités du serveur pour lire ou mettre à jour des ressources internes. L'attaquant fournit ou modifie une URL, que le code exécuté sur le serveur lit ou à laquelle il soumet des données. +* **Fast IDentity Online** (FIDO) – Ensemble de normes d'authentification permettant l'utilisation de différentes méthodes d'authentification, notamment la biométrie, les modules de plateforme sécurisée (TPM), les jetons de sécurité USB, etc. +* **Fonction de dérivation de clé basée sur un mot de passe 2** (PBKDF2) – Algorithme unidirectionnel spécial utilisé pour créer une clé cryptographique forte à partir d'un texte d'entrée (tel qu'un mot de passe) et d'une valeur de sel aléatoire supplémentaire. Il peut donc être utilisé pour rendre plus difficile le forçage d'un mot de passe hors ligne si la valeur résultante est stockée à la place du mot de passe d'origine. +* **Fournisseur d'identité** (IdP) – Également appelé fournisseur de services d'identification (CSP) dans les références NIST. Entité qui fournit une source d'authentification pour d'autres applications. +* **Fournisseur de services d'identification** (CSP) – Également appelé fournisseur d'identité (IdP). Source de données utilisateur pouvant être utilisée comme source d'authentification par d'autres applications. +* **Générateur de nombres pseudo-aléatoires cryptographiquement sécurisé** (CSPRNG) - Un générateur de nombres pseudo-aléatoires avec des propriétés qui le rendent adapté à une utilisation en cryptographie, également appelé générateur de nombres aléatoires cryptographiques (CRNG). +* **Gestion des informations et des événements de sécurité** (SIEM) - Système de détection des menaces, de conformité et de gestion des incidents de sécurité par la collecte et l'analyse de données de sécurité provenant de diverses sources au sein de l'infrastructure informatique d'une organisation. +* **Graphiques vectoriels évolutifs** (SVG) – Langage de balisage XML pour la description de graphiques vectoriels bidimensionnels. +* **Hardware Security Module** (HSM) – Composant matériel qui stocke les clés cryptographiques et autres secrets de manière protégée. +* **Hibernate Query Language** (HQL) – Langage de requête similaire au SQL utilisé par la bibliothèque Hibernate ORM. +* **HTTP Strict Transport Security** (HSTS) – Politique qui indique au navigateur de se connecter uniquement au domaine renvoyant l'en-tête via TLS et lorsqu'un certificat valide est présenté. Elle est activée via le champ d'en-tête de réponse Strict-Transport-Security. +* **HyperText Transfer Protocol** (HTTP) – Protocole d'application pour les systèmes d'information hypermédia distribués et collaboratifs. Il constitue le fondement de la communication de données sur le World Wide Web. +* **Identifiant de ressource uniforme** (URI) – Chaîne de caractères unique identifiant une ressource, telle qu'une page web, une adresse e-mail, des lieux. +* **Identifiant de session** ou **ID de session** – Clé identifiant une session avec état stockée dans le backend. Transférée vers et depuis le client, soit sous forme de jeton de référence, soit à l'intérieur d'un jeton de référence. +* **Identifiant unique universel** (UUID) – Un numéro de référence unique utilisé comme identifiant dans un logiciel. +* **Inclusion de fichiers distants** (RFI) – Attaque exploitant des procédures d'inclusion vulnérables dans l'application, entraînant l'inclusion de fichiers distants. +* **Inclusion de fichiers locaux** (LFI) – Attaque exploitant les procédures d'inclusion de fichiers vulnérables d'une application, entraînant l'inclusion de fichiers locaux déjà présents sur le serveur. +* **Inclusion de script intersite** (XSSI) – Variante d'une attaque de script intersite (XSS) dans laquelle une application web récupère du code malveillant depuis une ressource externe et l'intègre à son propre contenu. +* **Infrastructure à clés publiques** (PKI) – Dispositif qui lie les clés publiques aux identités respectives des entités. Cette liaison est établie par un processus d'enregistrement et de délivrance de certificats auprès et par une autorité de certification (AC). +* **Injection SQL** (SQLi) - Technique d'injection de code utilisée pour attaquer les applications pilotées par les données, dans laquelle des instructions SQL malveillantes sont insérées dans un endpoint. +* **Jeton anti-falsification** – Mécanisme par lequel un ou plusieurs jetons sont transmis dans une requête et validés par le serveur d'app. +* **Code d'authentification de message** (MAC) - Somme de contrôle cryptographique des données, calculée par un algorithme de génération de MAC, utilisée pour garantir leur intégrité et leur authenticité. +* **Jeton autonome** – Jeton qui encapsule un ou plusieurs attributs indépendants de l'état côté serveur ou d'un autre stockage externe. Ces jetons garantissent l'authenticité et l'intégrité des attributs qu'ils contiennent, permettant un échange d'informations sécurisé et « sans état » entre les systèmes. Les jetons autonomes sont généralement sécurisés à l'aide de techniques cryptographiques, telles que les signatures numériques ou les codes d'authentification de messages (MAC), afin de garantir l'authenticité, l'intégrité et, dans certains cas, la confidentialité de leurs données. Les assertions SAML et les JWT en sont des exemples courants. +* **Jeton de référence** – Type de jeton servant de pointeur ou d'identifiant vers un état ou des métadonnées stockées sur un serveur, parfois appelés jetons aléatoires ou jetons opaques. Contrairement aux jetons autonomes, qui intègrent certaines de leurs données pertinentes au sein même du jeton, les jetons de référence ne contiennent aucune information intrinsèque et dépendent du serveur pour le contexte. Le jeton de référence sera ou contiendra un identifiant de session. +* **Jeton de session** – Expression générique utilisée dans la présente norme pour désigner le jeton ou la valeur utilisé(e) dans les mécanismes de session sans état (qui utilisent un jeton autonome) ou dans les mécanismes de session avec état (qui utilisent un jeton de référence). +* **Jeton Web JSON** (JWT) – La RFC 7519 définit une norme pour un objet de données JSON composé d'une section d'en-tête expliquant comment valider l'objet, d'une section de corps contenant un ensemble de déclarations et d'une section de signature contenant une signature numérique permettant de valider le contenu de la section de corps. Il s'agit d'un type de jeton autonome. +* **Liste d'autorisation** – Liste de données ou d'opérations autorisées, par exemple une liste de caractères autorisés à valider les entrées. +* **Localisateur de ressources uniforme** (URL) – Chaîne spécifiant l'emplacement d'une ressource sur Internet. +* **Malware** - Code introduit dans une application pendant son développement, à l'insu de son propriétaire, qui contourne la politique de sécurité prévue de l'application. Différent des logiciels malveillants tels qu'un virus ou un ver ! +* **Mappage objet-relationnel** (ORM) - Système permettant de référencer et d'interroger une base de données relationnelle/table au sein d'un programme d'application à l'aide d'un modèle objet compatible avec l'application. +* **Mécanisme de session avec état** - Dans un mécanisme de session avec état, l'application conserve l'état de la session dans le backend, ce qui correspond généralement à un jeton de session, généré à l'aide d'un générateur de nombres pseudo-aléatoires cryptographiquement sécurisé (CSPRNG), délivré à l'utilisateur final. +* **Mécanisme de session sans état** - Un mécanisme de session sans état utilise un jeton autonome transmis aux clients et contenant des informations de session qui ne sont pas nécessairement stockées au sein du service, qui reçoit et valide ensuite le jeton. En réalité, un service doit avoir accès à certaines informations de session (comme une liste de révocation JWT) pour pouvoir appliquer les contrôles de sécurité requis. +* **Module cryptographique** – Matériel, logiciel et/ou micrologiciel implémentant des algorithmes cryptographiques et/ou générant des clés cryptographiques. +* **Module de plateforme sécurisé** (TPM) – Type de HSM généralement rattaché à un composant matériel plus important, comme une carte mère, et servant de « racine de confiance » pour ce système. +* **Mot de passe à usage unique** (OTP) - Mot de passe généré de manière unique pour une utilisation unique. +* **Open Worldwide Application Security Project** (OWASP) – L'OWASP (Open Worldwide Application Security Project) est une communauté mondiale, libre et ouverte, qui se consacre à l'amélioration de la sécurité des logiciels applicatifs. Notre mission est de rendre la sécurité des applications visible, afin que les personnes et les organisations puissent prendre des décisions éclairées face aux risques de sécurité applicative. Voir : [https://www.owasp.org/](https://www.owasp.org/). +* **OTP basé sur l'heure** - Méthode de génération d'un OTP où l'heure actuelle fait partie de l'algorithme de génération du mot de passe. +* **Partie de confiance** (RP) – Généralement une application qui s'appuie sur l'authentification d'un utilisateur auprès d'un fournisseur d'authentification distinct. L'application s'appuie sur un jeton ou un ensemble d'assertions signées fournies par ce fournisseur d'authentification pour garantir que l'utilisateur est bien celui qu'il prétend être. +* **Protocole de description de session** (SDP) - Format de message permettant de configurer une session multimédia (utilisé par exemple dans WebRTC). Défini dans la RFC 4566. +* **Protocole de transport en temps réel** (RTP) et **Protocole de contrôle de transport en temps réel** (RTCP) - Deux protocoles utilisés conjointement pour le transport de flux multimédia. Utilisé par la pile WebRTC. Défini dans la RFC 3550. +* **Protocole de transfert hypertexte sur SSL/TLS** (HTTPS) – Méthode de sécurisation des communications HTTP par chiffrement à l'aide du protocole TLS (Transport Layer Security). +* **Rapport de vérification de la sécurité des applications** – Rapport documentant les résultats globaux et l'analyse justificative produite par le vérificateur pour une application donnée. +* **Réseau téléphonique public commuté** (RTPC) – Réseau téléphonique traditionnel qui comprend à la fois les téléphones fixes et les téléphones mobiles. +* **Secure Real-time Transport Protocol** (SRTP) et **Secure Real-time Transport Control Protocol** (SRTCP) – Profil des protocoles RTP et RTCP prenant en charge le chiffrement des messages, l'authentification et la protection de leur intégrité. Défini dans la RFC 3711. +* **Security Assertion Markup Language** (SAML) – Une norme ouverte pour l’authentification unique basée sur la transmission d’assertions signées (généralement des objets XML) entre le fournisseur d’identité et la partie utilisatrice. +* **Sécurité des applications** – La sécurité au niveau des applications se concentre sur l'analyse des composants de la couche applicative du modèle de référence d'interconnexion des systèmes ouverts (OSI), plutôt que sur le système d'exploitation sous-jacent ou les réseaux connectés, par exemple. +* **Test boîte noire** – Méthode de test logiciel qui examine les fonctionnalités d'une application sans scruter ses structures ou son fonctionnement internes. +* **Tests dynamiques de sécurité des applications** (DAST) – Technologies conçues pour détecter les conditions indiquant une vulnérabilité de sécurité dans une application en cours d'exécution. +* **Time-of-check to time-of-use** (TOCTOU) - Situation dans laquelle une application vérifie l'état d'une ressource avant de l'utiliser, mais cet état peut être modifié entre la vérification et l'utilisation. Cela peut invalider les résultats de la vérification et entraîner des actions non valides de l'application en raison de cette incohérence d'état. +* **Time based One-time Passwords** (TOTPs) - Méthode de génération d'un OTP dans laquelle l'heure actuelle fait partie de l'algorithme de génération du mot de passe. +* **Transport Layer Security** (TLS) - Protocoles cryptographiques qui assurent la sécurité des communications sur une connexion réseau. +* **Traversée utilisant des relais autour de NAT** (TURN) – Extension du protocole STUN utilisant un serveur TURN comme relais lorsque les connexions "pair à pair" directes ne peuvent être établies. Défini dans la RFC 8656. +* **TLS mutuel** (mTLS) - Voir authentification client TLS. +* **Utilitaires de traversée de session pour NAT** (STUN) - Protocole utilisé pour faciliter la traversée NAT afin d'établir des communications "pair à pair". Défini dans la RFC 3489. +* **Validation des entrées** - Canonisation et validation des entrées utilisateur non fiables. +* **Vérificateur** – Personne ou équipe qui examine une demande par rapport aux exigences ASVS de l'OWASP. +* **Vérification automatisée** – Utilisation d'outils automatisés (analyse dynamique, analyse statique, ou les deux) qui utilisent les signatures de vulnérabilité pour détecter les problèmes. +* **Vérification de la conception** – Évaluation technique de l'architecture de sécurité d'une application. +* **Vérification de la sécurité des applications** – Évaluation technique d'une application par rapport à l'ASVS de l'OWASP. +* **Vérification dynamique** – Utilisation d'outils automatisés utilisant les signatures de vulnérabilité pour détecter les problèmes lors de l'exécution d'une application. +* **WebSocket sur TLS** (WSS) – Pratique de sécurisation des communications WebSocket en superposant WebSocket sur le protocole TLS. +* **What You See Is What You Get** (WYSIWYG) – Éditeur de contenu riche qui montre l'apparence réelle du contenu une fois rendu, plutôt que le codage utilisé pour gérer le rendu. diff --git a/5.0/fr/0x91-Appendix-B_References.md b/5.0/fr/0x91-Appendix-B_References.md new file mode 100644 index 0000000000..c982de0e9b --- /dev/null +++ b/5.0/fr/0x91-Appendix-B_References.md @@ -0,0 +1,43 @@ +# Annexe B : Références + +Les projets OWASP suivants sont les plus susceptibles d’être utiles aux utilisateurs/adoptants de cette norme : + +## Projets principaux de l'OWASP + +1. OWASP Top 10 Project : [https://owasp.org/www-project-top-ten/](https://owasp.org/www-project-top-ten/) +2. OWASP Web Security Testing Guide : [https://owasp.org/www-project-web-security-testing-guide/](https://owasp.org/www-project-web-security-testing-guide/) +3. OWASP Proactive Controls : [https://owasp.org/www-project-proactive-controls/](https://owasp.org/www-project-proactive-controls/) +4. OWASP Software Assurance Maturity Model (SAMM) : [https://owasp.org/www-project-samm/](https://owasp.org/www-project-samm/) +5. OWASP Secure Headers Project : [https://owasp.org/www-project-secure-headers/](https://owasp.org/www-project-secure-headers/) + +## Projet de la série de fiches aide-mémoire de l'OWASP + +[Ce projet](https://owasp.org/www-project-cheat-sheets/) contient plusieurs aide-mémoires qui seront pertinents pour différents sujets de l'ASVS. + +Il existe un mappage vers l'ASVS qui peut être trouvé ici : [https://cheatsheetseries.owasp.org/IndexASVS.html](https://cheatsheetseries.owasp.org/IndexASVS.html) + +## Projets liés à la sécurité mobile + +1. OWASP Mobile Security Project: [https://owasp.org/www-project-mobile-security/](https://owasp.org/www-project-mobile-security/) +2. OWASP Mobile Top 10 Risks: [https://owasp.org/www-project-mobile-top-10/](https://owasp.org/www-project-mobile-top-10/) +3. OWASP Mobile Security Testing Guide and Mobile Application Security Verification Standard: [https://owasp.org/www-project-mobile-security-testing-guide/](https://owasp.org/www-project-mobile-security-testing-guide/) + +## Projets Internet des objets de l'OWASP + +1. OWASP Internet of Things Project: [https://owasp.org/www-project-internet-of-things/](https://owasp.org/www-project-internet-of-things/) + +## Projets sans serveur OWASP + +1. OWASP Serverless Project : [https://owasp.org/www-project-serverless-top-10/](https://owasp.org/www-project-serverless-top-10/) + +## Autres + +De même, les sites Web suivants sont susceptibles d’être utiles aux utilisateurs/adoptants de cette norme + +1. SecLists Github : [https://github.com/danielmiessler/SecLists](https://github.com/danielmiessler/SecLists) +2. MITRE Common Weakness Enumeration : [https://cwe.mitre.org/](https://cwe.mitre.org/) +3. PCI Security Standards Council : [https://www.pcisecuritystandards.org/](https://www.pcisecuritystandards.org/) +4. PCI Data Security Standard (DSS) v3.2.1 Requirements and Security Assessment Procedures : [https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf](https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf) +5. PCI Software Security Framework - Secure Software Requirements and Assessment Procedures : [https://www.pcisecuritystandards.org/documents/PCI-Secure-Software-Standard-v1_0.pdf](https://www.pcisecuritystandards.org/documents/PCI-Secure-Software-Standard-v1_0.pdf) +6. PCI Secure Software Lifecycle (Secure SLC) Requirements and Assessment Procedures : [https://www.pcisecuritystandards.org/documents/PCI-Secure-SLC-Standard-v1_0.pdf](https://www.pcisecuritystandards.org/documents/PCI-Secure-SLC-Standard-v1_0.pdf) +7. OWASP ASVS 4.0 Testing Guide : [https://github.com/BlazingWind/OWASP-ASVS-4.0-testing-guide](https://github.com/BlazingWind/OWASP-ASVS-4.0-testing-guide) diff --git a/5.0/fr/0x92-Appendix-C_Cryptography.md b/5.0/fr/0x92-Appendix-C_Cryptography.md new file mode 100644 index 0000000000..88dc182bad --- /dev/null +++ b/5.0/fr/0x92-Appendix-C_Cryptography.md @@ -0,0 +1,312 @@ +# Annexe C : Standards cryptographiques + +Le chapitre « Cryptographie » va au-delà de la simple définition des bonnes pratiques. Il vise à améliorer la compréhension des principes de cryptographie et à encourager l'adoption de méthodes de sécurité plus résilientes et modernes. Cette annexe fournit des informations techniques détaillées sur chaque exigence, en complément des normes générales décrites dans le chapitre « Cryptographie ». + +Cette annexe définit le niveau d'approbation des différents mécanismes cryptographiques : + +* Les mécanismes _Approuvés_ (A) peuvent être utilisés dans les applications. +* Les mécanismes _Hérités_ (L) ne devraient pas être utilisés dans les applications, mais peuvent néanmoins être utilisés uniquement pour assurer la compatibilité avec les applications ou le code existants. Bien que l'utilisation de ces mécanismes ne soit pas actuellement considérée comme une vulnérabilité en soi, ils devraient être remplacés par des mécanismes plus sûrs et évolutifs dès que possible. +* Les mécanismes _Interdits_ (D) ne devraient pas être utilisés car ils sont actuellement considérés comme cassés ou n'offrent pas une sécurité suffisante. + +Cette liste peut être modifiée dans le contexte d'une application donnée pour diverses raisons, notamment : + +* nouvelles évolutions dans le domaine de la cryptographie ; +* conformité à une réglementation. + +## Inventaire et documentation cryptographiques + +Cette section fournit des informations complémentaires +sur l'inventaire et la documentation cryptographiques V11.1. + +Il est important de s'assurer que tous les actifs cryptographiques, tels que les algorithmes, les clés et les certificats, sont régulièrement découverts, inventoriés et évalués. Pour le niveau 3, cela devrait inclure l'utilisation d'analyses statiques et dynamiques pour découvrir l'utilisation de la cryptographie dans une application. Des outils tels que les SAST et DAST peuvent être utiles, mais des outils dédiés pourraient être nécessaires pour une couverture plus complète. Voici quelques exemples d'outils gratuits : + +* [CryptoMon - Moniteur de cryptographie réseau - utilisant eBPF, écrit en python](https://github.com/Santandersecurityresearch/CryptoMon) +* [Cryptobom Forge Tool: Generating Comprehensive CBOMs from CodeQL Outputs](https://github.com/Santandersecurityresearch/cryptobom-forge) + +## Forces équivalentes des paramètres cryptographiques + +Les niveaux de sécurité relatifs des différents systèmes cryptographiques sont présentés dans ce tableau (extrait de [NIST SP 800-57 Partie 1](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final), p.71) : + +| Force de sécurité | Algorithmes à clés symétriques | Corps finis | Factorisation d'entiers | Courbe elliptique | +|--|--|--|--|--| +| <= 80 | 2TDEA | L = 1024
N = 160 | k = 1024 | f = 160-223 | +| 112 | 3TDEA | L = 2048
N = 224 | k = 2048 | f = 224-255 | +| 128 | AES-128 | L = 3072
N = 256 | k = 3072 | f = 256-383 | +| 192 | AES-192 | L = 7680
N = 384 | k = 7680 | f = 384-511 | +| 256 | AES-256 | L = 15360
N = 512 | k = 15360 | f = 512+ | + +Exemples d'applications : + +* Cryptographie à corps finis : DSA, FFDH, MQV +* Cryptographie à factorisation entière : RSA +* Cryptographie à courbes elliptiques : ECDSA, EdDSA, ECDH, MQV + +Remarque : cette section suppose qu'aucun ordinateur quantique n'existe ; si un tel ordinateur existait, les estimations des trois dernières colonnes ne seraient plus valides. + +## Valeurs aléatoires + +Cette section fournit des informations supplémentaires +sur les valeurs aléatoires de la version 11.5. + +| Nom | Version/Référence | Notes | Statut | +|:---|:----|:----|:-:| +| `/dev/random` | Linux 4.8+ [(oct. 2016)](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=818e607b57c94ade9824dad63a96c2ea6b21baf3), également présent dans iOS, Android et d'autres systèmes d'exploitation POSIX basés sur Linux. Basé sur [RFC7539](https://datatracker.ietf.org/doc/html/rfc7539) | Utilise le flux ChaCha20. Trouvé dans iOS [`SecRandomCopyBytes`](https://developer.apple.com/documentation/security/secrandomcopybytes(_:_:_:)?language=objc) et Android [`Secure Random`](https://developer.android.com/reference/java/security/SecureRandom) avec les paramètres corrects fournis pour chacun. | A | +| `/dev/urandom` | Fichier spécial du noyau Linux pour fournir des données aléatoires | Fournit des sources d'entropie de haute qualité à partir du caractère aléatoire matériel | A | +| `AES-CTR-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | Tel qu'utilisé dans les implémentations courantes, telles que [l'API Windows CNG `BCryptGenRandom`](https://learn.microsoft.com/en-us/windows/win32/api/bcrypt/nf-bcrypt-bcryptgenrandom) définie par [`BCRYPT_RNG_ALGORITHM`](https://learn.microsoft.com/en-us/windows/win32/seccng/cng-algorithm-identifiers). | A | +| `HMAC-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | | A | +| `Hash-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | | A | +| `getentropy()` | [OpenBSD](https://man.openbsd.org/getentropy.2), disponible sous [Linux glibc 2.25+](https://man7.org/linux/man-pages/man3/getentropy.3.html) et [macOS 10.12+](https://support.apple.com/en-gb/guide/security/seca0c73a75b/web) | Fournit des octets aléatoires sécurisés directement depuis la source d'entropie du noyau, grâce à une API simple et minimale. Plus moderne, elle évite les pièges des anciennes API. | A | + +La fonction de hachage sous-jacente utilisée avec HMAC-DRBG ou Hash-DRBG doit être approuvée pour cette utilisation. + +## Algorithmes de chiffrement + +Cette section fournit des informations supplémentaires +sur les algorithmes de chiffrement V11.3. + +Les algorithmes de chiffrement approuvés sont classés par ordre de préférence. + +| Algorithmes à clé symétrique | Référence | Statut | +| ------ | ------ |:-:| +| AES-256 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | A | +| Salsa20 | [Salsa 20 specification](https://cr.yp.to/snuffle/spec.pdf) | A | +| XChaCha20 | [XChaCha20 Draft](https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-xchacha-03) | A | +| XSalsa20 | [Extending the Salsa20 nonce](https://cr.yp.to/snuffle/xsalsa-20110204.pdf) | A | +| ChaCha20 | [RFC 8439](https://www.rfc-editor.org/info/rfc8439) | A | +| AES-192 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | A | +| AES-128 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | L | +| 2TDEA | | D | +| TDEA (3DES/3DEA) | | D | +| IDEA | | D | +| RC4 | | D | +| Blowfish| | D | +| ARC4 | | D | +| DES | | D | + +### Modes de chiffrement AES + +Les chiffrements par blocs, comme AES, peuvent être utilisés avec différents modes opératoires. De nombreux modes, comme le livre de codes électronique (ECB), ne sont pas sécurisés et ne doivent pas être utilisés. Les modes Galois/Compteur (GCM) et Compteur avec chaînage de blocs et code d'authentification de message (CCM) assurent un chiffrement authentifié et doivent être utilisés dans les applications modernes. + +Les modes approuvés sont classés par ordre de préférence. + +| Mode | Authentifié | Référence | Statut | Restriction | +|--|--|--|--|--| +| GCM | Oui | [NIST SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | | +| CCM | Oui | [NIST SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | | +| CBC | Non | [NIST SP 800-38A](https://csrc.nist.gov/pubs/sp/800/38/a/final) | L | | +| CCM-8 | Oui | | D | | +| ECB | Non | | D | | +| CFB | Non | | D | | +| OFB | Non | | D | | +| CTR | Non | | D | | + +Remarques : + +* Tous les messages chiffrés doivent être authentifiés. Toute utilisation du mode CBC nécessite l'association d'un algorithme MAC de hachage pour valider le message. En général, cet algorithme doit être appliqué à la méthode « Chiffrer puis hacher » (mais TLS 1.2 utilise plutôt la méthode « Hash puis chiffrer »). Si cela ne peut être garanti, le mode CBC NE DOIT PAS être utilisé. La seule application où le chiffrement sans algorithme MAC est autorisé est le chiffrement de disque. +* Si le mode CBC est utilisé, la vérification du remplissage doit être garantie en temps constant. +* Lors de l'utilisation de CCM-8, la balise MAC ne dispose que de 64 bits de sécurité. Ceci n'est pas conforme à l'exigence 6.2.9 qui exige au moins 128 bits de sécurité. +* Le chiffrement de disque est considéré comme hors du périmètre de l'ASVS. Par conséquent, cette annexe ne répertorie aucune méthode approuvée pour le chiffrement de disque. Pour cette utilisation, le chiffrement sans authentification est généralement accepté et les modes XTS, XEX et LRW sont généralement utilisés. + +### key wrapping + +L'encapsulation (et le déchiffrement) d'une clé cryptographique est une méthode de protection d'une clé existante par encapsulation (c'est-à-dire par encapsulation) grâce à un mécanisme de chiffrement supplémentaire, afin que la clé d'origine ne soit pas exposée de manière visible, par exemple lors d'un transfert. Cette clé supplémentaire, utilisée pour protéger la clé d'origine, est appelée clé d'encapsulation. + +Cette opération peut être effectuée lorsqu'il est souhaitable de protéger des clés dans des emplacements jugés non fiables, ou d'envoyer des clés sensibles sur des réseaux non fiables ou au sein d'applications. +Cependant, il est important de bien comprendre la nature (par exemple, l'identité et la finalité) de la clé d'origine avant de s'engager dans une procédure d'encapsulation/déchiffrement, car cela peut avoir des répercussions sur les systèmes/applications sources et cibles en termes de sécurité, et notamment de conformité, ce qui peut inclure des pistes d'audit de la fonction d'une clé (par exemple, la signature) ainsi qu'un stockage approprié des clés. + +Plus précisément, AES-256 doit être utilisé pour l'encapsulation des clés, conformément à la norme NIST SP 800-38F (https://csrc.nist.gov/pubs/sp/800/38/f/final) et en tenant compte des dispositions prospectives contre la menace quantique. Les modes de chiffrement utilisant AES sont les suivants, par ordre de préférence : + +| Enveloppement de clé | Référence | Statut | +|--|--|:-:| +| KW | [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) | A | +| KWP | [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) | A | + +AES-192 et AES-128 PEUVENT être utilisés si le cas d'utilisation l'exige, mais leur motivation DOIT être documentée dans l'inventaire cryptographique de l'entité. + +### Chiffrement authentifié + +À l'exception du chiffrement du disque, les données chiffrées doivent être protégées contre toute modification non autorisée à l'aide d'un schéma de chiffrement authentifié (AE), généralement un schéma de chiffrement authentifié avec données associées (AEAD). + +L'application doit de préférence utiliser un schéma AEAD approuvé. Elle peut également combiner un schéma de chiffrement approuvé et un algorithme MAC approuvé avec une construction « Chiffrer puis MAC ». + +La méthode « MAC puis chiffrer » est toujours autorisée pour des raisons de compatibilité avec les applications existantes. Elle est utilisée dans TLS v1.2 avec les anciennes suites de chiffrement. + +| Mécanisme AEAD | Référence | Statut | +|---|---------|:-:| +|AES-GCM | [SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | +|AES-CCM | [SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | +|ChaCha-Poly1305 | [RFC 7539](https://datatracker.ietf.org/doc/html/rfc7539) | A | +|AEGIS-256 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +|AEGIS-128 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +|AEGIS-128L| [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +|Encrypt-then-MAC | | A | +|MAC-then-encrypt | | L | + +## Fonctions de hachage + +Cette section fournit des informations supplémentaires +sur le hachage V11.4 et les fonctions basées sur le hachage. + +### Fonctions de hachage pour les cas d'utilisation généraux + +Le tableau suivant répertorie les fonctions de hachage approuvées pour les cas d'utilisation cryptographiques généraux, tels que les signatures numériques : + +* Les fonctions de hachage approuvées offrent une forte résistance aux collisions et conviennent aux applications de haute sécurité. +* Certains de ces algorithmes offrent une forte résistance aux attaques lorsqu'ils sont utilisés avec une gestion appropriée des clés cryptographiques. Ils sont donc également approuvés pour les fonctions HMAC, KDF et RBG. +* Les fonctions de hachage dont le résultat est inférieur à 254 bits présentent une résistance aux collisions insuffisante et ne doivent pas être utilisées pour la signature numérique ou d'autres applications nécessitant une résistance aux collisions. Pour d'autres utilisations, elles peuvent être utilisées à des fins de compatibilité et de vérification UNIQUEMENT avec les systèmes existants, mais ne doivent pas être utilisées dans les nouvelles conceptions. + +| Fonction de hachage | Référence | Statut | Restrictions | +| ------ | ----------- |:-:| ---------- | +| SHA3-512 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| SHA-512 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHA3-384 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| SHA-384 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHA3-256 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| SHA-512/256 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHA-256 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHAKE256 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| BLAKE2s | [BLAKE2: simpler, smaller, fast as MD5](https://eprint.iacr.org/2013/322) | A | | +| BLAKE2b | [BLAKE2: simpler, smaller, fast as MD5](https://eprint.iacr.org/2013/322) | A | | +| BLAKE3 | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | | +| SHA-224 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | L | Ne convient pas aux signatures numériques HMAC, KDF, RBG | +| SHA-512/224 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | L | Ne convient pas aux signatures numériques HMAC, KDF, RBG | +| SHA3-224 | [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | L | Ne convient pas aux signatures numériques HMAC, KDF, RBG | +| SHA-1 | [RFC 3174](https://www.rfc-editor.org/info/rfc3174) et [RFC 6194](https://www.rfc-editor.org/info/rfc6194) | L | Ne convient pas aux signatures numériques HMAC, KDF, RBG | +| CRC (toute longueur) | | D | | +| MD4 | [RFC 1320](https://www.rfc-editor.org/info/rfc1320) | D | | +| MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | | + +### Fonctions de hachage pour le stockage des mots de passe + +Pour un hachage sécurisé des mots de passe, des fonctions de hachage dédiées doivent être utilisées. Ces algorithmes de hachage lent atténuent les attaques par force brute et par dictionnaire en augmentant la difficulté de calcul du craquage des mots de passe. + +| KDF | Référence | Paramètres requis | Statut | +| ---------- | --------- | ------------ |:-:| +| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1 | A | +| | | t = 2: m ≥ 19456 (19 MiB), p = 1 | A | +| | | t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | +| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8 | A | +| | | p = 2: N ≥ 2^16 (64 MiB), r = 8 | A | +| | | p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | +| bcrypt | [A Future-Adaptable Password Scheme](https://www.researchgate.net/publication/2519476_A_Future-Adaptable_Password_Scheme) | coût ≥ 10 | A | +| PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | itérations ≥ 210,000 | A | +| PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | itérations ≥ 600,000 | A | +| PBKDF2-HMAC-SHA-1 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | itérations ≥ 1,300,000 | L | + +Les fonctions de dérivation de clés basées sur des mots de passe approuvées peuvent être utilisées pour le stockage des mots de passe. + +## Fonctions de dérivations de clés (KDFs) + +### Fonctions de dérivations de clés générales + +| KDF | Référence | Statut | +| ---------------- | -------- |:-:| +| HKDF | [RFC 5869](https://www.rfc-editor.org/info/rfc5869) | A | +| TLS 1.2 PRF | [RFC 5248](https://www.rfc-editor.org/info/rfc5248) | L | +| KDFs à base de MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | +| KDFs à base de SHA-1 | [RFC 3174](https://www.rfc-editor.org/info/rfc3174), [RFC 6194](https://www.rfc-editor.org/info/rfc6194) | D | + +### Fonctions de dérivations de clés à base de mot de passe + +| KDF | Référence | Paramètres requis | Statut | +| ---------- | --------- | ------------ |:-:| +| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1 | A | +| | | t = 2: m ≥ 19456 (19 MiB), p = 1 | A | +| | | t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | +| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8 | A | +| | | p = 2: N ≥ 2^16 (64 MiB), r = 8 | A | +| | | p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | +| PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | itérations ≥ 210,000 | A | +| PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | itérations ≥ 600,000 | A | +| PBKDF2-HMAC-SHA-1 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | itérations ≥ 1,300,000 | L | + +## Mécanismes d'échange de clés + +Cette section fournit des informations complémentaires +sur la cryptographie à clé publique V11.6. + +### Systèmes KEX + +Une force de sécurité de 112 bits ou plus DOIT être garantie pour tous les méthodes d'échange de clés, et leur mise en œuvre DOIT suivre les choix de paramètres dans le tableau suivant. + +| Schéma | Paramètres du domaine | Confidentialité persistante | Statut | +|--|--|--|:-:| +| Diffie-Hellman à corps finis (FFDH) | L >= 3072 et N >= 256 | Oui | A | +| Courbe elliptique Diffie-Hellman (ECDH) | f >= 256-383 | Oui | A | +| Transport de clés chiffrées avec RSA-PKCS#1 v1.5 | | Non | D | + +Où les paramètres suivants sont : + +* k est la taille de la clé RSA. +* L est la taille de la clé publique et N est la taille de la clé privée pour la cryptographie à corps finis. +* f est la plage de tailles de clés pour ECC. + +Toute nouvelle implémentation NE DOIT PAS utiliser de schéma non conforme aux normes [NIST SP 800-56A](https://csrc.nist.gov/pubs/sp/800/56/a/r3/final) et [B](https://csrc.nist.gov/pubs/sp/800/56/b/r2/final) et [NIST SP 800-77](https://csrc.nist.gov/pubs/sp/800/77/r1/final). Plus précisément, IKEv1 NE DOIT PAS être utilisé en production. + +### Groupes Diffie-Hellman + +Les groupes suivants sont approuvés pour la mise en œuvre de l'échange de clés Diffie-Hellman. Les niveaux de sécurité sont décrits dans la norme NIST SP 800-56A (https://csrc.nist.gov/pubs/sp/800/56/a/r3/final), l'annexe D et la norme NIST SP 800-57, partie 1, révision 5 (https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final). + +| Groupe | Statut | +|------------------|:------:| +| P-224, secp224r1 | A | +| P-256, secp256r1 | A | +| P-384, secp384r1 | A | +| P-521, secp521r1 | A | +| K-233, sect233k1 | A | +| K-283, sect283k1 | A | +| K-409, sect409k1 | A | +| K-571, sect571k1 | A | +| B-233, sect233r1 | A | +| B-283, sect283r1 | A | +| B-409, sect409r1 | A | +| B-571, sect571r1 | A | +| Curve448 | A | +| Curve25519 | A | +| MODP-2048 | A | +| MODP-3072 | A | +| MODP-4096 | A | +| MODP-6144 | A | +| MODP-8192 | A | +| ffdhe2048 | A | +| ffdhe3072 | A | +| ffdhe4096 | A | +| ffdhe6144 | A | +| ffdhe8192 | A | + +## Codes d'authentification des messages (MAC) + +Les codes d'authentification de message (MAC) sont des structures cryptographiques permettant de vérifier l'intégrité et l'authenticité d'un message. Un MAC prend en entrée un message et une clé secrète et génère une étiquette de taille fixe (la valeur MAC). Les MAC sont largement utilisés dans les protocoles de communication sécurisés (par exemple, TLS/SSL) pour garantir l'authenticité et l'intégrité des messages échangés entre les parties. + +| Algorithme MAC | Référence | Statut | +| ---------- | --------------- |:-:| +| HMAC-SHA-256 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) et [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| HMAC-SHA-384 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) et [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| HMAC-SHA-512 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) et [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| KMAC128 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | +| KMAC256 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | +| BLAKE3 (mode keyed_hash) | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | +| AES-CMAC | [RFC 4493](https://datatracker.ietf.org/doc/html/rfc4493) et [NIST SP 800-38B](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38b.pdf) | A | +| AES-GMAC | [NIST SP 800-38D](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf) | A | +| Poly1305-AES | [The Poly1305-AES message-authentication code](https://cr.yp.to/mac/poly1305-20050329.pdf) | A | +| HMAC-SHA-1 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) et [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | L | +| HMAC-MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | + +## Signatures numériques + +Les schémas de signature DOIVENT utiliser des tailles de clés et des paramètres approuvés conformément à la norme [NIST SP 800-57 Partie 1](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final). + +| Algorithme de signature | Référence | Statut | +| ------------------------------ | --------------------------------------------- | :-: | +| EdDSA (Ed25519, Ed448) | [RFC 8032](https://www.rfc-editor.org/info/rfc8032) | A | +| XEdDSA (Curve25519, Curve448) | [XEdDSA](https://signal.org/docs/specifications/xeddsa/) | A | +| ECDSA (P-256, P-384, P-521) | [FIPS 186-4](https://csrc.nist.gov/pubs/fips/186-5/final) | A | +| RSA-RSSA-PSS | [RFC 8017](https://www.rfc-editor.org/info/rfc8017) | A | +| RSA-SSA-PKCS#1 v1.5 | [RFC 8017](https://www.rfc-editor.org/info/rfc8017) | D | +| DSA (n'importe quelle taille de clé) | [FIPS 186-4](https://csrc.nist.gov/pubs/fips/186-4/final) | D | + +## Normes de chiffrement post-quantique + +Les mises en œuvre de la cryptographie post-quantique (PQC) doivent respecter les normes [FIPS-203](https://csrc.nist.gov/pubs/fips/203/ipd), [FIPS-204](https://csrc.nist.gov/pubs/fips/204/ipd) et [FIPS-205](https://csrc.nist.gov/pubs/fips/205/ipd). À l'heure actuelle, il n'existe pas beaucoup d'exemples de codes renforcés ou d'implémentations de référence disponibles pour ces normes. Pour plus de détails, voir [l'annonce par le NIST des trois premières normes de chiffrement post-quantique finalisées (août 2024)](https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards). + +La méthode d'accord de clé TLS hybride post-quantique proposée [mlkem768x25519](https://datatracker.ietf.org/doc/draft-kwiatkowski-tls-ecdhe-mlkem/03/) est prise en charge par les principaux navigateurs tels que [Firefox version 132](https://www.mozilla.org/en-US/firefox/132.0/releasenotes/) et [Chrome version 131](https://security.googleblog.com/2024/09/a-new-path-for-kyber-on-web.html). Elle peut être utilisée dans des environnements de test cryptographique ou lorsqu'elle est disponible dans des bibliothèques approuvées par l'industrie ou le gouvernement. diff --git a/5.0/fr/0x93-Appendix-D_Recommendations.md b/5.0/fr/0x93-Appendix-D_Recommendations.md new file mode 100644 index 0000000000..8c77ce077b --- /dev/null +++ b/5.0/fr/0x93-Appendix-D_Recommendations.md @@ -0,0 +1,49 @@ +# Annexe D : Recommandations + +## Introduction + +Lors de la préparation de la version 5.0 de la norme de vérification de la sécurité des applications (ASVS), il est apparu clairement que plusieurs éléments, existants ou nouvellement proposés, ne devaient pas être inclus comme exigences dans la version 5.0. Cela peut s'expliquer par le fait qu'ils n'entraient pas dans le champ d'application de l'ASVS selon la définition de la version 5.0, ou bien par le fait que, malgré leur pertinence, ils ne pouvaient être rendus obligatoires. + +Ne voulant pas perdre tous ces éléments entièrement, certains ont été capturés dans cette annexe. + +## Mécanismes de périmètre recommandés + +Les éléments suivants sont concernés par ASVS. Ils ne devraient pas être rendus obligatoires, mais il est fortement recommandé de les prendre en compte dans le cadre d'une application sécurisée. + +* Un indicateur de sécurité des mots de passe devrait être fourni pour aider les utilisateurs à définir un mot de passe plus fort. +* Créez un fichier security.txt accessible au public à la racine ou dans le répertoire .well-known de l'application, définissant clairement un lien ou une adresse e-mail permettant de contacter les propriétaires en cas de problème de sécurité. +* La validation des entrées côté client devrait être appliquée en plus de la validation au niveau d'une couche de service de confiance, car cela permet de détecter si un utilisateur a contourné les contrôles côté client pour tenter d'attaquer l'application. +* Empêchez l'affichage de pages sensibles et accessibles accidentellement dans les moteurs de recherche à l'aide d'un fichier robots.txt, de l'en-tête de réponse X-Robots-Tag ou d'une balise méta HTML robots. +* Lorsque vous utilisez GraphQL, implémentez la logique d'autorisation au niveau de la couche logique métier plutôt que dans la couche GraphQL ou du résolveur afin d'éviter de gérer l'autorisation sur chaque interface distincte. + +Références : + +* [Plus d'informations sur security.txt, y compris un lien vers la RFC](https://securitytxt.org/) + +## Principes de sécurité des logiciels + +Les éléments suivants figuraient déjà dans ASVS, mais ne constituent pas de véritables exigences. Il s'agit plutôt de principes à prendre en compte lors de la mise en œuvre de contrôles de sécurité, dont le respect permettra de renforcer la robustesse. Parmi ceux-ci : + +* Les contrôles de sécurité doivent être centralisés, simples (économie de conception), vérifiables et réutilisables. Cela permet d'éviter les contrôles dupliqués, manquants ou inefficaces. +* Dans la mesure du possible, utilisez des implémentations de contrôle de sécurité préalablement écrites et bien contrôlées plutôt que de vous fier à la mise en œuvre de contrôles à partir de zéro. +* Idéalement, un mécanisme de contrôle d'accès unique devrait être utilisé pour accéder aux données et ressources protégées. Toutes les requêtes devraient transiter par ce mécanisme unique afin d'éviter les copier-coller ou les chemins alternatifs non sécurisés. +* Le contrôle d'accès basé sur les attributs ou les fonctionnalités est un modèle recommandé : le code vérifie l'autorisation de l'utilisateur pour une fonctionnalité ou un élément de données, plutôt que simplement son rôle. Les autorisations doivent toujours être attribuées à l'aide de rôles. + +## Processus de sécurité des logiciels + +Plusieurs processus de sécurité ont été supprimés d'ASVS 5.0, mais restent pertinents. Le projet OWASP SAMM pourrait être une bonne source d'inspiration pour une mise en œuvre efficace de ces processus. Parmi les éléments précédemment présents dans ASVS, on peut citer : + +* Vérifier l'utilisation d'un cycle de vie sécurisé pour le développement de logiciels qui prend en compte la sécurité à tous les stades du développement. +* Vérifier l'utilisation de la modélisation des menaces pour chaque changement de conception ou planification de sprint afin d'identifier les menaces, de planifier les contre-mesures, de faciliter les réponses appropriées aux risques et d'orienter les tests de sécurité. +* Vérifier que toutes les histoires d'utilisateurs et les caractéristiques contiennent des contraintes de sécurité fonctionnelles, telles que "En tant qu'utilisateur, je devrais être en mesure de voir et de modifier mon profil. Je ne dois pas pouvoir consulter ou modifier le profil de quelqu'un d'autre" +* Vérifier la disponibilité d'une liste de contrôle de codage sécurisé, d'exigences de sécurité, de lignes directrices ou d'une politique pour tous les développeurs et les testeurs. +* Vérifier l'existence d'un processus permanent visant à garantir que le code source de l'application est exempt de portes dérobées, de codes malveillants (attaques par salami, bombes logiques, bombes à retardement) et de caractéristiques non documentées ou cachées (œufs de Pâques, outils de débogage non sécurisés). Il n'est pas possible de se conformer à cette section sans un accès complet au code source, y compris aux bibliothèques tierces, et cela ne convient donc probablement qu'aux applications exigeant les niveaux de sécurité les plus élevés. +* Vérifier que des mécanismes sont en place pour détecter les dérives de configuration dans les environnements déployés et y répondre. Il peut s'agir de l'utilisation d'une infrastructure immuable, d'un redéploiement automatisé à partir d'une base sécurisée ou d'outils de détection de dérive qui comparent l'état actuel aux configurations approuvées. +* Vérifier que le durcissement de la configuration est effectué sur tous les produits tiers, les bibliothèques, + +Références: + +* [OWASP Threat Modeling Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html) +* [OWASP Threat modeling](https://owasp.org/www-community/Application_Threat_Modeling) +* [OWASP Software Assurance Maturity Model Project](https://owasp.org/www-project-samm/) +* [Microsoft SDL](https://www.microsoft.com/en-us/securityengineering/sdl/) diff --git a/5.0/fr/0x94-Appendix-E_Contributors.md b/5.0/fr/0x94-Appendix-E_Contributors.md new file mode 100644 index 0000000000..40f1767efb --- /dev/null +++ b/5.0/fr/0x94-Appendix-E_Contributors.md @@ -0,0 +1,71 @@ +# Appendix E - Contributeurs + +Nous remercions les personnes suivantes pour leurs contributions, leurs commentaires et leurs demandes d'extension depuis la publication de ASVS 4.0.0. + +Si vous avez connaissance d'erreurs ou si vous souhaitez que votre nom apparaisse différemment, merci de nous le faire savoir. + +| | | | | +|---|---|---|---| +| Johan Sydseter ([sydseter](https://github.com/sydseter)) | luis servin ([lfservin](https://github.com/lfservin)) | Oleksii Dovydkov ([oleksiidov](https://github.com/oleksiidov)) | IZUKA Masahiro ([maizuka](https://github.com/maizuka)) | +| James Sulinski ([jsulinski](https://github.com/jsulinski)) | Eli Saad ([ThunderSon](https://github.com/ThunderSon)) | [kkshitish9](https://github.com/kkshitish9) | Andrew van der Stock ([vanderaj](https://github.com/vanderaj)) | +| Rick M ([kingthorin](https://github.com/kingthorin)) | Bankde Eakasit ([Bankde](https://github.com/Bankde)) | Michael Gargiullo ([mgargiullo](https://github.com/mgargiullo)) | Raphael Dunant ([Racater](https://github.com/Racater)) | +| Cesar Kohl ([cesarkohl](https://github.com/cesarkohl)) | [inaz0](https://github.com/inaz0) | Joerg Bruenner ([JoergBruenner](https://github.com/JoergBruenner)) | David Deatherage ([securitydave](https://github.com/securitydave)) | +| John Carroll ([yosignals](https://github.com/yosignals)) | Jim Fenton ([jimfenton](https://github.com/jimfenton)) | Matteo Pace ([M4tteoP](https://github.com/M4tteoP)) | Sebastien gioria ([SPoint42](https://github.com/SPoint42)) | +| Steven van der Baan ([vdbaan](https://github.com/vdbaan)) | Jeremy Bonghwan Choi ([jeremychoi](https://github.com/jeremychoi)) | [craig-shony](https://github.com/craig-shony) | Riccardo Sirigu ([ricsirigu](https://github.com/ricsirigu)) | +| Tomasz Wrobel ([tw2as](https://github.com/tw2as)) | Alena Dubeshko ([belalena](https://github.com/belalena)) | Rafael Green ([RafaelGreen1](https://github.com/RafaelGreen1)) | [mjang-cobalt](https://github.com/mjang-cobalt) | +| [clallier94](https://github.com/clallier94) | Kevin W. Wall ([kwwall](https://github.com/kwwall)) | Jordan Sherman ([jsherm-fwdsec](https://github.com/jsherm-fwdsec) / [deleterepo](https://github.com/deleterepo)) | Ingo Rauner ([ingo-rauner](https://github.com/ingo-rauner)) | +| Dirk Wetter ([drwetter](https://github.com/drwetter)) | Moshe Zioni ([moshe-apiiro](https://github.com/moshe-apiiro)) | Patrick Dwyer ([coderpatros](https://github.com/coderpatros)) | David Clarke ([davidclarke-au](https://github.com/davidclarke-au)) | +| Takaharu Ogasa ([takaharuogasa](https://github.com/takaharuogasa)) | Arkadii Yakovets ([arkid15r](https://github.com/arkid15r)) | Motoyasu Saburi ([motoyasu-saburi](https://github.com/motoyasu-saburi)) | [leirn](https://github.com/leirn) | +| [wet-certitude](https://github.com/wet-certitude) | [timhemel](https://github.com/timhemel) | RL Thornton ([thornshadow99](https://github.com/thornshadow99)) | Thomas Bandt ([aspnetde](https://github.com/aspnetde)) | +| Roel Storms ([roelstorms](https://github.com/roelstorms)) | Jeroen Willemsen ([commjoen](https://github.com/commjoen)) | [anonymous-31](https://github.com/anonymous-31) | Kamran Saifullah ([deFr0ggy](https://github.com/deFr0ggy)) | +| Steve Springett ([stevespringett](https://github.com/stevespringett)) | Spyros ([northdpole](https://github.com/northdpole)) | Hans Herrera ([hansphp](https://github.com/hansphp)) | [Marx314](https://github.com/Marx314) | +| [CarlosAllendes](https://github.com/CarlosAllendes) | Yonah Russ ([yruss972](https://github.com/yruss972)) | Sander Maijers ([sanmai-NL](https://github.com/sanmai-NL)) | Luboš Bretschneider ([bretik](https://github.com/bretik)) | +| Eva Sarafianou ([esarafianou](https://github.com/esarafianou)) | Ata Seren [ataseren](https://github.com/ataseren) | Steve Thomas ([Sc00bz](https://github.com/Sc00bz)) | Dominique RIGHETTO ([righettod](https://github.com/righettod)) | +| Steven van der Baan ([svdb-ncc](https://github.com/svdb-ncc)) | Michael Vacarella ([Aif4thah](https://github.com/Aif4thah)) | Tonimir Kisasondi ([tkisason](https://github.com/tkisason)) | Stefan Streichsbier ([streichsbaer](https://github.com/streichsbaer)) | +| [hi-unc1e](https://github.com/hi-unc1e) | sb3k ([starbuck3000](https://github.com/starbuck3000)) | [mario-platt](https://github.com/mario-platt) | Devdatta Akhawe ([devd](https://github.com/devd)) | +| Michael Gissing ([scolytus](https://github.com/scolytus)) | Jet Anderson ([thatsjet](https://github.com/thatsjet)) | Dave Wichers ([davewichers](https://github.com/davewichers)) | Jonny Schnittger ([JonnySchnittger](https://github.com/JonnySchnittger)) | +| Silvia Väli ([silviavali](https://github.com/silviavali)) | [jackgates73](https://github.com/jackgates73) | [1songb1rd](https://github.com/1songb1rd) | Timur - ([timurozkul](https://github.com/timurozkul)) | +| Gareth Heyes ([hackvertor](https://github.com/hackvertor)) | [appills](https://github.com/appills) | [suvikaartinen](https://github.com/suvikaartinen) | chaals ([chaals](https://github.com/chaals)) | +| DanielPharos ([AtlasHackert](https://github.com/AtlasHackert)) | will Farrell ([willfarrell](https://github.com/willfarrell)) | Alina Vasiljeva ([avasiljeva](https://github.com/avasiljeva)) | Paul McCann ([ismisepaul](https://github.com/ismisepaul)) | +| Sage ([SajjadPourali](https://github.com/SajjadPourali)) | [rbsec](https://github.com/rbsec) | Benedikt Bauer ([mastacheata](https://github.com/mastacheata)) | James Jardine ([jamesjardine](https://github.com/jamesjardine)) | +| Mark Burnett ([m8urnett](https://github.com/m8urnett)) | [dschwarz91](https://github.com/dschwarz91) | Cyber-AppSec ([Cyber-AppSec](https://github.com/Cyber-AppSec)) | [Tib3rius](https://github.com/Tib3rius) | +| BitnessWise ([bitnesswise](https://github.com/bitnesswise)) | damienbod ([damienbod](https://github.com/damienbod)) | Jared Meit ([jmeit-fwdsec](https://github.com/jmeit-fwdsec)) | Stefan Seelmann ([sseelmann](https://github.com/sseelmann)) | +| Brendan O'Connor ([ussjoin](https://github.com/ussjoin)) | Andrei Titov ([andrettv](https://github.com/andrettv)) | Hans-Petter Fjeld ([atluxity](https://github.com/atluxity)) | [markehack](https://github.com/markehack) | +| Neil Madden ([NeilMadden](https://github.com/NeilMadden)) | Michael Geramb ([mgeramb](https://github.com/mgeramb)) | Osama Elnaggar ([ossie-git](https://github.com/ossie-git)) | [mackowski](https://github.com/mackowski) | +| Ravi Balla ([raviballa](https://github.com/raviballa)) | Hazana ([hazanasec](https://github.com/hazanasec)) | David Means ([dmeans82](https://github.com/dmeans82)) | Alexander Stein ([tohch4](https://github.com/tohch4)) | +| BaeSenseii ([baesenseii](https://github.com/baesenseii)) | Vincent De Schutter ([VincentDS](https://github.com/VincentDS)) | S Bani ([sbani](https://github.com/sbani)) | Mitsuaki Akiyama ([mak1yama](https://github.com/mak1yama)) | +| Christopher Loessl ([hashier](https://github.com/hashier)) | [victorxm](https://github.com/victorxm) | Michal Rada ([michalradacz](https://github.com/michalradacz)) | Veeresh Devireddy ([drveresh](https://github.com/drveresh)) | +| [MaknaSEO](https://github.com/MaknaSEO) | [darkzero2022](https://github.com/darkzero2022) | Liam ([LiamDobbelaere](https://github.com/LiamDobbelaere)) | Frank Denis ([jedisct1](https://github.com/jedisct1)) | +| Otto Sulin ([ottosulin](https://github.com/ottosulin)) | [carllaw6885](https://github.com/carllaw6885) | Anders Johan Holmefjord ([aholmis](https://github.com/aholmis)) | Richard Fritsch ([rfricz](https://github.com/rfricz)) | +| [mesutgungor](https://github.com/mesutgungor) | Scott Helme ([ScottHelme](https://github.com/ScottHelme)) | Carlo Reggiani ([carloreggiani](https://github.com/carloreggiani)) | Suyash Srivastava ([suyash5053](https://github.com/suyash5053)) | +| Mark Potter ([markonweb](https://github.com/markonweb)) | Arjan Lamers ([alamers](https://github.com/alamers)) | Gøran Breivik ([gobrtg](https://github.com/gobrtg)) | [flo-blg](https://github.com/flo-blg) | +| Guillaume Déflache ([guillaume-d](https://github.com/guillaume-d)) | Toufik Airane ([toufik-airane](https://github.com/toufik-airane)) | Keith Hoodlet ([securingdev](https://github.com/securingdev)) | Sinner ([SoftwareSinner](https://github.com/SoftwareSinner)) | +| [iloving](https://github.com/iloving) | Jeroen Beckers ([TheDauntless](https://github.com/TheDauntless)) | Joubin Jabbari ([joubin](https://github.com/joubin)) | yu fujioka ([fujiokayu](https://github.com/fujiokayu)) | +| execjosh ([execjosh](https://github.com/execjosh)) | Alicja Kario ([tomato42](https://github.com/tomato42)) | Sidney Ribeiro ([srjsoftware](https://github.com/srjsoftware)) | Gabriel Marquet ([Gby56](https://github.com/Gby56)) | +| Drew Schulz ([drschulz](https://github.com/drschulz)) | [bedirhan](https://github.com/bedirhan) | [muralito](https://github.com/muralito) | Ronnie Flathers ([ropnop](https://github.com/ropnop)) | +| Philippe De Ryck ([philippederyck](https://github.com/philippederyck)) | Malte ([mal33](https://github.com/mal33)) | [MazeOfThoughts](https://github.com/MazeOfThoughts) | Andreas Falk ([andifalk](https://github.com/andifalk)) | +| Javi ([javixeneize](https://github.com/javixeneize)) | Daniel Hahn ([averell23](https://github.com/averell23)) | [borislav-c](https://github.com/borislav-c) | Robin Wood ([digininja](https://github.com/digininja)) | +| [miro2ns](https://github.com/miro2ns) | Jan Dockx ([jandockx](https://github.com/jandockx)) | [vipinsaini434](https://github.com/vipinsaini434) | [priyanshukumar397](https://github.com/priyanshukumar397) | +| Nat Sakimura ([sakimura](https://github.com/sakimura)) | Benjamin Häublein ([BenjaminHae](https://github.com/BenjaminHae)) | [unknown-user-from](https://github.com/unknown-user-from) | Ali Ramazan TAŞDELEN ([alitasdln](https://github.com/alitasdln)) | +| Pedro Escaleira ([oEscal](https://github.com/oEscal)) | Josh ([josh-hemphill](https://github.com/josh-hemphill)) | Tim Würtele ([SECtim](https://github.com/SECtim)) | AviD ([avidouglen](https://github.com/avidouglen)) | +| SheHacksPurple ([shehackspurple](https://github.com/shehackspurple)) | [fcerullo-cycubix](https://github.com/fcerullo-cycubix) | Hector Eryx Paredes Camacho ([heryxpc](https://github.com/heryxpc)) | Irene Michlin ([irene221b](https://github.com/irene221b)) | +| Jonah Y-M ([TG-Techie](https://github.com/TG-Techie)) | Dhiraj Bahroos ([bahroos](https://github.com/bahroos)) | Jef Meijvis ([jefmeijvis](https://github.com/jefmeijvis)) | [IzmaDoesItbeta](https://github.com/IzmaDoesItbeta) | +| Abdessamad TEMMAR ([TmmmmmR](https://github.com/TmmmmmR)) | [sectroyer](https://github.com/sectroyer) | Soh Satoh ([sohsatoh](https://github.com/sohsatoh)) | [regoravalaz](https://github.com/regoravalaz) | +| james-t ([james-bitherder](https://github.com/james-bitherder)) | Aram Hovsepyan ([aramhovsepyan](https://github.com/aramhovsepyan)) | [JaimeGomezGarciaSan](https://github.com/JaimeGomezGarciaSan) | [ValdiGit01](https://github.com/ValdiGit01) | +| iwatachan ([ishowta](https://github.com/ishowta)) | Vinod Anandan ([VinodAnandan](https://github.com/VinodAnandan)) | Kevin Kien ([KevinKien](https://github.com/KevinKien)) | [paul-williamson-swoop](https://github.com/paul-williamson-swoop) | +| [endergzr](https://github.com/endergzr) | Radhwan Alshamamri ([Rado0z](https://github.com/Rado0z)) | Grant Ongers ([rewtd](https://github.com/rewtd)) | Cure53 ([cure53](https://github.com/cure53)) | +| [AliR2Linux](https://github.com/AliR2Linux) | Ads Dawson ([GangGreenTemperTatum](https://github.com/GangGreenTemperTatum)) | William Reyor ([BillReyor](https://github.com/BillReyor)) | gabe ([gcrow](https://github.com/gcrow)) | +| [mascotter](https://github.com/mascotter) | [luissaiz](https://github.com/luissaiz) | Suren Manukyan ([vx-sec](https://github.com/vx-sec)) | Piotr Gliźniewicz ([pglizniewicz](https://github.com/pglizniewicz)) | +| Tadeusz Wachowski ([tadeuszwachowski](https://github.com/tadeuszwachowski)) | Nasir aka Nate ([andesec](https://github.com/andesec)) | [settantasette](https://github.com/settantasette) | Lars Haulin ([LarsH](https://github.com/LarsH)) | +| Terence Eden ([edent](https://github.com/edent)) | [JasmineScholz](https://github.com/JasmineScholz) | Arun Sivadasan ([teavanist](https://github.com/teavanist)) | Yusuf GÜR ([yusuffgur](https://github.com/yusuffgur)) | +| Troy Marshall ([troymarshall](https://github.com/troymarshall)) | Tanner Prynn ([tprynn](https://github.com/tprynn)) | Nick K. ([nickific](https://github.com/nickific)) | [raoul361](https://github.com/raoul361) | +| Azeem Ilyas ([TheAxZim](https://github.com/TheAxZim)) | Evo Stamatov ([avioli](https://github.com/avioli)) | Tim Potter ([timpotter87](https://github.com/timpotter87)) | Gavin Ray ([GavinRay97](https://github.com/GavinRay97)) | +| monis ([demideus](https://github.com/demideus)) | Marcin Hoppe ([MarcinHoppe](https://github.com/MarcinHoppe)) | Grambulf ([ramshazar](https://github.com/ramshazar)) | Jordan Pike ([computersarebad](https://github.com/computersarebad)) | +| Jason Rogers ([jason-invision](https://github.com/jason-invision)) | Ben Hall ([benbhall](https://github.com/benbhall)) | JamesPoppyCock ([jamesly123](https://github.com/jamesly123)) | WhiteHackLabs ([whitehacklabs](https://github.com/whitehacklabs)) | +| Alex Gaynor ([alex](https://github.com/alex)) | Filip van Laenen ([filipvanlaenen](https://github.com/filipvanlaenen)) | [jeurgen](https://github.com/jeurgen) | [GraoMelo](https://github.com/GraoMelo) | +| Andreas Kurtz ([ay-kay](https://github.com/ay-kay)) | Tom Tervoort ([TomTervoort](https://github.com/TomTervoort)) | old man ([deveras](https://github.com/deveras)) | Marco Schnüriger ([marcortw](https://github.com/marcortw)) | +| [stiiin](https://github.com/stiiin) | infoseclearn ([teaminfoseclearn](https://github.com/teaminfoseclearn)) | [hljupkij](https://github.com/hljupkij) | Noe ([nmarher](https://github.com/nmarher)) | +| Lyz ([lyz-code](https://github.com/lyz-code)) | Martin Riedel ([mrtnrdl](https://github.com/mrtnrdl)) | KIM Jaesuck ([tcaesvk](https://github.com/tcaesvk)) | Barbara Schachner ([bschach](https://github.com/bschach)) | +| René Reuter ([AresSec](https://github.com/AresSec)) | [carhackpils](https://github.com/carhackpils) | Tyler ([tyler2cr](https://github.com/tyler2cr)) | Hugo ([hasousa](https://github.com/hasousa)) | +| Wouter Bloeyaert ([Someniak](https://github.com/Someniak)) | Mark de Rijk ([markderijkinfosec](https://github.com/markderijkinfosec)) | Ramin ([picohub](https://github.com/picohub)) | Philip D. Turner ([philipdturner](https://github.com/philipdturner)) | +| Will Chatham ([willc](https://github.com/willc)) | | | | diff --git a/5.0/ko/0x00-Header.yaml b/5.0/ko/0x00-Header.yaml new file mode 100644 index 0000000000..735c53ade8 --- /dev/null +++ b/5.0/ko/0x00-Header.yaml @@ -0,0 +1,16 @@ +--- + title: "애플리케이션 보안 검증 표준" + subtitle: "Version 5.0.0" + date: May 2025 + titlepage: true + titlepage-rule-height: 0 + titlepage-logo: "images/owasp_logo_1c_notext.png" + table-use-row-colors: true + toc: true + toc-own-page: true + geometry: "left=2cm,right=2cm,top=3cm,bottom=3cm" + CJKmainfont: "Noto Sans CJK JP" + mainfont: "Source Serif 4" + sansfont: "Source Sans 3" +--- + diff --git a/5.0/ko/0x01-Frontispiece.md b/5.0/ko/0x01-Frontispiece.md new file mode 100644 index 0000000000..40d74253bf --- /dev/null +++ b/5.0/ko/0x01-Frontispiece.md @@ -0,0 +1,46 @@ +# 서문 + +## 표준 소개 + +애플리케이션 보안 검증 표준(Application Security Verification Standard; ASVS)은 아키텍트, 개발자, 테스터, 보안전문가, tool 공급업체, 소비자가 안전한 애플리케이션을 정의, 구축, 테스트 및 검증하는데 사용할 수 있는 애플리케이션 보안 요구 사항 목록이다. + +## 저작권 및 라이선스 + +Version 5.0.0, May 2025 + +![license](../images/license.png) + +Copyright © 2008-2025 The OWASP Foundation. + +본 문서는 [Creative Commons Attribution-ShareAlike 4.0 International License](https://creativecommons.org/licenses/by-sa/4.0/) 에 따라 배포된다. + +재사용 또는 배포 시, 본 작업물의 라이선스 조건을 명확하게 전달해야 한다. + +## 프로젝트 리드 + +| | | +|---------------------- |----------------- | +| Elar Lang | Josh C Grossman | +| Jim Manico | Daniel Cuthbert | + +## 작업 그룹 + +| | | | | +|---------------- |------------------ |------------------- |----------------- | +| Tobias Ahnoff | Ralph Andalis | Ryan Armstrong | Gabriel Corona | +| Meghan Jacquot | Shanni Prutchi | Iman Sharafaldin | Eden Yardeni | + +## 주요 기여자 + +| | | +|-------------------|-------------------| +| Sjoerd Langkemper | Isaac Lewis | +| Mark Carney | Sandro Gauci | + +## 기타 기여자 및 리뷰어 + +기타 기여자 목록은 부록 E에 포함되어 있다. + +5.x 버전의 크레딧 목록에 누락된 경우, GitHub에 티켓을 등록하면 향후 5.x 업데이트에서 반영될 수 있다. + +애플리케이션 보안 검증 표준은 ASVS 1.0(2008)부터 4.0(2019)에 이르기까지 참여한 이들의 작업을 기반으로 한다. 현재 ASVS에 남아 있는 많은 구조와 검증 항목은 Andrew van der Stock, Mike Boberski, Jeff Williams, Dave Wichers 등 여러 기여자에 의해 최초 작성되었다. 과거에 기여한 모든 분들께 감사의 뜻을 전한다. 이전 기여자에 대한 전체 목록은 각 버전의 문서를 참조한다. diff --git a/5.0/ko/0x02-Preface.md b/5.0/ko/0x02-Preface.md new file mode 100644 index 0000000000..307731c31b --- /dev/null +++ b/5.0/ko/0x02-Preface.md @@ -0,0 +1,29 @@ +# 머리말 + +애플리케이션 보안 검증 표준(ASVS) 5.0 버전에 오신 것을 환영한다. + +## 소개 + +2008년에 글로벌 커뮤니티 협력을 통해 처음 시작된 ASVS는 최신 웹 애플리케이션과 서비스를 설계, 개발 및 테스트하기 위한 포괄적인 보안 요구 사항을 정의한다. + +2019년 ASVS 4.0과 이은 2021년의 작은 업데이트(v4.0.3)의 출시에 이어서, 5.0 버전은 소프트웨어 보안의 최신 발전을 반영한 현대의 중요한 이정표와 같다. + +ASVS 5.0은 프로젝트 리더, 작업 그룹 구성원, 그리고 OWASP 전반의 커뮤니티가 광범위하게 업데이트하고 개선하기 위해 기여한 결과다. + +## 5.0 버전의 원칙 + +이 주요 개정판은 다음과 같은 몇 가지 주요 원칙을 염두에 두고 개발되었다: + +* 개선된 범위와 초점: 이 표준 버전은 애플리케이션, 보안, 검증 및 표준이라는 이름의 기본 토대를 보다 충실히 반영하도록 설계했다. 특정 기술 구현을 의무화하는 대신 보안 결함 예방을 강조하기 위해 요구 사항을 다시 작성했다. 요구 사항 내용에서는 왜 그런 요구 사항이 존재하는지 설명한다. + +* 보안 결정의 문서화: ASVS 5.0은 주요 보안 결정을 문서화하기 위한 요구 사항을 도입했다. 이를 통해 추적 가능성이 향상되고 상황에 맞춘 구현을 지원하여 조직이 특정 요구 사항과 위험 레벨에 맞게 보안 상태를 조정할 수 있도록 한다. + +* 개정된 레벨: ASVS는 3단계 모델을 유지하지만, 레벨의 정의는 ASVS를 더 쉽게 채택할 수 있도록 개정했다. 레벨 1은 ASVS를 채택하기 위한 초기 단계로 설계되어 첫 번째 방어 계층을 제공한다. 레벨 2는 표준 보안 관행에 대한 포괄적인 관점을 나타내며, 레벨 3은 높은 신뢰성을 보장하는 수준의 요구 사항을 다룬다. + +* 재구성 및 확장된 콘텐츠: ASVS 5.0에는 17개의 챕터에 걸쳐 약 350개의 요구 사항이 포함되어 있다. 챕터는 명확성과 사용성을 위해 재구성했다. 마이그레이션을 용이하게 하기 위해 v4.0과 v5.0 간의 양방향 매핑이 제공된다. + +## 앞으로의 방향 + +애플리케이션 보안에는 끝이 없듯이, ASVS도 마찬가지다. 버전 5.0은 주요 배포판이지만 개발은 계속되고 있다. 이번 배포판을 통해 더 폭넓은 커뮤니티가 축적된 개선 사항과 추가 사항의 혜택을 누릴 수 있을 뿐만 아니라 향후 개선을 위한 토대를 마련할 수 있다. 더욱이 핵심 요구 사항들을 기반으로 구현 및 검증 지침을 만들기 위한 커뮤니티 주도의 노력도 필요할 것이다. + +ASVS 5.0은 안전한 소프트웨어 개발을 위한 신뢰할 수 있는 기반으로 설계되었다. 커뮤니티는 애플리케이션 보안 상태를 종합적으로 발전시키기 위해 이 표준을 채택, 기여 및 구축할 것을 권장한다. diff --git a/5.0/ko/0x03-What-is-the-ASVS.md b/5.0/ko/0x03-What-is-the-ASVS.md new file mode 100644 index 0000000000..7fff77c2a6 --- /dev/null +++ b/5.0/ko/0x03-What-is-the-ASVS.md @@ -0,0 +1,195 @@ +# ASVS란 무엇인가? + +애플리케이션 보안 검증 표준(Application Security Verification Standard; ASVS)은 웹 애플리케이션 및 서비스의 보안 요구사항을 정의하며, 안전한 애플리케이션을 설계, 개발, 유지보수하거나 보안을 평가하는 모든 사람에게 유용한 자료이다. + +이 장은 ASVS 활용의 핵심 요소를 다루며, 여기에는 범위, 우선순위 기반 레벨 구조, 표준의 주요 사용 사례가 포함된다. + +## ASVS의 범위 + +ASVS의 범위는 명칭인 애플리케이션, 보안, 검증, 표준에 의해 정의된다. 이는 궁극적으로 달성해야 하는 보안 원칙을 식별하는 목표를 가지고 포함되거나 제외되는 요구사항을 설정한다. 또한 이 범위는 구현 요구사항의 토대 역할을 하는 문서화 요구사항을 고려한다. + +공격자에게는 범위라는 개념이 존재하지 않는다. 따라서 ASVS 요구사항은 CI/CD 프로세스, 호스팅, 운영 활동을 포함한 애플리케이션 수명 주기의 다른 측면에 대한 지침과 함께 평가되어야 한다. + +### 애플리케이션 + +ASVS는 "애플리케이션"을 보안 제어 기능이 통합되어야 하는 개발 중인 소프트웨어 제품으로 정의한다. ASVS는 개발 수명 주기 활동을 규정하거나 CI/CD 파이프라인을 통해 애플리케이션이 구축되는 방식을 지시하지 않는다. 대신 제품이 달성해야 하는 보안 목표를 명시한다. + +웹 애플리케이션 방화벽(Web Application Firewall; WAF), 로드 밸런서 또는 프록시와 같이 HTTP 트래픽을 처리, 수정 또는 검검증하는 구성 요소는 일부 보안 제어 기능이 해당 요소에 직접 의존하거나 해당 요소를 통해 구현될 수 있으므로 특정 목적을 위해 애플리케이션의 일부로 간주될 수 있다. 이러한 구성 요소는 캐시된 응답, 속도 제한 또는 원본과 대상에 기반한 인바운드(inbound) 및 아웃바운드(outbound) 연결 제한과 관련된 요구사항에 대해 고려되어야 한다. + +반대로 ASVS는 애플리케이션과 직접 관련이 없거나 구성이 애플리케이션의 책임 범위를 벗어나는 요구사항을 일반적으로 제외한다. 예를 들어, DNS 문제는 일반적으로 별도의 팀 또는 기능에 의해 관리된다. + +마찬가지로, 애플리케이션이 입력을 소비하고 출력을 생성하는 방식에 대한 책임이 있지만, 외부 프로세스가 애플리케이션 또는 해당 데이터와 상호작용을 하는 경우 ASVS의 범위를 벗어나는 것으로 간주한다. 예를 들어, 애플리케이션 또는 해당 데이터 백업은 일반적으로 외부 프로세스의 책임이며 애플리케이션 또는 개발자가 제어하지 않는다. + +### 보안 + +모든 요구사항은 보안에 실질적인 영향을 미쳐야 하며, 그 효과가 입증 가능해야 한다. 요구사항이 누락되면 애플리케이션의 보안 수준이 저하되며, 요구사항을 구현하면 보안 위험의 발생 가능성 또는 영향을 감소시켜야 한다. + +기능적 측면, 코드 스타일 또는 정책 요구사항과 같은 다른 모든 고려 사항은 범위에 포함되지 않는다. + +### 검증 + +해당 요구사항은 검증 가능해야 하며, 검증 결과는 "실패" 또는 "통과"여야 한다. + +### 표준 + +ASVS는 표준을 준수하기 위해 구현되어야 하는 보안 요구사항의 집합으로 설계되었다. 이는 요구사항이 해당 보안 목표를 달성하기 위한 보안 목표 정의에 제한된다는 의미이다. 기타 관련 정보는 ASVS를 기반으로 확장하거나, 매핑 문서를 통해 연결할 수 있다. + +특히 OWASP는 많은 프로젝트를 가지고 있으며, ASVS는 다른 프로젝트의 내용과 중복되는 것을 계획적으로 피한다. 예를 들어, 개발자는 "특정 기술 또는 환경에서 특정 요구사항을 어떻게 구현해야 하는가"라는 질문을 할 수 있으며, 이는 Cheat Sheet Series 프로젝트에서 다루어져야 한다. 검증자는 "이 환경에서 이 요구사항을 어떻게 테스트해야 하는가"라는 질문을 할 수 있으며, 이는 Web Security Testing Guide 프로젝트에서 다룬다. + +ASVS는 보안 전문가만이 사용하도록 의도된 것은 아니지만, 독자가 내용을 이해하거나 특정 개념을 조사하기 위해 필요한 기술적 지식을 갖추고 있음을 전제한다. + +### 요구사항 + +"요구사항"이라는 단어는 ASVS에서 이를 충족하기 위해 무엇을 달성해야 하는지를 설명하므로 특별히 사용된다. ASVS는 주요 조건으로서 요구사항(must)만 포함하며 권고 사항(should)은 포함하지 않는다. + +다시 말해, 권고 사항은 문제를 해결하기 위한 여러 가능한 옵션 중 하나이거나 코드 스타일 고려사항일 뿐 요구사항을 충족하지 않는다. + +ASVS 요구사항은 구현이나 기술에 너무 구애받지 않으면서도 존재하는 이유를 자명하게 설명하면서 특정 보안 원칙을 다루도록 의도되었다. 이는 또한 요구사항이 특정 검증 방법이나 구현을 중심으로 구축되지 않음을 의미한다. + +### 문서화된 보안 결정 + +소프트웨어 보안에서 보안 설계 및 사용할 메커니즘을 조기에 계획하면 완성된 제품 또는 기능에서 더 일관되고 신뢰할 수 있는 구현으로 이어진다. + +또한 특정 요구사항의 경우, 구현이 복잡하고 애플리케이션의 필요에 매우 특화될 수 있다. 일반적인 예시로는 권한, 입력 유효성 검사, 다양한 수준의 민감한 데이터에 대한 보호 제어 기능이 포함된다. + +이를 고려하여 "모든 데이터는 암호화되어야 한다"와 같은 포괄적인 진술이나 요구사항에서 모든 가능한 사용 사례를 아우르려고 하기보다는, 애플리케이션 개발자가 이러한 제어 기능을 어떻게 접근하고 구성하는지를 문서화하도록 요구하는 것이 포함되었다. 이렇게 문서화된 내용을 기반으로 적절성을 검토할 수 있으며, 실제 구현이 기대치와 일치하는지도 비교하여 평가할 수 있다. + +이러한 요구사항은 애플리케이션을 개발하는 조직이 특정 보안 요구사항을 구현하는 방법에 대해 내린 결정을 문서화하기 위한 것이다. + +문서화된 요구사항은 항상 장의 첫 번째 절에 위치하며 모든 장에 포함되는 것은 아니다. 또한 해당 내용이 실제로 구현되어야 한다는 관련 구현 요건이 항상 존재한다. 문서가 존재하는지를 검증하는 활동과, 그것이 실제로 구현되었는지를 검증하는 활동은 별개의 작업이다. + +이러한 요구사항을 포함하는 데에는 두 가지 주요 동인이 있다. 첫 번째 동인은 보안 요구사항이 종종 파일 유형 허용 범위, 적용해야 할 비즈니스 제어 기능, 특정 필드에 허용되는 문자 등 규칙 적용을 수반한다는 것이다. 이러한 규칙은 애플리케이션마다 다르므로 ASVS는 이를 규정적으로 정의할 수 없으며, 치트 시트 또는 더 자세한 응답도 이 경우에 도움이 되지 않는다. 마찬가지로, 이러한 결정이 문서화되지 않으면 이러한 결정을 구현하는 요구사항에 대한 검증을 수행할 수 없다. + +두 번째 동인은 특정 요구사항의 경우 특정 보안 과제를 해결하는 방법에 대해 애플리케이션 개발에 유연성을 제공하는 것이 중요하다는 것이다. 예를 들어, 이전 ASVS 버전에서는 세션 타임아웃 규칙이 매우 규정적이었다. 실용적으로 볼 때, 특히 소비자 대상 애플리케이션의 많은 경우 훨씬 더 완화된 규칙을 가지며 대신 다른 완화 제어 기능을 구현하는 것을 선호한다. 따라서 문서화 요구사항은 이에 대한 유연성을 명시적으로 허용한다. + +개별 개발자가 이러한 결정을 내리고 문서화할 것으로 기대되는 것은 아니다. 이러한 결정은 조직 전체가 내리고, 이를 개발자에게 전달하여 따르도록 하는 것이 바람직하다. + +개발자에게 새로운 기능에 대한 사양과 설계를 제공하는 것은 소프트웨어 개발의 표준적인 부분이다. 마찬가지로, 개발자는 매번 주관적으로 결정하기보다는 공통 컴포넌트와 사용자 인터페이스 메커니즘을 사용하는 것이 기대된다. 따라서 이를 보안에 확장하는 것은 놀랍거나 논란의 여지가 있는 것으로 간주되지 않아야 한다. + +이를 달성하는 방법에도 유연성이 있다. 보안 결정은 개발자가 참조해야 하는 문서 형태로 문서화될 수 있다. 또는 모든 개발자가 의무적으로 사용해야 하는 공통 코드 라이브러리에 보안 결정이 문서화되고 구현될 수 있다. 두 경우 모두 원하는 결과가 달성된다. + +## 애플리케이션 보안 검증 레벨 + +ASVS는 깊이와 복잡성이 증가하는 세 가지 보안 검증 레벨을 정의한다. 일반적인 목표는 조직이 가장 중요한 보안 문제를 해결하기 위해 첫 번째 레벨부터 시작한 다음, 조직 및 애플리케이션 요구사항에 따라 더 높은 레벨로 진행하는 것이다. 레벨은 문서와 요구사항 텍스트에서 L1, L2, L3로 표시될 수 있다. + +각 ASVS 레벨은 해당 레벨에서 달성해야 하는 보안 요구사항을 나타내며, 남은 더 높은 레벨의 요구사항은 권고 사항으로 간주된다. + +중복되는 요구사항이나 더 높은 레벨에서 더 이상 관련 없는 요구사항을 피하기 위해 일부 요구사항은 특정 레벨에 적용되지만, 더 높은 레벨에서는 더 엄격한 조건을 가진다. + +### 레벨 평가 + +레벨은 보안 요구사항 구현 및 테스트 경험을 바탕으로 각 요구사항을 우선순위에 따라 평가하여 정의된다. 주요 초점은 위험 감소와 요구사항 구현 노력 간의 비교에 있다. 또 다른 주요 요인은 진입 장벽을 낮게 유지하는 것이다. + +위험 감소는 요구사항이 애플리케이션 내 보안 위험 수준을 얼마나 줄이는지 고려하며, 고전적인 기밀성, 무결성, 가용성 영향 요인을 고려하고 이것이 주요 방어 계층인지 또는 심층 방어로 간주될 수 있는지를 고려한다. + +기준과 레벨링 결정에 대한 엄격한 논의 결과는 대부분의 경우에 유효해야 하는 할당이 도출되었지만, 모든 상황에 100% 적합하지 않을 수 있음을 인정한다. 이는 특정 경우에 조직이 자체적인 특정 위험 고려 사항에 따라 더 높은 레벨의 요구사항을 더 일찍 우선순위로 지정할 수 있음을 의미한다. + +각 레벨의 요구사항 유형은 다음과 같이 특징지어질 수 있다. + +### 레벨 1 + +이 레벨은 애플리케이션을 보호할 때 고려해야 할 최소 요구사항을 포함하며, 중요한 시작점을 나타낸다. 이 레벨은 ASVS 요구사항의 약 20%를 포함한다. 이 레벨의 목표는 가능한 한 적은 요구사항을 포함하여 진입 장벽을 낮추는 것이다. + +이러한 요구사항은 일반적으로 다른 취약점이나 사전 조건이 필요 없이 악용될 수 있는 일반적인 공격을 방지하기 위한 중요하거나 기본적인 첫 번째 방어 계층 요구사항이다. + +첫 번째 방어 계층 요구사항 외에도, 비밀번호 관련 요구사항과 같이 더 높은 레벨에서는 영향이 적은 일부 요구사항이 있다. 이러한 요구사항은 레벨 1에서 더 중요하며, 더 높은 레벨부터는 다중 요소 인증 요구사항이 관련성을 가진다. + +레벨 1은 내부 문서나 코드 접근 권한 없이(예: "블랙 박스(black box)" 테스트) 외부 테스터가 침투 테스트를 수행할 수 있는 것은 아니지만, 요구사항 수가 적으므로 검증이 더 쉬워야 한다. + +### 레벨 2 + +이러한 요구사항은 일반적으로 덜 흔한 공격 또는 일반적인 공격에 대한 더 복잡한 보호 기능과 관련된다. 이는 여전히 첫 번째 방어 계층일 수 있으며, 공격이 성공하기 위한 특정 사전 조건이 필요할 수 있다. + +이러한 요구사항은 일반적으로 덜 흔한 공격 또는 일반적인 공격에 대한 더 복잡한 보호 기능과 관련된다. 이는 여전히 첫 번째 방어 계층일 수 있으며, 공격이 성공하기 위한 특정 사전 조건이 필요할 수 있다. + +### 레벨 3 + +이 레벨은 최고 수준의 보안을 입증하고자 하는 애플리케이션의 목표가 되어야 하며, 준수해야 하는 나머지 약 30%의 요구사항을 제공한다. + +이 섹션의 요구사항은 일반적으로 심층 방어 메커니즘 또는 기타 유용하지만 구현하기 어려운 제어 기능이다. + +### 달성해야 할 레벨 + +우선순위 기반 레벨은 조직 및 애플리케이션의 애플리케이션 보안 성숙도를 반영하는 역할을 한다. ASVS가 애플리케이션이 어떤 레벨에 있어야 한다고 규정적으로 명시하기보다는, 조직은 애플리케이션의 민감도와 애플리케이션 사용자들의 기대치를 고려하여 자체 위험을 분석하고 어떤 레벨에 있어야 한다고 판단하는지 결정해야 한다. + +예를 들어, 제한된 민감 데이터를 수집하는 초기 스타트업은 초기 보안 목표로 레벨 1에 집중하기로 결정할 수 있지만, 은행은 온라인 뱅킹 애플리케이션에 대해 고객에게 레벨 3 미만의 수준을 정당화하기 어려울 수 있다. + +## ASVS 사용 방법 + +### ASVS의 구조 + +ASVS는 총 약 350개의 요구사항으로 구성되며, 이는 17개 장으로 나뉘고 각 장은 다시 섹션으로 세분된다. + +장 및 섹션 분할의 목표는 애플리케이션에 적합한 것을 기반으로 장 및 섹션을 선택하거나 필터링하는 것을 단순화하는 것이다. 예를 들어, 머신 투 머신(machine-to-machine) API의 경우 웹 프론트엔드와 관련된 V3 장의 요구사항은 관련성이 없을 것이다. OAuth 또는 WebRTC를 사용하지 않는다면 해당 장도 무시될 수 있다. + +### 릴리스 전략 + +ASVS 릴리스는 "Major.Minor.Patch" 패턴을 따르며, 숫자는 해당 릴리스 내에서 변경된 내용에 대한 정보를 제공한다. 주요 릴리스에서는 첫 번째 숫자가 변경되고, 마이너 릴리스에서는 두 번째 숫자가 변경되며, 패치 릴리스에서는 세 번째 숫자가 변경된다. + +* 주요 릴리스 - 전체 재편성, 요구사항 번호를 포함하여 거의 모든 것이 변경될 수 있다. 규정 준수 재평가가 필요하다 (예: 4.0.3 -> 5.0.0). +* 마이너 릴리스 - 요구사항이 추가되거나 제거될 수 있지만, 전체 번호는 동일하게 유지된다. 규정 준수 재평가가 필요하지만, 더 쉬워야 한다 (예: 5.0.0 -> 5.1.0). +* 패치 릴리스 - 요구사항이 제거되거나(예: 중복되거나 오래된 경우) 덜 엄격하게 변경될 수 있지만, 이전 릴리스를 준수했던 애플리케이션은 패치 릴리스 또한 준수할 것이다 (예: 5.0.0 -> 5.0.1). + +위 내용은 ASVS의 요구사항에 특별히 관련된다. 주변 텍스트 및 부록과 같은 다른 콘텐츠의 변경은 주요 변경(breaking change)으로 간주되지 않는다. + +### ASVS의 유연성 + +문서화 요구사항 및 레벨 메커니즘과 같이 위에서 설명된 여러 사항은 ASVS를 더 유연하고 조직 특유의 방식으로 사용할 수 있는 기능을 제공한다. + +또한 조직은 애플리케이션의 특정 특성 및 위험 수준에 따라 요구사항을 조정하는 조직 또는 도메인별 포크(fork)를 생성하는 것이 강력히 권장된다. 그러나 요구사항 4.1.1을 통과하는 것이 모든 버전에서 동일한 의미를 갖도록 추적성을 유지하는 것이 중요하다. + +이상적으로는 각 조직이 관련 없는 섹션(예: GraphQL, WebSockets, SOAP, 사용하지 않는 경우)을 생략하여 자체 맞춤형 ASVS를 생성해야 한다. 조직별 ASVS 버전 또는 보충 자료는 요구사항 준수 시 사용할 라이브러리 또는 리소스를 자세히 설명하는 조직별 구현 지침을 제공하기에도 좋은 장소이다. + +### ASVS 요구사항 참조 방법 + +각 요구사항은 .
. 형식의 식별자를 가지며, 각 요소는 숫자이다. 예를 들어, 1.11.3. + +* 값은 요구사항이 속한 장에 해당한다. 예를 들어, 모든 1.#.# 요구사항은 '인코딩 및 새니티제이션(Encoding and Sanitization)' 장에 속한다. +*
값은 해당 장 내에서 요구사항이 나타나는 섹션에 해당한다. 예를 들어: 모든 1.2.# 요구사항은 '인코딩 및 새니티제이션' 장의 '인젝션 방지(Injection Prevention)' 섹션에 속한다. +* 값은 장 및 섹션 내의 특정 요구사항을 식별한다. 예를 들어, 이 표준의 버전 5.0.0을 기준으로 1.2.5는 다음과 같다: + +> 애플리케이션이 OS 명령 주입(OS command injection)으로부터 보호하고 운영 체제 호출이 매개변수화된 OS 쿼리를 사용하거나 문맥별 명령줄 출력 인코딩을 사용하는지 검증한다. + +식별자는 표준 버전 간에 변경될 수 있으므로, 다른 문서, 보고서 또는 도구에서 다음 형식을 사용하는 것이 바람직하다: 'v-.
.' 여기서 'version'은 ASVS 버전 태그이다. 예를 들어: ‘v5.0.0-1.2.5'는 버전 5.0.0의 '인코딩 및 새니티제이션' 장의 '인젝션 방지' 섹션에 있는 특정 5번째 요구사항을 의미하는 것으로 이해될 것이다. (이는 v-로 요약될 수 있다.) + +참고: 형식의 버전 번호 앞에 오는 'v'는 항상 소문자여야 한다. + +식별자가 'v' 요소를 포함하지 않고 사용되는 경우, 이는 최신 애플리케이션 보안 검증 표준 콘텐츠를 참조하는 것으로 가정해야 한다. 표준이 성장하고 변경됨에 따라 이는 문제가 되므로, 작성자 또는 개발자는 버전 요소를 포함해야 한다. + +ASVS 요구사항 목록은 CSV, JSON 및 기타 형식으로 제공되며, 이는 참조 또는 프로그래밍적 사용에 유용할 수 있다. + +### ASVS 포크 + +조직은 세 가지 레벨 중 하나를 선택하거나 애플리케이션 위험 수준에 따라 요구사항을 조정하는 도메인별 포크를 생성하여 ASVS 채택으로부터 이점을 얻을 수 있다. 이러한 유형의 포크는 요구사항 4.1.1을 통과하는 것이 모든 버전에서 동일한 의미를 갖도록 추적성을 유지하는 경우 권장된다. + +이상적으로는 각 조직이 관련 없는 섹션(예: GraphQL, WebSockets, SOAP, 사용하지 않는 경우)을 생략하여 자체 맞춤형 ASVS를 생성해야 한다. 포크는 ASVS 레벨 1을 기준으로 시작하여 애플리케이션의 위험에 따라 레벨 2 또는 3으로 진행해야 한다. + +## ASVS의 사용 사례 + +ASVS는 애플리케이션의 보안을 평가하는 데 사용될 수 있으며, 이는 다음 장에서 더 자세히 다루어진다. 그러나 ASVS(또는 포크된 버전)의 다른 잠재적 사용 사례가 여러 가지 확인되었다. + +### 상세 보안 아키텍처 지침으로서 + +애플리케이션 보안 검증 표준의 더 일반적인 용도 중 하나는 보안 아키텍트(security architect)를 위한 자료로 활용되는 것이다. 특히 최신 애플리케이션에서 보안 애플리케이션 아키텍처를 구축하는 방법에 대한 자료는 제한적이다. ASVS는 데이터 보호 패턴 및 입력 유효성 검사 전략과 같은 일반적인 문제에 대해 보안 아키텍트가 더 나은 제어 기능을 선택할 수 있도록 하여 이러한 격차를 채우는 데 사용될 수 있다. 아키텍처 및 문서화 요구사항은 특히 이 용도에 유용할 것이다. + +### 전문 보안 코딩 참조 자료로서 + +ASVS는 애플리케이션 개발 중 보안 코딩 참조 자료를 준비하기 위한 기반으로 사용될 수 있으며, 개발자가 소프트웨어를 구축할 때 보안을 염두에 두도록 돕는다. ASVS가 기반이 될 수 있지만, 조직은 명확하고 통일된 자체적인 특정 지침을 준비하는 것이 권장되며, 이상적으로는 보안 엔지니어 또는 보안 아키텍트의 지침을 기반으로 준비되어야 한다. 이의 연장선상에서, 조직은 가능한 한 지침에 참조되고 개발자가 사용할 수 있는 승인된 보안 메커니즘 및 라이브러리를 준비하는 것이 권장된다. + +### 자동화된 단위 및 통합 테스트를 위한 가이드로서 + +ASVS는 높은 테스트 가능성을 가지도록 설계되었다. 일부 검증은 기술적일 수 있지만, 다른 요구사항(아키텍처 및 문서화 요구사항 등)은 문서 또는 아키텍처 검토를 필요로 할 수 있다. 기술적 수단으로 검증 가능한 요구사항과 관련된 특정 및 관련 악용 사례에 대해 테스트하고 퍼징(fuzzing)하는 단위(unit) 및 통합(integration) 테스트를 구축함으로써, 각 빌드에서 이러한 제어 기능이 올바르게 작동하는지 확인하기가 더 쉬워야 한다. 예를 들어, 로그인 컨트롤러의 테스트 스위트(test suite)에 대해 추가 테스트를 작성하여 일반적인 기본 사용자 이름, 계정 열거(account enumeration), 무차별 대입(brute forcing), LDAP 및 SQL 주입(injection), XSS에 대한 사용자 이름 매개변수를 테스트할 수 있다. 마찬가지로, 비밀번호 매개변수에 대한 테스트에는 일반적인 비밀번호, 비밀번호 길이, 널 바이트(null byte) 주입, 매개변수 제거, XSS 등이 포함되어야 한다. + +### 보안 개발 교육을 위해 + +ASVS는 보안 소프트웨어의 특성을 정의하는 데도 사용될 수 있다. 많은 "보안 코딩" 과정은 단순히 코딩 팁이 약간 섞인 윤리적 해킹 과정에 불과하다. 이는 개발자가 더 안전한 코드를 작성하는 데 반드시 도움이 되지 않을 수 있다. 대신, 보안 개발 과정은 하지 말아야 할 "Top 10"과 같은 부정적인 사항보다는 ASVS에서 발견되는 긍정적인 메커니즘에 강력히 초점을 맞춰 ASVS를 사용할 수 있다. ASVS 구조는 애플리케이션을 보호할 때 다양한 주제를 다루는 논리적인 구조 또한 제공한다. + +### 보안 소프트웨어 조달을 위한 프레임워크로서 + +ASVS는 보안 소프트웨어 조달 또는 맞춤형 개발 서비스 조달에 도움이 되는 훌륭한 프레임워크이다. 구매자는 조달하고자 하는 소프트웨어가 ASVS 레벨 X로 개발되어야 한다는 요구사항을 설정하고, 판매자에게 해당 소프트웨어가 ASVS 레벨 X를 충족함을 증명하도록 요청할 수 있다. + +## ASVS 실전 적용 + +다양한 위협은 각기 다른 동기를 가진다. 일부 산업은 고유한 정보 및 기술 자산과 도메인별 규제 준수 요구사항을 가진다. + +조직은 비즈니스 특성을 기반으로 고유한 위험 특성을 깊이 살펴보고, 해당 위험과 비즈니스 요구사항을 기반으로 적절한 ASVS 레벨을 결정하는 것이 강력히 권장된다. diff --git a/5.0/ko/0x04-Assessment_and_Certification.md b/5.0/ko/0x04-Assessment_and_Certification.md new file mode 100644 index 0000000000..902e350caf --- /dev/null +++ b/5.0/ko/0x04-Assessment_and_Certification.md @@ -0,0 +1,47 @@ +# 평가와 인증 + +## OWASP의 ASVS 인증과 신뢰 마크에 대한 입장 + +OWASP는 특정 공급업체나 검증자, 소프트웨어를 인증하지 않는 비영리 단체이다. 따라서 ASVS 준수를 주장하는 보증, 신뢰 마크, 인증은 OWASP가 공식적으로 승인한 것이 아니며, 조직은 제3자가 주장하는 ASVS 인증을 신중히 검토해야 한다. + +조직은 공식 OWASP 인증을 주장하지 않는 한, 보증 서비스를 제공할 수 있다. + +## ASVS 준수 여부를 검증하는 방법 + +ASVS는 테스트 가이드 수준에서 준수 여부를 정확히 검증하는 방법에 대해 구체적인 지침을 제공하지 않는다. 그러나 몇몇의 핵심 사항은 강조할 필요가 있다. + +### 검증 보고 + +전통적인 침투 테스트 보고서는 일반적으로 실패한 항목만을 나열하는 "예외 보고 방식"으로 작성된다. 그러나 ASVS 인증 보고서에는 점검 범위, 점검한 모든 요구사항에 대한 요약, 예외가 발생한 요구사항, 문제 해결 가이드를 포함해야 한다. 일부 요구사항은 적용되지 않을 수 있으며(예: 무상태 API(stateless API)에서의 세션 관리), 이러한 사항은 보고서에 반드시 명시해야 한다. + +### 검증 범위 + +애플리케이션을 개발하는 조직은 일반적으로 모든 요구사항을 구현하지 않으며, 이는 애플리케이션의 기능에 따라 일부 요구사항이 관련 없거나 중요도가 낮을 수 있기 때문이다. 검증자는 조직이 달성하려는 레벨과 포함된 요구사항을 명확히 하여 검증 범위를 분명히 해야 한다. 이때 검증 범위는 '포함하지 않은 항목'이 아닌, '포함한 항목'을 중심으로 기술하는 것이 권장된다. 또한 구현되지 않은 요구사항을 제외한 근거에 대한 의견도 함께 제시해야 한다. + +이는 검증 보고서의 수신자가 검증의 맥락을 이해하고, 애플리케이션에 어느 정도의 신뢰를 부여할 수 있을지에 대해 정보에 기반한 결정을 내릴 수 있도록 한다. + +인증 기관은 검증 방법을 자율적으로 선택할 수 있지만, 해당 방법은 보고서에 공개해야 하며 이상적으로는 반복 가능하도록 해야한. 입력 검증과 같은 항목을 확인하기 위해, 애플리케이션과 요구사항에 따라 수동 침투 테스트나 소스 코드 분석과 같은 다양한 방법이 사용될 수 있다. + +### 검증 메커니즘 + +특정 ASVS 요구사항을 검증하기 위해서는 다양한 기술이 필요할 수 있다. 유효한 자격 증명을 사용하여 애플리케이션 전체를 점검하는 침투 테스트 외에도, 문서, 소스 코드, 설정 정보, 개발 과정에 참여한 인력에 대한 접근이 요구될 수 있으며, 이는 특히 L2 및 L3 요구사항 검증에서 중요하다. 일반적으로는 작업 문서, 스크린샷, 스크립트, 테스트 로그 등을 포함한 상세한 문서를 통해 검증 결과에 대한 충분한 증거를 제공하는 것이 표준이다. 단순히 자동화 도구를 실행하는 것만으로는 충분하지 않으며, 각 요구사항은 반드시 검증 가능하게 테스트해야 한다. + +ASVS 요구사항을 검증하기 위한 자동화 도구의 사용은 지속적으로 관심을 받는 주제이다. 따라서 자동화 테스트 및 블랙박스 테스트와 관련된 몇 가지 사항을 명확히 하는 것이 중요하다. + +#### 자동화 보안 테스트 도구의 역할 + +동적 애플리케이션 보안 테스트(Dynamic Application Secure Test; DAST)와 정적 애플리케이션 보안 테스트(Static Application Secure Test; SAST)와 같은 자동화 보안 테스트 도구를 빌드 파이프라인에 올바르게 구현하면, 초기에 제거되었어야 할 일부 보안 문제를 식별할 수 있다. 그러나 신중하게 구성하고 조정하지 않으면 요구되는 범위를 충족하지 못하며, 과도한 노이즈로 인해 실제 보안 문제가 식별 및 완화되는 것을 방해하게 된다. + +이러한 도구들이 출력 인코딩이나 정제(sanitization)와 관련된 요구사항처럼 비교적 기본적이고 단순한 기술 요구사항 일부를 검증하는 데 도움이 될 수 있으나, 보다 복잡한 ASVS 요구사항이나 비즈니스 로직 및 접근 제어와 관련된 요구사항은 검증할 수 없다는 점을 명확히 인지해야 한다. + +복잡한 요구사항에 대해서도 자동화를 활용할 수 있는 가능성은 있으며, 이를 위해서는 애플리케이션 특화 검증 항목을 직접 작성해야 할 수 있다. 이러한 검증 항목은 조직에서 이미 사용 중인 단위 테스트(unit test)나 통합 테스트(integration test)와 유사할 수 있다. 따라서 기존의 테스트 자동화 인프라를 활용하여 ASVS 요구사항에 특화된 테스트를 작성할 수 있다. 이러한 작업에는 단기적인 투자가 필요하지만, 장기간 지속적으로 해당 요구사항을 검증할 수 있는 이점이 크다. + +요약하면, 자동화로 검증할 수 있다는 것은 시중 도구를 그대로 실행하는 것과 같지 않다. + +#### 침투 테스트의 역할 + +버전 4.0의 L1은 문서나 소스 코드 없이 수행되는 블랙박스 테스트에 최적화되어 있었으나, 당시에도 본 표준은 해당 방식이 효과적인 보증 활동이 아니며 적극적으로 지양되어야 한다는 점을 명시했다. + +필요한 추가 정보에 접근하지 못한 채 수행되는 테스트는 비효율적일 뿐 아니라 효과적인 보안 검증 방식도 아니다. 이런 방식은 소스 코드를 검토하거나, 위협 요소와 통제 공백을 식별하거나, 더 짧은 시간 안에 훨 더 철저한 테스트를 수행할 수 있는 기회를 놓치게 만든다. + +전통적인 침투 테스트보다는 애플리케이션 개발자와 문서에 완전하게 접근할 수 있는 문서 기반 또는 소스 코드 기반(하이브리드) 침투 테스트를 강력히 권장한다. 많은 ASVS 요구사항을 검증하려면 이러한 방식이 사실상 필수적이다. diff --git a/5.0/ko/0x05-For-Users-Of-4.0.md b/5.0/ko/0x05-For-Users-Of-4.0.md new file mode 100644 index 0000000000..adbec1f4f3 --- /dev/null +++ b/5.0/ko/0x05-For-Users-Of-4.0.md @@ -0,0 +1,90 @@ +# v4.x 대비 변경 사항 + +## 소개 + +4.x 버전에 익숙한 사용자는 내용, 범위 및 근본적인 철학의 변경을 포함하는 5.0 버전의 주요 변경 사항을 검토하는 것이 도움이 될 수 있다. + +버전 4.0.3의 286개 요구사항 중 변경되지 않은 것은 11개에 불과하며, 15개는 의미를 바꾸지 않는 범위에서 문법적으로 소폭 조정되었다. 총 109개(38%)의 요구사항은 더 이상 버전 5.0에서 별도의 요구사항으로 존재하지 않으며, 이 중 50개는 단순히 삭제되었고, 28개는 중복으로 제거되었으며, 31개는 다른 요구사항에 병합되었다. 나머지 요구사항들은 일부 수정되었다. 실질적인 수정이 이루어지지 않은 요구사항조차도 재배열이나 구조 변경으로 인해 식별자가 달라졌다. + +5.0 버전의 원활한 채택을 위해, 4.x 버전과 5.0 버전의 요구사항 간 대응 관계를 확인할 수 있는 매핑 문서를 제공한다. 이 매핑 문서는 출시 버전과 연동되지 않으며, 필요에 따라 업데이트되거나 보완될 수 있다. + +## 요구사항 철학 + +### 범위와 중점 + +버전 4.x에는 표준에서 정의한 범위와 맞지 않는 요구사항이 포함되어 있었으며, 이는 제거되었다. 5.0의 범위 기준에 부합하지 않거나 검증이 불가능한 요구사항 또한 제외되었다. + +### 보안 메커니즘보다 보안 목표에 중점 + +버전 4.x에서는 많은 요구사항이 근본적인 보안 목표보다 특정 메커니즘에 집중되어 있었다. 버전 5.0에서는 요구사항이 보안 목표에 중심을 두며, 특정 메커니즘은 유일한 실질적 해결책인 경우에만 참조하거나 예시 또는 보충 안내로 제공한다. + +이 접근법은 주어진 보안 목표를 달성하기 위해 여러 방법이 존재할 수 있음을 인정하며, 조직의 유연성을 제한할 수 있는 불필요한 규제를 지양한다. + +또한, 동일한 보안 문제를 다루는 요구사항은 적절한 경우 통합되었다. + +### 문서화된 보안 결정 + +문서화된 보안 결정이라는 개념은 버전 5.0에서 새롭게 등장한 것처럼 보이나, 이는 버전 4.0의 정책 적용과 위협 모델링 관련 요구사항의 진화된 형태이다. 이전에는 일부 요구사항이 허용된 네트워크 연결을 결정하는 등 보안 통제 구현을 위한 분석을 암묵적으로 요구하였다. + +구현과 검증에 필요한 정보가 확보되도록, 이러한 기대사항을 분명하고 실행 가능하며 검증 가능한 문서화 요구사항으로 명확히 정의한다. + +## 구조적 변화 및 신규 장 + +버전 5.0에서는 여러 장에서 완전히 새로운 내용을 도입하였다: + +* OAuth 및 OIDC – 접근 위임 및 싱글 사인온(single sign-on; SSO)을 위한 이러한 프로토콜의 광범위한 채택을 고려하여, 개발자가 직면할 수 있는 다양한 시나리오를 다루기 위한 전용 요구사항이 추가되었다. 이 영역은 이전 버전에서 모바일 및 IoT 요구사항을 별도로 분리했던 것처럼, 궁극적으로 독립적인 표준으로 발전할 수 있다. +* WebRTC – 이 기술의 보급이 확산됨에 따라, 고유한 보안 고려사항과 과제들을 별도의 섹션에서 다루고 있다. + +또한, 관련된 요구사항들을 논리적으로 묶어 장과 섹션을 구성하도록 개선하였다. + +이러한 구조 개편으로 인해 다음과 같은 신규 장이 추가되었다: + +* 자체 포함 토큰 – 기존에는 세션 관리 항목에 포함되었으나, 이제는 독립적인 메커니즘이자 OAuth 및 OIDC와 같은 무상태 통신의 기반 요소로 인식되어 별도의 장에서 다뤄진다. 고유한 보안 특성을 고려하여 전용 요구사항이 추가되었으며, 버전 5.x에서 일부 신규 요구사항이 도입되었다. +* 웹 프론트엔드 보안 – 브라우저 기반 애플리케이션의 복잡성이 증가하고 API 중심 아키텍처가 확산됨에 따라, 프론트엔드 보안 요구사항을 별도의 장으로 분리하였다. +* 시큐어 코딩 및 아키텍처 – 기존 장에 포함되지 않았던 일반적인 보안 관행에 대한 신규 요구사항을 이 장에 통합하였다. + +버전 5.0의 기타 구성 변경은 목적의 명확화를 위한 것이다. 예를 들어, 입력 검증 요구사항은 정제 및 인코딩 항목과의 연관성보다는 비즈니스 규칙을 강제하는 역할에 초점을 맞추어 비즈니스 로직과 함께 배치되었다. + +기존 V1 아키텍처 장은 삭제되었다. 서두에는 범위에서 벗어난 요구사항이 포함되어 있었고, 이후 섹션들은 관련 장으로 재배치되었으며, 요구사항은 중복 제거 및 명확화 작업이 이루어졌다. + +## 외부 표준과의 직접 매핑 제거 + +표준 본문에서는 외부 표준과의 직접 매핑이 제거되었다. 이는 OWASP Common Requirement Enumeration (CRE) 프로젝트와의 매핑을 준비하기 위한 것으로, 이를 통해 ASVS를 다양한 OWASP 프로젝트 및 외부 표준과 연결할 수 있도록 한다. + +아래에서 설명하는 바와 같이, CWE와 NIST에 대한 직접 매핑은 더 이상 유지되지 않는다. + +### NIST 디지털 신원 지침과의 결합도 감소 + +NIST [디지털 신원 지침(SP 800-63)](https://pages.nist.gov/800-63-3/)은 오랫동안 인증 및 권한 부여 제어의 참고 자료로 활용되어 왔다. 버전 4.x에서는 일부 장이 NIST의 구조와 용어에 밀접하게 정렬되어 있었다. + +이러한 지침은 여전히 중요한 참고 자료이지만, 지나치게 엄격한 정렬은 널리 통용되지 않는 용어 사용, 유사 요구사항의 중복, 불완전한 매핑과 같은 문제를 초래하였다. 버전 5.0에서는 명확성과 실효성을 높이기 위해 이러한 접근 방식을 지양한다. + +### CWE(Common Weakness Enumeration)와의 결합도 감소 + +[CWE(Common Weakness Enumeration)](https://cwe.mitre.org/)은 소프트웨어 보안 약점에 대한 유용한 분류 체계를 제공한다. 그러나 카테고리 전용 CWE, 단일 CWE에 대한 매핑의 어려움, 버전 4.x의 부정확한 매핑 등 여러 문제로 인해, 버전 5.0에서는 CWE와의 직접 매핑을 중단하기로 결정하였다. + +## 보안 수준 정의 재검토 + +버전 4.x에서는 L1("최소"), L2("표준"), L3("고급")으로 수준을 정의하고, 민감한 데이터를 처리하는 모든 애플리케이션은 최소한 L2를 충족해야 한다고 간주하였다. + +버전 5.0에서는 다음과 같은 단락에서 설명되는 여러 문제점을 해결하였다. + +실무적으로는, 버전 4.x에서 수준 표시로 사용되던 체크 마크 대신, 버전 5.x에서는 markdown, PDF, DOCX, CSV, JSON, XML 등 모든 형식에서 단순 숫자 표기를 사용한다. 하위 호환성을 위해, 기존 체크 마크 형식을 유지하는 CSV, JSON, XML 출력물도 함께 제공된다. + +### 진입 장벽 완화 + +레벨 1이 "최소 수준"으로 간주되면서도 대부분의 애플리케이션에 충분하지 않다는 인식, 그리고 약 120개의 요구사항이 포함된다는 점이 채택을 저해한다는 피드백이 있었다. 버전 5.0에서는 L1을 주로 1차 방어 계층 요구사항 중심으로 정의함으로써, 보다 명확하고 간결한 요구사항으로 진입 장벽을 낮추고자 하였다. 수치적으로는, v4.0.3에서는 전체 278개 중 128개가 L1로, 46%를 차지했으며, 5.0.0에서는 전체 345개 중 70개로, 20%에 해당한다. + +### 테스트 가능성의 오류 + +버전 4.x에서 레벨 1 요구사항을 선정하는 주요 기준은 외부 블랙박스 침투 테스트를 통한 평가 가능성이었다. 그러나 이러한 접근은 L1을 최소 보안 통제 집합으로 정의한 본래 목적과 완전히 부합하지 않았다. 일부 사용자는 L1이 보안을 보장하기에 부족하다고 보았고, 다른 사용자들은 테스트가 너무 어렵다고 평가하였다. + +테스트 가능성을 기준으로 삼는 것은 상대적일 뿐만 아니라 때로는 오해를 불러일으킨다. 요구사항이 테스트 가능하다는 사실이 자동화되거나 간단한 방식으로 테스트할 수 있음을 보장하지는 않는다. 더 나아가, 가장 쉽게 테스트할 수 있는 요구사항이 반드시 가장 큰 보안 효과를 가지거나 가장 구현이 용이한 요구사항인 것도 아니다. + +따라서 버전 5.0에서는 수준 결정 시 위험 감소 효과를 우선적으로 고려하되, 구현에 필요한 노력도 함께 고려하였다. + +### 위험 기반에만 의존하지 않는 접근 + +특정 애플리케이션에 대해 정해진 수준을 요구하는 위험 기반 접근은 지나치게 경직된 것으로 드러났다. 실제로 보안 통제의 우선순위 결정 및 구현은 위험 감소 효과뿐 아니라 구현 난이도 등 다양한 요소에 따라 달라진다. + +따라서 조직은 자신의 성숙도와 사용자에게 전달하려는 메시지에 따라 적절하다고 판단되는 수준을 달성하는 것이 권장된다. diff --git a/5.0/ko/0x10-V1-Encoding-and-Sanitization.md b/5.0/ko/0x10-V1-Encoding-and-Sanitization.md new file mode 100644 index 0000000000..04b9d94827 --- /dev/null +++ b/5.0/ko/0x10-V1-Encoding-and-Sanitization.md @@ -0,0 +1,103 @@ +# V1 인코딩과 데이터 정제 + +## 제어 목표 + +이번 장에서는 신뢰할 수 없는 데이터를 안전하지 않게 처리하여 발생하는 가장 흔한 웹 애플리케이션 보안 약점들을 다룬다. 이러한 약점들은 신뢰할 수 없는 데이터가 관련 인터프리터의 문법 규칙에 따라 해석되면서 다양한 기술적 취약점들로 이어질 수 있다. + +현대의 웹 애플리케이션에서는 파라미터화된 쿼리, 자동 이스케이핑, 또는 템플릿 프레임워크와 같은 더 안전한 API들을 쓰는 것이 항상 가장 좋다. 즉, 출력값 인코딩, 이스케이핑, 또는 데이터 정제를 신중하게 처리하는 것은 애플리케이션의 보안에 매우 중요하다. + +입력값 검증은 예상치 못한 입력이나 위험한 콘텐츠로부터 보호하기 위한 심층 방어(defense-in-depth) 메커니즘 역할을 한다. 다만, 입력값 검증의 주요 목적은 입력된 데이터가 기능 및 비즈니스 요구사항에 부합하는지를 확인하는 데 있으므로, 이에 관련된 요구사항은 "검증 및 비즈니스 로직" 장에서 다루고 있다. + +## V1.1 인코딩 및 데이터 정제 아키텍처 + +아래의 섹션에서는 위험한 콘텐츠를 안전하게 처리하여 보안 취약점을 방지하기 위한 문법 또는 인터프리터별 요구사항들이 제시된다. 이 요구사항들은 처리가 이루어져야 할 순서와 위치에 대한 내용도 포함하고 있다. 또한 데이터가 저장될 때 인코딩되거나 이스케이프된 형태(예: HTML 인코딩)가 아닌 원래의 상태로 저장되도록 보장함으로써 이중 인코딩 문제를 방지하는 데 목적이 있다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **1.1.1** | 입력값 검증은 오직 한 번만 표준 형태로 디코딩 되거나 언이스케이프 되어야 하며, 인코딩된 데이터가 예상될 때만 디코딩 되어야 한다. 이 과정은 입력이 추가로 처리되기 전에 완료되어야 한다. 예를 들어서 입력값 검증이나 데이터 정제 이후에는 수행되면 안 된다. | 2 | +| **1.1.2** | 애플리케이션이 출력값 인코딩 또는 이스케이핑을 인터프리터가 사용하기 전의 최종 단계로 수행하거나 인터프리터 자체에서 처리하는지 검증해야 한다. | 2 | + +## V1.2 인젝션(Injection) 방지 + +잠재적으로 위험 컨텍스트(context)에 인접하거나 가까운 위치에서 수행되는 출력값 인코딩이나 이스케이핑은 애플리케이션의 보안에 매우 중요하다. 일반적으로 출력값 인코딩과 이스케이핑은 저장되지 않으며, 대신 해당 출력값을 적절한 인터프리터에서 즉시 안전하게 렌더링하기 위해 사용된다. 이를 너무 이른 시점에 수행하려고 하면 콘텐츠가 잘못 구성되거나 인코딩 및 이스케이핑이 무효화될 수 있다. + +많은 경우에서 소프트웨어 라이브러리에는 이를 자동으로 처리하는 안전한 함수들이 포함되어 있지만 현재 컨텍스트에 적합한지 확인이 필요하다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **1.2.1** | HTTP 응답, HTML 문서 또는 XML 문서에 대한 출력값 인코딩이 해당 컨텍스트에 적절한지 검증해야 한다. 예를 들어, 메시지나 문서 구조가 변경되지 않도록 HTML 요소, HTML 속성, HTML 주석, CSS, HTTP 헤더 필드 등에 맞는 문맥별 문자 인코딩이 수행되어야 한다. | 1 | +| **1.2.2** | 통합 자원 식별자(Uniform Resource Locator; URL)들을 동적으로 생성할 때 신뢰할 수 없는 데이터가 해당 컨텍스트에 맞게 인코딩되었는지 검증해야 한다(예: 쿼리나 경로 파라미터에 대한 URL 인코딩 또는 base64url 인코딩). 또한, 오직 안전한 URL 프로토콜만이 허용되는지 검증해야 한다(예: javascript: 또는 data:를 허용하지 않음). | 1 | +| **1.2.3** | 동적으로 자바스크립트 콘텐츠(JSON 포함)를 생성할 때 메시지나 문서 구조를 바꾸는 것을 방지하기 위해 출력값 인코딩이나 이스케이핑이 사용되고 있는지 검증해야 한다(자바스크립트 또는 JSON 인젝션을 피하기 위함). | 1 | +| **1.2.4** | 데이터 선택 혹은 데이터베이스 쿼리(예: SQL, HQL, NoSQL, Cypher)들 파라미터화된 쿼리, 객체 관계 매핑(Object Relational Mapping; ORM), 엔티티 프레임워크, 또는 다른 구조화된 쿼리 언어(Structured Query Language; SQL) 인젝션 및 기타 데이터베이스 인젝션 공격으로부터 보호해 주는 것들을 사용하는지 검증해야 한다. 이는 저장 프로시저를 쓸 때도 마찬가지이다. | 1 | +| **1.2.5** | 애플리케이션이 운영체제(Operating System; OS) 명령 인젝션으로부터 보호되며 운영체제 호출 시 파라미터화된 OS 쿼리나 상황에 맞는 명령줄 출력값 인코딩을 사용하는지 검증해야 한다. | 1 | +| **1.2.6** | 애플리케이션이 경량 디렉터리 접근 프로토콜(Lightweight Directory Access Protocol; LDAP) 인젝션 취약점에 대해 보호되어 있는지, 또는 LDAP 인젝션을 방지하기 위한 특정 보안 통제가 구현되어 있는지 검증해야 한다. | 2 | +| **1.2.7** | 애플리케이션이 XPath 인젝션 공격을 쿼리 파라미터나 미리 컴파일된 쿼리들을 사용해 보호되고 있는지 검증해야 한다. | 2 | +| **1.2.8** | LaTeX 프로세서가 안전하게 구성되어 있으며("--shell-escape" 플래그 비사용 등) LaTeX 인젝션 공격을 방지하기 위해 허용된 명령어 목록이 사용되고 있는지 검증해야 한다. | 2 | +| **1.2.9** | 애플리케이션이 정규 표현식에서 특수 문자들을 메타 문자로 잘못 해석하는 것을 방지하기 위해 해당 문자들 이스케이프(보통 백슬래시를 사용)하고 있는지 검증해야 한다. | 2 | +| **1.2.10** | 애플리케이션이 쉼표 구분 데이터(Comma Separated Values; CSV) 및 수식 인젝션에 대해 보호되어 있는지 검증해야 한다. 그리고 애플리케이션은 CSV 콘텐츠를 내보낼 때 RFC 4180 2.6과 2.7 부분에 명시된 이스케이핑 규칙을 반드시 따라야 한다. 또한 CSV나 다른 스프레드시트 포맷(XLS, XLSX, ODF 등)으로 내보낼 때 필드 값의 첫 번째가 특수 문자('=', '+', '-', '@', '\t' (탭), '\0' (null 문자) 포함)라면 반드시 작은따옴표로 이스케이프되어야 한다. | 3 | + +참고: 파라미터화된 쿼리를 사용하거나 SQL을 이스케이핑만으로 항상 충분하지 않다. 테이블명과 컬럼명("ORDER BY" 컬럼 이름을 포함)과 같은 쿼리의 일부는 이스케이프 될 수 없다. 이러한 필드에 이스케이프된 사용자 입력 데이터를 포함하면 쿼리가 실패하거나 SQL 인젝션에 취약해질 수 있다. + +## V1.3 데이터 정제 + +신뢰할 수 없는 콘텐츠를 안전하지 않은 컨텍스트에서 사용하는 것을 이상적으로 방지하는 방법은 해당 컨텍스트에 맞는 인코딩 또는 이스케이핑을 사용하는 것이다. 이를 통해 안전하지 않은 콘텐츠의 시맨틱(semantic) 의미는 그대로 유지하면서 해당 컨텍스트를 안전하게 유지할 수 있다. 이에 대한 자세한 내용은 앞 부분에서 다루었다. + +이와 같은 처리가 불가능한 경우에 잠재적으로 위험한 문자나 콘텐츠를 제거하는 데이터 정제는 필수적이다. 일부 경우에 이로 인해 입력의 시맨틱 의미가 바뀔 수 있다. 그러나 보안상의 이유로 다른 대안이 없을 수 있다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **1.3.1** | 위지윅(WYSIWYG) 에디터나 이와 유사한 것으로부터 오는 모든 신뢰할 수 없는 HTML 입력들은 잘 알려지고 안전한 HTML 데이터 정제 라이브러리나 프레임워크 기능을 사용해 정제되는지 검증해야 한다. | 1 | +| **1.3.2** | 애플리케이션이 eval() 또는 스프링 표현 언어(Spring Expression Language; SpEL) 등과 같은 동적 코드 실행 기능 사용을 피하고 있는지 검증해야 한다. 대안이 없는 경우, 실행 전에 포함되는 모든 사용자 입력이 반드시 정제되어야 한다. | 1 | +| **1.3.3** | 잠재적으로 위험한 컨텍스트에 전달되는 데이터가 사전에 정제되어 안전 조치가 적용되는지 검증해야 한다. 예를 들어 해당 컨텍스트에서 안전한 문자만 허용하고 너무 긴 입력값은 잘라내는 등의 조치가 포함된다. | 2 | +| **1.3.4** | 사용자로부터 제공된 확장 가능한 벡터 그래픽(Scalable Vector Graphics; SVG)의 스크립트 실행 가능 콘텐츠가 애플리케이션에 안전한 태그 및 속성(예: 그래픽 그리기)만 포함하도록 검증 또는 정제되는지 검증해야 한다. 예를 들어 스크립트나 foreignObject는 포함되면 안 된다. | 2 | +| **1.3.5** | 애플리케이션이 사용자로부터 제공된 스크립트 실행 가능하거나 표현식 템플릿 언어(예: 마크다운, CSS, XSL 스타일시트, BBCode ) 콘텐츠를 정제하거나 비활성화하는지 검증해야 한다. | 2 | +| **1.3.6** | 애플리케이션이 서버측 요청 위조(Server-side Request Forgery; SSRF) 공격으로부터 보호하기 위해 신뢰할 수 없는 데이터를 프로토콜, 도메인, 경로, 포트의 허용 목록과 대조해 검증하고 다른 서비스를 호출하기 전에 잠재적으로 위험한 문자를 정제(sanitization)하는지 검증해야 한다. | 2 | +| **1.3.7** | 애플리케이션이 템플릿 인젝션 공격으로부터 보호하기 위해 신뢰할 수 없는 입력값을 기반으로 템플릿을 생성하지 않도록 하는지 검증해야 한다. 대안이 없는 경우에는 템플릿 생성 과정에서 동적으로 포함되는 모든 신뢰할 수 없는 입력값은 정제되거나 엄격히 검증되어야 한다. | 2 | +| **1.3.8** | 애플리케이션이 자바 명명 및 디렉터리 인터페이스(Java Naming and Directory Interface; JNDI) 쿼리에서 신뢰할 수 없는 입력값을 사용하기 전에 적절히 정제하고 JNDI가 JNDI 인젝션 공격을 방지할 수 있도록 안전하게 구성되어 있는지 검증해야 한다. | 2 | +| **1.3.9** | 인젝션을 방지하기 위해 애플리케이션이 메모리 캐시(memcache)에 콘텐츠를 전달하기 전에 해당 데이터를 정제하는지 검증해야 한다. | 2 | +| **1.3.10** | 사용 시 예상치 못하거나 악의적인 방식으로 작동할 수 있는 포맷 스트링(format string)들은 처리되기 전에 정제되는지 검증해야 한다. | 2 | +| **1.3.11** | 간이 전자 우편 전송 프로토콜(Simple Mail Transfer Protocol; SMTP)이나 인터넷 메시지 액세스 프로토콜(Internet Message Access Protocol; IMAP) 인젝션으로부터 보호하기 위해 애플리케이션이 사용자 입력을 메일 시스템으로 보내기 전에 정제를 하는지 검증해야 한다. | 2 | +| **1.3.12** | 정규 표현식에 지수형 백트래킹을 유발하는 요소가 없는지, 또한 신뢰할 수 없는 입력값을 정제하여 정규식 기반 서비스 거부 공격(Regular Expression Denial of Service; ReDoS) 또는 런어웨이(Runaway) 정규식 공격을 방지하는지 검증해야 한다. | 3 | + +## V1.4 메모리, 스트링, 비관리 코드 + +다음 요구사항들은 안전하지 않은 메모리 사용과 관련된 위험 요소들을 다루며 일반적으로 애플리케이션이 시스템 언어나 비관리 코드를 사용할 때 적용된다. + +일부 경우에는 컴파일러 플래그를 설정하여 버퍼 오버플로우 방지 및 경고 기능을 활성화함으로써 보호할 수 있다. 이에는 스택 무작위화, 데이터 실행 방지 등이 포함되고 위험한 포인터, 메모리, 포맷 문자열, 정수 또는 문자열 연산이 발견될 경우 빌드를 중단하도록 설정할 수도 있다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **1.4.1** | 애플리케이션이 스택, 버퍼, 또는 힙 오버플로를 탐지하거나 방지하기 위해 메모리 안전 문자열, 안전한 메모리 복사 및 포인터 산술을 사용하는지 검증해야 한다. | 2 | +| **1.4.2** | 정수 오버플로를 방지하기 위해 부호 확인, 범위 검사, 입력값 검증 등의 기법이 사용되고 있는지 검증해야 한다. | 2 | +| **1.4.3** | 댕글링 포인터(dangling pointer)나 해체 후 사용(Use After Free; UAF) 취약점을 방지하기 위해 동적으로 할당된 메모리와 자원이 적절히 해제되었는지 그리고 해제된 메모리를 참조하는 포인터나 참조가 제거되었거나 null로 설정되었는지를 검증해야 한다. | 2 | + +## V1.5 안전한 역직렬화 + +저장되었거나 전송된 데이터를 애플리케이션의 실제 객체로 변환하는 과정(역직렬화)은 역사적으로 다양한 코드 인젝션 취약점의 원인이 되어왔다. 이 과정을 조심스럽고 안전하게 수행하는 것은 이러한 종류의 문제를 피하는데 중요하다. + +특히, 일부 역직렬화 방법은 프로그래밍 언어나 프레임워크 문서에서 안전하지 않거나 신뢰할 수 없는 데이터를 안전하게 만들 수 없다고 지정되어 왔다. 사용 중인 각 메커니즘에 대해 신중한 검토(실사)를 수행해야 한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **1.5.1** | 애플리케이션이 확장 가능한 마크업 언어(eXtensible Markup Language; XML) 파서(parser)를 제한적인 설정으로 구성하고 외부 엔티티 해석과 같은 안전하지 않은 기능을 비활성화하여 XML 외부 엔티티(XML eXternal Entity; XXE) 공격을 방지하는지 검증해야 한다. | 1 | +| **1.5.2** | 역직렬화 공격을 방지하기 위해 신뢰할 수 없는 데이터의 역직렬화 시 객체 타입 허용 목록 사용 또는 클라이언트 정의 객체 타입 제한과 같은 안전한 입력 처리 방식이 적용되는지 검증해야 한다. 또한 명확히 안전하지 않은 것으로 지정된 역직렬화 메커니즘은 신뢰할 수 없는 입력에 대해 반드시 사용해서는 안 된다. | 2 | +| **1.5.3** | 애플리케이션에서 동일한 데이터 타입(예: JSON 파서, XML 파서, URL 파서)에 대해 사용되는 서로 다른 파서들이 일관된 방식으로 파싱(parsing)을 수행하고 동일한 문자 인코딩 방식을 사용하는지 검증해야 한다. 이를 통해 JSON 상호운용 취약점이나 원격 파일 포함(Remote File Inclusion; RFI) 및 SSRF 공격에서 악용될 수 있는 서로 다른 URI 또는 파일 파싱 동작 문제를 방지할 수 있다. | 3 | + +## 참조 + +자세한 내용은 다음을 참고: + +* [OWASP LDAP 인젝션 방지 치트 시트(Cheat Sheet)](https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html) +* [OWASP 사이트 간 스크립팅(Cross Site Scripting; XSS) 방지 치트 시트](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) +* [OWASP 문서 객체 모델(Document Object Model; DOM) 기반 XSS 방지 치트 시트](https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html) +* [OWASP XXE 방지 치트 시트](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html) +* [OWASP 웹 보안 테스트 가이드: 클라이언트 측 테스트](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/11-Client-side_Testing) +* [OWASP 자바 인코딩 프로젝트](https://owasp.org/owasp-java-encoder/) +* [DOMPurify - 클라이언트 측 HTML 정제 라이브러리](https://github.com/cure53/DOMPurify) +* [RFC4180 - CSV 파일의 공통 포맷(format) 및 다목적 인터넷 메일 확장(Multipurpose Internet Mail Extensions; MIME) 타입](https://datatracker.ietf.org/doc/html/rfc4180#section-2) + +역직렬화 또는 파싱 문제에 대한 자세한 내용은 다음을 참고: + +* [OWASP 역직렬화 치트 시트](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) +* [JSON 상호운용 취약점 탐구](https://bishopfox.com/blog/json-interoperability-vulnerabilities) +* [Orange Tsai – 트렌딩(Trending) 프로그래밍 언어의 URL 파서를 악용한 SSRF의 새로운 시대](https://www.blackhat.com/docs/us-17/thursday/us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf) diff --git a/5.0/ko/0x11-V2-Validation-and-Business-Logic.md b/5.0/ko/0x11-V2-Validation-and-Business-Logic.md new file mode 100644 index 0000000000..afaa9d6412 --- /dev/null +++ b/5.0/ko/0x11-V2-Validation-and-Business-Logic.md @@ -0,0 +1,73 @@ +# V2 유효성 검증 및 비즈니스 로직 + +## 제어 목표 + +이번 장에서는 검증된 애플리케이션이 아래와 같은 상위 수준의 목표를 충족하는지 확인하는 것이 목표이다. + +* 애플리케이션에 입력되는 값은 비즈니스 및 기능 요구사항에 부합한다. +* 비즈니스 로직은 정해진 순서에 따라 순차적으로 실행되며, 특정 단계를 건너뛰거나 우회할 수 없다. +* 비즈니스 로직에는 지속적인 소액 송금이나 한 번에 친구 백만 명 추가와 같은 자동화된 공격을 탐지하고 방지하기 위한 제한 및 제어 기능이 포함되어 있다. +* 핵심적인 비즈니스 로직은 악용 사례와 악의적인 공격자를 고려하여 설계되었으며, 스푸핑, 데이터 위변조, 정보 유출, 권한 상승 공격에 대한 보호 조치를 갖추고 있다. + +## V2.1 유효성 검증 및 비즈니스 로직 문서화 + +유효성 검증 및 비즈니스 로직 관련 문서는 애플리케이션에 구현해야 할 사항을 명확히 하기 위해서 비즈니스 로직의 제한 사항, 유효성 검증 규칙, 그리고 여러 데이터 항목 간의 문맥적 일관성을 명확하게 정의해야 한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **2.1.1** | 애플리케이션 문서에 데이터 항목이 예상되는 구조에 부합하는지 확인하는 입력값 유효성 검증 규칙이 정의되어 있는지 확인한다. 이는 신용카드 번호, 이메일 주소, 전화번호와 같은 일반적인 데이터 형식일 수도 있고, 내부적으로 사용하는 데이터 형식일 수도 있다. | 1 | +| **2.1.2** | 애플리케이션 문서에 연관된 데이터 항목들 간의 논리적, 문맥적 일관성을 검증하는 방법이 정의되어 있는지 검증한다. 예를 들어서 세부 주소와 우편번호가 서로 일치하는지 확인하는 경우가 이에 해당한다. | 2 | +| **2.1.3** | 비즈니스 로직의 제한사항 및 유효성 검증에 대한 요구사항이 사용자별 기준과 애플리케이션 전체에 적용되는 전역적 기준을 모두 포함하여 문서화되어 있는지 검증한다. | 2 | + +## V2.2 입력값 검증 + +효과적인 입력값 검증은 애플리케이션이 받아들이고자 하는 데이터의 유형에 관한 비즈니스 또는 기능적 요구사항을 강제하는 제어 기능이다. 이를 통해 데이터 품질을 높이고 공격 표면을 줄일 수 있다. 하지만 이는 데이터를 다른 컴포넌트에서 사용하거나 출력용으로 표시할 때 필요한 올바른 인코딩, 매개변수화, 또는 정제의 필요성을 대체하거나 없애주는 것은 아니다. + +이 문맥에서 “입력값”이란 HTML 양식 필드, REST 요청, URL 매개변수, HTTP 헤더, 쿠키, 디스크의 파일, 데이터베이스, 외부 API 등 매우 다양한 출처로부터 유입될 수 있는 데이터를 의미한다. + +예를 들어, 비즈니스 로직 제어는 특정 입력값이 100보다 작은 숫자인지를 확인할 수 있다. 반면 기능적 기대사항은 특정 숫자가 정해진 임계값 이하인지 검사할 수 있다. 이는 해당 숫자가 특정 루프의 반복 횟수를 제어하는 역할을 하며, 값이 지나치게 크면 과도한 처리 부하로 인해 서비스 거부(DoS) 상태를 초래할 수 있기 때문이다. + +스키마 유효성 검증(schema validation)이 명시적으로 의무화된 것은 아니지만, JSON이나 XML을 사용하는 HTTP API 또는 기타 인터페이스에서 입력 전체에 대한 포괄적인 유효성 검증을 수행하는 데 가장 효과적인 방법이 될 수 있다. + +스키마 검증에 대한 아래 사항들에 유의해야 한다: + +* JSON 스키마 검증 사양의 "공식 배포 버전"은 운영 환경에서 사용 가능할 정도로 안정적이지만, 엄밀히 말해 "완전히 안정된" 상태는 아니다. +* 사용 중인 JSON 스키마 검증 라이브러리도, 표준이 공식화되면 이를 반영하여 모니터링하고 필요시 업데이트해야 한다. +* DTD(문서 타입 정의) 검증은 사용해서는 안 되며, 프레임워크의 DTD 평가 기능은 반드시 비활성화해야 한다. 이는 DTD를 악용한 XXE(XML 외부 개체) 공격을 방지하기 위함이다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **2.2.1** | 입력값에 대한 비즈니스 또는 기능적인 기대치를 충족하기 위해서 입력값의 유효성을 검증해야 한다. 이는 허용 값, 패턴 및 범위 목록에 대한 긍정적 검증을 사용하거나, 미리 정의된 규칙에 따라 입력값을 예상 구조 및 논리적 한계와 비교하여 검증해야 한다. L1의 경우, 특정 비즈니스 또는 보안 결정을 내리는 데 초점을 맞출 수 있다. L2 이상의 경우에는 모든 입력값에 적용해야 한다. | 1 | +| **2.2.2** | 애플리케이션이 신뢰할 수 있는 서비스 계층에서 입력값 유효성 검사를 시행하도록 설계되었는지 확인해야 한다. 클라이언트 측 유효성 검사는 사용성을 향상시키므로 권장해야 하지만, 보안 제어 수단으로 의존해서는 안된다. | 1 | +| **2.2.3** | 사전 정의된 규칙에 따라 관련 데이터 항목의 조합이 합리적인지 애플리케이션에서 확인해야 한다. | 2 | + +## V2.3 비즈니스 로직 보안 + +이 챕터에서는 애플리케이션이 비즈니스 로직 프로세스를 올바른 방식으로 적용하고 애플리케이션의 로직과 흐름을 악용하는 공격에 취약하지 않은지 확인하기 위한 핵심 요구 사항을 고려한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **2.3.1** | 애플리케이션이 예상되는 순차적 단계 순서에 따라 동일한 사용자에 대한 비즈니스 로직 흐름만 처리하고 단계를 건너뛰지 않는지 확인한다. | 1 | +| **2.3.2** | 비즈니스 로직 결함이 악용되는 것을 방지하기 위해서 애플리케이션 문서에 따라 비즈니스 로직 제한이 구현되었는지 확인한다. | 2 | +| **2.3.3** | 비즈니스 로직 수준에서 트랜잭션이 사용되고 있는지 확인하여 비즈니스 로직 작업이 완전히 성공하거나 이전의 올바른 상태로 롤백되는지 확인한다. | 2 | +| **2.3.4** | 제한된 양의 리소스(ex. 극장 좌석이나 배송 시간대)가 애플리케이션의 로직을 조작하여 이중으로 예약되는 것을 방지하기 위해서 비즈니스 로직 수준 잠금 메커니즘이 사용되는지 확인한다. | 2 | +| **2.3.5** | 핵심적인 비즈니스 로직 흐름에 무단 또는 우발적인 행위를 방지하기 위해서 다중 사용자 승인이 필요한지 확인해야 한다. 이는 거액 자금 이체, 계약 승인, 기밀 정보 접근, 제조 과정의 안전 무시 등이 포함될 수 있지만, 이에 국한되지는 않는다. | 3 | + +## V2.4 자동화 방지 + +이 섹션은 인간과 유사한 상호작용을 요구하고, 과도한 자동화 요청을 방지하기 위한 자동화 방지 제어 기능들을 포함한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **2.4.1** | 데이터 유출, 더미 데이터 생성, 할당량 소진, 속도 제한 위반, 서비스 거부(DoS), 핵심적인 리소스의 과다 사용으로 이어질 수 있는 애플리케이션 기능에 대한 과도한 호출을 방어하기 위해, 자동화 방지 제어 기능이 구현되어 있는지 검증한다. | 2 | +| **2.4.2** | 비즈니스 로직의 각 단계가 실제 사람이 수행하는 데 필요한 현실적인 시간을 요구하여, 비정상적으로 빠른 속도의 트랜잭션 제출을 방지하는지 검증한다. | 3 | + +## 참조 + +자세한 내용은 다음을 참고한다. + +* [OWASP Web Security Testing Guide: Input Validation Testing](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/README.html) +* [OWASP Web Security Testing Guide: Business Logic Testing](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/10-Business_Logic_Testing/README) +* Anti-automation can be achieved in many ways, including the use of the [OWASP Automated Threats to Web Applications](https://owasp.org/www-project-automated-threats-to-web-applications/) +* [OWASP Input Validation Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html) +* [JSON Schema](https://json-schema.org/specification.html) diff --git a/5.0/ko/0x12-V3-Web-Frontend-Security.md b/5.0/ko/0x12-V3-Web-Frontend-Security.md new file mode 100644 index 0000000000..27e1ebdeb7 --- /dev/null +++ b/5.0/ko/0x12-V3-Web-Frontend-Security.md @@ -0,0 +1,100 @@ +# V3 웹 프론트엔드 보안 + +## 제어 목표 + +이번 장에서는 웹 프론트엔드를 통해 수행되는 공격으로부터 보호하기 위한 요구사항에 초점을 둔다. 이러한 요구사항은 기계 간 통신(M2M) 솔루션에는 적용되지 않는다. + +## V3.1 웹 프론트엔드 보안 문서 + +이 섹션에서는 애플리케이션의 공식 문서에서 알려줘야 할 브라우저 내 보안 특징들에 대해 설명한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **3.1.1** | 애플리케이션 공식 문서에서 애플리케이션이 반드시 지원해야 하는, 예상되는 보안 특징들을 서술하고 있는지 확인한다. (예: HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP), 그리고 다른 관련된 HTTP 보안 메커니즘들). 또한 문서에서 앞선 특징들(유저에게나 경고하거나 접속을 막는 등의)이 유효하지 않을 때 애플리케이션이 어떻게 행동하는지 반드시 정의해야 한다. | 3 | + +## V3.2 의도하지 않은 콘텐츠 접근 + +잘못된 콘텐츠나 기능을 불러오는 작업은 위협적인 콘텐츠를 실행하거나 불러오는 결과를 초래한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **3.2.1** | 브라우저가 HTTP 응답에 대해 콘텐츠나 기능을 불러올 때, 의도하지 않은 상황이 보안적으로 통제되고 있는지 확인한다(예: API, 유저가 올린 파일, 혹은 다른 리소스에 직접 접근 시). Content-Security-Policy 헤더 필드의 샌드박스 지시어를 사용하거나, Content-Disposition 헤더 필드 내의 attachment disposition 타입을 사용하는 등으로, 불필요한 HTTP 요청 헤더 필드 (Sec-Fetch-* 와 같은)를 제공하지 않을 수 있다. | 1 | +| **3.2.2** | 콘텐츠가 HTML로 렌더링되지 않고 텍스트로 표시되도록 하여, HTML이나 JavaScript 등의 의도하지 않은 실행을 방지하는 안전한 렌더링 함수(예: createTextNode, textContent)를 사용하는지 확인한다. | 1 | +| **3.2.3** | 애플리케이션이 클라이언트 사이드 JavaScript를 사용할 때, 명시적 변수 사용, 엄격한 타입 검사, 문서에서의 전역 변수 저장 지양, 그리고 네임스페이스 격리 구현 등으로 DOM 클로버링을 막고 있음을 확인한다. | 3 | + +## V3.3 쿠키 설정 + +이 섹션에서는 민감한 쿠키를 설정할 때, 애플리케이션 자체에서 만들어졌고, 콘텐츠 내용이 새어 나가거나, 부적절한 수정이 되는 것을 막는 등의 더 높은 수준의 보안을 제공하기 위한 요구사항에 대해 설명한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **3.3.1** | 쿠키가 'Secure' 속성을 가지며, 쿠키 이름에 '\__Host-' 접두사가 사용되지 않았고, '__Secure-' 접두사를 사용했는지 확인한다. | 1 | +| **3.3.2** | UI redress 공격, 그리고 CSRF라 알려진 브라우저 기반 요청 위조 공격들에 대한 노출을 제한하기 위해 각 쿠키의 'SameSite' 속성 값이 쿠키의 목적에 맞게 설정되어 있는지 확인한다. | 2 | +| **3.3.3** | 다른 호스트들과 명시적으로 공유되는 쿠키에 대해서, '__Host-' 접두사를 가지고 있는지 확인한다. | 2 | +| **3.3.4** | 클라이언트 측 스크립트에서 쿠키의 값에 접근이 가능한 걸 의도하지 않았다면(세션 토큰 등), 쿠키는 반드시 'HttpOnly' 속성을 가져야 하고, 반드시 'Set-Cookie' 헤더 필드를 통해 클라이언트에게 전달돼야 한다. | 2 | +| **3.3.5** | 애플리케이션이 쿠키를 만들 때, 쿠키 이름과 값의 길이 합이 4096바이트를 넘지 않는지 확인한다. 너무 큰 쿠키는 브라우저에 저장되지 않으며, 요청 전달도 안되고, 해당 쿠키에 의존하는 애플리케이션 기능을 사용하지 못하게 된다. | 3 | + +## V3.4 브라우저 보안 메커니즘 헤더 + +이 섹션에서는 브라우저 보안 기능들을 활성화하기 위해 HTTP 응답에 설정되어야 할 보안 헤더들과, 애플리케이션에서의 응답들을 다루기 위한 제한사항들에 대해 설명한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **3.4.1** | 이 섹션에서는 애플리케이션의 응답을 처리할 때 브라우저의 보안 기능과, 제한 사항을 활성화하기 위해 HTTP 응답에 설정해야 하는 보안 헤더를 설명한다. | 1 | +| **3.4.2** | 교차 출처 리소스 공유(CORS)의 Access-Control-Allow-Origin 헤더 필드가 애플리케이션의 고정 값인지 확인한다. 만약 출처 Origin HTTP 요청 헤더 필드 값을 사용하고 있다면, 신뢰할 수 있는 출처 목록으로 검증한다. 'Access-Control-Allow-Origin: *' 사용이 필요할 때엔, 응답이 민감한 정보를 포함하지 않는지 확인한다. | 1 | +| **3.4.3** | HTTP 응답이 Content-Security-Policy 응답 헤더 필드를 가지고 있는지 확인한다. 이는 브라우저가 신뢰하는 콘텐츠나 리소스만 불러오고 실행하도록 하고, 위험한 JavaScript의 실행을 제한한다. 최소한, object-src 'none' 과 base-uri 'none'이라는 지침, 그리고 허용 목록을 정의하거나 논스, 해쉬의 사용을 포함한다는 전역 정책은 반드시 사용돼야 한다. 3계층 애플리케이션의 경우에는, 논스나 해쉬가 적용된 응답별 정책이 반드시 정의돼야 한다. | 2 | +| **3.4.4** | 모든 HTTP 응답이 'X-Content-Type-Options: nosniff' 헤더 필드를 포함하는지 확인해야 한다. 이는 브라우저들이 주어진 응답에 대해 콘텐츠 스니핑과 MIME 타입 추측을 하지 않도록, 응답의 Content-Type 헤더 필드 값을 목적지 리소스와 일치하도록 지시한다. 예를 들어서, 응답의 Content-Type이 'text/css'인 스타일만 허용된다고 치자. 이는 기능적으로 브라우저의 Cross-Origin Read Blocking (CORB) 사용 또한 활성화시킨다. | 2 | +| **3.4.5** | 'Referer' HTTP 요청 헤더 필드를 통해 제 3자 서비스들에 기술적으로 민감한 정보 누출을 막기 위해, 애플리케이션에서 리퍼러 정책을 설정했는지 확인해야 한다. 이는 Referrer-Policy HTTP 응답 헤더 필드나 HTML 속성 항목을 통해 설정할 수 있다. 민감한 데이터는 URL에 있는 경로나 쿼리 데이터, 그리고 내부 비공개 애플리케이션의 경우 hostname도 포함된다. | 2 | +| **3.4.6** | 웹 애플리케이션이 Content-Security-Policy 헤더 필드의 frame-ancestors를 사용해 모든 HTTP 응답들에 대해 기본적으로 내부 삽입을 할 수 없고, 필요할 때만 특정 리소스에 대해 내부 삽입을 허용하도록 확인한다. X-Frame-Options 헤더 필드가 브라우저에서 지원되더라도, 오래돼서 신뢰할 수 없음을 알아야 한다. | 2 | +| **3.4.7** | Content-Security-Policy 헤더 필드에 위반 사항을 보고할 영역이 특정되어 있는지 확인해야 한다. | 3 | +| **3.4.8** | 문서 렌더링을 시작하는 모든 HTTP 요청(Content-Type text/html과 같은 응답)에 same-origin 지시어나 same-origin-allow-popups이 있는 Cross‑Origin‑Opener‑Policy 헤더 필드를 포함하는지 확인해야 한다. 이는 탭내빙(tabnabbing) 및 프레임 카운팅과 같은 Window 객체에 대한 공유 액세스를 악용하는 공격을 방지할 수 있다. | 3 | + +## V3.5 브라우저 출처 구분 + +서버 측에서 민감한 기능에 대한 요청을 수락할 때, 애플리케이션은 그 요청이 애플리케이션 자체나 신뢰할 수 있는 당사자에 의해 시작되었는지, 공격자에 의해 위조되지 않았는지 확인해야 한다. + +이 섹션에서, 민감한 기능에는 인증된 사용자와 인증되지 않은 사용자의 form post 수락(인증 요청 등), 상태 변경 작업 또는 리소스를 많이 소모하는 기능(데이터 내보내기 등)이 포함된다. + +여기서 핵심 보호 장치는 JavaScript의 동일 출처 정책과 쿠키의 SameSite 로직과 같은 브라우저 보안 정책이다. 또 다른 일반적인 보호 장치는 CORS preflight 메커니즘이다. 이 메커니즘은 다른 출처에서 호출되도록 설계된 엔드포인트에 치명적이지만, 다른 출처에서 호출되도록 설계되지 않은 엔드포인트에 대한 요청 위조 방지 메커니즘으로 유용하게 사용된다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **3.5.1** | 애플리케이션이 허용되지 않은 교차 출처 요청을 통한 민감한 기능의 사용을 막기 위해 CORS preflight 메커니즘에 의존하지 않는지 확인하고, 이런 요청이 애플리케이션 자체에서 시작된건지 증명해야 한다. 이는 anti-forgery 토큰의 사용과 증명이나 CORS-safelisted 요청 헤더 필드가 아닌 확장 HTTP 헤더 필드를 요구하는 것으로 가능하다. 사이트 간 요청 위조 공격(CSRF)으로 알려진 브라우저 기반의 요청 위조 공격에 대한 방어다. | 1 | +| **3.5.2** | 애플리케이션이 민감한 기능의 허용되지 않은 교차 출처 사용을 막기 위해 CORS preflight 메커니즘에 의존하고 있다면, CORS preflight 요청을 작동하지 않는 요청을 호출할 수 있는지 확인해야 한다. 이는 'Origin'과 'Content-Type' 요청 헤더 필드 값을 확인하거나 CORS-safelisted 헤더 필드가 아닌 확장 필드 사용에 대한 확인이 필요하다. | 1 | +| **3.5.3** | 민감한 기능이 HTTP 요청으로 POST, PUT, PATCH, DELETE와 같은 적절한 HTTP 방식을 사용하는지, HEAD, OPTIONS, 또는 GET처럼 HTTP 사양이 "안전"으로 정의되지 않는 방식을 사용하는지 확인한다. 또는 Sec-Fetch-* 요청 헤더 필드의 엄격한 검증을 사용하여 요청이 부적절한 교차 출처 호출, 탐색 요청 또는 이미지 소스와 같은 리소스 로드에서 발생하지 않았는지 확인할 수 있다. | 1 | +| **3.5.4** | 서로 다른 호스트 이름에 별도의 애플리케이션이 호스팅되어 있는지 확인하여 동일한 출처 정책에서 제공하는 제한 사항을 활용한다. 여기에는 한 출처에서 불러온 문서나 스크립트가 다른 출처의 리소스와 상호 작용할 수 있는 방법과 쿠키에서의 호스트 이름 기반 제한 사항이 포함된다. | 2 | +| **3.5.5** | postMessage 인터페이스를 통해 수신한 메시지의 출처를 신뢰할 수 없거나, 구문이 유효하지 않은 경우, 수신한 메시지가 폐기되는지 확인한다. | 2 | +| **3.5.6** | Cross-Site Script Inclusion (XSSI) 공격을 피하기 위해, 애플리케이션 아무 곳에서나 JSONP 기능이 활성화되지 않는지 확인한다. | 3 | +| **3.5.7** | Cross-Site Script Inclusion (XSSI) 공격을 방지하기 위해 JavaScript 파일과 같은 스크립트 리소스 응답에 승인이 필요한 데이터가 포함되지 않았는지 확인한다. | 3 | +| **3.5.8** | 인증된 리소스(예: 이미지, 비디오, 스크립트 및 기타 문서)가 의도된 경우에만 사용자를 대신하여 불러와지거나 내장될 수 있는지 확인한다. 이는 Sec-Fetch-* HTTP 요청 헤더 필드를 엄격하게 검증하여 요청이 부적절한 교차 출처 호출에서 발생하지 않았는지 확인하거나 브라우저에 반환된 콘텐츠를 차단하도록 지시하는 제한적인 교차 출처 리소스 정책 HTTP 응답 헤더 필드를 설정하여 달성할 수 있다. | 3 | + +## V3.6 외부 리소스 무결성 + +이 섹션은 외부 사이트에서 콘텐츠를 안전하게 호스팅하기 위한 지침을 제공한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **3.6.1** | 클라이언트 측 자산(예: JavaScript 라이브러리, CSS 또는 웹 폰트)이 정적이고 버전이 지정된 경우에만 외부(예: 콘텐츠 전송 네트워크)로만 호스팅되는지 확인하고, 하위 리소스 무결성(SRI)을 사용하여 자산의 무결성을 검증한다. 이것이 불가능하다면 각 리소스에 대해 이를 정당화하기 위해 문서화된 보안 결정이 필요하다. | 3 | + +## V3.7 다른 브라우저 보안 고려사항 + +이 섹션은 클라이언트 측 브라우저 보안을 위해 요구되는 다양한 보안 통제와 현대 브라우저 보안 특징들을 포함한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **3.7.1** | 애플리케이션이 여전히 지원되고 안전하다고 간주되는 클라이언트 측 기술만 사용하는지 확인한다. 이 요구 사항을 충족하지 않는 기술의 예로는 NSAPI 플러그인, Flash, Shockwave, ActiveX, Silverlight, NACL 또는 클라이언트 측 Java applets가 있다. | 2 | +| **3.7.2** | 애플리케이션이 사용자를 통제하지 못하는 다른 호스트 이름이나 도메인으로 자동으로 리다이렉션할 때, 허용된 목적지로만 리다이렉션 하는지 확인한다. | 2 | +| **3.7.3** | 사용자가 애플리케이션의 통제 범위를 벗어난 URL로 리다이렉션 될 때 이를 취소할 수 있는 옵션이 있는 알림이 애플리케이션에 표시되는지 확인한다. | 3 | +| **3.7.4** | 애플리케이션의 최상위 도메인(예: site.tld)가 공공 HSTS preload 목록에 추가되었는지 확인한다. 이렇게 하면 애플리케이션에 TLS를 사용하는 것이 Strict-Transport-Security 응답 헤더 필드에만 의존하지 않고 메인 브라우저에 직접 내장된다. | 3 | +| **3.7.5** | 애플리케이션에 접근하는 브라우저가 예상한 보안 특징을 가지고 있지 않은 경우, 애플리케이션이 문서에 명시된 대로 동작하는지 확인한다 (유저에게 경고하거나 접근을 차단하는 등). | 3 | + +## 참조 + +더 많은 정보는 다음을 참조한다. + +* [Set-Cookie __Host- prefix details](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#cookie_prefixes) +* [OWASP Content Security Policy Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html) +* [OWASP Secure Headers Project](https://owasp.org/www-project-secure-headers/) +* [OWASP Cross-Site Request Forgery Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html) +* [HSTS Browser Preload List submission form](https://hstspreload.org/) +* [OWASP DOM Clobbering Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/DOM_Clobbering_Prevention_Cheat_Sheet.html) diff --git a/5.0/ko/0x13-V4-API-and-Web-Service.md b/5.0/ko/0x13-V4-API-and-Web-Service.md new file mode 100644 index 0000000000..5ce32bd148 --- /dev/null +++ b/5.0/ko/0x13-V4-API-and-Web-Service.md @@ -0,0 +1,64 @@ +# V4 API 와 WEB 서비스 + +## 제어 목표 + +웹 브라우저나 다른 클리어언트에서 사용하기 위해서 API를 노출하는 애플리케이션 (일반적으로 JSON, XML, GraphQL 사용)에는 몇 가지 특별히 고려해야 할 사항이 적용된다. 이번 장에서는 관련 보안 설정과 적용해야할 매커니즘에 대해 다룬다. + +다른 장에서 다루는 인증, 세션 관리, 입력값 검증과 관련된 문제들은 API에도 동일하게 적용되므로, 이 챕터의 내용을 전체 맥락에서 벗어나 개별적으로 테스트해서는 안 된다는 점에 유의해야 한다. + +## V4.1 일반적인 웹 서비스 보안 + +이 섹션은 일반적인 웹 서비스 보안 고려사항과 기본적인 웹 서비스 보안 수칙에 대해서 다룬다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **4.1.1** | 메세지 본문이 포함된 모든 HTTP 응답에는 실제 내용과 일치하는 Content-Type 헤더 필드가 포함되어 있는지 검증한다. 이때 IANA 미디어 타입(text, /+xml, /xml 등)에 따라 안전한 문자 인코딩 (ex. UTF-8, ISO-8859-1)을 지정하는 charset 파라미터도 포함되어야 한다. | 1 | +| **4.1.2** | 사용자가 대면하는 엔드포인트(사람이 직접 웹 브라우저에 접속하는 경우)만 HTTP에서 HTTPS로 자동 리디렉션하고, 그 외에 서비스나 API 엔드포인트는 명백한 리디렉션을 구현하지 않았는지 검증한다. 이는 클라이언트가 실수로 암호화되지 않은 HTTP 요청을 보내고 있음에도, 요청이 자동으로 HTTPS로 리디렉션되어 민감한 데이터의 유출 사실을 발견하지 못하게 되는 상황을 방지하기 위함이다. | 2 | +| **4.1.3** | 로드 밸런서, 웹 프록시, 백엔드-프론트엔드 서비스 등 중간 계층에서 설정되며, 애플리케이션에서 사용하는 모든 HTTP 헤더 필드를 사용자가 재정의할 수 없는지 확인한다. 예를 들어 X-Real-IP, X-Frowarded-*, X-User-ID 등의 헤더가 포함될 수 있다. | 2 | +| **4.1.4** | 애플리케이션이나 API에서 명시적으로 지원하는 HTTP 메서드(프리플라이트 요청 시에 OPTIONS 포함)만 사용할 수 있으며, 사용되지 않는 메서드는 차단되어 있는지 확인한다. | 3 | +| **4.1.5** | 매우 민감하거나 여러 시스템을 거치는 요청이나 거래에 대한 전송 계층 보호에 더하여 메세지별 디지털 서명들을 사용함으로써 추가적인 보증을 제공하는지 확인한다. | 3 | + +## V4.2 HTTP 메세지 구조 검증 + +이번 섹션은 지나치게 긴 HTTP 메세지를 통한 요청 smuggling, 응답 분할, 헤더 인젝션, 그리고 DOS와 같은 공격을 방지하기 위해 HTTP 메세지의 구조와 헤더 필드를 어떻게 검증해야 하는지를 설명한다. + +이러한 요구 사항은 일반적인 HTTP 메세지 처리 및 생성과 관련이 있지만, 서로 다른 HTTP버전 간에 HTTP 메세지를 변환할 때 특히 중요하다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **4.2.1** | 모든 애플리케이션 구성 요소(로드 밸런서, 방화벽, 애플리케이션 서버 포함)가 HTTP 요청 smuggling을 예방하는 HTTP 버전의 적합한 메커니즘을 사용하는지에 대해, 수신되는 HTTP 메세지의 끝을 결정하는지 확인한다. HTTP/1.x에서 Transfer-encoding 헤더 필드가 있는 경우에 RFC 2616에 따라서 Content-Length 헤더는 무시해야 한다. HTTP/2 또는 HTTP/3를 사용할 때 Content-Length 헤더 필드가 있는 경우에 수신기는 DATA 프레임의 길이와 일치하는지 확인해야 한다. | 2 | +| **4.2.2** | HTTP 메세지를 생성할 때, 요청 smuggling 공격을 예방하기 위해서 HTTP 프로토콜의 프레이밍 방식에 의해 결정된 Content의 길이와 Content-Length 헤더 필드가 충돌하지 않는지 확인한다. | 3 | +| **4.2.3** | 응답 분할 및 헤더 인젝션 공격을 예방하기 위해서 애플리케이션이 Transfer-encoding과 같은 connection-specific 헤더 필드를 가진 HTTP/2또는 HTTP/3 메세지를 전송하거나 수락하지 않는지 확인한다. | 3 | +| **4.2.4** | 헤더 인젝션 공격을 예방하기 위해서, 애플리케이션이 헤더 이름과 값에 CR(\r), LF(\n), CRLF(\r\n)과 같은 줄바꿈 문자가 포함되어 있지 않은 HTTP/2 및 HTTP/3 요청만 허용하는지 확인한다. | 3 | +| **4.2.5** | 애플리케이션(백엔드 또는 프론트엔드)이 요청을 빌드하고 전송하는 경우, 수신 구성 요소가 수학하기에는 너무 긴 URI(ex. API 호출) 또는 HTTP 요청 헤더 필드(ex. Authorization 또는 Cookie)를 생성하지 않도록 검증, 검열 또는 기타 메커니즘을 사용하는지 확인한다. 이로 인해서 지나치게 긴 요청(ex. 긴 쿠키 헤더 필드)을 보낼 때와 같이 서비스 거부가 발생하여 서버가 항상 오류 상태로 응답할 수 있다. | 3 | + +## V4.3 GraphQL + +GraphQL은 다양한 백엔드 서비스와 긴밀하게 연결되지 않은 데이터가 풍부한 클라이언트를 만드는 방법으로, 점점 일반화 되고 있다. 이 섹션에서는 GraphQL의 보안 고려 사항을 다룬다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **4.3.1** | 쿼리 허용 목록, 깊이 제한, 양 제한 또는 쿼리 비용 분석을 사용하여 값비싼 중첩 쿼리로 인해 GraphQL 또는 데이터 계층 표현식 거부(DOS)를 방지하는지 확인한다. | 2 | +| **4.3.2** | GraphQL API가 다른 사용자에 의해 사용되지 않는 한, 운영 환경에서 GraphQL 점검 쿼리들이 비비활성화되어 있는지 확인한다. | 2 | + +## V4.4 WebSocket + +WebSocket은 단일 TCP 연결을 통해 동시에 양방향 통신 채널을 제공하는 통신 프로토콜이다. 2011년에 IETF에 의해 RFC 6455로 표준화되었으며, HTTP 포트 443 및 80에서 동작하도록 설계되었음에도 불구하고 HTTP와는 다르다. + +이 섹션에서는 실시간 통신 채널을 악용하는 통신 보안 및 세션 관리와 관련된 공격을 방지하기 위한 주요 보안 요구 사항을 제공한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **4.4.1** | 모든 WebSocket 연결에 WebSocket over TLS(WSS)이 사용되는지 확인한다. | 1 | +| **4.4.2** | 초기 HTTP WebSocket Handshake 중에 기존 헤더 필드가 애플리케이션에 허용된 기존 목록과 대조되는지 확인한다. | 2 | +| **4.4.3** | 애플리케이션의 표준 세션 관리를 사용할 수 없는 경우, 관련 세션 관리 보안 요구 사항을 준수하는 전용 토큰이 사용되고 있는지 확인한다. | 2 | +| **4.4.4** | 기존 HTTPS 세션을 WebSocket 채널로 전환할 때 이전에 인증된 HTTPS 세션을 통해 전용 WebSocket 세션 관리 토큰을 처음 얻거나 검증하는지 확인한다. | 2 | + +## 참조 + +자세한 내용은 다음을 참고한다: + +* [OWASP REST Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html) +* Resources on GraphQL Authorization from [graphql.org](https://graphql.org/learn/authorization/) and [Apollo](https://www.apollographql.com/docs/apollo-server/security/authentication/#authorization-methods). +* [OWASP Web Security Testing Guide: GraphQL Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/12-API_Testing/01-Testing_GraphQL) +* [OWASP Web Security Testing Guide: Testing WebSockets](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/11-Client-side_Testing/10-Testing_WebSockets) diff --git a/5.0/ko/0x14-V5-File-Handling.md b/5.0/ko/0x14-V5-File-Handling.md new file mode 100644 index 0000000000..d079b2cabc --- /dev/null +++ b/5.0/ko/0x14-V5-File-Handling.md @@ -0,0 +1,54 @@ +# V5 파일 처리 + +## 제어 목표 + +파일을 사용하는 것은 서비스 거부, 무단 접근 및 저장 공간 고갈을 포함하여 애플리케이션에 다양한 위험을 초래할 수 있다. 이 장은 이러한 위험을 해결하기 위한 요구사항을 포함한다. + +## V5.1 파일 처리 문서화 + +이 섹션은 관련 보안 검사를 개발하고 검증하기 위한 필수 전제 조건으로 애플리케이션이 허용하는 파일의 예상 특성을 문서화하는 요구사항을 포함한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **5.1.1** | 업로드 기능별로 허용되는 파일 형식, 예상되는 파일 확장자, 그리고 최대 크기(압축 해제된 크기 포함)가 문서에 정의되어 있는지 검증해야 한다. 또한, 악성 파일이 탐지될 때 애플리케이션이 어떻게 동작하는지와 같이, 최종 사용자가 파일을 안전하게 다운로드하고 처리할 수 있도록 하는 방법이 문서에 명시되어 있는지 확인해야 한다. | 2 | + +## V5.2 파일 업로드 및 콘텐츠 + +파일 업로드 기능은 신뢰할 수 없는 파일의 주요 소스이다. 이 섹션은 이러한 파일의 존재, 볼륨 또는 내용이 애플리케이션에 해를 끼치지 않도록 보장하기 위한 요구사항을 설명한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **5.2.1** | 애플리케이션이 성능 저하나 서비스 거부 공격(Denial of Service; DoS)을 유발하지 않고 처리할 수 있는 크기의 파일만 허용하는지 검증해야 한다. | 1 | +| **5.2.2** | 애플리케이션이 파일 자체 또는 zip 파일과 같은 아카이브 내에서 파일을 허용할 때, 파일 확장자가 예상 파일 확장자와 일치하는지 확인하고 내용이 확장자로 표현된 유형과 일치하는지 확인하는지 검증해야 한다. 여기에는 초기 '매직 바이트(magic bytes)' 확인, 이미지 재작성 수행, 파일 내용 유효성 검사를 위한 전문 라이브러리 사용이 포함되지만 이에 국한되지 않는다. L1의 경우, 특정 비즈니스 또는 보안 결정을 내리는 데 사용되는 파일에만 집중할 수 있다. L2 이상에서는 허용되는 모든 파일에 적용되어야 한다 | 1 | +| **5.2.3** | 애플리케이션이 압축 파일(예: zip, gz, docx, odt)을 압축 해제하기 전에 허용되는 최대 압축 해제 크기와 최대 파일 수를 확인하는지 검증해야 한다. | 2 | +| **5.2.4** | 단일 사용자가 너무 많은 파일이나 과도하게 큰 파일로 저장 공간을 채우지 않도록 사용자별 파일 크기 할당량(quota) 및 최대 파일 수가 적용되는지 검증해야 한다. | 3 | +| **5.2.5** | 애플리케이션이 심볼릭 링크(symlink)를 포함하는 압축 파일 업로드를 허용하지 않는지 검증해야 한다. 단, 이러한 기능이 특별히 요구되는 경우에는 심볼릭 링크할 수 있는 파일의 허용 목록(allowlist)을 강제하는 것이 필요하다. | 3 | +| **5.2.6** | 픽셀 플러드 공격(Pixel Flood Attack)을 방지하기 위해, 애플리케이션이 업로드된 이미지의 픽셀 크기가 허용된 최대값보다 큰 경우 해당 이미지를 거부하는지 검증해야 한다. | 3 | + +## V5.3 파일 저장 + +이 섹션은 업로드 후 파일이 부적절하게 실행되는 것을 방지하고, 위험한 콘텐츠를 탐지하며, 신뢰할 수 없는 데이터가 파일 저장 위치를 제어하는 데 사용되지 않도록 하기 위한 요구사항을 포함한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **5.3.1** | 신뢰할 수 없는 입력으로 업로드되거나 생성되어 공개 폴더에 저장된 파일이 HTTP 요청으로 직접 접근될 때 서버 측 프로그램 코드로 실행되지 않는지 검증해야 한다. | 1 | +| **5.3.2** | 애플리케이션이 파일 작업을 위한 파일 경로를 생성할 때, 사용자 제출 파일명 대신 내부적으로 생성되거나 신뢰할 수 있는 데이터를 사용하는지 검증해야 한다. 만약 사용자 제출 파일명 또는 파일 메타데이터를 반드시 사용해야 한다면, 경로 탐색(path traversal), 로컬 또는 원격 파일 포함(Local File Inclusion; LFI, Remote File Inclusion; RFI), 그리고 서버 측 요청 위조(Server-side Request Forgery; SSRF) 공격으로부터 보호하기 위해 엄격한 유효성 검사 및 정제(Sanitization)가 적용되는지 확인해야 한다. | 1 | +| **5.3.3** | 파일 압축 해제와 같은 서버 측 파일 처리가 zip slip과 같은 취약점을 방지하기 위해 사용자 제공 경로 정보를 무시하는지 검증해야 한다. | 3 | + +## V5.4 파일 다운로드 + +이 섹션은 경로 탐색 및 삽입 공격을 포함하여 파일을 다운로드할 때 위험을 완화하기 위한 요구사항을 포함한다. 또한 위험한 콘텐츠를 포함하지 않도록 하는 것도 포함된다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **5.4.1** | 애플리케이션이 JSON, JSONP 또는 URL 파라미터를 포함한 사용자 제출 파일명을 검증하거나 무시하는지 검증해야 하고, 응답의 Content-Disposition 헤더 필드에 파일명을 명시하는지 검증해야 한다. | 2 | +| **5.4.2** | 제공되는 파일 이름(예: HTTP 응답 헤더 필드 또는 이메일 첨부 파일)이 문서 구조를 보존하고 삽입 공격(Injection Attack)을 방지하기 위해 인코딩되거나 정제되는지 검증해야 한다. (예: RFC 6266 준수)| 2 | +| **5.4.3** | 신뢰할 수 없는 소스에서 얻은 파일이 알려진 악성 콘텐츠 제공을 방지하기 위해 안티바이러스 스캐너에 의해 검사되는지 검증해야 한다. | 2 | + +## 참조 + +더 많은 정보는 다음을 참고한다: + +* [OWASP File Upload Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html) +* [Example of using symlinks for arbitrary file read](https://hackerone.com/reports/1439593) +* [Explanation of "Magic Bytes" from Wikipedia](https://en.wikipedia.org/wiki/List_of_file_signatures) diff --git a/5.0/ko/0x15-V6-Authentication.md b/5.0/ko/0x15-V6-Authentication.md new file mode 100644 index 0000000000..f68a83f162 --- /dev/null +++ b/5.0/ko/0x15-V6-Authentication.md @@ -0,0 +1,166 @@ +# V6 인증 + +## 제어 목표 + +인증은 개인이나 장치의 진위를 확립하거나 확인하는 과정이다. 이는 사용자가 주장하는 신원을 검증하고, 위장 행위(impersonation)에 대한 저항성을 보장하며, 비밀번호의 복구나 가로채기를 방지하는 것을 포함한다. + +[NIST SP 800-63](https://pages.nist.gov/800-63-3/)은 전 세계 조직에 유용한 현대적이고 증거 기반의 표준이나, 특히 미국 정부 기관 및 그와 상호작용하는 조직에 매우 관련성이 높다. + +이 장의 요구사항 중 많은 것은 표준의 두 번째 섹션(NIST SP 800-63B “디지털 신원 지침 - 인증 및 수명 주기 관리”)을 기반으로 하지만, 본 장은 보편적인 위협과 자주 악용되는 인증 취약점에 초점을 맞춘다. 또한 표준의 모든 항목을 포괄적으로 다루지는 않는다. 완전한 NIST SP 800-63 준수가 필요한 경우 반드시 원문을 참고해야 한다. + +추가적으로, NIST SP 800-63의 용어와는 일부 경우 다를 수 있으며, 본 장은 명확성을 높이기 위해 더 일반적으로 이해되는 용어를 사용한다. + +보다 발전된 애플리케이션의 일반적 기능 중 하나는 다양한 위험 요인에 따라 요구되는 인증 단계를 조정할 수 있는 능력이다. 이러한 기능은 권한 부여 결정에도 고려되어야 하므로 “권한 부여” 장에서 다룬다. + +## V6.1 Authentication Documentation + +본 섹션은 애플리케이션에서 유지해야 하는 인증 문서화에 대한 요구사항을 포함한다. 이는 관련 인증 제어가 어떻게 구성되어야 하는지를 구현하고 평가하는 데 핵심적이다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **6.1.1** | 인증 문서가 크리덴셜 스터핑, 비밀번호 무차별 대입 공격 등을 방어하기 위해 속도 제한, 자동화 방지, 적응형 응답(adaptive response)과 같은 제어가 어떻게 사용되는지를 정의한다. 또한, 이러한 제어가 어떻게 구성되는지와 악의적으로 계정을 잠그는 것을 방지하는 방법을 명확히 하는지 검증한다. | 1 | +| **6.1.2** | 조직명, 제품명, 시스템 식별자, 프로젝트 코드명, 부서명 또는 역할명 등 문맥적으로 특정된 단어의 변형을 포함하여, 비밀번호에 사용되지 않도록 문서화된 단어 목록이 있는지 검증한다. | 2 | +| **6.1.3** | 애플리케이션이 여러 인증 경로를 포함하는 경우, 이들 모두가 문서화되어 있으며 각 경로에 대해 일관되게 적용되는 보안 제어와 인증 강도가 정의되어 있는지 검증한다. | 2 | + +## V6.2 비밀번호 보안 + +비밀번호는 NIST SP 800-63에서 “기억된 비밀(Memorized Secret)”로 불리며, 비밀번호, 암호구절(passphrase), PIN, 잠금 패턴, 특정 이미지 요소 선택 등을 포함한다. 일반적으로 “알고 있는 것(something you know)”으로 간주되며, 단일 요소 인증 방식으로 자주 사용된다. + +이 섹션은 비밀번호가 안전하게 생성되고 처리되도록 하기 위한 요구사항을 포함한다. 대부분의 요구사항은 L1에 속하는데, 이는 해당 수준에서 가장 중요하기 때문이다. L2 이상부터는 다중요소 인증 메커니즘이 요구되며, 이때 비밀번호는 그 요소 중 하나로 사용될 수 있다. + +본 섹션의 요구사항은 주로 [NIST 가이드라인](https://pages.nist.gov/800-63-3/sp800-63b.html)의 [§ 5.1.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver)와 관련된다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **6.2.1** | 사용자가 설정하는 비밀번호가 최소 8자 이상이어야 하며, 최소 15자 이상을 강력히 권장하는지 검증한다. | 1 | +| **6.2.2** | 사용자가 비밀번호를 변경할 수 있는지 검증한다. | 1 | +| **6.2.3** | 비밀번호 변경 기능이 사용자의 현재 비밀번호와 새 비밀번호를 요구하는지 검증한다. | 1 | +| **6.2.4** | 계정 등록 또는 비밀번호 변경 시 제출된 비밀번호가 최소 3000개의 상위 비밀번호 목록과 비교 및 검사되는지, 이때 애플리케이션 비밀번호 정책(예: 최소 길이)을 만족하는지 검증한다. | 1 | +| **6.2.5** | 비밀번호는 어떤 구성도 허용되며, 허용되는 문자 유형에 대한 제한이 없는지 검증한다. 대/소문자, 숫자, 특수문자에 대한 최소 개수 요구사항이 없어야 한다. | 1 | +| **6.2.6** | 비밀번호 입력 필드가 type=password를 사용하여 입력을 마스킹하는지 검증한다. 애플리케이션은 사용자가 전체 비밀번호나 마지막 입력 문자를 일시적으로 볼 수 있도록 허용할 수 있다. | 1 | +| **6.2.7** | 붙여넣기 기능, 브라우저 비밀번호 도우미, 외부 비밀번호 관리자의 사용이 허용되는지 검증한다. | 1 | +| **6.2.8** | 애플리케이션이 비밀번호를 사용자로부터 수신한 그대로 검증하며, 대소문자 변경이나 잘림(truncation)과 같은 수정 없이 처리하는지 검증한다. | 1 | +| **6.2.9** | 비밀번호가 최소 64자까지 허용되는지 검증한다. | 2 | +| **6.2.10** | 사용자의 비밀번호는 손상되었음이 발견되거나 사용자가 교체할 때까지 유효하며, 애플리케이션이 주기적인 자격 증명 교체를 요구하지 않는지 검증한다. | 2 | +| **6.2.11** | 문서화된 문맥별 단어 목록을 사용하여 추측하기 쉬운 비밀번호가 생성되지 않도록 하는지 검증한다. | 2 | +| **6.2.12** | 계정 등록 또는 비밀번호 변경 시 제출된 비밀번호가 유출된 비밀번호 집합과 비교 및 검사되는지 검증한다. | 2 | + +## V6.3 일반 인증 보안 + +이 섹션은 인증 메커니즘의 보안에 대한 일반 요구사항을 포함하며, 레벨별로 상이한 기대치를 제시한다. L2 애플리케이션은 다중요소 인증(MFA)을 반드시 사용해야 한다. L3 애플리케이션은 반드시 검증된 신뢰 실행 환경(Trusted Execution Environment, TEE)에서 수행되는 하드웨어 기반 인증을 사용해야 한다. 여기에는 장치에 종속된 패스키(device-bound passkeys), eIDAS 높은 수준(Level of Assurance, LoA High)의 강제 인증기, NIST 인증기 보증 수준 3(Authenticator Assurance Level 3, AAL3)을 충족하는 인증기, 또는 이에 상응하는 메커니즘이 포함될 수 있다. + +이는 비교적 강력한 MFA 요구이지만, 사용자를 보호하기 위해 이에 대한 인증 수준을 높이는 것은 필수적이다. 이러한 요구사항을 완화하려는 모든 시도는, 인증과 관련된 위험을 어떻게 완화할 것인지에 대한 명확한 계획을 반드시 수반해야 하며, 이때 NIST의 지침과 해당 주제에 대한 연구 결과를 고려해야 한다. + +출시 시점 기준으로, NIST SP 800-63은 이메일을 인증 메커니즘([아카이브](https://web.archive.org/web/20250330115328/https://pages.nist.gov/800-63-FAQ/#q-b11))으로 [허용하지 않는다](https://pages.nist.gov/800-63-FAQ/#q-b11)는 점에 유의해야 한다. + +이 섹션의 요구사항은 [NIST 가이드라인](https://pages.nist.gov/800-63-3/sp800-63b.html)의 다양한 절과 관련이 있으며, 여기에는 [§ 4.2.1](https://pages.nist.gov/800-63-3/sp800-63b.html#421-permitted-authenticator-types), [§ 4.3.1](https://pages.nist.gov/800-63-3/sp800-63b.html#431-permitted-authenticator-types), [§ 5.2.2](https://pages.nist.gov/800-63-3/sp800-63b.html#522-rate-limiting-throttling), and [§ 6.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#-612-post-enrollment-binding) 등이 포함된다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **6.3.1** | 애플리케이션의 보안 문서에 따라 크리덴셜 스터핑 및 비밀번호 무차별 대입 공격을 방지하기 위한 제어가 구현되어 있는지 검증한다. | 1 | +| **6.3.2** | “root”, “admin”, “sa”와 같은 기본 사용자 계정이 애플리케이션에 존재하지 않거나 비활성화되어 있는지 검증한다. | 1 | +| **6.3.3** | 애플리케이션 접근 시 반드시 MFA 또는 단일 요소 인증 메커니즘의 조합을 사용하는지 검증한다. L3의 경우, 인증을 수행하려는 사용자의 의도를 검증하기 위해 사용자가 직접 수행하는 동작(예: FIDO 하드웨어 키 또는 모바일 기기에서 버튼을 누르는 행위)을 요구함으로써, 피싱 공격에 대한 침해 및 위장 저항성을 제공하는 하드웨어 기반 인증 메커니즘이 반드시 하나의 요소로 포함되어야 한다. 이 요구사항에서 고려 사항을 완화하려는 경우, 완전히 문서화된 근거와 포괄적인 보완 통제가 반드시 수반되어야 한다. | 2 | +| **6.3.4** | 여러 인증 경로가 존재하는 경우, 문서화되지 않은 경로가 없어야 하며 보안 제어와 인증 강도가 일관되게 적용되는지 검증한다. | 2 | +| **6.3.5** | 사용자가 의심스러운 인증 시도에 대해 성공 여부와 관계 없이 알림을 제공받는지 검증한다. 여기에는 비정상적인 위치나 클라이언트에서의 인증 시도, 부분적으로만 성공한 인증(여러 요소 중 하나만 성공한 경우), 장기간 비활성 상태 이후의 인증 시도, 또는 여러 번의 인증 실패 후 성공한 인증이 포함될 수 있다. | 3 | +| **6.3.6** | 이메일이 단일 또는 다중 요소 인증 메커니즘으로 사용되지 않는지 검증한다. | 3 | +| **6.3.7** | 자격 증명 재설정, 사용자명/이메일 수정 등 인증 관련 정보 변경 이후 사용자에게 통지되는지 검증한다. | 3 | +| **6.3.8** | 오류 메시지, HTTP 응답 코드, 응답 시간 차이 등을 통해 유효한 사용자를 유추할 수 없으며, 비밀번호 등록/찾기 기능에도 동일한 보호가 적용되는지 검증한다. | 3 | + +## V6.4 인증 요소 수명 주기 및 복구 + +인증 요소는 비밀번호, 소프트 토큰, 하드웨어 토큰, 생체 인식 장치 등을 포함할 수 있다. 이들의 수명주기를 안전하게 처리하는 것은 애플리케이션 보안에 매우 중요하며, 본 섹션은 관련 요구사항을 다룬다. + +본 섹션의 요구사항은 주로 [NIST 가이드라인](https://pages.nist.gov/800-63-3/sp800-63b.html)의 [§ 5.1.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver), [§ 6.1.2.3](https://pages.nist.gov/800-63-3/sp800-63b.html#replacement)과 관련된다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **6.4.1** | 시스템이 생성하는 초기 비밀번호나 활성화 코드가 안전하게 난수로 생성되며, 기존 비밀번호 정책을 따르고, 짧은 기간 내 또는 최초 사용 시 만료되는지 검증한다. 초기 비밀번호는 장기 비밀번호로 허용되지 않아야 한다. | 1 | +| **6.4.2** | 비밀번호 힌트나 지식 기반 인증(“비밀 질문”)이 존재하지 않는지 검증한다. | 1 | +| **6.4.3** | 분실된 비밀번호에 대한 재설정 절차가 안전하게 구현되며, MFA를 우회하지 않는지 검증한다. | 2 | +| **6.4.4** | MFA 요소 분실 시, 등록 시와 동일 수준의 신원 증명이 수행되는지 검증한다. | 2 | +| **6.4.5** | 만료 예정인 인증 메커니즘에 대한 갱신 안내가 충분한 시간 전에 발송되며, 필요한 경우 자동 알림이 구성되는지 검증한다 | 3 | +| **6.4.6** | 관리자가 사용자 비밀번호 재설정 절차를 시작할 수 있으나, 사용자의 비밀번호를 직접 변경하거나 지정할 수 없는지 검증한다. 이는 관리자가 사용자의 비밀번호를 알지 못하도록 한다. | 3 | + +## V6.5 General Multi-factor authentication requirements + +이 섹션은 다양한 다중요소 인증 방식에 적용될 수 있는 일반적인 지침을 제공한다. + +여기에는 다음 메커니즘이 포함된다: + +* 룩업 시크릿 (Lookup Secrets) +* 시간 기반 일회용 비밀번호(Time based One-time Passwords, TOTPs) +* 대역 외 메커니즘(Out-of-Band mechanisms) + +룩업 시크릿은 미리 생성된 비밀 코드 목록으로, 거래 승인 번호(Transaction Authorization Numbers, TAN), 소셜 미디어 복구 코드, 또는 무작위 값이 들어 있는 격자(grid)와 유사하다. 이러한 인증 메커니즘은 의도적으로 기억하기 어려워, 어딘가에 저장해야 하므로 “소유하고 있는 것(something you have)”으로 간주된다. + +시간 기반 일회용 비밀번호(TOTPs)는 지속적으로 변경되는 의사난수 기반의 일회용 챌린지를 표시하는 물리적 또는 소프트 토큰이다. 이러한 인증 메커니즘 역시 “소유하고 있는 것(something you have)”으로 간주된다. 다중요소 TOTPs는 단일요소 TOTPs와 유사하지만, 최종 일회용 비밀번호(OTP)를 생성하기 위해 유효한 PIN 코드, 생체 인식 해제, USB 삽입 또는 NFC 페어링, 혹은 거래 서명 계산기와 같은 추가 값을 입력해야 한다. + +대역 외 메커니즘(Out-of-Band mechanisms)의 세부 사항은 다음 섹션에서 제공된다. + +본 섹션의 요구사항은 주로 [NIST 가이드라인](https://pages.nist.gov/800-63-3/sp800-63b.html)[§ 5.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#-512-look-up-secrets)의 [§ 5.1.3](https://pages.nist.gov/800-63-3/sp800-63b.html#-513-out-of-band-devices), [§ 5.1.4.2](https://pages.nist.gov/800-63-3/sp800-63b.html#5142-single-factor-otp-verifiers), [§ 5.1.5.2](https://pages.nist.gov/800-63-3/sp800-63b.html#5152-multi-factor-otp-verifiers), [§ 5.2.1](https://pages.nist.gov/800-63-3/sp800-63b.html#521-physical-authenticators), 그리고 [§ 5.2.3](https://pages.nist.gov/800-63-3/sp800-63b.html#523-use-of-biometrics)와 관련된다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **6.5.1** | 조회 secret, 대역 외 인증 요청 및 코드, 시간 기반 일회용 비밀번호가 단 한 번만 성공적으로 사용 가능한지 검증한다. | 2 | +| **6.5.2** | 애플리케이션 백엔드에 저장될 때, 엔트로피가 112비트 미만인 룩업 시크릿(예: 무작위 영숫자 19자 또는 무작위 숫자 34자)은 32비트 무작위 솔트(salt)를 포함하는 사전 승인된 비밀번호 저장용 해시 알고리즘으로 해시되는지 검증한다. 룩업 시크릿이 112비트 이상의 엔트로피를 가진 경우에는 표준 해시 함수를 사용할 수 있다. | 2 | +| **6.5.3** | 룩업 시크릿, 대역 외 인증 코드, 그리고 시간 기반 일회용 비밀번호의 시드가 예측 가능한 값을 피하기 위해 암호학적으로 안전한 의사난수 생성기(CSPRNG)를 사용하여 생성되는지 검증한다. | 2 | +| **6.5.4** | 룩업 시크릿과 대역 외 인증 코드가 최소 20비트의 엔트로피를 가지는지 검증한다. 일반적으로 무작위 영숫자 4자 또는 무작위 숫자 6자가 충분하다. | 2 | +| **6.5.5** | 대역 외 인증 요청, 코드 또는 토큰과 시간 기반 일회용 비밀번호가 정의된 수명을 가지는지 검증한다. 대역 외 요청의 최대 수명은 10분이어야 하며, TOTP의 최대 수명은 30초이어야 한다. | 2 | +| **6.5.6** | 도난이나 기타 손실의 경우 모든 인증 요소(물리적 장치 포함)를 해지할 수 있는지 검증한다. | 3 | +| **6.5.7** | 생체 인식 인증 메커니즘은 반드시 보조 요소로만 사용되어야 하며, “소유하고 있는 것” 또는 “알고 있는 것” 중 하나와 함께 사용되는지 검증한다. | 3 | +| **6.5.8** | 시간 기반 일회용 비밀번호는 신뢰할 수 있는 서비스의 시간 소스를 기준으로 검증되어야 하며, 신뢰할 수 없거나 클라이언트에서 제공한 시간을 기반으로 해서는 안 된다. | 3 | + +## V6.6 대역 외(Out-of-Band) 인증 메커니즘 + +이는 보통 인증 서버가 보안이 보장된 보조 채널을 통해 물리적 장치와 통신하는 방식을 포함한다. 예를 들어, 모바일 기기에 푸시 알림을 전송하는 경우가 있다. 이러한 유형의 인증 메커니즘은 “소유하고 있는 것”으로 간주된다. + +전자메일이나 VOIP와 같은 안전하지 않은 대역 외 인증 메커니즘은 허용되지 않는다. PSTN과 SMS 인증은 현재 NIST에 의해 [“제한된” 인증 메커니즘](https://pages.nist.gov/800-63-FAQ/#q-b01)으로 간주되며, 시간 기반 일회용 비밀번호나 암호학적 메커니즘 또는 유사한 방식으로 대체되어야 한다. NIST SP 800-63B의 [§ 5.1.3.3](https://pages.nist.gov/800-63-3/sp800-63b.html#-5133-authentication-using-the-public-switched-telephone-network)에서는 전화나 SMS 기반 대역 외 인증을 반드시 지원해야 하는 경우, 디바이스 교체, SIM 변경, 번호 이동 또는 기타 비정상적 행위의 위험을 다룰 것을 권장한다. 본 섹션은 이를 필수 요구사항으로 명시하지는 않지만, 민감한 L2 애플리케이션이나 L3 애플리케이션에서 이러한 예방 조치를 취하지 않는 것은 심각한 위험 신호로 간주되어야 한다. + +또한 NIST는 최근 [푸시 알림 사용을 권장하지 않는 지침](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#fig-3)을 제공했다. 이 ASVS 절은 이를 요구사항으로 규정하지 않지만, “푸시 폭탄(push bombing)” 공격 위험을 인지하는 것이 중요하다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **6.6.1** | 공중 교환 전화망(PSTN)을 사용하여 전화나 SMS를 통해 일회용 비밀번호(OTPs)를 전달하는 인증 메커니즘은, 해당 전화번호가 사전에 검증되었을 때만 제공되어야 하며, 더 강력한 대체 방법(예: 시간 기반 일회용 비밀번호)도 제공되어야 하고, 서비스는 사용자에게 이러한 보안 위험에 대한 정보를 제공해야 한다. L3 애플리케이션의 경우, 전화와 SMS는 옵션으로 제공되어서는 안 된다. | 2 | +| **6.6.2** | 대역 외 인증 요청, 코드 또는 토큰은 생성된 원래 인증 요청에만 바인딩되어야 하며, 이전이나 이후의 요청에는 사용할 수 없어야 한다. | 2 | +| **6.6.3** | 코드 기반 대역 외 인증 메커니즘이 속도 제한 등을 통해 무차별 대입 공격으로부터 보호되는지 검증한다. 또한 최소 64비트 이상의 엔트로피를 가진 코드를 사용하는 것도 고려해야한다. | 2 | +| **6.6.4** | 다중요소 인증에 푸시 알림이 사용되는 경우, 푸시 폭탄(push bombing) 공격을 방지하기 위해 속도 제한을 적용해야 한다. 또한 숫자 일치 기법 역시 이 위험을 완화할 수 있다. | 3 | + +## V6.7 암호학적 인증 메커니즘 + +암호학적 인증 메커니즘에는 스마트카드나 FIDO 키가 포함되며, 사용자가 인증을 완료하기 위해 암호 장치를 컴퓨터에 연결하거나 페어링해야 한다. 인증 서버는 챌린지 논스(challenge nonce)를 암호 장치나 소프트웨어로 전송하며, 해당 장치나 소프트웨어는 안전하게 저장된 암호 키를 기반으로 응답을 계산한다. 본 섹션의 요구사항은 이러한 메커니즘에 대한 구현별 지침을 제공하며, 암호 알고리즘에 대한 지침은 “암호학(Cryptography)” 장에서 다룬다. + +암호학적 인증에 공유 키나 비밀 키가 사용되는 경우, 이는 “구성(Configuration)” 장의 “비밀 관리(Secret Management)” 섹션에 문서화된 것과 동일한 메커니즘을 사용하여 저장되어야 한다. + +본 섹션의 요구사항은 주로 [NIST 가이드라인](https://pages.nist.gov/800-63-3/sp800-63b.html) [§ 5.1.7.2](https://pages.nist.gov/800-63-3/sp800-63b.html#sfcdv)에 해당한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **6.7.1** | 암호학적 인증 단언(assertion)을 검증하는 데 사용되는 인증서는 수정으로부터 보호되는 방식으로 저장되는지 검증한다. | 3 | +| **6.7.2** | 챌린지 논스(nonce)는 최소 64비트 길이여야 하며, 통계적으로 고유하거나 해당 암호 장치의 수명 동안 고유해야 한다. | 3 | + +## V6.8 ID 제공자(IdP)를 통한 인증 + +ID 제공자(IdP)는 사용자에게 통합 신원을 제공한다. 사용자는 종종 여러 IdP와 함께 여러 개의 신원을 보유하고 있다. 예를 들어, Azure AD, Okta, Ping Identity 또는 Google과 같은 기업용 IdP를 통한 기업 신원, 그리고 Facebook, Twitter, Google, WeChat과 같은 소비자용 IdP를 통한 개인 신원을 동시에 가질 수 있다. (이 목록은 특정 기업이나 서비스를 보증하는 것이 아니라, 많은 사용자가 이미 여러 신원을 보유하고 있다는 현실을 개발자가 고려하도록 권장하는 것이다.) 조직은 IdP의 신원 증명 강도를 기준으로 기존 사용자 신원과의 통합을 고려해야 한다. 예를 들어, 정부 기관은 가짜 혹은 일회성 ID를 쉽게 만들 수 있기 때문에 민감한 시스템의 로그인에 소셜 미디어 신원을 허용하지 않을 가능성이 큰 반면, 모바일 게임 회사는 활동적인 플레이어 기반을 확장하기 위해 주요 소셜 미디어 플랫폼과의 통합이 필요할 수 있다. + +외부 IdP를 안전하게 사용하려면 신원 위조(identity spoofing)나 위조된 단언(assertion)을 방지하기 위한 세심한 구성과 검증이 필요하다. 이 섹션은 이러한 위험을 해결하기 위한 요구사항을 제공한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **6.8.1** | 애플리케이션이 다중 ID 제공자(IdP)를 지원하는 경우, 사용자의 신원이 다른 지원 IdP를 통해 위조될 수 없는지 검증한다. (예: 동일한 사용자 식별자를 사용하는 방식). 표준적인 대응책은 애플리케이션이 IdP ID(네임스페이스 역할)와 IdP 내 사용자 ID의 조합을 사용하여 사용자를 등록하고 식별하는 것이다. | 2 | +| **6.8.2** | 인증 단언(예: JWT 또는 SAML 단언)의 디지털 서명이 존재하고 무결성이 항상 유지되는지를 검증한다. 서명이 없거나 유효하지 않은 단언은 거부해야 한다. | 2 | +| **6.8.3** | SAML 단언이 재생 공격의 방지를 위해 고유하게 처리되는지, 유효 기간 내에 단 한 번만 사용되는지 검증한다. | 2 | +| **6.8.4** | 애플리케이션이 별도의 ID 제공자(IdP)를 사용하고 특정 기능에 대해 특정 인증 강도, 방식, 또는 최근성을 요구하는 경우, 애플리케이션은 IdP가 반환한 정보를 사용하여 이를 검증해야 한다. 예를 들어, OIDC가 사용되는 경우, 이는 ‘acr’, ‘amr’, ‘auth_time’(존재하는 경우)과 같은 ID 토큰 클레임을 검증함으로써 달성할 수 있다. IdP가 이 정보를 제공하지 않는 경우, 애플리케이션은 최소 강도의 인증 메커니즘(예: 사용자 이름과 비밀번호를 사용하는 단일요소 인증)이 사용되었다고 가정하는 문서화된 대체 접근법을 가져야 한다. | 2 | + +## 참조 + +더 많은 정보는 다음을 참고한다: + +* [NIST SP 800-63 - Digital Identity Guidelines](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-3.pdf) +* [NIST SP 800-63B - Authentication and Lifecycle Management](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf) +* [NIST SP 800-63 FAQ](https://pages.nist.gov/800-63-FAQ/) +* [OWASP Web Security Testing Guide: Testing for Authentication](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/04-Authentication_Testing) +* [OWASP Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html) +* [OWASP Forgot Password Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html) +* [OWASP Choosing and Using Security Questions Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Choosing_and_Using_Security_Questions_Cheat_Sheet.html) +* [CISA Guidance on "Number Matching"](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implement-number-matching-in-mfa-applications-508c.pdf) +* [Details on the FIDO Alliance](https://fidoalliance.org/) diff --git a/5.0/ko/0x16-V7-Session-Management.md b/5.0/ko/0x16-V7-Session-Management.md new file mode 100644 index 0000000000..f26175ebae --- /dev/null +++ b/5.0/ko/0x16-V7-Session-Management.md @@ -0,0 +1,91 @@ +# V7 세션 관리 + +## 제어 목표 + +세션 관리 메커니즘은 상태 비저장(stateless) 통신 프로토콜(예: HTTP)을 사용할 때에도, 애플리케이션이 시간 경과에 따라 사용자와 장치 간의 상호작용을 연계할 수 있도록 한다. 최신 애플리케이션은 서로 다른 특성과 목적을 가진 여러 세션 토큰을 사용할 수 있다. 안전한 세션 관리 시스템은 공격자가 피해자의 세션을 획득, 사용 또는 악용하지 못하도록 방지한다. 세션을 유지하는 애플리케이션은 다음의 상위 수준 세션 관리 요구사항을 반드시 충족해야 한다. + +* 세션은 각 개인에게 고유하며, 추측되거나 공유될 수 없어야 한다. +* 세션은 더 이상 필요하지 않을 때 무효화되며, 비활성 상태가 지속되면 시간 초과되어야 한다. + +이 장의 많은 요구사항은 [NIST SP 800-63 디지털 신원 지침](https://pages.nist.gov/800-63-4/) 중 일부 제어 항목과 관련이 있으며, 일반적인 위협 및 자주 악용되는 인증 취약점에 초점을 맞춘다. + +특정 세션 관리 메커니즘의 구현 세부사항에 대한 요구사항은 다른 장에서 확인할 수 있다. + +* HTTP 쿠키는 세션 토큰을 보호하는 데 일반적으로 사용되는 메커니즘이다. 쿠키에 대한 구체적 보안 요구사항은 “웹 프론트엔드 보안” 장에서 확인할 수 있다. +* 자체 포함 토큰은 세션을 유지하는 수단으로 자주 사용된다. 자체 포함 토큰에 대한 구체적 보안 요구사항은 “자체 포함 토큰” 장에서 확인할 수 있다. + +## V7.1 세션 관리 문서화 + +모든 애플리케이션에 동일하게 적용할 수 있는 단일 패턴은 존재하지 않는다. 따라서 모든 경우에 적합한 범위와 한계를 보편적으로 정의하는 것은 불가능하다. 세션 처리를 구현하고 테스트하기 전에, 이와 관련된 보안 결정을 문서화한 위험 분석을 반드시 수행해야 한다. 이는 세션 관리 시스템이 애플리케이션의 특정 요구사항에 맞게 조정되도록 보장한다. + +상태 유지형(stateful) 또는 상태 비저장형(stateless) 세션 메커니즘 중 어느 것을 선택하더라도, 선택한 솔루션이 모든 관련 보안 요구사항을 충족할 수 있음을 입증하기 위해 분석은 반드시 완전하게 이루어지고 문서화되어야 한다. 또한 사용 중인 SSO(Single Sign-on) 메커니즘과의 상호작용도 고려하는 것을 권장한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **7.1.1** | 사용자의 세션 비활성 시간 초과 및 절대 최대 세션 수명에 대한 문서가 존재하고, 다른 제어와의 조합에서 적절하며, NIST SP 800-63B 재인증 요구사항에서 벗어날 시 그 근거가 문서에 포함되어 있는지 검증한다. | 2 | +| **7.1.2** | 문서가 하나의 계정에서 허용되는 동시(병렬) 세션 수와 활성 세션 수의 최대값에 도달했을 때의 의도된 동작과 수행할 조치를 정의하는지 검증한다. | 2 | +| **7.1.3** | 통합 신원 관리 생태계(예: SSO 시스템)의 일부로 사용자 세션을 생성하고 관리하는 모든 시스템이 문서화되어 있으며, 세션 수명, 종료, 재인증이 필요한 기타 조건을 조율하기 위한 제어가 포함되어 있는지 검증한다. | 2 | + +## V7.2 기본 세션 관리 보안 + +이 절은 세션 토큰이 안전하게 생성되고 검증되도록 하는 세션 보안의 필수 요구사항을 다룬다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **7.2.1** | 애플리케이션이 모든 세션 토큰 검증을 신뢰할 수 있는 백엔드 서비스에서 수행하는지 검증한다. | 1 | +| **7.2.2** | 애플리케이션이 세션 관리를 위해 정적 API 시크릿이나 키가 아닌, 자체 포함 토큰 또는 참조 토큰을 동적으로 생성하여 사용하는지 검증한다. | 1 | +| **7.2.3** | 참조 토큰이 사용자 세션을 나타내는 데 사용되는 경우, 그 토큰이 고유하고, 암호학적으로 안전한 의사난수 생성기(CSPRNG)를 사용해 생성되며 최소 128비트의 엔트로피를 갖는지 검증한다. | 1 | +| **7.2.4** | 애플리케이션이 사용자 인증(재인증 포함) 시 새로운 세션 토큰을 생성하고 기존 세션 토큰을 종료하는지 검증한다. | 1 | + +## V7.3 세션 타임아웃 + +세션 타임아웃 메커니즘은 세션 하이재킹 및 기타 세션 악용 가능성을 최소화한다. 타임아웃 설정은 반드시 문서화된 보안 결정에 부합해야 한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **7.3.1** | 위험 분석 및 문서화된 보안 결정에 따라 재인증을 강제하는 비활성 시간 초과가 존재하는지 검증한다. | 2 | +| **7.3.2** | 위험 분석 및 문서화된 보안 결정에 따라 재인증을 강제하는 절대 최대 세션 수명이 존재하는지 검증한다. | 2 | + +## V7.4 세션 종료 + +세션 종료는 애플리케이션 자체에서 처리할 수도 있고, 애플리케이션 대신 SSO 제공자가 세션 관리를 담당하는 경우 SSO 제공자에서 처리할 수도 있다.이 절의 요구사항을 고려할 때, 일부는 SSO 제공자가 제어할 수 있으므로 SSO 제공자가 범위(scope)에 포함되는지 여부를 결정해야 한다. + +세션 종료는 재인증이 필요하도록 하고, 이는 애플리케이션, 통합 로그인(존재하는 경우), 그리고 모든 의존 서비스에 걸쳐 효과적으로 적용됨이 권장된다. + +상태 유지형 세션 메커니즘에서는 종료 시 백엔드에서 세션을 무효화하는 것이 일반적이다. 자체 포함 토큰의 경우, 토큰이 만료 시까지 계속 유효할 수 있으므로 이를 취소하거나 차단하기 위한 추가 조치가 필요하다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **7.4.1** | 로그아웃이나 만료와 같이 세션 종료가 트리거될 때, 애플리케이션이 해당 세션의 추가 사용을 허용하지 않는지 검증한다. 참조 토큰 또는 상태 유지형 세션의 경우, 이는 애플리케이션 백엔드에서 세션 데이터를 무효화하는 것을 의미한다. 자체 포함 토큰을 사용하는 애플리케이션은 종료된 토큰 목록 유지, 사용자별 날짜·시간 이전에 발급된 토큰 거부, 사용자별 서명 키 회전과 같은 방법을 사용해야 한다. | 1 | +| **7.4.2** | 사용자 계정이 비활성화되거나 삭제될 때(예: 직원 퇴사), 애플리케이션이 모든 활성 세션을 종료하는지 검증한다. | 1 | +| **7.4.3** | 비밀번호 재설정·복구를 통한 변경, MFA 설정 변경 등 어떤 인증 요소라도 성공적으로 변경 또는 제거한 후, 모든 다른 활성 세션을 종료할 수 있는 옵션을 제공하는지 검증한다. | 2 | +| **7.4.4** | 인증이 필요한 모든 페이지의 로그아웃 기능에 접근하는 것이 쉽고 잘 보이는지 검증한다. | 2 | +| **7.4.5** | 애플리케이션 관리자가 개별 사용자 또는 모든 사용자의 활성 세션을 종료할 수 있는지 검증한다. | 2 | + +## V7.5 세션 악용 방어 + +이 절은 하이재킹되었거나, 활성 사용자 세션의 존재와 권한을 악용하는 벡터를 통해 남용될 수 있는 활성 세션의 위험을 완화하기 위한 요구사항을 제시한다. 예를 들어, 악성 콘텐츠 실행을 통해 인증된 피해자 브라우저가 피해자의 세션을 사용하여 동작을 수행하게 만드는 경우가 있다. + +이 절의 요구사항을 고려할 때, “인증(Authentication)” 장의 레벨별 지침을 함께 참고해야 한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **7.5.1** | 이메일 주소, 전화번호, MFA 구성, 계정 복구에 사용되는 기타 정보 등 인증에 영향을 줄 수 있는 민감한 계정 속성을 변경하기 전에 전체 재인증을 요구하는지 검증한다. | 2 | +| **7.5.2** | 사용자가 현재 활성 세션을 전체 또는 일부 확인하고(최소 요소 한 개에 대한 인증을 다시 수행한 후) 종료할 수 있는지 검증한다. | 2 | +| **7.5.3** | 매우 민감한 거래나 작업을 수행하기 전에 최소 한 요소 인증 또는 2차 검증을 요구하는지 검증한다. | 3 | + +## V7.6 페더레이션 재인증 + +이 절은 신뢰 당사자(Relying Party;RP) 또는 ID 공급자(Identity Provider; IDP) 코드를 작성하는 경우에 적용된다. 요구사항은 [NIST SP 800-63C](https://pages.nist.gov/800-63-4/sp800-63c.html) 연방·인증서 발급 지침에서 파생되었다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **7.6.1** | RP와 IdP 간 세션 수명과 종료가 문서대로 동작하며, IdP 인증 이벤트 간의 최대 시간이 도달하는 경우 등 필요한 시점에 재인증을 요구하는지 검증한다. | 2 | +| **7.6.2** | 세션 생성 시 사용자 동의 또는 명시적 동작을 요구하여, 사용자 상호작용 없이 새로운 애플리케이션 세션이 생성되지 않도록 하는지 검증한다. | 2 | + +## 참조 + +더 많은 정보는 다음을 참고한다: + +* [OWASP Web Security Testing Guide: Session Management Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/06-Session_Management_Testing) +* [OWASP Session Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html) diff --git a/5.0/ko/0x17-V8-Authorization.md b/5.0/ko/0x17-V8-Authorization.md new file mode 100644 index 0000000000..0d4f522cb3 --- /dev/null +++ b/5.0/ko/0x17-V8-Authorization.md @@ -0,0 +1,56 @@ +# V8 권한 부여 + +## 제어 목표 + +권한 부여는 허가된 소비자(사용자, 서버, 기타 클라이언트)에게만 접근을 허용하는 것을 보장한다. 최소 권한의 원칙(PLOP)을 적용하기 위해, 검증된 애플리케이션은 반드시 다음의 상위 수준 요구사항을 충족해야 한다: + +* 권한 부여 규칙을 문서화하며, 문서에는 의사 결정 요소와 환경적 맥락을 포함한다. +* 소비자는 자신에게 부여된 권한으로 허용된 자원에만 접근할 수 있는 것이 권장된다. + +## V8.1 권한 부여 문서화 + +포괄적인 권한 부여 문서는 보안 결정이 일관성 있게 적용되고, 감사 가능하며, 조직의 정책에 부합함을 보장하는 데 필수적이다. 이는 보안 요구사항을 개발자, 관리자, 테스터에게 명확하고 실행 가능하게 전달함으로써 무단 접근 위험을 줄인다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **8.1.1** | 권한 부여 문서가 소비자 권한과 자원 속성에 따라 기능 수준 및 데이터별 접근을 제한하는 규칙을 정의하는지 검증한다. | 1 | +| **8.1.2** | 권한 부여 문서가 소비자 권한과 자원 속성에 따라 필드 수준 접근 제한(읽기 및 쓰기 모두)을 정의하는지 검증한다. 이러한 규칙은 관련 데이터 객체의 상태(state)나 상태값(status)과 같은 다른 속성 값에 의존할 수 있다. | 2 | +| **8.1.3** | 애플리케이션 문서가 인증 및 권한 부여와 관련된 보안 결정을 내리는 데 사용되는 환경적, 맥락적 속성(예: 시간대, 사용자 위치, IP 주소, 디바이스 등)을 정의하는지 검증한다. | 3 | +| **8.1.4** | 인증 및 권한 부여 문서가 기능 수준, 데이터별, 필드 수준 권한 부여에 더해 환경적, 맥락적 요소가 의사 결정에 어떻게 사용되는지 정의하는지 검증한다. 여기에는 평가되는 속성, 위험 임계값, 수행되는 조치(예: 허용, 추가 인증 요청, 거부, 단계적 인증)을 포함하는 것을 권장한다. | 3 | + +## V8.2 일반 권한 부여 설계 + +기능, 데이터, 필드 수준에서 세분화된 권한 부여 제어의 구현은, 소비자가 명시적으로 부여된 범위 내에서만 접근할 수 있도록 보장할 수 있다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **8.2.1** | 애플리케이션이 기능 수준의 접근을 명시적 권한이 있는 소비자에게만 허용하는지 검증한다. | 1 | +| **8.2.2** | 애플리케이션이 특정 데이터 항목에 대한 명시적 권한이 있는 소비자에게만 데이터별 접근을 허용하여, 안전하지 않은 직접 객체 참조(IDOR) 및 객체 수준 권한 부여 취약점(BOLA)을 방지하는지 검증한다. | 1 | +| **8.2.3** | 애플리케이션이 특정 필드에 대한 명시적 권한이 있는 소비자에게만 필드 수준 접근을 허용하여, 객체 속성 수준 권한 부여 취약점(BOPLA)을 방지하는지 검증한다. | 2 | +| **8.2.4** | 애플리케이션 문서에서 정의한 바에 따라, 소비자의 환경적, 맥락적 속성(예: 시간대, 위치, IP 주소 또는 장치)에 기반한 적응형 보안 제어가 인증 및 권한 부여 결정에 구현되는지 검증한다. 이러한 제어는 소비자가 새 세션을 시작할 때뿐만 아니라 기존 세션 중에도 반드시 적용되어야 한다. | 3 | + +## V8.3 운영 수준 권한 부여 + +애플리케이션 아키텍처의 적절한 계층에서 권한 부여 변경 사항을 즉시 적용하는 것은, 특히 동적인 환경에서 무단 행위를 방지하는 데 매우 중요하다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **8.3.1** | 애플리케이션이 권한 부여 규칙을 신뢰할 수 있는 서비스 계층에서 적용하고, 클라이언트 측 JavaScript처럼 신뢰할 수 없는 소비자가 조작할 수 있는 제어에 의존하지 않는지 검증한다. | 1 | +| **8.3.2** | 권한 부여 결정에 영향을 미치는 값의 변경 사항이 즉시 적용되는지 검증한다. 자체 포함 토큰(self-contained token)과 같이 즉시 적용이 불가능한 경우, 소비자가 더 이상 권한이 없는 작업을 수행할 때 이를 알리고 변경을 되돌리는 완화 제어를 반드시 두어야 한다. 단, 이 방법은 정보 유출을 방지하지는 못한다. | 3 | +| **8.3.3** | 객체에 대한 접근이, 대리인이나 이를 대신 수행하는 서비스의 권한이 아닌, 원래 주체(예: 소비자)의 권한에 기반하는지 검증한다. 예를 들어, 소비자가 인증을 위해 자체 포함 토큰을 사용하여 웹 서비스를 호출하고, 해당 서비스가 다른 서비스에 데이터를 요청하는 경우, 두 번째 서비스는 첫 번째 서비스의 머신-투-머신 토큰이 아니라 소비자의 토큰을 사용하여 권한 결정을 내려야 한다. | 3 | + +## V8.4 기타 권한 부여 고려사항 + +특히 관리 인터페이스나 다중 테넌트 환경에서의 권한 부여에 대한 추가적인 고려사항은 무단 접근을 방지하는 데 도움이 된다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **8.4.1** | 다중 테넌트 애플리케이션이 교차 테넌트 제어를 사용하여, 소비자의 작업이 권한이 없는 다른 테넌트에 영향을 미치지 않도록 하는지 검증한다. | 2 | +| **8.4.2** | 관리 인터페이스 접근이 연속적인 소비자 신원 검증, 장치 보안 상태 평가, 맥락 기반 위험 분석 등 복수의 보안 계층을 포함하는지 검증한다. 네트워크 위치나 신뢰된 엔드포인트가 무단 접근 가능성을 줄일 수는 있더라도, 단독으로 권한 부여 판단의 유일한 요소가 되어서는 안 된다. | 3 | + +## 참조 + +더 많은 정보는 다음을 참고한다: + +* [OWASP Web Security Testing Guide: Authorization](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/05-Authorization_Testing) +* [OWASP Authorization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html) diff --git a/5.0/ko/0x18-V9-Self-contained-Tokens.md b/5.0/ko/0x18-V9-Self-contained-Tokens.md new file mode 100644 index 0000000000..2f3c4189d0 --- /dev/null +++ b/5.0/ko/0x18-V9-Self-contained-Tokens.md @@ -0,0 +1,36 @@ +# V9 자체 포함 토큰(self-contained token) + +## 제어 목표 + +자체 포함 토큰의 개념은 2012년에 발표된 RFC 6749 OAuth 2.0 원문에서 언급된다. 이는 수신 서비스가 보안 결정을 내릴 때 의존할 데이터 또는 클레임(claims)을 포함하는 토큰을 의미한다. 이는 수신 서비스가 데이터를 로컬에서 조회하는 데 사용하는 식별자만 포함하는 단순 토큰과는 구별되어야 한다. 자체 포함 토큰의 가장 일반적인 예시는 JSON 웹 토큰(JSON Web Token; JWT)과 SAML 어설션(SAML assertions)이 있다. + +자체 포함 토큰의 사용은 OAuth 및 OIDC 외부에서도 매우 광범위하게 확산되었다. 동시에 이 메커니즘의 보안은 토큰의 무결성을 검증하고 토큰이 특정 컨텍스트에 유효한지 확인하는 능력에 의존한다. 이 과정에는 많은 위험요소가 있으며, 이 장에서는 애플리케이션이 이를 방지하기 위해 갖춰야 할 메커니즘에 대한 구체적인 세부 정보를 제공한다. + +## V9.1 토큰 출처 및 무결성 + +이 섹션에는 토큰이 신뢰할 수 있는 주체에 의해 생성되었으며 변조되지 않았음을 확인하기 위한 요구사항을 포함한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **9.1.1** | 자체 포함 토큰 내용을 허용하기 전에 변조를 방지하기 위해 디지털 서명 또는 메시지 인증 코드(MAC)를 사용하여 토큰의 무결성을 검증해야 한다. | 1 | +| **9.1.2** | 주어진 컨텍스트에 대해 자체 포함 토큰을 생성하고 검증할 때, 허용 목록에 있는 알고리즘만 사용될 수 있는지 검증해야 한다. 허용 목록에는 사용 가능한 알고리즘을 모두 포함해야 하며, 이상적으로는 대칭 또는 비대칭 알고리즘 중 하나만을 포함해야 한다. 또한 'None' 알고리즘은 반드시 제외해야 한다. 대칭 및 비대칭 알고리즘 모두를 지원해야 하는 경우, 키 혼동을 방지하기 위해 추가 제어가 필요하다. | 1 | +| **9.1.3** | 자체 포함 토큰을 검증하는 데 사용되는 키 자료가 토큰 발행자를 위한 신뢰할 수 있는 사전 구성된 출처에서 비롯되었는지 검증하여, 공격자가 신뢰할 수 없는 출처 및 키를 지정하는 것을 방지해야 한다. JWT 및 기타 JWS 구조의 경우, 'jku', 'x5u', 'jwk'와 같은 헤더는 신뢰할 수 있는 출처의 허용 목록에 대해 검증되어야 한다. | 1 | + +## V9.2 토큰 내용 + +자체 포함 토큰의 내용에 기반하여 보안 결정을 내리기 전에, 토큰이 유효 기간 내에 제시되었는지, 수신 서비스에서 사용하도록 의도되었는지, 그리고 제시된 목적에 맞게 사용되었는지 검증해야 한다. 이는 동일한 발급자로부터 발급된 서로 다른 서비스 간 또는 서로 다른 토큰 유형 간의 안전하지 않은 교차 사용을 방지하는 데 도움이 된다. + +OAuth 및 OIDC에 대한 구체적인 요구사항은 별도의 장 V10 OAuth and OIDC에서 다룬다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **9.2.1** | 토큰 데이터에 유효 기간이 존재하는 경우, 검증 시간이 이 유효 기간 내에 있을 때만 토큰 및 해당 내용이 허용되는지 검증해야 한다. 예를 들어, JWT의 경우 'nbf' 및 'exp' 클레임이 검증되어야 한다. | 1 | +| **9.2.2** | 토큰을 수신하는 서비스가 토큰 내용을 수락하기 전에 올바른 유형이며 의도된 목적을 위한 것인지 토큰을 검증하는지 확인해야 한다. 예를 들어, 인가 결정에는 액세스 토큰만 허용될 수 있으며, 사용자 인증을 증명하는 데는 ID 토큰만 사용될 수 있다. | 2 | +| **9.2.3** | 서비스가 대상 서비스(audience)와 함께 사용하기 위한 토큰만 허용하는지 검증해야 한다. JWT의 경우, 서비스에 정의된 허용 목록에 대해 'aud' 클레임을 검증함으로써 이를 달성할 수 있다. | 2 | +| **9.2.4** | 토큰 발행자가 다른 대상(audience)에게 토큰을 발행하기 위해 동일한 개인 키를 사용하는 경우, 발행된 토큰이 의도된 대상을 고유하게 식별하는 대상 제한을 포함하는지 검증해야 한다. 이는 토큰이 의도하지 않은 대상에서 재사용되는 것을 방지한다. 대상 식별자가 동적으로 프로비저닝되는 경우, 토큰 발행자는 대상 위장(audience impersonation)을 초래하지 않도록 대상들을 검증해야 한다. | 2 | + +## 참조 + +더 많은 정보는 다음을 참고한다: + +* [OWASP JSON Web Token Cheat Sheet for Java Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_for_Java_Cheat_Sheet.html) (유용한 일반 지침 포함) diff --git a/5.0/ko/0x19-V10-OAuth-and-OIDC.md b/5.0/ko/0x19-V10-OAuth-and-OIDC.md new file mode 100644 index 0000000000..db998cfa55 --- /dev/null +++ b/5.0/ko/0x19-V10-OAuth-and-OIDC.md @@ -0,0 +1,169 @@ +# V10 OAuth와 OIDC + +## 제어 목표 + +OAuth2(본 장에서는 OAuth로 지칭)는 권한 위임을 위한 산업 표준 프레임워크이다. 예를 들어, OAuth를 사용하면 클라이언트 애플리케이션은 사용자가 클라이언트 애플리케이션에 권한을 위임한 경우 사용자를 대신하여 API(서버 리소스)에 접근할 수 있다. + +OAuth 자체는 사용자 인증을 위해 설계되지 않았다. OpenID Connect(OIDC) 프레임워크는 OAuth 위에 사용자 식별 계층을 추가하여 OAuth를 확장한다. OIDC는 표준화된 사용자 정보, 싱글 사인온(SSO), 세션 관리 등의 기능을 지원한다. OIDC는 OAuth를 확장한 표준 사양이므로 본 장의 OAuth 요구사항은 OIDC에도 적용된다. + +OAuth에 정의된 역할은 다음과 같다: + +* OAuth 클라이언트는 서버 리소스에 접근하려는 애플리케이션이다(예: 발급된 액세스 토큰을 사용하여 API 호출). OAuth 클라이언트는 서버에서 동작하는 애플리케이션인 경우가 많다. + * 기밀 클라이언트는 인가 서버에 자체적으로 인증하는 데 사용하는 자격 증명(Credentials)의 기밀성을 유지할 수 있는 클라이언트이다. + * 공개 클라이언트는 인가 서버에 인증하기 위한 자격 증명의 기밀성을 유지할 수 없다. 따라서 자체적으로 인증(예: 'client_id' 및 'client_secret' 파라미터 사용)하는 대신, 자체 식별만 한다('client_id' 파라미터 사용). +* OAuth 리소스 서버는 OAuth 클라이언트에 리소스를 제공하는 서버 API이다. +* OAuth 인가 서버는 OAuth 클라이언트에 액세스 토큰을 발급하는 서버 애플리케이션이다. 이 액세스 토큰을 통해 OAuth 클라이언트는 최종 사용자를 대신하여 또는 OAuth 클라이언트 자체를 대신하여 리소스 서버의 리소스에 접근할 수 있다. 인가 서버는 종종 별도의 애플리케이션이지만, (적절한 경우) 요건에 맞는 리소스 서버에 통합될 수 있다. +* 리소스 소유자는 리소스 서버에 호스팅된 리소스에 대해 제한된 접근 권한을 획득하도록 OAuth 클라이언트에 권한을 위임하는 최종 사용자이다. 리소스 소유자는 인가 서버와 상호 작용함으로써 이 권한 위임에 동의한다. + +OIDC에 정의된 역할은 다음과 같다: + +* 신뢰 당사자(Relying Party)는 OpenID 공급자를 통해 최종 사용자 인증을 요청하는 클라이언트 애플리케이션이다. 이는 OAuth 클라이언트의 역할을 수행한다. +* OpenID 공급자는 최종 사용자를 인증하고 신뢰 당사자에 OIDC 클레임(claims)을 제공할 수 있는 OAuth 인가 서버이다. OpenID 공급자는 ID 공급자(IdP)일 수 있지만, 연합 인증 시나리오(federated scenarios)에서는 OpenID 공급자와 ID 공급자(최종 사용자가 인증하는 곳)가 다른 서버 애플리케이션일 수 있다. + +OAuth와 OIDC는 원래 외부(third-party) 애플리케이션을 위해 설계되었으며, 오늘날에는 내부(first-party) 애플리케이션에서도 종종 사용된다. 그러나 인증 및 세션 관리와 같은 내부 시나리오에서 사용될 때, 프로토콜이 복잡성을 더하게 되며, 이로 인해 새로운 보안 과제가 발생할 수 있다. + +OAuth와 OIDC는 다양한 유형의 애플리케이션에 사용될 수 있지만, 본 장의 ASVS와 요구사항은 웹 애플리케이션과 API에 중점을 두고 있다. + +OAuth와 OIDC는 웹 기술 위에 구축된 논리 계층으로 간주될 수 있으므로, 본 장의 내용만을 따로 떼어내서 해석하지 않고, 다른 장의 일반 요구사항과 함께 적용해야 한다. + +본 장은 및 에서 찾을 수 있는 사양에 맞춰 OAuth2 및 OIDC에 대한 현재의 모범 사례를 다룬다. RFC가 성숙하다고 간주되더라도 자주 업데이트된다. 따라서 본 장의 요구사항을 적용할 때 최신 버전과 일치시키는 것이 중요하다. 자세한 내용은 참조 섹션을 확인한다. + +이 영역의 복잡성을 고려할 때, 안전한 OAuth 또는 OIDC 솔루션을 위해서는 잘 알려진 산업 표준의 인가 서버를 사용하고, 권장되는 보안 구성을 적용하는 것이 매우 중요하다. + +본 장에서 사용되는 용어는 OAuth RFC 및 OIDC 사양과 일치하지만, OIDC 용어는 OIDC에 특화된 요구사항에만 사용되며, 그 외에는 OAuth 용어가 사용된다는 점에 유의해야 한다. + +OAuth 및 OIDC의 맥락에서, 본 장의 "토큰"이라는 용어는 다음을 의미한다: + +* 액세스 토큰은 리소스 서버에서만 사용되어야 하며, 조회(introspection)를 통해 검증되는 참조 토큰이거나 특정 키 정보를 사용하여 검증되는 자체 포함 토큰일 수 있다. +* 리프레시 토큰은 토큰을 발급한 인가 서버에서만 사용되어야 한다. +* OIDC ID 토큰은 인가 플로우를 시작했던 클라이언트에서만 사용되어야 한다. + +본 장의 일부 요구사항의 위험 수준은 클라이언트가 기밀 클라이언트인지, 공개 클라이언트로 간주되는지에 따라 달라질 수 있다. 강력한 클라이언트 인증을 사용하면 많은 공격 벡터를 줄일 수 있으므로, L1 애플리케이션에서 기밀 클라이언트를 사용하는 경우 일부 요구사항이 완화될 수 있다. + +## V10.1 일반적인 OAuth 및 OIDC 보안 + +이 섹션은 OAuth 또는 OIDC를 사용하는 모든 애플리케이션에 적용되는 일반적인 아키텍처 요구사항을 다룬다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **10.1.1** | 엄격하게 필요한 구성 요소에만 토큰이 전송되는지 검증해야 한다. 예를 들어, 브라우저 기반 JavaScript 애플리케이션에 프론트엔드 전용 백엔드(Backend For Frontend; BFF) 패턴을 사용하는 경우, 액세스 토큰 및 리프레시 토큰은 백엔드에서만 접근 가능해야 한다. | 2 | +| **10.1.2** | 클라이언트는 인가 서버에서 제공하는 값(예: 인가 코드 또는 ID 토큰)이 동일한 사용자 에이전트 세션 및 트랜잭션에서 시작된 인가 플로우의 결과인 경우에만 허용하는지 검증해야 한다. 이를 위해 클라이언트가 생성하는 비밀 값(PKCE(Proof Key for Code Exchange)의 'code_verifier', 'state', OIDC의 'nonce' 등)은 추측이 불가능해야 하며, 해당 트랜잭션에 고유해야 하고, 트랜잭션이 시작된 클라이언트와 사용자 에이전트 세션 양쪽에 안전하게 결합(Binding)되어 있어야 한다. | 2 | + +## V10.2 OAuth 클라이언트 + +이 요구사항은 OAuth 클라이언트 애플리케이션의 책임을 상세히 규정한다. 예를 들어 클라이언트는 웹 서버 백엔드(일반적으로 BFF 역할 수행), 백엔드 서비스 통합, 또는 프론트엔드 단일 페이지 애플리케이션(브라우저 기반 애플리케이션)일 수 있다. + +일반적으로 백엔드 클라이언트는 기밀 클라이언트로 간주되고, 프론트엔드 클라이언트는 공개 클라이언트로 간주된다. 그러나 최종 사용자 장치에서 실행되는 네이티브 애플리케이션은 OAuth 동적 클라이언트 등록을 사용하는 경우 기밀로 간주될 수 있다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **10.2.1** | 코드 플로우를 사용하는 경우, OAuth 클라이언트는 토큰 요청을 유도하는 사이트 간 요청 위조 공격(Cross-Site Request Forgery; CSRF)에 대한 보호 기능을 갖추고 있는지 검증한다. 이를 위해 인가 요청 시 전송된 'state' 파라미터를 검증하거나, PKCE 기능을 사용해야 한다. | 2 | +| **10.2.2** | OAuth 클라이언트가 둘 이상의 인가 서버와 상호 작용할 수 있는 경우, 믹스업 공격에 대한 방어 대책을 갖는지 검증해야 한다. 예를 들어, 인가 서버가 'iss' 파라미터 값을 반환하도록 요구하고 인가 응답 및 토큰 응답에서 이를 검증할 수 있다. | 2 | +| **10.2.3** | OAuth 클라이언트가 인가 서버에 대한 요청에서 필요한 범위(또는 기타 인가 파라미터)만 요청하는지 검증해야 한다. | 3 | + +## V10.3 OAuth 리소스 서버 + +ASVS 및 본 장의 맥락에서 리소스 서버는 API를 의미한다. 안전한 접근 제어를 제공하기 위해 리소스 서버는 다음을 수행해야 한다: + +* 토큰 형식 및 관련 프로토콜 사양(예: JWT 검증 또는 OAuth 토큰 조회)에 따라 액세스 토큰을 검증해야 한다. +* 토큰이 유효한 경우, 액세스 토큰의 정보 및 부여된 권한을 기반으로 인가 결정을 강제해야 한다. 예를 들어, 리소스 서버는 클라이언트(리소스 소유자를 대신하여 작동)가 요청된 리소스에 접근할 권한이 있는지 검증해야 한다. + +따라서 여기에 나열된 요구사항은 OAuth 또는 OIDC에 특화되어 있으며, 토큰 검증 후 토큰의 정보를 기반으로 인가를 수행하기 전에 이행되어야 한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **10.3.1** | 리소스 서버가 해당 서비스(audience)에 사용하도록 의도된 액세스 토큰만 수락하는지 검증해야 한다. 대상은 구조화된 액세스 토큰(예: JWT의 'aud' 클레임)에 포함될 수 있거나, 토큰 조회 엔드포인트를 사용하여 확인할 수 있다. | 2 | +| **10.3.2** | 리소스 서버가 위임된 인가를 정의하는 액세스 토큰의 클레임을 기반으로 인가 결정을 시행하는지 검증해야 한다. 'sub', 'scope', 'authorization_details'와 같은 클레임이 존재하는 경우, 이는 결정에 반영되어야 한다. | 2 | +| **10.3.3** | 액세스 토큰(JWT 또는 관련 토큰 조회 응답)에서 고유한 사용자를 식별해야 하는 접근 제어 결정이 필요한 경우, 리소스 서버가 다른 사용자에게 재할당될 수 없는 클레임에서 사용자를 식별하는지 검증해야 한다. 일반적으로 이는 'iss' 및 'sub' 클레임의 조합을 사용하는 것을 의미한다. | 2 | +| **10.3.4** | 리소스 서버가 특정 인증 강도, 방법 또는 최신성을 요구하는 경우, 제시된 액세스 토큰이 이러한 제약 조건을 충족하는지 검증해야 한다. 예를 들어, 토큰을 제시한 경우 OIDC의 'acr', 'amr' 및 'auth_time' 클레임을 각각 사용해야 한다. | 2 | +| **10.3.5** | 리소스 서버가 발신자 제약 액세스 토큰, 즉 OAuth 2용 상호 TLS(Mutual TLS; mTLS) 또는 OAuth 2 소유 증명(Demonstration of Proof of Possession; DPoP)를 요구하여 도난된 액세스 토큰 사용 또는 액세스 토큰 재사용(권한 없는 당사자로부터)을 방지하는지 검증해야 한다. | 3 | + +## V10.4 OAuth 인가 서버 + +이 요구사항은 OpenID 공급자를 포함한 OAuth 인가 서버의 책임을 상세히 설명한다. + +클라이언트 인증의 경우, 'self_signed_tls_client_auth' 메소드는 [RFC 8705](https://datatracker.ietf.org/doc/html/rfc8705)의 [섹션 2.2](https://datatracker.ietf.org/doc/html/rfc8705#name-self-signed-certificate-mut)에서 요구하는 전제조건을 충족하는 경우에 허용된다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **10.4.1** | 인가 서버는 클라이언트 별로 사전 등록된 URI의 허용 목록을 기반으로 리디렉션 URI를 정확한 문자열 비교 방식으로 검증해야 한다. | 1 | +| **10.4.2** | 인가 서버가 인가 응답에서 인가 코드를 반환하는 경우, 해당 코드는 토큰 요청에 한번만 사용될 수 있어야 한다. 이미 액세스 토큰을 발급하는 데 사용된 인가 코드를 사용하여 두 번째 요청이 발생하면, 인가 서버는 토큰 요청을 거부하고 해당 인가 코드와 관련된 모든 발급된 토큰을 취소해야 한다. | 1 | +| **10.4.3** | 인가 코드가 단기간만 유효한지 검증해야 한다. 최대 수명은 L1 및 L2 애플리케이션의 경우 최대 10분, L3 애플리케이션의 경우 최대 1분 이내여야 한다. | 1 | +| **10.4.4** | 인가 서버는 특정 클라이언트에 대해, 해당 클라이언트가 사용할 필요가 있는 인가 방식(grant)만 사용하도록 허용해야 한다. token(암시적 플로우) 및 password(리소스 소유자 비밀번호 자격 증명 플로우) 방식은 더 이상 사용되어서는 안 된다. | 1 | +| **10.4.5** | 인가 서버가 공개 클라이언트에 대한 리프레시 토큰 재사용 공격을 완화하는지 검증해야 한다. 가급적이면 발신자 제약 리프레시 토큰, 즉 소유 증명이나 mTLS를 사용한 인증서 바인딩 액세스 토큰을 사용해야 한다. L1 및 L2 애플리케이션의 경우, 리프레시 토큰 회전(rotation)이 사용될 수 있다. 리프레시 토큰 회전이 사용되는 경우, 인가 서버는 리프레시 토큰을 사용 후 무효화해야 하며, 이미 사용되고 무효화된 리프레시 토큰이 제공되면 해당 인가에 대한 모든 리프레시 토큰을 철회(revoke)해야 한다. | 1 | +| **10.4.6** | 코드 인가 방식(code grant)이 사용되는 경우, 인가 서버가 PKCE를 요구하여 인가 코드 탈취 공격을 완화하는지 검증해야 한다. 인가 요청의 경우, 인가 서버는 유효한 'code_challenge' 값을 요구해야 하며, 'code_challenge_method'값으로 'plain'를 허용해서는 안 된다. 토큰 요청의 경우, 'code_verifier' 파라미터의 검증을 요구해야 한다. | 2 | +| **10.4.7** | 인가 서버가 인증되지 않은 동적 클라이언트 등록을 지원하는 경우, 악의적인 클라이언트 애플리케이션의 위험을 완화하는지 검증해야 한다. 등록된 URI와 같은 클라이언트 메타데이터를 검증하고, 사용자의 동의를 확인해야 하며, 신뢰할 수 없는 클라이언트 애플리케이션으로 인가 요청을 처리하기 전에 사용자에게 경고해야 한다. | 2 | +| **10.4.8** | 슬라이딩 리프레시 토큰 만료(expiration)가 적용되더라도, 리프레시 토큰에 절대 만료 시점(absolute expiration)이 포함되어 있는지 확인한다. | 2 | +| **10.4.9** | 악의적인 클라이언트 또는 도난된 토큰의 위험을 완화하기 위해 인가 서버 사용자 인터페이스를 통해 권한 있는 사용자가 리프레시 토큰 및 참조 액세스 토큰을 철회할 수 있는지 검증해야 한다. | 2 | +| **10.4.10** | 토큰 요청, 푸시된 인가 요청(Pushed Authorization Request; PAR), 토큰 철회 요청과 같은 클라이언트에서 인가 서버로의 백채널 요청(backchannel request)에 대해 기밀 클라이언트가 인증되는지 검증해야 한다. | 2 | +| **10.4.11** | 인가 서버 구성이 OAuth 클라이언트에 필요한 범위만 할당하는지 검증해야 한다. | 2 | +| **10.4.12** | 주어진 클라이언트에 대해 인가 서버가 해당 클라이언트가 사용해야 하는 'response_mode' 값만 허용하는지 검증해야 한다. 예를 들어, 인가 서버가 이 값을 예상 값과 비교하여 검증하거나, PAR 또는 JWT 기반 인가 요청(JWT-secured Authorization Request; JAR)을 사용하여 검증해야 한다. | 3 | +| **10.4.13** | 인가 유형 'code'가 항상 PAR과 함께 사용되는지 검증해야 한다. | 3 | +| **10.4.14** | 인가 서버가 mTLS를 사용하는 인증서 바인딩 액세스 토큰 또는 소유 증명 바인딩 액세스 토큰을 사용하여 발신자 제약(Proof-of-Possession) 액세스 토큰만 발급하는지 검증해야 한다. | 3 | +| **10.4.15** | 최종 사용자 장치에서 실행되지 않는 서버에서 동작하는 클라이언트의 경우, 인가 서버가 'authorization_details' 파라미터 값이 클라이언트 백엔드로부터 생성되었는지와 사용자가 해당 값을 변조되지 않았는지를 검증해야 한다. 예를 들어, PAR 또는 JAR의 사용을 요구하여 확인해야 한다. | 3 | +| **10.4.16** | 클라이언트가 기밀 클라이언트인지 검증하고, 인가 서버는 재사용 공격에 강하고 공개키 암호화에 기반한 강력한 클라이언트 인증 방식을 사용하도록 요구해야 한다. 예를 들어, mTLS(tls_client_auth, self_signed_tls_client_auth) 또는 비공개 키 기반 JWT 인증(private_key_jwt) 등이 이에 해당한다. | 3 | + +## V10.5 OIDC 클라이언트 + +OIDC 신뢰 당사자가 OAuth 클라이언트로 작동하므로, "V10.2 OAuth 클라이언트" 섹션의 요구사항도 적용된다. + +"V6 인증" 장의 "V6.8 ID 공급자를 사용한 인증" 섹션에도 관련 일반 요구사항이 포함되어 있음에 유의해야 한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **10.5.1** | 신뢰 당사자로서 클라이언트가 ID 토큰 재사용 공격을 완화하는지 검증해야 한다. 예를 들어, ID 토큰의 'nonce' 클레임이 OpenID 공급자에 전송된 인증 요청(OAuth2에서는 인가 서버에 전송된 인가 요청)에서 전송된 'nonce' 값과 일치하는지 확인해야 한다. | 2 | +| **10.5.2** | 클라이언트가 ID 토큰 클레임, 일반적으로 'sub' 클레임에서 사용자를 고유하게 식별하며, 해당 클레임이 ID 공급자 범위 내에서 다른 사용자에게 재할당될 수 없는지 검증해야 한다. | 2 | +| **10.5.3** | 클라이언트는 악의적인 인가 서버가 인가 서버 메타데이터를 통해 다른 인가 서버를 가장하려는 시도를 거부하는지 검증해야 한다. 클라이언트는 인가 서버 메타데이터에 포함된 발급자(issuer) URL이 클라이언트가 예상하는 사전 구성된 발급자 URL과 정확히 일치하지 않는 경우, 해당 메타데이터를 거부해야 한다. | 2 | +| **10.5.4** | 클라이언트는 토큰의 aud 클레임 값이 클라이언트의 client_id 값과 동일한지 확인하여 ID 토큰이 해당 클라이언트(audience)를 대상으로 발급되었음을 검증해야 한다. | 2 | +| **10.5.5** | OIDC 백채널 로그아웃을 사용하는 경우, 신뢰 당사자는 강제 로그아웃을 통한 서비스 거부 공격(Denial of Service) 및 로그아웃 플로우에서의 JWT 혼동(cross-JWT confusion)을 완화하는지 검증해야 한다. 클라이언트는 로그아웃 토큰이 'logout+jwt' 값으로 올바르게 지정되어 있는지, 올바른 멤버 이름을 가진 'event' 클레임을 포함하는지, 그리고 'nonce' 클레임을 포함하지 않는지 검증해야 한다. 또한, 짧은 만료 시간(예: 2분)을 갖는 것이 권장된다. | 2 | + +## V10.6 OpenID 공급자 + +OpenID 공급자는 OAuth 인가 서버로 작동하므로, "V10.4 OAuth 인가 서버" 섹션의 요구사항도 적용된다. + +ID 토큰 플로우(코드 플로우가 아닌)을 사용하는 경우, 액세스 토큰이 발급되지 않으며 OAuth 인가 서버의 많은 요구사항이 적용되지 않음에 유의해야 한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **10.6.1** | OpenID 공급자는 response_mode 파라미터 값으로'code', 'ciba', 'id_token' 또는 'id_token code' 만 허용하는지 검증해야 한다. 이 중 'id_token code'(OIDC 하이브리드 플로우)보다는 'code'가 선호되며, 'token'(모든 암시적 플로우)은 사용되어서는 안 된다. | 2 | +| **10.6.2** | OpenID 공급자가 강제 로그아웃을 통한 서비스 거부 공격을 완화하는지 검증해야 한다. 신뢰 당사자로 부터 시작된 로그아웃 요청에 id_token_hint 등의 파라미터가 포함되어 있는 경우, 이를 검증하거나 최종 사용자로부터 명시적인 확인을 받아야 한다. | 2 | + +## V10.7 동의 관리 + +이 요구사항은 인가 서버에 의한 사용자 동의 검증을 다룬다. 적절한 사용자 동의 검증이 없으면 악의적인 행위자가 스푸핑 또는 사회 공학을 통해 사용자를 대신하여 권한을 획득할 수 있다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **10.7.1** | 인가 서버가 사용자로부터 각 인가 요청에 대한 명시적인 동의(consent)를 확인하는지 검증해야 한다. 클라이언트의 신원을 보장할 수 없는 경우, 인가 서버는 항상 사용자에게 명시적으로 동의를 요청해야 한다. | 2 | +| **10.7.2** | 인가 서버가 사용자 동의를 요청할 때, 동의하는 내용에 대한 충분하고 명확한 정보를 제공하는지 검증해야 한다. 이에 해당하는 경우, 요청된 인가의 성격(일반적으로 범위, 리소스 서버, RAR(Rich Authorization Requests) 인가 세부 정보 기반), 인가된 애플리케이션의 신원, 인가의 유효 기간이 포함되어야 한다. | 2 | +| **10.7.3** | 사용자가 인가 서버를 통해 부여한 동의를 검토, 수정 및 철회할 수 있는지 검증해야 한다. | 2 | + +## 참조 + +더 많은 정보는 다음을 참고한다: + +* [oauth.net](https://oauth.net/) +* [OWASP OAuth 2.0 프로토콜 치트 시트](https://cheatsheetseries.owasp.org/cheatsheets/OAuth2_Cheat_Sheet.html) + +ASVS에서 OAuth 관련 요구사항은 다음의 공개 및 초안 상태 RFC를 사용한다: + +* [RFC6749 OAuth 2.0 인가 프레임워크](https://datatracker.ietf.org/doc/html/rfc6749) +* [RFC6750 OAuth 2.0 인가 프레임워크: 베어러 토큰 사용](https://datatracker.ietf.org/doc/html/rfc6750) +* [RFC6819 OAuth 2.0 위협 모델 및 보안 고려 사항](https://datatracker.ietf.org/doc/html/rfc6819) +* [RFC7636 OAuth 공개 클라이언트를 위한 코드 교환 증명 키](https://datatracker.ietf.org/doc/html/rfc7636) +* [RFC7591 OAuth 2.0 동적 클라이언트 등록 프로토콜](https://datatracker.ietf.org/doc/html/rfc7591) +* [RFC8628 OAuth 2.0 디바이스 인가 부여](https://datatracker.ietf.org/doc/html/rfc8628) +* [RFC8707 OAuth 2.0을 위한 리소스 표시자](https://datatracker.ietf.org/doc/html/rfc8707) +* [RFC9068 OAuth 2.0 액세스 토큰을 위한 JSON 웹 토큰(JWT) 프로파일](https://datatracker.ietf.org/doc/html/rfc9068) +* [RFC9126 OAuth 2.0 푸시된 인가 요청(PAR)](https://datatracker.ietf.org/doc/html/rfc9126) +* [RFC9207 OAuth 2.0 인가 서버 발급자 식별](https://datatracker.ietf.org/doc/html/rfc9207) +* [RFC9396 OAuth 2.0 확장된 인가 요청](https://datatracker.ietf.org/doc/html/rfc9396) +* [RFC9449 OAuth 2.0 PoP(Demonstrating Proof of Possession)](https://datatracker.ietf.org/doc/html/rfc9449) +* [RFC9700 OAuth 2.0 보안을 위한 현재 모범 사례](https://datatracker.ietf.org/doc/html/rfc9700) +* [브라우저 기반 애플리케이션을 위한 OAuth 2.0 초안](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-browser-based-apps) +* [OAuth 2.1 인가 프레임워크 초안](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-12) + +OpenID Connect에 대한 자세한 내용은 다음을 참조한다: + +* [OpenID Connect Core 1.0](https://openid.net/specs/openid-connect-core-1_0.html) +* [FAPI 2.0 보안 프로파일](https://openid.net/specs/fapi-security-profile-2_0-final.html) diff --git a/5.0/ko/0x20-V11-Cryptography.md b/5.0/ko/0x20-V11-Cryptography.md new file mode 100644 index 0000000000..cd9a20c94c --- /dev/null +++ b/5.0/ko/0x20-V11-Cryptography.md @@ -0,0 +1,107 @@ +# V11 암호화 + +## 제어 목표 + +본 장의 목표는 암호화의 일반적인 사용에 대한 모범 사례를 정의하고, 암호화 원리에 대한 근본적인 이해를 확립하여 더욱 견고하고 현대적인 접근 방식으로 전환하도록 장려하는 것이다. 본 장에서는 다음을 권장한다. + +* 안전하게 실패하고, 진화하는 위협에 적응하며, 미래에도 사용할 수 있는 강력한 암호화 시스템을 구현한다. +* 안전하고 업계 모범 사례에 부합하는 암호화 메커니즘을 활용한다. +* 적절한 접근 제어 및 감사 기능을 갖춘 안전한 암호화 키 관리 시스템을 유지한다. +* 새로운 위험을 평가하고 그에 따라 알고리즘을 조정하기 위해 암호화 환경을 정기적으로 평가한다. +* 애플리케이션의 수명 주기 동안 모든 암호화 자산을 식별하고 보호하기 위해 암호화 사용 사례를 지속적으로 발견하고 관리해야 한다. + +이 문서는 일반적인 원칙 및 모범 사례를 설명하는 것 외에도, '부록 C - 암호화 표준의 요구 사항'에 대한 보다 심층적인 기술 정보를 제공한다. 여기에는 이 장의 요구 사항 목적에 따라 "승인된" 것으로 간주되는 알고리즘 및 모드가 포함되어 있다. + +비밀 관리 또는 통신 보안과 같이 별도의 문제를 해결하기 위해 암호화를 사용하는 요구 사항은 본 표준의 다른 장에서 기술될 것이다. + +## V11.1 암호화 인벤토리 및 문서화 + +애플리케이션은 데이터 자산의 분류에 따라 이를 보호하기 위한 강력한 암호화 아키텍처로 설계되어야 한다. 모든 데이터를 암호화하는 것은 낭비이며, 아무것도 암호화하지 않는 것은 법적 책임을 초래할 수 있다. 암호화는 일반적으로 아키텍처 설계 또는 상위 수준 설계, 설계 스프린트(design sprint) 또는 아키텍처 스파이크(architecture spike) 단계에서 균형 있게 적용되어야 한다. 즉흥적으로 암호화를 설계하거나 사후에 적용하는 것은 초기부터 구축하는 것보다 안전하게 구현하는 데 훨씬 더 많은 비용이 발생하게 된다. + +모든 암호화 자산을 정기적으로 식별, 목록화 및 평가하는 것이 중요하다. 수행 방법에 대한 자세한 내용은 부록을 참조할 수 있다.. + +양자 컴퓨팅의 등장을 대비하여 암호화 시스템의 미래 안정성(future-proofing)을 확보하는 것 또한 매우 중요하다. 양자 내성 암호(Post-Quantum Cryptography; PQC)는 양자 컴퓨팅에 의해 RSA 및 타원 곡선 암호(Elliptic Curve Cryptography; ECC)와 같이 널리 사용되는 알고리즘을 무력화될 것으로 예상됨에 따라 필수적으로 고려되어야 한다. + +검증된 PQC 기본 요소 및 표준에 대한 현재 지침은 부록을 참조해야 한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **11.1.1** | 'NIST SP 800-57'과 같은 암호화 키 관리 및 키 관리 표준을 따르는 암호화 키 수명 주기에 대한 문서화 된 정책이 있는지 검증해야 한다. 여기에는 키가 과도하게 공유되지 않도록 하는 것이 포함된다(예: 공유 비밀의 경우 두 개를 초과하는 엔터티와 공유 및 개인 키의 경우 한 개를 초과하는 엔터티에 공유). | 2 | +| **11.1.2** | 애플리케이션에서 사용되는 모든 암호화 키, 알고리즘, 인증서를 포함한 암호화 자산 목록(cryptographic inventory)이 작성되고, 유지되며, 정기적으로 업데이트되고 있는지 검증해야 한다. 또한, 각 키가 시스템 내에서 사용 가능한 위치와 사용이 제한되는 위치, 해당 키로 보호할 수 있는 데이터 유형과 보호할 수 없는 데이터 유형이 문서화되어 있어야 한다. | 2 | +| **11.1.3** | 암호화, 해싱, 서명 작업을 포함하는 시스템 내의 모든 암호화 사용 사례를 식별하기 위해, 암호화 사용 탐지 메커니즘이 적용되는지 검증해야 한다. | 3 | +| **11.1.4** | 암호화 자산 목록이 유지 관리되는지 검증해야 한다. 여기에는 미래의 위협에 대응하기 위해 양자 내성 암호(Post-Quantum Cryptography; PQC)와 같은 새로운 암호화 표준으로의 마이그레이션 계획을 설명하는 문서화된 계획이 포함되어야 한다. | 3 | + +## V11.2 안전한 암호화 구현 + +이 섹션은 애플리케이션의 핵심 암호화 알고리즘 선택, 구현 및 지속적인 관리에 대한 요구 사항을 정의한다. 목표는 현재 표준(예: NIST, ISO/IEC) 및 모범 사례에 맞춰 강력하고 업계에서 인정하는 암호화 기본 요소만 배포되도록 하는 것이다. 조직은 각 암호화 구성 요소가 동료 검토(peer-review)를 거친 증거와 실제 보안 테스트를 기반으로 선택되도록 해야 한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **11.2.1** | 암호화 작업에 업계에서 검증된 구현(라이브러리 및 하드웨어 가속 구현 포함)이 사용되는지 검증해야 한다. | 2 | +| **11.2.2** | 난수, 인증 암호화, MAC, 해싱 알고리즘, 키 길이, 라운드, 암호 및 모드를 언제든지 재구성, 업그레이드 또는 교체하여 암호화 해독으로부터 보호할 수 있도록 애플리케이션이 암호화 유연성(crypto agility)을 갖추고 설계되었는지 검증해야 한다. 또한, 키와 비밀번호를 교체하고 데이터를 다시 암호화하는 것도 가능해야 한다. 이를 통해 승인된 PQC 체계(또는 표준)의 고신뢰 구현이 널리 사용 가능해지면 PQC로 원활하게 업그레이드할 수 있다. | 2 | +| **11.2.3** | 모든 암호화 기본 구성요소(primitive)가 알고리즘, 키 크기 및 구성에 따라 최소 128비트의 보안강도를 제공하는지 검증해야 한다. 예를 들어, 256비트 ECC 키는 대략 128비트의 보안을 제공하며, RSA는 128비트의 보안을 달성하기 위해 3072비트 키를 필요로 한다. | 2 | +| **11.2.4** | 민감한 정보가 누출되는 것을 방지하기 위해 모든 암호화 연산은 상수 시간(constant-time)으로 수행되어야 하며, 비교, 계산, 반환 과정에서 단락(short-circuit) 연산이 없는지 검증해야 한다. | 3 | +| **11.2.5** | 모든 암호화 모듈이 안전하게 실패하고, 패딩 오라클 공격(Padding Oracle attacks)과 같은 취약점을 허용하지 않는 방식으로 오류가 처리되는지 검증해야 한다. | 3 | + +## V11.3 암호화 알고리즘 + +AES 및 CHACHA20을 기반으로 구축된 인증 암호화 알고리즘은 현대 암호화 관행의 근간을 이룬다. + +| # | 설명 | 래밸 | +| :---: | :--- | :---: | +| **11.3.1** | 안전하지 않은 블록 모드(예: ECB) 및 약한 패딩 방식(예: PKCS#1 v1.5)가 사용되지 않는지 검증해야 한다. | 1 | +| **11.3.2** | GCM을 사용하는 AES와 같이 승인된 암호 및 모드만 사용되는지 검증해야 한다. | 1 | +| **11.3.3** | 암호화 된 데이터가 승인된 인증된 암호화 방식을 사용하거나, 승인된 암호화 방식과 승인된 MAC 알고리즘을 조합을 통한 무단 수정으로부터 보호되는지 검증해야 한다. | 2 | +| **11.3.4** | 논스(nonces), 초기화 벡터 및 기타 단일 사용 번호가 둘 이상의 암호화 키 및 데이터 요소 쌍에 사용되지 않는지 검증해야 한다. 생성 방법은 사용되는 알고리즘에 적합해야 한다. | 3 | +| **11.3.5** | 암호화 알고리즘과 MAC 알고리즘의 모든 조합이 암호화 후 MAC(Encrypt-then-MAC) 방식으로 동작하는지 검증해야 한다. | 3 | + +## V11.4 해싱 및 해시 기반 함수 + +암호화 해시는 디지털 서명, HMAC, 키 유도 함수(KDF), 무작위 비트 생성 및 비밀번호 저장과 같은 다양한 암호화 프로토콜에서 사용된다. 암호화 시스템의 보안은 사용되는 기본 해시 함수의 강도에 달려 있다. 이 섹션에서는 암호화 작업에서 안전한 해시 함수를 사용하는 요구 사항을 설명한다. + +비밀번호 저장 및 암호화 부록의 경우, [OWASP 비밀번호 저장 치트 시트](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#password-hashing-algorithms)도 유용한 맥락과 지침을 제공할 것이다. + +| # | 설명 | 래밸 | +| :---: | :--- | :---: | +| **11.4.1** | 디지털 서명, HMAC, KDF 및 무작위 비트 생성을 포함한 일반적인 암호화 사용 사례에 승인된 해시 함수만 사용되는지 검증해야 한다. MD5와 같이 허용되지 않는 해시 함수는 어떤 암호화 목적으로도 사용해서는 안 된다. | 1 | +| **11.4.2** | 비밀번호가 승인된 '계산 집약적인 키 유도 함수("비밀번호 해싱 함수"라고도 함)'를 사용하여 저장되고, 파라미터 설정이 현재 지침에 따라 구성되었는지 검증해야 한다. 설정은 필요한 보안 수준에 대한 무차별 대입 공격을 충분히 어렵게 만들기 위해 보안과 성능의 균형을 이루어야 한다. | 2 | +| **11.4.3** | 데이터 인증 또는 데이터 무결성의 일부로 디지털 서명에 사용되는 해시 함수가 충돌 저항성을 가지며 적절한 비트 길이를 갖는지 검증해야 한다. 충돌 저항성이 필요한 경우, 출력 길이는 최소 256비트여야 한다. 제2 역상(pre-image) 공격 저항성만 필요한 경우, 출력 길이는 최소 128비트여야 한다. | 2 | +| **11.4.4** | 비밀번호로부터 비밀 키를 유도할 때 애플리케이션이 키 스트레칭(key stretching) 파라미터를 사용하여 승인된 키 유도 함수(key derivation function)를 사용하는지 검증해야 한다. 사용 중인 파라미터는 결과적인 암호화 키를 손상시키는 무차별 대입 공격을 방지하기 위해 보안과 성능의 균형을 이루어야 한다. | 2 | + +## V11.5 무작위 값 + +암호학적으로 안전한 의사 난수 생성(CSPRNG)은 올바르게 구현하기가 매우 어렵다. 일반적으로 시스템 내의 좋은 엔트로피 소스는 과도하게 사용될 경우 빠르게 고갈되지만, 무작위성이 적은 소스는 예측 가능한 키와 비밀로 이어질 수 있다. + +| # | 설명 | 래밸 | +| :---: | :--- | :---: | +| **11.5.1** | 예측 불가능해야 하는 모든 난수 및 문자열이 암호학적으로 안전한 의사 난수 생성기(CSPRNG)를 사용하여 생성되고 최소 128비트의 엔트로피를 갖는지 검증해야 한다. UUID는 이 조건을 충족하지 않는다. | 2 | +| **11.5.2** | 사용 중인 난수 생성 메커니즘이 높은 부하(heavy demand)에서도 안전하게 작동하도록 설계되었는지 검증해야 한다. | 3 | + +## V11.6 공개 키 암호화 + +공개 키 암호화는 여러 당사자 간에 비밀 키를 공유하는 것이 불가능하거나 바람직하지 않은 경우에 사용될 것이다. + +이의 일부로, 디피-헬만(Diffie-Hellman) 및 타원 곡선 디피-헬만(Elliptic Curve Diffie-Hellman; ECDH)과 같은 승인된 키 교환 메커니즘이 필요하여 암호화 시스템이 현대 위협에 대해 안전하게 유지되도록 한다. "V12 안전한 통신" 챕터는 TLS에 대한 요구 사항을 제공하므로 이 섹션의 요구 사항은 TLS 이외의 사용 사례에서 공개 키 암호화가 사용되는 상황을 위한 것이다. + +| # | 설명 | 래밸 | +| :---: | :--- | :---: | +| **11.6.1** | 키 생성 및 시딩, 디지털 서명 생성 및 검증에 승인된 암호화 알고리즘 및 작동 모드만 사용되는지 검증해야 한다. 키 생성 알고리즘은 알려진 공격에 취약한 안전하지 않은 키(예: 페르마 인수분해(Fermat factorization)에 취약한 RSA 키)를 생성해서는 안 된다. | 2 | +| **11.6.2** | 키 교환에는 디피-헬만과 같은 승인된 암호화 알고리즘이 사용되어야 하며, 안전한 파라미터를 사용하는지 여부를 중점적으로 검증해야 한다.이는 중간자 공격(adversary-in-the-middle attacks) 또는 암호화 해독으로 이어질 수 있는 키 설정 프로세스에 대한 공격을 방지할 것이다. | 3 | + +## V11.7 사용 중 데이터 암호화 + +데이터가 처리되는 동안 데이터를 보호하는 것은 매우 중요하다. 이를 위해 전체 메모리 암호화, 전송 중 데이터 암호화, 그리고 데이터 사용 직후 가능한 한 빠르게 암호화하는 방식 등의 기술을 적용하는 것이 권장된다. + +| # | 설명 | 래밸 | +| :---: | :--- | :---: | +| **11.7.1** | 사용 중인 민감한 데이터를 보호하고 무단 사용자 또는 프로세스의 접근을 방지하기 위해 전체 메모리 암호화가 사용되는지 검증해야 한다. | 3 | +| **11.7.2** | 데이터 최소화가 처리 중에 노출되는 데이터의 양을 최소화하고, 사용 직후 또는 가능한 한 빨리 데이터가 암호화되도록 보장하는지 검증해야 한다. | 3 | + +## 참조 + +더 많은 정보는 다음을 참고한다: + +* [OWASP 웹 보안 테스팅 가이드: 취약한 암호화 테스트](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography) +* [OWASP 암호화 저장 치트 시트](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html) +* [FIPS 140-3](https://csrc.nist.gov/pubs/fips/140-3/final) +* [NIST SP 800-57](https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final) diff --git a/5.0/ko/0x21-V12-Secure-Communication.md b/5.0/ko/0x21-V12-Secure-Communication.md new file mode 100644 index 0000000000..06e14f5dd3 --- /dev/null +++ b/5.0/ko/0x21-V12-Secure-Communication.md @@ -0,0 +1,57 @@ +# V12 보안 통신 + +## 제어 목표 + +이번 장에서는 사용자 클라이언트와 백엔드 서비스 간, 그리고 내부 서비스와 백엔드 서비스 사이에 전송 중인 데이터를 보호하기 위해 마련되어야 할 특정 메커니즘에 관한 요구사항을 포함한다. + +이번 장에서 강조되는 주요 개념은 다음과 같다: + +* 외부 통신은 물론 가능하다면 내부 통신 또한 암호화되도록 한다. +* 최신 가이드에 따라서 암호화 매커니즘을 구성하고, 권장 알고리즘과 암호를 사용해야 한다. +* 서명된 인증서를 사용해 통신이 허가되지 않은 제 3자에게 가로채이지 않도록 해야 한다. + +게다가 일반적인 원칙과 모범 사례를 제시하는 것 외에도 ASVS는 부록 C - 암호 표준에서 암호화 강도에 대한 좀 더 세부적인 기술 정보를 제공한다. + +## V12.1 일반 TLS 보안 가이드 + +이번 절에서는 TLS 통신을 보호하는 방법에 대한 초기 가이드를 제공한다. 최신 도구를 사용해 TLS 설정을 지속적으로 검토해야 한다. + +와일드카드 TLS 인증서 사용 자체가 원래 안전하지 않은 것이 아니지만, 모든 자체 환경(예를 들어, 운영, 스테이징, 개발, 테스트)에서 배포된 인증서가 손상되는 것은 이를 사용하는 애플리케이션의 보안 상태가 손상될 수 있다. 그래서 가능하다면 적절한 보호 및 관리와 각각의 환경별로 별도의 TLS인증서 사용을 취해야 한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **12.1.1** | TLS 1.2 및 TLS 1.3과 같은 최신 권장 버전의 TLS 프로토콜만 활성화되어 있으며, 그중 최신 버전이 우선되어야 한다. | 1 | +| **12.1.2** | 오직 권장되는 암호화 스위트(cipher suites)들이 활성화되어 있으며 그 중 가장 강력한 암호화 스위트로 우선 설정되어 있는지 확인한다. 레벨3 애플리케이션은 순방향 비밀성(forward secrecy)을 제공하는 암호화 스위트만 지원해야 한다. | 2 | +| **12.1.3** | 인증이나 권한 부여를 위해 인증서 ID를 사용하기 전에 애플리케이션이 mTLS 클라이언트 인증서가 신뢰할 수 있는지 검증해야 한다. | 2 | +| **12.1.4** | Online Certificate Status Protocol (OCSP) 스테이플링(Stapling)과 같은 적절한 인증서 폐지 프로토콜이 활성화되고 설정되어 있는지 확인해야 한다. | 3 | +| **12.1.5** | TLS 핸드셰이크 프로세스 중 Server Name Indication (SNI)과 같은 민감한 메타 데이터의 노출을 방지하기 위해 애플리케이션 TLS 설정에서 Encrypted Client Hello (ECH)가 활성화되어 있는지 확인해야 한다. | 3 | + +## V12.2 외부 서비스와의 HTTPS 통신 + +애플리케이션이 노출하는 외부 서비스에 대한 모든 HTTP 트래픽은 공적으로 신뢰되는 인증서를 사용해 암호화되어 전송되는지 확인해야 한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **12.2.1** | TLS는 클라이언트와 외부 HTTP 기반 서비스 간의 모든 연결에 사용되며, 안전하지 않거나 암호화 되어 있지 않은 통신에 대체 동작(fall back)이 발생하지 않는지 확인해야한다. | 1 | +| **12.2.2** | 외부 서비스가 공적으로 신뢰된 TLS 인증서를 사용하는지 확인해야 한다. | 1 | + +## V12.3 일반 서비스 간의 통신 보안 + +내부와 외부 서버 통신은 HTTP 외에도 다양하게 이루어지며 다른 시스템과의 연결은 가능한 TLS를 사용하여 보호되어야 한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **12.3.1** | 애플리케이션간의 모니터링 시스템, 관리 도구, 원격 엑세스 및 SSH, 미들웨어, 데이터베이스, 메인프레임, 파트너 시스템이나 외부 API를 포함한 모든 인바운드와 아웃바운드 통신은 TLS같은 암호화 프로토콜이 사용되는지 확인해야 한다. 이 서버는 안전하지 않거나 암호화 되어있지 않은 프로토콜에 대체 동작(fall back)이 발생하지 않아야 한다. | 2 | +| **12.3.2** | TLS 클라이언트가 통신하기 전에 TLS서버로 부터 받은 인증서를 검증하는지 확인해야 한다. | 2 | +| **12.3.3** | 그리고 TLS 또는 애플리케이션 내의 내부 HTTP 기반 서비스간에 사용된 다른 적절한 전송 암호화 매커니즘이 안전하지 않거나 암호화 되어있지 않은 통신에 대체 동작(fall back)이 발생하지 않는지 확인해야 한다. | 2 | +| **12.3.4** | 내부 서버간에 TLS 통신이 신뢰된 인증서를 사용하는지 확인해야 한다. 내부 인증서나 자체 서명(self-signed)인증서를 사용할 경우, 이를 사용하는 서비스는 오직 특정 내부 인증기관(CA)과 자체 서명 인증만을 신뢰하게 설정해야 한다. | 2 | +| **12.3.5** | 시스템 내부에서 통신하는 서비스(intra-service communication)는 각 엔드포인트를 검증하기 위해 강력한 인증을 사용해야 한다. 공용키(public-key) 기반 구조와 재전송 공격(replay attacks)에 저항하는 매커니즘을 사용하여 신원보장을 위해 TLS 클라이언트 인증과 같은 강력한 인증 방식을 사용해야 한다. 마이크로서비스 아키텍쳐의 경우 인증서 관리를 간소화 하고 보안을 강화하기 위해 서비스 매시(service mesh)를 사용하는 것을 고려해야 한다. | 3 | + +## 참조 + +더 많은 정보는 다음을 참고한다: + +* [OWASP - TLS 참고자료](https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html) +* [Mozilla's 서버측 TLS 구성 가이드](https://wiki.mozilla.org/Security/Server_Side_TLS) +* [Mozilla's 일반적으로 알려진 좋은 TLS 구성 툴](https://ssl-config.mozilla.org/). +* [O-Saft - TLS 구성 검증을 위한 OWASP 프로젝트](https://owasp.org/www-project-o-saft/) diff --git a/5.0/ko/0x22-V13-Configuration.md b/5.0/ko/0x22-V13-Configuration.md new file mode 100644 index 0000000000..9774889038 --- /dev/null +++ b/5.0/ko/0x22-V13-Configuration.md @@ -0,0 +1,68 @@ +# V13 설정 + +## 제어 목표 + +인터넷상에서 사용하기 위해 애플리케이션의 기본 설정은 안전해야 한다. + +이 챕터에서는 이를 달성하기 위해 개발, 빌드, 배포 과정에서 적용되는 설정들을 비롯한 여러 설정에 대한 가이던스를 제공한다. + +이 주제는 데이터 유출 방지, 컴포넌트 간의 안전한 의사소통, 비밀 정보 보호 등을 다룬다. + +## V13.1 설정 문서 + +이 섹션은 서비스 비접근성으로 인한 가용성 손실을 방지하는 기술을 포함하여, 애플리케이션이 내부, 외부 서비스와 통신을 하기 위한 요구사항들의 문서화에 대해 간략히 서술하고 있다. 또한 비밀 정보와 관련된 문서화에 대해서도 다루고 있다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **13.1.1** | 애플리케이션의 모든 통신 요구사항이 문서화 되어 있는지를 검증한다. 이는 애플리케이션이 의존하는 외부 서비스나, 사용자가 애플리케이션이 연결할 외부 위치를 제공하는 경우들을 포함한다. | 2 | +| **13.1.2** | 애플리케이션이 사용하는 각각의 서비스들에 대해, 문서가 최대 동시 연결 수(연결 풀 제한)를 정의하고 있는지, 그리고 그 한계에 다다랐을 때 폴백(fallback)이나 복구 메커니즘 등을 포함하여, DoS 공격을 방지하기 위해 애플리케이션이 어떻게 동작하는지를 검증한다. | 3 | +| **13.1.3** | 애플리케이션 문서가 모든 외부 시스템이나 애플리케이션이 사용하는 서비스(예시: 데이터베이스, 파일 핸들, 스레드, HTTP 연결)들에 대한 자원-관리 전략을 정의하고 있는지 검증한다.이는 자원-해제 프로시저, 시간초과 설정, 오류 핸들링을 포함하며, 재시도 로직이 구현된 경우 재시도 제한과 지연, 백-오프 알고리즘을 명시해야 한다. 동기 HTTP 요청-응답 명령에 대해서는 짧은 타임아웃에 더해 재시도의 비활성화 혹은 연쇄적인 지연과 자원 고갈을 방지하기 위한 재시도의 엄격한 제한을 의무화해야 한다. | 3 | +| **13.1.4** | 애플리케이션 문서가 조직의 위협 모델과 사업적 요구사항에 기반하여, 애플리케이션의 보안과 비밀 정보들의 주기적 갱신 일정에 치명적인 비밀 정보들을 정의하고 있는지 검증한다. | 3 | + +## V13.2 백엔드 통신 설정 + +애플리케이션들은 여러 API, 데이터베이스 또는 다른 컴포넌트 등과 함께 상호작용한다. 이것들은 애플리케이션의 표준 접근 제어 메커니즘에 포함되어 있기보다 애플리케이션 내부에 존재한다고 고려되거나, 혹은 완전 외부에 존재한다고 여겨진다. 각각의 경우 모두 이 컴포넌트들과 안전하게 상호작용하고, 또 유사시 그 설정을 보호하는 도록 애플리케이션을 설정하는 것이 필수적이다. + +참고: “안전한 통신” 챕터는 전송의 암호화를 위한 가이던스를 제공한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **13.2.1** | API나 미들웨어와 같은 애플리케이션의 표준 사용자 세션 메커니즘을 지원하지 않는 백엔드 애플리케이션 컴포넌트와 데이터 계층 사이의 통신이 인증되어 있는지를 검증한다. 인증은 반드시 개별적인 서비스 계정과 단기간 토큰, 또는 인증서 기반 인증을 사용하고 비밀번호, API 키, 또는 접근 권한이 부여된 공유 계정 등의 자격 증명을 변경하지 않아선 안 된다. | 2 | +| **13.2.2** | 로컬 또는 운영체제 서비스, API, 미들웨어, 그리고 데이터 계층을 포함한 백엔드 애플리케이션 컴포넌트 간의 통신이 최소 필요 권한이 할당된 계정들로 수행되는지 검증한다. | 2 | +| **13.2.3** | 만약 자격 증명이 서비스 인증을 위해 필요하다면, 소비자로부터 사용되는 그 자격 증명이 기본 자격 증명이 아님을 검증한다. (예시: root/root 또는 admin/admin) | 2 | +| **13.2.4** | 얼로우리스트가 애플리케이션의 통신이 허가된 외부 리소스나 시스템을 정의하기 위해 사용되는지 검증한다. (예시: 아웃바운드 요청, 데이터 로드, 파일 접근). 이 얼로우리스트는 애플리케이션 계층, 웹 서버, 방화벽 또는 다른 여러 계층의 조합으로 구현할 수 있다. | 2 | +| **13.2.5** | 웹이나 애플리케이션 서버에 요청을 보내거나 데이터나 파일을 로드 할 수 있는 리소스 또는 시스템의 얼로우리스트가 설정되어 있는지를 검증한다. | 2 | +| **13.2.6** | 애플리케이션이 별도의 서비스와 연결할 때, 각 연결이 최대 병렬연결, 최대 연결 도달 시의 동작, 연결 타임아웃, 재시도 전략 등 문서화된 설정에 따르는지 검증한다. | 3 | + +## V13.3 비밀 정보 관리 + +비밀 정보 관리는 애플리케이션에서 사용되는 데이터를 보호하기 위해 필수적인 설정이다. 암호에 대한 특정 요구사항들은 “암호” 챕터에서 찾아볼 수 있고, 이 섹션에서는 비밀 정보들의 관리와 취급의 측면에 초점을 둔다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **13.3.1** | 키 볼트와 같은 비밀 정보 관리 솔루션이 백엔드 비밀 정보들을 만들고 저장하고, 접근을 제어하고, 파기하기 위해 사용되고 있는지 검증한다. 이는 비밀번호, 키 재료, 데이터베이스와 서드 파티 시스템의 통합, 시간-기반 토큰을 위한 키와 시드, 그리고 API 키들을 포함할 수 있다. 비밀 정보들은 애플리케이션 소스 코드 내부나, 빌드 아티팩트에 포함되어서는 안 된다. L3 애플리케이션에 대해서는, 반드시 HSM과 같은 하드웨어 기반 솔루션을 사용해야 한다. | 2 | +| **13.3.2** | 비밀 정보 자원들에 대한 접근이 최소 권한의 원칙을 고수하는지 검증한다. | 2 | +| **13.3.3** | 보안 모듈에 대한 외부의 노출로부터 안전하게 키 재료를 관리하고 보호하기 위해 모든 암호 연산이 고립된 보안 모듈(볼트나, 하드웨어 보안 모듈 등)을 사용하여 수행되는지 검증한다. | 3 | +| **13.3.4** | 애플리케이션의 문서를 기반으로 비밀 정보들이 만료되고 갱신되도록 설정되었는지 검증한다. | 3 | + +## V13.4 의도하지 않은 정보 노출 + +운영환경 설정은 불필요한 데이터가 공개되는 것을 피하기 위해 강화되어야 한다. 의도하지 않은 정보의 노출은 심각한 위협으로 평가되지는 않지만 자주 다른 취약점들과 연계된다. 이러한 문제들이 기본적으로 존재하지 않으면 애플리케이션에 대한 공격 난이도를 높일 수 있다. + +예를 들어 서버단 컴포넌트의 버전 정보를 숨긴다고 해서 모든 컴포넌트를 패치할 필요가 없어지는 것은 아니지만, 또 폴더 목록 보기를 비활성화한다고 인증 제어를 사용하거나 공용 폴더로부터 파일을 제거할 필요가 없어지는 것은 아니지만, 이는 공격의 난이도를 높인다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **13.4.1** | 애플리케이션이 .git 이나 .svn 폴더 같은 소스 코드 관리 메타데이터 없이 배포되었는지, 또는 이 폴더들이 외부적으로든 애플리케이션 자체에서든 접근할 수 없도록 배포되었는지 검증한다. | 1 | +| **13.4.2** | 실제 운영환경에서 디버깅 기능 노출이나 정보 누출을 방지하기 위해, 모든 컴포넌트에서 디버그 모드가 비활성화되어 있는지 검증한다. | 2 | +| **13.4.3** | 분명히 의도된 것이 아닌 이상 웹 서버가 폴더 목록을 클라이언트에게 노출하지 않는지 검증한다. | 2 | +| **13.4.4** | 잠재적인 정보 누출을 방지하기 위해 실제 운영환경에서 HTTP TRACE 메소드 사용이 지원되지 않는지 검증한다. | 2 | +| **13.4.5** | 분명히 의도된 것이 아닌 이상 문서(내부 API 같은)와 모니터링 엔드포인트가 노출되지 않는지 검증한다. | 2 | +| **13.4.6** | 애플리케이션이 백엔드 컴포넌트의 자세한 버전 정보를 노출하지 않는지 검증한다. | 3 | +| **13.4.7** | 웹 계층이 의도적이지 않은 정보, 설정, 소스코드 누출을 방지하기 위해 특정 파일 확장자만 서비스하도록 설정되었는지 검증한다. | 3 | + +## 참조 + +더 많은 정보는 다음을 참고한다: + +* [OWASP Web Security Testing Guide: Configuration and Deployment Management Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing) diff --git a/5.0/ko/0x23-V14-Data-Protection.md b/5.0/ko/0x23-V14-Data-Protection.md new file mode 100644 index 0000000000..5b3b6a5711 --- /dev/null +++ b/5.0/ko/0x23-V14-Data-Protection.md @@ -0,0 +1,60 @@ +# V14 데이터 보호 + +## 제어 목표 + +애플리케이션은 모든 사용 패턴과 사용자 행동을 고려할 수 없으므로, 클라이언트 기기의 민감한 데이터에 대한 비인가 접근를 제한하는 기능 구현이 권장된다. + +이 장에서는 보호해야 하는 데이터, 보호해야 하는 방법, 구현해야 하는 구체적인 메커니즘 또는 피해야 할 실수들과 관련된 요구사항이 포함된다. + +데이터 보호에서 또 다른 고려 사항은 데이터 대량 추출, 무단 변경, 과도한 자원 사용이다. 각 시스템의 요구사항은 매우 다를 가능성이 높으므로, 무엇이 "비정상"인지 판단하려면 위협 모델과 비즈니스 리스크를 고려해야 한다. ASVS 관점에서 이러한 문제들을 탐지하는 것은 “보안 로그와 오류 처리” 장에서 다루며, 한도 설정은 “검증과 비즈니스 로직” 장에서 다룬다. + +## V14.1 데이터 보호 문서화 + +데이터를 보호하기 위한 핵심 조건은 어떤 데이터를 민감한 데이터로 간주해야 하는지 분류하는 것이다. 민감도에는 몇가지 수준이 있을 수 있으며, 각 수준별로 데이터를 보호하기 위해 필요한 통제는 서로 다르다. + +애플리케이션이 민감한 개인정보를 저장, 사용, 전송의 접근 방식에 영향을 미치는 다양한 개인정보보호 규정 및 법률이 존재한다. 이 절에서는 이러한 유형의 테이터 보호 또는 개인정보보호 법률을 반복해서 다루지 않지만, 민감한 데이터를 보호하기 위한 핵심기술의 고려사항에 초점을 맞춘다. 현지 법률 및 규정을 확인하고, 필요에 따라 자격을 갖춘 개인정보보호 전문가나 변호사와 상의한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **14.1.1** | 애플리케이션이 생성하고 처리하는 모든 민감한 데이터가 식별되고 보호 수준으로 분류되었는지 확인한다. 여기에는 단순히 인코딩되어 있고 쉽게 디코딩할 수 있는 데이터, 예를 들어 Base64 문자열이나 JWT 내부 평문 페이로드가 포함된다. 보호 수준은 애플리케이션이 준수해야 하는 모든 데이터 보호 및 개인정보 보호 관련 규정과 표준을 반드시 고려해야 한다. | 2 | +| **14.1.2** | 모든 민감한 데이터의 보호 수준에 대해 문서화된 요구사항이 있는지 확인한다. 반드시 여기에는(이에 한정되지 않지만) 일반적인 암호화, 무결성 검증, 보존 기간, 데이터 로그 기록 방식, 로그 내 민감한 데이터에 대한 접근 제어, 데이터베이스 암호화 수준, 사용할 개인정보 보호 및 개인정보 보호 강화 기술, 그리고 기타 기밀성 요구사항들 관련하여 포함되어야 한다. | 2 | + +## V14.2 일반 데이터 보호 + +이 절에는 데이터 보호와 관련하여 다양하게 실제로 적용가능한 요구사항들이 포함되어 있다. 대부분은 의도하지 않은 데이터 유출과 같은 특정 문제를 다루지만, 각 데이터 항목에 요구되는 보호 수준에 따라 보호 통제를 구현해야 하는 일반적인 요구사항도 있다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **14.2.1** | 민감한 데이터는 HTTP 메시지 본문이나 헤더 필드로만 서버에 전송되고, URL과 쿼리 문자열에는 API키나 세션토큰처럼 민감한 정보가 포함되지 않도록 검증한다. | 1 | +| **14.2.2** | 서버 구성 요소에서 로드밸런서나 애플리케이션 캐시와 같은 민감한 데이터가 캐시되지 않게 하거나, 사용 후 해당 데이터를 안전하게 삭제하도록 검증한다. | 2 | +| **14.2.3** | 정의된 민감한 데이터가 애플리케이션의 통제를 벗어난 곳에서 원치 않는 수집을 예방하기 위해 신뢰할 수 없는 대상(예: 사용자 추적기)에게 전송되지 않도록 검증한다. | 2 | +| **14.2.4** | 암호화, 무결성 검증, 보존, 데이터 로그 기록 방식, 로그 내 민감한 데이터 접근 제어, 개인정보 보호 및 개인정보 보호 강화 기술과 관련된 민감한 데이터 통제가, 해당 데이터 보호 수준에 대한 문서에 정의된 대로 구현되었는지 검증한다. | 2 | +| **14.2.5** | 캐시 메커니즘이 해당 리소스에 대해 예상되는 콘텐츠 유형을 가진 응답만 캐시하고, 민감하거나 동적인 콘텐츠는 캐시하지 않도록 구성되어 있는지 검증한다. 존재하지 않는 파일에 접근했을 때 다른 유효한 파일을 반환하는 대신 웹 서버는 404 또는 302 응답을 반환해야 한다. 이는 Web Cache Deception 공격을 예방한다. | 3 | +| **14.2.6** | 애플리케이션 기능에 필요한 최소한의 민감한 데이터만 반환을 검증한다. 예를 들어, 전체 신용카드 번호가 아닌 일부 숫자만 반환해야 한다. 만약 전체 데이터가 필요한 경우, 사용자가 구체적으로 조회하지 않는 한 사용자 인터페이스에서는 마스킹하는 것이 권장된다. | 3 | +| **14.2.7** | 민감한 정보는 데이터 보존 분류 기준에 따라 관리되어야 하고, 오래되었거나 불필요한 데이터는 사전에 정의된 작업 또는 상황에 따라 자동으로 삭제되도록 검증한다. | 3 | +| **14.2.8** | 사용자가 제출한 파일의 메타데이터에서 사용자가 저장에 동의하지 않는 한 민감한 정보는 제거를 검증한다. | 3 | + +## V14.3 클라이언트 측 데이터 보호 + +이 절에서는 클라이언트 또는 사용자 에이전트 측에서 애플리케이션의 데이터가 특정 방식으로 유출되는 것을 방지하기 위한 요구사항을 다룬다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **14.3.1** | 클라이언트나 세션이 종료된 후에 브라우저 DOM과 같은 클라이언트 스토리지에서 인증된 데이터를 삭제되는지 검증한다. 이를 위해 ‘Clear-Site-Data’ HTTP 응답 헤더 필드를 사용할 수 있으나, 세션 종료 시 서버 연결이 불가능한 경우에도 클라이언트 측에서 해당 데이터를 삭제하는 것이 권장된다. | 1 | +| **14.3.2** | 애플리케이션이 브라우저에서 민감한 데이터가 캐시되지 않도록, (Cache-Control: no-store)충분한 캐시 방지 HTTP 응답 헤더 필드를 설정을 검증한다. | 2 | +| **14.3.3** | 브라우저 저장소(localStorage, sessionStorage, IndexedDB, 쿠키)에 저장되는 데이터에는 세션 토큰을 제외한 민감 데이터가 포함되지 않도록 검증한다. | 2 | + +## 참조 + +자세한 내용은 다음을 참고한다: + +* [Consider using the Security Headers website to check security and anti-caching header fields](https://securityheaders.com/) +* [Documentation about anti-caching headers by Mozilla](https://developer.mozilla.org/en-US/docs/Web/HTTP/Caching) +* [OWASP Secure Headers project](https://owasp.org/www-project-secure-headers/) +* [OWASP Privacy Risks Project](https://owasp.org/www-project-top-10-privacy-risks/) +* [OWASP User Privacy Protection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/User_Privacy_Protection_Cheat_Sheet.html) +* [Australian Privacy Principle 11 - Security of personal information](https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-11-app-11-security-of-personal-information) +* [European Union General Data Protection Regulation (GDPR) overview](https://www.edps.europa.eu/data-protection_en) +* [European Union Data Protection Supervisor - Internet Privacy Engineering Network](https://www.edps.europa.eu/data-protection/ipen-internet-privacy-engineering-network_en) +* [Information on the "Clear-Site-Data" header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Clear-Site-Data) +* [White paper on Web Cache Deception](https://www.blackhat.com/docs/us-17/wednesday/us-17-Gil-Web-Cache-Deception-Attack-wp.pdf) diff --git a/5.0/ko/0x24-V15-Secure-Coding-and-Architecture.md b/5.0/ko/0x24-V15-Secure-Coding-and-Architecture.md new file mode 100644 index 0000000000..bb226f908d --- /dev/null +++ b/5.0/ko/0x24-V15-Secure-Coding-and-Architecture.md @@ -0,0 +1,77 @@ +# V15 보안 코딩 및 아키텍처 + +## 제어 목표 + +많은 ASVS 요구사항은 인증 및 권한 부와 같은 특정 보안 영역에 관련되거나, 로깅 및 파일 처리와 같은 특정 애플리케이션 기능과 관련되어 있다. + +이번 장에서는 애플리케이션을 설계하고 개발할 때 고려해야 하는 일반적인 보안 요구사항을 제시한다. 이러한 요구사항은 클린 아키텍처와 코드 품질뿐만 아니라, 애플리케이션 보안을 위해 필요한 구체적인 아키텍처 설계 및 코드 작성 관행에도 중점을 둔다. + +## V15.1 보안 코딩 및 아키텍처 문서화 + +보안적이고 방어 가능한 아키텍처를 수립하기 위한 많은 요구사항은, 특정 보안 통제의 구현 및 애플리케이션에서 사용되는 구성요소에 대한 의사결정이 명확하게 문서화되어 있는지에 따라 달려 있다. + +이 장에서는 위험한 기능(dangerous functionality)을 포함하거나 위험한 구성요소(risky components)로 간주되는 항목을 식별하는 것을 포함하여, 문서화에 필요한 요구사항을 설명한다. + +위험한 기능을 가진 구성요소는 내부적으로 개발되었거나 서드파티 구성요소일 수 있으며, 신뢰할 수 없는 데이터의 역직렬화(deserialization), 원시 파일 또는 바이너리 데이터 파싱, 동적 코드 실행, 메모리 직접 조작 등의 작업을 수행할 수 있다. 이러한 유형의 작업에서 발생하는 취약점은 애플리케이션을 손상시키고 그 기반 인프라를 노출시킬 수 있는 높은 위험을 초래한다. + +위험한 구성요소는 개발 프로세스나 기능에 대한 보안 통제가 없거나 부실하게 구현된 서드파티 라이브러리를 의미하며, 내부적으로 개발되지 않은 구성요소를 포함한다. 예를 들어, 유지 관리가 제대로 이루어지지 않거나, 지원이 종료되었거나, 생명주기가 끝났거나, 심각한 취약점 이력이 있는 구성요소가 이에 해당한다. + +또한 이 장에서는 서드파티 구성요소에 취약점이 발견됐을 때, 이를 얼마나 빨리 해결할 것인지에 대한 대응 기한을 명확히 정하는 것이 중요하다는 점을 강조한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **15.1.1** | 애플리케이션 문서에 취약점이 존재하는 서드파티 구성요소 버전 및 일반적인 라이브러리 업데이트에 대해, 해당 구성요소로부터 발생할 수 있는 위험을 최소화하기 위한 위험 기반 대응 기한이 정의되어 있는지 확인해야 한다. | 1 | +| **15.1.2** | 사용 중인 모든 서드파티 라이브러리에 대해 소프트웨어 자재 명세서(SBOM)와 같은 인벤토리가 유지되고 있으며, 해당 구성요소가 사전에 정의된 신뢰할 수 있고 지속적으로 관리되는 저장소에서 제공되는지 확인해야 한다. | 2 | +| **15.1.3** | 애플리케이션 문서에 시간 소모가 크거나 리소스 소비가 많은 기능이 식별되어 있으며, 해당 기능의 과도한 사용으로 인해 가용성이 손실되지 않도록 하는 방법과, 응답 생성이 소비자의 타임아웃보다 오래 걸리는 상황을 방지하는 방법이 포함되어 있는지 확인해야 한다. 가능한 방어 전략에는 비동기 처리, 큐(queue) 사용, 사용자 및 애플리케이션 단위의 병렬 처리 제한 등이 있다. | 2 | +| **15.1.4** | 애플리케이션 문서에 위험한 구성요소로 간주되는 서드파티 라이브러리가 강조되어 있는지 확인해야 한다. | 3 | +| **15.1.5** | 애플리케이션 문서에 위험한 기능을 사용하는 애플리케이션의 부분이 강조되어 있는지 확인해야 한다. | 3 | + +## V15.2 보안 아키텍처 및 종속성 + +이 장에서는 종속성 관리(dependency management)를 통해 위험하거나 구식이거나 보안에 취약한 종속성과 구성요소를 다루기 위한 요구사항을 포함한다. + +또한, 앞 장에서 정의한 "위험한 동작"이나 "위험한 구성요소"의 사용으로 인한 영향을 줄이기 위해 샌드박싱, 캡슐화, 컨테이너화, 네트워크 격리와 같은 아키텍처 수준의 기법을 활용하는 방법도 포함된다. 이러한 기법은 리소스을 과도하게 사용하는 기능 때문에 발생할 수 있는 가용성 저하를 예방하는 데에도 도움이 된다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **15.2.1** | 애플리케이션이 문서화된 업데이트 및 대응 기한을 위반하지 않은 구성요소만 포함하고 있는지 확인해야 한다. | 1 | +| **15.2.2** | 애플리케이션이 시간 소모가 크거나 리소스 소비가 많은 기능의 과도한 사용으로 인한 가용성 손실을 방지하기 위해, 해당 기능에 대한 문서화된 보안 결정 및 전략을 기반으로 방어 조치를 구현하고 있는지 확인해야 한다. | 2 | +| **15.2.3** | 운영 환경에 애플리케이션 기능 수행에 필요한 기능만 포함되어 있으며, 테스트 코드, 샘플 코드, 개발용 기능 등 불필요한 기능이 노출되지 않도록 구성되어 있는지 확인해야 한다. | 2 | +| **15.2.4** | 서드파티 구성요소 및 그 모든 전이 종속성(transitive dependencies)이 내부 또는 외부의 예상된 저장소에서 가져며, 의존성 혼동(dependency confusion) 공격의 위험이 없는지 확인해야 한다. | 3 | +| **15.2.5** | 애플리케이션이 위험한 기능을 포함하거나 위험한 구성요소를 사용하는 부분에 대해 샌드박싱, 캡슐화, 컨테이너화, 네트워크 수준 격리와 같은 추가적인 보호 기법을 구현하여, 애플리케이션의 한 부분이 침해되더라도 공격자가 다른 영역으로 확산하지 못하도록 지연 및 차단하고 있는지 확인해야 한다. | 3 | + +## V15.3 방어적(Defensive) 코딩 + +이 장에서는 특정 프로그래밍 언어에서 비안전한 코딩 패턴을 사용할 때 발생할 수 있는 취약점 유형을 다룬다. 여기에는 타입 혼용(type juggling), 프로토타입 오염(prototype pollution) 등이 포함되며, 일부는 모든 언어에 적용되지 않지만, 다른 일부는 특정 언어 또는 프레임워크가 HTTP 파라미터와 같은 기능을 처리하는 방식과 관련될 수 있으며, 언어별 대응 방안이 존재할 수 있다. 또한 애플리케이션 업데이트 시 암호학적 검증을 수행하지 않는 것과 관련된 위험도 포함된다. + +또한, 객체를 사용하여 데이터를 표현하고 외부 API를 통해 이를 수신하거나 반환하는 경우에 발생할 수 있는 위험도 고려한다. 이 경우, 애플리케이션은 사용자 입력에 의해 수정되어서는 안 되는 데이터 필드가 변경되지 않도록 보장해야 하며(mass assignment), API는 반환할 데이터 필드를 선택적으로 제한해야 한다. 데이터 필드 접근이 사용자의 권한에 따라 달라지는 경우, 이는 권한 부여 챕터의 필드 수준 접근 통제 요구사항과 함께 고려되어야 한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **15.3.1** | 애플리케이션이 데이터 객체에서 필요한 필드만 선택적으로 반환하고 있는지 확인해야 한다. 예를 들어, 일부 필드는 사용자에게 노출되어서는 안 되므로 전체 데이터 객체를 반환해서는 안 된다. | 1 | +| **15.3.2** | 애플리케이션 백엔드에서 외부 URL로 요청을 보낼 때, 의도된 기능이 아닌 경우 리디렉션을 따르지 않도록 구성되어 있는지 확인해야 한다. | 2 | +| **15.3.3** | 애플리케이션이 각 컨트롤러 및 액션 단위로 허용된 필드를 제한함으로써, 대량 할당(mass assignment) 공격에 대한 방어가 구현되어 있는지 확인해야 한다. 예를 들어, 특정 동작에 포함되지 않은 필드 값을 삽입하거나 수정할 수 없어야 한다. | 2 | +| **15.3.4** | 모든 프록시 및 미들웨어 구성요소가 사용자의 원래 IP 주소를 신뢰 가능한 데이터 필드를 통해 정확하게 전달하고 있으며, 애플리케이션과 웹 서버가 이 값을 로그 기록이나 속도 제한(rate limiting)과 같은 보안 결정에 사용하는지 확인해야 한다. 단, 동적 IP, VPN, 방화벽 등으로 인해 원래 IP조차 완전히 신뢰할 수 없는 점도 고려해야 한다. | 2 | +| **15.3.5** | 애플리케이션이 변수의 타입이 올바른지 명시적으로 확인하고, 엄격한 동등성 비교 및 연산자를 사용하여 타입 혼용(type juggling) 또는 타입 혼동(type confusion)으로 인한 취약점을 방지하고 있는지 확인해야 한다. | 2 | +| **15.3.6** | JavaScript 코드가 프로토타입 오염(prototype pollution)을 방지할 수 있도록 작성되어 있는지 확인해야 한다. 예를 들어, 객체 리터럴 대신 `Set()` 또는 `Map()`을 사용하는 방식이 권장된다. | 2 | +| **15.3.7** | 애플리케이션이 HTTP 파라미터 오염(HTTP parameter pollution) 공격에 대한 방어를 구현하고 있는지 확인해야 한다. 특히, 애플리케이션 프레임워크가 요청 파라미터의 출처(쿼리 스트링, 본문, 쿠키, 헤더)를 구분하지 않는 경우 이를 고려해야 한다. | 2 | + +## V15.4 안전한 동시성 + +경쟁 상태(race condition), 검사-사용 시점 불일치(TOCTOU), 교착 상태, 라이락(livelock), 스레드 기아(thread starvation), 부적절한 동기화 등 동시성 이슈는 예측 불가능한 동작과 보안 위험을 초래할 수 있다. 이 장에서는 이러한 위험을 완화하기 위한 기법과 전략을 제시한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **15.4.1** | 다중 스레드 코드에서 캐시, 파일, 다수 스레드가 접근하는 메모리 내 객체 등 공유 객체에 접근할 때, 스레드 세이프(thread-safe) 타입과 락·세마포어 같은 동기화 메커니즘을 사용하여 경쟁 상태와 데이터 손상을 피하고 안전하게 접근하는지 확인해야 한다. | 3 | +| **15.4.2** | 리소스의 존재 여부나 권한과 같은 상태 검사와, 그 검사 결과에 의존하는 동작이 단일(atomic) 연산으로 수행되어 TOCTOU 경쟁 상태를 방지하는지 확인해야 한다. (예: 파일을 열기 전에 존재 여부를 확인하는 작업과 파일 열기 동작을 분리하지 않기, 접근 권한 검증과 권한 부여를 동일 트랜잭션/원자적 구간에서 수행하기) | 3 | +| **15.4.3** | 스레드가 서로를 기다리거나 무한 재시도에 빠지지 않도록 일관된 락 사용을 보장하고, 락 관리 로직을 리소스 관리 책임 코드 내부에 유지하여 외부 클래스 및 코드가 우발적·악의적으로 락을 변경하지 못하도록 하는지 확인해야 한다. | 3 | +| **15.4.4** | **스레드 풀** 활용 등 **리소스 할당 정책**을 통해 공정한 리소스 접근을 보장하고, 우선순위가 낮은 스레드도 합리적 시간 내 진행될 수 있게 하여 **스레드 기아**를 방지하는지 확인해야 한다. | 3 | + +## 참조 + +자세한 내용은 다음을 참조한다: + +* [OWASP Prototype Pollution Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html) +* [OWASP Mass Assignment Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html) +* [OWASP CycloneDX Bill of Materials Specification](https://owasp.org/www-project-cyclonedx/) +* [OWASP Web Security Testing Guide: Testing for HTTP Parameter Pollution](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/07-Input_Validation_Testing/04-Testing_for_HTTP_Parameter_Pollution diff --git a/5.0/ko/0x25-V16-Security-Logging-and-Error-Handling.md b/5.0/ko/0x25-V16-Security-Logging-and-Error-Handling.md new file mode 100644 index 0000000000..0c6aa34752 --- /dev/null +++ b/5.0/ko/0x25-V16-Security-Logging-and-Error-Handling.md @@ -0,0 +1,84 @@ +# V16 보안 로깅과 오류 처리 + +## 제어 목표 + +보안 로그는 오류나 성능 로그와 달리 인증 결정, 접근 제어 결정, 그리고 입력값 확인이나 비즈니스 로직 확인 등의 보안 제어 우회 시도와 같은 보안과 관련된 이벤트를 기록하는데 사용된다. 보안 로그의 목적은 SIEM과 같은 분석 도구에 고신뢰성의 구조화된 데이터를 제공함으로써 감지, 응답, 조사를 돕는 것이다. + +로그는 법적으로 요구되지 않는 이상, 민감한 개인 정보를 포함해서는 안 되고, 모든 로그 데이터는 높은 가치의 자원으로서 보호되어야 한다. 로깅이 프라이버시나 시스템 보안을 훼손해서는 안 된다. 애플리케이션은 오류가 나더라도 안전하게 발생해야 하고, 불필요한 공개나, 혼란을 방지해야 한다. + +더욱 자세한 구현 지침은 참조 섹션의 OWASP 치트 시트를 참조한다. + +## V16.1 보안 로깅 문서화 + +이번 섹션은 애플리케이션 스택 전체에 걸친 완전하고 명확한 로깅 내역을 보장한다. 이는 효과적인 보안 모니터링, 사고 대응, 그리고 컴플라이언스에 필수적이다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **16.1.1** | 애플리케이션의 기술 스택의 각 계층에서 수행된 로깅에 대해, 어떤 이벤트들이 로그로 남았는지, 로그의 형식이 무엇인지, 로그가 어디에 저장되었는지, 어떻게 사용되는지, 로그에 대한 접근이 어떻게 제어되는지, 그리고 로그가 얼마나 보관되는지에 대해 문서화한 목록이 존재하는지 검증한다. | 2 | + +## V16.2 일반 로깅 + +이번 섹션은 보안 로그가 일관적으로 구조화되어 있고, 필요한 메타데이터들을 포함하고 있음을 보장하기 위한 요구사항들을 제공한다. 목표는 분산 시스템들과 도구들에서 로그를 기계가 읽고, 분석할 수 있도록 만드는 것이다. + +보안 이벤트는 일반적으로 민감한 데이터와 연관된다. 만약 데이터가 주의하지 않고 로깅 되었다면, 그 로그들 자체가 기밀로 분류되어 암호화 요구사항, 더 엄격한 보관 정책, 그리고 감사 시 잠재적 공개 위험이 발생한다. + +그러므로 정말 필요한 것들만 로깅하고, 또 로그를 다른 민감한 자산들처럼 다루는 것이 매우 중요하다. + +아래의 요구사항들은 로깅의 메타데이터, 동기화, 형식, 그리고 제어에 대해 기초적인 요구사항들을 확립한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **16.2.1** | 이벤트가 발생했을 때 그 타임라인을 자세히 조사할 수 있도록 각 로그의 항목이 필수적인 메타데이터(언제, 어디서, 누가, 무엇을 등)을 포함하는지 검증한다. | 2 | +| **16.2.2** | 모든 로깅 컴포넌트의 시간 소스가 동기화되어 있는지, 그리고 보안 이벤트 메타데이터에서 타임스탬프가 UTC를 사용하거나 혹은 명시적인 시간대 오프셋을 포함하는지 검증한다. UTC는 분산 시스템 전체에 걸친 일관성을 보장하고, 일광 절약 시간제 전환 시의 혼란을 방지하기 위해 추천된다. | 2 | +| **16.2.3** | 애플리케이션이 로그를 저장만 하는지, 혹은 로그 목록에서 문서화 된 파일이나 서비스로 브로드캐스트하는지 검증한다. | 2 | +| **16.2.4** | 사용 중인 로그 처리기가 로그를 읽고, 또 상호 연관 지을 수 있는지 검증한다. 가능하다면 공통 로깅 형식을 사용하는 것이 좋다. | 2 | +| **16.2.5** | 민감한 데이터를 로깅할때, 애플리케이션이 데이터의 보호 수준을 기반으로 로깅을 수행하는지 검증한다. 예를 들어, 자격 증명이나, 지불 상세 정보 등의 특정 데이터는 로깅 해서는 안 된다. 또한 세션 토큰 등의 데이터는 전체 혹은 일부분이 해싱된, 마스킹 된 상태로 로깅 되어야 한다. | 2 | + +## V16.3 보안 이벤트 + +이번 섹션에서는 애플리케이션 내 보안 관련 이벤트들의 로깅을 위한 요구사항들을 정의한다. 이러한 이벤트들을 수집하는 것은 의심스러운 행위를 탐지하고, 조사를 돕고, 컴플라이언스 의무를 달성하기 위해 매우 중요하다. + +이번 섹션은 로깅 되어야 할 이벤트들에 대해 간략히 설명하고 있지만, 모든 세부 사항을 다 다루려는 것은 아니다. 각 애플리케이션은 자신만의 위험 요소들과 운영의 맥락을 가진다. + +ASVS는 보안 이벤트의 로깅을 범위에 포함하는 반면, 경보(alerting)와 상관분석(correlation, 예시: SIEM 규칙이나 모니터링 인프라스트럭처)은 범위에 포함하지 않는다. 이는 운영 및 모니터링 시스템에서 다루어진다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **16.3.1** | 성공한 시도와 실패한 시도를 포함하여 모든 인증 명령을 로깅 하는지 검증한다. 인증의 종류나, 사용한 인증 요소 등의 추가적인 메타데이터 또한 수집해야 한다. | 2 | +| **16.3.2** | 실패한 인가 시도들도 로깅 하는지 검증한다. L3에 대해서는 반드시 민감한 데이터가 접근되었을 때를 포함하여(민감한 데이터 자체는 제외하고) 모든 인가 결정들의 로그를 포함해야 한다. | 2 | +| **16.3.3** | 애플리케이션이 이 문서에서 정의한 보안 이벤트들을 로깅하고, 또한 입력값 확인, 비즈니스 로직, 그리고 자동화 방지 등의 보안 제어를 우회하려는 시도들도 로깅 하는지 검증한다. | 2 | +| **16.3.4** | 애플리케이션이 백엔드 TLS 오류와 같은 예상치 못한 오류나 보안 제어 오류들을 로깅 하는지 검증한다. | 2 | + +## V16.4 로그 보호 + +로그는 중요한 포렌식 아티팩트이며 반드시 보호해야 한다. 만약 로그가 쉽게 수정되거나 삭제된다면 로그는 자신의 무결성을 잃고, 사고 조사나 법적 절차에서 신뢰할 수 없게 된다. 로그는 내부 애플리케이션의 동작이나 민감한 메타데이터를 노출할 수 있으므로 공격자들에게 매력적인 표적이 될 수 있다. + +이번 섹션은 로그를 비인가 접근, 위조, 공개로부터 보호하고 로그들이 안전하게 전송되고 또 안전하고 격리된 시스템에 저장되도록 보장하기 위한 요구사항들을 정의한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **16.4.1** | 로그 삽입을 방지하기 위해 모든 로깅 컴포넌트가 적절히 데이터를 인코딩하는지 검증한다. | 2 | +| **16.4.2** | 로그가 비인가된 접근으로부터 보호되고 수정할 수 없는지 검증한다. | 2 | +| **16.4.3** | 분석, 탐지, 경보, 그리고 에스컬레이션(escalation)을 위해 로그가 논리적으로 분리된 시스템으로 안전하게 전송되는지 검증한다. 애플리케이션이 침해되더라도 로그는 훼손하지 못하도록 보장하는 것이 목적이다. | 2 | + +## V16.5 오류 처리 + +이번 섹션은 애플리케이션이 민감한 내부 상세 정보를 공개하지 않고 안전하고 우아한 오류 발생을 보장하기 위한 요구사항들을 정의한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **16.5.1** | 예상치 못한 혹은 보안 측면에서 민감한 오류가 발생했을 때 스택 흔적, 쿼리, 비밀키, 그리고 토큰 등의 민감한 내부 시스템 데이터의 노출 방지를 보장하기 위해 유저에게 구체화하지 않은 메시지를 반환하는지 검증한다. | 2 | +| **16.5.2** | 외부 리소스 접근 오류가 발생하더라도 애플리케이션이 계속해서 안전하게 작동하는지 검증한다. 예를 들어 서킷 브레이커(circuit breaker)나 우아한 성능 저하와 같은 패턴을 사용할 수 있다. | 2 | +| **16.5.3** | 예외가 발생할 때, 검증 로직의 오류에도 불구하고 거래를 처리하는 등의 페일-오픈(fail-open) 상태 방지를 포함하여 애플리케이션이 우아하고 안전하게 실패하는지 검증한다. | 2 | +| **16.5.4** | 처리되지 못한 모든 예외를 처리할 “최후의 수단” 오류 핸들러가 정의되어 있는지 검증한다. 이는 로그 파일에 기록되어야 하는 오류 상세 정보들의 손실을 피하기 위함과 동시에, 오류로 인해 전체 애플리케이션 프로세스가 종료되어 가용성 손실로 이어지지 않도록 보장하기 위함이다. | 3 | + +참고: Swift나 Go 등의 특정 언어들, 그리고 일반적인 설계 관례상의 많은 함수형 언어들은 예외나 최후의 수단 이벤트 핸들러를 지원하지 않는다. 이 경우에는 설계자나 개발자들이 애플리케이션이 안전하게 예외와 예상치 못한 혹은 보안 관련 이벤트들을 처리하도록 보장하기 위해 패턴이나, 언어, 프레임워크 친화적인 방법을 사용해야 한다. + +## 참조 + +더 많은 정보는 다음을 참고한다: + +* [OWASP Web Security Testing Guide: Testing for Error Handling](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/README) +* [OWASP Authentication Cheat Sheet section about error messages](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#authentication-and-error-messages) +* [OWASP Logging Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html) +* [OWASP Application Logging Vocabulary Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Vocabulary_Cheat_Sheet.html) diff --git a/5.0/ko/0x26-V17-WebRTC.md b/5.0/ko/0x26-V17-WebRTC.md new file mode 100644 index 0000000000..a5a1b38dd7 --- /dev/null +++ b/5.0/ko/0x26-V17-WebRTC.md @@ -0,0 +1,75 @@ +# V17 WebRTC + +## 제어 목표 + +웹 실시간 통신(WebRTC)은 최신 애플리케이션에서 음성과 동영상 및 데이터를 실시간으로 교환할 수 있도록 한다. 도입이 늘어남에 따라 WebRTC 인프라스트럭처 보안이 점점 중요해지고 있다. 이 섹션은 WebRTC 시스템을 개발, 제공, 혹은 통합하는 이해관계자들에게 보안 요구사항을 제공한다. + +WebRTC 시장은 크게 세 개의 분야로 나눌 수 있다: + +1. 제품 개발자: WebRTC 제품과 솔루션을 제작하고 공급하는 소유자나 오픈 소스 벤더이다. 그들은 다른 사람들이 사용할 수 있는 강건하고 안전한 WebRTC 기술을 개발하는 것이 목표이다. + +2. 서비스형 통신 플랫폼 (CPaaS): WebRTC 기능을 가능하게 하기 위한 API, SDK와 필수적인 인프라스트럭처 혹은 플랫품을 제공하는 제공자이다. CPaaS 제공자는 서비스를 제공하기 위해 첫번째 분야의 제품을 사용하거나 자체 개발한 WebRTC 소프트웨어를 사용할 수 있다. + +3. 서비스 제공자: 제품 개발자 혹은 CPaaS 제공자의 제품, 또는 자체 개발한 WebRTC 솔루션을 개발하고 활용하는 조직이다. 이런 조직은 온라인 컨퍼런스나 헬스케어, e-러닝 등 다양한 도메인에서 실시간 통신이 필요한 애플리케이션을 제작하고 구현한다. + +보안 요구사항은 이곳에 제시되어 있으며 우선적으로 다음과 같은 제품 개발자, CPaaS와 서비스 제공자 초점이 맞추고 있다: + +* WebRTC 애플리케이션을 만들기 위해 오픈 소스 솔루션 활용 +* 인프라스트럭처에서 부분적으로 상용 WebRTC 제품 사용 +* 내부적으로 개발된 WebRTC 솔루션을 사용하거나 유기적인 서비스 제품에 다양한 컴포넌트를 통합 + +보안 요구사항은 예외적으로 CPaaS 에서 제공하는 SDK와 API를 사용하는 개발자들에게는 적용되지 않는다는 것을 알아두어야 한다. CPaaS 제공자는 당사 플랫폼의 보안 우려점에 대한 일반적인 책임이 있으며 ASVS 같은 일반적인 보안 표준은 그들의 수요를 모두 충족하지 못할 수 있다. + +## V17.1 TURN 서버 + +이 섹션은 고유의 TURN(Traversal Using Relays around NAT)을 실행하는 시스템을 위한 보안 요구사항을 정의 한다. TURN 서버는 제한된 네트워크 환경에서 미디어 중계를 보조하는데, 설정이 잘못된 경우 위험을 초래할 수 있다. 이 제어는 안전한 주소 필터링과 자원 고갈을 방지하는데 초첨을 맞추고 있다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **17.1.1** | Traversal Using Relays around NAT(TURN) 서비스가 특정 목적을 위해 보존된 주소(예: 내부 네트워크, 브로드캐스트, 루프백)를 제외한 주소에 대해서만 접근을 허용하도록 한다. | 2 | +| **17.1.2** | Traversal Using Relays around NAT(TURN) 서비스가 정당한 사용자의 TURN 서버 포트의 대량 개방 시 자원고갈에 취약하지 않도록 한다. | 3 | + +## V17.2 미디어 + +이러한 요구사항은 선택적 포워딩 유닛 (SFUs, Selective Forwarding Units), 다중점 제어 유닛 (MCUs, Multipoint Control Units), 기록 서버 혹은 게이트웨이 서버 등 고유의 WebRTC 미디어 서버를 호스팅하는 시스템에게만 적용된다. 미디어 서버는 미디어 스트림을 처리하고 배포하므로, 피어 간 통신을 보호하기 위한 서버 보안이 매우 중요하다. 사용자 프라이버시와 통신 품질을 위협할 수 있는 도청, 변조, 서비스 거부 공격을 방지하기 위해 WebRTC 애플리케이션에서 미디어 스트림 보호는 최우선 과제이다. + +특히, 속도 제한, 타임스탬프 검증, 실시간 간격 일치를 위한 동기화된 시계 사용, 오버플로우 방지 및 적절한 타이밍 유지를 위한 버퍼 관리와 같은 플러드 공격에 대한 보호 장치를 구현해야 한다. 특정 미디어 세션의 패킷이 너무 빠르게 도착할 경우 초과 패킷은 삭제되어야 한다. 또한 입력 검증 구현, 정수 오버플로우 안전 처리, 버퍼 오버플로우 방지 및 기타 견고한 오류 처리 기법을 통해 시스템이 잘못된 형식의 패킷으로부터 보호받는 것이 중요하다. + +중간 미디어 서버의 개입 없이 웹 브라우저 간 피어 투 피어 미디어 통신에만 의존하는 시스템은 이러한 특정 미디어 관련 보안 요구사항에서 제외된다. + +이 섹션은 WebRTC 환경에서 데이터그램 전송 계층 보안(DTLS)의 사용을 다룬다. 암호화 키 관리에 대한 문서화된 정책 수립과 관련된 요구사항은 "암호화" 장에서 확인할 수 있다. 승인된 암호화 방법에 대한 정보는 ASVS의 암호화 부록 또는 NIST SP 800‑52 Rev. 2 or BSI TR‑02102‑2 (Version 2025‑01) 등의 문서에서 확인할 수 있다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **17.2.1** | 데이터그램 전송 계층 보안(DTLS) 인증서의 키가 암호화 키 관리에 대한 문서화된 정책에 따라 관리되고 보호되는지 확인해야 한다. | 2 | +| **17.2.2** | 미디어 서버가 승인된 데이터그램 전송 계층 보안(DTLS) 암호 모음을 사용하고 지원하도록 구성되었는지, 그리고 보안 실시간 전송 프로토콜(DTLS-SRTP)을 위한 키 생성에 사용되는 DTLS 확장을 위한 안전한 보호 프로파일을 구성했는지 확인해야 한다. | 2 | +| **17.2.3** | 미디어 서버에서 보안 실시간 전송 프로토콜(SRTP) 인증이 선택되어 있는지 확인한다. 이를 통해 실시간 전송 프로토콜(RTP) 삽입 공격으로 인한 서비스 거부 상태 발생 또는 오디오/비디오 미디어가 미디어 스트림에 삽입되는 것을 방지할 수 있다. | 2 | +| **17.2.4** | 미디어 서버가 잘못된 형식의 보안 실시간 전송 프로토콜(SRTP) 패킷을 접했을 때도 수신 미디어 트래픽 처리를 계속할 수 있는지 확인해야 한다. | 2 | +| **17.2.5** | 미디어 서버가 정상 사용자로부터의 보안 실시간 전송 프로토콜(SRTP) 패킷이 대량으로 유입되는 상황에서도 수신 미디어 트래픽 처리를 계속할 수 있는지 확인해야 한다. | 3 | +| **17.2.6** | 미디어 서버가 Datagram Transport Layer Security(DTLS)의 “ClientHello” 경합 조건 취약점에 노출되지 않았는지 확인해야 한다. 이를 위해 해당 미디어 서버가 공개적으로 취약한 것으로 알려져 있는지 확인하거나 경합 조건 테스트를 수행해야 한다. | 3 | +| **17.2.7** | 미디어 서버와 연결된 모든 오디오 또는 비디오 녹화 장치가 합법적인 사용자로부터의 보안 실시간 전송 프로토콜(SRTP) 패킷이 대량으로 유입되는 상황에서도 수신 미디어 트래픽 처리를 계속할 수 있는지 확인해야 한다. | 3 | +| **17.2.8** | 데이터그램 전송 계층 보안(DTLS) 인증서가 세션 설명 프로토콜(SDP) 지문 속성과 대조되어 검증되었는지 확인하고, 검증이 실패할 경우 미디어 스트림을 종료하여 미디어 스트림의 진위성을 보장해야 한다. | 3 | + +## V17.3 신호 처리 + +이 섹션은 자체 WebRTC 신호 서버를 운영하는 시스템에 대한 요구 사항을 정의한다. 신호는 피어 투 피어 통신을 조정하며, 세션 설정 또는 제어를 방해할 수 있는 공격에 대해 복원력을 가져야 한다. + +안전한 신호 처리를 보장하기 위해 시스템은 잘못된 형식의 입력을 우아하게 처리하고 부하 상태에서도 가용성을 유지해야 한다. + +| # | 설명 | 레벨 | +| :---: | :--- | :---: | +| **17.3.1** | 신호 서버가 플러드 공격 중에도 합법적인 수신 신호 메시지 처리를 계속할 수 있는지 확인해야 한다. 이는 신호 수준에서 속도 제한을 구현함으로써 달성되어야 한다. | 2 | +| **17.3.2** | 서비스 거부 상태를 유발할 수 있는 잘못된 형식의 신호 메시지를 접했을 때 신호 서버가 정상적인 신호 메시지 처리를 계속할 수 있는지 확인해야 한다. 여기에는 입력 검증 구현, 정수 오버플로우 안전 처리, 버퍼 오버플로우 방지 및 기타 강력한 오류 처리 기법 적용이 포함될 수 있다. | 2 | + +## 참조 + +자세한 내용은 다음을 참조한다: + +* The WebRTC DTLS ClientHello DoS is best documented at [Enable Security's blog post aimed at security professionals](https://www.enablesecurity.com/blog/novel-dos-vulnerability-affecting-webrtc-media-servers/) and the associated [white paper aimed at WebRTC developers](https://www.enablesecurity.com/blog/webrtc-hello-race-conditions-paper/) +* [RFC 3550 - RTP: A Transport Protocol for Real-Time Applications](https://www.rfc-editor.org/rfc/rfc3550) +* [RFC 3711 - The Secure Real-time Transport Protocol (SRTP)](https://datatracker.ietf.org/doc/html/rfc3711) +* [RFC 5764 - Datagram Transport Layer Security (DTLS) Extension to Establish Keys for the Secure Real-time Transport Protocol (SRTP))](https://datatracker.ietf.org/doc/html/rfc5764) +* [RFC 8825 - Overview: Real-Time Protocols for Browser-Based Applications](https://www.rfc-editor.org/info/rfc8825) +* [RFC 8826 - Security Considerations for WebRTC](https://www.rfc-editor.org/info/rfc8826) +* [RFC 8827 - WebRTC Security Architecture](https://www.rfc-editor.org/info/rfc8827) +* [DTLS-SRTP Protection Profiles](https://www.iana.org/assignments/srtp-protection/srtp-protection.xhtml) diff --git a/5.0/ko/0x90-Appendix-A_Glossary.md b/5.0/ko/0x90-Appendix-A_Glossary.md new file mode 100644 index 0000000000..6ecdfc8fb7 --- /dev/null +++ b/5.0/ko/0x90-Appendix-A_Glossary.md @@ -0,0 +1,89 @@ +# 부록 A: 어휘 + +* **절대 최대 세션 수명** - NIST에서는 “Overall Timeout”이라고도 언급되었다. 유저 상호작용과 관계없이 다음 인증까지 세션이 액티브하게 유지될 수 있는 최대 시간이다. 세션 만료의 한 요소이다. +* **허용 목록 (allowlist)** - 허용된 데이터 혹은 작업들의 리스트. 예를 들어 입력 검증이 허용된 문자들의 리스트. +* **위조 방지 토큰** - 요청에 하나 혹은 그 이상의 토큰이 전달되고 그 요청이 예상되는 엔드포인트로부터 왔음을 보장하도록 애플리케이션 서버에서 검증되는 메커니즘. +* **애플리케이션 보안** - 예를 들어 기저에 있는 운영 체제 혹은 연결된 네트워크에 집중하기보다는 OSI 모델에서 애플리케이션 계층을 이루는 구성 요소들의 분석에 초점을 두는 애플리케이션 단계의 보안. +* **애플리케이션 보안 검증** - OWASP ASVS를 따르는 애플리케이션의 기술적 평가. +* **애플리케이션 보안 검증 보고서** - 검증자가 특정 애플리케이션에 대한 전반적인 결과와 보조적인 분석을 기록한 보고서. +* **인증** - 애플리케이션 유저가 주장하는 신원의 검증. +* **자동화된 검증** - 문제를 찾기 위한 취약점 시그니처를 사용하는 자동화 도구(동적 분석 도구, 정적 분석 도구 혹은 둘 다)의 사용. +* **블랙박스 시험** - 내부 구조나 동작을 자세히 들여다보지 않고 애플리케이션의 기능을 검사하는 소프트웨어 시험 방법. +* **공통 취약점 목록** (CWE) - 커뮤니티에서 개발한 공통 소프트웨어 보안 취약점 목록. 공용어로 제공되며, 소프트웨어 보안 도구들을 위한 척도이자, 취약점의 식별, 완화책, 예방을 위한 노력의 기준선이다. +* **컴포넌트 (component)** - 다른 컴포넌트들과 통신하는 디스크나 네트워크 인터페이스들과 연관된 자체-포함 단위의 코드. +* **자격 증명 서비스 제공자** (CSP) - IdP라고도 불린다. 다른 애플리케이션들로부터 인증의 근원으로써 사용될 수 있는 유저 데이터의 근원. +* **교차 사이트 스크립트 포함** (XSSI) - 웹 애플리케이션이 외부 리소스로부터 악의적 코드를 받고 그 코드를 자기 콘텐츠의 일부로 포함하는 XSS의 변이 공격이다. +* **교차 사이트 스크립트** (XSS) - 콘텐츠에 클라이언트 단 스크립트 주입을 허용하는 웹 애플리케이션에서 전형적으로 찾아볼 수 있는 보안 취약점이다. +* **암호 모듈** - 암호화 알고리즘을 구현하고/구현하거나 암호 키를 생성하는 하드웨어, 소프트웨어, 그리고/또는 펌웨어. +* **암호학적으로 안전한 의사 난수 생성기** (CSPRNG) - 암호 기법에서 사용하기 적합한 의사 난수 생성기, 암호 난수 생성기 (CRNG)라고도 한다. +* **데이터그램 전송 계층 보안** (DTLS) - 네트워크 연결 상에서 통신 보안을 제공하는 암호 프로토콜이다. TLS 프로토콜을 기반으로 하지만, (보통 UDP 상에서의) 데이터그램-지향 프로토콜 보호를 위해 개량되었다. RFC 9147에서 DTLS 1.3으로 정의되었다. +* **실시간 전송 프로토콜 보호의 키 수립을 위한 데이터그램 전송 계층 보안 확장** (DTLS-SRTP) - SRTP 세션의 키 수립을 위해 DTLS 핸드셰이크를 사용하는 메커니즘. RFC 5764에서 정의되었다. +* **설계 검증** - 애플리케이션 보안 구조에 대한 기술적 평가. +* **동적 애플리케이션 보안 테스팅** (DAST) - 애플리케이션이 동작하는 상태에서 보안 취약점을 드러낼 수 있는 조건들을 발견하기 위한 기술들. +* **동적 검증** - 애플리케이션이 동작하는 동안 문제를 찾기 위해 취약점 시그니처를 활용하는 자동화 도구의 사용. +* **온라인 간편 인증** (FIDO) - 생체인증, TPM(Trusted Platform Modules), USB 보안 토큰 등을 포함해 다양한 인증 방법들을 이용할 수 있게 하는 인증 표준들의 집합. +* **HSM** (Hardware Security Module) - 보호된 방식으로 암호키나 기밀들을 저장하는 하드웨어 컴포넌트. +* **HQL** (Hibernate Query Language) - SQL과 문법적으로 비슷해 보이는 히버네이트 ORM 라이브러리에서 사용하는 쿼리 언어. +* **HSTS** (HTTP Strict Transport Security) - 브라우저에 해당 도메인에 대해 유효한 인증서가 제시된 TLS 연결만 허용하도록 지시하는 정책이다. Strict-Transport-Security 응답 헤더 필드를 통해서 활성화된다. +* **HTTP** (HyperText Transfer Protocol) - 분산된 협력적인 하이퍼미디어 정보 시스템을 위한 애플리케이션 프로토콜이다. 월드 와이드 웹 (World Wide Web) 데이터 통신의 토대이다. +* **SSL/TLS 상에서의 HyperText Transfer Protocol** (HTTPS) - 전송 계층 보안(TLS)으로 암호화하여 HTTP 통신을 보호하는 방법. +* **신원 제공자** (IdP) - NIST references로부터 자격 증명 서비스 제공자(CSP)로도 언급된다. 다른 애플리케이션에 인증 근원을 제공해 준다. +* **비활동 타임아웃** - 유저가 활동하지 않고 세션이 유지될 수 있는 시간의 길이이다. 세션 만료의 한 요소이다. +* **입력 검증** - 신뢰할 수 없는 유저 입력의 정규화와 검증 +* **JSON 웹 토큰** (JWT) - 해당 객체의 유효성을 어떻게 검증할지 설명하는 헤더 섹션, 클레임들(claims)을 포함한 바디 섹션, 바디 섹션의 내용들을 검증할 디지털 시그니처를 담고 있는 시그니처 섹션으로 구성되어 있는 JSON 데이터 객체. 자체-포함 토큰의 한 종류이다. RFC 7519에서 정의되었다. +* **로컬 파일 삽입** (LFI) - 애플리케이션에서 취약한 파일 삽입 과정을 악용하는 공격으로, 서버에 이미 존재하는 로컬 파일에 대한 삽입으로 이어질 수 있다. +* **악의적 코드** - 개발 과정 중 애플리케이션 소유자가 알지 못하게 삽입되어 애플리케이션의 보안 정책을 우회하는 코드. 바이러스나 웜과 같은 멀웨어와는 다르다! +* **멀웨어** - 애플리케이션 실행 중에 유저나 관리자가 알지 못하게 애플리케이션에 삽입된 실행 가능한 코드. +* **메시지 인증 코드** (MAC) - MAC 생성 알고리즘을 통해 산출되어 데이터의 무결성과 인증성을 보장하는 데이터에 대한 암호 체크섬. +* **다중 인증** (MFA) - 둘 혹은 그 이상의 단일 요소를 포함한 인증. +* **상호 TLS** (mTLS) - ‘TLS 클라이언트 인증’을 확인. +* **객체-관계 매핑** (ORM) - 애플리케이션-호환 객체 모델을 사용하여 관계형 데이터베이스를 애플리케이션 내에서 참조하고 질의할 수 있게 하는 시스템. +* **일회용 비밀번호** (OTP) - 한 번만 사용되도록 유일하게 생성된 비밀번호. +* **오픈 웹 애플리케이션 보안 프로젝트** (OWASP) - OWASP는 애플리케이션 소프트웨어의 보안 증진에 초점을 맞춘 자유롭고 개방적인 커뮤니티이다. 우리의 사명은 애플리케이션 보안을 “가시적”으로 만들어 사람들과 단체들이 애플리케이션 보안 위험에 대해 현명한 선택을 할 수 있도록 하는 것이다. [https://www.owasp.org/](https://www.owasp.org/)를 확인. +* **암호-기반 키 유도 함수 2** (PBKDF2) - 특별한 단방향 알고리즘으로 (비밀번호와 같은) 입력값 텍스트와 추가적인 무작위 솔트 값으로부터 강한 암호 키를 생성하고, 기존 비밀번호 대신 저장하여 오프라인에서 비밀번호를 알아내기 어렵게 만든다. +* **공개키 인프라스트럭처** (PKI) - 공개키를 각각의 개체와 신원과 연결하는 배열이다. 이러한 배열은 인증기관들로부터 등록 과정과 인증서 발급을 통해 수립된다. +* **공중 교환 전화망** (PSTN) - 유선 전화와 휴대 전화를 포함한 전통적인 전화 네트워크. +* **실시간 전송 프로토콜** (RTP)과 **실시간 전송 제어 프로토콜** (RTCP) - 멀티미디어 스트림을 전송하기 위해 함께 사용되는 두 프로토콜이다. 웹 실시간 통신 스택에 의해 사용된다. RFC 3550에서 정의되었다. +* **레퍼런스 토큰 (Reference Token)** - 서버에 저장된 상태나 메타데이터의 포인터나 식별자로서 동작하는 토큰의 한 종류. 가끔 ‘임의 토큰’이나 ‘불투명 토큰’이라고도 한다. 토큰 자체에 토큰 자신과 관련 있는 데이터들이 포함된 자체-포함 토큰과 다르게, 레퍼런스 토큰은 고유한 정보를 포함하지 않는 대신, 맥락을 위해 서버에 의존한다. 또한 레퍼런스 토큰은 세션 식별자가 되거나, 그것에 포함된다. +* **신뢰 당사자** (RP) - 일반적으로 유저가 별도의 인증 제공자로부터 인증을 받았다고 신뢰하는 애플리케이션. 인증 제공자로부터 제공된 몇 종류의 토큰이나 서명된 주장(assertion)들의 집합으로 유저를 신뢰한다. +* **원격 파일 삽입** (RFI) - 애플리케이션에서 취약한 파일 삽입 과정을 악용하는 공격. 외부 파일의 삽입으로 이어질 수 있다. +* **확장형 벡터 그래픽스** (SVG) - 2차원 기반의 벡터 그래픽을 표현하는 XML 기반의 마크업 언어. +* **실시간 전송 보안 프로토콜** (SRTP)와 **실시간 전송 보안 제어 프로토콜** (SRTCP) - 메시지의 암호화, 인증, 무결성의 보호를 지원하는 RTP와 RTCP의 프로파일(profile). RFC 3711에 정의되어 있다. +* **보안 아키텍처** - 애플리케이션 설계의 추상화로 보안 제어가 어디서 어떻게 사용되는지와 유저와 애플리케이션 데이터의 위치와 민감도를 식별하고 설명한다. +* **보안 보장 마크업 언어** (SAML) - 신원 제공자와 신뢰 당사자 간 서명된 보장(주로 XML 객체)의 전달을 기반으로 하는 싱글 사인 온 인증을 위한 개방 표준이다. +* **보안 구성**- 보안 제어가 어떻게 사용되는지에 영향을 주는 애플리케이션의 런타임 구성이다. +* **보안 제어** - 보안 검사를 수행하는 기능이나 요소 (예: 인증 검사) 혹은 보안적 측면에서 영향을 초래하는 경우. (예: 감사 레코드를 생성) +* **보안 정보와 이벤트 관리** (SIEM) - 컬렉션과 여러 소스로부터의 보안-관련 데이터들의 분석을 통한 조직의 IT 인프라스트럭처에서의 위협 감지, 컴플라이언스, 보안 사고 관리를 위한 시스템. +* **자체-포함 토큰** - 서버 단의 상태나 다른 외부 저장소에 의존하지 않는 하나 이상의 속성들을 캡슐화한 토큰. 이 토큰들은 포함되어 있는 속성들의 인증성과 무결성을 보장하고, “무상태” 정보들을 여러 시스템에 걸쳐 안전한 교환이 가능하게 한다. 자체-포함 토큰은 보통 인증성, 무결성 그리고 어떤 경우에는 데이터의 기밀성을 보장하기 위해 디지털 서명, 메시지 인증 코드 (MAC) 등의 암호 기술들을 이용하여 보호된다. +* **서버 측 요청 위조** (SSRF) - 서버의 내부 리소스들을 읽고 업데이트하는 기능을 남용하는 공격. 공격자는 데이터를 읽거나 제출하는 코드인 서버상에서 작동하는 URL을 제공하거나 변형한다. +* **세션 기술 프로토콜** (SDP) - 멀티미디어 세션을 구성하기 위한 메시지 형식이다. (예로 웹 실시간 통신에서 사용된다.) RFC 4566에서 정의되었다. +* **세션 식별자** 또는 **세션 ID** - 백엔드에 저장된 상태 유지 세션을 식별하는 키이다. 레퍼런스 토큰으로서, 혹은 레퍼런스 토큰 내에서 클라이언트에게 혹은 클라이언트로부터 전달된다. +* **세션 토큰** - (자체-포함 토큰을 사용하는) 무상태 세션 메커니즘이나 (레퍼런스 토큰을 사용하는) 상태 유지 세션 메커니즘에서 사용되는 토큰이나 값을 이 표준에서 포괄적으로 이르는 말. +* **NAT용 세션 탐색 유틸리티** (STUN) - peer-to-peer 통신을 수립하기 위해 NAT 탐색을 돕는 프로토콜. RFC 3489에서 정의되었다. +* **단일 요소 인증기** - 유저가 인증되었는지 확인하는 메커니즘. 당신이 알거나(기억하는 비밀, 비밀번호, 비밀 구절, PIN), 당신 자신이거나 (생체 인증, 지문, 얼굴 인식), 당신이 가지고 있는 것 (OTP 토큰, 스마트카드와 같은 암호 디바이스)들이 될 수 있다. +* **싱글 사인 온 인증** (SSO) - 유저가 한 애플리케이션에 로그인한 다음 다시 인증을 할 필요 없이 다른 애플리케이션에 자동으로 로그인될 때 발생한다. 예를 들어, 구글에 로그인할 때, 유저는 자동으로 유튜브, 구글 문서, G메일 같은 다른 구글 서비스들에 로그인된다. +* **소프트웨어 구성 명세서** (SBOM) - 소프트웨어 애플리케이션을 만들거나 어셈블(assemble)할때 요구되는 모든 컴포넌트, 모듈, 라이브러리, 프레임워크 등 리소스들의 구조적이고 포괄적인 리스트이다. +* **소프트웨어 구성 분석** (SCA) - 사용 중인 특정 컴포넌트 버전의 보안 취약점을 위한 애플리케이션 구성, 의존성, 라이브러리 그리고 패키지들을 분석하기 위해 설계된 기술들의 집합. 현재 흔히 SAST라고 불리는 소스코드 분석과 혼동해서는 안 된다. +* **소프트웨어 개발 수명 주기** (SDLC) - 초기 요구 사항부터 배포와 유지보수까지 소프트웨어가 개발되는 단계별 과정이다 +* **SQL 인젝션** (SQLi) - 엔트리 포인트에 악성 SQL 구문이 삽입되는, 데이터 기반 애플리케이션을 공격하기 위해 사용되는 코드 주입 기술 +* **상태 유지 세션 메커니즘** - 상태 유지 세션 메커니즘에서는, 애플리케이션이 CSRPNG를 사용하여 생성된 세션 토큰에 해당하는 세션 상태를 백엔드 단에 보유하며, 이 토큰은 최종 사용자에게 발급된다. +* **무상태 세션 메커니즘** - 무상태 세션 메커니즘은 서비스 내에 저장될 필요가 없고 클라이언트에게 전달되는 자체-포함 토큰을 사용하고, 토큰을 받고 검증한다. 그러나 실제로는, 서비스가 필요한 보안 제어를 시행하기 위해 약간의 세션 정보 (JWT 파기 목록과 같은)에 대한 접근이 필요하다. +* **정적 애플리케이션 보안 테스팅** (SAST) - 보안 취약점을 시사하는 코딩, 설계 조건들을 찾기 위해 애플리케이션의 소스 코드, 바이트 코드, 바이너리들을 분석하도록 설계된 기술들의 집합. SAST 솔루션들은 비실행 상태에서 애플리케이션을 “내부에서 외부로” 분석한다. +* **위협 모델링** - 위협 주체, 보안 영역, 보안 제어, 그리고 중요한 기술과 사업 자산들을 식별하기 위해 보안 아키텍처를 점점 더 정교하게 개발해 나가는 기술이다. +* **검사 시점과 사용 시점** (TOCTOU) - 애플리케이션이 리소스를 사용하기 전에 리소스의 상태를 검사하더라도, 리소스의 상태는 리소스의 검사 시점과 사용 시점 사이에 바뀔 수 있다. 이는 검사 결과를 무효화하고 상태 비일치로 인한 잘못된 동작의 수행을 초래할 수 있다. +* **시간 동기 일회용 패스워드** (TOTPs) - 현재 시각이 비밀번호를 생성하는 알고리즘의 일부로 사용되는 OTP 생성의 한 방식. +* **TLS 클라이언트 인증**, 또는 **상호 TLS** (mTLS) - 표준 TLS 연결에서, 클라이언트는 서버의 신원을 검증하기 위해 서버가 제공한 인증서를 사용할 수 있다. TLS 클라이언트 인증이 사용될 때, 클라이언트 또한 자신의 비밀 키와 인증서를 사용하여 서버로 하여금 클라이언트의 신원을 검증하도록 허용할 수 있다. +* **전송 계층 보안** (TLS) - 네트워크 연결 상에서 통신 보안을 제공하는 암호 프로토콜. +* **NAT를 중심으로 릴레이를 이용한 트래버설** (TURN) - peer-to-peer 직접 연결이 수립되지 못할 때 TURN 서버를 중계 서버로 사용하는 STUN 프로토콜의 확장. RFC 8656에서 정의되었다. +* **신뢰 실행 환경** (TEE) - 애플리케이션이 시스템의 다른 영역과 관계없이 안전하게 실행될 수 있는 고립된 처리 환경. +* **신뢰 플랫폼 모듈** (TPM) - 마더보드와 같은 더 큰 하드웨어 컴포넌트에 부착되어 그 시스템의 “신뢰의 근원” 역할을 하는 HSM의 한 종류. +* **신뢰 서비스 계층** - 마이크로서비스, 서버리스 API, 서버 단, secure boot을 가진 클라이언트 장치의 신뢰되는 API, 파트너 또는 외부 API 등등의 제어 집행 지점(control enforcement point). ‘신뢰되는’ 이란, 신뢰할 수 없는 유저가 그 계층에 구현된 계층이나 제어를 우회하거나 통과할 우려가 없음을 의미한다. +* **인터넷 식별자** (URI) - 웹페이지, 메일 주소, 장소 등을 식별하는 고유의 문자열. +* **인터넷 주소** (URL) - 인터넷상의 리소스들의 위치를 명시하는 문자열. +* **범용 단일 식별자** (UUID) - 소프트웨어에서 식별자로 사용되는 고유의 레퍼런스 번호. +* **검증자** - 애플리케이션을 OWASP ASVS 요구사항에 따라 리뷰하는 사람이나 팀. +* **웹 실시간 통신** (WebRTC) - 보통 화상회의에서, 웹 애플리케이션에서 멀티미디어 스트림을 전송하기 위해 사용되는 프로토콜 스택과 관련된 웹 API. SRTP, SRTCP, DTLS, SDP 그리고 STUN/TURN을 기반으로 한다. +* **TLS 상의 웹 소켓** (WSS) - 웹 소켓 통신을 TLS 프로토콜 상에서 계층화하여 보호하는 한 방법. +* **위지위그** (WYSIWYG) - 렌더링을 제어하는 코드 자체를 보이기보다 콘텐츠가 렌더링 되었을 때 실제로 어떻게 보일지를 보여주는 리치 콘텐츠 에디터의 한 종류. +* **X.509 인증서** - 공개키가 인증서에 포함된 해당 유저, 컴퓨터 혹은 서비스의 신원에 속해있음을 검증하고, 널리 받아들여지는 국제 X.509 PKI 표준을 사용하는 디지털 인증서. +* **XML 외부 개체** (XXE) - 선언된 시스템 식별자를 통해 로컬 혹은 리모트 콘텐츠에 접근할 수 있는 XML 개체의 한 종류. 다양한 삽입 공격을 초래할 수 있다. diff --git a/5.0/ko/0x91-Appendix-B_References.md b/5.0/ko/0x91-Appendix-B_References.md new file mode 100644 index 0000000000..e9862bd39f --- /dev/null +++ b/5.0/ko/0x91-Appendix-B_References.md @@ -0,0 +1,43 @@ +# 부록 B: 참고 문헌 + +다음은 본 표준의 사용자와 채택자들에게 유용할 OWASP 프로젝트들이다: + +## OWASP 핵심 프로젝트 + +1. OWASP Top 10 Project: [https://owasp.org/www-project-top-ten/](https://owasp.org/www-project-top-ten/) +2. OWASP Web Security Testing Guide: [https://owasp.org/www-project-web-security-testing-guide/](https://owasp.org/www-project-web-security-testing-guide/) +3. OWASP Proactive Controls: [https://owasp.org/www-project-proactive-controls/](https://owasp.org/www-project-proactive-controls/) +4. OWASP Software Assurance Maturity Model (SAMM): [https://owasp.org/www-project-samm/](https://owasp.org/www-project-samm/) +5. OWASP Secure Headers Project: [https://owasp.org/www-project-secure-headers/](https://owasp.org/www-project-secure-headers/) + +## OWASP 치트 시트 시리즈(Cheat Sheet Series) 프로젝트 + +[이 프로젝트](https://owasp.org/www-project-cheat-sheets/)는 ASVS의 다양한 주제에 관한 치트 시트를 제공한다. + +ASVS와의 매핑은 여기서 확인할 수 있다: [https://cheatsheetseries.owasp.org/IndexASVS.html](https://cheatsheetseries.owasp.org/IndexASVS.html) + +## 모바일 보안 관련 프로젝트 + +1. OWASP Mobile Security Project: [https://owasp.org/www-project-mobile-security/](https://owasp.org/www-project-mobile-security/) +2. OWASP Mobile Top 10 Risks: [https://owasp.org/www-project-mobile-top-10/](https://owasp.org/www-project-mobile-top-10/) +3. OWASP Mobile Security Testing Guide and Mobile Application Security Verification Standard: [https://owasp.org/www-project-mobile-security-testing-guide/](https://owasp.org/www-project-mobile-security-testing-guide/) + +## OWASP 사물인터넷(IoT) 관련 프로젝트 + +1. OWASP Internet of Things Project: [https://owasp.org/www-project-internet-of-things/](https://owasp.org/www-project-internet-of-things/) + +## OWASP 서버리스(Serverless) 프로젝트 + +1. OWASP Serverless Project: [https://owasp.org/www-project-serverless-top-10/](https://owasp.org/www-project-serverless-top-10/) + +## 기타 + +다음 웹사이트들도 본 표준의 사용자와 채택자들에게 유용하게 활용될 것이다. + +1. SecLists Github: [https://github.com/danielmiessler/SecLists](https://github.com/danielmiessler/SecLists) +2. MITRE Common Weakness Enumeration: [https://cwe.mitre.org/](https://cwe.mitre.org/) +3. PCI Security Standards Council: [https://www.pcisecuritystandards.org/](https://www.pcisecuritystandards.org/) +4. PCI Data Security Standard (DSS) v3.2.1 Requirements and Security Assessment Procedures: [https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf](https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf) +5. PCI Software Security Framework - Secure Software Requirements and Assessment Procedures: [https://www.pcisecuritystandards.org/documents/PCI-Secure-Software-Standard-v1_0.pdf](https://www.pcisecuritystandards.org/documents/PCI-Secure-Software-Standard-v1_0.pdf) +6. PCI Secure Software Lifecycle (Secure SLC) Requirements and Assessment Procedures: [https://www.pcisecuritystandards.org/documents/PCI-Secure-SLC-Standard-v1_0.pdf](https://www.pcisecuritystandards.org/documents/PCI-Secure-SLC-Standard-v1_0.pdf) +7. OWASP ASVS 4.0 Testing Guide [https://github.com/BlazingWind/OWASP-ASVS-4.0-testing-guide](https://github.com/BlazingWind/OWASP-ASVS-4.0-testing-guide) diff --git a/5.0/ko/0x92-Appendix-C_Cryptography.md b/5.0/ko/0x92-Appendix-C_Cryptography.md new file mode 100644 index 0000000000..3e036568e3 --- /dev/null +++ b/5.0/ko/0x92-Appendix-C_Cryptography.md @@ -0,0 +1,311 @@ +# 부록 C: 암호 기법 표준 + +"암호 기법" 장은 단순히 모범 사례를 정의하는 것을 넘어선다. 이 장은 암호학 원리에 대한 이해를 향상시키고, 보다 견고하고 현대적인 보안 방법의 채택을 장려하는 것을 목표로 한다. 이 부록에서는 각 요구 사항에 대한 상세한 기술 정보를 제공하며, "암호 기법" 장에 설명된 전반적인 표준을 보완한다. + +이 부록은 다양한 암호화 메커니즘(mechanism)에 대한 승인 수준을 정의한다: + +* 승인된 메커니즘(A)은 애플리케이션에서 사용할 수 있다. +* 기존 메커니즘(L)은 애플리케이션에서 사용해서는 안 되지만, 기존 애플리케이션이나 코드와의 호환성을 위해 제한적으로 사용될 수 있다. 이러한 메커니즘의 사용은 현재 본질적으로 취약점으로 간주하지는 않지만, 가능한 한 빠른 시일 내에 더 안전하고 미래 지향적인 메커니즘으로 대체되어야 한다. +* 허용되지 않은 메커니즘(D)은 현재 취약한 것으로 간주되거나 충분한 보안을 제공하지 않으므로 사용해서는 안 된다. + +이 목록은 특정 애플리케이션의 맥락에서 여러 가지 이유로 재정의 될 수 있으며, 예를 들어 다음과 같다: + +* 암호학 분야의 새로운 발전; +* 규제 준수. + +## 암호 자산 목록 및 문서화 + +이 문단은 V11.1 암호 목록 및 문서화에 대한 +추가 정보를 제공한다. + +알고리즘, 키, 인증서와 같은 암호 자산은 정기적으로 발견되고, 목록화되며, 평가되어야 한다. 3단계에서는 애플리케이션에서 암호 기법의 사용을 식별하기 위해 정적 및 동적 스캐닝을 포함해야 한다. SAST 및 DAST와 같은 도구는 이에 도움이 될 수 있으나, 더 포괄적인 범위를 위해서는 전용 도구가 필요할 수 있다. 프리웨어 도구의 예시는 다음과 같다: + +* [CryptoMon - Network Cryptography Monitor - using eBPF, written in python](https://github.com/Santandersecurityresearch/CryptoMon) +* [Cryptobom Forge Tool: Generating Comprehensive CBOMs from CodeQL Outputs](https://github.com/Santandersecurityresearch/cryptobom-forge) + +## 암호 매개변수의 동등 강도 + +다양한 암호 시스템의 상대적 보안 강도는 이 표에 제시되어 있다. (출처: [NIST SP 800-57 Part 1](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final), p.71): + +| 보안 강도 | 대칭키 알고리즘 | 유한체 | 소인수 분해 | 타원 곡선 | +|--|--|--|--|--| +| <= 80 | 2TDEA | L = 1024
N = 160 | k = 1024 | f = 160-223 | +| 112 | 3TDEA | L = 2048
N = 224 | k = 2048 | f = 224-255 | +| 128 | AES-128 | L = 3072
N = 256 | k = 3072 | f = 256-383 | +| 192 | AES-192 | L = 7680
N = 384 | k = 7680 | f = 384-511 | +| 256 | AES-256 | L = 15360
N = 512 | k = 15360 | f = 512+ | + +애플리케이션 예시: + +* 유한체 암호 기법: DSA, FFDH, MQV +* 소인수 분해 암호 기법: RSA +* 타원 곡선 암호 기법: ECDSA, EdDSA, ECDH, MQV + +참고: 이 문단은 양자컴퓨터가 존재하지 않는다고 가정한다. 만약 그러한 컴퓨터가 존재한다면, 마지막 3개 열의 추정치는 더 이상 유효하지 않게 된다. + +## 무작위 값 + +이 문단은 V11.5 무작위 값에 대한 +추가 정보를 제공한다. + +| 이름 | 버전/참조 | 비고 | 상태 | +|:-:|:-:|:-:|:-:| +| `/dev/random` | Linux 4.8+ [(Oct 2016)](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=818e607b57c94ade9824dad63a96c2ea6b21baf3), iOS, Android, 그리고 다른 Linux 기반 POSIX 운영체제에서도 사용된다. [RFC7539](https://datatracker.ietf.org/doc/html/rfc7539)를 기반으로 한다. | ChaCha20 스트림을 활용한다. iOS의 [`SecRandomCopyBytes`](https://developer.apple.com/documentation/security/secrandomcopybytes(_:_:_:)?language=objc) 및 Android의 [`Secure Random`](https://developer.android.com/reference/java/security/SecureRandom)에서 각각 올바른 설정이 적용된 상태로 제공된다. | A | +| `/dev/urandom` | 무작위 데이터를 제공하는 Linux 커널의 특수 파일 | 하드웨어 난수를 통해 고품질의 엔트로피 소스를 제공한다. | A | +| `AES-CTR-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | 일반적인 구현에서 사용되며, 예를 들어 [`BCRYPT_RNG_ALGORITHM`](https://learn.microsoft.com/en-us/windows/win32/seccng/cng-algorithm-identifiers)로 설정된 [Windows CNG API `BCryptGenRandom`](https://learn.microsoft.com/en-us/windows/win32/api/bcrypt/nf-bcrypt-bcryptgenrandom)이 사용된다. | A | +| `HMAC-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | | A | +| `Hash-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | | A | +| `getentropy()` | [OpenBSD](https://man.openbsd.org/getentropy.2)은 [Linux glibc 2.25+](https://man7.org/linux/man-pages/man3/getentropy.3.html) 및 [macOS 10.12+](https://support.apple.com/en-gb/guide/security/seca0c73a75b/web)에서 지원한다. | 단순하고 최소화된 API를 통해 커널의 엔트로피 소스에서 보안 무작위 바이트를 직접 제공한다. 이는 보다 최신 방식이며, 기존 API와 관련된 문제점을 피할 수 있다. | A | + +HMAC-DRBG 또는 Hash-DRBG와 함께 사용되는 기반 해시 함수는 반드시 해당 용도로 승인되어야 한다. + +## 암호 알고리즘 + +이 문단은 V11.3 암호화 알고리즘에 대한 +추가 정보를 제공한다. + +승인된 암호 알고리즘은 선호도 순서로 제시되어 있다. + +| 대칭키 알고리즘 | 참조 | 상태 | +| ------ | ------ |:-:| +| AES-256 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | A | +| Salsa20 | [Salsa 20 specification](https://cr.yp.to/snuffle/spec.pdf) | A | +| XChaCha20 | [XChaCha20 Draft](https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-xchacha-03) | A | +| XSalsa20 | [Extending the Salsa20 nonce](https://cr.yp.to/snuffle/xsalsa-20110204.pdf) | A | +| ChaCha20 | [RFC 8439](https://www.rfc-editor.org/info/rfc8439) | A | +| AES-192 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | A | +| AES-128 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | L | +| 2TDEA | | D | +| TDEA (3DES/3DEA) | | D | +| IDEA | | D | +| RC4 | | D | +| Blowfish| | D | +| ARC4 | | D | +| DES | | D | + +### AES 암호 모드 + +AES와 같은 블록 암호는 다양한 운용 모드와 함께 사용할 수 있다. 전자 코드북(Electronic codebook; ECB)와 같은 많은 운용 모드는 안전하지 않으며, 사용해서는 안 된다. 갈루아/카운터 모드(Galois/Counter Mode; GCM)와 CBC-MAC을 사용하는 카운터 모드(Counter with Cipher Block Chaining Message Authentication Code; CCM)는 인증 암호화를 제공하며, 최신 애플리케이션에서 사용하는 것이 권장된다. + +승인된 모드는 선호도 순서로 제시되어 있다. + +| 모드 | 인증 여부 | 참조 | 상태 | 제한 사항 | +|--|--|--|--|--| +| GCM | 예 | [NIST SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | | +| CCM | 예 | [NIST SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | | +| CBC | 아니오 | [NIST SP 800-38A](https://csrc.nist.gov/pubs/sp/800/38/a/final) | L | | +| CCM-8 | 예 | | D | | +| ECB | 아니오 | | D | | +| CFB | 아니오 | | D | | +| OFB | 아니오 | | D | | +| CTR | 아니오 | | D | | + +비고: + +* 모든 암호화된 메시지는 반드시 인증되어야 한다. CBC 모드를 사용하는 모든 경우에 반드시 메시지 무결성을 검증하기 위한 해시 기반 MAC 알고리즘을 함께 사용해야 한다. 일반적으로 반드시 암호화 후 해싱 방식(Encrypt-Then-Hash)을 적용해야 한다. (단, TLS 1.2는 해시 후 암호화 방식(Hash-Then-Encrypt)을 사용한다.) 이것이 보장되지 않는다면, CBC를 절대 사용해서는 안 된다. MAC 알고리즘 없이 암호화가 허용되는 애플리케이션은 디스크 암호화로 한정된다. +* CBC 모드를 사용하는 경우, 패딩 검증이 상수 시간(constant time)으로 수행되도록 보장해야 한다. +* CCM-8을 사용할 경우, MAC 태그의 보안 강도는 64비트에 불과하다. 이는 최소 128비트 이상의 보안 강도를 요구하는 요구사항 6.2.9를 준수하지 않는다. +* 디스크 암호화는 ASVS의 적용 범위에 포함되지 않는다. 따라서 이 부록에서는 디스크 암호화를 위한 승인된 방법을 제시하지 않는다. 이러한 용도의 경우, 인증 없는 암호화가 일반적으로 허용되며 XTS, XEX, LRW 모드가 주로 사용된다. + +### 키 래핑 + +암호 키 래핑(cryptographic key wrap, 및 해당 언래핑)은 기존 키를 추가적인 암호화 메커니즘으로 캡슐화(즉, 래핑)하여 전송 과정 등에서 직접적으로 노출되지 않도록 보호하는 방법이다. 기존 키를 보호하기 위해 사용되는 이 추가 키를 래핑 키(wrap key)라고 한다. + +이 작업은 신뢰할 수 없는 것으로 간주되는 환경에서 키를 보호하거나, 민감한 키를 신뢰할 수 없는 네트워크나 애플리케이션 내에서 전송해야 하는 경우에 수행될 수 있다. +그러나 래핑/언래핑 절차를 수행하기 전에 원래 키의 속성(예: 키의 식별 정보 및 용도)을 충분히 이해하는 것을 신중히 고려해야 하며, 이는 보안 측면뿐 아니라 특히 컴플라이언스 측면에서 원본 및 대상 시스템 또는 애플리케이션 모두에 영향을 미칠 수 있고, 컴플라이언스 요구사항에는 키 기능(예: 서명)에 대한 감사 추적(audit trail)과 적절한 키 저장 방식이 포함될 수 있다. + +특히, 키 래핑에는 [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final)를 준수하고 양자 위협에 대비한 향후 권고 사항을 고려하여 반드시 AES-256을 사용해야 한다. AES를 사용하는 암호 모드는 선호도 순서로 제시되어 있다: + +| 키 래핑 | 참조 | 상태 | +|--|--|:-:| +| KW | [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) | A | +| KWP | [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) | A | + +AES-192와 AES-128은 사용 사례에서 필요할 경우 사용할 수 있지만, 그 사용 사유는 해당 엔터티의 암호 인벤토리(cryptography inventory)에 반드시 문서화해야 한다. + +### 인증 암호화 + +디스크 암호화를 제외하고, 암호화된 데이터는 인증 암호화(AE) 방식, 일반적으로는 연관 데이터가 있는 인증 암호화(AEAD) 방식을 사용하여 무단 변경으로부터 반드시 보호해야 한다. + +애플리케이션은 승인된 AEAD 방식을 사용하는 것이 바람직하다. 대안으로, 승인된 암호화 방식과 승인된 MAC 알고리즘을 결합하여 암호화 후 MAC(Encrypt-then-MAC) 구조를 사용할 수도 있다. + +MAC 후 암호화는 방식은 레거시 애플리케이션과의 호환성을 위해 여전히 허용된다. 이 방식은 TLS 1.2에서 구식 암호 제품군(cipher suites)과 함께 사용된다. + +| AEAD 메커니즘 | 참조 | 상태 | +|---|---------|:-:| +|AES-GCM | [SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | +|AES-CCM | [SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | +|ChaCha-Poly1305 | [RFC 7539](https://datatracker.ietf.org/doc/html/rfc7539) | A | +|AEGIS-256 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +|AEGIS-128 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +|AEGIS-128L| [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +|Encrypt-then-MAC | | A | +|MAC-then-encrypt | | L | + +## 해시 함수 + +이 문단은 V11.4 해싱과 해시 기반 함수에 대한 +추가 정보를 제공한다. + +### 범용 해시 함수 + +다음 표는 디지털 서명과 같은 일반적인 암호 사용 사례에서 승인된 해시 함수를 제시한다. + +* 승인된 해시 함수는 강력한 충돌 저항성을 제공하며, 높은 보안 수준을 요구하는 애플리케이션에 적합하다. +* 이들 알고리즘 중 일부는 적절한 암호 키 관리와 함께 사용될 경우 강력한 공격 저항성을 제공하므로, HMAC, KDF, RBG 기능에도 추가적으로 승인된다. +* 출력 길이가 254비트 미만인 해시 함수는 충돌 저항성이 불충분하므로 디지털 서명 또는 충돌 저항성이 필요한 다른 애플리케이션에 사용해서는 안 된다. 다른 용도의 경우, 호환성 및 검증을 위해서만 레거시 시스템에서 제한적으로 사용할 수 있지만, 새로운 설계에서는 사용해서는 안 된다. + +| 해시 함수 | 참조 | 상태 | 제한 사항 | +| ------ | ----------- |:-:| ---------- | +| SHA3-512 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| SHA-512 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHA3-384 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| SHA-384 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHA3-256 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| SHA-512/256 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHA-256 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHAKE256 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| BLAKE2s | [BLAKE2: simpler, smaller, fast as MD5](https://eprint.iacr.org/2013/322) | A | | +| BLAKE2b | [BLAKE2: simpler, smaller, fast as MD5](https://eprint.iacr.org/2013/322) | A | | +| BLAKE3 | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | | +| SHA-224 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | L | HMAC, KDF, RBG, 디지털 서명에 적합하지 않다. | +| SHA-512/224 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | L | HMAC, KDF, RBG, 디지털 서명에 적합하지 않다. | +| SHA3-224 | [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | L | HMAC, KDF, RBG, 디지털 서명에 적합하지 않다. | +| SHA-1 | [RFC 3174](https://www.rfc-editor.org/info/rfc3174) & [RFC 6194](https://www.rfc-editor.org/info/rfc6194) | L | HMAC, KDF, RBG, 디지털 서명에 적합하지 않다. | +| CRC (길이 무관) | | D | | +| MD4 | [RFC 1320](https://www.rfc-editor.org/info/rfc1320) | D | | +| MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | | + +### 비밀번호 저장을 위한 해시 함수 + +안전한 비밀번호 해싱을 위해서는 전용 해시 함수를 반드시 사용해야 한다. 이러한 느린 해싱(slow-hashing) 알고리즘은 비밀번호 크래킹의 연산 난이도를 높여 무차별 대입 공격과 사전 대입 공격을 완화한다. + +| KDF | 참조 | 필수 매개변수 | 상태 | +| ---------- | --------- | ------------ |:-:| +| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1 | A | +| | | t = 2: m ≥ 19456 (19 MiB), p = 1 | A | +| | | t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | +| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8 | A | +| | | p = 2: N ≥ 2^16 (64 MiB), r = 8 | A | +| | | p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | +| bcrypt | [A Future-Adaptable Password Scheme](https://www.researchgate.net/publication/2519476_A_Future-Adaptable_Password_Scheme) | cost ≥ 10 | A | +| PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 210,000 | A | +| PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 600,000 | A | +| PBKDF2-HMAC-SHA-1 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 1,300,000 | L | + +승인된 비밀번호 기반 키 유도 함수 (Password-based Key Derivation Function; PBKDF)는 비밀번호 저장에 사용할 수 있다. + +## 키 유도 함수 (Key Derivation Functions; KDFs) + +### 범용 키 유도 함수 + +| KDF | 참조 | 상태 | +| ---------------- | -------- |:-:| +| HKDF | [RFC 5869](https://www.rfc-editor.org/info/rfc5869) | A | +| TLS 1.2 PRF | [RFC 5248](https://www.rfc-editor.org/info/rfc5248) | L | +| MD5 기반 KDFs | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | +| SHA-1 기반 KDFs | [RFC 3174](https://www.rfc-editor.org/info/rfc3174) & [RFC 6194](https://www.rfc-editor.org/info/rfc6194) | D | + +### 비밀번호 기반 키 유도 함수 + +| KDF | 참조 | 필수 매개변수 | 상태 | +| ---------- | --------- | ------------ |:-:| +| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1 | A | +| | | t = 2: m ≥ 19456 (19 MiB), p = 1 | A | +| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8 | A | +| | | p = 2: N ≥ 2^16 (64 MiB), r = 8 | A | +| | | p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | +| PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 210,000 | A | +| PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 600,000 | A | +| PBKDF2-HMAC-SHA-1 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 1,300,000 | L | + +## 키 교환 메커니즘 + +이 문단은 V11.6 공개 키 암호에 대한 +추가 정보를 제공한다. + +### 키 교환 체계 + +모든 키 교환 체계에서 최소 112비트 이상의 보안 강도를 반드시 보장해야 하며, 구현 시 아래 표의 매개변수 선택을 따라야 한다. + +| 스키마 | 도메인 매개변수 | 순방향 보안 | 상태 | +|--|--|--|:-:| +| 유한체 디피-헬만(Finite Field Diffie-Hellman; FFDH) | L >= 3072 & N >= 256 | 예 | A | +| 타원 곡선 디피-헬만(Elliptic Curve Diffie-Hellman; ECDH) | f >= 256-383 | 예 | A | +| RSA-PKCS#1 v1.5 기반 암호화 키 전송 | | 아니오 | D | + +다음은 매개변수 정의이다: + +* k는 RSA 키의 크기이다. +* L은 유한체 암호 기법에서 공개 키의 크기이며, N은 개인 키의 크기이다. +* f는ECC에서 키 크기의 범위이다. + +새로운 구현에서는 [NIST SP 800-56A](https://csrc.nist.gov/pubs/sp/800/56/a/r3/final), [NIST SP 800-56B](https://csrc.nist.gov/pubs/sp/800/56/b/r2/final), [NIST SP 800-77](https://csrc.nist.gov/pubs/sp/800/77/r1/final) 표준을 준수하지 않는 어떤 체계도 사용해서는 안 된다. 특히, IKEv1은 운영 환경에서 사용해서는 안 된다. + +### 디피-헬만 그룹 + +다음 그룹들은 디피-헬만 키 교환 구현 시 승인된 그룹이다. 보안 강도에 대한 상세 내용은 [NIST SP 800-56A](https://csrc.nist.gov/pubs/sp/800/56/a/r3/final) 부록 D 및 [NIST SP 800-57 Part 1 Rev.5](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final)에 문서화되어 있다. + +| 그룹 | 상태 | +|------------------|:------:| +| P-224, secp224r1 | A | +| P-256, secp256r1 | A | +| P-384, secp384r1 | A | +| P-521, secp521r1 | A | +| K-233, sect233k1 | A | +| K-283, sect283k1 | A | +| K-409, sect409k1 | A | +| K-571, sect571k1 | A | +| B-233, sect233r1 | A | +| B-283, sect283r1 | A | +| B-409, sect409r1 | A | +| B-571, sect571r1 | A | +| Curve448 | A | +| Curve25519 | A | +| MODP-2048 | A | +| MODP-3072 | A | +| MODP-4096 | A | +| MODP-6144 | A | +| MODP-8192 | A | +| ffdhe2048 | A | +| ffdhe3072 | A | +| ffdhe4096 | A | +| ffdhe6144 | A | +| ffdhe8192 | A | + +## 메시지 인증 코드(Message Authentication Codes; MAC) + +메시지 인증 코드(MAC)는 메시지의 무결성과 진위 여부를 검증하기 위해 사용되는 암호학적 구성 요소이다. MAC은 메시지와 비밀 키를 입력으로 받아 고정 길이의 태그(MAC 값)를 생성한다. MAC는 TLS, SSL 등과 같은 보안 통신 프로토콜에서 널리 사용되며, 통신 당사자 간에 교환되는 메시지가 인증되었고 변경되지 않았음을 보장한다. + +| MAC 알고리즘 | 참조 | 상태 | +| ---------- | --------------- |:-:| +| HMAC-SHA-256 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| HMAC-SHA-384 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| HMAC-SHA-512 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| KMAC128 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | +| KMAC256 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | +| BLAKE3 (keyed_hash mode) | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | +| AES-CMAC | [RFC 4493](https://datatracker.ietf.org/doc/html/rfc4493) & [NIST SP 800-38B](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38b.pdf) | A | +| AES-GMAC | [NIST SP 800-38D](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf) | A | +| Poly1305-AES | [The Poly1305-AES message-authentication code](https://cr.yp.to/mac/poly1305-20050329.pdf) | A | +| HMAC-SHA-1 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | L | +| HMAC-MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | + +## 디지털 서명 + +서명 체계는 반드시 [NIST SP 800-57 Part 1](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final)에서 승인한 키 크기와 매개변수를 사용해야 한다. + +| 서명 알고리즘 | 참조 | 상태 | +| ------------------------------ | --------------------------------------------- | :-: | +| EdDSA (Ed25519, Ed448) | [RFC 8032](https://www.rfc-editor.org/info/rfc8032) | A | +| XEdDSA (Curve25519, Curve448) | [XEdDSA](https://signal.org/docs/specifications/xeddsa/) | A | +| ECDSA (P-256, P-384, P-521) | [FIPS 186-4](https://csrc.nist.gov/pubs/fips/186-5/final) | A | +| RSA-RSSA-PSS | [RFC 8017](https://www.rfc-editor.org/info/rfc8017) | A | +| RSA-SSA-PKCS#1 v1.5 | [RFC 8017](https://www.rfc-editor.org/info/rfc8017) | D | +| DSA (키 길이 무관) | [FIPS 186-4](https://csrc.nist.gov/pubs/fips/186-4/final) | D | + +## 양자 내성 암호 표준 + +양자 내성 암호(Post-quantum cryptography; PQC) 구현은 [FIPS-203](https://csrc.nist.gov/pubs/fips/203/ipd), [FIPS-204](https://csrc.nist.gov/pubs/fips/204/ipd), [FIPS-205](https://csrc.nist.gov/pubs/fips/205/ipd)를 준수해야 한다. 현재 이들 표준에 대해 보안이 강화된 코드 예제나 참조 구현은 아직 많지 않다. 자세한 내용은 [NIST announcement of the first three finalized post-quantum encryption standards (August 2024)](https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards)을 참조하라. + +제안된 [mlkem768x25519](https://datatracker.ietf.org/doc/draft-kwiatkowski-tls-ecdhe-mlkem/03/) 양자 내성 하이브리드 TLS 키 합의 방식은 [Firefox release 132](https://www.mozilla.org/en-US/firefox/132.0/releasenotes/)와 [Chrome release 131](https://security.googleblog.com/2024/09/a-new-path-for-kyber-on-web.html)과 같은 주요 브라우저에서 지원된다. 이 방식은 암호화 테스트 환경에서 사용하거나, 산업계 또는 정부에서 승인한 라이브러리에서 사용할 수 있다. diff --git a/5.0/ko/0x93-Appendix-D_Recommendations.md b/5.0/ko/0x93-Appendix-D_Recommendations.md new file mode 100644 index 0000000000..f1edf5c5e5 --- /dev/null +++ b/5.0/ko/0x93-Appendix-D_Recommendations.md @@ -0,0 +1,49 @@ +# 부록 D: 권장 사항 + +## 소개 + +애플리케이션 보안 검증 표준(Application Security Verification Standard; ASVS) 버전 5.0을 준비하면서, 몇 가지 기존 항목과 새로이 제안된 항목들이 버전 5.0의 요구사항으로서 포함되기에 부적절하다는 점이 확실해졌다. 이는 버전 5.0의 정의에 따라 해당 항목들이 더는 ASVS의 범위에 있지 않거나, 유용하지만 필수 사항으로 지정하기에는 어려움이 있기 때문이다. + +해당 항목들이 누락되지 않도록 일부 항목을 본 부록에 수록하였다. + +## 권장되는 범위 내 매커니즘 + +다음 항목들은 ASVS의 범위 내에 있으며, 필수적이지는 않으나 안전한 애플리케이션의 일부로서 고려하는 것이 강력하게 권장된다. + +* 사용자들이 더 강력한 비밀번호를 설정할 수 있도록 비밀번호 강도 측정기(password strength meter)를 제공하는 것이 권장된다. +* 애플리케이션의 루트 또는 .well-known 디렉터리에 공개적으로 접근 가능한 security.txt 파일을 생성하여, 보안 문제에 관해 소유자에게 연락할 수 있는 링크 또는 이메일 주소를 명확히 정의해야 한다. +* 신뢰할 수 있는 서비스 계층에서의 검증과 함께 클라이언츠 측에서의 입력값 검증을 강제하는 것이 권장된다. 이는 누군가가 애플리케이션을 공격하기 위해 클라이언트 측 통제의 우회 여부를 탐지할 수 있는 기회를 제공한다. +* robots.txt 파일, X-Robots-Tag 응답 헤더 또는 robots html meta tag를 사용하여 우연히 접근될 수 있는 민감한 페이지가 검색 엔진에 노출되는 것을 막아야 한다. +* GraphQL을 사용하는 경우, 모든 개별 인터페이스마다의 권한 부여를 관리하지 않아도 않도록 GraphQL이나 리졸버 계층이 아닌 비즈니스 로직 계층에서 권한 부여 로직을 구현해야 한다. + +참조: + +* [security.txt에 관한 자세한 정보(RFC 링크 포함)](https://securitytxt.org/) + +## 소프트웨어 보안 원칙 + +다음의 항목들은 ASVS의 이전 버전에 포함되어 있었으나 실제 요구사항은 아니다. 보안 통제를 구현할 때 고려해야 할 원칙에 가까우며, 이를 따랐을 때 더 강건한 보안 통제를 구현할 수 있다. 해당하는 항목은 다음과 같다: + +* 보안 통제는 중앙집중화되고, 단순하고(설계의 경제성), 검증 가능하도록 안전하며, 재사용 가능할 것이 권장된다. 이로써 중복, 누락, 또는 비효율적인 통제를 방지할 수 있다. +* 통제를 처음부터 구현하기보다는, 가능한 사전에 작성되어 있으며 철저히 검증된 보안 통제 구현을 사용하는 것이 좋다. +* 이상적으로 보호된 데이터와 리소스에 접근할 때 단일 접근 통제 매커니즘을 사용하는 것이 권장된다. 복사, 붙여넣기 또는 안전하지 않은 대체 경로를 방지하기 위해 모든 요청은 해당 단일 매커니즘을 통과하는 것이 권장된다. +* 속성 기반 또는 기능 기반의 접근 통제는 권장되는 패턴이며, 이 패턴에서는 코드가 단순히 사용자의 역할만 확인하기 보다는 기능이나 데이터 항목에 대한 사용자의 권한을 검사한다. 권한은 여전히 역할 기반으로 할당하는 것이 권장된다. + +## 소프트웨어 보안 프로세스 + +몇 가지의 보안 프로세스는 ASVS 5.0에서 제외되었지만 여전히 유용하다. 이 프로세스들을 효과적으로 구현하는 방법은 OWASP SAMM 프로젝트에서 확인할 수 있다. 이전 버전의 ASVS에 포함되었던 항목은 다음과 같다: + +* 모든 개발 단계에서 보안을 다루는 안전한 소프트웨어 개발 생명 주기를 사용하고 있는지 확인해야 한다. +* 모든 설계 변경 또는 스프린트 계획에서의 위협 모델링이 사용되는지 확인해야 한다. 이는 위협을 식별하고, 대응책을 계획하고, 적절한 위험 대응을 촉진하며, 보안 검사를 안내하기 위함이다. +* 모든 사용자 스토리와 기능이 보안 제약 조건을 포함하는지 확인해야 한다. 보안 제약 조건의 예시는 다음과 같다. "사용자로서, 나는 나의 프로필을 조회하고 수정할 수 있어야 한다. 또한 나는 다른 사람의 프로필을 조회하거나 수정할 수 없어야 한다." +* 모든 개발자와 테스터가 시큐어 코딩 체크리스트, 보안 요구사항, 가이드라인 또는 정책을 사용할 수 있는지 확인해야 한다. +* 애플리케이션 소스 코드가 백도어, 악성 코드(예: 살라미 공격, 논리 폭탄, 시한 폭탄), 문서화되지 않았거나 숨겨진 기능(예: 이스터 에그, 안전하지 않은 디버깅 도구)로부터 안전함을 확인하는 프로세스가 지속적으로 수행되고 있는지 확인해야 한다. 이를 준수하기 위해서는 서드 파티 라이브러리를 포함한 소스 코드에 대한 완전한 접근이 필요하므로 최고 수준의 보안을 요구하는 애플리케이션에만 적합할 가능성이 크다. +* 배포된 환경에서 설정 편차를 탐지하고 응답할 수 있는 매커니즘이 존재하는지 확인해야 한다. 이는 불변 인프라의 사용, 안전 기준선에서의 자동화된 재배포, 승인된 설정과 현재의 상태를 비교하는 드리프트 탐지 도구(drift detection tools)를 포함할 수 있다. +* 모든 서드파티 제품, 라이브러리, 프레임워크 및 서비스에 대해, 개별적인 권장 사항에 따라 보안 강화가 수행되는지 확인해야 한다. + +참조: + +* [OWASP Threat Modeling Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html) +* [OWASP Threat modeling](https://owasp.org/www-community/Application_Threat_Modeling) +* [OWASP Software Assurance Maturity Model Project](https://owasp.org/www-project-samm/) +* [Microsoft SDL](https://www.microsoft.com/en-us/securityengineering/sdl/) diff --git a/5.0/ko/0x94-Appendix-E_Contributors.md b/5.0/ko/0x94-Appendix-E_Contributors.md new file mode 100644 index 0000000000..1ac001e6a8 --- /dev/null +++ b/5.0/ko/0x94-Appendix-E_Contributors.md @@ -0,0 +1,71 @@ +# 부록 E - 기여자들 + +우리는 ASVS 4.0.0 릴리즈 이후부터 의견을 제공하거나 풀 리퀘스트(pull request)를 올려준 다음의 기여자들에게 감사한다. + +오류를 발견하거나 이름이 다른 방식으로 표기되길 바랄 경우 알려주기 바란다. + +| | | | | +|---|---|---|---| +| Johan Sydseter ([sydseter](https://github.com/sydseter)) | luis servin ([lfservin](https://github.com/lfservin)) | Oleksii Dovydkov ([oleksiidov](https://github.com/oleksiidov)) | IZUKA Masahiro ([maizuka](https://github.com/maizuka)) | +| James Sulinski ([jsulinski](https://github.com/jsulinski)) | Eli Saad ([ThunderSon](https://github.com/ThunderSon)) | [kkshitish9](https://github.com/kkshitish9) | Andrew van der Stock ([vanderaj](https://github.com/vanderaj)) | +| Rick M ([kingthorin](https://github.com/kingthorin)) | Bankde Eakasit ([Bankde](https://github.com/Bankde)) | Michael Gargiullo ([mgargiullo](https://github.com/mgargiullo)) | Raphael Dunant ([Racater](https://github.com/Racater)) | +| Cesar Kohl ([cesarkohl](https://github.com/cesarkohl)) | [inaz0](https://github.com/inaz0) | Joerg Bruenner ([JoergBruenner](https://github.com/JoergBruenner)) | David Deatherage ([securitydave](https://github.com/securitydave)) | +| John Carroll ([yosignals](https://github.com/yosignals)) | Jim Fenton ([jimfenton](https://github.com/jimfenton)) | Matteo Pace ([M4tteoP](https://github.com/M4tteoP)) | Sebastien gioria ([SPoint42](https://github.com/SPoint42)) | +| Steven van der Baan ([vdbaan](https://github.com/vdbaan)) | Jeremy Bonghwan Choi ([jeremychoi](https://github.com/jeremychoi)) | [craig-shony](https://github.com/craig-shony) | Riccardo Sirigu ([ricsirigu](https://github.com/ricsirigu)) | +| Tomasz Wrobel ([tw2as](https://github.com/tw2as)) | Alena Dubeshko ([belalena](https://github.com/belalena)) | Rafael Green ([RafaelGreen1](https://github.com/RafaelGreen1)) | [mjang-cobalt](https://github.com/mjang-cobalt) | +| [clallier94](https://github.com/clallier94) | Kevin W. Wall ([kwwall](https://github.com/kwwall)) | Jordan Sherman ([jsherm-fwdsec](https://github.com/jsherm-fwdsec) / [deleterepo](https://github.com/deleterepo)) | Ingo Rauner ([ingo-rauner](https://github.com/ingo-rauner)) | +| Dirk Wetter ([drwetter](https://github.com/drwetter)) | Moshe Zioni ([moshe-apiiro](https://github.com/moshe-apiiro)) | Patrick Dwyer ([coderpatros](https://github.com/coderpatros)) | David Clarke ([davidclarke-au](https://github.com/davidclarke-au)) | +| Takaharu Ogasa ([takaharuogasa](https://github.com/takaharuogasa)) | Arkadii Yakovets ([arkid15r](https://github.com/arkid15r)) | Motoyasu Saburi ([motoyasu-saburi](https://github.com/motoyasu-saburi)) | [leirn](https://github.com/leirn) | +| [wet-certitude](https://github.com/wet-certitude) | [timhemel](https://github.com/timhemel) | RL Thornton ([thornshadow99](https://github.com/thornshadow99)) | Thomas Bandt ([aspnetde](https://github.com/aspnetde)) | +| Roel Storms ([roelstorms](https://github.com/roelstorms)) | Jeroen Willemsen ([commjoen](https://github.com/commjoen)) | [anonymous-31](https://github.com/anonymous-31) | Kamran Saifullah ([deFr0ggy](https://github.com/deFr0ggy)) | +| Steve Springett ([stevespringett](https://github.com/stevespringett)) | Spyros ([northdpole](https://github.com/northdpole)) | Hans Herrera ([hansphp](https://github.com/hansphp)) | [Marx314](https://github.com/Marx314) | +| [CarlosAllendes](https://github.com/CarlosAllendes) | Yonah Russ ([yruss972](https://github.com/yruss972)) | Sander Maijers ([sanmai-NL](https://github.com/sanmai-NL)) | Luboš Bretschneider ([bretik](https://github.com/bretik)) | +| Eva Sarafianou ([esarafianou](https://github.com/esarafianou)) | Ata Seren [ataseren](https://github.com/ataseren) | Steve Thomas ([Sc00bz](https://github.com/Sc00bz)) | Dominique RIGHETTO ([righettod](https://github.com/righettod)) | +| Steven van der Baan ([svdb-ncc](https://github.com/svdb-ncc)) | Michael Vacarella ([Aif4thah](https://github.com/Aif4thah)) | Tonimir Kisasondi ([tkisason](https://github.com/tkisason)) | Stefan Streichsbier ([streichsbaer](https://github.com/streichsbaer)) | +| [hi-unc1e](https://github.com/hi-unc1e) | sb3k ([starbuck3000](https://github.com/starbuck3000)) | [mario-platt](https://github.com/mario-platt) | Devdatta Akhawe ([devd](https://github.com/devd)) | +| Michael Gissing ([scolytus](https://github.com/scolytus)) | Jet Anderson ([thatsjet](https://github.com/thatsjet)) | Dave Wichers ([davewichers](https://github.com/davewichers)) | Jonny Schnittger ([JonnySchnittger](https://github.com/JonnySchnittger)) | +| Silvia Väli ([silviavali](https://github.com/silviavali)) | [jackgates73](https://github.com/jackgates73) | [1songb1rd](https://github.com/1songb1rd) | Timur - ([timurozkul](https://github.com/timurozkul)) | +| Gareth Heyes ([hackvertor](https://github.com/hackvertor)) | [appills](https://github.com/appills) | [suvikaartinen](https://github.com/suvikaartinen) | chaals ([chaals](https://github.com/chaals)) | +| DanielPharos ([AtlasHackert](https://github.com/AtlasHackert)) | will Farrell ([willfarrell](https://github.com/willfarrell)) | Alina Vasiljeva ([avasiljeva](https://github.com/avasiljeva)) | Paul McCann ([ismisepaul](https://github.com/ismisepaul)) | +| Sage ([SajjadPourali](https://github.com/SajjadPourali)) | [rbsec](https://github.com/rbsec) | Benedikt Bauer ([mastacheata](https://github.com/mastacheata)) | James Jardine ([jamesjardine](https://github.com/jamesjardine)) | +| Mark Burnett ([m8urnett](https://github.com/m8urnett)) | [dschwarz91](https://github.com/dschwarz91) | Cyber-AppSec ([Cyber-AppSec](https://github.com/Cyber-AppSec)) | [Tib3rius](https://github.com/Tib3rius) | +| BitnessWise ([bitnesswise](https://github.com/bitnesswise)) | damienbod ([damienbod](https://github.com/damienbod)) | Jared Meit ([jmeit-fwdsec](https://github.com/jmeit-fwdsec)) | Stefan Seelmann ([sseelmann](https://github.com/sseelmann)) | +| Brendan O'Connor ([ussjoin](https://github.com/ussjoin)) | Andrei Titov ([andrettv](https://github.com/andrettv)) | Hans-Petter Fjeld ([atluxity](https://github.com/atluxity)) | [markehack](https://github.com/markehack) | +| Neil Madden ([NeilMadden](https://github.com/NeilMadden)) | Michael Geramb ([mgeramb](https://github.com/mgeramb)) | Osama Elnaggar ([ossie-git](https://github.com/ossie-git)) | [mackowski](https://github.com/mackowski) | +| Ravi Balla ([raviballa](https://github.com/raviballa)) | Hazana ([hazanasec](https://github.com/hazanasec)) | David Means ([dmeans82](https://github.com/dmeans82)) | Alexander Stein ([tohch4](https://github.com/tohch4)) | +| BaeSenseii ([baesenseii](https://github.com/baesenseii)) | Vincent De Schutter ([VincentDS](https://github.com/VincentDS)) | S Bani ([sbani](https://github.com/sbani)) | Mitsuaki Akiyama ([mak1yama](https://github.com/mak1yama)) | +| Christopher Loessl ([hashier](https://github.com/hashier)) | [victorxm](https://github.com/victorxm) | Michal Rada ([michalradacz](https://github.com/michalradacz)) | Veeresh Devireddy ([drveresh](https://github.com/drveresh)) | +| [MaknaSEO](https://github.com/MaknaSEO) | [darkzero2022](https://github.com/darkzero2022) | Liam ([LiamDobbelaere](https://github.com/LiamDobbelaere)) | Frank Denis ([jedisct1](https://github.com/jedisct1)) | +| Otto Sulin ([ottosulin](https://github.com/ottosulin)) | [carllaw6885](https://github.com/carllaw6885) | Anders Johan Holmefjord ([aholmis](https://github.com/aholmis)) | Richard Fritsch ([rfricz](https://github.com/rfricz)) | +| [mesutgungor](https://github.com/mesutgungor) | Scott Helme ([ScottHelme](https://github.com/ScottHelme)) | Carlo Reggiani ([carloreggiani](https://github.com/carloreggiani)) | Suyash Srivastava ([suyash5053](https://github.com/suyash5053)) | +| Mark Potter ([markonweb](https://github.com/markonweb)) | Arjan Lamers ([alamers](https://github.com/alamers)) | Gøran Breivik ([gobrtg](https://github.com/gobrtg)) | [flo-blg](https://github.com/flo-blg) | +| Guillaume Déflache ([guillaume-d](https://github.com/guillaume-d)) | Toufik Airane ([toufik-airane](https://github.com/toufik-airane)) | Keith Hoodlet ([securingdev](https://github.com/securingdev)) | Sinner ([SoftwareSinner](https://github.com/SoftwareSinner)) | +| [iloving](https://github.com/iloving) | Jeroen Beckers ([TheDauntless](https://github.com/TheDauntless)) | Joubin Jabbari ([joubin](https://github.com/joubin)) | yu fujioka ([fujiokayu](https://github.com/fujiokayu)) | +| execjosh ([execjosh](https://github.com/execjosh)) | Alicja Kario ([tomato42](https://github.com/tomato42)) | Sidney Ribeiro ([srjsoftware](https://github.com/srjsoftware)) | Gabriel Marquet ([Gby56](https://github.com/Gby56)) | +| Drew Schulz ([drschulz](https://github.com/drschulz)) | [bedirhan](https://github.com/bedirhan) | [muralito](https://github.com/muralito) | Ronnie Flathers ([ropnop](https://github.com/ropnop)) | +| Philippe De Ryck ([philippederyck](https://github.com/philippederyck)) | Malte ([mal33](https://github.com/mal33)) | [MazeOfThoughts](https://github.com/MazeOfThoughts) | Andreas Falk ([andifalk](https://github.com/andifalk)) | +| Javi ([javixeneize](https://github.com/javixeneize)) | Daniel Hahn ([averell23](https://github.com/averell23)) | [borislav-c](https://github.com/borislav-c) | Robin Wood ([digininja](https://github.com/digininja)) | +| [miro2ns](https://github.com/miro2ns) | Jan Dockx ([jandockx](https://github.com/jandockx)) | [vipinsaini434](https://github.com/vipinsaini434) | [priyanshukumar397](https://github.com/priyanshukumar397) | +| Nat Sakimura ([sakimura](https://github.com/sakimura)) | Benjamin Häublein ([BenjaminHae](https://github.com/BenjaminHae)) | [unknown-user-from](https://github.com/unknown-user-from) | Ali Ramazan TAŞDELEN ([alitasdln](https://github.com/alitasdln)) | +| Pedro Escaleira ([oEscal](https://github.com/oEscal)) | Josh ([josh-hemphill](https://github.com/josh-hemphill)) | Tim Würtele ([SECtim](https://github.com/SECtim)) | AviD ([avidouglen](https://github.com/avidouglen)) | +| SheHacksPurple ([shehackspurple](https://github.com/shehackspurple)) | [fcerullo-cycubix](https://github.com/fcerullo-cycubix) | Hector Eryx Paredes Camacho ([heryxpc](https://github.com/heryxpc)) | Irene Michlin ([irene221b](https://github.com/irene221b)) | +| Jonah Y-M ([TG-Techie](https://github.com/TG-Techie)) | Dhiraj Bahroos ([bahroos](https://github.com/bahroos)) | Jef Meijvis ([jefmeijvis](https://github.com/jefmeijvis)) | [IzmaDoesItbeta](https://github.com/IzmaDoesItbeta) | +| Abdessamad TEMMAR ([TmmmmmR](https://github.com/TmmmmmR)) | [sectroyer](https://github.com/sectroyer) | Soh Satoh ([sohsatoh](https://github.com/sohsatoh)) | [regoravalaz](https://github.com/regoravalaz) | +| james-t ([james-bitherder](https://github.com/james-bitherder)) | Aram Hovsepyan ([aramhovsepyan](https://github.com/aramhovsepyan)) | [JaimeGomezGarciaSan](https://github.com/JaimeGomezGarciaSan) | [ValdiGit01](https://github.com/ValdiGit01) | +| iwatachan ([ishowta](https://github.com/ishowta)) | Vinod Anandan ([VinodAnandan](https://github.com/VinodAnandan)) | Kevin Kien ([KevinKien](https://github.com/KevinKien)) | [paul-williamson-swoop](https://github.com/paul-williamson-swoop) | +| [endergzr](https://github.com/endergzr) | Radhwan Alshamamri ([Rado0z](https://github.com/Rado0z)) | Grant Ongers ([rewtd](https://github.com/rewtd)) | Cure53 ([cure53](https://github.com/cure53)) | +| [AliR2Linux](https://github.com/AliR2Linux) | Ads Dawson ([GangGreenTemperTatum](https://github.com/GangGreenTemperTatum)) | William Reyor ([BillReyor](https://github.com/BillReyor)) | gabe ([gcrow](https://github.com/gcrow)) | +| [mascotter](https://github.com/mascotter) | [luissaiz](https://github.com/luissaiz) | Suren Manukyan ([vx-sec](https://github.com/vx-sec)) | Piotr Gliźniewicz ([pglizniewicz](https://github.com/pglizniewicz)) | +| Tadeusz Wachowski ([tadeuszwachowski](https://github.com/tadeuszwachowski)) | Nasir aka Nate ([andesec](https://github.com/andesec)) | [settantasette](https://github.com/settantasette) | Lars Haulin ([LarsH](https://github.com/LarsH)) | +| Terence Eden ([edent](https://github.com/edent)) | [JasmineScholz](https://github.com/JasmineScholz) | Arun Sivadasan ([teavanist](https://github.com/teavanist)) | Yusuf GÜR ([yusuffgur](https://github.com/yusuffgur)) | +| Troy Marshall ([troymarshall](https://github.com/troymarshall)) | Tanner Prynn ([tprynn](https://github.com/tprynn)) | Nick K. ([nickific](https://github.com/nickific)) | [raoul361](https://github.com/raoul361) | +| Azeem Ilyas ([TheAxZim](https://github.com/TheAxZim)) | Evo Stamatov ([avioli](https://github.com/avioli)) | Tim Potter ([timpotter87](https://github.com/timpotter87)) | Gavin Ray ([GavinRay97](https://github.com/GavinRay97)) | +| monis ([demideus](https://github.com/demideus)) | Marcin Hoppe ([MarcinHoppe](https://github.com/MarcinHoppe)) | Grambulf ([ramshazar](https://github.com/ramshazar)) | Jordan Pike ([computersarebad](https://github.com/computersarebad)) | +| Jason Rogers ([jason-invision](https://github.com/jason-invision)) | Ben Hall ([benbhall](https://github.com/benbhall)) | JamesPoppyCock ([jamesly123](https://github.com/jamesly123)) | WhiteHackLabs ([whitehacklabs](https://github.com/whitehacklabs)) | +| Alex Gaynor ([alex](https://github.com/alex)) | Filip van Laenen ([filipvanlaenen](https://github.com/filipvanlaenen)) | [jeurgen](https://github.com/jeurgen) | [GraoMelo](https://github.com/GraoMelo) | +| Andreas Kurtz ([ay-kay](https://github.com/ay-kay)) | Tom Tervoort ([TomTervoort](https://github.com/TomTervoort)) | old man ([deveras](https://github.com/deveras)) | Marco Schnüriger ([marcortw](https://github.com/marcortw)) | +| [stiiin](https://github.com/stiiin) | infoseclearn ([teaminfoseclearn](https://github.com/teaminfoseclearn)) | [hljupkij](https://github.com/hljupkij) | Noe ([nmarher](https://github.com/nmarher)) | +| Lyz ([lyz-code](https://github.com/lyz-code)) | Martin Riedel ([mrtnrdl](https://github.com/mrtnrdl)) | KIM Jaesuck ([tcaesvk](https://github.com/tcaesvk)) | Barbara Schachner ([bschach](https://github.com/bschach)) | +| René Reuter ([AresSec](https://github.com/AresSec)) | [carhackpils](https://github.com/carhackpils) | Tyler ([tyler2cr](https://github.com/tyler2cr)) | Hugo ([hasousa](https://github.com/hasousa)) | +| Wouter Bloeyaert ([Someniak](https://github.com/Someniak)) | Mark de Rijk ([markderijkinfosec](https://github.com/markderijkinfosec)) | Ramin ([picohub](https://github.com/picohub)) | Philip D. Turner ([philipdturner](https://github.com/philipdturner)) | +| Will Chatham ([willc](https://github.com/willc)) | | | | diff --git a/5.0/mappings/README.md b/5.0/mappings/README.md index 380067cb3e..634a2b4fae 100644 --- a/5.0/mappings/README.md +++ b/5.0/mappings/README.md @@ -2,7 +2,7 @@ Versions: -* v4.0.3 - latest v4 release +* v4.0.3 - latest v4 ralease * v5.0.be - "bleeding edge" version for v5.0 development, where all v4.0 structure and numbers were kept directly or as placeholders * v5.0 - v5.0 after re-structuring and re-numbering everything diff --git a/5.0/mappings/nist.md b/5.0/mappings/nist.md index e1e19ceaec..1cfb69e4d2 100644 --- a/5.0/mappings/nist.md +++ b/5.0/mappings/nist.md @@ -5,11 +5,11 @@ | **2.1.1** | 5.1.1.2 | | **2.1.2** | 5.1.1.2 | | **2.1.3** | 5.1.1.2 | -| **2.1.4** | | +| **2.1.4** | | | **2.1.5** | 5.1.1.2 | | **2.1.6** | 5.1.1.2 | | **2.1.7** | 5.1.1.2 | -| **2.1.8** | | +| **2.1.8** | | | **2.1.9** | 5.1.1.2 | | **2.1.10** | 5.1.1.2 | | **2.1.11** | 5.1.1.2 | @@ -17,31 +17,31 @@ | **2.1.13** | 5.1.1.2 | | **2.1.14** | 5.1.1.2 | | **2.2.1** | 5.2.2 | -| **2.2.2** | | +| **2.2.2** | | | **2.2.3** | 6.1.2 | | **2.2.4** | 4.3.1 | -| **2.2.5** | | -| **2.2.6** | | -| **2.2.7** | | -| **2.2.8** | | +| **2.2.5** | | +| **2.2.6** | | +| **2.2.7** | | +| **2.2.8** | | | **2.2.9** | 4.2.1 | -| **2.2.10** | | -| **2.2.11** | | +| **2.2.10** | | +| **2.2.11** | | | **2.3.1** | 5.1.1.2 / A.3 | -| **2.3.2** | | +| **2.3.2** | | | **2.3.3** | 6.1.4 | -| **2.3.4** | | -| **2.4.1** | | -| **2.4.2** | | -| **2.4.3** | | -| **2.4.4** | | -| **2.4.5** | | -| **2.4.6** | | -| **2.5.1** | | +| **2.3.4** | | +| **2.4.1** | | +| **2.4.2** | | +| **2.4.3** | | +| **2.4.4** | | +| **2.4.5** | | +| **2.4.6** | | +| **2.5.1** | | | **2.5.2** | 5.1.1.2 | -| **2.5.3** | | -| **2.5.4** | | -| **2.5.5** | | +| **2.5.3** | | +| **2.5.4** | | +| **2.5.5** | | | **2.5.6** | 5.1.1.2 | | **2.5.7** | 6.1.2.3 | | **2.6.1** | 5.1.2.2 | @@ -52,59 +52,59 @@ | **2.7.2** | 5.1.3.2 | | **2.7.3** | 5.1.3.2 | | **2.7.4** | 5.1.3.2 | -| **2.7.5** | | +| **2.7.5** | | | **2.7.6** | 5.1.3.2 | | **2.7.7** | 5.1.3.2 | -| **2.7.8** | | +| **2.7.8** | | | **2.8.1** | 5.1.4.2 / 5.1.5.2 | | **2.8.2** | 5.1.4.2 / 5.1.5.2 | | **2.8.3** | 5.1.4.2 / 5.1.5.2 | | **2.8.4** | 5.1.4.2 / 5.1.5.2 | -| **2.8.5** | | +| **2.8.5** | | | **2.8.6** | 5.2.1 | | **2.8.7** | 5.2.3 | | **2.8.8** | 5.1.4.2 / 5.1.5.2 | | **2.9.1** | 5.1.7.2 | | **2.9.2** | 5.1.7.2 | | **2.9.3** | 5.1.7.2 | -| **2.10.1** | | -| **2.10.2** | | -| **2.10.3** | | -| **2.10.4** | | -| **2.11.1** | | -| **2.11.2** | | -| **2.11.3** | | -| **3.1.1** | | -| **3.1.2** | | +| **2.10.1** | | +| **2.10.2** | | +| **2.10.3** | | +| **2.10.4** | | +| **2.11.1** | | +| **2.11.2** | | +| **2.11.3** | | +| **3.1.1** | | +| **3.1.2** | | | **3.1.3** | 7.1 | -| **3.1.4** | | +| **3.1.4** | | | **3.2.1** | 7.1 | -| **3.2.2** | | -| **3.2.3** | | -| **3.2.4** | | -| **3.2.5** | | -| **3.3.1** | | -| **3.3.2** | | -| **3.3.3** | | -| **3.3.4** | | +| **3.2.2** | | +| **3.2.3** | | +| **3.2.4** | | +| **3.2.5** | | +| **3.3.1** | | +| **3.3.2** | | +| **3.3.3** | | +| **3.3.4** | | | **3.3.5** | 7.2 | | **3.4.1** | 7.1.1 | | **3.4.2** | 7.1.1 | | **3.4.3** | 7.1.1 | | **3.4.4** | 7.1.1 | -| **3.4.5** | | +| **3.4.5** | | | **3.5.1** | 7.1.2 | -| **3.5.2** | | -| **3.5.3** | | -| **3.5.4** | | -| **3.5.5** | | -| **3.5.6** | | +| **3.5.2** | | +| **3.5.3** | | +| **3.5.4** | | +| **3.5.5** | | +| **3.5.6** | | | **3.6.1** | 7.2.1 | -| **3.6.2** | | -| **3.7.1** | | -| **3.7.2** | | +| **3.6.2** | | +| **3.7.1** | | +| **3.7.2** | | | **3.8.1** | 7.1 | -| **3.8.2** | | -| **3.8.3** | | -| **3.8.4** | | +| **3.8.2** | | +| **3.8.3** | | +| **3.8.4** | | | **3.8.5** | 7.1 | diff --git a/5.0/ru/0x00-Header.yaml b/5.0/ru/0x00-Header.yaml new file mode 100644 index 0000000000..eb86984808 --- /dev/null +++ b/5.0/ru/0x00-Header.yaml @@ -0,0 +1,15 @@ +--- + title: "Стандарт верификации требований к безопасности приложений" + subtitle: "Версия 5.0.0" + date: Май 2025 + titlepage: true + titlepage-rule-height: 0 + titlepage-logo: "images/owasp_logo_1c_notext.png" + table-use-row-colors: true + toc: true + toc-own-page: true + geometry: "left=2cm,right=2cm,top=3cm,bottom=3cm" + CJKmainfont: "Noto Sans CJK JP" + mainfont: "Source Serif 4" + sansfont: "Source Sans 3" +--- diff --git a/5.0/ru/0x01-Frontispiece.md b/5.0/ru/0x01-Frontispiece.md new file mode 100644 index 0000000000..55578529a5 --- /dev/null +++ b/5.0/ru/0x01-Frontispiece.md @@ -0,0 +1,46 @@ +# Фронтиспис + +## О стандарте + +Стандарт верификации требований к безопасности приложений — это перечень требований к безопасности приложений (тестов), которыми могут пользоваться архитекторы, разработчики, тестировщики, специалисты по безопасности, разработчики инструментов и конечные пользователи для проектирования, разработки, тестирования и контроля безопасных приложений. + +## Авторские права и лицензия + +Версия 5.0.0, май 2025 + +![лицензия](../images/license.png) + +Copyright © 2008-2025 The OWASP Foundation. + +Этот документ выпущен под [лицензией Creative Commons Attribution-ShareAlike 4.0 International](https://creativecommons.org/licenses/by-sa/4.0/). + +При воспроизведении или распространении этого документа необходимо разъяснить условия лицензии на него. + +## Руководители проекта + +| | | +|---------------------- |----------------- | +| Elar Lang | Josh C Grossman | +| Jim Manico | Daniel Cuthbert | + +## Рабочая группа + +| | | | | +|---------------- |------------------ |------------------- |----------------- | +| Tobias Ahnoff | Ralph Andalis | Ryan Armstrong | Gabriel Corona | +| Meghan Jacquot | Shanni Prutchi | Iman Sharafaldin | Eden Yardeni | + +## Основные участники + +| | | +|-------------------|-------------------| +| Sjoerd Langkemper | Isaac Lewis | +| Mark Carney | Sandro Gauci | + +## Другие участники и рецензенты + +Список остальных участников перечислен в Приложении E. + +Если Вы — участник проекта, но Вашего имени нет в приведенном выше списке, пожалуйста, зарегистрируйте issue на GitHub для признания в будущих обновлениях. + +Пятая версия стандарта верификации требований к безопасности приложений опирается на предыдущие версии ASVS, начиная с первой, вышедшей в 2008 году, и до четвертой, в 2019 году. Большая часть разделов оглавления и пунктов требований, до сих пор присутствующих в ASVS, изначально были написаны Эндрю ван дер Стоком, Майком Боберски, Джеффом Уильямсом и Дэйвом Уичерсом, но участников было гораздо больше - спасибо им всем. Полные списки всех, кто внес свой вклад в более ранние версии, есть в соответствующих версиях документа. diff --git a/5.0/ru/0x02-Preface.md b/5.0/ru/0x02-Preface.md new file mode 100644 index 0000000000..4470b3236f --- /dev/null +++ b/5.0/ru/0x02-Preface.md @@ -0,0 +1,29 @@ +# Предисловие + +Добро пожаловать в Стандарт верификации требований к безопасности приложений (ASVS) версии 5.0 + +## Введение + +Изначально представленный в 2008 году совместными усилиями мирового сообщества, ASVS определяет исчерпывающий набор требований безопасности для проектирования, разработки и тестирования современных веб-приложений и сервисов. + +После выхода версии ASVS 4.0 в 2019 году и ее незначительного обновления (v4.0.3) в 2021 году, версия 5.0 является значительным шагом вперед — она была модернизирована, чтобы учесть последние достижения в области безопасности программного обеспечения. + +ASVS 5.0 стал результатом масштабного вклада руководителей проекта, членов рабочей группы и широкого сообщества OWASP, направленного на обновление и совершенствование этого важного стандарта. + +## Ключевые принципы версии 5.0 + +Эта масштабная редакция была разработана с учетом нескольких ключевых принципов: + +* Уточнение границ и целей: Данная версия стандарта была разработана для более точного соответствия основным принципам, отраженным в его названии: Приложение (Application), Безопасность (Security), Проверка (Verification), Стандарт (Standard). Требования были переформулированы - теперь они направлены на предотвращение недостатков безопасности, а не на обязательное применение конкретных технических решений. Тексты требований являются самодостаточными и поясняют свою необходимость. + +* Поддержка документирования решений по безопасности: ASVS 5.0 вводит требования к документированию ключевых решений по безопасности. Данный подход улучшает отслеживаемость решений и способствует контекстуально-ориентированным реализациям, предоставляя организациям возможность настраивать свою защиту в соответствии с индивидуальными требованиями и рисками. + +* Обновленные уровни: Несмотря на сохранение трехуровневой модели, определения уровней были пересмотрены для упрощения внедрения ASVS. Уровень 1 предназначен для начального этапа внедрения стандарта и обеспечивает базовый уровень защиты. Уровень 2 представляет собой комплексный набор стандартных практик безопасности. Уровень 3 охватывает расширенные требования для обеспечения повышенной гарантии безопасности. + +* Реструктуризированное и расширенное содержание: ASVS 5.0 включает приблизительно 350 требований, распределенных по 17 главам. Структура глав была переработана для большей ясности и удобства использования. Для облегчения перехода предоставлено двустороннее соответствие между версиями 4.0 и 5.0. + +## Взгляд в будущее + +Так же, как и обеспечение безопасности приложения никогда не может быть полностью завершено, работа над ASVS также никогда не прекращается. Несмотря на то, что версия 5.0 является крупным релизом, разработка стандарта продолжается. Данный выпуск позволяет сообществу воспользоваться преимуществами накопленных улучшений и дополнений, а также закладывает основу для будущего развития. Это может включать в себя инициативы сообщества по созданию руководств по внедрению и проверке, основанных на базовом наборе требований. + +ASVS 5.0 предназначен для того, чтобы служить надежной основой для разработки безопасного программного обеспечения. Сообществу предлагается применять этот стандарт, вносить в него свой вклад и развивать его, чтобы совместно двигать вперёд состояние безопасности приложений. diff --git a/5.0/ru/0x03-What-is-the-ASVS.md b/5.0/ru/0x03-What-is-the-ASVS.md new file mode 100644 index 0000000000..bc1d58331e --- /dev/null +++ b/5.0/ru/0x03-What-is-the-ASVS.md @@ -0,0 +1,195 @@ +# Что такое ASVS? + +Стандарт верификации требований к безопасности приложений (ASVS) определяет требования безопасности для веб-приложений и сервисов, представляя собой ценный ресурс для всех, кто стремится проектировать, разрабатывать и поддерживать безопасные приложения или оценивать их уровень защищённости. + +В этой главе описываются ключевые аспекты применения ASVS, включая его область действия, структуру уровней, основанных на приоритетах, и основные сценарии использования стандарта. + +## Область действия ASVS + +Область действия ASVS определяется его названием: Приложение (Application), Безопасность (Security), Верификация (Verification) и Стандарт (Standard). Он устанавливает, какие требования включены в стандарт, а какие — исключены из него, с глобальной целью определения основополагающих принципов безопасности, которые должны быть достигнуты. Область действия также учитывает требования к документации, которые служат основой для требований к реализации. + +Не существует такого понятия, как «область действия» для злоумышленника. Поэтому требования ASVS должны оцениваться в совокупности с рекомендациями по другим аспектам жизненного цикла приложения, включая процессы CI/CD, хостинг и операционную деятельность. + +### Приложение + +ASVS определяет «Приложение» как разрабатываемый программный продукт, в который должны быть интегрированы механизмы безопасности. ASVS не регламентирует процессы жизненного цикла разработки и не указывает на методы сборки приложения в CI/CD. Его задача — описать требуемый уровень защищённости, который должен быть достигнут в конечном продукте. + +Компоненты для обработки HTTP-трафика (WAF, балансировщики нагрузки, прокси) могут считаться частью приложения в контексте безопасности, поскольку некоторые механизмы безопасности напрямую зависят от них или могут быть реализованы с их помощью. Это касается требований по кешированию, rate limiting, а также фильтрации входящих/исходящих подключений по источнику и получателю. + +В свою очередь, ASVS не включает требования, не относящиеся к приложению напрямую или находящиеся за пределами его зоны ответственности. Так, например, проблемы DNS обычно относятся в ведении отдельной команды или функции. + +Аналогично, хотя в зону ответственности приложения входит обработка входящих данных и генерация исходящих данных, если внешний процесс взаимодействует с приложением или его данными, это считается выходящим за рамки ASVS. Например, резервное копирование приложения или его данных обычно выполняется внешними процессами и не контролируется самим приложением или его разработчиками. + +### Безопасность + +Каждое требование должно иметь очевидное влияние на безопасность. Отсутствие требования должно привести к снижению уровня защищённости приложения, а реализация требования должна либо уменьшить вероятность возникновения риска безопасности, либо смягчить последствия. + +Все прочие аспекты, такие как функциональные характеристики, стиль кода или требования политик, выходят за рамки стандарта. + +### Верификация + +Требование должно быть верифицируемым, а его проверка должна приводить к однозначному решению: «не выполнено» или «выполнено». + +### Стандарт + +ASVS представляет собой набор требований безопасности, которые необходимо реализовать для соответствия стандарту. Это означает, что требования ограничиваются определением целевого показателя безопасности, которого необходимо достичь. Прочая сопутствующая информация может быть надстроена на основе ASVS или связана с ним через сопоставления. + +В частности, в рамках OWASP существует множество проектов, и ASVS намеренно избегает дублирования содержания других проектов. Например, у разработчиков может возникнуть вопрос: «как мне реализовать конкретное требование в моем технологическом стеке или окружении?» — на него должен отвечать проект Cheat Sheet Series. У тестировщиков может возникнуть вопрос: «как мне проверить это требование в данном окружении?» — на него должен отвечать проект Web Security Testing Guide. + +Хотя ASVS предназначен не только для специалистов по безопасности, он ожидает, что читатель обладает техническими знаниями для понимания содержания или способен самостоятельно изучить конкретные концепции. + +### Требование + +Слово «Требование» специально используется в ASVS, поскольку оно описывает обязательное условие, которое должно быть достигнуто для его выполнения. ASVS содержит только требования (обязательные к выполнению) и не содержит рекомендаций. + +Другими словами, рекомендации, независимо от того, являются ли они лишь одним из многих возможных вариантов для решения проблем или вопросов стиля кода, не удовлетворяют определению требования. + +Требования ASVS определяют цели безопасности, не привязываясь к конкретным технологиям или методам реализации. Их назначение понятно из самого текста, и они не предписывают, как именно следует проводить проверку. + +### Документированные решения по безопасности + +В области безопасности программного обеспечения заблаговременное планирование архитектуры безопасности и защитных механизмов позволяет добиться более последовательной и предсказуемой реализации в конечном продукте или функции. + +Кроме того, некоторые требования сложны в реализации и зависят от специфики приложения. Например, система прав доступа, проверка вводимых данных и защита данных с разной степенью чувствительности. + +Чтобы учесть это, вместо общих формулировок, таких как «все данные должны быть зашифрованы», или попыток охватить каждый возможный случай в требовании, были включены требования к документации. Они предписывают, чтобы подход и конфигурация, выбранные разработчиком приложения для механизмов управления, были задокументированы. Это позволяет провести оценку целесообразности подхода, а затем сравнить фактическую реализацию с документацией, чтобы оценить, соответствует ли реализация ожиданиям. + +Задача этих требований — фиксировать решения, которые организация-разработчик приняла в отношении того, каким образом реализовать определенные требования безопасности. + +Требования к документации всегда размещаются в первом разделе главы (хотя присутствуют не в каждой из них), и каждое из них всегда связано с соответствующим требованием к реализации, в рамках которого документированные решения должны быть воплощены на практике. Ключевая идея заключается в том, что проверка наличия документации и проверка фактической реализации — это два самостоятельных вида деятельности. + +Существует две ключевые причины для включения этих требований. Первая причина заключается в том, что требование информационной безопасности часто предполагает принудительное применение правил, например, какие типы файлов разрешены для загрузки, какие бизнес-контроли должны быть реализованы, какие символы допустимы для конкретного поля. Эти правила уникальны для каждого приложения и поэтому ASVS не может предписать, какими они должны быть. Ни чек-лист, ни развернутое руководство в данном случае не будут полезны. Также, если эти решения не документированы, то невозможно проверить реализацию на соответствие требованиям. + +Вторая причина заключается в необходимости обеспечить гибкость для разработчиков приложения в выборе подходов к решению отдельных вопросов безопасности. Например, в прошлых версиях ASVS ограничения времени жизни сессии были строго фиксированы. На практике многие приложения, особенно ориентированные на прямое взаимодействие с потребителями, применяют более мягкие правила, отдавая предпочтение иным компенсирующим механизмам защиты. Таким образом, настоящие требования к документации прямо разрешают такую гибкость. + +Очевидно, что предполагается, что подобные решения будут приниматься и документироваться не отдельными разработчиками, а организацией в целом. На организацию возлагается ответственность за принятие данных решений, доведение их до сведения разработчиков и обеспечение их соблюдения. + +Предоставление разработчикам спецификаций и проектов новых функций является стандартной практикой в процессе разработки программного обеспечения. Аналогичным образом, от разработчиков ожидается использование общепринятых компонентов и механизмов пользовательского интерфейса, а не принятие самостоятельных решений каждый раз. Таким образом, распространение данного подхода на безопасность не должно восприниматься как нечто удивительное или спорное. + +Кроме того, существует гибкость в выборе способа достижения данной цели. Решения в области безопасности могут быть документированы в виде явного документа, с которым разработчики обязаны знакомиться. Альтернативно, эти решения могут быть документированы и реализованы в рамках общей библиотеки, которую все разработчики обязаны использовать. Результат достигается в обоих случаях. + +## Уровни соответствия ASVS + +Стандарт верификации требований к безопасности приложений определяет три уровня соответствия, каждый из которых усиливает требования предыдущего. Рекомендуемый подход для организаций — начинать с первого уровня для митигации наиболее критичных рисков безопасности с последующим переходом на более высокие уровни в зависимости от конкретных потребностей приложения и организации. В документации и требованиях используются сокращения L1, L2 и L3. + +Каждый уровень соответствия определяет требования безопасности, которые необходимо выполнить для его достижения. Требования же вышестоящих уровней носят рекомендательный характер. + +Во избежание дублирования требований или наличия требований, теряющих актуальность на более высоких уровнях, некоторые из них применяются к конкретному уровню, но предусматривают более строгие условия для последующих уровней. + +### Оценка уровней соответствия + +Уровни соответствия определяются путём приоритизационной оценки каждого требования, основанной на опыте их внедрения и тестирования. Основное внимание уделяется сопоставлению снижения рисков с усилиями по реализации требования. Другим ключевым фактором является сохранение низкого порога вхождения. + +Оценка снижения риска рассматривает, насколько требование уменьшает уровень риска безопасности в приложении. При этом принимаются во внимание классические факторы воздействия на Конфиденциальность, Целостность и Доступность, а также то, является ли данное требование основным рубежом обороны или же оно рассматривается как элемент эшелонированной защиты. + +В результате тщательных обсуждений как самих критериев, так и решений по отнесению их к уровням соответствия, была выработана классификация, которая должна оставаться справедливой для подавляющего большинства случаев, при этом допуская, что она не может быть универсальной для всех ситуаций. Это означает, что в отдельных случаях организации могут пожелать отдать приоритет требованиям более высокого уровня ранее, основываясь на собственной оценке рисков. + +Требования на каждом уровне можно охарактеризовать следующим образом: + +### Уровень 1 + +Данный уровень содержит минимальный набор требований для обеспечения безопасности приложения, и представляет собой критически важную отправную точку. На этот уровень приходится около 20% требований ASVS. Цель этого уровня — иметь как можно меньше требований для снижения порога вхождения. + +Эти требования, как правило, являются критически важными или базовыми, представляя собой первый рубеж защиты от распространённых атак, для эксплуатации которых не требуется наличия других уязвимостей или предварительных условий. + +Помимо требований первого рубежа защиты, некоторые требования имеют меньшее значение на более высоких уровнях, например, требования, связанные с паролями. Они более важны для первого уровня, поскольку, начиная с более высоких уровней становятся актуальными требования многофакторной аутентификации. + +Первый уровень не обязательно поддаётся полноценному тестированию на проникновение внешним специалистом без доступа ко внутренней документации или коду (например, при тестировании по методу «чёрного ящика»), хотя меньшее количество требований должно упростить процесс верификации. + +### Уровень 2 + +Большинству приложений следует стремиться к достижению данного уровня безопасности. На Уровень 2 (L2) приходится около 50% требований ASVS, что означает, что приложению необходимо реализовать порядка 70% требований ASVS (все требования уровней L1 и L2) для соответствия этому уровню. + +Эти требования, как правило, связаны либо с менее распространёнными атаками, либо с более сложными механизмами защиты от распространённых атак. Они могут по-прежнему представлять собой первый рубеж обороны, либо же для успешной атаки могут требоваться определённые предварительные условия. + +### Уровень 3 + +Данный уровень должен быть целью для приложений, стремящихся продемонстрировать наивысший уровень защищённости, и содержит оставшиеся ~30% требований для полного соответствия. + +Требования в данном разделе, как правило, представляют собой либо механизмы глубокой эшелонированной обороны (defense-in-depth), либо иные полезные, но сложные в реализации средства контроля. + +### Какого уровня следует достичь + +Уровни, основанные на приоритетах, призваны отражать степень зрелости системы безопасности организации и приложения. Вместо того, чтобы предписывать, какого уровня должно достигать приложение, ASVS предлагает организации проанализировать свои риски и самостоятельно определить целевой уровень, исходя из критичности приложения и, конечно же, ожиданий его пользователей. + +Например, стартап на ранней стадии, собирающий лишь ограниченный объём конфиденциальных данных, может принять решение сфокусироваться на первом уровне на начальном этапе. В то же время банк не сможет объяснить клиентам выбор уровня ниже, чем Уровень 3, для своего онлайн банковского приложения. + +## Как применять этот стандарт + +### Структура ASVS + +ASVS состоит в общей сложности из приблизительно 350 требований, которые разделены на 17 глав. Каждая глава, в свою очередь, делится на разделы. + +Цель такого деления на главы и разделы — упростить выбор или исключение соответствующих глав и разделов в зависимости от релевантности для конкретного приложения. Например, требования главы V3, касающиеся веб-интерфейсов, не будут актуальны в случае API для межмашинного взаимодействия. Если в системе не используется OAuth или WebRTC, то соответствующие главы также могут быть проигнорированы. + +### Стратегия выпусков + +Выпуски ASVS следуют схеме "Major.Minor.Patch", где номера версий указывают на характер изменений в выпуске. При мажорном выпуске изменяется первое число, при минорном — второе, а при патче — третье. + +* Мажорный выпуск (Major release) — Полная реорганизация. Могут быть изменены практически все элементы, включая нумерацию требований. Для подтверждения соответствия потребуется проведение повторной оценки (например, переход с версии 4.0.3 на 5.0.0). +* Минорный выпуск (Minor release) — Требования могут добавляться или удаляться, но общая структура нумерации остаётся прежней. Для подтверждения соответствия потребуется повторная оценка, но она должна быть проще (например, переход с версии 5.0.0 на 5.1.0). +* Выпуск патча (Patch release) — Требования могут быть удалены (например, если они являются дубликатами или устарели) или смягчены. Приложение, соответствовавшее предыдущему выпуску, будет соответствовать и патч-выпуску (например, переход с версии 5.0.0 на 5.0.1). + +Вышеизложенное относится только к самим требованиям. Изменения в пояснительных текстах и приложениях не являются критическими. + +### Гибкость использования ASVS + +Ряд рассмотренных принципов (например, требования к документации и система уровней) предоставляет возможность применять ASVS гибко, с учётом специфики организации. + +Кроме того, организациям настоятельно рекомендуется создавать специализированные ответвления (форки) стандарта, адаптированные для организации или домена, которые корректируют требования исходя из специфических характеристик и уровней риска их приложений. Однако важно сохранять прослеживаемость (traceability), чтобы соответствие требованию, например, 4.1.1, означало одно и то же во всех версиях. + +В идеале, каждой организации следует создавать собственную адаптированную версию ASVS, исключая нерелевантные разделы (например, GraphQL, WebSockets, SOAP, если они не используются). Версия ASVS, адаптированная под организацию, или дополнение к ней также является хорошим способом предоставить специфичные для организации руководства по реализации, уточняя библиотеки или ресурсы, которые следует использовать для выполнения требований. + +### Как ссылаться на требования ASVS + +Каждое требование имеет идентификатор в формате `.
.` где каждый элемент является числом, например: `1.11.3`. + +* Значение `` соответствует главе, в которой находится это требование, например: все требования `1.#.#` находятся в главе 'Архитектура кодировки и нейтрализации'. +* Значение `
` соответствует разделу в этой главе, где находится это требование; например, все требования `1.2.#` находятся в разделе 'Предотвращение инъекций' главы 'Архитектура кодировки и нейтрализации'. +* Значение `` указывает на конкретное требование в главе и разделе, например, `1.2.5`, которым в версии 5.0.0 этого стандарта является: + +> Убедитесь, что приложение защищено от внедрения команд ОС и что вызовы операционной системы используют параметризованные запросы к ОС или используют контекстное кодирование вывода командной строки. + +Идентификаторы требований могут меняться от версии к версии, поэтому желательно, чтобы другие документы, отчеты или инструменты использовали формат: `v-.
.`, где: 'version' это метка версии ASVS. Например: `v5.0.0-1.2.5` будет означать 5-е требование в разделе 'Предотвращение инъекций' главы 'Архитектура кодировки и обработки' в версии 5.0.0. (Резюмируя, `v-`.) + +Примечание. Буква `v`, предшествующая версии, должна быть в нижнем регистре. + +Считается, что если идентификаторы указаны без элемента `v`, то они относятся к последней версии стандарта. По мере развития и изменения стандарта это станет проблематичным, поэтому авторы и разработчики должны включать элемент версии. + +Списки требований ASVS доступны в форматах CSV, JSON и других, которые могут оказаться полезными для справки или использования в программах. + +### Создание ответвлений ASVS + +Организации могут извлечь пользу из применения ASVS, выбрав один из трёх уровней или создав предметно-ориентированное ответвление (fork), которое адаптирует требования в соответствии с уровнем риска каждого приложения. Такой подход настоятельно рекомендуется при условии сохранения прослеживаемости (traceability), чтобы соответствие требованию, например, 4.1.1, означало одно и то же во всех версиях. + +В идеале каждой организации следует создать собственную адаптированную версию ASVS, исключая нерелевантные разделы (например, GraphQL, WebSockets, SOAP, если они не используются). Создание ответвления следует начинать с использования ASVS Уровня 1 в качестве базового, с последующим переходом на Уровни 2 или 3 в зависимости от рисков, присущих приложению. + +## Сценарии применения ASVS + +ASVS может быть использован для оценки безопасности приложения, и этот вопрос более глубоко исследуется в следующей главе. Тем не менее, был выявлен ряд других потенциальных вариантов использования ASVS (или его модифицированной версии). + +### Как подробное руководство по архитектуре безопасности + +Одним из наиболее распространенных вариантов использования Стандарта верификации требований к безопасности приложений является его применение в качестве ресурса для архитекторов безопасности. В настоящее время существует ограниченное количество материалов о том, как построить безопасную архитектуру современного приложения. ASVS может быть использован для восполнения этих пробелов, позволяя архитекторам безопасности выбирать более эффективные меры для решения распространенных проблем, таких как шаблоны защиты и стратегии валидации входных данных. Требования, связанные с архитектурой и документацией, будут особенно полезны для этой цели. + +### Как специализированное руководство по безопасной разработке + +ASVS может быть использован как основа для подготовки руководства по безопасной разработке в процессе разработки приложения, помогая разработчикам не упускать из виду аспекты безопасности при создании программного обеспечения. Хотя ASVS может служить основой, организациям следует подготовить свои собственные конкретные руководства, которые являются четкими и унифицированными, и в идеале их следует составлять на основе рекомендаций инженеров или архитекторов безопасности. В развитие этого подхода организациям настоятельно рекомендуется, по возможности, подготовить одобренные механизмы безопасности и библиотеки, на которые можно ссылаться в руководствах и которые разработчики могут использовать. + +### Как руководство по автоматизированному модульному и интеграционному тестированию + +ASVS создавался таким, чтобы его можно было легко протестировать. Некоторые проверки носят технический характер, в то время как другие требования могут потребовать анализа документации или архитектуры. Благодаря модульным и интеграционным тестам, которые проверяют характерные случаи фаззинга и недокументированного использования, связанных с требованиями, поддающимися технической верификации, можно упростить проверку корректности работы этих контролей при каждой сборке. Например, для набора тестов для контроллера входа в систему можно разработать дополнительные тесты, проверяющие атрибут username на совпадение с наиболее распространенными именами пользователей по умолчанию, перебор учетных записей, LDAP- и SQL-инъекции, а также XSS. Аналогично, проверка атрибута password должна включать перебор самых распространенных паролей, оценку длины пароля, вставку нулевого байта, удаление этого атрибута, XSS и многое другое. + +### Как курс по безопасной разработке + +ASVS также можно использовать для определения характеристик защищенного программного обеспечения. Многие «курсы безопасной разработки» — это просто курсы по этичному хакингу с легким намеком на советы по безопасной разработке. Не факт, что это как-то поможет разработчикам писать более безопасный код. Вместо этого курсы по безопасной разработке должны делать упор на упреждающие меры из ASVS, а не на список того, чего делать не стоит (OWASP Top 10). Структура ASVS также предоставляет логичную основу для последовательного изучения различных тем, связанных с защитой приложения. + +### Как руководство по приобретению безопасного программного обеспечения + +ASVS — это отличное руководство по приобретению безопасного программного обеспечения или заказных услуг по его разработке. Заказчику достаточно указать требование, что программное обеспечение, которое он хочет приобрести, должно быть разработано на уровне ASVS LX, и потребовать, чтобы Исполнитель доказал, что оно ему соответствует. + +## Применение ASVS на практике + +Разные угрозы имеют разную мотивацию. В отдельных отраслях имеются уникальные информационные и технологические ресурсы или отраслевые регуляторные требования. + +Организациям настоятельно рекомендуется внимательно изучить риски, присущие характеру их бизнеса, и на их основе, и с учетом бизнес-требований определить соответствующий уровень ASVS. diff --git a/5.0/ru/0x04-Assessment_and_Certification.md b/5.0/ru/0x04-Assessment_and_Certification.md new file mode 100644 index 0000000000..1edc5c19f8 --- /dev/null +++ b/5.0/ru/0x04-Assessment_and_Certification.md @@ -0,0 +1,47 @@ +# Оценка и сертификация + +## Позиция OWASP в отношении сертификатов и знаков доверия ASVS + +OWASP, будучи независимой от поставщиков некоммерческой организацией, не сертифицирует разработчиков, аудиторов или программное обеспечение. Любые заверения, знаки доверия или сертификаты, претендующие на соответствие ASVS, официально не поддерживаются OWASP, поэтому организации должны проявлять осторожность в заявлении третьих сторон о сертификации по ASVS. + +Организации могут предлагать услуги по предоставлению гарантий соответствия при условии, что они не претендуют на официальную сертификацию OWASP. + +## Как проверять соответствие ASVS + +Стандарт намеренно не предписывает конкретные методы проверки соответствия на уровне руководства по тестированию. Тем не менее, важно выделить некоторые ключевые моменты. + +### Отчет о проверке + +Традиционные отчёты о тестировании на проникновение фиксируют только неудачные проверки. Однако отчёт о проверке соответствия ASVS должен включать в себя область исследования, сводку всех проверяемых требований, а также требования, по которым были отмечены исключения, и руководство по устранению выявленных проблем. Некоторые требования могут быть неприменимы (например, управление сессиями в stateless API), и это должно быть явно указано в отчёте. + +### Область исследования + +Организация, разрабатывающая приложение, как правило, реализует не все требования, поскольку некоторые из них могут быть нерелевантными или менее значимыми исходя из функциональности приложения. Аудитор должен чётко определить область проверки, включая то, какого уровня соответствия пытается достичь организация и какие требования были включены в оценку. Это должно быть представлено с точки зрения того, что было включено, а не того, что было исключено. Кроме того, аудитор должен предоставить заключение с обоснованием причин исключения требований, которые не были реализованы. + +Это должно позволить заказчику отчёта о проверке понять контекст проведённого исследования и принять взвешенное решение о том, какой уровень доверия может быть предоставлен приложению. + +Сертифицирующие организации могут выбирать свои методы тестирования, но должны раскрывать их в отчёте и в идеале эти методы должны быть воспроизводимыми. Для проверки различных аспектов (таких как валидация входных данных) в зависимости от приложения и конкретных требований могут использоваться разные методы, например, ручное тестирование на проникновение или анализ исходного кода. + +### Методы тестирования + +Для верификации конкретных требований ASVS может потребоваться применение ряда различных методик. Помимо тестирования на проникновение (с использованием действительных учётных данных для обеспечения полного охвата приложения), проверка соответствия требованиям ASVS может потребовать доступа к документации, исходному коду, конфигурациям, а также к лицам, причастным к процессу разработки. Это особенно актуально для верификации требований Уровней 2 и 3. Стандартной практикой является предоставление убедительных доказательств обнаруженных недостатков с подробным документированием, которое может включать записи тестировщика, скриншоты, скрипты и журналы тестирования. Простого запуска автоматизированного инструмента недостаточно для сертификации, поскольку каждое требование должно быть тщательно протестировано. + +Использование средств автоматизации для верификации требований ASVS — это тема, которая неизменно вызывает значительный интерес. В связи с этим важно прояснить некоторые моменты, связанные с автоматизированным тестированием и тестированием по методу «чёрного ящика». + +#### Роль инструментов автоматизированного тестирования безопасности + +Когда автоматизированные инструменты динамического и статического анализа безопасности приложений (DAST и SAST) корректно интегрированы в pipeline сборки, они могут выявлять некоторые проблемы безопасности, которые не должны существовать в принципе. Однако без тщательной конфигурации и настройки они не обеспечат необходимый охват, а большое количество ложных срабатываний помешает выявлению и устранению реальных проблем безопасности. + +Хотя это может обеспечить покрытие некоторых более базовых и простых технических требований, относящихся к кодированию или нейтрализации выходных данных, крайне важно отметить, что эти инструменты неспособны в полной мере проверить многие из более сложных требований ASVS или тех, что связаны с бизнес-логикой и контролем доступа. + +Что касается менее тривиальных требований, вероятно, что автоматизацию всё же можно задействовать, однако для этого потребуется написание специфичных для приложения проверок. Они могут быть аналогичны модульным и интеграционным тестам, которые организация, возможно, уже использует. Следовательно, может оказаться возможным использовать существующую инфраструктуру автоматизации тестирования для создания этих специализированных тестов под требования ASVS. Хотя для этого потребуются краткосрочные инвестиции, долгосрочные преимущества, связанные с возможностью постоянной верификации этих требований ASVS, будут значительными. + +Подводя итог, автоматизированное тестирование != запуску стандартного инструмента «из коробки». + +#### Роль тестирования на проникновение + +Несмотря на то, что Уровень 1 (L1) в версии 4.0 был оптимизирован для проведения тестирования по методу «чёрного ящика» (без доступа к документации и исходному коду), даже в то время стандарт четко давал понять, что это не является эффективной деятельностью, гарантирующей соответствие, и такой подход не следует активно применять. + +Тестирование без доступа к необходимой дополнительной информации является неэффективным и малорезультативным, поскольку при этом упускается возможность проверки исходного кода, выявления угроз и отсутствующих мер защиты, а также выполнения гораздо более тщательного тестирования в более короткие сроки. + +Настоятельно рекомендуется проводить тестирование на проникновение, основанное на изучении документации и исходного кода (гибридный подход), в ходе которого тестировщики имеют полный доступ к разработчикам приложения и его документации, в отличие от традиционного тестирования на проникновение. Этот подход будет необходимым для верификации многих требований ASVS. diff --git a/5.0/ru/0x05-For-Users-Of-4.0.md b/5.0/ru/0x05-For-Users-Of-4.0.md new file mode 100644 index 0000000000..bd02aecb2d --- /dev/null +++ b/5.0/ru/0x05-For-Users-Of-4.0.md @@ -0,0 +1,90 @@ +# Изменения по сравнению с v4.x + +## Введение + +Пользователям, знакомым со стандартом версии 4.x, может быть полезно ознакомиться с ключевыми изменениями, внесёнными в версию 5.0, включая обновления в содержании, области применения и основополагающей философии. + +Из 286 требований версии 4.0.3 только 11 остались без изменений, в то время как 15 претерпели незначительные грамматические правки, не повлиявшие на их смысл. В общей сложности 109 требований (38%) более не являются отдельными требованиями в версии 5.0 – 50 были просто удалены, 28 удалены как дубликаты и 31 объединено с другими требованиями. Остальные требования были так или иначе пересмотрены. Даже требования, не претерпевшие существенных изменений, имеют новые идентификаторы из-за переупорядочивания или реструктуризации. + +Для облегчения перехода на версию 5.0 предоставляются документы сопоставления, которые помогают пользователям отследить, как требования из версии 4.x соотносятся с требованиями в версии 5.0. Эти сопоставления не привязаны к версиям выпусков и могут при необходимости обновляться или уточняться. + +## Философия требований + +### Целевая область применения + +Версия 4.x включала требования, которые не соответствовали целевой области применения стандарта - они были удалены. Требования, которые не удовлетворяли критериям области применения для версии 5.0 или не поддавались верификации, также были исключены. + +### Акцент на целях безопасности, а не на механизмах + +В версии 4.x многие требования были сфокусированы на конкретных механизмах, а не на лежащих в их основе целях безопасности. В версии 5.0 требования сконцентрированы на целях безопасности, ссылаясь на конкретные механизмы только в тех случаях, когда они являются единственным практическим решением, или предоставляя их в качестве примеров или дополнительного руководства. + +Такой подход допускает разные методы достижения цели, избегая излишних предписаний, которые могли бы ограничить гибкость компаний. + +Кроме того, требования, касающиеся одной и той же проблемы безопасности, были объединены там, где это было необходимо. + +### Документированные решения по безопасности + +Хотя концепция документированных решений по безопасности может показаться новой в версии 5.0, она является развитием более ранних требований, связанных с применением политик и моделированием угроз в версии 4.0. Ранее некоторые требования неявно предполагали проведение анализа для обоснования реализации средств контроля безопасности, такого как определение разрешенных сетевых подключений. + +Чтобы обеспечить доступность необходимой информации для реализации и проверки, эти ожидания теперь явно определены как требования к документации, делая их понятными, практичными и проверяемыми. + +## Структурные изменения и новые главы + +Несколько глав в версии 5.0 представляют полностью новый контент: + +* OAuth и OIDC – Учитывая широкое распространение этих протоколов для делегирования доступа и единого входа, были добавлены специальные требования для решения разнообразных сценариев, с которыми могут столкнуться разработчики. Эта область может в конечном итоге развиться в самостоятельный стандарт, аналогично тому, как это произошло с требованиями для мобильных устройств и IoT в предыдущих версиях. +* WebRTC – Поскольку эта технология набирает популярность, ее уникальные проблемы и аспекты безопасности теперь рассматриваются в отдельном разделе. + +Также были приложены усилия, чтобы обеспечить организацию глав и разделов вокруг логичных наборов связанных требований. + +Эта реструктуризация привела к созданию дополнительных глав: + +* Автономные токены (Self-contained Tokens) – Ранее относящиеся к управлению сессиями, автономные токены теперь признаны самостоятельным механизмом и базовым элементом для взаимодействия без сохранения состояния (такого как в OAuth и OIDC). Ввиду их уникальных аспектов безопасности, они рассматриваются в отдельной главе с некоторыми новыми требованиями, введенными в версии 5.x. +* Безопасность веб-интерфейсов (Web Frontend Security) – В связи с растущей сложностью браузерных приложений и распространением API-ориентированных архитектур, требования к безопасности фронтенда были выделены в отдельную главу. +* Безопасная разработка и архитектура (Secure Coding and Architecture) – Новые требования, касающиеся общих практик безопасности, которые не вписывались в существующие главы, были сгруппированы здесь. + +Другие организационные изменения в версии 5.0 были внесены для уточнения целей. Например, требования к валидации входных данных были помещены рядом с бизнес-логикой, а не с кодировкой и обработкой, отражая их роль в обеспечении соблюдения бизнес-правил. + +Бывшая глава V1 «Архитектура, проектирование и моделирование угроз» была удалена. Ее начальный раздел содержал требования, которые выходили за рамки области проверки, в то время как последующие разделы были перераспределены в соответствующие главы, с удалением дубликатов и уточнениями по мере необходимости. + +## Удаление прямых соответствий с другими стандартами + +Прямые соответствия другим стандартам были удалены из основного тела стандарта. Цель состоит в подготовке соответствия с проектом OWASP Common Requirement Enumeration (CRE), который, в свою очередь, свяжет ASVS с рядом проектов OWASP и внешними стандартами. + +Прямые соответствия CWE и NIST более не поддерживаются, как поясняется ниже. + +### Снижение связи с NIST Digital Identity Guidelines + +Рекомендации NIST [Digital Identity Guidelines (SP 800-63)](https://pages.nist.gov/800-63-3/) долгое время служили ориентиром для средств контроля аутентификации и авторизации. В версии 4.x определенные главы были тесно связаны со структурой и терминологией NIST. + +Хотя эти рекомендации остаются важным ориентиром, строгое соответствие создавало проблемы, включая менее распространенную терминологию, дублирование схожих требований и неполные соответствия. Версия 5.0 отходит от этого подхода для повышения ясности и релевантности. + +### Отступление от Common Weakness Enumeration (CWE) + +[Common Weakness Enumeration (CWE)](https://cwe.mitre.org/) предоставляет полезную систематику уязвимостей программного обеспечения. Однако такие проблемы, как широкие классы CWЕ (category-only CWEs), трудности в сопоставлении требований с отдельным CWE, а также наличие неточных соответствий в версии 4.x, привели к решению отказаться от прямых сопоставлений с CWE в версии 5.0. + +## Переосмысление определений уровней + +Версия 4.x описывала уровни как L1 («Минимальный»), L2 («Стандартный») и L3 («Продвинутый»), с подразумеванием, что все приложения, обрабатывающие конфиденциальные данные, должны соответствовать как минимум L2. + +Версия 5.0 решает несколько проблем этого подхода, которые описаны в следующих параграфах. + +С практической точки зрения, в то время как версия 4.x использовала галочки для обозначения уровней, версия 5.x использует простое число во всех форматах стандарта, включая markdown, PDF, DOCX, CSV, JSON и XML. Для обратной совместимости также генерируются устаревшие версии выводов CSV, JSON и XML, которые все еще используют галочки. + +### Снижение порога входа + +Обратная связь показала, что большое количество требований Уровня 1 (~120) в сочетании с его обозначением как «минимального» уровня, которого недостаточно для большинства приложений, препятствовало внедрению. Цель версии 5.0 — уменьшить этот барьер за счет определения требований Уровня 1 как первого эшелона защиты, благодаря чему они становятся более четкими и их количество сокращается. Чтобы продемонстрировать это численно, в v4.0.3 было 128 требований L1 из общего числа в 278 требований, что составляет 46%. В 5.0.0 насчитывается 70 требований L1 из общего числа в 345 требований, что составляет 20%. + +### Иллюзия проверяемости + +Ключевым фактором при выборе средств контроля для Уровня 1 в версии 4.x была их пригодность для оценки с помощью внешнего тестирования на проникновение по методу «черного ящика». Однако этот подход не был полностью согласован с целью Уровня 1 как минимального набора средств обеспечения безопасности. Некоторые пользователи утверждали, что Уровня 1 недостаточно для защиты приложений, в то время как другие считали его слишком сложным для тестирования. + +Опора на проверяемость как на критерий является относительной и, в ряде случаев, вводящей в заблуждение. Тот факт, что требование является проверяемым, не гарантирует, что его можно проверить автоматизированным или простым способом. Более того, наиболее легко проверяемые требования не всегда являются теми, которые оказывают наибольшее влияние на безопасность или которые проще всего реализовать. + +Таким образом, в версии 5.0 решения об уровнях принимались в первую очередь с целью снижения рисков, а также с учетом необходимых усилий по реализации. + +### Не только оценка рисков + +Использование предписывающих уровней, основанных на оценке риска, которые устанавливают определенный уровень для определенных приложений, оказалось слишком жестким. На практике расстановка приоритетов и внедрение средств безопасности зависят от множества факторов, включая как снижение рисков, так и усилия, необходимые для реализации. + +Следовательно, организациям следует стремиться к достижению того уровня, который они считают необходимым, исходя из своей зрелости и ценностей, которые они хотят демонстрировать своим клиентам. diff --git a/5.0/ru/0x10-V1-Encoding-and-Sanitization.md b/5.0/ru/0x10-V1-Encoding-and-Sanitization.md new file mode 100644 index 0000000000..83d23a0ab8 --- /dev/null +++ b/5.0/ru/0x10-V1-Encoding-and-Sanitization.md @@ -0,0 +1,103 @@ +# V1 Кодировка и нейтрализация + +## Задачи контроля + +В этой главе рассматриваются наиболее распространенные уязвимости безопасности веб-приложений, связанные с небезопасной обработкой недоверенных (пользовательских) данных. Такие уязвимости могут привести к различным техническим уязвимостям, где такие данные интерпретируются в соответствии с правилами синтаксиса соответствующего интерпретатора. + +Для современных веб-приложений всегда лучше использовать более архитектурно безопасные API, такие как параметризованные запросы, автоматическое экранирование или шаблонные фреймворки. В ином случае, самостоятельное тщательное выполнение кодирования выходных данных, экранирование или нейтрализация становятся критически важными для безопасности приложения. + +Валидация входных данных служит механизмом многослойной/глубокоэшелонированной (defense‑in‑depth) защиты от неожидаемого или опасного контента. Однако, поскольку ее основная цель заключается в обеспечении соответствия входящих данных функциональным и бизнес-ожиданиям, требования, связанные с этим, можно найти в главе «Валидация и бизнес-логика». + +## V1.1 Архитектура кодировки и нейтрализации + +В разделах ниже приведены требования для синтаксиса или интерпретатора, предназначенные для безопасной обработки небезопасного содержимого и предотвращения уязвимостей безопасности. Требования в этом разделе охватывают порядок, в котором должна происходить эта обработка, и где она должна происходить. Они также направлены на то, чтобы гарантировать, что при каждом сохранении данных они остаются в своем исходном состоянии и не хранятся в закодированной или экранированной форме (например, кодировка HTML), чтобы предотвратить проблемы с двойным кодированием. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **1.1.1** | Убедитесь, что входные данные декодируются или деэкранируются в каноническую форму (в стандартное представление) только один раз. Декодирование происходит только тогда, когда ожидаются закодированные данные в этой форме, и что это делается перед дальнейшей обработкой входных данных, например, это не выполняется после проверки или нейтрализации. | 2 | +| **1.1.2** | Убедитесь, что приложение выполняет кодирование и экранирование выходных данных либо в качестве последнего шага перед использованием интерпретатором, для которого оно предназначено, либо самим интерпретатором. | 2 | + +## V1.2 Предотвращение инъекций + +Кодирование или экранирование выходных данных, выполняемое близко или смежно с потенциально опасным контекстом, критично для безопасности любого приложения. Обычно кодирование и экранирование выходных данных не сохраняется, а вместо этого используется для обеспечения безопасности выходных данных для немедленного использования в соответствующем интерпретаторе. Попытка выполнить это на более ранних этапах может привести к искажению содержимого или неэффективно отобразить кодирование или экранирование. + +Во многих случаях библиотеки программного обеспечения включают более или полностью безопасные функции, которые выполняют это автоматически, хотя необходимо убедиться, что они корректны для текущего контекста. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **1.2.1** | Убедитесь, что выходная кодировка для ответа HTTP, документа HTML или документа XML соответствует требуемому контексту, например, кодировка соответствующих символов для элементов HTML, атрибутов HTML, комментариев HTML, CSS или полей заголовка HTTP делается таким способом, чтобы избежать изменения структуры сообщения или документа. | 1 | +| **1.2.2** | Убедитесь, что при динамическом построении URL-адресов недоверенные данные кодируются в соответствии с их контекстом (например, кодирование URL-адресов или кодирование base64url для query или path параметров или пути). Убедитесь, что разрешены только безопасные протоколы URL-адресов (например, запрещен javascript: или data:). | 1 | +| **1.2.3** | Убедитесь, что при динамическом построении содержимого JavaScript (включая JSON) используется кодирование или экранирование выходных данных, чтобы избежать изменения структуры сообщения или документа (чтобы избежать JavaScript и JSON-инъекций). | 1 | +| **1.2.4** | Убедитесь, что выборка данных (Redis, Memcached, чтение из файлов, обращение по API) или запросы к базе данных (например, SQL, HQL, NoSQL, Cypher) используют параметризованные запросы, ORM, Entity Frameworks или иным образом защищены от SQL-инъекций и других атак. Это также актуально при написании хранимых процедур. | 1 | +| **1.2.5** | Убедитесь, что приложение защищено от внедрения команд ОС и что вызовы операционной системы используют параметризованные запросы к ОС или используют контекстное кодирование вывода командной строки. | 1 | +| **1.2.6** | Убедитесь, что приложение защищено от LDAP-инъекций, или что реализованы специальные меры безопасности для их предотвращения. | 2 | +| **1.2.7** | Убедитесь, что приложение защищено от атак с использованием XPath-инъекций с помощью параметризации запросов или предварительно скомпилированных запросов. | 2 | +| **1.2.8** | Убедитесь, что процессоры LaTeX настроены безопасно (например, не используется флаг «–shell‑escape») и используется разрешенный список команд для предотвращения LaTeX-инъекций. | 2 | +| **1.2.9** | Убедитесь, что приложение экранирует специальные символы в регулярных выражениях (обычно с помощью обратной косой черты), чтобы предотвратить их ошибочную интерпретацию как метасимволов. | 2 | +| **1.2.10** | Убедитесь, что приложение защищено от внедрения формул CSV (CSV Injection). Приложение должно следовать правилам экранирования, определенным в RFC 4180, разделы 2.6 и 2.7, при экспорте содержимого CSV. Кроме того, при экспорте в CSV или другие форматы электронных таблиц (такие как XLS, XLSX или ODF) специальные символы (включая '=', '+', '-', '@', '\t' (табуляция), и '\0' (нулевой символ)) должны экранироваться одинарной кавычкой, если они появляются в качестве первого символа в значении поля. | 3 | + +Примечание: Использование параметризованных запросов или экранирование SQL не всегда достаточно. Части запроса, такие как имена таблиц и столбцов (включая имена столбцов «ORDER BY»), не могут быть экранированы. Включение экранированных пользовательских данных в эти поля приводит к сбоям запросов или SQL-инъекции. + +## V1.3 Нейтрализация + +Идеальной защитой от использования недоверенных данных в небезопасном контексте является использование контекстно-зависимого кодирования или экранирования, которое сохраняет то же семантическое значение небезопасного контента, но делает его безопасным для использования в этом конкретном контексте, как обсуждалось более подробно в предыдущем разделе. + +Если это невозможно, необходима нейтрализация, удаляющая потенциально опасные символы или данные. В некоторых случаях это может изменить семантическое значение ввода, но по соображениям безопасности альтернативы может не быть. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **1.3.1** | Убедитесь, что все ненадежные входные данные HTML из редакторов WYSIWYG или аналогичных программ нейтрализуются с помощью известных и безопасных библиотек или функций фреймворка для санитизации HTML. | 1 | +| **1.3.2** | Убедитесь, что приложение избегает использования eval() или других динамических функций выполнения кода, таких как Spring Expression Language (SpEL). Если нет альтернативы, любой пользовательский ввод должен быть нейтрализован перед выполнением. | 1 | +| **1.3.3** | Убедитесь, что данные, передаваемые в потенциально опасный контекст, предварительно нейтрализованы, чтобы обеспечить соблюдение мер безопасности, таких как разрешение только тех символов, которые безопасны для данного контекста, и обрезка слишком длинного ввода. | 2 | +| **1.3.4** | Убедитесь, что предоставленный пользователем файл .SVG проверен или нейтрализован, чтобы он содержал только теги и атрибуты (например, относящиеся к рисованию), которые безопасны для приложения, например, не содержат скриптов и foreignObject. | 2 | +| **1.3.5** | Убедитесь, что приложение нейтралует или отключает предоставленные пользователем скриптовые данные или выражения шаблонных языков, такие как таблицы стилей Markdown, CSS или XSL, BBCode или аналогичные. | 2 | +| **1.3.6** | Убедитесь, что приложение защищено от атак с подделкой запросов на стороне сервера (SSRF), проверяя ненадежные данные по разрешенному списку протоколов, доменов, путей и портов, а также нейтрализуя потенциально опасные символы перед использованием данных для вызова другой службы. | 2 | +| **1.3.7** | Убедитесь, что приложение защищено от атак с внедрением шаблонов (template injection), не позволяя создавать шаблоны на основе недоверенных входных данных. Если нет альтернативы, любые недоверенные входные данные, включаемые динамически во время создания шаблона, должны быть нейтрализованы или тщательно провалидированы. | 2 | +| **1.3.8** | Убедитесь, что приложение надлежащим образом нейтрализует недоверенные входные данные перед использованием в запросах Java Naming and Directory Interface (JNDI) и что JNDI настроен безопасно для предотвращения атак с использованием JNDI-инъекций. | 2 | +| **1.3.9** | Убедитесь, что приложение нейтрализует данные перед отправкой в Memcache, чтобы предотвратить атаки методом инъекций. | 2 | +| **1.3.10** | Убедитесь, что строки форматирования, которые могут быть использованы неожидаемым или вредоносным образом, нейтрализуются перед дальнейшим использованием. | 2 | +| **1.3.11** | Убедитесь, что приложение нейтрализует вводимые пользователем данные перед передачей в почтовые системы для защиты от SMTP или IMAP-инъекций. | 2 | +| **1.3.12** | Убедитесь, что регулярные выражения не содержат элементов, вызывающих экспоненциальный возврат, и убедитесь в нейтрализации недоверенных входных данных для предотвращения атак ReDoS или Runaway Regex. | 3 | + +## V1.4 Память, строки и неуправляемый код + +Следующие требования касаются рисков, связанных с небезопасным использованием памяти, которые обычно применяются, когда приложение использует системный язык или неуправляемый код. + +В некоторых случаях этого можно добиться, установив флаги компилятора, которые включают защиту от переполнения буфера и предупреждения, включая рандомизацию стека и предотвращение выполнения данных, и которые прерывают сборку, если обнаружены небезопасные операции с указателем, памятью, строкой формата, целым числом или строкой. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **1.4.1** | Убедитесь, что для обнаружения или предотвращения ситуаций переполнения стека, буфера или кучи приложение учитывает размер доступной области памяти при строковых операциях, копировании в память, в арифметике указателей и т.п. | 2 | +| **1.4.2** | Убедитесь, что для предотвращения целочисленного переполнения применяется контроль знака, диапазона и типа допустимых входных данных. | 2 | +| **1.4.3** | Убедитесь, что динамически выделенная память и ресурсы освобождены, а ссылки или указатели на освобожденную память удалены или установлены в значение null, чтобы предотвратить появление висячих указателей и уязвимостей, связанных с использованием памяти после освобождения. | 2 | + +## V1.5 Безопасная десериализация + +Преобразование данных из сохраненного или переданного представления в фактические объекты приложения (десериализация) исторически было причиной различных уязвимостей внедрения кода. Важно выполнять этот процесс осторожно и безопасно, чтобы избежать подобных проблем. + +В частности, некоторые методы десериализации были определены в документации по языку программирования или фреймворку как небезопасные и не могут безопасно применяться с недоверенными данными. Для каждого используемого механизма следует проводить тщательную проверку. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **1.5.1** | Убедитесь, что приложение настраивает XML-парсеры на использование строгой конфигурации и что небезопасные функции, такие как разрешение внешних сущностей, отключены для предотвращения атак XML eXternal Entity (XXE). | 1 | +| **1.5.2** | Убедитесь, что десериализация недоверенных данных обеспечивает безопасную обработку ввода, например, используя список разрешенных типов объектов или ограничивая типы объектов, определяемые клиентом, для предотвращения атак десериализации. Механизмы десериализации, которые явно определены как небезопасные, не должны использоваться с недоверенным вводом. | 2 | +| **1.5.3** | Убедитесь, что различные парсеры, используемые в приложении для одного и того же типа данных (например, парсеры JSON, XML, URL), выполняют парсинг согласованным образом и используют один и тот же механизм кодирования символов, чтобы избежать таких проблем, как уязвимости взаимодействия JSON (JSON Interoperability) или различное поведение анализа URI или файлов, которые могут использоваться в атаках удаленного включения файлов (RFI) или подделки запросов на стороне сервера (SSRF). | 3 | + +## Ссылки + +Для дополнительной информации см. также: + +* [OWASP LDAP Injection Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html) +* [OWASP Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) +* [OWASP DOM Based Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html) +* [OWASP XML External Entity Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html) +* [OWASP Web Security Testing Guide: Client-Side Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/11-Client-side_Testing) +* [OWASP Java Encoding Project](https://owasp.org/owasp-java-encoder/) +* [DOMPurify - Client-side HTML Sanitization Library](https://github.com/cure53/DOMPurify) +* [RFC4180 - Common Format and MIME Type for Comma-Separated Values (CSV) Files](https://datatracker.ietf.org/doc/html/rfc4180#section-2) + +Для более подробной информации о проблемах сериализации и парсинга см. также: + +* [OWASP Deserialization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) +* [An Exploration of JSON Interoperability Vulnerabilities](https://bishopfox.com/blog/json-interoperability-vulnerabilities) +* [Orange Tsai - A New Era of SSRF Exploiting URL Parser In Trending Programming Languages](https://www.blackhat.com/docs/us-17/thursday/us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf) diff --git a/5.0/ru/0x11-V2-Validation-and-Business-Logic.md b/5.0/ru/0x11-V2-Validation-and-Business-Logic.md new file mode 100644 index 0000000000..2a2e4d18ed --- /dev/null +++ b/5.0/ru/0x11-V2-Validation-and-Business-Logic.md @@ -0,0 +1,73 @@ +# V2 Валидация и бизнес-логика + +## Задачи контроля + +Цель этой главы — убедиться, что проверенное приложение соответствует следующим высокоуровневым целям: + +* Входные данные, полученные приложением, соответствуют бизнес- или функциональным ожиданиям. +* Поток бизнес-логики последователен, выполняется по порядку и не может быть обойден. +* Бизнес-логика содержит ограничения и механизмы для обнаружения и предотвращения автоматизированных атак, таких как постоянные небольшие переводы средств или добавление миллиона друзей по одному за раз. +* Критически важные потоки бизнес-логики учитывают случаи злоупотреблений и действий злоумышленников и имеют защиту от подмены, подделки, раскрытия информации и атак с повышением привилегий. + +## V2.1 Документация валидации и бизнес-логики + +Документация по валидации и бизнес-логике должна четко определять ограничения бизнес-логики, правила валидации и контекстную согласованность объединенных данных, чтобы было понятно, что необходимо реализовать в приложении. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **2.1.1** | Убедитесь, что в документации приложения определены правила проверки входных данных на соответствие ожидаемой структуре. Это могут быть распространённые форматы данных, такие как номера кредитных карт, адреса электронной почты, номера телефонов, или внутренний формат данных. | 1 | +| **2.1.2** | Убедитесь, что в документации приложения указано, как проверять логическую и контекстную согласованность объединенных данных, например, проверять соответствие района и почтового индекса. | 2 | +| **2.1.3** | Убедитесь, что ожидания относительно ограничений и проверок бизнес-логики задокументированы как для уровня отдельного пользователя, так и для глобального уровня всего приложения. | 2 | + +## V2.2 Валидация ввода + +Эффективные средства контроля валидации входных данных обеспечивают соответствие бизнес- или функциональных ожиданий приложения относительно типа данных. Такой контроль валидации обеспечивает высокое качество данных и уменьшает поверхность атаки. Однако такой контроль не устраняет и не заменяет необходимость использования корректного кодирования, параметризации или санитизации данных при использовании данных в другом компоненте или для их представления для вывода. + +В данном контексте «входные данные» могут поступать из самых разных источников, включая поля HTML-форм, запросы REST, параметры URL, поля заголовков HTTP, файлы cookie, файлы на диске, базы данных и внешние API. + +Механизм бизнес-логики может проверять, что конкретное входное значение представляет собой число меньше 100. Функционал будет проверять и ожидать, что число ниже определенного порогового значения, поскольку это число определяет количество повторений конкретного цикла, а большое значение может привести к чрезмерной нагрузке и потенциальному отказу в обслуживании. + +Хотя валидация по схеме явно не предписана, она может быть наиболее эффективным механизмом для полного охвата валидацией HTTP API или других интерфейсов, использующих JSON или XML. + +Обратите внимание на следующие моменты при валидации по схеме: + +* «Опубликованная версия» спецификации валидации по JSON-схеме считается готовой к использованию, но, грубо говоря, «нестабильной». При использовании валидации по JSON-схеме убедитесь в отсутствии расхождений с приведенными ниже требованиями. +* Любые используемые библиотеки валидации по JSON-схеме также следует отслеживать и при необходимости обновлять после формализации стандарта. +* Валидацию DTD не следует использовать, а оценку DTD фреймворка следует отключить, чтобы избежать проблем с атаками XXE на DTD. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **2.2.1** | Убедитесь, что входные данные провалидированы для обеспечения соответствия бизнес- или функциональным ожиданиям. Валидация должна осуществляться либо по списку допустимых значений, шаблонов и диапазонов, либо путем сравнения входных данных с ожидаемой структурой и логическими ограничениями в соответствии с предопределенными правилами. Для L1 валидация может быть сосредоточена на входных данных, используемых для принятия конкретных бизнес-решений или решений, связанных с безопасностью. Для L2 и выше это должно применяться ко всем входным данным. | 1 | +| **2.2.2** | Убедитесь, что приложение разработано с принудительной валидацией входных данных на уровне доверенного сервиса. Хотя проверка на стороне клиента повышает удобство использования и должна поощряться, на неё не следует полагаться как на средство контроля безопасности. | 1 | +| **2.2.3** | Убедитесь, что приложение обеспечивает обоснованность комбинаций данных в соответствии с предопределенными правилам. Например: возраст должен соответствовать дате рождения; страна и почтовый индекс; количество товара в заказе и на складе. | 2 | + +## V2.3 Безопасность бизнес-логики + +В этом разделе рассматриваются ключевые требования, гарантирующие, что приложение обеспечит корректное выполнение процессов бизнес-логики и не будет уязвимо для атак, использующих логику и поток работы приложения. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **2.3.1** | Убедитесь, что приложение обрабатывает потоки бизнес-логики для одного и того же пользователя в ожидаемом последовательном порядке шагов и без пропуска шагов. | 1 | +| **2.3.2** | Убедитесь, что ограничения бизнес-логики реализованы в соответствии с документацией приложения, чтобы избежать эксплуатации её недостатков. | 2 | +| **2.3.3** | Убедитесь, что транзакции используются на уровне бизнес-логики таким образом, что операция бизнес-логики либо выполняется полностью, либо откатывается к предыдущему корректному состоянию. | 2 | +| **2.3.4** | Убедитесь, что на уровне бизнес-логики используются механизмы блокировки, чтобы гарантировать невозможность двойного бронирования ограниченных по количеству ресурсов (например, мест в театре или слотов доставки) путем манипулирования логикой приложения. | 2 | +| **2.3.5** | Убедитесь, что для важных потоков бизнес-логики требуется многопользовательское (multi-user) одобрение, чтобы предотвратить несанкционированные или случайные действия. Потоки бизнес-логики могут включать, помимо прочего, крупные денежные переводы, утверждение контрактов, доступ к секретной информации или обход ограничений безопасности на производстве. | 3 | + +## V2.4 Анти-автоматизация + +В этом разделе представлены меры по борьбе с автоматизацией, гарантирующие необходимость взаимодействия, аналогичного человеческому, и предотвращают чрезмерные автоматизированные запросы. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **2.4.1** | Убедитесь, что используются средства противодействия автоматизации для защиты от чрезмерных вызовов функций приложения, которые могут привести к утечке данных, созданию ненужных данных, исчерпанию квот, нарушению ограничений скорости, отказу в обслуживании или чрезмерному использованию дорогостоящих ресурсов. | 2 | +| **2.4.2** | Убедитесь, что потоки бизнес-логики требуют реалистичного человеческого времени, предотвращая чрезмерно быструю отправку транзакций. | 3 | + +## Ссылки + +Для дополнительной информации см. также: + +* [OWASP Web Security Testing Guide: Input Validation Testing](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/README.html) +* [OWASP Web Security Testing Guide: Business Logic Testing](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/10-Business_Logic_Testing/README) +* Анти-автоматизация может быть достигнута разными путями, включая применение [OWASP Automated Threats to Web Applications](https://owasp.org/www-project-automated-threats-to-web-applications/) +* [OWASP Input Validation Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html) +* [JSON Schema](https://json-schema.org/specification.html) diff --git a/5.0/ru/0x12-V3-Web-Frontend-Security.md b/5.0/ru/0x12-V3-Web-Frontend-Security.md new file mode 100644 index 0000000000..0215d4a612 --- /dev/null +++ b/5.0/ru/0x12-V3-Web-Frontend-Security.md @@ -0,0 +1,100 @@ +# V3 Безопасность веб-интерфейса + +## Задачи контроля + +Эта категория фокусируется на требованиях, направленных на защиту от атак, воспроизводимых через веб-интерфейс. Эти требования не применяются к решениям «машина-машина». + +## V3.1 Документация по безопасности веб-интерфейса + +В этом разделе описываются функции безопасности браузера, которые должны быть описаны в документации приложения. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **3.1.1** | Убедитесь, что в документации приложения описаны ожидаемые функции безопасности, которые должны поддерживать браузеры, использующие приложение (такие как HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) и другие соответствующие механизмы безопасности HTTP). В документации также должно быть обязательно определено, как приложение должно себя вести, если некоторые из этих функций недоступны (например, предупреждать пользователя или блокировать доступ). | 3 | + +## V3.2 Непреднамеренная интерпретация контента + +Отображение контента или функциональности в неправильном контексте может привести к выполнению или отображению вредоносного контента. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **3.2.1** | Убедитесь, что реализованы меры безопасности, предотвращающие отображение контента или функций браузерами в HTTP-ответах в некорректном контексте (например, запрос API, загруженный пользователем файл или другой ресурс запрашивается напрямую). Возможные способы контроля включают: не обрабатывать содержимое, если поля заголовка HTTP-запроса (например, Sec-Fetch-*) не указывают на корректность контекста; использование заголовка и значения Content-Security-Policy: sandbox directive; или использование заголовка и значения Content-Disposition: attachment. | 1 | +| **3.2.2** | Убедитесь, что данные, предназначенные для отображения в виде текста, а не визуализации в виде HTML, обрабатывается с использованием безопасных функций визуализации (таких как createTextNode или textContent), чтобы предотвратить непреднамеренное выполнение содержимого, такого как HTML или JavaScript. | 1 | +| **3.2.3** | Убедитесь, что приложение избегает затирания DOM при использовании JavaScript на стороне клиента, применяя явные объявления переменных, выполняя строгую проверку типов, избегая сохранения глобальных переменных в объекте документа и реализуя изоляцию пространства имен. | 3 | + +## V3.3 Настройка файлов cookie + +В этом разделе изложены требования к безопасной настройке чувствительных cookie, позволяющие обеспечить более высокий уровень уверенности в том, что они были созданы самим приложением, а также предотвратить утечку или ненадлежащее изменение их содержимого. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **3.3.1** | Убедитесь, что у файлов cookie установлен атрибут «Secure», и если префикс «__Host‑» не используется в названии cookie, необходимо использовать префикс «__Secure‑». | 1 | +| **3.3.2** | Убедитесь, что значение атрибута SameSite каждой cookie установлено в соответствии с назначением cookie, чтобы ограничить подверженность атакам на восстановление пользовательского интерфейса и атакам с подделкой запросов на уровне браузера, обычно называемым подделкой межсайтовых запросов (CSRF). | 2 | +| **3.3.3** | Убедитесь, что cookie имеют префикс «__Host‑» в названии, если только они явно не предназначены для совместного использования с другими хостами. | 2 | +| **3.3.4** | Убедитесь, что если значение cookie не должно быть доступно для клиентских скриптов (например, сессионный токен), для cookie должен быть установлен атрибут «HttpOnly», а само значение должно передаваться клиенту только через поле заголовка «Set-Cookie». | 2 | +| **3.3.5** | Убедитесь, что при записи cookie приложением общая длина имени и значения cookie не превышает 4096 байт. Слишком большие cookie не будут сохраняться браузером и, следовательно, не будут отправляться с запросами, что помешает пользователю использовать функции приложения, зависящие от этого cookie. | 3 | + +## V3.4 Заголовки механизма безопасности браузера + +В этом разделе описывается, какие заголовки безопасности следует устанавливать в HTTP-ответах, чтобы включить функции безопасности браузера и ограничения при обработке ответов от приложения. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **3.4.1** | Убедитесь, что поле заголовка Strict‑Transport‑Security включено во все ответы для реализации политики HTTP Strict Transport Security (HSTS). Необходимо указать максимальное время не менее 1 года, а для L2 и выше политика должна применяться также ко всем поддоменам. | 1 | +| **3.4.2** | Убедитесь, что поле заголовка Cross‑Origin Resource Sharing (CORS) «Access‑Control‑Allow‑Origin» имеет фиксированное значение, заданное приложением, или, если используется заголовок Origin, оно проверяется по списку доверенных источников. При необходимости использования «Access‑Control‑Allow‑Origin: *» убедитесь, что ответ не содержит конфиденциальной информации. | 1 | +| **3.4.3** | Убедитесь, что HTTP-ответы содержат поле заголовка Content-Security-Policy, которое определяет директивы, гарантирующие загрузку и выполнение браузером только доверенного контента или ресурсов, чтобы ограничить выполнение вредоносного JavaScript. Как минимум, необходимо использовать глобальную политику, включающую директивы object-src «none» и base-uri «none», а также определяющую список разрешенных адресов или использующую одноразовые коды или хэши. Для приложений L3 необходимо определить политику использования 'nonce' или hash-конструкций для каждого ответа. | 2 | +| **3.4.4** | Убедитесь, что все HTTP-ответы содержат поле заголовка «X‑Content‑Type‑Options: nosniff». Это предписывает браузерам не использовать анализ контента и определение типа MIME для данного ответа, а также требовать, чтобы значение поля заголовка Content‑Type в ответе соответствовало целевому ресурсу. Например, ответ на запрос стиля принимается только в том случае, если Content‑Type в ответе — «text/css». Это также позволяет браузеру использовать функцию Cross‑Origin Read Blocking (CORB). | 2 | +| **3.4.5** | Убедитесь, что приложение устанавливает политику реферера для предотвращения утечки технически конфиденциальных данных сторонним сервисам через поле заголовка HTTP-запроса «Referer». Это можно сделать с помощью поля заголовка HTTP-ответа «Referrer‑Policy» или через атрибуты HTML-элемента. Конфиденциальные данные могут включать путь и данные запроса в URL-адресе, а для внутренних непубличных приложений также имя хоста. | 2 | +| **3.4.6** | Убедитесь, что веб-приложение использует директиву frame‑ancestors поля заголовка Content‑Security‑Policy для каждого HTTP-ответа, чтобы гарантировать невозможность его внедрения по умолчанию и внедрение определённых ресурсов разрешено только при необходимости. Обратите внимание, что поле заголовка X‑Frame‑Options, хотя и поддерживается браузерами, устарело и не может быть использовано в качестве основы. | 2 | +| **3.4.7** | Убедитесь, что в поле заголовка Content‑Security‑Policy указано место, куда следует сообщать о нарушениях. | 3 | +| **3.4.8** | Убедитесь, что все HTTP-ответы, инициирующие рендеринг документа (например, ответы с типом содержимого text/html), включают поле заголовка Cross-Origin-Opener-Policy с директивой same-origin или same-origin-allow-popups (при необходимости). Это предотвращает атаки, злоупотребляющие общим доступом к объектам Window, такие как Tabnabbing и Frame Counting. | 3 | + +## V3.5 Браузерное разделение источников + +Принимая запрос к чувствительному функционалу на стороне сервера, приложение должно убедиться, что запрос инициирован самим приложением или доверенной стороной и не был подделан злоумышленником. + +К чувствительному функционалу в данном контексте могут относиться принятие форм POST для аутентифицированных и неаутентифицированных пользователей (например, запрос аутентификации), операции по изменению состояния или ресурсоемкие функции (например, экспорт данных). + +Ключевыми средствами защиты здесь являются политики безопасности браузера, такие как Same Origin Policy для JavaScript и логика SameSite для cookie. Другим распространённым средством защиты является механизм предварительной проверки CORS. Этот механизм критически важен для конечных точек, спроектированных и предназначенных, чтобы вызываться из другого источника, но он также может быть полезным механизмом предотвращения подделки запросов для конечных точек, которые не предназначены для вызова из другого источника. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **3.5.1** | Убедитесь, что, если приложение не использует механизм предварительной проверки CORS для предотвращения запрещённых кросс-доменных запросов на использование чувствительного функционала, эти запросы валидируются на предмет их происхождения от самого приложения. Это можно сделать, используя и проверяя специальные токены для защиты от подделки или требуя дополнительные поля HTTP-заголовка, не входящие в список «простых заголовков» (CORS-safelisted request-header). Это необходимо для защиты от атак с подделкой запросов через браузер, широко известных как межсайтовая подделка запросов (CSRF). | 1 | +| **3.5.2** | Убедитесь, что если приложение использует механизм предварительной проверки CORS для предотвращения неразрешённого использования чувствительного функционала между источниками, вызов этого функционала невозможен с помощью запроса, который не запускает предварительную проверку CORS. Для этого может потребоваться проверка значений полей заголовка запроса «Origin» и «Content-Type» или использование дополнительного поля заголовка, не входящего в безопасный список CORS. | 1 | +| **3.5.3** | Убедитесь, что HTTP-запросы к чувствительному функционалу используют соответствующие HTTP-методы, такие как POST, PUT, PATCH или DELETE, а не методы, определённые спецификацией HTTP как «безопасные», такие как HEAD, OPTIONS или GET. В качестве альтернативы можно использовать строгую валидацию полей заголовка запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, навигационного запроса или загрузки ресурса (например, источника изображения), где это не ожидается. | 1 | +| **3.5.4** | Убедитесь, что отдельные приложения размещены на разных именах хостов, чтобы использовать ограничения, предусмотренные политикой same-origin, включая то, как документы или скрипты, загруженные одним источником, могут взаимодействовать с ресурсами из другого источника, а также ограничения на cookie на основе имени хоста. | 2 | +| **3.5.5** | Убедитесь, что сообщения, полученные интерфейсом postMessage, отвергаются, если источник сообщения не является доверенным или если синтаксис сообщения недействителен. | 2 | +| **3.5.6** | Убедитесь, что функциональность JSONP не включена нигде в приложении, чтобы избежать атак с использованием межсайтового включения скриптов (XSSI). | 3 | +| **3.5.7** | Убедитесь, что данные, требующие авторизации, не включены в ответы ресурсов скриптов, таких как файлы JavaScript, чтобы предотвратить атаки с использованием межсайтового включения скриптов (XSSI). | 3 | +| **3.5.8** | Убедитесь, что аутентифицированные ресурсы (такие как изображения, видео, скрипты и другие документы) могут быть загружены или внедрены от имени пользователя только по назначению. Этого можно добиться путём строгой валидации полей заголовка HTTP-запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, или путём установки ограничительного поля заголовка HTTP-ответа Cross‑Origin‑Resource‑Policy, чтобы браузер блокировал возвращаемый контент. | 3 | + +## V3.6 Целостность внешних ресурсов + +В этом разделе приведены рекомендации по безопасному размещению контента на сторонних сайтах. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **3.6.1** | Убедитесь, что клиентские ресурсы, такие как библиотеки JavaScript, CSS или веб-шрифты, размещаются только на внешнем сервере (например, в сети доставки контента (Content Delivery Network)), если ресурс статический и имеет версии, а для проверки целостности ресурса используется механизм проверки целостности подресурсов (SRI). Если это невозможно, для каждого ресурса должно быть задокументировано решение по безопасности, обосновывающее это. | 3 | + +## V3.7 Другие соображения по безопасности браузера + +В этом разделе рассматриваются различные другие элементы управления безопасностью и современные функции безопасности браузера, необходимые для обеспечения безопасности браузера на стороне клиента. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **3.7.1** | Убедитесь, что приложение использует только те клиентские технологии, которые по-прежнему поддерживаются и считаются безопасными. Примерами технологий, не соответствующих этому требованию, являются плагины NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL или клиентские Java-апплеты. | 2 | +| **3.7.2** | Убедитесь, что приложение будет автоматически перенаправлять пользователя на другое имя хоста или домен (который не контролируется приложением), только если этот хост или домен указаны в списке разрешенных. | 2 | +| **3.7.3** | Убедитесь, что приложение отображает уведомление, что пользователь перенаправляется на URL-адрес, находящийся вне контроля приложения, с возможностью отмены навигации. | 3 | +| **3.7.4** | Убедитесь, что домен верхнего уровня приложения (например, site.tld) ​​добавлен в публичный список предварительной загрузки (preload list) для HTTP Strict Transport Security (HSTS). Это гарантирует, что использование TLS для приложения будет встроено непосредственно в основные браузеры, а не будет полагаться только на поле заголовка ответа Strict-Transport-Security. | 3 | +| **3.7.5** | Убедитесь, что приложение ведет себя так, как описано в документации (например, предупреждает пользователя или блокирует доступ), если браузер, используемый для доступа к приложению, не поддерживает ожидаемые функции безопасности. | 3 | + +## Ссылки + +Для дополнительной информации см. также: + +* [Set-Cookie __Host- prefix details](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#cookie_prefixes) +* [OWASP Content Security Policy Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html) +* [OWASP Secure Headers Project](https://owasp.org/www-project-secure-headers/) +* [OWASP Cross-Site Request Forgery Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html) +* [HSTS Browser Preload List submission form](https://hstspreload.org/) +* [OWASP DOM Clobbering Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/DOM_Clobbering_Prevention_Cheat_Sheet.html) diff --git a/5.0/ru/0x13-V4-API-and-Web-Service.md b/5.0/ru/0x13-V4-API-and-Web-Service.md new file mode 100644 index 0000000000..ca15f7df32 --- /dev/null +++ b/5.0/ru/0x13-V4-API-and-Web-Service.md @@ -0,0 +1,64 @@ +# V4 API и Веб-сервис + +## Задачи контроля + +Существует несколько моментов, применимых только к приложениям, предоставляющим API для использования веб-браузерами или другими клиентами (обычно с использованием JSON, XML или GraphQL). В этой главе рассматриваются соответствующие настройки и механизмы безопасности, которые следует применять. + +Обратите внимание, что вопросы аутентификации, управления сессиями и проверки входных данных, рассмотренные в других главах, также относятся к API. Поэтому эту главу нельзя рассматривать изолированно или тестировать отдельно. + +## V4.1 Общая безопасность веб-сервисов + +В этом разделе рассматриваются общие вопросы безопасности веб-сервисов и базовые практики гигиены веб-сервисов. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **4.1.1** | Убедитесь, что каждый HTTP-ответ с телом сообщения содержит заголовок Content-Type, который соответствует фактическому содержимому ответа, таким как «text/», «/+xml» и «/xml», включая параметр charset для указания безопасной кодировки символов (например, UTF-8, ISO-8859-1) согласно IANA Media Types. | 1 | +| **4.1.2** | Убедитесь, что только конечные точки, предназначенные для взаимодействия с пользователем через веб-браузер, автоматически перенаправляют HTTP на HTTPS, в то время как другие сервисы или конечные точки не реализуют прозрачные редиректы. Это необходимо, чтобы избежать ситуации, когда клиент ошибочно отправляет незашифрованные HTTP-запросы а из-за того, что запрос по HTTP автоматически перенаправляется на HTTPS другим сервисом без обработки на входе, утечка чувствительных данных остаётся незамеченной. | 2 | +| **4.1.3** | Убедитесь, что любой HTTP-заголовок, используемый приложением и устанавливаемый промежуточным уровнем, таким как балансировщик нагрузки, веб-прокси или backend-for-frontend сервис, не может быть переопределён конечным пользователем. Примеры заголовков: X-Real-IP, X-Forwarded-*, X-User-ID. | 2 | +| **4.1.4** | Убедитесь, что разрешены только HTTP-методы, которые явно поддерживаются приложением или его API (включая OPTIONS для preflight-запросов), а неиспользуемые методы заблокированы. | 3 | +| **4.1.5** | Убедитесь, что для особо чувствительных запросов или транзакций, проходящих через несколько систем, используются цифровые подписи на уровне сообщений, дополнительно к транспортным средствам защиты. | 3 | + +## V4.2 Валидация структуры HTTP-сообщений + +Этот раздел объясняет, как должна проверяться структура и заголовки HTTP-сообщений, чтобы предотвратить атаки типа request smuggling, response splitting, header injection и отказ в обслуживании из-за слишком длинных HTTP-сообщений. + +Эти требования актуальны для обработки и генерации HTTP-сообщений в целом, но особенно важны при конвертации сообщений между разными версиями HTTP. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **4.2.1** | Убедитесь, что все компоненты приложения (включая балансировщики нагрузки, файрволы и серверы приложений) определяют границы входящих HTTP-сообщений с использованием механизма, соответствующего версии HTTP, чтобы предотвратить HTTP request smuggling. В HTTP/1.x, если присутствует заголовок Transfer-Encoding, заголовок Content-Length должен игнорироваться согласно RFC 2616. При использовании HTTP/2 или HTTP/3, если присутствует Content-Length, веб-сервер должен убедиться, что он совпадает с длиной DATA-фреймов. | 2 | +| **4.2.2** | Убедитесь, что при генерации HTTP-сообщений заголовок Content-Length не конфликтует с длиной содержимого, определяемой рамками протокола HTTP, чтобы предотвратить HTTP Request Smuggling. | 3 | +| **4.2.3** | Убедитесь, что приложение не отправляет и не принимает HTTP/2 и HTTP/3 сообщения с заголовками, специфичными для соединения, такими как Transfer-Encoding, чтобы предотвратить HTTP Response Splitting и HTTP Header Injection. | 3 | +| **4.2.4** | Убедитесь, что приложение принимает HTTP/2 и HTTP/3 запросы только в случае, если поля заголовков и их значения не содержат последовательностей CR (\r), LF (\n) или CRLF (\r\n), чтобы предотвратить HTTP Header Injection. | 3 | +| **4.2.5** | Убедитесь, что если приложение (бекенд или фронтенд) формирует и отправляет запросы, оно использует валидацию, очистку или другие механизмы, чтобы не создавать URI (например, для API-вызовов) или HTTP-заголовки (например, Authorization или Cookie) слишком большой длины, чтобы их не принимал приёмник. Это может привести к отказу в обслуживании, например, при отправке слишком длинного запроса (длинный cookie-заголовок), из-за чего сервер постоянно возвращает ошибку. | 3 | + +## V4.3 GraphQL + +GraphQL становится всё более популярным способом создания клиентов с большим объёмом данных, которые не жёстко связаны с разными бэкенд-сервисами. В этом разделе рассмотрены вопросы безопасности для GraphQL. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **4.3.1** | Убедитесь, что используется белый список запросов, ограничение глубины вложенности, ограничение количества или анализ стоимости запроса, чтобы предотвратить DoS-атаки на уровне GraphQL или слоя данных из-за дорогостоящих вложенных запросов. | 2 | +| **4.3.2** | Убедитесь, что introspection-запросы GraphQL отключены в продакшен-среде, если GraphQL API не предназначен для использования сторонними клиентами. | 2 | + +## V4.4 WebSocket + +WebSocket — это протокол связи, обеспечивающий двунаправленную одновременную коммуникацию по одному TCP-соединению. Он был стандартизирован IETF в RFC 6455 в 2011 году и отличается от HTTP, хотя и работает поверх портов HTTP 443 и 80. + +В этом разделе приведены основные требования по безопасности, чтобы предотвратить атаки, связанные с безопасностью коммуникаций и управлением сессиями, которые эксплуатируют этот канал реального времени. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **4.4.1** | Убедитесь, что для всех WebSocket-соединений используется WebSocket поверх TLS (WSS). | 1 | +| **4.4.2** | Убедитесь, что при первоначальном HTTP WebSocket handshake заголовок Origin проверяется на соответствие списку разрешённых источников для приложения. | 2 | +| **4.4.3** | Убедитесь, что если стандартное управление сессиями приложения не может быть использовано, применяются специальные токены, соответствующие требованиям безопасности управления сессиями. | 2 | +| **4.4.4** | Убедитесь, что специальные токены управления сессиями WebSocket изначально получаются или валидируются через ранее аутентифицированную HTTPS-сессию при переходе от HTTPS к WebSocket. | 2 | + +## Ссылки + +Для дополнительной информации см. также: + +* [OWASP REST Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html) +* Ресурсы по авторизации GraphQL от [graphql.org](https://graphql.org/learn/authorization/) и [Apollo](https://www.apollographql.com/docs/apollo-server/security/authentication/#authorization-methods). +* [OWASP Web Security Testing Guide: GraphQL Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/12-API_Testing/01-Testing_GraphQL) +* [OWASP Web Security Testing Guide: Testing WebSockets](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/11-Client-side_Testing/10-Testing_WebSockets) diff --git a/5.0/ru/0x14-V5-File-Handling.md b/5.0/ru/0x14-V5-File-Handling.md new file mode 100644 index 0000000000..118568c67d --- /dev/null +++ b/5.0/ru/0x14-V5-File-Handling.md @@ -0,0 +1,54 @@ +# V5 Работа с файлами + +## Задачи контроля + +Использование файлов может нести различные риски для приложения, включая отказ в обслуживании (DoS), несанкционированный доступ и переполнение хранилища. В этой главе приведены требования, для предотвращения этих рисков. + +## V5.1 Документация по работе с файлами + +Этот раздел содержит требование документировать ожидаемые характеристики файлов, принимаемых приложением, как необходимое условие для разработки и проверки соответствующих мер безопасности. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **5.1.1** | Убедитесь, что документация определяет допустимые типы файлов, ожидаемые расширения и максимальный размер (включая распакованный размер) для каждой функции загрузки. Также убедитесь, что в документации указано, как файлы обезвреживаются для конечных пользователей (например, как приложение ведёт себя при обнаружении вредоносного файла). | 2 | + +## V5.2 Загрузка файлов и содержимое + +Функциональность загрузки файлов является основным источником недоверенных файлов. Этот раздел описывает требования, обеспечивающие безопасность приложения от вреда, связанного с наличием, объёмом или содержимым этих файлов. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **5.2.1** | Убедитесь, что приложение принимает только те файлы, которые может обработать без потери производительности или отказа в обслуживании. | 1 | +| **5.2.2** | Убедитесь, что при загрузке файла (включая файлы внутри архивов, таких как ZIP) приложение проверяет, соответствует ли расширение ожидаемому, и валидирует, соответствует ли содержимое типу, указанному в расширении. Это включает проверку начальных 'magic bytes', перезапись изображений, использование специализированных библиотек. Для уровня 1 — достаточно проверок для файлов, критичных с точки зрения бизнеса или безопасности. Для уровней 2 и выше — для всех файлов. | 1 | +| **5.2.3** | Убедитесь, что приложение проверяет архивы (например, zip, gz, docx, odt) на максимально допустимый распакованный размер и максимальное количество файлов до распаковки. | 2 | +| **5.2.4** | Убедитесь, что для каждого пользователя установлены квоты на общий размер и количество файлов, чтобы один пользователь не мог переполнить хранилище. | 3 | +| **5.2.5** | Убедитесь, что приложение не позволяет загружать архивы с символьными ссылками (symlinks), если это не требуется по бизнес-логике. Если требуется — разрешён только строго определённый список допустимых символьных ссылок. | 3 | +| **5.2.6** | Убедитесь, что приложение отклоняет изображения с числом пикселей выше допустимого, чтобы предотвратить атаки 'pixel flood'. | 3 | + +## V5.3 Хранение файлов + +Этот раздел содержит требования для предотвращения исполнения файлов после загрузки, обнаружения опасного содержимого и предотвращения использования недоверенных данных для управления путями хранения файлов. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **5.3.1** | Убедитесь, что загруженные или сгенерированные из недоверенного ввода файлы, находящиеся в публичной директории, не исполняются как серверный код при обращении к ним по HTTP. | 1 | +| **5.3.2** | Убедитесь, что при создании путей к файлам приложение использует внутренние или доверенные данные, а не пользовательские имена файлов. Если использование пользовательских имён или метаданных необходимо — требуется строгая проверка и очистка. Это защита от path traversal, LFI, RFI и SSRF. | 1 | +| **5.3.3** | Убедитесь, что при обработке файлов на сервере (например, при распаковке) игнорируются пути, заданные пользователем, во избежание уязвимостей типа 'zip slip'. | 3 | + +## V5.4 Скачивание файлов + +Этот раздел содержит требования для снижения рисков при выдаче файлов на загрузку, включая защиту от path traversal и инъекций, а также проверку содержимого. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **5.4.1** | Убедитесь, что приложение валидирует или игнорирует имена файлов, переданных пользователем (включая в JSON, JSONP или URL-параметре), и указывает имя файла в заголовке Content-Disposition при ответе. | 2 | +| **5.4.2** | Убедитесь, что имена файлов, передаваемые (например, в HTTP-заголовках или вложениях в email), кодируются или очищаются (например, по RFC 6266), чтобы сохранить структуру документа и предотвратить инъекции. | 2 | +| **5.4.3** | Убедитесь, что файлы, полученные из недоверенных источников, сканируются антивирусом, чтобы не распространять известное вредоносное содержимое. | 2 | + +## Ссылки + +Для дополнительной информации см. также: + +* [OWASP File Upload Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html) +* [Example of using symlinks for arbitrary file read](https://hackerone.com/reports/1439593) +* [Explanation of "Magic Bytes" from Wikipedia](https://en.wikipedia.org/wiki/List_of_file_signatures) diff --git a/5.0/ru/0x15-V6-Authentication.md b/5.0/ru/0x15-V6-Authentication.md new file mode 100644 index 0000000000..5f1cb68a52 --- /dev/null +++ b/5.0/ru/0x15-V6-Authentication.md @@ -0,0 +1,166 @@ +# V6 Аутентификация + +## Задачи контроля + +Аутентификация — это процесс установления или подтверждения подлинности личности или устройства. Он включает в себя проверку заявленных данных, устойчивость к подмене личности и защиту от перехвата или восстановления паролей. + +[Документ NIST SP 800-63](https://pages.nist.gov/800-63-3/) является современным и основанным на фактических данных стандартом, особенно актуальным для государственных структур США и организаций, взаимодействующих с ними. + +Хотя многие требования этой главы основаны на разделе NIST SP 800-63B («Руководство по цифровой идентификации — Управление аутентификацией и жизненным циклом»), акцент сделан на распространённых угрозах и часто эксплуатируемых слабостях. Эта глава не охватывает весь стандарт. Для полной реализации NIST SP 800-63 необходимо обратиться к оригиналу. + +В тексте используется более понятная терминология, отличающаяся от формулировок NIST. + +Многие современные приложения адаптируют этапы аутентификации в зависимости от уровня риска. Эти механизмы рассматриваются в главе «Авторизация», поскольку они также касаются авторизационных решений. + +## V6.1 Документация по аутентификации + +Этот раздел содержит требования к документации по аутентификации, которую необходимо вести для приложения. Это критически важно для того, чтобы правильно настроить и оценить соответствующие механизмы управления аутентификацией. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **6.1.1** | Убедитесь, что в документации приложения описано, как используются механизмы, такие как ограничение частоты запросов (rate limiting), защита от автоматизации и адаптивные реакции, для защиты от атак, таких как подстановка учётных данных и перебор паролей. Документация должна ясно описывать конфигурацию этих механизмов и предотвращение злонамеренной блокировки аккаунтов. | 1 | +| **6.1.2** | Убедитесь, что задокументирован список контекстно-зависимых слов, запрещённых к использованию в паролях. В него могут входить производные от названий организаций, продуктов, идентификаторов систем, кодовых названий проектов, названий отделов или ролей и тому подобное. | 2 | +| **6.1.3** | Убедитесь, что если приложение поддерживает несколько способов аутентификации, то все они документированы вместе с описанием применяемых средств защиты и уровнем стойкости аутентификации, которые должны быть одинаково применены ко всем способам. | 2 | + +## V6.2 Безопасность паролей + +Пароли (в терминологии NIST SP 800-63 — «запоминаемые секреты») включают в себя пароли, кодовые фразы, PIN-коды, графические шаблоны разблокировки и, например, выбор нужного котёнка или другого элемента на изображении. Они относятся к категории «что-то, что вам известно» и часто используются как однофакторный механизм аутентификации. + +Соответственно, в этом разделе перечислены требования, направленные на безопасное создание и обработку паролей. Большинство требований относятся к уровню L1, поскольку на этом уровне они наиболее важны. Начиная с уровня L2, требуется использование многофакторной аутентификации, в которой пароли могут быть одним из факторов. + +Требования в данном разделе в основном соответствуют [§ 5.1.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver) [руководства NIST](https://pages.nist.gov/800-63-3/sp800-63b.html). + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **6.2.1** | Убедитесь, что пользовательские пароли содержат не менее 8 символов. Рекомендуется минимальная длина в 15 символов. | 1 | +| **6.2.2** | Убедитесь, что пользователи могут менять свои пароли. | 1 | +| **6.2.3** | Убедитесь, что для смены пароля требуется ввести как текущий, так и новый пароль. | 1 | +| **6.2.4** | Убедитесь, что при регистрации или смене пароля введённый пароль проверяется по списку как минимум из 3000 самых популярных паролей, соответствующих политике (например, минимальной длине). | 1 | +| **6.2.5** | Убедитесь, что допускаются пароли любой структуры, без ограничений на использование определённых символов. Не должно быть требований по обязательному наличию заглавных/строчных букв, цифр или специальных символов. | 1 | +| **6.2.6** | Убедитесь, что поля ввода пароля используют type=password для скрытия символов. Разрешено временное отображение всего пароля или последнего введённого символа. | 1 | +| **6.2.7** | Убедитесь, что разрешены вставка (paste), использование менеджеров паролей браузера и внешних менеджеров паролей. | 1 | +| **6.2.8** | Убедитесь, что пароль проверяется строго в том виде, в котором он был введён пользователем — без обрезки, изменения регистра и других модификаций. | 1 | +| **6.2.9** | Убедитесь, что система позволяет использовать пароли длиной не менее 64 символов. | 2 | +| **6.2.10** | Убедитесь, что пароль остаётся действительным, пока не будет скомпрометирован или не будет изменён пользователем. Приложение не должно требовать регулярной смены пароля. | 2 | +| **6.2.11** | Убедитесь, что используется документированный список контекстно-зависимых слов (например, названия компаний, проектов и т.д.) для предотвращения использования легко угадываемых паролей. | 2 | +| **6.2.12** | Убедитесь, что при регистрации или смене пароля проверяется, не входит ли он в список скомпрометированных (утёкших) паролей. | 2 | + +## V6.3 Общие требования к безопасности аутентификации + +В этом разделе изложены общие требования к безопасности механизмов аутентификации, а также различные ожидания для разных уровней защиты. Для приложений уровня L2 обязательно использование многофакторной аутентификации (MFA). Для приложений уровня L3 требуется аппаратная аутентификация, выполняемая в аттестованной и доверенной среде исполнения (TEE). Это может включать: ключи passkey, привязанные к устройству; аутентификаторы, соответствующие eIDAS LoA High; аутентификаторы с уровнем доверия NIST AAL3; или эквивалентные механизмы. + +Это достаточно строгий подход к MFA, но он необходим для повышения уровня защиты пользователей. Любое смягчение этих требований должно сопровождаться документированным обоснованием и чётким планом по смягчению рисков с учётом рекомендаций и исследований NIST. + +Обратите внимание: на момент публикации NIST SP 800-63 рассматривает email как [недопустимый](https://pages.nist.gov/800-63-FAQ/#q-b11) механизм аутентификации ([archived copy](https://web.archive.org/web/20250330115328/https://pages.nist.gov/800-63-FAQ/#q-b11)). + +Требования в этом разделе опираются на следующие части [руководства NIST](https://pages.nist.gov/800-63-3/sp800-63b.html), including: [§ 4.2.1](https://pages.nist.gov/800-63-3/sp800-63b.html#421-permitted-authenticator-types), [§ 4.3.1](https://pages.nist.gov/800-63-3/sp800-63b.html#431-permitted-authenticator-types), [§ 5.2.2](https://pages.nist.gov/800-63-3/sp800-63b.html#522-rate-limiting-throttling), и [§ 6.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#-612-post-enrollment-binding). + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **6.3.1** | Убедитесь, что реализованы меры защиты от атак типа credential stuffing (массовая подстановка учётных данных) и brute-force (перебор паролей), согласно документации по безопасности приложения. | 1 | +| **6.3.2** | Убедитесь, что в приложении отсутствуют или отключены учётные записи по умолчанию (например, root, admin, sa). | 1 | +| **6.3.3** | Убедитесь, что для доступа к приложению используется либо механизм многофакторной аутентификации, либо комбинация однофакторных. Для уровня L3 один из факторов должен быть аппаратным, обеспечивающим защиту от фишинга, устойчивость к компрометации и подтверждение намерения аутентификации через явное действие пользователя (например, нажатие кнопки на FIDO-ключе или телефоне). Ослабление этих требований допускается только при наличии обоснования и компенсирующих мер. | 2 | +| **6.3.4** | Убедитесь, что при наличии нескольких способов аутентификации, они все задокументированы, и для них единообразно применяются меры защиты и уровни доверия. | 2 | +| **6.3.5** | Убедитесь, что пользователи получают уведомления о подозрительных попытках аутентификации (удачных и неудачных). Это может включать попытки (например, подключения) с необычного устройства или места, частично успешную MFA, попытку после долгого отсутствия или успешную аутентификацию после серии неудачных. | 3 | +| **6.3.6** | Убедитесь, что email не используется ни как однофакторный, ни как многофакторный механизм аутентификации. | 3 | +| **6.3.7** | Убедитесь, что пользователи получают уведомление при изменении данных аутентификации, таких как сброс пароля или изменение логина/email. | 3 | +| **6.3.8** | Убедитесь, что из сообщений об ошибке, HTTP-кодов ответа или различий во времени ответа нельзя определить, существует ли пользователь с таким логином. Это правило также должно применяться к функциям регистрации и восстановления пароля. | 3 | + +## V6.4 Жизненный цикл и восстановление факторов аутентификации + +Факторы аутентификации могут включать пароли, программные токены (soft tokens), аппаратные токены (hardware tokens) и биометрические устройства. Безопасное управление жизненным циклом этих механизмов критически важно для безопасности приложения, и данный раздел включает соответствующие требования. + +Требования в этом разделе в основном соответствуют разделам [§ 5.1.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver) или [§ 6.1.2.3](https://pages.nist.gov/800-63-3/sp800-63b.html#replacement) [руководства NIST](https://pages.nist.gov/800-63-3/sp800-63b.html). + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **6.4.1** | Убедитесь, что начальные пароли или коды активации, генерируемые системой, создаются с использованием надёжного генератора случайных чисел, соответствуют текущей политике паролей и истекают через короткий период времени либо после первого использования. Эти секреты не должны использоваться как постоянные пароли. | 1 | +| **6.4.2** | Убедитесь, что в системе отсутствуют подсказки к паролю или вопросы на знание («секретные вопросы»). | 1 | +| **6.4.3** | Убедитесь, что реализован безопасный процесс сброса забытого пароля, который не обходит активные механизмы многофакторной аутентификации. | 2 | +| **6.4.4** | Убедитесь, что в случае утраты одного из факторов MFA проводится удостоверение личности (identity proofing) на том же уровне, что и при первичной регистрации. | 2 | +| **6.4.5** | Убедитесь, что инструкции по обновлению истекающих механизмов аутентификации отправляются заранее, с достаточным запасом времени для выполнения замены, при необходимости с настройкой автоматических напоминаний. | 3 | +| **6.4.6** | Убедитесь, что администраторы могут инициировать процесс сброса пароля, но не могут задать или выбрать новый пароль за пользователя. Это исключает ситуацию, при которой администратор знает пароль пользователя. | 3 | + +## V6.5 Общие требования к многофакторной аутентификации + +Этот раздел содержит общие рекомендации, применимые к различным методам многофакторной аутентификации (MFA). + +К таким механизмам относятся: + +* Lookup-секреты +* Временные одноразовые пароли (TOTP) +* Out-of-Band (внеполосные) механизмы + +Lookup-секреты — заранее сгенерированные списки одноразовых кодов, аналогичные TAN-кодам (Transaction Authorization Numbers), кодам восстановления для соцсетей или таблицам с наборами случайных значений. Эти коды считаются фактором типа «что-то, что у вас есть», поскольку они не запоминаются и должны быть где-то сохранены. + +Временные одноразовые пароли (TOTP) — аппаратные или программные токены, генерирующие постоянно меняющиеся псевдослучайные коды. Это также фактор типа «что-то, что у вас есть». MFA-варианты TOTP предполагают дополнительное подтверждение — например, PIN-код, биометрию, вставку USB-ключа, NFC или дополнительные значения (например, калькуляторы для подписания транзакций). + +Out-of-Band (внеполосные) механизмы рассматриваются в следующем разделе. + +Требования этого раздела в основном соответствуют [§ 5.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#-512-look-up-secrets), [§ 5.1.3](https://pages.nist.gov/800-63-3/sp800-63b.html#-513-out-of-band-devices), [§ 5.1.4.2](https://pages.nist.gov/800-63-3/sp800-63b.html#5142-single-factor-otp-verifiers), [§ 5.1.5.2](https://pages.nist.gov/800-63-3/sp800-63b.html#5152-multi-factor-otp-verifiers), [§ 5.2.1](https://pages.nist.gov/800-63-3/sp800-63b.html#521-physical-authenticators), и [§ 5.2.3](https://pages.nist.gov/800-63-3/sp800-63b.html#523-use-of-biometrics) [руководства NIST](https://pages.nist.gov/800-63-3/sp800-63b.html). + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **6.5.1** | Убедитесь, что lookup-секреты, внеполосные коды/запросы и TOTP-коды можно использовать только один раз. | 2 | +| **6.5.2** | Убедитесь, что при хранении lookup-секретов с энтропией менее 112 бит (например, 19 случайных буквенно-цифровых символов или 34 случайные цифры) они хэшируются с использованием разрешённого алгоритма хеширования паролей и случайной соли минимум 32 бита. Если у секрета ≥112 бит энтропии — допустимо использовать стандартный хэш. | 2 | +| **6.5.3** | Убедитесь, что lookup-секреты, коды внеполосной аутентификации и сиды для TOTP генерируются с использованием криптографически стойкого генератора случайных чисел (CSPRNG), чтобы избежать предсказуемых значений. | 2 | +| **6.5.4** | Убедитесь, что lookup-секреты и внеполосные коды аутентификации имеют минимум 20 бит энтропии (достаточно, например, 4 случайных алфавитно-цифровых символов или 6 случайных цифр). | 2 | +| **6.5.5** | Убедитесь, что все внеполосные запросы, коды и токены, а также TOTP-коды имеют ограниченный срок действия. Максимум для out-of-band — 10 минут, для TOTP — 30 секунд. | 2 | +| **6.5.6** | Убедитесь, что любой фактор аутентификации (включая физические устройства) может быть отозван в случае кражи или утери. | 3 | +| **6.5.7** | Убедитесь, что биометрические механизмы аутентификации используются только как вторичный фактор — в сочетании с «чем-то, что вы знаете» или «чем-то, что у вас есть». | 3 | +| **6.5.8** | Убедитесь, что TOTP-коды проверяются по источнику времени, полученному от доверенного сервиса, а не от клиента или недоверенного источника. | 3 | + +## V6.6 Внеполосные механизмы аутентификации + +Обычно внеполосная аутентификация предполагает, что сервер аутентификации взаимодействует с физическим устройством пользователя через безопасный вторичный канал. Например, путём отправки push-уведомления на мобильное устройство. Такой механизм считается фактором типа «что-то, что у вас есть». + +Небезопасные внеполосные методы аутентификации, такие как электронная почта и VOIP, не допускаются. Аутентификация через PSTN и SMS в настоящее время [считается ограниченной](https://pages.nist.gov/800-63-FAQ/#q-b01) по версии NIST и должна постепенно заменяться на временные одноразовые пароли (TOTP), криптографические механизмы или аналогичные средства. Руководство NIST SP 800-63B [§ 5.1.3.3](https://pages.nist.gov/800-63-3/sp800-63b.html#-5133-authentication-using-the-public-switched-telephone-network) рекомендует принимать меры против таких угроз, как замена устройства, смена SIM-карты, перенос номера и прочие аномалии, если всё же приходится использовать телефонную или SMS-аутентификацию. Хотя этот раздел ASVS не требует строго выполнять эти рекомендации, их игнорирование для чувствительных приложений уровня L2 или L3 считается серьёзным сигналом риска. + +Также стоит отметить, что NIST недавно выпустил рекомендации, в которых отговаривает от [использования push-уведомлений](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#fig-3). Хотя ASVS пока этого не запрещает, важно учитывать риск push-бомбинга (массовой отправки уведомлений для перегрузки пользователя). + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **6.6.1** | Убедитесь, что механизмы аутентификации через телефонную сеть общего пользования (PSTN) для доставки одноразовых паролей (OTP) по телефону или SMS используются только в случае предварительной валидации номера, при этом предлагаются альтернативные более безопасные методы (например, TOTP), и пользователю сообщаются риски. Для приложений уровня L3 использование телефона и SMS недопустимо. | 2 | +| **6.6.2** | Убедитесь, что внеполосные запросы, коды или токены привязаны к исходному запросу аутентификации, для которого они были сгенерированы, и не могут быть использованы повторно для других попыток. | 2 | +| **6.6.3** | Убедитесь, что внеполосные механизмы на основе кода защищены от атак методом подбора (brute force) путём применения ограничения частоты запросов (rate limiting). Также рекомендуется использовать коды с энтропией не менее 64 бит. | 2 | +| **6.6.4** | Убедитесь, что при использовании push-уведомлений для MFA применяется ограничение частоты (rate limiting), чтобы предотвратить атаки push-бомбинга. Также может помочь механизм сопоставления номеров (number matching). | 3 | + +## V6.7 Криптографические механизмы аутентификации + +Криптографические механизмы аутентификации включают, например, смарт-карты или ключи FIDO, при использовании которых пользователь должен подключить или сопрячь криптографическое устройство с компьютером для завершения аутентификации. Аутентификационный сервер отправляет случайную строку (nonce) на криптографическое устройство или программное обеспечение, и устройство или программа вычисляет ответ на основе надежно хранимого криптографического ключа. Требования в этом разделе содержат рекомендации по реализации подобных механизмов. Рекомендации по выбору криптографических алгоритмов приведены в главе «Криптография». + +Если для криптографической аутентификации используются общие или секретные ключи, они должны храниться с использованием тех же механизмов, что и другие системные секреты — как указано в разделе «Управление секретами» главы «Конфигурация». + +Требования этого раздела в основном соответствуют пункту [§ 5.1.7.2](https://pages.nist.gov/800-63-3/sp800-63b.html#sfcdv) [руководства NIST](https://pages.nist.gov/800-63-3/sp800-63b.html). + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **6.7.1** | Убедитесь, что сертификаты, используемые для проверки криптографических утверждений об аутентификации, хранятся таким образом, чтобы исключить возможность их модификации. | 3 | +| **6.7.2** | Убедитесь, что nonce (случайная строка), используемая в процессе вызова, имеет длину не менее 64 бит и является статистически уникальной или уникальной на протяжении всего срока службы криптографического устройства. | 3 | + +## V6.8 Аутентификация с использованием провайдера идентификаций (IdP) + +Провайдеры идентификаций (IdP) предоставляют пользователям федеративную идентификацию. У одного пользователя может быть несколько различных идентификаторов через разные IdP, например, корпоративная учётная запись через Azure AD, Okta, Ping Identity или Google, а также потребительская через Facebook, Twitter, Google или WeChat. Этот перечень не является рекламой данных сервисов, а лишь отражает реальность: у многих пользователей есть уже существующие идентификации. Организациям стоит учитывать возможность интеграции с такими внешними IdP в зависимости от уровня доверия к процедурам подтверждения личности у этих провайдеров. Например, государственная система вряд ли примет соцсети в качестве логина, так как там легко создать фальшивую учётную запись, а вот мобильной игре может быть полезна авторизация через соцсети для роста пользовательской базы. + +Безопасное использование внешних IdP требует тщательной настройки и проверки, чтобы не допустить подделки личности или ложных утверждений (assertions). Данный раздел описывает требования, направленные на снижение этих рисков. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **6.8.1** | Убедитесь, что при поддержке несколькими IdP, невозможно подделать личность пользователя через другой IdP (например, с тем же user ID). Стандартным способом защиты является регистрация пользователя с использованием сочетания ID самого IdP (в качестве пространства имён) и пользовательского ID внутри IdP. | 2 | +| **6.8.2** | Убедитесь, что наличие и целостность цифровой подписи в утверждениях аутентификации (например, в JWT или SAML) всегда проверяются, а неподписанные или недействительные утверждения отклоняются. | 2 | +| **6.8.3** | Убедитесь, что SAML-утверждения обрабатываются только один раз в течение периода их действия, чтобы исключить атаки воспроизведения (replay attacks). | 2 | +| **6.8.4** | Убедитесь, что если приложение использует внешний поставщик идентификации (IdP) и для определенных функций требуется особый уровень, метод или срок действия аутентификации, то приложение использует данные, возвращаемые IdP, для проверки этих условий. Например, при использовании OIDC можно проверить значения полей ID Token — acr, amr, auth_time (если они есть). Если IdP не предоставляет эти данные, приложение должно иметь документированный план действий по умолчанию, предполагающий использование минимально допустимой силы аутентификации (например, одноступенчатая — логин и пароль). | 2 | + +## Ссылки + +Для дополнительной информации см. также: + +* [NIST SP 800-63 - Digital Identity Guidelines](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-3.pdf) +* [NIST SP 800-63B - Authentication and Lifecycle Management](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf) +* [NIST SP 800-63 FAQ](https://pages.nist.gov/800-63-FAQ/) +* [OWASP Web Security Testing Guide: Testing for Authentication](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/04-Authentication_Testing) +* [OWASP Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html) +* [OWASP Forgot Password Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html) +* [OWASP Choosing and Using Security Questions Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Choosing_and_Using_Security_Questions_Cheat_Sheet.html) +* [CISA Guidance on "Number Matching"](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implement-number-matching-in-mfa-applications-508c.pdf) +* [Details on the FIDO Alliance](https://fidoalliance.org/) diff --git a/5.0/ru/0x16-V7-Session-Management.md b/5.0/ru/0x16-V7-Session-Management.md new file mode 100644 index 0000000000..9823970c9e --- /dev/null +++ b/5.0/ru/0x16-V7-Session-Management.md @@ -0,0 +1,91 @@ +# V7 Управление сессиями + +## Задачи контроля + +Механизмы управления сессиями позволяют приложениям связывать взаимодействия пользователя и устройства во времени, даже при использовании протоколов без состояния (например, HTTP). Современные приложения могут использовать несколько токенов сессии с разными характеристиками и назначением. Безопасная система управления сессиями — это система, предотвращающая получение, использование или иное злоупотребление сессией жертвы злоумышленником. Приложения, поддерживающие сессии, должны соответствовать следующим концептуальным требованиям: + +* Сессии уникальны для каждого пользователя, их идентификаторы нельзя угадать, и ими нельзя «поделиться» с другими. +* Сессии становятся недействительными, когда они больше не нужны, т.е. при бездействии пользователя срок действия сессии истекает. + +Многие требования в этой главе основаны на [NIST SP 800-63 Digital Identity Guidelines](https://pages.nist.gov/800-63-4/), с фокусом на распространённые угрозы и уязвимости аутентификации. + +Обратите внимание, что конкретные требования по реализации различных механизмов управления сессиями приведены в других разделах: + +* Требования по безопасности HTTP cookies — в разделе «Безопасность веб-интерфеса». +* Требования по автономным токенам — в разделе «Автономные токены». + +## V7.1 Документация по управлению сессиями + +Нет единого шаблона, подходящего для всех приложений. Поэтому необходимо проводить анализ рисков с документированием решений по безопасности, касающихся управления сессиями, до реализации и тестирования. Это обеспечивает адаптацию системы управления сессиями к конкретным требованиям приложения. + +Независимо от того, используется ли механизм сессий с сохранением состояния (stateful) или без (stateless), анализ должен быть завершён и задокументирован, чтобы продемонстрировать соответствие всем требованиям безопасности. Также необходимо учесть взаимодействие с системами единого входа (SSO), если они используются. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **7.1.1** | Убедитесь, что тайм-аут бездействия и абсолютное максимальное время жизни сессии задокументированы, соответствуют другим контрольным мерам и сопровождаются обоснованием любых отклонений от требований повторной аутентификации NIST SP 800-63B. | 2 | +| **7.1.2** | Убедитесь, что документация определяет допустимое количество одновременных (параллельных) сессий для одного аккаунта, а также поведение системы и действия при достижении этого лимита. | 2 | +| **7.1.3** | Убедитесь, что все системы, создающие и управляющие сессиями пользователей в рамках федеративной идентификации (например, SSO), задокументированы вместе с механизмами координации сроков действия сессий, условий завершения и случаев, требующих повторной аутентификации. | 2 | + +## V7.2 Базовая безопасность сессий + +Требования этого раздела обеспечивают безопасное создание и валидацию сессионных токенов. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **7.2.1** | Убедитесь, что все проверки сессионных токенов выполняются на доверенной серверной стороне. | 1 | +| **7.2.2** | Убедитесь, что приложение использует либо автономные токены, либо ссылочные токены, которые генерируются динамически, не используя статические API-секреты или ключи. | 1 | +| **7.2.3** | Убедитесь, что ссылочные токены являются уникальными, создаются с использованием криптографически безопасного генератора псевдослучайных чисел (CSPRNG) и обладают энтропией не менее 128 бит. | 1 | +| **7.2.4** | Убедитесь, что при аутентификации пользователя (включая повторную) создается новый токен сессии, а текущий — аннулируется. | 1 | + +## V7.3 Тайм-ауты сессии + +Механизмы тайм-аутов сессии уменьшают временное окно для угонов и других атак. Тайм-ауты должны соответствовать документированным решениям по безопасности. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **7.3.1** | Убедитесь, что есть тайм-аут бездействия, после которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями. | 2 | +| **7.3.2** | Убедитесь, что установлено абсолютное максимальное время жизни сессии, по истечении которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями. | 2 | + +## V7.4 Завершение сессий + +Завершение сессии может происходить как со стороны самого приложения, так и через поставщика SSO, если управление сессиями делегировано ему. Некоторые требования этого раздела могут быть реализованы на стороне поставщика SSO. + +Завершение сессии должно требовать повторной аутентификации и быть эффективным во всех компонентах: приложении, федеративной аутентификации и других доверяющих сторонах. + +Сессии с сохранением состояния обычно аннулируются на серверной стороне. self-contained токены нужно отзывать или блокировать, иначе они могут оставаться действительными до истечения срока их действия. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **7.4.1** | Убедитесь, что после завершения сессии (logout, истечение срока) дальнейшее её использование невозможно. Для ссылочных токенов или сессий с сохранением состояния это означает аннулирование на сервере. Для self-contained токенов необходимо реализовать механизм отзыва, например, список отозванных токенов, проверку времени выпуска или ротацию ключей подписи для каждого пользователя. | 1 | +| **7.4.2** | Убедитесь, что при удалении или отключении пользователя все активные сессии немедленно завершаются. | 1 | +| **7.4.3** | Убедитесь, что после изменения или удаления факторов аутентификации (например, смена пароля или MFA) приложение предлагает завершить все другие активные сессии. | 2 | +| **7.4.4** | Убедитесь, что на всех страницах, требующих аутентификации, имеется простой и видимый способ выхода. | 2 | +| **7.4.5** | Убедитесь, что администраторы могут завершать активные сессии конкретного пользователя или всех пользователей. | 2 | + +## V7.5 Защита от злоупотреблений сессией + +Этот раздел направлен на снижение рисков при активных сессиях, включая атаки с использованием действующей сессии жертвы. + +При рассмотрении требований этого раздела нужно учитывать рекомендации для конкретных уровней, приведенные в разделе «Аутентификация» + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **7.5.1** | Убедитесь, что приложение требует полной повторной аутентификации перед изменением чувствительных атрибутов аккаунта, которые могут влиять на аутентификацию (например, email, номер телефона, настройки MFA или данных восстановления доступа). | 2 | +| **7.5.2** | Убедитесь, что пользователь может просматривать и (после повторной аутентификации хотя бы по одному фактору) завершать активные сессии. | 2 | +| **7.5.3** | Убедитесь, что перед выполнением критически важных операций приложение требует повторной аутентификации (по крайней мере, одного фактора) или дополнительной проверки. | 3 | + +## V7.6 Федеративная повторная аутентификация + +Требования для сторон, реализующих логику Relying Party (RP) и Identity Provider (IdP), основаны на [NIST SP 800-63C](https://pages.nist.gov/800-63-4/sp800-63c.html). + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **7.6.1** | Убедитесь, что срок действия и завершение сессий между RP и IdP соответствуют документации и включают повторную аутентификацию, если достигнут максимальный допустимый интервал между событиями аутентификации. | 2 | +| **7.6.2** | Убедитесь, что создание сессии требует согласия пользователя или явного действия, предотвращающего несанкционированное создание сессий без участия пользователя. | 2 | + +## Ссылки + +Для дополнительной информации см. также: + +* [OWASP Web Security Testing Guide: Session Management Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/06-Session_Management_Testing) +* [OWASP Session Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html) diff --git a/5.0/ru/0x17-V8-Authorization.md b/5.0/ru/0x17-V8-Authorization.md new file mode 100644 index 0000000000..eb25da0fc1 --- /dev/null +++ b/5.0/ru/0x17-V8-Authorization.md @@ -0,0 +1,56 @@ +# V8 Авторизация + +## Задачи контроля + +Механизмы авторизации обеспечивают доступ только разрешённым субъектам (пользователям, сервисам и другим клиентам). Для соблюдения принципа наименьших привилегий (POLP) проверяемые приложения должны соответствовать следующим концептуальным требованиям: + +* Документировать правила авторизации, включая факторы принятия решений и контекст окружения. +* Субъекты должны иметь доступ только к тем ресурсам, на которые у них есть разрешения. + +## V8.1 Документация по авторизации + +Полная документация по авторизации необходима для обеспечения согласованного применения решений в области безопасности, возможности аудита и соответствия политикам организации. Это снижает риск несанкционированного доступа, делая требования безопасности понятными и выполнимыми для разработчиков, администраторов и тестировщиков. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **8.1.1** | Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне функций и на уровне данных на основе прав субъекта и атрибутов ресурса. | 1 | +| **8.1.2** | Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне полей (как на чтение, так и на запись) на основе прав субъекта и атрибутов ресурса. Эти правила могут зависеть от других атрибутов объекта данных, например, статуса. | 2 | +| **8.1.3** | Убедитесь, что документация определяет, какие атрибуты окружения и контекста (например, время суток, IP-адрес, местоположение, устройство) используются приложением для принятия решений в области аутентификации и авторизации. | 3 | +| **8.1.4** | Убедитесь, что документация по аутентификации и авторизации определяет, как используются факторы окружения и контекста в принятии решений, наряду с правилами доступа к функциям, данным и полям. Документация должна содержать оцениваемые атрибуты, пороговые значения риска, действия (разрешить, отказать, повысить уровень аутентификации и др.). | 3 | + +## V8.2 Архитектура авторизации + +Реализация детализированных механизмов авторизации на уровне функций, данных и полей обеспечивает субъектам наличие прав доступа только к тем компонентам, которые были им явно предоставлены. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **8.2.1** | Убедитесь, что приложение обеспечивает доступ на уровне функций (function-level) только субъектам с явными разрешениями. | 1 | +| **8.2.2** | Убедитесь, что приложение обеспечивает доступ на уровне данных (data-specific) только тем субъектам, которым явно предоставлены права к определённым элементам данных, чтобы предотвратить IDOR (Insecure Direct Object Reference) и BOLA-уязвимости (Broken Object Level Authorization). | 1 | +| **8.2.3** | Убедитесь, что приложение обеспечивает доступ на уровне полей (field-level) только тем субъектам, которым явно предоставлены права к определённым полям, чтобы предотвратить BOPLA (Broken Object Property Level Authorization). | 2 | +| **8.2.4** | Убедитесь, что реализованы адаптивные меры безопасности, основанные на атрибутах окружения и контекста субъекта (время, местоположение, IP, устройство), которые используются для принятия решений об аутентификации и авторизации, как это определено в документации приложения. Эти меры должны применяться как при попытке субъекта начать новую сессию, так и во время существующей сессии. | 3 | + +## V8.3 Авторизация на уровне операций + +Немедленное применение изменений авторизации на соответствующем уровне архитектуры критически важно для предотвращения несанкционированных действий, особенно в динамически меняющихся системах. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **8.3.1** | Убедитесь, что правила авторизации реализуются на доверенном сервисном уровне и не зависят от элементов, которые может контролировать клиент (например, JavaScript на стороне клиента). | 1 | +| **8.3.2** | Убедитесь, что изменения значений, влияющих на авторизацию, применяются немедленно. Если это невозможно (например, при использовании автономных токенов), должны быть реализованы компенсирующие меры: оповещения о попытке несанкционированного действия и откат изменений. Обратите внимание, что данный подход не предотвращает утечку информации. | 3 | +| **8.3.3** | Убедитесь, что доступ к объекту осуществляется на основе прав субъекта, инициировавшего запрос, а не прав промежуточного сервиса, действующего от его имени. Например, если пользователь обращается к веб-сервису с автономным токеном для аутентификации, а сервис затем запрашивает данные у другого сервиса, второй сервис должен использовать токен пользователя, а не токен первого сервиса для принятия решения о доступе. | 3 | + +## V8.4 Прочие аспекты авторизации + +Дополнительные меры контроля, особенно в административных интерфейсах и многопользовательских (мультитенантных) системах, помогают предотвратить несанкционированный доступ. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **8.4.1** | Убедитесь, что в мультитенантных приложениях реализованы механизмы, предотвращающие действия потребителя в отношении арендаторов, к которым у него нет доступа. | 2 | +| **8.4.2** | Убедитесь, что доступ к административным интерфейсам защищён несколькими уровнями контроля, включая непрерывную проверку личности, контроль защищённости устройства и анализ контекстных рисков. Недостаточно опираться только на IP-адрес или доверенные устройства. | 3 | + +## Ссылки + +Для дополнительной информации см. также: + +* [OWASP Web Security Testing Guide: Authorization](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/05-Authorization_Testing) +* [OWASP Authorization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html) diff --git a/5.0/ru/0x18-V9-Self-contained-Tokens.md b/5.0/ru/0x18-V9-Self-contained-Tokens.md new file mode 100644 index 0000000000..7ca2676c0d --- /dev/null +++ b/5.0/ru/0x18-V9-Self-contained-Tokens.md @@ -0,0 +1,36 @@ +# V9 Автономные токены + +## Задачи контроля + +В оригинальном RFC 6749 OAuth 2.0 от 2012 года упоминается концепция автономного токена (self-contained token). Она относится к токенам, которые содержат данные или утверждения (claims), на основе которых получатель будет принимать решения по безопасности. Автономный токен следует отличать от простого токена, содержащего только идентификатор, который принимающая сторона использует для локального поиска данных. + +Наиболее распространёнными примерами автономных токенов являются JSON Web Tokens (JWTs) и SAML Assertions. Но автономные токены получили широкое распространение даже за пределами OAuth и OIDC. Безопасность этой концепции зависит от возможности проверить целостность токена и убедиться, что он действителен для конкретного контекста. Этот процесс сопряжен с множеством подводных камней, и в этой главе подробно описываются механизмы, помогающие приложениям обходить их. + +## V9.1 Источник токена и его целостность + +В данном разделе изложены требования, гарантирующие, что токен был выпущен доверенной стороной и не был модифицирован. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **9.1.1** | Убедитесь, что автономные токены проверяются на целостность с помощью цифровой подписи или MAC, прежде чем доверять их содержимому. | 1 | +| **9.1.2** | Проверяйте, что автономные токены создаются и проверяются исключительно с помощью алгоритмов из списка допустимых в данном контексте. Список допустимых алгоритмов должен включать только разрешенные алгоритмы (желательно либо только симметричные, либо только асимметричные) и ни в коем случае не содержать алгоритм None. Если необходимо поддерживать оба типа алгоритмов, потребуются дополнительные средства контроля для предотвращения путаницы с ключами (key confusion). | 1 | +| **9.1.3** | Убедитесь, что ключи, используемые для проверки автономных токенов, получены из доверенных, предварительно настроенных источников. Это предотвращает возможность указания злоумышленниками ненадёжных источников и ключей. Для JWT и других JWS структур заголовки 'jku', 'x5u' и 'jwk' должны проверяться по белому списку. | 1 | + +## V9.2 Содержимое токена + +Прежде чем принимать решения по безопасности на основе данных из токена, важно проверить два момента: что срок действия токена актуален на момент предъявления, и что токен предназначен для использования принимающим сервисом в тех целях, для которых он был передан. Это предотвращает небезопасное перекрестное использование токена между различными сервисами или использование разного типа токенов от одного и того же эмитента. + +Конкретные требования для OAuth и OIDC рассматриваются в соответствующей главе. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **9.2.1** | Убедитесь, что при указанном сроке действия токен и его содержимое принимаются только в том случае, если срок действия токена не истёк. Например, для JWT нужно проверить поля 'nbf' и 'exp'. | 1 | +| **9.2.2** | Убедитесь, что сервис, принимающий токен, проверяет его тип и соответствие назначению перед обработкой содержимого токена. Например, для принятия решений об авторизации могут быть приняты только Access Token, а для подтверждения аутентификации пользователя — только ID Token. | 2 | +| **9.2.3** | Убедитесь, что сервис принимает только токены, предназначенные для использования с этим сервисом (audience). Для JWT это можно сделать, проверив наличие утверждения «aud» по белому списку, определенному в сервисе. | 2 | +| **9.2.4** | Убедитесь, что, если эмитент токенов использует один и тот же закрытый ключ для выпуска токенов различным сервисам (audiences), выпущенные токены содержат явное указание целевых сервисов. Это предотвратит повторное использования токенов в не предназначенных для них сервисах. Если идентификатор сервиса (audience identifier) назначается динамически, эмитент токенов должен проверить audiences для исключения подмены получателей (audience impersonation). | 2 | + +## Ссылки + +Для дополнительной информации см. также: + +* [OWASP JSON Web Token Cheat Sheet for Java Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_for_Java_Cheat_Sheet.html) (но имеет полезные общие рекомендации) diff --git a/5.0/ru/0x19-V10-OAuth-and-OIDC.md b/5.0/ru/0x19-V10-OAuth-and-OIDC.md new file mode 100644 index 0000000000..4d26a8e666 --- /dev/null +++ b/5.0/ru/0x19-V10-OAuth-and-OIDC.md @@ -0,0 +1,169 @@ +# V10 OAuth и OIDC + +## Задачи контроля + +OAuth2 (в этой главе именуется просто OAuth) — это общепринятый отраслевой стандарт делегированной авторизации. Например, с помощью OAuth клиентское приложение может получить доступ к API (ресурсам сервера) от имени пользователя, если тот дал на это разрешение. + +Сама по себе технология OAuth не предназначена для аутентификации пользователей. Фреймворк OpenID Connect (OIDC) расширяет OAuth, добавляя слой идентификации пользователя. OIDC поддерживает такие функции, как стандартизированная информация о пользователе, единый вход (SSO) и управление сессиями. Поскольку OIDC является надстройкой над OAuth, все требования, предъявляемые к OAuth, также применимы к OIDC. + +В OAuth определены следующие роли: + +* OAuth-клиент — приложение, пытающееся получить доступ к серверным ресурсам (например, через вызов API с использованием access token). Чаще всего это серверное приложение. + * Конфиденциальный клиент (confidential client) — клиент, способный сохранять в тайне свои учетные данные (например, client_secret) для аутентификации на авторизационном сервере. + * Публичный клиент (public client) — клиент, неспособный хранить учетные данные в секрете. Вместо аутентификации (например, с использованием пары client_id и client_secret) он лишь идентифицирует себя через client_id. +* OAuth-ресурсный сервер (Resource Server, RS) — сервер API, предоставляющий ресурсы клиентам OAuth. +* OAuth-авторизационный сервер (Authorization Server, AS) — сервер, выдающий клиентам access token'ы. Эти токены позволяют клиенту получать доступ к ресурсам RS — либо от имени пользователя, либо от имени самого клиента. Часто AS — это отдельное приложение, но при необходимости может быть интегрирован в RS. +* Владелец ресурса (Resource Owner, RO) — конечный пользователь, разрешающий OAuth-клиенту ограниченный доступ к своим данным на RS. Пользователь предоставляет это разрешение через взаимодействие с AS. + +В OIDC определены следующие роли: + +* Relying Party (RP) — клиентское приложение, запрашивающее аутентификацию пользователя через OpenID-провайдера. В терминах OAuth оно также является OAuth-клиентом. +* OpenID-провайдер (OP) — авторизационный сервер OAuth, способный аутентифицировать пользователя и предоставлять RP claims в рамках OIDC. OP может быть IdP (провайдером идентификации), но в федеративных сценариях OP и IdP могут быть разными приложениями. + +Изначально OAuth и OIDC были разработаны для сторонних приложений. Однако в настоящее время они часто используются и в first-party сценариях. Например, для аутентификации и управления сессиями. В таких случаях протоколы добавляют некоторую сложность, которая может привести к новым проблемам с безопасностью. + +OAuth и OIDC могут использоваться в различных типах приложений, однако в OWASP ASVS акцент делается на веб-приложения и API. + +Поскольку OAuth и OIDC работают поверх веб-технологий, на них распространяются общие требования из других глав. Этот раздел не следует рассматривать изолированно. + +В этой главе рассматриваются лучшие современные практики OAuth2 и OIDC в ​​соответствии со спецификациями, представленными на и . Поскольку RFC часто обновляются, при применении требований, изложенных в этой главе, следует сверяться с их последними версиями. Подробнее см. в разделе «Ссылки». + +С учетом сложности темы крайне важно использовать проверенные стандартные решения (например, авторизационные серверы от крупных вендоров) и применять рекомендованные параметры безопасности. + +Терминология в этой главе соответствует RFC OAuth и спецификациям OIDC. Однако OIDC-термины используются только в OIDC-специфичных требованиях. В остальных случаях применяется терминология OAuth. + +В этом разделе под «токеном» понимается: + +* Access Token используется только ресурсным сервером (RS). Он может быть ссылочным (reference token), проверяемым через introspection, или автономным (self-contained), проверяемым через криптографически подписанный материал. +* Refresh Token используется только авторизационным сервером, выдавшим токен. +* OIDC ID Token используется только клиентским приложением, инициировавшим процесс авторизации. + +Уровни риска для некоторых требований зависят от того, является ли клиент конфиденциальным или публичным. Поскольку сильная клиентская аутентификация снижает многие риски, в случае конфиденциальных клиентов на уровне L1 возможны послабления. + +## V10.1 Общие требования безопасности OAuth и OIDC + +В этом разделе изложены универсальные архитектурные требования, применимые ко всем приложениям, использующим OAuth или OIDC. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **10.1.1** | Убедитесь, что токены передаются только тем компонентам, которым они действительно необходимы. Например, при использовании схемы backend-for-frontend для браузерных JavaScript-приложений, access и refresh токены должны быть доступны только на backend. | 2 | +| **10.1.2** | Убедитесь, что клиент принимает значения от авторизационного сервера (например, authorization code или ID Token) только если они получены в результате авторизационного потока, инициированного в той же сессии пользовательского агента и в рамках той же транзакции. Для этого клиентские секреты, такие как proof key для code exchange (PKCE) — 'code_verifier', 'state' или OIDC 'nonce' — должны быть непредсказуемыми, специфичными для транзакции и надежно привязанными как к клиенту, так и к сессии пользовательского агента, в которой началась транзакция. | 2 | + +## V10.2 Клиент OAuth + +Данные требования описывают обязанности приложений-клиентов OAuth. Клиентом может быть, например, backend веб-сервера (часто выступающий как Backend For Frontend, BFF), интеграция backend-сервиса или frontend-приложение одностраничного типа (SPA, то есть браузерное приложение). + +В общем случае backend-клиенты считаются конфиденциальными (confidential clients), а frontend — публичными (public clients). Однако нативные приложения, работающие на устройстве конечного пользователя, могут рассматриваться как конфиденциальные при использовании динамической регистрации OAuth клиента. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **10.2.1** | Убедитесь, что если используется механизм authorization code flow, OAuth клиент защищён от CSRF, вызывающих запросы токенов либо за счёт использования механизма proof key for code exchange (PKCE), либо за счёт проверки параметра 'state', который был отправлен в запросе авторизации. | 2 | +| **10.2.2** | Убедитесь, что если OAuth клиент может взаимодействовать с более чем одним сервером авторизации, у него есть защита от атак смешивания (mix-up attacks). Например, клиент должен требовать, чтобы сервер авторизации возвращал параметр 'iss' и проверять его в ответах на авторизацию и токены. | 2 | +| **10.2.3** | Убедитесь, что OAuth клиент запрашивает только необходимые области доступа (scopes) или другие параметры авторизации в запросах к серверу авторизации. | 3 | + +## V10.3 Сервер ресурсов OAuth + +В контексте ASVS и данного раздела сервер ресурсов — это API. Для обеспечения безопасного доступа сервер ресурсов должен: + +* Валидировать access token в соответствии с форматом токена и спецификациями протокола, например, валидация JWT или интроспекция OAuth токена. +* Если токен действителен, принимать решения по авторизации на основе информации из токена и предоставленных разрешений. Например, сервер ресурсов должен проверить, что клиент (действующий от имени владельца ресурса) имеет право доступа к запрошенному ресурсу. + +Таким образом, требования здесь специфичны для OAuth или OIDC и должны выполняться после валидации токена и перед принятием решения об авторизации на основе информации из токена. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **10.3.1** | Убедитесь, что сервер ресурсов принимает только те access токены, которые предназначены для использования с этим сервисом (свойство audience). Эта принадлежность сервису может быть включена в структурированный access токен (например, в поле 'aud' в JWT) или проверяться через endpoint интроспекции токена. | 2 | +| **10.3.2** | Убедитесь, что сервер ресурсов принимает решения по авторизации на основе claims из access токена, определяющих делегированную авторизацию. Если присутствуют claims, такие как 'sub', 'scope' и 'authorization_details', они должны участвовать в принятии решения. | 2 | +| **10.3.3** | Убедитесь, что если для принятия решения по контролю доступа необходимо однозначно идентифицировать пользователя из access токена (JWT или ответа интроспекции), сервер ресурсов использует claims, которые не могут быть переприсвоены другим пользователям. Обычно это комбинация claims 'iss' и 'sub'. | 2 | +| **10.3.4** | Убедитесь, что если сервер ресурсов требует определённой силы аутентификации, методов или свежести аутентификации, он проверяет, что предъявленный access токен удовлетворяет этим требованиям. Например, при наличии, могут использоваться claims OIDC 'acr', 'amr' и 'auth_time'. | 2 | +| **10.3.5** | Убедитесь, что сервер ресурсов предотвращает использование украденных access токенов или их повторное использование (replay) неавторизованными лицами, требуя access токены с подтверждением отправителя — например, Mutual TLS для OAuth 2 или OAuth 2 Demonstration of Proof of Possession (DPoP). | 3 | + +## V10.4 Сервер авторизации OAuth + +Эти требования описывают обязанности серверов авторизации OAuth, включая OpenID провайдеров. + +Для аутентификации клиента разрешён метод 'self_signed_tls_client_auth' при выполнении предварительных требований, указанных в [разделе 2.2](https://datatracker.ietf.org/doc/html/rfc8705#name-self-signed-certificate-mut) стандарта [RFC 8705](https://datatracker.ietf.org/doc/html/rfc8705). + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **10.4.1** | Убедитесь, что сервер авторизации проверяет URI перенаправления (redirect URI), сверяя его с заранее зарегистрированным списком разрешённых URI для данного клиента (allowlist), используя точное сравнение строк. | 1 | +| **10.4.2** | Убедитесь, что если сервер авторизации возвращает authorization code в ответе авторизации, этот код может быть использован только один раз для запроса токена. При втором валидном запросе с уже использованным кодом сервер должен отклонить запрос и отозвать любые токены, связанные с этим кодом. | 1 | +| **10.4.3** | Убедитесь, что authorization code имеет короткое время жизни. Максимальная продолжительность — до 10 минут для приложений L1 и L2 и до 1 минуты для приложений L3. | 1 | +| **10.4.4** | Убедитесь, что сервер авторизации для конкретного клиента разрешает использование только тех типов авторизации, которые необходимы этому клиенту. Обратите внимание, что тип авторизации Implicit flow и Resource Owner Password Credentials flow больше не должны использоваться. | 1 | +| **10.4.5** | Убедитесь, что сервер авторизации предотвращает атаки повторного использования refresh токенов для публичных клиентов, предпочтительно используя sender-constrained refresh токены, такие как DPoP или сертификат-связанные токены с mutual TLS (mTLS). Для L1 и L2 допускается ротация refresh токенов с обязательной их инвалидацией после использования. Если используется ротация, сервер должен отозвать все refresh токены при попытке использовать уже инвалидированный токен. | 1 | +| **10.4.6** | Убедитесь, что при использовании типа авторизации «Authorization Code» сервер предотвращает атаки перехвата authorization code, требуя Proof Key for Code Exchange (PKCE). В запросах авторизации сервер должен требовать валидное значение 'code_challenge' и не принимать 'code_challenge_method' со значением 'plain'. В запросах токена обязательно валидировать параметр 'code_verifier'. | 2 | +| **10.4.7** | Убедитесь, что если сервер авторизации поддерживает динамическую регистрацию клиентов без аутентификации, он минимизирует риски вредоносных клиентов. Сервер должен валидировать метаданные клиента (например, зарегистрированные URI), обеспечивать согласие пользователя и предупреждать пользователя перед обработкой запроса авторизации от недоверенного клиента. | 2 | +| **10.4.8** | Убедитесь, что refresh токены имеют абсолютный срок действия, включая случаи, когда применяется скользящее время истечения срока. | 2 | +| **10.4.9** | Убедитесь, что пользователи могут отзывать refresh токены и reference access токены через пользовательский интерфейс сервера авторизации для снижения риска от вредоносных клиентов или кражи токенов. | 2 | +| **10.4.10** | Убедитесь, что конфиденциальный клиент аутентифицируется при взаимодействии с сервером авторизации через backchannel, например при запросах токена, pushed authorization requests (PAR) и запросах на отзыв токенов. | 2 | +| **10.4.11** | Убедитесь, что конфигурация сервера авторизации назначает OAuth клиенту только необходимые области доступа (scopes). | 2 | +| **10.4.12** | Убедитесь, что для конкретного клиента сервер авторизации разрешает только те значения 'response_mode', которые необходимы этому клиенту. Например, сервер должен валидировать это значение против ожидаемых или использовать pushed authorization request (PAR) или JWT-secured Authorization Request (JAR). | 3 | +| **10.4.13** | Убедитесь, что грант типа 'code' всегда используется вместе с pushed authorization requests (PAR). | 3 | +| **10.4.14** | Убедитесь, что сервер авторизации выдаёт только sender-constrained (Proof-of-Possession) access токены, либо с сертификат-связанными токенами через mutual TLS (mTLS), либо DPoP-bound токены (Demonstration of Proof of Possession). | 3 | +| **10.4.15** | Убедитесь, что для серверного клиента (не выполняющегося на устройстве конечного пользователя) сервер авторизации проверяет, что значение параметра 'authorization_details' исходит из клиентского backend и что пользователь не изменял его. Например, это достигается использованием pushed authorization request (PAR) или JWT-secured Authorization Request (JAR). | 3 | +| **10.4.16** | Убедитесь, что клиент является конфиденциальным и сервер авторизации требует использования сильных методов аутентификации клиента (основанных на криптографии с открытым ключом и устойчивых к атакам повторного воспроизведения), таких как mutual TLS ('tls_client_auth', 'self_signed_tls_client_auth') или private key JWT ('private_key_jwt'). | 3 | + +## V10.5 Клиент OIDC + +Поскольку OIDC клиент (relying party) выступает в роли OAuth клиента, на него также распространяются требования из раздела «OAuth Client». + +Обратите внимание, что в разделе «Аутентификация с использованием провайдера идентификаций (IdP)» главы «Аутентификация» содержатся дополнительные общие требования. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **10.5.1** | Убедитесь, что клиент (relying party) защищается от повторного использования ID Token (replay-атак). Например, это достигается проверкой того, что значение 'nonce' в ID Token совпадает со значением 'nonce', отправленным в запросе аутентификации провайдеру OpenID (authorization server). | 2 | +| **10.5.2** | Убедитесь, что клиент однозначно идентифицирует пользователя по утверждениям (claims) ID Token, обычно это 'sub', который не может быть переназначен другому пользователю (в пределах конкретного провайдера идентификации). | 2 | +| **10.5.3** | Убедитесь, что клиент отклоняет попытки злоумышленного сервера авторизации выдавать себя за другой сервер авторизации через метаданные сервера авторизации. Клиент должен отклонить метаданные, если URL издателя (issuer) в метаданных не совпадает точно с преднастроенным URL издателя, ожидаемым клиентом. | 2 | +| **10.5.4** | Убедитесь, что клиент проверяет, что ID Token предназначен для него (проверка audience), сравнивая значение 'aud' в токене с 'client_id' клиента. | 2 | +| **10.5.5** | Убедитесь, что при использовании OIDC back-channel logout клиент снижает риск отказа в обслуживании, вызванный принудительным выходом из системы и путаницей между разными типами JWT (cross-JWT confusion) в процессе логаута. Клиент должен проверить, что токен выхода корректно типизирован со значением 'logout+jwt', содержит claim 'event' с правильным именем участника и не содержит 'nonce'. Также рекомендуется установить короткий срок действия токена (например, 2 минуты). | 2 | + +## V10.6 Провайдер OpenID + +Поскольку провайдеры OpenID выступают в роли OAuth серверов авторизации, на них также распространяются требования из раздела «Сервер авторизации OAuth». + +Обратите внимание, что при использовании потока ID Token (а не code flow) access токены не выдаются, и многие требования к OAuth AS в этом случае неприменимы. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **10.6.1** | Убедитесь, что провайдер OpenID допускает только значения 'code', 'ciba', 'id_token' или 'id_token code' для параметра response mode. При этом предпочтение отдаётся 'code' по сравнению с 'id_token code' (гибридный поток OIDC), а значение 'token' (любой Implicit flow) не должно использоваться. | 2 | +| **10.6.2** | Убедитесь, что провайдер OpenID предотвращает отказ в обслуживании (DoS) через принудительный выход (logout), запрашивая явное подтверждение от конечного пользователя или, если применимо, проверяя параметры в запросе выхода (инициированном relying party), например параметр 'id_token_hint'. | 2 | + +## V10.7 Управление согласием + +Эти требования касаются проверки согласия пользователя авторизационным сервером. Без правильной проверки согласия пользователя злоумышленник может получить разрешения от имени пользователя с помощью подделки или социальной инженерии. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **10.7.1** | Убедитесь, что авторизационный сервер обеспечивает получение согласия пользователя для каждого запроса авторизации. Если личность клиента не может быть подтверждена, сервер авторизации всегда должен явно запрашивать согласие пользователя. | 2 | +| **10.7.2** | Убедитесь, что при запросе согласия пользователя авторизационный сервер предоставляет достаточную и понятную информацию о том, на что даётся согласие. При необходимости это должно включать характер запрашиваемых разрешений (обычно основанных на scope, ресурсном сервере, деталях авторизации Rich Authorization Requests (RAR)), идентификацию авторизованного приложения и срок действия этих разрешений. | 2 | +| **10.7.3** | Убедитесь, что пользователь может просматривать, изменять и отзывать согласия, которые он предоставил, через авторизационный сервер. | 2 | + +## Ссылки + +Для дополнительной информации об OAuth см.: + +* [oauth.net](https://oauth.net/) +* [OWASP OAuth 2.0 Protocol Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/OAuth2_Cheat_Sheet.html) + +Для требований, связанных с OAuth, в ASVS используются следующие опубликованные и находящиеся в статусе черновика RFC: + +* [RFC6749 The OAuth 2.0 Authorization Framework](https://datatracker.ietf.org/doc/html/rfc6749) +* [RFC6750 The OAuth 2.0 Authorization Framework: Bearer Token Usage](https://datatracker.ietf.org/doc/html/rfc6750) +* [RFC6819 OAuth 2.0 Threat Model and Security Considerations](https://datatracker.ietf.org/doc/html/rfc6819) +* [RFC7636 Proof Key for Code Exchange by OAuth Public Clients](https://datatracker.ietf.org/doc/html/rfc7636) +* [RFC7591 OAuth 2.0 Dynamic Client Registration Protocol](https://datatracker.ietf.org/doc/html/rfc7591) +* [RFC8628 OAuth 2.0 Device Authorization Grant](https://datatracker.ietf.org/doc/html/rfc8628) +* [RFC8707 Resource Indicators for OAuth 2.0](https://datatracker.ietf.org/doc/html/rfc8707) +* [RFC9068 JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens](https://datatracker.ietf.org/doc/html/rfc9068) +* [RFC9126 OAuth 2.0 Pushed Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9126) +* [RFC9207 OAuth 2.0 Authorization Server Issuer Identification](https://datatracker.ietf.org/doc/html/rfc9207) +* [RFC9396 OAuth 2.0 Rich Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9396) +* [RFC9449 OAuth 2.0 Demonstrating Proof of Possession (DPoP)](https://datatracker.ietf.org/doc/html/rfc9449) +* [RFC9700 Best Current Practice for OAuth 2.0 Security](https://datatracker.ietf.org/doc/html/rfc9700) +* [draft OAuth 2.0 for Browser-Based Applications](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-browser-based-apps) +* [draft The OAuth 2.1 Authorization Framework](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-12) + +Для получения дополнительной информации об OpenID Connect см.: + +* [OpenID Connect Core 1.0](https://openid.net/specs/openid-connect-core-1_0.html) +* [FAPI 2.0 Security Profile](https://openid.net/specs/fapi-security-profile-2_0-final.html) diff --git a/5.0/ru/0x20-V11-Cryptography.md b/5.0/ru/0x20-V11-Cryptography.md new file mode 100644 index 0000000000..9d9a9a4ff1 --- /dev/null +++ b/5.0/ru/0x20-V11-Cryptography.md @@ -0,0 +1,107 @@ +# V11 Криптография + +## Задачи контроля + +Цель этой главы - определить наилучшие методы общего использования криптографии, а также привить фундаментальное понимание ее принципов и стимулировать переход к более устойчивым и современным подходам. В ней рассмотрены следующие пункты: + +* Внедрение надежных криптографических систем, которые являются отказоустойчивыми, адаптируются к меняющимся угрозам и ориентированы на будущее. +* Использование криптографических механизмов, которые одновременно являются безопасными и соответствуют лучшим практикам индустрии. +* Поддержка безопасной системы управления криптографическими ключами с надлежащим контролем доступа и аудитом. +* Регулярная оценка криптографической отрасли для определения рисков и соответствующей адаптации алгоритмов. +* Обнаружение и управление криптографическими сценариями использования на протяжении всего жизненного цикла приложения с целью обеспечения учёта и защиты всех криптографических ресурсов. + +В дополнение к обозначенным общим принципам и лучшим практикам данный документ также представляет более углубленную техническую информацию о требованиях в Приложении C - Стандарты криптографии. Он содержит алгоритмы и конфигурации, которые считаются «утвержденными» в соответствии с требованиями, изложенными в данном разделе. + +Требования для решения отдельных криптографических задач, таких как управление секретами или обеспечение безопасного соединения будут рассмотрены в разных частях стандарта. + +## V11.1 Инвентаризация и документирование криптографии + +Приложения должны проектироваться с использованием надёжной криптографической архитектуры для защиты данных в соответствии с их классификацией. Шифровать всё подряд — это расточительно, а не шифровать ничего — юридическая халатность. Необходимо найти баланс, который обычно достигается на этапе архитектурного или высокоуровневого проектирования, в ходе дизайн-спринтов или архитектурных исследований. Проектирование криптографии «на ходу» или доработка её после разработки приложения неизбежно приведёт к гораздо большим затратам на обеспечение безопасности, чем если бы она была заложена с самого начала. + +Важно регулярно обнаруживать, вести учёт и оценивать все криптографические активы. В приложении приведена дополнительная информация о том, как это делать. + +Также критически важно подготовить криптографические системы к будущему появлению квантовых компьютеров. Постквантовая криптография (Post-Quantum Cryptography, PQC) — это криптографические алгоритмы, разработанные так, чтобы оставаться надёжными против атак квантовых компьютеров, которые, как ожидается, смогут взламывать широко используемые алгоритмы, такие как RSA и эллиптические кривые (ECC). + +В приложении также содержатся текущие рекомендации по проверенным PQC-примитивам и стандартам. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **11.1.1** | Убедитесь, что задокументирована политика управления криптографическими ключами и описан их жизненный цикл в соответствии со стандартом управления ключей, таким как NIST SP 800-57. Убедитесь, что ключи известны только тем сущностям, которым они должны быть доступны (например, ключи не передавались более чем двум участникам для общих секретов и более чем одному участнику для приватных ключей). | 2 | +| **11.1.2** | Убедитесь, что проводится инвентаризация криптографических средств, которая непрерывно поддерживается, регулярно обновляется и включает все криптографические ключи, алгоритмы и сертификаты, используемые в приложении. Также должна быть задокументирована информация о том, где ключи могут и не могут использоваться в системе, а также какие типы данных могут и не могут быть защищены с помощью этих ключей. | 2 | +| **11.1.3** | Убедитесь, что используются механизмы обнаружения криптографии для идентификации всех случаев применения криптографии в системе , включая операции шифрования, хеширования и цифровой подписи. | 3 | +| **11.1.4** | Убедитесь, что ведётся и поддерживается инвентаризация криптографических средств. В неё должен входить документированный план, описывающий переход на новые криптографические стандарты, такие как постквантовая криптография, чтобы своевременно реагировать на будущие угрозы. | 3 | + +## V11.2 Безопасная реализация криптографии + +Данный раздел содержит требования для определения (выбора), реализации и дальнейшего управления основными криптографическими алгоритмами в приложении. Основная цель - убедиться в том, что используются исключительно надежные, утвержденные криптографические примитивы в соответствии с текущими стандартами (н-р, NIST, ISO/IEC) и лучшими практиками разработки. Организации должны убедиться, что каждый криптографический компонент выбран с учетом рецензируемых исследований и практического тестирования безопасности. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **11.2.1** | Убедитесь, что для криптографических операций используются утвержденные в индустрии реализации (включая библиотеки и аппаратные реализации). | 2 | +| **11.2.2** | Убедитесь, что архитектура приложения поддерживает быструю реконфигурацию, усовершенствование или смену в любой момент случайных чисел, аутентифицированного шифрования, MAC, алгоритмов хеширования, длин ключей, количества раундов, шифров и режимов шифрования для защиты от криптографических атак. Также должна поддерживаться возможность смены ключей, паролей и повторного шифрования данных. Это позволит беспрепятственно перейти на постквантовую криптографию (PQC), как только станут широко доступны высоконадёжные реализации одобренных схем или стандартов PQC. | 2 | +| **11.2.3** | Убедитесь, что все криптографические примитивы используют как минимум 128-бит стойкости с учетом алгоритма, размера ключа и конфигурации. Например, 256-битный ECC ключ обеспечивает примерно 128 бит безопасности, тогда как для достижения того же уровня безопасности в RSA требуется ключ длиной 3072 бита. | 2 | +| **11.2.4** | Убедитесь, что все криптографические операции выполняются за константное время, без использования «short-circuit» операций в сравнениях, вычислениях, возвратах функций для избежания утечек информации. | 3 | +| **11.2.5** | Убедитесь, что все криптографические модули обеспечивают безопасное завершение работы при ошибках, а обработка ошибок реализована таким образом, чтобы не создавать уязвимостей, например, таких как атаки Padding Oracle. | 3 | + +## V11.3 Алгоритмы шифрования + +Алгоритмы аутентифицированного шифрования на основе AES и ChaCha20 составляют основу современной криптографической практики. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **11.3.1** | Убедитесь, что не используются небезопасные режимы блочного шифрования (н-р, ECB) и слабые схемы дополнения (padding) (н-р, PKCS#1 v1.5). | 1 | +| **11.3.2** | Убедитесь, что используются только утверждённые шифры и режимы, такие как AES с GCM. | 1 | +| **11.3.3** | Убедитесь, что зашифрованные данные защищены от несанкционированного изменения, предпочтительно с использованием утверждённого метода аутентифицированного шифрования или путём комбинирования утверждённого метода шифрования с утверждённым алгоритмом MAC. | 2 | +| **11.3.4** | Убедитесь, что случайные числа (nonce), векторы инициализации (IV) и другие одноразовые числа не используются более одного раза для одной и той же пары ключа шифрования и элемента данных. Метод их генерации должен соответствовать требованиям используемого алгоритма. | 3 | +| **11.3.5** | Убедитесь, что любая комбинация алгоритма шифрования и алгоритма MAC работает в режиме encrypt-then-MAC (EtM). | 3 | + +## V11.4 Хеширование и функции на основе хеширования + +Криптографические хеш-функции применяются во множестве криптографических протоколов, таких как цифровые подписи, HMAC, функции генерации ключа (KDF), генерация случайных битов и хранение паролей. Безопасность криптографической системы напрямую зависит от стойкости используемых хеш-функций. В этом разделе изложены требования к использованию надёжных хеш-функций в криптографических операциях. + +Для рекомендаций по хранению паролей, вместе с Приложениием C - Стандарты криптографии, рекомендуем использовать [OWASP Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#password-hashing-algorithms) + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **11.4.1** | Убедитесь, что только утвержденные хэш-функции используются для стандартных сценариев использования в криптографии, включая цифровую подпись, HMAC, KDF, генерацию случайных чисел. Запрещено использовать неустойчивые хэш-функции, (н-р, MD5) для любого использования в криптографии. | 1 | +| **11.4.2** | Убедитесь, что пароли хранятся с использованием утверждённой, вычислительно затратной функции генерации ключа (также известной как «функция хеширования паролей»), с параметрами, настроенными в соответствии с актуальными рекомендациями. Настройки должны обеспечивать баланс между безопасностью и производительностью, чтобы сделать атаки перебором достаточно сложными для требуемого уровня безопасности. | 2 | +| **11.4.3** | Убедитесь, что хэш-функции, используемые в формировании цифровой подписи, как часть аутентификации и целостности данных, устойчивы к коллизиям и имеют достаточную длину. | 2 | +| **11.4.4** | Убедитесь, что приложение использует утвержденную функцию генерации ключа с использованием параметров расширения ключа (key stretching) при генерации ключа из пароля. Параметры должны быть сбалансированы с точки зрения безопасности, производительности и устойчивости к атакам полного перебора при компрометации результирующего криптографического ключа. | 2 | + +## V11.5 Случайные значения + +Криптографически стойкая генерация псевдослучайных чисел (Cryptographically secure Pseudo-random Number Generation (CSPRNG)) чрезвычайно сложна для правильной реализации. Как правило, хорошие источники энтропии в системе быстро истощаются при чрезмерном использовании, тогда как источники с меньшей степенью случайности могут приводить к предсказуемым ключам и секретам. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **11.5.1** | Убедитесь, что все случайные числа и строки, которые должны быть непредсказуемы, должны быть сгенерированы с помощью CSPRNG и иметь хотя бы 128 бит энтропии. Учтите, что UUID не удовлетворяют данному условию. | 2 | +| **11.5.2** | Убедитесь, что механизм генерации случайных чисел является надежным даже при высокой нагрузке. | 3 | + +## V11.6 Криптография с публичным ключом + +Криптография с публичным ключом используется там, где невозможно или нежелательно распределять ключ между несколькими сторонами. + +Также существует потребность в утвержденных методах обмена ключами, таких как Diffie-Hellman (DH) и Elliptic Curve Diffie-Hellman (ECDH), чтобы убедиться, что криптосистема остается безопасной к современным угрозам. Раздел «Безопасная коммуникация» содержит требования для TLS, так что требования данной секции применимы в ситуациях, где криптография с открытым ключом используется отдельно от TLS. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **11.6.1** | Убедитесь, что только утвержденные криптографические алгоритмы и режимы операций используются для генерации ключа и инициализации случайного значения для его генерации (seeding), а также для генерации цифровой подписи и верификации. Алгоритмы генерации ключей не должны генерировать небезопасные ключи уязвимые к известным атакам, например, ключи RSA уязвимы к факторизации Ферма. | 2 | +| **11.6.2** | Убедитесь, что для обмена ключами используются утверждённые криптографические алгоритмы (например, Диффи-Хеллман) с особым вниманием к обеспечению использования безопасных параметров. Это предотвратит атаки на процесс установления ключа, которые могут привести к атакам «человек посередине» или криптографическим взломам. | 3 | + +## V11.7 Шифрование данных в процессе использования + +Защита данных во время их обработки имеет первостепенное значение. Рекомендуется использовать такие методы, как полное шифрование памяти, шифрование данных при передаче, а также обеспечение как можно более быстрого шифрования данных после их использования. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **11.7.1** | Убедитесь, что используется полное шифрование памяти, которое защищает конфиденциальные данные во время их использования, предотвращая доступ к ним неавторизованных пользователей или процессов. | 3 | +| **11.7.2** | Убедитесь, что минимизация данных обеспечивает раскрытие минимально необходимого объёма данных во время обработки, а также что данные шифруются сразу после использования или как можно скорее. | 3 | + +## Ссылки + +Для дополнительной информации см. также: + +* [OWASP Web Security Testing Guide: Testing for Weak Cryptography](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography) +* [OWASP Cryptographic Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html) +* [FIPS 140-3](https://csrc.nist.gov/pubs/fips/140-3/final) +* [NIST SP 800-57](https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final) diff --git a/5.0/ru/0x21-V12-Secure-Communication.md b/5.0/ru/0x21-V12-Secure-Communication.md new file mode 100644 index 0000000000..531de161f5 --- /dev/null +++ b/5.0/ru/0x21-V12-Secure-Communication.md @@ -0,0 +1,57 @@ +# V12 Безопасная коммуникация + +## Задачи контроля + +В этой главе изложены требования, связанные с механизмами защиты данных при передаче, как между клиентом конечного пользователя и серверной частью, так и между компонентами внутренней сервисной архитектуры. + +Основные концепции главы: + +* Шифрование внешних коммуникаций, а в идеале — и внутри системы. +* Настройку механизмов шифрования в соответствии с актуальными рекомендациями, включая предпочтительные алгоритмы и шифры. +* Использование подписанных сертификатов для защиты от перехвата данных третьими лицами. + +Кроме того, помимо общих принципов и лучших практик, ASVS предоставляет более глубокую техническую информацию о криптографической стойкости в Приложении C - Стандарты криптографии. + +## V12.1 Общие рекомендации по безопасности TLS + +В этом разделе приводятся первоначальные рекомендации по обеспечению безопасности TLS-соединений. Для постоянного контроля конфигурации TLS следует использовать актуальные инструменты. + +Хотя использование универсальных (wildcard) TLS-сертификатов само по себе не является небезопасным, компрометация такого сертификата, который используется во всех управляемых окружениях (например, в production, staging, development, test), может привести к нарушению безопасности приложений, использующих этот сертификат. Поэтому при возможности рекомендуется применять надёжную защиту, управление и использовать отдельные TLS-сертификаты для разных сред. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **12.1.1** | Убедитесь, что включены только актуальные и рекомендуемые версии протокола TLS, такие как TLS 1.2 и TLS 1.3. Наиболее свежая версия TLS должна быть выбрана как предпочтительная. | 1 | +| **12.1.2** | Убедитесь, что включены рекомендуемые шифронаборы (cipher suites), предпочтение также стоит отдать самому сильному шифронабору. L3 приложения должны поддерживать только те наборы шифров (cipher suites), которые обеспечивают прямую (forward) секретность. Пояснение: Прямая секретность (Forward Secrecy, FS) — это криптографическая особенность, при которой сессионные ключи уникальны для каждой сессии и не зависят от долгосрочных ключей. Это гарантирует, что даже при компрометации долгосрочного ключа злоумышленник не сможет расшифровать ранее перехваченные зашифрованные сессии. | 2 | +| **12.1.3** | Убедитесь, что приложение проверяет доверенность клиентских сертификатов mTLS, прежде чем использовать идентификацию по сертификату для аутентификации или авторизации. | 2 | +| **12.1.4** | Убедитесь, что включена и настроена правильная проверка отзыва сертификатов, такая как Online Certificate Status Protocol (OCSP) Stapling. | 3 | +| **12.1.5** | Убедитесь, что в настройках TLS приложения включена функция Encrypted Client Hello (ECH) для предотвращения раскрытия конфиденциальных метаданных, таких как Server Name Indication (SNI), во время процесса TLS-рукопожатия. | 3 | + +## V12.2 HTTPS коммуникация с внешними сервисами + +Убедитесь, что весь HTTP-трафик к внешним сервисам, которые предоставляет приложение, передавался в зашифрованном виде с использованием публично доверенных сертификатов. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **12.2.1** | Убедитесь, что для всех соединений между клиентом и внешними HTTP-сервисами используется TLS и не происходит отката к небезопасным или незашифрованным протоколам. | 1 | +| **12.2.2** | Убедитесь, что внешние сервисы используют публично доверенные TLS-сертификаты. | 1 | + +## V12.3 Общая безопасность межсервисного взаимодействия + +Все взаимодействия между серверами (включая внутренние и внешние подключения) должны быть защищены, предпочтительно с применением TLS-шифрования. Соединения с другими системами также должны быть защищены, желательно с использованием TLS. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **12.3.1** | Убедитесь, что для всех входящих и исходящих соединений приложения используется зашифрованный протокол, например TLS, включая системы мониторинга, инструменты управления, удалённый доступ и SSH, промежуточное ПО, базы данных, мейнфреймы, партнёрские системы и внешние API. Сервер не должен допускать откат к небезопасным или незашифрованным протоколам. | 2 | +| **12.3.2** | Убедитесь, что TLS-клиент проверяет сертификат сервера до установления защищенного соединения с TLS-сервером. | 2 | +| **12.3.3** | Убедитесь, что все внутренние HTTP-взаимодействия между компонентами приложения используют TLS или другой подходящий механизм транспортного шифрования, и не происходит откат к небезопасным или незашифрованным коммуникациям. | 2 | +| **12.3.4** | Убедитесь, что TLS-соединения между внутренними сервисами используют доверенные сертификаты. Если используются внутренние или самоподписанные сертификаты, потребляющий сервис должен быть настроен на доверие только к конкретным внутренним центрам сертификации (CA) и конкретным самоподписанным сертификатам. | 2 | +| **12.3.5** | Убедитесь, что сервисы, взаимодействующие внутри системы (intra-service communications), используют строгую аутентификацию для проверки каждого конечного узла. Для проверки подлинности взаимодействующих сторон должны применяться методы строгой аутентификации, такие как аутентификация TLS-клиента, с использованием инфраструктуры открытых ключей и механизмов, устойчивых к атакам повтора (replay attacks). Для микросервисных архитектур рекомендуется использование service mesh для упрощения управления сертификатами и повышения безопасности. | 3 | + +## Ссылки + +Для дополнительной информации см. также: + +* [OWASP - Transport Layer Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html) +* [Mozilla's Server Side TLS configuration guide](https://wiki.mozilla.org/Security/Server_Side_TLS) +* [Mozilla's tool to generate known good TLS configurations](https://ssl-config.mozilla.org/). +* [O-Saft - OWASP Project to validate TLS configuration](https://owasp.org/www-project-o-saft/) diff --git a/5.0/ru/0x22-V13-Configuration.md b/5.0/ru/0x22-V13-Configuration.md new file mode 100644 index 0000000000..79b0cf80a5 --- /dev/null +++ b/5.0/ru/0x22-V13-Configuration.md @@ -0,0 +1,68 @@ +# V13 Конфигурация + +## Задачи контроля + +Стандартная конфигурация приложения должна быть безопасной для использования в Интернете. + +В этой главе приводятся рекомендации по различным настройкам, необходимым для достижения этого, включая те, которые применяются на этапах разработки, сборки и развертывания. + +Рассматриваемые темы включают предотвращение утечек данных, безопасное управление коммуникациями между компонентами и защиту секретов. + +## V13.1 Документация конфигурации + +Этот раздел описывает требования к документации, связанные с тем, как приложение взаимодействует с внутренними и внешними сервисами, а также методы предотвращения потери доступности из-за недоступности сервисов. Также рассматриваются вопросы, касающиеся документации секретных данных. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **13.1.1** | Убедитесь, что все необходимые доступы приложения задокументированы. Сюда должны быть включены как внешние сервисы, от которых зависит приложение, так и сценарии, когда конечный пользователь может задавать адреса для внешнего подключения. | 2 | +| **13.1.2** | Убедитесь, что для каждого сервиса, используемого приложением, в документации определено максимальное количество одновременных соединений (например, лимиты пула соединений) и описано поведение приложения при достижении этого лимита, включая любые механизмы отказоустойчивости или восстановления, чтобы предотвратить ситуации отказа в обслуживании (DoS). | 3 | +| **13.1.3** | Убедитесь, что в документации приложения определены стратегии управления ресурсами для каждой внешней системы или сервиса, которые оно использует (например, базы данных, файловые дескрипторы, потоки, HTTP-соединения). Стратегии должны включать процедуры освобождения ресурсов, настройки таймаутов, обработку сбоев, а также, если реализована логика повторных попыток, указание лимитов, задержек и алгоритмов back-off. Для синхронных HTTP-запросов должны быть заданы короткие таймауты, а повторные запросы должны быть отключены, либо строго ограничены по числу попыток, чтобы предотвратить каскадные задержки и истощение ресурсов. | 3 | +| **13.1.4** | Убедитесь, что в документации приложения определены секреты, критически важные для безопасности приложения, а также установлен график их ротации в соответствии с моделью угроз организации и её бизнес-требованиями. | 3 | + +## V13.2 Конфигурация бэкенд соединений + +Приложения взаимодействуют с множеством сервисов, включая API, базы данных и другие компоненты. Эти сервисы могут считаться внутренними для приложения, но не включёнными в стандартные механизмы контроля доступа приложения, либо быть полностью внешними. В любом случае необходимо настроить приложение для безопасного взаимодействия с этими компонентами и, при необходимости, защитить соответствующую конфигурацию. + +Важно: Глава «Безопасная коммуникация» содержит рекомендации по шифрованию данных при передаче. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **13.2.1** | Убедитесь, что коммуникации между компонентами бэкенда приложения (включая API, промежуточное ПО и уровни данных), которые не поддерживают стандартный механизм пользовательских сессий, проходят с аутентификацией. Аутентификация должна использовать индивидуальные сервисные аккаунты, краткосрочные токены или аутентификацию на основе сертификатов, а не постоянные учётные данные, такие как пароли, API-ключи или общие аккаунты с привилегированным доступом. | 2 | +| **13.2.2** | Убедитесь, что коммуникации между компонентами бэкенда приложения, включая локальные или системные службы, API, промежуточное ПО и уровни данных, выполняются с использованием аккаунтов, которым назначены минимально необходимые привилегии. | 2 | +| **13.2.3** | Убедитесь, что если для аутентификации в сервисе используются учётные данные, то используемые потребителем учётные данные не являются стандартными (например, root/root или admin/admin). | 2 | +| **13.2.4** | Убедитесь, что используется белый список (allowlist) для определения внешних ресурсов или систем, с которыми приложению разрешено взаимодействовать (например, для исходящих запросов, загрузки данных или доступа к файлам). Этот белый список может быть реализован на уровне приложения, веб-сервера, межсетевого экрана или комбинации различных уровней. | 2 | +| **13.2.5** | Убедитесь, что веб- или прикладной сервер настроен с белым списком ресурсов или систем, к которым сервер может отправлять запросы или из которых может загружать данные и файлы. | 2 | +| **13.2.6** | Убедитесь, что при подключении приложения к другим сервисам соблюдается задокументированная конфигурация для каждого соединения, включая максимальное количество параллельных соединений, поведение при достижении их максимума, таймауты и стратегии повторных попыток подключения. | 3 | + +## V13.3 Управление секретами + +Управление секретами — это важная задача конфигурации, необходимая для обеспечения защиты данных, используемых в приложении. Конкретные требования к криптографии изложены в главе «Криптография», а данный раздел сосредоточен на аспектах управления и обработки секретов. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **13.3.1** | Убедитесь, что для безопасного создания, хранения, контроля доступа и уничтожения секретов бэкенда используется решение для управления секретами, например, хранилище ключей (key vault). Секретами могут быть пароли, ключевой материал, интеграции с базами данных и сторонними системами, ключи и seed-значения для токенов с ограниченным временем действия, другие внутренние секреты и API-ключи. Секреты не должны включаться в исходный код приложения или артефакты сборки. Для приложений уровня L3 необходимо использовать аппаратное решение, например, аппаратный модуль безопасности (HSM). | 2 | +| **13.3.2** | Убедитесь, что доступ к секретным ресурсам осуществляется в соответствии с принципом минимально необходимых привилегий (least privilege). | 2 | +| **13.3.3** | Убедитесь, что все криптографические операции выполняются с использованием изолированного модуля безопасности (например, хранилища ключей или аппаратного модуля безопасности), чтобы надежно управлять ключевым материалом и защищать его от утечки за пределы модуля безопасности. | 3 | +| **13.3.4** | Убедитесь, что секреты настроены на срок действия и ротацию в соответствии с документацией приложения. | 3 | + +## V13.4 Непреднамеренная утечка информации + +Конфигурации в промышленной среде должны быть усилены, чтобы избежать раскрытия избыточных данных. Многие из подобных проблем редко оцениваются как значительные риски, но часто используются в связке с другими уязвимостями. Если таких проблем нет по умолчанию, это повышает уровень защиты приложения. + +Например, скрытие версии серверных компонентов не отменяет необходимости обновлять все компоненты, а отключение отображения содержимого папок не исключает необходимости использовать механизмы авторизации или хранить файлы вне публичных каталогов, но всё это повышает уровень безопасности. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **13.4.1** | Убедитесь, что приложение развернуто либо без метаданных систем контроля версий (включая папки .git или .svn), либо так, чтобы эти папки были недоступны как извне, так и для самого приложения. | 1 | +| **13.4.2** | Убедитесь, что режимы отладки отключены для всех компонентов в промышленной среде, чтобы предотвратить раскрытие функций отладки и утечку информации. | 2 | +| **13.4.3** | Убедитесь, что веб-серверы не показывают клиентам списки содержимого каталогов, если это явно не предусмотрено. | 2 | +| **13.4.4** | Убедитесь, что метод HTTP TRACE не поддерживается в продуктовой среде, чтобы избежать потенциальной утечки информации. | 2 | +| **13.4.5** | Убедитесь, что документация (например, по внутренним API) и мониторинговые эндпоинты не доступны, если это явно не предусмотрено. | 2 | +| **13.4.6** | Убедитесь, что приложение не раскрывает подробную информацию о версиях компонентов бэкенда. | 3 | +| **13.4.7** | Убедитесь, что веб-слой настроен на обслуживание только файлов с определёнными расширениями, чтобы предотвратить непреднамеренную утечку информации, конфигураций и исходного кода. | 3 | + +## Ссылки + +Для дополнительной информации см. также: + +* [OWASP Web Security Testing Guide: Configuration and Deployment Management Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing) diff --git a/5.0/ru/0x23-V14-Data-Protection.md b/5.0/ru/0x23-V14-Data-Protection.md new file mode 100644 index 0000000000..b403f6c5be --- /dev/null +++ b/5.0/ru/0x23-V14-Data-Protection.md @@ -0,0 +1,60 @@ +# V14 Защита информации + +## Задачи контроля + +Приложения не могут предусмотреть все сценарии использования и поведение пользователей, поэтому они должны реализовывать механизмы, ограничивающие несанкционированный доступ к конфиденциальным данным на устройствах клиентов. + +В эту главу входят требования, связанные с определением перечня данных, подлежащих защите, методы их защиты, а также конкретные механизмы реализации и ошибки, которых следует избегать. + +Ещё один важный аспект защиты данных — предотвращение массового извлечения, изменения или чрезмерного использования данных. Требования для каждой системы, вероятно, будут сильно различаться, поэтому определение «аномального» поведения должно основываться на модели угроз и бизнес-рисках. С точки зрения ASVS, обнаружение таких проблем рассматривается в главе «Журналирование событий безопасности и обработка ошибок», а установка ограничений — в главе «Валидация и бизнес-логика». + +## V14.1 Документация по защите информации + +Ключевым условием для защиты данных является классификация данных по уровню конфиденциальности. Данные следует классифицировать по нескольким уровням конфиденциальности, где для каждого уровня требуются разные меры защиты. + +Существует множество законов и нормативных актов в области защиты персональных данных, которые определяют то, как приложения должны подходить к хранению, использованию и передаче конфиденциальных данных. Этот раздел не пытается дублировать такие законы и нормы, а сосредоточен на ключевых технических аспектах защиты чувствительных данных. При работе с данными следует учитывать требования местного законодательства и нормативных актов, а при необходимости консультироваться с профильным специалистом по защите данных или юристом. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **14.1.1** | Убедитесь, что все конфиденциальные данные, создаваемые и обрабатываемые приложением, идентифицированы и классифицированы по уровням защиты. Включая закодированные данные, которые легко декодируются, например, строки Base64 или незашифрованные данные в полезной нагрузке JWT. Уровни защиты должны учитывать требования по защите данных и конфиденциальности, которым должно соответствовать приложение. | 2 | +| **14.1.2** | Убедитесь, что для каждого уровня защиты конфиденциальных данных требования к защите задокументированы. Они должны включать (но не ограничиваться) требования по шифрованию, проверке целостности, срокам хранения, способам логирования данных, контролю доступа к чувствительным данным в логах, шифрованию на уровне базы данных, применению технологий повышения конфиденциальности, а также другим требованиям по конфиденциальности. | 2 | + +## V14.2 Базовые меры по защите информации + +Этот раздел содержит различные практические требования, связанные с защитой данных. Большинство из них направлены на непреднамеренную утечку данных, но также есть общее требование — реализовывать меры защиты в зависимости от необходимого уровня защиты для каждого типа данных. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **14.2.1** | Убедитесь, что конфиденциальные данные передаются на сервер только в теле HTTP-запроса или в заголовках. URL и строка запроса не должны содержать конфиденциальную информацию, такую как API-ключ или сессионный токен. | 1 | +| **14.2.2** | Убедитесь, что приложение предотвращает кэширование конфиденциальных данных в серверных компонентах, таких как балансировщики нагрузки и кэши приложений, либо гарантирует их надежное удаление после использования. | 2 | +| **14.2.3** | Убедитесь, что заранее определённые конфиденциальные данные не отправляются ненадёжным сторонам (например, системам трекинга пользователей), чтобы предотвратить нежелательный сбор данных вне контроля приложения. | 2 | +| **14.2.4** | Убедитесь, что для конфиденциальных данных реализованы меры по шифрованию, проверке целостности, срокам хранения, способам логирования, контролю доступа к данным в логах, а также применяются технологии повышения конфиденциальности в соответствии с документацией для соответствующего уровня защиты данных. | 2 | +| **14.2.5** | Убедитесь, что механизмы кэширования настроены так, чтобы кэшировать только ответы с ожидаемым типом содержимого для данного ресурса и не содержать конфиденциального динамического контента. При обращении к несуществующему файлу, веб-сервер должен возвращать ответ 404 или 302, а не подменять на другой существующий файл, что позволит предотвратить атаки типа Web Cache Deception. | 3 | +| **14.2.6** | Убедитесь, что приложение возвращает только минимально необходимый объем конфиденциальных данных для выполнения своей функциональности. Например, показывает только часть цифр номера кредитной карты, а не полный номер. Если требуется отображение полных данных, они должны быть замаскированы в пользовательском интерфейсе, пока пользователь специально не запросил их просмотр. | 3 | +| **14.2.7** | Убедитесь, что конфиденциальная информация подлежит классификации по срокам хранения, чтобы устаревшие или ненужные данные удалялись автоматически, по расписанию или по мере необходимости. | 3 | +| **14.2.8** | Убедитесь, что конфиденциальная информация удаляется из метаданных файлов, загружаемых пользователями, если пользователь явно не согласился на ее хранение. | 3 | + +## V14.3 Защита данных на стороне клиента + +В этом разделе содержатся требования, направленные на предотвращение утечки данных на стороне клиента или user agent приложения. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **14.3.1** | Убедитесь, что аутентифицированные данные очищаются из клиентского хранилища, например, из DOM браузера, после завершения работы клиента или сессии. Заголовок HTTP-ответа Clear-Site-Data может помочь в этом, но клиентская сторона также должна уметь очищать данные, если соединение с сервером недоступно при завершении сессии. | 1 | +| **14.3.2** | Убедитесь, что приложение устанавливает HTTP-заголовки, достаточные для предотвращения кэширования (например, Cache-Control: no-store), чтобы конфиденциальные данные не сохранялись в браузерах. | 2 | +| **14.3.3** | Убедитесь, что данные, хранящиеся в браузерном хранилище (например, localStorage, sessionStorage, IndexedDB или cookie), не содержат конфиденциальной информации, за исключением сессионных токенов. | 2 | + +## Ссылки + +Для дополнительной информации см. также: + +* [Consider using the Security Headers website to check security and anti-caching header fields](https://securityheaders.com/) +* [Documentation about anti-caching headers by Mozilla](https://developer.mozilla.org/en-US/docs/Web/HTTP/Caching) +* [OWASP Secure Headers project](https://owasp.org/www-project-secure-headers/) +* [OWASP Privacy Risks Project](https://owasp.org/www-project-top-10-privacy-risks/) +* [OWASP User Privacy Protection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/User_Privacy_Protection_Cheat_Sheet.html) +* [Australian Privacy Principle 11 - Security of personal information](https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-11-app-11-security-of-personal-information) +* [European Union General Data Protection Regulation (GDPR) overview](https://www.edps.europa.eu/data-protection_en) +* [European Union Data Protection Supervisor - Internet Privacy Engineering Network](https://www.edps.europa.eu/data-protection/ipen-internet-privacy-engineering-network_en) +* [Information on the "Clear-Site-Data" header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Clear-Site-Data) +* [White paper on Web Cache Deception](https://www.blackhat.com/docs/us-17/wednesday/us-17-Gil-Web-Cache-Deception-Attack-wp.pdf) diff --git a/5.0/ru/0x24-V15-Secure-Coding-and-Architecture.md b/5.0/ru/0x24-V15-Secure-Coding-and-Architecture.md new file mode 100644 index 0000000000..49a5c2c210 --- /dev/null +++ b/5.0/ru/0x24-V15-Secure-Coding-and-Architecture.md @@ -0,0 +1,77 @@ +# V15 Безопасная разработка и архитектура + +## Задачи контроля + +Многие требования ASVS относятся либо к конкретной области безопасности, такой как аутентификация или авторизация, либо к определённому типу функциональности приложения, например, к логированию или работе с файлами. + +В этой главе представлены общие требования безопасности, которые следует учитывать при проектировании и разработке приложений. Эти требования касаются не только чистоты архитектуры и качества кода, но и конкретных практик проектирования и программирования, необходимых для обеспечения безопасности приложений. + +## V15.1 Документация по безопасной разработке и архитектуре + +Многие требования по созданию безопасной и защищенной архитектуры зависят от четкого документирования решений, принятых в отношении реализации конкретных механизмов безопасности и компонентов, используемых в приложении. + +В этом разделе излагаются требования к документации, включая определение компонентов, которые считаются содержащими «опасную функциональность» или «рискованными компонентами». + +Компонент с «опасной функциональностью» может быть разработан внутри компании или представлять собой внешнюю зависимость, который выполняет такие операции, как десериализация ненадежных данных, парсинг необработанных файлов или двоичных данных, динамическое выполнение кода или непосредственное управление памятью. Уязвимости в таких операциях создают высокий риск компрометации приложения и его инфраструктуры. + +«Компонент с повышенным риском» — это сторонняя библиотека (т.е. не разработанная внутри компании) с отсутствующими или неэффективно реализованными средствами контроля безопасности в отношении процессов разработки или функциональности. Примерами служат компоненты, которые не поддерживаются, находятся на этапе завершения жизненного цикла или ранее содержали серьезные уязвимости. + +В этом разделе также подчеркивается важность определения соответствующих сроков устранения уязвимостей в сторонних компонентах. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **15.1.1** | Убедитесь, что в документации по приложению определены сроки устранения уязвимостей на основе оценки рисков для внешних зависимостей с уязвимостями и для обновления библиотек в целом, чтобы минимизировать риск, связанный с этими компонентами. | 1 | +| **15.1.2** | Убедитесь, что ведется реестр всех используемых сторонних библиотек (например, Software Bill of Materials, SBOM), с обязательной проверкой, что компоненты получены из предопределенных, доверенных и регулярно поддерживаемых репозиториев. | 2 | +| **15.1.3** | Убедитесь, что в документации приложения указан функционал, требующий значительных временных или вычислительных ресурсов. Необходимо указать, как предотвратить потерю доступности из-за чрезмерного использования этого функционала и как избежать ситуаций, когда формирование ответа занимает больше времени, чем установленный системой таймаут. Возможные меры защиты могут включать асинхронную обработку, использование очередей и ограничение количества параллельных процессов для каждого пользователя и приложения. | 2 | +| **15.1.4** | Убедитесь, что в документации приложения указаны внешние библиотеки, которые считаются «компонентами с повышенным риском». | 3 | +| **15.1.5** | Убедитесь, что в документации приложения выделены те части приложения, в которых используются «функционал с повышенным риском». | 3 | + +## V15.2 Архитектура безопасности и зависимости + +В этом разделе содержатся требования по работе с уязвимыми, устаревшими и небезопасными зависимостями и компонентами посредством управления зависимостями. + +Он также включает использование методов архитектурного уровня, таких как «песочница», инкапсуляция, контейнеризация и сетевая изоляция, для снижения влияния использования «операций с повышенным риском» и «компонентов с повышенным риском» (как определено в предыдущем разделе) и предотвращения потери доступности из-за чрезмерного использования ресурсоемких функций. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **15.2.1** | Убедитесь, что приложение содержит только те компоненты, которые не нарушили задокументированные сроки обновления и исправления. | 1 | +| **15.2.2** | Убедитесь, что в приложении реализованы меры защиты от потери доступности из-за функциональности, требующей много времени или ресурсов, на основе задокументированных решений и стратегий безопасности для этого. | 2 | +| **15.2.3** | Убедитесь, что производственная среда включает только те функции, которые необходимы для работы приложения, и не предоставляет лишние функции, такие как тестовый код, примеры кода и инструменты разработки. | 2 | +| **15.2.4** | Убедитесь, что сторонние компоненты и все их транзитивные зависимости загружаются только из ожидаемых репозиториев (внутренних или внешних) и отсутствует риск атаки через подмену зависимостей (dependency confusion attack) | 3 | +| **15.2.5** | Убедитесь, что приложение реализует дополнительные меры защиты для тех частей приложения, которые документированы как содержащие «функционал с повышенным риском» или использующие сторонние библиотеки, считающиеся «функционалом с повышенным риском». Это могут быть такие методы, как «песочница», инкапсуляция, контейнеризация или изоляция на сетевом уровне, чтобы задержать и предотвратить продвижение (pivoting) злоумышленников, скомпрометировавших одну часть приложения, к другим частям приложения. | 3 | + +## V15.3 Безопасное программирование + +В этом разделе рассматриваются типы уязвимостей, включая type juggling, prototype pollution и другие, возникающие из-за использования небезопасных паттернов программирования на конкретном языке. Некоторые уязвимости актуальны не для всех языков, тогда как другие требуют исправлений, зависящих от конкретного языка программирования, или связаны с особенностями обработки функций (например, HTTP-параметров) в конкретном языке или фреймворке. Также рассматривается риск установки обновлений приложения без криптографической проверки. + +В данном разделе также рассматриваются риски, связанные с использованием объектов для представления данных и их передачей через внешние API. В этом случае приложение должно гарантировать, что поля данных, которые не должны быть доступны для записи, не будут изменены пользовательским вводом (mass assignment), и что API избирательно определяет, какие поля данных возвращаются. Если доступ к полю зависит от прав пользователя, это следует рассматривать в контексте требования к контролю доступа на уровне полей в главе «Авторизация». + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **15.3.1** | Убедитесь, что приложение возвращает только необходимое подмножество полей из объекта данных. Например, оно не должно возвращать весь объект данных, поскольку некоторые отдельные поля должны быть недоступны пользователям. | 1 | +| **15.3.2** | Убедитесь, что при вызовах внешних URL-адресов бэкэнд приложения настроен так, чтобы не выполнять перенаправления, если только это не предусмотрено функционалом. | 2 | +| **15.3.3** | Убедитесь, что в приложении реализованы защитные механизмы против атак типа массового присвоения (mass assignment) путем строгого ограничения разрешенных полей для каждого контроллера и действия, исключая возможность добавления или изменения значений полей, которые не должны быть доступны для данной конкретной операции. | 2 | +| **15.3.4** | Убедитесь, что все прокси и промежуточное ПО корректно передают исходный IP-адрес пользователя, используя доверенные поля данных, которые не могут быть изменены конечным пользователем, а приложение и веб-сервер используют это правильное значение для ведения логирования и принятия решений по безопасности, таких как ограничение запросов. При этом следует учитывать, что даже исходный IP-адрес может быть ненадежным из-за динамических IP-адресов, VPN или корпоративных файрволов. | 2 | +| **15.3.5** | Убедитесь, что приложение явно проверяет соответствие переменных ожидаемому типу данных и использует строгие операции сравнения. Это необходимо для предотвращения уязвимостей, связанных с type juggling и type confusion, вызванных тем, что код приложения делает предположения о типе переменной. | 2 | +| **15.3.6** | Убедитесь, что JavaScript-код написан таким образом, чтобы предотвратить prototype pollution, например, используя Set() или Map() вместо обычных литералов объекта. | 2 | +| **15.3.7** | Убедитесь, что приложение защищено от атак типа HTTP Parameter Pollution (HPP), особенно если используемый фреймворк не различает источники параметров запроса (строка запроса, тело запроса, куки или заголовки). | 2 | + +## V15.4 Безопасная работа с параллельными процессами + +Проблемы безопасности работы параллельных процессов, такие как состояния гонки (race conditions), уязвимости типа «проблем синхронизации проверки и использования ресурсов» (TOCTOU), взаимные блокировки (deadlocks), постоянно повторяющиеся блокировки (livelocks), нехватка ресурсов у потоков (thread starvation) и некорректная синхронизация (improper synchronization), могут приводить к неожиданному поведению системы и создавать угрозы безопасности. В этом разделе рассматриваются различные методы и стратегии, помогающие снизить эти риски. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **15.4.1** | Убедитесь, что к общим объектам в многопоточном коде (например, кэшам, файлам или объектам в памяти, используемым несколькими потоками) используется безопасный многопоточный доступ и механизмов синхронизации, таких как блокировки или семафоры, чтобы избежать состояний гонки и повреждения данных. | 3 | +| **15.4.2** | Убедитесь, что проверки состояния ресурса, например его существования или разрешений, а также зависящие от него действия выполняются как одна атомарная операция, чтобы предотвратить условия гонки времени проверки и времени использования (TOCTOU). Например, проверка существования файла перед его открытием или проверка прав доступа пользователя перед его предоставлением. | 3 | +| **15.4.3** | Убедитесь, что блокировки применяются согласованно, чтобы предотвратить взаимные блокировки потоков (deadlocks) или их бесконечные повторы, а также что логика блокировки инкапсулирована в коде, отвечающем за управление ресурсом. Это гарантирует, что блокировки не могут быть случайно или намеренно изменены внешними классами или кодом. | 3 | +| **15.4.4** | Убедитесь, что политики распределения ресурсов предотвращают нехватку ресурсов у потоков, обеспечивая справедливый доступ к ресурсам, например, используя пулы потоков, позволяя потокам с более низким приоритетом выполняться в течение разумного периода времени. | 3 | + +## Ссылки + +Для дополнительной информации см. также: + +* [OWASP Prototype Pollution Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html) +* [OWASP Mass Assignment Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html) +* [OWASP CycloneDX Bill of Materials Specification](https://owasp.org/www-project-cyclonedx/) +* [OWASP Web Security Testing Guide: Testing for HTTP Parameter Pollution](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/07-Input_Validation_Testing/04-Testing_for_HTTP_Parameter_Pollution) diff --git a/5.0/ru/0x25-V16-Security-Logging-and-Error-Handling.md b/5.0/ru/0x25-V16-Security-Logging-and-Error-Handling.md new file mode 100644 index 0000000000..9ad8c623c1 --- /dev/null +++ b/5.0/ru/0x25-V16-Security-Logging-and-Error-Handling.md @@ -0,0 +1,84 @@ +# V16 Журналирование событий безопасности и обработка ошибок + +## Задачи контроля + +Журналы безопасности отличаются от журналов ошибок или производительности и служат для записи событий, связанных с безопасностью, таких как решения по аутентификации, контроль доступа или попытки обхода механизмов защиты (например, проверка входных данных или бизнес-логики). Их основная задача — обеспечить обнаружение, реагирование и расследование инцидентов за счёт предоставления структурированных данных с высокой информативной ценностью для аналитических систем, таких как SIEM. + +Журналы не должны содержать конфиденциальные персональные данные, если это не предусмотрено законом, а все залогированные сведения должны защищаться как актив высокой важности. Процесс журналирования не должен нарушать конфиденциальность или безопасность системы. Кроме того, приложения должны отрабатывать ошибки безопасным образом, исключая необоснованное раскрытие информации или disruption (нарушение работы). + +Подробные инструкции по внедрению см. в OWASP Cheat Sheets в разделе ссылок. + +## V16.1 Документация по ведению логов + +Этот раздел обеспечивает четкий и полный учет журналирования во всем стеке приложения. Это необходимо для эффективного мониторинга безопасности, реагирования на инциденты и соответствия требованиям. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **16.1.1** | Убедитесь в существовании реестра, в котором документируется ведение журнала на каждом уровне технологического стека приложения, включая какие события регистрируются, форматы логов, где хранятся эти журналы, как они используются, как контролируется доступ к ним и как долго хранятся журналы. | 2 | + +## V16.2 Общее журналирование + +В этом разделе устанавливаются требования, обеспечивающие единообразную структуру журналов безопасности и наличие метаданных. Цель — обеспечить машиночитаемость логов и возможность их анализа в распределённых системах и инструментах мониторинга. + +Естественно, события безопасности часто связаны с конфиденциальными данными. Если такие данные регистрируются без должного внимания, сами журналы становятся секретными и, следовательно, подпадают под действие требований шифрования (прим. автора - законодательства), более строгих политик хранения и могут быть раскрыты в ходе аудита. + +Крайне важно регистрировать только необходимые данные и обращаться с данными журналов с той же осторожностью, что и с другими конфиденциальными активами. + +Приведенные ниже требования устанавливают основополагающие требования к регистрации метаданных, синхронизации, форматированию и контролю. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **16.2.1** | Убедитесь, что каждая запись журнала содержит необходимые метаданные (например, когда, где, кто, что), которые позволят провести подробное исследование временной шкалы, когда произошло событие. | 2 | +| **16.2.2** | Убедитесь, что все источники времени компонентов системы журналирования синхронизированы, а временные метки в метаданных событий безопасности используют UTC или содержат явное указание смещения часового пояса. Рекомендуется применять UTC для обеспечения согласованности в распределённых системах и предотвращения ошибок при переходе на летнее/зимнее время. | 2 | +| **16.2.3** | Убедитесь, что приложение записывает и передаёт логи исключительно в те файлы и сервисы, которые указаны в реестре журналирования. | 2 | +| **16.2.4** | Убедитесь, что логи могут быть прочитаны и коррелированы используемой системой обработки журналов, предпочтительно с использованием общего стандартного формата логирования. | 2 | +| **16.2.5** | Убедитесь, что приложение применяет соответствующие меры защиты при логировании конфиденциальных данных в зависимости от уровня их чувствительности: например, полностью запрещает запись в логи таких данных, как учетные данные или платежные реквизиты, а для других данных (например, сессионных токенов) использует хеширование или частичное/полное маскирование. | 2 | + +## V16.3 Инциденты безопасности + +В этом разделе определяются требования к журналированию событий безопасности в приложении. Фиксация этих событий критически важна для выявления подозрительной активности, проведения расследований и выполнения нормативных требований. + +В этом разделе описываются типы регистрируемых событий, но он не претендует на исчерпывающую информацию. Каждое приложение имеет уникальные факторы риска и эксплуатационный контекст. + +Обратите внимание, что, хотя ASVS включает регистрацию событий безопасности в свою область применения, функции оповещения и корреляции (например, правила SIEM или инфраструктура мониторинга) не входят в сферу применения и обрабатываются операционными системами и системами мониторинга. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **16.3.1** | Убедитесь, что все операции аутентификации регистрируются, включая успешные и неудачные попытки. Также следует фиксировать дополнительные метаданные, такие как тип аутентификации или использованные факторы проверки. | 2 | +| **16.3.2** | Убедитесь, что ведется журнал неудачных попыток авторизации. Для уровня L3 это должно включать в себя журналирование всех решений об авторизации, включая журналирование доступа к конфиденциальным данным (без регистрации самих конфиденциальных данных). | 2 | +| **16.3.3** | Убедитесь, что приложение регистрирует все события безопасности, определенные в документации, а также фиксирует попытки обхода механизмов защиты, включая проверку входных данных, бизнес-логики и системы защиты от автоматизированных атак. | 2 | +| **16.3.4** | Убедитесь, что приложение регистрирует в журналах неожиданные ошибки и сбои механизмов безопасности, включая, например, ошибки TLS-соединения на стороне сервера. | 2 | + +## V16.4 Защита журналов + +Журналы представляют собой ценные источники forensic-данных и должны быть надёжно защищены. Если логи можно легко изменить или удалить, они теряют целостность и становятся ненадёжными для расследования инцидентов или судебных разбирательств. Кроме того, журналы могут раскрывать внутреннюю логику работы приложения или содержать конфиденциальные метаданные, что делает их привлекательной целью для злоумышленников. + +В данном разделе определены требования, обеспечивающие защиту журналов от несанкционированного доступа, изменений и раскрытия и безопасную передачу и хранение в изолированных защищённых системах. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **16.4.1** | Убедитесь, что все компоненты системы логирования корректно кодируют данные, чтобы предотвратить атаки типа внедрения в журналы (log injection). | 2 | +| **16.4.2** | Убедитесь, что логи защищены от неавторизованного доступа и не могут быть модифицированы. | 2 | +| **16.4.3** | Убедитесь, что логи безопасно передаются в логически изолированную систему для анализа, обнаружения угроз, генерации оповещений и эскалации инцидентов. Это гарантирует сохранность журналов даже в случае компрометации основного приложения. | 2 | + +## V16.5 Обработка ошибок + +Данный раздел определяет требования к безопасному и корректному завершению работы приложений в случае сбоев, исключающему раскрытие конфиденциальной внутренней информации. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **16.5.1** | Убедитесь, что при возникновении непредвиденной или связанной с безопасностью ошибки пользователю возвращается только общее сообщение, гарантируя отсутствие раскрытия конфиденциальных внутренних данных системы, таких как трассировки стека, запросы, секретные ключи и токены. | 2 | +| **16.5.2** | Убедитесь, что приложение продолжает работать в безопасном режиме при недоступности внешних ресурсов, используя такие механизмы, как автоматические выключатели (circuit breakers) или плавное снижение функциональности (graceful degradation). | 2 | +| **16.5.3** | Убедитесь, что приложение корректно и безопасно завершает работу при возникновении исключений, предотвращая опасные сценарии по типу «fail-open», когда, например, транзакция ошибочно выполняется, несмотря на ошибки в логике валидации. | 2 | +| **16.5.4** | Убедитесь, что определён обработчик ошибок «крайние меры», который будет перехватывать все необработанные ошибки. Это необходимо как для предотвращения потери информации об ошибках, которая должна быть записана в файлы журналов, так и для того, чтобы ошибка не остановила весь процесс приложения, что привело бы к потере доступности. | 3 | + +Примечание: Некоторые языки программирования (включая Swift, Go и многие функциональные языки в силу их парадигмы) не поддерживают исключения или обработчики событий «крайней меры». В таких случаях архитекторам и разработчикам следует использовать подходы, соответствующие паттернам, языковым особенностям или возможностям фреймворка, чтобы гарантировать безопасную обработку исключительных, непредвиденных или связанных с безопасностью событий. + +## Ссылки + +Для дополнительной информации см. также: + +* [OWASP Web Security Testing Guide: Testing for Error Handling](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/README) +* [OWASP Authentication Cheat Sheet section about error messages](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#authentication-and-error-messages) +* [OWASP Logging Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html) +* [OWASP Application Logging Vocabulary Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Vocabulary_Cheat_Sheet.html) diff --git a/5.0/ru/0x26-V17-WebRTC.md b/5.0/ru/0x26-V17-WebRTC.md new file mode 100644 index 0000000000..fafc396930 --- /dev/null +++ b/5.0/ru/0x26-V17-WebRTC.md @@ -0,0 +1,75 @@ +# V17 WebRTC + +## Задачи контроля + +Web Real-Time Communication (WebRTC) — технология, обеспечивающая передачу голоса, видео и данных в реальном времени в современных приложениях. По мере роста WebRTC обеспечение безопасности инфраструктуры WebRTC становится критически важным. В данном разделе представлены требования по безопасности для разработчиков, хостинг-провайдеров и интеграторов решений на основе WebRTC. + +Рынок WebRTC можно разделить на три основных сегмента: + +1. Разработчики продуктов — поставщики, создающие и поставляющие продукты и решения WebRTC как с собственным, так и с открытым исходным кодом. Они специализируются на разработке надежных и безопасных технологий WebRTC, которые могут использоваться другими. + +2. Платформы коммуникаций как услуга (CPaaS) — провайдеры, предлагающие API, SDK и инфраструктуру для реализации WebRTC-функциональности. Они могут использовать продукты первой категории или разрабатывать собственное ПО WebRTC для предоставления этих услуг. + +3. Поставщики услуг — организации, внедряющие WebRTC-решения (на базе готовых продуктов или собственных разработок) для создания приложений для онлайн-конференций, здравоохранения, электронного обучения и других областей, где критически важна коммуникация в режиме реального времени. + +Изложенные здесь требования безопасности в первую очередь ориентированы на разработчиков продуктов, CPaaS-провайдеров, поставщиков услуг, которые: + +* Используют open-source решения для создания своих WebRTC-приложений. +* Применяют коммерческие WebRTC-продукты как часть своей инфраструктуры. +* Разрабатывают собственные WebRTC-решения или интегрируют различные компоненты в единый сервис. + +Важно отметить, что эти требования безопасности не распространяются на разработчиков, использующих исключительно SDK и API, предоставляемые поставщиками CPaaS. Для таких разработчиков CPaaS-провайдеры обычно несут ответственность за обеспечение базовой безопасности своей платформы, и универсальные стандарты безопасности (например, ASVS) могут не полностью покрывать их потребности. + +## V17.1 TURN-сервер + +В этом разделе определяются требования безопасности для систем, использующих собственные серверы TURN (Traversal Using Relays around NAT). Серверы TURN помогают ретранслировать медиаданные в сетевых средах с ограничениями, но могут представлять опасность при неправильной настройке. Эти меры контроля направлены на безопасную фильтрацию адресов и защиту от исчерпания ресурсов. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **17.1.1** | Убедитесь, что сервис TURN (Traversal Using Relays around NAT) разрешает доступ только к IP-адресам, не зарезервированным для специальных целей (например, внутренние сети, широковещательная рассылка, loopback-адреса). Данное требование применяется как к IPv4, так и к IPv6 адресам. | 2 | +| **17.1.2** | Убедитесь, что сервис TURN (Traversal Using Relays around NAT) защищен от исчерпания ресурсов при попытках легитимных пользователей открыть чрезмерное количество портов на сервере. | 3 | + +## V17.2 Требования к медиасерверам + +Данные требования применяются только к системам, использующим собственные WebRTC-медиасерверы, такие как, SFU (Selective Forwarding Units), MCU (Multipoint Control Units), серверы записи, шлюзовые серверы. Медиасерверы обрабатывают и распределяют медиапотоки, поэтому их безопасность критически важна для защиты взаимодействия между участниками. Обеспечение безопасности медиапотоков в WebRTC-приложениях является приоритетной задачей для предотвращения перехвата данных, манипуляций с трафиком, атак типа «отказ в обслуживании». Эти угрозы могут нарушить конфиденциальность пользователей и качество связи. + +В частности, необходимо реализовать защиту от флуд-атак, включая: ограничение частоты запросов (rate limiting), проверку временных меток, использование синхронизированных часов для контроля временных интервалов и управление буферами для предотвращения переполнения и поддержания правильной временной синхронизации. Если пакеты для конкретного медиасеанса прибывают слишком быстро, избыточные пакеты должны отбрасываться. Также важно защитить систему от некорректных пакетов путем валидации входных данных, безопасной обработки целочисленных переполнений, предотвращения переполнения буферов и применения других надежных методов обработки ошибок. + +Системы, использующие исключительно peer-to-peer медиакоммуникацию между веб-браузерами без промежуточных медиасерверов, не подпадают под эти специфические требования к медиабезопасности. + +Данный раздел относится к использованию Datagram Transport Layer Security (DTLS) в контексте WebRTC. Требования к документированной политике управления криптографическими ключами приведены в главе «Криптография». Информацию об одобренных криптографических методах можно найти в Приложении С - Криптография ASVS или в таких документах, как NIST SP 800-52 Rev. 2 или BSI TR-02102-2 (версия 2025-01). + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **17.2.1** | Убедитесь, что ключ сертификата Datagram Transport Layer Security (DTLS) управляется и защищается в соответствии с документированной политикой управления криптографическими ключами. | 2 | +| **17.2.2** | Убедитесь, что медиасервер настроен на использование только одобренных наборов шифров Datagram Transport Layer Security (DTLS) и защищенного профиля безопасности для расширения DTLS, применяемого при установке ключей для Secure Real-time Transport Protocol (DTLS-SRTP). | 2 | +| **17.2.3** | Убедитесь, что медиасервер проверяет аутентификацию Secure Real-time Transport Protocol (SRTP) для предотвращения атак с внедрением Real-time Transport Protocol (RTP), которые могут привести к отказу в обслуживании (Denial of Service) или вставке поддельного аудио-/видеоконтента в медиапотоки. | 2 | +| **17.2.4** | Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика при получении некорректных пакетов Secure Real-time Transport Protocol (SRTP). | 2 | +| **17.2.5** | Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетами Secure Real-time Transport Protocol (SRTP) от легитимных пользователей. | 3 | +| **17.2.6** | Убедитесь, что медиасервер не подвержен уязвимости «Гонка ClientHello» (ClientHello Race Condition) в Datagram Transport Layer Security (DTLS), проверив наличие известных уязвимостей в публичных источниках или выполнив тестирование на воспроизведение условий гонки. | 3 | +| **17.2.7** | Убедитесь, что механизмы аудио- и видеозаписи, связанные с медиасервером, способны продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетов Secure Real-time Transport Protocol (SRTP) от легитимных пользователей. | 3 | +| **17.2.8** | Убедитесь, что сертификат Datagram Transport Layer Security (DTLS) проверяется на соответствие атрибуту отпечатка (fingerprint) в Session Description Protocol (SDP), с немедленным прекращением медиапотока в случае несоответствия — это гарантирует подлинность передаваемых данных. | 3 | + +## V17.3 Сигнализация + +Данный раздел устанавливает требования для систем, использующих собственные серверы сигнализации WebRTC. Сигнализация координирует peer-to-peer (P2P) взаимодействие и должна быть устойчива к атакам, способным нарушить установление сеансов или управление соединениями. + +Для обеспечения безопасной сигнализации системы должны корректно обрабатывать некорректные входные данные и оставаться доступными под нагрузкой. + +| # | Описание | Уровень | +| :---: | :--- | :---: | +| **17.3.1** | Убедитесь, что сигнальный сервер способен продолжать обработку легитимных входящих сообщений сигнализации даже в условиях флуд-атаки. Для этого необходимо реализовать механизм ограничения частоты запросов (rate limiting) на уровне сигнализации. | 2 | +| **17.3.2** | Убедитесь, что сигнальный сервер способен продолжать обработку легитимных сообщений сигнализации даже при получении некорректных сообщений, которые могут вызвать отказ в обслуживании (Denial of Service, DoS). Для этого необходимо реализовать: проверку входных данных (input validation), безопасную обработку целочисленных переполнений (integer overflows), защиту от переполнения буферов (buffer overflows) и другие надежные методы обработки ошибок. | 2 | + +## Ссылки + +Для дополнительной информации см. также: + +* DoS-атака WebRTC DTLS ClientHello лучше всего документирована [в записи блога Enable Security для специалистов по безопасности](https://www.enablesecurity.com/blog/novel-dos-vulnerability-affecting-webrtc-media-servers/) и соответствующем [техническом документе для разработчиков WebRTC](https://www.enablesecurity.com/blog/webrtc-hello-race-conditions-paper/) +* [RFC 3550 - RTP: A Transport Protocol for Real-Time Applications](https://www.rfc-editor.org/rfc/rfc3550) +* [RFC 3711 - The Secure Real-time Transport Protocol (SRTP)](https://datatracker.ietf.org/doc/html/rfc3711) +* [RFC 5764 - Datagram Transport Layer Security (DTLS) Extension to Establish Keys for the Secure Real-time Transport Protocol (SRTP))](https://datatracker.ietf.org/doc/html/rfc5764) +* [RFC 8825 - Overview: Real-Time Protocols for Browser-Based Applications](https://www.rfc-editor.org/info/rfc8825) +* [RFC 8826 - Security Considerations for WebRTC](https://www.rfc-editor.org/info/rfc8826) +* [RFC 8827 - WebRTC Security Architecture](https://www.rfc-editor.org/info/rfc8827) +* [DTLS-SRTP Protection Profiles](https://www.iana.org/assignments/srtp-protection/srtp-protection.xhtml) diff --git a/5.0/ru/0x90-Appendix-A_Glossary.md b/5.0/ru/0x90-Appendix-A_Glossary.md new file mode 100644 index 0000000000..d4b6b3c79d --- /dev/null +++ b/5.0/ru/0x90-Appendix-A_Glossary.md @@ -0,0 +1,89 @@ +# Приложение A: Термины и сокращения + +* **Absolute Maximum Session Lifetime** (абсолютный максимальный срок действия сессии) — также известный как "Overall Timeout" в NIST, это максимальное время, в течение которого сеанс может оставаться активным после аутентификации, независимо от действий пользователя. Это составная часть механизма завершения сессии. +* **Allowlist** — список разрешённых данных или операций, например список символов, разрешённых форматно-логическим контролем. +* **Anti-forgery token** (токен защиты от подделки) — механизм, при котором один или несколько токенов передаются в запросе и проверяются сервером приложения, чтобы гарантировать, что запрос поступил из ожидаемой конечной точки. +* **Application Security** (безопасность приложений) — это анализ компонентов, составляющих прикладной уровень эталонной модели взаимодействия открытых систем (модели OSI), и в меньшей степени – инфраструктуры, например, операционных систем или сетей. +* **Application Security Verification** (верификация требований к безопасности приложений) — технический анализ приложения по стандарту OWASP ASVS. +* **Application Security Verification Report** — отчёт по тестированию конкретного приложения, в котором аудитор документирует общие результаты и даёт сопроводительные пояснения. +* **Authentication** (аутентификация) — проверка учетных данных, предъявленных пользователем приложения. +* **Automated Verification** (автоматизированная проверка) – поиск сигнатур уязвимостей с помощью автоматизированных инструментов динамического и/или статического анализа безопасности кода. +* **Black box testing** (метод «чёрного ящика») — метод тестирования программного обеспечения, который проверяет функциональность приложения, не заглядывая в его внутреннюю структуру и операции. +* **Common Weakness Enumeration** (CWE, список общих недостатков) – разработанный сообществом список распространенных недостатков безопасности программного обеспечения. Он служит общим языком, мерилом для средств обеспечения безопасности программного обеспечения, а также основой для выявления недостатков, их устранения и предотвращения. +* **Component** (компонент) – автономный блок кода со связанными дисковыми и сетевыми интерфейсами, который взаимодействует с другими компонентами. +* **Credential Service Provider** (CSP) — также называемый поставщиком идентификационных данных (IdP). Источник пользовательских данных, который может использоваться другими приложениями для аутентификации. +* **Cross-Site Script Inclusion** (XSSI) — разновидность атаки межсайтового скриптинга (XSS), при которой веб-приложение загружает вредоносный код из внешнего источника и включает его в состав собственного содержимого. +* **Cross-Site Scripting** (XSS, межсайтовый скриптинг) — уязвимость в системе безопасности, обычно обнаруживаемая в web-приложениях, позволяющая внедрять скрипты в контент на стороне клиента. +* **Cryptographic module** (криптографический модуль) — аппаратное, программное и/или микропрограммное обеспечение, реализующее криптографические алгоритмы и/или генерирующее криптографические ключи. +* **Cryptographically secure pseudo-random number generator** (CSPRNG, криптографически стойкий генератор псевдослучайных чисел) — генератор псевдослучайных чисел со свойствами, делающими его пригодным для использования в криптографии, также называется криптографическим генератором случайных чисел (cryptographic random number generator, CRNG). +* **Datagram Transport Layer Security** (DTLS) — криптографический протокол, обеспечивающий безопасность связи по сетевому соединению. Он основан на протоколе TLS, но адаптирован для защиты ориентированных на датаграммы протоколов (обычно поверх UDP). Версия DTLS 1.3 стандартизирована в RFC 9147. +* **Datagram Transport Layer Security Extension to Establish Keys for the Secure Real-time Transport Protocol** (DTLS-SRTP) — механизм использования DTLS-рукопожатия для формирования ключей сеанса SRTP. Стандартизирован в RFC 5764. +* **Design Verification** (верификация архитектуры) — технический анализ архитектуры безопасности приложения. +* **Dynamic Application Security Testing** (DAST, динамический анализ приложения) — технологии, предназначенные для обнаружения условий, указывающих на уязвимость системы безопасности в приложении, производящийся во время его выполнения. +* **Dynamic Verification** (динамическая верификация) — использование автоматизированных инструментов, использующих сигнатуры уязвимостей для поиска проблем во время выполнения приложения. +* **Fast IDentity Online** (FIDO) — набор стандартов аутентификации, которые позволяют использовать различные методы аутентификации, включая биометрические данные, модули доверенной платформы (TPM), USB-токены и т.д. +* **Hardware Security Module** (HSM, аппаратный модуль безопасности) — аппаратный компонент, способный хранить криптографические ключи и другие секреты в защищённом виде. +* **Hibernate Query Language** (HQL) — язык запросов, внешне похожий на SQL, используемый библиотекой Hibernate ORM. +* **HTTP Strict Transport Security** (HSTS) — политика, которая предписывает браузеру подключаться к домену, возвращающему заголовок, только через TLS и при наличии действительного сертификата. Активируется с помощью поля заголовка ответа Strict-Transport-Security. +* **HyperText Transfer Protocol** (HTTP) — протокол приложений для распределенных, гипермедиа (гипертекст+мультимедиа)-систем и совместной работы. Основа для передачи данных в World Wide Web. +* **HyperText Transfer Protocol over SSL/TLS** (HTTPS) — Способ защиты HTTP-соединения путём его шифрования с использованием TLS. +* **Identity Provider** (IdP) — также называется провайдером услуг аутентификации (CSP) в ссылках NIST. Сущность, которая предоставляет источник аутентификации для других приложений. +* **Inactivity Timeout** (таймаут бездействия) — промежуток времени, в течение которого сессия может оставаться активной при отсутствии взаимодействия пользователя с приложением. Это составная часть механизма завершения сессии. +* **Input Validation** (форматно-логический контроль) — нормализация и проверка корректности недоверенных входных данных. +* **JSON Web Token** (JWT) – RFC 7519 определяет стандарт для объекта данных JSON, состоящего из раздела заголовка (header), который объясняет, как проверять объект, раздела тела (body), содержащего набор утверждений (claims), и раздела подписи (signature), содержащей цифровую подпись для проверки содержимого раздела тела. Это тип автономного (self-contained) токена. +* **Local File Inclusion** (LFI) – атака, использующая уязвимые процедуры включения файлов в приложении, что приводит к подключению локальных файлов, уже присутствующих на сервере. +* **Malicious Code** (вредоносный код) — код, попавший в приложение во время его разработки без ведома владельца, который обходит имеющуюся политику безопасности приложения. Не путать с вредоносным ПО, таким как вирусы или черви. +* **Malware** (вредоносное ПО) — исполняемый код, который попадает в приложение во время выполнения без ведома пользователя или администратора приложения. +* **Message authentication code** (MAC) — криптографическая контрольная сумма данных, вычисляемая алгоритмом генерации MAC, которая используется для обеспечения целостности и подлинности. +* **Multi-factor authentication** (MFA, многофакторная аутентификация) — аутентификация, использующая два или более различных факторов. +* **Mutual TLS** (mTLS) – См. TLS client authentication. +* **Object-relational Mapping** (ORM) – система, позволяющая приложению делать запросы к реляционной/табличной базе данных, используя объектную модель, совместимую с приложением. +* **One-time Password** (OTP, одноразовый пароль) — уникальный пароль, сгенерированный для одноразового использования. +* **Open Worldwide Application Security Project** (OWASP) – бесплатно распространяемый проект и открытое международное сообщество, занимающееся повышением безопасности прикладного программного обеспечения. Наша миссия — сделать безопасность приложений «видимой», чтобы люди и организации могли принимать обоснованные решения о рисках безопасности приложений. См.: [https://www.owasp.org/](https://www.owasp.org/). +* **Password-Based Key Derivation Function 2** (PBKDF2) – специальный односторонний алгоритм для формирования стойкого криптографического ключа на основе введённого текста (например, пароля) и дополнительного случайного значения — соли, которая затрудняет взлом пароля в режиме offline, если вместо исходного пароля хранится результирующее значение. +* **Public Key Infrastructure** (PKI, инфраструктура открытых ключей) — механизм, который связывает открытые ключи с соответствующими идентификаторами сущностей. Привязка устанавливается посредством процесса регистрации и выдачи сертификатов в центре сертификации (CA) и с его помощью. +* **Public Switched Telephone Network** (PSTN, коммутируемая телефонная сеть общего пользования, ТСОП, ТфОП) — традиционная телефонная сеть, соединяющая как стационарные, так и мобильные телефоны. +* **Real-time Transport Protocol** (RTP) и **Real-time Transport Control Protocol** (RTCP) — два протокола, используемые совместно для передачи мультимедийных потоков. Применяются в стеке WebRTC. Стандартизированы в RFC 3550. +* **Reference Token** (ссылочный токен) — тип токена, который служит указателем или идентификатором для состояния или метаданных, хранящихся на сервере, также известен как случайный или непрозрачный токен. В отличие от автономных (self-contained) токенов, сслылочный токен не содержат собственной информации, а зависят от контекста сервера. Ссылочный токен либо является идентификатором сессии, либо содержит его. +* **Relying Party** (RP, проверяющая сторона) — как правило, приложение, которое полагается на то, что пользователь прошёл аутентификацию у отдельного поставщика аутентификации. Приложение проверяет токен или набор подписанных утверждений, предоставляемых этим поставщиком, чтобы убедиться, что пользователь является тем, за кого себя выдает. +* **Remote File Inclusion** (RFI, подключение удалённых файлов) — атака, эксплуатирующая уязвимые процедуры включения файлов в приложении, что приводит к подключению удалённых файлов. +* **Scalable Vector Graphics** (SVG, масштабируемая векторная графика) — язык разметки на основе XML для описания двумерной векторной графики. +* **Secure Real-time Transport Protocol** (SRTP) и **Secure Real-time Transport Control Protocol** (SRTCP) – расширение протоколов RTP и RTCP, предоставляющее функции шифрования сообщений, проверки подлинности и обеспечения целостности. Стандартизирован в RFC 3711. +* **Security Architecture** (архитектура безопасности) — абстракция дизайна приложения, которая определяет и описывает, где и как применяются меры безопасности, а также местоположение и категории информации. +* **Security Assertion Markup Language** (SAML) — открытый стандарт для единого входа (SSO), основанный на передаче подписанных утверждений (обычно в формате XML) между поставщиком идентификации и проверяющей стороной. +* **Security Configuration** (конфигурация безопасности) — конфигурация среды выполнения приложения, которая влияет на то, как применяются меры безопасности. +* **Security Control** (мера обеспечения безопасности) — функция или компонент, который контролирует (например, меры контроля доступа) или приводит к действию по обеспечению безопасности (например, регистрирует запись в журнале аудита). +* **Security information and event management** (SIEM) — система для обнаружения угроз, обеспечения соответствия требованиям и управления инцидентами безопасности путём сбора и анализа связанных с безопасностью данных из различных источников ИТ-инфраструктуры организации. +* **Self-Contained Token** (автономный токен) — токен, который инкапсулирует один или несколько атрибутов, не зависящих от серверного состояния или другого внешнего хранилища. Эти токены обеспечивают подлинность и целостность содержащихся в них атрибутов, позволяя осуществлять безопасный обмен информацией между системами «без сохранения состояния». Автономные токены обычно защищаются с помощью криптографических методов, таких как цифровые подписи или коды аутентификации сообщений (MAC), для обеспечения подлинности, целостности, а в некоторых случаях и конфиденциальности своих данных. Распространёнными примерами являются SAML Assertions и JWT. +* **Server-side Request Forgery** (SSRF, подделка запросов на стороне сервера) — атака, которая злоупотребляет функциональными возможностями сервера для чтения или обновления внутренних ресурсов путем предоставления или изменения URL-адреса, по которому код, запущенный на сервере, будет читать или отправлять данные. +* **Session Description Protocol** (SDP) — формат сообщений для настройки мультимедийного сеанса (используется, например, в WebRTC). Стандартизирован в RFC 4566. +* **Session Identifier** или **Session ID** (идентификатор сессии) — ключ, который идентифицирует сессию с сохранением состояния, хранящийся на серверной стороне. Передаётся клиенту и обратно с помощью ссылочного токена (reference token). +* **Session Token** (сессионный токен) — общий термин, используемый в данном стандарте для обозначения токена или значения, применяемого в сессиях без сохранения состояния (которые используют автономный токен) или в сессиях с сохранением состояния (которые используют ссылочный токен). +* **Session Traversal Utilities for NAT** (STUN) — протокол, используемый для преодоления ограничений NAT с целью установления одноранговой связи. Стандартизирован в RFC 3489. +* **Single-factor authenticator** — Механизм проверки аутентификации пользователя. Фактором аутентификации может быть что-то, что вы знаете (запоминаемые секреты, пароли, парольные фразы, PIN-коды), что-то, что вы представляете собой (биометрия, отпечатки пальцев, сканы лица), или что-то, чем вы владеете (OTP-токены, криптографическое устройство, такое как смарт-карта). +* **Single Sign-on Authentication** (SSO, аутентификация единого входа) — пользователь входит в одно приложение, одновременно получая возможность войти в несколько других, без необходимости повторной аутентификации. Например, когда вы входите в Google, вы автоматически входите в другие сервисы Google, такие как YouTube, Google Docs, Gmail и т.д. +* **Software bill of materials** (SBOM) — структурированный и исчерпывающий перечень всех компонентов, модулей, библиотек, фреймворков и других ресурсов, необходимых для сборки или компиляции программного приложения. +* **Software Composition Analysis** (SCA, композиционный анализ) — Совокупность технологий, предназначенных для анализа состава приложений, зависимостей, библиотек и пакетов на наличие уязвимостей безопасности в используемых версиях компонентов. Не следует путать с анализом исходного кода, который теперь обычно обозначается как SAST. +* **Software development lifecycle** (SDLC, жизненный цикл разработки программного обеспечения) – пошаговый процесс разработки ПО, начиная с первоначальных требований, и заканчивая развертыванием и сопровождением. +* **SQL Injection** (SQLi, SQL-инъекция) — метод внедрения кода, используемый для атаки приложений, управляемых данными, в котором вредоносные SQL-выражения вставляются в точку входа. +* **Stateful Session Mechanism** (механизм сессии с сохранением состояния) — механизм управления сессией, когда приложение сохраняет состояние сеанса на серверной стороне, который обычно соответствует токену сеанса, сгенерированному с использованием криптографически стойкого генератора псевдослучайных чисел (CSPRNG), и выданному конечному пользователю. +* **Stateless Session Mechanism** (механизм сессии без сохранения состояния) — механизм управления сессией, который использует автономный токен, который передаётся клиентам и содержит информацию о сеансе, не обязательно хранящуюся в службе, которая затем получает и проверяет токен. На практике службе потребуется доступ к некоторой информации о сеансе (например, к списку отозванных JWT), чтобы иметь возможность применять необходимые меры безопасности. +* **Static application security testing** (SAST, статический анализ безопасности приложений) — набор технологий, предназначенных для анализа исходного кода, байт-кода и бинарных файлов приложения с целью выявления условий на уровне кода или архитектуры, указывающих на уязвимости безопасности. Решения SAST анализируют приложение «изнутри наружу» в статическом состоянии (без выполнения). +* **Threat Modeling** (моделирование угроз) — метод, состоящий в совершенствовании архитектур безопасности для выявления нарушителей, границ доверия, мер безопасности, а также ключевых технических и бизнес-активов. +* **Time-of-check to time-of-use** (TOCTOU) — ситуация, когда приложение проверяет состояние ресурса перед его использованием, но состояние ресурса может быть изменено между проверкой и использованием. Это может сделать результаты проверки недействительными и привести к ситуации, когда приложение выполняет некорректные действия из-за несоответствия состояния. +* **Time based One-time Passwords** (TOTPs) — метод создания OTP, при котором текущее время является входным аргументом для алгоритма формирования пароля. +* **TLS client authentication**, также называемый **Mutual TLS** (mTLS) — в стандартном TLS-соединении клиент может использовать сертификат, предоставленный сервером, для проверки подлинности сервера. При использовании mTLS клиент также использует свой собственный закрытый ключ и сертификат, чтобы позволить серверу проверить подлинность клиента. +* **Transport Layer Security** (TLS, безопасность транспортного уровня) — криптографические протоколы, обеспечивающие безопасность канала связи по сетевому соединению. +* **Traversal Using Relays around NAT** (TURN) — расширение протокола STUN, использующее TURN-сервер в качестве ретранслятора, когда прямое одноранговое соединение не может быть установлено. Стандартизировано в RFC 8656. +* **Trusted execution environment** (TEE) — изолированная среда выполнения, обеспечивающая безопасное исполнение приложений вне зависимости от состояния остальной системы. +* **Trusted Platform Module** (TPM, модуль доверенной платформы) — тип HSM, который обычно является компонентом другого оборудования, например, материнской платы, и выступает в роли «корня доверия» для этой системы. +* **Trusted Service Layer** (уровень доверенных служб) — любая доверенная точка принудительного контроля, такая как микросервис, бессерверный API, серверная часть, доверенный API на клиентском устройстве с безопасной загрузкой, партнёрские или внешние API и т.д. «Доверенный» означает, что нет опасений, что недоверенный пользователь сможет обойти или пропустить слой или элементы управления, реализованные на этом уровне. +* **Uniform Resource Identifier** (URI, унифицированный идентификатор ресурса) — это строка символов, используемая для идентификации ресурса, например, веб-страницы, почтового адреса, места. +* **Uniform Resource Locator** (URL, унифицированный адрес ресурса) — это строка, указывающая местоположение ресурса в Интернете. +* **Universally Unique Identifier** (UUID, универсальный уникальный идентификатор) — уникальный номер-идентификатор, используемый в качестве средства идентификации в программном обеспечении. +* **Verifier** (верификатор/аудитор) — лицо или группа людей, которые анализируют безопасность приложения на соответствие требованиям OWASP ASVS. +* **Web Real-Time Communication** (WebRTC) — стек протоколов и связанный с ним веб-API, используемые для передачи мультимедийных потоков в веб-приложениях, обычно в контексте телеконференций. Основан на SRTP, SRTCP, DTLS, SDP и STUN/TURN. +* **WebSocket over TLS** (WSS) — практика защиты WebSocket-соединения путём размещения протокола WebSocket поверх протокола TLS. +* **What You See Is What You Get** (WYSIWYG) – тип редактора гипермедиа, который показывает, как на самом деле будет выглядеть содержимое при отображении, а не код разметки, управляющий отображением. +* **X.509 Certificate** — электронный сертификат, соответствующий общепринятому международному стандарту инфраструктуры открытых ключей X.509 (PKI) для проверки принадлежности открытого ключа идентификатору пользователя, компьютера или сервиса, указанному в сертификате. +* **XML eXternal Entity** (XXE) — тип элемента XML, который может получать доступ к локальному или удаленному содержимому через объявленный идентификатор. Может привести к атакам инъекции. diff --git a/5.0/ru/0x91-Appendix-B_References.md b/5.0/ru/0x91-Appendix-B_References.md new file mode 100644 index 0000000000..ccd2905473 --- /dev/null +++ b/5.0/ru/0x91-Appendix-B_References.md @@ -0,0 +1,43 @@ +# Приложение B: Полезные ссылки + +Следующие проекты OWASP, скорее всего, будут полезны для читателей/последователей этого стандарта: + +## Основные проекты OWASP + +1. Проект OWASP Top 10: [https://owasp.org/www-project-top-ten/](https://owasp.org/www-project-top-ten/) +2. OWASP Web Security Testing Guide: [https://owasp.org/www-project-web-security-testing-guide/](https://owasp.org/www-project-web-security-testing-guide/) +3. OWASP Proactive Controls: [https://owasp.org/www-project-proactive-controls/](https://owasp.org/www-project-proactive-controls/) +4. OWASP Software Assurance Maturity Model (SAMM): [https://owasp.org/www-project-samm/](https://owasp.org/www-project-samm/) +5. OWASP Secure Headers Project: [https://owasp.org/www-project-secure-headers/](https://owasp.org/www-project-secure-headers/) + +## Проект OWASP Cheat Sheet Series + +[В этом проекте](https://owasp.org/www-project-cheat-sheets/) есть памятки, которые будут актуальны для многих требований ASVS. + +Сопоставление памяток с требованиями ASVS можно найти здесь: [https://cheatsheetseries.owasp.org/IndexASVS.html](https://cheatsheetseries.owasp.org/IndexASVS.html) + +## Проекты Mobile Security + +1. OWASP Mobile Security Project: [https://owasp.org/www-project-mobile-security/](https://owasp.org/www-project-mobile-security/) +2. OWASP Mobile Top 10 Risks: [https://owasp.org/www-project-mobile-top-10/](https://owasp.org/www-project-mobile-top-10/) +3. OWASP Mobile Security Testing Guide and Mobile Application Security Verification Standard: [https://owasp.org/www-project-mobile-security-testing-guide/](https://owasp.org/www-project-mobile-security-testing-guide/) + +## Проект OWASP Internet of Things + +1. OWASP Internet of Things Project: [https://owasp.org/www-project-internet-of-things/](https://owasp.org/www-project-internet-of-things/) + +## Проект OWASP Serverless + +1. OWASP Serverless Project: [https://owasp.org/www-project-serverless-top-10/](https://owasp.org/www-project-serverless-top-10/) + +## Другие + +Следующие веб-сайты, скорее всего, также будут полезны для читателей/последователей этого стандарта: + +1. SecLists Github: [https://github.com/danielmiessler/SecLists](https://github.com/danielmiessler/SecLists) +2. MITRE Common Weakness Enumeration: [https://cwe.mitre.org/](https://cwe.mitre.org/) +3. PCI Security Standards Council: [https://www.pcisecuritystandards.org/](https://www.pcisecuritystandards.org/) +4. PCI Data Security Standard (DSS) v3.2.1 Requirements and Security Assessment Procedures: [https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf](https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf) +5. PCI Software Security Framework - Secure Software Requirements and Assessment Procedures: [https://www.pcisecuritystandards.org/documents/PCI-Secure-Software-Standard-v1_0.pdf](https://www.pcisecuritystandards.org/documents/PCI-Secure-Software-Standard-v1_0.pdf) +6. PCI Secure Software Lifecycle (Secure SLC) Requirements and Assessment Procedures: [https://www.pcisecuritystandards.org/documents/PCI-Secure-SLC-Standard-v1_0.pdf](https://www.pcisecuritystandards.org/documents/PCI-Secure-SLC-Standard-v1_0.pdf) +7. OWASP ASVS 4.0 Testing Guide [https://github.com/BlazingWind/OWASP-ASVS-4.0-testing-guide](https://github.com/BlazingWind/OWASP-ASVS-4.0-testing-guide) diff --git a/5.0/ru/0x92-Appendix-C_Cryptography.md b/5.0/ru/0x92-Appendix-C_Cryptography.md new file mode 100644 index 0000000000..204928d870 --- /dev/null +++ b/5.0/ru/0x92-Appendix-C_Cryptography.md @@ -0,0 +1,312 @@ +# Приложение C: Стандарты криптографии + +Глава «Криптография» выходит за рамки простого описания передовых практик. Она направлена ​​на углубление понимания принципов криптографии и поощрение внедрения более надёжных и современных методов безопасности. В этом приложении представлена ​​подробная техническая информация по каждому требованию, дополняющая общие стандарты, изложенные в главе «Криптография». + +В этом приложении определяются уровни допустимости различных криптографических механизмов: + +* Допустимые механизмы (A) могут использоваться в приложениях. +* Устаревшие механизмы (L) не должны использоваться в приложениях, но могут использоваться только для обеспечения совместимости с существующими устаревшими приложениями или кодом. Хотя использование таких механизмов в настоящее время само по себе не считается уязвимостью, их следует как можно скорее заменить более безопасными и перспективными механизмами. +* Запрещенные механизмы (D) не должны использоваться, поскольку в настоящее время они считаются ненадежными или не обеспечивают достаточной безопасности. + +Этот список может быть переопределен в контексте конкретного приложения по разным причинам, включая: + +* новые разработки в области криптографии; +* соблюдение нормативных требований. + +## Инвентаризация и документирование криптографии + +В этом разделе представлена ​​дополнительная информация +для V11.1 «Инвентаризация и документирование криптографии». + +Важно обеспечить регулярное обнаружение, инвентаризацию и оценку всех криптографических активов, таких как алгоритмы, ключи и сертификаты. Для уровня 3 это должно включать статическое и динамическое сканирование для обнаружения использования криптографии в приложении. Такие инструменты, как SAST и DAST, могут помочь в этом, но для более полного охвата могут потребоваться специализированные инструменты. Примеры бесплатных инструментов: + +* [CryptoMon - Network Cryptography Monitor - using eBPF, written in python](https://github.com/Santandersecurityresearch/CryptoMon) +* [Cryptobom Forge Tool: Generating Comprehensive CBOMs from CodeQL Outputs](https://github.com/Santandersecurityresearch/cryptobom-forge) + +## Эквивалентная стойкость криптографических параметров + +Относительные уровни безопасности различных криптографических систем приведены в следующей таблице (из [NIST SP 800-57 Часть 1](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final), стр.71): + +| Количество бит стойкости | Симметричные алгоритмы | Конечное поле | Целочисленная факторизация | Эллиптическая кривая | +|--|--|--|--|--| +| <= 80 | 2TDEA | L = 1024
N = 160 | k = 1024 | f = 160-223 | +| 112 | 3TDEA | L = 2048
N = 224 | k = 2048 | f = 224-255 | +| 128 | AES-128 | L = 3072
N = 256 | k = 3072 | f = 256-383 | +| 192 | AES-192 | L = 7680
N = 384 | k = 7680 | f = 384-511 | +| 256 | AES-256 | L = 15360
N = 512 | k = 15360 | f = 512+ | + +Примеры применения: + +* Криптография на конечных полях: DSA, FFDH, MQV +* Криптография на целочисленной факторизации: RSA +* Криптография на эллиптических кривых: ECDSA, EdDSA, ECDH, MQV + +Примечание: в этом разделе предполагается, что квантового компьютера не существует; если бы такой компьютер существовал, оценки для последних трех столбцов стали бы недействительными. + +## Случайные значения + +В этом разделе представлена ​​дополнительная информация +для V11.5 «Случайные значения». + +| Имя | Версия/Ссылка | Примечания | Статус | +|:---|:----|:----|:-:| +| `/dev/random` | Linux 4.8+ [(Окт 2016)](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=818e607b57c94ade9824dad63a96c2ea6b21baf3), также встречается в iOS, Android и других операционных системах POSIX на базе Linux. Основан на [RFC7539](https://datatracker.ietf.org/doc/html/rfc7539) | Использование ChaCha20. Найдено в iOS [`SecRandomCopyBytes`](https://developer.apple.com/documentation/security/secrandomcopybytes(_:_:_:)?language=objc) и Android [`Secure Random`](https://developer.android.com/reference/java/security/SecureRandom) с правильными настройками, предоставленными для каждого. | A | +| `/dev/urandom` | Специальный файл ядра Linux для предоставления случайных данных | Обеспечивает высококачественный источник энтропии на основе аппаратной случайности. | A | +| `AES-CTR-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | Используется в распространенных реализациях, таких как [Windows CNG API `BCryptGenRandom`](https://learn.microsoft.com/en-us/windows/win32/api/bcrypt/nf-bcrypt-bcryptgenrandom) при установке [`BCRYPT_RNG_ALGORITHM`](https://learn.microsoft.com/en-us/windows/win32/seccng/cng-algorithm-identifiers). | A | +| `HMAC-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | | A | +| `Hash-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | | A | +| `getentropy()` | [OpenBSD](https://man.openbsd.org/getentropy.2), доступный в [Linux glibc 2.25+](https://man7.org/linux/man-pages/man3/getentropy.3.html) и [macOS 10.12+](https://support.apple.com/en-gb/guide/security/seca0c73a75b/web) | Обеспечивает безопасный доступ к случайным байтам непосредственно из источника энтропии ядра с помощью простого и минималистичного API. Он более современный и позволяет избежать ошибок, связанных со старыми API. | A | + +Базовая хэш-функция, используемая с HMAC-DRBG или Hash-DRBG, должна быть допустима для такого применения. + +## Алгоритмы шифрования + +В этом разделе представлена ​​дополнительная информация +для V11.3 «Алгоритмы шифрования». + +Допустимые алгоритмы шифрования перечислены в порядке предпочтения. + +| Симметричные алгоритмы | Ссылка | Статус | +| ------ | ------ |:-:| +| AES-256 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | A | +| Salsa20 | [Salsa 20 specification](https://cr.yp.to/snuffle/spec.pdf) | A | +| XChaCha20 | [XChaCha20 Draft](https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-xchacha-03) | A | +| XSalsa20 | [Extending the Salsa20 nonce](https://cr.yp.to/snuffle/xsalsa-20110204.pdf) | A | +| ChaCha20 | [RFC 8439](https://www.rfc-editor.org/info/rfc8439) | A | +| AES-192 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | A | +| AES-128 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | L | +| 2TDEA | | D | +| TDEA (3DES/3DEA) | | D | +| IDEA | | D | +| RC4 | | D | +| Blowfish| | D | +| ARC4 | | D | +| DES | | D | + +### Режимы шифрования AES + +Блочные шифры, такие как AES, могут использоваться в различных режимах работы. Многие режимы работы, такие как Electronic codebook (ECB), небезопасны и не должны использоваться. Режимы работы Galois/Counter Mode (GCM) и «Счётчик с кодом аутентификации сообщений цепочки блоков шифра» (CCM) обеспечивают аутентифицированное шифрование и должны использоваться в современных приложениях. + +Допустимые режимы перечислены в порядке предпочтения. + +| Режим | Поддержка аутентификации | Ссылка | Статус | Ограничение | +|--|--|--|--|--| +| GCM | Yes | [NIST SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | | +| CCM | Yes | [NIST SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | | +| CBC | No | [NIST SP 800-38A](https://csrc.nist.gov/pubs/sp/800/38/a/final) | L | | +| CCM-8 | Yes | | D | | +| ECB | No | | D | | +| CFB | No | | D | | +| OFB | No | | D | | +| CTR | No | | D | | + +Примечания: + +* Все зашифрованные сообщения должны быть аутентифицированы. Для ЛЮБОГО использования режима CBC ОБЯЗАТЕЛЬНО должен быть соответствующий алгоритм хеширования MAC для проверки сообщения. Как правило, он ДОЛЖЕН применяться в методе «Шифрование-затем-хеширование» (но в TLS 1.2 вместо этого используется «Хеширование-затем-шифрование»). Если это невозможно гарантировать, то CBC НЕ ДОЛЖЕН использоваться. Единственной опцией, где разрешено шифрование без алгоритма MAC, является шифрование диска. +* При использовании CBC должно быть гарантировано, что проверка заполнения выполняется за константное время. +* При использовании CCM-8 тег MAC имеет только 64 бита стойкости. Это не соответствует требованию 6.2.9, которое требует не менее 128 бит стойкости. +* Шифрование диска считается выходящим за рамки ASVS. Поэтому в данном приложении не перечислены какие-либо утверждённые методы шифрования диска. В этом случае обычно допускается шифрование без аутентификации, и обычно используются режимы XTS, XEX и LRW. + +### Шифрование ключей + +Шифрование ключа (key wrap) и соответствующее расшифрование ключа (key unwrap) — это метод защиты существующего ключа путём его инкапсуляции с использованием дополнительного механизма шифрования, чтобы исходный ключ не был явно раскрыт, например, во время передачи. Этот дополнительный ключ, используемый для защиты исходного ключа, называется ключом обёртывания (wrap key). + +Эта операция может выполняться в случае необходимости защиты ключей в местах, которые считаются недоверенными, а также для передачи конфиденциальных ключей по ненадежным сетям или внутри приложений. +Однако перед началом процедуры шифрования/расшифрования ключей необходимо оценить характер исходного ключа (например, идентичность и назначение). Это может повлиять на безопасность и соответствие требованиям как исходных (до передачи), так и целевых систем/приложений, включая требования по аудиту действий с ключами (например, подпись) и хранению ключей. + +В частности, для шифрования ключей ОБЯЗАТЕЛЬНО должен использоваться алгоритм AES-256, соответствующий [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) и с учётом перспективных мер защиты от квантовых угроз. Режимы шифрования с использованием AES применяются в следующем порядке предпочтения: + +| Шифрование ключа | Ссылка | Статус | +|--|--|:-:| +| KW | [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) | A | +| KWP | [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) | A | + +AES-192 и AES-128 МОГУТ использоваться, если того требует сценарий использования, но обоснование этого ДОЛЖНО быть задокументировано в реестре криптографии организации. + +### Аутентифицированное шифрование + +За исключением шифрования диска, зашифрованные данные должны быть защищены от несанкционированного изменения с использованием какой-либо схемы аутентифицированного шифрования (AE), обычно с использованием схемы аутентифицированного шифрования с соответствующими данными (AEAD). + +Предпочтительно, чтобы приложение использовало утверждённую схему AEAD. В качестве альтернативы, оно может комбинировать утверждённую схему шифрования и утверждённый алгоритм MAC с конструкцией Encrypt-then-MAC. + +MAC-then-encrypt по-прежнему разрешен для совместимости со старыми приложениями. Он используется в TLS версии 1.2 со старыми наборами шифров. + +| Схема AEAD | Ссылка | Статус | +|---|---------|:-:| +|AES-GCM | [SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | +|AES-CCM | [SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | +|ChaCha-Poly1305 | [RFC 7539](https://datatracker.ietf.org/doc/html/rfc7539) | A | +|AEGIS-256 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +|AEGIS-128 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +|AEGIS-128L| [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +|Encrypt-then-MAC | | A | +|MAC-then-encrypt | | L | + +## Хэш-функции + +В этом разделе представлена ​​дополнительная информация +для V11.4 «Хеширование и функции на основе хеширования». + +### Основные случаи использования хэш функций + +В следующей таблице перечислены хэш-функции, допустимые для основных случаев использования криптографии, таких как цифровые подписи: + +* Допустимые хеш-функции обеспечивают высокую устойчивость к коллизиям и подходят для приложений с высоким уровнем безопасности. +* Некоторые из этих алгоритмов обеспечивают высокую устойчивость к атакам при использовании с надлежащим управлением криптографическими ключами, поэтому они дополнительно допустимы для функций HMAC, KDF и RBG. +* Хэш-функции с длиной выходного значения менее 254 бит обладают недостаточной устойчивостью к коллизиям и не должны использоваться для цифровой подписи или других приложений, требующих устойчивости к коллизиям. В других случаях они могут использоваться ТОЛЬКО для обеспечения совместимости и верификации с устаревшими системами, но не должны использоваться в новых разработках. + +| Хэш-функция | Ссылка | Статус | Ограничения | +| ------ | ----------- |:-:| ---------- | +| SHA3-512 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| SHA-512 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHA3-384 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| SHA-384 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHA3-256 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| SHA-512/256 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHA-256 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHAKE256 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| BLAKE2s | [BLAKE2: simpler, smaller, fast as MD5](https://eprint.iacr.org/2013/322) | A | | +| BLAKE2b | [BLAKE2: simpler, smaller, fast as MD5](https://eprint.iacr.org/2013/322) | A | | +| BLAKE3 | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | | +| SHA-224 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | L | Not suitable for HMAC, KDF, RBG, digital signatures | +| SHA-512/224 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | L | Not suitable for HMAC, KDF, RBG, digital signatures | +| SHA3-224 | [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | L | Not suitable for HMAC, KDF, RBG, digital signatures | +| SHA-1 | [RFC 3174](https://www.rfc-editor.org/info/rfc3174) & [RFC 6194](https://www.rfc-editor.org/info/rfc6194) | L | Not suitable for HMAC, KDF, RBG, digital signatures | +| CRC (any length) | | D | | +| MD4 | [RFC 1320](https://www.rfc-editor.org/info/rfc1320) | D | | +| MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | | + +### Хэш-функции для хранения паролей + +Для безопасного хеширования паролей необходимо использовать специальные хеш-функции. Эти медленные алгоритмы хеширования снижают риск атак методом перебора и перебора по словарю, увеличивая вычислительную сложность взлома паролей. + +| KDF | Ссылка | Обязательные параметры | Статус | +| ---------- | --------- | ------------ |:-:| +| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1 | A | +| | | t = 2: m ≥ 19456 (19 MiB), p = 1 | A | +| | | t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | +| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8 | A | +| | | p = 2: N ≥ 2^16 (64 MiB), r = 8 | A | +| | | p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | +| bcrypt | [A Future-Adaptable Password Scheme](https://www.researchgate.net/publication/2519476_A_Future-Adaptable_Password_Scheme) | cost ≥ 10 | A | +| PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 210,000 | A | +| PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 600,000 | A | +| PBKDF2-HMAC-SHA-1 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 1,300,000 | L | + +Для хранения паролей можно использовать допустимые функции формирования ключей на основе паролей. + +## Функции формирования ключа (KDFs) + +### Основные функции формирования ключа + +| KDF | Ссылка | Статус | +| ---------------- | -------- |:-:| +| HKDF | [RFC 5869](https://www.rfc-editor.org/info/rfc5869) | A | +| TLS 1.2 PRF | [RFC 5248](https://www.rfc-editor.org/info/rfc5248) | L | +| MD5-based KDFs | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | +| SHA-1-based KDFs | [RFC 3174](https://www.rfc-editor.org/info/rfc3174) & [RFC 6194](https://www.rfc-editor.org/info/rfc6194) | D | + +### Функции формирования ключа на основе пароля + +| KDF | Ссылка | Обязательные параметры | Статус | +| ---------- | --------- | ------------ |:-:| +| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1 | A | +| | | t = 2: m ≥ 19456 (19 MiB), p = 1 | A | +| | | t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | +| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8 | A | +| | | p = 2: N ≥ 2^16 (64 MiB), r = 8 | A | +| | | p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | +| PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 210,000 | A | +| PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 600,000 | A | +| PBKDF2-HMAC-SHA-1 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 1,300,000 | L | + +## Механизмы обмена ключами + +В этом разделе представлена ​​дополнительная информация +для V11.6 «Криптография с публичным ключом». + +### Схемы KEX + +Для всех схем обмена ключами ДОЛЖНА быть обеспечена стойкость в 112 бит или выше, а их реализация ДОЛЖНА соответствовать выбору параметров, представленному в следующей таблице. + +| Схема | Параметры | Прямая секретность | Статус | +|--|--|--|:-:| +| Диффи-Хеллман на конечных полях (FFDH) | L >= 3072 & N >= 256 | Yes | A | +| Диффи-Хеллман на эллиптических кривых (ECDH) | f >= 256-383 | Yes | A | +| Передача зашифрованного ключа с помощью RSA-PKCS#1 v1.5 | | No | D | + +Где следующие параметры: + +* k — длина ключа для RSA. +* L — длина открытого ключа, а N — длина закрытого ключа для криптографии на конечном поле. +* f — диапазон длин ключей для ECC. + +Любая новая реализация НЕ ДОЛЖНА использовать схему, НЕ соответствующую [NIST SP 800-56A](https://csrc.nist.gov/pubs/sp/800/56/a/r3/final) & [B](https://csrc.nist.gov/pubs/sp/800/56/b/r2/final) и [NIST SP 800-77](https://csrc.nist.gov/pubs/sp/800/77/r1/final). В частности, IKEv1 НЕ ДОЛЖЕН использоваться в промышленной среде. + +### Группы Диффи-Хеллмана + +Следующие группы допустимы для реализации обмена ключами Диффи-Хеллмана. Уровни безопасности описаны в [NIST SP 800-56A](https://csrc.nist.gov/pubs/sp/800/56/a/r3/final), Приложение D, и [NIST SP 800-57 Часть 1, Ред. 5](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final). + +| Группа | Статус | +|------------------|:------:| +| P-224, secp224r1 | A | +| P-256, secp256r1 | A | +| P-384, secp384r1 | A | +| P-521, secp521r1 | A | +| K-233, sect233k1 | A | +| K-283, sect283k1 | A | +| K-409, sect409k1 | A | +| K-571, sect571k1 | A | +| B-233, sect233r1 | A | +| B-283, sect283r1 | A | +| B-409, sect409r1 | A | +| B-571, sect571r1 | A | +| Curve448 | A | +| Curve25519 | A | +| MODP-2048 | A | +| MODP-3072 | A | +| MODP-4096 | A | +| MODP-6144 | A | +| MODP-8192 | A | +| ffdhe2048 | A | +| ffdhe3072 | A | +| ffdhe4096 | A | +| ffdhe6144 | A | +| ffdhe8192 | A | + +## Коды аутентификации сообщений (MAC) + +Коды аутентификации сообщений (MAC) — это криптографические конструкции, используемые для проверки целостности и подлинности сообщения. MAC принимает сообщение и секретный ключ в качестве входных данных и создаёт тег фиксированного размера (значение MAC). MAC широко используется в протоколах защищённой связи (например, TLS/SSL) для обеспечения подлинности и целостности сообщений, которыми обмениваются стороны. + +| Алгоритм MAC | Ссылка | Статус | +| ---------- | --------------- |:-:| +| HMAC-SHA-256 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| HMAC-SHA-384 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| HMAC-SHA-512 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| KMAC128 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | +| KMAC256 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | +| BLAKE3 (keyed_hash mode) | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | +| AES-CMAC | [RFC 4493](https://datatracker.ietf.org/doc/html/rfc4493) & [NIST SP 800-38B](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38b.pdf) | A | +| AES-GMAC | [NIST SP 800-38D](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf) | A | +| Poly1305-AES | [The Poly1305-AES message-authentication code](https://cr.yp.to/mac/poly1305-20050329.pdf) | A | +| HMAC-SHA-1 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | L | +| HMAC-MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | + +## Цифровые подписи + +Схемы подписи ДОЛЖНЫ использовать утвержденные размеры ключей и параметры согласно [NIST SP 800-57 Часть 1](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final). + +| Алгоритм подписи | Ссылка | Статус | +| ------------------------------ | --------------------------------------------- | :-: | +| EdDSA (Ed25519, Ed448) | [RFC 8032](https://www.rfc-editor.org/info/rfc8032) | A | +| XEdDSA (Curve25519, Curve448) | [XEdDSA](https://signal.org/docs/specifications/xeddsa/) | A | +| ECDSA (P-256, P-384, P-521) | [FIPS 186-4](https://csrc.nist.gov/pubs/fips/186-5/final) | A | +| RSA-RSSA-PSS | [RFC 8017](https://www.rfc-editor.org/info/rfc8017) | A | +| RSA-SSA-PKCS#1 v1.5 | [RFC 8017](https://www.rfc-editor.org/info/rfc8017) | D | +| DSA (any key size) | [FIPS 186-4](https://csrc.nist.gov/pubs/fips/186-4/final) | D | + +## Стандарты постквантового шифрования + +Реализации постквантовой криптографии (PQC) должны соответствовать стандартам [FIPS-203](https://csrc.nist.gov/pubs/fips/203/ipd), [FIPS-204](https://csrc.nist.gov/pubs/fips/204/ipd) и [FIPS-205](https://csrc.nist.gov/pubs/fips/205/ipd). В настоящее время для этих стандартов доступно не так много примеров эталонных реализаций. Подробнее см. [объявление NIST о первых трёх финализированных постквантовых стандартах шифрования (август 2024 г.)](https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards). + +Предлагаемый постквантовый гибридный метод согласования ключей TLS [mlkem768x25519](https://datatracker.ietf.org/doc/draft-kwiatkowski-tls-ecdhe-mlkem/03/) поддерживается основными браузерами, такими как [Firefox версии 132](https://www.mozilla.org/en-US/firefox/132.0/releasenotes/) и [Chrome версии 131](https://security.googleblog.com/2024/09/a-new-path-for-kyber-on-web.html). Он может использоваться в средах тестирования криптографии или при наличии в библиотеках, допустимых отраслевыми или государственными органами. diff --git a/5.0/ru/0x93-Appendix-D_Recommendations.md b/5.0/ru/0x93-Appendix-D_Recommendations.md new file mode 100644 index 0000000000..c51830efae --- /dev/null +++ b/5.0/ru/0x93-Appendix-D_Recommendations.md @@ -0,0 +1,49 @@ +# Приложение D: Рекомендации + +## Введение + +При подготовке версии 5.0 Стандарта верификации требований к безопасности приложений (ASVS) стало очевидно, что ряд существующих и вновь предложенных пунктов не следует включать в требования версии 5.0. Это могло быть связано с тем, что они не входят в область действия ASVS согласно определению для версии 5.0, или же потому, что, хотя эти идеи и представлялись полезными, их нельзя было сделать обязательными. + +Не желая полностью потерять все эти материалы, некоторые из них были включены в это приложение. + +## Рекомендуемые механизмы, входящие в область применения + +Следующие пункты входят в область действия ASVS. Они не должны быть обязательными, но настоятельно рекомендуется рассматривать их как часть безопасного приложения. + +* Необходимо предоставить индикатор надежности пароля, чтобы помочь пользователям установить более стойкий пароль. +* Создайте общедоступный файл security.txt в корневом каталоге или каталоге .well-known приложения, в котором будет чётко указана ссылка или адрес электронной почты, по которым пользователи смогут связаться с владельцами по вопросам безопасности. +* В дополнение к проверке на уровне доверенных служб следует применять проверку входных данных на стороне клиента, поскольку это даёт хорошую возможность обнаружить, когда кто-то обходит клиентские средства защиты при попытке атаки на приложение. +* Предотвращайте появление в поисковых системах случайно доступных и конфиденциальных страниц с помощью файла robots.txt, заголовка ответа X-Robots-Tag или метатега robots.html. +* При использовании GraphQL реализуйте логику авторизации на уровне бизнес-логики, а не на уровне GraphQL или резолвера, чтобы избежать необходимости обрабатывать авторизацию на каждом отдельном интерфейсе. + +Ссылки: + +* [Дополнительная информация о security.txt, включая ссылку на RFC](https://securitytxt.org/) + +## Принципы безопасности программного обеспечения + +Следующие пункты ранее присутствовали в ASVS, но они не являются требованиями. Скорее, это принципы, которые следует учитывать при реализации мер безопасности, соблюдение которых приведет к повышению надежности этих мер. К ним относятся: + +* Средства управления безопасностью должны быть централизованными, простыми (экономия времени), проверяемо безопасными и допускающими повторное использование. Это позволит избежать дублирования, отсутствия или неэффективности средств управления. +* По возможности используйте ранее написанные и проверенные реализации средств управления безопасностью, а не полагайтесь на их реализацию с нуля. +* В идеале для доступа к защищённым данным и ресурсам следует использовать единый механизм управления доступом. Все запросы должны проходить через этот механизм, чтобы избежать копирования и вставки или небезопасных альтернативных путей. +* Управление доступом на основе атрибутов или функций — рекомендуемый шаблон, при котором код проверяет авторизацию пользователя для функции или элемента данных, а не только его роль. Разрешения по-прежнему должны предоставляться с использованием ролей. + +## Процессы обеспечения безопасности программного обеспечения + +Ряд процессов обеспечения безопасности были исключены из ASVS 5.0, но всё ещё представляют собой хорошую идею. Проект OWASP SAMM может стать хорошим источником информации о том, как эффективно реализовать эти процессы. Ранее в ASVS присутствовали следующие элементы: + +* Убедитесь в использовании безопасного жизненного цикла разработки программного обеспечения, который обеспечивает безопасность на всех этапах разработки. +* Убедитесь в применении моделирования угроз для каждого изменения дизайна или планирования спринта, чтобы выявлять угрозы, планировать контрмеры, способствовать надлежащему реагированию на риски и управлять тестированием безопасности. +* Убедитесь, что все пользовательские истории и функции содержат функциональные ограничения безопасности. Например, "Как пользователь, я должен иметь возможность просматривать и редактировать свой профиль, но не должен иметь возможности просматривать или редактировать чужой профиль". +* Убедитесь в наличии чек-листа для безопасной разработки, требований, политик и стандартов безопасности, а также в их доступности для разработчиков и тестировщиков. +* Убедитесь, что существует непрерывный процесс, гарантирующий отсутствие в исходном коде приложения бэкдоров, вредоносного кода (такого как атаки типа «нарезка салями», обход логики или «логические бомбы») и недокументированных или скрытых функций (например, «пасхальных яиц», небезопасных инструментов отладки). Выполнение требований этого раздела невозможно без полного доступа к исходному коду, включая сторонние библиотеки, и поэтому, вероятно, подходит только для приложений, требующих высочайшего уровня безопасности. +* Убедитесь, что в средах развертывания реализованы механизмы обнаружения и реагирования на отклонения конфигурации. Это может включать использование неизменяемой инфраструктуры, автоматическое повторное развертывание с безопасной базовой конфигурацией или инструменты обнаружения отклонений, сравнивающие текущее состояние с утверждёнными конфигурациями. +* Убедитесь, что усиление защиты конфигурации выполняется для всех сторонних продуктов, библиотек, фреймворков и служб в соответствии с их индивидуальными рекомендациями. + +Ссылки: + +* [OWASP Threat Modeling Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html) +* [OWASP Threat modeling](https://owasp.org/www-community/Application_Threat_Modeling) +* [OWASP Software Assurance Maturity Model Project](https://owasp.org/www-project-samm/) +* [Microsoft SDL](https://www.microsoft.com/en-us/securityengineering/sdl/) diff --git a/5.0/ru/0x94-Appendix-E_Contributors.md b/5.0/ru/0x94-Appendix-E_Contributors.md new file mode 100644 index 0000000000..1b845cc51e --- /dev/null +++ b/5.0/ru/0x94-Appendix-E_Contributors.md @@ -0,0 +1,71 @@ +# Приложение E: Участники + +Мы выражаем благодарность следующим людям, которые комментировали или открывали пул-реквесты после выпуска ASVS 4.0.0. + +Если вам известно о каких-либо ошибках или вы хотите, чтобы ваше имя отображалось иначе, пожалуйста, сообщите нам об этом. + +| | | | | +|---|---|---|---| +| Johan Sydseter ([sydseter](https://github.com/sydseter)) | luis servin ([lfservin](https://github.com/lfservin)) | Oleksii Dovydkov ([oleksiidov](https://github.com/oleksiidov)) | IZUKA Masahiro ([maizuka](https://github.com/maizuka)) | +| James Sulinski ([jsulinski](https://github.com/jsulinski)) | Eli Saad ([ThunderSon](https://github.com/ThunderSon)) | [kkshitish9](https://github.com/kkshitish9) | Andrew van der Stock ([vanderaj](https://github.com/vanderaj)) | +| Rick M ([kingthorin](https://github.com/kingthorin)) | Bankde Eakasit ([Bankde](https://github.com/Bankde)) | Michael Gargiullo ([mgargiullo](https://github.com/mgargiullo)) | Raphael Dunant ([Racater](https://github.com/Racater)) | +| Cesar Kohl ([cesarkohl](https://github.com/cesarkohl)) | [inaz0](https://github.com/inaz0) | Joerg Bruenner ([JoergBruenner](https://github.com/JoergBruenner)) | David Deatherage ([securitydave](https://github.com/securitydave)) | +| John Carroll ([yosignals](https://github.com/yosignals)) | Jim Fenton ([jimfenton](https://github.com/jimfenton)) | Matteo Pace ([M4tteoP](https://github.com/M4tteoP)) | Sebastien gioria ([SPoint42](https://github.com/SPoint42)) | +| Steven van der Baan ([vdbaan](https://github.com/vdbaan)) | Jeremy Bonghwan Choi ([jeremychoi](https://github.com/jeremychoi)) | [craig-shony](https://github.com/craig-shony) | Riccardo Sirigu ([ricsirigu](https://github.com/ricsirigu)) | +| Tomasz Wrobel ([tw2as](https://github.com/tw2as)) | Alena Dubeshko ([belalena](https://github.com/belalena)) | Rafael Green ([RafaelGreen1](https://github.com/RafaelGreen1)) | [mjang-cobalt](https://github.com/mjang-cobalt) | +| [clallier94](https://github.com/clallier94) | Kevin W. Wall ([kwwall](https://github.com/kwwall)) | Jordan Sherman ([jsherm-fwdsec](https://github.com/jsherm-fwdsec) / [deleterepo](https://github.com/deleterepo)) | Ingo Rauner ([ingo-rauner](https://github.com/ingo-rauner)) | +| Dirk Wetter ([drwetter](https://github.com/drwetter)) | Moshe Zioni ([moshe-apiiro](https://github.com/moshe-apiiro)) | Patrick Dwyer ([coderpatros](https://github.com/coderpatros)) | David Clarke ([davidclarke-au](https://github.com/davidclarke-au)) | +| Takaharu Ogasa ([takaharuogasa](https://github.com/takaharuogasa)) | Arkadii Yakovets ([arkid15r](https://github.com/arkid15r)) | Motoyasu Saburi ([motoyasu-saburi](https://github.com/motoyasu-saburi)) | [leirn](https://github.com/leirn) | +| [wet-certitude](https://github.com/wet-certitude) | [timhemel](https://github.com/timhemel) | RL Thornton ([thornshadow99](https://github.com/thornshadow99)) | Thomas Bandt ([aspnetde](https://github.com/aspnetde)) | +| Roel Storms ([roelstorms](https://github.com/roelstorms)) | Jeroen Willemsen ([commjoen](https://github.com/commjoen)) | [anonymous-31](https://github.com/anonymous-31) | Kamran Saifullah ([deFr0ggy](https://github.com/deFr0ggy)) | +| Steve Springett ([stevespringett](https://github.com/stevespringett)) | Spyros ([northdpole](https://github.com/northdpole)) | Hans Herrera ([hansphp](https://github.com/hansphp)) | [Marx314](https://github.com/Marx314) | +| [CarlosAllendes](https://github.com/CarlosAllendes) | Yonah Russ ([yruss972](https://github.com/yruss972)) | Sander Maijers ([sanmai-NL](https://github.com/sanmai-NL)) | Luboš Bretschneider ([bretik](https://github.com/bretik)) | +| Eva Sarafianou ([esarafianou](https://github.com/esarafianou)) | Ata Seren [ataseren](https://github.com/ataseren) | Steve Thomas ([Sc00bz](https://github.com/Sc00bz)) | Dominique RIGHETTO ([righettod](https://github.com/righettod)) | +| Steven van der Baan ([svdb-ncc](https://github.com/svdb-ncc)) | Michael Vacarella ([Aif4thah](https://github.com/Aif4thah)) | Tonimir Kisasondi ([tkisason](https://github.com/tkisason)) | Stefan Streichsbier ([streichsbaer](https://github.com/streichsbaer)) | +| [hi-unc1e](https://github.com/hi-unc1e) | sb3k ([starbuck3000](https://github.com/starbuck3000)) | [mario-platt](https://github.com/mario-platt) | Devdatta Akhawe ([devd](https://github.com/devd)) | +| Michael Gissing ([scolytus](https://github.com/scolytus)) | Jet Anderson ([thatsjet](https://github.com/thatsjet)) | Dave Wichers ([davewichers](https://github.com/davewichers)) | Jonny Schnittger ([JonnySchnittger](https://github.com/JonnySchnittger)) | +| Silvia Väli ([silviavali](https://github.com/silviavali)) | [jackgates73](https://github.com/jackgates73) | [1songb1rd](https://github.com/1songb1rd) | Timur - ([timurozkul](https://github.com/timurozkul)) | +| Gareth Heyes ([hackvertor](https://github.com/hackvertor)) | [appills](https://github.com/appills) | [suvikaartinen](https://github.com/suvikaartinen) | chaals ([chaals](https://github.com/chaals)) | +| DanielPharos ([AtlasHackert](https://github.com/AtlasHackert)) | will Farrell ([willfarrell](https://github.com/willfarrell)) | Alina Vasiljeva ([avasiljeva](https://github.com/avasiljeva)) | Paul McCann ([ismisepaul](https://github.com/ismisepaul)) | +| Sage ([SajjadPourali](https://github.com/SajjadPourali)) | [rbsec](https://github.com/rbsec) | Benedikt Bauer ([mastacheata](https://github.com/mastacheata)) | James Jardine ([jamesjardine](https://github.com/jamesjardine)) | +| Mark Burnett ([m8urnett](https://github.com/m8urnett)) | [dschwarz91](https://github.com/dschwarz91) | Cyber-AppSec ([Cyber-AppSec](https://github.com/Cyber-AppSec)) | [Tib3rius](https://github.com/Tib3rius) | +| BitnessWise ([bitnesswise](https://github.com/bitnesswise)) | damienbod ([damienbod](https://github.com/damienbod)) | Jared Meit ([jmeit-fwdsec](https://github.com/jmeit-fwdsec)) | Stefan Seelmann ([sseelmann](https://github.com/sseelmann)) | +| Brendan O'Connor ([ussjoin](https://github.com/ussjoin)) | Andrei Titov ([andrettv](https://github.com/andrettv)) | Hans-Petter Fjeld ([atluxity](https://github.com/atluxity)) | [markehack](https://github.com/markehack) | +| Neil Madden ([NeilMadden](https://github.com/NeilMadden)) | Michael Geramb ([mgeramb](https://github.com/mgeramb)) | Osama Elnaggar ([ossie-git](https://github.com/ossie-git)) | [mackowski](https://github.com/mackowski) | +| Ravi Balla ([raviballa](https://github.com/raviballa)) | Hazana ([hazanasec](https://github.com/hazanasec)) | David Means ([dmeans82](https://github.com/dmeans82)) | Alexander Stein ([tohch4](https://github.com/tohch4)) | +| BaeSenseii ([baesenseii](https://github.com/baesenseii)) | Vincent De Schutter ([VincentDS](https://github.com/VincentDS)) | S Bani ([sbani](https://github.com/sbani)) | Mitsuaki Akiyama ([mak1yama](https://github.com/mak1yama)) | +| Christopher Loessl ([hashier](https://github.com/hashier)) | [victorxm](https://github.com/victorxm) | Michal Rada ([michalradacz](https://github.com/michalradacz)) | Veeresh Devireddy ([drveresh](https://github.com/drveresh)) | +| [MaknaSEO](https://github.com/MaknaSEO) | [darkzero2022](https://github.com/darkzero2022) | Liam ([LiamDobbelaere](https://github.com/LiamDobbelaere)) | Frank Denis ([jedisct1](https://github.com/jedisct1)) | +| Otto Sulin ([ottosulin](https://github.com/ottosulin)) | [carllaw6885](https://github.com/carllaw6885) | Anders Johan Holmefjord ([aholmis](https://github.com/aholmis)) | Richard Fritsch ([rfricz](https://github.com/rfricz)) | +| [mesutgungor](https://github.com/mesutgungor) | Scott Helme ([ScottHelme](https://github.com/ScottHelme)) | Carlo Reggiani ([carloreggiani](https://github.com/carloreggiani)) | Suyash Srivastava ([suyash5053](https://github.com/suyash5053)) | +| Mark Potter ([markonweb](https://github.com/markonweb)) | Arjan Lamers ([alamers](https://github.com/alamers)) | Gøran Breivik ([gobrtg](https://github.com/gobrtg)) | [flo-blg](https://github.com/flo-blg) | +| Guillaume Déflache ([guillaume-d](https://github.com/guillaume-d)) | Toufik Airane ([toufik-airane](https://github.com/toufik-airane)) | Keith Hoodlet ([securingdev](https://github.com/securingdev)) | Sinner ([SoftwareSinner](https://github.com/SoftwareSinner)) | +| [iloving](https://github.com/iloving) | Jeroen Beckers ([TheDauntless](https://github.com/TheDauntless)) | Joubin Jabbari ([joubin](https://github.com/joubin)) | yu fujioka ([fujiokayu](https://github.com/fujiokayu)) | +| execjosh ([execjosh](https://github.com/execjosh)) | Alicja Kario ([tomato42](https://github.com/tomato42)) | Sidney Ribeiro ([srjsoftware](https://github.com/srjsoftware)) | Gabriel Marquet ([Gby56](https://github.com/Gby56)) | +| Drew Schulz ([drschulz](https://github.com/drschulz)) | [bedirhan](https://github.com/bedirhan) | [muralito](https://github.com/muralito) | Ronnie Flathers ([ropnop](https://github.com/ropnop)) | +| Philippe De Ryck ([philippederyck](https://github.com/philippederyck)) | Malte ([mal33](https://github.com/mal33)) | [MazeOfThoughts](https://github.com/MazeOfThoughts) | Andreas Falk ([andifalk](https://github.com/andifalk)) | +| Javi ([javixeneize](https://github.com/javixeneize)) | Daniel Hahn ([averell23](https://github.com/averell23)) | [borislav-c](https://github.com/borislav-c) | Robin Wood ([digininja](https://github.com/digininja)) | +| [miro2ns](https://github.com/miro2ns) | Jan Dockx ([jandockx](https://github.com/jandockx)) | [vipinsaini434](https://github.com/vipinsaini434) | [priyanshukumar397](https://github.com/priyanshukumar397) | +| Nat Sakimura ([sakimura](https://github.com/sakimura)) | Benjamin Häublein ([BenjaminHae](https://github.com/BenjaminHae)) | [unknown-user-from](https://github.com/unknown-user-from) | Ali Ramazan TAŞDELEN ([alitasdln](https://github.com/alitasdln)) | +| Pedro Escaleira ([oEscal](https://github.com/oEscal)) | Josh ([josh-hemphill](https://github.com/josh-hemphill)) | Tim Würtele ([SECtim](https://github.com/SECtim)) | AviD ([avidouglen](https://github.com/avidouglen)) | +| SheHacksPurple ([shehackspurple](https://github.com/shehackspurple)) | [fcerullo-cycubix](https://github.com/fcerullo-cycubix) | Hector Eryx Paredes Camacho ([heryxpc](https://github.com/heryxpc)) | Irene Michlin ([irene221b](https://github.com/irene221b)) | +| Jonah Y-M ([TG-Techie](https://github.com/TG-Techie)) | Dhiraj Bahroos ([bahroos](https://github.com/bahroos)) | Jef Meijvis ([jefmeijvis](https://github.com/jefmeijvis)) | [IzmaDoesItbeta](https://github.com/IzmaDoesItbeta) | +| Abdessamad TEMMAR ([TmmmmmR](https://github.com/TmmmmmR)) | [sectroyer](https://github.com/sectroyer) | Soh Satoh ([sohsatoh](https://github.com/sohsatoh)) | [regoravalaz](https://github.com/regoravalaz) | +| james-t ([james-bitherder](https://github.com/james-bitherder)) | Aram Hovsepyan ([aramhovsepyan](https://github.com/aramhovsepyan)) | [JaimeGomezGarciaSan](https://github.com/JaimeGomezGarciaSan) | [ValdiGit01](https://github.com/ValdiGit01) | +| iwatachan ([ishowta](https://github.com/ishowta)) | Vinod Anandan ([VinodAnandan](https://github.com/VinodAnandan)) | Kevin Kien ([KevinKien](https://github.com/KevinKien)) | [paul-williamson-swoop](https://github.com/paul-williamson-swoop) | +| [endergzr](https://github.com/endergzr) | Radhwan Alshamamri ([Rado0z](https://github.com/Rado0z)) | Grant Ongers ([rewtd](https://github.com/rewtd)) | Cure53 ([cure53](https://github.com/cure53)) | +| [AliR2Linux](https://github.com/AliR2Linux) | Ads Dawson ([GangGreenTemperTatum](https://github.com/GangGreenTemperTatum)) | William Reyor ([BillReyor](https://github.com/BillReyor)) | gabe ([gcrow](https://github.com/gcrow)) | +| [mascotter](https://github.com/mascotter) | [luissaiz](https://github.com/luissaiz) | Suren Manukyan ([vx-sec](https://github.com/vx-sec)) | Piotr Gliźniewicz ([pglizniewicz](https://github.com/pglizniewicz)) | +| Tadeusz Wachowski ([tadeuszwachowski](https://github.com/tadeuszwachowski)) | Nasir aka Nate ([andesec](https://github.com/andesec)) | [settantasette](https://github.com/settantasette) | Lars Haulin ([LarsH](https://github.com/LarsH)) | +| Terence Eden ([edent](https://github.com/edent)) | [JasmineScholz](https://github.com/JasmineScholz) | Arun Sivadasan ([teavanist](https://github.com/teavanist)) | Yusuf GÜR ([yusuffgur](https://github.com/yusuffgur)) | +| Troy Marshall ([troymarshall](https://github.com/troymarshall)) | Tanner Prynn ([tprynn](https://github.com/tprynn)) | Nick K. ([nickific](https://github.com/nickific)) | [raoul361](https://github.com/raoul361) | +| Azeem Ilyas ([TheAxZim](https://github.com/TheAxZim)) | Evo Stamatov ([avioli](https://github.com/avioli)) | Tim Potter ([timpotter87](https://github.com/timpotter87)) | Gavin Ray ([GavinRay97](https://github.com/GavinRay97)) | +| monis ([demideus](https://github.com/demideus)) | Marcin Hoppe ([MarcinHoppe](https://github.com/MarcinHoppe)) | Grambulf ([ramshazar](https://github.com/ramshazar)) | Jordan Pike ([computersarebad](https://github.com/computersarebad)) | +| Jason Rogers ([jason-invision](https://github.com/jason-invision)) | Ben Hall ([benbhall](https://github.com/benbhall)) | JamesPoppyCock ([jamesly123](https://github.com/jamesly123)) | WhiteHackLabs ([whitehacklabs](https://github.com/whitehacklabs)) | +| Alex Gaynor ([alex](https://github.com/alex)) | Filip van Laenen ([filipvanlaenen](https://github.com/filipvanlaenen)) | [jeurgen](https://github.com/jeurgen) | [GraoMelo](https://github.com/GraoMelo) | +| Andreas Kurtz ([ay-kay](https://github.com/ay-kay)) | Tom Tervoort ([TomTervoort](https://github.com/TomTervoort)) | old man ([deveras](https://github.com/deveras)) | Marco Schnüriger ([marcortw](https://github.com/marcortw)) | +| [stiiin](https://github.com/stiiin) | infoseclearn ([teaminfoseclearn](https://github.com/teaminfoseclearn)) | [hljupkij](https://github.com/hljupkij) | Noe ([nmarher](https://github.com/nmarher)) | +| Lyz ([lyz-code](https://github.com/lyz-code)) | Martin Riedel ([mrtnrdl](https://github.com/mrtnrdl)) | KIM Jaesuck ([tcaesvk](https://github.com/tcaesvk)) | Barbara Schachner ([bschach](https://github.com/bschach)) | +| René Reuter ([AresSec](https://github.com/AresSec)) | [carhackpils](https://github.com/carhackpils) | Tyler ([tyler2cr](https://github.com/tyler2cr)) | Hugo ([hasousa](https://github.com/hasousa)) | +| Wouter Bloeyaert ([Someniak](https://github.com/Someniak)) | Mark de Rijk ([markderijkinfosec](https://github.com/markderijkinfosec)) | Ramin ([picohub](https://github.com/picohub)) | Philip D. Turner ([philipdturner](https://github.com/philipdturner)) | +| Will Chatham ([willc](https://github.com/willc)) | | | | diff --git a/5.0/tools/cyclonedx.py b/5.0/tools/cyclonedx.py index e8b2737113..7cf944287a 100644 --- a/5.0/tools/cyclonedx.py +++ b/5.0/tools/cyclonedx.py @@ -38,7 +38,7 @@ class CycloneDX: bom = {} bom['bomFormat'] = "CycloneDX" - bom['specVersion'] = "1.7" + bom['specVersion'] = "1.6" bom['serialNumber'] = "urn:uuid:" + str(uuid.uuid4()) bom['version'] = 1 bom['metadata'] = {} @@ -51,20 +51,20 @@ class CycloneDX: bom['metadata']['supplier'] = {} bom['metadata']['supplier']['name'] = "OWASP Foundation" bom['metadata']['supplier']['url'] = [ "https://owasp.org" ] - bom['definitions'] = {} - bom['definitions']['standards'] = [] - bom['definitions']['standards'].append({}) + bom['declarations'] = {} + bom['declarations']['standards'] = [] + bom['declarations']['standards'].append({}) def __init__(self, asvs_json_in): self.asvs = asvs_json_in asvs = json.loads(asvs_json_in) bom_ref = asvs["ShortName"] + "-" + asvs["Version"] - self.bom['definitions']['standards'][0]['bom-ref'] = bom_ref - self.bom['definitions']['standards'][0]['name'] = \ + self.bom['declarations']['standards'][0]['bom-ref'] = bom_ref + self.bom['declarations']['standards'][0]['name'] = \ asvs["Name"].replace('Project', '') + "(" + asvs["ShortName"] + ")" - self.bom['definitions']['standards'][0]['version'] = asvs["Version"] - self.bom['definitions']['standards'][0]['description'] = asvs["Description"] - self.bom['definitions']['standards'][0]['owner'] = asvs["Name"] + self.bom['declarations']['standards'][0]['version'] = asvs["Version"] + self.bom['declarations']['standards'][0]['description'] = asvs["Description"] + self.bom['declarations']['standards'][0]['owner'] = asvs["Name"] requirements = [] l1_requirements = [] @@ -89,44 +89,41 @@ def __init__(self, asvs_json_in): elif asvs_requirement['L'] == "3": l3_requirements.append(requirement['bom-ref']) - self.bom['definitions']['standards'][0]['requirements'] = requirements + self.bom['declarations']['standards'][0]['requirements'] = requirements - self.bom['definitions']['standards'][0]['levels'] = [] - self.bom['definitions']['standards'][0]['levels'].append({}) - self.bom['definitions']['standards'][0]['levels'][0] = {} - self.bom['definitions']['standards'][0]['levels'][0]['bom-ref'] = "level-1" - self.bom['definitions']['standards'][0]['levels'][0]['identifier'] = "Level 1" - self.bom['definitions']['standards'][0]['levels'][0]['title'] = "Level 1" - self.bom['definitions']['standards'][0]['levels'][0]['description'] = "This level contains the minimum requirements to consider when securing an application and represents a critical starting point." - self.bom['definitions']['standards'][0]['levels'][0]['requirements'] = l1_requirements - self.bom['definitions']['standards'][0]['levels'].append({}) - self.bom['definitions']['standards'][0]['levels'][1] = {} - self.bom['definitions']['standards'][0]['levels'][1]['bom-ref'] = "level-2" - self.bom['definitions']['standards'][0]['levels'][1]['identifier'] = "Level 2" - self.bom['definitions']['standards'][0]['levels'][1]['title'] = "Level 2" - self.bom['definitions']['standards'][0]['levels'][1]['description'] = "ASVS Level 2 requirements generally relate to either less common attacks or more complicated protections against common attacks. They may still be a first layer of defense, or they may require certain preconditions for the attack to be successful." - self.bom['definitions']['standards'][0]['levels'][1]['requirements'] = l2_requirements - self.bom['definitions']['standards'][0]['levels'].append({}) - self.bom['definitions']['standards'][0]['levels'][2] = {} - self.bom['definitions']['standards'][0]['levels'][2]['bom-ref'] = "level-3" - self.bom['definitions']['standards'][0]['levels'][2]['identifier'] = "Level 3" - self.bom['definitions']['standards'][0]['levels'][2]['title'] = "Level 3" - self.bom['definitions']['standards'][0]['levels'][2]['description'] = "ASVS Level 3 should be the goal for applications looking to demonstrate the highest levels of security and requirements in this section are generally either defense-in-depth mechanisms or other useful but hard-to-implement controls." - self.bom['definitions']['standards'][0]['levels'][2]['requirements'] = l3_requirements + self.bom['declarations']['standards'][0]['levels'] = [] + self.bom['declarations']['standards'][0]['levels'].append({}) + self.bom['declarations']['standards'][0]['levels'][0] = {} + self.bom['declarations']['standards'][0]['levels'][0]['bom-ref'] = "level-1" + self.bom['declarations']['standards'][0]['levels'][0]['identifier'] = "Level 1" + self.bom['declarations']['standards'][0]['levels'][0]['description'] = "This level contains the minimum requirements to consider when securing an application and represents a critical starting point." + self.bom['declarations']['standards'][0]['levels'][0]['requirements'] = l1_requirements + self.bom['declarations']['standards'][0]['levels'].append({}) + self.bom['declarations']['standards'][0]['levels'][1] = {} + self.bom['declarations']['standards'][0]['levels'][1]['bom-ref'] = "level-2" + self.bom['declarations']['standards'][0]['levels'][1]['identifier'] = "Level 2" + self.bom['declarations']['standards'][0]['levels'][1]['description'] = "ASVS Level 2 requirements generally relate to either less common attacks or more complicated protections against common attacks. They may still be a first layer of defense, or they may require certain preconditions for the attack to be successful." + self.bom['declarations']['standards'][0]['levels'][1]['requirements'] = l2_requirements + self.bom['declarations']['standards'][0]['levels'].append({}) + self.bom['declarations']['standards'][0]['levels'][2] = {} + self.bom['declarations']['standards'][0]['levels'][2]['bom-ref'] = "level-3" + self.bom['declarations']['standards'][0]['levels'][2]['identifier'] = "Level 3" + self.bom['declarations']['standards'][0]['levels'][2]['description'] = "ASVS Level 3 should be the goal for applications looking to demonstrate the highest levels of security and requirements in this section are generally either defense-in-depth mechanisms or other useful but hard-to-implement controls." + self.bom['declarations']['standards'][0]['levels'][2]['requirements'] = l3_requirements - self.bom['definitions']['standards'][0]['externalReferences'] = [] - self.bom['definitions']['standards'][0]['externalReferences'].append({}) - self.bom['definitions']['standards'][0]['externalReferences'][0]['type'] = 'website' - self.bom['definitions']['standards'][0]['externalReferences'][0]['url'] = 'https://owasp.org/asvs' - self.bom['definitions']['standards'][0]['externalReferences'].append({}) - self.bom['definitions']['standards'][0]['externalReferences'][1]['type'] = 'vcs' - self.bom['definitions']['standards'][0]['externalReferences'][1]['url'] = 'https://github.com/OWASP/ASVS' - self.bom['definitions']['standards'][0]['externalReferences'].append({}) - self.bom['definitions']['standards'][0]['externalReferences'][2]['type'] = 'issue-tracker' - self.bom['definitions']['standards'][0]['externalReferences'][2]['url'] = 'https://github.com/OWASP/ASVS/issues' - self.bom['definitions']['standards'][0]['externalReferences'].append({}) - self.bom['definitions']['standards'][0]['externalReferences'][3]['type'] = 'social' - self.bom['definitions']['standards'][0]['externalReferences'][3]['url'] = 'https://twitter.com/OWASP_ASVS' + self.bom['declarations']['standards'][0]['externalReferences'] = [] + self.bom['declarations']['standards'][0]['externalReferences'].append({}) + self.bom['declarations']['standards'][0]['externalReferences'][0]['type'] = 'website' + self.bom['declarations']['standards'][0]['externalReferences'][0]['url'] = 'https://owasp.org/asvs' + self.bom['declarations']['standards'][0]['externalReferences'].append({}) + self.bom['declarations']['standards'][0]['externalReferences'][1]['type'] = 'vcs' + self.bom['declarations']['standards'][0]['externalReferences'][1]['url'] = 'https://github.com/OWASP/ASVS' + self.bom['declarations']['standards'][0]['externalReferences'].append({}) + self.bom['declarations']['standards'][0]['externalReferences'][2]['type'] = 'issue-tracker' + self.bom['declarations']['standards'][0]['externalReferences'][2]['url'] = 'https://github.com/OWASP/ASVS/issues' + self.bom['declarations']['standards'][0]['externalReferences'].append({}) + self.bom['declarations']['standards'][0]['externalReferences'][3]['type'] = 'social' + self.bom['declarations']['standards'][0]['externalReferences'][3]['url'] = 'https://twitter.com/OWASP_ASVS' def convert_requirement(self, asvs_requirement, parent): requirement = {} diff --git a/5.0/tr/0x00-Header.yaml b/5.0/tr/0x00-Header.yaml new file mode 100644 index 0000000000..008ba53ddc --- /dev/null +++ b/5.0/tr/0x00-Header.yaml @@ -0,0 +1,16 @@ +--- + title: "Uygulama Güvenliği Doğrulama Standardı" + subtitle: "Versiyon 5.0.0" + date: Mayıs 2025 + titlepage: true + titlepage-rule-height: 0 + titlepage-logo: "images/owasp_logo_1c_notext.png" + table-use-row-colors: true + toc: true + toc-own-page: true + geometry: "left=2cm,right=2cm,top=3cm,bottom=3cm" + CJKmainfont: "Noto Sans CJK JP" + mainfont: "Source Serif 4" + sansfont: "Source Sans 3" +--- + diff --git a/5.0/tr/0x01-Frontispiece.md b/5.0/tr/0x01-Frontispiece.md new file mode 100644 index 0000000000..10cc928d18 --- /dev/null +++ b/5.0/tr/0x01-Frontispiece.md @@ -0,0 +1,46 @@ +# Bilgilendirme + +## Standart Hakkında + +Uygulama Güvenliği Doğrulama Standardı, mimarlar, geliştiriciler, test uzmanları, güvenlik profesyonelleri, araç satıcıları ve tüketiciler tarafından güvenli uygulamaları tanımlamak, inşa etmek, test etmek ve doğrulamak için kullanılabilecek uygulama güvenliği gereksinimleri veya testlerinin bir listesidir. + +## Telif Hakkı ve Lisans + +Versiyon 5.0.0, Mayıs 2025 + +![license](../images/license.png) + +Copyright © 2008-2025 The OWASP Foundation. + +Bu doküman [Creative Commons Attribution-ShareAlike 4.0 Uluslararası Lisansı](https://creativecommons.org/licenses/by-sa/4.0/) altında yayımlanmıştır. + +Dokümanın yeniden kullanımı veya dağıtımı esnasında bu lisans göz önünde bulundurulmalıdır. + +## Proje Liderleri + +| | | +|---------------------- |----------------- | +| Elar Lang | Josh C Grossman | +| Jim Manico | Daniel Cuthbert | + +## Çalışma Grubu + +| | | | | +|---------------- |------------------ |------------------- |----------------- | +| Tobias Ahnoff | Ralph Andalis | Ryan Armstrong | Gabriel Corona | +| Meghan Jacquot | Shanni Prutchi | Iman Sharafaldin | Eden Yardeni | + +## Diğer Önemli Katkıda Bulunanlar + +| | | +|-------------------|-------------------| +| Sjoerd Langkemper | Isaac Lewis | +| Mark Carney | Sandro Gauci | + +## Diğer Katkıda Bulunanlar ve Değerlendirenler + +Diğer katkıda bulunanların bir listesini Ek E'ye ekledik. + +Eğer 5.x katkıda bulunanlar listesinde eksik bir kişi varsa, gelecekteki 5.x güncellemelerinde eklenmesi için lütfen GitHub'da bir olay açın. + +Uygulama Güvenliği Doğrulama Standardı, 2008'de ASVS 1.0'dan 2019'da ASVS 4.0'a kadar katkıda bulunanların emeğiyle inşa edilmiştir. ASVS'nin bugünkü yapısının ve doğrulama maddelerinin çoğu, başlangıçta Andrew van der Stock, Mike Boberski, Jeff Williams ve/veya Dave Wichers tarafından yazılmış olsa da, katkıda bulunan çok daha fazla kişi bulunmaktadır. Daha önce katkıda bulunan herkese teşekkür ederiz. Önceki sürümlere katkıda bulunanların tam listesi için lütfen önceki ilgili sürümleri inceleyin. diff --git a/5.0/tr/0x02-Preface.md b/5.0/tr/0x02-Preface.md new file mode 100644 index 0000000000..685fb10e54 --- /dev/null +++ b/5.0/tr/0x02-Preface.md @@ -0,0 +1,29 @@ +# Önsöz + +Uygulama Güvenliği Doğrulama Standardı (ASVS) 5.0 sürümüne hoş geldiniz. + +## Giriş + +İlk olarak 2008 yılında küresel bir topluluk iş birliğiyle başlatılan ASVS, modern web uygulamaları ve servislerinin tasarımı, geliştirilmesi ve test edilmesi için kapsamlı bir güvenlik gereksinimleri setini tanımlar. + +2019’da ASVS 4.0 sürümü ve 2021’deki küçük güncellemesi (v4.0.3) sonrası, 5.0 sürümü yazılım güvenliğindeki en son gelişmeleri yansıtacak şekilde modernleştirilmiş önemli bir dönüm noktasıdır. + +ASVS 5.0, proje liderleri, çalışma grubu üyeleri ve bunlardan daha geniş OWASP topluluğunun bu önemli standardı güncellemek ve geliştirmek amacıyla verdikleri yoğun katkıların sonucudur. + +## 5.0 Sürümünün Arkasındaki İlkeler + +Bu büyük revizyon, birkaç temel ilke göz önünde bulundurularak geliştirilmiştir: + +* Daha Net Kapsam ve Odak: Standardın bu sürümü, adındaki temel dayanaklar "Uygulama, Güvenlik, Doğrulama ve Standart" ile daha doğrudan uyumlu olacak şekilde tasarlanmıştır. Gereksinimler, belirli teknik uygulamaları zorunlu kılmak yerine, güvenlik açıklarının önlenmesine vurgu yapacak şekilde yeniden yazılmıştır. Gereksinim metinlerinin kendi kendilerini açıklaması ve neden var olduklarını açıklaması amaçlanmıştır. + +* Belgelenmiş Güvenlik Kararları Desteği: ASVS 5.0, temel güvenlik kararlarının belgelenmesine dair gereksinimler getirmektedir. Bu sayede izlenebilirlik artar ve bağlama duyarlı uygulamalar desteklenerek, organizasyonların güvenlik duruşlarını özel ihtiyaç ve risklerine göre uyarlamalarına olanak sağlar. + +* Güncellenmiş Seviyeler: ASVS üç katmanlı modelini korurken, benimsenmelerinin kolaylaştırması için seviye tanımları geliştirilmiştir. Seviye 1, ASVS’yi benimsemenin ilk adımı olarak tasarlanmıştır ve ilk savunma katmanını sağlamaktadır. Seviye 2, standart güvenlik uygulamalarının kapsamlı bir görünümünü sunar. Seviye 3 ise gelişmiş ve yüksek seviye güvence gereksinimlerini kapsar. + +* Yeniden Yapılandırılmış ve Genişletilmiş İçerik: ASVS 5.0, 17 bölümde yaklaşık 350 gereksinimi içermektedir. Bölümler, açıklık ve kullanılabilirliği artırmak için yeniden düzenlenmiştir. Geçişi kolaylaştırmak amacıyla v4.0 ile v5.0 arasında çift yönlü bir eşleştirme sağlanmıştır. + +## ASVS'nin Geleceği + +Bir uygulamanın güvenliğini sağlamak hiçbir zaman tam anlamıyla bitmeyeceği gibi, ASVS de bitmeyecektir. 5.0 sürümü büyük bir adım olsa da, geliştirme süreci devam etmektedir. Bu sürüm, topluluğun biriken geliştirmelerden ve eklemelerden faydalanmasını sağlamakla kalmaz, aynı zamanda gelecekteki iyileştirmeler için zemin hazırlar. Bunlar arasında topluluk tarafından oluşturulan uygulama ve doğrulama rehberlerinin temel gereksinim seti üzerine inşa edilmesi de olabilir. + +ASVS 5.0, güvenli yazılım geliştirme için güvenilir bir temel oluşturacak şekilde tasarlanmıştır. Topluluk, uygulama güvenliğinin durumunu kolektif olarak ilerletmek için bu standardı benimsemeye, katkıda bulunmaya ve üzerine inşa etmeye davet edilmektedir. diff --git a/5.0/tr/0x03-What-is-the-ASVS.md b/5.0/tr/0x03-What-is-the-ASVS.md new file mode 100644 index 0000000000..0802a8a406 --- /dev/null +++ b/5.0/tr/0x03-What-is-the-ASVS.md @@ -0,0 +1,195 @@ +# ASVS Nedir? + +Uygulama Güvenliği Doğrulama Standardı (ASVS), web uygulamaları ve hizmetleri için güvenlik gereksinimlerini tanımlar ve güvenli uygulamalar tasarlamayı, geliştirmeyi ve sürdürmeyi veya bunların güvenliğini değerlendirmeyi amaçlayan herkes için değerli bir kaynaktır. + +Bu bölümde ASVS'nin kapsamı, önceliğe dayalı seviyelerinin yapısı ve standart için birincil kullanım durumları da dahil olmak üzere ASVS'yi kullanmanın temel yönleri özetlenmektedir. + +## ASVS'nin Kapsamı + +ASVS'nin kapsamı adıyla tanımlanmaktadır: Uygulama, Güvenlik, Doğrulama ve Standart. Ulaşılması gereken güvenlik ilkelerini tanımlamak amacıyla hangi gereksinimlerin dahil edileceğini veya hariç tutulacağını belirler. Kapsam, uygulama gereksinimleri için temel teşkil eden dokümantasyon gereksinimlerini de dikkate alır. + +Saldırganlar için kapsam diye bir şey yoktur. Bu nedenle ASVS gereksinimleri, CI/CD süreçleri, hosting ve operasyonel faaliyetler de dahil olmak üzere uygulama yaşam döngüsünün diğer yönlerine ilişkin yönlendirmelerle birlikte değerlendirilmelidir. + +### Uygulama + +ASVS bir “uygulamayı”, güvenlik kontrollerinin entegre edilmesi gereken ve geliştirilmekte olan yazılım ürünü olarak tanımlar. ASVS, geliştirme yaşam döngüsü faaliyetlerini belirlemez veya uygulamanın bir CI/CD boru hattı aracılığıyla nasıl oluşturulması gerektiğini dikte etmez. Bunun yerine, ürünün kendi içinde elde edilmesi gereken güvenlik sonuçlarını belirtir. + +Web Uygulaması Güvenlik Duvarları (WAF'lar), yük dengeleyiciler veya proxy'ler gibi HTTP trafiğini sunan, değiştiren veya doğrulayan bileşenler, bazı güvenlik kontrolleri doğrudan bunlara bağlı olduğundan veya bunlar aracılığıyla uygulanabildiğinden, bu özel amaçlar için uygulamanın bir parçası olarak kabul edilebilir. Bu bileşenler, önbelleğe alınan yanıtlar, hız sınırlaması veya gelen ve giden bağlantıların kaynak ve hedefe göre kısıtlanmasıyla ilgili gereksinimler için dikkate alınmalıdır. + +Tersine, ASVS genellikle uygulamayla doğrudan ilgili olmayan veya yapılandırmanın uygulamanın sorumluluğu dışında olduğu gereksinimleri hariç tutar. Örneğin, DNS sorunları genellikle ayrı bir ekip veya işlev tarafından yönetilir. + +Benzer şekilde, uygulama girdiyi nasıl tükettiğinden ve çıktıyı nasıl ürettiğinden sorumlu olsa da, harici bir süreç uygulama veya verileriyle etkileşime giriyorsa, ASVS için kapsam dışı kabul edilir. Örneğin, uygulamanın veya verilerinin yedeklenmesi genellikle harici bir sürecin sorumluluğundadır ve uygulama veya geliştiricileri tarafından kontrol edilmez. + +### Güvenlik + +Her gerekliliğin güvenlik üzerinde kanıtlanabilir bir etkisi olmalıdır. Bir gerekliliğin olmaması daha az güvenli bir uygulama ile sonuçlanmalı ve gerekliliğin uygulanması bir güvenlik riskinin olasılığını veya etkisini azaltmalıdır. + +İşlevsel yönler, kod stili veya politika gereksinimleri gibi diğer tüm hususlar kapsam dışıdır. + +### Doğrulama + +Gereksinim doğrulanabilir olmalı ve doğrulama “başarısız” veya “başarılı” kararıyla sonuçlanmalıdır. + +### Standart + +ASVS, standarda uymak için uygulanması gereken bir güvenlik gereksinimleri koleksiyonu olarak tasarlanmıştır. Bu, gereksinimlerin bunu başarmak için güvenlik hedefini tanımlamakla sınırlı olduğu anlamına gelir. Diğer ilgili bilgiler ASVS'nin üzerine inşa edilebilir veya eşleştirmeler yoluyla bağlanabilir. + +Özellikle, OWASP'ın birçok projesi vardır ve ASVS kasıtlı olarak diğer projelerdeki içerikle örtüşmekten kaçınır. Örneğin, geliştiricilerin “belirli bir gereksinimi kendi teknolojimde veya ortamımda nasıl uygulayabilirim” şeklinde bir sorusu olabilir ve bu, Cheat Sheet Series projesi kapsamında ele alınmalıdır. Doğrulayıcıların “bu gereksinimi bu ortamda nasıl test edebilirim” şeklinde bir sorusu olabilir ve bu Web Güvenliği Test Kılavuzu projesi kapsamında ele alınmalıdır. + +ASVS sadece güvenlik uzmanlarının kullanımına yönelik olmamakla birlikte, okuyucunun içeriği anlamak için teknik bilgiye veya belirli kavramları araştırma becerisine sahip olmasını beklemektedir. + +### Gereksinim + +Gereksinim kelimesi ASVS'de özel olarak kullanılır çünkü bu kelimenin karşılanması için nelerin başarılması gerektiğini tanımlar. ASVS sadece gereksinimleri (must) içerir ve ana koşul olarak tavsiyeleri (should) içermez. + +Başka bir deyişle, ister bir sorunu çözmek için birçok olası seçenekten biri isterse de kod stili hususları olsun, öneriler bir gereksinim olma tanımını karşılamaz. + +ASVS gereksinimleri, uygulamaya veya teknolojiye özgü olmadan belirli güvenlik ilkelerini ele almayı ve aynı zamanda neden var olduklarına dair açıklayıcı olmayı amaçlamaktadır. Bu aynı zamanda gereksinimlerin belirli bir doğrulama yöntemi veya uygulaması etrafında oluşturulmadığı anlamına gelir. + +### Belgelenmiş güvenlik kararları + +Yazılım güvenliğinde, güvenlik tasarımını ve kullanılacak mekanizmaları erkenden planlamak, bitmiş üründe veya özellikte daha tutarlı ve güvenilir bir uygulama oluşturacaktır. + +Ayrıca, belirli gereksinimler için uygulama, karmaşık ve bir uygulamanın ihtiyaçlarına çok spesifik olacaktır. Yaygın örnekler arasında izinler, girdi doğrulama ve farklı hassas veri seviyeleri etrafında koruyucu kontroller yer alır. + +Bunu hesaba katmak için "tüm veriler şifrelenmelidir" gibi kapsamlı ifadeler veya bir gereksinimde olası her kullanım durumunu kapsamaya çalışmak yerine, uygulama geliştiricisinin bu tür kontrollere yaklaşımının ve yapılandırmasının belgelenmesini zorunlu kılan dokümantasyon gereksinimleri dahil edilmiştir. Bu daha sonra uygunluk açısından gözden geçirilebilir ve ardından gerçek uygulama, uygulamanın beklentilere uyup uymadığını değerlendirmek için belgelerle karşılaştırılabilir. + +Bu gereksinimler, uygulamayı geliştiren kuruluşun belirli güvenlik gereksinimlerinin nasıl uygulanacağına ilişkin aldığı kararları belgelemeyi amaçlamaktadır. + +Dokümantasyon gereksinimleri her zaman bir bölümün ilk kısmında yer alır (her bölümde olmasa da) ve her zaman dokümante edilen kararların gerçekten uygulamaya konulması gereken ilgili bir uygulama gerekliliğine sahiptir. Burada önemli olan nokta, dokümantasyonun yerinde olduğunu ve fiili uygulamanın iki ayrı faaliyet olduğunu doğrulamaktır. + +Bu gereksinimleri dahil etmenin iki temel nedeni vardır. İlk neden, güvenlik gereksiniminin genellikle kuralların uygulanmasını içermesidir. Örneğin hangi tür dosya türlerinin yüklenmesine izin verilir, hangi iş kontrolleri uygulanmalıdır, belirli bir alan için izin verilen karakterler nelerdir gibi uygulanma biçimleri. Bu kurallar her uygulama için farklı olacaktır ve bu nedenle ASVS, bunların ne olması gerektiğini kuralcı bir şekilde tanımlayamaz ve bu durumda bir cheat sheet veya daha ayrıntılı bir yanıt da yardımcı olmaz. Benzer şekilde, bu kararlar belgelenmeden, bu kararları uygulayan gereksinimlerin doğrulanması mümkün olmayacaktır. + +İkinci neden ise, belirli gereksinimler için belirli güvenlik sorunlarının nasıl ele alınacağı konusunda esnekliğe sahip bir uygulama geliştirme sağlamanın önemli olmasıdır. Örneğin, önceki ASVS sürümlerinde oturum zaman aşımı kuralları çok kuralcıydı. Pratik olarak, birçok uygulama, özellikle tüketicilere yönelik olanlar, çok daha esnek kurallara sahiptir ve bunun yerine diğer risk azaltma kontrollerini uygulamayı tercih eder. Bu nedenle, belgeleme gereksinimleri bu konuda açıkça esneklik sağlar. + +Elbette ki, bu kararların bireysel geliştiriciler tarafından alınması ve belgelenmesi beklenmemektedir. Aksine, bu kararlar organizasyonun bir bütün olarak alınacak ve geliştiricilere iletilecek, geliştiriciler de bu kararları uygulamaya özen gösterecektir. + +Geliştiricilere yeni özellikler ve işlevler için spesifikasyonlar ve tasarımlar sağlamak, yazılım geliştirmenin standart bir parçasıdır. Benzer şekilde, geliştiricilerin her seferinde kendi kararlarını vermek yerine ortak bileşenleri ve kullanıcı arayüzü mekanizmalarını kullanmaları beklenir. Bu nedenle, bunu güvenliğe genişletmek şaşırtıcı veya tartışmalı olarak görülmemelidir. + +Bunu nasıl başaracağınız konusunda da esneklik vardır. Güvenlik kararları, geliştiricilerin başvurması beklenen yazılı bir belgede belgelenebilir. Alternatif olarak, güvenlik kararları belgelenebilir ve tüm geliştiricilerin kullanması zorunlu olan ortak bir kod kütüphanesinde uygulanabilir. Her iki durumda da istenen sonuç elde edilir. + +## Uygulama Güvenliği Doğrulama Seviyeleri + +ASVS, seviyesi arttıkça derinliği ve karmaşıklığı artan üç güvenlik doğrulama seviyesi tanımlar. Genel amaç, kuruluşların en kritik güvenlik sorunlarını ele almak için ilk seviyeden başlaması ve ardından kuruluşun ve uygulamanın ihtiyaçlarına göre daha yüksek seviyelere geçmesidir. Seviyeler, belgede ve gereksinim metinlerinde L1, L2 ve L3 olarak gösterilebilir. + +Her ASVS seviyesi, o seviyeden elde edilmesi gereken güvenlik gereksinimlerini belirtir ve kalan daha yüksek seviye gereksinimler öneri olarak sunulur. + +Yinelenen gereksinimleri veya daha yüksek seviyelerde artık geçerli olmayan gereksinimleri önlemek için bazı gereksinimler belirli bir seviyeye özel uygulanır. Fakat bu gereksinimler daha yüksek seviyeler için daha katı koşullar içerir. + +### Seviye değerlendirmesi + +Seviyeler, güvenlik gereksinimlerinin uygulanması ve test edilmesi deneyimine dayalı olarak her bir gereksinimin öncelik bazlı değerlendirmesiyle tanımlanır. Ana odak noktası, risk azaltma ile gereksinimin uygulanması için gereken çabayı karşılaştırmaktır. Bir diğer önemli faktör ise giriş engelini düşük tutmaktır. + +Risk azaltma, gereksinimin uygulama içindeki güvenlik riskinin düzeyini ne ölçüde azalttığını, klasik Gizlilik, Bütünlük ve Kullanılabilirlik etki faktörlerini dikkate alarak ve bunun birincil savunma katmanı mı yoksa derinlemesine savunma mı olduğunu değerlendirerek değerlendirir. + +Kriterler ve seviyelendirme kararları etrafında yapılan titiz tartışmalar, her duruma %100 uymayabileceğini kabul etmekle birlikte, vakaların büyük çoğunluğu için geçerli olması gereken bir dağılımla sonuçlanmıştır. Bu, belirli durumlarda kuruluşların kendi özel risk değerlendirmelerine göre daha yüksek seviyedeki gereksinimleri daha erken önceliklendirmek isteyebilecekleri anlamına gelir. + +Her seviyedeki gereksinim türleri aşağıdaki gibi tanımlanabilir: + +### Seviye 1 + +Bu seviye, bir uygulamayı güvenli hale getirirken dikkate alınması gereken minimum gereksinimleri içerir ve kritik bir başlangıç noktasıdır. Bu seviye, ASVS gereksinimlerinin yaklaşık %20'sini içerir. Bu seviyenin amacı, giriş engelini azaltmak için mümkün olduğunca az gereksinim olmasını sağlamaktır. + +Bu gereksinimler genellikle kritik veya temel, diğer güvenlik açıklarının veya ön koşulların istismar edilmesini gerektirmeyen yaygın saldırıları önlemek için birinci katman savunma gereksinimleridir. + +Birinci savunma katmanı gereksinimlerine ek olarak, bazı gereksinimlerin daha yüksek seviyelerde etkisi daha azdır, şifrelerle ilgili gereksinimler gibi. Bunlar Seviye 1 için daha önemlidir, çünkü daha yüksek seviyelerde çok faktörlü kimlik doğrulama gereksinimleri önem kazanır. + +Seviye 1, belgelere veya koda iç erişimi olmayan bir dış test uzmanı tarafından mutlaka penetrasyon testi yapılabilir değildir (örneğin "kara kutu" testi), ancak gereksinimlerin sayısının az olması doğrulamayı kolaylaştırmalıdır. + +### Seviye 2 + +Çoğu uygulama bu güvenlik seviyesine ulaşmak için çaba göstermelidir. ASVS'deki gereksinimlerin yaklaşık %50'si L2 seviyesindedir, yani bir uygulamanın L2 seviyesine uymak için ASVS'deki gereksinimlerin yaklaşık %70'ini (tüm L1 ve L2 gereksinimlerini) uygulaması gerekir. + +Bu gereksinimler genellikle daha az yaygın saldırılarla veya yaygın saldırılara karşı daha karmaşık korumalarla ilgilidir. Bunlar hala ilk savunma katmanı olabilir veya saldırının başarılı olması için belirli ön koşullar gerektirebilir. + +### Seviye 3 + +Bu seviye, en yüksek güvenlik seviyelerini göstermek isteyen uygulamalar için bir hedef olmalıdır. Bu seviye, uyum sağlamak için gereken gereksinimlerin son %30'unu sağlar. + +Bu bölümdeki gereksinimler genellikle derinlemesine savunma mekanizmaları veya diğer yararlı ancak uygulanması zor kontrollerden oluşur. + +### Hangi seviyeye ulaşılmalı? + +Öncelik tabanlı seviyeler, kuruluşun ve uygulamanın uygulama güvenliği olgunluğunu yansıtmayı amaçlamaktadır. ASVS, bir uygulamanın hangi seviyede olması gerektiğini kuralcı bir şekilde belirtmek yerine, kuruluşun risklerini analiz etmesi ve uygulamanın hassasiyetine ve elbette uygulamanın kullanıcılarının beklentilerine bağlı olarak hangi seviyede olması gerektiğini belirlemesi gerekir. + +Örneğin, yalnızca sınırlı miktarda hassas veri toplayan erken aşamadaki bir girişim, ilk güvenlik hedefleri için Seviye 1'e odaklanmaya karar verebilir, ancak bir banka, çevrimiçi bankacılık uygulaması için müşterilerine Seviye 3'ten daha düşük bir seviyeyi haklı çıkarmakta zorlanabilir. + +## ASVS nasıl kullanılır? + +### ASVS'nin yapısı + +ASVS, toplamda yaklaşık 350 gereksinimden oluşur ve bu gereksinimler 17 bölüme ayrılmıştır. Her bölüm de alt bölümlere ayrılmıştır. + +Bölüm ve alt bölümlerin ayrılmasının amacı, uygulama ile ilgili olanları seçmeyi veya filtrelemeyi kolaylaştırmaktır. Örneğin, bir makineler arası API için, V3 bölümündeki web ön uçlarıyla ilgili gereksinimler ilgili olmayacaktır. OAuth veya WebRTC kullanılmıyorsa, bu bölümler de göz ardı edilebilir. + +### Sürüm stratejisi + +ASVS sürümleri "Major.Minor.Patch" ("Büyük.Küçük.Yama") modelini izler ve sayılar sürüm içinde nelerin değiştiği hakkında bilgi verir. Büyük bir sürümde ilk sayı, küçük bir sürümde ikinci sayı ve yama sürümünde üçüncü sayı değişir. + +* Büyük sürüm - Tamamen yeniden düzenleme yapılmıştır. Gereksinim numaraları da dahil olmak üzere neredeyse her şey değişebilir. Uyumluluk için yeniden değerlendirme gerekli olacaktır (örneğin, 4.0.3 -> 5.0.0). +* Küçük sürüm - Gereksinimler eklenebilir veya kaldırılabilir, ancak genel numaralandırma aynı kalır. Uyumluluk için yeniden değerlendirme gerekli olacaktır, ancak daha kolay olacaktır (örneğin, 5.0.0 -> 5.1.0). +* Yama sürümü - Gereksinimler kaldırılabilir (örneğin, tekrar eden veya güncelliğini yitiren gereksinimler) veya daha az katı hale getirilebilir, ancak önceki sürüme uygun olan bir uygulama, yama sürümüne de uygun olacaktır (örneğin, 5.0.0 -> 5.0.1). + +Yukarıdaki bilgiler özellikle ASVS'deki gereksinimlerle ilgilidir. Gereksinimleri çevreleyen metin ve ekler gibi diğer içeriklerdeki değişiklikler, önemli bir değişiklik olarak değerlendirilmeyecektir. + +### ASVS ile esneklik + +Yukarıda açıklanan belgeleme gereksinimleri ve seviye mekanizması gibi bazı noktalar, ASVS'yi daha esnek ve kuruluşa özgü bir şekilde kullanma olanağı sağlar. + +Ayrıca, kuruluşların uygulamalarının belirli özelliklerine ve risk seviyelerine göre gereksinimleri ayarlayan, kuruluşa veya alana özgü bir "fork" oluşturmaları şiddetle tavsiye edilir. Ancak, gereksinim 4.1.1'in tüm sürümlerde aynı anlama gelmesi için izlenebilirliği korumak önemlidir. + +İdeal olarak, her kuruluş kendi özel ASVS'sini oluşturmalı ve ilgisiz bölümleri (örneğin, kullanılmıyorsa GraphQL, WebSockets, SOAP) çıkarmalıdır. Kuruluşa özgü bir ASVS sürümü veya eki, gereksinimlere uyum sağlarken kullanılacak kütüphaneleri veya kaynakları ayrıntılı olarak açıklayan, kuruluşa özgü uygulama kılavuzları sağlamak için de iyi bir varlıktır. + +### ASVS Gereksinimlerine Nasıl Atıfta Bulunulur? + +Her gereksinim, her ögesinin bir sayı olduğu `..` biçiminde bir tanımlayıcıya sahiptir. Örneğin, `1.11.3`. + +* `` (chapter) değeri, gereksinimin geldiği bölümü belirtir. Örneğin, tüm `1.#.#` gereksinimleri "Kodlama (Encoding) ve Temizleme" bölümünden gelir. +* `` (section) değeri, o bölüm içinde gereksinimin yer aldığı kısmı belirtir. Örneğin, tüm `1.2.#` gereksinimleri "Kodlama ve Temizleme" bölümünün "Enjeksiyon Önleme" bölümündedir. +* `` (requirement) değeri, bölüm ve kısım içindeki belirli bir gereksinimi tanımlar. Örneğin, bu standardın 5.0.0 sürümünde `1.2.5` şu şekildedir: + +> Uygulamanın işletim sistemi komut enjeksiyonuna karşı koruma sağladığını ve işletim sistemi çağrılarının parametreli işletim sistemi sorguları veya bağlamsal komut satırı çıktı kodlaması kullandığını doğrulayın. + +Tanımlayıcılar standardın sürümleri arasında değişebileceğinden, diğer belgeler, raporlar veya araçlar için aşağıdaki biçimin kullanılması tercih edilir: `v-..`, burada: 'sürüm' ASVS sürüm etiketidir. Örneğin: `v5.0.0-1.2.5`, 5.0.0 sürümünün "Kodlama ve Temizleme" bölümünün "Enjeksiyon Önleme" alt bölümündeki 5. gereksinimi ifade eder. (Bu, `v-` olarak özetlenebilir.) + +Not: Format içinde sürüm numarasından önce gelen v her zaman küçük harf olmalıdır. + +Tanımlayıcılar v öğesi olmadan kullanıldığında, varsayılan olarak en güncel Uygulama Güvenliği Doğrulama Standardı içeriğine atıfta bulunulduğu kabul edilir. Ancak standart büyüyüp değiştikçe bu durum sorun yaratabilir, bu nedenle yazarlar veya geliştiriciler sürüm öğesini eklemelidir. + +ASVS gereksinim listeleri, başvuru veya programatik kullanım için yararlı olabilecek CSV, JSON ve diğer formatlarda sunulmaktadır. + +### ASVS’yi Çatallama (Forklama) + +Kuruluşlar, üç seviyeden birini seçerek veya uygulama risk seviyesine göre gereksinimleri ayarlayan alana özgü bir fork oluşturarak ASVS'den faydalanabilir. Bu tür bir fork, izlenebilirliği koruduğu sürece teşvik edilir, böylece 4.1.1 gereksiniminin karşılanması tüm sürümlerde aynı anlama gelir. + +İdeal olarak, her kuruluş kendi özel ASVS'sini oluşturmalı ve alakasız bölümleri (örneğin, kullanılmıyorsa GraphQL, Websockets, SOAP) çıkarmalıdır. Fork oluşturma, ASVS Seviye 1'i temel alarak başlamalı ve uygulamanın riskine göre Seviye 2 veya 3'e ilerlemelidir. + +## ASVS’nin kullanım alanları + +ASVS, bir uygulamanın güvenliğini değerlendirmek amacıyla kullanılabilir ve bu konu bir sonraki bölümde daha ayrıntılı olarak ele alınacaktır. Ancak, ASVS'nin (veya forklanmış bir sürümünün) başka potansiyel kullanım alanları da belirlenmiştir. + +### Ayrıntılı Güvenlik Mimarisi Rehberi Olarak Kullanma + +Uygulama Güvenliği Doğrulama Standardı'nın en yaygın kullanım alanlarından biri, güvenlik mimarları için bir kaynak olarak kullanılmasıdır. Özellikle modern uygulamalarda, güvenli bir uygulama mimarisi oluşturmak için sınırlı sayıda kaynak mevcuttur. ASVS, güvenlik mimarlarının veri koruma modelleri ve girdi doğrulama stratejileri gibi yaygın sorunlar için daha iyi kontroller seçmelerine olanak tanıyarak bu boşlukları doldurmak için kullanılabilir. Mimari ve dokümantasyon gereksinimleri bu konuda özellikle yararlı olacaktır. + +### Özelleştirilmiş Bir Güvenli Kodlama Referansı Olarak Kullanma + +ASVS, uygulama geliştirme sırasında güvenli kodlama referansı hazırlamak için temel olarak kullanılabilir ve geliştiricilerin yazılım oluştururken güvenliği göz önünde bulundurmalarını sağlar. ASVS temel olarak kullanılabilirken, kuruluşlar kendi özel kılavuzlarını hazırlamalıdır. Bu kılavuzlar açık ve birleşik olmalı ve ideal olarak güvenlik mühendisleri veya güvenlik mimarlarının rehberliğine dayalı olarak hazırlanmalıdır. Bunun bir uzantısı olarak, kuruluşların mümkün olduğunca kılavuzda referans gösterilebilecek ve geliştiriciler tarafından kullanılabilecek onaylanmış güvenlik mekanizmaları ve kütüphaneleri hazırlamaları teşvik edilir. + +### Otomatik Birim ve Entegrasyon Testleri İçin Rehber Olarak Kullanma + +ASVS, yüksek düzeyde test edilebilir şekilde tasarlanmıştır. Bazı doğrulamalar teknik nitelikteyken, bazı gereksinimler (mimari ve dokümantasyon gereksinimleri gibi) dokümantasyon veya mimari incelemesi gerektirebilir. Teknik yollarla doğrulanabilir gereksinimlerle ilgili belirli ve ilgili kötüye kullanım durumlarını test eden ve "fuzz" yapan birim ve entegrasyon testleri oluşturarak, bu kontrollerin her derlemede doğru şekilde çalıştığını kontrol etmek daha kolay hale gelmelidir. Örneğin, bir oturum açma denetleyicisi için test paketi için ek testler oluşturulabilir. Bu testlerde, kullanıcı adı parametresi için yaygın varsayılan kullanıcı adları, hesap numaralandırma, kaba kuvvet saldırısı, LDAP ve SQL enjeksiyonu ve XSS test edilir. Benzer şekilde, şifre parametresi üzerinde yapılan bir testte yaygın şifreler, şifre uzunluğu, null byte enjeksiyonu, parametrenin kaldırılması, XSS ve daha fazlası yer almalıdır. + +### Güvenli Geliştirme Eğitimi İçin Kullanma + +ASVS, güvenli yazılımın özelliklerini tanımlamak için de kullanılabilir. Birçok "güvenli kodlama kursu", kodlama ipuçlarının hafifçe serpiştirildiği etik hackleme kurslarından ibarettir. Bu, geliştiricilerin daha güvenli kod yazmasına yardımcı olmayabilir. Güvenli geliştirme kursları, yapılmaması gereken en önemli 10 olumsuz şey yerine ASVS'yi kullanarak ASVS'de bulunan olumlu mekanizmalara odaklanabilir. ASVS yapısı, bir uygulamayı güvenli hale getirirken farklı konuları ele almak için mantıklı bir yapı da sağlar. + +### Güvenli Yazılım Satın Alımına Rehberlik Eden Bir Çerçeve Olarak Kullanma + +ASVS, güvenli yazılım satın alımına veya özel geliştirme hizmetleri satın alımına yardımcı olan harika bir çerçevedir. Alıcı, satın almak istediği yazılımın ASVS seviye X'te geliştirilmesi gerektiğini belirten bir gereksinim belirleyebilir ve satıcıdan yazılımın ASVS seviye X'i karşıladığını kanıtlamasını isteyebilir. + +## ASVS'nin Pratikte Uygulanması + +Farklı tehditlerin farklı motivasyonları vardır. Bazı sektörler, benzersiz bilgi ve teknoloji varlıklarına ve alana özgü yasal uyumluluk gereksinimlerine sahiptir. + +Kuruluşların, işlerinin doğasına göre benzersiz risk özelliklerini derinlemesine incelemeleri ve bu risk ve iş gereksinimlerine göre uygun ASVS seviyesini belirlemeleri şiddetle tavsiye edilir. diff --git a/5.0/tr/0x04-Assessment_and_Certification.md b/5.0/tr/0x04-Assessment_and_Certification.md new file mode 100644 index 0000000000..fd9eb4016b --- /dev/null +++ b/5.0/tr/0x04-Assessment_and_Certification.md @@ -0,0 +1,47 @@ +# Değerlendirme ve Sertifikasyon + +## OWASP’in ASVS Sertifikaları ve Güven Damgaları Konusundaki Tutumu + +OWASP, satıcıdan bağımsız bir kar amacı gütmeyen kuruluş olarak, herhangi bir satıcıyı, doğrulayıcıyı veya yazılımı sertifikalandırmaz. ASVS uyumluluğunu iddia eden herhangi bir güvence, güven damgası veya sertifikasyon OWASP tarafından resmi olarak onaylanmamaktadır. Bu nedenle, kuruluşlar üçüncü tarafların ASVS sertifikasyonu iddialarına karşı dikkatli olmalıdır. + +Kuruluşlar, resmi bir OWASP sertifikası sunduklarını iddia etmemek koşuluyla güvence hizmetleri sunabilirler. + +## ASVS Uyumluluğu Nasıl Doğrulanır? + +ASVS, uyumluluğun nasıl doğrulanacağı konusunda kasıtlı olarak kesin bir yöntem belirtmez. Ancak, bazı temel noktaların vurgulanması önemlidir. + +### Doğrulama Raporlaması + +Geleneksel sızma testi raporları, yalnızca başarısız olan durumları istisnalarla listeler. Ancak bir ASVS sertifikasyon raporu; kapsamı, kontrol edilen tüm gereksinimlerin özetini, istisna tespit edilen gereksinimleri ve bu sorunların nasıl çözüleceğine dair rehberliği içermelidir. Bazı gereksinimler uygulanabilir olmayabilir (örneğin, durum bilgisi olmayan API'lerde oturum yönetimi) ve bu durum raporda açıkça belirtilmelidir. + +### Doğrulama Kapsamı + +Uygulama geliştiren bir organizasyon, uygulamanın işlevselliğine bağlı olarak bazı gereksinimleri uygulamayabilir, çünkü bunlar alakasız veya daha az önemli olabilir. Doğrulayıcı kişi veya kurum, doğrulamanın kapsamını açıkça belirtmelidir. Organizasyonun hangi Seviye’yi hedeflediği ve hangi gereksinimlerin dahil edildiği açıklanmalıdır. Bu, nelerin hariç tutulduğundan ziyade, nelerin dahil edildiği bakış açısından ele alınmalıdır. Ayrıca, uygulanmayan gereksinimlerin neden dışlandığına dair gerekçeli bir görüş sunulmalıdır. + +Bu yaklaşım, raporu okuyan tarafın doğrulamanın bağlamını anlamasına ve uygulamaya ne kadar güvenebileceğine dair bilinçli bir karar vermesine olanak tanır. + +Sertifikasyon yapan kuruluşlar kendi test yöntemlerini seçebilir, ancak bu yöntemler raporda açıkça belirtilmeli ve ideal olarak tekrarlanabilir olmalıdır. Girdi doğrulama gibi konular için sızma testi ya da kaynak kod analizi gibi farklı yöntemler kullanılabilir. + +### Doğrulama Mekanizmaları + +Bazı ASVS gereksinimlerinin doğrulanması için birden fazla teknik gerekebilir. Geçerli kullanıcı bilgileriyle tüm uygulama kapsamı elde edilerek yapılan sızma testlerine ek olarak ASVS gereksinimlerinin doğrulanması; dokümantasyon, kaynak kodu, yapılandırmalar ve geliştirme sürecine dahil kişilere, özellikle Seviye 2 ve Seviye 3 gereksinimlerinin doğrulanması için erişim gerektirebilir. Bulguların belgelenmesi standart bir uygulamadır ve buna çalışma notları, ekran görüntüleri, betikler ve test günlükleri (logs) dahil olabilir. Yalnızca otomatik bir araç çalıştırmak ve derinlemesine test yapmamak sertifikasyon için yeterli değildir; her gereksinimin doğrulanabilir şekilde test edilmiş olması gerekir. + +ASVS gereksinimlerinin otomasyonla doğrulanması, her zaman ilgi çeken bir konudur. Bu nedenle, otomatik ve kara kutu (black box) testlerle ilgili bazı noktaların netleştirilmesi önemlidir. + +#### Otomatik Güvenlik Testi Araçlarının Rolü + +DAST ve SAST gibi dinamik ve statik güvenlik test araçları doğru şekilde build pipeline’a entegre edildiğinde, asla var olmaması gereken bazı güvenlik açıklarını tespit edebilir. Ancak, dikkatli bir şekilde yapılandırılmaz ve ayarlanmazlarsa, yeterli kapsama alanı sağlamazlar ve yüksek sayıda yanlış pozitif, gerçek güvenlik sorunlarının tespitini ve düzeltilmesini engeller. + +Bu araçlar, çıktı kodlaması veya veri temizleme gibi bazı temel teknik gereksinimlerin doğrulanmasında yardımcı olabilir. Ancak, iş mantığı veya erişim kontrolü gibi daha karmaşık ASVS gereksinimlerinin doğrulanmasında yetersiz kalacaklardır. + +Daha karmaşık gereksinimler için otomasyon yine de kullanılabilir, ancak uygulamaya özel testlerin yazılması gerekebilir. Bunlar, organizasyonun halihazırda kullandığı birim ve entegrasyon testlerine benzer şekilde tasarlanabilir. Mevcut test altyapısı kullanılarak bu ASVS'ye özel testler yazılabilir. Bu kısa vadede yatırım gerektirse de, uzun vadede bu gereksinimlerin sürekli olarak doğrulanabilmesi açısından önemli bir fayda sağlar. + +Özetle, "otomasyon ile test edilebilir" ifadesi "hazır bir aracı çalıştırmak" anlamına gelmez. + +#### Sızma Testlerinin Rolü + +4.0 sürümünde Seviye 1, kara kutu (black box) test için optimize edilmişti (yani dokümantasyon veya kaynak kod olmadan). Ancak o zaman bile bunun etkili bir güvence yöntemi olmadığı ve aktif olarak kaçınılması gerektiği vurgulanmıştır. + +Gerekli ek bilgilere erişim olmadan test yapmak, güvenlik doğrulaması açısından hem verimsiz hem de etkisizdir. Bu durum, kaynak kodun incelenmesi, tehditlerin ve eksik kontrollerin tespiti gibi daha kapsamlı analizlerin yapılmasını engeller ve süreci uzatır. + +Geleneksel sızma testlerinin yerini, dokümantasyon ve/veya kaynak kod temelli (hibrit) sızma testlerinin almasını şiddetle tavsiye ediyoruz. Geliştirici ekip ve uygulamanın dokümantasyonuna tam erişim ile yapılan bu testler, birçok ASVS gereksiniminin doğrulanması için gerekli olacaktır. diff --git a/5.0/tr/0x05-For-Users-Of-4.0.md b/5.0/tr/0x05-For-Users-Of-4.0.md new file mode 100644 index 0000000000..cbbe7a5279 --- /dev/null +++ b/5.0/tr/0x05-For-Users-Of-4.0.md @@ -0,0 +1,90 @@ +# v4.x ile Karşılaştırıldığında Yapılan Değişiklikler + +## Giriş + +Standartın 4.x sürümüne aşina olan kullanıcılar, 5.0 sürümünde yapılan temel değişiklikleri içerik, kapsam ve altında yatan felsefe bakımından gözden geçirmeyi faydalı bulabilirler. + +Sürüm 4.0.3'te yer alan 286 gereksinimin yalnızca 11 tanesi hiçbir değişikliğe uğramadan korunmuştur. 15 gereksinimde ise yalnızca anlamı değiştirmeyen dilbilgisel düzeltmeler yapılmıştır. Toplamda 109 gereksinim (%38) artık 5.0 sürümünde bağımsız birer gereksinim olarak yer almamaktadır. Bunların 50’si doğrudan silinmiş, 28’i yinelenen olarak kaldırılmış ve 31’i başka gereksinimlerle birleştirilmiştir. Geri kalan tüm gereksinimler bir şekilde revize edilmiştir. İçeriği esasen değiştirilmemiş olan gereksinimler bile, yeniden sıralama veya yapısal değişiklikler nedeniyle artık farklı tanımlayıcılara (ID) sahiptir. + +Sürüm 5.0'ın benimsenmesini kolaylaştırmak için, kullanıcıların sürüm 4.x'teki gereksinimlerin sürüm 5.0'daki gereksinimlerle nasıl eşleştiğini izlemelerine yardımcı olmak için eşleme belgeleri sağlanmıştır. Bu eşlemeler sürüm numaralandırmasına bağlı değildir ve gerektiğinde güncellenebilir veya açıklığa kavuşturulabilir. + +## Gereksinim Felsefesi + +### Kapsam ve Odak + +Sürüm 4.x, standardın hedeflenen kapsamıyla uyumlu olmayan bazı gereksinimler içeriyordu. Bu gereksinimler kaldırılmıştır. 5.0 sürümünün kapsam kriterlerini karşılamayan veya doğrulanabilir olmayan gereksinimler de eklenen gereksinimlerden hariç tutulmuştur. + +### Mekanizmalar Yerine Güvenlik Hedeflerine Önem Verilmesi + +Sürüm 4.x'te birçok gereksinim, altında yatan güvenlik hedefleri yerine belirli mekanizmalara odaklanıyordu. 5.0 sürümünde ise gereksinimler, belirli güvenlik hedefleri etrafında yapılandırılmıştır. Belirli mekanizmalara yalnızca bunların tek pratik çözüm olması durumunda doğrudan referans verilmiş veya örnek/rehber olarak yer verilmiştir. + +Bu yaklaşım, belirli bir güvenlik hedefinin birden fazla yolla gerçekleştirilebileceğini kabul eder ve kuruluşların esnekliğini kısıtlayabilecek gereksiz derecede kuralcı yönlendirmelerden kaçınır. + +Ayrıca, aynı güvenlik sorununu ele alan gereksinimler uygun şekilde birleştirilmiştir. + +### Belgelenmiş Güvenlik Kararları + +"Belgelenmiş güvenlik kararları" kavramı 5.0 sürümünde yeni gibi görünse de, 4.0 sürümündeki politika uygulamaları ve tehdit modellemesi ile ilgili daha önceki gereksinimlerin evrimleşmiş halidir. Önceki sürümlerde bazı gereksinimler, örneğin izin verilen ağ bağlantılarının belirlenmesi gibi, güvenlik kontrollerinin uygulanmasına yön verecek analizlerin yapılmasını dolaylı olarak talep etmekteydi. + +Gerekli bilgilerin hem uygulama hem de doğrulama süreçlerinde erişilebilir olmasını sağlamak amacıyla bu beklentiler artık açıkça belgelenmesi gereken gereksinimler olarak tanımlanmıştır. Böylece bu gereksinimler daha net, uygulanabilir ve doğrulanabilir hale getirilmiştir. + +## Yapısal Değişiklikler ve Yeni Bölümler + +Sürüm 5.0’daki bazı bölümler tamamen yeni içerikler sunmaktadır: + +* OAuth ve OIDC – Bu protokollerin erişim yetkisi devri ve tek oturum açma (SSO) için yaygın biçimde benimsenmiş olması nedeniyle, geliştiricilerin karşılaşabileceği çeşitli senaryoları kapsayan özel gereksinimler eklenmiştir. Bu alan, geçmişte Mobil ve IoT gereksinimlerinin ayrı bir standarda dönüştürülmesinde olduğu gibi, zamanla bağımsız bir standarda da dönüşebilir. +* WebRTC – Bu teknolojinin yaygınlaşmasıyla birlikte, kendine özgü güvenlik gereksinimleri ve zorlukları artık özel bir bölümde ele alınmaktadır. + +Bölüm ve kısımların birbiriyle ilişkili gereksinim kümeleri etrafında daha tutarlı şekilde düzenlenmesine de özen gösterilmiştir. + +Bu yeniden yapılandırma kapsamında şu ek bölümler oluşturulmuştur: + +* Kendi İçinde Taşıyıcı Token’lar – Daha önce oturum yönetimi altında yer alan bu mekanizmalar artık ayrı bir yapı olarak tanınmakta ve OAuth ile OIDC gibi durumsuz iletişim yapılarının temel unsurlarından biri olarak ele alınmaktadır. Kendilerine özgü güvenlik etkileri nedeniyle, 5.x sürümünde bazı yeni gereksinimlerle birlikte ayrı bir bölümde toplanmıştır. +* Web Ön Yüz Güvenliği (Frontend Security) – Tarayıcı tabanlı uygulamaların artan karmaşıklığı ve yalnızca API’lara dayalı mimarilerin yaygınlaşması nedeniyle, frontend güvenliği gereksinimleri ayrı bir bölümde ele alınmıştır. +* Güvenli Kodlama ve Mimari – Diğer mevcut bölümlere doğrudan uymayan genel güvenlik uygulamalarıyla ilgili yeni gereksinimler burada gruplandırılmıştır. + +Sürüm 5.0’daki diğer düzenleyici değişiklikler ise niyetin daha net şekilde anlaşılmasını sağlamayı amaçlamıştır. Örneğin, girdi doğrulama gereksinimleri iş kuralları doğrultusunda işletim sağladıkları için artık iş mantığı ile birlikte gruplanmış, eski yapıda yer aldıkları temizleme ve kodlama (sanitization & encoding) konularından ayrılmıştır. + +Önceki V1 Mimari bölümü tamamen kaldırılmıştır. Bu bölümün ilk kısmı kapsam dışı gereksinimler içeriyordu. Sonraki kısımlar ise ilgili yeni bölümlere taşınmış, gereksinimler sadeleştirilmiş ve gerektiğinde yinelenen maddeler birleştirilerek açıklığa kavuşturulmuştur. + +## Diğer Standartlara Yapılan Doğrudan Eşlemelerin Kaldırılması + +Standardın ana kısmında yer alan diğer standartlara yönelik doğrudan eşlemeler kaldırılmıştır. Bunun yerine, ASVS'nin OWASP projeleri ve harici standartlarla ilişkilendirilmesini sağlayacak OWASP Common Requirement Enumeration (CRE) projesiyle bir eşleme hazırlanması hedeflenmektedir. + +Aşağıda açıklanan nedenlerle, CWE ve NIST gibi standartlara yapılan doğrudan eşlemeler artık devam ettirilmemektedir. + +### NIST Dijital Kimlik Kılavuzları (Digital Identity Guidelines) ile Azaltılmış Bağlılık + +NIST [Digital Identity Guidelines (SP 800-63)](https://pages.nist.gov/800-63-3/) uzun süredir kimlik doğrulama ve yetkilendirme kontrolleri için bir başvuru noktası olarak kullanılmıştır. Sürüm 4.x’te bazı bölümler, NIST’in yapısı ve terminolojisiyle oldukça örtüşüyordu. + +Bu kılavuzlar hâlâ önemli bir referans noktası olsa da, böyle bir sıkı örtüşme birtakım sorunlara yol açmıştır. Bu sorunlara yaygın olarak benimsenmemiş terimlerin kullanımı, benzer gereksinimlerin yinelenmesi ve eşlemenin eksik kalması örnek verilebilir. Sürüm 5.0, bu yaklaşımdan uzaklaşarak daha açık ve uygulanabilir bir yapı sunmayı hedeflemektedir. + +### Common Weakness Enumeration'dan (CWE) Uzaklaşma + +Common Weakness Enumeration (CWE), yazılım güvenliği zafiyetleri için faydalı bir sınıflandırma sistemidir. Ancak, yalnızca kategori düzeyinde tanımlanmış CWE’ler, bir gereksinimin yalnızca tek bir CWE ile eşleştirilememesi gibi eşleme zorlukları ve sürüm 4.x’teki bazı belirsiz eşlemeler sürüm 5.0’da doğrudan CWE eşlemelerinin sonlandırılmasına neden olmuştur. + +## Seviye Tanımlarının Yeniden Düşünülmesi + +Sürüm 4.x’te seviyeler L1 ("Minimum"), L2 ("Standart") ve L3 ("Gelişmiş") olarak tanımlanıyordu. Hassas veri işleyen tüm uygulamaların en az L2 seviyesini sağlaması gerektiği ima ediliyordu. + +Sürüm 5.0, bu yaklaşıma dair çeşitli sorunları ele almaktadır. + +Sürüm 4.x'te seviye göstergeleri tik işaretleriyle ifade edilirken, 5.x sürümünde tüm formatlarda (Markdown, PDF, DOCX, CSV, JSON ve XML) basit sayılar kullanılmaktadır. Geriye dönük uyumluluk için eski CSV, JSON ve XML çıktı formatlarında onay işaretleri hâlâ kullanılmaktadır. + +### Daha Kolay Giriş Seviyesi + +Geri bildirimler, yaklaşık 120 maddeden oluşan Seviye 1 gereksinimlerinin, aynı zamanda "minimum" olarak etiketlenip birçok uygulama için yetersiz görülmesi nedeniyle benimsenmesinin zorlaştığını göstermiştir. Sürüm 5.0, bu eşiği düşürmeyi hedefleyerek Seviye 1’i öncelikli olarak ilk savunma katmanına ait gereksinimler etrafında tanımlar ve bu seviyedeki gereksinimleri daha az ve daha net hale getirir. Sayısal olarak örnek vermek gerekirse sürüm 4.0.3'te 278 gereksinimden 128’i Seviye 1’di (%46). Sürüm 5.0.0'da ise 345 gereksinimden yalnızca 70’i Seviye 1’dir (%20). + +### Test Edilebilirlik Yanılgısı + +Sürüm 4.x’te Seviye 1 gereksinimleri belirlenirken, "dışsal kara kutu sızma testleriyle değerlendirilebilirlik" ön plandaydı. Ancak bu yaklaşım, Seviye 1’in güvenlik kontrolleri için minimum bir temel olması yönündeki amacıyla tam olarak örtüşmüyordu. Bazı kullanıcılar, Seviye 1’in yetersiz olduğunu savunurken, bazıları ise uygulanabilirliğini zor buluyordu. + +Test edilebilirliğe odaklanmak hem göreceli hem de zaman zaman yanıltıcı olabilir. Bir gereksinimin test edilebilir olması, onun kolayca veya otomatik biçimde test edilebileceği anlamına gelmez. Ayrıca, en kolay test edilebilen gereksinimler her zaman en yüksek güvenlik katkısına sahip ya da en kolay uygulanabilir olanlar değildir. + +Bu nedenle sürüm 5.0’da seviye belirleme kararları, esas olarak risk azaltımı temeline dayanır ve uygulama çabası da göz önünde bulundurulmuştur. + +### Sadece Risk Odaklı Değil + +Belirli uygulamalar için belirli bir seviyeyi zorunlu kılan, katı ve risk bazlı seviye yaklaşımı fazlasıyla sert bir yapıya dönüşmüştür. Gerçekte, güvenlik kontrollerinin önceliklendirilmesi ve uygulanması yalnızca risk değil, aynı zamanda uygulama çabası, organizasyonel olgunluk ve kullanıcıya verilmek istenen güvenlik mesajı gibi çeşitli faktörlere bağlıdır. + +Bu nedenle, kuruluşların olgunluk düzeylerine ve kullanıcılarına vermek istedikleri mesaja göre hangi seviyeyi hedeflemeleri gerektiğine kendilerinin karar vermesi teşvik edilmektedir. diff --git a/5.0/tr/0x10-V1-Encoding-and-Sanitization.md b/5.0/tr/0x10-V1-Encoding-and-Sanitization.md new file mode 100644 index 0000000000..f010cc04ea --- /dev/null +++ b/5.0/tr/0x10-V1-Encoding-and-Sanitization.md @@ -0,0 +1,104 @@ +# V1 Kodlama (Encoding) ve Temizleme + +## Kontrol Amacı + +Bu bölüm, güvenilmeyen verilerin güvensiz işlenmesiyle ilişkili en yaygın web uygulaması güvenlik zayıflıklarına odaklanır. Bu tür durumlar, güvenilmeyen verinin ilgili yorumlayıcının sözdizimi kuralları çerçevesinde yanlış şekilde yorumlanmasına neden olan çeşitli teknik güvenlik açıklarına yol açar. + +Modern web uygulamalarında, parametreli sorgular, otomatik kaçış (escaping) veya şablonlama (templating) çerçeveleri gibi daha güvenli API'ların kullanımı her zaman en iyi yaklaşımdır. Aksi takdirde ya da bu mümkün değilse, çıktı kodlaması, kaçış veya temizleme işlemlerinin dikkatle uygulanması uygulamanın güvenliği için kritik öneme sahiptir. + +Girdi doğrulama, beklenmeyen ve tehlikeli içeriklere karşı savunma derinliği mekanizması olarak kullanılabilir. Ancak asıl amacı gelen verinin işlevsel ve iş gereksinimleriyle uyumlu olup olmadığını kontrol etmektir. Bu nedenle, bu konudaki gereksinimler "Doğrulama ve İş Mantığı" bölümünde ele alınmıştır. + +## V1.1 Kodlama ve Temizleme Mimarisi + +Aşağıdaki bölümlerde, güvenli olmayan içeriklerin güvenli şekilde işlenmesine yönelik, sözdizimi veya yorumlayıcıya özel güvenlik gereksinimleri sunulmaktadır. Bu bölümdeki gereksinimler, bu işlemlerin hangi sırayla ve nerede gerçekleştirilmesi gerektiğini kapsar. Ayrıca, verilerin saklandığı her durumda orijinal (ham) haliyle saklanması gerektiğini (örneğin HTML kodlaması gibi kodlanmış/kaçırılmış biçimde değil) vurgular. Bu sayede çift kodlama (double encoding) gibi sorunlar önlenmiş olur. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **1.1.1** | Girdinin yalnızca bir kez kanonik forma (canonical form) çözümlendiği veya kaçış işlemlerinin kaldırıldığı, bu işlemin yalnızca verinin bu biçimde beklenmesi durumunda yapıldığı ve bu işlemin girdi doğrulama veya temizleme işlemlerinden sonra değil, önce gerçekleştiği doğrulanmalıdır. | 2 | +| **1.1.2** | Uygulamanın, çıktıyı kullanılması gereken yorumlayıcıya verilmeden hemen önce veya yorumlayıcının kendisi tarafından çıktı kodlaması ya da kaçış işlemi yaptığı doğrulanmalıdır. | 2 | + +## V1.2 Enjeksiyon Önleme + +Potansiyel olarak tehlikeli içeriklerin yakınında yapılan çıktı kodlama veya kaçış işlemleri, uygulama güvenliği için kritiktir. Genellikle çıktı kodlama ve kaçış işlemleri kalıcı değildir. Yalnızca verinin anlık olarak yorumlayıcı tarafından güvenli şekilde işlenebilmesi için uygulanır. Bu işlemin çok erken yapılması, içeriğin bozulmasına veya etkisiz hale gelmesine neden olabilir. + +Çoğu durumda, yazılım kütüphaneleri bu işlemleri otomatik olarak gerçekleştiren güvenli veya daha güvenli işlevler sağlar. Ancak, bu işlevlerin geçerli bağlama uygun olduğundan emin olunmalıdır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **1.2.1** | HTTP yanıtı, HTML veya XML belgesi için yapılan çıktı kodlamasının; HTML elemanları, HTML öznitelikleri, HTML yorumları, CSS ya da HTTP başlık alanları gibi bağlamlara uygun olduğu doğrulanmalıdır. Böylece mesaj veya belge yapısının bozulması önlenir. | 1 | +| **1.2.2** | Dinamik olarak URL oluşturulurken, güvenilmeyen verinin bağlamına göre (örneğin, sorgu veya yol parametreleri için URL kodlaması ya da base64url kodlaması) kodlandığı doğrulanmalıdır. Yalnızca güvenli URL protokollerine izin verilmelidir (örneğin, javascript: veya data: yasaklanmalıdır). | 1 | +| **1.2.3** |JavaScript içeriği (JSON dahil) dinamik olarak oluşturulurken çıktı kodlama/kaçış kullanıldığı doğrulanmalıdır. Böylece mesaj veya belge yapısı değiştirilmemiş olur (JavaScript ve JSON enjeksiyonlarının önüne geçilir). | 1 | +| **1.2.4** | Veri sorguları veya veritabanı sorguları (SQL, HQL, NoSQL, Cypher vb.) için parametreli sorgular, ORM’ler, entity framework’ler kullanıldığı ya da SQL enjeksiyonu ve diğer veritabanı enjeksiyon saldırılarına karşı koruma sağlandığı doğrulanmalıdır. Bu durum, saklı yordam (stored procedure) yazarken de geçerlidir. | 1 | +| **1.2.5** | Uygulamanın işletim sistemi komut enjeksiyonlarına karşı korunduğu ve işletim sistemi çağrılarında parametreli OS sorguları veya bağlama özgü komut satırı çıktı kodlamasının kullanıldığı doğrulanmalıdır. | 1 | +| **1.2.6** | Uygulamanın LDAP enjeksiyon zafiyetlerine karşı korunduğu ya da LDAP enjeksiyonlarını önlemek için özel güvenlik kontrollerinin uygulandığı doğrulanmalıdır. | 2 | +| **1.2.7** | XPath enjeksiyon saldırılarına karşı, sorgu parametrelemesi veya önceden derlenmiş sorgular kullanılarak koruma sağlandığı doğrulanmalıdır. | 2 | +| **1.2.8** | LaTeX işlemcilerinin güvenli şekilde yapılandırıldığı (örneğin, --shell-escape bayrağının kullanılmadığı) ve yalnızca izin verilen komutlardan oluşan bir listeyle çalıştırıldığı doğrulanmalıdır. | 2 | +| **1.2.9** | Düzenli ifadelerde (regex) özel karakterlerin (genellikle ters eğik çizgi \ ile) kaçırılarak meta karakter olarak yorumlanmalarının önlendiği doğrulanmalıdır. | 2 | +| **1.2.10** | Uygulamanın CSV ve formül enjeksiyonlarına karşı korunduğu doğrulanmalıdır. Uygulama, CSV içeriği dışa aktarırken RFC 4180 Bölüm 2.6 ve 2.7'de tanımlanan kaçış kurallarına uymalıdır. Ayrıca, CSV veya diğer tablo formatlarına (XLS, XLSX, ODF gibi) aktarım yapılırken, alanın ilk karakteri olarak çıkan özel karakterler ('=', '+', '-', '@', '\t' (sekme), '\0' (null karakter)) tek tırnak (') ile kaçırılmalıdır. | 3 | + +Not: Parametreli sorguların veya SQL kaçışlarının kullanılması her zaman yeterli değildir. Örneğin, tablo ve sütun adları (özellikle “ORDER BY” gibi) kaçırılamaz. Bu alanlarda kullanıcı tarafından sağlanan veriler kaçırılmış olarak dahil edilirse sorgular başarısız olur veya SQL enjeksiyonuna neden olabilir. + +## V1.3 Temizleme (Sanitization) + +Güvenilmeyen içeriğin güvensiz bir bağlamda kullanılmasına karşı ideal koruma yöntemi, önceki bölümde detaylı olarak açıklandığı gibi, bağlama özel kodlama veya kaçıştırma (escaping) kullanmaktır. Bu yöntem, içeriğin anlamını koruyarak güvenli hale getirir. + +Bu mümkün olmadığında, potansiyel olarak tehlikeli karakterlerin veya içeriğin temizlenmesi (sanitize) gerekir. Bazı durumlarda, bu işlem girdinin anlamını değiştirebilir; ancak güvenlik açısından başka bir seçenek olmayabilir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **1.3.1** | WYSIWYG editörlerinden veya benzer kaynaklardan gelen tüm güvenilmeyen HTML girdilerinin, bilinen ve güvenli bir HTML temizleme kütüphanesi ya da çerçeve özelliği ile temizlendiği doğrulanmalıdır. | 1 | +| **1.3.2** | Uygulamanın eval() veya Spring Expression Language (SpEL) gibi dinamik kod çalıştırma özelliklerini kullanmaktan kaçındığı doğrulanmalıdır. Alternatif yoksa, kullanıcı girdisi çalıştırılmadan önce mutlaka temizlenmelidir. | 1 | +| **1.3.3** | Potansiyel olarak tehlikeli bir bağlamda kullanılacak verilerin, bu bağlama uygun karakterlere izin vermek ve çok uzun girdileri kısaltmak gibi güvenlik önlemleriyle önceden temizlendiği doğrulanmalıdır. | 2 | +| **1.3.4** | Kullanıcı tarafından sağlanan SVG içeriğinin, yalnızca güvenli etiket ve özellikler (örneğin grafik çizme ile ilgili) içerdiğinden emin olmak için onaylandığı veya temizlendiği doğrulanmalıdır (ör. script veya foreignObject içermemelidir). | 2 | +| **1.3.5** | Markdown, CSS, XSL stil sayfaları, BBCode veya benzeri ifade şablon dillerinde kullanıcı girdisinin temizlendiği veya bu tür özelliklerin devre dışı bırakıldığı doğrulanmalıdır. | 2 | +| **1.3.6** | Uygulamanın, güvenilmeyen verileri başka servislere iletmeden önce izinli protokol, alan adı, yol ve port listelerine göre doğruladığı ve tehlikeli karakterleri temizlediği doğrulanarak SSRF (Sunucu Taraflı İstek Sahteciliği) saldırılarına karşı korunduğu doğrulanmalıdır. | 2 | +| **1.3.7** | Uygulamanın şablon enjeksiyon saldırılarına karşı, güvenilmeyen girdilere dayalı şablon oluşturmayı engellediği; eğer bu kaçınılmazsa, bu girdilerin mutlaka temizlendiği veya sıkı şekilde onaylandığı doğrulanmalıdır. | 2 | +| **1.3.8** | JNDI sorgularında kullanılmadan önce güvenilmeyen girdilerin temizlendiği ve JNDI'nin enjeksiyonlara karşı güvenli şekilde yapılandırıldığı doğrulanmalıdır. | 2 | +| **1.3.9** | Memcache’e gönderilmeden önce içeriğin temizlenerek enjeksiyon saldırılarına karşı korunduğu doğrulanmalıdır. | 2 | +| **1.3.10** | Format dizgilerinin (format strings) beklenmeyen veya zararlı şekilde çözümlenmesini önlemek için işlenmeden önce temizlendiği doğrulanmalıdır. | 2 | +| **1.3.11** | SMTP veya IMAP enjeksiyonlarını önlemek için, kullanıcı girdisinin posta sistemlerine iletilmeden önce temizlendiği doğrulanmalıdır. | 2 | +| **1.3.12** | Regex girdilerinin üstel geri izlemeye (exponential backtracking) neden olan öğeler içermediği ve güvenilmeyen girdilerin ReDoS (Regex Denial of Service) gibi saldırılara karşı temizlendiği doğrulanmalıdır. | 3 | + +## V1.4 Bellek, Dizgi ve Yönetilmeyen Kod + +Aşağıdaki gereksinimler, sistem programlama dilleri veya yönetilmeyen kod kullanan uygulamalarda görülen güvensiz bellek kullanımıyla ilişkili riskleri ele alır. + +Bazı durumlarda, taşma korumaları ve uyarılar, yığın (stack) rastgeleleştirme ve veri yürütme engelleme gibi önlemleri etkinleştiren derleyici bayrakları (compiler flags) kullanılarak bu risklerin önüne geçilebilir. Ayrıca, tehlikeli işaretçi, bellek, format dizgisi, tamsayı ve dizgi işlemleri tespit edildiğinde derlemenin başarısız olmasını sağlayan ayarlar tercih edilmelidir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **1.4.1** | Yığın, arabellek (buffer) veya yığın belleği taşmalarını önlemek ya da tespit etmek amacıyla, bellek güvenli dizgi işlemlerinin, daha güvenli bellek kopyalama ve işaretçi aritmetiğinin kullanıldığı doğrulanmalıdır. | 2 | +| **1.4.2** | Tamsayı taşmalarını önlemek için işaret (sign), aralık (range) ve giriş doğrulama tekniklerinin kullanıldığı doğrulanmalıdır. | 2 | +| **1.4.3** | Dinamik olarak ayrılan belleğin ve kaynakların serbest bırakıldığı ve boşaltılan belleklere ait referansların veya işaretçilerin kaldırıldığı veya null yapıldığı doğrulanmalıdır (dangling pointer ve use-after-free zafiyetlerine karşı). | 2 | + +## V1.5 Güvenli Ters Serileştirme (Safe Deserialization) + +Verilerin saklanmış veya iletilmiş bir temsilinden uygulama nesnelerine dönüştürülmesi işlemi olan ters serileştirme, geçmişte çeşitli kod enjeksiyonu zafiyetlerinin kaynağı olmuştur. Bu işlemin dikkatli ve güvenli bir şekilde yapılması, bu tür güvenlik açıklarının önlenmesi açısından son derece önemlidir. + +Özellikle, bazı ters serileştirme yöntemleri, kullanılan programlama dili veya çerçevenin dokümantasyonunda güvensiz olarak tanımlanmıştır ve güvenilmeyen verilerle kullanıldığında güvenli hâle getirilemez. Kullanılan her yöntem için dikkatli bir inceleme yapılmalıdır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **1.5.1** | XML ayrıştırıcılarının (parser) kısıtlayıcı şekilde yapılandırıldığı ve dış varlık çözümleme (external entity resolution) gibi güvensiz özelliklerin XXE (XML eXternal Entity) saldırılarına karşı devre dışı bırakıldığı doğrulanmalıdır . | 1 | +| **1.5.2** | Güvenilmeyen verilerin ters serileştirilmesinde, nesne türleri için izinli liste kullanımı veya istemci tanımlı nesne türlerinin kısıtlanması gibi güvenli giriş işleme önlemlerinin uygulandığı doğrulanmalıdır. Güvensiz olarak tanımlanmış ters serileştirme mekanizmaları, güvenilmeyen girdilerle kullanılmamalıdır. | 2 | +| **1.5.3** | Aynı veri türü için uygulamada kullanılan farklı parser'ların (ör. JSON, XML, URL parser'ları), veriyi tutarlı şekilde ayrıştırdığı ve aynı karakter kodlamasını kullandığı doğrulanmalıdır. Böylece JSON birlikte çalışabilirlik açıkları, URI veya dosya ayrıştırma farkları gibi sorunlar nedeniyle RFI veya SSRF saldırılarının istismar edilmesi önlenir. | 3 | + +## Referanslar + +Daha fazla bilgi için: + +* [OWASP LDAP Injection Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html) +* [OWASP Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) +* [OWASP DOM Based Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html) +* [OWASP XML External Entity Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html) +* [OWASP Testing Guide 4.0: Client-Side Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/11-Client-side_Testing/README) +* [OWASP Java Encoding Project](https://owasp.org/owasp-java-encoder/) +* [DOMPurify - Client-side HTML Sanitization Library](https://github.com/cure53/DOMPurify) +* [RFC4180 - Common Format and MIME Type for Comma-Separated Values (CSV) Files](https://datatracker.ietf.org/doc/html/rfc4180#section-2) + +Ters serileştirme ve parser konularında daha fazla bilgi için: + +* [OWASP Deserialization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) +* [OWASP Deserialization of Untrusted Data Guide](https://owasp.org/www-community/vulnerabilities/Deserialization_of_untrusted_data) +* [An Exploration of JSON Interoperability Vulnerabilities](https://bishopfox.com/blog/json-interoperability-vulnerabilities) +* [Orange Tsai - A New Era of SSRF Exploiting URL Parser In Trending Programming Languages](https://www.blackhat.com/docs/us-17/thursday/us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf) diff --git a/5.0/tr/0x11-V2-Validation-and-Business-Logic.md b/5.0/tr/0x11-V2-Validation-and-Business-Logic.md new file mode 100644 index 0000000000..3177eba8c3 --- /dev/null +++ b/5.0/tr/0x11-V2-Validation-and-Business-Logic.md @@ -0,0 +1,73 @@ +# V2 Doğrulama ve İş Mantığı + +## Kontrol Amacı + +Bu bölümün amacı, doğrulanan bir uygulamanın aşağıdaki üst düzey hedefleri karşıladığından emin olmaktır: + +* Uygulamanın aldığı girdiler, işlevsel veya iş gereksinimleriyle uyumludur. +* İş mantığı akışı sıralıdır, sırayla işlenir ve atlanamaz. +* İş mantığı, sürekli küçük para transferleri veya her seferinde 1 tane olmak üzere 1 milyon arkadaş ekleme gibi otomatik saldırıları tespit edip engellemek için sınırlar ve kontroller içerir. +* Yüksek değerli iş mantığı akışları, kötüye kullanım senaryoları ve kötü niyetli aktörler göz önüne alınarak oluşturulmuştur ve kimlik sahteciliği, manipülasyon, bilgi sızıntısı ve yetki yükseltme saldırılarına karşı korumaya sahiptir. + +## V2.1 Doğrulama ve İş Mantığı Dokümantasyonu + +Doğrulama ve iş mantığı dokümantasyonu; iş mantığı sınırlarını, doğrulama kurallarını ve birleştirilmiş veri öğelerinin bağlamsal tutarlılığını açıkça tanımlamalıdır. Böylece uygulamada neyin uygulanması gerektiği net olur. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **2.1.1** | Uygulama dokümantasyonunda, veri öğelerinin beklenen yapıya göre nasıl doğrulanacağına ilişkin giriş doğrulama kurallarının tanımlandığı doğrulanmalıdır. Bu; kredi kartı numaraları, e-posta adresleri, telefon numaraları gibi yaygın veri biçimleri olabileceği gibi iç sistemlere özel biçimler de olabilir. | 1 | +| **2.1.2** | Uygulama dokümantasyonunda, birleştirilmiş veri öğelerinin mantıksal ve bağlamsal tutarlılığının nasıl doğrulanacağı tanımlanmalıdır (örneğin, mahalle ve posta kodunun eşleşip eşleşmediğinin kontrolü). | 2 | +| **2.1.3** | Hem kullanıcı bazında hem de uygulama genelinde geçerli olacak şekilde, iş mantığı sınırları ve doğrulama beklentilerinin belgelendiği doğrulanmalıdır. | 2 | + +## V2.2 Girdi Doğrulama + +Etkili girdi doğrulama kontrolleri, uygulamanın beklediği veri türüne yönelik işlevsel ya da iş gereksinimlerinin sağlanmasını zorunlu kılar. Bu sayede veri kalitesi artar ve saldırı yüzeyi daraltılır. Ancak bu, verinin başka bileşenlerde kullanılmadan veya çıktıya aktarılmadan önce doğru şekilde kodlanması, parametreleştirilmesi ya da temizlenmesi ihtiyacını ortadan kaldırmaz. + +Bu bağlamda "girdi"; HTML form alanları, REST istekleri, URL parametreleri, HTTP başlıkları, çerezler, disk dosyaları, veritabanları veya harici API'lerden gelebilir. + +Bir iş mantığı kontrolü, belirli bir girdinin 100'den küçük bir sayı olup olmadığını kontrol edebilir. Bir işlevsel beklenti ise bu sayının belirli bir eşiğin altında olmasını isteyebilir, çünkü bu sayı örneğin bir döngünün kaç kez çalışacağını belirliyor olabilir; büyük bir değer, aşırı işlemeye ve hizmet reddi (DoS) durumuna yol açabilir. + +Şema doğrulaması zorunlu tutulmamış olsa da, HTTP API'leri veya JSON/XML kullanan diğer arayüzlerin tamamen doğrulanması için en etkili yöntem olabilir. + +Şema doğrulamasıyla ilgili aşağıdaki hususlara dikkat edilmelidir: + +* JSON Schema doğrulama standardının “yayınlanmış sürümü” üretime hazır kabul edilmekte ancak “stabil” değildir. Kullanıldığında, aşağıdaki gereksinimlerle çelişmediğinden emin olunmalıdır. +* Kullanılan JSON Schema kütüphaneleri, standart resmileştiğinde izlenmeli ve gerekirse güncellenmelidir. +* DTD'lere karşı yapılan XXE saldırılarını önlemek için DTD doğrulaması kullanılmamalı ve çerçeve içindeki DTD işleme özellikleri devre dışı bırakılmalıdır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **2.2.1** | Girdilerin, işlevsel ya da iş gereksinimlerine uygunluğunun doğrulandığı teyit edilmelidir. Bu işlem; izinli değerler, desenler ve aralıklar listesine karşı pozitif doğrulama ile ya da girdinin beklenen yapıya ve mantıksal sınırlara uygunluğunun önceden tanımlanmış kurallara göre karşılaştırılması ile yapılmalıdır. Seviye 1 için bu, güvenlik veya iş kararlarında kullanılan girdilere odaklanabilir. Seviye 2 ve üstü için tüm girdilere uygulanmalıdır. | 1 | +| **2.2.2** | Uygulamanın, güvenilir bir servis katmanında girdi doğrulama zorunluluğu uygulayacak şekilde tasarlandığı doğrulanmalıdır. İstemci tarafında gerçekleştirilen doğrulama, kullanılabilirliği artırabilir ve teşvik edilmelidir. Ancak bu doğrulama,güvenlik kontrolü olarak kabul edilmemelidir. | 1 | +| **2.2.3** | Uygulamanın, ilişkili veri öğelerinin önceden tanımlanmış kurallara göre makul olup olmadığını kontrol ettiği doğrulanmalıdır. | 2 | + +## V2.3 İş Mantığı Güvenliği + +Bu bölüm, uygulamanın iş mantığı süreçlerini doğru şekilde yürüttüğünden ve bu mantık ve akışın istismarına karşı savunmasız olmadığından emin olunması için temel gereksinimleri kapsar. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **2.3.1** | Uygulamanın, aynı kullanıcı için iş mantığı akışlarını yalnızca beklenen adım sırasına göre ve adım atlamadan işlediği doğrulanmalıdır. | 1 | +| **2.3.2** | İş mantığı sınırlarının, uygulama dokümantasyonuna uygun şekilde uygulandığı doğrulanmalıdır. | 2 | +| **2.3.3** | İş mantığı seviyesinde işlemlerin (transaction) kullanıldığı ve bir iş mantığı işleminin ya bütünüyle başarıyla tamamlandığı ya da önceki geçerli duruma geri döndürüldüğü (rollback) doğrulanmalıdır. | 2 | +| **2.3.4** | İş mantığı düzeyinde kilitleme mekanizmalarının, sınırlı kaynakların (ör. sinema koltukları, teslimat zamanları) uygulamanın mantığı manipüle edilerek çift rezervasyona neden olmamasını sağladığı doğrulanmalıdır. | 2 | +| **2.3.5** | Yüksek değerli iş mantığı akışlarının, yetkisiz veya kazara gerçekleşebilecek işlemleri önlemek için çoklu kullanıcı onayı gerektirdiği doğrulanmalıdır. Bu işlemler büyük para transferleri, sözleşme onayları, gizli bilgilere erişim veya üretimde güvenlik kurallarının geçersiz kılınmaları gibi durumları içerebilir. | 3 | + +## V2.4 Otomasyon Karşıtı Önlemler + +Bu bölümde, insan benzeri etkileşimlerin zorunlu kılındığı ve aşırı miktardaki otomatik taleplerin engellendiği kontroller yer alır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **2.4.1** | Uygulama işlevlerine yönelik aşırı miktardaki çağrılara karşı; veri sızdırma, anlamsız veri üretme, kota tüketme, hız sınırının aşılması, hizmet reddi (DoS) ya da maliyetli kaynakların aşırı kullanımı gibi risklere karşı otomasyon karşıtı kontrollerin bulunduğu doğrulanmalıdır. | 2 | +| **2.4.2** | İş mantığı akışlarının, aşırı hızlı işlem gönderimlerini önleyecek şekilde gerçekçi insan zamanlaması gerektirdiği doğrulanmalıdır. | 3 | + +## Referanslar + +Daha fazla bilgi için: + +* [OWASP Web Security Testing Guide 4.2: Input Validation Testing](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/README.html) +* [OWASP Web Security Testing Guide 4.2: Business Logic Testing](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/10-Business_Logic_Testing/README) +* Anti-automation can be achieved in many ways, including the use of the [OWASP Automated Threats to Web Applications](https://owasp.org/www-project-automated-threats-to-web-applications/) +* [OWASP Input Validation Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html) +* [JSON Schema](https://json-schema.org/specification.html) diff --git a/5.0/tr/0x12-V3-Web-Frontend-Security.md b/5.0/tr/0x12-V3-Web-Frontend-Security.md new file mode 100644 index 0000000000..6f1c2907b2 --- /dev/null +++ b/5.0/tr/0x12-V3-Web-Frontend-Security.md @@ -0,0 +1,101 @@ +# V3 Web Ön Uç (Frontend) Güvenliği + +## Kontrol Amacı + +Bu kategori, bir web frontend'i üzerinden gerçekleştirilen saldırılara karşı koruma sağlamak amacıyla belirlenmiş gereksinimlere odaklanır. Bu gereksinimler, makineden makineye çözümler için geçerli değildir. + +## V3.1 Web Frontend Güvenlik Dokümantasyonu + +Bu bölüm, uygulamanın dokümantasyonunda belirtilmesi gereken tarayıcı güvenlik özelliklerini tanımlar. + +| # | Açıklama | Seviye | +| :---: | :---: | :---: | +| **3.1.1** | Uygulama dokümantasyonunda, uygulamayı kullanan tarayıcıların desteklemesi gereken güvenlik özelliklerinin (ör. HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) ve diğer ilgili HTTP güvenlik mekanizmaları) tanımlandığı doğrulanmalıdır. Ayrıca bu özelliklerin mevcut olmadığı durumlarda uygulamanın nasıl davranması gerektiği (ör. kullanıcıyı uyarmak veya erişimi engellemek) de tanımlanmalıdır. | 3 | + +## V3.2 İçeriğin Yanlış Yorumlanması + +İçerik veya işlevin yanlış bir bağlamda sunulması, kötü amaçlı içeriğin çalıştırılmasına veya görüntülenmesine neden olabilir. + +| # | Açıklama | Seviye | +| :---: | :---: | :---: | +| **3.2.1** | Tarayıcıların HTTP yanıtlarında içerik veya işlevi yanlış bir bağlamda sunmalarını önlemek amacıyla güvenlik kontrollerinin uygulandığı doğrulanmalıdır (ör. API, kullanıcı tarafından yüklenen dosya veya başka bir kaynağın doğrudan çağrılması durumunda). Olası kontroller arasında; yalnızca HTTP istek başlıklarının (ör. Sec-Fetch-\*) doğru bağlamı gösterdiği durumlarda içeriğin sunulması, Content-Security-Policy başlığında "sandbox" yönergesinin kullanılması veya Content-Disposition başlığında "attachment" biçiminin kullanılması yer alabilir. | 1 | +| **3.2.2** | HTML yerine metin olarak görüntülenmesi amaçlanan içeriğin, HTML veya JavaScript gibi içeriklerin istenmeden çalıştırılmasını önleyecek şekilde "createTextNode" veya "textContent" gibi güvenli işleme fonksiyonlarıyla işlendiği doğrulanmalıdır. | 1 | +| **3.2.3** | Uygulamanın istemci tarafı JavaScript kullanırken açık değişken tanımlamaları yaparak, sıkı tür kontrolü uygulayarak, global değişkenleri document nesnesine kaydetmekten kaçınarak ve ad alanı izolasyonu sağlayarak DOM clobbering’den kaçındığı doğrulanmalıdır. | 3 | + +## V3.3 Çerez Yapılandırması + +Bu bölüm, hassas çerezlerin güvenli biçimde yapılandırılması için gereksinimleri tanımlar. Amaç, çerezlerin gerçekten uygulama tarafından oluşturulduğuna dair daha yüksek düzeyde güvence sağlamak ve içeriklerinin sızmasını veya uygunsuz şekilde değiştirilmesini önlemektir. + +| # | Açıklama | Seviye | +| :---: | :---: | :---: | +| **3.3.1** | Çerezlerin 'Secure' niteliğine sahip olduğu ve eğer çerez adı '\__Host-' ön eki ile başlamıyorsa, '__Secure-' ön ekinin kullanıldığı doğrulanmalıdır. | 1 | +| **3.3.2** | Kullanıcı arayüzü kandırma saldırılarına ve tarayıcı tabanlı istek sahteciliği saldırılarına (CSRF) karşı koruma sağlamak amacıyla, her çerezin 'SameSite' niteliğinin kullanım amacına uygun şekilde ayarlandığı doğrulanmalıdır. | 2 | +| **3.3.3** | Çerez adı, diğer sunucularla paylaşılmak üzere açıkça tasarlanmadığı sürece '__Host-' ön eki ile tanımlanmalıdır. | 2 | +| **3.3.4** | Bir çerez değeri istemci tarafı betikleri tarafından erişilememesi gereken bir veri içeriyorsa (ör. oturum token'ı), çerezin 'HttpOnly' niteliğine sahip olduğu ve aynı değerin (ör. oturum token'ı) yalnızca 'Set-Cookie' başlığı ile istemciye iletildiği doğrulanmalıdır. | 2 | +| **3.3.5** | Uygulama bir çerez oluştururken, çerez adı ve değerinin toplam uzunluğunun 4096 baytı aşmadığı doğrulanmalıdır. Çok büyük çerezler tarayıcı tarafından saklanmaz ve isteklerle gönderilmez; bu da çereze bağlı çalışan uygulama işlevlerinin bozulmasına yol açabilir. | 3 | + +## V3.4 Tarayıcı Güvenlik Mekanizması Başlıkları (Header) + +Bu bölüm, tarayıcıların uygulamadan gelen yanıtları işlerken güvenlik özelliklerini etkinleştirmesi ve kısıtlamaları uygulaması için HTTP yanıtlarında hangi güvenlik header'larının ayarlanması gerektiğini açıklar. + +| # | Açıklama | Seviye | +| :---: | :---: | :---: | +| **3.4.1**| Tüm yanıtların, HTTP Strict Transport Security (HSTS) politikasını zorunlu kılmak için Strict-Transport-Security header alanını içerdiği doğrulanmalıdır. En az 1 yıl süreli bir max-age tanımlanmalı ve Seviye 2 ve üzeri için bu politika tüm alt alan adlarını da kapsamalıdır. | 1 | +| **3.4.2** | Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header'ı, uygulama tarafından sabit bir değer olarak tanımlanmalı veya gelen Origin header değeri güvenilir origin’lerden oluşan bir izinli listeye karşı doğrulanmalıdır. ‘Access-Control-Allow-Origin: *’ kullanılması gerekiyorsa, yanıtın hassas bilgi içermediği doğrulanmalıdır. | 1 | +| **3.4.3** | HTTP yanıtlarında Content-Security-Policy header'ı bulunduğu ve bu header'ın yalnızca güvenilen içeriklerin veya kaynakların yüklenmesini ve çalıştırılmasını sağlayan yönergeler içerdiği doğrulanmalıdır. Minimum olarak "global policy", object-src 'none', base-uri 'none' yönergelerini içermeli ve izinli liste, nonce veya hash temelli bir yapı içermelidir. Seviye 3 uygulamalarında her yanıt için nonce veya hash içeren özel bir politika tanımlanmalıdır. | 2 | +| **3.4.4** | Tüm HTTP yanıtlarının 'X-Content-Type-Options: nosniff' header'ını içerdiği doğrulanmalıdır. Bu, tarayıcıya içerik türünü tahmin etmeyi bırakmasını ve yanıtın Content-Type header'ında belirtilen MIME türünün, beklenen kaynak türüyle eşleşmesini zorunlu kılar. Ayrıca bu, tarayıcıda CORB (Cross-Origin Read Blocking) özelliğini etkinleştirir. | 2 | +| **3.4.5** | Uygulamanın, 'Referer' başlığı yoluyla üçüncü taraflara teknik olarak hassas verilerin sızmasını önlemek için bir 'referrer policy' belirlediği doğrulanmalıdır. Bu, Referrer-Policy HTTP header'ıyla veya HTML öğe nitelikleriyle (element attributes) sağlanabilir. Sızabilecek hassas bilgiler, URL’deki yol ve sorgu parametreleri ile sınırlı uygulamalarda hostname bilgisini içerebilir. | 2 | +| **3.4.6** | Uygulamanın, Content-Security-Policy header'ı altında 'frame-ancestors' yönergesini her HTTP yanıtında tanımladığı ve bu sayede içeriklerin varsayılan olarak başka sayfalara gömülmesini engellediği doğrulanmalıdır. Gerekli durumlarda özel olarak izin verildiğinden emin olunmalıdır. 'X-Frame-Options' header'ı, tarayıcılar tarafından desteklenmesine rağmen, artık güncel değildir ve güvenlik amacıyla kullanılmamalıdır. | 2 | +| **3.4.7**| Content-Security-Policy header'ında ihlal bildirimlerinin gönderileceği bir adresin tanımlandığı doğrulanmalıdır. | 3 | +| **3.4.8** | Bir belgenin işlenmesini ve sunulmasını başlatan tüm HTTP yanıtlarında (örneğin 'text/html' tipi yanıtlar), 'Cross-Origin-Opener-Policy' header'ı 'same-origin' veya 'same-origin-allow-popups' yönergeleriyle birlikte yer almalıdır. Bu, tabnabbing ve frame counting gibi, pencere nesnelerine paylaşımlı erişimi sömüren saldırılara karşı koruma sağlar. | 3 | + +## V3.5 Tarayıcı Menşei Ayırımı + +Sunucu tarafında hassas işlevlere yönelik bir isteği kabul ederken, uygulamanın, isteğin uygulamanın kendisi veya güvenilir bir tarafça başlatıldığından ve bir saldırgan tarafından taklit edilmediğinden emin olması gerekir. + +Bu bağlamda hassas işlevsellik, kimliği doğrulanmış ve doğrulanmamış kullanıcılar için form gönderilerinin kabul edilmesini (kimlik doğrulama isteği gibi), durum değiştirme işlemlerini veya kaynak gerektiren işlevselliği (veri dışa aktarma gibi) içerebilir. + +Buradaki temel korumalar, JavaScript için Same Origin Policy ve çerezler için SameSite mantığı gibi tarayıcı güvenlik politikalarıdır. Bir diğer yaygın koruma ise CORS ön kontrol mekanizmasıdır. Bu mekanizma, farklı bir kaynaktan çağrılmak üzere tasarlanmış uç noktalar için kritik olacaktır, ancak farklı bir kaynaktan çağrılmak üzere tasarlanmamış uç noktalar için de yararlı bir istek sahteciliği önleme mekanizması olabilir. + +| # | Açıklama | Seviye | +| :---: | :---: | :---: | +| **3.5.1** | Uygulama, hassas işlevselliğe yönelik izinsiz cross-origin istekleri önlemek için CORS preflight mekanizmasına güvenmiyorsa, bu tür isteklerin gerçekten uygulamadan geldiği doğrulanmalıdır. Bu, anti-forgery token kullanımı veya CORS tarafından güvenli kabul edilmeyen özel HTTP header'larının zorunlu kılınmasıyla yapılabilir. Bu, tarayıcı tabanlı istek sahteciliği (CSRF) saldırılarına karşı bir savunmadır. | 1 | +| **3.5.2** | Uygulama, hassas işlevlerin izinsiz cross-origin çağrılmasını önlemek için CORS preflight mekanizmasına güveniyorsa, bu işlevlerin bir CORS-preflight isteğini tetiklemeden çağrılamadığı doğrulanmalıdır. Bu, 'Origin' ve 'Content-Type' header'larının doğrulanmasını veya CORS-safelisted olmayan bir header'ın ve alanın kullanılmasını gerektirebilir. | 1 | +| **3.5.3**| Hassas işlevselliğe yönelik HTTP isteklerinin 'POST', 'PUT', 'PATCH' veya 'DELETE' gibi uygun HTTP yöntemlerini kullandığı ve HTTP spesifikasyonuna göre "güvenli" olan 'GET', 'OPTIONS' veya 'HEAD' gibi yöntemlerle çağrılamadığı doğrulanmalıdır. Alternatif olarak 'Sec-Fetch-*' header'larının sıkı şekilde doğrulanması da uygunsuz cross-origin, navigasyon veya medya yükleme isteklerini ayırt etmek için kullanılabilir. | 1 | +| **3.5.4** | Farklı uygulamaların farklı hostname'lerde barındırıldığı ve böylece Same-Origin Policy tarafından sağlanan kısıtlamalardan (örneğin çerez erişim sınırları, kaynaklar arası etkileşim kontrolleri) faydalanıldığı doğrulanmalıdır. | 2 | +| **3.5.5**| postMessage arayüzü üzerinden alınan iletilerin, mesajın kökeni güvenilir değilse veya mesaj sözdizimi geçersizse reddedildiği doğrulanmalıdır. | 2 | +| **3.5.6** | Uygulamanın herhangi bir yerinde JSONP işlevselliğinin etkin olmadığı doğrulanmalıdır. Bu, XSSI (Cross-Site Script Inclusion) saldırılarını önlemek içindir. | 3 | +| **3.5.7** | Yetkilendirme gerektiren verilerin, JavaScript dosyaları gibi betik kaynaklarının yanıtlarında yer almadığı, XSSI saldırılarını önlemek için doğrulanmalıdır. | 3 | +| **3.5.8** | Kimliği doğrulanmış kaynakların (örneğin görseller, videolar, betikler ve belgeler) yalnızca gerçekten amaçlandığında kullanıcı adına yüklenebildiği veya gömülebildiği doğrulanmalıdır. Bu, isteğin uygun olmayan bir çapraz kaynak çağrısından kaynaklanmadığından emin olmak için Sec-Fetch-* HTTP istek başlığı alanlarının sıkı bir şekilde doğrulanmasıyla veya tarayıcıya döndürülen içeriği engelleme talimatı vermek için kısıtlayıcı bir Cross-Origin-Resource-Policy HTTP yanıt başlığı alanı ayarlayarak gerçekleştirilebilir. | 3 | + +## V3.6 Harici Kaynak Bütünlüğü + +Bu bölüm, içeriklerin üçüncü taraf sitelerde güvenli şekilde barındırılmasıyla ilgili rehberlik sunar. + +| # | Açıklama | Seviye | +| :---: | :---: | :---: | +| **3.6.1** | JavaScript kütüphaneleri, CSS veya web fontları gibi istemci tarafı varlıkların yalnızca statik ve sürümlü olması, varlığın bütünlüğünü doğrulamak için Subresource Integrity (SRI) kullanılması durumunda harici olarak (örneğin, bir İçerik Dağıtım Ağı üzerinde) barındırıldığı doğrulanmalıdır. Bu mümkün değilse, her bir kaynak için bunu gerekçelendiren belgelenmiş bir güvenlik kararı bulunmalıdır. | 3 | + +## V3.7 Diğer Tarayıcı Güvenliği Hususları + +Bu bölüm, istemci tarafı tarayıcı güvenliği için gerekli olan çeşitli diğer güvenlik kontrolleri ve modern tarayıcı güvenlik özelliklerini içerir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **3.7.1** | Uygulamanın yalnızca hâlâ desteklenen ve güvenli kabul edilen istemci tarafı teknolojileri kullandığı doğrulanmalıdır. Bu gereksinimi karşılamayan teknolojilere örnek olarak NSAPI eklentileri, Flash, Shockwave, ActiveX, Silverlight, NACL veya istemci tarafı Java applet’leri verilebilir. | 2 | +| **3.7.2** | Uygulamanın, yalnızca hedef adres bir izinli listede yer alıyorsa kullanıcıyı otomatik olarak farklı bir ana makine adına veya uygulamanın kontrolünde olmayan bir etki alanına yönlendirdiği doğrulanmalıdır. | 2 | +| **3.7.3** | Uygulamanın, kullanıcı uygulamanın kontrolü dışındaki bir URL’ye yönlendirildiğinde, yönlendirme hakkında bir bildirim gösterdiği ve kullanıcının bu gezintiyi iptal edebilmesi için bir seçenek sunduğu doğrulanmalıdır. | 3 | +| **3.7.4** | Uygulamanın en üst düzey etki alanının (örneğin, site.tld) HTTP Strict Transport Security (HSTS) için genel preload listesine eklendiği doğrulanmalıdır. Bu, uygulamanın TLS kullanımının ana tarayıcılar tarafından doğrudan tanınmasını ve yalnızca Strict-Transport-Security yanıt header'ına bağlı kalınmamasını sağlar. | 3 | +| **3.7.5** | Uygulamaya erişen tarayıcının beklenen güvenlik özelliklerini desteklememesi durumunda, uygulamanın dokümantasyona uygun şekilde davrandığı (örneğin kullanıcıyı uyarma veya erişimi engelleme) doğrulanmalıdır. | 3 | + +## Referanslar + +Daha fazla bilgi için: + +* [Set-Cookie __Host- prefix details](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#cookie_prefixes) +* [OWASP Content Security Policy Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html) +* [Exploiting CORS misconfiguration for BitCoins and Bounties](https://portswigger.net/blog/exploiting-cors-misconfigurations-for-bitcoins-and-bounties) +* [Sandboxing third-party components](https://cheatsheetseries.owasp.org/cheatsheets/Third_Party_Javascript_Management_Cheat_Sheet.html#sandboxing-content) +* [OWASP Secure Headers Project](https://owasp.org/www-project-secure-headers/) +* [OWASP Cross-Site Request Forgery Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html) +* [HSTS Browser Preload List submission form](https://hstspreload.org/) diff --git a/5.0/tr/0x13-V4-API-and-Web-Service.md b/5.0/tr/0x13-V4-API-and-Web-Service.md new file mode 100644 index 0000000000..b86db010ae --- /dev/null +++ b/5.0/tr/0x13-V4-API-and-Web-Service.md @@ -0,0 +1,64 @@ +# V4 API ve Web Servisi + +## Kontrol Amacı + +Web tarayıcıları veya diğer istemciler tarafından kullanılmak üzere API'ler sunan uygulamalara özgü bazı ek değerlendirmeler bulunmaktadır (genellikle JSON, XML veya GraphQL kullanılır). Bu bölüm, uygulanması gereken ilgili güvenlik yapılandırmaları ve mekanizmaları kapsar. + +Kimlik doğrulama, oturum yönetimi ve girdi doğrulama gibi diğer bölümlerde ele alınan konuların API'ler için de geçerli olduğunu unutmayın; bu nedenle bu bölüm bağlamından bağımsız düşünülemez veya tek başına test edilemez. + +## V4.1 Genel Web Servisi Güvenliği + +Bu bölüm, genel web servisi güvenliğiyle ilgili değerlendirmeleri ve temel web servisi hijyen uygulamalarını ele alır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **4.1.1** | İleti gövdesi içeren her HTTP yanıtında, yanıtın gerçek içeriğiyle eşleşen bir Content-Type header alanı bulunduğu ve güvenli karakter kodlamasını (örneğin, UTF-8, ISO-8859-1) belirtmek üzere charset parametresi içerdiği doğrulanmalıdır. Bu işlem, IANA Medya Türleri'nden "text/", "/+xml" ve "/xml" gibi içerikler için geçerlidir. | 1 | +| **4.1.2** | Yalnızca kullanıcı arayüzüne yönelik uç noktaların (manuel olarak web tarayıcısı ile erişilmesi amaçlanan) otomatik olarak HTTP'den HTTPS'e yönlendirme yaptığı ve diğer hizmetlerin veya uç noktaların şeffaf yönlendirme gerçekleştirmediği doğrulanmalıdır. Bu, istemcinin farkında olmadan şifrelenmemiş HTTP istekleri göndermesi ve bu isteklerin otomatik olarak HTTPS'e yönlendirilmesi sonucunda hassas verilerin sızmasının fark edilmemesi riskini önlemek içindir. | 2 | +| **4.1.3** | Uygulama tarafından kullanılan ve yük dengeleyici, web proxy veya frontend için backend hizmeti gibi bir ara katman tarafından ayarlanan herhangi bir HTTP başlık alanının, son kullanıcı tarafından geçersiz kılınamayacağı doğrulanmalıdır. Örnek başlıklar arasında X-Real-IP, X-Forwarded-* veya X-User-ID yer alabilir. | 2 | +| **4.1.4** | Uygulama veya API tarafından açıkça desteklenen HTTP yöntemlerinin (preflight istekleri sırasında OPTIONS dahil) dışında hiçbir yöntemin kullanılmadığı ve kullanılmayan yöntemlerin engellendiği doğrulanmalıdır. | 3 | +| **4.1.5** | Çok hassas istekler veya birçok sistemden geçen işlemler için, taşıma katmanı güvenliğinin üzerine ek bir güvence sağlamak amacıyla, her iletiye özel dijital imzaların kullanıldığı doğrulanmalıdır. | 3 | + +## V4.2 HTTP İleti Yapısı Doğrulama + +Bu bölüm, HTTP ileti yapısının ve başlık alanlarının doğrulanma biçimini açıklar. Amaç, istek kaçakçılığı, yanıt bölme, başlık enjeksiyonu ve aşırı uzun HTTP iletileri aracılığıyla hizmet reddi gibi saldırıları önlemektir. + +Bu gereksinimler, genel HTTP ileti işleme ve üretimi için geçerlidir; ancak farklı HTTP sürümleri arasında HTTP iletileri dönüştürülürken özellikle önemlidir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **4.2.1** | Tüm uygulama bileşenlerinin (yük dengeleyiciler, güvenlik duvarları ve uygulama sunucuları dahil) HTTP sürümüne uygun mekanizmaları kullanarak gelen HTTP iletilerinin sınırlarını belirlediği ve bu sayede HTTP istek kaçakçılığına karşı koruma sağlandığı doğrulanmalıdır. HTTP/1.x sürümünde Transfer-Encoding başlık alanı varsa, RFC 2616'ya göre Content-Length başlığı göz ardı edilmelidir. HTTP/2 veya HTTP/3 kullanıldığında, Content-Length başlığı varsa, alıcının bu değerin DATA çerçevelerinin uzunluğuyla tutarlı olduğunu doğrulaması gerekir. | 2 | +| **4.2.2** | HTTP iletileri üretilirken, Content-Length başlığının, HTTP protokolünün çerçeveleme yöntemine göre belirlenen içerik uzunluğu ile çelişmediği doğrulanmalıdır. Bu, istek kaçakçılığı saldırılarını önlemek için gereklidir. | 3 | +| **4.2.3** | Uygulamanın, yanıt bölme ve header enjeksiyonu saldırılarını önlemek amacıyla, bağlantıya özel başlık alanları (örneğin Transfer-Encoding) içeren HTTP/2 veya HTTP/3 iletilerini göndermediği ve kabul etmediği doğrulanmalıdır. | 3 | +| **4.2.4** | Uygulamanın yalnızca başlık alanları ve değerleri CR (\r), LF (\n) veya CRLF (\r\n) karakter dizileri içermeyen HTTP/2 ve HTTP/3 isteklerini kabul ettiği doğrulanmalıdır. Bu, başlık enjeksiyonu saldırılarını önlemek içindir. | 3 | +| **4.2.5** | Uygulama (backend veya frontend) istek oluşturuyor ve gönderiyorsa, URI'ler (örneğin API çağrıları için) veya HTTP istek başlıkları (örneğin Authorization veya Cookie) gibi bileşenlerin, alıcı sistemler tarafından kabul edilemeyecek kadar uzun olmamasını sağlamak amacıyla doğrulama, temizleme veya diğer mekanizmaları kullandığı doğrulanmalıdır. Bu tür çok uzun istekler (örneğin çok uzun bir Cookie başlığı) gönderildiğinde sunucunun sürekli hata durumu döndürmesiyle hizmet reddi oluşabilir. | 3 | + +## V4.3 GraphQL + +GraphQL, veri açısından zengin istemcilerin çeşitli backend servislerine sıkı sıkıya bağlı olmadan oluşturulması için giderek daha yaygın hale gelen bir yöntemdir. Bu bölüm, GraphQL ile ilgili güvenlik değerlendirmelerini kapsar. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **4.3.1** | Maliyetli ve iç içe geçmiş sorgular sonucu oluşabilecek GraphQL veya veri katmanı ifadelerine yönelik Hizmet Reddi (DoS) saldırılarını önlemek için, sorgu izin listesi (allowlist), derinlik sınırlandırması, sorgu sayısı sınırlandırması veya sorgu maliyeti analizi kullanıldığı doğrulanmalıdır. | 2 | +| **4.3.2** | GraphQL introspection (iç yapı sorgulama) sorgularının, GraphQL API'nin üçüncü taraflar tarafından kullanılmasına yönelik olmadığı sürece, üretim ortamında devre dışı bırakıldığı doğrulanmalıdır. | 2 | + +## V4.4 WebSocket + +WebSocket, tek bir TCP bağlantısı üzerinden eşzamanlı çift yönlü iletişim sağlayan bir iletişim protokolüdür. 2011 yılında IETF tarafından RFC 6455 olarak standartlaştırılmıştır ve HTTP'den farklıdır, ancak 443 ve 80 numaralı HTTP portları üzerinden çalışacak şekilde tasarlanmıştır. + +Bu bölüm, özellikle bu gerçek zamanlı iletişim kanalını hedef alan iletişim güvenliği ve oturum yönetimi ile ilgili saldırılara karşı korunmak için gerekli olan güvenlik gereksinimlerini sunar. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **4.4.1** | Tüm WebSocket bağlantılarında TLS üzerinden WebSocket (WSS) kullanıldığı doğrulanmalıdır. | 1 | +| **4.4.2** | WebSocket'in başlangıçtaki HTTP el sıkışması (handshake) sırasında, Origin başlık alanının uygulama için izin verilen origin listesiyle karşılaştırılarak kontrol edildiği doğrulanmalıdır. | 2 | +| **4.4.3** | Uygulamanın standart oturum yönetimi kullanılamıyorsa, bunun yerine ilgili Oturum Yönetimi güvenlik gereksinimlerine uygun özel token'ların kullanıldığı doğrulanmalıdır. | 2 | +| **4.4.4** | HTTPS oturumu WebSocket kanalına geçerken, özel WebSocket oturum yönetim token’larının önceki şekilde kimliği doğrulanmış HTTPS oturumu aracılığıyla elde edildiği veya doğrulandığı doğrulanmalıdır. | 2 | + +## Referanslar + +Daha fazla bilgi için: + +* [OWASP REST Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html) +* Resources on GraphQL Authorization from [graphql.org](https://graphql.org/learn/authorization/) and [Apollo](https://www.apollographql.com/docs/apollo-server/security/authentication/#authorization-methods). +* [WSTG - v4.2 | GraphQL Testing](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/12-API_Testing/01-Testing_GraphQL) +* [WSTG - v4.1 | OWASP Foundation](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/11-Client-side_Testing/10-Testing_WebSockets) diff --git a/5.0/tr/0x14-V5-File-Handling.md b/5.0/tr/0x14-V5-File-Handling.md new file mode 100644 index 0000000000..6061a1488c --- /dev/null +++ b/5.0/tr/0x14-V5-File-Handling.md @@ -0,0 +1,54 @@ +# V5 Dosya İşleme + +## Kontrol Amacı + +Dosya kullanımı, hizmet reddi, yetkisiz erişim ve depolama alanının tükenmesi gibi uygulama için çeşitli riskler oluşturabilir. Bu bölüm, bu riskleri ele almak için gereken gereksinimleri içerir. + +## V5.1 Dosya İşleme Dokümantasyonu + +Bu bölüm, uygulama tarafından kabul edilen dosyaların beklenen özelliklerinin belgelenmesini gerektirir. Bu, ilgili güvenlik kontrollerinin geliştirilmesi ve doğrulanması için gerekli bir ön koşuldur. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **5.1.1** | Dokümantasyonun, her yükleme özelliği için izin verilen dosya türlerini, beklenen dosya uzantılarını ve maksimum boyutu (açılmış hali dahil) tanımladığı doğrulanmalıdır. Ayrıca, dosyaların son kullanıcılar için nasıl güvenli hâle getirileceği (örneğin kötü amaçlı bir dosya tespit edildiğinde uygulamanın nasıl davranacağı) gibi bilgilerin de belgede yer aldığı doğrulanmalıdır. | 2 | + +## V5.2 Dosya Yükleme ve İçerik + +Dosya yükleme işlevi, güvenilmeyen dosyaların birincil kaynağıdır. Bu bölüm, bu dosyaların varlığının, hacminin veya içeriğinin uygulamaya zarar vermemesini sağlamak için gereken gereksinimleri açıklar. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **5.2.1** | Uygulamanın, yalnızca performans kaybına veya hizmet reddine yol açmayacak boyuttaki dosyaları kabul ettiği doğrulanmalıdır. | 1 | +| **5.2.2** | Uygulama bir dosyayı, doğrudan veya bir arşiv (ör. zip dosyası) içinde kabul ettiğinde, dosya uzantısının beklenen uzantıyla eşleşip eşleşmediğini kontrol ettiği ve içeriğin uzantı tarafından temsil edilen türle uyumlu olduğunu doğruladığı kontrol edilmelidir. Bu; ilk 'magic byte' kontrolü, görüntü yeniden yazımı ve dosya içeriği doğrulama için özel kütüphanelerin kullanımı gibi yöntemleri içerir. Seviye 1 için bu, yalnızca iş veya güvenlik kararlarında kullanılan dosyalarla sınırlı olabilir. Seviye 2 ve üzeri için tüm dosyalar bu kontrole tabi olmalıdır. | 1 | +| **5.2.3** | Sıkıştırılmış dosyaların (ör. zip, gz, docx, odt) açılmadan önce, izin verilen maksimum açılmış boyuta ve maksimum dosya sayısına göre kontrol edildiği doğrulanmalıdır. | 2 | +| **5.2.4** | Her kullanıcı için dosya boyutu kotası ve maksimum dosya sayısının uygulandığı doğrulanmalıdır. Böylece tek bir kullanıcının çok sayıda veya aşırı büyük dosya yükleyerek depolama alanını doldurması engellenir. | 3 | +| **5.2.5** | Uygulamanın, içinde sembolik bağlantılar (symlink) bulunan sıkıştırılmış dosyaların yüklenmesine yalnızca bu durum özel olarak gerekli olduğunda izin verdiği doğrulanmalıdır. Bu durumda, sembolik bağlantı verilebilecek dosyaların bir izinli listesi uygulanmalıdır. | 3 | +| **5.2.6** | Uygulamanın, piksel boyutu izin verilen maksimum değeri aşan görüntü dosyalarının yüklenmesini reddettiği doğrulanmalıdır. Bu, pixel flood saldırılarını önlemek için gereklidir. | 3 | + +## V5.3 Dosya Depolama + +Bu bölüm, yüklenen dosyaların uygunsuz şekilde çalıştırılmasını önlemeye, tehlikeli içeriğin tespitine ve güvenilmeyen verilerle dosya depolama konumlarının kontrol edilmesinin engellenmesine yönelik gereksinimleri içerir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **5.3.1** | Güvenilmeyen girdilerle yüklenen veya oluşturulan ve herkese açık klasörlerde depolanan dosyaların, bir HTTP isteğiyle doğrudan erişildiğinde sunucu taraflı program kodu olarak çalıştırılmadığı doğrulanmalıdır. | 1 | +| **5.3.2** | Uygulamanın, dosya işlemleri için dosya yollarını oluştururken kullanıcı tarafından gönderilen dosya adlarını değil, dahili olarak oluşturulan veya güvenilir verileri kullandığı; eğer kullanıcı tarafından gönderilen dosya adları veya meta veriler kullanılacaksa, sıkı doğrulama ve temizleme işlemlerinin uygulandığı doğrulanmalıdır. Bu, yol geçişi (path traversal), yerel veya uzak dosya dahil etme (LFI, RFI) ve sunucu tarafı istek sahteciliği (SSRF) saldırılarına karşı koruma sağlar. | 1 | +| **5.3.3** | Sunucu tarafında gerçekleşen dosya işlemlerinin (örneğin dosya açma/decompress işlemi), kullanıcı tarafından sağlanan yol bilgilerini yok saydığı ve zip slip gibi güvenlik açıklarını önlediği doğrulanmalıdır. | 3 | + +## V5.4 Dosya İndirme + +Bu bölüm, indirilebilir dosyaların sunulmasında ortaya çıkabilecek riskleri azaltmaya yönelik gereksinimleri içerir. Bunlar; yol geçişi (path traversal), enjeksiyon saldırıları ve dosyanın tehlikeli içerik barındırıp barındırmadığına ilişkin kontrolleri kapsar. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **5.4.1** | Uygulamanın, kullanıcı tarafından gönderilen dosya adlarını (ör. JSON, JSONP veya URL parametresinde) doğruladığı veya göz ardı ettiği ve yanıtın Content-Disposition başlık alanında bir dosya adı belirttiği doğrulanmalıdır. | 2 | +| **5.4.2** | Sunulan dosya adlarının (örneğin HTTP yanıt header'larında veya e-posta eklerinde), belge yapısını korumak ve enjeksiyon saldırılarını önlemek için kodlandığı veya temizlendiği (ör. RFC 6266’ya uygun) doğrulanmalıdır. | 2 | +| **5.4.3** | Güvenilmeyen kaynaklardan elde edilen dosyaların, bilinen kötü amaçlı içeriklerin sunulmasını önlemek amacıyla antivirüs tarayıcılarıyla tarandığı doğrulanmalıdır. | 2 | + +## Referanslar + +Daha fazla bilgi için: + +* [File Extension Handling for Sensitive Information](https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload) +* [Example of using symlinks for arbitrary file read](https://hackerone.com/reports/1439593) +* [Explanation of "Magic Bytes" from Wikipedia](https://en.wikipedia.org/wiki/List_of_file_signatures) diff --git a/5.0/tr/0x15-V6-Authentication.md b/5.0/tr/0x15-V6-Authentication.md new file mode 100644 index 0000000000..9b01cbe2c7 --- /dev/null +++ b/5.0/tr/0x15-V6-Authentication.md @@ -0,0 +1,166 @@ +# V6 Kimlik Doğrulama + +## Kontrol Amacı + +Kimlik doğrulama, bir kişinin ya da cihazın kimliğini kanıtlama veya doğrulama sürecidir. Bu süreç; bir kişi ya da cihaz hakkında yapılan iddiaların doğrulanmasını, taklit girişimlerine karşı dayanıklılığı ve parolaların ele geçirilmesine ya da dinlenmesine karşı korunmayı kapsar. + +[NIST SP 800-63](https://pages.nist.gov/800-63-3/), özellikle ABD kurumları ve bu kurumlarla etkileşimde bulunanlar için geçerli olmakla birlikte, dünya çapında kuruluşlar için değerli olan modern ve kanıta dayalı bir standarttır. + +Bu bölümdeki birçok gereksinim, söz konusu standardın ikinci bölümü olan NIST SP 800-63B "Dijital Kimlik Rehberi – Kimlik Doğrulama ve Yaşam Döngüsü Yönetimi" bölümünden esinlenmiştir. Ancak bu bölüm, yaygın tehditlere ve sıkça suistimal edilen kimlik doğrulama zayıflıklarına odaklanır; standardın tüm yönlerini kapsamaya çalışmaz. Tam NIST SP 800-63 uyumu gerekiyorsa, doğrudan bu belgeye başvurulmalıdır. + +Ayrıca, NIST SP 800-63 terimleriyle bu bölümde kullanılan terimler zaman zaman farklılık gösterebilir. Bu bölümde, anlaşılırlığı artırmak amacıyla daha yaygın kullanılan terimler tercih edilmiştir. + +Daha gelişmiş uygulamaların ortak bir özelliği, çeşitli risk faktörlerine bağlı olarak kimlik doğrulama aşamalarının uyarlanabilir şekilde yapılandırılabilmesidir. Bu özellik, yetkilendirme kararlarıyla da ilgili olduğundan "Yetkilendirme" bölümünde ele alınmıştır. + +## V6.1 Kimlik Doğrulama Dokümantasyonu + +Bu bölüm, bir uygulamada kimlik doğrulama ile ilgili tutulması gereken dokümantasyon gereksinimlerini içerir. Bu, ilgili kimlik doğrulama kontrollerinin nasıl yapılandırılması gerektiğini uygulamak ve değerlendirmek açısından kritik öneme sahiptir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **6.1.1** | Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırılarına karşı oran sınırlama (rate limiting), otomasyon karşıtı önlemler ve uyarlanabilir yanıt gibi kontrollerin nasıl kullanıldığını açıklayan bir uygulama dokümantasyonu bulunduğu doğrulanmalıdır. Dokümantasyon, bu kontrollerin nasıl yapılandırıldığını ve kötü niyetli hesap kilitlemenin nasıl önlendiğini açıkça ortaya koymalıdır. | 1 | +| **6.1.2** | Parolalarda kullanılmasını önlemek amacıyla, bağlama özgü sözcüklerin (örneğin kurum adlarının permütasyonları, ürün adları, sistem tanımlayıcıları, proje kod adları, departman veya rol adları vb.) bulunduğu belgelenmiş bir liste mevcut olduğu doğrulanmalıdır. | 2 | +| **6.1.3** | Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, bunların tümünün belgelenmiş olduğu ve her yol için tutarlı şekilde uygulanması gereken güvenlik kontrolleri ile kimlik doğrulama gücünün tanımlandığı doğrulanmalıdır. | 2 | + +## V6.2 Parola Güvenliği + +Parolalar, NIST SP 800-63 tarafından "Ezberlenmiş Sırlar" (Memorized Secrets) olarak tanımlanır ve parolalar, parola öbekleri, PIN'ler, desen kilitleri ya da "doğru kedinin veya başka bir görsel öğenin seçilmesi" gibi yöntemleri kapsar. Genellikle "bildiğiniz bir şey" olarak kabul edilirler ve tek faktörlü kimlik doğrulamada yaygın olarak kullanılırlar. + +Bu nedenle, bu bölüm parolaların güvenli şekilde oluşturulmasını ve işlenmesini sağlamak amacıyla oluşturulmuş gereksinimleri içerir. Gereksinimlerin çoğu Seviye 1’dedir çünkü temel düzeyde en önemli olanlardır. Seviye 2 ve sonrasında, çok faktörlü kimlik doğrulama mekanizmaları gereklidir ve parola bu faktörlerden yalnızca biri olabilir. + +Bu bölümdeki gereksinimler büyük ölçüde [NIST's Guidance](https://pages.nist.gov/800-63-3/sp800-63b.html)'ın [§ 5.1.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver) kısmı ile ilişkilidir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **6.2.1** | Kullanıcı tarafından belirlenen parolaların en az 8 karakter uzunluğunda olması sağlanmalı, ancak 15 karakter ve üzeri uzunlukta parolalar olmaları şiddetle tavsiye edilir. | 1 | +| **6.2.2** | Kullanıcıların parolalarını değiştirebilmeleri sağlanmalıdır. | 1 | +| **6.2.3** | Parola değiştirme işlevinin hem mevcut hem de yeni parolayı gerektirdiği doğrulanmalıdır. | 1 | +| **6.2.4** | Kayıt veya parola değişimi sırasında girilen parolaların, uygulamanın parola politikasına (örneğin minimum uzunluk) uyan ilk 3000 yaygın parolaya karşı kontrol edildiği doğrulanmalıdır. | 1 | +| **6.2.5** | Her tür karakterin kullanılmasına izin verildiği ve büyük/küçük harf, sayı veya özel karakter şartlarının zorunlu tutulmadığı doğrulanmalıdır. | 1 | +| **6.2.6** | Parola giriş alanlarının, girdiyi maskelemek için "type=password" kullandığı doğrulanmalıdır. Uygulamalar, kullanıcının tüm maskelenmiş parolayı ya da son girilen karakteri geçici olarak görüntülemesine izin verebilir. | 1 | +| **6.2.7** | "Yapıştır" özelliğinin, tarayıcı parola yardımcılarının ve harici parola yöneticilerinin kullanımına izin verildiği doğrulanmalıdır. | 1 | +| **6.2.8** | Uygulamanın, kullanıcıdan aldığı parolayı herhangi bir şekilde değiştirmeden, örneğin kesmeden veya harf büyüklüğünü değiştirmeden, tam olarak doğruladığı teyit edilmelidir. | 1 | +| **6.2.9** | En az 64 karakter uzunluğundaki parolalara izin verildiği doğrulanmalıdır. | 2 | +| **6.2.10** | Kullanıcının parolasının, yalnızca ele geçirildiği tespit edildiğinde veya kullanıcı tarafından yenilendiğinde geçerliliğini yitirdiği doğrulanmalıdır. Uygulama, belirli aralıklarla parola yenilenmesini zorunlu kılmamalıdır. | 2 | +| **6.2.11** | Tahmin edilmesi kolay parolaların oluşturulmasını önlemek amacıyla, bağlama özgü kelimelerin yer aldığı belgelenmiş listenin parola doğrulamada kullanıldığı teyit edilmelidir. | 2 | +| **6.2.12** | Kayıt veya parola değişikliği sırasında girilen parolaların, ele geçirilmiş parolalar listesine karşı kontrol edildiği doğrulanmalıdır. | 2 | + +## V6.3 Genel Kimlik Doğrulama Güvenliği + +Bu bölüm, kimlik doğrulama mekanizmalarının güvenliğine ilişkin genel gereksinimleri içerir ve farklı güvenlik seviyeleri için beklentileri ortaya koyar. Seviye 2 uygulamalarında çok faktörlü kimlik doğrulama (MFA) zorunlu olmalıdır. Seviye 3 uygulamalarında, donanım tabanlı, kanıtlanmış ve güvenli yürütme ortamında (Trusted Execution Environment - TEE) gerçekleştirilen kimlik doğrulama kullanılmalıdır. Bu, cihaza bağlı passkey’ler, eIDAS Yüksek Güvence Seviyesi (LoA High) zorunlu kimlik doğrulayıcılar, NIST Kimlik Doğrulayıcı Güvence Seviyesi 3 (AAL3) güvencesine sahip kimlik doğrulayıcılar veya eşdeğer mekanizmaları içerebilir. + +Bu yaklaşım MFA konusunda oldukça katı bir duruş sergilese de, kullanıcıları korumak adına güvenlik seviyesini yükseltmek kritiktir. Bu gereksinimlerin gevşetilmesi yönündeki her girişim, kimlik doğrulama ile ilgili risklerin nasıl azaltılacağını açıkça ortaya koyan bir planla birlikte sunulmalıdır. Bu plan, NIST’in konuyla ilgili rehberleri ve araştırmalarını dikkate almalıdır. + +Yayın tarihi itibarıyla, NIST SP 800-63 e-posta kullanımını bir kimlik doğrulama mekanizması olarak [kabul edilemez](https://pages.nist.gov/800-63-FAQ/#q-b11) olarak değerlendirmektedir ([arşivlenmiş kopya](https://web.archive.org/web/20250330115328/https://pages.nist.gov/800-63-FAQ/#q-b11)). + +Bu bölümdeki gereksinimler, [NIST's Guidance](https://pages.nist.gov/800-63-3/sp800-63b.html)'ın [§ 4.2.1](https://pages.nist.gov/800-63-3/sp800-63b.html#421-permitted-authenticator-types), [§ 4.3.1](https://pages.nist.gov/800-63-3/sp800-63b.html#431-permitted-authenticator-types), [§ 5.2.2](https://pages.nist.gov/800-63-3/sp800-63b.html#522-rate-limiting-throttling) ve [§ 6.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#-612-post-enrollment-binding) bölümleriyle ilgilidir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **6.3.1** | Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırıları gibi saldırıları önlemeye yönelik kontrollerin, uygulamanın güvenlik dokümantasyonuna göre uygulandığı doğrulanmalıdır. | 1 | +| **6.3.2** | "root", "admin" veya "sa" gibi varsayılan kullanıcı hesaplarının uygulamada yer almadığı veya devre dışı bırakıldığı doğrulanmalıdır. | 1 | +| **6.3.3** | Uygulamaya erişim için ya çok faktörlü bir kimlik doğrulama mekanizması ya da tek faktörlü mekanizmaların kombinasyonu kullanılmalıdır. Seviye 3 için, bu faktörlerden biri, oltalama saldırılarına karşı direnç sağlayan ve kimlik doğrulama niyetini bir kullanıcı etkileşimi (örneğin FIDO donanım anahtarında bir düğmeye basma veya mobil telefonda bir onay) gerektirerek doğrulayan donanım tabanlı bir kimlik doğrulayıcı olmalıdır. Bu gereksinimdeki herhangi bir esneklik için, gerekçesi belgelenmiş ve riskleri azaltıcı kapsamlı kontroller içeren bir plan gereklidir. | 2 | +| **6.3.4** | Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, belgelendirilmemiş bir yol bulunmadığı ve tüm yollar için güvenlik kontrolleri ile kimlik doğrulama gücünün tutarlı şekilde uygulandığı doğrulanmalıdır. | 2 | +| **6.3.5** | Başarılı veya başarısız şüpheli kimlik doğrulama girişimlerinin kullanıcıya bildirildiği doğrulanmalıdır. Bu, olağandışı bir konum veya istemciden gelen girişimler, yalnızca bir faktörle yapılan kısmen başarılı doğrulamalar, uzun süreli inaktiflik sonrası yapılan girişimler veya birçok başarısız denemeden sonraki başarılı girişimler gibi durumları içerebilir. | 3 | +| **6.3.6** | E-postanın, tek faktörlü ya da çok faktörlü kimlik doğrulama mekanizması olarak kullanılmadığı doğrulanmalıdır. | 3 | +| **6.3.7** | Kimlik doğrulama detaylarında yapılan güncellemeler sonrasında (örneğin kimlik bilgisi sıfırlama, kullanıcı adı veya e-posta adresi değişiklikleri), kullanıcıların bilgilendirildiği doğrulanmalıdır. | 3 | +| **6.3.8** | Başarısız kimlik doğrulama girişimlerinden, geçerli kullanıcıların hata mesajları, HTTP yanıt kodları veya farklı yanıt süreleri gibi sonuçlara dayanarak tespit edilemediği doğrulanmalıdır. Bu koruma, kayıt ve "parolamı unuttum" işlevselliğinde de geçerli olmalıdır. | 3 | + +## V6.4 Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma + +Kimlik doğrulama faktörleri; parolalar, yazılım tabanlı token'lar, donanım token'ları ve biyometrik cihazlar gibi öğeleri kapsar. Bu mekanizmaların yaşam döngüsünün güvenli şekilde yönetilmesi, bir uygulamanın güvenliği açısından kritik öneme sahiptir. Bu bölüm, bu mekanizmalarla ilgili gereksinimleri içerir. + +Bu bölümdeki gereksinimler, büyük ölçüde [NIST's Guidance](https://pages.nist.gov/800-63-3/sp800-63b.html)'ın [§ 5.1.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver) veya [§ 6.1.2.3](https://pages.nist.gov/800-63-3/sp800-63b.html#replacement) bölümleri ile ilişkilidir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **6.4.1** | Sistem tarafından oluşturulan ilk parolaların veya etkinleştirme kodlarının güvenli bir şekilde rastgele üretildiği, mevcut parola politikasına uygun olduğu, kısa bir süre içinde veya ilk kullanım sonrasında geçerliliğini yitirdiği doğrulanmalıdır. Bu başlangıç sırları uzun vadeli parola olarak kullanılmasına izin verilmemelidir. | 1 | +| **6.4.2** | Parola ipuçlarının veya "gizli sorular" olarak bilinen, bilgiye dayalı kimlik doğrulama mekanizmalarının mevcut olmadığı doğrulanmalıdır. | 1 | +| **6.4.3** | Unutulmuş parolanın sıfırlanması için, etkin olan çok faktörlü kimlik doğrulama mekanizmalarını atlamayan güvenli bir sürecin uygulandığı doğrulanmalıdır. | 2 | +| **6.4.4** | Çok faktörlü kimlik doğrulama faktörlerinden biri kaybolursa, kayıt sırasında uygulanan kimlik kanıtlama seviyesiyle aynı seviyede kimlik doğrulama yapıldığı doğrulanmalıdır. | 2 | +| **6.4.5** | Süresi dolacak kimlik doğrulama mekanizmalarının yenilenmesine ilişkin talimatların, süresi dolmadan önce tamamlanacak şekilde yeterli sürede gönderildiği ve gerekiyorsa otomatik hatırlatıcıların yapılandırıldığı doğrulanmalıdır. | 3 | +| **6.4.6** | Yönetici yetkisi olan kullanıcıların, kullanıcının parola sıfırlama sürecini başlatabildiği ancak kullanıcının yeni parolasını belirleyemediği veya değiştiremediği doğrulanmalıdır. Bu, yönetici yetkisi olan kullanıcıların, kullanıcı parolasını bilmesini engeller. | 3 | + +## V6.5 Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler + +Bu bölüm, çeşitli çok faktörlü kimlik doğrulama yöntemleriyle ilgili genel yönergeleri sunar. + +Bu mekanizmalar şunları içerir: + +* Arama Sırları (Lookup Secrets) +* Zamana Dayalı Tek Kullanımlık Parolalar (TOTP) +* Bant Dışı (Out-of-Band) mekanizmalar + +"Arama sırları", daha önceden oluşturulmuş gizli kod listeleridir. Bunlar, İşlem Yetkilendirme Numaraları (TAN), sosyal medya kurtarma kodları veya rastgele değerler içeren bir tablo şeklinde olabilir. Bu tür kimlik doğrulama mekanizmaları, “sahip olduğunuz bir şey” olarak değerlendirilir çünkü kodlar kasıtlı olarak ezberlenemez olacak şekilde tasarlanır ve bir yerde saklanmaları gerekir. + +Zamana Dayalı Tek Kullanımlık Parolalar (TOTP), fiziksel veya yazılımsal token'lardır ve sürekli değişen, sözde rastgele (pseudo-random) bir tek kullanımlık parola gösterir. Bu mekanizmalar da “sahip olduğunuz bir şey” kategorisindedir. Çok faktörlü TOTP'ler tek faktörlü TOTP'lere benzer, ancak nihai Tek Kullanımlık Parolayı (OTP) oluşturmak için geçerli bir PIN kodu, biyometrik kilit açma, USB takma, NFC eşleştirme veya bazı ek değerlerin (işlem imzalama hesaplayıcıları gibi) girilmesini gerektirir. + +Bant dışı mekanizmalar bir sonraki bölümde açıklanacaktır. + +Bu bölümlerdeki gereklilikler çoğunlukla [NIST's Guidance](https://pages.nist.gov/800-63-3/sp800-63b.html)'ın [§ 5.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#-512-look-up-secrets), [§ 5.1.3](https://pages.nist.gov/800-63-3/sp800-63b.html#-513-out-of-band-devices), [§ 5.1.4.2](https://pages.nist.gov/800-63-3/sp800-63b.html#5142-single-factor-otp-verifiers), [§ 5.1.5.2](https://pages.nist.gov/800-63-3/sp800-63b.html#5152-multi-factor-otp-verifiers), [§ 5.2.1](https://pages.nist.gov/800-63-3/sp800-63b.html#521-physical-authenticators) ve [§ 5.2.3](https://pages.nist.gov/800-63-3/sp800-63b.html#523-use-of-biometrics) kısımları ile ilgilidir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **6.5.1** | Arama sırları, bant dışı kimlik doğrulama istekleri veya kodları ve zamana dayalı tek kullanımlık parolaların (TOTP) yalnızca bir kez kullanılabildiği doğrulanmalıdır. | 2 | +| **6.5.2** | Uygulamanın backend tarafında saklanırken, 112 bitten az entropiye sahip (örneğin 19 rastgele harf-rakam karakteri veya 34 rastgele rakam) arama sırlarının, 32-bit rastgele bir salt içeren onaylı bir parola saklama algoritmasıyla hash’lendiği doğrulanmalıdır. Gizli bilginin entropisi 112 bit veya daha fazlaysa standart bir hash fonksiyonu kullanılabilir. | 2 | +| **6.5.3** | Arama sırları, bant dışı kimlik doğrulama kodları ve zamana dayalı tek kullanımlık parola seed'lerinin, öngörülebilir değerlerden kaçınmak için Kriptografik Olarak Güvenli Sözde Rastgele Sayı Üreteci (CSPRNG) ile oluşturulduğu doğrulanmalıdır. | 2 | +| **6.5.4** | Arama sırlarının ve bant dışı kimlik doğrulama kodlarının en az 20 bit entropiye (genellikle 4 rastgele harf-rakam karakteri veya 6 rastgele rakam) sahip olduğu doğrulanmalıdır. | 2 | +| **6.5.5** | Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının ve zamana dayalı tek kullanımlık parolaların (TOTP) belirli bir ömre sahip olduğu doğrulanmalıdır. Bant dışı istekler en fazla 10 dakika, TOTP’ler ise en fazla 30 saniye geçerli olmalıdır. | 2 | +| **6.5.6** | Herhangi bir kimlik doğrulama faktörünün (fiziksel cihazlar dahil) çalınması veya kaybı durumunda iptal edilebildiği doğrulanmalıdır. | 3 | +| **6.5.7** | Biyometrik kimlik doğrulama mekanizmalarının yalnızca ikincil faktör olarak, “sahip olduğunuz bir şey” veya “bildiğiniz bir şey” ile birlikte kullanıldığı doğrulanmalıdır. | 3 | +| **6.5.8** | Zamana dayalı tek kullanımlık parolaların (TOTP) doğrulamasının, güvenilir bir hizmetten alınan zaman kaynağına dayanarak yapıldığı ve güvenilir olmayan veya istemci tarafından sağlanan zaman kaynağına dayanmadığı doğrulanmalıdır. | 3 | + +## V6.6 Bant Dışı Kimlik Doğrulama Mekanizmaları + +Bu mekanizmalar genellikle kimlik doğrulama sunucusunun, fiziksel bir cihazla güvenli bir ikinci kanal üzerinden iletişim kurmasını (örneğin mobil cihazlara gönderilen bildirimler) içerir. Bu tür mekanizmalar, “sahip olduğunuz bir şey” olarak değerlendirilir. + +E-posta ve VOIP gibi güvenli olmayan bant dışı kimlik doğrulama yöntemlerine izin verilmemektedir. PSTN ve SMS ile yapılan kimlik doğrulama şu anda NIST tarafından ["sınırlandırılmış" doğrulama mekanizmaları](https://pages.nist.gov/800-63-FAQ/#q-b01) olarak değerlendirilmekte ve yerlerine zamana dayalı tek kullanımlık parolalar (TOTP) veya benzer kriptografik mekanizmaların tercih edilmesi önerilmektedir. NIST SP 800-63B [§ 5.1.3.3](https://pages.nist.gov/800-63-3/sp800-63b.html#-5133-authentication-using-the-public-switched-telephone-network), telefon veya SMS kullanılması gerekiyorsa cihaz değişimi, SIM değişikliği, numara taşıma gibi anormal davranışların risklerinin ele alınmasını önermektedir. Bu ASVS bölümü bunu zorunlu kılmasa da, bu önlemlerin alınmaması Seviye 2'deki hassas bir uygulamada veya Seviye 3’teki bir uygulamada ciddi bir güvenlik riski olarak değerlendirilmelidir. + +Ayrıca NIST, yakın zamanda [anlık bildirimlerin kullanılmamasını öneren](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#fig-3) bir yönerge oluşturmuştur. Bu ASVS bölümü bu konuda bir zorunluluk getirmese de, “push bombing” risklerine karşı farkındalık önemlidir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **6.6.1** | Tek kullanımlık parolaların (OTP) telefon veya SMS ile Public Switched Telephone Network (PSTN) üzerinden iletildiği kimlik doğrulama mekanizmalarının, yalnızca telefon numarası önceden doğrulanmışsa, alternatif daha güçlü yöntemler (örneğin TOTP) de sunuluyorsa ve kullanıcıya güvenlik riskleri hakkında bilgi veriliyorsa sunulduğu doğrulanmalıdır. Seviye 3 uygulamalar için telefon ve SMS seçenekleri sunulmamalıdır. | 2 | +| **6.6.2** | Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının, oluşturuldukları özgün kimlik doğrulama isteğiyle bağlantılı olduğu ve daha önceki ya da sonraki bir istek için kullanılamadığı doğrulanmalıdır. | 2 | +| **6.6.3** | Kod tabanlı bant dışı kimlik doğrulama mekanizmalarının, oran sınırlaması ile kaba kuvvet saldırılarına karşı korunduğu doğrulanmalıdır. En az 64 bit entropiye sahip kodlar kullanılması da değerlendirilmelidir. | 2 | +| **6.6.4** | Çok faktörlü kimlik doğrulama için push bildirimleri kullanılıyorsa, push bombing saldırılarına karşı oran sınırlamasının kullanıldığı doğrulanmalıdır. “Numara eşleştirme” de bu riski azaltabilir. | 3 | + +## V6.7 Kriptografik Kimlik Doğrulama Mekanizması + +Kriptografik kimlik doğrulama mekanizmaları, akıllı kartlar veya FIDO anahtarları gibi kullanıcıların kimlik doğrulama işlemini tamamlamak için kriptografik cihazı bilgisayara takması ya da eşleştirmesini gerektiren mekanizmaları içerir. Kimlik doğrulama sunucusu, kriptografik cihaza veya yazılıma bir "challenge nonce" gönderir; cihaz ya da yazılım da güvenli bir şekilde saklanan kriptografik anahtara dayalı olarak bir yanıt üretir. Bu bölümdeki gereksinimler bu mekanizmalar için, “Kriptografi” bölümünde ele alınan kriptografik algoritmalarla ilgili rehberlik sağlayan kısımlarla birlikte, uygulamaya özel rehberlik sağlar. + +Kriptografik kimlik doğrulama için paylaşımlı veya gizli anahtarların kullanıldığı durumlarda, diğer sistem gizli anahtarlarıyla aynı mekanizmalar kullanılarak saklanmalıdır. Bu mekanizmalar “Yapılandırma” başlığındaki “Gizli Yönetimi” bölümünde belgelenmiştir. + +Bu bölümdeki gereksinimler çoğunlukla [NIST's Guidance](https://pages.nist.gov/800-63-3/sp800-63b.html)'ın [§ 5.1.7.2](https://pages.nist.gov/800-63-3/sp800-63b.html#sfcdv) kısmı ile ilişkilidir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **6.7.1** | Kriptografik kimlik doğrulama beyanlarını doğrulamak için kullanılan sertifikaların, değiştirilmeye karşı korumalı şekilde saklandığı doğrulanmalıdır. | 3 | +| **6.7.2** | Challenge nonce değerinin en az 64 bit uzunluğunda olduğu ve istatistiksel olarak benzersiz ya da cihazın ömrü boyunca benzersiz olduğu doğrulanmalıdır. | 3 | + +## V6.8 Kimlik Sağlayıcısı ile Kimlik Doğrulama + +Kimlik Sağlayıcılar (IdP'ler), kullanıcılar için birleştirilmiş kimlikler sunar. Kullanıcılar genellikle birden fazla IdP ile birden fazla kimliğe sahiptir; örneğin Azure AD, Okta, Ping Identity veya Google gibi bir kurumsal kimlik ya da Facebook, Twitter, Google veya WeChat gibi bir tüketici kimliği. Bu liste, bu şirketlere veya hizmetlere bir onay niteliğinde değil, sadece geliştiricilerin çoğu kullanıcının halihazırda birçok kimliğe sahip olduğu gerçeğini dikkate almaları gerektiğine dair bir hatırlatmadır. Kuruluşlar, IdP'nin kimlik doğrulama gücüne ilişkin risk profiline göre mevcut kullanıcı kimlikleriyle entegrasyon sağlamayı değerlendirmelidir. Örneğin, sahte veya geçici kimliklerin kolayca oluşturulabilmesi nedeniyle bir devlet kurumu, sosyal medya kimliklerini hassas sistemlere giriş için kabul etmeyebilir; ancak bir mobil oyun şirketi, aktif oyuncu kitlesini artırmak için büyük sosyal medya platformlarıyla entegrasyon yapmayı tercih edebilir. + +Harici kimlik sağlayıcıların güvenli kullanımı, kimlik sahtekarlığını veya sahte beyanları önlemek için dikkatli yapılandırma ve doğrulama gerektirir. Bu bölüm, bu riskleri ele almak için gereksinimleri sunar. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **6.8.1** | Uygulama birden fazla kimlik sağlayıcıyı (IdP) destekliyorsa, başka bir desteklenen kimlik sağlayıcı aracılığıyla (örneğin aynı kullanıcı tanımlayıcısını kullanarak) kullanıcının kimliğinin taklit edilemediği doğrulanmalıdır. Standart önlem, uygulamanın kullanıcıyı IdP kimliği (bir ad alanı işlevi görür) ve IdP içindeki kullanıcı kimliğinin birleşimiyle kaydetmesi ve tanımlamasıdır. | 2 | +| **6.8.2** | Kimlik doğrulama beyanları üzerindeki dijital imzaların (örneğin JWT veya SAML beyanları) varlığı ve bütünlüğünün her zaman doğrulandığı ve imzasız veya geçersiz imzalı beyanların reddedildiği doğrulanmalıdır. | 2 | +| **6.8.3** | SAML beyanlarının benzersiz biçimde işlendiği ve yalnızca geçerlilik süresi içinde bir kez kullanıldığı, tekrar oynatma (replay) saldırılarını önlemek amacıyla doğrulanmalıdır. | 2 | +| **6.8.4** | Uygulama ayrı bir Kimlik Sağlayıcı (IdP) kullanıyorsa ve belirli işlemler için belirli kimlik doğrulama gücü, yöntemleri veya zaman bilgisi bekliyorsa, uygulamanın bu bilgileri IdP tarafından döndürülen veriler üzerinden doğruladığı teyit edilmelidir. Örneğin OIDC kullanılıyorsa, bu durum ID Token üzerindeki 'acr', 'amr' ve 'auth_time' gibi claim’lerin (varsa) doğrulanması ile sağlanabilir. Eğer IdP bu bilgileri sağlamıyorsa, uygulamanın asgari kimlik doğrulama gücünün kullanıldığını varsayan (örneğin yalnızca kullanıcı adı ve parola ile tek faktörlü doğrulama) belgelenmiş bir yedek yaklaşımı olmalıdır. | 2 | + +## Referanslar + +Daha fazla bilgi için: + +* [NIST SP 800-63 - Digital Identity Guidelines](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-3.pdf) +* [NIST SP 800-63B - Authentication and Lifecycle Management](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf) +* [NIST SP 800-63 FAQ](https://pages.nist.gov/800-63-FAQ/) +* [OWASP Testing Guide 4.0: Testing for Authentication](https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/04-Authentication_Testing/README.html) +* [OWASP Cheat Sheet - Password storage](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html) +* [OWASP Cheat Sheet - Forgot password](https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html) +* [OWASP Cheat Sheet - Choosing and using security questions](https://cheatsheetseries.owasp.org/cheatsheets/Choosing_and_Using_Security_Questions_Cheat_Sheet.html) +* [CISA Guidance on "Number Matching"](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implement-number-matching-in-mfa-applications-508c.pdf) +* [Details on the FIDO Alliance](https://fidoalliance.org/) diff --git a/5.0/tr/0x16-V7-Session-Management.md b/5.0/tr/0x16-V7-Session-Management.md new file mode 100644 index 0000000000..b600167bf0 --- /dev/null +++ b/5.0/tr/0x16-V7-Session-Management.md @@ -0,0 +1,91 @@ +# V7 Oturum Yönetimi + +## Kontrol Amacı + +Oturum yönetim mekanizmaları, durum bilgisi olmayan iletişim protokolleri (örneğin HTTP) kullanılırken bile uygulamaların kullanıcı ve cihaz etkileşimlerini zaman içinde ilişkilendirmesini sağlar. Modern uygulamalar, farklı özelliklere ve amaçlara sahip birden fazla oturum belirteci kullanabilir. Güvenli bir oturum yönetim sistemi, saldırganların bir kurbanın oturumunu ele geçirmesini, kullanmasını veya kötüye kullanmasını önlemelidir. Oturumları yöneten uygulamaların aşağıdaki üst düzey oturum yönetimi gereksinimlerini karşılaması gerekir: + +* Oturumlar her bireye özgüdür, tahmin edilemez veya paylaşılamaz. +* Oturumlar artık gerekmediğinde geçersiz kılınır ve inaktivite durumunda zaman aşımına uğrar. + +Bu bölümdeki birçok gereksinim, yaygın tehditlere ve sıkça kötüye kullanılan kimlik doğrulama zayıflıklarına odaklanarak seçilmiş [NIST SP 800-63 Digital Identity Guidelines](https://pages.nist.gov/800-63-4/) kontrolleriyle ilgilidir. + +Belirli oturum yönetim mekanizmalarının bazı uygulama detaylarına ilişkin gereksinimler diğer bölümlerde yer almaktadır: + +* HTTP Çerezleri, oturum belirteçlerini güvence altına almak için yaygın bir mekanizmadır. Çerezler için özel güvenlik gereksinimleri "Web Frontend Güvenliği" bölümünde bulunabilir. +* Kendinden içerikli token'lar, oturumları sürdürmenin yaygın yollarından biridir. Bu token'lara özel güvenlik gereksinimleri "Kendinden İçerikli Token'lar" bölümünde ele alınmıştır. + +## V7.1 Oturum Yönetim Dokümantasyonu + +Tüm uygulamalara uyan tek bir kalıp yoktur. Bu nedenle, tüm durumlara uygun evrensel sınırlar ve limitler tanımlamak mümkün değildir. Oturum yönetimi uygulama ve testine başlanmadan önce, oturum işleme ile ilgili güvenlik kararlarının belgelenmiş olduğu bir risk analizi yapılmalıdır. Bu, oturum yönetim sisteminin uygulamanın özel ihtiyaçlarına göre uyarlanmasını sağlar. + +Durum bilgili ya da durumsuz (stateful ya da stateless) oturum mekanizması tercih edilse bile, analiz eksiksiz ve belgelenmiş olmalı ve seçilen çözümün ilgili tüm güvenlik gereksinimlerini karşılayabildiğini göstermelidir. Kullanılan herhangi bir Tek Oturum Açma (SSO) mekanizması ile olan etkileşim de değerlendirilmelidir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **7.1.1** | Kullanıcının oturum inaktivite zaman aşımı süresi ve mutlak maksimum oturum süresinin belgelendiği, diğer kontrollerle birlikte uygun olduğu ve NIST SP 800-63B yeniden kimlik doğrulama gereksinimlerinden herhangi bir sapma varsa gerekçesinin belgede yer aldığı doğrulanmalıdır. | 2 | +| **7.1.2** | Belgede bir hesap için kaç adet eşzamanlı (paralel) oturuma izin verildiği ile birlikte, maksimum aktif oturum sayısına ulaşıldığında uygulanacak davranış ve işlemlerin tanımlandığı doğrulanmalıdır. | 2 | +| **7.1.3** | Birleşik kimlik yönetim ekosisteminin bir parçası olarak kullanıcı oturumu oluşturan ve yöneten tüm sistemlerin, oturum ömrü, sonlandırma ve yeniden kimlik doğrulama gerektiren diğer koşulların nasıl koordine edildiğini açıklayan kontrollerle birlikte belgede yer aldığı doğrulanmalıdır. | 2 | + +## V7.2 Temel Oturum Yönetimi Güvenliği + +Bu bölüm, oturum token'larının güvenli bir şekilde oluşturulup doğrulandığını teyit eden, güvenli oturumların temel gereksinimlerini içerir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **7.2.1** | Uygulamanın tüm oturum token'ı doğrulama işlemlerini güvenilir bir backend servisi aracılığıyla gerçekleştirdiği doğrulanmalıdır. | 1 | +| **7.2.2** | Uygulamanın, statik API gizli anahtarları veya sabit değerler yerine, oturum yönetimi için dinamik olarak oluşturulan kendi kendine yeterli veya referans token'ları kullandığı doğrulanmalıdır. | 1 | +| **7.2.3** | Uygulama kullanıcı oturumlarını temsil etmek için referans token'ları kullanıyorsa, bu token'ların benzersiz olduğu, kriptografik olarak güvenli bir sözde rastgele sayı üreteci (CSPRNG) kullanılarak üretildiği ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. | 1 | +| **7.2.4** | Uygulamanın, kullanıcı kimlik doğrulaması (yeniden kimlik doğrulama dahil) sırasında yeni bir oturum token'ı oluşturduğu ve mevcut oturum token'ını sonlandırdığı doğrulanmalıdır. | 1 | + +## V7.3 Oturum Zaman Aşımı + +Oturum zaman aşımı mekanizmaları, oturum gaspı (session hijacking) ve diğer oturum kötüye kullanımı biçimlerine karşı fırsat aralığını en aza indirmeyi amaçlar. Zaman aşımı süreleri, belgelenmiş güvenlik kararlarını karşılamalıdır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **7.3.1** | Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde bir hareketsizlik zaman aşımı bulunduğu doğrulanmalıdır. | 2 | +| **7.3.2** | Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde mutlak bir maksimum oturum süresi bulunduğu doğrulanmalıdır. | 2 | + +## V7.4 Oturum Sonlandırma + +Oturum sonlandırma işlemi, uygulamanın kendisi tarafından veya oturum yönetimi uygulama yerine SSO sağlayıcısı tarafından yürütülüyorsa SSO sağlayıcısı tarafından gerçekleştirilebilir. Bu bölümdeki gereksinimler değerlendirilirken SSO sağlayıcısının kapsam dahilinde olup olmadığına karar verilmesi gerekebilir çünkü bazı kontroller sağlayıcı tarafından yürütülüyor olabilir. + +Oturum sonlandırma, yeniden kimlik doğrulamanın gerekli olmasını sağlamalı ve uygulama genelinde, birleşik oturum açma (varsa) ve tüm güvenen taraflar genelinde etkili olmalıdır. + +Durum bilgili oturum mekanizmaları için sonlandırma tipik olarak oturumu backend tarafında geçersiz kılmayı içerir. Kendinden içerikli token'lar durumunda ise, bu token'ları geçersiz kılmak veya engellemek için ek önlemler gerekir; aksi halde bunlar süresi dolana kadar geçerli kalabilir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **7.4.1** | Oturum sonlandırma tetiklendiğinde (örneğin, çıkış yapıldığında veya süre dolduğunda), uygulamanın oturumun daha fazla kullanılmasına izin vermediği doğrulanmalıdır. Referans token'lar veya durum bilgili oturumlar için bu, oturum verilerinin uygulama arka ucunda geçersiz kılınması anlamına gelir. Kapsamlı token kullanan uygulamaların; sonlandırılmış token listesi tutmak, kullanıcıya özel tarih ve saatten önce oluşturulan token'ları reddetmek veya kullanıcıya özel imzalama anahtarını yenilemek gibi bir çözüm uygulaması gerekir. | 1 | +| **7.4.2** | Bir kullanıcı hesabı devre dışı bırakıldığında veya silindiğinde (örneğin bir çalışanın şirketten ayrılması), uygulamanın tüm aktif oturumları sonlandırdığı doğrulanmalıdır. | 1 | +| **7.4.3** | Herhangi bir kimlik doğrulama faktörünün başarılı bir şekilde değiştirilmesi veya kaldırılmasından (şifre sıfırlama veya kurtarma yoluyla yapılan değişiklikler dahil ve varsa MFA ayarları güncellemeleri dahil) sonra, uygulamanın diğer tüm aktif oturumları sonlandırma seçeneği sunduğu doğrulanmalıdır. | 2 | +| **7.4.4** | Kimlik doğrulama gerektiren tüm sayfalarda kolay erişilebilir ve görünür bir çıkış yap (logout) işlevi bulunduğu doğrulanmalıdır. | 2 | +| **7.4.5** | Uygulama yöneticilerinin, bireysel bir kullanıcının veya tüm kullanıcıların aktif oturumlarını sonlandırabilme yetkisine sahip olduğu doğrulanmalıdır. | 2 | + +## V7.5 Oturum Kötüye Kullanımına Karşı Savunmalar + +Bu bölüm, aktif oturumların ele geçirilmesi veya kötüye kullanılması riskini azaltmaya yönelik gereksinimleri içerir. Bu riskler, örneğin kimliği doğrulanmış bir kurbanın internet tarayıcısının, kurbanın oturumunu kullanarak bir eylemi gerçekleştirmeye zorlanması gibi vektörler aracılığıyla ortaya çıkabilir. + +Bu bölümdeki gereksinimler değerlendirilirken "Kimlik Doğrulama" bölümündeki seviyeye özel yönergeler dikkate alınmalıdır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **7.5.1** | E-posta adresi, telefon numarası, MFA yapılandırması veya hesap kurtarmada kullanılan diğer bilgiler gibi kimlik doğrulamayı etkileyebilecek hassas hesap özniteliklerinde değişiklik yapılmadan önce uygulamanın tam yeniden kimlik doğrulama gerektirdiği doğrulanmalıdır. | 2 | +| **7.5.2** | Kullanıcıların, (en az bir faktörle yeniden kimlik doğrulama yaptıktan sonra) mevcut tüm aktif oturumları görüntüleyebilmesi ve sonlandırabilmesinin mümkün olduğu doğrulanmalıdır. | 2 | +| **7.5.3** | Uygulamanın, son derece hassas işlemler veya operasyonlar gerçekleştirilmeden önce en az bir faktörle ek kimlik doğrulaması veya ikincil bir doğrulama gerektirdiği doğrulanmalıdır. | 3 | + +## V7.6 Birleşik Yeniden Kimlik Doğrulama + +Bu bölüm, Güvenen Taraf (Relying Party – RP) veya Kimlik Sağlayıcı (Identity Provider – IdP) kodu yazanlar için geçerlidir. Bu gereksinimler [NIST SP 800-63C Federation & Assertions](https://pages.nist.gov/800-63-4/sp800-63c.html) (Federasyon ve Beyanlar) rehberinden türetilmiştir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **7.6.1** | Güvenen Taraf (RP) ile Kimlik Sağlayıcı (IdP) arasındaki oturum süresi ve oturum sonlandırma davranışlarının belgelenmiş olduğu ve, örneğin IdP kimlik doğrulama olayları arasında maksimum süreye ulaşıldığında yeniden kimlik doğrulamanın gerekli kılındığı doğrulanmalıdır. | 2 | +| **7.6.2** | Yeni bir oturum oluşturulmasının, kullanıcı onayı veya açık bir eylem gerektirdiği; kullanıcı etkileşimi olmaksızın yeni uygulama oturumlarının oluşturulmasının önlendiği doğrulanmalıdır. | 2 | + +## Referanslar + +Daha fazla bilgi için: + +* [OWASP Web Security Testing Guide: Session Management Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/06-Session_Management_Testing) +* [OWASP Session Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html) diff --git a/5.0/tr/0x17-V8-Authorization.md b/5.0/tr/0x17-V8-Authorization.md new file mode 100644 index 0000000000..fe8b46df88 --- /dev/null +++ b/5.0/tr/0x17-V8-Authorization.md @@ -0,0 +1,56 @@ +# V8 Yetkilendirme + +## Kontrol Amacı + +Yetkilendirme, yalnızca izin verilen tüketicilere (kullanıcılar, sunucular ve diğer istemciler) erişim verilmesini sağlar. En Az Ayrıcalık İlkesi'ni (Principle of Least Privilege - POLP) uygulamak için doğrulanmış uygulamalar aşağıdaki üst düzey gereksinimleri karşılamalıdır: + +* Yetkilendirme kurallarını, karar alma faktörlerini ve çevresel bağlamları içerecek şekilde belgelendirin. +* Tüketiciler, yalnızca tanımlanmış haklarında izin verilen kaynaklara erişebilmelidir. + +## V8.1 Yetkilendirme Dokümantasyonu + +Kapsamlı yetkilendirme dokümantasyonu, güvenlik kararlarının tutarlı biçimde uygulanmasını, denetlenebilir olmasını ve kurumsal politikalarla uyumlu olmasını sağlamak açısından kritik öneme sahiptir. Bu, geliştiriciler, yöneticiler ve test uzmanları için güvenlik gereksinimlerini açık ve uygulanabilir hâle getirerek yetkisiz erişim riskini azaltır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **8.1.1** | Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak işlev düzeyinde ve veriye özel erişim kısıtlamaları için kuralları tanımladığı doğrulanmalıdır. | 1 | +| **8.1.2** | Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak alan (field) düzeyinde erişim kısıtlamaları (hem okuma hem yazma) için kuralları tanımladığı doğrulanmalıdır. Bu kuralların, ilgili veri nesnesinin durum veya statü gibi diğer özniteliklerine bağlı olabileceği unutulmamalıdır. | 2 | +| **8.1.3** | Uygulamanın dokümantasyonunun, kimlik doğrulama ve yetkilendirme ile ilgili güvenlik kararlarının alınmasında kullanılan çevresel ve bağlamsal öznitelikleri (günün saati, kullanıcı konumu, IP adresi veya cihaz gibi) tanımladığı doğrulanmalıdır. | 3 | +| **8.1.4** | Kimlik doğrulama ve yetkilendirme dokümantasyonunun; işlev düzeyinde, veriye özel ve alan düzeyinde yetkilendirmenin yanı sıra çevresel ve bağlamsal faktörlerin karar almada nasıl kullanıldığını tanımladığı doğrulanmalıdır. Bu, değerlendirilen öznitelikleri, risk eşiklerini ve alınan aksiyonları (ör. izin ver, doğrulama iste, reddet, step-up kimlik doğrulama) içermelidir. | 3 | + +## V8.2 Genel Yetkilendirme Tasarımı + +İşlev, veri ve alan düzeyinde ayrıntılı yetkilendirme kontrollerinin uygulanması, tüketicilerin yalnızca kendilerine açıkça verilmiş izinlere sahip kaynaklara erişebilmesini sağlar. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **8.2.1** | Uygulamanın, işlev düzeyindeki erişimin yalnızca açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. | 1 | +| **8.2.2** | Uygulamanın, veriye özel erişimin yalnızca belirli veri öğelerine açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, doğrudan nesne referansı güvenlik açıkları (IDOR) ve bozuk nesne düzeyinde yetkilendirme (BOLA) risklerini azaltır. | 1 | +| **8.2.3** | Uygulamanın, alan (field) düzeyindeki erişimin yalnızca belirli alanlara açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, bozuk nesne özelliği düzeyinde yetkilendirme (BOPLA) risklerini azaltır. | 2 | +| **8.2.4** | Tüketicinin çevresel ve bağlamsal özniteliklerine (ör. günün saati, konum, IP adresi veya cihaz) dayalı uyarlanabilir güvenlik kontrollerinin, uygulama dokümantasyonunda tanımlandığı şekilde, kimlik doğrulama ve yetkilendirme kararları için uygulandığı doğrulanmalıdır. Bu kontroller, tüketici yeni bir oturum başlatmaya çalışırken ve mevcut bir oturum sırasında uygulanmalıdır. | 3 | + +## V8.3 İşlem Düzeyinde Yetkilendirme + +Yetkilendirme değişikliklerinin uygulamanın mimarisindeki uygun katmana anında yansıtılması, özellikle dinamik ortamlarda yetkisiz işlemleri önlemek açısından kritik öneme sahiptir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **8.3.1** | Uygulamanın yetkilendirme kurallarını güvenilir bir servis katmanında uyguladığı ve istemci taraflı JavaScript gibi güvenilmeyen tüketiciler tarafından değiştirilebilecek kontrollerle yetinmediği doğrulanmalıdır. | 1 | +| **8.3.2** | Yetkilendirme kararlarının temelini oluşturan değerlerdeki değişikliklerin hemen uygulandığı doğrulanmalıdır. Değişikliklerin anında uygulanamadığı durumlarda (örneğin self-contained token içindeki verilere güveniliyorsa), tüketici artık yetkili olmadığı hâlde bir işlem gerçekleştirdiğinde uyarı verecek ve değişikliği geri alacak önlemler uygulanmalıdır. Bu alternatifin bilgi sızıntısını önlemeyeceği unutulmamalıdır. | 3 | +| **8.3.3** | Bir nesneye erişimin, herhangi bir aracı veya onun adına hareket eden bir servis yerine yalnızca erişimi başlatan öznenin (ör. tüketici) izinlerine dayandığı doğrulanmalıdır. Örneğin, bir tüketici kimlik doğrulama için bir self-contained token kullanarak bir web servis çağırırsa ve bu servis başka bir servisten veri talep ederse, ikinci servis izin kararlarını verirken birinci servisin makine-makine token'ı yerine tüketicinin token'ını kullanmalıdır. | 3 | + +## V8.4 Diğer Yetkilendirme Hususları + +Yetkilendirme ile ilgili ek hususlar, özellikle yönetici arayüzleri ve çok kiracılı (multi-tenant) ortamlar için, yetkisiz erişimi önlemeye yardımcı olur. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **8.4.1** | Multi-tenant uygulamaların, tüketici işlemlerinin izinli olmadıkları tenant'lar üzerinde asla etkili olmamasını sağlamak için tenant'lar arası kontroller kullandığı doğrulanmalıdır. | 2 | +| **8.4.2** | Yönetici arayüzlerine erişimin, sürekli tüketici kimlik doğrulaması, cihaz güvenlik durumu değerlendirmesi ve bağlamsal risk analizi dahil olmak üzere çok katmanlı güvenlik içerdiği doğrulanmalıdır. Yetkilendirme için yalnızca ağ konumu veya güvenilir uç noktalar yeterli olmamalıdır; ancak bu tür faktörler yetkisiz erişim olasılığını azaltabilir. | 3 | + +## Referanslar + +Daha fazla bilgi için: + +* [OWASP Web Security Testing Guide: Authorization](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/05-Authorization_Testing) +* [OWASP Authorization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html) diff --git a/5.0/tr/0x18-V9-Self-contained-Tokens.md b/5.0/tr/0x18-V9-Self-contained-Tokens.md new file mode 100644 index 0000000000..2754157502 --- /dev/null +++ b/5.0/tr/0x18-V9-Self-contained-Tokens.md @@ -0,0 +1,36 @@ +# V9 Kendi İçinde Taşıyıcı Token (Self-contained Token) + +## Kontrol Amacı + +Kendi içinde taşıyıcı token ya da self-contained token kavramı, ilk olarak 2012 tarihli RFC 6749 OAuth 2.0 standardında belirtilmiştir. Bu kavram, içeriğinde bir hizmetin güvenlik kararlarını almak için kullanacağı veri veya iddiaları (claim) taşıyan bir token'ı ifade eder. Bu, yalnızca bir tanımlayıcı içeren ve hizmetin veriyi yerel olarak aramasına yarayan basit token'lardan ayrıdır. Self-contained token'lara en yaygın örnekler JSON Web Tokens (JWT) ve SAML assertion'lardır. + +Self-contained token kullanımı, OAuth ve OIDC dışında bile oldukça yaygın hale gelmiştir. Aynı zamanda bu mekanizmanın güvenliği, token'ın bütünlüğünün doğrulanabilmesine ve belirli bir bağlam için geçerli olduğunun teyit edilmesine bağlıdır. Bu süreçte birçok güvenlik açığı ortaya çıkabilir ve bu bölüm, uygulamaların alması gereken önlemleri ayrıntılı şekilde açıklamaktadır. + +## V9.1 Token Kaynağı ve Bütünlüğü + +Bu bölüm, token'ın güvenilir bir tarafça üretildiğini ve üzerinde oynama yapılmadığını sağlamak için gereken gereksinimleri içerir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **9.1.1** | Self-contained token'ların içerikleri kabul edilmeden önce, oynama (tampering) saldırılarına karşı dijital imza veya MAC ile doğrulama yapıldığı doğrulanmalıdır. | 1 | +| **9.1.2** | Belirli bir bağlam için yalnızca bir allowlist üzerinde bulunan algoritmaların self-contained token oluşturmak ve doğrulamak için kullanılabildiği doğrulanmalıdır. Bu allowlist, yalnızca simetrik ya da yalnızca asimetrik algoritmaları içermeli ve kesinlikle 'None' algoritmasını içermemelidir. Hem simetrik hem de asimetrik algoritmalar desteklenmek zorundaysa, anahtar karışıklığını (key confusion) önlemek için ek kontroller uygulanmalıdır. | 1 | +| **9.1.3** | Self-contained token'ları doğrulamak için kullanılan anahtar malzemesinin, token issuer için önceden yapılandırılmış güvenilir kaynaklardan alındığı doğrulanmalıdır. Bu, saldırganların güvenilmeyen kaynak ve anahtarları belirtmesini engeller. JWT ve diğer JWS yapılarında 'jku', 'x5u' ve 'jwk' gibi header'lar güvenilir kaynaklardan oluşan bir allowlist'e göre doğrulanmalıdır. | 1 | + +## V9.2 Token İçeriği + +Bir self-contained token içeriğine dayanarak güvenlik kararı alınmadan önce, token'ın geçerlilik süresi içinde sunulup sunulmadığı ve belirli bir hizmet tarafından belirli bir amaç için kullanıma uygun olup olmadığı doğrulanmalıdır. Bu, aynı issuer'dan gelen farklı token türlerinin farklı hizmetler arasında güvensiz şekilde yeniden kullanılmasını önlemeye yardımcı olur. + +OAuth ve OIDC'ye özgü gereksinimler ilgili bölümde yer almaktadır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **9.2.1** | Token verisinde bir geçerlilik zaman aralığı (validity time span) varsa, yalnızca doğrulama zamanı bu zaman aralığı içerisindeyse token ve içeriği kabul edilmelidir. Örneğin, JWT'ler için 'nbf' ve 'exp' claim'leri doğrulanmalıdır. | 1 | +| **9.2.2** | Token'ı alan hizmetin, token içeriğini kabul etmeden önce bu token'ın doğru türde olduğunu ve sunulma amacına uygun olduğunu doğruladığı teyit edilmelidir. Örneğin, yalnızca erişim token'ları yetkilendirme kararları için, yalnızca ID Token'lar kullanıcı kimlik doğrulamasını kanıtlamak için kullanılabilir. | 2 | +| **9.2.3** | Hizmetin yalnızca kendisiyle kullanılması amaçlanan (audience) token'ları kabul ettiği doğrulanmalıdır. JWT'lerde bu, 'aud' claim'inin hizmet içinde tanımlı bir allowlist ile doğrulanması yoluyla sağlanabilir. | 2 | +| **9.2.4** | Eğer bir token issuer, farklı audience'lara token oluşturmak için aynı private key'i kullanıyorsa, oluşturulan token'ların hedef audience'ları benzersiz şekilde tanımlayan bir audience kısıtlaması içerdiği doğrulanmalıdır. Bu, bir token'ın farklı bir audience ile yeniden kullanılmasını önler. Audience tanımlayıcısı dinamik olarak sağlanıyorsa, token issuer bu audience'ları doğrulamalı ve audience taklitlerinin (impersonation) önüne geçmelidir. | 2 | + +## Referanslar + +Daha fazla bilgi için: + +* [OWASP JSON Web Token Cheat Sheet for Java Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_for_Java_Cheat_Sheet.html) (genel olarak yönlendirme için kullanışlı) diff --git a/5.0/tr/0x19-V10-OAuth-and-OIDC.md b/5.0/tr/0x19-V10-OAuth-and-OIDC.md new file mode 100644 index 0000000000..4da598de62 --- /dev/null +++ b/5.0/tr/0x19-V10-OAuth-and-OIDC.md @@ -0,0 +1,169 @@ +# V10 OAuth ve OIDC + +## Kontrol Amacı + +OAuth2 (bu bölümde kısaca OAuth olarak anılacaktır), yetki devri için endüstri standardı bir çerçevedir. Örneğin, OAuth kullanılarak bir istemci uygulama, kullanıcı tarafından yetkilendirildiği sürece, o kullanıcı adına API’lere (sunucu kaynaklarına) erişim sağlayabilir. + +OAuth tek başına kullanıcı kimlik doğrulaması amacıyla tasarlanmamıştır. OpenID Connect (OIDC) çerçevesi, OAuth üzerine bir kullanıcı kimliği katmanı ekleyerek bu eksikliği tamamlar. OIDC, standartlaştırılmış kullanıcı bilgileri, Single Sign-On (SSO) ve oturum yönetimi gibi özellikleri destekler. OIDC, OAuth'un bir uzantısı olduğundan, bu bölümdeki OAuth gereksinimleri aynı zamanda OIDC için de geçerlidir. + +OAuth çerçevesinde aşağıdaki roller tanımlanır: + +* OAuth istemcisi, sunucu kaynaklarına erişim sağlamaya çalışan uygulamadır (örneğin, verilen access token’ı kullanarak bir API çağrısı yapar). Genellikle bu, sunucu taraflı bir uygulamadır. + * Gizli istemci (confidential client), authorization server ile kimlik doğrulama sırasında kullandığı kimlik bilgilerini gizli tutabilecek kapasitede olan istemcidir. + * Genel istemci (public client), authorization server ile kimlik doğrulama sırasında kullandığı kimlik bilgilerini gizli tutamayacak durumdadır. Bu nedenle kendini yalnızca bir client_id ile tanıtır, client_id ve client_secret gibi bilgilerle kimlik doğrulaması yapmaz. +* OAuth kaynak sunucusu (resource server – RS), OAuth istemcilerine kaynakları sunan API’dir. +* OAuth yetkilendirme sunucusu (authorization server – AS), access token üreten sunucu uygulamasıdır. Bu token’lar sayesinde OAuth istemcisi, son kullanıcı adına veya kendi adına RS üzerindeki kaynaklara erişim sağlayabilir. AS genellikle ayrı bir uygulama olsa da, uygun görüldüğünde RS ile entegre olabilir. +* Kaynak sahibi (resource owner – RO), OAuth istemcilerinin kendi adına, kaynak sunucusu üzerinde kısıtlı erişim elde etmesine izin veren son kullanıcıdır. Yetkilendirme sürecine AS üzerinden katılım sağlar. + +OIDC çerçevesinde aşağıdaki roller tanımlanır: + +* Güvenen taraf (relying party – RP), son kullanıcının kimlik doğrulamasını OpenID Provider üzerinden gerçekleştirmek isteyen istemci uygulamadır. Aynı zamanda bir OAuth istemcisidir. +* OpenID Provider (OP), son kullanıcıyı kimlik doğrulama yeteneğine sahip olan ve RP'ye OIDC claim’lerini sağlayan bir OAuth yetkilendirme sunucusudur. OP çoğu zaman bir kimlik sağlayıcı (IdP) olur; ancak federasyon senaryolarında OP ve gerçek kimlik sağlayıcı farklı uygulamalar olabilir. + +OAuth ve OIDC başlangıçta üçüncü taraf uygulamalar için tasarlanmıştı. Ancak günümüzde ilk taraf uygulamalar tarafından da yaygın şekilde kullanılmaktadır. Bu kullanım senaryolarında, özellikle kimlik doğrulama ve oturum yönetimi amacıyla kullanıldığında protokol belirli bir karmaşıklık ekler ve bu durum bazı yeni güvenlik riskleri yaratabilir. + +OAuth ve OIDC birçok farklı uygulama tipiyle kullanılabilir; ancak ASVS ve bu bölümdeki gereksinimler özellikle web uygulamaları ve API’ler için tasarlanmıştır. + +OAuth ve OIDC, web teknolojilerinin üzerine kurulu mantıksal protokoller olduklarından, bu bölümdeki gereksinimler diğer bölümlerden bağımsız değerlendirilemez; genel güvenlik gereksinimleri geçerliliğini korur. + +Bu bölüm, ve üzerindeki spesifikasyonlarla uyumlu şekilde OAuth2 ve OIDC için güncel en iyi uygulamaları ele alır. RFC’ler olgun belgeler olarak görülse de, sık sık güncellenmektedir. Bu nedenle uygulamada, ilgili gereksinimlerin en güncel versiyonlarla uyumlu şekilde ele alınması önemlidir. Ayrıntılar için bölümün referans kısmına bakınız. + +Bu alanın karmaşıklığı göz önünde bulundurulduğunda, güvenli bir OAuth veya OIDC çözümünün, tanınmış ve endüstri standardı yetkilendirme sunucularını kullanması ve önerilen güvenlik yapılandırmalarını uygulaması son derece önemlidir. + +Bu bölümde kullanılan terimler, OAuth ve OIDC spesifikasyonlarındaki tanımlarla uyumludur. Ancak OIDC’ye özel gereksinimler dışında, genellikle OAuth terminolojisi tercih edilmiştir. + +Bu bölümde geçen "token" terimi, aşağıdaki anlamlarda kullanılmıştır: + +* Access token'ları sadece RS tarafından kullanılır. Bunlar ya introspection ile doğrulanan bir reference token olabilir ya da belirli bir anahtar malzemesiyle doğrulanan bir self-contained token olabilir. +* Refresh token'ları, yalnızca onu üreten authorization server tarafından kullanılabilir. +* OIDC ID Token'ları sadece authorization flow’u tetikleyen istemci tarafından kullanılabilir. + +Bu bölümdeki bazı gereksinimlerin risk seviyesi, istemcinin gizli istemci mi yoksa açık istemci mi olduğuna göre değişiklik gösterebilir. Güçlü istemci kimlik doğrulaması, birçok saldırı vektörünü etkisiz hale getirebildiği için, L1 uygulamalarında bazı gereksinimler gizli istemci kullanıldığında esnetilebilir. + +## V10.1 Genel OAuth ve OIDC Güvenliği + +Bu bölüm, OAuth veya OIDC kullanan tüm uygulamalara uygulanabilen genel mimari gereksinimleri kapsar. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **10.1.1** | Token'ların yalnızca kesinlikle ihtiyaç duyan bileşenlere gönderildiği doğrulanmalıdır. Örneğin, tarayıcı tabanlı JavaScript uygulamaları için bir backend-for-frontend modeli kullanıldığında, access ve refresh token'lara yalnızca backend'in erişebilmesi gerekir. | 2 | +| **10.1.2** | Authorization server'dan gelen değerler (örneğin authorization code veya ID Token gibi) yalnızca aynı user agent oturumu ve işlemi tarafından başlatılmış bir yetkilendirme akışının sonucuysa kabul edildiği doğrulanmalıdır. Bu, client tarafından oluşturulan secret’ların 'proof key for code exchange' (PKCE) ‘code_verifier’, ‘state’ veya OIDC ‘nonce’ gibi tahmin edilemez, işleme özgü ve hem client’a hem de işlem başlatılan user agent oturumuna güvenli bir şekilde bağlı olmasını gerektirir. | 2 | + +## V10.2 OAuth İstemcisi + +Bu gereksinimler, OAuth istemci uygulamaları için sorumlulukları detaylandırır. Client örneğin bir web sunucusu backend’i (genellikle Backend For Frontend olarak hareket eden), bir backend servis entegrasyonu veya bir frontend Single Page Application (SPA, yani tarayıcı tabanlı uygulama) olabilir. + +Genel olarak backend istemciler gizli istemci olarak, frontend istemciler ise açık istemci olarak değerlendirilir. Ancak, son kullanıcı cihazında çalışan native uygulamalar, 'OAuth dynamic client registration' kullanıldığında gizli olarak kabul edilebilir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **10.2.1** | Code flow kullanılıyorsa, OAuth client’ın token taleplerini tetikleyen CSRF saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Bu genellikle PKCE kullanılarak veya authorization isteğinde gönderilen ‘state’ parametresinin kontrolü ile sağlanır. | 2 | +| **10.2.2** | OAuth istemcisi birden fazla AS ile etkileşime girebiliyorsa, mix-up saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Örneğin, authorization server’ın 'iss' parametresini döndürmesi zorunlu kılınabilir ve bu parametrenin hem authorization yanıtında hem de token yanıtında doğrulanması gerekir. | 2 | +| **10.2.3** | OAuth istemcisinin authorization server’a yaptığı taleplerde yalnızca gerekli scope’ları (veya diğer yetkilendirme parametrelerini) talep ettiği doğrulanmalıdır. | 3 | + +## V10.3 OAuth Kaynak Sunucusu (RS) + +ASVS ve bu bölüm bağlamında resource server (RS) bir API’dir. Güvenli erişim sağlamak için RS şunları yapmalıdır: + +* Access token’ı, token formatı ve ilgili protokol spesifikasyonlarına göre doğrulamalıdır; örneğin JWT doğrulaması veya OAuth token introspection. +* Geçerliyse, access token’dan alınan bilgiler ve verilmiş izinlere göre yetkilendirme kararları uygulamalıdır. Örneğin, resource server’ın client’ın (RO adına hareket eden) istenen kaynağa erişme yetkisine sahip olduğunu doğrulaması gerekir. + +Bu nedenle burada listelenen gereksinimler, OAuth veya OIDC’ye özeldir ve token doğrulaması yapıldıktan sonra, token içeriğine dayalı yetkilendirme gerçekleştirilmeden önce uygulanmalıdır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **10.3.1** | RS'nin yalnızca bu servisle kullanılmak üzere tasarlanmış access token’ları kabul ettiği doğrulanmalıdır (audience kontrolü). Audience bilgisi yapılandırılmış token’larda (örneğin JWT içindeki ‘aud’ claim’i) yer alabilir veya token introspection endpoint aracılığıyla kontrol edilebilir. | 2 | +| **10.3.2** | RS'nin, access token’dan gelen claim’lere dayanarak yetki devri tanımına uygun şekilde yetkilendirme kararları uyguladığı doğrulanmalıdır. ‘sub’, ‘scope’ ve ‘authorization_details’ gibi claim’ler varsa, bu kararın parçası olmalıdır. | 2 | +| **10.3.3** | Erişim kontrolü kararında, access token’dan (JWT veya ilgili token introspection yanıtı) benzersiz bir kullanıcının tanımlanması gerekiyorsa, RS'nin başka kullanıcılara devredilemeyecek claim’ler ile kullanıcıyı tanımladığı doğrulanmalıdır. Genellikle bu, ‘iss’ ve ‘sub’ claim’lerinin birlikte kullanılması anlamına gelir. | 2 | +| **10.3.4** | RS'nin belirli bir kimlik doğrulama gücü, yöntemi veya güncelliği (recentness) gerektirmesi durumunda, sunulan access token’ın bu kısıtlamaları karşıladığını doğruladığı, örneğin, OIDC ‘acr’, ‘amr’ ve ‘auth_time’ claim’leri kullanılarak doğrulanmalıdır. | 2 | +| **10.3.5** | RS'nin, (yetkisiz taraflarca) çalınmış veya tekrar edilen access token’ların kullanımını önlemek için sender-constrained access token’lar kullandığı doğrulanmalıdır. Bu, OAuth 2 için Mutual TLS veya OAuth 2 Demonstration of Proof of Possession (DPoP) ile sağlanabilir. | 3 | + +## V10.4 OAuth Yetkilendirme Sunucusu (AS) + +Bu gereksinimler, OAuth authorization server'ların (yetkilendirme sunucuları) ve OpenID Provider'ların sorumluluklarını detaylandırır. + +İstemci kimlik doğrulaması için 'self_signed_tls_client_auth' yöntemi, [RFC 8705](https://datatracker.ietf.org/doc/html/rfc8705) [böüm 2.2'de](https://datatracker.ietf.org/doc/html/rfc8705#name-self-signed-certificate-mut) belirtilen ön koşullarla birlikte kullanılabilir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **10.4.1** | AS'nin, istemciye özel önceden kaydedilmiş URI’lerden oluşan bir allowlist kullanarak redirect URI’leri tam dize karşılaştırması ile doğruladığı doğrulanmalıdır. | 1 | +| **10.4.2** | AS'nin, "authorization response" içinde "authorization code" döndürdüğü durumlarda, bu kodun yalnızca bir kez kullanılabildiği doğrulanmalıdır. Daha önce access token vermek için kullanılmış bir authorization code ile yapılan ikinci geçerli token isteği reddedilmeli ve ilgili tüm token’lar iptal edilmelidir. | 1 | +| **10.4.3** | Authorization code’un kısa ömürlü olduğu doğrulanmalıdır. L1 ve L2 uygulamalar için maksimum yaşam süresi 10 dakika, L3 uygulamalar için 1 dakikadır. | 1 | +| **10.4.4** | Belirli bir istemci için AS'nin yalnızca o istemcinin ihtiyaç duyduğu grant türlerine izin verdiği doğrulanmalıdır. "Token" (Implicit flow) ve "password" (Resource Owner Password Credentials flow) grant türlerinin artık kullanılmaması gerekir. | 1 | +| **10.4.5** | AS'nin, açık istemciler için refresh token replay saldırılarını azalttığı doğrulanmalıdır. Tercihen sender-constrained refresh token’lar (DPoP veya mutual TLS ile certificate-bound access token’lar) kullanılmalıdır. L1 ve L2 uygulamalar için refresh token rotation kullanılabilir. Rotation kullanılıyorsa, AS refresh token’ı kullanım sonrası geçersiz kılmalı ve geçersiz bir refresh token sunulması durumunda o yetkilendirme ile ilişkili tüm refresh token’ları iptal etmelidir. | 1 | +| **10.4.6** | Code grant kullanılıyorsa, AS'nin authorization code interception saldırılarına karşı koruma sağladığı doğrulanmalıdır. Yetkilendirme isteğinde geçerli bir "code_challenge" değeri zorunlu olmalı ve "code_challenge_method" olarak "plain" kabul edilmemelidir. Token isteğinde ise "code_verifier" parametresi doğrulanmalıdır. | 2 | +| **10.4.7** | AS'nin, kimlik doğrulaması yapılmamış dinamik istemci kaydını desteklemesi durumunda, kötü niyetli istemci uygulamalarına karşı riskleri azalttığı doğrulanmalıdır. Kayıtlı URI’ler gibi client metadata’sı doğrulanmalı, kullanıcı onayı alınmalı ve güvenilmeyen bir client uygulamasıyla yapılan yetkilendirme isteği işlenmeden önce kullanıcı uyarılmalıdır. | 2 | +| **10.4.8** | Refresh token’ların, sliding expiration kullanılsa bile mutlak bir sona erme süresine sahip olduğu doğrulanmalıdır. | 2 | +| **10.4.9** | Yetkili bir kullanıcı tarafından AS kullanıcı arayüzü üzerinden refresh token’ların ve reference access token’ların iptal edilebildiği doğrulanmalıdır. | 2 | +| **10.4.10** | Gizli istemcilerin token istekleri, pushed authorization request (PAR) ve token iptal istekleri gibi server’a yapılan backchannel isteklerinde kimliğinin kontrol edildiği doğrulanmalıdır. | 2 | +| **10.4.11** | AS yapılandırmasının, OAuth istemcisine yalnızca gerekli scope’ları atadığı doğrulanmalıdır. | 2 | +| **10.4.12** | Belirli bir client için, authorization server’ın yalnızca client’ın ihtiyaç duyduğu 'response_mode' değerine izin verdiği doğrulanmalıdır. Örneğin, bu değer ya beklenenlerle karşılaştırılarak doğrulanmalı ya da PAR veya JAR kullanılmalıdır. | 3 | +| **10.4.13** | "Code" grant türünün daima pushed authorization request (PAR) ile birlikte kullanıldığı doğrulanmalıdır. | 3 | +| **10.4.14** | AS'nin yalnızca sender-constrained (Proof-of-Possession) access token’lar ürettiği doğrulanmalıdır. Bu, mutual TLS ile certificate-bound access token ya da DPoP ile DPoP-bound access token olabilir. | 3 | +| **10.4.15** | Sunucu taraflı istemciler için (kullanıcı cihazında çalışmayan), AS'nin "authorization_details" parametresinin istemci backend'i tarafından sağlandığını ve kullanıcı tarafından değiştirilmediğini doğruladığı, örneğin pushed authorization request (PAR) or JWT-secured Authorization Request (JAR) zorunlu kılınarak doğrulanmalıdır. | 3 | +| **10.4.16** | Bir istemci gizli ise, AS'nin güçlü istemci kimlik doğrulama yöntemlerini zorunlu kıldığı doğrulanmalıdır. Bu yöntemler, public-key cryptography’ye dayalı ve replay saldırılarına karşı dayanıklı olmalı, örneğin mutual TLS ("tls_client_auth", "self_signed_tls_client_auth") veya private key JWT ("private_key_jwt") gibi. | 3 | + +## V10.5 OIDC İstemcisi + +"OIDC relying party", bir OAuth istemcisi olarak davrandığı için "OAuth İstemcisi" bölümündeki gereksinimler burada da geçerlidir. + +“Kimlik Doğrulama” başlığındaki “Kimlik Sağlayıcısı ile Kimlik Doğrulama” bölümü de ilgili genel gereksinimleri içerir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **10.5.1** | İstemcinin (relying party olarak) ID Token replay saldırılarını azalttığı doğrulanmalıdır. Örneğin, ID Token’daki 'nonce' claim’inin, OpenID Provider’a gönderilen kimlik doğrulama isteğindeki 'nonce' değeriyle eşleştiği doğrulanmalıdır. | 2 | +| **10.5.2** | İstemcinin kullanıcıyı ID Token claim’lerinden (genellikle, başka kullanıcılarla yeniden atanamayan 'sub' claim’i) benzersiz şekilde tanımladığı doğrulanmalıdır. | 2 | +| **10.5.3** | İstemcinin, kötü niyetli bir AS'nin başka bir AS'yi taklit etmesini AS metadata’sı üzerinden reddettiği doğrulanmalıdır. AS metadata’sındaki issuer URL’si, istemci tarafından beklenen önceden yapılandırılmış issuer URL’siyle tam olarak eşleşmiyorsa, metadata reddedilmelidir. | 2 | +| **10.5.4** | İstemcinin, ID Token’ın kendisi için (audience) kullanılması amaçlandığını doğruladığı doğrulanmalıdır. Bu, token’daki 'aud' claim’inin istemcinin 'client_id' değeriyle eşit olup olmadığının kontrol edilmesiyle yapılır. | 2 | +| **10.5.5** | OIDC back-channel logout kullanıldığında, relying party’nin "forced logout" ve "logout" akışında "cross-JWT confusion" gibi saldırılara karşı koruma sağladığı doğrulanmalıdır. Client, logout token’ın 'logout+jwt' türünde olduğunu, 'event' claim’inin doğru üyeye sahip olduğunu ve 'nonce' claim’i içermediğini doğrulamalıdır. Ayrıca token için kısa bir sona erme süresi (örneğin 2 dakika) önerilir. | 2 | + +## V10.6 OpenID Provider + +OpenID Provider’lar, OAuth AS olarak davrandığı için “OAuth Yetkilendirme Sunucusu” bölümündeki gereksinimler burada da geçerlidir. + +ID Token flow (code flow değil) kullanılıyorsa, access token üretilmez ve OAuth AS için geçerli olan birçok gereksinim uygulanamaz. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **10.6.1** | OpenID Provider’ın yalnızca 'code', 'ciba', 'id_token' veya 'id_token code' response mode değerlerine izin verdiği doğrulanmalıdır. 'code' değeri, 'id_token code' (OIDC Hybrid flow) yerine tercih edilmelidir. 'token' (Implicit flow) kullanılmamalıdır. | 2 | +| **10.6.2** | OpenID Provider’ın forced logout yoluyla yapılan hizmet reddi saldırılarını önlediği doğrulanmalıdır. Bu, son kullanıcıdan açık onay alınarak veya varsa logout isteğinde (relying party tarafından başlatılan) bulunan parametrelerin, örneğin 'id_token_hint', doğrulanmasıyla yapılabilir. | 2 | + +## V10.7 Onay (Consent) Yönetimi + +Bu gereksinimler, kullanıcı onayının AS tarafından doğrulanmasını kapsar. Uygun kullanıcı onayı olmadan, kötü niyetli bir aktör spoofing veya sosyal mühendislik yoluyla kullanıcının adına yetki elde edebilir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **10.7.1** | AS'nin her yetkilendirme isteği için kullanıcının onayını aldığı doğrulanmalıdır. İstemcinin kimliği garanti altına alınamıyorsa, AS daima kullanıcıdan açıkça onay istemelidir. | 2 | +| **10.7.2** | AS'nin kullanıcıdan onay istediğinde, neye onay verildiğini açık ve yeterli şekilde gösterdiği doğrulanmalıdır. Uygun olduğunda bu bilgiler, istenen yetkilendirmelerin doğasını (genellikle scope, resource server, RAR gibi detaylara dayalı), yetkilendirilmiş uygulamanın kimliğini ve bu yetkilendirmelerin süresini içermelidir. | 2 | +| **10.7.3** | Kullanıcının, AS üzerinden verdiği onayları görüntüleyebildiği, değiştirebildiği ve iptal edebildiği doğrulanmalıdır. | 2 | + +## Referanslar + +OAuth ile ilgili daha fazla bilgi için: + +* [oauth.net](https://oauth.net/) +* [OWASP OAuth 2.0 Protocol Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/OAuth2_Cheat_Sheet.html) + +ASVS içindeki OAuth ile ilgili gereksinimler için, yayımlanmış ve taslak durumundaki aşağıdaki RFC'ler kullanılmaktadır: + +* [RFC6749 The OAuth 2.0 Authorization Framework](https://datatracker.ietf.org/doc/html/rfc6749) +* [RFC6750 The OAuth 2.0 Authorization Framework: Bearer Token Usage](https://datatracker.ietf.org/doc/html/rfc6750) +* [RFC6819 OAuth 2.0 Threat Model and Security Considerations](https://datatracker.ietf.org/doc/html/rfc6819) +* [RFC7636 Proof Key for Code Exchange by OAuth Public Clients](https://datatracker.ietf.org/doc/html/rfc7636) +* [RFC7591 OAuth 2.0 Dynamic Client Registration Protocol](https://datatracker.ietf.org/doc/html/rfc7591) +* [RFC8628 OAuth 2.0 Device Authorization Grant](https://datatracker.ietf.org/doc/html/rfc8628) +* [RFC8707 Resource Indicators for OAuth 2.0](https://datatracker.ietf.org/doc/html/rfc8707) +* [RFC9068 JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens](https://datatracker.ietf.org/doc/html/rfc9068) +* [RFC9126 OAuth 2.0 Pushed Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9126) +* [RFC9207 OAuth 2.0 Authorization Server Issuer Identification](https://datatracker.ietf.org/doc/html/rfc9207) +* [RFC9396 OAuth 2.0 Rich Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9396) +* [RFC9449 OAuth 2.0 Demonstrating Proof of Possession (DPoP)](https://datatracker.ietf.org/doc/html/rfc9449) +* [RFC9700 Best Current Practice for OAuth 2.0 Security](https://datatracker.ietf.org/doc/html/rfc9700) +* [draft OAuth 2.0 for Browser-Based Applications](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-browser-based-apps) +* [draft The OAuth 2.1 Authorization Framework](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-12) + +OpenID Connect ile ilgili daha fazla bilgi için: + +* [OpenID Connect Core 1.0](https://openid.net/specs/openid-connect-core-1_0.html) +* [FAPI 2.0 Security Profile](https://openid.net/specs/fapi-security-profile-2_0-final.html) diff --git a/5.0/tr/0x20-V11-Cryptography.md b/5.0/tr/0x20-V11-Cryptography.md new file mode 100644 index 0000000000..df3e8138fa --- /dev/null +++ b/5.0/tr/0x20-V11-Cryptography.md @@ -0,0 +1,107 @@ +# V11 Kriptografi + +## Kontrol Amacı + +Bu bölümün amacı, kriptografinin genel kullanımı için en iyi uygulamaları tanımlamak, kriptografik ilkelere dair temel bir anlayış kazandırmak ve daha dayanıklı ve modern yaklaşımlara yönelimi teşvik etmektir. Bu doğrultuda aşağıdakileri teşvik eder: + +* Güvenli şekilde hata veren, gelişen tehditlere uyum sağlayan ve geleceğe yönelik sağlam kriptografik sistemlerin uygulanması, +* Hem güvenli hem de sektörün en iyi uygulamalarıyla uyumlu kriptografik mekanizmaların kullanılması, +* Uygun erişim kontrolleri ve denetimle birlikte güvenli bir kriptografik anahtar yönetim sisteminin sürdürülmesi, +* Kriptografik ortamın düzenli olarak değerlendirilerek yeni risklerin analiz edilmesi ve algoritmaların buna göre uyarlanması, +* Uygulamanın yaşam döngüsü boyunca tüm kriptografik varlıkların keşfedildiğinden ve güvence altına alındığından emin olmak için kriptografi kullanım alanlarının belirlenmesi ve yönetilmesi. + +Genel ilkeleri ve en iyi uygulamaları özetlemenin yanı sıra, bu belge Ek C - Kriptografi Standartları bölümünde gereksinimlerle ilgili daha teknik bilgiler de sunar. Bu bölüm, "onaylı" kabul edilen algoritmaları ve modları içerir. + +Kriptografinin sır yönetimi ya da iletişim güvenliği gibi başka bir sorunu çözmek için kullanıldığı gereksinimler, bu standardın başka bölümlerinde yer almaktadır. + +## V11.1 Kriptografik Envanter ve Dokümantasyon + +Veri varlıklarını sınıflandırmalarına uygun şekilde korumak için uygulamaların güçlü bir kriptografik mimari ile tasarlanması gerekir. Her şeyi şifrelemek kaynak israfına, hiçbir şeyi şifrelememek ise hukuki ihlallere yol açar. Genellikle mimari tasarım, tasarım sprintleri veya mimari zirveler sırasında bir denge kurulmalıdır. Kriptografiyi "doğaçlama" yapmak veya sonradan eklemek, güvenli biçimde uygulamak için her zaman daha maliyetli olacaktır. + +Tüm kriptografik varlıkların düzenli olarak keşfedildiğinden, envantere alındığından ve değerlendirildiğinden emin olunması önemlidir. Bunun nasıl yapılacağı hakkında daha fazla bilgi için ekteki bölüme bakınız. + +Kriptografik sistemlerin kuantum bilgisayarların olası yükselişine karşı geleceğe yönelik olarak dayanıklı hale getirilmesi de kritik önemdedir. Post-Kuantum Kriptografi (PQC), kuantum bilgisayar saldırılarına karşı güvenli kalacak şekilde tasarlanmış kriptografik algoritmaları ifade eder; bu tür bilgisayarların, RSA ve eliptik eğri kriptografisi (ECC) gibi yaygın algoritmaları kırması beklenmektedir. + +Onaylı PQC ilkelikleri ve standartlarıyla ilgili güncel bilgiler için ekteki bölüme bakınız. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **11.1.1** | Kriptografik anahtarların yönetimi için belgelenmiş bir politika ve NIST SP 800-57 gibi bir anahtar yönetim standardını izleyen bir kriptografik anahtar yaşam döngüsü tanımlandığı doğrulanmalıdır. Bu, anahtarların aşırı miktarda paylaşılmadığını (örneğin, paylaşılan sırlar için ikiden fazla tarafla veya özel anahtarlar için birden fazla tarafla) garanti altına almalıdır. | 2 | +| **11.1.2** | Tüm kriptografik anahtarlar, algoritmalar ve uygulama tarafından kullanılan sertifikaları içeren bir kriptografik envanterin oluşturulduğu, sürdürüldüğü ve düzenli olarak güncellendiği doğrulanmalıdır. Bu envanter ayrıca, sistemde anahtarların nerede kullanılabileceğini ve kullanılamayacağını, ve hangi veri türlerinin bu anahtarlarla korunup korunamayacağını da belgelemelidir. | 2 | +| **11.1.3** | Sistem içerisinde şifreleme, özetleme ve imzalama işlemleri dahil olmak üzere kriptografi kullanımının tüm örneklerini tespit etmek için kriptografik keşif mekanizmalarının kullanıldığı doğrulanmalıdır. | 3 | +| **11.1.4** | Kriptografik bir envanterin sürdürüldüğü doğrulanmalıdır. Bu envanter, gelecekteki tehditlere karşı tepki verebilmek amacıyla post-kuantum kriptografiye geçiş yolunu belirten belgelenmiş bir plan içermelidir. | 3 | + +## V11.2 Güvenli Kriptografi Uygulaması + +Bu bölüm, bir uygulama için temel kriptografik algoritmaların seçimi, uygulanması ve sürekli yönetimine yönelik gereksinimleri tanımlar. Amaç, yalnızca sağlam, sektör tarafından kabul görmüş kriptografik ilkeliklerin, güncel standartlara (örneğin NIST, ISO/IEC) ve en iyi uygulamalara uygun biçimde kullanılmasını sağlamaktır. Kuruluşlar, her kriptografik bileşenin peer-review uygulanmış kanıtlar ve pratik güvenlik testlerine dayalı olarak seçildiğinden emin olmalıdır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **11.2.1** | Kriptografik işlemler için sektör tarafından doğrulanmış uygulamaların (kütüphaneler ve donanım hızlandırmalı uygulamalar dahil) kullanıldığı doğrulanmalıdır. | 2 | +| **11.2.2** | Uygulamanın, rastgele sayı üreticileri, kimliği doğrulanmış şifreleme, MAC veya özetleme algoritmaları, anahtar uzunlukları, turlar, şifreler ve modların herhangi bir zamanda yeniden yapılandırılabilir, yükseltilebilir veya değiştirilebilir olacağı şekilde kripto çevikliği (crypto agility) ile tasarlandığı doğrulanmalıdır. Aynı şekilde, anahtarların ve parolaların değiştirilebilmesi ve verilerin yeniden şifrelenebilmesi mümkün olmalıdır. Bu, onaylanmış PQC şemalarının yüksek güvenlikli uygulamaları yaygın olarak kullanılabilir hale geldiğinde sorunsuz geçişe olanak tanır. | 2 | +| **11.2.3** | Tüm kriptografik ilkeliklerin, algoritma, anahtar boyutu ve yapılandırmaya göre minimum 128 bit güvenlik sağladığı doğrulanmalıdır. Örneğin, 256-bit ECC anahtarı yaklaşık 128 bit güvenlik sağlarken, RSA için aynı güvenliği elde etmek 3072-bit anahtar gerektirir. | 2 | +| **11.2.4** | Tüm kriptografik işlemlerin sabit süreli (constant-time) olduğu, karşılaştırmalarda, hesaplamalarda veya geri dönüşlerde kısa devre (short-circuit) işlemleri yapılmadığı doğrulanmalıdır; bu, bilgi sızıntısını önlemek için gereklidir. | 3 | +| **11.2.5** | Tüm kriptografik modüllerin güvenli şekilde hata verdiği ve hataların, padding oracle saldırıları gibi zafiyetleri mümkün kılmayacak şekilde ele alındığı doğrulanmalıdır. | 3 | + +## V11.3 Şifreleme Algoritmaları + +AES ve CHACHA20 üzerine kurulu kimliği doğrulanmış şifreleme algoritmaları, modern kriptografik uygulamaların temelini oluşturur. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **11.3.1** | Güvensiz blok modlarının (örneğin, ECB) ve zayıf doldurma (padding) şemalarının (örneğin, PKCS#1 v1.5) kullanılmadığı doğrulanmalıdır. | 1 | +| **11.3.2** | Yalnızca AES ile GCM gibi onaylı şifreleme algoritmalarının ve modlarının kullanıldığı doğrulanmalıdır. | 1 | +| **11.3.3** | Şifrelenmiş verilerin yetkisiz değişikliklere karşı korunduğu doğrulanmalıdır. Tercihen bu koruma, onaylı bir kimliği doğrulanmış şifreleme yöntemi kullanılarak ya da onaylı bir şifreleme yöntemi ile onaylı bir MAC algoritmasının kombinasyonu ile sağlanmalıdır. | 2 | +| **11.3.4** | Sayılar, başlatma vektörleri (IV) ve diğer tek kullanımlık değerlerin, aynı şifreleme anahtarı ve veri öğesi çifti için birden fazla kez kullanılmadığı doğrulanmalıdır. Oluşturma yöntemi kullanılan algoritmaya uygun olmalıdır. | 3 | +| **11.3.5** | Şifreleme algoritması ve MAC algoritması kombinasyonlarının "encrypt-then-MAC" modunda çalıştığı doğrulanmalıdır. | 3 | + +## V11.4 Hashing ve Hash Tabanlı Fonksiyonlar + +Kriptografik hash'ler, dijital imzalar, HMAC, anahtar türetme fonksiyonları (KDF), rastgele bit üretimi ve parola saklama gibi çok çeşitli kriptografik protokollerde kullanılır. Kriptografik sistemin güvenliği, kullanılan hash fonksiyonlarının güvenliği ile doğrudan ilişkilidir. Bu bölüm, kriptografik işlemlerde güvenli hash fonksiyonlarının kullanımına dair gereksinimleri özetler. + +Parola saklama ve kriptografi ile ilgili ek için [OWASP Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#password-hashing-algorithms) belgesi de fayda ve rehberlik sağlar. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **11.4.1** | Dijital imzalar, HMAC, KDF ve rastgele bit üretimi gibi genel kriptografik kullanım senaryolarında yalnızca onaylı hash fonksiyonlarının kullanıldığı doğrulanmalıdır. MD5 gibi yasaklı hash fonksiyonları hiçbir kriptografik amaçla kullanılmamalıdır. | 1 | +| **11.4.2** | Parolaların, onaylı, hesaplama açısından yoğun ve mevcut rehberliğe göre yapılandırılmış bir anahtar türetme fonksiyonu (diğer adıyla parola hash'leme fonksiyonu) kullanılarak saklandığı doğrulanmalıdır. Ayarlar, güvenlik ve performans dengesini sağlayarak kaba kuvvet saldırılarını zorlaştırmalıdır. | 2 | +| **11.4.3** | Dijital imzalarda kullanılan hash fonksiyonlarının, veri bütünlüğü ve kimlik doğrulama amacıyla kullanıldığında çakışmaya karşı dayanıklı ve yeterli bit uzunluğuna sahip olduğu doğrulanmalıdır. Çakışma dayanıklılığı gerekiyorsa çıktı uzunluğu en az 256 bit olmalıdır. Sadece ikinci ön-görüntü (2nd pre-iamge) saldırılarına karşı dayanıklılık gerekiyorsa çıktı uzunluğu en az 128 bit olmalıdır. | 2 | +| **11.4.4** | Parolalardan gizli anahtarlar türetilirken, onaylı anahtar türetme fonksiyonlarının anahtar uzatma (key stretching) parametreleriyle birlikte kullanıldığı doğrulanmalıdır. Bu parametreler, kaba kuvvet saldırılarını önleyecek şekilde güvenlik ve performans dengesine sahip olmalıdır. | 2 | + +## V11.5 Rastgele Değerler + +Kriptografik olarak güvenli sözde rastgele sayı üretimini (Cryptographically secure Pseudo-random Number Generation - CSPRNG), doğru şekilde uygulamak son derece zordur. Genellikle, bir sistemdeki iyi entropi kaynakları aşırı kullanıldığında hızla tükenir. Düşük rastgelelik seviyesine sahip kaynaklar ise tahmin edilebilir anahtarlara ve sırların ortaya çıkmasına yol açabilir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **11.5.1** | Tahmin edilemez olması amaçlanan tüm rastgele sayıların ve dizelerin, CSPRNG ile oluşturulduğu ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. UUID'lerin bu koşulu dikkate almadığını unutmayın. | 2 | +| **11.5.2** | Kullanılan rastgele sayı üretim mekanizmasının, yoğun talep altında dahi güvenli çalışacak şekilde tasarlandığı doğrulanmalıdır. | 3 | + +## V11.6 Açık Anahtar (Public Key) Kriptografisi + +Birden fazla taraf arasında ortak bir sır paylaşımının mümkün olmadığı ya da arzu edilmediği durumlarda açık anahtar kriptografisi kullanılır. + +Bu bağlamda, modern tehditlere karşı sistemin güvenliğini sağlamak için Diffie-Hellman ve Eliptik Eğri Diffie-Hellman (ECDH) gibi onaylı anahtar değişim mekanizmalarına ihtiyaç vardır. “Güvenli İletişim” bölümü, TLS için gereksinimleri sağlar; bu bölümdeki gereksinimler ise TLS dışındaki açık anahtar kriptografisi kullanım durumlarına yöneliktir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **11.6.1** | Anahtar üretimi, tohumlama (seeding) ve dijital imza üretimi ve doğrulama için yalnızca onaylı kriptografik algoritmalar ve çalışma modlarının kullanıldığı doğrulanmalıdır. Anahtar üretim algoritmaları, bilinen saldırılara karşı savunmasız anahtarlar üretmemelidir. Örneğin, Fermat çarpanlama yöntemine karşı savunmasız RSA anahtarları oluşturulmamalıdır. | 2 | +| **11.6.2** | Anahtar değişimi için yalnızca onaylı kriptografik algoritmaların kullanıldığı doğrulanmalıdır (örneğin Diffie-Hellman). Kullanılan parametrelerin güvenli olması gerektiğine dikkat edilmelidir. Bu, anahtar kurulum sürecine yönelik saldırıları önleyecek ve araya girme (adversary-in-the-middle) ya da kriptografik kırılmaları engelleyecektir. | 3 | + +## V11.7 Kullanım Halindeki Verilerin Kriptografisi + +Veri işlenirken korunması çok önemlidir. Tam bellek şifreleme, veri iletiminde şifreleme ve verilerin kullanımdan hemen sonra mümkün olan en kısa sürede şifrelenmesi gibi teknikler önerilir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **11.7.1** | Hassas verilerin kullanım sırasında korunmasını sağlamak amacıyla, yetkisiz kullanıcıların veya süreçlerin bu verilere erişmesini engelleyen tam bellek şifrelemesinin kullanıldığı doğrulanmalıdır. | 3 | +| **11.7.2** | Veri asgariyetinin sağlandığı, yani işleme sırasında mümkün olan en az miktarda verinin ortaya çıktığı ve verilerin kullanımdan hemen sonra veya mümkün olan en kısa sürede şifrelendiği doğrulanmalıdır. | 3 | + +## Referanslar + +Daha fazla bilgi için: + +* [OWASP Web Security Testing Guide: Testing for Weak Cryptography](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography) +* [OWASP Cryptographic Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html) +* [FIPS 140-3](https://csrc.nist.gov/pubs/fips/140-3/final) +* [NIST SP 800-57](https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final) diff --git a/5.0/tr/0x21-V12-Secure-Communication.md b/5.0/tr/0x21-V12-Secure-Communication.md new file mode 100644 index 0000000000..859efc45ce --- /dev/null +++ b/5.0/tr/0x21-V12-Secure-Communication.md @@ -0,0 +1,57 @@ +# V12 Güvenli İletişim + +## Kontrol Amacı + +Bu bölüm, hem bir son kullanıcı istemcisi ile backend hizmeti arasında hem de iç sistemler ile backend hizmetleri arasındaki veri iletimini korumak için uygulanması gereken özel mekanizmalara ilişkin gereksinimleri içerir. + +Bu bölümde öne çıkan genel kavramlar şunlardır: + +* İletişimlerin dış sistemlerle şifreli, ideal olarak iç sistemlerde de şifreli olması. +* Şifreleme mekanizmalarının, tercih edilen algoritmalar ve şifreler dahil olmak üzere en güncel rehberliklere göre yapılandırılması. +* Yetkisiz taraflarca iletişimin engellenmediğinden emin olmak amacıyla imzalı sertifikaların kullanılması. + +Genel ilkelere ve en iyi uygulamalara ek olarak, ASVS ayrıca Ek C - Kriptografi Standartları bölümünde kriptografik güç hakkında daha derin teknik bilgiler sunar. + +## V12.1 Genel TLS Güvenlik Rehberi + +Bu bölüm, TLS iletişimini güvenli hale getirmek için başlangıç seviyesinde rehberlik sağlar. TLS yapılandırmasının güncel araçlarla düzenli olarak gözden geçirilmesi gerekir. + +Wildcard TLS sertifikalarının kullanımı doğası gereği güvensiz değildir, ancak aynı sertifikanın üretim, hazırlık (staging), geliştirme ve test gibi tüm ortamlarda kullanılması halinde sertifika güvenliğinin tehlikeye girmesi, bu ortamlarda çalışan uygulamaların da güvenlik postürünü olumsuz etkileyebilir. Mümkünse her ortam için ayrı TLS sertifikalarının kullanılması, bu sertifikaların güvenli bir şekilde yönetilmesi ve korunması gereklidir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **12.1.1** | Yalnızca TLS protokolünün en güncel ve önerilen sürümlerinin (örneğin TLS 1.2 ve TLS 1.3) etkinleştirildiği ve en son sürümün varsayılan olarak tercih edildiği doğrulanmalıdır. | 1 | +| **12.1.2** | Yalnızca önerilen şifre takımlarının (cipher suite) etkinleştirildiği ve en güçlü şifre takımlarının tercih edildiği doğrulanmalıdır. Seviye 3 (L3) uygulamalar yalnızca ileri gizlilik (forward secrecy) sağlayan şifre takımlarını desteklemelidir. | 2 | +| **12.1.3** | Uygulamanın, mTLS istemci sertifikalarını kimlik doğrulama veya yetkilendirme amacıyla kullanmadan önce bu sertifikaların güvendiği sertifikalar arasında olduğunu doğruladığı kontrol edilmelidir. | 2 | +| **12.1.4** | Online Certificate Status Protocol (OCSP) Stapling gibi geçerli bir sertifika iptal kontrolü yönteminin etkinleştirildiği ve yapılandırıldığı doğrulanmalıdır. | 3 | +| **12.1.5** | TLS el sıkışma (handshake) sürecinde Server Name Indication (SNI) gibi hassas meta verilerin ifşa edilmesini önlemek için, uygulamanın TLS yapılandırmasında Encrypted Client Hello (ECH) özelliğinin etkinleştirildiği doğrulanmalıdır. | 3 | + +## V12.2 Dışa Açık Hizmetlerle HTTPS İletişimi + +Uygulamanın dışa açtığı tüm HTTP trafiğinin şifreli olarak iletildiğinden ve bu iletişimlerde herkese açık olarak güvenilen sertifikaların kullanıldığından emin olunmalıdır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **12.2.1** | İstemci ile dışa açık, HTTP tabanlı hizmetler arasındaki tüm bağlantılarda TLS kullanıldığı ve bu bağlantıların güvensiz ya da şifrelenmemiş iletişime geri dönmediği doğrulanmalıdır. | 1 | +| **12.2.2** | Dışa açık hizmetlerin herkese açık olarak güvenilen TLS sertifikaları kullandığı doğrulanmalıdır. | 1 | + +## V12.3 Genel Servisler Arası İletişim Güvenliği + +Sunucu iletişimleri (hem iç hem dış) sadece HTTP ile sınırlı değildir. Diğer sistemlerle olan bağlantıların da güvenli olması gerekir ve ideal olarak TLS kullanılmalıdır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **12.3.1** | Uygulamaya gelen ve uygulamadan çıkan tüm bağlantılarda izleme sistemleri, yönetim araçları, uzaktan erişim ve SSH, ara yazılımlar, veritabanları, ana sistemler (mainframe), iş ortağı sistemleri ya da dış API'ler dahil olmak üzere TLS gibi şifreli bir protokolün kullanıldığı ve güvensiz ya da şifrelenmemiş protokollere geri dönülmediği doğrulanmalıdır. | 2 | +| **12.3.2** | TLS istemcilerinin bir TLS sunucusu ile iletişime geçmeden önce alınan sertifikaları doğruladığı kontrol edilmelidir. | 2 | +| **12.3.3** | Uygulama içindeki HTTP tabanlı iç hizmetler arasında gerçekleşen tüm bağlantılarda TLS ya da uygun başka bir aktarım şifreleme mekanizmasının kullanıldığı ve güvensiz ya da şifrelenmemiş iletişime geri dönülmediği doğrulanmalıdır. | 2 | +| **12.3.4** | İç hizmetler arasındaki TLS bağlantılarında güvenilir sertifikaların kullanıldığı doğrulanmalıdır. İç sistemlerde oluşturulmuş ya da kendinden imzalı (self-signed) sertifikalar kullanılıyorsa, bu sertifikalara güvenen hizmetlerin yalnızca belirli dahili sertifika otoritelerine (CA) ve belirli kendinden imzalı sertifikalara güvenecek şekilde yapılandırıldıkları doğrulanmalıdır. | 2 | +| **12.3.5** | Sistem içindeki hizmetlerin birbiriyle iletişim kurarken her bir uç noktanın kimliğini doğrulamak için güçlü kimlik doğrulama yöntemlerinin kullanıldığı doğrulanmalıdır. Bu yöntemler arasında, açık anahtar altyapısı (public-key infrastructure) kullanan ve tekrar oynatma saldırılarına karşı dayanıklı olan TLS istemci kimlik doğrulaması gibi yöntemler yer almalıdır. Mikroservis mimarilerinde, sertifika yönetimini basitleştirmek ve güvenliği artırmak amacıyla bir servis ağı (service mesh) kullanılması değerlendirilmelidir. | 3 | + +## Referanslar + +Daha fazla bilgi için: + +* [OWASP - Transport Layer Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html) +* [Mozilla's Server Side TLS configuration guide](https://wiki.mozilla.org/Security/Server_Side_TLS) +* [Mozilla's tool to generate known good TLS configurations](https://ssl-config.mozilla.org/). +* [O-Saft - OWASP Project to validate TLS configuration](https://owasp.org/www-project-o-saft/) diff --git a/5.0/tr/0x22-V13-Configuration.md b/5.0/tr/0x22-V13-Configuration.md new file mode 100644 index 0000000000..87f0ba8a7b --- /dev/null +++ b/5.0/tr/0x22-V13-Configuration.md @@ -0,0 +1,68 @@ +# V13 Konfigürasyon + +## Kontrol Amacı + +Uygulamanın varsayılan konfigürasyonu, İnternet üzerinde güvenli kullanım için uygun olmalıdır. + +Bu bölüm, geliştirme, derleme ve dağıtım aşamalarında uygulanması gereken çeşitli konfigürasyonlara dair rehberlik sağlar. + +Ele alınan konular veri sızıntısını önlemek, bileşenler arası iletişimi güvenli şekilde yönetmek ve gizli verileri korumayı içerir. + +## V13.1 Konfigürasyon Dokümantasyonu + +Bu bölüm, uygulamanın iç ve dış hizmetlerle nasıl iletişim kurduğunu açıklayan dokümantasyon gereksinimlerini ve hizmetlerin erişilemez olması durumunda erişilebilirliğin kaybını önlemek için kullanılabilecek teknikleri tanımlar. Ayrıca, gizli verilerle ilgili belgeleri de kapsar. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **13.1.1** | Uygulamanın tüm iletişim ihtiyaçlarının dokümante edildiği doğrulanmalıdır. Buna, uygulamanın bağımlı olduğu dış hizmetler ve son kullanıcının uygulamanın bağlantı kurmasını sağlayabileceği dış konumlar da dahil olmalıdır. | 2 | +| **13.1.2** | Uygulamanın kullandığı her bir hizmet için, dokümantasyonda eşzamanlı bağlantı sayısı (örn. bağlantı havuzu limitleri) ve bu sınır aşıldığında uygulamanın davranışı, geri dönüş veya kurtarma mekanizmaları da dahil olmak üzere hizmet reddi koşullarını önlemek için tanımlandığı doğrulanmalıdır. | 3 | +| **13.1.3** | Uygulamanın, kullandığı her bir dış sistem veya hizmet (örn. veritabanları, dosya tanıtıcıları, iş parçacıkları, HTTP bağlantıları) için kaynak yönetimi stratejilerini tanımladığı doğrulanmalıdır. Bu stratejiler, kaynak serbest bırakma prosedürlerini, zaman aşımı ayarlarını, hata durumlarını ve tekrar deneme mantığı uygulanmışsa sınırları, gecikmeleri ve geri çekilme (back-off) algoritmalarını içermelidir. Senkron HTTP istek–yanıt işlemleri için kısa zaman aşımı süreleri zorunlu tutulmalı ve tekrar eden denemeler devre dışı bırakılmalı ya da sıkı şekilde sınırlandırılmalıdır. | 3 | +| **13.1.4** | Uygulamanın, güvenlik açısından kritik olan gizli verileri tanımladığı ve kuruluşun tehdit modeli ve iş ihtiyaçlarına göre bu verilerin döndürülme (rotation) zamanlamasının belgelendiği doğrulanmalıdır. | 3 | + +## V13.2 Backend İletişim Konfigürasyonu + +Uygulamalar, API'ler, veritabanları veya diğer bileşenler gibi çok sayıda hizmetle etkileşime girer. Bu hizmetler, uygulamaya dâhil olarak kabul edilebilir ancak uygulamanın standart erişim kontrol mekanizmalarına dahil olmayabilir veya tamamen dış sistemler olabilir. Her iki durumda da, uygulamanın bu bileşenlerle güvenli şekilde iletişim kuracak şekilde yapılandırılması ve gerekiyorsa bu yapılandırmanın korunması gereklidir. + +Not: "Güvenli İletişim" bölümü, aktarım sırasında şifreleme için rehberlik sağlar. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **13.2.1** | Uygulamanın, standart kullanıcı oturum mekanizmasını desteklemeyen backend bileşenleri (örneğin API'ler, ara katmanlar, veri katmanları) arasında gerçekleşen iletişimlerin kimlik doğrulamasıyla korunduğu doğrulanmalıdır. Kimlik doğrulama; bireysel hizmet hesapları, kısa ömürlü token'lar ya da sertifika tabanlı kimlik doğrulama ile yapılmalıdır ve parola, API anahtarı ya da ayrıcalıklı erişime sahip paylaşımlı hesaplar gibi sabit kimlik bilgileri kullanılmamalıdır. | 2 | +| **13.2.2** | Uygulamanın backend bileşenleri arasında (yerel hizmetler, işletim sistemi hizmetleri, API'ler, ara katmanlar ve veri katmanları dahil) gerçekleştirilen iletişimlerin, yalnızca gerekli en az ayrıcalığa sahip hesaplarla yapıldığı doğrulanmalıdır. | 2 | +| **13.2.3** | Bir hizmet kimlik doğrulaması için bir kimlik bilgisi kullanılması gerekiyorsa, bu kimlik bilgisinin varsayılan bir değer (örneğin root/root veya admin/admin) olmadığının doğrulanması gereklidir. | 2 | +| **13.2.4** | Uygulamanın iletişim kurmasına izin verilen dış kaynaklar ya da sistemlerin, bir allowlist (izinli liste) ile tanımlandığı doğrulanmalıdır. Bu liste, uygulama katmanında, web sunucusunda, güvenlik duvarında veya farklı katmanların birleşiminde uygulanabilir. | 2 | +| **13.2.5** | Web veya uygulama sunucusunun, dış sistemlere veri veya dosya gönderimi veya yüklemesi yaparken sadece belirli kaynaklara izin verecek şekilde allowlist ile yapılandırıldığı doğrulanmalıdır. | 2 | +| **13.2.6** | Uygulamanın farklı hizmetlere bağlantı kurduğu durumlarda, bu bağlantılar için belgelenmiş yapılandırmaları (örn. maksimum eşzamanlı bağlantı, bağlantı limiti aşıldığında davranış, zaman aşımı, tekrar deneme stratejileri) takip ettiğinin doğrulanması gereklidir. | 3 | + +## V13.3 Gizli Bilgi Yönetimi + +Gizli bilgilerin (secret) yönetimi, uygulama tarafından kullanılan verilerin korunması açısından temel bir konfigürasyon görevidir. Kriptografi ile ilgili özel gereksinimler "Kriptografi" bölümünde yer almakla birlikte bu bölüm, gizli verilerin yönetimi ve işlenmesine odaklanır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **13.3.1** | Parolalar, anahtar materyalleri, veritabanı ve üçüncü parti sistemlerle entegrasyon bilgileri, zaman tabanlı token'lar için tohum (seed) bilgileri, dahili gizli veriler ve API anahtarları gibi backend sırlarının güvenli bir şekilde oluşturulması, saklanması, erişim denetiminin sağlanması ve imha edilmesi için bir gizli bilgi yönetim çözümünün (örneğin key vault) kullanıldığı doğrulanmalıdır. Bu gizli bilgiler uygulama kaynak koduna dahil edilmemeli ve yapı çıktılarında yer almamalıdır. Seviye 3 uygulamalar için donanım destekli bir çözüm (örneğin HSM) gereklidir. | 2 | +| **13.3.2** | Gizli bilgilere erişimin en az ayrıcalık prensibine uygun şekilde yapılandırıldığı doğrulanmalıdır. | 2 | +| **13.3.3** | Tüm kriptografik işlemlerin, anahtar materyallerinin güvenli bir şekilde yönetilmesi ve dışarıya sızmasının engellenmesi amacıyla, izole edilmiş bir güvenlik modülü (örneğin vault ya da donanım güvenlik modülü) aracılığıyla gerçekleştirildiği doğrulanmalıdır. | 3 | +| **13.3.4** | Uygulamanın belgelerinde belirtildiği şekilde gizli bilgilerin süresinin dolacak şekilde yapılandırıldığı ve düzenli olarak döndürüldüğü doğrulanmalıdır. | 3 | + +## V13.4 İstenmeyen Bilgi Sızıntısı + +Üretim yapılandırmaları, gereksiz veri ifşasını önleyecek şekilde sertleştirilmiş (hardened) olmalıdır. Bu tür güvenlik açıkları genellikle tek başına büyük risk olarak değerlendirilmese de diğer açıklıklarla zincirlenerek sömürülebilir. Varsayılan olarak bu açıklıkların bulunmaması, uygulamaya yapılacak saldırıların zorluk seviyesini artırır. + +Örneğin, sunucu taraflı bileşenlerin sürüm bilgisini gizlemek, tüm bileşenlerin yamanması ihtiyacını ortadan kaldırmaz; dizin listelemeyi devre dışı bırakmak, yetkilendirme kontrolleri ihtiyacını ya da dosyaların herkese açık klasörden uzak tutulması gerekliliğini ortadan kaldırmaz. Ancak bunlar, saldırıların başarıya ulaşma olasılığını azaltır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **13.4.1** | Uygulamanın .git veya .svn klasörleri gibi kaynak kontrolüyle ilgili metadata içermeyecek şekilde deploy edildiğini ya da bu klasörlerin hem dış erişime hem de uygulama erişimine kapalı olduğu doğrulanmalıdır. | 1 | +| **13.4.2** | Tüm bileşenler için üretim ortamlarında hata ayıklama (debug) modlarının devre dışı bırakıldığı doğrulanmalıdır. | 2 | +| **13.4.3** | Web sunucularının, açık şekilde istenmediği sürece dizin listelemesi (directory listing) özelliğini istemcilere sunmadığı doğrulanmalıdır. | 2 | +| **13.4.4** | HTTP TRACE metodunun üretim ortamlarında desteklenmediği, böylece potansiyel bilgi sızıntılarının önlendiği doğrulanmalıdır. | 2 | +| **13.4.5** | Belgeler (örneğin dahili API belgeleri) ve izleme uç noktalarının (monitoring endpoints) yalnızca açıkça belirtildiği durumlarda erişilebilir olduğu doğrulanmalıdır. | 2 | +| **13.4.6** | Uygulamanın arka uç bileşenlerinin ayrıntılı sürüm bilgilerini ifşa etmediği doğrulanmalıdır. | 3 | +| **13.4.7** | Web katmanının yalnızca belirli dosya uzantılarına sahip dosyaları sunacak şekilde yapılandırıldığı, bu sayede istem dışı bilgi, yapılandırma ya da kaynak kod sızıntılarının önlendiği doğrulanmalıdır. | 3 | + +## Referanslar + +Daha fazla bilgi için: + +* [OWASP Web Security Testing Guide: Configuration and Deployment Management Testing](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing) diff --git a/5.0/tr/0x23-V14-Data-Protection.md b/5.0/tr/0x23-V14-Data-Protection.md new file mode 100644 index 0000000000..7d88816343 --- /dev/null +++ b/5.0/tr/0x23-V14-Data-Protection.md @@ -0,0 +1,60 @@ +# V14 Veri Koruma + +## Kontrol Amacı + +Uygulamalar, tüm kullanım senaryolarını ve kullanıcı davranışlarını önceden öngöremez. Bu nedenle, istemci cihazlarda hassas verilere yetkisiz erişimi sınırlamak için kontroller uygulanmalıdır. + +Bu bölüm, hangi verilerin korunması gerektiğini tanımlama, nasıl korunacağını belirleme ve uygulanması gereken özel mekanizmalar ile kaçınılması gereken hatalarla ilgili gereksinimleri içerir. + +Veri koruma ile ilgili bir diğer husus da toplu veri çıkarımı, değiştirme veya aşırı kullanımdır. Her sistemin gereksinimleri muhtemelen çok farklı olacaktır; bu nedenle, neyin "anormal" olduğunun belirlenmesi tehdit modeli ve iş riski dikkate alınarak yapılmalıdır. ASVS perspektifinden bakıldığında, bu tür sorunların tespiti "Güvenlik Günlüğü Tutma ve Hata Yönetimi" bölümünde, sınırlamaların belirlenmesi ise "Doğrulama ve İş Mantığı" bölümünde ele alınmaktadır. + +## V14.1 Veri Koruma Dokümantasyonu + +Verilerin korunabilmesi için temel ön koşullardan biri, hangi verilerin hassas olarak kabul edilmesi gerektiğinin kategorize edilmesidir. Hassasiyetin birkaç farklı düzeyi olabilir ve her düzey için uygulanması gereken kontroller farklılık gösterebilir. + +Verilerin saklanması, kullanımı ve iletimi konusunda uygulamaların uyması gereken çeşitli gizlilik düzenlemeleri ve yasalar bulunmaktadır. Bu bölüm artık bu tür yasal düzenlemeleri çoğaltmaya çalışmamakta, bunun yerine hassas verileri korumaya yönelik temel teknik hususlara odaklanmaktadır. Lütfen yerel yasa ve düzenlemelere başvurun ve gerektiğinde nitelikli bir gizlilik uzmanı veya avukata danışın. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **14.1.1** | Uygulama tarafından oluşturulan ve işlenen tüm hassas verilerin tanımlanıp, koruma seviyelerine göre sınıflandırıldığından emin olun. Bu, yalnızca kodlanmış (örneğin Base64 stringleri ya da JWT içindeki düz metin yükler gibi) ve bu nedenle kolayca çözülebilir verileri de içermelidir. Koruma seviyeleri, uygulamanın uymakla yükümlü olduğu veri koruma ve gizlilik düzenlemeleri ile standartlarını dikkate almalıdır. | 2 | +| **14.1.2** | Tüm hassas veri koruma seviyeleri için belgelenmiş bir koruma gereksinimleri seti tanımlandığından emin olun. Bu gereksinimler genel şifreleme, bütünlük doğrulama, saklama süresi, verinin nasıl günlüğe kaydedileceği, günlüklerdeki hassas verilere erişim kontrolleri, veritabanı düzeyinde şifreleme, gizlilik ve gizliliği artırıcı teknolojiler ile diğer gizlilik gereksinimlerini kapsamalıdır. | 2 | + +## V14.2 Genel Veri Koruması + +Bu bölüm, veri korumaya yönelik çeşitli pratik gereksinimleri içerir. Bunların çoğu, istenmeyen veri sızıntısı gibi belirli konulara yöneliktir. Ancak aynı zamanda her bir veri öğesi için gerekli olan koruma düzeyine göre koruma kontrollerinin uygulanmasına ilişkin genel bir gereksinim de bulunmaktadır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **14.2.1** | Hassas verilerin yalnızca HTTP message body veya header alanlarında sunucuya gönderildiği ve URL ile sorgu parametrelerinin, API anahtarı veya session token’ı gibi hassas bilgiler içermediği doğrulanmalıdır. | 1 | +| **14.2.2** | Hassas verilerin, yük dengeleyiciler ve uygulama önbellekleri gibi sunucu bileşenlerinde önbelleğe alınmasının engellendiği veya kullanım sonrası bu verilerin güvenli biçimde temizlendiği doğrulanmalıdır. | 2 | +| **14.2.3** | Uygulama kontrolü dışında veri toplanmasını engellemek için, tanımlanmış hassas verilerin, kullanıcı izleyicileri gibi güvensiz taraflara gönderilmediği doğrulanmalıdır. | 2 | +| **14.2.4** | Hassas verilere yönelik şifreleme, bütünlük doğrulama, veri saklama, loglama yöntemi, loglardaki erişim kontrolleri, gizlilik teknolojileri gibi kontrollerin, söz konusu verinin belgelenmiş koruma seviyesinde tanımlandığı şekilde uygulandığı doğrulanmalıdır. | 2 | +| **14.2.5** | Önbellekleme mekanizmalarının yalnızca belirli içerik türüne sahip yanıtları önbelleğe alacak şekilde yapılandırıldığı ve hassas, dinamik içeriklerin önbelleğe alınmadığı doğrulanmalıdır. Web sunucusu, mevcut olmayan bir dosya talebinde geçerli ama farklı bir dosya döndürmek yerine 404 veya 302 cevabı vermelidir. Bu, Web Cache Deception saldırılarını önlemeye yardımcı olur. | 3 | +| **14.2.6** | Uygulamanın yalnızca işlevsellik için gerekli olan asgari hassas veriyi döndürdüğü doğrulanmalıdır. Örneğin, kredi kartı numarasının yalnızca bazı rakamlarının döndürülmesi; tam numaranın döndürülmesi gerekiyorsa, kullanıcı arayüzünde gizlenmiş (maskelenmiş) şekilde sunulması gerekir, aksi kullanıcı özel olarak görüntülemek istemedikçe gösterilmemelidir. | 3 | +| **14.2.7** | Hassas bilgilerin, veri saklama sınıflandırmasına tabi tutulduğu, geçerliliğini yitirmiş veya artık gerekli olmayan verilerin belirlenmiş bir zaman çizelgesiyle ya da gerektiğinde otomatik olarak silindiği doğrulanmalıdır. | 3 | +| **14.2.8** | Kullanıcı tarafından yüklenen dosyaların meta verilerinden hassas bilgilerin çıkarıldığı veya bu bilgilerin yalnızca kullanıcıdan açık onay alındığında saklandığı doğrulanmalıdır. | 3 | + +## V14.3 İstemci Tarafı Veri Koruması + +Bu bölüm, uygulamanın istemci veya kullanıcı aracısı tarafında verilerin belirli yollarla sızmasını önlemeye yönelik gereksinimleri içerir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **14.3.1** | Kimliği doğrulanmış verilerin, istemci veya oturum sonlandığında istemci depolamasından (örneğin tarayıcı DOM’undan) temizlendiği doğrulanmalıdır. 'Clear-Site-Data' HTTP response header bu konuda yardımcı olabilir ancak istemci tarafı, sunucu bağlantısı mevcut olmadığında da temizlik işlemini yapabiliyor olmalıdır. | 1 | +| **14.3.2** | Uygulamanın, tarayıcılarda hassas verilerin önbelleğe alınmasını önlemek amacıyla yeterli anti-önbellekleme HTTP response header (örneğin Cache-Control: no-store) ayarladığı doğrulanmalıdır. | 2 | +| **14.3.3** | Tarayıcıda depolanan verilerin (örneğin localStorage, sessionStorage, IndexedDB veya çerezler) hassas veri içermediği, yalnızca session token’larının istisna olarak kabul edildiği doğrulanmalıdır. | 2 | + +## Referanslar + +Daha fazla bilgi için: + +* [Güvenlik ve önbelleğe alma karşıtı header field'ları kontrol etmek için Security Headers web sitesini kullanmayı değerlendirebilirsiniz](https://securityheaders.com/) +* [Mozilla'nın önbelleğe alma karşıtı header'larla ilgili dokümantasyonu](https://developer.mozilla.org/en-US/docs/Web/HTTP/Caching) +* [OWASP Secure Headers project](https://owasp.org/www-project-secure-headers/) +* [OWASP Privacy Risks Project](https://owasp.org/www-project-top-10-privacy-risks/) +* [OWASP User Privacy Protection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/User_Privacy_Protection_Cheat_Sheet.html) +* [Australian Privacy Principle 11 - Security of personal information](https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-11-app-11-security-of-personal-information) +* [European Union General Data Protection Regulation (GDPR) overview](https://www.edps.europa.eu/data-protection_en) +* [European Union Data Protection Supervisor - Internet Privacy Engineering Network](https://www.edps.europa.eu/data-protection/ipen-internet-privacy-engineering-network_en) +* ["Clear-Site-Data" header'ıyla ilgili bilgi](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Clear-Site-Data) +* [Web Cache Deception hakkında white paper](https://www.blackhat.com/docs/us-17/wednesday/us-17-Gil-Web-Cache-Deception-Attack-wp.pdf) diff --git a/5.0/tr/0x24-V15-Secure-Coding-and-Architecture.md b/5.0/tr/0x24-V15-Secure-Coding-and-Architecture.md new file mode 100644 index 0000000000..2c1c963727 --- /dev/null +++ b/5.0/tr/0x24-V15-Secure-Coding-and-Architecture.md @@ -0,0 +1,77 @@ +# V15 Güvenli Kodlama ve Mimari + +## Kontrol Amacı + +ASVS gereksinimlerinin birçoğu kimlik doğrulama veya yetkilendirme gibi belirli bir güvenlik alanına ya da loglama veya dosya işleme gibi belirli uygulama işlevlerine ilişkindir. + +Bu bölüm, uygulamalar tasarlanırken ve geliştirilirken dikkate alınması gereken genel güvenlik gereksinimlerini kapsar. Bu gereksinimler yalnızca temiz mimari ve kod kalitesine değil, aynı zamanda uygulama güvenliği için gerekli olan belirli mimari ve kodlama uygulamalarına da odaklanır. + +## V15.1 Güvenli Kodlama ve Mimari Dokümantasyonu + +Güvenli ve savunulabilir bir mimarinin oluşturulmasına yönelik birçok gereksinim, uygulamada kullanılan bileşenler ve belirli güvenlik kontrollerinin uygulanmasına ilişkin kararların açıkça belgelenmesine dayanır. + +Bu bölüm, “tehlikeli işlevsellik” içeren bileşenler veya “riskli bileşenler” olarak kabul edilen parçaların tanımlanması dahil olmak üzere, dokümantasyon gereksinimlerini açıklar. + +"Tehlikeli işlevsellik" içeren bir bileşen, güvenilmeyen verilerin serisizleştirmesini (deserialization) yapan, ham dosya veya ikili veri ayrıştırması gerçekleştiren, dinamik kod çalıştıran veya doğrudan bellekle etkileşen bir dahili ya da üçüncü taraf bileşen olabilir. Bu tür işlemlerdeki güvenlik açıkları, uygulamanın ve altında yatan altyapının ele geçirilmesine yol açabilecek yüksek risklidir. + +"Riskli bileşen", güvenlik kontrolleri eksik ya da zayıf şekilde uygulanmış bir üçüncü taraf (ekip içinde geliştirilmemiş) kütüphanedir. Örnekler arasında kötü şekilde sürdürülen, desteklenmeyen, ömrünün sonuna gelmiş veya ciddi güvenlik açıkları geçmişi olan bileşenler yer alır. + +Bu bölüm aynı zamanda üçüncü taraf bileşenlerdeki güvenlik açıklarının giderilmesi için uygun zaman çerçevelerinin tanımlanmasının önemini vurgular. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **15.1.1** | Güvenlik açığı içeren üçüncü taraf bileşen sürümleri ve genel olarak kütüphane güncellemeleri için, uygulama dokümantasyonunda risk bazlı düzeltme zamanlarının tanımlandığı doğrulanmalıdır. | 1 | +| **15.1.2** | Yazılım bileşen listesi (Software Bill of Materials - SBOM) gibi bir envanterin tutulduğu, kullanılan tüm üçüncü taraf kütüphanelerin önceden tanımlanmış, güvenilir ve düzenli olarak güncellenen depolardan alındığı doğrulanmalıdır. | 2 | +| **15.1.3** | Uygulama dokümantasyonunda zaman veya kaynak açısından yoğun işlevlerin tanımlandığı, bu işlevlerin aşırı kullanımı durumunda kullanılabilirlik kaybının nasıl önleneceği ve yanıt oluşturma süresinin istemci zaman aşımını aşmaması için hangi önlemlerin alındığı belirtilmelidir. Örnek savunmalar kuyruklama, eşzamansız işleme, kullanıcı başına ve uygulama genelinde paralel işlem sınırlarını içerebilir. | 2 | +| **15.1.4** | Uygulama dokümantasyonunda "riskli bileşenler" olarak değerlendirilen üçüncü taraf kütüphanelerin vurgulandığı doğrulanmalıdır. | 3 | +| **15.1.5** | Uygulama dokümantasyonunda "tehlikeli işlevsellik" içeren uygulama bölümlerinin açıkça belirtildiği doğrulanmalıdır. | 3 | + +## V15.2 Güvenlik Mimarisi ve Bağımlılıklar + +Bu bölüm riskli, güncel olmayan veya güvensiz bağımlılıkların ve bileşenlerin bağımlılık yönetimi yoluyla nasıl ele alınması gerektiğine dair gereksinimleri içerir. + +Ayrıca, “tehlikeli işlemler” veya “riskli bileşenlerin” (önceki bölümde tanımlandığı şekilde) kullanımının etkisini azaltmak ve kaynak yoğun işlevlerin aşırı kullanımından kaynaklı kullanılabilirlik kayıplarını önlemek amacıyla sandboxing, kapsülleme (encapsulation), konteynerleştirme ve ağ izolasyonu gibi mimari düzeydeki tekniklerin kullanımını da kapsar. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **15.2.1** | Uygulamanın yalnızca, belgelenmiş güncelleme ve düzeltme sürelerini aşmamış bileşenleri içerdiği doğrulanmalıdır. | 1 | +| **15.2.2** | Uygulamanın, belgelenmiş güvenlik kararları ve stratejilere dayanarak, zaman veya kaynak açısından yoğun işlevlerin neden olabileceği kullanılabilirlik kaybına karşı savunmalar uyguladığı doğrulanmalıdır. | 2 | +| **15.2.3** | Üretim ortamının yalnızca uygulamanın çalışması için gerekli işlevleri içerdiği ve test kodları, örnek kod parçaları veya geliştirme işlevleri gibi gereksiz işlevsellikleri açığa çıkarmadığı doğrulanmalıdır. | 2 | +| **15.2.4** | Üçüncü taraf bileşenlerin ve bunların tüm transitif bağımlılıklarının beklenen depolardan (iç kaynaklı ya da harici) alındığı ve bağımlılık karışıklığı (dependency confusion) saldırılarına açık olmadığı doğrulanmalıdır. | 3 | +| **15.2.5** | Uygulamanın, “tehlikeli işlevsellik” içeren veya “riskli bileşenler” kullanan bölümlerine ek korumalar uyguladığı doğrulanmalıdır. Bu korumalar sandbox, kapsülleme, konteynerleştirme veya ağ düzeyinde izolasyon gibi teknikler aracılığıyla, bir uygulama bölümünün ele geçirilmesi durumunda saldırganın diğer bölümlere sıçramasını geciktirmeyi veya engellemeyi amaçlamalıdır. | 3 | + +## V15.3 Savunmacı Kodlama + +Bu bölüm, belirli bir programlama dilinde güvensiz kodlama kalıplarının kullanılması sonucu oluşan tür oynama (type juggling), prototip zehirleme (prototype pollution) gibi güvenlik açıklarını kapsar. Bazıları tüm dillere uygun olmayabilirken, diğerleri dile özel düzeltmelere sahip olabilir ya da HTTP parametrelerinin işlenmesi gibi framework'e özgü davranışlarla ilişkilidir. Ayrıca uygulama güncellemelerinin kriptografik olarak doğrulanmamasıyla ilgili riskleri de ele alır. + +Ayrıca, veri öğelerini temsil etmek için nesnelerin kullanılması ve bu nesnelerin dış API’ler üzerinden alınması ve döndürülmesi durumunda ortaya çıkan riskleri de dikkate alır. Bu durumda, uygulama kullanıcı girdileriyle değiştirilmemesi gereken alanların değiştirilememesini (kitlesel atama – mass assignment) sağlamalı ve hangi alanların döndürüldüğü konusunda seçici olmalıdır. Alan erişimi bir kullanıcının izinlerine bağlıysa, bu durum "Authorization" bölümündeki domain düzeyinde erişim kontrolü gereksinimi bağlamında değerlendirilmelidir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **15.3.1** | Uygulamanın yalnızca gerekli alanların bir alt kümesini veri nesnesinden döndürdüğü doğrulanmalıdır. Örneğin, bazı alanlara kullanıcıların erişmemesi gerektiğinden tüm veri nesnesi döndürülmemelidir. | 1 | +| **15.3.2** | Uygulama backend'i harici URL’lere çağrı yaptığında, yalnızca amaçlanan işlevsellik söz konusuysa yönlendirmeleri takip edecek şekilde yapılandırıldığının doğrulanması gerekir. | 2 | +| **15.3.3** | Uygulamanın, kitlesel atama saldırılarına karşı, her bir controller ve eylem için izin verilen alanları sınırlandırarak savunmalar sağladığı doğrulanmalıdır. Örneğin, bir alan değeri, bu işlemde değiştirilmesi amaçlanmadıysa eklenememeli veya güncellenememelidir. | 2 | +| **15.3.4** | Tüm proxy ve ara katman bileşenlerinin kullanıcının orijinal IP adresini, uç kullanıcı tarafından değiştirilemeyecek güvenilir veri alanları kullanarak doğru şekilde ilettiği ve uygulamanın ve web sunucusunun bu doğru değeri, loglama ve hız sınırlama gibi güvenlik kararları için kullandığı doğrulanmalıdır. Ayrıca, orijinal IP adresinin bile dinamik IP'ler, VPN'ler veya kurumsal güvenlik duvarları nedeniyle güvenilir olmayabileceği dikkate alınmalıdır. | 2 | +| **15.3.5** | Uygulamanın değişkenlerin doğru türde olduğunu açıkça doğruladığı ve sıkı eşitlik ve karşılaştırma işlemleri kullandığı doğrulanmalıdır. Bu, değişken türüyle ilgili varsayımlardan kaynaklanan tür oynama (type juggling) veya tür karışıklığı (type confusion) güvenlik açıklarını önlemek içindir. | 2 | +| **15.3.6** | JavaScript kodunun prototip zehirleme (prototype pollution) saldırılarını önleyecek şekilde yazıldığı, örneğin, nesne literal’leri yerine Set() veya Map() gibi yapılar kullanıldığı doğrulanmalıdır. | 2 | +| **15.3.7** | Uygulamanın, özellikle framework'ün istek parametrelerinin kaynağı (sorgu dizgisi, gövde parametreleri, çerezler veya başlık alanları) arasında ayrım yapmadığı durumlarda, HTTP parametre kirliliği (HTTP parameter pollution) saldırılarına karşı savunmalar uyguladığı doğrulanmalıdır. | 2 | + +## V15.4 Güvenli Eş Zamanlılık (Concurrency) + +Yarış durumları (race condition), kontrol anından kullanım anına (TOCTOU - time-of-check to time-of-use) açıkları, deadlock, livelock, iş parçacığı (thread) açlığı ve hatalı senkronizasyon gibi eş zamanlılık sorunları, öngörülemeyen davranışlara ve güvenlik risklerine yol açabilir. Bu bölüm, bu riskleri azaltmaya yardımcı olacak çeşitli teknikleri ve stratejileri içerir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **15.4.1** | Çok iş parçacıklı kodda (örneğin cache'ler, dosyalar veya birden fazla iş parçacığı tarafından erişilen bellek içi nesneler gibi) paylaşılan nesnelere yalnızca thread-safe (iş parçacığı güvenli) türler ve kilitleme (lock) veya semaphore gibi senkronizasyon mekanizmaları kullanılarak erişildiği doğrulanmalıdır. Bu, yarış durumlarını ve veri bozulmasını önlemeye yöneliktir. | 3 | +| **15.4.2** | Bir kaynağın durumu üzerindeki kontroller (örneğin varlığı ya da izinleri gibi) ile bu kontrole bağlı eylemlerin tek bir atomik işlem olarak gerçekleştirildiği doğrulanmalıdır. Bu, TOCTOU (time-of-check to time-of-use) yarış durumlarını önlemeye yöneliktir. Bir dosyanın varlığının kontrol edilip ardından açılması veya bir kullanıcının erişiminin doğrulanıp ardından yetki verilmesi gibi işlemler buna örnektir. | 3 | +| **15.4.3** | Kilitlerin (locks) tutarlı biçimde kullanıldığı, iş parçacıklarının birbirini beklemesi ya da sonsuz döngüye girmesi (deadlock veya livelock) gibi durumların önlendiği doğrulanmalıdır. Ayrıca, kilitleme mantığı, kaynağı yöneten kod içinde kalmalı ve dış sınıflar veya dış kodlar tarafından istemeden veya kötü niyetli şekilde değiştirilememelidir. | 3 | +| **15.4.4** | Kaynak tahsis politikalarının, iş parçacığı açlığını önleyecek şekilde, kaynaklara adil erişimi sağladığı doğrulanmalıdır. Örneğin, thread pool (iş parçacığı havuzu) kullanımı, düşük öncelikli iş parçacıklarının da makul sürelerde çalışabilmesi için uygulanmalıdır. | 3 | + +## Referanslar + +Daha fazla bilgi için: + +* [OWASP Prototype Pollution Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html) +* [OWASP Mass Assignment Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html) +* [OWASP CycloneDX Bill of Materials Specification](https://owasp.org/www-project-cyclonedx/) +* [OWASP Web Security Testing Guide: Testing for HTTP Parameter Pollution](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/07-Input_Validation_Testing/04-Testing_for_HTTP_Parameter_Pollution) diff --git a/5.0/tr/0x25-V16-Security-Logging-and-Error-Handling.md b/5.0/tr/0x25-V16-Security-Logging-and-Error-Handling.md new file mode 100644 index 0000000000..46d0624d56 --- /dev/null +++ b/5.0/tr/0x25-V16-Security-Logging-and-Error-Handling.md @@ -0,0 +1,84 @@ +# V16 Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi + +## Kontrol Amacı + +Güvenlik logları hata ya da performans loglarından farklı olarak kimlik doğrulama kararları, erişim kontrol kararları ve giriş doğrulama ya da iş mantığı doğrulama gibi güvenlik kontrollerini aşma girişimleri gibi güvenlikle ilgili olayları kaydetmek için kullanılır. Bu logların amacı tespit, müdahale ve inceleme süreçlerini desteklemek için SIEM gibi analiz araçlarına uygun, yüksek sinyalli ve yapılandırılmış veri sağlamaktır. + +Loglar, yasal bir zorunluluk olmadıkça hassas kişisel verileri içermemeli ve kaydedilen tüm veriler yüksek değerli birer varlık olarak korunmalıdır. Loglama işlemleri gizliliği veya sistem güvenliğini tehlikeye atmamalıdır. Uygulamalar ayrıca, hata durumlarında gereksiz bilgi sızdırma veya kesinti olmaksızın güvenli şekilde başarısız olmalıdır. + +Detaylı uygulama rehberliği için referanslar bölümündeki OWASP Cheat Sheet dökümanlarına başvurulabilir. + +## V16.1 Güvenlik Loglaması Dokümantasyonu + +Bu bölüm, uygulama katmanları genelinde gerçekleştirilen loglamanın açık ve eksiksiz bir envanterini oluşturmayı amaçlar. Bu, etkili güvenlik izleme, olay müdahalesi ve uyumluluk için gereklidir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **16.1.1** | Uygulamanın teknoloji yığını boyunca her katmanda hangi olayların loglandığını, log formatlarını, logların nereye yazıldığını, nasıl kullanıldığını, erişimin nasıl kontrol edildiğini ve logların ne kadar süre saklandığını belgeleyen bir envanterin mevcut olduğu doğrulanmalıdır. | 2 | + +## V16.2 Genel Loglama + +Bu bölüm, güvenlik loglarının tutarlı şekilde yapılandırılmasını ve beklenen meta verileri içermesini sağlamaya yönelik gereksinimleri kapsar. Amaç, logların makine tarafından okunabilir ve dağıtık sistemler ile araçlarda analiz edilebilir olmasını sağlamaktır. + +Güvenlik olayları çoğunlukla hassas veriler içerir. Bu tür verilerin dikkatsizce kaydedilmesi durumunda, loglar da hassas veri niteliği kazanır ve bu da şifreleme zorunluluğu, daha sıkı saklama politikaları ve denetimlerde açıklanma riski gibi sonuçlara yol açar. + +Bu nedenle yalnızca gerekli verilerin loglanması ve log verilerinin diğer hassas varlıklar gibi korunması kritik önemdedir. + +Aşağıdaki gereksinimler metadata'nın loglanması, senkronizasyon, biçim ve kontrol için temel gereksinimleri belirler. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **16.2.1** | Her bir log girdisinin, olayın ne zaman, nerede, kim tarafından ve ne olduğuna dair detaylı bir zaman çizelgesi oluşturulmasına olanak tanıyacak gerekli meta verileri içerdiği doğrulanmalıdır. | 2 | +| **16.2.2** | Tüm loglama bileşenlerinin zaman kaynaklarının senkronize olduğu ve güvenlik olayı meta verisindeki zaman damgalarının UTC kullanarak ya da açık zaman dilimi ofsetiyle belirtildiği doğrulanmalıdır. UTC kullanımı, özellikle yaz saati uygulamaları nedeniyle oluşabilecek karışıklıkları önlemek için tavsiye edilir. | 2 | +| **16.2.3** | Uygulamanın yalnızca log envanterinde belgelenmiş dosya ve hizmetlere log yazdığı ya da ilettiği doğrulanmalıdır. | 2 | +| **16.2.4** | Logların kullanılan log işleyici (log processor) tarafından okunabildiği ve ilişkilendirilebildiği doğrulanmalıdır. Tercihen yaygın bir log formatı kullanılmalıdır. | 2 | +| **16.2.5** | Hassas veriler loglanırken, uygulamanın veri koruma seviyesine uygun olarak loglama yaptığı doğrulanmalıdır. Örneğin kimlik bilgileri veya ödeme detayları gibi bazı verilerin loglanmasına izin verilmemelidir. Session token’ları gibi veriler ise yalnızca tamamen ya da kısmen maskelenmiş ya da hash’lenmiş olarak loglanmalıdır. | 2 | + +## V16.3 Güvenlik Olayları + +Bu bölüm, uygulama içerisinde güvenlikle ilgili olayların loglanmasına dair gereksinimleri tanımlar. Bu olayların yakalanması şüpheli davranışların tespiti, olay incelemelerinin desteklenmesi ve uyumluluk yükümlülüklerinin yerine getirilmesi açısından kritiktir. + +Buradaki olay türleri örnek niteliğindedir. Her uygulama, kendine özgü risk faktörleri ve operasyonel bağlama sahiptir. + +Not: ASVS, güvenlik olaylarının loglanmasını kapsam içine alır. Ancak SIEM kuralları veya izleme altyapısı gibi uyarı ve korelasyon sistemleri kapsam dışıdır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **16.3.1** | Tüm kimlik doğrulama işlemlerinin (başarılı ve başarısız girişimler dahil) loglandığı doğrulanmalıdır. Kullanılan kimlik doğrulama türü veya faktörleri gibi ek meta veriler de toplanmalıdır. | 2 | +| **16.3.2** | Başarısız yetkilendirme girişimlerinin loglandığı doğrulanmalıdır. Seviye 3 uygulamalar için, tüm yetkilendirme kararlarının ve hassas verilere erişim olaylarının (verinin kendisi olmadan) loglandığı da doğrulanmalıdır. | 2 | +| **16.3.3** | Uygulamanın, belgelenmiş güvenlik olaylarını ve güvenlik kontrollerini aşma girişimlerini (girdi doğrulama, iş mantığı, otomasyon karşıtı kontroller vb.) logladığı doğrulanmalıdır. | 2 | +| **16.3.4** | Beklenmeyen hatalar ve güvenlik kontrolü başarısızlıkları (örneğin backend TLS hataları gibi) loglandığı doğrulanmalıdır. | 2 | + +## V16.4 Log Koruması + +Loglar, olay incelemeleri ve adli analizler için değerli kanıtlardır ve korunmaları gerekir. Kolayca silinebilen ya da değiştirilebilen loglar güvenilirliğini kaybeder. Ayrıca loglar, uygulamanın iç davranışları veya hassas meta veriler hakkında bilgi barındırabileceğinden saldırganlar için cazip hedeflerdir. + +Bu bölüm, logların yetkisiz erişimden, değiştirilmeden ve açıklanmaktan korunmasını ve güvenli, izole sistemlere aktarılmasını sağlamaya yönelik gereksinimleri tanımlar. + +| # | Description | Level | +| :---: | :--- | :---: | +| **16.4.1** | Tüm loglama bileşenlerinin, log enjeksiyonunu (log injection) önlemek amacıyla verileri uygun biçimde encode ettiği doğrulanmalıdır. | 2 | +| **16.4.2** | Logların yetkisiz erişime karşı korunduğu ve değiştirilemez olduğu doğrulanmalıdır. | 2 | +| **16.4.3** | Logların analiz, tespit, uyarı ve yükseltme amacıyla mantıksal olarak ayrı bir sisteme güvenli biçimde iletildiği doğrulanmalıdır. Böylece uygulama ihlal edilse bile logların tehlikeye girmesi önlenmiş olur. | 2 | + +## V16.5 Hata Yönetimi + +Bu bölüm, uygulamaların beklenmedik durumlarda güvenli şekilde başarısız olmasını ve hassas içsel detayları açıklamamasını sağlamak için gerekli gereksinimleri tanımlar. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **16.5.1** | Beklenmedik ya da güvenlikle ilgili bir hata oluştuğunda, tüketiciye genel bir mesaj döndürüldüğü ve yığın izleri (stack trace), sorgular, gizli anahtarlar, token’lar gibi hassas sistem içi verilerin açıklanmadığı doğrulanmalıdır. | 2 | +| **16.5.2** | Uygulamanın, dış kaynaklara erişim başarısız olduğunda bile güvenli şekilde çalışmaya devam ettiği doğrulanmalıdır. Örneğin, circuit breaker ya da graceful degradation gibi desenler kullanılmalıdır. | 2 | +| **16.5.3** | Uygulamanın hata durumlarında güvenli ve düzenli şekilde başarısız olduğu doğrulanmalıdır. Bu, örneğin doğrulama hatalarına rağmen işlemlerin işlenmesine yol açabilecek fail-open durumlarını önlemelidir. | 2 | +| **16.5.4** | Ele alınmamış tüm istisnaları yakalayacak şekilde tanımlanmış bir “son çare hata yöneticisi” bulunduğu doğrulanmalıdır. Bu, hem loglara gitmesi gereken hata detaylarının kaybolmaması hem de tüm uygulama sürecinin çökerek hizmet dışı kalmasının önlenmesi açısından önemlidir. | 3 | + +Not: Swift, Go ve birçok fonksiyonel dilde olduğu gibi bazı diller, istisnaları veya “son çare” hata yöneticilerini desteklemez. Bu durumda, geliştiriciler uygulamanın beklenmeyen veya güvenlikle ilgili olayları güvenli şekilde ele almasını sağlamak için dile veya çerçeveye uygun desenler kullanmalıdır. + +## Referanslar + +Daha fazla bilgi için: + +* [OWASP Web Security Testing Guide: Testing for Error Handling](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/README) +* [OWASP Authentication Cheat Sheet section about error messages](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#authentication-and-error-messages) +* [OWASP Logging Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html) +* [OWASP Application Logging Vocabulary Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Vocabulary_Cheat_Sheet.html) diff --git a/5.0/tr/0x26-V17-WebRTC.md b/5.0/tr/0x26-V17-WebRTC.md new file mode 100644 index 0000000000..8706b284f4 --- /dev/null +++ b/5.0/tr/0x26-V17-WebRTC.md @@ -0,0 +1,75 @@ +# V17 WebRTC + +## Kontrol Amacı + +Web Gerçek Zamanlı İletişim (WebRTC), modern uygulamalarda gerçek zamanlı ses, görüntü ve veri alışverişini mümkün kılar. Kullanım yaygınlaştıkça, WebRTC altyapısının güvenliğinin sağlanması kritik hâle gelir. Bu bölüm, WebRTC sistemlerini geliştiren, barındıran veya entegre eden paydaşlar için güvenlik gereksinimlerini tanımlar. + +WebRTC pazarı genel olarak üç kategoriye ayrılabilir: + +1. Ürün Geliştiriciler: WebRTC ürün ve çözümlerini geliştiren ve sağlayan özel veya açık kaynak tedarikçileri. Odak noktaları, başkaları tarafından da kullanılabilecek sağlam ve güvenli WebRTC teknolojileri geliştirmektir. + +2. Hizmet Olarak İletişim Platformları (Communication Platforms as a Service - CPaaS): WebRTC işlevlerini mümkün kılmak için API, SDK ve altyapı/platform sağlayan hizmet sağlayıcılarıdır. CPaaS sağlayıcıları, birinci kategorideki ürünleri kullanabilir veya kendi WebRTC yazılımlarını geliştirerek bu hizmetleri sunabilirler. + +3. Hizmet Sağlayıcılar: Ürün geliştiricilerden veya CPaaS sağlayıcılarından alınan ürünleri kullanan ya da kendi WebRTC çözümlerini geliştiren kuruluşlardır. Bu sağlayıcılar çevrim içi konferans, sağlık, online eğitim gibi alanlarda gerçek zamanlı iletişimin kritik olduğu uygulamalar geliştirirler. + +Bu bölümdeki güvenlik gereksinimleri, özellikle aşağıdaki gibi sistemleri kullanan Ürün Geliştiriciler, CPaaS’ler ve Hizmet Sağlayıcıları için geçerlidir: + +* WebRTC uygulamalarını oluşturmak için açık kaynak çözümler kullananlar, +* Altyapılarının bir parçası olarak ticari WebRTC ürünlerini kullananlar, +* Kendi WebRTC çözümlerini geliştiren ya da çeşitli bileşenleri birleştirerek entegre hizmet sunanlar. + +Not: Bu güvenlik gereksinimleri yalnızca CPaaS sağlayıcılarının sunduğu SDK ve API'leri doğrudan kullanan geliştiricileri kapsamaz. Bu tür durumlarda, güvenlikten büyük ölçüde CPaaS sağlayıcısı sorumlu olur ve ASVS gibi genel güvenlik standartları her zaman tam olarak geçerli olmayabilir. + +## V17.1 TURN Sunucusu + +Bu bölüm, kendi TURN (Traversal Using Relays around NAT) sunucusunu işleten sistemler için güvenlik gereksinimlerini tanımlar. TURN sunucuları, kısıtlayıcı ağ ortamlarında medya iletimini sağlamak için kullanılır, ancak yanlış yapılandırıldıklarında güvenlik riski oluşturabilirler. Bu gereksinimler, güvenli IP filtrelemesi ve kaynak tüketimine karşı korumaları ele alır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **17.1.1** | TURN hizmetinin yalnızca özel amaçlar için ayrılmamış IP adreslerine (ör. iç ağlar, yayın adresleri, loopback) erişime izin verdiği doğrulanmalıdır. Bu gereksinim hem IPv4 hem de IPv6 adresleri için geçerlidir. | 2 | +| **17.1.2** | TURN hizmetinin, meşru kullanıcıların sunucuda çok sayıda bağlantı noktası açmaya çalışması durumunda kaynak tüketimi saldırılarına karşı dayanıklı olduğu doğrulanmalıdır. | 3 | + +## V17.2 Medya + +Bu gereksinimler yalnızca kendi WebRTC medya sunucularını (ör. SFU, MCU, kayıt sunucuları veya geçit sunucuları) barındıran sistemler için geçerlidir. Medya sunucuları, medya akışlarını işler ve dağıtır, bu da iletişim güvenliğini sağlamada kritik rol oynar. Medya akışlarını korumak dinlemeyi, kurcalamayı veya hizmet reddi (DoS) saldırılarını önlemek açısından önemlidir. + +Özellikle, hız sınırlama, zaman damgalarını doğrulama, gerçek zamanlı aralıkları eşleştirmek için senkronize saatler kullanma ve taşmayı önlemek ve uygun zamanlamayı korumak için arabellekleri (buffer) yönetme gibi flood saldırılarına karşı korumalar uygulamak gerekir. Belirli bir medya oturumu için paketler çok hızlı gelirse, fazla paketler düşürülmelidir. Girdi doğrulaması uygulayarak, tamsayı taşmalarını (integer overflow) güvenli bir şekilde ele alarak, arabellek taşmalarını (buffer overflow) önleyerek ve diğer sağlam hata işleme tekniklerini kullanarak sistemi hatalı biçimlendirilmiş paketlerden korumak da önemlidir. + +Sadece peer-to-peer medya iletişimi kullanan sistemler bu medya gereksinimlerinin kapsamı dışındadır. + +DTLS (Datagram Transport Layer Security) kullanımıyla ilgili gereksinimler burada yer alır. Kriptografik anahtarların yönetimi için bir politika oluşturulması "Kriptografi" bölümünde ele alınır. Onaylı şifreleme yöntemleri için ASVS’nin Kriptografi Ek’i veya NIST SP 800‑52 Rev. 2, BSI TR‑02102‑2 (2025‑01) gibi belgeler referans alınabilir. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **17.2.1** | DTLS sertifikası anahtarının, belgelenmiş kriptografik anahtar yönetim politikasına uygun şekilde yönetildiği ve korunduğu doğrulanmalıdır. | 2 | +| **17.2.2** | Medya sunucusunun onaylı DTLS şifre takımlarını (cipher suites) ve Güvenli Gerçek Zamanlı Aktarım Protokolü (Secure Real-time Transport Protocol - SRTP) için anahtarlar oluşturmaya yönelik DTLS Uzantısı için güvenli bir koruma profilini kullanacak ve destekleyecek şekilde yapılandırıldığı (DTLS-SRTP) doğrulanmalıdır. | 2 | +| **17.2.3** | Real-time Transport Protocol (RTP) injection saldırılarının bir hizmet reddi durumuna veya medya akışlarına ses veya video medyası eklenmesine yol açmasını önlemek için medya sunucusunda Güvenli SRTP kimlik doğrulamasının kontrol edildiği doğrulanmalıdır. | 2 | +| **17.2.4** | Verify that the media server is able to continue processing incoming media traffic when encountering malformed Secure Real-time Transport Protocol (SRTP) packets. | 2 | +| **17.2.5** | Medya sunucusunun, meşru kullanıcılardan gelen SRTP flood'ı sırasında gelen medya trafiğini işlemeye devam edebildiği doğrulanmalıdır. | 3 | +| **17.2.6** | Medya sunucusunun DTLS içinde yer alan "ClientHello" yarış durumu güvenlik açığına karşı savunmasız olmadığı, medya sunucusunun güvenlik açığına sahip olduğunun açıkça bilinip bilinmediği kontrol edilerek veya yarış koşulu testi gerçekleştirilerek doğrulanmalıdır. | 3 | +| **17.2.7** | Medya sunucusuna bağlı ses veya video kayıt mekanizmalarının, meşru kullanıcı kaynaklı SRTP flood'ı sırasında medya trafiğini işlemeye devam edebildiği doğrulanmalıdır. | 3 | +| **17.2.8** | DTLS sertifikasının, SDP (Session Description Protocol) fingerprint özelliği ile karşılaştırıldığı ve doğrulama başarısız olursa medya akışının sonlandırıldığı, medya akışının özgünlüğünü sağlamak için doğrulanmalıdır. | 3 | + +## V17.3 Sinyalizasyon + +Bu bölüm, kendi WebRTC sinyalizasyon sunucularını işleten sistemler için güvenlik gereksinimlerini tanımlar. Sinyalizasyon, peer-to-peer iletişimi koordine eder ve oturum kurulumunu veya kontrolünü bozabilecek saldırılara karşı dayanıklı olmalıdır. + +Sinyalizasyonun güvenli olması için sistemler bozuk girdileri zararsız biçimde işleyebilmeli ve yük altında erişilebilir kalmalıdır. + +| # | Açıklama | Seviye | +| :---: | :--- | :---: | +| **17.3.1** | Sinyalizasyon sunucusunun, flood saldırısı altında bile meşru sinyalizasyon mesajlarını işlemeye devam edebildiği doğrulanmalıdır. Bu, sinyalizasyon düzeyinde oran sınırlaması uygulanarak sağlanmalıdır. | 2 | +| **17.3.2** | Sinyalizasyon sunucusunun, hizmet reddine yol açabilecek şekilde yapılandırılmış bozuk sinyalizasyon mesajlarıyla karşılaştığında bile meşru mesajları işlemeye devam edebildiği doğrulanmalıdır. Bu, girdi doğrulaması, integer overflow ve buffer overflow'a karşı savunma ve sağlam hata işleme teknikleri ile sağlanmalıdır. | 2 | + +## Referanslar + +Daha fazla bilgi için: + +* WebRTC DTLS ClientHello DoS hakkında en iyi dokümantasyonlar: [Enable Security's blog post aimed at security professionals](https://www.enablesecurity.com/blog/novel-dos-vulnerability-affecting-webrtc-media-servers/) ve ilgili, [WebRTC geliştiricilerine yönelik white paper](https://www.enablesecurity.com/blog/webrtc-hello-race-conditions-paper/) +* [RFC 3550 - RTP: A Transport Protocol for Real-Time Applications](https://www.rfc-editor.org/rfc/rfc3550) +* [RFC 3711 - The Secure Real-time Transport Protocol (SRTP)](https://datatracker.ietf.org/doc/html/rfc3711) +* [RFC 5764 - Datagram Transport Layer Security (DTLS) Extension to Establish Keys for the Secure Real-time Transport Protocol (SRTP))](https://datatracker.ietf.org/doc/html/rfc5764) +* [RFC 8825 - Overview: Real-Time Protocols for Browser-Based Applications](https://www.rfc-editor.org/info/rfc8825) +* [RFC 8826 - Security Considerations for WebRTC](https://www.rfc-editor.org/info/rfc8826) +* [RFC 8827 - WebRTC Security Architecture](https://www.rfc-editor.org/info/rfc8827) +* [DTLS-SRTP Protection Profiles](https://www.iana.org/assignments/srtp-protection/srtp-protection.xhtml) diff --git a/5.0/tr/0x90-Appendix-A_Glossary.md b/5.0/tr/0x90-Appendix-A_Glossary.md new file mode 100644 index 0000000000..1b1a1856f8 --- /dev/null +++ b/5.0/tr/0x90-Appendix-A_Glossary.md @@ -0,0 +1,88 @@ +# Ek A: Sözlük + +* **Absolute Maximum Session Lifetime (Mutlak Maksimum Oturum Ömrü)** – NIST tarafından “Genel Zaman Aşımı” olarak da adlandırılan bu süre, kullanıcı etkileşiminden bağımsız olarak kimlik doğrulamasının ardından bir oturumun etkin kalabileceği maksimum süredir. Bu, oturum sona erme süresinin bir bileşenidir. +* **Allowlist (İzin Listesi)** – İzin verilen veri veya işlemlerin listesi, örneğin girdi doğrulaması yapmak için izin verilen karakterlerin listesi. +* **Anti-forgery token** – Bir veya daha fazla belirtecin bir istekte geçirildiği ve isteğin beklenen bir uç noktadan geldiğinden emin olmak için uygulama sunucusu tarafından doğrulandığı bir mekanizmadır. +* **Application Security (Uygulama Güvenliği)** – Uygulama düzeyinde güvenlik, örneğin altta yatan işletim sistemine veya bağlı ağlara odaklanmak yerine Açık Sistemler Ara Bağlantı Referans Modeli'nin (Open Systems Interconnection Reference Model - OSI Model) uygulama katmanını oluşturan bileşenlerin analizine odaklanır. +* **Application Security Verification (Uygulama Güvenliği Doğrulaması)** – Bir uygulamanın OWASP ASVS'ye göre teknik değerlendirmesidir. +* **Application Security Verification Report (Uygulama Güvenliği Doğrulaması Raporu)** – Belirli bir uygulama için doğrulayıcı tarafından üretilen genel sonuçları ve destekleyici analizi belgeleyen bir rapordur. +* **Authentication (Kimlik Doğrulama)** – Bir uygulama kullanıcısının iddia ettiği kimliğinin doğrulanmasıdır. +* **Automated Verification (Otomatik Doğrulama)** – Sorunları bulmak için güvenlik açığı imzalarını kullanan otomatik araçların (dinamik analiz araçları, statik analiz araçları veya her ikisi) kullanılmasıdır. +* **Black box testing** – Bir uygulamanın iç yapılarına veya işleyişine bakmadan işlevselliğini inceleyen bir yazılım testi yöntemidir. +* **Common Weakness Enumeration** (CWE) – Yaygın yazılım güvenlik zayıflıklarının topluluk tarafından geliştirilen bir listesi. Ortak bir dil, yazılım güvenlik araçları için bir ölçüm kriteri ve zayıflık tanımlama, azaltma ve önleme çabaları için bir temel olarak hizmet eder. +* **Component (Bileşen)** – Diğer bileşenlerle iletişim kuran ilişkili disk ve ağ arayüzlerine sahip bağımsız bir kod birimidir. +* **Credential Service Provider (Kimlik Bilgisi Hizmet Sağlayıcısı)** (CSP) – Kimlik Sağlayıcısı ( Identity Provider - IdP) olarak da adlandırılır. Diğer uygulamalar tarafından kimlik doğrulama kaynağı olarak kullanılabilecek bir kullanıcı verisi kaynağıdır. +* **Cross-Site Script Inclusion (Siteler Arası Komut Dosyası Ekleme)** (XSSI) - Bir web uygulamasının harici bir kaynaktan kötü amaçlı kod aldığı ve bu kodu kendi içeriğinin bir parçası olarak dahil ettiği Siteler Arası Komut Çalıştırma (XSS) saldırısının bir çeşididir. +* **Cross-Site Scripting (Siteler Arası Komut Çalıştırma)** (XSS) – Genellikle web uygulamalarında bulunan ve istemci tarafı komut dosyalarının içeriğe eklenmesine izin veren bir güvenlik açığıdır. +* **Cryptographic module (Kriptografik modül)** – Kriptografik algoritmalar uygulayan ve/veya kriptografik anahtarlar üreten donanım, yazılım ve/veya ürün yazılımıdır. +* **Cryptographically secure pseudo-random number generator (Kriptografik olarak güvenli sözde rastgele sayı üreteci)** (CSPRNG) - Kriptografide kullanıma uygun özelliklere sahip bir sözde rastgele sayı üreteci, kriptografik rastgele sayı üreteci (CRNG) olarak da adlandırılır. +* **Datagram Transport Layer Security (Datagram Taşıma Katmanı Güvenliği)** (DTLS) – Bir ağ bağlantısı üzerinden iletişim güvenliği sağlayan bir kriptografik protokoldür. TLS protokolüne dayanır ancak datagram odaklı protokolleri (genellikle UDP üzerinden) korumak için uyarlanmıştır. DTLS 1.3 için RFC 9147'de tanımlanmıştır. +* **Datagram Transport Layer Security Extension to Establish Keys for the Secure Real-time Transport Protocol (Güvenli Gerçek Zamanlı Aktarım Protokolü Anahtarlarını Oluşturmak için Datagram Aktarım Katmanı Güvenlik Uzantısı)** (DTLS-SRTP) – Bir SRTP oturumu için anahtar materyali oluşturmak üzere DTLS el sıkışmasını kullanmaya yönelik bir mekanizmadır. RFC 5764'te tanımlanmıştır. +* **Design Verification (Tasarım Doğrulama)** – Bir uygulamanın güvenlik mimarisinin teknik değerlendirmesidir. +* **Dynamic Application Security Testing (Dinamik Uygulama Güvenlik Testi)** (DAST) – Bir uygulamadaki güvenlik açığını gösteren koşulları, uygulamanın çalışır durumunda tespit etmek için tasarlanan teknolojilerdir. +* **Dynamic Verification (Dinamik Doğrulama)** – Bir uygulamanın çalışması sırasında sorunları tespit etmek için güvenlik açığı imzalarını kullanan otomatik araçların kullanımıdır. +* **Fast IDentity Online** (FIDO) – Biyometri, Güvenilir Platform Modülü (Trusted Platform Modules - TPM), USB güvenlik token’ları gibi çeşitli kimlik doğrulama yöntemlerinin kullanımına olanak tanıyan bir kimlik doğrulama standartları kümesidir. +* **Hardware Security Module (Donanım Güvenlik Modülü)** (HSM) – Kriptografik anahtarları ve diğer gizli verileri korumalı şekilde saklayan donanım bileşenidir. +* **Hibernate Query Language** (HQL) – Hibernate ORM kütüphanesi tarafından kullanılan, görünüm olarak SQL’e benzeyen bir sorgu (query) dilidir. +* **HTTP Strict Transport Security (HTTP Sıkı Taşıma Güvenliği)** (HSTS) – Tarayıcının yalnızca TLS üzerinden ve geçerli bir sertifika ile yanıt dönen alan adına bağlanmasını zorunlu kılan bir ilkedir. `Strict-Transport-Security` header field ile etkinleştirilir. +* **HyperText Transfer Protocol** (HTTP) – Dağıtık, işbirlikçi, çok ortamlı bilgi sistemleri için bir uygulama protokolüdür. Dünya Çapında Ağ (WWW) veri iletişiminin temelini oluşturur. +* **SSL/TLS üzerinden HyperText Transfer Protocol** (HTTPS) – HTTP iletişimini Taşıma Katmanı Güvenliği (TLS) ile şifreleyerek güvenli hale getirme yöntemidir. +* **Identity Provider (Kimlik Sağlayıcı)** (IdP) – NIST belgelerinde Kimlik Bilgisi Hizmet Sağlayıcısı (CSP) olarak da adlandırılır. Diğer uygulamalar için kimlik doğrulama kaynağı sağlayan bir varlıktır. +* **Inactivity Timeout (Etkin Olmama Zaman Aşımı)** – Bir oturumun, kullanıcı uygulama ile etkileşime girmediği sürede aktif kalabileceği süredir. Oturum zaman aşımının bir bileşenidir. +* **Input Validation (Girdi Doğrulama)** – RFC 7519 tarafından tanımlanan ve bir başlık (doğrulama yöntemini belirtir), bir gövde (iddiaları içerir) ve bir imza (gövdeyi doğrulamak için kullanılır) olmak üzere üç bölümden oluşan bir JSON veri nesnesidir. Kendi kendini içeren bir token (self-contained token) türüdür. +* **Local File Inclusion** (LFI) - Bir uygulamadaki savunmasız dosya dahil etme işlemlerinin sömürülmesiyle, sunucuda hâlihazırda bulunan yerel dosyaların dahil edilmesine yol açan saldırı türüdür. +* **Malicious Code (Kötü Amaçlı Kod)** – Uygulamanın geliştirme aşamasında uygulama sahibinin bilgisi dışında eklenen ve uygulamanın tasarlanan güvenlik politikasını aşmayı amaçlayan koddur. Virüs veya solucan gibi kötü amaçlı yazılımlardan (malware) farklıdır! +* **Malware (Kötü Amaçlı Yazılım)** – Uygulama çalışırken, kullanıcı veya yönetici farkında olmadan uygulamaya enjekte edilen çalıştırılabilir koddur. +* **Message authentication code (Mesaj Doğrulama Kodu)** (MAC) - Verinin bütünlüğünü ve özgünlüğünü sağlamak amacıyla bir MAC üretim algoritmasıyla hesaplanan kriptografik sağlama (checksum) değeridir. +* **Multi-factor authentication (Çok Faktörlü Kimlik Doğrulama)** (MFA) – İki veya daha fazla tekil faktörün bir arada kullanıldığı kimlik doğrulama yöntemidir. +* **Mutual TLS** (mTLS) – Bkz. TLS istemci kimlik doğrulaması. +* **Object-relational Mapping** (ORM) – İlişkisel (tablolu) bir veritabanının, uygulama içinde nesne tabanlı bir model üzerinden referans alınmasını ve sorgulanmasını sağlayan sistemdir. +* **One-time Password (Tek Kullanımlık Parola)** (OTP) – Sadece tek bir kullanım için benzersiz olarak üretilen paroladır. +* **Open Worldwide Application Security Project** (OWASP) – Uygulama yazılımlarının güvenliğini geliştirmeye odaklı, küresel ve açık bir topluluktur. Misyonu, uygulama güvenliğini “görünür” kılmak ve bireyler ile kurumların güvenlik risklerine dair bilinçli kararlar verebilmesini sağlamaktır. Bkz: [https://www.owasp.org/](https://www.owasp.org/). +* **Password-Based Key Derivation Function 2** (PBKDF2) – Bir giriş metninden (örn. parola) ve rastgele bir tuz (salt) değerinden güçlü bir kriptografik anahtar türeten, tek yönlü özel bir algoritmadır. Sonuç değeri özgün parola yerine saklandığında, parolanın çevrimdışı ortamda kırılmasını zorlaştırmak amacıyla kullanılır. +* **Public Key Infrastructure (Açık Anahtar Altyapısı)** (PKI) – Açık anahtarların ilgili varlıkların kimlikleriyle ilişkilendirilmesini sağlayan bir yapıdır. Bu ilişkilendirme, bir sertifika otoritesi (CA) tarafından gerçekleştirilen kayıt ve sertifika oluşturma süreciyle sağlanır. +* **Public Switched Telephone Network (Genel Anahtarlamalı Telefon Ağı)** (PSTN) – Sabit hatlı ve mobil telefonları içeren geleneksel telefon ağıdır. +* **Real-time Transport Protocol (Gerçek Zamanlı Taşıma Protokolü)** (RTP) ve **Real-time Transport Control Protocol (Gerçek Zamanlı Taşıma Denetim Protokolü)** (RTCP) – Multimedya akışlarını taşımak için birlikte kullanılan iki protokoldür. WebRTC yığını tarafından kullanılır. RFC 3550’de tanımlanmıştır. +* **Reference Token** – Sunucuda tutulan duruma veya meta veriye işaret eden veya onu tanımlayan, bazen rastgele veya opak token olarak da adlandırılan bir token türüdür. Kendi kendini içeren token’lardan farklı olarak, içeriğinde anlamlı bilgi taşımaz ve bağlam tamamen sunucu tarafından sağlanır. Genellikle bir oturum tanımlayıcısı içerir veya doğrudan bu tanımlayıcıyı temsil eder. +* **Relying Party** (RP) – Genellikle, kullanıcının ayrı bir kimlik sağlayıcı ile kimlik doğrulaması yaptığına güvenen bir uygulamadır. Bu uygulama, kullanıcıya ait olduğunu doğrulamak için kimlik sağlayıcı tarafından sağlanan bir token’a veya imzalı beyanlara dayanır. +* **Remote File Inclusion** (RFI) - Uygulamadaki zafiyet içeren dosya dahil etme işlemlerinin sömürülmesiyle, uzak sistemlerden dosya dahil edilmesine yol açan saldırı türüdür. +* **Scalable Vector Graphics** (SVG) – İki boyutlu vektör grafiklerini tanımlamak için kullanılan, XML tabanlı bir işaretleme dilidir. +* **Secure Real-time Transport Protocol (Güvenli Gerçek Zamanlı Taşıma Protokolü)** (SRTP) and **Secure Real-time Transport Control Protocol (Güvenli Gerçek Zamanlı Taşıma Denetim Protokolü)** (SRTCP) – RTP ve RTCP protokollerinin, mesaj şifreleme, kimlik doğrulama ve bütünlük koruması desteği sunan güvenli sürümleridir. RFC 3711’de tanımlanmıştır. +* **Security Architecture (Güvenlik Mimarisi)** – Uygulamanın tasarımına dair bir soyutlamadır. Güvenlik kontrollerinin nerede ve nasıl kullanıldığını, kullanıcı ve uygulama verilerinin nerede bulunduğunu ve hassasiyet seviyelerini tanımlar. +* **Security Assertion Markup Language** (SAML) – Kimlik sağlayıcı ile güvenen taraf arasında imzalı beyanların (genellikle XML nesneleri) iletilmesine dayalı, açık bir tek oturum açma (SSO) standardıdır. +* **Security Configuration (Güvenlik Yapılandırması)** – Uygulamanın çalışma zamanında, güvenlik kontrollerinin nasıl kullanılacağını etkileyen yapılandırma bilgileridir. +* **Security Control (Güvenlik Kontrolü)** – Bir güvenlik denetimi gerçekleştiren (örn. yetkilendirme kontrolü) ya da çağrıldığında güvenlikle ilgili bir etki oluşturan (örn. denetim kaydı üretme) işlev veya bileşendir. +* **Security information and event management** (SIEM) - Bir kuruluşun BT altyapısından gelen güvenlik verilerini toplayarak tehdit tespiti, uyumluluk ve olay yönetimi amacıyla analiz eden bir sistemdir. +* **Self-Contained Token (Kendi İçinde Taşıyıcı Token)** – Herhangi bir sunucu tarafı duruma veya harici saklamaya bağımlı olmayan, bir veya birden fazla niteliği içinde barındıran token’dır. Bu token’lar, içeriklerinin doğruluğunu ve bütünlüğünü sağlamak için dijital imza veya ileti doğrulama kodu (MAC) gibi kriptografik tekniklerle korunur. Örnekler: SAML beyanları, JWT. +* **Server-side Request Forgery** (SSRF) – Sunucudaki işlevselliğin suistimal edilerek iç kaynakların okunması veya güncellenmesi ile sonuçlanan saldırı türüdür. Saldırgan, sunucu üzerinde çalışacak olan URL’yi doğrudan sağlar ya da değiştirir. +* **Session Description Protocol** (SDP) – Multimedya oturumu kurulumunda kullanılan bir mesaj formatıdır (örneğin WebRTC'de kullanılır). RFC 4566’da tanımlanmıştır. +* **Session Identifier** veya **Session ID** – Backend'de saklanan durumlu bir oturumu tanımlayan anahtardır. İstemciye, doğrudan veya bir Referans Token içinde aktarılır. +* **Session Token** – Bu standartta, self-contained token kullanan ve durum barındırmayan oturum mekanizmalarında ya da reference token kullanan ve durum barındıran mekanizmalarda kullanılan token veya değeri ifade eden genel bir terimdir. +* **Session Traversal Utilities for NAT** (STUN) – Eşler arası iletişim kurmak amacıyla NAT geçişine yardımcı olan bir protokoldür. RFC 3489’da tanımlanmıştır. +* **Single-factor authenticator (Tek Faktörlü Kimlik Doğrulayıcı)** – Kullanıcının kimliğini doğrulamak için kullanılan mekanizmadır. Bu mekanizma ya bilinen bir şey (parolalar, PIN’ler), ya sahip olunan bir şey (OTP token’ları, akıllı kart gibi kriptografik cihazlar), ya da kullanıcıya özgü bir şey (biyometrik veriler, parmak izi, yüz taraması) olmalıdır. +* **Single Sign-on Authentication (Tek Oturum Açma)** (SSO) – Kullanıcının bir uygulamaya giriş yaptıktan sonra, ek bir kimlik doğrulama gerekmeksizin diğer uygulamalara da otomatik olarak giriş yapabilmesidir. Örneğin, Google hesabına giriş yapan bir kullanıcı, YouTube, Google Dokümanlar ve Gmail’e de otomatik olarak erişim sağlar. +* **Software bill of materials (Yazılım Bileşen Listesi)** (SBOM) - Bir yazılım uygulamasını oluşturmak veya birleştirmek için gerekli tüm bileşenlerin, modüllerin, kütüphanelerin, çatıların (framework) ve diğer kaynakların yapılandırılmış ve kapsamlı bir listesidir. +* **Software Composition Analysis** (SCA) – Uygulamanın bileşimini, bağımlılıklarını, kütüphanelerini ve paketlerini analiz ederek kullanılan belirli bileşen sürümlerindeki güvenlik açıklarını tespit etmeye yönelik teknolojiler bütünüdür. Kaynak kod analizi (SAST) ile karıştırılmamalıdır. +* **Software development lifecycle** (SDLC) – Yazılımın, ilk gereksinimlerden dağıtım ve bakıma kadar geçen süreçte adım adım geliştirilmesini tanımlayan modeldir. +* **SQL Injection** (SQLi) – Veri odaklı uygulamalara yönelik bir kod enjeksiyon tekniğidir. Kötü niyetli SQL ifadeleri bir giriş noktasına enjekte edilir. +* **Stateful Session Mechanism** – Oturum durumunun backend'de tutulduğu oturum yönetim biçimidir. Genellikle kriptografik olarak güvenli sahte rastgele sayı üreteci (CSPRNG) ile oluşturulmuş bir oturum token’ı son kullanıcıya verilir. +* **Stateless Session Mechanism** – Hizmet tarafından saklanmayan, oturum bilgilerini taşıyan kendi kendini içeren bir token’ın istemcilere iletildiği mekanizmadır. Gerçekte, hizmetin belirli güvenlik kontrollerini uygulayabilmesi için (örneğin JWT iptal listesi gibi) oturum bilgilerine kısmen erişmesi gerekebilir. +* **Static application security testing (Statik Uygulama Güvenlik Testi)** (SAST) – Uygulamanın kaynak kodunu, bayt kodunu ve ikili dosyalarını çalışmayan (non-running) durumda analiz ederek güvenlik açıklarını ortaya çıkaran teknolojiler bütünüdür. Uygulamayı "içeriden dışarı" analiz eder. +* **Threat Modeling (Tehdit Modelleme)** – Tehdit aktörleri, güvenlik bölgeleri, güvenlik kontrolleri ile teknik ve iş varlıklarını tanımlamak amacıyla gittikçe rafine edilen güvenlik mimarilerinin geliştirilmesini içeren bir tekniktir. +* **Time-of-check to time-of-use (Denetim Zamanı ile Kullanım Zamanı Arasındaki Süre)** (TOCTOU) – Bir kaynağın durumu uygulama tarafından kullanılmadan önce kontrol edilir, fakat bu durum kontrol ile kullanım arasında değişebilir. Bu da kontrolün geçersiz hale gelmesine ve yanlış işlemlerin gerçekleştirilmesine neden olabilir. +* **Time based One-time Passwords (Zamana Dayalı Tek Kullanımlık Parola)** (TOTPs) - Şifreyi üretmek için algoritmada mevcut zamanın kullanıldığı bir OTP üretim yöntemidir. +* **TLS client authentication (TLS İstemci Kimlik Doğrulaması)** veya **Mutual TLS (Karşılıklı TLS)** (mTLS) – Standart bir TLS bağlantısında istemci, sunucunun kimliğini sunucu sertifikası ile doğrular. TLS istemci kimlik doğrulamasında ise istemci de kendi özel anahtarı ve sertifikası ile kendi kimliğini sunucuya doğrulatır. +* **Transport Layer Security (Taşıma Katmanı Güvenliği)** (TLS) – Ağ üzerinden güvenli iletişim sağlamak için kullanılan kriptografik protokoller bütünüdür. +* **Traversal Using Relays around NAT (NAT Etrafında Aktarıcılar Kullanılarak Geçiş )** (TURN) – Eşler arası doğrudan bağlantılar kurulamadığında, bir TURN sunucusu aracılığıyla veri iletimi yapılmasını sağlayan STUN protokolünün bir uzantısıdır. RFC 8656’da tanımlanmıştır. +* **Trusted execution environment (Güvenli Yürütme Ortamı)** (TEE) - Sistemin geri kalanından izole bir işlem ortamında uygulamaların güvenli bir şekilde çalıştırılabildiği özel bir alan. +* **Trusted Platform Module (Güvenilir Platform Modülü)** (TPM) – Genellikle anakart gibi daha büyük donanımlara bağlı olan, sistemin “güven kökü (root of trust)” olarak görev yapan HSM türüdür. +* **Trusted Service Layer (Güvenilir Hizmet Katmanı)** – Mikro servis, sunucusuz API, sunucu tarafı, güvenli önyüklemeli istemci API’si, ortak veya harici API’ler gibi, bir güvenlik kontrolü uygulayan ve kötü niyetli kullanıcıların atlayamayacağı katmanlardır. +* **Uniform Resource Identifier** (URI)- Web sayfası, e-posta adresi veya konum gibi bir kaynağı tanımlayan benzersiz karakter dizisidir. +* **Uniform Resource Locator** (URL) – İnternette bir kaynağın konumunu belirten karakter dizisidir. +* **Universally Unique Identifier (Evrensel Benzersiz Tanımlayıcı)** (UUID) – Yazılımlarda kimlik belirleme amacıyla kullanılan benzersiz referans numarasıdır. +* **Verifier (Doğrulayıcı)** – Bir uygulamayı OWASP ASVS gereksinimlerine göre inceleyen kişi veya ekip. +* **Web Real-Time Communication** (WebRTC) – Web uygulamalarında genellikle görüntülü görüşme amacıyla kullanılan, multimedya akışlarını taşıyan protokol yığını ve web API’sidir. SRTP, SRTCP, DTLS, SDP ve STUN/TURN üzerine kuruludur. +* **WebSocket over TLS** (WSS) – WebSocket iletişimini TLS protokolü ile katmanlayarak güvenli hale getirme uygulamasıdır. +* **What You See Is What You Get** (WYSIWYG) – İçeriğin nasıl görüntüleneceğini doğrudan düzenleme sırasında gösteren zengin metin düzenleyicisidir. Kod görünümü yerine gerçek görünümü gösterir. +* **X.509 Certificate** – Uluslararası X.509 açık anahtar altyapısı (PKI) standardını kullanan ve bir açık anahtarın sertifikada yer alan kullanıcıya, bilgisayara veya hizmete ait olduğunu doğrulayan dijital sertifikadır. +* **XML eXternal Entity** (XXE) – Sistem tanımlayıcısı ile yerel veya uzak içeriğe erişebilen XML varlığı türüdür. Farklı enjeksiyon saldırılarına neden olabilir. diff --git a/5.0/tr/0x91-Appendix-B_References.md b/5.0/tr/0x91-Appendix-B_References.md new file mode 100644 index 0000000000..125eda58aa --- /dev/null +++ b/5.0/tr/0x91-Appendix-B_References.md @@ -0,0 +1,43 @@ +# Ek B: Referanslar + +Aşağıdaki OWASP projeleri, bu standardın kullanıcıları/uygulayıcıları için yararlı olabilir: + +## OWASP Ana Projeleri + +1. OWASP Top 10 Project: [https://owasp.org/www-project-top-ten/](https://owasp.org/www-project-top-ten/) +2. OWASP Web Security Testing Guide: [https://owasp.org/www-project-web-security-testing-guide/](https://owasp.org/www-project-web-security-testing-guide/) +3. OWASP Proactive Controls: [https://owasp.org/www-project-proactive-controls/](https://owasp.org/www-project-proactive-controls/) +4. OWASP Software Assurance Maturity Model (SAMM): [https://owasp.org/www-project-samm/](https://owasp.org/www-project-samm/) +5. OWASP Secure Headers Project: [https://owasp.org/www-project-secure-headers/](https://owasp.org/www-project-secure-headers/) + +## OWASP Cheat Sheet Series Projesi + +[Bu proje](https://owasp.org/www-project-cheat-sheets/) ASVS'deki farklı konularla ilgili olacak birkaç cheat sheet'e sahiptir. + +ASVS ile ilgili bir haritalandırmaya buradan ulaşabilirsiniz: [https://cheatsheetseries.owasp.org/IndexASVS.html](https://cheatsheetseries.owasp.org/IndexASVS.html) + +## Mobil Güvenlikle İlgili Projeler + +1. OWASP Mobile Security Project: [https://owasp.org/www-project-mobile-security/](https://owasp.org/www-project-mobile-security/) +2. OWASP Mobile Top 10 Risks: [https://owasp.org/www-project-mobile-top-10/](https://owasp.org/www-project-mobile-top-10/) +3. OWASP Mobile Security Testing Guide and Mobile Application Security Verification Standard: [https://owasp.org/www-project-mobile-security-testing-guide/](https://owasp.org/www-project-mobile-security-testing-guide/) + +## OWASP Nesnelerin İnterneti (Internet of Things) İle İlgili Projeler + +1. OWASP Internet of Things Project: [https://owasp.org/www-project-internet-of-things/](https://owasp.org/www-project-internet-of-things/) + +## OWASP Serverless Projeleri + +1. OWASP Serverless Project: [https://owasp.org/www-project-serverless-top-10/](https://owasp.org/www-project-serverless-top-10/) + +## Diğerleri + +Benzer şekilde, aşağıdaki web siteleri de bu standardın kullanıcıları/uygulayıcıları için yararlı olabilir: + +1. SecLists Github: [https://github.com/danielmiessler/SecLists](https://github.com/danielmiessler/SecLists) +2. MITRE Common Weakness Enumeration: [https://cwe.mitre.org/](https://cwe.mitre.org/) +3. PCI Security Standards Council: [https://www.pcisecuritystandards.org/](https://www.pcisecuritystandards.org/) +4. PCI Data Security Standard (DSS) v3.2.1 Requirements and Security Assessment Procedures: [https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf](https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf) +5. PCI Software Security Framework - Secure Software Requirements and Assessment Procedures: [https://www.pcisecuritystandards.org/documents/PCI-Secure-Software-Standard-v1_0.pdf](https://www.pcisecuritystandards.org/documents/PCI-Secure-Software-Standard-v1_0.pdf) +6. PCI Secure Software Lifecycle (Secure SLC) Requirements and Assessment Procedures: [https://www.pcisecuritystandards.org/documents/PCI-Secure-SLC-Standard-v1_0.pdf](https://www.pcisecuritystandards.org/documents/PCI-Secure-SLC-Standard-v1_0.pdf) +7. OWASP ASVS 4.0 Testing Guide [https://github.com/BlazingWind/OWASP-ASVS-4.0-testing-guide](https://github.com/BlazingWind/OWASP-ASVS-4.0-testing-guide) diff --git a/5.0/tr/0x92-Appendix-C_Cryptography.md b/5.0/tr/0x92-Appendix-C_Cryptography.md new file mode 100644 index 0000000000..4607b0d780 --- /dev/null +++ b/5.0/tr/0x92-Appendix-C_Cryptography.md @@ -0,0 +1,312 @@ +# Ek C: Kriptografi Standartları + +“Kriptografi” bölümü sadece en iyi uygulamaları tanımlamanın ötesine geçmektedir. Kriptografi ilkelerinin daha iyi anlaşılmasını ve daha esnek, modern güvenlik yöntemlerinin benimsenmesini teşvik etmeyi amaçlamaktadır. Bu ek, “Kriptografi” bölümünde ana hatlarıyla belirtilen kapsayıcı standartları tamamlayan her bir gereklilikle ilgili ayrıntılı teknik bilgi sağlamaktadır. + +Bu ek, farklı kriptografik mekanizmalar için onay seviyesini tanımlar: + +* Onaylanmış (A) mekanizmalar uygulamalarda kullanılabilir. +* Eski (Legacy) mekanizmalar (L) uygulamalarda kullanılmamalıdır, ancak yine de yalnızca mevcut eski uygulamalar veya kodlarla uyumluluk için kullanılabilir. Bu tür mekanizmaların kullanımı şu anda kendi başına bir güvenlik açığı olarak kabul edilmese de, mümkün olan en kısa sürede daha güvenli ve geleceğe dönük mekanizmalarla değiştirilmelidir. +* İzin verilmeyen (Disallowed) mekanizmalar (D) şu anda bozuk kabul edildikleri veya yeterli güvenlik sağlamadıkları için kullanılmamalıdır. + +Bu liste, belirli bir uygulama bağlamında, aşağıdakiler de dahil olmak üzere çeşitli nedenlerle geçersiz kılınabilir: + +* kriptografi alanındaki yeni gelişmeler; +* yönetmeliklere uygunluk. + +## Kriptografik Envanter ve Dokümantasyon + +Bu bölüm V11.1 Kriptografik Envanter +ve Dokümantasyon için ek bilgi sağlamaktadır. + +Algoritmalar, anahtarlar ve sertifikalar gibi tüm kriptografik varlıkların düzenli olarak keşfedildiğinden, envanterinin çıkarıldığından ve değerlendirildiğinden emin olmak önemlidir. Seviye 3 için bu, bir uygulamada kriptografi kullanımını keşfetmek için statik ve dinamik tarama kullanımını içermelidir. SAST ve DAST gibi araçlar bu konuda yardımcı olabilir, ancak daha geniş bir kapsam elde etmek için özel araçlara ihtiyaç duyulması mümkündür. Ücretsiz araç örnekleri şunları içerir: + +* [CryptoMon - Network Cryptography Monitor - using eBPF, written in python](https://github.com/Santandersecurityresearch/CryptoMon) +* [Cryptobom Forge Tool: Generating Comprehensive CBOMs from CodeQL Outputs](https://github.com/Santandersecurityresearch/cryptobom-forge) + +## Kriptografik Parametrelerin Eşdeğer Güçleri + +Çeşitli kriptografik sistemler için göreceli güvenlik güçleri bu tabloda yer almaktadır: [NIST SP 800-57 Kısım 1, syf.71](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final) + +| Güvenlik Gücü | Simetrik Anahtar Algoritmaları | Sonlu Alan | Tamsayı Çarpanlarına Ayırma | Eliptik Eğri (Elliptic Curve) | +|--|--|--|--|--| +| <= 80 | 2TDEA | L = 1024
N = 160 | k = 1024 | f = 160-223 | +| 112 | 3TDEA | L = 2048
N = 224 | k = 2048 | f = 224-255 | +| 128 | AES-128 | L = 3072
N = 256 | k = 3072 | f = 256-383 | +| 192 | AES-192 | L = 7680
N = 384 | k = 7680 | f = 384-511 | +| 256 | AES-256 | L = 15360
N = 512 | k = 15360 | f = 512+ | + +Uygulama örnekleri şunlardır: + +* Sonlu Alan Kriptografisi (Finite Field Cryptography): DSA, FFDH, MQV +* Tamsayı Çarpanlarına Ayırma Kriptografisi (Integer Factorization Cryptography): RSA +* Eliptik Eğri Kriptografisi (Elliptic Curve Cryptography): ECDSA, EdDSA, ECDH, MQV + +Not: Bu bölümde kuantum bilgisayarlarının var olmadığı varsayılmaktadır. Eğer böyle bir bilgisayar var olsaydı, son 3 sütun için yapılan tahminler artık geçerli olmazdı. + +## Rastgele Değerler + +Bu bölümde V11.5 Rastgele Değerler +için ek bilgi sağlanmaktadır. + +| İsim | Sürüm/Referans | Notlar | Durum | +|:---|:----|:----|:-:| +| `/dev/random` | Linux 4.8+ [(Oct 2016)](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=818e607b57c94ade9824dad63a96c2ea6b21baf3), , iOS, Android ve diğer Linux tabanlı POSIX işletim sistemlerinde de bulunur. [RFC7539](https://datatracker.ietf.org/doc/html/rfc7539) temel alınmıştır. | ChaCha20 akışını kullanır. iOS [`SecRandomCopyBytes`](https://developer.apple.com/documentation/security/secrandomcopybytes(_:_:_:)?language=objc) ve Android [`Secure Random`](https://developer.android.com/reference/java/security/SecureRandom) içinde her biri için sağlanan doğru ayarlarla bulunur.| A | +| `/dev/urandom` | Linux çekirdeğinin rastgele veri sağlamak için özel dosyası | Donanım rastgeleliğinden gelen yüksek kaliteli, entropi kaynakları sağlar | A | +| `AES-CTR-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | [Windows CNG API `BCryptGenRandom`](https://learn.microsoft.com/en-us/windows/win32/api/bcrypt/nf-bcrypt-bcryptgenrandom) gibi yaygın uygulamalarda kullanıldığı gibi, [`BCRYPT_RNG_ALGORITHM`](https://learn.microsoft.com/en-us/windows/win32/seccng/cng-algorithm-identifiers) tarafından ayarlanır. | A | +| `HMAC-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | | A | +| `Hash-DRBG` | [NIST SP800-90A](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf) | | A | +| `getentropy()` | [OpenBSD](https://man.openbsd.org/getentropy.2), [Linux glibc 2.25+](https://man7.org/linux/man-pages/man3/getentropy.3.html) ve [macOS 10.12+](https://support.apple.com/en-gb/guide/security/seca0c73a75b/web) sürümlerinde mevcuttur. | Doğrudan çekirdeğin entropi kaynağından basit ve minimal bir API ile güvenli rastgele baytlar sağlar. Daha moderndir ve eski API'lerle ilişkili tuzaklardan kaçınır. | A | + +HMAC-DRBG veya Hash-DRBG ile kullanılan temel hash fonksiyonu, bu kullanım için onaylanmış olmalıdır. + +## Şifre (Cipher) Algoritmaları + +Bu bölüm V11.3 Şifreleme Algoritmaları +için ek bilgi sağlar. + +Onaylanan şifre algoritmaları tercih sırasına göre listelenmiştir. + +| Simetrik Anahtar Algoritmaları | Referans | Durum | +| ------ | ------ |:-:| +| AES-256 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | A | +| Salsa20 | [Salsa 20 specification](https://cr.yp.to/snuffle/spec.pdf) | A | +| XChaCha20 | [XChaCha20 Draft](https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-xchacha-03) | A | +| XSalsa20 | [Extending the Salsa20 nonce](https://cr.yp.to/snuffle/xsalsa-20110204.pdf) | A | +| ChaCha20 | [RFC 8439](https://www.rfc-editor.org/info/rfc8439) | A | +| AES-192 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | A | +| AES-128 | [FIPS 197](https://csrc.nist.gov/pubs/fips/197/final) | L | +| 2TDEA | | D | +| TDEA (3DES/3DEA) | | D | +| IDEA | | D | +| RC4 | | D | +| Blowfish| | D | +| ARC4 | | D | +| DES | | D | + +### AES Şifre Modları + +AES gibi blok şifreler farklı işlem modları ile kullanılabilir. Elektronik kod kitabı (Electronic codebook - ECB) gibi birçok işlem modu güvensizdir ve kullanılmamalıdır. Galois/Counter Modu (Galois/Counter Mode - GCM) ve şifre blok zincirleme mesaj kimlik doğrulama kodlu Sayaç (CCM) işlem modları, kimliği doğrulanmış şifreleme sağlar ve modern uygulamalarda kullanılmalıdır. + +Onaylanan modlar tercih sırasına göre listelenmiştir. + +| Mod | Kimliği Doğrulanmış | Referans | Durum | Kısıtlama | +|--|--|--|--|--| +| GCM | Evet | [NIST SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | | +| CCM | Evet | [NIST SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | | +| CBC | Hayır | [NIST SP 800-38A](https://csrc.nist.gov/pubs/sp/800/38/a/final) | L | | +| CCM-8 | Evet | | D | | +| ECB | Hayır | | D | | +| CFB | Hayır | | D | | +| OFB | Hayır | | D | | +| CTR | Hayır | | D | | + +Notlar: + +* Tüm şifrelenmiş mesajların kimliği doğrulanmalıdır. CBC modunun herhangi bir kullanımı için, mesajı doğrulamak üzere ilişkili bir karma MAC algoritması olmalıdır. Genel olarak bu, Encrypt-Then-Hash yönteminde uygulanmalıdır (ancak TLS 1.2 bunun yerine Hash-Then-Encrypt kullanır). Eğer bu garanti edilemiyorsa, CBC kullanılmamalıdır. MAC algoritması olmadan şifrelemeye izin verilen tek uygulama disk şifrelemedir. +* Eğer CBC kullanıldıysa, padding doğrulanmasının sabit zamanda gerçekleştirildiği garanti edilmelidir. +* CCM-8 kullanıldığında, MAC etiketi yalnızca 64 bit güvenliğe sahiptir. Bu, en az 128 bit güvenlik gerektiren gereksinim 6.2.9 ile uyumlu değildir. +* Disk şifrelemenin ASVS için kapsam dışı olduğu düşünülmektedir. Bu nedenle bu ekte disk şifreleme için onaylanmış herhangi bir yöntem listelenmemiştir. Bu kullanım için, kimlik doğrulama olmadan şifreleme genellikle kabul edilir ve XTS, XEX ve LRW modları tipik olarak kullanılır. + +### Anahtar Sarma (Key Wrapping) + +Kriptografik anahtar sarma (ve buna karşılık gelen anahtar açma), mevcut bir anahtarı ek bir şifreleme mekanizması kullanarak kapsülleyerek (yani sararak) koruma yöntemidir. Böylece orijinal anahtar, örneğin bir aktarım sırasında açıkça ortaya çıkmaz. Orijinal anahtarı korumak için kullanılan bu ek anahtar sarma anahtarı (wrap key) olarak adlandırılır. + +Bu işlem, güvenilmez olduğu düşünülen yerlerdeki anahtarları korumak veya hassas anahtarları güvenilmeyen ağlar üzerinden ya da uygulamalar içinde göndermek istendiğinde gerçekleştirilebilir. +Ancak, bir sarma/açma prosedürüne girişmeden önce orijinal anahtarın doğasını (örn. kimliği ve amacı) anlamaya ciddi önem verilmelidir, çünkü bunun hem kaynak hem de hedef sistemler/uygulamalar için güvenlik ve özellikle de bir anahtarın işlevinin (örn. imzalama) denetim izlerini ve uygun anahtar depolamayı içerebilecek uyumluluk açısından yansımaları olabilir. + +Özellikle, [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) uyarınca ve kuantum tehdidine karşı ileriye dönük hükümler göz önünde bulundurularak, anahtar sarma için AES-256 kullanılmalıdır. AES kullanan şifre modları tercih sırasına göre şunlardır: + +| Anahtar Sarma | Referans | Durum | +|--|--|--| +| KW | [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) | A | +| KWP | [NIST SP 800-38F](https://csrc.nist.gov/pubs/sp/800/38/f/final) | A | + +Kullanım durumu gerektiriyorsa AES-192 ve AES-128 kullanılabilir. Ancak bunun sebebi ve amacı, kuruluşun kriptografi envanterinde belgelenmelidir. + +### Kimlik Doğrulamalı Şifreleme + +Disk şifreleme haricinde, şifrelenmiş veriler bir çeşit kimliği doğrulanmış şifreleme (authenticated encryption - AE) şeması kullanılarak, genellikle ilişkili verilerle kimliği doğrulanmış şifreleme (authenticated encryption with associated data - AEAD) şeması kullanılarak yetkisiz değişikliklere karşı korunmalıdır. + +Uygulama tercihen onaylı bir AEAD şeması kullanmalıdır. Alternatif olarak onaylı bir şifreleme şeması ile onaylı bir MAC algoritmasını bir Encrypt-then-MAC yapısıyla birleştirebilir. + +MAC-then-encrypt'e eski uygulamalarla uyumluluk için hala izin verilmektedir. TLS v1.2'de eski şifre takımları ile kullanılır. + +| AEAD mekanizması | Referans | Durum | +|---|---------|:-:| +|AES-GCM | [SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final) | A | +|AES-CCM | [SP 800-38C](https://csrc.nist.gov/pubs/sp/800/38/c/upd1/final) | A | +|ChaCha-Poly1305 | [RFC 7539](https://datatracker.ietf.org/doc/html/rfc7539) | A | +|AEGIS-256 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +|AEGIS-128 | [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +|AEGIS-128L| [AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)](https://competitions.cr.yp.to/round3/aegisv11.pdf) | A | +|Encrypt-then-MAC | | A | +|MAC-then-encrypt | | L | + +## Hash Fonksiyonları + +Bu bölümde V11.4 Hashing ve Hash Tabanlı Fonksiyonlar +için ek bilgiler sağlanmaktadır. + +### Genel Kullanım Durumları için Hash Fonksiyonları + +Aşağıdaki tabloda, dijital imzalar gibi genel kriptografik kullanım durumlarında onaylanan hash fonksiyonları listelenmektedir: + +* Onaylanan hash fonksiyonları güçlü çakışma (collision) direnci sağlar ve yüksek güvenlikli uygulamalar için uygundur. +* Bu algoritmalardan bazıları uygun kriptografik anahtar yönetimi ile kullanıldığında saldırılara karşı güçlü direnç sunar ve bu nedenle HMAC, KDF ve RBG işlevleri için ek olarak onaylanmıştır. +* 254 bitten daha az çıktıya sahip hash fonksiyonların çakışma direnci yetersizdir ve dijital imza veya çakışma direnci gerektiren diğer uygulamalar için kullanılmamalıdır. Diğer kullanımlar için, sadece eski sistemlerle uyumluluk ve doğrulama için kullanılabilirler, ancak yeni tasarımlarda kullanılmamalıdırlar. + +| Hash fonksiyonu | Referans | Durum | Kısıtlamalar | +| ------ | ----------- |:-:| ---------- | +| SHA3-512 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| SHA-512 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHA3-384 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| SHA-384 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHA3-256 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| SHA-512/256 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHA-256 |[FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | A | | +| SHAKE256 |[FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | A | | +| BLAKE2s | [BLAKE2: simpler, smaller, fast as MD5](https://eprint.iacr.org/2013/322) | A | | +| BLAKE2b | [BLAKE2: simpler, smaller, fast as MD5](https://eprint.iacr.org/2013/322) | A | | +| BLAKE3 | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | | +| SHA-224 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | L | HMAC, KDF, RBG, dijital imzalar için uygun değildir. | +| SHA-512/224 | [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | L | HMAC, KDF, RBG, dijital imzalar için uygun değildir. | +| SHA3-224 | [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) | L | HMAC, KDF, RBG, dijital imzalar için uygun değildir. | +| SHA-1 | [RFC 3174](https://www.rfc-editor.org/info/rfc3174) & [RFC 6194](https://www.rfc-editor.org/info/rfc6194) | L | HMAC, KDF, RBG, dijital imzalar için uygun değildir. | +| CRC (herhangi bir uzunluk) | | D | | +| MD4 | [RFC 1320](https://www.rfc-editor.org/info/rfc1320) | D | | +| MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | | + +### Parola Saklama için Hash Fonksiyonları + +Güvenli parola hashleme için özel hash fonksiyonları kullanılmalıdır. Bu yavaş hash algoritmaları, parola kırmanın hesaplama zorluğunu artırarak kaba kuvvet ve sözlük saldırılarını azaltır. + +| KDF | Referans | Gerekli Parametreler | Durum | +| ---------- | --------- | ------------ |:-:| +| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1 | A | +| | | t = 2: m ≥ 19456 (19 MiB), p = 1 | A | +| | | t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | +| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8 | A | +| | | p = 2: N ≥ 2^16 (64 MiB), r = 8 | A | +| | | p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | +| bcrypt | [A Future-Adaptable Password Scheme](https://www.researchgate.net/publication/2519476_A_Future-Adaptable_Password_Scheme) | cost ≥ 10 | A | +| PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 210,000 | A | +| PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 600,000 | A | +| PBKDF2-HMAC-SHA-1 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 1,300,000 | L | + +Parola depolama için onaylı parola tabanlı anahtar türetme işlevleri kullanılabilir. + +## Anahtar Türetme İşlevleri (Key Derivation Functions - KDF) + +### Genel Anahtar Türetme Fonksiyonları + +| KDF | Referanslar | Durum | +| ---------------- | -------- |:-:| +| HKDF | [RFC 5869](https://www.rfc-editor.org/info/rfc5869) | A | +| TLS 1.2 PRF | [RFC 5248](https://www.rfc-editor.org/info/rfc5248) | L | +| MD5-based KDFs | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | +| SHA-1-based KDFs | [RFC 3174](https://www.rfc-editor.org/info/rfc3174) & [RFC 6194](https://www.rfc-editor.org/info/rfc6194) | D | + +### Parola Tabanlı Anahtar Türetme İşlevleri + +| KDF | Referans | Gerekli Parametreler | Durum | +| ---------- | --------- | ------------ |:-:| +| argon2id | [RFC 9106](https://www.rfc-editor.org/info/rfc9106) | t = 1: m ≥ 47104 (46 MiB), p = 1 | A | +| | | t = 2: m ≥ 19456 (19 MiB), p = 1 | A | +| | | t ≥ 3: m ≥ 12288 (12 MiB), p = 1 | A | +| scrypt | [RFC 7914](https://www.rfc-editor.org/info/rfc7914) | p = 1: N ≥ 2^17 (128 MiB), r = 8 | A | +| | | p = 2: N ≥ 2^16 (64 MiB), r = 8 | A | +| | | p ≥ 3: N ≥ 2^15 (32 MiB), r = 8 | A | +| PBKDF2-HMAC-SHA-512 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 210,000 | A | +| PBKDF2-HMAC-SHA-256 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 600,000 | A | +| PBKDF2-HMAC-SHA-1 | [NIST SP 800-132](https://csrc.nist.gov/pubs/sp/800/132/final), [FIPS 180-4](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) | iterations ≥ 1,300,000 | L | + +## Anahtar Değişim Mekanizmaları (Key Exchange Mechanisms - KEX) + +Bu bölümde V11.6 Açık Anahtar Kriptografisi +için ek bilgi sağlanmaktadır. + +### KEX Şemaları + +Tüm anahtar değişimi şemaları için 112 bit veya üzeri bir güvenlik gücü sağlanmalıdır ve bunların uygulanması aşağıdaki tablodaki parametre seçeneklerini takip etmelidir. + +| Şema | Etki Alanı Parametreleri | İleriye Yönelik Gizlilik | Durum | +|--|--|--|:-:| +| Finite Field Diffie-Hellman (FFDH) | L >= 3072 & N >= 256 | Evet | A | +| Elliptic Curve Diffie-Hellman (ECDH) | f >= 256-383 | Evet | A | +| Encrypted key transport with RSA-PKCS#1 v1.5 | | Hayır | D | + +Parametreler aşağıdaki gibidir: + +* k, RSA anahtarları için anahtar boyutudur. +* L açık anahtarın boyutu ve N sonlu alan kriptografisi için özel anahtarın boyutudur. +* f, ECC için anahtar boyutları aralığıdır. + +Herhangi bir yeni uygulama [NIST SP 800-56A](https://csrc.nist.gov/pubs/sp/800/56/a/r3/final) & [B](https://csrc.nist.gov/pubs/sp/800/56/b/r2/final) ve [NIST SP 800-77](https://csrc.nist.gov/pubs/sp/800/77/r1/final) ile uyumlu OLMAYAN herhangi bir şema kullanılmamalıdır. Özellikle, IKEv1 üretimde kullanılmamalıdır. + +### Diffie-Hellman Grupları + +Aşağıdaki gruplar Diffie-Hellman anahtar değişimi uygulamaları için onaylanmıştır. Güvenlik güçleri [NIST SP 800-56A](https://csrc.nist.gov/pubs/sp/800/56/a/r3/final), Ek D ve [NIST SP 800-57 Bölüm 1 Rev.5](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final)'de belgelenmiştir. + +| Group | Status | +|------------------|:------:| +| P-224, secp224r1 | A | +| P-256, secp256r1 | A | +| P-384, secp384r1 | A | +| P-521, secp521r1 | A | +| K-233, sect233k1 | A | +| K-283, sect283k1 | A | +| K-409, sect409k1 | A | +| K-571, sect571k1 | A | +| B-233, sect233r1 | A | +| B-283, sect283r1 | A | +| B-409, sect409r1 | A | +| B-571, sect571r1 | A | +| Curve448 | A | +| Curve25519 | A | +| MODP-2048 | A | +| MODP-3072 | A | +| MODP-4096 | A | +| MODP-6144 | A | +| MODP-8192 | A | +| ffdhe2048 | A | +| ffdhe3072 | A | +| ffdhe4096 | A | +| ffdhe6144 | A | +| ffdhe8192 | A | + +## Mesaj Kimlik Doğrulama Kodları (Message Authentication Codes - MAC) + +Mesaj Kimlik Doğrulama Kodları (MAC), bir mesajın bütünlüğünü ve gerçekliğini doğrulamak için kullanılan kriptografik yapılardır. Bir MAC, girdi olarak bir mesaj ve gizli bir anahtar alır ve sabit boyutlu bir etiket (MAC değeri) üretir. MAC'ler güvenli iletişim protokollerinde (örneğin TLS/SSL) taraflar arasında değiş tokuş edilen mesajların gerçek ve bozulmamış olmasını sağlamak için yaygın olarak kullanılır. + +| MAC Algoritması | Referans | Durum | +| ---------- | --------------- |:-:| +| HMAC-SHA-256 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| HMAC-SHA-384 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| HMAC-SHA-512 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | A | +| KMAC128 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | +| KMAC256 | [NIST SP 800-185](https://csrc.nist.gov/pubs/sp/800/185/final) | A | +| BLAKE3 (keyed_hash mode) | [BLAKE3 one function, fast everywhere](https://github.com/BLAKE3-team/BLAKE3-specs/raw/master/blake3.pdf) | A | +| AES-CMAC | [RFC 4493](https://datatracker.ietf.org/doc/html/rfc4493) & [NIST SP 800-38B](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38b.pdf) | A | +| AES-GMAC | [NIST SP 800-38D](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf) | A | +| Poly1305-AES | [The Poly1305-AES message-authentication code](https://cr.yp.to/mac/poly1305-20050329.pdf) | A | +| HMAC-SHA-1 | [RFC 2104](https://www.rfc-editor.org/info/rfc2104) & [FIPS 198-1](https://csrc.nist.gov/pubs/fips/198-1/final) | L | +| HMAC-MD5 | [RFC 1321](https://www.rfc-editor.org/info/rfc1321) | D | + +## Dijital İmzalar + +İmza şemaları [NIST SP 800-57 Bölüm 1](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final) uyarınca onaylanmış anahtar boyutlarını ve parametrelerini kullanmalıdır. + +| İmza Algoritması | Referans | Durum | +| ------------------------------ | --------------------------------------------- | :-: | +| EdDSA (Ed25519, Ed448) | [RFC 8032](https://www.rfc-editor.org/info/rfc8032) | A | +| XEdDSA (Curve25519, Curve448) | [XEdDSA](https://signal.org/docs/specifications/xeddsa/) | A | +| ECDSA (P-256, P-384, P-521) | [FIPS 186-4](https://csrc.nist.gov/pubs/fips/186-5/final) | A | +| RSA-RSSA-PSS | [RFC 8017](https://www.rfc-editor.org/info/rfc8017) | A | +| RSA-SSA-PKCS#1 v1.5 | [RFC 8017](https://www.rfc-editor.org/info/rfc8017) | D | +| DSA (any key size) | [FIPS 186-4](https://csrc.nist.gov/pubs/fips/186-4/final) | D | + +## Kuantum Sonrası Şifreleme Standartları + +Kuantum sonrası kriptografi (PQC) uygulamaları [FIPS-203](https://csrc.nist.gov/pubs/fips/203/ipd), [FIPS-204](https://csrc.nist.gov/pubs/fips/204/ipd) ve [FIPS-205](https://csrc.nist.gov/pubs/fips/205/ipd) standartlarını takip etmelidir. Şu anda, bu standartlar için çok fazla güçlendirilmiş kod örneği veya referans uygulaması mevcut değildir. Daha fazla ayrıntı için, [Kuantum sonrası şifreleme standartlarının ilk üçüne ilişkin NIST duyurusu (Ağustos 2024)](https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards) adresine bakın. + +Önerilen [mlkem768x25519](https://datatracker.ietf.org/doc/draft-kwiatkowski-tls-ecdhe-mlkem/03/) kuantum sonrası hibrit TLS anahtar anlaşma yöntemi [Firefox sürüm 132](https://www.mozilla.org/en-US/firefox/132.0/releasenotes/) ve [Chrome sürüm 131](https://security.googleblog.com/2024/09/a-new-path-for-kyber-on-web.html) gibi büyük tarayıcılar tarafından desteklenmektedir. Kriptografik test ortamlarında veya endüstri veya devlet onaylı kütüphanelerde mevcut olduğunda kullanılabilir. diff --git a/5.0/tr/0x93-Appendix-D_Recommendations.md b/5.0/tr/0x93-Appendix-D_Recommendations.md new file mode 100644 index 0000000000..a0e1924ee0 --- /dev/null +++ b/5.0/tr/0x93-Appendix-D_Recommendations.md @@ -0,0 +1,49 @@ +# Ek D: Tavsiyeler + +## Giriş + +Uygulama Güvenliği Doğrulama Standardının (ASVS) 5.0 sürümü hazırlanırken, 5.0'da gereklilik olarak yer almaması gereken bir dizi mevcut ve yeni önerilen öğe olduğu anlaşıldı. Bunun nedeni, 5.0 tanımına göre ASVS kapsamında olmamaları veya alternatif olarak iyi bir fikir olmalarına rağmen zorunlu hale getirilemeyeceklerinin düşünülmesi olabilir. + +Tüm bu maddeleri tamamen kaybetmek istemediğimiz için bazıları bu ekte yer almaktadır. + +## Önerilen, kapsam dahilindeki mekanizmalar + +Aşağıdaki maddeler ASVS için kapsam dahilindedir. Bunlar zorunlu hale getirilmemelidir ancak güvenli bir uygulamanın parçası olarak dikkate alınmaları şiddetle tavsiye edilir. + +* Kullanıcıların daha güçlü bir parola belirlemesine yardımcı olmak için bir parola gücü ölçer sağlanmalıdır. +* Uygulamanın kök dizininde ya da .well-known dizininde, kullanıcıların güvenlik sorunları hakkında sahipleriyle iletişime geçebilecekleri bir bağlantı ya da e-posta adresini açıkça tanımlayan, herkese açık bir security.txt dosyası oluşturulmalıdır. +* İstemci tarafı girdi doğrulaması, güvenilir bir hizmet katmanında doğrulamaya ek olarak zorunlu kılınmalıdır. Çünkü bu, birisinin uygulamaya saldırmak amacıyla istemci tarafı kontrolleri atladığını keşfetmek için iyi bir fırsat sağlamaktadır. +* Bir robots.txt dosyası, X-Robots-Tag yanıt başlığı veya robots html meta etiketi kullanarak yanlışlıkla erişilebilen ve hassas sayfaların arama motorlarında görünmesi önlenmelidir. +* GraphQL kullanırken, yetkilendirmeyi her ayrı arayüzde ele almak zorunda kalmamak için yetkilendirme mantığı GraphQL veya çözümleyici katmanı yerine iş mantığı katmanında uygulanmalıdır. + +Referanslar: + +* [RFC bağlantısı da dahil olmak üzere security.txt hakkında daha fazla bilgi](https://securitytxt.org/) + +## Yazılım Güvenliği İlkeleri + +Aşağıdaki maddeler daha önce ASVS'de yer almaktaydı ancak tam olarak gereklilik değillerdir. Bunlar daha ziyade güvenlik kontrollerini uygularken göz önünde bulundurulması gereken ve takip edildiğinde daha sağlam kontrollere yol açacak ilkelerdir. Bunlar aşağıdakileri içerir: + +* Güvenlik kontrolleri merkezi, basit (tasarım ekonomisi), doğrulanabilir şekilde güvenli ve yeniden kullanılabilir olmalıdır. Bu sayede mükerrer, eksik veya etkisiz kontrollerden kaçınılabilir. +* Mümkün olan her yerde, kontrolleri sıfırdan uygulamaya güvenmek yerine daha önce yazılmış ve iyi incelenmiş güvenlik kontrolü uygulamaları kullanılmalıdır. +* İdeal olarak, korunan verilere ve kaynaklara erişmek için tek bir erişim kontrol mekanizması kullanılmalıdır. Kopyala yapıştır veya güvensiz alternatif yollardan kaçınmak için tüm istekler bu tek mekanizmadan geçmelidir. +* Öznitelik veya özellik tabanlı erişim kontrolü, kodun kullanıcının sadece rolü yerine bir özellik veya veri öğesi için yetkisini kontrol ettiği önerilen bir modeldir. İzinler yine de roller kullanılarak tahsis edilmelidir. + +## Yazılım Güvenliği Süreçleri + +ASVS 5.0'dan kaldırılan ancak hala iyi bir fikir olan bir dizi güvenlik süreci vardır. OWASP SAMM projesi bu süreçlerin nasıl etkili bir şekilde uygulanacağı konusunda iyi bir kaynak olabilir. Daha önce ASVS'de yer alan maddeler şunlardır: + +* Geliştirmenin tüm aşamalarında güvenliği ele alan güvenli bir yazılım geliştirme yaşam döngüsünün kullanıldığı doğrulanmalıdır. +* Tehditleri belirlemek, karşı önlemleri planlamak, uygun risk yanıtlarını kolaylaştırmak ve güvenlik testlerine rehberlik etmek için her tasarım değişikliği veya sprint planlaması için tehdit modellemesinin kullanıldığı doğrulanmalıdır. +* Tüm kullanıcı hikayelerinin ve özelliklerinin işlevsel güvenlik kısıtlamaları içerdiği doğrulanmalıdır. "Bir kullanıcı olarak profilimi görüntüleyebilmeli ve düzenleyebilmeliyim. Başkasının profilini görüntüleyememeli veya düzenleyememeliyim." gibi kısıtlamalar örnek olabilir. +* Tüm geliştiriciler ve test uzmanları için güvenli kodlama kontrol listesi, güvenlik gereksinimleri, kılavuz veya politikanın mevcut olduğu doğrulanmalıdır. +* Uygulama kaynak kodunun arka kapılardan, kötü amaçlı kodlardan (örn. salami saldırıları, mantık bombaları, saatli bombalar) ve belgelenmemiş veya gizli özelliklerden (örn. Easter eggs, güvensiz hata ayıklama araçları) arındırılmış olmasını sağlamak için devam eden bir sürecin var olduğu doğrulanmalıdır. Bu bölüme uymak, üçüncü taraf kütüphaneleri de dahil olmak üzere kaynak koduna tam erişim olmadan mümkün değildir ve bu nedenle muhtemelen yalnızca en yüksek düzeyde güvenlik gerektiren uygulamalar için uygundur. +* Konuşlandırılmış ortamlarda yapılandırma kaymasını tespit etmek ve buna yanıt vermek için mekanizmaların mevcut olduğu doğrulanmalıdır. Bu, değişmez altyapı, güvenli bir taban çizgisinden otomatik yeniden dağıtım veya mevcut durumu onaylanmış yapılandırmalarla karşılaştıran sapma tespit araçlarının kullanılmasını içerebilir. +* Tüm üçüncü taraf ürünlerde, kütüphanelerde, çerçevelerde ve hizmetlerde kendi önerilerine göre yapılandırma sağlamlaştırması yapıldığı doğrulanmalıdır. + +Referanslar: + +* [OWASP Threat Modeling Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html) +* [OWASP Threat modeling](https://owasp.org/www-community/Application_Threat_Modeling) +* [OWASP Software Assurance Maturity Model Project](https://owasp.org/www-project-samm/) +* [Microsoft SDL](https://www.microsoft.com/en-us/securityengineering/sdl/) diff --git a/5.0/tr/0x94-Appendix-E_Contributors.md b/5.0/tr/0x94-Appendix-E_Contributors.md new file mode 100644 index 0000000000..2aeab65e98 --- /dev/null +++ b/5.0/tr/0x94-Appendix-E_Contributors.md @@ -0,0 +1,71 @@ +# Ek E - Katkıda Bulunanlar + +ASVS 4.0.0'ın yayınlanmasından bu yana yorum yapan veya pull request açan aşağıdaki kişilerin katkılarını minnetle kabul ediyoruz. + +Herhangi bir hata fark ettiyseniz veya isminizin farklı görünmesini istiyorsanız, lütfen bize bildirin. + +| | | | | +|---|---|---|---| +| Johan Sydseter ([sydseter](https://github.com/sydseter)) | luis servin ([lfservin](https://github.com/lfservin)) | Oleksii Dovydkov ([oleksiidov](https://github.com/oleksiidov)) | IZUKA Masahiro ([maizuka](https://github.com/maizuka)) | +| James Sulinski ([jsulinski](https://github.com/jsulinski)) | Eli Saad ([ThunderSon](https://github.com/ThunderSon)) | [kkshitish9](https://github.com/kkshitish9) | Andrew van der Stock ([vanderaj](https://github.com/vanderaj)) | +| Rick M ([kingthorin](https://github.com/kingthorin)) | Bankde Eakasit ([Bankde](https://github.com/Bankde)) | Michael Gargiullo ([mgargiullo](https://github.com/mgargiullo)) | Raphael Dunant ([Racater](https://github.com/Racater)) | +| Cesar Kohl ([cesarkohl](https://github.com/cesarkohl)) | [inaz0](https://github.com/inaz0) | Joerg Bruenner ([JoergBruenner](https://github.com/JoergBruenner)) | David Deatherage ([securitydave](https://github.com/securitydave)) | +| John Carroll ([yosignals](https://github.com/yosignals)) | Jim Fenton ([jimfenton](https://github.com/jimfenton)) | Matteo Pace ([M4tteoP](https://github.com/M4tteoP)) | Sebastien gioria ([SPoint42](https://github.com/SPoint42)) | +| Steven van der Baan ([vdbaan](https://github.com/vdbaan)) | Jeremy Bonghwan Choi ([jeremychoi](https://github.com/jeremychoi)) | [craig-shony](https://github.com/craig-shony) | Riccardo Sirigu ([ricsirigu](https://github.com/ricsirigu)) | +| Tomasz Wrobel ([tw2as](https://github.com/tw2as)) | Alena Dubeshko ([belalena](https://github.com/belalena)) | Rafael Green ([RafaelGreen1](https://github.com/RafaelGreen1)) | [mjang-cobalt](https://github.com/mjang-cobalt) | +| [clallier94](https://github.com/clallier94) | Kevin W. Wall ([kwwall](https://github.com/kwwall)) | Jordan Sherman ([jsherm-fwdsec](https://github.com/jsherm-fwdsec) / [deleterepo](https://github.com/deleterepo)) | Ingo Rauner ([ingo-rauner](https://github.com/ingo-rauner)) | +| Dirk Wetter ([drwetter](https://github.com/drwetter)) | Moshe Zioni ([moshe-apiiro](https://github.com/moshe-apiiro)) | Patrick Dwyer ([coderpatros](https://github.com/coderpatros)) | David Clarke ([davidclarke-au](https://github.com/davidclarke-au)) | +| Takaharu Ogasa ([takaharuogasa](https://github.com/takaharuogasa)) | Arkadii Yakovets ([arkid15r](https://github.com/arkid15r)) | Motoyasu Saburi ([motoyasu-saburi](https://github.com/motoyasu-saburi)) | [leirn](https://github.com/leirn) | +| [wet-certitude](https://github.com/wet-certitude) | [timhemel](https://github.com/timhemel) | RL Thornton ([thornshadow99](https://github.com/thornshadow99)) | Thomas Bandt ([aspnetde](https://github.com/aspnetde)) | +| Roel Storms ([roelstorms](https://github.com/roelstorms)) | Jeroen Willemsen ([commjoen](https://github.com/commjoen)) | [anonymous-31](https://github.com/anonymous-31) | Kamran Saifullah ([deFr0ggy](https://github.com/deFr0ggy)) | +| Steve Springett ([stevespringett](https://github.com/stevespringett)) | Spyros ([northdpole](https://github.com/northdpole)) | Hans Herrera ([hansphp](https://github.com/hansphp)) | [Marx314](https://github.com/Marx314) | +| [CarlosAllendes](https://github.com/CarlosAllendes) | Yonah Russ ([yruss972](https://github.com/yruss972)) | Sander Maijers ([sanmai-NL](https://github.com/sanmai-NL)) | Luboš Bretschneider ([bretik](https://github.com/bretik)) | +| Eva Sarafianou ([esarafianou](https://github.com/esarafianou)) | Ata Seren [ataseren](https://github.com/ataseren) | Steve Thomas ([Sc00bz](https://github.com/Sc00bz)) | Dominique RIGHETTO ([righettod](https://github.com/righettod)) | +| Steven van der Baan ([svdb-ncc](https://github.com/svdb-ncc)) | Michael Vacarella ([Aif4thah](https://github.com/Aif4thah)) | Tonimir Kisasondi ([tkisason](https://github.com/tkisason)) | Stefan Streichsbier ([streichsbaer](https://github.com/streichsbaer)) | +| [hi-unc1e](https://github.com/hi-unc1e) | sb3k ([starbuck3000](https://github.com/starbuck3000)) | [mario-platt](https://github.com/mario-platt) | Devdatta Akhawe ([devd](https://github.com/devd)) | +| Michael Gissing ([scolytus](https://github.com/scolytus)) | Jet Anderson ([thatsjet](https://github.com/thatsjet)) | Dave Wichers ([davewichers](https://github.com/davewichers)) | Jonny Schnittger ([JonnySchnittger](https://github.com/JonnySchnittger)) | +| Silvia Väli ([silviavali](https://github.com/silviavali)) | [jackgates73](https://github.com/jackgates73) | [1songb1rd](https://github.com/1songb1rd) | Timur - ([timurozkul](https://github.com/timurozkul)) | +| Gareth Heyes ([hackvertor](https://github.com/hackvertor)) | [appills](https://github.com/appills) | [suvikaartinen](https://github.com/suvikaartinen) | chaals ([chaals](https://github.com/chaals)) | +| DanielPharos ([AtlasHackert](https://github.com/AtlasHackert)) | will Farrell ([willfarrell](https://github.com/willfarrell)) | Alina Vasiljeva ([avasiljeva](https://github.com/avasiljeva)) | Paul McCann ([ismisepaul](https://github.com/ismisepaul)) | +| Sage ([SajjadPourali](https://github.com/SajjadPourali)) | [rbsec](https://github.com/rbsec) | Benedikt Bauer ([mastacheata](https://github.com/mastacheata)) | James Jardine ([jamesjardine](https://github.com/jamesjardine)) | +| Mark Burnett ([m8urnett](https://github.com/m8urnett)) | [dschwarz91](https://github.com/dschwarz91) | Cyber-AppSec ([Cyber-AppSec](https://github.com/Cyber-AppSec)) | [Tib3rius](https://github.com/Tib3rius) | +| BitnessWise ([bitnesswise](https://github.com/bitnesswise)) | damienbod ([damienbod](https://github.com/damienbod)) | Jared Meit ([jmeit-fwdsec](https://github.com/jmeit-fwdsec)) | Stefan Seelmann ([sseelmann](https://github.com/sseelmann)) | +| Brendan O'Connor ([ussjoin](https://github.com/ussjoin)) | Andrei Titov ([andrettv](https://github.com/andrettv)) | Hans-Petter Fjeld ([atluxity](https://github.com/atluxity)) | [markehack](https://github.com/markehack) | +| Neil Madden ([NeilMadden](https://github.com/NeilMadden)) | Michael Geramb ([mgeramb](https://github.com/mgeramb)) | Osama Elnaggar ([ossie-git](https://github.com/ossie-git)) | [mackowski](https://github.com/mackowski) | +| Ravi Balla ([raviballa](https://github.com/raviballa)) | Hazana ([hazanasec](https://github.com/hazanasec)) | David Means ([dmeans82](https://github.com/dmeans82)) | Alexander Stein ([tohch4](https://github.com/tohch4)) | +| BaeSenseii ([baesenseii](https://github.com/baesenseii)) | Vincent De Schutter ([VincentDS](https://github.com/VincentDS)) | S Bani ([sbani](https://github.com/sbani)) | Mitsuaki Akiyama ([mak1yama](https://github.com/mak1yama)) | +| Christopher Loessl ([hashier](https://github.com/hashier)) | [victorxm](https://github.com/victorxm) | Michal Rada ([michalradacz](https://github.com/michalradacz)) | Veeresh Devireddy ([drveresh](https://github.com/drveresh)) | +| [MaknaSEO](https://github.com/MaknaSEO) | [darkzero2022](https://github.com/darkzero2022) | Liam ([LiamDobbelaere](https://github.com/LiamDobbelaere)) | Frank Denis ([jedisct1](https://github.com/jedisct1)) | +| Otto Sulin ([ottosulin](https://github.com/ottosulin)) | [carllaw6885](https://github.com/carllaw6885) | Anders Johan Holmefjord ([aholmis](https://github.com/aholmis)) | Richard Fritsch ([rfricz](https://github.com/rfricz)) | +| [mesutgungor](https://github.com/mesutgungor) | Scott Helme ([ScottHelme](https://github.com/ScottHelme)) | Carlo Reggiani ([carloreggiani](https://github.com/carloreggiani)) | Suyash Srivastava ([suyash5053](https://github.com/suyash5053)) | +| Mark Potter ([markonweb](https://github.com/markonweb)) | Arjan Lamers ([alamers](https://github.com/alamers)) | Gøran Breivik ([gobrtg](https://github.com/gobrtg)) | [flo-blg](https://github.com/flo-blg) | +| Guillaume Déflache ([guillaume-d](https://github.com/guillaume-d)) | Toufik Airane ([toufik-airane](https://github.com/toufik-airane)) | Keith Hoodlet ([securingdev](https://github.com/securingdev)) | Sinner ([SoftwareSinner](https://github.com/SoftwareSinner)) | +| [iloving](https://github.com/iloving) | Jeroen Beckers ([TheDauntless](https://github.com/TheDauntless)) | Joubin Jabbari ([joubin](https://github.com/joubin)) | yu fujioka ([fujiokayu](https://github.com/fujiokayu)) | +| execjosh ([execjosh](https://github.com/execjosh)) | Alicja Kario ([tomato42](https://github.com/tomato42)) | Sidney Ribeiro ([srjsoftware](https://github.com/srjsoftware)) | Gabriel Marquet ([Gby56](https://github.com/Gby56)) | +| Drew Schulz ([drschulz](https://github.com/drschulz)) | [bedirhan](https://github.com/bedirhan) | [muralito](https://github.com/muralito) | Ronnie Flathers ([ropnop](https://github.com/ropnop)) | +| Philippe De Ryck ([philippederyck](https://github.com/philippederyck)) | Malte ([mal33](https://github.com/mal33)) | [MazeOfThoughts](https://github.com/MazeOfThoughts) | Andreas Falk ([andifalk](https://github.com/andifalk)) | +| Javi ([javixeneize](https://github.com/javixeneize)) | Daniel Hahn ([averell23](https://github.com/averell23)) | [borislav-c](https://github.com/borislav-c) | Robin Wood ([digininja](https://github.com/digininja)) | +| [miro2ns](https://github.com/miro2ns) | Jan Dockx ([jandockx](https://github.com/jandockx)) | [vipinsaini434](https://github.com/vipinsaini434) | [priyanshukumar397](https://github.com/priyanshukumar397) | +| Nat Sakimura ([sakimura](https://github.com/sakimura)) | Benjamin Häublein ([BenjaminHae](https://github.com/BenjaminHae)) | [unknown-user-from](https://github.com/unknown-user-from) | Ali Ramazan TAŞDELEN ([alitasdln](https://github.com/alitasdln)) | +| Pedro Escaleira ([oEscal](https://github.com/oEscal)) | Josh ([josh-hemphill](https://github.com/josh-hemphill)) | Tim Würtele ([SECtim](https://github.com/SECtim)) | AviD ([avidouglen](https://github.com/avidouglen)) | +| SheHacksPurple ([shehackspurple](https://github.com/shehackspurple)) | [fcerullo-cycubix](https://github.com/fcerullo-cycubix) | Hector Eryx Paredes Camacho ([heryxpc](https://github.com/heryxpc)) | Irene Michlin ([irene221b](https://github.com/irene221b)) | +| Jonah Y-M ([TG-Techie](https://github.com/TG-Techie)) | Dhiraj Bahroos ([bahroos](https://github.com/bahroos)) | Jef Meijvis ([jefmeijvis](https://github.com/jefmeijvis)) | [IzmaDoesItbeta](https://github.com/IzmaDoesItbeta) | +| Abdessamad TEMMAR ([TmmmmmR](https://github.com/TmmmmmR)) | [sectroyer](https://github.com/sectroyer) | Soh Satoh ([sohsatoh](https://github.com/sohsatoh)) | [regoravalaz](https://github.com/regoravalaz) | +| james-t ([james-bitherder](https://github.com/james-bitherder)) | Aram Hovsepyan ([aramhovsepyan](https://github.com/aramhovsepyan)) | [JaimeGomezGarciaSan](https://github.com/JaimeGomezGarciaSan) | [ValdiGit01](https://github.com/ValdiGit01) | +| iwatachan ([ishowta](https://github.com/ishowta)) | Vinod Anandan ([VinodAnandan](https://github.com/VinodAnandan)) | Kevin Kien ([KevinKien](https://github.com/KevinKien)) | [paul-williamson-swoop](https://github.com/paul-williamson-swoop) | +| [endergzr](https://github.com/endergzr) | Radhwan Alshamamri ([Rado0z](https://github.com/Rado0z)) | Grant Ongers ([rewtd](https://github.com/rewtd)) | Cure53 ([cure53](https://github.com/cure53)) | +| [AliR2Linux](https://github.com/AliR2Linux) | Ads Dawson ([GangGreenTemperTatum](https://github.com/GangGreenTemperTatum)) | William Reyor ([BillReyor](https://github.com/BillReyor)) | gabe ([gcrow](https://github.com/gcrow)) | +| [mascotter](https://github.com/mascotter) | [luissaiz](https://github.com/luissaiz) | Suren Manukyan ([vx-sec](https://github.com/vx-sec)) | Piotr Gliźniewicz ([pglizniewicz](https://github.com/pglizniewicz)) | +| Tadeusz Wachowski ([tadeuszwachowski](https://github.com/tadeuszwachowski)) | Nasir aka Nate ([andesec](https://github.com/andesec)) | [settantasette](https://github.com/settantasette) | Lars Haulin ([LarsH](https://github.com/LarsH)) | +| Terence Eden ([edent](https://github.com/edent)) | [JasmineScholz](https://github.com/JasmineScholz) | Arun Sivadasan ([teavanist](https://github.com/teavanist)) | Yusuf GÜR ([yusuffgur](https://github.com/yusuffgur)) | +| Troy Marshall ([troymarshall](https://github.com/troymarshall)) | Tanner Prynn ([tprynn](https://github.com/tprynn)) | Nick K. ([nickific](https://github.com/nickific)) | [raoul361](https://github.com/raoul361) | +| Azeem Ilyas ([TheAxZim](https://github.com/TheAxZim)) | Evo Stamatov ([avioli](https://github.com/avioli)) | Tim Potter ([timpotter87](https://github.com/timpotter87)) | Gavin Ray ([GavinRay97](https://github.com/GavinRay97)) | +| monis ([demideus](https://github.com/demideus)) | Marcin Hoppe ([MarcinHoppe](https://github.com/MarcinHoppe)) | Grambulf ([ramshazar](https://github.com/ramshazar)) | Jordan Pike ([computersarebad](https://github.com/computersarebad)) | +| Jason Rogers ([jason-invision](https://github.com/jason-invision)) | Ben Hall ([benbhall](https://github.com/benbhall)) | JamesPoppyCock ([jamesly123](https://github.com/jamesly123)) | WhiteHackLabs ([whitehacklabs](https://github.com/whitehacklabs)) | +| Alex Gaynor ([alex](https://github.com/alex)) | Filip van Laenen ([filipvanlaenen](https://github.com/filipvanlaenen)) | [jeurgen](https://github.com/jeurgen) | [GraoMelo](https://github.com/GraoMelo) | +| Andreas Kurtz ([ay-kay](https://github.com/ay-kay)) | Tom Tervoort ([TomTervoort](https://github.com/TomTervoort)) | old man ([deveras](https://github.com/deveras)) | Marco Schnüriger ([marcortw](https://github.com/marcortw)) | +| [stiiin](https://github.com/stiiin) | infoseclearn ([teaminfoseclearn](https://github.com/teaminfoseclearn)) | [hljupkij](https://github.com/hljupkij) | Noe ([nmarher](https://github.com/nmarher)) | +| Lyz ([lyz-code](https://github.com/lyz-code)) | Martin Riedel ([mrtnrdl](https://github.com/mrtnrdl)) | KIM Jaesuck ([tcaesvk](https://github.com/tcaesvk)) | Barbara Schachner ([bschach](https://github.com/bschach)) | +| René Reuter ([AresSec](https://github.com/AresSec)) | [carhackpils](https://github.com/carhackpils) | Tyler ([tyler2cr](https://github.com/tyler2cr)) | Hugo ([hasousa](https://github.com/hasousa)) | +| Wouter Bloeyaert ([Someniak](https://github.com/Someniak)) | Mark de Rijk ([markderijkinfosec](https://github.com/markderijkinfosec)) | Ramin ([picohub](https://github.com/picohub)) | Philip D. Turner ([philipdturner](https://github.com/philipdturner)) | +| Will Chatham ([willc](https://github.com/willc)) | | | | diff --git a/COMPILING.md b/COMPILING.md index 59dc007975..ae7e23cc53 100644 --- a/COMPILING.md +++ b/COMPILING.md @@ -14,7 +14,7 @@ Whilst the output scripts can also be run locally, this may not be currently sta **Note:** This method is still in testing and may or may not function depending on your environment and underlying Operating System. -Stabilizing this is on our todo list but not a top priority. +Stabilising this is on our todo list but not a top priority. ### Document Compilation Instructions 1. Install Docker on your computer (see instructions for different architectures [in the Docker docs](https://docs.docker.com/engine/install/)) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 3aefb1c492..adb79235f2 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -28,71 +28,22 @@ We will no longer be accepting changes to the 4.0 folder which is now fixed at t ASVS releases follow the pattern "Major.Minor.Patch" and the numbers provide information on what has changed within the release. In a major release, the first number will change, in a minor release, the second number will change, and in a patch release, the third number will change. -* Major release - Full reorganization, almost everything may have changed, including requirement numbers and chapter and section structure. Reevaluation for compliance will be necessary (for example, 4.0.3 -> 5.0.0). -* Minor release - Requirements may be added, removed, split, or merged but overall numbering and the section structure will stay the same with no additions or removals. Reevaluation for compliance will be necessary, but should be easier (for example, 5.0.0 -> 5.1.0). The restrictions mean that requirements within a sections may not be in ascending level order. Levels may be increased or decreased. -* Patch release - Requirements may be removed (for example, if they are duplicates or outdated) or made less stringent, but an application that complied with the previous release will comply with the patch release as well (for example, 5.0.0 -> 5.0.1). A level number may be increased but not decreased. +* Major release - Full reorganization, almost everything may have changed, including requirement numbers. Reevaluation for compliance will be necessary (for example, 4.0.3 -> 5.0.0). +* Minor release - Requirements may be added or removed, but overall numbering will stay the same. Reevaluation for compliance will be necessary, but should be easier (for example, 5.0.0 -> 5.1.0). +* Patch release - Requirements may be removed (for example, if they are duplicates or outdated) or made less stringent, but an application that complied with the previous release will comply with the patch release as well (for example, 5.0.0 -> 5.0.1). The above specifically relates to the requirements in the ASVS. Changes to surrounding text and other content such as the appendices will not be considered to be a breaking change. -### Change control - -In order to make it easier to track changes made on the bleeding edge version of ASVS and prepare new releases, we will follow the following conventions. - -We will make changes on the bleeding edge branch which would be acceptable for minor and patch releases however we will add tags which make clear whether the type of change is breaking or not for a patch. We will not currently make changes that would not be acceptable for a minor release. This basically means no new sections and not requirement moving. - -Tags will start with either: - -* `M` - The change is acceptable for a major release -* `I` - The change is acceptable for a minor release -* `P` - The change is acceptable for a patch release - -The following tags will be used, their meaning should be should be clear and they will be added to the start of the requirement description. - -* Patch tags: - * `[P:WEAKENED]` - * `[P:DELETED]` - * `[P:WORDING]` -* Minor tags: - * `[I:ADDED]` - * `[I:STRENGTHENED]` - * `[I:TRANSFORMED]` (This means the meaning has been entirely changed) - * `[I:MERGED_TO x.y.z ]` (ID defines where the requirement has gone) - * `[I:MERGED_FROM x.y.z, x.y.w]` (IDs define which requirements have been merged into the current one) - * `[I:SPLIT_TO x.y.z, x.y.w]` (IDs define where the requirement has been split to) - * `[I:SPLIT_FROM x.y.z]` (This is like an addition except that the ID defines where the requirement has been split from) -* Major tags (not to be used until we are not going to make any more minor or patch releases before a major release): - * `[M:MOVED_FROM x.y.z]` (ID defines where the requirement has come from) - * `[M:MOVED_TO x.y.z]` (ID defines where the requirement has gone) - -### Release process - -#### Patch release - -When a patch release comes along, we do the following: - -* Create a branch for the patch release -* Reverse all requirement changes in the patch branch which are not acceptable for a patch based on the tag on the requirement (guided by tags). -* Manually review the changes which are being reversed out to see if we want to cherry pick some non-breaking changes that were within a requirement which also has breaking changes. -* Remove all tagging from the patch branch and bring the tag details into a separate file representing the changes in this release to act as release notes. -* Remove tags from requirements in the bleeding edge branch for changes that went into the patch branch. Tags should be relative to the previous release. - -#### Minor release - -When a minor release comes along, we do the following: - -* Create a branch for the minor release -* Remove all tagging from the minor release branch and bring the tag details into a separate file representing the changes in this release to act as release notes. -* Remove tags from requirements in the bleeding edge branch. Tags should be relative to the previous release. - -#### Major release +## How can I help? -This will be more complicated and will be defined when we get there. +We would be glad to receive feedback to help us to further enhance the ASVS. -## How can I help? +At this stage, we are accepting the following types of changes: -We would be glad to receive feedback to help us to further enhance the ASVS. Whilst there may be some delays in responses, be assured that all issues will eventually be reviewed. +* Changes to surrounding text and other content such as the appendices which is not be considered to be a breaking change for release purposes. +* Changes which are considered "non-breaking" for an ASVS "patch" release. This means that requirements may be removed (for example, if they are duplicates or outdated) or made less stringent, but an application that complied with the previous release will comply with the patch release as well. -We are most likely to immediately accept changes to surrounding text and other content such as the appendices which is not considered a breaking change for release purposes but we will also start integrating changes that would require a patch or minor release. For major changes such as moves, you are welcome to open an issue but please note that the issue may not be progressed until we are considering a new major release, for which there is currently no fixed timeline. +If you feel there are other important changes but they would be considered breaking for a patch release, you are welcome to open an issue but please note that the issue may not be progressed until we are considering a new minor or major release, for which there is currently no fixed timeline. ## Additional Details for Helping @@ -112,11 +63,44 @@ The mappings in the [mappings folder](https://github.com/OWASP/ASVS/tree/master/ If you are comfortable that your query has not been previously discussed, you can open an issue. Please try and include the ASVS requirement number and text you are talking about in the issue to save having to jump back and forth and please carry out all discussion in the associated issue and not in a PR discussion. + + ## Translations We are now keen to receive translations for v5.0.0 of ASVS! -Note that we are ONLY accepting translations based on markdown and not preformatted translations in Word or PDF format to make tracking and maintenance easier. +Note that we are ONLY accepting translations based on markdown and not preformatted translations in Word or PDF format to make tracking and maintainance easier. If you are interested in creating a translation, here are some pointers for how you can help us: @@ -135,9 +119,9 @@ If you are interested in creating a translation, here are some pointers for how * [Korean](https://github.com/OWASP/ASVS/raw/v5.0.0/5.0/ko/) * If the language you are interested in appears, it would be great if you could reach out to the translator to see if you can help them. * Often there is work to do in creating markdown files or updating the translation to keep it up to date with latest changes. -* We would request that you **specifically base your translation** on the 5.0/en folder from the **v5.0.0** branch as this is now static at the 5.0.0 version. +* We would request that you base your translation on the 5.0/en folder in the v5.0.0 branch as this is now static at the 5.0.0 version. * In order to start a translation, please start by forking the ASVS repository. -* Checkout the **v5.0.0** branch. take a copy of the /en folder and rename it to the 2 character language code which will be used for the translation. +* Take a copy of the /en folder and rename it to the 2 character language code which will be used for the translation. * You can then edit the markdown files to include your translation rather than the original English. * When you have completed the translation, please open a Pull Request against the v5.0.0 ASVS branch and one of the leaders will look at integrating it. * The leader will also use the relevant scripts to create the documents from the raw markdown (or you can if you want to save us some trouble). diff --git a/README.md b/README.md index 92bc15daa5..93e006e98d 100644 --- a/README.md +++ b/README.md @@ -9,7 +9,7 @@ This work is licensed under a [![CC BY-SA 4.0][cc-by-sa-image]][cc-by-sa] -[cc-by-sa]: https://creativecommons.org/licenses/by-sa/4.0/ +[cc-by-sa]: http://creativecommons.org/licenses/by-sa/4.0/ [cc-by-sa-image]: https://licensebuttons.net/l/by-sa/4.0/88x31.png [cc-by-sa-shield]: https://img.shields.io/badge/License-CC%20BY--SA%204.0-blue.svg @@ -25,13 +25,13 @@ Originally launched in 2008 through a global community collaboration, the ASVS d Following the release of ASVS 4.0 in 2019 and its minor update (v4.0.3) in 2021, Version 5.0 represents a significant milestone—modernized to reflect the latest advances in software security. -We gratefully recognize the organizations who have supported the project either through significant time provision or financially on our "[Supporters](SUPPORTERS.md)" page! +We gratefully recognise the organizations who have supported the project either through significant time provision or financially on our "[Supporters](SUPPORTERS.md)" page! **Please [log issues](https://github.com/OWASP/ASVS/issues) if you find any bugs or if you have ideas. We may subsequently ask you to [open a pull request](https://github.com/OWASP/ASVS/pulls) based on the discussion in the issue. We are also actively looking for [translations of the 5.n branch](CONTRIBUTING.md#translations).** ## Project Leaders and Working Group -The project is led by the three project leaders [Daniel Cuthbert](https://github.com/danielcuthbert), [Josh Grossman](https://github.com/tghosth), and [Elar Lang](https://github.com/elarlang). +The project is led by the four project leaders [Daniel Cuthbert](https://github.com/danielcuthbert), [Jim Manico](https://github.com/jmanico), [Josh Grossman](https://github.com/tghosth), and [Elar Lang](https://github.com/elarlang). They are supported by the ASVS Working Group which consists of [Shanni Prutchi](https://github.com/EnigmaRosa), [Ralph Andalis](https://github.com/csfreak92), [Meghan Jacquot](https://github.com/meghanjacquot), [Iman Sharafaldin](https://github.com/ImanSharaf), [Ryan Armstrong](https://github.com/ryarmst), [Gabriel Corona](https://github.com/randomstuff), [Tobias Ahnoff](https://github.com/TobiasAhnoff), and [Eden Yardeni](https://github.com/cronchie). diff --git a/SUPPORTERS.md b/SUPPORTERS.md index 08aa897a3a..58107f5821 100644 --- a/SUPPORTERS.md +++ b/SUPPORTERS.md @@ -7,9 +7,9 @@ ## Introduction -Within the ASVS project, we gratefully recognize the following organizations who support the OWASP Application Security Verification Standard project through monetary donations or allowing contributors to spend significant time working on the standard as part of their work with the organization. +Within the ASVS project, we gratefully recognise the following organizations who support the OWASP Application Security Verification Standard project through monetary donations or allowing contributors to spend significant time working on the standard as part of their work with the organization. -We recognize various tiers of support and the amount of time the supporter is recognized for depends on the supporter level. +We recognise various tiers of support and the amount of time the supporter is recognised for depends on the supporter level. On this page and the project web page, we will display the supporter's logo and link to their website and we will publicise via Social Media as well. @@ -30,6 +30,8 @@ Organizations who have allowed contributors to spend significant time working on Organizations who have donated $7,000 or more to the project via OWASP. Supporter will be listed in this section for 3 years from the date of the donation. +[](https://about.google/) + ## Secondary supporters Organizations who have donated $3,000 or more to the project via OWASP. Supporter will be listed in this section for 2 years from the date of the donation. @@ -42,10 +44,17 @@ Organizations who have donated $3,000 or more to the project via OWASP. Supporte Organizations who have donated $500 or more to the project via OWASP. Supporter will be listed in this section for 1 year from the date of the donation. + + +[](https://www.crest-approved.org/members/)     [](https://forwardsecurity.com/)     [](https://en.omegapoint.se/) + ## Associate supporters Organizations who have donated another amount to the project via OWASP. Supporter will be listed in this section for 1 year from the date of the donation. + + + From b936607d4e24e6353f054bdcec606e150b613ab5 Mon Sep 17 00:00:00 2001 From: tghosth Date: Thu, 16 Jul 2026 15:52:43 +0300 Subject: [PATCH 81/93] Fix Persian frontispiece project leads --- 5.0/fa/0x01-Frontispiece.md | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/5.0/fa/0x01-Frontispiece.md b/5.0/fa/0x01-Frontispiece.md index e69d800cbb..0393b38e2a 100644 --- a/5.0/fa/0x01-Frontispiece.md +++ b/5.0/fa/0x01-Frontispiece.md @@ -18,21 +18,22 @@ Copyright © 2008-2025 The OWASP Foundation. ## سرپرستان پروژه -| | | | -|---------------------- |----------------- |----------------- | -| Daniel Cuthbert | Elar Lang | Josh C Grossman | +| | | +|---------------------- |----------------- | +| Elar Lang | Josh C Grossman | +| Jim Manico | Daniel Cuthbert | ## گروه کاری -| | | | | -| -------------- | -------------- | ---------------- | -------------- | +| | | | | +|---------------- |------------------ |------------------- |----------------- | | Tobias Ahnoff | Ralph Andalis | Ryan Armstrong | Gabriel Corona | | Meghan Jacquot | Shanni Prutchi | Iman Sharafaldin | Eden Yardeni | ## سایر همکاران اصلی -| | | -| ----------------- | ------------ | +| | | +|-------------------|-------------------| | Sjoerd Langkemper | Isaac Lewis | | Mark Carney | Sandro Gauci | From 97206774d3963e180671d57ed2f80228226786fe Mon Sep 17 00:00:00 2001 From: tghosth Date: Thu, 16 Jul 2026 16:23:15 +0300 Subject: [PATCH 82/93] Fix Persian translation validation --- 5.0/fa/0x12-V3-Web-Frontend-Security.md | 3 +-- 5.0/fa/0x13-V4-API-and-Web-Service.md | 3 +-- 5.0/fa/0x15-V6-Authentication.md | 4 +++- 5.0/fa/0x19-V10-OAuth-and-OIDC.md | 6 ++---- 5.0/fa/0x26-V17-WebRTC.md | 2 ++ 5.0/fa/0x92-Appendix-C_Cryptography.md | 15 ++++++++++----- 5.0/fa/0x94-Appendix-E_Contributors.md | 2 +- 7 files changed, 20 insertions(+), 15 deletions(-) diff --git a/5.0/fa/0x12-V3-Web-Frontend-Security.md b/5.0/fa/0x12-V3-Web-Frontend-Security.md index 196b718d06..adc2b35e2d 100644 --- a/5.0/fa/0x12-V3-Web-Frontend-Security.md +++ b/5.0/fa/0x12-V3-Web-Frontend-Security.md @@ -55,8 +55,7 @@ عملکرد حساس در این زمینه می‌تواند شامل مواردی مانند ارسال فرم‌ها برای کاربران تأییدشده یا تأییدنشده (مثلاً درخواست احراز هویت)، عملیات تغییر وضعیت (state-changing operations)، یا عملکردهایی که منابع زیادی مصرف می‌کنند (مانند خروجی گرفتن از داده‌ها) باشد. -مکانیزم‌های کلیدی برای محافظت در برابر چنین حملاتی شامل سیاست‌های امنیتی مرورگرها مانند Same Origin Policy برای جاوااسکریپت و همچنین منطق SameSite برای کوکی‌ها هستند. -یکی دیگر از روش‌های رایج برای محافظت، مکانیزم CORS preflight است. این مکانیزم به‌ویژه برای اندپوینت‌هایی که قرار است از یک مبدأ متفاوت فراخوانی شوند حیاتی است، اما حتی برای اندپوینت‌هایی که نباید از مبدأهای دیگر فراخوانی شوند نیز می‌تواند به‌عنوان یک لایه محافظتی مؤثر در برابر جعل درخواست Request Forgery عمل کند. +مکانیزم‌های کلیدی برای محافظت در برابر چنین حملاتی شامل سیاست‌های امنیتی مرورگرها مانند Same Origin Policy برای جاوااسکریپت و همچنین منطق SameSite برای کوکی‌ها هستند. یکی دیگر از روش‌های رایج برای محافظت، مکانیزم CORS preflight است. این مکانیزم به‌ویژه برای اندپوینت‌هایی که قرار است از یک مبدأ متفاوت فراخوانی شوند حیاتی است، اما حتی برای اندپوینت‌هایی که نباید از مبدأهای دیگر فراخوانی شوند نیز می‌تواند به‌عنوان یک لایه محافظتی مؤثر در برابر جعل درخواست Request Forgery عمل کند. | # | Description | Level | | :---: | :--- | :---: | diff --git a/5.0/fa/0x13-V4-API-and-Web-Service.md b/5.0/fa/0x13-V4-API-and-Web-Service.md index e3a5f99a87..00b3f29058 100644 --- a/5.0/fa/0x13-V4-API-and-Web-Service.md +++ b/5.0/fa/0x13-V4-API-and-Web-Service.md @@ -43,8 +43,7 @@ GraphQL به‌طور فزاینده‌ای در حال تبدیل شدن به ## V4.4 WebSocket -WebSocket یک پروتکل ارتباطی است که امکان ارتباط دوطرفه هم‌زمان را از طریق یک اتصال TCP فراهم می‌کند. -این پروتکل در سال ۲۰۱۱ توسط IETF در قالب RFC 6455 استانداردسازی شد. اگرچه WebSocket برای کار کردن از طریق پورت‌های رایج HTTP یعنی پورت 443 (HTTPS) و پورت 80 (HTTP) طراحی شده، اما پروتکلی مجزا از HTTP محسوب می‌شود. +WebSocket یک پروتکل ارتباطی است که امکان ارتباط دوطرفه هم‌زمان را از طریق یک اتصال TCP فراهم می‌کند. این پروتکل در سال ۲۰۱۱ توسط IETF در قالب RFC 6455 استانداردسازی شد. اگرچه WebSocket برای کار کردن از طریق پورت‌های رایج HTTP یعنی پورت 443 (HTTPS) و پورت 80 (HTTP) طراحی شده، اما پروتکلی مجزا از HTTP محسوب می‌شود. این بخش به الزامات کلیدی امنیتی می‌پردازد که برای جلوگیری از حملاتی طراحی شده‌اند که از طریق این کانال ارتباطی بلادرنگ، به‌ویژه در حوزه‌های امنیت ارتباطات و مدیریت نشست انجام می‌گیرند. diff --git a/5.0/fa/0x15-V6-Authentication.md b/5.0/fa/0x15-V6-Authentication.md index 86f0eb167d..a8f3c4986c 100644 --- a/5.0/fa/0x15-V6-Authentication.md +++ b/5.0/fa/0x15-V6-Authentication.md @@ -83,7 +83,9 @@ ## V6.5 General Multi-factor authentication requirements -این بخش راهنمایی‌های کلی ارائه می‌دهد که برای انواع مختلف مکانیزم‌های احراز هویت چندعاملی (MFA) قابل استفاده است. مکانیزم‌های بررسی‌شده شامل موارد زیر هستند: +این بخش راهنمایی‌های کلی ارائه می‌دهد که برای انواع مختلف مکانیزم‌های احراز هویت چندعاملی (MFA) قابل استفاده است. + +مکانیزم‌های بررسی‌شده شامل موارد زیر هستند: * Lookup Secrets (فرایند یافتن یا بازیابی اطلاعات محرمانه) * رمزهای عبور یک‌بار مصرف مبتنی بر زمان (TOTPs) diff --git a/5.0/fa/0x19-V10-OAuth-and-OIDC.md b/5.0/fa/0x19-V10-OAuth-and-OIDC.md index 2351274fa3..f3f36fdae0 100644 --- a/5.0/fa/0x19-V10-OAuth-and-OIDC.md +++ b/5.0/fa/0x19-V10-OAuth-and-OIDC.md @@ -13,16 +13,14 @@ OAuth2 (که در این فصل با عنوان OAuth از آن یاد می‌ش * یک Public Client توانایی حفظ محرمانگی اعتبارنامه‌ها (Credentials) برای احراز هویت در برابر Authorization Server را ندارد. بنابراین، به جای احراز هویت خود (برای مثال با استفاده از پارامترهای client_id و client_secret)، صرفاً خودش را شناسایی می‌کند (با استفاده از پارامتر client_id) * OAuth Resource Server (RS) سروری است که از طریق API، منابع را در اختیار OAuth Clients قرار می‌دهد. * OAuth Authorization Server (AS) یک برنامه‌ی سرور است که به OAuth Clients توکن‌های دسترسی (Access Tokens) صادر می‌کند. این توکن‌ها به OAuth Clients امکان می‌دهند تا به منابع موجود در RS دسترسی پیدا کنند؛ یا به نمایندگی از کاربر نهایی (End-User)، یا به نمایندگی از خود OAuth Client. معمولاً AS یک برنامه‌ی مجزا است، اما در صورت لزوم می‌تواند در یک RS مناسب نیز ادغام شود. -* Resource Owner (RO) همان کاربر نهایی (End-User) است که به OAuth Clients اجازه می‌دهد تا به نمایندگی از او، دسترسی محدودی به منابع موجود روی Resource Server داشته باشند. - Resource Owner با تعامل با Authorization Server، رضایت خود را برای این واگذاری مجوز دسترسی (Delegated Authorization) اعلام می‌کند. +* Resource Owner (RO) همان کاربر نهایی (End-User) است که به OAuth Clients اجازه می‌دهد تا به نمایندگی از او، دسترسی محدودی به منابع موجود روی Resource Server داشته باشند. Resource Owner با تعامل با Authorization Server، رضایت خود را برای این واگذاری مجوز دسترسی (Delegated Authorization) اعلام می‌کند. نقش‌های زیر در OIDC تعریف شده‌اند: * Relying Party (RP) برنامه‌ی کاربری (Client Application) است که از طریق OpenID Provider درخواست احراز هویت کاربر نهایی (End-User) را می‌دهد. این نقش در واقع همان نقش یک OAuth Client را بر عهده دارد. * OpenID Provider (OP) یک OAuth AS است که توانایی احراز هویت کاربر نهایی (End-User) را دارد و اطلاعات هویتی (OIDC Claims) را در اختیار RP قرار می‌دهد.OP می‌تواند همان Identity Provider (IdP) باشد، اما در سناریوهای فدراسیونی (Federated Scenarios)، OP و Identity Provider (جایی که کاربر نهایی احراز هویت می‌شود) ممکن است دو برنامه‌ی سرور جداگانه باشند. -OAuth و OIDC در ابتدا برای برنامه‌های سوم‌شخص (Third-Party Applications) طراحی شده بودند. -امروزه، این پروتکل‌ها به‌طور گسترده در برنامه‌های اول‌شخص (First-Party Applications) نیز مورد استفاده قرار می‌گیرند. با این حال، هنگام استفاده در سناریوهای اول‌شخص مانند احراز هویت (Authentication) و مدیریت نشست (Session Management) این پروتکل‌ها پیچیدگی‌هایی را به همراه می‌آورند که ممکن است چالش‌های امنیتی جدیدی ایجاد کنند. +OAuth و OIDC در ابتدا برای برنامه‌های سوم‌شخص (Third-Party Applications) طراحی شده بودند. امروزه، این پروتکل‌ها به‌طور گسترده در برنامه‌های اول‌شخص (First-Party Applications) نیز مورد استفاده قرار می‌گیرند. با این حال، هنگام استفاده در سناریوهای اول‌شخص مانند احراز هویت (Authentication) و مدیریت نشست (Session Management) این پروتکل‌ها پیچیدگی‌هایی را به همراه می‌آورند که ممکن است چالش‌های امنیتی جدیدی ایجاد کنند. OAuth وOIDC را می‌توان در انواع مختلف برنامه‌ها به کار برد، اما تمرکز در ASVS و همچنین الزامات مطرح‌شده در این فصل، بر روی برنامه‌های وب (Web Applications) و رابط‌های برنامه‌نویسی کاربردی (APIs) است. diff --git a/5.0/fa/0x26-V17-WebRTC.md b/5.0/fa/0x26-V17-WebRTC.md index 1833398ce9..9d5b5f81d5 100644 --- a/5.0/fa/0x26-V17-WebRTC.md +++ b/5.0/fa/0x26-V17-WebRTC.md @@ -7,7 +7,9 @@ Web Real-Time Communication (WebRTC) امکان تبادل صوت، تصویر صنعت WebRTC را می‌توان به‌طور کلی به سه بخش تقسیم کرد: 1. توسعه‌دهندگان محصول: فروشندگان اختصاصی و متن‌باز که محصولات و راه‌حل‌های WebRTC را ایجاد و عرضه می‌کنند. تمرکز آن‌ها بر توسعه فناوری‌های قوی و امن WebRTC است که توسط دیگران قابل استفاده باشند. + 2. ارائه‌دهندگان خدمات: سازمان‌هایی که از محصولات توسعه‌دهندگان یا ارائه‌دهندگان CPaaS استفاده می‌کنند یا راهکارهای WebRTC خود را توسعه می‌دهند. آن‌ها برنامه‌هایی را برای کنفرانس آنلاین، سلامت، آموزش الکترونیکی و سایر حوزه‌هایی که در آن‌ها ارتباط بلادرنگ حیاتی است، ایجاد و پیاده‌سازی می‌کنند. + 3. ارائه‌دهندگان خدمات: سازمان‌هایی که از محصولات توسعه‌دهندگان یا ارائه‌دهندگان CPaaS استفاده می‌کنند یا خود راهکارهای WebRTC خود را توسعه می‌دهند. آن‌ها برنامه‌هایی برای کنفرانس‌های آنلاین، حوزه سلامت، آموزش الکترونیکی و سایر زمینه‌هایی که ارتباط بلادرنگ حیاتی است، ایجاد و پیاده‌سازی می‌کنند. نیازمندی‌های امنیتی مطرح شده در اینجا عمدتاً بر توسعه‌دهندگان محصول، ارائه‌دهندگان CPaaS و ارائه‌دهندگان خدمات متمرکز است که: diff --git a/5.0/fa/0x92-Appendix-C_Cryptography.md b/5.0/fa/0x92-Appendix-C_Cryptography.md index fcbbc3b84f..20c1365d74 100644 --- a/5.0/fa/0x92-Appendix-C_Cryptography.md +++ b/5.0/fa/0x92-Appendix-C_Cryptography.md @@ -15,7 +15,8 @@ ## Cryptographic Inventory and Documentation -این بخش اطلاعات تکمیلی را برای V11.1 موجودی و مستندسازی رمزنگاری ارائه می‌دهد. +این بخش اطلاعات تکمیلی را +برای V11.1 موجودی و مستندسازی رمزنگاری ارائه می‌دهد. مهم است که تمام دارایی‌های رمزنگاری، مانند الگوریتم‌ها، کلیدها و گواهی‌نامه‌ها، به‌طور منظم شناسایی، فهرست‌بندی و ارزیابی شوند. برای سطح 3، این باید شامل استفاده از اسکن ایستا و پویا برای شناسایی استفاده از رمزنگاری در یک برنامه باشد. ابزارهایی مانند SAST و DAST می‌توانند در این زمینه کمک کنند، اما ممکن است ابزارهای اختصاصی برای پوشش جامع‌تر مورد نیاز باشند. نمونه‌های رایگان از این ابزارها عبارتند از: @@ -44,7 +45,8 @@ ## Random Values -این بخش اطلاعات تکمیلی برای 5 Random Values را ارائه می‌دهد. +این بخش اطلاعات تکمیلی +برای 5 Random Values را ارائه می‌دهد. | Name | Version/Reference | Notes | Status | | :--- | :---- | :---- | :-: | @@ -59,7 +61,8 @@ ## Cipher Algorithms -این بخش اطلاعات تکمیلی برای الگوریتم‌های رمزنگاری را ارائه می‌دهد. +این بخش اطلاعات تکمیلی +برای الگوریتم‌های رمزنگاری را ارائه می‌دهد. الگوریتم‌های رمزنگاری تأیید شده به ترتیب اولویت فهرست شده‌اند. @@ -141,7 +144,8 @@ ## Hash Functions -این بخش اطلاعات تکمیلی در مورد هش کردن و توابع مبتنی بر هش را ارائه می‌دهد. +این بخش اطلاعات تکمیلی +در مورد هش کردن و توابع مبتنی بر هش را ارائه می‌دهد. ### Hash Functions for General Use Cases @@ -217,7 +221,8 @@ ## Key Exchange Mechanisms -این بخش اطلاعات تکمیلی رمزنگاری کلید عمومی را ارائه می‌دهد. +این بخش اطلاعات تکمیلی +رمزنگاری کلید عمومی را ارائه می‌دهد. ### KEX Schemes diff --git a/5.0/fa/0x94-Appendix-E_Contributors.md b/5.0/fa/0x94-Appendix-E_Contributors.md index 2a847121ac..d6c5abde43 100644 --- a/5.0/fa/0x94-Appendix-E_Contributors.md +++ b/5.0/fa/0x94-Appendix-E_Contributors.md @@ -20,7 +20,7 @@ | Roel Storms ([roelstorms](https://github.com/roelstorms)) | Jeroen Willemsen ([commjoen](https://github.com/commjoen)) | [anonymous-31](https://github.com/anonymous-31) | Kamran Saifullah ([deFr0ggy](https://github.com/deFr0ggy)) | | Steve Springett ([stevespringett](https://github.com/stevespringett)) | Spyros ([northdpole](https://github.com/northdpole)) | Hans Herrera ([hansphp](https://github.com/hansphp)) | [Marx314](https://github.com/Marx314) | | [CarlosAllendes](https://github.com/CarlosAllendes) | Yonah Russ ([yruss972](https://github.com/yruss972)) | Sander Maijers ([sanmai-NL](https://github.com/sanmai-NL)) | Luboš Bretschneider ([bretik](https://github.com/bretik)) | -| Eva Sarafianou ([esarafianou](https://github.com/esarafianou)) | Ata Seren [ataseren](https://github.com/ataseren) | Steve Thomas ([Sc00bz](https://github.com/Sc00bz)) | Dominique RIGHETTO ([righettod](https://github.com/righettod)) | +| Eva Sarafianou ([esarafianou](https://github.com/esarafianou)) | [ataseren](https://github.com/ataseren) | Steve Thomas ([Sc00bz](https://github.com/Sc00bz)) | Dominique RIGHETTO ([righettod](https://github.com/righettod)) | | Steven van der Baan ([svdb-ncc](https://github.com/svdb-ncc)) | Michael Vacarella ([Aif4thah](https://github.com/Aif4thah)) | Tonimir Kisasondi ([tkisason](https://github.com/tkisason)) | Stefan Streichsbier ([streichsbaer](https://github.com/streichsbaer)) | | [hi-unc1e](https://github.com/hi-unc1e) | sb3k ([starbuck3000](https://github.com/starbuck3000)) | [mario-platt](https://github.com/mario-platt) | Devdatta Akhawe ([devd](https://github.com/devd)) | | Michael Gissing ([scolytus](https://github.com/scolytus)) | Jet Anderson ([thatsjet](https://github.com/thatsjet)) | Dave Wichers ([davewichers](https://github.com/davewichers)) | Jonny Schnittger ([JonnySchnittger](https://github.com/JonnySchnittger)) | From 77a763c50854947f5a45f2dc328cc13c85a27e0c Mon Sep 17 00:00:00 2001 From: tghosth Date: Thu, 16 Jul 2026 20:14:29 +0300 Subject: [PATCH 83/93] Fix links --- 5.0/fa/0x15-V6-Authentication.md | 2 +- 5.0/fa/0x18-V9-Self-contained-Tokens.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/5.0/fa/0x15-V6-Authentication.md b/5.0/fa/0x15-V6-Authentication.md index a8f3c4986c..175e009b65 100644 --- a/5.0/fa/0x15-V6-Authentication.md +++ b/5.0/fa/0x15-V6-Authentication.md @@ -53,7 +53,7 @@ توجه داشته باشید که در زمان انتشار این سند، استاندارد NIST SP 800-63 استفاده از ایمیل را به عنوان یک مکانیزم احراز هویت [قابل قبول نمی‌داند](https://pages.nist.gov/800-63-FAQ/#q-b11).([archived copy](https://web.archive.org/web/20250330115328/https://pages.nist.gov/800-63-FAQ/#q-b11)). -الزامات این بخش به بخش‌های مختلفی از راهنمای [NIST's Guidance]([https://pages.nist.gov/800-63-3/sp800-63b.html) مربوط می‌شوند، از جمله بندهای [§ 4.2.1](https://pages.nist.gov/800-63-3/sp800-63b.html#421-permitted-authenticator-types)، [§ 4.3.1](https://pages.nist.gov/800-63-3/sp800-63b.html#431-permitted-authenticator-types)، [§ 5.2.2](https://pages.nist.gov/800-63-3/sp800-63b.html#522-rate-limiting-throttling) و [§ 6.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#-612-post-enrollment-binding). +الزامات این بخش به بخش‌های مختلفی از راهنمای [NIST's Guidance](https://pages.nist.gov/800-63-3/sp800-63b.html) مربوط می‌شوند، از جمله بندهای [§ 4.2.1](https://pages.nist.gov/800-63-3/sp800-63b.html#421-permitted-authenticator-types)، [§ 4.3.1](https://pages.nist.gov/800-63-3/sp800-63b.html#431-permitted-authenticator-types)، [§ 5.2.2](https://pages.nist.gov/800-63-3/sp800-63b.html#522-rate-limiting-throttling) و [§ 6.1.2](https://pages.nist.gov/800-63-3/sp800-63b.html#-612-post-enrollment-binding). | # | Description | Level | | :---: | :--- | :---: | diff --git a/5.0/fa/0x18-V9-Self-contained-Tokens.md b/5.0/fa/0x18-V9-Self-contained-Tokens.md index 20fa897eee..3ae5f5b231 100644 --- a/5.0/fa/0x18-V9-Self-contained-Tokens.md +++ b/5.0/fa/0x18-V9-Self-contained-Tokens.md @@ -33,4 +33,4 @@ برای اطلاعات بیشتر، همچنین به منابع زیر مراجعه کنید: -* [OWASP JSON Web Token Cheat Sheet for Java Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_for_Java_Cheat_Sheet.html) (but has useful general guidance) +* [OWASP JSON Web Token Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_Cheat_Sheet.html) From 1fb2177244c6097ef000e92bf0a84f20c0fd2bf0 Mon Sep 17 00:00:00 2001 From: tghosth Date: Thu, 16 Jul 2026 20:30:11 +0300 Subject: [PATCH 84/93] Define LaTeX fallback for Persian non-joiners --- 5.0/templates/eisvogel.tex | 1 + 1 file changed, 1 insertion(+) diff --git a/5.0/templates/eisvogel.tex b/5.0/templates/eisvogel.tex index 1902734b88..aaef4bbf8f 100644 --- a/5.0/templates/eisvogel.tex +++ b/5.0/templates/eisvogel.tex @@ -205,6 +205,7 @@ $if(zero-width-non-joiner)$ %% Support for zero-width non-joiner characters. \makeatletter +\providecommand{\textormath}[1]{#1} \def\zerowidthnonjoiner{% % Prevent ligatures and adjust kerning, but still support hyphenating. \texorpdfstring{% From 4512cfdb564bc12fc5d92f566e9f12aa0a8bc501 Mon Sep 17 00:00:00 2001 From: tghosth Date: Thu, 16 Jul 2026 20:40:04 +0300 Subject: [PATCH 85/93] Fix Persian PDF font and RTL rendering --- 5.0/fa/0x00-Header.yaml | 7 ++++--- 5.0/languages.txt | 2 +- docker/Dockerfile | 1 + 3 files changed, 6 insertions(+), 4 deletions(-) diff --git a/5.0/fa/0x00-Header.yaml b/5.0/fa/0x00-Header.yaml index 309d2b6f5d..a1118f91ec 100644 --- a/5.0/fa/0x00-Header.yaml +++ b/5.0/fa/0x00-Header.yaml @@ -9,8 +9,9 @@ toc: true toc-own-page: true geometry: "left=2cm,right=2cm,top=3cm,bottom=3cm" - CJKmainfont: "Noto Sans CJK JP" - mainfont: "Source Serif 4" - sansfont: "Source Sans 3" + lang: fa + dir: rtl + mainfont: "Noto Sans Arabic" + sansfont: "Noto Sans Arabic" --- diff --git a/5.0/languages.txt b/5.0/languages.txt index 9e3a1dd9d1..cf2c2075df 100644 --- a/5.0/languages.txt +++ b/5.0/languages.txt @@ -1 +1 @@ -en tr ru fr ko \ No newline at end of file +en tr ru fr ko fa diff --git a/docker/Dockerfile b/docker/Dockerfile index b5aa15bdfb..29e82e0e2e 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -7,6 +7,7 @@ ENV DEBIAN_FRONTEND noninteractive RUN apk add --update \ alpine-sdk \ fontconfig \ + font-noto-arabic \ font-noto-cjk \ freetype \ lua5.3 \ From 813d34a5583ed202b095bf8013c48b7cf5b84960 Mon Sep 17 00:00:00 2001 From: tghosth Date: Thu, 16 Jul 2026 20:50:27 +0300 Subject: [PATCH 86/93] Use bilingual font for Persian PDF --- 5.0/fa/0x00-Header.yaml | 4 ++-- docker/Dockerfile | 5 +++++ 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/5.0/fa/0x00-Header.yaml b/5.0/fa/0x00-Header.yaml index a1118f91ec..49e2d5f62f 100644 --- a/5.0/fa/0x00-Header.yaml +++ b/5.0/fa/0x00-Header.yaml @@ -11,7 +11,7 @@ geometry: "left=2cm,right=2cm,top=3cm,bottom=3cm" lang: fa dir: rtl - mainfont: "Noto Sans Arabic" - sansfont: "Noto Sans Arabic" + mainfont: "Amiri" + sansfont: "Amiri" --- diff --git a/docker/Dockerfile b/docker/Dockerfile index 29e82e0e2e..c490dda1db 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -57,6 +57,11 @@ RUN for font in source-sans source-serif source-code-pro; do \ done RUN mkdir adobe-fonts RUN find $PWD/ -name "*.ttf" -exec install -m644 {} adobe-fonts/ \; || return 1 +RUN curl -L --retry 5 \ + "https://github.com/aliftype/amiri/releases/download/1.003/Amiri-1.003.zip" \ + --output amiri.zip \ + && unzip amiri.zip \ + && find $PWD/ -path "*/Amiri-1.003/*.ttf" -exec install -m644 {} adobe-fonts/ \; RUN rm -rf $PWD/source* FROM base_${WITH_CERT} as pandoc_base From e6025d56adeaae3d7ef1543689e8c676397a6566 Mon Sep 17 00:00:00 2001 From: tghosth Date: Sun, 19 Jul 2026 08:23:56 +0300 Subject: [PATCH 87/93] Right-align tables in RTL PDF output --- 5.0/Makefile | 6 ++++-- 5.0/tools/rtl_tables.lua | 22 ++++++++++++++++++++++ 2 files changed, 26 insertions(+), 2 deletions(-) create mode 100644 5.0/tools/rtl_tables.lua diff --git a/5.0/Makefile b/5.0/Makefile index 9cd273185d..2f84e4ff2d 100644 --- a/5.0/Makefile +++ b/5.0/Makefile @@ -46,6 +46,8 @@ PANDOC_PDF_FLAGS=-f markdown -s -t latex --pdf-engine=xelatex PANDOC_TEX_FLAGS=-f markdown -s -t latex +PANDOC_RTL_TABLE_FILTER=--lua-filter=$(TOOLSDIR)/rtl_tables.lua + PANDOC_DOCX_FLAGS= -s \ -t docx \ -f markdown \ @@ -90,11 +92,11 @@ md: $(MD_FILES) echo $(MD_FILES) $(PDF_FILES): $(BUILD_FOLDERS) $(TARGETS) $(DIST_FOLDERS) transform-md - pandoc $(PANDOC_PDF_FLAGS) --include-in-header=$(TEMPLATEDIR)/header-eisvogel.tex -o $@ --template $(TEMPLATEDIR)/eisvogel.tex $(subst dist,build,$(@D)/*.md) $(subst dist,,$(@D)/0x00-Header.yaml) + pandoc $(PANDOC_PDF_FLAGS) $(PANDOC_RTL_TABLE_FILTER) --include-in-header=$(TEMPLATEDIR)/header-eisvogel.tex -o $@ --template $(TEMPLATEDIR)/eisvogel.tex $(subst dist,build,$(@D)/*.md) $(subst dist,,$(@D)/0x00-Header.yaml) pdf: $(PDF_FILES) $(TEX_FILES): $(BUILD_FOLDERS) $(TARGETS) $(DIST_FOLDERS) - pandoc $(PANDOC_TEX_FLAGS) --include-in-header=$(TEMPLATEDIR)/header-eisvogel.tex -o $@ --template $(TEMPLATEDIR)/eisvogel.tex $(subst dist,build,$(@D)/*.md) $(subst dist,,$(@D)/0x00-Header.yaml) + pandoc $(PANDOC_TEX_FLAGS) $(PANDOC_RTL_TABLE_FILTER) --include-in-header=$(TEMPLATEDIR)/header-eisvogel.tex -o $@ --template $(TEMPLATEDIR)/eisvogel.tex $(subst dist,build,$(@D)/*.md) $(subst dist,,$(@D)/0x00-Header.yaml) tex: $(TEX_FILES) $(DOCX_FILES): $(BUILD_FOLDERS) $(TARGETS) $(DIST_FOLDERS) diff --git a/5.0/tools/rtl_tables.lua b/5.0/tools/rtl_tables.lua new file mode 100644 index 0000000000..75fce16e01 --- /dev/null +++ b/5.0/tools/rtl_tables.lua @@ -0,0 +1,22 @@ +-- Pandoc preserves Markdown's default left table alignment in LaTeX output, +-- even when the document direction is RTL. Convert those columns to right +-- alignment for RTL documents while preserving explicit centered columns. + +local function align_table_right(table) + for index, colspec in ipairs(table.colspecs) do + local alignment = colspec[1] + if alignment == pandoc.AlignDefault or alignment == pandoc.AlignLeft then + table.colspecs[index] = { pandoc.AlignRight, colspec[2] } + end + end + + return table +end + +function Pandoc(document) + if pandoc.utils.stringify(document.meta.dir) ~= "rtl" then + return document + end + + return document:walk({ Table = align_table_right }) +end From 5084a0a6eb18b894093548ce3c12589bcc0a33dc Mon Sep 17 00:00:00 2001 From: tghosth Date: Sun, 19 Jul 2026 08:38:34 +0300 Subject: [PATCH 88/93] Handle LTR documents in table filter --- 5.0/tools/rtl_tables.lua | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/5.0/tools/rtl_tables.lua b/5.0/tools/rtl_tables.lua index 75fce16e01..19eb3eb5e0 100644 --- a/5.0/tools/rtl_tables.lua +++ b/5.0/tools/rtl_tables.lua @@ -14,7 +14,8 @@ local function align_table_right(table) end function Pandoc(document) - if pandoc.utils.stringify(document.meta.dir) ~= "rtl" then + local direction = document.meta.dir + if direction == nil or pandoc.utils.stringify(direction) ~= "rtl" then return document end From ff8e25d70067bbf63357047eabcda3d67b4c6901 Mon Sep 17 00:00:00 2001 From: tghosth Date: Sun, 19 Jul 2026 08:51:01 +0300 Subject: [PATCH 89/93] Add output docs --- ...ecurity_Verification_Standard_5.0.0_fa.pdf | Bin 0 -> 509308 bytes ...ty_Verification_Standard_5.0.0_fa.cdx.json | 3057 +++++++ ...ecurity_Verification_Standard_5.0.0_fa.csv | 347 + ...curity_Verification_Standard_5.0.0_fa.docx | Bin 0 -> 240713 bytes ...y_Verification_Standard_5.0.0_fa.flat.json | 3109 +++++++ ...ication_Standard_5.0.0_fa.flat.legacy.json | 4489 ++++++++++ ...curity_Verification_Standard_5.0.0_fa.json | 2774 +++++++ ..._Verification_Standard_5.0.0_fa.legacy.csv | 347 + ...Verification_Standard_5.0.0_fa.legacy.json | 7259 +++++++++++++++++ ..._Verification_Standard_5.0.0_fa.legacy.xml | 1 + ...ecurity_Verification_Standard_5.0.0_fa.xml | 1 + 11 files changed, 21384 insertions(+) create mode 100644 5.0/OWASP_Application_Security_Verification_Standard_5.0.0_fa.pdf create mode 100644 5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.cdx.json create mode 100644 5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.csv create mode 100644 5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.docx create mode 100644 5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.flat.json create mode 100644 5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.flat.legacy.json create mode 100644 5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.json create mode 100644 5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.legacy.csv create mode 100644 5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.legacy.json create mode 100644 5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.legacy.xml create mode 100644 5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.xml diff --git a/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_fa.pdf b/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_fa.pdf new file mode 100644 index 0000000000000000000000000000000000000000..b27fabb9e837149ae728294ccf18db4a979509fe GIT binary patch literal 509308 zcmZ5|bzD?m(6@nrpo9o0jkKh~(ku;%ERB?;LayG^;W`6~8E1KC^xLD%xKIZ{} zz+gOQ7bi1gTRe~PKWX7QlRdvAx`;)E0@>w_h;KS!(L6DFe}nm!B9;W!Jz}1i8yH$5 zL%AK+5rXGWU-oOQ1GsbZ)zO5H0Ew+^405kv5emZ$UH9XZv>YwpN6t2g9@)~DN;!Q zqLFq&&Yu4(giBi+{}mqsT0)JH@R4bNJjSX?VLG<(LbHZ+8$+WLifBBBkzbbOSZ%?u z=db|Mi=bld7v_&gK%j%NdOHsR%(Q2E<|p5NN;lP48{o0nW7fUVtC3yL(2ThxB9#4V z`0$y&gWg5q(`ib8A~Bn=)SP$ES#NzkW``L=$TY?8AVL$K)5lmxN!0O)n5O4#uvPs!1(xWqj+zMxg%k*1D9)mC#DsZD2;N(RouJjyn>6f>9Y47)wm>c8y8cH=PRE zTLQxyH-t^`2dEB7^2@$r^to||S^7xP2BVEc$j!2pvag6&hqkwXA+9RbLh|0JikI-uLJReCV1sZoL-m}vAf+Y^Q+`f!be46mH|mmC1Y?>D-Y zVqOZ%V`khSf|z2!xiN%w{TCZSC_^%aQD!i}luo%qh=~$oA`xWp-7k6I;sgH@X?C~` z20+XA%!1Fl(ZU*7#|qvy?h($Pe1 zxlQM-*AicJmnqOl{Z=u<=s(XWBD6#wtn50xgK;Mvzu=bW18rFVynx@c4}0EQ#yq9L zDBaQC&E~oC>{*K15XP=2S+!3+a2+LO-GRaTpg;SJr{4Kwdk5CLWv*xYwBoD#Pi^$L zF0cIYzxJb7?UVQEfO)tXmdJN7a~A>V#!}0n`X7@Mf5S?Skq=vAgu2|oeJqF@IDGSC zQHb$t<=t10BZ_}scIQO8jL3sH9|5=9%zQ|dg;n$f{MW00os-JGzASs+EqE7$sYJP{ zmZOFs6xIMQm|A*6?zsz!eXG-y{<`WdX5F|)QZUVnyhBEH{JF_kx;9ToxhV{uxG{s$ zFk4@((deT*jReEUa^HArOu!LQNrv$ig_!ftz3KlY&>KKYE`sqn9cvpz)SfI+C&a_} zL`pzM&D_dAcFLW^_9k#->16H797&q%whqC@3gIpx4+>J zC|Z1TH%{?ny;O3;c=wpTWHECChTtT^l_d58y2{69p4t4~qM5I4Xv^7w)+5iZ% zFe0)6I2o}F!0vPG@}44LdAD7@-5`sSfB=Qaacm+Zn?gg@rGc)IbO)D=# zPj3T4c{-zUO04>q-!Jp`sMB8h^DT5^$oa_0T4h{lzY1)M`-l84L(DZwFGU%#G%ZL6 zn()ETgI`?3Ei}o3MGrIXHNUt&iiro}ilS#gX=n~vqyt7Do+0$QFcY5rH240lhw+c~ zn+&30%O6it7_%`8amJ_*5F_53#>-$3FK@S9_Y{-md;1YFMjT58P)?nlwsw+K<<$e` z8(oek3U5Cc0<6yD=8B~HrY@t7mB)gsx{oO}Pk12x!sH!GW2*R!~y0Y`YC8? z>BM8wn4DFw!@G?i0gWhm(b9w@d4mae9)v1y8oG7~C?i@e5w|c2V-#B1wz;`Pm|jh= zq#0ukDE<8d#F?Lo@&%!V9={`|jN%UPv5l1~x`7?hk#KTR8-TPLn$ylY!Fw)qrJvp~ z=G@yV2@nVG%ZI5}xNU{TtFw^cTrb%646&R)ui8K_PP+gDrtmN#MbBE}-NI7dxLi*N zX?MxYr&rgui@&?we!d#$5AF0K8MD_@BIaM$;P!VWSWuBIuulsD z+Atc!HYGcG3GQ!J$jkGlKLbdDfJFfhPS8zT2>nk@}UWPMP7gs+TR4Xs_>u@E{t5o z@O~exgR#P}lUL?)>fcZM(dPr@D!^)8#lM}`WcECmA7Hsbk(#=3VH4re6=*JWmdpil>d z?7g@@H886R2ru}dz+a$l^Ff+^ZRX2HJrt<>r3`PxsI*f%G@cfw&2!>0!+1zR1MCRj zGga90b!an5`67;@1NSiS1xc0k5r?IBMd_xY)+q^r)Hf20vQO~i`DFXV{*i9CB;P&2 zlDW*+%kP8fVAv2~b)#9+qq?2}+t_8%$yLg**G_{q5n&i(aJO7d1BcOkZ_w~Bo`7r# z`-HuymtuMEZ0za2WMTBak-O+D^MtxzS;LRR3R8U6)Tay2e~&#xnhICkCg8XO?89m2 z22Aarb@^+}ab8FRh4BSt?)iKrt>}2wAe)yA6sWrrELrjlzyN9D!_+wu}SvxLAMAi=J0-Ve6=88p^vU%GkA_qt7kl!GpcygG_9ydMQ2|C z%})T|kRTH-a=-7`eD}d2%;QZw8KCJ0W{QxyUF@03#7OaF9AWV{oglVDLV*6HcZVFF z42Kq$C=}H)%W4Ca;Folcn+SX@L$kR4BAb+Lm^D_m8&E1>QRR1jxE1#Ix1~u2CN+W9 zzZ?KP)TE7bnA?c3VksF8hYdmltt<3_8bJ4wwv~^>^qZdgSN{6{XiN|Jp(e1_#>pAN zt8DEuwN}s=CfPm^?NNfBAsmh!>(47svX3Yi_2UmQDidJnApt+P&`T|;7lUV{0&mwc ze!2n0B0z)H{u$y+@*Ag)1j)}nH_(;a%p(J%AFfQS1;$&M0(DvPAeNJoZ?OX^I07|w6EXf_H1LM-FJi+7Os zk~FoQy|T{qUZduhEDyD%fKYi)y7uUy-o`C+fJyZ3#m%*G9rSGjK!1tU7qle6!icBA zC4SfgPraVvgkb}U%52h@IMl!TU99$fKPUJXVjZ6Z=!^m$5gUM4K4cD_q;X%J7u(wX z%GK4mmQTF4cBhwbE-b(wUhqiiQj7Cnf~T$( z1(Ha713JJ;tjWYc@u-B%&)Ol6#f8p%D=H}>Ff~>t!15(TEiilD9qiQbfD=a1F_#C( zo@3Bei@$JIjk_|qT;og9;{(0FuJx@9$s`>g&EFI^4wRI?Os7~}PGtb5uMRvdXTnm2 z*Ltuzq5RxVMPzeUA7Zu&T&nI=I<>&Jspfrzlb0j&uem_)c`&H|ezA;I=a$GPRFJ9} zsaujEQuer9_`W*!^B_Q+l$;YNeth#e&2s;5tuPs1x65%x_PR<703bReM(035R+Ye+ zy2|HCofmt`gkLSY6}C(89b+iAw9zrvxXj3W+)VBwhe1LMO5K)piWlYRpRN(VW9_aKe4|pflbV81{sv9wTUV} zcrCQ^K=c%|zXk_R@@y~ECd=q_o)l|3>#3l>eq4s;d|C0KsO#W^V_INidM)c8?T^R1 zE1YDkZ=N?y%{KGJmbIMBpZEzZb{_>m^?*r|^kl<~>85S5R}l9W(uw;C4RB&)WS8Nh zc#7QCAl-T`U=~*Jn*+DR0mME3jnXzv!M*q;?y+XS=E&e73sat+fD5%cb4* z^h*0i;=p~)$|-C9$kCa&Z_wrV_O$IoWZ|g%`bA@p1o?fs_I*cEW>} z*sEr9rdy#u8kCvY>wTWP6FQ^2uEGx5Uk_yw7EYhz-@EfQleu>VURcL@eptI_n*}>r z`_eumTzhwADx5Pb&(NueYUyMZIJZ%s?JY@KSe;j{A~`m#ALPq99NimuclJw-lU(;i zxfwZHW9frlX%$f&=pe?2R`}Qz!*T{T4znj^Kvre= z4|Rl`_7sbT^!1Qej0a*0cRp%^1f#nbZa4@n?#<+*`nzzc?Aodo>e zeLqsj1^dGp8BpDpe&WeD)+R$){h8c_6tlTH@I$)PNoJa!$F{$jPCQ&Z zGYBRp`N;W@5+CcgLcFT;SHNZ`O}IN1u$~&bY}lKlPy>6a;l4k0lo472NzPLo#jl{` zu}J4~K`6=xnn07?VIqkr7ykLegY{SQT({VW@Om67V``U=^d2MpP$>%FofFE z{IM41fe)UK1Oynd#kd%cc5^e}`+NL_IIop-Pn9As_2+ay`sv9=$Mzx;?sN zQ8ye|_=?yO$vPd^bKrf9aw*ybG}P#Qv|b_1=TtWRt1CtPw?2!i-CO?qbme0LPbvL# zI0(8tIYx!A);jrBA*CY115rKvZ`XohC*Q~?6cs?U<7P|qk_vY|2s+o37d_o1M{>R` z+%=Yr#ozW#nNq!B6|dF_TEMe5kGI4|kZzujH}&QK$n~=Df;nHB*Cib-YB-M%%?p3zz7f#4uG;C_mlb0%vW>|{|evW{4US{MM! zn+=xd*&pltb#%hmRiil$%Q1V zD_YF&Ts#B)sJcol@ZXvN;PJ( z`Ljg71^YlGUwU2+4XYIo}7WM3YjuSr!G{awQpN?jvWtxO> zLu$Fjqj&mv(FH*k(NKcZdUVnAEN(c=Yd}tU{at@Q)xN}S708+tpWB^BhRf!LL_aPk zixnn)-bngWsU7v5KFJzuXAJ>OkfuZEp8+#klzdC9nj+^@y_IO zW4b2=A~$f?@La8`ky85bJ?~QWJ&k}q>=P;h?@s6}Obuixeczf{01D=#I3T&9f|xUK zchqD&>URaofW7he_aJ8Whq~JDnyGNar!0v6t9DW8=?&B5TT7rpt6=mcE1u3CAo!M?6IlT^M^pLb!; zx|!;%XjzMib~^Fd%Iw}q#l(|MxiU8D{AIc_Jxc)uQOoC>{cf5WE14S3d@x#_r|Bxc z?u5j+A*hoYSZX%CdR+Wt1UOA@Z zPOp=;&*d)@m5JCsqYyHb=&|eR$jF$$CtP<1vEDDJiS%A8*pA11MoIK>cak=9}; z>F*_u!~E)|viPg=?`vPo|y6O$pC6oIOUho4nEppW@pDMtYa=s}Tr6-J^ zw$qo0DzL21Ny!GST1sHrUoG)F}myR4u=~AA1M@T_wv$kHX2Ryk^8W4 z^WfROBw;YL-XrmO2DiK##lc9*8?@ELpA~`aJ*G?41>arjcu#_wW<8;@vK7R{-M)>0 zyg|?3&y6AN(n;@Gf<>INVeR!>HMNaU>|JVOK)S zuI?18CW^K^pL^vv6#39Yv{>?73Ltau%qG$rd;s4DMoqRp488vbM1*<=Uh= z)q_lGE>6eeBaYL(`xH5m&PyORZiX(r^1ZCFo|s>E+-f=3lYMxP7De^T6<>2?N)gF% zSxaeqVH(jl#gZeIFD!QGbJ1kV)n16V1=c|QS=xM(BOr;`5=B`VZorgNKr_avd6Ok6piHMV`y9}jYwY=@I6q@!IZC-Bh-ko9c^t^sFdnSvVNE zJRrqga+c+^%Xihil=EXxY|udy>GMg!v;kWZ!jRtRIJG>Uhk$MG`5T0w>r1Z+?K=wk z>krt`*gMVF^O&Z_I+&-WFhjod^yqZ9}5cWH|Xx%Y0VCQP8RA0 z$E7sE%1StThB`ysy}5d2C?XhiATVh!&nls=75Pm43fjA8&6e{6$9arh8ieCKCH1Vf zlYC(|zB|&yu;arBmrqFU)+@(R-!HGcllCBMH2DqCbkB3Ut8RHbJ<)qd?(dIrB_YVx zGd7X)9BXjHRfEDp*@lmco>UV4?P4o4-gY!XSt&y!qzFsp^rr)z&jtiFq*Qh_#&@-s^RCv#<=X1!B>Ou9WZFD65ahnk6#K{>|3WUcSa3r zpe~H_M(5n`!!dVm{79(NRA8EpNDF$W+jQaL>rxFDHE`N|)JbAH3GUB6x8vMy6H`$v zJUQniHN;QWS7kP=dlB_M6D~9$*+aD~>%TMkQ$lnR~I{AHEW3A;d{v$gH`$Nm|=&lmQRIUcM}_xry#IBc+3 z*iMY$n7G}U4=ch}@gpCE1bvA9IbswD69Xr&I8#h3SEg&O>u>dJ9PHTXdAOhhy@L6* zidL&(EDzoveST#6O{~5-)mzER%YUnBz>2L<=)*?!*uBMz`0gKFWI6Rp_~mLxC(0Sh ze3Z1~_iQS}RH_Pv9)#DqXW)i2-XR|T!$dXUZ8lAM-@}h(`|?a6PuSIK`FZC_&Clgz zD>sN6h(;49aVp`bt*7F>3PF8)H|n*KCFatJ*FMM6E3nXPxKP+N&Z-5QsJNN)IF=V6Y%MgxjTeh z^VdZ2iA^I8jd{(JPl4x5*asQY$&2Ugyh5AoDcL0I8qSYKr@Y-B_p_i6gFz&GFo|to zFHq=F!hRP&E#fKTo%vf6`P^Z)y2qWU>%8+Px^GWk>9F$3FtzEVaAuLyU03R=$gj`M zcX4i(I<6dELlSg~4Z8gR!akOenhccT+O2eI9oL7ySmHB|@afosL1);Ylu8}J0d#JD zcoz+;ALMR8oZ;`w=dgq-FC}W1CrH6z7Aw#5Vjq=U{EIcJU;+RFkgR`9CzSIJfE=AbZFCKf4D|&@<8wp#EnXDjokUe zpLZWs5H&0EMaLO3OjZL-csa|SUwqUJ&OL?H1U4m}*$k?^!1#mRP^O+B}0u z-J6ea*Yi+UmK-ol6>&-Vpx$TwL09)aF2SeXN{IXwyWD&jlNhcA+M>X2Gcpug(J`gO z>S9}XpM1u750Zshna1$! zJpcZFqz>5}Pc!9Me8XAa@J5h?MMLK&PeR7p>`xz{htb6Dp0J}^AW;!_HrdyvSBtN@ zT@=1WyyJ&_jvGk2d$w_3Xxn%3CI8H(j#uiRW!YVjw`ZyC)TNhj!t3SWvz^pUChwU* zZm_U2+J0*)bZStp-`Sb)!-RJzlwh{ro1@uN+iJ+;y@I}GEdGwyVu%kRV@>v_kI=*W zHd~h?vOhMah$EhGUv}$LF2n0|8t!>UqATS3tF{d+$>eEZ%iIe8DLAa1^?@l;cpO)gv(V4ToQw)ee% z_6}Ay)y?$iOD^o<(ESgAwL)>JUB>3a++pJs;c?HJH;$zfM$Pf$6FxdR{+Ba}CkfjI zIw(8+D4p}#`JPrzkN5O17)4KBSn^&j2MQp--nTlIne&%#lume981H~oqx9AJj(+*n zQ=Z-ixx0VmaWp9u>akNm`&+IkzR1pBUe;oESdU{*Y(CkZkL~HT_n(Ldk1fO2WL;lB zK6(JznkDcNOp#eQAc_Vx{lQhN>fOu5ukO3&FKX`y@DV}ve$at^Vs#zA=FrQ8Uylgo;}sGd?Zv~uZ5>Xcfomf=1$B1| zlP_HcII?`T0)_V6GE?v>U-t zS9CJ_glJ6XsBcu*1CeOLH%Sq^ed2_|afi{zGbxaFUjq5^%}+;d`ISzDlO@k0<48!` zOHgsCBDSZZxy-w4h315#lN2H!w8dvcO&GIb12cNw0)_j5sVBSRo7fPtZe}dng)A9r zmQfP7cI%igNroocW_nNegQ3j+Q=y!_?YAQ1&pxJ*rj$rjc|)iMkUZM#r~{S)*m7yz zfit;af>ZB3wfUdDJC?B1nR?V}Uq$=^$Mnj)nP`IL_ZY3g`!#8ss9nCB?Zb3ge&i^{ z%X$RGYpS9q!q1$&KRF#f%f5q?e-%}(41MxVUlf9Rlf?S#%u#_#p>C;R%e@E6SmlbA zpA>wX2;l~_)SlkOs~}{ha+p2q%is1mGaJ&I~@N!9*}&3pNxx; z=T$CPYaIGcJLHE2gw^VZnkEEUHGyDXeXy}I(be|N3UyZ<`%_-~L)|dNd zscc?e`7v8cmPs6i$)~QA2$mc?C`BoU!c>Z?R7=LAz<8P$mhw^+g;ua%Ezd4F%l(?I zs~*9uOR=)*tSK6ZR*q|<{=j`vi^Qzc>n?YuEH|H4XTptDB+ZGWLFz4b@%Ew>neZ_? zNLG4JKCavwNk}`*3%QGrfND(p(GTbVdFnjaYp^14S?N{Dsn!CA^1?@mA*C0i)4-e3 z%oHD&ulG~nNUh{x4h`Oe4gRlTzx#e##;LL5Sybf;!+KPGz37rtUTJ~uGYF-O=XH!P zY}Ix+=sU}z&ezydRlDIW9J22^=#pBc<9nmwUT5rzBg>{5K(b%dLn;DIdW=24vvwSJ z?@~rN5XPz!G9u9|#jsGFRZ1Tfql?B!qkB^zEyBVJ)LRk@KjH8t?2Ch)Tj7#iT7&U4 z{PO0K6v-z*3Ld+r{M7a_H+Av)tQc!lQSm?-f&hzsP{fC5gYHL?+Nij{J3uSN2hKBh zfoSusk+>Ed6>E+>4{`fNis$VrrfG*HCCi%Kf^3W*b4!3oFsL!Nh1`g*tLRH4A*qXI zXZu-&^D+4kyclNw$xy(?@T<5$#ezY_+_32SNMm&3FdFH2tZLkq%Qo}m!=uI0h=y)8 zDW97mOw1x!GF}E6yt^CxcZ+3eiHsgpxl)HjI@Mbb-tJa(Q-2MqEMGodVRIN%SmFGA zi~qwTTm7pw?f1Or48iO6V5HU?e$!Ay+UH`!@JV`%os?Cqqj`PxuNmTEdYUFeCvJz= z8vZJ@s!H5LwmE2TLeyh#!?8Lfid@cPN5TXlzNojT*q zhbYDK`uh(Cb9%)EsKRB*d?3w(kMbIrzv9H5z0w6CWE?k7XAP~rpFPI!rTiGguPV^u zR+4YQ66TqyHA90CGkiCfj1BE?FSq)=+fxhV6rh+5XH*%{=1)uY=%4$@*(2GwJSfjpsw+?Wl4?mg-Ea6uB47*+wjg4%zi%R9!HSZXl4RLg|kXejjVUskn zhCz5!dRQ(LWfcPQBGCVk{L$|1Rx&j9sVejdmPty<8RG9P+5#aidzS zuFHs8!lZR{x6C=VmEdOFQgMeS@`Wh4KLo3>)8`#`14V46bNB}Fo=81|f zQq?$XKMaynD*NRQpbGqpVDPz&ev!G4CdhZc0ysq+DxB-WeoBP9PSPtb#8ht8wsGg6 zB}=T{K~CZfiAxo(f7%Y$k^Z#mrHZI3o1jymv0&1TXHD&(cDn-S^x-{s64y|7ds?-e zBJg?4Cetv`#!*(tT^)9+r7v)6iNS15`@48~v#!(p@Y_O^Zz%a%xz$KbChSektOWUr zS6Mff#(bPG*)u|y8EV#w(vS5}SZd2Yz0{NP#otH4q!mG@;rb~!Zn8H+ruviybR$!I zw)evjajNwE;dg{JNKg-Ll)&|6TRC6#P*LBeVGG@M>xEVoN(aVnCbUmBX!TYU_xUCT zQZwNlo>+EXD1cY>yB^TAbZGL9C<^E8t!Uf$8hscEfc6lS(YAFMgf0KsH^ur&q9L&8 zy#COE_R)E-1P}{#j$FUc-xT+_uoA28CvLpu+}!YR``8GDnI1N_$eyXm*usnzpZ!rA(d9UKrrr=`NM2$pDybM$Ug-(dx&V z5xxIzzF0NW_LRqt7ViE$ozUnvU!fag+*vR*8y4r!JH>993A;IMvR7#36w%gz4K-Z< z={0~`u&PQj{wv}FuRh)pN>pey`0V9R+`@2Z>HBK1_L2PhYtUN|g9dV<79_kX5;=Z+ zdxfBd8#j7K*!7Img?uT-1oZ@f@SY(k=fb>RT}bqJ zf-(F_%TswGhMQ!q<%W{t4i4$wM;BMmir^CsG9YC0)=eK?C8Rd?hoM*~-dmO0(-J5} zN0O_4Pc^SS-0MpfAc7js1V}auaFj-?(n?2iU@!CGlDE^EPLvPx ztX|0mRG{xJlTjKUu8y#;ayd0OxGQ`ec`ON1g%}n-2DtL!HLc%mA?Mnf$V{@03HzOC zeg^q+Tzc2oCplucmC`jc{(mwpPj7@m0J~&Bs)(Bh5^F{9ZezF@sq1a@?e5Zz&zde* zsnl-jmt$4;(b#_mB;AQ#P=!L>W(3%W;xb|R%m9AbFiFutftk#UYW^|Fdcujc|Rk2`Mrl7v^x6td})oBO0Qc>C$Nv7a25zt`Z4 zZVtUK_`4V*G@p5Q9K~Fx#zU}tZypz@6gVuFI z&O~fv$m;?DySvDY?V2>zZIvlWr^M#7i@$Kq@!MP@dt$DFm<_$9 zp{@!l2@>~e2q{?IBE~Uel0K(O1>gFgDGB4Og>{lE#WheU4Vivw62nelB=2|EuV9`R zzLkHG_Tk0gN7__81U}3;Yy4fY7XDdz%D@=N%2V^dZUhzs-U6b?##cCPB=++&UCYgo z_`76(eA`aHXL=E09Q}8qRaRo5mHwJ;&hU_4MLd$Ymie-g?#xMkd`S(EfPoPRCB(ia zT71HA{fRH5c-pKVchy0~@dy5lY=5N|=U&=OeJqM=fz6Kr21Nr8CPP-9qNiXWu!{ z?C@R51dQ((a*>P5PZp& zKu88CRA-0n1Sk}x0V=7f6w)`pa7=Z3?uCrnO7wU6AiB{xcQYT}6w6L47V|gI?g60* zFNKXb(jIv6Y?mG}N{&rFZhaGWX%4ygb?c_>_$4a2YQXlR*_!#$niY0@dSl3AzOpx0&{_?}S zn-6zo<6g=XyUq;2xA2PRi~3i~4S)1>^M8Mb>VMa7`009Hp~HE3Wml)bHJ4OYu2eQ1 z(jLqWDxNsXlK^XD{8az=rz&LHAhpn{0dK>j$Xu~P2j##1nzyJ!IL8|2?w31b@|&)- zxBgp%xiGmFs!Kby;!|Y)uwv}ByJpFyo*%2dE<_SkB4E9~EC=Mmf0hDU-ocaN0of4= zv&!Tvmj%m1d7r#8*a#^ZaF+Fd!UWh_g?W~bcG_;3IUgeR(-WLb2J;?*y(fBL^&&F= zCWcFcE;x<%4zsl&6UBGsaWd`W5DPCQT=`Qr@RM}ZdU8SWDv%9@ql~s=Bf#nL8|HLJ z1+ek1{cPCXBDn4A!SnBDVqxmTO+qO`m(e39s5N(v5j`1=8sh6x^w&35fW}JIbOZ^& zR|h9Vvg$&`1#g-riAN}PHB$ut4+hmx-J%`?>L1a{G59Uyg9ct}m!Njo-PBig9o38p z>)1>Hv@)O*^LZ5nU$sUS46K0^W@k;6*QALRyF84n9O>OgDM}HVQ5bhen>DDU_57ds z0Ccd$b5pu1<#QydocA9xG9YzU|1hYR zDr7=|CreX&ry^!LeXW#lW#M8kM|yM=ZNAGrX3yC~K)3J;YXkBGcF_2bb=NZ%o7xml zo-_w$pn(?eopI+O+`RiRtW-J$&4BoZKKDqqKb=|cO`d$#9sS1nY3$#yS7a=F zX$;Y|Y*GDITXXK~hhJ-Ne6>-+9j;e%GHaN0IXVd^w?svmP?*6BzS1k63gaHv} zRT6aETrpU*o9)M0?%{TR-lud+H!YQ06&B4$quXBnsPY|w$=keyb{wlRv3D0PU%7K!>@{1SgN z7gpWyyR8?`DL(~mMG|NU{Y8TaJ6I}{|N5QvUo;qO4;j_?qwmCh2|0YEVcRuJR~a~> zl5i%=b;dxNlvEjyG)hmk^J-$SvCxPplKYq19!>J`zAoXZ8}Fd?nve~w{m(QS27kzN zhY67!xk5q%x4dlFu=s7!fe+>XgROCTVX^RRCXL$oW0lHVRMk`mnc-Sc_POqFa!-41 z?qL((PS3}`dDSObi6*sI8@**Qr8?gJ$A%cpL*k6-QyXJGTpCqH9mp`n@P_Q_cZWbq zZ}Rvk*{|`FSKHY>6dy0~3EdS!{yH~m#+z>_bWr`BDuPH8>1OOm@ilM}I33$2o=r7m z=VDFL^87$pBn&mV+^cL!EWHp4_@B}l?aepVr=%TE1}%kEuk>{onz9e{UXglgwOAKr zICpMyh=|=i5R#?&eQsTMrnx=K_%AHZrx)tFze{5ni(%Ca4$tLr7V$5&q9PCjITTZ% zZ+3h7j+$8K?+dLu3c}|43;v4??^tF}$sD&bNoK38E4Ir`!Y|ryt*uh*DGS83wsWYoRwv@}mw0ZgFu!@gY{1L(qM8cfIiZo$K0W@4Envc&xBl2Id`E6t2 z!<6IyB52nqw#7NVMJ!qr@(|@x0$WH?!I^D+*4$%K+gBMWSQ9*VhJ`u<^Rbz z24oOC03@utbZ?v}zT>>xLpjumK9w+;uxJwK0SX!HYKf^_$CS|XEVoqfz0t(5_{r6O zHFC609{FIRmYH+-MrG4?TD=L2@dRW{Jp(c_UftW%_cygFP0Z-|moe9Le?-Jo3q$Iy zm(^jU`FD2y!^b!FhbJY#ud&9x5rr4T(m?U*>gVCBlnlMA;Vy;OW5=~C>wX8$(~Jw~ zYlX96YdsMsWDI*i4bbQ8dah;SCX-Sjn`?7cAsCK#BLCPeM9rn)eo}RO)C<#D;|{I{3BB7zS8E6T`?_=3TYX#?Xqa^P#q9DR2TG z&d!SQxbbGw{{ng@XGm!ECxC1g)Gzzx*oUbEsQ4MvY-+T7D1S=t*y*bi9-c-{e~p@h z7FWub@^5uEUzCjhx6|I7d^;1!hhpkYsZv1~-9edXa!QCD8?Z>On zz{Pc6L^;L}NAoFAj<$D!7sCE~m;Y19++xMrVZBD32gSxRc_GjO=5H~@is;wqK{TOc zZT5NdoUOkVe@#g6gBBaIFy-_J+TXiE5FDPl!rScHDjXJN{#vxt-F50OB;!vjH^;5{{_ zO>Iu*+1i!cNm!)EXW@K^x)<=L+F?fz%r|!iX*qZ{$8=B*U+Q0sWJ`N+UCG&c75uo< zq*MgxY5%-~0>4O_$bo_@?+Cs@Qf;F2^?o1|=y%J_GY`oA)t$SGG@ts*^l&YZ8u`l- zn(@G!Z&o`emX;OizLOUHsjH%L^E0Sj!_&~~f`e(mnYq}jJF9Dk_}p(3E9vHcf%;9} z$E8+8^E;y>r;E%TTh{EsW<+K!hFrG%s_w-OUDA1oe}SK@vZd;G_aet(#D86QlSx%K zfAKt|0!E**jDwnNz2bnY$lgKn0!!O%gYIx>(0-pldE>H(T-)HHZKb%ewnJyOEq1xP6-&G`RTc}^vI zh0^k0L9gl`{yOK{3+l4L=VIN|`M1q5XL=7$me#2XA{Es0LYiAEPVoyLS6IRFm-pv) zXBzRWX%Jw$@q(g__YFZ3)_;SbTYzLxOt>&^?_KcvlOd_IOH@hVttp3kp54}{>U%Af zIk8EC;@S;mRcTkLgtJHqOb`ISbI32Q?Pb+wNwvLYwSL<&i#ZGuDzwiW8N?81fNox2 zOPo70bMbfeTA0t6DVOvyPO%-&xY8w9PA|i|PHPQhtC*K70_RCtBwqj-v|Pc`o0Siv ztDj}t27Xn`RRgz{C*MTHyrH3dts`$={C~Z~-3^+HhUMEs@PZte*wwo3A-4Oth9dmr zO>6$E1%J;^-00XaXo`4@z@gyonE7Wbhkx}M%Psa@?Q*=sC8Z8bxR9*?Mn(3p+zLEu zwmp2DMBGP6Ua$L(yJwrSYtx)Y6GnuIMw@)*iU%py;KO^wC|L>#e9#LgIZ)aheeSmJ zuaS|O3+N4xyVlLe7CKw@6b&gGI((IoS16yC>DlU17?5~vb?y#;v@WD6rD3Nxbn{!| zSl=a9{os>b_0t|~n7a@vKH=vQp5_*ql;LAvOC-IK5W{heE^rpw=-p=@VU(e?>Kdnl zNcTt0{fxBg*=fF$k!pX^ySd`3bP5g=V;5L6ccqqA^7?%LZ`d>^-`IZEz}D_3HwP~u z%nX^1QiUiwBVHpm?avNg3Jxsn7g48{DY{&kc!{)>O8FCGumOs5zPSbPi~KF_R9nky zXHJQXQJ@q@`NT&?XQr(h4eb00to;U2`cPN!>_=V#!lQRnp! zEgi;zjV$1ojuXyuNA1k)8oc_*a}T4V!=WPt?#{WExV>su_HSS~r?9YnF<}_6Q zdbfAeZ~ZiX><`0Exo~HwB=9%=BC89#iC1r?EO+5f0{oC0Xr1nn(#)3Ty6j2r=|0=> z$^d0{OvoqP2ZAYDPzdqF+XeW@^IKz+k(@ea#Eo&JPUsl?!FCGF;_R|xylJE*v%NXtLtxzxx0T{v z6mRhNDLeF51>Do^3Oo~RJrhrpIi=g!&=J|M$@{J@Sa^GeLlb@B$VU`qRjSi5oeLvJ z9&F}cCVsHiErcsY{#U7wy`!}F zuVj%i#paM{cl$e}_^aWt<@(I!t=1!7=An&<%mUMZ3&bs(-G5oz;T+q!D>yO;=N(gQ z3W3?6QfV_`FJa54(>^P+XLA`n{Vd#utEvymIy1qyuj2_|tV`TI(zZpaLOu=at-g9L zpJYF+20HrnlKf>4-zYZ79cO(2JxR_6EA~vp(Jm~#$p2AOd4RzdS`bo_QN*?q1ri7`F1p%$NqPbD&ir; z`J(j$HS9;;X3a;bcR)cH9;=A>_pFwB^!d}7nNNK|OGLT{K1fI05c7^9)5;FF$yM;u zdsAHd4e8xFcrJAP-u6ELWPD=HfdA(p$Ez0jKyjk-yXl3`P*x7?E^ImUU40O=l-nv{ zN;GzSm;Cqtn6lIjJgXXXRC=T5i$)3>LZH#{`!*upq7 zyyCtBC``iRLMnO15ItDqP%R&Ulan`9bj6>n_y?5_Z~L+}y&Y`lt2CI8e5SU!GIdE+ z_rIZ|#JV@1(RlB;m5m1S(WT5T;bGN2o`(7)pS{??B7fq-+Vev{JNFr_$x_TQA}b}} zSz$&)Tnpk=W~C;lp_fPNa*_zMRyz$|5OT6=s$$}IL$1wYZ?~js!}TE>P`L}&{A@V( ze8d|esZh;WwJlV1AdE2Utp+bg{8#wc#PO7i(1rH~tAkT|!2jyi%)0la7?P^XbpDSa zPazvt@dhGl_&u@QG%2yg7c}SDZr<^~YMn9-^!iJ&MSWR>-91`2mqdg;B+^h%AV?Od zw=n>3yTuI0JiGMtmT3H6mQV@0kT{n&yi*2ZXSRIu9=JwXu*)}w3-MzU=PjRV9@y`{ zgy*gsh)^3wH)&J6gJ78EUF=S~z+h7J=f=fgP`CN~IM4w}%W*3soFU(%;YK9np96s=i&Spfp- zUrxXKxUzI5`cO_SzbqMAW~VFUqqB~S+CRRvsMDm@kd@iXv-1c%bGh+A6OtCuavh`D zu&9oKoC0*)3%v)>HPnm)FaOz@JgRf^L#vyDVOm+uS6wJL|EI4+(Y}gRTu2Rq7=JfpK)w!AY<$09u;yAJXN$6+jp}$AbbbejlDhvoA{bL*0HVtl{PaA=bDuh1XLi%U7T@)p1 zL9;_9YoQ3|Kohw%qCyV|wf1p#8^z6=U2lk0_8;%Rb-zhBx@J3IGU9H5UCnb=Dp)z&5 zE^U+~s0m5XxbC;z;u#~wZHMCV^7vtY=@GrT zEbMap91hXmKzg70lq`>YIoe zA8fp&d0J2=!R1)3B=_aa(mz3=YJTj{m>+%0U(45$-WxgAC_qmMn6;uOv2H$(>_M-p z^myy`9C(t~=XW4=h%ygW&$@j!EpdtoA$r`goyLEY;$U9F0?n84HSd+iaKAwRndOt@ zg6DgZdJUv=EP3P7eE#=3x9BpgcGF9(Kkwswxq*5YKr7)D&i?F_d{philTzN8yU3tD zxXb)rD1DXvsdU2FFAu(`RqAl{mqqXg@qbrvq{xYGp9?KpmCN8K>#YGqUp_K5gbIrX zOo<6x&^&|*{vbQxE73(eD1n3m_}%o$nLFZqF3sGYPIg&c-n4`-{c!!fb5yM0%3m(< zN^<9hi2n`X!O~`U`bA)dyGp22o(o~&&rzlVIEB+xlN}A@EKGaENk<#8LW9;(TxUkT zZCCoZ+yVY+x^jf2umhnEL?rn`Eo|@w1Eo;s@6#>+=3K3Mji#@+4*LHc6GhDMhEbX) z%v6YJBIjXYqjk4W_;kki`Q@-*Vo90&Hc9HLBx{SYm;BE_lDY>xEGG{m%HXtL0-wZn z$kW;;IXB%%FaB1+v(Sq1Liiba2f3deMVP|#B78$W?C$w8jtjvCJ)bRM zx0+y~^$nc#XcN@`yp=dMrT`n{R-u}GQ^g6>mtjBW$*CURdEH=9l+^j3A@7WeS(`x< zPd{P82A$k$WXrq4UQPY*C_qN07=C#TIDFx-D{X@IXKW)sZ2NNGbli!gi~+++ ztorenfxpn$$cbLdGcv?X_GalFXEVQDR*Jea$w%Wt&WBNt!14>}uK*te9I4($ltrms z+=12K8`PRovC3Ryeyk_cQY*kWE;M_mLvh8lD!px|VSwmAd+uc+@czE-3ab~}y3BQ) z3d4bI_v=r~^F#Mf6yc<}bCji%lj!b7NvOj=EyLy(zfoQsWjj0Ns&U-zn3+nGY6pL5 zF`gxhB~gifw@q@vM&2%r%7-uK+g-^nX8B&^T09*k%SKN${sVE!Z}0E~=lPnjU=58rZQ zuy{?1`^8Yj?=tqE&Zs}{D?&uHOoj~)*^7(i`5#6Gq)a6Hv`b;saXkV%3N9UZ|J!*B zwT~cikcCVMbY+TMT-nX_z~7g8uap-SNA@2_t`>>Ds3CY*o^tKFP>O(kaLP$Yw--hZ ze|D}M_XaU2-fBH@{uunQe%O+^4=>CK??#7B$UjD+?6DCU&vd?DL>2ly^&S?cd1H6< zpnWoC>Eyk)Uft6|%70@NxTp}@*jc`%ylP{>t_}bnIXH??12?avd7Bq4I)5>AT$KN( z=Td9gi9ufeFSi4*2ybeL$;lVbuv|$F;)QKzJ>b3fcP|bY8fiOQhVOL;TPv?BXARHS zW+@uqJT0t(2f2q7PCA@H**b;FI+W(HJo^j_{=?1HFxn6EC`*0zMP_UAYTsnIPsnZj zAc>UK3NBSG-J$Q*ed6*T@O#*x;PZIPA1Sx)4D?4V@%?&D%9I=jP-_r(!%fkf8Co4vzF<@J+{&MIZRbKSR@>pS@yTllBkD>?J{)~epCQ!f)>gP5 z;waVr(k>_oKL^<6C~4&GInsYH$jAGCgY)H$zKPReL65(04;RkQGHhU(s{juc0GpVA zYrH;*FRXneryu14$kgM7JXd%7@Jt?)ed|#tN#~8Hu$R=NASio1hGR^)8 zaJDOs?9h%DGr&hCckI+y{{gg3E$)1V1>0wtjEV90dOh6dl*ckUv7Z=d_Tug94#&ny z9<2q|5c|*S6Tn?Tlqyk82xm;bFeVr_)+M~4WrF)jlT6#dVGS%>pay$V703^^yOVi> zy1>~E@bNFuM){+O`n}N#v2~)7@Hk7-kXNmjOaqJ+>UgE%42TVF$otI>a~Hlq57rutTqdAZt%>ya&XG7X9-9+VIr1kZ#n+irF7?{~{W1^kEODy;a%hK}{CcLd-)AyvJ<{ptR^6Z8t{4APPe!n za|iPdVR_R%Ny)8xWzsWH#oFW6=qW&_zIvF5j5>So_z!@Jtk;LN^Se|aQ)Zcz$@(3; ziGc=ZLvK}Xee|1k?hIV=$Q+n^OSremWAxDwbL`cQzxX`DT3;%#0J zyDUxExXh$hPN=UTks|B;=@&DwccbAHSEPO=R|c2+pGi;j>*Ews?}TpXs!DaJ{fNw6 z4XM(e(}d3WzdG>er=h$OcPc0?cEV{&?G<(qM=bIL0vF$VdbeOaY$CWwp~xvU zOKO_-{e)z0ppP$`wSdM#J}+veH9tC$A>STc9I`eVj6*en30o+rVq*Dudy!w?!jqOB z`Qz2eAcl}#b%r13pmttCf`;+@1#u`*k?1RhJMPr zVMSj*wS#~AT;9O%eY4s}1oi8>jEa&l&;F2ib16{|a^Z_G!O7*$I6+`rtRXAw$z`yo z?vtAg$~Xwj%B;W^0ccskjY%Cy!}qp0?g65O;iBZk#2u+X)xfkU`-rzcO-Hu+J@1tk z|B@;;nV)i_Rf0^J8}CcxS&SINT&6OqZl&5qi-a6eY+;Txoau(PK-*gku}Rp*4!w6b z6dnr~7~3#1+E0itVJm=9KP+Ln@CIY-Mmm`^tUv zh>WJ#fe(r>J~s$ta$>^-f=~)g6LPcOMae+3^60~fqH&WJ%tLB2 zuU)@jlW|1)b)DE49hfy~jg+gx?m~6qa7Zyirs#^o(y~_;@?J~0-dQxOCHDn$0o-h{ z;N3BaO$+rD(EZ8jk2ucT-^LfVi)s@j8cZFkxg41$#MgaGDa+9?t!bv)s=^K>s2A8C zT55P%;Argx$yy-8Zi@})p+O#$z}?=ktof-(B3c;ELinPxEJ|r79Em)kaRb~bn$zRrI_T)~H8QznFgzt_n`A2!QeDMPMW&35w zVWFFFk+Y^pP+|L)#@jyuy(;7FJ3uk%J zw=BY{)&043A~E!bPLgASs0bqcr+T8DH+xZtf^Tv0c)q6Y>xbAxd5>-)4@%+u&Qu}> zzeqFu^5GbyswE8RwSts@{DZdIrvMIvR z3=MtdL1g?q&WFrgDB>e~{pzhT3|Rf-pg(#&vbQwM_Dr9DE)BKq_~aksUJ$J|t-gs( z@KZR!#$KBHmL=OK*~B6S2!bmx{&yg+VH1aiKxuLBfTz?A`lq9$mAS=939G8-xdmjm z91Oc2b1Wb}nHlo~_us?F3X3b)U8HYY3Fc6Q^HU4Wl!FfeyWc?RWqHofN?;~MtwRyQ zw%F%KS0NN}i7U)G7tVr5sXOSSAs6r=$Rsl9rD>fz&9^7~e)x|`>5^JJs6JbF){rUh zv_~CKvFYIAzP#1&NBf3*RJ*`^;X$*3)^Kl!TY8 z^&|Mt-tMa&ug6+Xl1ymA>JDdg=@g&vZHN>}bNofMt~(M-=$N|kLKFH<>`=nI`aP#% z^4>{ame}od+;VG-!}6cyGGf#Nu|1=|w;lN4@71JS3u3=8Rp1`Y^pMH>e6qYSx{oAA zCU>e7?6NhIKP;#m?BqV+adQn$t}*jr4o&x4m5+Fk#5r~ZN|2qcvnYlu%)w=fAW1h`sKKK z_u`cCD%0rI(`tPo3?x|>O1P?;;?X9y31F?AS^IU0V*ggFk7hl*b@7VrDTR<9^6gix zCC(a$)m|;Or60!`Il?x{uU4cgW}2>k(@zRLXiiW+RDtyEj#k|KAT*h|K&?`OurS#c zUnTeamTN8HC4&`NZv8VHvOP6y3|%BpVkr(< zrhU#Zco!_>Kl-yuAd^5%iBc0U-?<&CSX8DUmmL>h(N#TsYf=4kb$*Ueq{Osv~;=6lfM;R)?stJa)D%+5v!I1erE zBUVjlxWCX2|9i%rSiQ#H5UbKv;h$gV`+U1!X=>JYwEyxu-a}CLjE)Sg)-$?MuWo8x zF}Y3&J(Z#~c`bMeZkHTo7~XjAakg6Uou7dRtBn+<{f%KT4WjT2YB64@96~#A*P&1J zyi$d|R7}F*d@-Wk{)5qbV^fL9aj5Gt@cFr?iir{VB4e`~9tP1uTCm-z8}vI~>x!}w zO#3^-pv{`xGdZbLos}INB+R?2lu%$}&ZeqBe80*HU~B)k1_qN~iQIy8WsS6L$VKUp zf5k2J>L|sUdvd)(fz8Ff{wed3G4}TJ7V*;k8nPXvC$T3bY*Rl9;629sIIQIr-N{A?D1hkV&+nXI1_D5fgs-Fwd=Lzu)~l zP~7|2Lc14}$q-n)zK8|W{=sl|C^x7@K3h+lb4-n7Q{T#m&(&7@(Hl?JIcbjDutA-W zul_WH&y4R34YRDD{k~c2|J~}X`1agO&eFiHSwvjO$qyZ#Gt8~BOr|cqpX!bB(!dU7 zywq7P5Z7Si6ZzT&d)sS9X+(>KfN7wqre_gkJBzgtFS{G=CV-%}P}sS;>`5HF%r6_C zJ|)QJ>D&yu7tl8Q6DCtLGoE18RFDf7Kb~$Qx@BcIj39dbP+bwy$B>XYQ!cJ62X*O+uvO%fHK02{TWX=URqu8zT{?jWRemX`>9md zn0sfc&pgEi`D*W1NusJ2l#xrTL-<|C=DjtUz!__4>9_ZJir#*lGhd&e5sUd=n_>GV zn?^WPJ=;c1Z09O2JZ32mZg^~)QZ+hMC1uS+^;~~fx}Nc^=1bhL(EPiVGiTGs!AHfC z9ww?+z54O^B%CRmETUg|V}4{i=?<0P^!;h``l4Na-%8N)uIdvaj;?f?Y6x;la6{Kr zBu?EWKpE1oGulXGzZ&FNe=gm)b&%PSO0h}ug52}tA#UZY&2Zs1XbAiD!RiD|o0;;f zx~v{J)9xEJGFxKd{^yIwru_OYFPp6Dj0C%qV#to8FL)xlrQbh4^xzSpW_ZrK{lRVH z7bc?2JO1dN{Pua3y^(ZT`?>R1JiOgO705HDnvfl{w9F@B9y+kzE_-F)!Vc9z9t}37 zo7R5i?1o>Fv+u&&Igjx3q+Ujg=^v5nu03nG03tzTwWn2am-t_-K7t|U4|^QhmQrf~dQ0lY0iUoKu*)9-M}EQLRr9)^60JNqk6{faxC z_wm$ogmOXGFmSyfpSb<;V9#TL__v7Xhu+5(oLv-wFW)0+w01Sx%AV_ZeT{U}3gBif zuI_P2DlOiWIuaf7lG--!oa21t6T|$Kx2VdiIxk#Y8C*pIHP?*iGi}bd%hq}Q%KjGX zO<(m$5(D|?_p-JZfXivj$3WvyACUmy>h|qRc0r94&bTkFjQt6ag0h92oc3YqO{< zr33M+Iurkt`>Q)1{?Wr_y?G+>T3cG^V#Q;y^zv9v>|T8}>yx|Vw$GEv4Ua44O(I?H zmnm;okA7bKsuIiCE-+m5X3C?6t&1{pkf-X;&hOV>O^)|oGgkd^5PltGbc>M`QRW-J zCsCW~RDJnu=BB}`oS0PuAUcWADbvXdLgf5~^i{;4Wf_o_Zlqp6>0f$T;iS76#sQ zd#dXR1YgDWA@E|1^iO6~>v?lKu-q<>Az?kOg!0aOsez_od-S&OU>nO|+Mn6#UaenG z-|zJ~y_IX$%xRES!?=oPAIsD%3w&w6xoGirpN3t5|Myf-VT_#Ct7O*R=c~2@nM4ea6e`9Gv6f}8gG4@Sg4TI=UtUU3NLFlGsnw*=g(SWqB7Rf z3{&&$-+uSP$xQeV8!HSPYiiY%Z&f@DOHEh_Vum1*X6(jG zNR!f4kIdG*SrhRT(>lqIIn4U4q;V|FOk`qHnbEJk#SPH>Qc~#K(8Qx7Gkr(Luw0KNkMGtr@v-;-fG<)?_SX84CO?e#D&?% z`4~x1I&5dVE&GKHs9459pX#FhAy6`@c?OHiSjtPuI*5sOp8 z%LlhRwxI?mKkU`P!$=(>4$^pGRm${rfgGr|{k^EWYl z>5i$|9EEN6y_;Ql^%a*b7XIo!pM!r5x?`IXnvAw%%9}yvnD{l9#tPG|3-ojiF zlOMlXdz$6Fr11Cc9)(1X=|A$?A1AgPcS;cjKAe!>t@ujcyqJ8`<PI|R%wLLA~t<)S?eqrzi=fM|u-P##Lo%}L^g(Y@BnKtq>TS`CP|82O-*4p96i_p91xP45O*LZ56bnwDAa!hDn{Tt4T8B29_ zA|3MfHwGY&N-mK=d38CwiSqrg3q8wK23>uRAH!}ro;(x1+K-_bcB7;B8#O%JO(G}_ zZOhvbaXatb>@&B|OFqN*|C~){J58oEE!-&uzKTjuV>*)kqNeF3;^OO{2(I7dt*BXb z*OLu-B4k25gdeQ{QF?)b^7U82R9# z0Qc#SpqQmM0G1pg7cDVe#nQ?SkqN|f$6QL zn&KvXUz*b$$a5ub7T|rgZp%e2a339OCSyq69tc=VVY~to|Agb#L@P=u{uC116wkuj zwHm(g#rblA8-lhN;`6-Jc-d3iU9aJ!q=T= z&tm!!5aoXfCy#38U6#s5bTp3V~qQk@$Hv?B84NDT+8moKM#IXBZG40wLf*0egDvpPClG zYqiR`*IV}^xV*4AlE6TeX)73;y^@s>jO5L|m8*tm}p!kZ~WE-qodg1W~3 z0ey_3CJ+9TGlGk40t*6gEy+SY$r`kR`_5t{R0mp?1*TyG&^{~d zfoD;#VCRLt3)O{|5tN}}+gT_kR|dcwWXGS%i>J9sCIF6q#l!TINI?r=n7526GWqU0 znid$;+XH{~(+x_XydMg7(R7Rfp`;Ejod03_;r)aPV#Tu5BlP@D8IVRm_CaJggsW-; zs}?h~$CJO7%s&JUh-?OKG^bvVb~IO|H)1Tdk4Bbqpwvlx%RGY}$Ah6*T+OA5yiE)Z z`wmROVS%@BQ!mL=XWv@#!SO19AR<~{KZ(r~M-`cUd*s7PoKMLCDnPv`K+Qn@*$Yi` zO&m193d+E7aCyJ(E}gMxM8y!NGFQ=vS02Y_C^?!V!IQ@+g7;PGV@kqDZr;LfOZ!nb=&p&+0!Ua$dQLKuSXs|v= z#Kpiagu5dfr|$u#oKVvtDR0UZ5hW*z;G%k5;s z#zkDGP+`MN`f=V|P zdE?UnIL=w?4drw=4we<79el$3rlNa@&>P3d0=qEwU=_;U>7^m+0mB`%| z2XimW1Q%p-#loX^KyL->Ck))qf8EBTtHc#pUTnF2q;(iO32;t~bNu=pJDDtbW=*jT zk_?Ks42A*Vw#3j$FhmuoT`dVSq-H~nw&ic_gqk40O&2wyoeB;Tjg*1DLrhF!k)M22WS!jes2lLHl@@{=fOe1e-^ht{*fgaJ_O5{M)l+y|07~i| z{?zh|Xk{AAmLkX<3IyHw0UcK`1e_-*(&Nc8TmC3GORgRAAX|y- z-Oo?jgj4+~J^iqS%5*~+I|gYk7G3a0A`r!K zcEbLJXl=e4%I7T4?@4Yle!H#iS^Vk4QviSOXz7Y{J}h6z_?EU^m6ApkkU{603-DlK zgN$$M8(dpg`R2xBBOstf%EP23AnSwdDW@G)c#G18rjfP=1QLA_uZnUlRM_HWas{Wk z-)277wl%NL#P`$SCIQoJu$*i4YZ}F&mz-@|+xN<>y|u?A0d;lDvy11{IdPJz&|$HB z9AfjNN5T+VOUu39z(ZWj><7Xu0`tuPvdSm$S3 zRIWMGn8!4ywn8$@$L~kgfoK-lq3SBEIe>?`O;B{-f@G9!rZeo4D_>a-HIzU!ESMP| z%pHg2({!N?VYymu9}fUfQ(Kw>b_&bj$XX|j%7Z)WebAv5pc>R`wEwL5us|$WGn%{B z=G%6>J)Yb{Dd0gwl%a8EI5vHah=#RvO$*lMx$GY0g{V#&&O^YwP1BQ`>}6WTOb1~n z^lG}U!&M*bpUGyh0J_M_*WI%fvIp`qRb$b7?o|$^$7vCj{VAzzV8mLaM84< zd54h!w9g4%;1@3fSUjK6#9gj9&SK8qVujFN*#6(FPrqBN{WX6FZ_jA{RxPan^m?~3 zm^U48b=@^BykyUtEjK^A8qj(>%EX-i+*5Y>orRu-bM-$5_9m|Tjo-+qgGWQ+_)zO7 z&1a~*U3cc{oZE^OCsQ_;TP&ARiPZ|(1VU;eormF@@NxXJ9KV9oWv&IlnSj*E;t33U zM&*tIDjrxd3c!pdKcZylPILe+UB0PhW4wDapz+}NyjZit6r~anT?_k<`EB1cnu&ng zGdH-^obPv__7_Fp_Yua@cva=b@5V=y=iQqxvo$=cQ@?Wp$d(|{AM>h-RV}ES9WI9o z8Ekx0EKmb2A=yD!g+OB_LZprE=zf0h=M!0!)F2;MXkF-v(fD#j?lMBN^AVb^WHY-B z&P?lSJ=;-}*kJ;DF)*q@Z;X<xXW1kqm>_EF!JtE}hU0=x0!%5jF)Yy2lJn<~k)*L6 zofLm!=dC;jHbD9l>p^B7@x#U6>jY!<7iw2+qnIG~A$Z^EU9LZb1dVFiK*PmNZ{g{J zQ)KME9FUJA;@umhu__!Sdt{)UHfUUycIZm96?Dvt1zM`)sm2M=Z#69cL$EBbD%n%^>E~;3>6#5l+s|ok@`aBfT(Olw zSzbCR9FTYAxsWnqLvO3_=qvw<@!E4*5}XiFuoTs$>qye!gSRKT2VGfd7LrY8;4@6n z8DG!0T#iS$7ayr?Uc3qI!juDb1AD+8BlwxZR~aY6TZwPlo3#Q#rY1cl_JthBm0kxn zKYsX9IS}(a_az-*ZEKz&N*VjNvK~x_^>4i-Wwv8n_^Iy)`N(kkYUoxHU-3XR5GKo7oe``Ok z6@F&@mSxSPmxyBcMsS``(~o`^;@voFrVcTO4^@roKqXV`)Zses_QIXFi)BNZd`A-N zZdjn(PCu0nN^VaqGJ4{EX0mCGCIL~s{}Z$RGFy1RKLdr!ZKWnMsMJm{Ez9mV9f%4_ z7_&ayXt(eB2oF+{u`-Y!N%_f!5cI0>5@x;6^ZSxm9Go&}kgWl&mOlM(Blu3zs8iDD zT%ot%#*amWSh@S%HKl`aOi)3qQK~_QMqAVZtAfABtflTJe5bh^!L>R~I@T`9%k0H! z$QrRqk9+z1vLIQ8Ju&)&rsf&vWg+$-o2PGwb}O@RFhF%`>P<`^r#4#$Y(&1ae&)A! z=5`K1f@Fm=HvCdIGK-wY`{+#WPjJj|!@DdGVunNrK$fiWZK0hk-b7+hmsFiVLn|X5 z?l@5J{0j1Dz3bF@yl9kTtC4HJ@RkAP=VW$JLO}(Ga98BQTJ7X``CUt?w3EKU6bcoP zY@9m~XZmgt^udB_6yg?At(090?tCZkBS^Nmn6LIk=WEfhao3ckPRgN+4(>R$OdHUz zSwH;AF51j%XD)$wt2P}385~wRk19yKfw9=~CInfeDi&+z~!Ouq{(+Ht#e*Uo)nEsjy48dPd*Nu3+fgM zpEJC(mr7B|3<8lNjc}Cu(;7TLrnAyR*-FDYZK}~g#zRB>Au=YF1?IaLAU@y2I^D4O z^%+7CUG$6qr@U^J^MNA{h)~Jb?u)hZq@EhUgu<=NDM6)vh4yHmH67J69cwubC}@dK zj8Q0Pq}}iy2FSG(7<#erVLf`VD{ z28)3@u;VSj-}bPFu!Fiy=!i*xsVi*IZfp@3B)V54R!t^1f(4o;n$p=(YPG)!1qB0f zT*=IumKOk>fZl|i47eRE*y(8jf1W1S`)Y<8uRnP?bOUr*nK2dp>#1EsqY^1-iPmv8 zprqNJ{03-AqN1QHJH-POoMSgctK=g!7z+XgDWzxQ==h`@8pE(a!6p{=`{Z;tF+e`_ z+L>L&E>K$xQ2SF4VeK%+EnRQaALz`$J)J*qCaPZF1%cYL!w+2QT?s)o_{erQg;SY^ zV+WvDrejwh&Ia7sbwsgWHj{Cw@?^m{6Lte+I`w&Vdb~Ib4^*R~(*BxZ_s2s}a7W3Y zINd_L^X@i~agR#T>nWpF*I-blV5}JMiY@QqM@B2s<}*d@1SDv48n+f*`8xISEd911 zs9ROu!;o=REN@3z`8z&{udY?Pl4y&v$eT190|V5r&;rfGao6PRiv=!i2cIun>%;&% z0zcI{1~bR!+h+Qp9M%{h%PPd9a<$6hQW;Px~|5kk1wr zN~9z}-G%$sUL>3Ci(FC>1D1{;5TQJI;|sx1f-Ekl$I%}!K}$?9 z7$Cal)@k-3_gt}|$q` z)TD)$V|3>|)`uWaC%HtfD_c8NKX)r_zeg|&KL-mjOJ*5qu%wT;kCUqtKm_dL9V&eP|@ZZ7=P;nv;6V$-W8vb&>tp81%g@8d>*R!z3k~hz`Pk}z*!Vv}d%%2Mt#}_> zdANAFTUY_$EdLqrz|8QA}GYquOuiZ%*UrBDyl4^B*rfwCkFY~R?XSN)6Chz z3Plvv*6x4W3jTk#6<2V#GV^qChq<^o{xcOdM@KKfyiwI)1#Mw4C)CWs&e_w&!FFDGY@Yowa)R+e@aC_CVXNK5l7+c|n#x$`PJnt57X zWBljS1o$8jf&cMpKC?d;9Gq!CHezckFUdM~Thx8Kb89U9_O#%rRySS5xB405c;mK7 z`Jk0ITm7((HkqBBE@^3LZxA%#Y|pEL=zMF~r32W-0}5Y!2RkU5iie)}P+e^Xcq0VL zSVAtQhAMT^lmqEEadb_$KI?k7SI?fG6Q==c#|PM5QVSu({cpPO-i95gfo!?92*8NuCdCxk$6(Q={M@y#o9z80kNr$ zn5jPY*tv~o_m{9Z01`2g<)xsMi+U#pwkQ&?=$A<{v;)9uzXtl9-cUiRg_~!m7?exON-h_p5!|*!B^xpDu&HNTsQxk(92bYmK>V%M6}48_WZS+4OREz=6FHD{$Z zq9*T6IQ}T$A4oJ-_P0+%@0eZxQ2v#vCJ`(9#iyYcUm$XE*PT?sE@z`!=dpBo3jWKm zE+7-tj95)TWx`*~8h{Ac@5E~SHvZM%tBpiG@+KrRP+qy_xLbk5bNO{PW?vfFU+S(O zW7xs$zr{4|oNC+AQh}OEVx+qK${$`}u9K(OG6GxZO> z=-i6`tDI?HBJl-Z4t`=w?lE8w2?ayr*_x<#;|3*L-!*YQK|FDKpwSY3^4~_Qta2q> zGh%!r=4{te1<&{piEl>^zxbxhjSr;o2FgRFkVp8BIZfBeAF`k;x>+UrvRhd-WZ^{v z3JYjq@&+2pXs#8uEzTogMu9v=~@70|k6f!>xpGhJ^2v{94`)x(YDa zY;()C?y#6QfB6ykP4?_FaSo=g3>v`H(|%;;fghGW_Os|~xxqIf>yFIQIHFZAQx(xL zRM}YBDV9ngy(wj2nT;yn_sE{TVQ0*bLB{tBn{U*q`jrBQHb8l`UL7A#RN3v`quNNz zY#=m|VOe@@6D6$c_t`WpTc|@61Tp>&<-Nq*`pB9Db$7X>n@PYXD^Ol1=I#fJCScyl z^$k-4j_-i7p*GT@@>7IEEay}B$u*S6>s*g)AD6q#Qi6nn*ZnsQKs`uLdjlG#>!rJH z$fGuLLeyfcyDUx$6f`a$)sUgCLeEdQYXjN?+UTk!E)vg6rqnNTG&ZZ|tH90^P|DRt z61xdBjv`tdnXlPbQXR43aHmbKA=satxb~&dNx8%7AB5>fX{=i_u9<+b$>k(#I)Rsk z2K?$7(5P$`LZn&bW{DMT^|9__&|Ld48lb6?BSlvCZ3m3WYi8F~L!|F$8R*LkR1oQ- z4yn*i_Vj+Q#SOd~6M!1I&etK12DqHkX_gs$q2WL=-> ze=AO6Yc}|}Ip!6$-ym`@& zkn$zhPrLsBT?H6lppQ8s)e>g5c%4hTI&II~bg)PxuneHY9 zPdRV`3Y3TPA=0c|FxtnQH6aF_=ql5@BnQ87bL^8OUla{IzU~3Q42YChVJY2s75@fB zdInY?Yksj`*h5pd`p#=@lN|6zrfnv2zX%^fB?boyo$3eB$iT9WMubVBspr^7X(W6AH^E&fBE1Jq1xM z;Db9gFCe7&s6AH@s3I3z>Xw$~olR{s#7WhipVH`B%~YBLVl1k;Ph;IA(QLr^4p4+& z=N@yM&8Ysu)K{-8x&{j?X@17OH>0|ONvDU2A98W+sZfxtRnzi@*ha?GLLtVeJzEe+ zcc1Lo8H>DJtsmr20lC(_y=Lg*OIsVrC}E9jWsT8v9vX7VfaHKMjC8C2eK7e}gmR4r zTD9HoZnl6ZL2`wCy^g%qt*^muPs8I zF@QjZk3$zD2UZOPXmiJA&3$X1Ut{DZIiTnz(nxf!C-ZggH0?VjXMrE z26bui<2r!D9iR-Uj%<;L-RBs@XswW>c^7wW6)GeL(P0E%@M?qOw&L0PJFjbTNDd5p zZ{vTe3I;nQD%Z53sRd(o+`92zp7|blBHB``?jyRAPYln`H$R+>RY!Ijsm3yWJy)iu zVs-H4^^joP?WVEny5=hQ^7PN2ky}NPqztdsZ|HiJUr&f(Mc5rwa$gieD7q0=yVs!o ztm{^h#0(^gH$tn7Q+Xx8XaV*Uaw)-*%^H_jtok2?LITmFE0|h!q=|%fp2HghID)vg zF{*H^K++fQ0x>wiGjMBzdJeRz6Ed-~@2)(QT|R`e%rh&ZZQIn7 zJuxV=%9*IiyT+K}rCV0k&(AQU5On(y6a2A_pP<$?-W9ccRJp?rWch6DrY>p z9>&TXa?j&bm+symF(v4YLmQ4P2FU>jE@l-8{SBYk@IbV04W?sVSC6{EqxK3kq^lHb zdW?2OrnV#pN?4#YEG5vSvOgzU>QAa81`3K;rr}19BGG=co0D}tzGe5hvMAOs*X*~j z*@tKbsS>d+Zah05?hgaqPe->*NWr>b_@wki+9>J|5@f&mRT_Ny-MYp zeRMT(0@eki^D-l@7pS7?$OMhAm`!fYWSI_B?(8pry*67;$h{iuILij(bk723z(5&K z%8ePmV(+<8gE1F_mS72(N#iq~KX3Z^tcNx?X;&tQ;p*aI+iP#KhH)ky-6&F);PhuN zxh!SL?~@-_c91to)z{rPvM_ zU-n=kAWk5@sFBv_RGce7lV0!lAF%<}8a0|K?AKP6n?_A~@M-r;%BRrP7<=<@sG}}${4)$=8AFz`jU~IXlbw;WXD_msiWFG}*~h+R z3E5?elE@N8L?dg6K|*#}#-6e(eLpkP`#$gU{C?l(`F{L0cRBambI(2Z+_PL#8nBM1 z@JU&ZBhrS&CSGMmZz-dU>bmjKWaSDKWFZLRi|JD9nGE#cC9yjn&8AkrQ7{62iKF52 zA3ZWZp|}oMwr_8~1F;PUXG;ua0e!5{Pb?rn96sZT?d&>vQ`crFgP2poFK{&YPW6#^ z5#>J>`8a8xTTh3hVfZ-XAC4~vg$X`W*TA;g;Cw!lhQ>5|6Um1$0s$VZ|0GSjc2;ad zAJpx*!Lq+uOixK8o9cgrPTKnd&*uy+Nv%u`-a;pTjYD+&-@qp$C)}Za!K8A|AFO+` z@%@ldTCysJjk2UYjPf6BUqTsl<4H?{k^D)d0U%rgCu{8IezNYFfqkk}*P_T|Vtpj2 zRk*(K4xB@O+4-4A^=Ndoh1Q0i|}nrfD6c93K8lH|G{kaK^C^( z$HXoefhi#4VZ(WrxN5!Mk5URbTaM>?$zvKmoT45Y~8FTraj(;Q9-;&y>u{KfL53r+9Cd0X!w%HX4P3i-(q#Ew~ zjDca^^iJSEIUkZdRif(HLt?3!CwSUJxPL?YQmWBL{{8Rw>I6eR9KzH-PKJ`H>E3n; z-@XJq$vE`JTt_#i4UtKAEg(S^NO_dhbnlP+Y@mPhH&QWfK0=s4hlk7&xb6l;srHc% zX!#=QCdMsgY2}4QzZc2>$Th(%qvh|&#ctVcSwAJ^yPIBle31^{_(OrLQa%TdKFUu} zV0&RTkc7V-o1~UWn67Ow!V_JtYK8HrBh!)Q3zpL70OTV@Pt9RF&TBTy+UT2Pa@r+4 z!k$6FzPX-+mpyfuMCOwACE$9mk~a55p|1GmISt_1dZEp`7{c-ueSw_%k0 za4iZB%s4GtQfE@6b7C`4v<iKSM;DH{j#Z$-!=<8}MbveEW^~?3loX`Khl&7M zKny&3@*SJk*mB9!XMUEaSt)}Q2?Mu-g{!^f4#qAoskBmp&7TB* zZGqQJ-GEWsKV#{=qd<6Ly$wk)eZb@H@AE0)4zRfFp&JNNL*Tr>>LU(n5ORIl9@Zj= zxA*{1$rUd`Rzn?SR6ZLEOAdQlFRZXvDg6%;Y8JK(foxy>olePaArEPH69&Goc~v;) z%v&?M6n*691-N@@WCgiSjR4GL88UuSZ2m!=307p~_-^F1XgCZ*d}6E9C>ef&swRU2(( zcZe`x&~s)6j`-MT2Y>GAkD1VIV&Bd@eA{O44?t1|I3WToz}+w>Yd6~m z`bprRDnXav(Cy>hK+fpU^YF?MXtGhp62~N_&L!ccJz&Ryp*Ec-u)u`XJ$Fg&=$)Lbz zm@ug4YD-P)gMRhBzMi(VEwsF=YX?LQ&|_XP!0p$mJ0zsHp;nOy`0Wh9oLSTKND=Y& zQE_AQ`4Nl^90P{PIZ06KNSS&@WP$Tz(74l#Fm-}`o(RAPrfzS|7R@{>-g-q}quF@8 zqRDXV)+ks{Xx9UEClPDum~aChI|dad`(Y;a(DVH|{)b+Zl*7Ej3um69BN^;AC_sh^ zzgGSP;Op|(VgCJ#s<;;MjsCIE8EwXm*MIInm+Fqw7kFidl=Rn%gUSlnd)->+Pt`_|f+VmbjLuKg+&|(3rIl=XLuf#qv zXa811nRKrzeGn%z+DVPRW+hoOm0!nf!wk7%oxf(ZnA`nnYT^252bzio=(~lub%Imw zGmY0y)-fGLmXp(I7xnM%(_i-pR@a;{DA&`+$Em|_bgoO3@39pV%vyO9U z-EMAs4wZ2(wV?%=#JC-3sZ+{R&c5jCLp*r0oG_)xdC^ACJEJ4}jq9&blu3?p#vTJY zi6StJoFG-uHT)S?$FC5+#oc+Qj!a2*FPhK6;#_-IK3u)`I&ahTwpqbaqO2P}Je&e)6+XeaVw|GVWljm~hU9nK?fP+8-f9Y!nQmE= zeC8S9;RX42hvli%U*)-#0os9<=+%`oF#G2<0LTjtDUUy*=3eK?Q&>lJs(gK^RadS} zEup>rdh2D?$;OrXV6W6CQf%zcM$RgLC(rW{Pdelu%YN(h$;<4$Re75E%SV}E97#fk zi(hsIogPSpMF+IVj4ehJo;hr5^dH{-49O~|uVmW(f%{Se1Bp>!=4-BTisg|E(pk%kKQ#M*WPCPs*L=-Z6`PLmKfKe>Hp5jGo zpN29zgZ?45eyhwq6!@j60-A$n}$1RnP6|tQ(Snqu8^Ob?|)15tIv7fy@XHdCj*9^`FZ43@J zRZccTFf(~?bUejd!4YA-Tk9Sn>Khm9wB$jx^Zj8;W5n^_QdQ-I5d}yuA^_e>Lpu?r+;)5tCo3*!p5YeYm0>=xTWB*wlDr zzPv>7Ic|8<^a4UU-_^yi?ylVk1XGj4z*)fKXO1~QWG^bb(2C7(ThZOTSLu!Rw4tan zhhScD*r$Z*exN*Ct)OMHTcBDd_wF-yS|YK zU8Ys3XV=N}JYjf&FjEV4dPV`{$%3bZlkErXhz)LPtNG+%M&$-kq-alF+AoEoR(>4{ zkZ(94C9)Q+wA{`>wrB2U0o%*Ku%Lq7g`s&LJdCx{j5Bo9JF8pT5Qx@$_m`sBt~@xN0}SI@GE$_IX2!{w>mmtZY6LRV0MaHOZ6h-4I<;@ju^x4TieJAVd;KdnZq1Ztwoj0@w zs)voy*36W;Epomj7f(99xtf3m|6;1CJvH!-F(@cxXb@EM;_k)AP)nBR?7@$IKzhe= ztnMZON$(6v1{ZV*b(6wF_*vFsV|(?6H@VcZRGD-qa72@|(miKOK)ZkYkpdxS15vlh z9{sAyxKqV<=p;Zh_sgc&UJwwz*7N-b_|NY)6n~%IctbF~l6Ts7hYE9L!}Gdi(Vl8IkFUzrhS^d?=i*#~+o!oH0J=LUoYU0$Kvitq2V zcUGVPzI%g<1G)}aN(7fL!Y&AZhv0ZXcCD8LB8!=)`=A&@sa!rKeie)_n=6iibP0D7 z(c+B|X`p1aGgCMpd^^I(ah^DY9_|uPwtM#nwVe{5-`^sqva$|INCUuCs(7zqY{~^0 z6|{meKaY*|M~jJA5e|wfz31~=cBFQ-idGSicO2edM`LVzigd85 zj6X?s6Km1)j~hj`{FnS`ywRAN%Vq*(>`b;;_wEYnU@m@AOdyqDd<6-#@yVFmr-bO8 zWF4YO_gs`Six8n^GCGSNaw7Qe)~|Ze%Sm-Nmo6+u6G_s3@KpgY{d7EA=-KaY7c0HY z?g(kSnu~ZVWoqt20*b{p3G108BcP7hB;bdkvUQ!d`>H3!{eR?N&EoRb6RABguL8Eh6dHm zERdL_4<$cYV{hVBnETJa2+Zh3B!iA%6um<-$yC8q2rc*^rUT=XmAXNq4>svf!C%K@ z1F^k{EY&CiC|AF*{_uRxoh?NlaxSBiY?%YL))gQw^8`L(@&)*1r$Y-?=Lx;i9}|Cb z50Pygd4z+L)UXszoD4G9RqT1;JV zk+o>ZYo`5g>T@DHf|ExuqaX9>mJDJktWS4FPLO*WMf8D5A!@2Nq&7|pQtMPU-T7Es zld`m;)evK@HapUurk1FVjtaSQbDmhWh$Z-EynN)rG*()vo*rroE1Z{tAa)(|c29?V%oO#Mh&{s-3 zzR=*9r<;R^$up6$FV*t5$};~_)VWEv1A=sCP#G@uP978Z_QZVL4f^79A{qG?A}$dd zQ-MYi<9tn6vNaHxdD$e4l}Yj29RE4-+QZ1M>-V{Wh$ElfTJN!9^8zjiXqBWm zKNY@nckEmKn8xp9O)UXR53&PLa7LYgUL4q9u(1}%2hBK3vxRe-7J1rSuU$yUiz`=Z z{RPRR^F&=}`LgY!TScosthk#`U6&^D1OOMAwU`)w#_-v8u;;BHEJ-&5LUifim_q*? zyedZkeV~v0M8We9AG;)8#cr__pMsN&X%$40Hz)z;L1%q|e2Bg6wOZ&JLYtK|Ce6l0 z7U|U1)n|-$p|wTZ54DH~ z0`4K~9VJuu@!c%WKYP_ZeYd~K+rtA4f;FzVa5Ry+p-^u4Pm5aJ?U3iLK8U!f@_RG0`sLhnri${v4TC-`wGFT*{s z7V}9=8^%XNt76dzU%wvn`eQqPLwr(*TmG+d==4MXJESrBaxKBb0DsqCp>;KF#DL}A ziNd9gs{%y#u#-*m9Rv#MhM%oIdN{RxTH>+xOFybj0UL-(kKmVbH^!E=Lx&Jwh!*I9hT-dM64pYL<-AF3PO zb+j-i%Im6cD8``lB1+SEPBfNl>wxaF1Fyrbl#O{z^W42tnM6J?+Q{BZ9E6C1G}`9Z zm?p@pNls;#X#V~+t?HNgAYWf{$DWuP#ng$qNpKk%>Flp$fsCGyK%n_F!bUaDh`)`j zTdDa#;_-4%&cB935NoXnM6Iv}ukke5xX#H{3;&ZQkHoO;y4cd7E=P=h3UcI70mlaH z?R5BMeSr$|NJOoG25*)u`n2J%ru$%x=ex-?BP6Cwkbt89I5K-!W?o%S2KOOQWt+!9C;g}%ezJSV%}n+s#PD7CAZP*8Ght9MeYkID zL7X+p!|KBgzAG^HEGY8D#pih@rLcFrp>YO8ZvbXL<4I+aCDO@`8I1+ktoJ1KdP$fL z$Sr=I;{b&Miv4p!4*pT0m09fQDe*|(HS zB4HHcQdpPq#PQE<1)XoR zOXQd)H>LSf@9hA)^*hxnsqs+c{p9`pTiqJV_WDF#L8&JUi1>d!qVNTsw&)q!IUmVM zDQ(AnzCEEZ!&0vog2aOcOUI$QZJmgt=Y0HzoscQ)N+r9! z9zOhH+tP&Dt~;Usc(@GqlH^LmQnwQ({JD9aqKQlQ16;bK?2P*Q@hR9JSQONCp;A`qRo)T^hMRc7 zDp>r?Z`%dDCK3Uc|DL;mO>GkC`oXqT3s%8YSksq=o*)oKO?FNo`m0$QLS8@%)<>(< z7-yGbAFRjjOoW-9UR0CJjdVptAb!WXrYD^YWy9$aNivgKlsFiW$&Gw%yv|p60jxHB zF=qJMDw3Y$Kna1<<()I41Fu;-#zZCo9t#;PT|JM+*8d^cmP$sQhUOrJ z&Y(1phItULT6y&*NQywY=lj1>ybDiS`5tm;MZ|MQaiUSdQ$ro|N}NKp&)azT>4X?tDi? zzN+nZoTU6hMr=bXcIX^}R;AZ4*w`@EHTct=0g_WzjwKRu#_ra$lPnsY7$&5(ZUiEo zxzJzH#rSuv{m*9qmOg7p5{HW3o#I-h%O$ zM!La$D-SKihfk6aWC}M5p+1iWLr>7ziTi34EkDTd0w_J%oeV^QsBUc4kQ^ti3J}6Q zxOJr5Kw>aV^Lul3hIRt(JlHFaVw+~ZC5wR^8{u@;U>GKJA=cGGcJZU6R_xWdegV-u zXvwk#8JnW?(vOgWL&iFf3pigE;a0+I)(LR_uJ+l2%-3mLl1Ij0x!a(#Z5wdzzL#SS%B(eQWL) zUsUs%+#Ui^xpgv@-8lzRM}irxX9#@4d$1Lq(I)N&r*jUa4)ILLhTg_~UT@7n7Ta%_ znYJd|+<##cR$`Z7F)Thg4R*%ESZ!lEd?eHM$=j&!po$LwJZYts*efhH#&u>IFQG_g zW<~0UvKpJ_eNqoTFq9C>t(EiW7xFb7Hme9hLTap@ z0*&t=sYnMU<@v`um&R-i9iJCIm}=BGZU>R zw)$n4)gN;S^g$E9z0#GK8_gjHDz3rJHK0>G0tCeBms3sOgZJb#DPpFL$;p622xu?ujft@20aR_n&!6gLw& zWM-wB8y@l%^r;i;%6Gv)Z7~IChVONaopvOx3S0*g2qjYslN3e37bxE!*3kOU5%v|9 zaatn<^f3^-nO>M@vZuI+ko`IN>s~Twp8o;eIvCjF)qF#`;8Z;{*bX4L21>~GAB#ve zYfu)MVx|gk?8L5ErK@aAZUF%Up3=~*0RMkO8AK6?;+Gw>|6X-V8M*{9CAKZ1XMftb z4E3oHXGUXS|A+)oj{SU=-?SJx!;0M#(tt(qE`l<2EBkgSLv%(Xrj!A#Y5r0x7WC_1 z;9=_!A;K}utTcyAW}To_!CeA<&cq@>$86qKi5VSd7=F+39}>IgA3X_rsb*9kctZ~_ z;ZQ87v1v%2FCd)|;n-{ziSRTg7vLY(J)uONN@}8x#;{`j!N3&~Q1!)rJL1uu6U9!%%LKZ(lg3m75b__(1gw!urL3qcAzHA9|X2#iH7l zn&OBLI}p{;pG-G5nWDz7P%98{Yi&yyLoKj)@r(K?v>6s?qele(+RX{)Y`fk?>#lw<;%dmz&&vWNaPVsxQf(k6pp+y12EeDg1VQK)~l3%$@sB|DEFa-u_|({D+W(+&6`K z+QCyg&HEFiD+mBOj74HEM;(b= zPvu@Ai~P=QGA{zoY({wc;IC}=Uj_$nOp>gX0A@#$1+DpsmXcOWMCLzO!X3FOvM&T{ zXs55)ZQ-1o6-gAq35LRuAPEr}vt{HMZ!kdk8XZ5uvv~r6Q`5Lh#2g3)|M_JQHC_95 ze1FY{pxH^XU4TzPjv)P*$?NQvvS(iq@%{qh3d#(8>rs)qMJ6nFFG9XhX5)sKE z!1K)3ufiM4cn?e&1;41v=d||Xtq}ZBWIN&CY*ur$U>|R@7Y6N7ockF=Hf>mhc+ohq z@)M2%lOLCni!gj1{n(=bV<&Y-kIEK$vRFVlJo+%Vp-d5Dnvd_Z&msBRy-NuDVKjm^Ywl0m`ohLky{@ z?#+?xNuLAg=`ffLVS++v@z6#Og*P7g;4ztNnNm5>P6}fOv8SYFd=;h=%C=&jauTa- zw)9{P53#Mb^VmveP-1(|DYIhpAOt6XDG7?)Whwm7mNkB4nfwd_SOjzv8AQ6j2s&x< zgtDj$%w@&A_uqa@j7{3!YUjs<7>#)ds#+=k(C9CRAZdXD4q$BuxU-+2D*bSud#24Q z3v&IZ8Un!Wumkz&*jAp7xH|BdsIrezgsZ(F&Dchez!UTFI=C!sh12u@VU(`Nf&>jk zx{)Ys3Yc9{{hk&^&~s`(*aHWydQe$U*~+dCtM9ap2OjF{v>Z|qM-{PWMqkP_gJY)! zR67kIcA%XQm~jCAUwAK;a#J?2`JpMt#Cgj1l~alm!Otl1oxrwCl@7-Au?WG2GG7l> z`Kb?r5q>{Jc_p71sf^bu;y^1lNM{cCV3OXaWUr#$xkf!M52^Bo;D^oFfWqK*X(U+t+B^_v-J zOsSc1jH>~#twqeh*YR9zP!Dw=m?2VS{^E{t-RcXXH4zi@?K3v$xV`LK-vFn&l^%c@ zhlwCN9Sf9>0m82r5G#1a)amP;MBHqgfUi|4Y}`TjR4)OR9LBNXU!M`wY__nFv6MGWVSC7>$O zMGzNx98>s2eA#S&nQ>bTAQQH_s^E@ z)lM+mKLbXEJr4oD@pNpX31%PM$hhvKFc|-&SdaJDiQub0GaqYy6$hVrh_0covfkrB z|H<`HpvK=^0y>%fchs`em|f@;)0A9~-Czv3rtF>|y8N?@ei+SQFB&YoMLG3QqgxAW zB-A+e)kWvFtzp>j*{%Mp9gi$4ad*S^F=*BJoEwwqJ(q~bbMYO!yY4;<0tXUfxe3inx6k@h+B7r4CFVSl>x4$WZPh*I@4 zlbn{~22>#WjnYR!Q@Q@k;U>)6AHFs8=}Df}2fFTmUVa<=c~$}y9b6o8eSFu;eLkJ7 zCNm>p5sqOPIYuyjJ%%<7nmie@tAL=#lxHLpV^-_~42Be#4!^jpD|m2-vpu7jap;xE z9{IJTz`Qs;p8GebA)tdE_ZcvSmx51xNUbb5O(P6(#RD*r9lxIeCW$!6d1%G&HJALv6Ao(d5 zeVm=;a?YPiz3MT?cA+0l((Ak#N@BEZovj_Oi`nY(HwD8>DmPW)qcv}TdT%Lx<*AC9 zNUj{l@b&DtM}zuDhkHdZFi}GL!fPMwfrO}9^SjGxnbyPK{FthGU8G*bvJ3GE&lNl)sSeZZ}QNPV~pLviJV1gr7h_!41mOy~!3Ld>&&BZRYt`qJ>l zZB92Q^!F5Ahe0M}=1!ih!nyJi2`T*VMjCx zP*l(bA<7A7>OW}@m9Btd%g0jbE*iuDD>1Fyzx zat*NZbwI#eUsNOmig_HLKvmDD_2Dyn;I-IbQyWkWdqmD!R)~LnDMFl~C^b;P@`ldS z!#bkk2zTkV55{N8to5@r-LRIYG_5tIgS(a$1g~lK3;?-h^JmUO7?F$u5QnL~iE$s)`yY=Pm$ZaOl z0BX&NyWWC52@IsJh)Zb#m(sELjP#B;qyl zNmLrkC`b6Bcw@@S6H%3CQqS^ZJK!R-drM&FYjdy(rv26ExdaKGuIt^KST5}nW}hX% z^e4}_`#HDLer0c_dGh$2?v;dWKL=4rSoY z?sd~368XyGr+R1g3o$$Xll9Th^D|h0jgM8YC?~VEN}eY!JAh|z)!O28QT|yMItK}^ zvT++O-y2`jY$$LSbKQ}Aua}9_NET9sS${B8p}8;VWY(s3O1kRlS@$y@UDf7#bhJR7 z(=Hl=>BU;4&u|0&AyKb*8PR7iuMFFc`?^mus9|2x0Cpu~Ly(C5h0YXS`eVgVMz)!6 z?fnd27Mn7KUruFx+pZ2it6%j(0wq)&1yuE4*M{Y$V#h@=t$KJbdbh^dzLCL9p3Is@ zafc9~@zo?ZA0Mc#0240fUB?Tr7F);gv^Xj2+O}W08GdL6&d14L?i_&ce9E!S=u7~t zK+GPf>Jyb9dU~Gh`@saH1N$Mrq0YB7>0H2czq`E&&z9heLW=1nUhZz56 zCAl~N6w@s{OfCk2`6H>Yc|g*Q(ZX81Cgfxg@O86+YqSjzDGUp*x5%k~$XMQ_4xs}l zKl+_C3SWT$3)KcDYaXOusXZ;Uf$P_#WGJf&3eUqvNJ=Zf-3M0z zs^S$}$%t<5Lnql)fYAXvFeC*0n8G=>mqELpj>bIs>g!p~MBC6J1;q6NWW+CB$kE!9 z@CT~M89%t{;P#LcTa;DNjPF{nQmim4Nr{>LH#J6?dtMoFwaYI$?6MY|CntpT~_PfjGLnzm{SQ0x0mO`)4{TV$IPy z^_0>b91OgH5kK&%6Lf`w8CXN`{^KL|m&OrOKOms3eg6i$;O$YwK8dK9Y6BuA$i0Bk z&sGydEKezUJMc2(Z4C%m8sdXAj6m@6B4qmVsHhmf2xz*pCYSTODwwD#ls*U2)Y$}EdWVSK6#xd|pq{xG2tbV9gK?1F(!;K#U+ z+?E9Gw&^lx1~r9$R8HJ6z~^bkfs}Ba^m8Y*yN{iOH!#@`Xe)N$705+SMahm{r=FGt z5p?1z?8nPVb8E-K&?WYFqkUqO=y_@x{mw>O~Y@Ci)zivI;U+aN;V`5G4IjuDF5 zJFG&IAY%4=u|YTfip(->^MCppzTQsi@0kMqW5P2L7Uzj&;cu8C+o~o6wU+Kha0B-K z>YLRhyqRL5f24S(!_4D#6zyd{eBZasH+q>g6TJ%&$5EYsP8DmJ4u4^4ayegljkGOMD$LtUQG`=B&I2Y# z#aC|2k*5JZArYh(gB6_i9^n@`LALUz5>t6ojw|Eiu!11XTp3ACv2wJBS12%dG%Vnr z18hiWqX-GPQhmH5A9cO{b!a=g_Vfs?g7%Rxse(!m?NQ$e% z3ep~iGDidz8<@u2d$;O+PM6ff27G!Wdf7-+J1%r`nma1!pY8Srm>rz>Vn#-p#k9QS z_MP1eq{eRP*bjzIKeB6S>7-*S^2W%fW>+w+A2T{5W07Zy`o(0=Qo~3h9zF^h0-tTM z_$ks=;S#rj;<@;8Qm}iZg5{)03 zqed@9gi3q0=M~??m2$b#>!_3HluQzxX&0f&O!dAjbt#Inh z+XSedTvsY;b?A^(gt^1K4HeW+r%6Y34sDT(e3-YnFBtsNdxR<)BCD<#(3WDE z3*|F3O=<D@~V4`ae+4ueE8IpP6jRaAuMeH3I<8)3E*`_J#%>F~07%Nva~ys*gYM_L+!x ztIgX~5+N}Bf`s1}cdtY;^>w#*lj-c2j{T)*W+x-7yvn-DO2XoPJhY&YX6a?x;MHvF zY*G=H1bHKu7m1EUBaE18Bjk`G~tC{8F{2tH??!mWNiQ@*(HX zX4deh<|X>2F?pZ~hxnzAR3acpzxVe3 z>c;~WK}C_IQXoJdACOp1GxLS<4H=WJjYMr+o(78muP-dOPK(qE3&;^3@S`ZuWX}qVO?0RJoy5H<#F_KN%(twtVzpa`sRZ&$@LAGK7tm+gU?b_ zKYsp-%!2OCbA5IiD~OESH%V|%0k`m1TV{k)8zTSp0ndN}-(pi#L&Y;Ma-TC`A9Jve zpd0z12ZcTw0lo|sp(sj5RfJY0_F)kvB#)W&8=o_+wd53fi=AdL@gMKt;41vty0GMR z@@xQJX7qWm$7&Gi3;=N8N_)-|aJd>}>Uy?pVp%eR>9fDs){-~t438Y4?It^teaf6P z2EdaF2A*;w*#~vVzaOVz(_6&=mS>cz|Ck?l5)1{ENkiP-B0N8aML(1TVRZ zUn({|n;TibK^Ad9BluVr7_Xg+`L|AReytK3WtCd{eRBIEJ-pb(WW=kJWCa#y&5Wi~ zxp?O(TJ$}RL@6L99cz*E5H0#PpZpu#3>JmlNV>DvNDweof&}#J&_=5N7%S-`eT?XJjA7SjTGsxd1OVS4brF`)Du^WQOWcxreO5oO=710^I zHg=v&xH!-3{{i4954sHVA2{tjQb+i%xKXK6~9NNBI;z-1I${|iuJp( zB4+$=&Z}TR?)cU#>yRx7dD1grpP6&jhsDlh%7QvAdWMSe^z7T&hU|Zm0}eW+J2Lr{ z?YkwBv`dLG{U+OOVfV?@aq#Cgp0onE2t0RiMuvt$Rkb#Q%2< z6y*M2)<9NTQR#mdVLjh4W&9iyX7dl*A?2-uMJAeHQ9Lz4Vtp!sXKi%jnR0Q~@gMK~ z)R@=v+27>Hc9_FYj}MyKYz@6vn*R~NM9KKKZDxL^++`*Rc6gvJ&bp5`#l+BdzJ?&-fgp}ZR9Z)K6J6Rb$`f`#l!Z)Jq|LOug}dA<0}=f99&Ren(B~rRW;LDT!_e&+#+w+hi2q zOvoP#X=>VQDhfX+JN~===VQv>d66^JPjUwLxuqgcCIqa<6u^TRx3)Yh5czl5&b7Sr zy2esA;;^Dx{l#CE#rlVaFGh7GAaNwETXiw2LQq*V1in|)+LYs2_-=g2{w2$l7|+$l zao^W|#xggt*o9M@6=`r@ZN}jU7*F6=&v!rcLxzg}xcT#Zo(!IBGN81$V)-Y}fyP(s z$KcfHZ{-itw0Z}UNG;1xQj$I24@|!u%DM_XoylSIpnPgsC2&Y%W!w3c?$-N?Lp7{0 zWhg{Bx?$*n3JYCs+`S04>WNL({)Cf#`Me>NMG;)oeIA(Fw6%=psj^9@bh*`Ase(=S zF;LN!3rZG9gEx0na(8Xsn2JSyf6;qVy!1xNPYHYX0_Vz{h37E>%RSepBl`rCZ=2Sh z&s)>rwl!)tZK0=K38t*Kd>whD6k1A)TtiQ`l$kx0IM?J9zsvjNtoX^42bmxApXL5w zX20B}CZDP=q?+TXFZKyXZV6@sc=Qk!n8JW<=d z`&XBKF{MAT9`(tsGGAg1BE#2oJvi{#^^8aHsnkhZTZ?_|Am#U z%b4=5%b&HV_s+lPRBmYWe%vU5NYzJ#*Kq~2-RAcBdeX6dO0kwd>D5K$tSqsyaK#OG z9%Jv$UpyZ-+V;-RIYh_FhTPk;FCKbeShL_;l=jCrD9_4v&*c7n@P(dANUMzTom~}% zXXiOXo{gQzL$Z%3@tjt7VeXiZ`#3uzmB>Z?tv5=w`ySq#{Z><<#dbO5fU8{GBWJ*k ztL%}d%Nvm=MX)E?(hV`roS*VC+~|wVxUADUgZz~{bdU#xGE;Jc` zXw&P;;#0J}Y`lEry5Zzd{aQ_FP1rZ`x8Oj)`V7U@5f2At?`{FASC?TbP}OF(n)13A zcVpL1tkPcsCP&mm+Bu`SnTM)94KuBtMC))|_q1*ASq$Ya^<1j%?9r13C^4J}FtsmkZeMC$3(7UU%n=`70Lpo>4VMs_*<~XLsL1 zF19KRUAbow{K!*et7QrMGo!pb{@o{WvB4C#x5MIGpK{XO1oAEGTMtG(=S<-*lx6sS z4RS}Y9?r}pO7!@)T~zOSap^3>;KALqjDr&O;yr4531yAER^k(0e^%o3SiWR7t~@(u z8`R^Gaz``u#*Lh~l7L)Df$ZkZlWZQL+iF}&atZnp=e%{IRb8gPyD9$G>x{bci>L2F zu8__$YWnVcwzn!`jn8vHIOSLF8AoPsx28|gwT~}X!zUQO3w|>TJ`w%^-dynV2#x$; zx#Q#{C3Cms=a}nl#&`Lf~w2s zB4V8EmJhwkf2J<&JbT<&_WqVl=AGj*$!HrF8yl9Uw-0z)+%MdsFw{*vlw>cPoHtEeaY4m_cYuqqr3cQSTeZvA)!BfvPyuQE{r}!C8+6s z=?||;-*QL7Vl<{Vg%;t1QN$AS#WCNj5`?Fnq`$?5H^V>8iLyKkp0W@Rq>h z$@9f1H{jY@M5(_=ksLkPtfa8dwQZ=lR|=JhcfJ#{;ZPL?S`Cy2{!VgIw?xvc!b!|& zc2uwp$}yctLYLQpOmpUb%A|GCuioi$L?td5Yl#u0uip1@)CG({WD7?&uDxFO``T$v zl>R%$;AZ=eFa|sOe*t7_WM#pT2uaw$d$S!#REm*Ibo{t;FC_v);hfv30l7-rC1^NLEHEfp=AAld<6 z6{`kBS?0d>4n>)6Gtg1R@*21()}x>W501$u)k^2rx=Sb3x>HD$GSn=#f)X>iO=??M zGAy>2^7j7V-dQT~@R%1RNqrcDv?LVtTQ}K-5s(2%JyuY7zE$8PB#p*n%1_opbpROO zqAyhC9*hKD+`1Y`cM97FJc)EQ@r?bjr_F9g48fuea>?BVr5P&<$sR1&K`l#$(EHQt+HsrWf#go}#Z2f3Hwbyb3Hpo8e*bB)QdgU*+LQLYZ-2w3WZG5~3L-JAGZ>Ct8qNCi7bUAHS}UdJM6zOHOXQ*e<^7!IoMm3x10`Ch z9)&;drIR0kAH)G;sm^WRu4{%o~ph*PA?B;HyG+3(+9?L)0n%X>4jI;n>f3RK!H!K)U|I&XwoWT!vkkc1@wvW zN5}+3w!G)p}VnY-5!{QjmWKyJ#)*0W^vILUTSZCP(kVCX2;>b?I4 zZ@~eBJ=y%Dp7+V;e z>Ds$_lm3lut{=M<(*$Jh*r02fKgz^w14*!jR2Qxm~-)m!o?b);Sq5^g;)v0De|qmgvBQ}Ic}nyS9vakgc5}dosgj_ zuS?~+$~OGdAFWpO5Np%7`DVcC z2}r<f=)-dZ>r3M;7V@J)BlmKN%n0L@3wrqYxqfp>%>I|L^C3A}DFffhS z&>LQ_Dt+I}Bo$m7;b-aP1;Y49z}oot0EP`|y>_oZbI>}aJHES(!+UJoTL|Mjq8rU< zzE0{lM3EM!G+2u3kpFo!80X22;tj1;dmdPB{^3FnNx^kflqLa|Hk+QaV9ur_y2EBm zwmCoU(tO;iV8#_AN|l-ulvEU^&@zI60=pXFM!6xwWlIB(f(SkwJC#p=a!=U5)gQ~G z9hQ?F_?jE|7|f}w^qSGkD5f}5c6f>q+(H=o{UNg^`N_^f~+-d?0t%h z;atNiRU*3Xts1xN-MEOJVJq`>rZDvmYtw|^xW&A5i5q%k)OFb46_F@D?nb@K*rlX% z$%uKEz+t6Zj>lp9H4h?^kj2xlX$V7ve33mw^rl%#_-=4)e@s=E8DMF*i}aOxc}rFU zagS92P&I~)uA?xc25fHagcSR|@ty*Fn z&ML6gVem3Gv9DGjCotngC7iYH?X7096&z_obIBFs0 zs=asX=EofesYT*-UVxaLYtxXWlE{sd{8n{MgyCFWA%VXR&CL$0?)tb|3aj6Anpx!aVem9S z&*&`Pj+MqmQm~Yx+^OVVUP-%OS(z$+XQrtPniHa#(1Z>{V?XC$ct;^H!R#}62yr*Y zb`Xi6DEm88q2(DcN&9maX^^#O!{}PBkGIK&BOjNtb4SEVsEIT@Mk>3_ww(jqmy86zhlZ*D4_ovPvVNoz z8k~vbdqawmtQjzw@c91fQx4XOfwB-&n6bz~$lb?jWdgLHHYm-;(V0@&p}d;EhUq|{ zSIlcbHbrv_sy!Y4065W(U*A`QZ%Svpv}NMJ=BV6bJ0e+ zN;HbmdRs*Z>e^)XrpoC^u7VjNPL9X*e6NnWatY+`2}x zNA_%LhWz5bTA?pr2Jt(&<@s$5kKd`^?TF0rb@y_2*$*Fx= z>x?fh7+xb6TzjACsnM8B@UgCbnA7)xR%Kf8{&x_`%*y^Bp-5JiFLe{x|E1{Uw)z#R zva9@xR6V_8y!o~G#L$b;(KIHtm8a`247vl`PIT8*KYfOg49>y7QM8_Pwo(ZLd%z)l zv%bd+UkbS9?LAZS#NumAWn3|2Uk_Bbyn8o)t}`EGo_t&odO}qqrk@g+77IVsGBuMRa5A zlRtXx&hj}c81@z8>F|zkq)2w4NgTKc*A{Te3ju<&Z_c!BwgJUMB3fMgkT9QE;7Z&k zdy#F~q|(Sxq+2yvl7~|Ilvp|dv7JGc>N_Y$UgZbcA)ot4#lcq(L>PCQQH1dNQfsda zPqS{JQw%}!cv~yLR$#&A!znB33!(ONNTM;A&DXjjZdI?hKgI|fBp@CYwv8G{essS4 z@_*89M!o8tGRjx<65tv_dsrR(nw+QaI3>qg~hDgLtT8T*`yevl- zHf+CnNEJrHppv>Qis4-62OZwAprFa8vsxNZ%BwtUZ=albtKGb~yofIcwsa z$HT&t-m18Q(7C-+d@*6%Wr==8DCxX8D=_b~F8@k}3Y7l)!;e`A3qw7?tdI4NUR%Y1 z4xbKug$ie2!Es+ciC#@fmkqcW(f41u=r0%OiaT~P-j%rGfSdl3(|%dx4e=O@2#f}! zA%t^_J+uATf?>`fIS~$9TMpZ>-#rly4d*2hB<5#B$T$`bS@wn0KZ`HezOJ!_U4<6> z4l=K~FkGfv-6K<2RzPzy8ExWv-p{fO{$ho#g5|(RQbEoF=o#?DyNy zXpGW7UPkq-sHdR0J_A?053|$(LFJom>V3G8^JcUv@w?uB#bOtyZ2N1aw6CVwPoeS? zxh1lG4V2o-fJW7=#4ZIDGaBtRPS(JgI3%7i@(_W#Lbxajv$f&{5}B?ba_VXFL{H7U z*^vGZZvj9fz`AOt6@%SGNHJnYpZ$*cL{);FkAwfkMn#0qxDr3$?FSbeXz>}zLQn%s zyyXt<3GMI&g+U8U%g#-XFcDPM5|GClvgLHM&zQ!oQ`US+V|_DI9aAJCfSn@kn$kDl%BTS_f2laQ|`SMN@gD-Vf5l4O`4Fe zduwhn;ERum)49|3Zlowy1y~0k=5|&Zcol_L8I&qaoVASP;2Im0Z&IIMpmjaqE8&^r zRtCjadhd7C?nFnP+0OwYD-M-rs1T-#Ch44E}vnvSINAugYkZ%(^Csm$` zc(RznY+b_a$Y223JiiysLicZF_UHDnn*NMZyhfkjr#9I#`tvbRx@3hjqPyR0di}#{ zjLc%R+HyNZn(&RFH}Swg`rC>pgfbab5qnfo#!Ik8c>TDwc7(oc4JH|zzb9@U&B+tf z>n%``*fyJCIW|J1pPtx)C@7kxw2Qu1+_5~63P*mWzhXGN@l z+q;ImXHmCh>U>^s2t_m!nT3(%vj=W3eJz?P8#turw=b*o67E=@t!rVRRnnNmXEU31 zn{;{=`!u)1(fgr6y4Bqq>wftL;I)bHXj6ptjMFQ~HG){}=8Ae7l-Nha@c}uWDHx zLRKXUwQOvCQ);%8tC;oB;R+_z0zdD-i1D||tHE7=V0cpSK5U|!jci^#H$u>qCDr7k zuwXR*96EtY#5Kpn%K(8`t{SdcEAk5X`X>V03DHD~&BCDjr->t;2w^6tZ)fs9Q-Iqm@=m5#-43{! z1uB=uVu$AnX_jyWMM`02^bT;$)*YAADfD|IP~FMUIeZ)@+ZeMUU0$>RD^Xa3q$Jjx zR-OZ26Sb~%OiarziXYU@nzVtj3iHk^}GmE_sw*h*zdLbfi9sAY1$ zSXF(s$uYLBxJS19nAnuvkyZP2!pWn;_+N4#E#S4L$rUr{x$ikd90jcCv(TY-P#EU7WIwoGQy$=NN8+>YglSK+`dd?2J@ZI|CMQinx?&04t+d{PS((zoRvTUs;sikW zp{A3er=|aF8iP!58R*HS4LeYuxw;d$%GS^gGBV@aPVymo#tl#ZiZ1-ATtA$)wbW6V zwguO3=`jpUN620X%lz3CE0BJE)38)XqMYGUM4~;C#z3dgf6Rm-VDS;}r)QmtP?|30 z+-da3Mn^WOBGV)VjOrneZ*E}u@1)uNq-$iZrs<6@t$!ziu|?2*@Aes$aJp{Mbm@78lClt2eCKd6jM_&iOz?vYgWEp1cVkqII^+zKEM$XxW_}3?2~v zC~Dohd%c}2Js>~K)`nA)qIm8|ept1B|LFG}xCF)hZ?F|7$A5&anAn*9E4KQI&{3fd zU;Rb*@iQU@1B(?Gh-_$|-4s`Do*}sH=T154&p3QYVdMo}TL~*~Z&L}7reXzvu|yDZ zg$gpgafkY~3o=_^vuT>017CI--i8ae)T@0F;VTvU_4^|f;9CjU_Ac*Igix7HnY=%Y zpPipgn-gCjj+S<^KZk^XW~~_gX8>wl5HyJXvxnyFz_?j*$!ZTTP}+4>XWWra3jx^A znbaHK>QDThwrsE=3_^fZkPei$TuK!~;gfjeD%LN@FcWc>kMMiWjdBzhk|)>^kbd@j zO8sf0!n~j<)5~Py=D$h|SkHE606T%G<8rRzyrzi9?tT4ggwJZMA7+(lpN6Z2j=H0( ztDVlyDMOT(U0(?~H;7vgm&KLz>|<@*JsMD=s>VhaX~U$gMw~Q_ zxT3NcWgTf@ZlZ9695~YEWIvMRl_0D?bwco(jcoUOp7~+Hl&2irHtO!MVjuvYmGct6 ze#zySnlg^{fEOr^b|ejq=6qV+h504~&xKdeT64+Otq=J7(MDdxy?}tLb9y2`JfAXp zwsP;1*PeA)*V@fysx18%NOJ1OLw*IV-6Co*OPpmNhM;q}m^p^jSE$)|#y6*J7Jh#* zt^D42;rD|G{vz4RQVK|e{cb4FHF5Ny7_$^^mMax@?@wo?KK-eMT9jJd&eN12DKG|Z@zu0L2} zJlkLd`384Gxm{paa|tmPs*2Ozg8G#UGJwx-xfMgbV zG|;E7@YKI(?3~z{vgbLzCM7{rfXKH2pK5hJdhuisB|}qpNkVvhNUCCv<$e`wIK?BU zEPUj5Pr-OLd;83-L05~yh*N}z3tZE6PfX68;f^haB62)K+^2Ls@S_%CXAxpfU2>@2 zc&@(f%xfM@l2D2?skNy!GzA!LoV;I8vcr!3__1+5Mgl~^P@rodja$ERw`}$!u{Bz> zPYC&Ai`YW1M2)kH7k3Gx94R@ph4~9Z;ai(mJI%;xyzGr0}0$5y=md{ zu&%^S)z1#p&MWSvI+gG(d9;~U8l`cvn_o0}AgRoWA{IDAx2!#I2erQ{gk9mdh+;KoiT~2D?&Y(A(B0}LPUnOm^pdXQ3qO4i7T6i z?8>yVf7&Zhtvo;B2FrcyG#&M)3S)TI#tr<8T#yuv^@mW`dDH}o!mbb=i^&k>yU(Tv0bP){gM>uP; zO+TCWDQ=4{IigzGz|EutkO%_oQ|2&d{Jr+S)G~LJ*GPi<+8kedqZ=IcKu6ocvImrH z_oP-TB2sRC9dpML5VsIs1DobabdZ4*2a3Y1dx#d#^SwWo=kJj7n-ZpQ{0^keEaA&T@VLlpLvrBvkch?Xl zD8q}n;9ozpDlNb3en{lPX4Z-0^|gTlFa*a9b43pzu?N3vzs%U!#d5**Td514HAc3ELMn}@u<|LFi3c# z!^xMA)(##cv#H8^R%k}g(>9Jnu8HRBS?B%kpjjOHRlTA36k5CCU6EinPKAf&q+Y!; z0;5NR^cB;4-FP>q;ejS2wu$HakM5~<ap9$IeuvJS5P$>R{jLX&?8h2XBi}!J>lTrHQne|B?2WWivOP?i;PKs&_!JNXR zlMDxLu6w!<$r}wV^75`r%{+XR15P|NdBJFv(b29a;xUO%BfCtCdpCX2j>;Dte)f3M z1r^N?OUvi<-yjB5oVIXh86}5tj{lR6i7I^(>TacK4T%Y2W=UGmY?Zht&; z`GlmlIq#07pstKZoosN1Oo&vXYMAG>oUEXo+=7R}FJMxduq*x|R3&dNb4{OR5(o~( z&ALAhaHXaYJxm3(Yvi{ZC$xi;llfx?=a`WhfrhQO#Xl$civl`g9emtfXYD0)%rz=r zR&gdaP>RgQk7>hh(BF$0aG`WTy~bPWo^<08f7nyE_Hn~J@>!V0mtv(Zj}6VLI?E!g zri>t_ifEyt(6EuT^iV%QCOVvjp9BOUT_|wfE|_u7WT7&lRH{cW7kJ>IdZEXU92r`i zL$B_srY$zMA#Jxs@NtIQC(zgo?KnE$4xzGiqT;X!aiGVJRMMuYR%)ozI{YCZR<}4A zsTQwNPu0GMl~NAP{7u-dmjTSju~(|%RX*Vegv9{Ni;Wy3!o3JzX!6X66Rl?Ive#GX zHa59r|LV10Ej6$Z;cZ+QV{NYD6I`Xf)zavB`MF-KeQ%3&*DgQ4H=_;Zt!(VI`}7dzA^Y;Q}79_L201PQz#bzbwRsD00LkMg+8My)EyRUTbYg z$qMxSPx{7gU|}nk%$S1*14(H3i6})?N{ke759tbI8To3+qtJ9%WC?*$w8}p}r!{>2 z0K@u~g@Zytg-+0qZAb#?vayCzgecxp!zTEEVwM;dT%$Bx<3K*oCm(0wN+2>JFn-^F z&uUPF@pze7cA~ygOr%mL9RkZ-4UANJh^E2-37qvYcb%%RcKswO&)IGOA|72E+@~3R z8ylHaZYB_YIr(dNQk?Av8`xHZ0J*XrEwQ56YqpKi!UQ* zy6h$Z9yzZQUx`(o$ut$SQ2s3j5WTZc+lr4um4jgsTMrF+Zhyw(=F?c{L|LJ=j>pSD znWesH#*?gA=TzJnIO81Semv+^XI}Vb2KFyi@_OAuNGo3^H&o4)+CTQ8g zzauTMJcuVA)+GAZTBrcwYjhOsNoyf39W!0`_e*z3KcT7I?PwB0ZuPwWF;e(<1zPT* zbIXd4-eCBZcyhP=NG2SvI>;BtG-t6USh6!PDZ~|02vp<58X;yslh)HtlGp(WzND}I z0>EV{4QS%R;(T>}D#^g3RLs{;6x36c7UmHzbO_LLh%=k4(O3?_j}NPrb8Bz@WZheR zx3+$wKVwaIsXE1#AdQC4IP?!(A8*@zyH=5abta#*+r=Lpr@oMCJ#0RvRu|Fe7Exgq zg8k8*B5A7|=EW&OFyM5Py7+s~K2t-rsqV@ZhGG5_;#Ag$K@wxCg0}MN`T@y62%;S% z=+FXR_bDQyPfhq#Y^QoE;-%1s~K8hYNoCTrhYPCQ0?-2 zQx9zXtmiC2EJ{?Gu@G0`w9%u|14;<;9@zq64-9jmQ$012!3WaDCImMSzsZT4x}%-A zupObd{j0GcUc%A)Za?Ea2x-Bi79s?u@?3|vomp#Rm*n%b2?b$ZvhS~CHu8+lx^U`P zFl(rRC=du&j)8EuQ1v)8ee5*4G189HU0N!yk1~VV8PNr|PvP?Ii~96FgM%(PLGjA2 z_S(e{Cn3I|lBmD2{{4TP`CoE@|0z`erBko$1YndSVqs$X%FuRjbRuHrVrBooBx|#= za7cLCwz%?g)QR>*jMlD&n%>v6~^ zGlu@0hy(5OD>2Ja?g27u$1X|XUgM5Y%P$w5%0&@qh7evVL{r=lQyt5Fa98DiFiC*f?ZPgo$P;K}SV7(Hs zWY3e!#BF)@S`lBOSN(K=_BU6nESp4cz#d^>2#o49mTHWZKPQ*Ub>V8X)(jSgzGVyI zr?XD+?sOoKevdG#dSnKD3L542&I?XD`(C$0gWB_{ckY_1^T|IzBHMq-ArjuugFo2Js};W=_`Vs_dvm;pjfcecML~)Tfd9kG zlz|tMJB;o#5^ecR&}LBQ3w1O&Fu2A{3?nCS*fRk=#A+@Cjz$L81|2}ANm(5r-up{# zGA^7lHI=N@n8rTb^iP0wE;F+avd}d-8!(eS0jSx)l>*dlpyFqUR6}dx+Ifa(f!6YZ z%J79T!(fcIEan>jn`?UfeI2<{X{GOFw78dkX7_G8%OYwL^U^Tw3i7FkEEg|hanyVu z1BG_oI?)#;&(UmgbnbZIFgL#R7#~pa|M93ro%Qt;VpcboaK3AAs;wD zrAoFxVsYa11UYoIO5?4jy-%YQcS&o~lu%=3C8PTcj*MQ0zWKq^wfoq)bG}hoZO|F} zn2cTntf?Q4RCyv~8&Tz*mIAqDfZMMZ2wj6Mq09mi1_5xb(cTbgDaOQny22|ytf%A5 z_b~3rmqAvyYyocWXWI_xFjtY64h-M?YjjA~u1T2v104=a?pf&(aWN(}P(W6Qa?YK1^%Gwq)Tf`8L2U?r-b?0OBWndA<)2V1YhqV!whB4t9g zDi4|NxB5le5PDu761u{nKDA3=IzjwqIpYjEXslud#;i^k9~(D>#(ljN)d{jrKn%mbmH~7zUdy9WLl8yE zYqFB?Ki|jfKCdrb`CbpQVS?=lKTq3{y8oVT4BP4XJj^lbb@@Cs z$8fy~em-5^Eu~E9>36+dP-ee@nESjx33hwF+`s=tBGm7CJ!>X>xy0)B{Txo267YKJ zzUulLyfpqr=6Fu)^-!Mj>G3i_+|oa#-{tl4=5jvgd~8nG^>KYWNB9AG`}WcQmyq%W zrR&MM<1ds#0uQ}-Rai?%oIFNnM2KAKE>iqn^;TBiF{YSfo>2p{azBXb!hq0;dx5~k zP2Mu*Al;Wx=572;OLrJpe#Wor7_34bMK<;lKsmqShMb~@Olt5~QETfgYG;|61J3l5 za$>S_@}rw#+i%)*mLlu9_-#voVmSG7`fvn`oFaTPMOkmJ3{z||*{X8dUT-+x#`g9j zlXA_2RI=}D*&lk5a&Xt2Wrnu(Rj`c> zCBg#yxBhZzc5opAWaJSh;RgNjg+Z3lbT3%QqZW+^ZbG%u__vg_jm|w1iqt`FLgR+~ zY{6%L29GoSxo(oPH%K?D#kLQ|r7dAwS6%gog}y{Dh8e0F2;BqGuqcU%H%u8JT`%w> z4eCa=bTVd=?M?p!WgdQWL@k$}##R>J>X*Wx#Sn_gRWj#k3cxmh*&R7L*O#18` zma$N24l;tx6@@Y!z?@Mk^kLN(wJdFl@r%nSQF^SC3l^!xrm!xr)H+hhvJ;E)sleDe zi5jF9(sE(QcrtC$0$Z8$Y>_4b{vcwyENTd5LfH_018&-_y@vmsLARI-@{!-HWPFGDO|Z@t zR(l%Iju9^R8x{Odkz59tF2y(V;{t>~(g8R^La8Fge&+0$4h`K)5{z<<(j*w;G(}=J7zSF2V`W= z4G?1`WCB!pprS-CsiVK~FiVbwoZ;UKCmTcVX=BS?^GW$i?wun;gx=Ff>T@t;Iyq{P=Ah%SFgALT^&qBrQuQ%zj7sb}JUn z5&5e-t7Zt>gJs}pMm?7I(0DOCcuRN?LE3K;Y&`ia5A2^ftO9PwIw5}Pt%2yU zdX+UPy`z$tNigMClZe_s!_{{_ON);#*l+Bk(HWf7s~%}Rm;g&7nfumdvc*|)p|5Ew zb&ZTEDALsoCJt3A&|A7e-Ih2WrN#IJn4Otb8|^w+XJOcT4r~xT4SjHwlbBTNZBh~j zV#Y(y5sy9|n`}^D$(Rcr&_;m~mHgOR9$fYBB4~cA1G?jT!jmzeT)Nu1uF|EJu5gS>VRa-+SUbAf|0;M(cg_^Y zE#^rOog^o*9;a8DNh_zlz-wz*8i&{c5Q177d-qpW)H zqe)}9p%Ax&FhFPK$;ggGsjT?rhRMt`&y7dUY~EoW>2?u~E%wV4beexWYUY=6=nF)5 z=F2MYhzrFT=qeYU6Rt>TSDj69E14XZ2nmW*25wtW`3Z16&1`Lme9UDYB-?nM)Rk7J zJXt0kka^ephu*gGnd;s_fKQDLFpZLYGAq>ZBf%?*$t0!C=?zDH86{op=qdtN>=NE zWYtNt`bV942o=-X$JEkO|L+Vk7}O{W2rqKk+!}Nxyg?{xdh-%TH|8-d>1yt5aP+rk z(l$N0;V|Z8e@}z`Yhs*81A*{_c;!{3!kFy^i9cK9bj)U2b*Tb0sQ}_I$_&;Q)``D9 zS5#rXQ#6XJ^zVDdxsp1J`rb*){{!ZZkX;@uA zdRX4}GS+yAs{G@?dh|Rgyb?%#G{k!mStD{i+1lR6rg#Yn3fX+grH~UTng|y*Re(|D zSj&MkSwvczcA=&n$mB4Udc+xXNfB9v5iFq%rmr=`^JgjVc4@sFcZ7p5!?Q7{RX--- zHQl|jba>cI51{EKEUGUitfY5WC8xO>a97pDgy>C9d1)(j8l$OR%ybZ^sg7m1%3c`a zX{tb#eL5~%5$a%lQ)r6p|Lr#6pgp<*GtkaF>&_Phm!?W!f@!dUKMoP&MiYa{crPq0 zFYim_m5#WL{D#0u``csX)IgN3T)1^#M*~cSLy{%uy3IstnbWN_cr|xlfZCN%0-A*c zEkbl2C9!oniWJ6f_$<}I`od4&*i*>L!NoG1u`W~7hdI`(K0t2 zYMLs7i-J~R%NhES779+~cm zC6cma3otE?rWUfA#v5OwHBj3Ph~@u1?vS_&>Vm^v-fA8oa?NGsBx8hCW^KC939q^q z!2oF$WEg&&>@YRk2MY{oOgIIDJq-oHR`)g|XT&P%5yBrti)S^Bx-Qna&=g|Qk>Cwq z_TUd;!j4 z_Ov@7b&Ymf)ESd$vT%@GPhv!#h?WeAszS)B@sVmOFTixrPF@8;S|t63F|%kkCqo%* zj75m#d)8vP{FVz9`$WnI&O zpA_t>?8z(2b2{VgSaXSRFs99j2NOK8(fTCedBy{&v-a&cdBBiyga|QizIi^16ZUtO zTG+34kC@K8N}7j#(tt9h!dG@)TiJok3`W(`cyHBHUog(o@*54;Hx=7?jJ-~VmlL#B zMfIpBldr>FW=)USQx6=@)6wg!$tXRmYc`C_=NC5H`K298y^{xdQiv)c=SDYq3JG0uJx$!!1pN+JICp$j z^9%F#d&(cEGj}D5>MG4JKjMev^Tj{2>)JHFI_54bIgM|D(Z%ivmjk7>+()XIX!APO zBC*qMdStm~vk9>kf3+t}0@InJJJ-iGZ1a`PX*|1B#C~X2>-?gS zG1Yh!UgtM7@#sm<$>**3{H-Sh{z3I)P3_;vLzl;`tCH}3A2u=223zx63T z%IAc&jvncy1`P1m>L;Ck`h4Vr1N0yhQLgS_FSC^91uSPxl(^IjQq(}AP=ii`>eN#^ zEu+Ja^O+=IzL&HY?a#nUx3)|fW-AqETw31ck1HGaR!;D)%`0mUAd6;V0k-y+j?O-D zOFub-oSz`jEi2!~#`}*wEPQ1TYX6c#^cpU`D<4dkFzA+P1!SltzDCQ zVTcLW;y)jP;dE82uZpePJi&HUX|2`j4pd%J8h;*758k$j6cY(C7R zk{}x_`vHh^?b|;uO*5&f;unwUXz8hbx}bHiL7LmrE%*y})7(wWJGsj;87sngM>$bO*sE?k_@bbW4!1 z$NU`VKh^&?Bx7aYn`i{UvU|)8yBTkMO^1>a;QcKPX)_y)e_4ig;?A=f&YQRyZsr$E zf_u3uy{}056nTT0@72Z_2ZlM!-fN7SPM|HB#P*1GwLYJ$CgDI;3VQp7o}#|&y+aV&>hKb$YZCY3eH&R znHhi5$|G{oDYw?O7L_ICuw#2s;%cJMK&sXT8JQ=l!s0JN2vi>4I!n_pVskIJ^qyGc z4)FxrAFL_U({D~$Vpja&{)<%K7GyGKN;NLI@4M2htfn}k?cv(Tbs*I0$2e+!%UGO$ zXcX#Fs96{zMc@!|&hfe(-~zscjGfB7=>CFM*XnX^%O?bN2N^P;C^nd-ZebciFzJ1> zfca#alo*ZlhA*HP;K_AvAhW1csuoUzWYdrlzNSx=4#y6_QLZJJ)A`YVFF|z??$e0r zS5k`7W^OB+T(KV;f5dCZ_n;!qnY-#=I{PPd)6bG2$ME%1!a0#C&{@}BuA94Hd)xr9 zBfQNfnpZoknt})A+>w&qqZva!h<7r0tzXrw{M8Fb<+%pH3JObp?3Stftqyqfx*C4R zd)+^(p&Fxq1|uSRMf3?!qlaMg(RUb4ryXdmI2#Yz9Vlb$cQrw3Dt~ZArRTX5tF0I# zh+j(z=?OP(pbwK!>OzcHA*N7`D$t5CVaOqV$x}oZcc)fd(mZ^V4FKRlZ50~~t@FbX zhh^2ExtE1P_*&C(i^MY=X5R;A38YN7cr`0pn#sy(sOoy~EZ0V4PSmlMWAXwc|E4MM zBRqjpk3Nr$U-~HC z%{kOEO2lC-1X=P(INb3!4KgPK#a$sQd@?sI>GS1f1_}U&rZZqUM-UDaVOgG)-^xZS z*UCo+kI`gvruLDXYi?xB;^)$@8zQ~%0 zPVj`tXTPP~5Tk`DWZ>Wtrlo#B0ytP_s{AUln4YACQ&%RIv^|-MF0s#mKsz;&1pLt; zQ)c#Wi*D;t3vS!+@{#2crwKd*Tx^WRgWsg1O@ql_<56yQVM5BHR}zK*34FiGHjoG9 zd`YZ`Y9R>m@w-Zs@o;jkfbw|ec@9^~G?NdnSUK~q|B|YQH*X4;Bx8ugnfW#3J=>5v zZMWM7!ti;HK7^ZbEy|&3$w?W4EX=IZVFb|3Q>QlITU_X95KMc}w{O3bmZPNCJ#bEx zyU2#MFvUmJ=N2oZ%b{6y2q8IZHnuV4(%ReRXytso1Sx_&94XmQ&xJo$V zL**k6gxS-K`Xkvof+YRo_HB^jS_8%R|I%KRo%L7A(0;!zKdWEXkW}2T#Nu(WO?rQz zmlegEz6DBT6zS#xx`VW-5qugBUHZW?goXDW1LVRCAY9zt!$dlTAXK`dai4=TdqHgX3GDw4PH_J3B+h?M-)MZz z->P+#1O)!)*&|rauhajsbY~Lui{%g=Ea!>w!tt00v{k&e z>HpzHpeHCfF4XFdrIzi!jm6zJq^X!9?&&}I}dv{8}}{<>3j3rizr`r33Ee;PVDSh{I5uraf+ zauYGIFtc#55iu|^bF;D%F|e|8vU3qJa5A$qa}qHyGjlV4Rbl30V*4s&;$->9(N`Pn zthxdMx{S&{4IQmvS=j&KTqVZ;N5B3z4*I`)@XN*j>LMI9LR-jWKN@6xO@8LI+tGs+ADcF!}H%rYmfi@X`{UU@DY zSrX*d(i-kEmhEjQYxl^SOsJE|wVUV^;hwxHdolhBBa{6&zv6w0MJAVSqKlU{+r>@G z&4F8Y{J8tvdV2rV?2#%|0tbJWD|U2oLF{(q%7~P&61;%3MUELRr=hK{uSXCky*n+h ze!PFAgTR6S^V1-aqDW{tLSuao)4y@c%dhXx;q-c}&o*6MU0v66r6Dbxu~Ne8k-U{( zVM7;P60xL7LaeEbB9wzNFT~GS8-7ybG${Pe7d>GZBbtvG62R^Gc)ls}myR1Ve?$`3 zzS_HeMrd}h5x@OJg63iPj9^=nAboOY^BCrxQA#UQntVjwzy4UtidHLDC~IP5+o5${ zqGVxtF&2{yZ3IJ5%C_>i!wX;bR7&XJ-&c<`NwU0|5(M#19vS?Yp{sYtRy-$oo57YV0aEzBI`J;~PPmL2%Ff6R=zmewcCS?{SMP&x^bT=M2MG#!{K9teBAu3wCpVRiRy8dIxW~LtHmQ^mAM# z$L+aBOu%B0b3HXRwRDqZ8Ro3mE1JocX+J{5Ff<5Z>Ea|kbT>aXKhjRp2Df*On6RV7 zgxc;248nhqZQs45rKM@|WD=kQ*iz|>EZD+1>rOASoDHG+&97&!V+Ml;s~+V-CU$Pz z{Qdqv#=fyRldxMiwrx))wr!ge+nCt4?M!Ujwrv|vY~y5qIcM*xcUPVM1Km~Kz3#QH zbzygYUWrN4Ch^eJ4m)HI_7$e6-dM4mhvY z4ifG|f{17k&YF~hnnh9Ja3hJu~_hvez~7#<=} zh5Xmw-<2X?e;4502Jo4f(qg}_;OJr-v7WM?XFySSZChr}AKQ6-dUm+@01oZ_dpERo z!7&2oX)Q(_?_!mVWL!pAT2EsWrT1uLR(~Q(f<1|@p@e)<1MYLgL#|PcO|KNjwaAu~a z;Smu))AwGUIB|7FcxH3XS?P7{SMhCAGsOax%0}6Y2TY_U#_wS6{Blsr!0JF`+WCQm zPI+*eW;iR=tTvj|oPhEDxtNikr&Nrof=G~kfZKA9u$qH|!8Z{^TsZVKGogGQNxvYm!MyGq(E8yoAe#CGyd~clv~G0WzOY4iB+p zA$DOzzpAFsZ*FyCA(5bN|Euovat4!27R^W0*JrF}Sa)q3GX;tlDq*+#z2DZ{L=6oM ztpNaidBnTqi+pws4OPs$h+xMj)K=w(4j%V9&=RZUjc5Vb9b8-+)h)oTeRKMZ4P*aO zQ?=ss6qL08*)a6-n}Z@byK!kd8kv z7dU55v;XMMt9#zcN)Ro`Ig+pVpg^A3huN|ye6u%Z>^07HP`mN-Xb2C8hFFIV?)LV# z+q|9`891`0jy}5GnpGs#vR~4IR@`_`!TNUAPK$^Qn~^~~)h&1Rv4NLpFv>D(5{18p@l))I3*RRk4*XHg`tvpAE( zv{Dz`-wpwDd2?&&8XS;A&>unV(=!vynKB!=xYShCi&V)nRDm}bP(igcNGJg&US6Fw zHHaQ|hK7bNE*Rdry1K&~doEbSS-P$tb>cWUxMWI{i_mtSksqL(Xdx&3-v=Z5yfqt< zm=oht6%`ddZ%Z}!Tuv0cR9NrL&1|DIhj5UHc#9@xMlS$<;sY#P-1j|1AG@m$cXO>y z5;W+Zhb4OSR18wZK^ww=r^?Aan&4F3_obRph>+oskwYd8T^~N2n-kx!lTbv$kQy&z zdZ6D^sdT*0n~uC)U3|5=L_jTkw>#MsRFw6H$F(9o!~m(p?Pe<*iAuD2nd2*(Oc2}+ z(-U2fJrjzKKP+MqM1?PXz}$y_Xnqs;e#DOuFyllg@s+LTBNVDt7}Sf@7nYSl@AfIl zyr}nl40T{`cWlptob_e7nV32pA7Sb~d44v*H;E33QeGV|P^AiJ^0Xp(U2nk>lt3!P zVjeM34x2t-@wU#F#xS}aJnrzmC*}~%&SmwyX7;%64?;g62mu!hq*j!dcYkJGw{BkT z?HRbiwLee4y6)a8wV}0rhPL3Py)BpRJUc)2DeocWd~TlXVnaS%tCy?zQA^cBvnk3% z;#$gUqZJ{=g%Wxp&AnU&!~VER(RbbiY?)ehdx2kalA)NKH>{CSI)8^j*v95%WoG~Y zR}fYtxTI^=Vh}Gi#qI6I#l_Xl&2@EkMErW>sXNt4(&OZAaA^`$Q@JLMfrxl1W6X~b z1HrJE0%sy6Wc$G1AG^Ior_d?mV@J69MnQRmPTD&bM81~ha{*}Ax%k+&7v=)J zvXao+24%Riu8=%|3F6-8kUA#Gs{>Q}S7~jJHt?f)EA{sVJ|oFPS+2-)+mP z&QCB@l3L?gxV;&@D~Bmum*8HDxRx~IN!T@tWeLQ!)yg*Tdgx1>F)B} z6H`jJrnT9Nc2msB`h040bR$ihxV}$SO({>JA{fv)AfXOUQ82d{=X%{x_YLJiFlEV{ zlJ~uhghaseqcmrP2;cL(?s{%G$@!l7eyahbW4}Q10Og>GTs7mqiG69+tfeBOrxefBK)2zx>7<6@mHbR@8 znK=OE0{@WB#Z^=8;Ju1jMrehqA1ulCfO&bo89?-3S>S}aMO>B@WH}}GfP~lmqhNP9 ziYx+Rj`mT{W{~&GJ#nm1jVe@J?5EApF0ZXss8~>1mgvBbB8V0Zg$xaa6!&Ovx8JDF z;?CpGcH4(OTx9@nk3D={EK{!OxgB0>*@1|QyJLBG5uuzEY7ok_nFfGpauP-D{wk~< zg4j4bBuiqAf*?#b8{hjSM2up3ye;Dz8Oh*Egf(AvWCwza`1l60XE!)ve4H!ArfgB7RVPUUdq3>LIEJ z6{Ac@s=pyuGCo6t1_O@j%Yt@!oS7N7*@l{e#?F1y1(MFp&OUzce#pAZtthOQ`2Gcp z=R+_hz&?1rsiXp1!Ep{7g)12ZUR`x#Ka_wa24Cg_j0{Sn$XJ+F-_D?{9r0I zlhEhIz$OJ@deAH_#AXA&WM*<|s&A%~pl0S=nF5`v%0t_kKbH18j~~^@2#dM5 zOMz$>_rdqQ#nerSyjb z%dE#XxWm0o8Wl4nP&je%(*echCy*W>sy9f84Q?*`s&Bj-gng`ao=Xy|uFmG>7_@pG zK4T2ndsvb@iOiyCvq5!CsW@kCx{{5fJ0ONdOY~D{?G(8NU>+MAn_XlP(mTw*G%F~A3j9D{bVPT1SfwyZNukXdN#8_VYfMTJeqa%m{K}Io$J3oG)cHosbjbRBV zRHv^?>+vJT&R_w3Q%esgwRou&4^CnW$N1*VSUp11@ow zbGtRvm|v_N_URo)i(GLS3__^Tsg0sRyf(SfpYJf@A$)vZ*QZOp&X2qOeUzqQ2Q0>V z84Q(5E)s3vbl5xHQ(~{yg*}ef9Fl?%IOFi~^rK1(E7 zAg>Q}-jSEf&8BmVt`I-JR^gFU(s*m_JVq6L-(9Qv4vtn|r3Xjl4`4S3bk5sgx%Lz3 zqNI^X=>eM!q@RHVVHqMp&$4C;hD9x;UT#HY1nxU>;<|+ui!`;83eNX4*mVIoyJ2-2 z#yOdo+$U3qp|_4cEIK7z+6+TrfYvMLLZ3Q%p@ASY7dr=Uyp42Kg$e5;f$SR(?hhg= zv18T{ndciY1xt!$8N~JVDNI_Tt`SSMK&*L4H?o&x|jprD|r7%qZidwBnv3%tYU>0)P&^wHFbC-~h* zuHXxaKrlEZ(OG1DgzlxMrU^6b0~o?2oukkWlJJg&oRl(^zq02fwP$c~2}x>vg(IAi z;y$uTo%d>WXs3PBcQfBY{fdt_PQA6ar63M+roihzcj_bm2#lhRlyoB%0@)00{K-MN z+yTl_F#Uc`H(RD65c6%9?9GS~J%xz)i=&yIN|SwU3G8gzd@!~gtoKjYcO=igHJv6zj_l;~ z3x0Z~)@l+dcu#B)s*97$OxwQ}t~OAJ5kels zZaCj#=76d7vA#{EbGXp{zMqlVp16rCGYZont10*_9RR3Usfmt>7RnI(my(+7b9wID zWHf>hm%n8BdF9$enj+!g;1EOLjsyo&3p~_Y@9y3v&;RMKib6~$Q(7j2>6xBPnh9$E#2JGAbQ`% zM~q_mw-*;f;x=&O^`fL}ll$c!*d?+* zwdaz84bK9>mH$Qou1|1Qty`61OG>w>|8t{IG6KpW2u6;2TjO&?jcw_iaePB!OxOuF zMb7Ep=eB=4V&Uv3cNOQ%nTM1d*lQFnGU>w5G)5Po2pvjtgHkKgeg|BDwOWM2Qh0;< zdb4?9O@Sx2YOw2iwb|r3LqJAqM{YOB|9#)1pGFK#EVRSp?qF#NLj#IQNkz5YWW_#M zsZ^Bk8|7z=rlY4H5f^N%cTjE4S9IfvR|ujZyz_5|DikJb{wK3_(2VSI1P0l!@pn8W zcFcbjOU@4uE_%6|ws%3&r4bJRePYV!e>`?%%m~oDkfas|5_XlJd3az+L*64(H%+Lj zVb_l9gkGC`W?Mc71>2vMY`q$7v@iv=;Mq@+oO9N8y$lWl)~C{5opi7^-j6zu=y zZ?#gb)8&!8&t)ttE9-2ejJhsTGaqLf2fRtSdyfwD3o79FyppmgjE!slh2w?w6g5l=9A4W$A2}+20dT`jAi~e1 zBTj4xE=k0+wW)>_)#c5H zBmg^PXyB?o1C+^z!bzWKa{kDws%jaXQXNk^u`e!8>6jONgS+Xt05^Bs29-JWllB>N zsCmArBq~v#fZIa^vxm1{NpmJpC^3FOsm{t);XV+?&`Y2C=&c0z=a+iMNXe_uWhG=j zuKAdT$)_<%TiqDZ{)ZQzWJ5!v227FRHox!N6uX(3DHS!UAj#5&Xb@c z>S>_w$H+G?3rmoF^0@IU_$yU12weg>ljg5pYH-ou*{v$ts+W(6RJuM6XJ_ZQGvn;w z8S%4sfV}V9^WQG#wl?gPj+<>y^%@;g0AnnyF|nqZJ2r-JW*H(7AVKQ;co8+$98`zHZlvB@f>cqyo-aILxR%6@}Z& z%dL@kECxDyx~!?CUCYMjahdXpmZkuUVK~-BgST0McAm@}zO$A;37I!K6c%4%2s{Jg zS}#^Ol-fC4m;_f>P~E@utjlu%a03X6#p%b_B(@VG-*&4v_Z?B(#K#8@lv|96-VJOp zcIv{9b97AZT9cKTy}fO~5ZOwPkB>b(JbZ2^^!73BC@gwoAlwiK?1dRDfm(0r|XStM&o##WnD*sI0q`_a+6_Y_NL8mU6oRj}1 z??YZ-Zn(Ux!Xow;2t&IN3y+!*y+SoxOT3`d${N<1;P#vO@&^tB>ez}&F$`kSgh$e) zK&hwIi@l+w3!N-Hor3tO6Gz&b+5rFv2#6%CFPi#1Z3;A^3J{2a^-+gCl13ll69FJL zaB%R(ABDhXaB$t+od1^(5K3owdP8)vx9#N!?wo|>9knVB^}27a3E?(Ujw!3A1xyOu$nOdR^WO=`4A{#9&A zeRUSU#mO)%>+4-Ew?IR|S?K6!yFQ=Xqsd|IJ_iqC7uLj?a7j{0bCLU<2xKygg4y!X z?WN*J@iXZ4zLuzK^!;wRw^dcNRethS`^>=L0(`xdDIwx1xsuB*e8rn#Mi)**?VKG&O8e4n|E`~>=-Q7*vrgID0El{6H zw$4a|vK2@YX2IW`PVC80@N?1xmTeiZ05-3$ui`Oy*aQT8?ssHZz?_%3KX>5vC4l&4 zvU_9_1S0bV(%O zk^JWB>GP+ur2(6&svl75MTV^Lx7@$dvMTVwey8+v5thekhK?}wGFeZpjkceZ@d1(i zyI0mnR(S5_qvN9hx`VmFV_Q|DWyxo-yMce3KSX}bt&_(*4T;{Hl^=)^#(uOjG9og^ z&l+vW+ii&EY=b@-Z zU@6et0(ABSP)1o8?}Q3ETUy+#Su}Zg@0O_qMbcTVgwN?R2(U9CBPaifPw`b($2>$+ zu=(!pB99z0XINfdxu2iV_@fGC{x3ZnaB41o$JBoZi^ZUoV>8xpvC%V=WQ74Edcl-* zC{F&z3wUAn&tHbKcpRr@*M1tTi?ue+8wnj7Ssfj3Ne%1=%Gha)I%N{$b}BrGhM#?U zV1d7Gt{abZk(xgVq5FqoCuTFr1P~LO`!{j}-C}~VO^Y0?fhb0+ySMq~si``0r$N}I+W?3pm-1pA4!_H&QDD#5KC0t18j z2uesBqqtRt{s7I)cwagG#GFI&9ekOykf1^BVa%F)6fp9F%O5}GE6(1x zF2S4zEFfXmtYA+ zl}fKCrtWVi@6f*WRFDAwx(_D z>PLi$5Mhx~C1ng;`85*YW4Cz$l+@Hxf@tMRAkm>=6EO94xNv3UX}0QzLD-jNY}kz!NsDg2)MiW`-en`@3Xv^LNr7^Aj- z5AOk8s+&t?*6o?VcbxR>*LCu|5Y0z-t#wDMyh%P|03mG2)e3ug<;y2c^OM`X+v;h$ z!NLhZfH0A!xu&>#x~U6OTT~c&V0Ux(&z|gtw1aWg(VD6G!qB!yj5>ZW>?|5W+7>|@ ztX^N=4k_OC)E`o$LaWdA1(=$O-(d^>@+>Rma8@twNEpfK`C&G}T`dJcAjV)dqX9%h zdQRCch;!v`)F>7sHC0BV1oX?D0e_aI5lxO-JD3F3xMZ=Ekq4;x;=I92j_!lFJAw_}{qRd{vd146qfDp!T)}~_C;7O zZE)3P8jC1!VH_MTbm$%`*1`Mxv^N92r3%TpmezH zd2?;8&#k>K{ooJjW=FYHAILW4B4ye z1(B<|b|ONGx`NeXKjNb4X_&bMU;r3LNSujSy+!ax@Wk4~Y7x@J32c(oS9Mnh0L5e- z;pvbeMAu1c)+1(H6B8K<9E!9|1m{Sc(|R9CdXTdWE*K@CdiQi-gzlejsx2Kp0rn^V z_k+Ce6GdCxW(g|*;uDnWsan z*=m|gdSzBUwa|8|t%7>t5*u5ojLhhdLA$oAx-j1wmnQ$$##jGT-IuWpB>JoKwZq;t|ed<3(GwdsF+TV6*}dU}L@5i&sGV|>jS>t{4N zY$!a1n+HY*1SO&4@ABP4yFYADGW$(HnZ;<|MWyvV$yU}@;rbMKOhPmlnaPUfXXuI5 zxh0W!Blh~h2m+|-rX2es>Yv%Elx8A*;k+VV&nFc%wJnFQ!_WmO4{~o?+pBc5Y)gH;fnXfLm0a!XPUfY>#`7Z+gwJHlrx#8b*4ms6!9F+@zA7CUr(oc{= zNFioOz|b0q3JEwp9i~Vse6gjw4mhCaQWIAp2&8v(bhKgS%h=A&ZfCnoRCLHRQIaG% zg72)9u5<4CURF*PgiTXx!{>9|%8fG>02S8X#ixXa~l;hPi zCm}SB`qubDru`N?riKVY;CM8oj<<<%JZq!YxWTzoADyoteXW+ z6Al=$A-Vz%gB<*t+J zyzUMM39(`oO(muLIm^a%8h@ZOj)<5U8Tr`g*a;J+PEAd<^{pjVZs{0j0lo5y3g>p3 zS_Xw#%dEoWmS`5xgdKC1#|+P5sN>-rkD~ z8s485$2g5I57FC;)NbFd>wD=6)wG{r7^v8TrL97_#O-=jUS18TH2>SZdQr={Dr{s3 z2%I-Nv33b%#(x78ECAkOmq3tnXe5-WDl99W2v%WV;>}D+JV@tCcg{1@v$-74;LM>= zj3Ylt@hPDEYP>&d&dw~SOi{^NgSIyH8#Z!0pES-F(FAVacfP;Qd)_Y__+J5&lW-yT zo;&XZN}nP;U(deZ&&tXR&tBPBTK#gjZkwS59;bVu1YAz1NN=_+8!A*yGE`k|xBK63 zU(YrdDYZ0JPg*-47}}^5U-vnm7elGK8QJM=CzpWCV-l-qsM1r*>p=xdRq7(w?zo(> zQEF;xVjDrQMAYTAbk1DTcX)Jafi9mO=&IaV*y;Gp9Ca0yKT3+0EE#d90qc7b6MJD3 zdsu|nkdAZUvRdMd7MAK|D!D`1+ug1^?j?d57SWzUAW1Yy~(HJ@1n=ely7Gxz@wN7$kq-z&Xj2oWVbNB}X zy>KH-`zj0Ekq@8PV>buM@W}M8;KDgSvJznqoEZYW9kJ-PxH>pk8XKdXI;V!3{7teA zt7@B7CDeY~)%$+bizVQ6*zNWAet%-M-oStfzH|{+cYV&@>i8KHkO#xu;FNsz^vu*( zUIqtkzk5X*mPO6sAKsGBnUxpBV+kuttI;BVJs30ONvNo)DypgaT+A6Yr*rnK@UwG= zjt+7rK={X#l zE#au1tZlhr2j!NpQYOIe7PPhZ@(N4ec~_waQnZ>ZK0cD;m4FNdau59EDd+T43-;_v zTUxGT`$d=4#sS#E^t|5*zh;zl6?GLgRF!lmugb_^=|zO%f2|lYU`I+z<%gRG_!KRj zX+w6b_){OkV)F^hIheXRd1G!F9@=|`K!iegyuW+A#fi;rHET`LTh-{>Azyx9nDHqq zs@W2s8~+-eYxnTT&DbL$)Nc0z%olBWKFw~?{VZEH)0xfa^tw9*e;4mzMvLirA1zUy zAO3L0TrRi0Z)Wq3BnGdab=;n}e7|GAfqGeNcMyJg-hMtKyX_qv{qS_!*SS_7V<$xC z0o$T*DkVb@Cz|co)?(A*&UJ=yE?)YkmLvB<+Hh*#|@bllrIqp zcwU~?8W2KB&0Aa>V5j^^UW%%!;4OY<*>37H4b`6XqaPmm*JR0^a9?){vz;$5UYJ{Q z-5w?aAwm&BnK4o3El3U;mhyan^f1P~6$a5obRaex@?kKb%q7W$2=KLe`$VwDd!PbYffN;*_Ms zN)aJY&{hGX2U!2@+4NdFascg##rGUFXGuv(X0^6zbvQaB#GI>qMAwW6enm1ql;(1W zdrxLb{{bDph?B>HgfvsNKSMY-@nQql17TrnSq023>?sKfAVWsjOW)bZpjNx&d0e;) ze~kp3CQTe+l}lDUMl1h@3=KJTF=2?;4v`U}`vnPW$NtL>kU@mBCZLz2_*3MnK9^g1 z;Ef_iftmWB>9rZK;Ei=UMDC6=|8{#{{hK-e^)hM1cb`6!7Cj7!z&krX@8R41JEl$i zpnerdQRr*|8@ap_3Haec>uWq^7dMelz~K}NO1C{R3a>4xeb3IfHl6AzQ*V`-a4Q$L zN-eW58=HlL0Z1?cxIkQZXrFNtbPi}ru1DFmfi7qa>>XdD?e*0UlEsg%-Q30|I35FY z)JyGqH+RW0xS`)QuRzdIs=i6tZD%yC?c_SY!1=9FiI^F7Vq*6q7J&%Cl@vXAN(33f zj1P(9hiKQgM;tjMQ-aS!Ko17FRVFa7b!nf&;|!x|te?w|2D9MokL$~#N~T_|>+H_c z0}6*Y&h+)%%m%kR!1j8(blRCj3Pd zV&3`zt^0sgjH}n%T|T~I$dSq`5k~Nonk}(07}?@c^n3U==^@?YK|4T8Q^@SBWu3#L z>nksmz|iGl75K00_24&Zr)|21b`E)=zsq@jl~yfJm&a=gWmr>-O_N__9W)vfO>uYk z_Q`#f^OC&wAu49xY0;ed5BV~_(_wcKS zFd^S~?da^6;DAjkM#TP8Hj8(re*FWavV(HO&>>S+kJ5md$5*GPZ)Oxdr_8quB-HQ* z%P%9q^9r;P3$f?t=gPyz!%<$+<@@^yU_sso#43W8fp@3f$qphvGn>ALUr?-Y1i(E7 zsqUvaU=#Bo7d!qq3OC8v(DXco*BD1Ky897SGao@8X>eifawc8~HKy@@`<_3q%lYYQ%@@$LKk zBx@M6iAKh6m~`Wo?G-ILm;oOTCzRs2?#ZE4)^0ACcnl{`==M;YPULkWXvJoQ< zMM#I5$h!o9R6nMeDui~ta?`5iNL|Uh`A*LTy|i5T zaPa)UyaBlu6CD2i+`B?SC{_{SG{in~+o?;dO^gwU^Kv7XAM%d&7JXyP665o@l03itXz|B@*ieS+CQcM*@tQg%^zPY9G3+{J-qxj<`IL`JZkG*1K0-RM{?!U+U$OFGIX^9;{uGdCNzP@9UdtwOW?JlYp>6 zJ7_fzgl&He8DUr`o?|?=*v`m2c&Kc zr>f@-#LF^3G!4PD)}g?xfkd3`kMw0v|H;I`mK>ojTmZ4uj%Y1E=sX z$5`Q1m|glS)ajr*sx%K?kEw;HP4-PLPdLp%2)T=qCJ2GQ_>*y?Gj5NUc)o2445x&L z&od^oI%?9&=TurLNGi8}25ITG#%g(#Rua)_9JI=m+XSZ9a`kAj0eKXIYj3T(ms+N* zwz!Ebv=(s7QBXTBdSZIkz_-%eP%VjMuR9c-IVM7=vMFrzb_!o~w4U*dUhW}DbzKx6 z%%CD!J7NlORGD{(x~sG z;6AUf{YXOYh|s4OFvRt8Xe`sXh)y2P!EzD^9usdL9)wRwf%XU%JOO!0Hlkz}Ov`vS zQ118$S!nM1u%xCOGtM@M+$u}0OiOKIQPp`Yu5+0srWQQ|og zy|56Pql=ddL}CG*$EV+{X?$j!RTW1B8uGX$;XzoAa#^H}mfe{3dWR5RMY)?&%-)wjL9_@pT~$M-JZCr3r~W>xh@EW} z@3CAl$aM?!3%c^(nQX~6#qy}$*uia`x*z*AUhH2V#BjVJ_3*$2tp#ei9e$l(TqOQB z7LiBsntI*un7Qu!pF9J?jqZh`DU9B^n^utzsbi3bwELqRLSG$gK}Bn^JLkV}omAYK z;W_jljXliTD9Cm~jK|WGEc+HHJPWz@WrV;4P5OoUF$^=u4XkWz=Ig+ALUa;QeI;@>amifn3kT1Ify71gT6eLKhNqKPkr9^37mgxz(}gDH!Q+T^iZGaai)!eSEDl# zN_^hyztUG?WwD=ah3DwOKnU9g#UX3K{5DZF8`@<&ZFW0@AbxDP0p5&{ap<)z8f&Kp zwWSCJ_ICC#4Yw0oYz2+NMZE}-KQH)Q-AJN6wR46&(|y{Qy7O6SrbT4tw1a>&73xW2 z62gaR54euNC!mx&{ zf8gJqOg{H@_>Hai$#&Miu|#YlzU6PL({Xlm;hy2Ad#6Ou+q;n8jWV~yo_F5+!YV^1 z1jL~=<|OJs0ghMRgMVDlDay~ph|jUdZPLPWmvlp@qp0JM?7)Ixv}FQ`qkOUSt;cCD zBb)_g|5WyG7J|O>r2#0J#$?n<|0M5HEvz$1p-dkU0D1WCtD z?`|8n-z|5cCs&lvI?ai;{RRbT`DYK#u8OMD8)|Adts+++PDH@i7e)cz5r8&g#I1|| z;r38e5(iuCjaj;FR#+@Uu!x!H`s$>>wRZW&WXMj24aj3|bcjKdeC@03Bh3$uN}K5F zg)dNYKuV1;@f=5Ne{(b~xko4Gs9@?UpBDI&e4bH59GslSD;iyf*Eg)YQDlz<*H?7( z?O(!q()6J|bq^*lzeOIz@;URl;&SsmC-l1XI!c=~@HB@bbOc@-;=Uv-X$en6_rwR? zb+q3(cWdtqWwnhbIdVHA=bT9KU&FRftsEsiIEJgv+#>_?i&Fd$fK$ zg&x^WWJ(zKN7T$*V{WUw!SLD#20pH#tgXC4t8=w#-ifRvWcU3pThZc)oH>iqg8fbA zlB5Jw(9nXcRct5*y*pNFy+TOg^57O8>x$(=0MEvEqB~GI!f@B&MMj4|jG565g%vt< zN<$n)bdh}?hQc7y#pKFHAisv&ZFz+dt~x2S?fomlIP^=LzFfKzj}l?%tr?P?ZfY3y zg?9hXMS)&{epIuA-lDUXJIaYBk0g$6&5eskhIecSJ7d(@_VKRkX18_VPI_t9ghR=& zM3|W=od^iA;y) z<>B3;vg9J8c8+$9ik6o|nPFiYdB%bCJ_9l3x6kZ2Gm{@J1k{;kJoM&JUsrcORYLBd zfq1UfrHcdxg7*gDGU`--v;touRlS;C0T}UoW;_u)zE6N$9&>>!G~1ntMBzt(LE@5j z)5m1`WIFooyCPL)1O?u<*O{hL7Jwx=m=f0O{us)3XAmXre8<(j*c1vmO<5#C9pBDh z+p~h9-R2{10_e47Gp4pxLoC)ZH+a$Wu(iV1o9{Mbc@e5QaI7!CJ>^g~%H94rL)>%b z3*pvVuky^=Xaf-FnQldWzIKaE6VfRB(GowW@r=|WVTH#*64*5zv?SmGaCSMl-U;xg z`fzzpbJ6ZEfBcS2%r1)C!aq{L9nPj`t;e7!2uWTArs3&n^NxzKVWIDvaCSrt zIk^_0smwznt*cy~NY3cVDh{atD=vI+1glejLdCPEirIO9W<49T{$(j}c=vP!e-f3C zqk$hv8!Stoum4p1hBG9(h`|QTR=F$&0N(d&-`Al78;bDoP_ubp@`%Vp(>{rHDlsLe zz{*TB4&4@WIqik~kg!(0>*@>@7D3-9|1#Hc&dG2OVyv*`c|C3$rIlBFPF?X)SZ-G^ z-zyUKjNN5`a5~*rC)7HlXMc_+papp{kDK;r#Kd8%(Wk4ziXN2a#@guH)+o?6+XZur z)%YZtIBL^xa+J$}K5i=xo|5itt})W?aA#E$hj>84Ud?5r{#5waRk#DFlDP{?sOzb`KquavY)P;qQu$Da64HfE{*928yGt1ww3T(=rNh9( zy#VP3DG67Pa7RzufI2~LjQw}N(F32bp;Q;0XjZ$Dhr5RqqYyq4q2DOH?XiqO-+gtTaVzDIJcka{I^02)`V8YEhcXYD-<8dbzQG{m0e>;g{SS ziogG_7-Aiv01U{iqjaY)m?H~2zbYF_A7D~~qYbEBDR1KDjuvwq|>B5<9*1PbpzRkZ!S6c71rOV7H&sOi8 z7@iU-*3XVSsD8(hJ-X|}^LTeH*E`xq_91F6znb>c@ypo^i`VfJL5>P@xxC#ODD%KZ zx5^#CKNLGArn|y7)@(>={VfWuD+5$C&D*L*<47WET5M`cZ*ecT=2jHYulvvW)oC+_ zYl$vZEtzm$&OJqJi|bh)q-Fo5r_e^P3dx^}T7Rh1>Nslh%T0#vEOTV{8;?eWj9&&P z_gHAL^--l0g?$vc`#+4GW0N4jwq?tD*- znLAJJv)16B5D;7Q=$W(6vyo%wyw|$Z(91}0cf^A?QSE}RL5Ogp1w7UP(la^+iFvo` z{7l7FLGA8 zqO@@~Y1(d8?We8homjFae2hyHqmJ+MXT1y#Lb-!*&$)AYCB)uhfr44{@p&1BI%Jh1 zn<(dx!6}y0X4m^vw>y&Dme&NH%T0yA9Ye9K4V5CvNePN#g_j1t*z!Da7u>NfbcJml z>{)2jQUrzst4 zw+s-*$09@pa>BPYjbp~SLi)BdZ3>5yGp|q9WwVXkuL|o0$8&P1 z4)u6+*1}8b&rr1N(aB>~n`l{LG1%ByUV!_e+NrfUvke1=8W6^(%a%dyK~M}w za(Y#88ZQ z1LKI9qNmll7^v*3ZU(2WT0Y6(Cj3Cd6HbBF)EOQT{w;{3!L3h{B@B$iq72S;S(_+K zPbBV??f6RIR3AL#T6!5Yk`?0b-h_@nXo}H&C$Z*#u*)3f$O|xASO(25hD7gaZR#m^ z5km<4@A^o-akQxj40KTi7A9Ce(u#SGpxd`d^H(GSQi?NQ-nWoW=C4!ad29?g#*PyA zLxIDe!6pVLZ|A_Hbpi;)7J*ZEP?!NMdCb;YC^&ykuC0wPb11?7PFTud)RFUmXe$Z> z{f%`fkZ!Ds`Bi=(NY#~*8wD1Loxxu^XhcrZ;%t)&VoDi?mSbs5o{vztF$ zsN>G{g0Sb!<9tw4^c&>GaT$`)*G9(t!m)4O5%jQp(iPU#TL-gm&6o)^&-|u7R9Z{b z;Pk~47?js3a{wR2O&09BTZ*udH11GAosc((38IHpp2H27OOpBFH*~PDOu|PGfq-rFP1vwK1oPuPgiOW z;&Vj%2W3BSb4yxgc|2_9;S~eJo7ibevA|PmvmPtBJD0d7nl?KqaO9#GL46Rg8&B-3 zQK?^R#p$%y#hq{5xjXl;s&r`43!%r{vs?Y5Ek3+Gh5^c4Pe&+8G=>cJrJcs+DcOqy zRJ1&-MzNMW;+w!3r$6~Y(V`*qa270x#b$51q^0o#murE*{1z)8+T3_J%XawkydYfgH6YcC&*jbKVTf#ZIp(dDqsk8H z6V_OqkQ1FxzQc*jt+kuz7V)GVv^>^z%w`a8`B}#Ptnxn0-PmFMRHb`w*Bp(y9yn9n z8-;(`lMFf(8PDF&WMVMN+(#O+O|X8D&puSTXMtn;wly$3z%mlE%qV>wN6g_-q$_DK z;)TTsm1M9zUi;4^l0reY)i;3vtw=Po_8i*h9Ur5(`s>HAGmZ1a`#VWl;&~FADz_h~2#R7V2Yw=9#F}sL(wt;F>GhTDR0#Skmi~uxk$R z0+j`FNEvtav$A~MU*-7T7rZDBtRSKDT~7M8lt*-NA~&a1XAU^B(o1TvY74XY0ypyuqmE27vQo6yTN2fk?+ zvDnMyZReb&(z1869UIU*TBq|~STjFN_Xby61v@qEPx7_?XhhTON3cj3l6#6f$pEmx z2b=f(gjS*Hp|d@>1`3#CR~jH5I8U2z)jTY@k-8brk|C0As(kXM-D_hj(s$dWDZDLK zCgq_>D-E^0)3ff#omY)-jTm{070pl+!3HX04q_gxry9Q15lIy1aZ|gh>_U!1;ceda z=v<$);-AMsZu$t!(eNl>nd+epJEC2lL$O9J?$vpYE;}6_RPZPowmMZJ2qt)%v;xYa zUe&OWFC5OLROqN&wk6S37pn<&WiIUg65AiLtF@EKT&_F(V9C0a8J1v8lbJ!OoXC%3 z+HFJ8!n`pJXXv53aCg;z9U{)O%^xi4b;tcQEl#~|9H=9Efuar^BVl@-VV^Bl7Sr1; zXdFiy9y!#_)TO+#LTQr@IT@2yUJoXNMCIzJt4xzpvnrtSD773P5UCU7|PfYCZ z)|7=Umj#=o?FBF1$?Xxc;AZ_}f~MN|BCTcaxu9=7C|q~v#Snqe8my>M89aRje=EcctZ9eIScEaDdk6yAgK%!V}(Y!A+0_< z`n|tvyg0yMrZQF{uHN4-F_q03yF{-M$=A$PaX~i@M)3W&HTh4PEn@90mdGbR4fJvj zwDUt=JIF{}pWip>;4oPIB~s^2F+%Z`R$wBba9ULL98}3|Qr43($m*9m!EwC)j^q`7 z2u|snfyMX?lUwL&Wd^=6E`}2M%L?LYv7iQTZMp@)|Fb5Bde#n!7f&?`UaD(V4`cMc zSnBw^2-=u)q#zsX4ESq?TL5F0YGLXJ+~5?Bbo_b0of#ksd}+N$FH>g9V&8tSC)9T8%J|BiKc8d#XxY(JY^bji*gn~*I=PyB zbB~3;$sMDU{fuJ?wS+5(<@8hTOz)_ZZKObJqe?!iVnQd0MYB@5jWcvYshX`)+Lmu0 z9i5%Sxf;1mwOL;;W8k09raM{AR+DyHPYt$ocGww@y6JIwV(+o>&o@)#&*ls~T?=A9 z-g86ev+{O#IF7jjRB1P0+Y=$#`n!Uq?JurdUaep7FaD>RYuG1uPAKPnuvI_LEy=1MH85uRhhi8hQ!7gP!fW1(&}`K zFd(iEzg30Fd+lD70jba+qUhC+sQB_voay7~F}+S6CH(;yWddQ6V_ti--+*93i;(&+ zP601Gl_3Ce7+)qRi1(NiBl!ihS~Th!Q}Mits(- z>#LvzRNp2B2Sho|jA$^w!Z0B$(#VtV=;6FUg=qJuxRd_k5NM<11`e{s$RsaT(pH}` z*-F!3&ee4Hd3v%*~~pOVa|QfGGCl^SFT1Cga8f%SuRob@u=R$*!6 za2a?HZMLUR^GdM~%3dBsU=HP(!FUT2XHAhDCd!?l9CKBti;%&%L&pU(8w!R9@CgP4 z;-6)TWJIR}VXqLBiB7Qnb=%4y_asZOG|`im z?`K?P=jaJZ8?k#S??YvWeQua87B|5_8GV7EjOBM;=7gRA!icI7?h{K_{5&6WjJbZ|I9qf|rF>Bv+6icNp!1rY|=wbr3RtaTux@ z%+9W1|I+4ze-Jv|w0KY<%iqAT=eMc*snh|G zq1b-q63qEoOecATJKOBXHW|gZ&^R0&PE2+Ews!C9YhGC+UhdbgRa(s*`4*g+bz|CC zCaC#ix;Tk92Ue>FBTk1mn`PmhLDLsQN@q=q@UPKilg<40;t4AUcgcEkli2E|Ic;?_ z^6Np(WM3ymS%lxK$;w$7fg&AI)v>UJ}^oao~m)NSzw-0eu`_y*j~RdTPJ z<;)hOxp@YOf7?6ir{sv6$3D^X0F@|U3J@4MwNC<1rXVQgXFo~+zL)TJn^@cNMp7t~ zjb&``a=|Y1dezHZ)H`RGtTNhmj^_cQZoguTA;~3eZQmn4ywRtlk;NV48*Kba(Ph$w zkNiRMfpGx$hI)7VL(tOpJ8)D!*44tK$bMQ?5x)~aofTWoK%kWBNGk_OT1>}42^VEI z1#MP!?vbj|W3lpy0LJRc#?agG43J-JBoIN?ViV`rD8qF^r@bccvwP2(*z_Rn!(l9OuH~W zoU%AuB8!>P4xDOXJX|QSEpARGD-)sEI=x*o*0U?zjE=H-*gxN`^!{r<_V#xj_yAn7 z8icUuwW=D4CoTjDp6I@Qpu%O2w%T7^&& z*Is;WFCfAs?+3KTz(VHgXJ%tkuVOsRLVXpq|G<@)iB+32kM;a|10R}raYHSDADfKw z&(_o0cTxu8O5syqUhFWl`>OoOpM5XG$(V@utC>eVx{{MZVcKzBwN;M?Va$W%=>AZm zaW^vhKx%)q?8r9h{Xg&v=1Ld;!&H@>>Ay;b z9Gw5ddY!7(75CJM_%9iH0a734f}qg>kpM2@nsgD2Y&I?(qm)fvg&*s1lu&H(qXnsV z!<~K1C`{o;Yqfrrr4^*_FJUb?{qnMZ@$&z2e*H95lZm!{*>_O1Wzo_Y?mT|pMZfsD zF6@8$r~A|O<<>I&{G52dKkZEywX)hu((cLY>0YRM_W0cWekd($ep!6Mu0_jHwRN7Y zoaNW+s(QvgeB9mn({P;>pJ$|pckHexE~F&BZ#)J6io3#^0t!=qc)T<;uPUZWG*X_~&ORkz%{feN=yZR{L7KFNRY0_wl==V-I`g#4nP)x#ch$X6yT|rbMq+u@ycdpcS1!3yO8stpY`#n1iDU+3)a3 z@`0QPx@^)FOS5?bo%sxngN*Vaxj@n`)lye$tm-3?|tLk|BL7FE+uOVe+WrXX3* zgpaXC<>TIZ$oiY3om;f(viU?SEz$zfSQyt^=N z@TC!~qBIH{yD~+^FiCicnVpifV*SKF8;>Q6J2HqBTm@t- zAdr9*212&2q5ZIg5R9>ahMLJRV?YaKK+Zn>Ii*9@4HvT5R-#N{y=HS!un63`7~-QB z$dOc#Bl7lT&s*_W)I7QhLMjs;V|u9*rjp{=}O@@AmejI!9`W6%6(jF zb|?k9xB_Ait`nr1aZ9(<&s52#8)tDxstFW3G3rpYsB*59TK?4fhO-TNX@#9lP{Ll@ z4M9#7{_N+4OARMPjFS@6lN*rH2s3tSWTo{de|X+j6upIDDH=p1t;5+d1?8L8jjI5K z+S*9xNwOKn$`#s-esvmGG!wvPV%E_&h?`Oyp`ItEfzcjIx=J$=_axS;_e4SH$@-ut zaa7E99&nq>IA)|lG4cCO)|jqpX?c}NfKri|iTimXdS}w!l;<#L7EZf|QMo~1olaBh ze-Yypm zmv@bSu$Ed43fi?72(L&RYX6PC*=43nneMstfssP#EqttvSL z{FXS6p^;8%hpn=NlK>P#y7<~Ls--EaNa-W9BOEvOAy6kyqyK2pd|Ds^Xsz_P|5KnU zBF!q!t)6oWW1CE<@H4qvL`IIEGMlFvP5l4kDT~7vQUW!bkIN#gwxZ#(R?l|Sqr!xcPdmuwizPP8;9VP%K z&PHKn4muy2mQ(EBx=^mxifgYDSh+<#6+k0zkQRhTWfZ#vrqqmjm6iNX+9x10Y7vBA zqySi*+%}ofd!}9@RTbbOowrKDmf5<@Vv}F#@82;XJEu@2sIhoSS=ZcjJh3dZ53p%v zbbe}VI;4PWMuqDQ0~LrGRg3NL(a{|@!>-Y#ti_^-aB&_i2H4g;GUj$W%ww|0=L4ZvG7(;tf{1wG|DuXDaK_3py2XPcV5v=#OiTJps>ox5+CXu_V9Vd&m>Lg6ut7 zIUy{h{(5?h)7AruukNQ_bbot&JpAw|<8lrDsjATJISSC$@kCsqD~SAOuZ`*_4LbM? zn6t;*N{7~{0n+N;A2TGZrFkOdmDI1VJ{mhd{G$0n+&}SI4AbXKXa$ja=u>uXFmytN zO?Jav0F_~rnFHil^(1?h)M;_T7H2l;Tu!#a}0;*ucr=SX~bLO>g9>HSm!4hr0nxFhU?mG;7W6Aivf8-qPZk!mP{VW zG+X8r-r-6ug|j%CE1Jl#-Luw(g{oe*Edw216_{+VCqNHv5cm~habB<`P8uZXc|UmU zic#&Q2i%4_=txx&{mA9{LmHH(Zh=QX5R*BIEY3b>_76M_lbFB*XxL7}SmSdMZr>e~ z>6>Nz>>>`fR^L~89cHHTcS4^(<8}xp0jFfv*C3tzFG%^m<*vHR(WUR_a15U%)T+M| zX~dh@i&c=Kmb>l6vIf^4A8(*?-IbEjzgS{t2+)VR(kU#cUot#zZAw&je48H(S~lBT zxl16In${z^VB=iVd$f6={C#n=9j1{8%B@WQ9;U7%2`bF-p{kYt^n=Ye@f)6|4kxiW?=Xqo{<{u zi8$sC*xobBFCbmY8zh6j2n3J`TLizf;{!LXXGxsXly&%$IwF;6ulx{LVY*rrN<{p0 zmAzknjOi^unbM8vC{syOClA`Tf4#rII^Tc38{3nHPWsZ}k-lk(F!}$UjGfH+JEJ$znbMv<9*r!=>dG{ys$6@zGgh#?D79NHk3vgIg`RW8=n_9S`%NLRr%e!v$ZWla1>!Y(VngzYMX!0{^2qH zZsizwY0b%tMVNzPD2|;pHpAD=tSq)UYMt?InVV@LamcszA@hFmO;vy^5|C=u|iz)=)apw-;R`<8OJ4v^Ho^x z*64AtPA|^i)`};mV?*IVdqS8xVhfX-g@|@7J;0` zq!@zO)wL_Zc4{N{cUc8GFD|2zQyyx0GgJougzi=~i>6xN({04go&_{ebcjzXK9jwyqr6V4K@gWE&w98&D%}x({2L z?OsTvmc*FjQd{c(I&UL-6D$dP0ySNg@VdG$SILCl7m0JIqf1^O1ge#zH{cD{GfF}E z8@5)bh*MZwgvmSGqI1#S2+P@9)q}`j-C@*s+pi7gaeC9fP&T2SnGRk8OBqArJ7Y;f zE}LO8u&xD1f+dkAANlkLge?w`0u|I;Kp?ZE5$jKZogc#jt2;6;A17B$u`oAl-)8EIHt>7jZ4gmg65G(>;I9@nlGlU>`b{|d zafN6eq`q?`kS{J(beop!o1gzUDlwdcGf#Oh*p_y<+E`$_g1$EU(ISlSi=!X!DKv6; z{&ykU=y1g3KKr9$_ygWJ&Deox{cyr#ylcI7?qlm?33Jvsp#(TsoNjjwL)GHiEl18F z;+^Iyo81qU*XO%s67SKkC)hn^W`uhJebq;6fvw?UCL@1tJ(-k4cvfq{E1`MIJXXaM z@41LX*aM3K^RU@RKFwzFnJn zoF{8Eb?KmWed>f`Z7A;}47bAmgM2fJ5aROX4m&Xjl}-^#t@rC zhHDU(qgMAb!`^t4uT{iu_t`+P+)^QXM4B#FJ*Pk2(^%7XCK07I?-mXS`wq%sVrQNl zjJjUMc}mXaYPyGQ<6n;|8?5=HsteW-<1f98pitqvhMpI)jQPd@@bUzcCz=b9u*>aiLXv*-xwT&b@(r&1ZXL45B5Zgx6f04Zb|VjXJaKq|5llnWG{ zuVho^KyhMBa3%^bfJ6C^HbZ*QAlOL419CV1_t@hFVl!LOS+%XSk4$2UG%8kx!bmY8DKW{-E2!Le8_BkuLVTMERvd_@_zu{DaRON$flAG_`P zn(d*)Cw-Y4O+CEoThB~)6$idPZ-H+711xgA2|cug8=TIIErXdD8n~V+)55_)6U<3W z#jM3FN*WYXB6z5g3L~e$kRvo!7&P5f1cPj-8*$ez%6TaF#R|~_W77*&Rw;F}E=&g? z&!2v_ZqfWO<6X-@8@RL(T-A%n1ubb6u^gQ#$I$I#qAtSr>V?B;jM7bI2;6$_#Fc@G zBoXV$=PBa}u=LdVA=~2?;Jg=l+%P1jGbh`XG9gr*#WeXxQ?U13z!J^`JRl^g-T8>t%qA?Z>2>#vJxjN#dGxT@h~aGW&n5m z52WCJ78@5iGr6w)$iWQD+2a(!jKdR3=`1&B-6c@v_-3miF&?qJG8ayx{R^+3yBpr%+m%WI(I36b`0W3Ko8K&FY#Y= z4o3ak>}bn#9GkA~wp}_p)#2Ax8m&_OqeY3GUDPM$70w%dRfs~J)K0v^D6o)C8?U>b zvi)LBH97lPE5llkL}~=|tN|aqHfoQ?HyNN@uDs=P%D!>4rM1;!nbo@cD zTzewY<-z@2Z5xtK^s97-`Y{gkArAz3@V4kKK>L&y9Vrsv3(;Vu*;S5-?G&<{nZKO? zr0BRUhCv>=z*;CzYN<9iKQq^IfkqBX7~_VOb_Q)O$-rhjj=E&$7K3m;MCZp;;}Xh~ znU(btC~7gK{)asvtNs_fUJx9Z7_DHeVU-eHe{Lw_8+Y?<7-N*}ai;CzJ=}L3(#KlJ zMP+dZz3s0iroYF*u9&ibtW+A(rrC&nqS8`h8q}y!{ zOuqbplwn^qf%_TGu-9)_l7p)%ZIOuUOv|1nP7tws6jQG#lR3L0G2(7(P39Ik>sK#) z%&!d2kj=-21ZUCpn2$Qjsn%&yq<^^260tPa<#9sUxud zT+n8x6;cOP`s4q86t~_e$QsnXJ@S75z~+ikz`DU$-Dm(2;X6u5KBjSd%)Gn z&bno)vSQ`2xrdn;%ABO|Kh03bF&K5zzv78T(3fe+^G8?TK0kJLbYRf4yj}^Bt+5lu zCw=%lncg7HxyYe`h>w5%(0ZbOPy#Lz4^R3iZgb$^-asDP(POnXytuy}h0f7I8M;U7 zEhZJ3mIP?0@uUe>x#F1+5&O80(EZ7iXtt}USOcViu1g&;?KZ{r;+Ksm{KGdZ3s~*7 zGl$=|e-`c06!ULlkIXUua$?TpgjMT;dg4VOoXaLE3iFkxzdye9BCnf~US}7x24u>X zST@gH&76LTiais}?$ppDyyyN2xN8c zrl~tnJdQ-5N;stBUnzCdR;r5m#OYc=OgsR2c`HmAEClwX;0Qq3My1`Y^1%i;`uUss zn5fmVHSRBS@aOwimJ_h}nCfE%Ut`jh*NWfZCY}EqzQ7M*^glfS{vWg7|8Gr=;U6#b z|1E3$p9jDtXlIcxAPhc`4A3!~#9k22wVOL#=1|V#2eD%!MQY{G52FQ!o85m7Syd$$Q&OX#JDj zU#q@+#q^%P_ukKkdzWR4dFspS&q}#<)0IK%+ghJJ7pFR3SntvIjESz;_Zn|XUHNS% z-yfIXxlexf#q4~ zrLXFcO}cpQ%gSZyW`xMCC!k;6>e0>SNJM%m| z+)SegPG68}Yt2X#$(=9dWN`Eynh}myZ^+sYGM87;twtErEe6b&*gu2#7o zH<&;ObcHwZE0$ky`Wdpp@!(uTQBQ@kR|uyS>{JPoaM&G!RwSr)I|Z`?>U%QDS1K^$#e#M9VGIbTx`DZIC-#V2f^PY*YF5d>LoW9 z{eo6bTS?qzPmvQq*J5G}XC@{(E(4JoA5inbc&yhw{D+L~uP_z)5uaREy(uyYjPx){ z+O5wbADEjk^6W+S7^{I9i?UJRhHJ)-HzXYUpXPHBYrNVOMxlj)^vMu0)x&B6Z>w zw|b9Z3^)o|x5cyK2Shs+gt2A6szA%K;X=`(mRpf;9=ots|F%tW7Jf0u;_f#n!x2A9Ki&1qY%F+z?A1* zFj$z#jEHA2i4#u8M`$~mshgbwtSVL9;G$bYT=8nUS-6$l7lAxRpG#5^(P^Z{B8I_P z&L!v|G%Mt~C`-?P7)Ev^068+shNjz-u97*Y$StIpEr`-`iD7~3@$W5Pckzjk$%?CM z9J`>sLZS5X3xmMn@RQuN>FHGVzYkw1_E0SS#_PHfGni6rBnSsbgu1jU$ZAP-&ahA1 z*j(uNr0Ce9xPw(CV*$-yjD}!>EFd}^oOhk6%6qu!&cBh(wrg89hU?F+A)sR?oT$g% zP9q5I*|vH@W<$q}D7Afv{%D5}@ns1zdLsHe5-OAtWA+Gkb-oCJ@?cUlKa%UMw!GXM z)^{cy%-rdEpy2Z+54S=nj$9uoEFDNBPaY3pri6%ds`F6gCjw}b0^Q;O3iQzxT$v^HFJhXZ5ONx`KYX)1M3ii>EKOEU8d z)zzb<)0H<@ccekO&LPD*%&aBwXBAo^it7G3`y9Y56)W`8QPVmF^Myn4;sr&7jH z0M2WEB%;Kda*>Ow>J3Kb+(5ugly><<-yU@$$nL;7=UAnfJ7XU9NT4b8mRNW(|Ak(8~#?DL{;)+2`Q8%Lyd>w@CKG4>Jw&v&&KcUOg z!_{7e1qzI&o#3^Ek!-vD%h@Y!QFFb%$-icrEnwh<{-n8=Gb>6Qt4((*Ve8nS+>s)Z zUG0&wWT)7D_gS(sb4$zX;c zTe~}5d)-E7OJ3DBP>miaRSl1-v)+=O)eJdRW5<}i1K?_>IJI%@-%2GU6n?6n28oq~ zOOXHS{CT_guf3_i9)0fT0(dl1q#L@fG;==IKtSLlCZ_ zV{)YYR0ICDFyu}8{mn86-dB~v8C&m96??yNBWHavUNmOaZ5;C8C-n%())PbBA52b| z^@h~7*~zIZ00*4p)pzbVYi~m4S#*BkKiffvR8pkZX0{W!`4}Nb&(Gf`)g>{6dih-% z1jEL5r+IeQg5{sVAD`$gJQ`(}Wx&k3?e z!n+60S;mAVSL3w}-i#^`i}5bC$axU*z2Ef4HjCxj=C8U&w&tI)M(FaW)oapZQ*#=~ z{3r9G?~inTfY1?}h5wM(I2iw%fh`jYC(HlHYgk=zL+uT7>gV9q_ul~j8WcJ}CEWiS z6rnw>OUF@FkDp_niNsouUXB_NjpGLnW*qjn|BAKfOF#d(j7iG6(z?BV*1*3ObN>0e zee_jzq;$Xfa%{D`$E0uS(%2RA&m?$hTJu^E1KjCqt*b@2!S2-!EiGD@?Z=2#m-|qV{N|=Z1b9V z2?gvmc1Z}{Nm(tbuqCjeDH({?jRS-RQHUsof^*Nv=+b1_C1AwdZwvxvxk<@J8lj$W zBIM7Zz2(S(>=sToI|%FNq7?#{Tm!ZU^qY}DVm9axl1??m)UyphSbdAi{5l3IF3v3Dz_u6~a>=`^(m;Nj=+89Qi zg3W?59Kul`b08*kSYUVs6YEU3xyw)>Mk>Lt*3r6HF4*@VbSQXV3jt0^&U3VJ<)<ih zI$w?)BnVlm4#YZ?Ag_$xW$HPZ-KB(th#}~V7UG4ARE#!V#9DS}2pL3@!+s2R-(jxZ z00bw_jyRaNP|-$?nIp!T@9wgLPdR`CqO0MAVrWLw*lM5crL)>F?>WsRt|9ts8hf)$ zSvHUWuLbQ<3s0Mxryw8`VPe*8W-Tp05VA4fddpj>fDwddDsB>Z6dXTk?U9c{&0!vk zUM{O5Afafs8|?`EULK`K#M3{3O&k%A&-J2!V*N?Nz{$&@y}in#Xx#$2!!0hUX>xw6 zUzn?!P>=gp&&7bTb|7>O&xT&zx}rqaItI>(RsARnwj{}R{?sQ!dUGOFgjWp_3txS>k$F<4XBl(Jhe?2-LvcPaNx zSsQ#Lxk>7P@ml1ef`kV%kQf|V=odqjbAYw$uih*6k>VwK%a#w$t;IvUI|)51=SGyA za;bv^mI?o#rZ{?MQ?2e~Vn)JV-UePVgEm6(`{G;(w6p=iuuxV5%BqJhL|>&P$>yH< zL>4e2%s(g`!ge8{uxeWDP+PG_l>0_>-gmEFmmqddp@w&1z!mhwWJypnP*7d>K=N!nRYV!lK7|@o?mX7SrsE30D0o za|@2blv`?d0~#FM7}Ai~$`a<4n{bwv!0aAU813avAXpioy<_rgHQ$8U*t9jN=&dpoU)NF&sfE1<4%v2M@$W=h-rI`C>{^P{k0T9WQiZDwf-ZB4FT{$MrSR2r+z8JB4>IdSS0W%pnC*p0LG+{i|u=u$jX=BLwjQr`fou)oE!<@ zL&&DMSmrlBHjw`sH~!!-c5Zn{Ovlwi@Jgb;BfFXw(M5?XqZrXHPX-+CwC&)`sLS7y z^_JHVL+I)Wr`$gg356TQXVLLmM;}8&vY4eF_)V0Tzx++&Qmu(<7Nl4n5RbBzvTm)x z(h=^1Z%?vOv;JlZ8|ZrDLpE0k(FteTwX-r=pm^qWaf<7SpZz_JdEJ^kVrRpSD(#+< zp6`Cdo`#aC1f643&laW&6kX}16PG*Jw#OCHaJI_ypzy271Qz@DDh8-FjUAvb8v&^E$C+(d{=|w*RViU< zbR-cS0)h=lJ6|s`m2^u4(~-a`E1}{wy|C8fj0Rj_7T+{yV#oMSGz~x)Vahwa`!qw` zq73~2uA->LwF`pgZ!^>6tRC#EkJ6p;9HJ^QtzS5@_3P3em~*{SaE~%!Vk+&Tm%SSg z31jRv6f^BSI+}O0!W$#w*OtSWE~;5R3(|th+Req#)pNC8*UofZLMwkY9@DDKtO?z} zO`?wFuH^OEOjB(Ok}u1;oBkv0(p2HCIJt%oh9V$i)|9{SJ?tVh5_bIA%4|2KtfPC0 zyN*ZLR=d5%lHOKKT6h;pI?&J5X48M`q{6hBt-yM5=w3?d-&P)YG;ho zaOoOtu*qbHA>e(TCVow?;q926cNx|YsSWTKeLGG)px?BoCQ7OIW zf`wVK7x4xfaXJWgxX2z#F2GZU&*9}VcGGKZgeY>S+)=!WX?%zlOl|G<65EZogT#X? z3ja5ew-C7|`eP5q4P^DV$KXgJ@v|T%_|}GFV8V@-vUdSm5iigBVXdw zQDPmBcu`_4h4oG~Ij~iom$kWpixo{=L&WoPnD4@$+{k#Vqxb!1Z%S?>b4BAD-^|zI zH-B31@6vV>qIKhXM>xt?M6>?yBRCqYH}QW8f&UeqfSHl=e+=zru&3gV+8^@j=HWG{ zdnNnt2?g8&x7jka6M}bIohNYI=--tSi>~da!63kRtrSffH15E?-)$AAz(ZTp8w_cOF{hJVXN((6-dgYXabY&(LNL9#hcK4G)O{oHi5ARsStN2Om$W&#)CG$s76%h>Afy= zwT&EccQZ)nR0MPoT;LcR;nY`no5#XVk??4BM%y6jUoSQkbBz|sNCM*1bHXzG9CH15 z^51TNr=5j!6M#ovATil$+jtkN(GjQR*}CN2i#5}f_I#s{&6qR@nrPF&v5WsX^GH}3`(@(@;xo?KO| zh=}`?{&i)F=B5K!%w{2`hZ^JFQnMAf?U6*;qa#feYy*7-tJaz&oKGx?$%Zk>?hw-N zW%+hX42z|_Dlk1cDeFjs8wpcw+%Zwr$(CZQEV8ZQHhut}ffQZF_3pnKf(9n)6}*h|G+LeB+5JauTi^Ct?>$?gXnL zGb7Ro-a)Wy9SL7ADJ_xEeES|#dUI+iPX0WpmkUvQ6!)WWiz0)O`5P2cM*@+##Mbub z;gPfiu<eLoNk>SkyGWyJ=@O;AMo#Z~yjXAvy)UeeWisecf3)m5_ z|5`lG(13XBg5?cPi-cNqUl~e`ym82a>14v^y{*pT^5#7oogdZM*rrUa31D4vy~&p( z#nMf@$!6}zeOs7y&#Om31T#ZZa;InrV(hom*RYwHf^0{0~rl|z_9nLP9g zz|V9VlV{vjo7tiLk2^^5sO=eY>Ex7KgV(bk^1&_No{V74mCDyL)jLQo0gr_C3LTj3 z=^)K{;)j&s82eY*HBZb8CusyIlods*N^V1zj-c~udY*C<4x21+zI;m@YH2bk+};ZL zVvn+BonUgrUC(`gFpfk^h1#nhsFG`wcU?i&lj!5%5?C@AjcGtwzD21B0`JU)%QX?< zD)hQ6eNeolILkiGQe|8z8yF2+;0pP#7OhgOI2}DRko&~vT-L->OBD7QANto)v$Mt= zW;(y#P&7ttmzJT@6qiku{m4J#>d1`KAr`nqCaI)s8u{-RK|OC$~>M%6zVaO~olv9ON{`SjO5;6nHk!tzS_T zdI_o?Xc;PC@krb#H+;0^?1l3htW5=c*HHJknT4CWhQbKxQwKB}B7{L!3yBMQ7|hl< zl!Aszqk+!^*WKXgVn#pu{VWyFTI@931cy%5jc^<|Krty-k&5d%TZRIcDC`rDgVtVT zf!?mfnHw8zpuc}7|0t8m#efeS$ST$eMcatW;P_eap^28W{XEpU_iNZY9nYS1oc#K=0I@A-rEdr${r7)|MvP!K@ zbDo8`BLE3eMZXkNq~Abw3ePGdLfH+FO#BsNJ{h_6;5sT(>2?EE&(cSwv!5O#+&75ck zfr;1&S}w0tvvn(8M=9w?OsVVlrGho}&b?TJORAOZn4t$LI&TAXj>v|)1r0F{DlWPT z-)Y%%9cHTf;^x=~8`rA(lef8vUiz2EiUXy&dt_qJ7*<2l(ail_+-^4zm_a0t1EE6Z9OpGGLW-so*1^Bv?7Yk$bxuEa)TY@M3X+G_QV21I&Kw- z>xW-W=idnRcyGnuvzwt_MNXy2kX0Tg`h9mfwAMVx4GqUs)!B-bM%;MD;ll~_roCIa z$-wg+p>hC2y|0t!gI-(-&0uZKj9@1ca{) zhKDuD#B>|01Ld`BpIv{niQT5F{(J=SI@|E^maf6lr{J~zJ^S*+^tkYK7$hqlR+J-^M_7mUj!nQjS8@uuuWhz{3A+LdvckUS6%aokjp35xC)G`+Q)W_JU z!w~=_E<$RLM`=k+?o*Lo)I>UjRBqQnpcYNw~R7SZGtgQER1it=!wVdANmd zGE{UvsNz~9g8{T~zxJLQo05RL$2?2NbVbk&p<)J_ghIHbmP74lZ&>;y0kLGOAJ-gf zA16V@sTL!Z)aF>l)Ce;ON`J6lxj6}WUHImNI1tIrD(}G?bo0^v9Vp)OuV3(jCt_5+ z;rVOJ>dRg0l5RWpBkLMT!rn$CsdwUWUXe_RK>gD?TcXNd-b2=`JB*!rXV}9%!7FIF z+AvBy$2ozEasqvl$&k$w^*PP3<~=ZFZLP{v{@p{RtW3HA)8Z1!_zo4Jw&}6;MS`nb zOa=w1_1HzsP}R**_-#G;2K(N0`}#iU9$0lkqRc#dqN#;4UnBFJG`4$o=)MQV&I%%? z5K0*T$w>Cw8njRK)BHt@YPieU-Feg*2I}SZiXymey!R{%39zSV*WcPf}QPu2)RRAW3j(Z#Q(`2UukrKpqw)ZAQ7|)zM~x~T!b-_`!Y>W} zNUbS^v|8Ku$F^a+jtBa{ZUxh z@>X_+S&PqAv3b6&o`-MPMdkjx5STaPN5^$kbDBPOpmQ@`Zed{Z&HE7d9e0l9?{65% zr{@!l2A%VUsp|RmxyaI=+=`(mP(JO%0sNnR!02h2BSozCkPiD-U051Na-~1>^+|m` z(?=!6-O+Lvsh{@+Q<+MGvSA+=nfC`7qD6a_wd4ET_t}%eAz>ZolTz*_pI*t3^l5%% zKStjbJke|&w$t`m9_CDReHtycFN3--!L)S8d03kKeEaa`Y6Idh`(xrqw$8gfIab?<4BNEFR&Et4Q zDcIL>;>9S*GEae^14p=z%N!ucyN(VXs$3ywu3Cp$WfUQ6=s6HiHzWq_W{qDlP9gHa z2ccn%?Gf7xIwC716ZSYTf@JoND_V+F-?3w~Ho0Yi|2YbyE9*Nwii~^ACEKeH(ZUC8yxGpNFaBYxatt?Dm~X?T9`b zF#VQ#n8Rkci_7(JD|BkGTB)%ZS~aG}#QowUr78f4Ii;!LNm04ZO0*y>(yWgsdfv%O zRX}%erO6>K##dIYFyBFPUu2%!n*%`RK?dCxJxi-dmQH79vc8KeofMbjggf|L?Mopr zTUvGNAoBs8B92q&`*$ImzhCx(`#cqE0B9RWkgIlKn;N+OXSjYlEra5Gi1FL~)M14I z`edaXp?TnR1O;OMB+32WVPzf&1I*u5sV{L3R z-L}!XTmb@iTxL=-lH;fJ$xmJoYFa6?699?+SMB`mlr0)_>GKe=Z}A-3Akv;S24 zk+ua)P`0XK@;KDOIK)4}gvhsJtQ%X}&KOl!QfNBbUWvleaMs|TC7u8ER%)@U;Aav7 zmA>w;&G!=$Nw`FDyp6s>LAF$kM?OxNDiW7p)&Q9W44dw8q0nW^C49sb>W5GBjx|;* znhbA`C*b=fSf!}G-_`^%cp;>v$f~Vq&jGRG#)^~nkr~4o;Xd=gn#36CFUsMf&l4~b z6Shq&Wz}BEb1hQIZskOn1#?8^j)&_$CcDllTVfWLY5vXq1Jgow;ylJ^Gg+QjQjjuM zp=Ti}#v{puB@?xU69D4$ZU-PNaQ9^*qzxNmBOd{B4tmVN8fqX1jRLhFPKvT$j(bno z(j?2tE8NR;^MM>0NK$61q4JPrm$S-4fFr3YM}82L`@Pa%zaY-R zIK;liQ{P~*%9LTk3^HRpMMIe-i9sp5NcO^UrZT3z?_L2Y5cEdcJMC2E$_rS z(2zN4t~IF9A|xWp0~7=nTjzDaHy!zI@W^vnjrkCw8^Gr%WmPu>9=~iLEZ%cG>pgbY zp~-$^O2W-tI_{&&!XCQ7N&oIi$OA%lXT@rPub_~}>^o)=A>2XEz9(jxfP;+u{4t!a zj3`2@z0AUe2_|X2;~&SGZbuf?p2MysxJY(un?bv2kveSp(F|l(s^Ma`>*{1ntiMrQ z(26SQkVL3Yr?vn&Er*K^gfkH31}h0x=LRm5c#jl|;o12Tn^^nhbv-R`RWXiZr5EZa zG%IY!csl_+%NAz!ZW zBWyEWmTgwvMiP-XkR~~~wZ!1EA z4h~xa*ed&aH(OhSN;S&uf7eJ+o&R`hz=hizL??RG&FyoIS8u=D>xc`YjPzCwUxd_F zv2?_zdLIB**61kr-<|inN{Bj7Jap)x96(5S;mDVGodP%P$Hrs^ zQcQDBaBN_C7aa^>H9}4eRCpoPD;n3=)kauag!up68#ctl8TN-hLAg1^$T)0AE=OnO z@d!iv)VMfBtI_-$GlEw-fQ!7~+&)=Xvb`Hy&+i=3awe#TAwN2NFpRB-A3{ZCOOMR^ zU|DL;Cr96+VPs#h7+O}093c^C%yl|60`TOs0}lMY0nV1u|N8(> zR~^3=o;ozPGB1hyxM$1{_s-rE*8f#+jWtv5<81N7=&aeaE1USMow*j6pc_ZJOOI;S z^ZiHh>Vb`$A6-nRUe9-U_k#-lSq+%3`4fk1069L1HNtRcLDOm_)OyQadrt+J@gfC^&@~MfOL9=vAX27CGk@tdfRSa zI4N2i46m;WHSLujg+j^wLP>bRgS^oVoVd zgE)iD$hf~@`)C`341{TO0)_ocz+pVUM0AA;nU>S7?!}5ewjW4OO;#d4&PwSU`w00g z=Km>)9VgXn4iK&Re~$bnbNX2Rmx`G4zw|K}|EG_E)e%cQ!uX`Ei#hrEU`aeBYeum+8Yb*!2B8A3Uz~jU>5AyKUw9 z@}PFXN73&+9(><4*;B^I@7{R6L2Sj9y?Ia`RCPv$<<;nZKOEqf&4N=Gz&t?tDsAO>?dLppq11Ugz z<=u9OaO@A4KPv*0^MAPu%i$B!*0LZbyU~%K>~iak>b6wV^AWj*}W0~N1FfOXK}E98bQC%AJsO%ezxhQ$akH$yWBi&L6CB=MI^ zXcvad`uq273>pUqw0_i@MJ2$($k-{!uJ=A^G8{;lD(co5FZ7aqJq&23oQ~aDDK(z^ zJkTU6ON&#!L%vmWvEo(|42F%F0`DIW!syDqUCL38rX>Ja_E96Ruqa3FdzJOhS-70M z4X`epu=7eq#w&^?HsGso9~`Kc5(CydEN;V&edPKn07d#^KVyChCHdf2zA(9Yc}yjD zI);{UMXwcEXse{+w)=Fc?a0dlUc5D#)kgGqy!d}+K!1_g^wPV^}9)0oX5fA0n` zLFAnnK94pd1^m=p(-Vvg4l|wzJ{YDv;ZeU*45F?0dYS4; zSV4xstx=bVTyAkgL2)4UOoDQ@C_$ds4sy6>B3vyCGce1E@Mb-_zAi;7$1B=$XC zY>RCX3;_p(euoFW{lC05I+T9syc9F6?s)VH2#4UycK;XopHDetj zsPvIHhRKQ~+|{AmFo>tDF-c-|*hz*o5h>bN*EK%~mn=WDrNp*b%pw?)yCpiaG<7IO z=hTzDqBG>;S%34K?i`C`B&~E4;|=juP^C2*;V)K8m!lYiDeokC9>`euDsnepOti+d z{>WX3(O#pbY@?+x!bfr`q<$cEr%9EDua+O?Fk&y*Bd37Jnv^3&91E&dV=?x%@GBm{ zozZcMAv-WI9oY$+=5&g~&#+MefK+ei^H5&%yyQm)8Vsc0n{;?0msegQ+hFlK=Cz;) zA~#r`i92koWNf2^m<*!zODB`R=XA00RZ%W&zZ#@HoD39%=TLT*PLz zDkIr!CS{!)RU@MWQw}J>2ub|6{-ML$BNa&eY$-ZX&{~-O1Sph&;gqh3$mF=FI@l4Y zOFnJo{YV)sPK6@;B#o=~!pMQD-@YfM)g4FvkZvrS+3hB*n)Fa3;@!u)Jk4qe0w+0O zgK%9hfM;=i(+FPd7p#@0M{HG}Y{wE_W3*6uJucZU8H1~?+F}dePsRGOEQ@@LM5)Ds zsSCvUgfWMvHN}Q_*ZoDR73o3A*;7g=ff zRoMQIkG+aw0}iJDg~dg5J=%rRQaizNT^ZaG<ks%p^Qv}c5P$D9ITY>Vur zizMG-;|Oo&BJr}_{)(RH^p0V!ctGSKH4YgAjeL_p*^p_1FDU#Yz;#T2BEVt^5Kvd zn7_fk3LQP`3P0vMgy^wYuy0K$e@u?p8u&!QV{i$+Ap(Df!_1d&_}=fRFdIm0+3@{Tqo9;&i`o(p*sXIikg z)T4|F1xYA|;*wRJcquYoMpRXx&DB(MaM|l{WV4zzSVI|$+GtPP5$aqIrX3XE4h18_ zJ!&Q1h?V1ujk|87pLfrhAh=_$XK7h+)GqB)a+;cEGv5oMJvMx*o6}^sSNLczWwA~c zfG5lpGgJaP&n`lLzIqK8vnF=eu%c^Dnsy+lrv;lHBi1}a1ulJ-?SItjQf;}r8e)n9a2ebw+ye=az8=vwjnB>$MONVc`g&<1Q>uMFW-*^H9b| z$pE+DwpAOIg5;pSUPzsTY3_MEZ9dcspI$9(^mD2Y6wA55L#B0eHfZ=Er_ zT(Os0eVos?h0#NuKgGM`q&^CX(=nAZ?t^t$NWK&h!5CuVc4zdL$1ANXU)9WH0HA3> zkPSiEPTowzSvIj*Oc80cNtV)wEHpg)n__~Tb;tn?kYh)nlWroA^&W3^Rm0$rqbFKu zEtOwW0dJ$*lZo)iXsHjirR*!Ts}oI&q3n?g@RXqrS@~v~RD8S)Oj$6{BFww&f-b-t zd6=E-m@^Bgm)&c+m>yGcbF;kPa6J@V2(YN-srqZVXV-b@>f2+MrR3h>PUt?)LK!o- zzmr)8_RuMrXYmNFIXsD_kW*6qiHf3On{K(`p9NJr9FkYSSpc}^a$Zb8lu%I)!(Kb3zNMAw7&Y_eL#w)%{!jO>ou3B51sz{ z=z7SV6i1qKHNi2oD5FS6pHj9Mf-OzH$%#??fJ-g#J)FLo?I~0Ed~+1F{gIXK@>zH; z4r}MQ-CI=|_pGn}_0QHCCh7z%nEd|hHyQJN?{{;gv-ZDL(EpWZ!NkV-KRk<+-*_}| zN6n1-B>bhw4Y)x&L_COu+o-D`l$Wi35_N6o4!qhqH^T>0_m!0b7e(m^&eHOIg%h>+MPphAOAC6H* zp5Mpz_dERmv&!~$y4tel!m#mj#ZR7-P5lFwclT-9NLTdj2zP|Iq`9(^JpJ?ay<+BM zI8+>nw+yzEpI8%r^rQBD=Qe+$fvE8hW1h2^YybDFN0xI_zynKHZ%Z@eCAz5Yp`loS zRA)0AQVwKF)#7qh^qptBwI5l&Tux2y_wy|vr$2l}RXkj+#71?Lf%A2nLQK+%WVMo$H>H7yco*BhXn2*77qHJ&h!w?QieNhYMc z9lJZM#daWchtHt&%8J@`wd!7B8!JFUM{J+!kAQ86L?WgaZ4umR^U8G4NP^efReIh% zS^!?2g?Z`Mr2sY(1%i`d7;jGj;$P7H-=mYA7(ujQD6R*;yF3uLfc{TEnSw#TH}G;{ z)`1|X@5wTWoV|eO4O1Zk+UWj;8&yP`u12lQ-YuKM`8fYwbd{n={gnrTyVSt?xWa}n zhs9L*ISN{)Lz zSU?Ha#5-)ggrzN4*IP+o6VqRS1qI8U1)k1m5~o}Xe(A-_Eg|aS9V*U zK*MugaatJ=>D??*9n`q{DCf17V|5ebBCA_d=cs6V5~PZ87iuT{JNee=YR+SGX2=SKIlFz@?t_GK5n#(X|d^UC}Av3f1iU^gk1WixV4r-MvzfiCGRMgdAYC zq3#|*MJdhJZ1Z+z{d+6g-t50VH};YsXWS(kZQS^B2Si zPjpcs4NozAhXH8(oA7TU`q$)|GiaZzrqfM zRs2Fwn8_OUg!#xS=Z;CfC)&6m7S||*e2UY>5U7$yaVVLAP|b)4=*OB(DeO2Y3`XU;Jj@6K@T@hGy7>RXjUBeZddJYt+!-qk`g`LoxP z*AF*nIMLUM@4Ct6H=(ZBRg=ur0J9!9kJ$74oJWq!cDOY{c#`iESuPdxz&Ar>a5gyj z6j@z$5mZqJ3F80qDONTR4)oEdvK<;_6dME%e{$-tTC1+MAcI{=5w>r@)0AO@>dmK1m_JV`et7BfR;7L zT2a^}Yqassf}{sG?h(7%X;8J`wejJ5Ty~>0v}P%AAp}rZRAx5e^9bwO>QwFnA|-E$ za90cu#uy$}9G-_l8<(q!$NnnjdGN3+qnDUsEGSLSWQMsY@nz{2P%6UKK)a(-zU}@T zBm|9$6Ra9v%W`fNII&273tXD1&gPtg`F}KifD*V+Q}Ic0H$|+L5Dico&8$O)fx!OE ze0}{|B{$$u6-n0_*(KMME``+CE;jinmm{WES47=KN=}gioGd3XgCJL~E?kq> z7Q|3N3^jV>_a5^Ffb=ifB;N^RsXnAqV{?^D&ZH|Uif_CiKKYS0poi`)7F$nMU~3j7 zT-~&c^EWPlo@@n@5C{XyK3)#sDuXuD>CP^TXy?cq^@_-Y= zgKhqcu-MY0xlq^$A=sI>Iwa5Mszn`o0MyC3d*y9nnEu)?=jv{P5^q(d@c#aUgavwu zy_W(V+xGU5uI{};-aZe_G7O=IKoh&eit|y|fYEqRkmzG5v{MaeV!7R7OoxGqdJ;1l z{7Yx;E6EWI&qp!9Hq3*n8V-k~P!IEprGyV&es zo4(6FD!D%6njX5@;$g}xW~v^y;7}-E;NE?sNE{a~z%; zXv=>_OTb?2xx|PJ-RrM;%{#85k&eDk>TtqL7Q=NKG}mmqg@C{(G5_kQ?2#>){#%_v zOe^duYyW;WDCn)qGO)wGcj=MG*U>L&{?Ix1&O68rdTTd)jQlslE#5!4_50_sx1psG zE-;qu&1G`8!uV?+3$I=#GN$H`^FiqkV%*o=STfb--cv{>H>~oG-x_$E_{uT38^E*Z zU!0Z4g#a}KX64x=uLJ5$(7OJfj!KWQHHR-|2Qs>f;|sk0vxO3+CWUs?Kh;iWeA}^8 z7@oxE|9m^mV6t9(lfyDuc1gH3#;m9Wx*%*Eb%vI&>kJO~7N=o3-ms z#shaK`f<%YpNrPk4yGe~VdcQFybp3f(d8CFa(wF4jL8Y2p1WfvjI5+yJ7Ul7+#QBz z>i2b4!Gvyux}*5o3HbUgInjLmRsDusO2Qa=VqS$eGp?kPeg%w!nUD4bElBgn5TwL<^#0~l% z%?bWLlFy0zt%q0lufG@QYP`RDKK?_q(S}X<(c_cR*vY0fS0BCD|K1QrYAo9M>G(YO z-S))< zlU?`o{{As!XG+P2{>;G^DwTq(kUG=keR^Y43yHyTjPbx~W^p&G+1s?H*Wj&1KGQKBX7(mjE!P1)Sos!y|A;o8|IomEF=aQBD)`)j`ugr z2k`peb101%NLwFX)!e&;Wp`w)b=0QFV@ww}%Hndrp-QyLe%gpPh+en8v_5yrCz#gs zH9JCZ=VH|)4a%C7)W?5hWjt0&g*}^@<+zTHm!hGRi5JSj!u>PtDmDUMM|;i$qe}`d zRnt&dvW=>3%%%BKEpaX9F`{(8#%I#M^Pl79%~KjgSYW`fR&8mF>lCzBJCA8(v`sN7 zauM0eia^c+siT~|JbjnOxW_PL0xOwE=g(Tnu~bPiS2-n1;u9?9zbE^`plx`jkr>iz zshMv0%CPe*yQcrANL|IA3d|rPUKNN7auD7RQh_u$y|T277@;NYUYN@b>Ijj^erXDA zV0xy-jE5BrZN7Q3YY9V*{fyhWC)I|}Nfo(&Z`q>MbwqDK~pw?%rm#hCc%D3KkHgh;OXZ z@-vWFR!d1%?UBgurfMe2=n|ws`b^xyM6)!Py`&8U^I5uiqO}A)EzdU`knwUN#+{yr#uxmaraf!5Eqjg)(Qz_3~qlvl^{=T#p%KqqQ zs&~8I;{F)O5p)8yCxh`4__Cs1EEH&~i@(vpc$SPlZ)kZqIju-v*!{7TMB&_3e}YFv zGp~wF={S=1$U=jTA>1ioQ`}=45k{JjGKyEzPg)v)oaN{XFba@Ma-wKD(}<%9gZk7b$e~xQG9Drm@>#=bfBI*y7Gy zJ&gNNfh#GpwEHh1wVPh0>80#W*x`=PYNjodIOvnEy?Ln$YGFGdEqbneykR3{()|21 z8(&z`G6Ve=l%Q=YTv_i7TAcP%R?M226r+Q7mp|!iS+jZ-#q`}zz_N^|9NEX6yItzH zF6Q2tqr@P?U7bGxY<~V|++31rbROT!U=r=z&(sNT8FWSW7r>i!*k)+YNX!DT@1tb+ z1C_h(e`DIW?n!^@LNKH^Uur%9;Y$-(OWuqPH*&sz#i)>B`V5nfaR09$O!up3s}wL= z94f%a?#5E1U?1WuxHZUk-cw1ldQ)zm1^w6(tIoVyUuErGD{~$l-Ps46(}2Y}OM6@p zZ;@qFVWC_zWGTzD6E&URro!aacmIf^pOV~icFN4D$xiiNYh~xmQ96ysc;YZO-m|jd zG+vamwS`t2?@x9n?ke{tU5sIv z8e*twwpvEDW?uxnL;!$UJ2sp69E_Jnnr4otohrQycyJbtJyyTm0P>D%*?VJ%+C))5 zTq}c#1w(6+PvUxOXKglPNUhc*D=yg}Dy)W~4zyNfRFwSlAs2#RsmZ*qqu}kHgXoHa zvHB?@3HPCu#T-qxH|Etd@=YP#M#2E)>hG&d;wdD=#wZy}r`Tck z4sB(w_K+#=ol>Htp_MWSJ@!7H$f>86yX-sjoUGf`?Yvqh+Jq`(vZg7tIzvJ=$0{;V5& zRMGUrs9{UgIF=RI=SZrPe=NS!U-!wc^d&qZ6uQkwz20fj>e%b43T%8Xh1scrE}tz_ zPCd8cwGNTEnVcJ%pEm{+_r1B)o3{P|J-EmzNZ;&}N$8{@4%}#e;uax9a(J5?anuog z!R>J%%AQ=+uL;{pSX5x3os^;bv1&euxsoPr;%+11BfN+L5`@eoiXlBRSf7fFlfl*+ z%TSEL{inFU?{ZMH6jvF@nkJ>jiyAz&FIyXJrxe!LVtW{VkfaxQXmeIgB-%WH%-gqq zGkc1F5ySuQnXLYKsgG*C_1tMB7;`>%c{DynP&|~j)2327Hn7&tGqT89yO_bbnXYR5 zrV`hmVg0}`fL+ioNW(cpmBevlU z8btj!0ng~(I)5<{y|OXXG%~**lE`9;nBix@{(shSzc;RTip@T37qY1QJfqB_2yZCu z_4`r-@+MAp!ftk2w~i0ner(aN+^Y7`+*EV@wsau68EAr>H+BpiVST8=2_Vnyz7cGfr zRd@jeE1#!cMEm-R1(!4P?X{&{P_@|}G;0oc z@f>D?0rsVNvGdp#pXx8Ft3J+v79Qq<+rrNS%XTWc8^g|vaRZ@NC@ULOW~(5It;WnK zWn;BDJh=(l2<230r%NyZ4#`adV8}*GP^5A*AuabW!*Day;;dI@7)5y+NO(dFM(&h5 z<{+J-^f^4(4 zWoML0)k!}}Mpseu@WfiW1(z?j!0pTtmeRwSejtjEIvbuvs4kAl0$H373+7J*XKHyG zU}(?=*sBtgavHJMuL)S5{AP6p zEnDKf)$RZFG@n+Nm;!C?n)}P*=!5^rDw0=Si_y_#S014H@No(auNK1kTZ^x|R}oMy zlmePQ46zjDRpuf~I4yZ=cv_+1PzVr?oKq^{+LXQzgMpbx@z2pdvHsi_-0uSt#8LrXrSL z!#uGKhmkZc(N%_Q zzaG;kgt9<9$CZ~Nrm|=$+PU&s(VOClM1&(pM0+8<-~T>4HQmv?!3&%>4Xw4ZTcte* zip>enB5zP-ox5+rad(|r+nE?2LjJIUNd;cqf0=ayZOu=XmH-wg?YXW2F+AuB8#S$D z$)k-$FpgA6_ZM=Fy%UjPJ2=g`93UF;V`hB)F@S`NM}^OL0<26psB5kv)t*4I8^<47 ziC_j>rTPHEG;1n^ij=@FWpSza&J-PrRsf{}l_iI)LdNhNv7Gw+!310o7j*?ov7*Kc z1wbU}d05Tv7MRTmQYU1I=zU9%VFb&1=PHC>)7|qz=fdK@{=p<;|WMwA_xI zJKGx{r*3Pl5qA4>XPuAzwIYJJqPv+LH8I6#-|*ofXA}AF6vD+=F*T_ZFjF6)zNpjn zaGdHQ4XY#f8%z30*aG1}ZVX143~Qi8_H+~GRVm# zKkfw5vw{h9oSyQ6RKq%uP15cP zAnxgrYR)`Vk~~l)^wpyuU&eNqX6XDxv|ZW_zV4IgMo3O~Y+>(-77uSa#Q_%=7;gYe zof-oW9uc@yuV{w96|wlQYq@8J9^=Te+6@D8=n@I+@CnFt&teaR9{ zm*ClX?>^iWhaL%r-~#4^>28EhTIXU$PN=|tYI)sF)JcVXa{`T<&aJxF>Qq2#v@`g@ zmk^+KMx#h!jh+&u{}dEgW}ABz?0edB(L*9hZSQXJn%6Fj_*#?TVov>V%#_ix8i#2& zp%hC=J<=j#?S8DPehjm9hajwq5(Yc@o~z=QvlTHrr<*$IuQ5D`J5BwFXl0Hx;b0FG z8R|R#MnY4_ix~2X@~)~p@pK`hms|_$JNkhU)IEYyrT&&IUnM7DN|}P5GwFIY9&xZp zdFJM>r?et=Xc=2Z7s>zpa;+csdFDhojtvZBK^IpPs5Y*6J% z|Fs*cmwfzhGR>@0J~K2W-y?^*Q)|fL|=W-($@GH}JdJYW*MJ_xMG;SR$fQ zY3(}SP$jK8q;PaZe0<_2N>Al&L7GJx#zWSl<4XEYBWuIylrh=ZPjom?_GXo%H*a~;tI^W zz0<3ut9IxLcnUi$+-1-1ck29T$NZ$b>wWz+n!wr zYp|Y%WUpHMDoyTLE`vWhnDA0erzM(gYiJgVqJrI~JaWbb+UjF=ZdqK)Sl`mT*3-LG z!!8i^9KBveC6nHSS|}npvb_1f7<;GoOv7#6HmVpETNT^3Z95g)wrwY0Y}>YN+qSW5 z>^%?mTGu$32k&2a-ge!+_jcF9N`W-gdUZ-CYfP_tG^(cUl-x%t7B&-Hg0h`T;0Q&= zQo3FKT4Kv6i*mirZwPEsRu~-yweMA>p>ADr(~2QTGOc!TQ7N+>>i6o-_R4BATV_XL z*h4bo6x0_3@wBlF6hg&9AXdZ8Pzd#Bo7(AhdDZeF-J~A}kt!ZF5DwOj_QHj7b(fGP%R@T{aM#dk(|x`9@OKdS$1 zT->dZJArYkxdjwGYxF*!pPJ~{L%?|h!HW4ivu(alh0z!=DzcRZqj~SoG{UKJmMtFP z($5OJ5=sMfbD>JNIeM_rNqwe}I31KYD|q-XL@ro7ZGm!SZY`VJCQYu&{}3@tJCpr1 zvOTYIFnZ1!fCdnAH9X{n;Ng})VFg99-nQ;zcEVDxr;b+0!}!2WGYD?V%6;W$ky#4@ zm5sWPN$nrpoGSmqcHvzLuPVuxQ5T~1(8j%(^<8<;Y+{WxbJ+hu{)-(*NWx>IO`q@0OB;6(IuBxUZ zLa~)|NrcqULRb#Y^|`v|rzdjB(TJ_2E=oTbO9#7GQj!OjUlDSx&%GYFPC zgZWLbw;E432ouwA4GUl4Wsag)78&A7tknzHw`_2ku3~sKSk|bbh;uywd_gTK+AoPZ z&@^5y?o|k?VQ{xU$H_*@8?>2rr7s$VTNj7=f?%5VneQIG#dF#9G9@Y%qgAmrm@4#2~f>b3kiG+E#HHKXzxO zVnE#vPQIHRw|iSd0^Ry|kNRw7+sc?AUe6U_e<8wej@D3OzRkH%ApIezrKje`MoNPL z!EXDTS`Tzg@kO8@ligcjy{gxAIO_?+@4c)|8niw>IUU}aYoly2EHg7D=bnQcvWR+$ z{V4AX3%vw1qJ&4hW;WO~1$;0mE_se|y(4(LoXm%pk_aW4YK5$7CV#=2e5irT1btgF z2m9}`>Qab&fkTh%Gi{1IW~`Jc!WP_fkZl<3V>e}idEpc@y^o3DJV{84_|7-Fns^+U z2*UBYuML!mRa618SLg6}g*;>egw$Hgl8Ek_=q>0S0IBRuOZAQdm`1lPmHrLWOSsDc z##!r1&W4gmb$1EzcTAYvtrb6rMCr6VB%Y#bdKF41YxsAc19(S9A7B?iW-st)x44cZ z)5M7%4*aW`Up8G4dt}<9=pb0gwzKqE=%bzCbd*Eta&F| zzJznIJfqVpgT?B7K}xaf2HBZ+qj%g@rJ3|RlwF*j5Kxxp%Il=K{dPMH)$Qklle^^W z(s&&8d&C`&$u(me+e!PR4AZaIxf*o2X01nB5f#Rf0PlAVx+x~pO>hf9N&{=35rhQ# zk7SuV?o%ow*u#5Z{bW5@P ztXB3Z!IP4VrIb#;A@k9qD`dOe={X$WV9Yc&O|^an?7!WiM*pb!BA9m+IX}2_omT=csH{g>*Z@YPmYs6 z*jGHcyZYwacEuU>q$37vh-{3w8W`eED%I=gb8Lud5Z6s zqb!HtOpI@5#FxH$xMZw-_I1D{2eX21JRxz5e^N5GD`Ug=H9yG&zqK=|>}k=IU&)8(m`;be@hL>%91P88boA{mwm@_)w+8 zw9~e7zcKd+o-J)fXpu{MxEXirFjmIMzs%SM;wG7oiM;{_SHe4x__3CN3*YzZ{vqSI zvG~cTBt(`nEKCZ509x7bY>53qHp;=oRVKRsz}?z3OILM(!XSHX)V!f2i8@`JB5(771t4P3_un%bN=S0pmBxZ zqnXZd6z2bt?d*Ll4wNgB1LcesxTc$5T87kTKjEEk-pRBQ`T?F_yyjg0WnX4e*wP65 z!%IFczF0rc_HP#23+2{TjPvuuodg>6x(4Z)`;9}l;)Z?*n0GSmiEu}a<4UKnl0d?! zpUC@D(e|9R8ci}}d%d?K8>3g;$J+(!%7yp#P3OXwuTU|6FV<0I{@t-fHZ*Cr=PIc1 zEx3{${yd@g4R#EaaPi;J_J1dkU}b0f|D$b_X4^DT8{+@FAz{I0i}V`>qZW=`%Z+is ze_E!qPt?b|fwq1%w2;9HmiZkZR;NCqCT98W&A6cWlTNWlF~oSnxaC^`>RXkg$F|cW z*FeP~{gW+AI%y-Jl#%+cxbDy}Q^@7>v*zq(fi6^edB^vi;p>jhhH*kW#h@6!Ms#a+ zO_=M;?eoB@{^iN=jY~(iIgJxbH&wl7-htsZ?cpeg@0)c^vF2ZIot&p(ugY5A_`CZe z!cW!|2{14jiedL4ED;{*g)8e3=0(d99Q=rb2S{Es)hxVv@`tSUzuLMAYC9NDz1ueS zf9G>*xL-o$JSY^%~%0p0C3paX7GRc2=$Jd?94Q0l04+n?AJ83yek-*QP_eBc(s%^2PX-RtF>o6nMq&$ndH|+s8_{9J>_IUZ1<0(H1@n zH!sMwx{?HC(##w4{zu4^2$-SaCtO3fsprpK2V?aK{R7jnSPAo}Cz&719||fBsi4t_ z9;fAAslAPt0*JIf2LcpX(x`HcMg4_YRgs#~8!%?v7^0{5(cghHv6nz30o!SlPF`U#qHpMKU`{t!U2 zSzR#V&#L<2*ddrde9W3CW@a7Dl13E-E3bDO9jj*|+Xxiwdx6!~TKuYSw2A}0jXg#U z8lW*9rfs0`*{w9uR-5kLRmxjdn|<`pT}l;(G$%#|ISDzaFiwWAPjhfje&)sq`#9ei zN@~!2JN2VYN6AhRGQz5xF|csu>Q2|{w?gYkc;g~6M68aA5=Dr*Ebu2pX`?jiNdm6x zknCHmULQ2zyy(FK59G}8LL#nZutbkJ>m2yw=SyFYVS9Ip1_3B%M&318va<>$(>=im zwR06>Tx9{n>687XUoQbl5s(J1#|^sz1EiI*D_*c;8x2HESb=j!*od%noDK({ockx$ zLN;p(khboSP3^`qEC|c(C3C}7M8$ss#Z4C_T$U(10S=S7aBqwG+K81V>(jZ zw8JD8R6vamLPI*V)k-`;ye9OHkS&lv<3rNr6aCNZGvZ36z#wM&iT*vT73#@?sA{Zr z;I!nYbScQCL9Yqa9)~JwsZL=&Q~w-6pfu=Zp4j%Hj7dijUrrdSH=3}9iN!&{`T7}zqFtFW<)?uw=zaH0Ure-0>f zR~TJvvzTH%Qkn;5)aQ8Di*08({fg=!&SSWMUI7rwB(n5&u8hUX8IXD=c^LRr$B_u& z%vTbs2*+d7gbmk_K{&S4I0k*(7MSa|as6Xmb!cMNz=oh;{Mtd)id;8Rju=uBz| zq{w?#^R-M9$Ne&yfYdFnUdNeI{ET2>o30swZnjA~G7^PkV56a<96z~dc0mZW7v=P^ z59v%{5>pJ`9p2R~oEi5}FDs6Cf`6*USK?u&0l&c-EjXXf`)}17nS|=Cs8M z^RA$-l0QfsPjnPDL*%GC=8yF$CNRq%qvBr_9_{uq1UkPD)Y2&yw2X_HDKmm~yrz}% zEfF>wpDTK&LXF>Gz(^p2bm)xa&=(tHQ3(hTy#BX!nB{}3Qa3> zMus@mpUv9*giXtGGgiT1z2@RQjC#&hAjqc+FL!Zwf=Tp%sYK5wC zE4Z&lXE=X$V@d)QIl1%XOURn_Fl>`}Umjg3Jo3!0vr-znNZ5v9uj@K?=Au2WgES#8 zc_tZe-4&{UvHGWER2(qm-?z;ZYD zd5Z(d>>t|2N?&@!GBVhF*oGy%)LkmnS6z0*^wfgB1Mtq?6FA$-cLYzQU>-%I&sz^K zsGLqG)x$~0aWtt{664Pw?L}5eAPTLjF9&lg=)sg^j@uGYBb+xyj*8|90EFKiJ1445 zxxE56Z8gN7#?cJ7ySj!22GUQ?=l|RepwAPOM~7QDljS`--uUn=_H>Nti}xKZ!`AyH z&!~!6(%@oX*+VU-i>(WH!B0S?EM|0>CPcpwx!?WbTU@5}c%FRUm@C@iSx1U%UPRIQ zoZ5w4XHQ!Ii(cj>CSzECU4|wU$c(-CSb)O6h%bV+j;TJufij;BsC&)>G5f+)Tfw~g z(3wOlajrLgm^K@A*Y_a{I?tdhHWbh#lqvqAOfZJtAm7|uf|Q!lZc8G6NZepEHJ0IL zt+zwZM!6axF<2olZZw$I)SEM!R>0;6Euk1(m_eDedu41}?e(xf*(_bJGi|MTVAB%3S+b!8J>BeSHsmNE z;FHJQX)vkqas_Ldz0!}W=Dq_)14q|7FxM*W<$TcP=~1VCGF?) zyS^-J*=@eP8Uv^nP{WC_Y~B7cp1Hi2A@1gUMHQQIZnn$pe8eyKVTXGa)8t$ljcF^G zKof{bL)nAv*T$y*PGyMa+*W{`Z834~3LMe=9WQvY^f+GkK*OXMY6oM4z8js?Y3k0A z%gDPyy>Z<|n>*LiY`!3mJT{tZxS`9r?Ku`ISwAoV#vlcFCbl^0iegR(n7e?Wvm|q= zdHZIKo)08mtk5pb?OG`=zzdW)DLC$X=^5iD>6nb1X3Duu;k~NZ{`r~?TpDIwkr5(D^6WfV%N%)DM z6a-||mLifWE$<)aJBDgPE{~s?`z30izP{hybw%|Cjv}#^hCrp4SVmtw7qQ>d#~D~4 zBN&F=!<(XBfXW%GajNB#qF?aC4jwGR^_062;K?77e$~P%-w=JUm#Z3tDC>b-a_EqP z6~M(9f~z7^zFoB(Oxe@AE-x<;n-*!OE*2=>gYXSDUKJL43u4Cf>YvRTA$9` zTBdnBA}VUaLs`=(Xt)BOvEI0^xDt@Q-RrZ58nZqChZjrMIAa#Ft|Dp@j{kvY({EPB zEq(=FE^=w7(39^;w}^A5)XWD0C0=4{K_uhn0SeG(tRSR)G*R~&*3;RM?#AuuwMYd1 zw01^cl`XS_+p{u&Cj$pRgqfqpWtrte z!}>`$5t6JD;e0vZ@E6>)wo@nY;U#1UJA-RoXemt$dbD$xz>K@HrC9K^>`1%`g!fBx z!CgG2n_~>a?A`hT;yoce2QNQ+D*^|HrDaT} zBGDh>E3liJzY6f zHt--Akes&>2NB45I>@JdX&cnl&Q3Cv41hZJRrW0}x;$lu25}vCRxsEo4EQ^N#mL9` zxYw@hJv-fSodY!+8J}K%1YyH)mX{xBwz)mwGgDMzD z1hfwXJ+`?x-kOjjWqg{3Kke(h_H5@2@#XfZs`+tfkK5hL9PTV1_s=yCp%vcfZj6H( z2Y5WLPXya@0~&S-{sO;xhX>W3l615XtH)#j4cJrLR?zJznBKzLa_04mYn_HJ9Nxwj z++?ru`-#<;ItXA~U1SXJQiNm&@~3zX47E%5<7j2&jw_gAKNVJ=pjq9*Z&2X#Rs!sI zYSbjmKA=^_pcp{NMep6APOi3b#L!ELhB_e9Y(N~jjKLDlFOBAzfZ3yjp8I5>hwh@W z=GU6iG=-Mc8-{5vBO0gk8j)ekWynlw4ut=((N5l!qF5$$q5)c)Oo9-W7WN3>b>-gq z#eUF~{p70>+(AW(6hRJzX11Y@S7kZOiJulnkJb>49n<57y0?wD?x48ln=EiMq&*jk zNn^Jbh9xm4^=VB}^Hr@Xk;o#hK8LfBzW1Ne)~FL`%H*!=aNPn(OjODHqgq4XT^b!u zm=zQ|N5}D^G-zH?C=~8C10pgqyLrN9m1rP{GRqf8Rgv?Rocj-xk$LHb!(Y-+14|&N z(py_k3`@o`!T7CR?S30pnI!+klqlJ&2`ukF%_}oyr%9E(BCM^nydCzEp!qbxVhAE< zfQB>FO4@WPQCSMfJp<+8qE2jIgI}_D#TsdbP~{~CCiikmw2t5kXxeJ`0Ogr0>jv*S z!n<3$^cPDrzWFd`4S>h{z-sM!UNv0(GBVf=-rtWb(S z%i=-EWl&b%C@PCe{Y=Kh2j^DC%6`AnD^<2%eexPX4r^v}hX3sh#7nnwk`u?&+Nd|( zsl>n+O9TQchps%*Q5>~j0t=tSTxHK$OGbR)=jYX&@pUH~?se(SCFe=k!cE<=^sUv^ zm&fL4zVPdoWxAL5fH&$Qy~0-x}jwL(HZI z)UW}jU9ww43X;Fu7V7Vmv6qA8El#&`=-o%U`0BX?aRDPD?rjG0gDNL)Cb_)!-7J~a z`Kd}n5)45GNyPwLEo9FKfh<8CdfFcLA~d?-dmPKXZIPI8`rq$O^q3e{tbp0K5b&>7 zeDw=02Ul)L=%sm{3Gv+Eb58^~O0+e6GZqh{+|x$m14h??x{Spw{o&!g6kG_Fa%a{* z(srQ*182QFJb86x(QtsgXzx{VhqhU+M%j_3Z39KCoe&piBv4EQ&(x4q!o2;BTjH6t@dSc z3m6lfE5^op>|o@u8S;Y=E$!#?(;JJ>uR^&hmMOH?JUZJg6Sn8>%ZM2YdPuuF$^|Xe zMBWIsh{7N2djj${+UYRfe|K9;)>jjcqYk0DJGb+w!1XwGEnn8qL;5&UOWaVSe9}zX$;pWcw%=W^}K1nD~U=hs9346-tkr zX4&2RLFA8EJ5)foSCxbr2zH+jX1h*?F!SyjWSA6a=2<>CGZ>$^D`E9kRy#ZEzYBC6 zZy%l*7I*=BdJ5tHJY^k|z@$G(s!9G^*KTO<4rx=8`gz4kU4B9D4W{bBRPrKj1KEAw zoQgVqIlx#5c`$;lL;ijcww;t03sR{>xGYZiC7*VATNY$^gWO8sb>21ffb)tebSYqa zN$A+wqmuQbALfZUwP1*VSe-X%5%KkRVEt58^>hWRwBX%>#wfXk6|9`RDd{)dku@Dj zPl-(FewW!Xv-dL6jcc%r_ySH-;I9Tu=xe$g+85XP0x{$ad?9@9pHe68ABRVxrr7eR zZ#U(TTC-v36#|2v5T8{_|x>rQF5#W4L(t}FCE zxh}e0^RrP1XcoXN(0PA_ZLIuHq?pwEN;rerV;I}T>$xFI%MNSX)tQ`)uJyJE;=aoV z3+iW5wqEgzEnt>m^@?vJwNdcK=fOa($9F5ru^&9T=cnn*`{T_n>F%rK<|@{A4zMY* zS+Loi zQxz~xv*0L)@Qr`Cb^^>CecHbktZm?6>;Zv^Puqp+GFwFbDu!43Tt7?H0$pWlo`sgI zS=PC}`I4T~Fs-C*U-~rbPUicqJ0WGG7-3d5ey?bQ?$EN4I{#-F2=M&E!=rYFPsqc` zgW$#omy){UPWX-J$h0YS<>b5D{w4Ew40nCozLc>sNcF?!u-h^xTgn6Pwr7rcn5U_S z+sKKqXJiT&yDxP~Fc7g9g|*Ptqf#n%YM=xfa5BYp`!1}~ik0K5H1!oiG8XVCi<`6h zm<}kj0XjF6_CRS0Ob&u*D)}1;dCquGSFj+Cq^7x!wIK{v)MkC{-ILYR$=3(Aq8>VD zbi%xBh?&YE4;1W*lAQS45!?7_=QH|(jkE~9aTuoBgg1smxgQo;x<=Ho+T^ifjwf*Kn>%InBSvEaD)1S7^kjh@X z*G{ZC{k6OS`v?f~IH})JfaluKRBcjKak9XP=G4p4hc^yvDUy}f(OY+8uG!2J4`)`f zsJ|2?^TVo*J04NtY>cqNHz_$Lex-tLyu`BLPHWg?$uL_pEkh_USa+xp#DV?=o>Q4XQ?H9^6~`_a#jBa)tmzIq&!7@sDlU5 zV_C2Cu%1|~Na|N1RurErEExin@31IogtBFVk;>4OXV*E_Iik?|z_J2R1kr%Dlu3Lv?w}h&)!K!CHA5>gE@ND{$f~+X9?}l3^{OKx6np-# z!dE(N@9$@&mxrBnJIVOf2&1S6sq-|jDG5`WbN3Tziq1F&wiew&8-6%vYN&T?G}q#sV8qc{JwH%Q1uW#uBF5G$$GZD$vM^APvx zMb1vCP+gfB0SDa;3z2~1^pjScU(;*XZSkZRLfyP{u99q1g}jim0$D@nU^uBjjT%8V zb!EaiAQ|Xek4j@m4&p|e%OC<+*M}M;>TXL#I^Kdn9P!AezP+xZcyWzh>M*B zxA%c%&huXiW=ZZ+=g#2SN1A}HSm7m|iUCq8dlpN_mLYnq{Uc_zhDY=!QZU4}1B%`hy z_b}@6ogG{q0iJwm<(AuKUr|*!55gJ=+s*EsNi0;mB7HEH{2-LKcRI{?EIO9B5uRk) z1=gE;kS@*%&cCy9_ZuY|T#BXE;~2!aQf=y)eR;KU|H|+d+^()pW};9|g+FfTC=Yuoj%w&8o3h77L;|R)Lm(i&6KSzRFQZkY6F= z8WD3WCtn5~847q9@ii3+xbKurF(xxJCb3>cnCu(zaP0Cty{Q`O+rW~7x>~h4y(HJj2671l5#P z;Bw(aa}H+w%StfZ$P?eF65guqxImQhlh(J1*vyBwa5w#BjL0~?KRG^jo}+RGroxKt zAlqL+_CQmOQ;hyxFkdme-)x5IB5ZAal)`@tIf-z(sm5wAMvPY|Qkn<1;T!24gs;8f{(FS^pP(L^ z<{8@LqbTBtzs@)QTIU?3VlxrU|7pb5LY`w+975oY6|+k4NoMwIo3to|u1V+)XvEWj z)bW<@`+JOF+5;%Yx=EnplvOG_9q6nHPw6K9!9Vf7suqzCxk-%Ro%+yBE^Pzcch9J~ z>rn+q(8#tV#BuOS6Aot>a4#M;XOy|<~@I^{42L;qKX|KR^Q;o^0g^B9qX$_ z8JPS_x-UXNWk)mwui-vy!~0qIrvxRSlYy^Ome5j@x5(poaO?G`E)(Js!hC?`?2S6{ zj&g?ENKDeGNy0=(Qh(OBWCaEoMRK*Nwy8c#MK5wB(DiB$qp#J5`&E%1e;OiqZVy-x zU#xFm%S=dgJf5)UF>x60U3;!#gYAatTnX=V1c^s#=CaD4{E9qJF|e>Xz84sidb8F6 zEtcP|lrQG-h<)!BIdQgMmP-{iTZQ`7?0{o0TVg2& z$f_%V5ip)2v2Ko%-v;Skqx~DeP}D7IZv}MX{sw_s8%@asE$QRHmE?VQ+4BGa3^Cse zwUy8BoWpP6uNcRk0Y(j?vmW=6srj4d3`+e`EhN};wHx1?f z#c!&6Ees;=6)D5|1PJlJNoFzj^{CQkEl87rA!QDZ(peO{^>{ z+1&1|ZQP)h|4{sOmlhlGx%?``@ix$FtV}zAC1mcniDb9EpS`^STx4-}NCcr1h;6Ox?Ji_}(qO^j5FbX5py)&2aJD~3zp@8KGCa=B4ip z9NXaobOu$-*!DQ_{Q#atp^3VT0FDWoZpf?8NeMoI&)B=cQSw?;c`ETeG3rKA6q?*L+%%3T$xa&3t`-I}it&YCMYJzNjKM4^Lbpb$tCk~b5+sQ#<9H_h7^l79 zh*@J7cN;pQ=(}H|Hxm)a*kDOPzp=Ypfqv^FXu5%9Omy^Auh(2$Y1aBxbSnV3fE`wb zOBbs@6VxzmvBhsQ5Kj&@s-e6u+BHwNu-vE{TTQf6o@dV$8Qgd(k}INkh&I(g?radG z)LJZc1K@7AciW2k-iMBA_H?E2l`SMY?thg)S<}i7v@?4rISQ86gKxucBOU=VQc%Uu zmHDRUR~z}$-*+9QNzS5qLb;o}?=g$+qOz@}0BYxXRYXtelJ;9KpS~A)QDFtPUddn2 zM|kb&y`NEKhMt<*3H6f&m{XqO55kCXh4#9xNts}70lE%-W7aYO8zzR)35>;h53okg zpqvE0Ou3a73;Y5s{~C3I0!}svtcj86B|z=a0oBxH%z{OG%99XXglR6dFjk?$ITMtx#z`N%~04= z8lcC&zVHCehcgX_r zZog2z8Fu1qgVrn}?1C%sU~!MFsf7by}}<|y6HbPyahV!S z@2s=L1TH$BkaXBb37TpySE)EMbitZw*u^h9q&6PuqAIp$kO_GldP7IsP3ARJ_2z02 z)~Drb?Vvs1i!=!+r?1fbUDg2l>9qxcnEB-%XfjXl{}xj5!S;3 zvk`JW&K%NUD^+hr0PgP$;cVjc9egwO~s+B$1{ z!B$n+0#Os#91|W=oi)`Sn?2|9)M7$%ZvlUl23`?YEn5}_;zLp3nUn5bfxJ7D!_KAy zv6=^ZQjO(&US9W#{I`Z!o|6xZ^Vkyvmr2ILZ=fnYt0olYtGF9|V%b=0;WyyYDN#&+ zEOwU_ER7nN)WggdjOC3x=@aq%cNY&3|4e}qs>CzX&02W)8%@CYamtaxpMwUWdqEzN zpGfPh5f43k2&}Xe&8zwJXtmcR-P6;UTT9c|CRsN##oNdRcO$Zqdpg{zreq99#Vr6f zo=Z>JT9f8(o%kU(5uZshR3E=EK`=HKOYWulcvY*T6ADGEb!y>*5K5B10xZ0&`tldY zufGL6xo#><0feFz5-;?gS=pY`2m;hs>WW+tET&~J<{|L9wYZfEWEyD#wNZ6{x#VyV zdX$|EEf3w~b%&*Yba0GKy~kJ#yE#NkMe&Gj7hJ%*8Wc}~BaBdu@zxqIn00@rFF{p& zO*(Y;QE!X8au1EV9&YJ+UV43kWLtcpg*vANyD|kMh?eehWe+EcYAkZ9=*jj68KBb| zb&$*os#;}G^tP@|qx58G$ZF^4m#*UySvHRvc?*!IEFkl}S7g}3Zw6fPETBnld)w{; zjAffcU)Gs2L2q0Vpxr{TUE0-CHS-Hv>hfk9JDZrB?kzy;e>$qO8S~eDi#*?Bo z+!b%B7$%OKBaDtH61-GVrzP)DE|MMc(773RCF1kFbzp4)Ck<($3~zDIo>6NrOngw< z95H#bj#Toyt7SnMeYWb9e5h%|v`z9Z7A=1ze5H$%y%H4C@Fw8I+>w!3CWe|b_j5VW z^sn_yz$U0CU_S~d4iq;LW>T)fms%9Jnn-9h7 zux+karb&uC12sAKiRX>ge&0{dr@i3d3LAY!GV345)p{;SU!w)C@yyO+RoF{u+)@7b zy+*0KL|RxTaJl_uoY&CdJqlFY#c3`5()xQTzFE^rZ<86bHdAF<=mO`bXz0V;{mD>C zqRg_AKJ?pQ)jm(d6K{3sykAr*%H{YCih)HMI)};AcPPTW!(D|KH}djH_))XKV@=w? z>RAkrC0VxDjU#=%O(op|_2RF)%I1c8`8PA1(c^rpUNgLdRN;s?WEj+STox2QoJt?eY~n>aMJ$wGJO!;~jaT)rF0 zRq%kJSza_p51Zc8w43HFIxUKhM#LA7vqJB8VwN-%pI8O?5(NQI!IQPBat-e7QuF8O zD9_s9SWnE=c%Ccp)CirVTWIsMVvY@Pl%1V0M<5deIZoUePo)3+8H{f!HZ%7SWJ@>_~DTa-ng+6^+r>} zd)y|ac3%n(Gp}o|Dw$ly>z&p%m_W+ZyrX6+2eT|{NJJtit(iujI6YEaGG8Te+J*_2 z%RooY3{88~L^c?MMKW#}s7tAqrVa%%d*F4AN^Ol=)-p&3o`7SDMw!VGzaksd+7BK% zbLpg=TgQZqeA#=?3NDROr85hUWQ!Pj7RQ@uJ28@(f8C^9IXLO87m@6o!!_S2K5eLN z$>~-ZB!4!0(q!nl`3jPEs)88&n-PB5S@e8g{YZ&gc>EVQX8hkN3RqeHFE}2nK5G3B z9Djn&FtEUoZ;JTIg049$b`V5zJ(G5wZXdn~h35;8-Qy|>^c}ex!=Z@a;mzy%=;^QB z;#2F=Y!9&v9=&6;enzd-bbQ=QlpEGg_@>a+R&0OnufX~KG-I5oVmrNk-5lXh(1kWc zz4UnLeSfNT^)?UF^xuCem_jrKC{4U<@bw7LgVU*8e?J!e(Xa5%#M%CI33y}*TIlKi zu~tBA$p?{@Gt8Rm3XtWwYu{7(hPS&n2bp4Ow{swDN_+f$1H8Yrr;`lK+49R*4tYr- zMYK>iFM6^|f&8*4q0#)3NQW#dr8TMSSg9oI^U=GSP9133tV;5I{g{Drf5mfhE1&jby?MiVBWj)X>Mn+J9-CG74@;2e zT3XMZ*9n(!sHJwZ!u>u3V4w$vV`=I-70&vjk^Jo8*rpa;aOJ1#Mav z6H1t!!?2ODwX{!lM8)|UMssZQ9q30|7Q_V$lJrkm`6o3$rCq{If5T+d`=f zFZ1znn#s9Dk7V;EXm1E$`;aCNrsPmg>=g|WC5#(q42AhOQaD@HaMAQFn05ge>@ZY6 zb`!~?fqa@hO~hW<{k1OtCE0gr!QkX@%rFbXE$8Go!s@TFBsu+oBv6D-T9`#|6>E)? zKH=|{fX#8{=jEq2=1GnHxNdq5O8-R7kKf6!o9E|GFF74KzJ-@Ss)b1e^MQ1?uMh!h z6TdB#a)>V}^7Z0F4PL@B(Gb$ZI*S8W;8Pu%?>#Tx#iuX1L>>@5dJ$23QVCfbjG)g` zU0ox>tc>vjK9T~l~Vwy~+ksgRsA+Qsg&?r+sCYhbT28m>K z8B3XtHEEB$&mdhzZ$#{JJ|G&jk^BUy)jI;hK{M6lu7eD+R3tHy_4(HVudDd{(O>qB zL`1q4ZW`h?YxCU6v?;`qRmjOK3wzj#m^;TUL+n+zAtrvW z*lH(Rz_*%Yry+_taZpJ6N{n;6GNC3aGKf6WkwDc>l=OqYY+E&|nNIi3x)SpvtH)O} z>o_fAJ0BSy6k$d;ot_kX2e}!=2rv99ixTq{g()$UuEHwOd}By!s7OrQ(|CCU}JDkDi%}=A4(Y2obHgSk{^d_lFAC8Ga;0U^7o|Q>@*Ntir9N z7cCOhk*l48UDIm6S9xHMjc(5=x6QnU#@V~s zWjQixm`y~NrSHxoT^eg{eYi(Q2V?3%lCdb_0sU~s6;5LmMzcjWToi8s^l>+#b@Bb2 zDU`4Ku#(F3rx24aV4S48ihlH>I`}}Vqn8Y{iw@g@V|zq;)a9j}@1`HEs7Ne$22~-d zmTf1>-eO8_-?rdgNgdjy%V)`w@cav5U)FLW!=7Re8rZ;3_L*Ygj86Tnj2hp^2zNTNgNBHAjnV zKpShy>~Tw57tHMC6d&Q%GG0mom2-7XwpwsLRW?zMs`s92a34UKl36U>%+8CpHs5QO zf{$6oY=XpB)hLHJlruv$u-?Ph&*D;NAW}Ql*(8!A$gIY}|44Bz6nq3OvZ?wL_oEc8 zxyo}JI>}#zESvS8ch%4xWFJ&VrZwX4(@NX3RsOYX1uR_`dONRjiD(^+@q|!XG97)A z&dy5l7Ln&6`nN2!p;9#b>bulb&QZZaYUFosGL@BdZC+GD?c+l7At*zW@Wg?-?2Al` zYWnLuCtI76#7{4rQr7}aTdITTkZ_-#wfXIwpBC-O+%YS7B zR{lH^%)^Zi-8@7&uoAEqDH=`ykfOBlNY4i1EW!dtD`{zZ4dnv}*>KnpHcCSew}GXi>Yl)c$0n zg{=#Om9o<*Koe3|?O9px)i^_^Wyy)AMx^#6hJ%ZB0w#!f%GQJ+wM(K1$fA6jmc36s zv-%drLR_FS&HK7pd8nY|N<3Sb=@UW`@{9asBf7aW?XfP;<=MQC7C!lp9`a4MuLrOY zm7DXVS9Y&XEmOU5Y4paj2S!WNP$RL9+K4SYei$oS_r2As8H2gBcSf7ZcJ6VKd*L@f zU_jno(>fhXF^ryX;CMAU*@Eyr?-&C+&PL!nG6Z=DJhde*CX{hxr{a)JE3h~;+|F$9 znT8R6+#vGb(T2HO&ZTb5j!PS^l`2N;)s!+nHeov@=us};2V;1#?JJl}o;Bhxx^fdd z-DEUhPQJ`FevFIinAT4|XFU`i){j_h(Wt|UG=$k73hin?EKUQNPaO#$4hB0mHky=L zQ&{S`fsLtcqFJTSHV(1pSM;8J+=&UWM`JxL7d}6>$@JXcAM>pr?xnWvi2oy7ppy}< z7x{0v`oEJcu(JFgxZ3nD%f0*`Ts=Dd0>Wy7q{k%aknlh^Qb1U-VvJ0e@!=yTkxZ&O zKi_bq!}`@ilb%01P}2F?eJawIqnoc`FlsqIamD6#%k=5PqwTAw3P{xZZpm!atBR1) zM&11XYztOhKR5rv+|&}~=arr=I^VAjokq=uaSwN2=JWMR&a|Vi?;EzP%)p$o6*u1W z%Dpn*Oi=B7PRmZ2v(KCtUux0;RcVm>qpe+Y)p~YhAJ^BVpG00UV*PXj@sqgQ@Bx8V z(ySIBH6^{;N9rLssHPS#cTm%!Z_+97V*L~Wo4YND?`gEuR@Hx%#;u7t+Z~6eQCelJ;|AiPx^t@Sx>YyS~* zRg|lVMO}ddQ&4dMzV%KRBy;QG45hNDdd*}y+VPF=O_^zU50 z`~C|A1Lg!rU6)NT-VlYsL)#q~ZE#3OV-wqC0=wv%O&@O60eme9c0oHd>dydofMYyX z%s-cFyjTJ51;7o?npX0r@c&`#ow`GdwqV`Zwy|Q{=8A3GwrwXXwr$(CZQJI_Y3DxN z-P(TGKVr__NA;?&w$iggE!CoDlr6{^Cg}1y8MoOSs_7!Fh&T+o>Y`kkp>EVj7Wskj zU-!$*v0ay3=*A{R{sOI+V^k9ROr89btaQq~@b`PLme_qdlJvHAG`>}uj+_Lrmfy%4 zeY~P?InOZD85{*xwVC9DQhg3lrReS7Qs??nA+Yy$vR~6Ax`85Y&xC}Pq8N}!rx-4? z3p-ZgM-qL{pZAG$AOcxeW7~&rmD0jZJwnu~#>$b!*Ay9;j5ZSBI$NhqsKhSifAp{c zZZ?2rTdix}aX~joKRETo5M6Rpcdeb1YlayNVpyhm2y$w`P3kQ4i_J%07v2g#O3B}2%k{5e)ivm42yttsJy(5J_+S3a=W!6gJip2I< z*f!|!G8r~ufse^Bm5Rj>eYz3ahlY~Mk6r)^jjpzZIWA!EicPcRGo+viQ>*F_6sh@O6oSXpR&Q87PR7!|rKt>o{GHV0cKJm$0_^3lh$b&9j~(NSWm6CIL7kiW26 zaG+RdVQfGldLIQ08it#bl+NI@tBw1<3E4fyr+_lGRLz_gI&ReV6@qzT32m=aXKcq| zPM*pwP{Y1YXr}C8yCxhZYZXH~S+%`ZwsdoADWgQQgC|8G-BEKfcIv2QD1bmhE6T~~ z*7=;{5C-2FR$l4!ySY80N%oxK+J;4B`{zs3Hr?Rbd2-t`egCKdTceQ9K`J$Pne5*^ z!aizqE#;!pA{`GQ>w75F8>-7QS^ZdG2TS7JYdZ4lIYKma(QM+b%Exaha}^`8Sr{MK zaXN<_*}k)-^1AzAIem^%{9eeHJBJ*V9{nj&)}VSY-syHVzLkhw9a5>|kN`f1KR)|y zQ2pYl8plwM%5qw>iCjvmvIwNcymz_y$^j4U4a+(JYYK^nEO}v}ad%_%;!aXE2M9<8 zkHLFpb^qqtnu!PM6Vjnp!EF?F{|&a6m8TyJi?S^yR$rDEjdiCqk%qF6K1>n}m?iFH z#_l5328jFk=UzF#7m~O^2hW5i*Gg+Q6)(p>F1=)2LcW7PTko1a9~nWHW%rGLCjeir zGN_^3dz&%QDEc~FF5Q1=&L5eKXbf0QYDd*> z(|E5H5?rnM9)&mQXD8O*&L+dH;vH;j8$+K@L$L(!P=!XZi;CJLS#34USzgjRun=>| z7q2j`wzbwF)K3wsWSKXiC9-PIn6Mr11n}Y)A!!0?^&LFw@{}NqDEx&W-AaH!pl_!&}8y&2$LP8z|-0_n!Z$H7g-FLNvUv${$rGs@7VnuF) zfYA)`vU1O-&C=~}+q}jtAxq6GA6DE7cy|THrzzf7k#ZbG6SYZe8qE|>KpRB8hYjyJ z%$Yw$ixFQ>W{DwV&rJnq_pfbaWg&;50}-^ZS^;+klqzw5DR*pTGcEp6Yy zCx+GU5e?KJd_>nQgSd3xk zZ3We*Sr`U+6LXjX&8bC&DS7QFdFjg1I z2Ec-PWs{f{BK3o1tvDo=;~DSQSyEW61cDg9@40dFIGh8x?daVflwuOEq)wf8)ND2e3HK zi?Ds~nx7VwDHRtR;A2ybTd3TImtT~;=kcAuN#+SJ8lsSSm0hLiwlCO_jHiVF>XX@x zySu&XO*M;q&exWovWv{TrQy83f~4`5nrs3Lbu??mI%VDoV$14V!|23u$g~nPgu+nu zYne@JF$?x9!3PnFR}bKG(0$$uW)zuggOYc=oB!f3!aQ8E2)0!#C*r#wn^yi7OZ)(< zb!q%J>?`x@MLSnJ$_YVRLNOa*J^~$4);I7ZMu;3BCI`%ep>{R%P5B$5KnY;Iwz3-ELrCXD? z9S7tPifgnHH?MEQxn;%!W%uuy`;YsJGwOq{8`}wZzA_OzG&h8a4INYT1W2lsmJ>c- z6rBsVF$dQRX)wf{bnm9S<5$Z0f|rY)Z69@`FwJ;gnVb;~U?m-raW|d=j0x7)sQZH=C#rQHY666;1%j|09A`(2~^0!5E zvL83gdxK`3p07=wZ?-d0dYVjv@ixez%x7Vq*J9OKdBB)(gt8I^z;*$o^K6078Xm5@~B(Ld%dr5j&*8Ixv0(znI#i%mrx)V8D@C|zj`RRTBeJdfOuP3ld>@c1ONyJT?w{?=(gw?X>#u(kz$$9QHO2E9$C^i%HD|+rvBcCX@ zZ*Nu4la60Al+BTo7dZ`I(h(bWy>}aeFo`7BMU%^2Bd*UdR2Y*n`NMrPXQ*|D1Lp?B zzQ`OR#S)&aIo($IAQh%#qY3)M@KI#}fypY{y{4Q#xK}`6c&rRS88T&5&W+?Q6Cn9A zp7s;gFms>aRdUxL@k%MqFShFp?jDKZRC(9cd$aj6yc84-G~=Q~t)mFY+HtB)fkesi zj~R=yDb8lw>O<=K31;Z4jDaE%IOEhP@VO651=lf2>q^Ej}6FLqiZVdc2k~RTJ`WQ%cV&o zHtr)z6#Quf*4(?Y@OMBq=jPoI{c}Q6nM||ihC<{nX=u4we;jJ&uHT6EBkx<*XI}stj7dQl{N|%XXI!Uo51GM*?V*&Ph>fb4zm%fthinORR0#cq*wpze7&|EHt zo2+8E>|;iVQf)>j8+?lz71e(8_TS%poB1iQkMLZ2+WkK-m|f=ffalVMSwRQ5gF&(B z0Sh=Hsdaiu=jQ}IsUlarLW+)|))#~KKxbm%M~9?@)%g|13|?|)xx{$N0(CqoCUKB5 zIS2fMm;j-x0xH~lmWaEGYG=U-4*>5cN@Zw+7V>L7(YlrQ3!?b4xi6z?*ieKAf>DEt zbK-m+7LMl+FHkgrez|5t zz%&a_nA4DRa3|!RBS!pg#Ddwb^YQrvBNK32E+~$FWUCI*%3j^9MAI8AJXhoCD) zE%u^|!8U8rwefRGK#d%s&@ZsIOzqSr4DSLuDJj&hW`SsnbY)4kA?pc51@PF6)nD+- zmJCB;g)R=QE0{z*V{A;kx09H1(13m2AudQq@;P(q=%*OXLc;D7)QG9eMYcNQ?Igj* zvr6=sVYNf0g%pp~qkQQ2LX#(^Rdnv2y>0Ic6+I<27m}r>BYfxO)JMdrNmLYvDT3+C z99upeemt&+F4!EF22%y8D#SY>SmqhwQp^MP@Xwt3wv7rEdlYo=WrC7kkl|QjKk zTlP}hGD6B+e)JAO!}W?pK&`rF_u2+4Hdfau(nPKT*HFC$liv4#t0?&F!#1dE@=s^l zm~Wp(ezV{044NDSh0l{Kgl+$9LZ(nitWSqD)ERd&ohvQeFf)dqrLkAe4%))M`SDJ*Q-ZQvWI&*ks1O1_E*dg<$;`ck&lQmUxmd ztr+LYS~b8`cRY@$M@oGq3pq)Z4lnd9wF;c(`(|b!%24CNrr>C)g3MqY6NB9;^l&LY z6;29jt6k^?jH5xq$;Cn`gRV)O@zIR7V;>dT>u&&=`4=Q)v{Lgd8T5t3L-(Iy-tJqK zYM_qgHfO)R;yoh{wC)n3^TPePEE$>6LSv68=x3u1Ip7tWd}@~`HR%vYYLuX#PpO)tNvsZXIkVhq zWFZ3BrG^|>2ugy}hHpjwr}l15(7QlG=)Z9d!5+o6Sr+iI5f#EaR9+{&rfIO>9Zzoc zto%f9FW{{wG4ljHNp>k6V5WNspcJ9B5%1&iNuAvFNK%+fxmE42PXhgoS@zyiJHdS~ zf$Df(6|(0J(3*snqABR6V_QR*KeLWM!;73a=_K{byn6QXY+BK#Dg%2Dl{A7$gyNc5 zlG*8D{!A1eagV1mI@E6*GQ5~zpTsmGR%GSXa}l$k1f?@V8!Vdwa{NK=nOMTgJziSF zV${@*CtZ(219IZog!$~ZKk>0S_Tg2<7W%*NbZw1>)C+uh7R>^Js^ss<2jLZT#0TcE zFefM0@e(xU>%-Af6Y8A-o*183eJE*7?S_M7TYW0PZyZl%o?0|wxWAYV4C|}nN9q9Q z9exX=db%UC+{a8MF%1d!0T+hl%$Ds^QQ+{0eU%LWMNSN7tmr-5c~>-_XE64zZ{a%} zR~*c7{ji(8Zm)nP=yp*q?8&dYDVZZXq1%~-!AIRO#i`y?fTvRm|I|fx4(B#(K$hD{sK5aB;YoVv|rvpP4^)9 zN5Tp`MZ89Nc}gAGaO``9WC!o{A&w76YT&T%F~SvLNTmX=md|hq{_UIj!}n3Hmdy9< z&Oqqh_?cUn#KFr9IE294;p+!qs4t$6SL^uuSIW#l&d)KNXhmfMhu8MT`7kB&<=(@4 zO@TPTtD4Wq(SS){)ps|Dmq-`JyOjCc%gGKr>w&UW|Ix+f?nLRK88NS_*Q+a|WFcr~ zCB{4wQWJplK3AF-^lLMBUs5xQZKGVq(FF`v()%PM7JP64byo86_L(}4wf%9?b4qc> z=TpN$k)Y@I-N54;)!Z;S{T$5T8@-H(7_fVxG3jhFfP7k1L6-6~)HiJkaGT!;$WHE) ze_p+pdpEnbBWw~RYB09!U1VL96L-r+cWd$e?q9S|fapfJ1DZDDlVlSUCQv`<*FpzB zj~uu5G@OKR(+OK`xMnbNDoaq1D(}Vht-HP!wpU(r*qCmrqq~WN71$j=qRz&cht00& zsnvhCkn;}1$rmEs)hV37W+lwkM?5)%m7WtT-Z-Aq6X3);F>qITc$qP4vE&(V7u=Y^O_(-D*bli^E1 zQFQ4)>~zetR7$&!%ROAS@08vOv;54pZj_BK$IFk0&*|(n-KN!#a{WCw)3L)(dZ!D_ zghzrsKGM833g%CJed`S6uVmtrvE%%T4$Bxj3H9`vonEXkIZhHakC@WOb>|o3Qq!Y{$CEeLs$)RdM%TNHVPo2fqRH|z;+8zSQBEz=Y zBWE-}MYl;@;C(=dGo#cFN}H46WB^r*Ymst1-VPWx7HTu!HUu0Qxiwpfd-+6oKLd1@ z*b&Q$2aj}bOc-cNmVm41l{1;W&hUK80X_9j!PY?WX0 zlq|-$ZDA-xR8ZpJY(7ZwWWc=hV7n_$q2{AIyk5#N+p1Ch?z(GkmWhWH_a6|_L>{?d zG8ZuopEjP7!g8N24}6WRU7Ne^SfqI!mlY$@H)_F2<+nFtsRJj-&tAR+Xlno+jK8G9 z?ya@jt7WBnJVAh~9oJmYvMv-d3KSAt!?EOhHaja5ZJA*D2)3zJ*NpX4f?$Bpe)%57 zZYzsiy7UL%=yXAGzyB7}>3lsA8N9S~0RTXqL(IO(p}T%kitIs7^Ng%Em6DBb*ooAN zRK{yN59E{EFGj*4nd=~;0f&{+QFu2|0yoJK~e?5qM*e(;C$m$-*NvBp2yR{o6cqKJ_JSrAQuc+@Ap<57zV>l~S1 zE0QyIUQ&rb%IWP6iPgs1#*0V+w~xcGS;oqhCQ0y&)u8$?csQSeUxn zI79Gnh+^IuZ$&n+^_OOv#Zy=wC^HK1({4i;T*<7QO25b!Q6<5nVJ#)8NCkTLwB^P7 zk&ch11ds-;azYs?E;LtgE*WZ~CA3dh%066}CvbX`FR$D@7uIToT-L3%l=sBexheyS zpaU5whe&e)ei7MW46-%g0J=v@-lpor0euwU00%NIhanb#ggH(CLZkwU6g-oJa|lx+ zC&DBl6Iej5OfKC;97XqO9Ayu5zd5x04XKGeqBa}2wv&epbtI@Hkyo5(SAeT*(|FGR ztB9t?a9wM*;oBOAi8akhH68^OHw!!fTm!#_v&+xCRfXV8IHC#g0XXWkCmrVQCc%+F z63cW*iQyvTH}}Q>TI8s^%)!x+I>ZDO-+xMn1%YQh$+CO@-VbE+og5alGTj zAzJ3J8C{K;&kK!viwEiO@=91S69f2L)72!BVGP=TG>C~BVJwMe2==ItqsZotHj+rQ z9b=d<#J{7k%$_>}*)w2!*>+nV*&TKL!hyYDyzRuA9{~!^On~+K3M!985t8Rba_ACk z4uiwbT-nL$LcGN{dUvDgd43$0n6NGaXqhh9sOaDpat}J^(S#oN09rFXYQ&YUI-Ty- zyLk6pek@S*I_Lw+B%iHfLrYdO8})&KA*rp}am!A(hOqqFN38^MJ;9pVbyK7I8SkE_D=y~3nz z2#TSC<$q%i^7^cSJG}XJpx7#a@{`$p{^)0_*;- z7dUBqQnJ*j)bk6RjPGcnkMx}hF`BQyVi}_OI&_6~A zF8DULTFJ98K)ok>Y4|*B|EHxcdfFyV2IFrO==oJAZT##(s0y{VHM?}K|4N>W>foD3 zQnF>zLb1M{_dvX#`NI;)t)miToJ!Mj!jnY5uZuw zckRFg-ehEf1KBfj*MypY9@U;UNz?8Uz?97LQIQ85QO z3t9NMS0j91@B(G+?*DC>`ycPkZ2ysz-}+6;|G$pdCm?OwbF|shUcWBCh9)v5oX4|4 z>`LUGZjp$@QcjQeovA2+yb|K`{kuCk=^hz+nj`pPvto?<%zLMwBIZw}Y+q|1-z<}i ze>vY=S-mqZ;fk3l_umtTf~ns1pWipX2-KO-hDzU`N0wg%s!M?Jv}DNH#gYj)lMwyF z$^pKq*mTm!t!-zfRLK0fZi<}Gz5}4wFWY~nrbmV}rQrXu{mIIW;_JC%?{9w~X%We4 z84bl!;%bNVP2Z&Ba`Ha0@bt=PhR9?VMc+7q$`tU$7mXEz$9HY)FQIcHhe&L=m%bO> z68L<*drSV+IZlVebx?OxpWyEL+N)nya38G*y>-z>Hau+sDeQO1@m)({TEcg8?KTr6 z7Rv?5ab{Okok~P9G0L3&#p0lhmuX!kn?eNJ;yTT>~Ber>;7!6iL;$S7;rb!x49ek5_ z%f%%8s&+Z!q)EK7xlT+?p0ROs$Q_p$5fsJfIq*)lW6!wPvEXW@A=brf zVgvaqMr3&df@wAWXN5$0$_`2qL8Id#jf;_age*YCrSOpO^QNgyRg-`n@O^vF1$cRYv6xW4wIyT5-!E;6hA)c zMjy68)blu5>#Q$6XNJuU=~E$(;6q0bSHFjh zm)_6OP&=c5&|5XA-e5xWQl+M;$+j)FtEv~RcTpvJ@-Q6FdR+r=BGpq9y54ogRG$r!Nv|Jc%tm(<<@1z=sa5a(e3w?6Cy3JhX;> z(vc#plqMM%gEY}pbu;1cH6uIxQ5{;IzN{~XSlWdO7(F1oZwo9OC$g z=1iYTZrMIKjNzA`_+%-~iY+k>-1{BKsvJEqhf+W|>hl?angIbM0yc_w|zpd8SUzwyc11m z0rz*CNeK0;%yt<%ApK%_)u|)CYZdEPbRi)3d3jMCoxtvucvNm%t`vf+$zv*^)q1-M z_PrIg6p2$bgGBHcV_~$NTCW{zwb8S&6qsjFXbmv;Bq`pXKV$bq!k<5)LR@q%z#){^ z6)x2Wyd0385rjOOkzdWG&?6RAhCRGToX?5?t_UArIuP8b(v<(MR_jyFHw*!qNEf{e zOPK1;6WI~!4Yw(%S-QdwLg+6sB&V#=BfDYmK=fZ4g1V%B`!5Kd#7WK>OzKUZ<21Tn zyI4|ANnZ<2kDD*m9i1Ak_NHQp)=wu~!#RP7GGAb>9UCM%;NG=0%C+=j2Z#8=lRj8p zaRv#ORI%Z?o-Yb&MbTSa5HG-Ae0D9V*jm!YUjW)&>a?p!oOMN{Gs+hQj> zH*!9rnO;MZ0`qd2rfh-JY%zF9gElzJ#U;bp_N%YHiczW#d6-VQNX*xIl-E_>qiAG! zju_!4glPQx5;E~69iFwtV=UyWsKM{>THTzF0+t=KzsP`4c7VQVb! zvI8HK_+~2c!sfRv{|ea3+{pL(d7P^|r}4U45=&by$j_d9VNrB#g3%X=O5k^oVB?Vq zY=_)=XXMatUwpuuz;)+cbxiez!i+u%c2i1LLK`1G=a+M>6F(8W-&m_Ci~pKo{;v4% zGYRD5UXGoxXm=4Rl2mMS+K2-ZG*?ne`7F!xY_Fq*tnc&^xL5hpI1akkoeTPI}{%5OR`h{Y`;pxjdycRuHi0P-IeE4n;|d7aZS(pIE0rdNtJ*~ zZ!8^EwOjHvfksiJwHKad+fdy#z*nZ;TN`Oi8}bYnJ-xsbJ}8L#aTW(ryd*hn8&^V9 zPs6^rMY}_> zx&_*q#S@e{Yog4dKQ?u0{~eXK&Y;O_MaOKt(9$FtjiOI*cFrAn%*|~DNRm6T_vPO9 zDIsb#Nn=eOakj4DnmgE5gR1I3F#Jj;3i@(a65fV_H8(_CZeL65I?rBJe88G{4o?(0 zMkxK*Xf>Le5@u@-j;qo#04F~)5@v7eiXRG5Q977uz9n7ex>EDJ9NHujcQ5HAK9faT zFG!t%lP7(`axve2D%}MExL_|Fa=Cz##^q>z!)gPIaqp_!W!n*Kbl%tw**M~yd4Fz> zSp`dynh{yr>QMU@E<_8GQ&3mdzu2%l?K@L!0r1OJ8A{u9H`Q|dwC*O&%z6qs>Z?Hy zJqkN;Hki6=Zt*`@e7F9iFcy;l(PjFq>AjbA6Il8yUYcRa_jojtzmShNt>92gB%)Z< zVtRd{iOwoMwwgTHe;xfjeRzz+CpiotPDe6mnux5}R<3~^Y`~LO{1P>OJu@aQQdv_PG8jxBu*n#dt($@)s*?H*SX3NPnlP|x-a&6Ldu5WWmy8fOs@L)j49VGhcYgTz$k!Uve{+1J7vRWBE@b{SO1@$!kH*~m zbbMOA9i35M?DTlk{2C=Sqf|uD8@zbdFMoB&t9$2sj+C@GC*Yu~S|HME8LDy!%^I#pJ;mktlLXNZ9&9S$4XVx}}c^=}T ztj1&$Edh2_WK)r?cVKrF3K0I_@|uxPGB*@`9ayyy93$U(aj z3-MXOi;D}hq8yD?vYpmN@T>KL61lAWs|8{3pa+xEZ&?(sU7$&qsRyh9ZBJEkUG^_N?(0!7>u;H{31XKEzQvdXFnHoMRJ&)m&hjF z#l)t?$Vv2#VY)C|sUvL=yoZ290lr$dcRkR%if5&F&>?(x4+`kFfI&_r*na!ufDXa; zd`8haUDhy65lYe)fml@=8pqAE>e_j~%{qF0T>}+I!z^@0-V!{=7E&c%kZ~4-BCt*! z{pT}tZd}@=8;$!Uwyh5M$8UC zww^N79_;RzsJfzDorw8?>amOu!`jT%dN6sbkjW%Sy?M3f-7ccf(b<%2`7wq~2|t^J zG1Hr8ok?Kv5y?}fkuSFEC=pblgv%Ae1*jKw4pqT$s&*{#2xJxoI08ZI7DgB{EtHGk zAme-wHw{f<2SXlOd6^`OlZyU*Vc0nyq@i< z57_a)P3&gdO8IR-<9Sg~)0O6)x(`|bUM|6xCiQVI3Fc~+?2kLIVoi@JOmbVX3^l^W zHhRG%6}H-37BfvnJ=e|1`bVkreD zN`0a9xJ+h6j@i>=(!U9ArV_>N0~7{ek`oZ3Ed1g@?$2#=Tg!@RsOfQsRK$xm%sNFL znGhfb-h32)n$eUwO4}6*XLE7&zgBE$6U z)p?Js>mI>MiAG>Vla_kP=VQnQtV#T8Ac}CT^+&j5#7g7^axX7GCOWGsTd||l-FzpL zwQ{D-V9X_*u++`m2;Aq6CSveH-dB37MG1Jf-gxTBz@855(9Z-b)7~iWG)YTd4Jtag z&{|ZAd|sF8+BKH!L@_oOQ2uu+l%`4Q%Zr3%N|!Nbum#ren?8cq(+L{&*_LW}+z|ub zwp%1qf()iTm{tvNrR4rp^8A+WVM;F=%Y+H_1)rwj%_KG0-^1;MVAd)}ND1lkV}(hJ zK@=*ITjMa2`JiG|q*?9R{{xgh7~Q?8 z@>AVHcJrXHq?iiMcRp@m+1{euhl{zExZH54H;0rlY|G1VbM}Ur*zkAs=e7&d4GkFEx3UPnQ7AGIc zHRLU>1Q@qNZ&zk&xS?KQiYz=on4$eKp zc`j4(iG*7Z)>pnCv54UvJYU9>R%e<4%<~2sc!&eWRSkFuyw{iNvxUsa8eE5EI8xAa zraM8mtQl1aYWp&P16qWjEnXEqq>N{HSepdgK!*U|zFrjBcyt-MDZ8-0mv6MXtXTIr z=M_TJQ4XwQKdFDnrkco!OF1f?T_vIHwlw0fD=IQ=6GR$Y=J%hD_d2NQWQlC*E?&3+ zG2I;)Q&&dNuN9{V@dla3`T>!pugv4cemvD+WwAX-P8aa_!*c}?yBK|+Tin80H$C2w zuF13^VRr-Ri*D)MVhd*tIyx&?8QdZLmc3{xA}2KZ19D-cEbii3ilRVztVl`)@6Fy* zk()jS#`{cR_{%AvCHjZ+w+-ksVBzL<2n z0Of!eOW$%~Y&kWn_BHTg)q-E+c(5KK(<;V$dBk2pmkVrv%E)U5>Wf|Yw3hElsJK=< z3(bE5G0HwLasm4k)EV?~VM>+k#Lq^h{%kR8{qna+xAtCqf}zDmzHH_PvZ%XrobD+k z+R@wsQu=gW^B`eRb{**-1$QPF(`>jEtEpzcs)pk3B$3KEZ7(=K(tW_xYvVT9PwUt+ z0T0jXJM(;0EF3yC9R^BBgf}!RlzKn@!rL6xZS^0^(rmU&ALlGe8`bX7#|;~g-4)Sp z&l^sE*x^^iU4+on)?9Xw>-2CuA_H-jNo|fK`(q++wNM^wxA%yvYIGxuPSCHMBnfrc z>St)Y@?LkBdS%EYooqT~K;G!>y2NfYbmO>Z%yibj9pGeL){mg&SCt2wKC#xYN%YW#TQyLtx)GP?oZ>V43%T902jp+c8 z*}~6yOv3a$;E*73w=WbM#vPX~Gt-)IdCCIOinA-NW zvvV9!rPg*eUsu2i7QVQxt4BOw?b4FB#c7F#J_K>Owq$ad*qn1*eBZu zjtcgX(aGs_xD;>CRd9}V*7RLq)pdR6jAKz06Gs5bxj$PCaKaO zovEPZR=>MHYFTIYCtM&Geb$yfIksndM1i;LU}2CK7MJamp|*kWXUFY2bZyGO-QwU9 zl5Y`)3VhAw?B7}*QG<9|&}QC-ubGY5&*e$hy67E=dFw~PQd_gL3=2Rm+*+4g{bwQ{ zZu4BMZaDdtEyHx_mDNp4%}4u)`}g*SM@SbsL88TZx53Q*7%F1Rya`&#BZ&47 zqRrwZN>1aF>H1^-UohvB%-Z536pNs^`$`3K{yooW&Qz<|68mqep~N~2osT`-Zot+ z#)5>uWi}Ce`J=rNt63t-xcnOP$1wjL-AY6B?+ti?%z;Zu$XeM!2xQ8ozcP~J0~dFUcb>%Yo054LXbcN8v1nzs-HE#13*zY9~Q{@p1<)65IH5n4)zo2 zKu2Mb-covIyFY8hMk^)twh6Jf;S#5N*8*YN|pivUfMl z-ZbQ;pTsH@3Ws=z@MARluzzE(xWHLZWx3vL-JNj9Yz)m$~leSv}WVJF9SYE)jYQFc3~; zJ)uX2SUSp`pVt7`&y~l>Z9||02Y+nL@nmVjBML?ib7qtT0jJhx_D!yb2ux>wOhSgAc^&qX z>>#Mgcc4?4xcD}WtH)qW!zpTZ{MamSC?D?!ac-DVix1flAVt#*?{iv^ z^^wcicoCp_5qK+xm|)3n`n-O+Jb^_(G=Ga>q_s-kan2Xga_-=E(`qm7x&`>fdFN*K z;IwpnBy4>4Jod7XokEEATxb);cL*)&6YkjR?Xh<_A?fM^WnNd_nkWl(SyO+8y|}jC z1R92Q<^C3$jYP2b?m0(ZbL9viN(yhNN7W#z#ss?1=7K?=e@tcrPb?-z7iJ;Fkn9&C zWXoC2DT%?oHt8sjpIJsCvVvpiiNN1UN_wbxkHpj#<+{=Zlf`DLIU@+g9$Q=_(${IX zJ}Dt>-hI&=8kDH%ij)sk;^?7zi<^$-l;#&IlymzgP)Apy}x=0Trg zK!bT0=^bJc67p@221_>kWan=@GX^dq>G>X<%!b!n8EY9;lxcks;k6SpH{N^s$qI+S zG4NJDw;h5kW>Vm?m!-T_A%XnJt_ z5Bu%~G7g~W?c?g>)fr+1>r%HSDS)-F#Hz>4oB=~vb(ET$(eBNnU35bQ(|Pi)%IEXU zJv0lSLUgsG?8Z|%u zVQ)W7-mga)GE?U;sL32&!#T7%;2#4t&u|2eY-eA}G7q}wR{Nr~{iF`XR$q5WaADQC zEk#iXX98|KnfhnFQ$K5_HE^!gBRIrYsSE3Vn!1I1;AXEN;?Z=N(EQvmX;EXnfMjN3 zgSmdBieImKRRn?5u1R9yaeqHq*=kYy^RmIzU=W7`^lR4S@%9a&#Yn_IuyS+qM}to6 zrJZfRMBtT+WRZq{zl`WePK@c~hlHtNsfDJf=JJ=-rg?ryY-*i&3_;sXH=Hd%?iD~GlCf*%sZ5w*?4(e(dr^P2_s+fa`lK<_KV)aeun27|?)i~H8 z>*e4DK~1vh^z}-OCmuXXX=%ah8>y8;W$Cz-Xdq(48=NbUY;yoi=gn#{)LS%lak@@6 zAH5P{gYO^J){p32TJ5nXVJXEL;}|;HqfcP1=5Sn4zB@5~L3%6dAZ1eVRKB~4t>C2b z^5t6&c106A53B8H*m0kOdxqj$wQOT!Z(jTRV)h}H>Y$r(HR7X(vW!+WQD%Kg<*hEB%t3jV!Nw*E+fpZa%LMjX(RCL-;JYF{ZGtChF|8w|6lvsQkRU~WQFN|QGJDvqCBV3+Y|C<<+n9|QF)|4_)9xQ*!Fmn zfyzUvECXek1%=5`SS!c#^Dv! zdEmx?X}4Ho*sHooG&_?x+@tG@FD0rhCHUOQ`YM=2Ex*rnK(qrnECyqBgfWkS6wRJK z=o-)o;)SiQH=z~*&0tZ%T|-dbSVg@^j-r5>ki1;|7?s@I3R&T}TsT%!lhLJQHiMtz z!q@Z9mY*YRmg59SMI?puWih@h@ER8Z)u^!fS6#TWbwnHm+a!B6(ZC;65=}%O5}zt4 zBdA41Q{VqfZ*b;jdEQ-6d_Vm{=w^@Qjq5>Ud?+lr8k*(+hxu#2v#XTttd0``a)Rxt zu|&KyBPeKe`3=7P`tOR-{)uaKM5X1^MrG@mFkge-ds#X~rjjnw$FYw+pqge0C&aJ0 zGdUqiBm&x*Zhj@pLnZc}qa%TmQNyY*+S-APdG(I0%(?Fm@s10o7Xzk~XO;{TFmk1Y z{frX}cVEe)scVE~SLfUF>hzYC0(S>8@Q_uINAA~7XyH|7-IWaqRcVirDtFkGrjT<2VrXzLgg8e043 zz^>A2eB)xydI%!?pz-{$`em=LQ8S8T!)y}`D-#1oeV8KWVcN-VsmzfT+@a1vr7x|I z1l6#zXoL@1h72PrBZLR+Vbndok{p!M(-y)4#|Id|{xKpq*4{z`+HKf9xYY~@>pQbF z^NuWkg?r*fo23oh8$z5z@(HbXh?>Z>rJR<$j2|j3UyISI`F^ zDUQ&*psoJxF!y@dAj2q1zrG@{h2|#zLR&A@ozNoG2};6|kD{j^gO_bL*|jdh6njy3 zU-8!5>D-zUVY$Dqu zua{BCYP`Kk#Wcs7wxRqI#dUL^mHc6vd~X_o<|oV&FKL)jxDQt3u6foLWC}}dkevZ< zzJiZ5e03!snAS&19#macgV?>%am>WAvX+puN7~<3r!-;K#5B&iT)sbsJ#*nv8)sNv zn_s%`9S6HFRU*Ij6>=KP^zwN-x4l+~T+vQ4_RE`I^2p7J+c5Z%GeGuD1p*(Yn%=1L z%=|aYa5iI`eTeoK$I0udnno-g42wFp*%}8~G2r+%P9Cr3uxS9Kk7}#yrRxC<29Zqr zQBa$YLR7p~hSm~8e(0NG=4Z6V$SuxJnxW!?NyM7ar+m6CR?|>95!&IvxO+upX5(OT1vQkwdK=7XnkN4;u10?LRLk<_{My)=!PG2{CR zFV&h%nkFaBh>wEeZ&VlKHBH}?Vo8I!@v(VDaA>qckY%ct2S@G2?aMX^$ukHH_hC~)ZIvO- z<+5dR^rry1q@v2pP@f{63Im(1m3r3w;KiVeorM9axH1HI!9M0LQ0bpBGww~vr(uh$JYJ6H9h=yy8hHY)}0MYp*NzXW=x#I=62 zJ)wIE0pBNK00v``>Wqv1^?P|F{V z#1@w5l5tGkl9APr-sD5rxBmda^7a4BbX?T@`|S%k<698X$TQ`0XBhaR`)4n+ntS%W zv%puJBV&qL#fqW8wTpnitpdr5mBZuSqD0KGUN9M%uuJ4tNucYbU;CLODP{;Ux z{N#+o{gfZS7qEZ)yjgChu%( zn^sh4=BRi4$N=2meCJ73tTT(okt6yHCZL@6Em7BRWErsPRj+0mZhy~RZfV1O;n}4) z9S<0$qAmg3W>0T>4N%$eNe6d;W>F9JnDvK6CtIgZp{w5ftRe&iKHwM)GAwn`8a@1& zA7zFV_Y_yuAo=SMs%{8Y;>%5o*r%2zIHUy+Bd@Iu98AZi!LOpJxR=h89%r^`4hFIi)T8oxf;ZGH^?;TQa3GRyCE`HyqZi zX3y==h9LvMs^DeDaqp0q3Kmh8OYfPFh^yuN61uO{G&b-Kkuh^fFdEHO)HNBJ*8)WQ zdlBep7TQYL)TbD_OnbT@g85~#9t+-A_WW==7Cc=>y zG*i%nvxDu)>-kuKrZ8I;;JK21LpB*|7yDY-br1eBYa>ZdOP|kE>#BC6o9Xzyrbo(b;7;9;8jl8emXJqzD?^_jaJ-8hHX&-G~{m2XmH?N(U{&3;_D+A-(;$;WzV zjy`(j5^E!~tDdjlZxApum(eOrX^|iE8l7ddbF>7AYB(R^%dlA$$!zU7{7Rx9pPqtW zBgh9MqrCgJK-xMcO^ZP=?ozaB4Nl!V@-%uk`} zQ3s**yT0Bt2y$|_Y75mh4p;?Yk&=%qQv?l>_ z7o*{dRb1jaNSP)o1iuTfYdw2F2}F?2stg-yWj|UThYbG})Xe<~gknt|Ir{@!y&FqZ z>=>ue6LaN38&y$JsVgM=WxZlnu{c#P@iL|JMyHVWSBQNB!%z(9&^D-8mcD2r|KsE| z#NCJQGtJL?ELsm(U1b#DPD&v7(Z+J@-RKX6-YA=L;Xn88@J`0_=Uks%&taJECV`y3 z((LvT0>smO6!1VAP|(m%OI#aGXWYxn`~gWeZjZMplzj=KYw~E9gQ~cP2mt;?U>Q`Z zmXmXym!Jx;ZW9U^d}G2hX^7)TYr9Ti(-^J5F`74K9@{;aTRipa>wCsi!)9z zf1-$y_k#iMq1^UVu!n{tuXa)~PsMYdL>fKueNvDT<;?wIz9<)1+{B({F{j%gLOWL6 z&z4Sk=fMworesC~2`!iNd~H z5l49c)aoT`F0;>A8!YdOsru-+<_~)77i6?^o0Q2kG{8?WPJp9yB&HBybD22H37yX; zY_}wzx%S^pj>r$T@7cwErJ>yV}JVsL)uL^2lBAsR$$lT;9uu9m|Tnm*$OLEB> zlJEL0%N4%AT6dfgKO#5sAu7b!#n78Uc@^eE^*Rgad!z5<_ToiJ)?)Kt-P#bwU;=2y zKJ>*~5f9ngy;2zkB=t@Tm@?U=`%X=S5{%;9k?W}rsU$jEjuv`L0{SD168R@?BNeTG zRjwU=LMlm1*22)6CLyugL*-*--i<|@WfsWIm{_i9i`ce3e@Tqm z!`NJ-)LP%c>j~vX(l4vL#|!bz183^<98nd>Odl9#llE(>n~GBEV&WyMFm;U%)n$7X zXSihfxF|^jq)u_1uW<6Q5wFRgchN-L9JCKsA^DOW4%TYf0#XVNfmi1cO$(dDb^}1`fI~llmL;Qvt=iU@?$eR z>V~<3YD0ALTlCl2yU%sBfwnP8 z)S@~z#%3pXWIoTnl7X!G9E<%#UGUhA{Zk)|3!Y-my;Dp2)0N91DM0RSNWfAGuW#iv z9UDQhqO3>KGk2=1$@xT~_RgFx?QtEebF0rGXNbI*gd4#dB!;?CXAM5ArfOS|H*hs0 ztL%{18HwVz3_i<}Vg~lODptnw&xCRBx(iZ)XlkPli6#OYb^4;|i{mYOj&Gz~p?&I? z2)fTf7hb8`bphD2-<@w9zaSRKGPY95nKCsP2PysMfrDP(Z^(Q~sI@Ke10+?l!l(^l z?w9)vGpe*W!rqS-!|nwUahTVAf0pUHzNQuiAl#9Nn7zjzUH&M7F>alCqF_mTD%jtq z=BwIZJQgg~O2RpC*LVGykrC%UqH-SXWHynNKS=5syf9sw4W!jcwz!p0c+t3T7f)}_ z73}$rzZj+rt1?!tJ}e=PbFgyLp(HpJa0gI~=G5Gf{YPsniM4wEpQ7Xcu07B2|M$#| z*IY5dZ$F~E`?HYGrf8_+_b0A#w{Z>;Zi_eigIK+JS8#1&bliG#`PUR|vBiW|I9fQs z`NGmgy@3Vp2hPW+vu^$Ng~+;nx3vGV)9qJb{@~K&rJ+yjt%c3{LMvF7RE5pW?smiM{@{b6r(@wj+s1Nn*nwui*-p}`)+rneA8t#b-Tcv9He7IHJOq9+yMDUd zj0JLSL$R@cyQ@~|Nkv&gss*Wi>kS^C`$HIAc3ni>EanmJ3T3nGc6txAzgeYjp7)gu zsVhgT+4IzGFTWPKXmP#?rk$8aZew5eoo`OM+nYTG(PZSO&}-M9)u`Y2Xf`U(b(X<* zamgluKDzn0$_YEw(=7iJrjz`thRCHiRQVurgfy_b3}sgWA*Wos{K@x%TEC;n{(Ft_ zC2djjqI2t#G`IuFFe9W?^{L!fy0Vl2HG|5RE%aDv(cvQ3c*v>8=VOWMN4O1yq@NFD zEAmK6Ly@1gxoK}3a+}U>O%n)LYlM?hX5$Ok6rVq# zOY*CAdR}3Mlt?*6-6PElK1L_eMcc#usX5Y4uTTTH3r2U4!&SoemLtiLgoXKw7Q#Bb zTbtsK7Un|&(8h${<}zdr$R(&l^RTQ>Hbo|l941Pmm^93?do=*#K~9tdjX@f;;?4Tc z`dXbXRy8elP)QA0U&h?XP14>rM&mTRYND%sSjP^0PW8hK6sQz`E(XDpo+tjcJ^tb7h z2QJ-+ZzHb{O(Pp(%0ABsT{e;cJ(2(#ZMowl%Dn=CBb=Us4|fuz@&K;r5D!2aB=yL> zx7w``)%uXPmr8u$B2G;bw3XFBenqWCaZCz;wBrn|YlI#k@h({yMk11&?||1aU%S>@ zh1o1p;OXYCTezfO5zQ-W=`bEP9=rxFzmlwO{d<$oK6K>ppMHs}e0lKWI_3~4pC>}W zjD^Un%_4j({$aa@ZGycc z#bF{R;FjsHcS5h>k{-U5qScQ66mb!kt{p0!xr`(xS&ay9U~FzjA2xNP{DF1@XI@({ zWr($Xw;gm1(sTi^3IYmjh{ym55a%IKCD7rg1QMfB&_i;}i3&DERT@FEUY55{8dFw) z#lETGebh)D#|C~OQS438=2anSlDh&P*12H&5XYLm$INn@qoX~7-nFD---!PvnA+W* zkPoj8&dtgp)c_C$`YUE#>Pxj^kTM5K7WqlS$)^Z9EbCVXCM~Spq z41AdYkB8;O9Z%FZ&n|IVNS9FOj5HX@_=Nf+Q;??d!99)G-}#>eo}=p_{Wg`5i~pR3 z*|)l}cRl^&@P=r6A_BG_DU_=<+gG0} znTnWw5+m+4VQ>GZ4f&!u%Z4yHT6;@gO*8pEY)L(w%Vr4JStu)kD^4|A>*4AI^8v67 znZg;5@?I0K9XFLT28Q4E$+5%I5FUI~r=$hnx#ASVYBtKeb|vYxNPSa6dcx()Lx97c zUJ7a(qAmt@5H*or5=#=Q=~nh;ia;)@JiRTvgf)mZFXH)hqql@eql1Lgd`*lgrG``> zlQDclpaL7)(L9~w3AZB$0@3cI45?YS)@EBLITN%BXr_!FW+fuJtllhfc{FliKs@B9 zq-M3GBsSV@=`6fGpN9>r^P%rDWEJyA_ZA7%*+iR!X6|qC z1E>$3XDm98S{)c1UdlIal`sX!xdq6Q7o)E7G)9P2jsc3%QqBa(;7FlS6z@hiMuj>B#;avs+%$Qc1O``9;%S9h z*|&U4P86?XsDs9h@M~Bwf!U0k4%^3$WR{2KF@UF7tTtPT9-Z+nNRKwvD@p|snQ@^s z-th!{=_~tKBM}R*@Gu`&a=GhDc?L2Q3(uw1c$OXgqRq`C3KGygJ7`8%N_B zx0f^tty*oIV3ZX4y5uSgl-9Q_zeD{H>7e--@p|*2+8$Hg_6p^Yes;68fCAJo%JnU7 zN7GD?96~tOBdOWbBRr!$lKAOz6>D-hi+U7u#D&4zn24EAX?%vv!OyqeBKVBn)TF}Cssfng=hrkZrk6DK|CD_Gcin3?rvImV zJ*_!ibJ>Eh^ZKuQZ8GeO$TmmFhxJePXR7L?zs|GG6lt`$O3R)_5Q=R4sZ+#nr+=na zGPeKa^C<87ZX7?E@iRVLIowGmpk>2bip5*$vtMgx) z-QC~DFT?k9reM;<-Wx?aTGp@^%*%MTm+xxrb{ms1j zU*@rqb}{NMh$$|oQr5ZoKRRP+B9_EWgx{Cofaa+y_AM1F97@Rp(}yFEETYQds!ex& zqE{p+78|$DowP0FRrOmSv?kImE?%i_rVWzoo#}KW(t3emGfCfX-pTX9PRYj}-+=uh zAjGpvAxZGJtJ40gB(!!8k?RD|ZP{9nv!5Lkn)b=g%|6=99YY-%Ptze@q~FwwyDjWc zQb+RjMMq!s4OPm>kvb%-kN&MM)Sh+mnb1ehoIbet3g9-1AB9s#M2wk(m)&87y$yX@ zPuwohSWPYCP>!xG44Bu>)vk|kqUq69siRBD zHNzcs3p?W1@{tj|?V>cMD{8o_BY`VL-~^&=X#EmOm{#Jb_Zv=30BzYcg-)ykWHlt{ zzSLO3>ko|yl=b99v%-(Bu8)cDso#;alPgKqnkx3sfnIeciGdjQ9iuF;(T`;|@=3;B zJ{S5Q_Zu|b8GVa9I^mljQp;2mwpV8Z@NcWkQvpypJ^7jzBxZf;hMH`qMS@$Sh%YfH zxMQRqiI@qRrv92f<*rug!@ybZAK&395zZ4? zc-l74#x(Erij54ijh6S5@IxIh8&)T`T=VfJr~W{&u>kP6jI9*xASQkGcHOS(6N&Zn zLe!F#%V9d)PV3u@R*;sI5e1AW zF6#06vMslud9|=Co=aVK*bpivp?!L%KkM6)F%Zabv+)fI=-L>?M1mH|{L(;^;E%>q z`-`M57_VV}@Q%eShr365Qo)<)?;3@qBkJ9Hv#$LaMOsK(RK+L}5kpi9AF6GO^HgF4 z5%7=Z-~slab#F{og$kvxf&I>j0YSU0EsmoTs1>Ts;(#1RopPD52G7a`VSr{E!9>R% zTf~ltF|#Cjfe_UC5fLE6KSjq{) zyE#E`(+8#N&-V28(zHQuhluk%z*TWj1w>{9Nm7e46xPJ-d@aE0xcf{3Fgs~cSBV|^ z$VROsh$~iA7wLN?!x!;q#v0|@>ve=KXDALik98Fg2Qyr#$pwo6Q#y{~6zrOkHQba( zljt;Zmg(8A;iK)!A1(=@@5bx>z`4cwJv z()L1%1oze@QUt+w-^f89JWhOaCaVd@wKXaWf;TGqpck>P(=XJDjkm?EPc8$D-TO9F zZSbHaWINgwg+q=Z9&ssZPRoG`9%8JLsimeVp2C)LS=IRThZNx1DQMzQ_9#!_f^W(> zUx(NwZe(1qV1c(mPOcsB&KXVZR`i9fuCz`m)XO2I4a)+%XBEpEgJ=FKyCrnp+;Y8r z@YJ>$Afsy0gP$Id6LH&OKC)8m^F22mD5u<+pTtpEIk-2>#|#TeG}moH;wak7>1uUO zRv?VJ$p|bBywx1Q`Cm^&^YB@e3Ma?i+6u*0lbKdlKqwC2+kqB{W7h>}24h2BiWN>H zsm9<)(l^e=IaYpAO;EVb$MYt5jJta-OU4E4y(FckIse%1oit1ZO#hyvS*A( zO=ALKc}gyp1+5Je!~^y}K_ko1VK$0Xxe6NzQo&sG4eE}D7kPTk7+dyDU+ z^fd*E^Nit8?Lhc~uTU~uvb4j`H$h+c0{jYKo29T^dWyWl=QwsAQd3s4OKJJmhk87r z&u>jGWscWJt?E;eqFN=SG26;bFxJHUPu(q+{l`u2cEGt(Sb)ORPCFa>jI5aA(&3fW3iv`ww{PQr?fi&3F4JsIAYp=@Nj&8B)M2hdW~mPC(rv# z@#Ck+m?qvfn1f`#=Q$VAKG8;~9&|dlD9E;$!d;(EyIQ5N#e?Uvs`$#RNn>`V>=^J$ zo=O@=g8TFVj7w)2^2Kn>b``<0KQ5vo00&CR&hR&GL`nu}Pke!EADhot9gH;t;x0jd zRK^S(`gIUP zb=SEI=LBc+A!x@aCuH*^pa;Cg)a*bUT;SPZVC24P%B4z6Lln^!9DQgoME$vptg*6( z^l7lEMnT#b8ZQr}!V&yF&6zi?bRd2j3a%F6rI zSrYYBIk9C8jcqhFJ+mnx@q=q(W%lM1;U_N@1gt>`ToYM?al$@vUmjYb2O6=YV~~k9{f4* zkQb!~)Ii!`Bum$OOE*}jRSslN zxs^U3oey(1vp^$|P>YJ}L$~2wD&YooD0UX`?tDsfKI;AnS&;fJC6-w|_<=IkSqifc ziDHlrPd#KkjXm#r7{J8P=5#F#Z?=UnY>Ce`oakh!%r0!5>h$A@$HLl!`1DfNN5esP z(o;>tY3$n5(%i0x6?PN0!KPslLQj3aFEEPmd`OV({y&9ft5javqeCn+Dn^P z)3%Nk<|V|N;lNO9p0&lV`97gD;rUkQ8tBs2LGz#yI?zd_TQ}HoFI9KqqV^9w{kQ(; zN3VpS4F?wonxQ+#IIyU|pHCFN?W9VBDCQ{}W=D^?%oUXQTUn`d$Bp*lqjIw($$FSgjM9 z$qPIV1HV=L1NBHwTaqSy@F-ywPvV~lf>?EVSIjR@zfF>I_!;T^xK)^z^6Q*9gE&OG z*t-1-5{7s1aW?eTHnKtU;h(oG@nxdMKHMUBx0i+n_&Bk6_gCYm<;$UM;_YYg^kFpj zsz9~5I#Y+|*4f!Q3D)Gj>*rgL^mLE@DduzB3RC0T8}2URvgUC%>BZOU$Cw@qdzeTK z_Y_oDgg8@lz%e-VN7f_O9bl3&q$xB>Q|l(kbzzgbZ*vYu)IQW7pmhqu%$s}c- z4>^hA)m+hyZ!V1mI|vnD@FtSw5U3Q2IAgMk~U8i zK&Y4%-8#A<}VjmUV%H)=Yi4 zruWq4EorLrRxZCI5O+xEQ8m=Hd!rcBre+B|)?#(d36}JW7MpW}Om&_izP0h!h{Zu< zIZAbJe#_CQe+w{m6Up4?#z#ayTf>HdM(6ltpZN2KJa}u!N-}D&Nhz_fLGdQ@Mx$B= zQQG8G{nYPv)fM-{PyJV~Htij!!e?bCpFZR$HJ;FCrMWM77u(UxD!z z8h5Mrq$DsZ8N{c^&EWi|*oeyDn}2n2ew`kq=xrc6gRXymB@B?EI@x=)R9Yi#rj0x+ z!v@I*!(zmajj!nl^SBt+t>fU3cak%6Pw!2UPWnJ3w!9KObCD(FRRV(?-xZFLBGSeSis{j~eJV-?m}vj1iYJZoXhx|y)Ul0JbCW|* zZ`yb?wD_)Zj_}6`>{;rT5uO`UYnofiSbv}Xx9atjO$vS|Oi%sK16&?&UlDT-VY$|L zWKedt9PcF7VNN6as=mh}fwKB&qA03OvWQ3XIeY$C9o`@mPeNlX&vf7P(>09|A_v6g zs5RItd%KkzTWK&0sO~eG?Kn4NhoPwM1o^Rb$c# zNhDHxDJv&iqB=msTW|||Je_L)h55t1Bl(z;7jWZ#;!1+lAFy13P_`Fx#><+Nz>)M?mt3-|CoaS0&olu6lM9trzUJ@V{I4f>attu zYvH6kP)^j?WHXCsL;GD02-;PZnECvw3{tNX@e5&U{Ue}gkE=R`W;?1R@B}r;gHusqudmS&UQ#i;5W59} zubRKXJJW9pphR}=8*=q#*A6EkFFz}HECbmAbQt*qp%^EazWlqEXt?^NTiD@NdirV# zF0XB}1@7-|1_VWU7ioD795rE;wV}FN`yAJbB~HmbZWfxf2*J@di#KGpX>Y~=4IHT! zvhh&9wg19*d#(p)FH3c*Q%kP-H-A}(w8pL_0%r;*l;2h6$Yq-<;>vHC2aY}&8PJYw z9@X6jg~(funoOW5FL+f5`x^R zjgq~QK{I7L8suhBOK*)|qvl4Ui3B0Q@lXDhBCk%1&ZA0M+@ucwn=B=Vdq%#E;?#}@ znq+Vu*Tl5@C>GnpHUG|Vz<(-P**%tHZ?!yeaFB?t@Ljz+5Ss@vZVV37h~M|>NzF)P z+VGwNYDl_xvyY=X`X%(iHsvGfXrcr66lSH`7i=5 zM}%1vh~p{L?1W#Q4P1p=n9kzTK3eCORWeWBb>aV=P_ z$_?V_h;xDPo+*CH-&tZWpJHZVvD_8aXrwMH@ELWZ9(+m{tLQ+l5^M%G)nCQ936J(P znh)U;oK8>5y~TxF!MK>^#Jz9#d-MK#VbLFT6~Qr&t#SzqNp&0oI5m)<6eFKlrTr*k zcyL&bJru5iTOqMD^UxzG|5w34o|n4L4j2i#%g($-*faAZslcc;tO}ps|KpaMPS}P# z`$4vC94Dp^Y8v^uR;6Mw@3 zU*J|na>6RKM%&y{WIovdk2v9JvCJeW1fLDC(sfhs`F5`>$H{KS=7l`CmRNiS6&#W~ z;S>+u=ZRUM^tVG2MXJ&<;{h=WR*NfaV3)5daY;d5;Z}K}HWFIHFGYg|YVqUlK9xf& z`EU~2qkxsZn~B;`<(ReA%rDr+cg^F-|LI+EqAWK6kdQ?FczrmfDsQl$7U3)n-Q0AH((dAbIHW|@ z>j#Z(gLjT|Pv*l36xmj2QVXmagX4SSC_~ZX5m`jZTNCr@+IByu2rS2w;`8l!DKo5d zm?y&Bb8-Tsqd%uf>chA9|Qkhtn`v2u?;TC8Jz zBhWs(?PwZ0p(}b_ha=7+G;_-qL27>4)+;R$P}{CrEL$Zi0#l)j3&+|@jL+eG=oIbDx>Qs0hw67#cSqEoQ{qw#W}w$_DJ-D zs+ZbBeP5P#o{HWm`N8261=AxhTP-jrVI-mIC1 z-rsY}_d{8i`N|2)mC4n{>6++;ek$G9Uf+u&Y^{)6`%gM`!Af5n02}*lCZ3X}@54*l z$niRqM7<9N7PpIJs+XWkShU~VCscbtO;c!dCVKcZ59~H^1T*WIQ%`tm8@W ztK<){3m5@@+Q5Z_HBz0-Vd5IDWiN}Z@!Z~y9woC?U0+<>-)Pgq{f{z{Y#p|*IyyPqu2Rb&IYGwww zYbxRF-W?7uJ$mgawO$}rg?pSqcUwqv{BK_0p)*}@J1?BOP0XCwaJWtZg>F(V^t?I- zI77o;(E7~xCb3U?b$6V{-(;G)UYoG51U)JW~RGA|X^fY$wzNdhhBLYkZWam0o}<;juo3nD5J68T$M z5p|6z+zc*R$#UxYH5-4zB|r`;WoRuonnbV8sa3%VJ8F;RQ_V0{AhU~@=Tci-N?AFs ziM(_k6d=gE97&f7*#WiZ)6jK}naf7&bqQM4Gz4Fngp21WVWC7r2qBssvzyQOVI`4-@r*tAFq>+@A4F)lMuWW&{l$;m>CdKy|ny<42**O3bme zgYoKJ4J1VglAlDG*2&e2K-PG<4hd7{n`VT`QQ7SXo}+)axizrbavHfFoJUZ|EG`LA zax<nDn{w?9B%{Y z9`pnooWNNTAj?d6U=9M9YDm?9<)$PQ`K@;~m#IR^x+ii(hPjZFJ5<@kt0cdjATS+1f0(>&Y9Sp_14Le_}O8Q!5<80``Z=mTbcpo zGDcThvI4yXZ_P?H#5idf0?2`cWvj-7C7?%E88f8k*_vg^Y&0lQL_3@P7}ZlXJ3 zB2Q%qrk@`zJzb-p}@p3V5;>^HvnADB{u%`+@{ghla9OC>x`=mC4 zE3Pb_xkJ$j_{)oR2`U>RS1Ckx7k*Y{*f5iu*&q8&E&>}R2w3s9&P2bcPHQPG=b1-f zC_GduOQm$)Bq+BC+z+rJ_9dr6gz)d;;U2}`GJ50Ueaeti| zOyeL*0H(EDAk+U^mespyl`_CAxaI`MwJ%Ly&<0$tvCm?trZ}>Sd#C1Ic9x*?z{KTR z-h-PSCNk(tsKC~nI*Q*#G_Lx)d1bSybpm-{rfj4X%%D$5m zK?3{GcsTbhA_(uZ+&a3s(inws>HQh}?D`%_XIgZc(2q(wo*`F-(mD|i-!}u~ylh~V zHyUHc&{s*%VxZ3<$jk0Qy{|6Hf#y(kbk z`=Ny0G#B5~HGKN_m=ZCNL9#JMj(5LDL<^4N`KN1vd~RwP{KwWKOgm-G8ad7nuS;8F zzrh&^<@J?8bij!1MszF1n_}lZV<&`+zeMJ?nYxYj)P&zAr{Oz(XLq`)^O`+#w*-02e9fMbmBuj*-RI$R?JiLvf81Y3oYZdBZJzv zT&{V}SHeQ{lyOJ)jrgAH!>9tT48=NE|BT` ze-8ScYo#yet??!OiY;bpHyReVTBZIJ`1K~7IT$P90m20}dFBI^74v2iMElnlYsn6E zB6nO#NjSx&qn&?ffqM$`hhe{&O1N7#vy`O{u5@gnY`#IN(#}i;rv*;C(zA#lvZn21!LIvtwztc zWnrwD3Vz=Mm}vERaQ8GnvVYYjGYjpX)nlpu%4Hz_C|3VdF8kk=2AJ6YAGz)He}fJG zz2xx|0Rz1P$*TS~4GHYAK(eiq`T8IcmM^$SJ69(i$&*v8KonLu8WrsRYDp6w%vDd& zR-mFtJ-(-e{sLa5?fjR^9Ed~zlgl6`&YOse_up5CN6Q3UuHSVhcT;m^%dKvGKkC2k zX>I5=P_(BW46m1>l}R>^M<4Of61zhuTRb~_)(rHRs#d{Ui)umf9D9BqM|IIO`H(aH zxu&D@eUfo}AXbrTUVK?rgMhIWquwzYW8AzTUacl52ew-vYGRI`1O&WQ@-W_%aTzaH z`;fhi<2AE751gIbhPvZ9NTL(I-bd$BBfdX2Wfu>7?QNqTNHFTz@kYvz8rN`f(^<`W z0mRb*bvY}ujK4b-FdPt8!t*OxhDsaf*|ykN6}QGt(b%!Go$Ko`_^SEENqxItxFql`%HS$cU1&@Fc*E0O-xEaho+%fZ}wR3%P&raCC}58p#||=Y$Bwv z%m^=tLpz7WmdCP+u-&# z=#!m(>8q&6TZLHV9KnMkLj3%Gkh4zxU`@q|ctL`-zKhxCR^4yJ$$h7fgEmM~M#vA+ z8fOGkr=38lF)>+5$@O8~`U+Ak0u>Mdvb6#eV%BY*$G@N>`j41T|6ha}D6@nl*QC)) zPNj?L2Q?rAC2|{NRSXtGJh9&sLWDnS_woB?C?w8{?e*=A(8%Q;4eMm9c6m{GeRioT z2scF=nDlbp@qZyGjIcxqvR1tZ;G|*pe+UcaA_ec7N9?gLv0KCjVuJE0+90oF!srnNL!=oC>QrZOwGk++?L}}LQFn+yox>Q7vW;`d#13{s zEb-^0^?RKnM})>Gy3Z6xQ4pv}g%zmavTSKUu_u_fF9~KoQP}b0K6?xt&&e-7f~-Qu z##;7`a(;bY*p3EOf*{kxI9@$1G2Mn2U3g^)C9b9<@Ex=iZ2rAhD%XZ7`iYBPIBfi9 z-i9JlL@njUjfUdvfiGX980c}|O=c(Zj4`4v&CqV}N8LJE-HGCY z1R)ZD{!BoNKP2#w1Gl z`GqmRd+eV{;9)M_H{&Fp0PNu z9q*6?n1!t0&GDR+8@^Ekp@k`!PiziBN8z2)h$(-7GBa)Tn71*iCoQoeNw_23DanTf zFeT=}>GUQ}8CtF@JJ@#czU|^9hHv*FLLCIrG5#|CmO<06OI>Qe<&(sYd2U<(;WnuEY;HNg9d46*nE7V$+vm*5yL32*iZl+y5yBBX^Vca?l#@pfs#% zW#vW&b>wEapk%$AOkca1Jm0;E5e|XeFtgMISY-tB3aisyUlDG-q}0?r2lXn=tV*fX z$9USxJi6(p#44`|zF`v1Z;s}%+3tS|-Sww);-k)sPmEzahv3#DtP6nc3CF$tx1N%* zPFZB$Q%0zgj&c+5*7O9%qlM%(kj1{`@4OsGm3iV2wRtZ=_UDbfL<3lP#d%B;kNmE! z+cD|emww`cKGfWHKjLUr2K{ZS|0$MAMLw;XuyHfiT_SYQbBV6IWlZn>)Z5JgzBbi>7Rhx@<(O%Hm0 z31l(MV}z98VLBM^S7VLBpUd{A0vW=W?n-#C>L6qpD0}^xHyBwF1X*pQN@`#?7>x_W zu|sEhWo%NSu$vQvN&r5^E1w=XtWGS{(TcSNHa}XN4xFZV^0(M^i>KAOvtP4&^LiYV zrXA~2ut~EDyk6y&Zyf0GH}T*?Oi* z>70r`HblNHg`zxCJ9wyf^#sb(xoO?KyfQoLT(u;a z@DJdV(4EAR+s?C-WjkIR0e}cf{M4S#YX{0KayWoroo%8EX(@&-4{V>_yI(1W>*9;Kwr;=#b+=x5 zPd~&|D6NlZJ3i(}NqoGZ|xmd*B)kjEa_E8`|}-!OfKL2WC@n2C#P6T9C08MQE|R1 zF6;PSTKdm8(IDaO@udLjLp3|w`C6O!?>2Y-dS1}o;FwjAF?p*?@}Jw>!mY3DZ<-Is zaD(^n@#fQM?}qp+#jLvQ?n;O@R&ii@5BIP8@_73Ly2t3TK?6;pkG6pOu>1TSWAU-> z?hi}4mKuF|Uae)IXqgc}1J~@s+^#q+0=(MDfAnEdY-v=tMURw8t@$9RqY7RC1uYY+ zD1VYaB!Xy!P{@Fm1~yP~h6hkx1)QTW+1~dzvDh(Am$Igv=v9uhFdL1Xi5&crMlw^Oys44;Xg%_F5!MS>}&kC_n0AmR<}kSQMR6XVY;1@e3u z1X>e1p0=UR(aKp9W18Edr!n5 zOA)A4UUioT+*`N=uPNvNo5ruXzj)+aYwX-x&O4CX&#zZvbLG47Kt_a-H9;Bop=7-_ z_jnhy>e8&Jr%~t4tYCNs%7Zx#Nq`XoX4s%ih=lA}|H+h&s*X`YXFv|bJ->Ah&x=Xv zQ+e&ua_GVJn*!eFh5>CqrYE@BfC!aeO%q_^!Ns3r;BDyp^Td-!rfW0 zGbU=An)#^u^w&G<$&>5EY;6N$era*^FPICOEkq5JnRw`zP2$t~j z8IXBCPMXp}D8`fhiDd@-#@cnzoE9doVN(6RSZy>0Y%;v!35#F@0CSx@^S)^W3Apwu zaXyQkWL+r7Yy<$6wd|~AlajW9dZ8`G{+sL$y>>7eAS17w5Av&>HVo`SeTcKBwCa<> zB;_MYFb>dKx4wX;ZxhpCyyIO>KLEP%TAJv#5XYiRkam41Nl7qZbA6gf9(Y{PloH(( zwwS;xlt8nzjkc7(+rHQ4JfSw_Z$kghgjQ&zcH$|C;y-lXrktw&D@}LemKablnq26L z-2u;I-F&A3-f^D3baj}J(y*@C!4Z`lh90&g*Cc~kO_R$bPJ#9y2)6&qMOdu%V=`h+ zxy^!^M;N!xXc7Yrw5Mh1C`%ZsK2mxJJ$Dq|vZdg#se%$u5|yd73j2n%Hzde;_0J|nl>FAqZq(Ks^JqTQ5ym!791xHyt^GhjL$A*SJkIM|#O}TA8-eu)7TM{m((fq>#<_05c&p^=kWUh1F*$b?WBUX-z{o#0r&NM+2%xQvlHw>K*{bnU z$NDt|;ze__xxFr&*e?;aZ#N0wJHb#a8sO~=Q(HZePtV+MhU}#=xsD@|8c@Yr%$LIs zqrJE{%ua))B|Ym>TZRAjeMnogm<*u)b$0#DP#fxKsO1KrX{8FcqqH1L)R`K&6LTK> z*0A8UbZ<2ix&Jnh9kytDz?4&!k?6@%QE%^6L27HZQg+Ev~Y_8(wVug9&C3f54nh<5Qdg1xqM0xKwLrD-S4(vhj|vS>!u)x~fI;GfmcExOXy6mYr8gEzYYCsoR;-to-Hf1Lh z7s}Et#O^qzcZ8gJQfTCm=fE_c++up#g61f*F=uZUgg3gbeNy>4B~$YxqbMpcQN>{~ z?aDbEUA)pecj`#AvVO4WMvBT}KW6nT37qaU;(oYI!9%$k(-t+5u`1Wcw&J$eA1N_h zOpdo?9fHTzf5aj(vU+jeNV<@a8L9KAo$>NTO?00n5iIP8_QddQVnPfp1X8Vk)li(m zO{s0t1BHj6{s45bv#AeUJHkypV-8mx8Z(^XIaA3CT#-}3VR9H78P|L8Vl6+sYsl)v zJu*s_;I$QZzua^1TU_y>-Qk*9wMF$ecm2ky^vw}Ax{2r$W{l~N2vD--`rP_X9aAS$ zh74KQ+%yu3Zb{kKDIuGE<6LeZ5-oUz)GM+|^AMq~w!KUy$`0wt%?ghUKTyWtq}=~m7V)Uqok-M=#h)^{ zT74*GrR7R(%EX`PXKb^rkm+nm+D?qwE4?W*>A5n=aZ5z=gi}6nx38PvvXyMPQ^|6K z-PwGOMSj#PiW?>j(cJ2B;3UbT`K1IRSQra7rc zW}SbqU-)#Mj~qE513~FJlaKMPTqnoN|HZE-?XU@Ld1zYkXWBjt`DVhBc(GYK&q>7O z);AKl;F-U=|ALj{wCQV#*NvSpe8ZACu3>I9nR$LT$+PZjc6VKQ@mcCiFf!T;x|Z&= z7Ie{U!EzDV3i-uDbf>c0bK}8jkQgoqZX4c)OFFUG{tNBe)zDgly6M{csq=eK9=9Oi zi8+JhnE*+y^j55UG6?-py>vUEg<*A3MPk@;F|3nSn5>L~C2>|uZnW0j_jXS7{qEZ( z$!JT;5j+VEjroh^wV)EcOwRMLqD9*a7GPTV^;q%)P^Wx;@xSTQ|EgJ!k(K>_l1&=F zWK%25FWK}7B>(gSjBO;Ji<8@7K2v>4$RXZ-MqQlQ?L!ffM6o90aPx>NtjC^0B9T8T zi$_7%Lu>LYA^)Fc39m08(7%08u~T0w!fgoy_cupI0S=rr;^uDO#&-?O{7|Et*5@MCrY5~Dd-Oz#~S+=lC7qS*9g}snC#ROXF8xy zDtS$%P50}FmIJxDDOCkk)_6~x9qU8MLRXR1Om7D#<#Z??PpLT}Bfd*b4C9$bgZo)g ziesjA+**vZvo3%MjGz|(w@(=W?11q8AD>c4A-QO5Veo?4R5^XM(XNDa&x+cdQ~Se7 zSL*-xl-ZpjO)(BBO7%>VOuyUnxFG-WDXn>HiHirV=8v|oRilA3kq;Z{*W(ZypCM>V zoJTb}Bpbrt7ngCyaj*WpXgPcYB=pJ>G;zXS_bFjWXG_+LfGZL8Z)j9ZjFf~{deWRE z)|g<^>Se{#Qgw*Rhhwe$Z~;9J<8pJ)sclxJ4m&$pyGYZ~hnlca4uW&Wj)w?%bfjps zSW>{qs$0}bRAQFV*fGas;lM?>pHJiRt7Y%20r6V zT%8a}RrXD7xXG5(JC_dJMLzWr#o2&#y5ORIz>9(iLePfpkij99@nhb@DWAkjuE$~i zqvFk>Df#d8{j!W{Cen9$-?>#qRF8_mXy#J0g4CrEW$e5Evcn9|effonj0x>utR24$ zuJ=|#4a_!vkzkH8&mTX!HRf~EtI~-30`fAR*PQ9*a>^Ro`P5kDm10v;*R5(GcA#c! z69CmgQd);RocvsXbi2Q`1I8{*xmRMIuo+>yd|XfIpQ(*CHZvRlK9s2=NQFg_&dPc64pE z$@ixLRUH#CqigU}w4<3T_`VUjJB%251wh3NxNt_4NK~bh1j-=nSZ=B|D_2V36DqpI zU)v`X?py8Z z`Y;=hNB;UKAA|ZM!h6O7lP;dn`7TX_vz9vcRxB}ZLEfRK@d*1}9>Nj=pwQdkkgp;CCf{Hz z7P8g@nxcc3!fySqxB!Yi?`U}aquXj?6v+$W#-@CBbY^^Zj_)>aVCc=b5<4P{V36U= zC~t((Fexie>MXOA6^sCIx0DbW&H31;sxs@B2&O0>c&|amYXnci8(tA#Lh0?*NKG46 z{Phqo8A`;p=NYZ`K&KCR%g!9Lg0MzOWx_{E1$;2Xg4OH5J1|EpUdP5GDP+Bz zpwV=|*z})rq^R*NjT5=}MCcI?h<@>wcmj?s6=++RR)RrP7of{j{ff1E&+s>^eCHD( zqo{#FRp61rz>wOtHAoDKB7}tPFw2&`4j2USz%Z*ev%drV1l95+Aews>%XD*mf_loV zOoHugj<8QYEN8fT4#|ln8~-A%yH0g>31fiioVQdrKImF;<(vvmL}@D8lAJv4zG^1c zjHvxnTU_+PLM+!bsCpC4S5~4WZDsTx4P`>G$)aVZJy4wWGL}y5nNls%Rzx3k)D$&* zpF7VH`!aAslqGYBY%1&rUpF@5-tcVEl?{^n)dZi|FD1p*PXA1bDdqaRscXQXUZ`_$ zX94)@9;J}ehNUa|*`<=;ykWYWK{THiW(|bVDk7^2QCf`y$WIaHGqr>qT+xW&83sT% zn8`RHXnu;oaJCdS6SfbE6{|SWz=XAR*Q68(0$~bc+7PvcBxDF%S_p3eSd-K>G_h}9 zz1;t)egM#NALEwi;J+jz4(@eM7{f-^ygd&8oP@X-Z#*>KDkUfn$iqXJwkBUc!$n}} zNjNlZE8;bmRfw(iVe=nYj%1j<)}b?8%n(C%SK2{Bb(IpiO`K#p%*HSaM_-O;8dsQH z8=lteCc-?A&KgKgC0b&O$vR8m@XFz?WYKv8WlLx*s@W=7=?T-4(b%wF+BvsHKd!u6 zrige%2EwGuja#XlT8WQs;Y7jp;M}h(-cw0Wu&YKw7fU{hZkoU&7`9lg=x<;S*;VYX z3>clp!7wGkU*#aULGO(AkPND{0WaGh&CxMcdr95vQ1@rkNsmXdo69u!hT~V9{P}VB zw(X@FpqHogU~9M$l;;CG4!h}#-@!uI;Tz+^o1|i9)qp~A(APzU&c&F44B>f8F}A^Z z7~r@uCaP^TC88DV>e52)zKSv1nD(n(+j(^H5A#g1&wF8toawOFr}B<}gp;`7pv49* zUYYAld$)RJbXzmjj=RO`a-egx6lW%a8U(XsL}44L2Qux(GgjriV-(a{gQb?05w`1Q zux-vc*)W6^jX!-(+Z9)vv<&02jW7FIX-BqnFFAGOlZI~EvY^Uenf*hnE+|>gHl$WE zPukFHUQ4HAFLg2GIFA>kq;cC*n+;~gxGs(jxfM?0M7f$+5->i|s(2qSE{e*O!N=TH zp^5gGC1Oqk^Zd05W%`^n`kWDfYs*1h-=E6|%v4wM3Q{}uS{vPz2%f#_>zU&wmSg{H zcO&0ga{^=sI`)WtMB|l#NrlK??*lruh7G^BybO3R@*6N6FHRNd*YRdd|s7AaU0svpe15bnHZ;Me2H^=}(eJxrrdZ~923U2!l(*qD;;a$t|taAP9_0y1!w6q~%6 zY>XF55BLq;S2t7KTwtm-j+fw|xw(h?*JYib2~Sryk+NeJMN@Gg`}t(1dLLkd5Fy4+ zqNQpBi3NFIpB+B{h!qRT|BHU*`0wg0*%+Aq-~Q_Fk-eI_4QA>K!@yDvxv}24 zsp+OcC$d6O%lx;R=t9Qlo#C*^py&Jh;qf819IK#HT!j3@DocVF>ghI7onI4_*ch_W zMTKMH-W3$>kZ=-75Y0M__?PW3iC(d;7B)6W>nB5Tb9wyDPZe(R@ez}cY@9^}+907N>b{5jrBu=6joyC|HP+~<+Fv4k< zQOO)gE4p{jS>n&ECM0=$gTza3>eZ4@YBzkTq%ZAaRZG4|Xg4SCz2 z(%yu;Y@6`h`%F|>xE^?e9MO9U6JaF z2#8B@0j!sxh|uWkC+>ol*jZ0k%A zn@-721X&b(6H2$az*BjlVIHCaR0@b?DJoL+1FE}>C;=-vDuQio3$(*%8hBAnCirjo z(57=M71o=4Iu0ZOgQARMJ^_DcHV5M#tj4;wlv%FEdeCW0;aGSjEzI!H8x?VM_S~6Z z;6adp3dP?b%-EB0aZu(b=BsCUwj0pL##S?*B`Re*4qm{}0nqF|#JMwTIF9(m9YR3m z2+tT#-5z`Xe)jrLrwMNpj0Mf(Xs-%_u~>2o{Y2ix`U150v-PmRM8T+KeZ;fmy}0=0 z$QxWA8EC%YuDE(Tk4siyB7FVP^H$*Kel3W)nCuKT~Zb3#C^Ru=+mAqGV_X(q@e7FTrggvV+aS$JZ7Nf!8r z@eCN2$#*jez5+-@x^{VZB(xM>h6rtbo7T7CI(at{4DTqzXBg}cY;?+uZCkqj`StL^ zSr1;_JQ}e0;ulnK8zP_Kbi~G0-XcZKVKEcGLD$R6_3cKjVh-ae-blYf>_Q4 zKOm>r&FetG>w%cjy5nSUM-Lbpa1CPyUav;gz)IUWkKoykaZeNuShT=JE;G=_JMvgD z#J#zI(fp99f~iH9*e1bzrhH(w%x9T&qdnZ@z($w+H`^qZ<|Qnw#DF+TD6CJjp59>; z*wG5XTAH;+NFxWJX@n#ft%KG+rC3c8HHi6<$5tiI3|tq6yl!vmqHQtr+2Ls9!}1m5 zvV;4rH4ZQeI4o+cypD$WDl?>W!giu@y5&jPFY7 z%k=F)r zt{QHyg?vyPTyvoXTzC$)NZsClrECXN1Thi*bsXZ*O_oG(x#K1!Ek|4FZ&H#?-)c!}3)FkMBB8Rl{>g0Q^3#6&yTZ5g(PV(+#Q= zQWM%FA779m9Rmt@qIA5-cQ6~%>KqLzmV!>a+I;LCQ%%xQv-aA>11e2GhZV9f=hsQ0 zt{qtF7t-&kl?-FJNnTM4VX~^rgtwlojOs;ba@pMldoC^vMwP6H*WyYk5c;NKDa*+v zPBfAA^4Y7B%>lNfoD)jDGgww*F)Xe(;udCLC;n6$r&y6sS56RdrO!x<+I@z5DVz(dK@o^rBr%4cOXBZyB{NDHL({`G?^(x7EhZz)l}tCj=MfS zM=L289JSjkCBV`t*A)-}vjRNu7@`hqjoF8LuX*Ep_GJh~aTsIU)b_qNiGVc;6P`I?p!zRq7U{AS>7iB*{TyRCMSUbX%}S3$kZclwH#^8XEOo9%FD2L zKew0U)gdD~B$tH?bMH!PX-I6a-rF(f*mCWpxwcrgVO5Kyv{k(3)YBDUWj^ z8N*%4ipidt9<;#en03bc(3I6Z94daD^q=ef!v&H9r#X>A1a+w+Dl+xiLS)i0b&;|{ zJGpVEV@2eVWD!=B%dMMitcbn-3JKhJeQh?btJJegFe)4mh3^6))O~V)QxqG4;yJ}3 zDj1p7A@5H+^b}7i^s0q(w$=y$(J=$nh0b`dB;^N1&pl;PkuI928v9(yn)!Ti?rGAE zlitZ1<}%Vi63(nxx9+1q_fdmVUl=(Lb|%_-k%N{g22-YS;PQO6d|Y*@v`JVyjMt9F zOo*AiSF&I_PN{KjIMph30HI-Fjo7erwj&RTGY!_{rHKkw(IiUb%=|0OmH^dMMDme+ zInbPj8Il}6&WlPs-(K21nZy{AARUy>B`samiBv~@V*}PpGmE=b_P-r8&J6AmEij9& zcD;*$6@jGg3bT&|9CpKlGDh33*zeBPlI!6nCJ|b}8QFvB+0dlv-G<@Uy1DdCRYoqiBjsz$@s1hBH%3Zaf_Ti9* zWk@_Co`aCKp!|NQXUjYyQ`vbi)s&4g%h_hNB-u}IvR2k&eYFJBu&S0d(N3OSFc$=< zRf4zq>E*s|L^oJOg2dM%4ewQ!5I z8(DK8dXSg%&|2MvxMlr3Go1ddU#QP^8$1@Q*%Zh+Ub*pbH>Q-|mA4%-{1&qpn?#d+ zoYJZ>^PQ!D#VNOd(T@_`ddrCsuyN$Ze85l=tCzA+MjFeHz|qd4JzL{h&dZ?!zzG11 z5wYSr<^cSCe3o=N%$>_FN(HmD%0hNYg;U`XZ4S04Op#?;g+;E>a)_R^ zQ7lSt+**(Xc8H@Hh5tz}?5J~9`JWK^Qag_P;u-Mf0*XC4#MCx_B$>_#!xV zXrlU=XLDkcUH$d+y4{~dc!%t|BD06!Y_4_RD2$p0P*hJg#&Gyeu3S#a;*d%vDc1f? zxrJpzFd%W)fYsV7K3azfe`2zP-_q{oJS;WJI78hr43>giWyM#UK|W)Sm#>H)9Isvo zuDwrioGUKAjo_t5#6z>5AMt-Kj51DMDuMcM zHMjaMGofWPcz+(7l$Ju3LlL$-{jHod6~ey7AXh!@-nYUS=Ct0CuvK78FgD6O&vxPt z*gi8OfaXh$dv!tmY>h z3NU&?8tWG^hlx$ANGX1(&w?m2rl_i$UL6Z^p`O}ZYVx-p%LTyWXTNi-)(aKx;_>rM{fGxj%&I5h2l z@>ln1YzxQMjqc5P9UkPs%bK;+oP zQSx4()0i__A?PdEersVfhLT^#Ql!a9yTmp`OzCL#|vrh&zYwrkskTnJ`r z)`^uXH~jztw9wcg`p7<^<>r2DSwpvFx&8a+)!LkPT*lh&($@m@I-RmV`Z?ic%GJ#oaJL z<)Iv~c)Oj}P(4S@=-4jc`%1}Cz_%OiKV)7PCn{WM%4RE>Wl&}F72NY3I<~JQp#;&q zat@AyTk)Ld>jO~^hIGDep`Ya!o53(k5CA^s=1At7Ew6~<0W*~Yc7u}@Kl@2;{FX_$ z9%>>udq*7)-t&!mofxL0G1Anp9EtlE`Nq&ee*(iy3AGN;$V+8=WN~d^oOE|C2D_Tjj zW^){WdAEs96&YPUi6M)r#nTqINA->JA!Ut0zCiOqKwnIOvHKXv1f$*rAuo*3PQqO_ zgqAtQU&IPL3-vq#E(-*vwB3Fsfpo)If$I}{v5?i4v_r}LpV^VH6ZC`zaAQ(qE%N66s3xUIe^#~Dd!MKuw)buF3z zx1}!_ur178ho)-j7s=(v$(4khn{Ok2AfN5Zz-kHJPR&2dLw`aq@|Dj_wcYof!W(*p z%TZaO1~gTN&ZfBTyP*8`G&t3iO=YkG0@m0BPAm<9k?8D`n_-G?7mw%|8P!G zx-orm;RK~G?US<6-F_O+FHa9sd3<}md%t(CN&5br8NT14v4k7LO2RLU6g<)%Qdeg2 z+W2AzuVB)OySj3Y;^!`M%b?oWa6owd?&_Y5)FeXFqnzb^EG}oLO;A<-M@_%q42|i7 zQNEacjd@Vdy&_)g1a$;=6#k)1ad#bwk)TS{(4*1S9A3vqUQ8gTY4+ZAR$w0tZpUi&MN55VPi_8n~s zaLfM0*h=jn!Iq*@w(>1C$o@p1;OM2|+f-$EL@?Erm8=??4<3gS<^d&$xeu#hg3=Rr zN+nh|-IjGOwHZb`Ur))g%92&j0!`?dnggBntfV{mOEjq5R?~Fexx0`{Whd4#TT4ss z-xQSFhZL4^8!9Q3j~PXg?03Fu{DsWhxk1@EJR2%Yo-bDIHX)87l0-0nwjT|aovJPB zn-=pd)gzd)indskdf21F$-lBg(p+_y29-33BU|p(1ri~Ph2m;`2ycV{q*3(=_dil<%PA zP}v^b>&~)Uz&LAW2DV;<9MVIN{!@0rtxV9Y-)@LnvH#GvUGV?YES%-Yc7$mn7YHUB zGGtiJN&#-U6?t1uW_q)DI6z)_*v?AjYmGyn3{MZy;y5o_=87j=P}p|AXy)Skw4nuZ zp#6$fe2k92WtDPE4AX^;XGq*kmN&&fgJZ$Gnm=YmC4bE;Si*19$eNNDXKFbEO-n}C z2?kl>?ruRC8QumlORSK9ec~;?cM5NU;Z%YbU)4wQSCTMHdTMMUQ7SbWOkg#hY_ZZR zLu`6{X}Oh5g>8(UOkCc&oiq|<77C-ruA|>&@|-&sa*n|n2Pz3|%`e*+I-|l%(pqUF zlIZPj>PwmFe#yT4c^EaE0RE|6Mcsi-0J{BAAjXlRcpbb+1cUpKRgA=#NoXYwureLZ z7^>s_xsuA?1s%bSaa`DtwAF-O0>BaB52gl2bSC*^f;)tKih%B@Cptd`$vrV)4hK=) zL?JO^o@Dh4s=a$BzgF&>Rq&NnrL*<5;WYBX`EKXFt>M5c@`6dVtIQjDyKebLA#jNF zOxy4SvueoL?6%uBdjQV>STy0QMUb-riEh&J&|_rlMV+o>pp0!vA42q)#Uj*+(a_9{ z^rNJIWcjr@mGa)D5M4w?Iy`hS{G#L)ViR8#%+at#_{k6z7Iu|NhI1ItkH%-j8vKBrinK9u7iE8dEBi*s!+Wt&D&q!NaPoA38YsUhqxAjBtgy3T`2Hwht5- z_scnWI3NsdGw{%QqE*Z){%&ycP0B!C4>xHUw^?4MUwq@lM|-aP-mtPUQlBbof4SSR z3C#bP2n?OGBnWCi@?0Vu&J93)iN_`*#4zMM0Kj*Bop48yXTJA#JH82nd6hpDB-)QwvM7%iAoDUc*WW0+$~aJa zMj^8`Haw(VeDdVpS_-D1PEdB$W|B|^5Zn!rBfBn)JE^6)F0XlPY5OAx%Lukgvk zp7qXVoh`HI#$0x=x!%P0iv8&=B|7M8Dlq2X*?0`6?baz^zRf70$HIc+MgZ7FdqVZS zP3GmR(4(gwXSb?+lOZd3EbpWt>(|M>n*n=fW+D;x;5H%yZCS>RLuzN%t)t(-<;H3@UVfF^b~yzDz(O0X=`0bf4N{a*Xh;fpBTZnrsdi#CeF#V2=^}S| z$5;Ql_Hi-+y>Q~%jy#6i7!FuMkXR*zn?yI;p&NSiIj9*^agR^j51BQ#-ip}JfF1O1 zU&<@qf__ug5y}m)MLNW_w1~w5gOc4m_$tIElY$*AR)r3Qn>#R8&o8BC!RokI9FfHv zY`(EwWrvy>03Sqa>$N3 zw7AqK9^k_=Woq78*2FTw?%e2?yac)kr#i7%ud3ZIfT%Pz!FCCAKSIyZ`y1e3$SFtu zO@@EDQH$_w$*C1Tal%{XNZ;AxqO%ONg~hcKcDdW>8W4YvWZlQg5m8ZBKwJYKSxN{x zC>dQjek)x}b^;zNU+YcRQ?H08g2oB=5*>fm0$mx2A)pyC1paS+jSNtT5mzsbG0j_{ z7gqToZiTne_TX^Cxpt@-R^8L`1YeSi2Lj5AxKm6tNVNgjf#H}a)i^S?^qoZd)9P4e z1E$);Lt=~f7BR*}T}X{!^O!xX?q2M5FcZw_BkbXdiS~J_KfCKj&K{z;(1Y*kklE>^ zw{&cG$Jv057wjurakJG722s1gk!M+ME|iT%^mi_AnS4>>y&~ zgn@czv(U%qfNzmTC&&M$vHm;Gg_-{UtFfx7TM+)w9X8d(o{avK&yScd{W22+*5pi{ z5L97*hb_{`-qK}e^936nF4||{Si$oj<@V7GC@SuEpTUqpwCOb6%isRqnY}mbmv2Y? zd9JQc(>H)A;+9Bb?$2*S`Cw_>_}~Vl>s>`wbG@`zb9M zw$WLiuj)rbQtsb(jxP^%i!k({sF+7yenu*7B0S9VRAw~*6TP8p3iK3W-}9mYg%Bs` z+Cml5sL7*~ro-`5@=AIM$jzNXHTd;~S5>ti0n)|EHqy6(ce$1e4(Xz#S^~BvQf0ON zF26y!*E%-9ZT8v~Q;!{dL{{)oc9RHrcGcdtX7P!vzt>rknIc66@+9-6(7H{yC;Jv- z1AZz~__NG!laT|OZ@1m^Xxgx8HH*z0oR!OeetcypV<>S%nr~H@9Fj3+W;t`L#%<=b z(9IgT27;c|HS9gZjQmu|F{j_I!~=yOwAOWrgN6RyM=SL12>0GCwogngq-Kr?o}uLe z36Th*nD1_f59pX5d2L8!m-ad4pX2^Bk;h?#A}ycHhL6a9hY#Se{G-1|+|qO}H+x2L zp(4(hTRA-nP8pX&1vkXsADijCpAt(MvD=#(1INhzqHNh*#e3|yKbm-4d;sT7ppl`_ z$CHPIr`2|W9E{Xt6cH)RVNz9enBS240!SDHMw+CpE(x1AaNeCNNt*&(f(OvXGkVI#3(q_WCDPR&z9g`97 z#))u|2+#gTrcp}9nxESVKN)%X64{#XCbz9%At@u{n|AXl(kFKT@`W8u8;RVu>#-}Q z$}xYC6Bdj_7I2t%{%F_Zwi--P+r1w6 z?Iids?P7OEZiZae9o+i%ndsP}V|($K0BDwO>s+tM;UglBn0<#)BD1fdcH}9)k4%xQ z;zZU5x^!%Dd*|P2=Jlh)ZRw2mX5>^mmy&_S>r*DdnL{m0v*fiAMSv2Xh`MzZLWC}> z!N&7F!18do^bVk2jGcMkA{n`PZHvPgcfJKuh9E!`Z48>hH$zyl0;MB4kqwB>xMj=f zX7C;>k@-}cw1T|jPv(J};~WdBt5dV1sTX*eck}uh5HH8ZxOpZp>&8){ z8&=Ck!}+tH7n^A4&0wI?1Eyb=vIgQee|!l5WWyckZ@pd%F%o!&$y(-cN`P7vge%75 zV&~`J0cQgaElJRwoi*ciRJ!Te*b1j1^4_UB+m)I7VUB`(0do1fm9VLVj3e1LFN$GV z;1BT6m^8zp@PZNrU#j}iYGv3?sC{ifXW{)t%aZt!oOEs`4--Dvm--T&zF}IMk+DK; zba4bH)JP<#$`Y6?I6E&BNI6!b`ACXbsyRq{UWt)`oBgS4cV6(8oak?bR$wF;fQgh3 z$hdQ5u|&*H#LeI>B75pGwE{g%41OYa=&c50!BYGSujzKAB+xPbO_kWw>SpY{V2!qW z&dPnAC^(0t7SfJ)wE8>5`KZHt!fD}zvj%exvb|>y-&`=Y-qtGl9Y^=!;Ih@u(#@b8 z2!69;fAOOm${*e1$Mor4pXEMf4E|@ZtMGipwv?rt<~jpV{PY8hfEtV5Oe_AFP3OU$ z4FOjIE}1;^xzHwU!ptSp8=MUnkms(jJY&>E5H-@J)pV*Le5+dP)Dad{+r-R9iG@y% zhMTaf4eum3NoMbZ2t6CUAv_srND7+{3JMdl$bIT0BkvG!0#>1mV$|m5TbXJp|BfCv zjxvW4tNU`qznw+v;wDx)xa-UOu9Q2`^Gy{M9qr7!RQgGo5~-aC(f3X>5_-#H zcciF!){*Ksg+2uVZg|)=Ze!?@zy<475Ry)>)wWG1=)NSZLX4)OYMjp@;h2i3woj*nIAmVlvYH%g(_ut%togX%_&1b=nM=d8l+0)coXxToM&spa*NIgg zCRcNy5;rD+Y$DAHx+W7R8OPLU9bJ6Q@Hxaf$kvN3%+Re`oyHlpeUkVH%_e`qO2i0V zS%wWD(v>Of-BMC@^t zY~wVXa0$@yXiK}hB+rEsX>yDgUx*Yd!nctjE$}u=Lyvam#um4SxC)BRO7dDf(?uAd z^z-6VFl1hTU{?pV06P+8KYOUABrdHD6d&rm+wvfE&CD>7Q|Lq6+_PO3+ln^iK>~Ex zRI+{gx?WzGDY3c|pW#P}Y7A|rhqlsHOM;m)r*uh`ok)weP$xVEbjz)<0<)`PoFtCK z510}enRzcT7GEbHrm=Fs{DypHyb)K@*-&vyc0g?x+jGxXuu_X9=?It+s{tVUq7t+kp7ETTPkfUp_rNO_G{wMFiX(o^K0i!cR{wK z!fMC&BkTL!l`Y+vR+3@iq@v2^(klNSFW%4hZ(z=ix@Y0ZAku&Nwq3-n=*Z%h>Eyzf z_lIE(sB#s0Vqp{gy!6tJm>bUR)%CZR28vys;n;F=b-xa2do9T{sO1Qvy7}mFFnGO^ zkI7Eyn(4v}A5uiU5cQ<{wvBUhe_9fU?pLbaz6ED>Iy+JuxA%4=Nlk92bW&e8Q4`Qc zzT9&4CEj&Zv5!1|K8)-=uyGqRc_v129!F9+hUwrmHb#kdkugja_nyX?9;EeNN{|c+ zuabqhh!ND!(nQ7!hXHLsZV4rvB$fnK)OnelebZ(--ttpDfVxF)ThO*0`AITSUS9H0 z$9-j`O*pj_4?^1t-fT3?H^u+Ds)>OAmJF@W>k|xw9a*3#F;2xArJr28CJa>0kC09l z;8IjTyy;7^?oo1Ugx>n&x1oucdh$+mG~i+!>9L+Ji&q4y9=<*7Cq#F!L+1&tOGQc3 z8=LjPHxZu_x|GGr6*|%3{^0K7m|{hk&B7GIztsgYXA6PTCg+gNmztdO+TlJJgw1|L zy7$MzH&g$0dll>A9k+=i9}X-!N2F>vYhTn(X7Ea-<=ds{JCOeh9vPmhij-O&Ep%(3 z@kvsBK)#{}VzA@Og`*bw+lYBw8IKx(PJvaGx}zGXv(!+pVmM=UNtdDMdtwMT@lksW z;^-B0&HuG}4n`@j&R`K|p)!Vh@zpY}uC2=8$YA2&^2bNh&j1)t8<;(0%|mVpU>fst zD%{l##{&%Nn}_XY_7qX1+@hAkz*O}rng|2BAo{JJ{5}2LdPau75erX&SP}PyXeC!8 zUuEG-XFU3H#_+EdH@>B*DVVjXXM4DqmkD|N1@NJZroqK{>2$Qw#B$mwa13<>z-F#N zgz2&kAfCj8qdt}Wh$$JW5`TZ9{{($E}S7iT&(_FVZ0+U6K zC$IWl|L#=Vhl|(E0qZ62^%)C`(1+5mWC5axiYy18kwSS3j9Zmj-<12S+))uQa16FB zgrtW};X`7^;@NtLuTWU4MT0BHKPEz8-gOIp`mHx`c}|vm@{Y>@Dj6|~jQsWRQ*xiB zHMbjlMjfm0CnTII&riyLE*_my9<(cje^sTjPs!4H5Bhp`Mzy6T8(hVl{+v6)Kd-=w zgU~t0tD?E@@dy3T#D2jkTSlm>`mC&gIu2ME3#ZT> z$=dn(+rLQYE}P-wkC9g3$%aKW2NTmcn!e*z(&bwV|zZJhBEqvrL z2ycq_tHefiZ75kp9LP3q3{_W3MHN<0P>?f1zT2(_7%x=U{>#Z+0FqJM!+ft>pl`SU z!ypc5LB)zuTtIG)ho)>lY6ZLiouhSvYIa&{$lW;~#vKIh{GJP0o^9k;*oxARbTX>| zSut23rqlJjA*?IkJ0(@jEnv+p$ww=1o*<+gbLj0KuryJ@hY8ZRc!!t>;i!^l5`w5U zUSB7DHh9pry54Q}?*|kPoY`~|8uvkj6u6ums*n%E9(XJfFaT$Gc2)ySH+!oH%mX7du2K=fN&E3X!Z86VMM7q3?&Nk+^Ca8_xgA$2 zkIov+O&vPq5R_A=rIr=lU7G@>F&7@xd}6y*krM7ja{N8^9_*7e2C@Me=8JpwvBRy( zPP}T$3Ir(yYQ_o)FY`>aMELcTlBmmuNE)wl#*?YnXgLQ7)x_9y{pG%pL^wg;e#x=5 zuN+uprSHS8WUuJ79w3C}dmZhdDCqA&Z12JJJM$k;p ztX749O}|1T0G=deSR(7JC)DmcRJhH@>Dyx5#iX08^Uu)?n1uvp-`Y)?+{QXvSe&tG zDTle)fSh%>g}AS$H?KU7B_taawDBLFnmYuKc_=yJt2s;o?C#eSViRQOS#ExN5mKN zmVsvnoi;aM4R-4TkkIbmJ+AH;h4UbRu~i^ek%lfS5;pWRWIA1?hunhP?7r7MZ@1#f zc>+N!FJ$h@k3H?Akz5tz#v9}9aCRsczo;0>D?OCboJSeUKx;_N=DOfm4ne%EtPVw1 z%DYO7m#wd_1QKW>8O3yNB>B^ckLENMSrojI>(-P1p^tFsjIiwBFKgByWNNdqM%HR5 z0Z75Tl~xI)Wp=RtNCjCc)|6pMZaGXWl*{f$8g7tr&P);bIOta z)i%i)YCeO*|Fi-~Dl>tApoz6u+2lf|%T}f(@v5+QuMWj25a-Gj_q>ec%K-{Htp|Kd zRv*KLE*X+EL)*~gndFh1tul7LKP z%*|!>$y9^kNhzg`D+dpVV!ANL(e#p8d9`Nb+B$3%bLI4qMPH=IRu42KH z*?Bj|#rEvVE$OlbtSCcJyftnf>(Yl*eyyqgn^i=ix)XldoFO#p;Cl|5dS3VSjt|2c zsr&3>WG8Medy)4SOswu(dxhch+T2reX=zAf$W<_1@S9M~PX8w{+~U}t@1*Q)l1?J_ z#23v?+$9~Y;D@=E#oHdmS&KtzdfG%hVM2s?fob07ec}h8%xvd>S!ZNs`0t7qIavOO zqAk*xh`DTq**c;61U@=77w0QL1xx^}&pf;ipgupcVvHOk?ZK1(U5`nr=&+q7Z>7;h z6pjxKO-kKC>ni;$N!3fKEn+D?y3@3ICHeVwZvF1AWEJlDbZs;1(LhP5E%*A_*l)Ie znw$UXN$sKQ$&O*v`FS*aJJ7w%U;4iod#5hJ!nMgZZQH7}ZQHhORNA&}+qP}nwr!m{ z-51?okA1PnSU)13cg>iQp}a5|+Z|IgUBTA)<@R$ZBzF2RJIA6;M|!?>@p_p;C!oW! zHRASt8rw@tdR&~A7CPFKNoOYlZFjQE^n3PORtpGL$9;fSs}+O>4*$q<@wD-m?wEZnTb&HJ2_+ebd9SR+~fHX(=N z#IR=mh(ar_!0b#x6G1YA-rp0nMB-P9@Yu9;7DZ& zr#WZahU(I@rtY)bQ>2=g%!Z+Qq39ie2J5-k*l7lmh%NAVORjN#KBw{M8~?Qrd06Op zK%2^9Gp*w*o5~J7K3bUgHH(;LC1);S#lz=TsbDT{|{;B`@YS{*>)V_UdmGX}@KVRXS~?k=?R&`|<(SXUVUA zJU*N|knhf?;O|bRWb9^Gxt(!(k;F^sF{cwq`aaVZx+baR7e?y^ZHB9W`#B|#yGtiJ zB4_i6hKCuIKfPI$w$3QwjZLr~r>AC7#1|;G5C-?HTh)}l3u7WBY~W|$8exk?i4%&A zgX$vDHDMK_c8ziOH;^76-P~R1j{q2ea1}#PUr=)RNS_h_f6I7AgUQk6CIEYWuKKWb z+owsz4eU>jZAx z#me6rb8_)0Ti3$wNmma~I|y+^;4Po+i(9*1r`BJ$+iTCjp*wEiVq_ljw?mJ2q++>kfoU~K&uqq2Ey(F%0udo`P|u8>bPwGNL{ zlFD9;Rt z82{~gJV~AuyqqT zJePQ@Fmz@aIgHa?M^8{mHnuDV&m^Z!S4Al`a{2HoS*g|E)yFxLLq|o>M92+i33WT& z*q?KWOyruCotDppb(W{yMV_uKXs=CY%w~@hQJg&TD&IRd_BU8lTZC?TVki1Hmh`p% z#J6s0DLU_t_R@9V)i$QHdyg~2f`SylZ7Ep(7Hvs-e~Xg<{_0G3^KQX#3Nv^K_0mLg zM48VwR_k?31~!C!>uAThARhJ9C;RDQExZ-Fdt`P!=oMa^|?or>oML&Tz1WZAmXE>X(n1*|>j5|J0DUMwaI>W70+VfUQr7vqZqSd`>^ue{n zWuVo~^8xHr!XR`F`_V_{`%jp7Ql&Q&Y27CvfmO}pdk0KNP$`+0L&ale`rn4be8n;D zAw%_%WQFxbs_Lniag_qV$eR3g_!kH|&D(Ex;b*(w!G>Gtu}w(UmoqbB{VCSh<-C=r zhA7A|oiV*Bu;W$`KI0cE!Lpfp9hXvAZP^gIGN}OxCX?d@k@xTSJ*|q7!WJ)WD@Ll8 z=#Tpd8gYPvb=1)lOY{(++MRYbttImw$->a8^av_?U)sU%z z&#cxY2@n&@cK>W&VGl{3?S2xkpQJ7seDQOR=S@PL-pYWvUk2r-t1wHdA?+5mLqlIh z5ai)?gZI;#aL?lE@9oUk-vtAxg!~l^tyw!hrX+s$RTDuPI{`(qxh>ynecaC`7Dws& zM&Wm=6oiLVIZ6zHgJ$uZBp}H+wwxYn)fiLtTTVoJT}>SqWq?v0Voi{4<4qfi*J-qP z6wM0yWFsaYb4;Wi&ss8r{}_QVWFoz&2O9xvlp8eU{wugC8T)vhV0`gw;*lt=4gd^3 z(Iag)D3AW>ayO^Nj&SNK2ADN(&Pn$1ez0&#>j(!vAP_ZQ`M8PFkHd?T%@hg(_^mzh~`H%~b z5Twfi4@(Jt+*@-99N|t=!-WE<-$RAs?FiidESI=?Xtc3;qo|}jSD)&6ndtDH06AD8 zHy*boUR3-NJ~@$FlP;7hdh0>=XvjFz-&jONJ%I*uy}DoXc%V**6|zPXuGo~WJ_QV_KcCE^kcaM&!H8zEGn^pc@NhjooC6;WKuhOa6i7oYCFW+A*8a2-F&E%!l~@0 ztYb@Kf)SUb|4G*KXXa|i?>I8X9zWTTJZk7EDMeV-B0#kUreVn?cSe~Bj_fpqNpT!& zFN1Yp{+0sRW(>0z3%SQ!XiP0$9lk&{WHHxHw`p@_uUAwXZn$z*jxZ+{P#kI8{`N9& zH-E)AgR~I}R*bi@9vc~rhI_YCA|FVrwCvQ~H_f5d^&ew!Rve>e>7O&b2==}X-^+y7 zeE)q9P=++en2tW)nkMe;uqG3Uk&mrH2-mr3=&A5rh)R3`&a8{OQ{97nI(ih<3SO~2 zV{vb>NRcVI9w}5}3m={+-cjeBZq`?Dktc5o0Fk8hNltCNl)m(@3R%LG_2(OU=It zPN9ibg*uWi(ZVEy2sKIQ3`P9oOpXf29>gS*M9ySMQ~c?NiJj_pwfHZ`f-B6LCo9w_ zPmo0tRy*vas_YRTU93bEkS08tF?aQU4hci+XM9}bP3nodt9iyf&n2gTF37a6|ViYVO^M#qGc z(v%Zp<1hyjjM^9gdaB0n)?I&WkZf zB-rztRlboP5McbB@!NW<#Y|)097%BK(dK4=`eQv#a0Q5Y#T^mlj_?NOSvOD5BR_tEqXw zE!p?i^ZoPT@|^ncQBH3X|F-~5T|^z2TF)~Zw+MhLwRV(`x8EvS=A^XKYYgCRt}axcoToIlvEi`7KRR&(r4cZaa8Y&l3xlJ6dkT zROI#i^br};p5>adriRX?wL4h#C3a&?ELTsz&&WfMy(|{)Y3<{P_h|A#oA^3SIY`4c zNAy*bU`E`Vn~t|;blE8C@<%!vQ;1zy3frNoMZQm^{o@a|bd;|RiT8-`22lc@H7O@_ z1)_X#MxF>^@<<*Y!#^>jhJ?qr;5CvWHZyT(pT#V*b*=>lK@etPL^g}hhOLywEL7?8 z2&T)khHeoFIt1r~tq89QXf(4JW*klpxbrzj&*{1GwGrm8n2InBx0wv#txy2Kv8=kI zmRwZr`py>A-VziMV!S%h$xfI|$_v=2^f9DGV+>e;+#BiPzK^L%Nh>|6AF@EYwEGHN zQLtCu>wx;}0ClD}@#Yk(b1_8#;>J6^yt5;zT-x{|0Nir6uxCvl{9h5ow!aG5hs6^I z5gQA6`FG1}QMy5r^_S6?d=yIX6I|#f+M=EGP)8OLsZHXwZ^q~ z`}QVnkXwAN9`V;=lZ=ioz|22q!+KmvK+$JZ1Ba{=f6i6r$4_-#Yu-hGi5yg}iS1Ep zD@I zl#B7nLK%SA%ozsEED{={s0EJ^KvSx7zh3JVLFk4j^zxeu7~vAehkF$M6p);^Npkqk;F>Vuaq;D=jLFC-aFKM_5$wTG7z zC@3JF<^wUiaUQWgVSo^dC!Y!5<3#_O>dbXlk_{X`{9?`SId!4^=a{ET3g6j;zFr>k zgipG8KTjBcIWlLj#dwQuPrKYacS{EK?&nC#%48tS=U|VrD>G*G0+q#x#tMOrb^FkVh{J8m-f^*l+SeW{yJK31*s`TSUQk)HA`d6utzsiG<$5-hX1= zouZe5Nl55WnmvjTJ2Zc6gBwGla{nMY-=yK3(S8%wr?}}nXBd|dsYSA{)L7ozi>z~o zvdnTv^1=I)N)`_RebK9fz%jJEtS<@@8=>UXkzuMxU_p<1zfXo1Zfja1aJF&;rQ%Os za-1_bXg=H{oD8O3A^*S%Z$^I3C8lsnV(MmEuyMac7TTGENeV)z`W|B-T1Z@%?B$A@ z|3y*oX~BC{nzp}>(>ksoKpzHV>7)``2Ct4u@?P0!DcnH&a2y8*ea3C*0Tx#kZ9K%d zSdt1EQd)mW2!Abov=R5w^~DyBYJyMA=w?QNHqP-;ke8e06e}Ubnhq}wl{!%lo6VR8 zUBxocf9mbwfixQkRyDAMUZ^u-B~g~b@j{GfZvRhh5?9Z)q{A%#{z=QTAhB3+6%%Sr^S3W^*McJr7>HWOmrB>qfn(xX~2Nu$ezLcCY5@ zzk<*(4IjG$*@DEZnXk%6aEPMNbzD@U*GQe*BRz@X9Ae>hz3oR6{MDlSOuS7Cg)N>& z=$PEI^dT={*6k^&^C;CK{N$h=%#i5^91w@*Bbu@ue9dR*K%!7#RDo5rNby&IU7E(@ zUy{bHC1dWYA+)R|f=Gt3yR zNE5i?C@`$l-71x3By;K`egr>dyL9Sp#ko_cjPOUcas+u3z2fr;BU0Jb!_rDd4g8~* zr-{?jYTfU>K7yq~@p6}4SG>d%4MCPoEdt}NBjQ=-(Z*ao!qhaXB1iRpmJa63wYC$- z?inNKK*hpmzql(yuZxmRj~~RySXt>@nG?HZFGx>n{h;1(v!18V=56a{4TW{-wOc#R zp*8vfpd8$1-59I+{Yy*d$t>f@{!-V5@P+bm%Nbj2))NbTbZy~0KjZy)6W~g6>3z8# zJ~Ez_d_01i`(zpO7Fpilin!e*?&H|f^S4+Vm7?6{=i<;eVi`nS?c((!lOWr;2{jhc z!Np{&d)q-jA!Lcfn#!$YSWIj^g}$WRt|^2y(cw{^8hK>Ge*R#A6UEos3s%)K8cDMp z$)ef}uPc-CE|QJh(uk}}%Fe9oQ19YQTbEyl-`l6KgFcdPn&HR#F*aD2>#tmK&AE@( z5h6*B#a*GcSa~L09JZLWQBTjBHO}Og*nKHQIca{QdMjfMwO$014RlGN99M|8Je5Y8 zkOiR{3y0+uuyTtA=*hT3643X0Dju{0n{V?mdyVt+c2moHb5mZF0D*PmUB_ zQJQjbwZ7k|);QnH{pL9TRwDP0w7&aD+zeqqHhAQb>_=XEgA>%JnOA7* zW1MBrW8@d+rOkNiiIt=dU`RxXIXK<7qNQgAGRj_U3&~_nJ4)2K(9lirWV>k{#wUcaslvH-iCETdBc-G_;QxrZ|tl&I5#(Zm_G# zI~;hUU6odS9diSc$D4b7QcM0H1xT>6?AyA$$**~EaBcdomdN42tZ<*D&w6N8p!yH! z3E*R;Y5oZdjRZ>YBhMPeOD~JA>N2=H0sOOA%maD?duD}@i2-(pcnKjh{iMxfPW6nd z_W!){9pW&y-*fU>zi+g}$m#^n+SzOl8~X2;v|;Q0CVK6{7RD(h!67vph)i zNUPA^GP|}Z8sF^bBri6J>*Px#L-YW`7045mhl zWfN@kb^;FKwE9!^hy(~?AFq-s4?N18DEn|tL{U{9O?D_h+p)Fe8iR?WIoZiO&M+KJAR)`^ zCQ;UA`2-e3lf!05LsElY?`>#_wa0O$a(9#%`$Kqw${SXMVxLQwwsP8ojYiD{!eX+~ zfP|&R9fvjik>O2bAQBDCfixi81Rl<_!@aGALJI5B#cCE!b*(Yx%c7kQcq+v+MnI1! zc&b_iqj0(9N(ori$?fbMICR?P7TuVhu zy2zYY2`$3|5u8a;TK$r<(d5#rJIlEY@~(bsf^p{Ep!@W$%MfItlEb!=P^#4ToH1{5 z?D~VMdNZ`{AyOV?TDu%q5#O;NZ5RU10T`RjL`#Awf4(?DenoDSLR?jj^sy%(I18qG z|2|Hi4fW9Wd+gH3>Kh1neboIs!Hyd|+^i&24#;N}&REj!uN_b2GX9LLrdCmtVCK_*E{)A-i=Vt(6QN?1 z(nC@mw|a&!Sx$wIF1M{UT!JF0b_zTK$cm+J)gw!UeljLqEX%wX)2q&DHV!e$@N85unoZkLaRkU`e)lBzDT08i=9$|s8rC(#2B_@(I228i@ zMWtIYUU&|CzvziPS$T{2Q-&*fnLT%St+TyXMUdISEOmBeW6C4~m;&r-YkSqWV3bj( zI`zWQ<8~%okcb9qH%063nGyAV3BN)@+C)P5aW#AUqB>hkQBWZe`agF%drJU0C}J%0 zTm6DQeyh46CJAuaQ2dbTTw1LwwMvP{NqlXt6PiM@ddigKsx5Ht5D2tTSUkO& zNh}d`d%VdWR`H+I^%bxIszXwXOjMzEpdtS<4Kc8UW?~aOMA5dX6l7@jA05^JuB=e$% zI|+VhPlr+#aEpGUH5(txHJ*dg9&Zy^-kCFCsDmdrkA|TQtUkN>O|nzOQSxrCjWlNK zWTn@2QQ63UlZ;>FmA-i;J+G?zrf1cRj)?EdIJFXv63u{!hy6RmniaNfJuQ@cFExS0 z>q2YHS-?}HzH;d*M0u}5+bE285+!b)J<{X(f8>T6dRmb|xH-%jEDY4^3~DCc%bkiy z7TCYDNS!`3Mi90glS($UCciQjT=31r^#l!q$YO~vp109zV{_;k3Oso{UqzIgb_IAi z?zsSV@ui@G#S?g7V9Z%!3GGS~kkJsHVYa~WF6U6kg);WtR>b41{P@adb_DvmXdzL` zme-nvjWPWKxNM}Ln5~xN3#UIsWInJY(KZ^45gE5$FW^)Y=N?i>7D&r-)@$Y7y$%+a zkq$3)j_yF~lu@a?8vO3;rF0uXIRR5;2h?fgS36Ks9H93*OW=}=O%*;?`%H2pID|Z>~_cXUFNoT zjNP%#vJ{PJ)@bbAZN_L8U_b>!Fp86LSd+%2(6t>VS}PT22bpbvR{-D-n7gAEr6qhk zvr^uT-?8Io@j82r_RpF#N~&W|M5wLJ;JaouH!$%Cg81g_A^l)a2VqF4aHX|o9P>z* z$B#-clwU32fs+H*zA1*emJiD>0e@+meNtZ07=iJqL7aUmcYFTKNXU;dOfi>^{h2uZN%YnmH=9)_t*l3S?M(7lQ4O2`y`A-eChA_t-$av(WRz8d2@&l;$iXd>k_hu zf)vIC713wTX=!U3#?T8&jBBmhM$AY<%@A&WPatQ^AOPy{aSY>O6minrGs0=|dSVjN z!=(JqGA~#wxl>N39+eVnpt~OB(8c)kOy){Mk3p~HU=PO@j&+oQh>n5&_*=woDKYMK zYx|%q_Igv|MBxB5r9J6Q(}UO&BbKretNo}YZHj2mI~j*n3PzIwSY)`55b~L$@s3}^ zd8WnZY#cc}>uqyN#KAy@TPQ;PVBYcDJZvJ~vx&3QXp?wAN5f!AF4FATo}Sa!g_CjZ7$udy`SQWzNO^hBB}d1D=E8#gmA5No3T}tfN+6cgNsDT zH{1x!1eB8UU+s_n0y;MSLv7rtC@o4SEIOF^S5^*@wYW>#aeUNhdFcW z+1#r4XWzHHltkx09T%+sm1cm2h5di3NT*{!N)i8o)gPc>N?(7fPY@_tjxw*iML4Fe zq)(CXv!rx)K~bFM=eip!g(Fn|v{;Zw6kJr|d%PR@iyYun>(cCqARav2bGdv4_4>kH z<44Xhto>X31g)A|pwkui`tfF%fy8F!`L%ktc|VSu==r|D-N0Hi30s_Uwa<|GG{ zrMZpm?G>O0^NrB-?Jk2@vs$ej9GRpl8bzr2b^CQ!Kx{1lN}zMho-PcK{d51?hyRVg zcYzG3L(%cqneaL73277H{=80wS>Uv1FE?C1(_}J=nbMl+(cBnHtbE8OqqAgJrIh4G z*ix4B`pE7!vn$A|SI_qX?>Bn}EC>+(>Mw0xFq=QF-1RxUIX3_u!GU>okgCcLr)fyj zpmUZ@L351oKlM!0ebaPzSsy9|w?#yE0FlI}=jILBCd!I>O#u3z`zqXBl4ofb$nFeC zqc}fUB2J~3!&|HZ=ru`88B=SzJo39C2?#}A-l8U1$?Ia~k}o@D_m%uJh@aLJHs_*d z5xSxvcn|D4?-gC|KND+K-q$QppzoqqfGx34e7T9c!kWPC3^}o9Zp*=<2Q1Zwdmi%- zG&E|MbW#pL7K-N5tcu~u{4~6~ksaz3Q7q(^WJ%E?BW##y^b0tP=A+Tay4>Y#jkZ#o zkBMp`5t=LlZ_F`v9s>s3fg}d)qR10j+;rhjtfiSpPSDJq5C{blAjGtFXpw--WQ~6z zL5w6SJ%WXuQ6|)zxMRgHW0V(WlotX3$}=Q^>~rNDWWGpGaz(Vmx9=emF`^EL$dM~` z*E_}W9Gb!*~YIDaDHS>)1At=fHJxo*K?+u#mjHH#BzYtYc+9b(j|gr zs63cwf(E9(8vB^SO2%LBr5RiGsmC8>{gQ1;l{P!hmqgV>l|jo9)(|Ivf(a4>xd5js zV7aDsIigOG;f%|B%645gYTv_7CK;oVR1Nq;NDTw-c3#C_0uFPA$W|cExmI;LPY8{l z_X!G`Df4p@RE1%5=@613&Jv)FeX2O{o?=mb;qPYMK%)S@DQhcU`1tPHL%e_NNAW;b z!TZ4%!qx)!zLQq_#P?CM$%q?hhm+qb6yN96j>9$a?xd|sn=isXA1jcaPbKY8?UBzk z^k5Zcscm%9WzD}VPcZcHsqjXZ(2MCSUNWLsH2himbc#yd^0K%Z!(a})++zDXGV>CKGgbTXh>XJQ|V~xQ2|IM0MMSux-xZ&Y`if z7wpLSXw9Jm&y$YeXsKGKoB8W)Y+&@3mKC058gIoe>bERCp*+Rf4J<+58zu#Vj96$u zu)F3l}{R$@_{~mCO5%&Y%EDomN3njnk4zn zc_Ku(;NJEd`cY%VlXOKjchGx0@`UX$7A5JRp z)kFQ-KE$TaS*jaV3WhhqLm7}H&Rn7!a~ey8ej~7#lLl}Ygg)u_A|fYP z*DWt$S=zv+6mpl8-}#35%vQmgDRG;=+U^bBzL|e@4S}1E%4Q1XzfXs?O0UA9&B=GP z`VlRW&$HwcK`gdtOaO`koS9tCpf%nUR;yhZG&LhRBy@Xo1u4u&=5fOtSguxzpauQ; zv;W&YQ80f}c+}jp@@$zcf=z>9{-QyX^zxEr(kuYEN!I)h0=W+Dz`~P9Ts?b7I?o`* z#yH?|=-v`%j^1k661P4;tdvPoYgC@6HUHQZCC0GnhBj>cB{B*s)WI?Z7Epzx>FkW( zxGVS=pCje?WLPaYEXk^=^2?ZN3<=?8$>veY-H2wF;AfMXz1#9lvUb#5PK|&HLM)7* z@N)IY=S!_)^E`XiFp!nb7i<6lBi*!i=H9P)18^HfgJ+QdO&zT3=+Bz>3vI2_V@W(B)4miy??H_XS%y3B>j?&wnoXn@kS82b zni;5a9p~MTF6A%=4VhEYyp9?E@Y#J@lVg z`$7?4mXj`AWGi%L7+8bOsRI$g)Lu{wCU%Oc|5TP7StCswv%_Egw?@ zzjM21%zg35P(o`6I^82Z6v>f}aAQq!9g>Q+z?+((vJfq(Y%z(QC4^Anr#-Bzk)0~f z_Gf{$bf9bAdW^;88wciEOD=pkS@`tx)!X|Rxu#f>M)we?v(ePj&2*RD%p-b)+0{R~ zQ?##e{bM4C{W$*dIX)$RH%r4{qPe@=xqYZ!Y-4=Cs$$t3k2lxn)e5=ZZ=>&+rnA7C?N9h7IH{B) zK}ndh?K7hg8#2Jn`6o<BJ|L*2dSXS0t+}!_;LVyKltOzQiJliYK^itQEe+80ckc3nz z>eBKV4aUBGeeQox7Ff&ryxVa2si}^VP)7Iq>S{wwkWuyiHhvksTcl2We5cMH&-yk) zn;38JDs_OZZw?950AX$)EWZ>&z{z_{{(ZnQ(ZUI*VLoa^bCz%-4Lz*CzQbT z1+QjmXxP~&_e_X~%vIOQj_2^ZrTW(MG^c*PQ~y>NTl`CkBzelAPLZig5wa(AeY4aT^LB~C!p+(>C@9^E583X-m#ywKiI zATS_*dS9b~Zl8!_D=$BCYB)}o9l@AIqd0F+A%&Py#}Tkbf@yGsaB>;051i}dl#esv z#l!RooS*<#f2SYC$f|nQ?j%*F-Ni3Ik4n>@K9M?t20Nkpu25jAXWNZrX|X{}DqM79 zj`@M=cz{ZxTt;YqH-Vvt7DP!deF;KJRI(Xt@);SpoPS3f17&I<+%E!p{7Y+hZUK!7 z>Y@Is{2b$Q<;}@ zmpT88+eehf3|iRdpDpWGSc={er;qV0u6xLPaj<99j5r;G*V;olH=_!A99PfsQD3S_ zh|kW5&KOWS&(_1PWzBvT!; z;VxA>JuM)NH6B@b$Ri`-#)_J4mQTo~!AIzGZmX%UHV~Ff853>ng{|}~Rz+%j*q=Q$ zaSV|T7Jj^)#nc(Vnd?zbwyhb7Sx&DW8O^1~c4$D-CTYdzLa$re?768phwN1WoTHzZ zgR5IXTU^!*)mKIV7aPNI>F;^@b^Tx5SYTfuQ%H9e z?4d&x93c_1$q=&TTugKKO%2A*>4oPtto-$zFQJ8=bY3J1R>@09n3&T|8PT@xX4 zH%uM8kn`EE!nh4_RYoDyLE>sL6=Q`0p!3NTZR%0ho?pD2GfyEEf$fTvkLV9R%+ZaJ zb-ZXSqoh?Vqle$V(HcAnWiu?DAkXn!PfWJg6HN{u5NLQ*`Dum(`mL;PPJ#c~@Fezm zFM~XM0`KI{%L=~BDt>OLqSl?@2^x$w_H>kQzqx-J5=q4II3_g74?_|anJ?)P7hV=- zyj7~)bw*G1Qgp;ZHKzW4LCQU^_ht5V7?L-nVd0r^gb zPkrv-6B@o=)3y}|{M+h6y;SAjsUky2o32V@RvFQf8tD>gg6>o!h40EG2u0_6l2>?) z-Ho>7PdmYmcwv{(;95g_#iBIe!8{V$m6>#(!xhIzRc6G})xxjoz2?U*=nyA(Mijn~ zD{J-1R%03?*7s3k+D%(VI7||2734G#1bbSRaQB2Rbu$$x#bs#?HZJMUL;?5fRVAGw z*b^uR_f5+qai`RzXG%p8^P=HWOJ7k{hEbgx)qidb*CKJz^ID1cfCW2o#2zBhv?A-E z+AzQs^2|XgjxVh*1{X+_XK#PsB@FW8)URF5-g#LQ{FN^;^pzRiz+N=W&pJnb${?o0 zsE+~V@94f8W>D9_Kjx*bHLW4eao45XexFu7hIHLd6hU%@a;WgvVEinUN2O=is?FpQ z!7sCjf=t329eJo}n$gc12VF~c_87qBct@J;@=|+;9022|i->~Z__;V+Rq_St`;Q$j zf0}Ifq-!6_=5l&}*}uP%YgYL=`VOBr0emn{3!~xGtg9`0Ogyz^l;bSiVxUaWj@PMs z&@@1IX~(?cEQ8BIVdihY?+2g-+b285QS=1uYP_>{b;=)RV$s9FOL+`k@X$3gS<#>x zOXX(}A&pf28j=or%e&{=Qg2F1^jAh{E*q zjqE3QLX|g@1JWg1x+YVK!$EZJ+$N(J{NELRGX+E zGXhKiQLmJrS$|sd$9%(JLSRg=2YKA8NP5QE?*_mG?Ot&iTOS)cx~!rPRbYCVOId!P z1J$5Y9GstFHO#0XCkSwKrb~J)8rYapyh_}nPpvG!NHDgTC0nnJHL*c&dOuhsZw>=4 z`Tafwp}p$%m%G2#Y*)p#H1mHlakX#|H=LedP;U!^I)n5F#S=iP_^B!@$EgyqlVuy( z6j2qe>`2klNU+=g5lZ|k9d(3=WTVNHrnRrgcya1EU=W8nfIo+Z-+FDj(F}4r_-$F} zh|lYW01#1?wJys(nai_%n6qx*n^P?q6IQc4z-i{pW7+f4-Cre>o1@nlLsBzi@M&Hx zsXd$z2AZ@sWtky@SMl8R^bS=cpx9|13BMe!)N8!ix#a8P;@}k~l!KEXfXKX4Y*6c( zUwn0TgmF9({FGGXz+rPj0?*>^W|g_>+(c))Ga^Q$6!vz8LbgaJQp`ddw(npKuR7dB zEKmB$)=glGdV*p)3ZL_AdX}X^-}Bzzt@sPWzKDC{Bz;Fdpb9a~L$ZelWul>})NT0v z3)#HSB|I4-nP11bxr>}7{?mv8f8p`^=SZ>DH!5=97ZIJQExjmUcM=T`_jseqM=Wn<7^UPir+v(qA#Fa;KTTTh_)>M)l?G`Jw5CH z{XW|L59noXhy4fiegn}&c7Xn0K=0xz>5hK(+cQmgk+4en$L&4PNS=ZcC2oUl=DpoWEFEyp@0Xtn>JCQDi3aeV;mk)mFunmN~iqJ|79n^J;kfuAbkP z=E9q;^Zq`$fBdWIK{icr4xT@*n}HV+q%EF)cRnrWM zWtYW1uot{Y8W~^egi&@&7q`TCuj~%5kkl|Qdt6NXV=qR1%IAE2KP^1IU6WzS!4ZT0 z&giQ+NrZ)JnF3yeBA^~EY+{+f-u6yM6JSqp_P)P&+_lr(ENce#+9312ula&$P1((6`7=Ili><6!nC5 z`sjZm+f`syd7s%0S%KI63~ljJ{&m2e@UeSLJ*9UJy*|INIu-O*bCak5P|@`#lYTn@ zf5_Csv?1rsvE2_uA3ITtt#}@sJS;tbV?$Ie z#d|xc2hmT-fD`2M!5^4D7eVgSe+pP)|7Sgn1LNvZ64WH@tD z|LY57&ojee*OHl1r7B0xBX}|{{%Qe_5#_Kx#g>$CI;#Pq9DqdMH4chBcn`3kjgm$S`edHtUI z#(waHgdw*{I-v@0Rao`EN|d6VYXjLUaj#eBxXMfNnuV+KMq#YgtML}9-kM8&s%nlE zZdnI^5|}G!1rlc%VFRo!0>Fe5BJ6|-j;L%b2i~E^C-{woqRIlof$Dw_x^T=91k7=u z$|R^v-(A^Q{(F?kAd|}^nQRe(LI&|StQV(OGiI)b7Va=JvYv@RIk{4I!G`DG`qpkB z7`cE@xYo`BCF^2~fGxJ^%CDP+CpO~x-})JulZ?4J9`U90!pf5~*!;xgY8bwm!X3~; zprFJfqWM;#?#6ol_xwU$!A>6QEpQnps*J~Wf z7dw-|qD^jFRV;^STp4#Fo>}q6?z@kR#lMfR&AKoEf}yIY3`>BytTp-5ho2=3(+;&w zi!npe4Rs=vd8&wROw;<_0XVSa^XC*9?-QiDEu?oU_TZz(dl8#gq=ynF*m^X*Mrz#T zt4rrZd(lao+g}V8TxtsGCFll;zd5BBMgil$B%uu-`V-^J9KbJ%kk)LTP{8Zp{2&-J zwhSh42ya+j@!42U(O=9*Fm}*)k93TITLOb{#)=?FgTI+y3YQKg35-^*U|1E-XGU0~ zj39E8nzcdjx_DO#Qkn*ES`U9y*HRzp966}&{UsO1?zI&(( z940%WCY-7No#;x@tLoK?WrvbImM~gBe+0YuCU13r*pA(4W&;3X8NUx>cJa0QhH8sn z4+Xk&mpXekH9IYkn{C&QF0k5P4mfPtatc93?=MApo`&CEcJv8!a|1Iz3zhV(mWU80 zZK?A9wFMewbluU%u{udd-WVLxOR80Z4HG^v7e^xrn!S0VBsRZ{nx6;*n7uYV-0ELO z23y-b=!a8+zYoEp_!oGCX>I5Ho#AtnY6$xpP)zhv3ew7M>Ep*<=nXH3V;1BhrL6lF zen?$Y50R{;M2kV|{fGNCx?>xBYj3^nFF!d%fiO3VRpTipD%%e%eVy?5lc$x%KzO0c zc)-JL0lZUPpStc;F*aUJp{Pc3-pWa!+$XY}i2e>G%9xVuz;WP-h|qPx z7gG#p^tmhEUn;4ZYA5)}jCjP=#{Nnzxpn(89sRllxZ{-1!Zogg+qE!EsEamVC$RSQ zC%l2$jy{iW7{OU;*w?+fxJWVD9A02zs!-82i=Wr3N0Q&e4U@39St3ym)){7`d^;yZ z+DM5d1nrn9aZ-vu@L5mSL9RIeJZz&#&7#G76yNi&tPHy*Rk>8I31wbtDa!=12|%{0 z3LQ*$z6Ni#1VY*%Ss9;71`>%#i>Bm{Jgd=rh(4Gom)FC!rU8`_5G!N zmeTBd-h+pBCN}(sKQ6gqMDMsI)`)~l?cfUKG;M*rR<_!NBcDDjy26!*ezC)2%!GE5 ztjnok_-%%wsH6oxv#a?LNS4x(Pn$gDyrJ^F(GtU@xp zYLyAA|1}Vl&UMA9%YidITIhwx0)1E`*t&Nz|2v(DF|a`ngmzl0Y+bIECt$&z-A!BW ze+{W=ZI)er7cMs|R|KxOLU-aMA`_TPww>l|B-x-&`ddIn1qT0sLz`tu(Z(q1XVLZx zce9zLjdpde#fSDTN)2lmpNNX^cMmMEcCp>7ls4a9E<^_C%nJ$`VWnr7 z5HO;LJMQk5g&pJF5Y!r9`$Ct+S_EO;Ncg|T`|ZGRJ8*GP4F&CVk{=x}I4ABlnCQYJ zRFn14INI0Vv8W-=Tf*w5$mqK{C{OCN2r!+JQ@1k{p1$|Nl7rl>V=?8o|2p_n#)hmk zvXUZ~Iv}b(1({UEvU$>-L#hM9q3-+xm(ES#(^MqVENLfO9Ooncb}u*>vg8}0I~+l&j{BS*T97^e zj)&lsV9MJ&#+fwFI_N|;kH88#O%{eCdjknY0!wz0|BthG>drN6w`^nEn!${1+qP}n zwr$%^W^CKGZQGS^?K-HcwhmU?KjA%j+qkc%kI{F>IbZqt`LZZ69 zv!CN4L(C5C7fe&UwL*wyVV`}M&D^`#cdHAvRKd$`58CxySGArlYoIIa8y^faa*%>M zz%B;+KX+hNXc6sgAkrwRuSr=#9CBxP26tL#x0wz0r=9z>HXK4_G>PbU<qowG;d$nwHH`-rFHjbnsGRl+3SU%t2MuxxN0p=;tmvuUC? zS&eA=z^emveX8qYG9+-*<;+ExH9Kno1au@Gg=E{=6b-I#9{wP1(2br9)r6$~tLdw) zl)O0C_J;Y?CC+ikZqs%L6JdXzAShNlFOB{)ioj+e8=Fq*%YDt zlw?=GiLn#g+SRA{Gh&Eo7gXIy1Cs8Km=!!1(%Ay_wh=|8cCk!&V7`PHhK%bEc9xRh zc;u#KMK;L{@`1mBU>A@Vg#?oUy82eLvQu*}IsKo)#eZJxMd-7F-i;-StNyIe?^Ea_}{qRPa?h$IM8iEU%wbc&3yD}p=-=Tr6+gxG}uz64r{>I z93y2`={0@5fxu-*+-5cvv<%ER{by%T5?H{l+hWGxx!Wq<<~qmm_c#tFqPdIoihA8{ z@`d!2zw$+lr#|yC<{$%%kpO*!r;H!#KMMKYP25A(z4b#b|)zd{0)HBjif$4jd>Z8(?!vts3 zoPU;wyv+wWqb-)902srR{`L_-Ie3i@nkM;KZq$QCX0GixPY3V8MC-2Gs2uw@pIClE zAO~-J#Kw~fz}75`r)wP6(!-;SF)0Ivo+pyn+$doRr{QxGLQlAQztRl$`kyd2WJki= zj`(o{qvSF*gap1^2QwkW3d=0*Vo#iwyiPVG=vy_LCojPW0Lc>D_!jO@4Mkv@nusHQ z!%#eNDFuE0mC|#I$oJTCBQuBWYY9pu{7GY4OwzBzZ5%W@>`Uz2qo2T5sG*s9>EuVu zJAgfjyEcNtH((2fBE`OY8LP@u^bs>vmP7i&wYD)FQ9U~MRN5i|vN$0@bgO9~3$L0o zj{2?UqRg}=w9p~7GIiQWz&vboaeHw0B#qC`8HsP3*qjz1=WucMs;bOllqy?6r0&lI zkS60o4oy8Lo67{~4iJBpVQkxxw`!!er8ix_5~^&>`r3iT=@RL5cX|OGW6p*aqWjG$mR|OAkX3$yp#Lr^^n^gR$>)ikB zljy8K)6fz`$ERJ0kdfAQH4pFbsa*!ydmkywZ&jy0)ljmp*2s_Ju2T5{Bul>LxFkek zKguRd5-5M?4Fl-s$MM;%W&OL;1J#dnU{F#_{EYz9+}Iv zRdVAdkX0eF`iw5>s1M~#tyudiqQjZsIk`gK*DCe~YN8{I!ZbbEV zS+?=lmR}{gU{^`;rexhj%*>e=mPts%yQ&YnJkR-H}J{n~1rq zqjf*1&7~G2;k+g~=ihISt;=TrGQG_f2Q@YKUQY8i22y9vehFNb3a3we1x(|4m>xrp zRud8G*I1)cAoad743%?&nSrlvRo)9XWe6ScSe6PGQwo)<=xv(t!U}-VgdYJunv=>m zNDIrz!Lr!(AKeXszml(ZVoJe>O2D(JjN%}@K1+2?{iP?}nq{LgG1uoDsdnyj$I73L z_wGekXKz;8BYor-06W0b>k^PoVd6li>ScskLxf>QK zP_;!VSgwjur$RX>-8E;?v+I;~fLhDo2U_1kWKcl0v(+0io!5v+hvKsK!#^dlVwVkp zi&iPRVeL2e*p3+-19j5I#28Ryv@J6Gp)W|`Qm)rJ>p^b)2y}KuPm$(6m6g?BO$$pT z65@Mxg`tJV?dEHU)msxQ@nzbev#W+-htrJ{FVJMY%5x0+?dYIMSzTwbqJn?_^%ox zp=0*2POxw$uAPh7oce}&^B9D=#8;U0B&^sVx^OY_9kwo%og&TWB|W z`VdRZv@r4Z`RKqS+rw@a3XfhOg8I$gBmH&13)O&vF3{}@8}4}o+_((>(!OG~Xex%5;`2D>AcHe3hG*}!m;G40arQ%4` zj2w;GyWl;*V&{|p2DC%;Mwn2+k6VBaa0kl`hKWvMU_^^sd`yN6XCU@D zGYXTE50``XJ;ExETaVM)6p87IcraSoeeQ+lSIZL?NxA3Dm0wG-3&)`8Vs5_y_>>8+ zs)pBUw}oD1LM<60>$xuxEpoktZqt4EU7jsbpqUvWA@>bep*2k!=$_|ouNNa3q0eA>fO|&$?7vH~|1&EqD=WkQnPR6jredfnVYmN- z`i7wV;5T_7lD8?iu%>G#3ICWRcC@Y?J_Sa@h7@=lXDKsLEHN2J)lHcivVHl?msWqC zDKeE})JwcM{Zuo3D&+WHZTI9RO^xOL8pLLG)~Is|*2iylWN1K+5{q|!c)q?KF9=fK zzDj5Qt4HXe=sxlO_-3)$B+v1C%Ray}&Ca5X&3EneN~@Br^wkz{AG#{oGnGj7_4$4> za!8L55B9#o=29SrPC9Z=3jLOSNAmYKjv>$%2tWhJoA_nSV2-TI0*9JWa(m03?wi2n zino!=Bjtj}{TgRqKxc;f5m*hHOkf$`9!ytKp|0LGXa{C~{Hz-tI4tzD;H`fz*=eDg zBEVO$2+7mI>%W)miyae`(GUiiTj?gAxC$8Q91^&NEahUsrT)bB*GQJ4GdIhHuU|@= zlUDn7zy<}tzoe+ll%kbDKkQh9TM44R38A|)?CLTr^8yJ4cc zag3wZ&ct)&Sd->z{^9DWJkB);x z=J2Oov6nVaKmwX@(mURAUj+@f?VKXMfl>4{km0?HC>6c~kuVL11uO$C!hLQ!*Yalr z`l-B0VjUeB#MrB*y~n0J2GmJ8IfLmCX$-BBryZpb#8}C)$ZrZjUFwpUGq7CjtetXN zyLi8Xy{O;j?S2pG3@qe|ff2HyVdnma#X{PGDr!Any>Oo*W6dlg5N!puU1B;>H-<(V zM*~w8#nQ0v-0pC(Hd(QwYTUp^hI%Q~gjqq}EZ#0JkI5~Dup=7R6;(HbzmrgU*xkEv z+XMQ@UJ!o3tCthQYQTklBYiGZZdqH3fBUl)(e7mA$$%~nz)v&+p49{ANhr#2!f!E$ zXomkh$oRH(+>!{2!rJE6u`cJ)$hurtHV5~Z`GvWJjs;+7`^?@bZ)QXT{I@ZrqkHDA zBV-w=S?o^vszT;B(5V-MgfMiGRztAY~7e z(PW;zY^OCx;c2V)2UGDBaKk`9j@)PXLvZBe&wbqMBs%QPipqBjy6U$#*TjQB#Ch7C zjvc`St#Hr@GRNXeBxA~JYoDsa2a+r2)Pmi`l{@{dPxtG@WK+Z)zDw6xdOBx}F=)ms zyD+=V5zpkY^0JM-iJMIu==Axu53n8RMGK!O^sw#S=2u||L->OfJviq%>0jn1HvX3c z!^wP14QRQ|S(-FHFvmGuBuPj57`-7|eyWIdQauAD$8J*NiW~>R4aKQ`unu5~XkdCI zdyye?V%TPc#!3izKWAyPje^)@k0`SlYXQn(my;|A9}`Px1*)Z#7PY(==rsy-^N;n^ zv!^cKtF-qVZ0sjaMk0}{Tsu|(2dn_UNRTa92qqB2M@uCHKRj@%{j`cyeHnT&yWKuY zN`OoHcVHRK%%RyQ^bL{^b@Il+3I(TFy1bWl*PJrvOuGY#1uMZexcUQB&U*8)nMz-3 znrw0$Uh=YS3%%lQuC$Hm9Yn9rIjR6lF3^0;qGUu5fU1Ht&4DC^t09ZMDQA*}lRP;~T{jl>4ET zD^wdFdS=1m@EU$Q)_%#|hDws3kmxkhbpkHfFBFZ?iry~aqm1jd zC5F?7c3z~+%UrYYr-#H$je8csg+dASH)IbPw=rJrl`7D7CAziKbN=zLDW`HBc(R!rbjq_Ej;g%2>wB?QRXP+<^`nJ?i0U4fyKp!~<7?B(s;L z3NizP7-KghnW~Ml*z$XMVVl2NA0mx5oGY(B|MDo=TR~!>pDQ>|+{!wc!t1xwPn&Q1 zDv0%Js{#W+B2Lz){KBYVIe(i5Y81P~flRQj@yGng0?6Cx#}~%MTkWD_W`evSgdj#&hd{RX4^Vx{!IwCylyH}~=fY5n zSRn9~#wNJsX8izqszY<@97JHN3aEnbx7AByazs`ZsdQ>jG=4M96$I=c6*F*v;G}cS zmFZejxcip~1=UqrB}7`4%StbW>E!kZ6bPsX2Aon_1q^dN3F?V)Twd4 zGkuQH`G$zS^<;X^bLfZ?QWR6hUej$J;V{ylNkh!$N*1tPDLSrMfeVX=;g2>|5+&6B zn8o(Ar20k8jTO}ke+g@LLKFc$w-Zzan=70u7eXX*(?m!}gl{#jP1u5C%T9)CQn=99 zFD8YygEXAp-PU>K!3aXMc_&9d_z6cyNj;6`!vWC)6;_XxoTo9QW)%_6vS){YCgc*m z4NMOKI*@bMMafn=hE;7qF~V_TCs!A`n|)e+a)E#NO}aRKW#VIv8;bcL+)TIYM-(hE zeRDo(TlZ8{r?^t~z(>w&+`+(MNVks*#fB$Y49hU2@r#dBz^dp`62VJ9AK{jZd%Gh zEc!*WDR6Mif8}$BL!juh8L$5l8V6R@Ia&t=TU8Y#Wczs0mq-!u!XUYuO6)M!E37VY zksp;W?EP@O$(2J|F$nKdBGE3lZi?523J#B+ACliOx1LSo0)_e7wB(WnZ&@%^kNG9s zr&aPGabzxguDI4zc+_NuM{?p;U@li9yV-v5y!7fu`jNd0>*2sn!FgE~cE&Pj&k+Rb z1DWeM+IO%;z-jxt+|y4VJRe+0*E7>%cM%(y&>HZR zV!I-5?-H2Tk4FdmZB&o1vBcF(Dh&duo8P0TP2h9)VZ698!Hl+NQGgc>%oX}NH=LZT zn^2g2is>a-{_Q^K=y}_+%Gd!GRS%vi&W{`I&{TKz6z8)RYC&d!``fuo6FyR6Z7IBS z6$|8-20pJR_pHCB`RGE@PtLf8n6+^Co^(2!FKvB9J$6u0Pu``cilUkNoV5i$J0Y0L zy-`?j9&NbI>yIwHg*l7G4JU5+B*M#v>cp{D)37H!bK=zQhL7f}v`NLOfW2xI8pUp$ z4=;)R7_yF9NVzAn2eJgNNBN*X?%z>YG=;xuL`4Ieh_R)B6M6D#X(jJ7HiF@Eg0E$# zLvqjW9~HK$9CbNd>32^o^-i@M@`-*N!%5D?t)6$6V8h*8Y~ffxhog@GqTN6%Jx?WZ zh$_2q)0ATzgh|}noVD0~`Uo|YOHWAlRG&?Orau+OnMryqJ#!i($7``6{nx}s|6-fP ze-n*a|3{Pu0}Jc_HOAbeF;;WgjQBgo{0KZ1#t6yO2(gPXIz6@ps{Tl1yC2+jcT*Zs z^*1uX!|fTG#)(*dC?C$!M7Br9BV$iic24R)jEB<)D3(vq#mUy!iuhXA=i`Udyv`cC zjQrH?_r(83JZ>Iq&q_-Rt!{ijGJfSEoM-As>=$R2)`gaZPIL<^Upv3CIB;T?n}#%z zx$)f@(k}9$;EuWYh*$R~O$tm!DqzoYXBS$zUJP>O4~>V6M>w0`5u%`mKtEb2-d>KA z4@fKaxt^qE1U$}vg<^%`?FPAl0>ANHi@KYL6$ASSN?2zuCWre0)e*^Hm#<%W$P?=( zc6C;ahSjvVCaN~l#sKvJ*cB^2MYjKcLh*sEqk0@Ho$M{F1|9^3;3V?F=rJ0_9||b= z^L=z{h%-0q%Wi!|_mg6XoJ|0nh!sjUhz4D7YPza>EPAm69*oEE(D;cAOZ+|?1ui3;<2fAtXNqNOWMh(rEr}7(;-HrD#4*dbH8RP%F38F|kH;dFPeE z%b`MBnbINK10e%BtV^+-&6kDb1&y=CVcIGKZ21&~y^A3l0(s7&))`LpJ5Kq^*{u%` zK~Y_}05|I$)kaRAoXZ4|KUd|ei&8(7RKy=_3O5@jm)7hu8KY8PGmI~lF)4=*AqWqc zJsD#FfErbX%MgfC$#MYinip2Zw5vwXokS;N4AQw~ySPhEJGvU%Y0$LGfLL-$K5-34 z4OK?D@6^X~F#~pXGH8P!OW4p;TJygzSKF-NG$=cWJ{LdG}R=&>cfH?>pf(;*$;L`oXlMrFJ&wSz3LJ{NJ8a;R@!QlPlill zzy&{{555ia0Zkd4TUUH*5xJ|>B`laO+D7OYdx35>7@x;P{*`hKLjcFV{wO^eM zfG8G?@2sg(oe6V9GzbG9bH5uj7@r%1pAC;Fv=bpZ4c`Jw}Iiyi&ya6n7e-T@Km z{~%4u2?@lu%IV)9lExaR@}wo^EH#wc((^il(k#;2$i$jj5cl0Y z7kpfTh?IXm`!jG0dAUi+t6vQMtII>@GTt zKw>ZL<7n$SE}WOR_LDxXGYySnO1y)rWK23c_{Fp^g-1&vVJKPNJ5@runzffCfDp)i zbR7(2Kph~Got|pjAcgYN6nXU(QN|z7TpNiT(1sEFVSmf2HnEU2uE4QIsK4Lzen0q< zJLrT_FL5^T?i{RtRwCK-SAL&TbgQnnRZSr=YyMnj<0v+k;T;FwOLz3N>3FtjFN>n1 zc-O8T+o-?V7I@gVt_DO(e6)M$iOZdKd4sMqGqgYg0bO1UPqb%Tv9-nMRT6sfjek%# z>`Lwrf-w6|D=h{|2}uDf`FkXCq-xK07_5}Ad#hvZMFwX6HZ|K7Zln{=I37KY>SfC3 zLTbNVrdPV>U-pXwoz8vg0QBFpP+J##rO2q;f+3$xXj&OGTK-|$$i z+0gw$<$i#jV~A%`I$B=~(nzO&INTCPnUO0vm-2sFo`l(8@zw#68q{1t|Vk~sdcD@+2n^ig^uG)|IcZFPk-(D{b2nN=>oz3)oAJjIZ7LFpKPSG{f4?lG|SXG0n- z!dTJ~j>PnD*!J-|JftrSNW?+TGM5+>ugc4*_0Fx{aVXMy1t0Hs81ALOf_d$l3iq98 z9NuC7Qe@n_jk)d?c%eVUYpX2Z%MGBVRnR2{$V&hGqFF`iKB8MBr=V(*Po{($!M_%HZKgUUH^>*AK zB+MVYd=!FqwRSW}E%2YJvptPu?2l4ic4s}_T}R-TJ>oa?MhdDq!qb`|{ydmj=~gJGsjmMdibG`CwGlP5k_@hBjWCao5~m zQ{JO!kZI^L(UxSGu<%kEFLY+3`BhXD;Yte1%J0==>n4v=a^GAui7(LI6|1CBRCkNJ zSR6|}*v-{OPb?k3XM@UDMZoX630rE)8?+Z%$P};r;dT`9VqcBK8WyQ{C%$@9^O?;5 zOeP zP^NPPd`3Q-#K&Jb-m(@$=ooP=Z;_Bhl4Q*{_V0?Og=Icj#Aoa1ge^1`_IDrB6q2Bh zqK-|E!NAOK`|jwa#kh(6?Z|fm^3$TFbMHd~t|2*;N<%jA=&4<0H{^x7r_SaG5__=tnjT~!5O^ox( z#`eNYrivasiGlyg-Ngy_LyaKF7A!y$&3?_q=LP!4%K5MS`ghUfjU!N`n5Q91q~y1M zXJdYynA1>9Tq9*6li_l|GJ_YlFt*BkqQuf+&0~`}M4avTYI1kwQ^+c7J7euA@}5;q z{k;8d-w6D5EWhYNSPzK3zIZRP1?fx6b?7qyCYvqL=gO1Ab*8XF+#W&No6>yU3jB+M zwpO8Z)*j&R&~85T>W1E|aIBMj3v;YcDNSI>mm$?Ux706B!~`p!jHh&S!4Y*1?}i@u zc{S+HG~zA;n6S55GxIE`r&80y$6#;@(sZoa$<9=`G;%gY@+6^gsW*lF_QFTxGg#Unpas9sN5Ub}ebS*q(BZ1(?=xk;uB>_N?q)g`OgG;LS|X5d4$b z?nG@vnJ@H@D}={FsEl z5IPMI>lDre;G8BxqAvwCJ~oZ%cUfZP>rM@|2%li(S}34YXVe1_i+_Ao!UEsio7d6h zbQ%h1B+!J|VxiS$7{W0&jSGafXrx`m%eo86$6ucYa!^{KYpM2Uh@X<|2#AL{sne29=gP3<+e9o5|eLh**8GRNN>)8XWl9!0qMy1E=cL zPkXv6*zC$42g}(6@~8%{jpv*ZumH;{KL~Fi%Vn$k!TUp{Gl*3XY2ovBe+o<}2oan@ z9gUnQXOMmdrBSrMA{xS+6PN+@j25OFjw&KId$F3819WIxXx7%w)Jd%=xSI?dq)V4U zAlMx%mw9KXKL=J?UBXceCd@3CN$M_|F0u~;T7SGzb47M7mlX%AQ2a$z*%cAD4c*jE zgJI!|zcuHCWvxhzlUb3^=KU5!BIi?|fMmPIJObD!_k==4DHvx@lOQJWy_}#OW!?s6 zF}lifPI||yK`oB*2zUKo0gdHq*SC-d&fsOPX`*07ndo*r~8Tasj35@ z9XvpHDS}xmc1}`Od9Dmpg*a!-LAcRnC~+hS-=O#Kd5^LEp$`9n{Y3K(?b*u*1eD{j zTmfrNRPgX&x(BG*U3f47_tzrPjjo7F_RnKVut1o;5R9Rb>dGVtPG8)k?g;RB4q)mB zl|07;CNinM@H;})n6eNm;MJc=nAV~hIA*Owh&3&v!8(Cbrts4nMOiHh(y%$hkE+!p zr|KzAwKa~Jp4H=d|1$)rK;9ne;}R0(LL$toWt{dIrQ?hjwROI9fgqp|hb12hK3*D6SVApOm{O_?sd6He;kgC4iW|=w3)d1*h?n7k8 zTcg}gZmSZswVR)+_F?gP7zRK7_~yO}edhWg^T2=pX!zo#;FrUA6QMbGYL^Kpj}U!> z=J3wOL%u|7-h8T6uw0dGQx8@Oa*dRy{_<_oX!%_J=zjh-tHcO-vuH@6&D<^L!I+T9 zF;dPXp&s|M{;%wFgSHB?bF%p)Z9pdvl}2v z2D5S}>RIwo(8kFk7e{;sTpV#cxF|s_Ips#0Gx%#5N@-TnG=j}2#=P#gO4QKeUqTe5 z@)62)sU8%0b{M>ze%^ay>yu)nm_g2&NM2XD9tIy;cL&&h7ei3SCM~{Rv0@GW7v9 z;%LtExc=oJLtc8v{NrKP1IaZM)N@ux9!2}|BjJ%9PaLXO+p)hE> z_`%hTt|>~A0PfCuBa^qG15X0C+u`kOk2nOjg)E@!IULOyBbGw9!zU|M^3Tc=i1MlQ zUMGV#Qz=BlPwfbDMBK~*t8jG9&%M^Z=NqbZ?DYx)HE4WIkB8%`ii@ULqFMhIHu|`9 z9}3*89d)cuD+44^<50BTX+}$bx5rU@7*@4Wb_W)x;R%SmmFemr;kZPv%$4tQR_v5J z%j;1pqh)x5EF5t^I79+&Q2x2MR<77+cN7q@+~!-9&G>(mIZ_}fb;2|Vjm#6&Kh}97 z)H)smZ2o=NMK!`|`=o-;I^*7{Ws=(AnJ;pH)x6dqM~7g>%kv@t*eTjaXdx%YaOyTL%*|!bJ<$6IT2!eG2&p)_5gp9SaycH@0Ju4 z`PJ?Td-e7)GjQR1h77_-6r0!0&(?;ZdXfDOlg}Kj`*)JTa+HbdjTyVUPP!TGpLK6B zoqlR8gxBe)W`&fNegX8?mna~DMfq8u;wPpC=-GQAr*_wa&#IYAWdog6QYHy@Fuk{C zwjdI218bX}%G*vH__fjD6qd9R{p3ydDs5(JqO?ZoGhAuuDz$_yqh+vp7@R;Y(9*xM zrh?%rtZ5N^y$B*i%TMq@ZtgS$o zwZ^!a^D*s&K`ClwsAP9*MWBrPDAdopntCDKe<5+Ct{FEKOoc3WrMOoO!SCgvq4LN> zedJwOgtMs>m9byPwnFWIbJ;vWfK#zhE66P$Dv&zxsYIb{E&cf}u<0)TnQzHt{c#J* z_p=k;9hP&`ld0gGIP(BtL!jx_!Vp?o8ir9RRYGl6%L zKsf1HTBiwamd1}d!BA)eV|`AbIDmE;q!QteyxPOe!+@AgqHBy5AHWiP%#fsh4?e&J zzkRX{Mb3);z(#|rCt{Vp(C-S1S%1?Xm3-ZWWYn53O`^8~Da;W+1KN*qlT;2E*Rj*A z*zVr3=h^yF;ZlPAxCzT9Jz=M;b_0ZeQ7wfwx_`g!Vu@rCr}TlpvW+Y=d@0^aKC!C# zrOa4R$HrsTK8|F2fajZ0bpN{)`#-}I=;-PHUp#@38KL{(w`pgn_1(fW4hX5T-%Q6k zNRUpXwF`i*lk3nnZtdD($^Z=BXz?^yH}RyatL*aT=r4T0t5%?HFiLTB^aQW<8Zcwq z@sb-^|C?fOjvzbhIcVg~KR-wI|I@Sk{`|OqxPOZKrEIq*?yulo0ITb#|8;I+JJUf0 zsO!}9a0xoV;SJolc`#twE$zqx>dNQlc}bl;UQEPBj*&%(i*@I~=C}}Ry6ig+h5pFc zMFjs>h83WotnvEa8xpU6#Z4%-!E&5O7vc4k)uiUE48a{zd(By0sV7DgsOTijq}oJp z-^NS-ArsCfZtrRhu;t+XIt{x6RTfBQyBirZ&29t8^AB$=lUWM=upkSv>~i<9F1`0w zFi>$p>kMvIKnX1MN5{S*V=Oy$GTHAS{vKgH(Y+k7tp9kByBq%{jE zWu-tx6_6V?T^3=N5%oXYnaCG0Nxss7TptD>5%12iWJ@h80Jq5U4%2OCajJM0dkwH9 zwK(FI?&@d5B(_n7A6(mkpXOElJ47p2Q9v`|-bBzY^bF5;e{e>s&@N6(3M!@t*?HeKo%ZJ*ozx5{US+YV^#XT*^W0Zrj>dH7^^4o6C9x z-I?OSkqgisvCj~XTeP?AaRQp-=*z3|Sn4B=ZHG0oOr0xo-iM~(^JsE-6nAQ-@#adp z7wceN5dm2d!G>WA-^5(v6t>-&)>GoL(HG!Sl<>Gg`=qrQbJjMrFXB2%@({B2%@LV6 zjoBSy*F~hI(+p(NVrsdv51lZTK?81OXo13omGfbw zl~Myb)yqJ7rr6@)>Qt0&lh*E%j}!}@KdQqid8d1>njQ$dm^VqNh~GUBGa!XXEI?g( zosVS0jF1PS189d^pqEp8I(BOHhQRKGRfXfd0K)_4Nf&UOpbijav2$xI2`9v!ST>Ad z&nE2M&&7@rF`T+5U4HYj6GzKudBfDvO%?lF+&a3!m@4H?o&P{H9Px&I+{TU z@h|LHo3d06?@&*dO&$(C=p#>MgsRh}7Z=*6pyTPf!-6OtbOh=wU62s(B{M5~F%j52p=|-U7;IkE-Zdm`NG(f;7afI03*x#S4`TF2E5D3y z+&Sw}YSNsm$Do0PoQ}ZSV7B z8`_Z3ZcQD^>#7gFmonJQC!YxbZlr{8@4CjtN1WDkYQC)TqKJTToCg0H)Iiaf`tY>K zf&;X4S)DTqtc(T>;f~uZDtF7aH0g-XP|Gyesa<-WcLy9^v>kh7L@xqBpZf9V@}=rc zIL{NTg>;53008RH3KFmWy;g=(i#`Nn+iQ!&U?jlIll*7ZTem|x^;!i0ebiBXI$-W% zq%~hshkx+ir9Lm!(3v zib)q(60B1V56ic`J>}4hD#Dp2`t|MH(w1_8YOkhG_lnxZl43TU>NBO$b3IKdYmhK?wc8D*s*gsg-zr9<3VB?fqyyeHj% z&gh)uvKMh26Qz7zrR~@1XosDXqs~^=hj4;${UusRO-b0Ly2H7zzz`QS9-2Q)_?z}v z7dMLJqIce#1%!v39#Tj7)u9Xcdy}=?Xs-s?khfv7&2w^&A)I5PaY1msI=C;}vMphJ zIO@HiBuWYDjn4YqrDx&%ZC-n3EP)E}Fnr<f7cvZv zntUlvt+!{ce2iE7BDgiqMI)B1UBk$q{y2RUL%hEe5c^R~w4G=o^)?Ic>h30thnhiI zGPTb7M4JH|^ptyW`ccDzC~tTJ$mRn+wkJnqgX7<{oYu?IGhaP2$azF*j?GTTO~4bq zTFZk9%YcD~?GDeyZG7E+-};8SMTk(s4v49wY?I|YD4^CA{qiv=lJOIwRo-96coe1@ zg#S%KU}N~7ZI!Yz|KACLGxo9__WFVH7{03D1z1fA5xP#V{^Y`Y$sMI z9>sXV@i~h^4W=`NIAZ^S@M_`)-Er<|Mk}GKNKJ_*b;Qq&Np#`iO_1EV^E=J@_H zit|mSv+y*4rYJgafptNAR%zbCuKV+LRg129E^k$H__2^Tn|BU3xZ5W}ARG{zfN5oEz+6W~4GJ4=A3lV9HsUMf}zQ1kr1n^PeMfdn0=Z#?18lZX^ix zOA%a8E`AR#b@A_^)Jm7OyqQIw-Cbenz(Gfm<371#h`st)Mb1LTQ8HmcUxYpWoW3z{lg zgKBQ8^5>c^CW@})eapYKzLZ7-<%BY(F6s5h@j+4rnW@Ghql z1-dkpyE;5^N15x$eb{1#ZyBvY9ueDN<1d_`Pd%Kf>P(P_P4_H}WOGjXWN6zhopRty z;?H>1el#?*fiK|0aatXjWc0`(n6S6qbe(uHy6!qR>?B5>S7k|LMISP#Lq;9BC1~?U zh-L#tc&Et@xy7-YZm);g(%MQ^OL$}ZFA7aVo97^m+e5Qpct_F4CfK(tV@MyjaI8h6Cm()g3n$BwzIV(tce(A9ny?+VZG;gik?&M zm|=jr?|z#dfRN=}vhuJUSzu`r!pljp913JR9DpF zqloR>6Gb8Ia%h<_EI@tg-5<3{hnl8cwB-1C*KgGsg^AEt@3+e3Tk6K8TuD-{VVWMS zqp>ny<*`kEqXJDtU~qs9z&1^pcSsMdlw>0$SF-!(lgEu8Em)dFl!mE|`eqHhy0%n1 zqB?t5f`uRqX~cBT$$Nt63~}~!h&&a4pIm%Y{1bRWjIKArohm}X2prlsb}GuQ3Ggro ztj$^Qa9C1g;BnO+@EsXj^e)6-RwW%1#X^+Mj=;AjDmiDeSE=R2^({m(RHDdtO#SF&+Xw@Rtw6uY5_^AnG z=}vptcn=@`56-t&@P(J0$Zt&t>)nEqk^}Xk{pUd^MN&oCi1iOjX!rV*gD|D(KzFwB zzwD;!b@eu=k&n4)512;a)z}T@1{d;&HNiPLCz^J0glQ-x#GR`#oc{OIiXcD|PDd5G zl?kjyJ;D{{b**(^Y?oARV|VzqHI!t-&7n->X#?6)74GsJrBfS=ed=O`TO9p!`}mgj zk?xPCpxo6pi@3umQyI6v{Zo37^KaLIi|-SmaE}_iR`_&!_BhD$<{7BO1*KH@)}UK+aFW%Mzf5$Qmzgk+L`Ncl6jAu;0zWFRR(7rIVfQ{ zJ0f3fB*3*UI!6gFf5=(>Ry1R2x_J|eW4Lx-?5or^L`H0nNWT;3|ns8N3C zN$bNjpH7{_D@#^*+qgxyZabz^Nn!gVt=u{HubQts`)Nc}2ePc*`D93N?u6#e_$=$R z10ZbAHgvyO7!oyGpNLPwy2$qaIH|CgvfA0R6+Ct{3^<{NGw?uA^@u;0exkAAr)kA2 zgrh40Td;sYb_wb+1y(?nCp}#)i9LnyPheJQbQ4?AE@m654Ha-?!9>wSs#?t`mTFuW zp_87BHh^G)r?QPe;N%1<-I*!mEl@ocnN11_oka0G7L_u(6C=un9W2O!D11QaDVp;N(Yj3p} z{Qa4iYB$6ji^eqF1`7E!4k}9^cftekO}~fmqe1Q3%Wf5_l6OW9StC!#ZE zgbRb0?_>@-m2MB69_+eYPO}&q%*(k`-|^jSiejqs@N(bGd-Wf*oKX_&Rdltd#mi84 zZji`Zct?|liNrNT*p#*-_LezQ$a`&73Ls+V2cnffTvcxevIGi<-G*65-K^o*3u4Rz zUy|wNKNGYNxQa3BJ)v5I6ZD!Qt2SW;x8oO!(jk(kIzl>}O1leKQ4=oEkw)htvIf~X zPHIs3&`6mr=NDHF0rH~#K@7}FKduZ#3xdH0>!FsDH<>k^MO!9 zEjJbl5)Z71rSat@D+ZtHMhv9!H(EDXE-`8x-FMb z11H-;Y^iI?b9Q`?F#frx_j}TOS9xUR37?!v$M80GX2{;v$b`SuI~Ny`0*TU{VXqU# z{sZs`ymBx&>qFKEuE*ntw5L?kauS)sH7>=kt!cH7C-@)WL4{k4|1MSj&%U10v;9A{ zn6a2ECWNgA)Hi>Y9Pn~ybTPj{xYIud_Mt(rRC)t9ipHw$Vp$*Uco5u81)FR~4sBi* zQnbD_7V)>GDS4^8iDBk#KY+kH15X=!-zR^iB5d9~-Q{I4FjMe}xPI!?Zh|92a(s1t zbbPpu>U(@2n!UcV)ss-fNt!yXlRM@G+`BrtecYAjG+LRq29AVDK?`j<+*(21qym8}>VnIS-xu!@J;uyxP_B{##CvY4+AH(E+)_b#3mUIq?y-B={lP?cQSXvf3! z3|+an7;tCr00QJ7%c9Xl8os5+fiU4O+*Fk>xXL9Kj?E8Rr@AVVXf@Q#BRa^WGvHd< zw`8pp*)BXFy44^}uRgTrM~zY~g3|w?VYHGZv>5a5nJC{QUPoMWKsPHQNX7qikq<~( z7B^RE-Ef#!*iJ}_<>ckQzUArl1brDToSr9}QM@87(W zJVqW8vl^6#3bUYvT>}nXx3P&neDXW(uncx)Q8t?5s=i~o3wN$4OM`oNxpJS-U|nnYRikp+wd0`T;=h|+FoHPyo4Old+~#+v#V{In zWicjT_3I7$MIbwpU-FpK1TT>Zrpz(4rXTl0MPsNZQ!ibq)zc@~Bn4g-{i7lTo@x@b zCksfSo)PKXq46m4+mYFNj%+0g^>%Omn_O1<- zDsWe*{X4Th9cr=$i^{6V#ys{Ms=7S`^W8f8sJ5}p;CKCH-~|>8roJa`aJDE5?k7FNCvi7@9?Aip-e|F6Dapm<=`3$n|KP zlw{3Ah`L>U*_W!kxG|g#QQr+7%&2_MdffHQ%^PKd1-GeivVb5PTj~?xEiTheHst&a z{?Ig@s~^oXaJJL5o98rx#weT5J9~zTtZ{cdJjv)B2xZ#HmuEi=gN5)7uDWoRSWxH7 zNSUQ~wC0gnhA?V}do}K=Ab;yIbXa1II}r`EEdf|wDfXnWLMpMjq#__BGeEJHSyT#) z+)%+o6lD%tJnHSsCqJ*C1ZeK`#3VCwDmxMS9*o%H!~^vS4qyype)q#i0yu4R-t%7J zl-uZzrGhY)xpQ+q4TL2ys&;;bb_+Tn#~Gz!p4x_M$FeVKW?ceXUa_$k8>UbJr|ek| zWqHM{bil>OZ@#%ZRtIU88Oi&vtmRmi-Dg|jP1toxtTT;_^~|~E4KK~jemd6+!Mh;G zbT`=oO^5^&9YfP+N2?6B8|Lvm?JiD~lUPH2Zc3(oy5y|LDV}uba67EV?;IB4^<>20 z8JP{FC$EjWZWKihb@sfV3X4gcBD#@cky64MvW~WPQvZ;*pj?asDjd);bj+t8At+Qy z!L94S#gxVeA*FeF)`ed{CEYjqg7}q6c^Egql zEa z0>(m`2F(zf@yLRM`zwpg;H`Ta0!Xt(A`GtMuYa=NDF|t|b-$4ysoasn*=DhY^@o8? z#q#mi7FpS3vPUq%9@<|PaJx$XWC3ILU|rDF5?t1d{0+U0b56;9wI2;MZ(dp)j1bBN zeqZPOP^V>?%_t?~;?7M9#b(VJPzCj0tNwO|q7R~__5-TR${v8;uPU+X8QVYvUvtyi z9zF=l6W!q9Qq|AdULg(XrmEpvi4fgW@okD;`{pv%ybNnxy%o02@<4N(%6^Q$Y)E|r z7#1?uz~Q$AULGesjqWBbNiXZ-Z2WO^i{Hr$jk%pa=i`@bm4lA=J?mPU@7gMwfI2nQ zOWaS8EVtitbj`v}UgLIQZ_w-*Ea@UU$;>K3lf)NU4P9Mkm%cqIguVB!9zN7NS?qqW z+JtAtKMNa7fCN3^Jon1NlW12!zly%u3K6@+;UHjb*H!VP&8zC3jRYi*L9tQ`zvSas z)w0LleQV%W-eut1n%qrAU1>M6m}zFi7G`+$PC5CJvlThx+oHC~=tVDlt-$Q1M3zN& zfy#lc$s4d?^ITGmY(83NmM!_^WBd?4nSbT(M6_jT?_G#r{&R`7`ee5y8aAsQog4o> z^GMM9hZY$v4g(}Syd243UZC)BW3=vR2Zg?z(MF^T+=Nq3^nR;k?OBrO!eTkE&a4EH zt<$iDuSQ`m>d{#6cO!S4le!z92NAxf$-r#@!sZ}NufD5Xq<#pT63_FsP40^c@AW;@ zL#@t>I+3kL51-+KX2d(w@2W}w#Qc_;I)cm#9%jD!^o!8P&S=H*dH~f6_;bE(need2 zLmqlwv{9$RlW?gw`PV{imeZxT&gb2GTl(8Sb%mRxrMKnH)#=5Q-H*}n-rg$Z`?1pD z*X2CJ-dM3`O2-kdrY8KnSrZ4m&f6Ld845%4(WI75Kz8ZYzfvdMoj6-Ao(1wQXv}UR z?=3I&&~LIEL;|Mx;#ad2j&~yML{bc(A-S5=+W*p(Y%@;(8<@Fp%Kd*4Go1fbk%5tu z^?!;P&5l?Sc9@xO)Mw!Ti>svifA;5>(va;8$bWp2kSdBQJv~>~`!$x;THqp!%g4xP zAJ%}PM*ZqVnug<5C#Q~~*}Ml&<90slME^Az9_Ac@{=q7xRj~a0H2(u)pX&S7@zv$y zPj2-2z3cS;P0|&ps%ECCdnLn-4m3zzyR@VKzdY&-+0|1j(%|1j(>|G}`E zVa7=Pr4Zg++~(%3Dj}VvxzJ$Id^r5``X2}Fc`rlfu|3i9p2{4ar}HRM&A$xUzVmJqF**z^XMh|ZH>&JO=PHP<8!saxia z&`nPi6Z(V3F}8V*`>3gAlS@cdB{$y|m_wVp5_qB>N*{c-8V|*%;)`knhSI}8aioM&!2@yl89+9R8U#6V`~6bm zx70`Ae-Z981dcB-0HKs7w_v-iYQN;d+U9iFx7sLwf}&ip%bzim}bc)ZT z!}S`#nxl-Xb--RUdr zHJ~P#Wqm+ppJqNt#nlw;h8Exf?+!hVXX-45M7=PCyCZIh|BZt`6~BDD3eXWWiMtxzHxl(GgxfBxq&0f zz|o-~G~hJ=TQJ@xw~8&^*|35Tu?L1@^MU2bPz1(>xQp|2<#x=~-h^~r~p=vc4^Qfi;hk3fdP?6Xpm(R{rcNo( zq40z;gMMF}cQ55A3Qb9djumNwHy15P$)O)T(-oIMZ>dN;sEWc~2)Tgkc#dCppmj8G z;IZJ%!wOrTyDm;bQxeshj%qm5t9?dZ0qwUL%TgwenZ19J&I z=C-pK5Ia%%^9LzAMvjorM|8Dqq1+ltZf4zLD6}W;eq}CnIIkDy@oZHC+1=@R+m)V{mNtbt-Fo8+VZFB;3-i zX0!eE!D!86I?81?2fzwdV!kH+T^`B1QZeMl^dFcaGo|MkEBnw(0E^1De}#^{*lKAZ zlx_Z;XPF9WR5~9+3p`ycSpczH#>KglH3v?~?K&ZfGY*;;0{cW16A)gBckWoBrVo!0 zy)HA%b5_*EZeD=ox@iCr7E7>nxPzn*q??iqS0MJu35)u4Y+~J2YN_jWdj`r_3u_fe zQaoN0S>dzB>^4;|`0S-XR~K>TfGoUEoYZu|#`W?9>cFvc_oI6SX0rIz!bvp(%4J#U zn~_qBc99KbcS1D37^0C zIB3O%MUV6F=l0kIABicKV`D-VpT1taBxo7jiz{<+v32l9)wx4;J;Z-C3JkR;Bbz*t^ScT&(QA1Y`TyZS-7=i#lg zt#6QL(Q@oLl%Gu|x6|&ooiWbR*Q=^?T8)2Kl3!<^toRJhtz$=^?)pdL2g0y0(s>om zVOUmO!MzQxdrJ0!J(}H&p!WpUK3r$R=Hlr^6Zhg?UqgPuqQr0z)6%m{!B6Ibs1lSb zQY+%8@I#_yZtoj4VtB@`JuUU;m!|eY~N%eCcZYyM=EMUvyWLHngRq zmL?@p6xw!4FMi%!Dt^2w2YyWYe87Wgb;U7px72a|?`8phd`>mF@NljhKJjV?-4jeXC!d#@=LfPYQBabC>I8=ryi#if|Jn?*$WM8`X~!)a(GQ1*@9DPftx-Ws&06_cdSk@Vp6o|DtFSpWK!O=K z!sKA485s_tGH8bDE9X=ZbQ*)cNLS>&R$T^usi@e)cz1L>5dNdj&LEfv)`XCrd0v zFq726@447PK|&9-U-uIl{FZT6mh81BU^L_J#CR#2Mt~em;gikr`kZj+iVuNxhSvBc zF-IbZYinuQ!tr7t)@&_rQ)h#PUU@0;O0ZC7$#o@A+2v9*XAbxz6F<``a@9wwns6HL zwU!u4BV}7k`l&POgXv~EXUTCufRGeh1`06-P)`&5`A&F8JRwUQxLF8Et1UNz(}q(4 zpjE0HU|Q-Z>l9J)nm8~~<`j)}qLxBm^-axbATa2bmA-MBtdWxsxulI(Y?_GA6Xa{h zyz#nKujlV^LFijH-y>l++Z-2D$|l_=kB*Mh9&AB339;ewP3+>4bH$eNMgsC7y|{XP zO`Lb4Cs_IGPq%z7FT9%tP$+;mW{;)@n)l* z^yH&??EL#T8e_Cc?77<4XcZSwDv@|5ETN{#mLQWoG)oyKlm)2LkRq=kyc4MdBvQrK z=AuAId4p=LA#GAR5=TkhKVl{UUAF0o#KeuNa8LO;^{b6OL!U1((J5(O0Pi$i0Gd!- zyL1A(fP#X+k;Lx)75X6+HIu|u{<3CjpSf^+T`!-SLrgvJg|O8zdu*)$ts54Od0N1TA!`0_21HwkY%!86u65Pn^{G5r-1$QScN&ZB*exO5IcC zVud(Enb0Y(T~c3MOTfx>& z&=)*PX>L0o_M{vk`%$|)>6=()YOD3NVjVxl*H80sGnbG)VLeZGV})N$Yivli&dv#-2NvoF#-|JX0eA6iB)KpS$gYjwDxGR~}e; zwJd^6C+YV#9)A99OldgKgqZP&|C{d3`o_>#3y@2mWf6V=jWVAXK*SN6tF@_SWF{PA zylrGM5N4`xVA_7RW?KlOd#fu$9`Gs{Bg-4tog+hua5dauHOR!|cm_yH0gAB^5^|rM z;Dt=H3SmDS$~Ku;Y6n*oLnrXI_s7^F3ki_wI~pyL9CD#55K(SPXmdl(oRVN3I zBstrwp7}C=>vI$(Js((!d~74~yoaE?s3y=PwWB7Q{(}a$KGljOe@3C7GE}_dKM~PPBpms9sDVUXM>BiP3hXq zMjd)Z5VBKBf%R^c{_kYCmbgPgr39pAo@a%uC_S@yn@UU?3p63rd=Bg`|6$OZg;&z` zLFHqB-m_7ary}`b-n{RNS;mS@dwyg43z*XXx=D_K{NXNodZJc!QgYRUQp+#F*_PQ% zT$b(7Q_brNk55lJ2!;O|RjlX>$x7{yi_xIWZ!w_$_bHZKDui@7>Ru7qEIm>otz@?% z2*nIqRG~qZfQLen03yf>!GJtOy!fH>Y#;n2Lyv;h`m*9%NAEJbF(Q^~8DsYo^29vw zK!Ybqq?i?HJ@x3glBY!spiUKiAHRmq8rs$+x7RoiNyu@~`p-`!=K=-95xuLPvj3f& zDs8m)(OK)C323tQJyoZI*PAttsvLdUCs)(lgmDkEfGsoRqDkmFc1?pGfB};I#wpo# zwD$T4%T9@RL)&tAug%Q~u*uezTds;`!EVm7C!OOvL8P4ivvRegL(T=rlz2u88P)MQ zd?t%7WlC#^jf%M0DC{U!drdzov_F3@5~5qoRkD~Jb0C_yZ29TWmbuz0rGpV;5!QSO zX>9W^*E`2Gm7ybE$m2p0WoAXCA}L_uwdxTcH$H z^IOyCx+z_J^E8w4(~bqE=nhOhm-%#jf6eGS+9S#TZz72OzY;;rtpA_DuxuO)Ib82; zT{-`J@f(=sa#%`Z!b_@&?E>CMmE*>1yw1a`aX*+aDl2n@npTVyuWSIIF~4uL*Sk%^ z6qKLiz12NkB*MRDhQ%9TuD)AdAFa@sK^lK*RI^Z>@4ZpT?H<};cD>-?>n|NYJ-=K@ zbl$JGe(z_R-VxOS*6~BH>bVl+`SQch*Rd>^@xJ2Qc^x_`Y4hgw#r{y8dPZ-k{rB8w zA3CZbHI@Gx)9S`H_1Q9VE;-MeU%YxAh(+Sr;7Z7{(W3Ml3{x+THx*94llEO5NqKCe zsmKND=J+-?8fcG-mJL={$!X;hiW`ax&A;{H&sSrg2~jD;8dXVsDhb4FJvyl<4B?ID zzP?&0vgbP3Ty!3&T!=YfJlb!wV!z${oZd`!Z(Mu%AHcm_ZQq6(^_0w9$C)TIYr!7gk4I8-IEC>Yy<_dM;0QHXJRYEi_{I~dqOXhQ?$ zsuiqN?`d4m{)44f!w)fgx0L;_XwBT%Gtu5Ao^%yq5APIN11h^_FX_&%P*R2Pby;M0 zVPPqlQ`Mi2mZTZp0j26f9}3sO=1H>S-hxe;%!14Y`{(!bu$#+UNUjn9za$uLdcyD( z(9qoF#lzEG`tEo{tia~7lQSP#<80g+j?vnIF#8A1+122u>H0-4T0C3+mAIweA+ zk5BVg%IXFl5gn2*;+VtF;?kg)Nj!jHM#0-sW9n#;1koXY6-ub{4J6vvZE1Aw4*A zNp2&5C;f;KoX!eW;TTO1aZ9q71?g(3M= z075A-P9a0UD4GnjkW^3oN%4f&BKieqk;pUUU;^4I+ewKb41+jgdRQ{j7X?(&jx1t@ zr{Z%%MV<+}3JlRGMW*Z)cmW|5ES^4VeNkIP!)8_ExjkW`hV(*E!=*pW7DA1hI7?|e zRpkv^T<595I&&bO)RG7q=tdyzH>67IQui*~A>DFyxfI7OnCS5U9PF$En#usDY$XS< z)e^fgrPq~x0hAG2F(BV`XH%EDIXiu$BA;ax{lBI6k#eC{vQ!a;1kFb&aihuZ1&R|;F#Po5`XJj(OzCVu{tR8Ck5OQ?(8R1$nr ztZ2iS^QglSKq8Y*AUTs63&RZzi&Yz6k@AQl;>KubZr^$E;UR>x=z#BZF=u~fMvu~D ztSws|pE0TLGm*wg82bx*5p_J`+Hvt9)o+{%l{#cC5oY1ufL(d^SUktFWzLVS`Xz*S zrMVXG$KX`F3Gp~Z;5nt7Hkm~trGk~e6b)M+!Dajzb^DMWf3%4i&1Lezcv+}3Iu$tC zxxhzsf;E)+pykvX$vRVR;r&k4Oja%IxTNM2wF}W#u?{$1vJVB4QRrCl5^=i0FeTwg zTp0ipvO_C_-;DRC9B5lI8By@K?S{H74MyHMGG7yri2WwXiMzfQ$2jHfB9f@%0)wjj z>A@3T-p>LHPo+3>pN6`U=5AWTDFSk~E-~_?2+BK7${cYR2;t;XJn$w9BnWHx`g`Ew zo?~=}WgwEaXQn@o6O;wA6$5o)D9@*}|K2Cp=W5*Eazo84@A$Cg?x;c^9+Z~~Z*m@; zesCR9yMHj(c6$RrTs<-|}-_pDuOdLxL*S{#2LHvjQ|$ze4a!4d~*P0MVSlhgU(XK#)BT5@HVepsMBqt=^R z?>FbIC9p?X*ougoL7wINJtT=8h}j@KIX5M4q6zVxq4yRW7KxHy_3O&??D?F2Zt~nq zIKZH;Etq=Sl})5hU{EMtF2Or36K=c-M3-iqAn=BjX2h)qQy7_Dc=5?&B=_7Y62G( zh5oCIje${Z9}010TvCb0GpBR5RMGreX)3@?4O|MS0`>JdG9iu~j*Py1TNV94tttkY zu%yU4!Y@V24hm0`tfJ&<;j+tI91EH2&2f}(Y)K72Ex7D-GfLmosKJdYIUy@6&W_Xt z9nCjQW!~Wz$zhXtzLNzX*63l_P->TofI&aiSoK~jg-MZ%>_a10#)30V!?~kt;Ks-< zJI>Q1?;Uouz0D^f-K&Mj)2D}%G@W{!w_{R(h&8;}(vX&4D}{dbGv#h5ixNNK(4Ai@ zk49VrT_f`Ps~z3E3yE*krfB_P&A2G$4|zNmte1;QESRP?)r%pi5SmHR2jPKwTwE5q zwv+Lw}tPKBM2%G7DZXx^!Ho(&MAK1VJXlbDjAeawCJjVFU#C9N#XO+%Dkk9>P7K&s< zWo0hr*g)J*l{EB7PTqRcSNHlzKYy1=+mXteQrf3H!yT~qkCXdPcXe-S`&Vc8M!RQH zS~r&auO%d9O@q7d@9o3f@mQM5%Uqu~jo(j}ezj&*h3oq|m&>JE*7n2w+gcYbVgJ}Y zv;MA53jM#>xe4C2r7ZRm$G$Lqb$8j2MsY*oV;GZYDOyfk6p0b~Zm!bLsoY&(_o3M8qw8neNU- zx2(?@1StF23^@aTd^*+<5@7#K*DRWNBo0*$`GeY}1LL&YG>_P2vg?y@fgTxb)6l}ht7H+F?nAP02xbbD72IXm^R?yPIBW@$_ z9sZ1KNJv&kNf7Hn#6Dx!*ufN7sIN*=VMJQGG(^fVIUqc6SLEmDG?Om$23%j_Z{lYz ztkcJ5#gp?pR)Zx|;(t-(eVTC}SCT>oh?|T4G0#XplZ(p@O(i93=CGkn^l?5G5Ghe{ z+w`FDBFvKAajUVq-!VINL_?CzP>mwTfoHU2|1{cJLRX#AMB%i-|75J>BJ&wN{87?0 zutopk&XF){E~78uC|3xad$Rye9c&uC1%^|l2)YlX&0syJk^Dn=&>PAFPRft~iwl$F_Ty zl9Gq|)_w33Ha8a;tlE!<8x^CcB<-PRRugavei!fx%9d(;#PMN9pSsIj0iQPhL5K*d zl*o}bBv@F{AF>%aVg~9j*bw%Z>B8Y_Z$g!-fV%ZcyLk;kN>4#dA(P=* zc)l>xW=!pPY$cAST#(&La_+;s2eNm-C#W%t3_?UF`wK|ILb=#ZCc(_h z;LN62)jZ6O8VhQ*24mmcuK!ZDxvdnTPmw@l2IgFOgt*&lc@y!m5R2WkadLm->c}ow zWQb$oYXQW-X8|QI#B?(gQFg$#IfF8Yh;AsGXZPu~#$nPMpMV_@O2n{Xmz&RDHaUSV z=A@9er7WmFMCI_x@vRnE$);egPx7>gQ2w?4yBr!f7<-m3u$g1rWbY3MI+mABXZtGOeV z<}IAWAzN_CW7TU3N^j8w%sA)fouiqtExfktj0e$+Bepy zjeHDStqE{r3{HCVw13*H-z}<4SMV%a7Q}dw_8HnI=VAV;E7}^L$C+O1^dXnI$9J}+ z8JkR|e2=D7VW9d1w>dO#T-4@-mZVSCZ2M`OUWmKV9ftFpnO?dZA6&i<m`D zVNnTYbOm)<{Kk@qPBLoflKLC9g~@9F8fqS?$Goyh6b?J1zGP6&gW7sl#iJgydpz!> zAKt#OlR4V69hftJG0`Sbq(CHQbgm|<@IV{e`EU2I)G8 zeX^XBp$#5Uqk??0yr75Ivnp3jg%@=cVvpu{XkT#^wt;^6+QXF@K?Nn{zLI7AXXNF{ z^^C|>bjFfByOO@w^-gbX${&;O566MmF8>bL_E z8xx@Y-DK9$x0;tquY%r%nGX`@-mRcKJ6#;H0?UJ|N?zU7zn%@5T4`+{@i)?`I? za3dFvwTS}2V1`t%pV(K>fGNK%dE*V_*NYjymsi~0znha0ACeA9dHmHe@d)${~3Q{Ik@ac0oZ7@u|B0m><3 z*D(zKd9Wt$K-nmvn3>Bz8yJv}D5_*)v!_0y=c{X=c@K|9j&2@wXV~!_2+P0!9QO|~ zDq6lj^YG~iNW6T3My}@lW4f>kb*Sp`bNa8{e)yN>@Vo2vc+O7|x|*mOF!j|u2e%l2 zI_>pyZ@2$XOd5?_o306fHS65W!AuSIu=s6TU*E4w0$>{vuUy`kR+6U&s@H+bSk>39 zp_2oUD6>|dCcd__cZ3`KU&DL4DS(vCZm;2p3yLK1VZGiMnH~qlb?MQS(S|v98!F!e ztPEhGQK8$TD7K_?9QAP3nF~h;?nr0+I>+kY)nY zd+t@01uSh5(y5cF(L*+I#ef+l_hdpdU`>+iT9>XoYh?_Zc1XRa$j(;pv=Y-s>9ZLb zix^}K`oI+r{u?Vo4fvZw!Pn+`K>;!7YZt`9PO7%rSMAmi7gnye^0@WLSM3h|CfsE5 zs{+~=wtGL%B2qslhg9>MKLm5-sJ98dhwn*XKPL5MT8Aocl%(gV+hlchfVX_UraI=f zBbRt<+G~}EYmW3ig`N#F{BW*Frh!cu8N-$fYOGZKP?kc7M0?iAs$T-TYFN|gu2WO7 zKm~f0G%8_o5_3$ukH>DG@?I24BAhCc{A0MqhK)(UcfOXz=3HHmz7CN0H4WZiL(Le* zTG1$3I)}exUO7T(AS;qEd}?{Gsbnh^MQ}n?J^80b0)^uhk&v&eajo>lY!<qO8K zpMJAfdmaTkO@4>(H!DTuGBc!49jaNgm5&yQ-gf#UFf!ymDbJQq0iluOi{rB-H{5Lu zGcgMd0$FW5Cm$sI8ZhgMJY@2E zt(qh8W`QT34z>JZmP6>QA%{ou+xN#7-8wO*qQ$+R4I2wu8Ik&ohb9V8AQxsxEOmxm z7UGF-1_5SRg_#R6U|}p~J3`%prOIeF1MSA&euDGL3ok?wk-OA>t@9DMH`hfxTQ~wS z42I3@y@Z&PR4x$`8|_``jIW9r3G_|?y! z@jjUG<`mr~WU2YyCD;%=Q%r=4>I@H`qhv`Qg`iRu)|r=D!kFWwI7;LE^lv*U5`Q0W=z0G3_i5Zfl*S5WF-WV( zj^806CC*L@Yad?rl&Jp0R3U~wobDrx0Pnsr6JnB6lv48k9UJ=*3y3O9ZVsi(v#$JF z(U6FeSk7&5e57}4P*Y78qDd(b6YNBSqb@$-P4Ea%iUPMTH zd!k!yKng(X^9I6^xEriN5}Dy599A3{OPOHA73ATl1>LrbqeMH6hG!dnH;EUpX7K!b zp6rbTlX&6aa7Ka`3{x7`j}9gF*_ob55WU)MA|m^^NV*a$0Ag$+A{_!OI2sWC0~NWy z{S9}6cqf$Z!*lm8`HPNf(7uOLiRvZF+8(x{;$9RR!qL%XRQ`%F_QX~fztgp&h$r%;$7+PuW8|)c{9Ywmb5#zc2so<>z zFGbrM#QFnDGe~PjTe|CEN#m%@6Npq5?ga)%Nvi;g)rbjV^-n*64MpCBf@B~Ch<2DW25ierD8{AZNt(SO$ zzBHZJy-cZhHp?d218%Vb zxSG_S8%o&NUH;p&#><=8aGnlgzLMLRN|qk4#BzF1w`TlzFSjHE)khU*kAk(wJCm%1 zAj_2GQx)KasrCwt5|V z3<;UP6hGg_Wj~e46VNwR{q~g8Z5lXmJ^jtOh1IK0aRa&XO6dSC>P?amp0O^aTGL^` z)zZ|h+(Q7*;nBs~olnfDej!X<4e;->=>j4!4xtv@1)`kMG5aSNl{1UdscPBZgt0u*Dq~z31mh z-2|IN{G-ZJOe(5rj!qI_utqo6>aAuUd+!cvg=yHGH(c=T6#qD24YO&|i!I%D#jgG9 z^QYRJ_6Z3CH-6=_IS>+HROUm1E|f>;KG3rYyQYzdon)FW25=)pJ>Qh)R^==CL)jhS zs-z%@F0S`&#r<@Bxg?Y4QAf|Yny}y;pfwkeE`E*ijG@_J&y(CCJ75NnK@2hbqrQ?e zw6c3ScUtr)LXDNi^xbdkt7H5}T^$zp{l3#GS#p;K57J3W5|=-)C*wLTyjq)aejn)H zu%ll8o2>fpm_cmpEdOs=Rif1q%hCZm`~8m@M2zkNjp1z2uh+k^>1W1~-ka?nv@=|1 zmq_HYywb!5#;RJgIC6Pd(D~&VFcs)$FZq&a#Mq&8(`PUw@BaPA>G#>_-!kVz-V`{< zVXCvF*}z_(j(0Sf33=bI&->@`>5%5?EB|-<*FF6WP!y$fz*L-i7H)Nb1wB9B?_2N{ zub$e?`G+C2!5?>B;@w5Ze}U)6=RE!&&jwJ*2F$WLW8;0j4Mq8GJogEw&_9Kc*|Qjr ztY%jCPe`|zlgtM@lK^8joV=EWY*fpL%haz4+t}c4hO~IuwRAt=bkwa`GpHcIk zqZJIpoL{QmwuP{_8pY3z(hOMmvw%o* z+tAj+o!|m}ud=gzIGD51jxSqSQw(D0UF)G2Kw9J*8wCT3Vjx7IX~m!CpLeh>4yt{M z6r^qBe57W;?P||gq^B9;NCYLjW26h%DU#n>41v~_f49)vaSp8oa@@Tk2|oi7Xg0qR zid{9#*{m0jbFd(}wU4W{qz6l|GsUTGBioH2WoWaKSzOj8Utkv=mh`D$_t?=gF!Y7f zEhnf2m*U)9URv3pEr4DZc}lzLE0_lu);ZO0_fiGIebHHw2eMmOZRjCHAsA)RBNSy{ zW7ceF;LjK4L_i>cqrrNi3 zeo#b^HMAVdC7OanELogEh+qNpNnO@Fehv{8EyP@{JJi^S7;o@Wg=!&Sa;FmL?z`os$E8Kh<3nr0XD1fH8N@kex@6xUz|tPr9`wkF4TlLK%C zV!I8<`&6%KTg`B!oCw}GxBHG+_stsApaAQSUFc!EHqXF138Ey_h+VnI1mMktT}UQj z6zS~a_>_o4FFtjo{ctbyuIDqVzjGgdB*Wb@ll3o%bZb7xk#Uuq=!568aU2&M${FAe zoyf=F$YSWQyTS4+o|?hB(=%#`#4GprXN=Mp&ftk`4l$Ipc5EzH%_p|rXdEgXX+J;& zZ$PxR=-?1jkR+m-1kygi9c7Q|Er3BRdKk3iGmX_(zh(Jz_3qXYnkp@nb+5M;Wgima zNn69;T5O18da}LLo7VJ-SM*#@RK2}JW^9+i9nA7=eyq>_v)ZzTeMC%I-c)X$&7%T$kw@7_;9V?z zr82;@Zl0Xs7EHtSU?T(T05lB#m6cT0yiVcEoECmNS<*vY!wQil6?m+4xU1@LtMZjL zd@&LzZmYAXQhGIjsIte?vm17zF$YSENAXdjBa6^W61<42d1hB{r(RnQgG8}B!Y~WJ zSC!du>b7O=tp85`RO6P@C zYD-EG!m+(^-`d&?;cJbRz46FIDek{CJ*#$I*@ZzIa$VY)7=*udnYIA2#6)|!# zZz~qOQV$HNsmhbpxQWse(eAx`JKFN}|lyI6Xzj^6~^)c6>YU%BF zLSPP*`R`DcEXJGxmLJa%aZrk#b4Vc1E^;-yKJ@LIjYOeN{YC$@PKJgBdXIWe7u0H) zUMz`gz}F;>cDcIw(NB-3^Etqx*qr558!t7nt)RVJQj;=;K+FLOS99ek1HOF@u&F)f zG5l)em&(^N7O&8PJY->oFg}J*{9iYd&6ExaUg&K$D2F`YP(|k%ZPQ-}B;mG5G*t(E zZG|kuC;YdB+s^Mme&UWQuR`Gz`tTgCxpC=i8sO~+Ly*yV@quN`51tk5tTT4z411fo zPErqPeplfAl379x8(cB_S@RQWp`jp;F4?#6_KhVRZNu;5GOf#;*tC?W>1Bpzgy15R%P zkmzoQG)DOpMC(LZDU?u%_y$gIX<=3{TR{oT({NL6YOaleWmiA4(q=biFY-QolaMx# zDM*{A^rS4(1Z$MmL8@#BClb%rbT|Z0JZKN_Cv#=IPwr2q$lw&aS*Hv|kNrN`_GMkZ z-nb{?f}z^`-zrT0aB+@pst+G2gr$X2X7q*etZ&Zwz0o@gU_}2f!jDYk!JD!*ovit_dOn6OxzZNo&4ulLWTwKT-_+=6+pce~Zr z(p!7+OTx^^OWuFn)I)r7^(`eG%OT@ElmgZJ9@EcHYrm(Sb?F;mcRa=vX{v9@Gx{y_ zhG%oDyjU)GceRH(zWAre^`bVaBJyTip%%4T>8($`kG+vsN?VrYpLrirzwi6dT)u35 zE82Pu$yD6mP4`)8_+$0YqmM3F7=# ze<~CQSh|w-DCnNc81m~OSHy14SNd!E#UYW$V?OdpoC~eWEnscWi;2cDimHo0!DXHJ zbrK(gFwIOF2^M;(gLcR^2Cbfc?oZm+MYlK6E8I)XJx3^IISng6UxT?|P3`F(^2|4~ zpI4bMPe-Ah{bi4Q2Wh}7_Zxf-2_Dvd=$K>?SGX;_Q~9n1`#3LFP?N-6 z@Ln{Ig8E;q*_GVN5$Ko0wAxWB0|n!^z!}D3w}`J*pK?)6mXsSGD_P)Isg~MGsmT}3 zs3ymhjh@QvaE;FM)@=*PYG|0Hq<6qon$chi4p32@?F>wsa`(ITtS zXcIog8j;WBeH4?*k<-vFGn+P+bxM&=`p{rs>xmy5B$fk32KDJhtZJqYXn_Q>B3^>U zuk#uLB46hKA@7=7&dhSJMlhM&*fYHB5?03ZPyVpuIPR_LPiOc>B)!8~0(4EP0xEcy zSftkvkJi2rNkh}idz_P zE65WP#rn03h-45oh=yp=e#+$oxkv~S{Hm2|g*@=N)3>m+Ov?J&0()W;yRIyNSYsuI z$WXRFsMNJZjl9OUGV?G^!2+Z={T$*m@+E{mZ`A+&25NCSWaai5y_GYfm-k9crqIqj zqJaWC4G80qEJR#5$2^xk~V zvmBC{kReuL-RcYaupdo)6ft@W)i%C2MHJ3q-rX|sFJPAg3KwBGqPJ)Qoi3F~VXw!U z^!_;L<$Q3nqqG9g(vjb(;>F~g9CLk!qJhNsfz;0Eb7N1^8Cx*GByo}=w2YM zRn*pAO6gWV$$f8h749x`)^G8ij1JSqjgBE7J;%_y>xKpyZ<7|n3~9v`}V`RJ@&)-ixsgV=6v8~ zAre$s#q%5xxu#1?KQY0JVYYn{S!AqpzPHtT^;2=n^?CouEx*dD@RBVmZ9_vl!Rm zqQL1UdrR1%-!qPzG&zmTxd7t|SXmXeq?)7cj8MjBc!;jq?%gCSP{3?5R9}i(ZSPdq z9@^&sEYio~zn@Tjmf3pY04MqZ&^hZGMpq|vgKQMIGMKK3@NQ?@wp;UVK)OuB$`|^? z+st)VwYCu6$o(9^7wBYc6MRqjrfMQ&*sF$-UIVgUs`RX9h(3ad zueW6G^%<3hSrv_JM+(9NSkHQttMevqN*!Vs0TPZFN^%XC+>6lD4I3^0&b=_@-9*xW zsHwH6N(f%ER@ON@c!fwQ<9bj>on1n19Tdlxxya;TMcq z(B9>_p`w`wW83y1ciooiPVlfwUxJwG`-DU40){L`vX_%8CC+VpCglAA$2fhC$%q5F zl!YObe?1`V=XIB$k8`>gG3|+Msh_M@2}HOOo{Gn8g%MAS?gic2?00oMsO9W~FXs88 zi}4+FOWybQuEr~A&J}W$+1d3_<5s{Xo$z1>>zeZx{|9o`wC!|ty)Qkf3S(VllcT;$ z*}6|z`c@t^M>5A;)sb~jI0WU(8S58@@;L68WDX!C6e#sUji{)+EiWDhf-3VE|0lWhrK zD7Npbl4jHlc(KPM{BgfzWqZ70=%f1#uIobX`ysVa@DRGJFnN$#ZtbC%s+i?ejx-B5 zkDu}P1%oZv*MK`aqbttBj36iw4z)6(+a%TF_^AM=Qgaivt2C6_-F4LF5HiAra|EtO zab4nC2h~44gQjVrOldhcWkQ>laA4WZf^;!_A_m`WpbGmp$pBX{$f8FL~f|t(7vK4Z{JP> z-}p{ks3O>Tke}h0MG1^rfyJk4XD6?VHbXpRYHGoWCa@P@PFynib0hx@bNlN}>+`pm zPaogJ)>?X`Ua`;Ybz#)woWh8#xXGaWNA{f+as4AVU@(XQeSp3=TXgcH-Odq6{3no~ zBf?t>qHF14H{GBMajtO0@y0q<`Zk>J#&$RBiMVgQ{gP)MOv=e>vLt?{3=^NN$6q@V zQ!`|!<$fKwt6gg)az&C2M!7Cz&ZS4eQ}2_4C9`HFf}DvSyU!)H+e9wnWXH6z6V zRHXIc!g|ri)(l6K2Zu8wp=bWXb)@T%OW1Iu0q;r_D)O)*!Bkt z849cL!6RSo6SM1sF5Q^)h(U3AH>@ai<&!G``1R-zL#}t+ zb`-#Pa$;G<~ z?N@i%jRFiksp|VL9CWW;R7`fqmJCA0ESr4$N{C}BVxqq$!*3Xw?Q^S^>`@rW#q2mT zu~YA;JLP+Ta75U{j!RQc`;pE;)FbG%N3FFaXytLbZJGSsAx;_Re3z{`^}SF{4*>30 zfJ>|}Pe8>W)xnua689t*RYhsEldyoK-x)%A@}HXItByplzDK6t{Au+7mq+Ozor?ZJ z){9)mkj|b6(S~>aUsl92ARZEf@zzuPqMFGzZNjf0)9=Cq_h;g=VmJ4aC(7jsoPEP-+JE<1`x$hoPp zu6{hzvC?dQ;JuC8)&Ig|^fi$Z;#?LEoFH)-X1X?XP|rYuad4Fw@yQmL>m(Hu(FZUx zx_40L7t)sM3ZGe&4BM@mUpDLvA^9Q~UXL5o_Ftw8JyJI0oE0zL&Y}b|MaUC}4aOK*R zCiin5$XGYt(mD3~_2=_5F-J3g_V-H>|NQ;E-?O3fZqpdz!;t#*CflI*|G=N72?zXd z6WIUmdx({Z`F~ai|5KXvZ!Z9Y;se2eNzf+wqn#jJ<2-?5M(6qMuyRl`i3X>K7{N;gqGa5&>u|Ia0kDlBUJ~e5t)q7=Qz|x%t z!EdPrvvbn@bvd>R#yzBF1NOqh4puk`N4f9SPx@=#L}Id+VmvK9&2ex~_+`e-PyD5o zxo1IBM$Sal1T-g5sbh}xAMzX8Kk^%WH(I##R>%sU_11(uzuejRRHtJev;7O#v87X; z@=u=+XExp4u4@+Ft0fd5olnwJ2}yBi*Evygo(xi9QV0byEWc}O zu8t-lENyv)TLw@z z+veec>l>k4@Q_;rUfIrHocQ&j+;ri|8jk0<7Y|de4R_DNsIrCeD0g??jmwCq2UQf~ zYYSbXk*m!t*)#YBnln$pEuw(2#Q6!m6r5Y0lRZoy9|mhKTgP9UH;M_ZdNAW@uaBxFy%UP_p5I zg|*FNv8I;lVw#mzdLt$y*BbL^u86kI2G)C@USNcjtQ*niSD^*12G8B`chzJ}ugg$U zc({+I_R>*;#TswVi3LPmj*UM6RO2|uBv`xMNCa5;A|q|;j*rA9)@F4rl1ZVXN|m2_ zRdpzJXE|LUKv*8AC^jb9(YZ_@XJL>)g&6rpyqUmWf*EUi2xVk`|3uTWmG=r3Yl@)a zuY{yWU^5D+D2v?y|6cV)cY|S-`z6N5yVRH6pnU_9Q`xfB=#wxf%i@8n2N0Y5>DqJYiGY?Fy7e*XBg5CjGrj=l2+i;z_{!~WYYTR4l zcaPSBa`5}Bt?cKG2l^y$E!R{B2^RH0&42(W2Lf{l0KWVLO;^}$@vi0dlyS(h?rzXJ z|JM6YfD>dAUoaVgP(gL4ZWT5iC&?!C*6RA*FLHZVxh-BaUl|^D$9Nl6#wm_+jK6%c z09%E4Lx-O<%0^||$cXjWhu-Eq&w!<-AK5u(R*(#wIqG&-L1L3wWI?ySNjLUzhTw|s zQKA$)yfcp-mHY|20bAc^bmumD3Ij5hDqm;NV$cAL$pv=KL~1|mF;0R~Avtkx+|2sg zM}n;!9;L6fb|G9$U{6MgVlq{LswkK>;)oZN8(@V-k%M~Zwy#UDD6yNU4TWX*Uxvmf ztAi5{N4B^n?IJ(+tp@9PHI9m)at>Nba&qYHxpZ-?vZy;q%M*)X#>ldu$q(x8C`;r9(JalQK z=0T`DXxY&}j;6^!iB|OtPn`WAHbw4S=h>jl8^`Q|WzXD2v;f=@wm_yH($cf+H?hl+=>cck?z>T+<<5wbkYIbFrb^2rPoszlg8ICd<0$M zo`6N(ahc=A!QDzuLcJ-RmVwHGE6U5iMnXfgIO(L3({ik$)q;bl9m0*hY*SBaugKY^ zxy@cpcFY(6>oa7v#WD);*T8%)@w%->Oj(Y1lA4_Zv`1-#sTSxQBoAfSxwt*7T&ncc z2jldNBs(gpY_Y*{_>iy3I^G_%gRf1OA|F0p*HU^2PV}aK=GJtWudS!ddg;$&HdL;K zbl8l$?WhmKp>D?n3g}lP@Qfc@PcxD6njv-8y)@_mj4j{G<)$!#*okFo{f1^+kKGy5i%RbvLPR`3BI*1*^?9pIo#%18H_Mb)jEUwt z%9J*(KM;%m%uh$`zHUU+kl4F5E-n=Fc8?Fb@7M=|%K7=rFH)UXv&$)e0<6DGT81k$ zXcz3O*^1euSHJ|*>l-|JSHD8|y1Nfx8X%P@k{IIcCYI5gM+P1nGP=Is5OxKn=hrx0 zj?@-aK(@brZEP#wZ(QNtctf$WGzcQ?p>cpKz1;r}!OS=&t!K5mcLHLVc@`&rJkg}g z)eyUC-s;IP2Qwbx1dU{XIl9Qu88RV{;lNyS@shRcIq=GO4clT^bMBb#6L)Ts`$lOAfJZ%nhc>;Lc3ynhaJ8sfz|>lU+@KpbE#YK9!v zwEVZy(7Mr*g*oZe)8!y(-En1~s2b$G$}c{kRlAaGGi9~T*4NMokU48nCH36Rt;qO} z(B(5{DI@mwg;JRNlO@;s195U-pBkW!Q$nc6>27vm%_~dHIQh)z+PYz;R^7g-8Y4h= z3{dU{PCrnwHJd&>aC~iVU}teOz?Xx8X~zDlp;y8_x~z6(pR04`C)+Q?g?*H=Ocl%p zA+H+*V~RA>cC!MG+h);rrIvc74dmu2hJl$LESpnnt8J!zu=1ST`A#g5a_zyE*R?aY z2*q1dJ22#7^se>Xp@wzAaK81lE|RzJnuIl;u@+lm^O1@CBU|XXLA8+7{CX$f$Y+ZH zE$n3HSoz!f>;!d^Y;)a*Xn@T1R6(n^9!jOBC{?k^I#} z`r0RG9y_beK75w9V{>Jjmrk$o@&B<5@u}yUbFZunSa@0?;+t*2`cAsPA0O+Ibpuhe z4ZZcSfoCS+%m+`w@Zb5fY4^cuuP`3bnBzQrAm?mWy+g`ULE}c9IuFHMRrgRisM}Im zup@#r(JDq-;J<9(;{P2)9M&Wz^ZT=T&NTS_yePju^Os{Ydnd;z%}%s)zE>|Ri+O?a zQWMOWg|5%e&Z50{r9wC%&PEnQv56q2qMn30nmE%_A!|apYa+23i!Pokt$zb$JKqTk z-yNaPyDsZYjt59D4NT9?)-6#UdB*0wOP+H3*qOy<{+yl$M{Gh)(D>=aAWG6id(%iq zd^tkq4OF*5SLN+`HPN(D^Q4x9%Oec-tnJ~!&9k<|HAO_#y!0!i$G6Mn0S!Gj8L|B=ev?vx%>ZcTo~FEl0M9`(VzlG|yPi=tSfWaRmIU(xk@*w@q6%z2w=EU5T{_Hm4c!BBe1Og+@LE!LJZ9|Rd z*D>ebMdcnryDOa`>No;Iv2c`6!@UR=3`a?E76P30;$|*dfvLV)%@}+&l52O~50)?I zR$CJ8W$|&e8{a;^+wrMK^HqC^)`qH8Oll$>TLYhHW~qP_h)(lN4SkmMH%29$Q9xjs)>%341tCW?bYL z_aX2%BO(jBJxa{mLXTh<5=}n`FjU#%rR~1<>XYKzsHJQM`1o#3a8mGhhx?D;7Cau~ zC5o%Sa5D3Uz#>Fw=e3pp#u_RRzHCUx*m9*5?O*4*2oZpsD_lHWy}`x%y9Ka{F!K-kDjBs2VS!}MWSt=R$ae0^PJykP z!!*HHNb{Ro=n$m9z~V?kpefU!^Ol&ALwBUPCPkHA8X;+jc5<_{yLk8aC6sR85+%6w z*tvzC9`|bArJTnx6Et*fG98|{RqPn&+u^5^l3(g1D~8jpQsWUtqEbPY`mq!zjax2X z=P<`5Xg5WJ_-}&x=M0p#iN=Eun{wa#6IY!8yEv4yVUhe21~b^e@bm!St1pMJRBb|{lRSB_X zbTtW{Y4Mq_jV7~p-~0F6h_*JxSzX~O#4pM?-w?yI0&n5 z?Z=j2QfWwXN0cWicRLd37Z*p{N(decjO^(G&PQz8B|jk2GJBE>JWPS}*Kg1E!y?mr zX#mz56SYkOLIP{umRM`Q%|Vce-RG`>@qUv?c3mxTdZCzXLk_Vm%@zqg(l+@E_2P)Q z$0QtA%&oZL3u`UiwTx&d%7z^wqhl!PWFuKbEeiTrSQ@!03bTPXrE@5npzMUgS zB6Bt5M1)aiB{;=UHuEM*F+A>FlbaE-`U9Me&a`rcc|I9uEorIjon#CR#i^ecQ`mjT zPk*Eb?$e39MSb_&!T&31xJdaJhn}!-2K0NBON?Q{IBJ0SttW$r3RdKX-?{~Cd%BL~P z5!GwE$~{MI#{)m@*b!u-mCXAK*Xe)$%sX@m1!pHN20(VrlB>h5&LxyzQ-?QkP%8@= zx9PcmC{7RMw5rSdK3dE$-q6O+HGmUZ2LvE>ZMBeF`-dxkNcx(4YD74{C0D${HP~g+ zy4!&*d{*$XT4kr%rBxnTQ!Z_@b4Fs7jt%@^uN2z!6rEJsnWsKASff;Z#`t#Gry#*h zoaF-P)*485R_k}`ao*5%E}P7sD6J7UwW>Orq>|Xn^Zqq<9pozad_Y;c^1b5rl5ZfT zX}bUOnL|m{13@=5HJ@+-@jDY>vz_GE2&XJ9*@|FfgRATErKVocGQ!vowkXv(JErmP zr=Go*e;0z^Hwh>%&&Yl)V5-vD%uH_ z#n~gXMOs@g@7Y$#Kg#F(dkGLKk2ykdmi*4oE*5p4i^9x_qjIiuBW5-!P7|8aX!z8q z{7R7q?9DakuBE*V7)TAf4rtI66Ewuau%m`Q?%Z{QoPGq=VYlvg07e|r_kMbNGP^eh zJ4|+az;mvWdQvw(s5$>WA~rpGQ(SP@{a558{~{2z{7Z-=9k4y0)Cb^FtGxh`JQ(%hceYo( zn0!ZQy&iCf(f+$A=#mX;YVO#f0%{@>D3Xcs(MBJ>Ovz#V%%t2U|8!(ahwL7A&^o^x zUq5`5>P{Iy+`buqa^#eiux|Xbeg4_V#$JE(e)ztF@IpUIOk?UMmwWBn$_nX? zj8(o%>e1Zp%d;t&u?pmXnlI;Jik#<1y}g zq-ONsp;@irb{q+TNx$ekVH?~zDFH@kh0thm)C~e z7O*rFVU3=n^#w6})rH5x22V2_V(p)2Q*G!$z3RSk;-UO-;3Dwv(A&3=*Lo)ArUJS@j z%v4y>oYq=y_nwXuDDpyeC;Zqv*vXBECy7C+x<=);sS=v5LACi8Z1qE5N)q1K+JiSL zrBcN9p@QC#p4VncSG~QqcT(p|0R96m!C!Li1vcOLvp#B2$8gxlDeK5x)A^f;5tbh8EnwM9Q-5p}}EeloW$JFl)F zELUiQSYQ!dj*P`CtHHN)I7KJ&VTC(^#}(8Vg(dDg_EHAxjHUdTjxhNJDuENcjT@-B{}8C(mi@ zuxnUPV#yw0uxj+-@{ob5!GJuyJ$(rTgrPd!#CHbUa1Dk9iM2I=$XUS+2+cbq{dulS z0-gO9@E@DdB#LQbCiNT~hPPEjwAhoDac@2>@QiX0w~aRCBo4cv=*W8j`$opqad8W+T$Bp)@fOox1C<=07k0)6ke(FnB$n`hh3u+xlS9DQI(O#w+~ zqSzFK?BfbVC~6K~1o-38JWyEEFRw&rO#K=JjJ2#2+m_3$GvQqb8)Qb@zOU0q zuKlgL`v18IF+V^R3dAT>x96EG;?s14Z9QZrQ@D6MP#24o#MlvgO&d`CeDV5`6gAY5F~j5jc&0fld@(jVBcE~r9)58t8lp^} zx$9F=m56vyQwkZVk8Y}#Zdbk%lSByTwAUCjwFP(~~Pyheqq7i|TfG zSNt?~Ul^$h;BewnbIVDxEjm;jlsvEPFuSs})$eT4ol3M-wUD#LqK(M_eY{$)KVEEW z)Hp$k3;x@LH%;VtAq`|n3G=&{#XTg{E|m9td^a8Ryl;^YCN+v$<|)}?14&?z=c`Ip zJO^Ojsd-?sa8L)>(Nto%hh;qC8G$Jffe`pA$h)6%1a-S#SW>S$E@bqq#lHPyb=qIY zn}PrOleD-(ugON&_TwuAFUVGiWuY{py8pxuO_#LYQdNK6tf2T8IJl?3WoD1OoV^+E z@Mx`-X&x)6TB;2f83rv;*%GBWY$+3(IHd^~zrz9*RMdOJcz*IE;3DI10@(ZLuqi~0 z65*HietMR2vH87H>k%1%5m3^qe&4ADMqJ(*hoSZ9VgsZODuv~D%2P{SIq3C6vWRz# zWp>eyY>IUoJ11bg^v(se^kQ6pI}oK=N{^((01D8Ovo8NB-~v?A$(=$8UZm@VT;-%n zp6$|GREQUxeW=Glj*m2vu=*aH4G97SfBy7owVUAB$lWo%UT&h{m z!J0`zuh@cbY;^VFi{m_#q5ZCRr7wKi4(d1izU>O;mg5`g)d57oCYuIIOXFk+K(oOZ zUG0OO%IoePN+cf2uknm)Ywo_a#AF2<%1AiKEw=C0#+bawyyQx$zS$O*rN9l&Dl>%oduGShV1k5F+s92`vsog+Eoxg3+SKcT( z(!w!ma-Rrh5LIvT+t6|&#E;97b04clk_m$L%;yY) zB%ilNnu^%bxvP?HW7(L)z1E9C*K4;)OqFnF3MaxN+pBAL#8jR!2a zydE}8fe3*;LhPM91LxPCPSaDG5Yz^3m21&M+PoOR*oVi3B`pM)Pu!Mme?t54vyxBGx>eP#MXT~4y54s|~=Z8A85WdjFQTuMvCp z(R+TxG&b8%Ju12$xxB*i+VpmXM$^NWts99P9lFmk+ZIvQQP`fxV^m&Uv?(0b?&U5m zp;Lzd+FkzrX>Dz5yuMcKj=P*;g`EX$3u=b#QgW}7PnJV-yQ9-RgIE2 z^Rc2c>@IxtXOrK@xuh34gL=={GNlH0y%SPUnXNnOlF=c?58O`Jz+BJnbEcuO+PQ*c zgZdFj9LBuX)iRVc;9kBly{)|v2mt^x$xT@>HNos&g=Tg0b6_SF>Md-m+Q~JeF!9WS zq#0<*myKnQwG~tJ5eNSc+zqX`c;g0lzUvmY@{}bg%c0l&8nJnu7&jiL6mk7eBJa=K zSMf$IOJ=`|ZM^FxzV~iQ&Z-zYq+qqL?=$05{ogx&KpO_4|CXgW{#RL=m4)qp_VF`X z((yz82nnz1XYd(_yCn7V1p-I}ZN=WyUiGwH=_d&~AFtfZIs3v%Jv-NE6lg)}D4bZc zhuPq)-;C#$Vf?(J%p?EYB}>ol|LNrYZ~T5UQf4OPfAi!vsJX`|D=}~U^Z#FY$?I>{ z58L-g!sN?q-R%-Q|GMNH)tsjM?W>e7c1dvN&RSpJ`4NsznE#;@ljcx)A3dPoLAOP> ztmXUIzm@GoJ!*1*k0v(Hj1-#rV9UQWP2M9yVi0O1AuYjia7Xw>mTM2_2TNbil6C+K zxuV)z-LF|uQ@q}fGR-tjTibKkqTw?VDv6ssn)~(UM?=qRS=0Cmc5JGoBH+!1S>+^W zy5yL<-+AfLb>WeZ&fGV_%Zy9kHUgl1A6CTP4x`gi-L9!|Y%mgS6%NAu?4}*R;{TwwUijnLddX9_=IMq-2mX3`Y|=79jwn8bOEH)r zC)v%;1~q5YB3m`F2ed3XUyZB|GZd`kgK&VScg)*2ypsMFm!uydSHv^-LB-r-iicCh zj`pnfIXA_j`dM&fMUfMkEvxO}63{4k1gky-oX0H>Rr1VP0hScWHkx)@Vnu&od| zAU{?2V>m7WUrSH?f$^^X8_nlg943-RI5Mj(7pkGWYCij-)qrOJ8wJmz~GF1H0Yji<$&VJ?- z@{4tJIgMR|FT1AE z=}4wED;BX{OuySnirGCftimqZ?Qg@(Lf4QTYXnRX9&4 z$q@|DG1}l^FypW4X5c?TL6p|7Fs3)+6v#Nsnw@|*bRFKbqF3{0elcPzcog>~I(-+q zGT+wcmdqZLxOLvL@f=CS!HEO|O*oyaZu%y0gE-J9PIXXxn&l9WV0ABd<-5a$9@eKd z_}UWPaTK7G)BCJ*#5}v>yUW!cjBCAx*5gg|DyKcuALu>5K@76kDQB zNxf+zcvSDOT)x{1&vsMo=s4Ts<<8T*L2MKDC3Hv+IP!UyMTX!drot9q82@}El0c3` zRRN``DiH75-Co*WSHk<&S3#XaNt7;x-;W2?BskWmW*7%Vr`|^B6DsU$M5-~%bF{fV zGbH8vEEow+k-jtf8fsdb71(BuA0J#5_c|NG8uv%*fQ~))rVpV~#g?iU2Ugl%Fo<17 z#ZyH_ef!257|2;^txp9NvCRn^#Lt%rO+%l-UpJJ^NlwkGYT@Ab&0+TXQD#7 z=KG~D-Mt|PC@IP6eo_eE=D$V~s|MH#zr2wX>F*R|5Vz8dnWD7?y`kt-?B`>`R*PyVLb|e z*)j=p^CfM*wc;YRb^Adu8T%KQD6{>w&AQoyjIb`l6W(=CYjx)BV~Q?SuG4JfxAL-h zB{OR-zR!T6ZMd``|1RGo%?)>=Q5(mAG|uum)$JpSS#S2?>|+JP>*Ci|wbbz_fBJ43N+4P9_N$?0I`YoZZJ$r=0$t`$ zlijBW4C}PF^U|3%TmsfZ-Hg0qtd8lQ2={zbd8PU+2g1Z^^xb^c+o(z3@7B0_AL6nk zI1ay|&Ge{l8S8N6qtvL?ms|Vgb~sHT*5*Yiqg`^w_2EYr5taOu0{djC_nD{v7J1FIW75vxBQ^+6xU4K|;;(aAd-tvfHsm-O(n*^MK+(k=X zf643Av8Vqu0)`fiR}I+k(Wz;Y7|FT{zD2*ohLR2Gwm#EoUQVB1;ed(&12T$0T}^p( z<;orX%h-%&8HV=6cCFF;)A#8Ybn~_M>J+idzq}2II`9s>SrMnud0Gxu=M=H&_gO{P z)6f|&1tF<1Vm_VxaE9$3wUHKQ?tzyx9!`++K1KMX9*9g7$fyj z{uSrA=~bAh`&v4kEP;6_?i9T*Y9AR`a9_b;bU_=HF<|ZzfPSd>hlYj^I%W7Ez3R_o z+ml=S28(6~PFvy2wmRdft}@>>S98JbCC~W@9^1OlhfK3|Y||P3F#BWuw^i%)n*DTC zvC38lnx;z>Rq@+-8i}N8R@Z%do0pGNOI?4b(B&R;WxP_c?e=e$jT947YWTF);Z7{> z(p~WFFW(QVz%>OIp z9TPJH`~MvrCu*eZ$9+?h7^UsnIEQy%Q-w9A zqtsqMuMe-sr`vj?pZUGC{$J5rAm)MK4L;r}JE10nlgFF?YWhKI*!1EqZFwdL4{N-t z(Covie(~Eif4|R5B48R(uQNVhYgwCP)YgzoF!b-+k&AlZRPScL7Q9`HFT@+Ykgm|K zVt5sw(`{UCD*enS(AJ0NslQlcpfx13XnnqWEmSxMLb@|uqp4r-+NtPG$Nw-8+lT%N z>_L|MB1JjL3e%Rm<>YO;D0aZt0C%!KO?_vd{y`Cx5IrYm;_l)F`BC0*@1^3kO6x*f-#~oz zjD8i($Wb#G(V9&&SqOv8mJsQd0ukQC^^6b)ZB^-_N722b6{OW%%BD;_PceI1jjZ;k zk|k{$(3eeZ%R1c}VksIsOe|4pM>VAfUybLSr$aurE8~g4yC8!5`;e>^akEsy^&gj| zU!e37uW*eXm`AHtLoBG#Tu<^4@LBclD$Zeb(gkdXu44$aT!k_w?%3e`I#VPEi@UW; zX0u#m0V3n*L$MKY1*x5~umtA_Qe*(-PT}^@wf~%MvW>1n-VP~&SP+Zm844oN-11F- z2&LPp1MKGKN3!xK?uWRMep+{fT-o*>geXCX8aco)%fCZ)QdLG8*AcUz?nN&nM~ zso>Ae2irTs5g6axcA>!=-2!ux|Jhl+TYzGXs#bQs%=gpqt=LW_S=2y!3T_hkhaFK$ ztJ%8b_ z5*;eYp#;)$=2KyJurSW(O4<#K)yJR&VN3QUz)e=f6t^W{?*|Eri1>QpzGL#&72%L8 zuBj+Fk&R{XX^ov++B_h3Jo!n!=D;C`NCL7I!xVLK#Cz(i zo{v17M>6KjS(eX*%3!Rik!MYRiV7rmTj=z_Q8V3*i~N>LnY9AuC>50E+@V4q2St;u zkD|9w3YH2CmYlz)gG+f~MK`)ez@!Ozee}P+kRiYeXUx@Q-TTfN7W{ld1Qj(-kv6SR z9v!Y@j2PJ1;1%a(;>^s^W(b_F2&B=rzAExCNQ7c9A;lRe=kCThQoTy&<84JBpes-} zl2xJ?tiq&&h&|S)7)_DGXsw}ob)j*iZa0SH$h)Sowk{Z%<;=PJ!=fdBPJp1D#1~kx z(Zf3`s3^w^n&H(SKA<+D)Y!UsG>UV>BmJwwoM}QtfcLUEP1ETZd4*blgvZGkz*};I zHW-m@09k=f#Pl?}I{azPythp_l>1`uL{vqA9DZm50-2#QwWdb3CpvzTPO)^~X#I5z zUQ8AEDb0$rQr+3`yiK%?(#b{lbIq$Qvnw&YikR;$1`$oYNJ+lYQrQ`6KuHnB3Q0Ga z;F&yVkUcfc5FS}=1DdWn61x9vwkW(wMiz0QyRau(jk-hwHK`S~iPQ|6MdsNhTz3j= zHr-|fTh?nr2uLw$TqgQbj~ZX2T7-F;?VfM*z$VMQDa3B|jqfw3R$sdoVKYQocATm~ ztq3<1kJoV7CvE4NJY|59{cf4#kc4+wc@%wV$tv;bU0e`2lrBr0Mh#1`${7yk?R+gh>)w35r!GB?p<5{fTpvo$^v`Bt<62 z!av>>CRzF`p5~yAA&^7`=P{5DMue4U09V9@nxTNSQ_g_GH|_);?;Dou>@f+rFjZ0X zAPLg5oVe68`U`;?{zc#GEyMZ8oae2Rw~cb=3R1nBydr4~f-t5>7xsj589*HHgRX)i)uUgG=vfL@{_v#9Y*N@r* zeqC)t(8w;PK)_^Gx&NTFV^pLv2@_<@I^-ld3BUn+Pnl6o%V)K)Gu2C~xTcHM^rm_d z-`Grla?(iZR#xV`#eBBoYH`Ln-3}O92*3RaI={mOKLf3_^J(2~{}(Vl6hER*H6m5eTsi!PxL0#HEm;}QgIE^)Pwau}wjAyksvG)N@sY6} z#QO^bzEKoBoJf6`PgAN>o?b1aiu;R8dKwi=P`3{Q+Dza4&$7BI&e z1dvs6DK=#|k+3J{*1eP?iSy*n^~~&>g!F8)znmJZTb&7?5J`5Y)K6c9d~_+FF0lP9 z#FUM6V1+_DiZ8(kCdQ-tc-c%p<$Gr>naGqZ_;K|)^?5~j4nkUj2C(CIZABSAD!;M6 zB{L-{y1T= zir>eY&t}fP54#`A<7THkBfeK&{u6B@0=Oj2s?xxAUZIbNft}>!9LI&cYudV#G4I#- z`@EbanL8$02U)Fa+3QpOFZlDD&W!(-r2bb>0wz|D|63mXug)HBhwb?fl%OPI1C+%F zA^|30lf)O=seGox1TI6;wq4Uqr$udaVy2-J?uZyudNNY?hzaLlfMR&&dshv@Dv=eO&}y+i8tGkpHi?Qbzz zhG+(`Oun_|e<-D8b7Q-F|0t#SlIm?bCIC3BmqzyoC!h!Fx9NTUKb}edp_J0)=eLl} zJW$OJ&jIs4^@Wd&fTGk{d>i@VEZmdn@rIO*R274(U_IVoqEpFdeu?B9UnX0!L4`J% zq_FXIjm{MwP}?;xdz`l?^ZTj!LTdB*zZZOd)LHxoQ_3>h5r8E3Im*Mch;3mHKu)k{ zLmHY??T?xyFnQozOsQgbT+?Dxb^%jqH|0VBF zehuGTy!X#=7nvW;uB0=s?)@z7T`mWGY_&(v0Ziyxi|#`4>Bjq8^YWSczT=c#COX>_ zP%K^TNql!6qbC7>u9yvRiJfUjs7INv`?@(CJHn(kON6K|m=b7IDdB9}qtgPwjQ7-% z$Mc*VI^8YPEF078&ed(9ua3pc!DwJ}QE@yMddb=o-ZMo}+KZVd->g$jZlO=Lrm|Rz z4T)d#W836Rk%Ks}j^wz9y1NkBqj-s~ih%k~C9PcL4nw2wM)*~8Ywx~%?_)LVl>sQbW!f6>US)gwnM_6x&eHO!jsSE`Hrr2BfpAV9pRam#rm~6f=VuE>ll{Zyp zG}NxI7_XaUs?GQ6eirXmiP;hQdVl&gs2#iS(U#0~y$mVI6d$j=N zy2VJW66D}IW`)HG_3xWCzvXD6?ke4gR zZc$2%fJ%Q{0cDj+0e zRZl*l8Hvc{m9{}xom<(nE&$!B`7`w<#H3=imXBoSODt%_^Gc}2&LO4VQOwk)dYnA3y|~8=>K&tSsn^1VM~Ur7)&F4q}JF zqmZ|_$GM*{aQkb#sxSbr8u$7#ymRE3quaNN>Nj!DHwdSXvEdsgv>mh}@z5{PPa4WI zHu>f(6dxi7&{XK&J!=?2MH!<_kDF`^;d=&=)VV5vFGZyjlk7C&)z+sbF_G7S6c;{J z7mWC=y16Eprle)8TKo%@+O=6t<)y%>EV6V8TNoQ?L6PpyK+d#T%GyK9I3oeA-4yCF zr4CKr+B|==%$1Su1PLl%0n;##wGt^zgOF}y)SQK`%cE-FG?5jlMdpBBUAPZ-IgbUv zmpW3Y7NseRonk+)Z8`rCFZ)U6?QK9UrX&&-Bu|L2PVrFIU}(vtt}3Fy<4f%LYZLgy ztSdCwXJvjWe-%O~@{o5J;?QCTv$MBaYjXY_&9#oUInSn9LF{Lu^$e~>^>z-|5H99o zv9jiaZXGso;yw-)6~S%S9kVMqcCbsfShxLGQaAkJGN1lAk}ft>r*MC6h*rZDHxm9* z_vdG&;D)x;&BpRL+rG(t9K8Jfe90Y5DQG@tlM<%K_P{C&{d>zS^l1n#?=-~>ulAk(p>hK`W!ots9Sa6;RCH});3`0eJ zx-(563VdoC-n=8oE3u8~V5gu}PG^-I<%{0}D|%Er=etYAV}U%%cE&b`q9?9fn`hs* z8MW@hzkAl*T%UOI|1kDW!J&lhwr;E$+qUgw#+m3iyU+mXPPbYz#4gXno8184EBacc>G z4>v_1-%=DP$a7KBSfg=$=8Ak-tsOH5RN5tH=gyuS(;xR?xxLXMFG~9B(?!16?RmBj zMf|QUdY?peltF;(5CpS03`Dz0wMp{M1JKgyCmGKbY~xk~G1^chKGyQe@duuZE3BT_ zkMxL)>!4CJ2O!eLq;06uEu-w&j->SWybE?iJNzM!*mlL7;y!&X4HBmX`^{x#=*)I? z#Xi}k!ld&o5;){8n@mRC7=iYSB;D3+^)wyI1#q6bo=7JbUPcSXoD$YUT-LtpS*n^L zoMY6Wbn1YX&5#qenofG|zbKdMjb{t)z68(}%ayg1jj-=~K34KJl?R7>49VE&_7nn> zR~mL^hCNvaNr);Jz{IIE2^T5Vsl@JpvjZI6{@MaK-Z7j);~j!guHy|6Gc{LuAH-8;##huA zbI-fg8P*TsKDuov$>j!yqZj2COFL8L^lCEs=ZnBr!PjD5sHT1Kh4Rla7u|p^2LJgB z>7Q|rsQfKdm00`JUXymILi(>$gb15ceMhhMn3%sF#6LTlCE{s<7hXqll{bUd8`IVk{wSB1 zqPmgG*9XvQV;eVepB<<2%!>*hG_}Tu2M*(2?p$l0#Sk($%+gddHZ!cT?ayzqH0mrQ}HrybWUJd)}z!0bCPYw+-?0lp8tOXfM)WGF59@H5@KoHeYUTKsh-Z zBxP2MOxNkg)YW*MpvfJy&Gb~ow(rsT$p$;F^>pvV8fosXAf48HS5RGEApm$})G$hl ztN2sqoQXES3`nBS90mq`Zl?NSeT^tU`(z1G*h zGULhECB3DIkmF~}B*l9#c!|Ho7?-CnHw!Zhv9hk}JH76?J>S#PB9#S^>DzeTu7=6s zE*`yK_a+T5cIq9a4`Zmng?sifc9QQ_=QCL|y*)qlYd}@2&>OAI47*jA=TdDpc5{xb zCrWH~U51k`)+ljF6!aVFN7NHLD8!?} z>|`Od>+s@ADQRT?s4^|((^re^N=f#tsKq(8xjOOc$^+o$L1c9TYYGn&L|odK|1dp_ zzcFSDsF1w>lkM2t>qtjz6jz;aCAJ|URy$TiW@WV^1I&iqd*#NFDq z`B}v>)y<~KG?2C2{KrPw%=6poF^)*XqeS}RxSnewJ1p!fCgi+{)sbu*i6HrQVr@kk z7Zy4>pSbH}Io6PHvRwhaCb|)x7!Hgb3etz?9D*CGO;;}jOKZT)%(j-EYN!Kf__}aD zPr44*SdibmHQUB9^X8r*(EDfgc*S|!k7L>UnD$O$q3{o3-I_}FoQ%uW8#fZ)P<+5e zk%xQ22y_93-7syaKN$Gpz=l_g6-&GI@}#*Rij_$^PTTyrTg9ymZ&{RDU0hBa=2(0a zK`|fa#Ul_LNdr!xJ$p<0M&x~M2hB<1Oi^D&9OtYK5uOlGLj2p5%9^%tRNkSOwijBq zc>l*qnv1C7gq=GxXcUe-%7qG0r6c#{{=~YP;HA>FVrjU*b3IT}+9NBzT^IsRrxu-d zr%%=aPp+W}1=`ID*+DrL34q^9A8-jo4P_GHO2g*aP%!MQJ9X|H00eNlmN>0WH6ut8 zX^>s!X3Rr@P&}EExS|Tgyo#KBzO*x%xR|%%4GAk?F!N#$>V(`}y~60q+DT?*JmaOJ zagbLLv|C5~*)}DeG%>u2BP4!em4Ovwc~GW9C-c9x%8PCeB8U+)E~jNbhCr#(!~j1T zmGyu!)qic`(5e+R$sX+c9#V83UIOk|c%%23H+g}A(4*lAX;O1Oe;pa%qb0`_Ly`nT zbB4Mxe`Cz)dP<8EP9Y)BNHQ_6BFXSpFl*DE#{7q5icJo6f{||zQ$-(Iz@{C6j>{i{ zgN*X|8)^u5aZ=iMXjRSXF?6xjZy1aX-m zh?sv9Qed9xuv+_Uj8VJn$BCk zu*CEF3;mHac(M zED7gGvgZCt{vCe7e+1X0PE24F+vm;?`y)I{hLaLPFR8A_F*yIwEprfha->ziotT`f z4CyU(@(tP^BdyGaib#4xLjPJG!*T$?fAVkRYnRNChK;PlB+On2if;xTw%{aM-J#$p zQu35oep;o}{1wL(f{SfsPkh;P#;`Tv6E`ylaohOb!%3*tDnAN&yzuBzzN#h!ym#Q! z&kJrqBWA=TF~;wuPKaq^P>vZLtp4VYqn-^Bhzjk35vcos0va zT3zKpl=LamN=mDIl-`;Fm$Lh!X@yEs!4M>rkqj zkhh8?=nmS80$X{K!WWZ>O?hO;=k|h0ou$Z{u3R_Wq0Eu>Ib)0_337J&Ba*n;jyVSp zxg!dqxsu=@omcc?xfa7?IY8x5Wf%G4hU*#p`(k-p=0eZ@*<}(G@LXXiDv$@Y$VyeM zsGKch3-{)0&MWW@R90Fws3y)82qgzuPaUf44a_`okl#CL`j{&--r=uDoIeicY|K}p zHs6cTvQoE|TM4c;ZcP50b|q>RLLsQ&tItr-Nb$!ahS9))v%`+0{D;GTW(X%?s8Ih{ z*Iin6n~~pUl~~^)Ug^4sm=TkO zqaHG(N!;jOEIV&iTB@5Db z)@z)+q)?Hz4X)n?3u~Z4Nj4X(`3gq`O1;Iz7*)}o&9-o1-r-}eWJ?I!icYZpA|e;y z9GmUuTUm1w_`JPKOxykRs3nbs()ji+@8ESm<5*I-)v2?E7Hu2GxqJT9XX~b$P9@VM zSj6@MqqCdg2eP{!z`0~b#|ZtpUg&L>3D6u~Ua=ISQ#f6U0Xf||^j@9<}N-m!>@ludqSe>xzD>`Yy=AibpUqu$9bgb;pUjF=*R6JN+-Ymi;mm97{-~ z*iu}XPH>JK3&ofnKyRG+f@Ww|$o3f)HxMpE7U2^JJe|q5HIj#Y6L^$MfmoJ0#so;C zH43KRKPuBevF@ko$b3NKV|>q05r>oghEW|s zYvR%SREkw8)wJ+&glGGkLHi~C6|k`4vn3hn(oX@4JD$k zMKj&K_j7rRLgumfTqvLLx0lYXeD&w&dBN@-Z!ubao0urckzR%*H`wEKye!WXl-L+5 z%0-1^;%N|0pL?Sx%k39|MU=(rhm-+*)UQs<;MuRx%&~OWS5xbxYR}Lo>|KMxsr7 zJ1M6Zs1vXlHe7#Gg1fb&&40@b>M{1|F?KIX?+>>0TrE_2m8~u=<(7VT2&(ua_Yc~w z;w@TAS&I|8jC-+73i%RR(UEIvNavb~0v8>1eQ2gbRlM0V~0dJG+*pN6$+|X+9 z9>-;kLu$NG|IqQw1b`>ISkx*Qxi={s6au{gS}3I|8Y;rA*vK#&H@es_}Q26RgGIdo=^ah?$5$?v+uF0=Kv?=-exMj_KB+Y1DEoWbpK2 zSa;NNBoNP!BbC=j-&)Jy7S7{gZn2q8?7Bf-xU8AMqX5PRa>6rm{>o{9wO&|T6> z{=L3|y4qTz435vIm~0_LMF)i{%JHdF zzqZF}_#rl~zd5DNM^S8ImG_2}=C9qQAlJ)A4(9d4c|5abkZLi3cGMg~KBJENt|VN7 zwt<;?=Qr*AnCZ^&C1GPH-!@%O?`UiC#fzBpkC&i)iwMXe`?q|RTUxFy4-u1SeSsf|w4IVtVAU0k@sYS=)&t&s7PfvC=hjzXQ)6LPqgtwK zvFcty&;{!`;HHi~N?I=J0z%62IlPPLV9r`_-SsNJ&Vbm%BpIQ)J10Wny8gIj&A< z*O}z3fFo1F&uFjnF1e9dFkodib!N}FK3KpWj&&7_nlLAt+TI4%-Y%B3Xc_7Z$@t9yf_Vl{b~UHbq^9N7-g*q)sII zH364)bikSQ%0jlemR+XGOjuU!{}{n-BK8Rjy+Ls)4rtv{eDdollgX*eO%USxN`;21 z9}>g}a;7MB?bT5E@unbwc|!y|05FWOR%%T5tVZWkU4gXWMi61f%L*BGX1OIC ztgV3Uo~zxpO+$}$E}n|WpeznJP@0uJ#TB4y86ZQ?mqL%;V@_&EqY1eQJ( z3r8vhbY~AVWQr0(V=U~!`%R2!b=D?n0Vx@r|Mt!L^rdSN3E+AlVIRKoaNjHHAg*zM zn`C8fcz9uUEew+Tdi2|Z;k&#=*JHNfl0!oSo&&{Dnzy7|;s?>gN=7?|yBY}!Aa;du z6&!0|Vs$zPEkF3ymMZ1G2jqaPek>wG8Oe?&;EuN{t=3mDz5AW9=GeIhI=S)x*E1iKVmYCCn>%{wXP1?+LQ?Hjv<<1oVkQDf(S zhe}%`&xmSLPKPQ2aK zAr^#$bg_}Zr1;MbIzhKs=A*&V2NiV~3XH%ms(8 zHQKS{o?y?=utIl-*{4)-qIqS6hoU~2f{M@5Ka%qgD{LRl?7K{;TCLsjS2oL4M%ns; z2In1ADj6Y)&&qJAfclwRBIHVXBntr)=~_*h#&Xgt5taHIB$70oomKE4*vWUS61>KZ zSLxReS&$sS;cO1rFpx!Vgo?#1A4@9SR-B#%kGI!|Ckbd5%vu#%(X=z{q#dc!3s<`O zC$h`S3TN$15IdWyPqC61dTi6`)%M1M7z{a0h%)bgGU*CRn4}Sf(iy7d53Q60J_R;- z`J2VT3FrT&2|V=NI3`?nLrJz`#iE7&RQEaO*@wZz#|~Oxx$Gr0*z)D7SSN3i@yqH^ zw1a24h=dnJ4ATSdalS9MHovRpe4nZ2BqV_9_6mdUX@(Z=r5|92bYFCs1DiE(_)nNp zJ!}~U{|>ngFetdyC-V3;!l{OG{h>!1Z!b8w*=lywJp=QG;e_l1bDD{H!L!0kSdzec zn{w%W>~~pqA>;WCNSHMK!d*lqKi}YffQO=x&HfuH$ofCyZnH7|AE={bOz{}t_NyG# zMeq&<#AYBEJRoA=Lss#f0BoyNp43Twhp`tyc|zf(eVamgZCV;+Hv7bqzobkwucjqt zrReur_f9`JSU&wHty>?l<{??1kG*GuuNW!p!|wezJ7j1Bmq<-FKTQNjHzk>0D{nGhzjQR#Yj72hoXJ0)<}Nq3SP*3j1wyu#!BZ* z=FEh_g;xD7lin#OK*r&kz|PPea`!8>XkJjG*Tb@S%TpA>#|z%-yY19eJ>F_5nlV2^{r9ly)Z3r5t?6=j#G`-P%UE3RD?l`aBrF*LMw5yxk?;Q}GrifK@9BEw@l!)5zkP;$X}G4K@E z|B%>sC)XI*><{WtJHUyu#SEjIXyYAm2x}z9lA|zpRUdx1^A9t@9#^qxu3_@}%=~3- z!y^Uyu7e&>o(ffxhP*08ZYB^rYkaP6AIrZK&`9}*3fbBXZml|p&B#(R(93h7W%_%# zWzREC6Reg;PXzE+4b8){ZanS#ptZU)ju`i0*6T)@8Uhm7R?bxprj3rrMB4XEbsxnu*GV>d4~de~toOOv zU80`8H0$$s<8%fdwM7O4y~un(d`bagnyth=d(c)23ww0GIIF>MAp|?QfZ=Qf=u71m zmNZ>6ZmF!8%npVyhZTFOJ=YK?Rb)=Z96eP$GO+Gv+=!botZ1TSj}Eacna4C!?C$PB zEbktG1y|5$oWYJXeZ4OB16C(=M5%AY)M2nN(Az>*4>Z8-r9U+``&dfQ8vwPEgKPJ$ z!Z;o(xC(1l#ON(K35$u0bgY zk#*1%iU1#W@*+a$8CmKrhXF@t%zr$(4Jv9lU6xVW1_7b^u>yuPWPmB`&+ss1>_M=Vzd4KZN_%+qf%XD~MjqUka|OFOM7FDft`r8w`af zHB10uN0?vy{&AP*=IO-IeUztyl6J*#?iz;HG&eWHo;EsUd?NjH9_uVoZJS zJ})x;o4OA{1>-yG!_qiKN~59VRhLR3<}oB)&2LkYqBU-nA(8CG6*Pb$XL#z|nl(Y|@ad!MI@k89iQfXEE8e zr){<~_7?5pm_*<0O|;bu*`Im@O#29AWv~Jy0ej>OG_2sCtZ$$!0)hX`lG>!?M=F|% zKuK1o$)e!$Z@bCJggE4;K8c@NLuNx+jabrMPwv;&sMY>6Bn=8{NGzcoAznkHc9o@| zx;7^cnU@-&=)ZPtPjNV>Q)ZQq9Yorzu9%|l)97^GU~2}U#yrE(TSzcB#ajRf5abV8 z$O;h19OyzjDJKrqA*l~4ZYDdwEFo5e!JcMNUq|Rrze|HK7ZbZ>D2|^D#z!-v?_((! z%P9moRz6B{ia5%p!9eSfAn*LO{jXSi1de9fBvg*4Y`ubwnKTW7BzqJ}_gcxiDLs0aqi zZ@Y^bSY^yCY)(|lB%YHXkf*UZ#ROQ4fOt8Ktd}|uaG@Y3ypod$P#2a9LW=2K+trYE z5a>XE%yEkpz%zcP6?qM1=!p>YWGN-8pRyWc{u{leFHO{_xv!FV%;RMRGQ6iA8fykw zNlaQkVil|8F&-%fU3XS+U3hsVdI4;6#(eBqEj~2=P3-(bVZ%%x7^}dvmG@G~kRrUK zxA(OnjzxO>@K>$@tugH*_A$QGCB_J8v8^zD42J48U=u%_Tw2HVYj_0XdxYU;tiof* z0fw}tX_098QU@e5&ym^^U~26^u#xgvvgBm-y@m03crYzKGTZ8wcx?LxWh@9gbjl)` zlk5hW!pyj?Cd*BAty5u)LG0%4KZGp?6plOH=1wxHs-E0ep-=7Ya+SgIPwk3*IapW=dv5W!4;Ap5Xh#TIxn7#y+==0Na?qIL9cRd| zOvJ8@lwHtd=PlJeY1p$e%%1|c>+E5*6rRTlN+o6DO9AQ=nAOwlX(S%6XP*>!jEwa{ zr;Nk%z3S7T5J~YZN$q_~T}`G{G&Se-2CSQ8ARf*4qdl@`AGQh)E9vJ^T=B|(%i6DX zu~jeA>qVG?Y!j4#;#`;L7bi~p5Qb;(1`Y`L*W476&ax#IQ_J+}g}JPPpSy98hO z>e9y1NWCCz1u}9sE)C##7@a@G%B@n$)Lebem7|L$s`?O+fI4l>6&$%)&L)O-l(rQlsp94)tAi zs2-n!(p7`M)MIBix>j1R?8r|?%}DC!usD>Jr_r}gJG2O?sw}v!phJwn9?TIV;XJqI zb>1ZuFidetK|ehrXs2bueU`T8gVp+3`I8={6Dyba5AT z%6!Nxk)jj715c)j64OvSXcm(k27>xl_LuyKyYggNext*}nujN#YHLR~>(&-D7|2Pr zp&+L}wloh>E#6>p z6!FzK5Z5^D#6t>9$5UO?vg+nGH&T|YrD+i4O<>Gb4X+Y`^3-sQ$D%v>bl;jVH;BCg z$eAQ=>RUSC5~DB|m!S-GVn_7r)KkgBL`kHb5mdZeCd<7n}iRH}rm z+{csb4>%Q+-u!kMldpZ6K3 zIiD6v8GDtZua&W2`VXUvkKU4A*}r%S>VJP88NTl5T;?sNDKE|p%@>=~o#_`wF7Q;d zv#9yIWOF1%wOf=`DRPeYBH3^mDcwg)*9uTzIBh+e&;^Y00B-Q z3w8v9(7^Jhn9jf9j4vz#qHZX70q3)hFF>3ozl&XJqbhq~sL@1e@47b94;Ln^lfiJk zJ&Zu|YDZ-|%1n}1C%s6lbt+6#K6wm0xYX0?Tx3${8d@u>o?j!ecmUrtaJkS3SqCgD zX>O!3M#Ifslw|iR91sbv$ZcmG%p{;A0X4J{7AtwIfChC?PEbKHM-K0GF>aci?fL5^ zfVgYvGQG4)?(l2VF#ko(SURMdYy2}6@rP9ku=g=tYDWnJdO$&#P@k2zkoXV)lv1Gx zJ0hri5n?t(PFceFh~l%Q=pN1Tp&7n=keKaHke(cnb`x8+ zJcXIVtTe0t(2ZVy;777tv7oWlvCL5cItzv22?@}Fk+L{fwRvlgQRfzGNS0s)imV^DO*sVw!- zu%DvbPr-dm-rB}9%`Bor8FX}l%Yg#ogV8(QW477ntjL6#>d~&EvE~XV=~fWKIX+#F z#3Hj#u8I($9xl#i6?OoYD|xhmaN~o0oOts#C!)_Nis(7mboES74Q&6Yr~tDF_jxE5 z7%Y8X!c0$-dvtnqG>{-hg#0h#l|d3%{DAayEe+Vr@kA$E+cNT0>vz)KjO<&M5M?2t zel;hAVW1&{m8Q#O+0IEXpHOmLIE8<_2R0H&e|@0qIua|ru^${$aQUPwC-G_FcLyW= zJCCk$*#&V5A~kQ0m;q_=vWjOGd7FrmS_0QSVJ%)2?fOV{RWH#gPFHPabxK^fBFP7K z{RsyR>~15qZyWU5v)i2-?*^l@ls~gC%C+p|um5X?A?8&GQi+ z)U_2U7L0MluBP9GAdH$c48P^;ngIkt-8o-=b|yZZ2Ulbr6Rz=R!tN5zcj4Hk&CDcg<&qF93C-3p4egx z)XAlsl{;pWG&?eIFwLP3TqaGp-pBfF-gsgNl)(a}O_5TeAQr6Bve*CR?S6Ic<2s%* z$$dm9njx|T@X`C^_EA-FzHwXTmMCqiJy%;PYcG!R%Hl)R$wKbd58JM;^|5p%By5`u0Ky7;hK1RLh5bz^(u81LIO7yuIPRo&^(uxx}Sd z^Gva2pP(lrLd4h@8ZL#cm;1GF%~sk-v0j5NPmPsi)WMOo*Uc;-1#)qTletilR+$ZS znoLiVq&^EwOPj#YRMyo=C{`)7%TCaW3jiZZ@?4A z==A{0eP(iFKSNZ8^Y-~_0HLuf4=_IPs6>RF>*FxLI+P5BU^7?@U!*zVs3NpJ%mKXC zzapAbhjd_AG6k^lr)c&YelmJ>eAyKMR@ZmAS{-@1bP@usP#9L5d6N3_Rhx^`hR(@e z5Czd1XOMz&qzo~d(i(7P)%ac^Nfuj-q4qZFS>;9SCcPBZ-n zRc^j#_>V}g7NKRPn;*4?d1DKP9E&rQ-?aigsm!9wG1NCY{=Exlcxjz-hHa0QP6n%9 z0E|5q0s-AR3rLT$L+BA5s^IQ)JO=g|Im6!dRzTvZXwSCAQ*BS_qrh7?cdaMmO}wv` ztmG)*O2oPmKUp;;B`+7vF{z9gMSP8*lctUn#k}4N2HVye)Tig)PDy{P2)5Byom_SU zVl%Q%<&!7727AZYUt&0Ujofz*4oAPj+BFmPpjr%@^0&D1cLKe?dTnF|=3wwH{lU5` zAKy?M83rm}NANH+8v$hRnKqDE_6*+U{w_9aSgG{Vwu7!NbgrYC)b6p*9~9M{|FAI}mG{QU1L(z8nLR5IN@%pT%?#r!SmLwK^Z7L;C!K~M$q}r^rT!eo z{S6-^E?Sh?^bUPrIyPbzp16iJ_oUS3c_*A!$@z+a=YVf;d3+suONtS{-k)24dB@31$d& zl+5SjzD4X1KMIIm98{lDBY%9o=;HkxFjg%$b!qv)foG;03fKG}0;wQ)9AJL|huFl$ zVLaS{YBML+ld=wF{KsY2h7#$!zdQ`ZahK;VFG!?E*Aju&4{gJ9+#_ub>8rCwTkid3 zO8H?h=wS}WXk1Fh(|+<;W`AJa0LSDBv)i7Bh&BP*H(YRi7PY2KQ4>6d8Axb|lWhfP zl(J*H6f>AAxsdx-IGtv-43}Z8=wd^--TBGQv`&G1pm7m9Qz7@m^S+wkdGU z@B184bUxmqd;oyr#;QL|;FZA*kst}Hy%4KDTZ^Q7vex{z{bUFWE+3$rJ^|0QTMsMJ zX~it z;~L#Oja12uAR9!K&QzI1r{y+_?5dK%j#Cr8NjHi-%~=ybM#aCJqbSbvhjJ;;LOA?eW6iO;nNiXklazEKguaqu328;csb{8&(Xo4M zk@oTwscnVW{J30WyfCk6>0Ek|35KchmS}pStI0)$@@HNS85Rb@8dSRhlB~?~pG+62 zu^~I#kReq~a?K+tyq1VsE#>hKDlE_8iRTnn?H2hqWv%(Xi3tnZlZ$4Kn(?EWPj>LB z5txpkn%IIDB%)V!$Ss1C%SgZV2%TgC`{{aSo^&Uu_b0ARvHh>O*7 z<5t~VngA`DFdkQuM%5~8706eGULYRD5I*xWoG33UQD5xO#z$d~B@KD?6Uri-HBd30 zL%35e2BR0l*G048QSo0qGp&sT(2-*J!HGzIDe$Hua_koTdd%x$+_Bi?MhagOVJllp zyM17H$vkNM@toyGecQT zCaFc%>>>QT!YsD)?pD%Pc=tQ-itL8G94cl5Gp9T&cAw{@P&Tf(%Oui*5qBCNR!9|> zdim>0E}=CJU(G@C)<751YB7>tc?+W_mvqnqP089QeyK*vSY1AGZ0taT zlb* zbp<=9jbaE&`%j6JvlVhFTqGj)zq|fsuK~2-AZ%nQ6wdPAR@_{q_O(X+sa(LDW72~k z`5!73duk$(wW{sCAd}lAOi$hUpKy>u*GvijCINR+= z2XbHraIhDRK;fK=->4^7NIb9*jljE|m`K<>%v815CcbDlvfO7AehSd4f;dON z)vnk$lee4nTeOZh+MNYMXU3b3mxA;rPt~%56=vlCVN^FtAJ$rp#p}k`-M>(eeyRvn zC%$1(0bIi#8Z_eydn^V}c#_kPuT#p8(c={C_g-a&7FI6V{nlMlbf3DEux)I=A~sSK z-9*YM0crS%Z6sv zs`@nowMDoKwAkGr|4?7MJmY86*Z;!COm9m`x|h7&75LcD?)?(H z@gfi`*jk%vqYH(^;`o8DAQ}PR3H0dD=sp=t;g$FqXG2ryA=$V|IQ70aAP4H5T0wU0 z3I#L)up3S9p-Nf~TCkzUrsid)O>@9Y6`O&7Z1>5?7rqx{sEfEhW_1(%WD9olx3 z*76FZJDqCDszPYM?PrK{p>m?SXIb4rPdyzeJx7%?V9x1O&qG3HOFR~vo-A5nvK&Kl z!?phKkMY_yr2!^y!q^vD^xM&QOau z#t|)IlZ2u$C`6_YD%uI9dW#4LC;dy&v6+QtzFe6FYVzp8vsnf9IrO0;%4NS7D4fC= z0*cJCKO|b_a7~Pjkv%W`AfgnhGyGav!IPP0N1#G;ymp}=gSU9qz7a{1Gu0+mZl#^e z2A=%Ff1T^hc;EFzjfW`aTrmNgFIUdb$Ge~sj~nmclRzdfO`Sit(?2SYt?;aW)JH3v0TYamBZczEFbv!pg~Rz0Pr0=qvpBU z7PzZRsLf#3ORMDW2-$CfDA9Ee;0F3bmlxqCU6HGJSm)o&=lYjR`WraWCDCqRVsLA( zY*0CxulQ*vQj|-vv01N~YgvDoG83uujCQIY%v+R4IN4pjGMm1Omj-<*3g4O4%@*|a zfX=qLjLoKb@+84Mw-~4dlziXGcj$BXE53wn;)93)%2s3SU{~m&bCDT?G-2;Sm_Gru zq}FfDZS;G)eNds`W|PYdvb8k0T2>qOQ)GMNg;$ zmbA}b<>B;##f}>ezd88D0`?^*i@cN_w0gVO@ZquHwLUMk>t6oBSi7%=_MaYllrHt} zPOTvQh|XaK*qL6Mbq$j)iJ4y7A1$BlY~!wm2#XvjSNd2p3^T%THVAL6EgM18qY2PdSb4Z#hl+59Mq~Qm}IsMHLHcy#(n#(w^Ay zD5X9TT8?>`dazWMORK;&7GwHciE@ABF}~%7Lb?X2QiRMDvmz%o+JSl<=lns9Y)8P; zz?NIj!Z8>r##obUI6{`?Si6HAnw{_N54rO+-Y-he)|PHMI=VZ$|9Ml=((KN9f@XL1 z6Xao!Gzdh79Ulu-mMU|UYbq#C()yqD?mQ)(FOB4wizir1v5viG$U8sW(sLi%cxtI? zMyusiqgl5O@?UA^oY6Mss;y`b1bwuAo<#mZypb-1^qz*E)8$&OqA_Jjjs_&pAHe-v zdmpQ-b}qY#=ECVKhe1hXNS8sF^fK@i|F|$B)G7vh5R#KbWbH)&LyvM%@31CPf~9QT zN~n|UGs{vALIoYp#}Kgh#~G*(i!i@$j_aeblGC ze$a`eLY6%acq^h9iOej{tRd#5Xhdm_C9kPQhrlA}(?MXKjtQUyv2p@Z@<1&pUi^^A zFbz;8*1|*;>v4VH+EmW~+Jctp>I%eg%5A#XG8dB&*~&tObQNnPq8^eyb8Kx>m9h8w zGhcI@+!72eq_HIrm|2mYmZhzAI!(5DAj5&tJblc+EBm(Hn@Z2?4|fBM*@9g%NYE&} zNKH;~i$KA<)E<8I$c?!}i^Tt*H!+@U}y77)`VPJ}@lL1)O0Lq65t z$waoP#&Yawpp)qMvH(Qo-*>Sbn9ms2?8XAd&a-D1=*gRV7uMoSsq)`3d}c03qP?r& z7ap5ckYr6jA;o6?mCgnp{mwx;xP0XdjRPwTZTd2zaT=zTRFwFPkAqwMv|<__jm#!i zx~}D+q-#>gBaO#8v1RHGGMxd^Yo5$#oC&T$80OwTn{S+|c_G{A-VFoczc|vVP3t2R zpG>kEQau>lLGvAJQ`L2ZV2F^1)}1p3@=uQLZm2x=F6`yL5?tOzIj8wK#Zu~{4lmsA4>P=2?4LoULP z3~}FoZ5RU9U`g7Fmfxn0_q$>;5M7z}^tCoJFCe6vZleZA*Ql+l54o4Go|LGbL}V@D zh^1a{89aOC8>$+JMb8tGNqMFqR2*bw=LxGHjbZ#6YgiXwKa&Qh(2biucp5sH6U&?C zA%wj~BobO}wKUohjXj#`yGv>^pNJuqfl!rOB-#nb^G|2vEr4jE^P zD_M@DkKaB`DTr?{($+ztMxw#Eq0Lz-^HpS%3PjNh*W@BAo(cCwe>a4HR(+9*FHu(}q*sD!7K4{iU?F zMPO)cB}s8&&7!iziDia`;msP-cT&dXtGHrIy$C0J z@r6_uir8>d20-Oc(TBMs4VtsPY&rB)U;^{iMw=)3gUtSoMHDA##iI#XIS*jMp*4Q) zi3+q9Dj#F8 zS!XjgmKyvygt-n=5#T1PpHi{WhcI^9%9qR$xaMiu0`HT%sL-nKv1Mv0X|-K@^4rU#!L|r>o4IO>BwKSj>D~|f-7%js&zFp>%cN4j#Z&s zq4b?s;+=wPUR3Bg{Bl_IiWdDxiCR?pfwY;&=6Q7+HPEdSWf8VMRFh?P^ghq^%+HLZ zCn4c(hoiaMKkrXMrD556FnRxCwJ3`b*oJ4K2&*ZsmM&l1!!T<)6${lbfv05_UJ#Vh zmMBIS>j5JB{h7|Ti$oZY6`N5r7vR?W3j>Q}WY&VW2i)jIlE%Il1+h%t+6`lusg4W_ zc-epVfrk}cfcFA5y7U;ccnFZ;`z=Y}KBuNbK>{FaV*V0``SXK$>r%?FjL1}zfZRQO zR;Uu%nws!e+Xl8b+}hBK@<_-N+L&`s^TMiJru&5j8KpPe)89_5#!Z>00Ga46N6|~K zQ&;kkZ26QZ&UrCXwvrW`$c~2}Ehvh;ckH4BE=O$t5*SQ&&>oqjdGY$_{EO1qshw+; zO`a}gtT}N_V(Iw>6`fa4fACHkT(L+%Ths*RF?KssOwhi}Q=BWp(J}H`b4u?|y6h0l!T#vMmI|CyY3 zva@3UE9)o`fJfP`jGuF3b#>DF3D+RW(f@zzJ4VL;&9GK-w=<@bHLy^0vZj;4XQZd6 z6ESyibi!xgU|{?`wQ@3cpcApucQO_-HncS|rjs(ZF?BM-XJKIbKZ4I!+SayMq6yzV zy#ao`mpJr1U*8UDAa>ZEE8t}E)E}&Tb@(ESVi{?N^w<(HFDp9_%oNjd;zlqYV7t(sb?wlg!&Zf!@UP&d@P&M`N3 zrafDnv;Q_|a1(*B^o^1v%!cCUiWW-Z86b5zI2dElxL6o@cQGH03F*M3NjX?IN5_Mv zZ~sxoMs{PW4|aCps9U}s(l^NLXW-B63I<}R$6h<%5@E56oo<0CK%`h5;tOpiugWG6 zk+H0bgTZ{3-f@?5tBIp)#6-t?97cic&FA~iu`xzvk)$&^y!K;*ErR+K%*rmp!aO1& zfdhOI$8PXPq#h#bdIr0*qzTvF@&%qfU_xU~=7Lw7?Hc6vG7{wyW4RzBi?O8j>(K*% zF`@GjV(KG%4TS|1!{gA&6q4iQ#9%~aF$eaVtr3(!rtYezC7sfo015=wa1fXYJzidt z|1ZYgu{qZ;%(hKdY}?6-ZQHhO+qP}nwr$(CZLjQf?^CC`>-4GWukRmt=QHnljUhhO z-jDnjHi5r%Ji*l|!)r*8o}AnvgxiSPUouc$(kvg4KVjjpAa70~Zw(kcZwZ|}(49Y0 z3RK7Roe#dYi0C-p71+s`P7_j5pgs>-P;Fj-c7ks~T8MTc{vvJ7fEL14?`BT&z!|U* zKwKcw(YlXoWcHpztm_0?9y!@12?qiazbB3|ywn`FJ-I6|!HRy=t?JO(E#sH-8lJSz zyaaX!K0#fgn-1VpJ>b}nS}REF_Lnzui93S%L|)yZari4AM87c(97G)yB!lCEpp50x z+sL;~g&o4YE)Mg!?7R(zy25{$^O){7{666Y24(DWWQ zkYrtemdDQ*${dh{Z!h1NDEMX$4_O-oXZ?>d;6@0lnLqRc;}aT}2>?}Ia$jI@U1b?E z^J0VWH_$5pMrtz(HCPRG93b^n>~q(kpbu4%=&%^~Xzm~KaEoZv5_oF4II4XB005K+ zr4O;C32ML4r1%dw>^LPhd_aw_T?3LPr@avYlIEv4Kr8@j#32AYH&H_6IF2SU?T60HK8~sY#6&*dhk4o`KB!trw*(@E!(0KV*=>-!$vom(%u;{pj$}=5G1CviUx@ zz9?(@Jg44#R8^8zmSq2=`epqirSS=W<^A1*;6iM@5(3X;p~fNg^&*Xz`1;%r`(9!uQ8FkQPV&R-tH5YKk72PUSbZ30AZmd2i*%+Y8Q{5^XV-Imn?n)70gVq z5alk#&o1V)~&Xh$Xm^o-0iuO9<|0lGOP);t06iMchfFv%~`1K-0#j-@Xf zAeaHLt?(cPSICU8M9{AR(~qGqmWI_!&&(Na0$d0rpcDvZ1|SJWs|Py*$oV7RzZEb7 zR%jX^u{dbZyiFl+6*mzETQO)ZG_3*xuASiJ|Vun>j4dAqSY5{_UfTNf9Sya05=V*^T!I+OWsD z+sOwE{CF5AhXyOs(&vlNhoef<^R zPCwcyiN@O18JQjnGbYzvNY@VySuBYjJImVcFEwWs3y|tI7%G_bj%uHF?&ouN%tm-K zHs9BtZ2$gkHsZ}A^my|eQb>ROL=E9F7vz4vGkuWf+E1Q6%6&t8tb>8m%=wa@NVg)U zUQ1&XQ+1I~0X)NZQ_?sPb-Zr9K~U6kxS?mgeG;y|?mup7Ol2%L%#3v%cAfWqW5Teh zXm%RnfH$5qLVKyCa!(wgc!k_l)TnBATjjA|Z&qj;0pfTm_q<))kH5WtjW+Kx@u;t` zK6A0=-c{U_(;}%>t~=F1Lf;o-6&LUIv?-xYOa#$d=CsAEvim^oXXEN~P<<{5se0zAQI6uF?eJ(D-9fJ3Bzj9j#m0E745QVGh zrXM;!eXr7v$olFmPr5VX@PaT_y5fzf-VxUB3Lpmd8c&jt7c_brRh}MPZ?+B_tSi_? zv_7l*_Z@mbJVYvQ%kM=@UY>N(bSgWuR7+}p74l&5>QL=9tEM+EPCp;2US3KTN02Up zMxo)@bbYs-t~p{PwG2X34x}9G1xw!GQ=O{Z8#*hZJbNt^j5?U=D>3*3;QP^8O5zgI z7=Gc7cUq~auA2Udmk$T5&dyKC(levofhhtRGfGzm{5C0=4PmPchSrZA%2utkXs#l$ zy(l)jSQf?|d2~@wNSiz!9;zV2vo=@}fIDc#ZxgpA=1QlARfpjf83ywcWbUmgneMH4 zRf9AQ&zd4dq_6?YsT>@+b=;fHxT(-ZYb5`BQlVkIK|rnTzKueW1pj30s?)96OReLq ztjI;vQ@)ETo2q<&Eo|@c@t}VHbUNH*%>dl(^IpJKo|0B|@ZROtTy=W-gkN7 z<|98%Tia;Z&DOi-kn5$>MxUWcWiiS9MEuWudnI&l@q6>+bmRiAo|}P>4|TQj{zssE zb`@>g=k?+Iu(rp?WAsbIO(?|kTBAsZPm2%W<zwYs_ZZ`+{kB+LFglfRnf%s;R`GsiW7lRJfW#q}JKbT<` znp9n^1l_DXk(UHRrJy&*C7NvCpMVnF1z8RJ-A>OqLHbwG*nsc=^Nmb@h%lujMzGL3 ztJYu10AqciA7qazuy&Ywz(#;5K+vcW-WZ`|Jes=B3a|E{MojL0hR3@UKq7jnwAF*Ng%65#h+#0~E=X4SB-W%L|<0{polUH|L-*UPn$c zldHEVZbQ-(%h$trpI8X*Y{NZ*>GkpAqAEAbHWC@5a(J+k#+pwFv`!bKXAEnlFlRQy zUoEX~rt83&=TU&NW9e=x+wV(6o>LSM+w1$J*tZ^So0LBh>d~&JfovMZS*X4_&c0O7-S3 zKO_3@H^Y9O_`rmJrjKO0VUF7LNEAPkP!%u^wqyQuuvwGZ=H&)H<7WQ~)z&?Fqc7j= zn{u@`y!#IuO*CS4Y0aW<0Y&ll2R^WCFl|4IZQWX2a^)|Tb=s{@ok53u#W6}jaoE+QlVZIHVtof8Ko)F%H~l_&2B-Ur1Mh-tR9DXMxcXj>TPnaCz>Tx#K2*R zm{i<9@zo$YVdod-&%Kx`O#u##y92)QsJg@m)Frz}HuM|@v@?F70l*ZAD~^vU+SN(D z_q@xCO{Qy7?p$7MsYiP7PdxvP30-uY8j?{@b%~EFLm1zctCbpP$D$CEN-Zh#&sm^3{ z@h@It0t`61A)u6Mq1Xi1R}DFP>KuRZ(PXU*H)t#mH>Fp%W~r!7x-@6Nw(H%e8sR)q zqxonPJ?OR7iJ(M!K)|*o@PyfJ81oBwY>KA_X5O_{v6&16-TA4_<4r(H-nMPk8yhEP zwoFcx8d)nN`-=j>SGr+B3R=@t0Xh{njOKE_r7l`1AVIjeSe<2Ao6Xo`xMt%*PWN6A z!dnGCYgWKS9)cTkD*1jDfV?pdJFB8ygXDE)FIO5fVwk0&@l=0X5uX!cAiU#7wCuL+ z36`tMpfz5eSCG?GKp+%oQ$tD_InFOl+T^iG1R;BfV55oQArq+(t>o&;T)x@`^a;SS zi|gD$$AArr?uOS@`H=t+GxVrKJ$=1Kvd?z<{*_P;7t=`_q(If0nfAAX}QD z%fZ=BJqo33UIdQk^b6+ujNU6$Ws({ojPIR3z>}-IUdE#J+2DNitD|w0Q}JbV;#R$g zOd)W^_Dk43JrBx3C|=QUph+#~)vBXKUN-)6bURw7EgXiq!aOu+Yc|}qr!JQ_UEWJn zeIT(c(+4(^8U!**qd|O;6)ikPCUJPHDe<(KQiIzqMUf*x-R6=3&Bnc?kco7!dWuuT9U@F~V9LK4slujgOXNoS-|G8i zClpJ@lok`KDl)T*Y;$sZ5KBo9T;g08;M#@81>fBw!czi?C5WbUriX6#_pL%fP=7|^ z;Bt}1U)p&igkN6B#(Evupkv*bOht}`pRYD_-I_idr1%JAK3VF zOrpvP(Ztsv%ok3j$~y-?cuRME28WvOD_^9!dwJRDGBMJCANU$6!os%el)!Ptv-9?=)6+28y4b7Xr2 zXHF+Fh?G{kY5_Py_Q`ujP7E8n8rx;IMx1Tx;9k~(4~ib=yE2yP=oTXb+`XUO>C00q zo$uAPr)pFK8=Io{?7v#0th#S;M0lW%5az5S@i@hazi<$9_Bq73TO?k}M@5;qb{Fz4 zJ)vP$jg`lQzqeA`U>XvQ1NP{hK^JmBbrQAlY$*(3rEJHK#G&@bj5yjILzMr$XKR5Q zxI*zi$&W_`GAb}rVfpeBsY*WyJ6%>lI7%@DviiXH4`pn*AmOWZ|N`O#=Wk7_@e{U0LorO-!&)htJRp+=rjXvo5uS62PO z{HBZL?;6~DOrBZ}GB7uCACUW=h2ZTdc1+6k57j1o+awg?k6SpsM z*7^`sqSY}5H}b|UsdWdFv>2dtfd?Db#wkBy-xgmC7k>5+{Q2OW7NGU^Xmd}Uj*^G>8^|& zc7Gv4*rzXXep)X$cK&_mbdu3<$(B=%Cmb8UR^;kIn;>9Ty<~u{R z!pW;~ue2(8-!sseA3%2~6}kU!H_6QUU%JWv|N4=EftC5cuNB*Cs9F)Gzfrz{QcrpS z&~U)xfXNcQ83*}iON1bchI(%)8X~A(oMy2gV534sdiNEmRvawOJHL9;ga>&W|8^Gr zTB;|XS<&ARa&&WcdTD>rizz=;cqC+{iwQ{~yS>yrA}9@oyZ`zA%v0Rp>-*aL^$pgF z{vQOPcMqqF5sKfBIp@#S((#=^!}IJFI8ErNkWtM2ZF(=b)XIjh`+2-+r*A@(1EXXU@ta*ouFwo7Ho?B_WLWn_ z4bPhZF~P-p_C=Xnb}w@5x(|2#a|vdyo7vvS86gXE6s@j#($JOQz1&c7+qi9US;@l{ z(6smeCLpZtNhLd|n)LR@^tAIX-paZe#4@JJ&{kqWMucKiWliITns#2{n}L`)TYtuW z7be6K$c^5bShMTA zyC3D~L$D2P@e;=5iU(_Tp&&yWHj9uLxhXost-RlF)IL<$z;I*MeS4a#4FIOZi?7|K z#W+`RZ=m5-QmS_QY=OzDOnR-imdy0lc3+-jqbP5pj)xO?+`e zmS08UgJ>i2XibT5^(KXjND3Ezb%b+$fXt4uDbOfQ0Lbt)CUd;j6#4hBd@wXNb16T! z`umlxIWcj}!j$GjQR&U_P>2wl25N%e8E3mnHlV_CJ#|ndFdev;-H>&8(k}th7@EkH z>KrqW!c^2Ns!&$Gr~VEfxw5x|g+iMNJ%(w|2fH2D!8aLP-nwLnF?B&M*bIZAha;5o zF}v-U43V^lq5OR30TBo``H=i$m;+#% z_I6kLbA4{#)_y!FjmVxw2S_k<{9h5=&r4Dur zRE{EOfD{IV16AXedhrzTRnXZ0se5JQ3$)>k^`fkm{hJJweELz}{v_1M>3D1BR86WU zQYS=j(cJ`uoTM{FzycBi3c{Dh! zk$KMV7V4m)L;HER$_T641!)X9#P#GdU6%bv?2o3a3_Jd=)mKG6a975Y-@$E9|DbVx zzx_~x3cbx*u#9V`1{FPCO=^<6v-5mm4GI!#1z+vjh7Cx$rlt4B<$P(x;&*t&q9~Mb zU7{P@$HPec{F9mF%2o8wQA3>Xbj$iwI2rs)S`qIl%}`Q0VmeyP>X^8w+06V4%U%sP zR{FX=CK~zSVj)hh%Hf76@RC5aoHx#TE7ql%HK@qNtD&V?(<5oipF@5}hJ?i$`DKya zv(zMj<|%czbpCnlfLCNow))-)^l-wQ{RUCggYu!q7{VHCPJ1RKL7-k{(V=Ai2@IsF{0?rotVIqfS zcXghtH}(f8TNTd)_h^Ajc457kR%ZxgDq6@f)HO@NmCM~zMW++Hbe|`5JnS(8O|vBR zuDaVBBgTwUM?E>}I8R4YM9ohFb*E2%`uq9R%jH`>^hr?SmkwzC7S|%K*lwq~HXNY> zA%i^x3LD2+u+#(aNYfqKXF=2pcb!IKhPL`IuoO)=!KaRs#Oa}>^ef|QdawA52uan? zh;kkV>oaMWBJES|R)Y0K?5RDzO?7}UCd9=YKFIz?Ki76uT^s8{8msQap3C!aBBb(_ z9So|RDzJEtiggOZB^igMBA8D>=F@@r^AD*cCHsA*pj^L9L6)`f`FiVhI}G%unNtZTaqavN&q``Cv`vzfEQpIQZ<9cl)Fj<@ry-&M1-hnedEvRwapP z@_aWq^_|v?+UL9N56E&)R`>sql-L;mR|aBw2KxV=l*VJ8n0^V>$nO3uJ80#}K#2JE zKqnz=PZPmE0BAb76rB^2DL2q|e7~=Wqco|O?-t`yzETzmccmqHrF)5C<{jSt{!m0)8;Ac6C=_VneFo)OzBq zV8;g>ME1_|9zuwu-T$3UxV2eo=sl=G!~IoKZEyHvI^4oA3tFO=B4T5Ija0k7hpI~0 zER8Aqa4njcdiVSbr{2GpUHXrUj%D)Gq9||{my7*)d45X};C#d>77g_22Uc=MBd)7M zZItTAzZBA;rGba^sRar>V*C7(TUAWr99oz5yV#0smmWx5>JS|--{j^-he;N6jFeH* zi{rxaUDT()CmlTru@qX;?Yg+>?ZI(f2orVqMNG2fx2)vZ!IT4!#cLuM%={9SdonEm zjsoh2)UkBIT)T82)5tWz65E6Q8%$H+(G`x)xoanWkTXMIQ=JD~aI+a@<;>0RMn~;k zBA|C5Qi?0tljMvrk&W+7sH+6R$-yoW0_07@_+77mD;o;pnY=DePu%5Pa?-$WiDkz^nDbIe51R-Bfr?O5huxvwj<6P#DVcUB~4kDJ}nBLqmn6dnaSg%mU|+B5|l zPUpJ}ha9i2^+?chm2OmM=bm zX6pgE-JGlk^pEV@1%st}B1MNy*6Rrs225et6gb9|fRUB>dt3%=fygd5fVT&-d_5i# z=r@fJJBO-pIDz5BR*>-&E@L1rI@NeALIO3`zHQ{h%%5A_hMYQv1z*`{UxlV1G#a-d>G z5x!`QCp;!bJc}DgN(oD21^&=ZLUvtVEu`EWTOz_o4e2P%3Bh{3G~pb2Ka5-HGUu!fG4N3 zPld<@n-CfwMIfbG-6hITn13?>nWd_-Hb$)cEWIaB+Z{Cd0j$$pniny)TM4;5!&F#0 zZg4c36ox73mPw2NC^G1vx6VAJ{J}Ty2Aykj=$cvB-1si{g-wV@f67$sES5U=3`6F$ zbD*<_%UZiqK*}*fn7KYylvrA7Ko2wbtkF%H4C6cC^BlPD2DwyDx^Id+a^SEp*8tn> zgr3=&x0(bz%YySjW*_8xh39&t?6W)wcvnw(L)j0T?99#Z@8{-W75o6;|GiTGMM}8S zKO^}4g(LxxE7qbh(n!}i9{WVE=j8q}%fsB77&DZok*fT=;mEjf=G=dyyp%m3dg)i( zGirTL>26~zY|}$wlYD~x*k2j?M0x^iSp{LPn_PvR->}0zP+x@K87Vg3Yo2*U+Dh$w zX*ra!`&!)?Prisa9hE%${nyG#J>-HUVAff*A}-BCvK_|W)&gM8%q0@h98OYgg%)w3 zU*fwW5OEZ^lj%L8BJ3+zLmL2rMxdQKuM01+ak~MdYa|e=*REyycMF?uR58OMw37`w zwDGFb^h5=MuH)*vzP~;`8ftfvnVT3Z{IK*3u*762Yz?5D>F~NZGnw3Z+4X}JfPOV3 z=Q_t9nAq14X8sGV3{OUK$WE{ z`4_GjnM=*mYhKL4vutn}?zESE8@od2(nAkRY9a**HP{yG`w#Fd0of(5K%11yqWh2h zgnlAu6lU+q+}!-c#DHxvazGHG-kFvYjhDYdG?JL%rYw@mNtZ6)q; zVIAl^I3i{_4BpR*@}wZrsyq{m_Gd+T%|XEpl&4Kn3d<d`2h9I{}RGFQ~ zY(}eQ#f}c#p#}n2B;h24-ctYU&7t+|O)+x#JT7C825&f+Mut-w-!Pu(niE&H`vKd4 z$u|*p(d^sPqhINCRajWqx#dm*8BTam$Qn;4{RD2I{jZw0&-V}!@oBDmcy>T+_VQK4 zv>F94;Z%O&++>F~cwGRKGrJ4eHM!mgTXY;LwuSj3^5Ppy5~bZ-=VBK&B3P)&El-VfkO>5$4~K6%VANlY_CoHKf}{wMJ(QRXfaYbMp*D zow|cach=|E?bq0BYr=MR9*SgJmw9zdD;|$1slCi?h>qs$DFGKz@WxhT@$Otd3HfuC zu$`dDTuig7o3~Hu_V4lO^U}bJ+Wy^}eckLUBh^a9?Z+5`JY9{e_s8}9^x=^p`Tdoa zH--0Sn%0Hcx!UFZ{%on5k){23^ja6MB?ut)aMz2c-6EfvX9mLO!K39(W8!_6_g_yN zq^3Q{SZh1^LfL`+-{0=$?bcux1HvsoZGs)e3SteScX-7!Kz9_0t2xnTKVI}Aekk+r<51mZWTfl;2aorf>EB2~b0o|NSkfU7@S)Vb zIXki4=CNWz*#a-d(0?!03h(1;kS)WN=eWE2UgN zkraZ)pZTFyU|Sxf=R{q5JDbV(s!-riYKCpyyka^_wi{4iQ4C2*W1XTWVcf#fW)Yq1 z#(_+v1|3vH1%ij7&#t~bb{5!rAlA$9io3s;&^mu)Xx0|mu)Bz$gfh^CE9lR<4>fOL z7~nMH=gmAL!MkxbAx#sbA{|IP;A(uDqLF^46agrootKmRe03>qQ(1O*JUGk6Ew&Q$ zrg#8!!n9)&2-6XV8m z4}d^%Rm}uluo|?cHh0A#a@3GSzMzdmsQo?WO13B-!Ib6& zCjMviq47!Jz*Ne72}58o&!|i(k}~kT&N100@jF> zXg_3g)A7v!8U!yTgMfk;z-KaDtNPGuIbLHlftW9tXzh*NtoTBi)yvG+FGEmd0C=GQ?*_cGPzH8MfG}nhJi1q`{?>aRc+D? z%Wcj?PEu?NQz}K`KL0@yFD_nCE)9BRcv-}HjgDE(k`WBW;vNFwCU$*R z{9N5m`ns@H-f1cNP&=JHI-3@8YF@gUHb^gy?48pM=xzXoyzjYXUTML}q4%zq-&?~z z1N72-&zS)Pz7ApsOM`6a=yslOCVQHQGFE@jRRDfO)}TN%H;oPn)={*l0mk!3r72cY zMHtFpSiiDtfaJ^duG*adq_ELm0-^#}q_c5h;kgcWiC7}=stFl-p?{8{dm%y4Wcj87 z7)x)k+2+L-ExM3XNx}vcsR`hHp72h4a)7jWvfI=MO2&SXRYkMGk`b896ZqnqDpl}H?=;Pi;x`#;Den}v;7U}gNGYaD?m0==hhn2KCWyq`* z0}<1hE6{0q*6t2_FLl->PYjY~))K>h=qdM6CP)H`s3a7P-QnMl6-0xn4DEac4$ z$ba9_S}TGa&>7Tmjx$7&d66M;%(z82?{6L=`)jVJB1h`6EoNQV7YO!q8XIhMO~9w# zrh$|%Q2M`jjs%eljDQ#gG=}_6)>xCpR9q0m^9olOU#{PTh-`{ftSRZSG)-evM%|JL z9eJ%ZXXKa71X!lJM|zrU?~ueWpYT(n`R+&Jj0(GE{5YWjB9mZ@QlBvB3U`J@jgVSN z>#}vMmgPuL{UAsHs}3z@nH1nV`O!x`VoJtgkxx&9lPak)50z`z4MuHcv|x;;>+M%L zDOkz~=J7){sVEA%_|eqhL+})Tk))U${P8UX5d41D7hDXhbwwOmGn?bnq#`vW4m1u( zS2?yFyBRH|c!uoCti6S#HHdM&p#X|;-YVE-&&S1#@k8{ipB0@eoAc5z=}hfpsuke! z?JSkAjbNsP%b+M16NMl_Hb8N(<_AK_HvThs!S- zv!GS-6*V(w!J$U)t#DFv&#!K@7+vCHg zZaxsLecnpC)M&Tor1<4@B(PK8x_xw~{EIKXp%Rymd!&2hVJi8I_eSc~%4C@XCaEgtL;5yYAR%E7-JcD@a%0km2%< z8aQBK{gif&3pv0!g`G%Uz-=!@t?u5*Ok?szs%Tea3($;|R@^LmEWTJ=W8j+@*7smp zFfhBtRQ3=<^7Jdj8BA2GNe!CEAsup3J~$={HkS84f99lqT*wfFMt!{8A+MVK$x~~V zH{Vz<+s4=LTKZ#z_iJqqxN3Ft2&^RKAJ#j_=%5N1WgOic_9-kCylA1LP7dF3RI0&a zHW!yDrs)>#J&vf-&q89&DkfNO3o^5WVRBJh<}(%Oqnj4C7uWaX>jSCLnrB4?Zn8z4 z&E%?)Zzt7~iHrncx8|1(pZfV*!P>cbXpS1c5cU=jZF1Bj-~z!>DGc(ceofLGT?u#> zS;RXcxbUQn4nb%D21t zRBL|oPo@PeKzAcr2iRp%t{hBxhc@7a+q$$oo2QcKf-j7g+6In%?nt_zm55KdYioyh ze%WDTW9et`po7uyLw}$rslLX9x)xC-y1E2Yaf!WQB_fBJb#q}?mTn|vb%FPV%=8r9 z+pvxz9MUao1^F3c)Tx@4vEoK!q3ridiq=b*wzn`7##AV=&!L;KZuOu1q$MdrxA?uX z-KUmopeDnPgq`Jnd0@vV8T9*gvBim3TPkb^(pbmaisJjG7Q>d;9-UBEW`OFaN&Na> zoh4qD!(79I92C3^a-3vw2qIk;Vi^pi`TLI#V^8LoEP0L&gg_li$~Oy^@p)1tFOPk89xMhB=Ght=p19nd zw2?^L;22&>PUFy2^N-1w;`1xz16YK?9myP-A>cK@WpqpTFs5^HRx$zmhqrKCKV_tHGBc6k zoR|@DqA515j?l})=by+SUbQZbu1Lb6;|DAjul~!`&d=M(Ir_EZ*<%0|vvV}szdS!J z=%+z28M!~bztiInyOiti+}ugop9Lr}1mmD%$LhvF#J!~l_wQRUV8c5Fuh-GQ2)}9< zZjLT@cVG|b{kPs(Us{R-d8NMdM>SK$+Prd79o4QkSHHqi2&eS<;6kV+gEQhCprOpc z&I3S>W)R=P@C&j`QMuYVk&>M@@~dLARwkF?%QEwDMp@?E44H>V)5KJ}=a1vbyEm|N z&>%p#YzNr9VAgy^S#t~&r&<77d;{C+AQj<%93?R3p_go$!j?FZ68HP>drni;Wqrov zTW(?80S4lqj@&nqhLDz4wgF&7@~btx#H~^?5P|6!`O;djEMaF-Jh8mncNzp8aXzJ= z7z-yX0s^k~BaQe)T{=Zel}Ri6+}QnUR!sQE>?f)FDbc~5Id|1F+)o}{X5q9|vWAJx zdy1dNbvU~iSrY>0#mfsygJf;UmX2kRmW|dN%drLACEf>OmYZTW_gy#{T-M`{_Evp| zRmbQb6PJhEYb};u9P>Gi-D2c(RC3xfWLS+!vJ6Mj=#ASx8noTwgFrE`7Uy7KT9lQB zh0>HDc>=H-L{jahA4-hg8lij3Pv%M-Zt%?Z|fN6Oc*}O5b^~`GXN#E3@(*3C`+bsA+#N-4K?6 zNF@>&x!dBN&U{W<#~Em2t!UPT-p~yV2OMXuOAEyhCU_ulxrh4#_5q8TIgViga)-%j z=cq^dk~2?~3iQ~+%&G}bK`MiVOL^x`td8=IYY}TvzOMiH4DYf^`>*QOZfPB~_MR0! zJe~aJ5GI{Af2<|kvOtvD&1z|JZnL53`oHrSZd5NFzzV`6*MtduXd7blQ2%ibL!#Tc{WjFNTER~&PJ zZ_Zf2q8A3&ujI*w;|IyJaTe zq8^nQf4JS_vFk=!$598srNko7!3<6behT*6k)-eC{AksN&`l-ZWEuGi#WTgY4#lF` znw(*v-ly`UBa5#E@N6c{d%*^g6J!p-pedy}*I6i3_tJfxI;ykKRyOwYwwhAyD)oW~ ziDc0=j4c#HLhOz?LRjwdaOFvARKuC>I*Q1OMJBJTRz9*o;v z6CQrPP+E03d10$IigQ|PUr*QrVLVOLxz}ZOP_Tjz~3_L{u%5{J4 ze6c7ZR2V|_!Bf+>lp+>$ch5avvZm8q=j;dhLRb0EBr@y79>?eS{3TEB#S5D8f`ETd zDYzsjK1e&~n?}8EJ!Z}<2rlzT+t)K{c}9;7Q-ZtL+%;#fijF}pS`4aMFOl@`h3**l z;+yi1Hq$?I76p#t`TB=XZb6z5&fo=h>Kz88G$TmUcaai3c*v}I;`CRL5?+qZxnZcg z;DFeW%3xgx6taN13&(%A1r4UOoi*~)CEjNjKN92IEqw>UbbxOQ_=XI296 z>uoq)@>m&QywE_0#TyOw8Dc2XwY_nu3!59sDZn8c{&0-p=Ba{)U2}!+=XSCL~t5h!3zXnPyjgf;7dOtc2bK3S2G>SB^ zE6nG(#LK6A+o>X!XEzD4g8Z5WXKOn^P6d%?CgU!&er#_<{k|qBQR=afVwY#A&qrul zHb5Qjz<=f;r~Uy7aNnJe&A3ILt{LfDIE-!>0wdVBATk&%p3gRN?VR_40`f9xVXEyo z`@vo};-x|}~sq{&Q zhdm6O)sdg3cmB|BeCz6h)yC2F-NEEBagz^CNkZYag1iN`I(xJ<*Z#agW$SsS{SV29 z{eM@SG5+_9%jW+8w6*?+HSGdK1ECoT{fU6js*jb_5z66g8SPU~_v?d%SV5ASkvkBW z_o9|2Iii5)W{Ikow$AJeOp-|wTD`by%V*FZ@BYKs@yGjD3D*17p4CTLd5D-ia=MF( z7Vt3s@K`(9o0QFRY>hj9O`o>xD zv4_!tp8~50r-I&(jZx)Q0~7>AHCD^7fd6Ab3$f~R4zQj3=##_P;j+zYX%B%E5Z>?4 zePcuy;n3N1;ax9zn2DuubHFsl8PR?io1xKHU@WbgoE#@j4y^nPPX*JF9V6iHvgi@i zw*g6*od`6>Z+elp{2YS1#l7>H-%$6c;Rujr%6O9=QSZ43UU|jx4Rx$O@fV=W>31)P z+11XCPC)2*Y96*nFI!_;c!m|l{W@`PBdpgbDV->5WLO5v*;!%>q8OTE;nO5^pn-(y zk|v8n^dPN`k|k^Ld;KCb3)GLVervoxg3PPZu1Z>>tP}6F8BIR=USa8nVpqKlh@y@1 z0ji}H4p1yf;12Qu3FAOVm+d*zTlrOm4%xdVB^wdaKEp>0w)TB5DO zeyD2E7OgkxzrhrU2*qOSDHW+TwxxwmbjxES9d4>V#WXCW7o|E&ejZ^cmk#ZV6@LO8 zdZdLvKxeQD4%m4`Cp3<0IlP?A6!g?Ov~*oY?1gPB1{Zd3(8COl-YhQL!P77K0o*y0XJwX|`gEno z+7^MhlznZyqYd4XrsXU~jb?DuVFIb5vQ>w+9WPLWlBtBQUB<_O#nPU!k&vH&pa5|( zq?7x6>a4h6QdM>MdzUdpuP5r8ArG?BcN4c&=R8Ol);N>aT3bxskWnT8X#1z5ou6~# zpb-vtTuANa2=)(!2z9XfDr6~+sM8)3wXW|SAP7ANX<7oG8{-?5#+RA;j zS2-;CYFyY;wH<+5Mzr(my_g$Tl&fOjp*tY0iGGxWO&@6Qrj zb<{}1E@)vwOB6neNRYs|=$L%R2~YG>WZN|=XqU^TttU?S17%M&8afsvNLfD6GQo?P zN^t-Y8{=YIgldRaw-VW6Y97|>528~Xl`rP}yCfd6;bMIc;VqzkI4kY?sY9cAhqsej|#rC9hR+eICcSMQm zFe0;Ou$PvHS61$=sksiOnY~)=sU25fgKspr;yw5Mb4@kqR^uT@#6w>CM3Rf|MpE-e z!xdDIc@bH{^^@zWSzyjGMNA$_3C^nlXB1A;g0-+9zz=_`a>JdD?98t@a{H4M$5X=j~5qW=0>5&v!d_4UG=l;UY{$1u0}=i0LjdWLUv?sJhaJ%)+XK z5=o&GzU#I>bd`aH-E8zAm`I5W2t?9;VaXXm+-3by7CneJ2DL!sJKpH8|5)i8aY40k zb3;2+2*9W)1DFp6VkLNShL)VsG3#8+?vfVMm%FwP<6ll51?6x?4*%frL^vE@$KQ_? z9OkQ6!0a#dr@Li{N8sH!de9n|N*`~!rtV8gdT`qqjY2SZJ2uL$ir#c(k4M#Pr3d0` z?Oy%4(xdv(zC>NmA3NonbmYczvZ3tYpP8*)u(~c@^BhhVc$~~0@CT}RWL>b_wRWm* zrV+HnPGyYtgE-pvH?}me9yHAg%q{xE-FV@Bpkl@pDgO{HCWAT7Pc5=C$ zBinF$$ScVqT$mhkPn)+6#cUM!Nhz#j*cg5yeQ) z_+N{t>fbo_^#4d~tA8c7A~^rAxopDNlO}!eC}9*XQMJ zqD&nMj{f^Y)&E^r#el?o_$tNvL7{8RkA}vw8Qha(6-rcwHrBwUas400-l0tps9Vxa zXQgf1th8<0wr$(CU1{64ZQC|FzwR@*-S-U6AK1hF#99&S4b*`MsHT5f?!WP>Z=)O- zfj;W!`TYhgT)4oRvaE!c1xUEty2u2@Pzo8+5|)uo z#acRc#rnwCYKqq!a3`j1E-@w?k*dbWS!Ror=+SmywyX&{2xly`p*8darsjs}HqxqWZU?5mCpU~4|5TT6ea2T$G&iUN*WYII@P3moyeB~A zg&yYy%P9QqZMT#&-ghu|L@om;#rthmK99|X2`$w|$hWPITx7b9rx{|j4tw>m1A5Mw z(Ty(4@Vf!C^U#>*l*Z?s&b|t~*Tf%ucgrO}O1l~<7lmZB$s_^P21yxK$OJ(tA(W_> zd4uBl)UUk6b450NMx4M%e$`1{;7FdwnJ1b)JBCXanxF^~#sj5PNZ)*=IwN`^Ex^}{ zM-G#G&Gop3q>xapI!X>3rie41W z_`BrdTF(pB<4VM5)$A?l8BH)&fiPMQIjEB66Ke?=3NtZQ@cAiL|5(gT8rGsPy}~Yz z6|g5LgjmHu{9Uh{p_f$leI(&O4vUih;dW}fV8AO)KommG!sxf7_hunx_Zq0HzutD9 zvG1i;&GX_@*ctevjZ{}FnN3m!xWE1Q3Whm@$WTjYF~iS?F{cu_fJ_KMO#>M3B+-i)RDF%B4Xgx0x}A4HJu{24osZunCL+lgB_tl=>ryoS zC;5hnHTpbE&RGV-T$VUx#mo8alL-(EgQLU0@C5cX0C;9}-!pc|c+OiO?0#Ce&?wA4 zfmF^B{(fF%w2AAm&58C=EkDzKivUlEZ?IU#e@4pc)z7oB#jr8;Q^=pg zgLRb51I8Udx`tE7AP3btJ8rOb`aj6WLE3%q1 z$OON3Qg_k#d-8?@-&zO%)=PQZohEB16;<^vsU->2M5`fnE?asar*0_Z#T+WnafL=lmLjJy@q~$Nf5dI|WsInyBPBA&m2&+jSbT+m!Pp zNV#j+%N5lxWiE3t8x=GK++WkbND>hXrVeTuH^HPd9=ReG)046YFB4aypam2Ghnao& zm7uCJ2qnyiaw_LQbZJpTy7>z|S5rs(AB%R}p^8gDP_v1f5$H^)uw4;$|5T!&GMi_};XIStvlrFKySNq+lI47~&;#!0TJmFXd^7vMrn+Wz$bq z0KmCQ^`+zPBlXu+V*B;*L z)})XJF@V8tE8!B=pF~a425Vng+o!B2Y;)qTX{4j$axXFZ_roIr2doH*0k!6@QvhBjr1z1wj8-sJqqi2kaPN}cGjfKU#f=&~>PdAFKP&s{Tf%`+p z)~2@Pm3=1EZ_3C2ft&ZNEQkOOzXbTN)@-seM5ZK>b>=y>q5l=uW&khda)`DBT8WasZZU|J@Mpxl2s^9HujB)1y-TpB+uTLHro~7?371-A<>kcGe`$?H zS-!ZG8*pn zOwBDm-&{x$(OH0>1lPCnYKZ^qHC#ENw7%S8M=GU=^!wQ?s3t@woFG(Wx3DgC*w5-; zI5nl(I<5b~=m!3-H!)o8tJxL-y)RF#R{0JJ*4S#;f z{e}aAgbMxt>nRrc{~1k|f&Kpiiv4H3^}vGIJ)?LEIw@~YHhW9ZOWeE3xX^+RzESTW z4m)P7^UIUfE--rGg}@BiL{_I>zF!iM?UALQdIe8ROl;tPrRV<7e(UyO;`;4_Sn1Z} zea8uqXz`Mi%;fW@MO>3AO7-kV_ur2UFRsEGPtQlz_ghzn9;!Ypy?1pmhZvxW%&*ml zx7#!vD<$jNH44CHv0O0}npwm587deG#&d`t|i{ zW+>_OCr)^IoqoRg+X3_Y_zSb3$oCp;7ZXK2K(A1CK|r#qisTq4bU{tT)Hg>m2sI27 zON}_ZIM{F;sVHmZA!ix~wfITJJ3QI{W9$`5TLz$U7gk$)jx#Z`kvN%@1kdZYqtgW} z-Emz%gSh4rsKxHAJbE!YY7(duBufXRnL1~hR^1k!tgV*XV{6-k+@9^b8ZNvrX|{1K zpkv2BbaI_ndgk461#YuEynQ_tc)y4KnI+Vi)O=3~7rXb6e-JIw)Ln>aj636P=eF|D z6yKWHN}b+YQ1=sdiWl)C6cpS`ixWy@rI%u>(*$FNJOx8k&4z_PRM^7Z!-t-*?@f^ z#u{JT$P=?nv{Tpt!MlNE&S+Q(oO)@_-i*qDLKhVOH6++bn#g+IG!y!)p6>i_@Lj>Y z-}+fOg*Yik<5>K{w$OKw#JrZfMngR*3@t(4o=Pg`qB?I%bo0GiL~Z9?e(r?^va9_# z6~lDnD$64JvB2H*roBlkcyehPs33dTyw!v#G=S7{h(MWzjB2zJsZc{$R-_2{gmvHI zZTod2r>z|CzHQX!IMT(y#(ZTKGRhvlc{X`wHj+!TyWO^~GQ#B0o5n6!g|2Ji@p!4f z{j6@OMI_5r5fn!)PX#hbm2761-viQ?y<&|Wc`eNZpA8ut#xBWXtlAJ7Ka%pniRwcY zelR?sKQ0>VkbhK90x^~Fj1(S=iAB1bT{1tJD{|<9995Hqx_YJ#9T#T0!%Tk;Q;ORK zd1#fWVJ<;PHir8)TO?S!2qR4u%lvzJR?F%(0E77-SGJ<5g8Is!Ph9?Ht1_=6(rg z{o@$Wu}m4$S@$URyS5Lmd-enRjg+C26oVYW#i7fe18Dcizr+_73e_+AcdK|kn0b*0 zecL!a=<0kMN#cV5SzHLwgI0wX>m}mWopa&c{!v^U4g=;U!dWfATe^fc2e1mp8PoTy z+FuD=oihqj(k>(t0|3f!I%d>|1#b>RGRcQT%85`QLKa6MH?45+DV%LO7beV>eG$2l zH>RI@@e+qcF*QyvZlXJTaHXw^6|rr~nQYA>z@l9NY{8iqLw@IHbjOAgMR) zB?#NWe^-KlSF8r|&-|FMy4KAuOIJ5PL9e*Vw$by7nfP)A|~0OldQy z_j7n=Eb*(>SBWIHP|uZ=rW8805d$>!O=p%(uk^1pw(!;O|JK#!7>Y6y$WDPd>+zqj z2CVz^wJgScv7Dg~pX$U}4-f|q! zKA4J~K$8`#WwFCuWN(iczz2vxS{U33F&wj=e-0gW1Rq6%#)lErGD()X33RywP;C8l zH^tZH==;Rzb}7rX`z}BGKi+oe(xSbO2)Uk-vUebm97jQjtpf{> z^R}>A_@-hDA)eD)$#Eziv!CHY2~|wPK-#1sI1U|T%d&+fo)n9AXj8LGn@IRJpplO^ z5^^m-E6@)7yOP_f674A}U8uCikwf|pvtTI3+fRl6@nds|7lK{$R;Fk5zQ;R7Rn(Ez zO4!+S!nLqLH<>BC$VSzqQ)k|hCof73L{|^x*Bq+FfXmSos|tIy;8%F^U~||>bJ%l# z8{+j;hic46rm{5?;^J1ZAtt7-&&h@;d>^_vd@($DRbenc#H1+VFt?3rBTXo1rRV!2 zh*$Ni(^>ezjFRKtD7I)Ss3;zC??F+J*=z23{9k9sjLf40tk=kR1vUujd7h{Tm8P+d zrJ8kcE~1@iRImLx{g^e-)z-Apw~$YT)wnHETH{P-^QT(wiTh4HkG&aJJ)osK9M#NmQ znI%uXjt#Jq6S}{B6_#L4@(AMj%|;fWJ62sU(QepxgZlGDU-I*dkM4@)1eRw=53lo4 z9Ccv;1D0zJ&d-}IWE;yxvMXqXk`;C7O|!ZUt~f2{17r8APY_ZFvLA)XExr;#M@!Tu zX1>x&Au{yN(3-G)D8~Vhtlwj^fR?=92eQS)P|N?FwE3UG3Yh;4UX4G+*P$Xsv*l>N|PrX7rfI*t|!?yNb@D>D$~KPw&t*I*CE zE3hKH)QHvL2F*_$XRkpV{%C$tiSD1u&kXIi?~jq=8(Vo62bOtB(yYkE23G&@P!$cp zE6`ojwqBbmld7;E5Ai?d;4}8kwaXkv$pZWFw_+wUlxK`+DqIFN3IzYYy5c?pCf6`0 zly40{M%V2r?Tz`0trjOI*QpnVLfq|17Y=MI9$g90(9WNlNe?+l`xr>V5d_qTg5m{E zu|8b{Hd8CH1V+ItU%g%+dY&MAgqI;Yp+2gDIdfE=P=ESf{7uKRKjCtfnV=e%$*NG) ze+n!>aq`h5-F2GCx?qDey<|MvC*-O~!o>5$3;FHv#^jiAO#S}$A(RPhtMuV#@YECi zB`B0}Jve`eZ@n-n=0iuUcHz%Kbb)Aq$3uZ5L=q`=F++?%06Qt@4ELMevw+S|gcq9D zOe&u1(qa@@i9{9SM;V}4U}HgmO~oImt3)5lwE|xG-QMn@+k}VD5gUyR3MqL<@nfud zrE%x2nT8z^@P>&i5e2zH+r$-U8Zf8A&QA0m zTZfSobVd1zG}afBw29{U%Qo^mOKtFO=EI^fTOH!`v~w>PbM2-qi3N0P`6A4d5iF9{ zV3(ED8*f0mtpE&vDFs|QLXY{&aR3{yjnP>sH{x4AmOrk9vIv_LAj7V zdO3yEza-xX>BE$jEj{zmY$OHNlSO3bL5bHe8?DI!G62v8S92$sUJD(&G9^IkV-ucr%zo}R_uMQnqDhL%76Z23Jwrx*9;7)lEDh_ ziU@!-qOi(UWG+&46Qj1QPhS3l1y;`Qv_}bV);uU)ms(nW_q&&WwBJxJkC%?eCwQ1~+qqLtl&U}mnJmUrCLMVa?WYfxEdA!s-eDlr@!7nyfqaYYDQ~GN zu_!V0*a}urBpPxDlf~R=2Shscnj&!#KWtr<&;d8d2g(Ih=KPc56~g_3p)xa_v()X% z9))BBrjME%Pw%kiX=qoXF=DFC>JQ~f)~TQpOf`td^zZVo0?#-$3u~imLWq+{omt(` zd}YXKtBc&Gm$eqf9PyB~rKx*TMx$0-=viA|Co^GftD^9DG4!iLVMne0j&;=~r&t_+ z;3Ttc_3V7>n5Z@?JKb`5DdqSWJ2hZG5_!o(Y1((4*w5y!XR1$=Te3aO+9e*W3Lmg4 zf_Aj-UhlhK&B#<H6}_&FF@VvlLvN!1g${q1ecVtH{Wo#Qucl5rvz$Ap zY817i3Amd=N08tvzD5+>w8d`8RfUy9lbTJTq>NJmXWbU_12qx9QP&^K^~GRPlIs z^q_EDZid6AoXy7ML@D?(StR{&=hp5dIk=oJBAkq+*~%y|-g3(lub0qyY*6tO6QJgL z26E_L#BLXM@ZRM%DK3=hyl`AY7D~A*S)!ZOd#CE^AK1nh>8jF-yXl#sdNpZ*MC=k% z5+6E|68JQo!`q1~c*!8r!BQGm3f@{YO&v8u+JwA$2rTK|V2huHQbfR%o<^wZ1-wMg zHB|~O86zQSL?5I*n+OO;D)Jig<`;&Fg>AnjAtniD5el;4hk>m4Z`rCorbb6v!{Rb! zj2)DQ^!s|feA0{jIgNkLw^*29OK7#>q3?yG$6SIuI5a_0jfGpnC&3~^jbi;t355g| ze8pW`e{0cAY6aEzXcRYq#S=54_>Y6=A$ud$J$;iL6z=ic-^Qp6Z#a~Er?TAXHlG&& zd64zZ?iuza0XIJu78u$P~@?DfOCQUrk7DtilG%roXG%ZU%mAJf1?-c+R~@>IsuJ8+p+jG1vr}sd^g*>UMst{h6H+x&ihQgWB!1RP zlDV*K*mym0GDKWAf;gcXM~q$Yen<`~>5%b~YOdPLgWfFRb zrlx8LwSPqn>-k8xkG3BrAE%k;R*Qw=nq)4b0%`ANQFpmBr`bqLvE{PyXb)d_&)lp? z4vaOvUwip@VdK3Q@y>L6gmi-q8J;q3hX;!~#!~s(lir|SbefD_Qvf#*$CRXEapdlVl)U<1 z&VM~k4lo@bGE+RQ<=PQ&?K;vWZV=j+NY-s4n+K}G-+0qXVBpoW>8~#07O3D@JCLQe z$=i0Jk~cZG;#*bOu=2@i$;d!7vw~EKf^Zjw_$N>et#&-OhF+T6bQdd&Ngm- zbUG0m;yzJ!>zx?!(Ou`ci2)Vd1fY!c`VlO6zYgHwW19K@JE{3Ub0wMC{~uR!qWZBJ zX8VQW6X-zA6$0H&J`W;Jd%l6HJuUKIrb)cj`#Xwwe1WYasqmel&qli(@z8|m8FUYv zN!mH@Ut-Q8wPCH05!m1pr}&b!UeoCZ z-X0%ZtFnSst+9nobUP&%`ugvjr8?DTZTq6SKQn_1v{2lI4HaNZ8FsjQ|Ac zC}v<$JgV(ege$-;M8|z|X@`+r)(|CkC5o zUMd>{G#4=IwtSeO|Vbk@dm)3`b}*pho18I#OT8G~6+N^MX+dXNCczQdMwI(#P-ztv}jR*F0QF zbi{?1_`J;;Zfb~}op_i{@ku82!`;d9n&vyJpGnJZA1qSlD}fAyv#UA^>gP7 z4`zu;g0;Kw$uqZ;w&2^lTys(BQY?z!RoqnEceSfC;db7~e6&4CEZ=3oIW?iE5)xBP zr!pKXYo(JuyiQZ5NjC1OVqvTgyV%3gWEW&NfAB=2w6owv3B%`a#0NH zib%jZ!}MobFzQp1>7)E|0%_?1XFM;4KAgRK;@Qv04o8%alE2bnoE!LCjRXyGYkN|xqsS19~B{q9%Jb$9)SWB_vn_=C~3RB z0LCZmQVI3u+4z9Xzw%ECcYlQK_p6#^Lr49wM>PY|q}I%xL+#r*xpJ9ctADD?OhWsx zAW>j~HW)b0XG9-~|8)2ArnJ#EX}Vn6vovw2vmjcXD;YiInkLcaj6z;5jY|-CuL912 z@hlOQrB(OiB2t8DMx#ZVCVjf+V|0P%5_RTN`twtZ+p8Wdq90qB{2A!UzyGRY@L?~F zFo8|nfmtRxX_as;EQJn_=408o?fJO+#F8Akp-ilho))L_Q%Giu^>bSNXOy#msvUAU zu!_e@vhsVX_UI0|M^oa9=FoB1^R}DKuVry*-XPoX+|Lthv)97gk>(~t@p0^VESg~di z2Ysj@g{4w%1oyr#L>jBHmNrhUQpl^C&s(C?&IVHaZk({?L@{=wZg8E@L4L$MYcM&< za$bC}=g#euqnvHg3zuq@xcI`K!r4Qi2d9>jR9Gk>`9 z@P!uwmQ3G|T(za|l@t3;!-t=9Z3hdX&XdO$q!_A2^zyvr1<{D6aF-?>p!R0RU+B77 zl%(W^6&XRcY*6N9t0Rf72-CsB()=;Y^$MKG@0r(0jKIA({vD-r)UH_#IDeI65I&LZ z%iz%*{H|q5ofAtI$f52Rjz?^a@EoGI3+>(91O+1Rx)lX-OMVE?UYep_z`Y2$**AN3 zjlhXc3%mD2u=ayzXz|rvH45q+@DpJmk(<6rA`aZPMoB2oUDY8*uQSsXGcI7OBGOtdto2n-AOulsL$i5u^ zj@2>+yV@qc$&!%MIn$H?*gmhSrOmvIE-)x$I{QSi-dX8j)CKCGqBZVF2l|4xK$iC5 zYtD-N;7g1C3iWaRT*~Iz4GSC0NSaKxF=`I`_x8>S)$Ef$DFlku*$8}g`TDao@AR7y zNLf6Ogi0HHsL^+q8TCbAoTFlG&qz%$U5(aP>9Y7)PA5K{1QfN;i}e%E&#mxRy`|5d zC4K%FIcX1Ca~N?#9PD4*fg#Y%hqLqs{LYyV&W_nmE6Uh)OJHQ>+x7Vh$Th&Nj>--q zBWT2u6}AT@OhE|BM0iP|_L)g#!UoBY9jh(K+$`%;eQeQ7d4W@YF+;(Qhfp=R1|pzC z0CPfS7DiQpnD!?HFbcJn*$dg&*7#5F zC59C)fsw9Mq1zh+!0Z3G$QY74I1t&|q&6?rN1AE|KG0khyEEB0D`f&=68g?X&Nf+N zAvcx7tqd`w12h{CMK@ySp_Nb6Y6tYy&%w=o9LS$OP*tu}K*8qnctM|dZ{~KC=a-`smmmL)2q>|iM;Mi-B15?d zc4kp4Kx`p{X#V#N4+l#XCTB{73!J4akrdHJvSOt#Q4`=OS)x9?gUqy+eBV_* zed7l^=c{1Gzd7d~o)o|V2NXgb%Q?V&fi)?i=gm&W>@Yr#_?*UeMQ=aO(HK|6`S!4F zb9>yEUI#YDiXzlg!?6j?uEC>p#4~-Bw>+mkiNJRQMdGd0o2=9!vA)$-3Hx`Q`P$l3 zD;BqewNsb3hZDOe>{;am;ijCD_pN!`{BA59(KdlJtv?@J`Ljs-pUU$d57>a>BE7B* zfG(HK1?S>;F%_mk-j%hJAaA387d`98w=>8!pU=o zeBUr>#rxXU$JgH{FNf2$pgZWhdeYh_H;d$huws26bMIWaNy@mj>%Y`J*!-RBVZ1+{ z4U+W>Y#3i;rt^=-_cv@k|1|6~T!?KQXo&0SOe??cQ-6SNIb&h}8=cAUKXYrD|6i(@ zcHi(>ZHEI*p4iU`jB+e`i(RY2n@eX1SRS( zS}ea=m$ga!RZ(+R^HzMY(fb<+n78jKcI)f^6vp3N75rCW{7>qX2b~tv;}363j}0%L zLi&yG>#ENW*?$$ryD6VbKpj0j-@R_I{^s8#7r3?P{sR}QsR-4KQw{zZcKiAm$z{#f zqv8O1yRZH)x)}I>=wg<9Kp_yL z7!k``Jg8VgUWMG-9Vij+90vwOFudI0fCo0|g|MM`wd>ZG+3o3+J)Fz>*5TkZ^z75bYt-@DFxFBZRA%C)3X(g7404IJhR8)3CigT=)V?h zt`U?VM6DU&j3|#C52hr>RaM=jy1QCBt0(&1uA9zYqh08OeXq0E+(Dk$>B)8Jf5dBAE9Q|^ z`@godAx*XM?C2yw0ij+t4)cdZmf&eC=}}Si{7~}*w-s8sQ3eT;y(W9ka^5mQjsUnS z$<&dPl|RVb_)rS)^yI7}j4uZ8#l)`L-^zV0!ZRX~I~4FZ<6OWnorGBqJ^{i8O|x-d z=v;c0Flr)YPE|yDgjjRH+P{~t#+LK|;@3Dh2_*W6G-g#$5#4jhq+Fe$e2iMyrNaS{ z9HS2lBhNAJ-7tqy11*E~&ncge|FJ6wFHb3$Nhbxes78>RU4XPAijgWS64M$Cl$7s^ z3^il0OTcaZ-9J&&G_Kb>mfo|^l0{`D1t0Y;LjA{HwQ^aQ9 zpIMpcOq7V(%37nr~x(7FLuvG+lYo6jtLG8`>j>sQ}Z`kRn206TA087>n4b2e@0U1x1wH5TUEQ?v=1sO)=>7aGtWsE5^8TUDt=(v_2eC_C5@|g=Gy|`!k!(cBkYM9t zyko))Zqan^&iNO<&}{G0FIe1zpLSbX~qqHE{KJoUS6REL^zI=2H$`h~+1LscX@ z+B?+5LAv* z8qmEgoQ7z;^ConxAP7OMfY9YFUmH>K_^gGrBy@;7BK{=iIjAFOW9D2ql$_kv8n_t{ zG-CExG_BbC5A*62Jo%76H{@w{|HeR~=`AKIX2f1*J}q)i-p~Fl?uCg_Df!=t={nI?_!t=Y|HBy*e5%NYXVI?uGI||RZxXfr@UE6PA_bK66oD^r zwmaztRa7nLk{6JWiU|md{Rn1!#cIsZAq(NV3x__dlj6u@kVBZj&}M54kz0H&UQ)v+*CPbVh`eQTP1~TTNiU0 z2gz6{$MsBWoB{5OG&bSajL??LdTdp*P(XahtA@d)WpS9LZ`H1drd~G$Pg|9HI!m{& z`zLXTnR;dmvgWrwHYfeD`(^(b{k*0MXuhPd8|{yx4lpDq5wxC zGw1rtMj^`CZA00KxJ(-?Pc&TyIuY_h&b?@-xsTRod}doP)CHZF6WLNf*GAo`+;27o zt>(Q{K6}W;zE&^Ib2AP-d#i9-KDT+=CvIswb0!w!iLdhjCo_*8?}>|^W-Yew(3`n@ zsSrb|g1hM$eBT*=SABixW7e2y?M?W;heUXwU^M@H4o=;zPbU86Y4h00HsN0%_6P5o zS;oi!sgjxae_T$yH)7idj0n_mb5wf|*l&d&Y#-eNU_we&Y^Z8~V=^|D%AmA(r7ZC& z11rJu9S$gm;>Ia)R@*SxqT!aSHi9vN2R-c>tw?v`bkN}a1P3mJzHNTAs(&0Hs0i!d zqrp2yntS)>%PcHFh`iezyu5#_r!%&j`;@;e_zgNA0?Ov2ZR9=TbW79}nV9MSzt<7}!E}K97oT5})fQ1rO0O4jSL)d$B#=E@%|Gk)MVVUV z?mB%=!oSY!ktI_a^}@}0>Un~+1?T(lcO4>!%arKah@`pN22Pk2AaEyYJMRs~O%?>1)Dkc^lo>`gSD&jwbJ|?>CA-20M!O zkA=_(M3Jk5!`>pd z#A+?ypE}P^+k|Lj5s$S$CxRAx(q@ALL|uL+fNlgtlgkojL!T=M5c9Cl|J(95NG=#y z=v!bARS{2Zv->A|DNecH*pqb7%~n!7+)VkZ?-JK!DJxDCsW>h(6*Wt0gZE#gjvbOP zVG*?5AJJ}IVnkNPF$kFF1dO_yl%md?cjy)Co#>-qzD*937Nc(aWU{J9rpQ;fE^ci? zped+p=CFGSvpew=V~FTNIa|VYi%SoaMW4)L4o?X9*J$9o{GTTp3b0(pw{UFB*wnv5 zckGIuW9@hOm2!RlW?6D9jD~J#H()BeG8yEQwz^kBibyB4PQ;dO$S3;_-w!Box4_6M z98bZb^ITZd9*p8Q&BCt(#aB(6+yex01atbXbY&nAM1yteIpI%5p+L zLO|1j4oU7g<*J)iNCeC9Tj%_CJL()$LnIuCWD_$c*DE*OoSCaok`*XX6`vz(%;zkp za^K;PX=vc)&ogkg3+7J|MiY5=O%;sSLbjFj*1*bBE{e!8vLZ`5 z6;4_u>Oy14R~x`}-xef+hD5g$}GEiyqnvX+b6CF4}YtC&&p=d zD_JmcRJmM7v6YGAz^~s5W&$|xgMb*m14&$hOsqn7SOHD6UC|j)`Xo-CwMv*w{8wSiLz z1kKjLN8z!B)d)T%Qo`;#362jrUoW?)-cmS#CZkabJ>gpjU;A^L*)D0yV%cDn#+=_C zSzb?$yMGTvpK2=Exa-A=PF>z~>$1C}(Lh`wuzoO(Opn{*MZGx6e2e!!9k6KqN57-t zrG4?<=!N0 zh>XVL-$He=e8=FL<;OIb>>hFgS?nbbnivtI#Dw3xWlN<-2KB0%jG+hW{aJM3OHA(q z)J4oJcO%OP+wU}eu8ydoo@wZO*rq;wda3{*%)M(4xBC17)T{$GC&EXn0>G*13{@dc z44S)j7=Z`eSnolMw}^iSjaojZ{qlP_s2UXwQie&-v^RWcA7jnzXs|C36WiO4zoI=N znyu2VLZ#dgYHKKbn!A|K9W;f*7_oOvHYp~4logPi#!Ec7BG<{9QWN;j;!{4n8VaT_x1AE2 z)nE4q(2;}0+{{y|ZZf%?6+(H2OwlX#+Tc1J1bQFiE8<47WyPjew0n&qwC?`VlY%i{nyF<^!b#KC21Va~YaV zImeQz+q@4j;uuT(>9_@BJZ;ScH3b8sm|S;D!(x(5|BGT0E61fwiDSX`otRGSY@zgy z#9GnVb{Ir;pU6{)>9T_0B`Iqa2#B}sdb4z0y|>ARi}^-}nY5?L4gnCRfv$`{ta?9B z%OT#kxwBnNb|ilemG4^{paV0hwQn3j2Qk!-3jWmo;tE4J*RcV6vS}c9>77*gWj*@9 zb4+`??}mC)85z5I6}}v+W@==-Ot-vOt|xRateu|rTXyKOHGcJgBtn(4xU2GFEh=#s zDX6YW!o9BT{7y|7=fMpEZEf%daJA<5Pql1_uDuIrH9D!5*?llqW6w4H{w>m1x@ub} z69hbs`Wni2Pcn*aD?*LiLKlY4a~+-IX3snQ?y{r`au#pdqB>+mha|qeA-0&Q=+#4>&bn1QmQH#uf^tGxEut?bwptJ|$-9{76Glh?h)p=NK zL%3n)E9jBZjj>}P3S-t*z|K6BR^YTzJyh1?BsneqV&?nyq~4Mkk1tgtAfRuyJDmmj zte#FTsR9!}FSyxTg?|7zr`X+3uV}OH{m?D;Fz7hlM?d0CADf6LQP`N`6$&r5Wah(~ zLAuFLSF2wFvdyB@`o;;ewjE8|DUJ-n6oJC(+PmwoNGYHe%Wg-EYsPdN1O@&+7$PTk zu+Mb8ZbtaKiGcDR4+~<%cWx^|W-H8T0d>aN9I15nBc=_;aI@@{1?QBYn^ao1A9>;h z#VX6f3bR48N3f%SKGC!_mE~T7S^u;Am_a!9CwEL1fpo)l8xim5Zn6&JadBH3u(rS| zj=;$Qmzz1w=W>^VF^R^eusM@m+FA%vW*mPh!Qt!r?^kYu_I zQF3=ZmQ~($hNYjC-HR6d?atL%3j|yMbXKwI(u>?#&1Qxre!BRx2Z)bh;?`qlw1GOqmKD{oh zwxi}bx2N`Is3P&;xu(VtRTlpqwl-w;m|{>Ry%&giPZ?WQJNS0DREK5!vASi<>}k{A zPs5BKLAo-!8|WjU?|6Z<@iUm5dAOcybse*B4&H{Cw8Z(`Qc!e}^hYX2?n4PW%#|}$ zoH=fJ8wq@{qZCN$(YAuE<8?nv(}Wbq&63S6Gyz8yb`~X3;T*o9rLBSqt|p&y3;Cqj zekj|+ZBZIcH|@5!s@1jP(Q2q{^TU>}PrGmVgHYAD-tlMGXya3HnGPAiE){|6;(91M zJ=z7jkJImkTpv(TOJKeKM%Xd3{g3!-EKE%Qx3C+FIT%Ig`k;CRE^yTK3xEZ?1oXn{ zunmFJAlKyzy&LMeiK6+dP@q(v6T)CtD}IcKacA)FKlI*6^Z!Hd)t1zz?P>JSU4NFu&=cCMae`o%yxRzq>y_lg7WkWOq_{zlZ3SE0>fyygHoE zm#cp9y&F$>zxdu++L0G8u2zc;vrZhv4r9m0TaEF%+@0_C)^#EK;`o1E6#M1-`oCFbp2r`{?YTNIMzdVOEClWp@N8bD1wUEQfP%=TYbmr2J-(Pap2Du+(&5wdpuX}s zIthKiecJC*cZ`@IcwdUtfuAK6vmbP8{X@zIlm-%y7YuxRFqZ+R5i6$s3}Dt6HQSHU znh^)J1u#C>CL>|Ay2oABq&`TH${ZrpnWzIy1;lj3@h{yJIur7|ai$&tp$EWv;cb>^ zy8)5anW6m&q6~Ika^MWv-I(X;tG9o7XMWCuW!oy9Ls2m;JEqy^5`rAQ({^5r-IC-$ z!aH{#nl+J05EE%>J-1FfvYvi{tExYe+r ztxwj(Fv4MsSGQv0)f&EXZa{iUnh*3g1gWb}l#U?u73{LSjnEki4~I@VMa)^Nd_tfU zrbJVf$&1;(4&WCIdVA|B7&l3pAB$^lxAaMBZxU*jw=NT$bX*wZ9q6X7qZ?(rq{6RQ;)CuhOQ%GB0G< zQ6w|KNw4uUPbMx~S(wWgLJ?pTc{Y)X&+5>b8CX&u$qODN`1q_3_$;^86M=W&)*Rxv z7ogK8Qv`J7A85Z;m_i?9JA8I?QM`MXl)x10DK4;53B)Y7d8(7BWDq4YE4XT8Br}8K zfO#eNM>&O*Ri+R0i)}%hwnnAeZ^ZQU+Qr5qmOh{P|g`TAs@+Bd+Re z={=QF&ji>HsEN4p=ys4`uShZ|I}a@{*VpE8N{@`-yUFCYC~Dr$KeZBprj z*C>Af!Z+d5RJFyywldzBqSERnU5=y2>1jZDSA8jz-ZdV%Nc$M|m%#s6zY)jPuwn!? zh*yMWLVFmkcNX!=Z|QjMuiPVwD1+JXpW6n#2N2ZX|#1+qM0nn{55M42^r$3J+k zt8ed^3Q1>nK6zY;q~{+X+?<+J7p>OBv4cC-z&?RG0tNgR%@fB8C&}Cj6`n0@u0svM za%NH`Lj!ZPpe?J7(Y9!o<9_W!DoL}KDy<_Sk z`ec<*&096Mo31;4g6(>sbIFOE%xVb6cnVRC+qMD_t(Vw3##;<(KfpYhnYq3;MW2(zvKRsWq>#AD;qxJ?%hoqG zM29vT5Z(L8<(>&se?|r(Yj2lm?gq85 z)l+`j zXec4`0CT39NF~?^>yY6$K5IKy7qt~)VzDA+tZ@gz6nbgu|DsWJXG&yzyJ5b{k|r61nVDD`*M?EWLvO=wfXj0fWJ-4#J(>U#QAof`3pKo=F1LD9TF(&3m36#C)A0Puyf?!Jbk@j zh*^TE&u%=i4iCaS^encEm%sbtaS`07qf$g7X9ijUA-Ttf{ziRy+l_Y3vD#R; z(LoLP8=D&7MjNh3{&m|Cyl}ob^Z0bDLu33cTrVpqv(5T1~jSsOk^Wep>DOQJ2$7SI}i}v1x7V@TG!0bl>2!Y0e z(tKEFVbPw8iOcarYdI-maVQ-A;hRTrUrOHZMVSN3kM1F&01mEVIP9xpgs)xyvAKDYL1C@jk7DXXQ^T@6N;41mUd16u2`tKgzrVQXG&z%hXW1f zAmWq`?c+pc%Qw%*?t18=`Ih(jVD{HQD01gtQ-1;j!zWQKH&5+G=)GqPWR3@OiT01t ze5`yO?v4B8?x2*37s4RsF*DIE)TIvShh@gEN>23Bsr3i8jy#-pDJ#4_}Or-)`))O_PYv1C;42 z*6Qz@^k?V~z|edK&3{2tM*9C1nldr4|G#M3r7;up@oQxH&+VhV^cNc4Xg*&DpY6tU z^(lTjQI`|khNNx}0kK33iVgt{?fj-mf)|YMI6pY zqR02DriZ37rjO=FTSiZ{>uso3v;D`Ie!80F)Zypm=w@O@wm52qw~N;IGg3!S^8i)f z-B;->?{|a7z31xyCV>8|bbKjSmO{Y80@pN^#)lJVJH+n$7bt#hNkhyT#nibo)NrXE$5g_153@ ztV^;dZad>a-1cnf3W#$L%0@y~fiYX?BJSo1q{B+H)mIU3YB-hV%)>h?dCqooGRcGu zM`GcHU}~O74e=@J40e0{^w)twd*nwnbyBLF5L`e#kU>yRGJ~FZz;M6deNsPP&$dZ- zYfkI5j$~I^Pmi^03}x+Ly|qR)J~*%WHOC!aSl55rZd|>vzD@E z&=k^gV?p#{TsfD)?BIO};;_NgH=oiZTe!kQmTGiAthtu61ti@^#y&l5aew^JEF;Sj z)q-H%7W_d}+}eDz-D86)h44#Pue(T71LQIX_9tz=ZqB!}$W zuX4_DcX#B@&1*%he%7!aIbMr194fWIQ$3iH2 z6~`@kzCBkBD`zIkPNPneDR^g%VD48_B?zIQ&)elK_(G@eJ<_wI)lMK)I%(@} zpI*YGB)o%2(k3Kplks6vCv&nNtXkha#%i!(sU6k5-mQf!fO_<8n|}o5_O};TtT`=E ztHYcFX+g4H1|OkFaUgHr>f1S$14|*mu3(+`E`Neq`i+tn%I?HKx>5XlShB% zc^pqiMZ^LHW)vC7!7GDJi~NWWAs9?FmL}zQa%d0JrUn5nbMJw+qXY~WL&p3xq|~}z zr23rge*m~In*+ovB_V`>9fNRVF??Q)gmheQ^S{ax(nSk3jZys{H%LC6;%=@2wM!)t zAyJ`xWX^g~>^mINCe_pGG8u`1^6647MPJL!@!x1p5ZH_9($~V;kPOS>NSJr3TL{%h z<-&9_OoG-W1%*^4lVFlFX2&uRvPCc>EiLr9qv&7L5=O=gag4EN7K$!^Lgn>vFh`a>L z7YBLCRmw{ON|w5}D(&Q?MuW&%{*@}*PE-V)s$LE78x(Rn^BmS_=r)%@0kWyOVJSTo zU>{GqpcUh1EP-(Dro8cQw%agnN-#}WYT8FWGmn1$p%;V4)f|Psl^LKpt0>BeHkt8j z-?~^>*S@s^*E2xV1eJ=r)o4Ea5zKIsIJQFHw1vH0fW|IF1Y0_G(oO&V8!b|a*5@WF zF+1YWo66v793t^RfvgP-Gamn7B!?^a*awn%Ja`FBz5N19(`R5LEgBakVVJSlFB$70 zYpz>NO7)E2BzA}me6_}!83$uV?gnGW9z{M`xgR7CNlFh0i#wn1@=d=ZPoqnZiABo) zb94sV?34xQH6{9S`FEj>&7L5p)XG}z?m`iqCQq5bot*?=`NawZCB3c;s7@P&3|Y|5 zaCQA)MQ={70(&FvIX!;Bu_VA&P(~DDgj)_?zs*Y-YoNxCTu<-SLjG~ z3)aQlit<;rMZgBn(&5jCr%Xi{Ikj!;)RrX3>n@s10igN)zN9j6wB7f8f^h-&e zrPO}CxH-0JW)wdSH@c^l4aeQdX-t*0bhUIX7E=m4US<>y6E_0C&m*=7b zV#~(}Msv%&wEoH?<^Cx~v%4IpEJ0`T^8Pg^Fb#6sEn*2_Qm{pBVG)_h82ZgoZEm9 zVc5VC*R62eTtV31*@~k0exqXQ;kv_!vmI=mCe|h*U-Qo1pq#C$?I1QmxBd zZDW}mLCG^u>`2P`W+ou56(_mz>V*YW8G;L+Bo9yJ5H=EOT=>n0HOsG2{G z-+{cov4xF$cED`y)~{1hXX^-b#*G<3X!!LmS0^8R{e6dJ(3nlDawNH}~*%^Q+?{3OWRZ;|DVwbT-WG zt|#!+u4DMDSfL|4_U6LJb$O(t$Du`v zt2hf5SU&$`PuIO*^fI;vepme!q<%J5^Lc25*Cg&yDe#Z^qj;jxIH7pDjX?dijp{{1U6^Jf;%50BSR za}@_@$ER(ZpZ3!+T93`yOKqgRO%wmZ%@5U&nh$%n@#ptM?9mMG8Avm;4MGa8XEydC zqzpB0&d+Cnp42A_Ya!nSE75vFhya3IW$b z=r6%NxdToyw%a-5x1@d2d4q+~rgo#i%obC>s^*l%)Uy%1Kw2A}Wd})gDW$N)Zath- zJRrJeSnxP6AJ+0_bg8KF`u?Y*V>tozcp?eA+Dq{XjKSLdWr-G*N);<# z>`1=#V&|;tlBO7`Vlj6Gu1fX{$iEtU!h)A5$m;7mmF+uaZ5oEfP&$(-&+FpU<;DfX zPBtbg*82{1`q9&QJm1fNzN+xrVm~*JUljc?A`xSp)g*#e8xM8X%hs9CXB#$|@~2p@ zMU5o2OPUt5_+MhVY3*3Op>z3(hc+87u`7`fZ5KK1=$8dRuI@Yu^rehDa$)!4ltE~a zh2}CEeT^!Httg}f#5PUNwi8SMRkn<3%YcTz|4i-ajodcMECtH8n!V`~J2KcAQa7q} z&rqiABb$j+ru8%tnraF_U7JRJR2De_)Je+{BJeJ>*iP@dcW#NQKom&@TzbYisjt4Nd4ebJdwFk&QZZ8K1Uxx*gSe3czN$c57XZyWYpW zc~_WDH+|}VRWMm!7b6`9sCVNk=*$BLJTx78xUAI)z`~7n7j(HCvhrCEabHBS6cx^~ z72d~o2|Fj06T8Os&9FMu#N6kaT514Lj-a>6<+Te0KuUASTqUig)Q`AsUY ztYiT|_-BWs$i--ys5uqDkpoz;_5H)?(Sy}9&WU44Qi+79eCeJ~d#TG3Qwwq(JMEq_ zSQA_~P!)V5!U>V1sg9jPcf9485?eyp$oawbymyx%umBj%(-}PkRIG(ymqdC`fq!fW z8M0tS4-m*h5x^D_XPIUf{RMrP?BE{`&W4v zZ!YZ40kpROZvx)Gn4(H00*IaHeJNUZyX4n}aRieGXg#)_DN(c(MJYT<*K+E)Ls6G? zxH3)?K0y-ktq-r!#qq%cu8$gosOz4)Si`Nvag7axU!4cpMtyXMAP-n*7TbFpCX!t2cTm5f6Ta7@r9p>BBg z_VBAGQ8jM@C;KnDFHW@X#Y$Rb2$yiW*zIi&2&NJ$V}sD}sR?_1ko@#Q1W<}#I#Bf# z!wC~r8^jh3T4r&Bs6ZQI0yerJzh1D>P;qLtTLn7Z!pQuaax|ZYhXqIV)#DekwQRud ztdLYuV=U(f|K^&jeQC)U?cI(v5wD2Cx)EXg2T^4<=_LCYr(3)J&*_V8Zm#-tzBi`8 z8b~WA@ju&By6XoFV$cSWgW*lq`3k|sLJfxV6M~hbt2L6xpQ|i(OIme3X+;N#l5W!U zs4w80{-=?C&Vj>Ulx z^+T_8nt%77r9q5tqT@ein#Y+-6dKRQv0hf;D3%{AqYOKlf4~aFty$G05}JeOUE7#P z2E+JCme`kL$R?BLln@Zg_rv`Ia=Zus4cI5jM#icmzl0Yr>$n>l$1}xTCjeC}^Ic(j zqxX$JK7zS|{VL5T-sh?d=9L3P&E^JBkGU?HLE>>!NVG(FoFLs!2dQ z*##RFN)I9F^wND+-6f$_iSi7wn`o$2QZ*jY@{pw=+^>@-Fj=WIP6b{f_`Mr`&#j+U z2QPanPmi4y*`${c~vEo9#m!CjE`oE)0|7}~j(|sfY04F5_vy~&UOMNACRC5DD##InHp^@2^%_Dl@St|z zTlV-++P{F6`r{VXdi5C!X71&w$vioOGAk($nP0YX^CdlI!|99W%vqBxMbnL?%dc7x zksyrWc@Y;NoCbcdr~ViW;4#E#QY6gVbDw#f0YUm0a9X$mPi&QviseZ_X}Xr${rQ3#h{_ zM5~r;E2^Hb0)@e2+yG|U5co`@a8W>@Xh0@BR+ofX{?~n;*Hz`Zp6?S41$)F#A2VIM zk+vLcFXbGGBMC!tB~rgy8jyWRR;XVuzdBxoEn&@%3U&{;8VVEJLxgL6`6s#Xdr=_@ z03G4=Fb!caht*#KVAM6>L*CBZ98;XCIx2^j9pc{_Dsl;Q7Jv78vY`2-%d<=ZiY@86 zo~3l}QR_Fhz~8^0>H}rd;u34#Nh=jJfy;DqFz0P|F^Rerlrn zF@@|t#kRQ4-c=vfk}}^Sj|pg|bx=}AG8k{SEF(R(ch1Y+qiMk{Fv*yf@&IKB(>aN! zg+}u-L2;<4h|Y6Ty~1J2^`qH7-cHz(J{N8h&#hVY8)rKzk?;hp-ASpCR@4h^<7^Qr zjLZ1h(#KM0gQZ%DUe=ps!8sg98&<^UTo)~E`C>(5>JYkp4TY%f*kC19zKYm|FEJ1t zgz_@U*GkcSubU26lZ>KveB^?5Up>P^oGz$6AJ{yZ&iSa6;1WiM!&L{>e2^97^q&;S z>V29f4sB{I*{xCwwQRbe8*o8i4P|~sg$kL+s_GhRm#)UAs*D`vJiE=cxl*p9NW}EY zbq{8jfFhW;)UZTyYfGTfkRt^mvp&{Vhxs7(l(VKHcjw3aj4Tj}+DD>U*0-GxKezm# zC`97SlH_wMHgA)*6Rbj~5C*=KI79 zae;{{CKIvnF0wD-J@iN_@l5N^S&If{w8VD0FMAUgPoj9f)4dHv%T`p*Nw<`#3UqdU z4ii=5mTZo`yH6o1a{t*Jfc(sYbj6)hKFPgEtO4u7i`N2N{@$k{?TFxJ1NbK`_mjg{ zpF$m+b^2INbfDr0q*1&6?6azq)6N&O;^DjrD8q2XNqXr{Jq1cksqe_ptS+};*$aT7 zbch;r(>LRMK3ZY~J-wgnJY|hEb65V|DzfL87JGphdgyEncH%jbFFo?Af9z*=$LG_3 z-zEH#T$`+QAS26E?XEXENYxi*EG2Ynk4W<>VOT3!O;Yn)INGXq%Ps6QSd&`5vu3HX zc1EQP!E=2Spt!r%n?>S$RHaFGjz3?qHzHLx+WozznpwKYrKc)+bt+Ms-xx432Fa@CPT%A6X1@cy z7_99XGKi;AxXj7<(uW3?mLyU>Q3Y%JYA%=V&s`7L4v-}%xq7GMdc~;m#l7ya?k_rR z{;?+gk5U>+p#Mgf^`gseZuaKK>Sxu*y?xy4XX51fBzLmpKT7GVhdC8h4YJynnGIfE zrAAa5=@&bmv!dN{&n)iE0IteU#^Hya-+8n%;Hp#biPX03y)v_Vu~r+qxgYs#L7m=3 z6mPDNwA|HC#B2HDj?j)02+-UiyBVk^^_t1iLWA7!LVq&!V#X%-YeHSqL|*&+;$=zG zU#Ili5wTat_xHo?LytPEgc=I6;xj_#4jMa33LbuqSjN+!cd4f|blS_}DBHKkPL{1g3w&yf4x4K<9C}TtaYGbw* z^4Lbd?CK4LR-*(@zjn%pkLbP$zB+;cN>CDsn7MKjm=Sv<0euJE5^ToZUKdyLeL_*E z_62R_L&ibvr;fzQh2q2LP7o;qjcV>Oy?YguaZrP?HpoquMy>8~maK?RQaHIG2h%vv;e1>FAij)yfq%DmWb249&RSLfWL2ZFTN7T(j;*l#N z`8mJO0p{}bIA1xYLch-UujX2WQBtfTC!98-&~uldd>?PghrGP<=5KmK1XJpFvsY_?UNNB8zOKJw8BWlukTh9&S=^#eT%_1t0{h#qAgF?AYV+}OX zbcmurI*gTt6&u%Nbd$|^h@@8}Jq^64u4rwKoG|PbGd%stb{d4N$&uM?bw-CR{BQOk z3W@5MMovp(Hk5Xls%$~C2*R-eRLkn3$a!i$1kgp^tgRGKA;lzcRq_DXoK&3>DDReD zr=Y9bAuIc4_~-B3TD*QxBTIr+mw22VWUSByJw0eFJ*m1?ySlnM#9*RUmE>rc=6AtVEMWm-y#7@~^_H0vL>DLO zC`5X%hdM@T}#HUGvf?#CCELiyj;I@ExN*m(o zs(;E-{($QX4B_AHo(T_!lQwEF7w&TS3%0mw!^Fw)WuJFMte3X#tNatHK_v&rsBm*U zJCR(XR@bViu=9Qf(lspi8j(Z6Hx2d3K%MHoYy*v#)}{+pR~r&u5lB%GFbL){B95tV*QKT2EKKetaEi*)=5%(k#Ed;pg0jw=z^c36JgH`nf#dQpX^(lo^yddID1g;?izSbp2;jb zRa%1G`ALS#8$6_uD5B&)@gt#=z;Z2EYpQ__lra&KR0_+aSH-L#RN7MZ8wO74RTiNx zpQ_HO&=yuB%9Ly$Xb$LGC%>Vb>gP6qaXPq*Zv(@@*c^^Zd3|)!PPse!x1MSbh|a%bHP_w@s&jlrJsRh#wvDTiDlw%*R)<~* zoTC<19ls899L+o^KRR+nAkzX&GJX3gtZS9qFP7#hqx`n~;-dSqNxykU+n?=&c`Xu` zMl$C!pN)KDCMbdXoYKf5K>kp5gnR<{kK- zWb8l!@*Xur(5nme(E6j~`Y*ZAp3Jd6;fj!NNQVo27NZ(3Gm743b5(hVINALN38 z&2%Gk5bKrzlGRq++KgrGWM;LyP3x+>Ts~YA+VL*`P!ll@ zg6<;=X54hbl7#+^D4}iJ#@orM9n$V5L*pt6It!avN^~O|9_v3XtyBzHNuaux`FvPW z)3kPljZ?&EVyC}@;%x{ql0bZUd6Fq~lGQD->kqVJzYPOK9ta^Vc>i&C8zKFQ~L zECcEd@|S~#8B_&Sz&OyOQRzX+qtqw_dj>$|ow@{m0M%G_JCK35i26R2kvjFmkZjT1 ziX7*G1g=9d`e$X#%yRKsI^EAZNRjjkz*k03a2Bg@o~;`C2k@y-Xwm&Sxh);ZReO1h zd(tXhMDAn`xVJB{h`X+O;COSLSi7XVkjeG7gdt*il>7V4@DV!i{rMiJpHZG2Jd+;g z!DRNCW=c(MoBK#i2LS6#6N<22IGK^cxNg*YpFpkNhwR?ae3P4^|B#|BYjY8XO8*?t z)ylrhPF8Qf5_2+Ki88Y&ha&@=1d_9anT@+$V{Xl5WzW;z8OBmjxw6hI@o+qdJZ~OA zE~50XdyGuiOPtdUJ<Y!@OQlhVi2bW8O6pUGgD(sAVQTCm= zhfeq+C;oXN*9UAqO^5lvpeED*E@)+DVEBI@%d0ioYN-BiK}XQlo|Nvi*N>Pl{W22+ z)-9ioh7rIls+c>MP5O8&lu?ePH?i0cR4RUd-P2_*7LGsIvR? z==?K-QPA|d-~}@wPTJdY-R9OAW; zH^b$ArZyz?{^_L_H*|zoj3ti>_%z57urMGx+wE|Q>~~ErARwqZT15ovo8$-tBlf{f zHQzZWf4=3 zOgOod`U4^rET}T%kWeRIi#E2im03(40|}7f0TOP=r zQr3>r_OA~sW3-X`9}kEE&H|!0OmOBi5y8d$+}Gh$-S2a}tyW z5GyzpBZh|bRRi3y2jIpjhHMZI#Zc0|gil3NXrn(G8baz`bzF`$g-E@mVvvnPm8$E+ zpeZIr?pj4xqm%B5GJX{sJ&n!F5IJFi;oJfNHJ!pyG=wgVL!0Rt&FYS%ICwmV)+zt= znP`r>^XKs`RYpEmFNpb9YtjAN|yjWS%& zTN3q`QSPl;3f3Ex0kS(?A-~G$07kCej;6M%dJXu(bol9NKi?c@ay_dF>Z7B1;R;sJ z0E*uLSScK-;BC0xDZ%Ps!7x0zUmXRmmz^wUCRnvAP_fhjps>{oPK%P=_$7(qW{*pn zj+*v0FFr6nun)D73!M8$+v?LwTK>&%*lY#D&YoLtoM*rD98Z5leMu0vCUhI!s0_@z zsM-by*i%}cFAEi+yr}$(MS)=mAu(Jd_19ql4z|rdDOW3YP z+nThwB})d_hs(xIB70Gr3FYLfdu0_f=d>qqv4s`czNM#6FdxixUA`SR-3Cx;I$@Lu zVZT~*&<^3l8yyueiq8D!MJE<2;ymC=e*jtF4uv4|_zS()%s<{;0kmT*{!3#RjVDLT zorSiLEZ?J7S)bHPI!1Zx=_$&~A|e|+#megFq73zNxXfKV@knhfJw+)EyL&;YDSEcR z>=SjowTy_->%HD+7b`kcVAZ>$p+jb>Pg&Skl&h6yKWg(>7n@M`Wv}`nl4D#!Jr^w6 z#(uHevrs#I+VG8;SdL~aH@!_-%J&+N*@RK%BqnQYjI)eS4{RD6FFP~Ke5c9;@@0CY zB;oPqaWq}ZYnmFcGac<(O8Rc~n`L+F!tUNnfTBQTsv$=}Oc zQ7U>tO4Chw6^4Hbt5cs&CkG8xG~9RvD>N<&MyjWX<6}|?Nh0Sj>a79lhEWT(`zV(~ zl}1TJm!jv6@-6M8^2MhTBz9_JT$5j-(+@m*;3quAQ`~Jjf-Cga+lw$BPh>*7vpyiN zC3T!iwXf>qw+Axr=9!Y>n5LY`I&byTn`MNnCG6Cs?%6;!Vu`klDnCfu%EH?!wWENd z1@+>s5QLU1#I30K&FtAA)7vzN&|dEH#PIJL>1-V7teKbB%{&!Z)`z<a1`vNWAXaqWqV1e&bCQ*fv=&@7x#i#H50h6*h)WW{4EP$fC_2w671Ioy-xUOMlY{6ec8 z`Ll;whU&!2C9x3c@5nf474_WeoVky$48i_;C0)Y|1qXHbE~=50H8R(2H{PNVpo8!r z+7dv#HThAaA=q4#IFNP?(|1k?#z}*{zQ3Z0c9UikSwhx3`$SqfjaGYHLmIckSQyH zmMHA@*6rs~<`qPmSG#h0C_5T5x24S2Gk1wv#-%`E$2w=o-z+frX7|0+DlsDZ(1xQv zI_e|dZJ6Zj6EMGmfRvj$SPJ%*nB7-kuNCQSzCK+TSSoV*v9vJ*|t zn10)WIdnV#DD+Me>Mag#Nb`NZVMfG>QB;P%pDEftne`$=+5O^NoBE3`nn+-F*ukDC z!&tg_N3IShR(yHl*lCZVaY+J6eA8Wu=2gLfx8_?fY}Wq0W}sLyReO)@CX}#l3alw7 z%grhxvYEk)@@-QeHAT~C9=KW}ja>JNvxtVjdr?t7&ar|cBaV|2>_uIpjxfsQWmfCE z248Yw%w(5LeM;A%&RlsEU6JpjdDv>NllJfT{C#lK-wbDY3dQfNf@J7)az%ZTw(R{p z^Yu|ARfH#!ky2=5X!*&Sn+6nJvD4zMlfrj2Umik3@rsV%vP^4jUoA_ebO{D!2_y+q za+i3Xj6Ocm@$YN6^Jd=?S4a;P#z)_BRoyPJk>_j!x-{HLW^thmy|1}>pYILb+ThuQ z{|1QvyDXB4^?ww7vVXHkrZ$-0Eb<9ZaoPL#-v@dXicRxl1{%zp)>fY49Sa+{~a4xNLZ?S%} zlM*+N8F{kve_B2s62>2&3$aJBzITz#mdr~uygJ$K&Xv+OZ+EXFrPTP1u?MEzUjJ$N zcxfwm8adY8HY82(`hGgwH-+y@5XyQg4k`}~j6b_K!uirZC;0oJMU-nP_{aZAyi&LF zE_rt9>^o2!lf_$f6Ox^Eji9L?5UIta;DB*1$(+E4%& zMy9sTm4nBPJEDW@1~@}7>Kg{VM0+@?v;>WS5sngYHgxSDC)Tpi@g~}~V=;H&eifkF z^=OTiM)iyIow;+J%Y_B&Mh%0>KT%I+ubm?HRT|P^GR9F+blD%goDr%!IvVIBGNOr2 ziN+yQlajR3Im%q)Gxthw5b)#(+s#se1H=NpU`XFTCtM6lG9+%@h1(5)xNfgQC~tX^lakI&B17v8L^P8U zx;v)^1MA=Kau^Gt(-|^3WP!j8P`?WB=vde<9?k#_ctR| zbSLKLi=$}>5+K_Mu%0n^*@Kn+nLwWHc&a16O9n-E9~T>KuquK=mQGKY8hZBDF4F zdAyVdT8TaY(O15D8$EHHfp0ICTZ}w*|k_fdgm#v8m7K9+t z2ZF24(rCAr?vhB2_2IF#G)VUkv;lJo3YJyq6d*Di7@b$}M#AIPLVdDlVdQjUep$m=^&|ySM&*pu9`TUwCj^Saq9|vJBT9HodGu*w48b#o-73b=A$iM<5e5P zR70moL&D0d*D+;E^nt8<#EQgbEVAXNT)u;N3Y~PF{kiuaMisURxq>{Xy z`rbSruusC5agihFpz`ONy^DWTl1x!kHkTT%sH5=&Abf_2c z@nI}@F(X(2=9<(d^uOU9MfHLk?11INNfHT_8Sc*IY`pwo(F^Z^m#{C3mz5}Mdt?X| z7Uxu7PA6K5Kc82rXD7aSgDsY30HRB;xHL)3EwqJ`H-e7EJufev>yQ(QI@)!YSKS1( zJWYiPm%<)WS%`mA=d=U_`#P!HtqZ*F4yog{5VUWfwZ&J^4YGiz?5CvrG~{qN;1^~5 zsjGMvo4fs!&$&j<*|}u&9SY0TR4kD$42;TQC5DJTwcC(R{rcw;l@nhTSGkcojAz!l zrQ0BswAgcZn1XJvi6H73fgvRIRc&xIyty0Sc{uR5D!$a#0Z*||mrPf*T8`x8p1=eE zJ$IBCGWRo_BmXenBd8FDZ82Y>6iYtIf7@S@bNoQ{30`(PuESOnQR0$}nb>$%l~qLI zHz^%21Q(DzXiUhYn&+j@;-gCZ%%74?TZc+d2w@FS5$T%6YSO}(7@Ne3k&D}nZf_+N zoqIDCbt#!#zvS)<0U)ROLYr4IZ6;i{82oF_!RVY=&mV1Q_cg>Y&^`^Q4WTB(MzCC} z=@v!;pJIQhIs3tV@ou!dR}K}#;JCiMrnia=ue7#!zg=Q_#~xU&#XIGOR*IbAEKmn- z5ud$;_3!op^as^knM{T!Z!F0_yjPMAF@vS}YU_ia;@qS+k*#I7=uKtuh9L0k#&_SH z6CF}UT5|>SSI3nJcKLZiyx4r^DquIiK@99F2v0~Fv^SWIxPNP%5mhQ7sQU#dF>%z# z)P9B6ybSR6FQ8~J+VOK@iXZ~qopubFhHp<($<4JJIb7S|ntOgpydy8AH~3gm+Is ztMxDgSLwIja5)cIx1Ozqk2-rM*!-m&rH`x(M;pU^?%2I5UbFm*gB_-c z^kC_RED`RP+kWSNcO=UtwuSYF%zxnRv`&Xm=FR|kX8?ZwVdD;BwdICBnWYni;&uDq zlqpno(bT**&FO1qq#)-!Lq2AB910*p9X8U4I!S14emrr{A?QADgpVxfaTX<+g%Lh? zi+eW87+&ANtL(b0)XW3~@QP~1M?r8vFIQ9oPXSkUNMF6R*{;QCbKhwX@f**m8|J*A zsu?rw1fGsfc*w+cf)yloTQtAtAXhnhDB3e;cC*c92(dg}qHx zVp^wD?2TiEw3&3;I)2+n`aoj2V9}Hc+H{BsFKkpfZ<4WjldjF2Hhh0czLy6RltUY~ zb9(F`zEO9Tx%LAE$g@rUMV{ptTn!8Xi_S^ymw)?0Zo2G9Fu`KGLVHbmJBi%e+J84L z6B?m)&MYu9gU=0O%Z6~i63|zNTH0A`vkhU<%^c$V7`_)}HMGsP|2%*csa0VJyJKHwXdIMh{S@8?*{E8B#{tmaEP5An`O_vg7Tf8_3!R4uh#L; zpVHc^SYP_g1cI@m=2}-xZS(xj?O$j3Ykon~?ddyi4O%vGWBbd}fNq>>GOuCh_rpbP zri@=i%s;N_r<$k;lGvaV2wCsgbIg0d5S7Qfb3>cDHl*)D30k2>JU|(vMC2P z!q^CJ6AT!>KCmoQf$d!mGUQGcb3y=pOK@jzGp2TVr4 z`iStY0rBm+BbDU@pd@oxI?8a#)&B34F#*rsv%;Q@(mlfV&eM;wUuM{0Hh4Vvf2NE{ zVzWYO#cXFnla|HYWvgw`%ky^J$)!gPcekoNvI3Qvp3+#KA9a#*UYdO{G(D+830u-M zy?tM9x=S0_cwf{eUMwH5OkQ3bVxcvI)*=-1y@CaXi4p)RC}|rdligs_+7W2{#)FOA zdDaymKC+Lo;AdS4q<8tM$IKpLYMTRU3>nY1y;(-D;EeP|2zaxB2@mc)3Dxnbe+}V; z0RG0wD9zW<0{+Vr5VTW#1kQ=^bIT5m4O}Qb#+a4$LScCTSf{jU#U{L!@Uk4cMRKT% zqZoVqbv$N$p5-9?e(cv8|414I$kMZh)KeJGqN>jQA2F56ARC#Pq8K;rLt=GHjaYW0 zntK$>ActZ3I%2d=sHy2BhQZ1u-LFvDn08M~^jx*$Em89w; zOy7vlfL&2`?^IK(>j;?z5#h|XI0y>eTr0d4wjW$d;cueBjfPq+-U8XPO@_yjdDW=h zAPf=Nr??6-BTbZ2lBJ(x#5`91XhDLk7JT314y4lx4 zDGc)Chr~93^((p~-I9D10D0)^+B_QX@>6wCV11dlmsg&zUuv*t35*J-{>QH@q>*4% zMO^`vJ+5w8b-1_zK@CBPP@R}SK8tshQeCj@CBUvLv-3e$KWI}LHf8)aJS$~P=MLD+ z14+*{XL1%3i9aTIW7=29Tv_B=BPR(3Pv7ra;4w>%8sw6>rLjBP?$G-Na;eLyk`f@~DnkbjQPDrU%O+Ppyb2u`AQJ5aG_a^6yW{olv@1b z+3Ggb8E-|1&hYb}j+^nhP1{1=A(ld}=(-)8l_vkyiDUmS11$_Z51*)0&$xEfMvO%u z#gyXAO>jx($ab=@-LJob2zY_i)_y_`N<&ldKE+L9eek+P?c;xxF*wbHGo{7N=SJr> zC?JhOuA4}Ulo5drL__78V-qmy3&zY>ox^qgX&A75=4;eHW;ODcHS(3!l0b(wL{t6n z-wPfCMD=$f`X~ZsJfj5^o*e8n(IsjxZO^LBL+_lUM?w#+e{CfwWUmv*v_lbgS^xqV zz#XQOhb#2*am;(I+SZiq=>mfiw6N%pAS|TNKC;Sj*rk?Q?R8CST$X>xK#n+Zh9n$c z6&H$Dg6FfoLlf7TQ~7mz0SU9631Qfbu=X=v55?DAXrL_wsA?29?|T%RTbbTl2J4qPOL9?I(<}$7SAqEQkfBT<)bIxmPT8|EYaoHH7-qGr7YV*S&~fUwU4pj?VW3{b;KLgdWx#gl|#VTC)@a^mTz0Fp_Cujb!6B zC-5pe==#0p{eWwqk6BjM8N#WGZ<;EJrv|B(0tX79r(pMZMvVMLTjG}&wLJ55cp8+T zSka4OHv;awEqh5$DX3E7QKE#?G)qc3`k*5{9C;Jvp35i@Ytig;>;8_jA+k9;$N!Vi zRpw_(d`SSnU8I3bNoxX5#>hIUHkMa#lo)F}O`Z-X?CaQmYCCPLXyU%U>c2abfFZ{r z{&H<`*UPhy!TU&FBHBq3OWESJ#elmN{%FRGb|W#h@%RS z{QXjx3G?4!4rPNAd{i#^0P?Et20^Q6Q3mwLlMi6|J!c5bTB#}euE@FJ z6C@Pfho?i~q<1B+o=Q@rInC_XE(X&AYr1XoSilb=bh4sF87a8IJ@61c)JVCkZ;+Tl=B~sm?j_Rl<&8o&peTFDf|0_EwD!8!a+GE#R*W% zL8_c~GX}Q5Q!*~1`V=U`Z+~6|5qkbjS<>N{yK4vU_;Pwv-XS(3E8InfSDy*K8EBJ& z|4B*k?*+^?I6yGt{n_g={{!&foZrlh|0_UbVEG>l%~QYK9L5%e-)_zaV5quID6mf% z_%6EG$)OWJq&Q_;I8?{jh3RPeo^fg=;g3DSUvSEJEr;XGk6Wr98V~h5Sz0|*aPgtW zP2WC$+`ET|y|;@3s|cUBnfv^%dP=H1mCvt-U4(t?m^KJKz$KdM-OcK(_?lYc0g1<6-22dL!;J6pQr2L7WI`g3!3^$H&X_i30e| zL#S#NRv~;^Qvk2|odE0RKl$e~OmZ>itZfPw1LfcDs(uP%iD23!Z_%zQZNKS&@NP!b z!*Zu`G3+V8SsW)ho4?)47w?AQw(>CjYWnf_9g9z%)WbIX53}cK=-@Bfw^n{ff;pmR zMm_Ac3BNsRD&b!HZl<;2RR%5|);~MB?VY|-dS*$sYGr6B{rT6B0#IFY%t96 ziYm{G%TquB%uDS1GX zs1%)xZ=T5;j?iu$J;w}u#8(U{3K#nt>`gA0d(?y-OZEPdJVtr=S=yup zE!!{b3{B@GJBV%ne~i6TlOTW+q}!UdZQHhO+qP}nn6_=(wr$(CcJ|(vJrU>O{D_Lk zs?5soMxX&$o;H10W9myuYAaGe(g)uCjls!seZ8w?$SJ5vVj%V% zXwZdCkaBHnmYW4iiB2O5L(2*FSk&`dLVHf9e*F{^Smz`6dwQCrUip(lsJaFcv9wE0 zExS!HIQ~sOXGU~Fke6jlTjFB&LO|B3;dCi za@lUj6umo-Pskz_6`j1QF@Fd+o%dAC0$ChHnuK4|^JV(;sql2W>9>;0ieD2aUP`3j z7?5Sa0-ULawt)4f$;MMFYS^~R1&F_~CEl*h+Xhj~d{+vVW?;^#Y27O)NKG`dNGwxp z_#dG>YWz311ghAHyaV*5q*(3wTsFs3qX_+I6^iF^rno69c8LO(65AbPnnqmtWQHi# ze)7Hn|D~rM3->K2i$8I}cuO1C5xFrvd{@Kce~%{Y<+uqMAXz(=+`H)_XQD>C{-_qt z6`zU($~myV!$-)agVuTFZb)fo_AwSIc=^^;IfUi;8j(&9|2ouV!-$pu+%%9vsT5$HeUG#P&nfz_87AIdtY>;dN(W-(buUTQE18)B9m5VR1_K8GaU{3GEA zc}X1sEg_nISzzv_q4%|t^f*l4G0`07Yhrt(J2BfZM>2vh-kC?%fjZ)BPGYT>v0yIa z^qdtfRL)vQiy`YmzA6Yq(n5`D^tV2rELg>jt zX46bnHdP~WP1e(FxphF zcQWwp8sI(AP_MD z3{BCB4!bj4*a$16M(I}cl)*8nk0u>S(#?glSJ_l$NdL@0N%E?fPMeX*n`y1vPUiB} zthU^1O{w;Q4>V=J#jgW>VFEsEYHXpSLUn=7`wyiHnrs*q1yQS%2Qjwh!2vXL=e7cLZyrP?>xj|+Uck5-YfD{$Ylo#|ukhQ#YR3mI` zlK;2tuNP{an+$+gMRF}9>696=*7#dUM02P{v!nVS=#8C_b@n#s!{Czyy5SwZZ=pPNBa390ETC; zmYIrkxbhqa1Hk!;LN9oW*3IZXQ|pD zi2QB9t4r3r4geJ={F>b9;q)HCN8q$H9ly*nr&HaI=R*7Qzla2bRnFbJH(TZFii)V^ zv&yMlB^}dqu;?pA0>Un-LX~+HgWj^Su#{dBhEvrzG|02?pt1gs7c_dd|H#x~a>PBiRnOMm;h_(Akm&Cb@;ChZT`qxA?3&y(j@l;m<0BN2 z{9F6aq(gVNo+KpM3EO$vEGljPI;Y5>2(41g!R<{6$enney!qKIvX=GzxPAJkjhwOy zGA2K3lb{6NjnBXN7WqnZey2Ef5I{U*22?Mxrk@!u&S71tkLw<*wdh{a(E%A@*^>X$qo3HZu zV(R*Vt(zY^FA1{aZB(2k!o$Ty18qRzQ)W+ETm5C3^2>A(V*Tq9Xjk9?h%Cb}y%AS^^R=gf7jWh#XirA#1|cQDPWftBk;F zw+)Jq>N;|iB7pHyDy$xt1G+Xj$Hoa=ysSj$qgr(2j)EPzVx&+k;tNG(Zyp7bhPA-* zq{0$93cCg!%Xb#2B{<;CRxKy0kZKm^OYpnr8H)Y3k8bWOTVv_Hez4Db0Q8FrcjvO2 z?wl9ancfn5KV@(%I`YICYR{%1-(UJZ=fF8;ewrxTlJrU|E$fM-C@mpD*^j>MIvIc@ zvv5gbUlk{2t97yvfI0nq=3hmYNBOP44KyEN9e$LJDrxDwzojF{7R127wLv0~g_`e9 z|5^C*yT>L!=DFW(d5#7IL5fc)-9`ocI7#j}QpC$HEX$J@r4~olfi}{@j`G!cR zsGeCdRGcoz7Of_t*Gm{KT_02U?3PUEy-|WQeBz|>Q~r-S+h>@3Gey9bTTG&tdV^dW z>ue>cqFs@8E2n?m^Gd*EglC$kr3BAsnG12Z*FrbLTea3fERZ*D2ONfW1klK+DD3$Q zfxGq@%zh-Y;Izx`D)AB^G7|IS&Q(+10AIO^*j zZf2$+#6@P_l!}bdzKpPdHWX-`>>0La9rEl!>osfs@%j5w*mZcSP*SJka;hoZF(%1^ zsw|gqqNi}RNUI^II4bYS?*Mh|Hsi3>Q-+*S26KVb>WHaK-eqOtw$Z$b{2f}7cg*dH ze3M|XmDn3@vuPdO9>Nae!9&wnuMo!0bhNz*m5t>F2N(op#)a%*Y-S$WsFVqk!R#_e zgCVr$)oGuVbVYd9WI~+P%l~Rto}Iv zl0yg_8`f}$U)ub+rOd_a&@ZTqN=bD2$W~uHP;asP&V{PBg|_S-lC-kC@Bdjhi9NCr zwL(Z!<%HFA1|vvRIpb2(8Q)_EFYL1z*WIry{>^T|rHvMfGawsNeuDF$AkDyMPGb)RF|rCbQZDk)Per^1(N@KlKo zR3AMN(KM!h_ZK6a9(A@c*T6($j$!g;;TfMWNMf8_L?5c!-@5yQWC{|@+^$~$C|zO2 zJgYhR$FKx)whz<@Q`rf^GP*yKJ;VxniEF;bcNYsoh0tUREYl|?yM`0LuZKYS)B)@k zerZX8IAGCNeEM^|u)p9Kca11wR^`FMl@#_3&*T9?r0i;KJ8_QO*$4;u0aZ6)p~^Wi?J$vhrIhI4*}uZc1=rZs;gt6^|{ z<*x@^3t1#*X+CLaSGH$bULJFQz$(?l>i?S}{NGMy%#1AmuOhtue=sPE2meBJ5YS_w ze<3!c?dzO4>VZUleCla&eXge_0syh11neHk|6x#6s!pChi^x=do{*=Jg>sZ~YKs$>UY;`BphgxGV$Jm z$0|35%<}sRiBy3FpU&LlV{{jF^Z1sZyUiW~@HwV!sPGEMXVR z{!=`m_!3fFfXUML>1>>7v)B+9jwr|2_>p8J5umrN0mRJOAgtgZN-b>;RxlqU$D=0u z^_Ky>8RJr2weNY|djNtgk4vU$%p2ByE00KBRiv)&lMZm1gKcyV&C>yO?+}K4rDD%P z`s$sQHfwfMc0^MdNJw6Kr`y0)xN=n5QbIV~hASZTnI`BsZ(+@*j;IdP{*Bakj}T?S zVaq%^4+pqY%32V>n1=D56-;?Y^n{XnbnMLWxauF|3ai_tPOqI(mR~|3Bk38KHVzyA zWr*Yj+yUG%sK7j!=x!LnG&mi|M>j9-P?BM`RzZM^sq<{@%Ugmbu>H*Ye_QW=-3BcXAt2rq| zTsJIKfrA9g2MNnNqp&#|X7XwbY+D2$Z>q+-BX}%~28c=z#1bm*GK3IU47nxQ2K2-d zGF|w?4rHp~$6tiz8nEc>P)#c(S|zu)4?4qsuOpA9d2CkOIszFMMQz+yEl&dx3!V_B zs^l6@C5*$mz+VO_K)M-}Y6$S44DW*+<0#vy3q)7JQ1%TbOJp3=oHSX-C+Te4J7wiD zkv=rmqIIL@TG5ZDoX-|>sG>35#t{s^6Xua6^D?`eg1l+5i)mmSF(tjX zqF2ozz1*gc@%gIXvGkDExQW9{f4dEf^`kdtr?i6)=~RC>Jpk!a8EoAGaDCFqzn$GohrSjd=juL^$982ywi;vj&A4zj2AZO0{n5(Ic ze6^kPaVD&Z{BsfPnJ1&s1Gn1n>;PP*)Mt$&cvvA867=edmL_&tJ47>EIBa58)EskC z^ft64Nx{|?bRaHQ#-rz0K`)ortLodyr0Yv9X_tf#zM_k_-(lGKcKZNVI5Y0WZ{eHQybJBfK9@ge|>10_wVLQ4JZ zdQ8b90eCr1*m^5G8ic4*T(AAPMnfu-h$8OHaL$_us_OGD7UQTj>#wS(-gWkku2N^f zZQ%Uha*1iqv)3-+RlNB*WX z8~3+YPRWfm&Ee))KDv}SFpr4d*Fn(Wx|(AEhN+d_L?Hk6172^PlxPw+|33&lNhChk zh4bHPWvz(lhG+u9J?L#YXD4U^8wc}f0#>QJzg1S5nyH(YDc3eptu-xC71X4sf||Zt zpVmJS#6Wf^#u>mzamEp-x0;1BLAF86#QnfviMJl2m z@oN1L^vTHduc!Cb(2a(6FebA%h3AmPKA8N?mt627KR^5Y&zYplYWT}M{!*rRUsYY( z4pxhu%~qq*U&I`t-9b%8*v&KwPtkKHY!{AiA;fahA z)({0d)wnfIQYs&XUiU=-j*e$Xv3C7{@Sc327@@C!4$gQbIHQWGtyWoSkqnEJo?9@W zpNpQey4m2N3A{yB1fwSF(?G{rc2wSZT)elOy(yvZzh=->4|Gy<=kHZD?bJ@VcB*4@ z;c#kYPviG~*&68WB&Q-A^}^^@{lWKmp|m6Oz1T$RIOHetlZyye_hI3Jhm0@!+!+wG z-aMh>A+|DabJLpl$c(yNh>X8PHg9m{4y0J`HP1owV50x#7Oc4BSH?ZEzM9Bizd}i3 zz1o>SAl8;QpUB6A(Cil0gU!c@K7oOlwhs@w0LIip-w)%TvP%q@W3xK(t5MNe_pnPx z0^fzQH8yP(Mmp9*)cjdqXpAQTSSx8*norDcj78nwZw@D##WFe{+Kq}_sdUN-u%RQm9i#c3IYKQ6_ zsr60PG*_?_7bEaG_QRdpFdx5Qi!zz`w|Zh+<+8-Afb=SVg)ArNhKekU&V2^$?mz;) zCbepH_@YhP`uLJ?JTVI|xmF9cO%Fj^v}@IFFsDGFap5~;ZKKJD>;*qVR7Fs~|jj8?r7P5Q;Sw8am2LJ)T0L`rYFbxJU zCuX?^xg4yrX`oe>+e-LZLSynAs2Jnu;anZR4%3!=uak6=ly;k_o`dZBP=Ir#+ zRo0UH-#Tg5nw=w(+LG@d8wiT(diRfihUe{MZCK^hE#J5L&l_5=dZVh+^}``SrB>_4 zQ3_tGpZ7YVpci)c~-?=`b%zc*6;gaZB*qoc}>%?gKZ>z#T#z}PwUIv z?{JQjUf*M6d6v>SO}<-;Tm5s+#^yW-oDIqDrywKMK{RhgbUJ;9O+}2OPpi*OA)nc< zgtkTbck!ph&zI4imCVDxc=Yt_uk-pE%bInvz3fUY2Qmq+?KYx4qW*kkLd>rM3Bm>9>?&&+VA)>&32~J$T01Yxp)*gwfWQ1dhflF@h;GC3ya#mX@>N#WX($sJPN;5@X{-W<%r>pl z8=Ca;*HZG{R{@62R<0WQ3F||!2QxeO(6lXV5d^a4ZT;N_LSk!RUq8J=y*D$`>DEau zVb5UcBOkEnF7uE;Mo>n|YP2@SLOy5N&lOmOhr{{_YYEncVbf<{Fd4*Ocmvg@7+l#^Ypc>Y&hXNP8hG0uM~K7r0ad=c{Ni zCjni}t@+Xqrh&`*5wcgDMBn8FtoB!D3oghPC_0XAZR?+O@UR$s`yk5(2ZvQ+Yd2*lBy|91rapBV|| zVuL_kDA0aU2H~b9Av*#DGQweMxCihK4%Xb|@c>7g?4k{RTdW*imxhXfo(e*mYrh{JU(G}T!d ze*p$&HyuOa^w7O}bR6X@(PLW2TYQJySgvq(4agso`~dHeGprd9&v=f4IL^ng1XJr- zV5 z#}J5+GO&^X>;#|l@v|IklQ<8I2@ejD^~o!`>`?vqJ8y{K9~li0J82|U8G{XvU=G(w zK49LVPgxaESb+zQ1Y8fLbSDj_YVI|)zQe}_Bwr6BHG^2h3xZ>vDj(C0p)V8WC7%T+ zyBweMFFdbb?T-c-3McKN#1BT>Vyi!8(MMLj6#jtI9ll0md#V?*g0pzywjH9Oo4GQ` zYHDz$ff`ewb<+U?4Dt^*L^|%k(mB~!A&YQH*Q->{V?ynSKo)(LNtjz zinRV!8QOF7HQ1y@Lm_&0ld0I*@GQ*;e+v~UTv|??377jBYTrBi7S2r~ zqpOs>$1m?_H#XkE4N+7y47zvofu7kKMF*_@JfW{GiX3#sNowUp;iypRn$Qb;q{M#F z?h4;}Z0fYaxrnQ$gF}%(EK;OOM@8@iEN3ow`t=3EX!FL-(k5u?JHr)AE;9L?m*-$TpdhDQrMOIXPB9&EZhY%6E*vlF#zS~~n0hZXb1CeYG=EVX?ICRI7 z;!zIFD6OU)&vvd8fjp~8US44()uXE&Z2s6k2~Xgq(w&e*rg=-@v0>C%DN$;#y4!zJ zTkn%b=Jasd?n6e;KDOD%mE1KRfVg_QfMHnz(aS3V-s$X@%lqL=_Lxc)O5bhXmFmLE z=BG^MTIdVCUVl1&cOR|L@2<$yd(3Wo_uOoU`SmPf`iO?O@X!#u>zz2N$ziSHH|~_n z`Ua45675a?%~h^z*P_7T@7wE7V+h4M-AuvCD;D^dLvx=4`kHFchB%r%auyT?Ct@yZ z9n|=1@3@U8|FP(l4zesP07i9fJS=V0Lx$qvR1nFJfRskWhCp!!+AZ8(fmlfrfYP3&w}XhG`dVrw#<-@WHV zjY3Oil(Vg;Lqd;Ve|EQ4b%LCuy4}|N%m4RXGUMo;`QMZ@$N!|HS(yF<2)(T-6URh` z*mGNZ#-}fMAM-R3Cf=FgD8<;ijC)nzojOg>ezmJd4oPmlap=*QkZ5lF?94VNk0-~Y zQup1^Pr8U_t!uL*f^hKiIf)0CUd~VtoqYm&;r<9rq4l^&* zPY#%6xAl2~R>%&LR;fg>D&;KetIyG{#;KgPMcMP52Z^8G-yRV!i+NU@5|3gCC+rJbWzJewxpXQ z4rXz7`C2@d=L*b;xnZU+Wn$yrL-jegE*!0H6xE}D0_)EMU=(%nOyE6HHa2`bYK0Pl znxA8Q=j2JBXp7@Tu9}z!TlpR?bWhMcIPFlj_L;Ph5O@9rPP(5xOzYk9B}F;qPXhI)p~v_XPf}^3n7%mlU@P781YK zEX(CmS5ITvp(&~XF9y|q^ux$Ilf0}^gb~q`FQGss>C6=FaI5Wa7B}yR8F4^$L5-}# z0HHV1glMMRj;~Ilg)DRUJdxMs8z}X^&M8bV*cphX-WnfMP7F>b4pg*XrdTtRZhZs} zl3)iszL?UW@H|Bh)v*;vZ-pXhPcpp~mbyXD?43|t5Szc46D5gF%ANr*0=<2AQJLAv zo6M4qqAOw7(d9$h(NqA>0TtGK6i~P5sM8o)>p#h>akNg|=mu};hq(KISkpaD{eQDO;3=(G{*l3*B}5#7Mzmr89?vt zt2wDm88y~v-!}nEw1s_j2Wy7Qm4@lrR+Se`DOQ2emS0I34nR^q->#5Tu~B}RKq#IC zqmchcck4l2VMF(BUlu{wr)U{~)S>|wAE;W>1acv(2S@Fv zhZ5=DODeeaHse@^#<9?tEgcvIq$H`1&a;o^1aE*HsI)vmpR2o#g-hk_TPr-U!Rjw) zkrNb~vns#>3C191x-?g^o67jqQ|M4BwD?*#oRLB{PQPX*!Qxh&_hZESY$c^fJY?D&FG%Z6Ez z(iP!$oNtY&ZSA7}aZSnYo;+MUk8Q;meNwgp4Z2S*Up(#8OcoUGaMDr@u$*?)z}w!6 zDf)E=(KY)v^uA1n$_KQH9>J$0PYLqwMoXFR?1N~PHpEqnDdLsqSn`KjVWgP>dHAWL z2t%@kW2!GTr_y;0Yw(ScQHGVtes`TSiG;k+EfgS(1z?1%P8cD0d4EungC1nLI+VGC z<(Pl8Mn_|QpcKPfGjO11D(Lp6p)f#b#$-k;Zx>k;Zv(s#e4 z0QUrKpZ+l%+w|Txn|~-HZ>dH#*-wgpF92x0nmUz6zn?sGH z3dbqqGJ0Y?ls5lk0WhO_AykdaEm$d&eR(BR$Ig8sW^z1k))iSciRg#=D>B zv}jGcPBRDcJzaHlD&Dea#Gm-#BEWVkd-Gc2nKpsSPnTpGQFsC$6A=hqcFP7n1tXZE zyph?AxuoZWQqL3OW4M(HXjV>j1V>r}p9#bKf@K-g#}~J3-*{h$D%(|OmnZ6@Q{n1w znYcUAO{uH0x%-5Qq$CCZmt_zixPFxR<|7mN4zHyPJC8(eh8!ENF5sr$c_1d-)`qbH zmZ-jFNcr^5=XoliW1+9`;VEy)C{M$_aSJ;idjLx)>q#QiAPt(hTUofPl8s09an&WV zxgi+9!Q!y=t?oAn858Q)Nen1+71am94co)KWxv5LG8<4m=1F^FOxjEft&nF+5-yN_ zFpIV$*RpL@#g5e9QdZ?Ife-fi1t6o)kR`#0bz16{y5+*k51`yvs*&JEJU2O1)j)Uy z=fD%~qDMmYG=Fmk%wkbw$o|hHo+d?d$^_&|U^==yO~%o=N*i|LUemP{gD|9#LSiM* z=O^#r9UO`DOSDFNSsBiEb3ri}QGzBXuVB0+vuo~G_O3yDo%tVG-p!3;l;nU@pO6L9 z(@H8*=|LIYIlhOj`Ff15*J0M3*hf!@`3Xst>r;=CF`@KR8q`wsKKA`UuNJm5bi$ZF zaLtt-m-j_daXUuTx9Qu~x^4U{YHcMIn=zR$zE*v-G53Q?&X4J9sdALL-Us@KZwALN zXA*b1U<$bpi19J<=A7wOaV4*VyFXwMuoqYVMJTc}{x3q2iGlttJg_T!V^BQYS4Z2&|oht9xG<=(LWrA*UvG$B4fR~@6YLeZCI|G+xkE2 zVsro1?*XhctwY)C&GoiZ%gov_%&xT;#|9!_C)V%rd{AX`XXKNjIkzi|nmfhuo9w6R}EyW^d%da%fiS|kwY{G0gSn|s3D@P?jg~=A(kSW4riNg zj+sH2CJ@iSqDvN2%J&gOiYr2co_A?bjJl+R|Ly3}@{wdML-JGSpE*Tnk3~pgmlB^2 zKk3*>8#OzLm}&h{+#Q~v+sCgV0unr{gBoCaYErM3qo9_*MrnAi-^%RzkDRM#0+M_4 z5Uk(y{Ux*W=9P(L-c0vM3A%pX9ypff)xP*@K>Q$k=e@t)f2m`Xzx#q(wi2FYbg0Tm zt6G8r5T4t<=nQfMN=)RVm}?;njdH^kj%4oN#={G&36PTf(sh>#|Fj`ss|OjYwhQ5G zfYuGuGFuJVjeqCbusdq*9p=toVp?xFfs~CrRA+UT#?b*fykmq|1?4fxia=nJQZpF3 z&y+T8e0fb+;K`Lsjn1g-$)GRbex_C;LRhHXRbP*tp<*%8pyi@k9b-B&yjG%(H=nt* z^o_LL#kV+pC9T-;PKl;hx-YfyB~uLK?tnA3j`0605nvleDr-l&c#;RJ1hz zrbz{z7DMN~AU&(YhAU`4OzucxB{aK#*ZY^p)U7C+Wx;KxA$I%1Oty5oFxEH=M}`j? z@?iW_x^XTAiUMT`O|f`z$Km7zt2t|I?W;XwEmM924p|uq<3)TU5usWTtVA9dkXEWp zi|uF}Z-${UL6?Re61_ebBU>Y0Y-h`*V)}E$jR3B-xU?RFZ_Zb0)Jjn?ZX`?1$T~+4 zJTl+NkF7(=F%~CvirVZVQ$$>KIRmGCLH@SZW>p~+4Erc8m)=yX)a+821Uoc3nBM*dPAWmj)w099{?3t~{c$gbC+qR6LBcromSe_MG)Wp3vw! zt@V$gDjO-bs(^O2rnNV2X(DlMNYx!k@Ee6-%FlJXe=&gRi17f36*CM|3ZCvcIi5tQ zEZMoS>@KLQiW9BapT1jSk53Or5pn=(b?U@ZLTWKaWn8i z;4P6JU1Aa)hRako1(9aU+co@J9$=I$F4S|76ABVZ4GS)G@n>YO14}trD1f7`O>1hF zAqI@R@$lc&NO(c|c9K=5%gg27JfZ2mVRX#}TOB1*S+j@^16PFXK{u4JHr;V|1P(~~ z;AEawA9yy*_Qx}wPfW2CUfguSVl(*8iG8$9Yjsb4CxZlgp)_Ldj9~Em5jG9QWY~8b zD2JehIC5wxX`PoWS{rffQ0J|XZVW#qs=q3c63bG6$JrTkLuK^dY+(WTmo&2yDefW- z+ZYS!q_TcEvc1!8NCP6}BtI{CO*UC*$xjH%6GiF?5Y%%nk%90Us^D+x@V&Z%siE-s zZKJ7JRGYkij&EF0GRnR(AdgA4FqF%#6^PJ!=*N@me8_?J{BKp-e)I_UX$zB`rJ;S9 z*FYB2;#(m3sqY2?H)!Ej%B4yz}cxxpI6i6w8n&kJk)pY+X_aiDB#212Uh%^59I2MKMlW+ur`a{tyK5%5l zCzEc;3(GF>dbgQqb|H=vQGb96<%nbf~;^bC@(>!@E2@5)`M-$ zLBuKCbTLxxy3oI#2=QunY8D!L5E9NJzsE!nV(AA&(3!jysaK#VN;qxlCoVkcGy@-< z%|2%O+Kr5K3s>=rR>wR{4L{cEfxBLdgU^bHB2KI-H2%}p>X9(^!X%>l*W22k*PRAZ zJ|}I1O@76mPr$=j)Mje&SDk3R=gS6}BkwV_Zfw7MP;g$1oF?EwA`%;LZk(!twH5^u z!>A<{|1!Ns7tSI{bvLD*hnhDcw4j>Q<9H-I=OzDX^%4F~ z*5G`3v@hgK#M7i(9-~}dkVt;0?|?Lxc^#aw04h_R_qtPp2POwo`ug*Jz*~+ntV5=d zS~6b3EC0U4z(rz~Q-Br?$ui#6sYjKtkd~XlWEFb0$)i)N=w~Pu%z#uDHQkv6$Tj&`zWL_R)XGnuV|7%}3s`fYhN#Pj4>OTgi2{%;1WjIuEVGENX*Y$%9ox~;O` z0@3%lQe$9F(M0rh9kE?`AcfpOjb@yaMn-6^#PXVUMcJ2wluxh}&Nh;{`eIr4jLvL1 z6N`So&8oukU^$KwP}q(#n1%kZXu+>Q>!9>i?!raN6Tf!Qx^4Vb9=~HYF>G? zoH{TXC9N(>{3onWu`O4>Hl>zQv;7mLKQOnR8$rbrRxl@w8`ePruj~Ge@)V;9DAMG6 z2t;TF1G0NS8mO*i>oK-*1QLjSL%mKTD96&-km@zS7FfE_e@)orvR;K$NAx1F= z%_hkx=<1u8409DGWlaO(M8?$$TbeUUMF!fq5bK?39c8wsic={IZEggXrH?Y__(J!j z`EQkOdTS%wc=aBB!`X6>%Q|La*+1Cq8&1-peFH)~oe&TY*`eH8zt1>IdVvz})riVt zrU5T1MxK+XS*Ty-2VNFD&9LU$Xrwuyfmd-n_y_k^4tn2pL1Fu zuW=;vUahryxQQP1Oi`3ZNlZH{)f3`KxPqv9P0#0_<74v1at8?JEqCD~px7c|;w-Mf<=>g)><|D|>q#ED{Nzfh9?=<; z<6hkFxY7g*8h;DK-9uOza%;(=sK`GC^e-g6)X#wojlVi#nYS5RHf|xp5?@J$hkx;9 zH0+H$BK04Ro*I4yA-!*MBm?8AacROGdY)S?gbA|6GH@|^GiF@3!0H@$ zUlNzgb!aPNk^r1=e&!h}=n@uv0&%9VD(51lB_t&v2W}E1joX1FkUsfS^gaBA+na6f z(7UocuS$z-J&E?oXE*oRrk77Y&41`AqhzrYuLK`mWyGv0Gj!N+5;X;){7kaNe%lmP zq4m~}`kkYEksmKIi5IN=hSS%vQiw#9l-_A46*L!a8zOJGk`};QkKqHVMZ|byVR6U8 z<#Th`-%d);k

ZBUET7M2-!ZhIiG>0Q<%ui4mn z3+9}5LnCdV(G+cQpqUvDc|iv+hXb;j#+T@4MXM#N4=V0NU$bXcKQ?AWLwQ0SZxM&j#8M2tBxejta{6Cji1f@u-pq5}3cEpfxLWMrbx#Z7 z;sjHAdegg*|9W0wkoj6`s>$nVdM|Okq0~|;o_#7B?}&|EDa<-h|NY;=#IBLr-XH}q zPzHL3*>nDktMKDd@7U;>{{W8v0p6KePr$F;bLHYp%zl#TV$G(EygmLJ2|?UsF)|_V zkU)?XsdiB%dtTkgCOT|N-^`!~EwReoN3fY44Mo>LG0y=@Ncwqgr&#-v4FG)YZ)i&` z`MSv!+J;)AG(|@OS~s$noa>Zfn#U4|Un3sC_0XTlEa{|!c%D=`bXW-(if5mS#yX-l z)DL7KAWW4JG1h!@Do|eKTw9XNs&H0G3oU@%g4Pnc-!|3{(ja)Hmtev|L3Jr^B5F~^ z6~qICyWM1pOZO|C`^csVrVtY6PdT>7%G^&O`&H`H7n|^%;_b4W60>df_c9WE7OI`sCev`B4r@5fsgHO6s!?*89>#xdZ6) z*a3Z)>r2ax*i@@8uB1Le*!bAZ@ZWSscV4x06H8;yN4}OO=jC5vGWl5)hRdeGRdgO= zc_y=Hfw_)wX^oHRv_;VHWQ_**(gZyRJf6t<-wt7zLs{{(L0E3rm+Ia6!?-i%LkD!M zj`pIj5AR3QzGgnH|M{(eDkxpu{4Y-g?Truix?+CwV<~l z>WK`M#apDY6FDg;8<6xiNHYE)!|+S=;E}B*L&&nJ3sPKE(B$W+t)NUNP`QC$vmD3m zayx!lj~~S~dg@?_Ui&;=1zRjrS8-ufVEEwQj|vQf;C77)41?ynPZY1fU;LA*|BleY3=*MF-|GMfouLvXq$)N)p+E^+MFQ_X#eCeWz z!lkoQsakRyj=^2)t-?xVe=g*dmME-l31ZYN>n`Yw*)!0<*Jk4t_2*7Z5g)NZKXJu__#A}gCbBd?n8hhx*f zr@Mt=?(nEi)|a^V88|}0FQlON&=>p{v;mmQVjx_?u=^cs`uX3Sx>h5>r})W7=lTGp zBgDl?m}eU76UsI-{%wO*60p*@1AUT-V+>6IPm(q2qKLAj*C;aDn_`mC*kS~=Z~q_x zxI7(xj$K2^+&ZgNMwN9?F*G@S>VtcTeNz8`dh{v^B3 zF_05xFkn}}TX*$5Xpn55C?z#y4~zLux0cx&jcGQE4E~rp2}iYuK{-r{R(mit1KM+$ zsf4Q2Ng)#pUfk@R30k-gy8%T_P*PoVS4H1lv*gWphv zJv#)TckQ|V%z+Xx!b3TC!VmNQ@cobP-@HHI5o&m^XbBnFih-~dMXR8QNXdnE$+m<1 z2u*uaun(~@qXg=V-Ac1t?$(#$G4>H`Upw^nxEKB91s?cts%{wf@R$FJN}c3=g4}6#))AA=DIPW)e34NWB{DL23HuC zW4=-!nuWrpLp1fK;~W~tMfW-xm5IB`EH@XU`Fbrb&)u&yn{gw$-tAVZ50W&^(ylhy z`_@x=Mc8J|vymcj8+bc0e3jOTOVdMWC*X&7e}codkLDz!ZMGGpA}K9Y>WzrXW(^2w zC9ep6L{u0su&}*sPQk}~k;B{fn&T#Ujz{#i6I{EfA{#r}c9Ywc8kFIpZ`zfrdJkM{ zg_sAW;PRR?ioVP8E26Wx71671MRc-ku_Wb6W3kn)ckeHCF0KeV8GU936kRt1I=8xK zzx`9W2^A7X1eVxpr5o48BLO=S=0nzXRqXm_^RSoZzPzsfZ{i9D&sZ=7$KB>-9eSrw z3InN~EH@J6$c(wx<-|*QKf5C>H77q(`4}~U1+P7rId+B@Ft)a0-PT5fF#o5 zv$;>lI7PcD5eC}%Ac3OZs`I7Wznz=^zs947Qcvy27r~1+%*Ytb0n_; zWGc!qe(!1W5*aH@T_x0jtODP4xR9mQ^2~zmv%O??ssKkk4`5jVQYz5(gzs?oYi287 z4nxsk@4Mm4+fEKo-jFGNQ_+_+Hl$ws(u^(oT#xO% zvZq*SQ+DzgVPw4ikRlMy3I}x~_@@qtpKcSV%=1eYnPR^TJCc=xtX4<$u`ku?PY6h- zhl|_`#2~9XR?OK{`t6O+#}XHKr@;#rbcZL_kI5@^+}zfex5$9FPv9(zXb?T2Y5!8k zcc#IHK^{yfEH2|sy1LsI_kIYO1H;6TGl7yqBhdB}_Q}0Bu8TB?Ingjw&UC7OYGa zuTqi&GGV{OKllR)F+(4k#g`!zmqL6z4hIIibJ{h`aOsq%h6X?1Q_D(nr=QA6!?_OT ztsB$u3sK%NPfWnN9yc0i0B>^IaSOL^hcDSaRlJgrZ(zM?IlmE!geT_DVM{ zFSI~T-i9qcgk7)>NV;s%_5%Gtt3*n~yzd20YYtyIVXAl~zElFhlYDXNT_+sk;waU$ zqw9p-=9Gla7X`|Dwn%{0JlMiy4&JT5+k0=NIfVF&uDw-TjYb`XwS`tk?)Y56_VvsE%{g4 z;Xe>**xrU|EB%lZFrLcks(;$+P~ZG*{5YELw&QLU6Z7H3tDz(cT_LXw>A4wPVEuSU zgW7C*tLlzFN}F&`xE;(f#1euL!Vz}x{_8nqTpNk$DGT=P454+%Ek4cYOj@}3H0~Ck zrpxV0v({QFt7lk=FR;=y9o@l!MBm{+&atc%AUrtIUVMWk?j6*O&q+l{o6KPu$OQ{nPLI*lyeU(&wDyNvl!>Nb_y?aQ693$8X zY#iJ_SoNX`jWaODGMRZHU7=0AS=UJaDL~1K7kR1Ge?*s#&t{<2_Ouc!wfG<5jhFx- zUwv?tN*|@t2i*M_rP2q@g`F;5D&3w~REflJ(E(}O(~AH>M*fhsJhX+y2=EBc|J@cOzWw&*4R+^QKv+%Q z8%7uG!|6%R@VdueF^nE(@iueOa_ladd>>3)IZ+%HfxM3CY@RT#zwHt^%MSbyG29lk zu_2(szGs3zIIgSS#Q&|~eh^dTL|hYY#5Gf1Ub)w(SIZCL#|~Na#l>DT(QOLei&tgep|;aWsGr5GJ=JZAuRo($?r6G8TDrDP{jt5usv6L33rj9PLm2!l=~@B zq!Ot&Ii}Mj@7Afb1H0l4BGvQRNX`$Dc2eHkQ>{v#xuu>cOYVXN(DwwVU#PU_>36vm z?;G`ng?e26GHx`MDor@uKWj9=J+4M`D{B1y2TGsK-T0D#lL2}+PhFSZdmbb*)iKkP ztoXJAo~<45Nj-UQG->ELFx$2Y_jTUr$Gxr7z^ncJkNr|&W`L`enc1D>Ofyz^onx9kM$DdtdfJ<5X~u(&{RLcSX%YA5In}X z1ZeR7raNv9=xOsXB%_SWDC089xQsF`sYm#jAZ?~_8JFIwGS_cX9Z`7%z|=Xf|1A0z zoL1k+hc=4%&!OI2Lp>0tq@^s%CS~slw$$@v{!&*%Xp_Bd9&94BbwAMD(FdcneGUt3 z^sB0tD#QJv5Ch4Ri6>pPSI*IyrT`O}AP_`LImUu+)Egg=b_NIWdE8#Abfbj|bhGN- z*3hkcM)a_FVe;^$iDn9yCK6jZ5Oq-?*FVo#%KnrxW3rSKf*V^CVsZ^yO)*|Xk1{2L z^g$sc11r+-1rvs;fA5pg+-5FqeN*;cxfp5<1ol<|^DqmYInV{imv*rPuD}`@btLbX zSI5|44?oN4h|;Z_cW;exqM;wQcrm5Lvk$*EjW&^+Mw@igXtU*dv%J!Y%e6|kG9Y=h z+304o{B0+WZm2O`NFr?)x988)QhAUf`RA@}%JjU&Gz>H!U~?r>*K+0;7BoqdYT{|C zn7sC30>u@7kh zgtth8P7qK(pN@8B6bp}H;ZZDn(Q`eVvG8o+V&Q%)dQ|#+rO}9P#Y?UBV~48NB5qd^ zhxXJ~Bem9!&+nyq&r=v(;gSZptng$o3M@QMNb;gz$yFff6YBeg6znDM&v2kkhmXK# zws1im?i^+{aeR^zIJePKy;)!4qyi$ve`1vZH!9Ipd<}}Rxgx=GmE!=ef{GrmWA1_L zr>^EZXh?gCTketHzo3=3^OpcLI2wR|MUy$#c&{>h0? z(Og-gAL@;V4dYbvoT@+Gtm$8lUzr@&tI2$;pG9dWD8$z?Gj*nXEx(KJk%)M``#8EA zce>Dg^2JKM7Jp*?xzK8>&s84e#=e5gWiaP)`b_6>&Qaw0F!GzhoUfTPny=4q-ky)f zr>>M!c5~pTWcG}v1m)S)BD#9zN_l#=k7)@VBR)Hw{M)s>BWCuR%)w2RNxG$6Z7nUW zG(nF-IVk;}Hshyy+I%-YLB>h#BsrR()eb+KVCCx}y+--k#hjdU_wzb6x3t?uj-3wS z@=-CFdHh%4_W8_kX%-VFPCF@4>7@CbRznA@4oABI;r&1vO!%UR_af?Brrad5&F*7| zxAIT7iDY)mDwx@;+0Th5g#lyV6m>6(ub&s9517UvZUB}DE?mgsr2Arb_z_J@(Ar76+~7${ZBoW)`$T>s^{ z&VoE8@kjUKV(BoZI(?74_O?R3h!o{XrtL^gLMB`LbLh&Zt%->poLHD_gjZO-K*yW~ zYNAm}I@$2RzkfCab03;KoCdTSFbUiMFWv$JLehYg58Y7kRt^a)gHo?xTfCIoes9B8 zSl4}2$$6cC9`$Bofu5Mduv+E1PaReXcLV`Tr&OrCKL6dkAAt5&37US4)Axk>pfv25 zY%jHD?U8v%RfX9|ppl`}4{#RDMSuU}ziF0&fKqjU;r0XAC(`ho_AXjc=_e!&AfU%yLZf_)ZI3+ob4 zUSeNLc6rI+$8a&MJKVDVPCOC945$h9`2$*s1{n;02P&3>fCq<{KQQgsDI+g{#OB;n z4|hlykxZ7nbDMl9<-S`t$ZFR_KB_lr)k?cYPXWi#4tB~5bQ){McJU`cB{5hC5V{=*0$wo za=#r?4R}{Tt3jO?I=RYypqr#N<>+D)dd~<13%(S2TzI&0w*&NmNZP~<7-OcTKp7*a z>nH9!if$dJ9hG4{8tY(blM-JU^fk`yZWZ@B*juV2Xzoc**T_+H+R+`cTEd;v^xC7fR4joG64F$PBwk zfwV3Id}#dA1lW4|aZ=s~POH=~{Cikn`kv+><*$m!u)xf7!^Wlyo1tjcenX#FtuNnK z2UusN-i2r|G-Fl}bMv z?dT(LD-mJ3u9`w@8E^UzdXeay1!s~j7xMI)Mx0o;6rBb5!)KE4&)X@SU~ zr-;DOmdGDE`QKhOC_cvHjI+jkYOVz_PnL=3#v8=)+Y>6Qz_<$DlgzejTx+naL;lnSDe~HHj5yhIT?lIkb`AORC@oK z<)Cfh;e{vKNgbP`6z?d-JMf3)D8)Ny4%bBSQoMp|WKB0``53D-IM0FMIVH7i@XPoN zq0`1zPt~7~)y02u8@mK*t7m97wA`DM-SrLwhsJ;;)&zkj7rWm9mEBHMTBtM{_bSx~ zV}>u#eM(U!rVf|w1TPdqWFR3r%oVY0VyAWCcHr>klqZUpQ%>(82X1ikhB260T%86A znpqSVWOLb>tW0T=VkVgGzHo2m>O!RwkJm0RT$wZ|Dvm~?Zp-}W#xNRUbzb30>e#`(p_X=u5I+ubn|@{X z!I-FHXz(bWJr2x1SuTa;k$1B`Nh{>$W%51X7=;h9d4t?NgBAcC4zxDK4W5Q^Wfu+o0&AFQSJ1@oXLjRBCE}Eg^%`xbX;RyP&Xj((gxmWP zIzlkTx1(Da<)$!aMz~2SyA&#J?`!SiewmLO3+4IxVl%E~JG-{YUXAcIbj5gWLel>W z=vD>rK|RYpWwJG}!{@FCZOM`HJYQq7C-9KYGa!9|o5LId=LToL7Y&4TLRKD+nv|L^ zc#OE>^%3o!WHvotN}sNK5^lk_e*bJN-8&b6tP-R=%XSdvNj(FSXgo>Ypy5D2KtES0 zZq}At^=5a>B^KwtK5&7LoX)|FA-H&{(C3^AB01G5D-x8ikx#7)-QAH%^Sh-E0VHJZNG&>166Kj;l!6D7{E zOAfWlF7>n?lpFLEmPK&+%QTnFuvMI$Y<&u z!7C`7vHi6;wp?Pr*$iSo4SqZ4>d%PSFOTM9Qm>{{WD}b`TVlU*bhlk;c9vUe$$eFM z9Jehg!a1?hoynw~6^q}k)<4%9jmqEu`2Te@n0LNjBUo;=)m*4AuC%G}30xN`K8b;! zx3gmNlk?VXwHi<`CW?@596e~Z9;pdywQA{kOxYPRg&${8PMO;0OkTrTF$jKBp06x) z)uyM-f4klKeO&Fr%TSlC*WhKO-asE~ICQGz@C?r8@(f;`m0U8DWoIz`o_eQEFgO{_ z<;}@*_S2-91uu$}w|Ab@f@$V2?6L#raFwt~UN4?G&Tn$sglz z>v`lo(%1LMd%PJ5Qi!03b3l>czRqS~s}y)My5OjXfG_l9g;J;Dm^lnLIH4vK=J7hl z(w_-^D8YJ&SzyMEZBgLig5uAa4^c}OW5M<<1e`9Zx^68qyl`F{4Mv&ki1YLqDO1EU zyz<;Ev!<3Ix)_)wPmqTMqdPo#eN%5;&86PD>QHY@UK)1|X1Ug?t^kYB2bs^)hK#9U zxdt@4A%}IoJ2zq4trW|t1`QiBEz?)a^#X@{%PsV|eZ~E-hMIzSNV_qpsAO$IVC6~~ z0f7V9CIG-w(l|d>Kdyy7A;?fOdBQ?bR%*^L%z}C0@~2+&40|)O10>Tp>Yy1x*+x*d zi=69WgtAQ*kt9h_0v}r1r%NWG?`hE-`({4rX-&p|Ds? zLuua^NOk-#M8LmCa8?P3Q4V@DCT7vwtyY5yS+3KIm70Xv_XSCU5M@KJ5*ch{s0w#9 zJ1rfPZlu6S47xFKFF|x(GCCERtf)~!b1`gdy4oXpA<6;05jX3VM$}p`y(#}~m=lV( z@r#D06Ps0wO9zhSEsnI*N8bI(%lX)Rf~;1#G3SQUL&Uovc+6=uPo{yf2O*|^B+HI# z9!`RQ!)}L=QasEmZu6(8;R^{AnK`kiG)@%2`Nr~Gj{KY2?($xE3h!|T53J&Eqb-S*>*6c`!1BkPU{%PXxn zUV{wUUy@fyly7V3VMX^(E7b?(*203Q|C0m)+Dy;>BjwU7oIq3||2NcDKTKW`ys|X^ zxLLj5ZZ%sgoiX<$+Hz8^{(QkyY$8MUhR#FktV(3{(s9}1BjQuh2T2Y<)9dhu8Hp*K zSs10-J=7t+g+1AJ9`*OcK>+8InL(J8142*3FAS_~6O*UFmRqza{?E!)&mWKpDBgag{6 zO27v3=SGsuhkQgQUR9^dVX_UE-K6MkY#4XXFMDwsW-*rO-%&mQk7#3?OWUAkQ+zanXWg_VlsRBv9!{}wQ{JB+)kXoV4Md#^Matw)V|r|TyE;1r;0udc|Y4^%oMgssJPW%>T&QyJ8tl)Ir!O)R(p zh{-d9Q*k?Pw~2>G0H0GG2HWgpX_&8G``90)ViQ=&T%j3N!9V!-mmiI);1}Emxn?ZVXp+tzVI(dE<61uGw`-yk=4f619msRICeR zBB`+ks?6$MFT7GRe5(`3HT~gKp+LATNcZ(4IEdm?nqgIR;#6W=tJzKWIq7u{~xAJ!Z3 zVmy{kYK#``AS~L#Rill%s%-R22h%4ayC{>OuJ!Iu#Pem^inL2`0KZosFA1xQ&I6qh zUsl?+N0oML*+Or%YAX#`>M7g?Q7%*W=AJpRc-x6SKZ5$F;zJ3^7qZ@j`BJ|>a%zFP z1d#D)qvpOr-HS!5VOysx-7uHm^@q#-eTKFHZZy+hth}zDYz+t%D|PFh_DJ)H_KLoW z^V7&iTDjg_XtkG!AFmNt9#j@DOiWdcEc(`rEV^k&7JWq{ zJFkRuCOzeHTbXv^1raApP_9F_YdH%!WvbJ08}@=HKT$C@(@w+f5Ao15tap+}02*a< z@V1WC+8uMm9IH`oQpOrimP0|T2ODieE0$Zr5s$}G<}{PPsUUBgPgm0?_#DTEV8*w} zk2G>q@(uN%dqkO$!J3602|j81*?icRhO01oT>@70*bP$h2+v`hz+GKX3p6AO;(i_| z&CEHr!=+vw0B2;}zQgrY<#RJlXJCd!4Ph{kt5EBtUQnbb6(|9BC;^YnrePdBtqnTREdwX8 zw~=T^FoitWV^0g27-inXHZ!KHhgWLGF5DB8b!y8g;LY^7f;={U~pLYGK1v z;qvw=2wR>z#i7I#u-T#q0-B=Ut&7hSCTELig?tVGeJ}=?z@0-#ee2R{A2Ca!6u? zICnH@->B_j)_H6DEd67v&A(WR%S=-D)-K-B!EaT#P=WkoU7O)QE03L@tpbsu~T|AouWYO z)w9w!CSBOy#rG_*>u%iXf=~Aa2pWIl$@o>&lD!cxH(HOOH%_$4>96^7*`InWEbz-& zf1AzO8k1KhB<^FXT&r{|Wfh=xN!g^|4RYH0u~X3vH4qTo<$(m(Sa`Dw1^6B-$X<~8 zd+$6IWCN&jQIF;(0X~OJewMTnbjadS;%tg;;GQ8XcewrblPwFcpdvU|Q#6obn{CLx z4{Z-r=ygdw%#)$7D$h{|l}wpqm&YWHozV>q)VR%;@X4)3@~!U!_Do*tmLr~PB|c== zsBK>*%CGg%gG-#NhY>Z1op_C+ml6wBDf(CnuGbE4Sr7d zBJ`eJVw#s2jc+jt`1!pl@YA^Dpee8p0s?JrYl*LT>$71{0*yj=xGL^O(>D5w4r4^5 zXr8zo*adi2>nU`gG24_bX12<`jJuNFuHT#7^Tc&zI!?3uFx(7tfpFK}CN?#r@!8Nk zA)6VN!Lk{N1P89>cet$79RBixv2VvzzWwFDB<;I{Gjd?vxdIJn=m_POR%4I=ZPCj^ z^9En%mZ$6U-_4_T4L;SO-g0Shn(f?HPh-4>uUdG0{kRbQWo=Rjex@;uDYeVj8ce`Ge!fjf^pQuFS5~A_=Y=>_{BT+# zL=Cjs9IXMfC85{mA~K=RSkgTfr_hi&*OCaD-9zqp(9~mWWCRNtZVz8?P+imM(iFH> z!-V;=hjN)G80VmkGZyX~h1{Q@b=czmk0f*tk* za}w|1n>}(i$qr^!utC#!FmmPy9xCS6OyB|0dEgX=7lTlOObIixPy7U`dzyIPbn$5^vRGQ^h6LIOY$mrr_Du@Wu zF{}=%nSj(-U}k8(H^JZ`D-e2eds3YeGHZN!op~4`V?X%!mmiIgvA<%(BV_DQB4ekD zt$?0u>@{D7ZHnu?#pVQHX*&`ObD^VGG7-3ejqNOTTfGml6um1BB>40jb z{ckzPH^$6AssBF~`Hp~h>PA9zh9b{1o@nad{}0AyhC9~19gUn@SjZ0*FhZ&ViRPva zQ{{IkLK0WKRekc)N++I~((VJgx0|{!M0^dUM0b*6ig(UL(kosPhORej;knOUQxz zzwhYR?0`My1thSm4gpg@KsbkAz z&~-&g!Y~O9j4rC-98a4NxxF(R)`=?4(Pc;WFqS-Zb7XFYEVFKzGIpMG=XucXsisYZ z%&N$wrpdqVB!59Q0z0@-hU9~PKgy5{g2y+?kPKSXP(bC&9RJba5D4I@iM#ixJs9n{ zGX2=gLb3cRB&IFQbA!Lp6QUT2mAG($5~7^_?VYdSH~+K}w;xBHE~5VhtRu|5DH{%e zvhqRvm`2r!I~}M_c3ThP=GdsWci^^65d-Z&?hl-fYNdKVrl5EI#Lz4W@X3fp{8g(` zi$1M1D$S}oOVxh3zP#LEmGfwhZsfwQOulf;85Yo{kt5K^EqoqCPtoT;lGrHS` zUYmAjOg38vjw%VORIy)j41;*yWA43^0xOqKQj%ah7G*e^6^3yi6|Lnsh~V*4pgDWZ zrAl`x(EH4fy4lb{NrHYz!m^KSC*{oFps9Jn)B0RJIfIP%{SH{02nysexHl@5w(wKx zS{5ZAB|I`5gJ3v{*Vi2es8^H zYhP@l=UUqpy0Ekh&IdL`mLg$mFKR3Vg|2V0Cb8v)hu9@4*h)l5EOg&8B~~Lo(>WW8 zdzBtLn!3XE@5w6@_#}YBL*{oLG{xBFLTjwFyl)_T1Z1~DT!ez#!9FXB4sOKNc$tWU zhQp;8wg%#8{_}O|YmJn*v^NWqd>4DrVLNi2gx!M7t_?NBB zP)I;T@@x1{!y>f9K?2@GbKbi*>uH@Cvqinjz~C>rKu-e{(Pz2-oB&gEp(l|b7Q6<) zZopNuy;kaSOO?)pxMoI@;=7QISx($;8?T?6#*XR(DCz zo@*!|Z$OiyL(`?LqA`ZVC0$$>ei--T)uG#uhL22=yrx(@L>erBgOx{(U9}7WP4O^= zdSXl`2lD#;#CS=0U0?iV821DGPbPrpnl8qN0X*X_fM>E?ZPeAs%bj{H9vl$QWHe`o zHCR9%A4}s!OSn&%NzYGK5zJSu$|Jv?=L?ZAyY2?@EIXf2F-yfo*Hc+e*i5g`(%$d42Ia|!_jj_8V-tOjmdQzQf_>6 z3zPcb)N>|H)V*KfA6^Db_B;bgsOT*^wKeWVBVOhjaiv|JuXp1zo^wrZLZ z3auW|L#s}NRZY@h@&ts#bVg}iyKVQP?wPeuc^X7ja0fT*cGQ)zbVWvCBm*0#fB z+ra{0-n=~5YIfVL#wSs;Rqk|KZPHrZ!kl9AGnW1wvci*!kHXa82BZoFc$7tr?}x8M zS3up?bLT58`kKs-u?;(4kO6Q!OpdALB8QzE^Yd0aT2huU5-OMfH|Wntl}4v^%H)>Q zdNrIPx#hKqGa|QChXo`w+7XaMEk@n@LcW-S%}(?vzSmLCVAO3z%JNqqfB-ms0_dg8 zsRZA@Px0wOJ#N%eFE_w*IarfCc}A1$5KBdsd##mjXxci_J2%wbM!nJ$Ggfa_>&xoeMpj6>cW4p3hABGdRDp z3=`H-4qrLC3BGwV?waNMS#z=8jAQJ``a14DYPBB}Zep*U(Zoubb!a!c@2aey#Vw;V zzr)}E`0rCWf+9CqeIy9KWabZMy zU5qOj+J|!_;(4o-LM^xMfeT%K7?&?dU4V1B(KmV^=aeu>49#~2DF{$u3%z5)ks01u zMi4-98`5z*E|Eu|4ra*I0BL>z>1b+c@$SIrdUJhjL&JWZ9|RAYy2(DG{;`;LkZie) zsk(7zUtLCX1Z|lCFl+*uSS@;8w;ValCRxevGkGDdNPzn?wAQqoZ;y&!;Qika86HhA zBcUL78kjcG(Ui&bto6O{s(-~4EzJ=^AhQ^=w6wKFIb)LmfsvU6jJa4MB#d3vxT-ye zM%R!SJ3PAv8FQq*x#`q4Xz4ijV!b6;Tu>DhJTPuEuw{Ya#I>I8;EEGC%$}hZ?3ZL6 ztx--scgotTe_WWIx;Ak&o}HSQo{F!GS0*N}T&u>@*RD-WElgLhT%D*cEZm#DAOof> z^ri6=Z1jZ?ub*h)QhjrVWz&!yi{-jS{p6ccksX`jjuYKglhT@mEd)%Kt0)kL<#MC- zu}z948a*s|x~V9qI}rM(Bl4^4-AMQaFMEkrzDX=X_ul6mZe%?xc?5BnP z3@s#qFirZ& zGlzpW^z~PG9%~>yp3oRqj^BOR<)}hiq8C?%LT(;8TNBQ8})_Q zHuE?>D1)QXBs}qX6?66%eCB21p7$4Wa{8DH+Nc}ojqf=6P1s%N7&ME<696T<_p!wo z2)m6TIMLt)eG`9sSV}}kd1Hh=|KQ(Wel$X#|B4Zh(C0&mKA$e2azuc!CD8VsXTr5Y z7MO43riw(%Ti9+JJ$Q$G#v1UH=`JNMEiQXTW09{sX=EHQJxKk0g!*=UCl@46yjlnV z*C{f~Lt~VUOk_ZCSna^#0d{1Q16pj$J&z2hj-d_M#^DtZ6+3LG@aY1IAn1T#3k5!~ zjZdT$+yHgHwa|T3X~)s0^+p2_7`G~2j95ESY5vo1ZjCt`J*BOXv2_9tRtAlIs?D9c zTSfMDhX#$`#O;I5dSDN6EAJ~bN9$4zQFxpt3zbL_7s-n!^j-{M#35yiy}>%Iz#Ho7 z8>y(IaQk=IQ0=gPi-v0N@7OgPM1<5{8d0(^XrW(79;jcV08&W;;f-GJ`)6Y^Hs&&h zKHyyWrF};}S5W22W?(0G6X+|Z#1oy&tCYquO;(O~po#9_6sB$4hh{OyrQR&1or6%r z^Cl%BjIxr={W)nlN-vt;Hf1(2+qBNDZCd2nbci_=UixKtN+8+}?%-XvS>(fJvjoko zXmc|e4<~C#DaH-tFT@d~H8^R2uMK%9=k&Gg3{Tv;lie}i8QhtwDPJyi{BKZ@1zvKgw>eL%>B29AjF*G44&z z-kYpWOixy)u1t+DRIgSiYBSaGnenOGm8q%OiSf8nnYwrN;@}t)7Pjx8FaVZuBVLZ1 zwYXWWpIdKUf21}(8pB0uZQ?<}hza2aWmtY+pvo|jYCQvcE+lE1H9REWVQ zvRXrx|a96;U5%GrQ%H|rgWOC`=#6+Rn$fmwSo7wMisR|^VbWgGKz!{{deH2Z)cz=bci6uVg!^bR1$+z1CnvaC%`L^J$YT7M?XPsoX><4vF(GsSB9^I zH8k>KZlTw~J4aU39uQSK@BZY#qCDKPhvJo0A(?SKDRUigs@#ONSO5L^RK0YoY;rzR z`D6%!?cvL@7Egl=DgbJEy#cO_+6pyCrw^;(vi74czwO0flijTz>UW{)fr=v6P05yU zgj+zB3{5>UfW$5wEwirWfh0Cme*i5;I+$^Av07`%m^zulkFv_fPfO3cP4|4|5aF{_nb(@MM%G%& zs)E5Z9Ku2si4hfuWCQOgW!#)y%fYe)N~}c?$q9s6^y;yh4UP`u)n{VuN-zNN}|9m&>h2 zW5rZ(u*RhulCcF$8#ft0r>jfK4x-ADVQjD^HM`ef;I=7W2o@bs*Ouw#xBd0B>x5t$ zO;p~r_#LML3B`&?bT|8XO9vs;7InKA9#&7SiPyt1#$+E74>0q)PB$KNT9`+(ZQr&B zxTnQuz4E8J^q(A`(zVf~X^XYg9m6gSq|#Oh$DLQoVXTr+EL;@$pMMbK3Az^R_Z2(9 zJX}=HLY3X0$7(gKF@6_kQN?G_nW~01<_q@npQA2wYUB7)(u1X9GwA`LW zj%xj6(+KIe6H7G!+!PqlXXFQg1sVkdX!Y;HO2cfr?ef$*1?G6R{>_%KI>v9*7;&^9 z`+Badq^nu{@JtZ3Q1;CTH|+rWlC0ah*FhYWmMWc2r2fCY*aYedY*|tBmTJ}JQ0*1v zB_*cDJ{Y7mC_)TBVd(t{>;U64UwS+QDOFc{ZG)jex*fiogZb2vs&K{ZcE(lkQxAK< z9lb|c(Fl;#7`=FBaKim_$H*s+S?zK-1vd-5*EbFv2=jma`LIcH`vDuWNuPAps*d@t>jZDSTqr`X)Bs{Zrsov+ev zH?HF?WH!;D5Q=72G5pz~9r3286@Rt!`xdq-lj7`|2+BjCSi>L{zwLg}< z|B^Kj4)PiX*hCmuYR9#D8={pl%6(DhtEg&O!&h)Crdm+oT(e|rPP3i*6x(!hz?ryN zloL$VfOP8jInj*qiWlHHVUUDqabRngZcs-GqPjP*{YaY`g7z{ zz=aRe#0cln9GLWp83PXzOMr=_Y|18B*f;UF3G~-7{j+Cs<|f@nyj%Q8qZ<1lZTX_r z*iG3yv3(iK?baV21BIyCIZO3gtq~&uf?fa5VM8Z}(aqZtC6K(7&c0acdvt)ZzsMyW zo#3HFRX7!wm8F5c2u$Pco6|L=GEV0$C1_p0)3W!uNo7jkIn;PP0*qR9ONXIE?|XHg zBLrwyV0Vc67%bd7s#+N!9wfK+Qj}yF49@LJH;x+hrFs`$hBrs4DGX(6)_J@%QLN?} zdVA^Yyli{8d0U%X%ZT{h?XP>5(Rq~$6lfJ?y8V!W{RQ@mCgg#P)#u#PW;;hDtwiKNyx8+4Orc z*dE$wYRu!Q)$Fr7M8qIDMT-h_8b-q~Q!vATq`tqYJgm%P#y4dfur$7IgBM(lM_l9x z#qqGCLM3`{=aDT*+-L~nh-`0XKJJ#dLGo5*xirR`3o{!!U)QL2LC>l)+6{xS8)gf( z8$L9+xAD6vAKC~WVGVGiEyZezteJdqVx5*o3sBZMr%__zFBu zFl|Td%}|Sn9c<6Ie_Dy#kCSKNuitCc9#iM|CXn0eLOnaRZmI!A!^g;p{VN=J>%)6E z!T)4K$!2n)WV0@mY^vO;EC7nESzT#^9`WOggOW`}^J*;7oE=MGCft#o5+lGGhC;Y( z1kIEm?^V(Ds?{0Td6M^5Uy6Y!o8*GKE%S?&P8^l)elvIXn{USwfRk5hjaK!6`ms@e z81s+a`)&36sH5K9L&Ft-*ctRI9XzY_<~$fH`N3=GvF`J!g~2BU#}0WvV>Gcb1a>#~ zQCf(O6A7oCUZ1?eN6qH9xFNuQ2RIQ8T+RZ7MW-6yj4{Ca((03I=%x0-aX*4Ve;rZmJMjUz=Lhzh-U&>&=%K)>3%3?968;^5S#`RT+_$jI+#P^s%WaL)M^ zo?+Vp;MgzS%wX^T;cFtBDjx7cAd?LVEG6>PXId-mYMi*}cr9at)ywx*Pl>K#Yyi4& zI=Pu_NtH$1ViXnHTS^eEfqjVTvEJzfy_cL-_|0A2=SlfiE4P@rwJ2rTm+zgi;nH~_ zohxEcl&#rNX4FVznmN=$Ktyz9dat-YZr>o!jZNK2{-R03rOC8R=v+9H*MlO>8;Y{k zrABsQ5bQ(&Atk2uKpl=xdaLHVk4j&uGp(ajom8lKPp39)%~!-=;GD2WwEWHHq^)Jw zeCaMZ1{qt=^k~!R?Y4K*mPA08?jq6+-1PY!#H<`)YKlVgt@mVbo|)KL_nlxw{HFKB zKC-&tj}|B*;QX4;E}|RbU!f!f^RmV;Hcjb&nEVxp{JhR2(_T)o@1M1qq>T;J^%K>+ z+|E>uH<9neQaAXGo6?w4Ppr51qDmaGqbQ-@i8A4B4A>(#*3nUg#kr1*hz6 zS^f2ye~hdAsopi)x(6C_->xea3OjgU%dJ+U!)Y)C#`QMz1|l9+8#%EF1X@rM2Pb=` zH9&UAaM+fAzL=*z_XaJM>Aha%7NlX_r}=sD*}S~?_=L@ix8sEv($8_HJgzy9&p91_ z#|+_|Qs5S+0DIvndY44WjcaFzSb%*wDu*rgK$oWWad{sz3<~!0Cnr8db7hHss5c%q zOv;nzRQ>U0P5*NI%H)h*P3BwuEJ`~;_a86E?MA)%AZp{=Z{Mscm|;(}}wU5ajC? zf;=3PHh$$yCvEO=wb5$EH~ul8i#5L-SL+M)YEWo?;OA}pOy}))@jXine>d(RwDXIV zdM*CM{BxnzrULtIQ(!k+x{v7$oJ`{r-pM5YHko&7O-##b?o7GEV=p&ai;HToiaKU3Dd|pr4Cx_a9Z?$Zu@tn_U zy8Stw(*#@2KqsTunEC`1a5ZSc|C^+H0_cT?c=#|%4?IoXOgi?{$uf_>K@TjIwD)+L z{_J?q5{xY`Ep!hsF}P1Diw$y*U3~%RyEA&6vjc|f!936&Ay5y{2R~6FyyQCiY1)pS zrBTr3lE8;_`a%8WC1oAPF3~b_7%5Wv+zGdw9YMz@HlZ2WF8!8tl9H(-6Nl7-BLC#C zHtvuFT`VO}14^`@I#Xu=00(OGgcwCV`bavB+t8k1fj>LI>;h>~w@xyD^Rrv$rt=^d zyVD_LAPVU@IHJ%JpvO$pYq>J82DGn5xpnW5>3w=a97KfwW!4AX@W=ENLADNVM3BNW z>5`c3dZJXh)Wd`XJ4VSI3Bq3vkljdjd2x2z%nH6ds}3*wr(n&#h#aPxEe4J35iA=? zao~@Tb9!wTyWR6fkI&xO7gZ19-9R~niAvsR+m%@tB>Sb|;aV#K2YW>C6A>2!&^pW=SCK>D z_(Jhp_@P7YO0GuGxa+Q58c#bcwN`Zn{CxCIFA9pLMwa$gZpe|H*CKGCRk@ksv|T9O zY(l8iYCj%>O$bN(YGf6GxR7KFg3ZP=8_hnRBKwd}t3L1>uwBYuXBs+Cb!8QLopanLD~K$^jN4+3jcYE zwx7!$ba1HgtYcKEyYK}CZ6J`On@dRx=v{;0R78Y$W>MW`7Y?!?F(BIaeILUW>4u>4 zFPW5VcmT;@3>Ag<;P5gux32iR7jXD=$vJ1!U~lYS*^n@v%WXS8Pw536&^yeN280o8r{y41grAuSr8G>7I&}zmAu9Kx;rMzQ`2?J)=dGA}v z-_+D@=cY<@hQy`{FWD|K9p-x(4>e!d))_Iy%x?0tIX|3NsS}Nc?~GQ3_n}mBBrr_% z+`T8P>P0+I_T6BH_g#Y!?%2C7L21 z>-qj^;$fC>wulepsY!A0;(WufBX|fFgrW(eU9h2HLYdT{XR`X7$xEC(6&(LWYht(Z zs@lG9L}JYe>vC6!d10xy&&f4PjB6wpBv43ki;^7xtCUDqop{l_-ZH2Ttbg6F{6iuM zfcJY^Kw6u-9dyA2Xx&2A&yR}PUA06a_{@-xL1@GIIovTDnG&{V1{@MfRs3*%wcKl|pP=VHBsETi9}~GJg`I2B(0@aV(xv z)cB+!*y>-@Ji`B6C%1-`<_`krcK9M0HHP{b^6xQsycQ(HT+n&#h)0wH6jSF;H3={w-0$Nu!u? z1Upplb#WZp9?1N_yS+duDHTR%2hF`*wwYVS_O z!eo%*HR&X;xjG^lDKZ0xW^2G2HJNRLCn93n zr=c1!Ut8z@Wez$ccy}%mXT-Alnvw6YpATqu$DC9)il~7Gc%NO=4&OAi zTa`cO5xm|wiN4dJtdT@L09FzDlQtT!=olj&c|k@TnkjA!cKh)lsnU56*KG5$thyMemHULx{Ot8Gnv=`9Md4hQy75`J zC_HI_g4q4jxwxY6q(ugPhC?~G)O}u2*w4xbLB3>QJ`B3Qr|TcDh#ythA2c&NYAXX6 zcr_)f%nMxewYhf{aX3jhA8LQsu+!PW9T5Q}!2`p9_+834!DO%_AXr0o0LzN^PS2DB zDok>~gXi!@jeu?H6^YtZ*hFR4OjxoI)(M;f#{|RF1SO8iHMR<-52p@4p2(ho-i8IU zd%V$xsPq`UH7pu4OJBs=(D1yy4TtANcSGz#4nlL1l5CX*0-Wzl(N($>ObX}y`uunE zp2V$9x~5O`lkz%yn#&bMPY`ZT$qpyAg0KF1BW`zD_F=BoZpS1rjtSitnC1DG2ve$C zTrY-J3qE$J%*S92r>};%u6C%(3cksh(OqJ6urs)QHthK-%tU z(EJ_~1d0w~d^m&v=^bhlJ);4QXPP8aww|RKgPi0%^`Pw~FEpM7>U{JJu0sf^OrqI!HEI$^o7C4| zlqYSHZpicm5`_>BS2#SkoQIeSZjHN&W&$GABg3mn#RttYyqWw&0dK0Q49hg!*Y*;* zhqom>5pjfD80j*eZ5u}5!+tKTR^c{3IetutOw|^iy%p+fk2@{6d<0POH+hy43EmWa zP#J}&fd7?Cw;bF*Aw3E$mP~C&8OX*h`ZTQw6=Q8u%w;iMqXhRT!97ZFj}qLc7!4Fp zsi+SqzLWBD)G-Cn$Q-N|f5S}xhtSH5ExLl|U!<#qW`R1Ys5N;fQvPgIZ~mT~$YGJ^ z8NTqhc=9}1h}r&~AwLW-1$fbrC0ZaH8WZM$;f$8Y-8EXz1F)WpmT^7FYbLHnNomO~ zN|q#2$Q7s+zK7wg7F&>!Bob*Lic^xHZeVRgCo>Vgf=DXir^_HQi%rBqghCQ`RsHxQ zhw?6QQ7G6as!WVCR+$iE2)9#y%IIot%IKP#GMfHKZtBxd8BO;?M18SLKe_R>ZddRY z>Iqwt@-%yzv(}KNN>re%`YXmZZL|?2WFENEjG{SvCG`LrbWi14wdv1jHrKa6||T#B^)RbslCOJBu-t3TJo}6 zTj8&`L3QVd)c3Bpt1I5aXoC&H1}j>!AOri68KF1;4+G3{0}$r~+og7r0M`(0m*fTR%x9KT#0pL^WX^ z&xM$1`~Vm^IC{-7?mxE!yI!~Et{?4-!L|t>BJ6s09iN{F27?1?FxKg_QsQ9d=O5J< zy71z@Xr^>dA&#>6@N21`S`$ioMhHk+^!DZnt@)FqZd2RP^)MsG_jMJXptybu17@6 zbwGT{1zLJ9>&@sS{@_GTX0MYJO$qG!Z=r#o#fdYWMXk|xPKwZH zGDDMRyUv!E8+wuH+4`a=BwXThx9xjUD81iQzq5U}a767l549I?IgR3ZlRemJune2t>|s0Hv;nOngq-&BrJJK#nAbic^eQGvYBUjJ<}C@e|^>+@zKs9j=jP z(`$&8n1=_Hzt@Q_jM5mr4RIAhqinJgEqrWOCRUvF1AB?2bm0rf>X$#Im&ql{A?>Rf zKX6-PFdR0I=IlVR$De@B&~QifL}t^8^o(I5(xiYmGop>iDV&(Lr;{6M2IKXcT^ zU#VZ9?f8VFY^nfBT49alsm%Lx>%DuO1c0SPLB6+)WRICx z32uworPQ)X9R(?Ci6fu`VI7h!>H;iRh~h+tNTRhy=hAabha9jqR^!~EHZ?GRy!4DZ z5Qx+sxHoq76wNTVI7hHW>~k>VcvwMN(w-8D)oz!YDX8zd?n3}!i6Q zvqn&Y`zf@9L`ta@Y3-pJbYa%kG7t1Nb(zz;>$r^I#SdyqPyST`8t}%VVqZ98z6R z7Y_-Zz;6|wsdTqpQ4iIrG@@@ikchq$H!6=iQKj8lQE%<*>vzXo2illkz5D`RV_wrq za1>g!9*Mlv^WBPT^@^or1~{1T2#S#GzO*m-BMs zsv9d#l$RiCxVR{Bg2I+_jt@Paf>pH+wVYBg5=^YdTqrr?24|GNkj^Sjy`X-A644$CZcbf^=>CB&42za?ATi?jc$FpRd05qxmL5=R_-@{;MN>| zz#HS8xZ0xYP;$=w>lc-7{HXFc6?WPuE8$xk12UeUAzp=ik!&5(fNNAmhL(qY?DCZu z^3*JukX$5qOvGi2<&;YD%1$<>HIzc!fMJR~iH6RC-Ps^cO!~fG^||Ee3=(p_uLsCR z_1FUcfdj4C#-%9AWUt73NVYVren(P!9bsO3FU%xqdB3=^c+(U6-eS>dIuJ^=xLL0> z%B=-V71gWpShz<^qbZ!o9@gYc%q%eTVKhSReGXPU+2%h%)UAy&7IY z=f?}mie2nRGBFOZmYC^>F>PD&w$N(xnXl~2SWtdsO>XD5+FenjzElT*F%{9$-Eu~C zy_2L`2=t4@?}Jt+vKjWbr z%D1$XqoE%A5id(MMUg0i+su*Swo4on%dLSCQvxTflx z1g$aL(vQz}O!IW8(_N|iBt`^A1Tf4q9Hi_GnIM~BN-dJ~4PVh8O-ly+d)u)XI(cnc z#+;e!gGOJzT1^KF6N0}xh|uHOgAfGF;%*Y|Y`eFzun@P+i|*JAdwP|UYq&#w2k(B6 zuMz#f&Ct|fa~k=P)Dh#HyXR&da`M8WBD1Yov4wH-mY_ayX#LYGr{9<}X^qZW)TQGI zA}(#1JG_L}afpoCx=@*<^C{d!w5d{kL+0)*JOSND z&gd_Q@_E}-?A#@KqtdM`wkt~zAT>M7(0cY&<*{1arZuE=u^O zW^-N=6BjU7CW){faj%^xbuZ5tr@P7!ir{MoI#B8nr;W*Nqp(|kc`?_1yxeW62V1`X z_?Q2(z(HIlt7M(X*YPBc{lOyoQo239gIlEg`sV!qVej3V<3_e~!M~E@iExlHT@s6Tw#O4ek<_JIl(<>!R`2sL z4zLPjK|}%E0E!g*$x?_EC)^J+F)wy_W@0RROg38*n-taB+CI?_+u{FEl-~9)nOtjS z0*Ol%AvRHkD&idXRU_RQX0dp?20!@J! zA5r-ff;}WNiwKnBE6f6Y2)T9%cGE$~Zc4wY;*0_^Kql!6L{}QYArjgpK0H_fbjgg{ z8Jov;Qhph^@bN>SjeylIuv77N=;J-7;p$Xc2Vo55d7!0{UFF6DK1r#vys|W$O!PqB zcCm-^u!sAOpevy{Zz`cAc@*7n!g>HCoifrv@ISHV0)O)qlFYZdvH0C1y^CB!Yv1{%jl z97-2iKw0to6eoBYg59V|vsevYgcLvAkv9&(J0shjtoAdR=7NwL-BQrTVCgUD@|RdY z3=LGmLJ;~=p9a(hQOi#CnUnm4?-p@E<5}gTof0)m-c!U&keCYl z18+8TTQN>T!77yUBQ!6b$LIhkOeW0|SxFf+O_cV&31%4WKWVR|vBpAX*uXO4_TSE% z?z5d2`>$PxhNJ_;HAi8!NSC!X;O58XDb zb=}!?49gpi?6)IA3PR}y6l%c1G*p>i8dgurFviwzQ0*UyXM7934WaJvcZgMzA*#@Z zde(Z6&GgjE%IMuY0>ZTUsnTs*G@Tj9a}fS%4=L~16K`}T3@INgxyHJs^|Bov9|Wt& zK_onTcu3tSJx)fI6S+>CzVC_9^0&YRhI{!r8k5I~d_4yO(3MogAHTx6g5iFFuo^s5 zC82=Cv~B9TQ}XN*{Oj{JP;{Bv@CohE76~hnbBQ&=hv78SC+h1W>wyKhQwG@owe^#z zH<8_tMIt%C6Lx3^o5|{TB;SwExkO&J5^B#CGr~6n6wqWSu80s((DP@X&(clkT#E1< z!3&zT6TjAm7!6LN4T1;}{EQqDAB9z5rat@qo7)9us`qA6ftkvisXf+rn5n=$O;Gji zWAkc!T`@nYVnp+x#h}t5QSqG<4{_-;a-DpJe|(Ut96H=k2X@yC$+#LJ6-}J~-Vah!!cYwDG0c?K)t&ZxLX_HPCCjpmhz%KBrq`8{q2V@_ zMd~#~;+!fN9(^t+bo?A~{5!ZS9L+=OScH_m<0gr@@l zVL+b0xn$s1bdg+grLM~$1cFD^yyCoFVTQ|Ab=PAxyV`7k$b)GUdhDx74kq;^8Oy4H z(1HbytDipn%isSKe@fF{XPY*ERLyAMQ$hzEN-u6Y_L}ax+{e(&PQ7ogW-2ao4ekLm zk1wU>x^~szW?rpZYm`-gqV2lDjnz$!|2kL^A*nTRoNWF{mW_yh^L9*}uB;jnE#IDF zV-pi2ti+aAmcC@ONe~@qhZXcpQF`+9-#lj3t_bIGs$Ayt2&yqX@Tu=+a6H2qoS2#% z=QEfZxUulW(=E`i%(K~o>v8pLxOMimzT=|MdY`ov{kIkq8Lq|j^yma%i-%j_Z0Orx zDjGn}8%^>p$KK|@E8Wsuu5J5TJ4|LfpObt(eG#7H6J*qMho%Z=GP#FW?q_W(+gY39 zvnCF3fAVIXDxC9Gk8kb1o3H7N=F6|H!VN0gF!GmchMB7MVuF`A7WER9&-^?`a(}$h zz=PB_H+8FKJSl0Vb<=iT&DlxoM_z5Cyjd|2Hv1*JBSvzyzF7I{eX-9D_|2}mw%O!X z@S^s_Xfzvq+n^J|?i*`59Dy0w_?NlHU;h68jC8$1P6rA~2Y|;v{{#>gLTiMG1%cFO z2+k+XG#MOBcGDXM)(erqR6&s;6bLcQ9JdZW{)iwJ>V%?Ry`_-+Q)#7yt(^Y~xllnf z7ArW5N7_V>yXW!zDUAaOWeBSCN2;2J%K;$_g!TxF@<9aa0t}iG+Jh86hPOmV99fO} zZ_sKX%xlE2_YAm=M7@@P;RxYac(Q5GVKhv6fVb!SLEnY63_Sg}SxnR3=2l}C!HLUm z3RpLyR`=thLH7*=3lMS=K*G<7#x4LP{&R>(<|o9Y{E%=-AxsCNrBb9_Qh);P92I6m z_pHsP$G+7}qb8&$QvRX{FRS1>)DcbOj zG#!C(Bo*uVKK8&sh!FNO5bF6@uoeooyaNHAd#)C<`b|juT#mw$*ha7dZ6mp04`S#V zNe(6mJgkE7J`U1>*!dTQ{}n{_52ytxNJc_W+7{6e z4?V2h8}@;IXGn$_aM_8DHORQ^4?pOWB%0v>;{=Ud;k*jn(>Dv~Fo;o{Bheh+C)Y%3 z*|)l5tciDXCBl3)30rsg2@hiGN(|_KRg9zJ7d}MeG-;widga^7bzES!tV0MdN9+9Y z7&b7_srZoBJz{%ly^`Jvo{CaYDLXa9g#xPT1!$yp{k()Qu_2le-5Cy8l<|5O3Kt?E z-Vl#tK*)4K-+_J?sis%gxpkI11wp-0i3VBWRScX;1i5@5oI+?VFI?!sTt>SAiOL-7 z`#3@cFaf8npx-V5_eBxukc!5Md`~fJenoLOAhOoBUqgk1XGKeJyny2eCG-2kDt$1r z%Le8LR|G(MESuORltC->(r1Ff*|$&5K)(rqgfE1?!E@4{7^csK@s_DoH`uEEgn7E_ zMaxclEQd(p>IV>lieEr=k^u=gD-mGt-h)}nq( zTPd$<@Iu^7Z8`c9hltgklI3gwC5PXm!L67_y0&5IuFDqqSVS%;Co(iN_h@05#llhH zfGq`ys6lLp_R(RKql^zot%rU(5@`Rze@^XT(P~nw788WF<#QQRDAXUOUl5~I&5N!Z zWcpxRSpqbEK%E-aZ!z`SaU3mT&;OO&NS}Q>SzETKTLQoE8IzsG&%#*9*mQiLSsHNr z4DMlD+(OHV{Db6E7-=6P{m0T+entm1Mo?uJWIvL2AXl9#;ogVb@o;fFEc#o#zVE#I zN2ZTw-uElv4+NeNy5cIqjR*xjDC}o=^OM1s7)P&xMX#AY|J{;fZ$VN$Co(iNS6Lz* zsvL(esX{Q`!txrhmXd+UinC@#O~FQVhpoeACG~EDIv3k7}P^->XDQ>_@uUL ziDbHx*i52|R9-$Y{iTL{MF)s@W1N_UJgBLqImdS0QU&mc6)ZMm_pGYfbaQmZe^-G> zWr@jbqknn@{FWm64VKy`a0jsW%pP?U!gCG|U(s<$G>L%A4ksoTLIx$~7g31@Jx@*~ zxhAPzU)bKD$i5PBS)YeYv<4=7;wAC&9EXcy6&nDnw3QU8!iq_S)aQ~pbMRGXL^Si` zyO8ksr*9iyRP9L;bc^rQj7vzHAj6M}%NcRqbJIeqT1EC7%~ zC93eAQq~NsPX=A2{I(uOl{M^I)65gl1e$-~vW5-!1h?XR|0cyvo>HeXY!v4E$OqhM zg$hZmA`0bxVpQKkm%YLlil(|Lc@8=^b~yrx7M%RoNOUyQ+@TT*oo%{$vu2kZ&8pcA z#z(ly?Vxqt0#Dh_laaUl;0_$4q_O;klbj1O+kGrOU~x2IDv^IITa79FI`Pg^FNvb& zKxv>Ba#=$r6{^8_7X?L(TK_D1vmO&$kZPP>^Z=o8NAEHeRs_qmb`NOn?#Q*{lQoBv z*3q0DKv};K+nyJxCWL+91&8>YqKodIt1?-yIHkTSJS3sqCwcYr=)UjU?yU3!JfR_k z@}tXT$FgaS-3yz-Z8)URnnlB#vE{=*K zVSXzrES)Rg7^4jfc;}h&_>{^HH0bz~i%UJOsKz5t+e);+;CrhLA`3gzfo$C6+S9FT z8@j6M{aC6fRuB4ffcoVV!xlA9cMQ$MRs%1P1yt>oi5T(7k&(RR$SjgbR4JrbrgNQy zR0ndi948zT04AiNq%EnsOV==IJilXU4Q`Ai!b(-qxgNVWFT(r}Ez_{_5-=IMeQ*Au zP(tCpW=eE821)d@rSZf-Ebf*hmyw>c7!*E&WLI*o0e|yKhN!{f-bcvm3HEFw-0a7H z1RGsN+Cd!=Ha6c?!QTKy$J6qd4XrFKB2A6JzK05E0_FHk-V zYTKF@)%@;Lvd>Srn-&Yz(b zeUzYeFonZd)g231<9^qKLYVuSwcga$^CKL;yRQm|j}3t%=Pkv1U-1Q3x;u*Myg%Xr zD4Mn%;^|oV-F=xvRf}G*tm*($PQ)o4%*n&$#Wvp8z(&39u5gdD;yFguQ+)Hhg}m-o zRz%1v=vf=^7gG@v5sjV5Vzxs}4TPa^+-`qHSnX3ZhA|f8ci0qN0hDAbUH=8zMlb|F zb0CY5B9|9+9ZX?LKZ5JQk3t2qYWH514IX?$jLw}XK!j*-(;x;A^zWr0^-}s#`V2EPb);N={u>R0q9Ldt=@E^h%S*otlAy5Y=e1jv?D@D!p)6Im+^ zMttxOzLuyrI6%hX9v(pPh@s2!A_oX@3jlM1l2wu_B0oe@#UsWDH00J?#k|R2fp|2i^EDt19rzXlXA{G%Z^p2GEa?1!J zSrS@+Pj^8(Asp{8{ny^-VRH{ z_T=S*vY!r-Wvq8S55VG7V-vcl$VWsjD&NNR6(q_Dxj|AcVl)vAEeqtxK=kocN#rCd zVmR__5wnuueu07p4DyFhK~&jKy1*~kkgJ<(rK)XtnqlcRB90kg1$^J;T8!N`_+4`c ziNAjv5%CiI9tzU?&!ZHM+0TNXP?Z-SAJ*7@TEf; z6DkA#-xaIWhg?Y(oIhWuBg{_9Vy27)`&Tg1? z!}Q!+3b^l4Na=qVNGXK$SkA;xNxFw6@q(26exe+Pm?$VBejIaQV?{NCt9ZB%rLF5s z3o(tbYJRlP(BkZzk5m7+hka6TEAGZ3W=h_YAh3}@t6KINu+xN#Bh(rOerJ&v1>|}( zjv^$iLpQ~D*sG8n9=~~O;-IcgQf;wm0@)zHjqOB)E;sUadsYN>N=t*dx=YsL*NW|X# z7BVc%(=>>|_lK*G^{Q8LbQ2$uFY2PUxtSvf>cizlB@K=#Kefgqz;K-)5dDMTzfiFg z#A!*+K_#`8RcoJ+d9Mwhg7siRkzx#|CYc8^Hk9%P_FdCm`~({jDDahmfEj z5-ch{Xf;64qu3yb=U6RYODGGDMbSz5#93u;fa3XA^03J;c_|o>eB5iiTrRO0aoWCI0El3}iE@Z^w96Ez9bjx9NU)^XB&U_6>Vm zb2o3;&ic)$y7|rh;s#KG$zx0O9)i-hdEGI#NQd2STGRt&G%wm~>DJftw?|d=74?`! z^HKn^K;BkVg!}o0Xzfo>3rH^gkMh`y!Iz)Ox?7)G1weyJrVxu-r9R-l`x!p~1pSL) zKly^)RLO91HPefff*)Xk$kTW|dV;SnFdZk!Eou{UGCp|w2d2zj0q{<>U!|%W_1DN-~Mjn=$tK3q+{dUhu${lNECBm8Y(DZH0dFDmZG2kQKabtnpU8+7rlY#Uy+&d-e%-PAYhwxzQNy2sCxjogTFW#xg8V;|Fs6;TMwhVV%|h$cQ) z%(6EivOl4^l{E^Hubc<%JqCU4`+*|>*#R`GOWydEOyQhud5&%7a4P3yB;i;@sm>+Z zJu##}+^~?%k06ktgUmBRlDrZObjl8*h;=(Wdy*m4mfFO3(WGjp_5l3Xq6=c@YvK-< zObyuDH^$U3$OYMctN2{Oy)Z}~!vKW@P~j;&plS(x|KqXDuFAUVgwhOvVIcza$WO!` zA&TlCQhBIk^&+T{B$i)X9pnLDV+pj$y5{CC$lC8RPPjpOsTd zsxHo?#Db%VxjP^85%xV=?P@TRa<#9p`{uDIjRke3CT|s-QKZdRT!%`1cQKSyL?{t7 z8ZZ_qV~+OP=~!8!QU*jiAso?&-t+(d9Rn1oK9q?=bNhhUYTrgDUW|C)b5F~9!{&}? zK0%<%8G=Bw!+(+sM}i7^e~9LIc;KD7N>wwpResNJbp*rQA@WH#FXB}B_D&+-fM8~l zhThLISR3IV{BH5Sa`=OOdWY7$;3Ir0g2qw`4h3-z);)qG974^}KoWcP5%FIo=U#n> zsm!Z$UkSW>rItO=w(S`{fdG-~RrtLqdI`1Q^Ua4?8s%5CyLVg3G)Jhaqa33Gx)=j1 zb|ehy7#Q%q`>AsIdU^LgEMeBE)(ub3Q_?|A>g^%1`~emIo`xv#QX1e?%YhQ5)MLd! zPAD$Wzgsl}LV5TTC3GM$`uplB61O(EI6^#2B<2L%3x4#PI2bw?NZ%zFr^*x-mgoaEnhJCslH~cH*?i= z4#O6|VucX3z(%zwuuFb5SUuDlBi^Uk_txo@iFQ_{9{;lQWcFUcZK1GkzqkF z6n4=MT0aTWRHf)n1;K>w8sJsw5l;By2$UTixrbsLgDiH2wPrgFf^Km)iRoKV4$#mn zepWW}(-&~4a&KV~gF`AfJ~$gAbj(K}W3aRk+iwXme2;F%GXXW(MHO>`IRNq?L_bL4 zhfP`~jDk{kr1S35YIs?<9w8!JY!faL2$!fQfY)zQ2L z$+QAO9Y`sTrC?swCNyf zFaD2Ha-j-jS^q;*cRhC7cGh(#H%ZM(W%;%M^0ZCL$kK=~a5I27_-C{*+YmoYT1tR0 z;ESgc#UrgcIsnxk1c}{t=U(VP#h(b6S3-6&&12m z*nCcA%HMi^NlgOPqYL)lTGLDh*r8byF^LnS@yVUH0{B%zdjaf254M)C*2%oZ@%{Oy z7_RHj{{dit5Hd1|o(3?naAiIoe$?-N-~j|e{&MHHfyqpc#A`AGo_`AQ_Nc{7(U`p- ztQTlfaoR_aQ+}P3+72bwOf=l6PKh9d_5%1mY)C=L$a{tP?b=&T@BlK{mg9D}xA=g9%hcxoP4|c-crZ&OnE%IfagxSigOmAI+CxS|zYSu~Q~-(O+`o9Pata zZ#5#^KrxtOZlqK2MiwlRl(*=ma43(|_m}QHfF4$n>%O3dCV0VkzpNl<0WqR85v_(2 ze~7O@e~}X?1r||5^}^yPfAgWB@--?AErZeN=)w&PB`CRyQsMb zcAHQRovZ2DTvB>fDxx!-(rX4{cWt5<0U|^Qe>``aR2?3!$x<5>lA=#!mw-?SRc})f zi4sW+1xRG%7QaTwhBiQT?D2Ce)Tq&{Mx zDE#30TMGUV!xBBMe_em0{N8S^G*|VO|Jl40DTr=-J9k&4vLh7#NsSL%Kg8OR zDc^pIMhIHi(BDd?3?y@mh)gPpz;nqR>+ha`p@Fi2(zVz}$ORuv(yotl>;x4c11ytp zGut&V>Nsm@=8kLRM=a-NFX;N2(33dINung2{aV`4(xbv`iHbBOPuE^dMZOIS*!<)V z=}*07#KZvyaxnZ}x4-KplMxoBnn{+#U5Eh%h> zHRpg-+Mz7zI1ntjg5Ntq>4myXl13#9HzKTv5W@IP%jY}vp=p2;{z$zS6rlRq;72rm zcc0y}fS@i<7V_`z8!DjIPsTGug%el@H+)2MzV@3Lw>5F2r9nZB_eG3L=%Zn#5B)Aw zVc<2w6e76i1l4p9 zS}_uLAF1QVP!+6CBvV29M2$t@ktb^t5+Els@)|V4;s+w+4SFbx?(P+}2)8Hkq8a+lOsr$b60P{{--_H$vr9oi-(hJvJEi&X4au-Vk|p67h< z`{=~|gWQ19#Sig2D9MWR7oi^Fd+`yx<%aHCq2-m!`5R5(Pm)?2g>#U{J|l?V%PF{C z;P?f}CW-?3fa%}}Lr_<{8Br+*6)%{7^-l!78W!e`&sIt+)EUU1;GxO~r_L#CaG@=H z4;WRZDNMeu#8-Q|>*a`KoLro%b2dXB6rFts0tiMQ?Tfd-1`pZRVU~%Dyvj2HCVU^W z(DrD52;6nx49eORto4r2NPLcu>LU>2o@P+@S9?BJz`(o(lBDKCR4;;LS;uAd;Exth@ zU-|hX#8VG!JP~^1mTYd^)b;8HH*Aa(v|!&KHwe&`_WF5my#zKfBPpEq_V`xeElH%3=1zTRH|`6updFf7P+5N zDmSpzjx?toc9>4N%Wy!@_GjPh!LXd=@W{`g=x}$t)h4#^eSr7Bwb?DSZ zj&p#e!7>a$ydMs{7YuEPs?>()%KK@3!8FsgSyeMlJ+B-vdG0Z#bOSn|c#q%IHw1j- zKOk#D1+vDJ`T=oFN^a~R(xU))eImGc0ZF0{?X%k{1sY+Fd2u2HzzG@qzqmzKr}%E{ zc`4D~5@qjVTfad(#XCB;)MpnZah;+fOz*-lGMV56_+i{uZ*iEaJ zCwT43H_H#gZAhMCJaW%ZMXI<}0OQ75$xCGbmr6iKfg{&8EhV)|ToFq73Dr2X!Q=X! zkXm6-Z>(%M8H77MIdQG3l2)9i>v3~ef5H_Lh6Z(O%W!NfPvi!Ts@A#<$e;1XBIB zP6Wgn-#DVSK$O-|aI2~o1Q>?QT1vj)p=I0l0GEjKJFM81FGC~&*M*WwiW!ul8&#d` zr<@2Giq{Lu3lktB2!Sgx%Md8cU+Go|$1ao_v0I^UAu?+GYqLxD6jdY7)*&j)$D}6z z20;2Fd3u?igWo3(!MDv+w0+1_ml@A}iVN)$L^>dxNIqqOMR7?;?)J!mns1{-LuX8R3C+&_JyRfh)0^Kuv(^4 z0(O#6F(-1`%S#F9gmj2b#S)9?9R<8`VyVU9KyKV`ECY{)W!<%#4&S-Ct9TyzX8GQ5 zNz!Uj9~Hi=pJ>}iEZwP;ssnuQB*-)-M4vmA?)#E**L@1exviFJ52<`gvC?)w+WfTYVb_&xC;L?AqJ9%1VACY}5xphdz zM(80UFo-BU?Q>X5kr~5&(`>f#ZKZ8OaR8U~k-kbq@R%jzcWgARoRuLGEls#YoVuii zqCMO)MbntFS1rkQ7(o$Ty1QGnpNC>l!W}ON+DDyK;#Kt9Iboob!l!#`;U78;$AHWL z14NB-(FBAA8u||Kdm&do|9779Bb9k1z=z1*O^V=&+AV^P40Irji%!L^Zs^hIt8!01cuP7;6 zD?l;yJOhhK`R>NV$P823H0MMV12QZnYaHeXRf9PSE-RFoCnOcw%g?dY={ac|#Jy5& zV-Rwo$w=ZF4pQ1d=Wgowog#-FaF+&v|Jcef(8cWk>AB4ml+M*`w) z#W7TZ_fT)}TvmjNbtXC@MPpN+7mP=>4q_eLLNyf_qdb-Y%#P5)2pK)Oun??xO|V>Q zaUhEM2*2CbL0z@&jfUoIELb31M(uC^YHWN|3XS-z;%Sa2Kb_hr+_44P4=7kGBD~7^ueaU<-JomyacQrRBo9g2~hDyv& zC8YjT_?hxVJwO4WS{3}(fy(HnC?VOHC#3fjj0LsW^egV-IvGmR1w4pUlgy5Carm;M zIE0pbd@5LSds}liOI6#^OPh`jwYjMmeDq2eoaS_n4+Q94aUfT#U`MZB!KQqu6?>DF zN91FDnSn~J?`-OhX;>S~!6kO?)yBrh{wj9)@G{CDiAPR*^SbA4x?kSBiK27EcGhoh zZ*NQKDS7s0$w$9uA@+xlur7N?a&aaw5| z9(+Jon(tPAVPi{|9d_KVt?)!oR(MlBFqYuL0}trR`m80huG@4p;MiT%JlfJ&FowMa z7KgjG-jh99Z&zzH26ct0J1W>Iy5n~F;4P0%^=3Wsp-Xjo=rk*vto4oHV(?436rRCbDF z3pp%@fW{MvI`B=fZf{6gjG(uX%IJigo<^M%8ZItZ9~^n+@*CyQc2klt1bJhhMz6vb=z>YHqPU z(zOi>^xFa-f$pFg8%#%aTffmTJV!@G(f^OWG9zAq`tseghxh z|0{VSlCbT)j2$~cKAWxsXSmU|X^aqjsQ zs8GKoNTd(i zG@(@T2vI>&C`Cd~nGC18wDz9rf%a}U9l`twc^H} zs?7O}`VW&nhO&f@dvWp~p^Fk)75EPrP!8iitzUc$>zniaARl*}Oq?8|D%^`!TZuXH zrx}za4f8Ele0@+@ZQHk>4eD@&dT+g??k}QJ0&6m;B!a&@mA#w?U795o1M=^lvZ48~ zL?;Wb1opRE_%nVl!9ASFK^agkC^Tg_zNeAy4SR|v?!}3taN9?=Xtd}rp-7cFQTgny zc+KbP5hVEX6-kGU_KLd6T=B6p-2tdK1Z+M@ zQ2Y$bj}M4y==>R-svtF;Vf$fd{+JTQU#(8)<(b-=R$W^g8y&5Uu4!u%W3^g&b!K&D zd~$3?pBS62uJtA|q&PH2mEE(pbj!1y9n1#J+tntJmc8N{O&d!pk}lF~mbrf+H*_#asjL zWUTcA3&c;Hs7kY$1RG0qZN@LZC9*`m+`nR7n&RF>Y5S9|6%&Ynhc`?I(f)8dM|846c9QdT`K{5O;^)}e+Z1YBM4{y8?4Wizu71b~ue8gvdYt?}D zO;Wrm9ZnB$uK44DEkWh6s>lg@k7BxknHwHV(60N)uOhqR<9X&c9#ct~kjbnNEu`ZY zZHtxI1Kr!UosDoHi+^N5$M_O!BA=>$Yw7kEY}+wBPq&z1vCSQ?9zO!E5*3ljgk}XL zp~+jd8|=32tOHKQHos(dbPMCkd;(##j$YR-7t0WCJzR9zn!~?8XV>)K-DeM*-exl% zVo#THnjGs`6{w_~zMGjGpX7GNHp zLN3DR03+R1LX>O>lvW1jP2xVusxaxnJ%0F9me};jNNHjUmeOP84nlvqNBqL)ew!)} zC+m4{)fE4TE3KNL2VBusO2@drn>8}bo6r>XnDl3%LQ|1LQf>78V)zy0Oos{DqjuX%s< z+c&+ED_vxI}NTR9j-6G)_2&fxo-2PsW*~zW}YA8w!sY%o!vHcv({%r z2Xxpvm;2lNZhZ2;Z|5}U`56{W)7XT@hI38+cl*KL47PnvpX9Gi?{EH=pF4fF0HZ7O z3$uMT=KJh#88;%wa}tZWifcT8N1E(6;n_%9i2M(GjV8M^Iy#mYjgx33XNA2jmq#!3 z1M|FoV|}W#Mn}e{bE0pqN@tDs-R9p&T8R7)dyOW$G&(VnYn_!9KS6mkwqkvyvt}16 zrG#h5`KUo_jg3r&kBb4&S`(9fwh$Xh3z7d}uhC?e#-{UaX=POrQl9B=OAEDD{26jS zYS3C!lMz?E|FzcGbU)f!v4zP0u-9m^OB3Z->L6EID=T7|gyXUAv{wHe@fg*b7@Hh4 zwKWlsHspLIHWF7N|Knbx+5Vp{R9f&4zT@vse%KON5%A2+Ur5`r+eVoK>HHxGy^N2zLH>f5_H9i@FnJkHh;#ucQ93 zC3w{o++s@rXI>KaPa-sOn5#PQ8C?bF%G11NhhcX&C=q&s z(B-&vta3xHF;~}|&kR1?tm#`f=`idwk-BeK%_nU9#&p;LyPC5qDF8Gzl2HI?=wa1k zqa)?X;SO=2%RSc@Ofy}Zt=Ua(BpDVn9#+0!vsTTqjoKGj1BR?c3@5X+s=2^p`ml2E zJ7#Z6th>A8dV0gX!EWKlnY6Aei%RM49>9CLL({ zmlF?$T+H{j;nf+}U94(5j?NXRt9u@DHf}ohmQmxH%CniSRqILKK)&sc4rr@EF*%xj zY;$Y?S*H1yzyBwfxtn^`&`h=lth#HqBZLq1GCd%xX`a?+Pq{=J$Yph7y3 z=L@Do>zU0R=GslCs*8FzzWg=p*g}sB1Z>52%hh&+^xWLaa%q0~)}0;-V&Vywaa|ge zrOk}Qmbb4Ay;+wv!R+StT$P9pjmD;_`?L-27tC!|>r4ypy9~{atZ>qg46Z@8T{idN z4)mJu^f*^?zm8VORqei8m`}K)TRAqRxaGuFvuG!qC_WcKR)5oEFaLgNxRv5*05{*diWh}%Qk8*+cdm2%`{!^ zuDf>Cz&1*FW!nTC1;2tji2eoqlNACMSovCqtq;IMd?uN2fgX@3^N8sXP-ecPKvcKB zITfYri}4-%T!B6z)PawTlO0Y&)aQcBT{8J4OivNo zI>Oi6Q%YY4@ZRX;cp@0@!uM}(4<1NwKnSn84%oX6;J3ahOiQxar?Y}J-M+WPP4=0o z-q`B{9@|K}X*AQ-MtfPwmMC&r@#Ny;GQgez4nj5$E(EZ50{EST1LjQxv+D2cKQNnj zv^B4gy&lS5PPJcF`H6)m9`p^g)-iM>9-ditg0)wOVfVx^uNp8b+|2UrIW|4sD?EE4 zbNOKIDO`=~C~`fexGO~N^H=SDKZ{&O?A3Bm{jh$q41GVXA1ogm8k=9J+~of=n*q3@ zSjuj7BPe!aKQG_%Tn6NV#p-ow^=_H=_L|{l&_kwJ!fsj5#SZM}<>Mwyv3hASSIJ~p zN*h5$q`*nV-ddHu1mj9(Q2cG)GpAm(-5RW7D1L!TMpFcPm7h|4lbnY`WjR z>9Q)m3~#!*V$%)Ern?ne%bahz2X@}}TvnyL;XT(Qj;3y;^{?BWn_DdPTi?Y@j=IG4 z%c=Nwh$de%@m-j^)n~$+#gS3SZa>QI-0ebk3)$^Y*?m~ZZXvsUD!X$l%Z2O~vfEyE z;h(JNZ!qtEEE}<9)9bM;pRk+l`;HLJu*;zH9K2}HJ%VICKIM*tFTBPy|0z3vA+p^e za0T(PK>9n9#Sgd96d86lcWVxqfL@DH{X=l4Pd|M8F~;jcTtthrbAS~%!Pa)~Rr(;& z?hcR$Z~2g3!BE6wc5JS9L*(<{!>xeY=sDs(0zMp{sOSJ@X`c^5Kp#pgb=@if=Mml> zpW-8YTuV}C@3FvStFNnNJcr|h9HvCD{l5qHjY$zxPdDQv^ z>3QI)=eyWla1Yk@*VfNK-6TLLqLpA6k#Y*_kc7IxnK^4nI;{*^* zT+U&>VEWk5l2!v4*|1oiQ^GH?)=$Xjb;J;h@``qaO3F0=Qw)eBkRbkO(Md%)hbWq8 zrTKA>e}0J4=*#%0Up}2t7gL<2UFg+`FWc}%sVV{my>&`^9)5I);HOW&-1u~Q>J@Es27!V*}Zla)6oL(05APj<&hU6 zjF+hX63;H!uLsJc9q=(eC$KRNhD^KG%hnlfIH5S8Lo)Px#;waA{26X3&?p~|k?~UO z$)Ci22%Rt3^Z6NUsT-j?%drM$bn>JpjJ7jnX7Gaqff<5r!}$IgW`wQ%^h5k2-D5Z; z?W$myL8^8^3rd-ihDmr;BleBxS`8}Ne|$WuiO7)_F|c-DsPv?;HUKsko&lcA$8@s# z=xlXSU~q6FKGR5Ls^0Gtx+!mA=st%eKb+r#e4ampBjOP5sd!U=LQR}F1iU(eo%d<) zM$yn@alA!mLXIlDbeCI}D`MR|@J~-VP=1K|NXKZRpudA_`~r`sxV#T3(E8vM+Xp}I z7*PFOaSX#UiWxi&ZGY(0{t{2~#0_zibYx6LGTHiFv9pQY)_<%>4MK>c_N|Z}={SqU zY=>y)$93yp@sW1NL0oepb#v#91P$9N;-~x*sf0)4zP6C(A zWYtkO3@*7HU9nuS#0%pn*)f1P32aeVL2}ZB0-;^INB+4iQK7v6KY1bS11<*p;@sbd z-I`dplVH6>0%1W^4J4>@F$sNm#y@;5^psLvlpK(}4)r7jsc(9hCC@37!L7B(e}e7n zM?DmloE}{LAbEYwul4n#r9$ckQ|fMJn2#l+4C78%4lNy3 zP8(T&zF*ZTwv!Nzohf&W#*Qfr25J>&N%zaWdlQ*$SA5<@&r#+pf1*Y>?Q;Mv;gKJQ zVnQi0>@nv90!b8}08yc+lAk@LSWH~*AS}@O;OE=lllze1nM894!H|Y#7ltE2OA+=D z;tJ7R!6k1c9k$4HDM@}lnA!Q^j`7iM1`xnm^P?$B=tqfZi-~}7C-DbFb&5<51uz5x z3h)U$6&b5|R7$;33ibxB+LB=vlmm^8@kA&s(m!voBh-nHe1N@J62Ck_HjhL39Nk(8 z%G5#sDIAQ@PktndlzR}l!*HOINNXFmdxp96T@pbRrw}B3MUoJ9E5JL>A({M!Pui!G z8=p@7Ovx+MM93N50)9X+V zxz@Ch7c@0>`skG=9I>wRwj4vktb|8&wb1#))*Hw$9JJm;ey#O^@_$Dke?*w@^G`p7 z#&fxQT?rnXF!&-9e-0J8KIR(0n3%5OPxFD`&_}XPz7acbsA`+0;Sw1?PQ60D?<3n2(w(w+)vrGlw^ZT!0p$3Kt4({d z1UPLzIO0H7&4-fW61BtE;Ta;1Agc`Xs1(9si5Sh#lao4q$oLhi$6L^(8fMK&d0$W#`H?3(FWsd zb?&7SAS)6_LQ);BJ(8vN?Qj`XCmJX65I~ej^;JjwgtEB=R!^O3oPhT@0k1>tXI2iD-*UzkhRk@X#4(-bur=hoP&>jD2vy89AM9zw1R`<4P)b zXU9qt<-GN1pP9(AVfN@q?0E+#@_MBquD%f9Jj!oYz$j|?K0Q*3_311mxPK*htTZ;A zLF3gz1s4L`B^8`Q`7Km%A;F)cf^&%bDpYVGz@K9U-^`&57izeW;?I!cLV^nk?rRDD zdLf4*To@9C0H>OXTlYbL^VZ{ZCaaP!dfYFWYcw`Z-T8vK4b8+CYXIccT(&qLD?uuR zyRU_NwGi$?xCd0Y$MPoISvAU~r)9RK`w4p?*7}z2>}=O{Czc5>M7vK#8~wu3BEZ~l z65Px3ugi@0f$cH3X?TG5LU1>LE5872+Q8k`=R$klmQsS;%fD*@b`FF^nMB!%g+GFcZXdM<$3( z&2_hJr&e-3+tJo#U1s|scZ&#ONeqltXkZBw9vNZ#Hd!B;l!KQs+TuW`NV@UwuQf?We86}0pI z6KKx5ZH*eWyjgqW8CrWY<&hYEvpd$_6)l>_{+5-$WDWM0|Ly-{<5T64aW*tQ$rg=U z!vM8FO21#QP57|yc2d^#gjX6u=|Vi_3MFM!N=kWVd}5Lfm1hb`DI_H>DIg+azO0On zPET`L87*X`S1aOXM0NVx4(6;9%-9}brre`k%@r-#CLPQVa0`w8ujMJ&LDOOjIsC(} zk-GQI7P_YDc9RZfUsCwFJULznN+Bq5K@sP&FDeskXl%3)m0m5#YA%oEtniex>~<3} z^rhLFwn-WNAP!!w>x~|P@ULhwtF}vqZ#kB`EOt?r6Tfup>-pQGB|wIha>?*DK9W_{ zmfCi{Jk|+OdAX_mB6P*eT_Xi-Yj82#S0v&F-{u;n5AozKk9@&KMhZRCQ$3Tr()~iu z6nf@L^~~f*p=WxpXL5#OFSJadWv*1ql)qqO{i|>rpqdcFVwq_|f1d zl?AkW&e7mGWnZjz&)XYxr0j{+?vWFp^*UheMkmJ;F>@Ebe{;LQ()E7CgWF>x{}%M! z-ik|-(Ok~5FmYmfa;7&HVd1gC;8*T*v;4*=TUySY*kxI!H8DCKOBnW<*j;SD=UD6( z=O;?5WVUmwFlUli6j^nCj1EOs`IkHlOXXJf3Z8}Ebe)1{p&PsV=5~jw$Fd(zNObCz z{?~qqBW}i=`Swep!4)q4|6G*OeZCMCu76QRcb$S4MHyW;PyC{ct^i?oT~dlNy8Nt1 zQ5w~E%C;ztDwJ(e8dV5NQ5rS4$8u5BQNSRt7Ywo}>d1qhDT+D@Ju}#PrYP#jgPtjh zItnc_$Xe#Q6m=ve@1vB(>SyB}6ZwXRv~da0qq3&U;nupVJS42CWGgGrdD z@X)TP%ta6gAGY2A8}LEvJ@Wc~Aa38Ik3T{s3e>w~pb9QE-jnm)*6I1)$74Q1U=jAK zaateFchC1>xWp_BpY#9zU8$xyK7Vmh1x#3Grc{}EQgV?=qep;`uNS@(R32TEjeydc zPwflVde8rU9dJvxj*u++`24xD3X;(J{8{UmfBi@>U;{5T|H-El{{K(;x8QHa|L1^S zpYdy*zy*IndD{~N*T5Qm{wsV9)=sTyZDL#DELU5fn_( z<8V0v!fN=%G2HeQzxqCZ3b-==8}E36gx18IU64^<+50!Q2MXol4T zILZ}`|F-RHYrt-#R~@~&(|3kY|AT368x}WA*=<8NYi!vivM{+1ipQ=<$KzwCi{tGA)6%RJ2QJ9X>I>7MB8D8zzk8k?R`Wphpb zcWgr}%=O=fSPP`TG&bGKp7zBK=!YF(A>K!?G45b9&(SP*(*|$K@ak;2GFw{udam+6 zmf2SMMh0!Gl3h9Bv9&&+Cwc;G9KsL$@6xqL@V2H#?W_9NM0 z?W>2s-|pdqFwglux6j&qOZ3eW)GQ<`(a;f+wg8C>zXHVt;J0u=>V|bpA%a1f(KY3% zkRT?QxFDtz7qW%9xzuxTH3L0=@#%+;d+h>0ub_<>{KxqC!;v41Pr-M>+&2`&VW>q! z2Q(z~krQwtcTnj0t|rErSU8>)0#(fiO-#-TALdqc*>X`)dA{GR+0H7tq|Wx#R6Zwp zm+y%KuHc@vj+l`4Grluu9{|_X4gLy4yU;uk6vP>*&ejj?-q#CT<82F~{h~;Jc_CZ}?$+i2(Q zVyQGbI{pQ7_39>n;S@!G-Jbo4Niq8qlf~?Jd-lhsh3xYe#q4)`_9sTmH2eHTG5g(} z{jW=-V`Dh`9)Gb>%zn3Le_GD|bTRu~pZ)QX8Jd0mqL}?|&;G;|>3xsCC}zLAvwth3 z_lr}v>$9)u{bKgJJ^QNOFJ`~nv#;v?V)nZ``v|lfkMm>~v!3~^k4{XKW3>3iyl2Wt z{&0S&G&)j}^5aGqNcYWHqMbkCdeKGC+v`?1DWA)O-v}Zo;)8&~$$#l2AVXaoz zizBrs(_S2@J(>36NbSkA7e{JOrhPzuo5TSpbTi-zvH+PYrSnqHkh zm{FysCsn(qyQPL!O$)ZYTCS8u8Wo!jjf%~|sMyfr>|ApD)+{QL{HmMQLF+X#jhq5c z#y%2T5bXARm&U{hcpJj$Mr%>{`w}!L>l8%Q3cNUJy@i+W_??cR?1lg69l!o_)M*vsnvj_Ol z69StfKK)l58SvITS0T#)VMfUNdmq6JH}`uhuiUTPtW@p~Uoe3Hl|CSr9Hc41+2D)9 zmjmcSh_gggtI^aZv8CVzY0QU2cJiK&`YFETWBP#KJi&Fw2ZU?v@%7jjPa4R|^#zm` z9eh=_$T#$?xo$g#S8sIdyzAG7J_S(Le}Wt{vyNuj1aGuFQnVQy&8mGZkuJ_m$9XvW ztkGa!`#=8P9-Ho(=UMFSVs96FyNi1}f1MkOyVsHNzC^6sL<;CN53uA0(L*LPBe^=MsI&0W9y_a-}iERp|GZIDd z{I;bt*;W1vwx+or)3aFwScbOt`1nkW@bmiF z+F7xksE5zkbSH+cVsm$4bKl9~=I#ca(b#m1*s~D5F46_q=1zHRWTM1nFmK|Q6>Hu~ zU1#cZvt*S$XzAt?uUi=^)&RBWAVe&SF?7o zDW_|EpEp?5_*hnf-+?)He`Dx(%#`!b;Wv)~h=%wUlf5C6Kayn_fYJH$4fd|yE z(WeexyAoU~z%s<@D3f{J*ndTEYWZ zM3Jt710}GF49B_99l@46LVh?OPP*{dZ(HwCsDN7ryNUXQIq%?tETG8g*1~2L2)=DN`kMVD zXfOHcW18{B&@LKIRF@QA;O`F`C4<|uL9 zW1!K3gE(?B(7FH~6nwKEo(e~4UR(N;g z)6Yp(6PR0qFO5qr|KL@q@ibbU$iB84K(B^oE8kXzTR-?s%yEy1eRagIcPwpQr0Uy+ z4NN8)ynKb!Z2;eTalZR;5AK6(Y{9o8h7K6K$8_Y%U(@gd4nMVd`XNn0z@dlqeWyg) zhZ-b2DIbsFscBNg{uEBaK`^pk_;@;|P$8sKU}i8ITnC*$jV*=L zWuQRt#xSYS1pEX!`oI+te1E`LM#$wwmEqxlFaH6XS-L|+8& zNmoSt9MT5va(x({Fqp`fL;(0Bx+o}UdjSSduBPAcK3TD4Ap2o=is%bppiJQ-2ac8^ zSyDFM%SQsSelEg7sJh`vPDlV+!e@IU1zCM^+Ir#!Twd{PI0CvwAX`k;j5Cb3p9(?>qX$I4t`7s%d=R)+|(fgix%zOk*FW@*E+x2@1_pd;=TtcV|?32iKKaK9EDyl_+4%e1GBz~hGRfi9Nr3V0iv&LDkUXD!M=S##N5Un#fg57D}_>m@mz?G`YI5AMkX-+ zK?^0eDX3;V3DC~LwWF~xT-|qYWCym9lz}slGZIPoGjJeDB*4@NQzw(`@hiV25qb_L zk+hs-%uA$7@>u=E`l+711f(}=F1-#EhnH_e~(QT2c%duB&&jrQR zLh^7yehoi)!@esmBaFNHbN}T>2r|gcSZPtHx zA00z3kMF?&N}z0~Z5Z0p{`XNHT zXRf{GZEKERk^?GjI(#_BrrE0+zls2!o~w9+!i3KHxydg#i*1x^^@)xz^|mKs7H{SGM5nZ5Ux`**!Ptc@ zj{dvo`NL=JAL03h-v-{}5oTB*=n7GuV+g*)s zk)%0t_aKnr2N;8HRG}b)@A14tb3$mKXW;*GW8j8#Xz8Fqgc~_NZy*c}sXAp+{0$&7 zaWVv*D6@EzKx>Mm+3sg2v?n_ztw%cB&~{aK-8`AlVnE%>dd0J=5Q}<=9kPy-&XBe# zQ~WihK_Z#S*R7u+Rvyk_`MHgds0hU!M9%_S`iAHbhN13VSzI>oi#|e2Ha73O`QiRSMRC7YM0{nm*IY1LVZG`nks z5IGqcLV1~eFzw0bkTMR&rGP*L+X4epN3B2Mq^O>Y#0Z4ahUie7iqi{rChicqKJmE~ z28VxR+Deg-_*p1ZuHNk+w1ao0mqh2Y&dwHw{TJ) z0U#J7wcuf+&jkkfkz$9%lp;iNh0iVF9s?jt39BeDIf0StBY;8(cVVdrm)5sU{3R0V zPRXIer_^LDGaSDg*>ef^8vqGw(~dJNZnTDbAAbb- zcuoPi7>;a@GI+kQP;gJg@miR}QG}>PX;g^Jp%p?J?k(B_ZzJE0BQbsP_s<#-x?{Ln z>zIQ0A(bJWF8NUyCNdbhBK=CL1{Ec_kH{!U=$jj{HsvuQYiP*K3#TwYv<^b4z7tCS z2(2#>!&Hakp9S2T;orl)vOh`t4RfI+Id4&v(AJ>1&~E6WBH5JqVUXq>PSk~Tdtu|M zILk9-^UIdL>i8Bk*V7%Qudkyc`GbOH@sFt18HNM!>_4R=iY_i(`eDVGRpZ9O+am%v z{tsZ1_rmUP0CuBzva%qGJ=+NpEs&l+;oSZtg7Fl-fN%ZU`k6xdA_Om@U=&q335uRx zi|r_aXHWU=dLNdh2;7wBKso+Z_gkdI4`}7ds)6-?kFXEL4wYFy73+0fwsAPhq)ux) zu!AI5gcLW;v2SSN4#O||(JtYe;qebE?nl$(Sbec~o(1`xn95KS7ixqz5Yi;0S>QWh zL%xCU{s}{5esDe*zA#8m#YKGGj>dz?IV(}eUnS^7o>Fx5#P)8)G7ju=T7iASpuyBV z1;~rU1rewyGI^cK5XhE>Efzou<#{EaEma6-y)#A5Ofb;b|v zlwOOFK7bA*EZGT}G$Ldiz>wN1NpQ*t27WG3pvq1F|4qgkgIJo3{dFHraF79>U^)vt zK~|Ng6r@_IJG$nvMZ2b(03DdC!=IJ9u6rp!1NoY%tV%aSGu03?)n~IaHl9^Eya;y6 zVDYT$HXY5X>TD4>P9bcJ!o`*x`>|f_KdH*9ZgkP8IyMCTS!F&(`<@P9c4h zotk)<8W~NfmeWh6Qq{IR$5?H8w$tlkxdm2YbINeKcRC0|1tW*t%7JX7>b6n*10fbi zA;|P;U;+s%jl3%fj>lgq35c^BpMHiMgv?9)QGwhCsR%N`k`k^opySq`@H8D-YMLfn z*8kAdT~GKFnza9ZSD0UdCOC?JqP2}dPES`_Y()#qxVz3iF9uq4C6nnjwCgw{F zPrMK*7qo~302L4t{N-yu*K&-t>c<2p!HgX(DP}jQpq*eckWbu4`#wO`hASRmvYvCp zj53cBK#3Oddo-v%FnPP)kb940MeaS4p4_`UGo47{ed+gaZYPj_=aE0_E4!{)tg=&c zb%=Hhg+w6vJekOfl*|>Q=x~%=?jd_g>voy(noYxH@Y=A_tw>hg4$U=aj zZf$Qf`*4yz6DHs&zTs(GSPVobGB4 z``WIX>6RxeFS`ok*x&0;x z$kMf6kcz&lxt^h0Y~8ROLrb?RS$Wo#CEKvP@lI`HujS!V@$@aeL^5o6OViS6w5hC| z?XB7>AH%iZJzwdL-q>NcY-_!~&DUhEZl}xrOl9S6KgJPN`8Wn@aT4b+GoRSejP;UR zx2>JNcI%dnYE^S;HmewpvEEE4m|1zrj!|`S7=><+WC!hr=6=r}Irgfa&U2W`%J=rR zN43Ihm^F1vWAn{b-K}q=3u;eg<#BV7&|o;%eo>aSHOw_Qx}MVX$;!Q^k>Ehe1GOxP zvzV1j+<2^6>!qr_s+kwp8uUn;Cr!w7Rt{;EZ*AW_bl>=DQO@No{n?)M@p0#eXWv!Vur!}3GLuv4VlpGvL;r&DsT!yp39_e1%x{T?p z{L`AVjib2syJpemN}ByQ!?x0evZk~0MjJ4YlD26WPNB<|G|vG<;{5hb+MSY>Pg=EW zy0gj0V;8Xk%FoZ4nzNBEp*5YATUvvWRB<3Btq8J3gKXM{R@a;+d$_K->5^R2S-HNR z7>f-6EqYsa{WKsYb2;G}NW+tvX~i8Squ4t3Q~@ z%8S(8O-uK>Tdva&7V)yJn^1q~G*X&eS-F!AABc)HWvot%CQWT4!P9YZ05K3cVS`>(z-Ieu?j+|F2Tx+#@rR{rCT!-p_4)zy-eTrNljiDKBI zW<1uNl#7yCA*yCIG^6yO6Cv;QSe5(DRr|mGh23&=&#l%i-KeEY4^NC_I@`;n0mB(B+ zN=>U;&JWb(GK=S~j-_JDohWDJ+`69TtTw9~VsvMc3>ur=sB7D)0N@j&*=0qy3M;*hEqKRpU1*z^YJoD#h*oWL$7>cam#=h> z%|bBQO$XYW7|qJP<%YTEKJM5<@p>%DytbvYM|`)W4egI+R=>(evP}cI_N(%hZCN|4 zQmtEt=dGu-%SW^FWN|dXV2ZOQ;zt?gmZ7n4|MTC>bgu1aR<5m!BjJ}A_)3Y1(ad`2 zXw{8%&C}hfvD}!bi4%~O!&v5r^ZIJp>10#pUxTg~ji$p&>Goq*PNN5du)p7Ec9o2z zA9Us&&C$I&yQ}Z$Db0?oT+%w5(Z?6&4WwlUqZWaXm4NY-c|*M3!I`NMK|Oyl0rV|^=K7I-WxmyCO3VjS0gU6!<_ z$rh_~nw2j2H0E~>##mOKr?c9b zXEFcU;+AgdHDkkLx3p%;0O(kDX-n7Bs&!rS3N23kuD{Zp8uxcnEz5XTZs%hd%3~Ty zp~+*#Q5)=5)3MUlgN|p$;WJI67^t0-ID=XF#5K2C-`1S(XZpLAd~Rn|cS^IHn-#s9 zP9(E(V%3ohzF21EbFLVxV~)`g*3frq^OoURy6ZmT{y{ns&B||FrGaeofee&{US_;C ztzqcas$EOBBw4wQ{xGinf^h3kudzivT|f4T@vNN1#|=J&tVreiZBZngTi4A-+7Qcl zW^h?o45P5iBL|G5ThNu^;a~p#pXO}KveUV?<5{`3P1k*F8$~h1tW|S#gRK~zy_IT3 zCNfK=!bm)C>)I~~P_>kns6)W*$GVyB_@BtikJUW0`NZ(LNKPEYmS&tU3#_er)qf?Hq?{xXHwq>weTH4a_iOiUB z`8ZZ#7y~7rm$L!C*Q}JQk(Do7$1xNk2HEsxQ3npiR7;YT*IH}97^VwuwpmkuLiB7E zPdCz8pp#j7uAW`5);sYrUiq5z!=Z9Z(<{2=>PEWapvkQK*Hw+b!f{;tUGuGB!Sb?s z9ct{FX?qY(OlIX7ivi77uKm(fpmjvbost=&(kdUqwO@%v!*iS3hQVexj2-aZQmsj5 zZnU;hhEWu!O9aYLcMR9FH|t!5-M4kuO$S7u%*wT{Yi`{bux6@>6PT4_y=7EA+j-JR z>sRMgcU0?|$(FTRO0|)dC*8n-ID8z{f@AVqUFWas-0ayh9KBZCNw+qcH7@1<3*#AN zm7X}ES$V~a+J>c779QqCbtFCgRAw|tnzQk}?%1Ovqn+Xc`QN7Z4Xu%CXHI41D#8fn z?bTJ?)c6j)_ImTSqw#s4*DWJm*lQ{)H}SDvGu*1z2?pHv8uK#4f9QEOt2E7&0kEm8 z97mgv!-ZiC)Rsw{!mRwfs^*xcwmmsLJ<-=noM_J2S9V>q*j?Lf=xdK{Cmn=kDzjqL zIvDo7Q?qLYMr@Xr;{ ztDBPbVLB^c)WzXUj7)Umkn4NBewpE8UFwpZI^{NAg=w2-1*NxLf7S6j&5uj>4@*Av+`-z?N!HHAE+fsoWHCb+BMTIt(u)C zuh<=l}D^H4~UI(#dF6e(ky(P^qZRT(O<xZN0T!W-smaIHm4~J6H za46S)VZPQ4U_7<$nyII&o1Mh92LVxy}UR0S?49iMui)Q9x+iTvo=IAt*L3SAu zr!^}V*)Z)bF6C*D-du|3SGr^C+!WM-aWkEHK9iMKyHeNZwWj5nx?9-jU)jx7!(v}) ztE-xmE*3PCl`s1k$8znLWT(m2nvV^8BVF`oCM!2q3}UCNO_uw?anPUW)yKA*F5xnh zl}9T_aqaiZtZ7sqYwT-i%9d_PvT~9=yP02+!Ct+I{G$N^O)bKTb-<&>zd=@C4xlPzAZXQ%#j-njFc>h20dRsp-y6M}naK)18+Y@1kaUsiOCjBiXSv znPXjrFZ4okrpf>UMLz?&YU7)}{PJV5HMrc3U%3YKg4;M9r!hYkU-i zE{_Bwfw(5s%4Fp%KIS8MqFcK0ec>!pw=Q;9tEZ|*m>kKqG>VgDJ?$ZQ68<9nEs<&5dS5bH-+- z(oRD^*qIMBk5#k{XltD+$2wWgjH5@4VxacwWyX6;=cj3dAMSVm^WU1QW=ayc$#PaM znjFtvZLl1H#7WG`n`&Acmc4D2n*8t5nq&7j8_cX}uw|_QG@5K>_P_q0`Gxxn57J3# zW}cC0c$!-?i~bbRsIXphY_{N5HLgn1D*3FOFB``(P-^5-=5b2M%w#z$w+-MjrMljL zD1EUWD@KDo`p^IFc)FP`Mqkd#`Kv6TE+1=&~ z{cxaE>iS)+y5TN0oz0ZnWi%`I)U9Lt5qA^EGEmzlaUL@RxK?$iX_|Jax>Ieg8l3_r z`Bxrybs$`13(n3HwgipsbeGL>YqeTWg}<8|&C12C>wHL?1?&7hN4Inal#*sj=XNwJ z=hlFsjEGsQvcfQWOx5w<3R(EVW z9sX)GD`$I^2664zM;~1zlNu0y1T;hA*H?($aouOK6=+B>GNkKGqt#TS`?KG&z=)%SeM* zH2`#98?Y`6mpaNEt- z&8Zq%CEs;IlVe$VRo`l6&A4NDBc15L`%aA-+nT3U>uEP@Rvwb!*6r<%W_|x{)60za zTf?$zY}V4OTG}Pa%HhJHh>=|Tb@^J~GA#DBk*?|ZuIZ#$FuU;9DUm>Xe;NMjy^G#ZY477J%VHC=2GNB zeP`vV&6>vY=zYU#_BTFYw&t>VZJQs>>7+9=))&oMzvJk-wW2rp6;?E_Ss=e2k=?|W z^&LAEiRa{aRxaZ$J`^0rwO^EVZ8aUxYdkAoalPu;+t*H!XI5gUxmE1gkQ+Uo^!O85 zIcR3na9zzvovp~_o~&@&#$t<_)!axM37^QUO7Ka^)eBtPl3{xeyJH&v^(V{Fw~cBl z;b)E&YN1L*Mda9n$uu4V-jfVA5F9lXd5@h8)fr z4QGzHIHO&{d03-q{8+k$LYe?(5ZnSWanccEk{VGr{kHK1vLzlB)Wh2+k7XXOtr@?kEs}t-r$HqI;K6WHJ{coDJX1 zyZZ4J#<3~$U?dliKtVOrxoDpiuz*|^_3D`0;Qg&E%1Lnk^am{zHsoTWmBTTambESs zvy~<{x^lU>ixiZi$%u>Gx=`C}g{1KV=MH>vrGcq(nlcNy$gQ0_42>7at&C^E)n}S4 zxY%osAml{WpCN@@6w`n%)j?RR$iL%9A+q3`s(|)EK4e=&n2O^czqe@>zMd^~FtXrE zvn*&L;Y(yHwQ9XwF7XJxc6JzY(N!z6xrfnzE4y7YWO5EJ5_1R@O(a|t*uy{+Z{{0p zBsa)(PF!yraxv*dWYRh88$VcX+>(tvxX`Zd1Vto0E-Jl5;(;_?D(42Waj7OWiEt5T z1c9Xa5!(2fOKse0i-DXG2MHHxj`1ItsD%qKVhryZq`C_;%O$v=z@a9`5cl}jeY%wc zGGE9->ekC~B5;nOdIEb~Bz-LMaq9*2<0KQs0H@mOR1@n=_4w+PAQn}1YgQ9u8@%6B zX?ewgwkBqth*|W zrN!0uxri-PpJq_iYHV(U_fBWQ9d2rEXjyXlT(lOEtbsIMDq1B$MvOG-bJ5pCEQEp9 zJ?fm2+7&U+pZ+p(O8m^z=OVC~gJW#t7E<-u0-LRr^5Ym8+lWr)6J3Z{2{1&Z!NnP^ zaAk&`(bP(NY~`OvzsE>uB^M9^I05f|gkjLl8bdd9E5-2|5)ijwFSkJzG?V??od*ShK-QXnT_ z#$dqN;DBa0(E^XSnCiIjINCYo-|&YbfBG{Rijo=$7jZGyW84}wV6A7wmU9V>CWvQq zsdl@B^&K`!?2BCN(mliM$8G$~MLDIFZi=|LX$pldi&_`C-v<77?KSp^(xL)EbOT3R zw0ER4kxOWe9wY{{AQ8w6?ulk77l%d)Jxhc^94pUG<7G4SwY^C~;Uds;8SAus*OF%+ zQWS&KfBOIBb8uH0A~ooB*wO}jG>P?4+KJ}HL?e|7PE)WcWHd2x5o?#&c_*~k`i1Yv z!&be}{fw3GPg>91^l_Fa_z)-8UT1$LELQ;u+r*bu$Yl6suhTh;!u_bbw>~s5?qGO& z5S?_^2a(oUceH!hJzfRAr2=qv8j8s(amdg96S6g83*gy17eZcK*gvxMz z1=<{e6PmR;!*hqr%a%T#w6uQLpIhSodCn>I=NpZjrvKQrdcNNA?ZsLZcz89A z{1g0fE3FcP>2fF0@wt(%_u$YJ18HOY2M1wi-3gby$Zw8yQuz(Mr$j5#e*GIzO9KQH z00IaI0Ld-$Tne&1B@7+_04G=h02}}S0C#V4WG`QGWo&aVWN%}2ZDnqBE_iKhE^=jT zbJbm2m)kay{wq25%kBe2@hWN0X6N+SPU0Cm>9IPQJ^P{qk&p-p1ULXFwffg@f$Fx{ z9<(5L;^~@PPD`Q$egzilhN{AU|LL|7-|d(-T*>cW#iQ}7@0cuA#pU|@SHIr;K&G$$ z^gsXoi3w`q8>Z&1`3`;}&G)ZrYuo>dB2(6^p=P97CgI9T>4sW(tJhIW%Pn2AC>f87 zNDs$&^?1zhZVoNGWJI-E@shn&W!EriJp)IwYnDs{{8!(-ufBh!-&gUg?{27GGyDCk z&lg89?yK*jZ-&CygJ9+}gyaO_c;%blpIHlJo)Dx11ozjzHHJM~&cB3_onQ-|7rxuW7hcwb8sB?X$0w) z2>$Rn2qDP6MDT}m;!_CzxI6F$wDd_?4H&Co6{k`E;iz>w_1l4{VI(cM+@2Koc*x># z3j_C9a#O2zrEW(cD59lM>u6(?BwWHI!HqRta>4C^>^dPI-f<`Ijw5|k6##yB3*VOX zn+myqCMeBj|4b0v0>-Qvvj$8PkiBY8P21n&y{y>n)%>^lsJ1;%y*vep=aHPDU~nnA z>OjRw%gg=_i#P7lV(zZ>f-6w zG3b!GH?>j*thog|xW%vit2rw>4Qp}nw~m?qzBs8)isw@e)+5~LMC!E?ygVSKbNYNb zwK9gxxn+w_>>uuNE`EUTFbx!IwsY$iDNoOyzhHZ!7d_GQQuEe1E7-|Riu`xbduXj% zYueVlT+FS~Aa+qw8K>iCQ~CCnkBc`#Esv1^?9X$S{Vqb6)UaytzwM&Encc6RX_FlU9AIg|ML zcHdv-zx=%TJ6kSp)Ry5SZprrPEd{0I8VpVUxFV&crLDt;cMw`h?2e}eZF1#i}Rcllw`%z$+OA&tn)Bi+DZO= zz6=uhy1oAfsVM-EYeL0ZfgfErD55>-`1yv-wN_SH7}A9VMECEYKH~KG|bkb^I<+5ySr`H%2MQ)ybI?cxJHFpZp7 zXV2G`zrt0JG<-)(7o1b}-gd=E=kFl%e?NX$Jb+%j1EFfshayw2Bchs?0ebhlQK?6V zc4SqgRVS-7qHN90E{;cSwZcF_<_(oUfNp3RwMrb~bet0yFCVAL3=8yh>YMxr=tg#{ zm0*!+S&0X+PuhKn_|{NiC`@-8k3q#@0iSrW!tjX)@m2E-BR3dR+^|{mU02?6HUisl21rWwIwm!XGijA#d`uUkmXyy zUy@}2F#J5u#w5jqJ)M0G_UV{pQP);69s;t|CxMwD1)6 z*#r;r%$siUB=RXi#OSR=!-M-P1bZ^h(cm6m zVk4M)qacb?Og!%0DR>(D6qP*pg{hvzo=zi*3H( z0>8ooK8r6C@b}>J0vKOovfzu$6zc>2Nz__!p%96lEdDCqpG+c+Xys0Pa&yl{4Y!*0 zqhdgrdNbG_!K|pI;Bv#n9^+HxCTKqAwm&uS#JZBgtJC%)9aucU03keHkbs$SN<^Ca6`M2-e>%9UP| z+p?zc9~q}82ui=2AiXNn$*IEbMYqVldf5Q@ES`>Eo8!hGLBUm-FNG^iM>a#kLLSRC zh(4d34BnT`z4BNjLG;DsB(Yx>y~iH80R2fSzbyK%(dM7gPh%8w4?^%6=qGuK0)3Kw zwPNnk&rk^dBz=zLpA@IX{<3rb9L|{*ry8{vMV~xp?x&M+jsyL3WR64sTGECQ!^DcX zY+^97OQtPfxqWW%CpwFQyv!53zJ$C94)o74gl6Lc$HK^-V+hR#CAKe%-V<61qffAK z&U4JT*&uJ?Wzj#!jGJXhjL_^kB6T(yqcB3#iBIOR9TTo&#)!&FD_->-H8fi>&1A`< z4c*bm+-J!~eY!0B1YcDR4w8II;6zf}3f2=;-4EN3cA^Jf=$@ETwTI=wGV>pc|8oES z=br?X>yED3_iDK*G0>X$YS>S-HtLQGLHpsEB)`rb%_jOgTShpv)5(+XVJon(tDt^l_b&Rtja{hKV&!U=oh?Z%$PW}$q%)5uVy))VjyNrKKX5XR(`Zmn z`J&T4^Y~ILUMVUBry#5G?A=W~9`~Bt5vWMXL_coZE#bCJ1V8LI9 z%U&nNM#=Ru)+o}L^4Me255QjWRc32iW58PY4EP~d!9OJ*9Q&X^>(kpqv>*_{uEGE{ z_wA7kp;|%BPra#&A_kDoJofki@1H+h{qcU*p=hZ%}k zRqiX+8KPYtaui{yV(Pb8KLgcNeFP^C1y)~Ne}MJ!?tY}YUpx@ZMtd+RK066pI91a01rq_Sg9g~vb&~v`}&_{r! zJiz=)ZtWTe$RkD0YhU1NZn7w1{_Bi%|mfAX^bNMs~DfR z&_B{U_RH#~R^7U`IDCryJmQ}j7awU=;gGdiaUSg_>ar(r=rCXE#3QJc8so5Ne8nn{ zkgg~by`zRATdVN3&>Y~Mzk6dj3P&;vXx#a=;?ia)c0O`n?&lCI-E3%etvXEw#{f7D zMDf7Eu~fRPzWa@6%?tz0R^K<@{-{uhw6r)cC!Qvw?8#WFh5&{&4pkioo=G_#FHs1+ zJRtPurLy)XCK?>`>Z`*ZqE#!qr<%<<7O%7L?fgDM3}bP+MS<0qP%yxH^CP)oWzA8r zLgA~~9D=Rc)$RY`(0{qF1pG19x3rU1FoVJv&hqn2dsBB#63=mHj@*|ZIz-EtspcJu znJs)--b1X7`{xr1sJ`xXL#V2`VS1+&j_ujPS8+6e`x_M%|B>4<3fnyoSUbOQS;Am% z=NP~izJj91U{!S`!8*ecOV20gRRgV+XgCUakOvkS6|@197X#E{a$YG=!EmI&_!?$B z!pSW)l|aF&MSfm)IgiI6*~Jco9|0;~QGvpe&3*OpkFjcI?G6Lh%$K122&LfFXIqz+j1drh%8?X^$@D2O|5o@wFexUD+@RZRBw3|=O{eeERb(OO)Htjkw2El zfq4au;A&7%V9n3Rj;IygEw=|0SOduxbVm&r8@9ud8Zr)W><)N9hy+DKcaa2GcE>B# ztpyIIEdtpffL7rMmlwX)yhEf1vZXi{S0J#zq+l9K!#Iw4_4Vn0gtpd7p)d>bKqmK+ zRb1CdEP{a7<+4;j2H=pdzOzyuVU^383KT8R@<3U~l3U4)*>i)!fGK>9e}{0D=0?yR zLE$RqzC)~rXu+JYcRtDxsp72I!6^&O68zeOO)lT|Pj z3ZTBezC)lc7j=Dyg9XOtMV1T7&=sdr;jps;?Sj}XD>n*FBwkV+H@p-em=A@Hlj3etHu)S1^ zP1kPu1_Rc7dS1M8p>{}GQfC2y#U;H%(ZoFq7=tjMifGzlskIGsc;XtY>?DboD8L5# z3~*DcJ&u-Yd7!k8n}!?K(hf(iK_C%v19sM$T4p9F_7;mk8{7?Tm?2B}fawayI?H{B zTzv_7Lv_U^4mB322kh~RLyRQxJ5Z~zac4-BTO{#~5c3)(370!=IF4fRBGB!2LwEcZ z)C9jn!Mb@M3uVJ9Zc2+Ipd4sHzhSF}@y!lL@7JNxtD~*H~0>Q8C7Jg~LMMH5?Tox#4+wS*B zs&2BtmW^OsBVmB^)`3_Vrgu1)wFopj5FIy$aulg2MIcI?y=8da$kwK9W{818Gc&}@Y=1l5eNK1JeD7Ry%@0XSwVzc|NwsQAx>YK21ouAD zD&y`9$ZLcQ%M#KC3MZ0le>w|`R#h*WHbVZ3AlB~6b#(C~Y6a8TDO>M6c$mum#|{VE zQVB;94iLlr&|gZHQO4XnQzjU-PNG_vU?I2^AVn}h?tsfDb_4q=RAgbchwQ6IaEpWH zK}COfOl^e91g}uzL?T$n8pk)?uffTnCA!^JG$GnbB<;ijBd?+96V=?U17D}Uf^#9T zS+@-6g5W_kdgjqLMo}?RI3ty?Xv(?U{|UBsjs0F zAoOB3>yK6~GY)0TDZ>cU5wN9GP|2k*izJ+yEw;^#8h~IK)2yUU5s2rRSEoNqKxClk zAcVxBAadAMhcc@{jm+97-nwqK z{&_*-uDVANJs_D!xO&EZ-CR#c94T~-zI#(Vj^r>(RgB010xR0BW8qo0#R^mE=?l7?DG>fJW7B%a#Lc)Vml@0aBoe zjDX|tK*)N528gOO26VeXVi+|r8~Q4(h`#ceNmyXv?`xvG3q&CgTVy~Ae>-)K5L9YUaP!A;BZROg%J-HX4)UjKZ=A;XFp&*W?mh##myyPS) z6xbdKY8rD&_Z&#+0RwVtN~q!m&w19ZtshBu475ZVo6c<|<`02_+0b zd?Olj4kFo3fRc}5RbbIuGYrHp!4Y9CoIR!}*>Ywa2m?n|aw{kw8sq8)+{Axxs7Mh> zp~#oiH2Coom#Q~@F90oI%}ZK0Xr`T))|!WMJfOo(`g>z>o3eFeL8mm5#9J+?sacq@ zF-g3tF_!IlgC=+Z$1m|nffJ?f4$#!~ys2)_yoQ`A!&`Xa09M$gw(3wgUm5DA+--^p z7~EAOPtXTriW#a%|3w6iRX$yhNF#B2`H9to1#q1Cb#zJn1di@jZ9AQIFhGr*&)9lQ zVU0vlxSqOJV(1ugxD7|3WSXyfOi`$&Oc5Y>tZ9HT zbB;m+zbpKFPnaerg&Qj@(BtMrJ+GHA!62)q#fm9#7=WBTkrvZ~^f3e?b~cf%Rzn%- z=C7IOi12uTItZQXxplOLM_)Dbog%F%d@^bo&%Tud*`7^G_H zVJsoRa@01gfTs(pwAN?b_6H>C5poDsCYaDJojfKu_1>{(<^r&;B7E;wttrT01a8u{ zb;O?cAddsYt6)%1wyeSB( z4^8GWT@-m#GTmRwyQ#>~&B~OENU!px8oh1JuEH(c98fuA3A2dG`q{q1ru^?Sxau%E z!N5&ch@VmO`S0*>LG#GP6-P|nPc{-#s?!~7W{99EGf0!35`6dM8rNr{*WL#$s@%SM zZSzI&)w0qePQSK&l%~SW`KYf&g&upz%viEoRiGjK;;BEg{B|jsMl)7TJAq$K7|Ey+ z;-`=L`VJjlQCJ5NCCUm-ib8&5eDz=y6Aq~f7CS4mjQiZCZX)cS#BhwwWrZ4@^rR#& zU;6OEE8{Zjg3LkDX0;0Wv!$hswZLt=7M7%BsIM!sVz99rdx_%!7;CRtP*c=KK8#51 zE3Y>47hH(pb03Q>8`9u(@}^rUM{&ChGy4k-?a`zAeF+B$xCl(hrwaR+2nozmP@~9*70pDbUK%7sxFZQ6v>;jlTuq&KWSRro9 zYOH&ekJbY&1F?dv%AT2iyn^8>_G)((><3ubHA~!wu)IMEne!^OBrE&E#@E~4)^*gu`;5;uZsA3QUomY4s^2nle4N_x@g@M!OO(OQ_4+Z ze8tH_NfWAHPAb9r&J#|goY2+2;0SYK{b<5wMRu$Z`na3eYZ%2j>>+r{ST1)jX&O@$ zqSg2)y%~6K@Z(J2vrXcx+;#5+AB;TRJ>K#Is=+Lu&3eH$|7KZP>Q6ser%${>Wwggy zgX!2&Ksg>JKw>%$4;zCJtzZ?e}D#b@l9eNrv=H%t{I_5SC&?^6OS~T46@{SFD$7q zyD|EB3T4P?#HMu|-k6`G8~8AEC+skK?GTP1j_b>439&RqLm`Y_l+rcUqsy{I(mz}p ztthD{u2y`h#x~P6H%1kCx*wt=DK{LSMqS-LDo1_!;-w=IWmc7EN?;=@7+E8`6jGR` zs`>3G9{Z)4{!PS$1D8f$vPapUfAY(%2Ap_}y0@%?iUMhu)6^$kQv9&#@6N|zAHDON z@eWh{jNp(@cl<+6(L2FWOX}gC_#V+99tYe6$3$-6wP=`a(%%+*0@Ru0>MeMpC>}Gs zW|Xv1TKJdoQ{YZTj(7AdTKLmFqqiV?&S!1Ddmkes8k|*$Dp#aGMM}l>ufC-v zQ;qLx$)c>+mouS)zxI*qMB@f!8U0Y1z!$M6Sdwyd!CHB9|G7A8S7x^DRr~Ypx)9*KE>jJ@L&` z3BgeNs#<9Q`TI!;;$DW;qUx_s684O{X&I-gbrZH2ueX2^SHMe(318ag+)Kw=HJ2Nt z>VG!A4uz~95!8?F)?DR(qP8{!s<*FGz zwi;~+zoICut5RB66jwH*IUGKMt z7M&%9W^zQ9TKA%GX#CYpDa{h)aLSulL9ujl`_p`R1Df-8BDEz=wqYk{Q4a;$G<@m@ zCn`rn*LTpK9v+~aNa<2}9(?IFs*3VM-NB$tzS%)cQ#M6*1st+s#_S9Qp_2Qz;0RJV z@vbFSe$DK`XJ6!;Yc4upEjJq*`DPFT?bVraH)-Ji6)Z;CFfJ&`HNoKVT zP(vP+TWsggO$?YDv5mt9zY)+8|00f?0;jFdq{FYA>zu{VJ?4G3j4K2GtGo59wUwqm zDL=zhK1rPUa-oI}t?yAKbz@uk78WO7eG7yl?0{rb8h0KAHn~|>x3m0iIZ0k&)y&&c zY!LAy4Zex^51Mmw+_DnK0*7U0eWxd^HNfA~bUVu(9+WSHJJ(W>&-BxMky6gjZ1R%) zkJSD*SMLOQSX^=$p8XO2fObq9-YyzDeTp;7wM5Nm&>=b~30E>T8WHWnv7dv|wQ|EtRWZP71 z_WIu#In|3lyjVYgH*-9FDfUd4JDoMrWb&;CX+03Vv?#VP)X?{hmX#TQ$m&y2qN}am z1Q7hMlDVQU%BsgTo9k>lneelr)K6zo9t_@B@QFp`Ejqq0JBOJBLy!ILelI8FWTheY zX&K)Sa2_LAHoHozY(J1iiz_vS#|4^XdXhtC;F~Vh=nGO(tlLZ!nQ+m+^5O3GU!`rX zoocyFgj>~Zk$P2)R2$BGfrz!jl!T>Qr0??7_jwWeQL|(Cx|4}ho;r4JZ@7i;Y-cr3 zH+Pn&BFlndg;f=u5G*~)vZgW1iLrJ*RE%=Hjc0yfSQu9h(rs_Iy_yh-u_^K)7&v2d zeF659)?h4y(K-zx545SM`0V0JPwn*H>Uq>fVO16;vX}TRyZx#^%%UpnxuqFMbfd(nGo0i2rT+ z&!Eh=wI3Pv^|Q6;<{zhN#}`qFzY1HjtiYYbSHzWSlDGB|D6@A*kLN}(nf6o0`RX>; zcC+4qHVv^U7HoDGXq9qubh-e<)tq;F7C>CNipAvYl=k!mE~=ZX$}F{SoYp+VoDle%Lpy)Sju$1nH&cK1}BEqA?? zwO4Y3q&2M#v8JZl{9-@yKfo21LUpugHjLxA%^R3+>Mn}vxC2FHmt|shdtdtUGt}gA zGNU);I=tdcYGLYX5kKc7r=X-755BI@{HW|=o6E~*695^PGK>S039@%G`O$J zdS3W_Vecq>rgc?iJwqWZboluXL7%?keE@G|?(~cfG$^FQ(mR)uO?M2qUlykdh?|C4 zrfJu~UY}b*+S`JybQ54|dqvu?ppva<%=XFSF8+G+YtPB{iCG6+vX{NlpVRYT1=D;q|2KnH>0y^B|z$ z>Fg@+KyBYl=cwwUW)0;GI=s`!P-v!R>+G)y@^F@E(E~+`O-b?l_$(j1`o4$42phKT zdO%Sjz&`dx;VqDCG8jA!IJVC50@dugd-1A=0}9O@T#hgFs4Yo6G$25f zM0d4C+a)5D_CY?91c4z0LUPl8ddHqOdy3E<5i1$$(H4*vC8!t zM)4P9FRoY$vdc*$Y#@DNX5*PF&(XWDfiOsq!=7$qpC7^TFEzb${C_~^VgMerCxYu| zm1q!L#^o;r!iGrPnp`z___0K?$lwyCRjJ?(O7n*c$gIYz4V3;1Lbr8_uap^SVVr4dj=k|N2_6<5=gn-uffhd7$4o zW<^~zSBL3gcbZ`^;2k-Acj`w{qhTLI9U)yNX7nlG_8!A77w0u%BA<}{rmuRE$UYeK zjWl%1L}N<>a~WXl<@Md4*Bp2U zruxu(U%)#9O79{sQ?|11ZJz#=yR5(VwAFofJX~MIZjBAwYv^zD;{(B{y?qSW&JkW|3IxMf1*}| zKT&J+>``9Mb%oqZ->x*RM^WjgtiZ~F26y&rk2PsK$UI_Fl(!aJ_OMkpq}ST^n0t&h zcjAiM(8!U~8n`uaI%Ujv@4*WD!K*a1-f13!07alEQ^2Koq?)J{xoA3r)>xv490o;C zi095WLte@GL8n|~Ov0#VrD7rDe%)XpKaf{HMtYTH46yY!^A=(q%sb`N))FMRR_+F$ z2rLNFDHWW8^CtcvAJg+w6ZILx*Wy(u2cQEB zz$i9F8Zcz_J)idwDf0mj^WY?+{JS4>hS6+Wyu}^6?>KY99DXvq^tnkH17#x0!?via zz?xPE8`Sq0%IY%J-yzm^{jff=?jQ5wHs|Qr z=}}K`@PE8WVn402T3XjGmzFD0$@kCB%{ls^4Eh`+JE|4I4d>6SKe0_@(0_aFwa!S1 zg}{4QfyfI&vyX6~?qr?HL5R`ywgfu#VL<5r@e>Offp7d1K`Gk>1JJk+7DSi;r>$PQ zSxg{POi#{OPPiiv;d`3q=o~9Vsi$LxDgR7U;Ve79VYgOr@jNBelUx%m4Be2=x=HNz zMloaLZH)nYKZWHS-)jtZs}-F_qSf}G8AzI zYSuo(>BmUb*m$~spjMu4Zl9YGC)8LI^r@Cv>;9r~g;VdnuC+tdcNOy1!E5ExWs@|(0|(kIvLk?>K(}_ zFbL^UZ}5a_HdFup5hnbx--Uc>Tv=mDUS$9g!kD#Rl73%&o<)+gGlknqFL?WjHn$|h zox-g7($tf{$aalCS3%&;wT3&mJOihgU21zNht?ZS9MZw>TmFuHD_(x>`i+0n4QwhY z-2InGV4H1f3NDC>a%$)WtXPdNd|Xx77F8m>ibFv>wL_(O@M#^GdFTbRQUNfbpTP$f z8Frz_zt5?FfLEYDS+4K%;0KvtaDVazEA(oCo*!F*hp0@a7kmPs*7mE}1(!Ar0$t#&RVL`-?;7}!2WTvT z6@r2Rto(S~`D!lT*Ul9T;7PQn;8}GlmmtKgh8Vi*aJGPnkWr!6MUf4b;cHaBqjID* zLzx5tX@z{&(RWQ2Q6v9>w4y~F(nB)@n!e_&=BWF* z4hlpsbyNu$%U`(bc|wY_hw6|OjY2DDKcGIA^LqkT!#+d^u<|4J2Y!!g296**SV%?M z3ql>22o7O#*{HgEhH4SG(24>ybDy#^WC){B>pKN3)5t_$AhM$TY&}wDm750`*yB0RW zEPylZ%H}!XYG@2RT31$+g?6SN+jwz}ZMlIUDx$|JBkNaaNSs*rrH!me6(89}4K^2C zKZX<^cZizL0>o%u=z3$b;dwA5e6J;z<;#u6k$|k+I7$`t^p3JQ`xULg;6>Q zcvedt`dO0C^8}B%bv!p+dlO zi;EARN=HR?H?|D|wk^Nz2Qs<*EK}h)trTb{bQ>K>?jeGP*?e+@)W9H}&Hfab)Lx(I zjN57v@GBA=qhnoxk|L3#2fy_K?C3XZb^eRB(zl_hTek`S$yz~cN0lmQA@V%C({#&Q zn>lj)x>+>bsy|5KBosWLJqhnNZ8!YaP3v4jxW*w^H8yP5^Zl_)!OAILk;6hXz?=?% z%74KjAD%RJmmlLLqe|O35fZ91cedLq3XJd0nz@fll8<7FF9;fVm7!Nu>)xP2R6ad6 zdh83?#y1vDfPh3ve+kQv@Iq&RFyupSe+mN;vJaNO46pWXoXW+^Z>RN>J~90brL zp;fd{(#HBb<$=FN(qa#&<}Hyf|6M2ocfK^&jcVuYt7T-Q_Ijc^mm4vPsF z#xVq%-KO4MmqOEwhAz&|cb434z#G8b%qpH>e!(rV2j#$iNTERlo3v8{r(pn3tTzM# zudZGkbdkvl1Dt|ZQkB8_n9!_-4NVUgsDHxxIujTbx>MLfqcGFFVfR&K-6Vh(=Vyyp z4^T-JXdQ!$y#s?al7$-~mmS!poK~eo;gk~PKe|c>{v&Zs^=knGws=6G&G*fr)sePv z3YcMSIQdLAuWs6kw2f^j8dPBCZ~H}oixhbSz~}Sc;@gYsZJ@eYI~)WpP`E^M9uK*Z_3^#`#bqUypU0uCaNDRiTQEu}9?jCgSJk#um4d5aFR^>U*u+3ISyQGD_%c-)A`5&Ap&IGH z$8a2$;bGvjAh}MKvBmTmQ8gO;t4^$jwgwxOR-t2eD!c1wQ`jB&Ly4>Mp*+s~o6crK z1}WTbulE{l?R0Au*Q>tXl16}LwI2*LNecw9DpWzo+G`eY0Fxrp(u4O_z=_8l#S<&9 z2i8FEXAoOvArE1FuiDsln2qYzjG&8ORRHuA zUsSRsJ%*b#`KB5K?1E1*eH^VxiF*}CV=!m8W_g#9ZvmMGj(zBFFXxzbnGP8{v3@y2 z{IwFGr za!7GAZ`HXjyX&U9;t+i*tvk>HAZ)MT<#PIgBl|f-8!ffA>w4cpL0cTuK-xP}gL@ku z3y-qoRh5gUAkJKnzWU0!=8sG=BwJ4w`n&3;uR8H>6)*hKWKGsP5j};{K31G%4~x|ny1|02TmiANrfH~ zFTw;`U-LaJ$}V0HM=3MmYFwg2n)?n>D9vRNNE#?;virWrJVP-Gg3L73t}k``QfzCG z0`FKXW*>n=nCd!B2A%RMgk@+Q5;kJAY|?W0DZzx301i21;bOGo%<&$R@djC_qEtWA zqdzXegOmTQM_s6(d9LvVX`Q-0A4e+91s;zTMr_2ptR$}V`zq}}VJk=bZ`gY9U)XA_ zWdL7^d*cu1w3=5*++5Q8sbVN)9NLHEe}Ju<$^RQ{1^*XpZT%azF8>8vIl=(2b@D&3 zRpf8j8t@yoHv9=&asD4+>*;UU`fWef!fxT;uyx`euyr{JQ~EGa6zeH@+&s*#_xAmz zA@l8_z)(n!vUO`z?&61_DXZ7G);BkV+tbg>9Y*e9(K@(x5Wh#B>rePsF1G_<>++wlwc)?8wc!ug zIv}omBWBGmNEoH-K>mDt@at}n9rJ+nstNdo`Owsfh5iRqTTZ8w_CopO-jZP&$|lk; zzn!E$Mo&_Xyw4E6;gSn|%YJG|Pv*oRz0U#W2H|B?i(~mqk8wVS53lKe!qzxz%6A@m zdjM=D{|#H81V>O3>xUEQ=jFVJqRhBIzYC*2q~Cx@AG}OBKo^gl25DViyEg17v1KOFsps zrh>Y=Xp-%4s3p%+WnE4Ena%TcFiUnVE~97aAF#EP830?;cpc*pZVo2NXo)hk#K6M# zzpG3%_H!#BFdwZFfBhS~G*+<$sxTr?@bn;FViZ-ZC z)gw0N6ZS8XoysVUmL9li<3z$@~=beZomcRLpWfdVyh-2aQt%n)E*W%-dHD)C?l*PB&Li ze<>9zi4ISW1g`Hatz~5m@<4vFo)wTyp}PhP|3Hoshx972fKPsC}!a&Hq0@r zWSHaGKA|+ChRkDh@in|1pZNW4k& zMIsOZ)+I+URwobDDfw34e0k4y-_yjF%k9L^63xXqzJwJlZlt{skYNy(y;Fy#&TZ@pnUOqtJo~kDUq` z*x3j$pI_Wb#p3k3_&w&U>s4~*t>Q|yX@tp4CbQ7PEZNT6Y{kb$+fYG+pxElG$RbYt z$DNqs32&z-@_vyEUQ$*Es0qcU`h5ylZ(7!tQH3K6ciD_bM>{I#XP{PDs%K(gURta7 z4xMl3Z(Hb5lgUq9Xk7K)K0^5T8v$A2GNcMTxnqmvrQ~~mz}B2V0BrsC8@56S{|mOp z&A;1NL#^Is9q4U(J?(bE1GSP5eab`GD1MQ$^c^gJ!#}hCKf+ef{{gnj>#djk|H0Ot z{|neE{TsIW8RUsd;>*`7GPY;DO=+rIxT^kScH%N|gU?5gPPAfk6;Nc68}kl0%oz}s z6p+*|da1*M6a_$mc)T}PNB(UI-WZ&a(VVA*QTZ*o9iqsMqOuEtOO%$`Al{`KuFWo$ z5tNpjy}F~1lO13D+&w_IA!ro&)@%7KI)rBYA9R1x)&j}@(AL4;|IpUN|IpSF2ZE&s z{Y7|hvhyqBhK`!37fPH{$u)3Gw>)5SNDuvhiV)Z6Mgp(z9i&XqdL(ZI?oyy*m-*8cjXf-#@ssX~m?a zr=QhiY8xscfN4i^PvfSll%qz3b(~%f!lzBa7}n8I(K939eu*zwo@d!4A$Z`^FekU# zi|c6nywQu~ES5E|8-agJTTsrK(20wtIL}k&n}d&)wK|DX<2Ccf6VXOqlUt(2No(bs zQb9sJp-Xqu@1p$5?&o)6Q=g?vpJ1cR;k>5kc>QZ)xH2ZSpXKA~%UyZ69qW4G;W5v; z_sVnm8Vz9g50{s#qSW0%sbnYI7}vT~&^kfp%lhxU z6T4*X5}w-SD+<5N&X?TqbUs>p+Ue!A``nn-WvJU@S@UN&sBh$CY$ln{?Ci6}k6Y;_ zg`;qF?Q+=Q46xmfSnpk?TF1*AO9?kdn1k8HEZShyU#s`v$ojYt8$m( zQ(H&CH~2y6n%U`Shc@2Y$mnCZ;47+Mc21Sy%pjP9(tnNthM!Bi~dJ$ zSYtBkL4R3rX1+vbDXeA(a;ThIZ3|FO(<{vt@ld-XoPu1E*4Ij?Txa8L@yJ!Dnc`8rFXj%-up*N3>dDG!}KD@>V zk43+vkB`wvj-&M&nMvAI6ON3{kx0a*TUt73jLFCbiKM4zKnyc7)50S}rI%ScY>l1H zr)$2fMBu(`0uA_<8sX(lM)NU0k0k+wV1EnaDVUXK2|3M*i+&n1GPA-XWTn4xF~6)B z+we4-9w^B5)W+lgb^LxGc`z2Jzs>=hSH>JW2<|g{0a3N+^=!76MEo@wL7Ql8CEsBc;ou*`@gL(tatgvypSQgzuP-oIPzNxQA ztl?znvcr&f#kDg}S^8316uX7UqGpsy#^bWg&TQ4@0SXua$PfPS{I;gPwRWN9Dd;d3 z`)FIZ386XQZQa8OFy~=S!C64C08ag1)~bNB552&)XQZR4pI0dI*WH$LzCnMp|0+Q< zEUiEN;X~km@NDMa<34&wy}Ft6trf$P9fSom1948*>Z%chmpgNq&K2E-8#9 z8`$w}4i`?0mXbe9@_PqRS)c%A`fagI>1=*daExPSWZRtWV6e-@D-{Siy~1IRz5MC( z{ zFV{%N>JPBiovO#$liIye^lw}BXp63R3yNmX@1hj1Zr$^)8s~symrgbRIaiHm(L>!yZzrMEIBj-EZQoAB zgo1uA{#Zw!8art(pk!3E+tT(^r4=38CA3+=i&?P&{;QNOtp6#m|3PZt!SlI=6wE*x zdh-;G$zJGJga=MvK;<|ql7P>!v@PPGu_$g%CI-|mvVYVs5}5Hh770LC9YByw0fIz0 z?2l~P5aM)9VaLae&$Dl*EX7K&vd!`VKL_sRrKdoIf&caaWNrD6dKZQ;ez!iIgey(d zQ%B1pJyCeil0yRY*N*y|0pk3x6OUt2eGyyy%DC%j;NukpYfy)QBcDe}^AdKx;*`wo_vnK7EBrt+C@uaBFVGCzyw)!BJZ^*mEAI!CAMaDRah(zD z&_I92*YDa+mM8dEa5VdyDQ+?=F#DYb+ufo3*qFjC2gzuJus7M)HW?xG{R4`o!v^{aP4s=27Qt@_PJvwNB%3sE=9Xz|)5~QJ!EqmWNBcIESx( zy?ld{=>hONZDIE3*~w4o=S4slfYmBQTH+I)?~4~>h$BIhY~TIfkM&i|A13+V5>H<@ zsBI@%dLKqsna8g>ukU3VylXmmXL&ZM?I&4g|46>G|^{peSn6J?Ud zn0?xfct-Jh>p1au?d}loR;vhd?aLSMQ?m|r?W>pXW2266?JEbYpG3L#*~Nudso|Z3 zy8@OA#3$jMd`PR63JXXtyu{5K-|Nr5B%dvmt%JQ8T$O`t+3hoU^~K}Br4K9MvZ3~v zP{8|5Ta?0uu9zI*v$3ok_qvTSVtol+b4dK=w=~7R%y?M)&71`=CNFd72wZYObZF>^ z;ei2s(dWYH85QmWL+r?~%#Y$S@92;TnLA?|9y1EUU53_g{%MYBYbt^R`TNDKgBnn4 zEKiu`w00CkX3Z?g@mIpz#mG$NLkdD`6imMpvu<0y1xHgyFeJxMPXW9XVT8dMoohp3 zm{Qsq#s$TMh2PRxbxt)zs-z(d=yvF)`iFU23484Fiu#=tw-vawM# zFE0_Um>HvRvtVUDep_BD?vcTqwy{w*B+Ia1Yc69zQD(teRY{AW$%wI~8Uw=|A7Dc> z>xniq&V*t9Db`RY8#r2OgZwXworM*P#goLgT%I!r zOzO)z2UMA(I;OM3%52#@|6HIIbEzzyyFLg+)_g$z`##e>x08nz3kXPz9vBGmKlho= zE}k}jzRi24tLeVV0eF#@%QwSwNTYp^FEPE~j?BDX_S7wh5~hB+SVA`;GV%QmG%!lQ zh$xbVtA6!L*e381XfCuI1nTu>lmFiCkQ-WP@L@ym_I?7!UAQjWdp&?L1OnfJ`!m8B zP=PG%iStHFYb6dkHZx>7#_rm1X2o|Kh+)Y*Iup2C*nix=Puzf7?<$du6d;f~hXK1M z*bRKRCVbWJ18KiIBVE=MXNTG4526=*Hh;!=u|M-tT=IM!hp`=O{q~l>FjTROsdJPdLl{e6BW-|I!j@xt*>)@AOCtg{r467wHFK9D(l1)4t2`sY>e zr`p|{_f~nYd=ZD)eA8Wt*Q$M&_C8Uw`%E?%f%rzQI_!S=$YouO`rzUsU$YZq#_Hy+ zGxAzEK4z?zVR$AM8;a3{kRnKeSY@`fyfmSO&#f$)PHbZFtxqA7UjU5Fpw(v8NjkWi zK!69%gj*U1&e9EnZ3G-s>p!3&fI^c;i9V(3oHz7cb!Q0r8Hnzfu~vvD6O_8IiL+M7 z`?t{wFgku4odDw%V9b5Pa@YxV-B1p>$v=2*zIhwE`8*Rbgb2nlT3|p!Ap#OzB80pZ zjRH!}=yD9Ujyuu3wAt1tBB$Zz*lC|iLWEG43tH|= z#x*S1NeyoYA+Rs~6xmPHuF&X9hO!y`7cgnn=5Vt86uC= z*Xmbxx4~BS`jAfuskiA}h911%n;$}$mXCg$TJs~LgynJ=q1Qb?m&PkY3yzj5k zmI6v_u`2#cdJtiayKw06xg`P)RU^)@b+GSPRDp+DD84a~sxq6fPZ^4nE|kJAQg_2$ zqid@y7fP2qfXG5)Sz_Cbp}+5_a4x`L!vo6eo=9YoT+5t z!&g77c7@=)Y6_Z~p;1nt**))Onu~>C7Gu$ghvd9!+v#d^&y$QS(0HOfdsn;jU;a==D5jRY0N=dN(GT9bj_ z!(P`O)oMipUy$Pg9d|@(32Um}eu^qHTTu{{0ry-cV{TQUaX89B%l@!)m}(g__E>ur zv;mua7{1stN#-N?oYHG@?tqAe_%n!Ni^u~py2NE9930EI1Dq%L3jK0wpxvR0!6k{h z@eX)eEDJav5sOGg2H0m2(M=rVYd97$J{q$K57YCx<3&hmkePp)v6=so@IVqSMEKVk zWB(5f4sD)T1{M}Kz@!J5#28p~=m<|?cBVcxLpWMMy#yh%&>Z>;3n#Mc3<6mnhyS)h zL&@yn;AJ;3u`@d0Q}F6n6~(a}H?|q3P2ze*vV1ziPZ50$!1?PK)ahCq80ssb*HXJT z`}O@F_3CSI`*(Tmh*jcvehM4kvDg1R(EFu`=zsa7zOD)UdMKpp)wx$D#RN^W|~A` zt=vyAyuf+h(B&5F7z^pY;`8l(D(`-HoI(XJT@6he4@ZTUb2g+LWwzX?LV30v^joh+0bXkX_0q!o-49hz)+Bug0$tf=Q|N}7q`bZkZcN=NHt$y~c#n|G3aTnNl17;hC+$WK-f&EW zHJFio{u4tpm7~?AdJMREBX$MZplCLzb4S2RIZ-z*2GK7^oo>r+N2ChALD9+#Tnt;% zv|VDbv|V_bX6$_YLGUaHT#UM3&N_YN!;XN@jydZD1N|{|9Gg`2{nL?GfMHM+>aQvM z3oeEOwgbRx5|B07V8{{ngd-Bj*q_tC@||(YGBv~wR@d>#%N>{plUvY{&Fep~T7a%; z`Q_S6jgW8WL0VsF=Fxvs4VW?40cOq(W*(%qO@P_H{rIKS$Wg|2a>j1=rPRO`gq1dP zM}i|RrXD3H0$fcaE@Y^>RxD^QHS1u&c5?JzBJ_4MkD@&ehK?C0fYS1}a_+a1>9-Q= zPo*sR2_V~)-yWlm1|CHR0Qnyo4|4$ICcouUzvZ;Q<$uV=0W#9vf60>myZzs?`MV96 ze1roc54cNExRdKT2O@R23A?S6+R=uc8{-DFnaAT7T0dzukr({j{v4lbRQ1^Q8A*GX z(G3$_xkc?n{y>H>m~yb!?T10u5C_h%vkL1@R&F= z1NmSdr;@`v{o;HhFh=P^F!ci%4{Gt~xqCET$K@GQQNspIdg#z^0z=!%YZ0TT^i+Z* zGMjbhLp+2Fy;)y*Jw1$M2cmtuJ_~>OtoN$n`dLq>xC1G! z*Lc0bI5~zBGnM(RsHdlq-O%QhW1|<@UR*O%iu{l@fP@$X}%hghZ@>kjjATCE!;+mF<6- zIh(|eNE(p1%PkX;l|!D_Modkl)KCijB#A{VJyHuViACSutM?_qpyLm`ei{{`w2eXNw+SVc%a7){l-3yxos8vr5f2eKcMvNObm?4{fl;D!?yoI0kp-Z%S2>j%G5Vak1tSNcij~ zLV=hSdmj4M%6&ydP2Hl-$Pkiya#GG%i{SLRO~+Nt2()S>X)?OglrKyJU_D0#8#tnOTXcx1rPX0-iwTNQs-4HdJ#^% zdl3%<)X5@uW*#HF2@ZzaCA1H4BsS>q`SG&3u;XvWsQ9f7aoAa3+iJ_3fDB_e`CN3D zJ{oed(Qsfb8S)T)G+6J|rj3E|c;M*RvA~~ACq2{2@Z+Iv&W32@Xds0Wy+#iY-S7HH zC+GZ3m>Ji%Nk$yaKi!NAN;;XId{NOIus*XDn8F_1q6-(mQ(J@Dhpx-E?ic!cVtstR z1BJzZr7M~?#KtXUd2udVUS{^oKpLo}o?@JPlM+*djgm2lgw=09&xVr(G=_d@M)}xM ztwZma$5^-4D|NO;eY4=8j`S95rMFu1r(q1lw}v;ZOhY7{;b~26h@Dx^jP;@TtE0E3 z?|2gz7Bm*KzV`cY>!D?JCeQQKtJHm+S_PN2wrt3)M<-UDn)KZ@((lki(WyeA`A_SL zj3%mGRE@P_)Uu+BbyuT8z32-Z*c`M#l=)THBla8k(>HiLrH5PaxXl1q&` z@_94U+(W2D4T?4zN3yP6x8QK2(>A(Y(UmM#Z;hMi>qM3|{;2a#Ku!Gx8(PrKxr{1z z>A*7~LA4l~s?*ASr=rx5f0jl~U_m8716-do@ZUU*Gnwy#g>T%=Sn~}IEP}dW6hA08 zJUD+{W*FwA){_e#0}v8GTfq@Kug(dCqGn*Z-fXe=xX??qM$;;nZFo~JJm9MiXZtL@ z@Ti_hjAC!jqEFPFhkfQ3BVZ#77aI_|Gbhss#h3k#D_OmyAbIUA%cHS#E9-cy3!Q5g z7DyO)s(mru4Y#C5=^V!@t>zHgN5Fs`vreiDfoL4 zDEi2i@e;;^d^`e9_a3C=2ucyJGJNIrc-#qBfEMDBdnN~awzj9$bbKKr1|2ySCx^o@ zeh#&cjApL?Va~kZUnT*ZanBt3GbH6?WomN$nUE2EwZJaOl-TzZViJt+&>T%-&z_dR zI*aXsNr_XaPx(@s765ETg7x+7z^iROC?g_#Vzc#VEP3%usVeH1nrA}9`YFTFSmlT2&!T63n~3z2On5$gnMR)SvR^xT}NDj!2o7 zw>zq^3^P|x-Fvx%D+gBWy(dTov-^zJID(vM5K}wo!8}9KBAy{I z1j-5Rl|zulQW?#oEsf(F$YH6<6uyc8{RtBUx&=cfk+kE-n;i!Z>?m_T zfJ9u`1z_w@g#5o5(#c@xD>M2UF;Zp{mRULAY{aP!S<4t_mnoO^!gkjQNX$t*4k!ohB zu@aQ7bUEOfwsi}Lnof+v0h9&#O&h!ittqTSHfl96Mg{F7M;es}BUskvii{<*hX>R= zm#5YYq)&m;RF@<$wyRZ?M^YGKU8GomlUd01wExDUw;5V(PtP;3TV0N{Us#VNZTbCM zH>?_Ved#GIQUr4?TEHH1Z0z-*j05U_^o8#RxImnD!7SNwI+vw#WzC@xBSzWB8qOoJ zYoZ&@*CC`7hdp>Od41V@IkKOUHkVpzPpE%>=PK3b_K zCP{n{==<7Gw2ksEwo*+obyV zL(~)R>8e$;D(7x%TbCVaHm}6iO;-HB*7)Dy@k`F!YE#69@yMF#bLNW2wrPsJPKVa> z>MxmU_9|T^8n^bnZR_PnoC)-YpSlv{SyMp`u4`J7<2Pc`33hpoO_k(f;l5Ymt^sXc zSH&upR9XuV&csv03fNB3zu1-jzr7k&ayPrm*X!m#(K4A=ove-6TH013Yqh&_%*Wdw z*G)t>%l3^qo2i@qF9g%%R}Bi$>-_6?L*AOEhu&uK2N9|5a>(4DY~G5lgzX1G`vdnUL)OKgmbH_DX;IfCR9;VGtUTov$JqYEl- zu|9(M%uXM@^RNkDZ>1<)$qNLYk{!H0+i!UDVyhzGiFoWfYTlX0%tx;250TR1{#>E{ zFg6ug+Kweskz7?(UZ$bDdSb<1#-cO1o299A?mP>KzJ=QpJ5TPN1A*aQ0;OXr{P{oe zd5*;F-$4unH4E51Edl0UT;xAI|-2Cms_ zt*O-4Zh8wvi-R?y$tz>HJ$wk8^*XA((!-~#UljQ}c}=IDi_c4vwB2<`I zV9ELxOu^G;Jh^JOr=hU>U*CJ+O4!a+mTZ^u%+Nu6m*)7@60jzEOGU57RLogbuW%1b zd3b2UJ)wzS0LSQ9ka5em&)(P3CaL~Qq}XEhC^6VsYN3e})73^`)XBN;3Ve%g3S5z0 z0OMKWPYbcR)kwrWRf?mdU*|<$#ZVksngPh>_{EPH>MKQu-IY5gMu*%PihG?)(0(d! z89w*zq5gUBBy~jkbk{nX#4)mqpKS?C^NxkDN}i{Y@hAFScC~&YL(r&^S`;8Iyw^s9 zHNKEzgm<<`p-zqzY3!NG*AXFdo0=jy!_$n38;L@ONj35<>f0{2Bzmj8iQE$}algr_ zJdcTEc{-fiZd`5$A;R|J1LnNlUd@0~2=2DO%=kl7qz`Ar^cGBiwre)E?&_g{+C#>n zXPQqXzcp8$l_hPLr~IIQp8qf4lr8{dOEf?L0BK-=|L)}bACM_IiT!p#3^1YkpvQ8; z?&)M8PfE|AExZCKLJ=YdV{9hgpT$i!y34X<=;Eng{=GJ(8@_FXSuly9`cc;<2pRWS zT9H^;ZCEz}ORseae{D^UPsNQVZRVk!%Rj^38B_lya1KrXV)JfoviX zr(o|YD6daG=tIFVdgXih(TAVq zCyd7P`j>=)%r8gZk!r~(RA4BS)?1n>%w#!0c|tm;Gi<0h*~i+|zuUH4i?q{xyp4q` z=hPut_5Wv`3f~SGdHuIO$QF2l5f-751We@D`_%=FvjWm15~fFgj>G$Z;Kr=lMqxdupSr|Um#}U#yIPK4 zU*)~S?=CVE1b?0rDz|Pmi`8Hl!AME7`U6jJ!7iPv#er}iQ|y=sT?6JcPNw=PdNWT5 z1i9(az*ZR6UT4;zGta*R1BVI-notS3FVas>`a$WiT8xNl(JH{qAuvBRPGQT!8gNJ% z{iUWDQhS>0)z)5%Q-bxFHO0BQHSHbDg5s4O|DJkK+A!$#em_t|O67k4Uwxq>dRa%p zzuFZ0|HT|Z8;PVH?N>2< zwxp^2fI82cacaXEZ!PR}r`h;h(8oUXn@8YP$Xe413C9$G!z}0(83l36M7|=A6(*q! zw)@*wz$?%WlHru%=@|tvub~E4YhWa+5a+4xt60kQ3ZGCZIhYyc*|rU|`2_%256c4vSuBh2FO!EN;4Ku7~|t zH~M?Et*gg#R#eH4DvScE|>1GWeEscQLK7pvNTdjMRgshtR&6>>qGfq%#g2%T(xs;Wk3=_^4i#NI6u zPv9*Xb&p?^Ed&Ap zfbgq%|6AgQ4i5hjc(%%<-6jJ<7y21LLf2?=wm5W2u}huLEjQMoDeyLz<~` zM51ogJpOxC2Rxw#1W2hhj?&NMf6?`2FLM(d{Vl_CheFiI3w6ddmQ8`)rFvR*5wcMS zq5alC+QPp3jRd$T=3!5Y^Bd(e`dcdEabAJyb6&*A;d$FxW=fq)PN|h$PLi2Ytpp`$ z8ne;0M{s{BII#hCI~2qn-$NP!?}zok%8}$0WG1a=#Ikoi?VA!I&8hL4q3Alu5=`yW zU2dJ(_y+EgtQF`5OA9GDu$8}sH~Yr`<}~6v3BJCkb1&%xTt!82J{BICxw7LAUKqKFhH30_ZmbMUc^d{i)V z{&@`IJ?AChb6@=t(qZ#xeZp@%UbDG1tm9hKw7XrQX3C`Fj7hX1I3rX4veC?xq`M#BzPZ zs#Gwhd$4j2;NK$%6#TO1NU=*l>MMo6C=Yd<+^u-~ zHRwM-zySZPF8^U$A~Z0a&;MPZOJD#1$p5Fh7`r;V*xUX`W4coW?XwtAMth+iJi&y; zu!$s=$*ye|;52I!4l#@%KYwxiEm^KRXDOg*FD$dhAP>#I{P{1}75KW&*|?-mQPU%f z7>N^DfLF{htx1(${xSZ%i74h(~P6_(_2 ztWH0jQr^EecBx2RO18hF+n$T~oP!*`h0H`sqq=zrFKg%as5@$Y0t zVF3W3{;!?K#lqCql>Wb78UHh-SDLa>*z6cR=pXn)Te$wyZ^jYqYsTD`jak80WTfJr zV!4V{n3$3~y2wDJoM=$RmgfZlJ6;sFz>rUg-Lx74sf8$zUu)mP?K|IB?Rm;0}O`2uPWKW0}Rb+8aLi z!PE9*!xaPnG|9iiU2)VSEao_6fHz=1NV`NTt+SWV1PG~Vs=#6Lr1~K%)u>X%H~~3c z{6QgGxSqbp0EfUaqs!SIc>gozU%sa)EU+ecf`y3&g)LXHj-Kb7$KU`WIht@7{Pc#9 z0|AaO7IJmQf%<%!>`tGSCMIH2zkC&XVQ<*V071@bI{J5hVa}Debzb*F9e{|b1^$A_Sx%NZ&%xZRY9-m?S}pHxguco-zxi^?l0f22k1o94VWLtlRD#) zfaiSUP?6@NE^w`YXMKHuy;_HFtK}Xl1sO+_5?y2$l@;rgP-uK(dFZtZZ+3QC*`}<$6G!A_lek3uJ6}8zR&Ab`fGs#V13`Ot2p#oJ>SRoJbs?~zD}4} zmp4K=1aS5_#x_}GPR2<9i=pqFVMCaDyLnk+IOX(pjX7XM>@#dy+P|LHSRXf z=c8l!o>61TgAm0Mf2!i-5E|0A2iL+c`QR{)U1<7vVZ0Eug`L91N366kbq6D+Cbz^C zPBz1*zjfydhfaFpVr7c9P~+Ehh>U{osj?x{H82N*&&GHujIhUpIH9BeI1@7C5(@Pb zh-7ct*fq2ZzIG&|dvCms^DrjJ>_xz~gHtXi_;TGFr^{4lJ7Qg~#l4BpDMHvO8j=c5 z<0dYf;u&^ead$%^w zg*+{{%3pVQ6M}Y6*13vTPrk8jb$EOxhrAtFyW`I+XiM0kLqB!9^rqeXbi3GZ&Yse* zQOBsIy&Y84Y>{Z+UK`7d1*9W4jiz)sb9OsWV5^E^(&8hR)YH&~GCLp!Rls1N<{2R3 z4>?eUl~*7V^*G=9;w~DGIio1INnT+PVaOfEzg7%r%2G!R8`SH?{0MMEA60G zz%2Pe02kLEKDA~`0es9_sR(k5AolD_^}S8igf`UInWfw4F^1x-s-b;u6{*Rm*9AHXNuC~<%+cKY^6H5 zUh~53GTuafI7hkH`mNWQ9-if```8x`i4 zTIZ6Bb#u+;RSTHi>pszn)5)+qqTaCeEB^1E@ju;!|LiKvE+l~)zh33_-i79o96?Oy^4mn;?zn35dbQQN9vHpIEKJ6kHpW9qB=Bq2rYm8%fTLN)Bu`mfnT{apWr>uu&#E@L88)UHFYte#7RSW%hx zy2Bp6Yg-mwamyj&WGFeVn`8=i_tW#FYe{c{HZ{1a(~4<_QQ4-MjoeZPAq=G~B4Qjc za3Q9meHA#~(4$SomH^Pn_!8etCEjPD-P+EOXdQ7;7%-G1-~jPx2isNe#G-tPHYtme z6RRZGB{HFr43u;VP;WEKno)#fb|%3lk|Byzp@@K;;As?0O-c>Cx0cZb?Eo#-00+tZ z*l|tP7_)-?{s~cBEcM0m-Lp9l!PC=3O$3FaOcC4MuuP^#;?Pa{P#uXSc|pjV1mJXB zY8yX7ZRa}O^d9AD1_0PLNZU}@); z8?m}&%bgeyXy?65Jval%Axcvb&QX(tu7-?SBBWmm18o7KKzoR83syw$VtsNa2+pvu z?j70$IuWetjc=rc6B9Ak8}#8a+)714p3N@_wbm-QA!(WO+_SLEhsWk`5XgMqy=Ou6 z@t9^jS@68bT!ij<@iKG#b8`H%bakd?_|rJYmlUA&B-)cE(!b#4yyO-b=TQnr&r1Fl zy7m13I?OpFjChg1-?T#hACbMYsf)|+ImiEs?3>j#l{O_1e0OUd&OJj+jn`<=$wUd@ z3a(&PiPldOmKwOHM3Pyvld4=7oKb%f9tmi@>`_}K#dY^(5kUn zG(NCiaLq$8BQ?Pb=EF(3(Sz12Gu>sbu35pLqGsS!9h*?UZ|N{g>Lsw&l0TRNrwAt8 zR0B7&Y^=|>(UxpVx1nOCR$r4!fwNehaQ9$nt^w#gGPiFeoJWRU=M)5sE;)vaR&9bA1;!3jeJ8L zG5AMBwImwxTXbX5`R|?V;v4yU5mJ2fcc5~^!MH(8)1K6jojK%I41~hCfQvaxmeb=^ ziK@DONAjGi<6 zX1J}e9+oO%oL<|2`2Ih2Tf=ul(w7pqI8n=1WX&)%sI@$_VHnbmuML#F?P|z8*>6L$ zxHqZZ+Ku(NK>nnpGg4_DmZ50~oSNVz`Nq5(6#P9QboOS~F{;gwS7f@bGe8Ub59ZoB zZn}4*;9IXxwUvzr8d5cD5~e3f^etw4bJ$6wa9V=bz06LiaTeQ(T0xY5YCS22H;ug+ zys~7Y*G@k6+02pVwv*@IsLMF;y45G&lrNWUpAWDsO1SSzWzh=JE7!)nFUiq2yM=JU zFmKC&enLIx?BPECT>yMYl+<`R z3je*>Aa)>Y)NG5|s8#?CsBV06kbgY8G<8M-g-xL4<<$nc6?xse{|Hs*=5Ir;}m9EGYPo< zD;jVOzF~VCSw$j5Iv=0xv8b=F)qw1sG}sZP!81krm+}#oH7<0pfbZYS_Gw4vHoC2P z=!sFyi~%2YCJ)Wz$%)bTYAOD1+k4ezqgjS(0VUlDyePZB`}>!>{p#uE!Nu&~+e7wF zO%=>m_r8+y8^DjWPY z2moeVnXXsMf-f(b==p;G)zD@7S@c>&QBj4KbkeGC%h`UhT3yc3soRc4)kKXds~76! zq)Zn^GtCBHFxd;E*L*g5Fl^$%D%H0K7O1Gp1G!`a@FDMYz4>H^Zd%b8P5S0Id1k}$ zUnEcR=KQQ?@CMXy$OXE6o#9ZKuEPw!Jx_Y9 z&`o~Yb>>vhvb)voVMIF(-c;84yfIvL%vPKsJPwzz3)UHYj*$2I#Wv$xW#_(N5m zrrZkehJ8eRti`-ex+!1eZLrKQpWF+--kx}84Ny%+*>b|GhT|n}KN}{Oy?D9lOjZWr z;jXr9^FJ78(&fT=(cmozw3uYOQE(*o?E|7(E(8*T;%HHeJPiG3P=tdiY5^*a#DS2} zowk+$0cSL7(lr!I;!wu~v+)N;&2rBG)tQF?0mpKW;1Y%cvq~=3n8KBRD|PuHKEi3n z17MIv0P(T6f<1Z@H!RI(2#B)Iz_gqsf^ZUR5KK@SL=sqh3RsX*lS&c<+}aw|ik?HM zZ@=pm%$SSfKO;m<@5uw)-)9F+P!JdJz~ZcU8QGiGNdbjLE>acJNYcoMgn>QDMfj5p z5S#s?r`IGw#EpAe9I|i|qyJsl3oyWGc$D%e>K`1M0!9cP9ruJOMn~VoY+9b^=dg%) zm$&h|P8ODS)8RvT%v<|65>F(CRcjmmpU+Fjl%k=GMGzkIR{n{EuV~Ve|4?iBvm;}* z>g$<*y=)8`)XZs1Z$9f1dRvN z#qZenvcu&tmMAN80BeHKfAF%x%J>seDoq6^Iz~~jhg$7FHIW!wo}Hq@bq$G<7^4}Q zFq%^?S#hz-AqK*vLNx^IkCLo2?Xcq8b z6(!<vufN8+JD zfLz+8rx%+H246bQHTz%}rQ(4B1eEIDUOX^p{Q|OCNi<+=g@-3;eJS8UGBBux+$cyc zpHA8j-0$^p6>}#M9HuN_q4*Fd;^9#oZJPZ2GVT$*x&OPn{`GpRe*a918{{9apsMo! zc`mJA-XJgF%o8Na`UV-$0BK*4Q`KFpRS>?623xN#v+< zh8z=b%FnBG%gu|S8`s@*BojZfrJ=nbEjO|= zmT%d-{M59Ph(ER_gB`@=E)H$47sFmH_Wqic;qPo%_-tqqPv5}!ftnK9UL-j*p|!VcM+=H&hpwgGQ27F~lQ4q$g!&TS-zP&JVx>WdZwVW@S}t zYLr(uFKaFJ2`o9>r2F3ft`E3;MybSaK}R&B)-Ilm7#DhWeJ3lWbv$Q9jHd?si>&9HrbYp5jQZH zk#10FZq)bcfW_on0)xXb7#|;BSz55EmaTRKqS>FmY7z3FAf+7+jT>uJCYRfoFBGQ* zEh#kqPHYk|5_zoO^qTShBlj{-&DkE;i#5xl^);@n=5`mpj8pqO3*eh3L!_jwUCHdn z6^z9+7?h(md{$lEQIb}?>dEbu8wA7GB2|g;_rxN`cDrjC?uy@_ zR3uE9TwY7rIq3sQQm8^O{8e^!NM07T5T=PxIBestYafZtQ;mUXH?v5uoVvkx#`!Rc zt4I-zS6NB9s`dt2Ij@4-6njV8UK|d${=$l}IlZW-NADFDXWq>BiJp{nSZPtoR$+x; za&}hTJ4|Cf*pW>Fxd9W*9=|clYQ{7h#+ci7iLgn$G1y2dKC(t`13uVJ=dD|%87xe4 z0HCjp!8ohg3M|LTQnjUW3NFgPm0X@T?kQZj)Sc0nAKi)6t& zkwhz!gqPH+)c@gDeKzmaQUE)v2vR=Jt`7JUZY@w2zW@WXE-6AP=ly;&32Gq1it zS85kU`X*E>OSasvxcofE#%VJJ|Q8%&!a~@DIK763(ZO_D%41-_4 zwtqc{ww7Rbd28?2?rJZ1i}XWCBMK(qP08KQsHz&sVSqxeEzOyDPrhyxL<+Y&Y^%0h zY^Tr-`}A=thRhZ)P$V;OJi)gvpJ`;ISN4;k$h&wf)arMzvX|ecL3Xt>3x$uXC~F>8 zeBSjBwm6HISL-!z$VpX#P>gx%qHaiWyQkbd+*edr*WV+LX!n-^Nj}g>-s{L>eJp<( zgWA$Z)t3XnK$-|l<0a#FxpY9BSc5{TPK-?N4a3e?U#^LZ8sft(nBoZJt6kUWK z!y*r!ZU#pn)3TABT-5rD`H$vUgjN;^fRAPb!i0ggzuatFTdUVNj)Q~r=a0WeaLs|i z;+R+l>I%T+gMWo4TwGk>I1!XbP!hn%E#=e&fx~b7+qA29JRFUf7uTMN$H^m^Kk9i~ z$KBW<8dGS$4X@Vh9&t;(X==zZbvqb>Oq*+><>ucEJv!L{@Ezeh5H-X>loLp%GF%r9 zgV$~jUTs)STQ70Nwly06B@HGv+K9Gfb9#~}l}-og=2S}?S`%CoAmNJG;G$9O)O)M) z`Gv4f^D@fsOG-AG_KJ={sl&n0+4VgAU=U!Sq+g=HUD`Yl;VJxxi#VsQetBcWX0=Mj z;GK;>S^}Q;&>bJRwhoq@SKB+k-gI00e(>E1i;jk&o-fMgvaNu{=F`EFM3TKDA|_t6 z6zDvsp7Oa^qO4r&-EFyDGgPgBr|uQgvj5t6b~{*u6zn);v%E0DCcp;y(2Xo!5qCIk ziq;sh8SHp&aa-0}Ey8H+%Li(vFM(t!afpt=XO{~koz39t$ZL=Pn)r7gx(mFxP=(f}bkvCuN>-{20dfk*Vsm}H9k0vF9 zo|aZ7G7UTVs47Y*R3eqGNbr6Fz|5HWjD>+bR|`m1F3NpoW@fb_umZ8rHSH#KTntMP zOs1Kn7>R_LSqYiA$(xw%#aAzbtG0I3^`^H#(rq1vX^bthTnHi<42Hqs5YD4r$9PSr zU2KtC0O|-7t+oR6YcBSM*Qf&@5xz|hNdJv)r_Iq=f?A7tT<=P)K0R&Q;01}S`~;t* zYVW8#4mrJ4=py3217pZyLLEdt>jKqgi>)&}j0~^Y6h;=0XCf+knuerfy=(@P=Ex-l zJKEtbpfNBryWN(BXJG8-%XK3xHk;RG98UR?N!7E#_*_@P!r3`r!u^|t){y#QVO|oM zT(-xHF}&Z_2uh42Ygp&)Aft|nCtgaj=D#hY&1T~?Rh%-1b8HgETaEFM`t%}!p6OiX zQ7N(%jTREyk|NYpm)#yqzVx!@iwi1hYU(6-rzmVKZu{DS+r^!>e}aXp>gF~-&gK0#?0Uc4&_#5Y=eO-8ZjbGI zZR2=f(rq`o)~x~*FNl%f1Ad%(QDf+lXfTft!KX{{Yv%QK38gVE_1U5F@foS zVMNGKrZ`A=zK)Q4U4Y9q6H%<&;y%lgaLA$)mpu0h@teJGI%mZw-0&T+Kw`s)*4Nkh z7^-a#NtbJ!DRBkk!9J&J{Y`7TzeB6Fx;F@+Rts9-lkw~HFLp*j6icSF%|s6)uWa(h z(%VTUbOuD5KwFXgcG&g2w=1YCb%&Lg|4hLIN!oSYlXXfiaOuSig3R(gihDni^E;M9 z>h?UO)UJKO^X$0*?Ft#^uN;jhU1RV5E5Tg`p`fL8MaSVgR!{4(l6i>+#JnNuMi?p4 zwHQgu{YkRb>>Va2R{H3d_npXiPkn!+m3|fR2C-PJc+|eLYp=&+G{)fnm@PWs2D*BQ z^BD?RwXW^8t7O%a=eZBwJ15lso`JIesjhHeyEB~G>IRgggNiJJpYixS9@rpZ4Ng0h zImC2c{jJWGWKvPGx?ZSc@!4ihCnVz$TgFpTZt6-VHVxm(3jd)+>eC}Q3EZ?>Z3aGG zoNindWw;{?S|p-$7xHlXY`KQB#E4d8Qu#w?sL;`=PvjQ{Cy{ew2k{#crQ#8c}X&1Jyg|u@rz360lOG zc^Iuo=?yH5eI1`dx_ZW0!`j<*2yZJY#m0(c#YaQz7wz-D({=_RWiy&n>H}69*1d2%gz+1@_qZt4I;7XTJ?CD+_*^K&+Wnl(li_e%aN&!8&{z= z20+jLp*1<`p`|!zJpf2c`WJ;*maD5@uk?GGT^x|rQ||6zPVED@svnR+)74qG`ii(o zDJ9q-frlF+cn72KXlrZBpDI`9phsfMLhw*ZVf}Yp0M1Xn{5g)0%}B`+yV*w z8`2s=i6v)ILeuvOc`B(^+etO;W~1ViTgo&S*|d^OBmTF3_^X@FTeTyW)lH-#R|BJs z-ivMbYNZ;cJ&>mE?~lvtU&tpip-={UpMcP%;rji=idq`Y1DIg*Lyc?3EDp;+*cq&< zKawo#JH2W|;BZQWJU#Lw2l#%U;;(d!W}pMT@V@)d3v{g8P1`YM&Vfmn+qcxW(Kc!eAVSX6C1F-DmK*1o>x)#nL3@mqTY*YEL#shlf?hF$R#QE0Rcv%WXZ zZm+zr6t^U!;3z~Pg5BA040UDhJOmyX@hoM`KEu^s;!12w>>PvWXd^B)LW@ei5pC{i z*J`~OT~x9quGTA@#>hFJQ|5e!nHM#kH!f3{>5*J-GT+e1h!jB6`O1bgX2!=68f^{* z(7*)Pcf{XXHKji?4g;&}7yjonIX9nXM$xF*W2y`!ec^NV7kl{o-bT>Ho9-KAo^)+y zH?Zs&=^x*px9;d9ETJWB$a((Xp578G13_zY3HX9`kVCu(cW}xD(?M9nDycwV;BIOaI6ShzA&8)P?yJKw z=*GV;%QOry4NqOx!6ddJk;z;vD&7QvxvmpNPyZC{VqvQ7O|6dX%1 z2}>7QcC{S#d=)1=kTlyP(`XWv%jPi9%79K8WIGh(1{ppRBMu2eJ=`5I7mF}hdT~!h zeFRS`dD1o*?&!2ku}wAtJ_Vf2ajSFkMBC~^a+0t$?b7>m%f$E!Xph8VS__Er=r-Zn zqrUkrmQ3%+e?;s4>CYonKhD1r>@YV9)>kL?#TyY@_|slAaTHt0+Reo>ozg+G`wNIX~)S|6+uPhwePq*p>A_ohrWI_(QPewVbp{-787bO*<`G_9RC z9nwh#W%A)F&F&{v>#418qH(!Qmf_+E7(|{{bp(>~AI+VnHY5O&oCciX4dQ4_GE3^f z;#S1#=DQy&tyggU2n?ve82tGG1`%HHuEd;V76v^Z%e7o5gI1%jF;*ljGJ5Z8j>f!{ zG zZkMKya@lMuEq*eR42g8-O6PgAS8fspf*rT z#4ZlC!Sx8b?)>()KmMKa--1!;#VMqFtg&#Tcn&oN&3?t0+HXA0@|wSH{|JPI6>A8E z!wd^{5~GvND-%FE3?X+0hj~}HSZ^mNiuZu^2Lpe;csE3`3k_juv#g+PJBIm+)XvDj z-qRl~w+o|t!3M!7&LO<|KJj(R(TOhTQku-}8xmxcQWLj5^3s2EC#kooRC z8zMX0N?FF8>Us1NQlrl0L0H2tm_+NO%iJkv3P2Dxu)Cs_zDS&_89B3a0kI7{2UV2r zbp({#rE|AR3xijMCV()`LPUWZG2Bf#)v3p$=oxO|yL+B+fM6QmgD!J> zxlAn|$zdutA;Ls-Y?kuGSTdKiIwyt(D@qC&(qKTPL;v_z>clq11(fhMwRR$5w00iu zzt*HP<3Qg^T)TK0a;!RAn{4F;Rey;9B5{UcWhHwPj||cUWc1(5h;2w4GBL?9;O-R7 zfp7T-6$^6gwA&T6n(IPw&HInEDT?td;Em6I34I+w-2Y{$5ec7-6esz1q0h7SqnY>b zFu5voR+M9e(WPY-3xp4b*@5)Q$bkk4A2{p~i+0mV3Y<|O0K1`LdM2O&feg8fhru8v z0lvpPxgXDuh$p4t5L3cB7r+L(H!O496U7vsRIhRv2QNo4v}9C+ESR6G$d>2!yyvtE+n9)s z3N3L?LVoF%9+8uibt5CZPPSqFE6##8LL?cPP$%FWRe)ZzDo|IX@j9wYw>mbg1d?Pot+Q>rWk;Uq0&00-Pio)62Onb za4zCWB$4OyfZlr-lFh(o+g}ZqS_sG5H{1Jx3 z`TlM*EC)Fqw7-wn&?;iNO!0a=n0RuI1F!sBqK{+oTnkDj%m6@c-|_v`|C4>y zZ;k2aG(r3?iI&3WK|W2Ap%1rWi>etVDQNsI#HZ2!Oib5*^n1&fJTa_d&Jv z$cVtuaI3d^hHYvmScEKbLQ}Ax@qot^AJ)|Elv>r!D89c;?I>?&R7BscVLnFiv(e5l zeb3p*N?OmGXs2{QG;Jmb$LG&&VO$4y^rb<%z>rBlO!#Bh-RADswtpk2(Om|!dHW}1 z;NItS8a4vh?#9ixFm8=j&xBoByIL6Dh2;|6`i@G(1~g~S}v$332#{;SY2 zomG-RVTsu59o>^2BN8B_5TP#_j*a1F+CWGH(Z9*O3EY3l&iN#&B#Z(t4O1B~yA^Z3 z=jg72|FEAU`$7-LMUe@BY=zv94shPzV)z)!obe;)am~;oB1p$_-y{hYc&Apk7uoj$ z$V7kE>)7!%(M^R1gIf(j-OJ`}lEpH&6Y1bFve^QBI@|eZBdByyWDiCeB%Ub$mC1Y2 z%l=#;HFkz#uKzaq;!F$>LneuM^>?CcOD|i=T(-vb9+-nc@>}O=2Yr`|9mNxc#zY{P znDxJRp8e8o^$X&DPk3Yax7V);r(O49ct>3ES+^C#FxyF;x+!7!bPzF&>xr=iPE1bb z(RkART6G+ap$#_S2WoSHDmBvg$skq$kFI0@0|rtugK~3Q`O+W>t!X2{6YH*;ukGg- zfHY7+`@2k?5Kb59cFOI`{`FSj;!wSz%wp&+hyCd@?l&1|%^{P_5Nbk|_>06Ud`GN_ zq5djo4%&4Vtk^4!g`g!Y4`rL*WEqvx^gF;C$nwQ!UwBWuViH|z8Qj*%tC8h=KQe?6}3iaQht zffMvrL^;Ad3HYwJtJ}QbcD-{v0wZQr|B&!=V*gVqe$=NO-1qZ++k0NwstM{mIuOU9 zCOm4S``J#}{a%5>@sVX(* zWUPe8@3_U7w@HcBHH4C`s70hncryivMId@m#0!B2YB9I$TL*fh3`PHa4zv#a^M(Ii zU`)jDCUVe2xiNRE*=Uw$tl_ST@3{eD9=}y}_A6zQN!}>y+pmG5h$d*;ko^kM^7;6l zaA9Od6f$r@+6^_zO_1}LI;*7C<4OIGL`k9da>FUkP+U-FVe8<@yDr4s5*(e{Z0Q|H zz#Omn@Y^*_3$2#Sy^h@Eb$kPx^um3YLS}Xbk|`yu&<$gK7OYYC*!x)NyL=w3VC@7s zhBH|9sb=hysOZx`NI;#pRsXNunQ#n$i~#zv0(l`=29OatDlBv7)15Ohvi5%9B~K+b z$0uj_=&>=6sjD`2SLAGrvgY8o9ZO^p;8!-bym^DDKadBP6mc3Yq0u}0?}IjdH-I%Q zhAd48z%u;j()rjp{qC{z_B>c~G(C4Y#YS)51^WM*v(aZx-HUF-`Z<6&`{+QX|5OFg zF&ylJ$^aXaOItNw;9o<^riWW#q$drr8UPLet}*JlN%=z-Bn474_-7!M<|f;7Lp4P! z;4d_BS!9Xh?Wz)?yM%u4c_8(jSR5EV&dD`Np3hK({XcZQb95z9_bnQn*hzQLVaK*@ zTOD<5+qUhb<8*A>wrzH7R8A`{r-)ad@L8Ne}CO{n^BAK z8cW}n%$SiKp<#GCAVF_E2Zewgg|Txk+192KY2dnf(tzLpV2Z)E;3!ONl_S$T?NY&r zSY3~RfxjMtl%EK+F!bbCQ}O4|ugAS*ZD3Y2u)rA_yYK!}_+KVqy>&?M z{3R^klahWJ1wbO*)bx}0|L$pk-LSj0(}9=PJskE2`+QIBeT$s%@ONpp`tzg9+pN*9 zk92ME;(Aw98hX)QHfe~8i)_?%-(?jD^4TCB$KRx_heuuiK$K-y#kgN{|cEiP^|YJIZvV~s>PqW0FSp|cTMn?;PD3$_@lp>Akuc=n1>pWp5OIPYIZ+0(sGAd8J{dSQ}(S8`W7v73PU=gn{$ z82Aobw95eToA(OD#k?mz!7-D7CIbCaM7EBl&FFFOV7Ho=xN~nP$}=Jr?W=bwNNcR) z-EKt0ubC@UJ*~QAdO50xghBz^=U-M~042vMap$53iF;&jRNdsSroQ05N7>$#xGl9mA?!0lf^wm`v$l z3AnN8YlJw^$wEO281OG-&(+uVInm-F{cT`(1n+2XA>n{mP(FW0lOFmA&p1LL6m0We zDQIv+!4}HXflrKnF)@}buh_m91C|E_ ztHT2|O?0vznT>c8moQKf|J`W)0BPxi_!c)K1&$S0m2@lO8&U!Dh%7zXqoF|Gga&S3 zErWI>lsuEEApmYVmZ4R^ZG#_UkjYf)L7*q;wM^%8weH2&Vsr7-g!8s8A4Akk?r%_R zAcny@v>ATY6ZEr-#e)Y#;=)Qt35>8HgNP20uYb1z?bpZWswAqjYD)bAx8c>@jJ-=Vqv zeyF4W*5qoOLTMDOs59p|acQqVJdqFOOrP^`^?LwIG$e^>)wY%#49#>_L=T45_ztfI z@Wp_d7-ipE4X81Ld-SW(Gn|DECAh`Xu!UcrdO%rA%#RX?V!h>oW>H^mN`Hs(Yr#`Q znmEmUM51TK6_@$3tMJKeBTm4I5MmZrD#RSS-DXSuLk$fM`!r)6)tH0#pg#L!{&3SZ zpNR+HE?SC^AEd6Oq-2!+zAmJ{4Tj%tkK(rV;q~xZA5fFVUXLOQDOv+4sd~wcQB#JYX^nzZ3$BkW!C~lMcVjEz zYp9%%Ey1m7uT>sr=ogxM9Ge&-HoWo!$CMWraZYl2DXG;G5vxJzF8}f(&~-&h?Q?|t zI-w-T0ep=Tca03z^YO-gT%#g)iNv_;hRl-L!jr<5QtZNId1?<_Z*yJV zCQHMGUrwtw>T{oD4xhhKQuPy)&s%;QnBC6o;%>Y?RhF{l8AD!1y<99(+5Jt7%gD0X zh}k0F&lzqMFf$xhQcLAsBC!UK{@fE?AJ^!*KRN^*Qs#Rv#=fzcT*K6 zOtbFp=x-{=rHDkNLf)!Z6yw*U@rATAFORPcC@e%9@fD7CEKw;o+&ZOn;uaS%${<7M z@qxZQEf@eJ5|&MWVmsD=dTe(K%Ks21>6PCh1% z$&7=ZpA6;=TAxIgu-?9?7dNJsaS;#^O%R#^V2Ge|Qxsm)MWBF5m^GnyJu97%=oYFT>8=u`bS#Nk; zJnO!KZ9`GOpN%juvMMGV8;@Z$lKDfuPa%wERuP>K77)LUb1-@GIkw|iNqxYPW-&sZ|EyHFNqg^UJUH{m$dB_TY7|S{ib7 zZKYIop-ZC0%Fu#?j1zd z53qPvg9^#*jp%LoQkm~fjPJx2CV|C%#ir<88affU?a)3-Dk&OHEgv%C+cPGt+eCh0 z_8@?fyG8Hkql;WktQa;AI{!f{VNHr_2H;12Vbt&E)rso0R@*jzyD+&oSM{Mw_8(e8B#AJzIi&5Pa|B&!tCM-rKeLDr&;d04c$3BY%e) z1h*%*5Kr2>g&Qv^40)3C!dr+Nw%iDEKXxx887r4?4MAkE4FBWGx3~K$4>1zkRzEEj z$_lKnZGiUoq7 zM$@$W!r6+lV-hl{&gQMhui~d~JDqM^m zQQhJXdj|TozpruiJWN9%3AX?NDI+6ba9|eSaaY))m+Z3oeMM=rv@C0SQ|W|vc)Pnd zjm=HxNDRvOc5{ZIg(`HZ^|z}ZP~g&pzh%AwC}I`q)w%n2{&e5^apnO;gXwp;`EvL? zkst_BnL|ILEU@;UwtAmk5@7bAAH6n%IYdlbU<}VWnOKBv~q6SdG zp@cz;JgwHFsgT>-t!`DfM5DUDRihS**J3%NsAn+rZx zVXT=|va3Vy6755x-_^qsXEhoSbhw?xbS?Sh@UnYg>tludBtz0>VpllgeuTfcmj{#q~(FCrfZrb|Yy#OcDx1?gn|UO!mI)b4lxiF+FImUzcXH|T`T77y0|kB> zfPLMC_`{V0xaK4neKUit*2b<2Di-!1#oUX zG9@yzo+tseE_Dy%3VBGPGnj3Al_C!>vr9M*xuQ}o7qy@Fbf5Y@g)$Dy>`?e-x}CyI zuEiLZQ`UuYyw3$t{-#i<;1-@cxNsW|AVPO4j9h-{wm+9PE-Q5G&PBA=C&!NJsp#1& zP!8^q?xbc`cKnY+HlNqLU*TK+;6S-$^j2_SE)_S&>_lq&{7AUsMq%NZ<6X(Di6O5B zVcH(qR`=TGpw^g&UrR+f-*clUNsy}V5-)kRuzU1vf&Nu%hCoY8kM2E9pMci0PEUG| z>|~IV$5#LAiqWd?V2!5!wL&2qlQ#bVwvW^_PPv>%qhdQ+wM{Br%(QlCWW!F#2^4O% zOU&naa_PYacYJ1Z)>-y3n=AVHpyN?YMyNZ8w6Upv?;}z|Y>t!H5$9q7sh+9DrdCWT zW71S<6lD~-5aJAd^u+q=3!*ctyKwkzK_#KZNqi5@fOkRgG4ke^?W z^c{R8w&!}vn$SfLfUtEy@>`=i0cJpp6cRFc_vANLVbAU`>?Iq=!yb`7=KkBAPFa!n=nZczWP{SZGp(_PHH?jm z*$&AyV?BA_vDhqtI6dV`ZL;oIfkXmV$r@b7;xDXN9Av@H7*i_Wqc3?wLo%;|-$Bh* z@64R%-rQ!tNWN5Y{duPJalerJm~4r&zod2$L|EGVR3zu84k%`}(EnBA_f-IFPQnCG zBAW`JK-4z+^R)%G`Q3Ot?N2iA)EmD(RLN+xbPVqcnojnx_mqgp-rFH5M0@RGv=|+o#Pb66S zMOW)>6qB>*a{?M%%|Bw8kq1x0)AnEJQyDyhr9|*r=zoq2+kcT;7g5}M-G8$W@-GQF z{Vi@@r!U+^NT795Z8NHyZYj$32A(tesri1q}TDC_SebVGlAJ>atW=dE503GM2$uzy28!VbH z6%A);oq?|oRrIvWYH!if+fDMlYC)InANQM~)6V zkz-*%nf6)@9QwpHPEkDCoXux?1+s~e5%Uu>_2P?uOJ`Uz8Bg4a6IoEZA-V=-Mb(ML zTrRhnR53XcaK8VU*o|Xr_!_{i9|;X9;QAt^kE!Zus#A?&O2mvb#9nD_F)OCYbqBb$ z?b>c763c3cp_x#qzm8;}-}`rt*w!a0Nca9kvk{rgXOVFUQ6!&j@2xp#=#3$y6YIt|B7osq=B(Kr=_|r=U@%Z%u!yC8U-t#1_UEc2blC#cR|y~ zR=7V(^7AKT>EcCtp33 zJ9Cj`x)wCu-sUjrNBBz)mMJkhj_YcC&gU+cB8G2r?gRnV81l44#j=6kZB$uP=O&9r zr%?;3C1w7r1BAakos$ar-eol_WeBu@#x)lmWc2M`Oiv~}Embd>l;BjGQI?dCqOL;9 zzAL`c;tnW{yem+%An4qMy|NQk8rM{e4;kdFgz=}Sm4HB}solDRxi8t->Gg7c%&NAC z%#8ll`-MwV<|h;n-epnNPpJI3s;ITZp&73ut}TVhx<-vqrqsR;+WVjT&gltBu1CLI zR)4zJa3J1sdp^aA35=BXSG@2o@Nz3gBE;l;yexHIpdl??O!+)8y$0>Va2EyJwWX)N zwnyU1u|vX}wF^AA(IZkt>2WGsmDV0Z{)WG*SBx+61v_w8!C^n%F{m6^>-7lSARIwI zK?1;hT=ElRx;yGgiyo_C>oE3U4DW7&yP&oh_z28uxqU;gCZi68P9UA%TDx4&E>z;L zl*wpXwy5enaof*t5O*HkA8{_K#q@dG!}q9k{>8jDUlP79Y2M3ydo=ZEWJGKiXF2%s zeVTfjoWaZQLqQNN9fHk@PeNCRoZ!4iiD7A#{HQFbQ4Iz(B?zR_9!Z;6gn)lFs85|Zu^3wN7Ick?lz&2L z#1LGn6H8KrzGZ4SVwFbCXturW&_+bL;V7}h1-a9LL!O9lSh&2bvi3!u2gb^G39Fly zmGIOBVo%bg^o3Px#Xm@EtEeD?K?w_oaw&?_LFIyso3Yclic;|bG>EQ)J7rbW_l0U- zp(raU&3ZtxF-p zPNmo0ET7XjY9=YYqkQ%dh{RnT1(}g($D_Yah~fJ)mZVm#PPnxBq;Hj02tBQCMI~y@ z2*c0q5eGGbR%2hjZ1gE+&v;jJXxu6VV5#;1Whe&6{~-zKao zG;B*9G?~_Zke@oFh$KLkLk6IN8u|0r%xU;JNG^9OiY|3_yy8ghJ#UZHi}R7LE~r7D z?;>v0nN)SqK#CmPrqk>B^M!i^)Do!|!#mWqhl|utMY^)w^IeNxQ)f~}ad-?oF*ZH8qpd7T zRh;G#J2%4w?mz_W9T|i8f{RfidJxApSfA;|W#I7i0U(1EdW;p!mV#bTOGHlQ)ZOFC zcDcSuoZR9F*{dN^NLakDIw{bLqe0ui&j$CvR82RQ9sJV5Ry45-s~PASegk8JbsK#1 zhk$$ggHVpfT>>*^&!q?vyX<-R=V$ZGRp4D<2$VoyEi-%K!!-tV6Lv9c_SxJ@>xD6 zKSr}M@`liv$P=^VXSD77fst;CPfRe5MrFug9p^!?oE&9fiUSK*=%*~bn7=yyTO*?A z`smTHXRxOOSh&)`-_#V26eS`Q96+q03i z?Z&1`4P}7Zy>k`pT!ICpJ(#U+)c#tBeLAQ7Lm3=APEIZp_* z7=YfEWwp_ZodFB{j(&r#E>`5Xs08Z=S7e3e8=9psxjCgwB3_&6IY|z zE1MvR)0rO3;2!%W(&bg)g|#O)8cZHLbkeA4qoi@29&L9L=By+AD`jGN#~414sp*Qf zP~nqY{5vtf>oS>Cex87Z$=NX5t~vI2w8AK0hiM78MB2Ui&^%@K4x>NDPud+sJ%%5( zQ9udGv(_4exrf~F#^ckGSMFoi^NKc@BUZZT(N!SzERG8$W!Kc~3t?>i*U+%Xh$4tO z2~;@(QWul5D?X3V>K*cgFG85Z!s!6CT#R(j9%czYEH{$8ZqLg-Q~EkqN{j$Pzn)kO zrQxcexO@p)h9BB14rX+(5_E1(C02AB-;WixnFYXA#e#9rHg>FOc>KW^~89g#~=OzksR+b=u>B z`8nt{`gZhPXL*bH24Yy{ROI5m;gMo;_twbou1#G207r_G6ON?{l4(;25MO)}4H?w& z=wgNi5V2|DVsf{KY`KM8_&wlUo@74Vdh9xQVhg_0Tbp8B`t|f(PcAv~;!U1bxB$Si zzBP)-e)k+Ly`8M9Y5I1X;+}00x$#N_hm`Ot_aPM@8B&L7Su75@Cn+AWN!HWA^+BQt zGDylmhaR!=3GUOvXHBntegNEf1|lIMD_kk4>;M1Xhl@o>pOX*VhwB5Z-}G0Y%*Dpu zkj~Ud&(O&JKiWhE$!pgC*@FvrhYQ%?;#6z2{Ql5ebHL2cYSF*)z?eg^ib@y;kjR$* za?Evy@JfuU2(_ldrjiM#NfdT_oxNk*zeX2A&Egyw5qL;6*HR-Bu%9X_(TSC|rE~bp z&kQ>32D*@$jObQ8@Y(3?R<7xlAi5cJvjzGAK4x4^5?w91n_(ojc?5O5B*(%nz|45& zp0lTaRS8eM@_cz!KU1F&Ak8B3j0jWLzazw@(LaNi`E|O^HnN#G1g-CxzQ6>bLI7=F z8`K~AXHnRRH|9c9VkzWs8!VvoTfwGN!6$U35AKLn{M)Jc2C11XZi#}ddR;dK5l6e0 zQr35vCQk#S&@L-=sBZWX!=!>RZm_wFADD^zHb2P0s?uYf@{!Oysq#@I+7v``i5$jm zbM7wZKP27dpHfmr1De9RY||9lC&X!;_R+~G_WchDWz{MYEz7%K_d9{rb%%vh|a zGLzR1#Lmrtg-igJL|x-P$>^h7WSq_sUll@E^P>XCIH*Xlly}T_%M=}wwTg_uOF*o_ zr-urR`l>Jk;`Mgs5LGe@4i<~q2TI9h?Ip|SYGd9t$FcZhW4^m5A=-^k66$A6C7tsW zX*%bTWasl_rcZ1C0`PWIj(vJcg-?a44~7cZjM`pRk5Gt}efc85fGr;rtPOgPG*(Kx zN(?2$0_Ffuh5;$p?)yC&FGt^V$>FknXMA2R_m9;5{4e<5xjeqN)4aZO3U}O$R&8u| z?;q9P%tRLTGDf!(f;_Dm_lMh6WLmaf>Z1m*qyD&(Vuy49k-&__r^QmSW4@BwFVMmC zfB|-tz{^mMEFQT-y1}ZQ+nb%WgzLv_AFNRYbC+`re5@S`PilC);)-s3LNSVPwC@yr zz1Ol4J4tU4ON;`ZF52xBB3h&6#f7u>u{d&FUhm&{JE)_!dc~^y;8+&ZGL>{qRT#bR zjulsJ7oFbV%s779N-ibWDka)b#t~n7>S)7KztW{ri`!2NL_(upgXt=1x-{IYX__a= z{3Hh*wUch449a4|YTdL|>?Bagqw0U`n|@fA|6>4}h~QZW@8s-+Q+3+%bFMq~)_UsC zYi0az$ciPvST$z)NsID*YB1~)vntWtZM!xHd!B0#LPKnIILBxXCOS;ArYw9Bj(@iE zBTfx_j{_pO@;3Q$CXZXelZ>)h2vw)XKoeon9A>->slT6Rp_s|b`!gTcDVBLKF=J!< zO7{n_FmWU(Lb>lkZTAZ^%~p?laq0p>L7o;(n+8p*n19D_M4sE_mKHxuplo9VlU3ugw>EkJ4^bXVX%A;+Lv`=fOjz#T zLrp?kbsc_8PQQJ~ZOHd4vY#b{S$M!+*6w(J>#0^&abu$0 z=gCdWg%>9mpN0|PLe_+@2u?H)e{O)`HjepYojnZwRH+2aTuQo zJUIPLBzG`f8Oe`9IPEOIKXe-KJ2zf|gw?I6!igI)YWlg1s>1403NW0QSZogoWgQ84 zI%gTV4fH~9U8x1(cz^_>a}L&WUo~ zX#?q)wLy_#=sn|dbI1#I(|1yAZI<5j*nQ{ZuW1BZKH8#VBJRH=SE6ykZ;T6nf70Jy zDQ3aNqTox!4)gTES|Op&jz<+l~UOm=SQalOtKt*tCf9;qW257MurjGwx8*prkLa7 zQ$8_6;2rPw<&q|Hfz+74T6>}{IRo{RzdCX`b@^x_qAta;YSGt|Jp&k_o-u$Ml){VD1!5*iKv0{ZF-Si6^$A0mvqM^kkRqRz} z5`GkKML@)VoniDtL@xKu4RIhgx94W^M-n2m*(LcoeFckLZj0%tkdKrhD1B4xyGO+GkHUMdtDGadXBCh14CO38uYI=XD#`pe zFa7PuWt1ROq8IU}%S=@X2o=|?r_y;XVz%QIernxi&`5?qD_1l`W|(-q+42Jv?sy1e z3~hPr0~|F1Q@js83>Y91yuqR6h;F5{s{KvbRBK{A&TrCGykZ`lY`Fn1s81ke6rW>6 z6ntcdBw{%3NW|jCg+Om%^nS zH%zPm7+}k-kmPAnMNaoTrilL7TV-aVchi`z&FLS3Rrdj}E~^MxbhoA{99U47LmA*e zD=Yi=ZZR=yn`~430dpL_9MA9BP4UR z;^rvW=^S%w$h*9SDqC#0ag%48=9w?C56wz)2jo){qm!%+d%IwVLnx5qoLx_Ax5x6R zffRQhny736=2<+#59GM1T5IZrY@gr}p3ID$K3(+ZI)US%h@N-iNT`~wP$52Pe|7rT z+`Qaa7sUlA%A@w`jD^Py_v^w#Hj%uk+$t&|xY{2yGfWZk8b&nYQ4U7dx?VcDdD7Ca z{A7FW-cDprbpn6vh$x*PuqG9XUgo9E<8@IDPm0QYM*PyPxp_LCntxWzo=R*Du%h~$%Ja~SXaO1f>d!h!p z=nmSGpnZw-+GmhZ89ksC=-On>hjv>;NsAYhNX}uZJ9fLjAG^UcnRL~qvGSZ}7HDzc z99*8wgwY@JSIRFRT~DR-Q%SZPy;4Z~BKOu^)mg8Qs17I9f$Tyo;PU3ZX1wQO-_@e2K5)pa@ z)l%WXah!jMTVX1h6X;VZh(ZH&>iYasV><9a)zF5v+!Qa{>zkZJiK$-&B~1OoqT z1VW%w8i}N`eo4ydh_kceYh6v5-HY(rU`GEP^NEqrkmu1;P{utJ{1q9F#A@>XJ}@Ge z8FL(ac!!A$G0*f6*J=8;`K^k(f-ct*h%ih4A-SXe?#mh?l3nu|vEFP8R!M-NUfWg9 z^g4j;Se^e{cL8{+(qi2>SVlK)Ip@1g%wLwXkY%3#%W|?nmV^6WEVqD|XtTUn zTf)0CLInq^(K8_;G{wBwA4_8xi7zTQWBiVw(jkBMbET~q|2S&LIq@Sf>|=~jYkX;` zl4WeT)0U0s>w8E^`VSXceo;>X5r0-m4r63(8atkR%QCk0eATXh=2m#|Cs=3@ARuBu z^^*UcTm6sM{fFi1Q>6Y1Hu?S)Yy$j5C*MBS>#!`Zi`7{H!7h($ZVPFI63w$@jVF(F zJgYzUxs)$3B%34+pF2bj>)RQ^niRSll4~PmyI|N0OeUJ+sFMLtfsv7D`Igp2d(<(^ z+{|wjZm+Q$_w3v9{O9c`o7XxdO&7A9_SsgGgvfzLn5CXNtK81-NnHR{lw+b_T@Wt9 z7)zqMp^&;kYpv$ADSQUtfT$@W?-tWsVmAUT6K-S*7eO*z7tf*(cKHB*G=aSJO>Kr@ zmbRQ!zV^)ywNEwZmsoESk z5?KodgISxTLg3s~;to<7OVC72whNl-JgtjNaVc93t=bTnm))6$tN|fow<(7Wi<^e6 zig^E`-KL$+t9*K&uin%8RFy1kR!d<^VLn9@?7$AEal=xw3QH$j*t6g2x8Aki?-j@9 zzBc+tjh4?`PRS|JLl@)r{u!gC_RT2Iz$G+PxSpyt^~!Z>FdnSdw(D9#%)z!Hm4x95;$ZmJO`F&@7 zhpwa2x!Jx~{g@Zp>S#tcwi@R&e)tZtjqbh~|lVgPyxF7XvDb(I%^AP`~|LFx@2Rxmj4W%%dOTC3BJ%Vjdfg zA&J(}Ou4^thkT4bl3@iRFhC;97wM48i5#qN=@K{nHhD(HexDCCz+vfWX(>s>_2K-P z@wOMdmHBStHQ`BAtRng12LIUUd?yo?*@1Ar^OHV)bm=R%U#?}$TXhwVJMlxit(+-( zuMFzjA#q3Wxup+sa1Z~5Mg+PvED>KSV!`xv@K^m~MGf>2r6~k3lAx)E*jf2c7GI-| z&Ff5d_>-$!<>QbW-x8=#i{1<&M=Ps>EFlho^Zocx9I7Qle~MhR;ApPU_0_g>dJ(WF z35v^^90i8VxQ(x+l$b&%Wt8MCJTF)77*+E2A*yO@Hq^0(nlMJqP!I}wq|k@>jz&rA zW@!t-2PaC2YV1QdRHHOU<2Ag)`71rRMm&r()%xUm5y|%%w@~80a$~)F`OO_bDO12O zQs&~GUFiSFOl%Zy-M+alM)ZLjVs_`HN zz|cS}t6Gqqbjel-rxaqmTqvlIewhtl$gjUDQowB6Jd@B624Bj4JoP_GHJ4-`z*^lG zoQx!!^rUUM9~TVo^}`;|Q7g&=0?@+S~>1nOef80K-U0O^PJg)i;bWp?J{Z}k;iDP&}UqYQL2G+ z%!Gphiq1HE-_twBp1HFZLxxXBXLw35pq}cJNXmPgc8D=wcq1U@A+Ak&NPznR$%TUA zjxD_dl|=n(fY`wGC%f;Mqs{Bw3!3C_Itn>T(~AkR55u<`jLQ~Scb%GXim#<=>B80( zliiy>{{+xYMDkk_Ab_6yH-P@P+rp+4b7vC+YGd^f{3i|Gufn*YFC)kk`X8wS0 z5{tZ+9=gP<=z_oxZbPym?~l0QiH1vNyXs3=yZ?Sxx< zAy7?3vg|331+xn4ZIAWiik4U8vp70WTNbeQmeF~ORTf4rK>Pu%zp~_+5 z>}p4e0QrMue}{tz4_0x^D%EA*`B}j&-SkIex4}Hy2VLmmn_J!y9t!Y{!5AmM_anW5 z6yh(ROH{7dRk|30mVkbM=49^@!Ff-F!uLt6;g+&L$7$vt9v73#ZgMVi)kb?&jU)1J zFMapdK)O~tQ|nK*ky?Y3T`Dg;u*v_~C}Ns#4OXR_cDJ<=ziTzRUXC2Fs$9@FW+cJU zN|b{_TnF)Ns)8clg{*pCtbM(x7}U)RgwS@PLx!WngR%w%4@%pg&7cBPMBoHch3A-l z45a(8W_F{Ij`O3&ngvEM+TuKCZarvwF3OS`+~C{K_V@5T9P&reo_Tk8`*_G$E7o+C z(rWu!!xp9Fr4q4b4FLv{i$SgT3wustB#N^!Fzc`Bix?X>8o1w%eqM1aRY|#m^(`;n zH}H6LDA0v#2=bs<$Llr?*IB4dB0%ab;}@%xRdW3Jr7)chuUxc*&DcLfa*QfX)*-+K z??i{Qq<9~ESOvMRdJ84t!-?qlr1WlaCnt0E-V zPQm@+7~=ddw03?ALZpGCQaI);5$gjQHAe(lT$;;q}0L zZTXf@P37+;jJcJg)3T>UMPK7XzJd{?@vmwmf&FqC<*I4K@9Z;S*5V|;93(MRs1{D%ws z2M!DkKUeTwh7=g1IhpuQoZSVu&xQ5AxWu!=y!)|TdDJ|nP*}y5uO>xx?HFkoJ5)N5 z1fb<6=4g_&l^(`% z31s&lRp^-_rt4fhU4gQ}!D5PKkeYw%-#MunWGnU^@EvIm2)Nk)?*xX9 zy^*EE|92XL_V0!AI2kE$24wzA|IhE^8xz(@gtL|u%YsOG%_>t2X%oTLq~Av*UoT}8 zrUjAk+%v1#V$z=VFGU~17}Vv!(n}$O3)&kE0qxdHY%bl3$pr_;Fc3KOJ$W6S>0R68 z4p@=_2w`7gNkD}rcd~8^ARQT1cnOjuFY^;x0%xuW7G%He*R^&YT+@NCqLHqdg4*Sq zbT@|he(Jq;Ho@Yzr{gH{*7-Tuyt&`=9(%N{ZOo4m8sD z|C_P?lg9tYSdmjT;eGV*klXJ$m%8*dp8d(j%K-i zQSnb*`1gC+IsF9tO#K9UB+YZl5K7oCIOIrkKSk_T`#I~3ZX{zLJqY)A6 z%0YGhg^5ojMvHK6<1(TB_lzO?HS-MWSPEOy@!a+23cpRjgE5q(MFrBOp>}IUUSe<$ zSIjse-uJ@BGGPCBo>vl(N{RT9?OoNJr4OU;PmiSx1#|r$@5;ba;J3NqEee6_T@aAJ zzyDo><9~D<&8+lHjQ%e|ju0$B>BjW`2sv&>7IgqmzL*IK$x8?c5de!O8Jk%efq;<5 z8R+UNic^yh>!IrE4o^@~z}mYghK5Ee>UK?a!v_lTlV_xAX>DU7Z}<74dA1F9L+8<* z`j7WkAX05hO3=tc&ieSWbG76Y2m1LjfDfzE(oulac=%ez6Q^I-A*2QZsi9c}!rWN`0s?4%NpWasNg{&W*QZu5M5AudgF}LpRDRZ+eeD zFZ*HKUN6dX-`($y31{+PcpF42hHh>XQW*@wb;{LN-Kp=f$YgP>++@54Ri)OO?Ha5c zv7xaEK~V|*ap05i=l_nubG5-{g^&3`tCQ?-G&R=ZaJ0{z42MyF3DnFWT(!S1)l!nG zwwr~Aq<18hN|uf%k)s`nCtX+s2LmHkIhl{ARH2lp;H`Ojea*j2JZ!7xJq2(ydrNndw4SB1({lr`D(m@13j_wGB>|gEl*$ZPap|D<@ zf=x|YuGEg4R&~*?%*QjC$hr}EIMeiREUnnS5%Yun_t7cfD=M?aKADVna3GapcvShb z)?^BAr3yan_3<1HlZ7H0Efj?)*l;9X#QtEE1ZcJ7cDGwe*#(O;#I}TrL;$$#o`E?qgTfEQnvI{4vPjGu2?f(o$0>{jN`p zRt^S;`~Kt5`VJgFs`=)aJ^)@B>@HB(EO{b>b>xsn)9|&?3iZpE{i~04c^$Anb45#$ z89_;Yb>eY^@vK%FUR=5s|8CzlD6oC*AhlIac6Y}L>RsL)<)5!M&qvulrv3F-FtG|> z@hLwp+HS0`cNO=4xeyEZ1JD>xb^`jTS{# z%jNFUeO7kk$ppU#g-x>j>^H^~q78Vou-=3}u*P-ym4@Q#;O=t2@iA3RfGE6l8ZGU7E z&~GgH!uuZB>uoM_$#goESd5?AO|n_sZo3}H?D`?l#K0Kj{dh7c(JBlFs` z=`{-f%c-^#0H*VIetq6REK1{cs~wkrX0+LAJpd;=*IjfKfG)0a*L|D|)DLbmJWFNJAh`uX*~tv?8Ug4AG_le^An)g!!}D$g9kD{5 zaBIU@@IPa@JsW5pZP!Sk4^icdM#WE1+K>hT%4G?x*PAsqCkCUi;p}Y{|M^#O0!m;b zL`8;4yZX=^M&d~r?f1oDxNW;hHI!sfT?Gh?$5RzsB)^)?*u``0M;L?w>e; zK5XR<*`3;Ax+947a646QXgy~j-atf#OrybEQXH94q1p7?j>%s6E$JUa>=_L-1uOSH z)sMIC~%Uny-O!yb_xc-eID@Qf9l3u>| z*T7)!u5MT3a(Jq_KVHz3 z{itg6YgCQ{M3QV@UeZluu%(EWYPe^z+eMy7R{XOSYVp8+By&?wCH)00csy=3@7Mbu z0*EregrFM^tVFRe{sEU${HqEB?lT+3Kk=Yb2pGa}c&8yq_@jX^Xome)JN8GDxNzp; zN#fm{fKAU^nLn!)8T(V&Tbz;#X#b30A(-i6Gji=CY@IgaD96jqpV9by7jKj60RYd` zZnA7o!e3l2$@`$7ywZL`WdHDsEdn3{h(zC(C>8Aw;qd^HCjPdy5{180Mp>e2E61-t z{OeeQXfwvYP{{Y-@6&I-yT3ivyxok^F&YjdyFG3DjjUFCpk5(@Rds!|-kmSW-5gGw z;)3sz|I@*Hk#iK7;1Q=jYFsY0|18(!1Mt|lSE5%m3;z0KrOJZ$dBYMh(940?8W{@# zVFpA?LOJD~-$hT#W8g-Soi3leQL}N1_isQYko(i66zB7`zsV6#6^O?_^A-9?;K&8% zMm6tvJYI}!XM4wA?+w+Jy7i|zK0|yT2C{PEe2J3O&Hf09daYqRvzemA@5KaSS!x(m zVrcc%R*StzrB)|(vANGq zF9e6rM|C}P1oY7bfFZkVQZxG?nN?p--8qZoa zZ+nNHt3qcSQON#il2mP3X4p!#;n-n=C}m({zVH11O2$wzG0A~S;!Ba)o8IM7-*og3 ze!X_#dm}4L7X34~TTc1gOLpgCQ^ZT@Kzt<}BHwB|Oge>Q61gnyRd>>Zs4&lzPFiRi zzMPwCLbB7zUtA3bXK75G(E}ydDejj%f3~{1lH6|1$yffR@d|XxBe`@*gOG#7zdLlx}v)0IDhvqXf8DyVPCvQ|CmcUZqlL zm#3nu%F;={M+5bcn~c^LD{7t3HGnJ~m8tB;NwI@gtkhKL`T72+G4OiTwB7Viv`{4i zM(U&(;A^$d^8p4{F?Tl}k9&c`>4P<`%xb-2t)T=(VW~U@jfV2u`};W$0k#=ZK51lz z8teOQjB4SA=m~bEd2+eB(eiX|yiy@|&cD0zm#8@Lh?HxrU(cIr?e;`*H5+V{iaE85 zZS^Q#KVH+nqXiR%KLhZJ>!G2QLi`+7W((~<-rR1JYJDNE@T`F=(3#C5hX&1U6) zvzA}c2$4d+lo@h>Dyt{+d0rU;YR_W$KGgVLPr1ZM(AAgxp8O83=$G;>>=<+!#1R;D z$x|bsKtQ^rq`SK$q!u9ET`JwuAl*nRCEcCU-H4==AdNKA-JF+y z@2jKxio3;E@60?gGaZGLq!cZoK7@i=D!I~_SHb_xFVY=cAhtJ!-Gf6tE{ppFWRg!Q z%)dM@1dCt0OPciG9_B<-nGD38lSD*YqCeTxh!1fb>k9hn^oyf0I~@J0I5YIeXm^N} z1=fdn*l+UxC<`=bz>6S~+WdNKX$6w5^<3R>q{eQuRg=?puIX^{V=|U0IW|#g34viK zu$!%sd90~q~vleBI#{OUoliXRg5I&NZ%%71Pb|N2gfXA z<#x}D^3hivS0bjT=EhZw8T@O+bbp;V-(HXlwtHZkDvF`58oj>vm#gTs=U)%<5!=g@ zviv7Y3=P4FGhgyka$GESlQq790sktkNC&oGLivLTfiO|i+@qbr*L7e;hmZyAtJ_HqY_G|jS7E;AYpr) zDDm?=LEK$v*6fRV!6=)^6icg^j{hUTIhjejI4%O8U2M5khWsBH7VA*(vFbMxHVjI3 zRl$Os9sFv?d^U30+G8O;>T$=g4i|g^RUNTG1B~n(oDf7 zm0l&c65`4r`j1bsO~MyCEFE=znBkKk8h{}AHK^5RAb~mM!`(2i&Z3+Kd;LXKP4@Y8 zh2eDgpUg_U<1vq%T)8hQG;~jFqlo!i9NdVp|9X=!NLmRX3ak(ls&PMn(YNn@4t-g< zwS1`HFd3k-nXQQpAK=99^`)aSqVgL|WF0Jwr8K#&XdeKdcf{^MTpgyruvlaTz|Q%n zqY5&AL)(t$;7hq0S8n&ZsjD$x)B}UfAI4eFA2`8pC$pb?E>_oG>$wk^aG`9lU-3sF z71lEyNg|IX5&D{TA4?yREh=)pOJ8d>9c9gV|Ifpdi47jOxSycwekxa?p&{A}0h}G( zn+l3eL#y>K+Bs0bkuoOSJ?+7qNrriEi$=sFXF8fpU6{TvKQ1R9O7@g>g5PaId0p%8 za-~!nJnx67*G5K}lQ+Mgi58aDhZ^qA=uDk&FzZNzqNCMBi#Q|^gU^21_jGGaoX2i< zjhfO!I3k)+BQC@HIt&}pz*&tS|L;<+1T#}v^+l|Hvx^17ux`Dr_TFVf>8KQ`7gd^o zD_&r#s&vNyB!O9rE0b3D1qF8_+OtjJ)E%JJHJ9a# zlE1${le3YYI*n$z-m&;}xk{lDxn|0;H`THO9J(58*3oL;cR+fq?JqQw94v*Rf$_i$ z?S<@Pva^Uy)}Q~X_hxI4O(yc;0>T%lL2WZ`uzoBKK0L1ao3T^c$YzuL?bJ`ivL-+N>}Khg>Y>?COaLfoZd9cGcqj0voX0Off|;%+>`Sp6oaSWqA9 zthZ#7P%Y!Zx+(b-jMEaobQvmhDXrveDJYOjV*q7MmA}BG-(MH%3u*E9RV3uzd^ifJ zv6<5V<>Q+_0ZGDM9@`W36=Xy4VsML47?R1tPr@!k`0k*TEelCx*5&!ap&!?&rH-)T8_+JjhyF99H{|hwGPK6XQ`hB$K*UKKJYB zc(pxQl>0*tY4xrD8TJw@Ht-B)Tlmu>ux{|7U7@$U~!gKQZaI!rB_AkC3tplu8;w-4+*vT1^ox_tb%J8O_Q}S0)!T2+pR5r6<4R**H9)dMZpu*GKiEIC zaaqjIxF8H$PL&J-Zpi#c%?iI%e3@+Kwa7XSf+y2WAwgUdH`%8t-`*=$i^dn714&o^O+Yih`zX56|3wv4w$z97x&N#t zTgZ&!z5;0XT|NiaZ0`;GVF#>5(J}no zy1?eqlL559@B2f7FLPuvuiau?zI^gb-yAYDj9fe7xG~Jw-4@oQNmBRX6Xr*oQ zT8Un@M=c65TL;5s;nRP7J6is}dlAWW*JC>BoWhP95!5iyd`K}qP+|;c>#UytGQEw2 zNOyEYVk)pmQm9|Y9omnUJBNsw4<@iU+nDW3{^L~}NO!nEhdV{?sQ&ycuf5Ik)!gV; z&dKd7$j~v+WRQkylO{80apSPPbt?i@FLUscf_xOQ(EA>|CKZ{#BL@~+vTqqOe3@RO zN-~$NH5YdMTr@Uqlm6!5vZRFh{Tz1}Bq-6+uF+2tp09JK$6d9!cdNHrypqQ04$|oQJj@K)a=Jb`z zHb3S+u@O-6m&$rt2SRog$Xs@3#?|sZ`eq`IHaM(W^F9Jf86uPUny-2wsLnF5o`a{T ztu6mgzB(AA()#l1N&Lr(#pj0od9sNp1PvsSV8w}HzI+A?|NFHcIsA2^a0cRJpwh;2 zV^exe9GfEn4QO^7?lua^@P2(usrT>ub4|HasQR2DG{}P zs#ZrI{}6QAiotyQGjAA7eUt|gs)sna>Bl?DMd?iCZm2(;V2sR;PjA$*ej-akMYyn0 z2Mm9uPy34_6|;Yw3HvX;)RDyiC@oa$;c_)vrPgvP)SKt-Mk<;_<`0jJwW`IUlabnA#hY{oBcj$w zq5Ij6y2VmktH}!ZK~-oZA+_X3yxP(zwFpS5Sf~)H9~K9sT|e)}B#IhT|j7Vp1mdU2Wp_v4NdK>& zHhBE$Tjy)1Uro*>25-k}(}?*U2Y^T{9-g)}%Lj@~Qu0HvH%bOnH#KABOO=b~IU_~o z&mKwTtubZ?B(ET|==}wFgA|;9Jd{HXxcv55!v=fN$9dxO4z7Z3wYGkr(0#huAoD(ycO*7XWeovV7*JpZ-9eA~p!luLwFUR|H{_WoH%eAM`8k|2UTdZ4>cnfk^cbD4ka1D0 zGEhJJvSNkeGHUc!W(ay=eYL&74g87zf=6yVSKg{ID^8r&uSvovJBiN*a7*@m1O(bTLF*L!k?O* zV(`=;%aUwQM<{qJedcjLS?A38BYi`hf9!40=0rbkb4mG+2R{?!D;1gSmeu#Mb}Bdd zxEutMgsI7FVPR>bo2b35KkYN^0Y-zy!iY@VVyN zEwv?#hYkGeA(cShG&SWg-mC->vi{Wg1mp@?V1Oyh#d1C}h6DA}=SQ~dm`rCl1vALo zWq+1FadNGvx?q$FFbT)!b9Uep)~1-keS2j!WjL!Wxz)((CQ$(BD^4;VyTy4Gvy=Ho z$MtFfXDXlj+l29t|Gb83h@k1D#F>7JlCI2SDK8$3hU??w!&oG#{~-w`A{dAbu|T#M zw5n(|MZ!WPBIUJB-Cd~X)$?LwS86x#0(Fg2L;Jx@qd1E}OX1zQ!S)4}hf}mbXh_Lt z+BPObKy8+4s{(myC2XH~KgYA)mcyshUmA4`jkgc=@9I{%g9?tMn&ouIqBUlg$Iyov z6cgM?Le12EmH**5pb$^A1sYEvf3;l@u$XSs4@8jPLPQ@S5jl?mjP@YF5QfU0Kn5mX zihs!b(BH&b`Us2P4JD1Kh%Yp|Rt#l`EU5@66Z|8H*(dl)MI-|%{c+VUe@RN#+;cjm zSKzBLHYc@Cg`|?(Z~e%M87{-{Xfrz?A>cF56!bWylc?y|*tla?q)|ZDH6{w4T`u0d zI^MtzG`aZ%z_{iKLNvj|TZJREl@~wS+Xa;tJN^|vD;Z(CBa_idh2z@1uC>Ayfo;O% zaJkd}&=L8uptpCn-@<0pU{alWloB;283jiN`*9wZuE7U{JKD&hZp_t+2=UQ2}(9{FdA&SJFPypQ>V+NQ}V_@Wz4 zx`O}?tWcchks6Uv`@y5iV>?fG_|-|0Mm{}v4-W^23Q(KVKOchy{PA=9JpPKAf-emC zILaf+)d-=;d!5^8L*ssT|DbMsOCTuRmR*JHZ!YaMojKpN9|NDsI)gfjMM~r~j~@`n zi{Y5cHyH%ok8=@zAjA6uy?gDrQ_y8Mi6^$o>6c2Q>p}WYh4=yW4^3>SC{qCls9)ud zXo+$5t_9x&4u1Rc(&IU-n+fGq57-e}^Prnbdil`1bU5$w(`v4H%bx3h5Wzl%8%VP* ztfCOoaAUv>Y3jxxKfNF+S^MN_7BQdrUv%#vh6|?g5bu4*=nmJb81t&>V#^rK;(X@} zQf}DJ@|jjK!S!Q1BOulsEL+?fnt{w+7v0|8u6nam%TB_TSfN$!t_hGvSDC5n-Yl+4 z1PurZ$6!}i^He(TF3Q0ns1aT(KEsty;c+hJvYeD&mXWQZg>6AJXmXO#Eiba_S68=2 zxzI0NYI2sfU23Fst(mo@NugoSSr<(uI7&Krk>;D+Rax{}=rk+zkQ}2s9a;BTXT3Js zJ>_CN(ox&KL41VOE{LSy`PU8GzV(D*OWjU+!C&C*83f!!=zOA5C|%I?KVSz3Y~p?W zThH(VOy8B;d;!f`GqN+{z>|}6pH1p?Kl}7Wb?my%QDO4U0*?pxY#Nu0;!S$F?j7? zP+{1!?+u3DM?-YPyX(ydZ4(BC#Pg{svA(L1LtpsrWzv&}m|#>wf!YHAJH+Y~F+@cB zn+i05Ly8QL4C?45qo^hO=P%9niT8}*_SA~izMtBAxPHr-zCR=4ih+NI*Pkxrd1^Uc z=3?K5_JTv=x~NMO=MPp#;5QIb)&q5-N{~W6Tk@A2XB+VO7;u_;jDN&3NYPsUz8${Y z3)43o2dX|o6S>hC_MCSrAJ4zge_qau`yXS)GC!Of-m97zmki~L=krzy8N$q)lR^j= z1ad8&uZ@!Y$B;gje9|KLWFIY4mT*eIVSbSmv2*Y5DW6Ubl{AKq|Ge;ySdVe_jZ!EU8j>zq`xL=qO6$Wvq`I6}!CQI$hb1r>@O zrBRZyW8A=W@UNF8(km2_kAO)-ImE+_+;4eckujknrpb9nz@-1B=eadvY+x8xa4AtM z+-eUZuK(@kfQa)R!^|HX1AS7BOQq?$y?K1W$?Nk!wDAlYlPKaE_=AA5&D%~id<_y& zX=c>uAK#EOkn;xoo;+Ox8UV4Nn^HO50lpn(i#?ekYl6OIDyyu@`q&pCPZxJU>;RNl zur{2c$ze8fdu%FvbCE6iF<1QNyeX<3cmT$$RB83+P80exO0~!h>n(Er*jr8&Q;Rt5 z6T7rNeq7?`X+;dBV+_9wSirytco$+h zWF&k^n1|Dtm!hta^yq`ui}Y^&G@*;G!Y_2j6d@OmX5xZerxGic{rxh!^rl6a}B|0gX`Bcv;8leBqh#2}oi;6P6#*7vnpB zULQZWdWfo7ec=@wFNkBXMU&@$WR`-gkYmAZaWs6IpD99z1ijJDGX!N zaP2|>cI*DSB$LtHF0@D04OS4RQx}^=`tXBOU!l7}kOJh{ak-lq!W~z?Qh@0pzS2~y z_%}3_EHQYC$;w!^=~(GM8fEXcKT+!xYO>LCiacl0qbr+o{zT%?M+)DfRHomok-(}; z)Ux)mexKtA;h@81)sO=QPui=K&5K_$i_(=xv}s5kNUNo<<3r#dsypFw zJokB*;^1}!nR1EIjhuK(ctZD~@`2y8E(6se50~=EJhkBhlih=d-+?eoy8up>3+MCasExZBblmQyHY7XFu%X z1bw~h1z;=r;Lu2T=UYG$OmRpB4J}W6$wqP^saJ05?r(HEdSlc11Q#V0k-c}YK;1MV zlJF%c`T@Cph`7v;W&Gvj{!-j%GPgkiCf%q(^X+zab|f+$1J%@&&_;K(@OT%OzTL0- zi=Jl8kue}I$ZlPbEam^c-NIZ6SbwhG3^7P?JHN`cR3Dy5QZ5=fStBXO_8k+NIeD>3 zDK@*Jte5X(QFOQx0yJ;7^Eip=<{U$&jl5s7>V&50IIYnfb00%r{bU-AbWR%6s<+jb zNNGJ5LdojsB`O&>8mtmP8Xs%nwD{qaXgPCt^eX82s0OpHCHm=tTDcfb^MA6v zZ#{NL^#-ByUCBl7bCptaWdc5XGSp-NQYX18%5J+T7(jBUhucn?Wep`jg*qmJr+fP5{ zET(nNy}aRfUDQ)Oi6tW)0IJ!$@TUH&CMPBIZ(vp)d}qLowEA-7Z(&%fhLG5@p5}uA zV7|wHvoEX?qSH`Tp7U4~jWbZSI^;l&-{j%x4 z@p3M{EX?*>fDFh<3oDmcg&*{Qzu=8^2#@Uxc%^37KQsr0Z1?E{om+sU;30_=QUhyp zYHo8EE5eI0mO+rV_wObN87`@nm<=TLz7$2K-;4r4*P>T3lCZKID&HcfMeWXbeD1t6 z|BKGnIuX)E9dmcKOTI+P?;-I_68(z8KmKDPOYl{%bPf$lIO0vE|4=HoDxiSK+fx6~ zlac*b`3H4pZ6AJXaYsw5PEekC6Q23r9mpPeVpqrh3{!4Lxk=*7faLsC%s^a{<*_0~ z?fzfCgWD6>+(qAMq6oZiQ6y)<V)QM1i{ zf_84P2}bYRs$0OoxKrKsUSd`~1@Os`%3i{~X{uabSI7G-{!wmzj;Zy2D0HB>u&dbX zjwE1HDmRlcFXBsRkC-KXcq3$)ivv(9?(K2}djwOjB~yo~yBCM4Div^L?{a}bx7c#A zgFu3HY`74~^~2guwSPw;L^XC)d}nptaR(Vy=voV#zoyDrJZc-G4f_i|DKHsVWRQur^2@H52aPVZs{ zBQ2=VOodMEfCsV)xZ$b#$FvRjgCi!h1 z7m?zOY8e?8zgyX>*L!^lo6Ck$jFwp9_JPt7IVe z`{#GxqF%5Rg{p4Nc1kzsj=^xxoOl|Oh6godXyZy+5RlDEha*v@Uzy5(DidQE}~}0 zkoZKG0e7P#eGPC=+6?1veiJ@7ty~gDojUfzwSl`42%0b8P>Hy3*6LEZJrgwYh|>E< zqyZ~P<$Zfe-fTTvL;p^w1;~4b_}shzF9Y5L-Hx-qUHp?l3C=OH9ou2)E-+=P1_$Rb z$lPnicW<7s3MZbwn6*-;XPxB#k_ zZrxg2YMVA&%4c{iF+{w!fhefybq6gcQE?BMEo*}*iodVEJ-b5vekK(~NPo67{TT_H zHt-kgJ4$R#CH|KndC*uMX8%E2{nmaNU`6N$jOvyM@~+}kp%a9VGnQBZdZ00oSa$CCk+0cAIUa7UYPuF;{H0I%jee3xBTMUcWgVpPmA2a zBA`Z5BELJ|n^Qm?vdPJhZ{cdc-ykYL7>$%6qkyZmngVL$S4$DQ#jn~PXZ!1M#wWw` zcEMbz=skcy3c9^J9(cMgjCg{p!hc&FUVB*#&=Rd4tLP9-lxA=p>y8(Bw-id^>bK|+ zGJjX=1p#Mu>0V%@bq{yCD*sqx{YwS(xn))DE|k=pt^xnw^m*qX90MGW<-BxXB&pe# zF1|v4gKCYk7>6&7aM8vzI6e-L7^@oN00jR;obU^b2DhW^4_PRPry7UpZwF#yeD#qY z0U0pWy!md9)y%=IYbTe?tu%_ZXp{@>cVC4@&X0JRowFN1up$C$g392NLAWf|B>UkH zaCG4z-?7b9s2bL>0>2bce|(-I@;(o?7%uocsya|bt*Z{Q%sibX{&W}{gM5zd_4%JA zMFH2HT_xvZz(9r&yo?afdmWE_qJKyV06M^mUlGNM0!;Q>8dX}{9KI)?H5zkYdb$c5 zdhT(%x?F6vspcz;^=0rmyonr4ZFGcW31)qKAbX%s>Y__!)~!Q46KC+NU-XdGCFHeb zDy##}!J*WbJ_^gN;RIQa)#91u6!?D({+4T|$Prcju-8A}(rZ7f*?txaLjDrgjpar8 zRGDa9@>xLhLJvTFSTu5UVOZ4T!mAA3-h#Eu*qZ|0(PelapsEjyz!e#@H84j^vU%y_ zS=?9dCG4IpzbmMu&J}BiOETd)we~88VefG2MFfpqM|YJ>k?~Vpc&OedUJN#gE*173PRNDvB75 z>W$FF@1ZF46uwAWkg?$WeITnKPb{tXY>h=i7@nhqo$cxZ1Y;XHdKlO#tS&wkLjNQv zpIi`d*7zJ23b0?h&XaBBS#X&wS&2CBOpZ6HTMZ|LjZyM$`1(BoC?0LLTkD;KQDILv zaZ5AVT%Fwn!|;kJL3$jcrUJ-WxX0MG>4l|&TDTNrjKus2O~#bd1=aiWb^K z>P@fM!N%BG9KEV#wdy{V>`&Phpz)}(xyK8Vy{e$G`85KxL=%9?5++}4C;Idmt3&s?~*<#MrIu>lGaX_a=Lw6p2n&fO?uh$+mb0BJoG8FCj z#=2W-i%RVnDZ(AJ-INm}3X(m0&N7JrV<-C1a6b;z59z0YJ}r91hl8M_qjt||zDJf* z5TX0C3bm|7)>M{IYE%Xv3uxv{&=Clx?4B{6BH9_$GeSgTKJ+fTmQknIs?40@T;LNv zi1$!@-J&aYuXk0z^OE2eW4yqQ^m`&}1~9yeaiRtN>{R_TtXuN~rQGy6S63+)O+~iA zl2C7Ngm;XHVMv8E$l}g@R@$Yu_m^eLA=ipzVlSPlNu^$?(;nqm}5lRTdp=zKIwwi zk$0iTCgT$x-PLH=^IBclfik25AGDUYt2HIHtd&Q9e-o1w52}x*Z6nI083x=JJ?M0~ zkZ^4}^Q(E;>UlO^Cge&a#tfHQU{}1Exog*wCBK{hI(}fmRDY3lM7?uVi0xX6#vZ3* zZNEKyTR1htlD~9Boe_UUig7df6ZLCpO!dT$#9XKC@nrV-xo;7UC@u(YomM1AmO_^c z&!KK5`TZS%80Bd%UOI=LVl-M$>a}{*QWqb0@{K{&WwK*@l_7-O*118iR;h`DPjF=bHL6 zlXsE*gEQ855xbcz%Ma|V80>(360uLyb#9FRNVVlTec{k)B6yj{ z5N@u7NFS_>_mN?u%qBRj8uZEOY7}`65uTx0K@nf3(+d_AF0Luy%?YZu*tsa|vdO7uYm`Xm>Xi8sbKY?*%)A2CPMUh*JgZUxZ5Q zowq|jG~?!4)>Qr zt-zZ1{~$MhF9WSqdisfU& znI=9Lz7J0>BN2EPsytk+ z|A>$f#bHS3($8Z=8PdV#p#i!0cF((D)Ny@W^}wfDy!c$*9jIqdQH&qEYHx2(Ms*DO zS16&8e`@lZZqjR{Ojau$2z%9B6S(l0L!E}$!;o`y zrfnDArE#>d>eqql#Lo70%?z*s)%16UI;~$U%EC-Pln%JVIa|j3bjUrPUnopP(I|55 zNFPwW2{>Md-}2Cap@c27-FwB@fQqL)UsjZa1?) zBTBU=*z|x(iv`$>=qIHhp7-uij?><(`t|8PB?0FAiVf~9GepPpJ)KZdR6PF zNZ4Qm;@ETiFhIB$$O@2BUg1yiwET!M^g52CKTbTJFEz*smda7~zTT$Q#hDaO+A+#2 zp@sk4^hDkEn~z$Q6#i9=?YC(N8ePB5RsHdNpz$_HnCEoPlbYpWg{7qxcLZd0~>9oWkLIA-`thurB$9H~}t0tmLiwN(_2?GC7?-LgU}w^h2|hIY+?cL=U_bZ#j)n>65X4ekQ?6jmJ}kN z^x+W{sB}PkM?;o4omS@ZNhP(oXIPU1eqAX>cAz~o1USwubG4rX<1-3?1DZw+G4Vy%9P5Y=zSMw zYv0G5a5(8FYL^el>iAWG#~NpWWId{^X7H3}L7guoZ3W5QL^>sok8v4ulf%0rY_g@2 zX#4(1lZN6*7^@0CL}*5F@o5T?*V`>%tzG5CbPPhU3d5>K)f$8a8_Ws?Pwo2-bD7i> z3{v7Q%-yg!TUc|hZ4;0+EB(3H8~uqF_qT<*J#kmhKxtHfm^t1^TP$OyQ6v;x7)Pk%Eu)A!5`5QT z1QAEu=Uh;$i5lbQ{Z{h52{vX+P6FQX^(7=m7Ngfnimm{S z&jmlt^+U18Ps{vqqp=3!`=jOh?DhH}PK1bv{$3BUJQlFy4 zD!%g&-hAq_5;$ZJqzLKha>LJzi52FH{900yg(#0F{;OX|Q9BSwJ8bryY#I_VmzkMWCWOTt6G5D~@2`sESghMlIPtxdz4ze~g?T{@LRCZ3h&M?>ELx1^vaJVZ29S z6~)2z&{iV1yEE-kya|4XCpurqLXlF+y(3cUw0sV7O^uck#*;onFACA{2Q)@u|ZkffRn#-mObhI#cV;*hF^t zYE&8zh=d#I%Ge0iCIcLnbzr68M!cUy-h_$z7|vAjihjs{XFDjo7gLcMfAABH4Cox9 zakt%4`@`mf0D+i4YuRdHcSXN<_feV(oAaL2C^u*>?u1lx7yIJj;RhRsBJ`cmV zN<-r?yqDU%l4Eg5qzk)HS<4R@ymF!!y*#8o98z4uKQw~|zp(_+jq_UY!41>eqN0NL zuKN3*$Yef>q#pLULL{M$lH1pv2ECVaMDXd;R#Oj^%Km@I!(p>#d3&AV=&~VEQKDX`x&hyub{=5Zi{BOIf;GGPwY+r9`L=?dI%6hdyOV(rK8)$DJ-y`EAO9^0YbT40S(w&$yy zea9{~x)65xF?@n;-9$3LR4p$1{)K`8U9Oh+x~b%8@*>hqg!Sl0B(iH9 zg{M>M4Cs^L6YUzM?^>WA>wmI}2?5+*D&f1vde!?As!xX_lk8eQfNEq0|>r586F zP)n}D_UT>@OVlVCHVV!U?fH$}r}(27pGB*IY`*6=D-j>2u(#^)2T7{_1Isl@vTX0Y zYoYfG9?ia-U$htW3|kPfZ$)vP zw@O=9A~90Y%hbtf|I==^B#rK_&pfzs^Ir%u-g3FIIhqG&{az$>6a6LxW04zy;nuA^ zT-XTgXOzLkwO~k)m%F0;r0OZTuj6KlU3>if-SzgwvTRwY`sgbz%Qi@m4^)Osx6V4b z^X_C+}F9%fg}R+I}I<+E_wBy874y3CbbWwM8qB%u&D#Xuv`fIiOBzdXi1CyliXkI4 zh{4dGc`J>1L6HQ*o);l@89B@phG8(}FqL%<@EvQ*QujJbhPSDz314qfYPzfo(_p>A z-vUl|_+SK_BC&qBV^#0_-c6O&3Bu!A4y;qsABNuQwj)W}5-aI|Z%@f)M^TU-LK_|4 z7*4U`my}oT2@&WO&j;->iV^sIj)A|DnFrO=sdKujhe_tZaH};yT?ZHXS>e7vQaPoC zImnGdaJS6%UA7HC!MOfx^btT&4O)An2XFDkf;W8;G8OLw(1g=Db!#n6r2hcvDT0kU zp8N%Lj4u7)e1CzcSEKxHUWL8JYJhzjy8ET|uzhKS?Cp^@u0`0J0T4ifUcFHNQ4Izx zmGAES5H9p5VM5!StP%6e1O)&06uUNp(&mW_AS6$9c|2&8-{ah1`%Y5|3Rbl+C85eC z@}%X;r)Z29y&Jd;gdM_`{CIeHG8RHAbA>)IxWiq-{nlC{>w@*qaC;i%vQ<_~(xj-Q zDJQ&pJa6&ZP~M{Fs2n%Swr2&yj7eaoy$){t=Z|lQVcjg>h$_5kh2QLbDfw|{foTqS z?+-=cZsL_E5a|uuTFy(YB<8GDbH6h5k1GaU8i3Iqn#9sskj=;lhUdk&Ylm6l!E0u6 zadfehx2LL%C}WJybh_oKWYmPIo~L*?)$*|vL5ss*g-FSNXzKG07RF&$&TTQzsofh& zbab_?#wcSy*JH$ovuY*~i~23LH(NI$*nF?zaEWt3?YlOo<+3}EX&TdShV<5~>2#aQ ztLZd33%hRw_=p34DMX9dx3wB>c+uY(Sp2#ig%0DJ^bAAM_4j5F#+B5H^m?O;n@c&n z2Eg<(mWTVBib0#LDoWG7ma#&M$-#|+9Z?d_ZJf7AlNuJUBG@dus>A=oUmh5UC@7OT zUo>Z5ZSnW=!2wor93^E{-59TRJyU?T^v$Fo=wDv!o|r8u4iD}ztqCW$9;2hsP;$&w zJXmbHz$_d=Qmf66@nwW4QRbx&Nns7{;C+RK-DA z+kbcrt)?1)zr?lm*H@vB*spA7?w+1o$(pMxm(qC!pMD}2M;QJQHj1*%x%K;37&2(h z!<|kjo2#?zlg}Zs6p#L%GVO3;dt;-Uf%4X`-t@wDK~AW}r+A>Obt)1vt!jtmCW}u_ zN{3Duegs+6L|cK6a0Lo!ibSQfLi;%X%GBm;Hxeo@WC8k84{hL}Yc{~8 z+|UyRno&DFj85T^fs?gBf{;Y0H`K99{Vw7Mb(@FJXog6834?>kQ>2bLUe$cL_qUf0 zPcQ7Pt2yyFnqKC!*MB91ol#X%a|h(CzJJ9Ui#JFr7099jU)y~e{ zh@5U#wBrYD_SFmyo}^^KT}fbDBxHxy6|wq(7Ay<&Jhnj4S;n605csgH z2L^ncoG8Xu5*Y8ss&9JVolWOC7K|`VO9=VF#$y3DNr&A`W)`qZ^WLI<*qtL}kjnW5 zl^2|J{j<1W)i2WEvlN3I-MBz!yUA@Y#D|gNmZ7quNv9$G9|fR^q}O2I8AHJYI=JlB zsrNUjU@P;LC-}`HG#sK5U+NMap*VpFEPGAxIl@5@J?a>4T^^86qW6`HrTO8zP2-@$ z?Hc7y>aGjtH(EjIMD%RXTDxh3uMV-j92OviQ+S{irDef##=+F z)Yb34r%FERvwf>(K-cCnhdLlKY8J}{n9@P})8auh-a?6e@D9bm6sP6JIWVz&l3&Pe z5oIardILoy-H6O2bVzAL;Se-vaEpZwhgLnlD%hupdTP^P%0MLVB3rh09RZpjXwwNk zDf2Yc=h$ko*I>kdT8@9nB$3lxE!B0l=ZJ65>>I)#en63i6$F_lKOB=H-L{f8TWO$aF{0Ryo;*W?F zw)gvs)i2jP%UfQ<7|eo>K+m(Mr1uC}m+OpbKR&UfguyN%FTR-s{A2z;U2GKG)DC?* zrSAu`27|2^VrD&8EBp+*VZddK3{fgov6K12k!Q>O^z`R2(VXXkZv&=>hk zU;ixC7P?jm4S9mIVm?!u^<#K;i1J{;%MiGw@0F*TKo4I&F6#0ASd*}TTa!0f2wl#* z-0MlW*SU|_q&`r%&HN^C40*AJX>s|AlPdB!YFamfPvrDx>>lVZ(Ms{fgyzICe0$mJ z2#NSz=6Xb~8H(@V-PIB7Y87sVNVcvG=3O}-423$1yHfwkTu15{dvXBv7-Ux`W>m@9 z5O{`zcpR5#YTm$>t9F-LjPl^#@WVuyi=h0ouNl%~V+%*gd~Td35{{ZW-^!6yKAE#W zE=kXskrB8i_+Gkn+L&3GeP}9aI&C)zD7S{Fi~@~eBpDtbufGFy&6W4}ynRAAra*_U z--TuPCL+FrJlpU2Lt@PHcerq&M&ec6t?OUk<9$43IJp4T>&3Q{C$12V2TA%H&?^!P zTCZiQSyPaXZ6C)D2}+THh7gs_YJv1WKTL&I$d9_wMYz@Df z4a`!?Q~jopzxn*Dz#*6g!lmDP=JR0FgyunKf3UAFl#Db1{nQiIeLE~7DBgki--F8P zG=_7NJ)2xbVv#+CB5lx1SKV;k(QM1kVd+@rMtV!fA0I;dyjYgW2`X_V{p!4 z?X}mO^L?N9i6?5AuBkp)b78z9g319xKmhSgcByQzLx45z=fi^udJo+#H|5>kai(-m z1?P(JCK*rh_UZ}Of1v5Fhq)98sJf9R$C2U_CDw~fqJPvW>bA3j^(}P6jxwJId zY3cl)##GqjqL3}jqf~>6bo%bPeES#GRR$x~PZ743t$T69Vz3IX;Nhr>sig3yJ(sn9 za!65qBQiL0b`F(FPAeJ7-QF{>_3)rV?a|~FnMZ6xWD+B<63eTlE6&T84i7}$bGipD$Py`7h#m3g;X5`|gUZ54uU_f=Sqx*Xd$)Wyo`(C5 z^Ro}=1E>|gy}m3q449%kao_u0&(n}5c#(pqJDy3%gj#aM^t;sHb10FB66TOH1)Lrw zP}b1{I%@_wmMb9oRA#$Z?ZERKjhQO-1+UVr^-eHiJJQK~IzW`|$7kyhNo|HuV?=}| zu*(4n;dboy28vpit%0u{zFWiq_L^R?W>KQ{{O)K8R%&9|cv#Yk8$6p~$7rJ(A(xYM zFQRMEWUb)fKV4^?F;Fpjsaf z{)I`l3*4aXp`U>B9%cpE63~R1;~l8%s1$0k(ZBxg)1Sig2G~hh<=aun8P~$0Y$@m; zHZ>-ya5z@{OmEc>_W!`-J8icDW{&Na!118d8CP~UN%1Aa^I$0YpR=`XwZIxD$2R=@ zVd9Qc2%y}hd;9>~R2^dvBG{&w6v664KIBLhSsOw9StG(lzL;NO6dI(pe7(J=V*BxS z3sDe3d-={W4fS2=6SyLu>E*V%e4GQKDU)c4Ap=Y?nfw$;sw#|0Q)bvHmoRF)m&NZy z16PAgj4HS_`7k%*1rL}U_RUy4Z+U?pXrpXb3P-oL01G2d7e#JUjKE+##&pPWGHL*( z5%jr*xTe{qrB^Tyzux3!qe5*7zdT5KM|g~S7CI!_%{%Pg zD$?24%wnYrgXT~QE6Cbs>bpvvyL`RT!Byni{j{B?yOnHay)N}kxC$iVjhc-c&D~wF z{l~>dkD7&h-ig!{@gXWgEpVP?>ot3qo1fCcELZ`}fIma=x-lL{l>I$^eKgp!fHu;r zDfR5y{S1GkijvP+Y6&g2WWS%R&b0rV%IFVemTo&}+@89*JcDMTndW8O-t&p=|5$12 zX%VE4Lltaabd&#bo>2*C*=6KOKZ^($ka*3T>YV_MqozS15{V}gs)VX#$s z>Snh)$&8n9t#B1#dVuoOW&o&?zvZ+8Lqf&fB$EH%ND+3}c1-HBK@;ykBmx8N9w4iz z`sx=w`|G?3I77l?jKd^3fQq=LG)zMGZh0e>GJ;&}(`ILHd+&<`>N0ATG})MR)!Vxv zAC%A8x)bXsYXg}CjY3?)jkmsHr@)|TFM(r1%DaYm@m@=C?lAIbjf0upznYa*7Z>vhVcT~sSyzQ+aE3nc@dg2Mq-PK z&$b6+%eP9Ra2@u*%#zcNvf3|y>Be3OGYs|02-q)6yPmd2PYt$0MmNYBK_)wNq1=Qd z1gP#&P?KPaMlwXM|Mes%ql#ep=)HY6?@|}e-wcfwhu5S%%2#oidZ~8K{5~rv@7^QB z!L@RtNbL=SMj_HBncC{mf?s%mu z8gh(dwz$2nVGe15fBeKuHyjWtr8o~Gxf77*sJ>C{Lr6RM95%*LLn5usmcG`H-+z`; zM1ZR>hfRF{?=f4u%E-| zs}7q3u^l1L$9`_N{0ekgukTpI>n8+^8+q``thVS*&O;EVfXctG)&FTxff04$uTslP zL(HBd%X2k~^=)(;*$SgSO_TvY@}Qzy z%q~{M{y98PtAXxcpV*gGO0hyu=5)Q!bWX-f`P?)OXz-eWH9iX`1z^+l2m zFr8v@=dvnrE;kuq_>71i1s0`;zt}10e?EO+z>-ZF+Hq}=QIV|UJ-r7WR|owYbCaU* zJqYmBiiD@3{k&ZmB>YB8$TOUOtr(vL2mniT8*IgFxMoOUzi1FA5B;$LL|?iyEzx?V zEs|QZ-5NpfL$quypRs5&!F*c5Oeb)DxbNW$*h$83Ghi&R!8n5r);*YG;04(<3n0oz ziG9}F?ig+R^+6i{r+9IXj6*-wn5@gi8V}C#Rr6;6VRLnC(?T&* zaVBUtxvah&U41+q;8EO7`=1SmS9*zST|KjgSj7ANA?<(fwmtV+U4u?y>$~!mb8Eq6FFg_>5(n14i2O&l}xEmlyc6|LLL|0Fp<)3by4Joq<_r@ zaJ{cIz7IHOH|fXsjc2#d2PW9>xGm?%pIfq5pddIN%mH)k?e`tEehm#KC_-EVltX{L z(k)!@wxz@GtQQ*c8V_6SKL6k39}Afcn#$+UIo|slxlC%Bi^d+Fl~SWnOXb~5y(T8W z?u!Of0Wfj*;IwJ!zN|hdfw>vQ=~az~dQ487Xbk9o_oHxF&hQ8EDQ}E{THw=TQtOF= zH}R2F(obj!3tzIStJ>k0*{^jQIB9rEHS;K@67zppS^G9bY=jPq{Qs;rN9qW$FO$6U z7#VjyFHWpe&3>+D3%r1QAda+{AI3Syu-A!J% zm5%8yj+f$c@4R1)7} zem9sOXH$kH7Jpxb9m(j};3+2FQ_5xLe3oYVGyqhEw7{Qs^qH%@IOd8c`H>Hd2m5e; zsmBLuitL6zuO|SGbn{`nUmub?_uvlP>)B2A@WV=ehxv~^vd@|Q^_`%QA9V*%;XwIX zEmIIzWVvZYB#3Tv9SRf|np#i)9GY~4J&&uzP9P_O_4D(;gCH0&Tk5Hajm}~KFT59+ z{rQJuxT_k&9Prao{P4L3&L%FwyPLrd9ZW?iolw zdo%q5BLu2|g}!R0JKApzCm_>`iu+@K8aHr5OwMBQxU=x^&t)U5yawDaYSvDyWkfX&dNDY92Ro}mi0)~Vg-jW^sYoiIr1dovP zO?sb+9D1|_?ErE8kDE?Z0(-K6!H+?5^G91i^wvMaVSmxD&FAuvteGoSa^$3bD7yhtobj&>xvt0b^KP`uFWmrOoasmOpv| z04s<7%PmS+V$QN@7kD=RzLq$B=X!JLo9{QyyjAvL?q$sL-%?b=UUAVr0Amk*5_k%! z0X15G26z|}1M`@lOka^m{5~uXE7sT74MaSzUcc0=IqXxgw1<}coRFS_ITT)Xv)g1(ZR z^T=-k&YCQ+z{qZ|r&$9osxg2@l$iZR`63CpBC2(Hfl(d18q(0x886hK%n$w>3RKkKG3b+SH0WoU<#8hUh|r zU{8ep%k|R#A#qm;Q|t1Qf2PVKp3`bn9pHWI?WuF)B=Fjb+|X23yQqE=>woLl|FxPu zV;@m^0iQhz8T#xRR3L8tl80+_eX==KZw@=VmR2F0nK?7MT%6FGD{Zr~<;>SZ?Xoz= zpx${lrcin0g}VmR+i%y!vgqmdb=?5jSsy4mD94ecmVG}X_Rcz4tixy_MzYbbep(%2 zd^4*BkgTRH;%%G66{y7Q4-XtLmb;WmpMEj?b(BhNhwTQMeXf$FrF*Y?4lr&cByv?t zqA+oPNMh5y07u$?zWN2x?|=Zw0I%~0(=kiXVzx35sI%mOQg{z7mlqMd$03-*p@}9Q z6Gj7x6O_EU0VOy-6h+F5!uCroaPk?`6{cTNw?st2@b8D4Xky;lB=ftfR@tLgKk1Dx z>x^r|%Mw`mkfAqgGnN2LT5}Wlnk?j^**EXLy+Tt9%zxh3y1y#82_JUCk0Zfb+sp&@ zik@#*)udgHZ}uOC7Tj89Y`yI6^rvvT zK_hYAko8UW;|wdzM{xhXBE*-tB9GJpRH9?oOLdtS-9t8p(v%-ds>&lH`#eJaCe{K@ z)# zyB!VazrA0DwtdsuJ%8IyL{tG(^PmjWRallaHuG1(~etJ5b43MGTT3;84X|6a4$OIgL`ao;CO$6sh-V3giXW+l>~VU86aO~ zBu6pHtfLptalIF>PvdQqC*MS#P9QdooYC39qOtDV(PABe8;9GpO1n0x8X>uv*FC{G zuB%3x+7(9Gg)`-!(Lw`$;j6ukQG;CIbe@9XpDv$YPU zm259FcjKGCuJ^`euF*%0eHD4Y*HJM9ed49rItF8&Q^6!wZ@F%XruW1&u%|_B+wD{& zqN1h_ArautR!E2%%~FyuAI)Ji@gK{UH^pb>FzObCA=|^W3qPeqtB~%DkL%$xb1b@0 zv&H`NDMdxOe1RG7FtGc{7Vx-x_-#{Zd};y(-x!agZiE64wIBWaBC&3X^tT&*BM5UtZDzTGt z%{%&Z{qzN}yl6);adi`5p$eDPEYY>v0w=?YOh|cpxkiEJc)79s&2G2e+VifjAOXb~ zpYwSBD{cZknaM#{B8V?Pa5cUb{@2e{QiVFe9TPz}1<_u#)n?7&!H@ATt7r?r)(?!1v{x8t*0@mu)P`CVt} zxCLJha~`#cz%b$HF;I8nUBty#34AaP@WStSs+&)Wjg8%*>sk0oG~jGo!;xr`&RVqX z_0nV5zVLt7^p{5hFn9^V*-Z_5>)=_4nP85 zsf;grcz62s$@wrHvX74mxCo)HF8$>btHm;*JLyX3IRljeR@boKmKb^C z(WJV`c!Qk;2J$fcKO2Q;i!nTLIP}gBg_2rBVr3$Q|BJyMF5(bSns9t_2c?Wh&v1{F zauZJgc>cLmM`zn=V*;1;>ynh1V;*Qz`fnj{=+X!*##qx0#vF=?oWVw(!A9G}YW3+~ z#WR^#!r6Au^2V@c*VbUV8aH}@hL7(*LeHHU-&VS+Xt^o9<^;7!zHVck7OiR=DCM!L zF<8biWq^NdnWyxtL!NdtTFBow+XMkjf4Tdc%O4}HZ0$;|1uDS9%*t~4e8VqyZze$v zpZA)Di2s^}j%DNO4<>jqYat*x!N?uSy9Sq8(J_=d)|Md9$43Dk)IHhS6{bCV;OpkSc-OqF_nl&^UIz)hb7RMqVwG*c{7?rL>ZLhA38Do2^r*Sf1^nVO zPwgLo%v$v*Onm^>CucPQbxv zNQtc0EJlyqQ zUjD=2WC>%w`)1hjSu5|A5LNpnrHspECnR*1(@-Dng2)O5B}^ylHCEm z9Pj&;yoY*1$jO&>A-uKmGb=7U)a`rRDb_3~ao_m|o;*&WYC)_Z;4m2;BJy@F{-h`m zONr^+^Ro7UN_`kNQUHXVY+ytgdnKLhAOHPuroQWFa_v%(QM>p(pW*5y@%N;#Xr{#3FXdu1U@MP0PQutK>BD-`BDOAZRPQ{0g7~`SI6_D#Q!zTyI~X{ZmSj zW0Lq@9j}gk@_%X$f~hLEc1toDcPefHETGU}HB(LlkAPm^MVcbjuhgYyu%{5FVS&ZF z9Oi-pY*GWZ5!83`dIAWLk-xq2;Ydyb%#PY*!!pN7OOsPN=gOTMOTi2m6#z1CQ_$V;n+Xg5(i*cri z^B(^3#r51!*!s2;bP8BtKJmA}W6`1benZG;=;q6~Dy{v`Ir#|A0mZg_6acbn26kVC zK`N5rdR(oLtEq)$|FTur#Xc5d_vP-gq4P#hQaoU`%7BQ6px5X&qAdrI>Fu7~572z? zrRrN*xcfigiy1h^>BJ$L@f72IW~{JsaN@viR&KyizP=9vL_+k(9ht;jXhR_$X!gX4 z3tH1-(L$UEf6%j<5&q-=ydt8lKE`QjMsWd*qF#YMD+kzEcXAr-ef0I&u_)a6Ho&sf z^6u|Dk4EOSSV;a7|3b{`_RNhw>8GsDl_bX=q!gqx89o(R0-Fj^=YTk+uLV%bhh-H2 zAGK6W-QQs?+iE|ua`(DW1l5CgkgPRUrJ6Ue^%170?F`LtpH}E@Tx2L)982aj0&KJ^ zH==%KsCF5s)+C|h{gG5iu?*V1TF!&(y6-;?rtvWfhEw{7;3s9G6LIn7Yy$OJu%W#! zN}af1_z>+!DTEsgR_|#N<6|BZu)@nQ$OMD5Wn=!^OTbn*4crCm`=$?%2S7>#5Ee!q zTk7}un&qAWj3TH8R73=`9e6#7a>!KnkC(|+GffnG83p+%$o1*qeY?IU6~ElvR)LNy zy!eDBA=-ii4}8*d08w-pfQv%rotjPs>UrXpn4wAsi_OZZ3R<>^XV4WrqtW;Mz4lCs zft~=TlPV_*$63ugVt={->tM~*a#@h6UnhG-hAqHOp#NTnG?*Y!(!EBF&b>kmA(7vS zff=L;P{qVvhHDLUi~DmBvgmAD0c1G!${ZF5EV@{-rU)CP=_1OvBic!|IBchX3iQ@pVGh2wVn3907~tG zA7!3`dlC)9pTLW-hu{i@+L4N){P)H%BNWNQSYLuXfKS{{hFXE36{~B(ubZlcaTkPT zyaK++h>hCK!d`TtJ$uveaB%<9UJpA?T-D+H#<6*+%=HB+Gv^1gSG6#>rBGrqz^l2S zN8J1MjoG3aziTf~1qQE-T#Tek1R~G$*v!|xx<@*r3ok<%34An^EP!*U9@mM1tCZM7 zh%@{6pXY@clqd>ZRLnB8zBKI*iTJNduzbiwkbLP2OlN~%>)hvACa`l_&+)F9av&pb zNiG5BJLrl2Bc`< z&eSK<_}inyr>Ca}h&cdSdH7e)4Hi?up`@-_pW#$OE&>J?^B^U5lWsG7?x%PRxSBw0 zZ_4S_>39Q-GTVgPo>oEBbxqU0Q0xBB3${qp(l=b7Ss;ZYN!%?&*?0N;bVCIkr1U>* zqkOt4z%K#3tO!B?va{vmhJhe)-O*1|tVI?cmTVDCqr(^{q9<%Hjw^+%vGSZQJimCP z1PujWe(+WDGd)hTo9kXFE1ZV*alKL zh(x|)<>tC&p70l(T)slHI(zc>){h5=9-`jp?nKD#`7?6D;|H?N`OI3+c#a|wgLXMJ zje7DLJ456C4PQwEFnS>4vKsXRZG!QXfv8Oqj=sPk5bI@yQtCb2tz9a7dYW4?+ZmuT zrmZflcMyDZMaT!G-v52*L7M1!MAR_jGtDuo&DN$iMvzIn+lDxGK<4}dm>i7WJw6R? zjA7b(<$q;D?GV>5WeY`z^q=h7G-I2#fEJvEoxBOTKjSi)NhUV; z&P#>Mzbj>nyt)w7i+!n6_ge6IbmKRJ@iihOZn;|a>(}LyvWe8?B;lAMG4Ioifz50{ z{Qh^}&-&Bqw%GOdcm0~m>xUsThGHK7#aX})P~;^W)lhZ zV8ev`{D+Z}2goz;+6Wk4agP_9wYX6&yX;dASVo68x*PHD$Bv*ff$Q2l+kZ*i8Gb{k?n)?<;~?aPS+)1&{C zmqph&e4rN)*}N*ZoUe<0+jRbnS?gy+6rJ)x-wRgf9tds7x7zZx*pv0JoLA^5PCf2R z9aOtV?$Y%l#n+MGGi;E2wll;9q_s?74)ybW^v4#m1YCy=0Bye{;?iCQ)sxzvhkJ8S zHMR$sa~GBwM7JTI9ZoIM94g1deHVwoGn7;?eAJ^9Z6W$+n|}nCM%khp1l+sXK;drs znU;u~1W`HAbQ7@Nd$7bAJ>6`)yg;%Tbg@au3m}^>OP-u*(&ES0LSXKb1M(aoN=?1e zOhv*#B(}#rLb7!(x-;qR?^*{sub1yvyfk>P(TV=dX=Ar&AM|6RkLv(&Mop5%crMoZ zK++Ve2_h2Gm@`(J@#LQNc$NH{n%|PIrjTfpGI&lr4+Fa33Z% z(6A0Q#u(%6;B1Z z23VmdqS$mw3J6H3Ss=i4Y>s7PwBh}N(@X1tBj`v#Mxh_ZO?M1Azx~AUnIMcBh^Dq)?T|F2zZs0|gXy%Ep{|QrhQ9xF? zO9bf*Baz?hrj{QCTlMn$^HUJwHt{BOU--zNO(WFSv-D9H4}p*gryZhz9$t9nOog=a z*8m%-DDpt~H=l}M=YI1H0)~~VR9_#OZgvXP>m1GB{yBB8bK9j2O(Y$0EIt89d@|#U zboKZC%`DgfpK1R=`2dPX9x5s-`Uv=;3{AHR(R})iu>gbP3nku zPFAbWQ#d#m6wmARcursf>QW$}QQ|LSzpmvzh)hvZ=?G$Q{$$R#w`uia9@=myRI z1ylbQk-EZ$a0teSX23lt>vMYac_OO;JQ|s>;HM^6 z1o%PhE6Y)8Pyyywbj&k!vDpDh4MBRbYG#fcMg}tOkrbb=VzXri7^X8!No2zV8-|=h z?F#q8PYJ1sg+Oh|12|*Hk4AjPAf)sc0j3f{e`6%zX)XPMxEhn%pc~Q&M1t_VQQ$wW z1PsI&_ZJ%9X(tcbG+zhIR$GObiX<1l#L}-{(2vA516#?<35Oqm*Bu5l;hb3co#7x< z+Yh7A^Yry{xeQ}ha8m|d3qiH%U^0Oh1nht%DoTU^IX6Wq z#cFacdK-t&x!N8qp;PDVCCil!kc5bcc-&T`rdK{iH!vde3ir)q_a7oFFhtJ-_VItb zmX;aAHOzC8MKCgR5(JAZVG*L5&X=ls3@CGU|M3Di##2gc%t96ZtDpnB;{b{+b_^&o zuuN&vcs@2ozMqhbt<_U#3>xp_Ppd|~Ki zRJxR(Fqmjqt!6o4NekItJLB45aF_>bt#%Ga6BN@39<{-=&njaIshZWi>mOGa?_I8gOBKb(lF>=d_q)0tZmE@#=~Z3npezXbZ^q*cww7PG_KmJK~{y z4;QFhDh`@EsdqP4b zaa`}N*hu*7{T}A3!>WU=h87xe^M`x#+|PGFDc1HP_?kv_E6?rr!m3UG!^Y_E7t&uy zW-*sodVU_SdQRScjsD?z)AK`WQlJ9k%Z%(N;v2hia(pfl&b`yioSt;#_auBohZKL` z75I4r(`=!EFIy=kaRJAU$1OIMY38Q^LTF<75`%U85E1%gHz30+4U3N@!$8dvElUB; zbUU@{y+>dmrMya~5LEp|Rar4rN59PkFtal?umu`JTBbspa=`CBroJZ=hk?-y8Y$;D zU_`cWgf{hMzRt>8P*M62lyJ5U?RrF5$mr;r`OJb`u`AM>f8QIR6&qTWr~fd;WkVdm z2ZP(BFq%#fTE~^i$Nc*$*Tv=u;L5A=aKx^}#y7lAmgqfR1n+IaOhaY$$`?Zp!;OCY zeSdFRTzBZn7C3vcGNVRcq#N|1z#I~Ty7b+;2pzjgd&tfof?zRdib)@>`?Re+mx1}g zD0*UhfKAX0j|MoXh*yl+|Mv`n!6rweM=)Fr1j_bXT`f+!qTGNTGZ(Bl)!C_Z73$*2 zEI^|^{`g^jHD2)57yPF^Of4Am9lX!;ygq4S zRk!NoHS9#4C67uG7ZpW<_qx5v7OA#O2e^ui$|gwi(X|?nfkz8V6xRos6=1;&{g^$G zPj}tsDOnA?Li7c-@hCtXJPk`(Ld%_YC)I%n>A5i1pQ6GUT48HqkI(T#5_=M&>*rjt zLFWknEgmAI$pJ@49c0|Pk$hi|N6u2;!#s-;zXA&OqtR{fPOAW{FWZ)vIy4azvo!IM zDZkBpPT1Idr{;d1+l+MBdnGao7W(cAL5s=a-=87DP@NibPRX=EZ=Cfsvk125yvUsPFbg}CWO^ct7uw~V_MAvR8J z3(42R(rYUpFyE*VzNJTV5L84b_%5evcwNhIw)OlUC{?s25E&NaAa`Osm{>F_+Zu?T zu8a{Y6gE|;v+H~}Ijz8=b92^9uKVdn4*P|sqbHcc&jKzUo{ss1H0;CynVoTTawsS$ zk)6vck6od1pBd8)QnfYc89u&I4=3{ar(OV5U z)6yxKUtgpi`vOc8o37#3x(6FP`;^}bp@n1wK&p0@r)JHwBHQtFbI3!L#EFZxMI@BN zWN=tZf-m3hSuemk)b^%3lYNtwGR!nIFB}dIR%r0KGFyt*yYfql?&<+d^H1SFoYvy9 z=p_v}bDSC@V49(N_*Iy_N|Ey!moEcl^#)kF884SMNL`_IDCiRzG_S8G-k5`U2pB=g ztdFna^pDg4DnT+mV>YTs+)e71>zkjfF1mkqspMh{6 z%7nfl4UY$H^zjXnR3R6oZRAnLI~^5%TSxT&Jz#KN=w|rEkRAr#;bUU5hKK^9#&)K# zSMJ*?s0o*BfQs6A+a}-f5n5)Bd6#-fz+kF?eBT?UDe>n8F)uXAanGM0j3rme`vb|8 z7_aO8KrU@cGm)BW;Tj}4mWFc(?Fna`CEtL6ML+h34Kn$|C zLbzv}{*W)Y^x}t32MVC>;uexjD-+f{XBXp!iUY@^E~5lMX}(q^js+u-G2kT}w3?6` z1u#vSL&Al`QLLoNUjU*}wCI}%;1zySo>ni1w*L1Y6>af?2OK-+W_w&NGGSND4pL84 z_z|2X)7HB49RfCvH$}RNU_iz;|GkG0|D`dQNd)T>^>}D>oW=+;rCE8;*EyX5y2@?; zRR|ul)Mq3#P3W-E^hZFm;&q=jrczC%zsz6!=k zRhQNYLxzCvt(E0DG%NDG25bfgn4jq&kD-=?Z-n18F`gN?%*V|?p5^gv0f<=WYdBiY zbxoX^aucTlQU>3@T02lT|CA;#LL$h@+&Kor5S9JbO>%uq8KzcJ^}^S_x_CYL`5HxX zd1F~+F`)oSINP?2Q8D%xfy>OvM$$1cJ>3|}L=s-f7__4hCOs*8hByEiSvW*7#(mj+ z@kTDb7mDPzs>fU!=aLC1$Rm({Mp)nvPk#{|&62gsW{IhygB#R><($Jnr`VSoUrvJ8 zL>RDX1hxpI6rHiwX}0o1LpCM%YQWN6;kv}U#pd))(UduDHBjdSvT6k|}8zDiyo`JfE%iE28OV5PjSGoFZ+ z2!`<}p#K@_NVNY_5qJ*s)cSG!{B5KC`V%|K-089~Vndd_j(0l9cO>|^>am4d-o-H@ z{78T82uDKjtk62=em%E!yf)j-x6HS(CUjC4S)AM=A}7z^!5e&2z!VV%K_Nb{HWQ32 zzOS`LBv2a5!J<96tI9?5A=U*yrN@V7~8AeF`-B@)ml50TvCKpApZQh=0e3l;u?3bXnynM_jS2}}H15`iFUf#8$kOOh8K zE`fBo=llzI{z!wH19U#W%9#*QY~q`A&#Knlf2obxuf24-ieEv=nEOK4{r(e8?UCBD zELvIWBM(N2WV%PXDiu-3BpZ0oBDzt!mq^@{uW-Sn`3XEbZ9w7h??ErYSXKg4Q_|si z9%Mf^Xyj*Q(eh2HrjCKXl zPM24mlCS!yj`y+Iy~hk!`FDQP#iB`({mRuY)fdZVAmgHyNjM zjRMXH0QWu^MD(#SS8cGOfzz8@gTu~pTyl<)Ss4xVUsxn+->8G~avw}&#%6vy^OS*?SL^Mq*|ZnD^utXEsfhQUHv;LTLNqNJP%ZVgX^yMM zF9*9Qw>SE0DT^Yy=vZ$V9&D+7ce!ED&t z>qs*~j%+3>+Ig5H+woUC_UU1}YI?h#rJ0cJZ^LuCWg)lg!j+ zMx%Z%2}NOa=?vf}|1JPW5Wq-)gIDLEUX&IZEcaeogG}R$496FFG6{@A)j)4%m``OT z!eTxTAo|LSky1X$GiF^$4C?-zq|B7vB5JvBK>?_w;ze((MrXhGP$da@R6pA*f#}$g za6)D1N&$6Z+e>oFw_2zyC0N>iKB0Oy{v#vQVY^r+6eT#> z2RAdvZSbn z)z!y%D+h@SBq{m6&Dgg+m2mtvAS2}gc<-!@Gk(F?2@5#_XtbdGPJxb0{&FMaA|)_z zHmW2zN8YQV(`t2j(^)mItDeq`%qtCZW*NkDOdkgXqE&HoT&~Y8Bq;r>T_L6cP%{Kb z7M5#It~M}AHc#OjI|8L>GJOF17i3#|at#z{Kj}%*`C=AmPqDh-#&vk9wgBE;rGi5+ zT*ZfL@P$~wJw_bY}_6mM>>pAAkooteOny3g@3D-x$HSQN%vS3}54@CY8 z#st6*_sxgvTJAtfg-DTVYc!9dl~;gpXh~wK(P6b6ew^1@fxq4?SElq&& z%u;_9B@(!^*Jnn(nTkBN?QSW4x~c=9rN+b*fzQzf`tippcBYoO2=H|{5yv`_PG}P; z*>d+r_)*6A4I1p?iwn|A#>$EveMmD;j{x2BNO)A2m68N|-1SSD*_fqpTy>Md1%-saj#H` zHqZe+1db-oHb;OCNxfU6)X4{RStx7{J$)U2SjoS5JK7Llf`x5l_n4~Zo5x0Ul zJCnXu57>$$c}jk2+K>T@p@$iW9mI#aJG-m4!%)nbP46a|FVX zQa(aUM(sfgiA)KcDLUr7)^k5`mBlSVN}tlti~!{rA+HN3@^78v_K46U+VVlPMd7#jjR_E4cBuVoHXcjgeBtzJ zw?fOp@Ut$5yORPID}k6#kDrW&0^gD_ew%4~R1upiZTUuHCYxdV@7%9K#0x{N620*;^DLGKyvZT=DU-pIt{LDt)|YdtA~fmB(pBxfkrGkG*FZg|L8veipQnWL#0*RX^ zE&1TTuEa->3VU8<5B1+HvC<0Yio2<|w(;ssxwSrl@x6%Q2%4SBQLP5Ux@+V}06KIA z_d_n_ZSNDTF}zowg%ttuA_tw6N9$8@mm2{gp&X#kO-c|vuk4N%z)(zKk0s=`e9>{+ z`&dJe!5y^QD_1Z0pM)mf5aUfu^{Hmdt0nW=ox!c-&;lN`U4_Z`1h>tMIB^oj2Q**6 z@JLutfeygVBQC%ORBT{CI3e>bYDLhEJ8HiN;}K&nn?7g0{>YhD(n)r~qk&1BeP5rK z5F>o98rg=pomR!?LPn)=c1l~VPu*R?V+~6Lr6Ki#`WNUBRjlDu-XUlRRROm=Mg5EB z^KhOEr6d>e6LHaf_fSW}GWsmW zsKfiuK2MKO`>#;fNak9X1GIDB)Eqn$P<3o`$krdu6*#ROY8t;Pxnm$ zG8e+Nh_4>C>s?c~^H^sXi}zZ^;pN_pgdm(z^%ggU!Nt`uDe^Z((ayD(yFXEySxm_C z<7Zbl;Zn)j-<6x;dUx%Wr3)QWU}mdSc=|t)lkVyJ?&zxZ=82fyCXke52w+>Y50E}X zsydjccpe6*DWe|RqE`h|#ff2kl^3OVbDS}xT-1iOMT}4E1P5AQefg>S>UTL1+s0%h z=@e(HBHE~AdQvr;jZo4z_VBaJX;i;X7eCMpt6l(3sg-Ch*hMSY&R`X)ix*%ey>Ipw zn#W4z!ps22r0g%SKTy8X=6nKAh}lg?FMLyexW7uB`OCmo{;~GdNW=9>Z8ipjuTLx_ zgA=L=68PkVDED`}xGX5|iOG8DTI5GGA4*ldrAaSdH@;r>5VbwU5NVuZRt4&cK$_E6AZi~(L_c4e5px=7Zc|V2U>C3dk>uM0*8RXj9HsxRPwY*^_1ebYd*Okp1 z(>C}KomVIxW1PHGGQFoNlgJ|Fhfs+%m?u;g7-Ptp6Guy^mS(6#qez;M!%Dq%kg2|Q z@ZKUENFVLcJ_z{&s*5j-66@8abn%VC3z3k`6LP*c6FsdqM&utIVvGDpXC2t5%lKqm zE!|Pa{mxgS&TfNz(+;En7zPkVzN|R3oj|M1L%>I1sA zH~MkZsYb#18R-&IKe*|!Py&uzt+Ees6=mfTDPg_n=$6xdxl}C+=J~JA5B+9VO^4J7 zS{FAdJ|p#+&2Ih%dl01#u5JK(7SKtzqii|iXfI@bygNp^wudJglxwoj25hlufr|o` z=JEZras@J7ZxQ(@iWH$i$Gd~Kh|fuUeUczXG#>>^KZ-EN<3d{p(%oNiJ0I{tGGMT8 zwekLLDRh&)oVc!)*)T^T280p5$v4xh2F9DCj%%`YU_HoKEIucCctuU7&!VNRsI73lREqq z(oatAQ0@+(Z$}j)i9iq)1)N64LAbpGVMtaiKoF%)=!N0o?vW)e#+lv}69afcId78q zBZBXEkpRTg;d+(ud_iwnI$7IDhluY3_4(mq8lX~gD9={ z$Ris|E7SM6hZBp!a7VKT7j!%V46@{1;xUB3r@h)R47!EDgchK8pj2X~l;`DbDlW@% zZLR&_|D-%XN$(5IhzJyOL45X+p4qp?T+=V5-1&Y(n?TW59IR2uP94*2Lf3?$ZQP_8OFW`O!Jm*esG76DYgjGU_G+HqE9v zM=l0@9A?mDZV#b)f$lu^tBhTvf!V5&{Z8R%vd4Om^owWz@q~QkdbR)(2B|tfVX9*U-bdB#7RgP;B(CUu_{GpB7LzHyxa1v4 zWmP1GyklcZ+Bbc1%=D6XCOt7GQ9}sIP9HO^b(E8Ws=W_&8-wC6J?d>$dqIc5K(_Je z`gEH^wudwZ<7G1Z^Y+6x1vQIt)qBbH`SgN?Sjrs4jtvmF=O~=ex#i4v73fn?*3#Kmt6-J-q?TuRZi#C_ic{E1I>i9d;ZDN-f3?G}L zdz~$ZCkLdQw`ja7(GuMa$DKr#*O!YaFTyAl^nuj?Y%aC3Cd%$l@_c8igr(wXB^rDV zcF;&}0=L!M6&fuD|Ialnw+|k%46a^_pjgtV8)pKtdd{=4^me!`;Fq~`-jG7@eaE$W za4TqibMQ5L4JuLFmDu|#SBK;juvd=Mw|+D9w*(p(T^vSA(BXW-S5tZPks9^essHnL zcvw_6VXx#f76Hprjxw%vhY1CTmQ$0Xdpz>688${2s&o1AQ8EW=gGDM|k}8z8Eg69aTYHA}R@UpM*_BnA?>vx%ZoaCwdVYKke35^>-WMp7Tq83FxGk)zPH zd&~XN`4xWycjnr_^($e#;61?o6$er2U(1uV1zfY`qOxQMpy>NPK92Bggk0L6XR9pa z-%#hEUr~_uoqfnydw2k1a>gFlRQ30)BCdZB+5~{(Pt*ZM%TtRJri26g-3{h>jWhmx zSLch-ju5%74hl-6&J=b2pC1KGmB|JVto?0?S9{XDOxk6Pl$i?^u0));1?@~udt(_! zY}uA+80Akwy1tb(g7A@p5HgGF2a>0x{BBF2wqXxFw6rxuh}H3T+GIPDYz0V06-g&x zkZ*_aJDK%wjZ`bg)k?H`dZ@YH9cdNH1dLbf2&@Ft160|^6teKlfU+=gZgtlVKpK8$b8T{n2JY2_7?#Hj4zOhQez+UYPBx0t--Y=aIrZMX}BB zpAaeLZeBKfYs4aX;dlMv;JLc=+|S<>-bS2lk>w!?Th`MJPDE0Q^hhF!Qt?4Z_7gA) z5)eE2L%FgphK{FQ6Dnfu!3doyhtyPmGc+!l$`GkgE{vS3YV`l= z`UBw#nZ=f4L*<0~>5x9$v0iHBIu zYIuMciKxk!P#clVV4_xU9B)K?@fRC!G|9(eXHNL~ ze-L<$xw_-EEuJ_EZtdYzxJXeFE`nTI=t>tx*(Q+mgj zAEiHulbOhI6vAZ{st_4cRI9pgH7zkXXkg6O$Zz&MQ(C|@xhJgM&(H5lssGA*)MpBm zyu5L|GDYS+AKb?=F6@qbL>)Mr%!iZRcOd$LO2Pr2hlwTVa;ITjzK+*gp>JRZBKM7- zT-z_Elo_@p6+flWKd5{u%}emfJ()j$X{^8tAP#^B8Zit)MZNy9)dG^KOO#vJ6800~ zMD<-GixenV6a5ex=m4{(Z~ z3-gx{PgL2|aTWf!zuO*_NNVn1p_-?n5;myAfk$Moj*e9|71mIv21k~c<4uM*20Vg zhaAJIib;u}Qc<-85XgtRwD?agN(^qD#gu&d4%#S+cj;*G{*6n$_B=dT+@&ezXUZX9yr1mfTMtc1~(@V+k z+0;#%0P#1pd!GbcHqr?9_eF0XUvVNN>Qo>Y2=M8X_{^to9B06nOTb-Upk4BKBt$j_ z#~#fR2fO`^jfhMj$(r*>^>hrm#2o3!BDG zxg3XY;b~kgnInxN@nD`9k9wF+!+O=kVD|E4L9@SXt#2LU@lw*j;S-hzxk)$ihLygf z8;nRy7BKOn%cxoo@jr{w*_^}SHh*LC$awPSr+GSE9v2xZfjhkNB&=43MSNqtqoRfl z-ir=1FQvoRdI-mTpM_Jvm|_J(0MjRWX6qRcci{1+k9= z$DJieu{;6AsQ3zYhPZ8nhi;MbwBI>hLZ<7-y^T|Zn?j6e#C>jxNYV>zPE35h?m{|l zHuw3_8jDV)p+^Lmz^XXnHRiq4FhYMKA)y=!3)Q?JuRHZlC@!~nb-xncP)}2JuDxBd z8Nm~<;ioBI^0I$Zt8uUvjvaUmd~?ebTYt1eF`z5I(zt&|t-0mV#v%E~O|9lS zHIL*0IbKq2@G%`#E`Ilc^zcc?yYsX2KzYlkYkvJ&dNQ6E6gO@mA59lSUZfK@{PG_4 z!!Ft5i;p4@?na9&N8RV1DLl;C5ST)h8raHKf4*wbD`p59HO@uP9*VV=lnlCULH zco=lG4-X%FAR*x%iklf4`bt&4;Wts2WIX+TC?#kdJv^edj%XB{gwEA~2EUcb(1v+z z=%c<#9^;FH{iT8Sa?ytw1G!2Wxlt16;k?=xY^s``^O^Y7*piaBdem-amu@(ltr6)~ zbLR2D%>#|QDmlsgE*2NiyKc(s8>s0$c{+Vzw9p_joriTgmCM~J?v9)U z#r-k}bMOa-W^MbWe-77270rHfodhLEHd*>S27#>y!5$CbP_^Nq`>x5<~Z)leZ~0ibp(x zU-QP%mJE$+1grf;=$i8y5LyC$;f3zk4$EN=Rvw_Vrd7yw)%Z1+!9$EeIHY zyDtc`_&aS3sogVO^o?*GW+eD+zFfEt`hbM*+YynfMQLLX7kqvTL#FBcid?>`(z;mwhi^O@*Z- z0fCG>CQ@&dK`&H4kf$PfcyKF!C|1`qOB#rv<{p`tYcYC;ULgHiof6xDWQTUc>&m?PyAzn> zTNIaPORJz<8Ui5qCaEP}$ zRMJQnBNKB&e7Yq(13Ezk#M-rAg*2q#e@r?rA=kw;QhL6T21EpAKh5K?MN3ED$kWCq zyL^K6DG80YSsJ!Q>WM&*?B6ELzc_Sr)}sC1Et!3WR4-}!rZ;8+P4Aqnzk_rK#EloV zCezJYg3+zl`_e_tYVUrEl%^f^;Z^W4h<92a`^HNMK8`~zwKP!J?=p1fD$$I*Gm9dW zSLj8x=)>amop5_*Tjm*n)zr2IG-E52QFike%xdB6A*ihQW z?JC>A6PdK=vJ{=SljlM?^-d9o3+0VTdttT#gZtB*?5H&D8!h815A;!&*`Li)i^zm* z%l#~(4tlUpE*KbQinEJ?EOtq3@6*xh{&*f7=p}{_yPA1DKGTzsti*R|pr}X!DREa* zmRA1Y&M0fmuMenA`=Z9u1Lgyv1|J45-R(fZxO~m<#`t>u<}Km(q^LFo<>OS z^RfyLmWXs+uR}UbuHmS(`vsbuCVQkygB29BpmH^`HN=#PK%M!b@vuMI-T_q9WEkX= zBKzK5EZE{gl8~GCDPb!OxM_Y|;+U^D>NlTlKia|4d{uDVeO>VTbc9goLHx$bccICC zv)*oST+B9k#wp452pGt`Ot*`-$zSA?tTHJ zsBXfpdNm6hg~SE10k@&_UyjRzF!~~>?{O(Li1oiV<46#)x$U^x8?zGW$lvShG8vGR z9v+LcbnT{jg16y`R7{jO9x<7pjsHUeyVbk2atZx6t*w7-D}cv^47xX;-d<1~VMbmd zW7ls&8!548*rmAXGZcvG8ZQjqOjv;Y-q=G{UNl^it3URZB@-(w)9IqB1ICa!WMQghINHEvOG{KsAAmftAm0@(mFWITjhZTJT49hm%LF`{GO!xndU@?^Ha?w9l&xRAeo1I%t8p!Y`eB9nB#HeVskrf2 zZbTDkCzyu4d*r2bFt;i9?0uneSi;0UHBha$XYRb{&{zN(Yl10(66Wm+ats@@&VDSm z07O6#uj5wctuWW26D2GG%MZ@^_KJJ3G+zN?)V%4_jZfbfb5a*F>07^$gv-K;7dmi0 ztm!jbxF=g5=A1L_U z`nCLF`**o#1b$>*$-8ksmFI*3DAJ6S6Xi-#jN9i3TZjzC-vMCB0yJodiqTsYIo~ zc@$7)looW~WiJOH&K0&@?hy3|_x;t3ZbpFx!S#V3niEnfQ`BQr?lk?m8u%KKa=cBm zVo45TARH(qbhPn=4XIK$DR%7I3R}}W_IP8hW>zqFijU>!Yn7bv5{PJo))K}q4+h?( zrJ{C-tiaGEvIt@0!HvSJ*2X)zgG@#ly824AHN3?MB=Wzz{&btZZ3-;89ndUUCoRiV z+O#=e^d^^S&3EV`A%5j^;S3Ee+>MX9ZP-n~~7Mh*_x6Zl@CC%>cwF>v{LRPztB?>>7xQek6b3D5+N z7e$Y>dsnGLky~fVON*(ZFe@CN5=|^qn>}BPpExA9>R;%QD0jGhVMVx}t!I^d?I{DD zbRgaSW%1FPLG%7JfUyrBmOWmB31N*hQLMS{v}9=MAvZmM{8jA67GPvlCdR!RKOQ0j zoNW#->NXsGD9+T`f;A{}WmV084kxfinA>4qwZ%;5daEcLz(V$Wg?DSK& z+T~d=A(J$a@+oz!u}Ua>LAt`UfHO2`Z~-y8t>zU7+$ZAK2IGh?1T2T z-gnp4VDj}osoO-ZdWxg$=;$`)Z3R-DS`UpvYT~la_UtVT8p+#i8lSu`5->g-{g{~S zsre+`ya;*xx~+id7;nou=uwFO@Y|n5(sO}eg%3AAYme_tKz;BOQn7xPwErEIfvv3t zhfp($fZ|*blPM`75>jw0eins^I7;y5a3GYgHk6e{TQ^UMW2EBNO^FU<4#hXt?b2WL zKz7NqF7b;BTx?Y;TMTLFyjxVWmr$~KaOnED$f|mi-EmJ-$n$$ym!HJs_O-;ggU+sf z5&i3$udiIjCt-N$ha>ggKX{qF=@>;n2sL*;<FNfJkH+u}*~+SDh~gXSt3Y<6Hsq z4(Ssh)%WO?Y;Hbe^$vevl2ts(1xWp94Ud4*;IO)`>fjI_+W69~yP)>8A&=})FkLKY z((E)h?oL_zWwQp`Mv3mjK+FYQ4!B;1GuWmhhkLnY^gYWXo`3_g#+t}NNi4TT*?NNv zdTi^LAJ_Omk(s%rt^JU9nF+k1u=@Ht=YlA79HOb71f2NFj;f!z`QV@$@hbSh8Yq}* zg&ZVlyxW#7p;u#;k-#cXajl}`)?p{5e&JN|Y_U+ix6}Jp9+42jZ=C!h zcJX`z<)tmYZty_n}Nl#Y7wj+5q6T0e5 zrbg|Pyk!Hsn8#e++i5=vr^A`QlB&SebZB^VS!R|4BZHTOV^|&QFaqJ-)fIwz411E| zOek3>_RyVk!)RwsUlTb(Gh|I~dBdNyq z@B?W(HJIOD@F$XR!`mKAYcdqNdaPD4->%zUuZfr@4=jq9T=yR33fx+MKCKh@ zi(WRe{vE15>h;#2itM$&aO>_JB{qAj1TP!&v8A`~i@l?Gb1ZNtVoa`{00MK>b{?c; zFFtHwZb&@)5LF`t-W^cC0pT|8xu5((^n32Uq^kIp8Ok;MD?(lZpOe@ce_oJ%-PU%^ zxFg9-Kg1N{4+QTH^+VY;G4_)7sOA>G!njCB*@F!+R)u$W;3fn9n=}GDrNFAYIGvEj zpm7O&r?=hbrG0$jQ7~p$9~#?dmp_e5NSUl=6fmznn7Y_S%vR#WFuD1MxDNu!hQ3}x zT4(EXx-73Hx_jpKHGKJ$)*{zg^z~`>o2G8t@jfNP@jgrvau+sI0_(CvED1DTR#<(_ z4&m!QhayW=kCfr+uPEuO)K{9(z$PWy{QM!=OpKaNI>@XprC~VyNfi7CN$<;u9%oF| z#`H$^i^tDhM*cT$t-yc{J&?V>A95@#Oz4Y3ts?`+YeTMer7BV)%qenT*txnZ9hXP* zZ=`?uLE%A}evcFV4fGk07Y9oAkIFlD}ZGqU#Q90|6j@I9RF2;pbc zZpK&UT{v+D(QQRu=;EMTCrI84$ZmLmund-+&j1eTp51&&EX)( z+K2LNQ=6zQnV)9>M1}u<&ni>zkYNl{KhN^LU5}IbY$xP*PS{)hW?>Y&a1n5W6CLir z7Kr^)TZIXV4vuy-{@6K*JT{d&O3Go_Rn9qZHzj3G_W5_!t^ZiT$LBqYERXpcH^HXH z5|$I$xTWzrA*#7l7D*I07wI%@4NrPZQUljasX6O_+m*jgTpu_kYm;!<2Z`ALDWgY% zf)U({-?SkA^D`T6q<;SmhAHzmt=TMgQ%&dzx9qc7mV~i!HUfp4r7yqT&TY)}-459K z@C239wjMEmU0rbtvXf*Em1G@}s;3E7{@1SmN72|2NA6A07h39*yq>~g(vcR`@D6&c z3jb~l`{m2bny_Qk=Pn*iPM{c{Q2%Nl&pbbg2LgvgYVG{z|DzrKk8c6*o_UoEj;i7S zLE%!0C`)B|I zC;E3L(SM$}`?(Ki27SbR9-GfVlfz}edJG|cbYL;004DR*=bI_FU0;Qqb#X1sV@+wc+N@25lnpgt1DDt`t!QEr%2@?oJ+(?&@6uU9@C=XO<;ojJ@iCH*~WdF*0|$7Vyq| z+=oF*96@(Yx6(IMd!>fZ`W`Ge?5{mY?tjceIf3U38Z#<+%30d4XfkfTNtKj$JmDPu z?9F<%uDW9eszhNpq`{Sv6@SkI%7++8GNB2t&EWjQ2)vAJMyvZYL}CqT3POiXujfDy zk&&t!PLXs!{nu4_-B#Mo003n;0y&|pojtsS~lpR3OnPw3y+yK2do$JYI zm(Exh--({odVPN>zeqVOf$Lk3iaD8l+@rk}jXck^M>vsEX|APn?1>R2RxlvMIDyzb zQtRp7gw5sBiZ3JZ0ch&~H(~$VVO99Wpea=Bf9a~oqjSh*Q-pT&SdL!nf^LvB=)T*X zt0!zLQ0QcYOgo)~JT;^OT)#vs;pX0K%Ov&ZzAt@|i%1Z|i<8@*)1L`Ulp8$e#+^y= zW9y?D{7$~UzWut52hJnDk3~lCT&iZjesXxCwEb)0mOLv1WnY-2Pu$%pbh=X%q<>Zf zmy1a4VF{PkegfnKQgNBL+U~x($LW3SvAXkEgmU7NFOb_*fP|OK6wHo?Cg5=pIfhR@ zUfJ9;lfJhy5aJ?&e%3lTCL$c96jkF7&RGUsqY{lIXxLVj^>YjCRVId z(CTlK^Sh~5=@H^cW%4<#l@hz7`lq3tsMGrKdO(Hagx};;ZLM8r-SqPkCgy-V4B z`k4A9F{rU;)OvmwJHlBPuD@_1q%8xN_@$~Uy1V_L1&BLF@NKpRvMK!9Z^71Fd=3A}obUsT>jjw@8G%YX;ANBmY*}xxa=S0$CGR5!N5#R4g)SPzUV6 z2o;S7k(j=HnOMHDDOR+h#|Zbu6Hp`j15ak-X$Tfw!u||re)X22nD7K{3kgu_aL&T` zbk=TMfM%-KFPqHAg-I@;u4Q{p{Qfk=R?YG$2+jfDxXgMWVG4w?QzJG4AAytC-o+F~Juwi47%GfKTv;z5iL2%jnXcDn%_8n<(ur4ZKBZ-rRy| z6AyB~g;`#T7%0><^(_TZT&%o(r)%oqFkH$0F`Cro^wK~!2WS3=lIa#Dpa}j09Qobc z|M}VH1xgv4IXjux6$QF#ZpUZN!n&BHh>%K>+=L*LchLa z&CsgF89!EMk@;eJXG$GhmE6*Vf{<8{z;?uI5ID^p}XD z7SzpOzNVUnMaG}NZOn=Cm)#M_PLyd`N>LwRutt1GkC02A1r|k`^@A!r6G;$>T|+s+ z^1Z?Pj)H=+aN8qxm)~uN@vY}PStW?bw>uWRiiEU?3A|=_Af3|wilqnpj8`zdBdnD{ z-)A;hNOrGKTjQdl5>p9C$U?A{NYH)n#w+RrQj{{v$lIQ7=0KJtcrb;&Zf^5jg+W1? zC)?FEgL0U+v3Hf4$I=?z~vuq1)9d(LFIqXCEL^BBWx@rMXMlh~~GV3NQ>GPe~YEp5|#494@w7-$Y&MWuNXY{0{; zu>J-C*taiXwYkPi-09pFlrm&52&aHfH4&*(GwkHo4H4vWSQ38df&M34UA+~$1SPZY z+td}*w8rjHrl)b92t%bA%Y9Cyy$cjy&Id+3)nPn z;>m@xI$;gP(x@MjTBd1~nw*f(-p+e1bW_oAj{`5EZ16J1cY0sI?J5IkPVQ>;gRq2r zwSt$O>otphI#|C7jQa`a0ZiUc@NwQv1`15 zxd4-tcTiZE9~r>cJ9-t^ay{1{O*Lhg85q%&HnE?;Uix6QC|LPYP`gFMC`=<6W|z-$ zn(KYirVkHZ_c;3%^j&}nE5o^hW;kP968PfT^kF3Utt(G_;KE{SzDohDys6I2f0Zj$ zz*PjKtJ|~hzIc6pH@2hXE8d_JF+zEHyi+}g{+)aByXVOZ04Pl z-EKXWWwrtbr#o2qtMiC5WONefWr7hyK2Y(BodJ2NJN?{=&e?s(MI|9%on>{+cXBby z`bd6C`%U`ze^xUUt1p+3Gv<}P(P~&E$B*V7uzPtd3!g!@_(^4VPXL7oFS+ee-IBTI$sE26`rPNrJot^6ku@S5aQ#}a3_0v9D4B1}B{~2|BENFy zUFvPm?}|0wcLl9cG5`1Q|Mvs*M)6yvC~P$Mz!Ob60AX7tPM1m>YJ262U#xW7eP!j~ z{}P%4f#+xzE52CN1Zr`N*kyH%$(&TLm)UX&LrXut0QvZPnheo(w)8W09-QLKNMA{~ z;+?=7Ha&iPo0(fmW>3>WC3Za(b>a{=~Whgw_IMqpGM=TBaScSk*q+ z-QVt^785_gL<1M1O8K7IFlegw1U{pQS@P-pdmj=Oc1AALVC5v21DRga1oe^CS9c_4 zBf)=@|2MHjkuv5ECbAw11_7h+3f)3*rc`oE%+!l$Of0NyxV-BDwIORMZ)3;jKreth zLHb9gm}j}pKEnMd)h)SgqOWyo_&m23bCe?PHwv!EaeEBiTwfMWaIdZXI7T??_fDGG+0ncg7krL0U%irR^NCHyzQiMG}?E`kJZqu`z;8EI% zdoa|xL27Mjmbnro9<8x84Qa$Ep)^&!vh zKEe07M4Qk{^GS=N@(r)+j+U;|MEfW2_!pkBb)*IR3|{5BY6xl|FP&Du=Ibvx)xqgP zRo9STr_?y?t5q5`WaFR&)xQ&cx}1hvhM%I_LRkdOr(y2*Yc-uC^&v5HjCj z5T%1u3D3ydIb>wU2YiDZ*^*y#L-_YszsZ0Wb2d2l@6=U1Hvx;+BY>*{`j{`5Vtg;0 z)f^47jz#~B!A)hu+l9a861n+Ef8~KdmtCV`sji_E?C;l*cbC3oKwwT{*b@+#OyDgm zt;N27GTj64pZElBD`|+aL=MM9m&5I$jJ+6j1~B{Xno)$E<<;`wZveE>L?jhBA`r>w zd(j$+$z@p#shTiKkWi74uc0}(Rp5gUaI3fQ;tVU!;`|$-nRN+{V{5dGxl)rZLuV7W zAEXryBRh*qc3d^0oM&xiIuiByVF@0ukB*K^E5pK2{dq=AQmXpg`6KXH0&AcBX0rZB^7s*YWH%R7Qks{RgsClVi5#eNcpf{mZ{T~PSQ&XTg_9+ z$!4AN(leB)5Sh$ZE9#A;5;dLn$Gqi``epluRkE^#;M&)EHolYF|aa>d)4nld`BjtuOztGnJ< zDYykm)Igw&w(hBqj~b54)(raRc)`SM`9z8I2=ZY!S<=DSRwb<_q!W38zdv!J^$cMN zq2Xcl5KhV-$iE*is;qZC$t4p6mRek%)5^V4#CO0%PQf3la%Kflu)yQvA2wYiDx)H! zK8QwMtt|6<%?WAlXFTl&3-WE45{(Bd!yLpgbv@zus`E%SicZG(3OC>!df&`2>mXr0 z>3&=fF0t9`z{|^+_?VYC;RwQMGbV6t|I>BN4Zu(Qd2~Mc6|M<9MsgQC~a1T!Pr?;a|e$>>I6S`w^>}7^~@F5=Md## z|55Cs*s~^s?>mcg`1gnO!-%;|yC*(Gb6MPfstG8DzyyFg+Q|+9MqKQ{M`L$L4s{1E z3%M>cs&^YFh(0*O3dPt+SGXF;=aNP9Pn9*L8QM7`^8>|L7N5K(BApQ33vAj>Fv7qQ1lP+>Op0+x0@doV&z6lL~_FMCw zK$44R7iVK*Tf_1ntCC2|%oJlyFr0()`h&jt76gmzB^epbNa9UZJDqNBELl(VzYHCC%g64-T z0uPVL1ivq2U|hUtarh|@_xI=h=kb>=Q|4)~wx@c%e*L=NGOBo}-0Ew^=@DUqiNing7c$3rtNPbp($dQWsr$KOp z>#>n(xomtq7JKQy4VAPh)bV`6|IPCj71f<6dWA316u;D0cxl|ab*pfZgG~GnQ$x)%P%{Z{!U-K3SWbfc%PSWCKoD47qxku8 zSTz>}t#p5NT=iYX7;5_Ezq`B(G0RW25nq;DnJY$Ls>x231Cvw-JLce2C*q)KB0WzC zyFy%b>1R4BMLz(6NH(M0Z9ZRR7lSxWf3ow~;uz(^`!1AMuU_r6EEk<9{J&XG!+hF! zoTy%A`fR1c80)t|@t^9^k`Pj#B}QUnV=Z0`3myS!&}=4ZtwxZBrqR`ALI~o2nVGcv z7eu?gfukM4`)MM4j$w})47EiI$*60IkB;Ks% z;^Io+cP^YCFLh-OdysIvPb0CA;=a}cq50v}LrqF-Zz1osq%pT2Rt)j)ZN_h7OMV|r zZ?3S)C(`v$djI~tx92n6(*_Zyq&%toLoLXm2=2~Afe39;f>H=Sg`A8`9~^bKoL1Di zA!>`mojdsS=~H=X`x;l1Y`M9B5x_!WGXqaID<=m4U`-*X#Pw=%%7 z=!JM+f<_cSMMPj=_c#`DCPgTD0dRZrnb(OO=7qg72Enl%1h1padQ~$fCdPAG+SK#t z1GaZAfKZs|>FLXm88lB@UYk-_x%B*nMUWl+uC`rRgMIrT?Yz0Y&E*rN5#Z}{eWK-E zuUuwnZf&jNiNjew{BRC6No-Cts^f;B17p+6U+uQ57KF#1ouqQfe7mfy8<>C1pvMw0 z?Jr`AKX{P*f>pQBwM&TNd3#ThQCSdGl?t3NGB^zv6yI{K)6Jl%K=`=lO;|#(Sqn((TvJ{kM+G_hUe@siOQ_cVu$>;gCTD(>1;k z%x_r{f2@R1zh4TO4*LgE}>Tk^qD*{ zk6PvqIy`>C3|Y%^%q=WDzr4`8UhW-najwhRn6QfL!uPP#J)Dak*}pRxXv5W(DM{`s z25BGPV{1Kf9)Mw7xmx~}^I<*0C~=GD=a151MGpU+NLLEuJ9m7Y;-06b76GP=JA->& zC?PR1-?i@G>GPh$>(cX?pS?W=^0nbEVb$k%*!=l!v>m@$?;v|Ug!cCG5FQZDJ`%a`A* zTQHB6N;Wq)%QG=E4*>jDNV;veUh_H*s7VQiAD7Hmj%{IaOS1U3QF%KCyiviz=utU2dPq(eK>E_kP`kA(7A6Q(x~W*4lL z$@|AO`)gHq`ma|$_TfjFnwr{y#N!rAWoE&lp$?Kci*$c44pLA$YRKb9H*9^oJ1Po! zWo7*pm`eP}j zks(9vAin+lH4YArVzP9{zsG4ljMF+hp4yUaxTiOSYnNM1clk|yz2 zyS7iExZ0(@0eLt`tHHuE2$KJW#~&F`1Xv#OAe}&yff0MVxuwNTK(j&g)GmqeC4u#* z`k7*+4ltc_qDF5pGNSd8_cEg-u;P%B6~JA-#g~;~X=!P5uc!T|yBUF;fGN=Q@6@t4T|L8o1~oa=KY0lu&r=h@-1RR}(`BS^Ax# zW@d!z3y{Gb?Cg+D>?m9BnmO$`K^;r@;F_fdhj?GVcC8mACU@4>z1OE07u<5uhq7i> zvgHRLx*QD?#C#H;_3xpf3`2wF!>HYl^e3phpL(<0EItzteECwD^>v4%35Cyj?X`CT zn<(%#W0SMm{`NWlyYXmybio02XT0ub0YrVWf`c)LBt-^mXd`1{vKEaQwsC1B7^$fn zWYTdj{`Cw8cVJRcL_SFm0zYl{%U2tV!#76Xcls2bq|5A3HNl+{&F)XwAOX~7WNhrO zzTf1ynn}0d_ULMy>c2F8oDu3OcQBwC@6|>X(ajDI#yOz=m$QC zo}N6EKEej@Hrx`|o7R|FS=DrOQnorSh=N;$U9y0_{}n}3Qrv8)JH7J9S`}CS4b}+u z@mqhr2?ELcWK)hUYyZl`#ME=*8ix;SfApF|69n(%sOrO$WQ}-GmyS(NKWkK=z&dG6 z+5ce7*vu@i)V@;Ac5S${b+)JbrwzVoUv`+CogHWI4OWU5iTOiALpD{(7Jt8mk1o8$ z_ou^EVMzk6%5bszWlk=!%<3yQ_tmX>#c@at^@$5zHnFLCI-I}1($NB2OdRd6S|;eg zm^#Ft5v|GwPI6s5Rk_|9lK~^f814P%1Sl~rZ}ahK4xhVVx{-G06Zr0c$*`D+8udTr zp}?;wC;r>RQPGzJkdb9kG-~u{0oz*<+>n(PQBq%`z|hcstMMNx92e~)r407~02Jnh zEOcY%?@3Nf1tS$#eRMf4Yfp0iwHd(&=@|mW))Q|wHZ<%c z7d{x+-}^cM*MT`Z3&Se7xVW`uk(z(a0t5)j!XAa-lhe_i0H6ID3yaey9s98gn^c%p zPCrpa4uX??WyOmbYinyOwhGUmH3Pus*{R@NJ-nATHzj^AZr>rL zAh-LfO6|?mF17nGIi>H-X&=saIdSJE@4EJk+H{rofBCWmI2!r)kcv39ll~d8p0VVJ zv#NjM*6w_6E~5$RCSxh>D9go)@o9a7WIsb~k81mHp0+kWKNPyR7CD(sVsAOxI>hXa z%d>QU(VAZR%MlQu-0*gg-%h^Nm@kijFDY?(u|koDj}>K*kP!$17$j(jHs)>ZYQl)5 zQX~YT90P&CKlva3_|g)!v34-BcF`$KO z%&K%PX2W=~5Qu>WBm~}X6(JDjtp8SJ?P#TMWM^h=a@I>Zr`8B?T}2=ySdkFef0XYP z{I|TlgRA9#p5U}Ws}cBSgkW=-bBI%obE^GY_>VU@U7o`F9R4sg`UuSbXNS0{|6AU` z#_FU${xQJm;$k|9GosLZ_+P~zYak<_7ZmMmZ0%VMZ0wBw`|8a94n)8LAxwjuV^4;r z2nqs$^T(_2X#Q4Q&(`+8rGFpBR1b}M(xCDF3#W%M&4b@c8#vlK*jW9yg5R5erA#+Y z1BF9~5s1rwHm~#V%R87FSsAhZ^PTOiDmWZyACJHrlwh8=zqHZ+>~HO$s;6)HKMVZ+ z4#~7^8qTo z;Xe<6_-8E`)GK^n%8fvr{Qa|rV%vXfure|<(_^)hGGu3Cv9&fi83VsR!&T~=X&LYg z-Y|Io?8KOye`_!`(la!&JJWza8db;cf&l};0DqP?e*H&jjBXOWbkyr{QI-? zXyG5F+0QE7`Lpxl*=@^~{#*KF@)+5j**5v}rK|Yo5eP|`^nbS9@b-_=XSO|t#kfre zrI-FHeXi<{(q~%D>_R2U4s>@P41bc}yB%@A{@>F7SqOi#{QnlO-#hOWJyvZsR6zAt zMNdAQQPDrIa;l<}=BW@L$C>VIP9YE{fB&3IE)D-y^q+BLW~FCh^zT4A50ejpAcjA& M@KaJ2Oa#RL1Dnubi2wiq literal 0 HcmV?d00001 diff --git a/5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.flat.json b/5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.flat.json new file mode 100644 index 0000000000..1d0fb6230e --- /dev/null +++ b/5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.flat.json @@ -0,0 +1,3109 @@ +{ + "requirements": [ + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.1", + "section_name": "ساختار Encoding and Sanitization", + "req_id": "V1.1.1", + "req_description": "ورودی فقط یک‌بار به فرم استاندارد decoded یا unescaped شود، و این تنها زمانی انجام شود که انتظار می‌رود داده واقعاً در آن قالب رمزگذاری‌شده دریافت شده باشد. این فرآیند باید قبل از هرگونه پردازش بعدی روی ورودی انجام شود، و به‌هیچ‌وجه نباید پس از اعتبارسنجی یا پاک‌سازی انجام گیرد.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.1", + "section_name": "ساختار Encoding and Sanitization", + "req_id": "V1.1.2", + "req_description": "برنامه فرآیند encode و escape خروجی را به‌عنوان آخرین مرحله انجام می‌دهد؛ به‌گونه‌ای که این عملیات یا دقیقاً پیش از استفاده داده در مفسر مربوطه انجام شود، یا اینکه خود مفسر به‌طور داخلی این کار را انجام دهد.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.2", + "section_name": "پیشگیری از تزریق", + "req_id": "V1.2.1", + "req_description": "encoding خروجی برای پاسخ HTTP، سند HTML یا سند XML با زمینه‌ای که داده در آن استفاده می‌شود باید متناسب باشد؛ برای مثال، در رمزگذاری کاراکترهای مربوط به عناصر HTML، صفات HTML، توضیحات HTML، CSS یا فیلدهای هدر HTTP به‌گونه‌ای عمل شود که ساختار پیام یا سند تغییر نکند.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.2", + "section_name": "پیشگیری از تزریق", + "req_id": "V1.2.2", + "req_description": "هنگام ساخت پویا آدرس‌های URL، داده‌های غیرقابل‌اعتماد باید متناسب با زمینه استفاده‌شان رمزگذاری شوند (مثلاً URL Encoding یا base64url برای پارامترهای کوئری یا مسیر) همچنین اطمینان حاصل شود که فقط پروتکل‌های امن در URL مجاز باشند (برای نمونه، استفاده از JavaScript: یا data: ممنوع شود)", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.2", + "section_name": "پیشگیری از تزریق", + "req_id": "V1.2.3", + "req_description": "هنگام تولید پویا محتوای JavaScript (از جملهJSON)، از encoding یا escaping خروجی استفاده شود تا از تغییر ساختار پیام یا سند جلوگیری گردد (و از حملات تزریق JavaScript یا JSON پیشگیری شود).", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.2", + "section_name": "پیشگیری از تزریق", + "req_id": "V1.2.4", + "req_description": "در انتخاب داده یا اجرای کوئری‌های پایگاه داده (مانند SQL، HQL، NoSQL ...)، از parameterized queries، ORMها، یا Entity Framework استفاده شود یا به روش‌های دیگر، برنامه در برابر تزریق SQL و سایر حملات تزریقی پایگاه داده ایمن شده باشد. این موضوع هنگام نوشتن stored procedure‌ها نیز صدق می‌کند.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.2", + "section_name": "پیشگیری از تزریق", + "req_id": "V1.2.5", + "req_description": "برنامه در برابر تزریق دستورات سیستم‌عامل (OS command injection) محافظت شده است و در فراخوانی‌های سیستم‌عامل، از کوئری‌های پارامتری‌شده سیستم‌عامل یا Encoding خروجی دستورات سیستم‌عاملی استفاده می‌شود.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.2", + "section_name": "پیشگیری از تزریق", + "req_id": "V1.2.6", + "req_description": "برنامه در برابر آسیب‌پذیری‌های تزریق LDAP محافظت شده است، یا اینکه کنترل‌های امنیتی مشخصی برای جلوگیری از تزریق LDAP پیاده‌سازی شده‌اند.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.2", + "section_name": "پیشگیری از تزریق", + "req_id": "V1.2.7", + "req_description": "برنامه در برابر حملات تزریقXPath، به‌وسیله‌ی استفاده از کوئری‌های پارامتری‌شده یا کوئری‌های از پیش‌کامپایل‌شده محافظت شده باشد.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.2", + "section_name": "پیشگیری از تزریق", + "req_id": "V1.2.8", + "req_description": "پردازشگرهای LaTeX به‌صورت امن پیکربندی شده‌اند (برای نمونه با عدم استفاده از گزینه‌ی --shell-escape ) و از فهرست مجاز دستورات (allowlist) برای جلوگیری از حملات تزریق LaTeX استفاده شده است.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.2", + "section_name": "پیشگیری از تزریق", + "req_id": "V1.2.9", + "req_description": "برنامه کاراکترهای ویژه در عبارات Regex را escape می‌کند (معمولاً با استفاده از \\)، تا این کاراکترها به‌اشتباه به‌عنوان متاکاراکتر تفسیر نشوند.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.2", + "section_name": "پیشگیری از تزریق", + "req_id": "V1.2.10", + "req_description": "برنامه در برابر حملات تزریق CSV و فرمول (Formula Injection) محافظت شده است. برنامه باید هنگام خروجی‌ گرفتن فایل‌های CSV، از قوانین escape تعیین‌شده در بخش‌های ۲.۶ و ۲.۷ استاندارد RFC 4180 پیروی کند. همچنین، هنگام خروجی گرفتن به فرمت CSV یا سایر فرمت‌های صفحه‌گسترده (مانند XLS، XLSX یا ODF)، اگر کاراکترهای ویژه‌ای مانند '='، '+'، '-'، '@'، \\t (tab) و 0\\ (Null character) در ابتدای مقدار یک فیلد قرار داشته باشند، باید با یک تک‌کوتیشن (') escape شوند.", + "L": "3" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.3", + "section_name": "پاک‌سازی (Sanitization)", + "req_id": "V1.3.1", + "req_description": "تمام ورودی‌های HTML غیرقابل اعتماد (مثلاً از طریق ویرایشگرهای WYSIWYG یا ابزارهای مشابه)، با استفاده از یک کتابخانه یا قابلیت امن و معتبر sanitization (پاک‌سازی) ‌شوند.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.3", + "section_name": "پاک‌سازی (Sanitization)", + "req_id": "V1.3.2", + "req_description": "برنامه استفاده از تابعeval یا سایر قابلیت‌های اجرای پویا (dynamic) کد، مانند Spring Expression Language (SpEL)، اجتناب ‌کند. در مواردی که استفاده از این قابلیت‌ها اجتناب‌ناپذیر است، ورودی‌های کاربر که در اجرای کد گنجانده می‌شوند باید پیش از اجرا، به‌طور کامل پاک‌سازی (sanitized) شوند.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.3", + "section_name": "پاک‌سازی (Sanitization)", + "req_id": "V1.3.3", + "req_description": "بخش‌های حائز اهمیت که احتمال وقوع حملات ناشی از ورودی‌های کاربر در آنها بالاست؛ باید پیشاپیش عملیاتSanitization جهت اقدامات ایمنی روی داده‌ها انجام شود؛ برای مثال، تنها کاراکترهایی که برای آن محتوا ایمن محسوب می‌شوند مجاز باشند، و ورودی‌های بیش‌از‌حد بلند نیز کوتاه (trim) شوند.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.3", + "section_name": "پاک‌سازی (Sanitization)", + "req_id": "V1.3.4", + "req_description": "محتوای اسکریپت‌پذیر (scriptable) فایل‌های SVG که توسط کاربر ارائه می‌شود، مورد اعتبارسنجی یا پاک‌سازی (sanitization) قرار گرفته باشد تا فقط شامل تگ‌ها و ویژگی‌هایی (attributes) باشد که برای برنامه ایمن هستند؛ برای مثال، از درج اسکریپت‌ها و عناصر خطرناک مانند foreignObject جلوگیری شده باشد.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.3", + "section_name": "پاک‌سازی (Sanitization)", + "req_id": "V1.3.5", + "req_description": "برنامه محتوای زبان‌های قالب‌نویسی یا اسکریپت‌پذیر ارائه‌شده توسط کاربر، مانند Markdown، CSS یا استایل‌شیت‌های XSL، BBCode یا موارد مشابه را پاک‌سازی (sanitize) کرده یا غیرفعال کرده باشد.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.3", + "section_name": "پاک‌سازی (Sanitization)", + "req_id": "V1.3.6", + "req_description": "برنامه در برابر حملات جعل درخواست سمت سرور (SSRF) محافظت شده باشد؛ به این صورت که داده‌های غیرقابل اعتماد را در برابر یک لیست مجاز از پروتکل‌ها، دامنه‌ها، مسیرها و پورت‌ها اعتبارسنجی کرده و کاراکترهای بالقوه خطرناک را پیش از استفاده از داده برای فراخوانی سرویس دیگر پاک‌سازی (sanitize) می‌کند.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.3", + "section_name": "پاک‌سازی (Sanitization)", + "req_id": "V1.3.7", + "req_description": "برنامه در برابر حملات تزریق قالب (Template Injection) محافظت شده باشد؛ به این صورت که ساخت قالب‌ها بر پایه داده‌های غیرقابل اعتماد مجاز نباشد. در صورتی که هیچ راه‌حل جایگزینی وجود نداشته باشد، هرگونه ورودی غیرقابل اعتماد که به‌صورت پویا در فرآیند ایجاد قالب وارد می‌شود، باید پیش از استفاده یا پاک‌سازی (sanitize) شود یا به‌صورت سخت‌گیرانه اعتبارسنجی (validate) گردد.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.3", + "section_name": "پاک‌سازی (Sanitization)", + "req_id": "V1.3.8", + "req_description": "برنامه، ورودی غیرقابل اعتماد را پیش از استفاده در کوئری‌های Java Naming and Directory Interface (JNDI) به‌درستی پاک‌سازی (sanitize) می‌کند و همچنین اطمینان حاصل شود که پیکربندی JNDI به‌گونه‌ای امن انجام شده تا از بروز حملات تزریق JNDI جلوگیری شود.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.3", + "section_name": "پاک‌سازی (Sanitization)", + "req_id": "V1.3.9", + "req_description": "برنامه، محتوا را پیش از ارسال به memcache پاک‌سازی (sanitize) می‌کند تا از حملات تزریق (injection attacks) جلوگیری شود.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.3", + "section_name": "پاک‌سازی (Sanitization)", + "req_id": "V1.3.10", + "req_description": "رشته‌های قالب‌بندی (format strings) که ممکن است هنگام استفاده، به‌شکلی ناخواسته یا مخرب تفسیر شوند، پیش از پردازش پاک‌سازی (sanitize) شوند.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.3", + "section_name": "پاک‌سازی (Sanitization)", + "req_id": "V1.3.11", + "req_description": "برنامه ورودی‌های کاربر را پیش از ارسال به سامانه‌های ایمیل (مانند SMTP یا IMAP) پاک‌سازی (sanitize) ‌کند تا از حملات تزریق در SMTP یا IMAP جلوگیری شود.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.3", + "section_name": "پاک‌سازی (Sanitization)", + "req_id": "V1.3.12", + "req_description": "عبارات منظم (Regular Expressions) عاری از اجزایی هستند که باعث بازگشت‌پذیری نمایی (exponential backtracking) می‌شوند، و همچنین ورودی‌های غیرقابل اعتماد به‌درستی پاک‌سازی (sanitize) شوند تا از حملات ReDoS (انکار سرویس با استفاده از عبارات منظم) یا Runaway Regex جلوگیری گردد.", + "L": "3" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.4", + "section_name": "حافظه، رشته و کد بدون مدیریت (Memory, String, and Unmanaged Code)", + "req_id": "V1.4.1", + "req_description": "برنامه از رشته‌های ایمن از نظر مدیریت حافظه، کپی حافظه‌ای ایمن‌تر و حساب‌گری ایمن‌تر روی اشاره‌گرها استفاده می‌کند تا از سرریز پشته (stack overflow)، سرریز بافر (buffer overflow) یا سرریز حافظه پویای (heap overflow) جلوگیری کرده یا آن‌ها را شناسایی کند.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.4", + "section_name": "حافظه، رشته و کد بدون مدیریت (Memory, String, and Unmanaged Code)", + "req_id": "V1.4.2", + "req_description": "از تکنیک‌های اعتبارسنجی علامت (sign validation)، محدوده (range validation) و ورودی (input validation) استفاده شده است تا از بروز سرریز عدد صحیح (integer overflow) جلوگیری شود.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.4", + "section_name": "حافظه، رشته و کد بدون مدیریت (Memory, String, and Unmanaged Code)", + "req_id": "V1.4.3", + "req_description": "حافظه و منابعی که به‌صورت پویا تخصیص داده شده‌اند، به‌درستی آزاد (release) می‌شوند و همچنین ارجاع‌ها یا اشاره‌گرها (pointers) به حافظه آزادشده حذف یا به null تنظیم می‌شوند تا از اشاره‌گرهای معلق (dangling pointers) و آسیب‌پذیری‌های استفاده پس از آزادسازی (use-after-free) جلوگیری شود.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.5", + "section_name": "سریال‌زدایی ایمن (Safe Deserialization)", + "req_id": "V1.5.1", + "req_description": "برنامه، XML Parserها را به‌گونه‌ای پیکربندی کرده باشد که از تنظیمات محدودکننده استفاده کنند، و ویژگی‌های ناایمنی مانند resolve کردن موجودیت‌های خارجی (external entities) غیرفعال شده باشند تا از حملات XML External Entity (XXE) جلوگیری شود.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.5", + "section_name": "سریال‌زدایی ایمن (Safe Deserialization)", + "req_id": "V1.5.2", + "req_description": "فرآیند deserialization داده‌های غیرقابل‌اعتماد، با اجرای مدیریت ایمن ورودی‌ها همراه باشد؛ برای مثال، استفاده از لیست مجاز (allowlist) انواع objectها یا محدود کردن انواع تعریف‌شده توسط کلاینت برای جلوگیری از حملات مرتبط با deserialization. همچنین، مکانیزم‌های deserialization که به‌طور صریح به‌عنوان ناایمن شناخته شده‌اند، نباید با داده‌های غیرقابل‌اعتماد مورد استفاده قرار گیرند.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.5", + "section_name": "سریال‌زدایی ایمن (Safe Deserialization)", + "req_id": "V1.5.3", + "req_description": "Parser های مختلفی که در برنامه برای یک نوع داده مشخص استفاده می‌شوند (برای مثال: Parser های JSON، XML یا URL)، رفتار تحلیلی یکسانی دارند و از مکانیزم یکسانی برای encoding کاراکترها استفاده می‌کنند، تا از بروز مشکلاتی مانند آسیب‌پذیری در سازگاری JSON (JSON Interoperability) یا تفاوت در نحوه تحلیل URI یا مسیر فایل که ممکن است در حملات RFI یا SSRF سوءاستفاده شود، جلوگیری شود.", + "L": "3" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation and Business Logic", + "section_id": "V2.1", + "section_name": "مستندات اعتبارسنجی و منطق کسب‌وکار ( Validation and Business Logic Documentation)", + "req_id": "V2.1.1", + "req_description": "قوانین اعتبارسنجی ورودی‌های برنامه (مندرج در مستندات برنامه) ‌باید چگونگی بررسی صحت داده‌ها را مطابق با ساختار مورد انتظار مشخص نماید. این ساختار می‌تواند شامل فرمت‌های رایج داده مانند شماره کارت اعتباری، آدرس ایمیل، شماره تلفن یا یک قالب داده‌ای داخلی باشد.", + "L": "1" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation and Business Logic", + "section_id": "V2.1", + "section_name": "مستندات اعتبارسنجی و منطق کسب‌وکار ( Validation and Business Logic Documentation)", + "req_id": "V2.1.2", + "req_description": "قوانین اعتبارسنجی ورودی‌های برنامه (مندرج در مستندات برنامه) باید چگونگی بررسی سازگاری مناسب بین داده‌‌های ترکیب شده (از نظر مفهومی و متنی) را مشخص نماید؛ مانند تطبیق کدپستی با نام محله.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation and Business Logic", + "section_id": "V2.1", + "section_name": "مستندات اعتبارسنجی و منطق کسب‌وکار ( Validation and Business Logic Documentation)", + "req_id": "V2.1.3", + "req_description": "انتظارات مربوط به محدودیت‌ها و اعتبارسنجی‌های منطق کسب و کار مستند شده باشند؛ این مستندات باید شامل محدودیت‌ها در سطح هر کاربر و محدودیت‌های عمومی در سطح برنامه باشند.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation and Business Logic", + "section_id": "V2.2", + "section_name": "اعتبارسنجی ورودی (Input Validation)", + "req_id": "V2.2.1", + "req_description": "ورودی‌ها باید به‌منظور اعمال انتظارات کسب و کار یا عملکردی مرتبط با آن‌ها اعتبارسنجی ‌شوند.این اعتبارسنجی باید یکی از این دو روش زیر را داشته باشد، استفاده از اعتبارسنجی مثبت (Positive Validation) مبتنی بر فهرست مجاز از مقادیر، الگوها یا بازه‌های قابل قبول و تطبیق با ساختار مورد انتظار و محدودیت‌های منطقی، بر اساس قوانین از پیش تعریف‌شده. برای سطح 1 (L1)، تمرکز می‌تواند بر ورودی‌هایی باشد که در تصمیم‌گیری‌های خاص تجاری یا امنیتی استفاده می‌شوند. برای سطح 2 و بالاتر، این اعتبارسنجی باید شامل تمام ورودی‌ها باشد.", + "L": "1" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation and Business Logic", + "section_id": "V2.2", + "section_name": "اعتبارسنجی ورودی (Input Validation)", + "req_id": "V2.2.2", + "req_description": "برنامه به‌گونه‌ای طراحی شود که اعتبارسنجی ورودی را در لایه‌ قابل اعتمادی از سرویس (Trusted Service Layer) اعمال کند. هرچند اعتبارسنجی سمت کلاینت (Client-side Validation) باعث بهبود تجربه کاربری می‌شود و توصیه می‌گردد، اما نباید به‌عنوان یک کنترل امنیتی اتکا شود.", + "L": "1" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation and Business Logic", + "section_id": "V2.2", + "section_name": "اعتبارسنجی ورودی (Input Validation)", + "req_id": "V2.2.3", + "req_description": "برنامه باید اطمینان حاصل نماید که ترکیب داده‌های مربوطه با توجه به قوانین از پیش تعریف‌شده معقول و منطقی باشد.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation and Business Logic", + "section_id": "V2.3", + "section_name": "امنیت منطق کسب‌وکار (Business Logic Security)", + "req_id": "V2.3.1", + "req_description": "اطمینان حاصل شود که برنامه فقط جریان‌های منطق تجاری را برای همان کاربر و طبق ترتیب گام‌به‌گام از پیش تعیین شده و مورد انتظار پردازش می‌کند و امکان رد کردن مراحل (Skipping Steps) وجود ندارد.", + "L": "1" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation and Business Logic", + "section_id": "V2.3", + "section_name": "امنیت منطق کسب‌وکار (Business Logic Security)", + "req_id": "V2.3.2", + "req_description": "اطمینان حاصل شود که محدودیت‌های منطق تجاری مطابق با مستندات برنامه پیاده‌سازی شده‌اند، تا از سوء‌استفاده از نقص‌های منطقی جلوگیری شود.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation and Business Logic", + "section_id": "V2.3", + "section_name": "امنیت منطق کسب‌وکار (Business Logic Security)", + "req_id": "V2.3.3", + "req_description": "تراکنش‌های سطح منطق کسب‌وکار (business logic) باید به‌گونه‌ای استفاده شوند که یا یک عملیات منطق کسب‌وکار به‌طور کامل با موفقیت انجام شود، یا در صورت بروز خطا، به حالت صحیح قبلی بازگردد(rollback) شود.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation and Business Logic", + "section_id": "V2.3", + "section_name": "امنیت منطق کسب‌وکار (Business Logic Security)", + "req_id": "V2.3.4", + "req_description": "در منطق کسب‌وکار (business logic)باید از مکانیزم‌های قفل‌گذاری (locking) استفاده شده باشد تا اطمینان حاصل شود که منابع محدود (مانند صندلی‌های سینما یا بازه‌های زمانی تحویل)، قابل رزرو دوباره (double-booked) از طریق دستکاری منطق برنامه نباشند.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation and Business Logic", + "section_id": "V2.3", + "section_name": "امنیت منطق کسب‌وکار (Business Logic Security)", + "req_id": "V2.3.5", + "req_description": "اطمینان حاصل شود که جریان‌های منطق کسب و کاری با ارزش بالا نیازمند تایید چند کاربره (Multi-user Approval) هستند تا از اقدامات غیرمجاز یا تصادفی جلوگیری شود. این موارد می‌تواند شامل – اما نه محدود به – انتقال‌های مالی بزرگ، تایید قرارداد‌ها، دسترسی به اطلاعات طبقه‌بنده شده، یا غیرفعال‌سازی‌های ایمنی در محیط‌های تولید صنعتی باشد.", + "L": "3" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation and Business Logic", + "section_id": "V2.4", + "section_name": "مقابله با خودکارسازی (Anti-automation)", + "req_id": "V2.4.1", + "req_description": "کنترل‌های ضد خودکارسازی (Anti-Automation) در سیستم پیاده‌سازی شده باشند تا از سوءاستفاده‌هایی مانند فراخوانی بیش از حد توابع برنامه جلوگیری شود؛ چرا که این نوع حملات می‌توانند منجر به استخراج غیرمجاز داده‌ها، تولید داده‌های زائد، مصرف کامل سهمیه‌ها، عبور از محدودیت‌های نرخ (Rate Limit)، ایجاد اختلال در سرویس (DoS) یا استفاده بیش از حد از منابع گران‌قیمت شوند.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation and Business Logic", + "section_id": "V2.4", + "section_name": "مقابله با خودکارسازی (Anti-automation)", + "req_id": "V2.4.2", + "req_description": "بررسی کنید که جریان‌های منطق کسب‌وکار (Business Logic Flows) به گونه‌ای طراحی شده باشند که نیازمند زمان‌بندی واقعی انسان باشند، و از ارسال سریع و غیرطبیعی تراکنش‌ها (Transaction Submissions) جلوگیری کنند.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.1", + "section_name": "مستندسازی امنیت رابط کاربری وب ( Web Frontend Security Documentation)", + "req_id": "V3.1.1", + "req_description": "در مستندات برنامه باید ویژگی‌های امنیتی مربوط به مرورگری که برنامه را اجرا میکند مشخص شده باشد (نظیر استفاده از HTTPS، پشتیبانی از HTTP Strict Transport Security (HSTS)، اجرای Content Security Policy (CSP) و سایر مکانیزم‌های امنیتی مرتبط با HTTP). همچنین در مستندات باید مشخص شود مرورگر در صورت عدم دسترسی به این ویژگی‌ها چه رفتاری باید داشته باشد. (برای مثال: نمایش هشدار به کاربر یا ممانعت از دسترسی به برنامه).", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.2", + "section_name": "تفسیر ناخواسته محتوا (Unintended Content Interpretation)", + "req_id": "V3.2.1", + "req_description": "کنترل‌های امنیتی متناسب با مرورگر‌ها در هنگام پردازش پاسخ‌های HTTP به منظور جلوگیری از پردازش محتوا یا عملکرد مربوط به آن در شرایط زمینه‌‌ای نادرست باید بکار‌گرفته شود. (برای مثال، زمانی که یک APIیا یک فایل بارگذاری‌شده توسط کاربر یا هر منبع دیگری به‌طور مستقیم درخواست می‌شود).کنترل‌های ممکن می‌توانند شامل این موارد باشند: عدم پردازش محتوا مگر در صورت وجود هدرهای متناسب با درخواست‌های HTTP (مانند ‎Sec-Fetch-*) به منظور اطمیان از صحیح بودن پردازش محتوا یا عملکرد مربوط به . استفاده از عبارت sandbox در هدر Content-Security-Policy یا استفاده از نوعattachment در هدر Content-Disposition .", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.2", + "section_name": "تفسیر ناخواسته محتوا (Unintended Content Interpretation)", + "req_id": "V3.2.2", + "req_description": "اطمینان حاصل شود که محتوایی که برای نمایش به‌صورت متن طراحی شده نه برای پردازش به صورتHTML ، با استفاده از توابع امن نظیر CreateTextNode یا textContent به منظور جلوگیری از اجرای ناخواسته محتوایی مانند HTML یا JavaScript پردازش ‌شود.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.2", + "section_name": "تفسیر ناخواسته محتوا (Unintended Content Interpretation)", + "req_id": "V3.2.3", + "req_description": "برنامه هنگام استفاده از جاوااسکریپت سمت کاربر (Client-Side JavaScript)، با استفاده از اعلام متغیرها به‌صورت صریح، انجام بررسی نوع به‌صورت سخت‌گیرانه، اجتناب از ذخیره‌سازی متغیرهای سراسری بر روی شیء document، و پیاده‌سازی ایزولاسیون فضای نام (namespace isolation)، از وقوع DOM Clobbering جلوگیری می‌کند.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.3", + "section_name": "پیکربندی کوکی (Cookie Setup)", + "req_id": "V3.3.1", + "req_description": "اطمینان حاصل شود که کوکی‌ها دارای ویژگی ‘Secure’ هستند. در صورتی که از پیشوند ‘__Host-’ برای نام کوکی استفاده نمی‌شود، باید پیشوند__Secure- در نام کوکی لحاظ شده باشد.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.3", + "section_name": "پیکربندی کوکی (Cookie Setup)", + "req_id": "V3.3.2", + "req_description": "اطمینان حاصل شود که مقدار ویژگی SameSite برای هر کوکی، متناسب با هدف آن کوکی تنظیم شده باشد تا میزان آسیب‌پذیری در برابر حملات فریب سمت کلاینت نظیر CSRF کاهش یابد.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.3", + "section_name": "پیکربندی کوکی (Cookie Setup)", + "req_id": "V3.3.3", + "req_description": "اطمینان حاصل شود که کوکی‌ها از پیشوند __Host- در نام خود استفاده می‌کنند، مگر در مواردی که کوکی به‌طور مشخص برای اشتراک‌گذاری بین چند دامنه (Hosts) طراحی شده باشد.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.3", + "section_name": "پیکربندی کوکی (Cookie Setup)", + "req_id": "V3.3.4", + "req_description": "اطمینان حاصل شود که اگر مقدار کوکی (مثلاً توکن نشست) نباید برای اسکریپت‌های سمت کلاینت در دسترس باشد، ویژگی HttpOnly باید برای آن کوکی فعال شده باشد، و همچنین مقدار کوکی (مثلاً همان توکن نشست) تنها از طریق هدر Set-Cookie به کلاینت ارسال شود.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.3", + "section_name": "پیکربندی کوکی (Cookie Setup)", + "req_id": "V3.3.5", + "req_description": "اطمینان حاصل شود که حداکثر مجموع نام و مقدار کوکی از ۴۰۹۶ بایت تجاوز نکند.کوکی‌هایی که بیش از این مقدار باشند توسط مرورگر ذخیره نخواهند شد، و بنابراین در درخواست‌ها ارسال نمی‌شوند؛ موضوعی که ممکن است باعث شود عملکردهایی از برنامه که به آن کوکی وابسته‌اند، غیرفعال یا مختل شوند.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.4", + "section_name": "هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers)", + "req_id": "V3.4.1", + "req_description": "اطمینان حاصل شود که در تمامی پاسخ‌های HTTP، هدر Strict-Transport-Security وجود دارد تا سیاست HSTS (HTTP Strict Transport Security) اعمال شود. حداقل مقدار max-age باید برابر با یک سال باشد. برای برنامه‌های سطح 2 (L2) و بالاتر، این سیاست باید برای تمام زیردامنه‌ها (subdomains) نیز اعمال شود.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.4", + "section_name": "هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers)", + "req_id": "V3.4.2", + "req_description": "اطمینان حاصل شود که هدرAccess-Control-Allow-Origin مربوط به (CORS)، دارای یک مقدار ثابت و مشخص توسط برنامه باشد یا اگر هدر Origin در درخواست مورد استفاده قرار می گیرد باید با فهرستی از مبدأهای مورد اعتماد (Allowlist) اعتبارسنجی شود. در صورتی که استفاده از مقدار * در Access-Control-Allow-Origin تنظیم شده باشد، اطمینان حاصل شود که هیچ اطلاعات حساسی در پاسخ قرار ندارد.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.4", + "section_name": "هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers)", + "req_id": "V3.4.3", + "req_description": "اطمینان حاصل شود که تمامی پاسخ‌های HTTP شامل هدر Content-Security-Policy باشند تا ریسک اجرای اسکریپت‌های مخرب (مانند (JavaScript مخرب کاهش یابد. دستورهای object-src 'none' و base-uri 'none' الزامی هستند .برای برنامه‌های سطح 3 (L3)، باید سیاست CSP به‌صورت اختصاصی برای هر پاسخ(Per-response Policy) و مبتنی بر nonce یا hash تعریف شده باشد.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.4", + "section_name": "هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers)", + "req_id": "V3.4.4", + "req_description": "اطمینان حاصل شود که تمامی پاسخ‌ها شامل هدر X-Content-Type-Options: nosniff باشند، این (هدر) به مرورگرها دستور می‌دهد که برای پاسخ دریافتی از Content Sniffing یا حدس‌زدن نوع محتوا (MIME Type Guessing) استفاده نکنند و آن‌ها را ملزم می‌کند که نوع محتوای واقعی را دقیقاً مطابق مقدار هدر Content-Type در درخواست/پاسخ در نظر بگیرند.برای مثال، پاسخ به یک درخواست برای یک فایل استایل (CSS) تنها در صورتی پذیرفته می‌شود که مقدار Content-Type در پاسخ 'text/css' باشد.این کار همچنین امکان استفاده از قابلیت مسدودسازی خواندن منابع از مبدا متفاوت Cross-Origin Read Blocking یا (CORB) توسط مرورگر را فراهم می‌سازد.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.4", + "section_name": "هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers)", + "req_id": "V3.4.5", + "req_description": "برنامه باید (وب‌سایت یا اپلیکیشن) یک \"Referrer Policy\" (سیاست ارجاع) تنظیم کرده باشد تا از نشت اطلاعات حساس از طریق هدر HTTP به نام Referer به سرویس‌های شخص ثالث جلوگیری شود. این کار را می‌توان از طریق هدر پاسخ HTTP به نام Referrer-Policy یا با استفاده از ویژگی‌هایی در عناصر HTML انجام داد.اطلاعات حساس ممکن است شامل مسیر (Path) و داده‌های کوئری (Query) در آدرس URL باشد، و در مورد برنامه‌های داخلی و غیرعمومی، حتی نام میزبان (hostname) نیز می‌تواند جزو اطلاعات حساس محسوب شود.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.4", + "section_name": "هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers)", + "req_id": "V3.4.6", + "req_description": "برنامه باید از frame-ancestors در هدر Content-Security-Policy (CSP) برای تمام پاسخ‌های HTTP استفاده کند،تا به‌صورت پیش‌فرض، اجازه‌ی نمایش سایت در قالب iframe داده نشود، و فقط در صورت نیاز، نمایش منابع خاص (specific resources) در iframe مجاز باشد.به این نکته توجه کنید که هدر X-Frame-Options با اینکه هنوز توسط برخی مرورگرها پشتیبانی می‌شود، اما قدیمی (obsolete) است و نباید به آن تکیه کرد.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.4", + "section_name": "هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers)", + "req_id": "V3.4.7", + "req_description": "هدر Content-Security-Policy (CSP) باید شامل یک آدرس برای گزارش (Report violation) باشد.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.4", + "section_name": "هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers)", + "req_id": "V3.4.8", + "req_description": "تمام پاسخ‌های HTTP که باعث رندر (نمایش) یک سند می‌شوند مانند (پاسخ‌هایی با نوع محتوا (text/html باید شامل هدر Cross-Origin-Opener-Policy با دستور same-origin یا same-origin-allow-popups باشند (بنا به نیاز). این کار از حملاتی جلوگیری می‌کند که از دسترسی مشترک به اشیای Window سوءاستفاده می‌کنند، مانند حملات tabnabbing و frame counting.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.5", + "section_name": "تفکیک مبدا توسط مرورگر (Browser Origin Separation)", + "req_id": "V3.5.1", + "req_description": "برنامه باید از مکانیزم Preflight در CORS برای جلوگیری از درخواست‌های cross-origin به عملکردهای حساس استفاده نمی‌کند، این درخواست‌ها به‌گونه‌ای اعتبارسنجی شوند که فقط از مبدأ اصلی برنامه ارسال شده باشند. این اعتبارسنجی می‌تواند با استفاده از توکن‌های (anti- forgery tokens) یا الزام به ارسال هدرهای HTTP اضافی انجام شود که در لیست هدرهای مجاز CORS (CORS-safelisted) قرار ندارند. این اقدام برای محافظت در برابر حملات جعل درخواست از طریق مرورگر، که با نام CSRF (Cross-Site Request Forgery) شناخته می‌شوند، ضروری است.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.5", + "section_name": "تفکیک مبدا توسط مرورگر (Browser Origin Separation)", + "req_id": "V3.5.2", + "req_description": "اگر برنامه برای جلوگیری از استفاده غیرمجاز cross-origin از عملکردهای حساس، به مکانیزم Preflight در CORS متکی است، باید امکان فراخوانی این عملکردها با درخواست‌هایی که باعث ایجاد Preflight نمی‌شوند، وجود نداشته باشد. برای تحقق این هدف ممکن است لازم باشد مقدار هدرهای Origin و Content-Type بررسی شوند یا از هدر اضافی استفاده شود که در لیست هدرهای مجاز CORS قرار ندارد.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.5", + "section_name": "تفکیک مبدا توسط مرورگر (Browser Origin Separation)", + "req_id": "V3.5.3", + "req_description": "برنامه باید درخواست‌های HTTP که به عملکردهای حساس از متدهای مناسب مانند POST، PUT، PATCH یا DELETE استفاده می‌کنند، و نه از متدهایی که در استاندارد HTTP به‌عنوان \"ایمن\" تعریف شده‌اند، مانند GET، HEAD یا .OPTIONS به عنوان جایگزین یا مکمل، می‌توان از بررسی سخت‌گیرانه هدرهای Sec-Fetch-* استفاده کرد تا اطمینان حاصل شود که درخواست از منبع نامناسبی مثل بارگذاری تصویر، ناوبری صفحه یا فراخوانی cross-origin ارسال نشده است.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.5", + "section_name": "تفکیک مبدا توسط مرورگر (Browser Origin Separation)", + "req_id": "V3.5.4", + "req_description": "برنامه‌های مجزا باید روی نام‌های دامنه (hostname) متفاوت میزبانی شده‌اند تا از محدودیت‌های ارائه‌شده توسط (Same-Origin Policy) بهره‌مند شوند. این شامل کنترل تعامل اسناد یا اسکریپت‌های بارگذاری‌شده از یک مبدأ با منابع مبدأ دیگر و اعمال محدودیت بر اساس دامنه برای کوکی‌ها می‌شود.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.5", + "section_name": "تفکیک مبدا توسط مرورگر (Browser Origin Separation)", + "req_id": "V3.5.5", + "req_description": "برنامه باید پیام‌های دریافت‌شده از طریق رابط postMessage در صورتی که مبدأ پیام مورد اعتماد نباشد یا ساختار پیام نامعتبر باشد، نادیده گرفته می‌شوند.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.5", + "section_name": "تفکیک مبدا توسط مرورگر (Browser Origin Separation)", + "req_id": "V3.5.6", + "req_description": "هیچ‌کجای برنامه از قابلیت JSONP استفاده نشود تا از حملات Cross-Site Script Inclusion (XSSI) جلوگیری شود.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.5", + "section_name": "تفکیک مبدا توسط مرورگر (Browser Origin Separation)", + "req_id": "V3.5.7", + "req_description": "داده‌هایی که نیاز به احراز هویت دارند، در پاسخ‌های مربوط به منابع اسکریپتی(مانند فایل‌های (JavaScript نباید قرار بگیرند تا از حملات XSSI جلوگیری شود.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.5", + "section_name": "تفکیک مبدا توسط مرورگر (Browser Origin Separation)", + "req_id": "V3.5.8", + "req_description": "اطمینان حاصل کنید که منابع احراز هویت‌شده (مانند تصاویر، ویدیوها، اسکریپت‌ها و سایر اسناد) فقط در مواقعی که هدف آن است، قابل بارگذاری یا جاسازی توسط کاربر باشند. این کار را می‌توان با اعتبارسنجی دقیق هدرهای HTTP مانند Sec-Fetch-* انجام داد تا اطمینان حاصل شود که درخواست از یک منبع غیرمجاز ارسال نشده است، یا با تنظیم هدر Cross-Origin-Resource-Policy برای محدود کردن دسترسی مرورگر به محتوا.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.6", + "section_name": "یکپارچگی منابع خارجی (External Resource Integrity)", + "req_id": "V3.6.1", + "req_description": "منابع سمت کلاینت مانند کتابخانه‌های جاوااسکریپت، فایل‌های CSS، یا فونت‌های وب، تنها در صورتی به‌صورت خارجی (مثلاً از طریق شبکه تحویل محتوا - CDN) میزبانی شوند که آن منابع: استاتیک (تغییرناپذیر) باشند، نسخه‌گذاری‌شده (versioned) باشند و یکپارچگی آن‌ها با استفاده از Subresource Integrity (SRI) بررسی شود. اگر این موارد امکان‌پذیر نیست، باید برای هر منبع، یک تصمیم امنیتی مستند وجود داشته باشد که توجیه کند چرا این منبع به این شکل بارگذاری می‌شود.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.7", + "section_name": "سایر ملاحظات امنیتی مرورگر (Other Browser Security Considerations)", + "req_id": "V3.7.1", + "req_description": "برنامه صرفا باید از فناوری‌های سمت کلاینتی استفاده ‌کند که همچنان پشتیبانی می‌شوند و از نظر امنیتی قابل اعتماد هستند.مثال‌هایی از فناوری‌هایی که این الزام را برآورده نمی‌کنند عبارتند از NSAPI Plugins،Flash،Shockwave،ActiveX،Silverlight،NACL و Appletهای جاوا در سمت کلاینت", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.7", + "section_name": "سایر ملاحظات امنیتی مرورگر (Other Browser Security Considerations)", + "req_id": "V3.7.2", + "req_description": "برنامه فقط زمانی کاربر را به دامنه‌ها یا hostnameهای دیگر (که تحت کنترل برنامه نیستند) به صورت خودکار هدایت می‌کند، که آن مقصد در یک فهرست مجاز (allowlist) قرار داشته باشد.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.7", + "section_name": "سایر ملاحظات امنیتی مرورگر (Other Browser Security Considerations)", + "req_id": "V3.7.3", + "req_description": "برنامه باید هنگام ریدایرکت کاربر به یک URL که خارج از کنترل برنامه است، یک پیام هشدار نشان می‌دهد و امکان لغو آن را به کاربر می‌دهد.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.7", + "section_name": "سایر ملاحظات امنیتی مرورگر (Other Browser Security Considerations)", + "req_id": "V3.7.4", + "req_description": "باید دامنه اصلی برنامه، مثلاً (site.tld) به فهرست preload عمومی HSTS اضافه شده باشد.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.7", + "section_name": "سایر ملاحظات امنیتی مرورگر (Other Browser Security Considerations)", + "req_id": "V3.7.5", + "req_description": "اگر مرورگر کاربر از ویژگی‌های امنیتی مورد انتظار برنامه پشتیبانی نمی‌کند، برنامه رفتار مناسبی داشته باشد، مثل هشدار دادن به کاربر یا مسدود کردن دسترسی.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API and Web Service", + "section_id": "V4.1", + "section_name": "Generic Web Service Security", + "req_id": "V4.1.1", + "req_description": "اطمینان حاصل شود که در هر پاسخ HTTP که شامل Body می باشد، هدر Content-Type وجود داشته باشد که نوع آن، با محتوای پاسخ دریافتی از سرور مطابقت داشته باشد. این هدر باید شامل پارامتر charset نیز باشد تا رمزگذاری کاراکتر ایمن (مانند UTF-8 یا ISO-8859-1) را مشخص کند. این مقادیر باید مطابق با استاندارد IANA Media Types باشند؛ برای مثال، انواعی مانند \"text/، /+xml\" و \"/xml\" را در بر می‌گیرند.", + "L": "1" + }, + { + "chapter_id": "V4", + "chapter_name": "API and Web Service", + "section_id": "V4.1", + "section_name": "Generic Web Service Security", + "req_id": "V4.1.2", + "req_description": "اطمینان حاصل شود که تنها نقاط پایانی که برای استفاده کاربر نهایی از طریق مرورگر طراحی شده‌اند (User-Facing Endpoints) به‌صورت خودکار از HTTP به HTTPS هدایت ‌شوند، سایر سرویس‌ها یا نقاط پایانی نباید (ریدایرکت شفاف، Transparent Redirect) داشته باشند. این اقدام برای جلوگیری از وضعیتی است که در آن یک کلاینت به اشتباه درخواست‌های رمزنگاری‌نشده (HTTP) ارسال می‌کند، اما چون این درخواست‌ها به‌طور خودکار به HTTPS ریدایرکت می‌شوند، نشت احتمالی داده‌های حساس پنهان خواهد ماند.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API and Web Service", + "section_id": "V4.1", + "section_name": "Generic Web Service Security", + "req_id": "V4.1.3", + "req_description": "اطمینان حاصل شود که هدرهای HTTP که در برنامه استفاده می شود و توسط یک لایه واسطه، مانند یکload balancer ، یک پروکسی وب یا یک سرویس backend-for-frontend تنظیم شده است نمی‌تواند توسط کاربر نهایی بازنویسی شود. هدرهای نمونه ممکن است شامل X-Real-IP، X-Forwarded-* یا X-User-ID باشند.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API and Web Service", + "section_id": "V4.1", + "section_name": "Generic Web Service Security", + "req_id": "V4.1.4", + "req_description": "اطمینان حاصل شود که فقط متدهای HTTP که صریحاً توسط برنامه یا API آن پشتیبانی می‌شوند (از جمله OPTIONS در درخواست‌های preflight) می‌توانند مورد استفاده قرار گیرند و متدهای استفاده نشده مسدود شوند.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API and Web Service", + "section_id": "V4.1", + "section_name": "Generic Web Service Security", + "req_id": "V4.1.5", + "req_description": "اطمینان حاصل شود که برای درخواست‌ها یا تراکنش‌هایی که بسیار حساس هستند یا از چندین سامانه عبور می‌کنند، از امضاهای دیجیتال در سطح پیام استفاده شود تا اطمینان امنیتی بیشتری علاوه بر محافظت‌های سطح انتقال (مانند TLS) فراهم گردد.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API and Web Service", + "section_id": "V4.2", + "section_name": "HTTP Message Structure Validation", + "req_id": "V4.2.1", + "req_description": "اطمینان حاصل شود که تمامی اجزای برنامه )از جمله لود بالانسرها، فایروال‌ها و سرورهای اپلیکیشن( مرزهای پیام‌های HTTP ورودی را با استفاده از مکانیزم مناسب نسخه های HTTP تعیین می‌کنند تا از حملات HTTP request smuggling جلوگیری شود. در HTTP/1.x اگر هدر Transfer-Encoding وجود داشته باشد، هدر Content-Length باید مطابق RFC 2616 نادیده گرفته شود. در مقابل، هنگام استفاده از HTTP/2 یا HTTP/3، اگر هدر Content-Length وجود داشته باشد، گیرنده باید اطمینان حاصل کند که این مقادیر با طول فریم‌های DATA سازگار می‌باشد.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API and Web Service", + "section_id": "V4.2", + "section_name": "HTTP Message Structure Validation", + "req_id": "V4.2.2", + "req_description": "اطمینان حاصل شود که هنگام تولید پیام‌های HTTP، هدر Content-Length با طول محتوایی که توسط چارچوب‌بندی پروتکل HTTP تعیین می‌شود، تداخل نداشته باشد تا از حملات request smuggling جلوگیری شود.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API and Web Service", + "section_id": "V4.2", + "section_name": "HTTP Message Structure Validation", + "req_id": "V4.2.3", + "req_description": "اطمینان حاصل شود برنامه، پیام‌های HTTP/2 یا HTTP/3 با هدرهای connection-specific مانند Transfer-Encoding را به منظور جلوگیری از حملات response splitting یا header injection ارسال یا قبول نمی کند.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API and Web Service", + "section_id": "V4.2", + "section_name": "HTTP Message Structure Validation", + "req_id": "V4.2.4", + "req_description": "اطمینان حاصل شود برنامه تنها درخواست های HTTP/2 and HTTP/3 که هدرها و مقادیر آن شامل هیچ توالی CR (\\r), LF (\\n), CRLF (\\r\\n) نباشد را می پذیرد تا از حملات header injection جلوگیری کند.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API and Web Service", + "section_id": "V4.2", + "section_name": "HTTP Message Structure Validation", + "req_id": "V4.2.5", + "req_description": "اطمینان حاصل کنید که اگر برنامه (Frontend or Backend) اقدام به ساخت و ارسال درخواست‌های HTTP می کند از مکانیزم های validation ، sanitization یا سایر مکانیزم‌ها استفاده کند تا از ایجاد URIها (مانند فراخوانیAPI ) یا فیلدهای هدر درخواست HTTP (مانند Authorization یا( Cookie که بیش از حد مجاز، طولانی هستند، جلوگیری شود که منجر به عدم پذیرش درخواست توسط مولفه دریافت کننده(هر بخشی از زیرساخت یا سامانه که درخواست HTTP را دریافت و پردازش می‌کند) شود. عدم رعایت این موضوع می تواند باعث وقوع حمله Danial of Service شود، ارسال یک درخواست بیش از حد طولانی (مانند یک فیلد هدر کوکی طولانی) باعث می شود سرور همواره با وضعیت خطا پاسخ دهد.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API and Web Service", + "section_id": "V4.3", + "section_name": "GraphQL", + "req_id": "V4.3.1", + "req_description": "اطمینان حاصل شود یکی از مکانیزم ها برای جلوگیری از حملات انکار سرویس (DoS) درلایه GraphQL یا لایه داده استفاده شده است. این مکانیزم‌ها عبارتند از استفاده از فهرست مجاز کوئری‌ها ( Query Allowlist)، محدودسازی عمق کوئری‌ها (Depth Limiting)،محدودسازی تعداد یا حجم داده(Amount Limiting) و تحلیل هزینه کوئری (Query Cost Analysis). این اقدامات، به منظور مقابله با درخواست های پیچیده، تو در تو یا کوئری‌های پرهزینه که می توانند موجب مصرف بیش از حد منابع و اختلال در سرویس دهی شوند ضروری است.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API and Web Service", + "section_id": "V4.3", + "section_name": "GraphQL", + "req_id": "V4.3.2", + "req_description": "اطمینان حاصل شود که قابلیت Introspection در GraphQL در محیط تولید (Production) غیرفعال شده‌است، مگرAPI مبتنی بر GraphQL به‌صورت صریح برای استفاده توسط اشخاص یا سامانه های ثالث (Third Parties) طراحی شده باشد.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API and Web Service", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.1", + "req_description": "اطمینان حاصل شود که تمامی ارتباطات WebSocket از طریق پروتکل TLS( WSS) برقرار می‌شوند.", + "L": "1" + }, + { + "chapter_id": "V4", + "chapter_name": "API and Web Service", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.2", + "req_description": "اطمینان حاصل شود که در هنگام Handshake اولیه‌ی HTTP برای WebSocket، مقدار هدر Origin بررسی ‌شود و در صورتی که با لیستی از مبداهای مجاز (allowed origins) برای برنامه مطابقت داشته باشد، اتصال پذیرفته می‌شود.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API and Web Service", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.3", + "req_description": "اطمینان حاصل شود که در صورتی که امکان استفاده از مکانیزم استاندارد مدیریت نشست برنامه وجود نداشته باشد، از توکن‌های اختصاصی (Duplicated Tokens) برای این منظور استفاده شود که با الزامات امنیتی مدیریت نشست به طور کامل مطابقت داشته باشند.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API and Web Service", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.4", + "req_description": "اطمینان حاصل شود که توکن‌های اختصاصی مدیریت نشست WebSocket در هنگام انتقال از یک نشست HTTPS موجود به کانالWebSocket، از طریق نشست HTTPS احراز هویت‌شده قبلی، دریافت یا اعتبارسنجی می‌شوند.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "File Handling", + "section_id": "V5.1", + "section_name": "File Handling Documentation", + "req_id": "V5.1.1", + "req_description": "مستندات نوع فایل‌های مجاز، پسوندهای مورد انتظار، و حداکثر اندازه هر فایل (شامل اندازه پس از استخراج) را برای هر قابلیت بارگذاری مشخص کرده باشد. همچنین، مستندات توضیح می‌دهند چگونه فایل‌ها برای دانلود و پردازش توسط کاربران نهایی ایمن‌سازی می‌شوند؛ برای مثال، رفتار برنامه هنگام شناسایی یک فایل مخرب چگونه خواهد بود.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "File Handling", + "section_id": "V5.2", + "section_name": "File Upload and Content", + "req_id": "V5.2.1", + "req_description": "برنامه تنها فایل‌هایی با حجم مشخص، که قادر به پردازش آن است را می‌پذیرد تا از کاهش عملکرد یا حملات انکار سرویس (DoS) جلوگیری شود.", + "L": "1" + }, + { + "chapter_id": "V5", + "chapter_name": "File Handling", + "section_id": "V5.2", + "section_name": "File Upload and Content", + "req_id": "V5.2.2", + "req_description": "هنگام پذیرش فایل توسط برنامه، چه به صورت مستقیم و چه به صورت یک آرشیو مانند فایلzip پسوند فایل با پسوند مورد انتظار مطابقت داشته باشد و اعتبارسنجی محتوای فایل صورت گیرد تا تایید شود محتوای فایل با نوع تعریف‌شده توسط پسوند هم‌خوانی دارد. این فرآیند می تواند شامل موارد بررسی بایت‌های ابتدایی (magic bytes) فایل، انجام بازنویسی تصاویر برای حذف ساختارها و اطلاعات ناخواسته و استفاده از کتابخانه‌های تخصصی برای اعتبارسنجی کامل محتوای فایل باشد اما محدود به آنها نیست. در سطح L1، کافی است این بررسی‌ها فقط بر روی فایل‌هایی که در فرآیندهای تجاری یا امنیتی خاص استفاده می‌شوند متمرکز باشد. در سطح L2 و بالاتر، این فرآیند باید برای تمامی فایل‌های ورودی برنامه اجرا شود.", + "L": "1" + }, + { + "chapter_id": "V5", + "chapter_name": "File Handling", + "section_id": "V5.2", + "section_name": "File Upload and Content", + "req_id": "V5.2.3", + "req_description": "برنامه باید پیش از استخراج محتوای فایل‌های فشرده (مانند zip، gz، docx، odt)، آن‌ها را از نظر حداکثر اندازه مجاز پس از استخراج و همچنین حداکثر تعداد فایل‌های درون آن بررسی می‌کند.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "File Handling", + "section_id": "V5.2", + "section_name": "File Upload and Content", + "req_id": "V5.2.4", + "req_description": "برنامه فضای مشخصی برای اندازه فایل و تعداد فایل‌های مجاز برای هر کاربر اعمال می‌کند تا از این طریق، یک کاربر نتواند با بارگذاری تعداد زیادی فایل یا فایل‌های بیش از حد بزرگ، فضای ذخیره‌سازی را پر کند.", + "L": "3" + }, + { + "chapter_id": "V5", + "chapter_name": "File Handling", + "section_id": "V5.2", + "section_name": "File Upload and Content", + "req_id": "V5.2.5", + "req_description": "برنامه اجازه بارگذاری فایل‌های فشرده‌ که حاوی لینک های نمادین (symlinks) هستند را نمی‌دهد، مگر اینکه این رفتار به طور مشخص مورد نیاز باشد. در چنین شرایطی باید یک فهرست مجاز (allowlist) از مسیرها یا فایل‌هایی که می تواند برای آنها لینک نمادین ایجاد شود، اعمال و اعتبارسنجی گردد.", + "L": "3" + }, + { + "chapter_id": "V5", + "chapter_name": "File Handling", + "section_id": "V5.2", + "section_name": "File Upload and Content", + "req_id": "V5.2.6", + "req_description": "برنامه تصاویر بارگذاری‌شده با اندازه پیکسلی بزرگ‌تر از حد مجاز را رد کند تا از حملات pixel flood attacks جلوگیری شود.", + "L": "3" + }, + { + "chapter_id": "V5", + "chapter_name": "File Handling", + "section_id": "V5.3", + "section_name": "File Storage", + "req_id": "V5.3.1", + "req_description": "فایل هایی که از ورودی های غیرمعتبر بارگذاری‌ یا تولید می شوند و در پوشه های عمومی قرار می گیرند، هنگام دسترسی مستقیم از طریق یک درخواست HTTP، به عنوان کداجرایی سمت سرور اجرا نشوند.", + "L": "1" + }, + { + "chapter_id": "V5", + "chapter_name": "File Handling", + "section_id": "V5.3", + "section_name": "File Storage", + "req_id": "V5.3.2", + "req_description": "هنگام ایجاد مسیرهای فایل برای عملیات مختلف، به جای استفاده از نام فایل‌های ارسال شده توسط کاربر، از داده‌های تولید شده داخلی یا منابع مورد اعتماد استفاده شود. و در صورتی که استفاده از نام فایل‌ها یا متادیتای ارسالی توسط کاربر ضروری باشد، می بایست validation و Sanitization اعمال شود. این کار برای جلوگیری از حملاتی مانند Path Traversal، Local or Remote File Inclusion(LFI, RFI) و Server-Side Request Forgery(SSRF) می‌باشد.", + "L": "1" + }, + { + "chapter_id": "V5", + "chapter_name": "File Handling", + "section_id": "V5.3", + "section_name": "File Storage", + "req_id": "V5.3.3", + "req_description": "پردازش فایل‌های سمت سرور، مانند استخراج فایل‌های فشرده، اطلاعات مسیر ارائه شده توسط کاربر را نادیده می‌گیرد تا از آسیب‌پذیری‌هایی مانند zip slip جلوگیری شود.", + "L": "3" + }, + { + "chapter_id": "V5", + "chapter_name": "File Handling", + "section_id": "V5.4", + "section_name": "File Download", + "req_id": "V5.4.1", + "req_description": "برنامه نام فایل ارسال‌شده توسط کاربر را چه در قالب JSON، JSONP یا پارامتر URL، اعتبارسنجی می‌کند یا نادیده می‌گیرد، و در پاسخ HTTP، نام فایل را به‌طور صریح در فیلد Content-Disposition هدر مشخص می‌نماید.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "File Handling", + "section_id": "V5.4", + "section_name": "File Download", + "req_id": "V5.4.2", + "req_description": "نام‌های فایل‌های ارائه شده (مانند فیلدهای هدر پاسخ HTTP یا پیوست‌های ایمیل)، به‌درستی encoded یا sanitized شده‌اند (مطابق RFC 6266)، تا ساختار سند حفظ شده و از حملات تزریق جلوگیری شود.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "File Handling", + "section_id": "V5.4", + "section_name": "File Download", + "req_id": "V5.4.3", + "req_description": "فایل‌های دریافت شده از منابع غیرقابل اعتماد توسط آنتی ویروس اسکن شود تا از ارائه محتوای مخرب شناخته‌شده جلوگیری شود.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.1", + "section_name": "Authentication Documentation", + "req_id": "V6.1.1", + "req_description": "مستندات برنامه، نحوه استفاده از کنترل هایی مانند محدودیت نرخ (Rate Limit)، مقابله با خودکارسازی (Anti-Automation) و پاسخ تطبیقی (Adaptive Response) را برای دفاع در برابر حملاتی مانند Credential Stuffing و حملات Password Brute Force به وضوح تعریف کرده باشد. مستندات باید به‌وضوح نحوه پیکربندی این کنترل‌ها را تشریح کرده و نشان دهند که چگونه از قفل شدن مخرب حساب‌های کاربری جلوگیری می‌شود.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.1", + "section_name": "Authentication Documentation", + "req_id": "V6.1.2", + "req_description": "یک لیست از کلمات خاص مرتبط با زمینه سازمانی‌ (Context-Specific) مستندسازی شود تا از بکارگیری آنها در رمزهای عبور جلوگیری شد. این فهرست می‌تواند شامل نام سازمان، نام محصول، شناسه سامانه، نام کد پروژه، نام دپارتمان یا نقش های سازمانی و موارد مشابه باشد.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.1", + "section_name": "Authentication Documentation", + "req_id": "V6.1.3", + "req_description": "در صورت وجود مسیرهای متعدد احراز هویت در برنامه کاربردی، تمامی این مسیرها به همراه کنترل‌های امنیتی و سطح قدرت احراز هویت مورد نیاز، مستندسازی شده‌اند. لازم است این کنترل‌ها به‌صورت یکسان و سازگار در تمامی مسیرهای احراز هویت اجرا شوند.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.2", + "section_name": "Password Security", + "req_id": "V6.2.1", + "req_description": "کلمات عبور تنظیم شده توسط کاربر حداقل ۸ کاراکتر طول داشته باشد. هرچند حداقل ۱۵ کاراکتر به شدت توصیه می‌شود.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.2", + "section_name": "Password Security", + "req_id": "V6.2.2", + "req_description": "کاربران قادر به تغییر گذرواژه خود باشند.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.2", + "section_name": "Password Security", + "req_id": "V6.2.3", + "req_description": "هنگام تغییر کلمه عبور، گذرواژه فعلی و گذرواژه جدید توسط کاربر تکمیل شود.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.2", + "section_name": "Password Security", + "req_id": "V6.2.4", + "req_description": "کلمات عبوری که در حین ثبت‌نام حساب کاربری یا تغییر کلمه عبور ارسال می شوند با یک فهرست در دسترس از حداقل ۳۰۰۰ کلمه عبور رایج که ( با سیاست‌های کلمه عبور برنامه (مانند حداقل طول) سازگاری دارند) بررسی شوند.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.2", + "section_name": "Password Security", + "req_id": "V6.2.5", + "req_description": "کلمات عبور با هر ترکیبی قابل استفاده باشند، بدون اینکه قوانینی برای محدودکردن نوع کاراکترهای مجاز وجود داشته باشد. نباید هیچ‌گونه الزامی برای تعداد حداقل کاراکترهای حروف بزرگ یا کوچک، اعداد یا کاراکترهای خاص وجود داشته باشد.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.2", + "section_name": "Password Security", + "req_id": "V6.2.6", + "req_description": "فیلدهای ورودی کلمه عبور از نوع \"type=password\" استفاده می‌کنند تا ورودی‌ها پنهان شوند. برنامه‌ها می‌توانند به کاربر این امکان را بدهند که موقتاً کلمه عبور کامل یا آخرین کاراکتر تایپ شده را مشاهده کند.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.2", + "section_name": "Password Security", + "req_id": "V6.2.7", + "req_description": "عملکرد \"چسباندن\" (paste)، ابزارهای کمکی گذرواژه مرورگر و مدیریت‌کننده‌های گذرواژه خارجی مجاز باشند.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.2", + "section_name": "Password Security", + "req_id": "V6.2.8", + "req_description": "برنامه کلمه عبور کاربر را دقیقاً همانطور که از کاربر دریافت شده است، بدون هیچ گونه تغییراتی مانند کوتاه‌سازی(truncation) یا تبدیل حروف بزرگ و کوچک (case transformation)، بررسی کند.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.2", + "section_name": "Password Security", + "req_id": "V6.2.9", + "req_description": "استفاده از گذرواژه‌هایی با حداقل طول ۶۴ کاراکتر مجاز باشد.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.2", + "section_name": "Password Security", + "req_id": "V6.2.10", + "req_description": "کلمه عبور کاربر تا زمانی که مشخص شود که به خطر افتاده است یا کاربر آن را تغییر دهد، معتبر باقی بماند. برنامه نباید الزام به تغییر دوره‌ای گذرواژه‌ها را داشته باشد.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.2", + "section_name": "Password Security", + "req_id": "V6.2.11", + "req_description": "فهرست مستند شده ای از کلمات خاص مرتبط با زمینه‌ سازمانی برای جلوگیری از ایجاد کلمات عبور آسان قابل حدس، مورد استفاده قرار گیرد.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.2", + "section_name": "Password Security", + "req_id": "V6.2.12", + "req_description": "کلمات عبور وارد شده در حین ثبت‌نام حساب کاربری یا تغییر کلمه عبور با مجموعه‌ای از کلمات عبور افشا شده بررسی ‌شوند.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.3", + "section_name": "General Authentication Security", + "req_id": "V6.3.1", + "req_description": "کنترل‌های لازم برای جلوگیری از حملاتی مانند Credential Stuffing و password brute force طبق مستندات امنیتی برنامه پیاده‌سازی شوند.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.3", + "section_name": "General Authentication Security", + "req_id": "V6.3.2", + "req_description": "حساب‌های کاربری پیش‌فرض (مانند \"admin\"، \"root\" یا \"sa\") در برنامه وجود نداشته باشند یا غیرفعال شده باشند.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.3", + "section_name": "General Authentication Security", + "req_id": "V6.3.3", + "req_description": "برای دسترسی به برنامه، از یک مکانیزم احراز هویت چندعاملی (MFA) یا ترکیبی از مکانیزم‌های احراز هویت تک‌عاملی استفاده شود. برای سطح L3، حداقل یکی از عوامل احراز هویت باید مبتنی بر سخت‌افزار باشد در برابر حملات فیشینگ، مقاومت در برابر نفوذ و جعل هویت را فراهم کند، در حالی که با اقدام آگاهانه کاربر (مانند فشردن دکمه روی کلید سخت‌افزاری FIDO یا تلفن همراه) قصد کاربر برای احراز هویت را نیز تأیید نماید. هرگونه تسهیل یا تعدیل در این الزام، مستلزم ارائه دلایل مستند و مجموعه‌ای جامع از کنترل‌های جبرانی است.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.3", + "section_name": "General Authentication Security", + "req_id": "V6.3.4", + "req_description": "تأیید کنید که در صورت وجود مسیرهای متعدد احراز هویت در برنامه، هیچ مسیر احراز هویتِ مستندسازی‌نشده‌ای وجود نداشته باشد و کنترل‌های امنیتی و سطح قدرت احراز هویت در تمامی مسیرها به‌صورت یکسان و سازگار اعمال شوند.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.3", + "section_name": "General Authentication Security", + "req_id": "V6.3.5", + "req_description": "کاربران از تلاش‌های مشکوک برای احراز هویت (موفق یا ناموفق) مطلع ‌شوند. این اطلاع‌رسانی می‌تواند شامل تلاش برای احراز هویت از موقعیت مکانی یا کلاینت غیرمعمول، احراز هویت ناقص (تنها موفقیت یکی از عوامل)، تلاش برای احراز هویت پس از یک دوره طولانی عدم فعالیت، یا احراز هویت موفق پس از چندین تلاش ناموفق باشد.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.3", + "section_name": "General Authentication Security", + "req_id": "V6.3.6", + "req_description": "ایمیل به‌عنوان مکانیزم احراز هویت، چه به‌صورت تک‌عاملی و چه به‌عنوان یکی از عوامل احراز هویت چندعاملی، استفاده نمی‌شود.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.3", + "section_name": "General Authentication Security", + "req_id": "V6.3.7", + "req_description": "کاربران پس از به‌روزرسانی اطلاعات احراز هویت خود، مانند بازنشانی گذرواژه یا تغییر نام کاربری یا آدرس ایمیل، مطلع شوند.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.3", + "section_name": "General Authentication Security", + "req_id": "V6.3.8", + "req_description": "با توجه به پیام‌های خطا، کدهای پاسخ HTTP یا تفاوت در زمان پاسخ‌دهی، نتوان کاربران معتبر را از طریق تلاش‌های ناموفق احراز هویت شناسایی کرد. همچنین، عملکردهای ثبت‌نام و بازیابی گذرواژه نیز باید از این نوع افشای اطلاعات محافظت شده باشند.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.4", + "section_name": "Authentication Factor Lifecycle and Recovery", + "req_id": "V6.4.1", + "req_description": "کلمه عبور اولیه یا کدهای فعال‌سازی تولید شده توسط سیستم، به‌صورت تصادفی و ایمن تولید ‌شوند، با سیاست فعلی رمز عبور مطابقت دارند، و پس از مدت زمان کوتاهی یا پس از اولین استفاده منقضی می‌شوند. این رمزهای اولیه نباید به عنوان رمز عبور بلندمدت مورد استفاده قرار گیرند.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.4", + "section_name": "Authentication Factor Lifecycle and Recovery", + "req_id": "V6.4.2", + "req_description": "راهنمای کلمه عبور یا احراز هویت مبتنی بر دانش (که به عنوان \"سؤالات امنیتی\" شناخته می‌شوند) در سیستم وجود ندارد.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.4", + "section_name": "Authentication Factor Lifecycle and Recovery", + "req_id": "V6.4.3", + "req_description": "فرآیند امنی برای بازنشانی کلمه عبور فراموش‌شده پیاده‌سازی شده است که هیچ‌یک از مکانیزم‌های احراز هویت چندعاملی فعال را دور نزند.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.4", + "section_name": "Authentication Factor Lifecycle and Recovery", + "req_id": "V6.4.4", + "req_description": "در صورت از دست رفتن یکی از عوامل احراز هویت چندعاملی، فرآیند اثبات هویت با همان سطحی که در زمان ثبت‌نام انجام شده است، اجرا شود.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.4", + "section_name": "Authentication Factor Lifecycle and Recovery", + "req_id": "V6.4.5", + "req_description": "دستورالعمل‌های تمدید مکانیزم‌های احراز هویت دارای تاریخ انقضا برای کاربران به موقع ارسال می‌شود تا پیش از انقضای مکانیزم فعلی فرصت کافی برای تمدید وجود داشته باشد، و در صورت لزوم، یادآورهای خودکار نیز تنظیم و ارسال شده باشند.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.4", + "section_name": "Authentication Factor Lifecycle and Recovery", + "req_id": "V6.4.6", + "req_description": "کاربران ادمین می‌توانند فرآیند بازنشانی کلمه عبور را برای کاربران عادی آغاز کنند، اما اجازه تغییر مستقیم یا انتخاب رمز عبور برای کاربر را ندارند. این کنترل برای جلوگیری از دسترسی ادمین به رمز عبور کاربران طراحی شده است.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.5", + "section_name": "General Multi-factor authentication requirements", + "req_id": "V6.5.1", + "req_description": "Lookup Secrets درخواست‌ها یا کدهای احراز هویت خارج از باند (Out-of-Band) و رمزهای یکبار مصرف مبتنی بر زمان (TOTP) تنها یک‌بار قابل استفاده باشند و پس از استفاده موفق، مجدداً قابل استفاده نباشند.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.5", + "section_name": "General Multi-factor authentication requirements", + "req_id": "V6.5.2", + "req_description": "در صورت ذخیره‌سازی Lookup Secrets در سمت Backend برنامه، اگر مقدار آنتروپی کمتر از ۱۱۲ بیت باشند (معادل ۱۹ کاراکتر تصادفی الفبایی-عددی یا ۳۴ رقم تصادفی)، باید با یک الگوریتم تایید شده برای ذخیره رمز عبور و با استفاده از یک Salt تصادفی ۳۲ بیتی هش شوند. در صورتی که آنتروپی کد ۱۱۲ بیت یا بیشتر باشد، می‌توان از یک تابع هش استاندارد برای ذخیره سازی استفاده کرد.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.5", + "section_name": "General Multi-factor authentication requirements", + "req_id": "V6.5.3", + "req_description": "Lookup Secrets کدهای احراز هویت خارج از باند (out of band) و تولید رمزهای یکبار مصرف مبتنی بر زمان(TOTP) همگی با استفاده از یک تولیدکننده عدد شبه تصادفی ‌رمزنگاری‌شده (CSPRNG) تولید شده باشند تا از تولید مقادیر قابل پیش‌بینی جلوگیری شود.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.5", + "section_name": "General Multi-factor authentication requirements", + "req_id": "V6.5.4", + "req_description": "Lookup Secrets و کدهای احراز هویت خارج از باند (out of band) حداقل دارای ۲۰ بیت آنتروپی باشند (معمولاً ۴ کاراکتر تصادفی الفبایی-عددی یا ۶ رقم تصادفی برای رسیدن به این میزان آنتروپی کافی است).", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.5", + "section_name": "General Multi-factor authentication requirements", + "req_id": "V6.5.5", + "req_description": "درخواست‌ها، کدها یا توکن‌های احراز هویت خارج از باند (Out-of-Band) و همچنین رمزهای عبور یک‌بار مصرف مبتنی بر زمان (TOTP) دارای طول عمر مشخص باشند. حداکثر طول عمر برای درخواست‌های خارج از باند باید ۱۰ دقیقه و برای TOTP حداکثر ۳۰ ثانیه باشد.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.5", + "section_name": "General Multi-factor authentication requirements", + "req_id": "V6.5.6", + "req_description": "امکان لغو (Revoke) هر عامل احراز هویت، از جمله دستگاه‌های فیزیکی، در صورت سرقت یا مفقود شدن وجود داشته باشد.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.5", + "section_name": "General Multi-factor authentication requirements", + "req_id": "V6.5.7", + "req_description": "مکانیزم‌های احراز هویت بیومتریک فقط به‌عنوان عامل دوم و در کنار یکی از عوامل «چیزی که در اختیار دارید» یا «چیزی که کاربر می داند» مورد استفاده قرار می‌گیرند.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.5", + "section_name": "General Multi-factor authentication requirements", + "req_id": "V6.5.8", + "req_description": "اعتبارسنجی رمزهای یک‌بار مصرف مبتنی بر زمان (TOTP) بر اساس منبع زمانی از یک سرویس قابل اعتماد انجام می‌شود و نه بر اساس زمان ارائه‌شده توسط کلاینت یا منابع غیرقابل اعتماد.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.6", + "section_name": "Out-of-Band authentication mechanisms", + "req_id": "V6.6.1", + "req_description": "مکانیزم‌های احراز هویت مبتنی بر شبکه تلفن عمومی (PSTN) برای ارسال رمزهای یک‌بار مصرف (OTP) از طریق تماس تلفنی یا پیامک تنها در صورتی که شماره تلفن قبلا اعتبارسنجی شده باشد، یا روش‌های جایگزین قوی‌تر (رمزهای عبور یکبار مصرف مبتنی بر زمان) در دسترس باشند ارائه می‌شوند و سرویس‌دهنده باید کاربران را از ریسک‌های امنیتی این روش‌ها مطلع سازد. برای اپلیکیشن‌های سطح L3، استفاده از تماس تلفنی و پیامک به‌عنوان گزینه، مجاز نیست.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.6", + "section_name": "Out-of-Band authentication mechanisms", + "req_id": "V6.6.2", + "req_description": "درخواست‌ها، کدها یا توکن‌های احراز هویت خارج از باند (Out-of-Band) به درخواست احراز هویت اصلی که برای آن تولید شده‌اند متصل باشند و قابل استفاده برای درخواست‌های قبلی یا بعدی نباشند.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.6", + "section_name": "Out-of-Band authentication mechanisms", + "req_id": "V6.6.3", + "req_description": "مکانیزم‌های احراز هویت خارج از باند (Out-of-Band) مبتنی بر کد، در برابر حملات brute force از طریق اعمال کنترل محدودیت نرخ (Rate Limiting) محافظت شوند. همچنین، استفاده از کدی با حداقل ۶۴ بیت آنتروپی (Entropy)مدنظر قرار گیرد.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.6", + "section_name": "Out-of-Band authentication mechanisms", + "req_id": "V6.6.4", + "req_description": "در صورت استفاده از Push Notifications جهت احراز هویت چند عاملی، محدودیت نرخ (Rate Limiting) به منظور جلوگیری از حملات Push Bombing اعمال شده باشد. استفاده از تطبیق عدد Matching) Number) نیز می‌تواند به کاهش این ریسک کمک کند.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.7", + "section_name": "Cryptographic authentication mechanism", + "req_id": "V6.7.1", + "req_description": "گواهینامه‌های مورد استفاده برای تأیید ادعاهای احراز هویت رمزنگاری‌شده به گونه‌ای ذخیره شوند که از تغییر یا دستکاری آن‌ها محافظت شود.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.7", + "section_name": "Cryptographic authentication mechanism", + "req_id": "V6.7.2", + "req_description": "مقدار چالش (Challenge Nonce) حداقل ۶۴ بیت طول داشته باشد و از نظر آماری یکتا باشد یا حداقل در طول عمر دستگاه رمزنگاری منحصر به فرد باقی بماند.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.8", + "section_name": "Authentication with an Identity Provider", + "req_id": "V6.8.1", + "req_description": "اگر برنامه از چند ارائه‌دهنده هویت (IdP) پشتیبانی می‌کند، امکان جعل هویت کاربر از طریق یک ارائه‌دهنده هویت دیگر وجود نداشته باشد (برای مثال، با استفاده از شناسه کاربری یکسان). مکانیسم استاندارد برای جلوگیری از این تهدید، این است که برنامه، کاربران را با استفاده از ترکیب شناسه IdP (به‌عنوان فضای نام یا (namespace و شناسه کاربر در آن، IdP ثبت و شناسایی کند.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.8", + "section_name": "Authentication with an Identity Provider", + "req_id": "V6.8.2", + "req_description": "وجود و یکپارچگی امضاهای دیجیتال بر روی تصدیق‌های (تقاضاها یا ادعاهای) احراز هویت برای مثال بر روی (توکن‌های JWT یا SAML assertions) همواره اعتبارسنجی می‌شود و هرگونه تصدیقی که فاقد امضا یا دارای امضای نامعتبر باشد، رد می‌گردد.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.8", + "section_name": "Authentication with an Identity Provider", + "req_id": "V6.8.3", + "req_description": "(تقاضاها یا ادعاهای) تصدیق‌های SAML به‌صورت منحصربه‌فرد پردازش شده و تنها یک‌بار در بازه‌ی اعتبار خود استفاده می‌شوند تا از حملات بازپخش (Replay Attacks) جلوگیری گردد.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.8", + "section_name": "Authentication with an Identity Provider", + "req_id": "V6.8.4", + "req_description": "اگر برنامه‌ای از یک ارائه‌دهنده هویت (IdP) جداگانه استفاده می‌کند و انتظار قدرت، روش‌ها یا تازگی احراز هویت خاصی را برای عملکردهای خاص دارد، برنامه این موضوع را با استفاده از اطلاعات برگردانده شده توسط IdP تأیید می‌کند. به عنوان مثال، اگر از OIDC استفاده شود، این کار می‌تواند با اعتبارسنجی ادعاهای (Claims) موجود در توکن شناسایی (ID Token) مانند «amr»، «acr» و «auth_time» (در صورت وجود) انجام شود. اگر ارائه‌دهنده هویت این اطلاعات را ارائه نکند، برنامه باید یک روش جایگزین مستندسازی‌شده داشته باشد که فرض می‌کند حداقل سطح احراز هویت استفاده شده است (مثلاً احراز هویت تک‌عاملی با نام کاربری و گذرواژه).", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.1", + "section_name": "Session Management Documentation", + "req_id": "V7.1.1", + "req_description": "بازه عدم فعالیت نشست کاربر و بیشینه طول عمر نشست قبل از احراز هویت مجدد، در ترکیب با سایر کنترل‌ها مستند و متناسب سازی شود. مستند سازی انجام شده باید شامل توجیه برای هر انحراف(نقض) از الزامات احراز هویت مجدد NIST SP 800-63B باشد.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.1", + "section_name": "Session Management Documentation", + "req_id": "V7.1.2", + "req_description": "در مستند باید تعداد نشست همزمان مجاز برای یک کاربر و همچنین رفتار و اعمال مناسب برای زمانی که این تعداد به حداکثر رسید مشخص شود.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.1", + "section_name": "Session Management Documentation", + "req_id": "V7.1.3", + "req_description": "تمام سیستم‌هایی که نشست‌های کاربر را به عنوان بخشی از یک اکوسیستم مدیریت هویت فدرال(مانند سیستم‌های (SSO ایجاد و مدیریت می‌کنند، باید در کنار سایر کنترل‌های مربوط به طول عمر نشست‌ها، خاتمه آن‌ها و هرگونه شرایط دیگری که نیاز به احراز هویت مجدد دارد، مستند شوند.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.2", + "section_name": "Fundamental Session Management Security", + "req_id": "V7.2.1", + "req_description": "برنامه کاربردی باید تمام بررسی‌های توکن نشست‌ را با استفاده از یک سرویس backend مطمئن انجام دهد.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.2", + "section_name": "Fundamental Session Management Security", + "req_id": "V7.2.2", + "req_description": "برنامه کاربردی که از هر یک از توکن‌های Self-Contained یا reference که به صورت پویا برای مدیریت نشست تولید شده‌اند استفاده کند اما از از کلیدهای API ثابت و کلید‌ها استفاده نکند.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.2", + "section_name": "Fundamental Session Management Security", + "req_id": "V7.2.3", + "req_description": "در صورتی که برای نمایش نشست کاربر از توکن‌های reference استفاده می شود، این توکن‌ها منحصر به فرد بوده و با استفاده از یک تولید کننده عدد شبه تصادفی امن رمزنگاری(CSPRNG) که دارای انتروپی حداقل128 بیتی است تولید شوند.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.2", + "section_name": "Fundamental Session Management Security", + "req_id": "V7.2.4", + "req_description": "برنامه کاربردی در هنگام احراز هویت کاربر یک توکن نشست جدید تولید نماید که شامل احراز هویت مجدد و ابطال توکن نشست کنونی است.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.3", + "section_name": "Session Timeout", + "req_id": "V7.3.1", + "req_description": "بر اساس تحلیل ریسک و تصمیمات امنیتی مستند شده، پس از گذشت مهلت زمانی عدم فعالیت، کاربر مجبور به احراز هویت مجدد گردد.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.3", + "section_name": "Session Timeout", + "req_id": "V7.3.2", + "req_description": "بر اساس تحلیل ریسک و تصمیمات امنیتی مستند شده، پس از گذشت بیشینه زمان مطلق طول عمر، کاربر مجبور به احراز هویت مجدد گردد.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.4", + "section_name": "Session Termination", + "req_id": "V7.4.1", + "req_description": "در مواقعی که فرآیند خاتمه نشست کاربر فعال می‌شود (مانند خروج کاربر یا انقضای نشست)، برنامه اجازه هیچ فعالیتی را به آن نشست نمی‌دهد. برای Reference tokens یا stateful session، این به معنی نامعتبرسازی اطلاعات نشست در برنامه Backend می‌باشد. برنامه‌هایی که از توکن‌های Self-contained استفاده می‌کنند نیاز به راه حل‌هایی نظیر نگهداری فهرستی از توکن‌های خاتمه‌یافته، عدم پذیرش توکن‌هایی که پیش از یک تاریخ و زمان مشخص برای هر کاربر تولید شده‌اند، یا چرخش کلید امضای مخصوص هر کاربر دارند.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.4", + "section_name": "Session Termination", + "req_id": "V7.4.2", + "req_description": "برنامه کاربردی تمامی نشست‌های فعال را در زمانی که حساب کاربری غیرفعال یا حذف می‌شود را ابطال نماید. (مانند کارمندی که شرکت را ترک می‌کند)", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.4", + "section_name": "Session Termination", + "req_id": "V7.4.3", + "req_description": "برنامه کاربردی قابلیت ارائه گزینه ابطال تمامی نشست های فعال دیگر را پس از یک تغییر موفقیت آمیز یا حذف هریک از عوامل احراز هویت (نظیر تغییر پسورد از طریق ریست یا بازنشانی و در صورت وجود به روزرسانی تنظیمات MFA ) را داشته باشد.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.4", + "section_name": "Session Termination", + "req_id": "V7.4.4", + "req_description": "تمامی صفحاتی که نیازمند احراز هویت هستند دارای دسترسی آسان و مشخص به فرآیند خروج باشند.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.4", + "section_name": "Session Termination", + "req_id": "V7.4.5", + "req_description": "مدیران برنامه کاربردی قادر به ابطال نشست‌های فعال برای یک شخص یا تمامی کاربران باشند.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.5", + "section_name": "Defenses Against Session Abuse", + "req_id": "V7.5.1", + "req_description": "برنامه کاربردی قبل از اعطای مجوز تغییر ویژگی‌های حساس حساب کاربری که بر روی احراز هویت تاثیر دارد نظیر آدرس ایمیل، شماره تلفن، تنظیمات MFA یا اطلاعات دیگر که در بازگردانی حساب کاربری مورد استفاده قرار می‌گیرند، به احراز هویت مجدد کامل نیاز دارد.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.5", + "section_name": "Defenses Against Session Abuse", + "req_id": "V7.5.2", + "req_description": "حساب‌های کاربری قادر به دیدن(پس از احراز هویت مجدد با حداقل یک عامل) و ابطال یک یا همه نشست‌های فعال باشد.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.5", + "section_name": "Defenses Against Session Abuse", + "req_id": "V7.5.3", + "req_description": "برنامه کاربردی قبل از اجرای تراکنش‌ها یا عملیات‌های حساس نیازمند احراز هویت مجدد با حداقل یک عامل یا صحت سنجی ثانویه باشد.", + "L": "3" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.6", + "section_name": "Federated Re-authentication", + "req_id": "V7.6.1", + "req_description": "طول عمر و ابطال نشست بین RP و idp طبق سند- که نیازمند احرازهویت مجدد در زمان مورد نیاز مانند وقتی که بیشینه زمان بین رخداد احراز هویت idp رسیده باشد- انجام شود.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.6", + "section_name": "Federated Re-authentication", + "req_id": "V7.6.2", + "req_description": "ساخت نشست‌ها نیاز به رضایت کاربر یا یک اقدام صریح دارد که بدین صورت از ایجاد نشست‌های جدید برنامه بدون تعامل کاربر جلوگیری می‌شود.", + "L": "2" + }, + { + "chapter_id": "V8", + "chapter_name": "Authorization", + "section_id": "V8.1", + "section_name": "Authorization Documentation", + "req_id": "V8.1.1", + "req_description": "مستند اعطای مجوز باید شامل قوانینی به منظور محدودسازی دسترسی در سطح عملکرد و دسترسی مبتنی بر داده بر اساس مجوزهای کاربران و ویژگی‌های منابع باشد.", + "L": "1" + }, + { + "chapter_id": "V8", + "chapter_name": "Authorization", + "section_id": "V8.1", + "section_name": "Authorization Documentation", + "req_id": "V8.1.2", + "req_description": "مستند اعطای مجوز باید قوانینی را برای محدودیت‌های دسترسی در سطح Field بر اساس مجوزهای کاربران و ویژگی‌های منابع تعریف نماید(هر دو دسترسی خواندن و نوشتن). توجه داشته باشید که این قوانین ممکن است به مقادیر دیگر ویژگی‌های شیء داده ی مربوطه (Relevant Data Object) بستگی داشته باشند، مانند حالت (state) یا وضعیت (status).", + "L": "2" + }, + { + "chapter_id": "V8", + "chapter_name": "Authorization", + "section_id": "V8.1", + "section_name": "Authorization Documentation", + "req_id": "V8.1.3", + "req_description": "مستند برنامه کاربردی باید ویژگی‌های محیطی و زمینه‌ای (شامل و نه محدود به زمان روز، مکان، آدرس IP یا دستگاه) که در برنامه کاربردی به منظور اتخاذ تصمیمات امنیتی (نظیر آن دسته از تصمیماتی که مربوط به احراز هویت و اعطای مجوز می باشد) را مشخص کند.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Authorization", + "section_id": "V8.1", + "section_name": "Authorization Documentation", + "req_id": "V8.1.4", + "req_description": "مستندات احراز هویت و اعطای مجوز، علاوه بر اعطای مجوز در سطح Field، سطح عملکرد و داده‌های خاص، چگونگی استفاده از عوامل محیطی و زمینه‌ای در اتخاذ تصمیمات را مشخص نماید.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Authorization", + "section_id": "V8.2", + "section_name": "General Authorization Design", + "req_id": "V8.2.1", + "req_description": "برنامه کاربردی باید از محدود بودن دسترسی‌‌های در سطح عملکرد به مشتریانی که دارای دسترسی صریح هستند اطمینان حاصل نماید.", + "L": "1" + }, + { + "chapter_id": "V8", + "chapter_name": "Authorization", + "section_id": "V8.2", + "section_name": "General Authorization Design", + "req_id": "V8.2.2", + "req_description": "برنامه کاربردی باید از محدود بودن دسترسی‌‌های در سطح داده به مشتریانی که دارای دسترسی صریح به اقلام داده‌ای خاص هستند اطمینان حاصل نماید تا از این طریق خطر آسیب پذیری IDOR و broken object level authorization را کاهش دهد .", + "L": "1" + }, + { + "chapter_id": "V8", + "chapter_name": "Authorization", + "section_id": "V8.2", + "section_name": "General Authorization Design", + "req_id": "V8.2.3", + "req_description": "برنامه کاربردی دسترسی در سطح Field را با مجوزهای صریح به Field ها برای مصرف کنندگان جهت کاهش خطر broken object property level authorization (BOPLA) محدود کرده باشد.", + "L": "2" + }, + { + "chapter_id": "V8", + "chapter_name": "Authorization", + "section_id": "V8.2", + "section_name": "General Authorization Design", + "req_id": "V8.2.4", + "req_description": "کنترل‌های امنیتی تطبیقی که بر اساس ویژگی‌های محیطی و زمینه‌ای کاربر (مانند زمان روز، مکان، آدرس IP یا دستگاه) هستند، برای تصمیم‌گیری‌های احراز هویت (Authentication) و مجوزدهی (Authorization) طبق مستندات برنامه پیاده‌سازی شده‌اند. این کنترل‌ها باید هم در زمان تلاش کاربر برای شروع یک نشست (Session) جدید و هم در طول یک نشست فعال، اعمال شوند.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Authorization", + "section_id": "V8.3", + "section_name": "Operation Level Authorization", + "req_id": "V8.3.1", + "req_description": "برنامه کاربردی قوانین مجوزدهی را در یک لایه سرویس معتبر اعمال نموده و بر آن دسته از کنترل‌هایی که مصرف کنندگان نامعتبر قادر به دستکاری آن‌ها هستند متکی نباشد. (نظیر جاوا اسکریپت سمت کاربر)", + "L": "1" + }, + { + "chapter_id": "V8", + "chapter_name": "Authorization", + "section_id": "V8.3", + "section_name": "Operation Level Authorization", + "req_id": "V8.3.2", + "req_description": "در مواقعی که امکان اعمال فوری تغییرات وجود ندارد (مثلاً وقتی که سیستم برای تصمیم‌گیری در مجوزدهی از توکن‌های Self-Contained مثل JWT استفاده می‌کند که اطلاعات را داخل خود ذخیره کرده و تا زمان انقضا تغییر نمی‌کنند)، باید کنترل‌های جبرانی وجود داشته باشد. این کنترل‌ها باید بتوانند زمانی که کاربر عملی را انجام می‌دهد که دیگر مجاز به آن نیست، هشدار بدهند و تغییر را برگردانند. با این حال، توجه کنید که این راهکار جایگزین نمی‌تواند جلوی نشت اطلاعات را بگیرد.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Authorization", + "section_id": "V8.3", + "section_name": "Operation Level Authorization", + "req_id": "V8.3.3", + "req_description": "دسترسی به یک object بر اساس مجوزهای کاربری شخص درخواست کننده(مثال: مصرف کننده) باشد نه بر اساس مجوز‌های یک واسطه یا سرویسی که به نمایندگی از او عمل می‌کند. بطور مثال، در صورتی که یک مصرف کننده یک وب سرویس را با استفاده از یک توکن self-contained برای احراز هویت فراخوانی می‌کند و سپس آن سرویس اطلاعات را از یک سرویس دیگر درخواست می‌کند، سرویس دوم باید همان توکن مصرف کننده را استفاده کند، نه یک توکن سرویس-به-سرویس (Machine-to-Machine token) که متعلق به سرویس اول است، تا تصمیمات مجوزدهی دقیقاً بر اساس مجوزهای کاربر گرفته شوند.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Authorization", + "section_id": "V8.4", + "section_name": "Other Authorization Considerations", + "req_id": "V8.4.1", + "req_description": "برنامه های کاربردی چند کاربره(multi tenants) از کنترل های cross-tenant به منظور تضمین این امر که عملیات‌های مصرف کنندگان هرگز کاربرانی (tenants) را که مجوز تعامل با آنها را ندارند را تحت تأثیر قرار نمی‌دهد.", + "L": "2" + }, + { + "chapter_id": "V8", + "chapter_name": "Authorization", + "section_id": "V8.4", + "section_name": "Other Authorization Considerations", + "req_id": "V8.4.2", + "req_description": "دسترسی به درگاه‌های پیکربندی شامل چندین لایه امنیتی از قبیل تأیید مداوم هویت مصرف‌کننده، ارزیابی وضعیت امنیتی دستگاه و تحلیل ریسک زمینه‌ای باشد تا از این طریق اطمینان حاصل شود که موقعیت شبکه‌ای یا نقاط پایانی معتبر تنها عوامل برای مجوزدهی نیستند اگر چه که این عوامل احتمال دسترسی غیرمجاز را کاهش می‌دهند.", + "L": "3" + }, + { + "chapter_id": "V9", + "chapter_name": "Self-contained Tokens", + "section_id": "V9.1", + "section_name": "Token source and integrity", + "req_id": "V9.1.1", + "req_description": "قبل از پذیرش محتوای توکن‌ها، آن‌ها را با استفاده از امضای دیجیتال یا MAC به منظور حفاظت در مقابل دستکاری‌ها مورد اعتبارسنجی قرار داده شود.", + "L": "1" + }, + { + "chapter_id": "V9", + "chapter_name": "Self-contained Tokens", + "section_id": "V9.1", + "section_name": "Token source and integrity", + "req_id": "V9.1.2", + "req_description": "فقط الگوریتم‌های موجود در لیست مجاز قادر به استفاده در ساخت و صحت سنجی توکن‌های self-contained در یک زمینه مشخص باشند. این لیست مجاز باید در حالت ایده آل شامل هم الگوریتم‌های متقارن و هم نامتقارن‌ها باشد و نباید شامل الگوریتم‌های NONE باشد. در صورتی که هر دو الگوریتم‌های متقارن و نانتقارن مورد نیاز باشند کنترل‌های بیشتری باید به منظور جلوگیری از سردرگمی کلید‌ها(key Confusion) بکار گرفته شود.", + "L": "1" + }, + { + "chapter_id": "V9", + "chapter_name": "Self-contained Tokens", + "section_id": "V9.1", + "section_name": "Token source and integrity", + "req_id": "V9.1.3", + "req_description": "به منظور جلوگیری از مشخص نمودن منابع غیر مطمئن و کلید‌ها توسط مهاجمین، موارد کلیدی که در اعتبارسنجی توکن‌های self-contained مورد استفاده قرار می‌گیرند، از منابع از پیش پیکربندی شده مطمئنی که برای صادر کننده توکن است تعیین شود. برای JWTs و سایر ساختارهای JWS ، هدرهایی نظیر ‘jku’, ‘x5u’ و ‘jwk’ باید با یک لیست مجاز از منابع مطمئن مورد اعتبارسنجی قرار گیرند.", + "L": "1" + }, + { + "chapter_id": "V9", + "chapter_name": "Self-contained Tokens", + "section_id": "V9.2", + "section_name": "Token content", + "req_id": "V9.2.1", + "req_description": "اگر یک بازه زمانی معتبر در داده‌های توکن وجود داشته باشد، توکن و محتوای آن تنها در صورتی پذیرفته می‌شوند که زمان بررسی در این بازه زمانی معتبر باشد. به عنوان مثال، برای JWTها، ادعاهای 'nbf' و 'exp' باید تایید شوند.", + "L": "1" + }, + { + "chapter_id": "V9", + "chapter_name": "Self-contained Tokens", + "section_id": "V9.2", + "section_name": "Token content", + "req_id": "V9.2.2", + "req_description": "سرویسی که یک توکن دریافت می‌کند قبل از پذیرش محتوای آن، از لحاظ درستی نوع بررسی نموده و برای هدف مشخص شده در نظر گیرد. بطور مثال، فقط توکن‌های access می‌توانند به منظور تصمیمات مجوزی و فقط توکن های ID می‌توانند به منظور اثبات هویت کاربر مورد پذیرش قرار گیرند.", + "L": "2" + }, + { + "chapter_id": "V9", + "chapter_name": "Self-contained Tokens", + "section_id": "V9.2", + "section_name": "Token content", + "req_id": "V9.2.3", + "req_description": "یک سرویس فقط توکن‌هایی را بپذیرد که به منظور استفاده توسط آن سرویس هستند(audience).برای JWT ها،این امر می‌تواند از طریق اعتبارسنجی ادعای 'aud' با یک لیست مجاز تعریف شده در سرویس صورت پذیرد.", + "L": "2" + }, + { + "chapter_id": "V9", + "chapter_name": "Self-contained Tokens", + "section_id": "V9.2", + "section_name": "Token content", + "req_id": "V9.2.4", + "req_description": "اگر صادر کننده توکن از کلید خصوصی مشابهی برای audienceهای متفاوت استفاده می‌کند، توکن‌های تولید شده دارای محدودیت مخاطبی باشند که بطور منحصر به فردی مخاطبین مورد نظر را مشخص می‌کند. این امر از استفاده مجدد توکن توسط مخاطب ناخواسته جلوگیری می‌کند. در صورتی که شناسه مخاطب به صورت پویا مشخص شده باشد، صادرکننده توکن باید این مخاطبین را به منظور اطمینان از عدم جعل هویت مخاطب مورد اعتبارسنجی قرار دهد.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.1", + "section_name": "Generic OAuth and OIDC Security", + "req_id": "V10.1.1", + "req_description": "توکن‌ها باید فقط به مؤلفه‌هایی ارسال شوند که به‌طور دقیق به آن‌ها نیاز دارند. برای مثال، هنگام استفاده از الگوی Backend-for-Frontend برای برنامه‌های JavaScript مبتنی بر مرورگر، Access Tokens و Refresh Tokens باید فقط برای Backend قابل دسترس باشند.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.1", + "section_name": "Generic OAuth and OIDC Security", + "req_id": "V10.1.2", + "req_description": "Client باید فقط مقادیری را از Authorization Server بپذیرد (مانند Authorization Code یاID Token ) که این مقادیر حاصل از یک Authorization Flow باشند که توسط همان نشست (Session) و تراکنش User Agent آغاز شده است. این موضوع مستلزم آن است که Secretهای تولیدشده توسط کلاینت مانند code_verifier در PKCE، یا مقادیر state و nonce در OIDC قابل حدس زدن نباشند، مخصوص همان تراکنش باشند، و به‌صورت امن هم به کلاینت و هم به نشست (Session) مرورگری که تراکنش در آن شروع شده، متصل شده باشند.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.2", + "section_name": "OAuth Client", + "req_id": "V10.2.1", + "req_description": "درCode Flow، باید OAuth Client در برابر حملاتBrowser-based Request Forgery که معمولاً با عنوان Cross-Site Request Forgery (CSRF) شناخته می‌شوند و درخواست‌های توکن را ایجاد می‌کنند، محافظت داشته باشد. این محافظت باید با استفاده از قابلیت PKCE یا با بررسی پارامترstate که در درخواست احراز مجوز ارسال شده است.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.2", + "section_name": "OAuth Client", + "req_id": "V10.2.2", + "req_description": "اگر OAuth Client بتواند با بیش از یک Authorization Server تعامل داشته باشد، باید دارای سازوکاری برای دفاع در برابر Mix-up Attacks باشد. برای مثال، می‌تواند الزام کند که Authorization Server مقدار پارامتر ‘iss’ را برگرداند و این مقدار هم درAuthorization Response و هم درToken Response اعتبارسنجی شود.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.2", + "section_name": "OAuth Client", + "req_id": "V10.2.3", + "req_description": "OAuth Client باید فقطScopes (یا سایر پارامترهای مجوزدهی) مورد نیاز را در درخواست‌ها به Authorization Server درخواست کند.", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.3", + "section_name": "OAuth Resource Server", + "req_id": "V10.3.1", + "req_description": "Resource Server باید فقط Access Tokenهایی را بپذیرد که برای استفاده با همان سرویس در نظر گرفته شده‌اند(Audience). Audience می‌تواند در یک Access Token ساختاریافته (مانند مقدار aud در JWT) درج شده باشد، یا از طریق Token Introspection Endpoint بررسی شود.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.3", + "section_name": "OAuth Resource Server", + "req_id": "V10.3.2", + "req_description": "Resource Server باید تصمیمات مجوزدهی (Authorization Decisions) را بر اساس Claims موجود در Access Token که واگذاری مجوز (Delegated Authorization) را تعریف می‌کنند، اعمال کند. اگر Claimsهایی مانند sub، scope و authorization_details موجود باشند، باید جزو فرآیند تصمیم‌گیری قرار گیرند.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.3", + "section_name": "OAuth Resource Server", + "req_id": "V10.3.3", + "req_description": "اگر برای گرفتن یک تصمیم کنترل دسترسی، لازم است یک کاربرِ یکتا از داخل Access Token (چه JWT و چه پاسخ Token Introspection ) شناسایی شود، سرور منبع (Resource Server) کاربر را از روی Claimهایی شناسایی کند که قابل اختصاص‌دادن به کاربران دیگر نیستند. معمولاً این یعنی استفاده از ترکیب دو Claim یعنی 'iss' (صادرکننده توکن) و 'sub' (شناسه یکتای کاربر)", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.3", + "section_name": "OAuth Resource Server", + "req_id": "V10.3.4", + "req_description": "اگر Resource Server نیازمند قدرت، روش یا تازگی خاص احراز هویت باشد، بررسی کند که Access Token ارائه‌شده این محدودیت‌ها را برآورده می‌کند. برای مثال، در صورت وجود، از Claimsهای OIDC مانند acr، amr و auth_time به ترتیب استفاده شود.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.3", + "section_name": "OAuth Resource Server", + "req_id": "V10.3.5", + "req_description": "تأیید کنید که Resource Server از استفاده از Access Tokenهای سرقت‌شده یا Replay توکن‌ها (توسط افراد غیرمجاز) جلوگیری کند، با الزام استفاده از Sender-Constrained Access Tokens، مانند Mutual TLS برای OAuth 2 یا OAuth2 Demonstration of Proof of Possession (DPoP).", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.4", + "section_name": "OAuth Authorization Server", + "req_id": "V10.4.1", + "req_description": "سرور احراز هویت باید آدرس‌های بازگشتی (Redirect URI) را بر اساس فهرست مجاز (Allowlist) از URIهای از پیش‌ثبت‌شده و مخصوص هر کلاینت، با استفاده از مقایسه دقیقِ رشته‌ای Comparison) (Exact String اعتبارسنجی می‌کند.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.4", + "section_name": "OAuth Authorization Server", + "req_id": "V10.4.2", + "req_description": "اگر Authorization Server کد احراز مجوز (Authorization Code) را در Authorization Response برمی‌گرداند، این کد فقط یک‌بار برای درخواست توکن باید قابل استفاده باشد. برای دومین درخواست معتبر با یک Authorization Code که قبلاً برای صدور Access Token استفاده شده است، Authorization Server باید درخواست توکن را رد کند و هر توکن صادرشده‌ی مرتبط با آن Authorization Code را باطل نماید.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.4", + "section_name": "OAuth Authorization Server", + "req_id": "V10.4.3", + "req_description": "تأیید کنید که Authorization Code دارای مدت زمان معتبر بودن محدود باشد. حداکثر طول عمر می‌تواند برای برنامه‌های کاربردی در سطوح L1 و L2 تا ۱۰ دقیقه و برای برنامه‌های کاربردی در سطح L3 تا ۱ دقیقه باشد.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.4", + "section_name": "OAuth Authorization Server", + "req_id": "V10.4.4", + "req_description": "برای یک Client مشخص، Authorization Server فقط استفاده از Grantهایی را مجاز بداند که آن Client به استفاده از آن‌ها نیاز دارد. توجه داشته باشید که Grantهای ‘token’ (Implicit Flow) و ‘password’ (Resource Owner Password Credentials Flow) دیگر نباید استفاده شوند.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.4", + "section_name": "OAuth Authorization Server", + "req_id": "V10.4.5", + "req_description": "Authorization Server باید حملات Refresh Token Replay را برای Public Clientها کاهش دهد، ترجیحاً با استفاده از Sender-Constrained Refresh Tokens، یعنی Demonstrating Proof of Possession (DPoP) یا Certificate-Bound Access Tokens با استفاده از Mutual TLS (mTLS). برای برنامه‌های L1 و L2، می‌توان از Refresh Token Rotation استفاده کرد. اگر Refresh Token Rotation به‌کار گرفته شود، Authorization Server باید پس از استفاده، Refresh Token را باطل کند و اگر یک Refresh Token که قبلاً استفاده و باطل شده ارائه شود، تمام Refresh Tokenهای مربوط به آن مجوز را ابطال نماید.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.4", + "section_name": "OAuth Authorization Server", + "req_id": "V10.4.6", + "req_description": "اگر از Code Grant استفاده شود، Authorization Server باید حملات Authorization Code Interception را با الزام به استفاده از Proof Key for Code Exchange (PKCE) کاهش دهد. برای Authorization Requestها، Authorization Server باید یک مقدار معتبر برای 'code_challenge' الزام کند و نباید مقدار 'code_challenge_method' از نوع 'plain' را بپذیرد. برای Token Request، باید اعتبارسنجی پارامتر 'code_verifier' الزامی باشد.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.4", + "section_name": "OAuth Authorization Server", + "req_id": "V10.4.7", + "req_description": "اگر Authorization Server از Unauthenticated Dynamic Client Registration پشتیبانی می‌کند، ریسک مربوط به Client Applicationهای مخرب را باید کاهش دهد. این کار باید شامل اعتبارسنجی Client Metadata (مانند هر Registered URI)، اطمینان از رضایت کاربر، و هشدار به کاربر پیش از پردازش یک Authorization Request با یک Client Application غیرقابل اعتماد باشد.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.4", + "section_name": "OAuth Authorization Server", + "req_id": "V10.4.8", + "req_description": "Refresh Tokenها باید دارای یک انقضای مطلق (Absolute Expiration) باشند، حتی اگر از Sliding Refresh Token Expiration استفاده شود.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.4", + "section_name": "OAuth Authorization Server", + "req_id": "V10.4.9", + "req_description": "Refresh Tokenها و Reference Access Tokenها باید توسط کاربر مجاز از طریق User Interface Authorization Server قابل ابطال باشند، تا ریسک Clientهای مخرب یا توکن‌های سرقت‌شده کاهش یابد.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.4", + "section_name": "OAuth Authorization Server", + "req_id": "V10.4.10", + "req_description": "Confidential Client باید برای درخواست‌های Backchannel بین Client و Authorization Server، مانند Token Requests، Pushed Authorization Requests (PAR) و Token Revocation Requests، احراز هویت شود.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.4", + "section_name": "OAuth Authorization Server", + "req_id": "V10.4.11", + "req_description": "پیکربندی Authorization Server باید فقط Scopes موردنیاز را به OAuth Client اختصاص دهد.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.4", + "section_name": "OAuth Authorization Server", + "req_id": "V10.4.12", + "req_description": "برای یک Client مشخص، Authorization Server فقط مقدار 'response_mode' را که این Client نیاز دارد، مجاز بداند. برای مثال، با اعتبارسنجی این مقدار توسط Authorization Server در برابر مقادیر مورد انتظار یا با استفاده از Pushed Authorization Request (PAR) یا JWT-secured Authorization Request (JAR).", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.4", + "section_name": "OAuth Authorization Server", + "req_id": "V10.4.13", + "req_description": "Grant Type ‘code’ همواره همراه با Pushed Authorization Requests (PAR) باید استفاده شود.", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.4", + "section_name": "OAuth Authorization Server", + "req_id": "V10.4.14", + "req_description": "Authorization Server باید فقط توکن‌های دسترسی از نوع وابسته به ارسال‌کننده (Proof-of-Possession) صادر می‌کند؛ چه به‌صورت توکن‌های دسترسی مبتنی بر گواهی از طریق TLS دوسویه (mTLS) و چه به‌صورت توکن‌های دسترسی وابسته به DPoP (Demonstration of Proof of Possession).", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.4", + "section_name": "OAuth Authorization Server", + "req_id": "V10.4.15", + "req_description": "برای یک کلاینت سمت‌سرور (که روی دستگاه کاربر نهایی اجرا نمی‌شود)، سرور احراز هویت اطمینان حاصل می‌کند که مقدار پارامترِ authorization_details از بک‌اند کلاینت ارسال شده و کاربر در آن دستکاری نکرده است. به‌عنوان مثال، با الزام به استفاده از درخواست احراز هویت پوش‌شده (PAR) یا درخواست احراز هویت ایمن‌شده با JWT (JAR).", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.4", + "section_name": "OAuth Authorization Server", + "req_id": "V10.4.16", + "req_description": "کلاینت باید از نوع Confidential Client باشد و سرور احراز هویت استفاده از روش‌های قدرتمند احراز هویت کلاینت ـ مبتنی بر رمزنگاری کلید عمومی و مقاوم در برابر حملات replay attacks ـ را الزامی کند؛ مانند TLS دوسویه (tls_client_auth ‎، ‎self_signed_tls_client_auth یا JWT مبتنی بر کلید خصوصی (private_key_jwt).", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.5", + "section_name": "OIDC Client", + "req_id": "V10.5.1", + "req_description": "Client به‌عنوان Relying Partyباید در برابر حملات بازپخش (Replay) توکن ID محافظت شده است. برای مثال، با بررسی اینکه مقدار claim مربوط به nonce در ID Token دقیقاً با مقدار **nonce**ای که در درخواست احراز هویت به OpenID Provider ارسال شده، یکسان باشد(که در OAuth 2 به آن authorization request ارسالی به authorization server گفته می‌شود).", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.5", + "section_name": "OIDC Client", + "req_id": "V10.5.2", + "req_description": "Client باید کاربر را به‌صورت یکتا از ID Token Claims شناسایی کند، معمولاً از ‘sub’ Claim ، که قابل انتساب مجدد به کاربران دیگر نیست (در محدوده‌ی همان Identity Provider).", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.5", + "section_name": "OIDC Client", + "req_id": "V10.5.3", + "req_description": "Client باید تلاش‌های یک Authorization Server مخرب برای جا زدن خود به‌جای یک Authorization Server دیگر از طریق متادیتای Authorization Server را رد می‌کند.کلاینت باید متادیتای Authorization Server را رد کند اگر مقدار issuer URL موجود در متادیتا دقیقاً با issuer URL از پیش پیکربندی‌شده و مورد انتظار کلاینت یکسان نباشد.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.5", + "section_name": "OIDC Client", + "req_id": "V10.5.4", + "req_description": "Client باید اعتبارسنجی کند ID Token برای استفاده توسط همان Client در نظر گرفته شده است (Audience)، با بررسی اینکه ‘aud’ Claim در توکن برابر با مقدار ‘client_id’ مربوط به Client باشد.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.5", + "section_name": "OIDC Client", + "req_id": "V10.5.5", + "req_description": "هنگام استفاده ازOIDC Back-Channel Logout، Relying Party از Denial of Service از طریق Forced Logout و Cross-JWT Confusion در جریان Logout باید جلوگیری کند. Client باید بررسی کند که Logout Token به درستی با مقدار typ آن برابر با logout+jwt باشد ، شامل ‘event’ Claim با نام عضو صحیح باشد و شامل ‘nonce’ Claim نباشد. همچنین توصیه می‌شود Expiration کوتاه باشد (مثلاً ۲ دقیقه).", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.6", + "section_name": "OpenID Provider", + "req_id": "V10.6.1", + "req_description": "OpenID Provider باید فقط مقادیر 'code'، 'ciba'، 'id_token' یا 'id_token code' را برای Response Mode مجاز بداند. توجه داشته باشید که 'code' نسبت به 'id_token code' (که OIDC Hybrid Flow است) ترجیح داده می‌شود و 'token' (هر Implicit Flow) نباید استفاده شود.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.6", + "section_name": "OpenID Provider", + "req_id": "V10.6.2", + "req_description": "OpenID Provider از Denial of Service از طریق Forced Logout جلوگیری کند. این کار با دریافت تأیید صریح از کاربر نهایی یا در صورت وجود، اعتبارسنجی پارامترها در Logout Request (که توسط Relying Party آغاز شده است)، مانند ‘id_token_hint’، انجام می‌شود.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.7", + "section_name": "Consent Management", + "req_id": "V10.7.1", + "req_description": "Authorization Server باید تضمین ‌کند کاربر برای هر درخواست مجوز (Authorization Request) رضایت خود را اعلام کرده است. در صورتی که هویت کلاینت قابل اطمینان نباشد، Authorization Server باید در همه موارد کاربر را به‌صورت صریح برای اعلام رضایت (Consent) راهنمایی و از او تأیید بگیرد.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.7", + "section_name": "Consent Management", + "req_id": "V10.7.2", + "req_description": "زمانی که Authorization Server از کاربر درخواست رضایت (Consent) می‌کند باید اطلاعات کافی و شفافی درباره آنچه کاربر در حال تأیید آن است ارائه ‌دهد. در صورت لزوم، این اطلاعات باید شامل این موارد باشد: ماهیت مجوزهای درخواستی )معمولاً بر اساس scope، resource server و جزئیات مجوز در Rich Authorization Requests – RAR)، هویت برنامه یا اپلیکیشن دریافت‌کننده مجوز و مدت اعتبار این مجوزها.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.7", + "section_name": "Consent Management", + "req_id": "V10.7.3", + "req_description": "کاربر باید بتواند رضایت‌هایی (Consents) را که از طریق Authorization Server صادر کرده است، مشاهده، ویرایش و لغو (Revoke) کند.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.1", + "section_name": "Cryptographic Inventory and Documentation", + "req_id": "V11.1.1", + "req_description": "اطمینان حاصل کنید که یک سیاست مستند برای مدیریت کلیدهای رمزنگاری و چرخه‌عمر کلیدهای رمزنگاری وجود دارد که از یک استاندارد مدیریت کلید مانند NIST SP 800-57 پیروی می‌کند. این باید شامل اطمینان از این موضوع باشد که کلیدها بیش از حد به اشتراک گذاشته نشوند (برای مثال، در مورد Secrets مشترک با بیش از دو موجودیت و در مورد کلیدهای خصوصی با بیش از یک موجودیت).", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.1", + "section_name": "Cryptographic Inventory and Documentation", + "req_id": "V11.1.2", + "req_description": "فهرست اجزاء رمزنگاری باید تهیه و نگهداری ‌شود و به‌صورت منظم به‌روزرسانی گردد و شامل تمام کلیدهای رمزنگاری، الگوریتم‌ها و گواهی‌های دیجیتال مورد استفاده در برنامه باشد. این فهرست همچنین باید مشخص کند که کلیدها در کدام بخش‌های سیستم مجاز یا غیرمجاز به استفاده هستند و چه نوع داده‌هایی می‌توانند یا نمی‌توانند با این کلیدها محافظت شوند.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.1", + "section_name": "Cryptographic Inventory and Documentation", + "req_id": "V11.1.3", + "req_description": "مکانیزم‌های کشف رمزنگاری برای شناسایی تمام موارد استفاده از رمزنگاری در سیستم باید استفاده ‌شود؛ از جمله رمزنگاری (encryption)، هش‌کردن (hashing) و عملیات امضای دیجیتال (signing).", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.1", + "section_name": "Cryptographic Inventory and Documentation", + "req_id": "V11.1.4", + "req_description": "فهرست اجزاء رمزنگاری باید تهیه ‌شود. این فهرست باید شامل یک برنامه مستند باشد که مسیر مهاجرت به استانداردهای جدید رمزنگاری (مانند رمزنگاری پساکوانتومی) را مشخص می‌کند تا امکان واکنش مناسب به تهدیدات آینده فراهم شود.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.2", + "section_name": "Secure Cryptography Implementation", + "req_id": "V11.2.1", + "req_description": "برای عملیات رمزنگاری باید از پیاده‌سازی‌های مورد تأیید (شامل کتابخانه‌ها و پیاده‌سازی‌های سخت‌افزاری) استفاده شود.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.2", + "section_name": "Secure Cryptography Implementation", + "req_id": "V11.2.2", + "req_description": "برنامه با انعطاف‌پذیری رمزنگاری (crypto agility) باید طراحی شده باشد، به‌طوری که الگوریتم‌های تولید اعداد تصادفی، رمزنگاری احراز هویت‌شده، MAC یا هش، طول کلیدها، تعداد دورها، رمزها و حالت‌ها بتوانند در هر زمان مجدداً پیکربندی، ارتقاء یا تعویض شوند تا در برابر شکست‌های رمزنگاری محافظت شوند. به همین ترتیب، باید امکان جایگزینی کلیدها و رمزهای عبور و رمزگذاری مجدد داده‌ها نیز وجود داشته باشد. این امکان ارتقاء بدون وقفه به رمزنگاری پساکوانتومی (PQC) را فراهم می‌کند، زمانی که پیاده‌سازی‌های با اطمینان بالا از طرح‌ها یا استانداردهای تأییدشده PQC به‌طور گسترده در دسترس قرار گیرند.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.2", + "section_name": "Secure Cryptography Implementation", + "req_id": "V11.2.3", + "req_description": "تمام بدویات رمزنگاری (cryptographic primitives) بر اساس الگوریتم، اندازه کلید و پیکربندی، حداقل ۱۲۸ بیت سطح امنیتی را فراهم می‌کنند(2128)، برای مثال، یک کلید ECC با طول ۲۵۶ بیت تقریباً ۱۲۸ بیت امنیت ارائه می‌دهد، در حالی که برای رسیدن به همین سطح امنیت، الگوریتم RSA به کلید ۳۰۷۲ بیتی نیاز دارد.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.2", + "section_name": "Secure Cryptography Implementation", + "req_id": "V11.2.4", + "req_description": "تأیید کنید که تمامی عملیات رمزنگاری زمان ثابت (constant-time) باشند و هیچ عملیات «کوتاه‌شده» (short-circuit) در مقایسه‌ها، محاسبات یا بازگشت‌ها وجود نداشته باشد تا از نشت اطلاعات جلوگیری شود.( مهاجم می‌تواند از همین تفاوت‌های زمانی، از طریق Timing Side-Channel Attack، اطلاعات حساس را استخراج کند.)", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.2", + "section_name": "Secure Cryptography Implementation", + "req_id": "V11.2.5", + "req_description": "تأیید کنید که تمامی ماژول‌های رمزنگاری به‌صورت امن دچار خطا (fail securely) شوند و خطاها به گونه‌ای مدیریت شوند که ایجاد آسیب‌پذیری‌هایی مانند حملات Padding Oracle را ممکن نکنند.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.3", + "section_name": "Encryption Algorithms", + "req_id": "V11.3.1", + "req_description": "از مد‌های بلاک ناامن (مانند ECB) و روش‌های Padding ضعیف (مانند PKCS#1 v1.5) نباید استفاده شود.", + "L": "1" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.3", + "section_name": "Encryption Algorithms", + "req_id": "V11.3.2", + "req_description": "تنها رمزها و مد‌های تأییدشده، مانند AES با GCM باید استفاده شوند.", + "L": "1" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.3", + "section_name": "Encryption Algorithms", + "req_id": "V11.3.3", + "req_description": "داده‌های رمزنگاری‌شده باید با استفاده از ترجیحاً یک روش رمزنگاری احراز هویت‌شده تأییدشده یا با ترکیب یک روش رمزنگاری تأییدشده با یک الگوریتم MAC تأییدشده در برابر تغییرات غیرمجاز محافظت شوند.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.3", + "section_name": "Encryption Algorithms", + "req_id": "V11.3.4", + "req_description": "تأیید کنید که Nonceها، Initialization Vectorها و سایر اعداد یک‌بار مصرف برای بیش از یک جفت کلید رمزنگاری و عنصر داده استفاده نشوند. روش تولید آن‌ها باید متناسب با الگوریتم مورد استفاده باشد.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.3", + "section_name": "Encryption Algorithms", + "req_id": "V11.3.5", + "req_description": "تأیید کنید که هر ترکیبی از یک الگوریتم رمزنگاری و یک الگوریتم MAC در حالت Encrypt-then-MAC عمل کند.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.4", + "section_name": "Hashing and Hash-based Functions", + "req_id": "V11.4.1", + "req_description": "تأیید کنید که تنها توابع هش تأییدشده برای موارد استفاده عمومی رمزنگاری، از جمله امضاهای دیجیتال، HMAC، KDF و تولید بیت تصادفی استفاده شوند. توابع هش غیرمجاز، مانند MD5، نباید برای هیچ هدف رمزنگاری به‌کار گرفته شوند.", + "L": "1" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.4", + "section_name": "Hashing and Hash-based Functions", + "req_id": "V11.4.2", + "req_description": "رمزعبورها با استفاده از یک تابع مشتق‌سازی کلید تأییدشده و پرهزینه محاسباتی (که به آن «تابع هش رمزعبور» نیز گفته می‌شود) ذخیره شوند، و تنظیمات پارامترها بر اساس راهنمایی‌های کنونی پیکربندی شده باشد. این تنظیمات باید تعادل بین امنیت و عملکرد برقرار کنند تا حملات Brute-force برای سطح امنیت مورد نیاز به‌طور کافی دشوار باشد.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.4", + "section_name": "Hashing and Hash-based Functions", + "req_id": "V11.4.3", + "req_description": "توابع هش استفاده‌شده در امضاهای دیجیتال، باید به‌عنوان بخشی از احراز هویت داده یا یکپارچگی داده، در برابر collision مقاوم بوده و طول بیت مناسب داشته باشند. اگر مقاومت در برابر collision لازم باشد، طول خروجی باید حداقل 256 بیت باشد. اگر تنها مقاومت در برابر حملات Second Pre-image لازم باشد، طول خروجی باید حداقل 128 بیت باشد.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.4", + "section_name": "Hashing and Hash-based Functions", + "req_id": "V11.4.4", + "req_description": "برنامه باید هنگام استخراج کلیدهای مخفی از پسوردها از توابع مشتق‌سازی کلید (KDF) تاییدشده با پارامترهای Key Stretching استفاده می‌کند. پارامترهای مورد استفاده باید تعادلی بین امنیت و عملکرد برقرار کنند تا از نفوذ حملات brute-force و به خطر افتادن کلید رمزنگاری تولیدشده جلوگیری شود.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.5", + "section_name": "Random Values", + "req_id": "V11.5.1", + "req_description": "اعداد و رشته‌های تصادفی که قرار است قابل حدس نباشند، باید با استفاده از یک تولیدکننده اعداد شبه‌تصادفی امن رمزنگاری‌شده (CSPRNG) تولید شوند و حداقل 128 بیت انتروپی داشته باشند. توجه داشته باشید که UUIDها این شرط را رعایت نمی‌کنند.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.5", + "section_name": "Random Values", + "req_id": "V11.5.2", + "req_description": "مکانیزم تولید اعداد تصادفی مورد استفاده به‌گونه‌ای طراحی شده باشد که حتی تحت بار سنگین نیز به‌طور امن عمل کند.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.6", + "section_name": "Public Key Cryptography", + "req_id": "V11.6.1", + "req_description": "فقط الگوریتم‌های رمزنگاری و مدهای عملیاتی تأیید شده برای تولید کلید و مقداردهی اولیه، و همچنین برای تولید و تأیید امضاهای دیجیتال باید استفاده می‌شوند. الگوریتم‌های تولید کلید نباید کلیدهای ناامن تولید کنند که در برابر حملات شناخته شده آسیب‌پذیر باشند؛ به‌عنوان مثال، کلیدهای RSA که در برابر Fermat factorization آسیب‌پذیر هستند.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.6", + "section_name": "Public Key Cryptography", + "req_id": "V11.6.2", + "req_description": "برای تبادل کلید از الگوریتم‌های رمزنگاری تأیید شده (مانند Diffie-Hellman) استفاده می‌شود و تمرکز بر این است که مکانیزم‌های تبادل کلید از پارامترهای امن بهره ببرند. این کار از حملات بر فرآیند برقراری کلید جلوگیری می‌کند و مانع حملات مرد میانی (MITM) یا شکست‌های رمزنگاری می‌شود.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.7", + "section_name": "In-Use Data Cryptography", + "req_id": "V11.7.1", + "req_description": "رمزنگاری کامل حافظه (Full Memory Encryption) باید فعال باشد تا داده‌های حساس هنگام استفاده محافظت شوند و دسترسی کاربران یا فرآیندهای غیرمجاز به آن‌ها جلوگیری شود.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.7", + "section_name": "In-Use Data Cryptography", + "req_id": "V11.7.2", + "req_description": "کاهش داده‌ها (data minimization) تضمین می‌کند که حداقل مقدار داده در حین پردازش افشا شود، و اطمینان حاصل شود که داده‌ها بلافاصله پس از استفاده یا در اولین فرصت ممکن رمزنگاری شوند.", + "L": "3" + }, + { + "chapter_id": "V12", + "chapter_name": "Secure Communication", + "section_id": "V12.1", + "section_name": "General TLS Security Guidance", + "req_id": "V12.1.1", + "req_description": "جدیدترین نسخه‌های پیشنهادی پروتکل TLS فعال باشند، مانند TLS 1.2 و TLS 1.3 نسخه‌ی جدیدترین پروتکل TLS باید گزینه‌ی ترجیحی باشد.", + "L": "1" + }, + { + "chapter_id": "V12", + "chapter_name": "Secure Communication", + "section_id": "V12.1", + "section_name": "General TLS Security Guidance", + "req_id": "V12.1.2", + "req_description": "تنها cipher suiteهای پیشنهادی فعال باشند و قوی‌ترین cipher suiteها به‌عنوان گزینه‌ی ترجیحی تنظیم شده باشند. برنامه‌های L3 باید تنها از cipher suiteهایی پشتیبانی کنند که Forward Secrecy را فراهم می‌کنند.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Secure Communication", + "section_id": "V12.1", + "section_name": "General TLS Security Guidance", + "req_id": "V12.1.3", + "req_description": "برنامه باید پیش از استفاده از هویت گواهی برای احراز هویت یا مجوزدهی، اعتبار و مورد اعتماد بودن گواهی‌های کلاینت در mTLS را بررسی و تأیید ‌کند.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Secure Communication", + "section_id": "V12.1", + "section_name": "General TLS Security Guidance", + "req_id": "V12.1.4", + "req_description": "لغو صحیح گواهی‌ها، مانند OCSP ، باید فعال و به‌درستی پیکربندی شده باشد.", + "L": "3" + }, + { + "chapter_id": "V12", + "chapter_name": "Secure Communication", + "section_id": "V12.1", + "section_name": "General TLS Security Guidance", + "req_id": "V12.1.5", + "req_description": "Encrypted Client Hello (ECH) باید در تنظیمات TLS برنامه فعال باشد تا از افشای متادیتای حساس، مانند Server Name Indication (SNI)، در طول فرآیند Handshake TLS جلوگیری شود.", + "L": "3" + }, + { + "chapter_id": "V12", + "chapter_name": "Secure Communication", + "section_id": "V12.2", + "section_name": "HTTPS Communication with External Facing Services", + "req_id": "V12.2.1", + "req_description": "برای تمام ارتباطات بین کلاینت و سرویس‌های مبتنی بر HTTP که در معرض دسترسی خارجی هستند، از TLS باید استفاده ‌شود و هیچ‌گونه بازگشت (fallback) به ارتباطات ناامن یا بدون رمزنگاری انجام نگیرد.", + "L": "1" + }, + { + "chapter_id": "V12", + "chapter_name": "Secure Communication", + "section_id": "V12.2", + "section_name": "HTTPS Communication with External Facing Services", + "req_id": "V12.2.2", + "req_description": "سرویس‌هایی که در معرض دسترسی خارجی قرار دارند از گواهی‌های TLS عمومی و مورد اعتماد استفاده می‌کنند.", + "L": "1" + }, + { + "chapter_id": "V12", + "chapter_name": "Secure Communication", + "section_id": "V12.3", + "section_name": "General Service to Service Communication Security", + "req_id": "V12.3.1", + "req_description": "یک پروتکل رمزنگاری‌شده مانند TLS باید برای تمامی ارتباطات ورودی و خروجی به و از برنامه استفاده شود، از جمله سیستم‌های مانیتورینگ، ابزارهای مدیریت، دسترسی از راه دور و SSH، میان‌افزارها، پایگاه‌های داده، mainframes، سیستم‌های partner یا APIهای خارجی. سرور نباید به پروتکل‌های ناامن یا بدون رمزگذاری بازگردد.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Secure Communication", + "section_id": "V12.3", + "section_name": "General Service to Service Communication Security", + "req_id": "V12.3.2", + "req_description": "کلاینت‌های TLS باید قبل از برقراری ارتباط با سرور TLS، گواهی‌های دریافتی را اعتبارسنجی کنند.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Secure Communication", + "section_id": "V12.3", + "section_name": "General Service to Service Communication Security", + "req_id": "V12.3.3", + "req_description": "TLS یا دیگر مکانیزم‌های مناسب رمزگذاری انتقال باید برای تمامی ارتباطات بین سرویس‌های داخلی مبتنی بر HTTP درون برنامه استفاده شود و ارتباط به حالت‌های ناامن یا بدون رمزگذاری بازنگردد.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Secure Communication", + "section_id": "V12.3", + "section_name": "General Service to Service Communication Security", + "req_id": "V12.3.4", + "req_description": "ارتباطات TLS بین سرویس‌های داخلی باید از گواهی‌های معتبر استفاده کنند. در صورتی که از گواهی‌های داخلی تولیدشده یا Self-Signed استفاده شود، سرویس مصرف‌کننده باید به‌گونه‌ای پیکربندی شود که تنها به CAهای داخلی مشخص و گواهی‌های Self-Signed خاص اعتماد کند.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Secure Communication", + "section_id": "V12.3", + "section_name": "General Service to Service Communication Security", + "req_id": "V12.3.5", + "req_description": "سرویس‌هایی که درون یک سیستم با یکدیگر ارتباط دارند (ارتباطات درون‌سرویسی)، باید از احراز هویت قوی استفاده کنند تا هر نقطه انتهایی (endpoint) تأیید شود. روش‌های احراز هویت قوی، مانند احراز هویت کلاینت TLS، باید به‌کار گرفته شوند تا هویت تضمین شود (با استفاده از زیرساخت کلید عمومی (PKI) و مکانیزم‌هایی که در برابر حملات تکرار (replay attacks) مقاوم هستند). برای معماری‌های میکروسرویس، استفاده از سرویس مش برای ساده‌سازی مدیریت گواهی‌ها و افزایش امنیت در نظر گرفته شود", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.1", + "section_name": "Configuration Documentation", + "req_id": "V13.1.1", + "req_description": "تمامی نیازهای ارتباطی برنامه باید به‌طور کامل مستندسازی شده باشند. این مستندسازی شامل سرویس‌های خارجی که برنامه به آن‌ها وابسته است و همچنین مواردی که کاربر نهایی جهت اتصال به سرویس خارجی مشخص می‌کند باید باشد.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.1", + "section_name": "Configuration Documentation", + "req_id": "V13.1.2", + "req_description": "برای هر سرویسی که برنامه استفاده می‌کند، مستندسازی باید شامل حداکثر تعداد ارتباطات همزمان (مثلاً محدودیت‌های Connection Pool) و نحوه‌ی رفتار برنامه هنگام رسیدن به این حد باشد، از جمله هر مکانیزم بازیابی یا جایگزین، تا از بروز شرایط Denial of Service جلوگیری شود.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.1", + "section_name": "Configuration Documentation", + "req_id": "V13.1.3", + "req_description": "مستندات برنامه باید استراتژی‌های مدیریت منابع را برای هر سیستم یا سرویس خارجی که استفاده می‌کند مشخص کرده باشد (مثلاً پایگاه‌های داده، هندل‌های فایل، رشته‌ها، اتصالات HTTP) این مستندسازی باید شامل این موارد باشد :رویه‌های آزادسازی منابع، تنظیمات تایم‌اوت، مدیریت خطاها، جایی که منطق Retry اعمال می‌شود، شامل محدودیت تعداد Retry، تأخیرها و الگوریتم‌هایBack-off. برای عملیات همزمان درخواست–پاسخ HTTP (Synchronous)، مستندات باید تایم‌اوت کوتاه را الزام کند و یا Retryها را غیرفعال کند یا به‌طور سختگیرانه محدود کند تا از تاخیرهای زنجیره‌ای و هدررفت منابع جلوگیری شود.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.1", + "section_name": "Configuration Documentation", + "req_id": "V13.1.4", + "req_description": "مستندسازی برنامه باید شامل secretهای حیاتی برای امنیت برنامه و همچنین برنامه‌ای برای چرخش آن‌ها باشد( بر اساس مدل تهدید سازمان و نیازهای کسب‌وکار).", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Backend Communication Configuration", + "req_id": "V13.2.1", + "req_description": "رتباطات بین اجزای بک‌اند برنامه که از مکانیزم استاندارد نشست کاربران برنامه پشتیبانی نمی‌کنند، از جمله APIها، میان‌افزارها و لایه‌های داده، باید احراز هویت شده باشند. احراز هویت باید با استفاده از حساب‌های سرویس جداگانه، توکن‌های کوتاه‌مدت یا احراز هویت مبتنی بر گواهی انجام شود و نباید از اعتبارنامه‌های ثابت مانند رمز عبور، کلیدهای API یا حساب‌های مشترک با دسترسی‌های سطح بالا استفاده شود.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Backend Communication Configuration", + "req_id": "V13.2.2", + "req_description": "ارتباطات بین اجزای بک‌اند، از جمله سرویس‌های محلی یا سیستم‌عامل، APIها، میان‌افزارها و لایه‌های داده، با حساب‌هایی باید انجام شود که کمترین سطح دسترسی لازم را دارند.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Backend Communication Configuration", + "req_id": "V13.2.3", + "req_description": "اگر اعتبارنامه‌ای برای احراز هویت سرویس استفاده می‌شود، اعتبارنامه‌ای که توسط مصرف‌کننده استفاده می‌شود، اعتبارنامه پیش‌فرض نباشد (مثلاً root/root یا admin/admin).", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Backend Communication Configuration", + "req_id": "V13.2.4", + "req_description": "یک allowlist برای تعیین منابع یا سیستم‌های خارجی که برنامه مجاز به ارتباط با آن‌ها است باید وجود داشته باشد (مثلاً برای درخواست‌های خروجی، بارگذاری داده یا دسترسی به فایل). این allowlist می‌تواند در لایه برنامه، وب‌سرور، فایروال یا ترکیبی از لایه‌های مختلف پیاده‌سازی شود.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Backend Communication Configuration", + "req_id": "V13.2.5", + "req_description": "وب‌سرور یا سرور برنامه با یک allowlist از منابع یا سیستم‌هایی که سرور می‌تواند به آن‌ها درخواست ارسال کند یا داده‌ها و فایل‌ها را بارگذاری کند پیکربندی شده باشد.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Backend Communication Configuration", + "req_id": "V13.2.6", + "req_description": "در مواقعی که برنامه به سرویس‌های جداگانه متصل می‌شود، پیکربندی مستندسازی‌شده برای هر اتصال رعایت شود، از جمله حداکثر ارتباطات همزمان، رفتار هنگام رسیدن به حداکثر ارتباط مجاز، زمان‌های Timeout اتصال و استراتژی‌های Retry.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.3", + "section_name": "Secret Management", + "req_id": "V13.3.1", + "req_description": "یک راهکار مدیریت secret، مانند Key Vault، برای ایجاد امن، ذخیره، کنترل دسترسی و از بین بردن secret بک‌اند استفاده شود. این secret می‌تواند شامل رمزعبورها، داده‌های رمز نگاری، اطلاعات حساس مربوط به اتصال به پایگاه داده و سیستم‌های شخص ثالث، کلیدها و seedهای توکن‌های زمان‌محور، سایر secretهای داخلی و کلیدهای API باشد. Secret نباید در کد منبع برنامه یا در build artifacts قرار گیرد. برای برنامه‌های L3، این باید شامل راهکاری مبتنی بر سخت‌افزار مانند HSM باشد.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.3", + "section_name": "Secret Management", + "req_id": "V13.3.2", + "req_description": "دسترسی به دارایی‌های secret بر اساس اصل حداقل دسترسی (Least Privilege) رعایت شود.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.3", + "section_name": "Secret Management", + "req_id": "V13.3.3", + "req_description": "تمام عملیات رمزنگاری باید با استفاده از یک ماژول امنیتی ایزوله (مانند Vault یا Hardware Security Module) انجام شود تا مواد کلیدی به‌طور امن مدیریت و محافظت شده و از افشای خارج از ماژول امنیتی جلوگیری شود.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.3", + "section_name": "Secret Management", + "req_id": "V13.3.4", + "req_description": "secretها بر اساس مستندسازی برنامه طوری پیکربندی شوند که منقضی شده و چرخش داده شوند.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Unintended Information Leakage", + "req_id": "V13.4.1", + "req_description": "برنامه باید به‌گونه‌ای مستقر شود که هیچ‌گونه متادیتای کنترل نسخه، از جمله پوشه‌های .git یا .svn، در دسترس نباشد یا به شکلی باشد که این پوشه‌ها نه از بیرون و نه توسط خود برنامه قابل دسترسی نباشند.", + "L": "1" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Unintended Information Leakage", + "req_id": "V13.4.2", + "req_description": "حالت‌های Debug برای تمام اجزا در محیط‌های production باید غیرفعال شده باشند تا از افشای قابلیت‌های دیباگ و نشت اطلاعات جلوگیری شود.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Unintended Information Leakage", + "req_id": "V13.4.3", + "req_description": "وب‌سرورها فهرست‌بندی دایرکتوری‌ها را به کاربر نهایی نباید نمایش دهند مگر اینکه به‌طور صریح مورد نظر باشد.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Unintended Information Leakage", + "req_id": "V13.4.4", + "req_description": "از متد HTTP TRACE در محیط‌های production نباید پشتیبانی شود تا از احتمال نشت اطلاعات جلوگیری شود.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Unintended Information Leakage", + "req_id": "V13.4.5", + "req_description": "مستندسازی‌ها (مانند مستندات APIهای داخلی) و نقاط پایش (Monitoring Endpoints) در دسترس نباشند مگر اینکه به‌طور صریح مورد نظر باشد.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Unintended Information Leakage", + "req_id": "V13.4.6", + "req_description": "تأیید کنید که برنامه اطلاعات نسخه دقیق اجزای backend را افشا نکند.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Unintended Information Leakage", + "req_id": "V13.4.7", + "req_description": "لایه وب باید به‌گونه‌ای پیکربندی شده باشد که فقط فایل‌هایی با پسوندهای مشخص را سرو کند تا از افشای تصادفی اطلاعات، پیکربندی و کد منبع جلوگیری شود.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Data Protection", + "section_id": "V14.1", + "section_name": "Data Protection Documentation", + "req_id": "V14.1.1", + "req_description": "تمامی داده‌های حساس ایجادشده و پردازش‌شده توسط برنامه باید شناسایی شده و بر اساس سطوح حفاظتی طبقه‌بندی شده‌اند. این موضوع شامل داده‌هایی می‌شود که صرفاً کُدگذاری شده‌اند و به‌راحتی قابل بازیابی هستند، مانند رشته‌های Base64 یا محتوای متنی (plaintext) داخل یک JWT. سطوح حفاظتی باید الزامات قوانین و استانداردهای حفاظت از داده و حریم خصوصی که برنامه ملزم به رعایت آن‌هاست را در نظر بگیرند.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Data Protection", + "section_id": "V14.1", + "section_name": "Data Protection Documentation", + "req_id": "V14.1.2", + "req_description": "برای تمامی سطوح حفاظت از داده‌های حساس، مجموعه‌ای مستند از الزامات حفاظتی تعریف شده باشد. این الزامات باید شامل (اما محدود به آن نباشد) موارد زیر باشند: الزامات مرتبط با رمزنگاری کلی، بررسی صحت و یکپارچگی، دوره‌های نگهداری داده، نحوه ثبت داده‌ها در لاگ، کنترل‌های دسترسی به داده‌های حساس در لاگ‌ها، رمزنگاری در سطح پایگاه داده، الزامات مربوط به حریم خصوصی و فناوری‌های تقویت‌کننده حریم خصوصی مورد استفاده، و سایر الزامات مرتبط با محرمانگی.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Data Protection", + "section_id": "V14.2", + "section_name": "General Data Protection", + "req_id": "V14.2.1", + "req_description": "داده‌های حساس باید فقط در بدنه پیام HTTP یا فیلدهای هدر به سرور ارسال شوند، و اینکه URL و query string شامل اطلاعات حساس (مانند API key یا session token) نباشند.", + "L": "1" + }, + { + "chapter_id": "V14", + "chapter_name": "Data Protection", + "section_id": "V14.2", + "section_name": "General Data Protection", + "req_id": "V14.2.2", + "req_description": "برنامه باید از cache شدن داده‌های حساس در اجزای سرور مانند Load Balancer و Application Cache جلوگیری کند، یا اطمینان حاصل شود که داده‌ها پس از استفاده به‌طور ایمن پاک‌سازی می‌شوند.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Data Protection", + "section_id": "V14.2", + "section_name": "General Data Protection", + "req_id": "V14.2.3", + "req_description": "داده‌های حساس تعریف‌شده به طرف‌های غیرقابل اعتماد (مانند User Trackers) نباید ارسال شوند تا از جمع‌آوری ناخواسته داده‌ها خارج از کنترل برنامه جلوگیری شود.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Data Protection", + "section_id": "V14.2", + "section_name": "General Data Protection", + "req_id": "V14.2.4", + "req_description": "کنترل‌های مرتبط با داده‌های حساس شامل رمزنگاری، بررسی صحت و یکپارچگی، نگهداری، نحوه ثبت داده‌ها در لاگ، کنترل‌های دسترسی به داده‌های حساس در لاگ‌ها، حریم خصوصی و فناوری‌های مربوط به حریم خصوصی، مطابق با آنچه در مستندات برای سطح حفاظت مشخص هر داده تعریف شده است، پیاده‌سازی شوند.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Data Protection", + "section_id": "V14.2", + "section_name": "General Data Protection", + "req_id": "V14.2.5", + "req_description": "مکانیزم‌های cache باید طوری پیکربندی شده باشند که تنها پاسخ‌هایی با نوع محتوای مورد انتظار برای آن منبع cache شوند و شامل محتوای حساس یا پویا نباشند. وب‌سرور باید هنگام دسترسی به فایل ناموجود، پاسخ 404 یا 302 برگرداند و نه فایل معتبر دیگر، تا از حملات Web Cache Deception جلوگیری شود.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Data Protection", + "section_id": "V14.2", + "section_name": "General Data Protection", + "req_id": "V14.2.6", + "req_description": "برنامه باید تنها حداقل داده‌های حساس مورد نیاز برای عملکرد برنامه را بازگرداند. برای مثال، تنها برخی از ارقام شماره کارت اعتباری بازگردانده شود و نه شماره کامل. در صورتی که داده کامل لازم باشد، باید در رابط کاربری masked شود مگر اینکه کاربر به‌طور مشخص آن را مشاهده کند.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Data Protection", + "section_id": "V14.2", + "section_name": "General Data Protection", + "req_id": "V14.2.7", + "req_description": "اطلاعات حساس باید تحت طبقه‌بندی دوره‌ای نگهداری داده قرار گرفته باشند، به‌گونه‌ای که داده‌های قدیمی یا غیرضروری به‌طور خودکار، در یک برنامه زمان‌بندی‌شده مشخص، یا براساس نیاز حذف شوند.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Data Protection", + "section_id": "V14.2", + "section_name": "General Data Protection", + "req_id": "V14.2.8", + "req_description": "اطلاعات حساس باید از متادیتای فایل‌های ارسال‌شده توسط کاربر حذف شود، مگر اینکه ذخیره‌سازی آن با رضایت کاربر انجام شود.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Data Protection", + "section_id": "V14.3", + "section_name": "Client-side Data Protection", + "req_id": "V14.3.1", + "req_description": "داده‌های احراز هویت‌شده از حافظه کلاینت، مانند DOM مرورگر، پس از خروج کلاینت یا Session پاک شوند. فیلد هدر Clear-Site-Data در پاسخ سرور می‌تواند در این زمینه مفید باشد، اما کلاینت باید بتواند داده‌ها را حتی زمانی که اتصال به سرور در دسترس نیست در زمان پایان Session (خروج از آن) پاک کند.", + "L": "1" + }, + { + "chapter_id": "V14", + "chapter_name": "Data Protection", + "section_id": "V14.3", + "section_name": "Client-side Data Protection", + "req_id": "V14.3.2", + "req_description": "برنامه باید هدرهای پاسخ HTTP، anti-cach مناسب (مانند Cache-Control: no-store) را تنظیم کند تا داده‌های حساس در مرورگرها cache نشوند.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Data Protection", + "section_id": "V14.3", + "section_name": "Client-side Data Protection", + "req_id": "V14.3.3", + "req_description": "برای اطلاعات بیشتر، همچنین به منابع زیر مراجعه کنید:", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.1", + "section_name": "Secure Coding and Architecture Documentation", + "req_id": "V15.1.1", + "req_description": "مستندات برنامه باید بازه‌های زمانی جهت برطرف سازی آسیب‌پذیری‌ نسخه‌های مؤلفه‌ شخص ثالث (بر اساس ریسک) و همچنین به‌روزرسانی کتابخانه‌ها را به طور کلی تعریف کرده باشد تا ریسک ناشی از این مؤلفه‌ها به حداقل برسد.", + "L": "1" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.1", + "section_name": "Secure Coding and Architecture Documentation", + "req_id": "V15.1.2", + "req_description": "یک کاتالوگ دارایی مانند Software Bill of Materials (SBOM) باید برای تمامی کتابخانه‌های شخص ثالث مورد استفاده نگهداری شود. شامل تایید این که مؤلفه‌ها از مخازن از پیش تعیین‌شده، قابل اعتماد و به‌طور مستمر نگهداری‌شده تهیه شده‌اند.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.1", + "section_name": "Secure Coding and Architecture Documentation", + "req_id": "V15.1.3", + "req_description": "مستندات برنامه باید شامل عملکردهایی که زمان‌بر یا پرمصرف(منابع سیستمی) هستند نیز باشد. این مورد باید شامل روش‌هایی برای جلوگیری از دست‌رفتن دسترس‌پذیری به دلیل استفاده بیش از حد از این عملکردها و همچنین جلوگیری از وضعیتی باشد که پردازش یک پاسخ طولانی‌تر از زمان انتظار مصرف‌کننده شود. تدابیر احتمالی می‌تواند شامل پردازش غیرهمزمان، استفاده از صف‌ها و محدود کردن فرآیندهای موازی برای هر کاربر و هر برنامه باشد.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.1", + "section_name": "Secure Coding and Architecture Documentation", + "req_id": "V15.1.4", + "req_description": "مستندات برنامه باید کتابخانه‌های شخص ثالثی را که به‌عنوان «کامپوننت‌های پرخطر» شناخته می‌شوند، مشخص کرده باشد.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.1", + "section_name": "Secure Coding and Architecture Documentation", + "req_id": "V15.1.5", + "req_description": "مستندات برنامه باید بخش‌هایی از برنامه را که به‌عنوان «عملکرد خطرناک» استفاده می‌شود، مشخص کرده باشد.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.2", + "section_name": "Security Architecture and Dependencies", + "req_id": "V15.2.1", + "req_description": "برنامه باید تنها شامل کامپوننت‌هایی باشد که چارچوب‌های زمانی مستند‌شده برای به‌روزرسانی و رفع آسیب‌پذیری‌ها را نقض نکرده‌باشند.", + "L": "1" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.2", + "section_name": "Security Architecture and Dependencies", + "req_id": "V15.2.2", + "req_description": "برنامه باید بر اساس تصمیمات و استراتژی‌های امنیتی مستندسازی‌شده، تدابیری برای جلوگیری از کاهش دسترس‌پذیری ناشی از عملکردهایی که زمان‌بر یا پرمصرف منابع هستند، پیاده‌سازی کرده باشد.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.2", + "section_name": "Security Architecture and Dependencies", + "req_id": "V15.2.3", + "req_description": "محیط production تنها شامل عملکردهایی می‌باشد که برای اجرای برنامه ضروری هستند و هیچ قابلیت اضافی مانند کدهای تست، نمونه‌کدها و عملکردهای توسعه‌ای در دسترس نمی‌باشد.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.2", + "section_name": "Security Architecture and Dependencies", + "req_id": "V15.2.4", + "req_description": "کامپوننت‌های شخص ثالث و تمام وابستگی‌های انتقالی آن‌ها از مخزن مورد انتظار باید دریافت ‌شوند، چه داخلی و چه منبع خارجی، و ریسک حمله‌ی dependency confusion مدیریت شود.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.2", + "section_name": "Security Architecture and Dependencies", + "req_id": "V15.2.5", + "req_description": "برنامه باید محافظت‌های اضافی را در بخش‌هایی از برنامه که به‌عنوان «عملکرد خطرناک» مستند شده‌اند یا از کتابخانه‌های شخص ثالثی که به‌عنوان «کامپوننت‌های پرریسک» شناخته می‌شوند، پیاده‌سازی می‌کند. این می‌تواند شامل تکنیک‌هایی مانند sandboxing، encapsulation، containerization یا جداسازی در سطح شبکه باشد تا حمله‌کنندگان پس از نفوذ به یک بخش از برنامه، نتوانند به بخش‌های دیگر برنامه منتقل شوند و زمان لازم برای پیشروی آن‌ها افزایش یابد.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.3", + "section_name": "Defensive Coding", + "req_id": "V15.3.1", + "req_description": "برنامه باید تنها زیرمجموعه‌ای از فیلدهای مورد نیاز از یک data object را بازگرداند. به‌عنوان مثال، نباید کل data object بازگردانده شود، زیرا برخی فیلدهای منفرد نباید برای کاربران قابل دسترسی باشند.", + "L": "1" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.3", + "section_name": "Defensive Coding", + "req_id": "V15.3.2", + "req_description": "در جایی که بک‌اند برنامه به URLهای خارجی فراخوانی می‌فرستد، طوری باید پیکربندی شده باشد که تنها در صورت نیاز و منظور مشخص، از تغییر مسیرها (redirects) پیروی کند.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.3", + "section_name": "Defensive Coding", + "req_id": "V15.3.3", + "req_description": "برنامه باید دارای تدابیر مقابله‌ای برای محافظت در برابر حملات mass assignment باشد، به‌طوری که فیلدهای مجاز برای هر کنترلر و اکشن محدود شده باشند؛ به عنوان مثال، نباید بتوان مقداری برای فیلدی وارد یا به‌روزرسانی کرد که قرار نبوده بخشی از آن اکشن باشد.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.3", + "section_name": "Defensive Coding", + "req_id": "V15.3.4", + "req_description": "تمام اجزای proxying و middleware باید آدرس IP اصلی کاربر را به‌درستی منتقل کنند، با استفاده از فیلدهای داده معتبر که توسط کاربر نهایی قابل دستکاری نباشند، و برنامه و وب‌سرور از این مقدار صحیح برای ثبت لاگ و تصمیم‌گیری‌های امنیتی مانند rate limiting استفاده کنند، با در نظر گرفتن اینکه حتی آدرس IP اصلی ممکن است به دلیل IPهای پویا، VPNها یا فایروال‌های سازمانی قابل اعتماد نباشد.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.3", + "section_name": "Defensive Coding", + "req_id": "V15.3.5", + "req_description": "برنامه باید به‌طور صریح اطمینان حاصل کند که variables از نوع صحیح هستند و عملیات‌های مقایسه و comparator به‌صورت دقیق (strict) انجام می‌شوند. این اقدام برای جلوگیری از آسیب‌پذیری‌های type juggling یا type confusion است که ممکن است به دلیل فرضیات نادرست برنامه درباره نوع یک متغیر ایجاد شود.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.3", + "section_name": "Defensive Coding", + "req_id": "V15.3.6", + "req_description": "کد JavaScript باید به‌گونه‌ای نوشته شده باشد که از prototype pollution جلوگیری کند، برای مثال با استفاده از Set() یا Map() به جای object literals.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.3", + "section_name": "Defensive Coding", + "req_id": "V15.3.7", + "req_description": "برنامه باید دارای تدابیر محافظتی در برابر HTTP parameter pollution باشد، به‌ویژه اگر چارچوب برنامه تفاوتی بین منابع پارامترهای درخواست (رشته‌های query، پارامترهای body، کوکی‌ها یا فیلدهای هدر) قائل نشود.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.4", + "section_name": "Safe Concurrency", + "req_id": "V15.4.1", + "req_description": "shared objects در کد multi-threaded (مانند cacheها، فایل‌ها، یا اشیائی که توسط multiple threads دسترسی پیدا می‌کنند) باید به‌صورت ایمن مورد استفاده قرار بگیرند، با استفاده از نوع‌های thread-safe و مکانیزم‌های همگام‌سازی مانند lock یا semaphore تا از race condition و تخریب داده جلوگیری شود.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.4", + "section_name": "Safe Concurrency", + "req_id": "V15.4.2", + "req_description": "بررسی وضعیت یک resource، مانند وجود آن یا دسترسی‌ها،و اقداماتی که به این وضعیت وابسته‌اند، به‌صورت یک عملیات واحد انجام شوند تا از race condition نوع time-of-check to time-of-use (TOCTOU) جلوگیری شود. برای مثال، بررسی اینکه یک فایل وجود دارد قبل از باز کردن آن، یا تأیید دسترسی یک کاربر قبل از اعطای آن.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.4", + "section_name": "Safe Concurrency", + "req_id": "V15.4.3", + "req_description": "باید از قفل‌ها (Locks) به طور یکنواخت استفاده شود تا از گیر کردن (Threads) جلوگیری شود، چه با انتظار برای یکدیگر و چه با تلاش بی‌پایان، و همچنین منطق قفل‌گذاری باید در همان کدی باقی بماند که مسئول مدیریت منبع است؛ این کار تضمین می‌کند که قفل‌ها نمی‌توانند به‌صورت ناخواسته یا خرابکارانه توسط کلاس‌ها یا کدهای بیرونی تغییر داده شوند.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.4", + "section_name": "Safe Concurrency", + "req_id": "V15.4.4", + "req_description": "تأیید کنید که سیاست‌های تخصیص resource از thread starvation جلوگیری می‌کنند، با اطمینان از دسترسی عادلانه به منابع، مانند استفاده از thread pools و اجازه دادن به threads با اولویت پایین‌تر تا در بازه زمانی منطقی پیشرفت کنند.", + "L": "3" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.1", + "section_name": "Security Logging Documentation", + "req_id": "V16.1.1", + "req_description": "فهرستی باید وجود داشته باشد که در آن ثبت وقایع (Logging) انجام‌شده در هر لایه از stack فناوری برنامه، رویدادهای ثبت‌شده، فرمت‌های لاگ، محل ذخیره‌سازی، نحوه استفاده، نحوه کنترل دسترسی به آن‌ها و مدت زمان نگهداری لاگ‌ها مستند شده است.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.2", + "section_name": "General Logging", + "req_id": "V16.2.1", + "req_description": "هر ورودی لاگ باید شامل متادیتای لازم (مانند زمان، مکان، چه کسی و چه چیزی) باشد تا امکان بررسی دقیق خط زمانی هنگام وقوع یک رویداد فراهم شود.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.2", + "section_name": "General Logging", + "req_id": "V16.2.2", + "req_description": "منابع زمانی برای تمام مؤلفه‌های لاگ با هم همگام‌سازی شده‌اند و مهر زمان (timestamp)‌ در متادیتای رویدادهای امنیتی از UTC استفاده ‌کند یا شامل یک اختلاف‌زمان (time zone offset) صریح باشد. استفاده از UTC توصیه می‌شود تا یکپارچگی در سراسر سیستم‌های توزیع‌شده تضمین شود و از بروز سردرگمی در زمان تغییر ساعت تابستانی جلوگیری گردد.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.2", + "section_name": "General Logging", + "req_id": "V16.2.3", + "req_description": "برنامه تنها لاگ‌ها را در فایل‌ها و سرویس‌هایی ذخیره یا ارسال می‌کند که در فهرست مستند لاگ‌ها ثبت شده‌اند.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.2", + "section_name": "General Logging", + "req_id": "V16.2.4", + "req_description": "لاگ‌ها باید توسط پردازشگر لاگی که در حال استفاده است خوانده و همبسته شوند، و ترجیحاً با استفاده از یک فرمت لاگ مشترک این کار انجام گیرد.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.2", + "section_name": "General Logging", + "req_id": "V16.2.5", + "req_description": "هنگام لاگ‌گیری از داده‌های حساس، برنامه باید لاگ گیری را بر اساس سطح حفاظت داده اعمال کند. برای مثال، ممکن است لاگ‌کردن برخی داده‌ها مانند اطلاعات ورود یا جزئیات پرداخت مجاز نباشد. داده‌های دیگر، مانند session token، تنها در صورتی باید لاگ شوند که به‌صورت hash یا masked، چه به‌طور کامل یا جزئی، ثبت شوند.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.3", + "section_name": "Security Events", + "req_id": "V16.3.1", + "req_description": "تمام عملیات احراز هویت باید لاگ‌گیری ‌شوند، از جمله تلاش‌های موفق و ناموفق. همچنین باید متادیتای اضافی، مانند نوع احراز هویت یا عوامل استفاده‌شده، جمع‌آوری شود.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.3", + "section_name": "Security Events", + "req_id": "V16.3.2", + "req_description": "تلاش‌های ناموفق برای مجوزدهی (authorization) باید لاگ‌گیری ‌شوند. برای برنامه‌های L3، این باید شامل لاگ‌گیری تمام تصمیمات مجوزدهی باشد، از جمله ثبت زمانی که داده‌های حساس دسترسی پیدا می‌کنند، بدون آنکه خود داده‌های حساس ثبت شوند.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.3", + "section_name": "Security Events", + "req_id": "V16.3.3", + "req_description": "برنامه باید رویدادهای امنیتی تعریف‌شده در مستندات (ابتدای بخش) را لاگ‌ نماید و همچنین تلاش‌ها برای دور زدن کنترل‌های امنیتی، مانند اعتبارسنجی ورودی، منطق کسب‌وکار و ضد‌خودکارسازی، را نیز ثبت ‌کند.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.3", + "section_name": "Security Events", + "req_id": "V16.3.4", + "req_description": "برنامه باید خطاهای غیرمنتظره و شکست‌های کنترل‌های امنیتی، مانند شکست‌های TLS در بک اند را لاگ ‌کند.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.4", + "section_name": "Log Protection", + "req_id": "V16.4.1", + "req_description": "تمام مؤلفه‌های لاگ‌گیری باید داده‌ها را به‌طور مناسب رمزگذاری ‌کنند تا از حملات log injection جلوگیری شود.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.4", + "section_name": "Log Protection", + "req_id": "V16.4.2", + "req_description": "لاگ‌ها باید در برابر دسترسی غیرمجاز محافظت شده و امکان تغییر آن‌ها وجود نداشته باشد.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.4", + "section_name": "Log Protection", + "req_id": "V16.4.3", + "req_description": "لاگ‌ها به‌صورت امن باید به یک سیستم منطقی جداگانه برای تحلیل، تشخیص، هشدار و ارجاع منتقل شوند. هدف این است که در صورت نفوذ به برنامه، لاگ‌ها به خطر نیفتند.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.5", + "section_name": "Error Handling", + "req_id": "V16.5.1", + "req_description": "هنگام بروز خطاهای غیرمنتظره یا حساس به امنیت، پیامی عمومی به کاربر باید بازگردانده ‌شود، به‌گونه‌ای که هیچ‌گونه اطلاعات حساس داخلی سیستم مانند stack trace، کوئری‌ها، کلیدها و توکن‌های محرمانه افشا نشود.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.5", + "section_name": "Error Handling", + "req_id": "V16.5.2", + "req_description": "برنامه باید هنگام بروز خطا در دسترسی به منابع خارجی همچنان به‌صورت امن عمل نماید، برای مثال با استفاده از الگوهایی مانند circuit breaker یا کاهش تدریجی عملکرد (graceful degradation).", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.5", + "section_name": "Error Handling", + "req_id": "V16.5.3", + "req_description": "برنامه باید به‌صورت امن و کنترل‌شده دچار خطا ‌شود، حتی هنگام وقوع استثنا، و از شرایط fail-open جلوگیری نماید؛ برای مثال، از پردازش تراکنش در صورت بروز خطا در منطق اعتبارسنجی جلوگیری شود.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.5", + "section_name": "Error Handling", + "req_id": "V16.5.4", + "req_description": "یک « last resort» باید تعریف شده باشد که تمامی unhandled exception را مدیریت کند. این کار هم برای جلوگیری از از دست رفتن جزئیات خطا که باید در فایل‌های لاگ ثبت شوند و هم برای اطمینان از این است که خطا باعث از کار افتادن کل فرآیند برنامه و در نتیجه از دست رفتن دسترسی نشود، ضروری است.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.1", + "section_name": "TURN Server", + "req_id": "V17.1.1", + "req_description": "سرویس Traversal Using Relays around NAT (TURN) باید تنها به آدرس‌های IP دسترسی دهد که برای اهداف ویژه رزرو نشده‌اند (مثلاً شبکه‌های داخلی، broadcast، loopback). توجه داشته باشید که این مورد هم برای آدرس‌های IPv4 و هم برای IPv6 صدق می‌کند.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.1", + "section_name": "TURN Server", + "req_id": "V17.1.2", + "req_description": "سرویس Traversal Using Relays around NAT (TURN)، نباید به resource exhaustion آسیب‌پذیر باشد، حتی زمانی که کاربران قانونی تلاش کنند تعداد زیادی پورت روی سرور TURN باز کنند.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Media", + "req_id": "V17.2.1", + "req_description": "کلید مربوط به گواهی Datagram Transport Layer Security (DTLS) بر اساس سیاست مستند مدیریت کلیدهای رمزنگاری مدیریت و محافظت می‌شود.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Media", + "req_id": "V17.2.2", + "req_description": "سرور Media طوری پیکربندی شده باشد که از مجموعه‌های رمزنگاری تاییدشده Datagram Transport Layer Security (DTLS) استفاده کند و از یک پروفایل محافظتی امن برای گسترش DTLS به منظور ایجاد کلیدها برای پروتکل Secure Real-time Transport Protocol (DTLS-SRTP) پشتیبانی نماید.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Media", + "req_id": "V17.2.3", + "req_description": "احراز هویت Secure Real-time Transport Protocol (SRTP) در سرور Media بررسی ‌شود تا از حملات تزریق Real-time Transport Protocol (RTP) جلوگیری شده و این حملات باعث بروز شرایط Denial of Service یا وارد شدن محتوای صوتی یا تصویری ناخواسته به جریان‌های رسانه‌ای نشوند.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Media", + "req_id": "V17.2.4", + "req_description": "سرور Media باید قادر باشد پردازش ترافیک رسانه‌ای ورودی را حتی هنگام مواجهه با بسته‌های Secure Real-time Transport Protocol (SRTP) ناقص یا خراب ادامه دهد.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Media", + "req_id": "V17.2.5", + "req_description": "سرور Media باید قادر باشد پردازش ترافیک رسانه‌ای ورودی را حتی در هنگام دریافت سیلی(flood) از بسته‌های Secure Real-time Transport Protocol (SRTP) از کاربران قانونی ادامه دهد.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Media", + "req_id": "V17.2.6", + "req_description": "سرور Media نسبت به آسیب‌پذیری \"ClientHello Race Condition \" در Datagram Transport Layer Security (DTLS) نباید آسیب‌پذیر نباشد، این کار می‌تواند با بررسی اینکه آیا سرور رسانه به‌صورت عمومی به عنوان آسیب‌پذیر شناخته شده است یا با انجام آزمون Race Condition انجام شود.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Media", + "req_id": "V17.2.7", + "req_description": "مکانیزم‌های ضبط صدا یا تصویر مرتبط با سرور رسانه در هنگام طوفان بسته‌ای (Flood) از پروتکل انتقال بلادرنگ امن (SRTP) توسط کاربران مجاز، باید قادر به ادامه پردازش ترافیک رسانه ورودی است.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Media", + "req_id": "V17.2.8", + "req_description": "گواهی‌نامه امنیت لایه انتقال دیتاگرام (DTLS) باید با ویژگی اثر انگشت (Fingerprint) پروتکل توصیف نشست (SDP) بررسی می‌شود و در صورت شکست در بررسی، جریان رسانه قطع می‌شود تا اصالت جریان رسانه تضمین گردد.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.3", + "section_name": "Signaling", + "req_id": "V17.3.1", + "req_description": "سرور سیگنالینگ باید قادر باشد حتی در جریان flood attack، پیام‌های سیگنالینگ ورودی مشروع را پردازش کند. این باید با اعمال محدودیت نرخ (rate limiting) در سطح سیگنالینگ محقق شود.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.3", + "section_name": "Signaling", + "req_id": "V17.3.2", + "req_description": "سرور سیگنالینگ باید قادر باشد پیام‌های سیگنالینگ مشروع را حتی در مواجهه با پیام‌های سیگنالینگ ناقص یا مخرب که می‌توانند باعث ایجاد شرایط عدم دسترسی (Denial of Service) شوند، پردازش کند. این می‌تواند شامل اعمال اعتبارسنجی ورودی، مدیریت ایمن سرریز عدد صحیح (integer overflow)، جلوگیری از سرریز بافر (buffer overflow) و استفاده از دیگر تکنیک‌های مقاوم مدیریت خطا باشد.", + "L": "2" + } + ] +} diff --git a/5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.flat.legacy.json b/5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.flat.legacy.json new file mode 100644 index 0000000000..b46c4acace --- /dev/null +++ b/5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.flat.legacy.json @@ -0,0 +1,4489 @@ +{ + "requirements": [ + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.1", + "section_name": "ساختار Encoding and Sanitization", + "req_id": "V1.1.1", + "req_description": "ورودی فقط یک‌بار به فرم استاندارد decoded یا unescaped شود، و این تنها زمانی انجام شود که انتظار می‌رود داده واقعاً در آن قالب رمزگذاری‌شده دریافت شده باشد. این فرآیند باید قبل از هرگونه پردازش بعدی روی ورودی انجام شود، و به‌هیچ‌وجه نباید پس از اعتبارسنجی یا پاک‌سازی انجام گیرد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.1", + "section_name": "ساختار Encoding and Sanitization", + "req_id": "V1.1.2", + "req_description": "برنامه فرآیند encode و escape خروجی را به‌عنوان آخرین مرحله انجام می‌دهد؛ به‌گونه‌ای که این عملیات یا دقیقاً پیش از استفاده داده در مفسر مربوطه انجام شود، یا اینکه خود مفسر به‌طور داخلی این کار را انجام دهد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.2", + "section_name": "پیشگیری از تزریق", + "req_id": "V1.2.1", + "req_description": "encoding خروجی برای پاسخ HTTP، سند HTML یا سند XML با زمینه‌ای که داده در آن استفاده می‌شود باید متناسب باشد؛ برای مثال، در رمزگذاری کاراکترهای مربوط به عناصر HTML، صفات HTML، توضیحات HTML، CSS یا فیلدهای هدر HTTP به‌گونه‌ای عمل شود که ساختار پیام یا سند تغییر نکند.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.2", + "section_name": "پیشگیری از تزریق", + "req_id": "V1.2.2", + "req_description": "هنگام ساخت پویا آدرس‌های URL، داده‌های غیرقابل‌اعتماد باید متناسب با زمینه استفاده‌شان رمزگذاری شوند (مثلاً URL Encoding یا base64url برای پارامترهای کوئری یا مسیر) همچنین اطمینان حاصل شود که فقط پروتکل‌های امن در URL مجاز باشند (برای نمونه، استفاده از JavaScript: یا data: ممنوع شود)", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.2", + "section_name": "پیشگیری از تزریق", + "req_id": "V1.2.3", + "req_description": "هنگام تولید پویا محتوای JavaScript (از جملهJSON)، از encoding یا escaping خروجی استفاده شود تا از تغییر ساختار پیام یا سند جلوگیری گردد (و از حملات تزریق JavaScript یا JSON پیشگیری شود).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.2", + "section_name": "پیشگیری از تزریق", + "req_id": "V1.2.4", + "req_description": "در انتخاب داده یا اجرای کوئری‌های پایگاه داده (مانند SQL، HQL، NoSQL ...)، از parameterized queries، ORMها، یا Entity Framework استفاده شود یا به روش‌های دیگر، برنامه در برابر تزریق SQL و سایر حملات تزریقی پایگاه داده ایمن شده باشد. این موضوع هنگام نوشتن stored procedure‌ها نیز صدق می‌کند.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.2", + "section_name": "پیشگیری از تزریق", + "req_id": "V1.2.5", + "req_description": "برنامه در برابر تزریق دستورات سیستم‌عامل (OS command injection) محافظت شده است و در فراخوانی‌های سیستم‌عامل، از کوئری‌های پارامتری‌شده سیستم‌عامل یا Encoding خروجی دستورات سیستم‌عاملی استفاده می‌شود.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.2", + "section_name": "پیشگیری از تزریق", + "req_id": "V1.2.6", + "req_description": "برنامه در برابر آسیب‌پذیری‌های تزریق LDAP محافظت شده است، یا اینکه کنترل‌های امنیتی مشخصی برای جلوگیری از تزریق LDAP پیاده‌سازی شده‌اند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.2", + "section_name": "پیشگیری از تزریق", + "req_id": "V1.2.7", + "req_description": "برنامه در برابر حملات تزریقXPath، به‌وسیله‌ی استفاده از کوئری‌های پارامتری‌شده یا کوئری‌های از پیش‌کامپایل‌شده محافظت شده باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.2", + "section_name": "پیشگیری از تزریق", + "req_id": "V1.2.8", + "req_description": "پردازشگرهای LaTeX به‌صورت امن پیکربندی شده‌اند (برای نمونه با عدم استفاده از گزینه‌ی --shell-escape ) و از فهرست مجاز دستورات (allowlist) برای جلوگیری از حملات تزریق LaTeX استفاده شده است.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.2", + "section_name": "پیشگیری از تزریق", + "req_id": "V1.2.9", + "req_description": "برنامه کاراکترهای ویژه در عبارات Regex را escape می‌کند (معمولاً با استفاده از \\)، تا این کاراکترها به‌اشتباه به‌عنوان متاکاراکتر تفسیر نشوند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.2", + "section_name": "پیشگیری از تزریق", + "req_id": "V1.2.10", + "req_description": "برنامه در برابر حملات تزریق CSV و فرمول (Formula Injection) محافظت شده است. برنامه باید هنگام خروجی‌ گرفتن فایل‌های CSV، از قوانین escape تعیین‌شده در بخش‌های ۲.۶ و ۲.۷ استاندارد RFC 4180 پیروی کند. همچنین، هنگام خروجی گرفتن به فرمت CSV یا سایر فرمت‌های صفحه‌گسترده (مانند XLS، XLSX یا ODF)، اگر کاراکترهای ویژه‌ای مانند '='، '+'، '-'، '@'، \\t (tab) و 0\\ (Null character) در ابتدای مقدار یک فیلد قرار داشته باشند، باید با یک تک‌کوتیشن (') escape شوند.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.3", + "section_name": "پاک‌سازی (Sanitization)", + "req_id": "V1.3.1", + "req_description": "تمام ورودی‌های HTML غیرقابل اعتماد (مثلاً از طریق ویرایشگرهای WYSIWYG یا ابزارهای مشابه)، با استفاده از یک کتابخانه یا قابلیت امن و معتبر sanitization (پاک‌سازی) ‌شوند.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.3", + "section_name": "پاک‌سازی (Sanitization)", + "req_id": "V1.3.2", + "req_description": "برنامه استفاده از تابعeval یا سایر قابلیت‌های اجرای پویا (dynamic) کد، مانند Spring Expression Language (SpEL)، اجتناب ‌کند. در مواردی که استفاده از این قابلیت‌ها اجتناب‌ناپذیر است، ورودی‌های کاربر که در اجرای کد گنجانده می‌شوند باید پیش از اجرا، به‌طور کامل پاک‌سازی (sanitized) شوند.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.3", + "section_name": "پاک‌سازی (Sanitization)", + "req_id": "V1.3.3", + "req_description": "بخش‌های حائز اهمیت که احتمال وقوع حملات ناشی از ورودی‌های کاربر در آنها بالاست؛ باید پیشاپیش عملیاتSanitization جهت اقدامات ایمنی روی داده‌ها انجام شود؛ برای مثال، تنها کاراکترهایی که برای آن محتوا ایمن محسوب می‌شوند مجاز باشند، و ورودی‌های بیش‌از‌حد بلند نیز کوتاه (trim) شوند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.3", + "section_name": "پاک‌سازی (Sanitization)", + "req_id": "V1.3.4", + "req_description": "محتوای اسکریپت‌پذیر (scriptable) فایل‌های SVG که توسط کاربر ارائه می‌شود، مورد اعتبارسنجی یا پاک‌سازی (sanitization) قرار گرفته باشد تا فقط شامل تگ‌ها و ویژگی‌هایی (attributes) باشد که برای برنامه ایمن هستند؛ برای مثال، از درج اسکریپت‌ها و عناصر خطرناک مانند foreignObject جلوگیری شده باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.3", + "section_name": "پاک‌سازی (Sanitization)", + "req_id": "V1.3.5", + "req_description": "برنامه محتوای زبان‌های قالب‌نویسی یا اسکریپت‌پذیر ارائه‌شده توسط کاربر، مانند Markdown، CSS یا استایل‌شیت‌های XSL، BBCode یا موارد مشابه را پاک‌سازی (sanitize) کرده یا غیرفعال کرده باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.3", + "section_name": "پاک‌سازی (Sanitization)", + "req_id": "V1.3.6", + "req_description": "برنامه در برابر حملات جعل درخواست سمت سرور (SSRF) محافظت شده باشد؛ به این صورت که داده‌های غیرقابل اعتماد را در برابر یک لیست مجاز از پروتکل‌ها، دامنه‌ها، مسیرها و پورت‌ها اعتبارسنجی کرده و کاراکترهای بالقوه خطرناک را پیش از استفاده از داده برای فراخوانی سرویس دیگر پاک‌سازی (sanitize) می‌کند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.3", + "section_name": "پاک‌سازی (Sanitization)", + "req_id": "V1.3.7", + "req_description": "برنامه در برابر حملات تزریق قالب (Template Injection) محافظت شده باشد؛ به این صورت که ساخت قالب‌ها بر پایه داده‌های غیرقابل اعتماد مجاز نباشد. در صورتی که هیچ راه‌حل جایگزینی وجود نداشته باشد، هرگونه ورودی غیرقابل اعتماد که به‌صورت پویا در فرآیند ایجاد قالب وارد می‌شود، باید پیش از استفاده یا پاک‌سازی (sanitize) شود یا به‌صورت سخت‌گیرانه اعتبارسنجی (validate) گردد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.3", + "section_name": "پاک‌سازی (Sanitization)", + "req_id": "V1.3.8", + "req_description": "برنامه، ورودی غیرقابل اعتماد را پیش از استفاده در کوئری‌های Java Naming and Directory Interface (JNDI) به‌درستی پاک‌سازی (sanitize) می‌کند و همچنین اطمینان حاصل شود که پیکربندی JNDI به‌گونه‌ای امن انجام شده تا از بروز حملات تزریق JNDI جلوگیری شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.3", + "section_name": "پاک‌سازی (Sanitization)", + "req_id": "V1.3.9", + "req_description": "برنامه، محتوا را پیش از ارسال به memcache پاک‌سازی (sanitize) می‌کند تا از حملات تزریق (injection attacks) جلوگیری شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.3", + "section_name": "پاک‌سازی (Sanitization)", + "req_id": "V1.3.10", + "req_description": "رشته‌های قالب‌بندی (format strings) که ممکن است هنگام استفاده، به‌شکلی ناخواسته یا مخرب تفسیر شوند، پیش از پردازش پاک‌سازی (sanitize) شوند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.3", + "section_name": "پاک‌سازی (Sanitization)", + "req_id": "V1.3.11", + "req_description": "برنامه ورودی‌های کاربر را پیش از ارسال به سامانه‌های ایمیل (مانند SMTP یا IMAP) پاک‌سازی (sanitize) ‌کند تا از حملات تزریق در SMTP یا IMAP جلوگیری شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.3", + "section_name": "پاک‌سازی (Sanitization)", + "req_id": "V1.3.12", + "req_description": "عبارات منظم (Regular Expressions) عاری از اجزایی هستند که باعث بازگشت‌پذیری نمایی (exponential backtracking) می‌شوند، و همچنین ورودی‌های غیرقابل اعتماد به‌درستی پاک‌سازی (sanitize) شوند تا از حملات ReDoS (انکار سرویس با استفاده از عبارات منظم) یا Runaway Regex جلوگیری گردد.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.4", + "section_name": "حافظه، رشته و کد بدون مدیریت (Memory, String, and Unmanaged Code)", + "req_id": "V1.4.1", + "req_description": "برنامه از رشته‌های ایمن از نظر مدیریت حافظه، کپی حافظه‌ای ایمن‌تر و حساب‌گری ایمن‌تر روی اشاره‌گرها استفاده می‌کند تا از سرریز پشته (stack overflow)، سرریز بافر (buffer overflow) یا سرریز حافظه پویای (heap overflow) جلوگیری کرده یا آن‌ها را شناسایی کند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.4", + "section_name": "حافظه، رشته و کد بدون مدیریت (Memory, String, and Unmanaged Code)", + "req_id": "V1.4.2", + "req_description": "از تکنیک‌های اعتبارسنجی علامت (sign validation)، محدوده (range validation) و ورودی (input validation) استفاده شده است تا از بروز سرریز عدد صحیح (integer overflow) جلوگیری شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.4", + "section_name": "حافظه، رشته و کد بدون مدیریت (Memory, String, and Unmanaged Code)", + "req_id": "V1.4.3", + "req_description": "حافظه و منابعی که به‌صورت پویا تخصیص داده شده‌اند، به‌درستی آزاد (release) می‌شوند و همچنین ارجاع‌ها یا اشاره‌گرها (pointers) به حافظه آزادشده حذف یا به null تنظیم می‌شوند تا از اشاره‌گرهای معلق (dangling pointers) و آسیب‌پذیری‌های استفاده پس از آزادسازی (use-after-free) جلوگیری شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.5", + "section_name": "سریال‌زدایی ایمن (Safe Deserialization)", + "req_id": "V1.5.1", + "req_description": "برنامه، XML Parserها را به‌گونه‌ای پیکربندی کرده باشد که از تنظیمات محدودکننده استفاده کنند، و ویژگی‌های ناایمنی مانند resolve کردن موجودیت‌های خارجی (external entities) غیرفعال شده باشند تا از حملات XML External Entity (XXE) جلوگیری شود.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.5", + "section_name": "سریال‌زدایی ایمن (Safe Deserialization)", + "req_id": "V1.5.2", + "req_description": "فرآیند deserialization داده‌های غیرقابل‌اعتماد، با اجرای مدیریت ایمن ورودی‌ها همراه باشد؛ برای مثال، استفاده از لیست مجاز (allowlist) انواع objectها یا محدود کردن انواع تعریف‌شده توسط کلاینت برای جلوگیری از حملات مرتبط با deserialization. همچنین، مکانیزم‌های deserialization که به‌طور صریح به‌عنوان ناایمن شناخته شده‌اند، نباید با داده‌های غیرقابل‌اعتماد مورد استفاده قرار گیرند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Encoding and Sanitization", + "section_id": "V1.5", + "section_name": "سریال‌زدایی ایمن (Safe Deserialization)", + "req_id": "V1.5.3", + "req_description": "Parser های مختلفی که در برنامه برای یک نوع داده مشخص استفاده می‌شوند (برای مثال: Parser های JSON، XML یا URL)، رفتار تحلیلی یکسانی دارند و از مکانیزم یکسانی برای encoding کاراکترها استفاده می‌کنند، تا از بروز مشکلاتی مانند آسیب‌پذیری در سازگاری JSON (JSON Interoperability) یا تفاوت در نحوه تحلیل URI یا مسیر فایل که ممکن است در حملات RFI یا SSRF سوءاستفاده شود، جلوگیری شود.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation and Business Logic", + "section_id": "V2.1", + "section_name": "مستندات اعتبارسنجی و منطق کسب‌وکار ( Validation and Business Logic Documentation)", + "req_id": "V2.1.1", + "req_description": "قوانین اعتبارسنجی ورودی‌های برنامه (مندرج در مستندات برنامه) ‌باید چگونگی بررسی صحت داده‌ها را مطابق با ساختار مورد انتظار مشخص نماید. این ساختار می‌تواند شامل فرمت‌های رایج داده مانند شماره کارت اعتباری، آدرس ایمیل، شماره تلفن یا یک قالب داده‌ای داخلی باشد.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation and Business Logic", + "section_id": "V2.1", + "section_name": "مستندات اعتبارسنجی و منطق کسب‌وکار ( Validation and Business Logic Documentation)", + "req_id": "V2.1.2", + "req_description": "قوانین اعتبارسنجی ورودی‌های برنامه (مندرج در مستندات برنامه) باید چگونگی بررسی سازگاری مناسب بین داده‌‌های ترکیب شده (از نظر مفهومی و متنی) را مشخص نماید؛ مانند تطبیق کدپستی با نام محله.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation and Business Logic", + "section_id": "V2.1", + "section_name": "مستندات اعتبارسنجی و منطق کسب‌وکار ( Validation and Business Logic Documentation)", + "req_id": "V2.1.3", + "req_description": "انتظارات مربوط به محدودیت‌ها و اعتبارسنجی‌های منطق کسب و کار مستند شده باشند؛ این مستندات باید شامل محدودیت‌ها در سطح هر کاربر و محدودیت‌های عمومی در سطح برنامه باشند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation and Business Logic", + "section_id": "V2.2", + "section_name": "اعتبارسنجی ورودی (Input Validation)", + "req_id": "V2.2.1", + "req_description": "ورودی‌ها باید به‌منظور اعمال انتظارات کسب و کار یا عملکردی مرتبط با آن‌ها اعتبارسنجی ‌شوند.این اعتبارسنجی باید یکی از این دو روش زیر را داشته باشد، استفاده از اعتبارسنجی مثبت (Positive Validation) مبتنی بر فهرست مجاز از مقادیر، الگوها یا بازه‌های قابل قبول و تطبیق با ساختار مورد انتظار و محدودیت‌های منطقی، بر اساس قوانین از پیش تعریف‌شده. برای سطح 1 (L1)، تمرکز می‌تواند بر ورودی‌هایی باشد که در تصمیم‌گیری‌های خاص تجاری یا امنیتی استفاده می‌شوند. برای سطح 2 و بالاتر، این اعتبارسنجی باید شامل تمام ورودی‌ها باشد.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation and Business Logic", + "section_id": "V2.2", + "section_name": "اعتبارسنجی ورودی (Input Validation)", + "req_id": "V2.2.2", + "req_description": "برنامه به‌گونه‌ای طراحی شود که اعتبارسنجی ورودی را در لایه‌ قابل اعتمادی از سرویس (Trusted Service Layer) اعمال کند. هرچند اعتبارسنجی سمت کلاینت (Client-side Validation) باعث بهبود تجربه کاربری می‌شود و توصیه می‌گردد، اما نباید به‌عنوان یک کنترل امنیتی اتکا شود.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation and Business Logic", + "section_id": "V2.2", + "section_name": "اعتبارسنجی ورودی (Input Validation)", + "req_id": "V2.2.3", + "req_description": "برنامه باید اطمینان حاصل نماید که ترکیب داده‌های مربوطه با توجه به قوانین از پیش تعریف‌شده معقول و منطقی باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation and Business Logic", + "section_id": "V2.3", + "section_name": "امنیت منطق کسب‌وکار (Business Logic Security)", + "req_id": "V2.3.1", + "req_description": "اطمینان حاصل شود که برنامه فقط جریان‌های منطق تجاری را برای همان کاربر و طبق ترتیب گام‌به‌گام از پیش تعیین شده و مورد انتظار پردازش می‌کند و امکان رد کردن مراحل (Skipping Steps) وجود ندارد.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation and Business Logic", + "section_id": "V2.3", + "section_name": "امنیت منطق کسب‌وکار (Business Logic Security)", + "req_id": "V2.3.2", + "req_description": "اطمینان حاصل شود که محدودیت‌های منطق تجاری مطابق با مستندات برنامه پیاده‌سازی شده‌اند، تا از سوء‌استفاده از نقص‌های منطقی جلوگیری شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation and Business Logic", + "section_id": "V2.3", + "section_name": "امنیت منطق کسب‌وکار (Business Logic Security)", + "req_id": "V2.3.3", + "req_description": "تراکنش‌های سطح منطق کسب‌وکار (business logic) باید به‌گونه‌ای استفاده شوند که یا یک عملیات منطق کسب‌وکار به‌طور کامل با موفقیت انجام شود، یا در صورت بروز خطا، به حالت صحیح قبلی بازگردد(rollback) شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation and Business Logic", + "section_id": "V2.3", + "section_name": "امنیت منطق کسب‌وکار (Business Logic Security)", + "req_id": "V2.3.4", + "req_description": "در منطق کسب‌وکار (business logic)باید از مکانیزم‌های قفل‌گذاری (locking) استفاده شده باشد تا اطمینان حاصل شود که منابع محدود (مانند صندلی‌های سینما یا بازه‌های زمانی تحویل)، قابل رزرو دوباره (double-booked) از طریق دستکاری منطق برنامه نباشند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation and Business Logic", + "section_id": "V2.3", + "section_name": "امنیت منطق کسب‌وکار (Business Logic Security)", + "req_id": "V2.3.5", + "req_description": "اطمینان حاصل شود که جریان‌های منطق کسب و کاری با ارزش بالا نیازمند تایید چند کاربره (Multi-user Approval) هستند تا از اقدامات غیرمجاز یا تصادفی جلوگیری شود. این موارد می‌تواند شامل – اما نه محدود به – انتقال‌های مالی بزرگ، تایید قرارداد‌ها، دسترسی به اطلاعات طبقه‌بنده شده، یا غیرفعال‌سازی‌های ایمنی در محیط‌های تولید صنعتی باشد.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation and Business Logic", + "section_id": "V2.4", + "section_name": "مقابله با خودکارسازی (Anti-automation)", + "req_id": "V2.4.1", + "req_description": "کنترل‌های ضد خودکارسازی (Anti-Automation) در سیستم پیاده‌سازی شده باشند تا از سوءاستفاده‌هایی مانند فراخوانی بیش از حد توابع برنامه جلوگیری شود؛ چرا که این نوع حملات می‌توانند منجر به استخراج غیرمجاز داده‌ها، تولید داده‌های زائد، مصرف کامل سهمیه‌ها، عبور از محدودیت‌های نرخ (Rate Limit)، ایجاد اختلال در سرویس (DoS) یا استفاده بیش از حد از منابع گران‌قیمت شوند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Validation and Business Logic", + "section_id": "V2.4", + "section_name": "مقابله با خودکارسازی (Anti-automation)", + "req_id": "V2.4.2", + "req_description": "بررسی کنید که جریان‌های منطق کسب‌وکار (Business Logic Flows) به گونه‌ای طراحی شده باشند که نیازمند زمان‌بندی واقعی انسان باشند، و از ارسال سریع و غیرطبیعی تراکنش‌ها (Transaction Submissions) جلوگیری کنند.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.1", + "section_name": "مستندسازی امنیت رابط کاربری وب ( Web Frontend Security Documentation)", + "req_id": "V3.1.1", + "req_description": "در مستندات برنامه باید ویژگی‌های امنیتی مربوط به مرورگری که برنامه را اجرا میکند مشخص شده باشد (نظیر استفاده از HTTPS، پشتیبانی از HTTP Strict Transport Security (HSTS)، اجرای Content Security Policy (CSP) و سایر مکانیزم‌های امنیتی مرتبط با HTTP). همچنین در مستندات باید مشخص شود مرورگر در صورت عدم دسترسی به این ویژگی‌ها چه رفتاری باید داشته باشد. (برای مثال: نمایش هشدار به کاربر یا ممانعت از دسترسی به برنامه).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.2", + "section_name": "تفسیر ناخواسته محتوا (Unintended Content Interpretation)", + "req_id": "V3.2.1", + "req_description": "کنترل‌های امنیتی متناسب با مرورگر‌ها در هنگام پردازش پاسخ‌های HTTP به منظور جلوگیری از پردازش محتوا یا عملکرد مربوط به آن در شرایط زمینه‌‌ای نادرست باید بکار‌گرفته شود. (برای مثال، زمانی که یک APIیا یک فایل بارگذاری‌شده توسط کاربر یا هر منبع دیگری به‌طور مستقیم درخواست می‌شود).کنترل‌های ممکن می‌توانند شامل این موارد باشند: عدم پردازش محتوا مگر در صورت وجود هدرهای متناسب با درخواست‌های HTTP (مانند ‎Sec-Fetch-*) به منظور اطمیان از صحیح بودن پردازش محتوا یا عملکرد مربوط به . استفاده از عبارت sandbox در هدر Content-Security-Policy یا استفاده از نوعattachment در هدر Content-Disposition .", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.2", + "section_name": "تفسیر ناخواسته محتوا (Unintended Content Interpretation)", + "req_id": "V3.2.2", + "req_description": "اطمینان حاصل شود که محتوایی که برای نمایش به‌صورت متن طراحی شده نه برای پردازش به صورتHTML ، با استفاده از توابع امن نظیر CreateTextNode یا textContent به منظور جلوگیری از اجرای ناخواسته محتوایی مانند HTML یا JavaScript پردازش ‌شود.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.2", + "section_name": "تفسیر ناخواسته محتوا (Unintended Content Interpretation)", + "req_id": "V3.2.3", + "req_description": "برنامه هنگام استفاده از جاوااسکریپت سمت کاربر (Client-Side JavaScript)، با استفاده از اعلام متغیرها به‌صورت صریح، انجام بررسی نوع به‌صورت سخت‌گیرانه، اجتناب از ذخیره‌سازی متغیرهای سراسری بر روی شیء document، و پیاده‌سازی ایزولاسیون فضای نام (namespace isolation)، از وقوع DOM Clobbering جلوگیری می‌کند.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.3", + "section_name": "پیکربندی کوکی (Cookie Setup)", + "req_id": "V3.3.1", + "req_description": "اطمینان حاصل شود که کوکی‌ها دارای ویژگی ‘Secure’ هستند. در صورتی که از پیشوند ‘__Host-’ برای نام کوکی استفاده نمی‌شود، باید پیشوند__Secure- در نام کوکی لحاظ شده باشد.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.3", + "section_name": "پیکربندی کوکی (Cookie Setup)", + "req_id": "V3.3.2", + "req_description": "اطمینان حاصل شود که مقدار ویژگی SameSite برای هر کوکی، متناسب با هدف آن کوکی تنظیم شده باشد تا میزان آسیب‌پذیری در برابر حملات فریب سمت کلاینت نظیر CSRF کاهش یابد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.3", + "section_name": "پیکربندی کوکی (Cookie Setup)", + "req_id": "V3.3.3", + "req_description": "اطمینان حاصل شود که کوکی‌ها از پیشوند __Host- در نام خود استفاده می‌کنند، مگر در مواردی که کوکی به‌طور مشخص برای اشتراک‌گذاری بین چند دامنه (Hosts) طراحی شده باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.3", + "section_name": "پیکربندی کوکی (Cookie Setup)", + "req_id": "V3.3.4", + "req_description": "اطمینان حاصل شود که اگر مقدار کوکی (مثلاً توکن نشست) نباید برای اسکریپت‌های سمت کلاینت در دسترس باشد، ویژگی HttpOnly باید برای آن کوکی فعال شده باشد، و همچنین مقدار کوکی (مثلاً همان توکن نشست) تنها از طریق هدر Set-Cookie به کلاینت ارسال شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.3", + "section_name": "پیکربندی کوکی (Cookie Setup)", + "req_id": "V3.3.5", + "req_description": "اطمینان حاصل شود که حداکثر مجموع نام و مقدار کوکی از ۴۰۹۶ بایت تجاوز نکند.کوکی‌هایی که بیش از این مقدار باشند توسط مرورگر ذخیره نخواهند شد، و بنابراین در درخواست‌ها ارسال نمی‌شوند؛ موضوعی که ممکن است باعث شود عملکردهایی از برنامه که به آن کوکی وابسته‌اند، غیرفعال یا مختل شوند.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.4", + "section_name": "هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers)", + "req_id": "V3.4.1", + "req_description": "اطمینان حاصل شود که در تمامی پاسخ‌های HTTP، هدر Strict-Transport-Security وجود دارد تا سیاست HSTS (HTTP Strict Transport Security) اعمال شود. حداقل مقدار max-age باید برابر با یک سال باشد. برای برنامه‌های سطح 2 (L2) و بالاتر، این سیاست باید برای تمام زیردامنه‌ها (subdomains) نیز اعمال شود.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.4", + "section_name": "هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers)", + "req_id": "V3.4.2", + "req_description": "اطمینان حاصل شود که هدرAccess-Control-Allow-Origin مربوط به (CORS)، دارای یک مقدار ثابت و مشخص توسط برنامه باشد یا اگر هدر Origin در درخواست مورد استفاده قرار می گیرد باید با فهرستی از مبدأهای مورد اعتماد (Allowlist) اعتبارسنجی شود. در صورتی که استفاده از مقدار * در Access-Control-Allow-Origin تنظیم شده باشد، اطمینان حاصل شود که هیچ اطلاعات حساسی در پاسخ قرار ندارد.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.4", + "section_name": "هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers)", + "req_id": "V3.4.3", + "req_description": "اطمینان حاصل شود که تمامی پاسخ‌های HTTP شامل هدر Content-Security-Policy باشند تا ریسک اجرای اسکریپت‌های مخرب (مانند (JavaScript مخرب کاهش یابد. دستورهای object-src 'none' و base-uri 'none' الزامی هستند .برای برنامه‌های سطح 3 (L3)، باید سیاست CSP به‌صورت اختصاصی برای هر پاسخ(Per-response Policy) و مبتنی بر nonce یا hash تعریف شده باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.4", + "section_name": "هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers)", + "req_id": "V3.4.4", + "req_description": "اطمینان حاصل شود که تمامی پاسخ‌ها شامل هدر X-Content-Type-Options: nosniff باشند، این (هدر) به مرورگرها دستور می‌دهد که برای پاسخ دریافتی از Content Sniffing یا حدس‌زدن نوع محتوا (MIME Type Guessing) استفاده نکنند و آن‌ها را ملزم می‌کند که نوع محتوای واقعی را دقیقاً مطابق مقدار هدر Content-Type در درخواست/پاسخ در نظر بگیرند.برای مثال، پاسخ به یک درخواست برای یک فایل استایل (CSS) تنها در صورتی پذیرفته می‌شود که مقدار Content-Type در پاسخ 'text/css' باشد.این کار همچنین امکان استفاده از قابلیت مسدودسازی خواندن منابع از مبدا متفاوت Cross-Origin Read Blocking یا (CORB) توسط مرورگر را فراهم می‌سازد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.4", + "section_name": "هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers)", + "req_id": "V3.4.5", + "req_description": "برنامه باید (وب‌سایت یا اپلیکیشن) یک \"Referrer Policy\" (سیاست ارجاع) تنظیم کرده باشد تا از نشت اطلاعات حساس از طریق هدر HTTP به نام Referer به سرویس‌های شخص ثالث جلوگیری شود. این کار را می‌توان از طریق هدر پاسخ HTTP به نام Referrer-Policy یا با استفاده از ویژگی‌هایی در عناصر HTML انجام داد.اطلاعات حساس ممکن است شامل مسیر (Path) و داده‌های کوئری (Query) در آدرس URL باشد، و در مورد برنامه‌های داخلی و غیرعمومی، حتی نام میزبان (hostname) نیز می‌تواند جزو اطلاعات حساس محسوب شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.4", + "section_name": "هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers)", + "req_id": "V3.4.6", + "req_description": "برنامه باید از frame-ancestors در هدر Content-Security-Policy (CSP) برای تمام پاسخ‌های HTTP استفاده کند،تا به‌صورت پیش‌فرض، اجازه‌ی نمایش سایت در قالب iframe داده نشود، و فقط در صورت نیاز، نمایش منابع خاص (specific resources) در iframe مجاز باشد.به این نکته توجه کنید که هدر X-Frame-Options با اینکه هنوز توسط برخی مرورگرها پشتیبانی می‌شود، اما قدیمی (obsolete) است و نباید به آن تکیه کرد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.4", + "section_name": "هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers)", + "req_id": "V3.4.7", + "req_description": "هدر Content-Security-Policy (CSP) باید شامل یک آدرس برای گزارش (Report violation) باشد.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.4", + "section_name": "هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers)", + "req_id": "V3.4.8", + "req_description": "تمام پاسخ‌های HTTP که باعث رندر (نمایش) یک سند می‌شوند مانند (پاسخ‌هایی با نوع محتوا (text/html باید شامل هدر Cross-Origin-Opener-Policy با دستور same-origin یا same-origin-allow-popups باشند (بنا به نیاز). این کار از حملاتی جلوگیری می‌کند که از دسترسی مشترک به اشیای Window سوءاستفاده می‌کنند، مانند حملات tabnabbing و frame counting.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.5", + "section_name": "تفکیک مبدا توسط مرورگر (Browser Origin Separation)", + "req_id": "V3.5.1", + "req_description": "برنامه باید از مکانیزم Preflight در CORS برای جلوگیری از درخواست‌های cross-origin به عملکردهای حساس استفاده نمی‌کند، این درخواست‌ها به‌گونه‌ای اعتبارسنجی شوند که فقط از مبدأ اصلی برنامه ارسال شده باشند. این اعتبارسنجی می‌تواند با استفاده از توکن‌های (anti- forgery tokens) یا الزام به ارسال هدرهای HTTP اضافی انجام شود که در لیست هدرهای مجاز CORS (CORS-safelisted) قرار ندارند. این اقدام برای محافظت در برابر حملات جعل درخواست از طریق مرورگر، که با نام CSRF (Cross-Site Request Forgery) شناخته می‌شوند، ضروری است.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.5", + "section_name": "تفکیک مبدا توسط مرورگر (Browser Origin Separation)", + "req_id": "V3.5.2", + "req_description": "اگر برنامه برای جلوگیری از استفاده غیرمجاز cross-origin از عملکردهای حساس، به مکانیزم Preflight در CORS متکی است، باید امکان فراخوانی این عملکردها با درخواست‌هایی که باعث ایجاد Preflight نمی‌شوند، وجود نداشته باشد. برای تحقق این هدف ممکن است لازم باشد مقدار هدرهای Origin و Content-Type بررسی شوند یا از هدر اضافی استفاده شود که در لیست هدرهای مجاز CORS قرار ندارد.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.5", + "section_name": "تفکیک مبدا توسط مرورگر (Browser Origin Separation)", + "req_id": "V3.5.3", + "req_description": "برنامه باید درخواست‌های HTTP که به عملکردهای حساس از متدهای مناسب مانند POST، PUT، PATCH یا DELETE استفاده می‌کنند، و نه از متدهایی که در استاندارد HTTP به‌عنوان \"ایمن\" تعریف شده‌اند، مانند GET، HEAD یا .OPTIONS به عنوان جایگزین یا مکمل، می‌توان از بررسی سخت‌گیرانه هدرهای Sec-Fetch-* استفاده کرد تا اطمینان حاصل شود که درخواست از منبع نامناسبی مثل بارگذاری تصویر، ناوبری صفحه یا فراخوانی cross-origin ارسال نشده است.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.5", + "section_name": "تفکیک مبدا توسط مرورگر (Browser Origin Separation)", + "req_id": "V3.5.4", + "req_description": "برنامه‌های مجزا باید روی نام‌های دامنه (hostname) متفاوت میزبانی شده‌اند تا از محدودیت‌های ارائه‌شده توسط (Same-Origin Policy) بهره‌مند شوند. این شامل کنترل تعامل اسناد یا اسکریپت‌های بارگذاری‌شده از یک مبدأ با منابع مبدأ دیگر و اعمال محدودیت بر اساس دامنه برای کوکی‌ها می‌شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.5", + "section_name": "تفکیک مبدا توسط مرورگر (Browser Origin Separation)", + "req_id": "V3.5.5", + "req_description": "برنامه باید پیام‌های دریافت‌شده از طریق رابط postMessage در صورتی که مبدأ پیام مورد اعتماد نباشد یا ساختار پیام نامعتبر باشد، نادیده گرفته می‌شوند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.5", + "section_name": "تفکیک مبدا توسط مرورگر (Browser Origin Separation)", + "req_id": "V3.5.6", + "req_description": "هیچ‌کجای برنامه از قابلیت JSONP استفاده نشود تا از حملات Cross-Site Script Inclusion (XSSI) جلوگیری شود.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.5", + "section_name": "تفکیک مبدا توسط مرورگر (Browser Origin Separation)", + "req_id": "V3.5.7", + "req_description": "داده‌هایی که نیاز به احراز هویت دارند، در پاسخ‌های مربوط به منابع اسکریپتی(مانند فایل‌های (JavaScript نباید قرار بگیرند تا از حملات XSSI جلوگیری شود.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.5", + "section_name": "تفکیک مبدا توسط مرورگر (Browser Origin Separation)", + "req_id": "V3.5.8", + "req_description": "اطمینان حاصل کنید که منابع احراز هویت‌شده (مانند تصاویر، ویدیوها، اسکریپت‌ها و سایر اسناد) فقط در مواقعی که هدف آن است، قابل بارگذاری یا جاسازی توسط کاربر باشند. این کار را می‌توان با اعتبارسنجی دقیق هدرهای HTTP مانند Sec-Fetch-* انجام داد تا اطمینان حاصل شود که درخواست از یک منبع غیرمجاز ارسال نشده است، یا با تنظیم هدر Cross-Origin-Resource-Policy برای محدود کردن دسترسی مرورگر به محتوا.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.6", + "section_name": "یکپارچگی منابع خارجی (External Resource Integrity)", + "req_id": "V3.6.1", + "req_description": "منابع سمت کلاینت مانند کتابخانه‌های جاوااسکریپت، فایل‌های CSS، یا فونت‌های وب، تنها در صورتی به‌صورت خارجی (مثلاً از طریق شبکه تحویل محتوا - CDN) میزبانی شوند که آن منابع: استاتیک (تغییرناپذیر) باشند، نسخه‌گذاری‌شده (versioned) باشند و یکپارچگی آن‌ها با استفاده از Subresource Integrity (SRI) بررسی شود. اگر این موارد امکان‌پذیر نیست، باید برای هر منبع، یک تصمیم امنیتی مستند وجود داشته باشد که توجیه کند چرا این منبع به این شکل بارگذاری می‌شود.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.7", + "section_name": "سایر ملاحظات امنیتی مرورگر (Other Browser Security Considerations)", + "req_id": "V3.7.1", + "req_description": "برنامه صرفا باید از فناوری‌های سمت کلاینتی استفاده ‌کند که همچنان پشتیبانی می‌شوند و از نظر امنیتی قابل اعتماد هستند.مثال‌هایی از فناوری‌هایی که این الزام را برآورده نمی‌کنند عبارتند از NSAPI Plugins،Flash،Shockwave،ActiveX،Silverlight،NACL و Appletهای جاوا در سمت کلاینت", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.7", + "section_name": "سایر ملاحظات امنیتی مرورگر (Other Browser Security Considerations)", + "req_id": "V3.7.2", + "req_description": "برنامه فقط زمانی کاربر را به دامنه‌ها یا hostnameهای دیگر (که تحت کنترل برنامه نیستند) به صورت خودکار هدایت می‌کند، که آن مقصد در یک فهرست مجاز (allowlist) قرار داشته باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.7", + "section_name": "سایر ملاحظات امنیتی مرورگر (Other Browser Security Considerations)", + "req_id": "V3.7.3", + "req_description": "برنامه باید هنگام ریدایرکت کاربر به یک URL که خارج از کنترل برنامه است، یک پیام هشدار نشان می‌دهد و امکان لغو آن را به کاربر می‌دهد.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.7", + "section_name": "سایر ملاحظات امنیتی مرورگر (Other Browser Security Considerations)", + "req_id": "V3.7.4", + "req_description": "باید دامنه اصلی برنامه، مثلاً (site.tld) به فهرست preload عمومی HSTS اضافه شده باشد.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "امنیت رابط کاربری وب (Web Frontend Security)", + "section_id": "V3.7", + "section_name": "سایر ملاحظات امنیتی مرورگر (Other Browser Security Considerations)", + "req_id": "V3.7.5", + "req_description": "اگر مرورگر کاربر از ویژگی‌های امنیتی مورد انتظار برنامه پشتیبانی نمی‌کند، برنامه رفتار مناسبی داشته باشد، مثل هشدار دادن به کاربر یا مسدود کردن دسترسی.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API and Web Service", + "section_id": "V4.1", + "section_name": "Generic Web Service Security", + "req_id": "V4.1.1", + "req_description": "اطمینان حاصل شود که در هر پاسخ HTTP که شامل Body می باشد، هدر Content-Type وجود داشته باشد که نوع آن، با محتوای پاسخ دریافتی از سرور مطابقت داشته باشد. این هدر باید شامل پارامتر charset نیز باشد تا رمزگذاری کاراکتر ایمن (مانند UTF-8 یا ISO-8859-1) را مشخص کند. این مقادیر باید مطابق با استاندارد IANA Media Types باشند؛ برای مثال، انواعی مانند \"text/، /+xml\" و \"/xml\" را در بر می‌گیرند.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API and Web Service", + "section_id": "V4.1", + "section_name": "Generic Web Service Security", + "req_id": "V4.1.2", + "req_description": "اطمینان حاصل شود که تنها نقاط پایانی که برای استفاده کاربر نهایی از طریق مرورگر طراحی شده‌اند (User-Facing Endpoints) به‌صورت خودکار از HTTP به HTTPS هدایت ‌شوند، سایر سرویس‌ها یا نقاط پایانی نباید (ریدایرکت شفاف، Transparent Redirect) داشته باشند. این اقدام برای جلوگیری از وضعیتی است که در آن یک کلاینت به اشتباه درخواست‌های رمزنگاری‌نشده (HTTP) ارسال می‌کند، اما چون این درخواست‌ها به‌طور خودکار به HTTPS ریدایرکت می‌شوند، نشت احتمالی داده‌های حساس پنهان خواهد ماند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API and Web Service", + "section_id": "V4.1", + "section_name": "Generic Web Service Security", + "req_id": "V4.1.3", + "req_description": "اطمینان حاصل شود که هدرهای HTTP که در برنامه استفاده می شود و توسط یک لایه واسطه، مانند یکload balancer ، یک پروکسی وب یا یک سرویس backend-for-frontend تنظیم شده است نمی‌تواند توسط کاربر نهایی بازنویسی شود. هدرهای نمونه ممکن است شامل X-Real-IP، X-Forwarded-* یا X-User-ID باشند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API and Web Service", + "section_id": "V4.1", + "section_name": "Generic Web Service Security", + "req_id": "V4.1.4", + "req_description": "اطمینان حاصل شود که فقط متدهای HTTP که صریحاً توسط برنامه یا API آن پشتیبانی می‌شوند (از جمله OPTIONS در درخواست‌های preflight) می‌توانند مورد استفاده قرار گیرند و متدهای استفاده نشده مسدود شوند.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API and Web Service", + "section_id": "V4.1", + "section_name": "Generic Web Service Security", + "req_id": "V4.1.5", + "req_description": "اطمینان حاصل شود که برای درخواست‌ها یا تراکنش‌هایی که بسیار حساس هستند یا از چندین سامانه عبور می‌کنند، از امضاهای دیجیتال در سطح پیام استفاده شود تا اطمینان امنیتی بیشتری علاوه بر محافظت‌های سطح انتقال (مانند TLS) فراهم گردد.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API and Web Service", + "section_id": "V4.2", + "section_name": "HTTP Message Structure Validation", + "req_id": "V4.2.1", + "req_description": "اطمینان حاصل شود که تمامی اجزای برنامه )از جمله لود بالانسرها، فایروال‌ها و سرورهای اپلیکیشن( مرزهای پیام‌های HTTP ورودی را با استفاده از مکانیزم مناسب نسخه های HTTP تعیین می‌کنند تا از حملات HTTP request smuggling جلوگیری شود. در HTTP/1.x اگر هدر Transfer-Encoding وجود داشته باشد، هدر Content-Length باید مطابق RFC 2616 نادیده گرفته شود. در مقابل، هنگام استفاده از HTTP/2 یا HTTP/3، اگر هدر Content-Length وجود داشته باشد، گیرنده باید اطمینان حاصل کند که این مقادیر با طول فریم‌های DATA سازگار می‌باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API and Web Service", + "section_id": "V4.2", + "section_name": "HTTP Message Structure Validation", + "req_id": "V4.2.2", + "req_description": "اطمینان حاصل شود که هنگام تولید پیام‌های HTTP، هدر Content-Length با طول محتوایی که توسط چارچوب‌بندی پروتکل HTTP تعیین می‌شود، تداخل نداشته باشد تا از حملات request smuggling جلوگیری شود.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API and Web Service", + "section_id": "V4.2", + "section_name": "HTTP Message Structure Validation", + "req_id": "V4.2.3", + "req_description": "اطمینان حاصل شود برنامه، پیام‌های HTTP/2 یا HTTP/3 با هدرهای connection-specific مانند Transfer-Encoding را به منظور جلوگیری از حملات response splitting یا header injection ارسال یا قبول نمی کند.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API and Web Service", + "section_id": "V4.2", + "section_name": "HTTP Message Structure Validation", + "req_id": "V4.2.4", + "req_description": "اطمینان حاصل شود برنامه تنها درخواست های HTTP/2 and HTTP/3 که هدرها و مقادیر آن شامل هیچ توالی CR (\\r), LF (\\n), CRLF (\\r\\n) نباشد را می پذیرد تا از حملات header injection جلوگیری کند.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API and Web Service", + "section_id": "V4.2", + "section_name": "HTTP Message Structure Validation", + "req_id": "V4.2.5", + "req_description": "اطمینان حاصل کنید که اگر برنامه (Frontend or Backend) اقدام به ساخت و ارسال درخواست‌های HTTP می کند از مکانیزم های validation ، sanitization یا سایر مکانیزم‌ها استفاده کند تا از ایجاد URIها (مانند فراخوانیAPI ) یا فیلدهای هدر درخواست HTTP (مانند Authorization یا( Cookie که بیش از حد مجاز، طولانی هستند، جلوگیری شود که منجر به عدم پذیرش درخواست توسط مولفه دریافت کننده(هر بخشی از زیرساخت یا سامانه که درخواست HTTP را دریافت و پردازش می‌کند) شود. عدم رعایت این موضوع می تواند باعث وقوع حمله Danial of Service شود، ارسال یک درخواست بیش از حد طولانی (مانند یک فیلد هدر کوکی طولانی) باعث می شود سرور همواره با وضعیت خطا پاسخ دهد.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API and Web Service", + "section_id": "V4.3", + "section_name": "GraphQL", + "req_id": "V4.3.1", + "req_description": "اطمینان حاصل شود یکی از مکانیزم ها برای جلوگیری از حملات انکار سرویس (DoS) درلایه GraphQL یا لایه داده استفاده شده است. این مکانیزم‌ها عبارتند از استفاده از فهرست مجاز کوئری‌ها ( Query Allowlist)، محدودسازی عمق کوئری‌ها (Depth Limiting)،محدودسازی تعداد یا حجم داده(Amount Limiting) و تحلیل هزینه کوئری (Query Cost Analysis). این اقدامات، به منظور مقابله با درخواست های پیچیده، تو در تو یا کوئری‌های پرهزینه که می توانند موجب مصرف بیش از حد منابع و اختلال در سرویس دهی شوند ضروری است.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API and Web Service", + "section_id": "V4.3", + "section_name": "GraphQL", + "req_id": "V4.3.2", + "req_description": "اطمینان حاصل شود که قابلیت Introspection در GraphQL در محیط تولید (Production) غیرفعال شده‌است، مگرAPI مبتنی بر GraphQL به‌صورت صریح برای استفاده توسط اشخاص یا سامانه های ثالث (Third Parties) طراحی شده باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API and Web Service", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.1", + "req_description": "اطمینان حاصل شود که تمامی ارتباطات WebSocket از طریق پروتکل TLS( WSS) برقرار می‌شوند.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API and Web Service", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.2", + "req_description": "اطمینان حاصل شود که در هنگام Handshake اولیه‌ی HTTP برای WebSocket، مقدار هدر Origin بررسی ‌شود و در صورتی که با لیستی از مبداهای مجاز (allowed origins) برای برنامه مطابقت داشته باشد، اتصال پذیرفته می‌شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API and Web Service", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.3", + "req_description": "اطمینان حاصل شود که در صورتی که امکان استفاده از مکانیزم استاندارد مدیریت نشست برنامه وجود نداشته باشد، از توکن‌های اختصاصی (Duplicated Tokens) برای این منظور استفاده شود که با الزامات امنیتی مدیریت نشست به طور کامل مطابقت داشته باشند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API and Web Service", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.4", + "req_description": "اطمینان حاصل شود که توکن‌های اختصاصی مدیریت نشست WebSocket در هنگام انتقال از یک نشست HTTPS موجود به کانالWebSocket، از طریق نشست HTTPS احراز هویت‌شده قبلی، دریافت یا اعتبارسنجی می‌شوند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "File Handling", + "section_id": "V5.1", + "section_name": "File Handling Documentation", + "req_id": "V5.1.1", + "req_description": "مستندات نوع فایل‌های مجاز، پسوندهای مورد انتظار، و حداکثر اندازه هر فایل (شامل اندازه پس از استخراج) را برای هر قابلیت بارگذاری مشخص کرده باشد. همچنین، مستندات توضیح می‌دهند چگونه فایل‌ها برای دانلود و پردازش توسط کاربران نهایی ایمن‌سازی می‌شوند؛ برای مثال، رفتار برنامه هنگام شناسایی یک فایل مخرب چگونه خواهد بود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "File Handling", + "section_id": "V5.2", + "section_name": "File Upload and Content", + "req_id": "V5.2.1", + "req_description": "برنامه تنها فایل‌هایی با حجم مشخص، که قادر به پردازش آن است را می‌پذیرد تا از کاهش عملکرد یا حملات انکار سرویس (DoS) جلوگیری شود.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "File Handling", + "section_id": "V5.2", + "section_name": "File Upload and Content", + "req_id": "V5.2.2", + "req_description": "هنگام پذیرش فایل توسط برنامه، چه به صورت مستقیم و چه به صورت یک آرشیو مانند فایلzip پسوند فایل با پسوند مورد انتظار مطابقت داشته باشد و اعتبارسنجی محتوای فایل صورت گیرد تا تایید شود محتوای فایل با نوع تعریف‌شده توسط پسوند هم‌خوانی دارد. این فرآیند می تواند شامل موارد بررسی بایت‌های ابتدایی (magic bytes) فایل، انجام بازنویسی تصاویر برای حذف ساختارها و اطلاعات ناخواسته و استفاده از کتابخانه‌های تخصصی برای اعتبارسنجی کامل محتوای فایل باشد اما محدود به آنها نیست. در سطح L1، کافی است این بررسی‌ها فقط بر روی فایل‌هایی که در فرآیندهای تجاری یا امنیتی خاص استفاده می‌شوند متمرکز باشد. در سطح L2 و بالاتر، این فرآیند باید برای تمامی فایل‌های ورودی برنامه اجرا شود.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "File Handling", + "section_id": "V5.2", + "section_name": "File Upload and Content", + "req_id": "V5.2.3", + "req_description": "برنامه باید پیش از استخراج محتوای فایل‌های فشرده (مانند zip، gz، docx، odt)، آن‌ها را از نظر حداکثر اندازه مجاز پس از استخراج و همچنین حداکثر تعداد فایل‌های درون آن بررسی می‌کند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "File Handling", + "section_id": "V5.2", + "section_name": "File Upload and Content", + "req_id": "V5.2.4", + "req_description": "برنامه فضای مشخصی برای اندازه فایل و تعداد فایل‌های مجاز برای هر کاربر اعمال می‌کند تا از این طریق، یک کاربر نتواند با بارگذاری تعداد زیادی فایل یا فایل‌های بیش از حد بزرگ، فضای ذخیره‌سازی را پر کند.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "File Handling", + "section_id": "V5.2", + "section_name": "File Upload and Content", + "req_id": "V5.2.5", + "req_description": "برنامه اجازه بارگذاری فایل‌های فشرده‌ که حاوی لینک های نمادین (symlinks) هستند را نمی‌دهد، مگر اینکه این رفتار به طور مشخص مورد نیاز باشد. در چنین شرایطی باید یک فهرست مجاز (allowlist) از مسیرها یا فایل‌هایی که می تواند برای آنها لینک نمادین ایجاد شود، اعمال و اعتبارسنجی گردد.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "File Handling", + "section_id": "V5.2", + "section_name": "File Upload and Content", + "req_id": "V5.2.6", + "req_description": "برنامه تصاویر بارگذاری‌شده با اندازه پیکسلی بزرگ‌تر از حد مجاز را رد کند تا از حملات pixel flood attacks جلوگیری شود.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "File Handling", + "section_id": "V5.3", + "section_name": "File Storage", + "req_id": "V5.3.1", + "req_description": "فایل هایی که از ورودی های غیرمعتبر بارگذاری‌ یا تولید می شوند و در پوشه های عمومی قرار می گیرند، هنگام دسترسی مستقیم از طریق یک درخواست HTTP، به عنوان کداجرایی سمت سرور اجرا نشوند.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "File Handling", + "section_id": "V5.3", + "section_name": "File Storage", + "req_id": "V5.3.2", + "req_description": "هنگام ایجاد مسیرهای فایل برای عملیات مختلف، به جای استفاده از نام فایل‌های ارسال شده توسط کاربر، از داده‌های تولید شده داخلی یا منابع مورد اعتماد استفاده شود. و در صورتی که استفاده از نام فایل‌ها یا متادیتای ارسالی توسط کاربر ضروری باشد، می بایست validation و Sanitization اعمال شود. این کار برای جلوگیری از حملاتی مانند Path Traversal، Local or Remote File Inclusion(LFI, RFI) و Server-Side Request Forgery(SSRF) می‌باشد.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "File Handling", + "section_id": "V5.3", + "section_name": "File Storage", + "req_id": "V5.3.3", + "req_description": "پردازش فایل‌های سمت سرور، مانند استخراج فایل‌های فشرده، اطلاعات مسیر ارائه شده توسط کاربر را نادیده می‌گیرد تا از آسیب‌پذیری‌هایی مانند zip slip جلوگیری شود.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "File Handling", + "section_id": "V5.4", + "section_name": "File Download", + "req_id": "V5.4.1", + "req_description": "برنامه نام فایل ارسال‌شده توسط کاربر را چه در قالب JSON، JSONP یا پارامتر URL، اعتبارسنجی می‌کند یا نادیده می‌گیرد، و در پاسخ HTTP، نام فایل را به‌طور صریح در فیلد Content-Disposition هدر مشخص می‌نماید.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "File Handling", + "section_id": "V5.4", + "section_name": "File Download", + "req_id": "V5.4.2", + "req_description": "نام‌های فایل‌های ارائه شده (مانند فیلدهای هدر پاسخ HTTP یا پیوست‌های ایمیل)، به‌درستی encoded یا sanitized شده‌اند (مطابق RFC 6266)، تا ساختار سند حفظ شده و از حملات تزریق جلوگیری شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "File Handling", + "section_id": "V5.4", + "section_name": "File Download", + "req_id": "V5.4.3", + "req_description": "فایل‌های دریافت شده از منابع غیرقابل اعتماد توسط آنتی ویروس اسکن شود تا از ارائه محتوای مخرب شناخته‌شده جلوگیری شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.1", + "section_name": "Authentication Documentation", + "req_id": "V6.1.1", + "req_description": "مستندات برنامه، نحوه استفاده از کنترل هایی مانند محدودیت نرخ (Rate Limit)، مقابله با خودکارسازی (Anti-Automation) و پاسخ تطبیقی (Adaptive Response) را برای دفاع در برابر حملاتی مانند Credential Stuffing و حملات Password Brute Force به وضوح تعریف کرده باشد. مستندات باید به‌وضوح نحوه پیکربندی این کنترل‌ها را تشریح کرده و نشان دهند که چگونه از قفل شدن مخرب حساب‌های کاربری جلوگیری می‌شود.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.1", + "section_name": "Authentication Documentation", + "req_id": "V6.1.2", + "req_description": "یک لیست از کلمات خاص مرتبط با زمینه سازمانی‌ (Context-Specific) مستندسازی شود تا از بکارگیری آنها در رمزهای عبور جلوگیری شد. این فهرست می‌تواند شامل نام سازمان، نام محصول، شناسه سامانه، نام کد پروژه، نام دپارتمان یا نقش های سازمانی و موارد مشابه باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.1", + "section_name": "Authentication Documentation", + "req_id": "V6.1.3", + "req_description": "در صورت وجود مسیرهای متعدد احراز هویت در برنامه کاربردی، تمامی این مسیرها به همراه کنترل‌های امنیتی و سطح قدرت احراز هویت مورد نیاز، مستندسازی شده‌اند. لازم است این کنترل‌ها به‌صورت یکسان و سازگار در تمامی مسیرهای احراز هویت اجرا شوند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.2", + "section_name": "Password Security", + "req_id": "V6.2.1", + "req_description": "کلمات عبور تنظیم شده توسط کاربر حداقل ۸ کاراکتر طول داشته باشد. هرچند حداقل ۱۵ کاراکتر به شدت توصیه می‌شود.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.2", + "section_name": "Password Security", + "req_id": "V6.2.2", + "req_description": "کاربران قادر به تغییر گذرواژه خود باشند.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.2", + "section_name": "Password Security", + "req_id": "V6.2.3", + "req_description": "هنگام تغییر کلمه عبور، گذرواژه فعلی و گذرواژه جدید توسط کاربر تکمیل شود.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.2", + "section_name": "Password Security", + "req_id": "V6.2.4", + "req_description": "کلمات عبوری که در حین ثبت‌نام حساب کاربری یا تغییر کلمه عبور ارسال می شوند با یک فهرست در دسترس از حداقل ۳۰۰۰ کلمه عبور رایج که ( با سیاست‌های کلمه عبور برنامه (مانند حداقل طول) سازگاری دارند) بررسی شوند.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.2", + "section_name": "Password Security", + "req_id": "V6.2.5", + "req_description": "کلمات عبور با هر ترکیبی قابل استفاده باشند، بدون اینکه قوانینی برای محدودکردن نوع کاراکترهای مجاز وجود داشته باشد. نباید هیچ‌گونه الزامی برای تعداد حداقل کاراکترهای حروف بزرگ یا کوچک، اعداد یا کاراکترهای خاص وجود داشته باشد.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.2", + "section_name": "Password Security", + "req_id": "V6.2.6", + "req_description": "فیلدهای ورودی کلمه عبور از نوع \"type=password\" استفاده می‌کنند تا ورودی‌ها پنهان شوند. برنامه‌ها می‌توانند به کاربر این امکان را بدهند که موقتاً کلمه عبور کامل یا آخرین کاراکتر تایپ شده را مشاهده کند.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.2", + "section_name": "Password Security", + "req_id": "V6.2.7", + "req_description": "عملکرد \"چسباندن\" (paste)، ابزارهای کمکی گذرواژه مرورگر و مدیریت‌کننده‌های گذرواژه خارجی مجاز باشند.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.2", + "section_name": "Password Security", + "req_id": "V6.2.8", + "req_description": "برنامه کلمه عبور کاربر را دقیقاً همانطور که از کاربر دریافت شده است، بدون هیچ گونه تغییراتی مانند کوتاه‌سازی(truncation) یا تبدیل حروف بزرگ و کوچک (case transformation)، بررسی کند.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.2", + "section_name": "Password Security", + "req_id": "V6.2.9", + "req_description": "استفاده از گذرواژه‌هایی با حداقل طول ۶۴ کاراکتر مجاز باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.2", + "section_name": "Password Security", + "req_id": "V6.2.10", + "req_description": "کلمه عبور کاربر تا زمانی که مشخص شود که به خطر افتاده است یا کاربر آن را تغییر دهد، معتبر باقی بماند. برنامه نباید الزام به تغییر دوره‌ای گذرواژه‌ها را داشته باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.2", + "section_name": "Password Security", + "req_id": "V6.2.11", + "req_description": "فهرست مستند شده ای از کلمات خاص مرتبط با زمینه‌ سازمانی برای جلوگیری از ایجاد کلمات عبور آسان قابل حدس، مورد استفاده قرار گیرد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.2", + "section_name": "Password Security", + "req_id": "V6.2.12", + "req_description": "کلمات عبور وارد شده در حین ثبت‌نام حساب کاربری یا تغییر کلمه عبور با مجموعه‌ای از کلمات عبور افشا شده بررسی ‌شوند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.3", + "section_name": "General Authentication Security", + "req_id": "V6.3.1", + "req_description": "کنترل‌های لازم برای جلوگیری از حملاتی مانند Credential Stuffing و password brute force طبق مستندات امنیتی برنامه پیاده‌سازی شوند.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.3", + "section_name": "General Authentication Security", + "req_id": "V6.3.2", + "req_description": "حساب‌های کاربری پیش‌فرض (مانند \"admin\"، \"root\" یا \"sa\") در برنامه وجود نداشته باشند یا غیرفعال شده باشند.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.3", + "section_name": "General Authentication Security", + "req_id": "V6.3.3", + "req_description": "برای دسترسی به برنامه، از یک مکانیزم احراز هویت چندعاملی (MFA) یا ترکیبی از مکانیزم‌های احراز هویت تک‌عاملی استفاده شود. برای سطح L3، حداقل یکی از عوامل احراز هویت باید مبتنی بر سخت‌افزار باشد در برابر حملات فیشینگ، مقاومت در برابر نفوذ و جعل هویت را فراهم کند، در حالی که با اقدام آگاهانه کاربر (مانند فشردن دکمه روی کلید سخت‌افزاری FIDO یا تلفن همراه) قصد کاربر برای احراز هویت را نیز تأیید نماید. هرگونه تسهیل یا تعدیل در این الزام، مستلزم ارائه دلایل مستند و مجموعه‌ای جامع از کنترل‌های جبرانی است.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.3", + "section_name": "General Authentication Security", + "req_id": "V6.3.4", + "req_description": "تأیید کنید که در صورت وجود مسیرهای متعدد احراز هویت در برنامه، هیچ مسیر احراز هویتِ مستندسازی‌نشده‌ای وجود نداشته باشد و کنترل‌های امنیتی و سطح قدرت احراز هویت در تمامی مسیرها به‌صورت یکسان و سازگار اعمال شوند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.3", + "section_name": "General Authentication Security", + "req_id": "V6.3.5", + "req_description": "کاربران از تلاش‌های مشکوک برای احراز هویت (موفق یا ناموفق) مطلع ‌شوند. این اطلاع‌رسانی می‌تواند شامل تلاش برای احراز هویت از موقعیت مکانی یا کلاینت غیرمعمول، احراز هویت ناقص (تنها موفقیت یکی از عوامل)، تلاش برای احراز هویت پس از یک دوره طولانی عدم فعالیت، یا احراز هویت موفق پس از چندین تلاش ناموفق باشد.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.3", + "section_name": "General Authentication Security", + "req_id": "V6.3.6", + "req_description": "ایمیل به‌عنوان مکانیزم احراز هویت، چه به‌صورت تک‌عاملی و چه به‌عنوان یکی از عوامل احراز هویت چندعاملی، استفاده نمی‌شود.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.3", + "section_name": "General Authentication Security", + "req_id": "V6.3.7", + "req_description": "کاربران پس از به‌روزرسانی اطلاعات احراز هویت خود، مانند بازنشانی گذرواژه یا تغییر نام کاربری یا آدرس ایمیل، مطلع شوند.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.3", + "section_name": "General Authentication Security", + "req_id": "V6.3.8", + "req_description": "با توجه به پیام‌های خطا، کدهای پاسخ HTTP یا تفاوت در زمان پاسخ‌دهی، نتوان کاربران معتبر را از طریق تلاش‌های ناموفق احراز هویت شناسایی کرد. همچنین، عملکردهای ثبت‌نام و بازیابی گذرواژه نیز باید از این نوع افشای اطلاعات محافظت شده باشند.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.4", + "section_name": "Authentication Factor Lifecycle and Recovery", + "req_id": "V6.4.1", + "req_description": "کلمه عبور اولیه یا کدهای فعال‌سازی تولید شده توسط سیستم، به‌صورت تصادفی و ایمن تولید ‌شوند، با سیاست فعلی رمز عبور مطابقت دارند، و پس از مدت زمان کوتاهی یا پس از اولین استفاده منقضی می‌شوند. این رمزهای اولیه نباید به عنوان رمز عبور بلندمدت مورد استفاده قرار گیرند.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.4", + "section_name": "Authentication Factor Lifecycle and Recovery", + "req_id": "V6.4.2", + "req_description": "راهنمای کلمه عبور یا احراز هویت مبتنی بر دانش (که به عنوان \"سؤالات امنیتی\" شناخته می‌شوند) در سیستم وجود ندارد.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.4", + "section_name": "Authentication Factor Lifecycle and Recovery", + "req_id": "V6.4.3", + "req_description": "فرآیند امنی برای بازنشانی کلمه عبور فراموش‌شده پیاده‌سازی شده است که هیچ‌یک از مکانیزم‌های احراز هویت چندعاملی فعال را دور نزند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.4", + "section_name": "Authentication Factor Lifecycle and Recovery", + "req_id": "V6.4.4", + "req_description": "در صورت از دست رفتن یکی از عوامل احراز هویت چندعاملی، فرآیند اثبات هویت با همان سطحی که در زمان ثبت‌نام انجام شده است، اجرا شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.4", + "section_name": "Authentication Factor Lifecycle and Recovery", + "req_id": "V6.4.5", + "req_description": "دستورالعمل‌های تمدید مکانیزم‌های احراز هویت دارای تاریخ انقضا برای کاربران به موقع ارسال می‌شود تا پیش از انقضای مکانیزم فعلی فرصت کافی برای تمدید وجود داشته باشد، و در صورت لزوم، یادآورهای خودکار نیز تنظیم و ارسال شده باشند.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.4", + "section_name": "Authentication Factor Lifecycle and Recovery", + "req_id": "V6.4.6", + "req_description": "کاربران ادمین می‌توانند فرآیند بازنشانی کلمه عبور را برای کاربران عادی آغاز کنند، اما اجازه تغییر مستقیم یا انتخاب رمز عبور برای کاربر را ندارند. این کنترل برای جلوگیری از دسترسی ادمین به رمز عبور کاربران طراحی شده است.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.5", + "section_name": "General Multi-factor authentication requirements", + "req_id": "V6.5.1", + "req_description": "Lookup Secrets درخواست‌ها یا کدهای احراز هویت خارج از باند (Out-of-Band) و رمزهای یکبار مصرف مبتنی بر زمان (TOTP) تنها یک‌بار قابل استفاده باشند و پس از استفاده موفق، مجدداً قابل استفاده نباشند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.5", + "section_name": "General Multi-factor authentication requirements", + "req_id": "V6.5.2", + "req_description": "در صورت ذخیره‌سازی Lookup Secrets در سمت Backend برنامه، اگر مقدار آنتروپی کمتر از ۱۱۲ بیت باشند (معادل ۱۹ کاراکتر تصادفی الفبایی-عددی یا ۳۴ رقم تصادفی)، باید با یک الگوریتم تایید شده برای ذخیره رمز عبور و با استفاده از یک Salt تصادفی ۳۲ بیتی هش شوند. در صورتی که آنتروپی کد ۱۱۲ بیت یا بیشتر باشد، می‌توان از یک تابع هش استاندارد برای ذخیره سازی استفاده کرد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.5", + "section_name": "General Multi-factor authentication requirements", + "req_id": "V6.5.3", + "req_description": "Lookup Secrets کدهای احراز هویت خارج از باند (out of band) و تولید رمزهای یکبار مصرف مبتنی بر زمان(TOTP) همگی با استفاده از یک تولیدکننده عدد شبه تصادفی ‌رمزنگاری‌شده (CSPRNG) تولید شده باشند تا از تولید مقادیر قابل پیش‌بینی جلوگیری شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.5", + "section_name": "General Multi-factor authentication requirements", + "req_id": "V6.5.4", + "req_description": "Lookup Secrets و کدهای احراز هویت خارج از باند (out of band) حداقل دارای ۲۰ بیت آنتروپی باشند (معمولاً ۴ کاراکتر تصادفی الفبایی-عددی یا ۶ رقم تصادفی برای رسیدن به این میزان آنتروپی کافی است).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.5", + "section_name": "General Multi-factor authentication requirements", + "req_id": "V6.5.5", + "req_description": "درخواست‌ها، کدها یا توکن‌های احراز هویت خارج از باند (Out-of-Band) و همچنین رمزهای عبور یک‌بار مصرف مبتنی بر زمان (TOTP) دارای طول عمر مشخص باشند. حداکثر طول عمر برای درخواست‌های خارج از باند باید ۱۰ دقیقه و برای TOTP حداکثر ۳۰ ثانیه باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.5", + "section_name": "General Multi-factor authentication requirements", + "req_id": "V6.5.6", + "req_description": "امکان لغو (Revoke) هر عامل احراز هویت، از جمله دستگاه‌های فیزیکی، در صورت سرقت یا مفقود شدن وجود داشته باشد.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.5", + "section_name": "General Multi-factor authentication requirements", + "req_id": "V6.5.7", + "req_description": "مکانیزم‌های احراز هویت بیومتریک فقط به‌عنوان عامل دوم و در کنار یکی از عوامل «چیزی که در اختیار دارید» یا «چیزی که کاربر می داند» مورد استفاده قرار می‌گیرند.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.5", + "section_name": "General Multi-factor authentication requirements", + "req_id": "V6.5.8", + "req_description": "اعتبارسنجی رمزهای یک‌بار مصرف مبتنی بر زمان (TOTP) بر اساس منبع زمانی از یک سرویس قابل اعتماد انجام می‌شود و نه بر اساس زمان ارائه‌شده توسط کلاینت یا منابع غیرقابل اعتماد.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.6", + "section_name": "Out-of-Band authentication mechanisms", + "req_id": "V6.6.1", + "req_description": "مکانیزم‌های احراز هویت مبتنی بر شبکه تلفن عمومی (PSTN) برای ارسال رمزهای یک‌بار مصرف (OTP) از طریق تماس تلفنی یا پیامک تنها در صورتی که شماره تلفن قبلا اعتبارسنجی شده باشد، یا روش‌های جایگزین قوی‌تر (رمزهای عبور یکبار مصرف مبتنی بر زمان) در دسترس باشند ارائه می‌شوند و سرویس‌دهنده باید کاربران را از ریسک‌های امنیتی این روش‌ها مطلع سازد. برای اپلیکیشن‌های سطح L3، استفاده از تماس تلفنی و پیامک به‌عنوان گزینه، مجاز نیست.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.6", + "section_name": "Out-of-Band authentication mechanisms", + "req_id": "V6.6.2", + "req_description": "درخواست‌ها، کدها یا توکن‌های احراز هویت خارج از باند (Out-of-Band) به درخواست احراز هویت اصلی که برای آن تولید شده‌اند متصل باشند و قابل استفاده برای درخواست‌های قبلی یا بعدی نباشند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.6", + "section_name": "Out-of-Band authentication mechanisms", + "req_id": "V6.6.3", + "req_description": "مکانیزم‌های احراز هویت خارج از باند (Out-of-Band) مبتنی بر کد، در برابر حملات brute force از طریق اعمال کنترل محدودیت نرخ (Rate Limiting) محافظت شوند. همچنین، استفاده از کدی با حداقل ۶۴ بیت آنتروپی (Entropy)مدنظر قرار گیرد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.6", + "section_name": "Out-of-Band authentication mechanisms", + "req_id": "V6.6.4", + "req_description": "در صورت استفاده از Push Notifications جهت احراز هویت چند عاملی، محدودیت نرخ (Rate Limiting) به منظور جلوگیری از حملات Push Bombing اعمال شده باشد. استفاده از تطبیق عدد Matching) Number) نیز می‌تواند به کاهش این ریسک کمک کند.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.7", + "section_name": "Cryptographic authentication mechanism", + "req_id": "V6.7.1", + "req_description": "گواهینامه‌های مورد استفاده برای تأیید ادعاهای احراز هویت رمزنگاری‌شده به گونه‌ای ذخیره شوند که از تغییر یا دستکاری آن‌ها محافظت شود.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.7", + "section_name": "Cryptographic authentication mechanism", + "req_id": "V6.7.2", + "req_description": "مقدار چالش (Challenge Nonce) حداقل ۶۴ بیت طول داشته باشد و از نظر آماری یکتا باشد یا حداقل در طول عمر دستگاه رمزنگاری منحصر به فرد باقی بماند.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.8", + "section_name": "Authentication with an Identity Provider", + "req_id": "V6.8.1", + "req_description": "اگر برنامه از چند ارائه‌دهنده هویت (IdP) پشتیبانی می‌کند، امکان جعل هویت کاربر از طریق یک ارائه‌دهنده هویت دیگر وجود نداشته باشد (برای مثال، با استفاده از شناسه کاربری یکسان). مکانیسم استاندارد برای جلوگیری از این تهدید، این است که برنامه، کاربران را با استفاده از ترکیب شناسه IdP (به‌عنوان فضای نام یا (namespace و شناسه کاربر در آن، IdP ثبت و شناسایی کند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.8", + "section_name": "Authentication with an Identity Provider", + "req_id": "V6.8.2", + "req_description": "وجود و یکپارچگی امضاهای دیجیتال بر روی تصدیق‌های (تقاضاها یا ادعاهای) احراز هویت برای مثال بر روی (توکن‌های JWT یا SAML assertions) همواره اعتبارسنجی می‌شود و هرگونه تصدیقی که فاقد امضا یا دارای امضای نامعتبر باشد، رد می‌گردد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.8", + "section_name": "Authentication with an Identity Provider", + "req_id": "V6.8.3", + "req_description": "(تقاضاها یا ادعاهای) تصدیق‌های SAML به‌صورت منحصربه‌فرد پردازش شده و تنها یک‌بار در بازه‌ی اعتبار خود استفاده می‌شوند تا از حملات بازپخش (Replay Attacks) جلوگیری گردد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Authentication", + "section_id": "V6.8", + "section_name": "Authentication with an Identity Provider", + "req_id": "V6.8.4", + "req_description": "اگر برنامه‌ای از یک ارائه‌دهنده هویت (IdP) جداگانه استفاده می‌کند و انتظار قدرت، روش‌ها یا تازگی احراز هویت خاصی را برای عملکردهای خاص دارد، برنامه این موضوع را با استفاده از اطلاعات برگردانده شده توسط IdP تأیید می‌کند. به عنوان مثال، اگر از OIDC استفاده شود، این کار می‌تواند با اعتبارسنجی ادعاهای (Claims) موجود در توکن شناسایی (ID Token) مانند «amr»، «acr» و «auth_time» (در صورت وجود) انجام شود. اگر ارائه‌دهنده هویت این اطلاعات را ارائه نکند، برنامه باید یک روش جایگزین مستندسازی‌شده داشته باشد که فرض می‌کند حداقل سطح احراز هویت استفاده شده است (مثلاً احراز هویت تک‌عاملی با نام کاربری و گذرواژه).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.1", + "section_name": "Session Management Documentation", + "req_id": "V7.1.1", + "req_description": "بازه عدم فعالیت نشست کاربر و بیشینه طول عمر نشست قبل از احراز هویت مجدد، در ترکیب با سایر کنترل‌ها مستند و متناسب سازی شود. مستند سازی انجام شده باید شامل توجیه برای هر انحراف(نقض) از الزامات احراز هویت مجدد NIST SP 800-63B باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.1", + "section_name": "Session Management Documentation", + "req_id": "V7.1.2", + "req_description": "در مستند باید تعداد نشست همزمان مجاز برای یک کاربر و همچنین رفتار و اعمال مناسب برای زمانی که این تعداد به حداکثر رسید مشخص شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.1", + "section_name": "Session Management Documentation", + "req_id": "V7.1.3", + "req_description": "تمام سیستم‌هایی که نشست‌های کاربر را به عنوان بخشی از یک اکوسیستم مدیریت هویت فدرال(مانند سیستم‌های (SSO ایجاد و مدیریت می‌کنند، باید در کنار سایر کنترل‌های مربوط به طول عمر نشست‌ها، خاتمه آن‌ها و هرگونه شرایط دیگری که نیاز به احراز هویت مجدد دارد، مستند شوند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.2", + "section_name": "Fundamental Session Management Security", + "req_id": "V7.2.1", + "req_description": "برنامه کاربردی باید تمام بررسی‌های توکن نشست‌ را با استفاده از یک سرویس backend مطمئن انجام دهد.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.2", + "section_name": "Fundamental Session Management Security", + "req_id": "V7.2.2", + "req_description": "برنامه کاربردی که از هر یک از توکن‌های Self-Contained یا reference که به صورت پویا برای مدیریت نشست تولید شده‌اند استفاده کند اما از از کلیدهای API ثابت و کلید‌ها استفاده نکند.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.2", + "section_name": "Fundamental Session Management Security", + "req_id": "V7.2.3", + "req_description": "در صورتی که برای نمایش نشست کاربر از توکن‌های reference استفاده می شود، این توکن‌ها منحصر به فرد بوده و با استفاده از یک تولید کننده عدد شبه تصادفی امن رمزنگاری(CSPRNG) که دارای انتروپی حداقل128 بیتی است تولید شوند.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.2", + "section_name": "Fundamental Session Management Security", + "req_id": "V7.2.4", + "req_description": "برنامه کاربردی در هنگام احراز هویت کاربر یک توکن نشست جدید تولید نماید که شامل احراز هویت مجدد و ابطال توکن نشست کنونی است.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.3", + "section_name": "Session Timeout", + "req_id": "V7.3.1", + "req_description": "بر اساس تحلیل ریسک و تصمیمات امنیتی مستند شده، پس از گذشت مهلت زمانی عدم فعالیت، کاربر مجبور به احراز هویت مجدد گردد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.3", + "section_name": "Session Timeout", + "req_id": "V7.3.2", + "req_description": "بر اساس تحلیل ریسک و تصمیمات امنیتی مستند شده، پس از گذشت بیشینه زمان مطلق طول عمر، کاربر مجبور به احراز هویت مجدد گردد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.4", + "section_name": "Session Termination", + "req_id": "V7.4.1", + "req_description": "در مواقعی که فرآیند خاتمه نشست کاربر فعال می‌شود (مانند خروج کاربر یا انقضای نشست)، برنامه اجازه هیچ فعالیتی را به آن نشست نمی‌دهد. برای Reference tokens یا stateful session، این به معنی نامعتبرسازی اطلاعات نشست در برنامه Backend می‌باشد. برنامه‌هایی که از توکن‌های Self-contained استفاده می‌کنند نیاز به راه حل‌هایی نظیر نگهداری فهرستی از توکن‌های خاتمه‌یافته، عدم پذیرش توکن‌هایی که پیش از یک تاریخ و زمان مشخص برای هر کاربر تولید شده‌اند، یا چرخش کلید امضای مخصوص هر کاربر دارند.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.4", + "section_name": "Session Termination", + "req_id": "V7.4.2", + "req_description": "برنامه کاربردی تمامی نشست‌های فعال را در زمانی که حساب کاربری غیرفعال یا حذف می‌شود را ابطال نماید. (مانند کارمندی که شرکت را ترک می‌کند)", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.4", + "section_name": "Session Termination", + "req_id": "V7.4.3", + "req_description": "برنامه کاربردی قابلیت ارائه گزینه ابطال تمامی نشست های فعال دیگر را پس از یک تغییر موفقیت آمیز یا حذف هریک از عوامل احراز هویت (نظیر تغییر پسورد از طریق ریست یا بازنشانی و در صورت وجود به روزرسانی تنظیمات MFA ) را داشته باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.4", + "section_name": "Session Termination", + "req_id": "V7.4.4", + "req_description": "تمامی صفحاتی که نیازمند احراز هویت هستند دارای دسترسی آسان و مشخص به فرآیند خروج باشند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.4", + "section_name": "Session Termination", + "req_id": "V7.4.5", + "req_description": "مدیران برنامه کاربردی قادر به ابطال نشست‌های فعال برای یک شخص یا تمامی کاربران باشند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.5", + "section_name": "Defenses Against Session Abuse", + "req_id": "V7.5.1", + "req_description": "برنامه کاربردی قبل از اعطای مجوز تغییر ویژگی‌های حساس حساب کاربری که بر روی احراز هویت تاثیر دارد نظیر آدرس ایمیل، شماره تلفن، تنظیمات MFA یا اطلاعات دیگر که در بازگردانی حساب کاربری مورد استفاده قرار می‌گیرند، به احراز هویت مجدد کامل نیاز دارد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.5", + "section_name": "Defenses Against Session Abuse", + "req_id": "V7.5.2", + "req_description": "حساب‌های کاربری قادر به دیدن(پس از احراز هویت مجدد با حداقل یک عامل) و ابطال یک یا همه نشست‌های فعال باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.5", + "section_name": "Defenses Against Session Abuse", + "req_id": "V7.5.3", + "req_description": "برنامه کاربردی قبل از اجرای تراکنش‌ها یا عملیات‌های حساس نیازمند احراز هویت مجدد با حداقل یک عامل یا صحت سنجی ثانویه باشد.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.6", + "section_name": "Federated Re-authentication", + "req_id": "V7.6.1", + "req_description": "طول عمر و ابطال نشست بین RP و idp طبق سند- که نیازمند احرازهویت مجدد در زمان مورد نیاز مانند وقتی که بیشینه زمان بین رخداد احراز هویت idp رسیده باشد- انجام شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Session Management", + "section_id": "V7.6", + "section_name": "Federated Re-authentication", + "req_id": "V7.6.2", + "req_description": "ساخت نشست‌ها نیاز به رضایت کاربر یا یک اقدام صریح دارد که بدین صورت از ایجاد نشست‌های جدید برنامه بدون تعامل کاربر جلوگیری می‌شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Authorization", + "section_id": "V8.1", + "section_name": "Authorization Documentation", + "req_id": "V8.1.1", + "req_description": "مستند اعطای مجوز باید شامل قوانینی به منظور محدودسازی دسترسی در سطح عملکرد و دسترسی مبتنی بر داده بر اساس مجوزهای کاربران و ویژگی‌های منابع باشد.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Authorization", + "section_id": "V8.1", + "section_name": "Authorization Documentation", + "req_id": "V8.1.2", + "req_description": "مستند اعطای مجوز باید قوانینی را برای محدودیت‌های دسترسی در سطح Field بر اساس مجوزهای کاربران و ویژگی‌های منابع تعریف نماید(هر دو دسترسی خواندن و نوشتن). توجه داشته باشید که این قوانین ممکن است به مقادیر دیگر ویژگی‌های شیء داده ی مربوطه (Relevant Data Object) بستگی داشته باشند، مانند حالت (state) یا وضعیت (status).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Authorization", + "section_id": "V8.1", + "section_name": "Authorization Documentation", + "req_id": "V8.1.3", + "req_description": "مستند برنامه کاربردی باید ویژگی‌های محیطی و زمینه‌ای (شامل و نه محدود به زمان روز، مکان، آدرس IP یا دستگاه) که در برنامه کاربردی به منظور اتخاذ تصمیمات امنیتی (نظیر آن دسته از تصمیماتی که مربوط به احراز هویت و اعطای مجوز می باشد) را مشخص کند.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Authorization", + "section_id": "V8.1", + "section_name": "Authorization Documentation", + "req_id": "V8.1.4", + "req_description": "مستندات احراز هویت و اعطای مجوز، علاوه بر اعطای مجوز در سطح Field، سطح عملکرد و داده‌های خاص، چگونگی استفاده از عوامل محیطی و زمینه‌ای در اتخاذ تصمیمات را مشخص نماید.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Authorization", + "section_id": "V8.2", + "section_name": "General Authorization Design", + "req_id": "V8.2.1", + "req_description": "برنامه کاربردی باید از محدود بودن دسترسی‌‌های در سطح عملکرد به مشتریانی که دارای دسترسی صریح هستند اطمینان حاصل نماید.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Authorization", + "section_id": "V8.2", + "section_name": "General Authorization Design", + "req_id": "V8.2.2", + "req_description": "برنامه کاربردی باید از محدود بودن دسترسی‌‌های در سطح داده به مشتریانی که دارای دسترسی صریح به اقلام داده‌ای خاص هستند اطمینان حاصل نماید تا از این طریق خطر آسیب پذیری IDOR و broken object level authorization را کاهش دهد .", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Authorization", + "section_id": "V8.2", + "section_name": "General Authorization Design", + "req_id": "V8.2.3", + "req_description": "برنامه کاربردی دسترسی در سطح Field را با مجوزهای صریح به Field ها برای مصرف کنندگان جهت کاهش خطر broken object property level authorization (BOPLA) محدود کرده باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Authorization", + "section_id": "V8.2", + "section_name": "General Authorization Design", + "req_id": "V8.2.4", + "req_description": "کنترل‌های امنیتی تطبیقی که بر اساس ویژگی‌های محیطی و زمینه‌ای کاربر (مانند زمان روز، مکان، آدرس IP یا دستگاه) هستند، برای تصمیم‌گیری‌های احراز هویت (Authentication) و مجوزدهی (Authorization) طبق مستندات برنامه پیاده‌سازی شده‌اند. این کنترل‌ها باید هم در زمان تلاش کاربر برای شروع یک نشست (Session) جدید و هم در طول یک نشست فعال، اعمال شوند.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Authorization", + "section_id": "V8.3", + "section_name": "Operation Level Authorization", + "req_id": "V8.3.1", + "req_description": "برنامه کاربردی قوانین مجوزدهی را در یک لایه سرویس معتبر اعمال نموده و بر آن دسته از کنترل‌هایی که مصرف کنندگان نامعتبر قادر به دستکاری آن‌ها هستند متکی نباشد. (نظیر جاوا اسکریپت سمت کاربر)", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Authorization", + "section_id": "V8.3", + "section_name": "Operation Level Authorization", + "req_id": "V8.3.2", + "req_description": "در مواقعی که امکان اعمال فوری تغییرات وجود ندارد (مثلاً وقتی که سیستم برای تصمیم‌گیری در مجوزدهی از توکن‌های Self-Contained مثل JWT استفاده می‌کند که اطلاعات را داخل خود ذخیره کرده و تا زمان انقضا تغییر نمی‌کنند)، باید کنترل‌های جبرانی وجود داشته باشد. این کنترل‌ها باید بتوانند زمانی که کاربر عملی را انجام می‌دهد که دیگر مجاز به آن نیست، هشدار بدهند و تغییر را برگردانند. با این حال، توجه کنید که این راهکار جایگزین نمی‌تواند جلوی نشت اطلاعات را بگیرد.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Authorization", + "section_id": "V8.3", + "section_name": "Operation Level Authorization", + "req_id": "V8.3.3", + "req_description": "دسترسی به یک object بر اساس مجوزهای کاربری شخص درخواست کننده(مثال: مصرف کننده) باشد نه بر اساس مجوز‌های یک واسطه یا سرویسی که به نمایندگی از او عمل می‌کند. بطور مثال، در صورتی که یک مصرف کننده یک وب سرویس را با استفاده از یک توکن self-contained برای احراز هویت فراخوانی می‌کند و سپس آن سرویس اطلاعات را از یک سرویس دیگر درخواست می‌کند، سرویس دوم باید همان توکن مصرف کننده را استفاده کند، نه یک توکن سرویس-به-سرویس (Machine-to-Machine token) که متعلق به سرویس اول است، تا تصمیمات مجوزدهی دقیقاً بر اساس مجوزهای کاربر گرفته شوند.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Authorization", + "section_id": "V8.4", + "section_name": "Other Authorization Considerations", + "req_id": "V8.4.1", + "req_description": "برنامه های کاربردی چند کاربره(multi tenants) از کنترل های cross-tenant به منظور تضمین این امر که عملیات‌های مصرف کنندگان هرگز کاربرانی (tenants) را که مجوز تعامل با آنها را ندارند را تحت تأثیر قرار نمی‌دهد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Authorization", + "section_id": "V8.4", + "section_name": "Other Authorization Considerations", + "req_id": "V8.4.2", + "req_description": "دسترسی به درگاه‌های پیکربندی شامل چندین لایه امنیتی از قبیل تأیید مداوم هویت مصرف‌کننده، ارزیابی وضعیت امنیتی دستگاه و تحلیل ریسک زمینه‌ای باشد تا از این طریق اطمینان حاصل شود که موقعیت شبکه‌ای یا نقاط پایانی معتبر تنها عوامل برای مجوزدهی نیستند اگر چه که این عوامل احتمال دسترسی غیرمجاز را کاهش می‌دهند.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Self-contained Tokens", + "section_id": "V9.1", + "section_name": "Token source and integrity", + "req_id": "V9.1.1", + "req_description": "قبل از پذیرش محتوای توکن‌ها، آن‌ها را با استفاده از امضای دیجیتال یا MAC به منظور حفاظت در مقابل دستکاری‌ها مورد اعتبارسنجی قرار داده شود.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Self-contained Tokens", + "section_id": "V9.1", + "section_name": "Token source and integrity", + "req_id": "V9.1.2", + "req_description": "فقط الگوریتم‌های موجود در لیست مجاز قادر به استفاده در ساخت و صحت سنجی توکن‌های self-contained در یک زمینه مشخص باشند. این لیست مجاز باید در حالت ایده آل شامل هم الگوریتم‌های متقارن و هم نامتقارن‌ها باشد و نباید شامل الگوریتم‌های NONE باشد. در صورتی که هر دو الگوریتم‌های متقارن و نانتقارن مورد نیاز باشند کنترل‌های بیشتری باید به منظور جلوگیری از سردرگمی کلید‌ها(key Confusion) بکار گرفته شود.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Self-contained Tokens", + "section_id": "V9.1", + "section_name": "Token source and integrity", + "req_id": "V9.1.3", + "req_description": "به منظور جلوگیری از مشخص نمودن منابع غیر مطمئن و کلید‌ها توسط مهاجمین، موارد کلیدی که در اعتبارسنجی توکن‌های self-contained مورد استفاده قرار می‌گیرند، از منابع از پیش پیکربندی شده مطمئنی که برای صادر کننده توکن است تعیین شود. برای JWTs و سایر ساختارهای JWS ، هدرهایی نظیر ‘jku’, ‘x5u’ و ‘jwk’ باید با یک لیست مجاز از منابع مطمئن مورد اعتبارسنجی قرار گیرند.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Self-contained Tokens", + "section_id": "V9.2", + "section_name": "Token content", + "req_id": "V9.2.1", + "req_description": "اگر یک بازه زمانی معتبر در داده‌های توکن وجود داشته باشد، توکن و محتوای آن تنها در صورتی پذیرفته می‌شوند که زمان بررسی در این بازه زمانی معتبر باشد. به عنوان مثال، برای JWTها، ادعاهای 'nbf' و 'exp' باید تایید شوند.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Self-contained Tokens", + "section_id": "V9.2", + "section_name": "Token content", + "req_id": "V9.2.2", + "req_description": "سرویسی که یک توکن دریافت می‌کند قبل از پذیرش محتوای آن، از لحاظ درستی نوع بررسی نموده و برای هدف مشخص شده در نظر گیرد. بطور مثال، فقط توکن‌های access می‌توانند به منظور تصمیمات مجوزی و فقط توکن های ID می‌توانند به منظور اثبات هویت کاربر مورد پذیرش قرار گیرند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Self-contained Tokens", + "section_id": "V9.2", + "section_name": "Token content", + "req_id": "V9.2.3", + "req_description": "یک سرویس فقط توکن‌هایی را بپذیرد که به منظور استفاده توسط آن سرویس هستند(audience).برای JWT ها،این امر می‌تواند از طریق اعتبارسنجی ادعای 'aud' با یک لیست مجاز تعریف شده در سرویس صورت پذیرد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Self-contained Tokens", + "section_id": "V9.2", + "section_name": "Token content", + "req_id": "V9.2.4", + "req_description": "اگر صادر کننده توکن از کلید خصوصی مشابهی برای audienceهای متفاوت استفاده می‌کند، توکن‌های تولید شده دارای محدودیت مخاطبی باشند که بطور منحصر به فردی مخاطبین مورد نظر را مشخص می‌کند. این امر از استفاده مجدد توکن توسط مخاطب ناخواسته جلوگیری می‌کند. در صورتی که شناسه مخاطب به صورت پویا مشخص شده باشد، صادرکننده توکن باید این مخاطبین را به منظور اطمینان از عدم جعل هویت مخاطب مورد اعتبارسنجی قرار دهد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.1", + "section_name": "Generic OAuth and OIDC Security", + "req_id": "V10.1.1", + "req_description": "توکن‌ها باید فقط به مؤلفه‌هایی ارسال شوند که به‌طور دقیق به آن‌ها نیاز دارند. برای مثال، هنگام استفاده از الگوی Backend-for-Frontend برای برنامه‌های JavaScript مبتنی بر مرورگر، Access Tokens و Refresh Tokens باید فقط برای Backend قابل دسترس باشند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.1", + "section_name": "Generic OAuth and OIDC Security", + "req_id": "V10.1.2", + "req_description": "Client باید فقط مقادیری را از Authorization Server بپذیرد (مانند Authorization Code یاID Token ) که این مقادیر حاصل از یک Authorization Flow باشند که توسط همان نشست (Session) و تراکنش User Agent آغاز شده است. این موضوع مستلزم آن است که Secretهای تولیدشده توسط کلاینت مانند code_verifier در PKCE، یا مقادیر state و nonce در OIDC قابل حدس زدن نباشند، مخصوص همان تراکنش باشند، و به‌صورت امن هم به کلاینت و هم به نشست (Session) مرورگری که تراکنش در آن شروع شده، متصل شده باشند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.2", + "section_name": "OAuth Client", + "req_id": "V10.2.1", + "req_description": "درCode Flow، باید OAuth Client در برابر حملاتBrowser-based Request Forgery که معمولاً با عنوان Cross-Site Request Forgery (CSRF) شناخته می‌شوند و درخواست‌های توکن را ایجاد می‌کنند، محافظت داشته باشد. این محافظت باید با استفاده از قابلیت PKCE یا با بررسی پارامترstate که در درخواست احراز مجوز ارسال شده است.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.2", + "section_name": "OAuth Client", + "req_id": "V10.2.2", + "req_description": "اگر OAuth Client بتواند با بیش از یک Authorization Server تعامل داشته باشد، باید دارای سازوکاری برای دفاع در برابر Mix-up Attacks باشد. برای مثال، می‌تواند الزام کند که Authorization Server مقدار پارامتر ‘iss’ را برگرداند و این مقدار هم درAuthorization Response و هم درToken Response اعتبارسنجی شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.2", + "section_name": "OAuth Client", + "req_id": "V10.2.3", + "req_description": "OAuth Client باید فقطScopes (یا سایر پارامترهای مجوزدهی) مورد نیاز را در درخواست‌ها به Authorization Server درخواست کند.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.3", + "section_name": "OAuth Resource Server", + "req_id": "V10.3.1", + "req_description": "Resource Server باید فقط Access Tokenهایی را بپذیرد که برای استفاده با همان سرویس در نظر گرفته شده‌اند(Audience). Audience می‌تواند در یک Access Token ساختاریافته (مانند مقدار aud در JWT) درج شده باشد، یا از طریق Token Introspection Endpoint بررسی شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.3", + "section_name": "OAuth Resource Server", + "req_id": "V10.3.2", + "req_description": "Resource Server باید تصمیمات مجوزدهی (Authorization Decisions) را بر اساس Claims موجود در Access Token که واگذاری مجوز (Delegated Authorization) را تعریف می‌کنند، اعمال کند. اگر Claimsهایی مانند sub، scope و authorization_details موجود باشند، باید جزو فرآیند تصمیم‌گیری قرار گیرند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.3", + "section_name": "OAuth Resource Server", + "req_id": "V10.3.3", + "req_description": "اگر برای گرفتن یک تصمیم کنترل دسترسی، لازم است یک کاربرِ یکتا از داخل Access Token (چه JWT و چه پاسخ Token Introspection ) شناسایی شود، سرور منبع (Resource Server) کاربر را از روی Claimهایی شناسایی کند که قابل اختصاص‌دادن به کاربران دیگر نیستند. معمولاً این یعنی استفاده از ترکیب دو Claim یعنی 'iss' (صادرکننده توکن) و 'sub' (شناسه یکتای کاربر)", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.3", + "section_name": "OAuth Resource Server", + "req_id": "V10.3.4", + "req_description": "اگر Resource Server نیازمند قدرت، روش یا تازگی خاص احراز هویت باشد، بررسی کند که Access Token ارائه‌شده این محدودیت‌ها را برآورده می‌کند. برای مثال، در صورت وجود، از Claimsهای OIDC مانند acr، amr و auth_time به ترتیب استفاده شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.3", + "section_name": "OAuth Resource Server", + "req_id": "V10.3.5", + "req_description": "تأیید کنید که Resource Server از استفاده از Access Tokenهای سرقت‌شده یا Replay توکن‌ها (توسط افراد غیرمجاز) جلوگیری کند، با الزام استفاده از Sender-Constrained Access Tokens، مانند Mutual TLS برای OAuth 2 یا OAuth2 Demonstration of Proof of Possession (DPoP).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.4", + "section_name": "OAuth Authorization Server", + "req_id": "V10.4.1", + "req_description": "سرور احراز هویت باید آدرس‌های بازگشتی (Redirect URI) را بر اساس فهرست مجاز (Allowlist) از URIهای از پیش‌ثبت‌شده و مخصوص هر کلاینت، با استفاده از مقایسه دقیقِ رشته‌ای Comparison) (Exact String اعتبارسنجی می‌کند.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.4", + "section_name": "OAuth Authorization Server", + "req_id": "V10.4.2", + "req_description": "اگر Authorization Server کد احراز مجوز (Authorization Code) را در Authorization Response برمی‌گرداند، این کد فقط یک‌بار برای درخواست توکن باید قابل استفاده باشد. برای دومین درخواست معتبر با یک Authorization Code که قبلاً برای صدور Access Token استفاده شده است، Authorization Server باید درخواست توکن را رد کند و هر توکن صادرشده‌ی مرتبط با آن Authorization Code را باطل نماید.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.4", + "section_name": "OAuth Authorization Server", + "req_id": "V10.4.3", + "req_description": "تأیید کنید که Authorization Code دارای مدت زمان معتبر بودن محدود باشد. حداکثر طول عمر می‌تواند برای برنامه‌های کاربردی در سطوح L1 و L2 تا ۱۰ دقیقه و برای برنامه‌های کاربردی در سطح L3 تا ۱ دقیقه باشد.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.4", + "section_name": "OAuth Authorization Server", + "req_id": "V10.4.4", + "req_description": "برای یک Client مشخص، Authorization Server فقط استفاده از Grantهایی را مجاز بداند که آن Client به استفاده از آن‌ها نیاز دارد. توجه داشته باشید که Grantهای ‘token’ (Implicit Flow) و ‘password’ (Resource Owner Password Credentials Flow) دیگر نباید استفاده شوند.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.4", + "section_name": "OAuth Authorization Server", + "req_id": "V10.4.5", + "req_description": "Authorization Server باید حملات Refresh Token Replay را برای Public Clientها کاهش دهد، ترجیحاً با استفاده از Sender-Constrained Refresh Tokens، یعنی Demonstrating Proof of Possession (DPoP) یا Certificate-Bound Access Tokens با استفاده از Mutual TLS (mTLS). برای برنامه‌های L1 و L2، می‌توان از Refresh Token Rotation استفاده کرد. اگر Refresh Token Rotation به‌کار گرفته شود، Authorization Server باید پس از استفاده، Refresh Token را باطل کند و اگر یک Refresh Token که قبلاً استفاده و باطل شده ارائه شود، تمام Refresh Tokenهای مربوط به آن مجوز را ابطال نماید.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.4", + "section_name": "OAuth Authorization Server", + "req_id": "V10.4.6", + "req_description": "اگر از Code Grant استفاده شود، Authorization Server باید حملات Authorization Code Interception را با الزام به استفاده از Proof Key for Code Exchange (PKCE) کاهش دهد. برای Authorization Requestها، Authorization Server باید یک مقدار معتبر برای 'code_challenge' الزام کند و نباید مقدار 'code_challenge_method' از نوع 'plain' را بپذیرد. برای Token Request، باید اعتبارسنجی پارامتر 'code_verifier' الزامی باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.4", + "section_name": "OAuth Authorization Server", + "req_id": "V10.4.7", + "req_description": "اگر Authorization Server از Unauthenticated Dynamic Client Registration پشتیبانی می‌کند، ریسک مربوط به Client Applicationهای مخرب را باید کاهش دهد. این کار باید شامل اعتبارسنجی Client Metadata (مانند هر Registered URI)، اطمینان از رضایت کاربر، و هشدار به کاربر پیش از پردازش یک Authorization Request با یک Client Application غیرقابل اعتماد باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.4", + "section_name": "OAuth Authorization Server", + "req_id": "V10.4.8", + "req_description": "Refresh Tokenها باید دارای یک انقضای مطلق (Absolute Expiration) باشند، حتی اگر از Sliding Refresh Token Expiration استفاده شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.4", + "section_name": "OAuth Authorization Server", + "req_id": "V10.4.9", + "req_description": "Refresh Tokenها و Reference Access Tokenها باید توسط کاربر مجاز از طریق User Interface Authorization Server قابل ابطال باشند، تا ریسک Clientهای مخرب یا توکن‌های سرقت‌شده کاهش یابد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.4", + "section_name": "OAuth Authorization Server", + "req_id": "V10.4.10", + "req_description": "Confidential Client باید برای درخواست‌های Backchannel بین Client و Authorization Server، مانند Token Requests، Pushed Authorization Requests (PAR) و Token Revocation Requests، احراز هویت شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.4", + "section_name": "OAuth Authorization Server", + "req_id": "V10.4.11", + "req_description": "پیکربندی Authorization Server باید فقط Scopes موردنیاز را به OAuth Client اختصاص دهد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.4", + "section_name": "OAuth Authorization Server", + "req_id": "V10.4.12", + "req_description": "برای یک Client مشخص، Authorization Server فقط مقدار 'response_mode' را که این Client نیاز دارد، مجاز بداند. برای مثال، با اعتبارسنجی این مقدار توسط Authorization Server در برابر مقادیر مورد انتظار یا با استفاده از Pushed Authorization Request (PAR) یا JWT-secured Authorization Request (JAR).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.4", + "section_name": "OAuth Authorization Server", + "req_id": "V10.4.13", + "req_description": "Grant Type ‘code’ همواره همراه با Pushed Authorization Requests (PAR) باید استفاده شود.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.4", + "section_name": "OAuth Authorization Server", + "req_id": "V10.4.14", + "req_description": "Authorization Server باید فقط توکن‌های دسترسی از نوع وابسته به ارسال‌کننده (Proof-of-Possession) صادر می‌کند؛ چه به‌صورت توکن‌های دسترسی مبتنی بر گواهی از طریق TLS دوسویه (mTLS) و چه به‌صورت توکن‌های دسترسی وابسته به DPoP (Demonstration of Proof of Possession).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.4", + "section_name": "OAuth Authorization Server", + "req_id": "V10.4.15", + "req_description": "برای یک کلاینت سمت‌سرور (که روی دستگاه کاربر نهایی اجرا نمی‌شود)، سرور احراز هویت اطمینان حاصل می‌کند که مقدار پارامترِ authorization_details از بک‌اند کلاینت ارسال شده و کاربر در آن دستکاری نکرده است. به‌عنوان مثال، با الزام به استفاده از درخواست احراز هویت پوش‌شده (PAR) یا درخواست احراز هویت ایمن‌شده با JWT (JAR).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.4", + "section_name": "OAuth Authorization Server", + "req_id": "V10.4.16", + "req_description": "کلاینت باید از نوع Confidential Client باشد و سرور احراز هویت استفاده از روش‌های قدرتمند احراز هویت کلاینت ـ مبتنی بر رمزنگاری کلید عمومی و مقاوم در برابر حملات replay attacks ـ را الزامی کند؛ مانند TLS دوسویه (tls_client_auth ‎، ‎self_signed_tls_client_auth یا JWT مبتنی بر کلید خصوصی (private_key_jwt).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.5", + "section_name": "OIDC Client", + "req_id": "V10.5.1", + "req_description": "Client به‌عنوان Relying Partyباید در برابر حملات بازپخش (Replay) توکن ID محافظت شده است. برای مثال، با بررسی اینکه مقدار claim مربوط به nonce در ID Token دقیقاً با مقدار **nonce**ای که در درخواست احراز هویت به OpenID Provider ارسال شده، یکسان باشد(که در OAuth 2 به آن authorization request ارسالی به authorization server گفته می‌شود).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.5", + "section_name": "OIDC Client", + "req_id": "V10.5.2", + "req_description": "Client باید کاربر را به‌صورت یکتا از ID Token Claims شناسایی کند، معمولاً از ‘sub’ Claim ، که قابل انتساب مجدد به کاربران دیگر نیست (در محدوده‌ی همان Identity Provider).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.5", + "section_name": "OIDC Client", + "req_id": "V10.5.3", + "req_description": "Client باید تلاش‌های یک Authorization Server مخرب برای جا زدن خود به‌جای یک Authorization Server دیگر از طریق متادیتای Authorization Server را رد می‌کند.کلاینت باید متادیتای Authorization Server را رد کند اگر مقدار issuer URL موجود در متادیتا دقیقاً با issuer URL از پیش پیکربندی‌شده و مورد انتظار کلاینت یکسان نباشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.5", + "section_name": "OIDC Client", + "req_id": "V10.5.4", + "req_description": "Client باید اعتبارسنجی کند ID Token برای استفاده توسط همان Client در نظر گرفته شده است (Audience)، با بررسی اینکه ‘aud’ Claim در توکن برابر با مقدار ‘client_id’ مربوط به Client باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.5", + "section_name": "OIDC Client", + "req_id": "V10.5.5", + "req_description": "هنگام استفاده ازOIDC Back-Channel Logout، Relying Party از Denial of Service از طریق Forced Logout و Cross-JWT Confusion در جریان Logout باید جلوگیری کند. Client باید بررسی کند که Logout Token به درستی با مقدار typ آن برابر با logout+jwt باشد ، شامل ‘event’ Claim با نام عضو صحیح باشد و شامل ‘nonce’ Claim نباشد. همچنین توصیه می‌شود Expiration کوتاه باشد (مثلاً ۲ دقیقه).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.6", + "section_name": "OpenID Provider", + "req_id": "V10.6.1", + "req_description": "OpenID Provider باید فقط مقادیر 'code'، 'ciba'، 'id_token' یا 'id_token code' را برای Response Mode مجاز بداند. توجه داشته باشید که 'code' نسبت به 'id_token code' (که OIDC Hybrid Flow است) ترجیح داده می‌شود و 'token' (هر Implicit Flow) نباید استفاده شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.6", + "section_name": "OpenID Provider", + "req_id": "V10.6.2", + "req_description": "OpenID Provider از Denial of Service از طریق Forced Logout جلوگیری کند. این کار با دریافت تأیید صریح از کاربر نهایی یا در صورت وجود، اعتبارسنجی پارامترها در Logout Request (که توسط Relying Party آغاز شده است)، مانند ‘id_token_hint’، انجام می‌شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.7", + "section_name": "Consent Management", + "req_id": "V10.7.1", + "req_description": "Authorization Server باید تضمین ‌کند کاربر برای هر درخواست مجوز (Authorization Request) رضایت خود را اعلام کرده است. در صورتی که هویت کلاینت قابل اطمینان نباشد، Authorization Server باید در همه موارد کاربر را به‌صورت صریح برای اعلام رضایت (Consent) راهنمایی و از او تأیید بگیرد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.7", + "section_name": "Consent Management", + "req_id": "V10.7.2", + "req_description": "زمانی که Authorization Server از کاربر درخواست رضایت (Consent) می‌کند باید اطلاعات کافی و شفافی درباره آنچه کاربر در حال تأیید آن است ارائه ‌دهد. در صورت لزوم، این اطلاعات باید شامل این موارد باشد: ماهیت مجوزهای درخواستی )معمولاً بر اساس scope، resource server و جزئیات مجوز در Rich Authorization Requests – RAR)، هویت برنامه یا اپلیکیشن دریافت‌کننده مجوز و مدت اعتبار این مجوزها.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth and OIDC", + "section_id": "V10.7", + "section_name": "Consent Management", + "req_id": "V10.7.3", + "req_description": "کاربر باید بتواند رضایت‌هایی (Consents) را که از طریق Authorization Server صادر کرده است، مشاهده، ویرایش و لغو (Revoke) کند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.1", + "section_name": "Cryptographic Inventory and Documentation", + "req_id": "V11.1.1", + "req_description": "اطمینان حاصل کنید که یک سیاست مستند برای مدیریت کلیدهای رمزنگاری و چرخه‌عمر کلیدهای رمزنگاری وجود دارد که از یک استاندارد مدیریت کلید مانند NIST SP 800-57 پیروی می‌کند. این باید شامل اطمینان از این موضوع باشد که کلیدها بیش از حد به اشتراک گذاشته نشوند (برای مثال، در مورد Secrets مشترک با بیش از دو موجودیت و در مورد کلیدهای خصوصی با بیش از یک موجودیت).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.1", + "section_name": "Cryptographic Inventory and Documentation", + "req_id": "V11.1.2", + "req_description": "فهرست اجزاء رمزنگاری باید تهیه و نگهداری ‌شود و به‌صورت منظم به‌روزرسانی گردد و شامل تمام کلیدهای رمزنگاری، الگوریتم‌ها و گواهی‌های دیجیتال مورد استفاده در برنامه باشد. این فهرست همچنین باید مشخص کند که کلیدها در کدام بخش‌های سیستم مجاز یا غیرمجاز به استفاده هستند و چه نوع داده‌هایی می‌توانند یا نمی‌توانند با این کلیدها محافظت شوند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.1", + "section_name": "Cryptographic Inventory and Documentation", + "req_id": "V11.1.3", + "req_description": "مکانیزم‌های کشف رمزنگاری برای شناسایی تمام موارد استفاده از رمزنگاری در سیستم باید استفاده ‌شود؛ از جمله رمزنگاری (encryption)، هش‌کردن (hashing) و عملیات امضای دیجیتال (signing).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.1", + "section_name": "Cryptographic Inventory and Documentation", + "req_id": "V11.1.4", + "req_description": "فهرست اجزاء رمزنگاری باید تهیه ‌شود. این فهرست باید شامل یک برنامه مستند باشد که مسیر مهاجرت به استانداردهای جدید رمزنگاری (مانند رمزنگاری پساکوانتومی) را مشخص می‌کند تا امکان واکنش مناسب به تهدیدات آینده فراهم شود.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.2", + "section_name": "Secure Cryptography Implementation", + "req_id": "V11.2.1", + "req_description": "برای عملیات رمزنگاری باید از پیاده‌سازی‌های مورد تأیید (شامل کتابخانه‌ها و پیاده‌سازی‌های سخت‌افزاری) استفاده شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.2", + "section_name": "Secure Cryptography Implementation", + "req_id": "V11.2.2", + "req_description": "برنامه با انعطاف‌پذیری رمزنگاری (crypto agility) باید طراحی شده باشد، به‌طوری که الگوریتم‌های تولید اعداد تصادفی، رمزنگاری احراز هویت‌شده، MAC یا هش، طول کلیدها، تعداد دورها، رمزها و حالت‌ها بتوانند در هر زمان مجدداً پیکربندی، ارتقاء یا تعویض شوند تا در برابر شکست‌های رمزنگاری محافظت شوند. به همین ترتیب، باید امکان جایگزینی کلیدها و رمزهای عبور و رمزگذاری مجدد داده‌ها نیز وجود داشته باشد. این امکان ارتقاء بدون وقفه به رمزنگاری پساکوانتومی (PQC) را فراهم می‌کند، زمانی که پیاده‌سازی‌های با اطمینان بالا از طرح‌ها یا استانداردهای تأییدشده PQC به‌طور گسترده در دسترس قرار گیرند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.2", + "section_name": "Secure Cryptography Implementation", + "req_id": "V11.2.3", + "req_description": "تمام بدویات رمزنگاری (cryptographic primitives) بر اساس الگوریتم، اندازه کلید و پیکربندی، حداقل ۱۲۸ بیت سطح امنیتی را فراهم می‌کنند(2128)، برای مثال، یک کلید ECC با طول ۲۵۶ بیت تقریباً ۱۲۸ بیت امنیت ارائه می‌دهد، در حالی که برای رسیدن به همین سطح امنیت، الگوریتم RSA به کلید ۳۰۷۲ بیتی نیاز دارد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.2", + "section_name": "Secure Cryptography Implementation", + "req_id": "V11.2.4", + "req_description": "تأیید کنید که تمامی عملیات رمزنگاری زمان ثابت (constant-time) باشند و هیچ عملیات «کوتاه‌شده» (short-circuit) در مقایسه‌ها، محاسبات یا بازگشت‌ها وجود نداشته باشد تا از نشت اطلاعات جلوگیری شود.( مهاجم می‌تواند از همین تفاوت‌های زمانی، از طریق Timing Side-Channel Attack، اطلاعات حساس را استخراج کند.)", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.2", + "section_name": "Secure Cryptography Implementation", + "req_id": "V11.2.5", + "req_description": "تأیید کنید که تمامی ماژول‌های رمزنگاری به‌صورت امن دچار خطا (fail securely) شوند و خطاها به گونه‌ای مدیریت شوند که ایجاد آسیب‌پذیری‌هایی مانند حملات Padding Oracle را ممکن نکنند.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.3", + "section_name": "Encryption Algorithms", + "req_id": "V11.3.1", + "req_description": "از مد‌های بلاک ناامن (مانند ECB) و روش‌های Padding ضعیف (مانند PKCS#1 v1.5) نباید استفاده شود.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.3", + "section_name": "Encryption Algorithms", + "req_id": "V11.3.2", + "req_description": "تنها رمزها و مد‌های تأییدشده، مانند AES با GCM باید استفاده شوند.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.3", + "section_name": "Encryption Algorithms", + "req_id": "V11.3.3", + "req_description": "داده‌های رمزنگاری‌شده باید با استفاده از ترجیحاً یک روش رمزنگاری احراز هویت‌شده تأییدشده یا با ترکیب یک روش رمزنگاری تأییدشده با یک الگوریتم MAC تأییدشده در برابر تغییرات غیرمجاز محافظت شوند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.3", + "section_name": "Encryption Algorithms", + "req_id": "V11.3.4", + "req_description": "تأیید کنید که Nonceها، Initialization Vectorها و سایر اعداد یک‌بار مصرف برای بیش از یک جفت کلید رمزنگاری و عنصر داده استفاده نشوند. روش تولید آن‌ها باید متناسب با الگوریتم مورد استفاده باشد.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.3", + "section_name": "Encryption Algorithms", + "req_id": "V11.3.5", + "req_description": "تأیید کنید که هر ترکیبی از یک الگوریتم رمزنگاری و یک الگوریتم MAC در حالت Encrypt-then-MAC عمل کند.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.4", + "section_name": "Hashing and Hash-based Functions", + "req_id": "V11.4.1", + "req_description": "تأیید کنید که تنها توابع هش تأییدشده برای موارد استفاده عمومی رمزنگاری، از جمله امضاهای دیجیتال، HMAC، KDF و تولید بیت تصادفی استفاده شوند. توابع هش غیرمجاز، مانند MD5، نباید برای هیچ هدف رمزنگاری به‌کار گرفته شوند.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.4", + "section_name": "Hashing and Hash-based Functions", + "req_id": "V11.4.2", + "req_description": "رمزعبورها با استفاده از یک تابع مشتق‌سازی کلید تأییدشده و پرهزینه محاسباتی (که به آن «تابع هش رمزعبور» نیز گفته می‌شود) ذخیره شوند، و تنظیمات پارامترها بر اساس راهنمایی‌های کنونی پیکربندی شده باشد. این تنظیمات باید تعادل بین امنیت و عملکرد برقرار کنند تا حملات Brute-force برای سطح امنیت مورد نیاز به‌طور کافی دشوار باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.4", + "section_name": "Hashing and Hash-based Functions", + "req_id": "V11.4.3", + "req_description": "توابع هش استفاده‌شده در امضاهای دیجیتال، باید به‌عنوان بخشی از احراز هویت داده یا یکپارچگی داده، در برابر collision مقاوم بوده و طول بیت مناسب داشته باشند. اگر مقاومت در برابر collision لازم باشد، طول خروجی باید حداقل 256 بیت باشد. اگر تنها مقاومت در برابر حملات Second Pre-image لازم باشد، طول خروجی باید حداقل 128 بیت باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.4", + "section_name": "Hashing and Hash-based Functions", + "req_id": "V11.4.4", + "req_description": "برنامه باید هنگام استخراج کلیدهای مخفی از پسوردها از توابع مشتق‌سازی کلید (KDF) تاییدشده با پارامترهای Key Stretching استفاده می‌کند. پارامترهای مورد استفاده باید تعادلی بین امنیت و عملکرد برقرار کنند تا از نفوذ حملات brute-force و به خطر افتادن کلید رمزنگاری تولیدشده جلوگیری شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.5", + "section_name": "Random Values", + "req_id": "V11.5.1", + "req_description": "اعداد و رشته‌های تصادفی که قرار است قابل حدس نباشند، باید با استفاده از یک تولیدکننده اعداد شبه‌تصادفی امن رمزنگاری‌شده (CSPRNG) تولید شوند و حداقل 128 بیت انتروپی داشته باشند. توجه داشته باشید که UUIDها این شرط را رعایت نمی‌کنند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.5", + "section_name": "Random Values", + "req_id": "V11.5.2", + "req_description": "مکانیزم تولید اعداد تصادفی مورد استفاده به‌گونه‌ای طراحی شده باشد که حتی تحت بار سنگین نیز به‌طور امن عمل کند.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.6", + "section_name": "Public Key Cryptography", + "req_id": "V11.6.1", + "req_description": "فقط الگوریتم‌های رمزنگاری و مدهای عملیاتی تأیید شده برای تولید کلید و مقداردهی اولیه، و همچنین برای تولید و تأیید امضاهای دیجیتال باید استفاده می‌شوند. الگوریتم‌های تولید کلید نباید کلیدهای ناامن تولید کنند که در برابر حملات شناخته شده آسیب‌پذیر باشند؛ به‌عنوان مثال، کلیدهای RSA که در برابر Fermat factorization آسیب‌پذیر هستند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.6", + "section_name": "Public Key Cryptography", + "req_id": "V11.6.2", + "req_description": "برای تبادل کلید از الگوریتم‌های رمزنگاری تأیید شده (مانند Diffie-Hellman) استفاده می‌شود و تمرکز بر این است که مکانیزم‌های تبادل کلید از پارامترهای امن بهره ببرند. این کار از حملات بر فرآیند برقراری کلید جلوگیری می‌کند و مانع حملات مرد میانی (MITM) یا شکست‌های رمزنگاری می‌شود.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.7", + "section_name": "In-Use Data Cryptography", + "req_id": "V11.7.1", + "req_description": "رمزنگاری کامل حافظه (Full Memory Encryption) باید فعال باشد تا داده‌های حساس هنگام استفاده محافظت شوند و دسترسی کاربران یا فرآیندهای غیرمجاز به آن‌ها جلوگیری شود.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Cryptography", + "section_id": "V11.7", + "section_name": "In-Use Data Cryptography", + "req_id": "V11.7.2", + "req_description": "کاهش داده‌ها (data minimization) تضمین می‌کند که حداقل مقدار داده در حین پردازش افشا شود، و اطمینان حاصل شود که داده‌ها بلافاصله پس از استفاده یا در اولین فرصت ممکن رمزنگاری شوند.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Secure Communication", + "section_id": "V12.1", + "section_name": "General TLS Security Guidance", + "req_id": "V12.1.1", + "req_description": "جدیدترین نسخه‌های پیشنهادی پروتکل TLS فعال باشند، مانند TLS 1.2 و TLS 1.3 نسخه‌ی جدیدترین پروتکل TLS باید گزینه‌ی ترجیحی باشد.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Secure Communication", + "section_id": "V12.1", + "section_name": "General TLS Security Guidance", + "req_id": "V12.1.2", + "req_description": "تنها cipher suiteهای پیشنهادی فعال باشند و قوی‌ترین cipher suiteها به‌عنوان گزینه‌ی ترجیحی تنظیم شده باشند. برنامه‌های L3 باید تنها از cipher suiteهایی پشتیبانی کنند که Forward Secrecy را فراهم می‌کنند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Secure Communication", + "section_id": "V12.1", + "section_name": "General TLS Security Guidance", + "req_id": "V12.1.3", + "req_description": "برنامه باید پیش از استفاده از هویت گواهی برای احراز هویت یا مجوزدهی، اعتبار و مورد اعتماد بودن گواهی‌های کلاینت در mTLS را بررسی و تأیید ‌کند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Secure Communication", + "section_id": "V12.1", + "section_name": "General TLS Security Guidance", + "req_id": "V12.1.4", + "req_description": "لغو صحیح گواهی‌ها، مانند OCSP ، باید فعال و به‌درستی پیکربندی شده باشد.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Secure Communication", + "section_id": "V12.1", + "section_name": "General TLS Security Guidance", + "req_id": "V12.1.5", + "req_description": "Encrypted Client Hello (ECH) باید در تنظیمات TLS برنامه فعال باشد تا از افشای متادیتای حساس، مانند Server Name Indication (SNI)، در طول فرآیند Handshake TLS جلوگیری شود.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Secure Communication", + "section_id": "V12.2", + "section_name": "HTTPS Communication with External Facing Services", + "req_id": "V12.2.1", + "req_description": "برای تمام ارتباطات بین کلاینت و سرویس‌های مبتنی بر HTTP که در معرض دسترسی خارجی هستند، از TLS باید استفاده ‌شود و هیچ‌گونه بازگشت (fallback) به ارتباطات ناامن یا بدون رمزنگاری انجام نگیرد.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Secure Communication", + "section_id": "V12.2", + "section_name": "HTTPS Communication with External Facing Services", + "req_id": "V12.2.2", + "req_description": "سرویس‌هایی که در معرض دسترسی خارجی قرار دارند از گواهی‌های TLS عمومی و مورد اعتماد استفاده می‌کنند.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Secure Communication", + "section_id": "V12.3", + "section_name": "General Service to Service Communication Security", + "req_id": "V12.3.1", + "req_description": "یک پروتکل رمزنگاری‌شده مانند TLS باید برای تمامی ارتباطات ورودی و خروجی به و از برنامه استفاده شود، از جمله سیستم‌های مانیتورینگ، ابزارهای مدیریت، دسترسی از راه دور و SSH، میان‌افزارها، پایگاه‌های داده، mainframes، سیستم‌های partner یا APIهای خارجی. سرور نباید به پروتکل‌های ناامن یا بدون رمزگذاری بازگردد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Secure Communication", + "section_id": "V12.3", + "section_name": "General Service to Service Communication Security", + "req_id": "V12.3.2", + "req_description": "کلاینت‌های TLS باید قبل از برقراری ارتباط با سرور TLS، گواهی‌های دریافتی را اعتبارسنجی کنند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Secure Communication", + "section_id": "V12.3", + "section_name": "General Service to Service Communication Security", + "req_id": "V12.3.3", + "req_description": "TLS یا دیگر مکانیزم‌های مناسب رمزگذاری انتقال باید برای تمامی ارتباطات بین سرویس‌های داخلی مبتنی بر HTTP درون برنامه استفاده شود و ارتباط به حالت‌های ناامن یا بدون رمزگذاری بازنگردد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Secure Communication", + "section_id": "V12.3", + "section_name": "General Service to Service Communication Security", + "req_id": "V12.3.4", + "req_description": "ارتباطات TLS بین سرویس‌های داخلی باید از گواهی‌های معتبر استفاده کنند. در صورتی که از گواهی‌های داخلی تولیدشده یا Self-Signed استفاده شود، سرویس مصرف‌کننده باید به‌گونه‌ای پیکربندی شود که تنها به CAهای داخلی مشخص و گواهی‌های Self-Signed خاص اعتماد کند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Secure Communication", + "section_id": "V12.3", + "section_name": "General Service to Service Communication Security", + "req_id": "V12.3.5", + "req_description": "سرویس‌هایی که درون یک سیستم با یکدیگر ارتباط دارند (ارتباطات درون‌سرویسی)، باید از احراز هویت قوی استفاده کنند تا هر نقطه انتهایی (endpoint) تأیید شود. روش‌های احراز هویت قوی، مانند احراز هویت کلاینت TLS، باید به‌کار گرفته شوند تا هویت تضمین شود (با استفاده از زیرساخت کلید عمومی (PKI) و مکانیزم‌هایی که در برابر حملات تکرار (replay attacks) مقاوم هستند). برای معماری‌های میکروسرویس، استفاده از سرویس مش برای ساده‌سازی مدیریت گواهی‌ها و افزایش امنیت در نظر گرفته شود", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.1", + "section_name": "Configuration Documentation", + "req_id": "V13.1.1", + "req_description": "تمامی نیازهای ارتباطی برنامه باید به‌طور کامل مستندسازی شده باشند. این مستندسازی شامل سرویس‌های خارجی که برنامه به آن‌ها وابسته است و همچنین مواردی که کاربر نهایی جهت اتصال به سرویس خارجی مشخص می‌کند باید باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.1", + "section_name": "Configuration Documentation", + "req_id": "V13.1.2", + "req_description": "برای هر سرویسی که برنامه استفاده می‌کند، مستندسازی باید شامل حداکثر تعداد ارتباطات همزمان (مثلاً محدودیت‌های Connection Pool) و نحوه‌ی رفتار برنامه هنگام رسیدن به این حد باشد، از جمله هر مکانیزم بازیابی یا جایگزین، تا از بروز شرایط Denial of Service جلوگیری شود.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.1", + "section_name": "Configuration Documentation", + "req_id": "V13.1.3", + "req_description": "مستندات برنامه باید استراتژی‌های مدیریت منابع را برای هر سیستم یا سرویس خارجی که استفاده می‌کند مشخص کرده باشد (مثلاً پایگاه‌های داده، هندل‌های فایل، رشته‌ها، اتصالات HTTP) این مستندسازی باید شامل این موارد باشد :رویه‌های آزادسازی منابع، تنظیمات تایم‌اوت، مدیریت خطاها، جایی که منطق Retry اعمال می‌شود، شامل محدودیت تعداد Retry، تأخیرها و الگوریتم‌هایBack-off. برای عملیات همزمان درخواست–پاسخ HTTP (Synchronous)، مستندات باید تایم‌اوت کوتاه را الزام کند و یا Retryها را غیرفعال کند یا به‌طور سختگیرانه محدود کند تا از تاخیرهای زنجیره‌ای و هدررفت منابع جلوگیری شود.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.1", + "section_name": "Configuration Documentation", + "req_id": "V13.1.4", + "req_description": "مستندسازی برنامه باید شامل secretهای حیاتی برای امنیت برنامه و همچنین برنامه‌ای برای چرخش آن‌ها باشد( بر اساس مدل تهدید سازمان و نیازهای کسب‌وکار).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Backend Communication Configuration", + "req_id": "V13.2.1", + "req_description": "رتباطات بین اجزای بک‌اند برنامه که از مکانیزم استاندارد نشست کاربران برنامه پشتیبانی نمی‌کنند، از جمله APIها، میان‌افزارها و لایه‌های داده، باید احراز هویت شده باشند. احراز هویت باید با استفاده از حساب‌های سرویس جداگانه، توکن‌های کوتاه‌مدت یا احراز هویت مبتنی بر گواهی انجام شود و نباید از اعتبارنامه‌های ثابت مانند رمز عبور، کلیدهای API یا حساب‌های مشترک با دسترسی‌های سطح بالا استفاده شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Backend Communication Configuration", + "req_id": "V13.2.2", + "req_description": "ارتباطات بین اجزای بک‌اند، از جمله سرویس‌های محلی یا سیستم‌عامل، APIها، میان‌افزارها و لایه‌های داده، با حساب‌هایی باید انجام شود که کمترین سطح دسترسی لازم را دارند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Backend Communication Configuration", + "req_id": "V13.2.3", + "req_description": "اگر اعتبارنامه‌ای برای احراز هویت سرویس استفاده می‌شود، اعتبارنامه‌ای که توسط مصرف‌کننده استفاده می‌شود، اعتبارنامه پیش‌فرض نباشد (مثلاً root/root یا admin/admin).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Backend Communication Configuration", + "req_id": "V13.2.4", + "req_description": "یک allowlist برای تعیین منابع یا سیستم‌های خارجی که برنامه مجاز به ارتباط با آن‌ها است باید وجود داشته باشد (مثلاً برای درخواست‌های خروجی، بارگذاری داده یا دسترسی به فایل). این allowlist می‌تواند در لایه برنامه، وب‌سرور، فایروال یا ترکیبی از لایه‌های مختلف پیاده‌سازی شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Backend Communication Configuration", + "req_id": "V13.2.5", + "req_description": "وب‌سرور یا سرور برنامه با یک allowlist از منابع یا سیستم‌هایی که سرور می‌تواند به آن‌ها درخواست ارسال کند یا داده‌ها و فایل‌ها را بارگذاری کند پیکربندی شده باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.2", + "section_name": "Backend Communication Configuration", + "req_id": "V13.2.6", + "req_description": "در مواقعی که برنامه به سرویس‌های جداگانه متصل می‌شود، پیکربندی مستندسازی‌شده برای هر اتصال رعایت شود، از جمله حداکثر ارتباطات همزمان، رفتار هنگام رسیدن به حداکثر ارتباط مجاز، زمان‌های Timeout اتصال و استراتژی‌های Retry.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.3", + "section_name": "Secret Management", + "req_id": "V13.3.1", + "req_description": "یک راهکار مدیریت secret، مانند Key Vault، برای ایجاد امن، ذخیره، کنترل دسترسی و از بین بردن secret بک‌اند استفاده شود. این secret می‌تواند شامل رمزعبورها، داده‌های رمز نگاری، اطلاعات حساس مربوط به اتصال به پایگاه داده و سیستم‌های شخص ثالث، کلیدها و seedهای توکن‌های زمان‌محور، سایر secretهای داخلی و کلیدهای API باشد. Secret نباید در کد منبع برنامه یا در build artifacts قرار گیرد. برای برنامه‌های L3، این باید شامل راهکاری مبتنی بر سخت‌افزار مانند HSM باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.3", + "section_name": "Secret Management", + "req_id": "V13.3.2", + "req_description": "دسترسی به دارایی‌های secret بر اساس اصل حداقل دسترسی (Least Privilege) رعایت شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.3", + "section_name": "Secret Management", + "req_id": "V13.3.3", + "req_description": "تمام عملیات رمزنگاری باید با استفاده از یک ماژول امنیتی ایزوله (مانند Vault یا Hardware Security Module) انجام شود تا مواد کلیدی به‌طور امن مدیریت و محافظت شده و از افشای خارج از ماژول امنیتی جلوگیری شود.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.3", + "section_name": "Secret Management", + "req_id": "V13.3.4", + "req_description": "secretها بر اساس مستندسازی برنامه طوری پیکربندی شوند که منقضی شده و چرخش داده شوند.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Unintended Information Leakage", + "req_id": "V13.4.1", + "req_description": "برنامه باید به‌گونه‌ای مستقر شود که هیچ‌گونه متادیتای کنترل نسخه، از جمله پوشه‌های .git یا .svn، در دسترس نباشد یا به شکلی باشد که این پوشه‌ها نه از بیرون و نه توسط خود برنامه قابل دسترسی نباشند.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Unintended Information Leakage", + "req_id": "V13.4.2", + "req_description": "حالت‌های Debug برای تمام اجزا در محیط‌های production باید غیرفعال شده باشند تا از افشای قابلیت‌های دیباگ و نشت اطلاعات جلوگیری شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Unintended Information Leakage", + "req_id": "V13.4.3", + "req_description": "وب‌سرورها فهرست‌بندی دایرکتوری‌ها را به کاربر نهایی نباید نمایش دهند مگر اینکه به‌طور صریح مورد نظر باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Unintended Information Leakage", + "req_id": "V13.4.4", + "req_description": "از متد HTTP TRACE در محیط‌های production نباید پشتیبانی شود تا از احتمال نشت اطلاعات جلوگیری شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Unintended Information Leakage", + "req_id": "V13.4.5", + "req_description": "مستندسازی‌ها (مانند مستندات APIهای داخلی) و نقاط پایش (Monitoring Endpoints) در دسترس نباشند مگر اینکه به‌طور صریح مورد نظر باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Unintended Information Leakage", + "req_id": "V13.4.6", + "req_description": "تأیید کنید که برنامه اطلاعات نسخه دقیق اجزای backend را افشا نکند.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Configuration", + "section_id": "V13.4", + "section_name": "Unintended Information Leakage", + "req_id": "V13.4.7", + "req_description": "لایه وب باید به‌گونه‌ای پیکربندی شده باشد که فقط فایل‌هایی با پسوندهای مشخص را سرو کند تا از افشای تصادفی اطلاعات، پیکربندی و کد منبع جلوگیری شود.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Data Protection", + "section_id": "V14.1", + "section_name": "Data Protection Documentation", + "req_id": "V14.1.1", + "req_description": "تمامی داده‌های حساس ایجادشده و پردازش‌شده توسط برنامه باید شناسایی شده و بر اساس سطوح حفاظتی طبقه‌بندی شده‌اند. این موضوع شامل داده‌هایی می‌شود که صرفاً کُدگذاری شده‌اند و به‌راحتی قابل بازیابی هستند، مانند رشته‌های Base64 یا محتوای متنی (plaintext) داخل یک JWT. سطوح حفاظتی باید الزامات قوانین و استانداردهای حفاظت از داده و حریم خصوصی که برنامه ملزم به رعایت آن‌هاست را در نظر بگیرند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Data Protection", + "section_id": "V14.1", + "section_name": "Data Protection Documentation", + "req_id": "V14.1.2", + "req_description": "برای تمامی سطوح حفاظت از داده‌های حساس، مجموعه‌ای مستند از الزامات حفاظتی تعریف شده باشد. این الزامات باید شامل (اما محدود به آن نباشد) موارد زیر باشند: الزامات مرتبط با رمزنگاری کلی، بررسی صحت و یکپارچگی، دوره‌های نگهداری داده، نحوه ثبت داده‌ها در لاگ، کنترل‌های دسترسی به داده‌های حساس در لاگ‌ها، رمزنگاری در سطح پایگاه داده، الزامات مربوط به حریم خصوصی و فناوری‌های تقویت‌کننده حریم خصوصی مورد استفاده، و سایر الزامات مرتبط با محرمانگی.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Data Protection", + "section_id": "V14.2", + "section_name": "General Data Protection", + "req_id": "V14.2.1", + "req_description": "داده‌های حساس باید فقط در بدنه پیام HTTP یا فیلدهای هدر به سرور ارسال شوند، و اینکه URL و query string شامل اطلاعات حساس (مانند API key یا session token) نباشند.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Data Protection", + "section_id": "V14.2", + "section_name": "General Data Protection", + "req_id": "V14.2.2", + "req_description": "برنامه باید از cache شدن داده‌های حساس در اجزای سرور مانند Load Balancer و Application Cache جلوگیری کند، یا اطمینان حاصل شود که داده‌ها پس از استفاده به‌طور ایمن پاک‌سازی می‌شوند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Data Protection", + "section_id": "V14.2", + "section_name": "General Data Protection", + "req_id": "V14.2.3", + "req_description": "داده‌های حساس تعریف‌شده به طرف‌های غیرقابل اعتماد (مانند User Trackers) نباید ارسال شوند تا از جمع‌آوری ناخواسته داده‌ها خارج از کنترل برنامه جلوگیری شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Data Protection", + "section_id": "V14.2", + "section_name": "General Data Protection", + "req_id": "V14.2.4", + "req_description": "کنترل‌های مرتبط با داده‌های حساس شامل رمزنگاری، بررسی صحت و یکپارچگی، نگهداری، نحوه ثبت داده‌ها در لاگ، کنترل‌های دسترسی به داده‌های حساس در لاگ‌ها، حریم خصوصی و فناوری‌های مربوط به حریم خصوصی، مطابق با آنچه در مستندات برای سطح حفاظت مشخص هر داده تعریف شده است، پیاده‌سازی شوند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Data Protection", + "section_id": "V14.2", + "section_name": "General Data Protection", + "req_id": "V14.2.5", + "req_description": "مکانیزم‌های cache باید طوری پیکربندی شده باشند که تنها پاسخ‌هایی با نوع محتوای مورد انتظار برای آن منبع cache شوند و شامل محتوای حساس یا پویا نباشند. وب‌سرور باید هنگام دسترسی به فایل ناموجود، پاسخ 404 یا 302 برگرداند و نه فایل معتبر دیگر، تا از حملات Web Cache Deception جلوگیری شود.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Data Protection", + "section_id": "V14.2", + "section_name": "General Data Protection", + "req_id": "V14.2.6", + "req_description": "برنامه باید تنها حداقل داده‌های حساس مورد نیاز برای عملکرد برنامه را بازگرداند. برای مثال، تنها برخی از ارقام شماره کارت اعتباری بازگردانده شود و نه شماره کامل. در صورتی که داده کامل لازم باشد، باید در رابط کاربری masked شود مگر اینکه کاربر به‌طور مشخص آن را مشاهده کند.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Data Protection", + "section_id": "V14.2", + "section_name": "General Data Protection", + "req_id": "V14.2.7", + "req_description": "اطلاعات حساس باید تحت طبقه‌بندی دوره‌ای نگهداری داده قرار گرفته باشند، به‌گونه‌ای که داده‌های قدیمی یا غیرضروری به‌طور خودکار، در یک برنامه زمان‌بندی‌شده مشخص، یا براساس نیاز حذف شوند.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Data Protection", + "section_id": "V14.2", + "section_name": "General Data Protection", + "req_id": "V14.2.8", + "req_description": "اطلاعات حساس باید از متادیتای فایل‌های ارسال‌شده توسط کاربر حذف شود، مگر اینکه ذخیره‌سازی آن با رضایت کاربر انجام شود.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Data Protection", + "section_id": "V14.3", + "section_name": "Client-side Data Protection", + "req_id": "V14.3.1", + "req_description": "داده‌های احراز هویت‌شده از حافظه کلاینت، مانند DOM مرورگر، پس از خروج کلاینت یا Session پاک شوند. فیلد هدر Clear-Site-Data در پاسخ سرور می‌تواند در این زمینه مفید باشد، اما کلاینت باید بتواند داده‌ها را حتی زمانی که اتصال به سرور در دسترس نیست در زمان پایان Session (خروج از آن) پاک کند.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Data Protection", + "section_id": "V14.3", + "section_name": "Client-side Data Protection", + "req_id": "V14.3.2", + "req_description": "برنامه باید هدرهای پاسخ HTTP، anti-cach مناسب (مانند Cache-Control: no-store) را تنظیم کند تا داده‌های حساس در مرورگرها cache نشوند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Data Protection", + "section_id": "V14.3", + "section_name": "Client-side Data Protection", + "req_id": "V14.3.3", + "req_description": "برای اطلاعات بیشتر، همچنین به منابع زیر مراجعه کنید:", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.1", + "section_name": "Secure Coding and Architecture Documentation", + "req_id": "V15.1.1", + "req_description": "مستندات برنامه باید بازه‌های زمانی جهت برطرف سازی آسیب‌پذیری‌ نسخه‌های مؤلفه‌ شخص ثالث (بر اساس ریسک) و همچنین به‌روزرسانی کتابخانه‌ها را به طور کلی تعریف کرده باشد تا ریسک ناشی از این مؤلفه‌ها به حداقل برسد.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.1", + "section_name": "Secure Coding and Architecture Documentation", + "req_id": "V15.1.2", + "req_description": "یک کاتالوگ دارایی مانند Software Bill of Materials (SBOM) باید برای تمامی کتابخانه‌های شخص ثالث مورد استفاده نگهداری شود. شامل تایید این که مؤلفه‌ها از مخازن از پیش تعیین‌شده، قابل اعتماد و به‌طور مستمر نگهداری‌شده تهیه شده‌اند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.1", + "section_name": "Secure Coding and Architecture Documentation", + "req_id": "V15.1.3", + "req_description": "مستندات برنامه باید شامل عملکردهایی که زمان‌بر یا پرمصرف(منابع سیستمی) هستند نیز باشد. این مورد باید شامل روش‌هایی برای جلوگیری از دست‌رفتن دسترس‌پذیری به دلیل استفاده بیش از حد از این عملکردها و همچنین جلوگیری از وضعیتی باشد که پردازش یک پاسخ طولانی‌تر از زمان انتظار مصرف‌کننده شود. تدابیر احتمالی می‌تواند شامل پردازش غیرهمزمان، استفاده از صف‌ها و محدود کردن فرآیندهای موازی برای هر کاربر و هر برنامه باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.1", + "section_name": "Secure Coding and Architecture Documentation", + "req_id": "V15.1.4", + "req_description": "مستندات برنامه باید کتابخانه‌های شخص ثالثی را که به‌عنوان «کامپوننت‌های پرخطر» شناخته می‌شوند، مشخص کرده باشد.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.1", + "section_name": "Secure Coding and Architecture Documentation", + "req_id": "V15.1.5", + "req_description": "مستندات برنامه باید بخش‌هایی از برنامه را که به‌عنوان «عملکرد خطرناک» استفاده می‌شود، مشخص کرده باشد.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.2", + "section_name": "Security Architecture and Dependencies", + "req_id": "V15.2.1", + "req_description": "برنامه باید تنها شامل کامپوننت‌هایی باشد که چارچوب‌های زمانی مستند‌شده برای به‌روزرسانی و رفع آسیب‌پذیری‌ها را نقض نکرده‌باشند.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.2", + "section_name": "Security Architecture and Dependencies", + "req_id": "V15.2.2", + "req_description": "برنامه باید بر اساس تصمیمات و استراتژی‌های امنیتی مستندسازی‌شده، تدابیری برای جلوگیری از کاهش دسترس‌پذیری ناشی از عملکردهایی که زمان‌بر یا پرمصرف منابع هستند، پیاده‌سازی کرده باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.2", + "section_name": "Security Architecture and Dependencies", + "req_id": "V15.2.3", + "req_description": "محیط production تنها شامل عملکردهایی می‌باشد که برای اجرای برنامه ضروری هستند و هیچ قابلیت اضافی مانند کدهای تست، نمونه‌کدها و عملکردهای توسعه‌ای در دسترس نمی‌باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.2", + "section_name": "Security Architecture and Dependencies", + "req_id": "V15.2.4", + "req_description": "کامپوننت‌های شخص ثالث و تمام وابستگی‌های انتقالی آن‌ها از مخزن مورد انتظار باید دریافت ‌شوند، چه داخلی و چه منبع خارجی، و ریسک حمله‌ی dependency confusion مدیریت شود.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.2", + "section_name": "Security Architecture and Dependencies", + "req_id": "V15.2.5", + "req_description": "برنامه باید محافظت‌های اضافی را در بخش‌هایی از برنامه که به‌عنوان «عملکرد خطرناک» مستند شده‌اند یا از کتابخانه‌های شخص ثالثی که به‌عنوان «کامپوننت‌های پرریسک» شناخته می‌شوند، پیاده‌سازی می‌کند. این می‌تواند شامل تکنیک‌هایی مانند sandboxing، encapsulation، containerization یا جداسازی در سطح شبکه باشد تا حمله‌کنندگان پس از نفوذ به یک بخش از برنامه، نتوانند به بخش‌های دیگر برنامه منتقل شوند و زمان لازم برای پیشروی آن‌ها افزایش یابد.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.3", + "section_name": "Defensive Coding", + "req_id": "V15.3.1", + "req_description": "برنامه باید تنها زیرمجموعه‌ای از فیلدهای مورد نیاز از یک data object را بازگرداند. به‌عنوان مثال، نباید کل data object بازگردانده شود، زیرا برخی فیلدهای منفرد نباید برای کاربران قابل دسترسی باشند.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.3", + "section_name": "Defensive Coding", + "req_id": "V15.3.2", + "req_description": "در جایی که بک‌اند برنامه به URLهای خارجی فراخوانی می‌فرستد، طوری باید پیکربندی شده باشد که تنها در صورت نیاز و منظور مشخص، از تغییر مسیرها (redirects) پیروی کند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.3", + "section_name": "Defensive Coding", + "req_id": "V15.3.3", + "req_description": "برنامه باید دارای تدابیر مقابله‌ای برای محافظت در برابر حملات mass assignment باشد، به‌طوری که فیلدهای مجاز برای هر کنترلر و اکشن محدود شده باشند؛ به عنوان مثال، نباید بتوان مقداری برای فیلدی وارد یا به‌روزرسانی کرد که قرار نبوده بخشی از آن اکشن باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.3", + "section_name": "Defensive Coding", + "req_id": "V15.3.4", + "req_description": "تمام اجزای proxying و middleware باید آدرس IP اصلی کاربر را به‌درستی منتقل کنند، با استفاده از فیلدهای داده معتبر که توسط کاربر نهایی قابل دستکاری نباشند، و برنامه و وب‌سرور از این مقدار صحیح برای ثبت لاگ و تصمیم‌گیری‌های امنیتی مانند rate limiting استفاده کنند، با در نظر گرفتن اینکه حتی آدرس IP اصلی ممکن است به دلیل IPهای پویا، VPNها یا فایروال‌های سازمانی قابل اعتماد نباشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.3", + "section_name": "Defensive Coding", + "req_id": "V15.3.5", + "req_description": "برنامه باید به‌طور صریح اطمینان حاصل کند که variables از نوع صحیح هستند و عملیات‌های مقایسه و comparator به‌صورت دقیق (strict) انجام می‌شوند. این اقدام برای جلوگیری از آسیب‌پذیری‌های type juggling یا type confusion است که ممکن است به دلیل فرضیات نادرست برنامه درباره نوع یک متغیر ایجاد شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.3", + "section_name": "Defensive Coding", + "req_id": "V15.3.6", + "req_description": "کد JavaScript باید به‌گونه‌ای نوشته شده باشد که از prototype pollution جلوگیری کند، برای مثال با استفاده از Set() یا Map() به جای object literals.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.3", + "section_name": "Defensive Coding", + "req_id": "V15.3.7", + "req_description": "برنامه باید دارای تدابیر محافظتی در برابر HTTP parameter pollution باشد، به‌ویژه اگر چارچوب برنامه تفاوتی بین منابع پارامترهای درخواست (رشته‌های query، پارامترهای body، کوکی‌ها یا فیلدهای هدر) قائل نشود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.4", + "section_name": "Safe Concurrency", + "req_id": "V15.4.1", + "req_description": "shared objects در کد multi-threaded (مانند cacheها، فایل‌ها، یا اشیائی که توسط multiple threads دسترسی پیدا می‌کنند) باید به‌صورت ایمن مورد استفاده قرار بگیرند، با استفاده از نوع‌های thread-safe و مکانیزم‌های همگام‌سازی مانند lock یا semaphore تا از race condition و تخریب داده جلوگیری شود.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.4", + "section_name": "Safe Concurrency", + "req_id": "V15.4.2", + "req_description": "بررسی وضعیت یک resource، مانند وجود آن یا دسترسی‌ها،و اقداماتی که به این وضعیت وابسته‌اند، به‌صورت یک عملیات واحد انجام شوند تا از race condition نوع time-of-check to time-of-use (TOCTOU) جلوگیری شود. برای مثال، بررسی اینکه یک فایل وجود دارد قبل از باز کردن آن، یا تأیید دسترسی یک کاربر قبل از اعطای آن.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.4", + "section_name": "Safe Concurrency", + "req_id": "V15.4.3", + "req_description": "باید از قفل‌ها (Locks) به طور یکنواخت استفاده شود تا از گیر کردن (Threads) جلوگیری شود، چه با انتظار برای یکدیگر و چه با تلاش بی‌پایان، و همچنین منطق قفل‌گذاری باید در همان کدی باقی بماند که مسئول مدیریت منبع است؛ این کار تضمین می‌کند که قفل‌ها نمی‌توانند به‌صورت ناخواسته یا خرابکارانه توسط کلاس‌ها یا کدهای بیرونی تغییر داده شوند.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Secure Coding and Architecture", + "section_id": "V15.4", + "section_name": "Safe Concurrency", + "req_id": "V15.4.4", + "req_description": "تأیید کنید که سیاست‌های تخصیص resource از thread starvation جلوگیری می‌کنند، با اطمینان از دسترسی عادلانه به منابع، مانند استفاده از thread pools و اجازه دادن به threads با اولویت پایین‌تر تا در بازه زمانی منطقی پیشرفت کنند.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.1", + "section_name": "Security Logging Documentation", + "req_id": "V16.1.1", + "req_description": "فهرستی باید وجود داشته باشد که در آن ثبت وقایع (Logging) انجام‌شده در هر لایه از stack فناوری برنامه، رویدادهای ثبت‌شده، فرمت‌های لاگ، محل ذخیره‌سازی، نحوه استفاده، نحوه کنترل دسترسی به آن‌ها و مدت زمان نگهداری لاگ‌ها مستند شده است.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.2", + "section_name": "General Logging", + "req_id": "V16.2.1", + "req_description": "هر ورودی لاگ باید شامل متادیتای لازم (مانند زمان، مکان، چه کسی و چه چیزی) باشد تا امکان بررسی دقیق خط زمانی هنگام وقوع یک رویداد فراهم شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.2", + "section_name": "General Logging", + "req_id": "V16.2.2", + "req_description": "منابع زمانی برای تمام مؤلفه‌های لاگ با هم همگام‌سازی شده‌اند و مهر زمان (timestamp)‌ در متادیتای رویدادهای امنیتی از UTC استفاده ‌کند یا شامل یک اختلاف‌زمان (time zone offset) صریح باشد. استفاده از UTC توصیه می‌شود تا یکپارچگی در سراسر سیستم‌های توزیع‌شده تضمین شود و از بروز سردرگمی در زمان تغییر ساعت تابستانی جلوگیری گردد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.2", + "section_name": "General Logging", + "req_id": "V16.2.3", + "req_description": "برنامه تنها لاگ‌ها را در فایل‌ها و سرویس‌هایی ذخیره یا ارسال می‌کند که در فهرست مستند لاگ‌ها ثبت شده‌اند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.2", + "section_name": "General Logging", + "req_id": "V16.2.4", + "req_description": "لاگ‌ها باید توسط پردازشگر لاگی که در حال استفاده است خوانده و همبسته شوند، و ترجیحاً با استفاده از یک فرمت لاگ مشترک این کار انجام گیرد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.2", + "section_name": "General Logging", + "req_id": "V16.2.5", + "req_description": "هنگام لاگ‌گیری از داده‌های حساس، برنامه باید لاگ گیری را بر اساس سطح حفاظت داده اعمال کند. برای مثال، ممکن است لاگ‌کردن برخی داده‌ها مانند اطلاعات ورود یا جزئیات پرداخت مجاز نباشد. داده‌های دیگر، مانند session token، تنها در صورتی باید لاگ شوند که به‌صورت hash یا masked، چه به‌طور کامل یا جزئی، ثبت شوند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.3", + "section_name": "Security Events", + "req_id": "V16.3.1", + "req_description": "تمام عملیات احراز هویت باید لاگ‌گیری ‌شوند، از جمله تلاش‌های موفق و ناموفق. همچنین باید متادیتای اضافی، مانند نوع احراز هویت یا عوامل استفاده‌شده، جمع‌آوری شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.3", + "section_name": "Security Events", + "req_id": "V16.3.2", + "req_description": "تلاش‌های ناموفق برای مجوزدهی (authorization) باید لاگ‌گیری ‌شوند. برای برنامه‌های L3، این باید شامل لاگ‌گیری تمام تصمیمات مجوزدهی باشد، از جمله ثبت زمانی که داده‌های حساس دسترسی پیدا می‌کنند، بدون آنکه خود داده‌های حساس ثبت شوند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.3", + "section_name": "Security Events", + "req_id": "V16.3.3", + "req_description": "برنامه باید رویدادهای امنیتی تعریف‌شده در مستندات (ابتدای بخش) را لاگ‌ نماید و همچنین تلاش‌ها برای دور زدن کنترل‌های امنیتی، مانند اعتبارسنجی ورودی، منطق کسب‌وکار و ضد‌خودکارسازی، را نیز ثبت ‌کند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.3", + "section_name": "Security Events", + "req_id": "V16.3.4", + "req_description": "برنامه باید خطاهای غیرمنتظره و شکست‌های کنترل‌های امنیتی، مانند شکست‌های TLS در بک اند را لاگ ‌کند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.4", + "section_name": "Log Protection", + "req_id": "V16.4.1", + "req_description": "تمام مؤلفه‌های لاگ‌گیری باید داده‌ها را به‌طور مناسب رمزگذاری ‌کنند تا از حملات log injection جلوگیری شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.4", + "section_name": "Log Protection", + "req_id": "V16.4.2", + "req_description": "لاگ‌ها باید در برابر دسترسی غیرمجاز محافظت شده و امکان تغییر آن‌ها وجود نداشته باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.4", + "section_name": "Log Protection", + "req_id": "V16.4.3", + "req_description": "لاگ‌ها به‌صورت امن باید به یک سیستم منطقی جداگانه برای تحلیل، تشخیص، هشدار و ارجاع منتقل شوند. هدف این است که در صورت نفوذ به برنامه، لاگ‌ها به خطر نیفتند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.5", + "section_name": "Error Handling", + "req_id": "V16.5.1", + "req_description": "هنگام بروز خطاهای غیرمنتظره یا حساس به امنیت، پیامی عمومی به کاربر باید بازگردانده ‌شود، به‌گونه‌ای که هیچ‌گونه اطلاعات حساس داخلی سیستم مانند stack trace، کوئری‌ها، کلیدها و توکن‌های محرمانه افشا نشود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.5", + "section_name": "Error Handling", + "req_id": "V16.5.2", + "req_description": "برنامه باید هنگام بروز خطا در دسترسی به منابع خارجی همچنان به‌صورت امن عمل نماید، برای مثال با استفاده از الگوهایی مانند circuit breaker یا کاهش تدریجی عملکرد (graceful degradation).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.5", + "section_name": "Error Handling", + "req_id": "V16.5.3", + "req_description": "برنامه باید به‌صورت امن و کنترل‌شده دچار خطا ‌شود، حتی هنگام وقوع استثنا، و از شرایط fail-open جلوگیری نماید؛ برای مثال، از پردازش تراکنش در صورت بروز خطا در منطق اعتبارسنجی جلوگیری شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Security Logging and Error Handling", + "section_id": "V16.5", + "section_name": "Error Handling", + "req_id": "V16.5.4", + "req_description": "یک « last resort» باید تعریف شده باشد که تمامی unhandled exception را مدیریت کند. این کار هم برای جلوگیری از از دست رفتن جزئیات خطا که باید در فایل‌های لاگ ثبت شوند و هم برای اطمینان از این است که خطا باعث از کار افتادن کل فرآیند برنامه و در نتیجه از دست رفتن دسترسی نشود، ضروری است.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.1", + "section_name": "TURN Server", + "req_id": "V17.1.1", + "req_description": "سرویس Traversal Using Relays around NAT (TURN) باید تنها به آدرس‌های IP دسترسی دهد که برای اهداف ویژه رزرو نشده‌اند (مثلاً شبکه‌های داخلی، broadcast، loopback). توجه داشته باشید که این مورد هم برای آدرس‌های IPv4 و هم برای IPv6 صدق می‌کند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.1", + "section_name": "TURN Server", + "req_id": "V17.1.2", + "req_description": "سرویس Traversal Using Relays around NAT (TURN)، نباید به resource exhaustion آسیب‌پذیر باشد، حتی زمانی که کاربران قانونی تلاش کنند تعداد زیادی پورت روی سرور TURN باز کنند.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Media", + "req_id": "V17.2.1", + "req_description": "کلید مربوط به گواهی Datagram Transport Layer Security (DTLS) بر اساس سیاست مستند مدیریت کلیدهای رمزنگاری مدیریت و محافظت می‌شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Media", + "req_id": "V17.2.2", + "req_description": "سرور Media طوری پیکربندی شده باشد که از مجموعه‌های رمزنگاری تاییدشده Datagram Transport Layer Security (DTLS) استفاده کند و از یک پروفایل محافظتی امن برای گسترش DTLS به منظور ایجاد کلیدها برای پروتکل Secure Real-time Transport Protocol (DTLS-SRTP) پشتیبانی نماید.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Media", + "req_id": "V17.2.3", + "req_description": "احراز هویت Secure Real-time Transport Protocol (SRTP) در سرور Media بررسی ‌شود تا از حملات تزریق Real-time Transport Protocol (RTP) جلوگیری شده و این حملات باعث بروز شرایط Denial of Service یا وارد شدن محتوای صوتی یا تصویری ناخواسته به جریان‌های رسانه‌ای نشوند.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Media", + "req_id": "V17.2.4", + "req_description": "سرور Media باید قادر باشد پردازش ترافیک رسانه‌ای ورودی را حتی هنگام مواجهه با بسته‌های Secure Real-time Transport Protocol (SRTP) ناقص یا خراب ادامه دهد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Media", + "req_id": "V17.2.5", + "req_description": "سرور Media باید قادر باشد پردازش ترافیک رسانه‌ای ورودی را حتی در هنگام دریافت سیلی(flood) از بسته‌های Secure Real-time Transport Protocol (SRTP) از کاربران قانونی ادامه دهد.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Media", + "req_id": "V17.2.6", + "req_description": "سرور Media نسبت به آسیب‌پذیری \"ClientHello Race Condition \" در Datagram Transport Layer Security (DTLS) نباید آسیب‌پذیر نباشد، این کار می‌تواند با بررسی اینکه آیا سرور رسانه به‌صورت عمومی به عنوان آسیب‌پذیر شناخته شده است یا با انجام آزمون Race Condition انجام شود.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Media", + "req_id": "V17.2.7", + "req_description": "مکانیزم‌های ضبط صدا یا تصویر مرتبط با سرور رسانه در هنگام طوفان بسته‌ای (Flood) از پروتکل انتقال بلادرنگ امن (SRTP) توسط کاربران مجاز، باید قادر به ادامه پردازش ترافیک رسانه ورودی است.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Media", + "req_id": "V17.2.8", + "req_description": "گواهی‌نامه امنیت لایه انتقال دیتاگرام (DTLS) باید با ویژگی اثر انگشت (Fingerprint) پروتکل توصیف نشست (SDP) بررسی می‌شود و در صورت شکست در بررسی، جریان رسانه قطع می‌شود تا اصالت جریان رسانه تضمین گردد.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.3", + "section_name": "Signaling", + "req_id": "V17.3.1", + "req_description": "سرور سیگنالینگ باید قادر باشد حتی در جریان flood attack، پیام‌های سیگنالینگ ورودی مشروع را پردازش کند. این باید با اعمال محدودیت نرخ (rate limiting) در سطح سیگنالینگ محقق شود.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.3", + "section_name": "Signaling", + "req_id": "V17.3.2", + "req_description": "سرور سیگنالینگ باید قادر باشد پیام‌های سیگنالینگ مشروع را حتی در مواجهه با پیام‌های سیگنالینگ ناقص یا مخرب که می‌توانند باعث ایجاد شرایط عدم دسترسی (Denial of Service) شوند، پردازش کند. این می‌تواند شامل اعمال اعتبارسنجی ورودی، مدیریت ایمن سرریز عدد صحیح (integer overflow)، جلوگیری از سرریز بافر (buffer overflow) و استفاده از دیگر تکنیک‌های مقاوم مدیریت خطا باشد.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + } + ] +} diff --git a/5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.json b/5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.json new file mode 100644 index 0000000000..69517b1afe --- /dev/null +++ b/5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.json @@ -0,0 +1,2774 @@ +{ + "Name": "Application Security Verification Standard Project", + "ShortName": "ASVS", + "Version": "5.0.0", + "Description": "The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.", + "Requirements": [ + { + "Shortcode": "V1", + "Ordinal": 1, + "ShortName": "Encoding", + "Name": "Encoding and Sanitization", + "Items": [ + { + "Shortcode": "V1.1", + "Ordinal": 1, + "Name": "ساختار Encoding and Sanitization", + "Items": [ + { + "Shortcode": "V1.1.1", + "Ordinal": 1, + "Description": "ورودی فقط یک‌بار به فرم استاندارد decoded یا unescaped شود، و این تنها زمانی انجام شود که انتظار می‌رود داده واقعاً در آن قالب رمزگذاری‌شده دریافت شده باشد. این فرآیند باید قبل از هرگونه پردازش بعدی روی ورودی انجام شود، و به‌هیچ‌وجه نباید پس از اعتبارسنجی یا پاک‌سازی انجام گیرد.", + "L": "2" + }, + { + "Shortcode": "V1.1.2", + "Ordinal": 2, + "Description": "برنامه فرآیند encode و escape خروجی را به‌عنوان آخرین مرحله انجام می‌دهد؛ به‌گونه‌ای که این عملیات یا دقیقاً پیش از استفاده داده در مفسر مربوطه انجام شود، یا اینکه خود مفسر به‌طور داخلی این کار را انجام دهد.", + "L": "2" + } + ] + }, + { + "Shortcode": "V1.2", + "Ordinal": 2, + "Name": "پیشگیری از تزریق", + "Items": [ + { + "Shortcode": "V1.2.1", + "Ordinal": 1, + "Description": "encoding خروجی برای پاسخ HTTP، سند HTML یا سند XML با زمینه‌ای که داده در آن استفاده می‌شود باید متناسب باشد؛ برای مثال، در رمزگذاری کاراکترهای مربوط به عناصر HTML، صفات HTML، توضیحات HTML، CSS یا فیلدهای هدر HTTP به‌گونه‌ای عمل شود که ساختار پیام یا سند تغییر نکند.", + "L": "1" + }, + { + "Shortcode": "V1.2.2", + "Ordinal": 2, + "Description": "هنگام ساخت پویا آدرس‌های URL، داده‌های غیرقابل‌اعتماد باید متناسب با زمینه استفاده‌شان رمزگذاری شوند (مثلاً URL Encoding یا base64url برای پارامترهای کوئری یا مسیر) همچنین اطمینان حاصل شود که فقط پروتکل‌های امن در URL مجاز باشند (برای نمونه، استفاده از JavaScript: یا data: ممنوع شود)", + "L": "1" + }, + { + "Shortcode": "V1.2.3", + "Ordinal": 3, + "Description": "هنگام تولید پویا محتوای JavaScript (از جملهJSON)، از encoding یا escaping خروجی استفاده شود تا از تغییر ساختار پیام یا سند جلوگیری گردد (و از حملات تزریق JavaScript یا JSON پیشگیری شود).", + "L": "1" + }, + { + "Shortcode": "V1.2.4", + "Ordinal": 4, + "Description": "در انتخاب داده یا اجرای کوئری‌های پایگاه داده (مانند SQL، HQL، NoSQL ...)، از parameterized queries، ORMها، یا Entity Framework استفاده شود یا به روش‌های دیگر، برنامه در برابر تزریق SQL و سایر حملات تزریقی پایگاه داده ایمن شده باشد. این موضوع هنگام نوشتن stored procedure‌ها نیز صدق می‌کند.", + "L": "1" + }, + { + "Shortcode": "V1.2.5", + "Ordinal": 5, + "Description": "برنامه در برابر تزریق دستورات سیستم‌عامل (OS command injection) محافظت شده است و در فراخوانی‌های سیستم‌عامل، از کوئری‌های پارامتری‌شده سیستم‌عامل یا Encoding خروجی دستورات سیستم‌عاملی استفاده می‌شود.", + "L": "1" + }, + { + "Shortcode": "V1.2.6", + "Ordinal": 6, + "Description": "برنامه در برابر آسیب‌پذیری‌های تزریق LDAP محافظت شده است، یا اینکه کنترل‌های امنیتی مشخصی برای جلوگیری از تزریق LDAP پیاده‌سازی شده‌اند.", + "L": "2" + }, + { + "Shortcode": "V1.2.7", + "Ordinal": 7, + "Description": "برنامه در برابر حملات تزریقXPath، به‌وسیله‌ی استفاده از کوئری‌های پارامتری‌شده یا کوئری‌های از پیش‌کامپایل‌شده محافظت شده باشد.", + "L": "2" + }, + { + "Shortcode": "V1.2.8", + "Ordinal": 8, + "Description": "پردازشگرهای LaTeX به‌صورت امن پیکربندی شده‌اند (برای نمونه با عدم استفاده از گزینه‌ی --shell-escape ) و از فهرست مجاز دستورات (allowlist) برای جلوگیری از حملات تزریق LaTeX استفاده شده است.", + "L": "2" + }, + { + "Shortcode": "V1.2.9", + "Ordinal": 9, + "Description": "برنامه کاراکترهای ویژه در عبارات Regex را escape می‌کند (معمولاً با استفاده از \\)، تا این کاراکترها به‌اشتباه به‌عنوان متاکاراکتر تفسیر نشوند.", + "L": "2" + }, + { + "Shortcode": "V1.2.10", + "Ordinal": 10, + "Description": "برنامه در برابر حملات تزریق CSV و فرمول (Formula Injection) محافظت شده است. برنامه باید هنگام خروجی‌ گرفتن فایل‌های CSV، از قوانین escape تعیین‌شده در بخش‌های ۲.۶ و ۲.۷ استاندارد RFC 4180 پیروی کند. همچنین، هنگام خروجی گرفتن به فرمت CSV یا سایر فرمت‌های صفحه‌گسترده (مانند XLS، XLSX یا ODF)، اگر کاراکترهای ویژه‌ای مانند '='، '+'، '-'، '@'، \\t (tab) و 0\\ (Null character) در ابتدای مقدار یک فیلد قرار داشته باشند، باید با یک تک‌کوتیشن (') escape شوند.", + "L": "3" + } + ] + }, + { + "Shortcode": "V1.3", + "Ordinal": 3, + "Name": "پاک‌سازی (Sanitization)", + "Items": [ + { + "Shortcode": "V1.3.1", + "Ordinal": 1, + "Description": "تمام ورودی‌های HTML غیرقابل اعتماد (مثلاً از طریق ویرایشگرهای WYSIWYG یا ابزارهای مشابه)، با استفاده از یک کتابخانه یا قابلیت امن و معتبر sanitization (پاک‌سازی) ‌شوند.", + "L": "1" + }, + { + "Shortcode": "V1.3.2", + "Ordinal": 2, + "Description": "برنامه استفاده از تابعeval یا سایر قابلیت‌های اجرای پویا (dynamic) کد، مانند Spring Expression Language (SpEL)، اجتناب ‌کند. در مواردی که استفاده از این قابلیت‌ها اجتناب‌ناپذیر است، ورودی‌های کاربر که در اجرای کد گنجانده می‌شوند باید پیش از اجرا، به‌طور کامل پاک‌سازی (sanitized) شوند.", + "L": "1" + }, + { + "Shortcode": "V1.3.3", + "Ordinal": 3, + "Description": "بخش‌های حائز اهمیت که احتمال وقوع حملات ناشی از ورودی‌های کاربر در آنها بالاست؛ باید پیشاپیش عملیاتSanitization جهت اقدامات ایمنی روی داده‌ها انجام شود؛ برای مثال، تنها کاراکترهایی که برای آن محتوا ایمن محسوب می‌شوند مجاز باشند، و ورودی‌های بیش‌از‌حد بلند نیز کوتاه (trim) شوند.", + "L": "2" + }, + { + "Shortcode": "V1.3.4", + "Ordinal": 4, + "Description": "محتوای اسکریپت‌پذیر (scriptable) فایل‌های SVG که توسط کاربر ارائه می‌شود، مورد اعتبارسنجی یا پاک‌سازی (sanitization) قرار گرفته باشد تا فقط شامل تگ‌ها و ویژگی‌هایی (attributes) باشد که برای برنامه ایمن هستند؛ برای مثال، از درج اسکریپت‌ها و عناصر خطرناک مانند foreignObject جلوگیری شده باشد.", + "L": "2" + }, + { + "Shortcode": "V1.3.5", + "Ordinal": 5, + "Description": "برنامه محتوای زبان‌های قالب‌نویسی یا اسکریپت‌پذیر ارائه‌شده توسط کاربر، مانند Markdown، CSS یا استایل‌شیت‌های XSL، BBCode یا موارد مشابه را پاک‌سازی (sanitize) کرده یا غیرفعال کرده باشد.", + "L": "2" + }, + { + "Shortcode": "V1.3.6", + "Ordinal": 6, + "Description": "برنامه در برابر حملات جعل درخواست سمت سرور (SSRF) محافظت شده باشد؛ به این صورت که داده‌های غیرقابل اعتماد را در برابر یک لیست مجاز از پروتکل‌ها، دامنه‌ها، مسیرها و پورت‌ها اعتبارسنجی کرده و کاراکترهای بالقوه خطرناک را پیش از استفاده از داده برای فراخوانی سرویس دیگر پاک‌سازی (sanitize) می‌کند.", + "L": "2" + }, + { + "Shortcode": "V1.3.7", + "Ordinal": 7, + "Description": "برنامه در برابر حملات تزریق قالب (Template Injection) محافظت شده باشد؛ به این صورت که ساخت قالب‌ها بر پایه داده‌های غیرقابل اعتماد مجاز نباشد. در صورتی که هیچ راه‌حل جایگزینی وجود نداشته باشد، هرگونه ورودی غیرقابل اعتماد که به‌صورت پویا در فرآیند ایجاد قالب وارد می‌شود، باید پیش از استفاده یا پاک‌سازی (sanitize) شود یا به‌صورت سخت‌گیرانه اعتبارسنجی (validate) گردد.", + "L": "2" + }, + { + "Shortcode": "V1.3.8", + "Ordinal": 8, + "Description": "برنامه، ورودی غیرقابل اعتماد را پیش از استفاده در کوئری‌های Java Naming and Directory Interface (JNDI) به‌درستی پاک‌سازی (sanitize) می‌کند و همچنین اطمینان حاصل شود که پیکربندی JNDI به‌گونه‌ای امن انجام شده تا از بروز حملات تزریق JNDI جلوگیری شود.", + "L": "2" + }, + { + "Shortcode": "V1.3.9", + "Ordinal": 9, + "Description": "برنامه، محتوا را پیش از ارسال به memcache پاک‌سازی (sanitize) می‌کند تا از حملات تزریق (injection attacks) جلوگیری شود.", + "L": "2" + }, + { + "Shortcode": "V1.3.10", + "Ordinal": 10, + "Description": "رشته‌های قالب‌بندی (format strings) که ممکن است هنگام استفاده، به‌شکلی ناخواسته یا مخرب تفسیر شوند، پیش از پردازش پاک‌سازی (sanitize) شوند.", + "L": "2" + }, + { + "Shortcode": "V1.3.11", + "Ordinal": 11, + "Description": "برنامه ورودی‌های کاربر را پیش از ارسال به سامانه‌های ایمیل (مانند SMTP یا IMAP) پاک‌سازی (sanitize) ‌کند تا از حملات تزریق در SMTP یا IMAP جلوگیری شود.", + "L": "2" + }, + { + "Shortcode": "V1.3.12", + "Ordinal": 12, + "Description": "عبارات منظم (Regular Expressions) عاری از اجزایی هستند که باعث بازگشت‌پذیری نمایی (exponential backtracking) می‌شوند، و همچنین ورودی‌های غیرقابل اعتماد به‌درستی پاک‌سازی (sanitize) شوند تا از حملات ReDoS (انکار سرویس با استفاده از عبارات منظم) یا Runaway Regex جلوگیری گردد.", + "L": "3" + } + ] + }, + { + "Shortcode": "V1.4", + "Ordinal": 4, + "Name": "حافظه، رشته و کد بدون مدیریت (Memory, String, and Unmanaged Code)", + "Items": [ + { + "Shortcode": "V1.4.1", + "Ordinal": 1, + "Description": "برنامه از رشته‌های ایمن از نظر مدیریت حافظه، کپی حافظه‌ای ایمن‌تر و حساب‌گری ایمن‌تر روی اشاره‌گرها استفاده می‌کند تا از سرریز پشته (stack overflow)، سرریز بافر (buffer overflow) یا سرریز حافظه پویای (heap overflow) جلوگیری کرده یا آن‌ها را شناسایی کند.", + "L": "2" + }, + { + "Shortcode": "V1.4.2", + "Ordinal": 2, + "Description": "از تکنیک‌های اعتبارسنجی علامت (sign validation)، محدوده (range validation) و ورودی (input validation) استفاده شده است تا از بروز سرریز عدد صحیح (integer overflow) جلوگیری شود.", + "L": "2" + }, + { + "Shortcode": "V1.4.3", + "Ordinal": 3, + "Description": "حافظه و منابعی که به‌صورت پویا تخصیص داده شده‌اند، به‌درستی آزاد (release) می‌شوند و همچنین ارجاع‌ها یا اشاره‌گرها (pointers) به حافظه آزادشده حذف یا به null تنظیم می‌شوند تا از اشاره‌گرهای معلق (dangling pointers) و آسیب‌پذیری‌های استفاده پس از آزادسازی (use-after-free) جلوگیری شود.", + "L": "2" + } + ] + }, + { + "Shortcode": "V1.5", + "Ordinal": 5, + "Name": "سریال‌زدایی ایمن (Safe Deserialization)", + "Items": [ + { + "Shortcode": "V1.5.1", + "Ordinal": 1, + "Description": "برنامه، XML Parserها را به‌گونه‌ای پیکربندی کرده باشد که از تنظیمات محدودکننده استفاده کنند، و ویژگی‌های ناایمنی مانند resolve کردن موجودیت‌های خارجی (external entities) غیرفعال شده باشند تا از حملات XML External Entity (XXE) جلوگیری شود.", + "L": "1" + }, + { + "Shortcode": "V1.5.2", + "Ordinal": 2, + "Description": "فرآیند deserialization داده‌های غیرقابل‌اعتماد، با اجرای مدیریت ایمن ورودی‌ها همراه باشد؛ برای مثال، استفاده از لیست مجاز (allowlist) انواع objectها یا محدود کردن انواع تعریف‌شده توسط کلاینت برای جلوگیری از حملات مرتبط با deserialization. همچنین، مکانیزم‌های deserialization که به‌طور صریح به‌عنوان ناایمن شناخته شده‌اند، نباید با داده‌های غیرقابل‌اعتماد مورد استفاده قرار گیرند.", + "L": "2" + }, + { + "Shortcode": "V1.5.3", + "Ordinal": 3, + "Description": "Parser های مختلفی که در برنامه برای یک نوع داده مشخص استفاده می‌شوند (برای مثال: Parser های JSON، XML یا URL)، رفتار تحلیلی یکسانی دارند و از مکانیزم یکسانی برای encoding کاراکترها استفاده می‌کنند، تا از بروز مشکلاتی مانند آسیب‌پذیری در سازگاری JSON (JSON Interoperability) یا تفاوت در نحوه تحلیل URI یا مسیر فایل که ممکن است در حملات RFI یا SSRF سوءاستفاده شود، جلوگیری شود.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V2", + "Ordinal": 2, + "ShortName": "Validation", + "Name": "Validation and Business Logic", + "Items": [ + { + "Shortcode": "V2.1", + "Ordinal": 1, + "Name": "مستندات اعتبارسنجی و منطق کسب‌وکار ( Validation and Business Logic Documentation)", + "Items": [ + { + "Shortcode": "V2.1.1", + "Ordinal": 1, + "Description": "قوانین اعتبارسنجی ورودی‌های برنامه (مندرج در مستندات برنامه) ‌باید چگونگی بررسی صحت داده‌ها را مطابق با ساختار مورد انتظار مشخص نماید. این ساختار می‌تواند شامل فرمت‌های رایج داده مانند شماره کارت اعتباری، آدرس ایمیل، شماره تلفن یا یک قالب داده‌ای داخلی باشد.", + "L": "1" + }, + { + "Shortcode": "V2.1.2", + "Ordinal": 2, + "Description": "قوانین اعتبارسنجی ورودی‌های برنامه (مندرج در مستندات برنامه) باید چگونگی بررسی سازگاری مناسب بین داده‌‌های ترکیب شده (از نظر مفهومی و متنی) را مشخص نماید؛ مانند تطبیق کدپستی با نام محله.", + "L": "2" + }, + { + "Shortcode": "V2.1.3", + "Ordinal": 3, + "Description": "انتظارات مربوط به محدودیت‌ها و اعتبارسنجی‌های منطق کسب و کار مستند شده باشند؛ این مستندات باید شامل محدودیت‌ها در سطح هر کاربر و محدودیت‌های عمومی در سطح برنامه باشند.", + "L": "2" + } + ] + }, + { + "Shortcode": "V2.2", + "Ordinal": 2, + "Name": "اعتبارسنجی ورودی (Input Validation)", + "Items": [ + { + "Shortcode": "V2.2.1", + "Ordinal": 1, + "Description": "ورودی‌ها باید به‌منظور اعمال انتظارات کسب و کار یا عملکردی مرتبط با آن‌ها اعتبارسنجی ‌شوند.این اعتبارسنجی باید یکی از این دو روش زیر را داشته باشد، استفاده از اعتبارسنجی مثبت (Positive Validation) مبتنی بر فهرست مجاز از مقادیر، الگوها یا بازه‌های قابل قبول و تطبیق با ساختار مورد انتظار و محدودیت‌های منطقی، بر اساس قوانین از پیش تعریف‌شده. برای سطح 1 (L1)، تمرکز می‌تواند بر ورودی‌هایی باشد که در تصمیم‌گیری‌های خاص تجاری یا امنیتی استفاده می‌شوند. برای سطح 2 و بالاتر، این اعتبارسنجی باید شامل تمام ورودی‌ها باشد.", + "L": "1" + }, + { + "Shortcode": "V2.2.2", + "Ordinal": 2, + "Description": "برنامه به‌گونه‌ای طراحی شود که اعتبارسنجی ورودی را در لایه‌ قابل اعتمادی از سرویس (Trusted Service Layer) اعمال کند. هرچند اعتبارسنجی سمت کلاینت (Client-side Validation) باعث بهبود تجربه کاربری می‌شود و توصیه می‌گردد، اما نباید به‌عنوان یک کنترل امنیتی اتکا شود.", + "L": "1" + }, + { + "Shortcode": "V2.2.3", + "Ordinal": 3, + "Description": "برنامه باید اطمینان حاصل نماید که ترکیب داده‌های مربوطه با توجه به قوانین از پیش تعریف‌شده معقول و منطقی باشد.", + "L": "2" + } + ] + }, + { + "Shortcode": "V2.3", + "Ordinal": 3, + "Name": "امنیت منطق کسب‌وکار (Business Logic Security)", + "Items": [ + { + "Shortcode": "V2.3.1", + "Ordinal": 1, + "Description": "اطمینان حاصل شود که برنامه فقط جریان‌های منطق تجاری را برای همان کاربر و طبق ترتیب گام‌به‌گام از پیش تعیین شده و مورد انتظار پردازش می‌کند و امکان رد کردن مراحل (Skipping Steps) وجود ندارد.", + "L": "1" + }, + { + "Shortcode": "V2.3.2", + "Ordinal": 2, + "Description": "اطمینان حاصل شود که محدودیت‌های منطق تجاری مطابق با مستندات برنامه پیاده‌سازی شده‌اند، تا از سوء‌استفاده از نقص‌های منطقی جلوگیری شود.", + "L": "2" + }, + { + "Shortcode": "V2.3.3", + "Ordinal": 3, + "Description": "تراکنش‌های سطح منطق کسب‌وکار (business logic) باید به‌گونه‌ای استفاده شوند که یا یک عملیات منطق کسب‌وکار به‌طور کامل با موفقیت انجام شود، یا در صورت بروز خطا، به حالت صحیح قبلی بازگردد(rollback) شود.", + "L": "2" + }, + { + "Shortcode": "V2.3.4", + "Ordinal": 4, + "Description": "در منطق کسب‌وکار (business logic)باید از مکانیزم‌های قفل‌گذاری (locking) استفاده شده باشد تا اطمینان حاصل شود که منابع محدود (مانند صندلی‌های سینما یا بازه‌های زمانی تحویل)، قابل رزرو دوباره (double-booked) از طریق دستکاری منطق برنامه نباشند.", + "L": "2" + }, + { + "Shortcode": "V2.3.5", + "Ordinal": 5, + "Description": "اطمینان حاصل شود که جریان‌های منطق کسب و کاری با ارزش بالا نیازمند تایید چند کاربره (Multi-user Approval) هستند تا از اقدامات غیرمجاز یا تصادفی جلوگیری شود. این موارد می‌تواند شامل – اما نه محدود به – انتقال‌های مالی بزرگ، تایید قرارداد‌ها، دسترسی به اطلاعات طبقه‌بنده شده، یا غیرفعال‌سازی‌های ایمنی در محیط‌های تولید صنعتی باشد.", + "L": "3" + } + ] + }, + { + "Shortcode": "V2.4", + "Ordinal": 4, + "Name": "مقابله با خودکارسازی (Anti-automation)", + "Items": [ + { + "Shortcode": "V2.4.1", + "Ordinal": 1, + "Description": "کنترل‌های ضد خودکارسازی (Anti-Automation) در سیستم پیاده‌سازی شده باشند تا از سوءاستفاده‌هایی مانند فراخوانی بیش از حد توابع برنامه جلوگیری شود؛ چرا که این نوع حملات می‌توانند منجر به استخراج غیرمجاز داده‌ها، تولید داده‌های زائد، مصرف کامل سهمیه‌ها، عبور از محدودیت‌های نرخ (Rate Limit)، ایجاد اختلال در سرویس (DoS) یا استفاده بیش از حد از منابع گران‌قیمت شوند.", + "L": "2" + }, + { + "Shortcode": "V2.4.2", + "Ordinal": 2, + "Description": "بررسی کنید که جریان‌های منطق کسب‌وکار (Business Logic Flows) به گونه‌ای طراحی شده باشند که نیازمند زمان‌بندی واقعی انسان باشند، و از ارسال سریع و غیرطبیعی تراکنش‌ها (Transaction Submissions) جلوگیری کنند.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V3", + "Ordinal": 3, + "ShortName": "Web", + "Name": "امنیت رابط کاربری وب (Web Frontend Security)", + "Items": [ + { + "Shortcode": "V3.1", + "Ordinal": 1, + "Name": "مستندسازی امنیت رابط کاربری وب ( Web Frontend Security Documentation)", + "Items": [ + { + "Shortcode": "V3.1.1", + "Ordinal": 1, + "Description": "در مستندات برنامه باید ویژگی‌های امنیتی مربوط به مرورگری که برنامه را اجرا میکند مشخص شده باشد (نظیر استفاده از HTTPS، پشتیبانی از HTTP Strict Transport Security (HSTS)، اجرای Content Security Policy (CSP) و سایر مکانیزم‌های امنیتی مرتبط با HTTP). همچنین در مستندات باید مشخص شود مرورگر در صورت عدم دسترسی به این ویژگی‌ها چه رفتاری باید داشته باشد. (برای مثال: نمایش هشدار به کاربر یا ممانعت از دسترسی به برنامه).", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.2", + "Ordinal": 2, + "Name": "تفسیر ناخواسته محتوا (Unintended Content Interpretation)", + "Items": [ + { + "Shortcode": "V3.2.1", + "Ordinal": 1, + "Description": "کنترل‌های امنیتی متناسب با مرورگر‌ها در هنگام پردازش پاسخ‌های HTTP به منظور جلوگیری از پردازش محتوا یا عملکرد مربوط به آن در شرایط زمینه‌‌ای نادرست باید بکار‌گرفته شود. (برای مثال، زمانی که یک APIیا یک فایل بارگذاری‌شده توسط کاربر یا هر منبع دیگری به‌طور مستقیم درخواست می‌شود).کنترل‌های ممکن می‌توانند شامل این موارد باشند: عدم پردازش محتوا مگر در صورت وجود هدرهای متناسب با درخواست‌های HTTP (مانند ‎Sec-Fetch-*) به منظور اطمیان از صحیح بودن پردازش محتوا یا عملکرد مربوط به . استفاده از عبارت sandbox در هدر Content-Security-Policy یا استفاده از نوعattachment در هدر Content-Disposition .", + "L": "1" + }, + { + "Shortcode": "V3.2.2", + "Ordinal": 2, + "Description": "اطمینان حاصل شود که محتوایی که برای نمایش به‌صورت متن طراحی شده نه برای پردازش به صورتHTML ، با استفاده از توابع امن نظیر CreateTextNode یا textContent به منظور جلوگیری از اجرای ناخواسته محتوایی مانند HTML یا JavaScript پردازش ‌شود.", + "L": "1" + }, + { + "Shortcode": "V3.2.3", + "Ordinal": 3, + "Description": "برنامه هنگام استفاده از جاوااسکریپت سمت کاربر (Client-Side JavaScript)، با استفاده از اعلام متغیرها به‌صورت صریح، انجام بررسی نوع به‌صورت سخت‌گیرانه، اجتناب از ذخیره‌سازی متغیرهای سراسری بر روی شیء document، و پیاده‌سازی ایزولاسیون فضای نام (namespace isolation)، از وقوع DOM Clobbering جلوگیری می‌کند.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.3", + "Ordinal": 3, + "Name": "پیکربندی کوکی (Cookie Setup)", + "Items": [ + { + "Shortcode": "V3.3.1", + "Ordinal": 1, + "Description": "اطمینان حاصل شود که کوکی‌ها دارای ویژگی ‘Secure’ هستند. در صورتی که از پیشوند ‘__Host-’ برای نام کوکی استفاده نمی‌شود، باید پیشوند__Secure- در نام کوکی لحاظ شده باشد.", + "L": "1" + }, + { + "Shortcode": "V3.3.2", + "Ordinal": 2, + "Description": "اطمینان حاصل شود که مقدار ویژگی SameSite برای هر کوکی، متناسب با هدف آن کوکی تنظیم شده باشد تا میزان آسیب‌پذیری در برابر حملات فریب سمت کلاینت نظیر CSRF کاهش یابد.", + "L": "2" + }, + { + "Shortcode": "V3.3.3", + "Ordinal": 3, + "Description": "اطمینان حاصل شود که کوکی‌ها از پیشوند __Host- در نام خود استفاده می‌کنند، مگر در مواردی که کوکی به‌طور مشخص برای اشتراک‌گذاری بین چند دامنه (Hosts) طراحی شده باشد.", + "L": "2" + }, + { + "Shortcode": "V3.3.4", + "Ordinal": 4, + "Description": "اطمینان حاصل شود که اگر مقدار کوکی (مثلاً توکن نشست) نباید برای اسکریپت‌های سمت کلاینت در دسترس باشد، ویژگی HttpOnly باید برای آن کوکی فعال شده باشد، و همچنین مقدار کوکی (مثلاً همان توکن نشست) تنها از طریق هدر Set-Cookie به کلاینت ارسال شود.", + "L": "2" + }, + { + "Shortcode": "V3.3.5", + "Ordinal": 5, + "Description": "اطمینان حاصل شود که حداکثر مجموع نام و مقدار کوکی از ۴۰۹۶ بایت تجاوز نکند.کوکی‌هایی که بیش از این مقدار باشند توسط مرورگر ذخیره نخواهند شد، و بنابراین در درخواست‌ها ارسال نمی‌شوند؛ موضوعی که ممکن است باعث شود عملکردهایی از برنامه که به آن کوکی وابسته‌اند، غیرفعال یا مختل شوند.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.4", + "Ordinal": 4, + "Name": "هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers)", + "Items": [ + { + "Shortcode": "V3.4.1", + "Ordinal": 1, + "Description": "اطمینان حاصل شود که در تمامی پاسخ‌های HTTP، هدر Strict-Transport-Security وجود دارد تا سیاست HSTS (HTTP Strict Transport Security) اعمال شود. حداقل مقدار max-age باید برابر با یک سال باشد. برای برنامه‌های سطح 2 (L2) و بالاتر، این سیاست باید برای تمام زیردامنه‌ها (subdomains) نیز اعمال شود.", + "L": "1" + }, + { + "Shortcode": "V3.4.2", + "Ordinal": 2, + "Description": "اطمینان حاصل شود که هدرAccess-Control-Allow-Origin مربوط به (CORS)، دارای یک مقدار ثابت و مشخص توسط برنامه باشد یا اگر هدر Origin در درخواست مورد استفاده قرار می گیرد باید با فهرستی از مبدأهای مورد اعتماد (Allowlist) اعتبارسنجی شود. در صورتی که استفاده از مقدار * در Access-Control-Allow-Origin تنظیم شده باشد، اطمینان حاصل شود که هیچ اطلاعات حساسی در پاسخ قرار ندارد.", + "L": "1" + }, + { + "Shortcode": "V3.4.3", + "Ordinal": 3, + "Description": "اطمینان حاصل شود که تمامی پاسخ‌های HTTP شامل هدر Content-Security-Policy باشند تا ریسک اجرای اسکریپت‌های مخرب (مانند (JavaScript مخرب کاهش یابد. دستورهای object-src 'none' و base-uri 'none' الزامی هستند .برای برنامه‌های سطح 3 (L3)، باید سیاست CSP به‌صورت اختصاصی برای هر پاسخ(Per-response Policy) و مبتنی بر nonce یا hash تعریف شده باشد.", + "L": "2" + }, + { + "Shortcode": "V3.4.4", + "Ordinal": 4, + "Description": "اطمینان حاصل شود که تمامی پاسخ‌ها شامل هدر X-Content-Type-Options: nosniff باشند، این (هدر) به مرورگرها دستور می‌دهد که برای پاسخ دریافتی از Content Sniffing یا حدس‌زدن نوع محتوا (MIME Type Guessing) استفاده نکنند و آن‌ها را ملزم می‌کند که نوع محتوای واقعی را دقیقاً مطابق مقدار هدر Content-Type در درخواست/پاسخ در نظر بگیرند.برای مثال، پاسخ به یک درخواست برای یک فایل استایل (CSS) تنها در صورتی پذیرفته می‌شود که مقدار Content-Type در پاسخ 'text/css' باشد.این کار همچنین امکان استفاده از قابلیت مسدودسازی خواندن منابع از مبدا متفاوت Cross-Origin Read Blocking یا (CORB) توسط مرورگر را فراهم می‌سازد.", + "L": "2" + }, + { + "Shortcode": "V3.4.5", + "Ordinal": 5, + "Description": "برنامه باید (وب‌سایت یا اپلیکیشن) یک \"Referrer Policy\" (سیاست ارجاع) تنظیم کرده باشد تا از نشت اطلاعات حساس از طریق هدر HTTP به نام Referer به سرویس‌های شخص ثالث جلوگیری شود. این کار را می‌توان از طریق هدر پاسخ HTTP به نام Referrer-Policy یا با استفاده از ویژگی‌هایی در عناصر HTML انجام داد.اطلاعات حساس ممکن است شامل مسیر (Path) و داده‌های کوئری (Query) در آدرس URL باشد، و در مورد برنامه‌های داخلی و غیرعمومی، حتی نام میزبان (hostname) نیز می‌تواند جزو اطلاعات حساس محسوب شود.", + "L": "2" + }, + { + "Shortcode": "V3.4.6", + "Ordinal": 6, + "Description": "برنامه باید از frame-ancestors در هدر Content-Security-Policy (CSP) برای تمام پاسخ‌های HTTP استفاده کند،تا به‌صورت پیش‌فرض، اجازه‌ی نمایش سایت در قالب iframe داده نشود، و فقط در صورت نیاز، نمایش منابع خاص (specific resources) در iframe مجاز باشد.به این نکته توجه کنید که هدر X-Frame-Options با اینکه هنوز توسط برخی مرورگرها پشتیبانی می‌شود، اما قدیمی (obsolete) است و نباید به آن تکیه کرد.", + "L": "2" + }, + { + "Shortcode": "V3.4.7", + "Ordinal": 7, + "Description": "هدر Content-Security-Policy (CSP) باید شامل یک آدرس برای گزارش (Report violation) باشد.", + "L": "3" + }, + { + "Shortcode": "V3.4.8", + "Ordinal": 8, + "Description": "تمام پاسخ‌های HTTP که باعث رندر (نمایش) یک سند می‌شوند مانند (پاسخ‌هایی با نوع محتوا (text/html باید شامل هدر Cross-Origin-Opener-Policy با دستور same-origin یا same-origin-allow-popups باشند (بنا به نیاز). این کار از حملاتی جلوگیری می‌کند که از دسترسی مشترک به اشیای Window سوءاستفاده می‌کنند، مانند حملات tabnabbing و frame counting.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.5", + "Ordinal": 5, + "Name": "تفکیک مبدا توسط مرورگر (Browser Origin Separation)", + "Items": [ + { + "Shortcode": "V3.5.1", + "Ordinal": 1, + "Description": "برنامه باید از مکانیزم Preflight در CORS برای جلوگیری از درخواست‌های cross-origin به عملکردهای حساس استفاده نمی‌کند، این درخواست‌ها به‌گونه‌ای اعتبارسنجی شوند که فقط از مبدأ اصلی برنامه ارسال شده باشند. این اعتبارسنجی می‌تواند با استفاده از توکن‌های (anti- forgery tokens) یا الزام به ارسال هدرهای HTTP اضافی انجام شود که در لیست هدرهای مجاز CORS (CORS-safelisted) قرار ندارند. این اقدام برای محافظت در برابر حملات جعل درخواست از طریق مرورگر، که با نام CSRF (Cross-Site Request Forgery) شناخته می‌شوند، ضروری است.", + "L": "1" + }, + { + "Shortcode": "V3.5.2", + "Ordinal": 2, + "Description": "اگر برنامه برای جلوگیری از استفاده غیرمجاز cross-origin از عملکردهای حساس، به مکانیزم Preflight در CORS متکی است، باید امکان فراخوانی این عملکردها با درخواست‌هایی که باعث ایجاد Preflight نمی‌شوند، وجود نداشته باشد. برای تحقق این هدف ممکن است لازم باشد مقدار هدرهای Origin و Content-Type بررسی شوند یا از هدر اضافی استفاده شود که در لیست هدرهای مجاز CORS قرار ندارد.", + "L": "1" + }, + { + "Shortcode": "V3.5.3", + "Ordinal": 3, + "Description": "برنامه باید درخواست‌های HTTP که به عملکردهای حساس از متدهای مناسب مانند POST، PUT، PATCH یا DELETE استفاده می‌کنند، و نه از متدهایی که در استاندارد HTTP به‌عنوان \"ایمن\" تعریف شده‌اند، مانند GET، HEAD یا .OPTIONS به عنوان جایگزین یا مکمل، می‌توان از بررسی سخت‌گیرانه هدرهای Sec-Fetch-* استفاده کرد تا اطمینان حاصل شود که درخواست از منبع نامناسبی مثل بارگذاری تصویر، ناوبری صفحه یا فراخوانی cross-origin ارسال نشده است.", + "L": "1" + }, + { + "Shortcode": "V3.5.4", + "Ordinal": 4, + "Description": "برنامه‌های مجزا باید روی نام‌های دامنه (hostname) متفاوت میزبانی شده‌اند تا از محدودیت‌های ارائه‌شده توسط (Same-Origin Policy) بهره‌مند شوند. این شامل کنترل تعامل اسناد یا اسکریپت‌های بارگذاری‌شده از یک مبدأ با منابع مبدأ دیگر و اعمال محدودیت بر اساس دامنه برای کوکی‌ها می‌شود.", + "L": "2" + }, + { + "Shortcode": "V3.5.5", + "Ordinal": 5, + "Description": "برنامه باید پیام‌های دریافت‌شده از طریق رابط postMessage در صورتی که مبدأ پیام مورد اعتماد نباشد یا ساختار پیام نامعتبر باشد، نادیده گرفته می‌شوند.", + "L": "2" + }, + { + "Shortcode": "V3.5.6", + "Ordinal": 6, + "Description": "هیچ‌کجای برنامه از قابلیت JSONP استفاده نشود تا از حملات Cross-Site Script Inclusion (XSSI) جلوگیری شود.", + "L": "3" + }, + { + "Shortcode": "V3.5.7", + "Ordinal": 7, + "Description": "داده‌هایی که نیاز به احراز هویت دارند، در پاسخ‌های مربوط به منابع اسکریپتی(مانند فایل‌های (JavaScript نباید قرار بگیرند تا از حملات XSSI جلوگیری شود.", + "L": "3" + }, + { + "Shortcode": "V3.5.8", + "Ordinal": 8, + "Description": "اطمینان حاصل کنید که منابع احراز هویت‌شده (مانند تصاویر، ویدیوها، اسکریپت‌ها و سایر اسناد) فقط در مواقعی که هدف آن است، قابل بارگذاری یا جاسازی توسط کاربر باشند. این کار را می‌توان با اعتبارسنجی دقیق هدرهای HTTP مانند Sec-Fetch-* انجام داد تا اطمینان حاصل شود که درخواست از یک منبع غیرمجاز ارسال نشده است، یا با تنظیم هدر Cross-Origin-Resource-Policy برای محدود کردن دسترسی مرورگر به محتوا.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.6", + "Ordinal": 6, + "Name": "یکپارچگی منابع خارجی (External Resource Integrity)", + "Items": [ + { + "Shortcode": "V3.6.1", + "Ordinal": 1, + "Description": "منابع سمت کلاینت مانند کتابخانه‌های جاوااسکریپت، فایل‌های CSS، یا فونت‌های وب، تنها در صورتی به‌صورت خارجی (مثلاً از طریق شبکه تحویل محتوا - CDN) میزبانی شوند که آن منابع: استاتیک (تغییرناپذیر) باشند، نسخه‌گذاری‌شده (versioned) باشند و یکپارچگی آن‌ها با استفاده از Subresource Integrity (SRI) بررسی شود. اگر این موارد امکان‌پذیر نیست، باید برای هر منبع، یک تصمیم امنیتی مستند وجود داشته باشد که توجیه کند چرا این منبع به این شکل بارگذاری می‌شود.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.7", + "Ordinal": 7, + "Name": "سایر ملاحظات امنیتی مرورگر (Other Browser Security Considerations)", + "Items": [ + { + "Shortcode": "V3.7.1", + "Ordinal": 1, + "Description": "برنامه صرفا باید از فناوری‌های سمت کلاینتی استفاده ‌کند که همچنان پشتیبانی می‌شوند و از نظر امنیتی قابل اعتماد هستند.مثال‌هایی از فناوری‌هایی که این الزام را برآورده نمی‌کنند عبارتند از NSAPI Plugins،Flash،Shockwave،ActiveX،Silverlight،NACL و Appletهای جاوا در سمت کلاینت", + "L": "2" + }, + { + "Shortcode": "V3.7.2", + "Ordinal": 2, + "Description": "برنامه فقط زمانی کاربر را به دامنه‌ها یا hostnameهای دیگر (که تحت کنترل برنامه نیستند) به صورت خودکار هدایت می‌کند، که آن مقصد در یک فهرست مجاز (allowlist) قرار داشته باشد.", + "L": "2" + }, + { + "Shortcode": "V3.7.3", + "Ordinal": 3, + "Description": "برنامه باید هنگام ریدایرکت کاربر به یک URL که خارج از کنترل برنامه است، یک پیام هشدار نشان می‌دهد و امکان لغو آن را به کاربر می‌دهد.", + "L": "3" + }, + { + "Shortcode": "V3.7.4", + "Ordinal": 4, + "Description": "باید دامنه اصلی برنامه، مثلاً (site.tld) به فهرست preload عمومی HSTS اضافه شده باشد.", + "L": "3" + }, + { + "Shortcode": "V3.7.5", + "Ordinal": 5, + "Description": "اگر مرورگر کاربر از ویژگی‌های امنیتی مورد انتظار برنامه پشتیبانی نمی‌کند، برنامه رفتار مناسبی داشته باشد، مثل هشدار دادن به کاربر یا مسدود کردن دسترسی.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V4", + "Ordinal": 4, + "ShortName": "API", + "Name": "API and Web Service", + "Items": [ + { + "Shortcode": "V4.1", + "Ordinal": 1, + "Name": "Generic Web Service Security", + "Items": [ + { + "Shortcode": "V4.1.1", + "Ordinal": 1, + "Description": "اطمینان حاصل شود که در هر پاسخ HTTP که شامل Body می باشد، هدر Content-Type وجود داشته باشد که نوع آن، با محتوای پاسخ دریافتی از سرور مطابقت داشته باشد. این هدر باید شامل پارامتر charset نیز باشد تا رمزگذاری کاراکتر ایمن (مانند UTF-8 یا ISO-8859-1) را مشخص کند. این مقادیر باید مطابق با استاندارد IANA Media Types باشند؛ برای مثال، انواعی مانند \"text/، /+xml\" و \"/xml\" را در بر می‌گیرند.", + "L": "1" + }, + { + "Shortcode": "V4.1.2", + "Ordinal": 2, + "Description": "اطمینان حاصل شود که تنها نقاط پایانی که برای استفاده کاربر نهایی از طریق مرورگر طراحی شده‌اند (User-Facing Endpoints) به‌صورت خودکار از HTTP به HTTPS هدایت ‌شوند، سایر سرویس‌ها یا نقاط پایانی نباید (ریدایرکت شفاف، Transparent Redirect) داشته باشند. این اقدام برای جلوگیری از وضعیتی است که در آن یک کلاینت به اشتباه درخواست‌های رمزنگاری‌نشده (HTTP) ارسال می‌کند، اما چون این درخواست‌ها به‌طور خودکار به HTTPS ریدایرکت می‌شوند، نشت احتمالی داده‌های حساس پنهان خواهد ماند.", + "L": "2" + }, + { + "Shortcode": "V4.1.3", + "Ordinal": 3, + "Description": "اطمینان حاصل شود که هدرهای HTTP که در برنامه استفاده می شود و توسط یک لایه واسطه، مانند یکload balancer ، یک پروکسی وب یا یک سرویس backend-for-frontend تنظیم شده است نمی‌تواند توسط کاربر نهایی بازنویسی شود. هدرهای نمونه ممکن است شامل X-Real-IP، X-Forwarded-* یا X-User-ID باشند.", + "L": "2" + }, + { + "Shortcode": "V4.1.4", + "Ordinal": 4, + "Description": "اطمینان حاصل شود که فقط متدهای HTTP که صریحاً توسط برنامه یا API آن پشتیبانی می‌شوند (از جمله OPTIONS در درخواست‌های preflight) می‌توانند مورد استفاده قرار گیرند و متدهای استفاده نشده مسدود شوند.", + "L": "3" + }, + { + "Shortcode": "V4.1.5", + "Ordinal": 5, + "Description": "اطمینان حاصل شود که برای درخواست‌ها یا تراکنش‌هایی که بسیار حساس هستند یا از چندین سامانه عبور می‌کنند، از امضاهای دیجیتال در سطح پیام استفاده شود تا اطمینان امنیتی بیشتری علاوه بر محافظت‌های سطح انتقال (مانند TLS) فراهم گردد.", + "L": "3" + } + ] + }, + { + "Shortcode": "V4.2", + "Ordinal": 2, + "Name": "HTTP Message Structure Validation", + "Items": [ + { + "Shortcode": "V4.2.1", + "Ordinal": 1, + "Description": "اطمینان حاصل شود که تمامی اجزای برنامه )از جمله لود بالانسرها، فایروال‌ها و سرورهای اپلیکیشن( مرزهای پیام‌های HTTP ورودی را با استفاده از مکانیزم مناسب نسخه های HTTP تعیین می‌کنند تا از حملات HTTP request smuggling جلوگیری شود. در HTTP/1.x اگر هدر Transfer-Encoding وجود داشته باشد، هدر Content-Length باید مطابق RFC 2616 نادیده گرفته شود. در مقابل، هنگام استفاده از HTTP/2 یا HTTP/3، اگر هدر Content-Length وجود داشته باشد، گیرنده باید اطمینان حاصل کند که این مقادیر با طول فریم‌های DATA سازگار می‌باشد.", + "L": "2" + }, + { + "Shortcode": "V4.2.2", + "Ordinal": 2, + "Description": "اطمینان حاصل شود که هنگام تولید پیام‌های HTTP، هدر Content-Length با طول محتوایی که توسط چارچوب‌بندی پروتکل HTTP تعیین می‌شود، تداخل نداشته باشد تا از حملات request smuggling جلوگیری شود.", + "L": "3" + }, + { + "Shortcode": "V4.2.3", + "Ordinal": 3, + "Description": "اطمینان حاصل شود برنامه، پیام‌های HTTP/2 یا HTTP/3 با هدرهای connection-specific مانند Transfer-Encoding را به منظور جلوگیری از حملات response splitting یا header injection ارسال یا قبول نمی کند.", + "L": "3" + }, + { + "Shortcode": "V4.2.4", + "Ordinal": 4, + "Description": "اطمینان حاصل شود برنامه تنها درخواست های HTTP/2 and HTTP/3 که هدرها و مقادیر آن شامل هیچ توالی CR (\\r), LF (\\n), CRLF (\\r\\n) نباشد را می پذیرد تا از حملات header injection جلوگیری کند.", + "L": "3" + }, + { + "Shortcode": "V4.2.5", + "Ordinal": 5, + "Description": "اطمینان حاصل کنید که اگر برنامه (Frontend or Backend) اقدام به ساخت و ارسال درخواست‌های HTTP می کند از مکانیزم های validation ، sanitization یا سایر مکانیزم‌ها استفاده کند تا از ایجاد URIها (مانند فراخوانیAPI ) یا فیلدهای هدر درخواست HTTP (مانند Authorization یا( Cookie که بیش از حد مجاز، طولانی هستند، جلوگیری شود که منجر به عدم پذیرش درخواست توسط مولفه دریافت کننده(هر بخشی از زیرساخت یا سامانه که درخواست HTTP را دریافت و پردازش می‌کند) شود. عدم رعایت این موضوع می تواند باعث وقوع حمله Danial of Service شود، ارسال یک درخواست بیش از حد طولانی (مانند یک فیلد هدر کوکی طولانی) باعث می شود سرور همواره با وضعیت خطا پاسخ دهد.", + "L": "3" + } + ] + }, + { + "Shortcode": "V4.3", + "Ordinal": 3, + "Name": "GraphQL", + "Items": [ + { + "Shortcode": "V4.3.1", + "Ordinal": 1, + "Description": "اطمینان حاصل شود یکی از مکانیزم ها برای جلوگیری از حملات انکار سرویس (DoS) درلایه GraphQL یا لایه داده استفاده شده است. این مکانیزم‌ها عبارتند از استفاده از فهرست مجاز کوئری‌ها ( Query Allowlist)، محدودسازی عمق کوئری‌ها (Depth Limiting)،محدودسازی تعداد یا حجم داده(Amount Limiting) و تحلیل هزینه کوئری (Query Cost Analysis). این اقدامات، به منظور مقابله با درخواست های پیچیده، تو در تو یا کوئری‌های پرهزینه که می توانند موجب مصرف بیش از حد منابع و اختلال در سرویس دهی شوند ضروری است.", + "L": "2" + }, + { + "Shortcode": "V4.3.2", + "Ordinal": 2, + "Description": "اطمینان حاصل شود که قابلیت Introspection در GraphQL در محیط تولید (Production) غیرفعال شده‌است، مگرAPI مبتنی بر GraphQL به‌صورت صریح برای استفاده توسط اشخاص یا سامانه های ثالث (Third Parties) طراحی شده باشد.", + "L": "2" + } + ] + }, + { + "Shortcode": "V4.4", + "Ordinal": 4, + "Name": "WebSocket", + "Items": [ + { + "Shortcode": "V4.4.1", + "Ordinal": 1, + "Description": "اطمینان حاصل شود که تمامی ارتباطات WebSocket از طریق پروتکل TLS( WSS) برقرار می‌شوند.", + "L": "1" + }, + { + "Shortcode": "V4.4.2", + "Ordinal": 2, + "Description": "اطمینان حاصل شود که در هنگام Handshake اولیه‌ی HTTP برای WebSocket، مقدار هدر Origin بررسی ‌شود و در صورتی که با لیستی از مبداهای مجاز (allowed origins) برای برنامه مطابقت داشته باشد، اتصال پذیرفته می‌شود.", + "L": "2" + }, + { + "Shortcode": "V4.4.3", + "Ordinal": 3, + "Description": "اطمینان حاصل شود که در صورتی که امکان استفاده از مکانیزم استاندارد مدیریت نشست برنامه وجود نداشته باشد، از توکن‌های اختصاصی (Duplicated Tokens) برای این منظور استفاده شود که با الزامات امنیتی مدیریت نشست به طور کامل مطابقت داشته باشند.", + "L": "2" + }, + { + "Shortcode": "V4.4.4", + "Ordinal": 4, + "Description": "اطمینان حاصل شود که توکن‌های اختصاصی مدیریت نشست WebSocket در هنگام انتقال از یک نشست HTTPS موجود به کانالWebSocket، از طریق نشست HTTPS احراز هویت‌شده قبلی، دریافت یا اعتبارسنجی می‌شوند.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V5", + "Ordinal": 5, + "ShortName": "File", + "Name": "File Handling", + "Items": [ + { + "Shortcode": "V5.1", + "Ordinal": 1, + "Name": "File Handling Documentation", + "Items": [ + { + "Shortcode": "V5.1.1", + "Ordinal": 1, + "Description": "مستندات نوع فایل‌های مجاز، پسوندهای مورد انتظار، و حداکثر اندازه هر فایل (شامل اندازه پس از استخراج) را برای هر قابلیت بارگذاری مشخص کرده باشد. همچنین، مستندات توضیح می‌دهند چگونه فایل‌ها برای دانلود و پردازش توسط کاربران نهایی ایمن‌سازی می‌شوند؛ برای مثال، رفتار برنامه هنگام شناسایی یک فایل مخرب چگونه خواهد بود.", + "L": "2" + } + ] + }, + { + "Shortcode": "V5.2", + "Ordinal": 2, + "Name": "File Upload and Content", + "Items": [ + { + "Shortcode": "V5.2.1", + "Ordinal": 1, + "Description": "برنامه تنها فایل‌هایی با حجم مشخص، که قادر به پردازش آن است را می‌پذیرد تا از کاهش عملکرد یا حملات انکار سرویس (DoS) جلوگیری شود.", + "L": "1" + }, + { + "Shortcode": "V5.2.2", + "Ordinal": 2, + "Description": "هنگام پذیرش فایل توسط برنامه، چه به صورت مستقیم و چه به صورت یک آرشیو مانند فایلzip پسوند فایل با پسوند مورد انتظار مطابقت داشته باشد و اعتبارسنجی محتوای فایل صورت گیرد تا تایید شود محتوای فایل با نوع تعریف‌شده توسط پسوند هم‌خوانی دارد. این فرآیند می تواند شامل موارد بررسی بایت‌های ابتدایی (magic bytes) فایل، انجام بازنویسی تصاویر برای حذف ساختارها و اطلاعات ناخواسته و استفاده از کتابخانه‌های تخصصی برای اعتبارسنجی کامل محتوای فایل باشد اما محدود به آنها نیست. در سطح L1، کافی است این بررسی‌ها فقط بر روی فایل‌هایی که در فرآیندهای تجاری یا امنیتی خاص استفاده می‌شوند متمرکز باشد. در سطح L2 و بالاتر، این فرآیند باید برای تمامی فایل‌های ورودی برنامه اجرا شود.", + "L": "1" + }, + { + "Shortcode": "V5.2.3", + "Ordinal": 3, + "Description": "برنامه باید پیش از استخراج محتوای فایل‌های فشرده (مانند zip، gz، docx، odt)، آن‌ها را از نظر حداکثر اندازه مجاز پس از استخراج و همچنین حداکثر تعداد فایل‌های درون آن بررسی می‌کند.", + "L": "2" + }, + { + "Shortcode": "V5.2.4", + "Ordinal": 4, + "Description": "برنامه فضای مشخصی برای اندازه فایل و تعداد فایل‌های مجاز برای هر کاربر اعمال می‌کند تا از این طریق، یک کاربر نتواند با بارگذاری تعداد زیادی فایل یا فایل‌های بیش از حد بزرگ، فضای ذخیره‌سازی را پر کند.", + "L": "3" + }, + { + "Shortcode": "V5.2.5", + "Ordinal": 5, + "Description": "برنامه اجازه بارگذاری فایل‌های فشرده‌ که حاوی لینک های نمادین (symlinks) هستند را نمی‌دهد، مگر اینکه این رفتار به طور مشخص مورد نیاز باشد. در چنین شرایطی باید یک فهرست مجاز (allowlist) از مسیرها یا فایل‌هایی که می تواند برای آنها لینک نمادین ایجاد شود، اعمال و اعتبارسنجی گردد.", + "L": "3" + }, + { + "Shortcode": "V5.2.6", + "Ordinal": 6, + "Description": "برنامه تصاویر بارگذاری‌شده با اندازه پیکسلی بزرگ‌تر از حد مجاز را رد کند تا از حملات pixel flood attacks جلوگیری شود.", + "L": "3" + } + ] + }, + { + "Shortcode": "V5.3", + "Ordinal": 3, + "Name": "File Storage", + "Items": [ + { + "Shortcode": "V5.3.1", + "Ordinal": 1, + "Description": "فایل هایی که از ورودی های غیرمعتبر بارگذاری‌ یا تولید می شوند و در پوشه های عمومی قرار می گیرند، هنگام دسترسی مستقیم از طریق یک درخواست HTTP، به عنوان کداجرایی سمت سرور اجرا نشوند.", + "L": "1" + }, + { + "Shortcode": "V5.3.2", + "Ordinal": 2, + "Description": "هنگام ایجاد مسیرهای فایل برای عملیات مختلف، به جای استفاده از نام فایل‌های ارسال شده توسط کاربر، از داده‌های تولید شده داخلی یا منابع مورد اعتماد استفاده شود. و در صورتی که استفاده از نام فایل‌ها یا متادیتای ارسالی توسط کاربر ضروری باشد، می بایست validation و Sanitization اعمال شود. این کار برای جلوگیری از حملاتی مانند Path Traversal، Local or Remote File Inclusion(LFI, RFI) و Server-Side Request Forgery(SSRF) می‌باشد.", + "L": "1" + }, + { + "Shortcode": "V5.3.3", + "Ordinal": 3, + "Description": "پردازش فایل‌های سمت سرور، مانند استخراج فایل‌های فشرده، اطلاعات مسیر ارائه شده توسط کاربر را نادیده می‌گیرد تا از آسیب‌پذیری‌هایی مانند zip slip جلوگیری شود.", + "L": "3" + } + ] + }, + { + "Shortcode": "V5.4", + "Ordinal": 4, + "Name": "File Download", + "Items": [ + { + "Shortcode": "V5.4.1", + "Ordinal": 1, + "Description": "برنامه نام فایل ارسال‌شده توسط کاربر را چه در قالب JSON، JSONP یا پارامتر URL، اعتبارسنجی می‌کند یا نادیده می‌گیرد، و در پاسخ HTTP، نام فایل را به‌طور صریح در فیلد Content-Disposition هدر مشخص می‌نماید.", + "L": "2" + }, + { + "Shortcode": "V5.4.2", + "Ordinal": 2, + "Description": "نام‌های فایل‌های ارائه شده (مانند فیلدهای هدر پاسخ HTTP یا پیوست‌های ایمیل)، به‌درستی encoded یا sanitized شده‌اند (مطابق RFC 6266)، تا ساختار سند حفظ شده و از حملات تزریق جلوگیری شود.", + "L": "2" + }, + { + "Shortcode": "V5.4.3", + "Ordinal": 3, + "Description": "فایل‌های دریافت شده از منابع غیرقابل اعتماد توسط آنتی ویروس اسکن شود تا از ارائه محتوای مخرب شناخته‌شده جلوگیری شود.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V6", + "Ordinal": 6, + "ShortName": "Authentication", + "Name": "Authentication", + "Items": [ + { + "Shortcode": "V6.1", + "Ordinal": 1, + "Name": "Authentication Documentation", + "Items": [ + { + "Shortcode": "V6.1.1", + "Ordinal": 1, + "Description": "مستندات برنامه، نحوه استفاده از کنترل هایی مانند محدودیت نرخ (Rate Limit)، مقابله با خودکارسازی (Anti-Automation) و پاسخ تطبیقی (Adaptive Response) را برای دفاع در برابر حملاتی مانند Credential Stuffing و حملات Password Brute Force به وضوح تعریف کرده باشد. مستندات باید به‌وضوح نحوه پیکربندی این کنترل‌ها را تشریح کرده و نشان دهند که چگونه از قفل شدن مخرب حساب‌های کاربری جلوگیری می‌شود.", + "L": "1" + }, + { + "Shortcode": "V6.1.2", + "Ordinal": 2, + "Description": "یک لیست از کلمات خاص مرتبط با زمینه سازمانی‌ (Context-Specific) مستندسازی شود تا از بکارگیری آنها در رمزهای عبور جلوگیری شد. این فهرست می‌تواند شامل نام سازمان، نام محصول، شناسه سامانه، نام کد پروژه، نام دپارتمان یا نقش های سازمانی و موارد مشابه باشد.", + "L": "2" + }, + { + "Shortcode": "V6.1.3", + "Ordinal": 3, + "Description": "در صورت وجود مسیرهای متعدد احراز هویت در برنامه کاربردی، تمامی این مسیرها به همراه کنترل‌های امنیتی و سطح قدرت احراز هویت مورد نیاز، مستندسازی شده‌اند. لازم است این کنترل‌ها به‌صورت یکسان و سازگار در تمامی مسیرهای احراز هویت اجرا شوند.", + "L": "2" + } + ] + }, + { + "Shortcode": "V6.2", + "Ordinal": 2, + "Name": "Password Security", + "Items": [ + { + "Shortcode": "V6.2.1", + "Ordinal": 1, + "Description": "کلمات عبور تنظیم شده توسط کاربر حداقل ۸ کاراکتر طول داشته باشد. هرچند حداقل ۱۵ کاراکتر به شدت توصیه می‌شود.", + "L": "1" + }, + { + "Shortcode": "V6.2.2", + "Ordinal": 2, + "Description": "کاربران قادر به تغییر گذرواژه خود باشند.", + "L": "1" + }, + { + "Shortcode": "V6.2.3", + "Ordinal": 3, + "Description": "هنگام تغییر کلمه عبور، گذرواژه فعلی و گذرواژه جدید توسط کاربر تکمیل شود.", + "L": "1" + }, + { + "Shortcode": "V6.2.4", + "Ordinal": 4, + "Description": "کلمات عبوری که در حین ثبت‌نام حساب کاربری یا تغییر کلمه عبور ارسال می شوند با یک فهرست در دسترس از حداقل ۳۰۰۰ کلمه عبور رایج که ( با سیاست‌های کلمه عبور برنامه (مانند حداقل طول) سازگاری دارند) بررسی شوند.", + "L": "1" + }, + { + "Shortcode": "V6.2.5", + "Ordinal": 5, + "Description": "کلمات عبور با هر ترکیبی قابل استفاده باشند، بدون اینکه قوانینی برای محدودکردن نوع کاراکترهای مجاز وجود داشته باشد. نباید هیچ‌گونه الزامی برای تعداد حداقل کاراکترهای حروف بزرگ یا کوچک، اعداد یا کاراکترهای خاص وجود داشته باشد.", + "L": "1" + }, + { + "Shortcode": "V6.2.6", + "Ordinal": 6, + "Description": "فیلدهای ورودی کلمه عبور از نوع \"type=password\" استفاده می‌کنند تا ورودی‌ها پنهان شوند. برنامه‌ها می‌توانند به کاربر این امکان را بدهند که موقتاً کلمه عبور کامل یا آخرین کاراکتر تایپ شده را مشاهده کند.", + "L": "1" + }, + { + "Shortcode": "V6.2.7", + "Ordinal": 7, + "Description": "عملکرد \"چسباندن\" (paste)، ابزارهای کمکی گذرواژه مرورگر و مدیریت‌کننده‌های گذرواژه خارجی مجاز باشند.", + "L": "1" + }, + { + "Shortcode": "V6.2.8", + "Ordinal": 8, + "Description": "برنامه کلمه عبور کاربر را دقیقاً همانطور که از کاربر دریافت شده است، بدون هیچ گونه تغییراتی مانند کوتاه‌سازی(truncation) یا تبدیل حروف بزرگ و کوچک (case transformation)، بررسی کند.", + "L": "1" + }, + { + "Shortcode": "V6.2.9", + "Ordinal": 9, + "Description": "استفاده از گذرواژه‌هایی با حداقل طول ۶۴ کاراکتر مجاز باشد.", + "L": "2" + }, + { + "Shortcode": "V6.2.10", + "Ordinal": 10, + "Description": "کلمه عبور کاربر تا زمانی که مشخص شود که به خطر افتاده است یا کاربر آن را تغییر دهد، معتبر باقی بماند. برنامه نباید الزام به تغییر دوره‌ای گذرواژه‌ها را داشته باشد.", + "L": "2" + }, + { + "Shortcode": "V6.2.11", + "Ordinal": 11, + "Description": "فهرست مستند شده ای از کلمات خاص مرتبط با زمینه‌ سازمانی برای جلوگیری از ایجاد کلمات عبور آسان قابل حدس، مورد استفاده قرار گیرد.", + "L": "2" + }, + { + "Shortcode": "V6.2.12", + "Ordinal": 12, + "Description": "کلمات عبور وارد شده در حین ثبت‌نام حساب کاربری یا تغییر کلمه عبور با مجموعه‌ای از کلمات عبور افشا شده بررسی ‌شوند.", + "L": "2" + } + ] + }, + { + "Shortcode": "V6.3", + "Ordinal": 3, + "Name": "General Authentication Security", + "Items": [ + { + "Shortcode": "V6.3.1", + "Ordinal": 1, + "Description": "کنترل‌های لازم برای جلوگیری از حملاتی مانند Credential Stuffing و password brute force طبق مستندات امنیتی برنامه پیاده‌سازی شوند.", + "L": "1" + }, + { + "Shortcode": "V6.3.2", + "Ordinal": 2, + "Description": "حساب‌های کاربری پیش‌فرض (مانند \"admin\"، \"root\" یا \"sa\") در برنامه وجود نداشته باشند یا غیرفعال شده باشند.", + "L": "1" + }, + { + "Shortcode": "V6.3.3", + "Ordinal": 3, + "Description": "برای دسترسی به برنامه، از یک مکانیزم احراز هویت چندعاملی (MFA) یا ترکیبی از مکانیزم‌های احراز هویت تک‌عاملی استفاده شود. برای سطح L3، حداقل یکی از عوامل احراز هویت باید مبتنی بر سخت‌افزار باشد در برابر حملات فیشینگ، مقاومت در برابر نفوذ و جعل هویت را فراهم کند، در حالی که با اقدام آگاهانه کاربر (مانند فشردن دکمه روی کلید سخت‌افزاری FIDO یا تلفن همراه) قصد کاربر برای احراز هویت را نیز تأیید نماید. هرگونه تسهیل یا تعدیل در این الزام، مستلزم ارائه دلایل مستند و مجموعه‌ای جامع از کنترل‌های جبرانی است.", + "L": "2" + }, + { + "Shortcode": "V6.3.4", + "Ordinal": 4, + "Description": "تأیید کنید که در صورت وجود مسیرهای متعدد احراز هویت در برنامه، هیچ مسیر احراز هویتِ مستندسازی‌نشده‌ای وجود نداشته باشد و کنترل‌های امنیتی و سطح قدرت احراز هویت در تمامی مسیرها به‌صورت یکسان و سازگار اعمال شوند.", + "L": "2" + }, + { + "Shortcode": "V6.3.5", + "Ordinal": 5, + "Description": "کاربران از تلاش‌های مشکوک برای احراز هویت (موفق یا ناموفق) مطلع ‌شوند. این اطلاع‌رسانی می‌تواند شامل تلاش برای احراز هویت از موقعیت مکانی یا کلاینت غیرمعمول، احراز هویت ناقص (تنها موفقیت یکی از عوامل)، تلاش برای احراز هویت پس از یک دوره طولانی عدم فعالیت، یا احراز هویت موفق پس از چندین تلاش ناموفق باشد.", + "L": "3" + }, + { + "Shortcode": "V6.3.6", + "Ordinal": 6, + "Description": "ایمیل به‌عنوان مکانیزم احراز هویت، چه به‌صورت تک‌عاملی و چه به‌عنوان یکی از عوامل احراز هویت چندعاملی، استفاده نمی‌شود.", + "L": "3" + }, + { + "Shortcode": "V6.3.7", + "Ordinal": 7, + "Description": "کاربران پس از به‌روزرسانی اطلاعات احراز هویت خود، مانند بازنشانی گذرواژه یا تغییر نام کاربری یا آدرس ایمیل، مطلع شوند.", + "L": "3" + }, + { + "Shortcode": "V6.3.8", + "Ordinal": 8, + "Description": "با توجه به پیام‌های خطا، کدهای پاسخ HTTP یا تفاوت در زمان پاسخ‌دهی، نتوان کاربران معتبر را از طریق تلاش‌های ناموفق احراز هویت شناسایی کرد. همچنین، عملکردهای ثبت‌نام و بازیابی گذرواژه نیز باید از این نوع افشای اطلاعات محافظت شده باشند.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.4", + "Ordinal": 4, + "Name": "Authentication Factor Lifecycle and Recovery", + "Items": [ + { + "Shortcode": "V6.4.1", + "Ordinal": 1, + "Description": "کلمه عبور اولیه یا کدهای فعال‌سازی تولید شده توسط سیستم، به‌صورت تصادفی و ایمن تولید ‌شوند، با سیاست فعلی رمز عبور مطابقت دارند، و پس از مدت زمان کوتاهی یا پس از اولین استفاده منقضی می‌شوند. این رمزهای اولیه نباید به عنوان رمز عبور بلندمدت مورد استفاده قرار گیرند.", + "L": "1" + }, + { + "Shortcode": "V6.4.2", + "Ordinal": 2, + "Description": "راهنمای کلمه عبور یا احراز هویت مبتنی بر دانش (که به عنوان \"سؤالات امنیتی\" شناخته می‌شوند) در سیستم وجود ندارد.", + "L": "1" + }, + { + "Shortcode": "V6.4.3", + "Ordinal": 3, + "Description": "فرآیند امنی برای بازنشانی کلمه عبور فراموش‌شده پیاده‌سازی شده است که هیچ‌یک از مکانیزم‌های احراز هویت چندعاملی فعال را دور نزند.", + "L": "2" + }, + { + "Shortcode": "V6.4.4", + "Ordinal": 4, + "Description": "در صورت از دست رفتن یکی از عوامل احراز هویت چندعاملی، فرآیند اثبات هویت با همان سطحی که در زمان ثبت‌نام انجام شده است، اجرا شود.", + "L": "2" + }, + { + "Shortcode": "V6.4.5", + "Ordinal": 5, + "Description": "دستورالعمل‌های تمدید مکانیزم‌های احراز هویت دارای تاریخ انقضا برای کاربران به موقع ارسال می‌شود تا پیش از انقضای مکانیزم فعلی فرصت کافی برای تمدید وجود داشته باشد، و در صورت لزوم، یادآورهای خودکار نیز تنظیم و ارسال شده باشند.", + "L": "3" + }, + { + "Shortcode": "V6.4.6", + "Ordinal": 6, + "Description": "کاربران ادمین می‌توانند فرآیند بازنشانی کلمه عبور را برای کاربران عادی آغاز کنند، اما اجازه تغییر مستقیم یا انتخاب رمز عبور برای کاربر را ندارند. این کنترل برای جلوگیری از دسترسی ادمین به رمز عبور کاربران طراحی شده است.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.5", + "Ordinal": 5, + "Name": "General Multi-factor authentication requirements", + "Items": [ + { + "Shortcode": "V6.5.1", + "Ordinal": 1, + "Description": "Lookup Secrets درخواست‌ها یا کدهای احراز هویت خارج از باند (Out-of-Band) و رمزهای یکبار مصرف مبتنی بر زمان (TOTP) تنها یک‌بار قابل استفاده باشند و پس از استفاده موفق، مجدداً قابل استفاده نباشند.", + "L": "2" + }, + { + "Shortcode": "V6.5.2", + "Ordinal": 2, + "Description": "در صورت ذخیره‌سازی Lookup Secrets در سمت Backend برنامه، اگر مقدار آنتروپی کمتر از ۱۱۲ بیت باشند (معادل ۱۹ کاراکتر تصادفی الفبایی-عددی یا ۳۴ رقم تصادفی)، باید با یک الگوریتم تایید شده برای ذخیره رمز عبور و با استفاده از یک Salt تصادفی ۳۲ بیتی هش شوند. در صورتی که آنتروپی کد ۱۱۲ بیت یا بیشتر باشد، می‌توان از یک تابع هش استاندارد برای ذخیره سازی استفاده کرد.", + "L": "2" + }, + { + "Shortcode": "V6.5.3", + "Ordinal": 3, + "Description": "Lookup Secrets کدهای احراز هویت خارج از باند (out of band) و تولید رمزهای یکبار مصرف مبتنی بر زمان(TOTP) همگی با استفاده از یک تولیدکننده عدد شبه تصادفی ‌رمزنگاری‌شده (CSPRNG) تولید شده باشند تا از تولید مقادیر قابل پیش‌بینی جلوگیری شود.", + "L": "2" + }, + { + "Shortcode": "V6.5.4", + "Ordinal": 4, + "Description": "Lookup Secrets و کدهای احراز هویت خارج از باند (out of band) حداقل دارای ۲۰ بیت آنتروپی باشند (معمولاً ۴ کاراکتر تصادفی الفبایی-عددی یا ۶ رقم تصادفی برای رسیدن به این میزان آنتروپی کافی است).", + "L": "2" + }, + { + "Shortcode": "V6.5.5", + "Ordinal": 5, + "Description": "درخواست‌ها، کدها یا توکن‌های احراز هویت خارج از باند (Out-of-Band) و همچنین رمزهای عبور یک‌بار مصرف مبتنی بر زمان (TOTP) دارای طول عمر مشخص باشند. حداکثر طول عمر برای درخواست‌های خارج از باند باید ۱۰ دقیقه و برای TOTP حداکثر ۳۰ ثانیه باشد.", + "L": "2" + }, + { + "Shortcode": "V6.5.6", + "Ordinal": 6, + "Description": "امکان لغو (Revoke) هر عامل احراز هویت، از جمله دستگاه‌های فیزیکی، در صورت سرقت یا مفقود شدن وجود داشته باشد.", + "L": "3" + }, + { + "Shortcode": "V6.5.7", + "Ordinal": 7, + "Description": "مکانیزم‌های احراز هویت بیومتریک فقط به‌عنوان عامل دوم و در کنار یکی از عوامل «چیزی که در اختیار دارید» یا «چیزی که کاربر می داند» مورد استفاده قرار می‌گیرند.", + "L": "3" + }, + { + "Shortcode": "V6.5.8", + "Ordinal": 8, + "Description": "اعتبارسنجی رمزهای یک‌بار مصرف مبتنی بر زمان (TOTP) بر اساس منبع زمانی از یک سرویس قابل اعتماد انجام می‌شود و نه بر اساس زمان ارائه‌شده توسط کلاینت یا منابع غیرقابل اعتماد.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.6", + "Ordinal": 6, + "Name": "Out-of-Band authentication mechanisms", + "Items": [ + { + "Shortcode": "V6.6.1", + "Ordinal": 1, + "Description": "مکانیزم‌های احراز هویت مبتنی بر شبکه تلفن عمومی (PSTN) برای ارسال رمزهای یک‌بار مصرف (OTP) از طریق تماس تلفنی یا پیامک تنها در صورتی که شماره تلفن قبلا اعتبارسنجی شده باشد، یا روش‌های جایگزین قوی‌تر (رمزهای عبور یکبار مصرف مبتنی بر زمان) در دسترس باشند ارائه می‌شوند و سرویس‌دهنده باید کاربران را از ریسک‌های امنیتی این روش‌ها مطلع سازد. برای اپلیکیشن‌های سطح L3، استفاده از تماس تلفنی و پیامک به‌عنوان گزینه، مجاز نیست.", + "L": "2" + }, + { + "Shortcode": "V6.6.2", + "Ordinal": 2, + "Description": "درخواست‌ها، کدها یا توکن‌های احراز هویت خارج از باند (Out-of-Band) به درخواست احراز هویت اصلی که برای آن تولید شده‌اند متصل باشند و قابل استفاده برای درخواست‌های قبلی یا بعدی نباشند.", + "L": "2" + }, + { + "Shortcode": "V6.6.3", + "Ordinal": 3, + "Description": "مکانیزم‌های احراز هویت خارج از باند (Out-of-Band) مبتنی بر کد، در برابر حملات brute force از طریق اعمال کنترل محدودیت نرخ (Rate Limiting) محافظت شوند. همچنین، استفاده از کدی با حداقل ۶۴ بیت آنتروپی (Entropy)مدنظر قرار گیرد.", + "L": "2" + }, + { + "Shortcode": "V6.6.4", + "Ordinal": 4, + "Description": "در صورت استفاده از Push Notifications جهت احراز هویت چند عاملی، محدودیت نرخ (Rate Limiting) به منظور جلوگیری از حملات Push Bombing اعمال شده باشد. استفاده از تطبیق عدد Matching) Number) نیز می‌تواند به کاهش این ریسک کمک کند.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.7", + "Ordinal": 7, + "Name": "Cryptographic authentication mechanism", + "Items": [ + { + "Shortcode": "V6.7.1", + "Ordinal": 1, + "Description": "گواهینامه‌های مورد استفاده برای تأیید ادعاهای احراز هویت رمزنگاری‌شده به گونه‌ای ذخیره شوند که از تغییر یا دستکاری آن‌ها محافظت شود.", + "L": "3" + }, + { + "Shortcode": "V6.7.2", + "Ordinal": 2, + "Description": "مقدار چالش (Challenge Nonce) حداقل ۶۴ بیت طول داشته باشد و از نظر آماری یکتا باشد یا حداقل در طول عمر دستگاه رمزنگاری منحصر به فرد باقی بماند.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.8", + "Ordinal": 8, + "Name": "Authentication with an Identity Provider", + "Items": [ + { + "Shortcode": "V6.8.1", + "Ordinal": 1, + "Description": "اگر برنامه از چند ارائه‌دهنده هویت (IdP) پشتیبانی می‌کند، امکان جعل هویت کاربر از طریق یک ارائه‌دهنده هویت دیگر وجود نداشته باشد (برای مثال، با استفاده از شناسه کاربری یکسان). مکانیسم استاندارد برای جلوگیری از این تهدید، این است که برنامه، کاربران را با استفاده از ترکیب شناسه IdP (به‌عنوان فضای نام یا (namespace و شناسه کاربر در آن، IdP ثبت و شناسایی کند.", + "L": "2" + }, + { + "Shortcode": "V6.8.2", + "Ordinal": 2, + "Description": "وجود و یکپارچگی امضاهای دیجیتال بر روی تصدیق‌های (تقاضاها یا ادعاهای) احراز هویت برای مثال بر روی (توکن‌های JWT یا SAML assertions) همواره اعتبارسنجی می‌شود و هرگونه تصدیقی که فاقد امضا یا دارای امضای نامعتبر باشد، رد می‌گردد.", + "L": "2" + }, + { + "Shortcode": "V6.8.3", + "Ordinal": 3, + "Description": "(تقاضاها یا ادعاهای) تصدیق‌های SAML به‌صورت منحصربه‌فرد پردازش شده و تنها یک‌بار در بازه‌ی اعتبار خود استفاده می‌شوند تا از حملات بازپخش (Replay Attacks) جلوگیری گردد.", + "L": "2" + }, + { + "Shortcode": "V6.8.4", + "Ordinal": 4, + "Description": "اگر برنامه‌ای از یک ارائه‌دهنده هویت (IdP) جداگانه استفاده می‌کند و انتظار قدرت، روش‌ها یا تازگی احراز هویت خاصی را برای عملکردهای خاص دارد، برنامه این موضوع را با استفاده از اطلاعات برگردانده شده توسط IdP تأیید می‌کند. به عنوان مثال، اگر از OIDC استفاده شود، این کار می‌تواند با اعتبارسنجی ادعاهای (Claims) موجود در توکن شناسایی (ID Token) مانند «amr»، «acr» و «auth_time» (در صورت وجود) انجام شود. اگر ارائه‌دهنده هویت این اطلاعات را ارائه نکند، برنامه باید یک روش جایگزین مستندسازی‌شده داشته باشد که فرض می‌کند حداقل سطح احراز هویت استفاده شده است (مثلاً احراز هویت تک‌عاملی با نام کاربری و گذرواژه).", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V7", + "Ordinal": 7, + "ShortName": "Session", + "Name": "Session Management", + "Items": [ + { + "Shortcode": "V7.1", + "Ordinal": 1, + "Name": "Session Management Documentation", + "Items": [ + { + "Shortcode": "V7.1.1", + "Ordinal": 1, + "Description": "بازه عدم فعالیت نشست کاربر و بیشینه طول عمر نشست قبل از احراز هویت مجدد، در ترکیب با سایر کنترل‌ها مستند و متناسب سازی شود. مستند سازی انجام شده باید شامل توجیه برای هر انحراف(نقض) از الزامات احراز هویت مجدد NIST SP 800-63B باشد.", + "L": "2" + }, + { + "Shortcode": "V7.1.2", + "Ordinal": 2, + "Description": "در مستند باید تعداد نشست همزمان مجاز برای یک کاربر و همچنین رفتار و اعمال مناسب برای زمانی که این تعداد به حداکثر رسید مشخص شود.", + "L": "2" + }, + { + "Shortcode": "V7.1.3", + "Ordinal": 3, + "Description": "تمام سیستم‌هایی که نشست‌های کاربر را به عنوان بخشی از یک اکوسیستم مدیریت هویت فدرال(مانند سیستم‌های (SSO ایجاد و مدیریت می‌کنند، باید در کنار سایر کنترل‌های مربوط به طول عمر نشست‌ها، خاتمه آن‌ها و هرگونه شرایط دیگری که نیاز به احراز هویت مجدد دارد، مستند شوند.", + "L": "2" + } + ] + }, + { + "Shortcode": "V7.2", + "Ordinal": 2, + "Name": "Fundamental Session Management Security", + "Items": [ + { + "Shortcode": "V7.2.1", + "Ordinal": 1, + "Description": "برنامه کاربردی باید تمام بررسی‌های توکن نشست‌ را با استفاده از یک سرویس backend مطمئن انجام دهد.", + "L": "1" + }, + { + "Shortcode": "V7.2.2", + "Ordinal": 2, + "Description": "برنامه کاربردی که از هر یک از توکن‌های Self-Contained یا reference که به صورت پویا برای مدیریت نشست تولید شده‌اند استفاده کند اما از از کلیدهای API ثابت و کلید‌ها استفاده نکند.", + "L": "1" + }, + { + "Shortcode": "V7.2.3", + "Ordinal": 3, + "Description": "در صورتی که برای نمایش نشست کاربر از توکن‌های reference استفاده می شود، این توکن‌ها منحصر به فرد بوده و با استفاده از یک تولید کننده عدد شبه تصادفی امن رمزنگاری(CSPRNG) که دارای انتروپی حداقل128 بیتی است تولید شوند.", + "L": "1" + }, + { + "Shortcode": "V7.2.4", + "Ordinal": 4, + "Description": "برنامه کاربردی در هنگام احراز هویت کاربر یک توکن نشست جدید تولید نماید که شامل احراز هویت مجدد و ابطال توکن نشست کنونی است.", + "L": "1" + } + ] + }, + { + "Shortcode": "V7.3", + "Ordinal": 3, + "Name": "Session Timeout", + "Items": [ + { + "Shortcode": "V7.3.1", + "Ordinal": 1, + "Description": "بر اساس تحلیل ریسک و تصمیمات امنیتی مستند شده، پس از گذشت مهلت زمانی عدم فعالیت، کاربر مجبور به احراز هویت مجدد گردد.", + "L": "2" + }, + { + "Shortcode": "V7.3.2", + "Ordinal": 2, + "Description": "بر اساس تحلیل ریسک و تصمیمات امنیتی مستند شده، پس از گذشت بیشینه زمان مطلق طول عمر، کاربر مجبور به احراز هویت مجدد گردد.", + "L": "2" + } + ] + }, + { + "Shortcode": "V7.4", + "Ordinal": 4, + "Name": "Session Termination", + "Items": [ + { + "Shortcode": "V7.4.1", + "Ordinal": 1, + "Description": "در مواقعی که فرآیند خاتمه نشست کاربر فعال می‌شود (مانند خروج کاربر یا انقضای نشست)، برنامه اجازه هیچ فعالیتی را به آن نشست نمی‌دهد. برای Reference tokens یا stateful session، این به معنی نامعتبرسازی اطلاعات نشست در برنامه Backend می‌باشد. برنامه‌هایی که از توکن‌های Self-contained استفاده می‌کنند نیاز به راه حل‌هایی نظیر نگهداری فهرستی از توکن‌های خاتمه‌یافته، عدم پذیرش توکن‌هایی که پیش از یک تاریخ و زمان مشخص برای هر کاربر تولید شده‌اند، یا چرخش کلید امضای مخصوص هر کاربر دارند.", + "L": "1" + }, + { + "Shortcode": "V7.4.2", + "Ordinal": 2, + "Description": "برنامه کاربردی تمامی نشست‌های فعال را در زمانی که حساب کاربری غیرفعال یا حذف می‌شود را ابطال نماید. (مانند کارمندی که شرکت را ترک می‌کند)", + "L": "1" + }, + { + "Shortcode": "V7.4.3", + "Ordinal": 3, + "Description": "برنامه کاربردی قابلیت ارائه گزینه ابطال تمامی نشست های فعال دیگر را پس از یک تغییر موفقیت آمیز یا حذف هریک از عوامل احراز هویت (نظیر تغییر پسورد از طریق ریست یا بازنشانی و در صورت وجود به روزرسانی تنظیمات MFA ) را داشته باشد.", + "L": "2" + }, + { + "Shortcode": "V7.4.4", + "Ordinal": 4, + "Description": "تمامی صفحاتی که نیازمند احراز هویت هستند دارای دسترسی آسان و مشخص به فرآیند خروج باشند.", + "L": "2" + }, + { + "Shortcode": "V7.4.5", + "Ordinal": 5, + "Description": "مدیران برنامه کاربردی قادر به ابطال نشست‌های فعال برای یک شخص یا تمامی کاربران باشند.", + "L": "2" + } + ] + }, + { + "Shortcode": "V7.5", + "Ordinal": 5, + "Name": "Defenses Against Session Abuse", + "Items": [ + { + "Shortcode": "V7.5.1", + "Ordinal": 1, + "Description": "برنامه کاربردی قبل از اعطای مجوز تغییر ویژگی‌های حساس حساب کاربری که بر روی احراز هویت تاثیر دارد نظیر آدرس ایمیل، شماره تلفن، تنظیمات MFA یا اطلاعات دیگر که در بازگردانی حساب کاربری مورد استفاده قرار می‌گیرند، به احراز هویت مجدد کامل نیاز دارد.", + "L": "2" + }, + { + "Shortcode": "V7.5.2", + "Ordinal": 2, + "Description": "حساب‌های کاربری قادر به دیدن(پس از احراز هویت مجدد با حداقل یک عامل) و ابطال یک یا همه نشست‌های فعال باشد.", + "L": "2" + }, + { + "Shortcode": "V7.5.3", + "Ordinal": 3, + "Description": "برنامه کاربردی قبل از اجرای تراکنش‌ها یا عملیات‌های حساس نیازمند احراز هویت مجدد با حداقل یک عامل یا صحت سنجی ثانویه باشد.", + "L": "3" + } + ] + }, + { + "Shortcode": "V7.6", + "Ordinal": 6, + "Name": "Federated Re-authentication", + "Items": [ + { + "Shortcode": "V7.6.1", + "Ordinal": 1, + "Description": "طول عمر و ابطال نشست بین RP و idp طبق سند- که نیازمند احرازهویت مجدد در زمان مورد نیاز مانند وقتی که بیشینه زمان بین رخداد احراز هویت idp رسیده باشد- انجام شود.", + "L": "2" + }, + { + "Shortcode": "V7.6.2", + "Ordinal": 2, + "Description": "ساخت نشست‌ها نیاز به رضایت کاربر یا یک اقدام صریح دارد که بدین صورت از ایجاد نشست‌های جدید برنامه بدون تعامل کاربر جلوگیری می‌شود.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V8", + "Ordinal": 8, + "ShortName": "Authorization", + "Name": "Authorization", + "Items": [ + { + "Shortcode": "V8.1", + "Ordinal": 1, + "Name": "Authorization Documentation", + "Items": [ + { + "Shortcode": "V8.1.1", + "Ordinal": 1, + "Description": "مستند اعطای مجوز باید شامل قوانینی به منظور محدودسازی دسترسی در سطح عملکرد و دسترسی مبتنی بر داده بر اساس مجوزهای کاربران و ویژگی‌های منابع باشد.", + "L": "1" + }, + { + "Shortcode": "V8.1.2", + "Ordinal": 2, + "Description": "مستند اعطای مجوز باید قوانینی را برای محدودیت‌های دسترسی در سطح Field بر اساس مجوزهای کاربران و ویژگی‌های منابع تعریف نماید(هر دو دسترسی خواندن و نوشتن). توجه داشته باشید که این قوانین ممکن است به مقادیر دیگر ویژگی‌های شیء داده ی مربوطه (Relevant Data Object) بستگی داشته باشند، مانند حالت (state) یا وضعیت (status).", + "L": "2" + }, + { + "Shortcode": "V8.1.3", + "Ordinal": 3, + "Description": "مستند برنامه کاربردی باید ویژگی‌های محیطی و زمینه‌ای (شامل و نه محدود به زمان روز، مکان، آدرس IP یا دستگاه) که در برنامه کاربردی به منظور اتخاذ تصمیمات امنیتی (نظیر آن دسته از تصمیماتی که مربوط به احراز هویت و اعطای مجوز می باشد) را مشخص کند.", + "L": "3" + }, + { + "Shortcode": "V8.1.4", + "Ordinal": 4, + "Description": "مستندات احراز هویت و اعطای مجوز، علاوه بر اعطای مجوز در سطح Field، سطح عملکرد و داده‌های خاص، چگونگی استفاده از عوامل محیطی و زمینه‌ای در اتخاذ تصمیمات را مشخص نماید.", + "L": "3" + } + ] + }, + { + "Shortcode": "V8.2", + "Ordinal": 2, + "Name": "General Authorization Design", + "Items": [ + { + "Shortcode": "V8.2.1", + "Ordinal": 1, + "Description": "برنامه کاربردی باید از محدود بودن دسترسی‌‌های در سطح عملکرد به مشتریانی که دارای دسترسی صریح هستند اطمینان حاصل نماید.", + "L": "1" + }, + { + "Shortcode": "V8.2.2", + "Ordinal": 2, + "Description": "برنامه کاربردی باید از محدود بودن دسترسی‌‌های در سطح داده به مشتریانی که دارای دسترسی صریح به اقلام داده‌ای خاص هستند اطمینان حاصل نماید تا از این طریق خطر آسیب پذیری IDOR و broken object level authorization را کاهش دهد .", + "L": "1" + }, + { + "Shortcode": "V8.2.3", + "Ordinal": 3, + "Description": "برنامه کاربردی دسترسی در سطح Field را با مجوزهای صریح به Field ها برای مصرف کنندگان جهت کاهش خطر broken object property level authorization (BOPLA) محدود کرده باشد.", + "L": "2" + }, + { + "Shortcode": "V8.2.4", + "Ordinal": 4, + "Description": "کنترل‌های امنیتی تطبیقی که بر اساس ویژگی‌های محیطی و زمینه‌ای کاربر (مانند زمان روز، مکان، آدرس IP یا دستگاه) هستند، برای تصمیم‌گیری‌های احراز هویت (Authentication) و مجوزدهی (Authorization) طبق مستندات برنامه پیاده‌سازی شده‌اند. این کنترل‌ها باید هم در زمان تلاش کاربر برای شروع یک نشست (Session) جدید و هم در طول یک نشست فعال، اعمال شوند.", + "L": "3" + } + ] + }, + { + "Shortcode": "V8.3", + "Ordinal": 3, + "Name": "Operation Level Authorization", + "Items": [ + { + "Shortcode": "V8.3.1", + "Ordinal": 1, + "Description": "برنامه کاربردی قوانین مجوزدهی را در یک لایه سرویس معتبر اعمال نموده و بر آن دسته از کنترل‌هایی که مصرف کنندگان نامعتبر قادر به دستکاری آن‌ها هستند متکی نباشد. (نظیر جاوا اسکریپت سمت کاربر)", + "L": "1" + }, + { + "Shortcode": "V8.3.2", + "Ordinal": 2, + "Description": "در مواقعی که امکان اعمال فوری تغییرات وجود ندارد (مثلاً وقتی که سیستم برای تصمیم‌گیری در مجوزدهی از توکن‌های Self-Contained مثل JWT استفاده می‌کند که اطلاعات را داخل خود ذخیره کرده و تا زمان انقضا تغییر نمی‌کنند)، باید کنترل‌های جبرانی وجود داشته باشد. این کنترل‌ها باید بتوانند زمانی که کاربر عملی را انجام می‌دهد که دیگر مجاز به آن نیست، هشدار بدهند و تغییر را برگردانند. با این حال، توجه کنید که این راهکار جایگزین نمی‌تواند جلوی نشت اطلاعات را بگیرد.", + "L": "3" + }, + { + "Shortcode": "V8.3.3", + "Ordinal": 3, + "Description": "دسترسی به یک object بر اساس مجوزهای کاربری شخص درخواست کننده(مثال: مصرف کننده) باشد نه بر اساس مجوز‌های یک واسطه یا سرویسی که به نمایندگی از او عمل می‌کند. بطور مثال، در صورتی که یک مصرف کننده یک وب سرویس را با استفاده از یک توکن self-contained برای احراز هویت فراخوانی می‌کند و سپس آن سرویس اطلاعات را از یک سرویس دیگر درخواست می‌کند، سرویس دوم باید همان توکن مصرف کننده را استفاده کند، نه یک توکن سرویس-به-سرویس (Machine-to-Machine token) که متعلق به سرویس اول است، تا تصمیمات مجوزدهی دقیقاً بر اساس مجوزهای کاربر گرفته شوند.", + "L": "3" + } + ] + }, + { + "Shortcode": "V8.4", + "Ordinal": 4, + "Name": "Other Authorization Considerations", + "Items": [ + { + "Shortcode": "V8.4.1", + "Ordinal": 1, + "Description": "برنامه های کاربردی چند کاربره(multi tenants) از کنترل های cross-tenant به منظور تضمین این امر که عملیات‌های مصرف کنندگان هرگز کاربرانی (tenants) را که مجوز تعامل با آنها را ندارند را تحت تأثیر قرار نمی‌دهد.", + "L": "2" + }, + { + "Shortcode": "V8.4.2", + "Ordinal": 2, + "Description": "دسترسی به درگاه‌های پیکربندی شامل چندین لایه امنیتی از قبیل تأیید مداوم هویت مصرف‌کننده، ارزیابی وضعیت امنیتی دستگاه و تحلیل ریسک زمینه‌ای باشد تا از این طریق اطمینان حاصل شود که موقعیت شبکه‌ای یا نقاط پایانی معتبر تنها عوامل برای مجوزدهی نیستند اگر چه که این عوامل احتمال دسترسی غیرمجاز را کاهش می‌دهند.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V9", + "Ordinal": 9, + "ShortName": "Self", + "Name": "Self-contained Tokens", + "Items": [ + { + "Shortcode": "V9.1", + "Ordinal": 1, + "Name": "Token source and integrity", + "Items": [ + { + "Shortcode": "V9.1.1", + "Ordinal": 1, + "Description": "قبل از پذیرش محتوای توکن‌ها، آن‌ها را با استفاده از امضای دیجیتال یا MAC به منظور حفاظت در مقابل دستکاری‌ها مورد اعتبارسنجی قرار داده شود.", + "L": "1" + }, + { + "Shortcode": "V9.1.2", + "Ordinal": 2, + "Description": "فقط الگوریتم‌های موجود در لیست مجاز قادر به استفاده در ساخت و صحت سنجی توکن‌های self-contained در یک زمینه مشخص باشند. این لیست مجاز باید در حالت ایده آل شامل هم الگوریتم‌های متقارن و هم نامتقارن‌ها باشد و نباید شامل الگوریتم‌های NONE باشد. در صورتی که هر دو الگوریتم‌های متقارن و نانتقارن مورد نیاز باشند کنترل‌های بیشتری باید به منظور جلوگیری از سردرگمی کلید‌ها(key Confusion) بکار گرفته شود.", + "L": "1" + }, + { + "Shortcode": "V9.1.3", + "Ordinal": 3, + "Description": "به منظور جلوگیری از مشخص نمودن منابع غیر مطمئن و کلید‌ها توسط مهاجمین، موارد کلیدی که در اعتبارسنجی توکن‌های self-contained مورد استفاده قرار می‌گیرند، از منابع از پیش پیکربندی شده مطمئنی که برای صادر کننده توکن است تعیین شود. برای JWTs و سایر ساختارهای JWS ، هدرهایی نظیر ‘jku’, ‘x5u’ و ‘jwk’ باید با یک لیست مجاز از منابع مطمئن مورد اعتبارسنجی قرار گیرند.", + "L": "1" + } + ] + }, + { + "Shortcode": "V9.2", + "Ordinal": 2, + "Name": "Token content", + "Items": [ + { + "Shortcode": "V9.2.1", + "Ordinal": 1, + "Description": "اگر یک بازه زمانی معتبر در داده‌های توکن وجود داشته باشد، توکن و محتوای آن تنها در صورتی پذیرفته می‌شوند که زمان بررسی در این بازه زمانی معتبر باشد. به عنوان مثال، برای JWTها، ادعاهای 'nbf' و 'exp' باید تایید شوند.", + "L": "1" + }, + { + "Shortcode": "V9.2.2", + "Ordinal": 2, + "Description": "سرویسی که یک توکن دریافت می‌کند قبل از پذیرش محتوای آن، از لحاظ درستی نوع بررسی نموده و برای هدف مشخص شده در نظر گیرد. بطور مثال، فقط توکن‌های access می‌توانند به منظور تصمیمات مجوزی و فقط توکن های ID می‌توانند به منظور اثبات هویت کاربر مورد پذیرش قرار گیرند.", + "L": "2" + }, + { + "Shortcode": "V9.2.3", + "Ordinal": 3, + "Description": "یک سرویس فقط توکن‌هایی را بپذیرد که به منظور استفاده توسط آن سرویس هستند(audience).برای JWT ها،این امر می‌تواند از طریق اعتبارسنجی ادعای 'aud' با یک لیست مجاز تعریف شده در سرویس صورت پذیرد.", + "L": "2" + }, + { + "Shortcode": "V9.2.4", + "Ordinal": 4, + "Description": "اگر صادر کننده توکن از کلید خصوصی مشابهی برای audienceهای متفاوت استفاده می‌کند، توکن‌های تولید شده دارای محدودیت مخاطبی باشند که بطور منحصر به فردی مخاطبین مورد نظر را مشخص می‌کند. این امر از استفاده مجدد توکن توسط مخاطب ناخواسته جلوگیری می‌کند. در صورتی که شناسه مخاطب به صورت پویا مشخص شده باشد، صادرکننده توکن باید این مخاطبین را به منظور اطمینان از عدم جعل هویت مخاطب مورد اعتبارسنجی قرار دهد.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V10", + "Ordinal": 10, + "ShortName": "OAuth", + "Name": "OAuth and OIDC", + "Items": [ + { + "Shortcode": "V10.1", + "Ordinal": 1, + "Name": "Generic OAuth and OIDC Security", + "Items": [ + { + "Shortcode": "V10.1.1", + "Ordinal": 1, + "Description": "توکن‌ها باید فقط به مؤلفه‌هایی ارسال شوند که به‌طور دقیق به آن‌ها نیاز دارند. برای مثال، هنگام استفاده از الگوی Backend-for-Frontend برای برنامه‌های JavaScript مبتنی بر مرورگر، Access Tokens و Refresh Tokens باید فقط برای Backend قابل دسترس باشند.", + "L": "2" + }, + { + "Shortcode": "V10.1.2", + "Ordinal": 2, + "Description": "Client باید فقط مقادیری را از Authorization Server بپذیرد (مانند Authorization Code یاID Token ) که این مقادیر حاصل از یک Authorization Flow باشند که توسط همان نشست (Session) و تراکنش User Agent آغاز شده است. این موضوع مستلزم آن است که Secretهای تولیدشده توسط کلاینت مانند code_verifier در PKCE، یا مقادیر state و nonce در OIDC قابل حدس زدن نباشند، مخصوص همان تراکنش باشند، و به‌صورت امن هم به کلاینت و هم به نشست (Session) مرورگری که تراکنش در آن شروع شده، متصل شده باشند.", + "L": "2" + } + ] + }, + { + "Shortcode": "V10.2", + "Ordinal": 2, + "Name": "OAuth Client", + "Items": [ + { + "Shortcode": "V10.2.1", + "Ordinal": 1, + "Description": "درCode Flow، باید OAuth Client در برابر حملاتBrowser-based Request Forgery که معمولاً با عنوان Cross-Site Request Forgery (CSRF) شناخته می‌شوند و درخواست‌های توکن را ایجاد می‌کنند، محافظت داشته باشد. این محافظت باید با استفاده از قابلیت PKCE یا با بررسی پارامترstate که در درخواست احراز مجوز ارسال شده است.", + "L": "2" + }, + { + "Shortcode": "V10.2.2", + "Ordinal": 2, + "Description": "اگر OAuth Client بتواند با بیش از یک Authorization Server تعامل داشته باشد، باید دارای سازوکاری برای دفاع در برابر Mix-up Attacks باشد. برای مثال، می‌تواند الزام کند که Authorization Server مقدار پارامتر ‘iss’ را برگرداند و این مقدار هم درAuthorization Response و هم درToken Response اعتبارسنجی شود.", + "L": "2" + }, + { + "Shortcode": "V10.2.3", + "Ordinal": 3, + "Description": "OAuth Client باید فقطScopes (یا سایر پارامترهای مجوزدهی) مورد نیاز را در درخواست‌ها به Authorization Server درخواست کند.", + "L": "3" + } + ] + }, + { + "Shortcode": "V10.3", + "Ordinal": 3, + "Name": "OAuth Resource Server", + "Items": [ + { + "Shortcode": "V10.3.1", + "Ordinal": 1, + "Description": "Resource Server باید فقط Access Tokenهایی را بپذیرد که برای استفاده با همان سرویس در نظر گرفته شده‌اند(Audience). Audience می‌تواند در یک Access Token ساختاریافته (مانند مقدار aud در JWT) درج شده باشد، یا از طریق Token Introspection Endpoint بررسی شود.", + "L": "2" + }, + { + "Shortcode": "V10.3.2", + "Ordinal": 2, + "Description": "Resource Server باید تصمیمات مجوزدهی (Authorization Decisions) را بر اساس Claims موجود در Access Token که واگذاری مجوز (Delegated Authorization) را تعریف می‌کنند، اعمال کند. اگر Claimsهایی مانند sub، scope و authorization_details موجود باشند، باید جزو فرآیند تصمیم‌گیری قرار گیرند.", + "L": "2" + }, + { + "Shortcode": "V10.3.3", + "Ordinal": 3, + "Description": "اگر برای گرفتن یک تصمیم کنترل دسترسی، لازم است یک کاربرِ یکتا از داخل Access Token (چه JWT و چه پاسخ Token Introspection ) شناسایی شود، سرور منبع (Resource Server) کاربر را از روی Claimهایی شناسایی کند که قابل اختصاص‌دادن به کاربران دیگر نیستند. معمولاً این یعنی استفاده از ترکیب دو Claim یعنی 'iss' (صادرکننده توکن) و 'sub' (شناسه یکتای کاربر)", + "L": "2" + }, + { + "Shortcode": "V10.3.4", + "Ordinal": 4, + "Description": "اگر Resource Server نیازمند قدرت، روش یا تازگی خاص احراز هویت باشد، بررسی کند که Access Token ارائه‌شده این محدودیت‌ها را برآورده می‌کند. برای مثال، در صورت وجود، از Claimsهای OIDC مانند acr، amr و auth_time به ترتیب استفاده شود.", + "L": "2" + }, + { + "Shortcode": "V10.3.5", + "Ordinal": 5, + "Description": "تأیید کنید که Resource Server از استفاده از Access Tokenهای سرقت‌شده یا Replay توکن‌ها (توسط افراد غیرمجاز) جلوگیری کند، با الزام استفاده از Sender-Constrained Access Tokens، مانند Mutual TLS برای OAuth 2 یا OAuth2 Demonstration of Proof of Possession (DPoP).", + "L": "3" + } + ] + }, + { + "Shortcode": "V10.4", + "Ordinal": 4, + "Name": "OAuth Authorization Server", + "Items": [ + { + "Shortcode": "V10.4.1", + "Ordinal": 1, + "Description": "سرور احراز هویت باید آدرس‌های بازگشتی (Redirect URI) را بر اساس فهرست مجاز (Allowlist) از URIهای از پیش‌ثبت‌شده و مخصوص هر کلاینت، با استفاده از مقایسه دقیقِ رشته‌ای Comparison) (Exact String اعتبارسنجی می‌کند.", + "L": "1" + }, + { + "Shortcode": "V10.4.2", + "Ordinal": 2, + "Description": "اگر Authorization Server کد احراز مجوز (Authorization Code) را در Authorization Response برمی‌گرداند، این کد فقط یک‌بار برای درخواست توکن باید قابل استفاده باشد. برای دومین درخواست معتبر با یک Authorization Code که قبلاً برای صدور Access Token استفاده شده است، Authorization Server باید درخواست توکن را رد کند و هر توکن صادرشده‌ی مرتبط با آن Authorization Code را باطل نماید.", + "L": "1" + }, + { + "Shortcode": "V10.4.3", + "Ordinal": 3, + "Description": "تأیید کنید که Authorization Code دارای مدت زمان معتبر بودن محدود باشد. حداکثر طول عمر می‌تواند برای برنامه‌های کاربردی در سطوح L1 و L2 تا ۱۰ دقیقه و برای برنامه‌های کاربردی در سطح L3 تا ۱ دقیقه باشد.", + "L": "1" + }, + { + "Shortcode": "V10.4.4", + "Ordinal": 4, + "Description": "برای یک Client مشخص، Authorization Server فقط استفاده از Grantهایی را مجاز بداند که آن Client به استفاده از آن‌ها نیاز دارد. توجه داشته باشید که Grantهای ‘token’ (Implicit Flow) و ‘password’ (Resource Owner Password Credentials Flow) دیگر نباید استفاده شوند.", + "L": "1" + }, + { + "Shortcode": "V10.4.5", + "Ordinal": 5, + "Description": "Authorization Server باید حملات Refresh Token Replay را برای Public Clientها کاهش دهد، ترجیحاً با استفاده از Sender-Constrained Refresh Tokens، یعنی Demonstrating Proof of Possession (DPoP) یا Certificate-Bound Access Tokens با استفاده از Mutual TLS (mTLS). برای برنامه‌های L1 و L2، می‌توان از Refresh Token Rotation استفاده کرد. اگر Refresh Token Rotation به‌کار گرفته شود، Authorization Server باید پس از استفاده، Refresh Token را باطل کند و اگر یک Refresh Token که قبلاً استفاده و باطل شده ارائه شود، تمام Refresh Tokenهای مربوط به آن مجوز را ابطال نماید.", + "L": "1" + }, + { + "Shortcode": "V10.4.6", + "Ordinal": 6, + "Description": "اگر از Code Grant استفاده شود، Authorization Server باید حملات Authorization Code Interception را با الزام به استفاده از Proof Key for Code Exchange (PKCE) کاهش دهد. برای Authorization Requestها، Authorization Server باید یک مقدار معتبر برای 'code_challenge' الزام کند و نباید مقدار 'code_challenge_method' از نوع 'plain' را بپذیرد. برای Token Request، باید اعتبارسنجی پارامتر 'code_verifier' الزامی باشد.", + "L": "2" + }, + { + "Shortcode": "V10.4.7", + "Ordinal": 7, + "Description": "اگر Authorization Server از Unauthenticated Dynamic Client Registration پشتیبانی می‌کند، ریسک مربوط به Client Applicationهای مخرب را باید کاهش دهد. این کار باید شامل اعتبارسنجی Client Metadata (مانند هر Registered URI)، اطمینان از رضایت کاربر، و هشدار به کاربر پیش از پردازش یک Authorization Request با یک Client Application غیرقابل اعتماد باشد.", + "L": "2" + }, + { + "Shortcode": "V10.4.8", + "Ordinal": 8, + "Description": "Refresh Tokenها باید دارای یک انقضای مطلق (Absolute Expiration) باشند، حتی اگر از Sliding Refresh Token Expiration استفاده شود.", + "L": "2" + }, + { + "Shortcode": "V10.4.9", + "Ordinal": 9, + "Description": "Refresh Tokenها و Reference Access Tokenها باید توسط کاربر مجاز از طریق User Interface Authorization Server قابل ابطال باشند، تا ریسک Clientهای مخرب یا توکن‌های سرقت‌شده کاهش یابد.", + "L": "2" + }, + { + "Shortcode": "V10.4.10", + "Ordinal": 10, + "Description": "Confidential Client باید برای درخواست‌های Backchannel بین Client و Authorization Server، مانند Token Requests، Pushed Authorization Requests (PAR) و Token Revocation Requests، احراز هویت شود.", + "L": "2" + }, + { + "Shortcode": "V10.4.11", + "Ordinal": 11, + "Description": "پیکربندی Authorization Server باید فقط Scopes موردنیاز را به OAuth Client اختصاص دهد.", + "L": "2" + }, + { + "Shortcode": "V10.4.12", + "Ordinal": 12, + "Description": "برای یک Client مشخص، Authorization Server فقط مقدار 'response_mode' را که این Client نیاز دارد، مجاز بداند. برای مثال، با اعتبارسنجی این مقدار توسط Authorization Server در برابر مقادیر مورد انتظار یا با استفاده از Pushed Authorization Request (PAR) یا JWT-secured Authorization Request (JAR).", + "L": "3" + }, + { + "Shortcode": "V10.4.13", + "Ordinal": 13, + "Description": "Grant Type ‘code’ همواره همراه با Pushed Authorization Requests (PAR) باید استفاده شود.", + "L": "3" + }, + { + "Shortcode": "V10.4.14", + "Ordinal": 14, + "Description": "Authorization Server باید فقط توکن‌های دسترسی از نوع وابسته به ارسال‌کننده (Proof-of-Possession) صادر می‌کند؛ چه به‌صورت توکن‌های دسترسی مبتنی بر گواهی از طریق TLS دوسویه (mTLS) و چه به‌صورت توکن‌های دسترسی وابسته به DPoP (Demonstration of Proof of Possession).", + "L": "3" + }, + { + "Shortcode": "V10.4.15", + "Ordinal": 15, + "Description": "برای یک کلاینت سمت‌سرور (که روی دستگاه کاربر نهایی اجرا نمی‌شود)، سرور احراز هویت اطمینان حاصل می‌کند که مقدار پارامترِ authorization_details از بک‌اند کلاینت ارسال شده و کاربر در آن دستکاری نکرده است. به‌عنوان مثال، با الزام به استفاده از درخواست احراز هویت پوش‌شده (PAR) یا درخواست احراز هویت ایمن‌شده با JWT (JAR).", + "L": "3" + }, + { + "Shortcode": "V10.4.16", + "Ordinal": 16, + "Description": "کلاینت باید از نوع Confidential Client باشد و سرور احراز هویت استفاده از روش‌های قدرتمند احراز هویت کلاینت ـ مبتنی بر رمزنگاری کلید عمومی و مقاوم در برابر حملات replay attacks ـ را الزامی کند؛ مانند TLS دوسویه (tls_client_auth ‎، ‎self_signed_tls_client_auth یا JWT مبتنی بر کلید خصوصی (private_key_jwt).", + "L": "3" + } + ] + }, + { + "Shortcode": "V10.5", + "Ordinal": 5, + "Name": "OIDC Client", + "Items": [ + { + "Shortcode": "V10.5.1", + "Ordinal": 1, + "Description": "Client به‌عنوان Relying Partyباید در برابر حملات بازپخش (Replay) توکن ID محافظت شده است. برای مثال، با بررسی اینکه مقدار claim مربوط به nonce در ID Token دقیقاً با مقدار **nonce**ای که در درخواست احراز هویت به OpenID Provider ارسال شده، یکسان باشد(که در OAuth 2 به آن authorization request ارسالی به authorization server گفته می‌شود).", + "L": "2" + }, + { + "Shortcode": "V10.5.2", + "Ordinal": 2, + "Description": "Client باید کاربر را به‌صورت یکتا از ID Token Claims شناسایی کند، معمولاً از ‘sub’ Claim ، که قابل انتساب مجدد به کاربران دیگر نیست (در محدوده‌ی همان Identity Provider).", + "L": "2" + }, + { + "Shortcode": "V10.5.3", + "Ordinal": 3, + "Description": "Client باید تلاش‌های یک Authorization Server مخرب برای جا زدن خود به‌جای یک Authorization Server دیگر از طریق متادیتای Authorization Server را رد می‌کند.کلاینت باید متادیتای Authorization Server را رد کند اگر مقدار issuer URL موجود در متادیتا دقیقاً با issuer URL از پیش پیکربندی‌شده و مورد انتظار کلاینت یکسان نباشد.", + "L": "2" + }, + { + "Shortcode": "V10.5.4", + "Ordinal": 4, + "Description": "Client باید اعتبارسنجی کند ID Token برای استفاده توسط همان Client در نظر گرفته شده است (Audience)، با بررسی اینکه ‘aud’ Claim در توکن برابر با مقدار ‘client_id’ مربوط به Client باشد.", + "L": "2" + }, + { + "Shortcode": "V10.5.5", + "Ordinal": 5, + "Description": "هنگام استفاده ازOIDC Back-Channel Logout، Relying Party از Denial of Service از طریق Forced Logout و Cross-JWT Confusion در جریان Logout باید جلوگیری کند. Client باید بررسی کند که Logout Token به درستی با مقدار typ آن برابر با logout+jwt باشد ، شامل ‘event’ Claim با نام عضو صحیح باشد و شامل ‘nonce’ Claim نباشد. همچنین توصیه می‌شود Expiration کوتاه باشد (مثلاً ۲ دقیقه).", + "L": "2" + } + ] + }, + { + "Shortcode": "V10.6", + "Ordinal": 6, + "Name": "OpenID Provider", + "Items": [ + { + "Shortcode": "V10.6.1", + "Ordinal": 1, + "Description": "OpenID Provider باید فقط مقادیر 'code'، 'ciba'، 'id_token' یا 'id_token code' را برای Response Mode مجاز بداند. توجه داشته باشید که 'code' نسبت به 'id_token code' (که OIDC Hybrid Flow است) ترجیح داده می‌شود و 'token' (هر Implicit Flow) نباید استفاده شود.", + "L": "2" + }, + { + "Shortcode": "V10.6.2", + "Ordinal": 2, + "Description": "OpenID Provider از Denial of Service از طریق Forced Logout جلوگیری کند. این کار با دریافت تأیید صریح از کاربر نهایی یا در صورت وجود، اعتبارسنجی پارامترها در Logout Request (که توسط Relying Party آغاز شده است)، مانند ‘id_token_hint’، انجام می‌شود.", + "L": "2" + } + ] + }, + { + "Shortcode": "V10.7", + "Ordinal": 7, + "Name": "Consent Management", + "Items": [ + { + "Shortcode": "V10.7.1", + "Ordinal": 1, + "Description": "Authorization Server باید تضمین ‌کند کاربر برای هر درخواست مجوز (Authorization Request) رضایت خود را اعلام کرده است. در صورتی که هویت کلاینت قابل اطمینان نباشد، Authorization Server باید در همه موارد کاربر را به‌صورت صریح برای اعلام رضایت (Consent) راهنمایی و از او تأیید بگیرد.", + "L": "2" + }, + { + "Shortcode": "V10.7.2", + "Ordinal": 2, + "Description": "زمانی که Authorization Server از کاربر درخواست رضایت (Consent) می‌کند باید اطلاعات کافی و شفافی درباره آنچه کاربر در حال تأیید آن است ارائه ‌دهد. در صورت لزوم، این اطلاعات باید شامل این موارد باشد: ماهیت مجوزهای درخواستی )معمولاً بر اساس scope، resource server و جزئیات مجوز در Rich Authorization Requests – RAR)، هویت برنامه یا اپلیکیشن دریافت‌کننده مجوز و مدت اعتبار این مجوزها.", + "L": "2" + }, + { + "Shortcode": "V10.7.3", + "Ordinal": 3, + "Description": "کاربر باید بتواند رضایت‌هایی (Consents) را که از طریق Authorization Server صادر کرده است، مشاهده، ویرایش و لغو (Revoke) کند.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V11", + "Ordinal": 11, + "ShortName": "Cryptography", + "Name": "Cryptography", + "Items": [ + { + "Shortcode": "V11.1", + "Ordinal": 1, + "Name": "Cryptographic Inventory and Documentation", + "Items": [ + { + "Shortcode": "V11.1.1", + "Ordinal": 1, + "Description": "اطمینان حاصل کنید که یک سیاست مستند برای مدیریت کلیدهای رمزنگاری و چرخه‌عمر کلیدهای رمزنگاری وجود دارد که از یک استاندارد مدیریت کلید مانند NIST SP 800-57 پیروی می‌کند. این باید شامل اطمینان از این موضوع باشد که کلیدها بیش از حد به اشتراک گذاشته نشوند (برای مثال، در مورد Secrets مشترک با بیش از دو موجودیت و در مورد کلیدهای خصوصی با بیش از یک موجودیت).", + "L": "2" + }, + { + "Shortcode": "V11.1.2", + "Ordinal": 2, + "Description": "فهرست اجزاء رمزنگاری باید تهیه و نگهداری ‌شود و به‌صورت منظم به‌روزرسانی گردد و شامل تمام کلیدهای رمزنگاری، الگوریتم‌ها و گواهی‌های دیجیتال مورد استفاده در برنامه باشد. این فهرست همچنین باید مشخص کند که کلیدها در کدام بخش‌های سیستم مجاز یا غیرمجاز به استفاده هستند و چه نوع داده‌هایی می‌توانند یا نمی‌توانند با این کلیدها محافظت شوند.", + "L": "2" + }, + { + "Shortcode": "V11.1.3", + "Ordinal": 3, + "Description": "مکانیزم‌های کشف رمزنگاری برای شناسایی تمام موارد استفاده از رمزنگاری در سیستم باید استفاده ‌شود؛ از جمله رمزنگاری (encryption)، هش‌کردن (hashing) و عملیات امضای دیجیتال (signing).", + "L": "3" + }, + { + "Shortcode": "V11.1.4", + "Ordinal": 4, + "Description": "فهرست اجزاء رمزنگاری باید تهیه ‌شود. این فهرست باید شامل یک برنامه مستند باشد که مسیر مهاجرت به استانداردهای جدید رمزنگاری (مانند رمزنگاری پساکوانتومی) را مشخص می‌کند تا امکان واکنش مناسب به تهدیدات آینده فراهم شود.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.2", + "Ordinal": 2, + "Name": "Secure Cryptography Implementation", + "Items": [ + { + "Shortcode": "V11.2.1", + "Ordinal": 1, + "Description": "برای عملیات رمزنگاری باید از پیاده‌سازی‌های مورد تأیید (شامل کتابخانه‌ها و پیاده‌سازی‌های سخت‌افزاری) استفاده شود.", + "L": "2" + }, + { + "Shortcode": "V11.2.2", + "Ordinal": 2, + "Description": "برنامه با انعطاف‌پذیری رمزنگاری (crypto agility) باید طراحی شده باشد، به‌طوری که الگوریتم‌های تولید اعداد تصادفی، رمزنگاری احراز هویت‌شده، MAC یا هش، طول کلیدها، تعداد دورها، رمزها و حالت‌ها بتوانند در هر زمان مجدداً پیکربندی، ارتقاء یا تعویض شوند تا در برابر شکست‌های رمزنگاری محافظت شوند. به همین ترتیب، باید امکان جایگزینی کلیدها و رمزهای عبور و رمزگذاری مجدد داده‌ها نیز وجود داشته باشد. این امکان ارتقاء بدون وقفه به رمزنگاری پساکوانتومی (PQC) را فراهم می‌کند، زمانی که پیاده‌سازی‌های با اطمینان بالا از طرح‌ها یا استانداردهای تأییدشده PQC به‌طور گسترده در دسترس قرار گیرند.", + "L": "2" + }, + { + "Shortcode": "V11.2.3", + "Ordinal": 3, + "Description": "تمام بدویات رمزنگاری (cryptographic primitives) بر اساس الگوریتم، اندازه کلید و پیکربندی، حداقل ۱۲۸ بیت سطح امنیتی را فراهم می‌کنند(2128)، برای مثال، یک کلید ECC با طول ۲۵۶ بیت تقریباً ۱۲۸ بیت امنیت ارائه می‌دهد، در حالی که برای رسیدن به همین سطح امنیت، الگوریتم RSA به کلید ۳۰۷۲ بیتی نیاز دارد.", + "L": "2" + }, + { + "Shortcode": "V11.2.4", + "Ordinal": 4, + "Description": "تأیید کنید که تمامی عملیات رمزنگاری زمان ثابت (constant-time) باشند و هیچ عملیات «کوتاه‌شده» (short-circuit) در مقایسه‌ها، محاسبات یا بازگشت‌ها وجود نداشته باشد تا از نشت اطلاعات جلوگیری شود.( مهاجم می‌تواند از همین تفاوت‌های زمانی، از طریق Timing Side-Channel Attack، اطلاعات حساس را استخراج کند.)", + "L": "3" + }, + { + "Shortcode": "V11.2.5", + "Ordinal": 5, + "Description": "تأیید کنید که تمامی ماژول‌های رمزنگاری به‌صورت امن دچار خطا (fail securely) شوند و خطاها به گونه‌ای مدیریت شوند که ایجاد آسیب‌پذیری‌هایی مانند حملات Padding Oracle را ممکن نکنند.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.3", + "Ordinal": 3, + "Name": "Encryption Algorithms", + "Items": [ + { + "Shortcode": "V11.3.1", + "Ordinal": 1, + "Description": "از مد‌های بلاک ناامن (مانند ECB) و روش‌های Padding ضعیف (مانند PKCS#1 v1.5) نباید استفاده شود.", + "L": "1" + }, + { + "Shortcode": "V11.3.2", + "Ordinal": 2, + "Description": "تنها رمزها و مد‌های تأییدشده، مانند AES با GCM باید استفاده شوند.", + "L": "1" + }, + { + "Shortcode": "V11.3.3", + "Ordinal": 3, + "Description": "داده‌های رمزنگاری‌شده باید با استفاده از ترجیحاً یک روش رمزنگاری احراز هویت‌شده تأییدشده یا با ترکیب یک روش رمزنگاری تأییدشده با یک الگوریتم MAC تأییدشده در برابر تغییرات غیرمجاز محافظت شوند.", + "L": "2" + }, + { + "Shortcode": "V11.3.4", + "Ordinal": 4, + "Description": "تأیید کنید که Nonceها، Initialization Vectorها و سایر اعداد یک‌بار مصرف برای بیش از یک جفت کلید رمزنگاری و عنصر داده استفاده نشوند. روش تولید آن‌ها باید متناسب با الگوریتم مورد استفاده باشد.", + "L": "3" + }, + { + "Shortcode": "V11.3.5", + "Ordinal": 5, + "Description": "تأیید کنید که هر ترکیبی از یک الگوریتم رمزنگاری و یک الگوریتم MAC در حالت Encrypt-then-MAC عمل کند.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.4", + "Ordinal": 4, + "Name": "Hashing and Hash-based Functions", + "Items": [ + { + "Shortcode": "V11.4.1", + "Ordinal": 1, + "Description": "تأیید کنید که تنها توابع هش تأییدشده برای موارد استفاده عمومی رمزنگاری، از جمله امضاهای دیجیتال، HMAC، KDF و تولید بیت تصادفی استفاده شوند. توابع هش غیرمجاز، مانند MD5، نباید برای هیچ هدف رمزنگاری به‌کار گرفته شوند.", + "L": "1" + }, + { + "Shortcode": "V11.4.2", + "Ordinal": 2, + "Description": "رمزعبورها با استفاده از یک تابع مشتق‌سازی کلید تأییدشده و پرهزینه محاسباتی (که به آن «تابع هش رمزعبور» نیز گفته می‌شود) ذخیره شوند، و تنظیمات پارامترها بر اساس راهنمایی‌های کنونی پیکربندی شده باشد. این تنظیمات باید تعادل بین امنیت و عملکرد برقرار کنند تا حملات Brute-force برای سطح امنیت مورد نیاز به‌طور کافی دشوار باشد.", + "L": "2" + }, + { + "Shortcode": "V11.4.3", + "Ordinal": 3, + "Description": "توابع هش استفاده‌شده در امضاهای دیجیتال، باید به‌عنوان بخشی از احراز هویت داده یا یکپارچگی داده، در برابر collision مقاوم بوده و طول بیت مناسب داشته باشند. اگر مقاومت در برابر collision لازم باشد، طول خروجی باید حداقل 256 بیت باشد. اگر تنها مقاومت در برابر حملات Second Pre-image لازم باشد، طول خروجی باید حداقل 128 بیت باشد.", + "L": "2" + }, + { + "Shortcode": "V11.4.4", + "Ordinal": 4, + "Description": "برنامه باید هنگام استخراج کلیدهای مخفی از پسوردها از توابع مشتق‌سازی کلید (KDF) تاییدشده با پارامترهای Key Stretching استفاده می‌کند. پارامترهای مورد استفاده باید تعادلی بین امنیت و عملکرد برقرار کنند تا از نفوذ حملات brute-force و به خطر افتادن کلید رمزنگاری تولیدشده جلوگیری شود.", + "L": "2" + } + ] + }, + { + "Shortcode": "V11.5", + "Ordinal": 5, + "Name": "Random Values", + "Items": [ + { + "Shortcode": "V11.5.1", + "Ordinal": 1, + "Description": "اعداد و رشته‌های تصادفی که قرار است قابل حدس نباشند، باید با استفاده از یک تولیدکننده اعداد شبه‌تصادفی امن رمزنگاری‌شده (CSPRNG) تولید شوند و حداقل 128 بیت انتروپی داشته باشند. توجه داشته باشید که UUIDها این شرط را رعایت نمی‌کنند.", + "L": "2" + }, + { + "Shortcode": "V11.5.2", + "Ordinal": 2, + "Description": "مکانیزم تولید اعداد تصادفی مورد استفاده به‌گونه‌ای طراحی شده باشد که حتی تحت بار سنگین نیز به‌طور امن عمل کند.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.6", + "Ordinal": 6, + "Name": "Public Key Cryptography", + "Items": [ + { + "Shortcode": "V11.6.1", + "Ordinal": 1, + "Description": "فقط الگوریتم‌های رمزنگاری و مدهای عملیاتی تأیید شده برای تولید کلید و مقداردهی اولیه، و همچنین برای تولید و تأیید امضاهای دیجیتال باید استفاده می‌شوند. الگوریتم‌های تولید کلید نباید کلیدهای ناامن تولید کنند که در برابر حملات شناخته شده آسیب‌پذیر باشند؛ به‌عنوان مثال، کلیدهای RSA که در برابر Fermat factorization آسیب‌پذیر هستند.", + "L": "2" + }, + { + "Shortcode": "V11.6.2", + "Ordinal": 2, + "Description": "برای تبادل کلید از الگوریتم‌های رمزنگاری تأیید شده (مانند Diffie-Hellman) استفاده می‌شود و تمرکز بر این است که مکانیزم‌های تبادل کلید از پارامترهای امن بهره ببرند. این کار از حملات بر فرآیند برقراری کلید جلوگیری می‌کند و مانع حملات مرد میانی (MITM) یا شکست‌های رمزنگاری می‌شود.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.7", + "Ordinal": 7, + "Name": "In-Use Data Cryptography", + "Items": [ + { + "Shortcode": "V11.7.1", + "Ordinal": 1, + "Description": "رمزنگاری کامل حافظه (Full Memory Encryption) باید فعال باشد تا داده‌های حساس هنگام استفاده محافظت شوند و دسترسی کاربران یا فرآیندهای غیرمجاز به آن‌ها جلوگیری شود.", + "L": "3" + }, + { + "Shortcode": "V11.7.2", + "Ordinal": 2, + "Description": "کاهش داده‌ها (data minimization) تضمین می‌کند که حداقل مقدار داده در حین پردازش افشا شود، و اطمینان حاصل شود که داده‌ها بلافاصله پس از استفاده یا در اولین فرصت ممکن رمزنگاری شوند.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V12", + "Ordinal": 12, + "ShortName": "Secure", + "Name": "Secure Communication", + "Items": [ + { + "Shortcode": "V12.1", + "Ordinal": 1, + "Name": "General TLS Security Guidance", + "Items": [ + { + "Shortcode": "V12.1.1", + "Ordinal": 1, + "Description": "جدیدترین نسخه‌های پیشنهادی پروتکل TLS فعال باشند، مانند TLS 1.2 و TLS 1.3 نسخه‌ی جدیدترین پروتکل TLS باید گزینه‌ی ترجیحی باشد.", + "L": "1" + }, + { + "Shortcode": "V12.1.2", + "Ordinal": 2, + "Description": "تنها cipher suiteهای پیشنهادی فعال باشند و قوی‌ترین cipher suiteها به‌عنوان گزینه‌ی ترجیحی تنظیم شده باشند. برنامه‌های L3 باید تنها از cipher suiteهایی پشتیبانی کنند که Forward Secrecy را فراهم می‌کنند.", + "L": "2" + }, + { + "Shortcode": "V12.1.3", + "Ordinal": 3, + "Description": "برنامه باید پیش از استفاده از هویت گواهی برای احراز هویت یا مجوزدهی، اعتبار و مورد اعتماد بودن گواهی‌های کلاینت در mTLS را بررسی و تأیید ‌کند.", + "L": "2" + }, + { + "Shortcode": "V12.1.4", + "Ordinal": 4, + "Description": "لغو صحیح گواهی‌ها، مانند OCSP ، باید فعال و به‌درستی پیکربندی شده باشد.", + "L": "3" + }, + { + "Shortcode": "V12.1.5", + "Ordinal": 5, + "Description": "Encrypted Client Hello (ECH) باید در تنظیمات TLS برنامه فعال باشد تا از افشای متادیتای حساس، مانند Server Name Indication (SNI)، در طول فرآیند Handshake TLS جلوگیری شود.", + "L": "3" + } + ] + }, + { + "Shortcode": "V12.2", + "Ordinal": 2, + "Name": "HTTPS Communication with External Facing Services", + "Items": [ + { + "Shortcode": "V12.2.1", + "Ordinal": 1, + "Description": "برای تمام ارتباطات بین کلاینت و سرویس‌های مبتنی بر HTTP که در معرض دسترسی خارجی هستند، از TLS باید استفاده ‌شود و هیچ‌گونه بازگشت (fallback) به ارتباطات ناامن یا بدون رمزنگاری انجام نگیرد.", + "L": "1" + }, + { + "Shortcode": "V12.2.2", + "Ordinal": 2, + "Description": "سرویس‌هایی که در معرض دسترسی خارجی قرار دارند از گواهی‌های TLS عمومی و مورد اعتماد استفاده می‌کنند.", + "L": "1" + } + ] + }, + { + "Shortcode": "V12.3", + "Ordinal": 3, + "Name": "General Service to Service Communication Security", + "Items": [ + { + "Shortcode": "V12.3.1", + "Ordinal": 1, + "Description": "یک پروتکل رمزنگاری‌شده مانند TLS باید برای تمامی ارتباطات ورودی و خروجی به و از برنامه استفاده شود، از جمله سیستم‌های مانیتورینگ، ابزارهای مدیریت، دسترسی از راه دور و SSH، میان‌افزارها، پایگاه‌های داده، mainframes، سیستم‌های partner یا APIهای خارجی. سرور نباید به پروتکل‌های ناامن یا بدون رمزگذاری بازگردد.", + "L": "2" + }, + { + "Shortcode": "V12.3.2", + "Ordinal": 2, + "Description": "کلاینت‌های TLS باید قبل از برقراری ارتباط با سرور TLS، گواهی‌های دریافتی را اعتبارسنجی کنند.", + "L": "2" + }, + { + "Shortcode": "V12.3.3", + "Ordinal": 3, + "Description": "TLS یا دیگر مکانیزم‌های مناسب رمزگذاری انتقال باید برای تمامی ارتباطات بین سرویس‌های داخلی مبتنی بر HTTP درون برنامه استفاده شود و ارتباط به حالت‌های ناامن یا بدون رمزگذاری بازنگردد.", + "L": "2" + }, + { + "Shortcode": "V12.3.4", + "Ordinal": 4, + "Description": "ارتباطات TLS بین سرویس‌های داخلی باید از گواهی‌های معتبر استفاده کنند. در صورتی که از گواهی‌های داخلی تولیدشده یا Self-Signed استفاده شود، سرویس مصرف‌کننده باید به‌گونه‌ای پیکربندی شود که تنها به CAهای داخلی مشخص و گواهی‌های Self-Signed خاص اعتماد کند.", + "L": "2" + }, + { + "Shortcode": "V12.3.5", + "Ordinal": 5, + "Description": "سرویس‌هایی که درون یک سیستم با یکدیگر ارتباط دارند (ارتباطات درون‌سرویسی)، باید از احراز هویت قوی استفاده کنند تا هر نقطه انتهایی (endpoint) تأیید شود. روش‌های احراز هویت قوی، مانند احراز هویت کلاینت TLS، باید به‌کار گرفته شوند تا هویت تضمین شود (با استفاده از زیرساخت کلید عمومی (PKI) و مکانیزم‌هایی که در برابر حملات تکرار (replay attacks) مقاوم هستند). برای معماری‌های میکروسرویس، استفاده از سرویس مش برای ساده‌سازی مدیریت گواهی‌ها و افزایش امنیت در نظر گرفته شود", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V13", + "Ordinal": 13, + "ShortName": "Configuration", + "Name": "Configuration", + "Items": [ + { + "Shortcode": "V13.1", + "Ordinal": 1, + "Name": "Configuration Documentation", + "Items": [ + { + "Shortcode": "V13.1.1", + "Ordinal": 1, + "Description": "تمامی نیازهای ارتباطی برنامه باید به‌طور کامل مستندسازی شده باشند. این مستندسازی شامل سرویس‌های خارجی که برنامه به آن‌ها وابسته است و همچنین مواردی که کاربر نهایی جهت اتصال به سرویس خارجی مشخص می‌کند باید باشد.", + "L": "2" + }, + { + "Shortcode": "V13.1.2", + "Ordinal": 2, + "Description": "برای هر سرویسی که برنامه استفاده می‌کند، مستندسازی باید شامل حداکثر تعداد ارتباطات همزمان (مثلاً محدودیت‌های Connection Pool) و نحوه‌ی رفتار برنامه هنگام رسیدن به این حد باشد، از جمله هر مکانیزم بازیابی یا جایگزین، تا از بروز شرایط Denial of Service جلوگیری شود.", + "L": "3" + }, + { + "Shortcode": "V13.1.3", + "Ordinal": 3, + "Description": "مستندات برنامه باید استراتژی‌های مدیریت منابع را برای هر سیستم یا سرویس خارجی که استفاده می‌کند مشخص کرده باشد (مثلاً پایگاه‌های داده، هندل‌های فایل، رشته‌ها، اتصالات HTTP) این مستندسازی باید شامل این موارد باشد :رویه‌های آزادسازی منابع، تنظیمات تایم‌اوت، مدیریت خطاها، جایی که منطق Retry اعمال می‌شود، شامل محدودیت تعداد Retry، تأخیرها و الگوریتم‌هایBack-off. برای عملیات همزمان درخواست–پاسخ HTTP (Synchronous)، مستندات باید تایم‌اوت کوتاه را الزام کند و یا Retryها را غیرفعال کند یا به‌طور سختگیرانه محدود کند تا از تاخیرهای زنجیره‌ای و هدررفت منابع جلوگیری شود.", + "L": "3" + }, + { + "Shortcode": "V13.1.4", + "Ordinal": 4, + "Description": "مستندسازی برنامه باید شامل secretهای حیاتی برای امنیت برنامه و همچنین برنامه‌ای برای چرخش آن‌ها باشد( بر اساس مدل تهدید سازمان و نیازهای کسب‌وکار).", + "L": "3" + } + ] + }, + { + "Shortcode": "V13.2", + "Ordinal": 2, + "Name": "Backend Communication Configuration", + "Items": [ + { + "Shortcode": "V13.2.1", + "Ordinal": 1, + "Description": "رتباطات بین اجزای بک‌اند برنامه که از مکانیزم استاندارد نشست کاربران برنامه پشتیبانی نمی‌کنند، از جمله APIها، میان‌افزارها و لایه‌های داده، باید احراز هویت شده باشند. احراز هویت باید با استفاده از حساب‌های سرویس جداگانه، توکن‌های کوتاه‌مدت یا احراز هویت مبتنی بر گواهی انجام شود و نباید از اعتبارنامه‌های ثابت مانند رمز عبور، کلیدهای API یا حساب‌های مشترک با دسترسی‌های سطح بالا استفاده شود.", + "L": "2" + }, + { + "Shortcode": "V13.2.2", + "Ordinal": 2, + "Description": "ارتباطات بین اجزای بک‌اند، از جمله سرویس‌های محلی یا سیستم‌عامل، APIها، میان‌افزارها و لایه‌های داده، با حساب‌هایی باید انجام شود که کمترین سطح دسترسی لازم را دارند.", + "L": "2" + }, + { + "Shortcode": "V13.2.3", + "Ordinal": 3, + "Description": "اگر اعتبارنامه‌ای برای احراز هویت سرویس استفاده می‌شود، اعتبارنامه‌ای که توسط مصرف‌کننده استفاده می‌شود، اعتبارنامه پیش‌فرض نباشد (مثلاً root/root یا admin/admin).", + "L": "2" + }, + { + "Shortcode": "V13.2.4", + "Ordinal": 4, + "Description": "یک allowlist برای تعیین منابع یا سیستم‌های خارجی که برنامه مجاز به ارتباط با آن‌ها است باید وجود داشته باشد (مثلاً برای درخواست‌های خروجی، بارگذاری داده یا دسترسی به فایل). این allowlist می‌تواند در لایه برنامه، وب‌سرور، فایروال یا ترکیبی از لایه‌های مختلف پیاده‌سازی شود.", + "L": "2" + }, + { + "Shortcode": "V13.2.5", + "Ordinal": 5, + "Description": "وب‌سرور یا سرور برنامه با یک allowlist از منابع یا سیستم‌هایی که سرور می‌تواند به آن‌ها درخواست ارسال کند یا داده‌ها و فایل‌ها را بارگذاری کند پیکربندی شده باشد.", + "L": "2" + }, + { + "Shortcode": "V13.2.6", + "Ordinal": 6, + "Description": "در مواقعی که برنامه به سرویس‌های جداگانه متصل می‌شود، پیکربندی مستندسازی‌شده برای هر اتصال رعایت شود، از جمله حداکثر ارتباطات همزمان، رفتار هنگام رسیدن به حداکثر ارتباط مجاز، زمان‌های Timeout اتصال و استراتژی‌های Retry.", + "L": "3" + } + ] + }, + { + "Shortcode": "V13.3", + "Ordinal": 3, + "Name": "Secret Management", + "Items": [ + { + "Shortcode": "V13.3.1", + "Ordinal": 1, + "Description": "یک راهکار مدیریت secret، مانند Key Vault، برای ایجاد امن، ذخیره، کنترل دسترسی و از بین بردن secret بک‌اند استفاده شود. این secret می‌تواند شامل رمزعبورها، داده‌های رمز نگاری، اطلاعات حساس مربوط به اتصال به پایگاه داده و سیستم‌های شخص ثالث، کلیدها و seedهای توکن‌های زمان‌محور، سایر secretهای داخلی و کلیدهای API باشد. Secret نباید در کد منبع برنامه یا در build artifacts قرار گیرد. برای برنامه‌های L3، این باید شامل راهکاری مبتنی بر سخت‌افزار مانند HSM باشد.", + "L": "2" + }, + { + "Shortcode": "V13.3.2", + "Ordinal": 2, + "Description": "دسترسی به دارایی‌های secret بر اساس اصل حداقل دسترسی (Least Privilege) رعایت شود.", + "L": "2" + }, + { + "Shortcode": "V13.3.3", + "Ordinal": 3, + "Description": "تمام عملیات رمزنگاری باید با استفاده از یک ماژول امنیتی ایزوله (مانند Vault یا Hardware Security Module) انجام شود تا مواد کلیدی به‌طور امن مدیریت و محافظت شده و از افشای خارج از ماژول امنیتی جلوگیری شود.", + "L": "3" + }, + { + "Shortcode": "V13.3.4", + "Ordinal": 4, + "Description": "secretها بر اساس مستندسازی برنامه طوری پیکربندی شوند که منقضی شده و چرخش داده شوند.", + "L": "3" + } + ] + }, + { + "Shortcode": "V13.4", + "Ordinal": 4, + "Name": "Unintended Information Leakage", + "Items": [ + { + "Shortcode": "V13.4.1", + "Ordinal": 1, + "Description": "برنامه باید به‌گونه‌ای مستقر شود که هیچ‌گونه متادیتای کنترل نسخه، از جمله پوشه‌های .git یا .svn، در دسترس نباشد یا به شکلی باشد که این پوشه‌ها نه از بیرون و نه توسط خود برنامه قابل دسترسی نباشند.", + "L": "1" + }, + { + "Shortcode": "V13.4.2", + "Ordinal": 2, + "Description": "حالت‌های Debug برای تمام اجزا در محیط‌های production باید غیرفعال شده باشند تا از افشای قابلیت‌های دیباگ و نشت اطلاعات جلوگیری شود.", + "L": "2" + }, + { + "Shortcode": "V13.4.3", + "Ordinal": 3, + "Description": "وب‌سرورها فهرست‌بندی دایرکتوری‌ها را به کاربر نهایی نباید نمایش دهند مگر اینکه به‌طور صریح مورد نظر باشد.", + "L": "2" + }, + { + "Shortcode": "V13.4.4", + "Ordinal": 4, + "Description": "از متد HTTP TRACE در محیط‌های production نباید پشتیبانی شود تا از احتمال نشت اطلاعات جلوگیری شود.", + "L": "2" + }, + { + "Shortcode": "V13.4.5", + "Ordinal": 5, + "Description": "مستندسازی‌ها (مانند مستندات APIهای داخلی) و نقاط پایش (Monitoring Endpoints) در دسترس نباشند مگر اینکه به‌طور صریح مورد نظر باشد.", + "L": "2" + }, + { + "Shortcode": "V13.4.6", + "Ordinal": 6, + "Description": "تأیید کنید که برنامه اطلاعات نسخه دقیق اجزای backend را افشا نکند.", + "L": "3" + }, + { + "Shortcode": "V13.4.7", + "Ordinal": 7, + "Description": "لایه وب باید به‌گونه‌ای پیکربندی شده باشد که فقط فایل‌هایی با پسوندهای مشخص را سرو کند تا از افشای تصادفی اطلاعات، پیکربندی و کد منبع جلوگیری شود.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V14", + "Ordinal": 14, + "ShortName": "Data", + "Name": "Data Protection", + "Items": [ + { + "Shortcode": "V14.1", + "Ordinal": 1, + "Name": "Data Protection Documentation", + "Items": [ + { + "Shortcode": "V14.1.1", + "Ordinal": 1, + "Description": "تمامی داده‌های حساس ایجادشده و پردازش‌شده توسط برنامه باید شناسایی شده و بر اساس سطوح حفاظتی طبقه‌بندی شده‌اند. این موضوع شامل داده‌هایی می‌شود که صرفاً کُدگذاری شده‌اند و به‌راحتی قابل بازیابی هستند، مانند رشته‌های Base64 یا محتوای متنی (plaintext) داخل یک JWT. سطوح حفاظتی باید الزامات قوانین و استانداردهای حفاظت از داده و حریم خصوصی که برنامه ملزم به رعایت آن‌هاست را در نظر بگیرند.", + "L": "2" + }, + { + "Shortcode": "V14.1.2", + "Ordinal": 2, + "Description": "برای تمامی سطوح حفاظت از داده‌های حساس، مجموعه‌ای مستند از الزامات حفاظتی تعریف شده باشد. این الزامات باید شامل (اما محدود به آن نباشد) موارد زیر باشند: الزامات مرتبط با رمزنگاری کلی، بررسی صحت و یکپارچگی، دوره‌های نگهداری داده، نحوه ثبت داده‌ها در لاگ، کنترل‌های دسترسی به داده‌های حساس در لاگ‌ها، رمزنگاری در سطح پایگاه داده، الزامات مربوط به حریم خصوصی و فناوری‌های تقویت‌کننده حریم خصوصی مورد استفاده، و سایر الزامات مرتبط با محرمانگی.", + "L": "2" + } + ] + }, + { + "Shortcode": "V14.2", + "Ordinal": 2, + "Name": "General Data Protection", + "Items": [ + { + "Shortcode": "V14.2.1", + "Ordinal": 1, + "Description": "داده‌های حساس باید فقط در بدنه پیام HTTP یا فیلدهای هدر به سرور ارسال شوند، و اینکه URL و query string شامل اطلاعات حساس (مانند API key یا session token) نباشند.", + "L": "1" + }, + { + "Shortcode": "V14.2.2", + "Ordinal": 2, + "Description": "برنامه باید از cache شدن داده‌های حساس در اجزای سرور مانند Load Balancer و Application Cache جلوگیری کند، یا اطمینان حاصل شود که داده‌ها پس از استفاده به‌طور ایمن پاک‌سازی می‌شوند.", + "L": "2" + }, + { + "Shortcode": "V14.2.3", + "Ordinal": 3, + "Description": "داده‌های حساس تعریف‌شده به طرف‌های غیرقابل اعتماد (مانند User Trackers) نباید ارسال شوند تا از جمع‌آوری ناخواسته داده‌ها خارج از کنترل برنامه جلوگیری شود.", + "L": "2" + }, + { + "Shortcode": "V14.2.4", + "Ordinal": 4, + "Description": "کنترل‌های مرتبط با داده‌های حساس شامل رمزنگاری، بررسی صحت و یکپارچگی، نگهداری، نحوه ثبت داده‌ها در لاگ، کنترل‌های دسترسی به داده‌های حساس در لاگ‌ها، حریم خصوصی و فناوری‌های مربوط به حریم خصوصی، مطابق با آنچه در مستندات برای سطح حفاظت مشخص هر داده تعریف شده است، پیاده‌سازی شوند.", + "L": "2" + }, + { + "Shortcode": "V14.2.5", + "Ordinal": 5, + "Description": "مکانیزم‌های cache باید طوری پیکربندی شده باشند که تنها پاسخ‌هایی با نوع محتوای مورد انتظار برای آن منبع cache شوند و شامل محتوای حساس یا پویا نباشند. وب‌سرور باید هنگام دسترسی به فایل ناموجود، پاسخ 404 یا 302 برگرداند و نه فایل معتبر دیگر، تا از حملات Web Cache Deception جلوگیری شود.", + "L": "3" + }, + { + "Shortcode": "V14.2.6", + "Ordinal": 6, + "Description": "برنامه باید تنها حداقل داده‌های حساس مورد نیاز برای عملکرد برنامه را بازگرداند. برای مثال، تنها برخی از ارقام شماره کارت اعتباری بازگردانده شود و نه شماره کامل. در صورتی که داده کامل لازم باشد، باید در رابط کاربری masked شود مگر اینکه کاربر به‌طور مشخص آن را مشاهده کند.", + "L": "3" + }, + { + "Shortcode": "V14.2.7", + "Ordinal": 7, + "Description": "اطلاعات حساس باید تحت طبقه‌بندی دوره‌ای نگهداری داده قرار گرفته باشند، به‌گونه‌ای که داده‌های قدیمی یا غیرضروری به‌طور خودکار، در یک برنامه زمان‌بندی‌شده مشخص، یا براساس نیاز حذف شوند.", + "L": "3" + }, + { + "Shortcode": "V14.2.8", + "Ordinal": 8, + "Description": "اطلاعات حساس باید از متادیتای فایل‌های ارسال‌شده توسط کاربر حذف شود، مگر اینکه ذخیره‌سازی آن با رضایت کاربر انجام شود.", + "L": "3" + } + ] + }, + { + "Shortcode": "V14.3", + "Ordinal": 3, + "Name": "Client-side Data Protection", + "Items": [ + { + "Shortcode": "V14.3.1", + "Ordinal": 1, + "Description": "داده‌های احراز هویت‌شده از حافظه کلاینت، مانند DOM مرورگر، پس از خروج کلاینت یا Session پاک شوند. فیلد هدر Clear-Site-Data در پاسخ سرور می‌تواند در این زمینه مفید باشد، اما کلاینت باید بتواند داده‌ها را حتی زمانی که اتصال به سرور در دسترس نیست در زمان پایان Session (خروج از آن) پاک کند.", + "L": "1" + }, + { + "Shortcode": "V14.3.2", + "Ordinal": 2, + "Description": "برنامه باید هدرهای پاسخ HTTP، anti-cach مناسب (مانند Cache-Control: no-store) را تنظیم کند تا داده‌های حساس در مرورگرها cache نشوند.", + "L": "2" + }, + { + "Shortcode": "V14.3.3", + "Ordinal": 3, + "Description": "برای اطلاعات بیشتر، همچنین به منابع زیر مراجعه کنید:", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V15", + "Ordinal": 15, + "ShortName": "Secure", + "Name": "Secure Coding and Architecture", + "Items": [ + { + "Shortcode": "V15.1", + "Ordinal": 1, + "Name": "Secure Coding and Architecture Documentation", + "Items": [ + { + "Shortcode": "V15.1.1", + "Ordinal": 1, + "Description": "مستندات برنامه باید بازه‌های زمانی جهت برطرف سازی آسیب‌پذیری‌ نسخه‌های مؤلفه‌ شخص ثالث (بر اساس ریسک) و همچنین به‌روزرسانی کتابخانه‌ها را به طور کلی تعریف کرده باشد تا ریسک ناشی از این مؤلفه‌ها به حداقل برسد.", + "L": "1" + }, + { + "Shortcode": "V15.1.2", + "Ordinal": 2, + "Description": "یک کاتالوگ دارایی مانند Software Bill of Materials (SBOM) باید برای تمامی کتابخانه‌های شخص ثالث مورد استفاده نگهداری شود. شامل تایید این که مؤلفه‌ها از مخازن از پیش تعیین‌شده، قابل اعتماد و به‌طور مستمر نگهداری‌شده تهیه شده‌اند.", + "L": "2" + }, + { + "Shortcode": "V15.1.3", + "Ordinal": 3, + "Description": "مستندات برنامه باید شامل عملکردهایی که زمان‌بر یا پرمصرف(منابع سیستمی) هستند نیز باشد. این مورد باید شامل روش‌هایی برای جلوگیری از دست‌رفتن دسترس‌پذیری به دلیل استفاده بیش از حد از این عملکردها و همچنین جلوگیری از وضعیتی باشد که پردازش یک پاسخ طولانی‌تر از زمان انتظار مصرف‌کننده شود. تدابیر احتمالی می‌تواند شامل پردازش غیرهمزمان، استفاده از صف‌ها و محدود کردن فرآیندهای موازی برای هر کاربر و هر برنامه باشد.", + "L": "2" + }, + { + "Shortcode": "V15.1.4", + "Ordinal": 4, + "Description": "مستندات برنامه باید کتابخانه‌های شخص ثالثی را که به‌عنوان «کامپوننت‌های پرخطر» شناخته می‌شوند، مشخص کرده باشد.", + "L": "3" + }, + { + "Shortcode": "V15.1.5", + "Ordinal": 5, + "Description": "مستندات برنامه باید بخش‌هایی از برنامه را که به‌عنوان «عملکرد خطرناک» استفاده می‌شود، مشخص کرده باشد.", + "L": "3" + } + ] + }, + { + "Shortcode": "V15.2", + "Ordinal": 2, + "Name": "Security Architecture and Dependencies", + "Items": [ + { + "Shortcode": "V15.2.1", + "Ordinal": 1, + "Description": "برنامه باید تنها شامل کامپوننت‌هایی باشد که چارچوب‌های زمانی مستند‌شده برای به‌روزرسانی و رفع آسیب‌پذیری‌ها را نقض نکرده‌باشند.", + "L": "1" + }, + { + "Shortcode": "V15.2.2", + "Ordinal": 2, + "Description": "برنامه باید بر اساس تصمیمات و استراتژی‌های امنیتی مستندسازی‌شده، تدابیری برای جلوگیری از کاهش دسترس‌پذیری ناشی از عملکردهایی که زمان‌بر یا پرمصرف منابع هستند، پیاده‌سازی کرده باشد.", + "L": "2" + }, + { + "Shortcode": "V15.2.3", + "Ordinal": 3, + "Description": "محیط production تنها شامل عملکردهایی می‌باشد که برای اجرای برنامه ضروری هستند و هیچ قابلیت اضافی مانند کدهای تست، نمونه‌کدها و عملکردهای توسعه‌ای در دسترس نمی‌باشد.", + "L": "2" + }, + { + "Shortcode": "V15.2.4", + "Ordinal": 4, + "Description": "کامپوننت‌های شخص ثالث و تمام وابستگی‌های انتقالی آن‌ها از مخزن مورد انتظار باید دریافت ‌شوند، چه داخلی و چه منبع خارجی، و ریسک حمله‌ی dependency confusion مدیریت شود.", + "L": "3" + }, + { + "Shortcode": "V15.2.5", + "Ordinal": 5, + "Description": "برنامه باید محافظت‌های اضافی را در بخش‌هایی از برنامه که به‌عنوان «عملکرد خطرناک» مستند شده‌اند یا از کتابخانه‌های شخص ثالثی که به‌عنوان «کامپوننت‌های پرریسک» شناخته می‌شوند، پیاده‌سازی می‌کند. این می‌تواند شامل تکنیک‌هایی مانند sandboxing، encapsulation، containerization یا جداسازی در سطح شبکه باشد تا حمله‌کنندگان پس از نفوذ به یک بخش از برنامه، نتوانند به بخش‌های دیگر برنامه منتقل شوند و زمان لازم برای پیشروی آن‌ها افزایش یابد.", + "L": "3" + } + ] + }, + { + "Shortcode": "V15.3", + "Ordinal": 3, + "Name": "Defensive Coding", + "Items": [ + { + "Shortcode": "V15.3.1", + "Ordinal": 1, + "Description": "برنامه باید تنها زیرمجموعه‌ای از فیلدهای مورد نیاز از یک data object را بازگرداند. به‌عنوان مثال، نباید کل data object بازگردانده شود، زیرا برخی فیلدهای منفرد نباید برای کاربران قابل دسترسی باشند.", + "L": "1" + }, + { + "Shortcode": "V15.3.2", + "Ordinal": 2, + "Description": "در جایی که بک‌اند برنامه به URLهای خارجی فراخوانی می‌فرستد، طوری باید پیکربندی شده باشد که تنها در صورت نیاز و منظور مشخص، از تغییر مسیرها (redirects) پیروی کند.", + "L": "2" + }, + { + "Shortcode": "V15.3.3", + "Ordinal": 3, + "Description": "برنامه باید دارای تدابیر مقابله‌ای برای محافظت در برابر حملات mass assignment باشد، به‌طوری که فیلدهای مجاز برای هر کنترلر و اکشن محدود شده باشند؛ به عنوان مثال، نباید بتوان مقداری برای فیلدی وارد یا به‌روزرسانی کرد که قرار نبوده بخشی از آن اکشن باشد.", + "L": "2" + }, + { + "Shortcode": "V15.3.4", + "Ordinal": 4, + "Description": "تمام اجزای proxying و middleware باید آدرس IP اصلی کاربر را به‌درستی منتقل کنند، با استفاده از فیلدهای داده معتبر که توسط کاربر نهایی قابل دستکاری نباشند، و برنامه و وب‌سرور از این مقدار صحیح برای ثبت لاگ و تصمیم‌گیری‌های امنیتی مانند rate limiting استفاده کنند، با در نظر گرفتن اینکه حتی آدرس IP اصلی ممکن است به دلیل IPهای پویا، VPNها یا فایروال‌های سازمانی قابل اعتماد نباشد.", + "L": "2" + }, + { + "Shortcode": "V15.3.5", + "Ordinal": 5, + "Description": "برنامه باید به‌طور صریح اطمینان حاصل کند که variables از نوع صحیح هستند و عملیات‌های مقایسه و comparator به‌صورت دقیق (strict) انجام می‌شوند. این اقدام برای جلوگیری از آسیب‌پذیری‌های type juggling یا type confusion است که ممکن است به دلیل فرضیات نادرست برنامه درباره نوع یک متغیر ایجاد شود.", + "L": "2" + }, + { + "Shortcode": "V15.3.6", + "Ordinal": 6, + "Description": "کد JavaScript باید به‌گونه‌ای نوشته شده باشد که از prototype pollution جلوگیری کند، برای مثال با استفاده از Set() یا Map() به جای object literals.", + "L": "2" + }, + { + "Shortcode": "V15.3.7", + "Ordinal": 7, + "Description": "برنامه باید دارای تدابیر محافظتی در برابر HTTP parameter pollution باشد، به‌ویژه اگر چارچوب برنامه تفاوتی بین منابع پارامترهای درخواست (رشته‌های query، پارامترهای body، کوکی‌ها یا فیلدهای هدر) قائل نشود.", + "L": "2" + } + ] + }, + { + "Shortcode": "V15.4", + "Ordinal": 4, + "Name": "Safe Concurrency", + "Items": [ + { + "Shortcode": "V15.4.1", + "Ordinal": 1, + "Description": "shared objects در کد multi-threaded (مانند cacheها، فایل‌ها، یا اشیائی که توسط multiple threads دسترسی پیدا می‌کنند) باید به‌صورت ایمن مورد استفاده قرار بگیرند، با استفاده از نوع‌های thread-safe و مکانیزم‌های همگام‌سازی مانند lock یا semaphore تا از race condition و تخریب داده جلوگیری شود.", + "L": "3" + }, + { + "Shortcode": "V15.4.2", + "Ordinal": 2, + "Description": "بررسی وضعیت یک resource، مانند وجود آن یا دسترسی‌ها،و اقداماتی که به این وضعیت وابسته‌اند، به‌صورت یک عملیات واحد انجام شوند تا از race condition نوع time-of-check to time-of-use (TOCTOU) جلوگیری شود. برای مثال، بررسی اینکه یک فایل وجود دارد قبل از باز کردن آن، یا تأیید دسترسی یک کاربر قبل از اعطای آن.", + "L": "3" + }, + { + "Shortcode": "V15.4.3", + "Ordinal": 3, + "Description": "باید از قفل‌ها (Locks) به طور یکنواخت استفاده شود تا از گیر کردن (Threads) جلوگیری شود، چه با انتظار برای یکدیگر و چه با تلاش بی‌پایان، و همچنین منطق قفل‌گذاری باید در همان کدی باقی بماند که مسئول مدیریت منبع است؛ این کار تضمین می‌کند که قفل‌ها نمی‌توانند به‌صورت ناخواسته یا خرابکارانه توسط کلاس‌ها یا کدهای بیرونی تغییر داده شوند.", + "L": "3" + }, + { + "Shortcode": "V15.4.4", + "Ordinal": 4, + "Description": "تأیید کنید که سیاست‌های تخصیص resource از thread starvation جلوگیری می‌کنند، با اطمینان از دسترسی عادلانه به منابع، مانند استفاده از thread pools و اجازه دادن به threads با اولویت پایین‌تر تا در بازه زمانی منطقی پیشرفت کنند.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V16", + "Ordinal": 16, + "ShortName": "Security", + "Name": "Security Logging and Error Handling", + "Items": [ + { + "Shortcode": "V16.1", + "Ordinal": 1, + "Name": "Security Logging Documentation", + "Items": [ + { + "Shortcode": "V16.1.1", + "Ordinal": 1, + "Description": "فهرستی باید وجود داشته باشد که در آن ثبت وقایع (Logging) انجام‌شده در هر لایه از stack فناوری برنامه، رویدادهای ثبت‌شده، فرمت‌های لاگ، محل ذخیره‌سازی، نحوه استفاده، نحوه کنترل دسترسی به آن‌ها و مدت زمان نگهداری لاگ‌ها مستند شده است.", + "L": "2" + } + ] + }, + { + "Shortcode": "V16.2", + "Ordinal": 2, + "Name": "General Logging", + "Items": [ + { + "Shortcode": "V16.2.1", + "Ordinal": 1, + "Description": "هر ورودی لاگ باید شامل متادیتای لازم (مانند زمان، مکان، چه کسی و چه چیزی) باشد تا امکان بررسی دقیق خط زمانی هنگام وقوع یک رویداد فراهم شود.", + "L": "2" + }, + { + "Shortcode": "V16.2.2", + "Ordinal": 2, + "Description": "منابع زمانی برای تمام مؤلفه‌های لاگ با هم همگام‌سازی شده‌اند و مهر زمان (timestamp)‌ در متادیتای رویدادهای امنیتی از UTC استفاده ‌کند یا شامل یک اختلاف‌زمان (time zone offset) صریح باشد. استفاده از UTC توصیه می‌شود تا یکپارچگی در سراسر سیستم‌های توزیع‌شده تضمین شود و از بروز سردرگمی در زمان تغییر ساعت تابستانی جلوگیری گردد.", + "L": "2" + }, + { + "Shortcode": "V16.2.3", + "Ordinal": 3, + "Description": "برنامه تنها لاگ‌ها را در فایل‌ها و سرویس‌هایی ذخیره یا ارسال می‌کند که در فهرست مستند لاگ‌ها ثبت شده‌اند.", + "L": "2" + }, + { + "Shortcode": "V16.2.4", + "Ordinal": 4, + "Description": "لاگ‌ها باید توسط پردازشگر لاگی که در حال استفاده است خوانده و همبسته شوند، و ترجیحاً با استفاده از یک فرمت لاگ مشترک این کار انجام گیرد.", + "L": "2" + }, + { + "Shortcode": "V16.2.5", + "Ordinal": 5, + "Description": "هنگام لاگ‌گیری از داده‌های حساس، برنامه باید لاگ گیری را بر اساس سطح حفاظت داده اعمال کند. برای مثال، ممکن است لاگ‌کردن برخی داده‌ها مانند اطلاعات ورود یا جزئیات پرداخت مجاز نباشد. داده‌های دیگر، مانند session token، تنها در صورتی باید لاگ شوند که به‌صورت hash یا masked، چه به‌طور کامل یا جزئی، ثبت شوند.", + "L": "2" + } + ] + }, + { + "Shortcode": "V16.3", + "Ordinal": 3, + "Name": "Security Events", + "Items": [ + { + "Shortcode": "V16.3.1", + "Ordinal": 1, + "Description": "تمام عملیات احراز هویت باید لاگ‌گیری ‌شوند، از جمله تلاش‌های موفق و ناموفق. همچنین باید متادیتای اضافی، مانند نوع احراز هویت یا عوامل استفاده‌شده، جمع‌آوری شود.", + "L": "2" + }, + { + "Shortcode": "V16.3.2", + "Ordinal": 2, + "Description": "تلاش‌های ناموفق برای مجوزدهی (authorization) باید لاگ‌گیری ‌شوند. برای برنامه‌های L3، این باید شامل لاگ‌گیری تمام تصمیمات مجوزدهی باشد، از جمله ثبت زمانی که داده‌های حساس دسترسی پیدا می‌کنند، بدون آنکه خود داده‌های حساس ثبت شوند.", + "L": "2" + }, + { + "Shortcode": "V16.3.3", + "Ordinal": 3, + "Description": "برنامه باید رویدادهای امنیتی تعریف‌شده در مستندات (ابتدای بخش) را لاگ‌ نماید و همچنین تلاش‌ها برای دور زدن کنترل‌های امنیتی، مانند اعتبارسنجی ورودی، منطق کسب‌وکار و ضد‌خودکارسازی، را نیز ثبت ‌کند.", + "L": "2" + }, + { + "Shortcode": "V16.3.4", + "Ordinal": 4, + "Description": "برنامه باید خطاهای غیرمنتظره و شکست‌های کنترل‌های امنیتی، مانند شکست‌های TLS در بک اند را لاگ ‌کند.", + "L": "2" + } + ] + }, + { + "Shortcode": "V16.4", + "Ordinal": 4, + "Name": "Log Protection", + "Items": [ + { + "Shortcode": "V16.4.1", + "Ordinal": 1, + "Description": "تمام مؤلفه‌های لاگ‌گیری باید داده‌ها را به‌طور مناسب رمزگذاری ‌کنند تا از حملات log injection جلوگیری شود.", + "L": "2" + }, + { + "Shortcode": "V16.4.2", + "Ordinal": 2, + "Description": "لاگ‌ها باید در برابر دسترسی غیرمجاز محافظت شده و امکان تغییر آن‌ها وجود نداشته باشد.", + "L": "2" + }, + { + "Shortcode": "V16.4.3", + "Ordinal": 3, + "Description": "لاگ‌ها به‌صورت امن باید به یک سیستم منطقی جداگانه برای تحلیل، تشخیص، هشدار و ارجاع منتقل شوند. هدف این است که در صورت نفوذ به برنامه، لاگ‌ها به خطر نیفتند.", + "L": "2" + } + ] + }, + { + "Shortcode": "V16.5", + "Ordinal": 5, + "Name": "Error Handling", + "Items": [ + { + "Shortcode": "V16.5.1", + "Ordinal": 1, + "Description": "هنگام بروز خطاهای غیرمنتظره یا حساس به امنیت، پیامی عمومی به کاربر باید بازگردانده ‌شود، به‌گونه‌ای که هیچ‌گونه اطلاعات حساس داخلی سیستم مانند stack trace، کوئری‌ها، کلیدها و توکن‌های محرمانه افشا نشود.", + "L": "2" + }, + { + "Shortcode": "V16.5.2", + "Ordinal": 2, + "Description": "برنامه باید هنگام بروز خطا در دسترسی به منابع خارجی همچنان به‌صورت امن عمل نماید، برای مثال با استفاده از الگوهایی مانند circuit breaker یا کاهش تدریجی عملکرد (graceful degradation).", + "L": "2" + }, + { + "Shortcode": "V16.5.3", + "Ordinal": 3, + "Description": "برنامه باید به‌صورت امن و کنترل‌شده دچار خطا ‌شود، حتی هنگام وقوع استثنا، و از شرایط fail-open جلوگیری نماید؛ برای مثال، از پردازش تراکنش در صورت بروز خطا در منطق اعتبارسنجی جلوگیری شود.", + "L": "2" + }, + { + "Shortcode": "V16.5.4", + "Ordinal": 4, + "Description": "یک « last resort» باید تعریف شده باشد که تمامی unhandled exception را مدیریت کند. این کار هم برای جلوگیری از از دست رفتن جزئیات خطا که باید در فایل‌های لاگ ثبت شوند و هم برای اطمینان از این است که خطا باعث از کار افتادن کل فرآیند برنامه و در نتیجه از دست رفتن دسترسی نشود، ضروری است.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V17", + "Ordinal": 17, + "ShortName": "WebRTC", + "Name": "WebRTC", + "Items": [ + { + "Shortcode": "V17.1", + "Ordinal": 1, + "Name": "TURN Server", + "Items": [ + { + "Shortcode": "V17.1.1", + "Ordinal": 1, + "Description": "سرویس Traversal Using Relays around NAT (TURN) باید تنها به آدرس‌های IP دسترسی دهد که برای اهداف ویژه رزرو نشده‌اند (مثلاً شبکه‌های داخلی، broadcast، loopback). توجه داشته باشید که این مورد هم برای آدرس‌های IPv4 و هم برای IPv6 صدق می‌کند.", + "L": "2" + }, + { + "Shortcode": "V17.1.2", + "Ordinal": 2, + "Description": "سرویس Traversal Using Relays around NAT (TURN)، نباید به resource exhaustion آسیب‌پذیر باشد، حتی زمانی که کاربران قانونی تلاش کنند تعداد زیادی پورت روی سرور TURN باز کنند.", + "L": "3" + } + ] + }, + { + "Shortcode": "V17.2", + "Ordinal": 2, + "Name": "Media", + "Items": [ + { + "Shortcode": "V17.2.1", + "Ordinal": 1, + "Description": "کلید مربوط به گواهی Datagram Transport Layer Security (DTLS) بر اساس سیاست مستند مدیریت کلیدهای رمزنگاری مدیریت و محافظت می‌شود.", + "L": "2" + }, + { + "Shortcode": "V17.2.2", + "Ordinal": 2, + "Description": "سرور Media طوری پیکربندی شده باشد که از مجموعه‌های رمزنگاری تاییدشده Datagram Transport Layer Security (DTLS) استفاده کند و از یک پروفایل محافظتی امن برای گسترش DTLS به منظور ایجاد کلیدها برای پروتکل Secure Real-time Transport Protocol (DTLS-SRTP) پشتیبانی نماید.", + "L": "2" + }, + { + "Shortcode": "V17.2.3", + "Ordinal": 3, + "Description": "احراز هویت Secure Real-time Transport Protocol (SRTP) در سرور Media بررسی ‌شود تا از حملات تزریق Real-time Transport Protocol (RTP) جلوگیری شده و این حملات باعث بروز شرایط Denial of Service یا وارد شدن محتوای صوتی یا تصویری ناخواسته به جریان‌های رسانه‌ای نشوند.", + "L": "2" + }, + { + "Shortcode": "V17.2.4", + "Ordinal": 4, + "Description": "سرور Media باید قادر باشد پردازش ترافیک رسانه‌ای ورودی را حتی هنگام مواجهه با بسته‌های Secure Real-time Transport Protocol (SRTP) ناقص یا خراب ادامه دهد.", + "L": "2" + }, + { + "Shortcode": "V17.2.5", + "Ordinal": 5, + "Description": "سرور Media باید قادر باشد پردازش ترافیک رسانه‌ای ورودی را حتی در هنگام دریافت سیلی(flood) از بسته‌های Secure Real-time Transport Protocol (SRTP) از کاربران قانونی ادامه دهد.", + "L": "3" + }, + { + "Shortcode": "V17.2.6", + "Ordinal": 6, + "Description": "سرور Media نسبت به آسیب‌پذیری \"ClientHello Race Condition \" در Datagram Transport Layer Security (DTLS) نباید آسیب‌پذیر نباشد، این کار می‌تواند با بررسی اینکه آیا سرور رسانه به‌صورت عمومی به عنوان آسیب‌پذیر شناخته شده است یا با انجام آزمون Race Condition انجام شود.", + "L": "3" + }, + { + "Shortcode": "V17.2.7", + "Ordinal": 7, + "Description": "مکانیزم‌های ضبط صدا یا تصویر مرتبط با سرور رسانه در هنگام طوفان بسته‌ای (Flood) از پروتکل انتقال بلادرنگ امن (SRTP) توسط کاربران مجاز، باید قادر به ادامه پردازش ترافیک رسانه ورودی است.", + "L": "3" + }, + { + "Shortcode": "V17.2.8", + "Ordinal": 8, + "Description": "گواهی‌نامه امنیت لایه انتقال دیتاگرام (DTLS) باید با ویژگی اثر انگشت (Fingerprint) پروتکل توصیف نشست (SDP) بررسی می‌شود و در صورت شکست در بررسی، جریان رسانه قطع می‌شود تا اصالت جریان رسانه تضمین گردد.", + "L": "3" + } + ] + }, + { + "Shortcode": "V17.3", + "Ordinal": 3, + "Name": "Signaling", + "Items": [ + { + "Shortcode": "V17.3.1", + "Ordinal": 1, + "Description": "سرور سیگنالینگ باید قادر باشد حتی در جریان flood attack، پیام‌های سیگنالینگ ورودی مشروع را پردازش کند. این باید با اعمال محدودیت نرخ (rate limiting) در سطح سیگنالینگ محقق شود.", + "L": "2" + }, + { + "Shortcode": "V17.3.2", + "Ordinal": 2, + "Description": "سرور سیگنالینگ باید قادر باشد پیام‌های سیگنالینگ مشروع را حتی در مواجهه با پیام‌های سیگنالینگ ناقص یا مخرب که می‌توانند باعث ایجاد شرایط عدم دسترسی (Denial of Service) شوند، پردازش کند. این می‌تواند شامل اعمال اعتبارسنجی ورودی، مدیریت ایمن سرریز عدد صحیح (integer overflow)، جلوگیری از سرریز بافر (buffer overflow) و استفاده از دیگر تکنیک‌های مقاوم مدیریت خطا باشد.", + "L": "2" + } + ] + } + ] + } + ] +} diff --git a/5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.legacy.csv b/5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.legacy.csv new file mode 100644 index 0000000000..97ab87cd47 --- /dev/null +++ b/5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.legacy.csv @@ -0,0 +1,347 @@ +chapter_id,chapter_name,section_id,section_name,req_id,req_description,level1,level2,level3,cwe,nist +V1,Encoding and Sanitization,V1.1,ساختار Encoding and Sanitization,V1.1.1,ورودی فقط یک‌بار به فرم استاندارد decoded یا unescaped شود، و این تنها زمانی انجام شود که انتظار می‌رود داده واقعاً در آن قالب رمزگذاری‌شده دریافت شده باشد. این فرآیند باید قبل از هرگونه پردازش بعدی روی ورودی انجام شود، و به‌هیچ‌وجه نباید پس از اعتبارسنجی یا پاک‌سازی انجام گیرد.,,✓,✓,, +V1,Encoding and Sanitization,V1.1,ساختار Encoding and Sanitization,V1.1.2,برنامه فرآیند encode و escape خروجی را به‌عنوان آخرین مرحله انجام می‌دهد؛ به‌گونه‌ای که این عملیات یا دقیقاً پیش از استفاده داده در مفسر مربوطه انجام شود، یا اینکه خود مفسر به‌طور داخلی این کار را انجام دهد.,,✓,✓,, +V1,Encoding and Sanitization,V1.2,پیشگیری از تزریق,V1.2.1,encoding خروجی برای پاسخ HTTP، سند HTML یا سند XML با زمینه‌ای که داده در آن استفاده می‌شود باید متناسب باشد؛ برای مثال، در رمزگذاری کاراکترهای مربوط به عناصر HTML، صفات HTML، توضیحات HTML، CSS یا فیلدهای هدر HTTP به‌گونه‌ای عمل شود که ساختار پیام یا سند تغییر نکند.,✓,✓,✓,, +V1,Encoding and Sanitization,V1.2,پیشگیری از تزریق,V1.2.2,هنگام ساخت پویا آدرس‌های URL، داده‌های غیرقابل‌اعتماد باید متناسب با زمینه استفاده‌شان رمزگذاری شوند (مثلاً URL Encoding یا base64url برای پارامترهای کوئری یا مسیر) همچنین اطمینان حاصل شود که فقط پروتکل‌های امن در URL مجاز باشند (برای نمونه، استفاده از JavaScript: یا data: ممنوع شود),✓,✓,✓,, +V1,Encoding and Sanitization,V1.2,پیشگیری از تزریق,V1.2.3,هنگام تولید پویا محتوای JavaScript (از جملهJSON)، از encoding یا escaping خروجی استفاده شود تا از تغییر ساختار پیام یا سند جلوگیری گردد (و از حملات تزریق JavaScript یا JSON پیشگیری شود).,✓,✓,✓,, +V1,Encoding and Sanitization,V1.2,پیشگیری از تزریق,V1.2.4,در انتخاب داده یا اجرای کوئری‌های پایگاه داده (مانند SQL، HQL، NoSQL ...)، از parameterized queries، ORMها، یا Entity Framework استفاده شود یا به روش‌های دیگر، برنامه در برابر تزریق SQL و سایر حملات تزریقی پایگاه داده ایمن شده باشد. این موضوع هنگام نوشتن stored procedure‌ها نیز صدق می‌کند.,✓,✓,✓,, +V1,Encoding and Sanitization,V1.2,پیشگیری از تزریق,V1.2.5,برنامه در برابر تزریق دستورات سیستم‌عامل (OS command injection) محافظت شده است و در فراخوانی‌های سیستم‌عامل، از کوئری‌های پارامتری‌شده سیستم‌عامل یا Encoding خروجی دستورات سیستم‌عاملی استفاده می‌شود.,✓,✓,✓,, +V1,Encoding and Sanitization,V1.2,پیشگیری از تزریق,V1.2.6,برنامه در برابر آسیب‌پذیری‌های تزریق LDAP محافظت شده است، یا اینکه کنترل‌های امنیتی مشخصی برای جلوگیری از تزریق LDAP پیاده‌سازی شده‌اند.,,✓,✓,, +V1,Encoding and Sanitization,V1.2,پیشگیری از تزریق,V1.2.7,برنامه در برابر حملات تزریقXPath، به‌وسیله‌ی استفاده از کوئری‌های پارامتری‌شده یا کوئری‌های از پیش‌کامپایل‌شده محافظت شده باشد.,,✓,✓,, +V1,Encoding and Sanitization,V1.2,پیشگیری از تزریق,V1.2.8,پردازشگرهای LaTeX به‌صورت امن پیکربندی شده‌اند (برای نمونه با عدم استفاده از گزینه‌ی --shell-escape ) و از فهرست مجاز دستورات (allowlist) برای جلوگیری از حملات تزریق LaTeX استفاده شده است.,,✓,✓,, +V1,Encoding and Sanitization,V1.2,پیشگیری از تزریق,V1.2.9,برنامه کاراکترهای ویژه در عبارات Regex را escape می‌کند (معمولاً با استفاده از \)، تا این کاراکترها به‌اشتباه به‌عنوان متاکاراکتر تفسیر نشوند.,,✓,✓,, +V1,Encoding and Sanitization,V1.2,پیشگیری از تزریق,V1.2.10,برنامه در برابر حملات تزریق CSV و فرمول (Formula Injection) محافظت شده است. برنامه باید هنگام خروجی‌ گرفتن فایل‌های CSV، از قوانین escape تعیین‌شده در بخش‌های ۲.۶ و ۲.۷ استاندارد RFC 4180 پیروی کند. همچنین، هنگام خروجی گرفتن به فرمت CSV یا سایر فرمت‌های صفحه‌گسترده (مانند XLS، XLSX یا ODF)، اگر کاراکترهای ویژه‌ای مانند '='، '+'، '-'، '@'، \t (tab) و 0\ (Null character) در ابتدای مقدار یک فیلد قرار داشته باشند، باید با یک تک‌کوتیشن (') escape شوند.,,,✓,, +V1,Encoding and Sanitization,V1.3,پاک‌سازی (Sanitization),V1.3.1,تمام ورودی‌های HTML غیرقابل اعتماد (مثلاً از طریق ویرایشگرهای WYSIWYG یا ابزارهای مشابه)، با استفاده از یک کتابخانه یا قابلیت امن و معتبر sanitization (پاک‌سازی) ‌شوند.,✓,✓,✓,, +V1,Encoding and Sanitization,V1.3,پاک‌سازی (Sanitization),V1.3.2,برنامه استفاده از تابعeval یا سایر قابلیت‌های اجرای پویا (dynamic) کد، مانند Spring Expression Language (SpEL)، اجتناب ‌کند. در مواردی که استفاده از این قابلیت‌ها اجتناب‌ناپذیر است، ورودی‌های کاربر که در اجرای کد گنجانده می‌شوند باید پیش از اجرا، به‌طور کامل پاک‌سازی (sanitized) شوند.,✓,✓,✓,, +V1,Encoding and Sanitization,V1.3,پاک‌سازی (Sanitization),V1.3.3,بخش‌های حائز اهمیت که احتمال وقوع حملات ناشی از ورودی‌های کاربر در آنها بالاست؛ باید پیشاپیش عملیاتSanitization جهت اقدامات ایمنی روی داده‌ها انجام شود؛ برای مثال، تنها کاراکترهایی که برای آن محتوا ایمن محسوب می‌شوند مجاز باشند، و ورودی‌های بیش‌از‌حد بلند نیز کوتاه (trim) شوند.,,✓,✓,, +V1,Encoding and Sanitization,V1.3,پاک‌سازی (Sanitization),V1.3.4,محتوای اسکریپت‌پذیر (scriptable) فایل‌های SVG که توسط کاربر ارائه می‌شود، مورد اعتبارسنجی یا پاک‌سازی (sanitization) قرار گرفته باشد تا فقط شامل تگ‌ها و ویژگی‌هایی (attributes) باشد که برای برنامه ایمن هستند؛ برای مثال، از درج اسکریپت‌ها و عناصر خطرناک مانند foreignObject جلوگیری شده باشد.,,✓,✓,, +V1,Encoding and Sanitization,V1.3,پاک‌سازی (Sanitization),V1.3.5,برنامه محتوای زبان‌های قالب‌نویسی یا اسکریپت‌پذیر ارائه‌شده توسط کاربر، مانند Markdown، CSS یا استایل‌شیت‌های XSL، BBCode یا موارد مشابه را پاک‌سازی (sanitize) کرده یا غیرفعال کرده باشد.,,✓,✓,, +V1,Encoding and Sanitization,V1.3,پاک‌سازی (Sanitization),V1.3.6,برنامه در برابر حملات جعل درخواست سمت سرور (SSRF) محافظت شده باشد؛ به این صورت که داده‌های غیرقابل اعتماد را در برابر یک لیست مجاز از پروتکل‌ها، دامنه‌ها، مسیرها و پورت‌ها اعتبارسنجی کرده و کاراکترهای بالقوه خطرناک را پیش از استفاده از داده برای فراخوانی سرویس دیگر پاک‌سازی (sanitize) می‌کند.,,✓,✓,, +V1,Encoding and Sanitization,V1.3,پاک‌سازی (Sanitization),V1.3.7,برنامه در برابر حملات تزریق قالب (Template Injection) محافظت شده باشد؛ به این صورت که ساخت قالب‌ها بر پایه داده‌های غیرقابل اعتماد مجاز نباشد. در صورتی که هیچ راه‌حل جایگزینی وجود نداشته باشد، هرگونه ورودی غیرقابل اعتماد که به‌صورت پویا در فرآیند ایجاد قالب وارد می‌شود، باید پیش از استفاده یا پاک‌سازی (sanitize) شود یا به‌صورت سخت‌گیرانه اعتبارسنجی (validate) گردد.,,✓,✓,, +V1,Encoding and Sanitization,V1.3,پاک‌سازی (Sanitization),V1.3.8,برنامه، ورودی غیرقابل اعتماد را پیش از استفاده در کوئری‌های Java Naming and Directory Interface (JNDI) به‌درستی پاک‌سازی (sanitize) می‌کند و همچنین اطمینان حاصل شود که پیکربندی JNDI به‌گونه‌ای امن انجام شده تا از بروز حملات تزریق JNDI جلوگیری شود.,,✓,✓,, +V1,Encoding and Sanitization,V1.3,پاک‌سازی (Sanitization),V1.3.9,برنامه، محتوا را پیش از ارسال به memcache پاک‌سازی (sanitize) می‌کند تا از حملات تزریق (injection attacks) جلوگیری شود.,,✓,✓,, +V1,Encoding and Sanitization,V1.3,پاک‌سازی (Sanitization),V1.3.10,رشته‌های قالب‌بندی (format strings) که ممکن است هنگام استفاده، به‌شکلی ناخواسته یا مخرب تفسیر شوند، پیش از پردازش پاک‌سازی (sanitize) شوند.,,✓,✓,, +V1,Encoding and Sanitization,V1.3,پاک‌سازی (Sanitization),V1.3.11,برنامه ورودی‌های کاربر را پیش از ارسال به سامانه‌های ایمیل (مانند SMTP یا IMAP) پاک‌سازی (sanitize) ‌کند تا از حملات تزریق در SMTP یا IMAP جلوگیری شود.,,✓,✓,, +V1,Encoding and Sanitization,V1.3,پاک‌سازی (Sanitization),V1.3.12,عبارات منظم (Regular Expressions) عاری از اجزایی هستند که باعث بازگشت‌پذیری نمایی (exponential backtracking) می‌شوند، و همچنین ورودی‌های غیرقابل اعتماد به‌درستی پاک‌سازی (sanitize) شوند تا از حملات ReDoS (انکار سرویس با استفاده از عبارات منظم) یا Runaway Regex جلوگیری گردد.,,,✓,, +V1,Encoding and Sanitization,V1.4,"حافظه، رشته و کد بدون مدیریت (Memory, String, and Unmanaged Code)",V1.4.1,برنامه از رشته‌های ایمن از نظر مدیریت حافظه، کپی حافظه‌ای ایمن‌تر و حساب‌گری ایمن‌تر روی اشاره‌گرها استفاده می‌کند تا از سرریز پشته (stack overflow)، سرریز بافر (buffer overflow) یا سرریز حافظه پویای (heap overflow) جلوگیری کرده یا آن‌ها را شناسایی کند.,,✓,✓,, +V1,Encoding and Sanitization,V1.4,"حافظه، رشته و کد بدون مدیریت (Memory, String, and Unmanaged Code)",V1.4.2,از تکنیک‌های اعتبارسنجی علامت (sign validation)، محدوده (range validation) و ورودی (input validation) استفاده شده است تا از بروز سرریز عدد صحیح (integer overflow) جلوگیری شود.,,✓,✓,, +V1,Encoding and Sanitization,V1.4,"حافظه، رشته و کد بدون مدیریت (Memory, String, and Unmanaged Code)",V1.4.3,حافظه و منابعی که به‌صورت پویا تخصیص داده شده‌اند، به‌درستی آزاد (release) می‌شوند و همچنین ارجاع‌ها یا اشاره‌گرها (pointers) به حافظه آزادشده حذف یا به null تنظیم می‌شوند تا از اشاره‌گرهای معلق (dangling pointers) و آسیب‌پذیری‌های استفاده پس از آزادسازی (use-after-free) جلوگیری شود.,,✓,✓,, +V1,Encoding and Sanitization,V1.5,سریال‌زدایی ایمن (Safe Deserialization),V1.5.1,برنامه، XML Parserها را به‌گونه‌ای پیکربندی کرده باشد که از تنظیمات محدودکننده استفاده کنند، و ویژگی‌های ناایمنی مانند resolve کردن موجودیت‌های خارجی (external entities) غیرفعال شده باشند تا از حملات XML External Entity (XXE) جلوگیری شود.,✓,✓,✓,, +V1,Encoding and Sanitization,V1.5,سریال‌زدایی ایمن (Safe Deserialization),V1.5.2,فرآیند deserialization داده‌های غیرقابل‌اعتماد، با اجرای مدیریت ایمن ورودی‌ها همراه باشد؛ برای مثال، استفاده از لیست مجاز (allowlist) انواع objectها یا محدود کردن انواع تعریف‌شده توسط کلاینت برای جلوگیری از حملات مرتبط با deserialization. همچنین، مکانیزم‌های deserialization که به‌طور صریح به‌عنوان ناایمن شناخته شده‌اند، نباید با داده‌های غیرقابل‌اعتماد مورد استفاده قرار گیرند.,,✓,✓,, +V1,Encoding and Sanitization,V1.5,سریال‌زدایی ایمن (Safe Deserialization),V1.5.3,Parser های مختلفی که در برنامه برای یک نوع داده مشخص استفاده می‌شوند (برای مثال: Parser های JSON، XML یا URL)، رفتار تحلیلی یکسانی دارند و از مکانیزم یکسانی برای encoding کاراکترها استفاده می‌کنند، تا از بروز مشکلاتی مانند آسیب‌پذیری در سازگاری JSON (JSON Interoperability) یا تفاوت در نحوه تحلیل URI یا مسیر فایل که ممکن است در حملات RFI یا SSRF سوءاستفاده شود، جلوگیری شود.,,,✓,, +V2,Validation and Business Logic,V2.1,مستندات اعتبارسنجی و منطق کسب‌وکار ( Validation and Business Logic Documentation),V2.1.1,قوانین اعتبارسنجی ورودی‌های برنامه (مندرج در مستندات برنامه) ‌باید چگونگی بررسی صحت داده‌ها را مطابق با ساختار مورد انتظار مشخص نماید. این ساختار می‌تواند شامل فرمت‌های رایج داده مانند شماره کارت اعتباری، آدرس ایمیل، شماره تلفن یا یک قالب داده‌ای داخلی باشد.,✓,✓,✓,, +V2,Validation and Business Logic,V2.1,مستندات اعتبارسنجی و منطق کسب‌وکار ( Validation and Business Logic Documentation),V2.1.2,قوانین اعتبارسنجی ورودی‌های برنامه (مندرج در مستندات برنامه) باید چگونگی بررسی سازگاری مناسب بین داده‌‌های ترکیب شده (از نظر مفهومی و متنی) را مشخص نماید؛ مانند تطبیق کدپستی با نام محله.,,✓,✓,, +V2,Validation and Business Logic,V2.1,مستندات اعتبارسنجی و منطق کسب‌وکار ( Validation and Business Logic Documentation),V2.1.3,انتظارات مربوط به محدودیت‌ها و اعتبارسنجی‌های منطق کسب و کار مستند شده باشند؛ این مستندات باید شامل محدودیت‌ها در سطح هر کاربر و محدودیت‌های عمومی در سطح برنامه باشند.,,✓,✓,, +V2,Validation and Business Logic,V2.2,اعتبارسنجی ورودی (Input Validation),V2.2.1,ورودی‌ها باید به‌منظور اعمال انتظارات کسب و کار یا عملکردی مرتبط با آن‌ها اعتبارسنجی ‌شوند.این اعتبارسنجی باید یکی از این دو روش زیر را داشته باشد، استفاده از اعتبارسنجی مثبت (Positive Validation) مبتنی بر فهرست مجاز از مقادیر، الگوها یا بازه‌های قابل قبول و تطبیق با ساختار مورد انتظار و محدودیت‌های منطقی، بر اساس قوانین از پیش تعریف‌شده. برای سطح 1 (L1)، تمرکز می‌تواند بر ورودی‌هایی باشد که در تصمیم‌گیری‌های خاص تجاری یا امنیتی استفاده می‌شوند. برای سطح 2 و بالاتر، این اعتبارسنجی باید شامل تمام ورودی‌ها باشد.,✓,✓,✓,, +V2,Validation and Business Logic,V2.2,اعتبارسنجی ورودی (Input Validation),V2.2.2,برنامه به‌گونه‌ای طراحی شود که اعتبارسنجی ورودی را در لایه‌ قابل اعتمادی از سرویس (Trusted Service Layer) اعمال کند. هرچند اعتبارسنجی سمت کلاینت (Client-side Validation) باعث بهبود تجربه کاربری می‌شود و توصیه می‌گردد، اما نباید به‌عنوان یک کنترل امنیتی اتکا شود.,✓,✓,✓,, +V2,Validation and Business Logic,V2.2,اعتبارسنجی ورودی (Input Validation),V2.2.3,برنامه باید اطمینان حاصل نماید که ترکیب داده‌های مربوطه با توجه به قوانین از پیش تعریف‌شده معقول و منطقی باشد.,,✓,✓,, +V2,Validation and Business Logic,V2.3,امنیت منطق کسب‌وکار (Business Logic Security),V2.3.1,اطمینان حاصل شود که برنامه فقط جریان‌های منطق تجاری را برای همان کاربر و طبق ترتیب گام‌به‌گام از پیش تعیین شده و مورد انتظار پردازش می‌کند و امکان رد کردن مراحل (Skipping Steps) وجود ندارد.,✓,✓,✓,, +V2,Validation and Business Logic,V2.3,امنیت منطق کسب‌وکار (Business Logic Security),V2.3.2,اطمینان حاصل شود که محدودیت‌های منطق تجاری مطابق با مستندات برنامه پیاده‌سازی شده‌اند، تا از سوء‌استفاده از نقص‌های منطقی جلوگیری شود.,,✓,✓,, +V2,Validation and Business Logic,V2.3,امنیت منطق کسب‌وکار (Business Logic Security),V2.3.3,تراکنش‌های سطح منطق کسب‌وکار (business logic) باید به‌گونه‌ای استفاده شوند که یا یک عملیات منطق کسب‌وکار به‌طور کامل با موفقیت انجام شود، یا در صورت بروز خطا، به حالت صحیح قبلی بازگردد(rollback) شود.,,✓,✓,, +V2,Validation and Business Logic,V2.3,امنیت منطق کسب‌وکار (Business Logic Security),V2.3.4,در منطق کسب‌وکار (business logic)باید از مکانیزم‌های قفل‌گذاری (locking) استفاده شده باشد تا اطمینان حاصل شود که منابع محدود (مانند صندلی‌های سینما یا بازه‌های زمانی تحویل)، قابل رزرو دوباره (double-booked) از طریق دستکاری منطق برنامه نباشند.,,✓,✓,, +V2,Validation and Business Logic,V2.3,امنیت منطق کسب‌وکار (Business Logic Security),V2.3.5,اطمینان حاصل شود که جریان‌های منطق کسب و کاری با ارزش بالا نیازمند تایید چند کاربره (Multi-user Approval) هستند تا از اقدامات غیرمجاز یا تصادفی جلوگیری شود. این موارد می‌تواند شامل – اما نه محدود به – انتقال‌های مالی بزرگ، تایید قرارداد‌ها، دسترسی به اطلاعات طبقه‌بنده شده، یا غیرفعال‌سازی‌های ایمنی در محیط‌های تولید صنعتی باشد.,,,✓,, +V2,Validation and Business Logic,V2.4,مقابله با خودکارسازی (Anti-automation),V2.4.1,کنترل‌های ضد خودکارسازی (Anti-Automation) در سیستم پیاده‌سازی شده باشند تا از سوءاستفاده‌هایی مانند فراخوانی بیش از حد توابع برنامه جلوگیری شود؛ چرا که این نوع حملات می‌توانند منجر به استخراج غیرمجاز داده‌ها، تولید داده‌های زائد، مصرف کامل سهمیه‌ها، عبور از محدودیت‌های نرخ (Rate Limit)، ایجاد اختلال در سرویس (DoS) یا استفاده بیش از حد از منابع گران‌قیمت شوند.,,✓,✓,, +V2,Validation and Business Logic,V2.4,مقابله با خودکارسازی (Anti-automation),V2.4.2,بررسی کنید که جریان‌های منطق کسب‌وکار (Business Logic Flows) به گونه‌ای طراحی شده باشند که نیازمند زمان‌بندی واقعی انسان باشند، و از ارسال سریع و غیرطبیعی تراکنش‌ها (Transaction Submissions) جلوگیری کنند.,,,✓,, +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.1,مستندسازی امنیت رابط کاربری وب ( Web Frontend Security Documentation),V3.1.1,در مستندات برنامه باید ویژگی‌های امنیتی مربوط به مرورگری که برنامه را اجرا میکند مشخص شده باشد (نظیر استفاده از HTTPS، پشتیبانی از HTTP Strict Transport Security (HSTS)، اجرای Content Security Policy (CSP) و سایر مکانیزم‌های امنیتی مرتبط با HTTP). همچنین در مستندات باید مشخص شود مرورگر در صورت عدم دسترسی به این ویژگی‌ها چه رفتاری باید داشته باشد. (برای مثال: نمایش هشدار به کاربر یا ممانعت از دسترسی به برنامه).,,,✓,, +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.2,تفسیر ناخواسته محتوا (Unintended Content Interpretation),V3.2.1,کنترل‌های امنیتی متناسب با مرورگر‌ها در هنگام پردازش پاسخ‌های HTTP به منظور جلوگیری از پردازش محتوا یا عملکرد مربوط به آن در شرایط زمینه‌‌ای نادرست باید بکار‌گرفته شود. (برای مثال، زمانی که یک APIیا یک فایل بارگذاری‌شده توسط کاربر یا هر منبع دیگری به‌طور مستقیم درخواست می‌شود).کنترل‌های ممکن می‌توانند شامل این موارد باشند: عدم پردازش محتوا مگر در صورت وجود هدرهای متناسب با درخواست‌های HTTP (مانند ‎Sec-Fetch-*) به منظور اطمیان از صحیح بودن پردازش محتوا یا عملکرد مربوط به . استفاده از عبارت sandbox در هدر Content-Security-Policy یا استفاده از نوعattachment در هدر Content-Disposition .,✓,✓,✓,, +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.2,تفسیر ناخواسته محتوا (Unintended Content Interpretation),V3.2.2,اطمینان حاصل شود که محتوایی که برای نمایش به‌صورت متن طراحی شده نه برای پردازش به صورتHTML ، با استفاده از توابع امن نظیر CreateTextNode یا textContent به منظور جلوگیری از اجرای ناخواسته محتوایی مانند HTML یا JavaScript پردازش ‌شود.,✓,✓,✓,, +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.2,تفسیر ناخواسته محتوا (Unintended Content Interpretation),V3.2.3,برنامه هنگام استفاده از جاوااسکریپت سمت کاربر (Client-Side JavaScript)، با استفاده از اعلام متغیرها به‌صورت صریح، انجام بررسی نوع به‌صورت سخت‌گیرانه، اجتناب از ذخیره‌سازی متغیرهای سراسری بر روی شیء document، و پیاده‌سازی ایزولاسیون فضای نام (namespace isolation)، از وقوع DOM Clobbering جلوگیری می‌کند.,,,✓,, +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.3,پیکربندی کوکی (Cookie Setup),V3.3.1,اطمینان حاصل شود که کوکی‌ها دارای ویژگی ‘Secure’ هستند. در صورتی که از پیشوند ‘__Host-’ برای نام کوکی استفاده نمی‌شود، باید پیشوند__Secure- در نام کوکی لحاظ شده باشد.,✓,✓,✓,, +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.3,پیکربندی کوکی (Cookie Setup),V3.3.2,اطمینان حاصل شود که مقدار ویژگی SameSite برای هر کوکی، متناسب با هدف آن کوکی تنظیم شده باشد تا میزان آسیب‌پذیری در برابر حملات فریب سمت کلاینت نظیر CSRF کاهش یابد.,,✓,✓,, +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.3,پیکربندی کوکی (Cookie Setup),V3.3.3,اطمینان حاصل شود که کوکی‌ها از پیشوند __Host- در نام خود استفاده می‌کنند، مگر در مواردی که کوکی به‌طور مشخص برای اشتراک‌گذاری بین چند دامنه (Hosts) طراحی شده باشد.,,✓,✓,, +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.3,پیکربندی کوکی (Cookie Setup),V3.3.4,اطمینان حاصل شود که اگر مقدار کوکی (مثلاً توکن نشست) نباید برای اسکریپت‌های سمت کلاینت در دسترس باشد، ویژگی HttpOnly باید برای آن کوکی فعال شده باشد، و همچنین مقدار کوکی (مثلاً همان توکن نشست) تنها از طریق هدر Set-Cookie به کلاینت ارسال شود.,,✓,✓,, +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.3,پیکربندی کوکی (Cookie Setup),V3.3.5,اطمینان حاصل شود که حداکثر مجموع نام و مقدار کوکی از ۴۰۹۶ بایت تجاوز نکند.کوکی‌هایی که بیش از این مقدار باشند توسط مرورگر ذخیره نخواهند شد، و بنابراین در درخواست‌ها ارسال نمی‌شوند؛ موضوعی که ممکن است باعث شود عملکردهایی از برنامه که به آن کوکی وابسته‌اند، غیرفعال یا مختل شوند.,,,✓,, +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.4,هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers),V3.4.1,اطمینان حاصل شود که در تمامی پاسخ‌های HTTP، هدر Strict-Transport-Security وجود دارد تا سیاست HSTS (HTTP Strict Transport Security) اعمال شود. حداقل مقدار max-age باید برابر با یک سال باشد. برای برنامه‌های سطح 2 (L2) و بالاتر، این سیاست باید برای تمام زیردامنه‌ها (subdomains) نیز اعمال شود.,✓,✓,✓,, +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.4,هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers),V3.4.2,اطمینان حاصل شود که هدرAccess-Control-Allow-Origin مربوط به (CORS)، دارای یک مقدار ثابت و مشخص توسط برنامه باشد یا اگر هدر Origin در درخواست مورد استفاده قرار می گیرد باید با فهرستی از مبدأهای مورد اعتماد (Allowlist) اعتبارسنجی شود. در صورتی که استفاده از مقدار * در Access-Control-Allow-Origin تنظیم شده باشد، اطمینان حاصل شود که هیچ اطلاعات حساسی در پاسخ قرار ندارد.,✓,✓,✓,, +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.4,هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers),V3.4.3,اطمینان حاصل شود که تمامی پاسخ‌های HTTP شامل هدر Content-Security-Policy باشند تا ریسک اجرای اسکریپت‌های مخرب (مانند (JavaScript مخرب کاهش یابد. دستورهای object-src 'none' و base-uri 'none' الزامی هستند .برای برنامه‌های سطح 3 (L3)، باید سیاست CSP به‌صورت اختصاصی برای هر پاسخ(Per-response Policy) و مبتنی بر nonce یا hash تعریف شده باشد.,,✓,✓,, +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.4,هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers),V3.4.4,اطمینان حاصل شود که تمامی پاسخ‌ها شامل هدر X-Content-Type-Options: nosniff باشند، این (هدر) به مرورگرها دستور می‌دهد که برای پاسخ دریافتی از Content Sniffing یا حدس‌زدن نوع محتوا (MIME Type Guessing) استفاده نکنند و آن‌ها را ملزم می‌کند که نوع محتوای واقعی را دقیقاً مطابق مقدار هدر Content-Type در درخواست/پاسخ در نظر بگیرند.برای مثال، پاسخ به یک درخواست برای یک فایل استایل (CSS) تنها در صورتی پذیرفته می‌شود که مقدار Content-Type در پاسخ 'text/css' باشد.این کار همچنین امکان استفاده از قابلیت مسدودسازی خواندن منابع از مبدا متفاوت Cross-Origin Read Blocking یا (CORB) توسط مرورگر را فراهم می‌سازد.,,✓,✓,, +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.4,هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers),V3.4.5,"برنامه باید (وب‌سایت یا اپلیکیشن) یک ""Referrer Policy"" (سیاست ارجاع) تنظیم کرده باشد تا از نشت اطلاعات حساس از طریق هدر HTTP به نام Referer به سرویس‌های شخص ثالث جلوگیری شود. این کار را می‌توان از طریق هدر پاسخ HTTP به نام Referrer-Policy یا با استفاده از ویژگی‌هایی در عناصر HTML انجام داد.اطلاعات حساس ممکن است شامل مسیر (Path) و داده‌های کوئری (Query) در آدرس URL باشد، و در مورد برنامه‌های داخلی و غیرعمومی، حتی نام میزبان (hostname) نیز می‌تواند جزو اطلاعات حساس محسوب شود.",,✓,✓,, +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.4,هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers),V3.4.6,برنامه باید از frame-ancestors در هدر Content-Security-Policy (CSP) برای تمام پاسخ‌های HTTP استفاده کند،تا به‌صورت پیش‌فرض، اجازه‌ی نمایش سایت در قالب iframe داده نشود، و فقط در صورت نیاز، نمایش منابع خاص (specific resources) در iframe مجاز باشد.به این نکته توجه کنید که هدر X-Frame-Options با اینکه هنوز توسط برخی مرورگرها پشتیبانی می‌شود، اما قدیمی (obsolete) است و نباید به آن تکیه کرد.,,✓,✓,, +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.4,هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers),V3.4.7,هدر Content-Security-Policy (CSP) باید شامل یک آدرس برای گزارش (Report violation) باشد.,,,✓,, +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.4,هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers),V3.4.8,تمام پاسخ‌های HTTP که باعث رندر (نمایش) یک سند می‌شوند مانند (پاسخ‌هایی با نوع محتوا (text/html باید شامل هدر Cross-Origin-Opener-Policy با دستور same-origin یا same-origin-allow-popups باشند (بنا به نیاز). این کار از حملاتی جلوگیری می‌کند که از دسترسی مشترک به اشیای Window سوءاستفاده می‌کنند، مانند حملات tabnabbing و frame counting.,,,✓,, +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.5,تفکیک مبدا توسط مرورگر (Browser Origin Separation),V3.5.1,برنامه باید از مکانیزم Preflight در CORS برای جلوگیری از درخواست‌های cross-origin به عملکردهای حساس استفاده نمی‌کند، این درخواست‌ها به‌گونه‌ای اعتبارسنجی شوند که فقط از مبدأ اصلی برنامه ارسال شده باشند. این اعتبارسنجی می‌تواند با استفاده از توکن‌های (anti- forgery tokens) یا الزام به ارسال هدرهای HTTP اضافی انجام شود که در لیست هدرهای مجاز CORS (CORS-safelisted) قرار ندارند. این اقدام برای محافظت در برابر حملات جعل درخواست از طریق مرورگر، که با نام CSRF (Cross-Site Request Forgery) شناخته می‌شوند، ضروری است.,✓,✓,✓,, +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.5,تفکیک مبدا توسط مرورگر (Browser Origin Separation),V3.5.2,اگر برنامه برای جلوگیری از استفاده غیرمجاز cross-origin از عملکردهای حساس، به مکانیزم Preflight در CORS متکی است، باید امکان فراخوانی این عملکردها با درخواست‌هایی که باعث ایجاد Preflight نمی‌شوند، وجود نداشته باشد. برای تحقق این هدف ممکن است لازم باشد مقدار هدرهای Origin و Content-Type بررسی شوند یا از هدر اضافی استفاده شود که در لیست هدرهای مجاز CORS قرار ندارد.,✓,✓,✓,, +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.5,تفکیک مبدا توسط مرورگر (Browser Origin Separation),V3.5.3,"برنامه باید درخواست‌های HTTP که به عملکردهای حساس از متدهای مناسب مانند POST، PUT، PATCH یا DELETE استفاده می‌کنند، و نه از متدهایی که در استاندارد HTTP به‌عنوان ""ایمن"" تعریف شده‌اند، مانند GET، HEAD یا .OPTIONS به عنوان جایگزین یا مکمل، می‌توان از بررسی سخت‌گیرانه هدرهای Sec-Fetch-* استفاده کرد تا اطمینان حاصل شود که درخواست از منبع نامناسبی مثل بارگذاری تصویر، ناوبری صفحه یا فراخوانی cross-origin ارسال نشده است.",✓,✓,✓,, +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.5,تفکیک مبدا توسط مرورگر (Browser Origin Separation),V3.5.4,برنامه‌های مجزا باید روی نام‌های دامنه (hostname) متفاوت میزبانی شده‌اند تا از محدودیت‌های ارائه‌شده توسط (Same-Origin Policy) بهره‌مند شوند. این شامل کنترل تعامل اسناد یا اسکریپت‌های بارگذاری‌شده از یک مبدأ با منابع مبدأ دیگر و اعمال محدودیت بر اساس دامنه برای کوکی‌ها می‌شود.,,✓,✓,, +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.5,تفکیک مبدا توسط مرورگر (Browser Origin Separation),V3.5.5,برنامه باید پیام‌های دریافت‌شده از طریق رابط postMessage در صورتی که مبدأ پیام مورد اعتماد نباشد یا ساختار پیام نامعتبر باشد، نادیده گرفته می‌شوند.,,✓,✓,, +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.5,تفکیک مبدا توسط مرورگر (Browser Origin Separation),V3.5.6,هیچ‌کجای برنامه از قابلیت JSONP استفاده نشود تا از حملات Cross-Site Script Inclusion (XSSI) جلوگیری شود.,,,✓,, +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.5,تفکیک مبدا توسط مرورگر (Browser Origin Separation),V3.5.7,داده‌هایی که نیاز به احراز هویت دارند، در پاسخ‌های مربوط به منابع اسکریپتی(مانند فایل‌های (JavaScript نباید قرار بگیرند تا از حملات XSSI جلوگیری شود.,,,✓,, +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.5,تفکیک مبدا توسط مرورگر (Browser Origin Separation),V3.5.8,اطمینان حاصل کنید که منابع احراز هویت‌شده (مانند تصاویر، ویدیوها، اسکریپت‌ها و سایر اسناد) فقط در مواقعی که هدف آن است، قابل بارگذاری یا جاسازی توسط کاربر باشند. این کار را می‌توان با اعتبارسنجی دقیق هدرهای HTTP مانند Sec-Fetch-* انجام داد تا اطمینان حاصل شود که درخواست از یک منبع غیرمجاز ارسال نشده است، یا با تنظیم هدر Cross-Origin-Resource-Policy برای محدود کردن دسترسی مرورگر به محتوا.,,,✓,, +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.6,یکپارچگی منابع خارجی (External Resource Integrity),V3.6.1,منابع سمت کلاینت مانند کتابخانه‌های جاوااسکریپت، فایل‌های CSS، یا فونت‌های وب، تنها در صورتی به‌صورت خارجی (مثلاً از طریق شبکه تحویل محتوا - CDN) میزبانی شوند که آن منابع: استاتیک (تغییرناپذیر) باشند، نسخه‌گذاری‌شده (versioned) باشند و یکپارچگی آن‌ها با استفاده از Subresource Integrity (SRI) بررسی شود. اگر این موارد امکان‌پذیر نیست، باید برای هر منبع، یک تصمیم امنیتی مستند وجود داشته باشد که توجیه کند چرا این منبع به این شکل بارگذاری می‌شود.,,,✓,, +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.7,سایر ملاحظات امنیتی مرورگر (Other Browser Security Considerations),V3.7.1,برنامه صرفا باید از فناوری‌های سمت کلاینتی استفاده ‌کند که همچنان پشتیبانی می‌شوند و از نظر امنیتی قابل اعتماد هستند.مثال‌هایی از فناوری‌هایی که این الزام را برآورده نمی‌کنند عبارتند از NSAPI Plugins،Flash،Shockwave،ActiveX،Silverlight،NACL و Appletهای جاوا در سمت کلاینت,,✓,✓,, +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.7,سایر ملاحظات امنیتی مرورگر (Other Browser Security Considerations),V3.7.2,برنامه فقط زمانی کاربر را به دامنه‌ها یا hostnameهای دیگر (که تحت کنترل برنامه نیستند) به صورت خودکار هدایت می‌کند، که آن مقصد در یک فهرست مجاز (allowlist) قرار داشته باشد.,,✓,✓,, +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.7,سایر ملاحظات امنیتی مرورگر (Other Browser Security Considerations),V3.7.3,برنامه باید هنگام ریدایرکت کاربر به یک URL که خارج از کنترل برنامه است، یک پیام هشدار نشان می‌دهد و امکان لغو آن را به کاربر می‌دهد.,,,✓,, +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.7,سایر ملاحظات امنیتی مرورگر (Other Browser Security Considerations),V3.7.4,باید دامنه اصلی برنامه، مثلاً (site.tld) به فهرست preload عمومی HSTS اضافه شده باشد.,,,✓,, +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.7,سایر ملاحظات امنیتی مرورگر (Other Browser Security Considerations),V3.7.5,اگر مرورگر کاربر از ویژگی‌های امنیتی مورد انتظار برنامه پشتیبانی نمی‌کند، برنامه رفتار مناسبی داشته باشد، مثل هشدار دادن به کاربر یا مسدود کردن دسترسی.,,,✓,, +V4,API and Web Service,V4.1,Generic Web Service Security,V4.1.1,"اطمینان حاصل شود که در هر پاسخ HTTP که شامل Body می باشد، هدر Content-Type وجود داشته باشد که نوع آن، با محتوای پاسخ دریافتی از سرور مطابقت داشته باشد. این هدر باید شامل پارامتر charset نیز باشد تا رمزگذاری کاراکتر ایمن (مانند UTF-8 یا ISO-8859-1) را مشخص کند. این مقادیر باید مطابق با استاندارد IANA Media Types باشند؛ برای مثال، انواعی مانند ""text/، /+xml"" و ""/xml"" را در بر می‌گیرند.",✓,✓,✓,, +V4,API and Web Service,V4.1,Generic Web Service Security,V4.1.2,اطمینان حاصل شود که تنها نقاط پایانی که برای استفاده کاربر نهایی از طریق مرورگر طراحی شده‌اند (User-Facing Endpoints) به‌صورت خودکار از HTTP به HTTPS هدایت ‌شوند، سایر سرویس‌ها یا نقاط پایانی نباید (ریدایرکت شفاف، Transparent Redirect) داشته باشند. این اقدام برای جلوگیری از وضعیتی است که در آن یک کلاینت به اشتباه درخواست‌های رمزنگاری‌نشده (HTTP) ارسال می‌کند، اما چون این درخواست‌ها به‌طور خودکار به HTTPS ریدایرکت می‌شوند، نشت احتمالی داده‌های حساس پنهان خواهد ماند.,,✓,✓,, +V4,API and Web Service,V4.1,Generic Web Service Security,V4.1.3,اطمینان حاصل شود که هدرهای HTTP که در برنامه استفاده می شود و توسط یک لایه واسطه، مانند یکload balancer ، یک پروکسی وب یا یک سرویس backend-for-frontend تنظیم شده است نمی‌تواند توسط کاربر نهایی بازنویسی شود. هدرهای نمونه ممکن است شامل X-Real-IP، X-Forwarded-* یا X-User-ID باشند.,,✓,✓,, +V4,API and Web Service,V4.1,Generic Web Service Security,V4.1.4,اطمینان حاصل شود که فقط متدهای HTTP که صریحاً توسط برنامه یا API آن پشتیبانی می‌شوند (از جمله OPTIONS در درخواست‌های preflight) می‌توانند مورد استفاده قرار گیرند و متدهای استفاده نشده مسدود شوند.,,,✓,, +V4,API and Web Service,V4.1,Generic Web Service Security,V4.1.5,اطمینان حاصل شود که برای درخواست‌ها یا تراکنش‌هایی که بسیار حساس هستند یا از چندین سامانه عبور می‌کنند، از امضاهای دیجیتال در سطح پیام استفاده شود تا اطمینان امنیتی بیشتری علاوه بر محافظت‌های سطح انتقال (مانند TLS) فراهم گردد.,,,✓,, +V4,API and Web Service,V4.2,HTTP Message Structure Validation,V4.2.1,اطمینان حاصل شود که تمامی اجزای برنامه )از جمله لود بالانسرها، فایروال‌ها و سرورهای اپلیکیشن( مرزهای پیام‌های HTTP ورودی را با استفاده از مکانیزم مناسب نسخه های HTTP تعیین می‌کنند تا از حملات HTTP request smuggling جلوگیری شود. در HTTP/1.x اگر هدر Transfer-Encoding وجود داشته باشد، هدر Content-Length باید مطابق RFC 2616 نادیده گرفته شود. در مقابل، هنگام استفاده از HTTP/2 یا HTTP/3، اگر هدر Content-Length وجود داشته باشد، گیرنده باید اطمینان حاصل کند که این مقادیر با طول فریم‌های DATA سازگار می‌باشد.,,✓,✓,, +V4,API and Web Service,V4.2,HTTP Message Structure Validation,V4.2.2,اطمینان حاصل شود که هنگام تولید پیام‌های HTTP، هدر Content-Length با طول محتوایی که توسط چارچوب‌بندی پروتکل HTTP تعیین می‌شود، تداخل نداشته باشد تا از حملات request smuggling جلوگیری شود.,,,✓,, +V4,API and Web Service,V4.2,HTTP Message Structure Validation,V4.2.3,اطمینان حاصل شود برنامه، پیام‌های HTTP/2 یا HTTP/3 با هدرهای connection-specific مانند Transfer-Encoding را به منظور جلوگیری از حملات response splitting یا header injection ارسال یا قبول نمی کند.,,,✓,, +V4,API and Web Service,V4.2,HTTP Message Structure Validation,V4.2.4,"اطمینان حاصل شود برنامه تنها درخواست های HTTP/2 and HTTP/3 که هدرها و مقادیر آن شامل هیچ توالی CR (\r), LF (\n), CRLF (\r\n) نباشد را می پذیرد تا از حملات header injection جلوگیری کند.",,,✓,, +V4,API and Web Service,V4.2,HTTP Message Structure Validation,V4.2.5,اطمینان حاصل کنید که اگر برنامه (Frontend or Backend) اقدام به ساخت و ارسال درخواست‌های HTTP می کند از مکانیزم های validation ، sanitization یا سایر مکانیزم‌ها استفاده کند تا از ایجاد URIها (مانند فراخوانیAPI ) یا فیلدهای هدر درخواست HTTP (مانند Authorization یا( Cookie که بیش از حد مجاز، طولانی هستند، جلوگیری شود که منجر به عدم پذیرش درخواست توسط مولفه دریافت کننده(هر بخشی از زیرساخت یا سامانه که درخواست HTTP را دریافت و پردازش می‌کند) شود. عدم رعایت این موضوع می تواند باعث وقوع حمله Danial of Service شود، ارسال یک درخواست بیش از حد طولانی (مانند یک فیلد هدر کوکی طولانی) باعث می شود سرور همواره با وضعیت خطا پاسخ دهد.,,,✓,, +V4,API and Web Service,V4.3,GraphQL,V4.3.1,اطمینان حاصل شود یکی از مکانیزم ها برای جلوگیری از حملات انکار سرویس (DoS) درلایه GraphQL یا لایه داده استفاده شده است. این مکانیزم‌ها عبارتند از استفاده از فهرست مجاز کوئری‌ها ( Query Allowlist)، محدودسازی عمق کوئری‌ها (Depth Limiting)،محدودسازی تعداد یا حجم داده(Amount Limiting) و تحلیل هزینه کوئری (Query Cost Analysis). این اقدامات، به منظور مقابله با درخواست های پیچیده، تو در تو یا کوئری‌های پرهزینه که می توانند موجب مصرف بیش از حد منابع و اختلال در سرویس دهی شوند ضروری است.,,✓,✓,, +V4,API and Web Service,V4.3,GraphQL,V4.3.2,اطمینان حاصل شود که قابلیت Introspection در GraphQL در محیط تولید (Production) غیرفعال شده‌است، مگرAPI مبتنی بر GraphQL به‌صورت صریح برای استفاده توسط اشخاص یا سامانه های ثالث (Third Parties) طراحی شده باشد.,,✓,✓,, +V4,API and Web Service,V4.4,WebSocket,V4.4.1,اطمینان حاصل شود که تمامی ارتباطات WebSocket از طریق پروتکل TLS( WSS) برقرار می‌شوند.,✓,✓,✓,, +V4,API and Web Service,V4.4,WebSocket,V4.4.2,اطمینان حاصل شود که در هنگام Handshake اولیه‌ی HTTP برای WebSocket، مقدار هدر Origin بررسی ‌شود و در صورتی که با لیستی از مبداهای مجاز (allowed origins) برای برنامه مطابقت داشته باشد، اتصال پذیرفته می‌شود.,,✓,✓,, +V4,API and Web Service,V4.4,WebSocket,V4.4.3,اطمینان حاصل شود که در صورتی که امکان استفاده از مکانیزم استاندارد مدیریت نشست برنامه وجود نداشته باشد، از توکن‌های اختصاصی (Duplicated Tokens) برای این منظور استفاده شود که با الزامات امنیتی مدیریت نشست به طور کامل مطابقت داشته باشند.,,✓,✓,, +V4,API and Web Service,V4.4,WebSocket,V4.4.4,اطمینان حاصل شود که توکن‌های اختصاصی مدیریت نشست WebSocket در هنگام انتقال از یک نشست HTTPS موجود به کانالWebSocket، از طریق نشست HTTPS احراز هویت‌شده قبلی، دریافت یا اعتبارسنجی می‌شوند.,,✓,✓,, +V5,File Handling,V5.1,File Handling Documentation,V5.1.1,مستندات نوع فایل‌های مجاز، پسوندهای مورد انتظار، و حداکثر اندازه هر فایل (شامل اندازه پس از استخراج) را برای هر قابلیت بارگذاری مشخص کرده باشد. همچنین، مستندات توضیح می‌دهند چگونه فایل‌ها برای دانلود و پردازش توسط کاربران نهایی ایمن‌سازی می‌شوند؛ برای مثال، رفتار برنامه هنگام شناسایی یک فایل مخرب چگونه خواهد بود.,,✓,✓,, +V5,File Handling,V5.2,File Upload and Content,V5.2.1,برنامه تنها فایل‌هایی با حجم مشخص، که قادر به پردازش آن است را می‌پذیرد تا از کاهش عملکرد یا حملات انکار سرویس (DoS) جلوگیری شود.,✓,✓,✓,, +V5,File Handling,V5.2,File Upload and Content,V5.2.2,هنگام پذیرش فایل توسط برنامه، چه به صورت مستقیم و چه به صورت یک آرشیو مانند فایلzip پسوند فایل با پسوند مورد انتظار مطابقت داشته باشد و اعتبارسنجی محتوای فایل صورت گیرد تا تایید شود محتوای فایل با نوع تعریف‌شده توسط پسوند هم‌خوانی دارد. این فرآیند می تواند شامل موارد بررسی بایت‌های ابتدایی (magic bytes) فایل، انجام بازنویسی تصاویر برای حذف ساختارها و اطلاعات ناخواسته و استفاده از کتابخانه‌های تخصصی برای اعتبارسنجی کامل محتوای فایل باشد اما محدود به آنها نیست. در سطح L1، کافی است این بررسی‌ها فقط بر روی فایل‌هایی که در فرآیندهای تجاری یا امنیتی خاص استفاده می‌شوند متمرکز باشد. در سطح L2 و بالاتر، این فرآیند باید برای تمامی فایل‌های ورودی برنامه اجرا شود.,✓,✓,✓,, +V5,File Handling,V5.2,File Upload and Content,V5.2.3,برنامه باید پیش از استخراج محتوای فایل‌های فشرده (مانند zip، gz، docx، odt)، آن‌ها را از نظر حداکثر اندازه مجاز پس از استخراج و همچنین حداکثر تعداد فایل‌های درون آن بررسی می‌کند.,,✓,✓,, +V5,File Handling,V5.2,File Upload and Content,V5.2.4,برنامه فضای مشخصی برای اندازه فایل و تعداد فایل‌های مجاز برای هر کاربر اعمال می‌کند تا از این طریق، یک کاربر نتواند با بارگذاری تعداد زیادی فایل یا فایل‌های بیش از حد بزرگ، فضای ذخیره‌سازی را پر کند.,,,✓,, +V5,File Handling,V5.2,File Upload and Content,V5.2.5,برنامه اجازه بارگذاری فایل‌های فشرده‌ که حاوی لینک های نمادین (symlinks) هستند را نمی‌دهد، مگر اینکه این رفتار به طور مشخص مورد نیاز باشد. در چنین شرایطی باید یک فهرست مجاز (allowlist) از مسیرها یا فایل‌هایی که می تواند برای آنها لینک نمادین ایجاد شود، اعمال و اعتبارسنجی گردد.,,,✓,, +V5,File Handling,V5.2,File Upload and Content,V5.2.6,برنامه تصاویر بارگذاری‌شده با اندازه پیکسلی بزرگ‌تر از حد مجاز را رد کند تا از حملات pixel flood attacks جلوگیری شود.,,,✓,, +V5,File Handling,V5.3,File Storage,V5.3.1,فایل هایی که از ورودی های غیرمعتبر بارگذاری‌ یا تولید می شوند و در پوشه های عمومی قرار می گیرند، هنگام دسترسی مستقیم از طریق یک درخواست HTTP، به عنوان کداجرایی سمت سرور اجرا نشوند.,✓,✓,✓,, +V5,File Handling,V5.3,File Storage,V5.3.2,"هنگام ایجاد مسیرهای فایل برای عملیات مختلف، به جای استفاده از نام فایل‌های ارسال شده توسط کاربر، از داده‌های تولید شده داخلی یا منابع مورد اعتماد استفاده شود. و در صورتی که استفاده از نام فایل‌ها یا متادیتای ارسالی توسط کاربر ضروری باشد، می بایست validation و Sanitization اعمال شود. این کار برای جلوگیری از حملاتی مانند Path Traversal، Local or Remote File Inclusion(LFI, RFI) و Server-Side Request Forgery(SSRF) می‌باشد.",✓,✓,✓,, +V5,File Handling,V5.3,File Storage,V5.3.3,پردازش فایل‌های سمت سرور، مانند استخراج فایل‌های فشرده، اطلاعات مسیر ارائه شده توسط کاربر را نادیده می‌گیرد تا از آسیب‌پذیری‌هایی مانند zip slip جلوگیری شود.,,,✓,, +V5,File Handling,V5.4,File Download,V5.4.1,برنامه نام فایل ارسال‌شده توسط کاربر را چه در قالب JSON، JSONP یا پارامتر URL، اعتبارسنجی می‌کند یا نادیده می‌گیرد، و در پاسخ HTTP، نام فایل را به‌طور صریح در فیلد Content-Disposition هدر مشخص می‌نماید.,,✓,✓,, +V5,File Handling,V5.4,File Download,V5.4.2,نام‌های فایل‌های ارائه شده (مانند فیلدهای هدر پاسخ HTTP یا پیوست‌های ایمیل)، به‌درستی encoded یا sanitized شده‌اند (مطابق RFC 6266)، تا ساختار سند حفظ شده و از حملات تزریق جلوگیری شود.,,✓,✓,, +V5,File Handling,V5.4,File Download,V5.4.3,فایل‌های دریافت شده از منابع غیرقابل اعتماد توسط آنتی ویروس اسکن شود تا از ارائه محتوای مخرب شناخته‌شده جلوگیری شود.,,✓,✓,, +V6,Authentication,V6.1,Authentication Documentation,V6.1.1,مستندات برنامه، نحوه استفاده از کنترل هایی مانند محدودیت نرخ (Rate Limit)، مقابله با خودکارسازی (Anti-Automation) و پاسخ تطبیقی (Adaptive Response) را برای دفاع در برابر حملاتی مانند Credential Stuffing و حملات Password Brute Force به وضوح تعریف کرده باشد. مستندات باید به‌وضوح نحوه پیکربندی این کنترل‌ها را تشریح کرده و نشان دهند که چگونه از قفل شدن مخرب حساب‌های کاربری جلوگیری می‌شود.,✓,✓,✓,, +V6,Authentication,V6.1,Authentication Documentation,V6.1.2,یک لیست از کلمات خاص مرتبط با زمینه سازمانی‌ (Context-Specific) مستندسازی شود تا از بکارگیری آنها در رمزهای عبور جلوگیری شد. این فهرست می‌تواند شامل نام سازمان، نام محصول، شناسه سامانه، نام کد پروژه، نام دپارتمان یا نقش های سازمانی و موارد مشابه باشد.,,✓,✓,, +V6,Authentication,V6.1,Authentication Documentation,V6.1.3,در صورت وجود مسیرهای متعدد احراز هویت در برنامه کاربردی، تمامی این مسیرها به همراه کنترل‌های امنیتی و سطح قدرت احراز هویت مورد نیاز، مستندسازی شده‌اند. لازم است این کنترل‌ها به‌صورت یکسان و سازگار در تمامی مسیرهای احراز هویت اجرا شوند.,,✓,✓,, +V6,Authentication,V6.2,Password Security,V6.2.1,کلمات عبور تنظیم شده توسط کاربر حداقل ۸ کاراکتر طول داشته باشد. هرچند حداقل ۱۵ کاراکتر به شدت توصیه می‌شود.,✓,✓,✓,, +V6,Authentication,V6.2,Password Security,V6.2.2,کاربران قادر به تغییر گذرواژه خود باشند.,✓,✓,✓,, +V6,Authentication,V6.2,Password Security,V6.2.3,هنگام تغییر کلمه عبور، گذرواژه فعلی و گذرواژه جدید توسط کاربر تکمیل شود.,✓,✓,✓,, +V6,Authentication,V6.2,Password Security,V6.2.4,کلمات عبوری که در حین ثبت‌نام حساب کاربری یا تغییر کلمه عبور ارسال می شوند با یک فهرست در دسترس از حداقل ۳۰۰۰ کلمه عبور رایج که ( با سیاست‌های کلمه عبور برنامه (مانند حداقل طول) سازگاری دارند) بررسی شوند.,✓,✓,✓,, +V6,Authentication,V6.2,Password Security,V6.2.5,کلمات عبور با هر ترکیبی قابل استفاده باشند، بدون اینکه قوانینی برای محدودکردن نوع کاراکترهای مجاز وجود داشته باشد. نباید هیچ‌گونه الزامی برای تعداد حداقل کاراکترهای حروف بزرگ یا کوچک، اعداد یا کاراکترهای خاص وجود داشته باشد.,✓,✓,✓,, +V6,Authentication,V6.2,Password Security,V6.2.6,"فیلدهای ورودی کلمه عبور از نوع ""type=password"" استفاده می‌کنند تا ورودی‌ها پنهان شوند. برنامه‌ها می‌توانند به کاربر این امکان را بدهند که موقتاً کلمه عبور کامل یا آخرین کاراکتر تایپ شده را مشاهده کند.",✓,✓,✓,, +V6,Authentication,V6.2,Password Security,V6.2.7,"عملکرد ""چسباندن"" (paste)، ابزارهای کمکی گذرواژه مرورگر و مدیریت‌کننده‌های گذرواژه خارجی مجاز باشند.",✓,✓,✓,, +V6,Authentication,V6.2,Password Security,V6.2.8,برنامه کلمه عبور کاربر را دقیقاً همانطور که از کاربر دریافت شده است، بدون هیچ گونه تغییراتی مانند کوتاه‌سازی(truncation) یا تبدیل حروف بزرگ و کوچک (case transformation)، بررسی کند.,✓,✓,✓,, +V6,Authentication,V6.2,Password Security,V6.2.9,استفاده از گذرواژه‌هایی با حداقل طول ۶۴ کاراکتر مجاز باشد.,,✓,✓,, +V6,Authentication,V6.2,Password Security,V6.2.10,کلمه عبور کاربر تا زمانی که مشخص شود که به خطر افتاده است یا کاربر آن را تغییر دهد، معتبر باقی بماند. برنامه نباید الزام به تغییر دوره‌ای گذرواژه‌ها را داشته باشد.,,✓,✓,, +V6,Authentication,V6.2,Password Security,V6.2.11,فهرست مستند شده ای از کلمات خاص مرتبط با زمینه‌ سازمانی برای جلوگیری از ایجاد کلمات عبور آسان قابل حدس، مورد استفاده قرار گیرد.,,✓,✓,, +V6,Authentication,V6.2,Password Security,V6.2.12,کلمات عبور وارد شده در حین ثبت‌نام حساب کاربری یا تغییر کلمه عبور با مجموعه‌ای از کلمات عبور افشا شده بررسی ‌شوند.,,✓,✓,, +V6,Authentication,V6.3,General Authentication Security,V6.3.1,کنترل‌های لازم برای جلوگیری از حملاتی مانند Credential Stuffing و password brute force طبق مستندات امنیتی برنامه پیاده‌سازی شوند.,✓,✓,✓,, +V6,Authentication,V6.3,General Authentication Security,V6.3.2,"حساب‌های کاربری پیش‌فرض (مانند ""admin""، ""root"" یا ""sa"") در برنامه وجود نداشته باشند یا غیرفعال شده باشند.",✓,✓,✓,, +V6,Authentication,V6.3,General Authentication Security,V6.3.3,برای دسترسی به برنامه، از یک مکانیزم احراز هویت چندعاملی (MFA) یا ترکیبی از مکانیزم‌های احراز هویت تک‌عاملی استفاده شود. برای سطح L3، حداقل یکی از عوامل احراز هویت باید مبتنی بر سخت‌افزار باشد در برابر حملات فیشینگ، مقاومت در برابر نفوذ و جعل هویت را فراهم کند، در حالی که با اقدام آگاهانه کاربر (مانند فشردن دکمه روی کلید سخت‌افزاری FIDO یا تلفن همراه) قصد کاربر برای احراز هویت را نیز تأیید نماید. هرگونه تسهیل یا تعدیل در این الزام، مستلزم ارائه دلایل مستند و مجموعه‌ای جامع از کنترل‌های جبرانی است.,,✓,✓,, +V6,Authentication,V6.3,General Authentication Security,V6.3.4,تأیید کنید که در صورت وجود مسیرهای متعدد احراز هویت در برنامه، هیچ مسیر احراز هویتِ مستندسازی‌نشده‌ای وجود نداشته باشد و کنترل‌های امنیتی و سطح قدرت احراز هویت در تمامی مسیرها به‌صورت یکسان و سازگار اعمال شوند.,,✓,✓,, +V6,Authentication,V6.3,General Authentication Security,V6.3.5,کاربران از تلاش‌های مشکوک برای احراز هویت (موفق یا ناموفق) مطلع ‌شوند. این اطلاع‌رسانی می‌تواند شامل تلاش برای احراز هویت از موقعیت مکانی یا کلاینت غیرمعمول، احراز هویت ناقص (تنها موفقیت یکی از عوامل)، تلاش برای احراز هویت پس از یک دوره طولانی عدم فعالیت، یا احراز هویت موفق پس از چندین تلاش ناموفق باشد.,,,✓,, +V6,Authentication,V6.3,General Authentication Security,V6.3.6,ایمیل به‌عنوان مکانیزم احراز هویت، چه به‌صورت تک‌عاملی و چه به‌عنوان یکی از عوامل احراز هویت چندعاملی، استفاده نمی‌شود.,,,✓,, +V6,Authentication,V6.3,General Authentication Security,V6.3.7,کاربران پس از به‌روزرسانی اطلاعات احراز هویت خود، مانند بازنشانی گذرواژه یا تغییر نام کاربری یا آدرس ایمیل، مطلع شوند.,,,✓,, +V6,Authentication,V6.3,General Authentication Security,V6.3.8,با توجه به پیام‌های خطا، کدهای پاسخ HTTP یا تفاوت در زمان پاسخ‌دهی، نتوان کاربران معتبر را از طریق تلاش‌های ناموفق احراز هویت شناسایی کرد. همچنین، عملکردهای ثبت‌نام و بازیابی گذرواژه نیز باید از این نوع افشای اطلاعات محافظت شده باشند.,,,✓,, +V6,Authentication,V6.4,Authentication Factor Lifecycle and Recovery,V6.4.1,کلمه عبور اولیه یا کدهای فعال‌سازی تولید شده توسط سیستم، به‌صورت تصادفی و ایمن تولید ‌شوند، با سیاست فعلی رمز عبور مطابقت دارند، و پس از مدت زمان کوتاهی یا پس از اولین استفاده منقضی می‌شوند. این رمزهای اولیه نباید به عنوان رمز عبور بلندمدت مورد استفاده قرار گیرند.,✓,✓,✓,, +V6,Authentication,V6.4,Authentication Factor Lifecycle and Recovery,V6.4.2,"راهنمای کلمه عبور یا احراز هویت مبتنی بر دانش (که به عنوان ""سؤالات امنیتی"" شناخته می‌شوند) در سیستم وجود ندارد.",✓,✓,✓,, +V6,Authentication,V6.4,Authentication Factor Lifecycle and Recovery,V6.4.3,فرآیند امنی برای بازنشانی کلمه عبور فراموش‌شده پیاده‌سازی شده است که هیچ‌یک از مکانیزم‌های احراز هویت چندعاملی فعال را دور نزند.,,✓,✓,, +V6,Authentication,V6.4,Authentication Factor Lifecycle and Recovery,V6.4.4,در صورت از دست رفتن یکی از عوامل احراز هویت چندعاملی، فرآیند اثبات هویت با همان سطحی که در زمان ثبت‌نام انجام شده است، اجرا شود.,,✓,✓,, +V6,Authentication,V6.4,Authentication Factor Lifecycle and Recovery,V6.4.5,دستورالعمل‌های تمدید مکانیزم‌های احراز هویت دارای تاریخ انقضا برای کاربران به موقع ارسال می‌شود تا پیش از انقضای مکانیزم فعلی فرصت کافی برای تمدید وجود داشته باشد، و در صورت لزوم، یادآورهای خودکار نیز تنظیم و ارسال شده باشند.,,,✓,, +V6,Authentication,V6.4,Authentication Factor Lifecycle and Recovery,V6.4.6,کاربران ادمین می‌توانند فرآیند بازنشانی کلمه عبور را برای کاربران عادی آغاز کنند، اما اجازه تغییر مستقیم یا انتخاب رمز عبور برای کاربر را ندارند. این کنترل برای جلوگیری از دسترسی ادمین به رمز عبور کاربران طراحی شده است.,,,✓,, +V6,Authentication,V6.5,General Multi-factor authentication requirements,V6.5.1,Lookup Secrets درخواست‌ها یا کدهای احراز هویت خارج از باند (Out-of-Band) و رمزهای یکبار مصرف مبتنی بر زمان (TOTP) تنها یک‌بار قابل استفاده باشند و پس از استفاده موفق، مجدداً قابل استفاده نباشند.,,✓,✓,, +V6,Authentication,V6.5,General Multi-factor authentication requirements,V6.5.2,در صورت ذخیره‌سازی Lookup Secrets در سمت Backend برنامه، اگر مقدار آنتروپی کمتر از ۱۱۲ بیت باشند (معادل ۱۹ کاراکتر تصادفی الفبایی-عددی یا ۳۴ رقم تصادفی)، باید با یک الگوریتم تایید شده برای ذخیره رمز عبور و با استفاده از یک Salt تصادفی ۳۲ بیتی هش شوند. در صورتی که آنتروپی کد ۱۱۲ بیت یا بیشتر باشد، می‌توان از یک تابع هش استاندارد برای ذخیره سازی استفاده کرد.,,✓,✓,, +V6,Authentication,V6.5,General Multi-factor authentication requirements,V6.5.3,Lookup Secrets کدهای احراز هویت خارج از باند (out of band) و تولید رمزهای یکبار مصرف مبتنی بر زمان(TOTP) همگی با استفاده از یک تولیدکننده عدد شبه تصادفی ‌رمزنگاری‌شده (CSPRNG) تولید شده باشند تا از تولید مقادیر قابل پیش‌بینی جلوگیری شود.,,✓,✓,, +V6,Authentication,V6.5,General Multi-factor authentication requirements,V6.5.4,Lookup Secrets و کدهای احراز هویت خارج از باند (out of band) حداقل دارای ۲۰ بیت آنتروپی باشند (معمولاً ۴ کاراکتر تصادفی الفبایی-عددی یا ۶ رقم تصادفی برای رسیدن به این میزان آنتروپی کافی است).,,✓,✓,, +V6,Authentication,V6.5,General Multi-factor authentication requirements,V6.5.5,درخواست‌ها، کدها یا توکن‌های احراز هویت خارج از باند (Out-of-Band) و همچنین رمزهای عبور یک‌بار مصرف مبتنی بر زمان (TOTP) دارای طول عمر مشخص باشند. حداکثر طول عمر برای درخواست‌های خارج از باند باید ۱۰ دقیقه و برای TOTP حداکثر ۳۰ ثانیه باشد.,,✓,✓,, +V6,Authentication,V6.5,General Multi-factor authentication requirements,V6.5.6,امکان لغو (Revoke) هر عامل احراز هویت، از جمله دستگاه‌های فیزیکی، در صورت سرقت یا مفقود شدن وجود داشته باشد.,,,✓,, +V6,Authentication,V6.5,General Multi-factor authentication requirements,V6.5.7,مکانیزم‌های احراز هویت بیومتریک فقط به‌عنوان عامل دوم و در کنار یکی از عوامل «چیزی که در اختیار دارید» یا «چیزی که کاربر می داند» مورد استفاده قرار می‌گیرند.,,,✓,, +V6,Authentication,V6.5,General Multi-factor authentication requirements,V6.5.8,اعتبارسنجی رمزهای یک‌بار مصرف مبتنی بر زمان (TOTP) بر اساس منبع زمانی از یک سرویس قابل اعتماد انجام می‌شود و نه بر اساس زمان ارائه‌شده توسط کلاینت یا منابع غیرقابل اعتماد.,,,✓,, +V6,Authentication,V6.6,Out-of-Band authentication mechanisms,V6.6.1,مکانیزم‌های احراز هویت مبتنی بر شبکه تلفن عمومی (PSTN) برای ارسال رمزهای یک‌بار مصرف (OTP) از طریق تماس تلفنی یا پیامک تنها در صورتی که شماره تلفن قبلا اعتبارسنجی شده باشد، یا روش‌های جایگزین قوی‌تر (رمزهای عبور یکبار مصرف مبتنی بر زمان) در دسترس باشند ارائه می‌شوند و سرویس‌دهنده باید کاربران را از ریسک‌های امنیتی این روش‌ها مطلع سازد. برای اپلیکیشن‌های سطح L3، استفاده از تماس تلفنی و پیامک به‌عنوان گزینه، مجاز نیست.,,✓,✓,, +V6,Authentication,V6.6,Out-of-Band authentication mechanisms,V6.6.2,درخواست‌ها، کدها یا توکن‌های احراز هویت خارج از باند (Out-of-Band) به درخواست احراز هویت اصلی که برای آن تولید شده‌اند متصل باشند و قابل استفاده برای درخواست‌های قبلی یا بعدی نباشند.,,✓,✓,, +V6,Authentication,V6.6,Out-of-Band authentication mechanisms,V6.6.3,مکانیزم‌های احراز هویت خارج از باند (Out-of-Band) مبتنی بر کد، در برابر حملات brute force از طریق اعمال کنترل محدودیت نرخ (Rate Limiting) محافظت شوند. همچنین، استفاده از کدی با حداقل ۶۴ بیت آنتروپی (Entropy)مدنظر قرار گیرد.,,✓,✓,, +V6,Authentication,V6.6,Out-of-Band authentication mechanisms,V6.6.4,در صورت استفاده از Push Notifications جهت احراز هویت چند عاملی، محدودیت نرخ (Rate Limiting) به منظور جلوگیری از حملات Push Bombing اعمال شده باشد. استفاده از تطبیق عدد Matching) Number) نیز می‌تواند به کاهش این ریسک کمک کند.,,,✓,, +V6,Authentication,V6.7,Cryptographic authentication mechanism,V6.7.1,گواهینامه‌های مورد استفاده برای تأیید ادعاهای احراز هویت رمزنگاری‌شده به گونه‌ای ذخیره شوند که از تغییر یا دستکاری آن‌ها محافظت شود.,,,✓,, +V6,Authentication,V6.7,Cryptographic authentication mechanism,V6.7.2,مقدار چالش (Challenge Nonce) حداقل ۶۴ بیت طول داشته باشد و از نظر آماری یکتا باشد یا حداقل در طول عمر دستگاه رمزنگاری منحصر به فرد باقی بماند.,,,✓,, +V6,Authentication,V6.8,Authentication with an Identity Provider,V6.8.1,اگر برنامه از چند ارائه‌دهنده هویت (IdP) پشتیبانی می‌کند، امکان جعل هویت کاربر از طریق یک ارائه‌دهنده هویت دیگر وجود نداشته باشد (برای مثال، با استفاده از شناسه کاربری یکسان). مکانیسم استاندارد برای جلوگیری از این تهدید، این است که برنامه، کاربران را با استفاده از ترکیب شناسه IdP (به‌عنوان فضای نام یا (namespace و شناسه کاربر در آن، IdP ثبت و شناسایی کند.,,✓,✓,, +V6,Authentication,V6.8,Authentication with an Identity Provider,V6.8.2,وجود و یکپارچگی امضاهای دیجیتال بر روی تصدیق‌های (تقاضاها یا ادعاهای) احراز هویت برای مثال بر روی (توکن‌های JWT یا SAML assertions) همواره اعتبارسنجی می‌شود و هرگونه تصدیقی که فاقد امضا یا دارای امضای نامعتبر باشد، رد می‌گردد.,,✓,✓,, +V6,Authentication,V6.8,Authentication with an Identity Provider,V6.8.3,(تقاضاها یا ادعاهای) تصدیق‌های SAML به‌صورت منحصربه‌فرد پردازش شده و تنها یک‌بار در بازه‌ی اعتبار خود استفاده می‌شوند تا از حملات بازپخش (Replay Attacks) جلوگیری گردد.,,✓,✓,, +V6,Authentication,V6.8,Authentication with an Identity Provider,V6.8.4,اگر برنامه‌ای از یک ارائه‌دهنده هویت (IdP) جداگانه استفاده می‌کند و انتظار قدرت، روش‌ها یا تازگی احراز هویت خاصی را برای عملکردهای خاص دارد، برنامه این موضوع را با استفاده از اطلاعات برگردانده شده توسط IdP تأیید می‌کند. به عنوان مثال، اگر از OIDC استفاده شود، این کار می‌تواند با اعتبارسنجی ادعاهای (Claims) موجود در توکن شناسایی (ID Token) مانند «amr»، «acr» و «auth_time» (در صورت وجود) انجام شود. اگر ارائه‌دهنده هویت این اطلاعات را ارائه نکند، برنامه باید یک روش جایگزین مستندسازی‌شده داشته باشد که فرض می‌کند حداقل سطح احراز هویت استفاده شده است (مثلاً احراز هویت تک‌عاملی با نام کاربری و گذرواژه).,,✓,✓,, +V7,Session Management,V7.1,Session Management Documentation,V7.1.1,بازه عدم فعالیت نشست کاربر و بیشینه طول عمر نشست قبل از احراز هویت مجدد، در ترکیب با سایر کنترل‌ها مستند و متناسب سازی شود. مستند سازی انجام شده باید شامل توجیه برای هر انحراف(نقض) از الزامات احراز هویت مجدد NIST SP 800-63B باشد.,,✓,✓,, +V7,Session Management,V7.1,Session Management Documentation,V7.1.2,در مستند باید تعداد نشست همزمان مجاز برای یک کاربر و همچنین رفتار و اعمال مناسب برای زمانی که این تعداد به حداکثر رسید مشخص شود.,,✓,✓,, +V7,Session Management,V7.1,Session Management Documentation,V7.1.3,تمام سیستم‌هایی که نشست‌های کاربر را به عنوان بخشی از یک اکوسیستم مدیریت هویت فدرال(مانند سیستم‌های (SSO ایجاد و مدیریت می‌کنند، باید در کنار سایر کنترل‌های مربوط به طول عمر نشست‌ها، خاتمه آن‌ها و هرگونه شرایط دیگری که نیاز به احراز هویت مجدد دارد، مستند شوند.,,✓,✓,, +V7,Session Management,V7.2,Fundamental Session Management Security,V7.2.1,برنامه کاربردی باید تمام بررسی‌های توکن نشست‌ را با استفاده از یک سرویس backend مطمئن انجام دهد.,✓,✓,✓,, +V7,Session Management,V7.2,Fundamental Session Management Security,V7.2.2,برنامه کاربردی که از هر یک از توکن‌های Self-Contained یا reference که به صورت پویا برای مدیریت نشست تولید شده‌اند استفاده کند اما از از کلیدهای API ثابت و کلید‌ها استفاده نکند.,✓,✓,✓,, +V7,Session Management,V7.2,Fundamental Session Management Security,V7.2.3,در صورتی که برای نمایش نشست کاربر از توکن‌های reference استفاده می شود، این توکن‌ها منحصر به فرد بوده و با استفاده از یک تولید کننده عدد شبه تصادفی امن رمزنگاری(CSPRNG) که دارای انتروپی حداقل128 بیتی است تولید شوند.,✓,✓,✓,, +V7,Session Management,V7.2,Fundamental Session Management Security,V7.2.4,برنامه کاربردی در هنگام احراز هویت کاربر یک توکن نشست جدید تولید نماید که شامل احراز هویت مجدد و ابطال توکن نشست کنونی است.,✓,✓,✓,, +V7,Session Management,V7.3,Session Timeout,V7.3.1,بر اساس تحلیل ریسک و تصمیمات امنیتی مستند شده، پس از گذشت مهلت زمانی عدم فعالیت، کاربر مجبور به احراز هویت مجدد گردد.,,✓,✓,, +V7,Session Management,V7.3,Session Timeout,V7.3.2,بر اساس تحلیل ریسک و تصمیمات امنیتی مستند شده، پس از گذشت بیشینه زمان مطلق طول عمر، کاربر مجبور به احراز هویت مجدد گردد.,,✓,✓,, +V7,Session Management,V7.4,Session Termination,V7.4.1,در مواقعی که فرآیند خاتمه نشست کاربر فعال می‌شود (مانند خروج کاربر یا انقضای نشست)، برنامه اجازه هیچ فعالیتی را به آن نشست نمی‌دهد. برای Reference tokens یا stateful session، این به معنی نامعتبرسازی اطلاعات نشست در برنامه Backend می‌باشد. برنامه‌هایی که از توکن‌های Self-contained استفاده می‌کنند نیاز به راه حل‌هایی نظیر نگهداری فهرستی از توکن‌های خاتمه‌یافته، عدم پذیرش توکن‌هایی که پیش از یک تاریخ و زمان مشخص برای هر کاربر تولید شده‌اند، یا چرخش کلید امضای مخصوص هر کاربر دارند.,✓,✓,✓,, +V7,Session Management,V7.4,Session Termination,V7.4.2,برنامه کاربردی تمامی نشست‌های فعال را در زمانی که حساب کاربری غیرفعال یا حذف می‌شود را ابطال نماید. (مانند کارمندی که شرکت را ترک می‌کند),✓,✓,✓,, +V7,Session Management,V7.4,Session Termination,V7.4.3,برنامه کاربردی قابلیت ارائه گزینه ابطال تمامی نشست های فعال دیگر را پس از یک تغییر موفقیت آمیز یا حذف هریک از عوامل احراز هویت (نظیر تغییر پسورد از طریق ریست یا بازنشانی و در صورت وجود به روزرسانی تنظیمات MFA ) را داشته باشد.,,✓,✓,, +V7,Session Management,V7.4,Session Termination,V7.4.4,تمامی صفحاتی که نیازمند احراز هویت هستند دارای دسترسی آسان و مشخص به فرآیند خروج باشند.,,✓,✓,, +V7,Session Management,V7.4,Session Termination,V7.4.5,مدیران برنامه کاربردی قادر به ابطال نشست‌های فعال برای یک شخص یا تمامی کاربران باشند.,,✓,✓,, +V7,Session Management,V7.5,Defenses Against Session Abuse,V7.5.1,برنامه کاربردی قبل از اعطای مجوز تغییر ویژگی‌های حساس حساب کاربری که بر روی احراز هویت تاثیر دارد نظیر آدرس ایمیل، شماره تلفن، تنظیمات MFA یا اطلاعات دیگر که در بازگردانی حساب کاربری مورد استفاده قرار می‌گیرند، به احراز هویت مجدد کامل نیاز دارد.,,✓,✓,, +V7,Session Management,V7.5,Defenses Against Session Abuse,V7.5.2,حساب‌های کاربری قادر به دیدن(پس از احراز هویت مجدد با حداقل یک عامل) و ابطال یک یا همه نشست‌های فعال باشد.,,✓,✓,, +V7,Session Management,V7.5,Defenses Against Session Abuse,V7.5.3,برنامه کاربردی قبل از اجرای تراکنش‌ها یا عملیات‌های حساس نیازمند احراز هویت مجدد با حداقل یک عامل یا صحت سنجی ثانویه باشد.,,,✓,, +V7,Session Management,V7.6,Federated Re-authentication,V7.6.1,طول عمر و ابطال نشست بین RP و idp طبق سند- که نیازمند احرازهویت مجدد در زمان مورد نیاز مانند وقتی که بیشینه زمان بین رخداد احراز هویت idp رسیده باشد- انجام شود.,,✓,✓,, +V7,Session Management,V7.6,Federated Re-authentication,V7.6.2,ساخت نشست‌ها نیاز به رضایت کاربر یا یک اقدام صریح دارد که بدین صورت از ایجاد نشست‌های جدید برنامه بدون تعامل کاربر جلوگیری می‌شود.,,✓,✓,, +V8,Authorization,V8.1,Authorization Documentation,V8.1.1,مستند اعطای مجوز باید شامل قوانینی به منظور محدودسازی دسترسی در سطح عملکرد و دسترسی مبتنی بر داده بر اساس مجوزهای کاربران و ویژگی‌های منابع باشد.,✓,✓,✓,, +V8,Authorization,V8.1,Authorization Documentation,V8.1.2,مستند اعطای مجوز باید قوانینی را برای محدودیت‌های دسترسی در سطح Field بر اساس مجوزهای کاربران و ویژگی‌های منابع تعریف نماید(هر دو دسترسی خواندن و نوشتن). توجه داشته باشید که این قوانین ممکن است به مقادیر دیگر ویژگی‌های شیء داده ی مربوطه (Relevant Data Object) بستگی داشته باشند، مانند حالت (state) یا وضعیت (status).,,✓,✓,, +V8,Authorization,V8.1,Authorization Documentation,V8.1.3,مستند برنامه کاربردی باید ویژگی‌های محیطی و زمینه‌ای (شامل و نه محدود به زمان روز، مکان، آدرس IP یا دستگاه) که در برنامه کاربردی به منظور اتخاذ تصمیمات امنیتی (نظیر آن دسته از تصمیماتی که مربوط به احراز هویت و اعطای مجوز می باشد) را مشخص کند.,,,✓,, +V8,Authorization,V8.1,Authorization Documentation,V8.1.4,مستندات احراز هویت و اعطای مجوز، علاوه بر اعطای مجوز در سطح Field، سطح عملکرد و داده‌های خاص، چگونگی استفاده از عوامل محیطی و زمینه‌ای در اتخاذ تصمیمات را مشخص نماید.,,,✓,, +V8,Authorization,V8.2,General Authorization Design,V8.2.1,برنامه کاربردی باید از محدود بودن دسترسی‌‌های در سطح عملکرد به مشتریانی که دارای دسترسی صریح هستند اطمینان حاصل نماید.,✓,✓,✓,, +V8,Authorization,V8.2,General Authorization Design,V8.2.2,برنامه کاربردی باید از محدود بودن دسترسی‌‌های در سطح داده به مشتریانی که دارای دسترسی صریح به اقلام داده‌ای خاص هستند اطمینان حاصل نماید تا از این طریق خطر آسیب پذیری IDOR و broken object level authorization را کاهش دهد .,✓,✓,✓,, +V8,Authorization,V8.2,General Authorization Design,V8.2.3,برنامه کاربردی دسترسی در سطح Field را با مجوزهای صریح به Field ها برای مصرف کنندگان جهت کاهش خطر broken object property level authorization (BOPLA) محدود کرده باشد.,,✓,✓,, +V8,Authorization,V8.2,General Authorization Design,V8.2.4,کنترل‌های امنیتی تطبیقی که بر اساس ویژگی‌های محیطی و زمینه‌ای کاربر (مانند زمان روز، مکان، آدرس IP یا دستگاه) هستند، برای تصمیم‌گیری‌های احراز هویت (Authentication) و مجوزدهی (Authorization) طبق مستندات برنامه پیاده‌سازی شده‌اند. این کنترل‌ها باید هم در زمان تلاش کاربر برای شروع یک نشست (Session) جدید و هم در طول یک نشست فعال، اعمال شوند.,,,✓,, +V8,Authorization,V8.3,Operation Level Authorization,V8.3.1,برنامه کاربردی قوانین مجوزدهی را در یک لایه سرویس معتبر اعمال نموده و بر آن دسته از کنترل‌هایی که مصرف کنندگان نامعتبر قادر به دستکاری آن‌ها هستند متکی نباشد. (نظیر جاوا اسکریپت سمت کاربر),✓,✓,✓,, +V8,Authorization,V8.3,Operation Level Authorization,V8.3.2,در مواقعی که امکان اعمال فوری تغییرات وجود ندارد (مثلاً وقتی که سیستم برای تصمیم‌گیری در مجوزدهی از توکن‌های Self-Contained مثل JWT استفاده می‌کند که اطلاعات را داخل خود ذخیره کرده و تا زمان انقضا تغییر نمی‌کنند)، باید کنترل‌های جبرانی وجود داشته باشد. این کنترل‌ها باید بتوانند زمانی که کاربر عملی را انجام می‌دهد که دیگر مجاز به آن نیست، هشدار بدهند و تغییر را برگردانند. با این حال، توجه کنید که این راهکار جایگزین نمی‌تواند جلوی نشت اطلاعات را بگیرد.,,,✓,, +V8,Authorization,V8.3,Operation Level Authorization,V8.3.3,دسترسی به یک object بر اساس مجوزهای کاربری شخص درخواست کننده(مثال: مصرف کننده) باشد نه بر اساس مجوز‌های یک واسطه یا سرویسی که به نمایندگی از او عمل می‌کند. بطور مثال، در صورتی که یک مصرف کننده یک وب سرویس را با استفاده از یک توکن self-contained برای احراز هویت فراخوانی می‌کند و سپس آن سرویس اطلاعات را از یک سرویس دیگر درخواست می‌کند، سرویس دوم باید همان توکن مصرف کننده را استفاده کند، نه یک توکن سرویس-به-سرویس (Machine-to-Machine token) که متعلق به سرویس اول است، تا تصمیمات مجوزدهی دقیقاً بر اساس مجوزهای کاربر گرفته شوند.,,,✓,, +V8,Authorization,V8.4,Other Authorization Considerations,V8.4.1,برنامه های کاربردی چند کاربره(multi tenants) از کنترل های cross-tenant به منظور تضمین این امر که عملیات‌های مصرف کنندگان هرگز کاربرانی (tenants) را که مجوز تعامل با آنها را ندارند را تحت تأثیر قرار نمی‌دهد.,,✓,✓,, +V8,Authorization,V8.4,Other Authorization Considerations,V8.4.2,دسترسی به درگاه‌های پیکربندی شامل چندین لایه امنیتی از قبیل تأیید مداوم هویت مصرف‌کننده، ارزیابی وضعیت امنیتی دستگاه و تحلیل ریسک زمینه‌ای باشد تا از این طریق اطمینان حاصل شود که موقعیت شبکه‌ای یا نقاط پایانی معتبر تنها عوامل برای مجوزدهی نیستند اگر چه که این عوامل احتمال دسترسی غیرمجاز را کاهش می‌دهند.,,,✓,, +V9,Self-contained Tokens,V9.1,Token source and integrity,V9.1.1,قبل از پذیرش محتوای توکن‌ها، آن‌ها را با استفاده از امضای دیجیتال یا MAC به منظور حفاظت در مقابل دستکاری‌ها مورد اعتبارسنجی قرار داده شود.,✓,✓,✓,, +V9,Self-contained Tokens,V9.1,Token source and integrity,V9.1.2,فقط الگوریتم‌های موجود در لیست مجاز قادر به استفاده در ساخت و صحت سنجی توکن‌های self-contained در یک زمینه مشخص باشند. این لیست مجاز باید در حالت ایده آل شامل هم الگوریتم‌های متقارن و هم نامتقارن‌ها باشد و نباید شامل الگوریتم‌های NONE باشد. در صورتی که هر دو الگوریتم‌های متقارن و نانتقارن مورد نیاز باشند کنترل‌های بیشتری باید به منظور جلوگیری از سردرگمی کلید‌ها(key Confusion) بکار گرفته شود.,✓,✓,✓,, +V9,Self-contained Tokens,V9.1,Token source and integrity,V9.1.3,"به منظور جلوگیری از مشخص نمودن منابع غیر مطمئن و کلید‌ها توسط مهاجمین، موارد کلیدی که در اعتبارسنجی توکن‌های self-contained مورد استفاده قرار می‌گیرند، از منابع از پیش پیکربندی شده مطمئنی که برای صادر کننده توکن است تعیین شود. برای JWTs و سایر ساختارهای JWS ، هدرهایی نظیر ‘jku’, ‘x5u’ و ‘jwk’ باید با یک لیست مجاز از منابع مطمئن مورد اعتبارسنجی قرار گیرند.",✓,✓,✓,, +V9,Self-contained Tokens,V9.2,Token content,V9.2.1,اگر یک بازه زمانی معتبر در داده‌های توکن وجود داشته باشد، توکن و محتوای آن تنها در صورتی پذیرفته می‌شوند که زمان بررسی در این بازه زمانی معتبر باشد. به عنوان مثال، برای JWTها، ادعاهای 'nbf' و 'exp' باید تایید شوند.,✓,✓,✓,, +V9,Self-contained Tokens,V9.2,Token content,V9.2.2,سرویسی که یک توکن دریافت می‌کند قبل از پذیرش محتوای آن، از لحاظ درستی نوع بررسی نموده و برای هدف مشخص شده در نظر گیرد. بطور مثال، فقط توکن‌های access می‌توانند به منظور تصمیمات مجوزی و فقط توکن های ID می‌توانند به منظور اثبات هویت کاربر مورد پذیرش قرار گیرند.,,✓,✓,, +V9,Self-contained Tokens,V9.2,Token content,V9.2.3,یک سرویس فقط توکن‌هایی را بپذیرد که به منظور استفاده توسط آن سرویس هستند(audience).برای JWT ها،این امر می‌تواند از طریق اعتبارسنجی ادعای 'aud' با یک لیست مجاز تعریف شده در سرویس صورت پذیرد.,,✓,✓,, +V9,Self-contained Tokens,V9.2,Token content,V9.2.4,اگر صادر کننده توکن از کلید خصوصی مشابهی برای audienceهای متفاوت استفاده می‌کند، توکن‌های تولید شده دارای محدودیت مخاطبی باشند که بطور منحصر به فردی مخاطبین مورد نظر را مشخص می‌کند. این امر از استفاده مجدد توکن توسط مخاطب ناخواسته جلوگیری می‌کند. در صورتی که شناسه مخاطب به صورت پویا مشخص شده باشد، صادرکننده توکن باید این مخاطبین را به منظور اطمینان از عدم جعل هویت مخاطب مورد اعتبارسنجی قرار دهد.,,✓,✓,, +V10,OAuth and OIDC,V10.1,Generic OAuth and OIDC Security,V10.1.1,توکن‌ها باید فقط به مؤلفه‌هایی ارسال شوند که به‌طور دقیق به آن‌ها نیاز دارند. برای مثال، هنگام استفاده از الگوی Backend-for-Frontend برای برنامه‌های JavaScript مبتنی بر مرورگر، Access Tokens و Refresh Tokens باید فقط برای Backend قابل دسترس باشند.,,✓,✓,, +V10,OAuth and OIDC,V10.1,Generic OAuth and OIDC Security,V10.1.2,Client باید فقط مقادیری را از Authorization Server بپذیرد (مانند Authorization Code یاID Token ) که این مقادیر حاصل از یک Authorization Flow باشند که توسط همان نشست (Session) و تراکنش User Agent آغاز شده است. این موضوع مستلزم آن است که Secretهای تولیدشده توسط کلاینت مانند code_verifier در PKCE، یا مقادیر state و nonce در OIDC قابل حدس زدن نباشند، مخصوص همان تراکنش باشند، و به‌صورت امن هم به کلاینت و هم به نشست (Session) مرورگری که تراکنش در آن شروع شده، متصل شده باشند.,,✓,✓,, +V10,OAuth and OIDC,V10.2,OAuth Client,V10.2.1,درCode Flow، باید OAuth Client در برابر حملاتBrowser-based Request Forgery که معمولاً با عنوان Cross-Site Request Forgery (CSRF) شناخته می‌شوند و درخواست‌های توکن را ایجاد می‌کنند، محافظت داشته باشد. این محافظت باید با استفاده از قابلیت PKCE یا با بررسی پارامترstate که در درخواست احراز مجوز ارسال شده است.,,✓,✓,, +V10,OAuth and OIDC,V10.2,OAuth Client,V10.2.2,اگر OAuth Client بتواند با بیش از یک Authorization Server تعامل داشته باشد، باید دارای سازوکاری برای دفاع در برابر Mix-up Attacks باشد. برای مثال، می‌تواند الزام کند که Authorization Server مقدار پارامتر ‘iss’ را برگرداند و این مقدار هم درAuthorization Response و هم درToken Response اعتبارسنجی شود.,,✓,✓,, +V10,OAuth and OIDC,V10.2,OAuth Client,V10.2.3,OAuth Client باید فقطScopes (یا سایر پارامترهای مجوزدهی) مورد نیاز را در درخواست‌ها به Authorization Server درخواست کند.,,,✓,, +V10,OAuth and OIDC,V10.3,OAuth Resource Server,V10.3.1,Resource Server باید فقط Access Tokenهایی را بپذیرد که برای استفاده با همان سرویس در نظر گرفته شده‌اند(Audience). Audience می‌تواند در یک Access Token ساختاریافته (مانند مقدار aud در JWT) درج شده باشد، یا از طریق Token Introspection Endpoint بررسی شود.,,✓,✓,, +V10,OAuth and OIDC,V10.3,OAuth Resource Server,V10.3.2,Resource Server باید تصمیمات مجوزدهی (Authorization Decisions) را بر اساس Claims موجود در Access Token که واگذاری مجوز (Delegated Authorization) را تعریف می‌کنند، اعمال کند. اگر Claimsهایی مانند sub، scope و authorization_details موجود باشند، باید جزو فرآیند تصمیم‌گیری قرار گیرند.,,✓,✓,, +V10,OAuth and OIDC,V10.3,OAuth Resource Server,V10.3.3,اگر برای گرفتن یک تصمیم کنترل دسترسی، لازم است یک کاربرِ یکتا از داخل Access Token (چه JWT و چه پاسخ Token Introspection ) شناسایی شود، سرور منبع (Resource Server) کاربر را از روی Claimهایی شناسایی کند که قابل اختصاص‌دادن به کاربران دیگر نیستند. معمولاً این یعنی استفاده از ترکیب دو Claim یعنی 'iss' (صادرکننده توکن) و 'sub' (شناسه یکتای کاربر),,✓,✓,, +V10,OAuth and OIDC,V10.3,OAuth Resource Server,V10.3.4,اگر Resource Server نیازمند قدرت، روش یا تازگی خاص احراز هویت باشد، بررسی کند که Access Token ارائه‌شده این محدودیت‌ها را برآورده می‌کند. برای مثال، در صورت وجود، از Claimsهای OIDC مانند acr، amr و auth_time به ترتیب استفاده شود.,,✓,✓,, +V10,OAuth and OIDC,V10.3,OAuth Resource Server,V10.3.5,تأیید کنید که Resource Server از استفاده از Access Tokenهای سرقت‌شده یا Replay توکن‌ها (توسط افراد غیرمجاز) جلوگیری کند، با الزام استفاده از Sender-Constrained Access Tokens، مانند Mutual TLS برای OAuth 2 یا OAuth2 Demonstration of Proof of Possession (DPoP).,,,✓,, +V10,OAuth and OIDC,V10.4,OAuth Authorization Server,V10.4.1,سرور احراز هویت باید آدرس‌های بازگشتی (Redirect URI) را بر اساس فهرست مجاز (Allowlist) از URIهای از پیش‌ثبت‌شده و مخصوص هر کلاینت، با استفاده از مقایسه دقیقِ رشته‌ای Comparison) (Exact String اعتبارسنجی می‌کند.,✓,✓,✓,, +V10,OAuth and OIDC,V10.4,OAuth Authorization Server,V10.4.2,اگر Authorization Server کد احراز مجوز (Authorization Code) را در Authorization Response برمی‌گرداند، این کد فقط یک‌بار برای درخواست توکن باید قابل استفاده باشد. برای دومین درخواست معتبر با یک Authorization Code که قبلاً برای صدور Access Token استفاده شده است، Authorization Server باید درخواست توکن را رد کند و هر توکن صادرشده‌ی مرتبط با آن Authorization Code را باطل نماید.,✓,✓,✓,, +V10,OAuth and OIDC,V10.4,OAuth Authorization Server,V10.4.3,تأیید کنید که Authorization Code دارای مدت زمان معتبر بودن محدود باشد. حداکثر طول عمر می‌تواند برای برنامه‌های کاربردی در سطوح L1 و L2 تا ۱۰ دقیقه و برای برنامه‌های کاربردی در سطح L3 تا ۱ دقیقه باشد.,✓,✓,✓,, +V10,OAuth and OIDC,V10.4,OAuth Authorization Server,V10.4.4,برای یک Client مشخص، Authorization Server فقط استفاده از Grantهایی را مجاز بداند که آن Client به استفاده از آن‌ها نیاز دارد. توجه داشته باشید که Grantهای ‘token’ (Implicit Flow) و ‘password’ (Resource Owner Password Credentials Flow) دیگر نباید استفاده شوند.,✓,✓,✓,, +V10,OAuth and OIDC,V10.4,OAuth Authorization Server,V10.4.5,Authorization Server باید حملات Refresh Token Replay را برای Public Clientها کاهش دهد، ترجیحاً با استفاده از Sender-Constrained Refresh Tokens، یعنی Demonstrating Proof of Possession (DPoP) یا Certificate-Bound Access Tokens با استفاده از Mutual TLS (mTLS). برای برنامه‌های L1 و L2، می‌توان از Refresh Token Rotation استفاده کرد. اگر Refresh Token Rotation به‌کار گرفته شود، Authorization Server باید پس از استفاده، Refresh Token را باطل کند و اگر یک Refresh Token که قبلاً استفاده و باطل شده ارائه شود، تمام Refresh Tokenهای مربوط به آن مجوز را ابطال نماید.,✓,✓,✓,, +V10,OAuth and OIDC,V10.4,OAuth Authorization Server,V10.4.6,اگر از Code Grant استفاده شود، Authorization Server باید حملات Authorization Code Interception را با الزام به استفاده از Proof Key for Code Exchange (PKCE) کاهش دهد. برای Authorization Requestها، Authorization Server باید یک مقدار معتبر برای 'code_challenge' الزام کند و نباید مقدار 'code_challenge_method' از نوع 'plain' را بپذیرد. برای Token Request، باید اعتبارسنجی پارامتر 'code_verifier' الزامی باشد.,,✓,✓,, +V10,OAuth and OIDC,V10.4,OAuth Authorization Server,V10.4.7,اگر Authorization Server از Unauthenticated Dynamic Client Registration پشتیبانی می‌کند، ریسک مربوط به Client Applicationهای مخرب را باید کاهش دهد. این کار باید شامل اعتبارسنجی Client Metadata (مانند هر Registered URI)، اطمینان از رضایت کاربر، و هشدار به کاربر پیش از پردازش یک Authorization Request با یک Client Application غیرقابل اعتماد باشد.,,✓,✓,, +V10,OAuth and OIDC,V10.4,OAuth Authorization Server,V10.4.8,Refresh Tokenها باید دارای یک انقضای مطلق (Absolute Expiration) باشند، حتی اگر از Sliding Refresh Token Expiration استفاده شود.,,✓,✓,, +V10,OAuth and OIDC,V10.4,OAuth Authorization Server,V10.4.9,Refresh Tokenها و Reference Access Tokenها باید توسط کاربر مجاز از طریق User Interface Authorization Server قابل ابطال باشند، تا ریسک Clientهای مخرب یا توکن‌های سرقت‌شده کاهش یابد.,,✓,✓,, +V10,OAuth and OIDC,V10.4,OAuth Authorization Server,V10.4.10,Confidential Client باید برای درخواست‌های Backchannel بین Client و Authorization Server، مانند Token Requests، Pushed Authorization Requests (PAR) و Token Revocation Requests، احراز هویت شود.,,✓,✓,, +V10,OAuth and OIDC,V10.4,OAuth Authorization Server,V10.4.11,پیکربندی Authorization Server باید فقط Scopes موردنیاز را به OAuth Client اختصاص دهد.,,✓,✓,, +V10,OAuth and OIDC,V10.4,OAuth Authorization Server,V10.4.12,برای یک Client مشخص، Authorization Server فقط مقدار 'response_mode' را که این Client نیاز دارد، مجاز بداند. برای مثال، با اعتبارسنجی این مقدار توسط Authorization Server در برابر مقادیر مورد انتظار یا با استفاده از Pushed Authorization Request (PAR) یا JWT-secured Authorization Request (JAR).,,,✓,, +V10,OAuth and OIDC,V10.4,OAuth Authorization Server,V10.4.13,Grant Type ‘code’ همواره همراه با Pushed Authorization Requests (PAR) باید استفاده شود.,,,✓,, +V10,OAuth and OIDC,V10.4,OAuth Authorization Server,V10.4.14,Authorization Server باید فقط توکن‌های دسترسی از نوع وابسته به ارسال‌کننده (Proof-of-Possession) صادر می‌کند؛ چه به‌صورت توکن‌های دسترسی مبتنی بر گواهی از طریق TLS دوسویه (mTLS) و چه به‌صورت توکن‌های دسترسی وابسته به DPoP (Demonstration of Proof of Possession).,,,✓,, +V10,OAuth and OIDC,V10.4,OAuth Authorization Server,V10.4.15,برای یک کلاینت سمت‌سرور (که روی دستگاه کاربر نهایی اجرا نمی‌شود)، سرور احراز هویت اطمینان حاصل می‌کند که مقدار پارامترِ authorization_details از بک‌اند کلاینت ارسال شده و کاربر در آن دستکاری نکرده است. به‌عنوان مثال، با الزام به استفاده از درخواست احراز هویت پوش‌شده (PAR) یا درخواست احراز هویت ایمن‌شده با JWT (JAR).,,,✓,, +V10,OAuth and OIDC,V10.4,OAuth Authorization Server,V10.4.16,کلاینت باید از نوع Confidential Client باشد و سرور احراز هویت استفاده از روش‌های قدرتمند احراز هویت کلاینت ـ مبتنی بر رمزنگاری کلید عمومی و مقاوم در برابر حملات replay attacks ـ را الزامی کند؛ مانند TLS دوسویه (tls_client_auth ‎، ‎self_signed_tls_client_auth یا JWT مبتنی بر کلید خصوصی (private_key_jwt).,,,✓,, +V10,OAuth and OIDC,V10.5,OIDC Client,V10.5.1,Client به‌عنوان Relying Partyباید در برابر حملات بازپخش (Replay) توکن ID محافظت شده است. برای مثال، با بررسی اینکه مقدار claim مربوط به nonce در ID Token دقیقاً با مقدار **nonce**ای که در درخواست احراز هویت به OpenID Provider ارسال شده، یکسان باشد(که در OAuth 2 به آن authorization request ارسالی به authorization server گفته می‌شود).,,✓,✓,, +V10,OAuth and OIDC,V10.5,OIDC Client,V10.5.2,Client باید کاربر را به‌صورت یکتا از ID Token Claims شناسایی کند، معمولاً از ‘sub’ Claim ، که قابل انتساب مجدد به کاربران دیگر نیست (در محدوده‌ی همان Identity Provider).,,✓,✓,, +V10,OAuth and OIDC,V10.5,OIDC Client,V10.5.3,Client باید تلاش‌های یک Authorization Server مخرب برای جا زدن خود به‌جای یک Authorization Server دیگر از طریق متادیتای Authorization Server را رد می‌کند.کلاینت باید متادیتای Authorization Server را رد کند اگر مقدار issuer URL موجود در متادیتا دقیقاً با issuer URL از پیش پیکربندی‌شده و مورد انتظار کلاینت یکسان نباشد.,,✓,✓,, +V10,OAuth and OIDC,V10.5,OIDC Client,V10.5.4,Client باید اعتبارسنجی کند ID Token برای استفاده توسط همان Client در نظر گرفته شده است (Audience)، با بررسی اینکه ‘aud’ Claim در توکن برابر با مقدار ‘client_id’ مربوط به Client باشد.,,✓,✓,, +V10,OAuth and OIDC,V10.5,OIDC Client,V10.5.5,هنگام استفاده ازOIDC Back-Channel Logout، Relying Party از Denial of Service از طریق Forced Logout و Cross-JWT Confusion در جریان Logout باید جلوگیری کند. Client باید بررسی کند که Logout Token به درستی با مقدار typ آن برابر با logout+jwt باشد ، شامل ‘event’ Claim با نام عضو صحیح باشد و شامل ‘nonce’ Claim نباشد. همچنین توصیه می‌شود Expiration کوتاه باشد (مثلاً ۲ دقیقه).,,✓,✓,, +V10,OAuth and OIDC,V10.6,OpenID Provider,V10.6.1,OpenID Provider باید فقط مقادیر 'code'، 'ciba'، 'id_token' یا 'id_token code' را برای Response Mode مجاز بداند. توجه داشته باشید که 'code' نسبت به 'id_token code' (که OIDC Hybrid Flow است) ترجیح داده می‌شود و 'token' (هر Implicit Flow) نباید استفاده شود.,,✓,✓,, +V10,OAuth and OIDC,V10.6,OpenID Provider,V10.6.2,OpenID Provider از Denial of Service از طریق Forced Logout جلوگیری کند. این کار با دریافت تأیید صریح از کاربر نهایی یا در صورت وجود، اعتبارسنجی پارامترها در Logout Request (که توسط Relying Party آغاز شده است)، مانند ‘id_token_hint’، انجام می‌شود.,,✓,✓,, +V10,OAuth and OIDC,V10.7,Consent Management,V10.7.1,Authorization Server باید تضمین ‌کند کاربر برای هر درخواست مجوز (Authorization Request) رضایت خود را اعلام کرده است. در صورتی که هویت کلاینت قابل اطمینان نباشد، Authorization Server باید در همه موارد کاربر را به‌صورت صریح برای اعلام رضایت (Consent) راهنمایی و از او تأیید بگیرد.,,✓,✓,, +V10,OAuth and OIDC,V10.7,Consent Management,V10.7.2,زمانی که Authorization Server از کاربر درخواست رضایت (Consent) می‌کند باید اطلاعات کافی و شفافی درباره آنچه کاربر در حال تأیید آن است ارائه ‌دهد. در صورت لزوم، این اطلاعات باید شامل این موارد باشد: ماهیت مجوزهای درخواستی )معمولاً بر اساس scope، resource server و جزئیات مجوز در Rich Authorization Requests – RAR)، هویت برنامه یا اپلیکیشن دریافت‌کننده مجوز و مدت اعتبار این مجوزها.,,✓,✓,, +V10,OAuth and OIDC,V10.7,Consent Management,V10.7.3,کاربر باید بتواند رضایت‌هایی (Consents) را که از طریق Authorization Server صادر کرده است، مشاهده، ویرایش و لغو (Revoke) کند.,,✓,✓,, +V11,Cryptography,V11.1,Cryptographic Inventory and Documentation,V11.1.1,اطمینان حاصل کنید که یک سیاست مستند برای مدیریت کلیدهای رمزنگاری و چرخه‌عمر کلیدهای رمزنگاری وجود دارد که از یک استاندارد مدیریت کلید مانند NIST SP 800-57 پیروی می‌کند. این باید شامل اطمینان از این موضوع باشد که کلیدها بیش از حد به اشتراک گذاشته نشوند (برای مثال، در مورد Secrets مشترک با بیش از دو موجودیت و در مورد کلیدهای خصوصی با بیش از یک موجودیت).,,✓,✓,, +V11,Cryptography,V11.1,Cryptographic Inventory and Documentation,V11.1.2,فهرست اجزاء رمزنگاری باید تهیه و نگهداری ‌شود و به‌صورت منظم به‌روزرسانی گردد و شامل تمام کلیدهای رمزنگاری، الگوریتم‌ها و گواهی‌های دیجیتال مورد استفاده در برنامه باشد. این فهرست همچنین باید مشخص کند که کلیدها در کدام بخش‌های سیستم مجاز یا غیرمجاز به استفاده هستند و چه نوع داده‌هایی می‌توانند یا نمی‌توانند با این کلیدها محافظت شوند.,,✓,✓,, +V11,Cryptography,V11.1,Cryptographic Inventory and Documentation,V11.1.3,مکانیزم‌های کشف رمزنگاری برای شناسایی تمام موارد استفاده از رمزنگاری در سیستم باید استفاده ‌شود؛ از جمله رمزنگاری (encryption)، هش‌کردن (hashing) و عملیات امضای دیجیتال (signing).,,,✓,, +V11,Cryptography,V11.1,Cryptographic Inventory and Documentation,V11.1.4,فهرست اجزاء رمزنگاری باید تهیه ‌شود. این فهرست باید شامل یک برنامه مستند باشد که مسیر مهاجرت به استانداردهای جدید رمزنگاری (مانند رمزنگاری پساکوانتومی) را مشخص می‌کند تا امکان واکنش مناسب به تهدیدات آینده فراهم شود.,,,✓,, +V11,Cryptography,V11.2,Secure Cryptography Implementation,V11.2.1,برای عملیات رمزنگاری باید از پیاده‌سازی‌های مورد تأیید (شامل کتابخانه‌ها و پیاده‌سازی‌های سخت‌افزاری) استفاده شود.,,✓,✓,, +V11,Cryptography,V11.2,Secure Cryptography Implementation,V11.2.2,برنامه با انعطاف‌پذیری رمزنگاری (crypto agility) باید طراحی شده باشد، به‌طوری که الگوریتم‌های تولید اعداد تصادفی، رمزنگاری احراز هویت‌شده، MAC یا هش، طول کلیدها، تعداد دورها، رمزها و حالت‌ها بتوانند در هر زمان مجدداً پیکربندی، ارتقاء یا تعویض شوند تا در برابر شکست‌های رمزنگاری محافظت شوند. به همین ترتیب، باید امکان جایگزینی کلیدها و رمزهای عبور و رمزگذاری مجدد داده‌ها نیز وجود داشته باشد. این امکان ارتقاء بدون وقفه به رمزنگاری پساکوانتومی (PQC) را فراهم می‌کند، زمانی که پیاده‌سازی‌های با اطمینان بالا از طرح‌ها یا استانداردهای تأییدشده PQC به‌طور گسترده در دسترس قرار گیرند.,,✓,✓,, +V11,Cryptography,V11.2,Secure Cryptography Implementation,V11.2.3,تمام بدویات رمزنگاری (cryptographic primitives) بر اساس الگوریتم، اندازه کلید و پیکربندی، حداقل ۱۲۸ بیت سطح امنیتی را فراهم می‌کنند(2128)، برای مثال، یک کلید ECC با طول ۲۵۶ بیت تقریباً ۱۲۸ بیت امنیت ارائه می‌دهد، در حالی که برای رسیدن به همین سطح امنیت، الگوریتم RSA به کلید ۳۰۷۲ بیتی نیاز دارد.,,✓,✓,, +V11,Cryptography,V11.2,Secure Cryptography Implementation,V11.2.4,تأیید کنید که تمامی عملیات رمزنگاری زمان ثابت (constant-time) باشند و هیچ عملیات «کوتاه‌شده» (short-circuit) در مقایسه‌ها، محاسبات یا بازگشت‌ها وجود نداشته باشد تا از نشت اطلاعات جلوگیری شود.( مهاجم می‌تواند از همین تفاوت‌های زمانی، از طریق Timing Side-Channel Attack، اطلاعات حساس را استخراج کند.),,,✓,, +V11,Cryptography,V11.2,Secure Cryptography Implementation,V11.2.5,تأیید کنید که تمامی ماژول‌های رمزنگاری به‌صورت امن دچار خطا (fail securely) شوند و خطاها به گونه‌ای مدیریت شوند که ایجاد آسیب‌پذیری‌هایی مانند حملات Padding Oracle را ممکن نکنند.,,,✓,, +V11,Cryptography,V11.3,Encryption Algorithms,V11.3.1,از مد‌های بلاک ناامن (مانند ECB) و روش‌های Padding ضعیف (مانند PKCS#1 v1.5) نباید استفاده شود.,✓,✓,✓,, +V11,Cryptography,V11.3,Encryption Algorithms,V11.3.2,تنها رمزها و مد‌های تأییدشده، مانند AES با GCM باید استفاده شوند.,✓,✓,✓,, +V11,Cryptography,V11.3,Encryption Algorithms,V11.3.3,داده‌های رمزنگاری‌شده باید با استفاده از ترجیحاً یک روش رمزنگاری احراز هویت‌شده تأییدشده یا با ترکیب یک روش رمزنگاری تأییدشده با یک الگوریتم MAC تأییدشده در برابر تغییرات غیرمجاز محافظت شوند.,,✓,✓,, +V11,Cryptography,V11.3,Encryption Algorithms,V11.3.4,تأیید کنید که Nonceها، Initialization Vectorها و سایر اعداد یک‌بار مصرف برای بیش از یک جفت کلید رمزنگاری و عنصر داده استفاده نشوند. روش تولید آن‌ها باید متناسب با الگوریتم مورد استفاده باشد.,,,✓,, +V11,Cryptography,V11.3,Encryption Algorithms,V11.3.5,تأیید کنید که هر ترکیبی از یک الگوریتم رمزنگاری و یک الگوریتم MAC در حالت Encrypt-then-MAC عمل کند.,,,✓,, +V11,Cryptography,V11.4,Hashing and Hash-based Functions,V11.4.1,تأیید کنید که تنها توابع هش تأییدشده برای موارد استفاده عمومی رمزنگاری، از جمله امضاهای دیجیتال، HMAC، KDF و تولید بیت تصادفی استفاده شوند. توابع هش غیرمجاز، مانند MD5، نباید برای هیچ هدف رمزنگاری به‌کار گرفته شوند.,✓,✓,✓,, +V11,Cryptography,V11.4,Hashing and Hash-based Functions,V11.4.2,رمزعبورها با استفاده از یک تابع مشتق‌سازی کلید تأییدشده و پرهزینه محاسباتی (که به آن «تابع هش رمزعبور» نیز گفته می‌شود) ذخیره شوند، و تنظیمات پارامترها بر اساس راهنمایی‌های کنونی پیکربندی شده باشد. این تنظیمات باید تعادل بین امنیت و عملکرد برقرار کنند تا حملات Brute-force برای سطح امنیت مورد نیاز به‌طور کافی دشوار باشد.,,✓,✓,, +V11,Cryptography,V11.4,Hashing and Hash-based Functions,V11.4.3,توابع هش استفاده‌شده در امضاهای دیجیتال، باید به‌عنوان بخشی از احراز هویت داده یا یکپارچگی داده، در برابر collision مقاوم بوده و طول بیت مناسب داشته باشند. اگر مقاومت در برابر collision لازم باشد، طول خروجی باید حداقل 256 بیت باشد. اگر تنها مقاومت در برابر حملات Second Pre-image لازم باشد، طول خروجی باید حداقل 128 بیت باشد.,,✓,✓,, +V11,Cryptography,V11.4,Hashing and Hash-based Functions,V11.4.4,برنامه باید هنگام استخراج کلیدهای مخفی از پسوردها از توابع مشتق‌سازی کلید (KDF) تاییدشده با پارامترهای Key Stretching استفاده می‌کند. پارامترهای مورد استفاده باید تعادلی بین امنیت و عملکرد برقرار کنند تا از نفوذ حملات brute-force و به خطر افتادن کلید رمزنگاری تولیدشده جلوگیری شود.,,✓,✓,, +V11,Cryptography,V11.5,Random Values,V11.5.1,اعداد و رشته‌های تصادفی که قرار است قابل حدس نباشند، باید با استفاده از یک تولیدکننده اعداد شبه‌تصادفی امن رمزنگاری‌شده (CSPRNG) تولید شوند و حداقل 128 بیت انتروپی داشته باشند. توجه داشته باشید که UUIDها این شرط را رعایت نمی‌کنند.,,✓,✓,, +V11,Cryptography,V11.5,Random Values,V11.5.2,مکانیزم تولید اعداد تصادفی مورد استفاده به‌گونه‌ای طراحی شده باشد که حتی تحت بار سنگین نیز به‌طور امن عمل کند.,,,✓,, +V11,Cryptography,V11.6,Public Key Cryptography,V11.6.1,فقط الگوریتم‌های رمزنگاری و مدهای عملیاتی تأیید شده برای تولید کلید و مقداردهی اولیه، و همچنین برای تولید و تأیید امضاهای دیجیتال باید استفاده می‌شوند. الگوریتم‌های تولید کلید نباید کلیدهای ناامن تولید کنند که در برابر حملات شناخته شده آسیب‌پذیر باشند؛ به‌عنوان مثال، کلیدهای RSA که در برابر Fermat factorization آسیب‌پذیر هستند.,,✓,✓,, +V11,Cryptography,V11.6,Public Key Cryptography,V11.6.2,برای تبادل کلید از الگوریتم‌های رمزنگاری تأیید شده (مانند Diffie-Hellman) استفاده می‌شود و تمرکز بر این است که مکانیزم‌های تبادل کلید از پارامترهای امن بهره ببرند. این کار از حملات بر فرآیند برقراری کلید جلوگیری می‌کند و مانع حملات مرد میانی (MITM) یا شکست‌های رمزنگاری می‌شود.,,,✓,, +V11,Cryptography,V11.7,In-Use Data Cryptography,V11.7.1,رمزنگاری کامل حافظه (Full Memory Encryption) باید فعال باشد تا داده‌های حساس هنگام استفاده محافظت شوند و دسترسی کاربران یا فرآیندهای غیرمجاز به آن‌ها جلوگیری شود.,,,✓,, +V11,Cryptography,V11.7,In-Use Data Cryptography,V11.7.2,کاهش داده‌ها (data minimization) تضمین می‌کند که حداقل مقدار داده در حین پردازش افشا شود، و اطمینان حاصل شود که داده‌ها بلافاصله پس از استفاده یا در اولین فرصت ممکن رمزنگاری شوند.,,,✓,, +V12,Secure Communication,V12.1,General TLS Security Guidance,V12.1.1,جدیدترین نسخه‌های پیشنهادی پروتکل TLS فعال باشند، مانند TLS 1.2 و TLS 1.3 نسخه‌ی جدیدترین پروتکل TLS باید گزینه‌ی ترجیحی باشد.,✓,✓,✓,, +V12,Secure Communication,V12.1,General TLS Security Guidance,V12.1.2,تنها cipher suiteهای پیشنهادی فعال باشند و قوی‌ترین cipher suiteها به‌عنوان گزینه‌ی ترجیحی تنظیم شده باشند. برنامه‌های L3 باید تنها از cipher suiteهایی پشتیبانی کنند که Forward Secrecy را فراهم می‌کنند.,,✓,✓,, +V12,Secure Communication,V12.1,General TLS Security Guidance,V12.1.3,برنامه باید پیش از استفاده از هویت گواهی برای احراز هویت یا مجوزدهی، اعتبار و مورد اعتماد بودن گواهی‌های کلاینت در mTLS را بررسی و تأیید ‌کند.,,✓,✓,, +V12,Secure Communication,V12.1,General TLS Security Guidance,V12.1.4,لغو صحیح گواهی‌ها، مانند OCSP ، باید فعال و به‌درستی پیکربندی شده باشد.,,,✓,, +V12,Secure Communication,V12.1,General TLS Security Guidance,V12.1.5,Encrypted Client Hello (ECH) باید در تنظیمات TLS برنامه فعال باشد تا از افشای متادیتای حساس، مانند Server Name Indication (SNI)، در طول فرآیند Handshake TLS جلوگیری شود.,,,✓,, +V12,Secure Communication,V12.2,HTTPS Communication with External Facing Services,V12.2.1,برای تمام ارتباطات بین کلاینت و سرویس‌های مبتنی بر HTTP که در معرض دسترسی خارجی هستند، از TLS باید استفاده ‌شود و هیچ‌گونه بازگشت (fallback) به ارتباطات ناامن یا بدون رمزنگاری انجام نگیرد.,✓,✓,✓,, +V12,Secure Communication,V12.2,HTTPS Communication with External Facing Services,V12.2.2,سرویس‌هایی که در معرض دسترسی خارجی قرار دارند از گواهی‌های TLS عمومی و مورد اعتماد استفاده می‌کنند.,✓,✓,✓,, +V12,Secure Communication,V12.3,General Service to Service Communication Security,V12.3.1,یک پروتکل رمزنگاری‌شده مانند TLS باید برای تمامی ارتباطات ورودی و خروجی به و از برنامه استفاده شود، از جمله سیستم‌های مانیتورینگ، ابزارهای مدیریت، دسترسی از راه دور و SSH، میان‌افزارها، پایگاه‌های داده، mainframes، سیستم‌های partner یا APIهای خارجی. سرور نباید به پروتکل‌های ناامن یا بدون رمزگذاری بازگردد.,,✓,✓,, +V12,Secure Communication,V12.3,General Service to Service Communication Security,V12.3.2,کلاینت‌های TLS باید قبل از برقراری ارتباط با سرور TLS، گواهی‌های دریافتی را اعتبارسنجی کنند.,,✓,✓,, +V12,Secure Communication,V12.3,General Service to Service Communication Security,V12.3.3,TLS یا دیگر مکانیزم‌های مناسب رمزگذاری انتقال باید برای تمامی ارتباطات بین سرویس‌های داخلی مبتنی بر HTTP درون برنامه استفاده شود و ارتباط به حالت‌های ناامن یا بدون رمزگذاری بازنگردد.,,✓,✓,, +V12,Secure Communication,V12.3,General Service to Service Communication Security,V12.3.4,ارتباطات TLS بین سرویس‌های داخلی باید از گواهی‌های معتبر استفاده کنند. در صورتی که از گواهی‌های داخلی تولیدشده یا Self-Signed استفاده شود، سرویس مصرف‌کننده باید به‌گونه‌ای پیکربندی شود که تنها به CAهای داخلی مشخص و گواهی‌های Self-Signed خاص اعتماد کند.,,✓,✓,, +V12,Secure Communication,V12.3,General Service to Service Communication Security,V12.3.5,سرویس‌هایی که درون یک سیستم با یکدیگر ارتباط دارند (ارتباطات درون‌سرویسی)، باید از احراز هویت قوی استفاده کنند تا هر نقطه انتهایی (endpoint) تأیید شود. روش‌های احراز هویت قوی، مانند احراز هویت کلاینت TLS، باید به‌کار گرفته شوند تا هویت تضمین شود (با استفاده از زیرساخت کلید عمومی (PKI) و مکانیزم‌هایی که در برابر حملات تکرار (replay attacks) مقاوم هستند). برای معماری‌های میکروسرویس، استفاده از سرویس مش برای ساده‌سازی مدیریت گواهی‌ها و افزایش امنیت در نظر گرفته شود,,,✓,, +V13,Configuration,V13.1,Configuration Documentation,V13.1.1,تمامی نیازهای ارتباطی برنامه باید به‌طور کامل مستندسازی شده باشند. این مستندسازی شامل سرویس‌های خارجی که برنامه به آن‌ها وابسته است و همچنین مواردی که کاربر نهایی جهت اتصال به سرویس خارجی مشخص می‌کند باید باشد.,,✓,✓,, +V13,Configuration,V13.1,Configuration Documentation,V13.1.2,برای هر سرویسی که برنامه استفاده می‌کند، مستندسازی باید شامل حداکثر تعداد ارتباطات همزمان (مثلاً محدودیت‌های Connection Pool) و نحوه‌ی رفتار برنامه هنگام رسیدن به این حد باشد، از جمله هر مکانیزم بازیابی یا جایگزین، تا از بروز شرایط Denial of Service جلوگیری شود.,,,✓,, +V13,Configuration,V13.1,Configuration Documentation,V13.1.3,مستندات برنامه باید استراتژی‌های مدیریت منابع را برای هر سیستم یا سرویس خارجی که استفاده می‌کند مشخص کرده باشد (مثلاً پایگاه‌های داده، هندل‌های فایل، رشته‌ها، اتصالات HTTP) این مستندسازی باید شامل این موارد باشد :رویه‌های آزادسازی منابع، تنظیمات تایم‌اوت، مدیریت خطاها، جایی که منطق Retry اعمال می‌شود، شامل محدودیت تعداد Retry، تأخیرها و الگوریتم‌هایBack-off. برای عملیات همزمان درخواست–پاسخ HTTP (Synchronous)، مستندات باید تایم‌اوت کوتاه را الزام کند و یا Retryها را غیرفعال کند یا به‌طور سختگیرانه محدود کند تا از تاخیرهای زنجیره‌ای و هدررفت منابع جلوگیری شود.,,,✓,, +V13,Configuration,V13.1,Configuration Documentation,V13.1.4,مستندسازی برنامه باید شامل secretهای حیاتی برای امنیت برنامه و همچنین برنامه‌ای برای چرخش آن‌ها باشد( بر اساس مدل تهدید سازمان و نیازهای کسب‌وکار).,,,✓,, +V13,Configuration,V13.2,Backend Communication Configuration,V13.2.1,رتباطات بین اجزای بک‌اند برنامه که از مکانیزم استاندارد نشست کاربران برنامه پشتیبانی نمی‌کنند، از جمله APIها، میان‌افزارها و لایه‌های داده، باید احراز هویت شده باشند. احراز هویت باید با استفاده از حساب‌های سرویس جداگانه، توکن‌های کوتاه‌مدت یا احراز هویت مبتنی بر گواهی انجام شود و نباید از اعتبارنامه‌های ثابت مانند رمز عبور، کلیدهای API یا حساب‌های مشترک با دسترسی‌های سطح بالا استفاده شود.,,✓,✓,, +V13,Configuration,V13.2,Backend Communication Configuration,V13.2.2,ارتباطات بین اجزای بک‌اند، از جمله سرویس‌های محلی یا سیستم‌عامل، APIها، میان‌افزارها و لایه‌های داده، با حساب‌هایی باید انجام شود که کمترین سطح دسترسی لازم را دارند.,,✓,✓,, +V13,Configuration,V13.2,Backend Communication Configuration,V13.2.3,اگر اعتبارنامه‌ای برای احراز هویت سرویس استفاده می‌شود، اعتبارنامه‌ای که توسط مصرف‌کننده استفاده می‌شود، اعتبارنامه پیش‌فرض نباشد (مثلاً root/root یا admin/admin).,,✓,✓,, +V13,Configuration,V13.2,Backend Communication Configuration,V13.2.4,یک allowlist برای تعیین منابع یا سیستم‌های خارجی که برنامه مجاز به ارتباط با آن‌ها است باید وجود داشته باشد (مثلاً برای درخواست‌های خروجی، بارگذاری داده یا دسترسی به فایل). این allowlist می‌تواند در لایه برنامه، وب‌سرور، فایروال یا ترکیبی از لایه‌های مختلف پیاده‌سازی شود.,,✓,✓,, +V13,Configuration,V13.2,Backend Communication Configuration,V13.2.5,وب‌سرور یا سرور برنامه با یک allowlist از منابع یا سیستم‌هایی که سرور می‌تواند به آن‌ها درخواست ارسال کند یا داده‌ها و فایل‌ها را بارگذاری کند پیکربندی شده باشد.,,✓,✓,, +V13,Configuration,V13.2,Backend Communication Configuration,V13.2.6,در مواقعی که برنامه به سرویس‌های جداگانه متصل می‌شود، پیکربندی مستندسازی‌شده برای هر اتصال رعایت شود، از جمله حداکثر ارتباطات همزمان، رفتار هنگام رسیدن به حداکثر ارتباط مجاز، زمان‌های Timeout اتصال و استراتژی‌های Retry.,,,✓,, +V13,Configuration,V13.3,Secret Management,V13.3.1,یک راهکار مدیریت secret، مانند Key Vault، برای ایجاد امن، ذخیره، کنترل دسترسی و از بین بردن secret بک‌اند استفاده شود. این secret می‌تواند شامل رمزعبورها، داده‌های رمز نگاری، اطلاعات حساس مربوط به اتصال به پایگاه داده و سیستم‌های شخص ثالث، کلیدها و seedهای توکن‌های زمان‌محور، سایر secretهای داخلی و کلیدهای API باشد. Secret نباید در کد منبع برنامه یا در build artifacts قرار گیرد. برای برنامه‌های L3، این باید شامل راهکاری مبتنی بر سخت‌افزار مانند HSM باشد.,,✓,✓,, +V13,Configuration,V13.3,Secret Management,V13.3.2,دسترسی به دارایی‌های secret بر اساس اصل حداقل دسترسی (Least Privilege) رعایت شود.,,✓,✓,, +V13,Configuration,V13.3,Secret Management,V13.3.3,تمام عملیات رمزنگاری باید با استفاده از یک ماژول امنیتی ایزوله (مانند Vault یا Hardware Security Module) انجام شود تا مواد کلیدی به‌طور امن مدیریت و محافظت شده و از افشای خارج از ماژول امنیتی جلوگیری شود.,,,✓,, +V13,Configuration,V13.3,Secret Management,V13.3.4,secretها بر اساس مستندسازی برنامه طوری پیکربندی شوند که منقضی شده و چرخش داده شوند.,,,✓,, +V13,Configuration,V13.4,Unintended Information Leakage,V13.4.1,برنامه باید به‌گونه‌ای مستقر شود که هیچ‌گونه متادیتای کنترل نسخه، از جمله پوشه‌های .git یا .svn، در دسترس نباشد یا به شکلی باشد که این پوشه‌ها نه از بیرون و نه توسط خود برنامه قابل دسترسی نباشند.,✓,✓,✓,, +V13,Configuration,V13.4,Unintended Information Leakage,V13.4.2,حالت‌های Debug برای تمام اجزا در محیط‌های production باید غیرفعال شده باشند تا از افشای قابلیت‌های دیباگ و نشت اطلاعات جلوگیری شود.,,✓,✓,, +V13,Configuration,V13.4,Unintended Information Leakage,V13.4.3,وب‌سرورها فهرست‌بندی دایرکتوری‌ها را به کاربر نهایی نباید نمایش دهند مگر اینکه به‌طور صریح مورد نظر باشد.,,✓,✓,, +V13,Configuration,V13.4,Unintended Information Leakage,V13.4.4,از متد HTTP TRACE در محیط‌های production نباید پشتیبانی شود تا از احتمال نشت اطلاعات جلوگیری شود.,,✓,✓,, +V13,Configuration,V13.4,Unintended Information Leakage,V13.4.5,مستندسازی‌ها (مانند مستندات APIهای داخلی) و نقاط پایش (Monitoring Endpoints) در دسترس نباشند مگر اینکه به‌طور صریح مورد نظر باشد.,,✓,✓,, +V13,Configuration,V13.4,Unintended Information Leakage,V13.4.6,تأیید کنید که برنامه اطلاعات نسخه دقیق اجزای backend را افشا نکند.,,,✓,, +V13,Configuration,V13.4,Unintended Information Leakage,V13.4.7,لایه وب باید به‌گونه‌ای پیکربندی شده باشد که فقط فایل‌هایی با پسوندهای مشخص را سرو کند تا از افشای تصادفی اطلاعات، پیکربندی و کد منبع جلوگیری شود.,,,✓,, +V14,Data Protection,V14.1,Data Protection Documentation,V14.1.1,تمامی داده‌های حساس ایجادشده و پردازش‌شده توسط برنامه باید شناسایی شده و بر اساس سطوح حفاظتی طبقه‌بندی شده‌اند. این موضوع شامل داده‌هایی می‌شود که صرفاً کُدگذاری شده‌اند و به‌راحتی قابل بازیابی هستند، مانند رشته‌های Base64 یا محتوای متنی (plaintext) داخل یک JWT. سطوح حفاظتی باید الزامات قوانین و استانداردهای حفاظت از داده و حریم خصوصی که برنامه ملزم به رعایت آن‌هاست را در نظر بگیرند.,,✓,✓,, +V14,Data Protection,V14.1,Data Protection Documentation,V14.1.2,برای تمامی سطوح حفاظت از داده‌های حساس، مجموعه‌ای مستند از الزامات حفاظتی تعریف شده باشد. این الزامات باید شامل (اما محدود به آن نباشد) موارد زیر باشند: الزامات مرتبط با رمزنگاری کلی، بررسی صحت و یکپارچگی، دوره‌های نگهداری داده، نحوه ثبت داده‌ها در لاگ، کنترل‌های دسترسی به داده‌های حساس در لاگ‌ها، رمزنگاری در سطح پایگاه داده، الزامات مربوط به حریم خصوصی و فناوری‌های تقویت‌کننده حریم خصوصی مورد استفاده، و سایر الزامات مرتبط با محرمانگی.,,✓,✓,, +V14,Data Protection,V14.2,General Data Protection,V14.2.1,داده‌های حساس باید فقط در بدنه پیام HTTP یا فیلدهای هدر به سرور ارسال شوند، و اینکه URL و query string شامل اطلاعات حساس (مانند API key یا session token) نباشند.,✓,✓,✓,, +V14,Data Protection,V14.2,General Data Protection,V14.2.2,برنامه باید از cache شدن داده‌های حساس در اجزای سرور مانند Load Balancer و Application Cache جلوگیری کند، یا اطمینان حاصل شود که داده‌ها پس از استفاده به‌طور ایمن پاک‌سازی می‌شوند.,,✓,✓,, +V14,Data Protection,V14.2,General Data Protection,V14.2.3,داده‌های حساس تعریف‌شده به طرف‌های غیرقابل اعتماد (مانند User Trackers) نباید ارسال شوند تا از جمع‌آوری ناخواسته داده‌ها خارج از کنترل برنامه جلوگیری شود.,,✓,✓,, +V14,Data Protection,V14.2,General Data Protection,V14.2.4,کنترل‌های مرتبط با داده‌های حساس شامل رمزنگاری، بررسی صحت و یکپارچگی، نگهداری، نحوه ثبت داده‌ها در لاگ، کنترل‌های دسترسی به داده‌های حساس در لاگ‌ها، حریم خصوصی و فناوری‌های مربوط به حریم خصوصی، مطابق با آنچه در مستندات برای سطح حفاظت مشخص هر داده تعریف شده است، پیاده‌سازی شوند.,,✓,✓,, +V14,Data Protection,V14.2,General Data Protection,V14.2.5,مکانیزم‌های cache باید طوری پیکربندی شده باشند که تنها پاسخ‌هایی با نوع محتوای مورد انتظار برای آن منبع cache شوند و شامل محتوای حساس یا پویا نباشند. وب‌سرور باید هنگام دسترسی به فایل ناموجود، پاسخ 404 یا 302 برگرداند و نه فایل معتبر دیگر، تا از حملات Web Cache Deception جلوگیری شود.,,,✓,, +V14,Data Protection,V14.2,General Data Protection,V14.2.6,برنامه باید تنها حداقل داده‌های حساس مورد نیاز برای عملکرد برنامه را بازگرداند. برای مثال، تنها برخی از ارقام شماره کارت اعتباری بازگردانده شود و نه شماره کامل. در صورتی که داده کامل لازم باشد، باید در رابط کاربری masked شود مگر اینکه کاربر به‌طور مشخص آن را مشاهده کند.,,,✓,, +V14,Data Protection,V14.2,General Data Protection,V14.2.7,اطلاعات حساس باید تحت طبقه‌بندی دوره‌ای نگهداری داده قرار گرفته باشند، به‌گونه‌ای که داده‌های قدیمی یا غیرضروری به‌طور خودکار، در یک برنامه زمان‌بندی‌شده مشخص، یا براساس نیاز حذف شوند.,,,✓,, +V14,Data Protection,V14.2,General Data Protection,V14.2.8,اطلاعات حساس باید از متادیتای فایل‌های ارسال‌شده توسط کاربر حذف شود، مگر اینکه ذخیره‌سازی آن با رضایت کاربر انجام شود.,,,✓,, +V14,Data Protection,V14.3,Client-side Data Protection,V14.3.1,داده‌های احراز هویت‌شده از حافظه کلاینت، مانند DOM مرورگر، پس از خروج کلاینت یا Session پاک شوند. فیلد هدر Clear-Site-Data در پاسخ سرور می‌تواند در این زمینه مفید باشد، اما کلاینت باید بتواند داده‌ها را حتی زمانی که اتصال به سرور در دسترس نیست در زمان پایان Session (خروج از آن) پاک کند.,✓,✓,✓,, +V14,Data Protection,V14.3,Client-side Data Protection,V14.3.2,برنامه باید هدرهای پاسخ HTTP، anti-cach مناسب (مانند Cache-Control: no-store) را تنظیم کند تا داده‌های حساس در مرورگرها cache نشوند.,,✓,✓,, +V14,Data Protection,V14.3,Client-side Data Protection,V14.3.3,برای اطلاعات بیشتر، همچنین به منابع زیر مراجعه کنید:,,✓,✓,, +V15,Secure Coding and Architecture,V15.1,Secure Coding and Architecture Documentation,V15.1.1,مستندات برنامه باید بازه‌های زمانی جهت برطرف سازی آسیب‌پذیری‌ نسخه‌های مؤلفه‌ شخص ثالث (بر اساس ریسک) و همچنین به‌روزرسانی کتابخانه‌ها را به طور کلی تعریف کرده باشد تا ریسک ناشی از این مؤلفه‌ها به حداقل برسد.,✓,✓,✓,, +V15,Secure Coding and Architecture,V15.1,Secure Coding and Architecture Documentation,V15.1.2,یک کاتالوگ دارایی مانند Software Bill of Materials (SBOM) باید برای تمامی کتابخانه‌های شخص ثالث مورد استفاده نگهداری شود. شامل تایید این که مؤلفه‌ها از مخازن از پیش تعیین‌شده، قابل اعتماد و به‌طور مستمر نگهداری‌شده تهیه شده‌اند.,,✓,✓,, +V15,Secure Coding and Architecture,V15.1,Secure Coding and Architecture Documentation,V15.1.3,مستندات برنامه باید شامل عملکردهایی که زمان‌بر یا پرمصرف(منابع سیستمی) هستند نیز باشد. این مورد باید شامل روش‌هایی برای جلوگیری از دست‌رفتن دسترس‌پذیری به دلیل استفاده بیش از حد از این عملکردها و همچنین جلوگیری از وضعیتی باشد که پردازش یک پاسخ طولانی‌تر از زمان انتظار مصرف‌کننده شود. تدابیر احتمالی می‌تواند شامل پردازش غیرهمزمان، استفاده از صف‌ها و محدود کردن فرآیندهای موازی برای هر کاربر و هر برنامه باشد.,,✓,✓,, +V15,Secure Coding and Architecture,V15.1,Secure Coding and Architecture Documentation,V15.1.4,مستندات برنامه باید کتابخانه‌های شخص ثالثی را که به‌عنوان «کامپوننت‌های پرخطر» شناخته می‌شوند، مشخص کرده باشد.,,,✓,, +V15,Secure Coding and Architecture,V15.1,Secure Coding and Architecture Documentation,V15.1.5,مستندات برنامه باید بخش‌هایی از برنامه را که به‌عنوان «عملکرد خطرناک» استفاده می‌شود، مشخص کرده باشد.,,,✓,, +V15,Secure Coding and Architecture,V15.2,Security Architecture and Dependencies,V15.2.1,برنامه باید تنها شامل کامپوننت‌هایی باشد که چارچوب‌های زمانی مستند‌شده برای به‌روزرسانی و رفع آسیب‌پذیری‌ها را نقض نکرده‌باشند.,✓,✓,✓,, +V15,Secure Coding and Architecture,V15.2,Security Architecture and Dependencies,V15.2.2,برنامه باید بر اساس تصمیمات و استراتژی‌های امنیتی مستندسازی‌شده، تدابیری برای جلوگیری از کاهش دسترس‌پذیری ناشی از عملکردهایی که زمان‌بر یا پرمصرف منابع هستند، پیاده‌سازی کرده باشد.,,✓,✓,, +V15,Secure Coding and Architecture,V15.2,Security Architecture and Dependencies,V15.2.3,محیط production تنها شامل عملکردهایی می‌باشد که برای اجرای برنامه ضروری هستند و هیچ قابلیت اضافی مانند کدهای تست، نمونه‌کدها و عملکردهای توسعه‌ای در دسترس نمی‌باشد.,,✓,✓,, +V15,Secure Coding and Architecture,V15.2,Security Architecture and Dependencies,V15.2.4,کامپوننت‌های شخص ثالث و تمام وابستگی‌های انتقالی آن‌ها از مخزن مورد انتظار باید دریافت ‌شوند، چه داخلی و چه منبع خارجی، و ریسک حمله‌ی dependency confusion مدیریت شود.,,,✓,, +V15,Secure Coding and Architecture,V15.2,Security Architecture and Dependencies,V15.2.5,برنامه باید محافظت‌های اضافی را در بخش‌هایی از برنامه که به‌عنوان «عملکرد خطرناک» مستند شده‌اند یا از کتابخانه‌های شخص ثالثی که به‌عنوان «کامپوننت‌های پرریسک» شناخته می‌شوند، پیاده‌سازی می‌کند. این می‌تواند شامل تکنیک‌هایی مانند sandboxing، encapsulation، containerization یا جداسازی در سطح شبکه باشد تا حمله‌کنندگان پس از نفوذ به یک بخش از برنامه، نتوانند به بخش‌های دیگر برنامه منتقل شوند و زمان لازم برای پیشروی آن‌ها افزایش یابد.,,,✓,, +V15,Secure Coding and Architecture,V15.3,Defensive Coding,V15.3.1,برنامه باید تنها زیرمجموعه‌ای از فیلدهای مورد نیاز از یک data object را بازگرداند. به‌عنوان مثال، نباید کل data object بازگردانده شود، زیرا برخی فیلدهای منفرد نباید برای کاربران قابل دسترسی باشند.,✓,✓,✓,, +V15,Secure Coding and Architecture,V15.3,Defensive Coding,V15.3.2,در جایی که بک‌اند برنامه به URLهای خارجی فراخوانی می‌فرستد، طوری باید پیکربندی شده باشد که تنها در صورت نیاز و منظور مشخص، از تغییر مسیرها (redirects) پیروی کند.,,✓,✓,, +V15,Secure Coding and Architecture,V15.3,Defensive Coding,V15.3.3,برنامه باید دارای تدابیر مقابله‌ای برای محافظت در برابر حملات mass assignment باشد، به‌طوری که فیلدهای مجاز برای هر کنترلر و اکشن محدود شده باشند؛ به عنوان مثال، نباید بتوان مقداری برای فیلدی وارد یا به‌روزرسانی کرد که قرار نبوده بخشی از آن اکشن باشد.,,✓,✓,, +V15,Secure Coding and Architecture,V15.3,Defensive Coding,V15.3.4,تمام اجزای proxying و middleware باید آدرس IP اصلی کاربر را به‌درستی منتقل کنند، با استفاده از فیلدهای داده معتبر که توسط کاربر نهایی قابل دستکاری نباشند، و برنامه و وب‌سرور از این مقدار صحیح برای ثبت لاگ و تصمیم‌گیری‌های امنیتی مانند rate limiting استفاده کنند، با در نظر گرفتن اینکه حتی آدرس IP اصلی ممکن است به دلیل IPهای پویا، VPNها یا فایروال‌های سازمانی قابل اعتماد نباشد.,,✓,✓,, +V15,Secure Coding and Architecture,V15.3,Defensive Coding,V15.3.5,برنامه باید به‌طور صریح اطمینان حاصل کند که variables از نوع صحیح هستند و عملیات‌های مقایسه و comparator به‌صورت دقیق (strict) انجام می‌شوند. این اقدام برای جلوگیری از آسیب‌پذیری‌های type juggling یا type confusion است که ممکن است به دلیل فرضیات نادرست برنامه درباره نوع یک متغیر ایجاد شود.,,✓,✓,, +V15,Secure Coding and Architecture,V15.3,Defensive Coding,V15.3.6,کد JavaScript باید به‌گونه‌ای نوشته شده باشد که از prototype pollution جلوگیری کند، برای مثال با استفاده از Set() یا Map() به جای object literals.,,✓,✓,, +V15,Secure Coding and Architecture,V15.3,Defensive Coding,V15.3.7,برنامه باید دارای تدابیر محافظتی در برابر HTTP parameter pollution باشد، به‌ویژه اگر چارچوب برنامه تفاوتی بین منابع پارامترهای درخواست (رشته‌های query، پارامترهای body، کوکی‌ها یا فیلدهای هدر) قائل نشود.,,✓,✓,, +V15,Secure Coding and Architecture,V15.4,Safe Concurrency,V15.4.1,shared objects در کد multi-threaded (مانند cacheها، فایل‌ها، یا اشیائی که توسط multiple threads دسترسی پیدا می‌کنند) باید به‌صورت ایمن مورد استفاده قرار بگیرند، با استفاده از نوع‌های thread-safe و مکانیزم‌های همگام‌سازی مانند lock یا semaphore تا از race condition و تخریب داده جلوگیری شود.,,,✓,, +V15,Secure Coding and Architecture,V15.4,Safe Concurrency,V15.4.2,بررسی وضعیت یک resource، مانند وجود آن یا دسترسی‌ها،و اقداماتی که به این وضعیت وابسته‌اند، به‌صورت یک عملیات واحد انجام شوند تا از race condition نوع time-of-check to time-of-use (TOCTOU) جلوگیری شود. برای مثال، بررسی اینکه یک فایل وجود دارد قبل از باز کردن آن، یا تأیید دسترسی یک کاربر قبل از اعطای آن.,,,✓,, +V15,Secure Coding and Architecture,V15.4,Safe Concurrency,V15.4.3,باید از قفل‌ها (Locks) به طور یکنواخت استفاده شود تا از گیر کردن (Threads) جلوگیری شود، چه با انتظار برای یکدیگر و چه با تلاش بی‌پایان، و همچنین منطق قفل‌گذاری باید در همان کدی باقی بماند که مسئول مدیریت منبع است؛ این کار تضمین می‌کند که قفل‌ها نمی‌توانند به‌صورت ناخواسته یا خرابکارانه توسط کلاس‌ها یا کدهای بیرونی تغییر داده شوند.,,,✓,, +V15,Secure Coding and Architecture,V15.4,Safe Concurrency,V15.4.4,تأیید کنید که سیاست‌های تخصیص resource از thread starvation جلوگیری می‌کنند، با اطمینان از دسترسی عادلانه به منابع، مانند استفاده از thread pools و اجازه دادن به threads با اولویت پایین‌تر تا در بازه زمانی منطقی پیشرفت کنند.,,,✓,, +V16,Security Logging and Error Handling,V16.1,Security Logging Documentation,V16.1.1,فهرستی باید وجود داشته باشد که در آن ثبت وقایع (Logging) انجام‌شده در هر لایه از stack فناوری برنامه، رویدادهای ثبت‌شده، فرمت‌های لاگ، محل ذخیره‌سازی، نحوه استفاده، نحوه کنترل دسترسی به آن‌ها و مدت زمان نگهداری لاگ‌ها مستند شده است.,,✓,✓,, +V16,Security Logging and Error Handling,V16.2,General Logging,V16.2.1,هر ورودی لاگ باید شامل متادیتای لازم (مانند زمان، مکان، چه کسی و چه چیزی) باشد تا امکان بررسی دقیق خط زمانی هنگام وقوع یک رویداد فراهم شود.,,✓,✓,, +V16,Security Logging and Error Handling,V16.2,General Logging,V16.2.2,منابع زمانی برای تمام مؤلفه‌های لاگ با هم همگام‌سازی شده‌اند و مهر زمان (timestamp)‌ در متادیتای رویدادهای امنیتی از UTC استفاده ‌کند یا شامل یک اختلاف‌زمان (time zone offset) صریح باشد. استفاده از UTC توصیه می‌شود تا یکپارچگی در سراسر سیستم‌های توزیع‌شده تضمین شود و از بروز سردرگمی در زمان تغییر ساعت تابستانی جلوگیری گردد.,,✓,✓,, +V16,Security Logging and Error Handling,V16.2,General Logging,V16.2.3,برنامه تنها لاگ‌ها را در فایل‌ها و سرویس‌هایی ذخیره یا ارسال می‌کند که در فهرست مستند لاگ‌ها ثبت شده‌اند.,,✓,✓,, +V16,Security Logging and Error Handling,V16.2,General Logging,V16.2.4,لاگ‌ها باید توسط پردازشگر لاگی که در حال استفاده است خوانده و همبسته شوند، و ترجیحاً با استفاده از یک فرمت لاگ مشترک این کار انجام گیرد.,,✓,✓,, +V16,Security Logging and Error Handling,V16.2,General Logging,V16.2.5,هنگام لاگ‌گیری از داده‌های حساس، برنامه باید لاگ گیری را بر اساس سطح حفاظت داده اعمال کند. برای مثال، ممکن است لاگ‌کردن برخی داده‌ها مانند اطلاعات ورود یا جزئیات پرداخت مجاز نباشد. داده‌های دیگر، مانند session token، تنها در صورتی باید لاگ شوند که به‌صورت hash یا masked، چه به‌طور کامل یا جزئی، ثبت شوند.,,✓,✓,, +V16,Security Logging and Error Handling,V16.3,Security Events,V16.3.1,تمام عملیات احراز هویت باید لاگ‌گیری ‌شوند، از جمله تلاش‌های موفق و ناموفق. همچنین باید متادیتای اضافی، مانند نوع احراز هویت یا عوامل استفاده‌شده، جمع‌آوری شود.,,✓,✓,, +V16,Security Logging and Error Handling,V16.3,Security Events,V16.3.2,تلاش‌های ناموفق برای مجوزدهی (authorization) باید لاگ‌گیری ‌شوند. برای برنامه‌های L3، این باید شامل لاگ‌گیری تمام تصمیمات مجوزدهی باشد، از جمله ثبت زمانی که داده‌های حساس دسترسی پیدا می‌کنند، بدون آنکه خود داده‌های حساس ثبت شوند.,,✓,✓,, +V16,Security Logging and Error Handling,V16.3,Security Events,V16.3.3,برنامه باید رویدادهای امنیتی تعریف‌شده در مستندات (ابتدای بخش) را لاگ‌ نماید و همچنین تلاش‌ها برای دور زدن کنترل‌های امنیتی، مانند اعتبارسنجی ورودی، منطق کسب‌وکار و ضد‌خودکارسازی، را نیز ثبت ‌کند.,,✓,✓,, +V16,Security Logging and Error Handling,V16.3,Security Events,V16.3.4,برنامه باید خطاهای غیرمنتظره و شکست‌های کنترل‌های امنیتی، مانند شکست‌های TLS در بک اند را لاگ ‌کند.,,✓,✓,, +V16,Security Logging and Error Handling,V16.4,Log Protection,V16.4.1,تمام مؤلفه‌های لاگ‌گیری باید داده‌ها را به‌طور مناسب رمزگذاری ‌کنند تا از حملات log injection جلوگیری شود.,,✓,✓,, +V16,Security Logging and Error Handling,V16.4,Log Protection,V16.4.2,لاگ‌ها باید در برابر دسترسی غیرمجاز محافظت شده و امکان تغییر آن‌ها وجود نداشته باشد.,,✓,✓,, +V16,Security Logging and Error Handling,V16.4,Log Protection,V16.4.3,لاگ‌ها به‌صورت امن باید به یک سیستم منطقی جداگانه برای تحلیل، تشخیص، هشدار و ارجاع منتقل شوند. هدف این است که در صورت نفوذ به برنامه، لاگ‌ها به خطر نیفتند.,,✓,✓,, +V16,Security Logging and Error Handling,V16.5,Error Handling,V16.5.1,هنگام بروز خطاهای غیرمنتظره یا حساس به امنیت، پیامی عمومی به کاربر باید بازگردانده ‌شود، به‌گونه‌ای که هیچ‌گونه اطلاعات حساس داخلی سیستم مانند stack trace، کوئری‌ها، کلیدها و توکن‌های محرمانه افشا نشود.,,✓,✓,, +V16,Security Logging and Error Handling,V16.5,Error Handling,V16.5.2,برنامه باید هنگام بروز خطا در دسترسی به منابع خارجی همچنان به‌صورت امن عمل نماید، برای مثال با استفاده از الگوهایی مانند circuit breaker یا کاهش تدریجی عملکرد (graceful degradation).,,✓,✓,, +V16,Security Logging and Error Handling,V16.5,Error Handling,V16.5.3,برنامه باید به‌صورت امن و کنترل‌شده دچار خطا ‌شود، حتی هنگام وقوع استثنا، و از شرایط fail-open جلوگیری نماید؛ برای مثال، از پردازش تراکنش در صورت بروز خطا در منطق اعتبارسنجی جلوگیری شود.,,✓,✓,, +V16,Security Logging and Error Handling,V16.5,Error Handling,V16.5.4,یک « last resort» باید تعریف شده باشد که تمامی unhandled exception را مدیریت کند. این کار هم برای جلوگیری از از دست رفتن جزئیات خطا که باید در فایل‌های لاگ ثبت شوند و هم برای اطمینان از این است که خطا باعث از کار افتادن کل فرآیند برنامه و در نتیجه از دست رفتن دسترسی نشود، ضروری است.,,,✓,, +V17,WebRTC,V17.1,TURN Server,V17.1.1,سرویس Traversal Using Relays around NAT (TURN) باید تنها به آدرس‌های IP دسترسی دهد که برای اهداف ویژه رزرو نشده‌اند (مثلاً شبکه‌های داخلی، broadcast، loopback). توجه داشته باشید که این مورد هم برای آدرس‌های IPv4 و هم برای IPv6 صدق می‌کند.,,✓,✓,, +V17,WebRTC,V17.1,TURN Server,V17.1.2,سرویس Traversal Using Relays around NAT (TURN)، نباید به resource exhaustion آسیب‌پذیر باشد، حتی زمانی که کاربران قانونی تلاش کنند تعداد زیادی پورت روی سرور TURN باز کنند.,,,✓,, +V17,WebRTC,V17.2,Media,V17.2.1,کلید مربوط به گواهی Datagram Transport Layer Security (DTLS) بر اساس سیاست مستند مدیریت کلیدهای رمزنگاری مدیریت و محافظت می‌شود.,,✓,✓,, +V17,WebRTC,V17.2,Media,V17.2.2,سرور Media طوری پیکربندی شده باشد که از مجموعه‌های رمزنگاری تاییدشده Datagram Transport Layer Security (DTLS) استفاده کند و از یک پروفایل محافظتی امن برای گسترش DTLS به منظور ایجاد کلیدها برای پروتکل Secure Real-time Transport Protocol (DTLS-SRTP) پشتیبانی نماید.,,✓,✓,, +V17,WebRTC,V17.2,Media,V17.2.3,احراز هویت Secure Real-time Transport Protocol (SRTP) در سرور Media بررسی ‌شود تا از حملات تزریق Real-time Transport Protocol (RTP) جلوگیری شده و این حملات باعث بروز شرایط Denial of Service یا وارد شدن محتوای صوتی یا تصویری ناخواسته به جریان‌های رسانه‌ای نشوند.,,✓,✓,, +V17,WebRTC,V17.2,Media,V17.2.4,سرور Media باید قادر باشد پردازش ترافیک رسانه‌ای ورودی را حتی هنگام مواجهه با بسته‌های Secure Real-time Transport Protocol (SRTP) ناقص یا خراب ادامه دهد.,,✓,✓,, +V17,WebRTC,V17.2,Media,V17.2.5,سرور Media باید قادر باشد پردازش ترافیک رسانه‌ای ورودی را حتی در هنگام دریافت سیلی(flood) از بسته‌های Secure Real-time Transport Protocol (SRTP) از کاربران قانونی ادامه دهد.,,,✓,, +V17,WebRTC,V17.2,Media,V17.2.6,"سرور Media نسبت به آسیب‌پذیری ""ClientHello Race Condition "" در Datagram Transport Layer Security (DTLS) نباید آسیب‌پذیر نباشد، این کار می‌تواند با بررسی اینکه آیا سرور رسانه به‌صورت عمومی به عنوان آسیب‌پذیر شناخته شده است یا با انجام آزمون Race Condition انجام شود.",,,✓,, +V17,WebRTC,V17.2,Media,V17.2.7,مکانیزم‌های ضبط صدا یا تصویر مرتبط با سرور رسانه در هنگام طوفان بسته‌ای (Flood) از پروتکل انتقال بلادرنگ امن (SRTP) توسط کاربران مجاز، باید قادر به ادامه پردازش ترافیک رسانه ورودی است.,,,✓,, +V17,WebRTC,V17.2,Media,V17.2.8,گواهی‌نامه امنیت لایه انتقال دیتاگرام (DTLS) باید با ویژگی اثر انگشت (Fingerprint) پروتکل توصیف نشست (SDP) بررسی می‌شود و در صورت شکست در بررسی، جریان رسانه قطع می‌شود تا اصالت جریان رسانه تضمین گردد.,,,✓,, +V17,WebRTC,V17.3,Signaling,V17.3.1,سرور سیگنالینگ باید قادر باشد حتی در جریان flood attack، پیام‌های سیگنالینگ ورودی مشروع را پردازش کند. این باید با اعمال محدودیت نرخ (rate limiting) در سطح سیگنالینگ محقق شود.,,✓,✓,, +V17,WebRTC,V17.3,Signaling,V17.3.2,سرور سیگنالینگ باید قادر باشد پیام‌های سیگنالینگ مشروع را حتی در مواجهه با پیام‌های سیگنالینگ ناقص یا مخرب که می‌توانند باعث ایجاد شرایط عدم دسترسی (Denial of Service) شوند، پردازش کند. این می‌تواند شامل اعمال اعتبارسنجی ورودی، مدیریت ایمن سرریز عدد صحیح (integer overflow)، جلوگیری از سرریز بافر (buffer overflow) و استفاده از دیگر تکنیک‌های مقاوم مدیریت خطا باشد.,,✓,✓,, + diff --git a/5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.legacy.json b/5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.legacy.json new file mode 100644 index 0000000000..f7992bfe49 --- /dev/null +++ b/5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.legacy.json @@ -0,0 +1,7259 @@ +{ + "Name": "Application Security Verification Standard Project", + "ShortName": "ASVS", + "Version": "5.0.0", + "Description": "The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.", + "Requirements": [ + { + "Shortcode": "V1", + "Ordinal": 1, + "ShortName": "Encoding", + "Name": "Encoding and Sanitization", + "Items": [ + { + "Shortcode": "V1.1", + "Ordinal": 1, + "Name": "ساختار Encoding and Sanitization", + "Items": [ + { + "Shortcode": "V1.1.1", + "Ordinal": 1, + "Description": "ورودی فقط یک‌بار به فرم استاندارد decoded یا unescaped شود، و این تنها زمانی انجام شود که انتظار می‌رود داده واقعاً در آن قالب رمزگذاری‌شده دریافت شده باشد. این فرآیند باید قبل از هرگونه پردازش بعدی روی ورودی انجام شود، و به‌هیچ‌وجه نباید پس از اعتبارسنجی یا پاک‌سازی انجام گیرد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.1.2", + "Ordinal": 2, + "Description": "برنامه فرآیند encode و escape خروجی را به‌عنوان آخرین مرحله انجام می‌دهد؛ به‌گونه‌ای که این عملیات یا دقیقاً پیش از استفاده داده در مفسر مربوطه انجام شود، یا اینکه خود مفسر به‌طور داخلی این کار را انجام دهد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V1.2", + "Ordinal": 2, + "Name": "پیشگیری از تزریق", + "Items": [ + { + "Shortcode": "V1.2.1", + "Ordinal": 1, + "Description": "encoding خروجی برای پاسخ HTTP، سند HTML یا سند XML با زمینه‌ای که داده در آن استفاده می‌شود باید متناسب باشد؛ برای مثال، در رمزگذاری کاراکترهای مربوط به عناصر HTML، صفات HTML، توضیحات HTML، CSS یا فیلدهای هدر HTTP به‌گونه‌ای عمل شود که ساختار پیام یا سند تغییر نکند.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.2", + "Ordinal": 2, + "Description": "هنگام ساخت پویا آدرس‌های URL، داده‌های غیرقابل‌اعتماد باید متناسب با زمینه استفاده‌شان رمزگذاری شوند (مثلاً URL Encoding یا base64url برای پارامترهای کوئری یا مسیر) همچنین اطمینان حاصل شود که فقط پروتکل‌های امن در URL مجاز باشند (برای نمونه، استفاده از JavaScript: یا data: ممنوع شود)", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.3", + "Ordinal": 3, + "Description": "هنگام تولید پویا محتوای JavaScript (از جملهJSON)، از encoding یا escaping خروجی استفاده شود تا از تغییر ساختار پیام یا سند جلوگیری گردد (و از حملات تزریق JavaScript یا JSON پیشگیری شود).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.4", + "Ordinal": 4, + "Description": "در انتخاب داده یا اجرای کوئری‌های پایگاه داده (مانند SQL، HQL، NoSQL ...)، از parameterized queries، ORMها، یا Entity Framework استفاده شود یا به روش‌های دیگر، برنامه در برابر تزریق SQL و سایر حملات تزریقی پایگاه داده ایمن شده باشد. این موضوع هنگام نوشتن stored procedure‌ها نیز صدق می‌کند.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.5", + "Ordinal": 5, + "Description": "برنامه در برابر تزریق دستورات سیستم‌عامل (OS command injection) محافظت شده است و در فراخوانی‌های سیستم‌عامل، از کوئری‌های پارامتری‌شده سیستم‌عامل یا Encoding خروجی دستورات سیستم‌عاملی استفاده می‌شود.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.6", + "Ordinal": 6, + "Description": "برنامه در برابر آسیب‌پذیری‌های تزریق LDAP محافظت شده است، یا اینکه کنترل‌های امنیتی مشخصی برای جلوگیری از تزریق LDAP پیاده‌سازی شده‌اند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.7", + "Ordinal": 7, + "Description": "برنامه در برابر حملات تزریقXPath، به‌وسیله‌ی استفاده از کوئری‌های پارامتری‌شده یا کوئری‌های از پیش‌کامپایل‌شده محافظت شده باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.8", + "Ordinal": 8, + "Description": "پردازشگرهای LaTeX به‌صورت امن پیکربندی شده‌اند (برای نمونه با عدم استفاده از گزینه‌ی --shell-escape ) و از فهرست مجاز دستورات (allowlist) برای جلوگیری از حملات تزریق LaTeX استفاده شده است.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.9", + "Ordinal": 9, + "Description": "برنامه کاراکترهای ویژه در عبارات Regex را escape می‌کند (معمولاً با استفاده از \\)، تا این کاراکترها به‌اشتباه به‌عنوان متاکاراکتر تفسیر نشوند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.10", + "Ordinal": 10, + "Description": "برنامه در برابر حملات تزریق CSV و فرمول (Formula Injection) محافظت شده است. برنامه باید هنگام خروجی‌ گرفتن فایل‌های CSV، از قوانین escape تعیین‌شده در بخش‌های ۲.۶ و ۲.۷ استاندارد RFC 4180 پیروی کند. همچنین، هنگام خروجی گرفتن به فرمت CSV یا سایر فرمت‌های صفحه‌گسترده (مانند XLS، XLSX یا ODF)، اگر کاراکترهای ویژه‌ای مانند '='، '+'، '-'، '@'، \\t (tab) و 0\\ (Null character) در ابتدای مقدار یک فیلد قرار داشته باشند، باید با یک تک‌کوتیشن (') escape شوند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V1.3", + "Ordinal": 3, + "Name": "پاک‌سازی (Sanitization)", + "Items": [ + { + "Shortcode": "V1.3.1", + "Ordinal": 1, + "Description": "تمام ورودی‌های HTML غیرقابل اعتماد (مثلاً از طریق ویرایشگرهای WYSIWYG یا ابزارهای مشابه)، با استفاده از یک کتابخانه یا قابلیت امن و معتبر sanitization (پاک‌سازی) ‌شوند.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.2", + "Ordinal": 2, + "Description": "برنامه استفاده از تابعeval یا سایر قابلیت‌های اجرای پویا (dynamic) کد، مانند Spring Expression Language (SpEL)، اجتناب ‌کند. در مواردی که استفاده از این قابلیت‌ها اجتناب‌ناپذیر است، ورودی‌های کاربر که در اجرای کد گنجانده می‌شوند باید پیش از اجرا، به‌طور کامل پاک‌سازی (sanitized) شوند.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.3", + "Ordinal": 3, + "Description": "بخش‌های حائز اهمیت که احتمال وقوع حملات ناشی از ورودی‌های کاربر در آنها بالاست؛ باید پیشاپیش عملیاتSanitization جهت اقدامات ایمنی روی داده‌ها انجام شود؛ برای مثال، تنها کاراکترهایی که برای آن محتوا ایمن محسوب می‌شوند مجاز باشند، و ورودی‌های بیش‌از‌حد بلند نیز کوتاه (trim) شوند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.4", + "Ordinal": 4, + "Description": "محتوای اسکریپت‌پذیر (scriptable) فایل‌های SVG که توسط کاربر ارائه می‌شود، مورد اعتبارسنجی یا پاک‌سازی (sanitization) قرار گرفته باشد تا فقط شامل تگ‌ها و ویژگی‌هایی (attributes) باشد که برای برنامه ایمن هستند؛ برای مثال، از درج اسکریپت‌ها و عناصر خطرناک مانند foreignObject جلوگیری شده باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.5", + "Ordinal": 5, + "Description": "برنامه محتوای زبان‌های قالب‌نویسی یا اسکریپت‌پذیر ارائه‌شده توسط کاربر، مانند Markdown، CSS یا استایل‌شیت‌های XSL، BBCode یا موارد مشابه را پاک‌سازی (sanitize) کرده یا غیرفعال کرده باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.6", + "Ordinal": 6, + "Description": "برنامه در برابر حملات جعل درخواست سمت سرور (SSRF) محافظت شده باشد؛ به این صورت که داده‌های غیرقابل اعتماد را در برابر یک لیست مجاز از پروتکل‌ها، دامنه‌ها، مسیرها و پورت‌ها اعتبارسنجی کرده و کاراکترهای بالقوه خطرناک را پیش از استفاده از داده برای فراخوانی سرویس دیگر پاک‌سازی (sanitize) می‌کند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.7", + "Ordinal": 7, + "Description": "برنامه در برابر حملات تزریق قالب (Template Injection) محافظت شده باشد؛ به این صورت که ساخت قالب‌ها بر پایه داده‌های غیرقابل اعتماد مجاز نباشد. در صورتی که هیچ راه‌حل جایگزینی وجود نداشته باشد، هرگونه ورودی غیرقابل اعتماد که به‌صورت پویا در فرآیند ایجاد قالب وارد می‌شود، باید پیش از استفاده یا پاک‌سازی (sanitize) شود یا به‌صورت سخت‌گیرانه اعتبارسنجی (validate) گردد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.8", + "Ordinal": 8, + "Description": "برنامه، ورودی غیرقابل اعتماد را پیش از استفاده در کوئری‌های Java Naming and Directory Interface (JNDI) به‌درستی پاک‌سازی (sanitize) می‌کند و همچنین اطمینان حاصل شود که پیکربندی JNDI به‌گونه‌ای امن انجام شده تا از بروز حملات تزریق JNDI جلوگیری شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.9", + "Ordinal": 9, + "Description": "برنامه، محتوا را پیش از ارسال به memcache پاک‌سازی (sanitize) می‌کند تا از حملات تزریق (injection attacks) جلوگیری شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.10", + "Ordinal": 10, + "Description": "رشته‌های قالب‌بندی (format strings) که ممکن است هنگام استفاده، به‌شکلی ناخواسته یا مخرب تفسیر شوند، پیش از پردازش پاک‌سازی (sanitize) شوند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.11", + "Ordinal": 11, + "Description": "برنامه ورودی‌های کاربر را پیش از ارسال به سامانه‌های ایمیل (مانند SMTP یا IMAP) پاک‌سازی (sanitize) ‌کند تا از حملات تزریق در SMTP یا IMAP جلوگیری شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.12", + "Ordinal": 12, + "Description": "عبارات منظم (Regular Expressions) عاری از اجزایی هستند که باعث بازگشت‌پذیری نمایی (exponential backtracking) می‌شوند، و همچنین ورودی‌های غیرقابل اعتماد به‌درستی پاک‌سازی (sanitize) شوند تا از حملات ReDoS (انکار سرویس با استفاده از عبارات منظم) یا Runaway Regex جلوگیری گردد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V1.4", + "Ordinal": 4, + "Name": "حافظه، رشته و کد بدون مدیریت (Memory, String, and Unmanaged Code)", + "Items": [ + { + "Shortcode": "V1.4.1", + "Ordinal": 1, + "Description": "برنامه از رشته‌های ایمن از نظر مدیریت حافظه، کپی حافظه‌ای ایمن‌تر و حساب‌گری ایمن‌تر روی اشاره‌گرها استفاده می‌کند تا از سرریز پشته (stack overflow)، سرریز بافر (buffer overflow) یا سرریز حافظه پویای (heap overflow) جلوگیری کرده یا آن‌ها را شناسایی کند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.4.2", + "Ordinal": 2, + "Description": "از تکنیک‌های اعتبارسنجی علامت (sign validation)، محدوده (range validation) و ورودی (input validation) استفاده شده است تا از بروز سرریز عدد صحیح (integer overflow) جلوگیری شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.4.3", + "Ordinal": 3, + "Description": "حافظه و منابعی که به‌صورت پویا تخصیص داده شده‌اند، به‌درستی آزاد (release) می‌شوند و همچنین ارجاع‌ها یا اشاره‌گرها (pointers) به حافظه آزادشده حذف یا به null تنظیم می‌شوند تا از اشاره‌گرهای معلق (dangling pointers) و آسیب‌پذیری‌های استفاده پس از آزادسازی (use-after-free) جلوگیری شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V1.5", + "Ordinal": 5, + "Name": "سریال‌زدایی ایمن (Safe Deserialization)", + "Items": [ + { + "Shortcode": "V1.5.1", + "Ordinal": 1, + "Description": "برنامه، XML Parserها را به‌گونه‌ای پیکربندی کرده باشد که از تنظیمات محدودکننده استفاده کنند، و ویژگی‌های ناایمنی مانند resolve کردن موجودیت‌های خارجی (external entities) غیرفعال شده باشند تا از حملات XML External Entity (XXE) جلوگیری شود.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.5.2", + "Ordinal": 2, + "Description": "فرآیند deserialization داده‌های غیرقابل‌اعتماد، با اجرای مدیریت ایمن ورودی‌ها همراه باشد؛ برای مثال، استفاده از لیست مجاز (allowlist) انواع objectها یا محدود کردن انواع تعریف‌شده توسط کلاینت برای جلوگیری از حملات مرتبط با deserialization. همچنین، مکانیزم‌های deserialization که به‌طور صریح به‌عنوان ناایمن شناخته شده‌اند، نباید با داده‌های غیرقابل‌اعتماد مورد استفاده قرار گیرند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.5.3", + "Ordinal": 3, + "Description": "Parser های مختلفی که در برنامه برای یک نوع داده مشخص استفاده می‌شوند (برای مثال: Parser های JSON، XML یا URL)، رفتار تحلیلی یکسانی دارند و از مکانیزم یکسانی برای encoding کاراکترها استفاده می‌کنند، تا از بروز مشکلاتی مانند آسیب‌پذیری در سازگاری JSON (JSON Interoperability) یا تفاوت در نحوه تحلیل URI یا مسیر فایل که ممکن است در حملات RFI یا SSRF سوءاستفاده شود، جلوگیری شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V2", + "Ordinal": 2, + "ShortName": "Validation", + "Name": "Validation and Business Logic", + "Items": [ + { + "Shortcode": "V2.1", + "Ordinal": 1, + "Name": "مستندات اعتبارسنجی و منطق کسب‌وکار ( Validation and Business Logic Documentation)", + "Items": [ + { + "Shortcode": "V2.1.1", + "Ordinal": 1, + "Description": "قوانین اعتبارسنجی ورودی‌های برنامه (مندرج در مستندات برنامه) ‌باید چگونگی بررسی صحت داده‌ها را مطابق با ساختار مورد انتظار مشخص نماید. این ساختار می‌تواند شامل فرمت‌های رایج داده مانند شماره کارت اعتباری، آدرس ایمیل، شماره تلفن یا یک قالب داده‌ای داخلی باشد.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.1.2", + "Ordinal": 2, + "Description": "قوانین اعتبارسنجی ورودی‌های برنامه (مندرج در مستندات برنامه) باید چگونگی بررسی سازگاری مناسب بین داده‌‌های ترکیب شده (از نظر مفهومی و متنی) را مشخص نماید؛ مانند تطبیق کدپستی با نام محله.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.1.3", + "Ordinal": 3, + "Description": "انتظارات مربوط به محدودیت‌ها و اعتبارسنجی‌های منطق کسب و کار مستند شده باشند؛ این مستندات باید شامل محدودیت‌ها در سطح هر کاربر و محدودیت‌های عمومی در سطح برنامه باشند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V2.2", + "Ordinal": 2, + "Name": "اعتبارسنجی ورودی (Input Validation)", + "Items": [ + { + "Shortcode": "V2.2.1", + "Ordinal": 1, + "Description": "ورودی‌ها باید به‌منظور اعمال انتظارات کسب و کار یا عملکردی مرتبط با آن‌ها اعتبارسنجی ‌شوند.این اعتبارسنجی باید یکی از این دو روش زیر را داشته باشد، استفاده از اعتبارسنجی مثبت (Positive Validation) مبتنی بر فهرست مجاز از مقادیر، الگوها یا بازه‌های قابل قبول و تطبیق با ساختار مورد انتظار و محدودیت‌های منطقی، بر اساس قوانین از پیش تعریف‌شده. برای سطح 1 (L1)، تمرکز می‌تواند بر ورودی‌هایی باشد که در تصمیم‌گیری‌های خاص تجاری یا امنیتی استفاده می‌شوند. برای سطح 2 و بالاتر، این اعتبارسنجی باید شامل تمام ورودی‌ها باشد.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.2.2", + "Ordinal": 2, + "Description": "برنامه به‌گونه‌ای طراحی شود که اعتبارسنجی ورودی را در لایه‌ قابل اعتمادی از سرویس (Trusted Service Layer) اعمال کند. هرچند اعتبارسنجی سمت کلاینت (Client-side Validation) باعث بهبود تجربه کاربری می‌شود و توصیه می‌گردد، اما نباید به‌عنوان یک کنترل امنیتی اتکا شود.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.2.3", + "Ordinal": 3, + "Description": "برنامه باید اطمینان حاصل نماید که ترکیب داده‌های مربوطه با توجه به قوانین از پیش تعریف‌شده معقول و منطقی باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V2.3", + "Ordinal": 3, + "Name": "امنیت منطق کسب‌وکار (Business Logic Security)", + "Items": [ + { + "Shortcode": "V2.3.1", + "Ordinal": 1, + "Description": "اطمینان حاصل شود که برنامه فقط جریان‌های منطق تجاری را برای همان کاربر و طبق ترتیب گام‌به‌گام از پیش تعیین شده و مورد انتظار پردازش می‌کند و امکان رد کردن مراحل (Skipping Steps) وجود ندارد.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.3.2", + "Ordinal": 2, + "Description": "اطمینان حاصل شود که محدودیت‌های منطق تجاری مطابق با مستندات برنامه پیاده‌سازی شده‌اند، تا از سوء‌استفاده از نقص‌های منطقی جلوگیری شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.3.3", + "Ordinal": 3, + "Description": "تراکنش‌های سطح منطق کسب‌وکار (business logic) باید به‌گونه‌ای استفاده شوند که یا یک عملیات منطق کسب‌وکار به‌طور کامل با موفقیت انجام شود، یا در صورت بروز خطا، به حالت صحیح قبلی بازگردد(rollback) شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.3.4", + "Ordinal": 4, + "Description": "در منطق کسب‌وکار (business logic)باید از مکانیزم‌های قفل‌گذاری (locking) استفاده شده باشد تا اطمینان حاصل شود که منابع محدود (مانند صندلی‌های سینما یا بازه‌های زمانی تحویل)، قابل رزرو دوباره (double-booked) از طریق دستکاری منطق برنامه نباشند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.3.5", + "Ordinal": 5, + "Description": "اطمینان حاصل شود که جریان‌های منطق کسب و کاری با ارزش بالا نیازمند تایید چند کاربره (Multi-user Approval) هستند تا از اقدامات غیرمجاز یا تصادفی جلوگیری شود. این موارد می‌تواند شامل – اما نه محدود به – انتقال‌های مالی بزرگ، تایید قرارداد‌ها، دسترسی به اطلاعات طبقه‌بنده شده، یا غیرفعال‌سازی‌های ایمنی در محیط‌های تولید صنعتی باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V2.4", + "Ordinal": 4, + "Name": "مقابله با خودکارسازی (Anti-automation)", + "Items": [ + { + "Shortcode": "V2.4.1", + "Ordinal": 1, + "Description": "کنترل‌های ضد خودکارسازی (Anti-Automation) در سیستم پیاده‌سازی شده باشند تا از سوءاستفاده‌هایی مانند فراخوانی بیش از حد توابع برنامه جلوگیری شود؛ چرا که این نوع حملات می‌توانند منجر به استخراج غیرمجاز داده‌ها، تولید داده‌های زائد، مصرف کامل سهمیه‌ها، عبور از محدودیت‌های نرخ (Rate Limit)، ایجاد اختلال در سرویس (DoS) یا استفاده بیش از حد از منابع گران‌قیمت شوند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.4.2", + "Ordinal": 2, + "Description": "بررسی کنید که جریان‌های منطق کسب‌وکار (Business Logic Flows) به گونه‌ای طراحی شده باشند که نیازمند زمان‌بندی واقعی انسان باشند، و از ارسال سریع و غیرطبیعی تراکنش‌ها (Transaction Submissions) جلوگیری کنند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V3", + "Ordinal": 3, + "ShortName": "Web", + "Name": "امنیت رابط کاربری وب (Web Frontend Security)", + "Items": [ + { + "Shortcode": "V3.1", + "Ordinal": 1, + "Name": "مستندسازی امنیت رابط کاربری وب ( Web Frontend Security Documentation)", + "Items": [ + { + "Shortcode": "V3.1.1", + "Ordinal": 1, + "Description": "در مستندات برنامه باید ویژگی‌های امنیتی مربوط به مرورگری که برنامه را اجرا میکند مشخص شده باشد (نظیر استفاده از HTTPS، پشتیبانی از HTTP Strict Transport Security (HSTS)، اجرای Content Security Policy (CSP) و سایر مکانیزم‌های امنیتی مرتبط با HTTP). همچنین در مستندات باید مشخص شود مرورگر در صورت عدم دسترسی به این ویژگی‌ها چه رفتاری باید داشته باشد. (برای مثال: نمایش هشدار به کاربر یا ممانعت از دسترسی به برنامه).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.2", + "Ordinal": 2, + "Name": "تفسیر ناخواسته محتوا (Unintended Content Interpretation)", + "Items": [ + { + "Shortcode": "V3.2.1", + "Ordinal": 1, + "Description": "کنترل‌های امنیتی متناسب با مرورگر‌ها در هنگام پردازش پاسخ‌های HTTP به منظور جلوگیری از پردازش محتوا یا عملکرد مربوط به آن در شرایط زمینه‌‌ای نادرست باید بکار‌گرفته شود. (برای مثال، زمانی که یک APIیا یک فایل بارگذاری‌شده توسط کاربر یا هر منبع دیگری به‌طور مستقیم درخواست می‌شود).کنترل‌های ممکن می‌توانند شامل این موارد باشند: عدم پردازش محتوا مگر در صورت وجود هدرهای متناسب با درخواست‌های HTTP (مانند ‎Sec-Fetch-*) به منظور اطمیان از صحیح بودن پردازش محتوا یا عملکرد مربوط به . استفاده از عبارت sandbox در هدر Content-Security-Policy یا استفاده از نوعattachment در هدر Content-Disposition .", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.2.2", + "Ordinal": 2, + "Description": "اطمینان حاصل شود که محتوایی که برای نمایش به‌صورت متن طراحی شده نه برای پردازش به صورتHTML ، با استفاده از توابع امن نظیر CreateTextNode یا textContent به منظور جلوگیری از اجرای ناخواسته محتوایی مانند HTML یا JavaScript پردازش ‌شود.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.2.3", + "Ordinal": 3, + "Description": "برنامه هنگام استفاده از جاوااسکریپت سمت کاربر (Client-Side JavaScript)، با استفاده از اعلام متغیرها به‌صورت صریح، انجام بررسی نوع به‌صورت سخت‌گیرانه، اجتناب از ذخیره‌سازی متغیرهای سراسری بر روی شیء document، و پیاده‌سازی ایزولاسیون فضای نام (namespace isolation)، از وقوع DOM Clobbering جلوگیری می‌کند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.3", + "Ordinal": 3, + "Name": "پیکربندی کوکی (Cookie Setup)", + "Items": [ + { + "Shortcode": "V3.3.1", + "Ordinal": 1, + "Description": "اطمینان حاصل شود که کوکی‌ها دارای ویژگی ‘Secure’ هستند. در صورتی که از پیشوند ‘__Host-’ برای نام کوکی استفاده نمی‌شود، باید پیشوند__Secure- در نام کوکی لحاظ شده باشد.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.3.2", + "Ordinal": 2, + "Description": "اطمینان حاصل شود که مقدار ویژگی SameSite برای هر کوکی، متناسب با هدف آن کوکی تنظیم شده باشد تا میزان آسیب‌پذیری در برابر حملات فریب سمت کلاینت نظیر CSRF کاهش یابد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.3.3", + "Ordinal": 3, + "Description": "اطمینان حاصل شود که کوکی‌ها از پیشوند __Host- در نام خود استفاده می‌کنند، مگر در مواردی که کوکی به‌طور مشخص برای اشتراک‌گذاری بین چند دامنه (Hosts) طراحی شده باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.3.4", + "Ordinal": 4, + "Description": "اطمینان حاصل شود که اگر مقدار کوکی (مثلاً توکن نشست) نباید برای اسکریپت‌های سمت کلاینت در دسترس باشد، ویژگی HttpOnly باید برای آن کوکی فعال شده باشد، و همچنین مقدار کوکی (مثلاً همان توکن نشست) تنها از طریق هدر Set-Cookie به کلاینت ارسال شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.3.5", + "Ordinal": 5, + "Description": "اطمینان حاصل شود که حداکثر مجموع نام و مقدار کوکی از ۴۰۹۶ بایت تجاوز نکند.کوکی‌هایی که بیش از این مقدار باشند توسط مرورگر ذخیره نخواهند شد، و بنابراین در درخواست‌ها ارسال نمی‌شوند؛ موضوعی که ممکن است باعث شود عملکردهایی از برنامه که به آن کوکی وابسته‌اند، غیرفعال یا مختل شوند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.4", + "Ordinal": 4, + "Name": "هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers)", + "Items": [ + { + "Shortcode": "V3.4.1", + "Ordinal": 1, + "Description": "اطمینان حاصل شود که در تمامی پاسخ‌های HTTP، هدر Strict-Transport-Security وجود دارد تا سیاست HSTS (HTTP Strict Transport Security) اعمال شود. حداقل مقدار max-age باید برابر با یک سال باشد. برای برنامه‌های سطح 2 (L2) و بالاتر، این سیاست باید برای تمام زیردامنه‌ها (subdomains) نیز اعمال شود.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.2", + "Ordinal": 2, + "Description": "اطمینان حاصل شود که هدرAccess-Control-Allow-Origin مربوط به (CORS)، دارای یک مقدار ثابت و مشخص توسط برنامه باشد یا اگر هدر Origin در درخواست مورد استفاده قرار می گیرد باید با فهرستی از مبدأهای مورد اعتماد (Allowlist) اعتبارسنجی شود. در صورتی که استفاده از مقدار * در Access-Control-Allow-Origin تنظیم شده باشد، اطمینان حاصل شود که هیچ اطلاعات حساسی در پاسخ قرار ندارد.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.3", + "Ordinal": 3, + "Description": "اطمینان حاصل شود که تمامی پاسخ‌های HTTP شامل هدر Content-Security-Policy باشند تا ریسک اجرای اسکریپت‌های مخرب (مانند (JavaScript مخرب کاهش یابد. دستورهای object-src 'none' و base-uri 'none' الزامی هستند .برای برنامه‌های سطح 3 (L3)، باید سیاست CSP به‌صورت اختصاصی برای هر پاسخ(Per-response Policy) و مبتنی بر nonce یا hash تعریف شده باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.4", + "Ordinal": 4, + "Description": "اطمینان حاصل شود که تمامی پاسخ‌ها شامل هدر X-Content-Type-Options: nosniff باشند، این (هدر) به مرورگرها دستور می‌دهد که برای پاسخ دریافتی از Content Sniffing یا حدس‌زدن نوع محتوا (MIME Type Guessing) استفاده نکنند و آن‌ها را ملزم می‌کند که نوع محتوای واقعی را دقیقاً مطابق مقدار هدر Content-Type در درخواست/پاسخ در نظر بگیرند.برای مثال، پاسخ به یک درخواست برای یک فایل استایل (CSS) تنها در صورتی پذیرفته می‌شود که مقدار Content-Type در پاسخ 'text/css' باشد.این کار همچنین امکان استفاده از قابلیت مسدودسازی خواندن منابع از مبدا متفاوت Cross-Origin Read Blocking یا (CORB) توسط مرورگر را فراهم می‌سازد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.5", + "Ordinal": 5, + "Description": "برنامه باید (وب‌سایت یا اپلیکیشن) یک \"Referrer Policy\" (سیاست ارجاع) تنظیم کرده باشد تا از نشت اطلاعات حساس از طریق هدر HTTP به نام Referer به سرویس‌های شخص ثالث جلوگیری شود. این کار را می‌توان از طریق هدر پاسخ HTTP به نام Referrer-Policy یا با استفاده از ویژگی‌هایی در عناصر HTML انجام داد.اطلاعات حساس ممکن است شامل مسیر (Path) و داده‌های کوئری (Query) در آدرس URL باشد، و در مورد برنامه‌های داخلی و غیرعمومی، حتی نام میزبان (hostname) نیز می‌تواند جزو اطلاعات حساس محسوب شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.6", + "Ordinal": 6, + "Description": "برنامه باید از frame-ancestors در هدر Content-Security-Policy (CSP) برای تمام پاسخ‌های HTTP استفاده کند،تا به‌صورت پیش‌فرض، اجازه‌ی نمایش سایت در قالب iframe داده نشود، و فقط در صورت نیاز، نمایش منابع خاص (specific resources) در iframe مجاز باشد.به این نکته توجه کنید که هدر X-Frame-Options با اینکه هنوز توسط برخی مرورگرها پشتیبانی می‌شود، اما قدیمی (obsolete) است و نباید به آن تکیه کرد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.7", + "Ordinal": 7, + "Description": "هدر Content-Security-Policy (CSP) باید شامل یک آدرس برای گزارش (Report violation) باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.8", + "Ordinal": 8, + "Description": "تمام پاسخ‌های HTTP که باعث رندر (نمایش) یک سند می‌شوند مانند (پاسخ‌هایی با نوع محتوا (text/html باید شامل هدر Cross-Origin-Opener-Policy با دستور same-origin یا same-origin-allow-popups باشند (بنا به نیاز). این کار از حملاتی جلوگیری می‌کند که از دسترسی مشترک به اشیای Window سوءاستفاده می‌کنند، مانند حملات tabnabbing و frame counting.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.5", + "Ordinal": 5, + "Name": "تفکیک مبدا توسط مرورگر (Browser Origin Separation)", + "Items": [ + { + "Shortcode": "V3.5.1", + "Ordinal": 1, + "Description": "برنامه باید از مکانیزم Preflight در CORS برای جلوگیری از درخواست‌های cross-origin به عملکردهای حساس استفاده نمی‌کند، این درخواست‌ها به‌گونه‌ای اعتبارسنجی شوند که فقط از مبدأ اصلی برنامه ارسال شده باشند. این اعتبارسنجی می‌تواند با استفاده از توکن‌های (anti- forgery tokens) یا الزام به ارسال هدرهای HTTP اضافی انجام شود که در لیست هدرهای مجاز CORS (CORS-safelisted) قرار ندارند. این اقدام برای محافظت در برابر حملات جعل درخواست از طریق مرورگر، که با نام CSRF (Cross-Site Request Forgery) شناخته می‌شوند، ضروری است.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.2", + "Ordinal": 2, + "Description": "اگر برنامه برای جلوگیری از استفاده غیرمجاز cross-origin از عملکردهای حساس، به مکانیزم Preflight در CORS متکی است، باید امکان فراخوانی این عملکردها با درخواست‌هایی که باعث ایجاد Preflight نمی‌شوند، وجود نداشته باشد. برای تحقق این هدف ممکن است لازم باشد مقدار هدرهای Origin و Content-Type بررسی شوند یا از هدر اضافی استفاده شود که در لیست هدرهای مجاز CORS قرار ندارد.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.3", + "Ordinal": 3, + "Description": "برنامه باید درخواست‌های HTTP که به عملکردهای حساس از متدهای مناسب مانند POST، PUT، PATCH یا DELETE استفاده می‌کنند، و نه از متدهایی که در استاندارد HTTP به‌عنوان \"ایمن\" تعریف شده‌اند، مانند GET، HEAD یا .OPTIONS به عنوان جایگزین یا مکمل، می‌توان از بررسی سخت‌گیرانه هدرهای Sec-Fetch-* استفاده کرد تا اطمینان حاصل شود که درخواست از منبع نامناسبی مثل بارگذاری تصویر، ناوبری صفحه یا فراخوانی cross-origin ارسال نشده است.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.4", + "Ordinal": 4, + "Description": "برنامه‌های مجزا باید روی نام‌های دامنه (hostname) متفاوت میزبانی شده‌اند تا از محدودیت‌های ارائه‌شده توسط (Same-Origin Policy) بهره‌مند شوند. این شامل کنترل تعامل اسناد یا اسکریپت‌های بارگذاری‌شده از یک مبدأ با منابع مبدأ دیگر و اعمال محدودیت بر اساس دامنه برای کوکی‌ها می‌شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.5", + "Ordinal": 5, + "Description": "برنامه باید پیام‌های دریافت‌شده از طریق رابط postMessage در صورتی که مبدأ پیام مورد اعتماد نباشد یا ساختار پیام نامعتبر باشد، نادیده گرفته می‌شوند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.6", + "Ordinal": 6, + "Description": "هیچ‌کجای برنامه از قابلیت JSONP استفاده نشود تا از حملات Cross-Site Script Inclusion (XSSI) جلوگیری شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.7", + "Ordinal": 7, + "Description": "داده‌هایی که نیاز به احراز هویت دارند، در پاسخ‌های مربوط به منابع اسکریپتی(مانند فایل‌های (JavaScript نباید قرار بگیرند تا از حملات XSSI جلوگیری شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.8", + "Ordinal": 8, + "Description": "اطمینان حاصل کنید که منابع احراز هویت‌شده (مانند تصاویر، ویدیوها، اسکریپت‌ها و سایر اسناد) فقط در مواقعی که هدف آن است، قابل بارگذاری یا جاسازی توسط کاربر باشند. این کار را می‌توان با اعتبارسنجی دقیق هدرهای HTTP مانند Sec-Fetch-* انجام داد تا اطمینان حاصل شود که درخواست از یک منبع غیرمجاز ارسال نشده است، یا با تنظیم هدر Cross-Origin-Resource-Policy برای محدود کردن دسترسی مرورگر به محتوا.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.6", + "Ordinal": 6, + "Name": "یکپارچگی منابع خارجی (External Resource Integrity)", + "Items": [ + { + "Shortcode": "V3.6.1", + "Ordinal": 1, + "Description": "منابع سمت کلاینت مانند کتابخانه‌های جاوااسکریپت، فایل‌های CSS، یا فونت‌های وب، تنها در صورتی به‌صورت خارجی (مثلاً از طریق شبکه تحویل محتوا - CDN) میزبانی شوند که آن منابع: استاتیک (تغییرناپذیر) باشند، نسخه‌گذاری‌شده (versioned) باشند و یکپارچگی آن‌ها با استفاده از Subresource Integrity (SRI) بررسی شود. اگر این موارد امکان‌پذیر نیست، باید برای هر منبع، یک تصمیم امنیتی مستند وجود داشته باشد که توجیه کند چرا این منبع به این شکل بارگذاری می‌شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.7", + "Ordinal": 7, + "Name": "سایر ملاحظات امنیتی مرورگر (Other Browser Security Considerations)", + "Items": [ + { + "Shortcode": "V3.7.1", + "Ordinal": 1, + "Description": "برنامه صرفا باید از فناوری‌های سمت کلاینتی استفاده ‌کند که همچنان پشتیبانی می‌شوند و از نظر امنیتی قابل اعتماد هستند.مثال‌هایی از فناوری‌هایی که این الزام را برآورده نمی‌کنند عبارتند از NSAPI Plugins،Flash،Shockwave،ActiveX،Silverlight،NACL و Appletهای جاوا در سمت کلاینت", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.7.2", + "Ordinal": 2, + "Description": "برنامه فقط زمانی کاربر را به دامنه‌ها یا hostnameهای دیگر (که تحت کنترل برنامه نیستند) به صورت خودکار هدایت می‌کند، که آن مقصد در یک فهرست مجاز (allowlist) قرار داشته باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.7.3", + "Ordinal": 3, + "Description": "برنامه باید هنگام ریدایرکت کاربر به یک URL که خارج از کنترل برنامه است، یک پیام هشدار نشان می‌دهد و امکان لغو آن را به کاربر می‌دهد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.7.4", + "Ordinal": 4, + "Description": "باید دامنه اصلی برنامه، مثلاً (site.tld) به فهرست preload عمومی HSTS اضافه شده باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.7.5", + "Ordinal": 5, + "Description": "اگر مرورگر کاربر از ویژگی‌های امنیتی مورد انتظار برنامه پشتیبانی نمی‌کند، برنامه رفتار مناسبی داشته باشد، مثل هشدار دادن به کاربر یا مسدود کردن دسترسی.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V4", + "Ordinal": 4, + "ShortName": "API", + "Name": "API and Web Service", + "Items": [ + { + "Shortcode": "V4.1", + "Ordinal": 1, + "Name": "Generic Web Service Security", + "Items": [ + { + "Shortcode": "V4.1.1", + "Ordinal": 1, + "Description": "اطمینان حاصل شود که در هر پاسخ HTTP که شامل Body می باشد، هدر Content-Type وجود داشته باشد که نوع آن، با محتوای پاسخ دریافتی از سرور مطابقت داشته باشد. این هدر باید شامل پارامتر charset نیز باشد تا رمزگذاری کاراکتر ایمن (مانند UTF-8 یا ISO-8859-1) را مشخص کند. این مقادیر باید مطابق با استاندارد IANA Media Types باشند؛ برای مثال، انواعی مانند \"text/، /+xml\" و \"/xml\" را در بر می‌گیرند.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.1.2", + "Ordinal": 2, + "Description": "اطمینان حاصل شود که تنها نقاط پایانی که برای استفاده کاربر نهایی از طریق مرورگر طراحی شده‌اند (User-Facing Endpoints) به‌صورت خودکار از HTTP به HTTPS هدایت ‌شوند، سایر سرویس‌ها یا نقاط پایانی نباید (ریدایرکت شفاف، Transparent Redirect) داشته باشند. این اقدام برای جلوگیری از وضعیتی است که در آن یک کلاینت به اشتباه درخواست‌های رمزنگاری‌نشده (HTTP) ارسال می‌کند، اما چون این درخواست‌ها به‌طور خودکار به HTTPS ریدایرکت می‌شوند، نشت احتمالی داده‌های حساس پنهان خواهد ماند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.1.3", + "Ordinal": 3, + "Description": "اطمینان حاصل شود که هدرهای HTTP که در برنامه استفاده می شود و توسط یک لایه واسطه، مانند یکload balancer ، یک پروکسی وب یا یک سرویس backend-for-frontend تنظیم شده است نمی‌تواند توسط کاربر نهایی بازنویسی شود. هدرهای نمونه ممکن است شامل X-Real-IP، X-Forwarded-* یا X-User-ID باشند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.1.4", + "Ordinal": 4, + "Description": "اطمینان حاصل شود که فقط متدهای HTTP که صریحاً توسط برنامه یا API آن پشتیبانی می‌شوند (از جمله OPTIONS در درخواست‌های preflight) می‌توانند مورد استفاده قرار گیرند و متدهای استفاده نشده مسدود شوند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.1.5", + "Ordinal": 5, + "Description": "اطمینان حاصل شود که برای درخواست‌ها یا تراکنش‌هایی که بسیار حساس هستند یا از چندین سامانه عبور می‌کنند، از امضاهای دیجیتال در سطح پیام استفاده شود تا اطمینان امنیتی بیشتری علاوه بر محافظت‌های سطح انتقال (مانند TLS) فراهم گردد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V4.2", + "Ordinal": 2, + "Name": "HTTP Message Structure Validation", + "Items": [ + { + "Shortcode": "V4.2.1", + "Ordinal": 1, + "Description": "اطمینان حاصل شود که تمامی اجزای برنامه )از جمله لود بالانسرها، فایروال‌ها و سرورهای اپلیکیشن( مرزهای پیام‌های HTTP ورودی را با استفاده از مکانیزم مناسب نسخه های HTTP تعیین می‌کنند تا از حملات HTTP request smuggling جلوگیری شود. در HTTP/1.x اگر هدر Transfer-Encoding وجود داشته باشد، هدر Content-Length باید مطابق RFC 2616 نادیده گرفته شود. در مقابل، هنگام استفاده از HTTP/2 یا HTTP/3، اگر هدر Content-Length وجود داشته باشد، گیرنده باید اطمینان حاصل کند که این مقادیر با طول فریم‌های DATA سازگار می‌باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.2.2", + "Ordinal": 2, + "Description": "اطمینان حاصل شود که هنگام تولید پیام‌های HTTP، هدر Content-Length با طول محتوایی که توسط چارچوب‌بندی پروتکل HTTP تعیین می‌شود، تداخل نداشته باشد تا از حملات request smuggling جلوگیری شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.2.3", + "Ordinal": 3, + "Description": "اطمینان حاصل شود برنامه، پیام‌های HTTP/2 یا HTTP/3 با هدرهای connection-specific مانند Transfer-Encoding را به منظور جلوگیری از حملات response splitting یا header injection ارسال یا قبول نمی کند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.2.4", + "Ordinal": 4, + "Description": "اطمینان حاصل شود برنامه تنها درخواست های HTTP/2 and HTTP/3 که هدرها و مقادیر آن شامل هیچ توالی CR (\\r), LF (\\n), CRLF (\\r\\n) نباشد را می پذیرد تا از حملات header injection جلوگیری کند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.2.5", + "Ordinal": 5, + "Description": "اطمینان حاصل کنید که اگر برنامه (Frontend or Backend) اقدام به ساخت و ارسال درخواست‌های HTTP می کند از مکانیزم های validation ، sanitization یا سایر مکانیزم‌ها استفاده کند تا از ایجاد URIها (مانند فراخوانیAPI ) یا فیلدهای هدر درخواست HTTP (مانند Authorization یا( Cookie که بیش از حد مجاز، طولانی هستند، جلوگیری شود که منجر به عدم پذیرش درخواست توسط مولفه دریافت کننده(هر بخشی از زیرساخت یا سامانه که درخواست HTTP را دریافت و پردازش می‌کند) شود. عدم رعایت این موضوع می تواند باعث وقوع حمله Danial of Service شود، ارسال یک درخواست بیش از حد طولانی (مانند یک فیلد هدر کوکی طولانی) باعث می شود سرور همواره با وضعیت خطا پاسخ دهد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V4.3", + "Ordinal": 3, + "Name": "GraphQL", + "Items": [ + { + "Shortcode": "V4.3.1", + "Ordinal": 1, + "Description": "اطمینان حاصل شود یکی از مکانیزم ها برای جلوگیری از حملات انکار سرویس (DoS) درلایه GraphQL یا لایه داده استفاده شده است. این مکانیزم‌ها عبارتند از استفاده از فهرست مجاز کوئری‌ها ( Query Allowlist)، محدودسازی عمق کوئری‌ها (Depth Limiting)،محدودسازی تعداد یا حجم داده(Amount Limiting) و تحلیل هزینه کوئری (Query Cost Analysis). این اقدامات، به منظور مقابله با درخواست های پیچیده، تو در تو یا کوئری‌های پرهزینه که می توانند موجب مصرف بیش از حد منابع و اختلال در سرویس دهی شوند ضروری است.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.3.2", + "Ordinal": 2, + "Description": "اطمینان حاصل شود که قابلیت Introspection در GraphQL در محیط تولید (Production) غیرفعال شده‌است، مگرAPI مبتنی بر GraphQL به‌صورت صریح برای استفاده توسط اشخاص یا سامانه های ثالث (Third Parties) طراحی شده باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V4.4", + "Ordinal": 4, + "Name": "WebSocket", + "Items": [ + { + "Shortcode": "V4.4.1", + "Ordinal": 1, + "Description": "اطمینان حاصل شود که تمامی ارتباطات WebSocket از طریق پروتکل TLS( WSS) برقرار می‌شوند.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.4.2", + "Ordinal": 2, + "Description": "اطمینان حاصل شود که در هنگام Handshake اولیه‌ی HTTP برای WebSocket، مقدار هدر Origin بررسی ‌شود و در صورتی که با لیستی از مبداهای مجاز (allowed origins) برای برنامه مطابقت داشته باشد، اتصال پذیرفته می‌شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.4.3", + "Ordinal": 3, + "Description": "اطمینان حاصل شود که در صورتی که امکان استفاده از مکانیزم استاندارد مدیریت نشست برنامه وجود نداشته باشد، از توکن‌های اختصاصی (Duplicated Tokens) برای این منظور استفاده شود که با الزامات امنیتی مدیریت نشست به طور کامل مطابقت داشته باشند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.4.4", + "Ordinal": 4, + "Description": "اطمینان حاصل شود که توکن‌های اختصاصی مدیریت نشست WebSocket در هنگام انتقال از یک نشست HTTPS موجود به کانالWebSocket، از طریق نشست HTTPS احراز هویت‌شده قبلی، دریافت یا اعتبارسنجی می‌شوند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V5", + "Ordinal": 5, + "ShortName": "File", + "Name": "File Handling", + "Items": [ + { + "Shortcode": "V5.1", + "Ordinal": 1, + "Name": "File Handling Documentation", + "Items": [ + { + "Shortcode": "V5.1.1", + "Ordinal": 1, + "Description": "مستندات نوع فایل‌های مجاز، پسوندهای مورد انتظار، و حداکثر اندازه هر فایل (شامل اندازه پس از استخراج) را برای هر قابلیت بارگذاری مشخص کرده باشد. همچنین، مستندات توضیح می‌دهند چگونه فایل‌ها برای دانلود و پردازش توسط کاربران نهایی ایمن‌سازی می‌شوند؛ برای مثال، رفتار برنامه هنگام شناسایی یک فایل مخرب چگونه خواهد بود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V5.2", + "Ordinal": 2, + "Name": "File Upload and Content", + "Items": [ + { + "Shortcode": "V5.2.1", + "Ordinal": 1, + "Description": "برنامه تنها فایل‌هایی با حجم مشخص، که قادر به پردازش آن است را می‌پذیرد تا از کاهش عملکرد یا حملات انکار سرویس (DoS) جلوگیری شود.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.2", + "Ordinal": 2, + "Description": "هنگام پذیرش فایل توسط برنامه، چه به صورت مستقیم و چه به صورت یک آرشیو مانند فایلzip پسوند فایل با پسوند مورد انتظار مطابقت داشته باشد و اعتبارسنجی محتوای فایل صورت گیرد تا تایید شود محتوای فایل با نوع تعریف‌شده توسط پسوند هم‌خوانی دارد. این فرآیند می تواند شامل موارد بررسی بایت‌های ابتدایی (magic bytes) فایل، انجام بازنویسی تصاویر برای حذف ساختارها و اطلاعات ناخواسته و استفاده از کتابخانه‌های تخصصی برای اعتبارسنجی کامل محتوای فایل باشد اما محدود به آنها نیست. در سطح L1، کافی است این بررسی‌ها فقط بر روی فایل‌هایی که در فرآیندهای تجاری یا امنیتی خاص استفاده می‌شوند متمرکز باشد. در سطح L2 و بالاتر، این فرآیند باید برای تمامی فایل‌های ورودی برنامه اجرا شود.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.3", + "Ordinal": 3, + "Description": "برنامه باید پیش از استخراج محتوای فایل‌های فشرده (مانند zip، gz، docx، odt)، آن‌ها را از نظر حداکثر اندازه مجاز پس از استخراج و همچنین حداکثر تعداد فایل‌های درون آن بررسی می‌کند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.4", + "Ordinal": 4, + "Description": "برنامه فضای مشخصی برای اندازه فایل و تعداد فایل‌های مجاز برای هر کاربر اعمال می‌کند تا از این طریق، یک کاربر نتواند با بارگذاری تعداد زیادی فایل یا فایل‌های بیش از حد بزرگ، فضای ذخیره‌سازی را پر کند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.5", + "Ordinal": 5, + "Description": "برنامه اجازه بارگذاری فایل‌های فشرده‌ که حاوی لینک های نمادین (symlinks) هستند را نمی‌دهد، مگر اینکه این رفتار به طور مشخص مورد نیاز باشد. در چنین شرایطی باید یک فهرست مجاز (allowlist) از مسیرها یا فایل‌هایی که می تواند برای آنها لینک نمادین ایجاد شود، اعمال و اعتبارسنجی گردد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.6", + "Ordinal": 6, + "Description": "برنامه تصاویر بارگذاری‌شده با اندازه پیکسلی بزرگ‌تر از حد مجاز را رد کند تا از حملات pixel flood attacks جلوگیری شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V5.3", + "Ordinal": 3, + "Name": "File Storage", + "Items": [ + { + "Shortcode": "V5.3.1", + "Ordinal": 1, + "Description": "فایل هایی که از ورودی های غیرمعتبر بارگذاری‌ یا تولید می شوند و در پوشه های عمومی قرار می گیرند، هنگام دسترسی مستقیم از طریق یک درخواست HTTP، به عنوان کداجرایی سمت سرور اجرا نشوند.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.3.2", + "Ordinal": 2, + "Description": "هنگام ایجاد مسیرهای فایل برای عملیات مختلف، به جای استفاده از نام فایل‌های ارسال شده توسط کاربر، از داده‌های تولید شده داخلی یا منابع مورد اعتماد استفاده شود. و در صورتی که استفاده از نام فایل‌ها یا متادیتای ارسالی توسط کاربر ضروری باشد، می بایست validation و Sanitization اعمال شود. این کار برای جلوگیری از حملاتی مانند Path Traversal، Local or Remote File Inclusion(LFI, RFI) و Server-Side Request Forgery(SSRF) می‌باشد.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.3.3", + "Ordinal": 3, + "Description": "پردازش فایل‌های سمت سرور، مانند استخراج فایل‌های فشرده، اطلاعات مسیر ارائه شده توسط کاربر را نادیده می‌گیرد تا از آسیب‌پذیری‌هایی مانند zip slip جلوگیری شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V5.4", + "Ordinal": 4, + "Name": "File Download", + "Items": [ + { + "Shortcode": "V5.4.1", + "Ordinal": 1, + "Description": "برنامه نام فایل ارسال‌شده توسط کاربر را چه در قالب JSON، JSONP یا پارامتر URL، اعتبارسنجی می‌کند یا نادیده می‌گیرد، و در پاسخ HTTP، نام فایل را به‌طور صریح در فیلد Content-Disposition هدر مشخص می‌نماید.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.4.2", + "Ordinal": 2, + "Description": "نام‌های فایل‌های ارائه شده (مانند فیلدهای هدر پاسخ HTTP یا پیوست‌های ایمیل)، به‌درستی encoded یا sanitized شده‌اند (مطابق RFC 6266)، تا ساختار سند حفظ شده و از حملات تزریق جلوگیری شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.4.3", + "Ordinal": 3, + "Description": "فایل‌های دریافت شده از منابع غیرقابل اعتماد توسط آنتی ویروس اسکن شود تا از ارائه محتوای مخرب شناخته‌شده جلوگیری شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V6", + "Ordinal": 6, + "ShortName": "Authentication", + "Name": "Authentication", + "Items": [ + { + "Shortcode": "V6.1", + "Ordinal": 1, + "Name": "Authentication Documentation", + "Items": [ + { + "Shortcode": "V6.1.1", + "Ordinal": 1, + "Description": "مستندات برنامه، نحوه استفاده از کنترل هایی مانند محدودیت نرخ (Rate Limit)، مقابله با خودکارسازی (Anti-Automation) و پاسخ تطبیقی (Adaptive Response) را برای دفاع در برابر حملاتی مانند Credential Stuffing و حملات Password Brute Force به وضوح تعریف کرده باشد. مستندات باید به‌وضوح نحوه پیکربندی این کنترل‌ها را تشریح کرده و نشان دهند که چگونه از قفل شدن مخرب حساب‌های کاربری جلوگیری می‌شود.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.1.2", + "Ordinal": 2, + "Description": "یک لیست از کلمات خاص مرتبط با زمینه سازمانی‌ (Context-Specific) مستندسازی شود تا از بکارگیری آنها در رمزهای عبور جلوگیری شد. این فهرست می‌تواند شامل نام سازمان، نام محصول، شناسه سامانه، نام کد پروژه، نام دپارتمان یا نقش های سازمانی و موارد مشابه باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.1.3", + "Ordinal": 3, + "Description": "در صورت وجود مسیرهای متعدد احراز هویت در برنامه کاربردی، تمامی این مسیرها به همراه کنترل‌های امنیتی و سطح قدرت احراز هویت مورد نیاز، مستندسازی شده‌اند. لازم است این کنترل‌ها به‌صورت یکسان و سازگار در تمامی مسیرهای احراز هویت اجرا شوند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.2", + "Ordinal": 2, + "Name": "Password Security", + "Items": [ + { + "Shortcode": "V6.2.1", + "Ordinal": 1, + "Description": "کلمات عبور تنظیم شده توسط کاربر حداقل ۸ کاراکتر طول داشته باشد. هرچند حداقل ۱۵ کاراکتر به شدت توصیه می‌شود.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.2", + "Ordinal": 2, + "Description": "کاربران قادر به تغییر گذرواژه خود باشند.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.3", + "Ordinal": 3, + "Description": "هنگام تغییر کلمه عبور، گذرواژه فعلی و گذرواژه جدید توسط کاربر تکمیل شود.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.4", + "Ordinal": 4, + "Description": "کلمات عبوری که در حین ثبت‌نام حساب کاربری یا تغییر کلمه عبور ارسال می شوند با یک فهرست در دسترس از حداقل ۳۰۰۰ کلمه عبور رایج که ( با سیاست‌های کلمه عبور برنامه (مانند حداقل طول) سازگاری دارند) بررسی شوند.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.5", + "Ordinal": 5, + "Description": "کلمات عبور با هر ترکیبی قابل استفاده باشند، بدون اینکه قوانینی برای محدودکردن نوع کاراکترهای مجاز وجود داشته باشد. نباید هیچ‌گونه الزامی برای تعداد حداقل کاراکترهای حروف بزرگ یا کوچک، اعداد یا کاراکترهای خاص وجود داشته باشد.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.6", + "Ordinal": 6, + "Description": "فیلدهای ورودی کلمه عبور از نوع \"type=password\" استفاده می‌کنند تا ورودی‌ها پنهان شوند. برنامه‌ها می‌توانند به کاربر این امکان را بدهند که موقتاً کلمه عبور کامل یا آخرین کاراکتر تایپ شده را مشاهده کند.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.7", + "Ordinal": 7, + "Description": "عملکرد \"چسباندن\" (paste)، ابزارهای کمکی گذرواژه مرورگر و مدیریت‌کننده‌های گذرواژه خارجی مجاز باشند.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.8", + "Ordinal": 8, + "Description": "برنامه کلمه عبور کاربر را دقیقاً همانطور که از کاربر دریافت شده است، بدون هیچ گونه تغییراتی مانند کوتاه‌سازی(truncation) یا تبدیل حروف بزرگ و کوچک (case transformation)، بررسی کند.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.9", + "Ordinal": 9, + "Description": "استفاده از گذرواژه‌هایی با حداقل طول ۶۴ کاراکتر مجاز باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.10", + "Ordinal": 10, + "Description": "کلمه عبور کاربر تا زمانی که مشخص شود که به خطر افتاده است یا کاربر آن را تغییر دهد، معتبر باقی بماند. برنامه نباید الزام به تغییر دوره‌ای گذرواژه‌ها را داشته باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.11", + "Ordinal": 11, + "Description": "فهرست مستند شده ای از کلمات خاص مرتبط با زمینه‌ سازمانی برای جلوگیری از ایجاد کلمات عبور آسان قابل حدس، مورد استفاده قرار گیرد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.12", + "Ordinal": 12, + "Description": "کلمات عبور وارد شده در حین ثبت‌نام حساب کاربری یا تغییر کلمه عبور با مجموعه‌ای از کلمات عبور افشا شده بررسی ‌شوند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.3", + "Ordinal": 3, + "Name": "General Authentication Security", + "Items": [ + { + "Shortcode": "V6.3.1", + "Ordinal": 1, + "Description": "کنترل‌های لازم برای جلوگیری از حملاتی مانند Credential Stuffing و password brute force طبق مستندات امنیتی برنامه پیاده‌سازی شوند.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.2", + "Ordinal": 2, + "Description": "حساب‌های کاربری پیش‌فرض (مانند \"admin\"، \"root\" یا \"sa\") در برنامه وجود نداشته باشند یا غیرفعال شده باشند.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.3", + "Ordinal": 3, + "Description": "برای دسترسی به برنامه، از یک مکانیزم احراز هویت چندعاملی (MFA) یا ترکیبی از مکانیزم‌های احراز هویت تک‌عاملی استفاده شود. برای سطح L3، حداقل یکی از عوامل احراز هویت باید مبتنی بر سخت‌افزار باشد در برابر حملات فیشینگ، مقاومت در برابر نفوذ و جعل هویت را فراهم کند، در حالی که با اقدام آگاهانه کاربر (مانند فشردن دکمه روی کلید سخت‌افزاری FIDO یا تلفن همراه) قصد کاربر برای احراز هویت را نیز تأیید نماید. هرگونه تسهیل یا تعدیل در این الزام، مستلزم ارائه دلایل مستند و مجموعه‌ای جامع از کنترل‌های جبرانی است.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.4", + "Ordinal": 4, + "Description": "تأیید کنید که در صورت وجود مسیرهای متعدد احراز هویت در برنامه، هیچ مسیر احراز هویتِ مستندسازی‌نشده‌ای وجود نداشته باشد و کنترل‌های امنیتی و سطح قدرت احراز هویت در تمامی مسیرها به‌صورت یکسان و سازگار اعمال شوند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.5", + "Ordinal": 5, + "Description": "کاربران از تلاش‌های مشکوک برای احراز هویت (موفق یا ناموفق) مطلع ‌شوند. این اطلاع‌رسانی می‌تواند شامل تلاش برای احراز هویت از موقعیت مکانی یا کلاینت غیرمعمول، احراز هویت ناقص (تنها موفقیت یکی از عوامل)، تلاش برای احراز هویت پس از یک دوره طولانی عدم فعالیت، یا احراز هویت موفق پس از چندین تلاش ناموفق باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.6", + "Ordinal": 6, + "Description": "ایمیل به‌عنوان مکانیزم احراز هویت، چه به‌صورت تک‌عاملی و چه به‌عنوان یکی از عوامل احراز هویت چندعاملی، استفاده نمی‌شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.7", + "Ordinal": 7, + "Description": "کاربران پس از به‌روزرسانی اطلاعات احراز هویت خود، مانند بازنشانی گذرواژه یا تغییر نام کاربری یا آدرس ایمیل، مطلع شوند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.8", + "Ordinal": 8, + "Description": "با توجه به پیام‌های خطا، کدهای پاسخ HTTP یا تفاوت در زمان پاسخ‌دهی، نتوان کاربران معتبر را از طریق تلاش‌های ناموفق احراز هویت شناسایی کرد. همچنین، عملکردهای ثبت‌نام و بازیابی گذرواژه نیز باید از این نوع افشای اطلاعات محافظت شده باشند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.4", + "Ordinal": 4, + "Name": "Authentication Factor Lifecycle and Recovery", + "Items": [ + { + "Shortcode": "V6.4.1", + "Ordinal": 1, + "Description": "کلمه عبور اولیه یا کدهای فعال‌سازی تولید شده توسط سیستم، به‌صورت تصادفی و ایمن تولید ‌شوند، با سیاست فعلی رمز عبور مطابقت دارند، و پس از مدت زمان کوتاهی یا پس از اولین استفاده منقضی می‌شوند. این رمزهای اولیه نباید به عنوان رمز عبور بلندمدت مورد استفاده قرار گیرند.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.2", + "Ordinal": 2, + "Description": "راهنمای کلمه عبور یا احراز هویت مبتنی بر دانش (که به عنوان \"سؤالات امنیتی\" شناخته می‌شوند) در سیستم وجود ندارد.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.3", + "Ordinal": 3, + "Description": "فرآیند امنی برای بازنشانی کلمه عبور فراموش‌شده پیاده‌سازی شده است که هیچ‌یک از مکانیزم‌های احراز هویت چندعاملی فعال را دور نزند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.4", + "Ordinal": 4, + "Description": "در صورت از دست رفتن یکی از عوامل احراز هویت چندعاملی، فرآیند اثبات هویت با همان سطحی که در زمان ثبت‌نام انجام شده است، اجرا شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.5", + "Ordinal": 5, + "Description": "دستورالعمل‌های تمدید مکانیزم‌های احراز هویت دارای تاریخ انقضا برای کاربران به موقع ارسال می‌شود تا پیش از انقضای مکانیزم فعلی فرصت کافی برای تمدید وجود داشته باشد، و در صورت لزوم، یادآورهای خودکار نیز تنظیم و ارسال شده باشند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.6", + "Ordinal": 6, + "Description": "کاربران ادمین می‌توانند فرآیند بازنشانی کلمه عبور را برای کاربران عادی آغاز کنند، اما اجازه تغییر مستقیم یا انتخاب رمز عبور برای کاربر را ندارند. این کنترل برای جلوگیری از دسترسی ادمین به رمز عبور کاربران طراحی شده است.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.5", + "Ordinal": 5, + "Name": "General Multi-factor authentication requirements", + "Items": [ + { + "Shortcode": "V6.5.1", + "Ordinal": 1, + "Description": "Lookup Secrets درخواست‌ها یا کدهای احراز هویت خارج از باند (Out-of-Band) و رمزهای یکبار مصرف مبتنی بر زمان (TOTP) تنها یک‌بار قابل استفاده باشند و پس از استفاده موفق، مجدداً قابل استفاده نباشند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.2", + "Ordinal": 2, + "Description": "در صورت ذخیره‌سازی Lookup Secrets در سمت Backend برنامه، اگر مقدار آنتروپی کمتر از ۱۱۲ بیت باشند (معادل ۱۹ کاراکتر تصادفی الفبایی-عددی یا ۳۴ رقم تصادفی)، باید با یک الگوریتم تایید شده برای ذخیره رمز عبور و با استفاده از یک Salt تصادفی ۳۲ بیتی هش شوند. در صورتی که آنتروپی کد ۱۱۲ بیت یا بیشتر باشد، می‌توان از یک تابع هش استاندارد برای ذخیره سازی استفاده کرد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.3", + "Ordinal": 3, + "Description": "Lookup Secrets کدهای احراز هویت خارج از باند (out of band) و تولید رمزهای یکبار مصرف مبتنی بر زمان(TOTP) همگی با استفاده از یک تولیدکننده عدد شبه تصادفی ‌رمزنگاری‌شده (CSPRNG) تولید شده باشند تا از تولید مقادیر قابل پیش‌بینی جلوگیری شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.4", + "Ordinal": 4, + "Description": "Lookup Secrets و کدهای احراز هویت خارج از باند (out of band) حداقل دارای ۲۰ بیت آنتروپی باشند (معمولاً ۴ کاراکتر تصادفی الفبایی-عددی یا ۶ رقم تصادفی برای رسیدن به این میزان آنتروپی کافی است).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.5", + "Ordinal": 5, + "Description": "درخواست‌ها، کدها یا توکن‌های احراز هویت خارج از باند (Out-of-Band) و همچنین رمزهای عبور یک‌بار مصرف مبتنی بر زمان (TOTP) دارای طول عمر مشخص باشند. حداکثر طول عمر برای درخواست‌های خارج از باند باید ۱۰ دقیقه و برای TOTP حداکثر ۳۰ ثانیه باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.6", + "Ordinal": 6, + "Description": "امکان لغو (Revoke) هر عامل احراز هویت، از جمله دستگاه‌های فیزیکی، در صورت سرقت یا مفقود شدن وجود داشته باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.7", + "Ordinal": 7, + "Description": "مکانیزم‌های احراز هویت بیومتریک فقط به‌عنوان عامل دوم و در کنار یکی از عوامل «چیزی که در اختیار دارید» یا «چیزی که کاربر می داند» مورد استفاده قرار می‌گیرند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.8", + "Ordinal": 8, + "Description": "اعتبارسنجی رمزهای یک‌بار مصرف مبتنی بر زمان (TOTP) بر اساس منبع زمانی از یک سرویس قابل اعتماد انجام می‌شود و نه بر اساس زمان ارائه‌شده توسط کلاینت یا منابع غیرقابل اعتماد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.6", + "Ordinal": 6, + "Name": "Out-of-Band authentication mechanisms", + "Items": [ + { + "Shortcode": "V6.6.1", + "Ordinal": 1, + "Description": "مکانیزم‌های احراز هویت مبتنی بر شبکه تلفن عمومی (PSTN) برای ارسال رمزهای یک‌بار مصرف (OTP) از طریق تماس تلفنی یا پیامک تنها در صورتی که شماره تلفن قبلا اعتبارسنجی شده باشد، یا روش‌های جایگزین قوی‌تر (رمزهای عبور یکبار مصرف مبتنی بر زمان) در دسترس باشند ارائه می‌شوند و سرویس‌دهنده باید کاربران را از ریسک‌های امنیتی این روش‌ها مطلع سازد. برای اپلیکیشن‌های سطح L3، استفاده از تماس تلفنی و پیامک به‌عنوان گزینه، مجاز نیست.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.6.2", + "Ordinal": 2, + "Description": "درخواست‌ها، کدها یا توکن‌های احراز هویت خارج از باند (Out-of-Band) به درخواست احراز هویت اصلی که برای آن تولید شده‌اند متصل باشند و قابل استفاده برای درخواست‌های قبلی یا بعدی نباشند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.6.3", + "Ordinal": 3, + "Description": "مکانیزم‌های احراز هویت خارج از باند (Out-of-Band) مبتنی بر کد، در برابر حملات brute force از طریق اعمال کنترل محدودیت نرخ (Rate Limiting) محافظت شوند. همچنین، استفاده از کدی با حداقل ۶۴ بیت آنتروپی (Entropy)مدنظر قرار گیرد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.6.4", + "Ordinal": 4, + "Description": "در صورت استفاده از Push Notifications جهت احراز هویت چند عاملی، محدودیت نرخ (Rate Limiting) به منظور جلوگیری از حملات Push Bombing اعمال شده باشد. استفاده از تطبیق عدد Matching) Number) نیز می‌تواند به کاهش این ریسک کمک کند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.7", + "Ordinal": 7, + "Name": "Cryptographic authentication mechanism", + "Items": [ + { + "Shortcode": "V6.7.1", + "Ordinal": 1, + "Description": "گواهینامه‌های مورد استفاده برای تأیید ادعاهای احراز هویت رمزنگاری‌شده به گونه‌ای ذخیره شوند که از تغییر یا دستکاری آن‌ها محافظت شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.7.2", + "Ordinal": 2, + "Description": "مقدار چالش (Challenge Nonce) حداقل ۶۴ بیت طول داشته باشد و از نظر آماری یکتا باشد یا حداقل در طول عمر دستگاه رمزنگاری منحصر به فرد باقی بماند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.8", + "Ordinal": 8, + "Name": "Authentication with an Identity Provider", + "Items": [ + { + "Shortcode": "V6.8.1", + "Ordinal": 1, + "Description": "اگر برنامه از چند ارائه‌دهنده هویت (IdP) پشتیبانی می‌کند، امکان جعل هویت کاربر از طریق یک ارائه‌دهنده هویت دیگر وجود نداشته باشد (برای مثال، با استفاده از شناسه کاربری یکسان). مکانیسم استاندارد برای جلوگیری از این تهدید، این است که برنامه، کاربران را با استفاده از ترکیب شناسه IdP (به‌عنوان فضای نام یا (namespace و شناسه کاربر در آن، IdP ثبت و شناسایی کند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.8.2", + "Ordinal": 2, + "Description": "وجود و یکپارچگی امضاهای دیجیتال بر روی تصدیق‌های (تقاضاها یا ادعاهای) احراز هویت برای مثال بر روی (توکن‌های JWT یا SAML assertions) همواره اعتبارسنجی می‌شود و هرگونه تصدیقی که فاقد امضا یا دارای امضای نامعتبر باشد، رد می‌گردد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.8.3", + "Ordinal": 3, + "Description": "(تقاضاها یا ادعاهای) تصدیق‌های SAML به‌صورت منحصربه‌فرد پردازش شده و تنها یک‌بار در بازه‌ی اعتبار خود استفاده می‌شوند تا از حملات بازپخش (Replay Attacks) جلوگیری گردد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.8.4", + "Ordinal": 4, + "Description": "اگر برنامه‌ای از یک ارائه‌دهنده هویت (IdP) جداگانه استفاده می‌کند و انتظار قدرت، روش‌ها یا تازگی احراز هویت خاصی را برای عملکردهای خاص دارد، برنامه این موضوع را با استفاده از اطلاعات برگردانده شده توسط IdP تأیید می‌کند. به عنوان مثال، اگر از OIDC استفاده شود، این کار می‌تواند با اعتبارسنجی ادعاهای (Claims) موجود در توکن شناسایی (ID Token) مانند «amr»، «acr» و «auth_time» (در صورت وجود) انجام شود. اگر ارائه‌دهنده هویت این اطلاعات را ارائه نکند، برنامه باید یک روش جایگزین مستندسازی‌شده داشته باشد که فرض می‌کند حداقل سطح احراز هویت استفاده شده است (مثلاً احراز هویت تک‌عاملی با نام کاربری و گذرواژه).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V7", + "Ordinal": 7, + "ShortName": "Session", + "Name": "Session Management", + "Items": [ + { + "Shortcode": "V7.1", + "Ordinal": 1, + "Name": "Session Management Documentation", + "Items": [ + { + "Shortcode": "V7.1.1", + "Ordinal": 1, + "Description": "بازه عدم فعالیت نشست کاربر و بیشینه طول عمر نشست قبل از احراز هویت مجدد، در ترکیب با سایر کنترل‌ها مستند و متناسب سازی شود. مستند سازی انجام شده باید شامل توجیه برای هر انحراف(نقض) از الزامات احراز هویت مجدد NIST SP 800-63B باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.1.2", + "Ordinal": 2, + "Description": "در مستند باید تعداد نشست همزمان مجاز برای یک کاربر و همچنین رفتار و اعمال مناسب برای زمانی که این تعداد به حداکثر رسید مشخص شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.1.3", + "Ordinal": 3, + "Description": "تمام سیستم‌هایی که نشست‌های کاربر را به عنوان بخشی از یک اکوسیستم مدیریت هویت فدرال(مانند سیستم‌های (SSO ایجاد و مدیریت می‌کنند، باید در کنار سایر کنترل‌های مربوط به طول عمر نشست‌ها، خاتمه آن‌ها و هرگونه شرایط دیگری که نیاز به احراز هویت مجدد دارد، مستند شوند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.2", + "Ordinal": 2, + "Name": "Fundamental Session Management Security", + "Items": [ + { + "Shortcode": "V7.2.1", + "Ordinal": 1, + "Description": "برنامه کاربردی باید تمام بررسی‌های توکن نشست‌ را با استفاده از یک سرویس backend مطمئن انجام دهد.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.2.2", + "Ordinal": 2, + "Description": "برنامه کاربردی که از هر یک از توکن‌های Self-Contained یا reference که به صورت پویا برای مدیریت نشست تولید شده‌اند استفاده کند اما از از کلیدهای API ثابت و کلید‌ها استفاده نکند.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.2.3", + "Ordinal": 3, + "Description": "در صورتی که برای نمایش نشست کاربر از توکن‌های reference استفاده می شود، این توکن‌ها منحصر به فرد بوده و با استفاده از یک تولید کننده عدد شبه تصادفی امن رمزنگاری(CSPRNG) که دارای انتروپی حداقل128 بیتی است تولید شوند.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.2.4", + "Ordinal": 4, + "Description": "برنامه کاربردی در هنگام احراز هویت کاربر یک توکن نشست جدید تولید نماید که شامل احراز هویت مجدد و ابطال توکن نشست کنونی است.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.3", + "Ordinal": 3, + "Name": "Session Timeout", + "Items": [ + { + "Shortcode": "V7.3.1", + "Ordinal": 1, + "Description": "بر اساس تحلیل ریسک و تصمیمات امنیتی مستند شده، پس از گذشت مهلت زمانی عدم فعالیت، کاربر مجبور به احراز هویت مجدد گردد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.3.2", + "Ordinal": 2, + "Description": "بر اساس تحلیل ریسک و تصمیمات امنیتی مستند شده، پس از گذشت بیشینه زمان مطلق طول عمر، کاربر مجبور به احراز هویت مجدد گردد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.4", + "Ordinal": 4, + "Name": "Session Termination", + "Items": [ + { + "Shortcode": "V7.4.1", + "Ordinal": 1, + "Description": "در مواقعی که فرآیند خاتمه نشست کاربر فعال می‌شود (مانند خروج کاربر یا انقضای نشست)، برنامه اجازه هیچ فعالیتی را به آن نشست نمی‌دهد. برای Reference tokens یا stateful session، این به معنی نامعتبرسازی اطلاعات نشست در برنامه Backend می‌باشد. برنامه‌هایی که از توکن‌های Self-contained استفاده می‌کنند نیاز به راه حل‌هایی نظیر نگهداری فهرستی از توکن‌های خاتمه‌یافته، عدم پذیرش توکن‌هایی که پیش از یک تاریخ و زمان مشخص برای هر کاربر تولید شده‌اند، یا چرخش کلید امضای مخصوص هر کاربر دارند.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.4.2", + "Ordinal": 2, + "Description": "برنامه کاربردی تمامی نشست‌های فعال را در زمانی که حساب کاربری غیرفعال یا حذف می‌شود را ابطال نماید. (مانند کارمندی که شرکت را ترک می‌کند)", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.4.3", + "Ordinal": 3, + "Description": "برنامه کاربردی قابلیت ارائه گزینه ابطال تمامی نشست های فعال دیگر را پس از یک تغییر موفقیت آمیز یا حذف هریک از عوامل احراز هویت (نظیر تغییر پسورد از طریق ریست یا بازنشانی و در صورت وجود به روزرسانی تنظیمات MFA ) را داشته باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.4.4", + "Ordinal": 4, + "Description": "تمامی صفحاتی که نیازمند احراز هویت هستند دارای دسترسی آسان و مشخص به فرآیند خروج باشند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.4.5", + "Ordinal": 5, + "Description": "مدیران برنامه کاربردی قادر به ابطال نشست‌های فعال برای یک شخص یا تمامی کاربران باشند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.5", + "Ordinal": 5, + "Name": "Defenses Against Session Abuse", + "Items": [ + { + "Shortcode": "V7.5.1", + "Ordinal": 1, + "Description": "برنامه کاربردی قبل از اعطای مجوز تغییر ویژگی‌های حساس حساب کاربری که بر روی احراز هویت تاثیر دارد نظیر آدرس ایمیل، شماره تلفن، تنظیمات MFA یا اطلاعات دیگر که در بازگردانی حساب کاربری مورد استفاده قرار می‌گیرند، به احراز هویت مجدد کامل نیاز دارد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.5.2", + "Ordinal": 2, + "Description": "حساب‌های کاربری قادر به دیدن(پس از احراز هویت مجدد با حداقل یک عامل) و ابطال یک یا همه نشست‌های فعال باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.5.3", + "Ordinal": 3, + "Description": "برنامه کاربردی قبل از اجرای تراکنش‌ها یا عملیات‌های حساس نیازمند احراز هویت مجدد با حداقل یک عامل یا صحت سنجی ثانویه باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.6", + "Ordinal": 6, + "Name": "Federated Re-authentication", + "Items": [ + { + "Shortcode": "V7.6.1", + "Ordinal": 1, + "Description": "طول عمر و ابطال نشست بین RP و idp طبق سند- که نیازمند احرازهویت مجدد در زمان مورد نیاز مانند وقتی که بیشینه زمان بین رخداد احراز هویت idp رسیده باشد- انجام شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.6.2", + "Ordinal": 2, + "Description": "ساخت نشست‌ها نیاز به رضایت کاربر یا یک اقدام صریح دارد که بدین صورت از ایجاد نشست‌های جدید برنامه بدون تعامل کاربر جلوگیری می‌شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V8", + "Ordinal": 8, + "ShortName": "Authorization", + "Name": "Authorization", + "Items": [ + { + "Shortcode": "V8.1", + "Ordinal": 1, + "Name": "Authorization Documentation", + "Items": [ + { + "Shortcode": "V8.1.1", + "Ordinal": 1, + "Description": "مستند اعطای مجوز باید شامل قوانینی به منظور محدودسازی دسترسی در سطح عملکرد و دسترسی مبتنی بر داده بر اساس مجوزهای کاربران و ویژگی‌های منابع باشد.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.1.2", + "Ordinal": 2, + "Description": "مستند اعطای مجوز باید قوانینی را برای محدودیت‌های دسترسی در سطح Field بر اساس مجوزهای کاربران و ویژگی‌های منابع تعریف نماید(هر دو دسترسی خواندن و نوشتن). توجه داشته باشید که این قوانین ممکن است به مقادیر دیگر ویژگی‌های شیء داده ی مربوطه (Relevant Data Object) بستگی داشته باشند، مانند حالت (state) یا وضعیت (status).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.1.3", + "Ordinal": 3, + "Description": "مستند برنامه کاربردی باید ویژگی‌های محیطی و زمینه‌ای (شامل و نه محدود به زمان روز، مکان، آدرس IP یا دستگاه) که در برنامه کاربردی به منظور اتخاذ تصمیمات امنیتی (نظیر آن دسته از تصمیماتی که مربوط به احراز هویت و اعطای مجوز می باشد) را مشخص کند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.1.4", + "Ordinal": 4, + "Description": "مستندات احراز هویت و اعطای مجوز، علاوه بر اعطای مجوز در سطح Field، سطح عملکرد و داده‌های خاص، چگونگی استفاده از عوامل محیطی و زمینه‌ای در اتخاذ تصمیمات را مشخص نماید.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V8.2", + "Ordinal": 2, + "Name": "General Authorization Design", + "Items": [ + { + "Shortcode": "V8.2.1", + "Ordinal": 1, + "Description": "برنامه کاربردی باید از محدود بودن دسترسی‌‌های در سطح عملکرد به مشتریانی که دارای دسترسی صریح هستند اطمینان حاصل نماید.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.2.2", + "Ordinal": 2, + "Description": "برنامه کاربردی باید از محدود بودن دسترسی‌‌های در سطح داده به مشتریانی که دارای دسترسی صریح به اقلام داده‌ای خاص هستند اطمینان حاصل نماید تا از این طریق خطر آسیب پذیری IDOR و broken object level authorization را کاهش دهد .", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.2.3", + "Ordinal": 3, + "Description": "برنامه کاربردی دسترسی در سطح Field را با مجوزهای صریح به Field ها برای مصرف کنندگان جهت کاهش خطر broken object property level authorization (BOPLA) محدود کرده باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.2.4", + "Ordinal": 4, + "Description": "کنترل‌های امنیتی تطبیقی که بر اساس ویژگی‌های محیطی و زمینه‌ای کاربر (مانند زمان روز، مکان، آدرس IP یا دستگاه) هستند، برای تصمیم‌گیری‌های احراز هویت (Authentication) و مجوزدهی (Authorization) طبق مستندات برنامه پیاده‌سازی شده‌اند. این کنترل‌ها باید هم در زمان تلاش کاربر برای شروع یک نشست (Session) جدید و هم در طول یک نشست فعال، اعمال شوند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V8.3", + "Ordinal": 3, + "Name": "Operation Level Authorization", + "Items": [ + { + "Shortcode": "V8.3.1", + "Ordinal": 1, + "Description": "برنامه کاربردی قوانین مجوزدهی را در یک لایه سرویس معتبر اعمال نموده و بر آن دسته از کنترل‌هایی که مصرف کنندگان نامعتبر قادر به دستکاری آن‌ها هستند متکی نباشد. (نظیر جاوا اسکریپت سمت کاربر)", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.3.2", + "Ordinal": 2, + "Description": "در مواقعی که امکان اعمال فوری تغییرات وجود ندارد (مثلاً وقتی که سیستم برای تصمیم‌گیری در مجوزدهی از توکن‌های Self-Contained مثل JWT استفاده می‌کند که اطلاعات را داخل خود ذخیره کرده و تا زمان انقضا تغییر نمی‌کنند)، باید کنترل‌های جبرانی وجود داشته باشد. این کنترل‌ها باید بتوانند زمانی که کاربر عملی را انجام می‌دهد که دیگر مجاز به آن نیست، هشدار بدهند و تغییر را برگردانند. با این حال، توجه کنید که این راهکار جایگزین نمی‌تواند جلوی نشت اطلاعات را بگیرد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.3.3", + "Ordinal": 3, + "Description": "دسترسی به یک object بر اساس مجوزهای کاربری شخص درخواست کننده(مثال: مصرف کننده) باشد نه بر اساس مجوز‌های یک واسطه یا سرویسی که به نمایندگی از او عمل می‌کند. بطور مثال، در صورتی که یک مصرف کننده یک وب سرویس را با استفاده از یک توکن self-contained برای احراز هویت فراخوانی می‌کند و سپس آن سرویس اطلاعات را از یک سرویس دیگر درخواست می‌کند، سرویس دوم باید همان توکن مصرف کننده را استفاده کند، نه یک توکن سرویس-به-سرویس (Machine-to-Machine token) که متعلق به سرویس اول است، تا تصمیمات مجوزدهی دقیقاً بر اساس مجوزهای کاربر گرفته شوند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V8.4", + "Ordinal": 4, + "Name": "Other Authorization Considerations", + "Items": [ + { + "Shortcode": "V8.4.1", + "Ordinal": 1, + "Description": "برنامه های کاربردی چند کاربره(multi tenants) از کنترل های cross-tenant به منظور تضمین این امر که عملیات‌های مصرف کنندگان هرگز کاربرانی (tenants) را که مجوز تعامل با آنها را ندارند را تحت تأثیر قرار نمی‌دهد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.4.2", + "Ordinal": 2, + "Description": "دسترسی به درگاه‌های پیکربندی شامل چندین لایه امنیتی از قبیل تأیید مداوم هویت مصرف‌کننده، ارزیابی وضعیت امنیتی دستگاه و تحلیل ریسک زمینه‌ای باشد تا از این طریق اطمینان حاصل شود که موقعیت شبکه‌ای یا نقاط پایانی معتبر تنها عوامل برای مجوزدهی نیستند اگر چه که این عوامل احتمال دسترسی غیرمجاز را کاهش می‌دهند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V9", + "Ordinal": 9, + "ShortName": "Self", + "Name": "Self-contained Tokens", + "Items": [ + { + "Shortcode": "V9.1", + "Ordinal": 1, + "Name": "Token source and integrity", + "Items": [ + { + "Shortcode": "V9.1.1", + "Ordinal": 1, + "Description": "قبل از پذیرش محتوای توکن‌ها، آن‌ها را با استفاده از امضای دیجیتال یا MAC به منظور حفاظت در مقابل دستکاری‌ها مورد اعتبارسنجی قرار داده شود.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.1.2", + "Ordinal": 2, + "Description": "فقط الگوریتم‌های موجود در لیست مجاز قادر به استفاده در ساخت و صحت سنجی توکن‌های self-contained در یک زمینه مشخص باشند. این لیست مجاز باید در حالت ایده آل شامل هم الگوریتم‌های متقارن و هم نامتقارن‌ها باشد و نباید شامل الگوریتم‌های NONE باشد. در صورتی که هر دو الگوریتم‌های متقارن و نانتقارن مورد نیاز باشند کنترل‌های بیشتری باید به منظور جلوگیری از سردرگمی کلید‌ها(key Confusion) بکار گرفته شود.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.1.3", + "Ordinal": 3, + "Description": "به منظور جلوگیری از مشخص نمودن منابع غیر مطمئن و کلید‌ها توسط مهاجمین، موارد کلیدی که در اعتبارسنجی توکن‌های self-contained مورد استفاده قرار می‌گیرند، از منابع از پیش پیکربندی شده مطمئنی که برای صادر کننده توکن است تعیین شود. برای JWTs و سایر ساختارهای JWS ، هدرهایی نظیر ‘jku’, ‘x5u’ و ‘jwk’ باید با یک لیست مجاز از منابع مطمئن مورد اعتبارسنجی قرار گیرند.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V9.2", + "Ordinal": 2, + "Name": "Token content", + "Items": [ + { + "Shortcode": "V9.2.1", + "Ordinal": 1, + "Description": "اگر یک بازه زمانی معتبر در داده‌های توکن وجود داشته باشد، توکن و محتوای آن تنها در صورتی پذیرفته می‌شوند که زمان بررسی در این بازه زمانی معتبر باشد. به عنوان مثال، برای JWTها، ادعاهای 'nbf' و 'exp' باید تایید شوند.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.2.2", + "Ordinal": 2, + "Description": "سرویسی که یک توکن دریافت می‌کند قبل از پذیرش محتوای آن، از لحاظ درستی نوع بررسی نموده و برای هدف مشخص شده در نظر گیرد. بطور مثال، فقط توکن‌های access می‌توانند به منظور تصمیمات مجوزی و فقط توکن های ID می‌توانند به منظور اثبات هویت کاربر مورد پذیرش قرار گیرند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.2.3", + "Ordinal": 3, + "Description": "یک سرویس فقط توکن‌هایی را بپذیرد که به منظور استفاده توسط آن سرویس هستند(audience).برای JWT ها،این امر می‌تواند از طریق اعتبارسنجی ادعای 'aud' با یک لیست مجاز تعریف شده در سرویس صورت پذیرد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.2.4", + "Ordinal": 4, + "Description": "اگر صادر کننده توکن از کلید خصوصی مشابهی برای audienceهای متفاوت استفاده می‌کند، توکن‌های تولید شده دارای محدودیت مخاطبی باشند که بطور منحصر به فردی مخاطبین مورد نظر را مشخص می‌کند. این امر از استفاده مجدد توکن توسط مخاطب ناخواسته جلوگیری می‌کند. در صورتی که شناسه مخاطب به صورت پویا مشخص شده باشد، صادرکننده توکن باید این مخاطبین را به منظور اطمینان از عدم جعل هویت مخاطب مورد اعتبارسنجی قرار دهد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V10", + "Ordinal": 10, + "ShortName": "OAuth", + "Name": "OAuth and OIDC", + "Items": [ + { + "Shortcode": "V10.1", + "Ordinal": 1, + "Name": "Generic OAuth and OIDC Security", + "Items": [ + { + "Shortcode": "V10.1.1", + "Ordinal": 1, + "Description": "توکن‌ها باید فقط به مؤلفه‌هایی ارسال شوند که به‌طور دقیق به آن‌ها نیاز دارند. برای مثال، هنگام استفاده از الگوی Backend-for-Frontend برای برنامه‌های JavaScript مبتنی بر مرورگر، Access Tokens و Refresh Tokens باید فقط برای Backend قابل دسترس باشند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.1.2", + "Ordinal": 2, + "Description": "Client باید فقط مقادیری را از Authorization Server بپذیرد (مانند Authorization Code یاID Token ) که این مقادیر حاصل از یک Authorization Flow باشند که توسط همان نشست (Session) و تراکنش User Agent آغاز شده است. این موضوع مستلزم آن است که Secretهای تولیدشده توسط کلاینت مانند code_verifier در PKCE، یا مقادیر state و nonce در OIDC قابل حدس زدن نباشند، مخصوص همان تراکنش باشند، و به‌صورت امن هم به کلاینت و هم به نشست (Session) مرورگری که تراکنش در آن شروع شده، متصل شده باشند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.2", + "Ordinal": 2, + "Name": "OAuth Client", + "Items": [ + { + "Shortcode": "V10.2.1", + "Ordinal": 1, + "Description": "درCode Flow، باید OAuth Client در برابر حملاتBrowser-based Request Forgery که معمولاً با عنوان Cross-Site Request Forgery (CSRF) شناخته می‌شوند و درخواست‌های توکن را ایجاد می‌کنند، محافظت داشته باشد. این محافظت باید با استفاده از قابلیت PKCE یا با بررسی پارامترstate که در درخواست احراز مجوز ارسال شده است.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.2.2", + "Ordinal": 2, + "Description": "اگر OAuth Client بتواند با بیش از یک Authorization Server تعامل داشته باشد، باید دارای سازوکاری برای دفاع در برابر Mix-up Attacks باشد. برای مثال، می‌تواند الزام کند که Authorization Server مقدار پارامتر ‘iss’ را برگرداند و این مقدار هم درAuthorization Response و هم درToken Response اعتبارسنجی شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.2.3", + "Ordinal": 3, + "Description": "OAuth Client باید فقطScopes (یا سایر پارامترهای مجوزدهی) مورد نیاز را در درخواست‌ها به Authorization Server درخواست کند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.3", + "Ordinal": 3, + "Name": "OAuth Resource Server", + "Items": [ + { + "Shortcode": "V10.3.1", + "Ordinal": 1, + "Description": "Resource Server باید فقط Access Tokenهایی را بپذیرد که برای استفاده با همان سرویس در نظر گرفته شده‌اند(Audience). Audience می‌تواند در یک Access Token ساختاریافته (مانند مقدار aud در JWT) درج شده باشد، یا از طریق Token Introspection Endpoint بررسی شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.3.2", + "Ordinal": 2, + "Description": "Resource Server باید تصمیمات مجوزدهی (Authorization Decisions) را بر اساس Claims موجود در Access Token که واگذاری مجوز (Delegated Authorization) را تعریف می‌کنند، اعمال کند. اگر Claimsهایی مانند sub، scope و authorization_details موجود باشند، باید جزو فرآیند تصمیم‌گیری قرار گیرند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.3.3", + "Ordinal": 3, + "Description": "اگر برای گرفتن یک تصمیم کنترل دسترسی، لازم است یک کاربرِ یکتا از داخل Access Token (چه JWT و چه پاسخ Token Introspection ) شناسایی شود، سرور منبع (Resource Server) کاربر را از روی Claimهایی شناسایی کند که قابل اختصاص‌دادن به کاربران دیگر نیستند. معمولاً این یعنی استفاده از ترکیب دو Claim یعنی 'iss' (صادرکننده توکن) و 'sub' (شناسه یکتای کاربر)", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.3.4", + "Ordinal": 4, + "Description": "اگر Resource Server نیازمند قدرت، روش یا تازگی خاص احراز هویت باشد، بررسی کند که Access Token ارائه‌شده این محدودیت‌ها را برآورده می‌کند. برای مثال، در صورت وجود، از Claimsهای OIDC مانند acr، amr و auth_time به ترتیب استفاده شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.3.5", + "Ordinal": 5, + "Description": "تأیید کنید که Resource Server از استفاده از Access Tokenهای سرقت‌شده یا Replay توکن‌ها (توسط افراد غیرمجاز) جلوگیری کند، با الزام استفاده از Sender-Constrained Access Tokens، مانند Mutual TLS برای OAuth 2 یا OAuth2 Demonstration of Proof of Possession (DPoP).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.4", + "Ordinal": 4, + "Name": "OAuth Authorization Server", + "Items": [ + { + "Shortcode": "V10.4.1", + "Ordinal": 1, + "Description": "سرور احراز هویت باید آدرس‌های بازگشتی (Redirect URI) را بر اساس فهرست مجاز (Allowlist) از URIهای از پیش‌ثبت‌شده و مخصوص هر کلاینت، با استفاده از مقایسه دقیقِ رشته‌ای Comparison) (Exact String اعتبارسنجی می‌کند.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.2", + "Ordinal": 2, + "Description": "اگر Authorization Server کد احراز مجوز (Authorization Code) را در Authorization Response برمی‌گرداند، این کد فقط یک‌بار برای درخواست توکن باید قابل استفاده باشد. برای دومین درخواست معتبر با یک Authorization Code که قبلاً برای صدور Access Token استفاده شده است، Authorization Server باید درخواست توکن را رد کند و هر توکن صادرشده‌ی مرتبط با آن Authorization Code را باطل نماید.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.3", + "Ordinal": 3, + "Description": "تأیید کنید که Authorization Code دارای مدت زمان معتبر بودن محدود باشد. حداکثر طول عمر می‌تواند برای برنامه‌های کاربردی در سطوح L1 و L2 تا ۱۰ دقیقه و برای برنامه‌های کاربردی در سطح L3 تا ۱ دقیقه باشد.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.4", + "Ordinal": 4, + "Description": "برای یک Client مشخص، Authorization Server فقط استفاده از Grantهایی را مجاز بداند که آن Client به استفاده از آن‌ها نیاز دارد. توجه داشته باشید که Grantهای ‘token’ (Implicit Flow) و ‘password’ (Resource Owner Password Credentials Flow) دیگر نباید استفاده شوند.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.5", + "Ordinal": 5, + "Description": "Authorization Server باید حملات Refresh Token Replay را برای Public Clientها کاهش دهد، ترجیحاً با استفاده از Sender-Constrained Refresh Tokens، یعنی Demonstrating Proof of Possession (DPoP) یا Certificate-Bound Access Tokens با استفاده از Mutual TLS (mTLS). برای برنامه‌های L1 و L2، می‌توان از Refresh Token Rotation استفاده کرد. اگر Refresh Token Rotation به‌کار گرفته شود، Authorization Server باید پس از استفاده، Refresh Token را باطل کند و اگر یک Refresh Token که قبلاً استفاده و باطل شده ارائه شود، تمام Refresh Tokenهای مربوط به آن مجوز را ابطال نماید.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.6", + "Ordinal": 6, + "Description": "اگر از Code Grant استفاده شود، Authorization Server باید حملات Authorization Code Interception را با الزام به استفاده از Proof Key for Code Exchange (PKCE) کاهش دهد. برای Authorization Requestها، Authorization Server باید یک مقدار معتبر برای 'code_challenge' الزام کند و نباید مقدار 'code_challenge_method' از نوع 'plain' را بپذیرد. برای Token Request، باید اعتبارسنجی پارامتر 'code_verifier' الزامی باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.7", + "Ordinal": 7, + "Description": "اگر Authorization Server از Unauthenticated Dynamic Client Registration پشتیبانی می‌کند، ریسک مربوط به Client Applicationهای مخرب را باید کاهش دهد. این کار باید شامل اعتبارسنجی Client Metadata (مانند هر Registered URI)، اطمینان از رضایت کاربر، و هشدار به کاربر پیش از پردازش یک Authorization Request با یک Client Application غیرقابل اعتماد باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.8", + "Ordinal": 8, + "Description": "Refresh Tokenها باید دارای یک انقضای مطلق (Absolute Expiration) باشند، حتی اگر از Sliding Refresh Token Expiration استفاده شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.9", + "Ordinal": 9, + "Description": "Refresh Tokenها و Reference Access Tokenها باید توسط کاربر مجاز از طریق User Interface Authorization Server قابل ابطال باشند، تا ریسک Clientهای مخرب یا توکن‌های سرقت‌شده کاهش یابد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.10", + "Ordinal": 10, + "Description": "Confidential Client باید برای درخواست‌های Backchannel بین Client و Authorization Server، مانند Token Requests، Pushed Authorization Requests (PAR) و Token Revocation Requests، احراز هویت شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.11", + "Ordinal": 11, + "Description": "پیکربندی Authorization Server باید فقط Scopes موردنیاز را به OAuth Client اختصاص دهد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.12", + "Ordinal": 12, + "Description": "برای یک Client مشخص، Authorization Server فقط مقدار 'response_mode' را که این Client نیاز دارد، مجاز بداند. برای مثال، با اعتبارسنجی این مقدار توسط Authorization Server در برابر مقادیر مورد انتظار یا با استفاده از Pushed Authorization Request (PAR) یا JWT-secured Authorization Request (JAR).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.13", + "Ordinal": 13, + "Description": "Grant Type ‘code’ همواره همراه با Pushed Authorization Requests (PAR) باید استفاده شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.14", + "Ordinal": 14, + "Description": "Authorization Server باید فقط توکن‌های دسترسی از نوع وابسته به ارسال‌کننده (Proof-of-Possession) صادر می‌کند؛ چه به‌صورت توکن‌های دسترسی مبتنی بر گواهی از طریق TLS دوسویه (mTLS) و چه به‌صورت توکن‌های دسترسی وابسته به DPoP (Demonstration of Proof of Possession).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.15", + "Ordinal": 15, + "Description": "برای یک کلاینت سمت‌سرور (که روی دستگاه کاربر نهایی اجرا نمی‌شود)، سرور احراز هویت اطمینان حاصل می‌کند که مقدار پارامترِ authorization_details از بک‌اند کلاینت ارسال شده و کاربر در آن دستکاری نکرده است. به‌عنوان مثال، با الزام به استفاده از درخواست احراز هویت پوش‌شده (PAR) یا درخواست احراز هویت ایمن‌شده با JWT (JAR).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.16", + "Ordinal": 16, + "Description": "کلاینت باید از نوع Confidential Client باشد و سرور احراز هویت استفاده از روش‌های قدرتمند احراز هویت کلاینت ـ مبتنی بر رمزنگاری کلید عمومی و مقاوم در برابر حملات replay attacks ـ را الزامی کند؛ مانند TLS دوسویه (tls_client_auth ‎، ‎self_signed_tls_client_auth یا JWT مبتنی بر کلید خصوصی (private_key_jwt).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.5", + "Ordinal": 5, + "Name": "OIDC Client", + "Items": [ + { + "Shortcode": "V10.5.1", + "Ordinal": 1, + "Description": "Client به‌عنوان Relying Partyباید در برابر حملات بازپخش (Replay) توکن ID محافظت شده است. برای مثال، با بررسی اینکه مقدار claim مربوط به nonce در ID Token دقیقاً با مقدار **nonce**ای که در درخواست احراز هویت به OpenID Provider ارسال شده، یکسان باشد(که در OAuth 2 به آن authorization request ارسالی به authorization server گفته می‌شود).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.5.2", + "Ordinal": 2, + "Description": "Client باید کاربر را به‌صورت یکتا از ID Token Claims شناسایی کند، معمولاً از ‘sub’ Claim ، که قابل انتساب مجدد به کاربران دیگر نیست (در محدوده‌ی همان Identity Provider).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.5.3", + "Ordinal": 3, + "Description": "Client باید تلاش‌های یک Authorization Server مخرب برای جا زدن خود به‌جای یک Authorization Server دیگر از طریق متادیتای Authorization Server را رد می‌کند.کلاینت باید متادیتای Authorization Server را رد کند اگر مقدار issuer URL موجود در متادیتا دقیقاً با issuer URL از پیش پیکربندی‌شده و مورد انتظار کلاینت یکسان نباشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.5.4", + "Ordinal": 4, + "Description": "Client باید اعتبارسنجی کند ID Token برای استفاده توسط همان Client در نظر گرفته شده است (Audience)، با بررسی اینکه ‘aud’ Claim در توکن برابر با مقدار ‘client_id’ مربوط به Client باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.5.5", + "Ordinal": 5, + "Description": "هنگام استفاده ازOIDC Back-Channel Logout، Relying Party از Denial of Service از طریق Forced Logout و Cross-JWT Confusion در جریان Logout باید جلوگیری کند. Client باید بررسی کند که Logout Token به درستی با مقدار typ آن برابر با logout+jwt باشد ، شامل ‘event’ Claim با نام عضو صحیح باشد و شامل ‘nonce’ Claim نباشد. همچنین توصیه می‌شود Expiration کوتاه باشد (مثلاً ۲ دقیقه).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.6", + "Ordinal": 6, + "Name": "OpenID Provider", + "Items": [ + { + "Shortcode": "V10.6.1", + "Ordinal": 1, + "Description": "OpenID Provider باید فقط مقادیر 'code'، 'ciba'، 'id_token' یا 'id_token code' را برای Response Mode مجاز بداند. توجه داشته باشید که 'code' نسبت به 'id_token code' (که OIDC Hybrid Flow است) ترجیح داده می‌شود و 'token' (هر Implicit Flow) نباید استفاده شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.6.2", + "Ordinal": 2, + "Description": "OpenID Provider از Denial of Service از طریق Forced Logout جلوگیری کند. این کار با دریافت تأیید صریح از کاربر نهایی یا در صورت وجود، اعتبارسنجی پارامترها در Logout Request (که توسط Relying Party آغاز شده است)، مانند ‘id_token_hint’، انجام می‌شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.7", + "Ordinal": 7, + "Name": "Consent Management", + "Items": [ + { + "Shortcode": "V10.7.1", + "Ordinal": 1, + "Description": "Authorization Server باید تضمین ‌کند کاربر برای هر درخواست مجوز (Authorization Request) رضایت خود را اعلام کرده است. در صورتی که هویت کلاینت قابل اطمینان نباشد، Authorization Server باید در همه موارد کاربر را به‌صورت صریح برای اعلام رضایت (Consent) راهنمایی و از او تأیید بگیرد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.7.2", + "Ordinal": 2, + "Description": "زمانی که Authorization Server از کاربر درخواست رضایت (Consent) می‌کند باید اطلاعات کافی و شفافی درباره آنچه کاربر در حال تأیید آن است ارائه ‌دهد. در صورت لزوم، این اطلاعات باید شامل این موارد باشد: ماهیت مجوزهای درخواستی )معمولاً بر اساس scope، resource server و جزئیات مجوز در Rich Authorization Requests – RAR)، هویت برنامه یا اپلیکیشن دریافت‌کننده مجوز و مدت اعتبار این مجوزها.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.7.3", + "Ordinal": 3, + "Description": "کاربر باید بتواند رضایت‌هایی (Consents) را که از طریق Authorization Server صادر کرده است، مشاهده، ویرایش و لغو (Revoke) کند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V11", + "Ordinal": 11, + "ShortName": "Cryptography", + "Name": "Cryptography", + "Items": [ + { + "Shortcode": "V11.1", + "Ordinal": 1, + "Name": "Cryptographic Inventory and Documentation", + "Items": [ + { + "Shortcode": "V11.1.1", + "Ordinal": 1, + "Description": "اطمینان حاصل کنید که یک سیاست مستند برای مدیریت کلیدهای رمزنگاری و چرخه‌عمر کلیدهای رمزنگاری وجود دارد که از یک استاندارد مدیریت کلید مانند NIST SP 800-57 پیروی می‌کند. این باید شامل اطمینان از این موضوع باشد که کلیدها بیش از حد به اشتراک گذاشته نشوند (برای مثال، در مورد Secrets مشترک با بیش از دو موجودیت و در مورد کلیدهای خصوصی با بیش از یک موجودیت).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.1.2", + "Ordinal": 2, + "Description": "فهرست اجزاء رمزنگاری باید تهیه و نگهداری ‌شود و به‌صورت منظم به‌روزرسانی گردد و شامل تمام کلیدهای رمزنگاری، الگوریتم‌ها و گواهی‌های دیجیتال مورد استفاده در برنامه باشد. این فهرست همچنین باید مشخص کند که کلیدها در کدام بخش‌های سیستم مجاز یا غیرمجاز به استفاده هستند و چه نوع داده‌هایی می‌توانند یا نمی‌توانند با این کلیدها محافظت شوند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.1.3", + "Ordinal": 3, + "Description": "مکانیزم‌های کشف رمزنگاری برای شناسایی تمام موارد استفاده از رمزنگاری در سیستم باید استفاده ‌شود؛ از جمله رمزنگاری (encryption)، هش‌کردن (hashing) و عملیات امضای دیجیتال (signing).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.1.4", + "Ordinal": 4, + "Description": "فهرست اجزاء رمزنگاری باید تهیه ‌شود. این فهرست باید شامل یک برنامه مستند باشد که مسیر مهاجرت به استانداردهای جدید رمزنگاری (مانند رمزنگاری پساکوانتومی) را مشخص می‌کند تا امکان واکنش مناسب به تهدیدات آینده فراهم شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.2", + "Ordinal": 2, + "Name": "Secure Cryptography Implementation", + "Items": [ + { + "Shortcode": "V11.2.1", + "Ordinal": 1, + "Description": "برای عملیات رمزنگاری باید از پیاده‌سازی‌های مورد تأیید (شامل کتابخانه‌ها و پیاده‌سازی‌های سخت‌افزاری) استفاده شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.2.2", + "Ordinal": 2, + "Description": "برنامه با انعطاف‌پذیری رمزنگاری (crypto agility) باید طراحی شده باشد، به‌طوری که الگوریتم‌های تولید اعداد تصادفی، رمزنگاری احراز هویت‌شده، MAC یا هش، طول کلیدها، تعداد دورها، رمزها و حالت‌ها بتوانند در هر زمان مجدداً پیکربندی، ارتقاء یا تعویض شوند تا در برابر شکست‌های رمزنگاری محافظت شوند. به همین ترتیب، باید امکان جایگزینی کلیدها و رمزهای عبور و رمزگذاری مجدد داده‌ها نیز وجود داشته باشد. این امکان ارتقاء بدون وقفه به رمزنگاری پساکوانتومی (PQC) را فراهم می‌کند، زمانی که پیاده‌سازی‌های با اطمینان بالا از طرح‌ها یا استانداردهای تأییدشده PQC به‌طور گسترده در دسترس قرار گیرند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.2.3", + "Ordinal": 3, + "Description": "تمام بدویات رمزنگاری (cryptographic primitives) بر اساس الگوریتم، اندازه کلید و پیکربندی، حداقل ۱۲۸ بیت سطح امنیتی را فراهم می‌کنند(2128)، برای مثال، یک کلید ECC با طول ۲۵۶ بیت تقریباً ۱۲۸ بیت امنیت ارائه می‌دهد، در حالی که برای رسیدن به همین سطح امنیت، الگوریتم RSA به کلید ۳۰۷۲ بیتی نیاز دارد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.2.4", + "Ordinal": 4, + "Description": "تأیید کنید که تمامی عملیات رمزنگاری زمان ثابت (constant-time) باشند و هیچ عملیات «کوتاه‌شده» (short-circuit) در مقایسه‌ها، محاسبات یا بازگشت‌ها وجود نداشته باشد تا از نشت اطلاعات جلوگیری شود.( مهاجم می‌تواند از همین تفاوت‌های زمانی، از طریق Timing Side-Channel Attack، اطلاعات حساس را استخراج کند.)", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.2.5", + "Ordinal": 5, + "Description": "تأیید کنید که تمامی ماژول‌های رمزنگاری به‌صورت امن دچار خطا (fail securely) شوند و خطاها به گونه‌ای مدیریت شوند که ایجاد آسیب‌پذیری‌هایی مانند حملات Padding Oracle را ممکن نکنند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.3", + "Ordinal": 3, + "Name": "Encryption Algorithms", + "Items": [ + { + "Shortcode": "V11.3.1", + "Ordinal": 1, + "Description": "از مد‌های بلاک ناامن (مانند ECB) و روش‌های Padding ضعیف (مانند PKCS#1 v1.5) نباید استفاده شود.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.3.2", + "Ordinal": 2, + "Description": "تنها رمزها و مد‌های تأییدشده، مانند AES با GCM باید استفاده شوند.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.3.3", + "Ordinal": 3, + "Description": "داده‌های رمزنگاری‌شده باید با استفاده از ترجیحاً یک روش رمزنگاری احراز هویت‌شده تأییدشده یا با ترکیب یک روش رمزنگاری تأییدشده با یک الگوریتم MAC تأییدشده در برابر تغییرات غیرمجاز محافظت شوند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.3.4", + "Ordinal": 4, + "Description": "تأیید کنید که Nonceها، Initialization Vectorها و سایر اعداد یک‌بار مصرف برای بیش از یک جفت کلید رمزنگاری و عنصر داده استفاده نشوند. روش تولید آن‌ها باید متناسب با الگوریتم مورد استفاده باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.3.5", + "Ordinal": 5, + "Description": "تأیید کنید که هر ترکیبی از یک الگوریتم رمزنگاری و یک الگوریتم MAC در حالت Encrypt-then-MAC عمل کند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.4", + "Ordinal": 4, + "Name": "Hashing and Hash-based Functions", + "Items": [ + { + "Shortcode": "V11.4.1", + "Ordinal": 1, + "Description": "تأیید کنید که تنها توابع هش تأییدشده برای موارد استفاده عمومی رمزنگاری، از جمله امضاهای دیجیتال، HMAC، KDF و تولید بیت تصادفی استفاده شوند. توابع هش غیرمجاز، مانند MD5، نباید برای هیچ هدف رمزنگاری به‌کار گرفته شوند.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.4.2", + "Ordinal": 2, + "Description": "رمزعبورها با استفاده از یک تابع مشتق‌سازی کلید تأییدشده و پرهزینه محاسباتی (که به آن «تابع هش رمزعبور» نیز گفته می‌شود) ذخیره شوند، و تنظیمات پارامترها بر اساس راهنمایی‌های کنونی پیکربندی شده باشد. این تنظیمات باید تعادل بین امنیت و عملکرد برقرار کنند تا حملات Brute-force برای سطح امنیت مورد نیاز به‌طور کافی دشوار باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.4.3", + "Ordinal": 3, + "Description": "توابع هش استفاده‌شده در امضاهای دیجیتال، باید به‌عنوان بخشی از احراز هویت داده یا یکپارچگی داده، در برابر collision مقاوم بوده و طول بیت مناسب داشته باشند. اگر مقاومت در برابر collision لازم باشد، طول خروجی باید حداقل 256 بیت باشد. اگر تنها مقاومت در برابر حملات Second Pre-image لازم باشد، طول خروجی باید حداقل 128 بیت باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.4.4", + "Ordinal": 4, + "Description": "برنامه باید هنگام استخراج کلیدهای مخفی از پسوردها از توابع مشتق‌سازی کلید (KDF) تاییدشده با پارامترهای Key Stretching استفاده می‌کند. پارامترهای مورد استفاده باید تعادلی بین امنیت و عملکرد برقرار کنند تا از نفوذ حملات brute-force و به خطر افتادن کلید رمزنگاری تولیدشده جلوگیری شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.5", + "Ordinal": 5, + "Name": "Random Values", + "Items": [ + { + "Shortcode": "V11.5.1", + "Ordinal": 1, + "Description": "اعداد و رشته‌های تصادفی که قرار است قابل حدس نباشند، باید با استفاده از یک تولیدکننده اعداد شبه‌تصادفی امن رمزنگاری‌شده (CSPRNG) تولید شوند و حداقل 128 بیت انتروپی داشته باشند. توجه داشته باشید که UUIDها این شرط را رعایت نمی‌کنند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.5.2", + "Ordinal": 2, + "Description": "مکانیزم تولید اعداد تصادفی مورد استفاده به‌گونه‌ای طراحی شده باشد که حتی تحت بار سنگین نیز به‌طور امن عمل کند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.6", + "Ordinal": 6, + "Name": "Public Key Cryptography", + "Items": [ + { + "Shortcode": "V11.6.1", + "Ordinal": 1, + "Description": "فقط الگوریتم‌های رمزنگاری و مدهای عملیاتی تأیید شده برای تولید کلید و مقداردهی اولیه، و همچنین برای تولید و تأیید امضاهای دیجیتال باید استفاده می‌شوند. الگوریتم‌های تولید کلید نباید کلیدهای ناامن تولید کنند که در برابر حملات شناخته شده آسیب‌پذیر باشند؛ به‌عنوان مثال، کلیدهای RSA که در برابر Fermat factorization آسیب‌پذیر هستند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.6.2", + "Ordinal": 2, + "Description": "برای تبادل کلید از الگوریتم‌های رمزنگاری تأیید شده (مانند Diffie-Hellman) استفاده می‌شود و تمرکز بر این است که مکانیزم‌های تبادل کلید از پارامترهای امن بهره ببرند. این کار از حملات بر فرآیند برقراری کلید جلوگیری می‌کند و مانع حملات مرد میانی (MITM) یا شکست‌های رمزنگاری می‌شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.7", + "Ordinal": 7, + "Name": "In-Use Data Cryptography", + "Items": [ + { + "Shortcode": "V11.7.1", + "Ordinal": 1, + "Description": "رمزنگاری کامل حافظه (Full Memory Encryption) باید فعال باشد تا داده‌های حساس هنگام استفاده محافظت شوند و دسترسی کاربران یا فرآیندهای غیرمجاز به آن‌ها جلوگیری شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.7.2", + "Ordinal": 2, + "Description": "کاهش داده‌ها (data minimization) تضمین می‌کند که حداقل مقدار داده در حین پردازش افشا شود، و اطمینان حاصل شود که داده‌ها بلافاصله پس از استفاده یا در اولین فرصت ممکن رمزنگاری شوند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V12", + "Ordinal": 12, + "ShortName": "Secure", + "Name": "Secure Communication", + "Items": [ + { + "Shortcode": "V12.1", + "Ordinal": 1, + "Name": "General TLS Security Guidance", + "Items": [ + { + "Shortcode": "V12.1.1", + "Ordinal": 1, + "Description": "جدیدترین نسخه‌های پیشنهادی پروتکل TLS فعال باشند، مانند TLS 1.2 و TLS 1.3 نسخه‌ی جدیدترین پروتکل TLS باید گزینه‌ی ترجیحی باشد.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.1.2", + "Ordinal": 2, + "Description": "تنها cipher suiteهای پیشنهادی فعال باشند و قوی‌ترین cipher suiteها به‌عنوان گزینه‌ی ترجیحی تنظیم شده باشند. برنامه‌های L3 باید تنها از cipher suiteهایی پشتیبانی کنند که Forward Secrecy را فراهم می‌کنند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.1.3", + "Ordinal": 3, + "Description": "برنامه باید پیش از استفاده از هویت گواهی برای احراز هویت یا مجوزدهی، اعتبار و مورد اعتماد بودن گواهی‌های کلاینت در mTLS را بررسی و تأیید ‌کند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.1.4", + "Ordinal": 4, + "Description": "لغو صحیح گواهی‌ها، مانند OCSP ، باید فعال و به‌درستی پیکربندی شده باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.1.5", + "Ordinal": 5, + "Description": "Encrypted Client Hello (ECH) باید در تنظیمات TLS برنامه فعال باشد تا از افشای متادیتای حساس، مانند Server Name Indication (SNI)، در طول فرآیند Handshake TLS جلوگیری شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V12.2", + "Ordinal": 2, + "Name": "HTTPS Communication with External Facing Services", + "Items": [ + { + "Shortcode": "V12.2.1", + "Ordinal": 1, + "Description": "برای تمام ارتباطات بین کلاینت و سرویس‌های مبتنی بر HTTP که در معرض دسترسی خارجی هستند، از TLS باید استفاده ‌شود و هیچ‌گونه بازگشت (fallback) به ارتباطات ناامن یا بدون رمزنگاری انجام نگیرد.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.2.2", + "Ordinal": 2, + "Description": "سرویس‌هایی که در معرض دسترسی خارجی قرار دارند از گواهی‌های TLS عمومی و مورد اعتماد استفاده می‌کنند.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V12.3", + "Ordinal": 3, + "Name": "General Service to Service Communication Security", + "Items": [ + { + "Shortcode": "V12.3.1", + "Ordinal": 1, + "Description": "یک پروتکل رمزنگاری‌شده مانند TLS باید برای تمامی ارتباطات ورودی و خروجی به و از برنامه استفاده شود، از جمله سیستم‌های مانیتورینگ، ابزارهای مدیریت، دسترسی از راه دور و SSH، میان‌افزارها، پایگاه‌های داده، mainframes، سیستم‌های partner یا APIهای خارجی. سرور نباید به پروتکل‌های ناامن یا بدون رمزگذاری بازگردد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.3.2", + "Ordinal": 2, + "Description": "کلاینت‌های TLS باید قبل از برقراری ارتباط با سرور TLS، گواهی‌های دریافتی را اعتبارسنجی کنند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.3.3", + "Ordinal": 3, + "Description": "TLS یا دیگر مکانیزم‌های مناسب رمزگذاری انتقال باید برای تمامی ارتباطات بین سرویس‌های داخلی مبتنی بر HTTP درون برنامه استفاده شود و ارتباط به حالت‌های ناامن یا بدون رمزگذاری بازنگردد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.3.4", + "Ordinal": 4, + "Description": "ارتباطات TLS بین سرویس‌های داخلی باید از گواهی‌های معتبر استفاده کنند. در صورتی که از گواهی‌های داخلی تولیدشده یا Self-Signed استفاده شود، سرویس مصرف‌کننده باید به‌گونه‌ای پیکربندی شود که تنها به CAهای داخلی مشخص و گواهی‌های Self-Signed خاص اعتماد کند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.3.5", + "Ordinal": 5, + "Description": "سرویس‌هایی که درون یک سیستم با یکدیگر ارتباط دارند (ارتباطات درون‌سرویسی)، باید از احراز هویت قوی استفاده کنند تا هر نقطه انتهایی (endpoint) تأیید شود. روش‌های احراز هویت قوی، مانند احراز هویت کلاینت TLS، باید به‌کار گرفته شوند تا هویت تضمین شود (با استفاده از زیرساخت کلید عمومی (PKI) و مکانیزم‌هایی که در برابر حملات تکرار (replay attacks) مقاوم هستند). برای معماری‌های میکروسرویس، استفاده از سرویس مش برای ساده‌سازی مدیریت گواهی‌ها و افزایش امنیت در نظر گرفته شود", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V13", + "Ordinal": 13, + "ShortName": "Configuration", + "Name": "Configuration", + "Items": [ + { + "Shortcode": "V13.1", + "Ordinal": 1, + "Name": "Configuration Documentation", + "Items": [ + { + "Shortcode": "V13.1.1", + "Ordinal": 1, + "Description": "تمامی نیازهای ارتباطی برنامه باید به‌طور کامل مستندسازی شده باشند. این مستندسازی شامل سرویس‌های خارجی که برنامه به آن‌ها وابسته است و همچنین مواردی که کاربر نهایی جهت اتصال به سرویس خارجی مشخص می‌کند باید باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.1.2", + "Ordinal": 2, + "Description": "برای هر سرویسی که برنامه استفاده می‌کند، مستندسازی باید شامل حداکثر تعداد ارتباطات همزمان (مثلاً محدودیت‌های Connection Pool) و نحوه‌ی رفتار برنامه هنگام رسیدن به این حد باشد، از جمله هر مکانیزم بازیابی یا جایگزین، تا از بروز شرایط Denial of Service جلوگیری شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.1.3", + "Ordinal": 3, + "Description": "مستندات برنامه باید استراتژی‌های مدیریت منابع را برای هر سیستم یا سرویس خارجی که استفاده می‌کند مشخص کرده باشد (مثلاً پایگاه‌های داده، هندل‌های فایل، رشته‌ها، اتصالات HTTP) این مستندسازی باید شامل این موارد باشد :رویه‌های آزادسازی منابع، تنظیمات تایم‌اوت، مدیریت خطاها، جایی که منطق Retry اعمال می‌شود، شامل محدودیت تعداد Retry، تأخیرها و الگوریتم‌هایBack-off. برای عملیات همزمان درخواست–پاسخ HTTP (Synchronous)، مستندات باید تایم‌اوت کوتاه را الزام کند و یا Retryها را غیرفعال کند یا به‌طور سختگیرانه محدود کند تا از تاخیرهای زنجیره‌ای و هدررفت منابع جلوگیری شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.1.4", + "Ordinal": 4, + "Description": "مستندسازی برنامه باید شامل secretهای حیاتی برای امنیت برنامه و همچنین برنامه‌ای برای چرخش آن‌ها باشد( بر اساس مدل تهدید سازمان و نیازهای کسب‌وکار).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V13.2", + "Ordinal": 2, + "Name": "Backend Communication Configuration", + "Items": [ + { + "Shortcode": "V13.2.1", + "Ordinal": 1, + "Description": "رتباطات بین اجزای بک‌اند برنامه که از مکانیزم استاندارد نشست کاربران برنامه پشتیبانی نمی‌کنند، از جمله APIها، میان‌افزارها و لایه‌های داده، باید احراز هویت شده باشند. احراز هویت باید با استفاده از حساب‌های سرویس جداگانه، توکن‌های کوتاه‌مدت یا احراز هویت مبتنی بر گواهی انجام شود و نباید از اعتبارنامه‌های ثابت مانند رمز عبور، کلیدهای API یا حساب‌های مشترک با دسترسی‌های سطح بالا استفاده شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.2", + "Ordinal": 2, + "Description": "ارتباطات بین اجزای بک‌اند، از جمله سرویس‌های محلی یا سیستم‌عامل، APIها، میان‌افزارها و لایه‌های داده، با حساب‌هایی باید انجام شود که کمترین سطح دسترسی لازم را دارند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.3", + "Ordinal": 3, + "Description": "اگر اعتبارنامه‌ای برای احراز هویت سرویس استفاده می‌شود، اعتبارنامه‌ای که توسط مصرف‌کننده استفاده می‌شود، اعتبارنامه پیش‌فرض نباشد (مثلاً root/root یا admin/admin).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.4", + "Ordinal": 4, + "Description": "یک allowlist برای تعیین منابع یا سیستم‌های خارجی که برنامه مجاز به ارتباط با آن‌ها است باید وجود داشته باشد (مثلاً برای درخواست‌های خروجی، بارگذاری داده یا دسترسی به فایل). این allowlist می‌تواند در لایه برنامه، وب‌سرور، فایروال یا ترکیبی از لایه‌های مختلف پیاده‌سازی شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.5", + "Ordinal": 5, + "Description": "وب‌سرور یا سرور برنامه با یک allowlist از منابع یا سیستم‌هایی که سرور می‌تواند به آن‌ها درخواست ارسال کند یا داده‌ها و فایل‌ها را بارگذاری کند پیکربندی شده باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.6", + "Ordinal": 6, + "Description": "در مواقعی که برنامه به سرویس‌های جداگانه متصل می‌شود، پیکربندی مستندسازی‌شده برای هر اتصال رعایت شود، از جمله حداکثر ارتباطات همزمان، رفتار هنگام رسیدن به حداکثر ارتباط مجاز، زمان‌های Timeout اتصال و استراتژی‌های Retry.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V13.3", + "Ordinal": 3, + "Name": "Secret Management", + "Items": [ + { + "Shortcode": "V13.3.1", + "Ordinal": 1, + "Description": "یک راهکار مدیریت secret، مانند Key Vault، برای ایجاد امن، ذخیره، کنترل دسترسی و از بین بردن secret بک‌اند استفاده شود. این secret می‌تواند شامل رمزعبورها، داده‌های رمز نگاری، اطلاعات حساس مربوط به اتصال به پایگاه داده و سیستم‌های شخص ثالث، کلیدها و seedهای توکن‌های زمان‌محور، سایر secretهای داخلی و کلیدهای API باشد. Secret نباید در کد منبع برنامه یا در build artifacts قرار گیرد. برای برنامه‌های L3، این باید شامل راهکاری مبتنی بر سخت‌افزار مانند HSM باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.3.2", + "Ordinal": 2, + "Description": "دسترسی به دارایی‌های secret بر اساس اصل حداقل دسترسی (Least Privilege) رعایت شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.3.3", + "Ordinal": 3, + "Description": "تمام عملیات رمزنگاری باید با استفاده از یک ماژول امنیتی ایزوله (مانند Vault یا Hardware Security Module) انجام شود تا مواد کلیدی به‌طور امن مدیریت و محافظت شده و از افشای خارج از ماژول امنیتی جلوگیری شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.3.4", + "Ordinal": 4, + "Description": "secretها بر اساس مستندسازی برنامه طوری پیکربندی شوند که منقضی شده و چرخش داده شوند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V13.4", + "Ordinal": 4, + "Name": "Unintended Information Leakage", + "Items": [ + { + "Shortcode": "V13.4.1", + "Ordinal": 1, + "Description": "برنامه باید به‌گونه‌ای مستقر شود که هیچ‌گونه متادیتای کنترل نسخه، از جمله پوشه‌های .git یا .svn، در دسترس نباشد یا به شکلی باشد که این پوشه‌ها نه از بیرون و نه توسط خود برنامه قابل دسترسی نباشند.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.2", + "Ordinal": 2, + "Description": "حالت‌های Debug برای تمام اجزا در محیط‌های production باید غیرفعال شده باشند تا از افشای قابلیت‌های دیباگ و نشت اطلاعات جلوگیری شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.3", + "Ordinal": 3, + "Description": "وب‌سرورها فهرست‌بندی دایرکتوری‌ها را به کاربر نهایی نباید نمایش دهند مگر اینکه به‌طور صریح مورد نظر باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.4", + "Ordinal": 4, + "Description": "از متد HTTP TRACE در محیط‌های production نباید پشتیبانی شود تا از احتمال نشت اطلاعات جلوگیری شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.5", + "Ordinal": 5, + "Description": "مستندسازی‌ها (مانند مستندات APIهای داخلی) و نقاط پایش (Monitoring Endpoints) در دسترس نباشند مگر اینکه به‌طور صریح مورد نظر باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.6", + "Ordinal": 6, + "Description": "تأیید کنید که برنامه اطلاعات نسخه دقیق اجزای backend را افشا نکند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.7", + "Ordinal": 7, + "Description": "لایه وب باید به‌گونه‌ای پیکربندی شده باشد که فقط فایل‌هایی با پسوندهای مشخص را سرو کند تا از افشای تصادفی اطلاعات، پیکربندی و کد منبع جلوگیری شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V14", + "Ordinal": 14, + "ShortName": "Data", + "Name": "Data Protection", + "Items": [ + { + "Shortcode": "V14.1", + "Ordinal": 1, + "Name": "Data Protection Documentation", + "Items": [ + { + "Shortcode": "V14.1.1", + "Ordinal": 1, + "Description": "تمامی داده‌های حساس ایجادشده و پردازش‌شده توسط برنامه باید شناسایی شده و بر اساس سطوح حفاظتی طبقه‌بندی شده‌اند. این موضوع شامل داده‌هایی می‌شود که صرفاً کُدگذاری شده‌اند و به‌راحتی قابل بازیابی هستند، مانند رشته‌های Base64 یا محتوای متنی (plaintext) داخل یک JWT. سطوح حفاظتی باید الزامات قوانین و استانداردهای حفاظت از داده و حریم خصوصی که برنامه ملزم به رعایت آن‌هاست را در نظر بگیرند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.1.2", + "Ordinal": 2, + "Description": "برای تمامی سطوح حفاظت از داده‌های حساس، مجموعه‌ای مستند از الزامات حفاظتی تعریف شده باشد. این الزامات باید شامل (اما محدود به آن نباشد) موارد زیر باشند: الزامات مرتبط با رمزنگاری کلی، بررسی صحت و یکپارچگی، دوره‌های نگهداری داده، نحوه ثبت داده‌ها در لاگ، کنترل‌های دسترسی به داده‌های حساس در لاگ‌ها، رمزنگاری در سطح پایگاه داده، الزامات مربوط به حریم خصوصی و فناوری‌های تقویت‌کننده حریم خصوصی مورد استفاده، و سایر الزامات مرتبط با محرمانگی.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V14.2", + "Ordinal": 2, + "Name": "General Data Protection", + "Items": [ + { + "Shortcode": "V14.2.1", + "Ordinal": 1, + "Description": "داده‌های حساس باید فقط در بدنه پیام HTTP یا فیلدهای هدر به سرور ارسال شوند، و اینکه URL و query string شامل اطلاعات حساس (مانند API key یا session token) نباشند.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.2", + "Ordinal": 2, + "Description": "برنامه باید از cache شدن داده‌های حساس در اجزای سرور مانند Load Balancer و Application Cache جلوگیری کند، یا اطمینان حاصل شود که داده‌ها پس از استفاده به‌طور ایمن پاک‌سازی می‌شوند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.3", + "Ordinal": 3, + "Description": "داده‌های حساس تعریف‌شده به طرف‌های غیرقابل اعتماد (مانند User Trackers) نباید ارسال شوند تا از جمع‌آوری ناخواسته داده‌ها خارج از کنترل برنامه جلوگیری شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.4", + "Ordinal": 4, + "Description": "کنترل‌های مرتبط با داده‌های حساس شامل رمزنگاری، بررسی صحت و یکپارچگی، نگهداری، نحوه ثبت داده‌ها در لاگ، کنترل‌های دسترسی به داده‌های حساس در لاگ‌ها، حریم خصوصی و فناوری‌های مربوط به حریم خصوصی، مطابق با آنچه در مستندات برای سطح حفاظت مشخص هر داده تعریف شده است، پیاده‌سازی شوند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.5", + "Ordinal": 5, + "Description": "مکانیزم‌های cache باید طوری پیکربندی شده باشند که تنها پاسخ‌هایی با نوع محتوای مورد انتظار برای آن منبع cache شوند و شامل محتوای حساس یا پویا نباشند. وب‌سرور باید هنگام دسترسی به فایل ناموجود، پاسخ 404 یا 302 برگرداند و نه فایل معتبر دیگر، تا از حملات Web Cache Deception جلوگیری شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.6", + "Ordinal": 6, + "Description": "برنامه باید تنها حداقل داده‌های حساس مورد نیاز برای عملکرد برنامه را بازگرداند. برای مثال، تنها برخی از ارقام شماره کارت اعتباری بازگردانده شود و نه شماره کامل. در صورتی که داده کامل لازم باشد، باید در رابط کاربری masked شود مگر اینکه کاربر به‌طور مشخص آن را مشاهده کند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.7", + "Ordinal": 7, + "Description": "اطلاعات حساس باید تحت طبقه‌بندی دوره‌ای نگهداری داده قرار گرفته باشند، به‌گونه‌ای که داده‌های قدیمی یا غیرضروری به‌طور خودکار، در یک برنامه زمان‌بندی‌شده مشخص، یا براساس نیاز حذف شوند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.8", + "Ordinal": 8, + "Description": "اطلاعات حساس باید از متادیتای فایل‌های ارسال‌شده توسط کاربر حذف شود، مگر اینکه ذخیره‌سازی آن با رضایت کاربر انجام شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V14.3", + "Ordinal": 3, + "Name": "Client-side Data Protection", + "Items": [ + { + "Shortcode": "V14.3.1", + "Ordinal": 1, + "Description": "داده‌های احراز هویت‌شده از حافظه کلاینت، مانند DOM مرورگر، پس از خروج کلاینت یا Session پاک شوند. فیلد هدر Clear-Site-Data در پاسخ سرور می‌تواند در این زمینه مفید باشد، اما کلاینت باید بتواند داده‌ها را حتی زمانی که اتصال به سرور در دسترس نیست در زمان پایان Session (خروج از آن) پاک کند.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.3.2", + "Ordinal": 2, + "Description": "برنامه باید هدرهای پاسخ HTTP، anti-cach مناسب (مانند Cache-Control: no-store) را تنظیم کند تا داده‌های حساس در مرورگرها cache نشوند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.3.3", + "Ordinal": 3, + "Description": "برای اطلاعات بیشتر، همچنین به منابع زیر مراجعه کنید:", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V15", + "Ordinal": 15, + "ShortName": "Secure", + "Name": "Secure Coding and Architecture", + "Items": [ + { + "Shortcode": "V15.1", + "Ordinal": 1, + "Name": "Secure Coding and Architecture Documentation", + "Items": [ + { + "Shortcode": "V15.1.1", + "Ordinal": 1, + "Description": "مستندات برنامه باید بازه‌های زمانی جهت برطرف سازی آسیب‌پذیری‌ نسخه‌های مؤلفه‌ شخص ثالث (بر اساس ریسک) و همچنین به‌روزرسانی کتابخانه‌ها را به طور کلی تعریف کرده باشد تا ریسک ناشی از این مؤلفه‌ها به حداقل برسد.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.1.2", + "Ordinal": 2, + "Description": "یک کاتالوگ دارایی مانند Software Bill of Materials (SBOM) باید برای تمامی کتابخانه‌های شخص ثالث مورد استفاده نگهداری شود. شامل تایید این که مؤلفه‌ها از مخازن از پیش تعیین‌شده، قابل اعتماد و به‌طور مستمر نگهداری‌شده تهیه شده‌اند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.1.3", + "Ordinal": 3, + "Description": "مستندات برنامه باید شامل عملکردهایی که زمان‌بر یا پرمصرف(منابع سیستمی) هستند نیز باشد. این مورد باید شامل روش‌هایی برای جلوگیری از دست‌رفتن دسترس‌پذیری به دلیل استفاده بیش از حد از این عملکردها و همچنین جلوگیری از وضعیتی باشد که پردازش یک پاسخ طولانی‌تر از زمان انتظار مصرف‌کننده شود. تدابیر احتمالی می‌تواند شامل پردازش غیرهمزمان، استفاده از صف‌ها و محدود کردن فرآیندهای موازی برای هر کاربر و هر برنامه باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.1.4", + "Ordinal": 4, + "Description": "مستندات برنامه باید کتابخانه‌های شخص ثالثی را که به‌عنوان «کامپوننت‌های پرخطر» شناخته می‌شوند، مشخص کرده باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.1.5", + "Ordinal": 5, + "Description": "مستندات برنامه باید بخش‌هایی از برنامه را که به‌عنوان «عملکرد خطرناک» استفاده می‌شود، مشخص کرده باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V15.2", + "Ordinal": 2, + "Name": "Security Architecture and Dependencies", + "Items": [ + { + "Shortcode": "V15.2.1", + "Ordinal": 1, + "Description": "برنامه باید تنها شامل کامپوننت‌هایی باشد که چارچوب‌های زمانی مستند‌شده برای به‌روزرسانی و رفع آسیب‌پذیری‌ها را نقض نکرده‌باشند.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.2.2", + "Ordinal": 2, + "Description": "برنامه باید بر اساس تصمیمات و استراتژی‌های امنیتی مستندسازی‌شده، تدابیری برای جلوگیری از کاهش دسترس‌پذیری ناشی از عملکردهایی که زمان‌بر یا پرمصرف منابع هستند، پیاده‌سازی کرده باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.2.3", + "Ordinal": 3, + "Description": "محیط production تنها شامل عملکردهایی می‌باشد که برای اجرای برنامه ضروری هستند و هیچ قابلیت اضافی مانند کدهای تست، نمونه‌کدها و عملکردهای توسعه‌ای در دسترس نمی‌باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.2.4", + "Ordinal": 4, + "Description": "کامپوننت‌های شخص ثالث و تمام وابستگی‌های انتقالی آن‌ها از مخزن مورد انتظار باید دریافت ‌شوند، چه داخلی و چه منبع خارجی، و ریسک حمله‌ی dependency confusion مدیریت شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.2.5", + "Ordinal": 5, + "Description": "برنامه باید محافظت‌های اضافی را در بخش‌هایی از برنامه که به‌عنوان «عملکرد خطرناک» مستند شده‌اند یا از کتابخانه‌های شخص ثالثی که به‌عنوان «کامپوننت‌های پرریسک» شناخته می‌شوند، پیاده‌سازی می‌کند. این می‌تواند شامل تکنیک‌هایی مانند sandboxing، encapsulation، containerization یا جداسازی در سطح شبکه باشد تا حمله‌کنندگان پس از نفوذ به یک بخش از برنامه، نتوانند به بخش‌های دیگر برنامه منتقل شوند و زمان لازم برای پیشروی آن‌ها افزایش یابد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V15.3", + "Ordinal": 3, + "Name": "Defensive Coding", + "Items": [ + { + "Shortcode": "V15.3.1", + "Ordinal": 1, + "Description": "برنامه باید تنها زیرمجموعه‌ای از فیلدهای مورد نیاز از یک data object را بازگرداند. به‌عنوان مثال، نباید کل data object بازگردانده شود، زیرا برخی فیلدهای منفرد نباید برای کاربران قابل دسترسی باشند.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.2", + "Ordinal": 2, + "Description": "در جایی که بک‌اند برنامه به URLهای خارجی فراخوانی می‌فرستد، طوری باید پیکربندی شده باشد که تنها در صورت نیاز و منظور مشخص، از تغییر مسیرها (redirects) پیروی کند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.3", + "Ordinal": 3, + "Description": "برنامه باید دارای تدابیر مقابله‌ای برای محافظت در برابر حملات mass assignment باشد، به‌طوری که فیلدهای مجاز برای هر کنترلر و اکشن محدود شده باشند؛ به عنوان مثال، نباید بتوان مقداری برای فیلدی وارد یا به‌روزرسانی کرد که قرار نبوده بخشی از آن اکشن باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.4", + "Ordinal": 4, + "Description": "تمام اجزای proxying و middleware باید آدرس IP اصلی کاربر را به‌درستی منتقل کنند، با استفاده از فیلدهای داده معتبر که توسط کاربر نهایی قابل دستکاری نباشند، و برنامه و وب‌سرور از این مقدار صحیح برای ثبت لاگ و تصمیم‌گیری‌های امنیتی مانند rate limiting استفاده کنند، با در نظر گرفتن اینکه حتی آدرس IP اصلی ممکن است به دلیل IPهای پویا، VPNها یا فایروال‌های سازمانی قابل اعتماد نباشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.5", + "Ordinal": 5, + "Description": "برنامه باید به‌طور صریح اطمینان حاصل کند که variables از نوع صحیح هستند و عملیات‌های مقایسه و comparator به‌صورت دقیق (strict) انجام می‌شوند. این اقدام برای جلوگیری از آسیب‌پذیری‌های type juggling یا type confusion است که ممکن است به دلیل فرضیات نادرست برنامه درباره نوع یک متغیر ایجاد شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.6", + "Ordinal": 6, + "Description": "کد JavaScript باید به‌گونه‌ای نوشته شده باشد که از prototype pollution جلوگیری کند، برای مثال با استفاده از Set() یا Map() به جای object literals.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.7", + "Ordinal": 7, + "Description": "برنامه باید دارای تدابیر محافظتی در برابر HTTP parameter pollution باشد، به‌ویژه اگر چارچوب برنامه تفاوتی بین منابع پارامترهای درخواست (رشته‌های query، پارامترهای body، کوکی‌ها یا فیلدهای هدر) قائل نشود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V15.4", + "Ordinal": 4, + "Name": "Safe Concurrency", + "Items": [ + { + "Shortcode": "V15.4.1", + "Ordinal": 1, + "Description": "shared objects در کد multi-threaded (مانند cacheها، فایل‌ها، یا اشیائی که توسط multiple threads دسترسی پیدا می‌کنند) باید به‌صورت ایمن مورد استفاده قرار بگیرند، با استفاده از نوع‌های thread-safe و مکانیزم‌های همگام‌سازی مانند lock یا semaphore تا از race condition و تخریب داده جلوگیری شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.4.2", + "Ordinal": 2, + "Description": "بررسی وضعیت یک resource، مانند وجود آن یا دسترسی‌ها،و اقداماتی که به این وضعیت وابسته‌اند، به‌صورت یک عملیات واحد انجام شوند تا از race condition نوع time-of-check to time-of-use (TOCTOU) جلوگیری شود. برای مثال، بررسی اینکه یک فایل وجود دارد قبل از باز کردن آن، یا تأیید دسترسی یک کاربر قبل از اعطای آن.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.4.3", + "Ordinal": 3, + "Description": "باید از قفل‌ها (Locks) به طور یکنواخت استفاده شود تا از گیر کردن (Threads) جلوگیری شود، چه با انتظار برای یکدیگر و چه با تلاش بی‌پایان، و همچنین منطق قفل‌گذاری باید در همان کدی باقی بماند که مسئول مدیریت منبع است؛ این کار تضمین می‌کند که قفل‌ها نمی‌توانند به‌صورت ناخواسته یا خرابکارانه توسط کلاس‌ها یا کدهای بیرونی تغییر داده شوند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.4.4", + "Ordinal": 4, + "Description": "تأیید کنید که سیاست‌های تخصیص resource از thread starvation جلوگیری می‌کنند، با اطمینان از دسترسی عادلانه به منابع، مانند استفاده از thread pools و اجازه دادن به threads با اولویت پایین‌تر تا در بازه زمانی منطقی پیشرفت کنند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V16", + "Ordinal": 16, + "ShortName": "Security", + "Name": "Security Logging and Error Handling", + "Items": [ + { + "Shortcode": "V16.1", + "Ordinal": 1, + "Name": "Security Logging Documentation", + "Items": [ + { + "Shortcode": "V16.1.1", + "Ordinal": 1, + "Description": "فهرستی باید وجود داشته باشد که در آن ثبت وقایع (Logging) انجام‌شده در هر لایه از stack فناوری برنامه، رویدادهای ثبت‌شده، فرمت‌های لاگ، محل ذخیره‌سازی، نحوه استفاده، نحوه کنترل دسترسی به آن‌ها و مدت زمان نگهداری لاگ‌ها مستند شده است.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V16.2", + "Ordinal": 2, + "Name": "General Logging", + "Items": [ + { + "Shortcode": "V16.2.1", + "Ordinal": 1, + "Description": "هر ورودی لاگ باید شامل متادیتای لازم (مانند زمان، مکان، چه کسی و چه چیزی) باشد تا امکان بررسی دقیق خط زمانی هنگام وقوع یک رویداد فراهم شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.2.2", + "Ordinal": 2, + "Description": "منابع زمانی برای تمام مؤلفه‌های لاگ با هم همگام‌سازی شده‌اند و مهر زمان (timestamp)‌ در متادیتای رویدادهای امنیتی از UTC استفاده ‌کند یا شامل یک اختلاف‌زمان (time zone offset) صریح باشد. استفاده از UTC توصیه می‌شود تا یکپارچگی در سراسر سیستم‌های توزیع‌شده تضمین شود و از بروز سردرگمی در زمان تغییر ساعت تابستانی جلوگیری گردد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.2.3", + "Ordinal": 3, + "Description": "برنامه تنها لاگ‌ها را در فایل‌ها و سرویس‌هایی ذخیره یا ارسال می‌کند که در فهرست مستند لاگ‌ها ثبت شده‌اند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.2.4", + "Ordinal": 4, + "Description": "لاگ‌ها باید توسط پردازشگر لاگی که در حال استفاده است خوانده و همبسته شوند، و ترجیحاً با استفاده از یک فرمت لاگ مشترک این کار انجام گیرد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.2.5", + "Ordinal": 5, + "Description": "هنگام لاگ‌گیری از داده‌های حساس، برنامه باید لاگ گیری را بر اساس سطح حفاظت داده اعمال کند. برای مثال، ممکن است لاگ‌کردن برخی داده‌ها مانند اطلاعات ورود یا جزئیات پرداخت مجاز نباشد. داده‌های دیگر، مانند session token، تنها در صورتی باید لاگ شوند که به‌صورت hash یا masked، چه به‌طور کامل یا جزئی، ثبت شوند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V16.3", + "Ordinal": 3, + "Name": "Security Events", + "Items": [ + { + "Shortcode": "V16.3.1", + "Ordinal": 1, + "Description": "تمام عملیات احراز هویت باید لاگ‌گیری ‌شوند، از جمله تلاش‌های موفق و ناموفق. همچنین باید متادیتای اضافی، مانند نوع احراز هویت یا عوامل استفاده‌شده، جمع‌آوری شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.3.2", + "Ordinal": 2, + "Description": "تلاش‌های ناموفق برای مجوزدهی (authorization) باید لاگ‌گیری ‌شوند. برای برنامه‌های L3، این باید شامل لاگ‌گیری تمام تصمیمات مجوزدهی باشد، از جمله ثبت زمانی که داده‌های حساس دسترسی پیدا می‌کنند، بدون آنکه خود داده‌های حساس ثبت شوند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.3.3", + "Ordinal": 3, + "Description": "برنامه باید رویدادهای امنیتی تعریف‌شده در مستندات (ابتدای بخش) را لاگ‌ نماید و همچنین تلاش‌ها برای دور زدن کنترل‌های امنیتی، مانند اعتبارسنجی ورودی، منطق کسب‌وکار و ضد‌خودکارسازی، را نیز ثبت ‌کند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.3.4", + "Ordinal": 4, + "Description": "برنامه باید خطاهای غیرمنتظره و شکست‌های کنترل‌های امنیتی، مانند شکست‌های TLS در بک اند را لاگ ‌کند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V16.4", + "Ordinal": 4, + "Name": "Log Protection", + "Items": [ + { + "Shortcode": "V16.4.1", + "Ordinal": 1, + "Description": "تمام مؤلفه‌های لاگ‌گیری باید داده‌ها را به‌طور مناسب رمزگذاری ‌کنند تا از حملات log injection جلوگیری شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.4.2", + "Ordinal": 2, + "Description": "لاگ‌ها باید در برابر دسترسی غیرمجاز محافظت شده و امکان تغییر آن‌ها وجود نداشته باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.4.3", + "Ordinal": 3, + "Description": "لاگ‌ها به‌صورت امن باید به یک سیستم منطقی جداگانه برای تحلیل، تشخیص، هشدار و ارجاع منتقل شوند. هدف این است که در صورت نفوذ به برنامه، لاگ‌ها به خطر نیفتند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V16.5", + "Ordinal": 5, + "Name": "Error Handling", + "Items": [ + { + "Shortcode": "V16.5.1", + "Ordinal": 1, + "Description": "هنگام بروز خطاهای غیرمنتظره یا حساس به امنیت، پیامی عمومی به کاربر باید بازگردانده ‌شود، به‌گونه‌ای که هیچ‌گونه اطلاعات حساس داخلی سیستم مانند stack trace، کوئری‌ها، کلیدها و توکن‌های محرمانه افشا نشود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.5.2", + "Ordinal": 2, + "Description": "برنامه باید هنگام بروز خطا در دسترسی به منابع خارجی همچنان به‌صورت امن عمل نماید، برای مثال با استفاده از الگوهایی مانند circuit breaker یا کاهش تدریجی عملکرد (graceful degradation).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.5.3", + "Ordinal": 3, + "Description": "برنامه باید به‌صورت امن و کنترل‌شده دچار خطا ‌شود، حتی هنگام وقوع استثنا، و از شرایط fail-open جلوگیری نماید؛ برای مثال، از پردازش تراکنش در صورت بروز خطا در منطق اعتبارسنجی جلوگیری شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.5.4", + "Ordinal": 4, + "Description": "یک « last resort» باید تعریف شده باشد که تمامی unhandled exception را مدیریت کند. این کار هم برای جلوگیری از از دست رفتن جزئیات خطا که باید در فایل‌های لاگ ثبت شوند و هم برای اطمینان از این است که خطا باعث از کار افتادن کل فرآیند برنامه و در نتیجه از دست رفتن دسترسی نشود، ضروری است.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V17", + "Ordinal": 17, + "ShortName": "WebRTC", + "Name": "WebRTC", + "Items": [ + { + "Shortcode": "V17.1", + "Ordinal": 1, + "Name": "TURN Server", + "Items": [ + { + "Shortcode": "V17.1.1", + "Ordinal": 1, + "Description": "سرویس Traversal Using Relays around NAT (TURN) باید تنها به آدرس‌های IP دسترسی دهد که برای اهداف ویژه رزرو نشده‌اند (مثلاً شبکه‌های داخلی، broadcast، loopback). توجه داشته باشید که این مورد هم برای آدرس‌های IPv4 و هم برای IPv6 صدق می‌کند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.1.2", + "Ordinal": 2, + "Description": "سرویس Traversal Using Relays around NAT (TURN)، نباید به resource exhaustion آسیب‌پذیر باشد، حتی زمانی که کاربران قانونی تلاش کنند تعداد زیادی پورت روی سرور TURN باز کنند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V17.2", + "Ordinal": 2, + "Name": "Media", + "Items": [ + { + "Shortcode": "V17.2.1", + "Ordinal": 1, + "Description": "کلید مربوط به گواهی Datagram Transport Layer Security (DTLS) بر اساس سیاست مستند مدیریت کلیدهای رمزنگاری مدیریت و محافظت می‌شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.2", + "Ordinal": 2, + "Description": "سرور Media طوری پیکربندی شده باشد که از مجموعه‌های رمزنگاری تاییدشده Datagram Transport Layer Security (DTLS) استفاده کند و از یک پروفایل محافظتی امن برای گسترش DTLS به منظور ایجاد کلیدها برای پروتکل Secure Real-time Transport Protocol (DTLS-SRTP) پشتیبانی نماید.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.3", + "Ordinal": 3, + "Description": "احراز هویت Secure Real-time Transport Protocol (SRTP) در سرور Media بررسی ‌شود تا از حملات تزریق Real-time Transport Protocol (RTP) جلوگیری شده و این حملات باعث بروز شرایط Denial of Service یا وارد شدن محتوای صوتی یا تصویری ناخواسته به جریان‌های رسانه‌ای نشوند.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.4", + "Ordinal": 4, + "Description": "سرور Media باید قادر باشد پردازش ترافیک رسانه‌ای ورودی را حتی هنگام مواجهه با بسته‌های Secure Real-time Transport Protocol (SRTP) ناقص یا خراب ادامه دهد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.5", + "Ordinal": 5, + "Description": "سرور Media باید قادر باشد پردازش ترافیک رسانه‌ای ورودی را حتی در هنگام دریافت سیلی(flood) از بسته‌های Secure Real-time Transport Protocol (SRTP) از کاربران قانونی ادامه دهد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.6", + "Ordinal": 6, + "Description": "سرور Media نسبت به آسیب‌پذیری \"ClientHello Race Condition \" در Datagram Transport Layer Security (DTLS) نباید آسیب‌پذیر نباشد، این کار می‌تواند با بررسی اینکه آیا سرور رسانه به‌صورت عمومی به عنوان آسیب‌پذیر شناخته شده است یا با انجام آزمون Race Condition انجام شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.7", + "Ordinal": 7, + "Description": "مکانیزم‌های ضبط صدا یا تصویر مرتبط با سرور رسانه در هنگام طوفان بسته‌ای (Flood) از پروتکل انتقال بلادرنگ امن (SRTP) توسط کاربران مجاز، باید قادر به ادامه پردازش ترافیک رسانه ورودی است.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.8", + "Ordinal": 8, + "Description": "گواهی‌نامه امنیت لایه انتقال دیتاگرام (DTLS) باید با ویژگی اثر انگشت (Fingerprint) پروتکل توصیف نشست (SDP) بررسی می‌شود و در صورت شکست در بررسی، جریان رسانه قطع می‌شود تا اصالت جریان رسانه تضمین گردد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V17.3", + "Ordinal": 3, + "Name": "Signaling", + "Items": [ + { + "Shortcode": "V17.3.1", + "Ordinal": 1, + "Description": "سرور سیگنالینگ باید قادر باشد حتی در جریان flood attack، پیام‌های سیگنالینگ ورودی مشروع را پردازش کند. این باید با اعمال محدودیت نرخ (rate limiting) در سطح سیگنالینگ محقق شود.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.3.2", + "Ordinal": 2, + "Description": "سرور سیگنالینگ باید قادر باشد پیام‌های سیگنالینگ مشروع را حتی در مواجهه با پیام‌های سیگنالینگ ناقص یا مخرب که می‌توانند باعث ایجاد شرایط عدم دسترسی (Denial of Service) شوند، پردازش کند. این می‌تواند شامل اعمال اعتبارسنجی ورودی، مدیریت ایمن سرریز عدد صحیح (integer overflow)، جلوگیری از سرریز بافر (buffer overflow) و استفاده از دیگر تکنیک‌های مقاوم مدیریت خطا باشد.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + } + ] +} diff --git a/5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.legacy.xml b/5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.legacy.xml new file mode 100644 index 0000000000..a5e5af7faa --- /dev/null +++ b/5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.legacy.xml @@ -0,0 +1 @@ +Application Security Verification Standard ProjectASVS5.0.0The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.V11EncodingEncoding and SanitizationV1.11ساختار Encoding and SanitizationV1.1.11ورودی فقط یک‌بار به فرم استاندارد decoded یا unescaped شود، و این تنها زمانی انجام شود که انتظار می‌رود داده واقعاً در آن قالب رمزگذاری‌شده دریافت شده باشد. این فرآیند باید قبل از هرگونه پردازش بعدی روی ورودی انجام شود، و به‌هیچ‌وجه نباید پس از اعتبارسنجی یا پاک‌سازی انجام گیرد.FalseTrue✓True✓V1.1.22برنامه فرآیند encode و escape خروجی را به‌عنوان آخرین مرحله انجام می‌دهد؛ به‌گونه‌ای که این عملیات یا دقیقاً پیش از استفاده داده در مفسر مربوطه انجام شود، یا اینکه خود مفسر به‌طور داخلی این کار را انجام دهد.FalseTrue✓True✓V1.22پیشگیری از تزریقV1.2.11encoding خروجی برای پاسخ HTTP، سند HTML یا سند XML با زمینه‌ای که داده در آن استفاده می‌شود باید متناسب باشد؛ برای مثال، در رمزگذاری کاراکترهای مربوط به عناصر HTML، صفات HTML، توضیحات HTML، CSS یا فیلدهای هدر HTTP به‌گونه‌ای عمل شود که ساختار پیام یا سند تغییر نکند.True✓True✓True✓V1.2.22هنگام ساخت پویا آدرس‌های URL، داده‌های غیرقابل‌اعتماد باید متناسب با زمینه استفاده‌شان رمزگذاری شوند (مثلاً URL Encoding یا base64url برای پارامترهای کوئری یا مسیر) همچنین اطمینان حاصل شود که فقط پروتکل‌های امن در URL مجاز باشند (برای نمونه، استفاده از JavaScript: یا data: ممنوع شود)True✓True✓True✓V1.2.33هنگام تولید پویا محتوای JavaScript (از جملهJSON)، از encoding یا escaping خروجی استفاده شود تا از تغییر ساختار پیام یا سند جلوگیری گردد (و از حملات تزریق JavaScript یا JSON پیشگیری شود).True✓True✓True✓V1.2.44در انتخاب داده یا اجرای کوئری‌های پایگاه داده (مانند SQL، HQL، NoSQL ...)، از parameterized queries، ORMها، یا Entity Framework استفاده شود یا به روش‌های دیگر، برنامه در برابر تزریق SQL و سایر حملات تزریقی پایگاه داده ایمن شده باشد. این موضوع هنگام نوشتن stored procedure‌ها نیز صدق می‌کند.True✓True✓True✓V1.2.55برنامه در برابر تزریق دستورات سیستم‌عامل (OS command injection) محافظت شده است و در فراخوانی‌های سیستم‌عامل، از کوئری‌های پارامتری‌شده سیستم‌عامل یا Encoding خروجی دستورات سیستم‌عاملی استفاده می‌شود.True✓True✓True✓V1.2.66برنامه در برابر آسیب‌پذیری‌های تزریق LDAP محافظت شده است، یا اینکه کنترل‌های امنیتی مشخصی برای جلوگیری از تزریق LDAP پیاده‌سازی شده‌اند.FalseTrue✓True✓V1.2.77برنامه در برابر حملات تزریقXPath، به‌وسیله‌ی استفاده از کوئری‌های پارامتری‌شده یا کوئری‌های از پیش‌کامپایل‌شده محافظت شده باشد.FalseTrue✓True✓V1.2.88پردازشگرهای LaTeX به‌صورت امن پیکربندی شده‌اند (برای نمونه با عدم استفاده از گزینه‌ی --shell-escape ) و از فهرست مجاز دستورات (allowlist) برای جلوگیری از حملات تزریق LaTeX استفاده شده است.FalseTrue✓True✓V1.2.99برنامه کاراکترهای ویژه در عبارات Regex را escape می‌کند (معمولاً با استفاده از \)، تا این کاراکترها به‌اشتباه به‌عنوان متاکاراکتر تفسیر نشوند.FalseTrue✓True✓V1.2.1010برنامه در برابر حملات تزریق CSV و فرمول (Formula Injection) محافظت شده است. برنامه باید هنگام خروجی‌ گرفتن فایل‌های CSV، از قوانین escape تعیین‌شده در بخش‌های ۲.۶ و ۲.۷ استاندارد RFC 4180 پیروی کند. همچنین، هنگام خروجی گرفتن به فرمت CSV یا سایر فرمت‌های صفحه‌گسترده (مانند XLS، XLSX یا ODF)، اگر کاراکترهای ویژه‌ای مانند '='، '+'، '-'، '@'، \t (tab) و 0\ (Null character) در ابتدای مقدار یک فیلد قرار داشته باشند، باید با یک تک‌کوتیشن (') escape شوند.FalseFalseTrue✓V1.33پاک‌سازی (Sanitization)V1.3.11تمام ورودی‌های HTML غیرقابل اعتماد (مثلاً از طریق ویرایشگرهای WYSIWYG یا ابزارهای مشابه)، با استفاده از یک کتابخانه یا قابلیت امن و معتبر sanitization (پاک‌سازی) ‌شوند.True✓True✓True✓V1.3.22برنامه استفاده از تابعeval یا سایر قابلیت‌های اجرای پویا (dynamic) کد، مانند Spring Expression Language (SpEL)، اجتناب ‌کند. در مواردی که استفاده از این قابلیت‌ها اجتناب‌ناپذیر است، ورودی‌های کاربر که در اجرای کد گنجانده می‌شوند باید پیش از اجرا، به‌طور کامل پاک‌سازی (sanitized) شوند.True✓True✓True✓V1.3.33بخش‌های حائز اهمیت که احتمال وقوع حملات ناشی از ورودی‌های کاربر در آنها بالاست؛ باید پیشاپیش عملیاتSanitization جهت اقدامات ایمنی روی داده‌ها انجام شود؛ برای مثال، تنها کاراکترهایی که برای آن محتوا ایمن محسوب می‌شوند مجاز باشند، و ورودی‌های بیش‌از‌حد بلند نیز کوتاه (trim) شوند.FalseTrue✓True✓V1.3.44محتوای اسکریپت‌پذیر (scriptable) فایل‌های SVG که توسط کاربر ارائه می‌شود، مورد اعتبارسنجی یا پاک‌سازی (sanitization) قرار گرفته باشد تا فقط شامل تگ‌ها و ویژگی‌هایی (attributes) باشد که برای برنامه ایمن هستند؛ برای مثال، از درج اسکریپت‌ها و عناصر خطرناک مانند foreignObject جلوگیری شده باشد.FalseTrue✓True✓V1.3.55برنامه محتوای زبان‌های قالب‌نویسی یا اسکریپت‌پذیر ارائه‌شده توسط کاربر، مانند Markdown، CSS یا استایل‌شیت‌های XSL، BBCode یا موارد مشابه را پاک‌سازی (sanitize) کرده یا غیرفعال کرده باشد.FalseTrue✓True✓V1.3.66برنامه در برابر حملات جعل درخواست سمت سرور (SSRF) محافظت شده باشد؛ به این صورت که داده‌های غیرقابل اعتماد را در برابر یک لیست مجاز از پروتکل‌ها، دامنه‌ها، مسیرها و پورت‌ها اعتبارسنجی کرده و کاراکترهای بالقوه خطرناک را پیش از استفاده از داده برای فراخوانی سرویس دیگر پاک‌سازی (sanitize) می‌کند.FalseTrue✓True✓V1.3.77برنامه در برابر حملات تزریق قالب (Template Injection) محافظت شده باشد؛ به این صورت که ساخت قالب‌ها بر پایه داده‌های غیرقابل اعتماد مجاز نباشد. در صورتی که هیچ راه‌حل جایگزینی وجود نداشته باشد، هرگونه ورودی غیرقابل اعتماد که به‌صورت پویا در فرآیند ایجاد قالب وارد می‌شود، باید پیش از استفاده یا پاک‌سازی (sanitize) شود یا به‌صورت سخت‌گیرانه اعتبارسنجی (validate) گردد.FalseTrue✓True✓V1.3.88برنامه، ورودی غیرقابل اعتماد را پیش از استفاده در کوئری‌های Java Naming and Directory Interface (JNDI) به‌درستی پاک‌سازی (sanitize) می‌کند و همچنین اطمینان حاصل شود که پیکربندی JNDI به‌گونه‌ای امن انجام شده تا از بروز حملات تزریق JNDI جلوگیری شود.FalseTrue✓True✓V1.3.99برنامه، محتوا را پیش از ارسال به memcache پاک‌سازی (sanitize) می‌کند تا از حملات تزریق (injection attacks) جلوگیری شود.FalseTrue✓True✓V1.3.1010رشته‌های قالب‌بندی (format strings) که ممکن است هنگام استفاده، به‌شکلی ناخواسته یا مخرب تفسیر شوند، پیش از پردازش پاک‌سازی (sanitize) شوند.FalseTrue✓True✓V1.3.1111برنامه ورودی‌های کاربر را پیش از ارسال به سامانه‌های ایمیل (مانند SMTP یا IMAP) پاک‌سازی (sanitize) ‌کند تا از حملات تزریق در SMTP یا IMAP جلوگیری شود.FalseTrue✓True✓V1.3.1212عبارات منظم (Regular Expressions) عاری از اجزایی هستند که باعث بازگشت‌پذیری نمایی (exponential backtracking) می‌شوند، و همچنین ورودی‌های غیرقابل اعتماد به‌درستی پاک‌سازی (sanitize) شوند تا از حملات ReDoS (انکار سرویس با استفاده از عبارات منظم) یا Runaway Regex جلوگیری گردد.FalseFalseTrue✓V1.44حافظه، رشته و کد بدون مدیریت (Memory, String, and Unmanaged Code)V1.4.11برنامه از رشته‌های ایمن از نظر مدیریت حافظه، کپی حافظه‌ای ایمن‌تر و حساب‌گری ایمن‌تر روی اشاره‌گرها استفاده می‌کند تا از سرریز پشته (stack overflow)، سرریز بافر (buffer overflow) یا سرریز حافظه پویای (heap overflow) جلوگیری کرده یا آن‌ها را شناسایی کند.FalseTrue✓True✓V1.4.22از تکنیک‌های اعتبارسنجی علامت (sign validation)، محدوده (range validation) و ورودی (input validation) استفاده شده است تا از بروز سرریز عدد صحیح (integer overflow) جلوگیری شود.FalseTrue✓True✓V1.4.33حافظه و منابعی که به‌صورت پویا تخصیص داده شده‌اند، به‌درستی آزاد (release) می‌شوند و همچنین ارجاع‌ها یا اشاره‌گرها (pointers) به حافظه آزادشده حذف یا به null تنظیم می‌شوند تا از اشاره‌گرهای معلق (dangling pointers) و آسیب‌پذیری‌های استفاده پس از آزادسازی (use-after-free) جلوگیری شود.FalseTrue✓True✓V1.55سریال‌زدایی ایمن (Safe Deserialization)V1.5.11برنامه، XML Parserها را به‌گونه‌ای پیکربندی کرده باشد که از تنظیمات محدودکننده استفاده کنند، و ویژگی‌های ناایمنی مانند resolve کردن موجودیت‌های خارجی (external entities) غیرفعال شده باشند تا از حملات XML External Entity (XXE) جلوگیری شود.True✓True✓True✓V1.5.22فرآیند deserialization داده‌های غیرقابل‌اعتماد، با اجرای مدیریت ایمن ورودی‌ها همراه باشد؛ برای مثال، استفاده از لیست مجاز (allowlist) انواع objectها یا محدود کردن انواع تعریف‌شده توسط کلاینت برای جلوگیری از حملات مرتبط با deserialization. همچنین، مکانیزم‌های deserialization که به‌طور صریح به‌عنوان ناایمن شناخته شده‌اند، نباید با داده‌های غیرقابل‌اعتماد مورد استفاده قرار گیرند.FalseTrue✓True✓V1.5.33Parser های مختلفی که در برنامه برای یک نوع داده مشخص استفاده می‌شوند (برای مثال: Parser های JSON، XML یا URL)، رفتار تحلیلی یکسانی دارند و از مکانیزم یکسانی برای encoding کاراکترها استفاده می‌کنند، تا از بروز مشکلاتی مانند آسیب‌پذیری در سازگاری JSON (JSON Interoperability) یا تفاوت در نحوه تحلیل URI یا مسیر فایل که ممکن است در حملات RFI یا SSRF سوءاستفاده شود، جلوگیری شود.FalseFalseTrue✓V22ValidationValidation and Business LogicV2.11مستندات اعتبارسنجی و منطق کسب‌وکار ( Validation and Business Logic Documentation)V2.1.11قوانین اعتبارسنجی ورودی‌های برنامه (مندرج در مستندات برنامه) ‌باید چگونگی بررسی صحت داده‌ها را مطابق با ساختار مورد انتظار مشخص نماید. این ساختار می‌تواند شامل فرمت‌های رایج داده مانند شماره کارت اعتباری، آدرس ایمیل، شماره تلفن یا یک قالب داده‌ای داخلی باشد.True✓True✓True✓V2.1.22قوانین اعتبارسنجی ورودی‌های برنامه (مندرج در مستندات برنامه) باید چگونگی بررسی سازگاری مناسب بین داده‌‌های ترکیب شده (از نظر مفهومی و متنی) را مشخص نماید؛ مانند تطبیق کدپستی با نام محله.FalseTrue✓True✓V2.1.33انتظارات مربوط به محدودیت‌ها و اعتبارسنجی‌های منطق کسب و کار مستند شده باشند؛ این مستندات باید شامل محدودیت‌ها در سطح هر کاربر و محدودیت‌های عمومی در سطح برنامه باشند.FalseTrue✓True✓V2.22اعتبارسنجی ورودی (Input Validation)V2.2.11ورودی‌ها باید به‌منظور اعمال انتظارات کسب و کار یا عملکردی مرتبط با آن‌ها اعتبارسنجی ‌شوند.این اعتبارسنجی باید یکی از این دو روش زیر را داشته باشد، استفاده از اعتبارسنجی مثبت (Positive Validation) مبتنی بر فهرست مجاز از مقادیر، الگوها یا بازه‌های قابل قبول و تطبیق با ساختار مورد انتظار و محدودیت‌های منطقی، بر اساس قوانین از پیش تعریف‌شده. برای سطح 1 (L1)، تمرکز می‌تواند بر ورودی‌هایی باشد که در تصمیم‌گیری‌های خاص تجاری یا امنیتی استفاده می‌شوند. برای سطح 2 و بالاتر، این اعتبارسنجی باید شامل تمام ورودی‌ها باشد.True✓True✓True✓V2.2.22برنامه به‌گونه‌ای طراحی شود که اعتبارسنجی ورودی را در لایه‌ قابل اعتمادی از سرویس (Trusted Service Layer) اعمال کند. هرچند اعتبارسنجی سمت کلاینت (Client-side Validation) باعث بهبود تجربه کاربری می‌شود و توصیه می‌گردد، اما نباید به‌عنوان یک کنترل امنیتی اتکا شود.True✓True✓True✓V2.2.33برنامه باید اطمینان حاصل نماید که ترکیب داده‌های مربوطه با توجه به قوانین از پیش تعریف‌شده معقول و منطقی باشد.FalseTrue✓True✓V2.33امنیت منطق کسب‌وکار (Business Logic Security)V2.3.11اطمینان حاصل شود که برنامه فقط جریان‌های منطق تجاری را برای همان کاربر و طبق ترتیب گام‌به‌گام از پیش تعیین شده و مورد انتظار پردازش می‌کند و امکان رد کردن مراحل (Skipping Steps) وجود ندارد.True✓True✓True✓V2.3.22اطمینان حاصل شود که محدودیت‌های منطق تجاری مطابق با مستندات برنامه پیاده‌سازی شده‌اند، تا از سوء‌استفاده از نقص‌های منطقی جلوگیری شود.FalseTrue✓True✓V2.3.33تراکنش‌های سطح منطق کسب‌وکار (business logic) باید به‌گونه‌ای استفاده شوند که یا یک عملیات منطق کسب‌وکار به‌طور کامل با موفقیت انجام شود، یا در صورت بروز خطا، به حالت صحیح قبلی بازگردد(rollback) شود.FalseTrue✓True✓V2.3.44در منطق کسب‌وکار (business logic)باید از مکانیزم‌های قفل‌گذاری (locking) استفاده شده باشد تا اطمینان حاصل شود که منابع محدود (مانند صندلی‌های سینما یا بازه‌های زمانی تحویل)، قابل رزرو دوباره (double-booked) از طریق دستکاری منطق برنامه نباشند.FalseTrue✓True✓V2.3.55اطمینان حاصل شود که جریان‌های منطق کسب و کاری با ارزش بالا نیازمند تایید چند کاربره (Multi-user Approval) هستند تا از اقدامات غیرمجاز یا تصادفی جلوگیری شود. این موارد می‌تواند شامل – اما نه محدود به – انتقال‌های مالی بزرگ، تایید قرارداد‌ها، دسترسی به اطلاعات طبقه‌بنده شده، یا غیرفعال‌سازی‌های ایمنی در محیط‌های تولید صنعتی باشد.FalseFalseTrue✓V2.44مقابله با خودکارسازی (Anti-automation)V2.4.11کنترل‌های ضد خودکارسازی (Anti-Automation) در سیستم پیاده‌سازی شده باشند تا از سوءاستفاده‌هایی مانند فراخوانی بیش از حد توابع برنامه جلوگیری شود؛ چرا که این نوع حملات می‌توانند منجر به استخراج غیرمجاز داده‌ها، تولید داده‌های زائد، مصرف کامل سهمیه‌ها، عبور از محدودیت‌های نرخ (Rate Limit)، ایجاد اختلال در سرویس (DoS) یا استفاده بیش از حد از منابع گران‌قیمت شوند.FalseTrue✓True✓V2.4.22بررسی کنید که جریان‌های منطق کسب‌وکار (Business Logic Flows) به گونه‌ای طراحی شده باشند که نیازمند زمان‌بندی واقعی انسان باشند، و از ارسال سریع و غیرطبیعی تراکنش‌ها (Transaction Submissions) جلوگیری کنند.FalseFalseTrue✓V33Webامنیت رابط کاربری وب (Web Frontend Security)V3.11مستندسازی امنیت رابط کاربری وب ( Web Frontend Security Documentation)V3.1.11در مستندات برنامه باید ویژگی‌های امنیتی مربوط به مرورگری که برنامه را اجرا میکند مشخص شده باشد (نظیر استفاده از HTTPS، پشتیبانی از HTTP Strict Transport Security (HSTS)، اجرای Content Security Policy (CSP) و سایر مکانیزم‌های امنیتی مرتبط با HTTP). همچنین در مستندات باید مشخص شود مرورگر در صورت عدم دسترسی به این ویژگی‌ها چه رفتاری باید داشته باشد. (برای مثال: نمایش هشدار به کاربر یا ممانعت از دسترسی به برنامه).FalseFalseTrue✓V3.22تفسیر ناخواسته محتوا (Unintended Content Interpretation)V3.2.11کنترل‌های امنیتی متناسب با مرورگر‌ها در هنگام پردازش پاسخ‌های HTTP به منظور جلوگیری از پردازش محتوا یا عملکرد مربوط به آن در شرایط زمینه‌‌ای نادرست باید بکار‌گرفته شود. (برای مثال، زمانی که یک APIیا یک فایل بارگذاری‌شده توسط کاربر یا هر منبع دیگری به‌طور مستقیم درخواست می‌شود).کنترل‌های ممکن می‌توانند شامل این موارد باشند: عدم پردازش محتوا مگر در صورت وجود هدرهای متناسب با درخواست‌های HTTP (مانند ‎Sec-Fetch-*) به منظور اطمیان از صحیح بودن پردازش محتوا یا عملکرد مربوط به . استفاده از عبارت sandbox در هدر Content-Security-Policy یا استفاده از نوعattachment در هدر Content-Disposition .True✓True✓True✓V3.2.22اطمینان حاصل شود که محتوایی که برای نمایش به‌صورت متن طراحی شده نه برای پردازش به صورتHTML ، با استفاده از توابع امن نظیر CreateTextNode یا textContent به منظور جلوگیری از اجرای ناخواسته محتوایی مانند HTML یا JavaScript پردازش ‌شود.True✓True✓True✓V3.2.33برنامه هنگام استفاده از جاوااسکریپت سمت کاربر (Client-Side JavaScript)، با استفاده از اعلام متغیرها به‌صورت صریح، انجام بررسی نوع به‌صورت سخت‌گیرانه، اجتناب از ذخیره‌سازی متغیرهای سراسری بر روی شیء document، و پیاده‌سازی ایزولاسیون فضای نام (namespace isolation)، از وقوع DOM Clobbering جلوگیری می‌کند.FalseFalseTrue✓V3.33پیکربندی کوکی (Cookie Setup)V3.3.11اطمینان حاصل شود که کوکی‌ها دارای ویژگی ‘Secure’ هستند. در صورتی که از پیشوند ‘__Host-’ برای نام کوکی استفاده نمی‌شود، باید پیشوند__Secure- در نام کوکی لحاظ شده باشد.True✓True✓True✓V3.3.22اطمینان حاصل شود که مقدار ویژگی SameSite برای هر کوکی، متناسب با هدف آن کوکی تنظیم شده باشد تا میزان آسیب‌پذیری در برابر حملات فریب سمت کلاینت نظیر CSRF کاهش یابد.FalseTrue✓True✓V3.3.33اطمینان حاصل شود که کوکی‌ها از پیشوند __Host- در نام خود استفاده می‌کنند، مگر در مواردی که کوکی به‌طور مشخص برای اشتراک‌گذاری بین چند دامنه (Hosts) طراحی شده باشد.FalseTrue✓True✓V3.3.44اطمینان حاصل شود که اگر مقدار کوکی (مثلاً توکن نشست) نباید برای اسکریپت‌های سمت کلاینت در دسترس باشد، ویژگی HttpOnly باید برای آن کوکی فعال شده باشد، و همچنین مقدار کوکی (مثلاً همان توکن نشست) تنها از طریق هدر Set-Cookie به کلاینت ارسال شود.FalseTrue✓True✓V3.3.55اطمینان حاصل شود که حداکثر مجموع نام و مقدار کوکی از ۴۰۹۶ بایت تجاوز نکند.کوکی‌هایی که بیش از این مقدار باشند توسط مرورگر ذخیره نخواهند شد، و بنابراین در درخواست‌ها ارسال نمی‌شوند؛ موضوعی که ممکن است باعث شود عملکردهایی از برنامه که به آن کوکی وابسته‌اند، غیرفعال یا مختل شوند.FalseFalseTrue✓V3.44هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers)V3.4.11اطمینان حاصل شود که در تمامی پاسخ‌های HTTP، هدر Strict-Transport-Security وجود دارد تا سیاست HSTS (HTTP Strict Transport Security) اعمال شود. حداقل مقدار max-age باید برابر با یک سال باشد. برای برنامه‌های سطح 2 (L2) و بالاتر، این سیاست باید برای تمام زیردامنه‌ها (subdomains) نیز اعمال شود.True✓True✓True✓V3.4.22اطمینان حاصل شود که هدرAccess-Control-Allow-Origin مربوط به (CORS)، دارای یک مقدار ثابت و مشخص توسط برنامه باشد یا اگر هدر Origin در درخواست مورد استفاده قرار می گیرد باید با فهرستی از مبدأهای مورد اعتماد (Allowlist) اعتبارسنجی شود. در صورتی که استفاده از مقدار * در Access-Control-Allow-Origin تنظیم شده باشد، اطمینان حاصل شود که هیچ اطلاعات حساسی در پاسخ قرار ندارد.True✓True✓True✓V3.4.33اطمینان حاصل شود که تمامی پاسخ‌های HTTP شامل هدر Content-Security-Policy باشند تا ریسک اجرای اسکریپت‌های مخرب (مانند (JavaScript مخرب کاهش یابد. دستورهای object-src 'none' و base-uri 'none' الزامی هستند .برای برنامه‌های سطح 3 (L3)، باید سیاست CSP به‌صورت اختصاصی برای هر پاسخ(Per-response Policy) و مبتنی بر nonce یا hash تعریف شده باشد.FalseTrue✓True✓V3.4.44اطمینان حاصل شود که تمامی پاسخ‌ها شامل هدر X-Content-Type-Options: nosniff باشند، این (هدر) به مرورگرها دستور می‌دهد که برای پاسخ دریافتی از Content Sniffing یا حدس‌زدن نوع محتوا (MIME Type Guessing) استفاده نکنند و آن‌ها را ملزم می‌کند که نوع محتوای واقعی را دقیقاً مطابق مقدار هدر Content-Type در درخواست/پاسخ در نظر بگیرند.برای مثال، پاسخ به یک درخواست برای یک فایل استایل (CSS) تنها در صورتی پذیرفته می‌شود که مقدار Content-Type در پاسخ 'text/css' باشد.این کار همچنین امکان استفاده از قابلیت مسدودسازی خواندن منابع از مبدا متفاوت Cross-Origin Read Blocking یا (CORB) توسط مرورگر را فراهم می‌سازد.FalseTrue✓True✓V3.4.55برنامه باید (وب‌سایت یا اپلیکیشن) یک "Referrer Policy" (سیاست ارجاع) تنظیم کرده باشد تا از نشت اطلاعات حساس از طریق هدر HTTP به نام Referer به سرویس‌های شخص ثالث جلوگیری شود. این کار را می‌توان از طریق هدر پاسخ HTTP به نام Referrer-Policy یا با استفاده از ویژگی‌هایی در عناصر HTML انجام داد.اطلاعات حساس ممکن است شامل مسیر (Path) و داده‌های کوئری (Query) در آدرس URL باشد، و در مورد برنامه‌های داخلی و غیرعمومی، حتی نام میزبان (hostname) نیز می‌تواند جزو اطلاعات حساس محسوب شود.FalseTrue✓True✓V3.4.66برنامه باید از frame-ancestors در هدر Content-Security-Policy (CSP) برای تمام پاسخ‌های HTTP استفاده کند،تا به‌صورت پیش‌فرض، اجازه‌ی نمایش سایت در قالب iframe داده نشود، و فقط در صورت نیاز، نمایش منابع خاص (specific resources) در iframe مجاز باشد.به این نکته توجه کنید که هدر X-Frame-Options با اینکه هنوز توسط برخی مرورگرها پشتیبانی می‌شود، اما قدیمی (obsolete) است و نباید به آن تکیه کرد.FalseTrue✓True✓V3.4.77هدر Content-Security-Policy (CSP) باید شامل یک آدرس برای گزارش (Report violation) باشد.FalseFalseTrue✓V3.4.88تمام پاسخ‌های HTTP که باعث رندر (نمایش) یک سند می‌شوند مانند (پاسخ‌هایی با نوع محتوا (text/html باید شامل هدر Cross-Origin-Opener-Policy با دستور same-origin یا same-origin-allow-popups باشند (بنا به نیاز). این کار از حملاتی جلوگیری می‌کند که از دسترسی مشترک به اشیای Window سوءاستفاده می‌کنند، مانند حملات tabnabbing و frame counting.FalseFalseTrue✓V3.55تفکیک مبدا توسط مرورگر (Browser Origin Separation)V3.5.11برنامه باید از مکانیزم Preflight در CORS برای جلوگیری از درخواست‌های cross-origin به عملکردهای حساس استفاده نمی‌کند، این درخواست‌ها به‌گونه‌ای اعتبارسنجی شوند که فقط از مبدأ اصلی برنامه ارسال شده باشند. این اعتبارسنجی می‌تواند با استفاده از توکن‌های (anti- forgery tokens) یا الزام به ارسال هدرهای HTTP اضافی انجام شود که در لیست هدرهای مجاز CORS (CORS-safelisted) قرار ندارند. این اقدام برای محافظت در برابر حملات جعل درخواست از طریق مرورگر، که با نام CSRF (Cross-Site Request Forgery) شناخته می‌شوند، ضروری است.True✓True✓True✓V3.5.22اگر برنامه برای جلوگیری از استفاده غیرمجاز cross-origin از عملکردهای حساس، به مکانیزم Preflight در CORS متکی است، باید امکان فراخوانی این عملکردها با درخواست‌هایی که باعث ایجاد Preflight نمی‌شوند، وجود نداشته باشد. برای تحقق این هدف ممکن است لازم باشد مقدار هدرهای Origin و Content-Type بررسی شوند یا از هدر اضافی استفاده شود که در لیست هدرهای مجاز CORS قرار ندارد.True✓True✓True✓V3.5.33برنامه باید درخواست‌های HTTP که به عملکردهای حساس از متدهای مناسب مانند POST، PUT، PATCH یا DELETE استفاده می‌کنند، و نه از متدهایی که در استاندارد HTTP به‌عنوان "ایمن" تعریف شده‌اند، مانند GET، HEAD یا .OPTIONS به عنوان جایگزین یا مکمل، می‌توان از بررسی سخت‌گیرانه هدرهای Sec-Fetch-* استفاده کرد تا اطمینان حاصل شود که درخواست از منبع نامناسبی مثل بارگذاری تصویر، ناوبری صفحه یا فراخوانی cross-origin ارسال نشده است.True✓True✓True✓V3.5.44برنامه‌های مجزا باید روی نام‌های دامنه (hostname) متفاوت میزبانی شده‌اند تا از محدودیت‌های ارائه‌شده توسط (Same-Origin Policy) بهره‌مند شوند. این شامل کنترل تعامل اسناد یا اسکریپت‌های بارگذاری‌شده از یک مبدأ با منابع مبدأ دیگر و اعمال محدودیت بر اساس دامنه برای کوکی‌ها می‌شود.FalseTrue✓True✓V3.5.55برنامه باید پیام‌های دریافت‌شده از طریق رابط postMessage در صورتی که مبدأ پیام مورد اعتماد نباشد یا ساختار پیام نامعتبر باشد، نادیده گرفته می‌شوند.FalseTrue✓True✓V3.5.66هیچ‌کجای برنامه از قابلیت JSONP استفاده نشود تا از حملات Cross-Site Script Inclusion (XSSI) جلوگیری شود.FalseFalseTrue✓V3.5.77داده‌هایی که نیاز به احراز هویت دارند، در پاسخ‌های مربوط به منابع اسکریپتی(مانند فایل‌های (JavaScript نباید قرار بگیرند تا از حملات XSSI جلوگیری شود.FalseFalseTrue✓V3.5.88اطمینان حاصل کنید که منابع احراز هویت‌شده (مانند تصاویر، ویدیوها، اسکریپت‌ها و سایر اسناد) فقط در مواقعی که هدف آن است، قابل بارگذاری یا جاسازی توسط کاربر باشند. این کار را می‌توان با اعتبارسنجی دقیق هدرهای HTTP مانند Sec-Fetch-* انجام داد تا اطمینان حاصل شود که درخواست از یک منبع غیرمجاز ارسال نشده است، یا با تنظیم هدر Cross-Origin-Resource-Policy برای محدود کردن دسترسی مرورگر به محتوا.FalseFalseTrue✓V3.66یکپارچگی منابع خارجی (External Resource Integrity)V3.6.11منابع سمت کلاینت مانند کتابخانه‌های جاوااسکریپت، فایل‌های CSS، یا فونت‌های وب، تنها در صورتی به‌صورت خارجی (مثلاً از طریق شبکه تحویل محتوا - CDN) میزبانی شوند که آن منابع: استاتیک (تغییرناپذیر) باشند، نسخه‌گذاری‌شده (versioned) باشند و یکپارچگی آن‌ها با استفاده از Subresource Integrity (SRI) بررسی شود. اگر این موارد امکان‌پذیر نیست، باید برای هر منبع، یک تصمیم امنیتی مستند وجود داشته باشد که توجیه کند چرا این منبع به این شکل بارگذاری می‌شود.FalseFalseTrue✓V3.77سایر ملاحظات امنیتی مرورگر (Other Browser Security Considerations)V3.7.11برنامه صرفا باید از فناوری‌های سمت کلاینتی استفاده ‌کند که همچنان پشتیبانی می‌شوند و از نظر امنیتی قابل اعتماد هستند.مثال‌هایی از فناوری‌هایی که این الزام را برآورده نمی‌کنند عبارتند از NSAPI Plugins،Flash،Shockwave،ActiveX،Silverlight،NACL و Appletهای جاوا در سمت کلاینتFalseTrue✓True✓V3.7.22برنامه فقط زمانی کاربر را به دامنه‌ها یا hostnameهای دیگر (که تحت کنترل برنامه نیستند) به صورت خودکار هدایت می‌کند، که آن مقصد در یک فهرست مجاز (allowlist) قرار داشته باشد.FalseTrue✓True✓V3.7.33برنامه باید هنگام ریدایرکت کاربر به یک URL که خارج از کنترل برنامه است، یک پیام هشدار نشان می‌دهد و امکان لغو آن را به کاربر می‌دهد.FalseFalseTrue✓V3.7.44باید دامنه اصلی برنامه، مثلاً (site.tld) به فهرست preload عمومی HSTS اضافه شده باشد.FalseFalseTrue✓V3.7.55اگر مرورگر کاربر از ویژگی‌های امنیتی مورد انتظار برنامه پشتیبانی نمی‌کند، برنامه رفتار مناسبی داشته باشد، مثل هشدار دادن به کاربر یا مسدود کردن دسترسی.FalseFalseTrue✓V44APIAPI and Web ServiceV4.11Generic Web Service SecurityV4.1.11اطمینان حاصل شود که در هر پاسخ HTTP که شامل Body می باشد، هدر Content-Type وجود داشته باشد که نوع آن، با محتوای پاسخ دریافتی از سرور مطابقت داشته باشد. این هدر باید شامل پارامتر charset نیز باشد تا رمزگذاری کاراکتر ایمن (مانند UTF-8 یا ISO-8859-1) را مشخص کند. این مقادیر باید مطابق با استاندارد IANA Media Types باشند؛ برای مثال، انواعی مانند "text/، /+xml" و "/xml" را در بر می‌گیرند.True✓True✓True✓V4.1.22اطمینان حاصل شود که تنها نقاط پایانی که برای استفاده کاربر نهایی از طریق مرورگر طراحی شده‌اند (User-Facing Endpoints) به‌صورت خودکار از HTTP به HTTPS هدایت ‌شوند، سایر سرویس‌ها یا نقاط پایانی نباید (ریدایرکت شفاف، Transparent Redirect) داشته باشند. این اقدام برای جلوگیری از وضعیتی است که در آن یک کلاینت به اشتباه درخواست‌های رمزنگاری‌نشده (HTTP) ارسال می‌کند، اما چون این درخواست‌ها به‌طور خودکار به HTTPS ریدایرکت می‌شوند، نشت احتمالی داده‌های حساس پنهان خواهد ماند.FalseTrue✓True✓V4.1.33اطمینان حاصل شود که هدرهای HTTP که در برنامه استفاده می شود و توسط یک لایه واسطه، مانند یکload balancer ، یک پروکسی وب یا یک سرویس backend-for-frontend تنظیم شده است نمی‌تواند توسط کاربر نهایی بازنویسی شود. هدرهای نمونه ممکن است شامل X-Real-IP، X-Forwarded-* یا X-User-ID باشند.FalseTrue✓True✓V4.1.44اطمینان حاصل شود که فقط متدهای HTTP که صریحاً توسط برنامه یا API آن پشتیبانی می‌شوند (از جمله OPTIONS در درخواست‌های preflight) می‌توانند مورد استفاده قرار گیرند و متدهای استفاده نشده مسدود شوند.FalseFalseTrue✓V4.1.55اطمینان حاصل شود که برای درخواست‌ها یا تراکنش‌هایی که بسیار حساس هستند یا از چندین سامانه عبور می‌کنند، از امضاهای دیجیتال در سطح پیام استفاده شود تا اطمینان امنیتی بیشتری علاوه بر محافظت‌های سطح انتقال (مانند TLS) فراهم گردد.FalseFalseTrue✓V4.22HTTP Message Structure ValidationV4.2.11اطمینان حاصل شود که تمامی اجزای برنامه )از جمله لود بالانسرها، فایروال‌ها و سرورهای اپلیکیشن( مرزهای پیام‌های HTTP ورودی را با استفاده از مکانیزم مناسب نسخه های HTTP تعیین می‌کنند تا از حملات HTTP request smuggling جلوگیری شود. در HTTP/1.x اگر هدر Transfer-Encoding وجود داشته باشد، هدر Content-Length باید مطابق RFC 2616 نادیده گرفته شود. در مقابل، هنگام استفاده از HTTP/2 یا HTTP/3، اگر هدر Content-Length وجود داشته باشد، گیرنده باید اطمینان حاصل کند که این مقادیر با طول فریم‌های DATA سازگار می‌باشد.FalseTrue✓True✓V4.2.22اطمینان حاصل شود که هنگام تولید پیام‌های HTTP، هدر Content-Length با طول محتوایی که توسط چارچوب‌بندی پروتکل HTTP تعیین می‌شود، تداخل نداشته باشد تا از حملات request smuggling جلوگیری شود.FalseFalseTrue✓V4.2.33اطمینان حاصل شود برنامه، پیام‌های HTTP/2 یا HTTP/3 با هدرهای connection-specific مانند Transfer-Encoding را به منظور جلوگیری از حملات response splitting یا header injection ارسال یا قبول نمی کند.FalseFalseTrue✓V4.2.44اطمینان حاصل شود برنامه تنها درخواست های HTTP/2 and HTTP/3 که هدرها و مقادیر آن شامل هیچ توالی CR (\r), LF (\n), CRLF (\r\n) نباشد را می پذیرد تا از حملات header injection جلوگیری کند.FalseFalseTrue✓V4.2.55اطمینان حاصل کنید که اگر برنامه (Frontend or Backend) اقدام به ساخت و ارسال درخواست‌های HTTP می کند از مکانیزم های validation ، sanitization یا سایر مکانیزم‌ها استفاده کند تا از ایجاد URIها (مانند فراخوانیAPI ) یا فیلدهای هدر درخواست HTTP (مانند Authorization یا( Cookie که بیش از حد مجاز، طولانی هستند، جلوگیری شود که منجر به عدم پذیرش درخواست توسط مولفه دریافت کننده(هر بخشی از زیرساخت یا سامانه که درخواست HTTP را دریافت و پردازش می‌کند) شود. عدم رعایت این موضوع می تواند باعث وقوع حمله Danial of Service شود، ارسال یک درخواست بیش از حد طولانی (مانند یک فیلد هدر کوکی طولانی) باعث می شود سرور همواره با وضعیت خطا پاسخ دهد.FalseFalseTrue✓V4.33GraphQLV4.3.11اطمینان حاصل شود یکی از مکانیزم ها برای جلوگیری از حملات انکار سرویس (DoS) درلایه GraphQL یا لایه داده استفاده شده است. این مکانیزم‌ها عبارتند از استفاده از فهرست مجاز کوئری‌ها ( Query Allowlist)، محدودسازی عمق کوئری‌ها (Depth Limiting)،محدودسازی تعداد یا حجم داده(Amount Limiting) و تحلیل هزینه کوئری (Query Cost Analysis). این اقدامات، به منظور مقابله با درخواست های پیچیده، تو در تو یا کوئری‌های پرهزینه که می توانند موجب مصرف بیش از حد منابع و اختلال در سرویس دهی شوند ضروری است.FalseTrue✓True✓V4.3.22اطمینان حاصل شود که قابلیت Introspection در GraphQL در محیط تولید (Production) غیرفعال شده‌است، مگرAPI مبتنی بر GraphQL به‌صورت صریح برای استفاده توسط اشخاص یا سامانه های ثالث (Third Parties) طراحی شده باشد.FalseTrue✓True✓V4.44WebSocketV4.4.11اطمینان حاصل شود که تمامی ارتباطات WebSocket از طریق پروتکل TLS( WSS) برقرار می‌شوند.True✓True✓True✓V4.4.22اطمینان حاصل شود که در هنگام Handshake اولیه‌ی HTTP برای WebSocket، مقدار هدر Origin بررسی ‌شود و در صورتی که با لیستی از مبداهای مجاز (allowed origins) برای برنامه مطابقت داشته باشد، اتصال پذیرفته می‌شود.FalseTrue✓True✓V4.4.33اطمینان حاصل شود که در صورتی که امکان استفاده از مکانیزم استاندارد مدیریت نشست برنامه وجود نداشته باشد، از توکن‌های اختصاصی (Duplicated Tokens) برای این منظور استفاده شود که با الزامات امنیتی مدیریت نشست به طور کامل مطابقت داشته باشند.FalseTrue✓True✓V4.4.44اطمینان حاصل شود که توکن‌های اختصاصی مدیریت نشست WebSocket در هنگام انتقال از یک نشست HTTPS موجود به کانالWebSocket، از طریق نشست HTTPS احراز هویت‌شده قبلی، دریافت یا اعتبارسنجی می‌شوند.FalseTrue✓True✓V55FileFile HandlingV5.11File Handling DocumentationV5.1.11مستندات نوع فایل‌های مجاز، پسوندهای مورد انتظار، و حداکثر اندازه هر فایل (شامل اندازه پس از استخراج) را برای هر قابلیت بارگذاری مشخص کرده باشد. همچنین، مستندات توضیح می‌دهند چگونه فایل‌ها برای دانلود و پردازش توسط کاربران نهایی ایمن‌سازی می‌شوند؛ برای مثال، رفتار برنامه هنگام شناسایی یک فایل مخرب چگونه خواهد بود.FalseTrue✓True✓V5.22File Upload and ContentV5.2.11برنامه تنها فایل‌هایی با حجم مشخص، که قادر به پردازش آن است را می‌پذیرد تا از کاهش عملکرد یا حملات انکار سرویس (DoS) جلوگیری شود.True✓True✓True✓V5.2.22هنگام پذیرش فایل توسط برنامه، چه به صورت مستقیم و چه به صورت یک آرشیو مانند فایلzip پسوند فایل با پسوند مورد انتظار مطابقت داشته باشد و اعتبارسنجی محتوای فایل صورت گیرد تا تایید شود محتوای فایل با نوع تعریف‌شده توسط پسوند هم‌خوانی دارد. این فرآیند می تواند شامل موارد بررسی بایت‌های ابتدایی (magic bytes) فایل، انجام بازنویسی تصاویر برای حذف ساختارها و اطلاعات ناخواسته و استفاده از کتابخانه‌های تخصصی برای اعتبارسنجی کامل محتوای فایل باشد اما محدود به آنها نیست. در سطح L1، کافی است این بررسی‌ها فقط بر روی فایل‌هایی که در فرآیندهای تجاری یا امنیتی خاص استفاده می‌شوند متمرکز باشد. در سطح L2 و بالاتر، این فرآیند باید برای تمامی فایل‌های ورودی برنامه اجرا شود.True✓True✓True✓V5.2.33برنامه باید پیش از استخراج محتوای فایل‌های فشرده (مانند zip، gz، docx، odt)، آن‌ها را از نظر حداکثر اندازه مجاز پس از استخراج و همچنین حداکثر تعداد فایل‌های درون آن بررسی می‌کند.FalseTrue✓True✓V5.2.44برنامه فضای مشخصی برای اندازه فایل و تعداد فایل‌های مجاز برای هر کاربر اعمال می‌کند تا از این طریق، یک کاربر نتواند با بارگذاری تعداد زیادی فایل یا فایل‌های بیش از حد بزرگ، فضای ذخیره‌سازی را پر کند.FalseFalseTrue✓V5.2.55برنامه اجازه بارگذاری فایل‌های فشرده‌ که حاوی لینک های نمادین (symlinks) هستند را نمی‌دهد، مگر اینکه این رفتار به طور مشخص مورد نیاز باشد. در چنین شرایطی باید یک فهرست مجاز (allowlist) از مسیرها یا فایل‌هایی که می تواند برای آنها لینک نمادین ایجاد شود، اعمال و اعتبارسنجی گردد.FalseFalseTrue✓V5.2.66برنامه تصاویر بارگذاری‌شده با اندازه پیکسلی بزرگ‌تر از حد مجاز را رد کند تا از حملات pixel flood attacks جلوگیری شود.FalseFalseTrue✓V5.33File StorageV5.3.11فایل هایی که از ورودی های غیرمعتبر بارگذاری‌ یا تولید می شوند و در پوشه های عمومی قرار می گیرند، هنگام دسترسی مستقیم از طریق یک درخواست HTTP، به عنوان کداجرایی سمت سرور اجرا نشوند.True✓True✓True✓V5.3.22هنگام ایجاد مسیرهای فایل برای عملیات مختلف، به جای استفاده از نام فایل‌های ارسال شده توسط کاربر، از داده‌های تولید شده داخلی یا منابع مورد اعتماد استفاده شود. و در صورتی که استفاده از نام فایل‌ها یا متادیتای ارسالی توسط کاربر ضروری باشد، می بایست validation و Sanitization اعمال شود. این کار برای جلوگیری از حملاتی مانند Path Traversal، Local or Remote File Inclusion(LFI, RFI) و Server-Side Request Forgery(SSRF) می‌باشد.True✓True✓True✓V5.3.33پردازش فایل‌های سمت سرور، مانند استخراج فایل‌های فشرده، اطلاعات مسیر ارائه شده توسط کاربر را نادیده می‌گیرد تا از آسیب‌پذیری‌هایی مانند zip slip جلوگیری شود.FalseFalseTrue✓V5.44File DownloadV5.4.11برنامه نام فایل ارسال‌شده توسط کاربر را چه در قالب JSON، JSONP یا پارامتر URL، اعتبارسنجی می‌کند یا نادیده می‌گیرد، و در پاسخ HTTP، نام فایل را به‌طور صریح در فیلد Content-Disposition هدر مشخص می‌نماید.FalseTrue✓True✓V5.4.22نام‌های فایل‌های ارائه شده (مانند فیلدهای هدر پاسخ HTTP یا پیوست‌های ایمیل)، به‌درستی encoded یا sanitized شده‌اند (مطابق RFC 6266)، تا ساختار سند حفظ شده و از حملات تزریق جلوگیری شود.FalseTrue✓True✓V5.4.33فایل‌های دریافت شده از منابع غیرقابل اعتماد توسط آنتی ویروس اسکن شود تا از ارائه محتوای مخرب شناخته‌شده جلوگیری شود.FalseTrue✓True✓V66AuthenticationAuthenticationV6.11Authentication DocumentationV6.1.11مستندات برنامه، نحوه استفاده از کنترل هایی مانند محدودیت نرخ (Rate Limit)، مقابله با خودکارسازی (Anti-Automation) و پاسخ تطبیقی (Adaptive Response) را برای دفاع در برابر حملاتی مانند Credential Stuffing و حملات Password Brute Force به وضوح تعریف کرده باشد. مستندات باید به‌وضوح نحوه پیکربندی این کنترل‌ها را تشریح کرده و نشان دهند که چگونه از قفل شدن مخرب حساب‌های کاربری جلوگیری می‌شود.True✓True✓True✓V6.1.22یک لیست از کلمات خاص مرتبط با زمینه سازمانی‌ (Context-Specific) مستندسازی شود تا از بکارگیری آنها در رمزهای عبور جلوگیری شد. این فهرست می‌تواند شامل نام سازمان، نام محصول، شناسه سامانه، نام کد پروژه، نام دپارتمان یا نقش های سازمانی و موارد مشابه باشد.FalseTrue✓True✓V6.1.33در صورت وجود مسیرهای متعدد احراز هویت در برنامه کاربردی، تمامی این مسیرها به همراه کنترل‌های امنیتی و سطح قدرت احراز هویت مورد نیاز، مستندسازی شده‌اند. لازم است این کنترل‌ها به‌صورت یکسان و سازگار در تمامی مسیرهای احراز هویت اجرا شوند.FalseTrue✓True✓V6.22Password SecurityV6.2.11کلمات عبور تنظیم شده توسط کاربر حداقل ۸ کاراکتر طول داشته باشد. هرچند حداقل ۱۵ کاراکتر به شدت توصیه می‌شود.True✓True✓True✓V6.2.22کاربران قادر به تغییر گذرواژه خود باشند.True✓True✓True✓V6.2.33هنگام تغییر کلمه عبور، گذرواژه فعلی و گذرواژه جدید توسط کاربر تکمیل شود.True✓True✓True✓V6.2.44کلمات عبوری که در حین ثبت‌نام حساب کاربری یا تغییر کلمه عبور ارسال می شوند با یک فهرست در دسترس از حداقل ۳۰۰۰ کلمه عبور رایج که ( با سیاست‌های کلمه عبور برنامه (مانند حداقل طول) سازگاری دارند) بررسی شوند.True✓True✓True✓V6.2.55کلمات عبور با هر ترکیبی قابل استفاده باشند، بدون اینکه قوانینی برای محدودکردن نوع کاراکترهای مجاز وجود داشته باشد. نباید هیچ‌گونه الزامی برای تعداد حداقل کاراکترهای حروف بزرگ یا کوچک، اعداد یا کاراکترهای خاص وجود داشته باشد.True✓True✓True✓V6.2.66فیلدهای ورودی کلمه عبور از نوع "type=password" استفاده می‌کنند تا ورودی‌ها پنهان شوند. برنامه‌ها می‌توانند به کاربر این امکان را بدهند که موقتاً کلمه عبور کامل یا آخرین کاراکتر تایپ شده را مشاهده کند.True✓True✓True✓V6.2.77عملکرد "چسباندن" (paste)، ابزارهای کمکی گذرواژه مرورگر و مدیریت‌کننده‌های گذرواژه خارجی مجاز باشند.True✓True✓True✓V6.2.88برنامه کلمه عبور کاربر را دقیقاً همانطور که از کاربر دریافت شده است، بدون هیچ گونه تغییراتی مانند کوتاه‌سازی(truncation) یا تبدیل حروف بزرگ و کوچک (case transformation)، بررسی کند.True✓True✓True✓V6.2.99استفاده از گذرواژه‌هایی با حداقل طول ۶۴ کاراکتر مجاز باشد.FalseTrue✓True✓V6.2.1010کلمه عبور کاربر تا زمانی که مشخص شود که به خطر افتاده است یا کاربر آن را تغییر دهد، معتبر باقی بماند. برنامه نباید الزام به تغییر دوره‌ای گذرواژه‌ها را داشته باشد.FalseTrue✓True✓V6.2.1111فهرست مستند شده ای از کلمات خاص مرتبط با زمینه‌ سازمانی برای جلوگیری از ایجاد کلمات عبور آسان قابل حدس، مورد استفاده قرار گیرد.FalseTrue✓True✓V6.2.1212کلمات عبور وارد شده در حین ثبت‌نام حساب کاربری یا تغییر کلمه عبور با مجموعه‌ای از کلمات عبور افشا شده بررسی ‌شوند.FalseTrue✓True✓V6.33General Authentication SecurityV6.3.11کنترل‌های لازم برای جلوگیری از حملاتی مانند Credential Stuffing و password brute force طبق مستندات امنیتی برنامه پیاده‌سازی شوند.True✓True✓True✓V6.3.22حساب‌های کاربری پیش‌فرض (مانند "admin"، "root" یا "sa") در برنامه وجود نداشته باشند یا غیرفعال شده باشند.True✓True✓True✓V6.3.33برای دسترسی به برنامه، از یک مکانیزم احراز هویت چندعاملی (MFA) یا ترکیبی از مکانیزم‌های احراز هویت تک‌عاملی استفاده شود. برای سطح L3، حداقل یکی از عوامل احراز هویت باید مبتنی بر سخت‌افزار باشد در برابر حملات فیشینگ، مقاومت در برابر نفوذ و جعل هویت را فراهم کند، در حالی که با اقدام آگاهانه کاربر (مانند فشردن دکمه روی کلید سخت‌افزاری FIDO یا تلفن همراه) قصد کاربر برای احراز هویت را نیز تأیید نماید. هرگونه تسهیل یا تعدیل در این الزام، مستلزم ارائه دلایل مستند و مجموعه‌ای جامع از کنترل‌های جبرانی است.FalseTrue✓True✓V6.3.44تأیید کنید که در صورت وجود مسیرهای متعدد احراز هویت در برنامه، هیچ مسیر احراز هویتِ مستندسازی‌نشده‌ای وجود نداشته باشد و کنترل‌های امنیتی و سطح قدرت احراز هویت در تمامی مسیرها به‌صورت یکسان و سازگار اعمال شوند.FalseTrue✓True✓V6.3.55کاربران از تلاش‌های مشکوک برای احراز هویت (موفق یا ناموفق) مطلع ‌شوند. این اطلاع‌رسانی می‌تواند شامل تلاش برای احراز هویت از موقعیت مکانی یا کلاینت غیرمعمول، احراز هویت ناقص (تنها موفقیت یکی از عوامل)، تلاش برای احراز هویت پس از یک دوره طولانی عدم فعالیت، یا احراز هویت موفق پس از چندین تلاش ناموفق باشد.FalseFalseTrue✓V6.3.66ایمیل به‌عنوان مکانیزم احراز هویت، چه به‌صورت تک‌عاملی و چه به‌عنوان یکی از عوامل احراز هویت چندعاملی، استفاده نمی‌شود.FalseFalseTrue✓V6.3.77کاربران پس از به‌روزرسانی اطلاعات احراز هویت خود، مانند بازنشانی گذرواژه یا تغییر نام کاربری یا آدرس ایمیل، مطلع شوند.FalseFalseTrue✓V6.3.88با توجه به پیام‌های خطا، کدهای پاسخ HTTP یا تفاوت در زمان پاسخ‌دهی، نتوان کاربران معتبر را از طریق تلاش‌های ناموفق احراز هویت شناسایی کرد. همچنین، عملکردهای ثبت‌نام و بازیابی گذرواژه نیز باید از این نوع افشای اطلاعات محافظت شده باشند.FalseFalseTrue✓V6.44Authentication Factor Lifecycle and RecoveryV6.4.11کلمه عبور اولیه یا کدهای فعال‌سازی تولید شده توسط سیستم، به‌صورت تصادفی و ایمن تولید ‌شوند، با سیاست فعلی رمز عبور مطابقت دارند، و پس از مدت زمان کوتاهی یا پس از اولین استفاده منقضی می‌شوند. این رمزهای اولیه نباید به عنوان رمز عبور بلندمدت مورد استفاده قرار گیرند.True✓True✓True✓V6.4.22راهنمای کلمه عبور یا احراز هویت مبتنی بر دانش (که به عنوان "سؤالات امنیتی" شناخته می‌شوند) در سیستم وجود ندارد.True✓True✓True✓V6.4.33فرآیند امنی برای بازنشانی کلمه عبور فراموش‌شده پیاده‌سازی شده است که هیچ‌یک از مکانیزم‌های احراز هویت چندعاملی فعال را دور نزند.FalseTrue✓True✓V6.4.44در صورت از دست رفتن یکی از عوامل احراز هویت چندعاملی، فرآیند اثبات هویت با همان سطحی که در زمان ثبت‌نام انجام شده است، اجرا شود.FalseTrue✓True✓V6.4.55دستورالعمل‌های تمدید مکانیزم‌های احراز هویت دارای تاریخ انقضا برای کاربران به موقع ارسال می‌شود تا پیش از انقضای مکانیزم فعلی فرصت کافی برای تمدید وجود داشته باشد، و در صورت لزوم، یادآورهای خودکار نیز تنظیم و ارسال شده باشند.FalseFalseTrue✓V6.4.66کاربران ادمین می‌توانند فرآیند بازنشانی کلمه عبور را برای کاربران عادی آغاز کنند، اما اجازه تغییر مستقیم یا انتخاب رمز عبور برای کاربر را ندارند. این کنترل برای جلوگیری از دسترسی ادمین به رمز عبور کاربران طراحی شده است.FalseFalseTrue✓V6.55General Multi-factor authentication requirementsV6.5.11Lookup Secrets درخواست‌ها یا کدهای احراز هویت خارج از باند (Out-of-Band) و رمزهای یکبار مصرف مبتنی بر زمان (TOTP) تنها یک‌بار قابل استفاده باشند و پس از استفاده موفق، مجدداً قابل استفاده نباشند.FalseTrue✓True✓V6.5.22در صورت ذخیره‌سازی Lookup Secrets در سمت Backend برنامه، اگر مقدار آنتروپی کمتر از ۱۱۲ بیت باشند (معادل ۱۹ کاراکتر تصادفی الفبایی-عددی یا ۳۴ رقم تصادفی)، باید با یک الگوریتم تایید شده برای ذخیره رمز عبور و با استفاده از یک Salt تصادفی ۳۲ بیتی هش شوند. در صورتی که آنتروپی کد ۱۱۲ بیت یا بیشتر باشد، می‌توان از یک تابع هش استاندارد برای ذخیره سازی استفاده کرد.FalseTrue✓True✓V6.5.33Lookup Secrets کدهای احراز هویت خارج از باند (out of band) و تولید رمزهای یکبار مصرف مبتنی بر زمان(TOTP) همگی با استفاده از یک تولیدکننده عدد شبه تصادفی ‌رمزنگاری‌شده (CSPRNG) تولید شده باشند تا از تولید مقادیر قابل پیش‌بینی جلوگیری شود.FalseTrue✓True✓V6.5.44Lookup Secrets و کدهای احراز هویت خارج از باند (out of band) حداقل دارای ۲۰ بیت آنتروپی باشند (معمولاً ۴ کاراکتر تصادفی الفبایی-عددی یا ۶ رقم تصادفی برای رسیدن به این میزان آنتروپی کافی است).FalseTrue✓True✓V6.5.55درخواست‌ها، کدها یا توکن‌های احراز هویت خارج از باند (Out-of-Band) و همچنین رمزهای عبور یک‌بار مصرف مبتنی بر زمان (TOTP) دارای طول عمر مشخص باشند. حداکثر طول عمر برای درخواست‌های خارج از باند باید ۱۰ دقیقه و برای TOTP حداکثر ۳۰ ثانیه باشد.FalseTrue✓True✓V6.5.66امکان لغو (Revoke) هر عامل احراز هویت، از جمله دستگاه‌های فیزیکی، در صورت سرقت یا مفقود شدن وجود داشته باشد.FalseFalseTrue✓V6.5.77مکانیزم‌های احراز هویت بیومتریک فقط به‌عنوان عامل دوم و در کنار یکی از عوامل «چیزی که در اختیار دارید» یا «چیزی که کاربر می داند» مورد استفاده قرار می‌گیرند.FalseFalseTrue✓V6.5.88اعتبارسنجی رمزهای یک‌بار مصرف مبتنی بر زمان (TOTP) بر اساس منبع زمانی از یک سرویس قابل اعتماد انجام می‌شود و نه بر اساس زمان ارائه‌شده توسط کلاینت یا منابع غیرقابل اعتماد.FalseFalseTrue✓V6.66Out-of-Band authentication mechanismsV6.6.11مکانیزم‌های احراز هویت مبتنی بر شبکه تلفن عمومی (PSTN) برای ارسال رمزهای یک‌بار مصرف (OTP) از طریق تماس تلفنی یا پیامک تنها در صورتی که شماره تلفن قبلا اعتبارسنجی شده باشد، یا روش‌های جایگزین قوی‌تر (رمزهای عبور یکبار مصرف مبتنی بر زمان) در دسترس باشند ارائه می‌شوند و سرویس‌دهنده باید کاربران را از ریسک‌های امنیتی این روش‌ها مطلع سازد. برای اپلیکیشن‌های سطح L3، استفاده از تماس تلفنی و پیامک به‌عنوان گزینه، مجاز نیست.FalseTrue✓True✓V6.6.22درخواست‌ها، کدها یا توکن‌های احراز هویت خارج از باند (Out-of-Band) به درخواست احراز هویت اصلی که برای آن تولید شده‌اند متصل باشند و قابل استفاده برای درخواست‌های قبلی یا بعدی نباشند.FalseTrue✓True✓V6.6.33مکانیزم‌های احراز هویت خارج از باند (Out-of-Band) مبتنی بر کد، در برابر حملات brute force از طریق اعمال کنترل محدودیت نرخ (Rate Limiting) محافظت شوند. همچنین، استفاده از کدی با حداقل ۶۴ بیت آنتروپی (Entropy)مدنظر قرار گیرد.FalseTrue✓True✓V6.6.44در صورت استفاده از Push Notifications جهت احراز هویت چند عاملی، محدودیت نرخ (Rate Limiting) به منظور جلوگیری از حملات Push Bombing اعمال شده باشد. استفاده از تطبیق عدد Matching) Number) نیز می‌تواند به کاهش این ریسک کمک کند.FalseFalseTrue✓V6.77Cryptographic authentication mechanismV6.7.11گواهینامه‌های مورد استفاده برای تأیید ادعاهای احراز هویت رمزنگاری‌شده به گونه‌ای ذخیره شوند که از تغییر یا دستکاری آن‌ها محافظت شود.FalseFalseTrue✓V6.7.22مقدار چالش (Challenge Nonce) حداقل ۶۴ بیت طول داشته باشد و از نظر آماری یکتا باشد یا حداقل در طول عمر دستگاه رمزنگاری منحصر به فرد باقی بماند.FalseFalseTrue✓V6.88Authentication with an Identity ProviderV6.8.11اگر برنامه از چند ارائه‌دهنده هویت (IdP) پشتیبانی می‌کند، امکان جعل هویت کاربر از طریق یک ارائه‌دهنده هویت دیگر وجود نداشته باشد (برای مثال، با استفاده از شناسه کاربری یکسان). مکانیسم استاندارد برای جلوگیری از این تهدید، این است که برنامه، کاربران را با استفاده از ترکیب شناسه IdP (به‌عنوان فضای نام یا (namespace و شناسه کاربر در آن، IdP ثبت و شناسایی کند.FalseTrue✓True✓V6.8.22وجود و یکپارچگی امضاهای دیجیتال بر روی تصدیق‌های (تقاضاها یا ادعاهای) احراز هویت برای مثال بر روی (توکن‌های JWT یا SAML assertions) همواره اعتبارسنجی می‌شود و هرگونه تصدیقی که فاقد امضا یا دارای امضای نامعتبر باشد، رد می‌گردد.FalseTrue✓True✓V6.8.33(تقاضاها یا ادعاهای) تصدیق‌های SAML به‌صورت منحصربه‌فرد پردازش شده و تنها یک‌بار در بازه‌ی اعتبار خود استفاده می‌شوند تا از حملات بازپخش (Replay Attacks) جلوگیری گردد.FalseTrue✓True✓V6.8.44اگر برنامه‌ای از یک ارائه‌دهنده هویت (IdP) جداگانه استفاده می‌کند و انتظار قدرت، روش‌ها یا تازگی احراز هویت خاصی را برای عملکردهای خاص دارد، برنامه این موضوع را با استفاده از اطلاعات برگردانده شده توسط IdP تأیید می‌کند. به عنوان مثال، اگر از OIDC استفاده شود، این کار می‌تواند با اعتبارسنجی ادعاهای (Claims) موجود در توکن شناسایی (ID Token) مانند «amr»، «acr» و «auth_time» (در صورت وجود) انجام شود. اگر ارائه‌دهنده هویت این اطلاعات را ارائه نکند، برنامه باید یک روش جایگزین مستندسازی‌شده داشته باشد که فرض می‌کند حداقل سطح احراز هویت استفاده شده است (مثلاً احراز هویت تک‌عاملی با نام کاربری و گذرواژه).FalseTrue✓True✓V77SessionSession ManagementV7.11Session Management DocumentationV7.1.11بازه عدم فعالیت نشست کاربر و بیشینه طول عمر نشست قبل از احراز هویت مجدد، در ترکیب با سایر کنترل‌ها مستند و متناسب سازی شود. مستند سازی انجام شده باید شامل توجیه برای هر انحراف(نقض) از الزامات احراز هویت مجدد NIST SP 800-63B باشد.FalseTrue✓True✓V7.1.22در مستند باید تعداد نشست همزمان مجاز برای یک کاربر و همچنین رفتار و اعمال مناسب برای زمانی که این تعداد به حداکثر رسید مشخص شود.FalseTrue✓True✓V7.1.33تمام سیستم‌هایی که نشست‌های کاربر را به عنوان بخشی از یک اکوسیستم مدیریت هویت فدرال(مانند سیستم‌های (SSO ایجاد و مدیریت می‌کنند، باید در کنار سایر کنترل‌های مربوط به طول عمر نشست‌ها، خاتمه آن‌ها و هرگونه شرایط دیگری که نیاز به احراز هویت مجدد دارد، مستند شوند.FalseTrue✓True✓V7.22Fundamental Session Management SecurityV7.2.11برنامه کاربردی باید تمام بررسی‌های توکن نشست‌ را با استفاده از یک سرویس backend مطمئن انجام دهد.True✓True✓True✓V7.2.22برنامه کاربردی که از هر یک از توکن‌های Self-Contained یا reference که به صورت پویا برای مدیریت نشست تولید شده‌اند استفاده کند اما از از کلیدهای API ثابت و کلید‌ها استفاده نکند.True✓True✓True✓V7.2.33در صورتی که برای نمایش نشست کاربر از توکن‌های reference استفاده می شود، این توکن‌ها منحصر به فرد بوده و با استفاده از یک تولید کننده عدد شبه تصادفی امن رمزنگاری(CSPRNG) که دارای انتروپی حداقل128 بیتی است تولید شوند.True✓True✓True✓V7.2.44برنامه کاربردی در هنگام احراز هویت کاربر یک توکن نشست جدید تولید نماید که شامل احراز هویت مجدد و ابطال توکن نشست کنونی است.True✓True✓True✓V7.33Session TimeoutV7.3.11بر اساس تحلیل ریسک و تصمیمات امنیتی مستند شده، پس از گذشت مهلت زمانی عدم فعالیت، کاربر مجبور به احراز هویت مجدد گردد.FalseTrue✓True✓V7.3.22بر اساس تحلیل ریسک و تصمیمات امنیتی مستند شده، پس از گذشت بیشینه زمان مطلق طول عمر، کاربر مجبور به احراز هویت مجدد گردد.FalseTrue✓True✓V7.44Session TerminationV7.4.11در مواقعی که فرآیند خاتمه نشست کاربر فعال می‌شود (مانند خروج کاربر یا انقضای نشست)، برنامه اجازه هیچ فعالیتی را به آن نشست نمی‌دهد. برای Reference tokens یا stateful session، این به معنی نامعتبرسازی اطلاعات نشست در برنامه Backend می‌باشد. برنامه‌هایی که از توکن‌های Self-contained استفاده می‌کنند نیاز به راه حل‌هایی نظیر نگهداری فهرستی از توکن‌های خاتمه‌یافته، عدم پذیرش توکن‌هایی که پیش از یک تاریخ و زمان مشخص برای هر کاربر تولید شده‌اند، یا چرخش کلید امضای مخصوص هر کاربر دارند.True✓True✓True✓V7.4.22برنامه کاربردی تمامی نشست‌های فعال را در زمانی که حساب کاربری غیرفعال یا حذف می‌شود را ابطال نماید. (مانند کارمندی که شرکت را ترک می‌کند)True✓True✓True✓V7.4.33برنامه کاربردی قابلیت ارائه گزینه ابطال تمامی نشست های فعال دیگر را پس از یک تغییر موفقیت آمیز یا حذف هریک از عوامل احراز هویت (نظیر تغییر پسورد از طریق ریست یا بازنشانی و در صورت وجود به روزرسانی تنظیمات MFA ) را داشته باشد.FalseTrue✓True✓V7.4.44تمامی صفحاتی که نیازمند احراز هویت هستند دارای دسترسی آسان و مشخص به فرآیند خروج باشند.FalseTrue✓True✓V7.4.55مدیران برنامه کاربردی قادر به ابطال نشست‌های فعال برای یک شخص یا تمامی کاربران باشند.FalseTrue✓True✓V7.55Defenses Against Session AbuseV7.5.11برنامه کاربردی قبل از اعطای مجوز تغییر ویژگی‌های حساس حساب کاربری که بر روی احراز هویت تاثیر دارد نظیر آدرس ایمیل، شماره تلفن، تنظیمات MFA یا اطلاعات دیگر که در بازگردانی حساب کاربری مورد استفاده قرار می‌گیرند، به احراز هویت مجدد کامل نیاز دارد.FalseTrue✓True✓V7.5.22حساب‌های کاربری قادر به دیدن(پس از احراز هویت مجدد با حداقل یک عامل) و ابطال یک یا همه نشست‌های فعال باشد.FalseTrue✓True✓V7.5.33برنامه کاربردی قبل از اجرای تراکنش‌ها یا عملیات‌های حساس نیازمند احراز هویت مجدد با حداقل یک عامل یا صحت سنجی ثانویه باشد.FalseFalseTrue✓V7.66Federated Re-authenticationV7.6.11طول عمر و ابطال نشست بین RP و idp طبق سند- که نیازمند احرازهویت مجدد در زمان مورد نیاز مانند وقتی که بیشینه زمان بین رخداد احراز هویت idp رسیده باشد- انجام شود.FalseTrue✓True✓V7.6.22ساخت نشست‌ها نیاز به رضایت کاربر یا یک اقدام صریح دارد که بدین صورت از ایجاد نشست‌های جدید برنامه بدون تعامل کاربر جلوگیری می‌شود.FalseTrue✓True✓V88AuthorizationAuthorizationV8.11Authorization DocumentationV8.1.11مستند اعطای مجوز باید شامل قوانینی به منظور محدودسازی دسترسی در سطح عملکرد و دسترسی مبتنی بر داده بر اساس مجوزهای کاربران و ویژگی‌های منابع باشد.True✓True✓True✓V8.1.22مستند اعطای مجوز باید قوانینی را برای محدودیت‌های دسترسی در سطح Field بر اساس مجوزهای کاربران و ویژگی‌های منابع تعریف نماید(هر دو دسترسی خواندن و نوشتن). توجه داشته باشید که این قوانین ممکن است به مقادیر دیگر ویژگی‌های شیء داده ی مربوطه (Relevant Data Object) بستگی داشته باشند، مانند حالت (state) یا وضعیت (status).FalseTrue✓True✓V8.1.33مستند برنامه کاربردی باید ویژگی‌های محیطی و زمینه‌ای (شامل و نه محدود به زمان روز، مکان، آدرس IP یا دستگاه) که در برنامه کاربردی به منظور اتخاذ تصمیمات امنیتی (نظیر آن دسته از تصمیماتی که مربوط به احراز هویت و اعطای مجوز می باشد) را مشخص کند.FalseFalseTrue✓V8.1.44مستندات احراز هویت و اعطای مجوز، علاوه بر اعطای مجوز در سطح Field، سطح عملکرد و داده‌های خاص، چگونگی استفاده از عوامل محیطی و زمینه‌ای در اتخاذ تصمیمات را مشخص نماید.FalseFalseTrue✓V8.22General Authorization DesignV8.2.11برنامه کاربردی باید از محدود بودن دسترسی‌‌های در سطح عملکرد به مشتریانی که دارای دسترسی صریح هستند اطمینان حاصل نماید.True✓True✓True✓V8.2.22برنامه کاربردی باید از محدود بودن دسترسی‌‌های در سطح داده به مشتریانی که دارای دسترسی صریح به اقلام داده‌ای خاص هستند اطمینان حاصل نماید تا از این طریق خطر آسیب پذیری IDOR و broken object level authorization را کاهش دهد .True✓True✓True✓V8.2.33برنامه کاربردی دسترسی در سطح Field را با مجوزهای صریح به Field ها برای مصرف کنندگان جهت کاهش خطر broken object property level authorization (BOPLA) محدود کرده باشد.FalseTrue✓True✓V8.2.44کنترل‌های امنیتی تطبیقی که بر اساس ویژگی‌های محیطی و زمینه‌ای کاربر (مانند زمان روز، مکان، آدرس IP یا دستگاه) هستند، برای تصمیم‌گیری‌های احراز هویت (Authentication) و مجوزدهی (Authorization) طبق مستندات برنامه پیاده‌سازی شده‌اند. این کنترل‌ها باید هم در زمان تلاش کاربر برای شروع یک نشست (Session) جدید و هم در طول یک نشست فعال، اعمال شوند.FalseFalseTrue✓V8.33Operation Level AuthorizationV8.3.11برنامه کاربردی قوانین مجوزدهی را در یک لایه سرویس معتبر اعمال نموده و بر آن دسته از کنترل‌هایی که مصرف کنندگان نامعتبر قادر به دستکاری آن‌ها هستند متکی نباشد. (نظیر جاوا اسکریپت سمت کاربر)True✓True✓True✓V8.3.22در مواقعی که امکان اعمال فوری تغییرات وجود ندارد (مثلاً وقتی که سیستم برای تصمیم‌گیری در مجوزدهی از توکن‌های Self-Contained مثل JWT استفاده می‌کند که اطلاعات را داخل خود ذخیره کرده و تا زمان انقضا تغییر نمی‌کنند)، باید کنترل‌های جبرانی وجود داشته باشد. این کنترل‌ها باید بتوانند زمانی که کاربر عملی را انجام می‌دهد که دیگر مجاز به آن نیست، هشدار بدهند و تغییر را برگردانند. با این حال، توجه کنید که این راهکار جایگزین نمی‌تواند جلوی نشت اطلاعات را بگیرد.FalseFalseTrue✓V8.3.33دسترسی به یک object بر اساس مجوزهای کاربری شخص درخواست کننده(مثال: مصرف کننده) باشد نه بر اساس مجوز‌های یک واسطه یا سرویسی که به نمایندگی از او عمل می‌کند. بطور مثال، در صورتی که یک مصرف کننده یک وب سرویس را با استفاده از یک توکن self-contained برای احراز هویت فراخوانی می‌کند و سپس آن سرویس اطلاعات را از یک سرویس دیگر درخواست می‌کند، سرویس دوم باید همان توکن مصرف کننده را استفاده کند، نه یک توکن سرویس-به-سرویس (Machine-to-Machine token) که متعلق به سرویس اول است، تا تصمیمات مجوزدهی دقیقاً بر اساس مجوزهای کاربر گرفته شوند.FalseFalseTrue✓V8.44Other Authorization ConsiderationsV8.4.11برنامه های کاربردی چند کاربره(multi tenants) از کنترل های cross-tenant به منظور تضمین این امر که عملیات‌های مصرف کنندگان هرگز کاربرانی (tenants) را که مجوز تعامل با آنها را ندارند را تحت تأثیر قرار نمی‌دهد.FalseTrue✓True✓V8.4.22دسترسی به درگاه‌های پیکربندی شامل چندین لایه امنیتی از قبیل تأیید مداوم هویت مصرف‌کننده، ارزیابی وضعیت امنیتی دستگاه و تحلیل ریسک زمینه‌ای باشد تا از این طریق اطمینان حاصل شود که موقعیت شبکه‌ای یا نقاط پایانی معتبر تنها عوامل برای مجوزدهی نیستند اگر چه که این عوامل احتمال دسترسی غیرمجاز را کاهش می‌دهند.FalseFalseTrue✓V99SelfSelf-contained TokensV9.11Token source and integrityV9.1.11قبل از پذیرش محتوای توکن‌ها، آن‌ها را با استفاده از امضای دیجیتال یا MAC به منظور حفاظت در مقابل دستکاری‌ها مورد اعتبارسنجی قرار داده شود.True✓True✓True✓V9.1.22فقط الگوریتم‌های موجود در لیست مجاز قادر به استفاده در ساخت و صحت سنجی توکن‌های self-contained در یک زمینه مشخص باشند. این لیست مجاز باید در حالت ایده آل شامل هم الگوریتم‌های متقارن و هم نامتقارن‌ها باشد و نباید شامل الگوریتم‌های NONE باشد. در صورتی که هر دو الگوریتم‌های متقارن و نانتقارن مورد نیاز باشند کنترل‌های بیشتری باید به منظور جلوگیری از سردرگمی کلید‌ها(key Confusion) بکار گرفته شود.True✓True✓True✓V9.1.33به منظور جلوگیری از مشخص نمودن منابع غیر مطمئن و کلید‌ها توسط مهاجمین، موارد کلیدی که در اعتبارسنجی توکن‌های self-contained مورد استفاده قرار می‌گیرند، از منابع از پیش پیکربندی شده مطمئنی که برای صادر کننده توکن است تعیین شود. برای JWTs و سایر ساختارهای JWS ، هدرهایی نظیر ‘jku’, ‘x5u’ و ‘jwk’ باید با یک لیست مجاز از منابع مطمئن مورد اعتبارسنجی قرار گیرند.True✓True✓True✓V9.22Token contentV9.2.11اگر یک بازه زمانی معتبر در داده‌های توکن وجود داشته باشد، توکن و محتوای آن تنها در صورتی پذیرفته می‌شوند که زمان بررسی در این بازه زمانی معتبر باشد. به عنوان مثال، برای JWTها، ادعاهای 'nbf' و 'exp' باید تایید شوند.True✓True✓True✓V9.2.22سرویسی که یک توکن دریافت می‌کند قبل از پذیرش محتوای آن، از لحاظ درستی نوع بررسی نموده و برای هدف مشخص شده در نظر گیرد. بطور مثال، فقط توکن‌های access می‌توانند به منظور تصمیمات مجوزی و فقط توکن های ID می‌توانند به منظور اثبات هویت کاربر مورد پذیرش قرار گیرند.FalseTrue✓True✓V9.2.33یک سرویس فقط توکن‌هایی را بپذیرد که به منظور استفاده توسط آن سرویس هستند(audience).برای JWT ها،این امر می‌تواند از طریق اعتبارسنجی ادعای 'aud' با یک لیست مجاز تعریف شده در سرویس صورت پذیرد.FalseTrue✓True✓V9.2.44اگر صادر کننده توکن از کلید خصوصی مشابهی برای audienceهای متفاوت استفاده می‌کند، توکن‌های تولید شده دارای محدودیت مخاطبی باشند که بطور منحصر به فردی مخاطبین مورد نظر را مشخص می‌کند. این امر از استفاده مجدد توکن توسط مخاطب ناخواسته جلوگیری می‌کند. در صورتی که شناسه مخاطب به صورت پویا مشخص شده باشد، صادرکننده توکن باید این مخاطبین را به منظور اطمینان از عدم جعل هویت مخاطب مورد اعتبارسنجی قرار دهد.FalseTrue✓True✓V1010OAuthOAuth and OIDCV10.11Generic OAuth and OIDC SecurityV10.1.11توکن‌ها باید فقط به مؤلفه‌هایی ارسال شوند که به‌طور دقیق به آن‌ها نیاز دارند. برای مثال، هنگام استفاده از الگوی Backend-for-Frontend برای برنامه‌های JavaScript مبتنی بر مرورگر، Access Tokens و Refresh Tokens باید فقط برای Backend قابل دسترس باشند.FalseTrue✓True✓V10.1.22Client باید فقط مقادیری را از Authorization Server بپذیرد (مانند Authorization Code یاID Token ) که این مقادیر حاصل از یک Authorization Flow باشند که توسط همان نشست (Session) و تراکنش User Agent آغاز شده است. این موضوع مستلزم آن است که Secretهای تولیدشده توسط کلاینت مانند code_verifier در PKCE، یا مقادیر state و nonce در OIDC قابل حدس زدن نباشند، مخصوص همان تراکنش باشند، و به‌صورت امن هم به کلاینت و هم به نشست (Session) مرورگری که تراکنش در آن شروع شده، متصل شده باشند.FalseTrue✓True✓V10.22OAuth ClientV10.2.11درCode Flow، باید OAuth Client در برابر حملاتBrowser-based Request Forgery که معمولاً با عنوان Cross-Site Request Forgery (CSRF) شناخته می‌شوند و درخواست‌های توکن را ایجاد می‌کنند، محافظت داشته باشد. این محافظت باید با استفاده از قابلیت PKCE یا با بررسی پارامترstate که در درخواست احراز مجوز ارسال شده است.FalseTrue✓True✓V10.2.22اگر OAuth Client بتواند با بیش از یک Authorization Server تعامل داشته باشد، باید دارای سازوکاری برای دفاع در برابر Mix-up Attacks باشد. برای مثال، می‌تواند الزام کند که Authorization Server مقدار پارامتر ‘iss’ را برگرداند و این مقدار هم درAuthorization Response و هم درToken Response اعتبارسنجی شود.FalseTrue✓True✓V10.2.33OAuth Client باید فقطScopes (یا سایر پارامترهای مجوزدهی) مورد نیاز را در درخواست‌ها به Authorization Server درخواست کند.FalseFalseTrue✓V10.33OAuth Resource ServerV10.3.11Resource Server باید فقط Access Tokenهایی را بپذیرد که برای استفاده با همان سرویس در نظر گرفته شده‌اند(Audience). Audience می‌تواند در یک Access Token ساختاریافته (مانند مقدار aud در JWT) درج شده باشد، یا از طریق Token Introspection Endpoint بررسی شود.FalseTrue✓True✓V10.3.22Resource Server باید تصمیمات مجوزدهی (Authorization Decisions) را بر اساس Claims موجود در Access Token که واگذاری مجوز (Delegated Authorization) را تعریف می‌کنند، اعمال کند. اگر Claimsهایی مانند sub، scope و authorization_details موجود باشند، باید جزو فرآیند تصمیم‌گیری قرار گیرند.FalseTrue✓True✓V10.3.33اگر برای گرفتن یک تصمیم کنترل دسترسی، لازم است یک کاربرِ یکتا از داخل Access Token (چه JWT و چه پاسخ Token Introspection ) شناسایی شود، سرور منبع (Resource Server) کاربر را از روی Claimهایی شناسایی کند که قابل اختصاص‌دادن به کاربران دیگر نیستند. معمولاً این یعنی استفاده از ترکیب دو Claim یعنی 'iss' (صادرکننده توکن) و 'sub' (شناسه یکتای کاربر)FalseTrue✓True✓V10.3.44اگر Resource Server نیازمند قدرت، روش یا تازگی خاص احراز هویت باشد، بررسی کند که Access Token ارائه‌شده این محدودیت‌ها را برآورده می‌کند. برای مثال، در صورت وجود، از Claimsهای OIDC مانند acr، amr و auth_time به ترتیب استفاده شود.FalseTrue✓True✓V10.3.55تأیید کنید که Resource Server از استفاده از Access Tokenهای سرقت‌شده یا Replay توکن‌ها (توسط افراد غیرمجاز) جلوگیری کند، با الزام استفاده از Sender-Constrained Access Tokens، مانند Mutual TLS برای OAuth 2 یا OAuth2 Demonstration of Proof of Possession (DPoP).FalseFalseTrue✓V10.44OAuth Authorization ServerV10.4.11سرور احراز هویت باید آدرس‌های بازگشتی (Redirect URI) را بر اساس فهرست مجاز (Allowlist) از URIهای از پیش‌ثبت‌شده و مخصوص هر کلاینت، با استفاده از مقایسه دقیقِ رشته‌ای Comparison) (Exact String اعتبارسنجی می‌کند.True✓True✓True✓V10.4.22اگر Authorization Server کد احراز مجوز (Authorization Code) را در Authorization Response برمی‌گرداند، این کد فقط یک‌بار برای درخواست توکن باید قابل استفاده باشد. برای دومین درخواست معتبر با یک Authorization Code که قبلاً برای صدور Access Token استفاده شده است، Authorization Server باید درخواست توکن را رد کند و هر توکن صادرشده‌ی مرتبط با آن Authorization Code را باطل نماید.True✓True✓True✓V10.4.33تأیید کنید که Authorization Code دارای مدت زمان معتبر بودن محدود باشد. حداکثر طول عمر می‌تواند برای برنامه‌های کاربردی در سطوح L1 و L2 تا ۱۰ دقیقه و برای برنامه‌های کاربردی در سطح L3 تا ۱ دقیقه باشد.True✓True✓True✓V10.4.44برای یک Client مشخص، Authorization Server فقط استفاده از Grantهایی را مجاز بداند که آن Client به استفاده از آن‌ها نیاز دارد. توجه داشته باشید که Grantهای ‘token’ (Implicit Flow) و ‘password’ (Resource Owner Password Credentials Flow) دیگر نباید استفاده شوند.True✓True✓True✓V10.4.55Authorization Server باید حملات Refresh Token Replay را برای Public Clientها کاهش دهد، ترجیحاً با استفاده از Sender-Constrained Refresh Tokens، یعنی Demonstrating Proof of Possession (DPoP) یا Certificate-Bound Access Tokens با استفاده از Mutual TLS (mTLS). برای برنامه‌های L1 و L2، می‌توان از Refresh Token Rotation استفاده کرد. اگر Refresh Token Rotation به‌کار گرفته شود، Authorization Server باید پس از استفاده، Refresh Token را باطل کند و اگر یک Refresh Token که قبلاً استفاده و باطل شده ارائه شود، تمام Refresh Tokenهای مربوط به آن مجوز را ابطال نماید.True✓True✓True✓V10.4.66اگر از Code Grant استفاده شود، Authorization Server باید حملات Authorization Code Interception را با الزام به استفاده از Proof Key for Code Exchange (PKCE) کاهش دهد. برای Authorization Requestها، Authorization Server باید یک مقدار معتبر برای 'code_challenge' الزام کند و نباید مقدار 'code_challenge_method' از نوع 'plain' را بپذیرد. برای Token Request، باید اعتبارسنجی پارامتر 'code_verifier' الزامی باشد.FalseTrue✓True✓V10.4.77اگر Authorization Server از Unauthenticated Dynamic Client Registration پشتیبانی می‌کند، ریسک مربوط به Client Applicationهای مخرب را باید کاهش دهد. این کار باید شامل اعتبارسنجی Client Metadata (مانند هر Registered URI)، اطمینان از رضایت کاربر، و هشدار به کاربر پیش از پردازش یک Authorization Request با یک Client Application غیرقابل اعتماد باشد.FalseTrue✓True✓V10.4.88Refresh Tokenها باید دارای یک انقضای مطلق (Absolute Expiration) باشند، حتی اگر از Sliding Refresh Token Expiration استفاده شود.FalseTrue✓True✓V10.4.99Refresh Tokenها و Reference Access Tokenها باید توسط کاربر مجاز از طریق User Interface Authorization Server قابل ابطال باشند، تا ریسک Clientهای مخرب یا توکن‌های سرقت‌شده کاهش یابد.FalseTrue✓True✓V10.4.1010Confidential Client باید برای درخواست‌های Backchannel بین Client و Authorization Server، مانند Token Requests، Pushed Authorization Requests (PAR) و Token Revocation Requests، احراز هویت شود.FalseTrue✓True✓V10.4.1111پیکربندی Authorization Server باید فقط Scopes موردنیاز را به OAuth Client اختصاص دهد.FalseTrue✓True✓V10.4.1212برای یک Client مشخص، Authorization Server فقط مقدار 'response_mode' را که این Client نیاز دارد، مجاز بداند. برای مثال، با اعتبارسنجی این مقدار توسط Authorization Server در برابر مقادیر مورد انتظار یا با استفاده از Pushed Authorization Request (PAR) یا JWT-secured Authorization Request (JAR).FalseFalseTrue✓V10.4.1313Grant Type ‘code’ همواره همراه با Pushed Authorization Requests (PAR) باید استفاده شود.FalseFalseTrue✓V10.4.1414Authorization Server باید فقط توکن‌های دسترسی از نوع وابسته به ارسال‌کننده (Proof-of-Possession) صادر می‌کند؛ چه به‌صورت توکن‌های دسترسی مبتنی بر گواهی از طریق TLS دوسویه (mTLS) و چه به‌صورت توکن‌های دسترسی وابسته به DPoP (Demonstration of Proof of Possession).FalseFalseTrue✓V10.4.1515برای یک کلاینت سمت‌سرور (که روی دستگاه کاربر نهایی اجرا نمی‌شود)، سرور احراز هویت اطمینان حاصل می‌کند که مقدار پارامترِ authorization_details از بک‌اند کلاینت ارسال شده و کاربر در آن دستکاری نکرده است. به‌عنوان مثال، با الزام به استفاده از درخواست احراز هویت پوش‌شده (PAR) یا درخواست احراز هویت ایمن‌شده با JWT (JAR).FalseFalseTrue✓V10.4.1616کلاینت باید از نوع Confidential Client باشد و سرور احراز هویت استفاده از روش‌های قدرتمند احراز هویت کلاینت ـ مبتنی بر رمزنگاری کلید عمومی و مقاوم در برابر حملات replay attacks ـ را الزامی کند؛ مانند TLS دوسویه (tls_client_auth ‎، ‎self_signed_tls_client_auth یا JWT مبتنی بر کلید خصوصی (private_key_jwt).FalseFalseTrue✓V10.55OIDC ClientV10.5.11Client به‌عنوان Relying Partyباید در برابر حملات بازپخش (Replay) توکن ID محافظت شده است. برای مثال، با بررسی اینکه مقدار claim مربوط به nonce در ID Token دقیقاً با مقدار **nonce**ای که در درخواست احراز هویت به OpenID Provider ارسال شده، یکسان باشد(که در OAuth 2 به آن authorization request ارسالی به authorization server گفته می‌شود).FalseTrue✓True✓V10.5.22Client باید کاربر را به‌صورت یکتا از ID Token Claims شناسایی کند، معمولاً از ‘sub’ Claim ، که قابل انتساب مجدد به کاربران دیگر نیست (در محدوده‌ی همان Identity Provider).FalseTrue✓True✓V10.5.33Client باید تلاش‌های یک Authorization Server مخرب برای جا زدن خود به‌جای یک Authorization Server دیگر از طریق متادیتای Authorization Server را رد می‌کند.کلاینت باید متادیتای Authorization Server را رد کند اگر مقدار issuer URL موجود در متادیتا دقیقاً با issuer URL از پیش پیکربندی‌شده و مورد انتظار کلاینت یکسان نباشد.FalseTrue✓True✓V10.5.44Client باید اعتبارسنجی کند ID Token برای استفاده توسط همان Client در نظر گرفته شده است (Audience)، با بررسی اینکه ‘aud’ Claim در توکن برابر با مقدار ‘client_id’ مربوط به Client باشد.FalseTrue✓True✓V10.5.55هنگام استفاده ازOIDC Back-Channel Logout، Relying Party از Denial of Service از طریق Forced Logout و Cross-JWT Confusion در جریان Logout باید جلوگیری کند. Client باید بررسی کند که Logout Token به درستی با مقدار typ آن برابر با logout+jwt باشد ، شامل ‘event’ Claim با نام عضو صحیح باشد و شامل ‘nonce’ Claim نباشد. همچنین توصیه می‌شود Expiration کوتاه باشد (مثلاً ۲ دقیقه).FalseTrue✓True✓V10.66OpenID ProviderV10.6.11OpenID Provider باید فقط مقادیر 'code'، 'ciba'، 'id_token' یا 'id_token code' را برای Response Mode مجاز بداند. توجه داشته باشید که 'code' نسبت به 'id_token code' (که OIDC Hybrid Flow است) ترجیح داده می‌شود و 'token' (هر Implicit Flow) نباید استفاده شود.FalseTrue✓True✓V10.6.22OpenID Provider از Denial of Service از طریق Forced Logout جلوگیری کند. این کار با دریافت تأیید صریح از کاربر نهایی یا در صورت وجود، اعتبارسنجی پارامترها در Logout Request (که توسط Relying Party آغاز شده است)، مانند ‘id_token_hint’، انجام می‌شود.FalseTrue✓True✓V10.77Consent ManagementV10.7.11Authorization Server باید تضمین ‌کند کاربر برای هر درخواست مجوز (Authorization Request) رضایت خود را اعلام کرده است. در صورتی که هویت کلاینت قابل اطمینان نباشد، Authorization Server باید در همه موارد کاربر را به‌صورت صریح برای اعلام رضایت (Consent) راهنمایی و از او تأیید بگیرد.FalseTrue✓True✓V10.7.22زمانی که Authorization Server از کاربر درخواست رضایت (Consent) می‌کند باید اطلاعات کافی و شفافی درباره آنچه کاربر در حال تأیید آن است ارائه ‌دهد. در صورت لزوم، این اطلاعات باید شامل این موارد باشد: ماهیت مجوزهای درخواستی )معمولاً بر اساس scope، resource server و جزئیات مجوز در Rich Authorization Requests – RAR)، هویت برنامه یا اپلیکیشن دریافت‌کننده مجوز و مدت اعتبار این مجوزها.FalseTrue✓True✓V10.7.33کاربر باید بتواند رضایت‌هایی (Consents) را که از طریق Authorization Server صادر کرده است، مشاهده، ویرایش و لغو (Revoke) کند.FalseTrue✓True✓V1111CryptographyCryptographyV11.11Cryptographic Inventory and DocumentationV11.1.11اطمینان حاصل کنید که یک سیاست مستند برای مدیریت کلیدهای رمزنگاری و چرخه‌عمر کلیدهای رمزنگاری وجود دارد که از یک استاندارد مدیریت کلید مانند NIST SP 800-57 پیروی می‌کند. این باید شامل اطمینان از این موضوع باشد که کلیدها بیش از حد به اشتراک گذاشته نشوند (برای مثال، در مورد Secrets مشترک با بیش از دو موجودیت و در مورد کلیدهای خصوصی با بیش از یک موجودیت).FalseTrue✓True✓V11.1.22فهرست اجزاء رمزنگاری باید تهیه و نگهداری ‌شود و به‌صورت منظم به‌روزرسانی گردد و شامل تمام کلیدهای رمزنگاری، الگوریتم‌ها و گواهی‌های دیجیتال مورد استفاده در برنامه باشد. این فهرست همچنین باید مشخص کند که کلیدها در کدام بخش‌های سیستم مجاز یا غیرمجاز به استفاده هستند و چه نوع داده‌هایی می‌توانند یا نمی‌توانند با این کلیدها محافظت شوند.FalseTrue✓True✓V11.1.33مکانیزم‌های کشف رمزنگاری برای شناسایی تمام موارد استفاده از رمزنگاری در سیستم باید استفاده ‌شود؛ از جمله رمزنگاری (encryption)، هش‌کردن (hashing) و عملیات امضای دیجیتال (signing).FalseFalseTrue✓V11.1.44فهرست اجزاء رمزنگاری باید تهیه ‌شود. این فهرست باید شامل یک برنامه مستند باشد که مسیر مهاجرت به استانداردهای جدید رمزنگاری (مانند رمزنگاری پساکوانتومی) را مشخص می‌کند تا امکان واکنش مناسب به تهدیدات آینده فراهم شود.FalseFalseTrue✓V11.22Secure Cryptography ImplementationV11.2.11برای عملیات رمزنگاری باید از پیاده‌سازی‌های مورد تأیید (شامل کتابخانه‌ها و پیاده‌سازی‌های سخت‌افزاری) استفاده شود.FalseTrue✓True✓V11.2.22برنامه با انعطاف‌پذیری رمزنگاری (crypto agility) باید طراحی شده باشد، به‌طوری که الگوریتم‌های تولید اعداد تصادفی، رمزنگاری احراز هویت‌شده، MAC یا هش، طول کلیدها، تعداد دورها، رمزها و حالت‌ها بتوانند در هر زمان مجدداً پیکربندی، ارتقاء یا تعویض شوند تا در برابر شکست‌های رمزنگاری محافظت شوند. به همین ترتیب، باید امکان جایگزینی کلیدها و رمزهای عبور و رمزگذاری مجدد داده‌ها نیز وجود داشته باشد. این امکان ارتقاء بدون وقفه به رمزنگاری پساکوانتومی (PQC) را فراهم می‌کند، زمانی که پیاده‌سازی‌های با اطمینان بالا از طرح‌ها یا استانداردهای تأییدشده PQC به‌طور گسترده در دسترس قرار گیرند.FalseTrue✓True✓V11.2.33تمام بدویات رمزنگاری (cryptographic primitives) بر اساس الگوریتم، اندازه کلید و پیکربندی، حداقل ۱۲۸ بیت سطح امنیتی را فراهم می‌کنند(2128)، برای مثال، یک کلید ECC با طول ۲۵۶ بیت تقریباً ۱۲۸ بیت امنیت ارائه می‌دهد، در حالی که برای رسیدن به همین سطح امنیت، الگوریتم RSA به کلید ۳۰۷۲ بیتی نیاز دارد.FalseTrue✓True✓V11.2.44تأیید کنید که تمامی عملیات رمزنگاری زمان ثابت (constant-time) باشند و هیچ عملیات «کوتاه‌شده» (short-circuit) در مقایسه‌ها، محاسبات یا بازگشت‌ها وجود نداشته باشد تا از نشت اطلاعات جلوگیری شود.( مهاجم می‌تواند از همین تفاوت‌های زمانی، از طریق Timing Side-Channel Attack، اطلاعات حساس را استخراج کند.)FalseFalseTrue✓V11.2.55تأیید کنید که تمامی ماژول‌های رمزنگاری به‌صورت امن دچار خطا (fail securely) شوند و خطاها به گونه‌ای مدیریت شوند که ایجاد آسیب‌پذیری‌هایی مانند حملات Padding Oracle را ممکن نکنند.FalseFalseTrue✓V11.33Encryption AlgorithmsV11.3.11از مد‌های بلاک ناامن (مانند ECB) و روش‌های Padding ضعیف (مانند PKCS#1 v1.5) نباید استفاده شود.True✓True✓True✓V11.3.22تنها رمزها و مد‌های تأییدشده، مانند AES با GCM باید استفاده شوند.True✓True✓True✓V11.3.33داده‌های رمزنگاری‌شده باید با استفاده از ترجیحاً یک روش رمزنگاری احراز هویت‌شده تأییدشده یا با ترکیب یک روش رمزنگاری تأییدشده با یک الگوریتم MAC تأییدشده در برابر تغییرات غیرمجاز محافظت شوند.FalseTrue✓True✓V11.3.44تأیید کنید که Nonceها، Initialization Vectorها و سایر اعداد یک‌بار مصرف برای بیش از یک جفت کلید رمزنگاری و عنصر داده استفاده نشوند. روش تولید آن‌ها باید متناسب با الگوریتم مورد استفاده باشد.FalseFalseTrue✓V11.3.55تأیید کنید که هر ترکیبی از یک الگوریتم رمزنگاری و یک الگوریتم MAC در حالت Encrypt-then-MAC عمل کند.FalseFalseTrue✓V11.44Hashing and Hash-based FunctionsV11.4.11تأیید کنید که تنها توابع هش تأییدشده برای موارد استفاده عمومی رمزنگاری، از جمله امضاهای دیجیتال، HMAC، KDF و تولید بیت تصادفی استفاده شوند. توابع هش غیرمجاز، مانند MD5، نباید برای هیچ هدف رمزنگاری به‌کار گرفته شوند.True✓True✓True✓V11.4.22رمزعبورها با استفاده از یک تابع مشتق‌سازی کلید تأییدشده و پرهزینه محاسباتی (که به آن «تابع هش رمزعبور» نیز گفته می‌شود) ذخیره شوند، و تنظیمات پارامترها بر اساس راهنمایی‌های کنونی پیکربندی شده باشد. این تنظیمات باید تعادل بین امنیت و عملکرد برقرار کنند تا حملات Brute-force برای سطح امنیت مورد نیاز به‌طور کافی دشوار باشد.FalseTrue✓True✓V11.4.33توابع هش استفاده‌شده در امضاهای دیجیتال، باید به‌عنوان بخشی از احراز هویت داده یا یکپارچگی داده، در برابر collision مقاوم بوده و طول بیت مناسب داشته باشند. اگر مقاومت در برابر collision لازم باشد، طول خروجی باید حداقل 256 بیت باشد. اگر تنها مقاومت در برابر حملات Second Pre-image لازم باشد، طول خروجی باید حداقل 128 بیت باشد.FalseTrue✓True✓V11.4.44برنامه باید هنگام استخراج کلیدهای مخفی از پسوردها از توابع مشتق‌سازی کلید (KDF) تاییدشده با پارامترهای Key Stretching استفاده می‌کند. پارامترهای مورد استفاده باید تعادلی بین امنیت و عملکرد برقرار کنند تا از نفوذ حملات brute-force و به خطر افتادن کلید رمزنگاری تولیدشده جلوگیری شود.FalseTrue✓True✓V11.55Random ValuesV11.5.11اعداد و رشته‌های تصادفی که قرار است قابل حدس نباشند، باید با استفاده از یک تولیدکننده اعداد شبه‌تصادفی امن رمزنگاری‌شده (CSPRNG) تولید شوند و حداقل 128 بیت انتروپی داشته باشند. توجه داشته باشید که UUIDها این شرط را رعایت نمی‌کنند.FalseTrue✓True✓V11.5.22مکانیزم تولید اعداد تصادفی مورد استفاده به‌گونه‌ای طراحی شده باشد که حتی تحت بار سنگین نیز به‌طور امن عمل کند.FalseFalseTrue✓V11.66Public Key CryptographyV11.6.11فقط الگوریتم‌های رمزنگاری و مدهای عملیاتی تأیید شده برای تولید کلید و مقداردهی اولیه، و همچنین برای تولید و تأیید امضاهای دیجیتال باید استفاده می‌شوند. الگوریتم‌های تولید کلید نباید کلیدهای ناامن تولید کنند که در برابر حملات شناخته شده آسیب‌پذیر باشند؛ به‌عنوان مثال، کلیدهای RSA که در برابر Fermat factorization آسیب‌پذیر هستند.FalseTrue✓True✓V11.6.22برای تبادل کلید از الگوریتم‌های رمزنگاری تأیید شده (مانند Diffie-Hellman) استفاده می‌شود و تمرکز بر این است که مکانیزم‌های تبادل کلید از پارامترهای امن بهره ببرند. این کار از حملات بر فرآیند برقراری کلید جلوگیری می‌کند و مانع حملات مرد میانی (MITM) یا شکست‌های رمزنگاری می‌شود.FalseFalseTrue✓V11.77In-Use Data CryptographyV11.7.11رمزنگاری کامل حافظه (Full Memory Encryption) باید فعال باشد تا داده‌های حساس هنگام استفاده محافظت شوند و دسترسی کاربران یا فرآیندهای غیرمجاز به آن‌ها جلوگیری شود.FalseFalseTrue✓V11.7.22کاهش داده‌ها (data minimization) تضمین می‌کند که حداقل مقدار داده در حین پردازش افشا شود، و اطمینان حاصل شود که داده‌ها بلافاصله پس از استفاده یا در اولین فرصت ممکن رمزنگاری شوند.FalseFalseTrue✓V1212SecureSecure CommunicationV12.11General TLS Security GuidanceV12.1.11جدیدترین نسخه‌های پیشنهادی پروتکل TLS فعال باشند، مانند TLS 1.2 و TLS 1.3 نسخه‌ی جدیدترین پروتکل TLS باید گزینه‌ی ترجیحی باشد.True✓True✓True✓V12.1.22تنها cipher suiteهای پیشنهادی فعال باشند و قوی‌ترین cipher suiteها به‌عنوان گزینه‌ی ترجیحی تنظیم شده باشند. برنامه‌های L3 باید تنها از cipher suiteهایی پشتیبانی کنند که Forward Secrecy را فراهم می‌کنند.FalseTrue✓True✓V12.1.33برنامه باید پیش از استفاده از هویت گواهی برای احراز هویت یا مجوزدهی، اعتبار و مورد اعتماد بودن گواهی‌های کلاینت در mTLS را بررسی و تأیید ‌کند.FalseTrue✓True✓V12.1.44لغو صحیح گواهی‌ها، مانند OCSP ، باید فعال و به‌درستی پیکربندی شده باشد.FalseFalseTrue✓V12.1.55Encrypted Client Hello (ECH) باید در تنظیمات TLS برنامه فعال باشد تا از افشای متادیتای حساس، مانند Server Name Indication (SNI)، در طول فرآیند Handshake TLS جلوگیری شود.FalseFalseTrue✓V12.22HTTPS Communication with External Facing ServicesV12.2.11برای تمام ارتباطات بین کلاینت و سرویس‌های مبتنی بر HTTP که در معرض دسترسی خارجی هستند، از TLS باید استفاده ‌شود و هیچ‌گونه بازگشت (fallback) به ارتباطات ناامن یا بدون رمزنگاری انجام نگیرد.True✓True✓True✓V12.2.22سرویس‌هایی که در معرض دسترسی خارجی قرار دارند از گواهی‌های TLS عمومی و مورد اعتماد استفاده می‌کنند.True✓True✓True✓V12.33General Service to Service Communication SecurityV12.3.11یک پروتکل رمزنگاری‌شده مانند TLS باید برای تمامی ارتباطات ورودی و خروجی به و از برنامه استفاده شود، از جمله سیستم‌های مانیتورینگ، ابزارهای مدیریت، دسترسی از راه دور و SSH، میان‌افزارها، پایگاه‌های داده، mainframes، سیستم‌های partner یا APIهای خارجی. سرور نباید به پروتکل‌های ناامن یا بدون رمزگذاری بازگردد.FalseTrue✓True✓V12.3.22کلاینت‌های TLS باید قبل از برقراری ارتباط با سرور TLS، گواهی‌های دریافتی را اعتبارسنجی کنند.FalseTrue✓True✓V12.3.33TLS یا دیگر مکانیزم‌های مناسب رمزگذاری انتقال باید برای تمامی ارتباطات بین سرویس‌های داخلی مبتنی بر HTTP درون برنامه استفاده شود و ارتباط به حالت‌های ناامن یا بدون رمزگذاری بازنگردد.FalseTrue✓True✓V12.3.44ارتباطات TLS بین سرویس‌های داخلی باید از گواهی‌های معتبر استفاده کنند. در صورتی که از گواهی‌های داخلی تولیدشده یا Self-Signed استفاده شود، سرویس مصرف‌کننده باید به‌گونه‌ای پیکربندی شود که تنها به CAهای داخلی مشخص و گواهی‌های Self-Signed خاص اعتماد کند.FalseTrue✓True✓V12.3.55سرویس‌هایی که درون یک سیستم با یکدیگر ارتباط دارند (ارتباطات درون‌سرویسی)، باید از احراز هویت قوی استفاده کنند تا هر نقطه انتهایی (endpoint) تأیید شود. روش‌های احراز هویت قوی، مانند احراز هویت کلاینت TLS، باید به‌کار گرفته شوند تا هویت تضمین شود (با استفاده از زیرساخت کلید عمومی (PKI) و مکانیزم‌هایی که در برابر حملات تکرار (replay attacks) مقاوم هستند). برای معماری‌های میکروسرویس، استفاده از سرویس مش برای ساده‌سازی مدیریت گواهی‌ها و افزایش امنیت در نظر گرفته شودFalseFalseTrue✓V1313ConfigurationConfigurationV13.11Configuration DocumentationV13.1.11تمامی نیازهای ارتباطی برنامه باید به‌طور کامل مستندسازی شده باشند. این مستندسازی شامل سرویس‌های خارجی که برنامه به آن‌ها وابسته است و همچنین مواردی که کاربر نهایی جهت اتصال به سرویس خارجی مشخص می‌کند باید باشد.FalseTrue✓True✓V13.1.22برای هر سرویسی که برنامه استفاده می‌کند، مستندسازی باید شامل حداکثر تعداد ارتباطات همزمان (مثلاً محدودیت‌های Connection Pool) و نحوه‌ی رفتار برنامه هنگام رسیدن به این حد باشد، از جمله هر مکانیزم بازیابی یا جایگزین، تا از بروز شرایط Denial of Service جلوگیری شود.FalseFalseTrue✓V13.1.33مستندات برنامه باید استراتژی‌های مدیریت منابع را برای هر سیستم یا سرویس خارجی که استفاده می‌کند مشخص کرده باشد (مثلاً پایگاه‌های داده، هندل‌های فایل، رشته‌ها، اتصالات HTTP) این مستندسازی باید شامل این موارد باشد :رویه‌های آزادسازی منابع، تنظیمات تایم‌اوت، مدیریت خطاها، جایی که منطق Retry اعمال می‌شود، شامل محدودیت تعداد Retry، تأخیرها و الگوریتم‌هایBack-off. برای عملیات همزمان درخواست–پاسخ HTTP (Synchronous)، مستندات باید تایم‌اوت کوتاه را الزام کند و یا Retryها را غیرفعال کند یا به‌طور سختگیرانه محدود کند تا از تاخیرهای زنجیره‌ای و هدررفت منابع جلوگیری شود.FalseFalseTrue✓V13.1.44مستندسازی برنامه باید شامل secretهای حیاتی برای امنیت برنامه و همچنین برنامه‌ای برای چرخش آن‌ها باشد( بر اساس مدل تهدید سازمان و نیازهای کسب‌وکار).FalseFalseTrue✓V13.22Backend Communication ConfigurationV13.2.11رتباطات بین اجزای بک‌اند برنامه که از مکانیزم استاندارد نشست کاربران برنامه پشتیبانی نمی‌کنند، از جمله APIها، میان‌افزارها و لایه‌های داده، باید احراز هویت شده باشند. احراز هویت باید با استفاده از حساب‌های سرویس جداگانه، توکن‌های کوتاه‌مدت یا احراز هویت مبتنی بر گواهی انجام شود و نباید از اعتبارنامه‌های ثابت مانند رمز عبور، کلیدهای API یا حساب‌های مشترک با دسترسی‌های سطح بالا استفاده شود.FalseTrue✓True✓V13.2.22ارتباطات بین اجزای بک‌اند، از جمله سرویس‌های محلی یا سیستم‌عامل، APIها، میان‌افزارها و لایه‌های داده، با حساب‌هایی باید انجام شود که کمترین سطح دسترسی لازم را دارند.FalseTrue✓True✓V13.2.33اگر اعتبارنامه‌ای برای احراز هویت سرویس استفاده می‌شود، اعتبارنامه‌ای که توسط مصرف‌کننده استفاده می‌شود، اعتبارنامه پیش‌فرض نباشد (مثلاً root/root یا admin/admin).FalseTrue✓True✓V13.2.44یک allowlist برای تعیین منابع یا سیستم‌های خارجی که برنامه مجاز به ارتباط با آن‌ها است باید وجود داشته باشد (مثلاً برای درخواست‌های خروجی، بارگذاری داده یا دسترسی به فایل). این allowlist می‌تواند در لایه برنامه، وب‌سرور، فایروال یا ترکیبی از لایه‌های مختلف پیاده‌سازی شود.FalseTrue✓True✓V13.2.55وب‌سرور یا سرور برنامه با یک allowlist از منابع یا سیستم‌هایی که سرور می‌تواند به آن‌ها درخواست ارسال کند یا داده‌ها و فایل‌ها را بارگذاری کند پیکربندی شده باشد.FalseTrue✓True✓V13.2.66در مواقعی که برنامه به سرویس‌های جداگانه متصل می‌شود، پیکربندی مستندسازی‌شده برای هر اتصال رعایت شود، از جمله حداکثر ارتباطات همزمان، رفتار هنگام رسیدن به حداکثر ارتباط مجاز، زمان‌های Timeout اتصال و استراتژی‌های Retry.FalseFalseTrue✓V13.33Secret ManagementV13.3.11یک راهکار مدیریت secret، مانند Key Vault، برای ایجاد امن، ذخیره، کنترل دسترسی و از بین بردن secret بک‌اند استفاده شود. این secret می‌تواند شامل رمزعبورها، داده‌های رمز نگاری، اطلاعات حساس مربوط به اتصال به پایگاه داده و سیستم‌های شخص ثالث، کلیدها و seedهای توکن‌های زمان‌محور، سایر secretهای داخلی و کلیدهای API باشد. Secret نباید در کد منبع برنامه یا در build artifacts قرار گیرد. برای برنامه‌های L3، این باید شامل راهکاری مبتنی بر سخت‌افزار مانند HSM باشد.FalseTrue✓True✓V13.3.22دسترسی به دارایی‌های secret بر اساس اصل حداقل دسترسی (Least Privilege) رعایت شود.FalseTrue✓True✓V13.3.33تمام عملیات رمزنگاری باید با استفاده از یک ماژول امنیتی ایزوله (مانند Vault یا Hardware Security Module) انجام شود تا مواد کلیدی به‌طور امن مدیریت و محافظت شده و از افشای خارج از ماژول امنیتی جلوگیری شود.FalseFalseTrue✓V13.3.44secretها بر اساس مستندسازی برنامه طوری پیکربندی شوند که منقضی شده و چرخش داده شوند.FalseFalseTrue✓V13.44Unintended Information LeakageV13.4.11برنامه باید به‌گونه‌ای مستقر شود که هیچ‌گونه متادیتای کنترل نسخه، از جمله پوشه‌های .git یا .svn، در دسترس نباشد یا به شکلی باشد که این پوشه‌ها نه از بیرون و نه توسط خود برنامه قابل دسترسی نباشند.True✓True✓True✓V13.4.22حالت‌های Debug برای تمام اجزا در محیط‌های production باید غیرفعال شده باشند تا از افشای قابلیت‌های دیباگ و نشت اطلاعات جلوگیری شود.FalseTrue✓True✓V13.4.33وب‌سرورها فهرست‌بندی دایرکتوری‌ها را به کاربر نهایی نباید نمایش دهند مگر اینکه به‌طور صریح مورد نظر باشد.FalseTrue✓True✓V13.4.44از متد HTTP TRACE در محیط‌های production نباید پشتیبانی شود تا از احتمال نشت اطلاعات جلوگیری شود.FalseTrue✓True✓V13.4.55مستندسازی‌ها (مانند مستندات APIهای داخلی) و نقاط پایش (Monitoring Endpoints) در دسترس نباشند مگر اینکه به‌طور صریح مورد نظر باشد.FalseTrue✓True✓V13.4.66تأیید کنید که برنامه اطلاعات نسخه دقیق اجزای backend را افشا نکند.FalseFalseTrue✓V13.4.77لایه وب باید به‌گونه‌ای پیکربندی شده باشد که فقط فایل‌هایی با پسوندهای مشخص را سرو کند تا از افشای تصادفی اطلاعات، پیکربندی و کد منبع جلوگیری شود.FalseFalseTrue✓V1414DataData ProtectionV14.11Data Protection DocumentationV14.1.11تمامی داده‌های حساس ایجادشده و پردازش‌شده توسط برنامه باید شناسایی شده و بر اساس سطوح حفاظتی طبقه‌بندی شده‌اند. این موضوع شامل داده‌هایی می‌شود که صرفاً کُدگذاری شده‌اند و به‌راحتی قابل بازیابی هستند، مانند رشته‌های Base64 یا محتوای متنی (plaintext) داخل یک JWT. سطوح حفاظتی باید الزامات قوانین و استانداردهای حفاظت از داده و حریم خصوصی که برنامه ملزم به رعایت آن‌هاست را در نظر بگیرند.FalseTrue✓True✓V14.1.22برای تمامی سطوح حفاظت از داده‌های حساس، مجموعه‌ای مستند از الزامات حفاظتی تعریف شده باشد. این الزامات باید شامل (اما محدود به آن نباشد) موارد زیر باشند: الزامات مرتبط با رمزنگاری کلی، بررسی صحت و یکپارچگی، دوره‌های نگهداری داده، نحوه ثبت داده‌ها در لاگ، کنترل‌های دسترسی به داده‌های حساس در لاگ‌ها، رمزنگاری در سطح پایگاه داده، الزامات مربوط به حریم خصوصی و فناوری‌های تقویت‌کننده حریم خصوصی مورد استفاده، و سایر الزامات مرتبط با محرمانگی.FalseTrue✓True✓V14.22General Data ProtectionV14.2.11داده‌های حساس باید فقط در بدنه پیام HTTP یا فیلدهای هدر به سرور ارسال شوند، و اینکه URL و query string شامل اطلاعات حساس (مانند API key یا session token) نباشند.True✓True✓True✓V14.2.22برنامه باید از cache شدن داده‌های حساس در اجزای سرور مانند Load Balancer و Application Cache جلوگیری کند، یا اطمینان حاصل شود که داده‌ها پس از استفاده به‌طور ایمن پاک‌سازی می‌شوند.FalseTrue✓True✓V14.2.33داده‌های حساس تعریف‌شده به طرف‌های غیرقابل اعتماد (مانند User Trackers) نباید ارسال شوند تا از جمع‌آوری ناخواسته داده‌ها خارج از کنترل برنامه جلوگیری شود.FalseTrue✓True✓V14.2.44کنترل‌های مرتبط با داده‌های حساس شامل رمزنگاری، بررسی صحت و یکپارچگی، نگهداری، نحوه ثبت داده‌ها در لاگ، کنترل‌های دسترسی به داده‌های حساس در لاگ‌ها، حریم خصوصی و فناوری‌های مربوط به حریم خصوصی، مطابق با آنچه در مستندات برای سطح حفاظت مشخص هر داده تعریف شده است، پیاده‌سازی شوند.FalseTrue✓True✓V14.2.55مکانیزم‌های cache باید طوری پیکربندی شده باشند که تنها پاسخ‌هایی با نوع محتوای مورد انتظار برای آن منبع cache شوند و شامل محتوای حساس یا پویا نباشند. وب‌سرور باید هنگام دسترسی به فایل ناموجود، پاسخ 404 یا 302 برگرداند و نه فایل معتبر دیگر، تا از حملات Web Cache Deception جلوگیری شود.FalseFalseTrue✓V14.2.66برنامه باید تنها حداقل داده‌های حساس مورد نیاز برای عملکرد برنامه را بازگرداند. برای مثال، تنها برخی از ارقام شماره کارت اعتباری بازگردانده شود و نه شماره کامل. در صورتی که داده کامل لازم باشد، باید در رابط کاربری masked شود مگر اینکه کاربر به‌طور مشخص آن را مشاهده کند.FalseFalseTrue✓V14.2.77اطلاعات حساس باید تحت طبقه‌بندی دوره‌ای نگهداری داده قرار گرفته باشند، به‌گونه‌ای که داده‌های قدیمی یا غیرضروری به‌طور خودکار، در یک برنامه زمان‌بندی‌شده مشخص، یا براساس نیاز حذف شوند.FalseFalseTrue✓V14.2.88اطلاعات حساس باید از متادیتای فایل‌های ارسال‌شده توسط کاربر حذف شود، مگر اینکه ذخیره‌سازی آن با رضایت کاربر انجام شود.FalseFalseTrue✓V14.33Client-side Data ProtectionV14.3.11داده‌های احراز هویت‌شده از حافظه کلاینت، مانند DOM مرورگر، پس از خروج کلاینت یا Session پاک شوند. فیلد هدر Clear-Site-Data در پاسخ سرور می‌تواند در این زمینه مفید باشد، اما کلاینت باید بتواند داده‌ها را حتی زمانی که اتصال به سرور در دسترس نیست در زمان پایان Session (خروج از آن) پاک کند.True✓True✓True✓V14.3.22برنامه باید هدرهای پاسخ HTTP، anti-cach مناسب (مانند Cache-Control: no-store) را تنظیم کند تا داده‌های حساس در مرورگرها cache نشوند.FalseTrue✓True✓V14.3.33برای اطلاعات بیشتر، همچنین به منابع زیر مراجعه کنید:FalseTrue✓True✓V1515SecureSecure Coding and ArchitectureV15.11Secure Coding and Architecture DocumentationV15.1.11مستندات برنامه باید بازه‌های زمانی جهت برطرف سازی آسیب‌پذیری‌ نسخه‌های مؤلفه‌ شخص ثالث (بر اساس ریسک) و همچنین به‌روزرسانی کتابخانه‌ها را به طور کلی تعریف کرده باشد تا ریسک ناشی از این مؤلفه‌ها به حداقل برسد.True✓True✓True✓V15.1.22یک کاتالوگ دارایی مانند Software Bill of Materials (SBOM) باید برای تمامی کتابخانه‌های شخص ثالث مورد استفاده نگهداری شود. شامل تایید این که مؤلفه‌ها از مخازن از پیش تعیین‌شده، قابل اعتماد و به‌طور مستمر نگهداری‌شده تهیه شده‌اند.FalseTrue✓True✓V15.1.33مستندات برنامه باید شامل عملکردهایی که زمان‌بر یا پرمصرف(منابع سیستمی) هستند نیز باشد. این مورد باید شامل روش‌هایی برای جلوگیری از دست‌رفتن دسترس‌پذیری به دلیل استفاده بیش از حد از این عملکردها و همچنین جلوگیری از وضعیتی باشد که پردازش یک پاسخ طولانی‌تر از زمان انتظار مصرف‌کننده شود. تدابیر احتمالی می‌تواند شامل پردازش غیرهمزمان، استفاده از صف‌ها و محدود کردن فرآیندهای موازی برای هر کاربر و هر برنامه باشد.FalseTrue✓True✓V15.1.44مستندات برنامه باید کتابخانه‌های شخص ثالثی را که به‌عنوان «کامپوننت‌های پرخطر» شناخته می‌شوند، مشخص کرده باشد.FalseFalseTrue✓V15.1.55مستندات برنامه باید بخش‌هایی از برنامه را که به‌عنوان «عملکرد خطرناک» استفاده می‌شود، مشخص کرده باشد.FalseFalseTrue✓V15.22Security Architecture and DependenciesV15.2.11برنامه باید تنها شامل کامپوننت‌هایی باشد که چارچوب‌های زمانی مستند‌شده برای به‌روزرسانی و رفع آسیب‌پذیری‌ها را نقض نکرده‌باشند.True✓True✓True✓V15.2.22برنامه باید بر اساس تصمیمات و استراتژی‌های امنیتی مستندسازی‌شده، تدابیری برای جلوگیری از کاهش دسترس‌پذیری ناشی از عملکردهایی که زمان‌بر یا پرمصرف منابع هستند، پیاده‌سازی کرده باشد.FalseTrue✓True✓V15.2.33محیط production تنها شامل عملکردهایی می‌باشد که برای اجرای برنامه ضروری هستند و هیچ قابلیت اضافی مانند کدهای تست، نمونه‌کدها و عملکردهای توسعه‌ای در دسترس نمی‌باشد.FalseTrue✓True✓V15.2.44کامپوننت‌های شخص ثالث و تمام وابستگی‌های انتقالی آن‌ها از مخزن مورد انتظار باید دریافت ‌شوند، چه داخلی و چه منبع خارجی، و ریسک حمله‌ی dependency confusion مدیریت شود.FalseFalseTrue✓V15.2.55برنامه باید محافظت‌های اضافی را در بخش‌هایی از برنامه که به‌عنوان «عملکرد خطرناک» مستند شده‌اند یا از کتابخانه‌های شخص ثالثی که به‌عنوان «کامپوننت‌های پرریسک» شناخته می‌شوند، پیاده‌سازی می‌کند. این می‌تواند شامل تکنیک‌هایی مانند sandboxing، encapsulation، containerization یا جداسازی در سطح شبکه باشد تا حمله‌کنندگان پس از نفوذ به یک بخش از برنامه، نتوانند به بخش‌های دیگر برنامه منتقل شوند و زمان لازم برای پیشروی آن‌ها افزایش یابد.FalseFalseTrue✓V15.33Defensive CodingV15.3.11برنامه باید تنها زیرمجموعه‌ای از فیلدهای مورد نیاز از یک data object را بازگرداند. به‌عنوان مثال، نباید کل data object بازگردانده شود، زیرا برخی فیلدهای منفرد نباید برای کاربران قابل دسترسی باشند.True✓True✓True✓V15.3.22در جایی که بک‌اند برنامه به URLهای خارجی فراخوانی می‌فرستد، طوری باید پیکربندی شده باشد که تنها در صورت نیاز و منظور مشخص، از تغییر مسیرها (redirects) پیروی کند.FalseTrue✓True✓V15.3.33برنامه باید دارای تدابیر مقابله‌ای برای محافظت در برابر حملات mass assignment باشد، به‌طوری که فیلدهای مجاز برای هر کنترلر و اکشن محدود شده باشند؛ به عنوان مثال، نباید بتوان مقداری برای فیلدی وارد یا به‌روزرسانی کرد که قرار نبوده بخشی از آن اکشن باشد.FalseTrue✓True✓V15.3.44تمام اجزای proxying و middleware باید آدرس IP اصلی کاربر را به‌درستی منتقل کنند، با استفاده از فیلدهای داده معتبر که توسط کاربر نهایی قابل دستکاری نباشند، و برنامه و وب‌سرور از این مقدار صحیح برای ثبت لاگ و تصمیم‌گیری‌های امنیتی مانند rate limiting استفاده کنند، با در نظر گرفتن اینکه حتی آدرس IP اصلی ممکن است به دلیل IPهای پویا، VPNها یا فایروال‌های سازمانی قابل اعتماد نباشد.FalseTrue✓True✓V15.3.55برنامه باید به‌طور صریح اطمینان حاصل کند که variables از نوع صحیح هستند و عملیات‌های مقایسه و comparator به‌صورت دقیق (strict) انجام می‌شوند. این اقدام برای جلوگیری از آسیب‌پذیری‌های type juggling یا type confusion است که ممکن است به دلیل فرضیات نادرست برنامه درباره نوع یک متغیر ایجاد شود.FalseTrue✓True✓V15.3.66کد JavaScript باید به‌گونه‌ای نوشته شده باشد که از prototype pollution جلوگیری کند، برای مثال با استفاده از Set() یا Map() به جای object literals.FalseTrue✓True✓V15.3.77برنامه باید دارای تدابیر محافظتی در برابر HTTP parameter pollution باشد، به‌ویژه اگر چارچوب برنامه تفاوتی بین منابع پارامترهای درخواست (رشته‌های query، پارامترهای body، کوکی‌ها یا فیلدهای هدر) قائل نشود.FalseTrue✓True✓V15.44Safe ConcurrencyV15.4.11shared objects در کد multi-threaded (مانند cacheها، فایل‌ها، یا اشیائی که توسط multiple threads دسترسی پیدا می‌کنند) باید به‌صورت ایمن مورد استفاده قرار بگیرند، با استفاده از نوع‌های thread-safe و مکانیزم‌های همگام‌سازی مانند lock یا semaphore تا از race condition و تخریب داده جلوگیری شود.FalseFalseTrue✓V15.4.22بررسی وضعیت یک resource، مانند وجود آن یا دسترسی‌ها،و اقداماتی که به این وضعیت وابسته‌اند، به‌صورت یک عملیات واحد انجام شوند تا از race condition نوع time-of-check to time-of-use (TOCTOU) جلوگیری شود. برای مثال، بررسی اینکه یک فایل وجود دارد قبل از باز کردن آن، یا تأیید دسترسی یک کاربر قبل از اعطای آن.FalseFalseTrue✓V15.4.33باید از قفل‌ها (Locks) به طور یکنواخت استفاده شود تا از گیر کردن (Threads) جلوگیری شود، چه با انتظار برای یکدیگر و چه با تلاش بی‌پایان، و همچنین منطق قفل‌گذاری باید در همان کدی باقی بماند که مسئول مدیریت منبع است؛ این کار تضمین می‌کند که قفل‌ها نمی‌توانند به‌صورت ناخواسته یا خرابکارانه توسط کلاس‌ها یا کدهای بیرونی تغییر داده شوند.FalseFalseTrue✓V15.4.44تأیید کنید که سیاست‌های تخصیص resource از thread starvation جلوگیری می‌کنند، با اطمینان از دسترسی عادلانه به منابع، مانند استفاده از thread pools و اجازه دادن به threads با اولویت پایین‌تر تا در بازه زمانی منطقی پیشرفت کنند.FalseFalseTrue✓V1616SecuritySecurity Logging and Error HandlingV16.11Security Logging DocumentationV16.1.11فهرستی باید وجود داشته باشد که در آن ثبت وقایع (Logging) انجام‌شده در هر لایه از stack فناوری برنامه، رویدادهای ثبت‌شده، فرمت‌های لاگ، محل ذخیره‌سازی، نحوه استفاده، نحوه کنترل دسترسی به آن‌ها و مدت زمان نگهداری لاگ‌ها مستند شده است.FalseTrue✓True✓V16.22General LoggingV16.2.11هر ورودی لاگ باید شامل متادیتای لازم (مانند زمان، مکان، چه کسی و چه چیزی) باشد تا امکان بررسی دقیق خط زمانی هنگام وقوع یک رویداد فراهم شود.FalseTrue✓True✓V16.2.22منابع زمانی برای تمام مؤلفه‌های لاگ با هم همگام‌سازی شده‌اند و مهر زمان (timestamp)‌ در متادیتای رویدادهای امنیتی از UTC استفاده ‌کند یا شامل یک اختلاف‌زمان (time zone offset) صریح باشد. استفاده از UTC توصیه می‌شود تا یکپارچگی در سراسر سیستم‌های توزیع‌شده تضمین شود و از بروز سردرگمی در زمان تغییر ساعت تابستانی جلوگیری گردد.FalseTrue✓True✓V16.2.33برنامه تنها لاگ‌ها را در فایل‌ها و سرویس‌هایی ذخیره یا ارسال می‌کند که در فهرست مستند لاگ‌ها ثبت شده‌اند.FalseTrue✓True✓V16.2.44لاگ‌ها باید توسط پردازشگر لاگی که در حال استفاده است خوانده و همبسته شوند، و ترجیحاً با استفاده از یک فرمت لاگ مشترک این کار انجام گیرد.FalseTrue✓True✓V16.2.55هنگام لاگ‌گیری از داده‌های حساس، برنامه باید لاگ گیری را بر اساس سطح حفاظت داده اعمال کند. برای مثال، ممکن است لاگ‌کردن برخی داده‌ها مانند اطلاعات ورود یا جزئیات پرداخت مجاز نباشد. داده‌های دیگر، مانند session token، تنها در صورتی باید لاگ شوند که به‌صورت hash یا masked، چه به‌طور کامل یا جزئی، ثبت شوند.FalseTrue✓True✓V16.33Security EventsV16.3.11تمام عملیات احراز هویت باید لاگ‌گیری ‌شوند، از جمله تلاش‌های موفق و ناموفق. همچنین باید متادیتای اضافی، مانند نوع احراز هویت یا عوامل استفاده‌شده، جمع‌آوری شود.FalseTrue✓True✓V16.3.22تلاش‌های ناموفق برای مجوزدهی (authorization) باید لاگ‌گیری ‌شوند. برای برنامه‌های L3، این باید شامل لاگ‌گیری تمام تصمیمات مجوزدهی باشد، از جمله ثبت زمانی که داده‌های حساس دسترسی پیدا می‌کنند، بدون آنکه خود داده‌های حساس ثبت شوند.FalseTrue✓True✓V16.3.33برنامه باید رویدادهای امنیتی تعریف‌شده در مستندات (ابتدای بخش) را لاگ‌ نماید و همچنین تلاش‌ها برای دور زدن کنترل‌های امنیتی، مانند اعتبارسنجی ورودی، منطق کسب‌وکار و ضد‌خودکارسازی، را نیز ثبت ‌کند.FalseTrue✓True✓V16.3.44برنامه باید خطاهای غیرمنتظره و شکست‌های کنترل‌های امنیتی، مانند شکست‌های TLS در بک اند را لاگ ‌کند.FalseTrue✓True✓V16.44Log ProtectionV16.4.11تمام مؤلفه‌های لاگ‌گیری باید داده‌ها را به‌طور مناسب رمزگذاری ‌کنند تا از حملات log injection جلوگیری شود.FalseTrue✓True✓V16.4.22لاگ‌ها باید در برابر دسترسی غیرمجاز محافظت شده و امکان تغییر آن‌ها وجود نداشته باشد.FalseTrue✓True✓V16.4.33لاگ‌ها به‌صورت امن باید به یک سیستم منطقی جداگانه برای تحلیل، تشخیص، هشدار و ارجاع منتقل شوند. هدف این است که در صورت نفوذ به برنامه، لاگ‌ها به خطر نیفتند.FalseTrue✓True✓V16.55Error HandlingV16.5.11هنگام بروز خطاهای غیرمنتظره یا حساس به امنیت، پیامی عمومی به کاربر باید بازگردانده ‌شود، به‌گونه‌ای که هیچ‌گونه اطلاعات حساس داخلی سیستم مانند stack trace، کوئری‌ها، کلیدها و توکن‌های محرمانه افشا نشود.FalseTrue✓True✓V16.5.22برنامه باید هنگام بروز خطا در دسترسی به منابع خارجی همچنان به‌صورت امن عمل نماید، برای مثال با استفاده از الگوهایی مانند circuit breaker یا کاهش تدریجی عملکرد (graceful degradation).FalseTrue✓True✓V16.5.33برنامه باید به‌صورت امن و کنترل‌شده دچار خطا ‌شود، حتی هنگام وقوع استثنا، و از شرایط fail-open جلوگیری نماید؛ برای مثال، از پردازش تراکنش در صورت بروز خطا در منطق اعتبارسنجی جلوگیری شود.FalseTrue✓True✓V16.5.44یک « last resort» باید تعریف شده باشد که تمامی unhandled exception را مدیریت کند. این کار هم برای جلوگیری از از دست رفتن جزئیات خطا که باید در فایل‌های لاگ ثبت شوند و هم برای اطمینان از این است که خطا باعث از کار افتادن کل فرآیند برنامه و در نتیجه از دست رفتن دسترسی نشود، ضروری است.FalseFalseTrue✓V1717WebRTCWebRTCV17.11TURN ServerV17.1.11سرویس Traversal Using Relays around NAT (TURN) باید تنها به آدرس‌های IP دسترسی دهد که برای اهداف ویژه رزرو نشده‌اند (مثلاً شبکه‌های داخلی، broadcast، loopback). توجه داشته باشید که این مورد هم برای آدرس‌های IPv4 و هم برای IPv6 صدق می‌کند.FalseTrue✓True✓V17.1.22سرویس Traversal Using Relays around NAT (TURN)، نباید به resource exhaustion آسیب‌پذیر باشد، حتی زمانی که کاربران قانونی تلاش کنند تعداد زیادی پورت روی سرور TURN باز کنند.FalseFalseTrue✓V17.22MediaV17.2.11کلید مربوط به گواهی Datagram Transport Layer Security (DTLS) بر اساس سیاست مستند مدیریت کلیدهای رمزنگاری مدیریت و محافظت می‌شود.FalseTrue✓True✓V17.2.22سرور Media طوری پیکربندی شده باشد که از مجموعه‌های رمزنگاری تاییدشده Datagram Transport Layer Security (DTLS) استفاده کند و از یک پروفایل محافظتی امن برای گسترش DTLS به منظور ایجاد کلیدها برای پروتکل Secure Real-time Transport Protocol (DTLS-SRTP) پشتیبانی نماید.FalseTrue✓True✓V17.2.33احراز هویت Secure Real-time Transport Protocol (SRTP) در سرور Media بررسی ‌شود تا از حملات تزریق Real-time Transport Protocol (RTP) جلوگیری شده و این حملات باعث بروز شرایط Denial of Service یا وارد شدن محتوای صوتی یا تصویری ناخواسته به جریان‌های رسانه‌ای نشوند.FalseTrue✓True✓V17.2.44سرور Media باید قادر باشد پردازش ترافیک رسانه‌ای ورودی را حتی هنگام مواجهه با بسته‌های Secure Real-time Transport Protocol (SRTP) ناقص یا خراب ادامه دهد.FalseTrue✓True✓V17.2.55سرور Media باید قادر باشد پردازش ترافیک رسانه‌ای ورودی را حتی در هنگام دریافت سیلی(flood) از بسته‌های Secure Real-time Transport Protocol (SRTP) از کاربران قانونی ادامه دهد.FalseFalseTrue✓V17.2.66سرور Media نسبت به آسیب‌پذیری "ClientHello Race Condition " در Datagram Transport Layer Security (DTLS) نباید آسیب‌پذیر نباشد، این کار می‌تواند با بررسی اینکه آیا سرور رسانه به‌صورت عمومی به عنوان آسیب‌پذیر شناخته شده است یا با انجام آزمون Race Condition انجام شود.FalseFalseTrue✓V17.2.77مکانیزم‌های ضبط صدا یا تصویر مرتبط با سرور رسانه در هنگام طوفان بسته‌ای (Flood) از پروتکل انتقال بلادرنگ امن (SRTP) توسط کاربران مجاز، باید قادر به ادامه پردازش ترافیک رسانه ورودی است.FalseFalseTrue✓V17.2.88گواهی‌نامه امنیت لایه انتقال دیتاگرام (DTLS) باید با ویژگی اثر انگشت (Fingerprint) پروتکل توصیف نشست (SDP) بررسی می‌شود و در صورت شکست در بررسی، جریان رسانه قطع می‌شود تا اصالت جریان رسانه تضمین گردد.FalseFalseTrue✓V17.33SignalingV17.3.11سرور سیگنالینگ باید قادر باشد حتی در جریان flood attack، پیام‌های سیگنالینگ ورودی مشروع را پردازش کند. این باید با اعمال محدودیت نرخ (rate limiting) در سطح سیگنالینگ محقق شود.FalseTrue✓True✓V17.3.22سرور سیگنالینگ باید قادر باشد پیام‌های سیگنالینگ مشروع را حتی در مواجهه با پیام‌های سیگنالینگ ناقص یا مخرب که می‌توانند باعث ایجاد شرایط عدم دسترسی (Denial of Service) شوند، پردازش کند. این می‌تواند شامل اعمال اعتبارسنجی ورودی، مدیریت ایمن سرریز عدد صحیح (integer overflow)، جلوگیری از سرریز بافر (buffer overflow) و استفاده از دیگر تکنیک‌های مقاوم مدیریت خطا باشد.FalseTrue✓True✓ diff --git a/5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.xml b/5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.xml new file mode 100644 index 0000000000..0025f140dd --- /dev/null +++ b/5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.xml @@ -0,0 +1 @@ +Application Security Verification Standard ProjectASVS5.0.0The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.V11EncodingEncoding and SanitizationV1.11ساختار Encoding and SanitizationV1.1.11ورودی فقط یک‌بار به فرم استاندارد decoded یا unescaped شود، و این تنها زمانی انجام شود که انتظار می‌رود داده واقعاً در آن قالب رمزگذاری‌شده دریافت شده باشد. این فرآیند باید قبل از هرگونه پردازش بعدی روی ورودی انجام شود، و به‌هیچ‌وجه نباید پس از اعتبارسنجی یا پاک‌سازی انجام گیرد.2V1.1.22برنامه فرآیند encode و escape خروجی را به‌عنوان آخرین مرحله انجام می‌دهد؛ به‌گونه‌ای که این عملیات یا دقیقاً پیش از استفاده داده در مفسر مربوطه انجام شود، یا اینکه خود مفسر به‌طور داخلی این کار را انجام دهد.2V1.22پیشگیری از تزریقV1.2.11encoding خروجی برای پاسخ HTTP، سند HTML یا سند XML با زمینه‌ای که داده در آن استفاده می‌شود باید متناسب باشد؛ برای مثال، در رمزگذاری کاراکترهای مربوط به عناصر HTML، صفات HTML، توضیحات HTML، CSS یا فیلدهای هدر HTTP به‌گونه‌ای عمل شود که ساختار پیام یا سند تغییر نکند.1V1.2.22هنگام ساخت پویا آدرس‌های URL، داده‌های غیرقابل‌اعتماد باید متناسب با زمینه استفاده‌شان رمزگذاری شوند (مثلاً URL Encoding یا base64url برای پارامترهای کوئری یا مسیر) همچنین اطمینان حاصل شود که فقط پروتکل‌های امن در URL مجاز باشند (برای نمونه، استفاده از JavaScript: یا data: ممنوع شود)1V1.2.33هنگام تولید پویا محتوای JavaScript (از جملهJSON)، از encoding یا escaping خروجی استفاده شود تا از تغییر ساختار پیام یا سند جلوگیری گردد (و از حملات تزریق JavaScript یا JSON پیشگیری شود).1V1.2.44در انتخاب داده یا اجرای کوئری‌های پایگاه داده (مانند SQL، HQL، NoSQL ...)، از parameterized queries، ORMها، یا Entity Framework استفاده شود یا به روش‌های دیگر، برنامه در برابر تزریق SQL و سایر حملات تزریقی پایگاه داده ایمن شده باشد. این موضوع هنگام نوشتن stored procedure‌ها نیز صدق می‌کند.1V1.2.55برنامه در برابر تزریق دستورات سیستم‌عامل (OS command injection) محافظت شده است و در فراخوانی‌های سیستم‌عامل، از کوئری‌های پارامتری‌شده سیستم‌عامل یا Encoding خروجی دستورات سیستم‌عاملی استفاده می‌شود.1V1.2.66برنامه در برابر آسیب‌پذیری‌های تزریق LDAP محافظت شده است، یا اینکه کنترل‌های امنیتی مشخصی برای جلوگیری از تزریق LDAP پیاده‌سازی شده‌اند.2V1.2.77برنامه در برابر حملات تزریقXPath، به‌وسیله‌ی استفاده از کوئری‌های پارامتری‌شده یا کوئری‌های از پیش‌کامپایل‌شده محافظت شده باشد.2V1.2.88پردازشگرهای LaTeX به‌صورت امن پیکربندی شده‌اند (برای نمونه با عدم استفاده از گزینه‌ی --shell-escape ) و از فهرست مجاز دستورات (allowlist) برای جلوگیری از حملات تزریق LaTeX استفاده شده است.2V1.2.99برنامه کاراکترهای ویژه در عبارات Regex را escape می‌کند (معمولاً با استفاده از \)، تا این کاراکترها به‌اشتباه به‌عنوان متاکاراکتر تفسیر نشوند.2V1.2.1010برنامه در برابر حملات تزریق CSV و فرمول (Formula Injection) محافظت شده است. برنامه باید هنگام خروجی‌ گرفتن فایل‌های CSV، از قوانین escape تعیین‌شده در بخش‌های ۲.۶ و ۲.۷ استاندارد RFC 4180 پیروی کند. همچنین، هنگام خروجی گرفتن به فرمت CSV یا سایر فرمت‌های صفحه‌گسترده (مانند XLS، XLSX یا ODF)، اگر کاراکترهای ویژه‌ای مانند '='، '+'، '-'، '@'، \t (tab) و 0\ (Null character) در ابتدای مقدار یک فیلد قرار داشته باشند، باید با یک تک‌کوتیشن (') escape شوند.3V1.33پاک‌سازی (Sanitization)V1.3.11تمام ورودی‌های HTML غیرقابل اعتماد (مثلاً از طریق ویرایشگرهای WYSIWYG یا ابزارهای مشابه)، با استفاده از یک کتابخانه یا قابلیت امن و معتبر sanitization (پاک‌سازی) ‌شوند.1V1.3.22برنامه استفاده از تابعeval یا سایر قابلیت‌های اجرای پویا (dynamic) کد، مانند Spring Expression Language (SpEL)، اجتناب ‌کند. در مواردی که استفاده از این قابلیت‌ها اجتناب‌ناپذیر است، ورودی‌های کاربر که در اجرای کد گنجانده می‌شوند باید پیش از اجرا، به‌طور کامل پاک‌سازی (sanitized) شوند.1V1.3.33بخش‌های حائز اهمیت که احتمال وقوع حملات ناشی از ورودی‌های کاربر در آنها بالاست؛ باید پیشاپیش عملیاتSanitization جهت اقدامات ایمنی روی داده‌ها انجام شود؛ برای مثال، تنها کاراکترهایی که برای آن محتوا ایمن محسوب می‌شوند مجاز باشند، و ورودی‌های بیش‌از‌حد بلند نیز کوتاه (trim) شوند.2V1.3.44محتوای اسکریپت‌پذیر (scriptable) فایل‌های SVG که توسط کاربر ارائه می‌شود، مورد اعتبارسنجی یا پاک‌سازی (sanitization) قرار گرفته باشد تا فقط شامل تگ‌ها و ویژگی‌هایی (attributes) باشد که برای برنامه ایمن هستند؛ برای مثال، از درج اسکریپت‌ها و عناصر خطرناک مانند foreignObject جلوگیری شده باشد.2V1.3.55برنامه محتوای زبان‌های قالب‌نویسی یا اسکریپت‌پذیر ارائه‌شده توسط کاربر، مانند Markdown، CSS یا استایل‌شیت‌های XSL، BBCode یا موارد مشابه را پاک‌سازی (sanitize) کرده یا غیرفعال کرده باشد.2V1.3.66برنامه در برابر حملات جعل درخواست سمت سرور (SSRF) محافظت شده باشد؛ به این صورت که داده‌های غیرقابل اعتماد را در برابر یک لیست مجاز از پروتکل‌ها، دامنه‌ها، مسیرها و پورت‌ها اعتبارسنجی کرده و کاراکترهای بالقوه خطرناک را پیش از استفاده از داده برای فراخوانی سرویس دیگر پاک‌سازی (sanitize) می‌کند.2V1.3.77برنامه در برابر حملات تزریق قالب (Template Injection) محافظت شده باشد؛ به این صورت که ساخت قالب‌ها بر پایه داده‌های غیرقابل اعتماد مجاز نباشد. در صورتی که هیچ راه‌حل جایگزینی وجود نداشته باشد، هرگونه ورودی غیرقابل اعتماد که به‌صورت پویا در فرآیند ایجاد قالب وارد می‌شود، باید پیش از استفاده یا پاک‌سازی (sanitize) شود یا به‌صورت سخت‌گیرانه اعتبارسنجی (validate) گردد.2V1.3.88برنامه، ورودی غیرقابل اعتماد را پیش از استفاده در کوئری‌های Java Naming and Directory Interface (JNDI) به‌درستی پاک‌سازی (sanitize) می‌کند و همچنین اطمینان حاصل شود که پیکربندی JNDI به‌گونه‌ای امن انجام شده تا از بروز حملات تزریق JNDI جلوگیری شود.2V1.3.99برنامه، محتوا را پیش از ارسال به memcache پاک‌سازی (sanitize) می‌کند تا از حملات تزریق (injection attacks) جلوگیری شود.2V1.3.1010رشته‌های قالب‌بندی (format strings) که ممکن است هنگام استفاده، به‌شکلی ناخواسته یا مخرب تفسیر شوند، پیش از پردازش پاک‌سازی (sanitize) شوند.2V1.3.1111برنامه ورودی‌های کاربر را پیش از ارسال به سامانه‌های ایمیل (مانند SMTP یا IMAP) پاک‌سازی (sanitize) ‌کند تا از حملات تزریق در SMTP یا IMAP جلوگیری شود.2V1.3.1212عبارات منظم (Regular Expressions) عاری از اجزایی هستند که باعث بازگشت‌پذیری نمایی (exponential backtracking) می‌شوند، و همچنین ورودی‌های غیرقابل اعتماد به‌درستی پاک‌سازی (sanitize) شوند تا از حملات ReDoS (انکار سرویس با استفاده از عبارات منظم) یا Runaway Regex جلوگیری گردد.3V1.44حافظه، رشته و کد بدون مدیریت (Memory, String, and Unmanaged Code)V1.4.11برنامه از رشته‌های ایمن از نظر مدیریت حافظه، کپی حافظه‌ای ایمن‌تر و حساب‌گری ایمن‌تر روی اشاره‌گرها استفاده می‌کند تا از سرریز پشته (stack overflow)، سرریز بافر (buffer overflow) یا سرریز حافظه پویای (heap overflow) جلوگیری کرده یا آن‌ها را شناسایی کند.2V1.4.22از تکنیک‌های اعتبارسنجی علامت (sign validation)، محدوده (range validation) و ورودی (input validation) استفاده شده است تا از بروز سرریز عدد صحیح (integer overflow) جلوگیری شود.2V1.4.33حافظه و منابعی که به‌صورت پویا تخصیص داده شده‌اند، به‌درستی آزاد (release) می‌شوند و همچنین ارجاع‌ها یا اشاره‌گرها (pointers) به حافظه آزادشده حذف یا به null تنظیم می‌شوند تا از اشاره‌گرهای معلق (dangling pointers) و آسیب‌پذیری‌های استفاده پس از آزادسازی (use-after-free) جلوگیری شود.2V1.55سریال‌زدایی ایمن (Safe Deserialization)V1.5.11برنامه، XML Parserها را به‌گونه‌ای پیکربندی کرده باشد که از تنظیمات محدودکننده استفاده کنند، و ویژگی‌های ناایمنی مانند resolve کردن موجودیت‌های خارجی (external entities) غیرفعال شده باشند تا از حملات XML External Entity (XXE) جلوگیری شود.1V1.5.22فرآیند deserialization داده‌های غیرقابل‌اعتماد، با اجرای مدیریت ایمن ورودی‌ها همراه باشد؛ برای مثال، استفاده از لیست مجاز (allowlist) انواع objectها یا محدود کردن انواع تعریف‌شده توسط کلاینت برای جلوگیری از حملات مرتبط با deserialization. همچنین، مکانیزم‌های deserialization که به‌طور صریح به‌عنوان ناایمن شناخته شده‌اند، نباید با داده‌های غیرقابل‌اعتماد مورد استفاده قرار گیرند.2V1.5.33Parser های مختلفی که در برنامه برای یک نوع داده مشخص استفاده می‌شوند (برای مثال: Parser های JSON، XML یا URL)، رفتار تحلیلی یکسانی دارند و از مکانیزم یکسانی برای encoding کاراکترها استفاده می‌کنند، تا از بروز مشکلاتی مانند آسیب‌پذیری در سازگاری JSON (JSON Interoperability) یا تفاوت در نحوه تحلیل URI یا مسیر فایل که ممکن است در حملات RFI یا SSRF سوءاستفاده شود، جلوگیری شود.3V22ValidationValidation and Business LogicV2.11مستندات اعتبارسنجی و منطق کسب‌وکار ( Validation and Business Logic Documentation)V2.1.11قوانین اعتبارسنجی ورودی‌های برنامه (مندرج در مستندات برنامه) ‌باید چگونگی بررسی صحت داده‌ها را مطابق با ساختار مورد انتظار مشخص نماید. این ساختار می‌تواند شامل فرمت‌های رایج داده مانند شماره کارت اعتباری، آدرس ایمیل، شماره تلفن یا یک قالب داده‌ای داخلی باشد.1V2.1.22قوانین اعتبارسنجی ورودی‌های برنامه (مندرج در مستندات برنامه) باید چگونگی بررسی سازگاری مناسب بین داده‌‌های ترکیب شده (از نظر مفهومی و متنی) را مشخص نماید؛ مانند تطبیق کدپستی با نام محله.2V2.1.33انتظارات مربوط به محدودیت‌ها و اعتبارسنجی‌های منطق کسب و کار مستند شده باشند؛ این مستندات باید شامل محدودیت‌ها در سطح هر کاربر و محدودیت‌های عمومی در سطح برنامه باشند.2V2.22اعتبارسنجی ورودی (Input Validation)V2.2.11ورودی‌ها باید به‌منظور اعمال انتظارات کسب و کار یا عملکردی مرتبط با آن‌ها اعتبارسنجی ‌شوند.این اعتبارسنجی باید یکی از این دو روش زیر را داشته باشد، استفاده از اعتبارسنجی مثبت (Positive Validation) مبتنی بر فهرست مجاز از مقادیر، الگوها یا بازه‌های قابل قبول و تطبیق با ساختار مورد انتظار و محدودیت‌های منطقی، بر اساس قوانین از پیش تعریف‌شده. برای سطح 1 (L1)، تمرکز می‌تواند بر ورودی‌هایی باشد که در تصمیم‌گیری‌های خاص تجاری یا امنیتی استفاده می‌شوند. برای سطح 2 و بالاتر، این اعتبارسنجی باید شامل تمام ورودی‌ها باشد.1V2.2.22برنامه به‌گونه‌ای طراحی شود که اعتبارسنجی ورودی را در لایه‌ قابل اعتمادی از سرویس (Trusted Service Layer) اعمال کند. هرچند اعتبارسنجی سمت کلاینت (Client-side Validation) باعث بهبود تجربه کاربری می‌شود و توصیه می‌گردد، اما نباید به‌عنوان یک کنترل امنیتی اتکا شود.1V2.2.33برنامه باید اطمینان حاصل نماید که ترکیب داده‌های مربوطه با توجه به قوانین از پیش تعریف‌شده معقول و منطقی باشد.2V2.33امنیت منطق کسب‌وکار (Business Logic Security)V2.3.11اطمینان حاصل شود که برنامه فقط جریان‌های منطق تجاری را برای همان کاربر و طبق ترتیب گام‌به‌گام از پیش تعیین شده و مورد انتظار پردازش می‌کند و امکان رد کردن مراحل (Skipping Steps) وجود ندارد.1V2.3.22اطمینان حاصل شود که محدودیت‌های منطق تجاری مطابق با مستندات برنامه پیاده‌سازی شده‌اند، تا از سوء‌استفاده از نقص‌های منطقی جلوگیری شود.2V2.3.33تراکنش‌های سطح منطق کسب‌وکار (business logic) باید به‌گونه‌ای استفاده شوند که یا یک عملیات منطق کسب‌وکار به‌طور کامل با موفقیت انجام شود، یا در صورت بروز خطا، به حالت صحیح قبلی بازگردد(rollback) شود.2V2.3.44در منطق کسب‌وکار (business logic)باید از مکانیزم‌های قفل‌گذاری (locking) استفاده شده باشد تا اطمینان حاصل شود که منابع محدود (مانند صندلی‌های سینما یا بازه‌های زمانی تحویل)، قابل رزرو دوباره (double-booked) از طریق دستکاری منطق برنامه نباشند.2V2.3.55اطمینان حاصل شود که جریان‌های منطق کسب و کاری با ارزش بالا نیازمند تایید چند کاربره (Multi-user Approval) هستند تا از اقدامات غیرمجاز یا تصادفی جلوگیری شود. این موارد می‌تواند شامل – اما نه محدود به – انتقال‌های مالی بزرگ، تایید قرارداد‌ها، دسترسی به اطلاعات طبقه‌بنده شده، یا غیرفعال‌سازی‌های ایمنی در محیط‌های تولید صنعتی باشد.3V2.44مقابله با خودکارسازی (Anti-automation)V2.4.11کنترل‌های ضد خودکارسازی (Anti-Automation) در سیستم پیاده‌سازی شده باشند تا از سوءاستفاده‌هایی مانند فراخوانی بیش از حد توابع برنامه جلوگیری شود؛ چرا که این نوع حملات می‌توانند منجر به استخراج غیرمجاز داده‌ها، تولید داده‌های زائد، مصرف کامل سهمیه‌ها، عبور از محدودیت‌های نرخ (Rate Limit)، ایجاد اختلال در سرویس (DoS) یا استفاده بیش از حد از منابع گران‌قیمت شوند.2V2.4.22بررسی کنید که جریان‌های منطق کسب‌وکار (Business Logic Flows) به گونه‌ای طراحی شده باشند که نیازمند زمان‌بندی واقعی انسان باشند، و از ارسال سریع و غیرطبیعی تراکنش‌ها (Transaction Submissions) جلوگیری کنند.3V33Webامنیت رابط کاربری وب (Web Frontend Security)V3.11مستندسازی امنیت رابط کاربری وب ( Web Frontend Security Documentation)V3.1.11در مستندات برنامه باید ویژگی‌های امنیتی مربوط به مرورگری که برنامه را اجرا میکند مشخص شده باشد (نظیر استفاده از HTTPS، پشتیبانی از HTTP Strict Transport Security (HSTS)، اجرای Content Security Policy (CSP) و سایر مکانیزم‌های امنیتی مرتبط با HTTP). همچنین در مستندات باید مشخص شود مرورگر در صورت عدم دسترسی به این ویژگی‌ها چه رفتاری باید داشته باشد. (برای مثال: نمایش هشدار به کاربر یا ممانعت از دسترسی به برنامه).3V3.22تفسیر ناخواسته محتوا (Unintended Content Interpretation)V3.2.11کنترل‌های امنیتی متناسب با مرورگر‌ها در هنگام پردازش پاسخ‌های HTTP به منظور جلوگیری از پردازش محتوا یا عملکرد مربوط به آن در شرایط زمینه‌‌ای نادرست باید بکار‌گرفته شود. (برای مثال، زمانی که یک APIیا یک فایل بارگذاری‌شده توسط کاربر یا هر منبع دیگری به‌طور مستقیم درخواست می‌شود).کنترل‌های ممکن می‌توانند شامل این موارد باشند: عدم پردازش محتوا مگر در صورت وجود هدرهای متناسب با درخواست‌های HTTP (مانند ‎Sec-Fetch-*) به منظور اطمیان از صحیح بودن پردازش محتوا یا عملکرد مربوط به . استفاده از عبارت sandbox در هدر Content-Security-Policy یا استفاده از نوعattachment در هدر Content-Disposition .1V3.2.22اطمینان حاصل شود که محتوایی که برای نمایش به‌صورت متن طراحی شده نه برای پردازش به صورتHTML ، با استفاده از توابع امن نظیر CreateTextNode یا textContent به منظور جلوگیری از اجرای ناخواسته محتوایی مانند HTML یا JavaScript پردازش ‌شود.1V3.2.33برنامه هنگام استفاده از جاوااسکریپت سمت کاربر (Client-Side JavaScript)، با استفاده از اعلام متغیرها به‌صورت صریح، انجام بررسی نوع به‌صورت سخت‌گیرانه، اجتناب از ذخیره‌سازی متغیرهای سراسری بر روی شیء document، و پیاده‌سازی ایزولاسیون فضای نام (namespace isolation)، از وقوع DOM Clobbering جلوگیری می‌کند.3V3.33پیکربندی کوکی (Cookie Setup)V3.3.11اطمینان حاصل شود که کوکی‌ها دارای ویژگی ‘Secure’ هستند. در صورتی که از پیشوند ‘__Host-’ برای نام کوکی استفاده نمی‌شود، باید پیشوند__Secure- در نام کوکی لحاظ شده باشد.1V3.3.22اطمینان حاصل شود که مقدار ویژگی SameSite برای هر کوکی، متناسب با هدف آن کوکی تنظیم شده باشد تا میزان آسیب‌پذیری در برابر حملات فریب سمت کلاینت نظیر CSRF کاهش یابد.2V3.3.33اطمینان حاصل شود که کوکی‌ها از پیشوند __Host- در نام خود استفاده می‌کنند، مگر در مواردی که کوکی به‌طور مشخص برای اشتراک‌گذاری بین چند دامنه (Hosts) طراحی شده باشد.2V3.3.44اطمینان حاصل شود که اگر مقدار کوکی (مثلاً توکن نشست) نباید برای اسکریپت‌های سمت کلاینت در دسترس باشد، ویژگی HttpOnly باید برای آن کوکی فعال شده باشد، و همچنین مقدار کوکی (مثلاً همان توکن نشست) تنها از طریق هدر Set-Cookie به کلاینت ارسال شود.2V3.3.55اطمینان حاصل شود که حداکثر مجموع نام و مقدار کوکی از ۴۰۹۶ بایت تجاوز نکند.کوکی‌هایی که بیش از این مقدار باشند توسط مرورگر ذخیره نخواهند شد، و بنابراین در درخواست‌ها ارسال نمی‌شوند؛ موضوعی که ممکن است باعث شود عملکردهایی از برنامه که به آن کوکی وابسته‌اند، غیرفعال یا مختل شوند.3V3.44هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers)V3.4.11اطمینان حاصل شود که در تمامی پاسخ‌های HTTP، هدر Strict-Transport-Security وجود دارد تا سیاست HSTS (HTTP Strict Transport Security) اعمال شود. حداقل مقدار max-age باید برابر با یک سال باشد. برای برنامه‌های سطح 2 (L2) و بالاتر، این سیاست باید برای تمام زیردامنه‌ها (subdomains) نیز اعمال شود.1V3.4.22اطمینان حاصل شود که هدرAccess-Control-Allow-Origin مربوط به (CORS)، دارای یک مقدار ثابت و مشخص توسط برنامه باشد یا اگر هدر Origin در درخواست مورد استفاده قرار می گیرد باید با فهرستی از مبدأهای مورد اعتماد (Allowlist) اعتبارسنجی شود. در صورتی که استفاده از مقدار * در Access-Control-Allow-Origin تنظیم شده باشد، اطمینان حاصل شود که هیچ اطلاعات حساسی در پاسخ قرار ندارد.1V3.4.33اطمینان حاصل شود که تمامی پاسخ‌های HTTP شامل هدر Content-Security-Policy باشند تا ریسک اجرای اسکریپت‌های مخرب (مانند (JavaScript مخرب کاهش یابد. دستورهای object-src 'none' و base-uri 'none' الزامی هستند .برای برنامه‌های سطح 3 (L3)، باید سیاست CSP به‌صورت اختصاصی برای هر پاسخ(Per-response Policy) و مبتنی بر nonce یا hash تعریف شده باشد.2V3.4.44اطمینان حاصل شود که تمامی پاسخ‌ها شامل هدر X-Content-Type-Options: nosniff باشند، این (هدر) به مرورگرها دستور می‌دهد که برای پاسخ دریافتی از Content Sniffing یا حدس‌زدن نوع محتوا (MIME Type Guessing) استفاده نکنند و آن‌ها را ملزم می‌کند که نوع محتوای واقعی را دقیقاً مطابق مقدار هدر Content-Type در درخواست/پاسخ در نظر بگیرند.برای مثال، پاسخ به یک درخواست برای یک فایل استایل (CSS) تنها در صورتی پذیرفته می‌شود که مقدار Content-Type در پاسخ 'text/css' باشد.این کار همچنین امکان استفاده از قابلیت مسدودسازی خواندن منابع از مبدا متفاوت Cross-Origin Read Blocking یا (CORB) توسط مرورگر را فراهم می‌سازد.2V3.4.55برنامه باید (وب‌سایت یا اپلیکیشن) یک "Referrer Policy" (سیاست ارجاع) تنظیم کرده باشد تا از نشت اطلاعات حساس از طریق هدر HTTP به نام Referer به سرویس‌های شخص ثالث جلوگیری شود. این کار را می‌توان از طریق هدر پاسخ HTTP به نام Referrer-Policy یا با استفاده از ویژگی‌هایی در عناصر HTML انجام داد.اطلاعات حساس ممکن است شامل مسیر (Path) و داده‌های کوئری (Query) در آدرس URL باشد، و در مورد برنامه‌های داخلی و غیرعمومی، حتی نام میزبان (hostname) نیز می‌تواند جزو اطلاعات حساس محسوب شود.2V3.4.66برنامه باید از frame-ancestors در هدر Content-Security-Policy (CSP) برای تمام پاسخ‌های HTTP استفاده کند،تا به‌صورت پیش‌فرض، اجازه‌ی نمایش سایت در قالب iframe داده نشود، و فقط در صورت نیاز، نمایش منابع خاص (specific resources) در iframe مجاز باشد.به این نکته توجه کنید که هدر X-Frame-Options با اینکه هنوز توسط برخی مرورگرها پشتیبانی می‌شود، اما قدیمی (obsolete) است و نباید به آن تکیه کرد.2V3.4.77هدر Content-Security-Policy (CSP) باید شامل یک آدرس برای گزارش (Report violation) باشد.3V3.4.88تمام پاسخ‌های HTTP که باعث رندر (نمایش) یک سند می‌شوند مانند (پاسخ‌هایی با نوع محتوا (text/html باید شامل هدر Cross-Origin-Opener-Policy با دستور same-origin یا same-origin-allow-popups باشند (بنا به نیاز). این کار از حملاتی جلوگیری می‌کند که از دسترسی مشترک به اشیای Window سوءاستفاده می‌کنند، مانند حملات tabnabbing و frame counting.3V3.55تفکیک مبدا توسط مرورگر (Browser Origin Separation)V3.5.11برنامه باید از مکانیزم Preflight در CORS برای جلوگیری از درخواست‌های cross-origin به عملکردهای حساس استفاده نمی‌کند، این درخواست‌ها به‌گونه‌ای اعتبارسنجی شوند که فقط از مبدأ اصلی برنامه ارسال شده باشند. این اعتبارسنجی می‌تواند با استفاده از توکن‌های (anti- forgery tokens) یا الزام به ارسال هدرهای HTTP اضافی انجام شود که در لیست هدرهای مجاز CORS (CORS-safelisted) قرار ندارند. این اقدام برای محافظت در برابر حملات جعل درخواست از طریق مرورگر، که با نام CSRF (Cross-Site Request Forgery) شناخته می‌شوند، ضروری است.1V3.5.22اگر برنامه برای جلوگیری از استفاده غیرمجاز cross-origin از عملکردهای حساس، به مکانیزم Preflight در CORS متکی است، باید امکان فراخوانی این عملکردها با درخواست‌هایی که باعث ایجاد Preflight نمی‌شوند، وجود نداشته باشد. برای تحقق این هدف ممکن است لازم باشد مقدار هدرهای Origin و Content-Type بررسی شوند یا از هدر اضافی استفاده شود که در لیست هدرهای مجاز CORS قرار ندارد.1V3.5.33برنامه باید درخواست‌های HTTP که به عملکردهای حساس از متدهای مناسب مانند POST، PUT، PATCH یا DELETE استفاده می‌کنند، و نه از متدهایی که در استاندارد HTTP به‌عنوان "ایمن" تعریف شده‌اند، مانند GET، HEAD یا .OPTIONS به عنوان جایگزین یا مکمل، می‌توان از بررسی سخت‌گیرانه هدرهای Sec-Fetch-* استفاده کرد تا اطمینان حاصل شود که درخواست از منبع نامناسبی مثل بارگذاری تصویر، ناوبری صفحه یا فراخوانی cross-origin ارسال نشده است.1V3.5.44برنامه‌های مجزا باید روی نام‌های دامنه (hostname) متفاوت میزبانی شده‌اند تا از محدودیت‌های ارائه‌شده توسط (Same-Origin Policy) بهره‌مند شوند. این شامل کنترل تعامل اسناد یا اسکریپت‌های بارگذاری‌شده از یک مبدأ با منابع مبدأ دیگر و اعمال محدودیت بر اساس دامنه برای کوکی‌ها می‌شود.2V3.5.55برنامه باید پیام‌های دریافت‌شده از طریق رابط postMessage در صورتی که مبدأ پیام مورد اعتماد نباشد یا ساختار پیام نامعتبر باشد، نادیده گرفته می‌شوند.2V3.5.66هیچ‌کجای برنامه از قابلیت JSONP استفاده نشود تا از حملات Cross-Site Script Inclusion (XSSI) جلوگیری شود.3V3.5.77داده‌هایی که نیاز به احراز هویت دارند، در پاسخ‌های مربوط به منابع اسکریپتی(مانند فایل‌های (JavaScript نباید قرار بگیرند تا از حملات XSSI جلوگیری شود.3V3.5.88اطمینان حاصل کنید که منابع احراز هویت‌شده (مانند تصاویر، ویدیوها، اسکریپت‌ها و سایر اسناد) فقط در مواقعی که هدف آن است، قابل بارگذاری یا جاسازی توسط کاربر باشند. این کار را می‌توان با اعتبارسنجی دقیق هدرهای HTTP مانند Sec-Fetch-* انجام داد تا اطمینان حاصل شود که درخواست از یک منبع غیرمجاز ارسال نشده است، یا با تنظیم هدر Cross-Origin-Resource-Policy برای محدود کردن دسترسی مرورگر به محتوا.3V3.66یکپارچگی منابع خارجی (External Resource Integrity)V3.6.11منابع سمت کلاینت مانند کتابخانه‌های جاوااسکریپت، فایل‌های CSS، یا فونت‌های وب، تنها در صورتی به‌صورت خارجی (مثلاً از طریق شبکه تحویل محتوا - CDN) میزبانی شوند که آن منابع: استاتیک (تغییرناپذیر) باشند، نسخه‌گذاری‌شده (versioned) باشند و یکپارچگی آن‌ها با استفاده از Subresource Integrity (SRI) بررسی شود. اگر این موارد امکان‌پذیر نیست، باید برای هر منبع، یک تصمیم امنیتی مستند وجود داشته باشد که توجیه کند چرا این منبع به این شکل بارگذاری می‌شود.3V3.77سایر ملاحظات امنیتی مرورگر (Other Browser Security Considerations)V3.7.11برنامه صرفا باید از فناوری‌های سمت کلاینتی استفاده ‌کند که همچنان پشتیبانی می‌شوند و از نظر امنیتی قابل اعتماد هستند.مثال‌هایی از فناوری‌هایی که این الزام را برآورده نمی‌کنند عبارتند از NSAPI Plugins،Flash،Shockwave،ActiveX،Silverlight،NACL و Appletهای جاوا در سمت کلاینت2V3.7.22برنامه فقط زمانی کاربر را به دامنه‌ها یا hostnameهای دیگر (که تحت کنترل برنامه نیستند) به صورت خودکار هدایت می‌کند، که آن مقصد در یک فهرست مجاز (allowlist) قرار داشته باشد.2V3.7.33برنامه باید هنگام ریدایرکت کاربر به یک URL که خارج از کنترل برنامه است، یک پیام هشدار نشان می‌دهد و امکان لغو آن را به کاربر می‌دهد.3V3.7.44باید دامنه اصلی برنامه، مثلاً (site.tld) به فهرست preload عمومی HSTS اضافه شده باشد.3V3.7.55اگر مرورگر کاربر از ویژگی‌های امنیتی مورد انتظار برنامه پشتیبانی نمی‌کند، برنامه رفتار مناسبی داشته باشد، مثل هشدار دادن به کاربر یا مسدود کردن دسترسی.3V44APIAPI and Web ServiceV4.11Generic Web Service SecurityV4.1.11اطمینان حاصل شود که در هر پاسخ HTTP که شامل Body می باشد، هدر Content-Type وجود داشته باشد که نوع آن، با محتوای پاسخ دریافتی از سرور مطابقت داشته باشد. این هدر باید شامل پارامتر charset نیز باشد تا رمزگذاری کاراکتر ایمن (مانند UTF-8 یا ISO-8859-1) را مشخص کند. این مقادیر باید مطابق با استاندارد IANA Media Types باشند؛ برای مثال، انواعی مانند "text/، /+xml" و "/xml" را در بر می‌گیرند.1V4.1.22اطمینان حاصل شود که تنها نقاط پایانی که برای استفاده کاربر نهایی از طریق مرورگر طراحی شده‌اند (User-Facing Endpoints) به‌صورت خودکار از HTTP به HTTPS هدایت ‌شوند، سایر سرویس‌ها یا نقاط پایانی نباید (ریدایرکت شفاف، Transparent Redirect) داشته باشند. این اقدام برای جلوگیری از وضعیتی است که در آن یک کلاینت به اشتباه درخواست‌های رمزنگاری‌نشده (HTTP) ارسال می‌کند، اما چون این درخواست‌ها به‌طور خودکار به HTTPS ریدایرکت می‌شوند، نشت احتمالی داده‌های حساس پنهان خواهد ماند.2V4.1.33اطمینان حاصل شود که هدرهای HTTP که در برنامه استفاده می شود و توسط یک لایه واسطه، مانند یکload balancer ، یک پروکسی وب یا یک سرویس backend-for-frontend تنظیم شده است نمی‌تواند توسط کاربر نهایی بازنویسی شود. هدرهای نمونه ممکن است شامل X-Real-IP، X-Forwarded-* یا X-User-ID باشند.2V4.1.44اطمینان حاصل شود که فقط متدهای HTTP که صریحاً توسط برنامه یا API آن پشتیبانی می‌شوند (از جمله OPTIONS در درخواست‌های preflight) می‌توانند مورد استفاده قرار گیرند و متدهای استفاده نشده مسدود شوند.3V4.1.55اطمینان حاصل شود که برای درخواست‌ها یا تراکنش‌هایی که بسیار حساس هستند یا از چندین سامانه عبور می‌کنند، از امضاهای دیجیتال در سطح پیام استفاده شود تا اطمینان امنیتی بیشتری علاوه بر محافظت‌های سطح انتقال (مانند TLS) فراهم گردد.3V4.22HTTP Message Structure ValidationV4.2.11اطمینان حاصل شود که تمامی اجزای برنامه )از جمله لود بالانسرها، فایروال‌ها و سرورهای اپلیکیشن( مرزهای پیام‌های HTTP ورودی را با استفاده از مکانیزم مناسب نسخه های HTTP تعیین می‌کنند تا از حملات HTTP request smuggling جلوگیری شود. در HTTP/1.x اگر هدر Transfer-Encoding وجود داشته باشد، هدر Content-Length باید مطابق RFC 2616 نادیده گرفته شود. در مقابل، هنگام استفاده از HTTP/2 یا HTTP/3، اگر هدر Content-Length وجود داشته باشد، گیرنده باید اطمینان حاصل کند که این مقادیر با طول فریم‌های DATA سازگار می‌باشد.2V4.2.22اطمینان حاصل شود که هنگام تولید پیام‌های HTTP، هدر Content-Length با طول محتوایی که توسط چارچوب‌بندی پروتکل HTTP تعیین می‌شود، تداخل نداشته باشد تا از حملات request smuggling جلوگیری شود.3V4.2.33اطمینان حاصل شود برنامه، پیام‌های HTTP/2 یا HTTP/3 با هدرهای connection-specific مانند Transfer-Encoding را به منظور جلوگیری از حملات response splitting یا header injection ارسال یا قبول نمی کند.3V4.2.44اطمینان حاصل شود برنامه تنها درخواست های HTTP/2 and HTTP/3 که هدرها و مقادیر آن شامل هیچ توالی CR (\r), LF (\n), CRLF (\r\n) نباشد را می پذیرد تا از حملات header injection جلوگیری کند.3V4.2.55اطمینان حاصل کنید که اگر برنامه (Frontend or Backend) اقدام به ساخت و ارسال درخواست‌های HTTP می کند از مکانیزم های validation ، sanitization یا سایر مکانیزم‌ها استفاده کند تا از ایجاد URIها (مانند فراخوانیAPI ) یا فیلدهای هدر درخواست HTTP (مانند Authorization یا( Cookie که بیش از حد مجاز، طولانی هستند، جلوگیری شود که منجر به عدم پذیرش درخواست توسط مولفه دریافت کننده(هر بخشی از زیرساخت یا سامانه که درخواست HTTP را دریافت و پردازش می‌کند) شود. عدم رعایت این موضوع می تواند باعث وقوع حمله Danial of Service شود، ارسال یک درخواست بیش از حد طولانی (مانند یک فیلد هدر کوکی طولانی) باعث می شود سرور همواره با وضعیت خطا پاسخ دهد.3V4.33GraphQLV4.3.11اطمینان حاصل شود یکی از مکانیزم ها برای جلوگیری از حملات انکار سرویس (DoS) درلایه GraphQL یا لایه داده استفاده شده است. این مکانیزم‌ها عبارتند از استفاده از فهرست مجاز کوئری‌ها ( Query Allowlist)، محدودسازی عمق کوئری‌ها (Depth Limiting)،محدودسازی تعداد یا حجم داده(Amount Limiting) و تحلیل هزینه کوئری (Query Cost Analysis). این اقدامات، به منظور مقابله با درخواست های پیچیده، تو در تو یا کوئری‌های پرهزینه که می توانند موجب مصرف بیش از حد منابع و اختلال در سرویس دهی شوند ضروری است.2V4.3.22اطمینان حاصل شود که قابلیت Introspection در GraphQL در محیط تولید (Production) غیرفعال شده‌است، مگرAPI مبتنی بر GraphQL به‌صورت صریح برای استفاده توسط اشخاص یا سامانه های ثالث (Third Parties) طراحی شده باشد.2V4.44WebSocketV4.4.11اطمینان حاصل شود که تمامی ارتباطات WebSocket از طریق پروتکل TLS( WSS) برقرار می‌شوند.1V4.4.22اطمینان حاصل شود که در هنگام Handshake اولیه‌ی HTTP برای WebSocket، مقدار هدر Origin بررسی ‌شود و در صورتی که با لیستی از مبداهای مجاز (allowed origins) برای برنامه مطابقت داشته باشد، اتصال پذیرفته می‌شود.2V4.4.33اطمینان حاصل شود که در صورتی که امکان استفاده از مکانیزم استاندارد مدیریت نشست برنامه وجود نداشته باشد، از توکن‌های اختصاصی (Duplicated Tokens) برای این منظور استفاده شود که با الزامات امنیتی مدیریت نشست به طور کامل مطابقت داشته باشند.2V4.4.44اطمینان حاصل شود که توکن‌های اختصاصی مدیریت نشست WebSocket در هنگام انتقال از یک نشست HTTPS موجود به کانالWebSocket، از طریق نشست HTTPS احراز هویت‌شده قبلی، دریافت یا اعتبارسنجی می‌شوند.2V55FileFile HandlingV5.11File Handling DocumentationV5.1.11مستندات نوع فایل‌های مجاز، پسوندهای مورد انتظار، و حداکثر اندازه هر فایل (شامل اندازه پس از استخراج) را برای هر قابلیت بارگذاری مشخص کرده باشد. همچنین، مستندات توضیح می‌دهند چگونه فایل‌ها برای دانلود و پردازش توسط کاربران نهایی ایمن‌سازی می‌شوند؛ برای مثال، رفتار برنامه هنگام شناسایی یک فایل مخرب چگونه خواهد بود.2V5.22File Upload and ContentV5.2.11برنامه تنها فایل‌هایی با حجم مشخص، که قادر به پردازش آن است را می‌پذیرد تا از کاهش عملکرد یا حملات انکار سرویس (DoS) جلوگیری شود.1V5.2.22هنگام پذیرش فایل توسط برنامه، چه به صورت مستقیم و چه به صورت یک آرشیو مانند فایلzip پسوند فایل با پسوند مورد انتظار مطابقت داشته باشد و اعتبارسنجی محتوای فایل صورت گیرد تا تایید شود محتوای فایل با نوع تعریف‌شده توسط پسوند هم‌خوانی دارد. این فرآیند می تواند شامل موارد بررسی بایت‌های ابتدایی (magic bytes) فایل، انجام بازنویسی تصاویر برای حذف ساختارها و اطلاعات ناخواسته و استفاده از کتابخانه‌های تخصصی برای اعتبارسنجی کامل محتوای فایل باشد اما محدود به آنها نیست. در سطح L1، کافی است این بررسی‌ها فقط بر روی فایل‌هایی که در فرآیندهای تجاری یا امنیتی خاص استفاده می‌شوند متمرکز باشد. در سطح L2 و بالاتر، این فرآیند باید برای تمامی فایل‌های ورودی برنامه اجرا شود.1V5.2.33برنامه باید پیش از استخراج محتوای فایل‌های فشرده (مانند zip، gz، docx، odt)، آن‌ها را از نظر حداکثر اندازه مجاز پس از استخراج و همچنین حداکثر تعداد فایل‌های درون آن بررسی می‌کند.2V5.2.44برنامه فضای مشخصی برای اندازه فایل و تعداد فایل‌های مجاز برای هر کاربر اعمال می‌کند تا از این طریق، یک کاربر نتواند با بارگذاری تعداد زیادی فایل یا فایل‌های بیش از حد بزرگ، فضای ذخیره‌سازی را پر کند.3V5.2.55برنامه اجازه بارگذاری فایل‌های فشرده‌ که حاوی لینک های نمادین (symlinks) هستند را نمی‌دهد، مگر اینکه این رفتار به طور مشخص مورد نیاز باشد. در چنین شرایطی باید یک فهرست مجاز (allowlist) از مسیرها یا فایل‌هایی که می تواند برای آنها لینک نمادین ایجاد شود، اعمال و اعتبارسنجی گردد.3V5.2.66برنامه تصاویر بارگذاری‌شده با اندازه پیکسلی بزرگ‌تر از حد مجاز را رد کند تا از حملات pixel flood attacks جلوگیری شود.3V5.33File StorageV5.3.11فایل هایی که از ورودی های غیرمعتبر بارگذاری‌ یا تولید می شوند و در پوشه های عمومی قرار می گیرند، هنگام دسترسی مستقیم از طریق یک درخواست HTTP، به عنوان کداجرایی سمت سرور اجرا نشوند.1V5.3.22هنگام ایجاد مسیرهای فایل برای عملیات مختلف، به جای استفاده از نام فایل‌های ارسال شده توسط کاربر، از داده‌های تولید شده داخلی یا منابع مورد اعتماد استفاده شود. و در صورتی که استفاده از نام فایل‌ها یا متادیتای ارسالی توسط کاربر ضروری باشد، می بایست validation و Sanitization اعمال شود. این کار برای جلوگیری از حملاتی مانند Path Traversal، Local or Remote File Inclusion(LFI, RFI) و Server-Side Request Forgery(SSRF) می‌باشد.1V5.3.33پردازش فایل‌های سمت سرور، مانند استخراج فایل‌های فشرده، اطلاعات مسیر ارائه شده توسط کاربر را نادیده می‌گیرد تا از آسیب‌پذیری‌هایی مانند zip slip جلوگیری شود.3V5.44File DownloadV5.4.11برنامه نام فایل ارسال‌شده توسط کاربر را چه در قالب JSON، JSONP یا پارامتر URL، اعتبارسنجی می‌کند یا نادیده می‌گیرد، و در پاسخ HTTP، نام فایل را به‌طور صریح در فیلد Content-Disposition هدر مشخص می‌نماید.2V5.4.22نام‌های فایل‌های ارائه شده (مانند فیلدهای هدر پاسخ HTTP یا پیوست‌های ایمیل)، به‌درستی encoded یا sanitized شده‌اند (مطابق RFC 6266)، تا ساختار سند حفظ شده و از حملات تزریق جلوگیری شود.2V5.4.33فایل‌های دریافت شده از منابع غیرقابل اعتماد توسط آنتی ویروس اسکن شود تا از ارائه محتوای مخرب شناخته‌شده جلوگیری شود.2V66AuthenticationAuthenticationV6.11Authentication DocumentationV6.1.11مستندات برنامه، نحوه استفاده از کنترل هایی مانند محدودیت نرخ (Rate Limit)، مقابله با خودکارسازی (Anti-Automation) و پاسخ تطبیقی (Adaptive Response) را برای دفاع در برابر حملاتی مانند Credential Stuffing و حملات Password Brute Force به وضوح تعریف کرده باشد. مستندات باید به‌وضوح نحوه پیکربندی این کنترل‌ها را تشریح کرده و نشان دهند که چگونه از قفل شدن مخرب حساب‌های کاربری جلوگیری می‌شود.1V6.1.22یک لیست از کلمات خاص مرتبط با زمینه سازمانی‌ (Context-Specific) مستندسازی شود تا از بکارگیری آنها در رمزهای عبور جلوگیری شد. این فهرست می‌تواند شامل نام سازمان، نام محصول، شناسه سامانه، نام کد پروژه، نام دپارتمان یا نقش های سازمانی و موارد مشابه باشد.2V6.1.33در صورت وجود مسیرهای متعدد احراز هویت در برنامه کاربردی، تمامی این مسیرها به همراه کنترل‌های امنیتی و سطح قدرت احراز هویت مورد نیاز، مستندسازی شده‌اند. لازم است این کنترل‌ها به‌صورت یکسان و سازگار در تمامی مسیرهای احراز هویت اجرا شوند.2V6.22Password SecurityV6.2.11کلمات عبور تنظیم شده توسط کاربر حداقل ۸ کاراکتر طول داشته باشد. هرچند حداقل ۱۵ کاراکتر به شدت توصیه می‌شود.1V6.2.22کاربران قادر به تغییر گذرواژه خود باشند.1V6.2.33هنگام تغییر کلمه عبور، گذرواژه فعلی و گذرواژه جدید توسط کاربر تکمیل شود.1V6.2.44کلمات عبوری که در حین ثبت‌نام حساب کاربری یا تغییر کلمه عبور ارسال می شوند با یک فهرست در دسترس از حداقل ۳۰۰۰ کلمه عبور رایج که ( با سیاست‌های کلمه عبور برنامه (مانند حداقل طول) سازگاری دارند) بررسی شوند.1V6.2.55کلمات عبور با هر ترکیبی قابل استفاده باشند، بدون اینکه قوانینی برای محدودکردن نوع کاراکترهای مجاز وجود داشته باشد. نباید هیچ‌گونه الزامی برای تعداد حداقل کاراکترهای حروف بزرگ یا کوچک، اعداد یا کاراکترهای خاص وجود داشته باشد.1V6.2.66فیلدهای ورودی کلمه عبور از نوع "type=password" استفاده می‌کنند تا ورودی‌ها پنهان شوند. برنامه‌ها می‌توانند به کاربر این امکان را بدهند که موقتاً کلمه عبور کامل یا آخرین کاراکتر تایپ شده را مشاهده کند.1V6.2.77عملکرد "چسباندن" (paste)، ابزارهای کمکی گذرواژه مرورگر و مدیریت‌کننده‌های گذرواژه خارجی مجاز باشند.1V6.2.88برنامه کلمه عبور کاربر را دقیقاً همانطور که از کاربر دریافت شده است، بدون هیچ گونه تغییراتی مانند کوتاه‌سازی(truncation) یا تبدیل حروف بزرگ و کوچک (case transformation)، بررسی کند.1V6.2.99استفاده از گذرواژه‌هایی با حداقل طول ۶۴ کاراکتر مجاز باشد.2V6.2.1010کلمه عبور کاربر تا زمانی که مشخص شود که به خطر افتاده است یا کاربر آن را تغییر دهد، معتبر باقی بماند. برنامه نباید الزام به تغییر دوره‌ای گذرواژه‌ها را داشته باشد.2V6.2.1111فهرست مستند شده ای از کلمات خاص مرتبط با زمینه‌ سازمانی برای جلوگیری از ایجاد کلمات عبور آسان قابل حدس، مورد استفاده قرار گیرد.2V6.2.1212کلمات عبور وارد شده در حین ثبت‌نام حساب کاربری یا تغییر کلمه عبور با مجموعه‌ای از کلمات عبور افشا شده بررسی ‌شوند.2V6.33General Authentication SecurityV6.3.11کنترل‌های لازم برای جلوگیری از حملاتی مانند Credential Stuffing و password brute force طبق مستندات امنیتی برنامه پیاده‌سازی شوند.1V6.3.22حساب‌های کاربری پیش‌فرض (مانند "admin"، "root" یا "sa") در برنامه وجود نداشته باشند یا غیرفعال شده باشند.1V6.3.33برای دسترسی به برنامه، از یک مکانیزم احراز هویت چندعاملی (MFA) یا ترکیبی از مکانیزم‌های احراز هویت تک‌عاملی استفاده شود. برای سطح L3، حداقل یکی از عوامل احراز هویت باید مبتنی بر سخت‌افزار باشد در برابر حملات فیشینگ، مقاومت در برابر نفوذ و جعل هویت را فراهم کند، در حالی که با اقدام آگاهانه کاربر (مانند فشردن دکمه روی کلید سخت‌افزاری FIDO یا تلفن همراه) قصد کاربر برای احراز هویت را نیز تأیید نماید. هرگونه تسهیل یا تعدیل در این الزام، مستلزم ارائه دلایل مستند و مجموعه‌ای جامع از کنترل‌های جبرانی است.2V6.3.44تأیید کنید که در صورت وجود مسیرهای متعدد احراز هویت در برنامه، هیچ مسیر احراز هویتِ مستندسازی‌نشده‌ای وجود نداشته باشد و کنترل‌های امنیتی و سطح قدرت احراز هویت در تمامی مسیرها به‌صورت یکسان و سازگار اعمال شوند.2V6.3.55کاربران از تلاش‌های مشکوک برای احراز هویت (موفق یا ناموفق) مطلع ‌شوند. این اطلاع‌رسانی می‌تواند شامل تلاش برای احراز هویت از موقعیت مکانی یا کلاینت غیرمعمول، احراز هویت ناقص (تنها موفقیت یکی از عوامل)، تلاش برای احراز هویت پس از یک دوره طولانی عدم فعالیت، یا احراز هویت موفق پس از چندین تلاش ناموفق باشد.3V6.3.66ایمیل به‌عنوان مکانیزم احراز هویت، چه به‌صورت تک‌عاملی و چه به‌عنوان یکی از عوامل احراز هویت چندعاملی، استفاده نمی‌شود.3V6.3.77کاربران پس از به‌روزرسانی اطلاعات احراز هویت خود، مانند بازنشانی گذرواژه یا تغییر نام کاربری یا آدرس ایمیل، مطلع شوند.3V6.3.88با توجه به پیام‌های خطا، کدهای پاسخ HTTP یا تفاوت در زمان پاسخ‌دهی، نتوان کاربران معتبر را از طریق تلاش‌های ناموفق احراز هویت شناسایی کرد. همچنین، عملکردهای ثبت‌نام و بازیابی گذرواژه نیز باید از این نوع افشای اطلاعات محافظت شده باشند.3V6.44Authentication Factor Lifecycle and RecoveryV6.4.11کلمه عبور اولیه یا کدهای فعال‌سازی تولید شده توسط سیستم، به‌صورت تصادفی و ایمن تولید ‌شوند، با سیاست فعلی رمز عبور مطابقت دارند، و پس از مدت زمان کوتاهی یا پس از اولین استفاده منقضی می‌شوند. این رمزهای اولیه نباید به عنوان رمز عبور بلندمدت مورد استفاده قرار گیرند.1V6.4.22راهنمای کلمه عبور یا احراز هویت مبتنی بر دانش (که به عنوان "سؤالات امنیتی" شناخته می‌شوند) در سیستم وجود ندارد.1V6.4.33فرآیند امنی برای بازنشانی کلمه عبور فراموش‌شده پیاده‌سازی شده است که هیچ‌یک از مکانیزم‌های احراز هویت چندعاملی فعال را دور نزند.2V6.4.44در صورت از دست رفتن یکی از عوامل احراز هویت چندعاملی، فرآیند اثبات هویت با همان سطحی که در زمان ثبت‌نام انجام شده است، اجرا شود.2V6.4.55دستورالعمل‌های تمدید مکانیزم‌های احراز هویت دارای تاریخ انقضا برای کاربران به موقع ارسال می‌شود تا پیش از انقضای مکانیزم فعلی فرصت کافی برای تمدید وجود داشته باشد، و در صورت لزوم، یادآورهای خودکار نیز تنظیم و ارسال شده باشند.3V6.4.66کاربران ادمین می‌توانند فرآیند بازنشانی کلمه عبور را برای کاربران عادی آغاز کنند، اما اجازه تغییر مستقیم یا انتخاب رمز عبور برای کاربر را ندارند. این کنترل برای جلوگیری از دسترسی ادمین به رمز عبور کاربران طراحی شده است.3V6.55General Multi-factor authentication requirementsV6.5.11Lookup Secrets درخواست‌ها یا کدهای احراز هویت خارج از باند (Out-of-Band) و رمزهای یکبار مصرف مبتنی بر زمان (TOTP) تنها یک‌بار قابل استفاده باشند و پس از استفاده موفق، مجدداً قابل استفاده نباشند.2V6.5.22در صورت ذخیره‌سازی Lookup Secrets در سمت Backend برنامه، اگر مقدار آنتروپی کمتر از ۱۱۲ بیت باشند (معادل ۱۹ کاراکتر تصادفی الفبایی-عددی یا ۳۴ رقم تصادفی)، باید با یک الگوریتم تایید شده برای ذخیره رمز عبور و با استفاده از یک Salt تصادفی ۳۲ بیتی هش شوند. در صورتی که آنتروپی کد ۱۱۲ بیت یا بیشتر باشد، می‌توان از یک تابع هش استاندارد برای ذخیره سازی استفاده کرد.2V6.5.33Lookup Secrets کدهای احراز هویت خارج از باند (out of band) و تولید رمزهای یکبار مصرف مبتنی بر زمان(TOTP) همگی با استفاده از یک تولیدکننده عدد شبه تصادفی ‌رمزنگاری‌شده (CSPRNG) تولید شده باشند تا از تولید مقادیر قابل پیش‌بینی جلوگیری شود.2V6.5.44Lookup Secrets و کدهای احراز هویت خارج از باند (out of band) حداقل دارای ۲۰ بیت آنتروپی باشند (معمولاً ۴ کاراکتر تصادفی الفبایی-عددی یا ۶ رقم تصادفی برای رسیدن به این میزان آنتروپی کافی است).2V6.5.55درخواست‌ها، کدها یا توکن‌های احراز هویت خارج از باند (Out-of-Band) و همچنین رمزهای عبور یک‌بار مصرف مبتنی بر زمان (TOTP) دارای طول عمر مشخص باشند. حداکثر طول عمر برای درخواست‌های خارج از باند باید ۱۰ دقیقه و برای TOTP حداکثر ۳۰ ثانیه باشد.2V6.5.66امکان لغو (Revoke) هر عامل احراز هویت، از جمله دستگاه‌های فیزیکی، در صورت سرقت یا مفقود شدن وجود داشته باشد.3V6.5.77مکانیزم‌های احراز هویت بیومتریک فقط به‌عنوان عامل دوم و در کنار یکی از عوامل «چیزی که در اختیار دارید» یا «چیزی که کاربر می داند» مورد استفاده قرار می‌گیرند.3V6.5.88اعتبارسنجی رمزهای یک‌بار مصرف مبتنی بر زمان (TOTP) بر اساس منبع زمانی از یک سرویس قابل اعتماد انجام می‌شود و نه بر اساس زمان ارائه‌شده توسط کلاینت یا منابع غیرقابل اعتماد.3V6.66Out-of-Band authentication mechanismsV6.6.11مکانیزم‌های احراز هویت مبتنی بر شبکه تلفن عمومی (PSTN) برای ارسال رمزهای یک‌بار مصرف (OTP) از طریق تماس تلفنی یا پیامک تنها در صورتی که شماره تلفن قبلا اعتبارسنجی شده باشد، یا روش‌های جایگزین قوی‌تر (رمزهای عبور یکبار مصرف مبتنی بر زمان) در دسترس باشند ارائه می‌شوند و سرویس‌دهنده باید کاربران را از ریسک‌های امنیتی این روش‌ها مطلع سازد. برای اپلیکیشن‌های سطح L3، استفاده از تماس تلفنی و پیامک به‌عنوان گزینه، مجاز نیست.2V6.6.22درخواست‌ها، کدها یا توکن‌های احراز هویت خارج از باند (Out-of-Band) به درخواست احراز هویت اصلی که برای آن تولید شده‌اند متصل باشند و قابل استفاده برای درخواست‌های قبلی یا بعدی نباشند.2V6.6.33مکانیزم‌های احراز هویت خارج از باند (Out-of-Band) مبتنی بر کد، در برابر حملات brute force از طریق اعمال کنترل محدودیت نرخ (Rate Limiting) محافظت شوند. همچنین، استفاده از کدی با حداقل ۶۴ بیت آنتروپی (Entropy)مدنظر قرار گیرد.2V6.6.44در صورت استفاده از Push Notifications جهت احراز هویت چند عاملی، محدودیت نرخ (Rate Limiting) به منظور جلوگیری از حملات Push Bombing اعمال شده باشد. استفاده از تطبیق عدد Matching) Number) نیز می‌تواند به کاهش این ریسک کمک کند.3V6.77Cryptographic authentication mechanismV6.7.11گواهینامه‌های مورد استفاده برای تأیید ادعاهای احراز هویت رمزنگاری‌شده به گونه‌ای ذخیره شوند که از تغییر یا دستکاری آن‌ها محافظت شود.3V6.7.22مقدار چالش (Challenge Nonce) حداقل ۶۴ بیت طول داشته باشد و از نظر آماری یکتا باشد یا حداقل در طول عمر دستگاه رمزنگاری منحصر به فرد باقی بماند.3V6.88Authentication with an Identity ProviderV6.8.11اگر برنامه از چند ارائه‌دهنده هویت (IdP) پشتیبانی می‌کند، امکان جعل هویت کاربر از طریق یک ارائه‌دهنده هویت دیگر وجود نداشته باشد (برای مثال، با استفاده از شناسه کاربری یکسان). مکانیسم استاندارد برای جلوگیری از این تهدید، این است که برنامه، کاربران را با استفاده از ترکیب شناسه IdP (به‌عنوان فضای نام یا (namespace و شناسه کاربر در آن، IdP ثبت و شناسایی کند.2V6.8.22وجود و یکپارچگی امضاهای دیجیتال بر روی تصدیق‌های (تقاضاها یا ادعاهای) احراز هویت برای مثال بر روی (توکن‌های JWT یا SAML assertions) همواره اعتبارسنجی می‌شود و هرگونه تصدیقی که فاقد امضا یا دارای امضای نامعتبر باشد، رد می‌گردد.2V6.8.33(تقاضاها یا ادعاهای) تصدیق‌های SAML به‌صورت منحصربه‌فرد پردازش شده و تنها یک‌بار در بازه‌ی اعتبار خود استفاده می‌شوند تا از حملات بازپخش (Replay Attacks) جلوگیری گردد.2V6.8.44اگر برنامه‌ای از یک ارائه‌دهنده هویت (IdP) جداگانه استفاده می‌کند و انتظار قدرت، روش‌ها یا تازگی احراز هویت خاصی را برای عملکردهای خاص دارد، برنامه این موضوع را با استفاده از اطلاعات برگردانده شده توسط IdP تأیید می‌کند. به عنوان مثال، اگر از OIDC استفاده شود، این کار می‌تواند با اعتبارسنجی ادعاهای (Claims) موجود در توکن شناسایی (ID Token) مانند «amr»، «acr» و «auth_time» (در صورت وجود) انجام شود. اگر ارائه‌دهنده هویت این اطلاعات را ارائه نکند، برنامه باید یک روش جایگزین مستندسازی‌شده داشته باشد که فرض می‌کند حداقل سطح احراز هویت استفاده شده است (مثلاً احراز هویت تک‌عاملی با نام کاربری و گذرواژه).2V77SessionSession ManagementV7.11Session Management DocumentationV7.1.11بازه عدم فعالیت نشست کاربر و بیشینه طول عمر نشست قبل از احراز هویت مجدد، در ترکیب با سایر کنترل‌ها مستند و متناسب سازی شود. مستند سازی انجام شده باید شامل توجیه برای هر انحراف(نقض) از الزامات احراز هویت مجدد NIST SP 800-63B باشد.2V7.1.22در مستند باید تعداد نشست همزمان مجاز برای یک کاربر و همچنین رفتار و اعمال مناسب برای زمانی که این تعداد به حداکثر رسید مشخص شود.2V7.1.33تمام سیستم‌هایی که نشست‌های کاربر را به عنوان بخشی از یک اکوسیستم مدیریت هویت فدرال(مانند سیستم‌های (SSO ایجاد و مدیریت می‌کنند، باید در کنار سایر کنترل‌های مربوط به طول عمر نشست‌ها، خاتمه آن‌ها و هرگونه شرایط دیگری که نیاز به احراز هویت مجدد دارد، مستند شوند.2V7.22Fundamental Session Management SecurityV7.2.11برنامه کاربردی باید تمام بررسی‌های توکن نشست‌ را با استفاده از یک سرویس backend مطمئن انجام دهد.1V7.2.22برنامه کاربردی که از هر یک از توکن‌های Self-Contained یا reference که به صورت پویا برای مدیریت نشست تولید شده‌اند استفاده کند اما از از کلیدهای API ثابت و کلید‌ها استفاده نکند.1V7.2.33در صورتی که برای نمایش نشست کاربر از توکن‌های reference استفاده می شود، این توکن‌ها منحصر به فرد بوده و با استفاده از یک تولید کننده عدد شبه تصادفی امن رمزنگاری(CSPRNG) که دارای انتروپی حداقل128 بیتی است تولید شوند.1V7.2.44برنامه کاربردی در هنگام احراز هویت کاربر یک توکن نشست جدید تولید نماید که شامل احراز هویت مجدد و ابطال توکن نشست کنونی است.1V7.33Session TimeoutV7.3.11بر اساس تحلیل ریسک و تصمیمات امنیتی مستند شده، پس از گذشت مهلت زمانی عدم فعالیت، کاربر مجبور به احراز هویت مجدد گردد.2V7.3.22بر اساس تحلیل ریسک و تصمیمات امنیتی مستند شده، پس از گذشت بیشینه زمان مطلق طول عمر، کاربر مجبور به احراز هویت مجدد گردد.2V7.44Session TerminationV7.4.11در مواقعی که فرآیند خاتمه نشست کاربر فعال می‌شود (مانند خروج کاربر یا انقضای نشست)، برنامه اجازه هیچ فعالیتی را به آن نشست نمی‌دهد. برای Reference tokens یا stateful session، این به معنی نامعتبرسازی اطلاعات نشست در برنامه Backend می‌باشد. برنامه‌هایی که از توکن‌های Self-contained استفاده می‌کنند نیاز به راه حل‌هایی نظیر نگهداری فهرستی از توکن‌های خاتمه‌یافته، عدم پذیرش توکن‌هایی که پیش از یک تاریخ و زمان مشخص برای هر کاربر تولید شده‌اند، یا چرخش کلید امضای مخصوص هر کاربر دارند.1V7.4.22برنامه کاربردی تمامی نشست‌های فعال را در زمانی که حساب کاربری غیرفعال یا حذف می‌شود را ابطال نماید. (مانند کارمندی که شرکت را ترک می‌کند)1V7.4.33برنامه کاربردی قابلیت ارائه گزینه ابطال تمامی نشست های فعال دیگر را پس از یک تغییر موفقیت آمیز یا حذف هریک از عوامل احراز هویت (نظیر تغییر پسورد از طریق ریست یا بازنشانی و در صورت وجود به روزرسانی تنظیمات MFA ) را داشته باشد.2V7.4.44تمامی صفحاتی که نیازمند احراز هویت هستند دارای دسترسی آسان و مشخص به فرآیند خروج باشند.2V7.4.55مدیران برنامه کاربردی قادر به ابطال نشست‌های فعال برای یک شخص یا تمامی کاربران باشند.2V7.55Defenses Against Session AbuseV7.5.11برنامه کاربردی قبل از اعطای مجوز تغییر ویژگی‌های حساس حساب کاربری که بر روی احراز هویت تاثیر دارد نظیر آدرس ایمیل، شماره تلفن، تنظیمات MFA یا اطلاعات دیگر که در بازگردانی حساب کاربری مورد استفاده قرار می‌گیرند، به احراز هویت مجدد کامل نیاز دارد.2V7.5.22حساب‌های کاربری قادر به دیدن(پس از احراز هویت مجدد با حداقل یک عامل) و ابطال یک یا همه نشست‌های فعال باشد.2V7.5.33برنامه کاربردی قبل از اجرای تراکنش‌ها یا عملیات‌های حساس نیازمند احراز هویت مجدد با حداقل یک عامل یا صحت سنجی ثانویه باشد.3V7.66Federated Re-authenticationV7.6.11طول عمر و ابطال نشست بین RP و idp طبق سند- که نیازمند احرازهویت مجدد در زمان مورد نیاز مانند وقتی که بیشینه زمان بین رخداد احراز هویت idp رسیده باشد- انجام شود.2V7.6.22ساخت نشست‌ها نیاز به رضایت کاربر یا یک اقدام صریح دارد که بدین صورت از ایجاد نشست‌های جدید برنامه بدون تعامل کاربر جلوگیری می‌شود.2V88AuthorizationAuthorizationV8.11Authorization DocumentationV8.1.11مستند اعطای مجوز باید شامل قوانینی به منظور محدودسازی دسترسی در سطح عملکرد و دسترسی مبتنی بر داده بر اساس مجوزهای کاربران و ویژگی‌های منابع باشد.1V8.1.22مستند اعطای مجوز باید قوانینی را برای محدودیت‌های دسترسی در سطح Field بر اساس مجوزهای کاربران و ویژگی‌های منابع تعریف نماید(هر دو دسترسی خواندن و نوشتن). توجه داشته باشید که این قوانین ممکن است به مقادیر دیگر ویژگی‌های شیء داده ی مربوطه (Relevant Data Object) بستگی داشته باشند، مانند حالت (state) یا وضعیت (status).2V8.1.33مستند برنامه کاربردی باید ویژگی‌های محیطی و زمینه‌ای (شامل و نه محدود به زمان روز، مکان، آدرس IP یا دستگاه) که در برنامه کاربردی به منظور اتخاذ تصمیمات امنیتی (نظیر آن دسته از تصمیماتی که مربوط به احراز هویت و اعطای مجوز می باشد) را مشخص کند.3V8.1.44مستندات احراز هویت و اعطای مجوز، علاوه بر اعطای مجوز در سطح Field، سطح عملکرد و داده‌های خاص، چگونگی استفاده از عوامل محیطی و زمینه‌ای در اتخاذ تصمیمات را مشخص نماید.3V8.22General Authorization DesignV8.2.11برنامه کاربردی باید از محدود بودن دسترسی‌‌های در سطح عملکرد به مشتریانی که دارای دسترسی صریح هستند اطمینان حاصل نماید.1V8.2.22برنامه کاربردی باید از محدود بودن دسترسی‌‌های در سطح داده به مشتریانی که دارای دسترسی صریح به اقلام داده‌ای خاص هستند اطمینان حاصل نماید تا از این طریق خطر آسیب پذیری IDOR و broken object level authorization را کاهش دهد .1V8.2.33برنامه کاربردی دسترسی در سطح Field را با مجوزهای صریح به Field ها برای مصرف کنندگان جهت کاهش خطر broken object property level authorization (BOPLA) محدود کرده باشد.2V8.2.44کنترل‌های امنیتی تطبیقی که بر اساس ویژگی‌های محیطی و زمینه‌ای کاربر (مانند زمان روز، مکان، آدرس IP یا دستگاه) هستند، برای تصمیم‌گیری‌های احراز هویت (Authentication) و مجوزدهی (Authorization) طبق مستندات برنامه پیاده‌سازی شده‌اند. این کنترل‌ها باید هم در زمان تلاش کاربر برای شروع یک نشست (Session) جدید و هم در طول یک نشست فعال، اعمال شوند.3V8.33Operation Level AuthorizationV8.3.11برنامه کاربردی قوانین مجوزدهی را در یک لایه سرویس معتبر اعمال نموده و بر آن دسته از کنترل‌هایی که مصرف کنندگان نامعتبر قادر به دستکاری آن‌ها هستند متکی نباشد. (نظیر جاوا اسکریپت سمت کاربر)1V8.3.22در مواقعی که امکان اعمال فوری تغییرات وجود ندارد (مثلاً وقتی که سیستم برای تصمیم‌گیری در مجوزدهی از توکن‌های Self-Contained مثل JWT استفاده می‌کند که اطلاعات را داخل خود ذخیره کرده و تا زمان انقضا تغییر نمی‌کنند)، باید کنترل‌های جبرانی وجود داشته باشد. این کنترل‌ها باید بتوانند زمانی که کاربر عملی را انجام می‌دهد که دیگر مجاز به آن نیست، هشدار بدهند و تغییر را برگردانند. با این حال، توجه کنید که این راهکار جایگزین نمی‌تواند جلوی نشت اطلاعات را بگیرد.3V8.3.33دسترسی به یک object بر اساس مجوزهای کاربری شخص درخواست کننده(مثال: مصرف کننده) باشد نه بر اساس مجوز‌های یک واسطه یا سرویسی که به نمایندگی از او عمل می‌کند. بطور مثال، در صورتی که یک مصرف کننده یک وب سرویس را با استفاده از یک توکن self-contained برای احراز هویت فراخوانی می‌کند و سپس آن سرویس اطلاعات را از یک سرویس دیگر درخواست می‌کند، سرویس دوم باید همان توکن مصرف کننده را استفاده کند، نه یک توکن سرویس-به-سرویس (Machine-to-Machine token) که متعلق به سرویس اول است، تا تصمیمات مجوزدهی دقیقاً بر اساس مجوزهای کاربر گرفته شوند.3V8.44Other Authorization ConsiderationsV8.4.11برنامه های کاربردی چند کاربره(multi tenants) از کنترل های cross-tenant به منظور تضمین این امر که عملیات‌های مصرف کنندگان هرگز کاربرانی (tenants) را که مجوز تعامل با آنها را ندارند را تحت تأثیر قرار نمی‌دهد.2V8.4.22دسترسی به درگاه‌های پیکربندی شامل چندین لایه امنیتی از قبیل تأیید مداوم هویت مصرف‌کننده، ارزیابی وضعیت امنیتی دستگاه و تحلیل ریسک زمینه‌ای باشد تا از این طریق اطمینان حاصل شود که موقعیت شبکه‌ای یا نقاط پایانی معتبر تنها عوامل برای مجوزدهی نیستند اگر چه که این عوامل احتمال دسترسی غیرمجاز را کاهش می‌دهند.3V99SelfSelf-contained TokensV9.11Token source and integrityV9.1.11قبل از پذیرش محتوای توکن‌ها، آن‌ها را با استفاده از امضای دیجیتال یا MAC به منظور حفاظت در مقابل دستکاری‌ها مورد اعتبارسنجی قرار داده شود.1V9.1.22فقط الگوریتم‌های موجود در لیست مجاز قادر به استفاده در ساخت و صحت سنجی توکن‌های self-contained در یک زمینه مشخص باشند. این لیست مجاز باید در حالت ایده آل شامل هم الگوریتم‌های متقارن و هم نامتقارن‌ها باشد و نباید شامل الگوریتم‌های NONE باشد. در صورتی که هر دو الگوریتم‌های متقارن و نانتقارن مورد نیاز باشند کنترل‌های بیشتری باید به منظور جلوگیری از سردرگمی کلید‌ها(key Confusion) بکار گرفته شود.1V9.1.33به منظور جلوگیری از مشخص نمودن منابع غیر مطمئن و کلید‌ها توسط مهاجمین، موارد کلیدی که در اعتبارسنجی توکن‌های self-contained مورد استفاده قرار می‌گیرند، از منابع از پیش پیکربندی شده مطمئنی که برای صادر کننده توکن است تعیین شود. برای JWTs و سایر ساختارهای JWS ، هدرهایی نظیر ‘jku’, ‘x5u’ و ‘jwk’ باید با یک لیست مجاز از منابع مطمئن مورد اعتبارسنجی قرار گیرند.1V9.22Token contentV9.2.11اگر یک بازه زمانی معتبر در داده‌های توکن وجود داشته باشد، توکن و محتوای آن تنها در صورتی پذیرفته می‌شوند که زمان بررسی در این بازه زمانی معتبر باشد. به عنوان مثال، برای JWTها، ادعاهای 'nbf' و 'exp' باید تایید شوند.1V9.2.22سرویسی که یک توکن دریافت می‌کند قبل از پذیرش محتوای آن، از لحاظ درستی نوع بررسی نموده و برای هدف مشخص شده در نظر گیرد. بطور مثال، فقط توکن‌های access می‌توانند به منظور تصمیمات مجوزی و فقط توکن های ID می‌توانند به منظور اثبات هویت کاربر مورد پذیرش قرار گیرند.2V9.2.33یک سرویس فقط توکن‌هایی را بپذیرد که به منظور استفاده توسط آن سرویس هستند(audience).برای JWT ها،این امر می‌تواند از طریق اعتبارسنجی ادعای 'aud' با یک لیست مجاز تعریف شده در سرویس صورت پذیرد.2V9.2.44اگر صادر کننده توکن از کلید خصوصی مشابهی برای audienceهای متفاوت استفاده می‌کند، توکن‌های تولید شده دارای محدودیت مخاطبی باشند که بطور منحصر به فردی مخاطبین مورد نظر را مشخص می‌کند. این امر از استفاده مجدد توکن توسط مخاطب ناخواسته جلوگیری می‌کند. در صورتی که شناسه مخاطب به صورت پویا مشخص شده باشد، صادرکننده توکن باید این مخاطبین را به منظور اطمینان از عدم جعل هویت مخاطب مورد اعتبارسنجی قرار دهد.2V1010OAuthOAuth and OIDCV10.11Generic OAuth and OIDC SecurityV10.1.11توکن‌ها باید فقط به مؤلفه‌هایی ارسال شوند که به‌طور دقیق به آن‌ها نیاز دارند. برای مثال، هنگام استفاده از الگوی Backend-for-Frontend برای برنامه‌های JavaScript مبتنی بر مرورگر، Access Tokens و Refresh Tokens باید فقط برای Backend قابل دسترس باشند.2V10.1.22Client باید فقط مقادیری را از Authorization Server بپذیرد (مانند Authorization Code یاID Token ) که این مقادیر حاصل از یک Authorization Flow باشند که توسط همان نشست (Session) و تراکنش User Agent آغاز شده است. این موضوع مستلزم آن است که Secretهای تولیدشده توسط کلاینت مانند code_verifier در PKCE، یا مقادیر state و nonce در OIDC قابل حدس زدن نباشند، مخصوص همان تراکنش باشند، و به‌صورت امن هم به کلاینت و هم به نشست (Session) مرورگری که تراکنش در آن شروع شده، متصل شده باشند.2V10.22OAuth ClientV10.2.11درCode Flow، باید OAuth Client در برابر حملاتBrowser-based Request Forgery که معمولاً با عنوان Cross-Site Request Forgery (CSRF) شناخته می‌شوند و درخواست‌های توکن را ایجاد می‌کنند، محافظت داشته باشد. این محافظت باید با استفاده از قابلیت PKCE یا با بررسی پارامترstate که در درخواست احراز مجوز ارسال شده است.2V10.2.22اگر OAuth Client بتواند با بیش از یک Authorization Server تعامل داشته باشد، باید دارای سازوکاری برای دفاع در برابر Mix-up Attacks باشد. برای مثال، می‌تواند الزام کند که Authorization Server مقدار پارامتر ‘iss’ را برگرداند و این مقدار هم درAuthorization Response و هم درToken Response اعتبارسنجی شود.2V10.2.33OAuth Client باید فقطScopes (یا سایر پارامترهای مجوزدهی) مورد نیاز را در درخواست‌ها به Authorization Server درخواست کند.3V10.33OAuth Resource ServerV10.3.11Resource Server باید فقط Access Tokenهایی را بپذیرد که برای استفاده با همان سرویس در نظر گرفته شده‌اند(Audience). Audience می‌تواند در یک Access Token ساختاریافته (مانند مقدار aud در JWT) درج شده باشد، یا از طریق Token Introspection Endpoint بررسی شود.2V10.3.22Resource Server باید تصمیمات مجوزدهی (Authorization Decisions) را بر اساس Claims موجود در Access Token که واگذاری مجوز (Delegated Authorization) را تعریف می‌کنند، اعمال کند. اگر Claimsهایی مانند sub، scope و authorization_details موجود باشند، باید جزو فرآیند تصمیم‌گیری قرار گیرند.2V10.3.33اگر برای گرفتن یک تصمیم کنترل دسترسی، لازم است یک کاربرِ یکتا از داخل Access Token (چه JWT و چه پاسخ Token Introspection ) شناسایی شود، سرور منبع (Resource Server) کاربر را از روی Claimهایی شناسایی کند که قابل اختصاص‌دادن به کاربران دیگر نیستند. معمولاً این یعنی استفاده از ترکیب دو Claim یعنی 'iss' (صادرکننده توکن) و 'sub' (شناسه یکتای کاربر)2V10.3.44اگر Resource Server نیازمند قدرت، روش یا تازگی خاص احراز هویت باشد، بررسی کند که Access Token ارائه‌شده این محدودیت‌ها را برآورده می‌کند. برای مثال، در صورت وجود، از Claimsهای OIDC مانند acr، amr و auth_time به ترتیب استفاده شود.2V10.3.55تأیید کنید که Resource Server از استفاده از Access Tokenهای سرقت‌شده یا Replay توکن‌ها (توسط افراد غیرمجاز) جلوگیری کند، با الزام استفاده از Sender-Constrained Access Tokens، مانند Mutual TLS برای OAuth 2 یا OAuth2 Demonstration of Proof of Possession (DPoP).3V10.44OAuth Authorization ServerV10.4.11سرور احراز هویت باید آدرس‌های بازگشتی (Redirect URI) را بر اساس فهرست مجاز (Allowlist) از URIهای از پیش‌ثبت‌شده و مخصوص هر کلاینت، با استفاده از مقایسه دقیقِ رشته‌ای Comparison) (Exact String اعتبارسنجی می‌کند.1V10.4.22اگر Authorization Server کد احراز مجوز (Authorization Code) را در Authorization Response برمی‌گرداند، این کد فقط یک‌بار برای درخواست توکن باید قابل استفاده باشد. برای دومین درخواست معتبر با یک Authorization Code که قبلاً برای صدور Access Token استفاده شده است، Authorization Server باید درخواست توکن را رد کند و هر توکن صادرشده‌ی مرتبط با آن Authorization Code را باطل نماید.1V10.4.33تأیید کنید که Authorization Code دارای مدت زمان معتبر بودن محدود باشد. حداکثر طول عمر می‌تواند برای برنامه‌های کاربردی در سطوح L1 و L2 تا ۱۰ دقیقه و برای برنامه‌های کاربردی در سطح L3 تا ۱ دقیقه باشد.1V10.4.44برای یک Client مشخص، Authorization Server فقط استفاده از Grantهایی را مجاز بداند که آن Client به استفاده از آن‌ها نیاز دارد. توجه داشته باشید که Grantهای ‘token’ (Implicit Flow) و ‘password’ (Resource Owner Password Credentials Flow) دیگر نباید استفاده شوند.1V10.4.55Authorization Server باید حملات Refresh Token Replay را برای Public Clientها کاهش دهد، ترجیحاً با استفاده از Sender-Constrained Refresh Tokens، یعنی Demonstrating Proof of Possession (DPoP) یا Certificate-Bound Access Tokens با استفاده از Mutual TLS (mTLS). برای برنامه‌های L1 و L2، می‌توان از Refresh Token Rotation استفاده کرد. اگر Refresh Token Rotation به‌کار گرفته شود، Authorization Server باید پس از استفاده، Refresh Token را باطل کند و اگر یک Refresh Token که قبلاً استفاده و باطل شده ارائه شود، تمام Refresh Tokenهای مربوط به آن مجوز را ابطال نماید.1V10.4.66اگر از Code Grant استفاده شود، Authorization Server باید حملات Authorization Code Interception را با الزام به استفاده از Proof Key for Code Exchange (PKCE) کاهش دهد. برای Authorization Requestها، Authorization Server باید یک مقدار معتبر برای 'code_challenge' الزام کند و نباید مقدار 'code_challenge_method' از نوع 'plain' را بپذیرد. برای Token Request، باید اعتبارسنجی پارامتر 'code_verifier' الزامی باشد.2V10.4.77اگر Authorization Server از Unauthenticated Dynamic Client Registration پشتیبانی می‌کند، ریسک مربوط به Client Applicationهای مخرب را باید کاهش دهد. این کار باید شامل اعتبارسنجی Client Metadata (مانند هر Registered URI)، اطمینان از رضایت کاربر، و هشدار به کاربر پیش از پردازش یک Authorization Request با یک Client Application غیرقابل اعتماد باشد.2V10.4.88Refresh Tokenها باید دارای یک انقضای مطلق (Absolute Expiration) باشند، حتی اگر از Sliding Refresh Token Expiration استفاده شود.2V10.4.99Refresh Tokenها و Reference Access Tokenها باید توسط کاربر مجاز از طریق User Interface Authorization Server قابل ابطال باشند، تا ریسک Clientهای مخرب یا توکن‌های سرقت‌شده کاهش یابد.2V10.4.1010Confidential Client باید برای درخواست‌های Backchannel بین Client و Authorization Server، مانند Token Requests، Pushed Authorization Requests (PAR) و Token Revocation Requests، احراز هویت شود.2V10.4.1111پیکربندی Authorization Server باید فقط Scopes موردنیاز را به OAuth Client اختصاص دهد.2V10.4.1212برای یک Client مشخص، Authorization Server فقط مقدار 'response_mode' را که این Client نیاز دارد، مجاز بداند. برای مثال، با اعتبارسنجی این مقدار توسط Authorization Server در برابر مقادیر مورد انتظار یا با استفاده از Pushed Authorization Request (PAR) یا JWT-secured Authorization Request (JAR).3V10.4.1313Grant Type ‘code’ همواره همراه با Pushed Authorization Requests (PAR) باید استفاده شود.3V10.4.1414Authorization Server باید فقط توکن‌های دسترسی از نوع وابسته به ارسال‌کننده (Proof-of-Possession) صادر می‌کند؛ چه به‌صورت توکن‌های دسترسی مبتنی بر گواهی از طریق TLS دوسویه (mTLS) و چه به‌صورت توکن‌های دسترسی وابسته به DPoP (Demonstration of Proof of Possession).3V10.4.1515برای یک کلاینت سمت‌سرور (که روی دستگاه کاربر نهایی اجرا نمی‌شود)، سرور احراز هویت اطمینان حاصل می‌کند که مقدار پارامترِ authorization_details از بک‌اند کلاینت ارسال شده و کاربر در آن دستکاری نکرده است. به‌عنوان مثال، با الزام به استفاده از درخواست احراز هویت پوش‌شده (PAR) یا درخواست احراز هویت ایمن‌شده با JWT (JAR).3V10.4.1616کلاینت باید از نوع Confidential Client باشد و سرور احراز هویت استفاده از روش‌های قدرتمند احراز هویت کلاینت ـ مبتنی بر رمزنگاری کلید عمومی و مقاوم در برابر حملات replay attacks ـ را الزامی کند؛ مانند TLS دوسویه (tls_client_auth ‎، ‎self_signed_tls_client_auth یا JWT مبتنی بر کلید خصوصی (private_key_jwt).3V10.55OIDC ClientV10.5.11Client به‌عنوان Relying Partyباید در برابر حملات بازپخش (Replay) توکن ID محافظت شده است. برای مثال، با بررسی اینکه مقدار claim مربوط به nonce در ID Token دقیقاً با مقدار **nonce**ای که در درخواست احراز هویت به OpenID Provider ارسال شده، یکسان باشد(که در OAuth 2 به آن authorization request ارسالی به authorization server گفته می‌شود).2V10.5.22Client باید کاربر را به‌صورت یکتا از ID Token Claims شناسایی کند، معمولاً از ‘sub’ Claim ، که قابل انتساب مجدد به کاربران دیگر نیست (در محدوده‌ی همان Identity Provider).2V10.5.33Client باید تلاش‌های یک Authorization Server مخرب برای جا زدن خود به‌جای یک Authorization Server دیگر از طریق متادیتای Authorization Server را رد می‌کند.کلاینت باید متادیتای Authorization Server را رد کند اگر مقدار issuer URL موجود در متادیتا دقیقاً با issuer URL از پیش پیکربندی‌شده و مورد انتظار کلاینت یکسان نباشد.2V10.5.44Client باید اعتبارسنجی کند ID Token برای استفاده توسط همان Client در نظر گرفته شده است (Audience)، با بررسی اینکه ‘aud’ Claim در توکن برابر با مقدار ‘client_id’ مربوط به Client باشد.2V10.5.55هنگام استفاده ازOIDC Back-Channel Logout، Relying Party از Denial of Service از طریق Forced Logout و Cross-JWT Confusion در جریان Logout باید جلوگیری کند. Client باید بررسی کند که Logout Token به درستی با مقدار typ آن برابر با logout+jwt باشد ، شامل ‘event’ Claim با نام عضو صحیح باشد و شامل ‘nonce’ Claim نباشد. همچنین توصیه می‌شود Expiration کوتاه باشد (مثلاً ۲ دقیقه).2V10.66OpenID ProviderV10.6.11OpenID Provider باید فقط مقادیر 'code'، 'ciba'، 'id_token' یا 'id_token code' را برای Response Mode مجاز بداند. توجه داشته باشید که 'code' نسبت به 'id_token code' (که OIDC Hybrid Flow است) ترجیح داده می‌شود و 'token' (هر Implicit Flow) نباید استفاده شود.2V10.6.22OpenID Provider از Denial of Service از طریق Forced Logout جلوگیری کند. این کار با دریافت تأیید صریح از کاربر نهایی یا در صورت وجود، اعتبارسنجی پارامترها در Logout Request (که توسط Relying Party آغاز شده است)، مانند ‘id_token_hint’، انجام می‌شود.2V10.77Consent ManagementV10.7.11Authorization Server باید تضمین ‌کند کاربر برای هر درخواست مجوز (Authorization Request) رضایت خود را اعلام کرده است. در صورتی که هویت کلاینت قابل اطمینان نباشد، Authorization Server باید در همه موارد کاربر را به‌صورت صریح برای اعلام رضایت (Consent) راهنمایی و از او تأیید بگیرد.2V10.7.22زمانی که Authorization Server از کاربر درخواست رضایت (Consent) می‌کند باید اطلاعات کافی و شفافی درباره آنچه کاربر در حال تأیید آن است ارائه ‌دهد. در صورت لزوم، این اطلاعات باید شامل این موارد باشد: ماهیت مجوزهای درخواستی )معمولاً بر اساس scope، resource server و جزئیات مجوز در Rich Authorization Requests – RAR)، هویت برنامه یا اپلیکیشن دریافت‌کننده مجوز و مدت اعتبار این مجوزها.2V10.7.33کاربر باید بتواند رضایت‌هایی (Consents) را که از طریق Authorization Server صادر کرده است، مشاهده، ویرایش و لغو (Revoke) کند.2V1111CryptographyCryptographyV11.11Cryptographic Inventory and DocumentationV11.1.11اطمینان حاصل کنید که یک سیاست مستند برای مدیریت کلیدهای رمزنگاری و چرخه‌عمر کلیدهای رمزنگاری وجود دارد که از یک استاندارد مدیریت کلید مانند NIST SP 800-57 پیروی می‌کند. این باید شامل اطمینان از این موضوع باشد که کلیدها بیش از حد به اشتراک گذاشته نشوند (برای مثال، در مورد Secrets مشترک با بیش از دو موجودیت و در مورد کلیدهای خصوصی با بیش از یک موجودیت).2V11.1.22فهرست اجزاء رمزنگاری باید تهیه و نگهداری ‌شود و به‌صورت منظم به‌روزرسانی گردد و شامل تمام کلیدهای رمزنگاری، الگوریتم‌ها و گواهی‌های دیجیتال مورد استفاده در برنامه باشد. این فهرست همچنین باید مشخص کند که کلیدها در کدام بخش‌های سیستم مجاز یا غیرمجاز به استفاده هستند و چه نوع داده‌هایی می‌توانند یا نمی‌توانند با این کلیدها محافظت شوند.2V11.1.33مکانیزم‌های کشف رمزنگاری برای شناسایی تمام موارد استفاده از رمزنگاری در سیستم باید استفاده ‌شود؛ از جمله رمزنگاری (encryption)، هش‌کردن (hashing) و عملیات امضای دیجیتال (signing).3V11.1.44فهرست اجزاء رمزنگاری باید تهیه ‌شود. این فهرست باید شامل یک برنامه مستند باشد که مسیر مهاجرت به استانداردهای جدید رمزنگاری (مانند رمزنگاری پساکوانتومی) را مشخص می‌کند تا امکان واکنش مناسب به تهدیدات آینده فراهم شود.3V11.22Secure Cryptography ImplementationV11.2.11برای عملیات رمزنگاری باید از پیاده‌سازی‌های مورد تأیید (شامل کتابخانه‌ها و پیاده‌سازی‌های سخت‌افزاری) استفاده شود.2V11.2.22برنامه با انعطاف‌پذیری رمزنگاری (crypto agility) باید طراحی شده باشد، به‌طوری که الگوریتم‌های تولید اعداد تصادفی، رمزنگاری احراز هویت‌شده، MAC یا هش، طول کلیدها، تعداد دورها، رمزها و حالت‌ها بتوانند در هر زمان مجدداً پیکربندی، ارتقاء یا تعویض شوند تا در برابر شکست‌های رمزنگاری محافظت شوند. به همین ترتیب، باید امکان جایگزینی کلیدها و رمزهای عبور و رمزگذاری مجدد داده‌ها نیز وجود داشته باشد. این امکان ارتقاء بدون وقفه به رمزنگاری پساکوانتومی (PQC) را فراهم می‌کند، زمانی که پیاده‌سازی‌های با اطمینان بالا از طرح‌ها یا استانداردهای تأییدشده PQC به‌طور گسترده در دسترس قرار گیرند.2V11.2.33تمام بدویات رمزنگاری (cryptographic primitives) بر اساس الگوریتم، اندازه کلید و پیکربندی، حداقل ۱۲۸ بیت سطح امنیتی را فراهم می‌کنند(2128)، برای مثال، یک کلید ECC با طول ۲۵۶ بیت تقریباً ۱۲۸ بیت امنیت ارائه می‌دهد، در حالی که برای رسیدن به همین سطح امنیت، الگوریتم RSA به کلید ۳۰۷۲ بیتی نیاز دارد.2V11.2.44تأیید کنید که تمامی عملیات رمزنگاری زمان ثابت (constant-time) باشند و هیچ عملیات «کوتاه‌شده» (short-circuit) در مقایسه‌ها، محاسبات یا بازگشت‌ها وجود نداشته باشد تا از نشت اطلاعات جلوگیری شود.( مهاجم می‌تواند از همین تفاوت‌های زمانی، از طریق Timing Side-Channel Attack، اطلاعات حساس را استخراج کند.)3V11.2.55تأیید کنید که تمامی ماژول‌های رمزنگاری به‌صورت امن دچار خطا (fail securely) شوند و خطاها به گونه‌ای مدیریت شوند که ایجاد آسیب‌پذیری‌هایی مانند حملات Padding Oracle را ممکن نکنند.3V11.33Encryption AlgorithmsV11.3.11از مد‌های بلاک ناامن (مانند ECB) و روش‌های Padding ضعیف (مانند PKCS#1 v1.5) نباید استفاده شود.1V11.3.22تنها رمزها و مد‌های تأییدشده، مانند AES با GCM باید استفاده شوند.1V11.3.33داده‌های رمزنگاری‌شده باید با استفاده از ترجیحاً یک روش رمزنگاری احراز هویت‌شده تأییدشده یا با ترکیب یک روش رمزنگاری تأییدشده با یک الگوریتم MAC تأییدشده در برابر تغییرات غیرمجاز محافظت شوند.2V11.3.44تأیید کنید که Nonceها، Initialization Vectorها و سایر اعداد یک‌بار مصرف برای بیش از یک جفت کلید رمزنگاری و عنصر داده استفاده نشوند. روش تولید آن‌ها باید متناسب با الگوریتم مورد استفاده باشد.3V11.3.55تأیید کنید که هر ترکیبی از یک الگوریتم رمزنگاری و یک الگوریتم MAC در حالت Encrypt-then-MAC عمل کند.3V11.44Hashing and Hash-based FunctionsV11.4.11تأیید کنید که تنها توابع هش تأییدشده برای موارد استفاده عمومی رمزنگاری، از جمله امضاهای دیجیتال، HMAC، KDF و تولید بیت تصادفی استفاده شوند. توابع هش غیرمجاز، مانند MD5، نباید برای هیچ هدف رمزنگاری به‌کار گرفته شوند.1V11.4.22رمزعبورها با استفاده از یک تابع مشتق‌سازی کلید تأییدشده و پرهزینه محاسباتی (که به آن «تابع هش رمزعبور» نیز گفته می‌شود) ذخیره شوند، و تنظیمات پارامترها بر اساس راهنمایی‌های کنونی پیکربندی شده باشد. این تنظیمات باید تعادل بین امنیت و عملکرد برقرار کنند تا حملات Brute-force برای سطح امنیت مورد نیاز به‌طور کافی دشوار باشد.2V11.4.33توابع هش استفاده‌شده در امضاهای دیجیتال، باید به‌عنوان بخشی از احراز هویت داده یا یکپارچگی داده، در برابر collision مقاوم بوده و طول بیت مناسب داشته باشند. اگر مقاومت در برابر collision لازم باشد، طول خروجی باید حداقل 256 بیت باشد. اگر تنها مقاومت در برابر حملات Second Pre-image لازم باشد، طول خروجی باید حداقل 128 بیت باشد.2V11.4.44برنامه باید هنگام استخراج کلیدهای مخفی از پسوردها از توابع مشتق‌سازی کلید (KDF) تاییدشده با پارامترهای Key Stretching استفاده می‌کند. پارامترهای مورد استفاده باید تعادلی بین امنیت و عملکرد برقرار کنند تا از نفوذ حملات brute-force و به خطر افتادن کلید رمزنگاری تولیدشده جلوگیری شود.2V11.55Random ValuesV11.5.11اعداد و رشته‌های تصادفی که قرار است قابل حدس نباشند، باید با استفاده از یک تولیدکننده اعداد شبه‌تصادفی امن رمزنگاری‌شده (CSPRNG) تولید شوند و حداقل 128 بیت انتروپی داشته باشند. توجه داشته باشید که UUIDها این شرط را رعایت نمی‌کنند.2V11.5.22مکانیزم تولید اعداد تصادفی مورد استفاده به‌گونه‌ای طراحی شده باشد که حتی تحت بار سنگین نیز به‌طور امن عمل کند.3V11.66Public Key CryptographyV11.6.11فقط الگوریتم‌های رمزنگاری و مدهای عملیاتی تأیید شده برای تولید کلید و مقداردهی اولیه، و همچنین برای تولید و تأیید امضاهای دیجیتال باید استفاده می‌شوند. الگوریتم‌های تولید کلید نباید کلیدهای ناامن تولید کنند که در برابر حملات شناخته شده آسیب‌پذیر باشند؛ به‌عنوان مثال، کلیدهای RSA که در برابر Fermat factorization آسیب‌پذیر هستند.2V11.6.22برای تبادل کلید از الگوریتم‌های رمزنگاری تأیید شده (مانند Diffie-Hellman) استفاده می‌شود و تمرکز بر این است که مکانیزم‌های تبادل کلید از پارامترهای امن بهره ببرند. این کار از حملات بر فرآیند برقراری کلید جلوگیری می‌کند و مانع حملات مرد میانی (MITM) یا شکست‌های رمزنگاری می‌شود.3V11.77In-Use Data CryptographyV11.7.11رمزنگاری کامل حافظه (Full Memory Encryption) باید فعال باشد تا داده‌های حساس هنگام استفاده محافظت شوند و دسترسی کاربران یا فرآیندهای غیرمجاز به آن‌ها جلوگیری شود.3V11.7.22کاهش داده‌ها (data minimization) تضمین می‌کند که حداقل مقدار داده در حین پردازش افشا شود، و اطمینان حاصل شود که داده‌ها بلافاصله پس از استفاده یا در اولین فرصت ممکن رمزنگاری شوند.3V1212SecureSecure CommunicationV12.11General TLS Security GuidanceV12.1.11جدیدترین نسخه‌های پیشنهادی پروتکل TLS فعال باشند، مانند TLS 1.2 و TLS 1.3 نسخه‌ی جدیدترین پروتکل TLS باید گزینه‌ی ترجیحی باشد.1V12.1.22تنها cipher suiteهای پیشنهادی فعال باشند و قوی‌ترین cipher suiteها به‌عنوان گزینه‌ی ترجیحی تنظیم شده باشند. برنامه‌های L3 باید تنها از cipher suiteهایی پشتیبانی کنند که Forward Secrecy را فراهم می‌کنند.2V12.1.33برنامه باید پیش از استفاده از هویت گواهی برای احراز هویت یا مجوزدهی، اعتبار و مورد اعتماد بودن گواهی‌های کلاینت در mTLS را بررسی و تأیید ‌کند.2V12.1.44لغو صحیح گواهی‌ها، مانند OCSP ، باید فعال و به‌درستی پیکربندی شده باشد.3V12.1.55Encrypted Client Hello (ECH) باید در تنظیمات TLS برنامه فعال باشد تا از افشای متادیتای حساس، مانند Server Name Indication (SNI)، در طول فرآیند Handshake TLS جلوگیری شود.3V12.22HTTPS Communication with External Facing ServicesV12.2.11برای تمام ارتباطات بین کلاینت و سرویس‌های مبتنی بر HTTP که در معرض دسترسی خارجی هستند، از TLS باید استفاده ‌شود و هیچ‌گونه بازگشت (fallback) به ارتباطات ناامن یا بدون رمزنگاری انجام نگیرد.1V12.2.22سرویس‌هایی که در معرض دسترسی خارجی قرار دارند از گواهی‌های TLS عمومی و مورد اعتماد استفاده می‌کنند.1V12.33General Service to Service Communication SecurityV12.3.11یک پروتکل رمزنگاری‌شده مانند TLS باید برای تمامی ارتباطات ورودی و خروجی به و از برنامه استفاده شود، از جمله سیستم‌های مانیتورینگ، ابزارهای مدیریت، دسترسی از راه دور و SSH، میان‌افزارها، پایگاه‌های داده، mainframes، سیستم‌های partner یا APIهای خارجی. سرور نباید به پروتکل‌های ناامن یا بدون رمزگذاری بازگردد.2V12.3.22کلاینت‌های TLS باید قبل از برقراری ارتباط با سرور TLS، گواهی‌های دریافتی را اعتبارسنجی کنند.2V12.3.33TLS یا دیگر مکانیزم‌های مناسب رمزگذاری انتقال باید برای تمامی ارتباطات بین سرویس‌های داخلی مبتنی بر HTTP درون برنامه استفاده شود و ارتباط به حالت‌های ناامن یا بدون رمزگذاری بازنگردد.2V12.3.44ارتباطات TLS بین سرویس‌های داخلی باید از گواهی‌های معتبر استفاده کنند. در صورتی که از گواهی‌های داخلی تولیدشده یا Self-Signed استفاده شود، سرویس مصرف‌کننده باید به‌گونه‌ای پیکربندی شود که تنها به CAهای داخلی مشخص و گواهی‌های Self-Signed خاص اعتماد کند.2V12.3.55سرویس‌هایی که درون یک سیستم با یکدیگر ارتباط دارند (ارتباطات درون‌سرویسی)، باید از احراز هویت قوی استفاده کنند تا هر نقطه انتهایی (endpoint) تأیید شود. روش‌های احراز هویت قوی، مانند احراز هویت کلاینت TLS، باید به‌کار گرفته شوند تا هویت تضمین شود (با استفاده از زیرساخت کلید عمومی (PKI) و مکانیزم‌هایی که در برابر حملات تکرار (replay attacks) مقاوم هستند). برای معماری‌های میکروسرویس، استفاده از سرویس مش برای ساده‌سازی مدیریت گواهی‌ها و افزایش امنیت در نظر گرفته شود3V1313ConfigurationConfigurationV13.11Configuration DocumentationV13.1.11تمامی نیازهای ارتباطی برنامه باید به‌طور کامل مستندسازی شده باشند. این مستندسازی شامل سرویس‌های خارجی که برنامه به آن‌ها وابسته است و همچنین مواردی که کاربر نهایی جهت اتصال به سرویس خارجی مشخص می‌کند باید باشد.2V13.1.22برای هر سرویسی که برنامه استفاده می‌کند، مستندسازی باید شامل حداکثر تعداد ارتباطات همزمان (مثلاً محدودیت‌های Connection Pool) و نحوه‌ی رفتار برنامه هنگام رسیدن به این حد باشد، از جمله هر مکانیزم بازیابی یا جایگزین، تا از بروز شرایط Denial of Service جلوگیری شود.3V13.1.33مستندات برنامه باید استراتژی‌های مدیریت منابع را برای هر سیستم یا سرویس خارجی که استفاده می‌کند مشخص کرده باشد (مثلاً پایگاه‌های داده، هندل‌های فایل، رشته‌ها، اتصالات HTTP) این مستندسازی باید شامل این موارد باشد :رویه‌های آزادسازی منابع، تنظیمات تایم‌اوت، مدیریت خطاها، جایی که منطق Retry اعمال می‌شود، شامل محدودیت تعداد Retry، تأخیرها و الگوریتم‌هایBack-off. برای عملیات همزمان درخواست–پاسخ HTTP (Synchronous)، مستندات باید تایم‌اوت کوتاه را الزام کند و یا Retryها را غیرفعال کند یا به‌طور سختگیرانه محدود کند تا از تاخیرهای زنجیره‌ای و هدررفت منابع جلوگیری شود.3V13.1.44مستندسازی برنامه باید شامل secretهای حیاتی برای امنیت برنامه و همچنین برنامه‌ای برای چرخش آن‌ها باشد( بر اساس مدل تهدید سازمان و نیازهای کسب‌وکار).3V13.22Backend Communication ConfigurationV13.2.11رتباطات بین اجزای بک‌اند برنامه که از مکانیزم استاندارد نشست کاربران برنامه پشتیبانی نمی‌کنند، از جمله APIها، میان‌افزارها و لایه‌های داده، باید احراز هویت شده باشند. احراز هویت باید با استفاده از حساب‌های سرویس جداگانه، توکن‌های کوتاه‌مدت یا احراز هویت مبتنی بر گواهی انجام شود و نباید از اعتبارنامه‌های ثابت مانند رمز عبور، کلیدهای API یا حساب‌های مشترک با دسترسی‌های سطح بالا استفاده شود.2V13.2.22ارتباطات بین اجزای بک‌اند، از جمله سرویس‌های محلی یا سیستم‌عامل، APIها، میان‌افزارها و لایه‌های داده، با حساب‌هایی باید انجام شود که کمترین سطح دسترسی لازم را دارند.2V13.2.33اگر اعتبارنامه‌ای برای احراز هویت سرویس استفاده می‌شود، اعتبارنامه‌ای که توسط مصرف‌کننده استفاده می‌شود، اعتبارنامه پیش‌فرض نباشد (مثلاً root/root یا admin/admin).2V13.2.44یک allowlist برای تعیین منابع یا سیستم‌های خارجی که برنامه مجاز به ارتباط با آن‌ها است باید وجود داشته باشد (مثلاً برای درخواست‌های خروجی، بارگذاری داده یا دسترسی به فایل). این allowlist می‌تواند در لایه برنامه، وب‌سرور، فایروال یا ترکیبی از لایه‌های مختلف پیاده‌سازی شود.2V13.2.55وب‌سرور یا سرور برنامه با یک allowlist از منابع یا سیستم‌هایی که سرور می‌تواند به آن‌ها درخواست ارسال کند یا داده‌ها و فایل‌ها را بارگذاری کند پیکربندی شده باشد.2V13.2.66در مواقعی که برنامه به سرویس‌های جداگانه متصل می‌شود، پیکربندی مستندسازی‌شده برای هر اتصال رعایت شود، از جمله حداکثر ارتباطات همزمان، رفتار هنگام رسیدن به حداکثر ارتباط مجاز، زمان‌های Timeout اتصال و استراتژی‌های Retry.3V13.33Secret ManagementV13.3.11یک راهکار مدیریت secret، مانند Key Vault، برای ایجاد امن، ذخیره، کنترل دسترسی و از بین بردن secret بک‌اند استفاده شود. این secret می‌تواند شامل رمزعبورها، داده‌های رمز نگاری، اطلاعات حساس مربوط به اتصال به پایگاه داده و سیستم‌های شخص ثالث، کلیدها و seedهای توکن‌های زمان‌محور، سایر secretهای داخلی و کلیدهای API باشد. Secret نباید در کد منبع برنامه یا در build artifacts قرار گیرد. برای برنامه‌های L3، این باید شامل راهکاری مبتنی بر سخت‌افزار مانند HSM باشد.2V13.3.22دسترسی به دارایی‌های secret بر اساس اصل حداقل دسترسی (Least Privilege) رعایت شود.2V13.3.33تمام عملیات رمزنگاری باید با استفاده از یک ماژول امنیتی ایزوله (مانند Vault یا Hardware Security Module) انجام شود تا مواد کلیدی به‌طور امن مدیریت و محافظت شده و از افشای خارج از ماژول امنیتی جلوگیری شود.3V13.3.44secretها بر اساس مستندسازی برنامه طوری پیکربندی شوند که منقضی شده و چرخش داده شوند.3V13.44Unintended Information LeakageV13.4.11برنامه باید به‌گونه‌ای مستقر شود که هیچ‌گونه متادیتای کنترل نسخه، از جمله پوشه‌های .git یا .svn، در دسترس نباشد یا به شکلی باشد که این پوشه‌ها نه از بیرون و نه توسط خود برنامه قابل دسترسی نباشند.1V13.4.22حالت‌های Debug برای تمام اجزا در محیط‌های production باید غیرفعال شده باشند تا از افشای قابلیت‌های دیباگ و نشت اطلاعات جلوگیری شود.2V13.4.33وب‌سرورها فهرست‌بندی دایرکتوری‌ها را به کاربر نهایی نباید نمایش دهند مگر اینکه به‌طور صریح مورد نظر باشد.2V13.4.44از متد HTTP TRACE در محیط‌های production نباید پشتیبانی شود تا از احتمال نشت اطلاعات جلوگیری شود.2V13.4.55مستندسازی‌ها (مانند مستندات APIهای داخلی) و نقاط پایش (Monitoring Endpoints) در دسترس نباشند مگر اینکه به‌طور صریح مورد نظر باشد.2V13.4.66تأیید کنید که برنامه اطلاعات نسخه دقیق اجزای backend را افشا نکند.3V13.4.77لایه وب باید به‌گونه‌ای پیکربندی شده باشد که فقط فایل‌هایی با پسوندهای مشخص را سرو کند تا از افشای تصادفی اطلاعات، پیکربندی و کد منبع جلوگیری شود.3V1414DataData ProtectionV14.11Data Protection DocumentationV14.1.11تمامی داده‌های حساس ایجادشده و پردازش‌شده توسط برنامه باید شناسایی شده و بر اساس سطوح حفاظتی طبقه‌بندی شده‌اند. این موضوع شامل داده‌هایی می‌شود که صرفاً کُدگذاری شده‌اند و به‌راحتی قابل بازیابی هستند، مانند رشته‌های Base64 یا محتوای متنی (plaintext) داخل یک JWT. سطوح حفاظتی باید الزامات قوانین و استانداردهای حفاظت از داده و حریم خصوصی که برنامه ملزم به رعایت آن‌هاست را در نظر بگیرند.2V14.1.22برای تمامی سطوح حفاظت از داده‌های حساس، مجموعه‌ای مستند از الزامات حفاظتی تعریف شده باشد. این الزامات باید شامل (اما محدود به آن نباشد) موارد زیر باشند: الزامات مرتبط با رمزنگاری کلی، بررسی صحت و یکپارچگی، دوره‌های نگهداری داده، نحوه ثبت داده‌ها در لاگ، کنترل‌های دسترسی به داده‌های حساس در لاگ‌ها، رمزنگاری در سطح پایگاه داده، الزامات مربوط به حریم خصوصی و فناوری‌های تقویت‌کننده حریم خصوصی مورد استفاده، و سایر الزامات مرتبط با محرمانگی.2V14.22General Data ProtectionV14.2.11داده‌های حساس باید فقط در بدنه پیام HTTP یا فیلدهای هدر به سرور ارسال شوند، و اینکه URL و query string شامل اطلاعات حساس (مانند API key یا session token) نباشند.1V14.2.22برنامه باید از cache شدن داده‌های حساس در اجزای سرور مانند Load Balancer و Application Cache جلوگیری کند، یا اطمینان حاصل شود که داده‌ها پس از استفاده به‌طور ایمن پاک‌سازی می‌شوند.2V14.2.33داده‌های حساس تعریف‌شده به طرف‌های غیرقابل اعتماد (مانند User Trackers) نباید ارسال شوند تا از جمع‌آوری ناخواسته داده‌ها خارج از کنترل برنامه جلوگیری شود.2V14.2.44کنترل‌های مرتبط با داده‌های حساس شامل رمزنگاری، بررسی صحت و یکپارچگی، نگهداری، نحوه ثبت داده‌ها در لاگ، کنترل‌های دسترسی به داده‌های حساس در لاگ‌ها، حریم خصوصی و فناوری‌های مربوط به حریم خصوصی، مطابق با آنچه در مستندات برای سطح حفاظت مشخص هر داده تعریف شده است، پیاده‌سازی شوند.2V14.2.55مکانیزم‌های cache باید طوری پیکربندی شده باشند که تنها پاسخ‌هایی با نوع محتوای مورد انتظار برای آن منبع cache شوند و شامل محتوای حساس یا پویا نباشند. وب‌سرور باید هنگام دسترسی به فایل ناموجود، پاسخ 404 یا 302 برگرداند و نه فایل معتبر دیگر، تا از حملات Web Cache Deception جلوگیری شود.3V14.2.66برنامه باید تنها حداقل داده‌های حساس مورد نیاز برای عملکرد برنامه را بازگرداند. برای مثال، تنها برخی از ارقام شماره کارت اعتباری بازگردانده شود و نه شماره کامل. در صورتی که داده کامل لازم باشد، باید در رابط کاربری masked شود مگر اینکه کاربر به‌طور مشخص آن را مشاهده کند.3V14.2.77اطلاعات حساس باید تحت طبقه‌بندی دوره‌ای نگهداری داده قرار گرفته باشند، به‌گونه‌ای که داده‌های قدیمی یا غیرضروری به‌طور خودکار، در یک برنامه زمان‌بندی‌شده مشخص، یا براساس نیاز حذف شوند.3V14.2.88اطلاعات حساس باید از متادیتای فایل‌های ارسال‌شده توسط کاربر حذف شود، مگر اینکه ذخیره‌سازی آن با رضایت کاربر انجام شود.3V14.33Client-side Data ProtectionV14.3.11داده‌های احراز هویت‌شده از حافظه کلاینت، مانند DOM مرورگر، پس از خروج کلاینت یا Session پاک شوند. فیلد هدر Clear-Site-Data در پاسخ سرور می‌تواند در این زمینه مفید باشد، اما کلاینت باید بتواند داده‌ها را حتی زمانی که اتصال به سرور در دسترس نیست در زمان پایان Session (خروج از آن) پاک کند.1V14.3.22برنامه باید هدرهای پاسخ HTTP، anti-cach مناسب (مانند Cache-Control: no-store) را تنظیم کند تا داده‌های حساس در مرورگرها cache نشوند.2V14.3.33برای اطلاعات بیشتر، همچنین به منابع زیر مراجعه کنید:2V1515SecureSecure Coding and ArchitectureV15.11Secure Coding and Architecture DocumentationV15.1.11مستندات برنامه باید بازه‌های زمانی جهت برطرف سازی آسیب‌پذیری‌ نسخه‌های مؤلفه‌ شخص ثالث (بر اساس ریسک) و همچنین به‌روزرسانی کتابخانه‌ها را به طور کلی تعریف کرده باشد تا ریسک ناشی از این مؤلفه‌ها به حداقل برسد.1V15.1.22یک کاتالوگ دارایی مانند Software Bill of Materials (SBOM) باید برای تمامی کتابخانه‌های شخص ثالث مورد استفاده نگهداری شود. شامل تایید این که مؤلفه‌ها از مخازن از پیش تعیین‌شده، قابل اعتماد و به‌طور مستمر نگهداری‌شده تهیه شده‌اند.2V15.1.33مستندات برنامه باید شامل عملکردهایی که زمان‌بر یا پرمصرف(منابع سیستمی) هستند نیز باشد. این مورد باید شامل روش‌هایی برای جلوگیری از دست‌رفتن دسترس‌پذیری به دلیل استفاده بیش از حد از این عملکردها و همچنین جلوگیری از وضعیتی باشد که پردازش یک پاسخ طولانی‌تر از زمان انتظار مصرف‌کننده شود. تدابیر احتمالی می‌تواند شامل پردازش غیرهمزمان، استفاده از صف‌ها و محدود کردن فرآیندهای موازی برای هر کاربر و هر برنامه باشد.2V15.1.44مستندات برنامه باید کتابخانه‌های شخص ثالثی را که به‌عنوان «کامپوننت‌های پرخطر» شناخته می‌شوند، مشخص کرده باشد.3V15.1.55مستندات برنامه باید بخش‌هایی از برنامه را که به‌عنوان «عملکرد خطرناک» استفاده می‌شود، مشخص کرده باشد.3V15.22Security Architecture and DependenciesV15.2.11برنامه باید تنها شامل کامپوننت‌هایی باشد که چارچوب‌های زمانی مستند‌شده برای به‌روزرسانی و رفع آسیب‌پذیری‌ها را نقض نکرده‌باشند.1V15.2.22برنامه باید بر اساس تصمیمات و استراتژی‌های امنیتی مستندسازی‌شده، تدابیری برای جلوگیری از کاهش دسترس‌پذیری ناشی از عملکردهایی که زمان‌بر یا پرمصرف منابع هستند، پیاده‌سازی کرده باشد.2V15.2.33محیط production تنها شامل عملکردهایی می‌باشد که برای اجرای برنامه ضروری هستند و هیچ قابلیت اضافی مانند کدهای تست، نمونه‌کدها و عملکردهای توسعه‌ای در دسترس نمی‌باشد.2V15.2.44کامپوننت‌های شخص ثالث و تمام وابستگی‌های انتقالی آن‌ها از مخزن مورد انتظار باید دریافت ‌شوند، چه داخلی و چه منبع خارجی، و ریسک حمله‌ی dependency confusion مدیریت شود.3V15.2.55برنامه باید محافظت‌های اضافی را در بخش‌هایی از برنامه که به‌عنوان «عملکرد خطرناک» مستند شده‌اند یا از کتابخانه‌های شخص ثالثی که به‌عنوان «کامپوننت‌های پرریسک» شناخته می‌شوند، پیاده‌سازی می‌کند. این می‌تواند شامل تکنیک‌هایی مانند sandboxing، encapsulation، containerization یا جداسازی در سطح شبکه باشد تا حمله‌کنندگان پس از نفوذ به یک بخش از برنامه، نتوانند به بخش‌های دیگر برنامه منتقل شوند و زمان لازم برای پیشروی آن‌ها افزایش یابد.3V15.33Defensive CodingV15.3.11برنامه باید تنها زیرمجموعه‌ای از فیلدهای مورد نیاز از یک data object را بازگرداند. به‌عنوان مثال، نباید کل data object بازگردانده شود، زیرا برخی فیلدهای منفرد نباید برای کاربران قابل دسترسی باشند.1V15.3.22در جایی که بک‌اند برنامه به URLهای خارجی فراخوانی می‌فرستد، طوری باید پیکربندی شده باشد که تنها در صورت نیاز و منظور مشخص، از تغییر مسیرها (redirects) پیروی کند.2V15.3.33برنامه باید دارای تدابیر مقابله‌ای برای محافظت در برابر حملات mass assignment باشد، به‌طوری که فیلدهای مجاز برای هر کنترلر و اکشن محدود شده باشند؛ به عنوان مثال، نباید بتوان مقداری برای فیلدی وارد یا به‌روزرسانی کرد که قرار نبوده بخشی از آن اکشن باشد.2V15.3.44تمام اجزای proxying و middleware باید آدرس IP اصلی کاربر را به‌درستی منتقل کنند، با استفاده از فیلدهای داده معتبر که توسط کاربر نهایی قابل دستکاری نباشند، و برنامه و وب‌سرور از این مقدار صحیح برای ثبت لاگ و تصمیم‌گیری‌های امنیتی مانند rate limiting استفاده کنند، با در نظر گرفتن اینکه حتی آدرس IP اصلی ممکن است به دلیل IPهای پویا، VPNها یا فایروال‌های سازمانی قابل اعتماد نباشد.2V15.3.55برنامه باید به‌طور صریح اطمینان حاصل کند که variables از نوع صحیح هستند و عملیات‌های مقایسه و comparator به‌صورت دقیق (strict) انجام می‌شوند. این اقدام برای جلوگیری از آسیب‌پذیری‌های type juggling یا type confusion است که ممکن است به دلیل فرضیات نادرست برنامه درباره نوع یک متغیر ایجاد شود.2V15.3.66کد JavaScript باید به‌گونه‌ای نوشته شده باشد که از prototype pollution جلوگیری کند، برای مثال با استفاده از Set() یا Map() به جای object literals.2V15.3.77برنامه باید دارای تدابیر محافظتی در برابر HTTP parameter pollution باشد، به‌ویژه اگر چارچوب برنامه تفاوتی بین منابع پارامترهای درخواست (رشته‌های query، پارامترهای body، کوکی‌ها یا فیلدهای هدر) قائل نشود.2V15.44Safe ConcurrencyV15.4.11shared objects در کد multi-threaded (مانند cacheها، فایل‌ها، یا اشیائی که توسط multiple threads دسترسی پیدا می‌کنند) باید به‌صورت ایمن مورد استفاده قرار بگیرند، با استفاده از نوع‌های thread-safe و مکانیزم‌های همگام‌سازی مانند lock یا semaphore تا از race condition و تخریب داده جلوگیری شود.3V15.4.22بررسی وضعیت یک resource، مانند وجود آن یا دسترسی‌ها،و اقداماتی که به این وضعیت وابسته‌اند، به‌صورت یک عملیات واحد انجام شوند تا از race condition نوع time-of-check to time-of-use (TOCTOU) جلوگیری شود. برای مثال، بررسی اینکه یک فایل وجود دارد قبل از باز کردن آن، یا تأیید دسترسی یک کاربر قبل از اعطای آن.3V15.4.33باید از قفل‌ها (Locks) به طور یکنواخت استفاده شود تا از گیر کردن (Threads) جلوگیری شود، چه با انتظار برای یکدیگر و چه با تلاش بی‌پایان، و همچنین منطق قفل‌گذاری باید در همان کدی باقی بماند که مسئول مدیریت منبع است؛ این کار تضمین می‌کند که قفل‌ها نمی‌توانند به‌صورت ناخواسته یا خرابکارانه توسط کلاس‌ها یا کدهای بیرونی تغییر داده شوند.3V15.4.44تأیید کنید که سیاست‌های تخصیص resource از thread starvation جلوگیری می‌کنند، با اطمینان از دسترسی عادلانه به منابع، مانند استفاده از thread pools و اجازه دادن به threads با اولویت پایین‌تر تا در بازه زمانی منطقی پیشرفت کنند.3V1616SecuritySecurity Logging and Error HandlingV16.11Security Logging DocumentationV16.1.11فهرستی باید وجود داشته باشد که در آن ثبت وقایع (Logging) انجام‌شده در هر لایه از stack فناوری برنامه، رویدادهای ثبت‌شده، فرمت‌های لاگ، محل ذخیره‌سازی، نحوه استفاده، نحوه کنترل دسترسی به آن‌ها و مدت زمان نگهداری لاگ‌ها مستند شده است.2V16.22General LoggingV16.2.11هر ورودی لاگ باید شامل متادیتای لازم (مانند زمان، مکان، چه کسی و چه چیزی) باشد تا امکان بررسی دقیق خط زمانی هنگام وقوع یک رویداد فراهم شود.2V16.2.22منابع زمانی برای تمام مؤلفه‌های لاگ با هم همگام‌سازی شده‌اند و مهر زمان (timestamp)‌ در متادیتای رویدادهای امنیتی از UTC استفاده ‌کند یا شامل یک اختلاف‌زمان (time zone offset) صریح باشد. استفاده از UTC توصیه می‌شود تا یکپارچگی در سراسر سیستم‌های توزیع‌شده تضمین شود و از بروز سردرگمی در زمان تغییر ساعت تابستانی جلوگیری گردد.2V16.2.33برنامه تنها لاگ‌ها را در فایل‌ها و سرویس‌هایی ذخیره یا ارسال می‌کند که در فهرست مستند لاگ‌ها ثبت شده‌اند.2V16.2.44لاگ‌ها باید توسط پردازشگر لاگی که در حال استفاده است خوانده و همبسته شوند، و ترجیحاً با استفاده از یک فرمت لاگ مشترک این کار انجام گیرد.2V16.2.55هنگام لاگ‌گیری از داده‌های حساس، برنامه باید لاگ گیری را بر اساس سطح حفاظت داده اعمال کند. برای مثال، ممکن است لاگ‌کردن برخی داده‌ها مانند اطلاعات ورود یا جزئیات پرداخت مجاز نباشد. داده‌های دیگر، مانند session token، تنها در صورتی باید لاگ شوند که به‌صورت hash یا masked، چه به‌طور کامل یا جزئی، ثبت شوند.2V16.33Security EventsV16.3.11تمام عملیات احراز هویت باید لاگ‌گیری ‌شوند، از جمله تلاش‌های موفق و ناموفق. همچنین باید متادیتای اضافی، مانند نوع احراز هویت یا عوامل استفاده‌شده، جمع‌آوری شود.2V16.3.22تلاش‌های ناموفق برای مجوزدهی (authorization) باید لاگ‌گیری ‌شوند. برای برنامه‌های L3، این باید شامل لاگ‌گیری تمام تصمیمات مجوزدهی باشد، از جمله ثبت زمانی که داده‌های حساس دسترسی پیدا می‌کنند، بدون آنکه خود داده‌های حساس ثبت شوند.2V16.3.33برنامه باید رویدادهای امنیتی تعریف‌شده در مستندات (ابتدای بخش) را لاگ‌ نماید و همچنین تلاش‌ها برای دور زدن کنترل‌های امنیتی، مانند اعتبارسنجی ورودی، منطق کسب‌وکار و ضد‌خودکارسازی، را نیز ثبت ‌کند.2V16.3.44برنامه باید خطاهای غیرمنتظره و شکست‌های کنترل‌های امنیتی، مانند شکست‌های TLS در بک اند را لاگ ‌کند.2V16.44Log ProtectionV16.4.11تمام مؤلفه‌های لاگ‌گیری باید داده‌ها را به‌طور مناسب رمزگذاری ‌کنند تا از حملات log injection جلوگیری شود.2V16.4.22لاگ‌ها باید در برابر دسترسی غیرمجاز محافظت شده و امکان تغییر آن‌ها وجود نداشته باشد.2V16.4.33لاگ‌ها به‌صورت امن باید به یک سیستم منطقی جداگانه برای تحلیل، تشخیص، هشدار و ارجاع منتقل شوند. هدف این است که در صورت نفوذ به برنامه، لاگ‌ها به خطر نیفتند.2V16.55Error HandlingV16.5.11هنگام بروز خطاهای غیرمنتظره یا حساس به امنیت، پیامی عمومی به کاربر باید بازگردانده ‌شود، به‌گونه‌ای که هیچ‌گونه اطلاعات حساس داخلی سیستم مانند stack trace، کوئری‌ها، کلیدها و توکن‌های محرمانه افشا نشود.2V16.5.22برنامه باید هنگام بروز خطا در دسترسی به منابع خارجی همچنان به‌صورت امن عمل نماید، برای مثال با استفاده از الگوهایی مانند circuit breaker یا کاهش تدریجی عملکرد (graceful degradation).2V16.5.33برنامه باید به‌صورت امن و کنترل‌شده دچار خطا ‌شود، حتی هنگام وقوع استثنا، و از شرایط fail-open جلوگیری نماید؛ برای مثال، از پردازش تراکنش در صورت بروز خطا در منطق اعتبارسنجی جلوگیری شود.2V16.5.44یک « last resort» باید تعریف شده باشد که تمامی unhandled exception را مدیریت کند. این کار هم برای جلوگیری از از دست رفتن جزئیات خطا که باید در فایل‌های لاگ ثبت شوند و هم برای اطمینان از این است که خطا باعث از کار افتادن کل فرآیند برنامه و در نتیجه از دست رفتن دسترسی نشود، ضروری است.3V1717WebRTCWebRTCV17.11TURN ServerV17.1.11سرویس Traversal Using Relays around NAT (TURN) باید تنها به آدرس‌های IP دسترسی دهد که برای اهداف ویژه رزرو نشده‌اند (مثلاً شبکه‌های داخلی، broadcast، loopback). توجه داشته باشید که این مورد هم برای آدرس‌های IPv4 و هم برای IPv6 صدق می‌کند.2V17.1.22سرویس Traversal Using Relays around NAT (TURN)، نباید به resource exhaustion آسیب‌پذیر باشد، حتی زمانی که کاربران قانونی تلاش کنند تعداد زیادی پورت روی سرور TURN باز کنند.3V17.22MediaV17.2.11کلید مربوط به گواهی Datagram Transport Layer Security (DTLS) بر اساس سیاست مستند مدیریت کلیدهای رمزنگاری مدیریت و محافظت می‌شود.2V17.2.22سرور Media طوری پیکربندی شده باشد که از مجموعه‌های رمزنگاری تاییدشده Datagram Transport Layer Security (DTLS) استفاده کند و از یک پروفایل محافظتی امن برای گسترش DTLS به منظور ایجاد کلیدها برای پروتکل Secure Real-time Transport Protocol (DTLS-SRTP) پشتیبانی نماید.2V17.2.33احراز هویت Secure Real-time Transport Protocol (SRTP) در سرور Media بررسی ‌شود تا از حملات تزریق Real-time Transport Protocol (RTP) جلوگیری شده و این حملات باعث بروز شرایط Denial of Service یا وارد شدن محتوای صوتی یا تصویری ناخواسته به جریان‌های رسانه‌ای نشوند.2V17.2.44سرور Media باید قادر باشد پردازش ترافیک رسانه‌ای ورودی را حتی هنگام مواجهه با بسته‌های Secure Real-time Transport Protocol (SRTP) ناقص یا خراب ادامه دهد.2V17.2.55سرور Media باید قادر باشد پردازش ترافیک رسانه‌ای ورودی را حتی در هنگام دریافت سیلی(flood) از بسته‌های Secure Real-time Transport Protocol (SRTP) از کاربران قانونی ادامه دهد.3V17.2.66سرور Media نسبت به آسیب‌پذیری "ClientHello Race Condition " در Datagram Transport Layer Security (DTLS) نباید آسیب‌پذیر نباشد، این کار می‌تواند با بررسی اینکه آیا سرور رسانه به‌صورت عمومی به عنوان آسیب‌پذیر شناخته شده است یا با انجام آزمون Race Condition انجام شود.3V17.2.77مکانیزم‌های ضبط صدا یا تصویر مرتبط با سرور رسانه در هنگام طوفان بسته‌ای (Flood) از پروتکل انتقال بلادرنگ امن (SRTP) توسط کاربران مجاز، باید قادر به ادامه پردازش ترافیک رسانه ورودی است.3V17.2.88گواهی‌نامه امنیت لایه انتقال دیتاگرام (DTLS) باید با ویژگی اثر انگشت (Fingerprint) پروتکل توصیف نشست (SDP) بررسی می‌شود و در صورت شکست در بررسی، جریان رسانه قطع می‌شود تا اصالت جریان رسانه تضمین گردد.3V17.33SignalingV17.3.11سرور سیگنالینگ باید قادر باشد حتی در جریان flood attack، پیام‌های سیگنالینگ ورودی مشروع را پردازش کند. این باید با اعمال محدودیت نرخ (rate limiting) در سطح سیگنالینگ محقق شود.2V17.3.22سرور سیگنالینگ باید قادر باشد پیام‌های سیگنالینگ مشروع را حتی در مواجهه با پیام‌های سیگنالینگ ناقص یا مخرب که می‌توانند باعث ایجاد شرایط عدم دسترسی (Denial of Service) شوند، پردازش کند. این می‌تواند شامل اعمال اعتبارسنجی ورودی، مدیریت ایمن سرریز عدد صحیح (integer overflow)، جلوگیری از سرریز بافر (buffer overflow) و استفاده از دیگر تکنیک‌های مقاوم مدیریت خطا باشد.2 From 7d955eeb895310402976780c8f27114727795f4a Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Sun, 19 Jul 2026 09:07:06 +0300 Subject: [PATCH 90/93] Undo this change which will be handled later --- 5.0/languages.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/5.0/languages.txt b/5.0/languages.txt index cf2c2075df..3a56623ab5 100644 --- a/5.0/languages.txt +++ b/5.0/languages.txt @@ -1 +1 @@ -en tr ru fr ko fa +en tr ru fr ko From d78559c8094ee5d75dad413a9f23aec3f0046e8b Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Sun, 19 Jul 2026 09:07:34 +0300 Subject: [PATCH 91/93] Update languages.txt --- 5.0/languages.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/5.0/languages.txt b/5.0/languages.txt index 3a56623ab5..2be814d4a1 100644 --- a/5.0/languages.txt +++ b/5.0/languages.txt @@ -1 +1 @@ -en tr ru fr ko +en tr ru fr ko From 8847dbe0e715f28f0257e8544336b619282f804a Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Sun, 19 Jul 2026 09:07:49 +0300 Subject: [PATCH 92/93] Update languages.txt --- 5.0/languages.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/5.0/languages.txt b/5.0/languages.txt index 2be814d4a1..3a56623ab5 100644 --- a/5.0/languages.txt +++ b/5.0/languages.txt @@ -1 +1 @@ -en tr ru fr ko +en tr ru fr ko From 63e2325bc54f8b0088386d586a863c1db64ab5cb Mon Sep 17 00:00:00 2001 From: tghosth Date: Sun, 19 Jul 2026 09:09:32 +0300 Subject: [PATCH 93/93] Restore languages list formatting --- 5.0/languages.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/5.0/languages.txt b/5.0/languages.txt index 3a56623ab5..9e3a1dd9d1 100644 --- a/5.0/languages.txt +++ b/5.0/languages.txt @@ -1 +1 @@ -en tr ru fr ko +en tr ru fr ko \ No newline at end of file

1i*8UCDGazJ74{klo68EL?u5&GmH7#3qPWM_73r`?--^d}Qbu-SS`q|zkY%d%TeWQVWFO!vO=0FL& z%&dt>hOgZ?E~aNrtMdKc?Bd-`LH)NCgXMo(G1!>@W5sCJ8vpkTi_mjQ@dUJZ(gP3( z3wQv~j`40M0ITT~0mpm%Jh(A-q1sx6yNM2tSwDWD`n;?r^0MC=#FO^&|1TLzMB)C6rZw(F)q<9a;8@GCJ1jQ7nv%SAwZ>RgIG8B`yy+7<93}rq0&!dK4zGAw?#5!dQ&YXe26|SC)8wgQ(A2wP zDOVorH_g2O<|c*F(o$RMFi#!X@#$72J^oSqo_sG~5lrIAG?a!O2{w=BYyBmHSxDP# zPCimyNSVzf`ZAg-&e6WR4zs%!jPH=YbuA7^>OwDPR<@YN0g)>RO1=1T_y8hcm)N8%EN$Z@Li0GCo6+_1UH9&5gJ)+& zUJ4-6`qJK1z=doy-`xTiSI@(|1WUOi=4E|%r+E3VX=3J;$@^?~>5uK}z3QVNxRUJs z9g6hku=HcO+HX(stb=3uxwUn;0TLEDx+v3v_>0arGMMHl``1h}D{h ze69+*QuzXrbOpOcj&(8Y7lNidtnZ|%7tc*5pUy@Px-<4Jk)zRWTuzc9nofXkhBjR`?+`4OqL%Dg~t|)8NR`b-lEl{gJfz^^FM*_JR27dUYmP!9{qjPm8an~MT0h-alH<8)S4zmfTx}b#~UU$aM z;{|WyM!11fx>^}sJi7v28;k~DugVDz{j3D{A(UN0(K6typdWntI&36>y}4Bf#=GL1LlZb^8o!`<%hh5hxz|x=NX)9)X2Uh<$=J`n zYfLR?UGtjBmNlAeFzrj7>4|FeoH+_v5(0r^K1TB# zAhkm83cIbw|Hb+DP0$#wk2*~-bIKdgr$s1l<<#N76H8502u?}_2G2O}{4z~i+L8?& zXqrO#EHx}hk+&2p8?K+S25*e@Z(YiD0mAlaXAi+DC0&GlxwL5A9alLu^Tp0cvaMR7 z!`VQr|2@@@E6bZO_<%Y+;Rs|!{QoU&ywQ+rMT@1ptED^(KM0%qkFVfiCH*G(A zS{o1mjuA^8RcGg$2@2)wL1QOL z7gF{~kl4@eo~gt5Ckvf)pBLy+eN;hBdfX6$6^yXJNI<4xDBD)LEmN+L6_g3s_#5g1 zZ4y$UfwCq!H5~dd_V|axMOd%`9}h`>T46K?cifUpDUFQ*V96PUna=o5e|o`OM$wlCj|IOsGRL1CeAQf)hyGh9K*>oX;#f~P6My@-6avX zJ*pwNSFBct`o~!g!m7xHeilI;*>CGS%0>yDMh5>X`9YFdx+L4QROs&H<2wdZOzt!A zvODn&o2W%JJhQ)Uw5f2owSp*ap81k;jOsr3>1IY=6Hh&)p(=~IQrdc@kJ!<~9KD4* zm$exe=DN)_{>mA&#Q%uMeed$r^Xfe~it|h7zIg(Bod2@nfMivckArOCW(I`19NG`g zutr1f`S6k+)X?1hCEDl1qaihcfV@NK7+_y+T~oN9sf|kXa(jpsQg>`yp$w}j-UV(pk|+zXA|S{&z5%~!bC_qAI~!j+ zizLLSd1QK}vJ!vVYz@a|@Bo$gFu{V_CR8o~S(F0!NwOK+RZIP@mX+d1A&svK8dLX? z9g@LszxHhsu^Sp`eVvur_Fs5e9vOY5C_foMQ}Hc%EJZp5tC!JN~EtQ$w0`D@~B6Y>`HM~qbVVH%== z)6eiLlx|N6-*Z9qHPc-ZTx~gsT~B=9*M?84%{a|1!su{Srp5z@9ZJ7?TaLnQ>BjdY z)MR{(>|7PAftQRk2VtKsMG!XI)!!AX zXk4s*15FjKa5Nd5Q&T;6ZRXqcyJB(bCoa6%-`q;CUzzj1jViVzA&fBn4U!SoXZ8Hs zqA%RrSW!_)Ee1zRfpa5Z-L1{7+O%lV1X`AYC&|SqD_nyYl3&l9HXN0R7bP&$RCiim z`+um2uZA?>GHT`xH)`{~r&Vg{pe4yx;3v?Jo;4FC`Q+KjYth#6-mEY8D;LrWfw7`! z9f2mh+h)1VO*Ql9Pk6G$#AUKjlgMj{eCdL|4W#Tudd8Ai1T(NmOhz_jrZA6eH@j0V z3f>OC*wDvZcJ%jo_<(RW8Q++l1odNZN~b<=soVYi=2XUw?kz@8z1{YC5fECgiWLcM zx}lOzLNEyJcxj5|*q(qfUpgNiR>4tmJ2iH-x5wf>*z!)07t4LVQ6E*DjTw}CAhsfw zcY?h2*46?T4Bal)9yDg`EL?j&kAA?|_WS-P#AW+mAuij0zoPvIaR*uvyG|%SL8|t; ze+9zy7b$XEX(G-pVMdvG}cPJX0pBxS_6Om7)2wm;~;$XA_yVEcs=Lh9iXBLd5%Er5!8V0FbS^~!v3!d- zGX;1|L4~D@wcCgK#ZrePY8SC%c zX@<6$;X$b${H7C#83CZIHv$_zaI0=}$}YY#c7+M%DU~c<`{d&^OscASz`#yX9*#Cy zK*3l!IonsTf>tYbW7};$!;|@iO8?f!kxIqOgeY&3W)SuL)J$9NjsC;e`gd1V-Xu`C z_0>-l>!B_pIBtT+E4)+zZV)s zE!Bxxf|4#b3yYF`t|kPsHLoccbZQ1C084&Y2s*S}65S;Gu8D~R`usf+H;UfQZ)y-mwI@2AUZpjbM^h5D;?^{#BDy(|bt-tjs+QbH z@9mU$kTj+bbkC$p74nDVk6B}Xq3~E1n23N+P+B&~knRY4h_2e7S88JRjq`wn;Q!_i~YlL zA3>*9W6l7-;%RC6c93b|uRBvFPMu!y)TA}_(b%T}C}HW?KugEKrb>Q+f0CtC-Q?f< zTj(X0Tfr`VXaP?rO~Q~YbOeCx#tm$!EMOboYTbN34%g}k!#E5SC{@9DKcObsuG(rq zDI1hVN&ki4Ur69RFnu6BU}=dU6FrE1HBFEQs_H!IqIvn)<4_L+2fakOib*BidMbL- zZVi1MELxqkn%`i+6Z@}GMqzO_D!-8?_=0ch%4QTCptt?piKUnL7tl!_em#Zf7HiRP z1M^n0Q(u|$p-E(xL4V*XxAC$bWmM9s^Nx4qI$?wof!pC5aItg^jt)yt^U~F0YKBg0 zEgMhbBLr;c8yN7)GWbx*;A)T%*L**AJ0a zSt1(eUUTlNFXX0TYL8J`rOT#X4Ax3O|4Rt;|+HsYfh#Npv;rF`#|vzTHLQs&o*um&+v8LEex$qxfV zTOE0zn^EbqtHi+5XM0O&Ct^gU=D~SuBL4y6aY?A}z$4Y7~jm|Fa zFgzQD-Iun{CT(AGKX>dAhsrO`L=ENJI)%fqC9p8^yGpjSe!v5`$2my2=6MTBZzEzD zyqt&}Wtz?D1U>jT&I=Wu(~##SX@$o#lI@t*;Uxx+$5!a6!?F<>|MqK<9D-?)#GP|B zF4ZyDi1trTyRp<3P=idTVnzx2Jl$yv9HQL7*55P%J7Frfl(=kjF+pGCCdyfj{u1=H zzS3zU^v`7(xIpo|x&3WN%dDydX5M?tEE{<7j%F=Cqv21bGj_C3H(gGZFA5e$rYw<+ ziCKh2l~Is9NHOB?=o5T!5J2E{oG>h1$7ayOfFB|C#JJJMN;ScPc|%4h4><-88F^o8 zf~y?&H_BR*x9>T>r&S9uC4j9Y);kwL&t3HjSC@CWHuJ`@2P7zRPIh#)>x=1mZ7l6t zwS8}D{<~b47Pe6dy1XvDb&m<+W_O`Lv8R^{uAjTRl0SxjQ2Q$jQA~KzA6f9N8E+(_ zuT~jNyWD6fHk%SG|EpVnxBEvY9G^KP_q9d82cb`_$_z3Awpz!Ai#ZIP)Uv`db0h9M z>sktCD@}EWmMhgC#L$7I2GF4C2SbN{yj-3}B90_l00CMaw8}gv1Iojcnl%vv zii5hx-mR=}9htf|o}~B1((;h?5s()OPw#GGGSVzx1of)^51gWRI1dnxJ}ilJ)zcOB`ib1L5wtf2?}D0BXdaA>TElG751tN zKpEwhz>&4g)X+h9OMoj(G{<>Xx{yN>FCCR1z*!C5z03t7Y!SK@x*e$BzZ@fV`Boak zjfasxcW}l;#x?!UV4Y&i0b!qpjd(9rAd~b2m1_bE36QiaAr@TPb}&N9ZRR3}a+1xK~>uQ{$fprU-n{G#^NE-j@~@ z>Z~hugwVK`o-ZLPe9U1^(kP0hn*T)Q^{d28|DHw-^?#kqI6$BJl#8IMBxvLv^vpYx zEqU@Gsm9wxGugqWxZ}B}o+NiDt8A~6Hb%SUNQirN4{%xslfwVVG5tZ9PwYbOL^~7_ ztaf_}D)*Pi7w2<3o6X@%tTXa#8h#xCQ4De$%E zI=#5Y!4h6q@tFJK!s7XmK7}2QqccRs5Lr>+jAZ)%w z&~)~s(@g3G;NGP=zap9SV(+n)@k$X@9e#MTW9&sa6k_t@2@oF{OSV>?g0mI2{fP}m zd#*Qh$C1xbnQ!!ZN6^&unoyy0%>qMq`1Wv9y=aqUN#Te9=>LHZ09{tRa+!Q6uZden zZ(Qk0h;QoKK23N1NzH6VUUH0ghf4lr04GI+Fj^u$^^YR~j`pMH&(zxQfFFc%`O`ob ziD-?qpgUt^Vmz|2T&C_hP)E3bHU=)(eu0=PnTB zy&hp$ELvnPMvHVmxUYyLEzb1y%VJqvf)6LJHtdD-YhNt`V`qj)kFU@Eq9VJ#SOuch(|>f2bgp#Q-2F*qHNJEF|HJE2jz~iudbc!RbJzkQ*S$Oy^N8X z_Hk|UU#2dFzxi05Z=aU5 zIO7~4@11A^9+mv*StBwewRB(83)?T;Y5Cnf3HTa&S;Yg{4Y;KH$r1o=udgjp<03hgL`#;V}W)_Vyc(rKE`_97W@U*_Evi0^~99rzE@6*x_P(n_^loC82 zd~nJ~*oe?I@ehWyWUm{plpT)(_!npLzij@kyoSI%-3o@ZJ5}11QZR45c;sR-=>sg{ zZxr!4njB5HD6Y)83`i%VwMy0O`C)pcDq|j`QOFqglH$n5LO>Q`a z*=9{SM*pI63(mCh0t5jA;|j~B@oE$d5_ZUT2Zs6fvgPEYGJ_uu4+o=%S08hp-A=3h z-MSiK=JOoC^{>{S=-&3V4fegB?Q`}0W2fdxeRrQTkr5Ta`WBD2(EZ~LNlsno`u%+~ zu|wOFC9wAW^AIyZ+w&g5EXlm2?Olo8?i2yIzCZYmanTSkjXC&vdp|C>DzNJ+ex}W+ z2&yU4{8#L^K~veNXr1p}*haBax~r|{etEt<(XaXY%hfM+ocRwrB;DFKng(v!m&h>@A7U+uiT%{doJwcDhfl~11M)^Gt=G$VM?x^9g@9E<3lQ-*^@RzBja`#i)CTkN z+xIe_NGwv%r#bVr7mZ}3xN0T-@Ue!~5A48H3m9wTPfQax{QFLA2JRWVksySmv|X`P z*V_rFu=BRRn&xC{LT!MmC=3*^3dZBb6ZK&9^0Q~Pfu!4LCBo>z&qW3+AE8Vt_JnRY z5B@Ww6(7cNH_09UA5(@Y!{R)0dqbjc--KO{+uCIYSUt4)**x@h%6K|oV>aTf3dzbW z`zYz7Eb)iF7#kV0n4^OGE9c+p+cs8ojX!)7oU=)$pLT+0V=(fqxQ;0N(dC1|=M#5Dao>3!(41QKSme zw$5sxOS_gMMA*s@59z3={hsDZ!TmmNy>e{z?%`P`3mU&sY$ERZdTBVoc3LB83sZ?+s0X8?);53O&973mqlzkm0@lUPx9{DD zjMs+4YO;&koWpkRzri{P$MR?g1JM1K0IT3`$OdLRyCoZRiNIf~ZmR=?h;q#jLZ_?O z>ol%|KGk4`b)y2W+dcp zzBZOScM1FGc%I@<7(;(STCOaf?fPh0M2C2^CI~AghkwyRO8a8`*043uHsfk=?^gZx zL_lZac%*mI0MdY;66Gb-RKS6W=*%#^0O{Nso&#A0aZ7X|VDza?qM)^{c4~g(x;D9t zeR6^vj-a*anO)>D521qv_cIpKQ0&;_%$AlAe?h!y_7x_@x1GVLsA5Z|)S!4^vi<88 zUx|x&o)TUH2jw^B%#W^d|A8sq69oDQ2`3W6(d zC_+Xs&C&_OL9C{HsTsh+@j>Xv&06Rb$LT$`hNR~&ZDDtH851AF|qC7<#iUC32fh1sD`bZ#|? z6#UH5-Fc&Kw|69=>WlD{=BR>F<_!ncbw?or@}iAmbcCunO~|`dFZF+~MaYZ0n47E4 zh`O}dBaOVnR*gdfF_zo!;)Xn^RHegpFz0yK@2AVcr39Ipa#Re9j6k2s$_j{RYD%X5 zvo3qT1oL5%qjN>6660)N#N92!1WxC(0Yrth#V_>J7OiEvjawshA3jQpA#*Yr?;c!Y z`wVu^5F2qPH)26HAFTu~vY1uR&GCZ82tSP^3@ar+m&e*m1ngO|KscXiA}ljV5Wfa5 znfb}yCKUr#@+sixE(D%mD(`4JYeT9BeO?@p;9e~_V*3>-&Uwx>826Q!0{mC_&yr&6 zgqpE3Dx+_Rw2QQsk7Or_Iy_OXlT_qWH3Bo;@2raa(MNaPWgDFG!RFFLMSKhZ=QGP2GL&1^kA5o$w(hM0%Q*Nn~ytcML5bcxd#!t1!A=P$pu0 zcohYPvb=S|jxNCQJi|`kndQVUzcF~{QNb;coe8&7GNHiW&N*}fjd*a(awWAUrK8_(sG`eZq-=(k<&;*0{VJ6J^E+i|4WHrl z#8yLTSu*ByEC--llNFA!t4^LOu2J|UZ}7`BhEPfe>+@xDNRxv8_e;Wxc(9UtxyA+9 z{Q}lR5)elI&`U}F>2#Ni(z+U0hW3(1k_z# zE!c|Y;i-Fki~zz^y*&mLl?lhFQ#-}RdI}$;1F~?tBU2r8X!Q!5_?+UF!xNSA0@dDA zH_m=|QMS+VYznQRQ?6pSIN^3g(A3JW2Y!ItST1gF}V;E$xPzBydIS*SH4>=|8y2-Gqtdvxvn) zh}ixT6HYJ5D&H}Q@&>UY{VMmOxe-`_&f6ix>K|TbsrRRHDt~eqph3viN5gLpdD)50 zCy@q{DZ>hCZ0IHD(|PdWL8S#r!t=9@aTGKKs7k^{z`sQOl}Mm-Qf!Q8Go+BHSF0^F z6FxsIhoCg-;rEy%EQceRr;^S!U*skRM^6LZ>~fHI5EhkN4p$rQ%CUSRD@??~t;4)i zvH&x&huU6lKMJ%zfV$A)HXUAr@(c|1NX~LP*cml(5%lZ5u$ea^QnDd!_M(429)9f_ zPQ$4Xh{RKIpC3i(M zyDkZ}V7O#>yY1&zX`6aNxrkYj$>};I|B8)tlk7~mn;l}ks?BrnDcRpBQTa;jmZD(* zMCGMu`zijiPuHiXt`yH(qy_6m?VFaPfAjM*gS=JpusU zancr1B{78(X;{ zT`AhDZMCF>0^Xo(a6Ut10R%|buJi432r~(%Kf0mzXgvEzp}Y{KIns7w96)HeU4TEvHhhu zUb?{=8GQd4fjQQk5S#N&^A0({nSsFplZIG^E-zm(piqKt>6GFEXrNf87WLgFQD!Ha3`1vph2f3%wS{hC~Xp0o>_Mp#}CV3(7{ z>prWmojZ5E$Nb#mQKPyO=COzGt*Xw*-b}B67Q$JbpzB4&s6yZY%YC#@*cBifddm5$Ql4=)v zfW3BZg!kRj4TWRsi=?K1#|zmn&GAGaIS6y>4yW^27*)8CV%j68MN31!rw5+3nXo3`-QpXLc2K#=J; zaP;?W1J;UiE1QgA3Q~(bp(bXC1jJqGQI$Abs{-z8Lo5<56T?hJwSn}j!L*}eQ3Ab<+LuaAFNz)%djBI&7g+_|L zA|`hSa3uzqojt~5&yV5EN~x#bi<4Aaqn`!I+7L)?Zu}VL>Jr{X@a1(Q`}`R3PZ3YT zVS+DMlnRv)KWkQuy&NiHGVidW&=J=wsxb)g&tBq;GTtpx$O7-mX(WNK>P7x6oyujg z3eJFw^j3{@wv|$J_zN}&>u^1hJaPPBw{i%r9w;$ia8*x7SDU}-DBwPSKOLD@F z!`j9zXdw{3>QB^gn{Gh;+#}%USU{?$`qylEcI))UemQjSF)-dALrx=7Yowvmd~eA zk`xmj@)g489&!aza1YNI0D)zq8eVfBk_HV2%H)?QpV6W7dklz2&Ymi(uI=9sT)XY-L!t zR5gdK2?H86x<7BYRMsT(!@ZX9kKq%y$p6Fe?cZ}4-^)Bd-tXTxX8($!3qR7hEHvAP z3ffX1UnAs&jf4AdFFw*gY+v4N6VD$rywW{i|1R8W|G97<%$c-U*NtWU%W%J$NkUv5 zymHpyRbgFc6q~@!mYM#IA0X{b~ z?wpI5K`K>VGe%0832!JMkC?tix@M8zC;QHv1dK35JABhbZi@P)9w(M1`;kAdYLs)* zV!R>oAuSFkwvIpkw2|&uU-_)?bbG0PT=iM;J@B=I8p5mQ_xgw+;`gC{-s z|3Tf14tDYbbL+jmUSvvUMNIoUGo!%Q!vC?17{8K%C*`j z-l{-kR4qtFZXMR0)d;vMq}-ZYLviorF)@^zhldi7fj_;eHQS=VEYT62@9X;N!G81S z_P(@6(uI$M!6Qbz3<{PUW3X2f6jBSdmV#(qj9yJEZ~aXJ`FA23c|U9OG_|ZmCzWeJ zNQU}ZVNV#R)BlIkF|UqbrByH1;`_##WD)%Kw`mlt`hiyy&O43A{7txyJjT3F6~L7i zpey;IilqN(B|d4F<;gvOC^zC{wHkjD_xoF_1e6WfBBTVLCmx45N}7vv2x%#Ec}Ao^n+Qj|J~Y-oN~&vi zyVkLrW??~uB{$i{BvmK|{|rIC`TV{XhZj{IrJ#O5t?GqLIs5H4;aMWO5&jnz1mk08 ztsN{`>*X($;!^)+ui{=54X>aswWgZ5|+_v{XvDe4f zL;X~u7WF_V!Qu%zja!NSa9KYtJA8$5(^0&BAVoU-bY;_{%{7(?uE7Yqrgl1_KlGEL ztlZPt5*r{_SdC@AJ=*E~S^5kC?v&{qSq?5!sD)QxqR%h-OvRgK>w=sljS38Ucxi}%b$Bv^gXzk^+q2SCVrt^1R|Ic$T#aMJjhu3a~@X68Tjdt4s2?xlxf$?d}p zWH&A*Cy2G2XQ2@OntsCuAILmogRYMwl=0iCT#t+|f6F)Fg zid$HqM(@)?)7IlS7rvMP&p{;&WQ}TAm$H)w?4~hHV3kh!8>#J6Trq#E3JDokQi|S; zwLGugQriYPkDfz9|I|PQ)1HQgsA0PgA@j2a>Xmca#2CVu!l?Bn3De@5<7A(uu+J_# z8-9zsInmHAg>8n$2#}bJPEwc{uaa@kOdl>UIq&O-3q?HdW#^alkLlr$EW{~60WX2K z@`v9cnl#QGXmj*ta9>o_yO?*RdEs0*8pq6RpynZP1AkyTKClm8fBjo8>J|`tmThWSwxylyxg{T^wG_SdM@gDCCGA+4#!SA`h)vKr4)m{rk)fzoW)RG5p zhd{EAS@>YDXMUa*)RHg~Efk{@rCUW?F(9R_0@rE0@&9B7!{d{T;Hsy!hH4sh{dM7h zC}W!rZXoD>SXHwSb-YjF&_QP8mn;Ym)rL05H5&qQYVAD5{};^esYwt$YxP%_hd?hd zDN#<%j0hM38VIKU;+M%UNSM&r?%!hU)N4Xc558DHOyyCYBXcCz$Y_kA)y?_L;7nH1 ziDK;+Qvs{z%Ha^11o=Z7)t$OK5YgS`WYby;G8%Yl7z~^E4Fxc|v2k}@Nn;~|dE~QZ z1S9<@Q)xf}(wmo~bBNNf=p+EnBbe|(A)3oB|A32j@Q8pD=)O?%NYD8=ZVZ$qvX#>J zgH_O(JM`2r`&lzlDdpkGhbQz&>&GS;!e;PYNNR+})R;0*l;V)HU4(w~e7 z`i3hstQ+Xcoc0RKAxYF}5y49JA{W!#(|@6o%!d|WK?4ebFUc&Kpkyx=a25vegvq`% zQoC5p{J-RtJR9Q%q>e1l;`1+3W9G+vm}O~Tibeh{^@-P&kDNuLzri5(!2(K!EBC42 z>9{wBKQHoHjW1jg!o+&7IEwdDi2{MShlo8AX)JzRge3Fr^K40KTJow#mwO8d-4~Nk ztjHpD8+)<-3eGHC1%f{)!;D3*`4NR{BBw_d9%Moi74DTfE5Ot0?^L<;JXN?7%Z0W? zck!!tIa^;oSVB!7WfSB2Z=6~3ih|=TcEO8u-cv$*SRUN3szx{y(YX;MS?2y*8?n3b z{yS`y4!&a&V*A8$5b*;i}kts zzB>Pr7}>X6b?!KPqh-n}7rav#(uHHdgP zxlJejiL9JAV`MkxJwoxwOf_d#tp|69u6^nT++R#R$i0B|0gj%E01eYLnr4UM!6Ccu zp16MI*w_QLlJRDKGr#loE1gtgSJVHR>z+KXu3_y!mDechwzN~$CApi@W^37N2X-n1 z3-#atEi5?;-DxG-8w>7*=>AFc-KEf@18MVj7sqd{ky~zv)d?mUXxw3tr`fnU^z2#z zcm`7EXj6Cy7BSYh@F#@8ST5USW7h}k46bDpl1-H@I2iehgx~z|T8`V&>YOdg&mwO< z;_xL+_6$?l#km=RZL1jI{#%M{8G=Shg!+V?SNMo2HO{`vReI!&PqAxlBWs=0w~J#( zT~43!LN^C0wryGuGJncjiQDEyztQ`->WV+%R6*yn;h?d7pprzST z?ksY|3#r=$)r!aK`hS@9>NSq?6{>`31IOi)`iP3KRAO%-In>aDDs-)O8SOm=s8rNz z*{#$$q3o}>vcV)ATt#(}ch=F+ds7nqvDXZbDpv+I2d<=Z!1`$+gvcrI1eL_BQ-`iT zx>gIUp~#eGflbvSc2u) zCG^tEO1wAvlfjTg7jSeC@5x=y9G-jNEf+$;D5w5Og-ME+)Vfl1jg|_?m2FYth%^E$ z5g)&MY6sl7L|4*5?Fjl3~{)d z(r>J5uk~Gj5v+*>y3%$aGpSncnVJ&~%LYY@?yD#)T6Q7aVq2gUj5ZzL@A`qWA3Uxd zI#+atrJc`^DN>5jPZC=OAw+kNvgn{KHxROHt6*R*Fpu}$?pYr1TjI99=cq#Mr0BQj z*QcX<4_y;J*AD#Og8X(r6~zI*?+in~9wRPnty3iPsJDpZsE^LYg9%Qg@ax)H^C!7MXK# zA+TH)ZK1&SRF0DPofyccGf|GI#(>icWwubI_*#(${(y}Dxg~EXan*@6qzP<^mL5j8 zUAs0B0ZKoCI5&SFH3FpYZaI^9u#U5X-c0eASmJL)7%-G{TKrJC#u6(iLPmuq;HA#I z6vw^$Tv;DtoZ;gEFUoM_1|84y-|OQ_cO+*Jony4uF&<6y`t#9gbeM!BK1!%&^{Ot` zPh0H=>VTQr2z#fIeH02jn?`HFjRt+=LXgD_U=cLgmM6|K{XVAN$%Gb5}e(v-!YKNN_5Fv9<0gOSQ(5}jHQA2%SQ zr+^@5JRR#2^PJO{a$vzVYR&UU+NC8*-pL|klw-XKTP{?iZL2N{puf#Q zs#7^%J=two-ma$>HCPaA)J@I9EY?kgC&Ls7#g2V;yh8-6+*-GMF(G+iacJX_YD2hf zA8X)<@4vU3lw?4JV!?`;Qo1!W<$>;wRnj#BecB)PnbYV|jZ_dbYsTyGzmxbmrsn#DF}tU??SB_7y$$VAiOI;;kVe`Q zs0sLHNwNurH*B%PVbGUj6KrViFZQy|2{)b)jZ4!LU;JH{wUAHEFRNS1jWb^(P zWe=TfH~w5dKwrgrEx?gL>$rPQv|(92yzqYg`=ji0`JW*Be-|TXWo7&S{Y6#(V&o6Q z|F>N#fGJab7*IHmvhDKj_4JY*nfJo+93EkZaC}H3FP{>h9B=l*dY|vFk+YJV zEAa~Aib@$?oTPS^2)N_NgYO*pe^yK0ftl89z;e+d@3Jh8T-AT9mOmc{I;05`@=_Fs zWj42~6l$hw-Y@qDKMC4|2(<$Ah0H``cCu>O;wRLJC3|qF6Y`tBvR6lC;EfVhq|G!5 z6jd;jsP8q|iwsjJ3xrtFnX{SCZdak8pLCupx!3+lx z6id&2JsM?CiVE8_5?eM>coJodLd$3OodZAe3kz0Pu>!vGLkaf``c}|3vgexQe#S3$ z1n@X;Dhu#bvUB@hv9Z#H~)V9|+@DfQ2 z5D|B2GC-U`*G%K(nGe07X)@^Eer>({R;g3#Yt9&S#SQZ)+l6kFTQ=$zoEkC}!tY|P+XpfWM+2Jzep4T(Fxur%p%`Ix!IH0;zB+1Yha|CCO zE2;~$aGijd+z@84P2zg{?X4p*@X}PwE;3}nwP`}T|GG=F_?r(n0U$Ur`-CAZ_yU0; zfKF{|r8Jk_nrV2DkCEf8MNM4AqxPg2I*I`ZOg8!dHbrCS|FUR9#EMB`rf6__RB$IW zifp&dLI8u>H_BSK4A(EB4UI8i?r#R7)?Q?dkk!__^?3FmY=itW%<%$lzU9uVTWxs1 zDm^M2mucHg*_9#fA~?2dj@pt=3b<^JOxmatcd|ypHE4K=ZCtEFtbnH)5-H3?QE=S> zxKfv3P{omV?Ae?r$>^VFSW`#^C27YQUV_Mlor#1-IA<<6)3MS*uR{;PgptQ+ud1)@ zyik^un!(^xtI?K$R%fe4R||Ot8R41(WFA+2C^)bM>twy5EKP6nfNVU%rkAoDog^?- zbVRhfTdRxMKXJ#J;pkg-Zd=JH5CM!1B(&?Pe~IWPQV#g=bD9hbIXV7hg2F&KBnjuv z&Oc(^OGqh zV?)+SL^!lT-8F@-CkvUzNqDNFbX`r`L)mLC=N$kH8^ykz_kN20Ak^z7%Gt$B`_$=L z6rkNqxe#e=w4zkVSLy{z=yL56Ha13HIFg9R-oh=ur@7&mM935=uD1%XLANbFeq|Us zX`U4dHxbJxjQ17i8q4G>66dqrjYR2;V!O;W1o_9U4wpHPHhhUlnFW$la|`kfb8#AR zzLw1vfR@kt%3bq8lnsXm314-lZd9gqMFKAhm*-v~dqM<_(w!B8{>$l=c9b+Hi(;0o zLGC)E@G=sWmLY@aWjF?ZH8=m#o(5mWVE?TjcGg!;=A4Op*{Y8HrbxS}R_nyF*qR#d zuw?$yMWIi~%4Lv!=G)+csco^b4yy`L#QO9~WeQ(`Ni2G09u_avKH>yys$jQ#X~$Ce z_p%5U{{_K10yE38Aq}{oNF5O~V$HFKa9^D%>N>RFk1wv5dwZ^19UHGfJ?hwd6E5$m ze|a^a*K@;srw82=8I*h;bJxOBRTC6kBaOI??LfZEL2E5Zw-21HD83KIn{I!6d zgB>BN67`_ma1;2U+CsmNCFsH`9M95gBR0wA4fdPb`7~e2HNdAzYup`=M=>&V_vI3E zmHN46YyV6{CEMD6mXS7J!*GUM%xvqM%l0>YgV3*L7H96*KyU&E|4($z3Pqv=IdO0X zbq;a&OYRr6y%KA02WD{=4|LKk!wM&QE!yUD_@2K7I?u`(L>z2}2lkn#&#-qxgQXG+5nNI+&aMvdc1IEaG z@kmEmASvV{kfc5>n8!Z46cNK?8%|an#ouQste_QmhIH4Q%57ogqlW8#<)Gh0>ny$Y zaX1xPCL*dZ`rQoUrCq6!o7rcq>E1rts}n0YUXQRcu@davB+s=6tB5geCv9j3EpKy{ zW784Fb`R&3M9_Qg&4u7<+N&6&rv7RjdWbMYcnQY2?(^5|uxWQ+khI3Cd zC#?{!Q#rE>wjer^IW9{>)xjmk_TeR)Y%)>?DuN8QESCQf`J;l(GYXAQbvYGI*?^;- zlbu_zm&fLBB|d7*g*}4UGrgP0cSCmp&dC$$w@tMkXjelX19bjS&oNPkB9`^s=n146sWIk9j8zxsk({)Eq$X?AjZ!@z#`@>8m-^0?* z3&wYada|(bE0l>Bgl{#_;1>#rW_yocK(lIFU*OGdE_3^CE?Hl(t%0EbJoP&*5D@3U zziLG(1cd8HT}#lxA(KW~RDXRSJPLK2PTX%~hKf3j<;UNq&t>5w5pFZ}UaDUB&Q0{#hfJ-<Xi9~&}KeV{I~@A zi;4IKQ|uC0!QkH)ng-xGA|g+?s9Ac;s#1o(<{qW2*nFF2C4`=M;sKu;s;(3|s93;h zCoku8HA~b+A@yQ^{R#UkqhG%B?&efSMX^PpdIm0(n38Ya#BDkX*%?vaTA5#ku0R_C zGH0teR|DG4kZJHz;+8HzH=|}!1s1LWB1cM~N5c8Byp<5lV0|_s{v6BFnyc$_ZseKH z^US@;n)nZ%nrvfKC8oeww`ldcPxhOGOh18_J8e3UmFJ5p)<7% zz`!sP`{vA74r|ikByetOe`ofom5}638Cc?zJ(XnBg3x&-toen!kNnzuPiFvBdP@G59Id=AqM-iScWxxF8kr$W8U|jX0tJTBWJG2VX_s zb~A=;kZ5G+!fs0dcAb{toNkqCxp=J#Ji}}UZS7NanqVd%m2TL{!CAYk@sA7hi$}`$ zFE$0h1YWQdmoS&rR|KU+Ce=8|Gz50M=Wvi)EH!?|0NnD1fM9*w^0I@Jw`8o8+2@i; z>MwzRN{ALzfwM2Cd1@_)jLGwuMh4(^Jqw;uc{9byt@T!JjCnTgz!W3Qjd7o;#=nE0 zoHUvjXo)}`yP0Z$?orhAnQ5C=1e1SO5lY)ND=2UCLzmHe!e*((!b2epZwF@$A*(A( zmn+}#HP<~nsbUQG*9#$XH&WQ(3gpg9vVb?P&2|{Oo`9^qln*CHRujcT!LCC5j^AP& zP~Rbdz2EJGuPKW2h^y^BwYe*P40O4hRNtG7XcHs~Kn{ zhS26#Oa4G++${twTmL(`mL%87Jkp}jD3`aHA?@S$8SVJ4LiJ*8+L#^70lKG$ znynXK+5{>N?Qgd?dILwN_Cky5nI0XlNTt!}oFDJEkE0bO%8g$bTIy+2oM6 zPba2}5gF3e(a3vD#n|>r%+XDw*Q%kVl{-zHPmu@1ZR*4Q44!Y-s$z?w6N#LWQLpZr zz|6bG#Xn!O24ei(Aj3(i$=UrqldtJwZlkYe?p^~eSvmYgQBX|4E=Rnuu8Vw2I_Qev zI=WYCxZ+l(GNbw01iqiwVGeI~wxoE6hKI{3?tjud-L?}RN?JE2*(?9JJ-B9Q$CSix zecs5!+z>B(jLLJ`T<(PXw>a-UxyjH7Un=YZ=IovXrQ5{bnzk1^agVEQ+_;1IzK2e2 zHn7W6MfPm}ZlWo1Bwx>vs7fYvNHbNrC1n5E_5Pdu?y)3SJ=J=P5z;MhI}c??2%}ET z-LnaVoKxYfP1EIG{d5pIxzN~R8g?D-6kL(dxWK09OPxJ(P`e7pv|A_BNT;cFFhzp{ltD`G)J)Qe`(!B=-)Ij$#_nvMqqsNyCU$ zNiwU&HVfwen4JQ<9~1$FuV^!m*5zMqn_O+6z83+W-W}k8s~*f|Bg3dryrV0Aab*jN zf??>GX8rhdX~gp&xY<7C!DKh&-_3ZV6>;`?S85i3(S05~U69lnQf20z5k7oqb(}&)r+I(QqnAS)HCAf1Lmb8iz1@zQRl`EH7sUHq0qc9okAnC!(=R^bKsnMbH;6L_%?be= zof%i(3L+eUFW$KVPg}d+AA+X_iaqL;tQzTHK}afjl%~1USx+g=v{Bi#N+ZDan!#Kj zSz_@$kZ7Uwt`Lkwmeik9njzZ~Ff`tUu!F7G$?Q$YV{+aEz{rN!03v@cVFspyi{Lgk znY8+KQ8wl;SwLaCrQZIL(fvL)2%;_@#sO`4S`*}5(`i-hzJ_zN?ICW^N^Jz8y+oDq z;+Y!LIciWl9JdnQLHWD;hRu7FHRtHtyKz~x`IuTJ&f|Gq_>$>XDjG&$dTimrO);LS ztWx?G78Ik1(FHsG-u^h^D&+=Czo|oiEdTRAl4tpx%3&EVLVD#@$!9`Zi|%;6@NbIO zGFyhx!VdSkQ}=oigX6cM$@}9lBlU<3lO&g)x{>aX%cIr z8$|`u7t}O{-~^8X2_fN^^Ec%=ySJJTOx5*}bq9I$LhzV42*&sN?6o4=)W~>vNezb8 zSv37Hj+4%E=Ac+}#$8iOBr@+gP!LtdRQSBO5KNp)GL&(Z9+v~6O>OuzT#f*^#(w_P z{9r?Sh;T%kAVF!r<#umu{IN-4tP8+9$5GYIqj8-g9L6Orv~YOhEKdU^)Z4-~QxEXU z=0`Tb4?Y1Q!azFC!_{ro`@!=d0p{KaVqO<^EIYYLS>&pEL33IKTc`V(;|caNqD*%N zdk`Zxdk}X)JTr{-N?{h9#sUSHO#>v^Q4#BLKpe%WKm-^l@ylRmM52`orw1;ri~HOT zHw;4zcKtl3erI9k)dR(?7l5YEMe|@+XNo2pJoj-|zNTm&tJCMOP9MuoW)?bF_Wec7 zB4#oD6KZ5mcF}bTWc8K{{r+1BUDIXo3S>|;!SsJL3lxR^TKcCo(X3zmiy$z^WF0sl zHW8MK=S8<5BEqz?!(L7+2(E4EC*S}?0&@^!trX<_v=*hNE!G~Jxx7OUu`Uwb)Lm|D+*oVvqfk7Dh!+-L&P&l0rF)8!j%87zzsmxcnogj?jTbK)aV2K2L{uf? zy*9b6P{(P%5t*J!<;6F)=1sZs$C#KwU#>F7AlSdNDK?D_=W$BloLcCVd+^J+DInNr zAUYLv*`Erd#Nj$ZUIvAm=(I)2s#~V?tl2BdQuza?H}6|vw6QylduNK2W?_qM9sxIg zsj8IyD?S$rLn`LHB?3GCA*_`LRQF%w1{?1v!$wc|$Spy1o8fOeeOZ_58aYt7eJZRZINKms6ZI4i3yxq}Ah}gB*rDjgI5xbOyv}Pi4436sk~68`6&|q0V~| z0hiBz&$!nWhWtc5=c)vBR(B6z&ml%VZB0C0$nwceiUJ*(#7 za#h1eangh_1&MIgTnC^9CT!W3Y)nt#snUsH>5dCd0o!V+9c1 z_ZqoouRW_D*t#4-?%+wCC*KTM^+z+47$S)16H$bGxrI2l;Z6sz)K&w+hX`8(B}eNhJ|~DN#ZC!#J8HK@zisb5r^b*7M8=aJ0BlaD%H*e(ZH2s0T z8O?3>k^_Wrm>QG~N%jny=dSo$eKQK()9m#uq!*U_=cCEk4E8S!QtnX-e`0Js4@7V2 zxUPcTma!-^B_`;lc`G{97(DmyQxI=vg@qa_zt~i6fy<*u$=%h9bswrUZv}s~_E_9t z3P|-M_4Wty0x8@yBC}G!2&9l6kLO8!kL|?HJZ2?jH)-B1EsH*$!;t(b$D#Bwt<6)XlFuOm1i}C<&K|x#zG-D-Q2x_s4n~?> z^~PoS(mgn2VlqM#X>Agvh2VDrvdB1vI*CC0sG2BeW9q)b^qdy=H^ zD*ZoDZld9>bk$y}Cnvo_NBAJ<%|jqRQIzCYi&J^DrKk?Oeu0D{7TTd^EY2zvdqlfU zb%vMwa#6f6x)Xc7YKF?17YiRfL2pn`z)Uu~y;N?K9ZA`oRndQAZ$#Og+*B|?0a(K*R{n=Z^uqbdhHDX;uPyTF*7WfI=)XZg! zP<61n7wcrsyjA3+x8GB{UoE+nC&-(_4`L-e2i|^|>VufLn-z*XmN6e(Y8PJg2@!lp zZ6E5zoJIC&z$SXiHk_O&L#}3++o9)>6*odwPInY2kBaRV?5NS*Bw^8_(WIpBHJSIT zv)Kj1D)Xm&4S(FW-kT*Ct0Jvzy@ctWz{bbWws!OB){yA0hq|wfu&AviCAMb*%lP8e zpUp?KoH?=TdLn9jVC^#t%-eRUlPH2UM9i82t%*}tSQ4&7M!g7ZXk`h2aBx(MxdrI> zTJjwx&0Zu8ImXQHGol8htAJ=98*AdPf)rC6Z155MxCCR9P$^q*K_4lr;YY=ArK$J( z23@^l_;R#&DrRje$L-e%D#CW?#GL9I5N59|UXbBy94FYtX8_#NdV73;6Z@@;5Bq2Q z6tiq8Mdl%CGDciMBQKo{4Dl-yxfGxk-j}UO%y3d1CzZ?8$zU4Y+DK~ zr3zfam3E>|p{-PoHFSyqQ1(^o5nUb4XH~lfnb6WvS+j!!(46VY>oHp2-7j?;r9$7w zjg&B@Nv+>Fd%hF1OLWjYYMWR_8~jhkMIOB%+AIk`%^JNv#C9@&#~mUW#5I~HR5 z0!88*cs;m&a~n~gFD-_x`?}^ZrRV2Ql*p zpYx^$?TD3DU-RDdxd>jt43U;&(>8{uw@U8oAGj0Pt#}!@!Rv8m1fZG+es5jI47i6P zFxb>D+|h-BLnw`$d++<3IroZ?tsAt~uT%^ge%zUXprB#04;6HOAsGOc4_Jh0A%0DW0^KK;z2%H#n;px+29B=Tx&Z`SVuqgP z%ytLDkQWP3>XizHVK4dzcW1;SS1o$9WpT?&0liS(4Xq$`T+^9$j98+-K$Hx@)&c%v zo76!(pzWR*F}^Iy9wOl%>VQZFF9EWIPo83^B>xb^F~p{x zWhioc%Uz<4@Il68v;GylwQd747h)j4XQKiAn&E77r5CMz6^qky<6>VielOBGqBQu1 z4n71r8gERq^*erfQlrX&^#Eva3#T@0rt*c!kv?0#%@&v*Jd$@LG~5+G=L`&{AQ3In zb*=I_9n=oVaT9<16j6BbWcPqOW;Fh4c0KM*+EMK))^XAg^YQ|~9f}`FI!Kpc;#l}` zDH0(M9d6j*!74sCaBLKO+{*FY;0pV61aDoJ?eEumxqRnAVwO9{`9F(M(m^)fJiFvOlV$MH_`80|?x-V^Gi1C55Hox5?3 z^EuWAD-q33AVUPV_b;lzQcX154~rPdYTqVSz24ekSXT(pVo9CW;rTMHM%wP_t8caJ zZDB4;RMQfs^CEBS?sM%B6lvb3b~$kzN;wYXz0>`1oc%ObMK)fw32c=D_#?aZgVGpa z0*InPyU!s+;0b87BuG5RQDdG9$xj7hrQp%Qibl!QkFa!)Xb`#>=&d(-5trZ_VH7LA zqg69n)%S1o-8`I#>;6T9b6|dUEB(3le3EeY8=i67Xb)7{)DQV1erFE=G8fVZi`c{~ zrTk3wmFDrzc~X-$F#0i$WKJP~{*xMO=%r{$`n1MQ*)lE}SEKNR3Hy+j7(dT)oEbWOnu>ul0>17_H#n6qcwvk8_My3rf0EYc^pFemLRKxON|5pYF-1d4l zw>S*5?u2=)5`f1^_N{|}DjC?3M(`xoZ9L8@2$R}Uc1ia}bLmI> z{FFZ3v@05{0u)r$j8pb&6N-BNtj*MfnswR20xokkOKeFM8*h1Zu8I^^zLaaxcc#CrI?b1c=0m>7+Iaov2I7^X1B^T1$44E)^9(*izf`2z7P) zszr*rib=H1;x0Lq*I;Y53qknT>w3%?cL!?Yu|#!$uM`!Gu29`nWB}zL;J4aaw?_{_ zL-Q`H?+a_j(3FNVdY#XO5_w8#ng{@!iUSM;)|+K+bKYg!rVI`3?(@VT>C%e0^rq7g zkCo*yl*J(>WX&LWb?1h62@|M9-D%!gs7iqQPA1|L#okzzkDV4L zDTb0&%l!IjU7q?>_wGMhbz2#12HoEKx7d$i*z-YyvD|1yFqlC(C0h6hx8I1%<7RuVZ*Hm=dk0eY`J!Mlx zv8~LUe82FE9;M%*B(X5=)I4PK-28l9?h~77FaG$e7C-+$UhVP+y@x_xtFlG^*s}5x zK1{g%0LAHaL;VL~!1!O~g&5fx|JNx~6Xr-XRomTl%_*LIMqVm_066e7PUsuU8kIo9lQ)No7YDnVvW>XhY=Ibh9D^XY3M!lkEH6Zu&c69c&QU4x4 zaDQ{8KX5LiId6IXQUg8M8ghB`p*OLUlA|ZM*8THn^md^4X*i`RT{jUU7HGR=S)lbB z6>@0A$mNyYK6ADoT3)_oA9|NOHojvzS>W^iba5z(-**I^aWcwPSUVVf-#jPkY2YCN z*+ns&EJ>{ct!?OTpm|Z>ktKDvoH&d2Td(Y8vRA%lvTznDk9G{DnfBgwx^Ep6;lBzL zmHhrZNVBVewRrz&$#KQ>MVnq9>OTj3dsWZ;Q{iOG!QPV`pT=`$DqGZj{qp{xxYO4C z^zvjp71whkY158*S$DQ~@iEDCQ^cEW+N(gC6W4NfEen@{>yzm#(Vyhp_E5{j*CHmi zr;Fy^s+Q?q#qm#`r4BiN1|7i2R?Wz(yeEsHZ~tbYFT*~uM$Eef75l{LqNaghw{;m2 z1-E6jVGO9?SsSVu*FzkFC{@0XA0uT?q>gJW2nsS=6=?8ovVhaH<$@j~g$(G+$1U+X z%=K{imZaj8y{Od|fNxj9lTMJz0V%BB1?JKohQzE~eg8ZlTqq2xpV^le=X}~6f_zyZ z1V012fzkaRkB09QQa&^Ha367LLnS%}b^Ih%xh6A5ZgnXPCjdx;DwqU<)vM7(5&6_dWp#ufmDrL!Cc71x+f5n7EW53RzA#T}L;%^SJ7yl` zPy+(rqR?5xq($m0skg*nmWlR26nzrSq~(xTkgS-oNtQzpVJnc(jk?BM*t>`oVWgK` zCwenm^XPN(ozE~H3Q*|Fa>r63qr~nSqjNaW2H)U~b8S_UN64c?&3%sb(Fm3Tf!o3m zO+MB74uyWvEgP<2zd1xX0J<-m4Hh8&DS6Rj2NTSiQ)m)ToQ|BUNZ0!l^ZPe+^%?{?ST5(#hL;@_O~#Ay;Nvbk<^`F?c52hE)Pl;YmbHF!0Ll4fWhc(j*xPBett#`)g|wFZtB~h&ClQC1tr?WZ_|<)-y08ZLcvIKRm zqS<&*+-wkvbEX<}GYU^93Xd1<-&Em01%^&uK?iMO#NK=w@7@?|ezkVtl^cwwzSMgH z(mP4^v=x9+Xmj(WC9%GTIC;3)Go3{?J5MdJ>7pFo;be{*Rzu`|SELDmBcp4hECDplsX0UG(y7 z5pKU>;%tIuWIq7u+dP=>(F+h%(LWCE`<+IjyG$WATqk`PR1FRpkge20+#m7LH|T|` zJS2SmxH{O-G7dz##CsnQ`nFLzbg>`Z?^jTJ5x2!1_#2N}O$&9dth&l7sZYtF*ahXy zeC%IbmsLG2&#CS#aNG=4bR-+$Ko*By(8^-a_y-0X`KW$oWn*MM9nIfhB0Ip>Xd4|f z8=6{|2v%5f)8S1|w0Ip@_i9moAPEhEpFiq4CrU9Ay!Gw0Div4^>5%e5$E_t&Gk3YK z8MtEB^GO7%I9FQG4b71HF@fdj@!=eL5{#gCnpx07p_qzty9#b3^o~S@SGcIscNdca z-yQDEFfLG-4B+QH_()b~H%31f0I~_S2G*C_A~IXBkJ*O9CA-F$BguBstgHl;4<4|* za+fT_I=pa)EIX6?L3+X^mgDWYn#)j}8JBM-oY%06s|-FuBXimU6y`0`u#)|`2T^ZA zAUN7;sWi*Rk=Aqplay6yw5vC>OoUBBGa&u6%he;vzQp7y3?# zXa}PLkb<4u@Z$4?nv^4LhYYA9=x7}$x-J>2-%+*y$}y(A$IAyGp0e`kUFEL3Ojax^ zXUTVmL-3Cp3mqWeWd2~`;eQFFwPGd21m`4g@#AKS&4@gl3g&fA={(4bkj3+#*bH2D z8;<1VQvDf~yUHnNkavA}{-hixfnesfg6~^wq?txOvZ%D(s+@bvz6oLs?aDg@zk%cG zv?CzMV%+mk7XFGBWhyE?QJ(qoT>p1qhTNYkO5E~WYaTq;20~xR1#+Nb-*07Q-*2SF zk23`hrg(fxAgXm`qK}i)JT$rNf3EN+NNNB9_DD_P{IvsXZ!QW+V;lJyQQ`=Ch>{!R zod84ySZQ@(a=E+@KL}Sb{=3NCi;gRV>8b(wS+J{7MjPW>`QJPuTh!88mkHag^ae0X z$VNV=?n_`gkw_}4Di$k=JJhacscj4vnx$trsEHPC(+HZ^250qFV(yW0j6y)oL}nRQ z8pBSS%xr7lun0@(qWm#O5QRk(Z@w>!mGs}*Y}^uQu@gsttY)(fXJYS#U4oIRv*wh9 z8&<-;vHd$&8IRjVo_3|)8ZRJj3-AK_v&>D3&v){+wk)^Zx9*~a*N#X9>KkY0nic?{ zgCOSJxAti9@QO3D>#(?qHk_@M*ZEU_KExoBrUF`p9W$IU^EW!w%(*X7e%`Rd0+52^ z*`ZweifS~wr{X}A?r|C5uPmJdbNEMbTjKQ7yH7mmR!RrLn73e|8lnQ=T}EdbfHM&Q zn62p9n)+^jKm}@jhVoS>eG6i907<;1YW+wzB2tku+DhS}`)M}HT%!pL;S}Rc)xSl| z%?e+zZ&8Y`x`HP2mX#IwK$S(rGNra;8PQjWqO&>aYFkHB7E`{yEJl<5ARw@8>ET;2 z>EIzwMG`a!4fB_zAh#EU8o6YHR$wD3;q#B%KW<28$Cp5Z%+q4%ORGAwiwQ4UVE9gJvs>&oD^CB54ZawpM6$ z`!s0X_l)l1(FASJ>xQ3ay-U8|xVEJms8)?PmYCJy=8~5ND_a(Bjde4Qp)I*EPt;1o zP6!0GZNk1#HDa}lmn!=l=#>?`PyW61op$?;u}noxU=Qrb@|H23)0U@?5%Q)}U%1$- zsnW$UEH;v^it;<(ToQua@)`-5zDfQfepb-?R0ay!PRb!+F@gL5?gG7o5A>5!@;CpL zmV(%0z0>ah0(C+ykBdOGFs|=Wzbr>0PGJ}p?MBJzZf25d`^9BX_gC+DB*+&%Jz@Zh zKa`QE<_M(2)nPr;7h^HEDF~DoiK1m~r+6>23v}k6rHhbX&*jQ!i=eh)R!EEr3+bUP z`WEt_N&3~l#-PFktHn0*iksf{#!b9%F;?9V*2*TnnvXgx!l-K6>d8JlRB@a6Mi*cu z{=w_&MtgahJjG^~!MSxdt*1ZJRr~D4#k;xuDTxCi{6_i9_p`@$7aL^sA0##Nf7PPL z$jrg#{h?6YlQZ0ck_-YZLJA`0)|x<(=R zYnKJ@6&;!rb`cuPpJ^m(Bt!X*8r8p~5;^;?d*>e;h3doFPcx3x+)P<1Ma*sA-)jg; zW3rnc&F}8dPsik^FFCylyq|s40+qQTYP}fNj=FK-4zI0m2j(@;*2>L=GyMqvUqvm_ zO5)Aqvxw*?O(MDv+%HrUaIE0id2oIeV;i+u?JE;js8GkYJK;LaJ`o38Pt&k z7`^V;ejse4yo<0(^%A#;6&j$6S~gVor&AU#rFB$!L+L>F`*Z0|u};VL!{YB3+x;-P zUA)EQoxL07oAz3Qq*WS5V;?|Cr_@BBRg%&oi?;@&|si1+8la`e7 z7lVReOO`_U+BW0L7~Bf2SMB&FDLE8tCQ~c0dCFXYR7qsSrI>&?lj7keK|jsf2buOP z4eg#*C;{d5_;g^CI>$u9FL~?Q)C2u;iLG-GczeUfi| zy?nA&>s)MraSMdR8FkM%uH3=4-fa+aiy0kmG))O)1cuEM*AQ3$=2In>PfOrlx+kof z1KAt-&Mu$s)&~L24d;Mz+ZA7q(%6!~)FZ{e&^wu&${!BvLLe3F-8 zf3FNXEqT#xjk<>O+?X@)X1WT^jwK=JQeOTh!w#5fIDyo_>+gj54swDY4#2&BFG>aV zhw7(*7a@~CEtz!90@XTX+apMs%1j8{%<2>~vEjA1wEl)jX@%@%RbTXV5yEZ=2p(}r zg}ztjhPqBl0CaV?kGKXA2Hvtpv!l=jKhSv)yfuJXw5rSBtPb$j^iImVL+5Skj1wL# zXcEaU%G3_xUSN9@%*3XFKPEw-EA-l!2i$s!V1k78yRxaRIVNt1uyx(CLW~(vle^un zD0Vn>Cdr(pZXl=?WQB%JdEr8pzBU?p{Hha;MxM;?pbuhqYYRRM3e_+$cOMO;+P9DG z_ku(h7pUV1m%W7Tg8V+MYnwpW2>oZ@E*~FiE~haGGaAL!0&}$T}Yz z*09-%D(k?*iMI6;q``SH+e_n4GE_3^q*YPX(jBQHLPubZNK=rq8ZQ(Ecc zH^Uc>)&6T}HHVdU1lO@xo2|SJ+*_EHu4RS!CjvdD%^Q0<`=USGap27s`WX*k zf+{`78JDKX+1(ZnwUrO1( zl;+y%{Ln*y2vM^Cp5Rr7la|+6y)bDojm#~d@4{trXaJ?j7wV-7JYUSk3 zV?b#P^kt!FHkLK5$JsZh%qNt?M0P84{lI-_>Wv&9=HmWWs7XdG0DKY|C1fgqp&L6d zGSxs=Q_@deAJmGNBl&Jlvq}uh)oW5)YV#UO&`5ecxxY2ZC(QrGZhgmCNc@mopweAA z(U~A_6MvBtfWtmL|QF)k6##hQVV@bZvg3YoC^M+n-V+^hSPtw~wpiB*>QUFf_h?*;!2a z>%EKgH1%oDVber#+EppRvXWocy0q1U3-@A6Gp|^Cnk*rj2w1Nb0UB(uCdw5vAYkzm z0E>I?#FYOvnyF!o-W?svW48f*Go8Td`dnbmi;tg(VM6gj{F0>}6)PWHX=uc08b>T8 zME5KTLIPj7X_d@t{=6^=q$^~8>YG(_pfg1kaUV`5$&}t0jh)r zEK%$L->e(`L}F#h9~1yD7p+Fv1UGdy|7KZsuWMX*hg*=QBz~zz`VFh_^Z021 z?rqsi>ul9y|F-93ptet!9Chb>Hxq6vwZ)KaLaW&bL*iPZT)|mg= zkYZ~`B1SQx7Y~osQ8&{1?mX!wSkR3+9V7sRv=WY1!4E%ODCI7TxXZDp6AqY{JPT7$W*$_Pm-nLo9bVTzm zAcvikJUh|Cii#aMdG%dAZIpK}PxkqKC={xX6-~WEldQ7%5R>FeS_SdxJ8k?X>6g0q z`5y2EgtVr&{0~Zyh55fZk7ZzEWBQ*;ut{SqnurbN7dLbcUTL1knyc^+U<{y5X1)a< ze8c1otsG$2HtL?eH6r0efHXPU%8PFjAJ;V9+N+52zSeDBrj<&%>l zB_ZcKOLmy5ueP@b0~?T6=!*V{+j-mjSuh?Qko`vK?&Ps^d7C$=KLC0)Y=>h8i9*+I`P|E z+d+{aR*$!)%n!j9Iw)zn00-HDau9QANp&SkqZ&WJ^1+zKk+ll{Y=cQPWFJ-71a@&` zA$Td#}23p+|CmdXwI zQUmY1X}}ALdJ;Ha`X?mwx+=OtQWCK8S7`Z=T0(Jx93{B^ccUvBw(3Rf1XA)nZsYRy zE?IBKiSD=r7 zlCb}vwK}AzwO->zp8HgUAV&f7`US;blPV-hYp=nitOj^d8fc@fo(gMp`f1LkUW51! zwz7fUzz|4Y;~~qyakvGFf}A4ML~QUP!JQAz@3#}vr`!eqvGfo=af z77x=iR`b=$%r8y4_0{m6Nw9FtKZ#OfRO->Q--4ui^!>z9E7t0q%TN(U9j=B`u4iN@qRh?V(t%#SeMq64+ zV*(*?y8ba0$TU(lN2j8|2_cTWOJ0s6*a02`Bp#wwbRN7Mi=-y-RVh?e^OAqd8~zqo zBPP8|>9MTbN060^&%z-bUHv zH*0f&mVcnT(*kw+0z)R>@YYL|3d2K|*Mi6gM=$rP?g5^vXB^eX0CF|}vQNScD>jBw zg6LHO%Sbu{;mFi)!lCf%l$A0uRU_b9^0NXnVHDJhWr#A_t2dcNctIM$YN1AIXf`N^2K4cmgy{n9v0 z`0-($(XbFZ70oI`Ehk>`iEE2UHE#@2MB5^LNI$4X7#iP73_GNO&%KX(p*ep65v`;V z23g9uGmfMaU9Cv_4&l5naQ5+oP%oxrJ)w3r^QhbatpK)w}-KC8Ci z1ug{)qS^w~lXU}ER|{kRaKqPyKmZT&CT{~s(`^v&&{ot*h>+MoIPgTb2W&pZwL0&m zqsO_6!%c|;_C_<@tp(}S32@L1d!k|0cL_?&&!otq(m4Ywq-6J-zyP$x?;pJABK3TO z_BY=Uxip)d(Ck;QmfrumEmDM*0EFp=inbJ3y#|A)Gps^6zaeT=Q@`dQz#?6&5XQ9j zf2#2NS**SrSu%@LSu#x;fG7=COWAy-x@ankrMmX$LX<47vm4_Ic<0s?OWwXB+41}G zymVbn`!Bbs^rGLGsOlH*mu%`Vs~>KLF-yUW{PwS-NfoUW`Ou|K_`Y^D$Y}P5)piaG zEPV=T%Oh0)8@GxDAf33n_@v#p9YZNBeMZ9rQjti9Cv5cDXGB|Wdt9U)c_(%}w4yyM z=!Og+w37*|6{8kNs&#cIq;K#+7-%19tq%R2nGs>){&eEECxcUrKuIZ5PUQm~7dRUo zG+>{XTd4071V8m|VnoD~@djAJxsS`6l^|o+CI`{{gl?N2xQTRIDfa|oDYO|#LT3da zi;k{zsdRm=W=dj_W5+~eaOfAKp?8bk84q}rdqB-B@B`|4i$yPA83sQy5lW4k7EIqi z`7}5SK6%hFa5`1sENVE;FDQE1Ilixd%&6la{==Ke%Jkp7nT$;A|Es{T2=lkVuGtiTFGzJ^ujgNZ6zQrX`EdU)k)FXU!7_H|hxhaA_To27GQ;=9 z{+lJ)+pV-{ZX1a4EV=G_Z?I}Nm`s-Hb_)Wn8Rw4F-2fX(Le zQVW?FqJ?Aw<|b1XX!G!IBcH^mrERrr>Ev!%V*o`OG$qrjf_1Y}3IXpPX~kBG(z~s= zmGzrB+iw{;-k)a8brI~DN~Yp%_` zwf3?sJX?8>B!G7NtH_UAe_a^9GfwPpSQ0JcNYY0OywP+K<`TCHR@mAaVr8}rEien$ z<{Znlf5^sL0;h5)cuE81%yE{zc{n|&gQsVBY^ zZ+eg*5@jH8*vY^AKVV3$5d7*%O2#F!j{9VkYf7mR*vHfPFm&lih|ruQ23v1dbFZNE zgThlpxJmP4;U@Hkd;Toa?f?Yc{w01{Xu}qU7hLOY5B4ScOlxg7%m}g`HHG1>UDVZ` z2Y~LrMw0vYT@-OoUG{|`RK=uZZef?6V!r@j&w`4w=?~#r`ejOO2zuMFl=_F;X!b7^ z>}`YcU68slkZ2gcaX8r;?bt}PrBX+iYNY2(H9|6uLi&DCu*0TQV$0pp5iYxY1S!T% zBAZR3)_?G`ML*Rr7n=~)>8kzj>sQCvlif8&h5W`%ycscSc%4*92ryhw;Qj^BV}3A+ z5l%2%(svG6M7I*-2#AG3o1H?kBx`~3N+(zcZQF>3$BprAwk-5ntwyd%e>vJ~R$e44 zfD%3)TJ%);egahrnC4K(ObTk?XpZv~7yB8Gy6b6i@FpSwlAT}2hGx$=IRQZy zR4>A`DbaQ_gh((HCDB+i(N;wfNZC~Z>dTwrb+ayFBNTh>%@dq>9X^zieK+y7k#Nib}J4!?5N|L(^ z`B#^E8m^B<6O@19^^cf4KJ36}!`!Fco+0h2!NBZQ-Ju_ezj8z4aqX%4rxCR4l;V=N z$PHGb!=8^AawT|wD_`DfUK$@H`#U4mS>>|2iCH&u41sfA602ce>v)`fR_9JRf=gJA zX~X_H@BK*VuSx}rgzyLl8tw%K5FPfet9UqC=rhI$1@JR#NAexAEttX(*t1JiYB;m= zTz)*?kiX$B6-bUC;VFXc$ImkJd`Uz355;{7N{5R@ZgETj1xFyuQ3$IlJVRykxrqLV z?Z+D*7`)REC4z$?CN5r74%HssfOESlz zw1dq`Dnys&vFITYMP>4TRUH`E)i@<3sc0xlAxwMnv0$FcODi!DDOcVaZD?jHoKzkq ze!2`?6N4=t$)A?Xtn$PqefY$~;O(Vk^|i$5Rgt7Rg6t;s2@h{#_ZMekw__F5ip$}B zVZU6(3bM-WsnC?6jQG8TA(0AB;Tjb3zNdD8K2c%A8RMB0@ zIOJON6`|NGLFp0^z>3>-sd2KOOS0uZFUTDMBHA}ke0e)`E(lN}cSWP#Oku!bDKL!w zn1X%YJyWR}ulj*5qoCm>hl1PyH+i+7XG_)I(llk3>kFxMz6>PH+{msIC7&Cn@3w&{ z&{Ja#D0seS;KrzCz-Daf)_$OEXXGeKf;Q?I=8q^2wy0$=COt4dTMqTtz@mXZdhm`1 z<%@@kD6kzo|5Kr?BxLjEn(v&pKm7 zqh%Zd!ou?Bs^{y3Y7>3CptD*24m zrnD2&YoorcBl3YBhxq+V)U2hOFQ?=(k?;|8XLOZ-vwj0%ke-7VTIs@SygGqYZl=Ou zRzi{F+Of|K2J(C%lg%ezNTo<*x?(MMC(L~G2#wZhbO?X++XnqU;))T#_EJ=k~!$;SSkCcGPlHDZJbm4R)qAt;9sV zZ08>1Gz*7PYuUV7l@j&x$az6a@y`&0qX&-`apF?-x_)RYM74Pp`&YpwI@X{5EfJFw z^To|($cpSwJAZ3OBkMyE7v@i%Vg182M)FS0nyxu8UBPHpf{7*^}N7lY|uI%5h+y``h)6@^pnw@K~D_(djYy*-fTqSzb42q|H-lR$kE= zH0tDTq%e@!(Jy1r44J0J=Z^E1_D@KXVeTa7%-pfG3*$WuOpQ{S#*%_lz2)geX5J)J zWwyb#MyPHhMJi)Hd}?gelgMX#jnWtUxgO1Xd_F-p^C8TW@#7>*MMRcLCc$Nn!^qFw z$$9DUbB@a#>))0kL)9>u>x128NMd1I7&IFfI)?RZizDk^dS}u!*-$S^I^vi(@E)&+ zlXxW69-4&)z{ish^>uKsscE0PClhqY&T=-)PhVD0VZ_krM~hJdy4?54;g>HEPDIOa z`&*9x`~3G0a98UUiTiS zX{k3RrA8$f4_S})Z&ffKikY75?H;*?3CQ9fSu)@Tt$pN^BCj9TH+WO==$_wEhWGmu z{KWHDNzGY|uS0^yai=kpHxH((k=gGo!{uXSjreB5=nZEjVX8Q?-w5^yC1q*XO!9)S z=bLj)JK9i5K&}?>y!_DK#KZPz?%qlj7;tK^on)TQ-W{(19C`Ot zzqWg)_|kp0-WT4Z7xU>ZoS&DA>3rI6Y{e8g1F><%&)2t()NfW#0QqQiKm2u+;yv(X z*X*8D?Czww$oFcK!jJ&%-!=dJJKtE1!QcX1vjp5H6Y&4T*gFM@5-wfZZDY5w+qP}) zwr$(CZQHhO+qP|6(-VKhKXYQfi*r?VT~Sq;`Q}>d5oHrBAlZQ;>1~QL)+Atyf+goz zsBf<`XiSoXaP?hsWkWLL1)Qri^UX(Vx$z_5>3a!~#fRZ5u?^w;ii8myHX;#`-t4$=`weK+?uG@^J&U4fHSOM z<13g9<0G&Vt;(v3px9qj>NT0PT=Pa?6xXk}YJ3YAMIL?2BY$32Qs%2edM60pOJRq8 zZJ=|N*qs}tj4S2jEW^%c%HasEf}M?YzB;`AE49Al#*UUHmIJ+l-#DvPXV~XYH<+8n zrdUreIOyW$#Ld7?2PB&1u3{#}4N9+Z) ze^tTB(CHK+exGx2t36|Z} zwC!0mdjIgjnH$X%bm-29kY`9r89qEa9WylKEyJ{O>coJso}5hSTt{n3ZxQy!a4kVc zhW{dgEq`JeqonpoWTPn!=UmJ`Yjk+Fj#QC(_C*exenUC~OXg%#IIMaGq4n+(BZsO2 z?~#LMEIVpt)K;GLt52lr@lA6(>lBb)ODcTw^C9UkrM zW}`K$Q{mhqHba(zu_)~jsuJFxqM_IeG)*}1zPqe6y(LUa23>|xX7O!8$t#d+4leMK zLmLz=5zPxCY>RH9sJswa3rOY&$8#tTRsK76&j+RwqrE=qGap-r zseg9!%!xW27=a9rOU2*Q2)b=`Y1_*5WI*Xm82-kmvbJp{gTxN+;W6XP%VLj@LC*cV zQNJK2*U`&If<5MF%yG2s_LrBRB#BDC7=s$K4KGlBzMJJ-K_<5}+k;j2Ac;T|C?@jR z8_qK#2Eq(*v_t~yzigmpiA!d8rA@njVn+kM7PbZ=bi%ZjY`%Gt(%VwoUr`_!;;uT^ zF-;~`cVWa5eTW5XnkG;a4~TR}i<6-2&_>U3{63z|?)hTy{08^vGkzw)T!P`z+gM^F z{o36W8IHbX?CG14kW`3M%{+)71U*7|pizo^NN5fDtN!=3xqTJ-1Jlf(TH|9I_<50_ zT1)-(hqS>RquY))xwFX5t$7XCDbB(I4PjM=oh1N#i+hBQUBdu*!0-@zz&_of_i1|u zE|srUDI43uNwVQV5BRB{N41Rz`E~^z3eLp=(73_U1^ApQ$CAk*y86=~Jhk7}zkLI| zgzWDt^0&2R-x*_?wg7xw)b6O)S8jsfyMVT?RKf7iBoFln%CAz**-Gf#5Xa2QlXY# zhh40zSY3P8oLehyfocuqaojp#q)+z2FN#w>NZWvirE6WK9E1hSXr@Y7ZH_Y!#p0o`E_`@WHBerlADW-t)3je~M zyi~i*j+R!UEMVo6UPr2(o7`H%<=t>HDI;^4ag4v!^XwAz|q5Vn_Lf%`~k|yp6;tg_xZ+WR@;EsA|Qk^u9<4;qV%3TX=7XmtJt?G6{^dao|l%yk6Tv z2m7oOpvuImr|Tc(0p@9fz@k<*mbeWeqL@6dZdW|w62(}RVi0CEmVOO$_+6@cC$~9| znFX=JjiG;gP?h%gc0td}0BB3hfRy59ZNiDmY8a!}jnS$G=D6W|yW4GScL0@D4^D2? zLJZPfA1ww%_e3klN|CFdyb6{p@YxK!kz*9A;=hHY{9W{FWXdy_>EZHgy%vHWJ$)W=;r~n|vi=sOJAVce-g|!y`~Yx6bg}#o-6Pw7 zwFG0JV`2WkyT_|vITR5q%rBAT37A@fzzHw_4(3;?uz#bt1!b>sQ^Q{4$f^kG%DG<47m%2d5yL zp3N(D+GUS${;;!fvoNAXGw~r)vk=qMYuG5xk#_d9-1@g7vSs1oCi;%Ovz~8pqbXEST{4dScojAww!#j{mKCp;aXAItkyux+vDs*zEi!!Gl}z~ zXBjDgGzl=>=L>}n?rLZVHwy-!tVaZs4z}kNfrrJ>B)@@bovCD8Y8@1=jCuMga60;O1 zg3}Sz?nr6Cw$z01zq`eBJroBssucIjNv-*i-$Eco#MS6SeXufqtUo&A-Sk@}7UCsudxp(_w zKoy{>?t8~MY}lP6DU3K$p<*i;NsJ?M2SXfE9PBm&3c|^WyRXH=<~6tDE7Mt}VVg2G zeey(Vx}@Q$A@sVMvH*RuhrggE#DYrH$l@>sdsHaZ1%8zT4gs}cfoV>K$iT=2n}dJP z9l8d6uYI+x{hN(at+a)oq#^(-9qYDd*i{*zX@yk0A`$sdSRQ_2nw#}~_kY2SYr{D7 zq7mvA3VOS8&hE~;ZQC}IM%sf_%y4eqw7K+HK{9ZF`}ke z>!OLX89`}a!IYxm&s}K-3ni%w=JQku?(eA!38A<`gF!0V&SPcm-6_uIa$TLl8Fu7< zHdbPGgHOZ;8DJm`hV-hxmWN~@hql*Bv|_CPxnPUfsW05{j~NO<{oGxm8giVn-=0Q} zk>@YLMC(+H&~#z|)uce#nroUj8X1!u!QyUC?q%tqC1-`IaEkMa zvl6IVow|@e8hoDSW~lT#F@PioU)}A&OMaJwQ$I4lPR;AO*nhLmp$o;3$b?#{l`y0W@f+``C6&W!|jnUWvOJvG^c;>J4ka zn1^;0c=+Y`aoB~iM57YONzUf&k1X*W7)QzDRds_(v7#3`v#oXo%hwl8;;uGIjwnC^!SwN zQV!U;jp3TfMr)$^GVd(Wi0RuUeM!KsMlDNWk{kb`OgGC)pYBl~zX|WIOE7`FZIf7x zMlZP_IY?%6B-lCJi3V9gJP)nAp?}?;#3rA?Q~KW&()7)kwWD`jL(u}4U=vubsa*}= zDQ1<1_-{%C#a_Oe_5?!%Y|-lM%a~mno&_(DC6`H&W;+Bu(!g`H6CuxV_IOms!W3Lt zMe9j!H>0!QkG_ji3QZu!;j6z~QC`~X{;zu!se%coKG9D^#~r4KNYHG`t%Q#4jqP}x zT$2-j{Zsr@x~(J@xJ6c7HbK^}<>r&dnQp9aAVyDF1hmg`JXA@CJxTN8M`>qK6CkPo zlCcnm`?LI?ud2kOB6#E_^gV{5_3$BKR9O!DJ^l6f8qo)UfoA;$Zt_N+No7bDONUdA z-r+(uiXgj9Bf2T!U$m1bt&ajb+8GNQQ;o~9tZjfIxIagFudTzGpB+)DjMo3yWJ|yH z2c41p-=*Nckp8&lrpoNV`C;@}0rYbNWY2a1^09BO-SPs^8Fa$>_JH>y<$Q1eY$mzA z2187uw<~45eDWq?`5zhh-u;NL&t@UrUZFAoP)l(OLJ!-tODN<1E((QaN)Z0vzJiVJ zzj7|pv$FjMto%w%B8G?=ru%{N9NtlMpGdk;4m(zt*c#eF5bJ#`h?@%So2U7qv=DcR zdB9emIozD$==E;R4(sL7i6NnwmoYEvm&&x@_$h#t^UJY*_|?~l&dK=5a2}wTX3Cnm z|1h-uNsN)*{>k*t;^95C|N7i>djBR(jZ_vRW$e<%bTLSRbavG|gR|JsU&_1z!}Acc9hIkF!SMnXp4ar!}ap=`U)xa_$?hujis zXue~D>@+!zqX($s@CorelA_S@`sU8(egiO6JF?2_24e|tPpw<|yeJ(W*czWYn@D>w zsguksz#tmu>oUfI0BdZ%UebdSY*o-^4gfC}so91Y-`fwhSp$bvDr81Ud#KT*DST^| zcHc;z4;o;e4i2rs+zb~Iw^8fItiPZd+J+4aPKv(A)sd=?Rn~1wJ#~76Ie1l_4_`E^ z>{5HE?zt0_3b|49VWVD(a@!64K-YHFL03z& zi~hCKTEhsQrZoIQl;8W)?r?!R^t4b3M3`s6BjwB9@+5SGx*q;{Ux zStU$Z3196vfDdb^; z)wY6%j}#P#r||txOf*c7o8wS{qLdJXhPb}!TE3&W`BVx6S}9B!ORMVhS>Cmb!jf)G zbyhNDVllxpc77OH(ycU*4?%Jx3Ot zus+9?2{dgJWPC;3W)>YNLpM`L$}!V(%v}Vy06BwYzG`RpVUswWWhkD=Q%#hh@ScUX zy8?)wyrQrc<7O$j_1q$uaQNl|@^;Bt?`%kwRmcWd4Dfr1^iuboZ1MHWt`H@oY0|0g zawUpCRQIOaZDCtfzzJiN(7`AQZ8qFvP2NcndbCJ5L8Xo~SKzI{O2p&*vOW6#nI>8m z^uuSJy}z2Wrm0Xq56W3DC+Wh!J)N_zS=PSicAe+en%0N)@<6v6(<`harOY+jM`sRm z*i;j~g}@i4x*1%owIeQ>e^u~k?i|I{7G9+n50PsY`2iBeCj-lBh8&X(1S5veaOWJw zw%wI_dnU^HSdxJAxANn3ss_IQJ`bG4t&GQr81|!cTBb!Vc8yn=cFv$Z& zz6Ya)g6%c7O8#beEmDuMqH1(z1`gfhkZRTv)rQR5uEm89>l~A2T9`3yMx$oZh`6d+ zO!{LX69iisR3ttKx6xUY(Vt7*hZubWC9{#V z1mgwv()Bnew~Cs)*L^hUYm2wT2+5lqkBSb-(cFa(shuc-+eshiRpT4r&E@PYEix3% zRNn3vHp-in*0qv!ar0aMBG;_weYficCPqqXdrt>;tR0KA&`oX5DfpRcDAxP(-Hs{M&ozBV+@EAkaQ zm9ME;5tQBZ!Co(2tGjpkYnU_S!)Pbp2`ela3R5g$qrm5VGsA0YaWPs&E2m4fn(Z^> z5Q_79)273bl`$QX$Q4>#)EFN#%U;(|*?<7VNNhGF?v`6wOpRo~buhd*#{uh;SvE^R zygSSwZ7;#0Dcv>I6H?X>#Gp%vbnl25FAJRVwr){AI=MfL;=MTY5)qP7%XQ**3bN=T zBNLg;Qw9+a4F@I;;+8{D1||7F%}ctxCVy&td5-e z3H~-@JFEkrZF#@&h*$PsgRBW_5kJ786?R;37gt<$?6S^^_@5Y$m1UT2)i;Y9!SAA9 zc471ej$BhN)b?c|cI`2woTffFjq(to;;n^aYj38O!^N^E{Z=lDOC7Uro?awl_v(y3 zBj~&!ye88ap4r43m&UqmN)j%kkeoo~m1-jVze$V*0Z@ZVKK5yF3e+||gbNh+(e=!F zeNBcDB|nQ6buHC>Rj=JXHi-j;Yq~a+?sF@ow?o^JiksuFi&tIDiAL(BB3!u5F3Gh`2%W1*X8$U zQ2-mDc^1;y55hiff8W4*>U&N+UHsDuLV%#L*ccsufILMOg^HqK4Ukz>K&SGSUHn|@ z9Y^=XUQ0CsbHoGCATy~KHc7&BAPK#2&07;{VT-Lbb=a7evm!3o5qoyhlvyktywNnD zhseL$wMbsZoD?)jzO}n2lZv9BpzhTV7nrA7mQ-;SsgkKU+eao9!!lccd#H@d_dHM^ z4yEl^5XL5;Y4f-k}0)PL@jQq8`db z&CNqw9Fzj78n@BdJV4w%WYcGk_RU|QLX8}`%0^RybbQ6Em4JG^Jg(UB!#un4Zx5=}b=yu8G9hv#r47kk7lZIinA@ z%}(|-hg+qnTkCC;W2n+%9Yt*M(M;9`edHdV`&IllK~Cn>R9zLyGLT{uD4-5U9Fgf+ zwx|cO(heVRFeP_)a;M9tgX2Cl+B(ep$g?*>8`wMVOsEt;9G|jUo#Ht)qX~kgBuw}U>ebH8cH0^6$ z|AR+A8Ix7N#Wp`0Z|JiJTmd3idFXan$XJd0mn#vtYU-53Sk3!){IVsZ6^1QFMmo)+phBMbeR=LL z?!Lk^UdcYmKGNUe@jU{}yZ9t#>f=Ui4cYG9g#&=1VgNa@_{K+S+9PN#`R13Bo#EXj zarFE(@bUO1;|x?4FHP5_^Vf+EsxxhS=Eo=C6pOpKbHI}h(iFL-p+set@pq$jva{op zCYfK5Dth>!9aB%Ct}Ql`mVM9OkCp0Mh3u92dni4U@E9FSlf7MRS<8Sr5CqwzmFjX^ zzUne=ju@_tk(~UZ{gy`Ez=kUSQTRs0+wIbsXftEOThskL&<=Qn$0rw!Z-mubzN@bU zU(8akJgW={X_l4-w@hYH4iqaZ$jiu*st1Oh)LcDqS&s?=ahU^Ypb|23)Jmg3mkXpO zS)gkyYNNy`tWhE`As+;Jn$Dyk@*5U1)jG47+!OsP`KXi|ei-y+h)m*w3ii37oJ? zk9Jzu*^_Ng2^+iUd;RbCH5EaX$fZ=id<5peK`Gk{j@AgjNhd&%2q2Kl8?*OV=sxRD z5&8167LtDZQzD3Gg|5-I=11t@!Pkdb5;{`VskBTIr)x7&I$eOikf zh2|G31b3WNXZVk0cImvQ45d{c@(z?zR9o%GjSzjz)8Q`w6dKOFNu)0E%`(_N-8+gE zK;}JI3yZJL4%j7hJGcZtP>=ufN?>=_w;UzxE5et8>LNQ=HPN;@fHie)?RzA*>%ba- zwl=H)XIyp-t^79n`NXU@0|{O)2%p8QAt?k1#DX|KsKO^%CTiH|o@dbs%%1+KSD{Pc z$oznT-wrWB2vSvR`r2zt7Itsq`Z${g^19{4p1F-eHugciq2?hGxZu8dAk|TR!SZuC zGnhA{*Zkm{5U}bKfkHNpJLj%T))?WF#Bu}8t#EkaPG`J>rt9A$M<#RH$3bV39P;^e?n7OnX*2OAvMExBf{$V4uk5GX zB8%ms&JG@f!(uJL{r6K^G=1c3i?m zzJpWdB(~F&ng%nyVf?`xQUr=(Ls<&bx74DLpv4+3w=JlYWCOWjmU>2o+pcQ%REn2o znkie8FzO8@=gfp9p6$PG8LOAHX{}huq2Uy&C*3dOqlT7KRvBy2apwkm1qIa&+HNyH zsJz}cbwz&CZWAr}u_B&Fs-2KnvZaIkanSZgjp3LgJg6eoICBxrfD8FYV&zP6dSr_w zGx0WL9jX*Q(#fKXxLrqbg|>XkB3sRregiq^Hp40%gM!y3^YUZD_`s4>}kv~Gfo4{mH`J7twwMHyW*NLzr{9;enk|#m5 zck#kQ+Pt((PRJly(VtEHd>va(3D$-5Qsvg8u*< zz&fDNpVOdo7(_=q$7hbm$u;UD%&~hgdk-s(J(u+e6hxS094EHr$4TqIFWpr3cNF0@ z`pA9^xr5gO)R0)f^bIXqwMoU!tJ^ZHA*(-h%qV*jlNNY^eec=F4$<@ByJaj+anTAN zglC32VxU<96eIA5eoz(;#%N*qL9NFyrlK3aQm(97)=E!hlN>dJ2Y3JOA*JVJeczqu zdyGLZN<@0^#!c5ry;A&~3&*0=6i0I`l=18iBR+iM^pNE(Ym3j&D{I69k>3cJ1`{Df zxNd;tU(kBGdzpLe-5j&AeXetSj+HwuF-YCP2};w;Ug4M5!bdFg#zfwh(Mq2b81tbP zv!L<#RWSzuXuXrw?1@E@f31j2A$oXXXU%qN&n364`%r1nRLexulI$GlC%uq4@1 zKOH!ESGni1r#h_QSZb8nOsnQ8xIsgm7`&16ce4vw_E>p5oK|X-1%D$$fI=6ieO-Go zEvrPSMID*MY4g1l)Q?_qrABa?MM?<>lbLb9m22-GL;&kzB`+ zF@*NjvRr==nT1-z_=_G%1iW`)?PmvaOGm6fRdv9{D!b_IYJASKcqJ)0A>e)=g)icB zp@$Ru-A&M5{OKOcSiO0YZ{f!#dVyjvG|5>J6{%Rz03@-)_}8y%M7F~~$9BfmgiN?* zx62+4eH4Suhe1#w??w4svf`?b>pZgenz+j>>9$S93gWM|rUnxj9b2kwQ;`G#^PmVN zIR3}|P(6mo&+Zj)i&75Q19+@^!V&H}@2_j#b2a_*|EV+iuM9Bs z49x!#)mx-GQGLJyv-R@JRFMDr zc$v9^&qHd@C+t7z+OAV%A_}t_RQ?t@1p-VBKQ%ZZ{5{heZbXp#QDiJw9Sg)x(nC_f85V=q}yx)vo7!P#B z&afu2)ihSOpAZ{R!?UbF)QbyhXng8#Oc*u3RcF6Nq)xZl@WW;*&P*Wc}_Iz0^sa!^wP5q zH%bKQ#YA&0W_X{yd*`5s6Yi$*XN#U~g!NxJ@{9Q9d$`bwANdVJhC~%F7HzNYenK1J z0fKawvw)p0+pbxe)_MlBOIS7d?(`d1|3rTyxTK9`qfDtM9}+EXdVP4d-5>zxSwKGQ&o?eIEk`JjKKxs1*f0R32Xs> z6J>g7KK`Gc_@80OjmV!7dFlAhV()x4%`C^bP$NqY$vnE~)!-@QJt@1nS(iUGDBP^u z08A}4g19ReXz*g{Ijht~!G(*iH#A^TO5=}E+`~L%M%YhILqp2Lk&W6W!<^ADETdC{ z&Ovo74K%UZFfCDmtOt=Zt%3XfU}y~evW1ny+jF1V;5Q1O*@LQeWBRef+0(3~Davo_ zQU`n$wo|c0GP-u=T16OW8V#tHqe7{+`cS%kSzdxN6K()AFHR)ckg$0W2&h*$$NL}^ z#KD4i z_fQN77b;qh0X|G*$aP(g_o*t+`Y&@Z9RImzP;zKhR1n`mw;e`4C!%2OwMCbMHqY_g zmbWk0>f*B8)7RXTnNH>|!9q%UN$>?*6bOb(`oLu^xHFFy(w4qMoSvAAN-1GnuI{;t*4d={otvlw`ba2nlq{ze(~>Nom3y z`&uz8OIWa>ePmf&9YHfSGA$>P>F8z_iqM9T9*0;bgkNP~kYXv&%vromyt zMnxdGKfMl!#)z0k0itVGPED#tY&2!1`POg`8?iyud`*snpr3A;1H5odRVKJ{3|nH8 z?MG#(+1SB?=>lgT0Iq<+tY}2)h(B8L9T6*^`+z+k3t zN?=zDe^P*G$krq=*kwpR%YGCF@3NwJoZ^OU*7nb-v@)m-2*5g8ukHvT2d%L%TIET z{10mu+ZE~%I^6SDY@*nx&uS`|-0%s91%{Z523o8Db_&!gOunKOVp6KRhU=~jxe{wO z+uu5hAWr#*!?kuA* z#tTqTf8ZU*BanW9i3lJ|>NEf{o|y}+J6vKAKqQ6Gq&R>z1P3}4FW)@MAJEx6nUPACP+ID9r33*)YljG=Yx6cF?^; zzHe2Z{lDcy0Df}S*gkeGLNV_6GyGmS^L*{&vR`k7M(NxjDq~Qq;dGT?!3?3(|C!lJ z0oa%=<%L`?jK|UBqN#=|258Sx)bm1spGrjs5e#Ovrnk#j44ep{m`h=Rrp*$xfI&nr z$LW)meT=Tj?VAPLi*Myc-DQ2sGy4A!bgu*pV3hF!hQH*aB{1Cx&nVw(%kdY!`8gND(6!hN}&-;|ck5xe5;dz?B?pt?h5vYwJR z^L;>w`O$HFhkFQ~dLMNysvz9w@?(95`(V1mmGVhN!M#%63WJM9?m}S)96I%)nIV%E z(Gh!skpa<%2nmhG1ycYUM?!6ai^nc=#Q6}&o(ATW@#uLW9|LU_6p6vgLMlL7>N>8I z$fK3-h}t`WxCr{`YWjRTd`mT1zX3i$NqlO3N2RN=biWe#D5*R&)PIrtJT0-lUEFJB z^t6&!kDqkJ(7NE#e!mT&{rJIY?^un0uDNS9y{$dxAL-DhT(G{SD0Put^sX7&osY~L9ObV`id)ixnn5}&C2mjW8P%6lNpwbC424033D&+=AQ4*r|WmkV#^(_ zp33tF+=>0Ew}*G@1!Wbdy0-2Q!db77k}nWBWJB}PzX+$9WW=Q|2}rZf;8>rZ?NsZ> z?Nl4Zl_^Gq|I8)5$4PTj9v&K+%jwBaX55C}FlZ50uBOb7B&4!eoSayELrBC}dGkf&n$=o)Yf3c{$SXj_xvi$Vt{O*K!Au^ElCb=X! ziB@%*M^hvr`IDNXEW%sH6g3kqX&$&ekp57x#TrB$1|FX*5UWqz-#@f{oK4=*WY9Gi z`dgOe?c6?Un@LY(PcabzO#a>tO4_{`Hzwnlq@6I}SaVnRQ}UaNKMk5y;nrB(%1q}i zgK%EX-|t6j5K3nJK0D&%i+D)N#Cn!oc=N?-Mi1s*ZJq5QE{d^ml5jat+byECkKA;! z%EOO`%X#DJ`}JA9(6jimj<;b!A!VBbjB^pD-Us=wH|85o&z%OVR$U$Wsx83Tj*4tI7BcA9$Uo~e^GL+UlKUcD@wWwEGZN0TD*XySf z$HS+BaRZ90X&50C6#5{ilPy3LS+n-Bi~b4rBBZ#BHtX*@%OF(U<-tkD+t-;1wN+I} z`Neq3HG;A?E=ob8>(~BzmOIL!Uj$=^anNE-u(dL8_))(J36gLpcCn2c-?Z zv?zTUbKn^@#cHvjA4|gaRYZsd8cGZFeOuMEXV;A9PfsUXrFjMA$pn%^k+5Jd`q>Hg zp8w`YtOC!B4V9<%w9%|jTROG2NEHisYtY~!MC@C?xIF7jplroQE(5(zxV7yS8qKVu zVjH&nty9yC7OaPp2j~I_!XuRi!!rBIaAEKU)+4dv8zRl_DOawrDiPLR+I@W*x$+Or zC`g?Ngx@>TMRT+#7(9T#*vL1V&S9RqH{W_2j)@_ZduDp5@~1@mViQ1=t{{D(Id*wa zYNA2Ax%Yr*+bp2o%H@xRy#q?=>W5igdI-`T)WT(*l zsO3(BeI=mi@1|cB5NaT=pmAK~9TV=8A!pY)La4LC%nq7&7vAIj^3+h%{pF5~M=0C^ z0gSMsEhW5}j&wVgW3^#XzVW5IqoVYqw)w$5K-LfsJZ(K*+=s=2w6X|IGv-{bpP!gV zu?R_al(MvhQgV5xOW1F+C1#&`svjYTt%&AB@QqvUW>=?$^0YN_Nq8CN!Wc!r8nz5Z z`_6CiQ=OEpP3g2ZmL6WbB9JBMSyx_t?*uBttDz|M?A)QA;$&B+DJO-Jk`k$zTbkQ- z?hH4kK?Pk(Z`?vU*ApHZo@E3IlNrv$2&2?L=^jW%;aMDDZ+jcxhu66)-?1QH8`<}d zRQ?tmN70LY2B4zqTpII^^atbQ&`^#sJkfYrmA-hZlCi&C@SJP7(JCqw!fvnLl9tmG zqQbu156)259K=itEl9&R$z4;Gj=wZ98gc>DhO~_3RX+IwSDMXi_z9lUQ}Nf#Xd+ey zVqpxHJZMrcGZ8oW2SF$Bf_)BHo-CP~?^Z8j#0fL-M;#Y7w+Bt3*0`SyHbn3CH>X#? z&4I~xZ+pIb3BXjfjLuLT@0DOoQ0A^)^~RoS=no%@n?g&58Qeuz&rrul_9Tyq6_W%~ zaAPPvmDH=()sf0^0C-pzqj8#QjyHi%$j(-!0`zyQ>wNNsn7yDuelB@H zpf1}&Rincf(J5KJTnTa(Tq;7L>auRY2#o6VDjtjlRg!VuOoHIB2_VX2v!RiohDt@5 zV0i3`#K^r-9!y2EpbGs_LP%#W-34{kYN;pHDt)a9F}$^#4b}@26=(B<1MBL=ioAD|Kw0o(F`*;34<_KT{mv_JJG1%nb3k{mog#LCFDvI6! zhk`F<^4{aq89k@ZW@OfhW*V2U;(Y3R;V^m{7tnjC?oV!7J~P_(sAx#2oWC8vF{>?F z(yj*4p~!yoA#wfJe^I~-VO0J!VmC_2Tj^v_ z`=r9xX~Kh8h3_4-P`?E#BKGGc%}2N@X+1^R+UV^i{t{qYkNP)|z^gmlHn{2biV{kf ziet1(8EaK##5vmf{@tg1T0q`H&6p~`v?y<$L_zKN)V;|okQ*>nVtp`oaIphdxx)2f z`$78o7{UE%r&w0eIBoAyMEgmX2`{hQRTfw<;>W^bQKyfDjx_m1in8b`tvJg6tEQ!$ z?9`T>^41gHGQ`$st=0Wm{dWsun~!*XRtkvKR|B$#zh7?t@e%%vvSz2+wDX_B@IRC3 zX_g~TwMuO%R{pP-h=!H@%cNb@Qlgxtb8W2+Yx1lP%{|Hzy4vJpOhGoo%>MO0=EsH3 z>hyDam1>ph2CIY}8vfIb>xI+KRjP-GU-9uu%35{PPb{5(ps`4vdwj%+squK*x;5Ml0bjoS=b*Y?nXf<<%TWWnuEb~ zfy!!{doR7!!DLi>97%*tVQ&rX%?jt6>HARrz&OwV!!uc~VdY)q?T9o<{h`ZAA`%YC z7HWm`X^wQq*+diSYnJ?~d*iOIPEEh`*r*rtR=u)8m`uHcai^xy~+OEzRb& zdTZK-HzTj4t_&TtSKfqz0`uK+3miqkAv5q@oa|ve=h4T1FO7jJ;QrpVMb9h z2`q$DA$%oH15UskTh-=h!5JRX!;r^;@fWWmSU!Uu%49Lrt;yqL8`-8_18h#P{Rue- zI2^oQAO;oecAf6@!~&eWE?GWiTsi?{#T2*Xgt@_)H25)3dYHVB`ayQOJQO?CZkD6`lfgjOr!CYPNpbW+YjwCBIIc8I zkpfeYo>18AaV=!Aj6fMSEA3l#dn0Gj%q0tBT_=;cmpPpjlqNH_9);{$$4u714l75n z6BQSa4X)IcC(r}P++sqaL52+o6x2~5rX}>AwxH(N>T_XMISJLM`k64_<61g zj}mJ}{T4MsXx~pw#g)6>eSW7pi_Owkq`!Z|xFC90(rwW2+Y8(sA4Ex*QeVu&!KXt` zPs=$`9Y-o$0Vx;2!rmeM^w+$6Pt7@*OdM%dU+P0B$1>vsGPTgpJQi_rI70*O^M1P& zMJxrvBgCQzf&v${zPY*%r+(uj$|E_VLVy3-SR>)%%X$_vbHNS8yhmVslH}b(V_%P{ zba3IZ_n-*dnWS}Nwxzir_io-I z9ehFjt!5>!DZ{OaA30cVXpD!5uCKGL$ZpDfWXK>9Cw}^)0Cr>jUJ6naCs4cPAr9uu z8oTMbqrC0&(S(W5&$^+N8jO|kOhzY-^+QI!*#t+ADvFJ`gAX-1ozsB(G109}@3pRC z09;8_mIP^7NR5lg5ZvsZW6`OMtOkcGsB+Z$d>^Ij`QZXB&^VM=*}tSQhc`tIYM-PJ z;|>*oOL}!%d$v=sr5GxCJoLH*tL|*jeXV*vmk>QlgfR5&o+Od=22;gUJQ!&DP8i}uvzbA#{R{*Kjk41QE1aq_5JR*y3vg-tmJ37r_MOLna*nJ)*W(j zC4EB&05G?mI6#T-_W}KHrz08CDb28Z)Rv z#hjeSpGtE~Ew0aRYoG0%k&5VLS7VM{{rV4@ zWzMWAJ6ozbneFhn&E$fk z#%n`z*{v^waQ9k|Ad-VOx}yt8vYPMk`Do6_I0-H-3wQuE*zgVo@Fwit1GB6gNp}|915HSS@SahJgctc&OEf|HFdRvYFZknW)V<_vtv6qOad zr4Y{QSsZW|{-A;i%UthLJP;a78o-g((98GBM9>SI zBEpFLFUH=nNz^Dvv#nFMZQHhS%C>FWwr$(CPT96?+f`H3ac|u2J3SHo>HPt3#NL@Z zbFD||954SsE@W=uZr6XSbl(0Kzq@nGKN&e)O%1<1b9+^;kS#HcwUZqoBR6taBC0sW zRbpxUoyxak%Hj3|9j)YDMyh%wfzj!__0qMXL%f7mqI)w)#(wP%QTO^hB!#2BjOYRG z7_Z>)6z!LNxj)8nn9-cfpvJ0aP6DN4*J+`(w>SXE^nbSkBT3Tdl!^&BFOYdMx0VV^vviO)+ci0hE>&p(BvE%)OZ))J(_<5Uf@!ebNP;j1C!{_JC(al7yZ1Lm^ zUpJlaXQXzNin?iImoM`fXc9zSm+sGpPhp{fHl3!A9m0#5pU+lwE4T-8((ew zLW(#!FB~kdvt;V0!HWnqUzuZcaX*xB0vw?NR57}{9H}0VE+DwNVwxc=2#Z259D(k6 z&W1jrVHC%=-8k9W`^-}GdFvDkSk4y`rv%p3qTqr=(e-L7H4aV8|?8Sl)8%EPf}A zXgdBpRd&Vh!mdU!p_sqcOR;wn1)pEUaq?4HCFJjs^Y zDt=I0S5@JL)@HgPEoj)54f+0!;=x=K@OYT^b#3U=2UdDX^>Zjp z{A}jNO>gc_VC|i=I4p0x9f4hV!fXvDHeelPet?-ixZCo#v|eP|J#e?=bp%nhFyQ?H z+d3z+POLUz3XgJ6we%!iLC8oJ#Kr8R+0*UQhRS6CdT(D%8{joKx0N{W>rOu*a$XR zq!jk@8k!tYRO(YZ7BMvRh(=i7V65a=gy(o!kTRdOlaXu4oZkuLBBA36`$gK^8Y@P1@0dN5ulZ(6)NRU=#|?c_18@ z^la_h4=-T!qUELuCyfKlCv-%!98H&+ZtFkmlH~)|Y~%uP%BitqX}4a#e+CsB_5~ zil09(wE^)?1A4D&wr!!c!rR*$=(gKW94v$uB&tWruX&P-ik1>qxYmItQYdD*Efv#8 zvqh%%QR#1B+^}`=-geBQMyS4%FY(#z+W1vxPvp^~-Oa#p*-^;nB4aI&1WKPtTb?wv zuyr9eABxQ-KHH|WB67T$n;tTAR{TY%R0Sf7W@ISe_s_AY9Dqvgk_yZ%+X17XqIq=c zUYyYAl6k<24ash7O7W?ea0q!%^vao7^z3MU%aCz~<~3It_){6Z@XDWSEa%NsS)Y-n zo(0AD)a}3>->p*Zh9(e2X~yXQaeC5TvnO7v4An8J7Qs)YB|?gIVU>PIg;nq_3mlwO z%@u7a%>~Qkum-V44z+g#ga=)41W#jsa^b|g@Jfnd%AmA&Qi}_sp6UBeT-L8T4gCOs z$L0;1Ti8e=Yb>P1(R7GrSzv2*MSKKk*FNj-d;XstK2!wffx}wQX zKHx>tAB(9~2;5|&NUmQGp$rydAyyYopd34%@f0^)gT4CfXRoaE6q!h-mM|%aEJ8AT z$*kN;7o~BZG0eP;-%XC+K#BH9KXNS@rAjS|XB|Ps)b=hjUzMuPQ)x6w0rE^;%O9&DKN|MpHZW)rueO)rlr0&kH@aG(AI31bj;@D3uY4AHP~b; zC6RO*Fk|7sWZ;rV78`%L4SC=p7#aD)nK&A*1Ub3x=3?FKcF*x{PK5kVA}lRBbU^Q@ zg(T`d>Kt|geCwrgGdz%Yr0eY;3NJNrYmW;v3VV$=uX3-{941oG&FojO3;bOZdr zE<*uvcIRGw=RPO5Z<_TFx!_9`ccAP1Fa8k5tv!DzJyqM8c~+6nRX)I@((2Qaw=jwv$~zgk;PAr8on6dTh` z3ck0-c^=7BfGjE6y_^yU^G>j%{$~HFC^FDzW)H=Bh<-K z9#R_A#0~8kzwbXjE}JzeSoU-_*X*k)V7J+Nv#ejH;wb*dO_-j+w;2f z+7;8uoPsZxt_}qqH-!g_oiXH=D}ju|{u&XKBVQ^z;^`Cn?+uz#W2W``A!K>JMP+xd zIS0E2*VvNCA_`uX|6Bd5AMATA_nCj#vgp$G1q#&r@1ZvJe5V)y@X|7uciyyW^|f4`>M*i)zh6gsRInlBw-Y4#= zw2Xzeoq+<3Ub^QO?x1`^0aqURkD&5#qUN^e@EML>R8`UDSWJ$$hgjRuv(tlLerB@9 zvaQO}>LP=&YvB!D1+1|CACg`ZVNet)I*e>uIAcKXb?bMKp1yg}E++QgP#Xkn2pD(r z4=7-bG@DBpvah>Npkq0`s6ZT|pGR@QZq-)$?Cw69n6S9Pk|8ts2&KthK>Gk5m+d6E2W8{6dH5vbqg zOw-@}Z^-G(4C^2r^5xF<3KXv!*fsvA7W(hNabQg&HFO<-KpzF14W*UJ+ z=w8UUT~%>ma^~@{J(b+}cH8@RZhe9rxf#%52pl_+Se7O4W zN9l`3(>UwSV)VguoRX4 zM)tGsK$scq$JmaA$Ar2mN_$r~p~|UXe}n%UoYNt}+$Dvq{6@l%(r%7jb`Sr~i;J|{ z0LsQ4a((+8uv<(uPVd4#+jL#7>p=HS-nd5E35dCUyrOGLdDwv+7>Q1#iEOt zU+|v(PlPB$xWj2rm3qBZwq2>)%z?8LQtdafcr`?$`Q;SC zcDE+Srt0bpM+xvqDmV-LVG-{UNzgb%jL~n(z1#Gl#Y`ct>+~`+OyQh|&F#t2@*n2v zLSdehZMCgB#hA35+MduWSI?YFQaP!3Nis)j%eWC1Ax6m zT`0NDnm9^YdB)bovDiq*J^GLv#QHA$+)s$;E^@P^^c#-4SJvy1r)tI?H|T$iny*Qi z(d-9FhA?d+Z^dlu>W+tFr^-D6Z zB|Wkcjt96fHYf?lsuCkcBD!2f=m!c8oY;YMP=hlyQCFxvI_DDF0j_n-AtW{SVzFm# zO5t&x4D(RFNXVu~pYKr_p7Ju*E8Og4ql%q<)*E280`6(b&3^pkXDyccV@d|Li4XN9 z>p60ari{ddAW_IV=K~ra+yRD*X{fSGVeZl}y%n z5Rp41K&+x~d9QQs?BaYj{IrG%;nq9)KphUD>I7uT(wa=D8%kxgKCMiO$ijbN*^EoB zn(1={K^kas!MVUgHk{YZJi;mMtv(Cn^*EVn&w$3Yc>Q*}N@aP7!&dW@{pctYG{lFiK?iZg$5CzR5UvcR-8@gH-hzCE0K64`^ zY#gc--DCLlcNBuO3E~dqL$705I2*a5u+~i&dB=OH%Mq|%2n``1LD|d9j(}QBp$n*u16ksdx`StX!#tPvF7Q{ zU??`FO+a%)9wV*Mm&>;_qIFBza)eV>r8~E|r0uJ=Cs@;ICB+;_GwdeO8#~e1ni_Hc z`7LRLaD)#&fbkL~gH*iBGA^*tSccU#@tbJ85(3|dQ0Vtp{$1HgGINutIDAGyEX}$@ zMa>ye0qJzGQ259iuVGY>|7XwPx%0pv@z3FMrJbvjNU8*D#j8e`KaoLysXND`m5yBWVAB}~Z6|n!L+(2pm)baR zN8xMPu*jf;*nugFH=@3ohQv!@4Ci4Ue~^?ubGgMi%cZ@TjLFLzS4jeoJ4#f5q1%_O z{qX)f!<7@OFfy|-eRpUej-%+y&9J%Q;h4ZKiW-8Jq?*1qEE8e29dDY|82rf0xwS;+p$lC)LL>_e|u=)Y^PU zb)ncN;|WeRN1%tDpZr|EmiwSif41|8?HzsZ`xBpFhL@TJI1xl%2S@gy85*T4sno)v zFFKU`D`)JL*`#Fbgb7}4usn%4O-Z|Yw3Y-s83Mv#VyTMudEIJ1j*JQ~)w>T<+!d-NEf>8+A&+W*vXK;Hb|#(!<$=jpl<+&-S@x$|DW29fY=Zx^P!yANK`BENC6 zNjy_`!}9KV|9k(mFk$#7w~h1TsTlUk*Y6GKM=3yeQ$v{DpRdvDBH#Ca>-DPTS(N^} zviX0c!C_)xXaCQ7y=tuX80vPK7u82NDfO2>(46#jth-iwsTi>DPWv#d_cyh~xCM(9 zIoE5Uq5V$foyLd-$Hv>C6aG6tMc;CLSvp$WK zxcepJAGTm<{l|$zFF!cn&acjB6Q3`(e6YS>ojhjE#>r26BiZ$qjc0nWd^JDci(~Eg z=$}}zc%&DM=QksA-@?v|Pb|d;zCNE1dJbz5;vhVeFg*e!ngkP$G;rTC@90#3lITL5 zAxdIeUuxf^*|zzgEbM(P^~km;2s8Keg@VPrjRI%|kV)l>%k3}k*w)(nQDw_z7cxF? zcYwLPQCki&){PSGrAg99;YY0;KC6OyZ^@@CPYONBBVff@G_jzotS3s_j^1>$7U7dg z^4@cA9)e1$uNreo?f(d2&a!v0HgWd2sSl*R>D;EJ43OngM4yhzvTMmFf*e5?bK=|p zE0H!Bt;q&-;%7T{Sm|JmmZHbDSjS}ne5Q4w`Z!vLcEJcvz3OelX3D2t!}f^+q;!xT z_Z&WhT02a0^?K>oMbB}iQ!hA(=KsmnUuSPu@bjZ1it76D`2`E-A#9ZgfFMg4lXp!C z;un;hNn@7xEDUyFrGY0tij!qcg%Su5Y85g2e{^;U;4s)B)@?J?&O6! zpArfz@av`0FtGc%D1X&*&OtPhOX2O%pPaVt*ZqD94m8ydZsVU+>ZHy^aLX!Jk*uxv z40b%zQ@hauB&;ug7Z-Y^#etTAD>gsRqqXD*|A5yIg)N#iV^l!|f(=Fb1=#sp4Ge*0 zBWRWV0peHNzLHj$(CV0|MfTH!Z6}13{uYsv1nozIdzVbW?}gl`gx_5;b7nHuYt>g&iP-d4i{_E)})5i|YP{6WFf z#}x@M8HyK^b{&gGfWfkFuVps^pr=f(&O}e}LQ023TJ7-&b3h3XLx8Xb5A!hi7iQhk z37P=U4H!DUUCG}huQ~782Z8p@$R6JpN=q|-MQP4KA5`Z?f9aG+8|V-e6RRfVF8Jes zqtNtm+RHVDA0gvGQidTXG)Ouyf%Y9(>V61a6uefr+9$_k-8C#yEBrhB-~}{#&C04) zRg5_|l;vh;Wcln`8h;q}6dTScMl&O)kWn`0k}aH6*J;`3AQ_JYNBdw3vCJIsyX^jK zcr^c(Ep1u{li=ER#-2kN*;7*+EUUO5LT$=S;6>M8Si()-A$#jSk^x<;?YFy5S~$L! zY)1m^qJ%9XMC6sB5oR5oYj7`XIiz%PQDRIX2!FXI>Q2?H)|j=Q)&Q{k6>G^1cf?d4 z&jSGM7=6!NGL6ncdE%t9l@3VigkI%(w=%0d*DHvg5|W;DH@$EOyRe1amlGe(0u30P zX-oQn@CdrueV*!=crSxhw_bLazgtOuN|xM?q;;hSK}WPIy3;n7!rQ8kTr_jP+YZy$;zX_f|)5c_yXIrJy|OV311~$dQPmE>P4$$1wv3r>#@NZ}SsKzz z3(f*?;94mPD=pWg?8A8)kZ8dT)MyjTq9xk!#H8VH&AF6}zLZ@v{N#jgBe682aLAM) z7`1ixN>0OUD?KvI$+;VR(vbL6>jpbe<(r*+aL1r^ZKE;Mo6XMaloAi8DVY-AipHKa z3{;hBzub5l8wqSGO4OD^5Y<0ZuV65(*G)WGZ4=k5rW=1U?a_OO1$6)N-@2UlAaMJQ zUPq(hBH#y!8Nomj9vqWsUPPq!D?^?%E0IGPfKZ6(ATTnx%_H-s($nHRLxlWHgmslYi?$0% z%6q+O!BwAooU;-K~HN|FhaK_!ONpX+AK+Ez~5uEMsC z`IvrZaotPW8jtC5zAt`Iks!z~tKP(47ks~zMyJvci}oczA`66$;!Ti~(}IZs5=F1@ z!@bmJjSY)inCEzm=Di1y)!T*Vz<1Fd{9!U@?%m?gSDI!3sk{pHz@^$3Zp8(5$) z@zJ!gi&$LqwGo6g+9CxY<#=wy^_OTi6M+X<#i2>Q*FmGgYLUV0x0&4k3{uk#vyNKM z`IwzywPk^XzT0#|77*K9#(MkSCQr+&(n6l(8mUKf6eq%aaKv`tAb)5aJyWAU9l2pX z6<1y_1tIbOMcSKcOsV+<>u0~L)C+_Y6QS~Na7Npa63trCY`7_^An`08!NH>~N@$n{ zvu_~5kD#HXo2*JZ`Pkn*P@in{Oe}}Xf35&j*_aDuYu>W8gel&CXrn0vErTm_H(uP- z+gTvQ8Yq~ht5<*Aw~pdr=)+*T`8b`83Ae8u!c3J8N9P-%B5J`5#aVZDxyPnB8na%(2h=xqUDyI& znq6069IzyX12xrJ@4~8$rPibi&hiV;%IPa+S4ObziC-ebt>@${ld!kP74t9Mc?xp_ zqh0Q_%@?|W@_s_7t;Xo;SibI_gCyobk`OrUCF&Liy(xZ7=;{Nu?fzhOEMA$36wUKB z8ur1Qw5$s~RZp33*eE*kjoG&02jjG9~6re(>IRZQWUcTx#mm(_@ zv+5_a9lGY^dj3Z>bd8Ivk3%3yAga84(fS|FjlI2PNVdzdfy@+Jsql-a2QVv8vN4}P zP zaZAZCJ>{!WQH#b)p_*quo0@`Y!ml|`Mw<+Ra5|j z9H#j|!QR$o@Fm;}MajCZ^)FFe=(?}mA8VJ zyKVi}FTtrxWe1e;bu5*bl;Um&6aAE4GB1fDd?ufqjad}LnI;*}Z}hD$>MZ#a$(Jhk zsmm%--|CbhFLSQv0=#$oxZv&k`Ndt1I&IwNYHXUi@>rZf7#?_rCr1&c*({WvTVJeN z&20uYdxEmQY4U{Z#1-A-9;!+;*-B@vjyTCf)fBXlh@5;)#C{nQMkD#zwkegLl#N;I zd@Oj(-fiaapX2(KT@I_1Kh&W(UJ%K9*#qfjb|!E6QC|uJXrXJJs=jUJW8L6ChXD?k zY<49jVDDKzJZ3UwA2_%YWg{Drg%8aNC?PHS8r#_WKdSe3wa-sKP)`Wa>q#j;I1!=C zKSbx^R?*8=8X^r0kv}(MSMe_wy59h{MI9*rXY0a2|DW)^|2v__$i%|&pIetH4X)V3 zHiYRfszD50qGZv!wCm%17 zsrwDU$RppnI8Abs#CwO2WW3M86*}3M9n=HI{-d1vDD2$2TpN=4O7}DC_AIrCo z`v-#Lx9?Kh3A~?uv^vra=!w=D8JsNt(-hkmUoU=0f4Wjv&Ri`}pNQO(QMLxtI9)}~ zpN9=yv{ZGJ)HJUxtokYm9hH0M6G>kgJ5qvOtf91NhOtC^y0;vBKEj=Bo7*Gxf>8ML z&bsS3W%Dg{l}5R)@$jaG7sZ-JG*nfRW?2p9w})0V7f9aB-PFVf(v!tYr$$yIOP(E` zyBR$i1EOcC!FaYHeU4zOET}C5YQS=t0@+r$7+WjPg9^Glwd?$2n7{~w`_*a`Dj3$D zpEU7g5IazN$w^bI5Ty75&jCsT^oTZP@}18YSC3Sf@#!#9J7!hI*{dJ1V)?pOB?o{k zA#)BAdSne+kyc2`j3WZKuQ&~^YcC1z=)0{nuq7sr?)8e4AjH@FA=z*a{SXPF<;5y> zOy2eNpL7|qF{gkCY8V_8`RVIHwiDE*N(d*|7(YzMbrClQrrTu$}p$) za^17zL$VeCZM=PX53O_OpDL%DSc!)PoO0()A{lJbG04q`Z6=DNp&- zVexp+Gdo95oNQLM<8rb}#KD9*ji~5q#tvp$1qHUE(K$NNAn^y{+|lHje2Gk1S|+HG zMwBl{f1cm0vnWu>H%L}wgWAb1HAu-eiy9izUya2SKavj5DY9k8iFg{{Fqp`rg}b6) zouUdxHNWs&(%-!=Z&Io-*tst2IIJOTDQk~{miV^*+uS9x9wx#v*oCERRuP&Ybx(TX zfm;8rYGt>yT1H$>;#nc6ztR@W!M;LR=ppgB4}|{ADQ3yY5HrV#mEX~vM^|A&d+!`- z3EA`yy}z1Ca(eLJSH_3e!%uS;IOso`0mHII2JT=l${Ne!#X+BBox1P$PJR#iKj5HJ zz7C___@=>6bG5Q9|9ncxJxPbBBD(ecFjEFM*499Y%bb5O@6E_Rta0K9A=?AqI%E-q zhw@?4EyvOS)@{*=yN9{RUJ6beKcPxZ!oVdb$s}Ju*?hcmU|!q{$4~gf5-ztPW2j@= zyxNYQ5MX7Rv+9?Vvx5)gQ|b@o(~S}!LwAvo&6~$_;g{J4TT_??oU{M@Gf}!V&Q!X8 zF9GxPM4yEn84!=>TuYAx);Zraf$Lwvzkq8W+H;~OZtmmF5lVO_1jcVAS?t$? zhbEu`8bf>&Xb&Tu6t<e*Vnxqkr6-O<-yxBb3aH3&^KgB`C3audKf zuE2%m2(Zh^mvSgUrQvgF?PVPjC)J=o9m@!)PLjhyN^5+{OPY*Mg?BVWQDhW%a2K>K z>{WrR;-2DC$t4x>szpJJyTF``;;H39?Vx=BSWMW*aVqjCJlS-jrxTinwiy#49EQ}V zLlh>pJL}mis#Y^TAIn|f_hJ&o>L0QfB&66Gt5Rzra!7bXR-r-pju5(JiSu5rexU4N zultW1N-Ju)A!2#0UM2ILx(ix`qFdI5Je0cPhd%m&nIg%}&&6?I?@<~rvj;e&^Hhce zQxmS!$%cmqzdNHdXgJoCU;yzTQFEv$_6*n(yX>LTXi#ID6?w&KGK!Ot>aq=(>XsU% zL}+g>PvXUn_(0VGlD#WCYaAb=fO(joPfC6wetP^?H1J@PHU+c%c`^cUGo{toDP1Zi zt28SnE3$h&r0=wP2l=2kZo+ujo~b)ilxsa(l&X%{7v`Ol>d?qYf|>t;FwF^DEB4BQ z!58QqR1}V}%4!sL70p>;i(p-4^Y`Q{j2(Y4O?bvBZs|ss_8E?o>Fr$o_Ah$oI>7mq z8(U>pq8AF2-A`hVt*s!HwOH%(Cj)^!ZpUb~EvOUB`VMDuilq;DaG!o^^MP1O@Y6~* z`MZr^kS%0vL-Zb>0N+khm6+r6_kMPsvRVgiA^5h!^Ffaap@V>21k#YyDgTO|ZDhcT|N zxoPi6_YsQdi#ICu-l7D!zba_>yvABI>k&r-~hof_V5iCsVzA zozNdkbW0(j{|b8n%YlQd9}ExM?|gG{;rgR@EX?hviT-0!!ngj@n2wgq8_on`MMc!*k6xYy5~_uDsFBRNF?w1xXm z)qFDQ_{GuJ`$(ps<=OlZ?1ea(NN>l?(gMt3#lGs`)69!5DvlWyrnr~Rg|-Kzv{yn6 zmG%)+1xf+H03uHf?g1U^cj9$f|I~tZDhTOUh+SmBIc2KqU};^olx(8>V^YlWaC7dR zhP2Y1yzo_I4A+aA|TM#41y zV+wub6OsG68TWYW4m$n?LB1Ne6-Sx$w7zi~(FK@XdQq_ZuD~%#>p+qv-tiYpiTTd? zsFJjJBvA7?)@jGwhlnGw8K7C`Y2FY`?|G}HoFr(5A8&hvHV4~yeq;;CTqp{sl10Ik zRNNH0!O3B=>Wl!Fk%ZaBbpe{-73@<0$uqQPpw8ZY4}zzxeTr(KPy`?4xptK+Ypzrp zGUsp>+%$Iur2?h=(!Aj2z$9KxbY#c~wRf8@f#bgv|NfCb(G!bej^EL5*iSnL`AFZY zPI15+QNL|WRm?!U0t5US2+?UFFv(X`F-tl%&HBTb)U{3g z6?Y(=|HTGkS>;{imdEemogi8pB4+?zgvor)k#@ahy{SJo@PJ?)1rB&5(a7-A;nkk(GSM2eZO zz1#mVNiJGD--!i*JTZYm0fQb2_4@|F#t#dLrqevsP_pjYMK6kC75pQ$|6cH;mal** z6RC-Tz7-VFac5TX**Z?l?U@!TcJ7df$^qoXAB!9;(cQ?5Ux@K~wRFte zi(9P2Hl}lazgFv;9##jNf>%h;UD0p0Zps2_N74si+JgOi%z^c6v zm&NK0wF~#Wz=MY&$riaabMQH&Hk?=o^Ma*VAf8cz2wl`%Vq1r9B)_82BL_H=mUL7U zruhg>tBj1BF{|AiY@?0!EIBOa&{SJ(6WoOq_x1ttDXjH4ejL1!?gb93=;f+ZfaVIg zpu%qM4d!l8gx5br41uh(nPRLR+X3^T>=J##-+G?#*?Fr2Q`h1>urf`t|Wp(;;1o&H4&xyu@nw_+HQO^b6i zYok>xCr1@SPX(x61PwSrKY{yZgtBEulpOGJxC5(e(wNKO`IQ5AhkgDYT%4WqUyBa+ zDf(bb25iJRGwVNgXZ}jXm*pw-WOKW0joy>_8JmXPvE~>nZmDxR<+j3%3-E$%rW*fk zAgb#qgn+PxqH>&i(1zDwA{7PHoxfRGK{={gSinmvLtqzdHA{smH)BsOh#PpC#q>oh zfMG%+VlJa#3MVd7F4gR20&ZDWg<$!Ezwy&c|QuWP~7L|JzH^bYZs-^?C zkDo~a=SM#J&6Zc}DbIp=T>CjeYkO)b?tnxq4}_-QB?kO&UXvWRR&VD>Upzp!a|0bK zE)Ejq4JV6^`}8Z&CmIo%!Y;ostw0uL z)uPmRsv=uJ0K+k%I{Rn9ZzELpVYCW~bw44|%vi24$!uY`mTQ!%2Zv;Dt!+(=SKt-x zr*XGlCyz^mM7pAzhz2}M0KQeFaNH$>W%tPjF|x0)TE)Dw&Ty~ni2f9dR|mr6XiSgX zNJ(MygNkd5^LbczdSiG6{H;*>;cfeF`jL3en>EivmT;&-uCDtUWCenx(qq-UCOLNrY6MzD#JK75N75<25c0t0rb zk|pF3US35O@4S7)XKtE8-v;5%dp?ajMBweITuO7Z0`w~Y;- znO!f_QC@)@+}M-41?=m)>WVHPoAxvqssnwtO+DRAfa$~Px@;4q2|Qys0A)PLps?aR5Rwy;uOo~wXyEFkEdokxWzw+M4 zYyDz0N80|cDl%Zgqz1%-KYt9MoBv)-kw=BBQ|Lae3y~v(n|2jtq+OMzB?MPPZ6qEO z6sq(~iR5*EeRP}``|q3#`$4OvVpq{|^C|UzfdDzTIQW`V1E^i9tV*dFQ!36k!tj)?QRErd&R+uJnw#JHuFJ<2K z73?x(%^4CH4mft%7ub~LT?I#R2?7w+nF5r<3GmjD9NG+VTw$Kz{X?s}^944N>vq;N zn7B0Hc2ucajA%eV75tbSiS9!8x?H86(_qGK5D5*=f5ylwrEC8bp$gBtbGxTQ4cwCQ zrk8}AS!{Bg0>B7TXz~z7bk#JUF>QvhuUl15;oF2`=A$SWL7Z%|>Txc3`5Tj47WML0}n$;J4Jw~F1H4M<)sAREa#56b1B07cXqm1`6c`jz^HL4 z8F!A}AskZGyqAioo+T@Ax%N;(Rs`uSsUhR8leislk0wx_2F;1ccEf!N9L@!PwV{YC z;znmQf!y3wYcWLr0RQxVgypV*)q zg%mAN!H=X>Ol(iRyCs1(LlMe*<& zlnTlwy7Efi+|DD;S8G*t90evsDS;m<;ve}Hi>$4Bw`PScj)4NV;-SMHru!w@m|RY4 z&*VeY3IxeKG|lNvGgji>c7i1Is`j6~hNmNrQc+^K#2g}1J~mXm7XmWnUZXr5ACqvV z3W0l>DKq!&1RTCe{G5jX0Cb3u_LQnhBwXrQC4jhl>Kh?oJ-;yYJPd_x~Bzl&c#Y0prm}W1WeVd1EnWWn89?X)J;$@qQipxE9 zw6ZscTACA@hJ{C=*T@)bfqlob4TCVejpVf80Qd2)xd~1wmM)BwREyPyG54sho{nRe zj57Jj*yMiFHi=F%9we`C?|yp{?mOfTk<-F*UO6L$rGe5q&bv-j1d}7k~x#Qi21U`kO5=un4M`a-B<# zL6gtx{(&Cl=?!{9^!=PHR)F_1 zO!QE>;*#BAi}y>^SGx&0kPTzmwDl`^rLQdg&~qVvl__ABbGHem9PGc7)gnBRhX%2P zh_86TYHA~S{d^Wu9C_G_(!E(bJC)G_Xz_RUZRhlE(F4mPgJ|Z$PtdKN#>8s+ETx*` zZCbxD5=^Bp;3%PlLQpP;QI8A_?E2wSdMwz5{ewO@;d`t>-M%j5lDJA1p=6puJ|j?X zo-B*bcL>4Z8aJ{lc5G*O)|Or9ufS^GtGH$hEmF8`+A%=J@|9M#rmV0LV9qHrrgEz2 zfMcrSSkr;~=65-y#v{bYka!lbk3^O2L6c3M;F!1i#7T7$a@QQ?;at8VUKi8c^*8I0 zDi*PS4?2XY};ux6k%8RGaKx5EK` zHrI&mO5A2355}6baC#cQD^C=S)ksxr@Zc>1zIuaZhKZrJ#B26Bt)`oVp2O0HP1MK| z@^2dPfUA8?oa`kM$iF2EpUpl-M8Wd*=uvB9p7O?JBU~0gJ_mfc0LA$K&kBZtp6P!^ z)Y3Dt{^#jXvBp%)uLrm1<=4YtJQ1s%(M%F+Re9viQtA1)R}_`FEr3zLg}BKM?z`Tx$A{_l>O_$-ND&*RLJnPjD@Rh0ogcWKFO((a++}{ln2+i7^9w)wU zB(FkXN`+`g8GI1(+$}?A@7WL2f$toV^s}OD{MfY+(8ByxowVwO42DY2`F>7bb@e~P zXctsRwP-1N95&0QF(bpIt zCH+FKp%?ocF@H(AA*g5@Et{ZQ1`d(t1)1JKb^EK9ZXqEk>|?Q0uu`@CIo6++8-xlC z)WR(|IS@k*JnJpEKQg{#aJHX|^O1)2=&IShOhZu+^&ZbX#qqp)C&7mrlB^-_-h2R{ zt^%w{ppt9QRj2bRBKs#ushBfncEc5`{p)~|0qQy-y`Ao3 zpn{WJ;C19ncs|f_#W2`uic|{k3dF1uTaA56U;&12S4@zT5m1p@c97M4KFsc2?Y*KN zA?c>QDe#h~7%dLMFBZaRgzPQ-3`6ig;zgh*2y+72Mfs>LqxlVoi(63Jflkb}&)ms? za_T@|yTwaryU{AnS!&2^vg;ng5kh70Ee8CdoDhrH3&-N-F0rdHlG_JAozcf*{=iDu zGuE^WQGaI8sV9n0$`sYLYRl(db@;6t)v=yvbETq$Xk`cCK56hqU23)#A>$(tZ3D zggu8*N+708;y0HY%`LB$+emLqh(v-kU31KbqvfxhRHP)R1bxmQGz-k{D+fQ5)Hy6! zt@1MGbmMr!H%DHX(-pMEu_wO&$%ze-IZmO)Z9>jPSz0<;iT78DX+r*5!C&uos*Wch zI_nN>A@LxJ+G*??3o0g3k&a27pA<|a#w}0Ir`4^8pC{61cnqh2anS|bRjK+IG zk{X8LYh+fb7aY_oU1Eie_tZxx#&H4Mgki9R3Z){0pSW1+SW+WXqb_-RAq!Kbvq@Ca zX|4Rj%B|I-0|I8)V@ok>r`LVUd=fhjG$_?%tuLb#0PeBc+?aaVyG|!&eP0J~MLD-B zDDQZ;rlyF!#M<8;Xn*Y-WFaX%k;Hkm8c4;C*FD^#WSZ7pA#kp*wrn5kLhEvQ0ejZ~ z-zf(sSg0SnPG~dcHb-uckxmjn{Zi|S7vl6Pb@}qY7(3_ZOoKSv$JRs>+qUhzv8{=1 zI};}p+qP}nwmHcg+qqNsm))(qdu#uLe(I^}KHcAQK8GhY;!o9_Cv~1uL0uk4@rh>p z>3M#}esI-w;=$pV90z&FRZ+;B1CA;eVqu)tx-)p8PBsePk2xLZX4OX;Pyz1zDO%9z zjE$H+&bcw^-XadZ^Yb+P>S1=9IT)Z(8PgO#lfukm;Wr!SDTvv0 z6H`!cmH9;&GkZt?oRieEsn>Gyd%oH3OC)Y|D{XR7YCys}62o2o4XcaK z?kYRK`3N(twnQ$22@LTZ%wTg1l0j0bM92_eNKsPXQC$d8e}GG(PctLa32b8XE#4QN z=%U?19)XYu)e6NWW0cD~(pHXY(n~AichBW*Xf|Zet;`L(%FGQD;eW!>$3D}%o3?QM z_$Zitth5~ZZLGUAnukBXZI@m^wqI{QT$FaBCdNyQUs}k z!y!Rvb*8}P&M%ST(Ecp<)p>jdZ?j=HfK_8On?dpoi4E~dEJdi z@L;z*`T(}BV+Bg{s0yClQ;NZINEKV}T}YDdk{WSyl4iIFj*r1=L)^?-Q|=SoP$ zOWy`ahs!V~0J{$nEBWc8vO^JeVdG~71z!(M(y4)`l7*5Hd~9mM2W>4}^&*CzMdB56 zh}&5$oxZNId!KEEOEE(<6BN7wR-e*K1x++mFo6MXX3f|D*I)<@Lho~1qOUrm4 z?lgd&(PzJF00Xv-mZ(6@#b_LU!L8n#C)mv{X>70Y&Zjg%XE$oEQD2Sead8FK}WHx3-Ttxw^fgzQQqf zb+30~)hCiN?3TQbKtu{<+L}+xVj4pefHgOAh!G4zQb(e&a)$E+;=fPN{uGD$aJvUf zjA4NM3>QbJ0IC<<6iUmd#iO`_%cqcV&2Is*f~gxnjz)rzQ#y7{a7U8Fp}Rjm5mc44 zP&n2|@COm>FTwMYLnw-q5m8ok$p z+o!-BuTe+?T z)1eD05;oHU!4bWN#C>0IpR62m1Gdy^$D9iI?=u`Y^acrPD4K5=L5~io_r#UpSxAml zmJ+hUfdwl`Kjt)rARWb%_oc9<$ie~rfpKtSXx~9zVsJZQl-|Ek@xs0XMbT3|NWxFr zhe!jd8*p-neHK(Of|U*!8c1I7J{&v#S$In;Q{c{Bk~=1HazJd=xRr|sP8#mc^cCUi zioE;jl*e2cEok~NkGx^(As!dH*AS)TWo$ro6*X_5mC16-iKdhj<}{T#0e4!ELCSJ> z`r&L08%;xY3$XFQ2$Mz0v}28`AMkYbnWzl(^_j{+RDr58#d=;~ZYt^}l!lzHUYs!P zssj9=NvR!xXOXJ%{8u{^S1PpBt6{s1teRh(d34e|EpyGX{-J+d4|d^5=>JHqfod2^ z3lw6;iB5biLSD3oX^?$gKk}3 zRiz8#Un*;1{Td+(E!ymqwd$24Ae_knl&UVqk--4W9eY1|gFIYR7etigPN?6I^0^DR z+i&e7RI=nb1s_kTwqRu<1fs-XvW^4y-pubeukd^O%@*8K#AAt@OK2GhN&+MH0P%3n;4}PsyPnxz0 zCXUSxBA{pD545H8yM5ZccZ7c;ka-)hBel~(^>~)Vz-9&$u zKky0uEP4?_rRLNN(D*dyU0;pPKc)zETpQv-s<%H-bYnE)A~TWe$@uO#yN%uTJ6CsH zZ36E0oVxe&-%Pgh#k7^X+_djG?cWD!1UHkDOf$X^aMtx-vWB02tp(lO+arhRH6koU z^!nbRa)y-z!3Ce1^{?W{A3|EBL0J28fqWJ76^B zzbpU>wVt-;_+zAZg>CV|Dy4?qwwr$NE!Lb4TDgO3iZ)>_X}usJXwQP^v?0~88=xGx zvf9N&L7d-o;2dDR(<-VbN468gldT}=$ViBHK%v?a#JR6wE2dYWLi+0hw;jOgi6EbaoDw~;c3Jr?O5m1N5Yj{S z$+RfYhrAwx$||17!Y=X|Z%P`TBf z9ZyZLdCbSaA9<9{Q#VakjJ;reGcP2Dk*-J4Fu=^?xrgaDkI^ghonJ!vD(#*Vx(3cW zW_NCfQ3z;q2v1^~zkcXxr*!;y*%*k&WjX5<-wM&Q860v?DrT>7xG^B^gPYI{B+i1e zD497f;16wk_a!u@y<)qC)R^lbf5&(FW&Mr5@o2M7KVaA8Na-4#6e8LtwrChov4LfX z;x_qS3)+B2|HmwQ?5Ow{^`qJP*YzXrs`}dik6%WjHE`Vm+}psk0b?`uXCM15zhU3V3KIl{ zO>aJu^F$p!QU+<_zQH4-qfa7qN*_`-ia`VJ*x-6|X+iB%JDVT$Om2wi;sfWGvP9~I zJ1fkLb@7k#@Pux)k%$J=_N`VV1@7Sb>rn3zLE|Z^p=_JTsR$OazG*nC-d!+970MZ+ zELs%Oq>BS$skvVgK_e3%&cwW|-x${63)M}Y^&FwLYr$V@)q^Mkatthw1?wEpl50W+ z7L#rPvajHIm0GZi3TwM1+VM5wP9EqVPWx*)v@AS)+iTsS`&_sK2Wy%Qgt+&77&GHl2Q3RY==*%78~%d32bC z1lJ`O*mc?~S%LdD*h_~syeptyGH*MVa%#fjkA)LwM?bhvX!3__G~a%7b{f*Ls~t49~=>SdvGSE8)% z_qh~P!^+3l(o@-4t`&1?JzL}6hS~6F6XcX&MumG>=rW+~UE$({qh{U)!MwkVh<$f_ z!4@dhB5JF!`v2K{*7}0+1=WU9**eRpR<#;0j1WXGD3M^AYk~(IXN(PeHmf`@!c5iZ z1^jw&`hT%cQefXMaRL!#Em}K_$7xktXiTdcMcDajF&o|5eb7dk4SeP4Sz=gSccu9>8Dw>B5ETZQ17|8&_jxnjz&#ov$*;lPSgw8sGn;GBreYXXzWCHi zGQ#>5ic=@eX6_NDY+t$ZAuYCe5ZLAU%F&K7P*YTfOqxUFi;nJ7$Dpa3>l8@S5Abyo zsflPh7}n-Bt}ndZLekJaJtxOmYopO5J#ky>-wSrO`2Lej8)kT`*A|Pc8PAY1*-QcrI3?nJM<>v$f+a zX)MT#2QT8cWnYGG1Wa?rwZVUkwfc3!_p8IFwoY>fd2sE_rtV4wR$?OCnxtW;cf9v{ z;I(ol5`icWO@9(!l(=V|Mz%E3;QrhN#h*Hdnu(0V@~I++p}zy#Q$?!jTN(Q=TQ;J9 zM@zCt_!5Z`f<_|wC<7XUTDF2McW>COXNuBfe$226}tB1=^ zrf^9nLJnR*TLTHnjaXU9?RpeOS$({@__`L|(q?!AvBA_#O=m{4mkhuS z&6OAOPc8Meq+hKY|FQmHach&)S&9FEZfG)0NRNrLwm4$x=iLgbm1nU_m3>NkSj`-8#XTn+M=8$_nRGo`RXa(_Igxe=B1!R@f^*^cN;R}kcrQAI+K_dy7w;+ z<1YZM+RlM&=ebdL4&~i18G=a9n(4Z4n0~L74OuMrQRL|tuUskjlO^-iHwvwv^RFGS zPZzAFL?7#(2uwwjeA@S?YZrcSm1@he81VE8?gIXq9u>CglnoCm0c_2b_G6SgXord!`x(KC6o>! zgONTd6v*?~Wme5u^~BsHO8?!@7ARZ2$>9$bJ_Sm@B}V z#AA|U7`x?w{bHB5{x3q3Yw@jT;6|{~qO5r?LXftOzDQI_Hg~9eJS^ew!*`2;!7zEh&s*KoJF2WDK7l~VrE4_ zGhefw;Gr8viCEb~u4GNF6x^U|OxNKJ^ZV<)?f&5*j8Crr?#3Nuz;Asj*^i=>2RGGz zUAi&tx95|SJ)+SKArRP&swQiuxu(C#CV|vA_zfg5mP5z)9i!(@dGwnN zu&Jc<;!Kq zvnHn7we|1lBfdiRya~kU>v@-j*OqJJu-&IwOO_zV5R&3X{~|)=Ub%Jq)E>W7#gYB7 zu9SP=8RBuz)zSUinCMvSJ6ETgWM3?k%<7O8T-;rW+V1aj8*DpPc-V2R`vYTlADfoO zxd$U<$Iwd6JNF2N_1lV*JiVQy>ob!9x9-TULxtUF74Fc09lF6%qIEkA47e|&j`g^Kbw7Z9iR3!f~tOCYMNOV`)Oz2o+o zX$j2wd@*iCHZCo7j>szSky8tp7w+v^gctp0%W59<<#=02M3$-WJ<0jlWz_%Etss$W z4J#`#seM#UQT1lj&V3~ypB~xU=OHcryZi(CUX6s>CsNRI%j*&3BW3Yy}hU5mtSk5)h~qQh+YP8 zFq;@f3j3d51;9+BpE>5OLG{vtL8P_WFQ)>*Rcl_*Rh{{eo;)&wv>ocx9hR9-)LqUS zv*mStN8Q1|xaPV#`#1TP!6jK8+nPd9ro|Zi7w&(9!#wim zyZyjm$NBj=b3>lcfW<3L#N|}B?{JdkNj>>2PM_enbntM%1VflI$@z8wujhX$(91Xg zVV~-sn%FQP)yhSD_O%HXKH!yj{jKk3&_e*g7WDVh^ZOX414I)2*4E#xbSVxI>F(11 z_D~`SV8|BS_F530Z+-F=e{*nB^8tRoodRp4kX+C&rG30GZFP?kYm0yYjjw++z3ST^j0q^ zjOo3dH@Af&5_yoQfg+oV1my2}b1&^Lj4zQIVI2tkP|17$&AVT9Dee-&wTXO$XA z@H}>{(Q54Hcf)wCPeYt)1O@onJqH%A$$B|8T~6uGQ&3#=1C>B%bo$M+(52+7j1aQ> z)|5(}!>YQwJ~W2d#WEf?vXT(`kPS2rS&rZ>vZE%rD4TZL@4G7EhKDCjB$;j!jgDtd zM$N(XVXbbOR-dsk6hb2eDXuLk2j*c#^YhU3_Z$}@}#Mva)f!e?N@1emN zyU2iAv_ zP~W8;v|P2CtNf+)JC31iI|Imfm;$fo2$Z>MmBK<@q5_}b4V_OiZg)3bb3XD($)3|xSJi9iQSG@Ef%=HT(JXaP6j=`5MD zRc;#{(65%vTC0YMfu=xzi%TiY3x3C2uP#EA+Af(e94bL~Yg_!W2!2{7ztI%Vgg_$6 zuwde8ZIf9|q*AI{QlnbRI+w^*Qw;5xT7r;-Yp;@))(;wD^8S2)qO7V=t={8fI*ByW zW63UCE^ifobB4b3UL_H^MXo=2-B>k9pDl3nbDs?+(hOX_zR92`!vFepf?Hd2D-cs1 zynI|?)0Se>|eMJ(F z)v%sbpAVr*q+fvEr@mQcJ-V#u4lisWT;D|ppciL7YcZL?w)ctI3DM9BT2KJrd+j{H z2ybT!R5#qH$Y4&?NCP*JCAC3kdJtsHCf#;L&6FcW7HpuTDQTWmDKl zv;AmjRIm;xGBc@6^YL|NT6wUD;rEa_6V*xUpoEoPZVSXzj>6eJ?dy1e9UMeGHYgUP zlv9>Jig1crS)0jD?^a}!c3Nzf#E!~EV*9#y4X{xp4oAXhJ94Y#iCz@;xGqj>H>+Nva z07&D$n*&?{dn&6jT2E!RSXGb(-W2LLOVL45;Cw_fG|=s z2q7E5u86AI{K+3GzCCd?$mUA!*M;>N_^i&-L2? z*33Q%(VYo$+|WtzN6gau+n|5c;4j$!Ml~?AaQw$`{(sILvM@3I7wSW{)?~~D2h#Se z#tSrn^juh4s6Psn1=K86`Z`F<#a+#u)ji(k?mfS(^+H*LlL2AZZJca)bU(lAv%a6= zjL=5j7U^F&!TVbn*{=lnJop(a_jm8|Y1Ivsw#g+EE#d2{9$U<)d&d9U|K0WdI6vw2 zt2XsA_j?6b>W4|d<#8bZnjB>L$?5$PZU?JFwWss50Bla>y`FSCYm4~n?DMNP_1lJK zPCbe8_Drv-YXaDoP=l-Y`c2^W6Y?*~kIxtZ0p?rD4sRIuqRt6M3%`?Xez*$z^#=*v z8Cs2Hh^w!eW{%Xj|Rn0ClQwq~R1L!S$_KS$^yC zPtbpj;2$;HuKzS1kQaDtK#nkaiGuQ^f5p}^b(YYBNqru5Kt;>d& zV{K)^{`hlGcW0Adql;(xj%c^sb)3<&_2m6%yC&9fp9T!-K-1UTk@h~_!-!so7P@`J5A`rny_ zR8Wm~J&)D^e(?-QjjXiIy&}Bu1YF|;Y!MQ8LsZ`$%9i#ge$Y=tlUjtjh>`$T?lg_%k#fu*amdb0CuDx5 zf$GhU)xFjHOB7~?Cd>mIW<7C|NU;mq7XGF+x}M`~p6Gdebiq>7QsGiq7JDSM+%g$? zZ*YX5+jH36h`T&C&+XtDWb?!cWu6R}+_zfh$b4>UA#gUGyzS zd;wHhjXN-M*15XtZmOvz(I{DW)W^+JvaI-iMiH5q2>o6=P48HA(GWC-@(i z4b|l|uCmSAO#>*0!lIiV-ZKxnZ{0X}wyOau3#}a2Ura0T2cDlpaZ!l(L-yB*Olvie zuBtTQD2Aw=^4?B0QF8VTWG;PCtul_0C^`j6aT;j4|{MJhcvnz%NAQol>}sYI*H@TWWY-04K3Jsqr!?%>n^~* zV_XrQW$Efj2aQ^?VSRm93!?*RvN7SxwyO;MCsDj%J^^`nH#Q%GoC5)+?iOyBgPn*+~BWFA77U*Ek9vM z{73ULgOP(Ug0H>%xh{jRTh1y$rn&!4AaJt%uLJ@c8~cAY{#XCYE1Q{;P`t zmcZD2u!zuzTFHFjoyw}6rIFHQ^!>}06S`b9K7|VvWj4`=j}Ij$7I)EP6TS@_xU>#K z?iVi^zxE~lKI=Wdy-_E4GrrQzi1LfFtKvRBYo&2X$I3rGXU|s8PDQB?-~D$=um9nY z;|64q7vCk5k*NCi9{j#95wli420rXkvH5RmAL_CE8l3`fmfMe?pK~c5x-eYm1h%cI z^p92B5)9n^j%SfDaUse`=G%tbZlaLBkKCcZj9&2X5ox|oE=XZ2+?6^=b&pqg5C1v; z4MK!B9j+xk=xOL2rwg9M!?HhadNyRz-rkN!uYlh{_CgkQb6n;U)F?h~u}Y6&JA%AV z?joqNjZOnzdNvlA_LX{=*@6-}P@k?#sll#eI9P#4_t_?m?XKG^RS=%%wfE1~>vu7L zNYW@s9TYf#lvtqE@?g0!XqRh3#m~L#)I;2)6fh3;yv?9H`c7J#_Y^%h1*;)0nBL6` z3Ag(D(Mk(Nkw(Z+HPuL>R&7}%iQ~AK9T;Ybs7adTvJuoXZ_Zq8?J!z)gc7&msVobl z@5_wmDyST9p+wY~HQ%38>RfV(BK=TwI$aDD7tALrGqf_DD@4dwBQ!XlAAZef^5>4d zH9D(;RHjwbXTBtJo}dmWR*g@1;eGkBL_+KA?KVTTS(>p(GhBr9b`2Fo21v=ME-Z(D zjXPN|tkhg7HYmM;xQwz8&X(J6iFUlNQye^qbSA?v@yI`Oc|w&PhFr^9(xIH8J?n*Y z8?D6e@vgMgUV`xjQf`ZA7*=1c`muDAcApKx~SvuoQK?uK1;m4nCtVIcpUf9wNJ|^BS-U&!3~U&5G^y zlJ4N8kN{$ZuC5Ae4o$1?%@ek;pN734R9Ec4u>`Buc8jP&4hmpKAAG)ok_LvX%AKL7 zSZW|d4w5b$FH;U))0*@+pv|k!tBc-sjHL`8Y_b6RoBJpln}KneW{~Z$G=Ftr%z9s! zwmD!&QmI7mPx8UVg8AbPm+%sNO*5!y05=2CJeakqPLv%nF87J_>%5}vpBbtK=j~OR zUxa_(Gpb}#GV*FqDTv0Kb`FHsX3_ij>NHH-H<`#I?L#nsHpDk-vK;Vf*rCN z63nOB`*&sdY_p(3LA=CNwqvf7U@!!?LVDh~=?pt&!74Rr|`f<|J@hLCA@UPYPhfp-?rrAR?YXG*n3P*Vm$tSNv-* zVJkU6i>2FPwK&%CIwud?O*d&Ru%)+T;z`+}!$Klsm3$mLm71WRIx zWrOdQ>ud8`VHIkezI*$J~ou8s3|6;o+t0Gl_Zkd_g9AYzTc$*MYx12^Ob;5>a zx5h~P?-!-~RLdB51F7%{l}5R)Qn>o zAkn@m!ZBGegG@zj;Le+8K`dNu!Q7FKZZS-@rREsg`>wr*aMV>;?lY(Po+= z^rdOBMW3F`4Tz@#9{HPaF|dg=cB>aIVV~3=yU;;PBjyB0EycFBw^Df0(L|goG&fZ< zPDTmVa9Pf!=bVe%EgH1zJ_1|tgJ{Yv2IaO`lNqOXqm_xFThwK5kJ^^-_A~4CkF?bm zM)*X0XBv_7dn+PkRKp7V_;IImxF9*5XW(Hhkg9p_<)@&7et5EhnU1WKgQC@v$h5g$ z-E@c&ZI9*@Yi|td)y5I}C6+Ta_)m-Q;;MnSL$6?@mSb6*e>>b>K!&pC@=MQ$d=ma0 zdJm9;6IPIEcIOJzm4)OE{E#$|mC=$4v>>Y#KTq<1r?C5O3?FeasMq)G8X)9b4}7du z{iEB+=x^tSMaAPrNHA#9H9qkjUC6|bEo0GeN3>X&&6VyTQocQ>fZm z0DeoyidQ-j!~r27g1xPr#;7jTuxzD-T^S~HSE>^FM}EyWIiGjMOLDOP75>Y^cXWcf z4{U@cCzd421l3`pU&lvY%gA~5(noNq`t_%-1?w-K%H`{Jb3^vNp(y)3WH=(*_M$^7 zYN2CvftSi(d+rw&`-#N??l!-ox<>~~+h1*VeKPzA)Waqn{2bJ!oyB4MsHo-Z$39PX zeFzIHJs}a11S7$=ccS-Ne)^my2BJO9W+=M{Mb=)M;i{R-Gb|X~7)B_|rZm)?vM@j@ z;>4p)IwVd>QD}Z7nThyx5)X>*c6j86?5v1WmrHEBJUTSWPF8ETAfixTrBA!gI_$H%;KOJj1;P%8yoz4O4@X@_n; zL&wlNvh*jQ@Gn+qkv^j`cP*Wuv2=o6lz;Zpb2ik~#agyMys^H~J6o%}p84@3YtQh> zpws$d_cfyxli~5%tySzi+S?pu>vMkcWHPfkWWYH=T>6j-Dbq4+jq?*5H$yx3(w`tA zb`*+cpe+*KRz2;Z#FL7P&)>KqGm2?p%VX_RileXsqWm~cR>bA6t@3X)cvp0oUEMx1vZte zBBwCOgwTCY`vGlr;KQ?!1db|u!0{K+(a_~^0O@dGcl2tZ#&p}Lf{wCgH|id5@CQt^ z55%}gBsTZpsW6yzeJ#8{giAX3hlnU>wshRw*cXU^1j5Dn7p}gMbMkSozs3I7I4JfM z1zOX4d^VkO)0~?HB9_ZX&M%07S{hynuddkiTOW^^=Uop*v+xz&z{~O!b^}}jXP>l zh5_k(S?ki6ftS-@ykpQU8QTT)5pdMa+h32~@=8e+;`5g_m|56;=gRS}z`Go0`)w~p zQn=Da610%Ubf!SaWa@oQhjcUBeIGN^D%kWvQ>7OY_=QHI7&-V@uk}^zBrrw~-8mk8 zac7;OlD1*&2xXzx{95>QIs~1(^d!hfSe8V9ioRkxn{W0^5ql_kqBP+qROYxLn+#Iq z&w6wgazu6{0Tt~%0Z`Bh&Dn&pq{JZdbn0tkY10nH1oCXlKxpxC6YcUf%#=C(#v@kS zX5(?Qji{jFxHF-~yfkcLElM%7qGMkXvyxR1!V%3U3Kz31L;C@f5ncc$M`Or8u8r3I zfiF{6WQGV;#~)YXMs-C&-8zORVpB6w|J(`PAyJ{EM5P?Ibd}o(5E5C!S}^HDtx~vO zfX}3{EJ{VN&;ZAOYtesj<+%skuP2RnT>))QZ2fa5yGXZ0UZ4JseEeEErsZf=~DZ-@?rWNv~wQ;TG$XH-WNHTr) z5Ge)#kuZe?^sm^xm6|_r|9rw9o9eM z;si@6!aPLc#To=Mz(fTA#JM1%QPYn58S7RRLr|_o`>^LIz>u==zyOGNZIej*mD1w= zkhr+tq9#xjcB`2skU?6kFiBTeiev1AeB+gJLUISqoK^ry?`7N%03w23S>j2A~U_x@z zzYvQdhmV)68kxVw%tnjD;Nc`*Pl&>fiJcEGP!d!gC}6KLCykkqL1hv7E8IssiJ_nz zgHHx?qY+ycv1G`+G09Mx)RelPIg45nwkKRX8Vrkow z+aRU?Z$!~Qq`j3FxmLeVG;SC}!lND;gG6{bhaDv(TY>e5$tK_8Y=I5xBm9t!k8oHh z(lSGPIB(L3aGx#|DggRA^1N?&U+*YcLZ_VFvdGeks-SWA>*?fkv8LnIuhaI4^BSqu z+wa}E`_toIba6-Rau$;1&%rgPVAo*vwcQu+q?h$}+nuu)_q_MIa`$V@zgGSIv*!Id zGc(MqmuKr_(#+X;&2Nh%w#EWIRc;23pFW8!EG z;_GYM{rkyU5g94rH%dueyD1Kd4?)m(vqfpr)Y*ds1~+zj^w^)e`!bChpzr#2bt`3a zG@X+|Y%op{Z$jzT0=aJd;QfhG<*R5b-6~~v)ucE=6@z&+ERP1W&)U{nI>KZAnR=93 z^Lq99qZadvLrhnkFi9z|HNFtD2iq5>{%qk!r{IU3L21{WCtgwP3X8JX#;jG%U44%= z5;E`{u0D7oeF`^kBTO0gnoY9%Yt82QqmU)4W~boRVAJfiX5-uEes%Zz_Qdzm)Bpak z#HY+}_4_sd`~HwGcDcGjt^H%|66w-TFPo752#8t?NkJPPt{tnQ99ds9A2o7-Y$Y_NA`;- zR1jW}Wn-#Pbz6NCj`-3|ObLjR@xv&3m@71Rn&bdWQ02n=+w8VSyXKs=J1=Da2qQl2 ze$^1g+K`p%Y>=@SO#<8ms3>wWX4XjLBo8VZ$6Z2yPvxppvr%$3(~kv8P9!&oz?-V8 z6~F*ddjsN3QQ%*8#i{nWUw#cq| zPQQ@~fg^j6OvJ9e?+c0JmV5FW{NB-rQknYg{PT2~hcRwE6RgRd71016-7>SZg1@jV z&IPNCSY*b>AEr>EU)882zQwI3c%8Z>OZBw8I)|G*Fy8(f&dX7ih$5A|>G@yWy|3&2 z_<>CvYe;nO^5)6ayKQ^740Z_!u@fx4i9XT4EwcqW@ESnmm`zRnQSMdMD!9DthHjkv zTjnhQrG$x@Lva>-Asv(3?bxXMCAi#N&#uF)^REE=wB1kxsPb=z{nL>LTs6F^vV59` ze1m)p=r3lYL%*S_kII&~yBl(B6o|$l1QqrpLa8rsD6fS1V~Od)h0VJf>KW0_0xdZI z1t}xAy|x(kLV)d~r9bDBqM0BZcY5Cvrh#z1$P`-+BeJdOk_AOMTN`>?Bt;+fUkI+^ zOiQ9~KfT^$6b~*&CcB$Ed10?$n;-AqxSGo|lp>fiBBRtM{Ibi;5@TcEK!- z+A?hSPH05-Iv0_t%6(**ANG}{CHP9RK^Fs~+*w1ay1#aKH%TT28*Bysq%P*At0R#~q$CJ6oGicU6u8MYml|eUY?q^vk-q{`nbp%$Cn@ z@4*%)8s$NKy{{U_vv6~^vZ?4ei^OW0zf4{3@Us5duFs%K@F}yCCiR$AYo&Fx>|e!Rwrx=zO1!o?{_skE(QY0GGt5Jqi;^*A`X@_e$*~i>!@6PLP{y6b67Dokq zqDAyKhw(6Rz^0)$;7)qkRmJ637F$pN-$?L&MB@y|1AH>K(iE4*HOFI%7qo^JWgu2L zJ2LENg7=U23Lm;w*H*%73A||xjd_%(lcv?heBP~HLA;Gyv!Of;Wyu_~Och#&AiF)< zN|yBpJ_%m<(PK7g2f^5=k&$UmxsB_MQriZXy}kAr%KJzzJ_|BotZVv_#&wA>+wKp| z-Bk^a_L$HE?XpxWebHu9XHDZ3=8R*c5|+7apf z+TA|&&DLWTheAVkqOp(YQLP^hA0rY-yyFQ3I6*$k53BI zb{gbBN{UnL@ibEh&j{9?0I@M`yZ9*#Ob(cHgNa)N_qr5emdQfL#tryyH)xa|+RgKp zF5E?#zkUt4H>_LHm#=em$* zmC$RjNtxQ>=Y>Yzc3%Yi}*tTuk zwr$&XPHfw@bzoOHk+f4333& z5jH?+p4$K)`gGU2OB}44HrM3Z6L{j`##7~bAG(FdmfaskgM(HHe<wqBn%GFGi4UgVa!m6*BLDiCn923f$x8E2#v#tgNyiA|? zEc3C+dgbEWbI`$0Ig1Wc;+CO>j=J!kt~u2%ozz=R-enZ_Yrr6RgBz(?8yd9*myAd+ zkk>G)lQFaHeboYE@Zvp)lbbjV3SOvj%a(-`C~!(4ZA*rFw_Zol?^*JTyJY7#c2Kw_fQc>TsfBlC^c-yM2f zTzZJ*P7d>_TV(8XRv4u+{F7||8r$pkw`Dz^D^O!qbJ9InK9w9cT~Vb@yGlvJiLV=4 z_2q;<{6^TauT`F>mg$7k<=hd+NCv8S&E2V%>b7QEZlU8ZwYJVqgVGqgRb3D|x}%k* z1t`m)Regovdb^1`}zpj#{)BE{4;crKa*E^Uzy)Sm;-I(~)<`ecjgUH~6IiF)E~>%moMU^;Ye@WH1ADCmEEJ$i!3L8IP2=m{&41 z3UhjM-Mkm4FC+0(r%#xtNppeAv@i^YY2Z${+t|%B30-#>hkN@`PFj0L&70Dx+uU8n zPd_m{*m2&`;Pc0)R);S2YSC_&r|H=4sp;&QhkbL0^pB2pT&+#rki(tZyxNPZwryHB z+4bA;xE%<1z2#Yt=qxdJ;6-~MJ`)Gplmdi)<0P(%_+{UmoBH*I*(T|>S`;YL!&Og> zJ^V*$w^^#AbAaI6+hN=gMDA@zV>tv{wZv{Dvc1-hFaXXt|nED_l#pTKr73dN*L`;WEpWsFP=4BHJ$w+QfMF z9{fNrdd%j-5{EA&5u(Pn6JAL4f28PTcPz3WO#qZ=?$h@G4A0`!JIfe&6HkRz_${Pj zT}#6~x-gGt-M6(py>(T?m0ES|$8L9XY+<-V$sH(TVH#ZT-9E7$d9=i^p%Pd-Muf5{(Aso9aD4;Mtw z7>H&Suu&Ar(~^ho-6cx4-TTXGackuwQk)DvJVPD=>H;Ij-FDC+-QiGFbFP4VB#H@? zU3+AM&D$Af#D*_r8!mA3UnJIO7D1u=-QjdqC5T2<oSTlZ=8!R<{XGz@8s2+$Psa3U|Uo%EB zC6a5X^e1J7h!Uc;jTUlA=MQp3qFvn7DlqM|fC{t1>gzdqJh`UTBZS2E+k-^JNF=L~ zRwkchBe5k8RJBwI=E_;qNW+NCq&xYWAxR!)n`;Hj$r|y}dNMuOol!7(y%SLa zDxw>u`n%T>`+xnqS*l6oVAU1%@AFaj4YDBwiRH-zkm_^?2;+f(mWILl^Z1d2C z5EU%P2TFR5^CaI)^n>6mjD523EO}4D|8vSa86L-Q3dXkGS5}iaIQg$>@K-)r8>gR$ zWqS35VFQ&gW6ind3Iw~PuJ8nfG0l6eqzmDtW?eTC~86J*yCc1O1=}IVgr^HX*P} zPX=RjVYIbmmcZJ#culX!2*^NMgy9xs6Pl_wl%hW%RU$^FW5jd;3mOQ@l}@!uy^W+R z9XcAEAe@TT@y{(6x&P||Ns25rPn?WGzrh%Jji_k!x0gZKP(Xh|k`#P3@V8y8k>t~=PeR|QI6OgaFHVa5%-X1!e0~*J>>Y_%Hd-dIhfK`Us48OK z#muXrT8?2sxEx1GmbEx@LIw=hC($J$;pDIsvYt%LERp@sf60kRkQ@m8-E>m$EEA(dliF3rSxq>)R9TJLz=V#GX^3K49hOmQQS}#VTuw5T4NSl!+KgALB&<=X z^6Puo2>Od5Kp!E7#AFbv)GhwqMes>){<`WK@y{#e|{F7+yEhV7c%J^gD-!R zllU}}r>TQGMB zU77n4Sd4b*Xa`W(B#%QJYNXeBk+XA^MOcit{{oR;i}FEynh^eQEj|K^eIpUeM=$6s zA`>U{-9#kZ(rc~cF)j={#wfs76yhm~(vlt4@k@3LjUf|f+>Rg@o$D;Z|3?rHqm;9( ze6$HrZ<*yW$)|50g^tltgkq-k$PMKCuNg1-IOwm~Hbj9?#Ig!ABtd!$ZdCjjl?n?f zHt11&43LV|r*tx0o*|*M1OHtHo-j->?&}lts+77U+(jE2usSZdVgdq3UPG6GJcg4J zC~$ISi2!yIEPVpPBwj`k&uK}7J%+;zDHJ|sIobC7jeVkljvG(^=XU6kPetGF@j*7b zm~GqlE>5_88=q}_=BPR5{FIi^mtoE^@2KUnva{~;)500%AH7?I_OQC*2Utm*_cAc| z6N1!ZAGb3tQd9h#4O-msyMk+-eohP2oe3+K23x0jCpGyYk3IOlPm@PQ_uNV5Dv8&J zq$gqGS%Tfq1)r{;8@2UUd20VqaNTp;-n;d?s_sRyJLLB1{cI(s$$RyS5JcrNH15SI z?&byVBIk$7k0z^b(`*BMFof-PE5TRSA+g^Sqy6e{fXxj;eZ}v~@rb!#wMN4Fi8=7} z1iYaXY){O^B;J{ri^;A1!bV3u zoNOzY=4E+s@k0F*Rle=jKG*&}`WpG2L!M)ImdjI7eMswx$QQjEkJAxLdrJV0KYmaj z`pBH}AY;lU<8z(&6F*GHf~IJM9PfvIKS^Zhf8y0=;bi{5vuysCUVR2m&i|cPpM~?k zHI?4hop!?EjP1EmUaId#Jl^N`50CH+*j^jdBR^3fPT7jAC#@stEPFXe$7jwMpCX}_ zZdqRJ23J?eAOQfv7w|Vpu|;ra0LKo7TNw$88NthLwP*{14-VxI-k0POsmi%akP#rp z89OHTHn^FO4+80Ox;BUz^hir~DZOg0D%x70BTTw=eBTR_g^Lc1E#YB1(};aXEQ&=P zX)H(5GA*xhaF{tl6SkU@zTOi`B`67s%Fr$hA_k_C{7A?bl?uTmvPLJTvAFBsyqN4q2ij43SYUul_(4&Mk?En ze~_<%s>2FI6#$0cx*>BPVnaNJEu%slji5; zt{}NJ=0JtHCre6TCP_XdR3*3VK&l#&4!pk`*rHh#O7@Iq7C>$X_PdckG{zJ|NE8{r zsD4|-@#RBbIGeDWAH(xmAK;)rI(Y`;)G=&%Bb8=WJlD%Tn{uDV4Fv99;*L3CfFgdr zmYS?~9^mX;oje+DzCL`iMyN0EAUlTgoe=??%2fyf+#@zjIrAg7O)C03ES*1{87j~1 zP+$*c4~%LU0KAcC4J_gkvz%~XEA)W;m>9YPyrxP$=d%!YVo_Rv5-B)4^dOXxpbG}g z%qhaZIT4e4fe?XSMgkG2M{HsNf;oZUS!-r-wsh@${U=R9=25mYbpSzEUzc!BE5@^t z^g%>3zynHS{rt3It5vdZIlw}w_^kUQQpH%pctA5L%_SVjvBBT20g_X)ZGipvfdW%> zlYN>NNqJUHY+#Xys?E%BBS^zN%pl3(p<3pQo>wRE0^|h|rv2Q}3aZ>`tB^(iTw-hOjnUF0kpMuK>!dY&n<{{na;wLoF@%cQp6p#W z1+h0=(0n8*9SB_J2%<^hq*S;o-FUeeQn{UutF-zPuZ{XQ1`a`hPoT$fA3esyq~v$zK(@c!=iU z~VT~QMu<+;cW$#L#B`9OSsU$|j#)f2f zQV=Q2Drc^&@=2N7LS0$co9Gnw#IJE~7S{SC!_ih$xgVZSpycPvA0x@jeo^HHVAITl z3jUGg!QgSJ3X2Z=MjBMX&M5Df_o7HZwV-U2t_quLD!HIdeS;+sh~-b;%3Odb=}(iO zqiDe)2JWlj!F_c{|Kid9xw}42TU>lAm+$4-?*07p`T6MK?CZe>3fscJ;aP1TNA5_S3p%C6V(?qk^Zyxiv3btq@9tY01gMMM_@8+JEDZu^q(xu^_jA;@7~NJ9l4%k1FzVv z89l5RfHT7;dN_OkHRNBxgeP1`rszO>hKX#UL(pnGH%FU6t>7hOKnqA%6776amUtV( zJc2ql4>ZHzM0|7}8-(bXzzPdD@>Z~l~lvT6QeDsz|B#x zbX*yH_x{T*t-!g2K2teZ7H$DD*11cA_af4m3c%B@fl{z+T$tp8D%$JH z5V}-TS~P_cpvvUu)fqfZYSNaJEy@icw_O|Sy;nR39RDONvj+f(E3TkcYdKzjk0BH* zjv#QSazi$F|2aF07i<4ly}x$=5UgGOzywWIYQ1dfX?WxSQCe0Zr_O`eJTU#wPpLV` z_BNt$5CwslROu$I;-0t-!thLgq1dx2%c{FBWDH}{=Y(YdjN0niKnOyyt%b)Lu4-Zb zgF;gRh9`)nBKu=l=5zMlH(+lJa!H5lx&kvUKwSO40?QDb`RL z$iBtfZ)n5~2nRE8JssO;?LEx^K&i>d6GKYof5!UuS?&s% zTz4c%|4_?5JS165=XX3?>ZRxli1db-i~QeW>pe}$W8w;2M2nmb<=I4vwIu7k3|`^XIz|Y zA5{YD8NoTMq&l6(fw&c(2e3XKHKKHd6%UNzbsN3ABn3Kq-9? z-9$BN=w_b$gRe4|C`52uOpz21MbR?#Z5`AFDPzL8DwZOCN5nIl=_y;Xm%>1({6Q$U z!65msIJ@rsLoaWGS~0>%*_QD6zQSMICYt%?wmBOkQZQ)DG^c+A1X`EofpD5;06{`**n^ixYhn z%)(3FCN1-n$C%gWj5X$K>)Mi@k=ncmYgw0W8KU!|D?JO5mODzM%tom)G%<)|CNG6b zT34%&R>CU&Car>ypako@`kJ0lt}AiX5m!V33vrihWcw2U>)jCY)Gi9-ulcbgt*|!~ z;N!N0QC9I=dX+*|-nm@wqL7ky*jtJ`37bY}=)`05)HT}MW(3@+X-6`a!3%5Jaq1@R zjjSN+UubvbyB4jFN6RbF?kmzLK1=1?iVq39L}(@0Z@feIR2a_W`2{;gV&f4`ai3_7 zFjP4d{z$(I z?#q`fTE~)8I$xmpb*c-*LLwUC4$zv)-zlyG+;ktGtoV|>mni5I?-aKJ(LnKs@hs4} zQ*YSf)S#CeS`%~TJJ)IksO@?t1}0NZ^rV@HDvBjgpo@(HRG8H1LU9*X(m2RKvrG*y z@h0h>xm%V>>V!0^xw3U*7t{^&iZ*9PGkTU4WE7=nQ{h^9C=@?%FH>K!JX@$7E39bBE%B}{yT3zyO$(7D2evZ#&NhM&35;uhEohE&xVDP-fR35tOx zuLCXv(QMBc7GH$6f(h(8 zLH>^0#`y=`qr&aC!u|Ug=|crhEM?zo0FYe7bkOx5^1){L?7|h&nFw&=PH7YP>*cGR z1f~7Y2W5{ASaLDVfjZy_O8s72+3VUlxT2(;Vc!i%auL#jKVTYF4xvR3;eB!R%aTo& zyf1?{s}yM8;;U%tgy`+n=ELk*v54>9{})08*RQ@r}vN12e0Ov zwQ`O$buK6Ww^xG3gm=hyj>WQTvU@{eyl{-kjXOwx2E1;$BAQNzoI5HpV4}7oLmOxo zoq*7&)tbN9g(`NxMsHjH@m$U}DDP;5+J*(t&KX)JSV!h*`=M86`FJSS9{UbHULL{Y zYe;E8$w|!q{+CJ1yPk<>39+##^f3;u7 zShMG0sUCxT&w2M^1Trm0V(PybRxU&-duGd=J$VA>9>TC_c-B*Qke6(FYdK=)$k&T$ zLc8|UAkcBDM{D5lRvHA-duJU-UnU&Aj5rGrc#}hSkTB@h2Cq|$x&=1+n6)ZWI3w8s zldXDfo>gwe42v5WaF{@&SV|Hw98ZMDVbIw^2OS}QfoxBP<-Rda(01x%T&lqmBrWOv{*qgRf8v?{ zkxxg?pdw6lO1l)M@;~+r3zc%M?1>R7!@}r5np^`D%Y;T@5AH{Yw}XKNA7i0&>>FGk z63P7sJl=}5);UU!v^F@BiF|`HRrf?zhKwe)KTT|9o!z*dTSiYw|#S${H312NBXHxL78P`0sr%ByC`$WqL+H?Z6_h4g<*s z=SLhk1QSL7MK=;VvNAY)6VK=s*krp9Q)tX;A$Rq za;zZg0|SF|9h^g%I-9mRbt*|!Qjw~n?!xc${O6a83nKmA6+wdTsFMdXmOXS(FoEV? z*PCBO2o?tCN8$`PhcKjzswdf9LT7H=w_`I8d>*lGWQ8Ln`GB;O=0_&}zE8`S?Yp&=Y##fNC*F1U z+BfJQcKy8FObmQ_hbVtD;bDJw%kq^24muHZ^5)ZM!?jA-*Od|d)@np&flSoC$U=oW z(a3Ubr)KzfF}=bopC&^)9D9Hz1X+(;{RGu0fjO>}SucHo+u5e_nM$xGdX=CIow+r> znM8X3+HAQrV$w5nS=T#G9;E0F>)5^)lG=oh>!!Dl%@{(O^fjf*OsQ5FY8^U%66jU3 z93f8r^ykg#$K~6_*Q0_AC5oWvueOR#X|d63$vhiMvveDYC0GbbYtGY_+H}2umBToy z!$V&`jC+!8DBrcmpYL}bnH+MSMHv^%93JC5KwgCt%8s$bdyd1<6W`5@irhsLsN7vN zNjY~Py)sE9?P91FO!+wcS^ZgjW_B%ykNtNQxUGKJv@`B#*~!1zvCxhKmzDK|Mw8UQ zwA?d8+qNrPT?!_;$MI=3TwzkV5YvFhI6=4x(IOE0JGQ8j? zpNtJQnU;SzhCbGTnhdxJmS+z;=6?L_aHtPo^8JotD)z27eR7ot$GT*0G8=Bz%Q2Z}qZ~K~=wzkBCyV>13vJE57EuC?J-PM_3K`81 zeUfI?velyr{k)o;zZILy*C3J4nBBgnT8?UQ&~d{81|y;0@iUlm?KXnN+J^nf9v_k(T?lX5!9C{Ve{T8KWkXvQEE}DD<3@65NC%MO5tE`emK*=T1-ZS-#N)^2Zsixj7t_g@1jRJ0r`3= zTWl-L7ADg9*z@nuCKQ0%K+#S}xy*@oR1II-!aEt;2^%R6jnV{?2NQApH~J^6)# zn_WPIj`eHs=R>Ha*pz0V@X2ierpA-q74|G&WQknHQ$qa@YOB#M$M>(3=Wh>G#}!sa z+$B6$HN$#LvPs6#cf7K(qTNj6vYNX#caCzv&$r5hrgFR1pe4t?;F?1(L6$OUrMkY9 zo{O*6*l%HJS;*agxn}oGu32hvN5@ATv2CkJx;H#wwfAoB-9}_0ZsC&!$4j9%ZXZt4 zY}+>+@3=N)+Zs-q(2wmNX6iTP-nlh6j6DjHGF9C?&wJe7H!`J_>$pA)*&H{PJ9R~$ zqs(-blv?blRoAO7)P#KKI}4NbJ?F6qx-_DhsVSYM(y0 zF}$7;=uKN4(=kt^-6zns+{I^;R8K5T~ zPk}1TQuZ6PC($%+xO91WzmI+mhDqr=)?d#;>ZsjV?i@(QT#~4A?%lWb-4T6w=*m9Q zIx9}gC|9&jFV zeTW1Z+LiHssE#wKXB@II>t7k8-Y%lN4>%??FKY+Wa=*AgzpyQ%gLxiuR=Sm$6ir*3 zYsxE^GOVK1(p8GH?a-`!j!>z7KmQUR{hM+aI&BJ6Ef|6Mn~rE5=Vo26j_5KXZz(N{ zK`(S6>eg~15AQ7>t}kz?bF$S`nyhN}dGGs;uem`)Bhk##qO@Mwt90_*^)PgdRckl7 ztZNY2#kIz!Ow!xWx_fN+4dwZ%mc52f?i?)}3s|T0pgKg|A(Y;P8u~Fn5}!gQUJWzP zqR*(eZa)M*dyDOdPV{rbXI!+$&_O*mnfh+ziodn!233GcdA#m6hMUM$ds@>)ffzQX zRr2?N?a&g=#o0v<-75BkTFLW($97GHT&L_LbPCp~o86j%>|Z@b2Q z>C~3Lx9ia;&9cvBV3#KgvWbHOANtXA^3JTjG}a^z{$-XPI=-uUAX`#7z2`5X!V9yUtj2&^f)D;KM2( zdw02ddW2yIKOLP*tieQ#a4FQYpa8uE{noT%5rH9ZogrvCF)Rb2z!r^Uw3U^VP$LNoB=@v@rRyu*I;4 zD@9hXP{irGyT{|>)6eI-?`Jc^g58R>N^>f+%7J3tR|(aF-R4?>`GZ^Ol0SUgIdQG0 zrw@x?=fB{#*Ec13gF4!#OP>{X15ez&Qrbr{%s{5g5}zkaQ~A3v}6KfaZ= z4zRT5Bb%XT*CTf9_&1I@lDqBax^a1K_r1S?S(XdNLS@S0ieNXof}BD4>gzhBk+iGJ zyQufKA70#$2;7G-BdRYCZ>)M1ic>sChJB0TkZyW7wNjQ0XUU zyIm;X?q1yBzoS`Y`ux2-z8+jY-*2lWFq?og;Taf7@B4#|OuTTuZBH#5R%7Pmg+_U?DPUV-3NsS7 z^Mgho1IqI+iF^Kt_uJdz14EpLx6*T5UaY=6e(%yx%uz|g420}K$l+|+X`Xbr$j9r; zV&lkICq4Wdw@W*}{MRbZ(=kfVH@qaCyV?IcjKjpp@c-ao`(K7}7#TVKH(?wW2Il`( zbu+Csp19eD`CCctF@-Zm=$22Ff-XT7mYpawEvVMGNmW%6i^e^(c>3X6OC(WoCB@TT zKHt}S<6o>=6WK9W=@z0C8KrWz_gA6RVZ#YA5&;IiUcvRMegSGObPvme3rVj`s6DeO zno{Mj2y2VN_}x;l&}u*#nuXRL4O}!KFLdb&FbE1%4iP1{D#kJ7sf}TDk}8c1%7h;J zil@{u?@_RYM#unYcmXO#doine%dHe5`_O>(KAP)(je&@=N16ob`vAD;mI^vwB*-|L zAgGdLJw!`tw+cudj_Mo(v`tV7eV{?#AJOW~6xu>W4sQ|YdyO}u4vcmvQJ8=>1Y$Ay zAi>mh0Rc@-&1qf*NkKWE1S>AeA%E1V2-TqpWwWT1LRsr;N?;uL<@nD%4Ash43pY`0SGKZK~XZQ)))ZmCOOsYfem9Q zu=r1q-v~K%kpe9&)h2e2z3+)r}6dG(avEZGp&=M4zbPV1i?shAoH^nW;D!T~lN{ z7Gak_()?Fqi6b)8f%PFAWe*X-IG7@VBmrp2pp8+hFDQd-1&9+!BA{N$+JqefE3LyU z!$5+XjN(34Z!XtDjVdPiKh#`8ELv)q@=YSU=_D39TC^6y%}TsuxS*kcayr9>U;s|e za*>$xB=jjo9JzvhAZm#aRG^v*Bndr=1+0*!5HLX0Sm2o?N~jHa9$!K#H_OQ=?N(bs7W5ZFvun%w}>05L!S z0EL!zB;o)$7E2@$D5{Iu8}S{;cQPhUP`XtV$!SYPK$5R(6g-=2W zN9dS|5J2-8ks|R7L;~@DPk(-EuIRDAtu8^-4pi?&#H}tdC%BZ5%uUmusUa}`Qg2BsY&7D7S^JD1kx=R9L}E~5HBw-#l5s_F{vjy{GaMH& z|4WFDF`OW1-F1d*!XEiEPIR`?q|>qDr6X0y%pj{0D7HqScx8eK8WW9Nqy=M6vdj`E z6FB1cIymdM(|t{Ms_*-wxtu~9mvwP$JRWyw`EoOD>dupVdh*!L`2_-@+J4`}$%Csu zIh*y>%=z*Ldjqc4}$8mIr;KY0sx;-Z~0k1cKb>aC9d$Mj)?hXi z+ov1PO}idqcrk^JUysiIbhGGw67Jdh+tpGoY`VvL$HqMjy?)P*`ULApkC0Zh1yxhM z(%TYl8Zwyf!x_4_)0`dvl-r-5d^-cFr^{IbOy0SpWvWa#SSt+TEbpM+GO(G)dbr zX@1Ml-9FIT3FQ2fH&1uV-w(3~%ZCM-W*>S(2{Uj~m?u8gw0l=)0Nx3C0CoVLWC5)= z_u}2oWNYU<^?16)PNF_)iB^cHDch`I`?AB5_2=iN+jSc+UJoZIgH*0gp3-7Y20AG) z_9wx1f+Fn3=ZK78BMm#b%{cA>gCDUW?qZX%vk+078+U{no}1iE(z%{+-Xl8Z`9v)^ zwDve|=J>tz`wCAxxYO-ZJlo1$_Qhmq*)qwJ(LZiMLRj+C*n`)9wN=;5(SXP zWULf?E_ie3wzTRnOSES`%WMZ~zh^SeEp}bdj3XMD2cNkRKrI=+1g>yR#&FVvKfmD_ zWUiiAw(gf=vXuop{7oOpG)Di^i}Fi98Fu06ZZTtS)x9Z16brcO=ZSl3h@_6~J7g$- zH@G+W=i2tJej90c~gs zd@_Ns4VBwwp^x!7b6ijSz6VTGZDa1@p|_=>3#OYN*DrXp6UsOVsZx0q3`7yN4BuZ*j$btGsrJv*JbaDi~Do%3z(It?dyPVA)n;wU?%h0u=woY^4Lqd z z$n5=c_&1GELdTQ`dkv#e-I3*uUnN~y2swo{;a0RG;bE9S4y_x95jwehQ}MH=m7Nb> zFE8{0cGn~kL}|l{=|W55f>DG$RoC7K?b>3D>(7%%4~@v?iWm`)h`JIzb8!rx(sgQjI}_!z%5Zc0mro@nb$$F&R(20*@i4BfiCgM}LngqQax zMJ{wBnyy2v)(bh@f6$ATG6y>~=U|ic`Jw-8)1%oJw)n+^W-sE|OpHG}__h8=iD+h>i)CB(X)Q)uLv*Ty= z4uIL-V=D_v8g7r27iEuMw?@u$13B>K%(cst!zT=~WEZ|wl_aRM|2RC6)Y)yG$~*d) zg|ixw>Y3C`-e~ccAEgIJ3eNVn*=GeK`FPoEE-S*pjqV^jG#7C|>Ae4n4?1}{+C|U3 ziSLn)RdBCBc&CB%NgWz)rPPzzWjlRHJ3K#6J${|wH|7^j+p#0eycIEOpzZ2}P*mQF} zLCg8iHm;a+`?YNkXIfU;^tD3|Og=Wt`N_ziNt2@&)0}_su#p2v9wad92h zhU0aEBGp6c9{txRwra!UQ#C2qfTuPNW<9iksUo(E(Y;hj#S5-!_FBtd1K;}56Bh#y zqZzupH@!=;73jW{cJx`lN#at^bjuw-M3s0_@yfi*=eM+b6D|4&x8efZMD24y@W;34 z+cS>*KUX(D6gVA*R5B2#L%cdKANqbTQ8lNhYZXR**+ted1ru|LiytA#*jgP_ax+kg+RZB)6o;TP^@MTTK z-!@J+D8CG-P{ltv{f^X8#XjTb$-n(~^w>&AYik!I^rmNJYpBOqvNt(DAWq-Ed6rIU zU%E29z>!q<;rN_t8VrYe<@rb5CsZWkP9&Wl{^(NjFTCtZ?2_o@klmMjyqjN(_Q?(y z2lT+HVtg7GO<$T<{z=}QId<1lWsG?|eO3o+d_2?t5cs~t5xyq*?8>_cGg4}AtL^Q_ z_k!Ow8o_1s-t$slb{}f&S2a}HxIRslBUILxl{Qve=k;@Ml-t47UjL%M1e_A)V#DnP>GQf#8 z0{Q?-604^U4?IcIVtmbmPkum~KH4s6w5dgl(!$tgG`882g$8$e-7%Y4&9HQ4ZERR+ ztG0%S_ow@2XThDYu};t!>cYoe4Wn^{%NmD^x=T(rN!@(E;9tcL(+|Zl**$31x&1uG z$Up{Z@4#9y*n9umRFC7rtFRfr7qTB+lzd&ho>e!aAxim{#%ExU{jN=|lLUU<$|;$# z!sp26*cbSRSfj5U(Y?7+t_@qOAp_LK>55V9lJQ}z=I3s58jQYSEsL8EL!)cviTKWk z17GZNyHB&2FI{OE@`FPyrnd3p`r3KbafJ&Y?}FTJ^jwIQ# zAr~9%{OY=if4ykfle2Z1aZ21ipN}(tM~*bK@nSkpMb8bc&(93X^w+`ZBJhLBD_GDZ z$?LyQsdBR6-7@f#@yM(oF=^t9#QVjG7KdDSxuwd9^{0vbgp8S*-Es%P+@aJND)Twt zg>@G;S1q$0gibQkdhClzwTs8@+}KM_AKSs=`_mc2V;N)9N&Dh9q*(P#ZwANaOgXR& zZ!q*>=mzD!X+q$L)@Q%h47s^AN+0 zmYCU1-|Qycv~6@-iKGt$x!ru*uqWe?gxzTNLK~`%Zab{JVZ7QwHzw92UG5lSA3L5@ zQQnO9#?q33BcT=sX5ye_E_dwhA&8WJnrPf9z5`Sf=Ft~HuXTPxJc^vgJb017YpTd}0p(v`AvLFP)` zJbn_WZ>il{bKvh62(lgNiU(7Nj^kvLViMP-dN`@py79_#K?X|SYLun1-_LI8jd`g> z5ePm!iCK;1q1kDt26ZH|F5~HFofUF7$A0P~O8r=brLY!c<+4r$edJ+7s6Z^eK2X6- z6CRsJ`%*LRvEKUJ03Rkd&f6jf+_`u_*lwQ#CKYPzq?&tc&$e^pLF|s9165u!V7}Cj zqWlLsP|7)TouGmROE^OePDk(TCX-Tg!U4RzQ0(GP90&-dFjB}=LntsY=z1kxOTZq*UIV6a>mO}O%rW|(-Z1YC7d%q5}5R0(resRB&5aAFZb0M0!yOs@z_mAOKp zOUb*204AieZ=ESyc>Dku^OZP!TiSmD0p9bUzPcK2;hBc9O3eLKb}mU^nC(!*AX|3d z$;hjkgNLyH7`M>4p!*2*7zb-$!JrCB^lf(n5(w7uQ-C4W5~L9_#S(aA0$ZQ9 z52#85%o3y=pB*u3=>aBE4RYfqT@vRIoZ(G<)zN`;8q{y2vI zt7vh|Q3wz19Z)HSAt9(|wSWzz08|7`G^qc4 z%11LY2g)G$u3T3vjFbSNsfUUIh1I~x5XGv7iu=IFu&tox2%ytVZv!G2I~Aquni+yuM_4kl2E~Cd_v%$#jBA;dsLfbrR2VY>x$))^ti-9gs zn_dQ_ko|Mf)v%6GEP+i)QQPnQrL--t}SJcYHsdUiiO* z!I7H6?I7b{UwZw%-#*fM*CyOLlHeMyj#3X(zhd~-<`a?jzD3 z>tCPKFy7n;RIGPtT({;bK=+&#`ku6=0`${!AsvXYFM^o-?9m^K#BCu3`xX~{m9#vp zx~<>?NcVie(;ijlv3-BW+dt9tdQfrmFCOH?<|f;`@IRba>&x!I{cQSp6YVZ+&%PI6 zmSBPR@{RS5>Nk`6+NSmnYz~*bK5q5e?^5@Wl5c6AIQz=(r?{bP9rWgYI4rxu9P#w50eCAHc*-tF*G{^5 zm!`qgp~VF)pIra*N1qP)m9(ctl!%i>h>Juk;78Gq~w?@A^Xm2CIPx`y4Q|`@K zQNOXYH1Ca3LS}E?_ZiNt9HsNU<(Yg5zqcxm>q5WHXp8J@!2k+NhnoEs0RtoNi~jR& z78L7aNCjX8C5d8u6{brtDHT8RAA%R!gEs#qVUi#Wt zSE9schE66x{N7QUzrKhw0zbvEV#~s}G%t+Zrf|{W@5s!bVm*F%_5)iizLgKqwdkV8 zSEf&b*4U$EQ;(sQyx1*QU9+Ox0eY`f)qix&Wh^S!?{9x-R+UXpoP0Mqx_901XniPg z|EN5_GhkKFWUL#0BX)<)M_8Zg9{#DqQ9m)&fA5e>iP}Avs{no+2mH>_(nBRw@Yq;- zKHh&XaRAgAHE~tt*xUBS{F)p-Bkb6)XU}Rq^3>|0yV9nD_OpYk>W~ZZgq`*Bu-%UK z#=}wb-Q%qA?&)RXey@L{9R_z^W_%ek!dLsTbn0!x&ysF3w$V8$HA40|rmvAVE}%6g z1dD>?)1!m>3D^m1KZDItA4iXRy4~4YISTO0v3dx;X20ki)=vo5qLcn;jfBTuWLe4S zJ_Lx{1xe!$!F#+{_{iLuq`yo0Oq}FFT@Kq&zZo>{aZ~e`x92kF6zlne&#n2s;APe; zi>l7;Nt4z{KWzS1ULtwF)n(Z+hdECZtRrlD@ybop}MtFMqJ>-&y(ACF7)`k`=0Seb@@ zo~5_in)1co9{OaL{U_1)rYFjji>AUyPaJn{)pFYwJrB7o;>qy0%Ha}g;(7Zk&~`F5 z!Tl|Ji6~>2M);NtxMgA3gkteh5!TPM z@lw&_!ksa{NF-j#fvGzG1Oi{hE2h0QZ5Rh0bh-q%;0uslk}dZV=#3L!)1hPC6$1od zuT#2f;-n!jeqt1^USGRA@7C>FBmNH6?yDj*9{g=Zs^@a-MzH#m1!f$08yo29*0BXD zSDI2R9MD*$`0865KJLHNfZlh1Nnk1%jHoI{7<(5%PBHxAfmzMl4QvuK_1r$v#rXMr zxd55Z&?q5g5eMy3+RX8Yk>mj68pXp3S*UMGFRt!l7K#1FLKA*kwsaEDy$H%fff=w} z)Q-kA4DT?0T)SWbi+`v)vr7|UNr8Y#lKn~YP@iS71KJ;uTz36EoR}_R)j@>`=PF&3 z)Y%@ZzC=OpE(D@%Ie14Q(P`2sfe2FX`ST#eDoeiKAb%C=F;ty%%~SwUa|nJ7q)6s4 z0MisXiT<)m35#Ix^;%}T+dL}60tMk31v-t2j6@*^D-qP>YN7zM;;MHq0mMXl?dywseHs3bzV=fR$?yehiBn85|BZ@W%QC zBZQ@#1uz|OEp8h0KS(>G_fwzK98dR291ONbz^%6!mYzmXf^mZg_F`ZtM#^9m#j= z=4M3%{|9659HUFnwf&Agdu-dbZQHhOdyj3~wry+A9((Sw&9k56BfZ`1%$qLcU6efHg=ISpLU&bmyT=^L5@_LBkDdNKr zr7O!+HkK-GPvb>lq9H5oUmUBH~&Bp`+UNp|L)8f4<%T0pHJ%1id#jH;GEnqV*r@U%vHxz-|4f zNR{&+RdlHwd_JF%JKDid^*$0?{5Nui=KbXu_w7D!n5f9oM+{#yq!SC7$XRnpQ8d>#qt!DH2gvMcMon1SGEStv;EZb&xIRcZ)C0Q z{+BuwALoBRHB9_tUdVjjB0E8FkM+4^?WA1EcCm8w!+t(S`=$1Fmpo~9H`l!!HKv+U z1g6_BCwD)&ki;ER%ePYKJjh<_uvgZ^c7xvs#Qg^7x0CX`#!Bs%lWuRvcr$$g6?jV;BjsZR0w zm?>jP1`o|X;rtgE(l?R(w-N)&0qNrMiu0de9&a8ge^PtZMBJ}RSDzm{lIn@NpNd_< z-!cM~yD=E#+K$>kWBN4LnS|_f`R>Qj)9&2~sPh4;>7Vzu{w4KED!WY&T)gUe%^D(3 zBSY!oTMzAVb8SQI!#7F&5eK|&x1lyQ)7?Hgth*}x`7(^F4y|lSCOm&z`U^N_(A)#& zPv3QV@ofmKRqPR5mJ@2-yT=b!RO(+I!#)Wf$CaCAW1Z+9j4B0Q>tEyO{n0qj(u4GM zUV!mt+dCV=I-yS{v3X=LaT2<#pGG#KD*bHiFml&u*RgdTY4K@9lI$*__r>gV-^ILb zA0{vTod^2b|d>ILmO0~RdvsmE7USB{-8->`7@etI5lzC0rQ|MtI1c-mBNDjO2{bS%{6 zUYYFoCpa8?RW^K^)xf-`HZtfT86bQbY}$*Vr>CZH_o{S?OEFE`fXx4%;O#|I^09LI3&O z$aGIYGB+yKUMWeoGN=3;%WGfKu)E>sw7=59uQ}3oU24~w{X>k@|L65kGhx~DH3Ral zx=kAwMrOCH4BqJLC2=W0mqIt|GL@7(+G0Q`eEGk4kq4~VA*zs z;eP%R4d(;9OF;WU%?|UBj8#4$#8zv{>6GlKPYdo4DOUBceCV`m~j*v1CWsD%m%i_1atV6<$f#x|)04!4Jx0MZ6 zK4cHza@Nn)WvZsD)X3a$(4I=jXQ}1?>}gy?O8L*CdM(WrEQ56#IiXSDVQOHO*uf<; zsdsrY&lOHrPl5?pDO)#jOQ+}8EH9N(;9Q!bev@1sVeug~x@JcDCh(X$YljXhN{DxD z9q~$~|63q33g@-GYakL}`ZLVJ>lHJ?VyT(9eLCrq#U;yMmN|?{8>*7Q=$OSNPo#Yo zrNa74FTDJe&=<-&3V0}aq9{g^fKimoOILc8l+B!OUP@-g{H`*+GA2ZIrxeMVp#;eoGFe=5dfkjV=GOQ*gFDzTD5!s{Z@-FaX^^h4MM4Z-JaTwJ^RbsT4lH(<)iF9K& z5XThbR6?p!%~-{7QuWqbxMR&QB1vO3dJJNiNu5(R_>TOLvD{EUAc$}e6-JR!30Sgzg zGjJ5$d&0j!)!+0pG-1<$&QP*RfuTvfJ0WkHWmrt4%o&t{jc|3n;|7vD*W~m!SwT{) zoa-UIoVy^GN)oQMZYgQ4j*tlCtk0+@kt+%9B@;M2NlOY?6v?54jA&okC>NoCA&yG* z8C0{y!5nMlUj+M!X5q|?Wx2$hBa=jfv$cP7tjh@tGnGozCN!X9feXJ zu?eXsTQ-cG*`xAPc(FsZO3>x~id0q0q9v_E#({o7COalWpUh^J+kzGx%tV!oi`3ew2-|$oEP}Koj35iP|kAr7{p`w!+#~=o>4fv zM9_A42l_Y7U-Y(&0NNt1HG9?F8|4s=Oh!OxsV|?n%wQC>EX|+di@!_j!tHz869Zs5 z58&8f`+}N?e)}@-iDo4+qJ40f1qHO6EbBY~fi>%=w+|mvZPY%QWB>=5@%AhE8nciv zroXkH?gxI4@!rKggveX8SKO?s`!5&T^z$d3;iA8CdNlU!48e}>$yUF4+}^%I+XyT> z`d7EVi?Q(p@b^Y`>E(TSdY85xUp>oiA#YDh3LmF;g=ZFkwl7gu^Emh(_jmADi^citA(Tm< z6Z21W0?J_Q*BijizE>-M(_mUIZR`HUu-L0Dp#3Q8HiY%?mPzNMST|?2%fG|Wq1t_t zX6ADK3{>rJ4aTQ59#_h|{Wu9I$K-Sv?8oKU%lBrzLu_sozv{&DjTl!SkXh|l~7dyfX!{DtIu57xJu=|@toWssxL`#0dhgn+|_|ERq9 z?d3Ckd;5w_#Z}ohm(6~Qun+!|l!@}GP~?sJ zu6t&!s<}D)GouS`UH>$$sRjR>ELn5N`izk|XU6U_eH$ffV{bk|>k=-68z0QF=kLq% zmWvDKb$y3K0*fU;_8k1$5~H@dET%*18)L=CXhab>j9 zIuh|taD1$%H#o)S_LYZ~7-jCWLpNfQ?Z45v+cI+bmEdWm;A;q>lX)1;u;cgk`g%sf zScxLP)1U5R5b$#rF^*9mzosz?5ukp^u{RH3_bOGyFS+=@TkFx+iQd(*KlI0DxZ<7v z@aP}^4Dfj=M=%KRd^xTc`2O4;AOBi@A@Kjavh{!X{_3u`7vS^%Oi_3hz3%7z{-Vl9 z#E0>Sj`|V_9k_oXwnTyvCM~2)F^KSaah?4G2i7PN?EAEQXz;esgf>kOO~#I>B+B}> z{g*US1W$r&GcWF>My{dYPgg z^GEm$|2>j^(_VPHGx_PwQ~>Xx&T~@lBKNF)B)<&R|uN*^gA~ zE`lvL$CcJ%501?l3tJ}-%(rQLW~g@ES|mC%QI`UJdW32TwV)q;Ys;E2XP>lF%)i759vTEl^ za9}vnKR#ws6AF<*B%(O+h&&h{BP-g$jCeYf zBB2tQ&``(ofm1r)^)#P9ReyX81PX&_ET~emAG*?PX9)6S2XamwDo1;&xz7x1$)UQ8 z22FX63;LFwU5R+n#luuBS_PwC6t!(oipd*ZBaEBV^(N;$I`==t^y&o5kw4rYpZb~& zq_d_qszPrwCnv{4oP2Le=?N3?(yaMOrey(sjlcP{OS}tASPm%CSutdmEGKtnz9-49 zMw9GYOeL~W=Vb07ymC3JF-wxeBB;H!tGPoI3 z)pUA|5v=*?RpL+&>!-Ar(M-eqvBnH%hufxyqd|J9>!w^v#z`aIlUlL_zjgs}(;C2Q zULAU*n(t0Jw6l)}T0&1#xHNd^=Y_<5gFWH+NB1zsS!3#F2_Ypb)uB~Pv&rqvX>+z- z-*Q#+-@a_|N_*@gyM}RnaM#gcQ?9Mf*@niT*z0@L83r#2%PxEdd4A56+p$mH-&|QB zVe1;&$VL65>fUbl(>9_L+t_3vV;0s@>L_dYUWb|#4@Zt7AmYn{yqk9eraX(+^~oDJ z~63#O6NJ4*B2^g=$#PF#+wsB-gc!J#;PI{>;Rs*F9O;yO}RMS1jT zo&NQgOd~AEGuE0L*Ppj}4SHzpAuH(8q}!6bmO3O}SAgakS6NN^-*J4bJz*=464z1t zbWYt@@Gl$YWX0{_eB9g>udqgI>pBU>mk)1J%{#=7#MwFt*6FTzW`Iq09)s){NwS*` zAI7{~+k}k&y@c-l${(0&^G)Y7!qDEpzS2Kwvaih0l&LxrZf?v-u!yA^fZ3A<2Ljv zh0N;rwBPMAR_;h?_QY+V+tty}(gh z!9RorXC13^6OK)NA2Mk;J2mjX^&ar^rp&$Qfm3T2e6oux?MpbUb2Y*4$zhzW6m%i( zq^VL+_%)^^_XUyHO~><)9jC}|0L6`5R1n?m95UZl(>hZcgdrfo%7Gla+u(+ImEU=p zN1Y<~a(xu5$YLkx^3ql0JKG`5sQsj5>|8~xp<(rdyM1oLlCiqaj=otVcx(}-h+5%@e5JBeyF>E z3Y}U=h5vx(_xpmFpT>tLcE(fNy(XPnwU&bXv^#F1^r9+7F5+`99hP|3vXY_t<_prn z*i+7gq6fxwICYI;N3Z?jZVFY~dgAF=v<#nTlheZmzgv*`>PMe&^Gv$SAZS425olMS zc|X+y9*cLtui5AASLbkLmRfyd6P>zp&&nsgs@n6;bUL=3(a6>Z2@s8de{oa{Z#9kg zeY(x!3r)FXoT{_)}DhMNRAuds5cn{d)5f;$x&N&95^+ayB%9I4y=^Q9| zYaD3z>Ib*I55WlwVS=_Igs0_8t5}%^WEICW=?nce+6`?#Fyf^pgg48>R*M@{Be}x- zysfd<9AW!4))kFB#+cU^i3{_x6!lqq17N`tZ)zAfeNz$;R8vPTC>uRYif^f^UG$mL z>nHlU0vdPi6aofXtR*DyHkhvCH-mhI^;!Y~GXy_yZR=&wsLNnerx#N0Bwjr12%n)n z?x`B4U8BpzTc3jy*_ZxEJu@VFT_7Z{6t0zkP6j#T3E;^pE<`#n-}XrA`af&9eSN&z z{f<|Dov37y1NvDA7E_xH47Pp-Ox-=kc6WXPgPyU`>17H4CM!H`*dj9ft<>4CiIeS% z--^{iKR~Mp6T$z}+@9-y;p+JR<8QFAu>YU@ja5Cl_(x9rK7ht)2G~DnR8e2xC{Q%m zB#}_V-%C5j2#8LK zezAO#%zm+!khnd^i9Y>hp=093BbuXQ_8&4YzYT+BcB#e@__trfLCVAXtD4ZHd51k<$%^xdcWro7sfbY)a6j=&Ru05WF z%(>`wJ&&x4|Hc>Zx95`ZzKU97k3d=%&Q-6d7 z0<{qzSmZ3fr{^$P1oe7UF`hU}Gc?-AQ2{8DmXUAIdba^d90bWdp{Hf7H*vCl3W^M4 zB%lEkO&C150_&;K7j$#wYeA3_>4BvMC4i^n?Zy@mb~o1~ly?`xAKSQcj2N4{dMFpg z_!e{<-P1Z0biak!{Y?xu9Xdu2x<1iUO0EOBSr^A!2Y=Pf4$3woJmp6`??_G;bTpd) z*`|9XmM`fJ!+g_z7o!i_0`&tXCbYplvtLB>1>L4I?sO{Y9!1pJk@SdWYUpA01oJlE zCf=s&1W_&NPOMF_sf<8P_XvX9_p9EM@76q75e_iEG%4f}4Q><1rAV zHIgd6r+*kyJ~H!YMxXAU!LeL7{QI{C;E`B4M9vO^?dtCRt>+oh!{ve!oeXA=Zga$N zh&;8I>Oq5fyg@9m4#W1=YW50KOQ^%k_QpQ}L)guoiPR7LsbtzL(PlxM>rB`CEJKU2 z;OBcsWa@q=rezxO60|GG?rDID5Xon&iHS-2-Vn5&PG7KAC>YJ#Mbxk|F^r0=Lf+IU z=6G!LsMJ!~BeP3}v)9eUB-*5HzjT3_Nsw?H-$^(*ml${jx2~arg?lt8lUEDY`GD$T zwWRhh^((wj#$2_o6yIg^w-xz^=6fj)Ky@M)E>AO$jHs!M9F;V(_V==v?a;jdql3M4b6V+2T4F6p1?Sh#!!6D?9C!l6UtVWRXS zNr_~4pY+KDiBNY8IuL)z*J6BS9CGZ;3X^l8t}4Zc$ScXTm$xn0cJ2Hyz6a z6{|Nw6607miIzY&YP}(QVff|tnZ8NW1|dck{+1qGbCi@DOSBAeh~1jP&8TEBUI!ufIKsf^W=22IVFxt^R}QwrnB=LL#2v{| zn2{+S{v)Y6@ke}2vex*QuZw|cF)$f~`S7f7zG6%|XTnyl>Bsg>-{)ER?)Sr$$Bo0y z&GbPeqopCnhj>7wcBJv|^s@-!rRiy8+mZ>p^Y(!!ZiaR=z zxnV`0$Q2Ivs8NSceog&Laq{2JkXm&PgnhKYP9v=S62c4 z)l#Uv@7LY^8zx58vT{3r_51(nqg*G#d69~6ciP|pispT_g** zTw=HNy|7LDDZ8O{we?VZ)zT|L&|11Mg!r0XLx#-0M9=zV8BN%HQ?2z#5-8O<fYM`JEmB6ZnO2X%QH;&-vyvaPd{3Lu++frw-4bC^n|o4xi)?R8dX&4q zpmcT1y_g$>`S5CQ_L8I4(tuF(kFm>WEQLDF_0!RZ+$@>#NgIxHDZ^Y}wt!uoOYP zj|HuU){kB_q*WoEm9wN)v4LBMxS&CVX9|iPROgbk1u3a-%>}uw7tsjH!e5Gz*47yv zoy|T=W~%CtIJf?*m}}Cgi|c94`+o^$qoAd8!!$A|ERVE3F?z zhPjTp;$|0WuyaM}Zj9P|Mao@yVUMcPYT9*fC&88J=1Srj>kebzdK&ahzol@!L(H?{ z8ds_D99@>*qbj8DQ^S?PM8UCb+rDh@%n4-^TZM=Gep7P2+c=4eeXIJ>6u>-#losG9 zG=NnZ!VjZ5;Fi(8Dtt3|Pi>Fk5^t6J%XW=C^J^@A5Pi2B%YMsO zcfAs9#(8_Y?@YXdD=a&IpmuIYqu-Rkj)^#|D!{>m=A|^LsorW0TSMR7fBKz#R$(-b zw2`vouYK5FZ?n`|E%9Y1^G;?KIqrTqOgm$c&X&6ThP5O?HTNIoGVUy2Gt9{%T8w|{sh&0hJ9aARN#SWNE~LqLlO;>I0}4g`m*UL2M2#zM$P7ZS zjzZoW!*dl>Pb(|FVilDK&RoN5E_SyHiYn?%GVj_xai9aAaamdS40`0rtbx@RZZzL7 z^9d3gp(J)2w~(beSqrmy7biOIn`!QbEJ@j9Ma!92lIfgFWYl{1q4f3z(VOVNIB057 zc$4Yk_f)X0)1khc4J2Dly}{K(zN9AjlNCcLVG2d0Nlt_#WUL6Cf3RLmFFPf0g*(bY z97p-Ok4E#rx_U?JGk2!hJ>bZ~E|C+SZ5ebm@oBl2G|_Y}En)E7OIGUx%kl15$py3^ zzZDOHNAW6GVnk=%YV#Ev!phly(vB)U6(5{^nW00$C4{RZ%ivLjyM@v=<%;sLS}9VV zNX*o>TAYNnK7mkdsjlMs*Cc*<9o9O_UDT5#WrK~oR~y~T;*bqufuf27Rqoj=g9-XC zVe60n=({VlL+pi82pXhkm&P0O!MET+>Vk!Hg2;+_W>WycZg=VWkbY7RMQn)s@Epts zB9Z@*XAqPmK~!yUng)Y%lIg6PoDu=q${V<{(D{OUcNxS4Nt6(*&>bBFLp<~Hk8Ip@ zOJ+5wp-J`JwCGbKx6Oh?64B`)I{!%9w zDl~I!$SHO7P6BM9EdR^gZ0Ag^>`*F0cB5{SFVSl!-W=~*n=9-hE8si!_qB%bEHP#Q zPCf2mEOhJ#+7N&VGZ9*ofFyugIMhOXMZ(-@H~_=6m*?6Qucm4q>nLn6BCVN{)XhRf zzd>v(eBYRzzGms>MAkQhq*wR{LN4w)33J#+L2Y+ZXCgSw+v?VN;9?W2Xzq5?nQ>%? zv?{5X0&>h$WObcv6!5A!bU@k3##2H_ZdIm_Pf=0A6R-mxq6a0SXZm8i=7P6gxS6+0 zp%#K)Z4%{S->Pmb=~H*#u7l$x7hH{rV{uypeQAvtPHLngCcEQezYj^EFp1I z2zengIxOjgHp1kG9Ws`PsNos#o5{ARf(odLN>FUi8A+r3EF<4o25(<+lvN;$=y)3r zsGHBBFFWkl^VC+2neKHiR^>q&i5l2HEKSaiJf-<~RG0)lY*0vI!uevoNB%LwTwG|! zP+5LZk8QLHhiBl9Qm?r!q^G#YHACeK2A23;dX(Y=2JZt#E{Lb^m_bgQy8b8y!5E-o z%Xv2(vFwHK375anx4xPS*LRVRN6PhEa?~7;TK$c)vH_1Kw9W^D9Ux&uS`tOWF9+il z^geUlpA8S5eql-48HlvG9e%b z#<>r{d2rU&bIZ(rzmhP5djcHoXhxV@c($h^T9J9*YtZQ&QS<#=a7ZF&4%Wxu!pc^ zEQf4~W;+oVR9N0(;Y!Jc)Juo+6N(BfOZRYC5O_h!QJrVh@*SI4vMkkzZ2;}N^Tnlz zIZ+VYO47e%XaULDstr8Jok{cY?G$hLPyHW3I3R`+Kox8|p~*nFVfA%{gX6S5U>wN0 zd^1x1%8pxejj|e+6WfwK9yq%6c`@jv0Xe)HAixq+)))x+qd9}|p&5g(A~hZ+<6F(e zoYf5`V*B@n`Evke-zYpcR~52T-L5R48--T<8Sa&L@*RBSH_-_J4ykI9R$_%x=x%@UI&Y^$CrYnG&Z}%8N9JhiZ z(WYXRI_Eb>jp~1$$e@=rS4r$jZ*bQruw%nJV@Xk^LhL$!qs(E4gDdi**|el~icLFv zj=B$EgkIt^W5oyBb8OwdpwRm&40hx9xeE3N3(q+-o*U(_b??4*f>(hDAoKU4!;1e&-ki z=nIJYc1yGm!}f(xla z>d8PyHmcb6O?xk--?hL5JLRRY!iCg5AytH^AhIx)9#2@=BnXX@(}IX& z-o!>4a_37%EHPjzgAn{zXBKV$zJ=Sr8j(%+lsCRMNz|U9ReOn+-fW=TWcU`V#fo`d zJ2Rxte%^oXSzlVC7lmp4+!_y+A#uXHXpiNUuc9fKVgW-j#+B^HUD_6PI+{=IPIdww zeVDd*#4C*kywz8%sI}FBRdXP1FJFULLYoS^N0Zx?(jsm{iQKd9AxScV8M#h09Nq|x` za#v-!LH9Vb?230atOJCDc$Edk2AZ{1BqAEaIa<5gR<6s+IcIN6wmt6~8=8TaF>-~~ zTwwrF^3aF%xA0N&U;Wz@)^18Ps*u`uH5F*ru#1mk^a#Jc>S3Gv9_$)BPC)oDcws7c zSN-f4DmJc6rrjkRS*O(}AFYIH; zTeRbCYP;4rl^g!;P^pFNQdw5D+SP(D&6XQg$&LtP9I{XHYi+dYzgRh&olY;SqX8|f z0uQxl4dhoIUT^YV7Gq0wcPz<`InkOd9B;wN%F}*uw4N2wz-}u4_aG*6`8a#Dskd*M z#QB;nnQm%?ceW8L1{aJZ@p8tN-^Ddfm^K=JFjmpyTkOgrT$qkb$gaN$2I8GzsAX3U z+N;W-s#Fe^b5SwgsZSuD*>Xqd$Aj z@9k`mU;4gSGHs|16I0+DIjxAB^54po^)=S;^6BU-g}@ccgUe-H$P2#s5Yo^f$j!@Y=&=k^(uqr3yXVLN4t~vpQ{JGY!kwFnOtMFq(UTMvi zhef_tC%>Z&nug4dR{U9x=&Wp`zYVSG0zFv$A^&S<#=k}TQ8b-c^Rd72e!X-R;gtn& z4WbaWQ;!;yhvn_G+cCI}%>~|S6zrnUH|zB(7f|vpgo{g2TE1L1mM5s4@#&v)V^Ua0 zy(1C(M45|&lyM;`&Y|vXnXJXdZWW2hbf)TVt!}=TROy;>Twgo5W-(=AN65vhmofKLCS+REmU&lJvfEe9 zW<+IHf>+7bvKd-4;j0)iwc0NrV9RptaRQsy9zP7H@BVx~F!cK!!oCYG_5IYs>#Qlw zKKvY)uQ}{$z@K}&V5MtAkF9W1m#O12wbn&ct}@Hk@)%hkL#kBMWq6}cu88E8;k$7> z6?9Zel*{pD*q%G-s~`+yd4sL49Ojo@uX8-Hrc?s1Wcm2a&)?`&=EXC+q}EoFfy?mC znVu|vS4NP_^0gVBI{~Y_L}qr8{9WmSibr98toE+WB}n;&?Dr3 zDzo6(2<#NL`jqxi2N8sEPzRBObx;S7fsj3FVmhyi?98?p|!5q{QUc(&J6aIodXe6YEJ!nS6#*hg(Xe0E8J?J3JgFWaX z?1Me%A>4so^?L!Oj1Y{6V7!EA;Pw{?q$^vpAdW!!LAMs= zG6F%Q2HFQfWDcbLGCO0C3D9~+$q(N$)_~PV?j5PF^=w6}Z#!63@7ajb(7Cgw(YG6| zrfadJ{EGa45BH&bVVC!GI)DYXZ}!b>1V57OZ%g~OBk$Etn2+YyzBZ!;v>nW=f36!(bCn3(S{O7vXVzaLLALl#~ALF~yh>iZo^TiJ3_CpEX4kjV86Mn7B zYI_9FS{3l+nJSJxXxma4PJPjZ`gqi-u3`*EhB{a;>OfR(&ZI!s;G981Fjh0JN^c+b zc&4T#IZ%$+6(PH@ju0YwH^h8JA)?eeCQG$IXRgvH&#syBhLZoT6k#g`QXqFtgaA9+ zC~VT&u%ykYPL;1?u~F@6oVzaPkyu{K@?6m}xjWf#j>o3GEAVT0<={kZ{29bObR+ zkCX8-Y+sbQMR~9Ph3fe%vkzCffc&o&eKzf%?1#-lNSFr5;(N8BQRR5X2P8)e!AexP=!|T~!?f?PeAZ)h+9>Z%HxKTU?bvcH{L}7n+v67>k6j zNuj{3G$+DRPTW!cs(_-NURoyfnew3O`@IUoDDZkKC~Gjv7B?I_vGe{K5myRVwGrB&1>oo6eSvc(XFRTK)b;j(iT6+*5 zLE7A+0}o>B+Gkd(kMh2YnxUBI#va$p$hkU2%qQvWSEE(6a|$wqCM7l7w^Njb8~(XVCTF zJdJJg2Ek+pT6xy;?uAEq!v+_eGgm&A-nff0yH#Er6NTHnJJbw5*7QvegkSq%0hprW-%4bdNH9DXV zLY~N@;75M}vBGnajIl6zqQ~>Gc#g#{s)Uf;wDcu#zrmD;cNeWju^dDscrXO>Bv&PW|ydnlDzJ#a7f|{t?f_8U#u(7+netH!-;K1C?Q-)siNWsYQ9cFVFXXe_L~)z!e&gPGNFLjya>FdP<=j+s)R?Z{fybY zGkf>V#&T?%GNG(HB8N;&vdBx#E6vXMW>EMrx37+uG=z8pBCMcv#j7smO5{rBA8KG{sT3r@|L& zOh4Sm4+#R+<4f!;&&D7=B0SEGXuDJTv7@lu55rLi;RM)Xlz(na`XBzUDCrT?6E*qwLC ze3CoCU9fZ8)2iUGuTyC4G#ZuO)GKOL%Rrc#?rH6G3J2*-6i`BYrBg2d=qYilq|g@b zh92Dr_xC8GDzUxXi1_zoZ=p{H7rxwXL=X|g(7#PppG)=%s`OS>h<>Mou})rM5>6X8 zkFcNHaY9IT-OoXiToy1gL{B^uizc*-9q3<3*$54pB1U>00i3+3_D6jz@pcpQVmD$h?0<^s$Q=YOp;w}? zKH*o&&;?;Ax|->zguDd&>Iz|0+M1%M8To4BkD=eO{OuYgg?Wb)19mu#mBF+QD9sq)r5v^sBw@Z) zn>$$ARUGk=ms&fYh-s&xVp97%)Fb7?#I3dr&c^%QE64DaUg3z<4rW=d`@ycIIlhGn zyyF2);oDjgNN(~)VSdQn0K}6=6&hL^nchw-6KZ23DNWK;b{<_x9T~2&0(N|Q=iJfu z@CJo@x=JmYWOf0+Gi*};(co!OUX_jFm$dLsf{>QNst%u8Ij7nhXKQF;DpGkGXX`=} z>W8%Ri}DEJHkN&t50&w6b$gZcVcwSSfBl`|v<%YL!M}lJb6%b$#InNsl*4zHB|ZoW z8NHIaLh7mtS=kCz*$P{kuhBWUO4=;#B*Ituj@Oki#)95jMiX41B1VStTE>0q2z}Wn zDJWAZ{e4p%lHp=v5Cw=Tu^`!h3c6;OZ1i>gk{Cdn@jnC&eZ80e$zoGlR~#H&On(pN zt+X(@61iEv=uQoruQI4pJF-P}Nw4;Bg5Z=}3}IgX%(LMm!Wy>cwbwwB#F&qyV;5Gv zOa&uo(@+)jM@~@}Yb4yBlG|&}5XpFSWXompO!ggByKvmSWO3JDZnsEEQ(15BaXD+F zd{G|>h+b3A1M*{z05dy{NY2!D@04`!e}V=pmRcYdWR8EhdB{(@h-rr-q-qbDgiNi^ zj>Q6@rMx6$##FTc07^Z5oIR(PxdFLFyQ+e;_Q+NYa69uYg(bC(#xS{<`?IDsxBGtG z`@$#4;re%Ln~>OorpaK@O$sFsJO62yspa6dH*(|Y=fa6HEW|?2#0IFhmC7cbur}zhXCV43b+4kJLaKe;)M1+ zzSbj$;;Lq5=*#N&ZHQ(uR&)-hxwqT)FLtqr1HXY{$oNd8=AqdBvp2+%@g`>pv}^+V z%{^e4j6_()e<_k-7z#bMl-fvXA#Lue9@hAz|1%UCr-s?e@i@&~8QGW4Qm>MuzZ+d| zQ`;`R8*z8o*|=o(>1oeBtk~9b?z#GwC*6P~vVO=D=d{UT|1oB_+i``{?swScu=O0f z+1IFV-ZNt1cFwNWmRVc8`PZC$seAMh`7lx`mM8zNI`eL`?k+E@vCp`M6pKb`tas3J zd+ya};dOD=6K~+Puz?v?{SWtfr^hRS?H$*&ubZAX){k*F-gpjl+@>fC0-z4ifGke&J$ug{#S3? z_Bf=-e#1ZWaORhKZV3@yTYszhVj`_oKW+!At1~TgS9Pp{%l&&08$e_A`Q^eg2R7vh#DEHtYSfi6(FVrlTw0m8Azp! z7r-2)BvrU_*(9j27vxah3xSLXO&}LGBR>(lk|(f42~J>*5~ic*X~;*`(Ui{!$wzur zC^Cq3QDtA#&6gs~o$Xb?_}fvY9v0Y=gGebM zR|~>_pA3{J%)|m%Vd?J$vIH?!@(t$gnSE$|b6~#YY?{^1E(=5kuGgH@3C5?pYW|45 z2z*geEd7tR#P+|jC3epLN*vTnowh$Ohb)@!;-63Rykz&)c0+IbX2Z+Y?P>H;=P>TcuQyKK1n@k451Y{3 zWJ?!)+{C>wYIGI2*ze;PZ}WZs@Og3k8OH5y?EXMOSWEZr@$s$^9o*=MI6k~U)JpTb z@TdpK@Y;WTMb@stj-@5n@ED9~JkPe2177{~eK0pU-M@nTe4Kf-*YzUy$?#1AjC>o{ z7u-P#*~;1TBDx|?wh0c5XUpfqYpc(iwMP2B?)9Z7@?K{9y-8h|GF|fSW@U$FRUIW# zw1|x&@7J4P$Y>wnNCmklA*B*P&|oAAj7+NS)dv@C{+19DpJ0; zO(ElnFp0b)(iHjvgaET6vQ!v=+*u71Y6~l0vM`%UL=C4T_0*DFoXPsuOw+@1G?+$M zEd(r@+RjaKzrv)$g+0RRbYSjP9~kG{aWL0jZS$ z!lfvr>Pd_y2&{@^1rwBwMhR*~oQ~oJ85}_v$?FQ7mUli~okS`4!sYWs_CYnlg{U<3 z$iP}s+L?ndNhnc;oCd@1GE!`)HNcE!Hfq%C6{4Hs$BK>T3j`PfzZ*Wj z?>VoVM!Ea~G-D!ZQzWXj>Wo1RYCGB`x;lZaef6;&TBhn}oA47eF1yw%C+I^V?=I;L zhLj85_?cz-ML2!zoA1s0t3L^Rxsm$fi$FJF=K23<_w4^0yJ!7xNi@A=1)D=g#L=5? zRBm^zs2}NbVMfy{2$1YH)~hBT*Gs8C3lri_zuul(pYZu=h=TIPvtC$>BdhIt-M&f= zFa%nBGFKWsa?__BpK2>Ya=bB0Gtb}MiNk)Lw_=oZud?ncxuTid5-t{^x{ zCcmn4>Ih={0|GWn#NC`nPTDsqsYx6zzOI-jy)NQHv}=h=58gBbGC$?EYrFRechg!e zb|Y`LrM7!DJ{p?(;|?QoM&+m@r-f2E&~a zDb8U&(f;->!R8?lQVjr7!c+Z!czeef--0gOv+dKit<$z`$xUujA1c{Nec0K%R@GY1?^&b)4cH>|`~r_cfvF&^*{xvU$lVOE-SG0NMo|va@hzs1q%bQ{<3;&9tUH@Y-79E zle*8}TI>!3%7AhqV6eMc%K&8gQk=7byrm%LhVxoMu@;9-kAZ6X4*W4V8f99@oq*ud z8TM|TcN6tq)8=kZ{y4d`Q--9;&qukQP+#1Uqd%`cAcf{1vj6pi_zwrY|L>ssKl;g3 z{_w+y^-~hUumAz+`%nY_mvz|~{zKdS|3qd+Lbm^jn46KA<9|$4UUfsa;fcEtYO8d+ z?fC4xTy6RE+O2qb-dOmplT9u(R&6zqNw<(rrd;_S3_(~k=m+)-L=)i;VvbmkAnp?d zLnAUBhvn7{1;>%fKxARP4$9jz5cYDHR($k`;xI8hOtU-5x9h2?sHx?0eUxASCW%H= zn&S-@Zjs%fetPjeeaxPFz~^}0vj5yn=>17$cggp~&tDsj!{7Eh{dp63#uUOidwNzp zE%Tmt;%@2%zWO_#IlIY-$=r*+PEX?edU}@#`Ep~8_az;ivlgcCg~NW+dw~9<7o{g~ z8YYWLz+L}yJed35n5qkUbp>USX~*gEno_urb0d6OD&OYGnXX@26J%Ktd=#jwQig6RD7t2>fk?7CDwj7!kL z{A9dS{|Q;>m)B;F&1#}URo81VeS%xJBk2r&6hnopo?tGaUtARw=Z0>rFmhwM9CuYQ%a&H}tE5Ux-6nUUvkA8{^`0KvN`A z#KI)Piuq31cx(Us-g&n@OSf$QTKv4HtZ<(z&<@uTVnoHTgrW5hX|PONCX!Kc)o`*# z$VF9XC>5Z5*!>KMk(EOk3@_SO+*RvweH6MFd1Zs*S5{~; z-7SU~k{77Eg&=3jA#`Mt6hz$RecWA3n}d2HY9LMw{KZex(fdcRTGlklqE`S)VyzYk z#yVI+_)x?)^f<2g=@imTua@vZZ&&tTvL}`)T zo7hWBZe5+Ul0D*-|1OVZofkEk_uR7|maaxbLKTaO`O24Gxk^TpAtNBzJ2Q36IiK4j z)kr-ew_M5=%Lc^p-9KparA|^+u>DMLJZEIhPXDqfh;Co8jM+RSkZYzfSi4_K=znTd zwv!hr2wXH|3>)N;SMpln517A7sq2G|UCg4iP**l&rn6o=YT5dtf7Si8MFsOXyBoWh zuSe#V;R7n1Vx~(pN0+VX3`AB{S&_Yv8xd)w9^YtDsp6<2y)sCY*Lvvq8>z2NcYDw4 zn<%N$jpN+IGoO6Rxd{>jvUaVgc8Sz7odZ-Xs>M$pc-#{5ccT7o%fZfJ#12Jd!?}jx zUvJFhU&vvNFnb^~{Zo(xtCz|wW`B#!$+wFw+n1DsYpns!8Un&P>0ZdaD8Gb3bMlnA zU`+%eQ=p7N85q>3UO~EZKMs)Ta_DzQ?K?~s_hc=-3Y1tU8X9R7HcunT9+PI zzoDUIlR&zHOi1DBaxqeR^0L9<_i}9Qbbh=`B+;rW0hk^LW;BPIdi}JwcN8SiDvcb< ziM7gIZTqzGb?&YIMDIw#hg_h2$W`vUH#y2AW>(&G_;wFcm=~P#)IH7Iwb^ZyZFR5% zaO<5K7nS48s+Q4$=MhXgc8Gr@bVcx3Al%KIWy)E+;OoGVwi4&Eu$Su&cpSNc36q&DSzhoP2cN;YneZcuMgEeWQWn>H_^+o+jE^}&Yxpdl8rq2X1Cqwno9KtvqdGT%v{&&Fh=#_b94|O&$w3ISP^j> z$Q8?c!=Y8(=_#yK7=pzyZ;d)3RTbTv|b#md$g0@@rE4umfN4|nMQ#H zI=q=1mUw`rJDt@S@_oI7c^}@(hsO;5s{6Y6W&8CvBob-kAnv;$A$c@Th z2`MCRxY@mHYDe@-A$U@3108(0Wt@E(B$rN4F{(uEj;IizkQHElb8u+*iE2+s(*R^;2u^f3DM7PQu(b&QgGj zj`}^JoD;X>FTM*AmZ$ZVuEmoUM7Ylymmj}|sLUeGIIoFcutvwyD<7)lixvyNy-TMR z`$u*f+WzED+q?`PaO`)H_-yU&vMNH7ujZsl8mv$^;Bc$NNQXSs1g~93_&n;VR%xfN za0J#9+Ls6{-k=h4?J3iJ3M((27&wT$=*^R?f;ul8AdSezxs@N;vQh<<&ESN3cMb@L z6H@suVaHIPDdvtY-6O14b?GNA=ErgyyH2w4MQ*7BhEtMJWGe{6`>z-kQNxKND@I^3 z1<*MgFYUL4uU_3>3XT1l3t^V_!TG1c8+OIh?h03F#xU{H`*X=bN-KaHm(U$HzQ8t< zWr~9B#C?VDWjQA;qYBK?bU*sE#HU>Y)W%s;>ZWgMAf3Po5UJ|D++WvMWj7$1$C~EJYo|?oz2Mrl+ ze-uSXz?8lcw2$C3de8ujpKiM*`6?*Aa7F#rk-8AP&&+ynnounZ^dzn_JFH$;30}K# zQ|a;a?&K@gWXG^E&`gdmRGs++vR=thOEOv!k7$*-vK?P*m%TVDP4;6x!XOy2SjH>X z<;dc;T61=+kr&ZFS8hI|TTj>RR5q@3oV2bQEIWOjF%xB1Hg6VMMjxMC_4<@wfri?3 zb(k<=kw*^H&DY9$c@eYk-mL3UaCGQ$`Q>LyMgvP;W8t?A-44mgOLhbx!d!K^QD5H~ zD5oeh-Rds-`1|pa1hB&6SG!<)OfAy-+$RGy$Ah@nq?k|+4>eJ+*5B^s8%rZB<;xEpk?ILD>uJ<@0M0d= z1h`r)H4`e5-&WS;;u`!;9ZF(KkFO?OA1rt{ChD$p!mZMX^la5xb}vK( zqb6+npVo+V4L`&3zkhDL-S(}cH2y?w)hI@Jo^tk|+yzkYgIQP5Cu{&^|Ih(jJC-OR<2IJ_DkKviu~KuT-tZx(>V$%E+fj zp;s?@oa(~>;jL#JGO!_z;3Iot-rqB}FyFL3ZxjR0n~g<=cn=)&PwAfH#c?`S zwV+Sh-c08=eLu{;*Qiy37%NNGY9oGi9UPQ)Um&dG)$DIxp4RCN&ggS)rIKWShn*q#D;x_pEPHHf*)b)|0tKUWt{^GG#2%l%vDPDYq7jH? zXA#md=j~SjYv_Lsk3aEiq2o-vZNxtXwpUt)PI+ft2nOtkAY-x?jN0DNf2rufnUH{1 z{I2G_JS>tXd#;9L{~WK0n-(Qy{A`>p4ZKWu+6udS8P~PMIQ?Sb(So{eq9NPJIe_oohrizlgh{IY##!ius`x;gGPkiqY=IJ7{Jw>)xPvw<(T2rioq! zixVXbJ{dsgBtcf1tkr9jLN&zNqd2JwO!+#>E%_8Dr(l~jl}m$lS|tkGl1mJK2}$SO z>!jc796O+#Wdb_y5zQ_f2V2|{%|D0EzMg3_H48X$rqsRKYS%m_2?C)oNKEgb$l@}1 zVbvU64`~}da$VZTPo2h(@E*I072C3HrNDLZ3O^c}xV*iy!f{YRztp6vv+#a7XT_BZ zl}en3__ygRj2-Q@y{Us;--;05j)rw?U4LKyc8~T#7$@wwAtr7(QVW0X-Sh$fO8Y=l zC$lc#Ccx#2Vt4NB_JJf`xSOM!`bj(9wCA67l>qzP|D0^fJ>C~lKgGCHyCphhzgId< zjlQeB5KDcGYVynH?KR$%^TvLU`9vBSx5l+XdH2>J2Dw6tHpm)S9$YtOk5-O$ zh&!kq_!8TOIQYXxV3lY$$dMegI2Lz{vDTrX3vwW1orQEGywO#aoo~a%Z*f48w-a7! zkQEYRWOJ{JX~uZ_O6nlki$CiN`CdKp<(42jH@h!RiDk@u`il1{d&<7gcG}wb?;%W0 zorn4-$gESt3DzA*lTOvNH#;ZrOZ%^mj61*l1808N1Df4p0VM8uPL; zZjiY@V{7U%Ipd!f9X>TgYuz>sn)p5ACHN<({rwve`tVI#EIU#Y)v(=&FpJn+f>rQQNL66d^);aUF`&ZfV*>) z1a{&aI?Y|vEMgK>8{xz|eMT-5L^-)r;$BV6A5|^-V z$0HCk8-w`bAnRisw>9uiuwA&yjRVq9OESmhWtxF3L?36a=_Fy$p=23Eoi?LAa?DdG z3pGG52l)Y@gg%OvHZENNXn`tDxh`lVB@6`hch}CPDgB4Bp8R|tlEE;s#KKIedEiw3 zo48_Ya7X>=3xrE|`;839XZfs6T`YC4m&;J*#Kzv>&VSNSolzy8e|nflxY zd)1beYnRc95c*fuk+z+a2Qi42)6DPwaN5CjyWEkI6{}Omx3^LT6M3?uREnFA7a6DV@}zpm2=`><6-FG$+UM2nKdY zN~v@$U@3+LMOK*&%26Sqgade!s-kP=N}ThKH-madxwF`qe(-Y!(~}b;f+>`s$*Bc% zTBGXUCjus{Ia9}U)PD3yuK^K~b2*I&F{-4xM-NtPt(q%CMlljJ{h6$j0(5B_8`M{0 z$p|U~psoo(x+q(E`*uLO%1Iw#!B)Gi5Mh!`!uFS|rNEI>9P{LLaRmnpR5 z+?3(`u!@XB&DIJp>P=2Xx|YZoMcd|T;wc)7@`oA11NpO9#3E#L79}hRTU1Qu=l3V5 zBMuA}(^1PsfrfNP<)0SKYSLkNN?OTZpLM%*&<#q`qF?i=OFHs4sE54r{Ia%Aln)3W zTN(F7#8NjHSrk3ZdP%w8+!L+I0=cz`8!qn($J!AL(A4AFke*zj3-dq7lCWx^AR3jO zVUZWlf2b?bPXQnusA|CzROuKhl}j=?vCDsS>(}0$KQ!eI;f*veAnsG^9iy+S zjGGy|^OVsqur7J(3Vfo~xe!V8jtQCJow*qdFh{J`%Y#w3q<)nyTbwx`S&+0)3e{&$ z&#T8QOl0nti~b44HfnF`Zf2r~N-<>QYN^%8#2JSJy?!>ewKroLkh z54ux_N48){LZ8PaWfvX&eT2omcj)fHvAxNFn1hdxIZc(;imsLdi&C!k-Gq#=GvElfF%a!aexS|33$cPQgZFamm|Xod zf03EJb%j597w7+6ZcceJMv)W_`+6=7+FMJI#m6|m-Akr<31-mGafE-zq>51Wn+i2f z?uG2pL!2VVtG>qNgzCCEfE0Lgkz%Z z7d4{@DSwhIOn6w+MYR?K>*|dz2ZVk<|K3uFVUJD$RhiBL!zOe zU@<0iaYY6VQKBJ-z&-~)jry?~2EJQPc;(>|uIYS^IiuiB$c0Y$D~%>;z^NqzbjdhU z6|X#icXk;>4Qe23N?{O8`e;*yFwCug!xW&Qb4O)CS*~r{)zRfOl`B<2?Anwup6|F< z(t_I{t{SI_{z>?W0VP=%`x=dG)BepQBo=E3XEFrG@E@-cHZNi%LhK&9fKI z&JQTJMR+%v`YZ(dW{k88Pp*o`hb3ar-Tch;3zN{$IQ}AedX(X0UeI727;l&ziNIZr zw|>DmWV9uzr%p$Q(K#%M;BOnfmr4VS&TbkCV} zMO=GVEElj!yp(NbrnrIuHUc3#$(XW$&0>I*$MPfZtte{ryJ%#0%I ziZpz%yTmFkhp$_$8_9R5JBI_%#enSOV)&a_80X&_6KuT4DN|GwmKaXiBTNwiQ__x! z;em`v@T@H-hE%xZQ2<;G-vy&dOM<4Y`!5b*OApMcNfU1W1KEk~6F6ejv#(;gI~cv6 zSl)sK6ZsFkNIjS-90Ib|!Yu?nQo))r5JgrdA_(C1|-Q<2l(bx15zp= z|JKwIVf0QgAd%FG4#@GI5RIyC`xTfP9hm~m1Ijw(SGu2bIuGq+Lct9QBBmn7D6emb zV#gd-Em$p3PPBF)#q&!}azK?JiMYyD!mE3$%^sN^ z5ce$)syACV^oJ#xL}=I114ELEzw?3UE9L?vzuA{eEYFH|Btj{a69Q048*_jTnfsgj z%h~qcw3iaFGk_xCW1CURSzYp&TxZ1~R=AT4D{T)%CFFH^Z}>LHMDE-3EHPLlUU-qw zMfxcu;Ke=NnW`kptF0!FvWSBPTPl4YZqJkPb-hPb8aq#vZ%UB_PaL-ya}eoq2xv|Q zq*EXL9tbRK|IjzDnt1;7ExETzThc8td%f_u0WIJ8)8Qb^Xqg~Mqt)S4G`}Mo1FIoI z)FS2SVcNB3Ow)*i%0?9SE2cEw>R;@JhN$a;+*LFlCLIUMR=_9WBHaV~(N>vU2n*Js zWzi=$kE^Os{z3bpG}h=!OCf`%yX7I;g$N|FN8V$tADRIh5-}v55@xAIzBM8kK@S^< zpjRjbVT&3a!gyNrbZ1F1ryyjJF9svNC3K?6M2|8>WVPdv^35IH)+yEHmILEqaw|Hu zHSWvxZ;A*cRM+_qa@$mdX3YXjt!3}>Lt~(NXdrI^vRDtUhA5`h+*7l6uUBKy29-^; zMB`rG|fae$@3Plw|@BF(?I#>dL6rC7^Cxn`r?w3@6jiEDc+J zB!2Mqq5pcN>tAXaCnc&Q5LCmnP8H?&#olJ-zQOaB<|Wvs=G@;|@J*?M6sfIUnq|eN}A1 zZ%Q~h0&qH7@FkSFi94JBaH>aLIDFPJo3gy;(njN94esD?YdAne`R&d(^5AI1|!TNJ(p9KB0JO0pViGG9G_#?Et3P8GqvCo5JJNt zl=7BujYjPFveY=#8J%idLG3=h+S9M!b0{GTN8`j3mo757RDV`Pn`@*^8w%9<;g~5# zTrH$fW@|;`nQEs_&~9nV+ZsGRI~w|=Ubgwg{`u=3QM3GHgoR8}HI;mHiWEmnyY84~ zL(-tjuyS+ zN!yK74Leh{0UviL;pE0SU#l5+%*;1Z!hKA@TQKL$tYYsu(9z3p= zYs;i6&e%FeMaBL299#yHGQ-8?vJvtI zYZ615-S+jo0kh;I>RS5n40dH?d3dE_x4=trPxJynla(K$ZR((6ryed<70H_!!*!Lf zp4O2p5?Wo65w5aYAw;C;WS-zzjE!6fW9+&U%%TRTTgNtSjBRgH+imKS&(Y}NqwI)o z9ob=QBLb-Q*jeX}&COtgL<9bb>NID~945ParSGJ7aP}Fc(O95&~p(I&YO|I!wpfB>vmLG`U?SwJACcubgFjP<DC-`}CpYUgCPMsU-u)TnXHz2I=N*(ew6*#-ROSOnOFo-X?Vk|NQw^izCxm z0cR2iHG4th+2D_G5Ktu;KUIxfF`#E<#m7!GhtM$FgD(E!~sX> zmSbDv`W>o7SGr^{B8?0&Jv2VhDrsP;qs{_7Sro0zTKq2!vS16i?(Rxm{PHaNVET6Y zq`?-dEK3T|E5)&J-m^{3SHGm62AnBjJXfE6@U0Kev$N5br0jzGan&)Isj|ki>P8-I z_5=2b}0{}Kh5&Xj`0gJR-CrbVyW_j{eh`E(i?|Vi19SB zD|pGUx44zvk?~rMvQRe-vx%se2raZ?N|_X`-Nyuo;&wcSb4iKUmAshbMD)gVzHed_3s&8&#U zNkx}N{H6?i0pbo)-WE)gVx0LoET1#gzs>I1BWMpaA0Dp>jPYPHFb8%-F;fR@g9tHK zuHQyL5Zp=xS(qsed4AEdC_iZIOf#>cczN6NS8T~ubpzQU^`03+OT>z%_M{}|&NA*J z37m>bxT%u2YMRb1$GVg7ftT38)2FlR15%^TXEIqq?ZwHf{4IrIM$hmmW@k2rVxp+! zTw*o-n?j!ueiZ8O787IH7@H|IHB&rQ+8!4#Koka3yXVf6yUcNAb6NUOXL`pRZ0v*LD>RaGRe%rDoJHLW z9k`u3>&F+L{Hozg+9fXEu!E|{O@WKXx6Lp${-kPgd~O<%ykyp4%Lfebw2~CLsu!BB zBkWF(Q1qt_u~UXhhO4EtqPk@nS;YJcrJ87C0ea?e^fGe8B+~?ra@fOw1#HT9_3=!%MGH72A_pU z0kh)7A$PMn*hG8sqcey5F$|^m#3MN~z>Yz_!h*9ZvRirps`!4RzaTwaVom9hcYhyj8zPF>E$RX_sI_eh~XC zxGaL-;%7k5ug!7J9%jr_10}sjW~tW;2<4{NJuoRp>c!k>|6L__LUsz<3dtX|UGo7) z64=gFSpeylioay78}in!-gOq6Wa}lT7J8YJk2ISst3U*zN$JSv6Q*y&!qrb_<`G~{ zG$^E#jck-)yP-i%`zh10KlAR}o$vUnGOq$()s{8_s7QQ`JiY`#1R%WE8BAl^jiKHi z&jnWh;30SRM6V`I?30y!o{vMFo5Uw5-MWe4F!u(t(7=Cy`y%Z#{Fc)FwAmEp&fI+b zHCQN4UK$41YNRvkE=3Jp=n)_*v=D-VzNPe8@R=WTBNIkqa$#D^L^9bHt|oG;*Q z%JOSgi4ffb-0*D4e6)ccIx#};M1!7b+ZN+1gR!24weNt0dvbVb!>I=B>-u?NLRK#Z zEJ*r{<{@WKogwXI1Lls&*VS0h%YH>&rk=Idc#fPNougCosC%4M_q*7hw8hhYkk5GN z2HX&G4Tq&*TzA=?%*$nbF8iupS!uV4Ik$06?}*dG!$HkX$1b~r2U@A(u-c|N*{oI> z*`l&B4SuLf@iW>KMC}kUN!91uCv{_OgU-Bbx30;JJ?xkqC1$~ysnuvqbZPyB$r|q) zact@m@VdI%@gaMOx|kI-lQuEF?7wxXWL&w1*3!T5ILjgQ?*v`}wF)-%QB-wHlu3Kk zD&4@Dv25#y_Dn3+3bbkR4ooX0+~Wy$=p1OW{q9=dqh;+)-R2CL&aA7!mDLahKEn|xfmTEcEjz%z>5?{@jQjU(BYOWbB{eRB zpbZr^)N3K#G-~;=6^S4>y%`L&IyL>_WNh0cfoo=0VY4%dDR`FX+<`>{z$cjZ#wFwAM?%Ak1W zzNRm{w9>C110S2B^Y%6=Vx`w6@_pX2#FpBscO0sN)B4I9+HRJfGfp}#xLSlf z#D3BIF)dfBL9D3=Ci<%uffg``dcU!y_?v=Op>U=Q2~MKlkkJ}mQUFPd5cyBD`(GRQ z#gg85yjyADY>{DX-^g3{1TmDtbo=tGLlcaf7GPR;hV&>>xM&1&s|x^zQarPU8ZJ*A zF)HGC-^A16_S|I$wT*MlR!d<|bV+zv8VLvsuW!DL`^C_07v+Zj47W?92OcuJtt5o!kmCx(scT*PISh+ZzYvi=Z3M{P zK;z!&`}V6!3qUfq9w);;+-A zgolkQ(X;_ws__U5A?u-=95HlLm-?@t)5)0}B@O}VWy_%g*S7U=Hu(ss@t9G-*&=JL zTyDkX)!;sQ*>_;C^08H|QvYVT_xxUjIP>qW`C!Ru_+)K#71kpu&Yw!P_J#K?uZHBM zbW5J=CNEN2^p{uO9$K#!mQ*M>F{0N8!B136#t&JHE7x|;0}}A(7&x^kHH)0{s)gB( zn2;8KT$Q+!y_F*flFc}IF&KS36S)?He(RKzpX`Yrof69j@vHdxaeZ17T-yDYhps$9 zN|v8%k+pFYEG_C}jxPt^?NB3dZXZZJ0))C$Jj`GDKjA;z=x4S2T+VTny6k+qMXPW~ zh*2*>DWUZYegdz=v7(&wJpcZ0t4NodA-Q{y58j%|*NMc!o&?9Kfo>`#8jU^=NcL$q z?8eN%-F2E`L$DJ!9((8F2=@q!`x0?@eDA{&Xp}p|#fd_MzAUL1Ip-dBijT-%;a{jK zAn&4MZzB+C5<`z0!xGRX7zXdZer1JOkgxr-I*0!PW;hv=jZ;{6>kYdh;xFoDDY}dP zHj2i!ZM~b$2tN72_X4qxb<({T4)}NeR42PP`r7d@@CrG^z9(}2y<14(Q#VyrlZeRc zg)z{b^U`Uk@2sK~`Sk3|<7qtH$9lj64H0O-Tq_p&UGy&kgvN!!mAc=B0`PeRjgex0 z_nMw4{@N9<>9rctnSP7J{4mmFSl?v8vDZY`-br5kCA(K+7=^s}ig`N93-#y)`404j z!MxrJ3ZrW((!4g+RAW1v5^0{<69bAXpwJy-isQ%GQOa8PKn%#$mAaoSb`@eN(e{f- z66yV(s$GMaiIo#Scan=*A=&_-n~l){*%1 z=SF>4-=8At7JRey+9d_^0K4zdnkgGA*EAR}Ky+ zV|DX>q-0hgM!PqS9{-7>;|3itJh(0QXA9YUonD}?3HnC*UA{U09C=d;3ylr>;KU@x z7b{_0lHXN2~xO`S^3Mox*q-Xv@C(pA?Auu)!3@)sSO`j z?A#U)@k+ZzG5-@VS9o&dzwqLAhdYtF;|j0yUDNa9N3MYPx)TwXx**D7C+Kr3Oz=Jz z#`l2pFGY; zn%FA@e}8>V-!|IWOPYK6oppKRO7BhXi!U19{Q=_(F@ujf><2t*d)TihuFDiG(-!c# zy77gT?(d18-qt-Pui8(PPYF#FLdo#0f%yO=b)Z2Cz~xc9&N-2I;fWy1q1<|4Fe{^{ z{J-DZw;Kc??}tC(=gD7~5+W>c$H~PNfGdW7t#~N-^Qgt^3IvZ~S)g;u`1nt&lr_-0 z`*LstP;^9iqhs&?LV6+QAKRJsldFT)3R!`jg`$rt-0$8G8}>_7T4-xh^HhJoPLAXm zn`r7Z!ZxDa2}vaz0s2W=l_e^*VT*y8Xdd#8=MwlN0LLqxW9?zc-G4dJ0VcvYuz3 zW3Yy~N_q80q%Egyo4*%(Yd1G1 zUTbaAd%1e%Je73$9Zr7ayv))j%|aRm_yn8;1?=(?DWCG@KkUWq5r||cBKt@`M%72G zD&Glw%6zVg@ZQ-wvb<&geg1p!wLsr{aKE-w(3R#|RGCVtH|c%cO06f1N%Rvl6p-~f zsu0kUA`sYI_$oIdNO46WcEjecY}xph)!%83{-+!hL7Q*8m=2V$V*M!u*fCf= z_H)eUkO#5sJkEOCznmGBE|aOexV8fMF+&4ccNGK47RX-{#vLTp9Y^9oPl zBJ;T_3b1j>R4aue@~`Z#7_unlrx^gTvH8>Xd=a*R-$9o>lFm3;aY8#(&e-dmY&%$K zKP=c{Xq4=IKF&inr$E$$Iur&iFza!#!aqoDj_@P+ro7#yaD8pVW;Mawv4z6^I#>*q z1rXQ)l{j;nO_58U2U4&ksrwrj8_=_PnA=cSD096W8^vaG^@S{RcUlO)^Ee1XD;b+0 zMzTXaW@x>ZW1>Mm_BfzOUWB9gZU{T$l+IEA!q?@j4s^r`>8u=u#pp3oLM z<@8m*sA_fS)#Y*Eye)oT4*Z87HBO_o|K#d0?iOF=nxRoR1xwWKD7Y7G@XJqnIsCC4 zrCo}=g2Q+pQh~*^HtOO4b-y;VI^A>5GLWTmU(b88ks*i2VJfOM#fXVm)M6vg72h<#ZeVZtyAespsn(SphWHr=cD)q=hdY5 zoyD{mgX7!SIh4|-k%ih?kfx5#9=W)$>QLM^Z(bdsDw-9tjM`+XZw%~NGCV!!^gAna zAAPx3#k#JCCAzGk-EmGY%m_1<=RyOr895p^_(Agy-6)hTGau@u8YOH<_Ht%=-|}=) z$Oo-cEEmd#aptx_9Zpa$>}hGY-DLLwI*;*a7At6HvO0!NmR)$3QvnjMy@>Y`!-ySaXa_oHH%|_%Wx^ly{27vO&ocJ9ZN9a7_-&V~l1=>h%^yx%X0ogE5@ONw+rIDmD#KM;u1O($0xKVksX`O zDn%nFGgW<*#Ckc$hHs`yB~A%4+N#?{0T%&VbA7Qag3QSzt(kB1nrHlSW*8FPj7Fqdg07uf;(+*UaMOjLZJi0F6he-KhFm{QSe!hkxm3tV;0f)|$21gE%f9vH;VcL`f&gv`;GpM$#8Q2c z7=uJe?gVyEuciVgS>{ZJLGw0e8R+ZGPnPTL7sYScAJDTe`rH4?m@)saz>NQ$UBmgu zt_7X&Uj5f~{{uAtf7vxoMuz`Ck1a+HMmE;}G}*fHfz12IuAR6p(Y5L(r{JV2P=6l@wP>6kqAUn{zw-Njt!2*1U z8>m`0-^`6(dI@9(P`x`?R~zYT<)zb{$~Bln4AE1YGj-86TP0Foak?JQHu3j}JS%uS zp5J{NPO0S~S3L$ley-n_Cy2d?27iUw zb2j}Bi1vC`7{)$@U+I`|-+4U!_pl&#g7U>olfT8d)4BEu<@gj|7*Ke9AyKje^F;Ph zD%GYKa*YeJ;ahJ8bQG2dKRhMAvEL&3{BMY>g)x~K!%yyl7(5dUu%FX-7waetCBDB; z_`(Rf>$;S9{$jvmo6I4|ENC3M}3AkPU)Y3 zAA`RBj*c=XqfHFfD}tS0v~IMH4t=h8L{E|B9fI78+IpWD^(@>{h9oh&fk8DzLJeu!&r> zL3T%R#{LA43*v#GQm__nSac&Nj4)X!&hcn=FWJsJL<~#_h^hR`U+Y^Ixl`rV25T%^ zD*h>zW=%Ij=~7Xo&6;Xh4e1$_#x-k&iX_>;J%)tfU_*B3tbz}wRb>s-h}KZt&3EyC zGpC63^+%Qo9A}WJC>GSh??x%Y5zEa(In?74{-E-lQz$^bPp8c)vOq~pzcj8gR6$Z* zp>vBfZd6IYSQHj^3pMN+bt|l@Jgv0bXmLavrRvhy6@{*J<;#?S^L*G;;OMGRf&#JC z%x3!L@?_pk7PMI4h~8cdfw0LHkx*Nw1;GbMB#Hv}+8BS-jX+jP~ zbcq?NKj(ikdn)!R1g|3C&@|PdoAk{RCvim((H5| zflXecibfHlN>>+FYSWQkl6_6O`3_x+yCG)f(*>iy$jZ+PigK?&j$7vrkN+lDw*NYr z{c<a1OZ?!&3(dS}lA5L(H!URsy&KUK8 zjI&Cf0=gI(%VasdMakwgjcgAJFc-7yiK53rZ$OHzt|P{XyTAOcVGQlKX{oEvE0;oM zaue8Kme$GuyqlX6Yu9bx3d7493$8XWQm;bOAn2E|JX+66vpRUZ^DkA?VE<{EVs^Dm zRCtd@6D>;Sywr}c&H=nn(}!BKDP=m|>df6$rjkohKUYDfFSTIDqs2PXQiic=dVTV! zJ0(Ovb+2{Go}*<`1Ogv~;p^`g>Rtk$RHNJ`XAI#0%_YYvrD>tV(WLe87&q(1c{kem z%~YA4>-lxxDQ1le1)G2q@nJZy$$sPRQha~5LWAOgFCE*QURi?;GmS1J-%5&#)%n)F z(k#Rj<{?vIRzGOdNVqejqvvfXPBTeN`r74#+p+yY@D>e`9uYkZ_= zrukA`Lv3#O&P=Wgi!&<>Gu6T}2ocUIp&{Cw@Mvx8sxQ8Q?l^}|poP7C=?Zt-z(9Rf zJm%vYL_udHZcA)`I19W18F#a_;l+fC?x_M47>e;=0 zAWaZdva>CQ4PMtAT1b(N4iw-z!535JWd48)AR^xht+%SBp?Ew6J*Jp9{CkxQAX3K^ju!+nne*h5^M;%wr!E35_^b9Jm zBj!?C9dUdyHB+-j=g{TI?G3`X*7C|GHiwR9S~Z0xVztxy6=XCl7T$UnC}4acF*?zW zy*2pATxjh45PvnWf>;?ZFXaM!}w)mG7N1I zCyPwaL3#aHO$1S*>lD5gza!DClowogZAl>{hV3CObBl}Z`PetiC@LblwD&>h6ZIR? zG&r67fU$1DL@zr;6N0TH2yKWZc{w<8y_%(%`t_uUbCI$n4H1^`kLXO51VC8;JI=$^ zIkPw2;bWcV;)UDWO}^JarS4EhW9s>^CSNk;$OGjO^T4i(!}B(qgz>ZPc(e<#E)rfv z#T)RMm|ULG&Sm|4S4E2yyL>()uzhvp9=3M!V2JO4GF=D?>IEADLqFZzbn#co8QHwv zk1n7$;`?91?!*-{i0{|zEK6wg98dXmaM3J~O^`${(oDNBpkS*Z2F1)((@;3EKzLbZ zty|cQ<8Xu=bs86!ndtk_{ZqCx2T-)J{DwNzIdK|gI(^8j!Lj2Yh^rRQoPK2d)3%FA zb?JSwd?yUUR-V=hFY-^Z{2jN`!->t#U2#@<_Q|{Hk@F=y#b{Deytw-Lmy|TPxT?^J zQHA!=){550+nOPB9IA?{uG7`q`tr{XI8J4mq8u2MQ)6S;x5enFYm?}9OuK+>w`fii z1uE;={wv{oyM^(g2ph}#tqBeKZ(pspbxP=hv0UpKn6jW`fd#WsLuH0)Tin|nvdO)o zDX;w5pzO*!ENAwqV%Ae9pZclxA!{j2p&MH+B#b>2&-pzYF5{){qq*<6<>`h$vcRzV zDY-&rsyocC%AF$({R!hS!~1O;w#{ie@Xl`LkH$Z9J@Xo>ZNIn7x8}%=4vM!95|3a; zQ=-z1nK-VYvpBt4S8V#jXX^8CzR=`$f8>r~jpMmOsx}VNR{%_*ku0^@r(ii2E%R#X zipF>uRkz5${ZA8(X~;I!Y;s;vg{+_!4Qt{WKhJPRkQAz8!XoxQ3bY?4ROg2xj#r=i z`)%eyaj?fp4R<^S`38y$>~;1`19mWZdwjocriaJ^@>%Bm_Q0Jn)`x~7To^@F$Ons)B93@k4AR}?IU;+KNbI$oX;_RM z;nWZE#?i66CQP5HC$bTIbAMv7!J?7QVJ^+j`fwZQHhO+qP}nwr$^c?RmR@7BidKOj1errjt%5 zomBOy{?0@D&bNEsgziLFjjC+zpZRD@30T-zSaPIxU9CO?psLbeqAqX;3S;6SBU>}G z`I+npMr15NO7Z7(-gLGFyu9-I*)fw`r+W12-g1qegt2PtwCdvQ7Um$Z2czg9M*!+` zQ)#jz>qNT3#_1m}rV2FOeTEN?IZ7s9Y2ODqca1>|16TUciqPr2^QxSDkzC9!oFp7(I1aKoGLo@m9og|0iA5YISmJyTPw1n&O@?6mE+@NEDPp}=>d2E* z7;;ZV#F?XK5yj2$!A=~BCoZa|>zATRjAibG@KQqSs$EPxn3tg4*N<7yQq zCDP1YB3cIBAZMEiwK$A{K;{nNM=9a((=lS5=OTP+mJBm^TE*|`)R%6c$TJnbx6zra zZvLda{n^7j#T~m{fAN;f7)}_h`B4S3g3d8g5OQpjh4ZZI@R*&r*`Qeh0(9~@8|_g@ zJ)wgyy})Vjg64l5 zrJOsa-*NBMc@TOGZ=xTxtwvCbU<2~C%`Mzk5j=AHFtCp9DOuEP1^KRUo=q;U3 z)iv&l44BHi5&TIiv;n&G>1)KSaG8(<6?mGh@6*y4lbf8eLEE0#q8zvUGJB9}PoXmF zWf%QR!~P}IY>dn9tR!VEpCe3YD@I_id&gp5rDfZZM4-&(o9vvSM&yI>*&(r%h}TiNWr%QLkRynARsI zAUyJ=dR#7hhj?EjZq=nbfht(+rEY-6_Z;~}bq5;xC->Z>3vk7hri+;k!wX=G?v@+z zYhfLkDQ@A7A^$BrT6L4Uq+7cE$T952nzdyIPuZvL7ZYy&h( z2ZaJcQKze;P!WtSWiZK}XL8mk+WP@GtfQl-4~Iw<=yOa5{9yehh9iuH1sk|ESZX4K zo9;%=ZH6@UogE3NAH6pu-A#V+R{w{$nf}h_@31CQ3?+A6kK;5rRXCT!`EaT*y`h6f zgZz#@w8}4u-(7^-RP5$B2Yy5Xw>mh4MpwCmk96A0;i#u6gJ6o&@!tiV=l9KcfXy(4agrtg!yiH7(KfG3y#Agxd+mg7uNZ5pf=<^TVLE9QZgdO*nd{{<;b8H z-pG9wDJ(r6s&{jAY)*6u;iIRraB@7DB<}oqti?J+J&+)zTDNLy!U4)GBD0_lzUa;+_CN~* z|LG5$ItZFoutQCy5t2Q{m*Bq5K)lj%c8GoZ{;{wbh5p&X>oGss%@L^5p!eMvpT8ol=Qkvr03pG&cCtKvU{@~Vr1e1be2RIUG zluj$8?1d_|U2PdCgDdWeJuO$tgsEmI+Ac z);*BW{j9UDe(%^1*Eq(iuxgmcDUBxVJN}LEg6hAM2%6^@J=f#id*`JUT6?=kESF;G z^)7tG6lYsC32;@@Uc=X#i&FO-QRXWeXo_G6-=#>qb?t#pmQvk2EuN?vk)fTuRSq7@di$+S5 zX!Rl@>bd57=+Ir;6nIX*I~4Tu-k@xLR=bvfCTUDdh6wU8Qj_k|O&OY{)(mf6v7@O1 zs_`rl{njN&l!+F#_20^Y=CQ#E$>cNL0ZwM*>~PR1ErW*sI|>T2s)~+j)4w34pE{WY z)T#_p5Z<E;UAgm@E9 znVqG=#h%-1=>@q(k3w(3AJ}8CJ28iml~Zvqx`D|Za@4_RJ$$15xd_8qY|~eCNE_tV zGB#^oPplIeybT-W4uq%7Z%^;<`%lA_RHvV>z?kWBEu#w^vvM9C0wXsXx_5rKh}!08 zsU$IPtm?h{$*68!knT2rWGne2|3b%s=Y-W@AbWOoJ_0`J%x7pz>)vHFKy8o$pQr27 zNB}TS+X)x{KF5p@PPF*0YhkkMGv_c=P+6HFCuCSuTRff zC|DQ8n?sV2uJlnBa*8=ty?%nwHDAvDT>i6HsID(367~q)UzxW9tdoc| z6FLiaj~s>lhCj6E)O)a*Z_71wMTk%W9!aVOXTAIgM-s$gA?B!6VR=JOo5@!0UDb>> z0D&8eR7E>qUuO>baHqnzoTl&ux1U8|23sK)P9Fwk6o_tf?_AY|7@n|(t0VJB=wXQ? zqXQ8q3@>Dh^CA-_iA-WmCl{IZt%9XI<{>2br~FAnCNfw6r=oFOx37eHAl1hSM%-Dp zdCnJjZR@(ySJ{hQ;K!lw0ngzn@V}M+tQ9r9ZVR=EGv}B+;CZ8w_<}gkF`B}z#Foc` zSC}BR#Zq+7(AYK z7nEyFdVpO`@*@GpTPQJ<&eNh|w%vYxma;))|_nS7q?%(8?18rn+(i z_HK|V?<0m^f=(vzQs^j24o|g{VPq0%s1ehfWz=ZYGkUVh?&qt8N+MT1CRL1IDia(N zOKo0b`TdDSWK|=%rVlnE?Ye9=nuz2nX(q>ZA#qh_EK?ohmlSo7FwDeuFXjwTmm zR!VT>r)E=pQvvoFsVH6Lj-Qf=AcK2QMQi@@pDa2wCdzH|0%4vbExgU=O5AI1Y^*+z zt*$E*O+?TAJ3Fh4TcKIVy$^4oN0+Ouau5GHrrE!wfFkC0v}e$&v=yB>9H@>OZQ|T$ zC`OiVnc4U*2zBt+lDUW+I0^Vnp1846s^A@@Ml!@4+GN^bWmv=ePnv)Hah>oDoC3@i z5o6wGg2SuH)8+GPlC36H}7oMol7f5soD1w$G?2T;%W2h*?@rn}yDGksdhD#3|$Tt}e+X zQewrdM-R*V1|IliU?^PvL*=jX?q*Sf#Hh9j=Q0M!-3Sqk) zC>h68*{scEIP104L9!YJjdxKo64M)9{RpeBG)jza{DBSjfRoTa{SaE7uAygjdVqAU z+cFKQNS(H(tc$2hIgQm_TwXb2czgVFt^{k1?yo{4!@p;Xd78?v02p64SqrA+CCupcOoxB=EFhXf8tymTsWcq_&oC+Z>g+twR0mmb`q=4nIqi>Lb` zS3Ow}26~p!QFdnF7&=?(k|R?K0K@4`)T#9c*q47AvhzDEc>s1qDu9@YN8c*Ix5zX5 z3%J%h9$lpA`clp=`KHkdXlFq?&5x3uNC{OV{{5vv#{jMvW$a^+>NIl8DY0@3ate@4 zZr`b2#hE@LKjB^l6IlSzheQbydIt$I4De*F%ZUGHv@yHLPRq~1gGZj0y!CD}Lfd%f z!=cO18-6rZo>3X|r6uwftdp3B<-ksdD;`rXO~XZvheubHMOOmOF3;Xd%i6)q+Lfir zg^5p#7*HxD&6BT>#$1P? zIL0IqCPZvXLR4=QvoWDm3Wq#LkjFTpRn-oAaZFQNL7J5%oj#OlW~QZA=0v|&|A1YM zR8=#h7H)V-1CJfoL}?+DPeDo<7h@P0j=Y7N7Z;zt?6V1NdL#2FVslf`wH3+6G>9om zrsTlbx7GPTXQ;(qZ+6b`7`x6Ge6ZcGJKa)PC0KiCL!MgVfwK#v?na@NCr$-`0v8Xp z$6~oqNOHIf$eDcKe(*Hw9?aF?AkvCo*Hlb;y~L`*Ozp8&pa zTs%)YiiirCh(}G%;)YE5gZD}hFNAb-dk0%(AyuK!u`($9f?R#Qfw+fm>Y4BCZQ zJ#+tqogc{6ceeg)zMtr~{#w$>1BOC?kxPEmJHp52wgsR$)DE$siZ+VqI(onEFZQ{f zMpdL$ z)=&Bf{giA;bE#s_OYP9Wfam&|(=oHb0;y%YM&HMH|D=|xv81Cq1Nz^BC;M&}cPXXA zv)*A&_8A^e`{G_F6^rY8>M^!Gv<6BHYq{CppXJ7lJ&vC1qK*ogcSl;T2F?bx!ZKoq zv$A|-{DC@?RwnRrv;oZ4aHYJokda5GjY<%oHYiU=Zp1jH0qW&SRAXMGqi|0Q2zTxS2KyLogqqvFjnMd}xzZADjGkK8l>zLR5>j+Q^jv%tWo!-t z{pp{=eoDuJmGFSVhz;wlt0-zJmc!GE#Rvid>RG6dBR^tH1UX|3w0)$0H^4SICN)}l z&;%12LKX-zG_=#3N9yBF!u+ZF5K1be;PQG<^^R={{47jqGAh?p7iH=Lc_xR(-@I@| zWY~okFO*0{6Eg;k%xfW>DpR0}la>8W6(Q_M+PzW>j*&))J&TyMmdir>BHi$zS zoW=RCO5LW199gxG2#CTKS5g8BytAq>twIu_D3ZVHnHn66o1AD-(KlH1F&#p_ zyS9j^$ay>rJYKd^C9Tigy=qJ+o20Qx>Mh!G%d9tcFgRPQ=*}NwJ?e;$EiCZ;TdtOd z8}B(joiK!N?a22D+J%VPc%X$lCz|{L0x2j@<<7?gF%Ph>INmRd`?`D+h6PCJ9L!pp zO#yDgfp^$aLt}{huCz+Svu##Xp~Qa>e2xFho*L0V!_cE zG7@YUoKkop`f3u!*--!kLIyIVt0|(m^Jv&-80im_<%<*3T`hc(Svf$YqV-0VWNyEId3E6yYKiw;^OLouA(V)hJyQOXdv)^Anyss zbCjDl+LG(H@Q7R}#r20fcNb2EMpN2b;e%jf1Q9nce)P))Y|88Lok>L)y0)^&U~aQ} zaG1-&xVb&!c%cM}cR;stV1!WgF{Z3pA*&r%tgaewNjtV{3_J0J9AfvNxP9pIk+^eEqdFa6cz9qd%TAFQfAZs_JE`+*ae1bPo=s35?)y|Nx4buswqRZpNiRXxd&6i#`?G_0Z4g4h zN;);9G3T~@huT-1k5rk%&mA_gG>W{v17_(agMRE4a&$JF0X+b~h0^*1zS)2_r*NCB z45ppBQX5ALZ!V(TiyrmKW3T7;K1RMv@InLNkxE*hqT!12zp3BGN{2qV%fD0z1j3O%Y>(7y0Bdsmuo{#(n*nC=h+j` zhz9z@%qIrKaU{TsjUQT<S zUD(J~gMa!E>-O;&_3C&vN2^HPaELL&zX5SY5b+$FoTM;YT(~8Wqm0w-4}}Ebc%aa8 zIXTjzc&s}N(t#cg9YFt)#}`(yj?3}!0}|&2e3pC0S&r~Sa0Mipj)r{DK!?(R_voC# zNc6YU(hq_$k~_Futy+RKf)cR6Q(mAzqZZ8ug&X45tH&4K{GaUO-W1ytnsemMZXf|w ztSJoK9QKx$g>_F$!>{F3PoJp@PcIvpC>T3T^STeQX)9>BW|le1Pf z!re0q&I!i=Jk|Kf>swBp8?6nKAM3w0%}dXe>4`W*Y@Ky zhUpkM7xV8ASbahr-%wqqB01E|F46h5u-29Fk9Hb@={l_jLu#~>K(pIUDf}!=OU;wj z%ld9iKJa>J=AbB=Q3k0RJp@hL9m7d&$o3&{a-BODjgIy__Y08WKxGMShaZEqLV>KY zY|*zc^>(3&Y4K@28_}H)ZDv5H7@csmtIT5yZP!|j$m~5W)BMH^UDaVX&%Z|R!^S$a z({%J8LBVSxxlLZhe~&ARFNWyl;`;G%_QV@LONKG#iSGeENP5FE2paRb;IXlqdm9U| zzjyxNd4eVurbwTUYMPQKQVUPapkvcJuBViXG@7W{(p=(NkA&6QthSO1eBGNWj8-%M zQLdgY4n3@Jsd-WLjx$eO#Mb7Xj$JXN(0w({)M)#ofg}E6L*X$zZ>+N~vY}{2HVWo= z(!R9Bre#$-aphD5Y2N|bC$h%{P(A;d7#P1`Q$}4M-+N0v@1obKvc}KHT4Exx@7@F= z+CE8jvP>)WW`-DRE0v<68ZsbGmfL3UI30Ya=W9}Hu{u(!sPw9bO9CzlHE}W zk{FSlDjW@e`U-!rmiWi$Yy>Q}bn1{A>dXVNQJs#vUR~kU;-n^~>H}f?P(OI`aI%{w zHi*V_Os>XO7dfVkz6|Kc_&8JE?_;wn-kIa#GivAT^C;nbRscn_5G!!@BWf0>7xvBO z=J26IM>Box+!I>`x=Yf)?KR^(q_P8b3)xHrS2(DYeElEkowI z<6!=Dbh(0fj9lFLQ)|ybhr&eF7>Y&`ehzqU7yh2pqJOF+3RC9l(k<#qHD?--Q?{{} zvu^WG4Csh-=wKvGjP~?#zFKO>Ceb}lGDzpaaQ>QeVf*d?ksX{TJ{9Pq43{W3x`c+( zjp<=hssKHOUx7C}TjCKr;l9bkohQ~xyMH@7CE_`Ju@>QcNQd@FHWr>_d4%$`4Rpse zW5!V;CqPg4Mm6UymovpMwYYQqKLuNZYTu))hlN8Y<1=>4pxh!`jbTcCcrG|qjtvzi zGIHf@u*+cmD%W1b_$P_srO)_AV;+YOrt;facTR(GxOG z&r}?;_mwwaPdodC+gw|g1h#W`!5S-m1*;6}5McNDHOnPdRV15r>l16zGoy}$1RN^~ zxEl2?M}~z6G;3QKK_v1FjTKw8Qx=H)wu7Ffp=|%7EX(w<{2+CZWw+;Na(KI1E}Pp_ zY~lc!S5$APFt)4LhIuUo)I3sh$Q&0U5^cf2YiegX!DcP|R8TdRTUB>2s#C`iMORsu zF(X;Tygy~&Ta*f}C``V7rTg(C%3cgM*G`(8a)o_n)5pq{sv!;|mmiWow5l>%>H%W- z2kv+ePF5r3rw1Z!umoaH1;%G*=d|ZL(+msZ5n%hPY#!$tZVG$uth4TIFhadu4>Z$d zjlqPUonC~$Sk)o4tWmJ$0q8)4E4W7;@|-5MvZK}mCPQcukHtN_^z>!cuCXmI^le*B z0%!Rn@JjPtNkbQX4q(y@Qk6(|^~XHfVoh?&gP;ti+(6V>-?@SmSe0)z)j3VYK~8n8 z9PeuoaJmxUz#Kk3**9N6&Y5lt-_W8_OVFYgK)OOcvP!P=bF3;C(o(V}7@Y)CqNlpf zK*v*-6Qh4m38tTj$}_YVL7j6n@eYJhofLa-DP&Wc8?ZHJ8^^&PZ-?a_bIOruvEOo< zPHV!qndCw754X`$=udekD6{t;i$hb#M&qK39%U2IeUD=|t*V%^>WbQ>fn{yQ;uiPV z&U0hfnj1>e8DCESl@(^)rdspXP8{Dc>#-Bs_~Lj1vhbw>4fM2o$+jaJh&iuaL5Wl* zrde5QWhx5sC{kqGelkTZCfv6sHYl#eH+O*7qUkFivf??l{JJ1aUA>QLcJn&7AU80_ zTFX@;W9H(Z}i<{p?M=Csi6Z5)fxIZ>RWO#(qqxU4NXUg{`DxPE^HYyQ}jmI zlT=Oc;r39SJw6$oSu69DJJZ^frsm5t>JHyWwk*e4N`$G&ST8-*3qj z!sut3WQX6ddJOne)AN%rIxp;3nm`+q2n~aV=bHa+6VqZ{*#(Da*iO{BhyTtl^$vI! zi1f7%F4NARRA-;;bI#>KyCvf6;O$D~uG*fX6TmU;`x0zfczDh1uG&9HAnJdx(d$^a zD>i&rHtY?9-Hx@7x5LW*aG_HW%FILf#4ExmgAeE}U2xsNVC zkxspQdF`zWn;a~?RSUZsGb{h>pA36XBjAeouKH|^t$*kHZxb4Pf*Lk6y-m){ZER{i zZzwE=wk7iE0jDQAK18g>2@HHw`1N46J=P<^6gzhW2NsnFa&orgol0f4PfAqKtEmOE z{l{C=DD@V!E%b`@=U{`^io}+RrV3MLkS!cLe9Op<4n@SJ}aKP$b( z0rWp|f=t8Sfc2I&wQ@EbYifx{7nt+qo|&6CO9a-Q1+*QcG`rm$da7_r6HI5&Z6c?o zgvGj9F6y(@&D$T5MQWN4sYrF>)Y)Q#EeCKsmyN-c`ZeokZ#tja@%D{XA z8-$5=&(~^q@sxi@a2w_xX9)WbBBd@2`dH)S(Iz;L@+sa)MhGKRqqq(N3`m=t)r$)B zAOEtYXcQMup7XdOnx)I&ZxO2}q`*LE}iE>1wq2!_tiukc- zS%(OgY_ogDO?!lXahu}4%Mac~nVUK_BTPh-Ob2GpW`bN(1t&h(QyDj{G0BHNErD`l z4RClaMd2NSyQI+>&`_L3HESFCukOI_jB3qFyC-tb3sYP@s|YEmQCYaVk_CmAoiQkrEqsL4p`riyll^W*D67J9V5)DStDep)mm+1o9@p=KBs)5snb)lZT;Bj6h1f zA}fx7UdQpXwfXlH{UwFdAgW!ScRofVt#p0dWGB4x)xUx2%G2%vhrQx>LVbeZ_;Y%_ zdrep+ID0wR@cT|$6rw`-eUDi3gQXL_g+3j^05fH;$;3ledeRvCPqwHXaKgz*VerHD9JG?vQDaWqX3xh0W}SWmOPyw02W9zo zM4WB&-)tQcKHUg@Hg7mTsE?kz!aqm1CMD6m(UthO5ADP5uUQ4(30$0`WACKGoK&f( zPdzcxZiKG%m{{Xzby;aw9nSx{aeXt6w0Y~O)nN=;BSQpPl@-*lp~{VAaNZ~|U`V5P> z@3>vf-!sCEiTK(BI`j5v)oYf-Vx@tN40?=1Nx=hnl-Dt%*9Oo>OSJV_;BstJ;n*zp} zK;ImkmapddwSz2BWW&BeK@B*NkZ#^F<~|M?H?`;H_!I#8Gl zSu-F)kp;=CTW#PB_+uOB(OjlNsRs9u0&%U54BeLi-x^9L_}?a^txSX_ncUfH>@PlR zF55geIJYPZB}Q}jv6{KOihxD{$KER%P_nbn9zz-f%xE{N#$=+<>%1>s(1;qe->x0Q zJNyJYyVYP`Z6mEoSoT}nPZ4J2*-L@6i_`=MVN#!@0vx0UZy~;JN$N_;A2$n6lXhHF z$k&8W+!07!oixZ^WJc3lKTfg6zJ9C-rsi?@nJ!DZeoWY*Cl1~C0er|MO{xk)+NO0` z9_);c;KktRk)f+(&a^TM$=nHd$La4Jc?{KTXr{xaZhfEZ@09RjLaL6OCZ6)nP@ji% z1raijZK$Y@6ySK0k3CSqJMA8Cx+rO|ARtO-q=w1>W$eNg@k^)Hb7mZ{7jhMI;tReW zZlzP6YJR_t(q&qADJi9y&^ug=tP7EmSEG|Qqoay)u#F4N7`I9WinNphZTQaYNq;PI zRJnO{e9DmQEe2@!onA@J+cgoBc~#@hYg!mLieUTN>0#}WMWE?ENZ?FWWiByuAFqn4 z9`^(Rqeh`6lQ5Tg9$=SQ!ol`>gq`*2yg8{c#b;r@cw!AfN;s2!ZJZ48x;e2EGSe)X zmfmA^$2c%SngTbRbW+QId@Z`tb{rGm)8TSKLsO~%J7$ca)161U_T*?abnWcQ*lH!b zMru1>j}H$oJUkR3Ba4mB11cO!3S~4X8?szsK1LW5oyGIyjJF!fTVXvh1lyR?CQqMP z$b5Jmj=!-l3;py$g$S-^U`d&gF*hQC>>f6pyTG0?!RFCO>F(T?d1YC{mGyvM@Vsz8 zszt*tUSu-of^_wT^UmtixZ4%KUvT33k`|}UyA@RL^T@2FJI4Qj<{R-P8CJp+1(;i5 z+s}s|BX?!`j84o3(HdP3aV%YIfxx%cSl;1W(r0+kt1fZKKZRBKeamVsz;pI~lgYo< ztcqE4M6}rVCSdc=y|(k$as{q63p~CS^>#qh(Vu@soOB8N#>oV1JGMVFD)J0sO!*ZV zbtILlabaKddS+6BPl&%TM?Yi%<)RbLs1q`tS4vFcAQrhn~}V`^SzW)b!ai+J}z5m`&x zBhmEMGQUwTVCUARi6&IW!3=oCnAa+KR7wTC3EHNWJh#6)mD3^9jcv+3x@+w3_bA^_2g@c`2pZbjZ9SLy5;-|nT!=vecy1*P+ah% za~p);bhKqfhIydgVc4cN$rx>{Wb?^>xa;>W$Cs+k$gFez8Spcm%P%eQ*tB-uv`-a}Z4npJQbtuMP%c?-fSLiS@ z3)Ps)&Kdp+`xEekBvm#_8U04r!W`it_J=f;V?YZ|#}@jiC+%~7jx$-@(cPn)rLw(L z2@RG;eFc{6+2>flix_nxS?3N^>ty;Z5|aV#?B|54c z!`%ZqA(rOuad{1`hLP0v9)IKP9kc%--B&gOZxh*XWN@&Kcd!{GJ!<&+s}c0?7#lc3 zlzSt*Uxx{5l)62B=NBGgKjWfqMjX5*EnMBw0UA4EGNE5R4!<9P`1q^^-kwrg=)xEg z9<$%O4+%j2AHSJQ%VE>l4IAAw6_+S9t-VphkiXG&PJqo*d^rv&hEiiJX*{wrReO`L$ApuRyzKmUdV!#6BJ3b*M;B zpVTzGa}wI@G`HyLcvimi`wrzuP-jCpQ6PNdd}yafeZ}}bPevRlbm#azA7f-yjvBmw zII-neiM`D|CUqPv4C+X-sq4XtANRcMqB&Sw~hpGLP2Ln6orqs9b z6P7%ZETJ}Zd{q>RdQU?QbG{}yt$=|*nBKEUTiglH#|@P%NRN@&Yvv{-(*GE&;y++; z2hI5ZA|IQYCh`9z#USSIJ8whLjYMi(&eUzET$v}ukPkm&0(B*d70il)r;GB!lGR#= zrJ*HwW@0cI_=rgLIjD}}o6LF%0Py!7NIMoHzqDd?8E7%$tf{DspguhMuFyNWR~Rg4`=X{wc)& zXSWTm4+JSDjKRo1dQ(C?t2jtHh7GZUWsHrljs`E6idLTDKe=@2gkWg0@I_CiI#g~L zZ)APbh=kcd)ec*z1o}*rNz5Umf7GWH;P~-d zrRY7kJy|z{(kE`EdF;(6B9?(6sc5xdHO)5uVGZtlI?Ka85PgWAf%Yk8Oxyej>7JiE z>+|N8LExEbtYyG+blIT z8z92`>hUCU`mc{yI?RK5Y0kUIiRTd*f^Xg2i@W%DCoFadL&}YN zhtXwh1sB^ReX9Mo-J%OUre_O(D5tmloEC(2`WFcNXy%9Y>T2*A>IT#g`v#%=OYCai z;^w66S8fEjVCpw$oAm7tf?I8fxg#0ftM<(E|090z9r3TcyTF5UKY!<3ZZ8J%|FaKY zY&f5siUhXaw26K2iC;bli#xNz_1WNzIR;l}VrG9GX?*V2A!f)qQFqHxFAi>EQTJ4j zNX-0`zM)|I&yDuy|Xg+(1}AfCe$zVd%OU#fU`P+A55~S(1QvWyy3dQ zW|kzAIR-4>Sc%0(tYRPFT`s~o`2C(V#)C0TeBRx6P_ODopx(MiZe6%%y*c4|+G&Ol z#CN{+eEc{Di6@w$!Zs$0CvI-PX=C|>hr&5VyeDQ1t=C_B!jM73t4kS5CtFULst; zYQ03T`=6MLzvR-k5?>yF{o7hZuc=6NrM}Ug&izprO%su{*WAn zkw+ad(1%B-!TNu}GwxEyzH*TDdmpS_$MJHazfm+!eqVnAxN5MexP? zP2d^+redGr9p|2yy@$QsK}j579aP`v-xD5KG|=qQ@e=XU`Km!lf)|Swn;qA0C)y?P zk@zY3iZW7~n8Z2aztL03QOQyBf&CUvRq1Usk@bbtzfG>TjpB%Ty86e zuZpY0SLEv$_LKMqzu!~ntK+TeHAgD9!~Dsm2X~ z7v5@U^RtJ%NAKRlJMY2l`xlKJ)1BoU77vyedlTbBo*mQIsTkwk(OK+i;hax6FNPO; z3)73{#qf*&D+p5U@W7Z;LoSxAFWIrUH)A)+*J(77BkNtZHKT{|)7h5gwe3CWy$pJU z^yfR|75(UU$>*JjkNwW9_I%I!E$kQnK2Gs>L2t|N^cU(E9-cDw!4Z`7rV~Kr=m{p*Xm;nbC|&wlM92~jaZ4GL4;2B2=NIj z)C7TC=nc_PB{CH8Uxfv4G&9&9oi zrHX9;sx{9`T+O8MQjEyTDDxsfY%S{WG9|h`*xZhfZ9x8r$y*a<0O0WhE{efOJ75yb z*d(NG5v*aV>7Isontl~*>zi8OucIuEMl7XhKa-~kRq)(iDfW+T(TmH!CbVc zK|IaGycibEFlL?XYZ2^GO5yehEv?II_HRMU7o2G%$L#iawwWwbSVqt^;VBEU$tA!J z7B?wYWl$WG+Cba)eXhQ(e>RC*vIhL!(e!hCZ(3@W{%rpzLUE3@oY$wZWwPCHu0ffh)5Z;WvOc2fWAYQnD>I$9UWPspy+0f+T(j4tYVG$+=#N z1%pt$*`KDsjDiB&+eMLg^jDvYv?@Z;4{r=lXP92PW$%*BCtc+A^KV^HVq&9>x$B^1 zjq)p$WmjK`t}set*P*7gRj0_-&a_lw1a8Oz9u`tg_&DJB)-=IihMOHt&0C0Ov=Ful zmtvwxJHLF#>( z$(y2QBu$Q1V-|A4Z<^sbEMg8>LZ{9AOrCo;wh}m?24OKzDlSxMZWd(1c2+*ZLKSu6}r1Nn1bs3Th$rTY_xk}aZ}cZD}s96_=DD~D6E zOf$BbKL3^-Da*wv-28b$`7X#0!Fw0;1$X#)hwR+2c}B?vW8ssu`{9x0y_2Z4EIY#zL1a6c5515jOZ!p*k;th~=J=i;!<{2X?OWmGg zFrYN42Zfl$Il;Nq)-HY_GfLA~#gDa%cQPT(a}-u!j1B&wGC-n*wEna9g(14@v{t3k zZijm|YSJgjs}M*7Vr10GK}`eAbqZ-HtC)3~VX8r_a2Ww>%wrn<$>w@IMcMu?O6&X! z><};+DS=q38fxeZ7k99OiKXNe1S)}9U-vo$TNX?61*}MU+Y$zX>LSuL=qW;4-~-H$ zm}UqELeWnVPeuR>n@rUp*D3!oBLJhoyd|*SG)e57Ok4kCi^wEU?&}g9*HptZhLgFS zWKmTGSwi<6@Pd})IA=OO*((m4W$#qSRo}_yFxc_jV!b%*FHw>ujZM`wrA{Pcj_y~$ zk_0RWySvin`nXBjoVnOQK3NNqG|jFG=e5U+zxL3tYA~P z*=Q1D!Od%QHoTK1tLTbfF!nl+2z<7!>@CuYM$uPNN*6!4X+5$hbJAYQ#Xp_5_m_+w z9eahXcnpu#Wl!YPcK7u64@htuW@XqEc{i<|4BiVZS4T!IA{Trf8TN#( zhO>SeR3G;to><60TfiJNDA}4`pPbo@d1TSfZo%n}<`5mZ3EX3#dFHz=yB==*o z5y?Hw0-zlcauGgamWjAAi%w~db5TtRmRTlepdb^m1%3L-sS8eU?016a3zPXEZ(OYA zkS_D=DgYle-fGu0nR`itH8jn@a><_THqDjp9$9ER6xCVvq;g-{Y@(g}#qVCk=a_*z zQjyK4*UbCFR@wQ*#4I%{mVhq+lYA|%6v&sC{TphcIb(Xe;U#7H;WZy=b*R`3 z3JUmdP(~m@SmhU2M|MSUAMdR*NUC9ySGdxoRuOWsZa#1BgR8M=*xdBVc;rlb_uZ2M z2x7kR)*Bz}x$E_s>pA=7JM+u+uWu#+0Sd?|OG_h?d?;L6%xOe$5%ynP??~~={6w}2 zVi&fL_D_;M%5B&`)k0f`xaY)%4vINh*R_6=d6)w_$b%4!|1RXp$>zeEdf&-^EJQf-z30xRhj2Ej&FILe;lzRu8!dn-f2sU{Ph&Z4q zQok(LDpwhsLTOY&C>g@Z`2s3d5y#D+GVqnYZi09eWSE9|r*+x7 zvt?FM_DNm4+og@G0!d|2FGvZSSOFwRY>4~&ZBD+m3uR)=4>Hha{-b`13>`i)j5L^_ zF4`?lL#|7-iZDCOX$ahq;GSVm$cmU1K^x3>ykSdI$W|lBjO+6iS*P{S`+bG0$Uj%kthF zg=R$~t2Nso-TbAAA@Y%AQ;04sQ#hr%s_Iy^q-wMTUhPw3H*25skTs*5C7A`ztYfCz z*iye^h;8j}@JMx2{oNZWvfBF_x7ST39rltDZlY-fc}r%f-bbg0wNa zT7*9ls@ht`l?!X2>5DdK*?6L1AkK}AxG~Afz?b-ZV~rlf*3Zl6O7IKC7Sg)miO;jW zx~0d!-xwgdf7v;rBdLlUudAINK_KYt^;+gWP;jOT z5&C69K+{^2-ji`iOeEIz^C>4+FopEJ%b&URz!72P_bX#-Jk80I z!u%bfsG0iyo{T?bvw8Fc0~*lo@zeq)&GOHwmP8M8L44N! zGa7h2luuTp*+nG8q;U=@_Uf`;yjIYw3jdSTW@q zW?was^k&waJ zM)$Sg^p^xqask$k2M+a3#8MfJNwlGddWUQ!X#MlDtd%IFJX@|&+`#xl@f{epFp}6g z%7S?qtBW5XycacoOpk=kTKWCNboz6qDMTT(lHK!bA&9G1tyMzy)z3z~3$E0Fi0{z2 zJ#@$Uh6@f!;{hhgh}^5nJtDkU_=IK$4Y}GzZIq(%-NM?uh&%-SdmeVtD)3t(S5Gu| z>bA>;uTGmw#0I*3tQGU__AGNXZ%qV>qeQo`Bx`?LbJfPzNe=up)*+~Q8r+doW`j(x zvK9!m8I5OHH2L{E?l@7qr)ob* z>VX|=ceOwl)dKrF6D=tMxnA-w#hWuPyU9J*%7^K9K#O9Vp(K;37Wk|Gl zBk;5mJIVKELZS7bgim7>K*z0U{J<;AQ~F%}V(TjDhbpFB@3Ym+yE`v8tc=#6Vw&EA zEa}@b2{xkLS1%2@&fLUm&EtkjCJ5H0q*RKb}W@Ak!Vn#BOjb=M0 zKP6g8{Qy2~I{L)UCYf#Z%&j<`9JlUsuK7ndXCYCy97RqH%>E66NlNrDq@~C}BX3#; z_8PIhoZ^j{?@gt{OWQOPnCZG11Y-2}z{})SSVFZB{YSPAx{H{~YB+XMQqYgJ$b}nx z?k?twNt!Wp+7K}U)Q~R*lWC@vM#CE(0#BlU5F?<*M zm~NV#x@+t3ZMk?-?%h%%#VG6e3epx{|_v${FWUUz|DlZ+3J`LNJ;|` z1=ZyRDH<;MfPec@34{%W1U?n*$I{*Jb{LTsObib9Ch>A?>Joh~{B7({6330Oz#oU5 zX^toBWEcSV=ylxnNteq#XKgJbneN2euq;U`QUwqG^J_o>zLfRe3L8u3Lq;U_$xFXV zO$sdD#joEQ3|(6M&9V-Fx{CvtI_#2Wc_meWadE=WNzTaoKALZZGHaAvMq-YV@mwq} zMVS^N0HjB+b1RyVDgsoaU?&|#uu44iXJrkF{Rg`4idsA3w&4gEklCqkonam@P=+HW zX6|n+$*^uOhtGx-ucSB&kAM{&D(VZl2bi7k1H%>udqKOU7C*gyGzDOb2~aVmMu^o`}tH^Y!5nji{}k{bKh38MpPRAq}rT?VayInEOG`Bm~xy z9-En#7HCp>UdXcciDk2IodYl!oG}Lrh`*aK|23;<61^v9I_QpKoF;2Mx!};sh`3lO zyw(Y-M8&K<3mqmFB9ZivBl_5V&TtHN9%XD`*`n&dP4spiv?0o#O7zq*{YAvOl_}y6 ze<@~9jjT80zCTO7^$jD=4ZVUsq@F)BG2Ob5g=55{p%)2wnm_eE5mvuRQ__>t6YXyY z_6@xmyh9}_9V|9gd$3f0Q@OESaEq|22`4FinsvMVDg`Sk{@^+QZ6LWAT3uWG@qN++ z8R<77BP_jWvkZ@_bC=r7@kRY|XD^2jRN2ON;7Wgk3tDtR!lh(`m)%}^n8p@gT)hhm z1xkU*0m3@!5!xPapJ5ndPN=?xWTocEnI!czxO6ev`#UZf8M67K8=9dp5QJSb&3Atp z3=Lg|rexjK@7oG_ymV7ORl>77a@ZBz|6s6B=cq@{HlS|iYL__#+RL|h zE9k>5ju~aoy#znrv!{Ap+7EQ)i&hn&x%z}pXgBnvSb zkwRHPk8&GBDw4;wtWBf`f8nXVuQcOn?MwPnn*&!(RMoYRyFH$6lfU&}t4UU<6z+oF z%d|c{Bc7e);>MX=5L4^9>~ zE;wJ+e4R*>rpPP5#E0R#O&t2)r`H4ztyK3yglScRznBK|r_05Z{#4?#Q~v3O8!4J< zRGX|uP59x(D`Y^+XekRl^^iyPE~b|QdMPAiy^n>l;wE$Zg(vg1D-AkTrRlqPiD8 z#!*qhTI-r-33-BbWKBxR!~2?7ehMvXLM8IQZw@tDYNIE|DdFgO_(&f+%^7= zNC?4H`#^mn8>rZO9rPNTrR0QHyePQB46*g<_i?s3Lo!4Ozp5J@ot(}mRQxF@$Czd- zY!kcQJyWCKIOLvbZ3hXoYRw@BF$7F=H|p7Tx(D@43&ecZ^ooAQ2MSyZ8j zhvdygE?;f9_O!Dx-nBf-sM^K5nNuLKH1t`ts%5oVABDN8Zt5ja#cPae>if<{ok-21 z{K}A|705uL>*V6cQ@ao0cdf6}LPO@?wpq5lfU9tYkp5XRJQ&p`^}Kd?z(&W3#=ZfP8``1SjXu=wjF+4+Nmy7ZvS3sEBt@${j0I_pXt@7n02k8uVj z)^w|S*C$B^3%IKS4kXDl6DUdTZw@aH5RXF!nJ|+at{JlX8=p2C`iou)h6&&@9&8%& zWCe3mq|!%v+=p%+TlOA%#rk78mXaYir7BN@3Fr+8M!R2kySWA1wfa*q>LSrEXK8I} z4%ME#0@5&48q}(lu7OH|2omKI0oCPF$MVL% z!oG&PEfrU$4hWAv{2AnjredJ}^uHCjfd3G<{%0vmKW9HW9_9Hz!W|#0hy3|E|}sy@-Diz^%a} zMw6UN^&pi^EEbIlb&PKm+UWg)a)9O*)I(Jqpbq7I!nG^|QSb|3^fK#H`HPwFWDdEt zDue|bR5n}!kJ$o#D;5}`4dku}5S|j$5q}sEB5!C6_6BduDevLL*vpFHJd#((asO<} zn)EH{H!%4NBZiYl*;gvHBFWdwYN}|Ep!%aV7>*;74u_i5^V9z0o}%ZR;OUFq`QS?0 zne`gI6BT>=M@HmZ9;x_F#x`Jm#y>iTk0pssIM6miDEW0sNq*(ClEkPbvR;K&mADY# z{~8}s8RR40FI8PxF!?I`cp+47nJXB8UNS)CtE}=+9XJqAgVPQ0vT~?1n#9LEOER^E zc4{bnvbPe({rateD#)*eo>fMLcYV}S$J#PseWYQi7n5R2-=SP@i>)Z4*Rdvv_!Un^ zhBrn(cL%lF0(J)>PA>U(zY((?9%f~r#bAFyvQ!pkb;Y#aZxPE&;S}V&FF=|P1BwputAJj`a0nS2hwA%`1R^=XqgE(ygPws@ zGlR;Mxhu;Ay_1lja z8o7yFo|W3}9d*h?5={mUhLo9ZWa0{xaC|R}O?z#L`&UPOT*OMZR%;sA>l9w}x%)?b zndQ(wK=r6))uZ<$e3N{XGs`hkt53%z@?S$~^dg~+R!v|oLBnfZ411Z{G3OwyC!geE z{|&@YU`_l_y|G&V0mL{!?Gv6+k#vaZ3q z__I{if+lADe+_uao(1m`%+gegn%MO(#op#F(j^}}oLlI2jf2h1Uwg3_5PYoE!qCsdhS3cD7iJ0pAB`b@$7`%^?VIjy?R`!48#aMN8;jgUrAaX8g{dZgemIrZuA)f( zOiRxOiwJL(M;Jls-`ecdn?g#H@K^uWph=DtAt)Y%F;Z(99E|z@nA#o7kvEEDPMwP_ zA^0cosF_Z0U5X84Ob5quV5a{61Fhah(w)zrB)O)vtj>)0T&qSd`K0~O?)K;cWVC~> zyW<6X=QKRi{eFlno%_PhTeHc%xIessbndMl$o~0R_f7qbF;R1iY!9$g%!)t{`=t?? zgYS|{NjY1MD)&A1P8lvzOZIaXU~=@{g%LT%;BnqHlo~aEf@ZbQEVar`It7R;glGAS zO{RiG## zUVa@cO!9jAOtp83tjY$(fZ=)Effl`7RAAvy@{5pgMQN;XReAsDXs2Tv zTGpJ^mb23$X-*xInO~Kdif?8C13F00=W783)Xv11!y3XQ=p&10|)F`Z)@{mD!P zp|y!)Dfo0S%2zN8R)<4b>c@>aB;wbq#UCK>Np^qkcRMP{&47O_11J@5}cL zdN!m)c;U_(Ih!P3DhTobzx-9nVWdB<*w4ZBRP5UkF)td>lcBjv(HMPhE-Kblf60}x zVcvGuRc^rY{EQJ-LZnT?J^8@PUgCS?#M`7Om6qF=F%31)`jw8>#c>VFDTmq`dJY-T zPDAgsAiMygEovu<#B}y$-E{0$$pW9#9Y}kf+@=>*v`OFc84Sl{^Hi83WzD*;z{2hF zE?R!GG!Y9YHQEf*=_}ortBa0hvAml*!zg6_#O(2&y^u#$8bPU8{rCyh57^}flDM#~ zt&LjxE%7WEA$ct~?r^MhtEjPE-lvur9RkfCMXtKz^dXco93r69`_v)KQUxI3l4usl>0xz~#hk_nUyEphnG%1GdeX>`jWI zh@sM43${^cVe(8DBoKvm&y1>Lo0+BUVxH^Xvx68e5|Ep1~{8g$>Db+UrMkHE|uw<{Ii+@2-K;ukDnkuAWE9lb6}=W#TW zgWubopy(I=urt~+NU^+KDdi9&NG$a3>Bt&-Mi|lBuce#&yV2R9Y_;~gmCKWLu;LyY z=AGZ4Mx~Z3?nku_1?9B^SkJtZ8O4(6Ua51jzalvxegm_<46xrnLI2WQm4G`taba}B zCvj{x(|KNvl)k58{0=go5JA2$8>D!;mW302UVQYlxzX{h$?kN_JsN&hOw)hE9z^)W z{)s*4y#Hd#tN2D&l3##dSVTnh3m9l@WNc(4ASfgR6cpv>7ZC&UnVN`!rT_PL=<~j} zvvbDfe|W`vUPW6|yXOLb>wd8C{PJ8tgrARBTbKX2;Bx`}e?d=#h57#zJrSOFQ`b7k z>^r(%z{Cy(E0l%m6QdDVafbHur8W1vFgeM&yFtV=RLoU)uD!N1bY6yPkzF9lsMaW?8Qq@Q zL3dG`+#kDkZqm!7keS#y($Esy9jkUSlsZ(%A$g+BBx->G;-&O@Sm)?!(s$AF>xS zUB%T4E43GfcGjhQ+u@^`Mq)06rrQhJc9u61IN3|=^F{mJ8p^ovWM9#rsxExx&xlMqR_TbfUBmUx2!IiV4*NMKu)qY~a!#BHT3QYY0zY5LMDMtTKB?svUBO zEDL%^^B%Iab;)~2*&TAXb)R2!0)6`{v(K5cwJWZ1WRMirT@}7QcWs-h$}1J#&XNpt zqY8Z|V@Ln5T`{I892qNw4TUt)*qF(8aiNtt&}L~eB^6@57{yNj`yN%V=oW7V$8-a`z+}?D}M1C@BbWm+Hg5UsbBAqrI z)0F|+h8Yp8Gk|Yzu4e!lkss_|s0xmdZ@YTGKuXYTHtUL{s*+e_h#~54@Z+Jdrt1S6 z0m%1s2YSW&0j_v@*ry~j$Sgnu?i6|A$eBLMav&@9Z*vdkQJP8D9(v>xbz&5#@(l7v zbOffC&c#UeHZz*4kt}(|5o!Id1}R7-GXwN{Zv-I+@WU=6Wadp+2Gmhnjnvc2pOH7G zHWC66aYyhSzImYExebHv==dAtjZu<{NUS+x<{z^+a_H2CVP*tj$vYR&)Hu<2L!)Et z$}jJwO}}A`whxnPoNi=lI~{m^XG!Zq{0u3L4Bxly+co?31oe=Kq7j_GH!jPi!Vg`$ zuN^QV*$YrOWT)>&>U=G5f2_93flS-2+YuY~d|xtj80j#4X`P()W!o7!2(*Pb0R*G0 z9`aQVDw=-C7KLs^Df-vs+4%EoZB48rD_ye1|B2D=gc8PfQaJK%DKit z@ZLBlm%g=LB0~I^7RerDInI%S0(_h$h2`x zH;Hn%-D6K*U>wMU_Wp#O67}tldvOhmK>aSwA>#3;uu}x1NRwLiK;vDC4Fn4?r?hj# zDBaa}@gy6JF5SI(@z`LM)4FH+0u!++fppcHpY|Eu*--cEh=I|4wo3K|Z@VJ*-A7on z6&<4_P`Ze_*VPft1C3baRhQbw-bmE~q*&kOs6-axUd3r|)D1%EoQJmv%Y0_t=SBI+ zd_jrRW|f6QV86^@7T|9pM4k8>a6$ z&T0hcE7qktzhtmpO1o)vFwixE*vFH?eC)DS=3+DQY$Nt6rCd9rXKA%l;R%-#1AnhiS95#hFR2F(G1Ml(v0>)MX2Q7TS=C{So0P4HDdU) zSQc%hlWqczO#JL14uDe_gC<4Dw?cN5Wo2@8k zL^(wk-Nc+}IiLB-KNt}5v9e$mO2l>TwR~F+C@8`Kr_dOar}s-Et)K%7wBs-9pj6xY zeEq`8BT*j3r57^WNH4l9zYvt}5OE|qYdKw$c-oRX(rMF(-hfp7C7h)#d{*IHc=s|h z#zV*dXVj)s9$iyNTz2s}nDLnr|GunC3cCAKq7@@au%ut6)wD-~i-<<49c>?pWI#dj zh&{>ZvISRnjXU9xhQbj>ODMVffV=OV@ii(@PofywHKY?Iu3E7w+!8HXiD{P?4ZM## zR%3Lvanq@3cIIA^qvJTQB4o(9Z@k!RP`!(7ccB?Qu$@~YR(y174Cg;4qfx&;ae~ud zlNjWlL8ptQ*0>-1f3eRpGfMX^(m)*%cQ3hqJUSoccGWK2F6w9VJB;T~4oxeie*lao z!S?<|s2bUu#V+^mQfqo;dT@(=Ta6;Nq7q77lPS8(Qf!+rNmiB7Uj2A zK58#xgWbT}$cB54>$~fdyHi4}<(ITU{6NYOLoV2gdSsu`U!R^9!bhdB{Fe5cvAs}q z?-7uYZTXFIry`K5Xq7A@xCBUNwyd1-t;T_8q|*aN!(iFa?Oh+(mMNs?kLN(l17k_~ zo6|F5<>@1DB+*{6)C;uY$D1}1f%XwJ5{s^wE_~H>pxIbjMfE~wY)L4`LYSn5iLNmPyaqUOCV>B8#V zu?|+H%DS&F9{tZA!pl2^;gH$4YxDvm{Wk(<(P7wUw4$Bi8Jm!w_`^5&`kzsJ>+Mmc4DjrIyZd#qiqo~5eugx^l0x3t zZa2`Uis7s;0Qd-N#W1pyk99j zLdWw-Oq`YO9wSF51mIONx-8c667<#whu4_ggLp@c%_HKIUqow{Bs(ub?+D7IYo+-DlES{{wut#S@EZ@ zJ*hkEh-wVG0k{b7Gm6RShxRsR-w0VAOcnv(y_ff)RZ>R`eL_vRlQYC+=lgyoxX5Us z9fh=X$;act=j>!wDUKs{EePYS;HYMDI65EZq!_Oeiz3qxHBcdaAgTJb8F^jw*Bv+t zeG*QiuCPFO%;`>k>U&%n`^E|ws!)}1gIU*xG3nNCReWG1CC%C%*6^145M#gwrF}t- zh)3k!bzIpwlwrh9zi;SBDt6k^Z&4V>bXh9PkM7_pK0*4RvdZp7T(~aLQBP>dq;eM|P9vJzyzs%g!|WoXK!Pu34dc{yAwq7Aw`3B{ z`J<;?=1A%2tIU!*vo=<${*+UIU9k+3yuM{=PZ#CVh|>_)p1%}^(HNsgr?`0hV(Gbt zLGw2^b;L9q>RKm8tzV{QWT<8IWGxM{g>A|7>6JSuC6AV$?O^@@xU7#={~Fg=q)oT20u~1+ArAuCVUaAXZFjvCA^^@oj>$IwZidX zWp?&b9-0GsN&kxzWVU9Vp+^6@{N$8G?;U+Ow_*|!H=YkQS)AIT;%JlY4R5j*^{_&< z7CZfxcC?8S0f@WNGFmA4L<%Dc+mxVA3UtyPeQSFq*{gzZw`nwqyb%EukYm*`q+N#@pTA`gaLC6driz-_Uvu`XO>S4|2V%NYOi5h@pm z4;jE(eGb3i2WA0+Jvn%~m5&+WoDKv~wwQt`d_IbkfeSh3hG@nyNO zH<#-3>9?8fkNG1diBDS_I?n)#@HyS)YPW57+E)Tt6w6GCkpwlZr4kDcSe5+AQ{e4jZ-e1 z`lWD^>UhjiEEc%IO`%v=B|=wjcZBZo;?(SBkZrO}Jag_F%4?3zEC>3EKAtUZt65&x zj#d?rts+HLWb~q`jiPl>c|lg1Vl!^HuN!bu5|eLwS2W;Kt{H50BzgJx?3YJMFy27H zSy1nqBhCN`Dv&aydtjnOArFOrjE`C`CTvgA^U+n9z?6KG7Z)gOJg`%_mWpFDC zrELFn&HCaD)@hTF0$rp7Fw&dZwrhAz{IdeYT(xwklMD_j2krF=1LliQQJ+U$k7*ZF z^L9F00TRVT%fwuaqXp6d+=n7f8**+(Xwpp6yRU0@iY_wVY(_uqk+bU;uJMe?-9-mE z4nGoh!hUrsPKTF96`b#>&*;Jy*<-sV2N(C-_RbYF<#&-}U14|3JU>UG9aj~%eZQ5# zD9VYRm4%Ccc9H%p=bPe5XWPTQmL^BbGM3m@KhKYPyb$uK(P_GGv_C| zbMU%+NlVp-EGB=cNjz~x8Z}PNHF?d!Jhq5FoWTobX&O-&NO_$nRzKq3d~Cy1(Pde` zhc>1D#_=1!xUPjv4AXStF<73kQ~uZrp5}-0R5=kEjNUq>0gx=u_+h+7;tF z$GMB`_MW-Ov^?Zb7bkI97f#me)8u}bg;PJZ)Y_CAlg=j?hLL2$ztM4u`FGuddI&9!0^Q&oN!>R0RF>o6I+mc~kTS%$jcR z7KDeF6wQf!C6 zZ}r4HVff`62A~q`03Bv_(Kn?1n(Rt88&d;5()D}T**avz0SSV1or>WGB{2w$s zgjxI3K0TOlePR8u9Z<%8dux~IOlZXs`j48{?sID+{U*QHE`ZZf)|)}f+q^-_gL8s< z!q*hdV}T(2j+fSf+d}O*{%KEM;%4p)5XY)p0yZ&@lq^QgL5z4TuFR!%Wyx4zA z0|JT-u(l}BuE_nfZl)*hJbxId9q(-WNL9%^BDMdI5|qL!pK{MiN)R(2Ro@CbZIrP+ zSK;bENl*_p;{&d4;am?a#-3-S`!XdO&z_N|tGDrqHu&FJ3kJ0N@0|Wu7k5h3jsv=F zk4htz+sem(2nUA!z6VyqdB{iq%BAwXWN=^A6SWl_ z$*?c()T4%CS-nnwmz-cqI$>9tn&hCB`z8&^%R=K#j;Uprvfgxe8ir;4vTin=n3zL! z=|1fX%+rNx@eVWi2}~7vJ5jMK2=n|r^KGvZ1Jz_8)mggfH4ny=H-6&U!&7W# zKlt$HNm*9bq@CFxP8zA99|m<>93O9SO_CIp{NDY30JNC_Ul!zsku@&PI;T?v7tfafKiDl!yx9varah$>aVn?jgoX literal 0 HcmV?d00001 diff --git a/5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.cdx.json b/5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.cdx.json new file mode 100644 index 0000000000..28a73f2d42 --- /dev/null +++ b/5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.cdx.json @@ -0,0 +1,3057 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.6", + "serialNumber": "urn:uuid:a1999c5c-912c-472a-adcc-971dbfeff5f0", + "version": 1, + "metadata": { + "timestamp": "2026-07-19T05:46:20+00:00", + "licenses": [ + { + "license": { + "id": "CC-BY-SA-4.0", + "url": "https://creativecommons.org/licenses/by-sa/4.0/legalcode.txt" + } + } + ], + "supplier": { + "name": "OWASP Foundation", + "url": [ + "https://owasp.org" + ] + } + }, + "declarations": { + "standards": [ + { + "bom-ref": "ASVS-5.0.0", + "name": "Application Security Verification Standard (ASVS)", + "version": "5.0.0", + "description": "The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.", + "owner": "Application Security Verification Standard Project", + "requirements": [ + { + "bom-ref": "V1", + "identifier": "V1", + "title": "Encoding and Sanitization" + }, + { + "bom-ref": "V1.1", + "identifier": "V1.1", + "title": "ساختار Encoding and Sanitization", + "parent": "V1" + }, + { + "bom-ref": "V1.1.1", + "identifier": "V1.1.1", + "text": "ورودی فقط یک‌بار به فرم استاندارد decoded یا unescaped شود، و این تنها زمانی انجام شود که انتظار می‌رود داده واقعاً در آن قالب رمزگذاری‌شده دریافت شده باشد. این فرآیند باید قبل از هرگونه پردازش بعدی روی ورودی انجام شود، و به‌هیچ‌وجه نباید پس از اعتبارسنجی یا پاک‌سازی انجام گیرد.", + "parent": "V1.1" + }, + { + "bom-ref": "V1.1.2", + "identifier": "V1.1.2", + "text": "برنامه فرآیند encode و escape خروجی را به‌عنوان آخرین مرحله انجام می‌دهد؛ به‌گونه‌ای که این عملیات یا دقیقاً پیش از استفاده داده در مفسر مربوطه انجام شود، یا اینکه خود مفسر به‌طور داخلی این کار را انجام دهد.", + "parent": "V1.1" + }, + { + "bom-ref": "V1.2", + "identifier": "V1.2", + "title": "پیشگیری از تزریق", + "parent": "V1" + }, + { + "bom-ref": "V1.2.1", + "identifier": "V1.2.1", + "text": "encoding خروجی برای پاسخ HTTP، سند HTML یا سند XML با زمینه‌ای که داده در آن استفاده می‌شود باید متناسب باشد؛ برای مثال، در رمزگذاری کاراکترهای مربوط به عناصر HTML، صفات HTML، توضیحات HTML، CSS یا فیلدهای هدر HTTP به‌گونه‌ای عمل شود که ساختار پیام یا سند تغییر نکند.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.2", + "identifier": "V1.2.2", + "text": "هنگام ساخت پویا آدرس‌های URL، داده‌های غیرقابل‌اعتماد باید متناسب با زمینه استفاده‌شان رمزگذاری شوند (مثلاً URL Encoding یا base64url برای پارامترهای کوئری یا مسیر) همچنین اطمینان حاصل شود که فقط پروتکل‌های امن در URL مجاز باشند (برای نمونه، استفاده از JavaScript: یا data: ممنوع شود)", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.3", + "identifier": "V1.2.3", + "text": "هنگام تولید پویا محتوای JavaScript (از جملهJSON)، از encoding یا escaping خروجی استفاده شود تا از تغییر ساختار پیام یا سند جلوگیری گردد (و از حملات تزریق JavaScript یا JSON پیشگیری شود).", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.4", + "identifier": "V1.2.4", + "text": "در انتخاب داده یا اجرای کوئری‌های پایگاه داده (مانند SQL، HQL، NoSQL ...)، از parameterized queries، ORMها، یا Entity Framework استفاده شود یا به روش‌های دیگر، برنامه در برابر تزریق SQL و سایر حملات تزریقی پایگاه داده ایمن شده باشد. این موضوع هنگام نوشتن stored procedure‌ها نیز صدق می‌کند.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.5", + "identifier": "V1.2.5", + "text": "برنامه در برابر تزریق دستورات سیستم‌عامل (OS command injection) محافظت شده است و در فراخوانی‌های سیستم‌عامل، از کوئری‌های پارامتری‌شده سیستم‌عامل یا Encoding خروجی دستورات سیستم‌عاملی استفاده می‌شود.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.6", + "identifier": "V1.2.6", + "text": "برنامه در برابر آسیب‌پذیری‌های تزریق LDAP محافظت شده است، یا اینکه کنترل‌های امنیتی مشخصی برای جلوگیری از تزریق LDAP پیاده‌سازی شده‌اند.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.7", + "identifier": "V1.2.7", + "text": "برنامه در برابر حملات تزریقXPath، به‌وسیله‌ی استفاده از کوئری‌های پارامتری‌شده یا کوئری‌های از پیش‌کامپایل‌شده محافظت شده باشد.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.8", + "identifier": "V1.2.8", + "text": "پردازشگرهای LaTeX به‌صورت امن پیکربندی شده‌اند (برای نمونه با عدم استفاده از گزینه‌ی --shell-escape ) و از فهرست مجاز دستورات (allowlist) برای جلوگیری از حملات تزریق LaTeX استفاده شده است.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.9", + "identifier": "V1.2.9", + "text": "برنامه کاراکترهای ویژه در عبارات Regex را escape می‌کند (معمولاً با استفاده از \\)، تا این کاراکترها به‌اشتباه به‌عنوان متاکاراکتر تفسیر نشوند.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.2.10", + "identifier": "V1.2.10", + "text": "برنامه در برابر حملات تزریق CSV و فرمول (Formula Injection) محافظت شده است. برنامه باید هنگام خروجی‌ گرفتن فایل‌های CSV، از قوانین escape تعیین‌شده در بخش‌های ۲.۶ و ۲.۷ استاندارد RFC 4180 پیروی کند. همچنین، هنگام خروجی گرفتن به فرمت CSV یا سایر فرمت‌های صفحه‌گسترده (مانند XLS، XLSX یا ODF)، اگر کاراکترهای ویژه‌ای مانند '='، '+'، '-'، '@'، \\t (tab) و 0\\ (Null character) در ابتدای مقدار یک فیلد قرار داشته باشند، باید با یک تک‌کوتیشن (') escape شوند.", + "parent": "V1.2" + }, + { + "bom-ref": "V1.3", + "identifier": "V1.3", + "title": "پاک‌سازی (Sanitization)", + "parent": "V1" + }, + { + "bom-ref": "V1.3.1", + "identifier": "V1.3.1", + "text": "تمام ورودی‌های HTML غیرقابل اعتماد (مثلاً از طریق ویرایشگرهای WYSIWYG یا ابزارهای مشابه)، با استفاده از یک کتابخانه یا قابلیت امن و معتبر sanitization (پاک‌سازی) ‌شوند.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.2", + "identifier": "V1.3.2", + "text": "برنامه استفاده از تابعeval یا سایر قابلیت‌های اجرای پویا (dynamic) کد، مانند Spring Expression Language (SpEL)، اجتناب ‌کند. در مواردی که استفاده از این قابلیت‌ها اجتناب‌ناپذیر است، ورودی‌های کاربر که در اجرای کد گنجانده می‌شوند باید پیش از اجرا، به‌طور کامل پاک‌سازی (sanitized) شوند.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.3", + "identifier": "V1.3.3", + "text": "بخش‌های حائز اهمیت که احتمال وقوع حملات ناشی از ورودی‌های کاربر در آنها بالاست؛ باید پیشاپیش عملیاتSanitization جهت اقدامات ایمنی روی داده‌ها انجام شود؛ برای مثال، تنها کاراکترهایی که برای آن محتوا ایمن محسوب می‌شوند مجاز باشند، و ورودی‌های بیش‌از‌حد بلند نیز کوتاه (trim) شوند.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.4", + "identifier": "V1.3.4", + "text": "محتوای اسکریپت‌پذیر (scriptable) فایل‌های SVG که توسط کاربر ارائه می‌شود، مورد اعتبارسنجی یا پاک‌سازی (sanitization) قرار گرفته باشد تا فقط شامل تگ‌ها و ویژگی‌هایی (attributes) باشد که برای برنامه ایمن هستند؛ برای مثال، از درج اسکریپت‌ها و عناصر خطرناک مانند foreignObject جلوگیری شده باشد.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.5", + "identifier": "V1.3.5", + "text": "برنامه محتوای زبان‌های قالب‌نویسی یا اسکریپت‌پذیر ارائه‌شده توسط کاربر، مانند Markdown، CSS یا استایل‌شیت‌های XSL، BBCode یا موارد مشابه را پاک‌سازی (sanitize) کرده یا غیرفعال کرده باشد.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.6", + "identifier": "V1.3.6", + "text": "برنامه در برابر حملات جعل درخواست سمت سرور (SSRF) محافظت شده باشد؛ به این صورت که داده‌های غیرقابل اعتماد را در برابر یک لیست مجاز از پروتکل‌ها، دامنه‌ها، مسیرها و پورت‌ها اعتبارسنجی کرده و کاراکترهای بالقوه خطرناک را پیش از استفاده از داده برای فراخوانی سرویس دیگر پاک‌سازی (sanitize) می‌کند.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.7", + "identifier": "V1.3.7", + "text": "برنامه در برابر حملات تزریق قالب (Template Injection) محافظت شده باشد؛ به این صورت که ساخت قالب‌ها بر پایه داده‌های غیرقابل اعتماد مجاز نباشد. در صورتی که هیچ راه‌حل جایگزینی وجود نداشته باشد، هرگونه ورودی غیرقابل اعتماد که به‌صورت پویا در فرآیند ایجاد قالب وارد می‌شود، باید پیش از استفاده یا پاک‌سازی (sanitize) شود یا به‌صورت سخت‌گیرانه اعتبارسنجی (validate) گردد.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.8", + "identifier": "V1.3.8", + "text": "برنامه، ورودی غیرقابل اعتماد را پیش از استفاده در کوئری‌های Java Naming and Directory Interface (JNDI) به‌درستی پاک‌سازی (sanitize) می‌کند و همچنین اطمینان حاصل شود که پیکربندی JNDI به‌گونه‌ای امن انجام شده تا از بروز حملات تزریق JNDI جلوگیری شود.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.9", + "identifier": "V1.3.9", + "text": "برنامه، محتوا را پیش از ارسال به memcache پاک‌سازی (sanitize) می‌کند تا از حملات تزریق (injection attacks) جلوگیری شود.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.10", + "identifier": "V1.3.10", + "text": "رشته‌های قالب‌بندی (format strings) که ممکن است هنگام استفاده، به‌شکلی ناخواسته یا مخرب تفسیر شوند، پیش از پردازش پاک‌سازی (sanitize) شوند.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.11", + "identifier": "V1.3.11", + "text": "برنامه ورودی‌های کاربر را پیش از ارسال به سامانه‌های ایمیل (مانند SMTP یا IMAP) پاک‌سازی (sanitize) ‌کند تا از حملات تزریق در SMTP یا IMAP جلوگیری شود.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.3.12", + "identifier": "V1.3.12", + "text": "عبارات منظم (Regular Expressions) عاری از اجزایی هستند که باعث بازگشت‌پذیری نمایی (exponential backtracking) می‌شوند، و همچنین ورودی‌های غیرقابل اعتماد به‌درستی پاک‌سازی (sanitize) شوند تا از حملات ReDoS (انکار سرویس با استفاده از عبارات منظم) یا Runaway Regex جلوگیری گردد.", + "parent": "V1.3" + }, + { + "bom-ref": "V1.4", + "identifier": "V1.4", + "title": "حافظه، رشته و کد بدون مدیریت (Memory, String, and Unmanaged Code)", + "parent": "V1" + }, + { + "bom-ref": "V1.4.1", + "identifier": "V1.4.1", + "text": "برنامه از رشته‌های ایمن از نظر مدیریت حافظه، کپی حافظه‌ای ایمن‌تر و حساب‌گری ایمن‌تر روی اشاره‌گرها استفاده می‌کند تا از سرریز پشته (stack overflow)، سرریز بافر (buffer overflow) یا سرریز حافظه پویای (heap overflow) جلوگیری کرده یا آن‌ها را شناسایی کند.", + "parent": "V1.4" + }, + { + "bom-ref": "V1.4.2", + "identifier": "V1.4.2", + "text": "از تکنیک‌های اعتبارسنجی علامت (sign validation)، محدوده (range validation) و ورودی (input validation) استفاده شده است تا از بروز سرریز عدد صحیح (integer overflow) جلوگیری شود.", + "parent": "V1.4" + }, + { + "bom-ref": "V1.4.3", + "identifier": "V1.4.3", + "text": "حافظه و منابعی که به‌صورت پویا تخصیص داده شده‌اند، به‌درستی آزاد (release) می‌شوند و همچنین ارجاع‌ها یا اشاره‌گرها (pointers) به حافظه آزادشده حذف یا به null تنظیم می‌شوند تا از اشاره‌گرهای معلق (dangling pointers) و آسیب‌پذیری‌های استفاده پس از آزادسازی (use-after-free) جلوگیری شود.", + "parent": "V1.4" + }, + { + "bom-ref": "V1.5", + "identifier": "V1.5", + "title": "سریال‌زدایی ایمن (Safe Deserialization)", + "parent": "V1" + }, + { + "bom-ref": "V1.5.1", + "identifier": "V1.5.1", + "text": "برنامه، XML Parserها را به‌گونه‌ای پیکربندی کرده باشد که از تنظیمات محدودکننده استفاده کنند، و ویژگی‌های ناایمنی مانند resolve کردن موجودیت‌های خارجی (external entities) غیرفعال شده باشند تا از حملات XML External Entity (XXE) جلوگیری شود.", + "parent": "V1.5" + }, + { + "bom-ref": "V1.5.2", + "identifier": "V1.5.2", + "text": "فرآیند deserialization داده‌های غیرقابل‌اعتماد، با اجرای مدیریت ایمن ورودی‌ها همراه باشد؛ برای مثال، استفاده از لیست مجاز (allowlist) انواع objectها یا محدود کردن انواع تعریف‌شده توسط کلاینت برای جلوگیری از حملات مرتبط با deserialization. همچنین، مکانیزم‌های deserialization که به‌طور صریح به‌عنوان ناایمن شناخته شده‌اند، نباید با داده‌های غیرقابل‌اعتماد مورد استفاده قرار گیرند.", + "parent": "V1.5" + }, + { + "bom-ref": "V1.5.3", + "identifier": "V1.5.3", + "text": "Parser های مختلفی که در برنامه برای یک نوع داده مشخص استفاده می‌شوند (برای مثال: Parser های JSON، XML یا URL)، رفتار تحلیلی یکسانی دارند و از مکانیزم یکسانی برای encoding کاراکترها استفاده می‌کنند، تا از بروز مشکلاتی مانند آسیب‌پذیری در سازگاری JSON (JSON Interoperability) یا تفاوت در نحوه تحلیل URI یا مسیر فایل که ممکن است در حملات RFI یا SSRF سوءاستفاده شود، جلوگیری شود.", + "parent": "V1.5" + }, + { + "bom-ref": "V2", + "identifier": "V2", + "title": "Validation and Business Logic" + }, + { + "bom-ref": "V2.1", + "identifier": "V2.1", + "title": "مستندات اعتبارسنجی و منطق کسب‌وکار ( Validation and Business Logic Documentation)", + "parent": "V2" + }, + { + "bom-ref": "V2.1.1", + "identifier": "V2.1.1", + "text": "قوانین اعتبارسنجی ورودی‌های برنامه (مندرج در مستندات برنامه) ‌باید چگونگی بررسی صحت داده‌ها را مطابق با ساختار مورد انتظار مشخص نماید. این ساختار می‌تواند شامل فرمت‌های رایج داده مانند شماره کارت اعتباری، آدرس ایمیل، شماره تلفن یا یک قالب داده‌ای داخلی باشد.", + "parent": "V2.1" + }, + { + "bom-ref": "V2.1.2", + "identifier": "V2.1.2", + "text": "قوانین اعتبارسنجی ورودی‌های برنامه (مندرج در مستندات برنامه) باید چگونگی بررسی سازگاری مناسب بین داده‌‌های ترکیب شده (از نظر مفهومی و متنی) را مشخص نماید؛ مانند تطبیق کدپستی با نام محله.", + "parent": "V2.1" + }, + { + "bom-ref": "V2.1.3", + "identifier": "V2.1.3", + "text": "انتظارات مربوط به محدودیت‌ها و اعتبارسنجی‌های منطق کسب و کار مستند شده باشند؛ این مستندات باید شامل محدودیت‌ها در سطح هر کاربر و محدودیت‌های عمومی در سطح برنامه باشند.", + "parent": "V2.1" + }, + { + "bom-ref": "V2.2", + "identifier": "V2.2", + "title": "اعتبارسنجی ورودی (Input Validation)", + "parent": "V2" + }, + { + "bom-ref": "V2.2.1", + "identifier": "V2.2.1", + "text": "ورودی‌ها باید به‌منظور اعمال انتظارات کسب و کار یا عملکردی مرتبط با آن‌ها اعتبارسنجی ‌شوند.این اعتبارسنجی باید یکی از این دو روش زیر را داشته باشد، استفاده از اعتبارسنجی مثبت (Positive Validation) مبتنی بر فهرست مجاز از مقادیر، الگوها یا بازه‌های قابل قبول و تطبیق با ساختار مورد انتظار و محدودیت‌های منطقی، بر اساس قوانین از پیش تعریف‌شده. برای سطح 1 (L1)، تمرکز می‌تواند بر ورودی‌هایی باشد که در تصمیم‌گیری‌های خاص تجاری یا امنیتی استفاده می‌شوند. برای سطح 2 و بالاتر، این اعتبارسنجی باید شامل تمام ورودی‌ها باشد.", + "parent": "V2.2" + }, + { + "bom-ref": "V2.2.2", + "identifier": "V2.2.2", + "text": "برنامه به‌گونه‌ای طراحی شود که اعتبارسنجی ورودی را در لایه‌ قابل اعتمادی از سرویس (Trusted Service Layer) اعمال کند. هرچند اعتبارسنجی سمت کلاینت (Client-side Validation) باعث بهبود تجربه کاربری می‌شود و توصیه می‌گردد، اما نباید به‌عنوان یک کنترل امنیتی اتکا شود.", + "parent": "V2.2" + }, + { + "bom-ref": "V2.2.3", + "identifier": "V2.2.3", + "text": "برنامه باید اطمینان حاصل نماید که ترکیب داده‌های مربوطه با توجه به قوانین از پیش تعریف‌شده معقول و منطقی باشد.", + "parent": "V2.2" + }, + { + "bom-ref": "V2.3", + "identifier": "V2.3", + "title": "امنیت منطق کسب‌وکار (Business Logic Security)", + "parent": "V2" + }, + { + "bom-ref": "V2.3.1", + "identifier": "V2.3.1", + "text": "اطمینان حاصل شود که برنامه فقط جریان‌های منطق تجاری را برای همان کاربر و طبق ترتیب گام‌به‌گام از پیش تعیین شده و مورد انتظار پردازش می‌کند و امکان رد کردن مراحل (Skipping Steps) وجود ندارد.", + "parent": "V2.3" + }, + { + "bom-ref": "V2.3.2", + "identifier": "V2.3.2", + "text": "اطمینان حاصل شود که محدودیت‌های منطق تجاری مطابق با مستندات برنامه پیاده‌سازی شده‌اند، تا از سوء‌استفاده از نقص‌های منطقی جلوگیری شود.", + "parent": "V2.3" + }, + { + "bom-ref": "V2.3.3", + "identifier": "V2.3.3", + "text": "تراکنش‌های سطح منطق کسب‌وکار (business logic) باید به‌گونه‌ای استفاده شوند که یا یک عملیات منطق کسب‌وکار به‌طور کامل با موفقیت انجام شود، یا در صورت بروز خطا، به حالت صحیح قبلی بازگردد(rollback) شود.", + "parent": "V2.3" + }, + { + "bom-ref": "V2.3.4", + "identifier": "V2.3.4", + "text": "در منطق کسب‌وکار (business logic)باید از مکانیزم‌های قفل‌گذاری (locking) استفاده شده باشد تا اطمینان حاصل شود که منابع محدود (مانند صندلی‌های سینما یا بازه‌های زمانی تحویل)، قابل رزرو دوباره (double-booked) از طریق دستکاری منطق برنامه نباشند.", + "parent": "V2.3" + }, + { + "bom-ref": "V2.3.5", + "identifier": "V2.3.5", + "text": "اطمینان حاصل شود که جریان‌های منطق کسب و کاری با ارزش بالا نیازمند تایید چند کاربره (Multi-user Approval) هستند تا از اقدامات غیرمجاز یا تصادفی جلوگیری شود. این موارد می‌تواند شامل – اما نه محدود به – انتقال‌های مالی بزرگ، تایید قرارداد‌ها، دسترسی به اطلاعات طبقه‌بنده شده، یا غیرفعال‌سازی‌های ایمنی در محیط‌های تولید صنعتی باشد.", + "parent": "V2.3" + }, + { + "bom-ref": "V2.4", + "identifier": "V2.4", + "title": "مقابله با خودکارسازی (Anti-automation)", + "parent": "V2" + }, + { + "bom-ref": "V2.4.1", + "identifier": "V2.4.1", + "text": "کنترل‌های ضد خودکارسازی (Anti-Automation) در سیستم پیاده‌سازی شده باشند تا از سوءاستفاده‌هایی مانند فراخوانی بیش از حد توابع برنامه جلوگیری شود؛ چرا که این نوع حملات می‌توانند منجر به استخراج غیرمجاز داده‌ها، تولید داده‌های زائد، مصرف کامل سهمیه‌ها، عبور از محدودیت‌های نرخ (Rate Limit)، ایجاد اختلال در سرویس (DoS) یا استفاده بیش از حد از منابع گران‌قیمت شوند.", + "parent": "V2.4" + }, + { + "bom-ref": "V2.4.2", + "identifier": "V2.4.2", + "text": "بررسی کنید که جریان‌های منطق کسب‌وکار (Business Logic Flows) به گونه‌ای طراحی شده باشند که نیازمند زمان‌بندی واقعی انسان باشند، و از ارسال سریع و غیرطبیعی تراکنش‌ها (Transaction Submissions) جلوگیری کنند.", + "parent": "V2.4" + }, + { + "bom-ref": "V3", + "identifier": "V3", + "title": "امنیت رابط کاربری وب (Web Frontend Security)" + }, + { + "bom-ref": "V3.1", + "identifier": "V3.1", + "title": "مستندسازی امنیت رابط کاربری وب ( Web Frontend Security Documentation)", + "parent": "V3" + }, + { + "bom-ref": "V3.1.1", + "identifier": "V3.1.1", + "text": "در مستندات برنامه باید ویژگی‌های امنیتی مربوط به مرورگری که برنامه را اجرا میکند مشخص شده باشد (نظیر استفاده از HTTPS، پشتیبانی از HTTP Strict Transport Security (HSTS)، اجرای Content Security Policy (CSP) و سایر مکانیزم‌های امنیتی مرتبط با HTTP). همچنین در مستندات باید مشخص شود مرورگر در صورت عدم دسترسی به این ویژگی‌ها چه رفتاری باید داشته باشد. (برای مثال: نمایش هشدار به کاربر یا ممانعت از دسترسی به برنامه).", + "parent": "V3.1" + }, + { + "bom-ref": "V3.2", + "identifier": "V3.2", + "title": "تفسیر ناخواسته محتوا (Unintended Content Interpretation)", + "parent": "V3" + }, + { + "bom-ref": "V3.2.1", + "identifier": "V3.2.1", + "text": "کنترل‌های امنیتی متناسب با مرورگر‌ها در هنگام پردازش پاسخ‌های HTTP به منظور جلوگیری از پردازش محتوا یا عملکرد مربوط به آن در شرایط زمینه‌‌ای نادرست باید بکار‌گرفته شود. (برای مثال، زمانی که یک APIیا یک فایل بارگذاری‌شده توسط کاربر یا هر منبع دیگری به‌طور مستقیم درخواست می‌شود).کنترل‌های ممکن می‌توانند شامل این موارد باشند: عدم پردازش محتوا مگر در صورت وجود هدرهای متناسب با درخواست‌های HTTP (مانند ‎Sec-Fetch-*) به منظور اطمیان از صحیح بودن پردازش محتوا یا عملکرد مربوط به . استفاده از عبارت sandbox در هدر Content-Security-Policy یا استفاده از نوعattachment در هدر Content-Disposition .", + "parent": "V3.2" + }, + { + "bom-ref": "V3.2.2", + "identifier": "V3.2.2", + "text": "اطمینان حاصل شود که محتوایی که برای نمایش به‌صورت متن طراحی شده نه برای پردازش به صورتHTML ، با استفاده از توابع امن نظیر CreateTextNode یا textContent به منظور جلوگیری از اجرای ناخواسته محتوایی مانند HTML یا JavaScript پردازش ‌شود.", + "parent": "V3.2" + }, + { + "bom-ref": "V3.2.3", + "identifier": "V3.2.3", + "text": "برنامه هنگام استفاده از جاوااسکریپت سمت کاربر (Client-Side JavaScript)، با استفاده از اعلام متغیرها به‌صورت صریح، انجام بررسی نوع به‌صورت سخت‌گیرانه، اجتناب از ذخیره‌سازی متغیرهای سراسری بر روی شیء document، و پیاده‌سازی ایزولاسیون فضای نام (namespace isolation)، از وقوع DOM Clobbering جلوگیری می‌کند.", + "parent": "V3.2" + }, + { + "bom-ref": "V3.3", + "identifier": "V3.3", + "title": "پیکربندی کوکی (Cookie Setup)", + "parent": "V3" + }, + { + "bom-ref": "V3.3.1", + "identifier": "V3.3.1", + "text": "اطمینان حاصل شود که کوکی‌ها دارای ویژگی ‘Secure’ هستند. در صورتی که از پیشوند ‘__Host-’ برای نام کوکی استفاده نمی‌شود، باید پیشوند__Secure- در نام کوکی لحاظ شده باشد.", + "parent": "V3.3" + }, + { + "bom-ref": "V3.3.2", + "identifier": "V3.3.2", + "text": "اطمینان حاصل شود که مقدار ویژگی SameSite برای هر کوکی، متناسب با هدف آن کوکی تنظیم شده باشد تا میزان آسیب‌پذیری در برابر حملات فریب سمت کلاینت نظیر CSRF کاهش یابد.", + "parent": "V3.3" + }, + { + "bom-ref": "V3.3.3", + "identifier": "V3.3.3", + "text": "اطمینان حاصل شود که کوکی‌ها از پیشوند __Host- در نام خود استفاده می‌کنند، مگر در مواردی که کوکی به‌طور مشخص برای اشتراک‌گذاری بین چند دامنه (Hosts) طراحی شده باشد.", + "parent": "V3.3" + }, + { + "bom-ref": "V3.3.4", + "identifier": "V3.3.4", + "text": "اطمینان حاصل شود که اگر مقدار کوکی (مثلاً توکن نشست) نباید برای اسکریپت‌های سمت کلاینت در دسترس باشد، ویژگی HttpOnly باید برای آن کوکی فعال شده باشد، و همچنین مقدار کوکی (مثلاً همان توکن نشست) تنها از طریق هدر Set-Cookie به کلاینت ارسال شود.", + "parent": "V3.3" + }, + { + "bom-ref": "V3.3.5", + "identifier": "V3.3.5", + "text": "اطمینان حاصل شود که حداکثر مجموع نام و مقدار کوکی از ۴۰۹۶ بایت تجاوز نکند.کوکی‌هایی که بیش از این مقدار باشند توسط مرورگر ذخیره نخواهند شد، و بنابراین در درخواست‌ها ارسال نمی‌شوند؛ موضوعی که ممکن است باعث شود عملکردهایی از برنامه که به آن کوکی وابسته‌اند، غیرفعال یا مختل شوند.", + "parent": "V3.3" + }, + { + "bom-ref": "V3.4", + "identifier": "V3.4", + "title": "هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers)", + "parent": "V3" + }, + { + "bom-ref": "V3.4.1", + "identifier": "V3.4.1", + "text": "اطمینان حاصل شود که در تمامی پاسخ‌های HTTP، هدر Strict-Transport-Security وجود دارد تا سیاست HSTS (HTTP Strict Transport Security) اعمال شود. حداقل مقدار max-age باید برابر با یک سال باشد. برای برنامه‌های سطح 2 (L2) و بالاتر، این سیاست باید برای تمام زیردامنه‌ها (subdomains) نیز اعمال شود.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.2", + "identifier": "V3.4.2", + "text": "اطمینان حاصل شود که هدرAccess-Control-Allow-Origin مربوط به (CORS)، دارای یک مقدار ثابت و مشخص توسط برنامه باشد یا اگر هدر Origin در درخواست مورد استفاده قرار می گیرد باید با فهرستی از مبدأهای مورد اعتماد (Allowlist) اعتبارسنجی شود. در صورتی که استفاده از مقدار * در Access-Control-Allow-Origin تنظیم شده باشد، اطمینان حاصل شود که هیچ اطلاعات حساسی در پاسخ قرار ندارد.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.3", + "identifier": "V3.4.3", + "text": "اطمینان حاصل شود که تمامی پاسخ‌های HTTP شامل هدر Content-Security-Policy باشند تا ریسک اجرای اسکریپت‌های مخرب (مانند (JavaScript مخرب کاهش یابد. دستورهای object-src 'none' و base-uri 'none' الزامی هستند .برای برنامه‌های سطح 3 (L3)، باید سیاست CSP به‌صورت اختصاصی برای هر پاسخ(Per-response Policy) و مبتنی بر nonce یا hash تعریف شده باشد.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.4", + "identifier": "V3.4.4", + "text": "اطمینان حاصل شود که تمامی پاسخ‌ها شامل هدر X-Content-Type-Options: nosniff باشند، این (هدر) به مرورگرها دستور می‌دهد که برای پاسخ دریافتی از Content Sniffing یا حدس‌زدن نوع محتوا (MIME Type Guessing) استفاده نکنند و آن‌ها را ملزم می‌کند که نوع محتوای واقعی را دقیقاً مطابق مقدار هدر Content-Type در درخواست/پاسخ در نظر بگیرند.برای مثال، پاسخ به یک درخواست برای یک فایل استایل (CSS) تنها در صورتی پذیرفته می‌شود که مقدار Content-Type در پاسخ 'text/css' باشد.این کار همچنین امکان استفاده از قابلیت مسدودسازی خواندن منابع از مبدا متفاوت Cross-Origin Read Blocking یا (CORB) توسط مرورگر را فراهم می‌سازد.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.5", + "identifier": "V3.4.5", + "text": "برنامه باید (وب‌سایت یا اپلیکیشن) یک \"Referrer Policy\" (سیاست ارجاع) تنظیم کرده باشد تا از نشت اطلاعات حساس از طریق هدر HTTP به نام Referer به سرویس‌های شخص ثالث جلوگیری شود. این کار را می‌توان از طریق هدر پاسخ HTTP به نام Referrer-Policy یا با استفاده از ویژگی‌هایی در عناصر HTML انجام داد.اطلاعات حساس ممکن است شامل مسیر (Path) و داده‌های کوئری (Query) در آدرس URL باشد، و در مورد برنامه‌های داخلی و غیرعمومی، حتی نام میزبان (hostname) نیز می‌تواند جزو اطلاعات حساس محسوب شود.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.6", + "identifier": "V3.4.6", + "text": "برنامه باید از frame-ancestors در هدر Content-Security-Policy (CSP) برای تمام پاسخ‌های HTTP استفاده کند،تا به‌صورت پیش‌فرض، اجازه‌ی نمایش سایت در قالب iframe داده نشود، و فقط در صورت نیاز، نمایش منابع خاص (specific resources) در iframe مجاز باشد.به این نکته توجه کنید که هدر X-Frame-Options با اینکه هنوز توسط برخی مرورگرها پشتیبانی می‌شود، اما قدیمی (obsolete) است و نباید به آن تکیه کرد.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.7", + "identifier": "V3.4.7", + "text": "هدر Content-Security-Policy (CSP) باید شامل یک آدرس برای گزارش (Report violation) باشد.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.4.8", + "identifier": "V3.4.8", + "text": "تمام پاسخ‌های HTTP که باعث رندر (نمایش) یک سند می‌شوند مانند (پاسخ‌هایی با نوع محتوا (text/html باید شامل هدر Cross-Origin-Opener-Policy با دستور same-origin یا same-origin-allow-popups باشند (بنا به نیاز). این کار از حملاتی جلوگیری می‌کند که از دسترسی مشترک به اشیای Window سوءاستفاده می‌کنند، مانند حملات tabnabbing و frame counting.", + "parent": "V3.4" + }, + { + "bom-ref": "V3.5", + "identifier": "V3.5", + "title": "تفکیک مبدا توسط مرورگر (Browser Origin Separation)", + "parent": "V3" + }, + { + "bom-ref": "V3.5.1", + "identifier": "V3.5.1", + "text": "برنامه باید از مکانیزم Preflight در CORS برای جلوگیری از درخواست‌های cross-origin به عملکردهای حساس استفاده نمی‌کند، این درخواست‌ها به‌گونه‌ای اعتبارسنجی شوند که فقط از مبدأ اصلی برنامه ارسال شده باشند. این اعتبارسنجی می‌تواند با استفاده از توکن‌های (anti- forgery tokens) یا الزام به ارسال هدرهای HTTP اضافی انجام شود که در لیست هدرهای مجاز CORS (CORS-safelisted) قرار ندارند. این اقدام برای محافظت در برابر حملات جعل درخواست از طریق مرورگر، که با نام CSRF (Cross-Site Request Forgery) شناخته می‌شوند، ضروری است.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.2", + "identifier": "V3.5.2", + "text": "اگر برنامه برای جلوگیری از استفاده غیرمجاز cross-origin از عملکردهای حساس، به مکانیزم Preflight در CORS متکی است، باید امکان فراخوانی این عملکردها با درخواست‌هایی که باعث ایجاد Preflight نمی‌شوند، وجود نداشته باشد. برای تحقق این هدف ممکن است لازم باشد مقدار هدرهای Origin و Content-Type بررسی شوند یا از هدر اضافی استفاده شود که در لیست هدرهای مجاز CORS قرار ندارد.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.3", + "identifier": "V3.5.3", + "text": "برنامه باید درخواست‌های HTTP که به عملکردهای حساس از متدهای مناسب مانند POST، PUT، PATCH یا DELETE استفاده می‌کنند، و نه از متدهایی که در استاندارد HTTP به‌عنوان \"ایمن\" تعریف شده‌اند، مانند GET، HEAD یا .OPTIONS به عنوان جایگزین یا مکمل، می‌توان از بررسی سخت‌گیرانه هدرهای Sec-Fetch-* استفاده کرد تا اطمینان حاصل شود که درخواست از منبع نامناسبی مثل بارگذاری تصویر، ناوبری صفحه یا فراخوانی cross-origin ارسال نشده است.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.4", + "identifier": "V3.5.4", + "text": "برنامه‌های مجزا باید روی نام‌های دامنه (hostname) متفاوت میزبانی شده‌اند تا از محدودیت‌های ارائه‌شده توسط (Same-Origin Policy) بهره‌مند شوند. این شامل کنترل تعامل اسناد یا اسکریپت‌های بارگذاری‌شده از یک مبدأ با منابع مبدأ دیگر و اعمال محدودیت بر اساس دامنه برای کوکی‌ها می‌شود.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.5", + "identifier": "V3.5.5", + "text": "برنامه باید پیام‌های دریافت‌شده از طریق رابط postMessage در صورتی که مبدأ پیام مورد اعتماد نباشد یا ساختار پیام نامعتبر باشد، نادیده گرفته می‌شوند.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.6", + "identifier": "V3.5.6", + "text": "هیچ‌کجای برنامه از قابلیت JSONP استفاده نشود تا از حملات Cross-Site Script Inclusion (XSSI) جلوگیری شود.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.7", + "identifier": "V3.5.7", + "text": "داده‌هایی که نیاز به احراز هویت دارند، در پاسخ‌های مربوط به منابع اسکریپتی(مانند فایل‌های (JavaScript نباید قرار بگیرند تا از حملات XSSI جلوگیری شود.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.5.8", + "identifier": "V3.5.8", + "text": "اطمینان حاصل کنید که منابع احراز هویت‌شده (مانند تصاویر، ویدیوها، اسکریپت‌ها و سایر اسناد) فقط در مواقعی که هدف آن است، قابل بارگذاری یا جاسازی توسط کاربر باشند. این کار را می‌توان با اعتبارسنجی دقیق هدرهای HTTP مانند Sec-Fetch-* انجام داد تا اطمینان حاصل شود که درخواست از یک منبع غیرمجاز ارسال نشده است، یا با تنظیم هدر Cross-Origin-Resource-Policy برای محدود کردن دسترسی مرورگر به محتوا.", + "parent": "V3.5" + }, + { + "bom-ref": "V3.6", + "identifier": "V3.6", + "title": "یکپارچگی منابع خارجی (External Resource Integrity)", + "parent": "V3" + }, + { + "bom-ref": "V3.6.1", + "identifier": "V3.6.1", + "text": "منابع سمت کلاینت مانند کتابخانه‌های جاوااسکریپت، فایل‌های CSS، یا فونت‌های وب، تنها در صورتی به‌صورت خارجی (مثلاً از طریق شبکه تحویل محتوا - CDN) میزبانی شوند که آن منابع: استاتیک (تغییرناپذیر) باشند، نسخه‌گذاری‌شده (versioned) باشند و یکپارچگی آن‌ها با استفاده از Subresource Integrity (SRI) بررسی شود. اگر این موارد امکان‌پذیر نیست، باید برای هر منبع، یک تصمیم امنیتی مستند وجود داشته باشد که توجیه کند چرا این منبع به این شکل بارگذاری می‌شود.", + "parent": "V3.6" + }, + { + "bom-ref": "V3.7", + "identifier": "V3.7", + "title": "سایر ملاحظات امنیتی مرورگر (Other Browser Security Considerations)", + "parent": "V3" + }, + { + "bom-ref": "V3.7.1", + "identifier": "V3.7.1", + "text": "برنامه صرفا باید از فناوری‌های سمت کلاینتی استفاده ‌کند که همچنان پشتیبانی می‌شوند و از نظر امنیتی قابل اعتماد هستند.مثال‌هایی از فناوری‌هایی که این الزام را برآورده نمی‌کنند عبارتند از NSAPI Plugins،Flash،Shockwave،ActiveX،Silverlight،NACL و Appletهای جاوا در سمت کلاینت", + "parent": "V3.7" + }, + { + "bom-ref": "V3.7.2", + "identifier": "V3.7.2", + "text": "برنامه فقط زمانی کاربر را به دامنه‌ها یا hostnameهای دیگر (که تحت کنترل برنامه نیستند) به صورت خودکار هدایت می‌کند، که آن مقصد در یک فهرست مجاز (allowlist) قرار داشته باشد.", + "parent": "V3.7" + }, + { + "bom-ref": "V3.7.3", + "identifier": "V3.7.3", + "text": "برنامه باید هنگام ریدایرکت کاربر به یک URL که خارج از کنترل برنامه است، یک پیام هشدار نشان می‌دهد و امکان لغو آن را به کاربر می‌دهد.", + "parent": "V3.7" + }, + { + "bom-ref": "V3.7.4", + "identifier": "V3.7.4", + "text": "باید دامنه اصلی برنامه، مثلاً (site.tld) به فهرست preload عمومی HSTS اضافه شده باشد.", + "parent": "V3.7" + }, + { + "bom-ref": "V3.7.5", + "identifier": "V3.7.5", + "text": "اگر مرورگر کاربر از ویژگی‌های امنیتی مورد انتظار برنامه پشتیبانی نمی‌کند، برنامه رفتار مناسبی داشته باشد، مثل هشدار دادن به کاربر یا مسدود کردن دسترسی.", + "parent": "V3.7" + }, + { + "bom-ref": "V4", + "identifier": "V4", + "title": "API and Web Service" + }, + { + "bom-ref": "V4.1", + "identifier": "V4.1", + "title": "Generic Web Service Security", + "parent": "V4" + }, + { + "bom-ref": "V4.1.1", + "identifier": "V4.1.1", + "text": "اطمینان حاصل شود که در هر پاسخ HTTP که شامل Body می باشد، هدر Content-Type وجود داشته باشد که نوع آن، با محتوای پاسخ دریافتی از سرور مطابقت داشته باشد. این هدر باید شامل پارامتر charset نیز باشد تا رمزگذاری کاراکتر ایمن (مانند UTF-8 یا ISO-8859-1) را مشخص کند. این مقادیر باید مطابق با استاندارد IANA Media Types باشند؛ برای مثال، انواعی مانند \"text/، /+xml\" و \"/xml\" را در بر می‌گیرند.", + "parent": "V4.1" + }, + { + "bom-ref": "V4.1.2", + "identifier": "V4.1.2", + "text": "اطمینان حاصل شود که تنها نقاط پایانی که برای استفاده کاربر نهایی از طریق مرورگر طراحی شده‌اند (User-Facing Endpoints) به‌صورت خودکار از HTTP به HTTPS هدایت ‌شوند، سایر سرویس‌ها یا نقاط پایانی نباید (ریدایرکت شفاف، Transparent Redirect) داشته باشند. این اقدام برای جلوگیری از وضعیتی است که در آن یک کلاینت به اشتباه درخواست‌های رمزنگاری‌نشده (HTTP) ارسال می‌کند، اما چون این درخواست‌ها به‌طور خودکار به HTTPS ریدایرکت می‌شوند، نشت احتمالی داده‌های حساس پنهان خواهد ماند.", + "parent": "V4.1" + }, + { + "bom-ref": "V4.1.3", + "identifier": "V4.1.3", + "text": "اطمینان حاصل شود که هدرهای HTTP که در برنامه استفاده می شود و توسط یک لایه واسطه، مانند یکload balancer ، یک پروکسی وب یا یک سرویس backend-for-frontend تنظیم شده است نمی‌تواند توسط کاربر نهایی بازنویسی شود. هدرهای نمونه ممکن است شامل X-Real-IP، X-Forwarded-* یا X-User-ID باشند.", + "parent": "V4.1" + }, + { + "bom-ref": "V4.1.4", + "identifier": "V4.1.4", + "text": "اطمینان حاصل شود که فقط متدهای HTTP که صریحاً توسط برنامه یا API آن پشتیبانی می‌شوند (از جمله OPTIONS در درخواست‌های preflight) می‌توانند مورد استفاده قرار گیرند و متدهای استفاده نشده مسدود شوند.", + "parent": "V4.1" + }, + { + "bom-ref": "V4.1.5", + "identifier": "V4.1.5", + "text": "اطمینان حاصل شود که برای درخواست‌ها یا تراکنش‌هایی که بسیار حساس هستند یا از چندین سامانه عبور می‌کنند، از امضاهای دیجیتال در سطح پیام استفاده شود تا اطمینان امنیتی بیشتری علاوه بر محافظت‌های سطح انتقال (مانند TLS) فراهم گردد.", + "parent": "V4.1" + }, + { + "bom-ref": "V4.2", + "identifier": "V4.2", + "title": "HTTP Message Structure Validation", + "parent": "V4" + }, + { + "bom-ref": "V4.2.1", + "identifier": "V4.2.1", + "text": "اطمینان حاصل شود که تمامی اجزای برنامه )از جمله لود بالانسرها، فایروال‌ها و سرورهای اپلیکیشن( مرزهای پیام‌های HTTP ورودی را با استفاده از مکانیزم مناسب نسخه های HTTP تعیین می‌کنند تا از حملات HTTP request smuggling جلوگیری شود. در HTTP/1.x اگر هدر Transfer-Encoding وجود داشته باشد، هدر Content-Length باید مطابق RFC 2616 نادیده گرفته شود. در مقابل، هنگام استفاده از HTTP/2 یا HTTP/3، اگر هدر Content-Length وجود داشته باشد، گیرنده باید اطمینان حاصل کند که این مقادیر با طول فریم‌های DATA سازگار می‌باشد.", + "parent": "V4.2" + }, + { + "bom-ref": "V4.2.2", + "identifier": "V4.2.2", + "text": "اطمینان حاصل شود که هنگام تولید پیام‌های HTTP، هدر Content-Length با طول محتوایی که توسط چارچوب‌بندی پروتکل HTTP تعیین می‌شود، تداخل نداشته باشد تا از حملات request smuggling جلوگیری شود.", + "parent": "V4.2" + }, + { + "bom-ref": "V4.2.3", + "identifier": "V4.2.3", + "text": "اطمینان حاصل شود برنامه، پیام‌های HTTP/2 یا HTTP/3 با هدرهای connection-specific مانند Transfer-Encoding را به منظور جلوگیری از حملات response splitting یا header injection ارسال یا قبول نمی کند.", + "parent": "V4.2" + }, + { + "bom-ref": "V4.2.4", + "identifier": "V4.2.4", + "text": "اطمینان حاصل شود برنامه تنها درخواست های HTTP/2 and HTTP/3 که هدرها و مقادیر آن شامل هیچ توالی CR (\\r), LF (\\n), CRLF (\\r\\n) نباشد را می پذیرد تا از حملات header injection جلوگیری کند.", + "parent": "V4.2" + }, + { + "bom-ref": "V4.2.5", + "identifier": "V4.2.5", + "text": "اطمینان حاصل کنید که اگر برنامه (Frontend or Backend) اقدام به ساخت و ارسال درخواست‌های HTTP می کند از مکانیزم های validation ، sanitization یا سایر مکانیزم‌ها استفاده کند تا از ایجاد URIها (مانند فراخوانیAPI ) یا فیلدهای هدر درخواست HTTP (مانند Authorization یا( Cookie که بیش از حد مجاز، طولانی هستند، جلوگیری شود که منجر به عدم پذیرش درخواست توسط مولفه دریافت کننده(هر بخشی از زیرساخت یا سامانه که درخواست HTTP را دریافت و پردازش می‌کند) شود. عدم رعایت این موضوع می تواند باعث وقوع حمله Danial of Service شود، ارسال یک درخواست بیش از حد طولانی (مانند یک فیلد هدر کوکی طولانی) باعث می شود سرور همواره با وضعیت خطا پاسخ دهد.", + "parent": "V4.2" + }, + { + "bom-ref": "V4.3", + "identifier": "V4.3", + "title": "GraphQL", + "parent": "V4" + }, + { + "bom-ref": "V4.3.1", + "identifier": "V4.3.1", + "text": "اطمینان حاصل شود یکی از مکانیزم ها برای جلوگیری از حملات انکار سرویس (DoS) درلایه GraphQL یا لایه داده استفاده شده است. این مکانیزم‌ها عبارتند از استفاده از فهرست مجاز کوئری‌ها ( Query Allowlist)، محدودسازی عمق کوئری‌ها (Depth Limiting)،محدودسازی تعداد یا حجم داده(Amount Limiting) و تحلیل هزینه کوئری (Query Cost Analysis). این اقدامات، به منظور مقابله با درخواست های پیچیده، تو در تو یا کوئری‌های پرهزینه که می توانند موجب مصرف بیش از حد منابع و اختلال در سرویس دهی شوند ضروری است.", + "parent": "V4.3" + }, + { + "bom-ref": "V4.3.2", + "identifier": "V4.3.2", + "text": "اطمینان حاصل شود که قابلیت Introspection در GraphQL در محیط تولید (Production) غیرفعال شده‌است، مگرAPI مبتنی بر GraphQL به‌صورت صریح برای استفاده توسط اشخاص یا سامانه های ثالث (Third Parties) طراحی شده باشد.", + "parent": "V4.3" + }, + { + "bom-ref": "V4.4", + "identifier": "V4.4", + "title": "WebSocket", + "parent": "V4" + }, + { + "bom-ref": "V4.4.1", + "identifier": "V4.4.1", + "text": "اطمینان حاصل شود که تمامی ارتباطات WebSocket از طریق پروتکل TLS( WSS) برقرار می‌شوند.", + "parent": "V4.4" + }, + { + "bom-ref": "V4.4.2", + "identifier": "V4.4.2", + "text": "اطمینان حاصل شود که در هنگام Handshake اولیه‌ی HTTP برای WebSocket، مقدار هدر Origin بررسی ‌شود و در صورتی که با لیستی از مبداهای مجاز (allowed origins) برای برنامه مطابقت داشته باشد، اتصال پذیرفته می‌شود.", + "parent": "V4.4" + }, + { + "bom-ref": "V4.4.3", + "identifier": "V4.4.3", + "text": "اطمینان حاصل شود که در صورتی که امکان استفاده از مکانیزم استاندارد مدیریت نشست برنامه وجود نداشته باشد، از توکن‌های اختصاصی (Duplicated Tokens) برای این منظور استفاده شود که با الزامات امنیتی مدیریت نشست به طور کامل مطابقت داشته باشند.", + "parent": "V4.4" + }, + { + "bom-ref": "V4.4.4", + "identifier": "V4.4.4", + "text": "اطمینان حاصل شود که توکن‌های اختصاصی مدیریت نشست WebSocket در هنگام انتقال از یک نشست HTTPS موجود به کانالWebSocket، از طریق نشست HTTPS احراز هویت‌شده قبلی، دریافت یا اعتبارسنجی می‌شوند.", + "parent": "V4.4" + }, + { + "bom-ref": "V5", + "identifier": "V5", + "title": "File Handling" + }, + { + "bom-ref": "V5.1", + "identifier": "V5.1", + "title": "File Handling Documentation", + "parent": "V5" + }, + { + "bom-ref": "V5.1.1", + "identifier": "V5.1.1", + "text": "مستندات نوع فایل‌های مجاز، پسوندهای مورد انتظار، و حداکثر اندازه هر فایل (شامل اندازه پس از استخراج) را برای هر قابلیت بارگذاری مشخص کرده باشد. همچنین، مستندات توضیح می‌دهند چگونه فایل‌ها برای دانلود و پردازش توسط کاربران نهایی ایمن‌سازی می‌شوند؛ برای مثال، رفتار برنامه هنگام شناسایی یک فایل مخرب چگونه خواهد بود.", + "parent": "V5.1" + }, + { + "bom-ref": "V5.2", + "identifier": "V5.2", + "title": "File Upload and Content", + "parent": "V5" + }, + { + "bom-ref": "V5.2.1", + "identifier": "V5.2.1", + "text": "برنامه تنها فایل‌هایی با حجم مشخص، که قادر به پردازش آن است را می‌پذیرد تا از کاهش عملکرد یا حملات انکار سرویس (DoS) جلوگیری شود.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.2.2", + "identifier": "V5.2.2", + "text": "هنگام پذیرش فایل توسط برنامه، چه به صورت مستقیم و چه به صورت یک آرشیو مانند فایلzip پسوند فایل با پسوند مورد انتظار مطابقت داشته باشد و اعتبارسنجی محتوای فایل صورت گیرد تا تایید شود محتوای فایل با نوع تعریف‌شده توسط پسوند هم‌خوانی دارد. این فرآیند می تواند شامل موارد بررسی بایت‌های ابتدایی (magic bytes) فایل، انجام بازنویسی تصاویر برای حذف ساختارها و اطلاعات ناخواسته و استفاده از کتابخانه‌های تخصصی برای اعتبارسنجی کامل محتوای فایل باشد اما محدود به آنها نیست. در سطح L1، کافی است این بررسی‌ها فقط بر روی فایل‌هایی که در فرآیندهای تجاری یا امنیتی خاص استفاده می‌شوند متمرکز باشد. در سطح L2 و بالاتر، این فرآیند باید برای تمامی فایل‌های ورودی برنامه اجرا شود.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.2.3", + "identifier": "V5.2.3", + "text": "برنامه باید پیش از استخراج محتوای فایل‌های فشرده (مانند zip، gz، docx، odt)، آن‌ها را از نظر حداکثر اندازه مجاز پس از استخراج و همچنین حداکثر تعداد فایل‌های درون آن بررسی می‌کند.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.2.4", + "identifier": "V5.2.4", + "text": "برنامه فضای مشخصی برای اندازه فایل و تعداد فایل‌های مجاز برای هر کاربر اعمال می‌کند تا از این طریق، یک کاربر نتواند با بارگذاری تعداد زیادی فایل یا فایل‌های بیش از حد بزرگ، فضای ذخیره‌سازی را پر کند.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.2.5", + "identifier": "V5.2.5", + "text": "برنامه اجازه بارگذاری فایل‌های فشرده‌ که حاوی لینک های نمادین (symlinks) هستند را نمی‌دهد، مگر اینکه این رفتار به طور مشخص مورد نیاز باشد. در چنین شرایطی باید یک فهرست مجاز (allowlist) از مسیرها یا فایل‌هایی که می تواند برای آنها لینک نمادین ایجاد شود، اعمال و اعتبارسنجی گردد.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.2.6", + "identifier": "V5.2.6", + "text": "برنامه تصاویر بارگذاری‌شده با اندازه پیکسلی بزرگ‌تر از حد مجاز را رد کند تا از حملات pixel flood attacks جلوگیری شود.", + "parent": "V5.2" + }, + { + "bom-ref": "V5.3", + "identifier": "V5.3", + "title": "File Storage", + "parent": "V5" + }, + { + "bom-ref": "V5.3.1", + "identifier": "V5.3.1", + "text": "فایل هایی که از ورودی های غیرمعتبر بارگذاری‌ یا تولید می شوند و در پوشه های عمومی قرار می گیرند، هنگام دسترسی مستقیم از طریق یک درخواست HTTP، به عنوان کداجرایی سمت سرور اجرا نشوند.", + "parent": "V5.3" + }, + { + "bom-ref": "V5.3.2", + "identifier": "V5.3.2", + "text": "هنگام ایجاد مسیرهای فایل برای عملیات مختلف، به جای استفاده از نام فایل‌های ارسال شده توسط کاربر، از داده‌های تولید شده داخلی یا منابع مورد اعتماد استفاده شود. و در صورتی که استفاده از نام فایل‌ها یا متادیتای ارسالی توسط کاربر ضروری باشد، می بایست validation و Sanitization اعمال شود. این کار برای جلوگیری از حملاتی مانند Path Traversal، Local or Remote File Inclusion(LFI, RFI) و Server-Side Request Forgery(SSRF) می‌باشد.", + "parent": "V5.3" + }, + { + "bom-ref": "V5.3.3", + "identifier": "V5.3.3", + "text": "پردازش فایل‌های سمت سرور، مانند استخراج فایل‌های فشرده، اطلاعات مسیر ارائه شده توسط کاربر را نادیده می‌گیرد تا از آسیب‌پذیری‌هایی مانند zip slip جلوگیری شود.", + "parent": "V5.3" + }, + { + "bom-ref": "V5.4", + "identifier": "V5.4", + "title": "File Download", + "parent": "V5" + }, + { + "bom-ref": "V5.4.1", + "identifier": "V5.4.1", + "text": "برنامه نام فایل ارسال‌شده توسط کاربر را چه در قالب JSON، JSONP یا پارامتر URL، اعتبارسنجی می‌کند یا نادیده می‌گیرد، و در پاسخ HTTP، نام فایل را به‌طور صریح در فیلد Content-Disposition هدر مشخص می‌نماید.", + "parent": "V5.4" + }, + { + "bom-ref": "V5.4.2", + "identifier": "V5.4.2", + "text": "نام‌های فایل‌های ارائه شده (مانند فیلدهای هدر پاسخ HTTP یا پیوست‌های ایمیل)، به‌درستی encoded یا sanitized شده‌اند (مطابق RFC 6266)، تا ساختار سند حفظ شده و از حملات تزریق جلوگیری شود.", + "parent": "V5.4" + }, + { + "bom-ref": "V5.4.3", + "identifier": "V5.4.3", + "text": "فایل‌های دریافت شده از منابع غیرقابل اعتماد توسط آنتی ویروس اسکن شود تا از ارائه محتوای مخرب شناخته‌شده جلوگیری شود.", + "parent": "V5.4" + }, + { + "bom-ref": "V6", + "identifier": "V6", + "title": "Authentication" + }, + { + "bom-ref": "V6.1", + "identifier": "V6.1", + "title": "Authentication Documentation", + "parent": "V6" + }, + { + "bom-ref": "V6.1.1", + "identifier": "V6.1.1", + "text": "مستندات برنامه، نحوه استفاده از کنترل هایی مانند محدودیت نرخ (Rate Limit)، مقابله با خودکارسازی (Anti-Automation) و پاسخ تطبیقی (Adaptive Response) را برای دفاع در برابر حملاتی مانند Credential Stuffing و حملات Password Brute Force به وضوح تعریف کرده باشد. مستندات باید به‌وضوح نحوه پیکربندی این کنترل‌ها را تشریح کرده و نشان دهند که چگونه از قفل شدن مخرب حساب‌های کاربری جلوگیری می‌شود.", + "parent": "V6.1" + }, + { + "bom-ref": "V6.1.2", + "identifier": "V6.1.2", + "text": "یک لیست از کلمات خاص مرتبط با زمینه سازمانی‌ (Context-Specific) مستندسازی شود تا از بکارگیری آنها در رمزهای عبور جلوگیری شد. این فهرست می‌تواند شامل نام سازمان، نام محصول، شناسه سامانه، نام کد پروژه، نام دپارتمان یا نقش های سازمانی و موارد مشابه باشد.", + "parent": "V6.1" + }, + { + "bom-ref": "V6.1.3", + "identifier": "V6.1.3", + "text": "در صورت وجود مسیرهای متعدد احراز هویت در برنامه کاربردی، تمامی این مسیرها به همراه کنترل‌های امنیتی و سطح قدرت احراز هویت مورد نیاز، مستندسازی شده‌اند. لازم است این کنترل‌ها به‌صورت یکسان و سازگار در تمامی مسیرهای احراز هویت اجرا شوند.", + "parent": "V6.1" + }, + { + "bom-ref": "V6.2", + "identifier": "V6.2", + "title": "Password Security", + "parent": "V6" + }, + { + "bom-ref": "V6.2.1", + "identifier": "V6.2.1", + "text": "کلمات عبور تنظیم شده توسط کاربر حداقل ۸ کاراکتر طول داشته باشد. هرچند حداقل ۱۵ کاراکتر به شدت توصیه می‌شود.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.2", + "identifier": "V6.2.2", + "text": "کاربران قادر به تغییر گذرواژه خود باشند.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.3", + "identifier": "V6.2.3", + "text": "هنگام تغییر کلمه عبور، گذرواژه فعلی و گذرواژه جدید توسط کاربر تکمیل شود.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.4", + "identifier": "V6.2.4", + "text": "کلمات عبوری که در حین ثبت‌نام حساب کاربری یا تغییر کلمه عبور ارسال می شوند با یک فهرست در دسترس از حداقل ۳۰۰۰ کلمه عبور رایج که ( با سیاست‌های کلمه عبور برنامه (مانند حداقل طول) سازگاری دارند) بررسی شوند.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.5", + "identifier": "V6.2.5", + "text": "کلمات عبور با هر ترکیبی قابل استفاده باشند، بدون اینکه قوانینی برای محدودکردن نوع کاراکترهای مجاز وجود داشته باشد. نباید هیچ‌گونه الزامی برای تعداد حداقل کاراکترهای حروف بزرگ یا کوچک، اعداد یا کاراکترهای خاص وجود داشته باشد.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.6", + "identifier": "V6.2.6", + "text": "فیلدهای ورودی کلمه عبور از نوع \"type=password\" استفاده می‌کنند تا ورودی‌ها پنهان شوند. برنامه‌ها می‌توانند به کاربر این امکان را بدهند که موقتاً کلمه عبور کامل یا آخرین کاراکتر تایپ شده را مشاهده کند.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.7", + "identifier": "V6.2.7", + "text": "عملکرد \"چسباندن\" (paste)، ابزارهای کمکی گذرواژه مرورگر و مدیریت‌کننده‌های گذرواژه خارجی مجاز باشند.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.8", + "identifier": "V6.2.8", + "text": "برنامه کلمه عبور کاربر را دقیقاً همانطور که از کاربر دریافت شده است، بدون هیچ گونه تغییراتی مانند کوتاه‌سازی(truncation) یا تبدیل حروف بزرگ و کوچک (case transformation)، بررسی کند.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.9", + "identifier": "V6.2.9", + "text": "استفاده از گذرواژه‌هایی با حداقل طول ۶۴ کاراکتر مجاز باشد.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.10", + "identifier": "V6.2.10", + "text": "کلمه عبور کاربر تا زمانی که مشخص شود که به خطر افتاده است یا کاربر آن را تغییر دهد، معتبر باقی بماند. برنامه نباید الزام به تغییر دوره‌ای گذرواژه‌ها را داشته باشد.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.11", + "identifier": "V6.2.11", + "text": "فهرست مستند شده ای از کلمات خاص مرتبط با زمینه‌ سازمانی برای جلوگیری از ایجاد کلمات عبور آسان قابل حدس، مورد استفاده قرار گیرد.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.2.12", + "identifier": "V6.2.12", + "text": "کلمات عبور وارد شده در حین ثبت‌نام حساب کاربری یا تغییر کلمه عبور با مجموعه‌ای از کلمات عبور افشا شده بررسی ‌شوند.", + "parent": "V6.2" + }, + { + "bom-ref": "V6.3", + "identifier": "V6.3", + "title": "General Authentication Security", + "parent": "V6" + }, + { + "bom-ref": "V6.3.1", + "identifier": "V6.3.1", + "text": "کنترل‌های لازم برای جلوگیری از حملاتی مانند Credential Stuffing و password brute force طبق مستندات امنیتی برنامه پیاده‌سازی شوند.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.2", + "identifier": "V6.3.2", + "text": "حساب‌های کاربری پیش‌فرض (مانند \"admin\"، \"root\" یا \"sa\") در برنامه وجود نداشته باشند یا غیرفعال شده باشند.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.3", + "identifier": "V6.3.3", + "text": "برای دسترسی به برنامه، از یک مکانیزم احراز هویت چندعاملی (MFA) یا ترکیبی از مکانیزم‌های احراز هویت تک‌عاملی استفاده شود. برای سطح L3، حداقل یکی از عوامل احراز هویت باید مبتنی بر سخت‌افزار باشد در برابر حملات فیشینگ، مقاومت در برابر نفوذ و جعل هویت را فراهم کند، در حالی که با اقدام آگاهانه کاربر (مانند فشردن دکمه روی کلید سخت‌افزاری FIDO یا تلفن همراه) قصد کاربر برای احراز هویت را نیز تأیید نماید. هرگونه تسهیل یا تعدیل در این الزام، مستلزم ارائه دلایل مستند و مجموعه‌ای جامع از کنترل‌های جبرانی است.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.4", + "identifier": "V6.3.4", + "text": "تأیید کنید که در صورت وجود مسیرهای متعدد احراز هویت در برنامه، هیچ مسیر احراز هویتِ مستندسازی‌نشده‌ای وجود نداشته باشد و کنترل‌های امنیتی و سطح قدرت احراز هویت در تمامی مسیرها به‌صورت یکسان و سازگار اعمال شوند.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.5", + "identifier": "V6.3.5", + "text": "کاربران از تلاش‌های مشکوک برای احراز هویت (موفق یا ناموفق) مطلع ‌شوند. این اطلاع‌رسانی می‌تواند شامل تلاش برای احراز هویت از موقعیت مکانی یا کلاینت غیرمعمول، احراز هویت ناقص (تنها موفقیت یکی از عوامل)، تلاش برای احراز هویت پس از یک دوره طولانی عدم فعالیت، یا احراز هویت موفق پس از چندین تلاش ناموفق باشد.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.6", + "identifier": "V6.3.6", + "text": "ایمیل به‌عنوان مکانیزم احراز هویت، چه به‌صورت تک‌عاملی و چه به‌عنوان یکی از عوامل احراز هویت چندعاملی، استفاده نمی‌شود.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.7", + "identifier": "V6.3.7", + "text": "کاربران پس از به‌روزرسانی اطلاعات احراز هویت خود، مانند بازنشانی گذرواژه یا تغییر نام کاربری یا آدرس ایمیل، مطلع شوند.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.3.8", + "identifier": "V6.3.8", + "text": "با توجه به پیام‌های خطا، کدهای پاسخ HTTP یا تفاوت در زمان پاسخ‌دهی، نتوان کاربران معتبر را از طریق تلاش‌های ناموفق احراز هویت شناسایی کرد. همچنین، عملکردهای ثبت‌نام و بازیابی گذرواژه نیز باید از این نوع افشای اطلاعات محافظت شده باشند.", + "parent": "V6.3" + }, + { + "bom-ref": "V6.4", + "identifier": "V6.4", + "title": "Authentication Factor Lifecycle and Recovery", + "parent": "V6" + }, + { + "bom-ref": "V6.4.1", + "identifier": "V6.4.1", + "text": "کلمه عبور اولیه یا کدهای فعال‌سازی تولید شده توسط سیستم، به‌صورت تصادفی و ایمن تولید ‌شوند، با سیاست فعلی رمز عبور مطابقت دارند، و پس از مدت زمان کوتاهی یا پس از اولین استفاده منقضی می‌شوند. این رمزهای اولیه نباید به عنوان رمز عبور بلندمدت مورد استفاده قرار گیرند.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.4.2", + "identifier": "V6.4.2", + "text": "راهنمای کلمه عبور یا احراز هویت مبتنی بر دانش (که به عنوان \"سؤالات امنیتی\" شناخته می‌شوند) در سیستم وجود ندارد.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.4.3", + "identifier": "V6.4.3", + "text": "فرآیند امنی برای بازنشانی کلمه عبور فراموش‌شده پیاده‌سازی شده است که هیچ‌یک از مکانیزم‌های احراز هویت چندعاملی فعال را دور نزند.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.4.4", + "identifier": "V6.4.4", + "text": "در صورت از دست رفتن یکی از عوامل احراز هویت چندعاملی، فرآیند اثبات هویت با همان سطحی که در زمان ثبت‌نام انجام شده است، اجرا شود.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.4.5", + "identifier": "V6.4.5", + "text": "دستورالعمل‌های تمدید مکانیزم‌های احراز هویت دارای تاریخ انقضا برای کاربران به موقع ارسال می‌شود تا پیش از انقضای مکانیزم فعلی فرصت کافی برای تمدید وجود داشته باشد، و در صورت لزوم، یادآورهای خودکار نیز تنظیم و ارسال شده باشند.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.4.6", + "identifier": "V6.4.6", + "text": "کاربران ادمین می‌توانند فرآیند بازنشانی کلمه عبور را برای کاربران عادی آغاز کنند، اما اجازه تغییر مستقیم یا انتخاب رمز عبور برای کاربر را ندارند. این کنترل برای جلوگیری از دسترسی ادمین به رمز عبور کاربران طراحی شده است.", + "parent": "V6.4" + }, + { + "bom-ref": "V6.5", + "identifier": "V6.5", + "title": "General Multi-factor authentication requirements", + "parent": "V6" + }, + { + "bom-ref": "V6.5.1", + "identifier": "V6.5.1", + "text": "Lookup Secrets درخواست‌ها یا کدهای احراز هویت خارج از باند (Out-of-Band) و رمزهای یکبار مصرف مبتنی بر زمان (TOTP) تنها یک‌بار قابل استفاده باشند و پس از استفاده موفق، مجدداً قابل استفاده نباشند.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.2", + "identifier": "V6.5.2", + "text": "در صورت ذخیره‌سازی Lookup Secrets در سمت Backend برنامه، اگر مقدار آنتروپی کمتر از ۱۱۲ بیت باشند (معادل ۱۹ کاراکتر تصادفی الفبایی-عددی یا ۳۴ رقم تصادفی)، باید با یک الگوریتم تایید شده برای ذخیره رمز عبور و با استفاده از یک Salt تصادفی ۳۲ بیتی هش شوند. در صورتی که آنتروپی کد ۱۱۲ بیت یا بیشتر باشد، می‌توان از یک تابع هش استاندارد برای ذخیره سازی استفاده کرد.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.3", + "identifier": "V6.5.3", + "text": "Lookup Secrets کدهای احراز هویت خارج از باند (out of band) و تولید رمزهای یکبار مصرف مبتنی بر زمان(TOTP) همگی با استفاده از یک تولیدکننده عدد شبه تصادفی ‌رمزنگاری‌شده (CSPRNG) تولید شده باشند تا از تولید مقادیر قابل پیش‌بینی جلوگیری شود.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.4", + "identifier": "V6.5.4", + "text": "Lookup Secrets و کدهای احراز هویت خارج از باند (out of band) حداقل دارای ۲۰ بیت آنتروپی باشند (معمولاً ۴ کاراکتر تصادفی الفبایی-عددی یا ۶ رقم تصادفی برای رسیدن به این میزان آنتروپی کافی است).", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.5", + "identifier": "V6.5.5", + "text": "درخواست‌ها، کدها یا توکن‌های احراز هویت خارج از باند (Out-of-Band) و همچنین رمزهای عبور یک‌بار مصرف مبتنی بر زمان (TOTP) دارای طول عمر مشخص باشند. حداکثر طول عمر برای درخواست‌های خارج از باند باید ۱۰ دقیقه و برای TOTP حداکثر ۳۰ ثانیه باشد.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.6", + "identifier": "V6.5.6", + "text": "امکان لغو (Revoke) هر عامل احراز هویت، از جمله دستگاه‌های فیزیکی، در صورت سرقت یا مفقود شدن وجود داشته باشد.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.7", + "identifier": "V6.5.7", + "text": "مکانیزم‌های احراز هویت بیومتریک فقط به‌عنوان عامل دوم و در کنار یکی از عوامل «چیزی که در اختیار دارید» یا «چیزی که کاربر می داند» مورد استفاده قرار می‌گیرند.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.5.8", + "identifier": "V6.5.8", + "text": "اعتبارسنجی رمزهای یک‌بار مصرف مبتنی بر زمان (TOTP) بر اساس منبع زمانی از یک سرویس قابل اعتماد انجام می‌شود و نه بر اساس زمان ارائه‌شده توسط کلاینت یا منابع غیرقابل اعتماد.", + "parent": "V6.5" + }, + { + "bom-ref": "V6.6", + "identifier": "V6.6", + "title": "Out-of-Band authentication mechanisms", + "parent": "V6" + }, + { + "bom-ref": "V6.6.1", + "identifier": "V6.6.1", + "text": "مکانیزم‌های احراز هویت مبتنی بر شبکه تلفن عمومی (PSTN) برای ارسال رمزهای یک‌بار مصرف (OTP) از طریق تماس تلفنی یا پیامک تنها در صورتی که شماره تلفن قبلا اعتبارسنجی شده باشد، یا روش‌های جایگزین قوی‌تر (رمزهای عبور یکبار مصرف مبتنی بر زمان) در دسترس باشند ارائه می‌شوند و سرویس‌دهنده باید کاربران را از ریسک‌های امنیتی این روش‌ها مطلع سازد. برای اپلیکیشن‌های سطح L3، استفاده از تماس تلفنی و پیامک به‌عنوان گزینه، مجاز نیست.", + "parent": "V6.6" + }, + { + "bom-ref": "V6.6.2", + "identifier": "V6.6.2", + "text": "درخواست‌ها، کدها یا توکن‌های احراز هویت خارج از باند (Out-of-Band) به درخواست احراز هویت اصلی که برای آن تولید شده‌اند متصل باشند و قابل استفاده برای درخواست‌های قبلی یا بعدی نباشند.", + "parent": "V6.6" + }, + { + "bom-ref": "V6.6.3", + "identifier": "V6.6.3", + "text": "مکانیزم‌های احراز هویت خارج از باند (Out-of-Band) مبتنی بر کد، در برابر حملات brute force از طریق اعمال کنترل محدودیت نرخ (Rate Limiting) محافظت شوند. همچنین، استفاده از کدی با حداقل ۶۴ بیت آنتروپی (Entropy)مدنظر قرار گیرد.", + "parent": "V6.6" + }, + { + "bom-ref": "V6.6.4", + "identifier": "V6.6.4", + "text": "در صورت استفاده از Push Notifications جهت احراز هویت چند عاملی، محدودیت نرخ (Rate Limiting) به منظور جلوگیری از حملات Push Bombing اعمال شده باشد. استفاده از تطبیق عدد Matching) Number) نیز می‌تواند به کاهش این ریسک کمک کند.", + "parent": "V6.6" + }, + { + "bom-ref": "V6.7", + "identifier": "V6.7", + "title": "Cryptographic authentication mechanism", + "parent": "V6" + }, + { + "bom-ref": "V6.7.1", + "identifier": "V6.7.1", + "text": "گواهینامه‌های مورد استفاده برای تأیید ادعاهای احراز هویت رمزنگاری‌شده به گونه‌ای ذخیره شوند که از تغییر یا دستکاری آن‌ها محافظت شود.", + "parent": "V6.7" + }, + { + "bom-ref": "V6.7.2", + "identifier": "V6.7.2", + "text": "مقدار چالش (Challenge Nonce) حداقل ۶۴ بیت طول داشته باشد و از نظر آماری یکتا باشد یا حداقل در طول عمر دستگاه رمزنگاری منحصر به فرد باقی بماند.", + "parent": "V6.7" + }, + { + "bom-ref": "V6.8", + "identifier": "V6.8", + "title": "Authentication with an Identity Provider", + "parent": "V6" + }, + { + "bom-ref": "V6.8.1", + "identifier": "V6.8.1", + "text": "اگر برنامه از چند ارائه‌دهنده هویت (IdP) پشتیبانی می‌کند، امکان جعل هویت کاربر از طریق یک ارائه‌دهنده هویت دیگر وجود نداشته باشد (برای مثال، با استفاده از شناسه کاربری یکسان). مکانیسم استاندارد برای جلوگیری از این تهدید، این است که برنامه، کاربران را با استفاده از ترکیب شناسه IdP (به‌عنوان فضای نام یا (namespace و شناسه کاربر در آن، IdP ثبت و شناسایی کند.", + "parent": "V6.8" + }, + { + "bom-ref": "V6.8.2", + "identifier": "V6.8.2", + "text": "وجود و یکپارچگی امضاهای دیجیتال بر روی تصدیق‌های (تقاضاها یا ادعاهای) احراز هویت برای مثال بر روی (توکن‌های JWT یا SAML assertions) همواره اعتبارسنجی می‌شود و هرگونه تصدیقی که فاقد امضا یا دارای امضای نامعتبر باشد، رد می‌گردد.", + "parent": "V6.8" + }, + { + "bom-ref": "V6.8.3", + "identifier": "V6.8.3", + "text": "(تقاضاها یا ادعاهای) تصدیق‌های SAML به‌صورت منحصربه‌فرد پردازش شده و تنها یک‌بار در بازه‌ی اعتبار خود استفاده می‌شوند تا از حملات بازپخش (Replay Attacks) جلوگیری گردد.", + "parent": "V6.8" + }, + { + "bom-ref": "V6.8.4", + "identifier": "V6.8.4", + "text": "اگر برنامه‌ای از یک ارائه‌دهنده هویت (IdP) جداگانه استفاده می‌کند و انتظار قدرت، روش‌ها یا تازگی احراز هویت خاصی را برای عملکردهای خاص دارد، برنامه این موضوع را با استفاده از اطلاعات برگردانده شده توسط IdP تأیید می‌کند. به عنوان مثال، اگر از OIDC استفاده شود، این کار می‌تواند با اعتبارسنجی ادعاهای (Claims) موجود در توکن شناسایی (ID Token) مانند «amr»، «acr» و «auth_time» (در صورت وجود) انجام شود. اگر ارائه‌دهنده هویت این اطلاعات را ارائه نکند، برنامه باید یک روش جایگزین مستندسازی‌شده داشته باشد که فرض می‌کند حداقل سطح احراز هویت استفاده شده است (مثلاً احراز هویت تک‌عاملی با نام کاربری و گذرواژه).", + "parent": "V6.8" + }, + { + "bom-ref": "V7", + "identifier": "V7", + "title": "Session Management" + }, + { + "bom-ref": "V7.1", + "identifier": "V7.1", + "title": "Session Management Documentation", + "parent": "V7" + }, + { + "bom-ref": "V7.1.1", + "identifier": "V7.1.1", + "text": "بازه عدم فعالیت نشست کاربر و بیشینه طول عمر نشست قبل از احراز هویت مجدد، در ترکیب با سایر کنترل‌ها مستند و متناسب سازی شود. مستند سازی انجام شده باید شامل توجیه برای هر انحراف(نقض) از الزامات احراز هویت مجدد NIST SP 800-63B باشد.", + "parent": "V7.1" + }, + { + "bom-ref": "V7.1.2", + "identifier": "V7.1.2", + "text": "در مستند باید تعداد نشست همزمان مجاز برای یک کاربر و همچنین رفتار و اعمال مناسب برای زمانی که این تعداد به حداکثر رسید مشخص شود.", + "parent": "V7.1" + }, + { + "bom-ref": "V7.1.3", + "identifier": "V7.1.3", + "text": "تمام سیستم‌هایی که نشست‌های کاربر را به عنوان بخشی از یک اکوسیستم مدیریت هویت فدرال(مانند سیستم‌های (SSO ایجاد و مدیریت می‌کنند، باید در کنار سایر کنترل‌های مربوط به طول عمر نشست‌ها، خاتمه آن‌ها و هرگونه شرایط دیگری که نیاز به احراز هویت مجدد دارد، مستند شوند.", + "parent": "V7.1" + }, + { + "bom-ref": "V7.2", + "identifier": "V7.2", + "title": "Fundamental Session Management Security", + "parent": "V7" + }, + { + "bom-ref": "V7.2.1", + "identifier": "V7.2.1", + "text": "برنامه کاربردی باید تمام بررسی‌های توکن نشست‌ را با استفاده از یک سرویس backend مطمئن انجام دهد.", + "parent": "V7.2" + }, + { + "bom-ref": "V7.2.2", + "identifier": "V7.2.2", + "text": "برنامه کاربردی که از هر یک از توکن‌های Self-Contained یا reference که به صورت پویا برای مدیریت نشست تولید شده‌اند استفاده کند اما از از کلیدهای API ثابت و کلید‌ها استفاده نکند.", + "parent": "V7.2" + }, + { + "bom-ref": "V7.2.3", + "identifier": "V7.2.3", + "text": "در صورتی که برای نمایش نشست کاربر از توکن‌های reference استفاده می شود، این توکن‌ها منحصر به فرد بوده و با استفاده از یک تولید کننده عدد شبه تصادفی امن رمزنگاری(CSPRNG) که دارای انتروپی حداقل128 بیتی است تولید شوند.", + "parent": "V7.2" + }, + { + "bom-ref": "V7.2.4", + "identifier": "V7.2.4", + "text": "برنامه کاربردی در هنگام احراز هویت کاربر یک توکن نشست جدید تولید نماید که شامل احراز هویت مجدد و ابطال توکن نشست کنونی است.", + "parent": "V7.2" + }, + { + "bom-ref": "V7.3", + "identifier": "V7.3", + "title": "Session Timeout", + "parent": "V7" + }, + { + "bom-ref": "V7.3.1", + "identifier": "V7.3.1", + "text": "بر اساس تحلیل ریسک و تصمیمات امنیتی مستند شده، پس از گذشت مهلت زمانی عدم فعالیت، کاربر مجبور به احراز هویت مجدد گردد.", + "parent": "V7.3" + }, + { + "bom-ref": "V7.3.2", + "identifier": "V7.3.2", + "text": "بر اساس تحلیل ریسک و تصمیمات امنیتی مستند شده، پس از گذشت بیشینه زمان مطلق طول عمر، کاربر مجبور به احراز هویت مجدد گردد.", + "parent": "V7.3" + }, + { + "bom-ref": "V7.4", + "identifier": "V7.4", + "title": "Session Termination", + "parent": "V7" + }, + { + "bom-ref": "V7.4.1", + "identifier": "V7.4.1", + "text": "در مواقعی که فرآیند خاتمه نشست کاربر فعال می‌شود (مانند خروج کاربر یا انقضای نشست)، برنامه اجازه هیچ فعالیتی را به آن نشست نمی‌دهد. برای Reference tokens یا stateful session، این به معنی نامعتبرسازی اطلاعات نشست در برنامه Backend می‌باشد. برنامه‌هایی که از توکن‌های Self-contained استفاده می‌کنند نیاز به راه حل‌هایی نظیر نگهداری فهرستی از توکن‌های خاتمه‌یافته، عدم پذیرش توکن‌هایی که پیش از یک تاریخ و زمان مشخص برای هر کاربر تولید شده‌اند، یا چرخش کلید امضای مخصوص هر کاربر دارند.", + "parent": "V7.4" + }, + { + "bom-ref": "V7.4.2", + "identifier": "V7.4.2", + "text": "برنامه کاربردی تمامی نشست‌های فعال را در زمانی که حساب کاربری غیرفعال یا حذف می‌شود را ابطال نماید. (مانند کارمندی که شرکت را ترک می‌کند)", + "parent": "V7.4" + }, + { + "bom-ref": "V7.4.3", + "identifier": "V7.4.3", + "text": "برنامه کاربردی قابلیت ارائه گزینه ابطال تمامی نشست های فعال دیگر را پس از یک تغییر موفقیت آمیز یا حذف هریک از عوامل احراز هویت (نظیر تغییر پسورد از طریق ریست یا بازنشانی و در صورت وجود به روزرسانی تنظیمات MFA ) را داشته باشد.", + "parent": "V7.4" + }, + { + "bom-ref": "V7.4.4", + "identifier": "V7.4.4", + "text": "تمامی صفحاتی که نیازمند احراز هویت هستند دارای دسترسی آسان و مشخص به فرآیند خروج باشند.", + "parent": "V7.4" + }, + { + "bom-ref": "V7.4.5", + "identifier": "V7.4.5", + "text": "مدیران برنامه کاربردی قادر به ابطال نشست‌های فعال برای یک شخص یا تمامی کاربران باشند.", + "parent": "V7.4" + }, + { + "bom-ref": "V7.5", + "identifier": "V7.5", + "title": "Defenses Against Session Abuse", + "parent": "V7" + }, + { + "bom-ref": "V7.5.1", + "identifier": "V7.5.1", + "text": "برنامه کاربردی قبل از اعطای مجوز تغییر ویژگی‌های حساس حساب کاربری که بر روی احراز هویت تاثیر دارد نظیر آدرس ایمیل، شماره تلفن، تنظیمات MFA یا اطلاعات دیگر که در بازگردانی حساب کاربری مورد استفاده قرار می‌گیرند، به احراز هویت مجدد کامل نیاز دارد.", + "parent": "V7.5" + }, + { + "bom-ref": "V7.5.2", + "identifier": "V7.5.2", + "text": "حساب‌های کاربری قادر به دیدن(پس از احراز هویت مجدد با حداقل یک عامل) و ابطال یک یا همه نشست‌های فعال باشد.", + "parent": "V7.5" + }, + { + "bom-ref": "V7.5.3", + "identifier": "V7.5.3", + "text": "برنامه کاربردی قبل از اجرای تراکنش‌ها یا عملیات‌های حساس نیازمند احراز هویت مجدد با حداقل یک عامل یا صحت سنجی ثانویه باشد.", + "parent": "V7.5" + }, + { + "bom-ref": "V7.6", + "identifier": "V7.6", + "title": "Federated Re-authentication", + "parent": "V7" + }, + { + "bom-ref": "V7.6.1", + "identifier": "V7.6.1", + "text": "طول عمر و ابطال نشست بین RP و idp طبق سند- که نیازمند احرازهویت مجدد در زمان مورد نیاز مانند وقتی که بیشینه زمان بین رخداد احراز هویت idp رسیده باشد- انجام شود.", + "parent": "V7.6" + }, + { + "bom-ref": "V7.6.2", + "identifier": "V7.6.2", + "text": "ساخت نشست‌ها نیاز به رضایت کاربر یا یک اقدام صریح دارد که بدین صورت از ایجاد نشست‌های جدید برنامه بدون تعامل کاربر جلوگیری می‌شود.", + "parent": "V7.6" + }, + { + "bom-ref": "V8", + "identifier": "V8", + "title": "Authorization" + }, + { + "bom-ref": "V8.1", + "identifier": "V8.1", + "title": "Authorization Documentation", + "parent": "V8" + }, + { + "bom-ref": "V8.1.1", + "identifier": "V8.1.1", + "text": "مستند اعطای مجوز باید شامل قوانینی به منظور محدودسازی دسترسی در سطح عملکرد و دسترسی مبتنی بر داده بر اساس مجوزهای کاربران و ویژگی‌های منابع باشد.", + "parent": "V8.1" + }, + { + "bom-ref": "V8.1.2", + "identifier": "V8.1.2", + "text": "مستند اعطای مجوز باید قوانینی را برای محدودیت‌های دسترسی در سطح Field بر اساس مجوزهای کاربران و ویژگی‌های منابع تعریف نماید(هر دو دسترسی خواندن و نوشتن). توجه داشته باشید که این قوانین ممکن است به مقادیر دیگر ویژگی‌های شیء داده ی مربوطه (Relevant Data Object) بستگی داشته باشند، مانند حالت (state) یا وضعیت (status).", + "parent": "V8.1" + }, + { + "bom-ref": "V8.1.3", + "identifier": "V8.1.3", + "text": "مستند برنامه کاربردی باید ویژگی‌های محیطی و زمینه‌ای (شامل و نه محدود به زمان روز، مکان، آدرس IP یا دستگاه) که در برنامه کاربردی به منظور اتخاذ تصمیمات امنیتی (نظیر آن دسته از تصمیماتی که مربوط به احراز هویت و اعطای مجوز می باشد) را مشخص کند.", + "parent": "V8.1" + }, + { + "bom-ref": "V8.1.4", + "identifier": "V8.1.4", + "text": "مستندات احراز هویت و اعطای مجوز، علاوه بر اعطای مجوز در سطح Field، سطح عملکرد و داده‌های خاص، چگونگی استفاده از عوامل محیطی و زمینه‌ای در اتخاذ تصمیمات را مشخص نماید.", + "parent": "V8.1" + }, + { + "bom-ref": "V8.2", + "identifier": "V8.2", + "title": "General Authorization Design", + "parent": "V8" + }, + { + "bom-ref": "V8.2.1", + "identifier": "V8.2.1", + "text": "برنامه کاربردی باید از محدود بودن دسترسی‌‌های در سطح عملکرد به مشتریانی که دارای دسترسی صریح هستند اطمینان حاصل نماید.", + "parent": "V8.2" + }, + { + "bom-ref": "V8.2.2", + "identifier": "V8.2.2", + "text": "برنامه کاربردی باید از محدود بودن دسترسی‌‌های در سطح داده به مشتریانی که دارای دسترسی صریح به اقلام داده‌ای خاص هستند اطمینان حاصل نماید تا از این طریق خطر آسیب پذیری IDOR و broken object level authorization را کاهش دهد .", + "parent": "V8.2" + }, + { + "bom-ref": "V8.2.3", + "identifier": "V8.2.3", + "text": "برنامه کاربردی دسترسی در سطح Field را با مجوزهای صریح به Field ها برای مصرف کنندگان جهت کاهش خطر broken object property level authorization (BOPLA) محدود کرده باشد.", + "parent": "V8.2" + }, + { + "bom-ref": "V8.2.4", + "identifier": "V8.2.4", + "text": "کنترل‌های امنیتی تطبیقی که بر اساس ویژگی‌های محیطی و زمینه‌ای کاربر (مانند زمان روز، مکان، آدرس IP یا دستگاه) هستند، برای تصمیم‌گیری‌های احراز هویت (Authentication) و مجوزدهی (Authorization) طبق مستندات برنامه پیاده‌سازی شده‌اند. این کنترل‌ها باید هم در زمان تلاش کاربر برای شروع یک نشست (Session) جدید و هم در طول یک نشست فعال، اعمال شوند.", + "parent": "V8.2" + }, + { + "bom-ref": "V8.3", + "identifier": "V8.3", + "title": "Operation Level Authorization", + "parent": "V8" + }, + { + "bom-ref": "V8.3.1", + "identifier": "V8.3.1", + "text": "برنامه کاربردی قوانین مجوزدهی را در یک لایه سرویس معتبر اعمال نموده و بر آن دسته از کنترل‌هایی که مصرف کنندگان نامعتبر قادر به دستکاری آن‌ها هستند متکی نباشد. (نظیر جاوا اسکریپت سمت کاربر)", + "parent": "V8.3" + }, + { + "bom-ref": "V8.3.2", + "identifier": "V8.3.2", + "text": "در مواقعی که امکان اعمال فوری تغییرات وجود ندارد (مثلاً وقتی که سیستم برای تصمیم‌گیری در مجوزدهی از توکن‌های Self-Contained مثل JWT استفاده می‌کند که اطلاعات را داخل خود ذخیره کرده و تا زمان انقضا تغییر نمی‌کنند)، باید کنترل‌های جبرانی وجود داشته باشد. این کنترل‌ها باید بتوانند زمانی که کاربر عملی را انجام می‌دهد که دیگر مجاز به آن نیست، هشدار بدهند و تغییر را برگردانند. با این حال، توجه کنید که این راهکار جایگزین نمی‌تواند جلوی نشت اطلاعات را بگیرد.", + "parent": "V8.3" + }, + { + "bom-ref": "V8.3.3", + "identifier": "V8.3.3", + "text": "دسترسی به یک object بر اساس مجوزهای کاربری شخص درخواست کننده(مثال: مصرف کننده) باشد نه بر اساس مجوز‌های یک واسطه یا سرویسی که به نمایندگی از او عمل می‌کند. بطور مثال، در صورتی که یک مصرف کننده یک وب سرویس را با استفاده از یک توکن self-contained برای احراز هویت فراخوانی می‌کند و سپس آن سرویس اطلاعات را از یک سرویس دیگر درخواست می‌کند، سرویس دوم باید همان توکن مصرف کننده را استفاده کند، نه یک توکن سرویس-به-سرویس (Machine-to-Machine token) که متعلق به سرویس اول است، تا تصمیمات مجوزدهی دقیقاً بر اساس مجوزهای کاربر گرفته شوند.", + "parent": "V8.3" + }, + { + "bom-ref": "V8.4", + "identifier": "V8.4", + "title": "Other Authorization Considerations", + "parent": "V8" + }, + { + "bom-ref": "V8.4.1", + "identifier": "V8.4.1", + "text": "برنامه های کاربردی چند کاربره(multi tenants) از کنترل های cross-tenant به منظور تضمین این امر که عملیات‌های مصرف کنندگان هرگز کاربرانی (tenants) را که مجوز تعامل با آنها را ندارند را تحت تأثیر قرار نمی‌دهد.", + "parent": "V8.4" + }, + { + "bom-ref": "V8.4.2", + "identifier": "V8.4.2", + "text": "دسترسی به درگاه‌های پیکربندی شامل چندین لایه امنیتی از قبیل تأیید مداوم هویت مصرف‌کننده، ارزیابی وضعیت امنیتی دستگاه و تحلیل ریسک زمینه‌ای باشد تا از این طریق اطمینان حاصل شود که موقعیت شبکه‌ای یا نقاط پایانی معتبر تنها عوامل برای مجوزدهی نیستند اگر چه که این عوامل احتمال دسترسی غیرمجاز را کاهش می‌دهند.", + "parent": "V8.4" + }, + { + "bom-ref": "V9", + "identifier": "V9", + "title": "Self-contained Tokens" + }, + { + "bom-ref": "V9.1", + "identifier": "V9.1", + "title": "Token source and integrity", + "parent": "V9" + }, + { + "bom-ref": "V9.1.1", + "identifier": "V9.1.1", + "text": "قبل از پذیرش محتوای توکن‌ها، آن‌ها را با استفاده از امضای دیجیتال یا MAC به منظور حفاظت در مقابل دستکاری‌ها مورد اعتبارسنجی قرار داده شود.", + "parent": "V9.1" + }, + { + "bom-ref": "V9.1.2", + "identifier": "V9.1.2", + "text": "فقط الگوریتم‌های موجود در لیست مجاز قادر به استفاده در ساخت و صحت سنجی توکن‌های self-contained در یک زمینه مشخص باشند. این لیست مجاز باید در حالت ایده آل شامل هم الگوریتم‌های متقارن و هم نامتقارن‌ها باشد و نباید شامل الگوریتم‌های NONE باشد. در صورتی که هر دو الگوریتم‌های متقارن و نانتقارن مورد نیاز باشند کنترل‌های بیشتری باید به منظور جلوگیری از سردرگمی کلید‌ها(key Confusion) بکار گرفته شود.", + "parent": "V9.1" + }, + { + "bom-ref": "V9.1.3", + "identifier": "V9.1.3", + "text": "به منظور جلوگیری از مشخص نمودن منابع غیر مطمئن و کلید‌ها توسط مهاجمین، موارد کلیدی که در اعتبارسنجی توکن‌های self-contained مورد استفاده قرار می‌گیرند، از منابع از پیش پیکربندی شده مطمئنی که برای صادر کننده توکن است تعیین شود. برای JWTs و سایر ساختارهای JWS ، هدرهایی نظیر ‘jku’, ‘x5u’ و ‘jwk’ باید با یک لیست مجاز از منابع مطمئن مورد اعتبارسنجی قرار گیرند.", + "parent": "V9.1" + }, + { + "bom-ref": "V9.2", + "identifier": "V9.2", + "title": "Token content", + "parent": "V9" + }, + { + "bom-ref": "V9.2.1", + "identifier": "V9.2.1", + "text": "اگر یک بازه زمانی معتبر در داده‌های توکن وجود داشته باشد، توکن و محتوای آن تنها در صورتی پذیرفته می‌شوند که زمان بررسی در این بازه زمانی معتبر باشد. به عنوان مثال، برای JWTها، ادعاهای 'nbf' و 'exp' باید تایید شوند.", + "parent": "V9.2" + }, + { + "bom-ref": "V9.2.2", + "identifier": "V9.2.2", + "text": "سرویسی که یک توکن دریافت می‌کند قبل از پذیرش محتوای آن، از لحاظ درستی نوع بررسی نموده و برای هدف مشخص شده در نظر گیرد. بطور مثال، فقط توکن‌های access می‌توانند به منظور تصمیمات مجوزی و فقط توکن های ID می‌توانند به منظور اثبات هویت کاربر مورد پذیرش قرار گیرند.", + "parent": "V9.2" + }, + { + "bom-ref": "V9.2.3", + "identifier": "V9.2.3", + "text": "یک سرویس فقط توکن‌هایی را بپذیرد که به منظور استفاده توسط آن سرویس هستند(audience).برای JWT ها،این امر می‌تواند از طریق اعتبارسنجی ادعای 'aud' با یک لیست مجاز تعریف شده در سرویس صورت پذیرد.", + "parent": "V9.2" + }, + { + "bom-ref": "V9.2.4", + "identifier": "V9.2.4", + "text": "اگر صادر کننده توکن از کلید خصوصی مشابهی برای audienceهای متفاوت استفاده می‌کند، توکن‌های تولید شده دارای محدودیت مخاطبی باشند که بطور منحصر به فردی مخاطبین مورد نظر را مشخص می‌کند. این امر از استفاده مجدد توکن توسط مخاطب ناخواسته جلوگیری می‌کند. در صورتی که شناسه مخاطب به صورت پویا مشخص شده باشد، صادرکننده توکن باید این مخاطبین را به منظور اطمینان از عدم جعل هویت مخاطب مورد اعتبارسنجی قرار دهد.", + "parent": "V9.2" + }, + { + "bom-ref": "V10", + "identifier": "V10", + "title": "OAuth and OIDC" + }, + { + "bom-ref": "V10.1", + "identifier": "V10.1", + "title": "Generic OAuth and OIDC Security", + "parent": "V10" + }, + { + "bom-ref": "V10.1.1", + "identifier": "V10.1.1", + "text": "توکن‌ها باید فقط به مؤلفه‌هایی ارسال شوند که به‌طور دقیق به آن‌ها نیاز دارند. برای مثال، هنگام استفاده از الگوی Backend-for-Frontend برای برنامه‌های JavaScript مبتنی بر مرورگر، Access Tokens و Refresh Tokens باید فقط برای Backend قابل دسترس باشند.", + "parent": "V10.1" + }, + { + "bom-ref": "V10.1.2", + "identifier": "V10.1.2", + "text": "Client باید فقط مقادیری را از Authorization Server بپذیرد (مانند Authorization Code یاID Token ) که این مقادیر حاصل از یک Authorization Flow باشند که توسط همان نشست (Session) و تراکنش User Agent آغاز شده است. این موضوع مستلزم آن است که Secretهای تولیدشده توسط کلاینت مانند code_verifier در PKCE، یا مقادیر state و nonce در OIDC قابل حدس زدن نباشند، مخصوص همان تراکنش باشند، و به‌صورت امن هم به کلاینت و هم به نشست (Session) مرورگری که تراکنش در آن شروع شده، متصل شده باشند.", + "parent": "V10.1" + }, + { + "bom-ref": "V10.2", + "identifier": "V10.2", + "title": "OAuth Client", + "parent": "V10" + }, + { + "bom-ref": "V10.2.1", + "identifier": "V10.2.1", + "text": "درCode Flow، باید OAuth Client در برابر حملاتBrowser-based Request Forgery که معمولاً با عنوان Cross-Site Request Forgery (CSRF) شناخته می‌شوند و درخواست‌های توکن را ایجاد می‌کنند، محافظت داشته باشد. این محافظت باید با استفاده از قابلیت PKCE یا با بررسی پارامترstate که در درخواست احراز مجوز ارسال شده است.", + "parent": "V10.2" + }, + { + "bom-ref": "V10.2.2", + "identifier": "V10.2.2", + "text": "اگر OAuth Client بتواند با بیش از یک Authorization Server تعامل داشته باشد، باید دارای سازوکاری برای دفاع در برابر Mix-up Attacks باشد. برای مثال، می‌تواند الزام کند که Authorization Server مقدار پارامتر ‘iss’ را برگرداند و این مقدار هم درAuthorization Response و هم درToken Response اعتبارسنجی شود.", + "parent": "V10.2" + }, + { + "bom-ref": "V10.2.3", + "identifier": "V10.2.3", + "text": "OAuth Client باید فقطScopes (یا سایر پارامترهای مجوزدهی) مورد نیاز را در درخواست‌ها به Authorization Server درخواست کند.", + "parent": "V10.2" + }, + { + "bom-ref": "V10.3", + "identifier": "V10.3", + "title": "OAuth Resource Server", + "parent": "V10" + }, + { + "bom-ref": "V10.3.1", + "identifier": "V10.3.1", + "text": "Resource Server باید فقط Access Tokenهایی را بپذیرد که برای استفاده با همان سرویس در نظر گرفته شده‌اند(Audience). Audience می‌تواند در یک Access Token ساختاریافته (مانند مقدار aud در JWT) درج شده باشد، یا از طریق Token Introspection Endpoint بررسی شود.", + "parent": "V10.3" + }, + { + "bom-ref": "V10.3.2", + "identifier": "V10.3.2", + "text": "Resource Server باید تصمیمات مجوزدهی (Authorization Decisions) را بر اساس Claims موجود در Access Token که واگذاری مجوز (Delegated Authorization) را تعریف می‌کنند، اعمال کند. اگر Claimsهایی مانند sub، scope و authorization_details موجود باشند، باید جزو فرآیند تصمیم‌گیری قرار گیرند.", + "parent": "V10.3" + }, + { + "bom-ref": "V10.3.3", + "identifier": "V10.3.3", + "text": "اگر برای گرفتن یک تصمیم کنترل دسترسی، لازم است یک کاربرِ یکتا از داخل Access Token (چه JWT و چه پاسخ Token Introspection ) شناسایی شود، سرور منبع (Resource Server) کاربر را از روی Claimهایی شناسایی کند که قابل اختصاص‌دادن به کاربران دیگر نیستند. معمولاً این یعنی استفاده از ترکیب دو Claim یعنی 'iss' (صادرکننده توکن) و 'sub' (شناسه یکتای کاربر)", + "parent": "V10.3" + }, + { + "bom-ref": "V10.3.4", + "identifier": "V10.3.4", + "text": "اگر Resource Server نیازمند قدرت، روش یا تازگی خاص احراز هویت باشد، بررسی کند که Access Token ارائه‌شده این محدودیت‌ها را برآورده می‌کند. برای مثال، در صورت وجود، از Claimsهای OIDC مانند acr، amr و auth_time به ترتیب استفاده شود.", + "parent": "V10.3" + }, + { + "bom-ref": "V10.3.5", + "identifier": "V10.3.5", + "text": "تأیید کنید که Resource Server از استفاده از Access Tokenهای سرقت‌شده یا Replay توکن‌ها (توسط افراد غیرمجاز) جلوگیری کند، با الزام استفاده از Sender-Constrained Access Tokens، مانند Mutual TLS برای OAuth 2 یا OAuth2 Demonstration of Proof of Possession (DPoP).", + "parent": "V10.3" + }, + { + "bom-ref": "V10.4", + "identifier": "V10.4", + "title": "OAuth Authorization Server", + "parent": "V10" + }, + { + "bom-ref": "V10.4.1", + "identifier": "V10.4.1", + "text": "سرور احراز هویت باید آدرس‌های بازگشتی (Redirect URI) را بر اساس فهرست مجاز (Allowlist) از URIهای از پیش‌ثبت‌شده و مخصوص هر کلاینت، با استفاده از مقایسه دقیقِ رشته‌ای Comparison) (Exact String اعتبارسنجی می‌کند.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.2", + "identifier": "V10.4.2", + "text": "اگر Authorization Server کد احراز مجوز (Authorization Code) را در Authorization Response برمی‌گرداند، این کد فقط یک‌بار برای درخواست توکن باید قابل استفاده باشد. برای دومین درخواست معتبر با یک Authorization Code که قبلاً برای صدور Access Token استفاده شده است، Authorization Server باید درخواست توکن را رد کند و هر توکن صادرشده‌ی مرتبط با آن Authorization Code را باطل نماید.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.3", + "identifier": "V10.4.3", + "text": "تأیید کنید که Authorization Code دارای مدت زمان معتبر بودن محدود باشد. حداکثر طول عمر می‌تواند برای برنامه‌های کاربردی در سطوح L1 و L2 تا ۱۰ دقیقه و برای برنامه‌های کاربردی در سطح L3 تا ۱ دقیقه باشد.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.4", + "identifier": "V10.4.4", + "text": "برای یک Client مشخص، Authorization Server فقط استفاده از Grantهایی را مجاز بداند که آن Client به استفاده از آن‌ها نیاز دارد. توجه داشته باشید که Grantهای ‘token’ (Implicit Flow) و ‘password’ (Resource Owner Password Credentials Flow) دیگر نباید استفاده شوند.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.5", + "identifier": "V10.4.5", + "text": "Authorization Server باید حملات Refresh Token Replay را برای Public Clientها کاهش دهد، ترجیحاً با استفاده از Sender-Constrained Refresh Tokens، یعنی Demonstrating Proof of Possession (DPoP) یا Certificate-Bound Access Tokens با استفاده از Mutual TLS (mTLS). برای برنامه‌های L1 و L2، می‌توان از Refresh Token Rotation استفاده کرد. اگر Refresh Token Rotation به‌کار گرفته شود، Authorization Server باید پس از استفاده، Refresh Token را باطل کند و اگر یک Refresh Token که قبلاً استفاده و باطل شده ارائه شود، تمام Refresh Tokenهای مربوط به آن مجوز را ابطال نماید.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.6", + "identifier": "V10.4.6", + "text": "اگر از Code Grant استفاده شود، Authorization Server باید حملات Authorization Code Interception را با الزام به استفاده از Proof Key for Code Exchange (PKCE) کاهش دهد. برای Authorization Requestها، Authorization Server باید یک مقدار معتبر برای 'code_challenge' الزام کند و نباید مقدار 'code_challenge_method' از نوع 'plain' را بپذیرد. برای Token Request، باید اعتبارسنجی پارامتر 'code_verifier' الزامی باشد.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.7", + "identifier": "V10.4.7", + "text": "اگر Authorization Server از Unauthenticated Dynamic Client Registration پشتیبانی می‌کند، ریسک مربوط به Client Applicationهای مخرب را باید کاهش دهد. این کار باید شامل اعتبارسنجی Client Metadata (مانند هر Registered URI)، اطمینان از رضایت کاربر، و هشدار به کاربر پیش از پردازش یک Authorization Request با یک Client Application غیرقابل اعتماد باشد.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.8", + "identifier": "V10.4.8", + "text": "Refresh Tokenها باید دارای یک انقضای مطلق (Absolute Expiration) باشند، حتی اگر از Sliding Refresh Token Expiration استفاده شود.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.9", + "identifier": "V10.4.9", + "text": "Refresh Tokenها و Reference Access Tokenها باید توسط کاربر مجاز از طریق User Interface Authorization Server قابل ابطال باشند، تا ریسک Clientهای مخرب یا توکن‌های سرقت‌شده کاهش یابد.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.10", + "identifier": "V10.4.10", + "text": "Confidential Client باید برای درخواست‌های Backchannel بین Client و Authorization Server، مانند Token Requests، Pushed Authorization Requests (PAR) و Token Revocation Requests، احراز هویت شود.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.11", + "identifier": "V10.4.11", + "text": "پیکربندی Authorization Server باید فقط Scopes موردنیاز را به OAuth Client اختصاص دهد.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.12", + "identifier": "V10.4.12", + "text": "برای یک Client مشخص، Authorization Server فقط مقدار 'response_mode' را که این Client نیاز دارد، مجاز بداند. برای مثال، با اعتبارسنجی این مقدار توسط Authorization Server در برابر مقادیر مورد انتظار یا با استفاده از Pushed Authorization Request (PAR) یا JWT-secured Authorization Request (JAR).", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.13", + "identifier": "V10.4.13", + "text": "Grant Type ‘code’ همواره همراه با Pushed Authorization Requests (PAR) باید استفاده شود.", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.14", + "identifier": "V10.4.14", + "text": "Authorization Server باید فقط توکن‌های دسترسی از نوع وابسته به ارسال‌کننده (Proof-of-Possession) صادر می‌کند؛ چه به‌صورت توکن‌های دسترسی مبتنی بر گواهی از طریق TLS دوسویه (mTLS) و چه به‌صورت توکن‌های دسترسی وابسته به DPoP (Demonstration of Proof of Possession).", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.15", + "identifier": "V10.4.15", + "text": "برای یک کلاینت سمت‌سرور (که روی دستگاه کاربر نهایی اجرا نمی‌شود)، سرور احراز هویت اطمینان حاصل می‌کند که مقدار پارامترِ authorization_details از بک‌اند کلاینت ارسال شده و کاربر در آن دستکاری نکرده است. به‌عنوان مثال، با الزام به استفاده از درخواست احراز هویت پوش‌شده (PAR) یا درخواست احراز هویت ایمن‌شده با JWT (JAR).", + "parent": "V10.4" + }, + { + "bom-ref": "V10.4.16", + "identifier": "V10.4.16", + "text": "کلاینت باید از نوع Confidential Client باشد و سرور احراز هویت استفاده از روش‌های قدرتمند احراز هویت کلاینت ـ مبتنی بر رمزنگاری کلید عمومی و مقاوم در برابر حملات replay attacks ـ را الزامی کند؛ مانند TLS دوسویه (tls_client_auth ‎، ‎self_signed_tls_client_auth یا JWT مبتنی بر کلید خصوصی (private_key_jwt).", + "parent": "V10.4" + }, + { + "bom-ref": "V10.5", + "identifier": "V10.5", + "title": "OIDC Client", + "parent": "V10" + }, + { + "bom-ref": "V10.5.1", + "identifier": "V10.5.1", + "text": "Client به‌عنوان Relying Partyباید در برابر حملات بازپخش (Replay) توکن ID محافظت شده است. برای مثال، با بررسی اینکه مقدار claim مربوط به nonce در ID Token دقیقاً با مقدار **nonce**ای که در درخواست احراز هویت به OpenID Provider ارسال شده، یکسان باشد(که در OAuth 2 به آن authorization request ارسالی به authorization server گفته می‌شود).", + "parent": "V10.5" + }, + { + "bom-ref": "V10.5.2", + "identifier": "V10.5.2", + "text": "Client باید کاربر را به‌صورت یکتا از ID Token Claims شناسایی کند، معمولاً از ‘sub’ Claim ، که قابل انتساب مجدد به کاربران دیگر نیست (در محدوده‌ی همان Identity Provider).", + "parent": "V10.5" + }, + { + "bom-ref": "V10.5.3", + "identifier": "V10.5.3", + "text": "Client باید تلاش‌های یک Authorization Server مخرب برای جا زدن خود به‌جای یک Authorization Server دیگر از طریق متادیتای Authorization Server را رد می‌کند.کلاینت باید متادیتای Authorization Server را رد کند اگر مقدار issuer URL موجود در متادیتا دقیقاً با issuer URL از پیش پیکربندی‌شده و مورد انتظار کلاینت یکسان نباشد.", + "parent": "V10.5" + }, + { + "bom-ref": "V10.5.4", + "identifier": "V10.5.4", + "text": "Client باید اعتبارسنجی کند ID Token برای استفاده توسط همان Client در نظر گرفته شده است (Audience)، با بررسی اینکه ‘aud’ Claim در توکن برابر با مقدار ‘client_id’ مربوط به Client باشد.", + "parent": "V10.5" + }, + { + "bom-ref": "V10.5.5", + "identifier": "V10.5.5", + "text": "هنگام استفاده ازOIDC Back-Channel Logout، Relying Party از Denial of Service از طریق Forced Logout و Cross-JWT Confusion در جریان Logout باید جلوگیری کند. Client باید بررسی کند که Logout Token به درستی با مقدار typ آن برابر با logout+jwt باشد ، شامل ‘event’ Claim با نام عضو صحیح باشد و شامل ‘nonce’ Claim نباشد. همچنین توصیه می‌شود Expiration کوتاه باشد (مثلاً ۲ دقیقه).", + "parent": "V10.5" + }, + { + "bom-ref": "V10.6", + "identifier": "V10.6", + "title": "OpenID Provider", + "parent": "V10" + }, + { + "bom-ref": "V10.6.1", + "identifier": "V10.6.1", + "text": "OpenID Provider باید فقط مقادیر 'code'، 'ciba'، 'id_token' یا 'id_token code' را برای Response Mode مجاز بداند. توجه داشته باشید که 'code' نسبت به 'id_token code' (که OIDC Hybrid Flow است) ترجیح داده می‌شود و 'token' (هر Implicit Flow) نباید استفاده شود.", + "parent": "V10.6" + }, + { + "bom-ref": "V10.6.2", + "identifier": "V10.6.2", + "text": "OpenID Provider از Denial of Service از طریق Forced Logout جلوگیری کند. این کار با دریافت تأیید صریح از کاربر نهایی یا در صورت وجود، اعتبارسنجی پارامترها در Logout Request (که توسط Relying Party آغاز شده است)، مانند ‘id_token_hint’، انجام می‌شود.", + "parent": "V10.6" + }, + { + "bom-ref": "V10.7", + "identifier": "V10.7", + "title": "Consent Management", + "parent": "V10" + }, + { + "bom-ref": "V10.7.1", + "identifier": "V10.7.1", + "text": "Authorization Server باید تضمین ‌کند کاربر برای هر درخواست مجوز (Authorization Request) رضایت خود را اعلام کرده است. در صورتی که هویت کلاینت قابل اطمینان نباشد، Authorization Server باید در همه موارد کاربر را به‌صورت صریح برای اعلام رضایت (Consent) راهنمایی و از او تأیید بگیرد.", + "parent": "V10.7" + }, + { + "bom-ref": "V10.7.2", + "identifier": "V10.7.2", + "text": "زمانی که Authorization Server از کاربر درخواست رضایت (Consent) می‌کند باید اطلاعات کافی و شفافی درباره آنچه کاربر در حال تأیید آن است ارائه ‌دهد. در صورت لزوم، این اطلاعات باید شامل این موارد باشد: ماهیت مجوزهای درخواستی )معمولاً بر اساس scope، resource server و جزئیات مجوز در Rich Authorization Requests – RAR)، هویت برنامه یا اپلیکیشن دریافت‌کننده مجوز و مدت اعتبار این مجوزها.", + "parent": "V10.7" + }, + { + "bom-ref": "V10.7.3", + "identifier": "V10.7.3", + "text": "کاربر باید بتواند رضایت‌هایی (Consents) را که از طریق Authorization Server صادر کرده است، مشاهده، ویرایش و لغو (Revoke) کند.", + "parent": "V10.7" + }, + { + "bom-ref": "V11", + "identifier": "V11", + "title": "Cryptography" + }, + { + "bom-ref": "V11.1", + "identifier": "V11.1", + "title": "Cryptographic Inventory and Documentation", + "parent": "V11" + }, + { + "bom-ref": "V11.1.1", + "identifier": "V11.1.1", + "text": "اطمینان حاصل کنید که یک سیاست مستند برای مدیریت کلیدهای رمزنگاری و چرخه‌عمر کلیدهای رمزنگاری وجود دارد که از یک استاندارد مدیریت کلید مانند NIST SP 800-57 پیروی می‌کند. این باید شامل اطمینان از این موضوع باشد که کلیدها بیش از حد به اشتراک گذاشته نشوند (برای مثال، در مورد Secrets مشترک با بیش از دو موجودیت و در مورد کلیدهای خصوصی با بیش از یک موجودیت).", + "parent": "V11.1" + }, + { + "bom-ref": "V11.1.2", + "identifier": "V11.1.2", + "text": "فهرست اجزاء رمزنگاری باید تهیه و نگهداری ‌شود و به‌صورت منظم به‌روزرسانی گردد و شامل تمام کلیدهای رمزنگاری، الگوریتم‌ها و گواهی‌های دیجیتال مورد استفاده در برنامه باشد. این فهرست همچنین باید مشخص کند که کلیدها در کدام بخش‌های سیستم مجاز یا غیرمجاز به استفاده هستند و چه نوع داده‌هایی می‌توانند یا نمی‌توانند با این کلیدها محافظت شوند.", + "parent": "V11.1" + }, + { + "bom-ref": "V11.1.3", + "identifier": "V11.1.3", + "text": "مکانیزم‌های کشف رمزنگاری برای شناسایی تمام موارد استفاده از رمزنگاری در سیستم باید استفاده ‌شود؛ از جمله رمزنگاری (encryption)، هش‌کردن (hashing) و عملیات امضای دیجیتال (signing).", + "parent": "V11.1" + }, + { + "bom-ref": "V11.1.4", + "identifier": "V11.1.4", + "text": "فهرست اجزاء رمزنگاری باید تهیه ‌شود. این فهرست باید شامل یک برنامه مستند باشد که مسیر مهاجرت به استانداردهای جدید رمزنگاری (مانند رمزنگاری پساکوانتومی) را مشخص می‌کند تا امکان واکنش مناسب به تهدیدات آینده فراهم شود.", + "parent": "V11.1" + }, + { + "bom-ref": "V11.2", + "identifier": "V11.2", + "title": "Secure Cryptography Implementation", + "parent": "V11" + }, + { + "bom-ref": "V11.2.1", + "identifier": "V11.2.1", + "text": "برای عملیات رمزنگاری باید از پیاده‌سازی‌های مورد تأیید (شامل کتابخانه‌ها و پیاده‌سازی‌های سخت‌افزاری) استفاده شود.", + "parent": "V11.2" + }, + { + "bom-ref": "V11.2.2", + "identifier": "V11.2.2", + "text": "برنامه با انعطاف‌پذیری رمزنگاری (crypto agility) باید طراحی شده باشد، به‌طوری که الگوریتم‌های تولید اعداد تصادفی، رمزنگاری احراز هویت‌شده، MAC یا هش، طول کلیدها، تعداد دورها، رمزها و حالت‌ها بتوانند در هر زمان مجدداً پیکربندی، ارتقاء یا تعویض شوند تا در برابر شکست‌های رمزنگاری محافظت شوند. به همین ترتیب، باید امکان جایگزینی کلیدها و رمزهای عبور و رمزگذاری مجدد داده‌ها نیز وجود داشته باشد. این امکان ارتقاء بدون وقفه به رمزنگاری پساکوانتومی (PQC) را فراهم می‌کند، زمانی که پیاده‌سازی‌های با اطمینان بالا از طرح‌ها یا استانداردهای تأییدشده PQC به‌طور گسترده در دسترس قرار گیرند.", + "parent": "V11.2" + }, + { + "bom-ref": "V11.2.3", + "identifier": "V11.2.3", + "text": "تمام بدویات رمزنگاری (cryptographic primitives) بر اساس الگوریتم، اندازه کلید و پیکربندی، حداقل ۱۲۸ بیت سطح امنیتی را فراهم می‌کنند(2128)، برای مثال، یک کلید ECC با طول ۲۵۶ بیت تقریباً ۱۲۸ بیت امنیت ارائه می‌دهد، در حالی که برای رسیدن به همین سطح امنیت، الگوریتم RSA به کلید ۳۰۷۲ بیتی نیاز دارد.", + "parent": "V11.2" + }, + { + "bom-ref": "V11.2.4", + "identifier": "V11.2.4", + "text": "تأیید کنید که تمامی عملیات رمزنگاری زمان ثابت (constant-time) باشند و هیچ عملیات «کوتاه‌شده» (short-circuit) در مقایسه‌ها، محاسبات یا بازگشت‌ها وجود نداشته باشد تا از نشت اطلاعات جلوگیری شود.( مهاجم می‌تواند از همین تفاوت‌های زمانی، از طریق Timing Side-Channel Attack، اطلاعات حساس را استخراج کند.)", + "parent": "V11.2" + }, + { + "bom-ref": "V11.2.5", + "identifier": "V11.2.5", + "text": "تأیید کنید که تمامی ماژول‌های رمزنگاری به‌صورت امن دچار خطا (fail securely) شوند و خطاها به گونه‌ای مدیریت شوند که ایجاد آسیب‌پذیری‌هایی مانند حملات Padding Oracle را ممکن نکنند.", + "parent": "V11.2" + }, + { + "bom-ref": "V11.3", + "identifier": "V11.3", + "title": "Encryption Algorithms", + "parent": "V11" + }, + { + "bom-ref": "V11.3.1", + "identifier": "V11.3.1", + "text": "از مد‌های بلاک ناامن (مانند ECB) و روش‌های Padding ضعیف (مانند PKCS#1 v1.5) نباید استفاده شود.", + "parent": "V11.3" + }, + { + "bom-ref": "V11.3.2", + "identifier": "V11.3.2", + "text": "تنها رمزها و مد‌های تأییدشده، مانند AES با GCM باید استفاده شوند.", + "parent": "V11.3" + }, + { + "bom-ref": "V11.3.3", + "identifier": "V11.3.3", + "text": "داده‌های رمزنگاری‌شده باید با استفاده از ترجیحاً یک روش رمزنگاری احراز هویت‌شده تأییدشده یا با ترکیب یک روش رمزنگاری تأییدشده با یک الگوریتم MAC تأییدشده در برابر تغییرات غیرمجاز محافظت شوند.", + "parent": "V11.3" + }, + { + "bom-ref": "V11.3.4", + "identifier": "V11.3.4", + "text": "تأیید کنید که Nonceها، Initialization Vectorها و سایر اعداد یک‌بار مصرف برای بیش از یک جفت کلید رمزنگاری و عنصر داده استفاده نشوند. روش تولید آن‌ها باید متناسب با الگوریتم مورد استفاده باشد.", + "parent": "V11.3" + }, + { + "bom-ref": "V11.3.5", + "identifier": "V11.3.5", + "text": "تأیید کنید که هر ترکیبی از یک الگوریتم رمزنگاری و یک الگوریتم MAC در حالت Encrypt-then-MAC عمل کند.", + "parent": "V11.3" + }, + { + "bom-ref": "V11.4", + "identifier": "V11.4", + "title": "Hashing and Hash-based Functions", + "parent": "V11" + }, + { + "bom-ref": "V11.4.1", + "identifier": "V11.4.1", + "text": "تأیید کنید که تنها توابع هش تأییدشده برای موارد استفاده عمومی رمزنگاری، از جمله امضاهای دیجیتال، HMAC، KDF و تولید بیت تصادفی استفاده شوند. توابع هش غیرمجاز، مانند MD5، نباید برای هیچ هدف رمزنگاری به‌کار گرفته شوند.", + "parent": "V11.4" + }, + { + "bom-ref": "V11.4.2", + "identifier": "V11.4.2", + "text": "رمزعبورها با استفاده از یک تابع مشتق‌سازی کلید تأییدشده و پرهزینه محاسباتی (که به آن «تابع هش رمزعبور» نیز گفته می‌شود) ذخیره شوند، و تنظیمات پارامترها بر اساس راهنمایی‌های کنونی پیکربندی شده باشد. این تنظیمات باید تعادل بین امنیت و عملکرد برقرار کنند تا حملات Brute-force برای سطح امنیت مورد نیاز به‌طور کافی دشوار باشد.", + "parent": "V11.4" + }, + { + "bom-ref": "V11.4.3", + "identifier": "V11.4.3", + "text": "توابع هش استفاده‌شده در امضاهای دیجیتال، باید به‌عنوان بخشی از احراز هویت داده یا یکپارچگی داده، در برابر collision مقاوم بوده و طول بیت مناسب داشته باشند. اگر مقاومت در برابر collision لازم باشد، طول خروجی باید حداقل 256 بیت باشد. اگر تنها مقاومت در برابر حملات Second Pre-image لازم باشد، طول خروجی باید حداقل 128 بیت باشد.", + "parent": "V11.4" + }, + { + "bom-ref": "V11.4.4", + "identifier": "V11.4.4", + "text": "برنامه باید هنگام استخراج کلیدهای مخفی از پسوردها از توابع مشتق‌سازی کلید (KDF) تاییدشده با پارامترهای Key Stretching استفاده می‌کند. پارامترهای مورد استفاده باید تعادلی بین امنیت و عملکرد برقرار کنند تا از نفوذ حملات brute-force و به خطر افتادن کلید رمزنگاری تولیدشده جلوگیری شود.", + "parent": "V11.4" + }, + { + "bom-ref": "V11.5", + "identifier": "V11.5", + "title": "Random Values", + "parent": "V11" + }, + { + "bom-ref": "V11.5.1", + "identifier": "V11.5.1", + "text": "اعداد و رشته‌های تصادفی که قرار است قابل حدس نباشند، باید با استفاده از یک تولیدکننده اعداد شبه‌تصادفی امن رمزنگاری‌شده (CSPRNG) تولید شوند و حداقل 128 بیت انتروپی داشته باشند. توجه داشته باشید که UUIDها این شرط را رعایت نمی‌کنند.", + "parent": "V11.5" + }, + { + "bom-ref": "V11.5.2", + "identifier": "V11.5.2", + "text": "مکانیزم تولید اعداد تصادفی مورد استفاده به‌گونه‌ای طراحی شده باشد که حتی تحت بار سنگین نیز به‌طور امن عمل کند.", + "parent": "V11.5" + }, + { + "bom-ref": "V11.6", + "identifier": "V11.6", + "title": "Public Key Cryptography", + "parent": "V11" + }, + { + "bom-ref": "V11.6.1", + "identifier": "V11.6.1", + "text": "فقط الگوریتم‌های رمزنگاری و مدهای عملیاتی تأیید شده برای تولید کلید و مقداردهی اولیه، و همچنین برای تولید و تأیید امضاهای دیجیتال باید استفاده می‌شوند. الگوریتم‌های تولید کلید نباید کلیدهای ناامن تولید کنند که در برابر حملات شناخته شده آسیب‌پذیر باشند؛ به‌عنوان مثال، کلیدهای RSA که در برابر Fermat factorization آسیب‌پذیر هستند.", + "parent": "V11.6" + }, + { + "bom-ref": "V11.6.2", + "identifier": "V11.6.2", + "text": "برای تبادل کلید از الگوریتم‌های رمزنگاری تأیید شده (مانند Diffie-Hellman) استفاده می‌شود و تمرکز بر این است که مکانیزم‌های تبادل کلید از پارامترهای امن بهره ببرند. این کار از حملات بر فرآیند برقراری کلید جلوگیری می‌کند و مانع حملات مرد میانی (MITM) یا شکست‌های رمزنگاری می‌شود.", + "parent": "V11.6" + }, + { + "bom-ref": "V11.7", + "identifier": "V11.7", + "title": "In-Use Data Cryptography", + "parent": "V11" + }, + { + "bom-ref": "V11.7.1", + "identifier": "V11.7.1", + "text": "رمزنگاری کامل حافظه (Full Memory Encryption) باید فعال باشد تا داده‌های حساس هنگام استفاده محافظت شوند و دسترسی کاربران یا فرآیندهای غیرمجاز به آن‌ها جلوگیری شود.", + "parent": "V11.7" + }, + { + "bom-ref": "V11.7.2", + "identifier": "V11.7.2", + "text": "کاهش داده‌ها (data minimization) تضمین می‌کند که حداقل مقدار داده در حین پردازش افشا شود، و اطمینان حاصل شود که داده‌ها بلافاصله پس از استفاده یا در اولین فرصت ممکن رمزنگاری شوند.", + "parent": "V11.7" + }, + { + "bom-ref": "V12", + "identifier": "V12", + "title": "Secure Communication" + }, + { + "bom-ref": "V12.1", + "identifier": "V12.1", + "title": "General TLS Security Guidance", + "parent": "V12" + }, + { + "bom-ref": "V12.1.1", + "identifier": "V12.1.1", + "text": "جدیدترین نسخه‌های پیشنهادی پروتکل TLS فعال باشند، مانند TLS 1.2 و TLS 1.3 نسخه‌ی جدیدترین پروتکل TLS باید گزینه‌ی ترجیحی باشد.", + "parent": "V12.1" + }, + { + "bom-ref": "V12.1.2", + "identifier": "V12.1.2", + "text": "تنها cipher suiteهای پیشنهادی فعال باشند و قوی‌ترین cipher suiteها به‌عنوان گزینه‌ی ترجیحی تنظیم شده باشند. برنامه‌های L3 باید تنها از cipher suiteهایی پشتیبانی کنند که Forward Secrecy را فراهم می‌کنند.", + "parent": "V12.1" + }, + { + "bom-ref": "V12.1.3", + "identifier": "V12.1.3", + "text": "برنامه باید پیش از استفاده از هویت گواهی برای احراز هویت یا مجوزدهی، اعتبار و مورد اعتماد بودن گواهی‌های کلاینت در mTLS را بررسی و تأیید ‌کند.", + "parent": "V12.1" + }, + { + "bom-ref": "V12.1.4", + "identifier": "V12.1.4", + "text": "لغو صحیح گواهی‌ها، مانند OCSP ، باید فعال و به‌درستی پیکربندی شده باشد.", + "parent": "V12.1" + }, + { + "bom-ref": "V12.1.5", + "identifier": "V12.1.5", + "text": "Encrypted Client Hello (ECH) باید در تنظیمات TLS برنامه فعال باشد تا از افشای متادیتای حساس، مانند Server Name Indication (SNI)، در طول فرآیند Handshake TLS جلوگیری شود.", + "parent": "V12.1" + }, + { + "bom-ref": "V12.2", + "identifier": "V12.2", + "title": "HTTPS Communication with External Facing Services", + "parent": "V12" + }, + { + "bom-ref": "V12.2.1", + "identifier": "V12.2.1", + "text": "برای تمام ارتباطات بین کلاینت و سرویس‌های مبتنی بر HTTP که در معرض دسترسی خارجی هستند، از TLS باید استفاده ‌شود و هیچ‌گونه بازگشت (fallback) به ارتباطات ناامن یا بدون رمزنگاری انجام نگیرد.", + "parent": "V12.2" + }, + { + "bom-ref": "V12.2.2", + "identifier": "V12.2.2", + "text": "سرویس‌هایی که در معرض دسترسی خارجی قرار دارند از گواهی‌های TLS عمومی و مورد اعتماد استفاده می‌کنند.", + "parent": "V12.2" + }, + { + "bom-ref": "V12.3", + "identifier": "V12.3", + "title": "General Service to Service Communication Security", + "parent": "V12" + }, + { + "bom-ref": "V12.3.1", + "identifier": "V12.3.1", + "text": "یک پروتکل رمزنگاری‌شده مانند TLS باید برای تمامی ارتباطات ورودی و خروجی به و از برنامه استفاده شود، از جمله سیستم‌های مانیتورینگ، ابزارهای مدیریت، دسترسی از راه دور و SSH، میان‌افزارها، پایگاه‌های داده، mainframes، سیستم‌های partner یا APIهای خارجی. سرور نباید به پروتکل‌های ناامن یا بدون رمزگذاری بازگردد.", + "parent": "V12.3" + }, + { + "bom-ref": "V12.3.2", + "identifier": "V12.3.2", + "text": "کلاینت‌های TLS باید قبل از برقراری ارتباط با سرور TLS، گواهی‌های دریافتی را اعتبارسنجی کنند.", + "parent": "V12.3" + }, + { + "bom-ref": "V12.3.3", + "identifier": "V12.3.3", + "text": "TLS یا دیگر مکانیزم‌های مناسب رمزگذاری انتقال باید برای تمامی ارتباطات بین سرویس‌های داخلی مبتنی بر HTTP درون برنامه استفاده شود و ارتباط به حالت‌های ناامن یا بدون رمزگذاری بازنگردد.", + "parent": "V12.3" + }, + { + "bom-ref": "V12.3.4", + "identifier": "V12.3.4", + "text": "ارتباطات TLS بین سرویس‌های داخلی باید از گواهی‌های معتبر استفاده کنند. در صورتی که از گواهی‌های داخلی تولیدشده یا Self-Signed استفاده شود، سرویس مصرف‌کننده باید به‌گونه‌ای پیکربندی شود که تنها به CAهای داخلی مشخص و گواهی‌های Self-Signed خاص اعتماد کند.", + "parent": "V12.3" + }, + { + "bom-ref": "V12.3.5", + "identifier": "V12.3.5", + "text": "سرویس‌هایی که درون یک سیستم با یکدیگر ارتباط دارند (ارتباطات درون‌سرویسی)، باید از احراز هویت قوی استفاده کنند تا هر نقطه انتهایی (endpoint) تأیید شود. روش‌های احراز هویت قوی، مانند احراز هویت کلاینت TLS، باید به‌کار گرفته شوند تا هویت تضمین شود (با استفاده از زیرساخت کلید عمومی (PKI) و مکانیزم‌هایی که در برابر حملات تکرار (replay attacks) مقاوم هستند). برای معماری‌های میکروسرویس، استفاده از سرویس مش برای ساده‌سازی مدیریت گواهی‌ها و افزایش امنیت در نظر گرفته شود", + "parent": "V12.3" + }, + { + "bom-ref": "V13", + "identifier": "V13", + "title": "Configuration" + }, + { + "bom-ref": "V13.1", + "identifier": "V13.1", + "title": "Configuration Documentation", + "parent": "V13" + }, + { + "bom-ref": "V13.1.1", + "identifier": "V13.1.1", + "text": "تمامی نیازهای ارتباطی برنامه باید به‌طور کامل مستندسازی شده باشند. این مستندسازی شامل سرویس‌های خارجی که برنامه به آن‌ها وابسته است و همچنین مواردی که کاربر نهایی جهت اتصال به سرویس خارجی مشخص می‌کند باید باشد.", + "parent": "V13.1" + }, + { + "bom-ref": "V13.1.2", + "identifier": "V13.1.2", + "text": "برای هر سرویسی که برنامه استفاده می‌کند، مستندسازی باید شامل حداکثر تعداد ارتباطات همزمان (مثلاً محدودیت‌های Connection Pool) و نحوه‌ی رفتار برنامه هنگام رسیدن به این حد باشد، از جمله هر مکانیزم بازیابی یا جایگزین، تا از بروز شرایط Denial of Service جلوگیری شود.", + "parent": "V13.1" + }, + { + "bom-ref": "V13.1.3", + "identifier": "V13.1.3", + "text": "مستندات برنامه باید استراتژی‌های مدیریت منابع را برای هر سیستم یا سرویس خارجی که استفاده می‌کند مشخص کرده باشد (مثلاً پایگاه‌های داده، هندل‌های فایل، رشته‌ها، اتصالات HTTP) این مستندسازی باید شامل این موارد باشد :رویه‌های آزادسازی منابع، تنظیمات تایم‌اوت، مدیریت خطاها، جایی که منطق Retry اعمال می‌شود، شامل محدودیت تعداد Retry، تأخیرها و الگوریتم‌هایBack-off. برای عملیات همزمان درخواست–پاسخ HTTP (Synchronous)، مستندات باید تایم‌اوت کوتاه را الزام کند و یا Retryها را غیرفعال کند یا به‌طور سختگیرانه محدود کند تا از تاخیرهای زنجیره‌ای و هدررفت منابع جلوگیری شود.", + "parent": "V13.1" + }, + { + "bom-ref": "V13.1.4", + "identifier": "V13.1.4", + "text": "مستندسازی برنامه باید شامل secretهای حیاتی برای امنیت برنامه و همچنین برنامه‌ای برای چرخش آن‌ها باشد( بر اساس مدل تهدید سازمان و نیازهای کسب‌وکار).", + "parent": "V13.1" + }, + { + "bom-ref": "V13.2", + "identifier": "V13.2", + "title": "Backend Communication Configuration", + "parent": "V13" + }, + { + "bom-ref": "V13.2.1", + "identifier": "V13.2.1", + "text": "رتباطات بین اجزای بک‌اند برنامه که از مکانیزم استاندارد نشست کاربران برنامه پشتیبانی نمی‌کنند، از جمله APIها، میان‌افزارها و لایه‌های داده، باید احراز هویت شده باشند. احراز هویت باید با استفاده از حساب‌های سرویس جداگانه، توکن‌های کوتاه‌مدت یا احراز هویت مبتنی بر گواهی انجام شود و نباید از اعتبارنامه‌های ثابت مانند رمز عبور، کلیدهای API یا حساب‌های مشترک با دسترسی‌های سطح بالا استفاده شود.", + "parent": "V13.2" + }, + { + "bom-ref": "V13.2.2", + "identifier": "V13.2.2", + "text": "ارتباطات بین اجزای بک‌اند، از جمله سرویس‌های محلی یا سیستم‌عامل، APIها، میان‌افزارها و لایه‌های داده، با حساب‌هایی باید انجام شود که کمترین سطح دسترسی لازم را دارند.", + "parent": "V13.2" + }, + { + "bom-ref": "V13.2.3", + "identifier": "V13.2.3", + "text": "اگر اعتبارنامه‌ای برای احراز هویت سرویس استفاده می‌شود، اعتبارنامه‌ای که توسط مصرف‌کننده استفاده می‌شود، اعتبارنامه پیش‌فرض نباشد (مثلاً root/root یا admin/admin).", + "parent": "V13.2" + }, + { + "bom-ref": "V13.2.4", + "identifier": "V13.2.4", + "text": "یک allowlist برای تعیین منابع یا سیستم‌های خارجی که برنامه مجاز به ارتباط با آن‌ها است باید وجود داشته باشد (مثلاً برای درخواست‌های خروجی، بارگذاری داده یا دسترسی به فایل). این allowlist می‌تواند در لایه برنامه، وب‌سرور، فایروال یا ترکیبی از لایه‌های مختلف پیاده‌سازی شود.", + "parent": "V13.2" + }, + { + "bom-ref": "V13.2.5", + "identifier": "V13.2.5", + "text": "وب‌سرور یا سرور برنامه با یک allowlist از منابع یا سیستم‌هایی که سرور می‌تواند به آن‌ها درخواست ارسال کند یا داده‌ها و فایل‌ها را بارگذاری کند پیکربندی شده باشد.", + "parent": "V13.2" + }, + { + "bom-ref": "V13.2.6", + "identifier": "V13.2.6", + "text": "در مواقعی که برنامه به سرویس‌های جداگانه متصل می‌شود، پیکربندی مستندسازی‌شده برای هر اتصال رعایت شود، از جمله حداکثر ارتباطات همزمان، رفتار هنگام رسیدن به حداکثر ارتباط مجاز، زمان‌های Timeout اتصال و استراتژی‌های Retry.", + "parent": "V13.2" + }, + { + "bom-ref": "V13.3", + "identifier": "V13.3", + "title": "Secret Management", + "parent": "V13" + }, + { + "bom-ref": "V13.3.1", + "identifier": "V13.3.1", + "text": "یک راهکار مدیریت secret، مانند Key Vault، برای ایجاد امن، ذخیره، کنترل دسترسی و از بین بردن secret بک‌اند استفاده شود. این secret می‌تواند شامل رمزعبورها، داده‌های رمز نگاری، اطلاعات حساس مربوط به اتصال به پایگاه داده و سیستم‌های شخص ثالث، کلیدها و seedهای توکن‌های زمان‌محور، سایر secretهای داخلی و کلیدهای API باشد. Secret نباید در کد منبع برنامه یا در build artifacts قرار گیرد. برای برنامه‌های L3، این باید شامل راهکاری مبتنی بر سخت‌افزار مانند HSM باشد.", + "parent": "V13.3" + }, + { + "bom-ref": "V13.3.2", + "identifier": "V13.3.2", + "text": "دسترسی به دارایی‌های secret بر اساس اصل حداقل دسترسی (Least Privilege) رعایت شود.", + "parent": "V13.3" + }, + { + "bom-ref": "V13.3.3", + "identifier": "V13.3.3", + "text": "تمام عملیات رمزنگاری باید با استفاده از یک ماژول امنیتی ایزوله (مانند Vault یا Hardware Security Module) انجام شود تا مواد کلیدی به‌طور امن مدیریت و محافظت شده و از افشای خارج از ماژول امنیتی جلوگیری شود.", + "parent": "V13.3" + }, + { + "bom-ref": "V13.3.4", + "identifier": "V13.3.4", + "text": "secretها بر اساس مستندسازی برنامه طوری پیکربندی شوند که منقضی شده و چرخش داده شوند.", + "parent": "V13.3" + }, + { + "bom-ref": "V13.4", + "identifier": "V13.4", + "title": "Unintended Information Leakage", + "parent": "V13" + }, + { + "bom-ref": "V13.4.1", + "identifier": "V13.4.1", + "text": "برنامه باید به‌گونه‌ای مستقر شود که هیچ‌گونه متادیتای کنترل نسخه، از جمله پوشه‌های .git یا .svn، در دسترس نباشد یا به شکلی باشد که این پوشه‌ها نه از بیرون و نه توسط خود برنامه قابل دسترسی نباشند.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.2", + "identifier": "V13.4.2", + "text": "حالت‌های Debug برای تمام اجزا در محیط‌های production باید غیرفعال شده باشند تا از افشای قابلیت‌های دیباگ و نشت اطلاعات جلوگیری شود.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.3", + "identifier": "V13.4.3", + "text": "وب‌سرورها فهرست‌بندی دایرکتوری‌ها را به کاربر نهایی نباید نمایش دهند مگر اینکه به‌طور صریح مورد نظر باشد.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.4", + "identifier": "V13.4.4", + "text": "از متد HTTP TRACE در محیط‌های production نباید پشتیبانی شود تا از احتمال نشت اطلاعات جلوگیری شود.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.5", + "identifier": "V13.4.5", + "text": "مستندسازی‌ها (مانند مستندات APIهای داخلی) و نقاط پایش (Monitoring Endpoints) در دسترس نباشند مگر اینکه به‌طور صریح مورد نظر باشد.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.6", + "identifier": "V13.4.6", + "text": "تأیید کنید که برنامه اطلاعات نسخه دقیق اجزای backend را افشا نکند.", + "parent": "V13.4" + }, + { + "bom-ref": "V13.4.7", + "identifier": "V13.4.7", + "text": "لایه وب باید به‌گونه‌ای پیکربندی شده باشد که فقط فایل‌هایی با پسوندهای مشخص را سرو کند تا از افشای تصادفی اطلاعات، پیکربندی و کد منبع جلوگیری شود.", + "parent": "V13.4" + }, + { + "bom-ref": "V14", + "identifier": "V14", + "title": "Data Protection" + }, + { + "bom-ref": "V14.1", + "identifier": "V14.1", + "title": "Data Protection Documentation", + "parent": "V14" + }, + { + "bom-ref": "V14.1.1", + "identifier": "V14.1.1", + "text": "تمامی داده‌های حساس ایجادشده و پردازش‌شده توسط برنامه باید شناسایی شده و بر اساس سطوح حفاظتی طبقه‌بندی شده‌اند. این موضوع شامل داده‌هایی می‌شود که صرفاً کُدگذاری شده‌اند و به‌راحتی قابل بازیابی هستند، مانند رشته‌های Base64 یا محتوای متنی (plaintext) داخل یک JWT. سطوح حفاظتی باید الزامات قوانین و استانداردهای حفاظت از داده و حریم خصوصی که برنامه ملزم به رعایت آن‌هاست را در نظر بگیرند.", + "parent": "V14.1" + }, + { + "bom-ref": "V14.1.2", + "identifier": "V14.1.2", + "text": "برای تمامی سطوح حفاظت از داده‌های حساس، مجموعه‌ای مستند از الزامات حفاظتی تعریف شده باشد. این الزامات باید شامل (اما محدود به آن نباشد) موارد زیر باشند: الزامات مرتبط با رمزنگاری کلی، بررسی صحت و یکپارچگی، دوره‌های نگهداری داده، نحوه ثبت داده‌ها در لاگ، کنترل‌های دسترسی به داده‌های حساس در لاگ‌ها، رمزنگاری در سطح پایگاه داده، الزامات مربوط به حریم خصوصی و فناوری‌های تقویت‌کننده حریم خصوصی مورد استفاده، و سایر الزامات مرتبط با محرمانگی.", + "parent": "V14.1" + }, + { + "bom-ref": "V14.2", + "identifier": "V14.2", + "title": "General Data Protection", + "parent": "V14" + }, + { + "bom-ref": "V14.2.1", + "identifier": "V14.2.1", + "text": "داده‌های حساس باید فقط در بدنه پیام HTTP یا فیلدهای هدر به سرور ارسال شوند، و اینکه URL و query string شامل اطلاعات حساس (مانند API key یا session token) نباشند.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.2", + "identifier": "V14.2.2", + "text": "برنامه باید از cache شدن داده‌های حساس در اجزای سرور مانند Load Balancer و Application Cache جلوگیری کند، یا اطمینان حاصل شود که داده‌ها پس از استفاده به‌طور ایمن پاک‌سازی می‌شوند.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.3", + "identifier": "V14.2.3", + "text": "داده‌های حساس تعریف‌شده به طرف‌های غیرقابل اعتماد (مانند User Trackers) نباید ارسال شوند تا از جمع‌آوری ناخواسته داده‌ها خارج از کنترل برنامه جلوگیری شود.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.4", + "identifier": "V14.2.4", + "text": "کنترل‌های مرتبط با داده‌های حساس شامل رمزنگاری، بررسی صحت و یکپارچگی، نگهداری، نحوه ثبت داده‌ها در لاگ، کنترل‌های دسترسی به داده‌های حساس در لاگ‌ها، حریم خصوصی و فناوری‌های مربوط به حریم خصوصی، مطابق با آنچه در مستندات برای سطح حفاظت مشخص هر داده تعریف شده است، پیاده‌سازی شوند.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.5", + "identifier": "V14.2.5", + "text": "مکانیزم‌های cache باید طوری پیکربندی شده باشند که تنها پاسخ‌هایی با نوع محتوای مورد انتظار برای آن منبع cache شوند و شامل محتوای حساس یا پویا نباشند. وب‌سرور باید هنگام دسترسی به فایل ناموجود، پاسخ 404 یا 302 برگرداند و نه فایل معتبر دیگر، تا از حملات Web Cache Deception جلوگیری شود.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.6", + "identifier": "V14.2.6", + "text": "برنامه باید تنها حداقل داده‌های حساس مورد نیاز برای عملکرد برنامه را بازگرداند. برای مثال، تنها برخی از ارقام شماره کارت اعتباری بازگردانده شود و نه شماره کامل. در صورتی که داده کامل لازم باشد، باید در رابط کاربری masked شود مگر اینکه کاربر به‌طور مشخص آن را مشاهده کند.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.7", + "identifier": "V14.2.7", + "text": "اطلاعات حساس باید تحت طبقه‌بندی دوره‌ای نگهداری داده قرار گرفته باشند، به‌گونه‌ای که داده‌های قدیمی یا غیرضروری به‌طور خودکار، در یک برنامه زمان‌بندی‌شده مشخص، یا براساس نیاز حذف شوند.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.2.8", + "identifier": "V14.2.8", + "text": "اطلاعات حساس باید از متادیتای فایل‌های ارسال‌شده توسط کاربر حذف شود، مگر اینکه ذخیره‌سازی آن با رضایت کاربر انجام شود.", + "parent": "V14.2" + }, + { + "bom-ref": "V14.3", + "identifier": "V14.3", + "title": "Client-side Data Protection", + "parent": "V14" + }, + { + "bom-ref": "V14.3.1", + "identifier": "V14.3.1", + "text": "داده‌های احراز هویت‌شده از حافظه کلاینت، مانند DOM مرورگر، پس از خروج کلاینت یا Session پاک شوند. فیلد هدر Clear-Site-Data در پاسخ سرور می‌تواند در این زمینه مفید باشد، اما کلاینت باید بتواند داده‌ها را حتی زمانی که اتصال به سرور در دسترس نیست در زمان پایان Session (خروج از آن) پاک کند.", + "parent": "V14.3" + }, + { + "bom-ref": "V14.3.2", + "identifier": "V14.3.2", + "text": "برنامه باید هدرهای پاسخ HTTP، anti-cach مناسب (مانند Cache-Control: no-store) را تنظیم کند تا داده‌های حساس در مرورگرها cache نشوند.", + "parent": "V14.3" + }, + { + "bom-ref": "V14.3.3", + "identifier": "V14.3.3", + "text": "برای اطلاعات بیشتر، همچنین به منابع زیر مراجعه کنید:", + "parent": "V14.3" + }, + { + "bom-ref": "V15", + "identifier": "V15", + "title": "Secure Coding and Architecture" + }, + { + "bom-ref": "V15.1", + "identifier": "V15.1", + "title": "Secure Coding and Architecture Documentation", + "parent": "V15" + }, + { + "bom-ref": "V15.1.1", + "identifier": "V15.1.1", + "text": "مستندات برنامه باید بازه‌های زمانی جهت برطرف سازی آسیب‌پذیری‌ نسخه‌های مؤلفه‌ شخص ثالث (بر اساس ریسک) و همچنین به‌روزرسانی کتابخانه‌ها را به طور کلی تعریف کرده باشد تا ریسک ناشی از این مؤلفه‌ها به حداقل برسد.", + "parent": "V15.1" + }, + { + "bom-ref": "V15.1.2", + "identifier": "V15.1.2", + "text": "یک کاتالوگ دارایی مانند Software Bill of Materials (SBOM) باید برای تمامی کتابخانه‌های شخص ثالث مورد استفاده نگهداری شود. شامل تایید این که مؤلفه‌ها از مخازن از پیش تعیین‌شده، قابل اعتماد و به‌طور مستمر نگهداری‌شده تهیه شده‌اند.", + "parent": "V15.1" + }, + { + "bom-ref": "V15.1.3", + "identifier": "V15.1.3", + "text": "مستندات برنامه باید شامل عملکردهایی که زمان‌بر یا پرمصرف(منابع سیستمی) هستند نیز باشد. این مورد باید شامل روش‌هایی برای جلوگیری از دست‌رفتن دسترس‌پذیری به دلیل استفاده بیش از حد از این عملکردها و همچنین جلوگیری از وضعیتی باشد که پردازش یک پاسخ طولانی‌تر از زمان انتظار مصرف‌کننده شود. تدابیر احتمالی می‌تواند شامل پردازش غیرهمزمان، استفاده از صف‌ها و محدود کردن فرآیندهای موازی برای هر کاربر و هر برنامه باشد.", + "parent": "V15.1" + }, + { + "bom-ref": "V15.1.4", + "identifier": "V15.1.4", + "text": "مستندات برنامه باید کتابخانه‌های شخص ثالثی را که به‌عنوان «کامپوننت‌های پرخطر» شناخته می‌شوند، مشخص کرده باشد.", + "parent": "V15.1" + }, + { + "bom-ref": "V15.1.5", + "identifier": "V15.1.5", + "text": "مستندات برنامه باید بخش‌هایی از برنامه را که به‌عنوان «عملکرد خطرناک» استفاده می‌شود، مشخص کرده باشد.", + "parent": "V15.1" + }, + { + "bom-ref": "V15.2", + "identifier": "V15.2", + "title": "Security Architecture and Dependencies", + "parent": "V15" + }, + { + "bom-ref": "V15.2.1", + "identifier": "V15.2.1", + "text": "برنامه باید تنها شامل کامپوننت‌هایی باشد که چارچوب‌های زمانی مستند‌شده برای به‌روزرسانی و رفع آسیب‌پذیری‌ها را نقض نکرده‌باشند.", + "parent": "V15.2" + }, + { + "bom-ref": "V15.2.2", + "identifier": "V15.2.2", + "text": "برنامه باید بر اساس تصمیمات و استراتژی‌های امنیتی مستندسازی‌شده، تدابیری برای جلوگیری از کاهش دسترس‌پذیری ناشی از عملکردهایی که زمان‌بر یا پرمصرف منابع هستند، پیاده‌سازی کرده باشد.", + "parent": "V15.2" + }, + { + "bom-ref": "V15.2.3", + "identifier": "V15.2.3", + "text": "محیط production تنها شامل عملکردهایی می‌باشد که برای اجرای برنامه ضروری هستند و هیچ قابلیت اضافی مانند کدهای تست، نمونه‌کدها و عملکردهای توسعه‌ای در دسترس نمی‌باشد.", + "parent": "V15.2" + }, + { + "bom-ref": "V15.2.4", + "identifier": "V15.2.4", + "text": "کامپوننت‌های شخص ثالث و تمام وابستگی‌های انتقالی آن‌ها از مخزن مورد انتظار باید دریافت ‌شوند، چه داخلی و چه منبع خارجی، و ریسک حمله‌ی dependency confusion مدیریت شود.", + "parent": "V15.2" + }, + { + "bom-ref": "V15.2.5", + "identifier": "V15.2.5", + "text": "برنامه باید محافظت‌های اضافی را در بخش‌هایی از برنامه که به‌عنوان «عملکرد خطرناک» مستند شده‌اند یا از کتابخانه‌های شخص ثالثی که به‌عنوان «کامپوننت‌های پرریسک» شناخته می‌شوند، پیاده‌سازی می‌کند. این می‌تواند شامل تکنیک‌هایی مانند sandboxing، encapsulation، containerization یا جداسازی در سطح شبکه باشد تا حمله‌کنندگان پس از نفوذ به یک بخش از برنامه، نتوانند به بخش‌های دیگر برنامه منتقل شوند و زمان لازم برای پیشروی آن‌ها افزایش یابد.", + "parent": "V15.2" + }, + { + "bom-ref": "V15.3", + "identifier": "V15.3", + "title": "Defensive Coding", + "parent": "V15" + }, + { + "bom-ref": "V15.3.1", + "identifier": "V15.3.1", + "text": "برنامه باید تنها زیرمجموعه‌ای از فیلدهای مورد نیاز از یک data object را بازگرداند. به‌عنوان مثال، نباید کل data object بازگردانده شود، زیرا برخی فیلدهای منفرد نباید برای کاربران قابل دسترسی باشند.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.2", + "identifier": "V15.3.2", + "text": "در جایی که بک‌اند برنامه به URLهای خارجی فراخوانی می‌فرستد، طوری باید پیکربندی شده باشد که تنها در صورت نیاز و منظور مشخص، از تغییر مسیرها (redirects) پیروی کند.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.3", + "identifier": "V15.3.3", + "text": "برنامه باید دارای تدابیر مقابله‌ای برای محافظت در برابر حملات mass assignment باشد، به‌طوری که فیلدهای مجاز برای هر کنترلر و اکشن محدود شده باشند؛ به عنوان مثال، نباید بتوان مقداری برای فیلدی وارد یا به‌روزرسانی کرد که قرار نبوده بخشی از آن اکشن باشد.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.4", + "identifier": "V15.3.4", + "text": "تمام اجزای proxying و middleware باید آدرس IP اصلی کاربر را به‌درستی منتقل کنند، با استفاده از فیلدهای داده معتبر که توسط کاربر نهایی قابل دستکاری نباشند، و برنامه و وب‌سرور از این مقدار صحیح برای ثبت لاگ و تصمیم‌گیری‌های امنیتی مانند rate limiting استفاده کنند، با در نظر گرفتن اینکه حتی آدرس IP اصلی ممکن است به دلیل IPهای پویا، VPNها یا فایروال‌های سازمانی قابل اعتماد نباشد.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.5", + "identifier": "V15.3.5", + "text": "برنامه باید به‌طور صریح اطمینان حاصل کند که variables از نوع صحیح هستند و عملیات‌های مقایسه و comparator به‌صورت دقیق (strict) انجام می‌شوند. این اقدام برای جلوگیری از آسیب‌پذیری‌های type juggling یا type confusion است که ممکن است به دلیل فرضیات نادرست برنامه درباره نوع یک متغیر ایجاد شود.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.6", + "identifier": "V15.3.6", + "text": "کد JavaScript باید به‌گونه‌ای نوشته شده باشد که از prototype pollution جلوگیری کند، برای مثال با استفاده از Set() یا Map() به جای object literals.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.3.7", + "identifier": "V15.3.7", + "text": "برنامه باید دارای تدابیر محافظتی در برابر HTTP parameter pollution باشد، به‌ویژه اگر چارچوب برنامه تفاوتی بین منابع پارامترهای درخواست (رشته‌های query، پارامترهای body، کوکی‌ها یا فیلدهای هدر) قائل نشود.", + "parent": "V15.3" + }, + { + "bom-ref": "V15.4", + "identifier": "V15.4", + "title": "Safe Concurrency", + "parent": "V15" + }, + { + "bom-ref": "V15.4.1", + "identifier": "V15.4.1", + "text": "shared objects در کد multi-threaded (مانند cacheها، فایل‌ها، یا اشیائی که توسط multiple threads دسترسی پیدا می‌کنند) باید به‌صورت ایمن مورد استفاده قرار بگیرند، با استفاده از نوع‌های thread-safe و مکانیزم‌های همگام‌سازی مانند lock یا semaphore تا از race condition و تخریب داده جلوگیری شود.", + "parent": "V15.4" + }, + { + "bom-ref": "V15.4.2", + "identifier": "V15.4.2", + "text": "بررسی وضعیت یک resource، مانند وجود آن یا دسترسی‌ها،و اقداماتی که به این وضعیت وابسته‌اند، به‌صورت یک عملیات واحد انجام شوند تا از race condition نوع time-of-check to time-of-use (TOCTOU) جلوگیری شود. برای مثال، بررسی اینکه یک فایل وجود دارد قبل از باز کردن آن، یا تأیید دسترسی یک کاربر قبل از اعطای آن.", + "parent": "V15.4" + }, + { + "bom-ref": "V15.4.3", + "identifier": "V15.4.3", + "text": "باید از قفل‌ها (Locks) به طور یکنواخت استفاده شود تا از گیر کردن (Threads) جلوگیری شود، چه با انتظار برای یکدیگر و چه با تلاش بی‌پایان، و همچنین منطق قفل‌گذاری باید در همان کدی باقی بماند که مسئول مدیریت منبع است؛ این کار تضمین می‌کند که قفل‌ها نمی‌توانند به‌صورت ناخواسته یا خرابکارانه توسط کلاس‌ها یا کدهای بیرونی تغییر داده شوند.", + "parent": "V15.4" + }, + { + "bom-ref": "V15.4.4", + "identifier": "V15.4.4", + "text": "تأیید کنید که سیاست‌های تخصیص resource از thread starvation جلوگیری می‌کنند، با اطمینان از دسترسی عادلانه به منابع، مانند استفاده از thread pools و اجازه دادن به threads با اولویت پایین‌تر تا در بازه زمانی منطقی پیشرفت کنند.", + "parent": "V15.4" + }, + { + "bom-ref": "V16", + "identifier": "V16", + "title": "Security Logging and Error Handling" + }, + { + "bom-ref": "V16.1", + "identifier": "V16.1", + "title": "Security Logging Documentation", + "parent": "V16" + }, + { + "bom-ref": "V16.1.1", + "identifier": "V16.1.1", + "text": "فهرستی باید وجود داشته باشد که در آن ثبت وقایع (Logging) انجام‌شده در هر لایه از stack فناوری برنامه، رویدادهای ثبت‌شده، فرمت‌های لاگ، محل ذخیره‌سازی، نحوه استفاده، نحوه کنترل دسترسی به آن‌ها و مدت زمان نگهداری لاگ‌ها مستند شده است.", + "parent": "V16.1" + }, + { + "bom-ref": "V16.2", + "identifier": "V16.2", + "title": "General Logging", + "parent": "V16" + }, + { + "bom-ref": "V16.2.1", + "identifier": "V16.2.1", + "text": "هر ورودی لاگ باید شامل متادیتای لازم (مانند زمان، مکان، چه کسی و چه چیزی) باشد تا امکان بررسی دقیق خط زمانی هنگام وقوع یک رویداد فراهم شود.", + "parent": "V16.2" + }, + { + "bom-ref": "V16.2.2", + "identifier": "V16.2.2", + "text": "منابع زمانی برای تمام مؤلفه‌های لاگ با هم همگام‌سازی شده‌اند و مهر زمان (timestamp)‌ در متادیتای رویدادهای امنیتی از UTC استفاده ‌کند یا شامل یک اختلاف‌زمان (time zone offset) صریح باشد. استفاده از UTC توصیه می‌شود تا یکپارچگی در سراسر سیستم‌های توزیع‌شده تضمین شود و از بروز سردرگمی در زمان تغییر ساعت تابستانی جلوگیری گردد.", + "parent": "V16.2" + }, + { + "bom-ref": "V16.2.3", + "identifier": "V16.2.3", + "text": "برنامه تنها لاگ‌ها را در فایل‌ها و سرویس‌هایی ذخیره یا ارسال می‌کند که در فهرست مستند لاگ‌ها ثبت شده‌اند.", + "parent": "V16.2" + }, + { + "bom-ref": "V16.2.4", + "identifier": "V16.2.4", + "text": "لاگ‌ها باید توسط پردازشگر لاگی که در حال استفاده است خوانده و همبسته شوند، و ترجیحاً با استفاده از یک فرمت لاگ مشترک این کار انجام گیرد.", + "parent": "V16.2" + }, + { + "bom-ref": "V16.2.5", + "identifier": "V16.2.5", + "text": "هنگام لاگ‌گیری از داده‌های حساس، برنامه باید لاگ گیری را بر اساس سطح حفاظت داده اعمال کند. برای مثال، ممکن است لاگ‌کردن برخی داده‌ها مانند اطلاعات ورود یا جزئیات پرداخت مجاز نباشد. داده‌های دیگر، مانند session token، تنها در صورتی باید لاگ شوند که به‌صورت hash یا masked، چه به‌طور کامل یا جزئی، ثبت شوند.", + "parent": "V16.2" + }, + { + "bom-ref": "V16.3", + "identifier": "V16.3", + "title": "Security Events", + "parent": "V16" + }, + { + "bom-ref": "V16.3.1", + "identifier": "V16.3.1", + "text": "تمام عملیات احراز هویت باید لاگ‌گیری ‌شوند، از جمله تلاش‌های موفق و ناموفق. همچنین باید متادیتای اضافی، مانند نوع احراز هویت یا عوامل استفاده‌شده، جمع‌آوری شود.", + "parent": "V16.3" + }, + { + "bom-ref": "V16.3.2", + "identifier": "V16.3.2", + "text": "تلاش‌های ناموفق برای مجوزدهی (authorization) باید لاگ‌گیری ‌شوند. برای برنامه‌های L3، این باید شامل لاگ‌گیری تمام تصمیمات مجوزدهی باشد، از جمله ثبت زمانی که داده‌های حساس دسترسی پیدا می‌کنند، بدون آنکه خود داده‌های حساس ثبت شوند.", + "parent": "V16.3" + }, + { + "bom-ref": "V16.3.3", + "identifier": "V16.3.3", + "text": "برنامه باید رویدادهای امنیتی تعریف‌شده در مستندات (ابتدای بخش) را لاگ‌ نماید و همچنین تلاش‌ها برای دور زدن کنترل‌های امنیتی، مانند اعتبارسنجی ورودی، منطق کسب‌وکار و ضد‌خودکارسازی، را نیز ثبت ‌کند.", + "parent": "V16.3" + }, + { + "bom-ref": "V16.3.4", + "identifier": "V16.3.4", + "text": "برنامه باید خطاهای غیرمنتظره و شکست‌های کنترل‌های امنیتی، مانند شکست‌های TLS در بک اند را لاگ ‌کند.", + "parent": "V16.3" + }, + { + "bom-ref": "V16.4", + "identifier": "V16.4", + "title": "Log Protection", + "parent": "V16" + }, + { + "bom-ref": "V16.4.1", + "identifier": "V16.4.1", + "text": "تمام مؤلفه‌های لاگ‌گیری باید داده‌ها را به‌طور مناسب رمزگذاری ‌کنند تا از حملات log injection جلوگیری شود.", + "parent": "V16.4" + }, + { + "bom-ref": "V16.4.2", + "identifier": "V16.4.2", + "text": "لاگ‌ها باید در برابر دسترسی غیرمجاز محافظت شده و امکان تغییر آن‌ها وجود نداشته باشد.", + "parent": "V16.4" + }, + { + "bom-ref": "V16.4.3", + "identifier": "V16.4.3", + "text": "لاگ‌ها به‌صورت امن باید به یک سیستم منطقی جداگانه برای تحلیل، تشخیص، هشدار و ارجاع منتقل شوند. هدف این است که در صورت نفوذ به برنامه، لاگ‌ها به خطر نیفتند.", + "parent": "V16.4" + }, + { + "bom-ref": "V16.5", + "identifier": "V16.5", + "title": "Error Handling", + "parent": "V16" + }, + { + "bom-ref": "V16.5.1", + "identifier": "V16.5.1", + "text": "هنگام بروز خطاهای غیرمنتظره یا حساس به امنیت، پیامی عمومی به کاربر باید بازگردانده ‌شود، به‌گونه‌ای که هیچ‌گونه اطلاعات حساس داخلی سیستم مانند stack trace، کوئری‌ها، کلیدها و توکن‌های محرمانه افشا نشود.", + "parent": "V16.5" + }, + { + "bom-ref": "V16.5.2", + "identifier": "V16.5.2", + "text": "برنامه باید هنگام بروز خطا در دسترسی به منابع خارجی همچنان به‌صورت امن عمل نماید، برای مثال با استفاده از الگوهایی مانند circuit breaker یا کاهش تدریجی عملکرد (graceful degradation).", + "parent": "V16.5" + }, + { + "bom-ref": "V16.5.3", + "identifier": "V16.5.3", + "text": "برنامه باید به‌صورت امن و کنترل‌شده دچار خطا ‌شود، حتی هنگام وقوع استثنا، و از شرایط fail-open جلوگیری نماید؛ برای مثال، از پردازش تراکنش در صورت بروز خطا در منطق اعتبارسنجی جلوگیری شود.", + "parent": "V16.5" + }, + { + "bom-ref": "V16.5.4", + "identifier": "V16.5.4", + "text": "یک « last resort» باید تعریف شده باشد که تمامی unhandled exception را مدیریت کند. این کار هم برای جلوگیری از از دست رفتن جزئیات خطا که باید در فایل‌های لاگ ثبت شوند و هم برای اطمینان از این است که خطا باعث از کار افتادن کل فرآیند برنامه و در نتیجه از دست رفتن دسترسی نشود، ضروری است.", + "parent": "V16.5" + }, + { + "bom-ref": "V17", + "identifier": "V17", + "title": "WebRTC" + }, + { + "bom-ref": "V17.1", + "identifier": "V17.1", + "title": "TURN Server", + "parent": "V17" + }, + { + "bom-ref": "V17.1.1", + "identifier": "V17.1.1", + "text": "سرویس Traversal Using Relays around NAT (TURN) باید تنها به آدرس‌های IP دسترسی دهد که برای اهداف ویژه رزرو نشده‌اند (مثلاً شبکه‌های داخلی، broadcast، loopback). توجه داشته باشید که این مورد هم برای آدرس‌های IPv4 و هم برای IPv6 صدق می‌کند.", + "parent": "V17.1" + }, + { + "bom-ref": "V17.1.2", + "identifier": "V17.1.2", + "text": "سرویس Traversal Using Relays around NAT (TURN)، نباید به resource exhaustion آسیب‌پذیر باشد، حتی زمانی که کاربران قانونی تلاش کنند تعداد زیادی پورت روی سرور TURN باز کنند.", + "parent": "V17.1" + }, + { + "bom-ref": "V17.2", + "identifier": "V17.2", + "title": "Media", + "parent": "V17" + }, + { + "bom-ref": "V17.2.1", + "identifier": "V17.2.1", + "text": "کلید مربوط به گواهی Datagram Transport Layer Security (DTLS) بر اساس سیاست مستند مدیریت کلیدهای رمزنگاری مدیریت و محافظت می‌شود.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.2", + "identifier": "V17.2.2", + "text": "سرور Media طوری پیکربندی شده باشد که از مجموعه‌های رمزنگاری تاییدشده Datagram Transport Layer Security (DTLS) استفاده کند و از یک پروفایل محافظتی امن برای گسترش DTLS به منظور ایجاد کلیدها برای پروتکل Secure Real-time Transport Protocol (DTLS-SRTP) پشتیبانی نماید.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.3", + "identifier": "V17.2.3", + "text": "احراز هویت Secure Real-time Transport Protocol (SRTP) در سرور Media بررسی ‌شود تا از حملات تزریق Real-time Transport Protocol (RTP) جلوگیری شده و این حملات باعث بروز شرایط Denial of Service یا وارد شدن محتوای صوتی یا تصویری ناخواسته به جریان‌های رسانه‌ای نشوند.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.4", + "identifier": "V17.2.4", + "text": "سرور Media باید قادر باشد پردازش ترافیک رسانه‌ای ورودی را حتی هنگام مواجهه با بسته‌های Secure Real-time Transport Protocol (SRTP) ناقص یا خراب ادامه دهد.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.5", + "identifier": "V17.2.5", + "text": "سرور Media باید قادر باشد پردازش ترافیک رسانه‌ای ورودی را حتی در هنگام دریافت سیلی(flood) از بسته‌های Secure Real-time Transport Protocol (SRTP) از کاربران قانونی ادامه دهد.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.6", + "identifier": "V17.2.6", + "text": "سرور Media نسبت به آسیب‌پذیری \"ClientHello Race Condition \" در Datagram Transport Layer Security (DTLS) نباید آسیب‌پذیر نباشد، این کار می‌تواند با بررسی اینکه آیا سرور رسانه به‌صورت عمومی به عنوان آسیب‌پذیر شناخته شده است یا با انجام آزمون Race Condition انجام شود.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.7", + "identifier": "V17.2.7", + "text": "مکانیزم‌های ضبط صدا یا تصویر مرتبط با سرور رسانه در هنگام طوفان بسته‌ای (Flood) از پروتکل انتقال بلادرنگ امن (SRTP) توسط کاربران مجاز، باید قادر به ادامه پردازش ترافیک رسانه ورودی است.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.2.8", + "identifier": "V17.2.8", + "text": "گواهی‌نامه امنیت لایه انتقال دیتاگرام (DTLS) باید با ویژگی اثر انگشت (Fingerprint) پروتکل توصیف نشست (SDP) بررسی می‌شود و در صورت شکست در بررسی، جریان رسانه قطع می‌شود تا اصالت جریان رسانه تضمین گردد.", + "parent": "V17.2" + }, + { + "bom-ref": "V17.3", + "identifier": "V17.3", + "title": "Signaling", + "parent": "V17" + }, + { + "bom-ref": "V17.3.1", + "identifier": "V17.3.1", + "text": "سرور سیگنالینگ باید قادر باشد حتی در جریان flood attack، پیام‌های سیگنالینگ ورودی مشروع را پردازش کند. این باید با اعمال محدودیت نرخ (rate limiting) در سطح سیگنالینگ محقق شود.", + "parent": "V17.3" + }, + { + "bom-ref": "V17.3.2", + "identifier": "V17.3.2", + "text": "سرور سیگنالینگ باید قادر باشد پیام‌های سیگنالینگ مشروع را حتی در مواجهه با پیام‌های سیگنالینگ ناقص یا مخرب که می‌توانند باعث ایجاد شرایط عدم دسترسی (Denial of Service) شوند، پردازش کند. این می‌تواند شامل اعمال اعتبارسنجی ورودی، مدیریت ایمن سرریز عدد صحیح (integer overflow)، جلوگیری از سرریز بافر (buffer overflow) و استفاده از دیگر تکنیک‌های مقاوم مدیریت خطا باشد.", + "parent": "V17.3" + } + ], + "levels": [ + { + "bom-ref": "level-1", + "identifier": "Level 1", + "description": "This level contains the minimum requirements to consider when securing an application and represents a critical starting point.", + "requirements": [ + "V1.2.1", + "V1.2.2", + "V1.2.3", + "V1.2.4", + "V1.2.5", + "V1.3.1", + "V1.3.2", + "V1.5.1", + "V2.1.1", + "V2.2.1", + "V2.2.2", + "V2.3.1", + "V3.2.1", + "V3.2.2", + "V3.3.1", + "V3.4.1", + "V3.4.2", + "V3.5.1", + "V3.5.2", + "V3.5.3", + "V4.1.1", + "V4.4.1", + "V5.2.1", + "V5.2.2", + "V5.3.1", + "V5.3.2", + "V6.1.1", + "V6.2.1", + "V6.2.2", + "V6.2.3", + "V6.2.4", + "V6.2.5", + "V6.2.6", + "V6.2.7", + "V6.2.8", + "V6.3.1", + "V6.3.2", + "V6.4.1", + "V6.4.2", + "V7.2.1", + "V7.2.2", + "V7.2.3", + "V7.2.4", + "V7.4.1", + "V7.4.2", + "V8.1.1", + "V8.2.1", + "V8.2.2", + "V8.3.1", + "V9.1.1", + "V9.1.2", + "V9.1.3", + "V9.2.1", + "V10.4.1", + "V10.4.2", + "V10.4.3", + "V10.4.4", + "V10.4.5", + "V11.3.1", + "V11.3.2", + "V11.4.1", + "V12.1.1", + "V12.2.1", + "V12.2.2", + "V13.4.1", + "V14.2.1", + "V14.3.1", + "V15.1.1", + "V15.2.1", + "V15.3.1" + ] + }, + { + "bom-ref": "level-2", + "identifier": "Level 2", + "description": "ASVS Level 2 requirements generally relate to either less common attacks or more complicated protections against common attacks. They may still be a first layer of defense, or they may require certain preconditions for the attack to be successful.", + "requirements": [ + "V1.1.1", + "V1.1.2", + "V1.2.6", + "V1.2.7", + "V1.2.8", + "V1.2.9", + "V1.3.3", + "V1.3.4", + "V1.3.5", + "V1.3.6", + "V1.3.7", + "V1.3.8", + "V1.3.9", + "V1.3.10", + "V1.3.11", + "V1.4.1", + "V1.4.2", + "V1.4.3", + "V1.5.2", + "V2.1.2", + "V2.1.3", + "V2.2.3", + "V2.3.2", + "V2.3.3", + "V2.3.4", + "V2.4.1", + "V3.3.2", + "V3.3.3", + "V3.3.4", + "V3.4.3", + "V3.4.4", + "V3.4.5", + "V3.4.6", + "V3.5.4", + "V3.5.5", + "V3.7.1", + "V3.7.2", + "V4.1.2", + "V4.1.3", + "V4.2.1", + "V4.3.1", + "V4.3.2", + "V4.4.2", + "V4.4.3", + "V4.4.4", + "V5.1.1", + "V5.2.3", + "V5.4.1", + "V5.4.2", + "V5.4.3", + "V6.1.2", + "V6.1.3", + "V6.2.9", + "V6.2.10", + "V6.2.11", + "V6.2.12", + "V6.3.3", + "V6.3.4", + "V6.4.3", + "V6.4.4", + "V6.5.1", + "V6.5.2", + "V6.5.3", + "V6.5.4", + "V6.5.5", + "V6.6.1", + "V6.6.2", + "V6.6.3", + "V6.8.1", + "V6.8.2", + "V6.8.3", + "V6.8.4", + "V7.1.1", + "V7.1.2", + "V7.1.3", + "V7.3.1", + "V7.3.2", + "V7.4.3", + "V7.4.4", + "V7.4.5", + "V7.5.1", + "V7.5.2", + "V7.6.1", + "V7.6.2", + "V8.1.2", + "V8.2.3", + "V8.4.1", + "V9.2.2", + "V9.2.3", + "V9.2.4", + "V10.1.1", + "V10.1.2", + "V10.2.1", + "V10.2.2", + "V10.3.1", + "V10.3.2", + "V10.3.3", + "V10.3.4", + "V10.4.6", + "V10.4.7", + "V10.4.8", + "V10.4.9", + "V10.4.10", + "V10.4.11", + "V10.5.1", + "V10.5.2", + "V10.5.3", + "V10.5.4", + "V10.5.5", + "V10.6.1", + "V10.6.2", + "V10.7.1", + "V10.7.2", + "V10.7.3", + "V11.1.1", + "V11.1.2", + "V11.2.1", + "V11.2.2", + "V11.2.3", + "V11.3.3", + "V11.4.2", + "V11.4.3", + "V11.4.4", + "V11.5.1", + "V11.6.1", + "V12.1.2", + "V12.1.3", + "V12.3.1", + "V12.3.2", + "V12.3.3", + "V12.3.4", + "V13.1.1", + "V13.2.1", + "V13.2.2", + "V13.2.3", + "V13.2.4", + "V13.2.5", + "V13.3.1", + "V13.3.2", + "V13.4.2", + "V13.4.3", + "V13.4.4", + "V13.4.5", + "V14.1.1", + "V14.1.2", + "V14.2.2", + "V14.2.3", + "V14.2.4", + "V14.3.2", + "V14.3.3", + "V15.1.2", + "V15.1.3", + "V15.2.2", + "V15.2.3", + "V15.3.2", + "V15.3.3", + "V15.3.4", + "V15.3.5", + "V15.3.6", + "V15.3.7", + "V16.1.1", + "V16.2.1", + "V16.2.2", + "V16.2.3", + "V16.2.4", + "V16.2.5", + "V16.3.1", + "V16.3.2", + "V16.3.3", + "V16.3.4", + "V16.4.1", + "V16.4.2", + "V16.4.3", + "V16.5.1", + "V16.5.2", + "V16.5.3", + "V17.1.1", + "V17.2.1", + "V17.2.2", + "V17.2.3", + "V17.2.4", + "V17.3.1", + "V17.3.2" + ] + }, + { + "bom-ref": "level-3", + "identifier": "Level 3", + "description": "ASVS Level 3 should be the goal for applications looking to demonstrate the highest levels of security and requirements in this section are generally either defense-in-depth mechanisms or other useful but hard-to-implement controls.", + "requirements": [ + "V1.2.10", + "V1.3.12", + "V1.5.3", + "V2.3.5", + "V2.4.2", + "V3.1.1", + "V3.2.3", + "V3.3.5", + "V3.4.7", + "V3.4.8", + "V3.5.6", + "V3.5.7", + "V3.5.8", + "V3.6.1", + "V3.7.3", + "V3.7.4", + "V3.7.5", + "V4.1.4", + "V4.1.5", + "V4.2.2", + "V4.2.3", + "V4.2.4", + "V4.2.5", + "V5.2.4", + "V5.2.5", + "V5.2.6", + "V5.3.3", + "V6.3.5", + "V6.3.6", + "V6.3.7", + "V6.3.8", + "V6.4.5", + "V6.4.6", + "V6.5.6", + "V6.5.7", + "V6.5.8", + "V6.6.4", + "V6.7.1", + "V6.7.2", + "V7.5.3", + "V8.1.3", + "V8.1.4", + "V8.2.4", + "V8.3.2", + "V8.3.3", + "V8.4.2", + "V10.2.3", + "V10.3.5", + "V10.4.12", + "V10.4.13", + "V10.4.14", + "V10.4.15", + "V10.4.16", + "V11.1.3", + "V11.1.4", + "V11.2.4", + "V11.2.5", + "V11.3.4", + "V11.3.5", + "V11.5.2", + "V11.6.2", + "V11.7.1", + "V11.7.2", + "V12.1.4", + "V12.1.5", + "V12.3.5", + "V13.1.2", + "V13.1.3", + "V13.1.4", + "V13.2.6", + "V13.3.3", + "V13.3.4", + "V13.4.6", + "V13.4.7", + "V14.2.5", + "V14.2.6", + "V14.2.7", + "V14.2.8", + "V15.1.4", + "V15.1.5", + "V15.2.4", + "V15.2.5", + "V15.4.1", + "V15.4.2", + "V15.4.3", + "V15.4.4", + "V16.5.4", + "V17.1.2", + "V17.2.5", + "V17.2.6", + "V17.2.7", + "V17.2.8" + ] + } + ], + "externalReferences": [ + { + "type": "website", + "url": "https://owasp.org/asvs" + }, + { + "type": "vcs", + "url": "https://github.com/OWASP/ASVS" + }, + { + "type": "issue-tracker", + "url": "https://github.com/OWASP/ASVS/issues" + }, + { + "type": "social", + "url": "https://twitter.com/OWASP_ASVS" + } + ] + } + ] + } +} diff --git a/5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.csv b/5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.csv new file mode 100644 index 0000000000..85ef1d1bf0 --- /dev/null +++ b/5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.csv @@ -0,0 +1,347 @@ +chapter_id,chapter_name,section_id,section_name,req_id,req_description,L +V1,Encoding and Sanitization,V1.1,ساختار Encoding and Sanitization,V1.1.1,ورودی فقط یک‌بار به فرم استاندارد decoded یا unescaped شود، و این تنها زمانی انجام شود که انتظار می‌رود داده واقعاً در آن قالب رمزگذاری‌شده دریافت شده باشد. این فرآیند باید قبل از هرگونه پردازش بعدی روی ورودی انجام شود، و به‌هیچ‌وجه نباید پس از اعتبارسنجی یا پاک‌سازی انجام گیرد.,2 +V1,Encoding and Sanitization,V1.1,ساختار Encoding and Sanitization,V1.1.2,برنامه فرآیند encode و escape خروجی را به‌عنوان آخرین مرحله انجام می‌دهد؛ به‌گونه‌ای که این عملیات یا دقیقاً پیش از استفاده داده در مفسر مربوطه انجام شود، یا اینکه خود مفسر به‌طور داخلی این کار را انجام دهد.,2 +V1,Encoding and Sanitization,V1.2,پیشگیری از تزریق,V1.2.1,encoding خروجی برای پاسخ HTTP، سند HTML یا سند XML با زمینه‌ای که داده در آن استفاده می‌شود باید متناسب باشد؛ برای مثال، در رمزگذاری کاراکترهای مربوط به عناصر HTML، صفات HTML، توضیحات HTML، CSS یا فیلدهای هدر HTTP به‌گونه‌ای عمل شود که ساختار پیام یا سند تغییر نکند.,1 +V1,Encoding and Sanitization,V1.2,پیشگیری از تزریق,V1.2.2,هنگام ساخت پویا آدرس‌های URL، داده‌های غیرقابل‌اعتماد باید متناسب با زمینه استفاده‌شان رمزگذاری شوند (مثلاً URL Encoding یا base64url برای پارامترهای کوئری یا مسیر) همچنین اطمینان حاصل شود که فقط پروتکل‌های امن در URL مجاز باشند (برای نمونه، استفاده از JavaScript: یا data: ممنوع شود),1 +V1,Encoding and Sanitization,V1.2,پیشگیری از تزریق,V1.2.3,هنگام تولید پویا محتوای JavaScript (از جملهJSON)، از encoding یا escaping خروجی استفاده شود تا از تغییر ساختار پیام یا سند جلوگیری گردد (و از حملات تزریق JavaScript یا JSON پیشگیری شود).,1 +V1,Encoding and Sanitization,V1.2,پیشگیری از تزریق,V1.2.4,در انتخاب داده یا اجرای کوئری‌های پایگاه داده (مانند SQL، HQL، NoSQL ...)، از parameterized queries، ORMها، یا Entity Framework استفاده شود یا به روش‌های دیگر، برنامه در برابر تزریق SQL و سایر حملات تزریقی پایگاه داده ایمن شده باشد. این موضوع هنگام نوشتن stored procedure‌ها نیز صدق می‌کند.,1 +V1,Encoding and Sanitization,V1.2,پیشگیری از تزریق,V1.2.5,برنامه در برابر تزریق دستورات سیستم‌عامل (OS command injection) محافظت شده است و در فراخوانی‌های سیستم‌عامل، از کوئری‌های پارامتری‌شده سیستم‌عامل یا Encoding خروجی دستورات سیستم‌عاملی استفاده می‌شود.,1 +V1,Encoding and Sanitization,V1.2,پیشگیری از تزریق,V1.2.6,برنامه در برابر آسیب‌پذیری‌های تزریق LDAP محافظت شده است، یا اینکه کنترل‌های امنیتی مشخصی برای جلوگیری از تزریق LDAP پیاده‌سازی شده‌اند.,2 +V1,Encoding and Sanitization,V1.2,پیشگیری از تزریق,V1.2.7,برنامه در برابر حملات تزریقXPath، به‌وسیله‌ی استفاده از کوئری‌های پارامتری‌شده یا کوئری‌های از پیش‌کامپایل‌شده محافظت شده باشد.,2 +V1,Encoding and Sanitization,V1.2,پیشگیری از تزریق,V1.2.8,پردازشگرهای LaTeX به‌صورت امن پیکربندی شده‌اند (برای نمونه با عدم استفاده از گزینه‌ی --shell-escape ) و از فهرست مجاز دستورات (allowlist) برای جلوگیری از حملات تزریق LaTeX استفاده شده است.,2 +V1,Encoding and Sanitization,V1.2,پیشگیری از تزریق,V1.2.9,برنامه کاراکترهای ویژه در عبارات Regex را escape می‌کند (معمولاً با استفاده از \)، تا این کاراکترها به‌اشتباه به‌عنوان متاکاراکتر تفسیر نشوند.,2 +V1,Encoding and Sanitization,V1.2,پیشگیری از تزریق,V1.2.10,برنامه در برابر حملات تزریق CSV و فرمول (Formula Injection) محافظت شده است. برنامه باید هنگام خروجی‌ گرفتن فایل‌های CSV، از قوانین escape تعیین‌شده در بخش‌های ۲.۶ و ۲.۷ استاندارد RFC 4180 پیروی کند. همچنین، هنگام خروجی گرفتن به فرمت CSV یا سایر فرمت‌های صفحه‌گسترده (مانند XLS، XLSX یا ODF)، اگر کاراکترهای ویژه‌ای مانند '='، '+'، '-'، '@'، \t (tab) و 0\ (Null character) در ابتدای مقدار یک فیلد قرار داشته باشند، باید با یک تک‌کوتیشن (') escape شوند.,3 +V1,Encoding and Sanitization,V1.3,پاک‌سازی (Sanitization),V1.3.1,تمام ورودی‌های HTML غیرقابل اعتماد (مثلاً از طریق ویرایشگرهای WYSIWYG یا ابزارهای مشابه)، با استفاده از یک کتابخانه یا قابلیت امن و معتبر sanitization (پاک‌سازی) ‌شوند.,1 +V1,Encoding and Sanitization,V1.3,پاک‌سازی (Sanitization),V1.3.2,برنامه استفاده از تابعeval یا سایر قابلیت‌های اجرای پویا (dynamic) کد، مانند Spring Expression Language (SpEL)، اجتناب ‌کند. در مواردی که استفاده از این قابلیت‌ها اجتناب‌ناپذیر است، ورودی‌های کاربر که در اجرای کد گنجانده می‌شوند باید پیش از اجرا، به‌طور کامل پاک‌سازی (sanitized) شوند.,1 +V1,Encoding and Sanitization,V1.3,پاک‌سازی (Sanitization),V1.3.3,بخش‌های حائز اهمیت که احتمال وقوع حملات ناشی از ورودی‌های کاربر در آنها بالاست؛ باید پیشاپیش عملیاتSanitization جهت اقدامات ایمنی روی داده‌ها انجام شود؛ برای مثال، تنها کاراکترهایی که برای آن محتوا ایمن محسوب می‌شوند مجاز باشند، و ورودی‌های بیش‌از‌حد بلند نیز کوتاه (trim) شوند.,2 +V1,Encoding and Sanitization,V1.3,پاک‌سازی (Sanitization),V1.3.4,محتوای اسکریپت‌پذیر (scriptable) فایل‌های SVG که توسط کاربر ارائه می‌شود، مورد اعتبارسنجی یا پاک‌سازی (sanitization) قرار گرفته باشد تا فقط شامل تگ‌ها و ویژگی‌هایی (attributes) باشد که برای برنامه ایمن هستند؛ برای مثال، از درج اسکریپت‌ها و عناصر خطرناک مانند foreignObject جلوگیری شده باشد.,2 +V1,Encoding and Sanitization,V1.3,پاک‌سازی (Sanitization),V1.3.5,برنامه محتوای زبان‌های قالب‌نویسی یا اسکریپت‌پذیر ارائه‌شده توسط کاربر، مانند Markdown، CSS یا استایل‌شیت‌های XSL، BBCode یا موارد مشابه را پاک‌سازی (sanitize) کرده یا غیرفعال کرده باشد.,2 +V1,Encoding and Sanitization,V1.3,پاک‌سازی (Sanitization),V1.3.6,برنامه در برابر حملات جعل درخواست سمت سرور (SSRF) محافظت شده باشد؛ به این صورت که داده‌های غیرقابل اعتماد را در برابر یک لیست مجاز از پروتکل‌ها، دامنه‌ها، مسیرها و پورت‌ها اعتبارسنجی کرده و کاراکترهای بالقوه خطرناک را پیش از استفاده از داده برای فراخوانی سرویس دیگر پاک‌سازی (sanitize) می‌کند.,2 +V1,Encoding and Sanitization,V1.3,پاک‌سازی (Sanitization),V1.3.7,برنامه در برابر حملات تزریق قالب (Template Injection) محافظت شده باشد؛ به این صورت که ساخت قالب‌ها بر پایه داده‌های غیرقابل اعتماد مجاز نباشد. در صورتی که هیچ راه‌حل جایگزینی وجود نداشته باشد، هرگونه ورودی غیرقابل اعتماد که به‌صورت پویا در فرآیند ایجاد قالب وارد می‌شود، باید پیش از استفاده یا پاک‌سازی (sanitize) شود یا به‌صورت سخت‌گیرانه اعتبارسنجی (validate) گردد.,2 +V1,Encoding and Sanitization,V1.3,پاک‌سازی (Sanitization),V1.3.8,برنامه، ورودی غیرقابل اعتماد را پیش از استفاده در کوئری‌های Java Naming and Directory Interface (JNDI) به‌درستی پاک‌سازی (sanitize) می‌کند و همچنین اطمینان حاصل شود که پیکربندی JNDI به‌گونه‌ای امن انجام شده تا از بروز حملات تزریق JNDI جلوگیری شود.,2 +V1,Encoding and Sanitization,V1.3,پاک‌سازی (Sanitization),V1.3.9,برنامه، محتوا را پیش از ارسال به memcache پاک‌سازی (sanitize) می‌کند تا از حملات تزریق (injection attacks) جلوگیری شود.,2 +V1,Encoding and Sanitization,V1.3,پاک‌سازی (Sanitization),V1.3.10,رشته‌های قالب‌بندی (format strings) که ممکن است هنگام استفاده، به‌شکلی ناخواسته یا مخرب تفسیر شوند، پیش از پردازش پاک‌سازی (sanitize) شوند.,2 +V1,Encoding and Sanitization,V1.3,پاک‌سازی (Sanitization),V1.3.11,برنامه ورودی‌های کاربر را پیش از ارسال به سامانه‌های ایمیل (مانند SMTP یا IMAP) پاک‌سازی (sanitize) ‌کند تا از حملات تزریق در SMTP یا IMAP جلوگیری شود.,2 +V1,Encoding and Sanitization,V1.3,پاک‌سازی (Sanitization),V1.3.12,عبارات منظم (Regular Expressions) عاری از اجزایی هستند که باعث بازگشت‌پذیری نمایی (exponential backtracking) می‌شوند، و همچنین ورودی‌های غیرقابل اعتماد به‌درستی پاک‌سازی (sanitize) شوند تا از حملات ReDoS (انکار سرویس با استفاده از عبارات منظم) یا Runaway Regex جلوگیری گردد.,3 +V1,Encoding and Sanitization,V1.4,"حافظه، رشته و کد بدون مدیریت (Memory, String, and Unmanaged Code)",V1.4.1,برنامه از رشته‌های ایمن از نظر مدیریت حافظه، کپی حافظه‌ای ایمن‌تر و حساب‌گری ایمن‌تر روی اشاره‌گرها استفاده می‌کند تا از سرریز پشته (stack overflow)، سرریز بافر (buffer overflow) یا سرریز حافظه پویای (heap overflow) جلوگیری کرده یا آن‌ها را شناسایی کند.,2 +V1,Encoding and Sanitization,V1.4,"حافظه، رشته و کد بدون مدیریت (Memory, String, and Unmanaged Code)",V1.4.2,از تکنیک‌های اعتبارسنجی علامت (sign validation)، محدوده (range validation) و ورودی (input validation) استفاده شده است تا از بروز سرریز عدد صحیح (integer overflow) جلوگیری شود.,2 +V1,Encoding and Sanitization,V1.4,"حافظه، رشته و کد بدون مدیریت (Memory, String, and Unmanaged Code)",V1.4.3,حافظه و منابعی که به‌صورت پویا تخصیص داده شده‌اند، به‌درستی آزاد (release) می‌شوند و همچنین ارجاع‌ها یا اشاره‌گرها (pointers) به حافظه آزادشده حذف یا به null تنظیم می‌شوند تا از اشاره‌گرهای معلق (dangling pointers) و آسیب‌پذیری‌های استفاده پس از آزادسازی (use-after-free) جلوگیری شود.,2 +V1,Encoding and Sanitization,V1.5,سریال‌زدایی ایمن (Safe Deserialization),V1.5.1,برنامه، XML Parserها را به‌گونه‌ای پیکربندی کرده باشد که از تنظیمات محدودکننده استفاده کنند، و ویژگی‌های ناایمنی مانند resolve کردن موجودیت‌های خارجی (external entities) غیرفعال شده باشند تا از حملات XML External Entity (XXE) جلوگیری شود.,1 +V1,Encoding and Sanitization,V1.5,سریال‌زدایی ایمن (Safe Deserialization),V1.5.2,فرآیند deserialization داده‌های غیرقابل‌اعتماد، با اجرای مدیریت ایمن ورودی‌ها همراه باشد؛ برای مثال، استفاده از لیست مجاز (allowlist) انواع objectها یا محدود کردن انواع تعریف‌شده توسط کلاینت برای جلوگیری از حملات مرتبط با deserialization. همچنین، مکانیزم‌های deserialization که به‌طور صریح به‌عنوان ناایمن شناخته شده‌اند، نباید با داده‌های غیرقابل‌اعتماد مورد استفاده قرار گیرند.,2 +V1,Encoding and Sanitization,V1.5,سریال‌زدایی ایمن (Safe Deserialization),V1.5.3,Parser های مختلفی که در برنامه برای یک نوع داده مشخص استفاده می‌شوند (برای مثال: Parser های JSON، XML یا URL)، رفتار تحلیلی یکسانی دارند و از مکانیزم یکسانی برای encoding کاراکترها استفاده می‌کنند، تا از بروز مشکلاتی مانند آسیب‌پذیری در سازگاری JSON (JSON Interoperability) یا تفاوت در نحوه تحلیل URI یا مسیر فایل که ممکن است در حملات RFI یا SSRF سوءاستفاده شود، جلوگیری شود.,3 +V2,Validation and Business Logic,V2.1,مستندات اعتبارسنجی و منطق کسب‌وکار ( Validation and Business Logic Documentation),V2.1.1,قوانین اعتبارسنجی ورودی‌های برنامه (مندرج در مستندات برنامه) ‌باید چگونگی بررسی صحت داده‌ها را مطابق با ساختار مورد انتظار مشخص نماید. این ساختار می‌تواند شامل فرمت‌های رایج داده مانند شماره کارت اعتباری، آدرس ایمیل، شماره تلفن یا یک قالب داده‌ای داخلی باشد.,1 +V2,Validation and Business Logic,V2.1,مستندات اعتبارسنجی و منطق کسب‌وکار ( Validation and Business Logic Documentation),V2.1.2,قوانین اعتبارسنجی ورودی‌های برنامه (مندرج در مستندات برنامه) باید چگونگی بررسی سازگاری مناسب بین داده‌‌های ترکیب شده (از نظر مفهومی و متنی) را مشخص نماید؛ مانند تطبیق کدپستی با نام محله.,2 +V2,Validation and Business Logic,V2.1,مستندات اعتبارسنجی و منطق کسب‌وکار ( Validation and Business Logic Documentation),V2.1.3,انتظارات مربوط به محدودیت‌ها و اعتبارسنجی‌های منطق کسب و کار مستند شده باشند؛ این مستندات باید شامل محدودیت‌ها در سطح هر کاربر و محدودیت‌های عمومی در سطح برنامه باشند.,2 +V2,Validation and Business Logic,V2.2,اعتبارسنجی ورودی (Input Validation),V2.2.1,ورودی‌ها باید به‌منظور اعمال انتظارات کسب و کار یا عملکردی مرتبط با آن‌ها اعتبارسنجی ‌شوند.این اعتبارسنجی باید یکی از این دو روش زیر را داشته باشد، استفاده از اعتبارسنجی مثبت (Positive Validation) مبتنی بر فهرست مجاز از مقادیر، الگوها یا بازه‌های قابل قبول و تطبیق با ساختار مورد انتظار و محدودیت‌های منطقی، بر اساس قوانین از پیش تعریف‌شده. برای سطح 1 (L1)، تمرکز می‌تواند بر ورودی‌هایی باشد که در تصمیم‌گیری‌های خاص تجاری یا امنیتی استفاده می‌شوند. برای سطح 2 و بالاتر، این اعتبارسنجی باید شامل تمام ورودی‌ها باشد.,1 +V2,Validation and Business Logic,V2.2,اعتبارسنجی ورودی (Input Validation),V2.2.2,برنامه به‌گونه‌ای طراحی شود که اعتبارسنجی ورودی را در لایه‌ قابل اعتمادی از سرویس (Trusted Service Layer) اعمال کند. هرچند اعتبارسنجی سمت کلاینت (Client-side Validation) باعث بهبود تجربه کاربری می‌شود و توصیه می‌گردد، اما نباید به‌عنوان یک کنترل امنیتی اتکا شود.,1 +V2,Validation and Business Logic,V2.2,اعتبارسنجی ورودی (Input Validation),V2.2.3,برنامه باید اطمینان حاصل نماید که ترکیب داده‌های مربوطه با توجه به قوانین از پیش تعریف‌شده معقول و منطقی باشد.,2 +V2,Validation and Business Logic,V2.3,امنیت منطق کسب‌وکار (Business Logic Security),V2.3.1,اطمینان حاصل شود که برنامه فقط جریان‌های منطق تجاری را برای همان کاربر و طبق ترتیب گام‌به‌گام از پیش تعیین شده و مورد انتظار پردازش می‌کند و امکان رد کردن مراحل (Skipping Steps) وجود ندارد.,1 +V2,Validation and Business Logic,V2.3,امنیت منطق کسب‌وکار (Business Logic Security),V2.3.2,اطمینان حاصل شود که محدودیت‌های منطق تجاری مطابق با مستندات برنامه پیاده‌سازی شده‌اند، تا از سوء‌استفاده از نقص‌های منطقی جلوگیری شود.,2 +V2,Validation and Business Logic,V2.3,امنیت منطق کسب‌وکار (Business Logic Security),V2.3.3,تراکنش‌های سطح منطق کسب‌وکار (business logic) باید به‌گونه‌ای استفاده شوند که یا یک عملیات منطق کسب‌وکار به‌طور کامل با موفقیت انجام شود، یا در صورت بروز خطا، به حالت صحیح قبلی بازگردد(rollback) شود.,2 +V2,Validation and Business Logic,V2.3,امنیت منطق کسب‌وکار (Business Logic Security),V2.3.4,در منطق کسب‌وکار (business logic)باید از مکانیزم‌های قفل‌گذاری (locking) استفاده شده باشد تا اطمینان حاصل شود که منابع محدود (مانند صندلی‌های سینما یا بازه‌های زمانی تحویل)، قابل رزرو دوباره (double-booked) از طریق دستکاری منطق برنامه نباشند.,2 +V2,Validation and Business Logic,V2.3,امنیت منطق کسب‌وکار (Business Logic Security),V2.3.5,اطمینان حاصل شود که جریان‌های منطق کسب و کاری با ارزش بالا نیازمند تایید چند کاربره (Multi-user Approval) هستند تا از اقدامات غیرمجاز یا تصادفی جلوگیری شود. این موارد می‌تواند شامل – اما نه محدود به – انتقال‌های مالی بزرگ، تایید قرارداد‌ها، دسترسی به اطلاعات طبقه‌بنده شده، یا غیرفعال‌سازی‌های ایمنی در محیط‌های تولید صنعتی باشد.,3 +V2,Validation and Business Logic,V2.4,مقابله با خودکارسازی (Anti-automation),V2.4.1,کنترل‌های ضد خودکارسازی (Anti-Automation) در سیستم پیاده‌سازی شده باشند تا از سوءاستفاده‌هایی مانند فراخوانی بیش از حد توابع برنامه جلوگیری شود؛ چرا که این نوع حملات می‌توانند منجر به استخراج غیرمجاز داده‌ها، تولید داده‌های زائد، مصرف کامل سهمیه‌ها، عبور از محدودیت‌های نرخ (Rate Limit)، ایجاد اختلال در سرویس (DoS) یا استفاده بیش از حد از منابع گران‌قیمت شوند.,2 +V2,Validation and Business Logic,V2.4,مقابله با خودکارسازی (Anti-automation),V2.4.2,بررسی کنید که جریان‌های منطق کسب‌وکار (Business Logic Flows) به گونه‌ای طراحی شده باشند که نیازمند زمان‌بندی واقعی انسان باشند، و از ارسال سریع و غیرطبیعی تراکنش‌ها (Transaction Submissions) جلوگیری کنند.,3 +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.1,مستندسازی امنیت رابط کاربری وب ( Web Frontend Security Documentation),V3.1.1,در مستندات برنامه باید ویژگی‌های امنیتی مربوط به مرورگری که برنامه را اجرا میکند مشخص شده باشد (نظیر استفاده از HTTPS، پشتیبانی از HTTP Strict Transport Security (HSTS)، اجرای Content Security Policy (CSP) و سایر مکانیزم‌های امنیتی مرتبط با HTTP). همچنین در مستندات باید مشخص شود مرورگر در صورت عدم دسترسی به این ویژگی‌ها چه رفتاری باید داشته باشد. (برای مثال: نمایش هشدار به کاربر یا ممانعت از دسترسی به برنامه).,3 +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.2,تفسیر ناخواسته محتوا (Unintended Content Interpretation),V3.2.1,کنترل‌های امنیتی متناسب با مرورگر‌ها در هنگام پردازش پاسخ‌های HTTP به منظور جلوگیری از پردازش محتوا یا عملکرد مربوط به آن در شرایط زمینه‌‌ای نادرست باید بکار‌گرفته شود. (برای مثال، زمانی که یک APIیا یک فایل بارگذاری‌شده توسط کاربر یا هر منبع دیگری به‌طور مستقیم درخواست می‌شود).کنترل‌های ممکن می‌توانند شامل این موارد باشند: عدم پردازش محتوا مگر در صورت وجود هدرهای متناسب با درخواست‌های HTTP (مانند ‎Sec-Fetch-*) به منظور اطمیان از صحیح بودن پردازش محتوا یا عملکرد مربوط به . استفاده از عبارت sandbox در هدر Content-Security-Policy یا استفاده از نوعattachment در هدر Content-Disposition .,1 +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.2,تفسیر ناخواسته محتوا (Unintended Content Interpretation),V3.2.2,اطمینان حاصل شود که محتوایی که برای نمایش به‌صورت متن طراحی شده نه برای پردازش به صورتHTML ، با استفاده از توابع امن نظیر CreateTextNode یا textContent به منظور جلوگیری از اجرای ناخواسته محتوایی مانند HTML یا JavaScript پردازش ‌شود.,1 +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.2,تفسیر ناخواسته محتوا (Unintended Content Interpretation),V3.2.3,برنامه هنگام استفاده از جاوااسکریپت سمت کاربر (Client-Side JavaScript)، با استفاده از اعلام متغیرها به‌صورت صریح، انجام بررسی نوع به‌صورت سخت‌گیرانه، اجتناب از ذخیره‌سازی متغیرهای سراسری بر روی شیء document، و پیاده‌سازی ایزولاسیون فضای نام (namespace isolation)، از وقوع DOM Clobbering جلوگیری می‌کند.,3 +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.3,پیکربندی کوکی (Cookie Setup),V3.3.1,اطمینان حاصل شود که کوکی‌ها دارای ویژگی ‘Secure’ هستند. در صورتی که از پیشوند ‘__Host-’ برای نام کوکی استفاده نمی‌شود، باید پیشوند__Secure- در نام کوکی لحاظ شده باشد.,1 +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.3,پیکربندی کوکی (Cookie Setup),V3.3.2,اطمینان حاصل شود که مقدار ویژگی SameSite برای هر کوکی، متناسب با هدف آن کوکی تنظیم شده باشد تا میزان آسیب‌پذیری در برابر حملات فریب سمت کلاینت نظیر CSRF کاهش یابد.,2 +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.3,پیکربندی کوکی (Cookie Setup),V3.3.3,اطمینان حاصل شود که کوکی‌ها از پیشوند __Host- در نام خود استفاده می‌کنند، مگر در مواردی که کوکی به‌طور مشخص برای اشتراک‌گذاری بین چند دامنه (Hosts) طراحی شده باشد.,2 +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.3,پیکربندی کوکی (Cookie Setup),V3.3.4,اطمینان حاصل شود که اگر مقدار کوکی (مثلاً توکن نشست) نباید برای اسکریپت‌های سمت کلاینت در دسترس باشد، ویژگی HttpOnly باید برای آن کوکی فعال شده باشد، و همچنین مقدار کوکی (مثلاً همان توکن نشست) تنها از طریق هدر Set-Cookie به کلاینت ارسال شود.,2 +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.3,پیکربندی کوکی (Cookie Setup),V3.3.5,اطمینان حاصل شود که حداکثر مجموع نام و مقدار کوکی از ۴۰۹۶ بایت تجاوز نکند.کوکی‌هایی که بیش از این مقدار باشند توسط مرورگر ذخیره نخواهند شد، و بنابراین در درخواست‌ها ارسال نمی‌شوند؛ موضوعی که ممکن است باعث شود عملکردهایی از برنامه که به آن کوکی وابسته‌اند، غیرفعال یا مختل شوند.,3 +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.4,هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers),V3.4.1,اطمینان حاصل شود که در تمامی پاسخ‌های HTTP، هدر Strict-Transport-Security وجود دارد تا سیاست HSTS (HTTP Strict Transport Security) اعمال شود. حداقل مقدار max-age باید برابر با یک سال باشد. برای برنامه‌های سطح 2 (L2) و بالاتر، این سیاست باید برای تمام زیردامنه‌ها (subdomains) نیز اعمال شود.,1 +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.4,هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers),V3.4.2,اطمینان حاصل شود که هدرAccess-Control-Allow-Origin مربوط به (CORS)، دارای یک مقدار ثابت و مشخص توسط برنامه باشد یا اگر هدر Origin در درخواست مورد استفاده قرار می گیرد باید با فهرستی از مبدأهای مورد اعتماد (Allowlist) اعتبارسنجی شود. در صورتی که استفاده از مقدار * در Access-Control-Allow-Origin تنظیم شده باشد، اطمینان حاصل شود که هیچ اطلاعات حساسی در پاسخ قرار ندارد.,1 +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.4,هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers),V3.4.3,اطمینان حاصل شود که تمامی پاسخ‌های HTTP شامل هدر Content-Security-Policy باشند تا ریسک اجرای اسکریپت‌های مخرب (مانند (JavaScript مخرب کاهش یابد. دستورهای object-src 'none' و base-uri 'none' الزامی هستند .برای برنامه‌های سطح 3 (L3)، باید سیاست CSP به‌صورت اختصاصی برای هر پاسخ(Per-response Policy) و مبتنی بر nonce یا hash تعریف شده باشد.,2 +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.4,هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers),V3.4.4,اطمینان حاصل شود که تمامی پاسخ‌ها شامل هدر X-Content-Type-Options: nosniff باشند، این (هدر) به مرورگرها دستور می‌دهد که برای پاسخ دریافتی از Content Sniffing یا حدس‌زدن نوع محتوا (MIME Type Guessing) استفاده نکنند و آن‌ها را ملزم می‌کند که نوع محتوای واقعی را دقیقاً مطابق مقدار هدر Content-Type در درخواست/پاسخ در نظر بگیرند.برای مثال، پاسخ به یک درخواست برای یک فایل استایل (CSS) تنها در صورتی پذیرفته می‌شود که مقدار Content-Type در پاسخ 'text/css' باشد.این کار همچنین امکان استفاده از قابلیت مسدودسازی خواندن منابع از مبدا متفاوت Cross-Origin Read Blocking یا (CORB) توسط مرورگر را فراهم می‌سازد.,2 +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.4,هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers),V3.4.5,"برنامه باید (وب‌سایت یا اپلیکیشن) یک ""Referrer Policy"" (سیاست ارجاع) تنظیم کرده باشد تا از نشت اطلاعات حساس از طریق هدر HTTP به نام Referer به سرویس‌های شخص ثالث جلوگیری شود. این کار را می‌توان از طریق هدر پاسخ HTTP به نام Referrer-Policy یا با استفاده از ویژگی‌هایی در عناصر HTML انجام داد.اطلاعات حساس ممکن است شامل مسیر (Path) و داده‌های کوئری (Query) در آدرس URL باشد، و در مورد برنامه‌های داخلی و غیرعمومی، حتی نام میزبان (hostname) نیز می‌تواند جزو اطلاعات حساس محسوب شود.",2 +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.4,هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers),V3.4.6,برنامه باید از frame-ancestors در هدر Content-Security-Policy (CSP) برای تمام پاسخ‌های HTTP استفاده کند،تا به‌صورت پیش‌فرض، اجازه‌ی نمایش سایت در قالب iframe داده نشود، و فقط در صورت نیاز، نمایش منابع خاص (specific resources) در iframe مجاز باشد.به این نکته توجه کنید که هدر X-Frame-Options با اینکه هنوز توسط برخی مرورگرها پشتیبانی می‌شود، اما قدیمی (obsolete) است و نباید به آن تکیه کرد.,2 +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.4,هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers),V3.4.7,هدر Content-Security-Policy (CSP) باید شامل یک آدرس برای گزارش (Report violation) باشد.,3 +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.4,هدرهای مکانیزم‌های امنیتی مرورگر (Browser Security Mechanism Headers),V3.4.8,تمام پاسخ‌های HTTP که باعث رندر (نمایش) یک سند می‌شوند مانند (پاسخ‌هایی با نوع محتوا (text/html باید شامل هدر Cross-Origin-Opener-Policy با دستور same-origin یا same-origin-allow-popups باشند (بنا به نیاز). این کار از حملاتی جلوگیری می‌کند که از دسترسی مشترک به اشیای Window سوءاستفاده می‌کنند، مانند حملات tabnabbing و frame counting.,3 +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.5,تفکیک مبدا توسط مرورگر (Browser Origin Separation),V3.5.1,برنامه باید از مکانیزم Preflight در CORS برای جلوگیری از درخواست‌های cross-origin به عملکردهای حساس استفاده نمی‌کند، این درخواست‌ها به‌گونه‌ای اعتبارسنجی شوند که فقط از مبدأ اصلی برنامه ارسال شده باشند. این اعتبارسنجی می‌تواند با استفاده از توکن‌های (anti- forgery tokens) یا الزام به ارسال هدرهای HTTP اضافی انجام شود که در لیست هدرهای مجاز CORS (CORS-safelisted) قرار ندارند. این اقدام برای محافظت در برابر حملات جعل درخواست از طریق مرورگر، که با نام CSRF (Cross-Site Request Forgery) شناخته می‌شوند، ضروری است.,1 +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.5,تفکیک مبدا توسط مرورگر (Browser Origin Separation),V3.5.2,اگر برنامه برای جلوگیری از استفاده غیرمجاز cross-origin از عملکردهای حساس، به مکانیزم Preflight در CORS متکی است، باید امکان فراخوانی این عملکردها با درخواست‌هایی که باعث ایجاد Preflight نمی‌شوند، وجود نداشته باشد. برای تحقق این هدف ممکن است لازم باشد مقدار هدرهای Origin و Content-Type بررسی شوند یا از هدر اضافی استفاده شود که در لیست هدرهای مجاز CORS قرار ندارد.,1 +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.5,تفکیک مبدا توسط مرورگر (Browser Origin Separation),V3.5.3,"برنامه باید درخواست‌های HTTP که به عملکردهای حساس از متدهای مناسب مانند POST، PUT، PATCH یا DELETE استفاده می‌کنند، و نه از متدهایی که در استاندارد HTTP به‌عنوان ""ایمن"" تعریف شده‌اند، مانند GET، HEAD یا .OPTIONS به عنوان جایگزین یا مکمل، می‌توان از بررسی سخت‌گیرانه هدرهای Sec-Fetch-* استفاده کرد تا اطمینان حاصل شود که درخواست از منبع نامناسبی مثل بارگذاری تصویر، ناوبری صفحه یا فراخوانی cross-origin ارسال نشده است.",1 +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.5,تفکیک مبدا توسط مرورگر (Browser Origin Separation),V3.5.4,برنامه‌های مجزا باید روی نام‌های دامنه (hostname) متفاوت میزبانی شده‌اند تا از محدودیت‌های ارائه‌شده توسط (Same-Origin Policy) بهره‌مند شوند. این شامل کنترل تعامل اسناد یا اسکریپت‌های بارگذاری‌شده از یک مبدأ با منابع مبدأ دیگر و اعمال محدودیت بر اساس دامنه برای کوکی‌ها می‌شود.,2 +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.5,تفکیک مبدا توسط مرورگر (Browser Origin Separation),V3.5.5,برنامه باید پیام‌های دریافت‌شده از طریق رابط postMessage در صورتی که مبدأ پیام مورد اعتماد نباشد یا ساختار پیام نامعتبر باشد، نادیده گرفته می‌شوند.,2 +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.5,تفکیک مبدا توسط مرورگر (Browser Origin Separation),V3.5.6,هیچ‌کجای برنامه از قابلیت JSONP استفاده نشود تا از حملات Cross-Site Script Inclusion (XSSI) جلوگیری شود.,3 +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.5,تفکیک مبدا توسط مرورگر (Browser Origin Separation),V3.5.7,داده‌هایی که نیاز به احراز هویت دارند، در پاسخ‌های مربوط به منابع اسکریپتی(مانند فایل‌های (JavaScript نباید قرار بگیرند تا از حملات XSSI جلوگیری شود.,3 +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.5,تفکیک مبدا توسط مرورگر (Browser Origin Separation),V3.5.8,اطمینان حاصل کنید که منابع احراز هویت‌شده (مانند تصاویر، ویدیوها، اسکریپت‌ها و سایر اسناد) فقط در مواقعی که هدف آن است، قابل بارگذاری یا جاسازی توسط کاربر باشند. این کار را می‌توان با اعتبارسنجی دقیق هدرهای HTTP مانند Sec-Fetch-* انجام داد تا اطمینان حاصل شود که درخواست از یک منبع غیرمجاز ارسال نشده است، یا با تنظیم هدر Cross-Origin-Resource-Policy برای محدود کردن دسترسی مرورگر به محتوا.,3 +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.6,یکپارچگی منابع خارجی (External Resource Integrity),V3.6.1,منابع سمت کلاینت مانند کتابخانه‌های جاوااسکریپت، فایل‌های CSS، یا فونت‌های وب، تنها در صورتی به‌صورت خارجی (مثلاً از طریق شبکه تحویل محتوا - CDN) میزبانی شوند که آن منابع: استاتیک (تغییرناپذیر) باشند، نسخه‌گذاری‌شده (versioned) باشند و یکپارچگی آن‌ها با استفاده از Subresource Integrity (SRI) بررسی شود. اگر این موارد امکان‌پذیر نیست، باید برای هر منبع، یک تصمیم امنیتی مستند وجود داشته باشد که توجیه کند چرا این منبع به این شکل بارگذاری می‌شود.,3 +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.7,سایر ملاحظات امنیتی مرورگر (Other Browser Security Considerations),V3.7.1,برنامه صرفا باید از فناوری‌های سمت کلاینتی استفاده ‌کند که همچنان پشتیبانی می‌شوند و از نظر امنیتی قابل اعتماد هستند.مثال‌هایی از فناوری‌هایی که این الزام را برآورده نمی‌کنند عبارتند از NSAPI Plugins،Flash،Shockwave،ActiveX،Silverlight،NACL و Appletهای جاوا در سمت کلاینت,2 +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.7,سایر ملاحظات امنیتی مرورگر (Other Browser Security Considerations),V3.7.2,برنامه فقط زمانی کاربر را به دامنه‌ها یا hostnameهای دیگر (که تحت کنترل برنامه نیستند) به صورت خودکار هدایت می‌کند، که آن مقصد در یک فهرست مجاز (allowlist) قرار داشته باشد.,2 +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.7,سایر ملاحظات امنیتی مرورگر (Other Browser Security Considerations),V3.7.3,برنامه باید هنگام ریدایرکت کاربر به یک URL که خارج از کنترل برنامه است، یک پیام هشدار نشان می‌دهد و امکان لغو آن را به کاربر می‌دهد.,3 +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.7,سایر ملاحظات امنیتی مرورگر (Other Browser Security Considerations),V3.7.4,باید دامنه اصلی برنامه، مثلاً (site.tld) به فهرست preload عمومی HSTS اضافه شده باشد.,3 +V3,امنیت رابط کاربری وب (Web Frontend Security),V3.7,سایر ملاحظات امنیتی مرورگر (Other Browser Security Considerations),V3.7.5,اگر مرورگر کاربر از ویژگی‌های امنیتی مورد انتظار برنامه پشتیبانی نمی‌کند، برنامه رفتار مناسبی داشته باشد، مثل هشدار دادن به کاربر یا مسدود کردن دسترسی.,3 +V4,API and Web Service,V4.1,Generic Web Service Security,V4.1.1,"اطمینان حاصل شود که در هر پاسخ HTTP که شامل Body می باشد، هدر Content-Type وجود داشته باشد که نوع آن، با محتوای پاسخ دریافتی از سرور مطابقت داشته باشد. این هدر باید شامل پارامتر charset نیز باشد تا رمزگذاری کاراکتر ایمن (مانند UTF-8 یا ISO-8859-1) را مشخص کند. این مقادیر باید مطابق با استاندارد IANA Media Types باشند؛ برای مثال، انواعی مانند ""text/، /+xml"" و ""/xml"" را در بر می‌گیرند.",1 +V4,API and Web Service,V4.1,Generic Web Service Security,V4.1.2,اطمینان حاصل شود که تنها نقاط پایانی که برای استفاده کاربر نهایی از طریق مرورگر طراحی شده‌اند (User-Facing Endpoints) به‌صورت خودکار از HTTP به HTTPS هدایت ‌شوند، سایر سرویس‌ها یا نقاط پایانی نباید (ریدایرکت شفاف، Transparent Redirect) داشته باشند. این اقدام برای جلوگیری از وضعیتی است که در آن یک کلاینت به اشتباه درخواست‌های رمزنگاری‌نشده (HTTP) ارسال می‌کند، اما چون این درخواست‌ها به‌طور خودکار به HTTPS ریدایرکت می‌شوند، نشت احتمالی داده‌های حساس پنهان خواهد ماند.,2 +V4,API and Web Service,V4.1,Generic Web Service Security,V4.1.3,اطمینان حاصل شود که هدرهای HTTP که در برنامه استفاده می شود و توسط یک لایه واسطه، مانند یکload balancer ، یک پروکسی وب یا یک سرویس backend-for-frontend تنظیم شده است نمی‌تواند توسط کاربر نهایی بازنویسی شود. هدرهای نمونه ممکن است شامل X-Real-IP، X-Forwarded-* یا X-User-ID باشند.,2 +V4,API and Web Service,V4.1,Generic Web Service Security,V4.1.4,اطمینان حاصل شود که فقط متدهای HTTP که صریحاً توسط برنامه یا API آن پشتیبانی می‌شوند (از جمله OPTIONS در درخواست‌های preflight) می‌توانند مورد استفاده قرار گیرند و متدهای استفاده نشده مسدود شوند.,3 +V4,API and Web Service,V4.1,Generic Web Service Security,V4.1.5,اطمینان حاصل شود که برای درخواست‌ها یا تراکنش‌هایی که بسیار حساس هستند یا از چندین سامانه عبور می‌کنند، از امضاهای دیجیتال در سطح پیام استفاده شود تا اطمینان امنیتی بیشتری علاوه بر محافظت‌های سطح انتقال (مانند TLS) فراهم گردد.,3 +V4,API and Web Service,V4.2,HTTP Message Structure Validation,V4.2.1,اطمینان حاصل شود که تمامی اجزای برنامه )از جمله لود بالانسرها، فایروال‌ها و سرورهای اپلیکیشن( مرزهای پیام‌های HTTP ورودی را با استفاده از مکانیزم مناسب نسخه های HTTP تعیین می‌کنند تا از حملات HTTP request smuggling جلوگیری شود. در HTTP/1.x اگر هدر Transfer-Encoding وجود داشته باشد، هدر Content-Length باید مطابق RFC 2616 نادیده گرفته شود. در مقابل، هنگام استفاده از HTTP/2 یا HTTP/3، اگر هدر Content-Length وجود داشته باشد، گیرنده باید اطمینان حاصل کند که این مقادیر با طول فریم‌های DATA سازگار می‌باشد.,2 +V4,API and Web Service,V4.2,HTTP Message Structure Validation,V4.2.2,اطمینان حاصل شود که هنگام تولید پیام‌های HTTP، هدر Content-Length با طول محتوایی که توسط چارچوب‌بندی پروتکل HTTP تعیین می‌شود، تداخل نداشته باشد تا از حملات request smuggling جلوگیری شود.,3 +V4,API and Web Service,V4.2,HTTP Message Structure Validation,V4.2.3,اطمینان حاصل شود برنامه، پیام‌های HTTP/2 یا HTTP/3 با هدرهای connection-specific مانند Transfer-Encoding را به منظور جلوگیری از حملات response splitting یا header injection ارسال یا قبول نمی کند.,3 +V4,API and Web Service,V4.2,HTTP Message Structure Validation,V4.2.4,"اطمینان حاصل شود برنامه تنها درخواست های HTTP/2 and HTTP/3 که هدرها و مقادیر آن شامل هیچ توالی CR (\r), LF (\n), CRLF (\r\n) نباشد را می پذیرد تا از حملات header injection جلوگیری کند.",3 +V4,API and Web Service,V4.2,HTTP Message Structure Validation,V4.2.5,اطمینان حاصل کنید که اگر برنامه (Frontend or Backend) اقدام به ساخت و ارسال درخواست‌های HTTP می کند از مکانیزم های validation ، sanitization یا سایر مکانیزم‌ها استفاده کند تا از ایجاد URIها (مانند فراخوانیAPI ) یا فیلدهای هدر درخواست HTTP (مانند Authorization یا( Cookie که بیش از حد مجاز، طولانی هستند، جلوگیری شود که منجر به عدم پذیرش درخواست توسط مولفه دریافت کننده(هر بخشی از زیرساخت یا سامانه که درخواست HTTP را دریافت و پردازش می‌کند) شود. عدم رعایت این موضوع می تواند باعث وقوع حمله Danial of Service شود، ارسال یک درخواست بیش از حد طولانی (مانند یک فیلد هدر کوکی طولانی) باعث می شود سرور همواره با وضعیت خطا پاسخ دهد.,3 +V4,API and Web Service,V4.3,GraphQL,V4.3.1,اطمینان حاصل شود یکی از مکانیزم ها برای جلوگیری از حملات انکار سرویس (DoS) درلایه GraphQL یا لایه داده استفاده شده است. این مکانیزم‌ها عبارتند از استفاده از فهرست مجاز کوئری‌ها ( Query Allowlist)، محدودسازی عمق کوئری‌ها (Depth Limiting)،محدودسازی تعداد یا حجم داده(Amount Limiting) و تحلیل هزینه کوئری (Query Cost Analysis). این اقدامات، به منظور مقابله با درخواست های پیچیده، تو در تو یا کوئری‌های پرهزینه که می توانند موجب مصرف بیش از حد منابع و اختلال در سرویس دهی شوند ضروری است.,2 +V4,API and Web Service,V4.3,GraphQL,V4.3.2,اطمینان حاصل شود که قابلیت Introspection در GraphQL در محیط تولید (Production) غیرفعال شده‌است، مگرAPI مبتنی بر GraphQL به‌صورت صریح برای استفاده توسط اشخاص یا سامانه های ثالث (Third Parties) طراحی شده باشد.,2 +V4,API and Web Service,V4.4,WebSocket,V4.4.1,اطمینان حاصل شود که تمامی ارتباطات WebSocket از طریق پروتکل TLS( WSS) برقرار می‌شوند.,1 +V4,API and Web Service,V4.4,WebSocket,V4.4.2,اطمینان حاصل شود که در هنگام Handshake اولیه‌ی HTTP برای WebSocket، مقدار هدر Origin بررسی ‌شود و در صورتی که با لیستی از مبداهای مجاز (allowed origins) برای برنامه مطابقت داشته باشد، اتصال پذیرفته می‌شود.,2 +V4,API and Web Service,V4.4,WebSocket,V4.4.3,اطمینان حاصل شود که در صورتی که امکان استفاده از مکانیزم استاندارد مدیریت نشست برنامه وجود نداشته باشد، از توکن‌های اختصاصی (Duplicated Tokens) برای این منظور استفاده شود که با الزامات امنیتی مدیریت نشست به طور کامل مطابقت داشته باشند.,2 +V4,API and Web Service,V4.4,WebSocket,V4.4.4,اطمینان حاصل شود که توکن‌های اختصاصی مدیریت نشست WebSocket در هنگام انتقال از یک نشست HTTPS موجود به کانالWebSocket، از طریق نشست HTTPS احراز هویت‌شده قبلی، دریافت یا اعتبارسنجی می‌شوند.,2 +V5,File Handling,V5.1,File Handling Documentation,V5.1.1,مستندات نوع فایل‌های مجاز، پسوندهای مورد انتظار، و حداکثر اندازه هر فایل (شامل اندازه پس از استخراج) را برای هر قابلیت بارگذاری مشخص کرده باشد. همچنین، مستندات توضیح می‌دهند چگونه فایل‌ها برای دانلود و پردازش توسط کاربران نهایی ایمن‌سازی می‌شوند؛ برای مثال، رفتار برنامه هنگام شناسایی یک فایل مخرب چگونه خواهد بود.,2 +V5,File Handling,V5.2,File Upload and Content,V5.2.1,برنامه تنها فایل‌هایی با حجم مشخص، که قادر به پردازش آن است را می‌پذیرد تا از کاهش عملکرد یا حملات انکار سرویس (DoS) جلوگیری شود.,1 +V5,File Handling,V5.2,File Upload and Content,V5.2.2,هنگام پذیرش فایل توسط برنامه، چه به صورت مستقیم و چه به صورت یک آرشیو مانند فایلzip پسوند فایل با پسوند مورد انتظار مطابقت داشته باشد و اعتبارسنجی محتوای فایل صورت گیرد تا تایید شود محتوای فایل با نوع تعریف‌شده توسط پسوند هم‌خوانی دارد. این فرآیند می تواند شامل موارد بررسی بایت‌های ابتدایی (magic bytes) فایل، انجام بازنویسی تصاویر برای حذف ساختارها و اطلاعات ناخواسته و استفاده از کتابخانه‌های تخصصی برای اعتبارسنجی کامل محتوای فایل باشد اما محدود به آنها نیست. در سطح L1، کافی است این بررسی‌ها فقط بر روی فایل‌هایی که در فرآیندهای تجاری یا امنیتی خاص استفاده می‌شوند متمرکز باشد. در سطح L2 و بالاتر، این فرآیند باید برای تمامی فایل‌های ورودی برنامه اجرا شود.,1 +V5,File Handling,V5.2,File Upload and Content,V5.2.3,برنامه باید پیش از استخراج محتوای فایل‌های فشرده (مانند zip، gz، docx، odt)، آن‌ها را از نظر حداکثر اندازه مجاز پس از استخراج و همچنین حداکثر تعداد فایل‌های درون آن بررسی می‌کند.,2 +V5,File Handling,V5.2,File Upload and Content,V5.2.4,برنامه فضای مشخصی برای اندازه فایل و تعداد فایل‌های مجاز برای هر کاربر اعمال می‌کند تا از این طریق، یک کاربر نتواند با بارگذاری تعداد زیادی فایل یا فایل‌های بیش از حد بزرگ، فضای ذخیره‌سازی را پر کند.,3 +V5,File Handling,V5.2,File Upload and Content,V5.2.5,برنامه اجازه بارگذاری فایل‌های فشرده‌ که حاوی لینک های نمادین (symlinks) هستند را نمی‌دهد، مگر اینکه این رفتار به طور مشخص مورد نیاز باشد. در چنین شرایطی باید یک فهرست مجاز (allowlist) از مسیرها یا فایل‌هایی که می تواند برای آنها لینک نمادین ایجاد شود، اعمال و اعتبارسنجی گردد.,3 +V5,File Handling,V5.2,File Upload and Content,V5.2.6,برنامه تصاویر بارگذاری‌شده با اندازه پیکسلی بزرگ‌تر از حد مجاز را رد کند تا از حملات pixel flood attacks جلوگیری شود.,3 +V5,File Handling,V5.3,File Storage,V5.3.1,فایل هایی که از ورودی های غیرمعتبر بارگذاری‌ یا تولید می شوند و در پوشه های عمومی قرار می گیرند، هنگام دسترسی مستقیم از طریق یک درخواست HTTP، به عنوان کداجرایی سمت سرور اجرا نشوند.,1 +V5,File Handling,V5.3,File Storage,V5.3.2,"هنگام ایجاد مسیرهای فایل برای عملیات مختلف، به جای استفاده از نام فایل‌های ارسال شده توسط کاربر، از داده‌های تولید شده داخلی یا منابع مورد اعتماد استفاده شود. و در صورتی که استفاده از نام فایل‌ها یا متادیتای ارسالی توسط کاربر ضروری باشد، می بایست validation و Sanitization اعمال شود. این کار برای جلوگیری از حملاتی مانند Path Traversal، Local or Remote File Inclusion(LFI, RFI) و Server-Side Request Forgery(SSRF) می‌باشد.",1 +V5,File Handling,V5.3,File Storage,V5.3.3,پردازش فایل‌های سمت سرور، مانند استخراج فایل‌های فشرده، اطلاعات مسیر ارائه شده توسط کاربر را نادیده می‌گیرد تا از آسیب‌پذیری‌هایی مانند zip slip جلوگیری شود.,3 +V5,File Handling,V5.4,File Download,V5.4.1,برنامه نام فایل ارسال‌شده توسط کاربر را چه در قالب JSON، JSONP یا پارامتر URL، اعتبارسنجی می‌کند یا نادیده می‌گیرد، و در پاسخ HTTP، نام فایل را به‌طور صریح در فیلد Content-Disposition هدر مشخص می‌نماید.,2 +V5,File Handling,V5.4,File Download,V5.4.2,نام‌های فایل‌های ارائه شده (مانند فیلدهای هدر پاسخ HTTP یا پیوست‌های ایمیل)، به‌درستی encoded یا sanitized شده‌اند (مطابق RFC 6266)، تا ساختار سند حفظ شده و از حملات تزریق جلوگیری شود.,2 +V5,File Handling,V5.4,File Download,V5.4.3,فایل‌های دریافت شده از منابع غیرقابل اعتماد توسط آنتی ویروس اسکن شود تا از ارائه محتوای مخرب شناخته‌شده جلوگیری شود.,2 +V6,Authentication,V6.1,Authentication Documentation,V6.1.1,مستندات برنامه، نحوه استفاده از کنترل هایی مانند محدودیت نرخ (Rate Limit)، مقابله با خودکارسازی (Anti-Automation) و پاسخ تطبیقی (Adaptive Response) را برای دفاع در برابر حملاتی مانند Credential Stuffing و حملات Password Brute Force به وضوح تعریف کرده باشد. مستندات باید به‌وضوح نحوه پیکربندی این کنترل‌ها را تشریح کرده و نشان دهند که چگونه از قفل شدن مخرب حساب‌های کاربری جلوگیری می‌شود.,1 +V6,Authentication,V6.1,Authentication Documentation,V6.1.2,یک لیست از کلمات خاص مرتبط با زمینه سازمانی‌ (Context-Specific) مستندسازی شود تا از بکارگیری آنها در رمزهای عبور جلوگیری شد. این فهرست می‌تواند شامل نام سازمان، نام محصول، شناسه سامانه، نام کد پروژه، نام دپارتمان یا نقش های سازمانی و موارد مشابه باشد.,2 +V6,Authentication,V6.1,Authentication Documentation,V6.1.3,در صورت وجود مسیرهای متعدد احراز هویت در برنامه کاربردی، تمامی این مسیرها به همراه کنترل‌های امنیتی و سطح قدرت احراز هویت مورد نیاز، مستندسازی شده‌اند. لازم است این کنترل‌ها به‌صورت یکسان و سازگار در تمامی مسیرهای احراز هویت اجرا شوند.,2 +V6,Authentication,V6.2,Password Security,V6.2.1,کلمات عبور تنظیم شده توسط کاربر حداقل ۸ کاراکتر طول داشته باشد. هرچند حداقل ۱۵ کاراکتر به شدت توصیه می‌شود.,1 +V6,Authentication,V6.2,Password Security,V6.2.2,کاربران قادر به تغییر گذرواژه خود باشند.,1 +V6,Authentication,V6.2,Password Security,V6.2.3,هنگام تغییر کلمه عبور، گذرواژه فعلی و گذرواژه جدید توسط کاربر تکمیل شود.,1 +V6,Authentication,V6.2,Password Security,V6.2.4,کلمات عبوری که در حین ثبت‌نام حساب کاربری یا تغییر کلمه عبور ارسال می شوند با یک فهرست در دسترس از حداقل ۳۰۰۰ کلمه عبور رایج که ( با سیاست‌های کلمه عبور برنامه (مانند حداقل طول) سازگاری دارند) بررسی شوند.,1 +V6,Authentication,V6.2,Password Security,V6.2.5,کلمات عبور با هر ترکیبی قابل استفاده باشند، بدون اینکه قوانینی برای محدودکردن نوع کاراکترهای مجاز وجود داشته باشد. نباید هیچ‌گونه الزامی برای تعداد حداقل کاراکترهای حروف بزرگ یا کوچک، اعداد یا کاراکترهای خاص وجود داشته باشد.,1 +V6,Authentication,V6.2,Password Security,V6.2.6,"فیلدهای ورودی کلمه عبور از نوع ""type=password"" استفاده می‌کنند تا ورودی‌ها پنهان شوند. برنامه‌ها می‌توانند به کاربر این امکان را بدهند که موقتاً کلمه عبور کامل یا آخرین کاراکتر تایپ شده را مشاهده کند.",1 +V6,Authentication,V6.2,Password Security,V6.2.7,"عملکرد ""چسباندن"" (paste)، ابزارهای کمکی گذرواژه مرورگر و مدیریت‌کننده‌های گذرواژه خارجی مجاز باشند.",1 +V6,Authentication,V6.2,Password Security,V6.2.8,برنامه کلمه عبور کاربر را دقیقاً همانطور که از کاربر دریافت شده است، بدون هیچ گونه تغییراتی مانند کوتاه‌سازی(truncation) یا تبدیل حروف بزرگ و کوچک (case transformation)، بررسی کند.,1 +V6,Authentication,V6.2,Password Security,V6.2.9,استفاده از گذرواژه‌هایی با حداقل طول ۶۴ کاراکتر مجاز باشد.,2 +V6,Authentication,V6.2,Password Security,V6.2.10,کلمه عبور کاربر تا زمانی که مشخص شود که به خطر افتاده است یا کاربر آن را تغییر دهد، معتبر باقی بماند. برنامه نباید الزام به تغییر دوره‌ای گذرواژه‌ها را داشته باشد.,2 +V6,Authentication,V6.2,Password Security,V6.2.11,فهرست مستند شده ای از کلمات خاص مرتبط با زمینه‌ سازمانی برای جلوگیری از ایجاد کلمات عبور آسان قابل حدس، مورد استفاده قرار گیرد.,2 +V6,Authentication,V6.2,Password Security,V6.2.12,کلمات عبور وارد شده در حین ثبت‌نام حساب کاربری یا تغییر کلمه عبور با مجموعه‌ای از کلمات عبور افشا شده بررسی ‌شوند.,2 +V6,Authentication,V6.3,General Authentication Security,V6.3.1,کنترل‌های لازم برای جلوگیری از حملاتی مانند Credential Stuffing و password brute force طبق مستندات امنیتی برنامه پیاده‌سازی شوند.,1 +V6,Authentication,V6.3,General Authentication Security,V6.3.2,"حساب‌های کاربری پیش‌فرض (مانند ""admin""، ""root"" یا ""sa"") در برنامه وجود نداشته باشند یا غیرفعال شده باشند.",1 +V6,Authentication,V6.3,General Authentication Security,V6.3.3,برای دسترسی به برنامه، از یک مکانیزم احراز هویت چندعاملی (MFA) یا ترکیبی از مکانیزم‌های احراز هویت تک‌عاملی استفاده شود. برای سطح L3، حداقل یکی از عوامل احراز هویت باید مبتنی بر سخت‌افزار باشد در برابر حملات فیشینگ، مقاومت در برابر نفوذ و جعل هویت را فراهم کند، در حالی که با اقدام آگاهانه کاربر (مانند فشردن دکمه روی کلید سخت‌افزاری FIDO یا تلفن همراه) قصد کاربر برای احراز هویت را نیز تأیید نماید. هرگونه تسهیل یا تعدیل در این الزام، مستلزم ارائه دلایل مستند و مجموعه‌ای جامع از کنترل‌های جبرانی است.,2 +V6,Authentication,V6.3,General Authentication Security,V6.3.4,تأیید کنید که در صورت وجود مسیرهای متعدد احراز هویت در برنامه، هیچ مسیر احراز هویتِ مستندسازی‌نشده‌ای وجود نداشته باشد و کنترل‌های امنیتی و سطح قدرت احراز هویت در تمامی مسیرها به‌صورت یکسان و سازگار اعمال شوند.,2 +V6,Authentication,V6.3,General Authentication Security,V6.3.5,کاربران از تلاش‌های مشکوک برای احراز هویت (موفق یا ناموفق) مطلع ‌شوند. این اطلاع‌رسانی می‌تواند شامل تلاش برای احراز هویت از موقعیت مکانی یا کلاینت غیرمعمول، احراز هویت ناقص (تنها موفقیت یکی از عوامل)، تلاش برای احراز هویت پس از یک دوره طولانی عدم فعالیت، یا احراز هویت موفق پس از چندین تلاش ناموفق باشد.,3 +V6,Authentication,V6.3,General Authentication Security,V6.3.6,ایمیل به‌عنوان مکانیزم احراز هویت، چه به‌صورت تک‌عاملی و چه به‌عنوان یکی از عوامل احراز هویت چندعاملی، استفاده نمی‌شود.,3 +V6,Authentication,V6.3,General Authentication Security,V6.3.7,کاربران پس از به‌روزرسانی اطلاعات احراز هویت خود، مانند بازنشانی گذرواژه یا تغییر نام کاربری یا آدرس ایمیل، مطلع شوند.,3 +V6,Authentication,V6.3,General Authentication Security,V6.3.8,با توجه به پیام‌های خطا، کدهای پاسخ HTTP یا تفاوت در زمان پاسخ‌دهی، نتوان کاربران معتبر را از طریق تلاش‌های ناموفق احراز هویت شناسایی کرد. همچنین، عملکردهای ثبت‌نام و بازیابی گذرواژه نیز باید از این نوع افشای اطلاعات محافظت شده باشند.,3 +V6,Authentication,V6.4,Authentication Factor Lifecycle and Recovery,V6.4.1,کلمه عبور اولیه یا کدهای فعال‌سازی تولید شده توسط سیستم، به‌صورت تصادفی و ایمن تولید ‌شوند، با سیاست فعلی رمز عبور مطابقت دارند، و پس از مدت زمان کوتاهی یا پس از اولین استفاده منقضی می‌شوند. این رمزهای اولیه نباید به عنوان رمز عبور بلندمدت مورد استفاده قرار گیرند.,1 +V6,Authentication,V6.4,Authentication Factor Lifecycle and Recovery,V6.4.2,"راهنمای کلمه عبور یا احراز هویت مبتنی بر دانش (که به عنوان ""سؤالات امنیتی"" شناخته می‌شوند) در سیستم وجود ندارد.",1 +V6,Authentication,V6.4,Authentication Factor Lifecycle and Recovery,V6.4.3,فرآیند امنی برای بازنشانی کلمه عبور فراموش‌شده پیاده‌سازی شده است که هیچ‌یک از مکانیزم‌های احراز هویت چندعاملی فعال را دور نزند.,2 +V6,Authentication,V6.4,Authentication Factor Lifecycle and Recovery,V6.4.4,در صورت از دست رفتن یکی از عوامل احراز هویت چندعاملی، فرآیند اثبات هویت با همان سطحی که در زمان ثبت‌نام انجام شده است، اجرا شود.,2 +V6,Authentication,V6.4,Authentication Factor Lifecycle and Recovery,V6.4.5,دستورالعمل‌های تمدید مکانیزم‌های احراز هویت دارای تاریخ انقضا برای کاربران به موقع ارسال می‌شود تا پیش از انقضای مکانیزم فعلی فرصت کافی برای تمدید وجود داشته باشد، و در صورت لزوم، یادآورهای خودکار نیز تنظیم و ارسال شده باشند.,3 +V6,Authentication,V6.4,Authentication Factor Lifecycle and Recovery,V6.4.6,کاربران ادمین می‌توانند فرآیند بازنشانی کلمه عبور را برای کاربران عادی آغاز کنند، اما اجازه تغییر مستقیم یا انتخاب رمز عبور برای کاربر را ندارند. این کنترل برای جلوگیری از دسترسی ادمین به رمز عبور کاربران طراحی شده است.,3 +V6,Authentication,V6.5,General Multi-factor authentication requirements,V6.5.1,Lookup Secrets درخواست‌ها یا کدهای احراز هویت خارج از باند (Out-of-Band) و رمزهای یکبار مصرف مبتنی بر زمان (TOTP) تنها یک‌بار قابل استفاده باشند و پس از استفاده موفق، مجدداً قابل استفاده نباشند.,2 +V6,Authentication,V6.5,General Multi-factor authentication requirements,V6.5.2,در صورت ذخیره‌سازی Lookup Secrets در سمت Backend برنامه، اگر مقدار آنتروپی کمتر از ۱۱۲ بیت باشند (معادل ۱۹ کاراکتر تصادفی الفبایی-عددی یا ۳۴ رقم تصادفی)، باید با یک الگوریتم تایید شده برای ذخیره رمز عبور و با استفاده از یک Salt تصادفی ۳۲ بیتی هش شوند. در صورتی که آنتروپی کد ۱۱۲ بیت یا بیشتر باشد، می‌توان از یک تابع هش استاندارد برای ذخیره سازی استفاده کرد.,2 +V6,Authentication,V6.5,General Multi-factor authentication requirements,V6.5.3,Lookup Secrets کدهای احراز هویت خارج از باند (out of band) و تولید رمزهای یکبار مصرف مبتنی بر زمان(TOTP) همگی با استفاده از یک تولیدکننده عدد شبه تصادفی ‌رمزنگاری‌شده (CSPRNG) تولید شده باشند تا از تولید مقادیر قابل پیش‌بینی جلوگیری شود.,2 +V6,Authentication,V6.5,General Multi-factor authentication requirements,V6.5.4,Lookup Secrets و کدهای احراز هویت خارج از باند (out of band) حداقل دارای ۲۰ بیت آنتروپی باشند (معمولاً ۴ کاراکتر تصادفی الفبایی-عددی یا ۶ رقم تصادفی برای رسیدن به این میزان آنتروپی کافی است).,2 +V6,Authentication,V6.5,General Multi-factor authentication requirements,V6.5.5,درخواست‌ها، کدها یا توکن‌های احراز هویت خارج از باند (Out-of-Band) و همچنین رمزهای عبور یک‌بار مصرف مبتنی بر زمان (TOTP) دارای طول عمر مشخص باشند. حداکثر طول عمر برای درخواست‌های خارج از باند باید ۱۰ دقیقه و برای TOTP حداکثر ۳۰ ثانیه باشد.,2 +V6,Authentication,V6.5,General Multi-factor authentication requirements,V6.5.6,امکان لغو (Revoke) هر عامل احراز هویت، از جمله دستگاه‌های فیزیکی، در صورت سرقت یا مفقود شدن وجود داشته باشد.,3 +V6,Authentication,V6.5,General Multi-factor authentication requirements,V6.5.7,مکانیزم‌های احراز هویت بیومتریک فقط به‌عنوان عامل دوم و در کنار یکی از عوامل «چیزی که در اختیار دارید» یا «چیزی که کاربر می داند» مورد استفاده قرار می‌گیرند.,3 +V6,Authentication,V6.5,General Multi-factor authentication requirements,V6.5.8,اعتبارسنجی رمزهای یک‌بار مصرف مبتنی بر زمان (TOTP) بر اساس منبع زمانی از یک سرویس قابل اعتماد انجام می‌شود و نه بر اساس زمان ارائه‌شده توسط کلاینت یا منابع غیرقابل اعتماد.,3 +V6,Authentication,V6.6,Out-of-Band authentication mechanisms,V6.6.1,مکانیزم‌های احراز هویت مبتنی بر شبکه تلفن عمومی (PSTN) برای ارسال رمزهای یک‌بار مصرف (OTP) از طریق تماس تلفنی یا پیامک تنها در صورتی که شماره تلفن قبلا اعتبارسنجی شده باشد، یا روش‌های جایگزین قوی‌تر (رمزهای عبور یکبار مصرف مبتنی بر زمان) در دسترس باشند ارائه می‌شوند و سرویس‌دهنده باید کاربران را از ریسک‌های امنیتی این روش‌ها مطلع سازد. برای اپلیکیشن‌های سطح L3، استفاده از تماس تلفنی و پیامک به‌عنوان گزینه، مجاز نیست.,2 +V6,Authentication,V6.6,Out-of-Band authentication mechanisms,V6.6.2,درخواست‌ها، کدها یا توکن‌های احراز هویت خارج از باند (Out-of-Band) به درخواست احراز هویت اصلی که برای آن تولید شده‌اند متصل باشند و قابل استفاده برای درخواست‌های قبلی یا بعدی نباشند.,2 +V6,Authentication,V6.6,Out-of-Band authentication mechanisms,V6.6.3,مکانیزم‌های احراز هویت خارج از باند (Out-of-Band) مبتنی بر کد، در برابر حملات brute force از طریق اعمال کنترل محدودیت نرخ (Rate Limiting) محافظت شوند. همچنین، استفاده از کدی با حداقل ۶۴ بیت آنتروپی (Entropy)مدنظر قرار گیرد.,2 +V6,Authentication,V6.6,Out-of-Band authentication mechanisms,V6.6.4,در صورت استفاده از Push Notifications جهت احراز هویت چند عاملی، محدودیت نرخ (Rate Limiting) به منظور جلوگیری از حملات Push Bombing اعمال شده باشد. استفاده از تطبیق عدد Matching) Number) نیز می‌تواند به کاهش این ریسک کمک کند.,3 +V6,Authentication,V6.7,Cryptographic authentication mechanism,V6.7.1,گواهینامه‌های مورد استفاده برای تأیید ادعاهای احراز هویت رمزنگاری‌شده به گونه‌ای ذخیره شوند که از تغییر یا دستکاری آن‌ها محافظت شود.,3 +V6,Authentication,V6.7,Cryptographic authentication mechanism,V6.7.2,مقدار چالش (Challenge Nonce) حداقل ۶۴ بیت طول داشته باشد و از نظر آماری یکتا باشد یا حداقل در طول عمر دستگاه رمزنگاری منحصر به فرد باقی بماند.,3 +V6,Authentication,V6.8,Authentication with an Identity Provider,V6.8.1,اگر برنامه از چند ارائه‌دهنده هویت (IdP) پشتیبانی می‌کند، امکان جعل هویت کاربر از طریق یک ارائه‌دهنده هویت دیگر وجود نداشته باشد (برای مثال، با استفاده از شناسه کاربری یکسان). مکانیسم استاندارد برای جلوگیری از این تهدید، این است که برنامه، کاربران را با استفاده از ترکیب شناسه IdP (به‌عنوان فضای نام یا (namespace و شناسه کاربر در آن، IdP ثبت و شناسایی کند.,2 +V6,Authentication,V6.8,Authentication with an Identity Provider,V6.8.2,وجود و یکپارچگی امضاهای دیجیتال بر روی تصدیق‌های (تقاضاها یا ادعاهای) احراز هویت برای مثال بر روی (توکن‌های JWT یا SAML assertions) همواره اعتبارسنجی می‌شود و هرگونه تصدیقی که فاقد امضا یا دارای امضای نامعتبر باشد، رد می‌گردد.,2 +V6,Authentication,V6.8,Authentication with an Identity Provider,V6.8.3,(تقاضاها یا ادعاهای) تصدیق‌های SAML به‌صورت منحصربه‌فرد پردازش شده و تنها یک‌بار در بازه‌ی اعتبار خود استفاده می‌شوند تا از حملات بازپخش (Replay Attacks) جلوگیری گردد.,2 +V6,Authentication,V6.8,Authentication with an Identity Provider,V6.8.4,اگر برنامه‌ای از یک ارائه‌دهنده هویت (IdP) جداگانه استفاده می‌کند و انتظار قدرت، روش‌ها یا تازگی احراز هویت خاصی را برای عملکردهای خاص دارد، برنامه این موضوع را با استفاده از اطلاعات برگردانده شده توسط IdP تأیید می‌کند. به عنوان مثال، اگر از OIDC استفاده شود، این کار می‌تواند با اعتبارسنجی ادعاهای (Claims) موجود در توکن شناسایی (ID Token) مانند «amr»، «acr» و «auth_time» (در صورت وجود) انجام شود. اگر ارائه‌دهنده هویت این اطلاعات را ارائه نکند، برنامه باید یک روش جایگزین مستندسازی‌شده داشته باشد که فرض می‌کند حداقل سطح احراز هویت استفاده شده است (مثلاً احراز هویت تک‌عاملی با نام کاربری و گذرواژه).,2 +V7,Session Management,V7.1,Session Management Documentation,V7.1.1,بازه عدم فعالیت نشست کاربر و بیشینه طول عمر نشست قبل از احراز هویت مجدد، در ترکیب با سایر کنترل‌ها مستند و متناسب سازی شود. مستند سازی انجام شده باید شامل توجیه برای هر انحراف(نقض) از الزامات احراز هویت مجدد NIST SP 800-63B باشد.,2 +V7,Session Management,V7.1,Session Management Documentation,V7.1.2,در مستند باید تعداد نشست همزمان مجاز برای یک کاربر و همچنین رفتار و اعمال مناسب برای زمانی که این تعداد به حداکثر رسید مشخص شود.,2 +V7,Session Management,V7.1,Session Management Documentation,V7.1.3,تمام سیستم‌هایی که نشست‌های کاربر را به عنوان بخشی از یک اکوسیستم مدیریت هویت فدرال(مانند سیستم‌های (SSO ایجاد و مدیریت می‌کنند، باید در کنار سایر کنترل‌های مربوط به طول عمر نشست‌ها، خاتمه آن‌ها و هرگونه شرایط دیگری که نیاز به احراز هویت مجدد دارد، مستند شوند.,2 +V7,Session Management,V7.2,Fundamental Session Management Security,V7.2.1,برنامه کاربردی باید تمام بررسی‌های توکن نشست‌ را با استفاده از یک سرویس backend مطمئن انجام دهد.,1 +V7,Session Management,V7.2,Fundamental Session Management Security,V7.2.2,برنامه کاربردی که از هر یک از توکن‌های Self-Contained یا reference که به صورت پویا برای مدیریت نشست تولید شده‌اند استفاده کند اما از از کلیدهای API ثابت و کلید‌ها استفاده نکند.,1 +V7,Session Management,V7.2,Fundamental Session Management Security,V7.2.3,در صورتی که برای نمایش نشست کاربر از توکن‌های reference استفاده می شود، این توکن‌ها منحصر به فرد بوده و با استفاده از یک تولید کننده عدد شبه تصادفی امن رمزنگاری(CSPRNG) که دارای انتروپی حداقل128 بیتی است تولید شوند.,1 +V7,Session Management,V7.2,Fundamental Session Management Security,V7.2.4,برنامه کاربردی در هنگام احراز هویت کاربر یک توکن نشست جدید تولید نماید که شامل احراز هویت مجدد و ابطال توکن نشست کنونی است.,1 +V7,Session Management,V7.3,Session Timeout,V7.3.1,بر اساس تحلیل ریسک و تصمیمات امنیتی مستند شده، پس از گذشت مهلت زمانی عدم فعالیت، کاربر مجبور به احراز هویت مجدد گردد.,2 +V7,Session Management,V7.3,Session Timeout,V7.3.2,بر اساس تحلیل ریسک و تصمیمات امنیتی مستند شده، پس از گذشت بیشینه زمان مطلق طول عمر، کاربر مجبور به احراز هویت مجدد گردد.,2 +V7,Session Management,V7.4,Session Termination,V7.4.1,در مواقعی که فرآیند خاتمه نشست کاربر فعال می‌شود (مانند خروج کاربر یا انقضای نشست)، برنامه اجازه هیچ فعالیتی را به آن نشست نمی‌دهد. برای Reference tokens یا stateful session، این به معنی نامعتبرسازی اطلاعات نشست در برنامه Backend می‌باشد. برنامه‌هایی که از توکن‌های Self-contained استفاده می‌کنند نیاز به راه حل‌هایی نظیر نگهداری فهرستی از توکن‌های خاتمه‌یافته، عدم پذیرش توکن‌هایی که پیش از یک تاریخ و زمان مشخص برای هر کاربر تولید شده‌اند، یا چرخش کلید امضای مخصوص هر کاربر دارند.,1 +V7,Session Management,V7.4,Session Termination,V7.4.2,برنامه کاربردی تمامی نشست‌های فعال را در زمانی که حساب کاربری غیرفعال یا حذف می‌شود را ابطال نماید. (مانند کارمندی که شرکت را ترک می‌کند),1 +V7,Session Management,V7.4,Session Termination,V7.4.3,برنامه کاربردی قابلیت ارائه گزینه ابطال تمامی نشست های فعال دیگر را پس از یک تغییر موفقیت آمیز یا حذف هریک از عوامل احراز هویت (نظیر تغییر پسورد از طریق ریست یا بازنشانی و در صورت وجود به روزرسانی تنظیمات MFA ) را داشته باشد.,2 +V7,Session Management,V7.4,Session Termination,V7.4.4,تمامی صفحاتی که نیازمند احراز هویت هستند دارای دسترسی آسان و مشخص به فرآیند خروج باشند.,2 +V7,Session Management,V7.4,Session Termination,V7.4.5,مدیران برنامه کاربردی قادر به ابطال نشست‌های فعال برای یک شخص یا تمامی کاربران باشند.,2 +V7,Session Management,V7.5,Defenses Against Session Abuse,V7.5.1,برنامه کاربردی قبل از اعطای مجوز تغییر ویژگی‌های حساس حساب کاربری که بر روی احراز هویت تاثیر دارد نظیر آدرس ایمیل، شماره تلفن، تنظیمات MFA یا اطلاعات دیگر که در بازگردانی حساب کاربری مورد استفاده قرار می‌گیرند، به احراز هویت مجدد کامل نیاز دارد.,2 +V7,Session Management,V7.5,Defenses Against Session Abuse,V7.5.2,حساب‌های کاربری قادر به دیدن(پس از احراز هویت مجدد با حداقل یک عامل) و ابطال یک یا همه نشست‌های فعال باشد.,2 +V7,Session Management,V7.5,Defenses Against Session Abuse,V7.5.3,برنامه کاربردی قبل از اجرای تراکنش‌ها یا عملیات‌های حساس نیازمند احراز هویت مجدد با حداقل یک عامل یا صحت سنجی ثانویه باشد.,3 +V7,Session Management,V7.6,Federated Re-authentication,V7.6.1,طول عمر و ابطال نشست بین RP و idp طبق سند- که نیازمند احرازهویت مجدد در زمان مورد نیاز مانند وقتی که بیشینه زمان بین رخداد احراز هویت idp رسیده باشد- انجام شود.,2 +V7,Session Management,V7.6,Federated Re-authentication,V7.6.2,ساخت نشست‌ها نیاز به رضایت کاربر یا یک اقدام صریح دارد که بدین صورت از ایجاد نشست‌های جدید برنامه بدون تعامل کاربر جلوگیری می‌شود.,2 +V8,Authorization,V8.1,Authorization Documentation,V8.1.1,مستند اعطای مجوز باید شامل قوانینی به منظور محدودسازی دسترسی در سطح عملکرد و دسترسی مبتنی بر داده بر اساس مجوزهای کاربران و ویژگی‌های منابع باشد.,1 +V8,Authorization,V8.1,Authorization Documentation,V8.1.2,مستند اعطای مجوز باید قوانینی را برای محدودیت‌های دسترسی در سطح Field بر اساس مجوزهای کاربران و ویژگی‌های منابع تعریف نماید(هر دو دسترسی خواندن و نوشتن). توجه داشته باشید که این قوانین ممکن است به مقادیر دیگر ویژگی‌های شیء داده ی مربوطه (Relevant Data Object) بستگی داشته باشند، مانند حالت (state) یا وضعیت (status).,2 +V8,Authorization,V8.1,Authorization Documentation,V8.1.3,مستند برنامه کاربردی باید ویژگی‌های محیطی و زمینه‌ای (شامل و نه محدود به زمان روز، مکان، آدرس IP یا دستگاه) که در برنامه کاربردی به منظور اتخاذ تصمیمات امنیتی (نظیر آن دسته از تصمیماتی که مربوط به احراز هویت و اعطای مجوز می باشد) را مشخص کند.,3 +V8,Authorization,V8.1,Authorization Documentation,V8.1.4,مستندات احراز هویت و اعطای مجوز، علاوه بر اعطای مجوز در سطح Field، سطح عملکرد و داده‌های خاص، چگونگی استفاده از عوامل محیطی و زمینه‌ای در اتخاذ تصمیمات را مشخص نماید.,3 +V8,Authorization,V8.2,General Authorization Design,V8.2.1,برنامه کاربردی باید از محدود بودن دسترسی‌‌های در سطح عملکرد به مشتریانی که دارای دسترسی صریح هستند اطمینان حاصل نماید.,1 +V8,Authorization,V8.2,General Authorization Design,V8.2.2,برنامه کاربردی باید از محدود بودن دسترسی‌‌های در سطح داده به مشتریانی که دارای دسترسی صریح به اقلام داده‌ای خاص هستند اطمینان حاصل نماید تا از این طریق خطر آسیب پذیری IDOR و broken object level authorization را کاهش دهد .,1 +V8,Authorization,V8.2,General Authorization Design,V8.2.3,برنامه کاربردی دسترسی در سطح Field را با مجوزهای صریح به Field ها برای مصرف کنندگان جهت کاهش خطر broken object property level authorization (BOPLA) محدود کرده باشد.,2 +V8,Authorization,V8.2,General Authorization Design,V8.2.4,کنترل‌های امنیتی تطبیقی که بر اساس ویژگی‌های محیطی و زمینه‌ای کاربر (مانند زمان روز، مکان، آدرس IP یا دستگاه) هستند، برای تصمیم‌گیری‌های احراز هویت (Authentication) و مجوزدهی (Authorization) طبق مستندات برنامه پیاده‌سازی شده‌اند. این کنترل‌ها باید هم در زمان تلاش کاربر برای شروع یک نشست (Session) جدید و هم در طول یک نشست فعال، اعمال شوند.,3 +V8,Authorization,V8.3,Operation Level Authorization,V8.3.1,برنامه کاربردی قوانین مجوزدهی را در یک لایه سرویس معتبر اعمال نموده و بر آن دسته از کنترل‌هایی که مصرف کنندگان نامعتبر قادر به دستکاری آن‌ها هستند متکی نباشد. (نظیر جاوا اسکریپت سمت کاربر),1 +V8,Authorization,V8.3,Operation Level Authorization,V8.3.2,در مواقعی که امکان اعمال فوری تغییرات وجود ندارد (مثلاً وقتی که سیستم برای تصمیم‌گیری در مجوزدهی از توکن‌های Self-Contained مثل JWT استفاده می‌کند که اطلاعات را داخل خود ذخیره کرده و تا زمان انقضا تغییر نمی‌کنند)، باید کنترل‌های جبرانی وجود داشته باشد. این کنترل‌ها باید بتوانند زمانی که کاربر عملی را انجام می‌دهد که دیگر مجاز به آن نیست، هشدار بدهند و تغییر را برگردانند. با این حال، توجه کنید که این راهکار جایگزین نمی‌تواند جلوی نشت اطلاعات را بگیرد.,3 +V8,Authorization,V8.3,Operation Level Authorization,V8.3.3,دسترسی به یک object بر اساس مجوزهای کاربری شخص درخواست کننده(مثال: مصرف کننده) باشد نه بر اساس مجوز‌های یک واسطه یا سرویسی که به نمایندگی از او عمل می‌کند. بطور مثال، در صورتی که یک مصرف کننده یک وب سرویس را با استفاده از یک توکن self-contained برای احراز هویت فراخوانی می‌کند و سپس آن سرویس اطلاعات را از یک سرویس دیگر درخواست می‌کند، سرویس دوم باید همان توکن مصرف کننده را استفاده کند، نه یک توکن سرویس-به-سرویس (Machine-to-Machine token) که متعلق به سرویس اول است، تا تصمیمات مجوزدهی دقیقاً بر اساس مجوزهای کاربر گرفته شوند.,3 +V8,Authorization,V8.4,Other Authorization Considerations,V8.4.1,برنامه های کاربردی چند کاربره(multi tenants) از کنترل های cross-tenant به منظور تضمین این امر که عملیات‌های مصرف کنندگان هرگز کاربرانی (tenants) را که مجوز تعامل با آنها را ندارند را تحت تأثیر قرار نمی‌دهد.,2 +V8,Authorization,V8.4,Other Authorization Considerations,V8.4.2,دسترسی به درگاه‌های پیکربندی شامل چندین لایه امنیتی از قبیل تأیید مداوم هویت مصرف‌کننده، ارزیابی وضعیت امنیتی دستگاه و تحلیل ریسک زمینه‌ای باشد تا از این طریق اطمینان حاصل شود که موقعیت شبکه‌ای یا نقاط پایانی معتبر تنها عوامل برای مجوزدهی نیستند اگر چه که این عوامل احتمال دسترسی غیرمجاز را کاهش می‌دهند.,3 +V9,Self-contained Tokens,V9.1,Token source and integrity,V9.1.1,قبل از پذیرش محتوای توکن‌ها، آن‌ها را با استفاده از امضای دیجیتال یا MAC به منظور حفاظت در مقابل دستکاری‌ها مورد اعتبارسنجی قرار داده شود.,1 +V9,Self-contained Tokens,V9.1,Token source and integrity,V9.1.2,فقط الگوریتم‌های موجود در لیست مجاز قادر به استفاده در ساخت و صحت سنجی توکن‌های self-contained در یک زمینه مشخص باشند. این لیست مجاز باید در حالت ایده آل شامل هم الگوریتم‌های متقارن و هم نامتقارن‌ها باشد و نباید شامل الگوریتم‌های NONE باشد. در صورتی که هر دو الگوریتم‌های متقارن و نانتقارن مورد نیاز باشند کنترل‌های بیشتری باید به منظور جلوگیری از سردرگمی کلید‌ها(key Confusion) بکار گرفته شود.,1 +V9,Self-contained Tokens,V9.1,Token source and integrity,V9.1.3,"به منظور جلوگیری از مشخص نمودن منابع غیر مطمئن و کلید‌ها توسط مهاجمین، موارد کلیدی که در اعتبارسنجی توکن‌های self-contained مورد استفاده قرار می‌گیرند، از منابع از پیش پیکربندی شده مطمئنی که برای صادر کننده توکن است تعیین شود. برای JWTs و سایر ساختارهای JWS ، هدرهایی نظیر ‘jku’, ‘x5u’ و ‘jwk’ باید با یک لیست مجاز از منابع مطمئن مورد اعتبارسنجی قرار گیرند.",1 +V9,Self-contained Tokens,V9.2,Token content,V9.2.1,اگر یک بازه زمانی معتبر در داده‌های توکن وجود داشته باشد، توکن و محتوای آن تنها در صورتی پذیرفته می‌شوند که زمان بررسی در این بازه زمانی معتبر باشد. به عنوان مثال، برای JWTها، ادعاهای 'nbf' و 'exp' باید تایید شوند.,1 +V9,Self-contained Tokens,V9.2,Token content,V9.2.2,سرویسی که یک توکن دریافت می‌کند قبل از پذیرش محتوای آن، از لحاظ درستی نوع بررسی نموده و برای هدف مشخص شده در نظر گیرد. بطور مثال، فقط توکن‌های access می‌توانند به منظور تصمیمات مجوزی و فقط توکن های ID می‌توانند به منظور اثبات هویت کاربر مورد پذیرش قرار گیرند.,2 +V9,Self-contained Tokens,V9.2,Token content,V9.2.3,یک سرویس فقط توکن‌هایی را بپذیرد که به منظور استفاده توسط آن سرویس هستند(audience).برای JWT ها،این امر می‌تواند از طریق اعتبارسنجی ادعای 'aud' با یک لیست مجاز تعریف شده در سرویس صورت پذیرد.,2 +V9,Self-contained Tokens,V9.2,Token content,V9.2.4,اگر صادر کننده توکن از کلید خصوصی مشابهی برای audienceهای متفاوت استفاده می‌کند، توکن‌های تولید شده دارای محدودیت مخاطبی باشند که بطور منحصر به فردی مخاطبین مورد نظر را مشخص می‌کند. این امر از استفاده مجدد توکن توسط مخاطب ناخواسته جلوگیری می‌کند. در صورتی که شناسه مخاطب به صورت پویا مشخص شده باشد، صادرکننده توکن باید این مخاطبین را به منظور اطمینان از عدم جعل هویت مخاطب مورد اعتبارسنجی قرار دهد.,2 +V10,OAuth and OIDC,V10.1,Generic OAuth and OIDC Security,V10.1.1,توکن‌ها باید فقط به مؤلفه‌هایی ارسال شوند که به‌طور دقیق به آن‌ها نیاز دارند. برای مثال، هنگام استفاده از الگوی Backend-for-Frontend برای برنامه‌های JavaScript مبتنی بر مرورگر، Access Tokens و Refresh Tokens باید فقط برای Backend قابل دسترس باشند.,2 +V10,OAuth and OIDC,V10.1,Generic OAuth and OIDC Security,V10.1.2,Client باید فقط مقادیری را از Authorization Server بپذیرد (مانند Authorization Code یاID Token ) که این مقادیر حاصل از یک Authorization Flow باشند که توسط همان نشست (Session) و تراکنش User Agent آغاز شده است. این موضوع مستلزم آن است که Secretهای تولیدشده توسط کلاینت مانند code_verifier در PKCE، یا مقادیر state و nonce در OIDC قابل حدس زدن نباشند، مخصوص همان تراکنش باشند، و به‌صورت امن هم به کلاینت و هم به نشست (Session) مرورگری که تراکنش در آن شروع شده، متصل شده باشند.,2 +V10,OAuth and OIDC,V10.2,OAuth Client,V10.2.1,درCode Flow، باید OAuth Client در برابر حملاتBrowser-based Request Forgery که معمولاً با عنوان Cross-Site Request Forgery (CSRF) شناخته می‌شوند و درخواست‌های توکن را ایجاد می‌کنند، محافظت داشته باشد. این محافظت باید با استفاده از قابلیت PKCE یا با بررسی پارامترstate که در درخواست احراز مجوز ارسال شده است.,2 +V10,OAuth and OIDC,V10.2,OAuth Client,V10.2.2,اگر OAuth Client بتواند با بیش از یک Authorization Server تعامل داشته باشد، باید دارای سازوکاری برای دفاع در برابر Mix-up Attacks باشد. برای مثال، می‌تواند الزام کند که Authorization Server مقدار پارامتر ‘iss’ را برگرداند و این مقدار هم درAuthorization Response و هم درToken Response اعتبارسنجی شود.,2 +V10,OAuth and OIDC,V10.2,OAuth Client,V10.2.3,OAuth Client باید فقطScopes (یا سایر پارامترهای مجوزدهی) مورد نیاز را در درخواست‌ها به Authorization Server درخواست کند.,3 +V10,OAuth and OIDC,V10.3,OAuth Resource Server,V10.3.1,Resource Server باید فقط Access Tokenهایی را بپذیرد که برای استفاده با همان سرویس در نظر گرفته شده‌اند(Audience). Audience می‌تواند در یک Access Token ساختاریافته (مانند مقدار aud در JWT) درج شده باشد، یا از طریق Token Introspection Endpoint بررسی شود.,2 +V10,OAuth and OIDC,V10.3,OAuth Resource Server,V10.3.2,Resource Server باید تصمیمات مجوزدهی (Authorization Decisions) را بر اساس Claims موجود در Access Token که واگذاری مجوز (Delegated Authorization) را تعریف می‌کنند، اعمال کند. اگر Claimsهایی مانند sub، scope و authorization_details موجود باشند، باید جزو فرآیند تصمیم‌گیری قرار گیرند.,2 +V10,OAuth and OIDC,V10.3,OAuth Resource Server,V10.3.3,اگر برای گرفتن یک تصمیم کنترل دسترسی، لازم است یک کاربرِ یکتا از داخل Access Token (چه JWT و چه پاسخ Token Introspection ) شناسایی شود، سرور منبع (Resource Server) کاربر را از روی Claimهایی شناسایی کند که قابل اختصاص‌دادن به کاربران دیگر نیستند. معمولاً این یعنی استفاده از ترکیب دو Claim یعنی 'iss' (صادرکننده توکن) و 'sub' (شناسه یکتای کاربر),2 +V10,OAuth and OIDC,V10.3,OAuth Resource Server,V10.3.4,اگر Resource Server نیازمند قدرت، روش یا تازگی خاص احراز هویت باشد، بررسی کند که Access Token ارائه‌شده این محدودیت‌ها را برآورده می‌کند. برای مثال، در صورت وجود، از Claimsهای OIDC مانند acr، amr و auth_time به ترتیب استفاده شود.,2 +V10,OAuth and OIDC,V10.3,OAuth Resource Server,V10.3.5,تأیید کنید که Resource Server از استفاده از Access Tokenهای سرقت‌شده یا Replay توکن‌ها (توسط افراد غیرمجاز) جلوگیری کند، با الزام استفاده از Sender-Constrained Access Tokens، مانند Mutual TLS برای OAuth 2 یا OAuth2 Demonstration of Proof of Possession (DPoP).,3 +V10,OAuth and OIDC,V10.4,OAuth Authorization Server,V10.4.1,سرور احراز هویت باید آدرس‌های بازگشتی (Redirect URI) را بر اساس فهرست مجاز (Allowlist) از URIهای از پیش‌ثبت‌شده و مخصوص هر کلاینت، با استفاده از مقایسه دقیقِ رشته‌ای Comparison) (Exact String اعتبارسنجی می‌کند.,1 +V10,OAuth and OIDC,V10.4,OAuth Authorization Server,V10.4.2,اگر Authorization Server کد احراز مجوز (Authorization Code) را در Authorization Response برمی‌گرداند، این کد فقط یک‌بار برای درخواست توکن باید قابل استفاده باشد. برای دومین درخواست معتبر با یک Authorization Code که قبلاً برای صدور Access Token استفاده شده است، Authorization Server باید درخواست توکن را رد کند و هر توکن صادرشده‌ی مرتبط با آن Authorization Code را باطل نماید.,1 +V10,OAuth and OIDC,V10.4,OAuth Authorization Server,V10.4.3,تأیید کنید که Authorization Code دارای مدت زمان معتبر بودن محدود باشد. حداکثر طول عمر می‌تواند برای برنامه‌های کاربردی در سطوح L1 و L2 تا ۱۰ دقیقه و برای برنامه‌های کاربردی در سطح L3 تا ۱ دقیقه باشد.,1 +V10,OAuth and OIDC,V10.4,OAuth Authorization Server,V10.4.4,برای یک Client مشخص، Authorization Server فقط استفاده از Grantهایی را مجاز بداند که آن Client به استفاده از آن‌ها نیاز دارد. توجه داشته باشید که Grantهای ‘token’ (Implicit Flow) و ‘password’ (Resource Owner Password Credentials Flow) دیگر نباید استفاده شوند.,1 +V10,OAuth and OIDC,V10.4,OAuth Authorization Server,V10.4.5,Authorization Server باید حملات Refresh Token Replay را برای Public Clientها کاهش دهد، ترجیحاً با استفاده از Sender-Constrained Refresh Tokens، یعنی Demonstrating Proof of Possession (DPoP) یا Certificate-Bound Access Tokens با استفاده از Mutual TLS (mTLS). برای برنامه‌های L1 و L2، می‌توان از Refresh Token Rotation استفاده کرد. اگر Refresh Token Rotation به‌کار گرفته شود، Authorization Server باید پس از استفاده، Refresh Token را باطل کند و اگر یک Refresh Token که قبلاً استفاده و باطل شده ارائه شود، تمام Refresh Tokenهای مربوط به آن مجوز را ابطال نماید.,1 +V10,OAuth and OIDC,V10.4,OAuth Authorization Server,V10.4.6,اگر از Code Grant استفاده شود، Authorization Server باید حملات Authorization Code Interception را با الزام به استفاده از Proof Key for Code Exchange (PKCE) کاهش دهد. برای Authorization Requestها، Authorization Server باید یک مقدار معتبر برای 'code_challenge' الزام کند و نباید مقدار 'code_challenge_method' از نوع 'plain' را بپذیرد. برای Token Request، باید اعتبارسنجی پارامتر 'code_verifier' الزامی باشد.,2 +V10,OAuth and OIDC,V10.4,OAuth Authorization Server,V10.4.7,اگر Authorization Server از Unauthenticated Dynamic Client Registration پشتیبانی می‌کند، ریسک مربوط به Client Applicationهای مخرب را باید کاهش دهد. این کار باید شامل اعتبارسنجی Client Metadata (مانند هر Registered URI)، اطمینان از رضایت کاربر، و هشدار به کاربر پیش از پردازش یک Authorization Request با یک Client Application غیرقابل اعتماد باشد.,2 +V10,OAuth and OIDC,V10.4,OAuth Authorization Server,V10.4.8,Refresh Tokenها باید دارای یک انقضای مطلق (Absolute Expiration) باشند، حتی اگر از Sliding Refresh Token Expiration استفاده شود.,2 +V10,OAuth and OIDC,V10.4,OAuth Authorization Server,V10.4.9,Refresh Tokenها و Reference Access Tokenها باید توسط کاربر مجاز از طریق User Interface Authorization Server قابل ابطال باشند، تا ریسک Clientهای مخرب یا توکن‌های سرقت‌شده کاهش یابد.,2 +V10,OAuth and OIDC,V10.4,OAuth Authorization Server,V10.4.10,Confidential Client باید برای درخواست‌های Backchannel بین Client و Authorization Server، مانند Token Requests، Pushed Authorization Requests (PAR) و Token Revocation Requests، احراز هویت شود.,2 +V10,OAuth and OIDC,V10.4,OAuth Authorization Server,V10.4.11,پیکربندی Authorization Server باید فقط Scopes موردنیاز را به OAuth Client اختصاص دهد.,2 +V10,OAuth and OIDC,V10.4,OAuth Authorization Server,V10.4.12,برای یک Client مشخص، Authorization Server فقط مقدار 'response_mode' را که این Client نیاز دارد، مجاز بداند. برای مثال، با اعتبارسنجی این مقدار توسط Authorization Server در برابر مقادیر مورد انتظار یا با استفاده از Pushed Authorization Request (PAR) یا JWT-secured Authorization Request (JAR).,3 +V10,OAuth and OIDC,V10.4,OAuth Authorization Server,V10.4.13,Grant Type ‘code’ همواره همراه با Pushed Authorization Requests (PAR) باید استفاده شود.,3 +V10,OAuth and OIDC,V10.4,OAuth Authorization Server,V10.4.14,Authorization Server باید فقط توکن‌های دسترسی از نوع وابسته به ارسال‌کننده (Proof-of-Possession) صادر می‌کند؛ چه به‌صورت توکن‌های دسترسی مبتنی بر گواهی از طریق TLS دوسویه (mTLS) و چه به‌صورت توکن‌های دسترسی وابسته به DPoP (Demonstration of Proof of Possession).,3 +V10,OAuth and OIDC,V10.4,OAuth Authorization Server,V10.4.15,برای یک کلاینت سمت‌سرور (که روی دستگاه کاربر نهایی اجرا نمی‌شود)، سرور احراز هویت اطمینان حاصل می‌کند که مقدار پارامترِ authorization_details از بک‌اند کلاینت ارسال شده و کاربر در آن دستکاری نکرده است. به‌عنوان مثال، با الزام به استفاده از درخواست احراز هویت پوش‌شده (PAR) یا درخواست احراز هویت ایمن‌شده با JWT (JAR).,3 +V10,OAuth and OIDC,V10.4,OAuth Authorization Server,V10.4.16,کلاینت باید از نوع Confidential Client باشد و سرور احراز هویت استفاده از روش‌های قدرتمند احراز هویت کلاینت ـ مبتنی بر رمزنگاری کلید عمومی و مقاوم در برابر حملات replay attacks ـ را الزامی کند؛ مانند TLS دوسویه (tls_client_auth ‎، ‎self_signed_tls_client_auth یا JWT مبتنی بر کلید خصوصی (private_key_jwt).,3 +V10,OAuth and OIDC,V10.5,OIDC Client,V10.5.1,Client به‌عنوان Relying Partyباید در برابر حملات بازپخش (Replay) توکن ID محافظت شده است. برای مثال، با بررسی اینکه مقدار claim مربوط به nonce در ID Token دقیقاً با مقدار **nonce**ای که در درخواست احراز هویت به OpenID Provider ارسال شده، یکسان باشد(که در OAuth 2 به آن authorization request ارسالی به authorization server گفته می‌شود).,2 +V10,OAuth and OIDC,V10.5,OIDC Client,V10.5.2,Client باید کاربر را به‌صورت یکتا از ID Token Claims شناسایی کند، معمولاً از ‘sub’ Claim ، که قابل انتساب مجدد به کاربران دیگر نیست (در محدوده‌ی همان Identity Provider).,2 +V10,OAuth and OIDC,V10.5,OIDC Client,V10.5.3,Client باید تلاش‌های یک Authorization Server مخرب برای جا زدن خود به‌جای یک Authorization Server دیگر از طریق متادیتای Authorization Server را رد می‌کند.کلاینت باید متادیتای Authorization Server را رد کند اگر مقدار issuer URL موجود در متادیتا دقیقاً با issuer URL از پیش پیکربندی‌شده و مورد انتظار کلاینت یکسان نباشد.,2 +V10,OAuth and OIDC,V10.5,OIDC Client,V10.5.4,Client باید اعتبارسنجی کند ID Token برای استفاده توسط همان Client در نظر گرفته شده است (Audience)، با بررسی اینکه ‘aud’ Claim در توکن برابر با مقدار ‘client_id’ مربوط به Client باشد.,2 +V10,OAuth and OIDC,V10.5,OIDC Client,V10.5.5,هنگام استفاده ازOIDC Back-Channel Logout، Relying Party از Denial of Service از طریق Forced Logout و Cross-JWT Confusion در جریان Logout باید جلوگیری کند. Client باید بررسی کند که Logout Token به درستی با مقدار typ آن برابر با logout+jwt باشد ، شامل ‘event’ Claim با نام عضو صحیح باشد و شامل ‘nonce’ Claim نباشد. همچنین توصیه می‌شود Expiration کوتاه باشد (مثلاً ۲ دقیقه).,2 +V10,OAuth and OIDC,V10.6,OpenID Provider,V10.6.1,OpenID Provider باید فقط مقادیر 'code'، 'ciba'، 'id_token' یا 'id_token code' را برای Response Mode مجاز بداند. توجه داشته باشید که 'code' نسبت به 'id_token code' (که OIDC Hybrid Flow است) ترجیح داده می‌شود و 'token' (هر Implicit Flow) نباید استفاده شود.,2 +V10,OAuth and OIDC,V10.6,OpenID Provider,V10.6.2,OpenID Provider از Denial of Service از طریق Forced Logout جلوگیری کند. این کار با دریافت تأیید صریح از کاربر نهایی یا در صورت وجود، اعتبارسنجی پارامترها در Logout Request (که توسط Relying Party آغاز شده است)، مانند ‘id_token_hint’، انجام می‌شود.,2 +V10,OAuth and OIDC,V10.7,Consent Management,V10.7.1,Authorization Server باید تضمین ‌کند کاربر برای هر درخواست مجوز (Authorization Request) رضایت خود را اعلام کرده است. در صورتی که هویت کلاینت قابل اطمینان نباشد، Authorization Server باید در همه موارد کاربر را به‌صورت صریح برای اعلام رضایت (Consent) راهنمایی و از او تأیید بگیرد.,2 +V10,OAuth and OIDC,V10.7,Consent Management,V10.7.2,زمانی که Authorization Server از کاربر درخواست رضایت (Consent) می‌کند باید اطلاعات کافی و شفافی درباره آنچه کاربر در حال تأیید آن است ارائه ‌دهد. در صورت لزوم، این اطلاعات باید شامل این موارد باشد: ماهیت مجوزهای درخواستی )معمولاً بر اساس scope، resource server و جزئیات مجوز در Rich Authorization Requests – RAR)، هویت برنامه یا اپلیکیشن دریافت‌کننده مجوز و مدت اعتبار این مجوزها.,2 +V10,OAuth and OIDC,V10.7,Consent Management,V10.7.3,کاربر باید بتواند رضایت‌هایی (Consents) را که از طریق Authorization Server صادر کرده است، مشاهده، ویرایش و لغو (Revoke) کند.,2 +V11,Cryptography,V11.1,Cryptographic Inventory and Documentation,V11.1.1,اطمینان حاصل کنید که یک سیاست مستند برای مدیریت کلیدهای رمزنگاری و چرخه‌عمر کلیدهای رمزنگاری وجود دارد که از یک استاندارد مدیریت کلید مانند NIST SP 800-57 پیروی می‌کند. این باید شامل اطمینان از این موضوع باشد که کلیدها بیش از حد به اشتراک گذاشته نشوند (برای مثال، در مورد Secrets مشترک با بیش از دو موجودیت و در مورد کلیدهای خصوصی با بیش از یک موجودیت).,2 +V11,Cryptography,V11.1,Cryptographic Inventory and Documentation,V11.1.2,فهرست اجزاء رمزنگاری باید تهیه و نگهداری ‌شود و به‌صورت منظم به‌روزرسانی گردد و شامل تمام کلیدهای رمزنگاری، الگوریتم‌ها و گواهی‌های دیجیتال مورد استفاده در برنامه باشد. این فهرست همچنین باید مشخص کند که کلیدها در کدام بخش‌های سیستم مجاز یا غیرمجاز به استفاده هستند و چه نوع داده‌هایی می‌توانند یا نمی‌توانند با این کلیدها محافظت شوند.,2 +V11,Cryptography,V11.1,Cryptographic Inventory and Documentation,V11.1.3,مکانیزم‌های کشف رمزنگاری برای شناسایی تمام موارد استفاده از رمزنگاری در سیستم باید استفاده ‌شود؛ از جمله رمزنگاری (encryption)، هش‌کردن (hashing) و عملیات امضای دیجیتال (signing).,3 +V11,Cryptography,V11.1,Cryptographic Inventory and Documentation,V11.1.4,فهرست اجزاء رمزنگاری باید تهیه ‌شود. این فهرست باید شامل یک برنامه مستند باشد که مسیر مهاجرت به استانداردهای جدید رمزنگاری (مانند رمزنگاری پساکوانتومی) را مشخص می‌کند تا امکان واکنش مناسب به تهدیدات آینده فراهم شود.,3 +V11,Cryptography,V11.2,Secure Cryptography Implementation,V11.2.1,برای عملیات رمزنگاری باید از پیاده‌سازی‌های مورد تأیید (شامل کتابخانه‌ها و پیاده‌سازی‌های سخت‌افزاری) استفاده شود.,2 +V11,Cryptography,V11.2,Secure Cryptography Implementation,V11.2.2,برنامه با انعطاف‌پذیری رمزنگاری (crypto agility) باید طراحی شده باشد، به‌طوری که الگوریتم‌های تولید اعداد تصادفی، رمزنگاری احراز هویت‌شده، MAC یا هش، طول کلیدها، تعداد دورها، رمزها و حالت‌ها بتوانند در هر زمان مجدداً پیکربندی، ارتقاء یا تعویض شوند تا در برابر شکست‌های رمزنگاری محافظت شوند. به همین ترتیب، باید امکان جایگزینی کلیدها و رمزهای عبور و رمزگذاری مجدد داده‌ها نیز وجود داشته باشد. این امکان ارتقاء بدون وقفه به رمزنگاری پساکوانتومی (PQC) را فراهم می‌کند، زمانی که پیاده‌سازی‌های با اطمینان بالا از طرح‌ها یا استانداردهای تأییدشده PQC به‌طور گسترده در دسترس قرار گیرند.,2 +V11,Cryptography,V11.2,Secure Cryptography Implementation,V11.2.3,تمام بدویات رمزنگاری (cryptographic primitives) بر اساس الگوریتم، اندازه کلید و پیکربندی، حداقل ۱۲۸ بیت سطح امنیتی را فراهم می‌کنند(2128)، برای مثال، یک کلید ECC با طول ۲۵۶ بیت تقریباً ۱۲۸ بیت امنیت ارائه می‌دهد، در حالی که برای رسیدن به همین سطح امنیت، الگوریتم RSA به کلید ۳۰۷۲ بیتی نیاز دارد.,2 +V11,Cryptography,V11.2,Secure Cryptography Implementation,V11.2.4,تأیید کنید که تمامی عملیات رمزنگاری زمان ثابت (constant-time) باشند و هیچ عملیات «کوتاه‌شده» (short-circuit) در مقایسه‌ها، محاسبات یا بازگشت‌ها وجود نداشته باشد تا از نشت اطلاعات جلوگیری شود.( مهاجم می‌تواند از همین تفاوت‌های زمانی، از طریق Timing Side-Channel Attack، اطلاعات حساس را استخراج کند.),3 +V11,Cryptography,V11.2,Secure Cryptography Implementation,V11.2.5,تأیید کنید که تمامی ماژول‌های رمزنگاری به‌صورت امن دچار خطا (fail securely) شوند و خطاها به گونه‌ای مدیریت شوند که ایجاد آسیب‌پذیری‌هایی مانند حملات Padding Oracle را ممکن نکنند.,3 +V11,Cryptography,V11.3,Encryption Algorithms,V11.3.1,از مد‌های بلاک ناامن (مانند ECB) و روش‌های Padding ضعیف (مانند PKCS#1 v1.5) نباید استفاده شود.,1 +V11,Cryptography,V11.3,Encryption Algorithms,V11.3.2,تنها رمزها و مد‌های تأییدشده، مانند AES با GCM باید استفاده شوند.,1 +V11,Cryptography,V11.3,Encryption Algorithms,V11.3.3,داده‌های رمزنگاری‌شده باید با استفاده از ترجیحاً یک روش رمزنگاری احراز هویت‌شده تأییدشده یا با ترکیب یک روش رمزنگاری تأییدشده با یک الگوریتم MAC تأییدشده در برابر تغییرات غیرمجاز محافظت شوند.,2 +V11,Cryptography,V11.3,Encryption Algorithms,V11.3.4,تأیید کنید که Nonceها، Initialization Vectorها و سایر اعداد یک‌بار مصرف برای بیش از یک جفت کلید رمزنگاری و عنصر داده استفاده نشوند. روش تولید آن‌ها باید متناسب با الگوریتم مورد استفاده باشد.,3 +V11,Cryptography,V11.3,Encryption Algorithms,V11.3.5,تأیید کنید که هر ترکیبی از یک الگوریتم رمزنگاری و یک الگوریتم MAC در حالت Encrypt-then-MAC عمل کند.,3 +V11,Cryptography,V11.4,Hashing and Hash-based Functions,V11.4.1,تأیید کنید که تنها توابع هش تأییدشده برای موارد استفاده عمومی رمزنگاری، از جمله امضاهای دیجیتال، HMAC، KDF و تولید بیت تصادفی استفاده شوند. توابع هش غیرمجاز، مانند MD5، نباید برای هیچ هدف رمزنگاری به‌کار گرفته شوند.,1 +V11,Cryptography,V11.4,Hashing and Hash-based Functions,V11.4.2,رمزعبورها با استفاده از یک تابع مشتق‌سازی کلید تأییدشده و پرهزینه محاسباتی (که به آن «تابع هش رمزعبور» نیز گفته می‌شود) ذخیره شوند، و تنظیمات پارامترها بر اساس راهنمایی‌های کنونی پیکربندی شده باشد. این تنظیمات باید تعادل بین امنیت و عملکرد برقرار کنند تا حملات Brute-force برای سطح امنیت مورد نیاز به‌طور کافی دشوار باشد.,2 +V11,Cryptography,V11.4,Hashing and Hash-based Functions,V11.4.3,توابع هش استفاده‌شده در امضاهای دیجیتال، باید به‌عنوان بخشی از احراز هویت داده یا یکپارچگی داده، در برابر collision مقاوم بوده و طول بیت مناسب داشته باشند. اگر مقاومت در برابر collision لازم باشد، طول خروجی باید حداقل 256 بیت باشد. اگر تنها مقاومت در برابر حملات Second Pre-image لازم باشد، طول خروجی باید حداقل 128 بیت باشد.,2 +V11,Cryptography,V11.4,Hashing and Hash-based Functions,V11.4.4,برنامه باید هنگام استخراج کلیدهای مخفی از پسوردها از توابع مشتق‌سازی کلید (KDF) تاییدشده با پارامترهای Key Stretching استفاده می‌کند. پارامترهای مورد استفاده باید تعادلی بین امنیت و عملکرد برقرار کنند تا از نفوذ حملات brute-force و به خطر افتادن کلید رمزنگاری تولیدشده جلوگیری شود.,2 +V11,Cryptography,V11.5,Random Values,V11.5.1,اعداد و رشته‌های تصادفی که قرار است قابل حدس نباشند، باید با استفاده از یک تولیدکننده اعداد شبه‌تصادفی امن رمزنگاری‌شده (CSPRNG) تولید شوند و حداقل 128 بیت انتروپی داشته باشند. توجه داشته باشید که UUIDها این شرط را رعایت نمی‌کنند.,2 +V11,Cryptography,V11.5,Random Values,V11.5.2,مکانیزم تولید اعداد تصادفی مورد استفاده به‌گونه‌ای طراحی شده باشد که حتی تحت بار سنگین نیز به‌طور امن عمل کند.,3 +V11,Cryptography,V11.6,Public Key Cryptography,V11.6.1,فقط الگوریتم‌های رمزنگاری و مدهای عملیاتی تأیید شده برای تولید کلید و مقداردهی اولیه، و همچنین برای تولید و تأیید امضاهای دیجیتال باید استفاده می‌شوند. الگوریتم‌های تولید کلید نباید کلیدهای ناامن تولید کنند که در برابر حملات شناخته شده آسیب‌پذیر باشند؛ به‌عنوان مثال، کلیدهای RSA که در برابر Fermat factorization آسیب‌پذیر هستند.,2 +V11,Cryptography,V11.6,Public Key Cryptography,V11.6.2,برای تبادل کلید از الگوریتم‌های رمزنگاری تأیید شده (مانند Diffie-Hellman) استفاده می‌شود و تمرکز بر این است که مکانیزم‌های تبادل کلید از پارامترهای امن بهره ببرند. این کار از حملات بر فرآیند برقراری کلید جلوگیری می‌کند و مانع حملات مرد میانی (MITM) یا شکست‌های رمزنگاری می‌شود.,3 +V11,Cryptography,V11.7,In-Use Data Cryptography,V11.7.1,رمزنگاری کامل حافظه (Full Memory Encryption) باید فعال باشد تا داده‌های حساس هنگام استفاده محافظت شوند و دسترسی کاربران یا فرآیندهای غیرمجاز به آن‌ها جلوگیری شود.,3 +V11,Cryptography,V11.7,In-Use Data Cryptography,V11.7.2,کاهش داده‌ها (data minimization) تضمین می‌کند که حداقل مقدار داده در حین پردازش افشا شود، و اطمینان حاصل شود که داده‌ها بلافاصله پس از استفاده یا در اولین فرصت ممکن رمزنگاری شوند.,3 +V12,Secure Communication,V12.1,General TLS Security Guidance,V12.1.1,جدیدترین نسخه‌های پیشنهادی پروتکل TLS فعال باشند، مانند TLS 1.2 و TLS 1.3 نسخه‌ی جدیدترین پروتکل TLS باید گزینه‌ی ترجیحی باشد.,1 +V12,Secure Communication,V12.1,General TLS Security Guidance,V12.1.2,تنها cipher suiteهای پیشنهادی فعال باشند و قوی‌ترین cipher suiteها به‌عنوان گزینه‌ی ترجیحی تنظیم شده باشند. برنامه‌های L3 باید تنها از cipher suiteهایی پشتیبانی کنند که Forward Secrecy را فراهم می‌کنند.,2 +V12,Secure Communication,V12.1,General TLS Security Guidance,V12.1.3,برنامه باید پیش از استفاده از هویت گواهی برای احراز هویت یا مجوزدهی، اعتبار و مورد اعتماد بودن گواهی‌های کلاینت در mTLS را بررسی و تأیید ‌کند.,2 +V12,Secure Communication,V12.1,General TLS Security Guidance,V12.1.4,لغو صحیح گواهی‌ها، مانند OCSP ، باید فعال و به‌درستی پیکربندی شده باشد.,3 +V12,Secure Communication,V12.1,General TLS Security Guidance,V12.1.5,Encrypted Client Hello (ECH) باید در تنظیمات TLS برنامه فعال باشد تا از افشای متادیتای حساس، مانند Server Name Indication (SNI)، در طول فرآیند Handshake TLS جلوگیری شود.,3 +V12,Secure Communication,V12.2,HTTPS Communication with External Facing Services,V12.2.1,برای تمام ارتباطات بین کلاینت و سرویس‌های مبتنی بر HTTP که در معرض دسترسی خارجی هستند، از TLS باید استفاده ‌شود و هیچ‌گونه بازگشت (fallback) به ارتباطات ناامن یا بدون رمزنگاری انجام نگیرد.,1 +V12,Secure Communication,V12.2,HTTPS Communication with External Facing Services,V12.2.2,سرویس‌هایی که در معرض دسترسی خارجی قرار دارند از گواهی‌های TLS عمومی و مورد اعتماد استفاده می‌کنند.,1 +V12,Secure Communication,V12.3,General Service to Service Communication Security,V12.3.1,یک پروتکل رمزنگاری‌شده مانند TLS باید برای تمامی ارتباطات ورودی و خروجی به و از برنامه استفاده شود، از جمله سیستم‌های مانیتورینگ، ابزارهای مدیریت، دسترسی از راه دور و SSH، میان‌افزارها، پایگاه‌های داده، mainframes، سیستم‌های partner یا APIهای خارجی. سرور نباید به پروتکل‌های ناامن یا بدون رمزگذاری بازگردد.,2 +V12,Secure Communication,V12.3,General Service to Service Communication Security,V12.3.2,کلاینت‌های TLS باید قبل از برقراری ارتباط با سرور TLS، گواهی‌های دریافتی را اعتبارسنجی کنند.,2 +V12,Secure Communication,V12.3,General Service to Service Communication Security,V12.3.3,TLS یا دیگر مکانیزم‌های مناسب رمزگذاری انتقال باید برای تمامی ارتباطات بین سرویس‌های داخلی مبتنی بر HTTP درون برنامه استفاده شود و ارتباط به حالت‌های ناامن یا بدون رمزگذاری بازنگردد.,2 +V12,Secure Communication,V12.3,General Service to Service Communication Security,V12.3.4,ارتباطات TLS بین سرویس‌های داخلی باید از گواهی‌های معتبر استفاده کنند. در صورتی که از گواهی‌های داخلی تولیدشده یا Self-Signed استفاده شود، سرویس مصرف‌کننده باید به‌گونه‌ای پیکربندی شود که تنها به CAهای داخلی مشخص و گواهی‌های Self-Signed خاص اعتماد کند.,2 +V12,Secure Communication,V12.3,General Service to Service Communication Security,V12.3.5,سرویس‌هایی که درون یک سیستم با یکدیگر ارتباط دارند (ارتباطات درون‌سرویسی)، باید از احراز هویت قوی استفاده کنند تا هر نقطه انتهایی (endpoint) تأیید شود. روش‌های احراز هویت قوی، مانند احراز هویت کلاینت TLS، باید به‌کار گرفته شوند تا هویت تضمین شود (با استفاده از زیرساخت کلید عمومی (PKI) و مکانیزم‌هایی که در برابر حملات تکرار (replay attacks) مقاوم هستند). برای معماری‌های میکروسرویس، استفاده از سرویس مش برای ساده‌سازی مدیریت گواهی‌ها و افزایش امنیت در نظر گرفته شود,3 +V13,Configuration,V13.1,Configuration Documentation,V13.1.1,تمامی نیازهای ارتباطی برنامه باید به‌طور کامل مستندسازی شده باشند. این مستندسازی شامل سرویس‌های خارجی که برنامه به آن‌ها وابسته است و همچنین مواردی که کاربر نهایی جهت اتصال به سرویس خارجی مشخص می‌کند باید باشد.,2 +V13,Configuration,V13.1,Configuration Documentation,V13.1.2,برای هر سرویسی که برنامه استفاده می‌کند، مستندسازی باید شامل حداکثر تعداد ارتباطات همزمان (مثلاً محدودیت‌های Connection Pool) و نحوه‌ی رفتار برنامه هنگام رسیدن به این حد باشد، از جمله هر مکانیزم بازیابی یا جایگزین، تا از بروز شرایط Denial of Service جلوگیری شود.,3 +V13,Configuration,V13.1,Configuration Documentation,V13.1.3,مستندات برنامه باید استراتژی‌های مدیریت منابع را برای هر سیستم یا سرویس خارجی که استفاده می‌کند مشخص کرده باشد (مثلاً پایگاه‌های داده، هندل‌های فایل، رشته‌ها، اتصالات HTTP) این مستندسازی باید شامل این موارد باشد :رویه‌های آزادسازی منابع، تنظیمات تایم‌اوت، مدیریت خطاها، جایی که منطق Retry اعمال می‌شود، شامل محدودیت تعداد Retry، تأخیرها و الگوریتم‌هایBack-off. برای عملیات همزمان درخواست–پاسخ HTTP (Synchronous)، مستندات باید تایم‌اوت کوتاه را الزام کند و یا Retryها را غیرفعال کند یا به‌طور سختگیرانه محدود کند تا از تاخیرهای زنجیره‌ای و هدررفت منابع جلوگیری شود.,3 +V13,Configuration,V13.1,Configuration Documentation,V13.1.4,مستندسازی برنامه باید شامل secretهای حیاتی برای امنیت برنامه و همچنین برنامه‌ای برای چرخش آن‌ها باشد( بر اساس مدل تهدید سازمان و نیازهای کسب‌وکار).,3 +V13,Configuration,V13.2,Backend Communication Configuration,V13.2.1,رتباطات بین اجزای بک‌اند برنامه که از مکانیزم استاندارد نشست کاربران برنامه پشتیبانی نمی‌کنند، از جمله APIها، میان‌افزارها و لایه‌های داده، باید احراز هویت شده باشند. احراز هویت باید با استفاده از حساب‌های سرویس جداگانه، توکن‌های کوتاه‌مدت یا احراز هویت مبتنی بر گواهی انجام شود و نباید از اعتبارنامه‌های ثابت مانند رمز عبور، کلیدهای API یا حساب‌های مشترک با دسترسی‌های سطح بالا استفاده شود.,2 +V13,Configuration,V13.2,Backend Communication Configuration,V13.2.2,ارتباطات بین اجزای بک‌اند، از جمله سرویس‌های محلی یا سیستم‌عامل، APIها، میان‌افزارها و لایه‌های داده، با حساب‌هایی باید انجام شود که کمترین سطح دسترسی لازم را دارند.,2 +V13,Configuration,V13.2,Backend Communication Configuration,V13.2.3,اگر اعتبارنامه‌ای برای احراز هویت سرویس استفاده می‌شود، اعتبارنامه‌ای که توسط مصرف‌کننده استفاده می‌شود، اعتبارنامه پیش‌فرض نباشد (مثلاً root/root یا admin/admin).,2 +V13,Configuration,V13.2,Backend Communication Configuration,V13.2.4,یک allowlist برای تعیین منابع یا سیستم‌های خارجی که برنامه مجاز به ارتباط با آن‌ها است باید وجود داشته باشد (مثلاً برای درخواست‌های خروجی، بارگذاری داده یا دسترسی به فایل). این allowlist می‌تواند در لایه برنامه، وب‌سرور، فایروال یا ترکیبی از لایه‌های مختلف پیاده‌سازی شود.,2 +V13,Configuration,V13.2,Backend Communication Configuration,V13.2.5,وب‌سرور یا سرور برنامه با یک allowlist از منابع یا سیستم‌هایی که سرور می‌تواند به آن‌ها درخواست ارسال کند یا داده‌ها و فایل‌ها را بارگذاری کند پیکربندی شده باشد.,2 +V13,Configuration,V13.2,Backend Communication Configuration,V13.2.6,در مواقعی که برنامه به سرویس‌های جداگانه متصل می‌شود، پیکربندی مستندسازی‌شده برای هر اتصال رعایت شود، از جمله حداکثر ارتباطات همزمان، رفتار هنگام رسیدن به حداکثر ارتباط مجاز، زمان‌های Timeout اتصال و استراتژی‌های Retry.,3 +V13,Configuration,V13.3,Secret Management,V13.3.1,یک راهکار مدیریت secret، مانند Key Vault، برای ایجاد امن، ذخیره، کنترل دسترسی و از بین بردن secret بک‌اند استفاده شود. این secret می‌تواند شامل رمزعبورها، داده‌های رمز نگاری، اطلاعات حساس مربوط به اتصال به پایگاه داده و سیستم‌های شخص ثالث، کلیدها و seedهای توکن‌های زمان‌محور، سایر secretهای داخلی و کلیدهای API باشد. Secret نباید در کد منبع برنامه یا در build artifacts قرار گیرد. برای برنامه‌های L3، این باید شامل راهکاری مبتنی بر سخت‌افزار مانند HSM باشد.,2 +V13,Configuration,V13.3,Secret Management,V13.3.2,دسترسی به دارایی‌های secret بر اساس اصل حداقل دسترسی (Least Privilege) رعایت شود.,2 +V13,Configuration,V13.3,Secret Management,V13.3.3,تمام عملیات رمزنگاری باید با استفاده از یک ماژول امنیتی ایزوله (مانند Vault یا Hardware Security Module) انجام شود تا مواد کلیدی به‌طور امن مدیریت و محافظت شده و از افشای خارج از ماژول امنیتی جلوگیری شود.,3 +V13,Configuration,V13.3,Secret Management,V13.3.4,secretها بر اساس مستندسازی برنامه طوری پیکربندی شوند که منقضی شده و چرخش داده شوند.,3 +V13,Configuration,V13.4,Unintended Information Leakage,V13.4.1,برنامه باید به‌گونه‌ای مستقر شود که هیچ‌گونه متادیتای کنترل نسخه، از جمله پوشه‌های .git یا .svn، در دسترس نباشد یا به شکلی باشد که این پوشه‌ها نه از بیرون و نه توسط خود برنامه قابل دسترسی نباشند.,1 +V13,Configuration,V13.4,Unintended Information Leakage,V13.4.2,حالت‌های Debug برای تمام اجزا در محیط‌های production باید غیرفعال شده باشند تا از افشای قابلیت‌های دیباگ و نشت اطلاعات جلوگیری شود.,2 +V13,Configuration,V13.4,Unintended Information Leakage,V13.4.3,وب‌سرورها فهرست‌بندی دایرکتوری‌ها را به کاربر نهایی نباید نمایش دهند مگر اینکه به‌طور صریح مورد نظر باشد.,2 +V13,Configuration,V13.4,Unintended Information Leakage,V13.4.4,از متد HTTP TRACE در محیط‌های production نباید پشتیبانی شود تا از احتمال نشت اطلاعات جلوگیری شود.,2 +V13,Configuration,V13.4,Unintended Information Leakage,V13.4.5,مستندسازی‌ها (مانند مستندات APIهای داخلی) و نقاط پایش (Monitoring Endpoints) در دسترس نباشند مگر اینکه به‌طور صریح مورد نظر باشد.,2 +V13,Configuration,V13.4,Unintended Information Leakage,V13.4.6,تأیید کنید که برنامه اطلاعات نسخه دقیق اجزای backend را افشا نکند.,3 +V13,Configuration,V13.4,Unintended Information Leakage,V13.4.7,لایه وب باید به‌گونه‌ای پیکربندی شده باشد که فقط فایل‌هایی با پسوندهای مشخص را سرو کند تا از افشای تصادفی اطلاعات، پیکربندی و کد منبع جلوگیری شود.,3 +V14,Data Protection,V14.1,Data Protection Documentation,V14.1.1,تمامی داده‌های حساس ایجادشده و پردازش‌شده توسط برنامه باید شناسایی شده و بر اساس سطوح حفاظتی طبقه‌بندی شده‌اند. این موضوع شامل داده‌هایی می‌شود که صرفاً کُدگذاری شده‌اند و به‌راحتی قابل بازیابی هستند، مانند رشته‌های Base64 یا محتوای متنی (plaintext) داخل یک JWT. سطوح حفاظتی باید الزامات قوانین و استانداردهای حفاظت از داده و حریم خصوصی که برنامه ملزم به رعایت آن‌هاست را در نظر بگیرند.,2 +V14,Data Protection,V14.1,Data Protection Documentation,V14.1.2,برای تمامی سطوح حفاظت از داده‌های حساس، مجموعه‌ای مستند از الزامات حفاظتی تعریف شده باشد. این الزامات باید شامل (اما محدود به آن نباشد) موارد زیر باشند: الزامات مرتبط با رمزنگاری کلی، بررسی صحت و یکپارچگی، دوره‌های نگهداری داده، نحوه ثبت داده‌ها در لاگ، کنترل‌های دسترسی به داده‌های حساس در لاگ‌ها، رمزنگاری در سطح پایگاه داده، الزامات مربوط به حریم خصوصی و فناوری‌های تقویت‌کننده حریم خصوصی مورد استفاده، و سایر الزامات مرتبط با محرمانگی.,2 +V14,Data Protection,V14.2,General Data Protection,V14.2.1,داده‌های حساس باید فقط در بدنه پیام HTTP یا فیلدهای هدر به سرور ارسال شوند، و اینکه URL و query string شامل اطلاعات حساس (مانند API key یا session token) نباشند.,1 +V14,Data Protection,V14.2,General Data Protection,V14.2.2,برنامه باید از cache شدن داده‌های حساس در اجزای سرور مانند Load Balancer و Application Cache جلوگیری کند، یا اطمینان حاصل شود که داده‌ها پس از استفاده به‌طور ایمن پاک‌سازی می‌شوند.,2 +V14,Data Protection,V14.2,General Data Protection,V14.2.3,داده‌های حساس تعریف‌شده به طرف‌های غیرقابل اعتماد (مانند User Trackers) نباید ارسال شوند تا از جمع‌آوری ناخواسته داده‌ها خارج از کنترل برنامه جلوگیری شود.,2 +V14,Data Protection,V14.2,General Data Protection,V14.2.4,کنترل‌های مرتبط با داده‌های حساس شامل رمزنگاری، بررسی صحت و یکپارچگی، نگهداری، نحوه ثبت داده‌ها در لاگ، کنترل‌های دسترسی به داده‌های حساس در لاگ‌ها، حریم خصوصی و فناوری‌های مربوط به حریم خصوصی، مطابق با آنچه در مستندات برای سطح حفاظت مشخص هر داده تعریف شده است، پیاده‌سازی شوند.,2 +V14,Data Protection,V14.2,General Data Protection,V14.2.5,مکانیزم‌های cache باید طوری پیکربندی شده باشند که تنها پاسخ‌هایی با نوع محتوای مورد انتظار برای آن منبع cache شوند و شامل محتوای حساس یا پویا نباشند. وب‌سرور باید هنگام دسترسی به فایل ناموجود، پاسخ 404 یا 302 برگرداند و نه فایل معتبر دیگر، تا از حملات Web Cache Deception جلوگیری شود.,3 +V14,Data Protection,V14.2,General Data Protection,V14.2.6,برنامه باید تنها حداقل داده‌های حساس مورد نیاز برای عملکرد برنامه را بازگرداند. برای مثال، تنها برخی از ارقام شماره کارت اعتباری بازگردانده شود و نه شماره کامل. در صورتی که داده کامل لازم باشد، باید در رابط کاربری masked شود مگر اینکه کاربر به‌طور مشخص آن را مشاهده کند.,3 +V14,Data Protection,V14.2,General Data Protection,V14.2.7,اطلاعات حساس باید تحت طبقه‌بندی دوره‌ای نگهداری داده قرار گرفته باشند، به‌گونه‌ای که داده‌های قدیمی یا غیرضروری به‌طور خودکار، در یک برنامه زمان‌بندی‌شده مشخص، یا براساس نیاز حذف شوند.,3 +V14,Data Protection,V14.2,General Data Protection,V14.2.8,اطلاعات حساس باید از متادیتای فایل‌های ارسال‌شده توسط کاربر حذف شود، مگر اینکه ذخیره‌سازی آن با رضایت کاربر انجام شود.,3 +V14,Data Protection,V14.3,Client-side Data Protection,V14.3.1,داده‌های احراز هویت‌شده از حافظه کلاینت، مانند DOM مرورگر، پس از خروج کلاینت یا Session پاک شوند. فیلد هدر Clear-Site-Data در پاسخ سرور می‌تواند در این زمینه مفید باشد، اما کلاینت باید بتواند داده‌ها را حتی زمانی که اتصال به سرور در دسترس نیست در زمان پایان Session (خروج از آن) پاک کند.,1 +V14,Data Protection,V14.3,Client-side Data Protection,V14.3.2,برنامه باید هدرهای پاسخ HTTP، anti-cach مناسب (مانند Cache-Control: no-store) را تنظیم کند تا داده‌های حساس در مرورگرها cache نشوند.,2 +V14,Data Protection,V14.3,Client-side Data Protection,V14.3.3,برای اطلاعات بیشتر، همچنین به منابع زیر مراجعه کنید:,2 +V15,Secure Coding and Architecture,V15.1,Secure Coding and Architecture Documentation,V15.1.1,مستندات برنامه باید بازه‌های زمانی جهت برطرف سازی آسیب‌پذیری‌ نسخه‌های مؤلفه‌ شخص ثالث (بر اساس ریسک) و همچنین به‌روزرسانی کتابخانه‌ها را به طور کلی تعریف کرده باشد تا ریسک ناشی از این مؤلفه‌ها به حداقل برسد.,1 +V15,Secure Coding and Architecture,V15.1,Secure Coding and Architecture Documentation,V15.1.2,یک کاتالوگ دارایی مانند Software Bill of Materials (SBOM) باید برای تمامی کتابخانه‌های شخص ثالث مورد استفاده نگهداری شود. شامل تایید این که مؤلفه‌ها از مخازن از پیش تعیین‌شده، قابل اعتماد و به‌طور مستمر نگهداری‌شده تهیه شده‌اند.,2 +V15,Secure Coding and Architecture,V15.1,Secure Coding and Architecture Documentation,V15.1.3,مستندات برنامه باید شامل عملکردهایی که زمان‌بر یا پرمصرف(منابع سیستمی) هستند نیز باشد. این مورد باید شامل روش‌هایی برای جلوگیری از دست‌رفتن دسترس‌پذیری به دلیل استفاده بیش از حد از این عملکردها و همچنین جلوگیری از وضعیتی باشد که پردازش یک پاسخ طولانی‌تر از زمان انتظار مصرف‌کننده شود. تدابیر احتمالی می‌تواند شامل پردازش غیرهمزمان، استفاده از صف‌ها و محدود کردن فرآیندهای موازی برای هر کاربر و هر برنامه باشد.,2 +V15,Secure Coding and Architecture,V15.1,Secure Coding and Architecture Documentation,V15.1.4,مستندات برنامه باید کتابخانه‌های شخص ثالثی را که به‌عنوان «کامپوننت‌های پرخطر» شناخته می‌شوند، مشخص کرده باشد.,3 +V15,Secure Coding and Architecture,V15.1,Secure Coding and Architecture Documentation,V15.1.5,مستندات برنامه باید بخش‌هایی از برنامه را که به‌عنوان «عملکرد خطرناک» استفاده می‌شود، مشخص کرده باشد.,3 +V15,Secure Coding and Architecture,V15.2,Security Architecture and Dependencies,V15.2.1,برنامه باید تنها شامل کامپوننت‌هایی باشد که چارچوب‌های زمانی مستند‌شده برای به‌روزرسانی و رفع آسیب‌پذیری‌ها را نقض نکرده‌باشند.,1 +V15,Secure Coding and Architecture,V15.2,Security Architecture and Dependencies,V15.2.2,برنامه باید بر اساس تصمیمات و استراتژی‌های امنیتی مستندسازی‌شده، تدابیری برای جلوگیری از کاهش دسترس‌پذیری ناشی از عملکردهایی که زمان‌بر یا پرمصرف منابع هستند، پیاده‌سازی کرده باشد.,2 +V15,Secure Coding and Architecture,V15.2,Security Architecture and Dependencies,V15.2.3,محیط production تنها شامل عملکردهایی می‌باشد که برای اجرای برنامه ضروری هستند و هیچ قابلیت اضافی مانند کدهای تست، نمونه‌کدها و عملکردهای توسعه‌ای در دسترس نمی‌باشد.,2 +V15,Secure Coding and Architecture,V15.2,Security Architecture and Dependencies,V15.2.4,کامپوننت‌های شخص ثالث و تمام وابستگی‌های انتقالی آن‌ها از مخزن مورد انتظار باید دریافت ‌شوند، چه داخلی و چه منبع خارجی، و ریسک حمله‌ی dependency confusion مدیریت شود.,3 +V15,Secure Coding and Architecture,V15.2,Security Architecture and Dependencies,V15.2.5,برنامه باید محافظت‌های اضافی را در بخش‌هایی از برنامه که به‌عنوان «عملکرد خطرناک» مستند شده‌اند یا از کتابخانه‌های شخص ثالثی که به‌عنوان «کامپوننت‌های پرریسک» شناخته می‌شوند، پیاده‌سازی می‌کند. این می‌تواند شامل تکنیک‌هایی مانند sandboxing، encapsulation، containerization یا جداسازی در سطح شبکه باشد تا حمله‌کنندگان پس از نفوذ به یک بخش از برنامه، نتوانند به بخش‌های دیگر برنامه منتقل شوند و زمان لازم برای پیشروی آن‌ها افزایش یابد.,3 +V15,Secure Coding and Architecture,V15.3,Defensive Coding,V15.3.1,برنامه باید تنها زیرمجموعه‌ای از فیلدهای مورد نیاز از یک data object را بازگرداند. به‌عنوان مثال، نباید کل data object بازگردانده شود، زیرا برخی فیلدهای منفرد نباید برای کاربران قابل دسترسی باشند.,1 +V15,Secure Coding and Architecture,V15.3,Defensive Coding,V15.3.2,در جایی که بک‌اند برنامه به URLهای خارجی فراخوانی می‌فرستد، طوری باید پیکربندی شده باشد که تنها در صورت نیاز و منظور مشخص، از تغییر مسیرها (redirects) پیروی کند.,2 +V15,Secure Coding and Architecture,V15.3,Defensive Coding,V15.3.3,برنامه باید دارای تدابیر مقابله‌ای برای محافظت در برابر حملات mass assignment باشد، به‌طوری که فیلدهای مجاز برای هر کنترلر و اکشن محدود شده باشند؛ به عنوان مثال، نباید بتوان مقداری برای فیلدی وارد یا به‌روزرسانی کرد که قرار نبوده بخشی از آن اکشن باشد.,2 +V15,Secure Coding and Architecture,V15.3,Defensive Coding,V15.3.4,تمام اجزای proxying و middleware باید آدرس IP اصلی کاربر را به‌درستی منتقل کنند، با استفاده از فیلدهای داده معتبر که توسط کاربر نهایی قابل دستکاری نباشند، و برنامه و وب‌سرور از این مقدار صحیح برای ثبت لاگ و تصمیم‌گیری‌های امنیتی مانند rate limiting استفاده کنند، با در نظر گرفتن اینکه حتی آدرس IP اصلی ممکن است به دلیل IPهای پویا، VPNها یا فایروال‌های سازمانی قابل اعتماد نباشد.,2 +V15,Secure Coding and Architecture,V15.3,Defensive Coding,V15.3.5,برنامه باید به‌طور صریح اطمینان حاصل کند که variables از نوع صحیح هستند و عملیات‌های مقایسه و comparator به‌صورت دقیق (strict) انجام می‌شوند. این اقدام برای جلوگیری از آسیب‌پذیری‌های type juggling یا type confusion است که ممکن است به دلیل فرضیات نادرست برنامه درباره نوع یک متغیر ایجاد شود.,2 +V15,Secure Coding and Architecture,V15.3,Defensive Coding,V15.3.6,کد JavaScript باید به‌گونه‌ای نوشته شده باشد که از prototype pollution جلوگیری کند، برای مثال با استفاده از Set() یا Map() به جای object literals.,2 +V15,Secure Coding and Architecture,V15.3,Defensive Coding,V15.3.7,برنامه باید دارای تدابیر محافظتی در برابر HTTP parameter pollution باشد، به‌ویژه اگر چارچوب برنامه تفاوتی بین منابع پارامترهای درخواست (رشته‌های query، پارامترهای body، کوکی‌ها یا فیلدهای هدر) قائل نشود.,2 +V15,Secure Coding and Architecture,V15.4,Safe Concurrency,V15.4.1,shared objects در کد multi-threaded (مانند cacheها، فایل‌ها، یا اشیائی که توسط multiple threads دسترسی پیدا می‌کنند) باید به‌صورت ایمن مورد استفاده قرار بگیرند، با استفاده از نوع‌های thread-safe و مکانیزم‌های همگام‌سازی مانند lock یا semaphore تا از race condition و تخریب داده جلوگیری شود.,3 +V15,Secure Coding and Architecture,V15.4,Safe Concurrency,V15.4.2,بررسی وضعیت یک resource، مانند وجود آن یا دسترسی‌ها،و اقداماتی که به این وضعیت وابسته‌اند، به‌صورت یک عملیات واحد انجام شوند تا از race condition نوع time-of-check to time-of-use (TOCTOU) جلوگیری شود. برای مثال، بررسی اینکه یک فایل وجود دارد قبل از باز کردن آن، یا تأیید دسترسی یک کاربر قبل از اعطای آن.,3 +V15,Secure Coding and Architecture,V15.4,Safe Concurrency,V15.4.3,باید از قفل‌ها (Locks) به طور یکنواخت استفاده شود تا از گیر کردن (Threads) جلوگیری شود، چه با انتظار برای یکدیگر و چه با تلاش بی‌پایان، و همچنین منطق قفل‌گذاری باید در همان کدی باقی بماند که مسئول مدیریت منبع است؛ این کار تضمین می‌کند که قفل‌ها نمی‌توانند به‌صورت ناخواسته یا خرابکارانه توسط کلاس‌ها یا کدهای بیرونی تغییر داده شوند.,3 +V15,Secure Coding and Architecture,V15.4,Safe Concurrency,V15.4.4,تأیید کنید که سیاست‌های تخصیص resource از thread starvation جلوگیری می‌کنند، با اطمینان از دسترسی عادلانه به منابع، مانند استفاده از thread pools و اجازه دادن به threads با اولویت پایین‌تر تا در بازه زمانی منطقی پیشرفت کنند.,3 +V16,Security Logging and Error Handling,V16.1,Security Logging Documentation,V16.1.1,فهرستی باید وجود داشته باشد که در آن ثبت وقایع (Logging) انجام‌شده در هر لایه از stack فناوری برنامه، رویدادهای ثبت‌شده، فرمت‌های لاگ، محل ذخیره‌سازی، نحوه استفاده، نحوه کنترل دسترسی به آن‌ها و مدت زمان نگهداری لاگ‌ها مستند شده است.,2 +V16,Security Logging and Error Handling,V16.2,General Logging,V16.2.1,هر ورودی لاگ باید شامل متادیتای لازم (مانند زمان، مکان، چه کسی و چه چیزی) باشد تا امکان بررسی دقیق خط زمانی هنگام وقوع یک رویداد فراهم شود.,2 +V16,Security Logging and Error Handling,V16.2,General Logging,V16.2.2,منابع زمانی برای تمام مؤلفه‌های لاگ با هم همگام‌سازی شده‌اند و مهر زمان (timestamp)‌ در متادیتای رویدادهای امنیتی از UTC استفاده ‌کند یا شامل یک اختلاف‌زمان (time zone offset) صریح باشد. استفاده از UTC توصیه می‌شود تا یکپارچگی در سراسر سیستم‌های توزیع‌شده تضمین شود و از بروز سردرگمی در زمان تغییر ساعت تابستانی جلوگیری گردد.,2 +V16,Security Logging and Error Handling,V16.2,General Logging,V16.2.3,برنامه تنها لاگ‌ها را در فایل‌ها و سرویس‌هایی ذخیره یا ارسال می‌کند که در فهرست مستند لاگ‌ها ثبت شده‌اند.,2 +V16,Security Logging and Error Handling,V16.2,General Logging,V16.2.4,لاگ‌ها باید توسط پردازشگر لاگی که در حال استفاده است خوانده و همبسته شوند، و ترجیحاً با استفاده از یک فرمت لاگ مشترک این کار انجام گیرد.,2 +V16,Security Logging and Error Handling,V16.2,General Logging,V16.2.5,هنگام لاگ‌گیری از داده‌های حساس، برنامه باید لاگ گیری را بر اساس سطح حفاظت داده اعمال کند. برای مثال، ممکن است لاگ‌کردن برخی داده‌ها مانند اطلاعات ورود یا جزئیات پرداخت مجاز نباشد. داده‌های دیگر، مانند session token، تنها در صورتی باید لاگ شوند که به‌صورت hash یا masked، چه به‌طور کامل یا جزئی، ثبت شوند.,2 +V16,Security Logging and Error Handling,V16.3,Security Events,V16.3.1,تمام عملیات احراز هویت باید لاگ‌گیری ‌شوند، از جمله تلاش‌های موفق و ناموفق. همچنین باید متادیتای اضافی، مانند نوع احراز هویت یا عوامل استفاده‌شده، جمع‌آوری شود.,2 +V16,Security Logging and Error Handling,V16.3,Security Events,V16.3.2,تلاش‌های ناموفق برای مجوزدهی (authorization) باید لاگ‌گیری ‌شوند. برای برنامه‌های L3، این باید شامل لاگ‌گیری تمام تصمیمات مجوزدهی باشد، از جمله ثبت زمانی که داده‌های حساس دسترسی پیدا می‌کنند، بدون آنکه خود داده‌های حساس ثبت شوند.,2 +V16,Security Logging and Error Handling,V16.3,Security Events,V16.3.3,برنامه باید رویدادهای امنیتی تعریف‌شده در مستندات (ابتدای بخش) را لاگ‌ نماید و همچنین تلاش‌ها برای دور زدن کنترل‌های امنیتی، مانند اعتبارسنجی ورودی، منطق کسب‌وکار و ضد‌خودکارسازی، را نیز ثبت ‌کند.,2 +V16,Security Logging and Error Handling,V16.3,Security Events,V16.3.4,برنامه باید خطاهای غیرمنتظره و شکست‌های کنترل‌های امنیتی، مانند شکست‌های TLS در بک اند را لاگ ‌کند.,2 +V16,Security Logging and Error Handling,V16.4,Log Protection,V16.4.1,تمام مؤلفه‌های لاگ‌گیری باید داده‌ها را به‌طور مناسب رمزگذاری ‌کنند تا از حملات log injection جلوگیری شود.,2 +V16,Security Logging and Error Handling,V16.4,Log Protection,V16.4.2,لاگ‌ها باید در برابر دسترسی غیرمجاز محافظت شده و امکان تغییر آن‌ها وجود نداشته باشد.,2 +V16,Security Logging and Error Handling,V16.4,Log Protection,V16.4.3,لاگ‌ها به‌صورت امن باید به یک سیستم منطقی جداگانه برای تحلیل، تشخیص، هشدار و ارجاع منتقل شوند. هدف این است که در صورت نفوذ به برنامه، لاگ‌ها به خطر نیفتند.,2 +V16,Security Logging and Error Handling,V16.5,Error Handling,V16.5.1,هنگام بروز خطاهای غیرمنتظره یا حساس به امنیت، پیامی عمومی به کاربر باید بازگردانده ‌شود، به‌گونه‌ای که هیچ‌گونه اطلاعات حساس داخلی سیستم مانند stack trace، کوئری‌ها، کلیدها و توکن‌های محرمانه افشا نشود.,2 +V16,Security Logging and Error Handling,V16.5,Error Handling,V16.5.2,برنامه باید هنگام بروز خطا در دسترسی به منابع خارجی همچنان به‌صورت امن عمل نماید، برای مثال با استفاده از الگوهایی مانند circuit breaker یا کاهش تدریجی عملکرد (graceful degradation).,2 +V16,Security Logging and Error Handling,V16.5,Error Handling,V16.5.3,برنامه باید به‌صورت امن و کنترل‌شده دچار خطا ‌شود، حتی هنگام وقوع استثنا، و از شرایط fail-open جلوگیری نماید؛ برای مثال، از پردازش تراکنش در صورت بروز خطا در منطق اعتبارسنجی جلوگیری شود.,2 +V16,Security Logging and Error Handling,V16.5,Error Handling,V16.5.4,یک « last resort» باید تعریف شده باشد که تمامی unhandled exception را مدیریت کند. این کار هم برای جلوگیری از از دست رفتن جزئیات خطا که باید در فایل‌های لاگ ثبت شوند و هم برای اطمینان از این است که خطا باعث از کار افتادن کل فرآیند برنامه و در نتیجه از دست رفتن دسترسی نشود، ضروری است.,3 +V17,WebRTC,V17.1,TURN Server,V17.1.1,سرویس Traversal Using Relays around NAT (TURN) باید تنها به آدرس‌های IP دسترسی دهد که برای اهداف ویژه رزرو نشده‌اند (مثلاً شبکه‌های داخلی، broadcast، loopback). توجه داشته باشید که این مورد هم برای آدرس‌های IPv4 و هم برای IPv6 صدق می‌کند.,2 +V17,WebRTC,V17.1,TURN Server,V17.1.2,سرویس Traversal Using Relays around NAT (TURN)، نباید به resource exhaustion آسیب‌پذیر باشد، حتی زمانی که کاربران قانونی تلاش کنند تعداد زیادی پورت روی سرور TURN باز کنند.,3 +V17,WebRTC,V17.2,Media,V17.2.1,کلید مربوط به گواهی Datagram Transport Layer Security (DTLS) بر اساس سیاست مستند مدیریت کلیدهای رمزنگاری مدیریت و محافظت می‌شود.,2 +V17,WebRTC,V17.2,Media,V17.2.2,سرور Media طوری پیکربندی شده باشد که از مجموعه‌های رمزنگاری تاییدشده Datagram Transport Layer Security (DTLS) استفاده کند و از یک پروفایل محافظتی امن برای گسترش DTLS به منظور ایجاد کلیدها برای پروتکل Secure Real-time Transport Protocol (DTLS-SRTP) پشتیبانی نماید.,2 +V17,WebRTC,V17.2,Media,V17.2.3,احراز هویت Secure Real-time Transport Protocol (SRTP) در سرور Media بررسی ‌شود تا از حملات تزریق Real-time Transport Protocol (RTP) جلوگیری شده و این حملات باعث بروز شرایط Denial of Service یا وارد شدن محتوای صوتی یا تصویری ناخواسته به جریان‌های رسانه‌ای نشوند.,2 +V17,WebRTC,V17.2,Media,V17.2.4,سرور Media باید قادر باشد پردازش ترافیک رسانه‌ای ورودی را حتی هنگام مواجهه با بسته‌های Secure Real-time Transport Protocol (SRTP) ناقص یا خراب ادامه دهد.,2 +V17,WebRTC,V17.2,Media,V17.2.5,سرور Media باید قادر باشد پردازش ترافیک رسانه‌ای ورودی را حتی در هنگام دریافت سیلی(flood) از بسته‌های Secure Real-time Transport Protocol (SRTP) از کاربران قانونی ادامه دهد.,3 +V17,WebRTC,V17.2,Media,V17.2.6,"سرور Media نسبت به آسیب‌پذیری ""ClientHello Race Condition "" در Datagram Transport Layer Security (DTLS) نباید آسیب‌پذیر نباشد، این کار می‌تواند با بررسی اینکه آیا سرور رسانه به‌صورت عمومی به عنوان آسیب‌پذیر شناخته شده است یا با انجام آزمون Race Condition انجام شود.",3 +V17,WebRTC,V17.2,Media,V17.2.7,مکانیزم‌های ضبط صدا یا تصویر مرتبط با سرور رسانه در هنگام طوفان بسته‌ای (Flood) از پروتکل انتقال بلادرنگ امن (SRTP) توسط کاربران مجاز، باید قادر به ادامه پردازش ترافیک رسانه ورودی است.,3 +V17,WebRTC,V17.2,Media,V17.2.8,گواهی‌نامه امنیت لایه انتقال دیتاگرام (DTLS) باید با ویژگی اثر انگشت (Fingerprint) پروتکل توصیف نشست (SDP) بررسی می‌شود و در صورت شکست در بررسی، جریان رسانه قطع می‌شود تا اصالت جریان رسانه تضمین گردد.,3 +V17,WebRTC,V17.3,Signaling,V17.3.1,سرور سیگنالینگ باید قادر باشد حتی در جریان flood attack، پیام‌های سیگنالینگ ورودی مشروع را پردازش کند. این باید با اعمال محدودیت نرخ (rate limiting) در سطح سیگنالینگ محقق شود.,2 +V17,WebRTC,V17.3,Signaling,V17.3.2,سرور سیگنالینگ باید قادر باشد پیام‌های سیگنالینگ مشروع را حتی در مواجهه با پیام‌های سیگنالینگ ناقص یا مخرب که می‌توانند باعث ایجاد شرایط عدم دسترسی (Denial of Service) شوند، پردازش کند. این می‌تواند شامل اعمال اعتبارسنجی ورودی، مدیریت ایمن سرریز عدد صحیح (integer overflow)، جلوگیری از سرریز بافر (buffer overflow) و استفاده از دیگر تکنیک‌های مقاوم مدیریت خطا باشد.,2 + diff --git a/5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.docx b/5.0/docs_fa/OWASP_Application_Security_Verification_Standard_5.0.0_fa.docx new file mode 100644 index 0000000000000000000000000000000000000000..c3659d1189e2b1fe2ff10a9f39cc726b9fed198d GIT binary patch literal 240713 zcmV)LK)JtAO9KQH00IaI0Ld-$T)Y;KoU;J{0JaJM022TJ09!+EZggdCbYE0?aAk8{ zE_iKh#g^G>!!QsN0)1%%O+P@9#)+u4AWgQv@7QikNki;3F?liA znz{GrN-`RZH#&<};DfSe826HH9Dxy5Dl;F(pVODleLNlwrdtOgqEZuv@dD93Fc!oD zG!Kb&U}z+@UUQ^ZKWC1MFFps>?{@E)um-_k2Xl>hG>_EbDTs zVa%P&l;B9itQchn8$D#LMyq?4?^$a}KUY?_puBQmCg%KJj zfwcdieD==fC}iqAQ*xN{Sq7J%cqM(5g8C=ky1>ZoYzD|rk_6cy5C+YH*+>4k2+f2DA7f@(x_W$HnM)p>ObQS6kP96*c4 zVjJsGN!L>>fJ^Y_|8@Q_l)_B`Zm$i{zaBuoTCF5d3O5C4A%W8XTG)h50W?U(nSYi2 zUgFGr4?^ku3Rrxv7b%MCRakKm9eo2(O9KQH00IaI0Ld-$T(@_m@8+Noe~dmdUru;%oQpS5O9KQH00IaI0Ld-$T-T^( z)spZ500<%w01*HH0C#V4WG`fIV|8t1ZgehqZEWnlTW?%fb}sr?78E2X;)E3MqLeuM zs3qI2hTK*}we0`_4vNJ^soF&rQ!GkWo?3!<0m6rav-8jgosDy%1YI;us$3*xnH|6n z{VP_9Z~7&Bj@z7L&NZu8l*uBgFhN_zx~w(Vyo~ENzVWyJX;o(PDe)Hgy!Ko|%eZ#v zqjbKwG*n$o7tCjK)!KZqZvL!2y!xbCn_a9`OX<>*x!io^>ge$BZ<)N z{fA%IEBqn9f!p)O(qgfcespEAmM*2W$LW>7yScbnDVK1q;mdXU$@^X{Ie}|Tr={gu zx&HK=4CjlqR-QX&GgL1w%oc02-leX}zUjDmrk7{xC%%8aAo+MsW@ch&cxd>T({j65 zKiMhytax7b?&$F7M07TmX6yV9{obgsd&OG)^O@hOzdkKiDrxPhl|987GilYi7u#dO!^QMiFwR&t^V|*EA`s4?4a_(QoZ&d{if3ZKEIXxV>S7!e_F2A|7K)x zj9w)F_$c|ue@^~!8HQl5&}9Hi>0+_wwrz)Rr3Ya-u6J!$@Qp(G`q6 z%&2~tX4c9!%_Um+K!+RcRd}wwY%6QDSIwsl_(rc!IC`>AsK%Di*pmF%j+AjHG#LNJ zt*n`tKmX%!<8T9BHrgxgRr7KyF<)r4SKj?@!@Tz_+lB8Yg`3k~Ob=umN&8uQ&HUC} z>2L#{Wfy+=0>0H=F@J8U3&9sQ&3Dan$F6CvgCk1bersmO{Q3Z|(83X#pKi6+&Bq7r zHTYGty$0ic+mugVX1nG->+MzZ>D#9LmAS-L_9}aA{=b2fErY?Ko13m@`|d*U0Gs@T z?REI^Yx9+7aLI4mtLl60mBS4f28^jepYX%KgsaF?n%f*?EwjweV2FF>8?W%rZnSWl z_^iW4%yr=ncw(5H_`K1)n~5`TG+<&98SGHk1N8C2tU5kdJD#lxcec!he=>u^hs(AG z+v|g7inh%h?4HeeqVd3N@Q`@ba7cYRMr z6Vh##*y%7Y7mZ4(lowKbY4i$ss-S3%R)lG${rWIi*VM7pqKMuv9gM^~;SxI4@}Xm8vT_sRUW zc;jKMxcI1CQZJ1uR!ofX|1&(Zzx!MB3cNddvGCa36Q%|JDE<1e8|%>3@_g}Ox^$HX zJ+uhM299?uHeR^^U9JeXxLYlKy_76ejmlkknBJ__s!tx7Excsr_KJIZY0=Cjz6Gn~ zU*>9Vj5C$;;wR-w1#SValiH1RekL`;s@<6#9pR}nCPG>-J%X2W=F9iZ9q{VvldJyK z;IAdKL6Vs#pH*kgvlW-?)hlp;Z{}+A@UL;QlW%ZkpUV0cVZU_UELYv{7i&xPPt)pr z0x!&P&6x1|#m9G-WOVW!cz>Y^Bct0?7Lq3)UAaDC1WEW2%qWN<{G(nhSNM;s@GE}I zrA0fLxbj!M9i{(oG z4T3~U9z05u&%eAmeJ}Z>x@??Gc*?knI1OWijGaAFm0Q^k2_+Z9h^2MdwR1{{yI&@ zhlZ0o#yGDn;M5l@$=&$2u!BEK{}K!lvrhZQ6f*y5l38x7jK1xdCKzGHwtU+JLkaE= zmh-L|6^zMf`v%#ByXNIVhPGvcjHrD!2i}N{EgLO?56l>M zj5XGmF}c7FB?GNzi)x~qMK!6sl|3_zpU8lQ8xO)C?e(|6Z?Bz^ixLbdaRZ7zdwr(D z|L|pJD!#W5ZaI(8eDL~Nq6Kin5=XcF~fv;OO%H)2PK6`SbQq+IphqtPg z<@p8mx%b9G^_RaWF3j4$zEFSRu!hb5i36?2{%Nf|3ojp)tPe97KNM@` zpDr`si^*`Uo5?WcIaJ{KwFcX3?G@73=vN&#wRPfN6^<(LN7X&k_20pu_)uJ{>EBk< z+AKO(U#IhnY3+g?)H_SXVkx8FW;_ zo_y5OrNa{^^Sh25(v903?8O3Qwh; zw2>WTTLNs5JoR4o%KY}5p@}5>-aL9M!N_e>0=ecT(tje3&N0GN4*DKiF5(t0KO;IOqn%ebp{`iBIc~y3u|P z$OwM&qk_PF0cZf~0+9g_mW9|hJQe~CAXuI4t0!vUay1|x-h?1JZbe!-eoFV{!`9H@ z_etS!_wal3|33~uf~Jui?z?wehX(^NjjOOm-o}LC>_IeMkO;dD>A?E|Pp6qp4yZf4 zgKRJai{Rp59Nvsk9@PBm5K$bov}=TXSjD|VOA8xf3noYqB5%Ogt))+r$HsJ?O>4w$uEAB}YbvW$%@-G`%p+cbm5U3xZvHyQ;3mSiCP5-pn~)=AnOzJ`N- z0(h{*T+SRCKtZj*IXG%jz2zCvrU{5%I2C7QYsmf2SkyZ~fU@C5A|jeZD#+S5c(R`> z&k_W>Ij)I0V-1ASnM-Vg9Hv|+c%Dj_H6VeSusX(@VzzX}EF@#?P@V9#jsfw5k(rNo z%=;R>ha-3Rw+PG)zwrv@AFpnHxCvu|ApEL=)CmX=#c;$!tP^e^ zb*2HSY79HZ^w31B1?o19IMG{Xn~;PZXEeI3(NELqFi}gv2i}0bo1ezS$T70cz8sjA@)}%G#e~L_;FV7a2YY&1Q((G z9O2km>qe3jVkE5d#tj`0ffrd#=jKfW3phhL3CPlq&bW@{Ca60BZ`8E@7P>tzWi8ER zZ+ME2k2s3kCh1EJR99vgo!#J3hH?tI!=v#=YOkAX?b!!(9t3&&Y#W2aC>|ZEl-Hhj zsWg7e%J~MI8@&7$So|$=j~J|v>WaKQ9xQtcKcVx)BVnnoAn(seMZSUw9zsMvA^9Uu zERhQ`M4Pzle=t|aQve635qIfmjo+@4y2B&GD@d-)3SPF!kIKNYBXIWT?f@A@vyWP8 zQ>+d=8C%Y8Buplh60CYA|KY}sytm-b|2EnCUX6#nlvCCI&9u1EI|?)$m=Wj-i{6xQ zgJ>%kox$^Fj6^XaVE@AQYmmzc!=rQ6fastcYp^Dc*m=0s@Wz{b+;?&Gu!{>ND75;f zK0uoyH@Tj5nhC}b??EoQwUEFWZjfYSd#nj=Im;b*xF68))<^CYiI`oiK1a0{O!XdoMZ%`ai zglWg@m>+!$GUK|P2D=&b3%gnrWe$}@AW6(__#O*o_F3%jxox&ZVI8w0QF7zelS3Dz zJiy2kXq2~2Rvg)%Xlv@)B6SOTl$_pz4gNw$3C;LkQNXr|wL%9XyeU+Oww`qfNaDEx z?%H4tjEy2(_Q?C*VGA^XjxWZvueY7$Z1cVLSTU$gjZf^{3pNArOm1=XoU|)EvOERa z+34b4nC)$*afiyvtim?y&uR%4#;&dPD)w=8#i+|m>U|FAnF}}Z@E`6SzV<{o+bPfS zolUbD58uF^0E<$VhW>P?fR-09;y=Pp0fqSkA4^=NEh?ddQwKHyWeHS~T4tZl7m4s$ z{!|Sq?Ts;3ux4qOC6w`rMYYitH-iut%?xapT%ShvM{5M|iG?HZ662ZV_n=sAk?z1v zwg&@)xTqY1o+FlHquo5BF@<+rCD&X6GlMdsvkHXKfV^N);>Of3S9{IvjyJg3C@f~I zVmbFNqQDW5e1x)%r37Nj+VBYFQOFUu(#b}`c+2D@GsV{;4)Yr7YcBA0x=8z9a-u+l zzFp17VforBxTHKj8b~yL!(Ia$sH}_hU7PG|pb5|*6NAr`HLGMS8O40$V6u^6)r1#* z5jnJ{Gy#ez%!(Ya&a-6}=0E0t>nH>yHDnfv-cdS(O?j^8CE-R=W6xesLX9?@AwRZz zRMs%B;y7-|ItwD6FI-i&EF*a>ezh+@M?U3dpB+Ub`l~HHNC*&R4Yu3B=psQ9H$%h9 z;C#|g$7%B+S$0NoeQ7_EDc!FC86KdCq2ZXWi0&ggx&9Nf4UZ=oa?JR2OJ8Old8s^jdl+_YkU@ldKXX%}yV!Eyq{QE<2w>%lHAq?ev=O-cRQ! zm+%h^f0HZc=i6e|NDccCF=g>Pjbx`(prUzkjX4QSV}TRc>X0#K&=;y!70BRg+`4o1 z)@}A<03j<8>UF#*hRE4x*memJoAL?)>*EYsXI3a_hj2dAbf! z=2v>W--S+s-QnHu{_O;=q9y!^4C;TKlj-qzB3#%9r5efa4sKD0kWVK&n6%Hg80%@- z@Ms$~kHre0!tz|&DIU^#O23^Ev${pu`C^2RR&EhJC%D)0$Iz?qJiqKL7f(rvW- zC}WVzg1r#^hQe%%!Xjb*&k7&>%8w*N?bA~ZORa{72OxpnN0jz9B^?hvIsE0#PqK|l zwK$v16f4DrQd;9V23xfOU|*YRwDC+(63;LW^2-Mg?%Bkm*tYu_8xRn9+7Xw;VegS$ zXWP#`O5%M5(1F&7js#^WKS;an6(DtKsm14JTz;!ohp1v=Z;>MD!a!g+o}vC#YJ z(qeUCDNSw_OOH}B5BH1pG`U-zFW2EO9H^TJ4wc|Cy%GNy5|>TZ!>{nKZ8i$5lLoil zL~uK~OV-)Nv-2Zo60P~o57}8B^V&(9YRd)p}_;l)2d^;G)fE`0Hh7T4@&q zvQfe^JP2F7C{6E7*db!8(tHWmf*?ojF)J zx-H&;0;lyF5$;BrHKr-EtSUJh&%xclZ~0G8D=BrgmHkKd9q$(r!-)-v>@o;YHq@p~ zhLF(9@ADx*i#H)fCh#{&M&|B~mcusJ)}b3smllKz#z$5I$+}N=TL<8k3oYdyw1J?A z6|}3(CVvibYuS=A2Rv2=K1Cpkh|^pHNDfAL`zAD99Vi)YXwGhFTQL%)MaP^nb`+=H z%QnqZnRl8Bz$sB_FJe!%Xw1mmU2Iv)s^?SMjk;+}Q8&5J-5H%yd;haOrS4#Q*<3tu zcouBwK=_TwL304gbK)tVOdtVO*R%HX4=RWN$MBpC<%Cv=1o?-zQWlQcs}$_UMl&|$ zmAC{+inFp=!g2I5==q+xWWGDyE$g(46R7C z#K9Z%P3pstDMO6ee^F39!c+b)a;PjVlA2=R`1`jNW*=>Tx*J{(pwy z58vLmg+x&E0~i8wT)fJK_@Ty7=SkQ^C!>@yS5>)}{U@aZbRn$TT*<9RX|bM6KT1>c z-?Uavmy{drXJ&`&K2k}!|4zFmmw5Gx&xGq6kUej7k@@-C9YoEMy<(rY>B*bq%XB6Y z97OUUU8);{Ao+B;Je%6;O+U`m&xo&IUBlTXfK+>UTn*ys*o4O`QeCysATR49&xt`o zR-y!8UX{cb2B4ti>lw4BP#Q&z2SStIDmkyhS@2U%$8V!4vCW~dOd2(r(E_*08o@tV z7_}r87er8cwII8(bd6p2qFubz2W#m+EthL4H1a&N$d??u!hJWGfqr?|X0dWS^cP*q zxj8*I;^{;Z=#IpR>$7cK+5xv;Q+*w!Yu@^TUbWDQRC#0y_Dr^}lstc%7aBvpkh0}a zzL8&;UtWS@P8SZBAzJ&du=J?9T$vs4+ekQj4;xRsQ4lb>mCb{nO}gfQ)5BY?$Hhke z@lXbGM$S(b^UOhf)p~B0MP^5*dF?M5Fy{q4;~`9voE}czdRpgXGhd$cZc^D|JP?l3 zU%Yb^e`kG0w6JJo>kPOfe=QHew0gZ`VK0>)H7)#xlEG_yO{4_q;G57{$a^%H@yr~~ z!8-|(j{|@_+>tRwabkzgTy@G|YKl1E3UCg0*j$egCbq;fLgEBh9&U~AO^_mFX&*4S zRpK-`0O}_A%aVNJ1PxA=3U%8oek4{ytD=+sJzH2IO`He)9`-U7ij!ba?}|YMq1``D z73PWOGBj&K3`=82*jG>BNFpbXgT^ATIdrlrbO`IDwcAnX8|kBUqk#^>q+Vj{PN?nRT__!ggto=Xxl}1gN8m_tzM09^h;?3{cFV2b8a6%>(7l?%mrThrs?cGHdRYvG?IR1mO!6cf21sTtCM*&JfJ7Pt0 z!oc_8BvIh8A7z#&g76|L!YFeQ4uZ^%qEu)VnQJ-0^vZMmrZMBRK(x+G*Gmh#)&@R1lLy3;YJr*oj03e7U{h6 zyhva7ZFWSuatqbr_qoi_*?2>dliJR+Qy|ux%QZfVZ_A{zwg6vX!a)%!9xY6y z5{)9e_8J3JDyPS>iQ!luX4bK&Ou)3xY{`gt!9_1R5}Iif(Gk&;nmC|X1)z_QNE)|S zp>)43OcBWF;3ul-5QXP)-TUx}BaNXDm?>4pVS&=LQeEAl(=hn4T+GJKB*Z0$)GJ0= z%_nMj5*#n0V=hEYZ;;i|6~A_BLz?++$I(XlRNDSIiDtUAb-~?KdXT&Zh4sMec!tAy z@h%@HBjz@nO8*IJo{2Qj?ar7Tid^rTWTo;WS*0L`v#TN?RRr74^;dAW<^^DoFCrM4 zmMu|KmiOq=SvQB&#*|Ha-I6ttdFdBDGBHjJk`N@_VPRUK^S~8C2QZ7AnX~bZ9b7uf zhc010R4QgDSB8lg6i#cxS(T$}fh(>M1(2h;VdfJTz|nf1xMN z{&bIi9#sjMy91j)P^v!7hjK@pd0QH@%4%-2v!nSEf6}xl)_k5!;5T{4PmIZc%FA^d zNT`gGcQgP%NG-q&zmd3rrF1gl<^@_ng{5?9sa#!1>gD;gx(tDS<;L2b%6kE2!MX^z zQ0(OSC7c^ZQG%cd!t+0wx#gXs2=bl=_fxi)>1qI!MV32Iju684(O_^apmR-m*k3GR4 zx76hWV%265f$j}}jbCQF@A~iG?CeFJ7$nSo=ugTZeI{D!0*6O zmv4rk0*NYE1v@9NlHVeEz*{gxHkGIexCD3${3nF0a>C}7II8oVdRpEC4qK+ggXl#$WHM%E};)tD$(LCs*= zm{5)mJdo=k&gg0IA<&p_p!?l$^fX%pQ|jP>#-A<5m-Nyj3SN`i?JlQTx$AbRoSV=j z>m0s?RhWc-Rv8kDX6_*ul26r*hi#kGN8Or9j9>HmzGC=((3$Hhl{cuxDvf&3XCyka zzOYP~73FV>8h&VoqVTH=Re^mFXfQ#J*x_r;ADX>T?^(g{w8+HjfCpIiaI? z-|4o5jYUJAcB?H!&pSeKQubZ@q!b-P>S>B4I}-=@lcX5MyZ#gW&*xkVYY}nv-awRB zYfK_crf70VJs;%LJnM~vOR`lI+q_Vv<19AFf7l7wCx>h&y*<38*p&G;3m&Z5U79tM zf}*n7O2%J)pAC&8Q~Dwh5%Sl!tUxUf(fALRv0(*9m`en&BeKFdL)Bt z-nt~d1@~uluUjC3BY@*AwZ%cr4qc?neF^i|Ai((^B#z@=JLSnZ2!0HTLcd*-BH|j9 z;hb4PnPvr(!SrkA$x?LehZ^Uf%*UezJV9A~fS2~6{`69n?&nR9w91b*VH1` z(4n8nuE-2+vLxi>X5<^57H)>lHpgWa*JD-X}qo#5|OB5OO@cgkpD;CNV!f!?roprhfcOuDw% zvmX}Ho0$LscHn#~)ooKXu~481N3o&F$SpaI%8usfwtQzyUG%U89X;DyG(H9hth!K# ztPFDm#JId-_G>;~(YD;mv7miix#8A8YJS_$Bb1jr3?p^NOz@@IQ4PWRm>HK`UijF~ z$7QRql{G?tJ|DZ@rI?1RVdzG!A8~5C^#d6n^PO7b(jNBQpZJ88y!0mOGY*88Vh0Pm zp65$7TvW9|l-{1s^JF@1U|WWvgA=IHxD|-??GR{(;$=(Ff^k+S+e&8_&u+#Em)uaf z1jc15#rX8$70OTbzL#yd_$MYySDc?o)z2h>I!w<6QRW@+KOUi#TNRrV*6hS>2Vow(WIL?8M78Y?Ea1ek;)5umK@mT?P8)g6v%bE zur8EGJlVxNi?Yds%|>&$#;S?bHjZ@%n9UuE9K-WFNe^+&({Xd`gxG0@(-1IVT3^Hn zv}b07-)n+5QrcX&;`Qpm_4w9SVEBNgf(FAVZ)Y3I$=J=nxXIdpXBhcS5NMAo<~}F2 zK$_W{b_gM$HU^5YPDLAW&4Y$|J@f*P=;5#liKmCh^LlvqZ1wPN-z;%!{YE0tD(1B* z$%Iupb-ce^SYXqopLN*H4{!k)102?>BDy@q_1Es zy(!{6;BzSN0L2H-3X4qmh@0%To=xu^rOB=Kbp=RHO>2B$9P-qwTVX?!9tm-fz9 zF72I-f8YQFWH@)~`{QE(SdlY0Pn=?FGWfE}i79UJ^BrC-=-d@+u!$bMOOWQ$3TKE6 z52g{D3!?r1FWOb2uI3O!GgFRt49+!W(wIjD81g!=2Xe}ypV(*Un1k{ceK4jRNdj}g9_|bDJiD39|lqY zApNHx6zido*8^Z$$085MxW%P!swkVg7TFl5PC|Dx1`v3*YLnbbdbreQJI@_%sg{pI z)@@Q~E{vIp*^)I>6q=N6#?87ymhu3<#X>0)U;y>Hv6(KHN{()(v*^pCS+Ko!s;KfC z?Vk|X1AaaWZc5`}vINz!;@Y!5cE@^6esFAo2wMi*TRY5=gQ16}MGW_)J=M_C!`5*` z4ruKRzfLGO_mmojJfmz)$R>QNt&w1}!pFShIT0XDF;qb)W+U^kDh-cw2AqOB9PYW= zI0abFh+~QNCqCCPovn~LSbfxuPIJQRk1XZOgD_%j)i&t+_{SFBC*3gFk(N1tfggqF zD!!xIYsxeEY`?u@wW>RD)6cd2>tnMzn$KQ3ng_*sP6l^wb&k#}8~u_n&h;VJHFB;! zG#txUx*4#!*SgsZ-&%JE`lRlWAo1GI_7D2P?de=UMLQ%fP3Befky>(3CLJI1iDoC& zD4Il-NLz&DCc1|(EZCvP2P;t~Wa+{Z;2<40@7=+)EY*n6<8T*delJqAK#Tarm}>B% z0+pZCstfhh$f!*6dp_+LI zKY;6H0Z=>H_h9j;)Gebq^_nSa7(s~d06$PJ8ynZpHo_mQgY8Dw+-K{~)kN6~L~O?RJ{TSv>6dT7lomI9E>=#^U}zjZS)oJp z8jVfcs85;9(Nvu){L)I3$_o@8!*iZg>jPTrAMlcYY_F*JhDONy3VD;$G)=jF1Tw$c z6KFnSFn6OBoEY|qn{6eW!*>kAc*2l{jb)q}t#hnq&n`{`L($Ln^bTr*zL0YvCHwZa zNsH?D!Oo{Lb0v#5)XW5g7DS@zTpE%IIjR8NmgDVq=s^*mWlK$XRKZW1QHo(?*)7cZ z;2#7k1B@2_i>_Spp?4k2u873M(LW?o2djb&PQL00+aaa_R0VvLkyOI9VVpf)lP&od zi!hH>K2sfU7KDU}KEOk)aWxTxLi^+o#?j1i-2#n924iDcC#p{i!w~;AEzlSud&kYW|?u zOtI){4qm>_hy#fB5HBS2->#_`cPyB7K(8)eDsEL6##CfEVA5vxPp9g$QHw%F6xBTiqpxww50 z)eFdygF!fAgZ@~~P*1mQ|6Du5j&@i7qRM{LLjn-v_SvVsr@I@$zTn9FX~%)Q<@h44 z%@ph9`CE^QHC~clZ}L}_`rniu6&LGi?XMoz|7HmOUP?>#a&^J}tr~N{d*>v?m8qmh zd(DykQIe5jLZX&kwMiIePj2*MmW?7B85%o*hd$vb*4P=i&Mw1!LC?rJ+5ZxfRnge? zn$7ivm62#r#jpt-(4H4%ZAOOvV(2f<%ZgyjzV-_$M3l8SCxbg7M(U7nno4aNln7?? z=EKUQ9D|DVQudyT>{a&2dD#?E*~IC-U(!u!pe2+AbN-TF|Q*-qvu9$su<}x z8PN&#lg0>MNEc!j8ta-qEGfymychKlDQG=Za+=Cz=QSyK&^1_7CMRD%H~057KW=_E_r5N*$dK zTJ`KEpHC-7EX)@dW|Q*5Z^`5!3^q5^QNdD5lSrRdFRHjlC7}d5RDANg33V}suOj#7 zA@^`=q2A{LUIT3ccR zdGO)}^wiRV;mi-E%WSlz-Fmw!Trwn;h`9gAfZxSgSroH_=Sdgja=wa<)8nH^$Tfm^EE30K^RXL7s~bWKNsP<_N%@s!o{|2 zUzl&CV0%NzdGCq)<`p8IUi--$lna2Lx-gq3CKlAO|G$XDYp#6GLYe`U=1|{yZ##$( z5S~4|Fzb9?R_-TSH9YRlUUvy;&4x}87h5m5gBJWVTTlZFWT_+ek{E4vk-maz0yf^+X#ejQ8Lm5H>TGHq_YhwZ5!IE)5CiAMi6?}yF<}(MKIa-01$PY z#r=|d&meUgL##R?5>cREdsKj78_FYHV~?~)(@rk0At)VLQWpqnqyo(ha3U|%W<8C_<%EAx)Uyr z@C3c;rs{Ync4D`iMyiZEK<_krWEX&)2GqH-3BhDO7m9=}7$%z7zR=oy3#^tdTbA&%SB@uvo%sV{bsnnD;UL@6ea4RuNrc_vz#T_wXY5`41k!=kaKgfzNF6(Obk;3xfQJxv zKz3m@1Vi9YVkbu29RvsVr2`i^@62>^N8 zExv7};~#NQA$OzeeyYKo`yElz9almWoX?4=Y$wat)`*2xbE*q8!+>>ags>?n{O@`; zyj`w&13|0W<2~qOZ3iVfG)OdSlo3=-YkF@=bHeo?`2rhn;4ZAC2ktR0^y!Fr_7aoE zy;Hqd^tPwv=kAfQqs?8Dax!@Z4ek@*F8b^}+V7#tuD8GUGD%3njs{cFoj;*VE$MupWA0d}^==G+6B8XJjBM6HbSYkgH8Lp6}No%g@;dhsF7S~Eu;W|JHM?C!9Xh$2 za;`fkNGswHMANrJS4?G-SW2mPwnHW#u@!pRNGLk;K~{2fb&U|{cl_pf1*jm-}~!|C#SgrMb4Q9N$(OP=Q@d6XCf#Qt4$ zj!8gyTFCM_cUDqc88VjGJ~gh2E4GVa7pNxE>S>gd5$i$G0R61$40wXwHqy<)sm@Xu zhHO=4o6GS!lp6(>hhmCWCY(NXL4jbC`D^8gaNZ!rVU56}f|q0q{{)IhaheDIuSfqL z2P+(>40)m(+vS8}yZmalRGb+pPK{0$OLODHBgNr#a-=wVeR8TaJ26q5n7TfDtvF{H zXU|;zhX>6vk1G=d+=3kvVE)1JO2}~XX$$pJFLWr&%<))Sn2mHHcO>eHZQak)+cN09 zG1GwEO?-dPT#(6f<-4el6fLi*OR_8FbH2x@pfiu4A+(SN0)AxW^0j?(`9o$~26h(2 zz~pS-FvFqe@4fc~J$9_`f>-uyF81#^m(!kUkokH3vS7A&Ey)@2nd{Z0tS58J|NPHk zC3%+PY=lLBLk1`Qc}Qw@%k$22*1GC$qYGdC4)#f5X1QFM9k9B&N$C!F)C1i$MR$dd z)yd?Byaku>%ypz^QGFEI?%qa|x2s%32-q!~6AbcFVt>?NgS%l#7{W$^`5Nxoyo*_00?G0@UkEwG%!z{y zWIZopDBVm7#ZsxdyiiZlh2{CQhIozvui;2CQ(La5$y~KoO6h70l}_&7zIhL}(=-N0 z&5N(5r}a+Lix>2pCyQdUO|?##=?Z3yK+6gCeE_?yuvlDLdQz>;4yecrhdC`Xql)(6 z&-0F4#;|gGw+*6&Ddpg0V9!UR)F@ZS3{OkPp|5J!`7>M ziTB;j_6MDjaK=uRI2v|n+G#i+u9EeIT)*IugMnfsIS0pvMJzpH&%sQmZLK10q9}0! z{+xgaPN*8~IR5hc4)nZ~SV)U2$PON8nxfnq8=Xje(}-n*SSDym=^sT(V-;mOszDBE zvpSXC1~lyvM}3n6%F5OkRx+RW6-|wXG;`c_ovt=HrbH1V^zu-uZS~-U2ry`s`_0p! z*ok+!E((bWh5x!4;YMVZx`~g@32n(Wqa#Yke_i)JC4LyrW91w@0iteFch(?pK_Oag zNn30Uh2qqrt8S~T!k;32g%aKo}0#Z{;58ie*1-UARYAuX~`%Rz?B zDx0R%U(8(N4Q@dlU2dVG#ieC(UgoMp@Tg70h-EHV@w`=fM1QvrL0Be`v^jeC?6JMVCTR^%7UhCrED449jW5o@$xcC2WJ`R@ zHa7L;)=e8CBeN&+xw&=I#dk=_=@eO27rwrNejQ%skq;8Cc?@$BG-xIGDbwvkH^hJQR@S4i}%KI%qkH#zKePO;K> zki0`<0H0m1UXLe{@$?nx1*~(-!X4D@P@EYXK7;e)W$VyJHG5?%AL!tK%xlUTP@>&3 z>e!b-8te_ahX-u0VEGkFcxiC~nMP2JlBs&ehazk$9Rx8lkA(I)s`+(_EnyI({eLH@ z>USMwJ6SBpU<5ch`F*?)v~I`J)VYwkSgxoYH+SY~SRx4|$2MfShxyP}D)gln7O{|reu9f}!1gIxN-YxY} zH;n1zbxonE5iW!6^+AyIu&oCnyhnaqZgZXgV=6cYStdxHvvMeEr(B@zUJf$oTAR$#%Qyv&bcBhlc1{^7)rHr|*Ss zk$rk}IGyjw(bcwNhHwJRHB;}S@aECyOg}yIhZ(Yc>G*9N>FoOAT z)r5Lk$oks?9$wKDK}$<*IlZA;1r~_Zt>Zh#+)MNEj_Z8ag5Ius$Z|=GV|yHnQ6$|x zU?Ml-65m6sZW0~vnkvTT>9JlNJ4#S(flKj5;@ODH1+tHphn(lcCYTzgl*y2+R=m6yVRL4O9$s4b+f;Mbfv zYGi%dOgS^rp0|NVoCu=6oRo{lDJ zC~;X-+;txv4VT0v)^rCdBc?rcZ|&J?I$(Zh?M$yn0*NlfXr}VOmSxgCJaD=lj0Xz|;2I&* zh$IcDU*rpciSQUn@Olru!-9+a?>UZ4J{W40GB`N_| zA?eSDGFuW)VR)+Rg(Y^UZYSSfV{)NLT`fwDcxULmwXjR>*)a}-OOUU|pM+69KF2#J zh2+cD+|V%9O-B8B7(Wv)@3&3Ff+b2$UZfcL1&{}Vc!{F9jtOgn5NF6 z+T@$$_iYwXUrbsD`Kebw>KR)fapZOI&I@#CQEI_$azFCsWBZp>+J4ZBfo9cqywpBh zKON9ql^2IZQN1gz-Cpw+h||mZSTe>}RY?R+glu#|7&Ud-wzP^@lZ_{BHy@Xv0miZC zs&n&83Rq==8@45B78-H};?&yCB3HGG{Tlu7R%kB8qW~x;Aw07}p-Oelxh553 zx638C8SkyGua1J&$$U(F2b0f#$lV}?2hw?Zj|-7=w{lj9?G6?QTRe9Xx~J}p(VB?$ zTxs&l_G+x%x2`nF1iC5~rtjfqN7f&akoH%{fe3Ss5{qaXY?ChW2<5fU*`qE-@SmM&{54I+`6XMWhN`D`cD{h&u?JOv>_+AVPEohTE{_ z=9!T#Yd`=8nM$gaC7;qf)&Q5s@&`XDikfxocKNocP9bhVE?`Qip{}*FJoEzAzyh*< z)6c|WXn$Mg8VwD;n5CxlN;#Y(sVu-8)?7`GUB`Gd+r}4gqdz;`ut^8ADc-KSoN9Y5 zXm#T(S+A(g=`6QzJjlN&;V#M!590|Pt>;%1^INxui>Fb;TA2KVKm?yR~bw7HOXRmF|Cvr(t%DL&lHq3ZBA>Jm@7zb=^dprV>T3m}Q)lChV8?YfxwMQ&$!;jCgzQot* zj1YGH6ZK?>A>tY>Q$*PTS6974dvYT2k~>7PN&s&_kiS+U;*$0mZsl6|$>Jr2g=%>z zCCVNnF}@1`L!IZj&5-j$9X9o+9pk+e)m1^%GoXBOXDGHxQE$lYH1VKTXw{Sf$rXn| z$7^-$z^YSS4*(Min@pUYd<%ral47+Tka!?(1)a)fUQ+Z0rI1o|hdiTFAst}rVO2;F zKZO0ddbptD@-+&)wn|$#>FXOtBtv2m5uFgS z>IWSnKH-tFeg!!$tsTySEsF z$%Pp^xiTu;sw7AREb0 zB=q2G5tMmwA-)gI9NBxZ=ygdR2&WoSqpaaLyY2DQ2-mXQPP!~n=G9MNssSJM1x3#G z&C7MgdAbUgDvAd<$MndEXTW%Y!+~_5W@LkL!w)TiGxOTRo8;o4Aw8j2c|vj1ed37E zQ?{+5gYudKr@`)~zp?`{Y-y8;E{4fq5`c_(5u|C2?IhCA74;KL+l2h<-U}y^gh6g4 zJTI_3gBRq2o5X+XS7qU%xyVkWp|E#A3-- z&ywZC6AcP%oO-{DoE;n=`sR!ZO}ya+sCK2zzUetMd2QIE;e8Iqp?SiQGeSz+5%deZ z>WT(+P?0L8csjos8u!BozK8#kgt65BI+~??K94K8gH=?pWydyVQGNLqKGK>;h$T1a zsLGl5E^eP_Ur8E)6YY{&>$PNa@pS1pL4;8PPojFl7ug<>7?6Nbw1$yfPyY)5rELXD z$kC}uovG0@r=blvG)B$T2%c_R8B@?WIOr~<2u3MGZ?wZ z)yW>eo1(;kNn^9R?ROA5>{b}v@8}~~bLgGDNQ4=L{3d%SI7dzi1Z_#-I^wkD11Jg% z;BP_-12QC2DJRXo%G2-4iY$vkxZSi4^R${(B*?W2qD&RJ+0$qrz+n)yrI8VKY(H}_ zSqUQw8cT;{EtJm@jxpIyC%wdbCx#vM_>_-9>UAxwMfS|0aj&Tj>$yRHTF=NfQfk*5 zPVctfNEF!)mDH9W=gfia9zW2T1cS)l3;8aAnyiV(y8{H7V~9STfO;;6<{~U{M~f1& z7I+loGYrzm)e-LPpt+4M>d}Wb=W11aYj*|9FjO904c(I&cmUrrgNqs%C-1y|Ize5$ z(;`ZJV32}!-1nIc@gJw-f;!yY*aWVPYDZ7@7&4&`lAj7f#sgoV;|GfkFLV44_!qJ~mr1hJl0|{A2IxweWR=jDjn-Iah?X~>OKqbE#U+HYI=saHZWor-^V5 zex&*F3Dh&rh4`IP6(&HZ1Re5F>VBqC!zyfZ6rjtmdeM!Bkf<*($e>b!Z*`iU;&=Qo$@kIaI7e&_bB z8|=k6mc+2!9;Q(v8s!P1 zx?ifg?6TwnDb9d+PEfB+c#rVd=01hCZFWHIfNk|X&Z4^cI>A^V0KA^usXp+JkMc2| zQ{)5A$t!-W9$NXH`y=sXI&=R)r^A3OxPVAJM1oR228wc&GNF|2`jHgZdaOyHXI-!t zOn$A?l-$JO6##L<0}$I!Jy`yy@A7Qn!|z)cTC;+CT0vBPu3M0+hR|4+wrZB59bMd* zQ0qW;Cp%c3LM^UeuPQ(!dRAgL6o2X$a1R!7;s`I??!O zt3P7G#(6U(wxy*pg==0>ipU2pCET^i?pREBgI$bZZ=00l^ek`i2Ij!FT&BKlsfCil zQoUGDE9uhGfc8~H)hD3q?KAA-$#CrCEeo^{@|@&3p=Z}cgh?W;jT9RGf@Ohk`OVM- zhn(0<3sro3EeYC5*v~_;$MDOzwN&?iq;NQdPn+ zS%G(~s_>>&g|EPP*cMpsOO70$k#$3$<2;Hj@OUHfxqKKVlGaBA;OjPb$`rP_Tw>Gt zR4Ys=9FHxlp3Yf!hL#{*Ciaix*7R+pT#X_VWI6vX%l#%&ucyqcxY3$$0+>oAwCrc? zCu|8o9YL50LaE6eGLKuSZ3&&(hwGbB%%aGi0Fu8DYsyJDNMQ8tqz{-32U@Rn;oIIwx7nj&kRbpqNFK>JEq$YI6|=Su(VP zf1un%;A><(bRY7f{EA%ctC`~1XsI}!ULTzq8NF6ahsQ@}CTFhAl!~(x*NU^(CMRan zsdV;?h_=5)oX5TbHNLe{oFcew;#hh?;0z_x*U%6p%rN$D-$G*s)}Vjbo8u4A8{7Nc zH{_Ro^mH+;RmuxrCpBFE+8wj3S8`YPms5Vj>)GqQZ%~fPXVwUba{X!Y>2i4% z*;ba4f;q%f!^4AZ0B=g zF_iuS5UmIa`v{ep4UtjwCwz3WPxoNLm~@oNBywSKc3L^Y>9}>NBsgUL^(NgFYpPhA zEi1ynwBymtxlXPPG$QH(82F*9BOMC7JXOo#;kIz2VYXHkGq86<2KJ6kpmRJA#_^xV zy=!?jr!7!y=m51l2Bss%Xt&;!*RE^Sw~TYpdF5b!?rH}ud98DG_b447 z!-CH<;bR2081PMY2xTVhs{R)Re8dfTV%fFBfL=qetfGE*GVUs|hhZJdw8izLNoF}} z?8!`oW(($6!*yR61%b&>X;F@!7uY6A+ zsh5=5?inp{lC}F%ob2jd(Dg(_;xpe?P!;6Fh`xd~&}fPj-u>IZDk2vtae-8U?XDg1 zfi2;my3vH(14>97;UKF<-k;dY_XYLURgKV^Nx@oQU>eL;pDdWG-@E;Z`S0z|Z+&I{ zxi$Sow(+a!&wmYPHo+8I z$|=fws-_gjW=Wn><*AaF8^e;#u|Us zUYC%xPW9m+U1cg2LN!?SQRAANJ+B`kDU6IdG6o{IZ!k~17e?V9<&o=3v@$OtQ)dy$ zdI&U;00%Q8Y-48<4#d)F<01wtpJH(=6`DAFJ#_fJgW{nhHr>282QNUHq%mHOENDp z4$=sK5OAjhs(iZ<<2=zDVq|nm4Fn&V(>@FhOGd9vX_}Dn$-jjC5LCk{vbxYU!x)hy zsog#_A6^^Qw+`<+Ha_9;lZ+1k<$#-BM|IItE<*Wj-3o@MbipuOe~;pHgSyIj(Dl-B zWqM~+?xn^URASpPdewyeOG5-6zQ*_EOV3?)vF%zD#Rb%eDrJe)oCk0@&F&e}y14{i z;6R>2LgWlRtB|zv-1rM85}+fVIV*jl1;iNC$8>a?ivcMbkNe5kYED@lRR%YJp?#(z zSyh!Yit9kN1R6CH(JO0CQUk;ATT+h_6GgDjo-3RA*nii|nRK&%#t=wE65bDa!*dHIqwgELk0 zYwisbJ;;WnU+|JNJpV#u!ZcxIT(i*jik>oCUZ{wG`dIqulY_^39wff}PWRIGyUN&T z;{oMpc_lN|w$j;p0JhpgqUW~dSGAyQ-MvukQMr%q^wq6ASHr%z&e;o%_YBHVhETV9 z_o*?D7U_BRW>6jyuv$i?8jnmC_^c9Rl;)7Rmtom`*FUM1@2VubM|tF25txH}+XrCB z${ECL=nDgixGJtiVGtTq>=QbA;6WA-m=rS93$LKRNg@=%iiiSk5lA|P!_)=#UzkUj2p3lnS>Ec;V1?Yf$C-B!LF2K*%+C0m5Sj?s4t;i@+z)|mI6jGO9Q zVLlaBn5&Pvfl^0?Rif_k$Y8oqs)D2%EH2Cr>K-&_!~XllNb)g{C@~{SrqzggkFx1* z0B8lD5uF|0yKh37%TlSV3WZ3Rrf(6@CfN8~aT;rssUSZ#+P-T~7M!Ym4JqZ%_vs_N zNi1D~1VLi#qMpzlj#R`H5DlUSE zKx@68&M#Jq(AF@SgC9Mq*1lfy6*euF^_4m3k!>gy=wKgYvFsqw?+rzo%mB?dL{^&L z`6JMBQ@aJO3xb-<1Qb}t1sZ48HKxZ(A?;<7!-h;>E6^H*L%_<+dj9AC5_`*UjxJl?jG^TUgs(fqhG1bTDs>*0#P&K39~75oOYm0~{3F)Rc(MB>eW0qO@{U z-MHkEzK4kq=e+B6uMEi&)^%q9b3KVzSev1I9dJrg&Cla$~~U#aC(B%FN-2x#@N2V(&hxQwJmb5g=17cvnoQl z%SzF9RI*wF=c^L^v&845tJ?HUhK|(Ej@iU}RtiD1FfFv{#S9#$j58ic{-O|Zmb((v zHrVHSWjat{JH`qt$KH#S=es4Y5vC5t^*sa_K@@4Xs&~yg-K1u32C_1($&l)` z<<$O4zEqJiMZZ!PhQo*v2Q@}ZFnwuO|z%&}QWy^iZ zZrRT6nJy!pO_ju7UJ#jYOB5{zMR6s&-r!#3T>-@v4WlM_5$Hmbi)b)@>H3jkmW8oh zImKX0YVgYfL~uYBj%p5rUz>~@pP=P^XYsfK?<@qGx14}lL?H(X4 zK?@m?CvDZ<`zOFgQq@kx&L)E^$9AA@#|2DLU3b0(#ps78B)UA(xfBwf@9!NAviM*R z)6v&$!abC~LYcjU?+Bo)1y-`0dD^O8c@0$0#rf7eNE;(iGuyFKLLrxN27BRkzmhnPMHuTTe?^rH((GTfWYf(r1`EF%@Q&XNl zKRQUODKkR*vAh%)P^)H<@gaLWqEQ z|1l>nvJU80OG>9s_%5Ymou3{NVKK5+Dz$rsVT;W}&wVFhv`IHbFbEkoY{xXTu!hi* z%ptt)<^rEybSda8;y7)np(=#JAOzJ=V3l}XCIYY8#QJa`u_O!7QTUfI6R%dp>m?tc zePczRDi!JnY*m#?z+JvW;o5-pM8@LC{0cw?nSN6rP+$`x$bXFoWe4oeuJD}8u*GHA z;+&h4mtl)@=8=qExUhv)W!eZ(=><@muaaLrcyKSXX! zR!q@*ae@%A1KJop8C&+@_z>~hVHlesIStf>g1FCdB|6Gocs97$YaH5^{o9g3>345U zPjkfJ85HPPaxC<>S~zQ+oGyW)X*K3?$}r~0n`f`zZD+Qv^L_BUoREup=r39rLL1Gz z=`epLfM+O@-E-FBZ|>jCHjWS8>3E2>o#x8{3NALNh9SsD30<~MgPD=JJTH!Zrnr<& zjxX0LffS=o(@q4K)3cua5w9#sR)pCMgsAeP%});ZMtWgbZ;gZ#jJD0)fLNMwxvVbP zB{`Ah7_0DCzbZa1PNUAhLF1k+){8gL%@NLR99fK`;!-U1SuBiQV6mVIoJBBrI32eU z&GyxhV<@5?5Wr39olWN|D_bMj9AL3{7N?d}u;wTDhby-1FAEAFIsNybpnr+~ z{dLv+mAw1iAMGLR1fTr;{%39K%7CNznCK%v5!hshqsbvMcq8aJDiwIyMi7{6TF6qi zNz_Vm@?fZNHZ93|?0j~d0tq;FPCi;PYmMhYMTunA$x^*qGjp<7tCrH)2c>MNzupD55onJ#;fT-)H56gRP7XUHhQU zO3Y^a>Rz$_D6_RAMoRBNgjA|$Vxf)WX&F3Kv7b;HRQkO!LB&tRpyYlYJ+WOXGB1xv zpO47Y1v?@dxQN^Yv>WdhAEaO9;QbsF#NKM(Vk&|P#lr?TvA`flP!G&ESK{YLlT(&&()Wj6jjFq;HNDij_+BNu|70A2>o8MI$Tx_@N_tM5WT@ zVe9i@yMDnAo2QTB89pGs`MuRv2MqIt?Rh_an0`Yb7CsSvePSU*O}TzS{y`g{N+t_k z$q&RHd}4{)r0_+Iv}cRx0o~8N%HP#)MZcG)rQa$3;fs7+dNSXD4;5?guwH>UF+Zu+ z=9eqQnz>(PwK0<1qVCjBW1e+ z>R^ZQ0ywr-F4p_i-Dz`k^WU%Na-ZM+gd)9fo7_3DqcF5IJoakdMt;A|buv_czdwPi zd~_ls`F~H~D%nX;-JhR{{XZ@z_H-t8@N!~LXJY@)%ZWXWYZU6m8FU|q|NQ?Ke!X0& zB&A2inz3Qh+JNn!XnWEUCo^hRY4c7fxkz8xHHC*^L^#2}HxZQ&oF7|Ql7}H5pbju! zO$ug>2CNluVQu6tI1#py;U9vdpGNNmFc#WtH%=fbSGecpn*W}1%>$hMVfaS?B%_Uk znP6-&XV%df3aFsc_IryoecnhuGH30rF%_ zj)pFgY7j>O4}8DeeD;9qD|W;C*|V%VvOB7b94LU#Y*1=*LoI@=W|N{#haOET;|dDM z@B`Zmwt~5-x%_}lpV+dU9aFAAxPRe@(O~HfZQ{0N!i#%n_;;jg*9jkCqYpY7> zJTxsMVnnRqzA%@5_q%_!KXBEwN`g^KdDX98i?7LKlW$-I^>h|4E(TAg$L@*k$} zeEAQbT5Rzq6?lvDW}96PxYFyqjf5suSU}FDGJgLVvNzVby$4!!M=IANcx=!2srul+ zdt(=_fXz=X#aa;1zCB3IUBk4C+P)raNHF-e;H5D8)VP4<5;opq9%l==U#x-8@bNb= zs3q9vcZ&-Tmx~WmuEWn12p7sPbd>uKq4;RUqKQ zn8Z=x0p$Sb8U%|ybn+$T(sh~ zFxQKvnt#My$#KOkd(3uNBbyDmjtS)hodyrM?7N>JThZR;HbB^5Qi25jDS-n@r$tfJ zOnZFc+vYN;R55TaOw;VuJ0`qb2sKBn)uBdSxC3K(;zQS2Sdr^$a$6T&06wF(>Ih&3 zL!`cysQF^^NR3zsAhQeq>=60+3%V2);ZVdMp)-Ygtvr8`<-`Yvh8eqX#dv;Xu>n1C z(478>G^=RP0(pH9e;9}$Ql`K7)Hds0hfXw}OvsZRS&mBEVe1&|lLc*054h}^?t#T| zE&`-Ub13P;3|)d$%7gGAZ}m}xyA$7f1x(?h>b)_ zpH5=Mi3SB#%Zm`-*Z9meQMZgUY-6~x2H&0eY8q;RfANc3!1Tw}`!*NoLI6UY-_a@` zaEU{@Ed?r`VP)P6)mZxS)SaJG_hFUdDSYa-(Gf35kzfrgaUkUV)=xi3Ir|*B# z0h_8Bq(p5<6xo}`E6(^BSvbO>f1i(?BJD?y0Jo;fb?G5O{eh=9!Zc$CS+ zfYv$iV?2jg7e+bX?z!@|$H}iU#9ao-o`PTL=2*on|A1`<0HKj>dOleTWuo|gQ>S>N zmQP1`Pw7C8!o;h|!`|TUq$M&ZJfbqTV76{~*6f%8OEGjQwa$Umx@a|{T54q*y`Hlp z)il+Cv~#dcpt(wZU7VMmXt&EXBkroTr$+FZMVT|BOA5dG_3b+Y5x`#W3LH(9V{_<* zrLZuLj@+3Hq{_7$kF>n%!1#q%@3n>1-A#k>!oA#YrEX+{YJA~xN_1K8H~|Tm=)lKxoT~`SWlMfkSJdo z=+OB>w{OsDOy!WVWuahbt>14Az7=fcu&E2CH7Z@5J-@T$QHJ8BGkRVQ$c4juc~Rse z^2bLh2z*VkVC^kp?gfF_9ueec5AM;ixbxY~djs7!dG88^Ds;SSUn-RIdtNRanoHAj zaBJd~q;NldxLhgL6vhhdn1f8UyU74?w95%hmxi=iO9sBf3*Zvp_mVM(u00VPjP#qu z>VjF9a*5nfeh{1nqSrVpn{_$99_6MC?msGZvygK-=VKZwO9rvL0ej6Dhc5zh*{RYwQ zq%gBQH)n=deVo?jD%B@U8uc2NzKQ}YuHMO&u3p3<$Wp=<%FeHfOYY>Y1a3kol=ba*kC^ise&=NKqoV08s zE_%AUk^~?+pr>>F+bD{kzW`Qo9&TI~oE`i9t4}Tq&d%N%zAQL9XCBq~#Va_=TNpVx z>03Qq-vh-_v_N^c9R8vW{t?G0I0+b2aJFtT4)4H{wIi4;{9agHV(SHlnxf>%!LQ% zYH9l4NFsELMqU?JE*gy-QPIe`sq5q8qv_N{aWWkpo-B>cUY{&o8%-x>Mn*=jU7JhC zCMHV5a=HFTBPUQHU~~qfFuTMas7=(uba5_CZo`ktM)CBS-3s(+lQ@uaWtYN~U=fVj z_Ymh2VjR`00_DUOeGl2oC>q6bhptkk!X^xdJx9T$E%^a2TvM3!r-N}{&@h#wxhsek zJwWm*4Ai)oQP1sdI3CQ_L1wv~S$4{BHasvEN8h~Ql1JzWUDdcPRjxCFcqJB9OK{9) z%#v{VmlZ+@Ks4$wA1CWV40j6qMOvN^=`wf2!{{fwVr{Q&UTz)Vm@7O-^gkEXQH(nm zB34@?QiDYNOmBf>USW`P)bn2CjvSO%v@3&N6ria>wnF;AK{zD+L~ERNML569wF~aF z6XJ}6L#hH{4P93v0t34e6&e*mh@qBhy45QxVb^okrd z!jG73u~4iefFY?P?Qu{o>(vo;#&f_Vek>Q`uDpe>zWVrs@q9iwww#Fz7eVwYu_B(t zaZEQwBWEeJygY*Ci3m|r82g}FHNUzpN+FRa3C>m6dhN;@WaSzUi2N!SPI2G|%xx)RjP5Pb@F~HMd_z+e%y_=HjAzVt_7%Li6>)6=fde}=K2 zZE&TbcG-?+&TFC*FVN%2OYrBHDUkCaz%E)am#mD$1tVc2zrgkY9;>z2gNn{71#I9@ z9JqL{G~MlxeYAnmLQXi{Nc^$NKf3-@@~t>3b3^8YH#gWJS^_&kX7=t_na$nsn2f0de|FQa_`d%M{~lN&5+p7A z_eey6CgQ^|uYMlP6=KI71Ir`BV=l5>OXt!W#6*_PCU$(^-oI~=Jx9m?2KUzi#paO4 z4!gB&1nHbj3B)!i6iY}|GJ25Cgd7#nvp0@>iiPEQdQq-CuGoML&#C$F&aAvSGCVvf zJIVg4mksGA=+RSiUMuB=uag=seeKTd_0cQ2sq>dve#2Mobz(pN^5*nCYGUr%dEBcR z7k>d?-g=Z4>&f(^G_8k|WQTc9r)=z0r|ed(y0nx`m+NUVO`#m413rw28$Z>FyZ!lR z$uEjafLs4?r*Ps_r!W?#_%P;e@>J*T%XB80PD{%*n6L-w5^lIpm&>#1jpSCPY^HB; z+Wa9OU9`!&cB+$y92OsowR^8t1#NNBrfBMvrpO4jduChBJxvB>CoREF!WIJ_&+y&y zOs!aZdeJ8C`YBD^{ZDRT(_b@f)%kfdKc7(TI#f7)cIUH?lLzL)z&?tf7YC=)#bT{k zH`?QiVr4m9N(#58zZgh9DOd8g=n-?;N6R!wOe-3CA%zr|FBfM*56V3A6149#Htq{^ zmuFb_6g6e>Rwr!FUOV~yWUhL;Mn*7;eNu_1GE*a`G*dShpuV?KtV$F(9%Bt|@Na?5CA{N}zS=gjmb4~*+9 zO7vl^IFGbY(!-*c`OSw8FgkFx(`Vz|;tC^^s^Q}3po13=8W}t|vup%Uy0kP{sXi>1 zdW|-WbX=kL5wTy4g0SaNp=S66k1Dwfql!wqcnoF2J!>0F6bDCoeWsI*pwQj>6g`n9 zjhbLtas&_;{i97b(2JnPcQ1Q`NeybS;8M#}bi3nFDZ3yBoPV+`=?j%hFV14JT#5q+l76InODM8uCIO4WK*sbBLk1H^6A( zrlR1V;{guBOH)IdVJMm=9|h_88Y4AT4u{VWSK1ynqV0snv}rX zCCI_*2R`q%JAuo_DsTmn5kQjFY--ndK_@+edMZembkD*fc~nzCiqfP-CpUbIu1zlC z5n)`T`8vsg$GE~0M_^6E@bdQhA9~)=X7>3Yvz2XYBwh*!OeJ{;2;#S;5*X)q8;=Y=h zNK0es%;fB~bZl~NZg^sBrZh59N{f>t*T!dybH%aIabp;tQQg7l&`1tq9V?!bN})Fd zhTo&i=Q<0KLU)@mxm_(S&!-FZz7{MT_pyRgW*vAqrifJ+cwAme>%&U3qs|$SIkcG+ zo)WataRg~&&X!RRZu+4!e7qWk*4uAE9m`%WWL_aN2xB7=R^(xc6=Hx5M~m=D!bG?O z0$3R0s@SU1uFp+V4rS0m%5~uryo8EhLdDNL+~yK0ewvSPY{Zt)UKb83-itDbwFp$g zwSdZj`-oBW+E;bDS`NJ|5!7#234i{!DINq@{=5dN=6qpai!=fI!)$#rK@w_yg>OVB zAUE)uA zNoC23H#FPOKPB*-86~HVhbulZ8a`b%1gMfklG5P_W2vh`fC zGyBf=9q&GLp=Ho#J9id4WP-eMrJz_s48aJStqzPxYAO-xwibnO52W|HUx{E1Wh*4G z&YpRFLBT?G2S?6{MJ}+~`Jv3~ebrErGXS8LZ(=u;WO^B!9eHd#OeoN>*7}YsJnOnW z{N`%WIyGCJkrB@~#-CT<5q$pF!*~O;++%j?nZXGUOHm|68Il-%rD-R;b)!4G>sni6 zpSx}1^Jw}m*HjC@EL#k;K98NPQ^Ox z`FE}zXs!u)jBAFbsYxW*eEUO6Li(9w;lsFj?~c4_i<$eirs!unG1u8*AZx-e^l@f8 z%NMB!dQJ)4KoA}P(;R(yg`@|p@yPJ7u-XtlL3{H#so2v9=sI}2q`*DmVXLuCqsc7k zt2@|^bq(2U7y&`U+ZNi$b=%loXORiqXIaZBO~t7!NK|iQ)+_q~ZjM2LNPmFB?dmio zh7iy9JV5{-@nkm#6u}YHeZdg8gkQGHYc-$!76?vS3sFFX`_SvUIbC{`&KDId!d1(% znaRZD>lEE!X@g0Sh+q+AOp?4UZ8seY4i^eS-`;(51!gaQ(P5~tbnY~Q7_hXYB*Iz7 zywTZk$B}@zIs5@2^Rup1e|=vp-g?++Vh!fKi558rpE|A_K85)ouiOcvc&?v8V*K6j z{>^)c_nl5?S1Pq-TL^(d`F{e}e)qfobplsOPT(4>xG6q@y9f6;pJHc_3&mE1S5SgN zKri}+i0@yZfvRIW5c_<7xRHcSXQ}(G5f$JUvT26#8M99d#{ZeAqys}onq%zDvI!m8 z>K-XoFTFC?u*a_%(w|5$xNuMi_}Ue@;kEm1oj9iGEKZW&o`CcgaX|}{B+Re`-Bzu{ z#DgMAocRt!@DqIj{s=3m8)!8Ly|+418`wSAVV8!vbvty5bF5fR1m&O8G63@ zIOikdy?W;zyv+Gu=KRljT=+8Qf0~c*9;t=Vi9%eL8A!xbJS*f(ZfX=EWu$%#44PEM(7M zh|b9t3G|5Zt316hE4*vFqvlz;6bCG)Yetg7-H`#YLh*yw|^RA>q`NtR~1CT+^T)x@M2DP~{v1Id)c?sG$PZIs2 zfi{A4Pn6nI;r_MX8kch_lhTsxEi>#P1V7q9)yiPk=(O;lw!8!-+0$mA+<3vVC1Ij=^}QJ z>nUe>zR%zX=f8|yym&<~3H75&o7H&>i^94ToOG-O&UKDdJ&nyM{++n=^X(2+jbwNo z3!;7~%+()UG051(^Y=kVG*EbJurQZXbaB0eqbsQ}i%t-<$^{AIZQTSzDOHG+;=yy& z)%Ek6U^t{5ol$e`XP9ju7^K&}Et7z~hbPHwx8hfL;5QQ2V)X@lZapnXlGs|vU5Vcn zYSl_*rdaxV;PNz{pVK&g(N1Gi3L$zsbvi&7wvNyVK64sgkk$7+>$O6qTKXEuXYvQr zZ^|Xgst2vA5%r=TkvU&B9ec(kNJVE;gB;@AP2py*>Du5uca*NU^_6O-mYBa<`NuFn;(kBm)~#wKS(-;?M&L-9-(kWI1h1Opz+*~jx6N29J{q1}1Co|+I#;Q`YA7FpR2G8jQk{(-l z6f7HK1FINNlOqt!*#$Od;t&MV4y#kOozLxvl~LqI?_z0GAcVw9zsyV=`~Azz#Cb3z zE;AG7%oZKLaG8nY33AdxH=P!e^76wCs$S_D?NrPexoD^FZ)z;2QVH0vwn2iQQLjPq zE18YxZu*(*nE9Fg!C1kVI$>m*SEHqK-JVIxRiB!dfJTo*vJD_1@~z`t8T?$r5tUGdoZF)vdw;@!w)_)<(R3G~Poz4`VR;Q?=r!Wxe7hnS4>yXBp zT=Wz;62eK(re!l03)sA{scWdNQ>JLMh73tI1|4D+yt#kB#|?=jqI>Ri8xynFlg=g& z9@WxfeJQC|aUFIVR&WW@BG`~BYsXDD*#EK}QhdGH@Gb3R; z4*gkI#>TNx6)T?|o){i04o}QY&RoAfnof+)UY{GCoS2&!PKT$8vlFAmiLt5C>%Ce* zC){|=L;o`({Y_98nd||$>GM?7=bj9L=U9T z2>?umxngCXVFrr>FjR0vD;yhCIrNHi1>C8KtXxiB);hnu1Gy@OZBMzm%37(K%?;a9 zs|#b7jXPzGwp%CYf^pH{8iSxH2i@OE;j?1tkuf+1>(xPiIiPzCH7WFh57?QoC3bSV zR_=^=l{-_TQ==18lcl-h@bJ{!#P#v(Go|aJvy&s&CyK?`Q zXq!X2`7()h{P(Y3Cb7;zH19Hrb()WG?11pt1#BvFq#(5-w z9}rmo7ucfn7 zBcs<#Q?nCiXT^>tcvko5tgK2Rn*Ad5doY@o6n?W%MsqctwWkkT*_+Gtxe26Sl4nPl z+@R)C`FwdSTQ0(hPLVorc8n5!#MZ2GNY(kf zq*c7MdM~ZsORM*!tlo=9s~ClD1*Y1T!PGm zT2^YXoz4cls82y!yZR(A{?j@CbK*pZwly$VMBiJPDT$1T6KD7jzX3n~%3c8@P}}fj z(Z)bG>MYKlk2-b~*O1N$7SbXkZ$mjqhkPA}PGs#HW@c|&3ZfWqQ1EzQNmI&o10L|m zDPxJJiV(Q4JHC%r90wdATD~Gj%!rZlAkMC6SouoW6^NZFLU=VR37BGBSp3PaB;w9` zcgY3PQF_;q^wGM+_71(tmj&9!8KoIvfBWPAn@!@&-sqtd-A-kqKcC()3 zccA;(SdNO9ISiQY!B`P>8hh0};E-EaICz7#7Eo!y`d#?W6flnLwyf_-N1N5aulO6l zIVtK`>RNiuDKIadYmup(+<*>zd_Vra{Y_&bre)Sn{!7xWUJfXghU8>(J_Z@@8n5@8 z>f`Dh2665~S}(ETlD+&TTR75ddmHmA~E6 zInXV&^R}G3`am-ES%-~fcNx=8(!uUdAofWe7bIj+x&o>9KX(N1A|t0v4jWRuq~KwP z@5S*rlMbSLTO?3%fR7>qchZ!GUTx>UqXljn63#Y*s<4ga&n;|I0}UM%?2?grV>XK9 z*-B8d!dDm7Ta6{E=?ESw`NUIv-kW#7j&3Y9=I7%k`u@3lkfV@PyshGM>w>um+|g^w zNp$SWSOwk{#%m0vu81>UrIviY9#>j%dv)c~N`qsOe}j?SV6yh`4x>4^!%L!Vy10i_ zkHf!rVI-S}PzmN9E3{MJ15KxNGg@3ek=|p>bB%(zI(v0sf>`(+cJ<^Gg}!XlRlt-C zi=d7^{KHaNTy-TT4s|z;+zYOMr)9xj-N!UOwg{;&FSPbwkT-t7yMbgmm||@VNv8kL zuu?g!RQAVM4`iisFy$}3qedWs7<8F7uk+lWb}wgPN%*%v{`(nx3)YI_Gr67r=#zoz z8mX8oZjtardz6y2C@Z}sH~)t}{JPOUiO^#o7NQdCWD(##Lv#UAA8)N10u9eiM)3ZHh*FEHrIbZV|22 zHjL%_K4p_2#0EDFeC-U@`EW_~#gZzVkZ3Q$gWDf?zRO8vD_PJm$CB{BVI_u|%}_H* z)=}BDsIqfkRi?GTXZjH7@M2^9q?zg+odHC@ZnszNE-(EM1uo_shRVg)Svg$%)y1FF z9@Yrz2c8wgR&)eo#R9tzqp8o)(8kZPiPFujw7_#>TAFY!2g zCkG-~I;55W&ghfllb=rBoxG9tw#z#B-7PGba{D4xD7Kwsr4F?1uQm%kv87!X4{jPi zaIYl%v?+iV(M#E3;fVvwRXhlzP4tp;Qb;`U|C3JnH!w7E{{~dUIGm0#`lI31P?D}g z9dv5bJQf0OvYQk&xUuQ%m;ty()aAsUE2pW@VJVXf~dJP_N;2d>z*w zR+sCoM-f%VTbD$OlmOW62yx8ZVUVGIc;_KCU*jMXf2b2(MUBM7I3LLv-e{Z{LpF;X z>*DP9V%97*ezGaQ!`9ER_0#8}#jy3$XVGc#^hJA$PRU=LtjY;87})etbc~WJW-=7j2a4F@)|ug~-tcu#c+WSE>(UKN+Rs>5gE> zCCM|iLz}XyATedMGa8ldj1omtK`4|7ynU=dGA!2bB*tcoOGYKIwK~7hcvP)}Fd#)9 zf#)vVx*xbsNCEXZd+CJWQl6>R;#R8ysNH5`sWP*))Ob?4+pIsRFQ-sSr5kte5x3cP zhKZS>^2r}@?d@{t#)Vh|8uBUO*coAn{s)D>=Q{}Gk=pvutsb+51V+6P0~+_8b-4|$ zj+;bQF(jFF=#O;%WYPfp?Z)OlD&e>+)m!Z{|AM&)#;RWSsEn3tntfo0>>ub;d2b@S zt<-t$Be^nOcJiV&QhJgMC6m6BiO}s>4qYGnX&)NI4$`S%hh2G-kS>KgUUY)N0n87xrm`*gtrg<;L=Wp=GwB z`D!b!B-5x*?r8X;GBy%rMbou*SXX+BR)UjNqMGn~eKdi)+yI6f{{VJKot>yaSqB>@6B3z=+8m6!<$95S?$_Jz?ndfsIO@(-$ zZ3NbApl(!@;3k00LumsP1&-hg4~cbbBiigZnt~6j-c3>?eD-tQ{cPwgUUVj$%%6|2Qe^W zuhv?vGr6I@IgI77;>FKq9v+)V8fxM6mmT-8osFss*y6DqKz10SHLZLNRLZ_hpv*Pw zgeS*%vyr6FoG{;us|(Q=?4?UP1ynD-C}(xKahY3=l1yH_pW(6G7sqnpU?D;M!%{Nm zc6e&x?C0uN_dTozL>nh(YZ>?9K3VU7`{VyUgKt3>m1f-JK>1AW>%aPBgi5**0Oc|u zLB1>Nx}5-2JV1Cyu^uz3b75SYQUM|e5xLYf8RKGn!&ENB#aIdoemunxSS&n)Ru!Qe zGBHN@&XQYmC0Vjq?*V~OgNuKM2f=H6e2}j24Kc1{4PgpIWMbZRmJ=+^R@)D$)symr z1F%r%&*abkPpfhB2XWndLDEOjZ|~jl(2W+deBiNU)eC_Oy+T)HYb*t5rY)oiAk}x* zGI5wYfNG>s>0zVQ2BeMY90hEfUjmIjb6R1@3f6x+g>5wr;3+pb5T_ijwfb^7$Vz}OfH?1s$XtM79Q>W9wIjzf-88zH zCkv&H&t$d;+_}432GYEi{NY<)oQqxQI?ng&nD!OyX;G=Q64&aB^;(pSZDX~Wj2dq< zd{OIWY2t6K#G9nBq_Vb)J$UQ)rQ3Z;a(@fo3TO4Q4Z~OPpJ76K==SUY0-Db1Qv%5; zMj%_oKLzj>)*ecY`Bq~oZpV^>@Aq z>LYTto4qKR_lFqV9Y>{mG2&Go*F}1!z!lunA;E>4sMiZNQBOPOjB5!2-?7jKF{?dL z%7SxZwPy!cuhr8^sY@{AH&i;s^3}ukqou$qk;SFTF3G79FWWf3v*VV2TX66+s6c}` zfcinDig<^W#>(nSOLuZhL@tnog3i)%Dor8pW9@B}qxGasj1(^ie z7Hw)`{@V2P{QUg*SX`@KuPu&@E-o&NO^%L?jK%T7_`>4YLR`H(Ccy;C(nGj{SST(| zh6{~`G{A+*xp<}8yjVs0tt1}Xl}dkB8$hSlTC3F-CCHwfyu^>_33FQj9k)m8S$6RE$}V^l_-% zZq&f}rFjm#EPwtoJW?H>I2Hj$HcDQ>;!^#=!?x@RmU-#?F_$Q)1WbpbdB)j=Lmf6s8Es9{Bc>jadC zrvf*pIU1CulU6`Db+EB4o+=;q;rL+z0J^_0$3x-1xYnH(qH()%isdSiNUlYTn$?^t{Rxd5|`GXi! zVp`_8kWkkGCj?T6Dy`~b3}l*kp`50gc%wpyF;O!=HBwdOmheg6aeLP;1Krfwr00ri zY9*?1VPNS63grl2Bcg@fgjZ(Y8@hmru8LRa88{xzL;?AHA7q~E%{XUo^>zpnGm)j} z?yzL8lexooo(rh=)a@QJ4y6_9;O#9QFdh8!TKDe3)Q>}_#L08NC~mdK?X9I1W}aJy zGH*D(A*t#;C!5LBWRsBGjRYTkC<*R1l+4jrq+z{0qC%_O^3bo=rokLB;#zblWp-x| zcHix%?88HXUw>{)g(LWd!^1qEF(t&5AJ!d`y~w_qz(#*nRgY%x&fQNI_3Ur)e`oIB z_%*Gan_u4f^8S~p=rG->*epY++@uM0N1+ct7`E*Y$4rA6BmuugxZGo@Hri4sm(95kho2Hr>LNxo@QhP1r1580$z%1XFPv#cIN~ z3M#{Tu-+n9cbIN1P>O7uX7(4R!jHIPk+N|Igh;Wt)VXCTBcI*2(VgVtZ4U#71)LZV zHV!$^dHaB&o_cG*RE@aW^fp>aHj1y~Rtp8FLeej`8OImOz#LHHOsU}`a)oqW@`J1`B-=v`Vf|OUs zq^i}b3M=ca++MCNt+v2-x%B(Fx!dIox>DgL^uVEQCkh7(PZ7KA{DM z5Bs*>Zy1sXxI9W_Iuc+~+cHJQLpz}PCr`?#FljtXjJhvQVe1xsB=h>=hDdkCZ z)@h!MTYx-HazB#wOR~K!RA*BMNhP{*^P6(IU!n1f82;LU`jzQ%!(Am2V9C;KFoI-e zS6M~6RCi2rU&c_TTL-1baT97d0Q9q;gSb6)+&iLsSs=%`)%j-X*pEtc_imSc7!3vD z9~2$R5}gzpNx835`tReGT;)#=i#x)egGT5&>2iB~7f~qfI)(@?*vLpTB7dkW`W4ZK z4U!Es_sy}ml6&YJ!<0^ED+O^8?YIoX@L?F<_c7Ek4DYire5!C^xZ5T~DzyW|!LslgO8-d?Bx$T&*vUCYTrGnK8`!jXKL;GtJZv77&Xke;%j1|51r5|%hnYSYyA&Y>z z5uQUDStc+V&j557VpcL4FwIv3eseC(IUOt=R;O2~HY7<#y&5jhdekn1(8-sdCL0-B zqq0zyfQjRd2^v+Di-KVPg07$h<3|27BgJ$`l**0LnhDOcj<25@d5YU(lXYSylYRa~F>x$a%KoytG znWYlIeQ!LUVTLWl4R9OrYy>1n*8$ig8Xpg+Q^7ZCiAIY z=A<2FK^kE#g3pZj@=Q?6I zQgKA}`&KmDY=B8>;RfmY`A(}$sTq*9c$~~QphOgTl1-n}_+dyct20XtTkD&0L+)MOrJfCc7crU@QAsoIbP%h!nFDrDT zt6yZ;Mjj&BPzK#0%JKA-c1rRdZ1d&7`Iv_s3JGy5be73O!0i{+qfLbw$d;J%Q;op) z_5G?@U3vIVOGtQ&{_*!;-}y(ZUn!_lDGblGauaWpU+<+r0|xrD#*lr%PP~Wm8`6t5 zI{S(qy%l9?{ie_&$T)awhRMn(DFYV1IvD~4-h$?K=OZ1?VJ@ZoZLsorKo74T+*WJ+ zF;EiMK0Srr3Uj5PHwy1U zp)n#=;VBY29CC47W6t4lWu)=|Tqo)^eLN)pq`3T&09?s!MPJcv>65~w3m3ImTnrZH z!g>ofuhin70^WhRPx7?uzQ;F?#;B38y2BPdu1o3az2kOTdbZfDX$vmi-Q?Bv8vdI! zFSxekFJ5XN$Z)i>9s=~}(PfhnnHkDwPlgz+yq{lvGQ?ju-0H2;PHs+3NhK!@(t{A*nqhXX2d`H#<}O)23bjh#aEDS@Nt` z|L^42XL48lqIB5Z>XREen-_I;(B2OfEkxJZBy~p8qj;Uq0aHPQ^Sp4l%U;fN;UXsg zfTQFs9&~t)ZYW*tU@=WYwKiPvb5K-YCu_c7V(GWZO;>JJYfyJivj3GveYxE#2PlyW zr-_%c7W43La~izq$?qF^5I-N}s$XyfRK28>LenMRzJ?LU^XPuFx}3a$CiDUCB?oIW zuC>eQP{WmL3^*Eu6x_SU+RQK2k@LJ5AUO;r<622&s+7WqwzYzAg)oDHRyY1^FsNlm z>m%i6o@OZA z8cEP@8Y|Qy?ydudy@lPiaM;@(cGqr7w?{48G^EziCYLYLhLfJn87;53-Az}n8vY79 zp7YhE>T)e^Mi#3JJ72P>j+}l6+Xc(6n0&7GUA(+dS!^^bi%rbe7PO9!Ble?=6_hni zKo&`#5wI5?LP7!8Q!H&~z~GC?izj8YVA8VRSMJ5trONHugxz%VssWunlg~~tB zll{Je=gRGydix!&_RC-Gg+mhevf7E-;y4wkMgJNPwmp(?koDp00yt%%r%VKs(|Bto z3blYi{Ve&k5vAW}tHaP)Z`>%$z782t;glk+vmps{MX3y8qftGo{}Blx6sohh+Oq?O ziH0RuJWO;C>5K`Zg8}FXyAWe34kl>GLx>D)4^;4I*q+LZ2kE8z6zm>R3{3Qbcc}My z;5TMF#*HcY(>EA^N*fq@$5@|xW@NwK0uVrmHQvJVv~!&?ar$Eh2TL9BXV_!glnR42 zPSadlyfWd%Asb3=N!KXv-Gt z#p@`gZ@JN=r*Fw+15WKhc!)#IPOjf$NLtqglHeB$UUTlz>VpSM$%{*tfAXX&jpbGx zwN{qu?Kb`JA$3RV%Yc6cpj~p?3-NNjx)e1QBL*;dH5He32iY{P?F|VxdKURT&(~;} z?VW9Qd60IE00xdFwIKs?K_8@L_}O?8cAS9lGTT${xbE4S0|_s4pLDS@zI%r;PDa2= zGLUsNb9~la6V+AR_UwT$gbRH1&#yii!UZlrm>R+b`YawF9Za|YRc8r!N$yL&XGGb} zV&UjwZ(};uur5W)-z2w)4F#*X!ph&+WiXj&_dT2?i0wM=Zj=b@dMLYk_!O|{O@kp0 zD-U|^r`n8=PmsttU3Q^%&;5E&&Lt$&j~{As0MU{FBI8u2i~&A!b>zzTqH@S62JA^J z#?8u?%e4lCkGXh@G(_W0y!@d3FbFKTck4zpIyo|#={DosALA5u$OTUw&4JOyXBnkT z3;%r#PkH@Z-u<2OP_|^@fSYsl>&@)VKv{6ig_#f(MD0YnIdgx8!qCGHEQP>Tmcp{Z z2d?-yI*^TAC*UC1@RQ>m$)P`Y-7aXa5Y{2Y8tSf zncD!@n&_%b=PoSZTJpN``s>t<(s9}g?T1RfbrJWvpv-jRUQ}|%^V6QO{EyL{TW9r6 zH}0L)cWDzzV>%Rxx_Q>on%*4TO=h?k^vzx{D9t<9E=)xF_0CYbB?y#8Gx~y%DP0sWFY0!qu&L~q647RxvG75FSLbsgCw!}e?}FNkKSC6>8Iumy0JG%{o&V~b_f_&BVrKrx%n_q)=VN7cs|uB7 znKhf@rNNn-LaPFK_$~aza&)=_D&=@Jw_7}s+by1Sy2WFa2OuTzFH4u!6CPtRgFAtz zK980mU(JIDiy;Fob>j}PPsogIa<-So9zu;+;0q__F;{V6Z&j!e+FQtNf;N8xn09Qx z4UTvnJavp~gb@Jty3_3O@|4h#C~fD!Lj+i<`ib};474O9=MH{{D^qNt;@PZiSJA*U zKt1Q#P^nc0K0xLkHa0){=U0b~%{~Y;hmFlX%T>k(t+7dc#mtN$pUR`MZTOt9U+fW4 zy4jdR-q3-;`O7v9f;iob zQM~VH8(*u(0ct!?Ltk(+UTHs!?$jUEp<Zh_^9cqTqfHddFrsN;8idtIKWs zC4@3c#{C&VfHvVAGl8D*kE=tc`0EAd3(9tY(SfY>M#37Y3+_63xG}vL9T6jmS&rcg;o4S zSxn2iLl5TfW(Y`P_PFI=33M>d{y$%#2B-?PkoTJ$!HLS-# zef8P01(uXQed*;V(380d^pul8kAwDCtC3_@?Mq9c$3f_84)5WDl4x^1&Gh3&JRR{k zds1S5){jH~RfLD`TUa=REr5_gJbSoOmc}IG>G&Gg+5H={nke8@&TLTP+@v_3Lvicy z9< zs@HUBE-PTwF!{H4R1W1ojK;^uh&DY}rV1ke{Q5P+ruJ91#WCw4ApkOh<`mT(L!zUu z5@EX>fVV10cwle3cLLJ6YKv*jIFGfH8!=;LGE+f-r?X>?Ot(t&o3?*%CG6lgqf6+A z{f=>9HdPcZHznhH=>;J{Ut#s>|yt2B4~#o%PW zrxAV9d1h9m@2m}Brvx$XMiyWfuovA8ons)C8H@;CLxuY0>dI2RR&6J%@qXjG*js=Z@2- z&D>UFwV6!ZsIhE1V=k6>vDt79)jsV?zMgXMt)7>29Ahu9G@1``-r(6h*r$9)k~dz^ z5Radi)!fWVBgrbyd~{Fme_Z-rG(K{!dl7jH@m6#{ZXxUMtJV5K{429!`N#ddI|WB> z^wLI7{?mkay|~{7!jy5}$4dV$S59m~dt6Oa7VArK zYbh|DRx+PuTuGyK$@K7&Lb2|JnjQv0b(pqW9h0<*uJPPZ$Z^vbh1}ri!(R-R&-FcY z)rAekNXd3<)s-G#iFfD9l#>`ccEQ$2wNP;8D$eW>cuny6$s@m^+xrPDAOY2;jJmR| z4%hKUw-~rD@$6x46~hcg0G!7y>|K}xBsOlm$$Ivs8_y+mjB8TI#FY_u)m9c7wbe&S z{&bn*f5~0Bt2nx;@9M%^sm&D`*SZJyIqP)ZB2_ zU_j}@t>tA_t_`V6gmQ!$XOSqrpJ)1SP*4ChNjFe~6hEhMmu7K0rgy6Rj{~s_(BV@} zKY1l!DM2|E`I}PSq8P#xa(;gG$q=6K8FxH{Ck!GyVWNPpcxs>CCbt9R^ZEyerb#Eq z#1ZZGd8bf^cJDp(-2F@EN9@}0bq)z1d|<8%-PF;dw7MbCeI|WthjSfplAxnsI}VYZ zp7wn8J!3LV?eHWwA%Q*TRafAc)&1yNOq}MIf>C*LPmX@D^_M~Z<=c$2yR@iyl%nF_;vJ#n46CGFP(*ynDwVnC($H+V9y?_x){H!` zRdL?N*Ws=bM%rTf?(h^m1w)^b?B-yY`yG-Tf?ngkP(3SO;Ho9s2e;Ka&xO)Od^c_O zY4bxja}GJs>@cv{X2CB|+JA>`>ZoH})_0S~I?%gUw$9Bk=p6>VeIKz5gWf(1dJCxS z9MonDRZFOhKpVD1kRp>oa%`gf z-&8lULu@khi(n!2G~h1N#6zGX?ZIv?DmP9m%`DZI%r2@1U>isBq2?{$6x*1mGF>59O;i{8O#->3^<@EioN zqTl>B2I?5gtEbq-jrz4yRt~*r4fV`;Wu!96{6!dr`qFR^B8 z{5HSfw_xIYGT4J(M6|)@6!7<{dSc$Zeejo@N-?BP_l$_E?G2@0<_Fh1D5NL%eW+?A z&U1}&Wqz9uC#?2_rlV;Y*tcM*E`cJG@+k29Ltj$DH9Xn+c)#M_r4zA?DO4h=Ie@*^pp;7xj`A1^`m11D4aGTj!+So{rs)M{TskEQ7 zN}*U%bP$ftcUd`^K%oSf!Dws!!r72cFBJ6mY8x!Z8cv@r1*$SyY0j;XUJYMQQCs@p^?@isX{*g9q?vkYjN z?j(uh0kZV-VI-VSz9&V~LaxsN6Re&nqF{9@yrKno8e+mZ_>!M-G`dIOJ~A(%Okotk zHmL57>#WrJ;St~nA(612voxJIRA-I6n$}4xdz-$nYwU`grk3SwDdSAe1O;W{$FTOG zJZ7zvw>A?p+QHqFA{?P7j%awrQ1Qv$18Q zuY+t{Tez)Zvd~+Dm&!YvgDPDx=~8#@VId_m@)<2IJlwE{MQ5|8zRn@>fx&QwEgV+r z-^WYQ;!>lr5LMglYVEt$pcFqpQ-pgwpC)$Q=}M1LSGv`1G^-D!op_%fTGg(2d;EqJXvK&#lj@SI{o%~b_aHiJi{Wuu40&(nfy}Pf@$vB z26e#GWjp1);fcJT3P-d68e4H&}rC+Bd%xz0s0~kZfH&?RtuzG$vgGbz@>H~GP z)e}nv!+ltf!DFnp*KJJ&wvflxWh}YXIqfp0>KVpzYTGEAIvwQG^ix$IX13aX2xg;? z<7TV6l-$vsMh$GIn$f-ZQKKDG>T!FywzS$x?xJ+(*6n|c?%leLqPE~n6*nt$^@TY3 zb28+;)o4D5n?IE1=I-4p7vJ}K0JpWGbtGN$we()&o~9jVdiy=VoGNW6rH&#yCoS&n z&Y!!RIop|3Xn9*ukO2<{gUgXo$O`MG_=@fl1#C}iDfypa1xIQ$ITf5~r-Cz16`X~} zlV!m1Us?%goc7V1d>{Q)!_gAxT?ANqq;e;)FiW8~CQnBk7CISJbN2)yGL$J~-Zmz* z=A=whky5k*5ejoOCAq`k-?VATWY?G2M0dyr7#4MgMV(<$=WODz0xEPnSQR%pQu$8+ zsOtwwgmHFkJbp8G_nYL9fPc(#iuIn(8cekgqTk-T)5!p*y0{hka84M;j9V%fb;y#I zOE;;fBKDd#B(=6b1TAIrTqXxrZq{2XjaHqGtW7Z|l9oHgc-Xmydn;b-HgJ%!;t7q@ z9Cb37Q1!)0S6nOckYBj75@Z1a+rV{9Cz3UMLD~AGU>THj#N*{!V1$NRtL|sTHpB5QG97 zF<$Gj>2k00c-4j&^a8reCuG%(l?&{IAHgAJ+|?BV(`H=`+**_exLFRR+f8)<|Glh) z{DQ%BUcq1@tPCttd>33Q7%BtjX-baCWI97l$%*q4I3-OPe0DO1J6t;Z$mpf zUHhrYb2^p3xeZPbv(fcy*D8~#e77&m1H_~`Hi=0kP0j zWzwyAoXAHwk>O|JFMXJN-@35qgFePa(l+PYVF5j3Szt`cpGn((7v%@AP(-{TDR-S{ z|2t`qroWxoio7l0_!zxx$c1PrvOBPmq87o43tKuLn5Kn~bA$_Dq2FCSwslks-cxw0 z1GO8z=IxJO?l#mSxM#did(F1=S^Y^0hN<`_ z`R+AUbVWJyUDP1LG9`^?;9j$jpw}c61C#bxGkpoe3WJZjA*h04#UM!BXg9ckH(WwG zw~T?qPHt*viT*c?vOiX|z4#wDU}Qt^Ldandi~Vb_kb0XT|ANqbcLPFC$cUm%4INMj@O?Vbh|IpNn-q4E zrtiTXl%yl!vGKMz#x$8w^69-~<{7f>0Y(S=Ct;_AlsQ89kq>n&*kOq$(Ly9v$N~E_ zcZPhxA#`jA9UDT&&ZLn(S$y{deH?Vu{@e+$a5N1&0FJjxgC}h8o9w+&>0Y%RM|bLv z>ZmCe@P2~*d7n=rIXOx*$thh)j_bxFJe-l^Vt_F=8pJQXetP}1CY7`Pv#AwN#dscY4m zQcej*0hcha`Y{wT7Pi~hSa-Dw9bMNd!u~ZdpRrVy+|j@5UnDD>(7jaH+7QrgvP~Zw z>b5hERP>Wd7GY|)#oeKx+`<7v_`zZ?8p6*Z14mspA4zeh*IB)AKb#H937?VTO5vF* zxGJ$Vs%WOnN0sp&9Q?LKV>nqd`*`!=>T}l>d2?Nx?AGJJbFV1-7DtOYaO^VzSWA_Y zsS4j>@--j!Rf$|xvfVMxNVBb;aWQ2PJ`=k*k!zwfG3`{qMk^~EAy!&!V|;04uTdMV zily=e)w=Xy&8K3=xARPu>m9|8b7(<-%6FWChw62QbHW6CPzYh(61M)mvYujwR55$|8)_Cm!xTpb zpLfG!PGd`}%S(;gcc8(LY&OfSviJq;;w##r>N{%+z6PV$WWNXM#E-B)W2Z;|@y>@0 z29{vLwrM{@yXyK0+2wxNkZultxz-t#VA0x9bJyyb?ePuhO8J283ezM#W+wyITjfs4 zS>RLpXN^#MiL}*W+GIEyQ%U_7>h^i+MwBi&t)%c-zKeWvfmNgxWxR`C7>r`aA|X1A zez5)3(>f+wbf&yc{@6AYb&o;|@p!NW3g|+6O#n4u;Q01lT@t^wowzgN!#zx7=Qjcs z3Pi$5%E92KV741vi|h@Mml|^m$-mx-;BH!QF)$No|8XXQJc=sdScrkTRnXseQEY)s zR=0#z;}wci@C#z7awY1N{PBExah_YfGto>VUj`TM@*H-HAXI(ooIr7Z-Hy=nH(d+r z3qV{)gmo<@Nj14IYVfb0BO>u{fBcVD^wny8p}Jg4A$yA9X3n*y`VH~ zmY(M$d_qmKc&?kFfDn_jpGk)_M_dCfjk-_4PvvL%#Wvc%9iRb(z?of~A*d;J4kRs9 z-*IsAI`u6(TrCj8cMN@pZMVLg^+jvDsggNXj~&z4Wa|Bb(BK0<{HI1fPvv5khzD@; z6|D`_RRVWvs^LbA`09R{dCsj5z9NNRp@IN zrIq(2!{vPW%eiQtZ@zY(wK55wmWRCHoTt3J8td7#NwK0TK$A1MtG?-mW|AKr`Xj$` zYhp&IOxA7VMwtpjY%AUARB`0wpv6>k&sdHzs@#E2V@Lie^F7m3&#-SPrh5TMYULDR zi#h0B(S2`fN(a>Ohi>O4{-mhZxdXUYP8DpgBwHB@J^EyUpA}9d*(P?V*?cAtnEu%T zOUb_8jtPf^5!ki~si0ngef3oTon!$}jKYIBsNGZZty3jD+>~DG7<5?A>#M!zdeQbC z7mOV`A3I8qJei(P(b*o3Q-oo|;(p72Ynf>FQ(+lcHoA};jq;<&W=E#D(n+zuAj84) zTyvRA?dIxojk#!2pV>jr>t}&f32Km>C`F}OwG~J0W_7u>*l04Jt@B(LHil<=->k3c zqOGqGQ8T12CSbVjbp0(ld2@2?N2J~XP{ipuaIBuuDp^u)h!r znklL8VI%6fV;1VvdPF%%B$I|~qaW5r@jxsAEWdD;9qGk0?#%8`;qE2Q?{`X+(qD?U zI*rbkRwB{n1*ecOioOcqAK84%T(5{pS8;5t@*rN0o7E*>dF;~Jmt)aabZ5T!*adSj zdo-Z5ChdwhBW&lePF)6L7z$91S;cPW9jqFvsRLQ=XUaDMa%X_i>9Vq+k?3HM+3Txh7jC}+VCnfTG1kX)mp*1T0<#Ka; z$+vwhNEk{Ok`Lb+68DLF`dUvMtwss85-5VeQ{Qi{w%YMR^yT--q{Z3$Q_`fZ_aI z`~&kgWqd;wPX@5yE9!V=r7Rs6DNC#l>(2R-sqyWbGjmZ%-gRRp`gQ%m!yYbAU%;vw zft#3_xic1lyb)YHtOVOJ&g-B1IomblMRH9w^yRL- zaF3dcT`P|v&!a5p-V*qYIu4szY%UV?N^)c1WFLnd^8)UbC>Fq4rj~}NR8233MrZ_P z{lp&MkOBd6QY8oAG4Ja<>C9X_RsT77s)!w+waWYia_|{+u6m)^O`ez4lND2b3g-xl zC^^J&uLFAZ3`loZO1(VsdD%8qo3)4a$I0PbYpkS#$`eP+;UDWVSoZs*UWiCJegbyBqLk@h-&#yiia^OGXj)xrh!Q{XP&c!~TLP28& zBTAXu8~iwVZ2_`J^Qfu4NSfMI3G?N$buHL!)(4F!irYjPIE2+$;pp(EsGgH$5&ROY zEZ=CR<2l4rpYk1NgSD+R>9|wCDF)Qa(6#rGtjfKCZgdQm(JIjiqLs3;3(KAPF$;A)Vaqd{|joy zbB|TQZ?)V5qML~H4*Yj&Ph!v3^!`Jmko@}A?VESyg+rYmi5${;EJKUuHTKucWp$f2 z{R;3&xp`D~$9L#wsg#)VPzeo$gos%3MWN4i|5v~mgMgV< zLYXN4nITU{C|GCW-I3>)@ln1T+bAl$%~DgvjJO7H*%nXA#zh%n{J{t!r$2s-B*eeu zpNl1ge6Dq$iuDsN5&TJ6tfk*MP-J`bv8nbu_$>)iZ78f$0PU9sIt3RTg>o2pNdf4UAo0M2!zBBioXwsb7k@j>fx@t??qdS@L0?UVv?Pl z*2#Ve?p>UN!3PD;7yM3nH}=aZFlJ0G-vRM$>>1i9< z8Zcm2pNi?63(jZ#mo8MT$F#~%64Q`t3;!ypxZ?n>iK6MJ_=31*E0(znJkLXQ0NR6* z+f{)h4%KoyPGbx=?nCitP0Mrm>?7;#=rfdFU^IKAP@!}sI?Ib2d=B7ZD4?Lnc4Q&X zJErOCl-*t-gTis*GWN~CzJGt#lyv~5zGZSO0Z7Z=vOf%N>=5el3E?kDMdv=~h-d3t zRN8tPij19TDYQ7*PL)*?h+A;Q;WMELnUz(N=k{2HkOA&c1`D;gfMyTZqbxH?u-rx> zvcvqq^uB_!lJMJ~mG()2i}|OoZumzgV{kIpp>guMWeom)qP8%d{J)XW>+@6Ni&NF< zv3PvGI$o{TCaWWpyTTi))R? zar43`g!!>pP*l&g@l!-u%Br@YMB^;X1KdV*894Zt;es)eT`WmVv%ZoQg~f6BJIaV< znS`yt(7m206zjIw8*DSEtZ)w&qb3Boq#P`<%g+_hNq8RU?$(prS&F5@x7Q`(_;)G3 z(M8RX-Ym61+{x#BUOYPd@6~1N;*h@QIKYVXO*c#XVt_kCHp(TXG`&lIuJm$*hmEo85q3nM2THx2*I0aA8OGssZLWy4&H^l5rjn+kYe=D`VhG_uQi@Rx$JYfdlJ}7Z1$t1f>D}s+>-w2V5gM z{c%)M0*!-dN1v?3|AUFG&pkPlJM0(8HWxi#g?#4)a%}ef6#Ax+LVW|cAr%chjL_2; zSW(|MYfDwsQZ2F6j>X_rI5>~3W=s|lOpC^n+^kq9QC;w3!Ne(;vPIXkp7|Da>JE!} zW)B?PYrJ?UO$UrgQR_Y#`vI3@_p>1r-WtRv);8%pS@b$VueV7a>n$i-1(l6_8BHw- z=ZW*P0Fpp$zZzX(Z8rySX%r0!N$UVt2E=FBkX8HjF1L2}KaL-wH2QYA2lWbPGNgmL z-{S)@ce=(9>K(!Vtw*PUAhCND(nd`V%3qDSrh~DvwzjZHU$e#>X&zZuKl_|HK6@Q$ zkZEW)P!+Z?kEipp^MX)|+{W*cXW=%UVN9Jc{^yw7n}__nXh0WkMHdZ!n8r5mlR9Rw zzwDk|r^kvcjhC@}Q8g2${fo{o9pT>i3X$ZB;fnt=U*RdP3eKRBdH{0kJAs-{>IQ_J zWQ$s+$Yfazr^qch^gBCll$m?C;6M6X+ywXh5P1-nF#IDMLvlS2Lozj?FeKH5h3V0F zYIGqUonIV{$KvUQsgc@vZE^ZqJio9oA73Av9=%q(Gz`gvQJ(&Kb*WviEE0so708a7 z@xQFrn=uIawgN+UJ{SQ96cE-2HS9o5qccj5$zNE_VLdD>`qJYi(}m<|n*8$ig8Xpg z+Q_)9UGu44wt&wY6X?9Iu7HwyGj6w{5>*2DG&o^XFwBlv{9EDhLQuK`5ezREe{9^= zgstup41b3ry7eTWJit}r)pjMFE8V|)f3`IM!;!gs*zr*C+{{-h-Cb>08jBU^!AD=m zwTIQ^dh1aS191)$TlMK64KNGX8Y4N~H{8-VxiAekd#L+cDHnK|i+qe*9W%Xke{dbs z3M5XWMHp57@6UWwc0s=WDobhSB$wEM8+W$im#jel&H&i$Us>}E;lgE+&BG;eJZs6j9pSLjcvNQHw5yB zBnxk5t-un|34)k})~pEdoTy~Z3I=NV!HU_yAwA?6`=`z;q6Ir8XB*L9RD7kkexxIN z+kGI=(Geo;`ObE5+BXL1U1p$E@?>MR6LF2=#Dw^mxWko_%a;-FuLsuzGUipl`-^68 zf1}|49oc})9}%>`L;qqS#Q(bA&V9jq&r6s&`W1e2>xT7QAoUAcQ*Wda!)^p{_geV^ z_B7P!fNx80g)k~_q|Riv)$(ObnU|fz&Yy9-({3!Eaduj%B9ieY1r0|T;}!0}n~XBK zB%Cq^%BFB;wLP@tc;CU7C#TOBzI^uJw}_IzOaJ45<=XREg|Zb4ZrR`T5l+L$btY-0_es zF_>hDiNcX3yiNkDXJBFqMGVRRe9}Y^JJL%|47iEYDk}LU`Eq0=th|zbR_xd)_kuwbThJSU$~aa7S+4CM`M*Of6EfJ5mr6-lsV0B&PGA$;$v=1fCIpm} zl7+EDWy}f*V@gBge2Ff z0KMCR-VM2+rc5z|17ND|zD08}2?_(aLlupn;O#!2c>Xt5+fidNnm6aaB3FKDD8P{b zsuJy=JU?Zr+bddM>PXakkEw>OHv-Z%gFD;!zzsu-Fe%-bo4xnVSLF~%)NY>$bnUP@ zsr;GK#kF>=;-Z4RnvDR&Z3q(Ymla$z{)D%JQ5gF37qRjIP=N81!;_y(AmJX2eq6y? zwGdt>vB9TD7H>jvg*qJ(9LCMiuCZfB9il@zb5jTSws`6$TS?FXc(~>+c+C}%n32w) z6;#OR|M|LJpOI5*dA{fj@o!~^5rSgQA`6BXiC3N1j-D9p49S!J2w&y=y0uRdcp{dOwkr|BzjVTTsAu?;%0CCom6|g0N=SD8|sdy89 z;HXFwg_C{$D9)fSFo{*vw*hr?yG+1nXx&iq5d5{xXHT?oQ$n;IS`JVEJVNazEFQ|A z$%3L%$PxLE!5^x|#ydu#?`zh&OWj4xFBf0!)hzqn;2ISfM?|w6%Mv-mHn_;?1CQ0+ z4B|S2e`Ip-fMs`8|IX#$O=}(J`Kfrkc0Gr1`snIwdzkaP+TO5hUuFp@`7A8k) zBiE{zr{g>sX(EY7y?bPMC4upB@AgcIcSct{DDtH15=wrU^@g`m{S5`ogXUejhoM3| zC$i(CP4wCEkLjc(9{G<%<)e&+%wF_{*YPncgZZdY#u0{BxbSnT0GIlWQdZ(r(sk?ReqbFLlat zJ(FwXF6J}2LeEF^XJa_ad>GLT-XTx7NLgG8SVzGFjLzb22iZojo>7`9JnK(fcOe1? zd~|%B&Hu@44^nX#f&|Zxu)};Z+^Dec50`ogzfZp9kSe!IWi{3G$7Me^8(qJ4tui_G zh0u%OFV5kx2<`{xY#ISDBW@>}nfu*bWZ7#GEZ^j7 z_PmzgI~)~bz@da7>|#>H%y(!?>AE`Ek3PfK^>fFUKc%-WfTj1);K#Re3=gm;$uWsL zqsy-I;X9)=hIhu?EiP>a2m!-0ywzPq0|}<yr%qeMv~JyX zC0;!^e`r@pPE+^Q!yt z>l9ICM#PpC5=Ls<=+%}ypF+cdaGHV6jK*|g#28HNybKQd@(k-v?xK_p#pyK(m12-l zICM~^xuQn4*Tcebf_#;b(^o>Y2BLmK;l;kj0>lo5ve-o+IwrA7pw0=A9Wz6Sj_-`6 z?W;SCo=v@Zw_=u#o8@I-ijykk6|bi>Z~&mmLUMI36w@ay8+FyJdh=@(9r6?*U$~}2 zsoEN#HC~gfswT%}Q|R)sd$g4r2{RG98FJ+MY~2-&f$~u}q@J*{-Z2Xc*ud>@mec9G z$F-l`Xui4Hj-$m!vljbN$u>e;x5?vIgo!$9sXwZ>lf<;_`&UcZ zH{D@MorrM9hVf#7_$P0GWfw%>m%dzXHybNIlyfU_!{vGT%d=?ol9WA1YPN>Z2rrXG z96rsYhU7SO^t7JDe;}FNgwF`6gxf{!Rf)_x_JaN^88K3{LPt4CnKTYSMpRSK6^wa!Ab@AH#LT!9< z{My)PZE|et+T{FHJUU&QnwXp)8yl~USI0)Hmxg|tif%N2SZOyNG^;BQ>$Ob$(*;%R zKk6LK>}@Jbd+HIX0B{p>L0o|Qq8351C;!2%+c)n*o!Ba4s^-}X6Ei!$0H!sf;Z*+Z ziLn9x3O|54);7d7Rb`1yw>dmUu}fZS>`dah0j0-g7gi`@MY!eSiY8)4+y>O&SlsrZTU__pfMK9`ehu1TXrtf{Ov;6YpOtXey?mvE^^`Z7 zzEUf$tv2JOA3PNUoHek8zsK)*B`=GDpX4Vyen<6+>hE#StvA7Z4E|ncS)WPUA+QKc z)gvslk9s9p7flIadeQ~icmbL<$vD48c)S1Wzy41|W;C+wE?#uM!zvQoJGC%+XH_Gx zA&E4T2_0JWuC%;U68wm5=i~ADFz4W)XQ<+lok;oyIcPB6UbuKoDt&}|2~U5zj`e_~ zXXEGs3#3l<4JCX(;0%)Y?S%MnJ^1stT{0vw8zD{ezy8Sb=U-Qss}Ini0%imbmrR)( zjpfDqgViRUCrDy2TWiqq?~>GIz4d##jO-b-EPH9|UO#7*)Twh&yBul`4vOaBu=70Z zJP$k1!_IT+5k8@6G*!6HGls|r>Ji;C9a4v5JsUdicK#%4VB75E@JYEW)?t8$x}m&Q zl$@3{QU!l@sL_&?N>UE>7YXrH7Mm*X4rVo{a7(3VeMcqZCq;p%bmL)lX(?WQ5Jy}u z$Z7+y{zh68AR_zHLt*wLQ+J(bF=7*Txln?COLN_k{7Gqh^_OHx@3255ElHA4a5$yZ7NJBs z^iWjA&<@U0giwY&<`0gjFw!wbv2wggUvuVPSDSG(b2IsZyWh2|$vvMZCmG0d$_KQ|U|kt)8+HF}I7lS6J-8i`~CsMpDcpmn3-*tK&$%}nM^cL+2Yp@hZ zUbW~;XQ`mv5k~G3P3$F)b|?YLp<81I$^p-zT+cy6Erj+t~S2>OH(-*wMYF8DXwYf2Drtb)m*)e(PEo(ud(C<{yoMr#Z2Hbll&A zE(>j-@HT%NR_lhH9Mumo*msV?tv>()u|)q(s6*mS~WPz+O?Lq|ON&{bebO<6)lsysNe4q<{jbi;eOX z4LLY6z35I@%0Gly~Uhb}acqvtwNgh+tTs`54%}hxekND0yWt94U#BH8yRf ztI_#gf&v9j8;k=&!(w4R$?d^+W7NN^|DKtdMMb_192oU_@oJ@Jb#LJ!MAXs2hYboO z*>KooZ;bWEQ@)n^vtmD_-2D zH7$;$6$FBV>I%aJ+z$)5Xk?GxR#{+q;#!f@O3>)G>%hO^wgZ%WHDjR+g!l zz_K8bgfF3!*{nS&BX}pPPsUUku*IPBx4y?5wsbFES*rdJ&9vLq+IPuv_rihU!s?@i zRXCbPI)pbJZ>tR3TO5zhc-vGfGF3l+;wzjnN(iBV&VecW;-R6r!_1z9o8i+sgWmPp z)=A}v0^<2I!FX#du-5ub#|Z6pMupY2uUD^l)&ns^Tt~Yx`Qr~P(ePg`@*#p z5_sqQDEhP+>;z2MI!vG9DmEo+PL>KzK>MAa@S(Rq{CjtEAiZw#d+(+N9_qbMtKNGv zUW}XZaxHFEM4$PB`|J129b8oNKtc80-S3303_D2rQLZzFfyc7m*k~e@_cm5^u-OZx zko{ks`V`BnkLX|OOOKaK<(kJd`Q_~e`Qga5kqMbh=2N}QNjpG6fcV%s!j-LzV^oQ5 z)*sZ{)g{|s2OM*pd~^C`DaN=U7 z-L08_D%{YVmm2ZiZ)cK$`8J*hpS;y3EW!J63wXt}6n|y@bFtC%CSKtN@w_BlX%J_t zt=5x9b0L~*H=4;3jBY%PtLO3xZ{wn1cAstU54o21C0-ou= z3O8j(&S}ctjN8@vQY)FPQF6|bY{1OYQvDQSpA1qU&ztu1JpH>d?{_)}9KAMabHK+_ zl~&wpC0kA9k%=yQO$J9Y$M#clv)@f6`ybv)PN2Jz^;9F%6ZWZ~uiRa$j9*SxOIN?3 zj5gCf#6d7`B*`t7TGAsNeQg{OM4!zqsA4J8l%y=0;Xnb(xQNAl`&}v3U~a7~>b87N zg+OzKc)@_w4&pv{Nr3|?7Y1hFRxt^Ui~1GM?8CR()pop;JSx_fq?-5Z`}b$df_*?d zgVJ&*Go-f;b~ZH(Jg)HbG-%U;M+DtKmB#eobD@!{SX;?G{5zC~4M-2m%gC`O0Zn{l zcu0Q)?7gxHnxJPh-ac8v(CBK;zXQ4u)F>%oACc}BX*LA3yQsu{l>EVer)uW#G++;E zI5~6|sBd7r1KfU4s-_%x1*Xr-U+5@ac=`k$P*?%Gq5iYZRJ{#yqj}AWXPO`9vi`Ba z$z3#3-IjV#M=SvXqpr03UA@9Ht`|*y=7IQ0+mHVe3^HJoWaxP5m&jGQoW+{z8VQ|< z9QoYZzr#YLT?6XQVAN;m42*Q9D&988O+h6Xe{ecBxp)KZb6xCS##B>-0oQI%y!}D( zGpMagqP&R8*ZA*u=q4d3bEYf6t4tR28@0~%d7rpAG2GMXKgosi zZc1W@jy^E_3_5Q+>KiW3r(ycMN{?(+v_9D2+9EO8otsWGL30<9-)U;w?k!2nqb*dE`1RTFQ6ubj%a^L8=8XOAZz9 zt)E;_(re6>ym^`Y^3S*|ceAvsu$kTcUvyx+lEwRR(X11Knv;SzLDR6|jgeVDAdYs% z=kC-c90w4~MmLf?s2*Fi0kF_qLrW!OrAbA|m@%&+h1Rp7nmLsN3T9e4-GCS@dlbIZ z2DM5D>Kt~?Px+3s@y~?v`mJVTxg96jx0LVB#D%0###69!7_h%ehUB+6nnHuBn z;-$q(EqSNa`f|LG0=5`IH5==CNk=*+CPg${oCi8a>-kjZb^Q(KGV@*uCeW?nG7FXd za;>(fozmZxkwEdUve2ll!oOf6@RD>Fl3NQD1EZVz)-I~RwwWBPSouN`OavKW3~0n7 z?a4|s>GhN68O0+-Vc8c25flv7z;mC@bHM023TO@}b0L?*cSsmoqX6tsszYg@te-LV;>U;C2!({5)El0(gkC&V5o)S3(5Choa z`MgQPPH}serG$xx)j{VMP35wcLqGnMC&r5G;_4FBYHWShujv{jsG3W@m84)T@k;CD zZ>^`1|MFN`Vgm`)kRZTW&1#YGeS5^Q4kh{mJ*BcEz5^p*i!Yt(9nQ+nIj8m1KCqk= z&mloQv8kks7KCEH_(Ls93YsL8{8?!(*`AaAdanLpxpH@zX*hFt%UYn7J-Jf__9H3u zaJVA5VNX5_PliImu=dO+Qtj;z?KKf|2((~$!b=~)@YzZC~ zXfN(|h491pG~KllwGhM^(LX!0A3E(DpCfA0-^+NwsARB&i$=1R_N|%dP6S4xOR6f0 zN|5V9b9(8f7?^;#tKE(6jKe%<9^%sDCS07Fr6lbbT%fd|;K#_qNiO;$(y%cB*{AC7 zD@ZB|D%CoGE2C)aWyx$p+H4s}45!eceQZ<>6-$&JQ4@LwnW=MHu~I{OLc(#SB*}@i z9Nbn=)=`VdDQ6x&HOU_%>l~GoPWQfoXSuc3#1wOvhw#fxF_VpzO5i}-G|h{cQSR)fug zBnUK{vD&(QpmXx8Q?w@-u1tDSoug>JTKf(F6adys{{Nq;(PAnLSgBfMDG()i#ZGcq7Z&?!@v))g<{kbq?ro;V`MBxC&Pq(8@O{P=N`rkApSvjFo0r zl|NJ0O-Wj*g?b@=rX>q}th>no;Jh=*u196&Af~p*w8*u$t;t(lbC}YNx!HT)d}VvA zN_tRx*jx3Sk##0maSPOF0~EnO%f@Z zyxip1#w|hg>~l(1l+EuX>HjwOklZWbvfLu>SSIeJ=qn<>iZzv6#k%ew{KgEz5A@0! zt37jj&%9zaW~x;8=}s=FGUdZ$EU^a~k1pQbiaq^|fL+yFA%!zC9^XLB4<0VBwHhuD zb@Z_Q&q+c9f(|g7jpMS`21G{)gxaMkttt4hr-yfteH09P`Q-ycWAs#TvwG-HLV zTG9Cr&QKxXF?sj&4m*Yx*?agdOsau7d`z8-P4G(6efTgLRyX`1mf2AUNM5`%R6y>d zWl+TO)7pn0S3F*geNFO&J)t4`qr!#KDdV4n) z6xypq(SoylSr$>R7D@Y@To@fT3|ZAHYzuOk?fM{n7=9O}*_g zigcm5^AjWRQ;)8V;@BTq<@ruq-9=rhRz6WNc>i#2n5Y$$*}phpPlJ%IHQ5W`<1osO z*-6%UK&UkiXuzi!h!ZLPmv($~807qA$>pRXm@yqPM7S-+C%5KyQPbJ9;4mwFX}3`s zE2pN~^A2mZK92Bjk31cHqM?QPB)8%uNvgKvh3HP>K^+9sb&^W}5a~7ihE# z8rnSpx89M$i7Fi!x$2YW>7s>w3=zh8MtV4gt&~|k_myMJjld%LPo6Tw0hBM1ohai= z$s@#u3`Q~r;|<(qthI^b!-I}Kg4HolzhTwmqklfEdh|oAKCF85S-Lk~ysC#iO~@o& z`EtBKR`|Zg7YC_FVifJVsySHdS9tKhblW~eSWef>%V{4PB1FIq5OrQxO03Zh1E5v7 zyrI-2Mg0%2Wo#m%HVQu|5;0JUIUQ1M;T@4<+DKWvDGHP00O20v&J%rM&`GX)a=tua z9+X6hi)0!N5jo4ndLv~S%(kBC%fZP{w0uv8WDS5V@ckw@PTh{3E*OiGJ`%=%Qs$Bb z<2e0kGXaThuiNN!3!PUO9IAo=^HDNX0(0;%9X4(MumRD2ay3D=5G3Y};pLx$xQ*}w~PhuP7#3KNMp z86BMp0OGH$D7CUg`V=RzEnmw~^a~o+QRI}IiBIXuFW^h@uhhcYgr#S2pzko!%7Uzv z%(<(t@gCdyT=mm5mIGp_NluO-5=)Y>22IdNPEP*h-wy?TKzj~eor`5(-jwO zZ!6x3H*meB@#2BTl%&n;WUYZhwk?KpTuP@&xaMdToi+XuWoM=E{DS5)Q!^zt45T!a zkkEWCW(+rgGkT(6Gg`Vd!a&YHqV`om-7m|B!aIll&vTjfdb^O+b@(0zcs^gv?RZY- zbUa6|U2{5~6P1N{G0FSmR;BtN$(vhk(*mu|uePMHd-2WBiRdQZSTsX7X1bv>aAOzM z>&PMB+JZ|*lzE|u0Ds3A0Y~?D+p_X=CObDo9pPm;2vp1is*o3pgm#zRqeiuk~ZmDm1w+L+v6PT z<(IZ|yhkJGJjF91EUe?vckm%gd0aFT9ZwCC#WuhTvM0q>VRw`Fr+4C{o6FM+RuG*_ z^}^CSmnq+iN;#IxBptTy9WdtnuDXsnG`j)(^~bMzY;O(QTbDi71KHl1C|-LjKP1;$c<&$}r{fd$??a~q<2z~*&yF#Y!CI?f zE=EL24FwcIU^dualfJ)R-{5*K0eMY?w$&h&>>)qa`s1J)VQXPl&n;%5g_(t7>C zH+xFeKP5NWyPr z?P*Lq_HmDb9nqmCoN9|PET{|%Dt#U)3=1lK7Hm!yub|>;5jz==Vi@5$cW)N{puVsI zC+ZFWR`49GoYLI6N(XU?yY3t8HJTD)68pOar-FO&R+tJ*^ zI8G^z1qLg$EBH>T`geIw0;3~p$9Q}lD=Lj<{a-(-%rkPfWuEKNjJ}KDstfOa$`t_s z9^JLd#O3UKboC3`^=xBN0ai&2Az`c%I>Ut95u zB-oeZs1&ZNAvlM4-_M|U$8aljZ0P*AA+^9bo$;A5{h8a{Crz)X1e)Vm5A`q(OgEbf zTCQfM;v(#W+6Dc~fve6T(cG5)dw@G7zj&*3Wf>rrvUQVDKFKu2DAXuBVDqfymWo!a z-K-<7v&*&ycuQYrH;N=f~c zo7XDI43Pe!D_gBB{XxYQb^Vn?FxIW$-c8yC92^*^A5*i7>U(xNUbS$GylBc8c99Dt zw8t5Vs%lW)?ry0dI308NfkNkbPPo0zGHG&%!YX_XBJ3MvCQb)qh=m+15eK&%XEx(3~w{=m) z+xJ-e#JMUts8#0Hw&8*0^DYK6J0^pwVdQSI`Y2JX_LKW2=JZB>L}P%o3e+f_507K^(eR+^2K zxY_<8xH3v#+?~BMQ`UP5!%B+G4BJChY=e4fc3f%g1!qKB3C4xH678 z#%Gk)yV}-CfvKdHX7qTRrdUXMddA`CmsvlTYK;5fx*#;l-z3iX)G=?$H22{Rnmd*R4!O;1~z<9g(CAF|ov;{<38_F}jVvoY;--heV}? z?7R%PImgMZzqg;yElB3dtd3lB3X)?L*xjiJi5vWwG=B8YhlR#|2qcDu#y*Qhi)lQct>5Kfp`3WEW88lz zUXcTUC|v-4ckC|}+h7CPRNSnh-=?t>fe={%D8el(#}+Nvx}xXH)754j@8rLXDVoA~ z0NY}Vsxe293MNndo+QN99g6(WW2g^SV&RIMVKYRS)Rd4pt0*I4>niPe5n_OJ??6;q~$`+7g2zbMK|Ki1?-+X&NrQI6fn|hRdx! zJBj1V+cDOTj*{+%x+a=|byNX4n3lg3z$)g|R$M)0Nz_9giQw_ARO&5nL#L9ioW0e2 zaX3O!l@MEW z-$7$1SR@EL7YWA=(qt@&XU4D6!3xyPWX~Y5Yxuf$3!?anuJRV|8M%}aX4wiM%34`g zx!~k5Z{Ff9#ocr>Y(BJan|wXpMfz#X?d|B$&(`xpKt1-cql3fuinj+*2!^s*NNi}oYQsk-i#3#CX%j~E&^xdlBs=G$>% zxWi;GSb|df3|^((sPMm%v2fYi(*RBrT82ArjE>OFXM7)o7TfmGkp8j1 z4`pcxuakJ9$3^3+S^k~YE=O{ubw@^=+U0nq(S8^=Jt$?eOj`8?t{t{6t$;Zm-G!U; z0F^hKo4cSYCTwcBQ~cav?D896hEs)q*OVPy*fLM#=T6Pg>^u7y|7>dzvXH>JKSS*a ztS&0e5ba8fY4v95(dtsW9<}4;>To@tz||?68>m(LWy+ zGy5Sr8x}MBEWjTxb}=&*gpf=4>ASR7fRrz)H5;u~h5jntuCge5s|U4iyl#TV2APG- zO+0`OJ;p3F!R%0;HR;DBT>0D6iznP)hSS(y!jHOy<) z9b*t&YpV9w-6TxK0m^x9!}n;~w0kXud*Pbd9xQ0Muu=L+v&E#*xAWCD z_6i=KtH=wh{A$+ke6?O@e;C!(qUnlTL#<%(ujlg687uQnQwPvibnoNc1lL@6@0(01 z^j?xSdG}%!dZBDZrR1#IIGn}zZrz9`r^ctFyHFb(WuaR~TgH@m;Yc36Hj@0&PY`8! z{92=Vqppk}(^7SgO_^iCm7d=e8AR>(J>`zD@%TJF<=3 z-t4kKDSNL|S76gnf3CP8*8#yzxD~6Z$fg;PZf0X)dtald;h13sWN3tLNrwitd6MU* z%+uvTXFWY$Q{Ra#1Y#KVlDu1$%9yw)K>3jx#Cbh+7#rphk+W&?Q+n|S=C5D~(O{onid;(8sy9f#8 z0q=_O7_Jm620^=+Qydu6LYR6G^e34W3uBm`(^jA;fpGccE&I{DX)?(Kq$zDO8pB+3 zAYDgvS4Y&vH$S@~D3%S0!%!`&^kD-VjNaTe*)C=J%(#qf(%Fzp4nE)Z~V@uNM8u|4sraY1_)IX)ef-55w2~=8* z)n+ZORF@Yj^(6aw0Ab%HHII^;qFo}Qn~IW~ip))2RC?h~C3BQHTES*><>`!g~~?s0c}&$Ejo>3%P`6!yASPKmZMqS!Y`;rN5rJk&X=Z z@GE|{bSjDJyiMIYE;z@87x0;#UuhfFN63Ws39;L&rVj;Bcqw zi=D1;(C;25s3Z8r?_NN!% zRIuRG0ZoF)xvHrtvF1v)(7Ife|>D?y{Gz-@6vi;~T_AK+pP-xIxJ`v^7y@srRQ{s+v>nf;k=l*sHG8dB)i*S47Rh7Z zcft4PSnrQ2fpoRMf)6+Blngs1eV)w@J0<7&2%k_8DWJeO0lTTR3XvrsT$Cb(K6dw2 zyFpa~Ez%@g7Ng@LQrsxw1@+4rneNp%rF|oZFatE0Jk004fzznS!aW>vAIuh5cZj94 zLAVu%4X?@+7QeBNTpJvSKFK!DCI?%dUmU0$Y`{|F`1_TCdObEp-ldWrwnvJp4=`|b z{sKA$q;yd{6^(rs^eG{;d|?oQ>cs*`za z^HY<7veZ#fq(xe{sVuKrtHrHW*~r$02n1gO8l+bSe<;@hs7(xwiSk{|8?<)1h6HIXz{A9vwT7;|-8<5y2B&)K#!>i92{Ti*}R0qljb zz;Bi1;I`ckfq&T$_)D|R>^D;x!|oa^c%OXxt2BWAjGVSceW7+qWcQJ4+?xa%8#E__6DGWH$5S-- zOOp5KUL?&Ohifz{Y2>3YKwlf}DqD)D;q3@jIwCr$?gs#g4r6R!S^^QayG8ahN65{v zLg;dmZona8Rd8m`6enCCwL2 zGxfEGOE;F1K&u_itgI|qd#rTIn63V+a1P9!pP9XlEtits1&;{0QFbMK5EZ(Qx;-LI zyUzAjZ$7Frrm81HQJPEkv1DVLt3Oz- z++B_;(cIi!aegymt7-SN=@-;Xb)YJ~>IP4e)W+6P+GcotqNH1ZHnJlwY=)y`*s;pNCHLDD}w6uYXA{wUc!Yv8|1HhGYdMW7n*J$g_JM z^@PK%L@X)$&Q(*j2VSV+kuF1PE|C7ux6*fB%LKlNq=9mZT*2HNM(w2vInHY!K5 z$#6Y&3H)5?Ml6AFH?<>43c6+12@E z=9*Xd*{{uiWx4OidoiK6;Oez9I)yfr1CH)Q1L@^y6Cu5`WXGg*HWQQ4@NQ~2N`I&? zz`@M_(TZ!$xLu~|(E*nI{*5mPY8p6YxjZF29cPm)^>_>R;vqk+f*m-tZ`_Mn^@Lw_ z>E2w~tWN)kak@aso=+q)bF>%(whoe|Sc^#SPpuRUEW3hM$l(kwpVG`+Ir~VH^H>kG z4clbg0yS!Vw3cS5$xd=tWm{R#s2IE77QCQ!`SOHOSv=MYEPP`2y}6ta1NV~u6qtAq ziDG2ao~ZQY@zdLJD+9 z>b~hT*kBry0a0GG9BboS`USo;hf7?rm0-4%yHA#JM}Z_t9B58^rKhfgZE993046D9 zsY#h>Ig~B}*iKIFgvQ)8wO6LlrL@Mp=clv9lR^*e6CG^-qn3vXoWuZ)4_3SxdF_T$Q9CX{a$u`417A~@x;q%fu4&RZD0Mf}m zyo)UqYvJyE>HfodbD=^zmD+t^(%4$E>ETmVn6?HeLUze`%^q9t@n^dL>d=uVT#!%_ zrWkC&N8uYqlQ?yww}7t}yirrsv<>~~NEoF&d?srSJj^<_6N@F9}ag^u*Ujeu=lf&(RA;Z~G<* zxaeg;t3n@Uyo1S7F>F=MO%3XI*p53&2xO{=3<_+FFTgtv(%k2q2E|v@_EBM#dgtzu0WQ zck6~dM}g*)Y%aeFUuf&p0Umt~ZM;e^ z!`=10BU%Q40xJw5UnE-vn;L-K!7E3;T{Qb4=7Rg9ri^K{NWiYuy@#!r;J888@? zEbOry1`=KzaHYc{bT6f%=fd1|S!G1i14Qwh6BktBJ#9rz15&jrbpT-LWm zNNd5^@=2&7Cx;02jvyS|ve_5ZW?ZoO?J zS-R+7Nz8enun%qPZr7Vju8X_NRo<4Xdfo~&nUdM2NDWEZ?Rjb$)&&@2p8@7P^g+)6 zXS)Y2m26q1i_4`Rzz_8+lJ;Bwk{#<35i24iQ?yGLCWpXGwJedDk&zKA*5zB@XBTC^ zGS+A0p1tM_!!9pNF)}->3`8AUfcJt+#W_{!6b@RGP+Vr0n4gtJ#JGOZ?ua?tC>#DQ zE23E?e)ZXH`A>=51c_txQsi_%@@JkGqHxp?!=9LK=uD4S!z7$lC1hsK6Oo4FmlA{T zJz5-k4D$r0>QuT*Qt+Xb5m5JmSv}>v@AL(v1f2?9;tBWIuJaytXJE02#aPX9!yS_D zbOqyP%)J)8u}e*Ot^UG+HFmSvZMVRmK)aU&+Z|HpFIv~2s8;_swyiw?YdD}omwff# z#*d?0m2TVyyvtZ$gF5A$@kJ~U^$yj~_xoHS;Sv%9E4+o{34&m<$F^SSblb0iObyaJ zqN%-kqu+U?dPMHbz2p}Cbthq$fn55$(R!ql>d&FJOQHLRP4X$3=tFdkcZDRZOaLdZ zL~%6JrPZgJ=C487S?!xy5ExPBad9UTwZ?9jsoJ}#nh+W)g8@&b>9wqygQyLeoKU*8 z_XLw^`gX=yG*h$92>=a1Qhw?h>QyCK>ai4}waDk0VWJB`hte$_0AYc z((_GlaXgn!5g+4^xHfIBks;?jW*H3YhB3#7C|QLTi)rRm3oaE$Wg;<6P)_56mdbt( z=Mk-8&hIZj8qpg5iV=@!4Tq7|5G-}^cnwonOZGsGM@mVA|AbnjYl|u1A&|7|kvfS_ zWsjc_F^leAGZkOc+~$;v(!Cug_#O%Cxu`FFTB$0xx>jCjwacHkkukb@f6%!wHTc)9l%CojxesgDJDO4+KdB)bS#?A$QT9? z3)1rtB?K3M-Lr+z(4z=2X3_OUoCh7%o=7|nxm)Z@L;c|A0y6^Rn8&US9aR~|6@67b zO2`v&ab`ziXR2zZzE?9_U#K(4F}nTRxzBWV%9*H6x6+N_nVK!gky)gvH5a>JFd``P z(uCMlEpxOW{fwP6XLj6AZ>B5jT&md6g68f+ZHm8y-i5G{#zS{*kBL;AU+RQD=66G5 z-=Q@ksaA&77+!vqLtDbxsH|{x#tl~|I83FUpNor4Cmh`DIR~Pt2=p-dD{s`D6oAYG zn*!1s^ateX@BOP&)d+GOk>BDOf)oH%c{AM5!QCA1elWOkbr&cl!@mtwlkupU_(Auc zrqfc|xA?r(j*QELM&{GcKc`6iY2+a3b-RyXPV+|N_MX$Y0A#|}E7gy}jkoaZ<}wk$ z`^e0!Cc75lRGPniosFQeR?ekzd@wUD=S^(D08lClSbxs+efV!BkO>2a(Y&9`FFN_f zP9F)zyrN@pd4H`A--j`82gd4=u<9NHD>Ko^FC9pmDf@)jO@kC%CTnx!v9e<}iFzkq ztarNYiZ1a;|6V3=a_9J?l7^!k&nU+;;NJZx$1`XVVga=)ls&}A4Fax2$k4hiPd*6( zR+7N8`n278q%KvySLwtxWv>5e1<-&l;>j}6R3_N*ozDb-xN)#;Sy>nhCgzh0V~ zzw`N+gJMdbF`HhSn9GGJ>c$qspRNEPW)Jvle%2s1S9?Rmi1LG`B%9fV&ruo{>>$XK z0#kz7+-cUQm`{*;Ww*hZ{z;i{JE2}X*oI;F(nbYj{wI=K*92@k6lu7AQROx(gQK%Y zqJKE7X=65#C90*60(P%18d_W>Zm{E&NxD`4LwRL6y58+7|GOhMZYXIS;0f39qGl4p z{TF;BOwiz9y^ZU<=8v2D!Ql_DcRHssmVx09*KNB@54L5F50Rhbw~9F}^)dJL--$cR zt!5{-X)pB=N_Cn)1rc9G6$DM?350XeT*G+h)p*G7h4Bamm`rC`hYx zUb(aoBwKf%`h6-sn~5dzOYz52>Tv^G!x_rxQ~SZi*RX#k#gf9i?UW(hGZzfuHq88Q zFgAI@eSxcpX5R5N21T==Xv`M90~Bkd4?QbV&_8e5Z+>^TtmdFzBl|)SE?ky0atHE# z%7EXCcrEN`J8vf-s)$V@L47GQ=RT14MqI6TnC-xlm1z0t#ADa+=&$7amper^`Y@-k z4K)pXjv0)y9Pg|xCWB$=f4kt^l8_V%QYGE_CZnj481f~?5IQCRE@(#Po@S;zt}(-O z*1m$1_8bch=`Lv(_WUCnw^aK*HDMzk0Ce(rxX7OAOrpxK_ATDhB00!#W~F_2YePV> z3i220$E`;6*Iy=@Z)}vfA0_TbiThFF{*>av$-*V>Gfz^+cuAka1v`X9`gC^9^U1cI zO1!`XWK~oh$~)ziXyv|0|CmcO>3XS$l=G(yAm-fR9uj~iQZ|*98eK@akkp@$Jx*&q@+PP+|3Ao#_aE5@+x?)jrnZyR*A*R8X$xiiC7$?HRcH87|1xo z#BiHiKf}F?jOZ^s=Hs)?uBUW8#H(-Xllcf^4p1eXVtJ|?oGB&7f1U{yj{YBz4h z;%o9(hxtl?$Bh26DXbcz{O44Yb$isaQt6(M1AEDufJwUDnikS{-jym)_E(nL+VB3p zTVIN~33G>l*+%x!;{Y4E%!9B^r;D~tcap!L^5dSN@uRJiii`tN;P|_AK8t+TC)8F# z`wVyWop`xXd7M&;DVe@J%q8t35|miXP%K5=WXzWjmo>~Si4hBpa6WF<;&ypX1?b&2 zF-!T(Sz-^~TIsG-8qwXa=I!pL0?mY|drqjJe~B)L4t#3?nBvuc;fGeI!!+8Z8@F4x z$BMT#e=X!fi~I&57n4_9$id=;*4Ynq^C7A#!Z(s=e}DPW2tV;FMm)k#3@LtMs&M!TDPI~) z`A~K7IVO${9pM?w89^fxlxXk7wR$_QcB60a+zi%bff@^&^QgRwH!59kG+K`u^$yA& zsb8osTX5xpbxM*K(0Aofw>y+BOgx~;C2XV`XhlR?87QBiTSLTKy?>1mH@IUt81N0W z>m4ZkmOlG~dKuAtw+*^~K{()vI*fz89dnj#VYgz@&=DF19qKK4_k$-kmcd;NJq+i?v-)gZ7$iPMKuc|D1c4W_0C|FRwo zJk(){ecQUIx^3I5`O>d3)x4j|PP;i>(JTxsc3}cA+o2hL@_kBU@9C^K$sS1bE?4f1 z2ddKu@Pu#JXaNmW;0d)&MWC=mn2(Ij02rIXfj6=;(V>-RJCaeNX9ru9hE;qhj@G*@ zf-z)ZqUB1b^QhIX4c9v}wc~FdHI;F=%?}yPwPU7!>u60AiyySkY#QA#3SkH3G%Fgu z;e@!!&}F%-;0CH-5I}GsIy8@X{1~YgtI+}|otIEG6`WfAVG>eeO$IJ2pa#vw9Gn5+ z6XxP}x4r;X(zyI-Yo+O-9kRzHkPoFL_202eC%LBDwM{ekaNDmtsjY4XUnHO08Zs9C zQl3a5&VBy7cDiT9?Xme;-q8(fZQ#tqL$}ENMk>_zbWJwxwAVXEkREW;Jyq1p*c!;6{fzj5|CzIc1G(Ae6re^InaYX^-oz z=Rmr$0s%6FpzOEMYSYy|`$P49rMVbKCE)ZM^9{5xXnr0N2@YYio%lRx03<1ulMvh= zx}XAC@zu088nK$$q4HGI-8H8tV{TXOk59NE5p>K*6*iOoNq|A#aHnvmx9o_^9=AIU()4sHWh} z)or$U8m=8Qetg$kako;dbSo|!#|B2#@N{uoJvRVis2%AImAGxduCDkK-fu^iot|;s z_=r7TuM^l|n*uUA{MZ3DbERtIno8W(&eId7yFWy^{+Oa;S-~3_i2*PYR|{q&Qn{5N z%{8$F!2Wqc`vF-Qdrx~$qSEzyomOL|3$f;My{(Bj914tGqNfu<^n9ZZT`FGQ$X;R8 z(l@wE{956cIEh{=+YdZXe!rgNyyFyKc z(9q|oO{>eZlG}luj=^Aup*cpeAiO==JcF@$#;+7?_XI@1JTlZY)X=U=&=`XZWHWA{ z417-6wRw-N(zPVN3?c zOjd`@Is(N4#w`1QO7i#?`Uy4iFq%bl(1y}_6s_T)ukay|0&>NIOuZjzl-1V{8Tqf# zb|}IrSZsi@91%oi^?w#hIc8eoypqqKiN;kcT5Eo{69(oBqrcljeB_26vt>I6zA5Z)y?%AqrH|C$mtY;0qCHLF5em(B8jhu%L7NK<&t;kx4vvO8yu2v!H9nfZ(~& zJ~O(iy>(VaGlId!0$7FSbc}K`Xfj8$SkGARt@`tkO|6SKqK|KD-8Mn8xlIwsD8?8d z<5Dz8vb(K>A8OA1tjs;ELd4*oU?tL9WuNzfE=n<3Epyj~F5`@{_s7)nkCc`NYIE=L zK8G*RlMr9}+Is?9U}6CNog?ucwW&*`!qUp>e%uHkFjdBTk!6OIui;V6MSuU}|58Rp z{Wph?&SVzSPL6pfCPV=~mgRQ+VWk^?{~&(+{qG-jhtdwf|74P4PHG0LFe&D^ONu#N zZq;kmGR^ltoHPq(#)3Ib9L2Pq0?+Rb>a=Jtxyu(-@|cab@fdrb)Qml*EkWGLfY3M! zI2=?=Acp}Jq2Uj!*n8~ZxIDo=qU8JKg{(&W@?VrdJV;CUNr;k`S~Ti?=S7qWPpE=~ zb)qZjqyO1FrAw(9J*ul`t~8^YXhzjcYfex#0~8XW)NAUCVuCD6&7D_a-YmTcS-K4Z zf0COMoU#%1UC!?>KN?ZrUA%uXqP`n6CwIDV)OUjU!VUDC<4*z>vphpI_y;P81v6iw zZssw|`gHRKapC~q`p<|5@gmKvBA8I!!$Z&yo2w|=<3pmGttRXD!kxLxmicOIoAh}X zTR(VB;bWY_*qGI)rxk(wh^Y}D;nH-ca|;P&UhsG8CiE%UJ82qw+d=GPHB>yo*lcrU zEyC=6uEP{?d)$HTCS;1|*bg60W4dr$gFe(QrD^8nzg-bFV^&yfF{pD!HGfx^>`WN0 zKjs=EajNjDfb%4ImXfGLgaq)oZWE4U57C*ulLhLc64!P#C7fYB)N;D1;Adpf2Ew8h z4Hc0B5AUFJCK8H)_9%@%GreL4aSZ7O6rfd$8oY%)V-jDUa51w7+=?TXHVAyQ6QD%U zUp5q?E}?KZAN!%#f(50(GcF*xGKX0|Gag8ql{?%N&)#;R>SPW(Q z6(lVrgY^Vyn*zHtsc=T*{xv`wZeFc0B)r(pb;n1MsSmX0u+A}>`#GaPeFd6#dsL(@4|}lJmB~lXrNw_ zsW`+o!hM6@cV9vO`n%x?U#Bu4IBJyM%V?^3Gy=rr{r>W!5g_K`!;KLj<}4rKV?x%M z!U1AZkO!|TO!iL?h<7@Kt*6P5@mbgJRYr4rHgj9AeLs8}MBwuc$WTuAEky%mW=@e! znhRxjw7Tdm2n@n}A19;b2jtO)@L)NWQpviC^tKrzIUr*i?b7^f5F`~V4qraLr{Xjj zw2ui5CEAsHsZ`#OslW~2ky+{i=d`cgm#gtMDr*i#j94__Z~zwnq4mj(LSveU9aDl> ztz1P44x?C{yvE<}(rv;F2Bv}Dq%ErAfEGG+VBM6W{EX zmnzN5V!U*r4bigzVCbOMf*DOZjFJ^|DDj}joW6>D zu0pIrAr%OKXL-TyQE}puXUEoAYyDq6qsT?}3{?rOqz0;MFU779y6cYBR-5Oz_cSWa zFSl9?>g_Tq3APYJP3%zf#E@3RG0+aox2kXweAZm7H{-aC-*SP|9^1LP_W@ek((Smt zR7Xan&Y0k-C8icA_aS04$xlSR6-lNo zdjOd}8u<4x0+Z5ysr_Wiu?OwE4TX{xntcQkM zCtGXHie+z?TII!V zcuulshnlF51i9JG#SDP!gu?F)V%!scXG&c} z{bJ1TTi&K_K4^eFj5;8#pa!L0Q){JNjdg!M%+gC0Df|^dOTwb!W8JA&eQc6p`~CYL z|1G+6{SGDxEC+#AfahGsmI@D^f)fw@b;Mz4vLi0js<}0`+Nsa&I0+9sPj((g7HSYI zRMDDlUGKs)2#AQ%m><)J3t=K#A|2>iq@f8u!?sSt2R&DVvTH{uNkz;YxQp;OhiG~e zjLF~B|CB(q=RrKCla52U=<`!SlXTZ#$L6xNtLh^$ch7>i9J=i+At0!D0d4s}WU{n=ucfM?mHS4j$Bpaeh+=_`px$ zwX>VT*_p{1mVx+f{5V=@wW*Qjvp;~6FuFicA%5(k9Mu(q^yB0>qVaJ~x{+AY*Q|JGg_* zWEO75CeLohu3eeA8vSPeo3Eqa#rOC`E&b+qcgJ8;F4WaMoT+oV1&e3y&MJO_i5#Dp zk?}&FbXei$?X03Kn70YFWwU%fPAT0a_A+82TwsFr!cF2Ch8))>ugS%ilgBRHtes)V zacyeqnsdY&9WX!&rbWP_5(tKk6>bX8FxI#>d*zA>$2#3;Zl&D@$L@ApjSpNE_uSAy zN8u*#tfGusyRy&~69m)sX}k4E{ki;Ur2}WjGC;+P8Jta@RbWBWCi4X2r<7ee*Zj04 z*JP}=ip868wd>}o30p@b7Myn@fl@^MomuMo+F2}!vkH~m`BVSfj-&Cj_3_VSe$FZ? z`uzIsn~nw6j(s096evzj`^72wx2e3s)yy@CVID76+mDyKt;Kd_`Tpa6i&x{BbNVrR z^}F%$XikhGxQoI?xM}+=SVmecU%i+D9NqoI{ePM_GspxIK2kRA80*2SXs^J;5fEgb zl+?JUoXyp0WsnkK3g!-epsKO$32-?PC3ZXmpN&a!iK-{3CPhB_J_M2<; zyryw7{JkTb*e4|_&QLo|vgaX&PWMchyz(n;-bXFBxAf)+3kblT19$_6#9EJ2tkFUK zs}y2^tnNh@dDGj}(3&+w=e%1du+6LF4NR_@T1_Q|y-ho?NS@jA@h;I_fP zZ8ID+%dQ|{mHNstR4ak)`4A?4s3v(AB#Edq#4dicDm3AY(|!NUn4y4a!*cJll*Bz6 z3uvT!nyJ>!vLV~}P8b5r5IwLsuqlUOmchmzpuySJkNq>4k9D<>){K^M#t}vPfWNd! zWD8O6V#R2?G67y@UB1<&6 z^nSBXqI2U3BsBac?d$!BkR7`JmK`2PPuDf7N9unzjZqbF-b3AVCZpNjDk<9@YAYqgf9?>;=miV=%)eGY#;;5 zYHHMuQ})XX3zjC-4Cs7~5PW`0A%(pwcX8uGlcVl3WzaFiDuCddrV_i$i3or|cP zvBBIwj@Pb@-@7-tP^(^zr?13UuhwR!s_@_1z47Y8#I>2Yc5h*(axuZ43Ro{WA#1%F z-E0Cyb*udtu^l&B)fH&J4OU3bFy*DKt2ng`(0Gd_#`IE4`RbmAI31L`@KNncTUE0R zt7|z?aII~_fr_5v8~B-gf7ZB>XQ(gvh^^;5LN&f0^$0ik+1?Q~EIGDBMgacp0hkC5 z7U4ACz{Xz#eEzcx9CV1b5xC7d$CAq2Y^W`#PE9o$dZ9wXY7)5|B#dBbgt~G(;rvHmbvp5 zAmP>Nwh@_E!5sJ)_FL!sEjVKu3{Q7t&qAkYcVOzB^&wIMaC)$lv!hk0a74<@5H?g; zJ;Qz*IrL8EY;(APVGF1W?-_OtJ1zDu%zcp~pm8QSq&1HDM5@N~zIM@Ld1@$+Kh)>) zqJ87ayFNLx1gI;Z{(-a))F~)~0dt(Y$$369Q37kbPe3}nyy ze{QdfvS$ZcAT^cHcyAANqZ08mTEKlxJOGovjbDKFsN_ci5L4p^Ou`Y7&!fti&IDSy zU71k(upAK6h3`_Ym&hchKl&Cfof<{ycB|7Z|Id|5v%9k7q>9O0-2R_)V>~fo=QA)Y zZEtYbv7fA+9oHwdk8V;=VPRu4lQJoio>F

WaliLm|TohxtBWXP{EJ#GDhMCO)}Or38JEx0uruAq=Fz@x@NaWWney|404t zE*D|jHec7Tp)2UDwCX-r0DixjG>R1+TMiWrJHZkhWQy=TPKLXizcIL4~1E zWK4wFgX{<*L2!%ubnu#wapz>%vX`BvlfP~06bGn}QLr0fwscb|kwK6H>(ccrQLVoz zYK?-*U&8t-mCB$W2GA?J(PLbG0o~Z-vWb`CUOpN5s-*g1CYWq*|TB{J}FmkE&& zKtd7{j%!&FSx1IaBbjt+*h-AtPNjzucM>BR>uxGJlIeLL>eANse3&JvzwDuIve>Rg zBixi_Xa#I8qJ(v3u?vy0VIR}0P2i7(+%Wx&J5#+{gH+RC(2Vd4#fgMhe_CY0f#&4BeLfs?@wPw9*H?H<7)g-smr)}_HO2N|D4@Fa9g z3l(vMgONLL6l)uDk@NmvpU!srum^R%wQCpobKVRSTV9lX#kpgQ@g3!6-+18aMy=v~=@cKt#@(#)Qi0QO%` zojdb^m*sEU*`}!Bz5XR&K+!2+rJyOrIK+kWWF1w>sUcJayjooWkYM*80WNwu$H9wN zSpf`}W6wb93~5en?Ah3a`37(0)i1&zEE<99f4riYsLW;3Jwl0WEcg%?p7vmdkHsZ8r_QRP-qy!a|sx(z4Fn+?e+K0C3-MAat z*e(0WyK&o|U}Dsm_TWA4_#P(qAK8yc`VU{O%qppbigF33P)XLrL|f=mxpL)NE7yI| zmkLf(e6Seu)4*JyTs)*S8KBli<25WIPd{O%>)dhxQ!a}?Kx081jWH= zD;cY3mgoj0Lo}I{l0^8KM9%U|R>)jHH}^#khwUq{0Q>65W1@UQePJ6v0k0q|o8!K2ND5mRK4a1mYVVyik{_R={TM4 z%;VwFD7amTrnl&_35AEw^f1_-0x7;HFUR7fP!75&lmjEjbsB1)Qq3X&UTppkOI%z} zP$(!wDMA1)O(OaksXZJX#Nk0zc>2ZwAQT6H=-~rE=bF=vn$S)i`BE?`u;LmQ_`MG^ zgz#$o%ea{q;pXv9_cM;p|+JA0+Q_tgXjNj1*u5-`=b`t|!RtFz}? ze;o|8h{P`|2GJC%ajNrZHboKADoZ00JyRQ9GWQiw=K}`Y*J;T!>PntN4diJ{F=UWx zGSSb>w6HDS7q70~q#e-|VMbeK{#wwtj35Wk*7U8?g7+KIi5`bs!zlwbdZczobs4q&@1Yd-JY&Qf%9 z8L8}?aDHf!@wmXCJ)cn17m`?!h@7Stq%ITfg0-Pm>W1QvVe0bi%mkvpOH;k>2Ej`T z2&oDBe4;UBPw>GEwaTbpA?MSQp%EslI_nIk$1c|tZA-V->7itmgd_{+jFHxy0KFg1 zXA+X7PV3e_I`lxsv4I;;1@(=`y(dJ-2=Vw z6C|0X4;OusgDrAPxSnKEO=Q`IFHkJ~iDKhV%aK4h5IUbp&UfA^SHnitle?%8EYWr5`vStoM6~KDQQSR@k)8Q5oN&;NOsxpvrM$&FZmj4%B5? z^vqP|)-j}ZK6_Cr>>dN}FRv*T*lHjch@4=meMiwz@pgS9U^}oBzT9E0Et%P!(H@j# zZ9`jhD&0U;kig4kIW!H`2Z|Nu;Q~ zuczz!Zr*>#W;CqtSSjQtf88w zpnjj%yzR5T_d4`yDZPa05&Vgc4MA8DHXp{vGbk8A?U)lDts1aGp3;eJq*1kF)A25J z|8LJ47FX+yTXhh^$SmIOtn}uv{Bqs)z-nJp{x@`({pmfQWXd;mzq%Q7>SdnSC%r4M z4ki!sEJc8K-enyWtIbOw$^387M+XZ2L4=#4*$$)Gg@?-R{R7@aqrCmTHHB#635K_+ zGJEp?ra(s6sb~D04fPz=?1rG1jvd|f3D&@hx35cYbG4Shb#0lfRp?Luwr20~bDGZo zg0vYXAX(F4wo`KegY(GomoG|Bf3p~ePh91*eputBe1UE0*&Y{<_IW+9W7cuoKH0?_ zEo1gN7B5PN#f#FasssIEx8L)glrY4x{N#WQu_@#}_xmP}{+@@@D7ebjPbhJ74%65) ze^cS-?OFqzd;+E7w*fw8hhD3#2;rDY4`06(` znlaQVRY3vt1u>XQn7_w_0+baflA&t!?K579bN)l|Mt1L}6h?iY)+5BPpWjtd?f<`jn35HTwNAHA(*U8oHh} zGFea2R3}%}uv=ci&_Kh5ReHG#Ey3Tw)ko<+K$*Jq{V#!|;x^@p7G7D$)#MeEm zOY6AtTi?*IeD^kYzErb?8E~e&Vg@{`&&`9t;LY+Z;nG)rn=kM02=|T)j$nRqnF{9k zG#U;D1JNNg4WtrsAw2gT^rOuAq0l*JIcdzv=07Gxb8;Qzvv^J>CcV+mZqWA)y72FR zhqHzXRJ&3W2K4i5l)UMi^KkMrD*Y@3-;uHTSMYb%hhwUoO)KU*@Oj-Eih5}jE6M6# zU)uiS@+TM$TDY{sKB-Abc)39TrBCGWg`&fj7rC|XU#Nq@;6Q0r;CQi-wFN`VlIpLl zFD3YYr?n4pxLuI0e72ad-j~UIGwM(s2RRVPg&Is}4H;$ecYmb{T3tVMUxCO5G&S@s zXggH*HbA4LDit&D{RLd*?ppcBO?33;c{%4azs!W}LXCUc0_MNS#^=AM;@4NW3(t;E z#C!$OHS~KF3Wf(-WGgoF-7f%?L4O_Ck`sE`4b(hGR3IFVw3q*!6saM>2}Ge#_=Ea- z`;H>wONI^y2ZnvZ&|#nP&XN;)+6~k^M^qpjjrx$G1*eLI!VSpx5kto&;sFN;+s@LF z;83_lY}zzSM+bd{o+T&rv>T{-j;KIn*pGL#;8eiSh@bCh#?p-twwWr92K2NWsCka4Ks40g$nyb93(gXC5b{1_X}?`V%#w~q2K~a*(MH3m?L6IxpLRnv z&oT8sKgiMW4|lW+4rVt@qULc@u`$tT)zvO8KgDvL*2lR&L*wySKe~8v{8B%f`qwXg zzl~$Q*5kXGi96Z%zS=^aNA@`U6JzW=CX)Q0F|WrWDtU#qkNphQC$W@&cnEnJR$pe8 zPV)Sq{A{n5w^q8pReAvF+brv=ux({LlwNL>w|`>|>Uk2Q<5S?frPnYg`sF&yNcHzU$e$poqLLC{lKos--g_X94N)rUSm^4S7 zrJq|IC2blg7#v#2U7(_}{JiKl*xu!+4E7mNd_MXa8eu0x=xA$wNwhg^Na?W@uKvi~ z+`5n?%NI1t-fG%sxV|PS*_&wK{BXUB+?=>}v{(gqx$V22FixVnSgkEHAI zeiT!ZnkpsxZBuZ}39K9$d;r$Q4H-Oo76RnHi*W-t|Rvx?50y;5QN>iB9d9v})PF8S;Y+Pgex*PW zSZ^z~F9;U)qb(4!&-0b7_sE=_ z>A@81afKkR01x@t>`Y*MW^}R*cy<)dj3A4<$>p2$YWX8t%m`=^;NCjS(>HhF#K^6aIl)2oqiX|gMoUYer!E;xq; zI;E&9IvV?862@pcK`UYzN8L==*+DhUBvC$AJ9>KHV(qk_^}0%`Uz&=I^+dWTk#6m+ zN2Fqj6zi!Tk@kqx*F?HN3<9IcGOK+J{=zoV>9F9eyz3dFjK;@5;%2Y!awb3x6P%>P zZRZ79noFSY`Eax$i=$OuFwuAs-1$F^6W8M?6g=;c*wU=q3kGukxam)e-RvsIn+KJD z&6n?Oum%o!P|9tdiJEuC!7X9#(`o@%bJ@T+qXTPF*2~-F!ozy^1#6@P`2*(caJv43 z0`!n8L&JsxX3&`}ohUf0IRhJl!MbDZ9YVaIu*rPTTkk*I`^w*vAO2}Uc2rg0MWvlh zz;#u(0CZNiUmg8p$7Vu9(>)%Wfu0o)AQJHkd{l5qMdrGCP#X?TfAVdP8J%X&GB53< z91=c;UFTnnj5Ic~u@%F%BJIN}xOcC)bz4+m@<+th{LT)MAG1KjCiYc3;W?ZKA3|TC zZ?jhk~ZR4)^Ygkv*8_SLvW`iwl@?GB0WPA)fs<1N;w^+{J~0H z@dvF4p0-on9U9m0ywM|)Qxb`<%>iiC}0O6BSnz8Q>3U$;=?ludi3I&4(AJc z84=txWai=+8Xj=XY3vb)8)$7RneOSW9YPyz=#bH)4J+#5U)pFxyJ$RLjBBG3%Z!}Fz*4hQCVG?m-JK*{cS;itVj9n zLOs21KW)szKRg)e9RD7u#lJDpt?7+01@Qa4*XVboIrF489R(I~*n!)Ur;dHoh3x}4 z4!2-33x~v-d0{rhe{#U4XfWs+@)(W}(}0;9&o<53U!}LV`zB(>5-6c231Izm zG%+@M&c6D~e`g_P`%31>Cq8YIcJ4y?9eo@WF_};7o5Zpz z=@($AI3+7IMZx(TO^!`5P{u~b0#mUuHtocGJj=vrc#8G&70F1UF)5Rxujz%7SVChd zEGgjinK9lhOv z5s;^vll4()1GZD^WeT`w3iPG}oJdb6%0Pj)O0$^+CZ9gqE4_7^quWNv&LGF3S&%-E z;m{6{*px|grmcT9GkOpC3vD~=XAX~JtVM7woPE+wWY{g;yxk{oR(_dwQ~p?w@|`JP zaDhcV<&X6!zx|Xy+HeZ(rTpz2%=X>c^#}b6F2AX#|1+(?Z?-q@r$YZ@QvrX?E@+AD zcf@@gHs|6U>ngIE7#sB$QMFF2_DJiDCDz3rY4u2}CHuVIBds23wMc5s&h$vDt4Ry~ zX+c3VZ>KDHwnNAQK-fe97Bwi?LTM0>dc6fRykD->ms4|Zena&%g#WA%7R2G~ku~$_ zNBh5(pA=akaP?``MW7J>Xunv_{Q?2Rqy06y2o(As7Ew8$1OKyG;%yduPsPTLRoLc^ z$5rdVt94}KJ!@?ns@5x4e$4Szele^1`zDkGbj=FPric=NTJ&=)yvf>s9$TQV^x#!L zn!OfBq4QzbwN;W%A6i?&d@d_%XAd=3IA;%=vIm}nb^~Ti5_%OtOtOAf0-JY0(az(Z z>!pn~*SPL+jG^+Qd#st41ss%5S01g`YU>^1rVwl1+JcU{xA$!1!kYl|R&Ji+rfsHo z7h>g9+K(z5uS#35O-f{Vx_g_&=^x~ein+dos^|t*3}i@Ya?T_w`g!GtuK|0|Y2c}O zZuNxXd(?nS!A^~ZDoTKYDtGfoe?NrQ8g+BX0ds=`RN7VUA2JSqyMFZMJ)qRqID>cW zK%ww3|DrjCqw!&ICQr7YZ=#t(!2aL?C^UFJe13#|Wp@n_er$q>?-A_8KXi|=_?L0k zv4ja1RNCL7at}~h`Ic_`)p6!OPx-J|ditKFF@T78yGAL_Y)B3=*I^aF8JDHDtb^j~ z(*8D=Y9J09(8&(ZoV>zXXaJBFMN~t(_qe>UNs{9NwqE(lbgq4_lFt1Xca~=^vy-QC&EA`crM; zK6a<5>^V{bEs<5ULSOeIXy|SAL;2y5fB75;b+c~`eFUQt)=R@|UuwI&=w_^kzV%?|-Sb7=q?Hw!8SN!}8m_ zjl!$a6Bagg2$N0^c#cvXxYaLKwS|NFCNWHW^Zp>#PZ*%^S07*oP;`!R6Z922yN)3M z)w74?M_;krtp|nDe-x|PV4S1i{^vNNcMdQI-%sW74samHW&;v_DVFZ+(6jj4`=jC} z)11sxby}g6gXZ|E}C_&6v4 zn4jc@DmjBHR4%?^8)g7mbWvc^wEW{H{T`r%3EO+$P>r*%ytDpU^{od_OK);!9~s6l zTi-{N<~2wJtxDU^nS6 z_~fnIeK?zxsIH`8Nj^vA0lVc2>n3s1zt*UpRBNSGz4JcQBug+ya{Tw(Bq`tSM-Z`N zTu$&Ll=`^b#p8HtYOqIDsbVeG*w{8EQgYl~o>0ygOm8i-iXUxNa>dGnA~OZdMvhMpOZ&T(d*C;c4$82!hcQ|$YXibn@)wP!GQ6xAo49~B!vS2b5`^-fIb-J_KBikf+AK#2VL zZ`WA;Q;k4OW4$TI@W(qG9R2wVwIY@_`0w&mId19W?xZ?hjAZ-QD2 zc`&1|`l(a&=4iiI*|v~aAC#eAuZCivAPnlv&cR$As%zQJ2FB{lJ~%6jk-5a}5gyZ5 z#ZXA8sjzIuVl>R82BcY1FqIIv;WyH{T9})AJWW|}^p3#=G?@Oyj)3s<=;mYia93aWr@qsgJw`BmEJk4e zY{VsgFc2EBWkRwX^#C86<~4ZG%xto{xoi$Qc3V#1RI&jxub;a=?R5kkGCxiyb3DAD zE%*Z|!cSfYPIZRO1c3NDs4YhcUG$!ApvuE)QuE8TO776iH-qCeJK)tKI@Od_$1q_n z22npU(2OiW0(1+~^s6i*EQ|c4eL$$DxLqo|Ua>DK!`&M20y;J`@Na5r0nvOu%(}U9YyT|HZb{{gbdCMxCY8i>PbZQvjNx$4U zd$Jm3t|6OZ^=SX~Nyz@&8ViuYfXjY#b^KyKf+?3gg%XksA!t?2x;AsGtt0LT1i#Hw zJkSjtLfH}(b>XO44gyK0rI#DPmkp%aNT5*3ux_T=T4-zF`)Zb}!_TcefIM{IEWJ29 ziF#csrK}$|lsi;obu9PRDh;y2cJQQ^8}^u=m6cmfpU$%?spjpF#*PG&1ZMsyp@j7gjngwD+OAxwQtdt6b>BuwFax)EP|{HZ)z!KvDOZ=WGuN@rxE^&>rvW%gnolAExOrp6o6k9$YB}FvSqd_0gATu(;Jx5&|N$uy@3u0PoaZewqvLNg`)ZeP~-ARhK_D6zYuYOSjjd zJs*@9*@5FFruFqetgtNCP(H~9Hq<6iIS;I|#;%m^ZXXT*2uk>>FsF*LkS!;QTR@b#T#M*+Y zgr%fERF@I)s>?_y*pOt@O4X%F{2S=^DD)XhqyPT;1sWI%1qV>yz#y8EM$h%541DM_ zf^Kz>6QR~|%S`Q4oO0MY<yaiI6OQ|&pG@FpYumxQ*Tk9 zqEp;UA;GaF);n_~bf&)MCb6I4_tF=PlEeQeGz5e^Y*MmDKWuTULElkwS4yl5zn7|~ zOs}QEf!-l^+aa6RQuUals4o)!gpc_nkU8h0TS;(MPYhkm8d;45Vo97az=wpUv97PE zS`x(*DUv?Z{K+QIC86qE{R%ZiLwdw~5@^$-SH~}g0}#gz_^ByGNN|F>eI8gS;+E3m zj<5c@Ukb=!=!(3&CW%g>?1LdaTj$qNDA*qi_L%n6OzW2-x*pShI!rql>@n>}F|9w6 z3VSU3>9B05KjKTKZKhfG$>5x3WMj3>Z(U^HYF>S37s33}Z*yi|0qV1ip}-v0NfKQp zt7x2P(lSFbwVim;+2@Gy`Z?BA*&)Hg)*!XooV1AvrYwKt!bzVExMrS=*t(P7*$wdR znfWDwC9)bwR<{$dYUuR9QgUARntjq#|MEr*pMX;Rb4W7Pol-GR+UihaFYn_!Zb?Rs z+0Xm<)*K=K6w)|8p&5{$V!B4xr9)h5$0<6hW-Tahhz<|-#hs+tkc(C(Col z)$$xZq2__}!Wr3SUab62)==x^+kcV)D) zmxtY1l-!l_s+WiTNgQ%754)GT+DobFnv|Me>S`}_wa2s_#XTh<$Q(_$1^PN9~`~OwIcp$J3YS0S)E(yFRx197f{3c^r*_YJSzX1 zFW=ihp-{N=E?2pK2<_R*cW*;uHHzW#_BuK$Zd+Z|s*T;?qh~Lwjoo%iuZ#Wk@q3k> z9Ab^%wsWOtJE-z7&mLq8SfO&RP`UdQTCJ6~ilwLTZLQ%PQPKa$zg?-Aj0zCfi96^YP4yR!8@PNU3kDv!6gMNr6!ffR13tmQw-H{ zsRg#P>odA(CYSVNa86OuNmcmr(+$?FxlZ9PY*QludNV)R{p^EQkCILE7m~azSCwfK zEA+$5N$br}Fj_Uhs=xX$*|_gv2?|Fkc>@K5=~B79M~RyQ?`)s=2>5G&`9`79O|7N+dPJVzRw>vm}!^cbe>m7yzwjv6<8Xh?M`(f#)cdhUl)~$p1 zI%g%j_+@S`TKayMUF&u5*gT4M&tJ8#1OKTha_gOmH8(K=Ut{hNmF^tS^P`J=BBHSw zUMjs^D?NXT#!;#GtyuI#1_h^}*P&+!O#=gk&2$_1Ggv;%ibYnY-(AQHg~A- zaP8XhDL9NHBZH0(;OhGqRyxfAe4==3r!D1o@8vWMfbB;*No42?t(RBd4CbPPCg!4p zJ%o+5>QV(;@U~bsL+;9(bO<`^z zIKnYUU-U574CbOkT+SKvMGte{K^v`;bG;j)Da_gATn}^2V9qY*dYEelb9On`!<=`} zSjNIYW52T=##}KLjz&WbJp_9=JFzR=^>J$E2YY1JB+4L(tcS9uP)2Xg7H8RY9m)nn z0}WL$J(RhkY&bO1V@%JW&Ce%Oq$mEHMp;k%H;uBM_-`6zJ@MZ($~sc~!#^h$VM12T zg_Ayuy5-|UYz2IO7zhrAl7s~D{16F;!UKtcp`nprXb6)e9tx9WC>)H=kIZ?^(P^eC z6Uu`g^SkC=&^yWP(zs!~MIaGeM2Pr5o-lL=aHTr_YHB|bZZRx1^m@UtFv|CTrN$x6A+($9Og%|U{! z`SsF+ckuqRP5LyJ%EYsvOcYdi#_CiV#vy6t(K_7&U3cwh|2O!XC&QJucUa1Fu3Ay~ zX%|9%LIX>Hbj#Ztlqx8pIoELu6zo21e%p1)IKFGF6K=tjif|~{xxMAXf=4p&b{-?c zja^xM)m`4ldTo_wBEv1V26{Zxdbpg^8u!r^b6BOTG)#qGThL^rAH&)K$}+O)leiD4Nzk72b~D+3qGBnA@3==VrxYz?j9kplOJ*A( z))U7k)FRlfCX5(?6c=K9dS`G(8ZarCh1o8m_iPtxy@6m~W zT@Y=f6L#^ihPAAMgq67*toh{H5uEGMA=l2wI;>nr^bHKv99HEY9+sbN2B5=m?w0_s zPzvz=)UEJc@#PR-&g#L>mvh*0Yus24AoNYEx)Jzu7Arc7f<_?E@{C5ei*P{Ify9Axv|Fr|$^OoQ`H&dArjQ0RcbT zgAs$Su^RpSqzEFJL}~_zI0~?aj#L09blGW`Q>d?din2G z2YXnGGFUmsoTII3T|OWYEtsD_?2r2~5U zqEAe)gDNdAk@V2u@J+|QPb~@8)?XbkwSn@|;YR7_J>ZhrYjGY6*nZ85g^RDt51zJw z@&&tX=tWBA)tg8oGQm1QA2VUP{8;#I1-l)_Qkt43w#}YC5M-;EF8}nt{A3FOEj*>K zisizZ6()KKBkHVa9Zb8n=)yh`?5hnJ@p=Eyd2Ywf(Jw_Ref#Mf#qy)Cj^5-@X=js_ zloz&3Z`T?^QUC=f&HuLtv4{G{6%d;|L#Do5J(1& z-foniy$Dc{D%*ecs%eIriISRgAwENVDa4m@-EO^>Yzym_?`<3v^MPRg{lEt&@SK*V{;7M#0Gll4&^x)kwz`ognUjhbfgS6;xD0i6(QI&V|1$geE6Jxm-2I82J8BY zswJuUpb=%kNTD<_h{hYY6!J%Jem#cGjzXX##gu+}1?rBe#++XvvK&}a)D;EhXq5_I zS8_$JxR^s3fiO)OS$KH#chI~jjj}V)&FksBannGRjg2xWKe=kh8!E#0`mIY2#AYGS z9(%y7UTD5U1v9l*A8i6{mLE}B|C{{)fuCRAuH4?M>Rd1pa*M9Q)V_Nga7v}Wd_`}S z%CmLz+VGI?OJ@z|yzf#qF}s-^SdB8Q! z@(+jQ!vdr1>bH5vqNCz>=I`KaCUn)M5Eprjn5kNwy6ZI|o- z0hv*NSbw4dhv-SM@?^u-xv6q@6Ef=R_fH>3zh!5^jyOwAol_0n#tZ%E4}lr>W?&XC zP{ckgJ@^$>9_@l8GfA5N2&Ig)459}k125Q<*MNrrZInAWjROmoHtU(>Z|{$an=B#j z-*@;W0*3~Ne)nsN>@8@R1=`eChvm0<^QL5HPp_kwUxOp5b2w%auH=8c#^j8JBfg*C zD4IaqeO3CtfLJDA4jNrid1j*J{%+~zI=iBGfacjP0w&xZ>mhcqM(MjY4-&>G!&OmL zu&N6mz`YE-@cfYKtrm}hjtG;NH{ix8|GW;02jyV6nP1+nW90g^&2KP%V!pj51(+!7 zgt@u|&q0o!>hztQ5mCY3di%{)y_51b?SFoPx}`AFCl&JbmMZs_Q;xKc{N%S1V||nF3SizG6xJ27w?)@vxjFG=wS zQ3Joc51kz8RYR}AD)oWFM$d}-X8LUkJz%q7dQl$IgRn6eGgj&23gyBYXd?W8z+Y5% z>eT>M!}ZLLrTiZcIstzmZ|>f%Sw3`&U}nN*zk#vy6q&5zfGPp^z<WcVLlEe1)j>FGqZzRaGLkNfv6D>eR0Ra9{hFxh507;I@*qkeZ%fp zs%*Tf@Ln;%*-bK4$7yM^)A`L$YxE3Vs_?WL>t*8N?etDlSDAEF;uo_u5TSpkJoA!QPmiP;NWkl{JcmF z8zxE^TXWHI;*mK2c!wo5Jz#g{aT!pLH*x7B|Gm~sPE9TFz``o@;O}q|d50+qW?S}c zuH-%kU!}#f5XP~`ASk!jA!KKhXJ+k~n=idMgfl2T+i-a>i((#s_M?0C&u$7CPdkJ> zxu66^hZ3cksgWx(hxCJd<@P4CO{m(n^%`oUE4Nw31gqLSN>O)&D zhbb8v6E!+l20J7iaBIb`suq8tmNmsA6@%Mfv9w%1g@N+uXA~RY%rE`z&~)`vtbX+# z<_}c9{cGiJuAdzPxSiRb)M|$yPcF|b{n{vjDh0nf+J8mmsVQH~HJD=-^jwGo{r#}t z*{<2zqPoS=yRQ%hmmcUjFmJd~YkmC{lS`In&2)B~3dD$ps$0|)sKv9^cPc-8&7Be- zIBUz9 zw#H!oHE&6pU7PaAXqSSfqGlSt@nu zS}gdBD*t|1F21tImH5%Jz)M49(Qf5ZIr99V{A}+7H<}e2d%I3m8WvojBnC&lV@eK- zdRe9oJ)m5{9*)~Aef!wT?|rt%_tI}BkFht|HduI%Wel@lvBGR-%D>COL=RJ4r!ws4 zJ+4-oyER#(FR4lM21*ixu;z%!P*qt!XD7iH`m$Q6N&;)mr@7DW|vspi5`NDen zS+4x!1`8Y)zpaH+Ybn?LW_-x>_SNO7+47Dog^y)rGYMizjE}h%{2Z|v78kJ*oF>k# z(%FOB{Ws1I70F9hQ?hUW0`{|=Oagt=PKKs zfJ4FIhJ0ia2n1Nly&Q&fJ; zS<38Fs@3c*tTCY z&+4eSS#uLNiG$M=wd_zUcZY`}@^o)DiO1D)a1@q;OO|zWaThu1zK64~qC{AKMi+@9u3;?$N>3f9wQF@w&cwzJtEkQNCE%}wtfJ2rzZg~ z;S|=g==uWIy}7AJ1RErV34#g`bP46gv?ZLBB=kqTq%IRf_l8)()($0GDH)1(&!uIk zt60yXIG)RD9xpDzmQmV-A)qrDIta6l*b!{!$VAfIVj*WP`5ZSb*p#7)VIV;?Lo%|i zNri1X4#hSOZrlT zrm>Eo%Ft6fWHcz)X25zzAx3NRcH6Cm&8S3%+mi}0(~A_04#KG;S_JF+SW%VLw3^ieuJha4O+r_3S_8i^mgcjv zj8oo7NU#c@Bp0>d!h&0{zhi|SOW{HBj3y}y#PE2j2-fFyfI+uF=paUQMQmnOQ$1cJ zf-L|=)r?d!qsrY^CCq7$fPnIgia@{gajKQQ&_th33-m< zw#n9vh6EcHV_1__Jw}xpB}v?LwRW@3A613km@`@3n-~fSwiQ-2y7I_SOEO>EA<$WE zEtjK9$X1q-(WM_!1|uMr7HWp%)fx(!`|s0V9P|U4qnERguz? zhOSCF)>S3xDP9{5i;l!B@#VV&sZ;>WgHO`X2&GwlPV%UD3%efWT*OnusAyQQ;iDT^o69DaBEg_r&k4V=rz2`amuO&3QUe(oySk*? zO*!LaIY}YJD7KWsE1nYcqG93jk>#$`^r~H*BwdFl^`3AmIyRC}uNQSZC zQMZc-wnG>YH5j^4y2d4WS;FYcf9}fO%#w&;vqWbA&|h|V25B@Ry0b4%EG=Mz=tGe< zYd(&<6>J`a=vA~Z7t-8Rn0CvgSt*^>P{13T2sRN6SX;fdlx;~ZYP+S-B-V(LLYK%Y z@pgem1e+Nt%52L-Gt^G15O73{=-@>rBgw9f(%QCD(K>#1Sz5waGbF{=u^MU(Vc8>> z2v*zq(%mS4#<3z1c{+u?W{X7xYw$5c#`+~Hg{TnfAQ9vS%?cG9=pxo2j^GKW1A^6e z0AQZ4-z6xGQIM&!j;YeTNS3_?X9ff->{M4bm+um!PUEbMrV?XV@#YK}5Ul7+dRo#+ z26v}w7x&mjH##8LqKMgvs&ldmIH#V32n~3`%1f6a+D|}DJ>aj6lXp9enii| zOk>@^2^fglEpm=eE4qTUB-L=e;Z(3Ou?P?>asawf)=gn;35{ko#cK`6fasd+VZL|= zQLH0c1lui1J&{_$+N}{k7g>$1&JisT%Vgpt;f;6%n;>=oI-G!_f-Q+zX)dBkuJJ!# z38GQSP>8PIpn9bzQi=+;5$5>%D|G!1q9j)lg3}UF=2TCE>7r4=CPH=fF2N>MLP!!# z5pPqkqEW%7!D5=O{INX<{e@909gYw=?bVQticVwF&DFb6w;R=n0?jk8|M%MCF;!7i zZ)S<;iSt=qUsSth0v;RLD4|)&@HX%_8WkPh000c5TgLrDiEdz;_lCT9J4K89f=Du&!pWq^rXivyoWuHj`3|BaSO0*O%1AVv zp7VrL(G$+o3vBH!LFjcIr!kt46}+&3yE7@82l`{Z~BUQ?SjE zOvBQ{-O@rLCX<`Iiv%^AC2y*Y=vn55no6YHdbV_~os3DGC_0h6r4x%DXg-JOE4F-> zQ0teHk|2tK#tCG@XT7%lkBS~^Zo)Ah?-IPmp?{}G8WmkLK1WyX5;RUphMvVs5{fNJ ztDuZ~L8#~<=4reXg2lU0o{pt7NjKC?it_z6mFT*+TsqP7&{J4XNgXxx!x1ZjjhtmE zVW`^8v{xIaT|NgH&ETX*-V|)tq}lo!T|Ut*{awB!guYJED|uPcNHV$V4Y8sJa?t+* z7@aEg9C0Mra+$(Q3XV@)Z!>>7ZdG*oH`bPJ5lsyT!)}IJyLsoDgwx*GMX+H23y-UF zFkO_gO_xZbiyEd#8z+k7%`+f+r36z7+?nU zNs7sfngs1iyhj^!no;4P-%7SY_ZM$hHo}f||T_Th{z0r|i z6`rlnmhTegWKFrz3|Ux^ygJuJ&-8}-LDftMx&*E9>?)@AW?Yk&p(@2=;h*S<;W~pN z8jQO2qwuxlb2k;WB{Z#i_OFW`G!EH8s7fR%aXS)g`x+QFQ{{xvCu*IbV7>gVdL|%8km#au;MEzH<^{F^^~Rh&iFrH z&&yEY=!up@4-sFm;0Sa}NyDs~ou`Z$lPH^d#HnDb#9$BvFoU2=uzHn9&=*KmlQQvE zD9|H#ScQl(ZCXcSlgit%`1W#ag8qs*jD1 z8C6jvf-cI~@Y-yDQ1l>jP0c83OQsOFTLev~Bw5O22oxL4tR_6UnFmGBAjF$s`ZuUB(g2(fQ>aDlhpy;XNNohe+BxSKGDUgF25{gBt^%RzXl?1)$VQEuV7_6qe-h+ z(No!_Y#M8kks+^pZnrM<1vXF|FTs!@Pl1v_;d8Xj#XE?B+@KjH^g>C~YwglMce8V{ z$2Jp#q6cYPU|hnTq-i>0Mz9W^RhATWMG0i--+_5e^>YbtOqS3LPD584G#mS`XX6vs zCcf}SPoni~Su(Jml)JLS=QK%bDw@y}nDVPfF(`UUw#t_8AYOG<$vnn}2Sv}*hPZGb zMbh9(>=tCsN@;ZCpYJt;$le@@q9<|3C&moPO-yzYHe<`uxHl|{ZaBLvCDrVL+?t-2 z?G~Z&6oDCL`gB&ycqLQOWBgLA$Eu!TAaoG9IwD7OI#PmYSy@&CiPc1QPI5C>+s&bu z2((r~6WZ!cG!5{uc+Nr5!?@@8 z+FgRsD`XyqZ!9i*Ya22sdf4|OnNRcOI|!kUh!JeKT)vgY<0{cF8*{{U?wqfrU2KkC z&d`ZFiDoCJreZVRh)S@1GMk3~&2&0Ni7wivYLup~x)$5CTO7sJ6pCX*_2w)PKKENq z>9BaG6OLe0K_d&QhUqV{TSlm_>5s^OX{*t zGOO5|ogjLMH>Mz@EC@OXt&X@6tmt3CQkqPvX>w~4YY7R*eVL{#dS3RISWZflk`eSg z&9mKtNm{`$OV}$13D&kHJ*BR6%@pG=B}Gl5n1b0fHc$8ztfVstOaQtBsaMIeq@b&k zw?R*XqGxThLZ>5M1S{_uoRtGBk}OL&t*c5vUr}8P56)cZIU+%@eomm3;=(OI z8!$6CnOdRJC?@MEY6hph6>blT9&=5>P=lRRzvTwaq=pp(T~`*omidSthpmwnqg$HO zjAb32b=o+R5`z7pk zaLS;zhmScQ6g_MD3f9w-LgMriaBZE`Zmx`J zSp~(VWt_yiM^#Vs7-@sxWvobgCy|gFG=I$M*?Bbi&%C#MC($FMS7G`2g>1*R(RGz| znz{;Y=JXVnJq5|$l=He)!Qq`+7L-f$>Iik#Ukt5>@6x&SGD`Is__1L9a z^iXY9?<22Z%#YWW2Y4= zfKr`1Z`uvCYpdQ=IMMT|<<(n(gqrLYA3eP%4G7LjBuTuv=tR%5PHTpuCA-B#clGiV zx`K(G_2`}xJ;T~a(8ZU#WqRBw*5d88$M>6GjD_GZ`tNrm`*RMcxKH@;T0E{5+b?Y97_aA<<*9 z`5fn@!64{L(JIL@8cSg#h11?JEZE3_&S1V`eG6|L@-UNt;Ga1eem|$GOCVb(lq7u! z9NSQE*d!BZq)gYO$kL_c%@2*u1q z$rQmgyj5+{E@ za?%nfLlvz3WM0zr55p98{y}CTev5vP`u*=hgTn*tsVnq#XoT7r);H)qjNs4=Lrv4q z2Kd+bQs&XEe72A^*q`h(4tMo4VEEb(HEAJb`_oV})*o!WgevRwZIh2`gkeaAOr{t3 zA4xSasYyURlm*GOWF+VgB7;GT2sst8mvd@zmA#<9$x{8u_+S4&P)h>@6aWGU2mpFQ zYFiR2h!1og0050#0RS8T004Jya%3-Ga%F6DFJy0Hb!}yCbS`*pY%X$TY;)CpU6P3MIEg+bj6}%JT4-AI>xKV zV}5tD@7PmDRLdo=*jrWgEtA$Wa3uS-WE$YV`tE)G{VV;xj$eIuL-mT;?_YhsID&Cs zeHVQ-6vplaGoK+O4-gJlzWV){wLs8_7~hdqYdX zKI6zAaD2Y_wNY63?E`}10l{$La5?_^Q=zO>_JlVlr&Dpf__a|~s&$thKujM%++Xu! zIDUWj@co9-n(5=j{do`%!=42YkH18a{$C@AzeJGyUn58!v(8tTgTt`r5u{%t_|xYg zgdqD8!Jp2F=MemPci=5(=?7(X!dNYUIQzA}WPiMQfuZ;SweZZmem^1-E;$?S;I5$DO=8jPy~}0QlW4d|T45D&+o^ zpfsEQD?xAz7_(u_8Zb>j_NpB<-EfchvSzne^WWy9#tuC7?I}pc&!XVuQgqdWij$UC z!yOiH+@;0bT^q=IO&?t+RMv!Ptu$$wF~FcG9$|7Sa$Yb2O7lBE{TQf=r?VGR_oh+G zfHk*(2e1h4i;>3p8}c|@mH#*jI; zZ1IWx(>>0`5AYqPfnv?JZrvi~>DkK{>_GHlAbMVD-Z^IlJGn`b{{edUomDGMyM|Yb zxm6m(E=nrn^yPZ!?Jpk}Z-gojkpS$^bC&%fLQ85`z4)K`96O!y_zyf$<}Oo#TD9gc zr|$;<>Z{BpbRZ}VS% zUi{9=#f{o9xd14OztJs4N#`tiF_|CUUR^KV%QdTpr-)pdrisUOek!GEwQ`CPCtZKw z2_EVCO;xn)1=TpM^mP34wfGUF=;F#4zLM^SDCtYmmm8?RI2SrWNme|ayqK)d$`7;2 zo#Zd)%OHWTyW=-VLjizX5h_*+9O|Y;5%x*PFSl^6wX({>kS;bL`hN%Y5vMOF_tU%i z%|kc@BX!C6 zrjhgN?B&|>SGWq2hHq)*qIAk0ZC8wR{sA)o=i`UPJ?OLmsWveajY--B*x6?IDN<8+)87%v~E$qWnh)N85T zLpQQtE(MEB$0|ICeWur!h;I!QhQf5m@fcJb7VwErQacU9x6I{wIBs`i3m91%W}lRWq4cAUkYP9us5{Ii$_z*or3m~{3uG4nt{jS0Lj;&2K4 z5)b&yn}&H7d|m+KYfKircYE>@{xZ^tgl1a!9P;z{CsAj?1w;UqgFnkWp+AS%YFcfW9&u)u2QpL@)tW9X+3YyA8?`eVPOLD5RdvHiD>kf+ zz`?>mR+4#y|5>u!!#L9BJ}1hRIgnBViA<9rJ(JL`L$S-9_;M7VN!d0bF?sNZzHPY2 zqb8n2js|k7rCyQSs-f^N8K)=+@@=|YCP*(U5aTfh^s{F#8vvih)A4I_*tjGpxGGCt zL`OD5!a^RM5=5U*iVOq##20)HqAw;768qbt_XKgDfc`-$e_Qm=mZlEEtDx zGs#mF=o4Qc`U&V~Cb9iigGiZRg(O1qIPhi-)-CH%0FY?}pJ&#yJl3FX0@A z{oEER3+KE<8PC!glDU7088^$27@@u%6k+s}F$yCz^+kSbwq?S#{uohNYsKrK zHHcNr?vhqdA?PqXljPUAquE5ivoiYW=H@zj zL#t-!?1q67pJno7N`4wTE1BqxU{nun706pygBU1_6Q62%Hf3{W$s46MoV~7wKZ_1l zB)`Sc#wE@@mKT$w9pCWI^*kCzcJHDO+}MR$E|#tc+u4%Tg8V>1MK<~EvP1^1oE zD!rwmHis)C_mRtVhChGd_4m_w%8K!%%qL(Jz+#zAldPt7k4uyS8k#0l6dzRYYx8w^;B+_Mr+u?qev`QX?G1zMlBJ4Fiu z5$q}qP;+0f=@hCJ)ciDf?@WF?Ulv=HZ1~R1-%1X{&z0x z=$GHG=GVkEIwaX>47_e!r!BJTISxL_VO!^ckr|nzUK~qqsQJ83%FTdji@yEnXt<@NZMKir@f_0b;80xI`iJ@_^8rSIXL-m}qg# ztFK}FDO$C(JF3~7WAQpCfgO;!g0VQ=V8B|WmqRBvKav|(H5>&i6u$b+Q?L!Yy8T}q z`Y)ed7SVw9E$yWh%%Cuav%vPoP18F`JjbCqa$jNJDOz5pn)fJXw(#|bKE>L)e?Fmr z>MJljg{s;crngGr*lI3(>ExLhhdvv!LD>-e%sK&6uVR`rIYI8>LfO!*XV*Kr|m zh%8@a=_yoA+eU2->-IP_R~B#-sNV28&QW-_c_80{nocr{CC4c+ub>fJJq-%1`Q_LV zwW7b}c8>yUAlZU$so`SHwm4Ele4Q*Gp#>fgB0-UyUii*!eFT=*s$U5lOj`u9K>)47 z5iT!$4f0Qs?#YJYSX_aKcuB!Dl!kE}^XhBg^9XIDmBL{b_>Raqh01EK8zdG%!0U2Z zDj)-J$k*v*bE{;sY^XrdzAX=wsFd7FX3UNo6b4M;JEZdzuF~8Hx+N%F#XJryFmS#& z3P-V+U5>w$X6TWI0qVrpY5oLiML}j&8*si*2-!R!3;?bWbXQELD4Mb4)5~7CgR3-K ztvHn^^lj$rzj_Lo8SoZWgG1W-+H0MHZ79XTwpk!KzY?yRm+2XbJiE--a^Ms#VACD7 z8i(PP2MjM)N4!>8JemN@stvFn@Wlg0 z!U1UX_Lq;>z2-|4lbZ)>&T86nFvk@N#!d6f6I_GNWdZ;jBbatgZd~6A93m}{LtcXt zzGGS?V;oH?a$nQAM|ihv$KjqhHXXA-!dLCWV4#!rh7sChK%9>Q48eZT> z72`;l2<(hCV%>KezQ%wx_np>zf|U!kMba5O3kWPO=^ct*`dPpjg!xoN(;i8ga1m%u z#Wh&jNfMVRzy?|*aMP$Aj&5*ypem4?mK)a59!Z+SWwdLsvsTnHGeNN}S_HZguW8E+ zDd7XAYaHt=_Z`miCFC{LHJ3QlSfG?~z$^AKlAQHGnZ?>2L#5X1(<~2$ZF1Orp z9ChwRpi%FdZuu>!34Vuyb@M<1&6?HRR2D}-IdBrdnk`$#*IOJ#!&!)RnP%<2Y7~k@ z#UhYdxn@0FL$SiLzz*}8w@Vldhd9Us4b#`av6d`%H5y0vvRCec^#tzNH5^Ha!0hto z&06&(N5KkNpo_rTfCbhf;)N{GD|T&q_`cbo5MWuL!P*9VN!uumgckzAugwO2X~9K9 zabRB-sK(puc1Q|_vcQ&&U|i#1fIufxu{2C?aWHEU=+hv2ZVcrpQcsFNluqpLh|9Of zfHe=~9kkP4OJ-5zNaO)s(9&w7c4&0LWgn~sX6-jPLSKObp_XpqJ#A57EykCHYfD9n zBf=2~E4NfvN?RP;;er0ZfR!uK!5}E)z$8!{1aLRZonv?>%htDJ+t$RkIhokDF|loP zl1yydww+9D+t$RG_dk2@bM`q8UOb=P58b`G`nRgPx@+}yb=}ofY;#`l4~vS#OvZPD z2LYfH>kphTHNZw={wfZ`c2>;$#FuPUY;;LA4oDS+c2W_>YNXT3IVMHT<+@dNq)x{E zrr{SbRrbk(p}^JzW+#hPDMfST{(80nA5WU09_6#uFhZ*XP3d z-jlZ-L}G^#vA+<~Uqe{~@dKMIMIRm|o_sq_!p2te4bG`hrp0Ix83!cW zw=OijSEQ~g`;^~?Byxz>E;w$hn&?R)KHp;OjTKD*+YMV3J#vD;#{0ES-$?da!pTQ+ z_H?FQQN6Wo{mh9}A{E1hoSXvjooy*_!8^wd$! zlmQPqhYX1bmd0i_7*uPAil$IQqVH+GAVI2X?WF;Q)wV-_>JMy5UqU0dswHuUiPgkdYOUB+dW&Je_$m=N*4nYS!Ee4WliG8Vx}(ObZ>K#!iJ z-0K-XZRE;2i2$}CFbg(-Gs-JO5eZ^KBwfdqa$ZqOcj6UQs7r_3)g7v%W64xP7gxlL z6vRa|;u=P_o&*iu#V*IL#$g=#z6?iW5RLh!P)uuAA;BU%+cE8$R3x4jT|Reqx!eQ;*85URjuIfA)f zq?Sn$tj>Zq|AHx9g)t)ErvR#f9(-KOZUr6&J_C~bYz0D8j|ER1w5h6`IFN8o^TL!e zqW-ogoF%E*P9TJ&G7rk_!mkl`Hn^D5<>&3sI%^x98ift(??1^TKr-5Qh8m>={n_Lz zp`&dVayUB*q39UE`^(`(VvczWMwGkvaX+^fiQ^Q5ISg4BKXR`BB(WRMhuv>d#-*h= zGV#|DZ_|r!$_&3cO zGs_~X2p2z%9D9VPL$u+Y0{89tExPK8*=EX=#xRD+6}qby)&!}nLeBBP9*tpL(3 z3fKn2EhZ`IBD!Y2=-VffoIV%$=6-^N95NIYmsCvcEJhgBk@_+AO3=0foRD6FF|cUV z6`FoEl+l?4_wA>bPKaQh^qgzV2tUlGE17QXDi5?Fwet(3QuC!ZCAdI@+SafK;pFUg zg9<2cyDj2HSsSKGQUFhJk<>yR)Zpfk7iiRQ{Do9njRt{yrO^GRYbm7O7t*k=3;)8?rzRxz00H$hrqPsyI@SXkB>k% z_C&Q9C7uapuUr zSqZNbAw(opQX)RswWx_R;6k2q z#-qT@IGHI=c+tMOhu6TR2?-T-*J>;%3`1rm*9S2rfL2I@FOLxwCrK#eI>KU60kO<_ zrzfDN8#a)r8%>>H2oY6nm%5DfHaHU{I-KVqqg2eb3~@Ip80w&w!@NX+>+F=};rPdl z1Jrd!WVwi>yXq&U)kj6yCAp|rOz=h+&=1Q-@L9cG)j@F;U4y{99n_cpjwe9OQu8Qo z(5fJDrH|B54B(a2nVL@(6tpZD$3*1>Z>ppNys0r=L=ezk*&gj+TV>G$MrhlpdhtL4 zZX$3xyEVK@dJ64?Y;T2$2U>@;u;qz@b$;HRgzsort4)-Q!(Av9EGZixCSa_p7qpge z$4Yuj*N(><{?`H6ffl7NtA5YWoH-%QUQ*?JGwW90dBL_uEso4<;D(bVPI=lV5!WMMx)d_CBmw@xAK?r!1o62PI@kBXD(I=$b)RbGs2u0XZ85@g_4 zlu)yBbAN*l(TMPN=F)RaVs=i;<>;6bulwW%2NJdH7amTXYhV3Yi z$WdPS5@#|o?!}_7>o7=q^yUC0hhftk{?{*5D0IxiF#gVVkJlUg5O)bL$WyNg_f)>L zi7$_j5tnmTQEqcfgVIAy0oVg)oHbia46aV&n$o9!?IPt zZz+&GlUe5qzqsz=zn7mqB3e>?@G=Or4c;N5(b?}7i>=X1|6rHOB9$fI|Dzc;3Px8z zv0schlANCK6@l|z^A1Gnu)1>x#p!l8Q1j+AQlpoV7&RsZf0mq}>C07fi9!o$ErZE3 zp8nj%l~DeUfL?i7aj&n80}|ioQuq^|;Z&SRpa8tk#i|GwP02uCegC4@siJy7u*UbT!q>kukoz64~v}?8}id zLZ+v+3{qlgD5?p5Nw^qEGUp9Xt*yR38U1+xZSHBnWq7MQncb@8H?avM6)}7s9>|)_ z@ymD?C9l-vi=Da;q;qa!quDIA*8;6v5uNj3VPM%&naN_~v4~JY_4^cRxP^u%<6sl# zD(GOB;uXbgo(6>(+ZT9+@4I82z9dwp8Vi(~-a}p9oC3($2#{lHI9>?XM;b8%kvqrt zan(=}ia7&nd4zezeS3^AP1|qRzAZ11ClR^TBvRPz=k%92A87*Su5!Sx))xGiu&9x2kjM|)%w=r4mqUQzYrQat;jpGiO! zuzF0p#v43q9v1VcxW^S^q`8!d5senhm}4RlWSquMSLM;JQM0|6L|ZcGLuyMDSt2UJCm}z-X+0m~_8t;oczA_iZeWTk1vUfdT}IWDd2Znj#;(+`uMs0iBK z1u+)F;`~{v>W9Rs?r$6%h!vOPVfUKOXdhqL8s{&ZHC5qh()%w6VX!Xag;KTcM^h}r ze7f0cduHHyZW7glPrd~3-?NoqO-m(*Uaz>gmd|Ni#wu%(i&w&}JbY%Bk)mH8V%4F? zH@J2a+_TW~7q8;ti?Am(@95&bmTDlNGEY$wPg50U_nAPntjx!cb7-Ak65N~_EahE> zoaZcGje>e;XxcdOc-?(J#)zCseAc|=s`G+pxFp;R&j^#IljqGIS7T#Baxm-z#_paJ z!ZvGCZdS-3&#%QzQRpvlcmaVV%bGwD8x>yRUc>Hd0xfP`5@Yb?p0AJpBoqRadCkt3 z@OI0iO88**YemWYbrC(kjaIODE2^-r2q)A!`6&(<|2^XN$BaOpx0AAlel5;fbhPWc zK(yvK{;|T%B-LA_8sZ6GpUL?b6=9y7#DUtm`^%{#W1>c4dh|_26EXc zjdw&YSxWsE1SUI1o|?tzxwll%o16zSc z>#Y=Nt1tw9F7h>%^4dw8u8fU^?uD6 zQNZI&d~UPQ9f~6PNFE`;;UVRZJCP?3bAbu$>!K{kCU>34eU~`3ofU0_7FuH5HKd7YU(Cr(niUz6)t^~N zxoGmT{+vb5g|I#qPvO_zWMK0=5%}@pm}9rAi(BdX|<`Xt&@$dlZoTsxLQZc6_+FKgNEy2>=JbO zoMx0OespFz`r;eDr8HS;Jp=Et&3AYdcqbrMs?#OgTq+G^2vSn_`YQYL>*x;{of6zK z7~l7uHuNp)RCevrE4_jIo5-t_3gw9dz)(Kj+VA2;3_ee5dIBs$bYA_e9V}bDas|&H zB1YDa$&}10{hAh{Wkx9c8q^z#unhOqr)G`0G#F%i_Q)rDOuD>yckSig!vrjOn)L32 zy5(iIsSR2F`4FPB0b>)9SDQ;)-P2cRZg|~Kml3Dv^`TN&Euy0``E7-51S(}wlDVog ztCSKg4buI=Y;>*LE^4ad(f0 zH*g-LPOPvjwKUg7CN>9$c#>Z*{{`25_Bg&Tj)_$JoJi&c{p&r$L{G#_0=^vcSK3tV z9Cl3iZZz{F6MBh?<%idc&wc=%&q+`oo9t@Qlp3vUBxQR`!O(evsN|L!miLv((%N8k zPX?Rrq4e(2nzz7&z-PP|x&gnj?h$TDb_Q%_4k=BRY?jO-=0WJnzU=MMoyqr}*NiF`PcnT|1QGMU3e%JK)0gQNw1** z3m%B$jVsYaf{XT8l~~ozin*{lbdEJn0_S@aP;iY?mVqn5=7tDvvIl$aN$79MF>}Tt z;2x)q^OrfeD-6j2B1J~%1OxnYXE9;b{{_~CQ}1$KzZ}9~tYaPja*&0EW0G$l1md%^ zhml_%yFV1IYJuzQO=aUsCjr9~2mCK zZ|BIKot%o`Je7fAoAlu%#aLl$fr$j9dv7kr^uN41t)et^~q^5I!e=q z4Oeu~k2&*6^#nA9t&z11Tl$>%5_8Z#fI^b%rg9eO!#Dz}J7yU4>1)d2*4NF9;p}~I zoHva_=y$FG)j5m)pJ6QRyx()nN*0~WM@@%IH%c;B>f**f zy~)KL*bLEGUwY?hr-D+keIH@Po@If);6`g-4`&d&2~V&_MTz(HJzfj();~lh)T^R#OUqq{je>D| zoIv#ArD%*bP0_XOh~&-Gn!LP)(Mb{Z3ib0*@p&!Jw~p2MxR@!TRgPk6Cqp7DPcZul zWF|&XK$!R`{wEiTqvATlgDuY^0Rv^2kLLQYN;j29AAVZ&Yuiq*4Rwa zwBchR5TDu&S8of~iXnaTnkh%_E?jv-I-n7LPBD?0?tu*Vxy3oYfWIqLUN?(eh3kgS zP^fbras6;hn*2Wg?l|6}5i$UEf1d-DpZ!e%E4P&47SLjjT6I4h_Cu3K7qL=^Rf~DT zcrcG`V|HZS^jTE6jo}qePlXO4&gLqjtP1LQB3%<(Aww=$@25#h|431*;;XXztKQB*DnLR{k)Nlg= ze^XsE$xS9r7VA8<00q7V6{2bbc*7i8S+BB#(S(Uqvg(9YyN5a)0u1~Lai6ICD5(rj zS_X14o~|AI@@IekN9vcJD4mi6!;^@bOgag=5kxd)VG7KW463bo+)Z|dma#Us#L6@ix(97HPP$-4{mO+?JiV}!e-_9!|TzJ z&I9JmogGMBUxBFN3M{!FULc~tv`H(hqZXQ&RGH{1eP#;e_7cgIeZj2^+E71Py}6DH zmML4QjiN~4X&y~P@ccWs$Hv(k03>mQk7fs}d^CsDTKnx2g|_?GZdZ zI#*L@qP=%s1Q`@CDUjOomVox#o{S`IzFt=QEE=kLTO<&qezc?z2koHZb?h@Wc{Ej? zgAxmzc%)y?6HmP5s>5^iuHPBWDQ^gD$ja9yH5}081}H!DpAc5hTP+p&a@{)P4B?he z;&n4vZW}GKTE+{GcwTYCN5S_rWx>ptpBXjwYTz98qWhS3y+>JFkGV+|+pkyl#N4(3 zP*;_OyjmT$yAuQ#FZfRP>GV6{_NK#g>g89;U7O%3Jx)=rOGh-~rarY2M>u7rdt^LC zH1)YV+Ut*^!fL<_NYc0UIJ zTOy~a78C9B{K<5uely+7e=uE0dE4dU1C{(26(jp6v@QsJu`pj#ZLb37DB(rZE|knq z4cVn*U_yEQyyh?@dO@pLO| zufh$|%U(*oaScf>S!(K)=_>Uy0m*t#$Pxf0B}q10ySM+vbl0Mf3DIF<)}_*y!r>zW%_TJ?vXHsn(ZihIZku{I*i`?A=7e* zj`lA^g!kmB$w;%Fm$Zjj7*lzyehq!ky|R-`(yYB{yw>WPD=az&r3p_o7OkfjVL~J8 zjqEAPoEI3lnB205h?7c1&Zab2y|!oMb-mJ(XDypyN~^~XPJz~L2aR6+>LaWkj4rF& zP<<6|;$H54WT~m*BNb5V1T!ue_wSGx*ys)5@tC0Vh90_9^1XHicTZ`)ygj3IY>k4w zWg_;vu3Rz0L@R>`L4?56dW!yiaT9lU5Xn-7Ul(l@^zpMfpi7h;w#qiYqlKQ{CQ=dZ zU2xNbA;cb()AEIsnXi>p8f*}R9{vD{23f$>9p-|WVn^K9lAn_>t=;DYKSXB@C@&WB zXA>ag$y5Egw0^0e4^OH!O~pWDsx5*EW${jPGaO~IQXH5jW zd~mC_eAPY1j$6N-gVV4jm`E{HeT@YdKA=FAA<2lmFPyO9+A_}(DWVc+A2P_x&CZ$9 z4rpC&J>r}|QM$e_ZY!2uUzl3ma}Fzt=pY@nbM@C*1q6E8jK=GCloV$6WBL!j0ybU`f3e=;0u^HEgkR`5*?KIeU=K#rSk9 z<)OmIU4QO^Rs;akFYc6xz$GNjR~)eQ#~#H)<~6ge<$doE`3~A7t%Rne2^Ijure{BT zfFnXl%K*}`%1k|h7A#2#LRHon0{g&OCVM9+;ZeCk5G{lZn8WBjhd_UWDY8J40#W&7 z-mVjWfrHb79@GC#S+!rD((k3soB-6>yrCQyj}|E#Q-eP1OLB%}aQ`HXleOVeg(eMN zT+a1QYRAG+vZrJiZ;K>D%N!wA$vo4Q=A_tpv zA6f`MQmSgkW*-Hq6fPiuPV?%IS1Fg$#l8A&vZ~)#!BfGB%ez6l=UDV!@c3_-*s~t} z03AGnSKri`%k{&dG_;_6LkSJ$gf4gmR$jm*om_JFUzo;wFfo(VJ{-gf-Hw0U+t$d9Qfq0HaeOmgDT_{ROSrGMlld&g{$b2(S*joCz ziVd}>&#@)yV9Yd26`@n|fWgme`a2FUP$2q=5pD(hf3n$Ckd5g?4bAXfCARDH`O~<- ziz$*Y@^rh`t9p+r)O^M`CaGc9_iqeyBZmDMp_5L~Wy?+prjB7&(*&$H%P#q8Cs^>> zvff`$({4r{Z#fyf?1sG^KQ17bw#MWW))FTc(e$V?E&QAo-nb^%3u{;wt}s``d^`zK zA?hpc?(GGW{sbssc-n@gI1Mx|6n8<)hKAJ=d>kFSO-M_BjaT^SX|)`|lEQR1IW08x z$Q$>aRmIrdFgvimA9M?evlzoJZaD&s`UeqCj8HIKjL>M1!0R#-ta^c+jmqM1E4=cp z+kz|r=mTQav+SUsxXy%^4(A@`8D%LGNmhXeW=W+TN3wzr&5CZ8dU8>gOoIoFuaTo+ z*d8#|B9+tc$Bx+GWT_@ShcSpVMgh#fts)#;#8zpSvh9zykYt%Cj>ohrIA5=$)C%I8 zTL2RLFkuQzqn!%qUSXeNi01~{Cauv}TtpF))G4~dgXVu|Q`w}rL>YiDl0#v@li{PU zVD}lB6ISHbqTfIrO&#>$8;W!dM7RX1-6&}bm&^v0KgqTNnBv?#u95xlX|Q@F7?DW_WIOlv z#BGkac4`MS(LGZ6?-via?rK_?$Rfn_{+g14y1PhEr0Ma&~?OFt`mn%=;by_Gb-bQ*KI#&lbo5!iAbj zL6H!i;N`M4PL&Mr9GuZDfy(Fw4)I&Ci0RKB1ub+71?4*^Go}1YprNm{fBB}cLb`%DGX_8q)1Lw zXl=$`82gdG@Xfb{Z))&ZM&ec>-{H=hy@X4f@TBf?1-I;=^!dsVIE=25_T`7Vo3RsDxuH-Fa zQGsZ%CCxmr|GzU`zW>a0JN{(4R{y^--KF15cj`YeUCaLy)6Mz^)4ls2F&?cjM^rIPj9mDB12mDeQe0*p zgKEuK5Kb_JHbayOZnzFs{s*Qj`v=o?m;00H;!H67&2;(y$#j>#ha46acFj&4DY4_~ z9b>^-huc<*aalT$rivJxkaqpd@eG4T`JNSgF?4wEH=C(Kz1_$js9-m#~n2amd z4Bscqw!$EZrD=tH{etmi504m+=C$50&DIS5fq9Wt?Wo@(%SBl%FcI1X9U`R9BaL|r zz!!T~nGi>an&E#~7(#Nx)kd7FOC0lsbE78>_&%XiaE>|Kneuw zlIzS2v{ez?WrDd5ua@v5>>vrDw^z?9tuEP!!67g=c~0UQ>$4#HPOGnXB_;qK(nJR{ zURw=z24>nUhz%U2!ZU^g`ZB-7_J-!+O4Ol0l%rYJ#jfuIf>5$Uwl!-Z$I5|A%F*ju zw`z_<+h1!E_cB>^*YBcAZm5&~#4XLAieh9=rJfMGrQXWvf_vD!rKgSGMHq#8D>+K0 zcmHw?PklCMxd`3pnuAGLT0q0j+xh+%)Ac>1HQCQ=j#?9Kx$C}`7QJ=rKKo_Ld~3km zWtEl(_)_^4CE!R8!wku`&)?swsHi8ioXth736fZo8H^a0}5 zs5FE^-iXqtlbE2rsQ!(5E8H%ofKJK~WUq0(jjtat#~*909U0#EnI+GwI>_8FFc1m? znGbOg$C}b`t#1LbWX|AUzN|!Br4GfXV86m-6UgXgeQ&}{`b2*9{Fd4dzI+Z}Q{Xm| z#VLO0eiuVdN1Uc93I>=gO&(KIBa*zbPi^AXY*kTBo4drLO4C#)QWx#Z^Xf0&xRRts zNF}Std_MVentLBox-{niRpEIgaH_8LSFt$5B$cSVg|Fvpp?9dUJ9af*g}ucvWetuy0|q7TA4w2KzhyM7q`s>;p8m2_Q3WpoEO0Z5X%sZJ0@BE0 zu>g-5ke7Nnucm19GO02VtsTwOUQVQ)ICEh$p!0)-H+Rn>ZdO89R6JTH+Ix76t5nE& z;hK);%dEx;sSLmDoIT!=IdjxUJgEiq4Q(voPY1|#XUv;W3VKK@CPMac{&6OG0H`KC zcj4LQBnxUQ=X1^AsCevOYhJN>gnMEP!tV5v&z0>7w^WYm56AUX4$f}|%Ql^p_ms1+ z73U4NnzK}zd*2~zWlo5Py=6HD41pgfC&irY`w`pGdKtv+w%hIXAxK~9auK^J$l zft{Xvsh1q~p#44bU=xD4)L~!8yPng@Z|c=5VmriTrG+-tb9EN#D|qz2dOdc@a6k4V zq=vMGf3{bKgGbvehgT0!OH-iyEUgwA^wVwQ4Pt0&*UFr9h$&cQ7P2rIX~K*%*L2un zFFJ8JfeKs$#Zg;>`Qk8fQi&xNH*{7GDj;@7M+WZ*BQa+&GF1I+Q0d$ttVo~yf-}O? z#+eBD>WA}Hr5(99Yq5z(*VfmKuWe}8(WEQMGn!VfKe9dDm6U=+2^Q^<;!Z^dE(kBx zPH>39Q63_VZowI?c+~71!gQXoG^49WDEw>vfP#Zw)1*sC%|(y-<#T1S0RHL9DBT}a zm-#o<#r;ineXmLzyw4&ObTD$}u7(sfl%o2Zq`XG`qJ2c%4~_|E_}f(ern)wbDLm8p zyO~N)Uj_II9-)$JQB~kC{8UkfWtZAR8Ab&yPMQF{kKBo>8rwca@0rPDWYxV~IcCWB z{KPlh)_2jb+>pJ)L>LHMO=h*jaQ5cu3a8iWq_`8#oO|o1VeWp%S!pYCCM_~Ljr8RY z>{^>ks6lZz4Caj<89aOTs+E!WJk9!R#EUB`ngqTnF>e z?(k;Ynu|hUk0Zp&F3LGZ&Cj#JbzqShS(dxZTdwJr3Mlms)e{3Nis(;nh-h39pvBC3 zY7=)Y3IpAB`{s9$XPg^csa%R=2Efn=wke5nbx6tcz_TP4q633U+&uA~v#6ky@W~P-|>d^+@Yd)1Z1v&Z1Bz;y!!lk{XH>aV#gn;wBCtr+_+LG+*Jc!~%00LU*0|r9*2i3K4wl*|zFt_>oo9A9+PT1^;q73T|GS&=Z*LE)##7YP% z?2|;USow_`PSr`rgo`H#j%KB5eYZs5qW!KN*m?fx{B<1moQ9SvHHohwjgW3lN%5#!-P&3S-Ci?rVjD?M_bunAM`#4nLc;-YJ`(@ zXM^r>m|}7;fmYt^GWCR88M@Z&<@GaWeC?7LbN6Q=++)dS2M34uR;_^MLWVgF=C+Yy zLYQ`B*AyP=3RxONSo@ikKmxiX%u#J^WnEK3p4adBD+{b!q=b+B>R%}=_G3EQK5h0R zJBns3=!6rT(B+qL#dYGLD=hGq`eYGcXRJ-3R(sCA^MHc@whJwvtipPI6C3o@LGK-Tc-tF z{?W=xWu%%bD7DO_3)6a+GKTxs@tv{mK+X7~+KGjZdppznd-`C9$5tr2?|naWxB9`D zMx8DuVUMA%3EjlyI%DympOk=SWYR5V)Q_q4m5(#s{fa_rYRHbmoI)&WNZpNIT5~RV zpA#e2wI%Bl3TrMhHJ^1Jfs@XJwzGnCT$NT0U(Iz`%Co~E`|k1aG8v5xn6|RwP!;x- z%yrLmH3o=K=UmrYOxgPM6OXIQ&dhd!qp`DvO)ZO~i?w%$Uj~g$clZ4ZPAcPykt-|B zSM?_ReA$=_3L}pN^4p_Lhq5l{+FcpvU+fiqbc@NlrKgtCy|~xBTstY@CvS~AsZ1}f zs4Jl9IVAWekU@5j`~fS&2Xj=O^fc173JSTZY(m?zuB zrmekv%bMSh$4;(=^_4Dnr^m~;2QppLbm!FGds@2FqfoiXyMqqa4w#5HKF;r^!NrmL z4w|GTw@uD0t3wYa{LAcwgAq!!tQ->ezh0k_hexJn`FW&&B%MGfFS)1fQ*4nDO5Uxs zxg4`w>k(X}@NA~=IA^TBGZ9q-w_0+ zYGkIOA6a>6p7~?4B#ZnL@AxruL5On=-Pbq&7kPVcqSGk6Vt92gxI(yETpT zhJOkjhVlL_z#jjtSDGgJ%hF=3FJW;U;iYr38XKp^lDd4A8K(`G!T2LL>~U$ez`raw zQy*f}BsSASSu`%qw#D)D}sydsR8p%O0H<%nsHCS)3)g6Vl<79d(q>&KfXl?kAHhjofxN; zm_YA0G?lQbBKk2tPbwarYHn_)J}xa2_$4(p4Pumug$^DeGPTs)ZhQQEAywmbH5~7C z3uwrv#1KDc>Ki}H%Xk7n2==$|J0*+K91)jkQDLtE6AK$WLPqL4H_Pj)kri)~$)UV# zU(I)dzwY1fI}gSR_180C_e`7T06{xQB1h$~4K~efgi9mL5W3K!vY3`WlPWb3VrgV3 z4ExN&1|1h@s)>V#!3sE!f>}|Kki)dJRA7IAsRa%mH|vrs2-<8aXRg{t_&RQy4hIZH zS4=z0w7CzJS&>Vy3|d;L#CJT_x!LWS96$lX0r|oIo!|C!Zfh5Mj=VNgk++ta%V%^u z{Ot!gL6#isX*e?oR=}hG%UTn3^kxv;agVS!@%0QriQQ|t7 zLHsSno|e`M{KM%Ph;^wMG$Fzqn`d#lg3FbUz=%iipQrx!ixdz%;g-Z)wt}75;dJ7{ zY$^V;B)=~JjTH(|rr#F(wDuN~ynPG{6Z_U&2cu0keu-f4`3){h^mVWI$NLgJ;krp$ zHHYmSt$F0|QsS^xDp_U9BW2)A;ZaV?USr>CRsSyFR|{L;pZG~f4Z9On{oFq~*1Ex3 zcPpQ2&T96@Fmku+(3hO?7ZprjK13+rTzVFq)h_|bPMxZL^UmroCXwk6N_?{;QNuZ2u^)-(hmV;mf6&B+O6>M$UwTNiTDniVxAk^t%#`M=aJQkaQ(R&j*1-$61B2omAYKeA~A^ zZ>G)vu07!JAb(c5dU!yDh&iUhxnZe1pLg?UQsyn2uPUZ+XdA;ywS5%=?fCp_P}uONZmB{*IuUG(ZFyvH>Ef-{N;fsw&NG zPuI3}`D*sIpyCfMA{O55r@$g}@aYAvig2=-6*M^&TtNBpg-g5cWo!n z5&A1Qn*2-^wpip@e9wby?oqopr}4@_(i*QW9DfJ*-!a+rXH4D!1MWR`N#fCs8;Nyp zYN`AW&Vf6&e`YK#^k+0;Pg{Xb-1C7p7JnvyJiL&@AlD`c6(UM>>lpS5LcF}Y>UMeF zrl0fbbWb;x(Bkc?;x!$kH6QE{!=7j0gB--GMqhNn#}N2Y0Fq9s7eaB9Dzc<8JNB^|BD?3b0#=NJnzU+q`r&j`$;RioMzQ<3vyS>*JKbd;Iy^CXMwJYyabq zHI|8+&f5p+davpZzB%448rvz>xj&Nc0m)AFoyIYfj|T>0*xiFF^CHYrm~+p2;V-D3 z?;U4;&OIGsJ*wq_&I5U31FDuG&I5IF1MD>6&I4tD{j*5t0h^exN>%)`FlWGak>o6_ zlOK7lLVgkXm5-!Jy}9nfBk^LfbOY>N|E3IN+vb4LbKpBJT z$g1%%0XysJNx#cD6Shalx?Oy(@A5Rq3e!h&#nQu^MAme-V$XpgZq*Du9BWnEclDDR-Cbyyv0o%I>(E1eA` zv1t=);`bZjogx(GuOsrG*D0BQCuaO?$qo8O6V90UeP$Zqr2r!g&g57V0>hlt&Nv|? zDlGh-!lrY1>g}d+o&F7erE)bXGzuQthMj%CWo7yMk*SezReBV>gEc!lWz)(s(Wvk^y;|8GBPHBdQWB?wWE+IBi;#HT5_c*2EAyx@q4xQ=@bk zmR`~NTAAQfz~{+tx9vaOKK^tI`O{7Gx102`a!O4pqd`TDx1Ns=%da(=xT6!1m4s@x z&8tk$u#(4fgjR!L`~H|cQM}^+=4rX$3I4Fn{|01SlqkMB%JCwHqqI}Kmx zXt=I%)_u_M`lPv!sJHL)$EW7slYgy~Id{pTf~i|664!}~i2t|;4TvN%B#r>|a$6e} zCJA@~nhz-hfqJ{!5^%}7&kTyieX?a}`*p0XKHwSk<;iZj+dg1pGkT-( zto3GUOt+Y&ZAAYwYJz^dGkzUZMt}4ZQ@JlTN(>2vkJHsqC^&x@VRnwO_RsBKlT z*PJaw*ssIKv&asdceeM;g^uwdR}F&uuBXIK)jVVs>N3Nn(xSOsNJs%6&l$p)I8k=v zS7JMYkwfmH>dww%W5i$WhNsS6b}}xPJg)V`A2%ykSKUE2NQ$7>54)$-zQbH~A-Dg)6_Qp4|detR~$}P@5jcTUxYDlS7Ht)aS-u5dJ_4|9M z3wqP$0Aoxe!I}kuvkrlz=>zMqK}LXzkws_ZJnqD00nrT9bJcv-P6wqKXa*P=zm0Z) zvHsiW1{nBhz{NHx_gT~#gd9uF)<^?BNT@XA0!Z6d*#WgJNYIR_FcM)bvTzym(G;1gioa4eIK6Wh~%AzpbP?vg_r82o;jc@YF0!eg|D9f@cY zBv=hLn1;_Aqwnwi8HEiZ1nDy)UJz8k4iOj<93-*NHfN}45gbCKCN>_%3^OO~YGFWx zXgeUm1(0yT%n7!-(NZh+1vB_jylr)SYaNyZ4c6^q^O^k~9*I1c7xr}!;i7$db4yEt zq;2*-fP)p5U7!*-p|r~Hv*WMSg7K3conL-}^QfGxd^A9{td&3mvyC7~LTmhrdffKg zo5UjgOQFtIIXxb5Ydi(A3<0|Dh3B3$XTC9?3uniEA8HP_1}WWyni`fMTQgV z{~-#~9EeRWD$v>EF33E7<#Q<^ZqyQbC|}-l7a&$A6x0#jPn5{j`0?n$9duyhYb$1> z?4Rola(e-~DCW84C9TK1b|2f)>{VZ{Gxgbtesja?O@9OIm6TRyBsho@c9(N`$KSMd zpxgV?S@$Prd&z#&Ulfae#pLjxf znZ^v5U0Wi*g>DOFY!ka7ek*qRAr6LZ)Is3}wa3>hjC-|SpFg5fHN6P=1=k)SjNdp& zo(UALgJ_+A_Y28kn49uA^34dATWBU>EtJGKbvH6I zyIs^%H*PPCX5Q`SH^>_$2o2|aePUX<2%JXnH8h~-bNFgxtfADxU{E8&4+8z>q{kI8 z?5RFnLf{?|I&^Al9JSO62G{r%%UoscE&zyz%{3!fePMR7wanxEEaoutX?F#o6|n;z zTBUzhba}~h&AuF^M)N!3<%YMF&K71Qq}N0&`$d}SMBrPz2ZYQIN`cv;2!XgL&*cN} z#vuFX7r#}$+=rf=hnWe^Qf}5t>LzaH5)Y>$xw2@P@`y@V>GFr*GR*_^<()uflA#xs zH(pBRksWm!IT35~e$80wvL6NZ6^X^DgSAD`@w9?r(#-QjY<{`arNDyRg(1LH$v8vW zWAj*=&aaYP?XkQEI<@n<=S$P+b6qY_zxcrH2Ls&X%0FL~Iv$7(Faw=h2A>UFmV}$z z_|0P-CW%KG*u>3anKnsi5SkXuGafEV0#cghvFu*SCeZ|6$v}WElA+|se8L$U&(%;F zgrW>C=}VZlEocmT7Mj8-a))b@vUKe8_Lv1i_Stgh)7_etLjFs^SPJ|PkhHxOF+=+_WKD!~Qgf@4r!Wk^^E z4f99kFq0>Oma)%eePCSEIEF<9&s|vDGSH2UrlI8sOWP&<&_^*}`_uyd?pW18pnD^Ktm-7#cRHWfyT9c*hk$|P_!P7S3 zsY6k)Rv2>gmR}TEEBcCASun5#&OPB{9rX7wQz-tPS zHTiJxG0vntGRXL!%fID2>yTk$fD@#q?VXc7v;Zc%s4bH-cxbT*UEOl(+)sm$XX8dz zS7GWlcvl5jvD5-qj`gN)WHpU|)q(BAwd9ZEw4KDXy`F2yp&JMbEtZZrdps;%DlP=L z>IOW>5H-zc(0&@WVgH@PZ-0p}+D+XG_c<9mW*q=Z^WVz(-%94+O6)(CG8AWkY?FR_ zjM?kE6&?cQe`Gw$36LBAmP`JY)BTqJA)5fm$oBqCmhjK>|CTM>Pa+t>-XZZqJOPI| zKf5^)tAR|?@6<0JXpBDBKEs&b{(KMVCZj3xmYX!35>S(*rqHRa8|%B}&`7SoU;HVC zMW$9-XzR=!IO@i$VS05jCpDM%Gg9#-t}{wP95Cqbl2>JXew%okd5Fu#y@W%u#?9Ut zack>Dv;Zk)$^qy&QT^F+OXLjqGw!pDDc}ck_y~osG{ZXa_Kr(_wZxUylGjsR3A8>A z`}q|_vEdy=wq8EAp&B;|lefuLWzc+tkHh(cRJnvuE54H4_Nl+}P`>1yM~t z$6A>S6C`jHVi%|irOnyk+aPltlQ7Ehg1xj$u z=~2^4dnyf)$Heo|j=BUbh!9hZ-RLJ(8xal`FQfHtl_&EBjVL3MDDfGmo??&AmtK@4 z)NgvR>Nx>9kVhyt7h{xOMxvK)ijyd=2#1N^6O$~6VU+sdk~FGE@pPJhik-zO-DF8D zxlzb#EAKVr1(x~&L_!5>EP>rXOqDP4b^2lvGZR;~JR4a!M+&AR_ z;A5Uh@G)eC3|{3g!p{n=)aIScmt@w~7ln17f8A|v{V%rOGANR$*%rm!-QC^YVQ_bM z7~EY4cXxLf+}#Fu_imiQ-EDx!cjDc9&Ux{ERM+nAsEUf6xifQTX03&B=@`HwDNN)@ zU(P%ob?o1=v=-8PWRPHICga?m0{!p&A=ZIYY z4R^uu=IU)#)RlQfXKWPZ6%93ilKn^a(uVm0Vf;}Qh8(M$!b^>;4>^B^2Jdi?3s!gX zoawpUzfP^eFg|oxrRa!_+K1P?`w7Gc5JOxG>n2~X^KLR&!M+>$tI{ zK0Y&-Le9Q8DWc@Rdl}-`aBh-)bx9_4Uqh+(21eYqC5!@v65FY#!sf!-5jF3%HF<>v zbTh(^5^^#c4=IWaEFL*Hj$N0UNj4J`FBxUk<`gBN(v@XrNG4*99;o$DCqz>CTVw3J z(=+R|I;C~js`D#a&R0AtdF;l!!yg@OSNjDlf`zsWrPayEHG36+x?Fvj?x5!=Q`sc7@qvbw-Jx)GTfQGKpx|+*?--sE)sZ6T!Xv{B zKepnxt%qa*e(^Ld>E&LASLDhjaxB+~m5Hd#sy`=*e;H+19RWvtO2t!?laR`q&ZQ%$ zuGX~z%AP|7wSh3eh^;=0@{iiE^%$y+pypoJRR+s^pFu{M);AXWvj<`1;|kMCj*pEZ_7N+`;hR73LDO1i#@mCE+my( z&P{I~iH%&7!n7t@sbg?bGI$4MGLMZV(NL^Be774Q*B^H#`PO*m^r=%Dij`X??XiNO zr3V4^6PaOxtp(iKI?L$S;%an!459HmzRK zDjr={>9;&h$J6z??0d_Ob4d!2Qu>vX)vdv?Y;;~4o#dM0A%VsHffvOrc^tEWZD}Nq zBCBfc&9aH@8#-RW1pDx?Qoemu<3^GKAK4^Qiiss>FYHd)`4Mn}bHhi> z?rw(Yf9qXB_qFE-!7+7~^o$VtEVFgJz#x-< zqiRg-thI%)?&aALE$ zVrgxZ6n;qNK=n<$fxv#@8lf8Hk}Cr6DvgldP5ljT*hLoop@V*mXE;Lx;?>5=bfTRR zm1P2@`sytkgFN~7A=4ev^4L$4jL)%03aMA@vi%Wa@{uTNwxKNTkh`B*)>esZ!C`PN zSe}$p*5jEQwx!V(6m_ek|2~f3bkML6%{Y4md>64p4IyStq%F;L&WG6yy z9C3B$Pe{Dv{#$vo)OV4Ut5g3|5?nF#>7~i{YRED3qgGSB!(4EMD&eSl~+kuxhoj5NbjHoWYvtinioys&uYbpFz@I2DpHNh%a(izwT zCC5{ubB;gM#vs;bhHsqvOqKxAJ+Dv9u|J$qx;mpn!gzEZBjiZ zuePzxrKf$`&OOW^H{1i|NaU1b!oNJlx8{=%J5}S}3FdGQB`#v<=hTqV2s;*sh{LW) zQREX+zHSD(7OwqGrscp<#p|!d_P{Nx_|7=v3<~qUWJcJiYZP?BCV$~bdk-^ruNvrO zs^uC$4?hvJYy<>36$u;J);!5(=m>$osU~D<=wCcrdRT8UCQ{bYu4sNG>1F*&tWga{ zD;-Sw%B4-q0;fiuyCm|$s9k;H)j$+zI(`*HIW9|Q7C$i+hBOqi^OY2stUEN;`BtHo zMRztTSJ0^{YjgR!G@B|i+01YsNv8ztncZiO*n1d0a_E4L1dV&BDU#X`eGPQ!*K!Us=0eS1xgd& z*g(DxUlS-W^;DWMDgOO}muv!O5s<-tlsfsN$04BWvJsEks5&BhBj1(K+QL%%9&>X8 zzb8BD-z0<^z3vxFu^8e=v7iHfmM)l*lO5 zV8pT9!CHh0P~Vm-&ohERa@!ObPXCQJeE*MYC{&vgM^Hb2?7bIEGc>&2C( z_Ooh>y&f*z*7c3(xo$ybFADs5>Yij-kqSij*Wb-J3DMV?90fA=7G?_g#7LS4`)IbW ze>HkHmAl$8ca<%lTe)ti4%b?qj(cDIyxqR?ZGb}WX6B3L1$9{livU&f!SoN0Y+A>4 z#|lj6?tq-j&9+UXHfU=hlZ-Ia;m`4KYQq^i{GH~`ObtQh6CR`F`roT)=2ty9LRss?VhSK>pN(IdRY?w6piBaOU5(%j9NwL(y!XP$B5@)r zfmp=Zkz{V=B3VqD2J`F<|MYM5`pfk#XT6ms%mgXEV#gM}*PHdlnBI%Rkr4}z$&9i2j4ivvBDGV@a2Yvb*%-+LS6Wt4#Z5O}j0q+OiVA_P# zv$dBp-3F-~rw@f@YE9&xK9b#cGONeMyBA$OcVPVK?wvF|-Ar@f!qN6d0NcJAnK9}V zq&|6Sds+TGK}X3`)-q0)i2CPYXM3fUYt`FVcVVQ;XX;CD6&H`ZS)it;q2Iv;RFX`1 zIOrjEHiAhnQ5@BZUYCiuS3eNCXnB-CE_>!JWpl7_?(Nl+UKLyigY)zwa&nsQx;IAP z@#pc6M&#mBB9YfH$w9N{u3iUz@+_U$R#;Kw-dM zh~GYKhH$4-&vX05G;G-4^yoRifG^94KC+A5=vhA$wS@7KgyO;pkT#&A?Z6lt!XZ{U z4bNJB#p_R0V^ zP*L17lM3QN^%1g7Py|CPN@9PU%iQ<9ti{e?Md3HLRQg9?zg-2uzk@UfAsNyr=CT|m z>lRP6&`u1;{!${$%nWHC)>T_6Swk#a`!VE|gfMR-}1aMOq>Y2s`j# zE{UjPs8@B2xkcLZ5y*p8Zxed5x()U+gfQX6?h;8!n$X&?C5y8$2+w?J2u@*^)mc? z&BUwcwO~1o{`V{rJAk8ad{?QQ!9YMz|4+5b%+dZolq~-Ra+9|(5IsbK0=26JyREh) znEE68N%aY~4Vh$=Lu@n&7ybEmZBhGsKlGP^?LLs_;PxN18K<6UL?7n60Xf|{qQ~rx zuJgx7W&g;loBSlnug9e7&1;=9O$1gbO3Ivp;3Gn)bJtoaFv9yZ2R2gopn2`1=>eMl z>?0CUer7DFRhISV*>(8r)6d}G;Ubb2Oj7={%;Td0NG7~CQ?h!jDyW|@xbND>h`%G6 z2q;+tWv5xv`&t||*PqMMLJiqC9fO%DI>JbcsAD7!d1xiXtMx>)?DIkYUfQE`X`CESSeE}utHL%o=TP$W-8tQcn4 zl6P&@W?!O>^l}w4DhM)47J-DdP*Hw9iMsfdf4AITw#*^+`0Gn}Cy%ftT*huISX}^9 zL4p8VheR9CdBL_gMiJ;xsEN}s{j)NZJAy-E|8*_g6XU3I=nKhbHO*9&RIC*4B6jgam>(0xV1|i!;o&59heV zC1UC%@z23WnvmYrIPK1eXsuC!xx5}tU4<_QqrCjwj1qu8&3E*M0fl~f-9Ety@ z>R?L={S)lJ^$`Sw6vQgZGXwNn24WB(ASmDZ_52RAHIoox{ET=|SpZbd8f~geCHMqu z&HIp}M;2`5SgLj}yQEk5xX5J7wv&`+XwSvg|3xaM;l&5p=~9+*ehq5|y&W-xszg&% zmY=enmCW7oc5F$8{Yg*M3dht%m1N2~ePB{X=8W~^!2qA~Ktm zH9BEDV(HlE7=}byisn3moLX)#X3LQtn940^Q%s_6-UI1pR-i zi7QZ;rMgb6`m_tW-ZZAO~p4gCJL7XhPwCyj6 zd#ccKD4M3-;> z**0TIusAEc2;H|54*R9)DGjZLZhi+q7ur-4rXOsTwv02HYZOuJ4ilXvM<95tfc#RQ z#E+7f=WAFHJC`#T5MCf%*|2^10Aw>@$e>ly@hf1|9xmZer`$k1K%YJ6_PR~<@A*=U zI^`NmJrSG8Wg-%;EMBFwddPy#Fw_J;@v%?z#q7%n!xtdkzFy1@=X zzB+l5GRID7)~kv1WR%e^t$#U~M|m?WL+fe1-@^_3jp}y*_1Eh@q%pLb zr?t4t)JdXtTtVhK{v(F$Dw3Am+tGiy#Im&uXTS9m>ZL&R`XjZcgMRBj2@mn|NgkDflN_k7> ztJL7)%4{2;gHiHg!IfE`76onl(Aa~+J|ur;+p7UE?y##CyzC~@bpUq8v^qn&#B=Xw z3-7WC9QjjPifCZ*CaPQ>YqE$Dz%Nc^iG&{gX+=;Bt? zP%U20+~PpP5LhzhZ4JKu8V{`8)e#q27d^tm#e&0EtlGdXa4leQf{+nyTMC2+ZfVTgAG;tg5N4 z+Z4hCuIhqat8t}*r0LT*!43OGkFq545Tgm0;#};}q{BPHsZCnAmTBT@p4|mLIcv!L zfVd+0t#hmZx??r@0z$+hfJu04cDk}a;%NB!a&+kG^ma0GT4JO~EG*>z&^&U6Cr`e0 z_V{e{@8d!3X6^pkQ22E+{+RFcxj^Xsa*g>?qzK%||KlP7d(P1R{I4b@LzN>U0dy3xr9N6xQmeHtoUxky(D|PK*s)%4fQ%tJJ-{( z@j~yI@zf!hGU;D635qC9nOj5ak>^54IEQWwe*_VHQ1rxIBBe%cba4%aqNb-dC6$kW zku#qL^CiPaeF^dMrJI-uD-p|^Cou$kJpL!l?*f;6W16Cu3tvACMa#7=11l_Y<@TeD30+FWP6^Yw%m2__X72Ne@a(HX+z z6$>KcF3v4aR<=d|r|mxSw3R-QrhMFHdsvB?4<2f>$khA0?0jk-LAA{_^DW=@CZ@25 zm3F1eE?-i}-l+z6soJR*uFWp5_tdbLeOpiB*+o5R2Wh}Z97&O-2NMGT3#)eeLlf)FHVL!y3uHQA`DQaWN#8NC zkY!5E!N~l1lf9QQ^Qgr({j`<6?l{FdB(!Z)9u2@2YZAGdGsnAjsUeH#qeH`G&7pTq zww4uHV+}4dgU6HZTX!YH4Vvqb+t`CUY08%N=~bSSC}BMYJ4`nJ^+TsTHb&^LGm@IY z>pye`6mSS?m)dh{lGA9t*461FFVTrsdTeHwGdU$TyaW}Jww9WzCT365OMf{h%_4T0 zHxi_Tfyn7~dm8XV&T1VH@#zt^Y*I_WzTppNg*q&~g_jY#)*qx9@GG4;Opu+%Lt>+w#yH z14*owHA8Th*+#K!sx?ypyoN9>d+BnnKwRhTih;MP8KlU4!%7?cda9F?KK)mJZ-YG4 z0Za`yvI5k9`%;Jcuw)sX?Ej^+WwcTl|Q|GI426NR~(1xvx z*DFMmg^@g!KCkQIuL9ynG2F~m{s)(Gs`|~$kQ}sX?#N8^W{*#0y1>sTNMqbA=r}-w zf#Wk?nMW@_L+6KK_3{&buWJ7u_xn)abt_;f0*Ob}xLxmgYqU_qM%};vFBcu|hi3P( zn{8_y@S+XM;dzg2)#Yf!6V-6U_L=zGXZ-I7;y+%6-Hjp`@EveABL1&!q=TEfiK*Rx zMgD)&6_kK1IAhl-PlUyrq|BxD#UwOtIUGC)<#`5U_BA6O=G~0FgZ{^aZ3!%w4Km#~ z_H@pN^cRgOVk-En7h%>Vn)t_!A9Dvr`GJd* z>PUj&e}O7(L6B34<^I{Kf{$W5_1$5y`cgj-pfFOvgQQ}e?ALsgOABc_WUb1NY*O5p zsl-OJFfwT%eJ!o)#!wEq*+g3?hH28pqJp+VXE1PeXtjx6+Qt_3f^<29oMZ~)Cv-UD zEQ|IACVvp(X)RUmoXmTP9v>&`peUDSOW5Z}WV1DshXa|z^`)1UL}9Ozz%vQy?E*;k zTpJ8B`_z`J*{xlNjRz)DAAi^!;O>hhfrO9JTy_K?>h9*euiu0jm{C+ta1yJ!!GM#mJd0Mmba+#M;BUu;%DJ{(Nj9ul zZ^uEvyY6NiA{oOD(^^RIj+yWGG-cJ3p@~($>xqyBJHqr@aiaQ`8Bx2y@J2-RZZjq^ zN#M-@KGBj^{Ut7}6VGduO6et&(X2C5=dD13(#uS(B+{%{P|-W##(w1|dHG{4tco{y zfzL_YGbvLl>b$8t!QoloBIB0Dr~)!tN-2EWFyvzjc?M-Ei>TBqZJ?qwF@NB25)G3` zQO}|t@}QtPF1`-I+3(`GKtHqqxYrfKf7bQeIr*(f9uw zOXpFr5=DRi(+>MTQUR_OZf@VNNB&nTpj8v73Y13i->G*x^$xQzTW7?k`ayzJbb+Wr zwsD-a+{8cqV}-qG)$ij;8V^1iQI0YQo157|}V1;1|hM-j|}&A0-T|53ZmBnOQfIBVXP^)$AsYhB8L zh_Ut#CtciUBr!)a2SmENG~0w$hv{;3f0zDe0yw@Hz!_m#>gDe7NlsKC0#PehZ1Ha) zElS<(oTG%f#N2=@wOdm|cE=1+U0&RZVsI~qgM2f?OFhyXxE!_L=ANK@2F1mVv==wT z(?Cry>==~V`=@1Z@@hi)RPK@R!@3<^Cjtv@y#Q+jfwJoZfU&z(3tOP@X=0i1BHLdN z*hmN#PDweTloQ|>o`E5#3td)fF1W%V-W9{gd-O^Bbl&lPhsdEy_^SFlRylU{(oFCvHTG(!1Su5ZWhI!p zxMen&Bi=VkLu`^#3XMXB`R4r*Zt{v`Eto6h>QB*Exc9sx(%Zi?kT>b_Iv;28;xhob z6IHWLM+~4=88WE0`N2u){@_zu^L+n4zAG0oYoGDxxlL(Bw#9v_;b!I6%hF^8UZ^`Z z)(F`f)qW08{7G~S+XyL#PHI-JOKYPcFy5y~V#+|}w$A0~hU|;T20I`$?+gCFH^KjL zVTRA^AkN?U5@8Dv5RCt`G4ix9Rr?=n_aaZh@qh~@{2KC&7-5H-2#HsmZQVTRviL{P zB{abPI=Y5JjB+6{)oaPfNVf^yH)W_RMq6N-vY7TBkuxEDs7UDF)7EiU_7=9iR``)= z-K?& zu6w@z%$=u?Grz`@J7Do_S91ehcE>$mi~H(W!sSfyEFkbo)A3HZzNxQ=uDU5un*?O8 zo$Ye%cj);!8?#X8zdEMu0IPnh7&^M}@@_`0Ek*kePMh<2CN2B%n7WuTHLViEytJ8; zShl&)Gd4$Y?7H`6FBTvXqH1GjaFM!}5|~>qh!Fa2&x>DfIM9Z{bjm-^#XA>C_$+lw zFz;(EOE9R8M={vr79JfcqE>5h=&{cJV-wVq{*Id;J%Kb<=SAG+5%z1zod_rqrDt9}xdLUf&aoV-` zPQ+Wx+j`vdl!w|`0f1v+<>*%Y`TEE=XOM0x#-0~hBa$e2>(M0j_mhu@{#11c5#d_f zmhhcfHd8*54+GJnNSk@C2Mtg1pFL1a>&0MlNCI7YiM!$d3`z-be^^0Eq4A((^=7Om z!62EAnfDCGQ#duSApm|MXj<F!@B}Tc-dVvga zh@js0S8>Mz2_rK6hQVkXj4diDqDZIkhM+{{AY{O$rolyNb?9Uuplxk2ZJ2pf|LpZV zLz(f>{AYx!<2$ua_gR#u?cU4GHh%hZp+H#0FPDFtCC&7 zWvaNGhrSTTeZl&_(L^#yyn6e{|NLGtt{MwxCV_Hau=-CTa#e?s`iovSkQ*JZ-N^9g z#}i=4xNcrg4)|z5>T_l#R)|@WZY-1~et93cFoJH)z5PbTqj-TR@k^d&KoHSUnJ8^7 zUfQ8Ldyue&^;fhGm7bdR4j3uxROeUr>eta}_0I$OSb&%{9I?v6jWb-evEQ`(w6OD^ zr)@r`@ni-0eMEDVf&HgdPS&re3OPEYALBGdyO_0s)04^ZmAPs9e3!5o$#FX2Nn=^% zW}f3isQAc06eaD{HZc-j zIO{hg%$_3DgF`w_tGH3b);A=WOCC2g_gfNPFPX@AV{C?H10jrs!I_~j2^3!1BC>|vZ53s93I@a z1w)jPmQejZw|yUCFyA>JkhgmV`0o>_tE!Y3NZl;K>Gu~{Cutp55D@HdGzV-n(4Pg1 z-$ApsbI%)R6HeCygG7WVC4*%BDQi^WPI+fkI zFt8gtIk^~xe2$55M0`tca!Kt)H6=lJkEJ68P0yy;x2H?nkGJRcwl=QE(~APR{<_wC zJjmhoT8}sN-b2K>W@uu+dDYcA16vJF4by|>^pqU4pD7Qtu%msNXfi>CkVC%5U6gKs zn3J#1j2pB1K5Cur(exvsg1hoOt*+W27MTedkCSl|TRWR3a;bRj$tmW3yL*S;4as;s zYw|m(7w;%LI|;InOA&5Db9j53HN;Eub4U5+{!}nmkn7|;ndG-zId~sfYd~(+$~Biy zfTnH=`P=4HsFS4P*@6A#QpB^>Zn5QW;%$JHA3&FU<_aMI(t_0fEG65nwY7B>uxYB- zX4jTFIx0CeF@eQ|>#!l-R9jXF8BJBgl86G6nUbArBSVY2Fo+1210I;2lT)jsU0K_@ zqPzS@WZCJeVCj9M**;yOf9Xw^m~}GhfV!sdvxTsp*Rld%k>A(tL2B&%`I;K943KCd zZns+~8i2@Q&9gK=D^K{7`X9I}+^2$~OdCg>+Cdf-zkkLaj3x!`{qAo0u03CF4kV!g#Y9wIX1lM2Zozyu|D? zxkbcO;=U2+Gwb_H@o9mcw=7S$STf$t7ir2LfE)MB0`N? zNmtD^4%fVCnyjY)(0%x}<8ayh<`PH>c$r zp}i35%q5N9gbU?J+#F*wYmtj!#&5q&+9K5)YATx;U8e{@4t3Cf=~ZuqijWxu`P0E- zmeXnjmFHru(N;Z;6l3g8t;92wZyz@-0o;gee1AT_mcXNxNn%7?l)~hrSoBS%(2b@L zq_n9Byt~$#D|ogR!Otm$RVr|30DnhXPglsfoG%)B3jk!};njAw>JWMtG!_}i?qJAW zrPzJEJ))aw0B+635bXJ^=0#WyqPuVxKt&TH2Roh@VqJOgpKM4HbNNd zNp@B?cfakf-lDI>0E`@}XcE!1;_a-4hOr_JB<%X~yt(hxGoUD1yzOpFqwQ=fjcLU1 z53fqtToDURDhtm8a{J1Oc2;Kf02PLko7ZB!Q5Pq7<#h&ZPba%rvx3b#6^24N;CtMxo+609kJ!U6?K*&@>s@gA^1huL3Ec_4=edrh% z8imftMRjymA1E0(mS+`ST_gfMmKBT;0onOa3o5uS8*c1GYrQW-@{f}psZ*AN1Y4EP6hXmmapi&~Jhz9!q+hi(D z7rYE61}|+xWfnAdPcMNU>z{Z2+Yzy`2=oi3xqS9ji1-{@z*Xt%4Rmk-HlDdu`fJcx0by(4^11{?`b9@qfh&O}ivQ;Uk_>y4NhJBH3E6qF`~WHkE6lnAJq zWy6T3>mgQsb8n)wRGojDrodLS3=M+cPN(=3tk>ETVU3xkB7HOY>|?T2Y1(ZR z_T{CR>25oH)T%b$vM+FflQiMrI>VaYaZFr`gmU%Db<-$1G>F ztUoAG2e!5Mdku_jdN^4o1OJ_jA(hxv+4SI|Q!ApF$u}|wzB*p4>NyHV@EWUvnXQw~ zbOj7B!rT33;Y1h0=t1lDyl%S=y!LG~KUL)x;7w1@w?qznHNmH5hPYy^gAJz82d?lx z92ohF_X>XG>}()er)`yW+y4p`uW6VEzMU!s0v!53Jg_AURu;A#rLPYi`|T41pEB(M zJsUPbDre;AuR&if{g`pgXbiZA2hcMV(OuPN$pIBc9q+4k`sew%qPXD9-{>P$7}Goy z0v~_T``y4Rb&@e`I}+Z1rw~xZCNF#MmJql4UUkn&(s&R%;X%YlkZo*i2(i@KA5gB; zxzZAfCPKZ>)CXGB_kM=g>h=Oi;ns@UkW+~pjLx>lAXLg{axH%xL|@nyjAwRIOzIE* zXn|};3)tp1^xdkWuQnJ_TlqDO5F+Eyb4%4Nv&d%{Hv};!bT8%mKrQTC32V@ImsY?2 zfh@4=2DT$+R=E0iBIOc)=U+MD3Iq)!qdPW%(4kgFpN;%eEGX_3Sue_Hxq;PaM*dfd zy-xoKHM#2BfRg`Y)@%CfJ)_*SgfE2ETGhSYjYDT65vv)F@Y`JJK0nySQ-a@c*qUv9 zze6>rp_0ID=}D^h3=>@RZ{%68_rpN|1!ri+f&2lk>)Lm9 zt~{HLmec)AJx9nsdnPHBh}=4nmKJCrliV_Ltswr35$%s5$x$%SVXYPXaA~G_?FY*Z zRmc(bCKKhZZX>dQ2qfveqa(=-`EH8WO)6y|&V?RD(D8KV z>}Ue<^&)diR9nc1k~?r!N~hI_jqFIa;IV;7!+ z$B_B#B+kVo_7WWTmGablWnJ~=APY0SJ!Vb-h{QuBx~!nzL|{@qQT#{N|Gou2$Zcyr?aly#X49(y$6QZ z73qhU6W|R&V6B;-l;b%rF21AE&lzqhP)={fo4a|R`)0S8($s4;Elazm&2Ur5D9<((ei=Z%xaz*v{L8ThL@RYSHU;#bZF$zJ z*0JqEwDf+yonL+&*PWg6Xbl7!jt4OIf}~j;S)USUNbF=W6N&0 z3dATn7%gKKXK)U+F1vPQ3p*Uh6(efL;WJMyVAEPU?`nxjPa;hW7Gu+#|COu9v*0t$ zHN_Y-23eSBZ!Qu`!*5Rk5-*%Yj^FHlBegzKs$9$5JVV%6qi%I#ORD}+9iADNn*BIE zbPDC}wyV5m=y~tcKZOpm&+59b+@^6eqxoLsKjG0)zd5!G)l3*H%?_iqJDiH(!AbCM z$Uk-KD!$~M2G=&u0#9f2uHG$8V=;5bHCQPAM9w>&?Go?#n!=X>JpokSOdXb2h}<}t zZ=dhip4b!|;pH9Z-%y_3zDFBBFAud0oh#!~k=)5P3waOXJ$T(t3aNe@C$-ReU`)^W zhltQIGkbz(O-xe|6!xHH@+&kZm|M3iGyC`CE@GM$Ku5Cx-J`Z=X%J!|`}cYgh3+$Z z-9WI38q5ZQA?xx^c-$YWuYhnzOfbt=jaF?l3M9TtbXyV++ilVGv-;h&Cq3!PH+ zW^6Lq)^D5Unra4p2s)bQ*Wwk3wKsz0rQmAWVGiV%kMkGN8;!@c6_FG$Xd!gOeDPl@ zpV?M=i#7N)P(Z46Sa>1Y_0u%eNQ>N`XjF3XS7+(u-}q_)mu1`t+=Q=IN8Kv9dEYSV zpKukVyon6A;D8lG=BIXLV(?$pj>Z3~f7|vz;D{rDY{NEOwJ`!MHh${$EgLJP{#lo{ zQiW8UAP;`PW1!{pzQZ8a=8&{vx8KF1z^Y8e=dx=M?tN&&pLo2g&~iaXD1!|)iHv|D z<_aeWck>g4LxaqvJ+PZzXZ29WJ7~Czzr{ber+!(f7bFAj)nPV+Gn&vCzRa5NAuOT| z{IDxj{)H=#CV(fc`^G8#Ael2xc_9{dYr$5h-?_LQaL(8t2zh42w10Tb(B6I3C6{9S zTPae#)$^!kBfb6QM?yZEb)*yu4w<)21Br~%TWhz49R-LCuQ6|AlN1)4{IV9flnwdD z&z-l`_6wu|6c$Wy9O1$s<0v0wcXD1TE91Vmm3qFTA)B%1I2#HMdBfLrXEQ-sYQrnf)d=(!w;|lHuLMC#LaBjWmdU@t= zK9_wLyPJZ0tuNtO{F;nysc)(hNMogp#dt}Y#w2v5N2R+BjA2c@aOZ^mq#1I6Pd6Z}W2cd37rXPz2wB~brCL~!E^yD4)g3O=%DOw#GRqcwTCzgl^C_w^P znH0JVHv_sR1XMpbSjnbiA7TRCufCvdqXLSUVo!_2BRUs6#7^P=kdo+Vp?4~H?^(q{ zEl9>?#MF<6utBuaNH|aZP1n1-qkpP4`czG6*ba=Cr7#}&EA7~`ZW27O?j`8-YJ%=` zEo+@{Z0I#WN{=~T0Aq{1XdbJdDSxAuEdoQ@#O;n%@g#k!Y3j<&2gWt{7*bWS+Z9yl zkjdXJCk|Z`o&>=<2NMHr%5pR9(x8=yVQ8{R?CE{VM_qb_=#1mX@eQ1yVhu#bf zDHG+{?sO<^|7ifnw-7kmp&}`;NHj6`A@=bX=C+unP9kzHT8iS+jk&-!fMFr9%lzWE ztBN8kf&n9^WH53l!Zxg5RvtV=!OA_5L21^6xQ z(d|TGR3aqz17Fz6CsfBGdC#+N+k#vN4ME4Mem zh&=R6$bmnCCN@zkzf~@`V!M1-%gCqZd59`MrT_3Oo$A8LM;L=B?m53c2flN!1+24u z9VbZ@!!B?007gHuFjzc|wUJzFbR;Q)5v3y|!d*@LMnSYpmYMK2w&$OGeD`bRMn^@4 zN7{Y0vh35lp`sMXlUhOp%m%%th47}Yr!{M~$A|;v>&FDUW1{|Cn-t=NKALWiF!!B| zu4eST{OFboie=1(;CcVLE=lO(k3Bce6d5)jK#08WxdHBcYy~z$n%-ow|LlB+4c>j9 z$-qZ}+5udBiWAo9_DwqUc-NtIy9koU^P#J7wDj>&uwcC`VkeD0wpPE-e_dq~+>Ca{@-@1j2 zB61nWHG?|_Nq~aS2f-IF(B?#1wq6i?J0r;6sI0uzpuTX;h*c<2wnsr8f)G=-5&%t} z6@{1`GHWtItt^qMCa70|mIwlULAcGFSssz!X|YbBo=N;2pq!jXdA}=gHEVl(V^Y>@Z%8pqE>{zMqPfNz!&6-6$d|0+eS$Tz*Vv(&L4L_YSt zQQtwRg=so66xwDO?pC1yNEOfCNv2Q4%4HAo?&{#Dhoas?lRFe+oP4BKEMM?snESp; zY32&Y-uP+$!J8Z;iB1vq9O%N-k@)eMydq4>PYtjqLzuf^HB)x_=lN<7?_lC_lmbq^FbfC1!!+z8Vp*PMZG&wbuSMyQt zbIoBajvmxx0Hoa+rtIjScNWPaWNcMq1Sp8|S&Xae>Zc|dcpW=wfp|}iLcM^1Ahf|M z#_wh7f^xjbv|Z`=`(J+zApzYB#vG2pO2n@}W&`Gf?Riu(Sz;}i(#2?;;y2_vI9kt& zKOuWgLRI?Z@KAKcmEi0P`~2~83g`}QX1I6UlCl}I(fr=e*7{aa6_7r}Ba<|zB}9Jn zs{OR2Nzjv9AKvsk);IK8@mip9kzM?oF0Ww1sW|8I1dWp;$(eYq3_}p| zQc63@J_Y(}xMR?|=yADyIEo-?+IW}rb>#R}E%o=0Ug)2%&+Gov>UJGS*RjC_9!>E{ z^dvJDozB}tb~SddopEB+0TS88y~pQm6O@LwOqpG9V5 zEH4uKeYAl2Yn^7x0yAw-4PtKq#LvXdnv?HYrkE0pvAzBnERAY`w-4K^qO4pvQF{VL|hJ z79y|Lb*yyTvUj`kQ#Xi>?J`UD+)CKFStzDe@xlRSMjUu!p7FQwayNwnc%gbpiYzCH z+|#Z2X)&?K!LXqEFKdAxJF}5EfjB|T<3&nhh%6AJOmuiZU5~dcly{0cZxZTlnaelXkzHD2gOMpLfaTP2W$NYlbKc`91ZVQjy-g_Og`*Q_a*Ji@e zf&wltd@5InPcYyazu+i0;ScS|;E1b-fVNPSvLC|$pLl4MGJCH_p3hh%!pLgkF|H!LKa zPo@Q4&x?;A$wngd4jE6cFGEu*OVoJ+Q~sYDvMZk{yY_dl3ouq`+W6IZ&@3d)eJ0fhQ{u@{}le030Q9((!s#kZgj3LogjY+ z%lD+DUq%6tNH;b88WS@VY3~7K#FW6E=o|^lx2b4bzuMn z7XrvpkLwp=ba-nm~YO% z*_;6GJ%IfHQI4p+^=jyBgw|#e#^!3-r^|!+#r!E#J|SlgAJcisu?p)w2cjdx~C|X&t0&y|#iBE9MB%p~v{}hp}V`(#b+&kE<<|Xdj8;bIbNJabVT?*0~>v*>t z5%Fv03RO?5E}34A>LH;}!1noO_i;&P!6)dM{ggJ zhcAU|GVe#2TsWwhN9OK|NtWFn?rI2FlsZ`&odK>3P03dg*owMVo=6sjZH&Z^(Rkh) z@ntorRL0j}4p#nEEv*@cy}8Y4*-UH{NQz;2gWHs8wMnwwLrur9YF9un12HC3I#>d3 zZ2B4@4s^0mkOBt$3)yq^wS7*scu0R6*d4(;+FM9C;1!h5-_fLpKEgAO5C{d^yjKbu z98s`^@^s)6qhCynC6t}N-z;#!W*tXlr!@2RUTGv{Rnm-zM$^hyy4R&%Se0=(&3=14 zYbf%0)eM0|;BQz~1?>r0p@Gt;j33@5O-S0m16< zKur^!tVd=e-ozyg6w-e;T0cNq`XIi=%}9Y`#Z@KUiui_9z&s*LPxfdi&^Muh+gHn= z9SJ4RWNHY2n~r5@6>!_&#~5TXm3k29NqQ~Q`CP4g@wM1oJT>9Gt;@#{HIw@r6dQ

{Q}R+1M!<(L6qer zk2Bg95d0BgCz*REz?IqaI3(2@G(D3L!J~RQ>zlFX@Y|ce*47&~IwUmIFGcW+W|@RH zOhTViGdf~3nseaCQzCPeJq)Hy4N&NDEf}qw#am(Fqh?l_X2))os^@?YG`On3>70c)K16FQnQ>y78}@H#LXU6z zC7oUIdtDA_{g{QGZWh8-W~Q0J*Klb z3?~2&2y4ZA0n$dfJ~PWs>;2Mw^^Yd}{sEp0xV9lbCf=L=BdQZLovPtRojkQzV{75|rF;DQ5Ypz4W7o-`q1RRIIZ>REc zS$|&#DyLX6P&UQA;Y3C4IQz#u*)#RKwe*&fz4SELeq*mjvbLq90H>^eG4XoNgGIEnE>%e0X9pwBgi<5hF0% ztw&Hc=qeyubR#>Eql-Z@r6UlfYl3PA#}M22(s4Be#*%0)UeJ0VudKjvO~EA>{`~5L zDY#?`F3CxpzLXZ}v4*#6RcB(N+j%tQz3`&()U{EMY?(=Y}q& zrEI{ohGY42bc_NR(rX*$Cv=4nXUzsnSnPaV%BhpcgW``Ygk(Fc92SpEf_3na|2H7; z7PzTTu>W8u{sGceE8;>iM~=8?VQ6aqM_Kfjh@J_v200%#T*?{9MF!1*0Nx5b8-6W` zHJ;#izA%_FtCeJAaAdn3=PDW&5t=h)K_D-TDM>ld>ae>g87<Kg+r8mwBG3#o|}HRU1C z3<&u*c?kplb|BZ0E^O#(0e%B65KSJ=DED?KKRBbHKh!(kI@pjO0*aqdLX=?+dwPdU z?%mYd4>DoAcXzIJ;;fh2A)&#KCqi^WRiDQ`f<4)jX%0=NQ z1LsdjIM694oSROaGkk-A(||V>!$*k0pA)Q!XwA9?aTV$+t_P)%Lq#OZazX;8K!xeCb(Wq-?IKv5bux`59RL!XLmbRv$`Gg3#Qwl%v!pp zXKLMx^UQud(xyi5ujUe$)`s}j%whz{N_wa+uEb$`C=X(=B+4flr}@^vJKo*DhyPL8 z`FKayCut$mAKuvF59j9=SNIw9U&S|&dD6QN@0V*kmEDh$8oa^UjjhGGwZC&MZOwjD z{6~K`l->Q!@2+j!Om6BfzUhD7td&1b_pkcT>vzkgda`l1T&}z8qVI9CR%v}4tMtCY zfM3%X@LaFZ{MUo9=K&8;pi zZ_eLdT3uVey}7kKw>iIXdvk7Ob-g?{zqz!&zB;T!nZHn%d?o4qcjB9GIO&OI=Y2+{ zg)G|60GkEShbkgo6`7m{t$*05E}6w44kJ+ZDms(nPmA-*WAU>8X0GW8YG0b$6>lZ0 z_YZ4L@E21#gL>PK;=Lla%e)PzM5H-3ZP#vIZr{@E_K6mpjS@q5h95%---l}Kvd+kQ z6}<+{2w`&j2`1l?(^I^yue?GRKef6AxLIZ_Ay{i8+#9e+*h1YBuhP~uz;*RNHaHh= z;#rTB$NL9GQAud4a^WA5n}*4EsoH4{LjzRp-86;ex}Wuk2it(R3Ow=k+&kks*J6mi z^V9UUKLa3u(OJN%#6g<6eIs$SUQG~5T9J;Fg)Mx>U~6^ME>To%2bBGI(Iuhp;YTEI zEB2AzoDFT!4jrt&1T2KM-Nub~-oFfj8Rvw1BVK)1$>l5F-=FB$pNB`GJu72u`Dx%Tu*>RTkNqh|0`v-%}$UeRZeXt6oQ*fWDhDNuHq79<>?j; zKU^q2%#_EPUzWsvD_7==9&;ykyc88!w`fDM*qfxUbUe_?^oEk&x8WPoiz+c<=7ugU zeu7#!@fPvR3fA>-Fy=8-#!h=gS+7fD06sp#9}h4sO+86T1Iz&03(;i_IaZSz=TFiT z*J4v>3UKFOiVZb#N7ekZ=J7G(K24c*=?og0CY4zxY+`1j>;?x$-Zy+OHnhcg_LtcwD3zy~Dk8>ieVa?9mB8GvkNWV}^-mQbE zuCrI6%POz(Dn9NB9{PsE>-N8}c$ZNfQV0KYyhmozhvu!$Y_&lk7KppDAde1qcmN$Eqw$X$O4bL*I+nb?aG8c0 zgEEi_NsM6lqX>+mJ&q~Tw8LO2t7-xWsDu)`7F4b&T)C8u{3p2Q6RddYqFG?S@XJD> zi!268uaYSHK2{k|ZFXxX`^HX*O&?-O??=Q48x0U)YoIki5TQ1HuhD}r4Vug|rHhHU z$1kM<)yD}nju<;kL)1n9VTc?#?vG?IfMFO7duA=dw(PuaUAGIkk3#kcgjIpJj^UHU zZRcahwr;u#4#7>S@8C=@KSa+pj`ux6YSnfY$o+gKZo_;6khA97$iU!q@B8UPrsGFyn4dV zPkv_1v{%KWt;0PL z+`-QE4fvuLoV4L5eVvp&i|fsX7{MLu88VXyL8bJJm}t}N>#BOmfG=+elQnr-Zn?KO z`I#n*(NB@*{!%w?#RdZh4|pW1u-lji3)#kl4tlgw_dJoU6)xiWW_h|PyO&Lctb*rs zH;;Tb=V!D@@5c}UG14+|DYiqx%ZBae%yxi5UIh&7q_rl3Z&zQ=t-=&65=^*X`k4yc+iOO6;BVyh!04)@vzlzg$4t8%u0Y-nRT$G#e(cSwrPxv1hl%8=na%? ze5?!iUOAWX(PvaK|53IXPN6=JyjT>8v)BOFWZe}DWX0fQ4`BVeCe*}X#ugSi!`v^b zmfnIkfD2&8xSU%rZKkQeYL*hWM}t7X*5BvP?qoNNGx-_kSM7%JV$nx`1yqD_UB}fl zUQBv_^dV@Go0x#canI3m%xoD0oFN_;J{dkQ4NJMCS>yju>A1=u34)1$jX=r^N~<;? z-t>mdX;z5qrxuEzns;3wfAPjY8xo<&m_t*y5&-aiY|!8&VW}oQvO;Xhf&P=h@Oy-p zBMY0gD@=A05Q`3UYOy5Zy(yR%2fpTx#OA}g>#_iYH`N>lq%AM?mA?SUfsfekKT%M0 zjZun8xuVxanFgx$$XNo&nNB$`GQ^0Wp99)i%5BFdg%l%CesVO#NwcZR58a7Urr)DyUvN?P5n5W+J-k?I0;?gCP|n+%cdpOVF#G zQ1h>8Rg|1`AvH(%%dt5n5*bNfmzs1jWGHI0(D}3{b{Y{l#;g`OgVGLGs{w=e2?SzC z!H05Y11* z4nX!g0AU#8dx`u@8mptGO^;}XR1jV1S=cl@_*+l2Tse|WpHP@-V}@ePAkj`~kaiq` zr0l2Hjw)D=3Wg>weP8}ky$L^WIqG3z9uk0zd#8c{fOsmpIF9Pc%)?MU?y8fYTSG=eo_ zXemxu4_|G|p>W28pVoZ$|HAn* zXRuThGU1J)+fyD_mtZMT%uIY)ua$jieF2BJg;`TH^$qp|$Q|`0O%0`C9*l0gS}X7F zRW^$bPf$$q8w76q-*9AU$+7|42oDX}$OHQIGdQrPHe+vF(wbl}i~}(0{9`Q*XILNc z<9!Cs6VINU3=5A8^|UZA-nSWdI?HGaAoF~He~6KIaHlO~`M?Od0rCp%J`4Tmk)Id| zi#_ioAR2u!&116NCd~6OHBKj8izk8y8u?|V8kcJ_1)2Wq@cV@GX)T;A#7*0*`PHUQ z&Z#|-#ryKiqD^`M@AL?|5}$K$1lu$sZ9Mw^3P0Q6&KvIc*BaC`F;Hj@ll2OyYImv& z(N@AgJA%r5-JuBIFDQv*dw2XRqg#kkee3zC#((&bCM7_ z%buu*dZCc|YlIy^aY^?Gy=-xSFb*oFad<5Q2NfDcIY~CIg3@xrz_5#OmXD*P^sSCdPCUX&3u%fQ zHik0w4mX~~b|5&ypCFc96?K?q`^ljC1yJzX`=83SEf^=UX=X{ripnA`qiiPAE^_@^ z#g_E{hQ&svne2r>pJuYtOg1;6)^d(ASsFJ&;xsIscKAJDOrY!-TlFRzKQ?)~HZ0^5 zuvnWVpWw969C#F!eV_1MX@xY6hv{3yPntrICa&n81eNx~D3Y82@=eVY9AFWrG(8&u z;@W&~q{yxZ1cf6Gbwfdl92$zvf|;o5;-s%fX$J0zCWjMD{%JsInn;cObmu3Rk4`Ff zb+1lO3UFAd@m`?-4IAh`VvAZ^k4~>;CH-=Qpr=JO851Vd41>CY5^w2r)FqLtg90&$ zAA-=nlmIqpzqFH?%}Q-^zfwAP#U;xw=)4uDUmb-{_Vfkr zYm&f=)&Q{Lho+P^Ci=)T1ntBVuIVv+gJYN<5SU$&_(n}ATICz)wV&ElK(Bs)*b3=L z<)}Vyc1G;O@En3V5K+n0LCu~cfI|%xJZ(RpKu0ka>>>V%{Z@$W7J#7+geopgKj* zRVc{=p*SqAi4+Zst>;1w8Y*N&dakaZZAhRRs0~Sa!v7$1K~tjaKSlWRqx8(TY4Dhi zB5Dj^$<@0$Dr;LaP@&-?8sAmVOoOmr76ww4yoA5Q6QY(}Dbev-cfoa^WAgw|OrkOI z6mA)pEJV((ehzcI>FT6EYQl3u$}25`lfugf2_ll50zGblAh#Cb(IYhuDS+6&phTpz z7lxPGTF>f6EG)$&yvHLhI+gIo59j9=SNR#a$G=v|8jK!ckkd^p6&ECp>!bc6yW4Y*IJt?z zjl*kf5d2p11xi2PqYflySk%W*V=?%cK|){^cg9JNWAra+xJch==ZuUL%Hot#VJyVu znV5cWf+hpkPx7MC$1w9Gfq))!=1=*z)4zLO)N__9r@)kjwU63FQ}mnwp`Z<)Q3Kmz^t{~Ea6I7TM94;| z%`ZzdD!IYziR6JGlS}_XkM*h#PN|cm&dqmV9Ow{Jqm-v}rOFe$RcFg%;T9&YdPL($ zGi9DyG}13R1~J{(_>8_nfqh?X}FBt^gR+=a;5{tD(HBf8>TZ@=@UVh z355hu*qyn4vsBucrJd#)4(O$E((4NJT)TOrkZipD4@tJMJrX9YWuTLkkl`CC4(grh ztuw@{3T*b5H0j! z5%);qd+CEc*L_yW%R!?9!rt&}wN1cb&Y zCW9y*ZYt{$bEMjkUnO+HTXt0tClx|2#za+t-B?J#Rz~8hLda1=Y^9Hp>vu*Rj;y~{ zBAorM`o3<6>gX2ts{6IgvKvCgjvg{Z!d5545IT$_wuEC?4&BxO!4jzd(*Xo$DbXeJ zIW1R2KKQYw$)v?GK;Ur7GWo0Xm!S7F!~squ8FLan!QRQaiWzvL6aZyoHLA@Yu~R3Q zNH7qCE_5(1&({5+$0C(*?s1ZWC9Ug!ox4~0M?9fFS?CT_RN>N;U> zI-{!4pqR3oMSm*~?@KolFC@r3(ZO~y0NSipq$4hoK@lFJzEym_vsOT?Ta^yizWT@^ zePB&kz3(!+*x}-0CN2AdMa#Z=WxiP7uk98k>CAYhVA4w^w?6#f*Vd&j@5GOaVtr6O zNI-@&4syiu%B4wnom#GB=2orrak;iv+DSg#Q$^|z$~&cpdr7HQ-A`Zoudm&jO^@tf z{Xc{Y!!BfV513;zM+b7ajt4r?GTUl{#2yHb)THu_E>B`3mEi#$jE8Zlltp27ad8$x zBsOq$uMcZMR0W;1=_Gd8A*+9?G6Z37+CreiDG(cwo2>tF{^R$f0Y9#YOC$-mS|M1> z16{$hSU$Rx1v6W^3Ah{#?R1*x!k=G#Fr6lvP7~z|N2NH*U6FqzpX?G(scZOm z1gJZ-%9uq%-Gt|E6Ma!?mUxU<{pLCJW{wq$#F19{>zEQ5^gAyGcL_Zxn6YNO=ngn? z6h@N)0{&i?9vW4xArUq(td?k=4Hz!523~NrB+oZXR=rFEIhJ~Y*>FmQKcNz!+Wy2` zW_Zh9{lGLQy%$jPg;N0S7J})+ceepdk14yM=CR39d&J@cLE0edQc*jId!aV=nx%u$ z2=NOy++I`J&Fn41DIJ;@vYPXvR^!zh()CcQdtBs~;gVFp6|B>!gUb^m-+L!9!*7u{_2v3Fvl(!$AU+HhdAdDx{%R^N5tVo;mh{_LS0#Iwlu&u#Vq~7_ont_-Wdw60#?IpSAC#>CZ ztlNvangKM5vQr)9-ZBpui8(IgwPo;#u~!qo-KYyl-^Tx8@71l;0xM zg)LXMZR+UUHTLLE%7U1&g_XN3qjnJJ=;uNeZv1EzJ=*$PIvuh42U2Y zBnAoyU0zHpij%{}NClFA9HArW92qRR?H0cssq}zKa1W+#Vhv)I)gZd>w&d7VyFjme zc&l`Nd1YxtW|s6392_#UkRzzX@Hp9XE3_pt^*Un78;DxG(3y-FKMM4?fPhW(Kx~}I zYBA||iF0{G+<-Lr{h=XgdTh+HWt51$M&H`mu?nV3HFzL#YeydX8E*wg9eAaht+Vts zw^~>6T~9IIeh`uc86DPy59{Dip6L%O-it0pPk;whASeUWIXuSM-iNd2iv+8A91#l^ zi4$2CB>s@rm>O49ImftO zC$}MFEII?q^xN?`AI{R}$75>1kB6E}IN&Koc1jrMGGkfCWHGmOe*R1A_m~8vGCyCk z=z_jumP+=|$7D?TPqIv>#V{g83;2#n2cD8I2i)YSERNg4bPdc4?Ju6j4NkU!Jw5|jz);92cDU!di1TahVnD8)4NC-oryygy+5)46jiY^XN54L|h_+}E1f2ig-vH%ZnTD{eKX+m`xplR673r+U^LXG6Ja#h_O8}I3N{O&2rL{L(c{K2H{w( z!>4+x@{U(~{Y9w$mf8zh3DsbUjKAms@bR3!2CIl(gmq#GtE}+({vqrZomNe7XXFVN z_)}5)pn2tfGqndiIWjRgaGA?Km=`;To#zRI<3uL!S$OxAdmv*Kl4-K`DY9Vaue_l? zxUQ{s3M(8TV^(>)RwYy}EZ#;iSW6Pt=i~ylBy7B@xlXMhd&hLvO7h#4IWq zTdl3Fd7kFw#0(JqiUwN%DfiZb#w{r6Z`BqZMTqS8GBF$0@1;Au_@jO=f<@8w9};6x zq^iUps3qPtUHi8-Wd zk(*`ap1R>!Ek%pSxEUzqGCv&2`BBv@Lx!nplbe+))vs1% zgS=<%RX`l89j*JIEPO8cg`b(p=IFxT+hM+dxqDqX$YPOjMQ=FN%r%|#4WnWf2l0?k zb!G9U=;BG?oTsZ{6-@`%1(t1~E|2N1EYUPwB5nuDm6~%38&=gUROtyFkj0rvc5!6Q z37j+DijV%dW|d;K-_y8R6Mi>K`JGH5=sT%pm0o25mYr53ZKT^s5pn`<%Cj_e&%i+R z-n=^(Glj zeCS8nfqb#QZz~>!fr#mR_$n<@4EB`)E{9?04WJ!(d?KULQW?Gah*J zq6Q8_z;8f^^H&iAb|=TVN8P3r{_F(97T~}P7vVN*P^B~34i!C66{V8BOU>X;1huon z^DTxfny6_+4xpY=T&rQ@K5-OpH)K>c7!#0)SEY1uwf zskHX-V6kH{@S9z(T4`!vuA9yt^?^3caRqJwIiikOOa8u^~yHB-YX8sPqAgwe37(c4l{R(8}nt zYY4zynvChE$xwWzdj4 zyyAg>*4_M_rV9_(JL)|nTT;4xV2^;K=%v^~k+=q=1`dRrdXhgvVC1kuBZ_3x)0z^~ zgA&~Zcy#wc_wskHqzLCE!rix@$b?_r?`b|LM5tYys ztr%Yc+3lB13`9F#5Qc9=w={A4o(TYl(l-ij$bFDhKDmLHnOb$jq!wA1)j~M&#J;Zs zE?_VaNc9cXzu^+A`c8zrN#NmlKTNY$(`gk#r)O2UiC&wqi-j1iPR>Lo8#*yn9B zu^q6tbq%%Cza|0m_6Z3FBL?2vq7U4nX32fi*esis3b{!K=1Hh-N!$GWn<;O^Mpy{Q zF{U)t1b7=215{vsoP}CErJx@L;XJm6@P?e)fu5o2#ibql91}UdkYgWr;vy?m+vtR~ zB6vmLMbQ19@T&h~0X{+0PuuP6cM!ks=VB9PO$R&?_cLBa#A}#e3R?JQiVe`jqEO93 zrm)ilmRu=|FWKDNp-rRa&(kD`E<2JJB^;k%T|MXM zZ}KbnKzyY5>F#Hu5dcHFvQPwG@dh2^0~xlHJ@PNb^#go^gXZUZD1!;u6D#|BIJq zBrHGkWm__6dtD8m1Su&d4V$G>I_Q-njdkGZLJ^UD8hlx^E0uKKs+uGZCH3S^xlpQA zx_HTdn9twg!iIItcyBZ@+9@nHSy9CM1%TQ(L}$TGF1l>E%z0p-SoZiU`pm$g>^Gpn zB5*?x1mh=OPtB8^FHuQC@xU_?VSmX3@K8+D{v0$AIxBwW98Or`a`M8Xg?Z_T1Z&E# z-FH2c?M#}2wRGsDuZx}xm5Y={mV}MylO!&n0pFL2=7F~bS$OxUl&=RnRGVX&xh$W7 zCT8ez?3$|~&8V<37tG{LW()AITAaL-_iW1j zPgYB-B-FlfK9xAbUC_UJAzPk7@xMEt7cc~-6drc?VA)D$sHDv(mG(#l0m9oAvsSdz zj!`b!TZB$$)pW?ZS!OP@-AzMo`Tg6ebN7G zd_ly1-rxzYm%*mQuRq}>U^22UnmRJcYpD5%7cIdYA)VncE^{8*(XI{fhlN?cvX#y` zl6|6C1`%$Ec>S@0M`wk|Op46Yy$$KNGB_vZTr_^S&IV%qK~`g^Z43s9hLOi9zj}r1 zn+xS(c#}-&IyXgOX!cex5sD}<4q$8@{|cc<*L`vc`XC9Psy(qz|;F(%k3Nlb$gks6M>9xAZY+3 zTnz9%o0*&*dcjYs{-m1+2pbw`@mNu67ycAu<}EB%{fQ@XT!t!vxeH_r)CLS~wSgj= z3nQC~mLefTtQu(GWyq{p>*Zd;MPQAe^6b0B_jG{&(EfcVXp_MY`Y!C1jV*f7Ye69^ z-OcDN%rTs|Hr*NvtK-}0Gl7i7_R&0Ga>@fcb?%2qUN6Z>=K8@BH0@ymP7%-*(gt$@ za-7K}=$QLy%0eaTKnG!JN*Aoj9c|8-0|qI$+Gh&<-HqTVY{)|(|@!c{iRdQ#6WjCm% zyH_q*<*vnMZrxe9$HhfEDSt(Su? zd+!)dao2DZ!i>eP#s=TXFQx*qJ~vOrLxQ2#ls;DICLlbCPYtChHI<*X1#ue0tvdwWec*+~S~Zg=3;0@-cZkhgoHV>fB8obS<`=iug$&>$H@rx^JUO#F?B(v!yba@HXf#7NbJxxHzzy#p`2tQ?=wJfr9`Cb(`#bl7=OG2U)i zPg~{TZLle2xuJr*Qv_~|*Sw0J6YG;P_tUm)Apc*OkaEO-)BW<5w66jPgQN#w`#j<) zGfs<+v`Wud#MBLzDmJ)V*Y}yAQIuZ50l9BGr6Rd+6-~w^F~kA{oPs2uzk7`y^KMF$ zP=r6a=7=}&%)XS?1ie8wGNkP{Y|GKPR{O}xa3E71q5dEJTl#{7zL9r|+(YU%?u)^& zqH$j$^YvQp!Xd|@Kw9ew$E?1H^koPF%m6tdX%bmWDMmT~0o*54K4j7){MPi;OiG}a z7eW>_51|*NW$RX4dKBHj3s9Lp&f0-+V#hQSoz`(PkvPF+7v7Ao=+sk2gbNU|ZP%tpxXc(Y`qY$$sML)gE0q8^RrdwoDLF#wa#NtP-ID%7}VDkVL&* z6VDh#4u=vW1tR9+bWX+J`kR<|c>vHv4fMef(PoZ#S3@u!UUm&WcF=eC-Tb}xnL$NX zx=A7N?)?>nva{sgbS^VXI5djeq@p^=7xGin5bb~B`&IXvhU^8DBK$t5J0IG<$7KP+k>HrT3N+`E$UqD1TNl$H4B z6Yfc|Z-_38hh(f!GOVo%7W?~O4joZJKs&|~kOpH|(+_w^;FNHy4cWGpC$M)?I+VLd zs2PHB4SQ)MTh7*Z2Ru5 zJECxe8;kXjbV(hPc``S`!{*>$ehO$+p7M3$+wzM01gr@Jm4xQ$1V0M?QdWZ#Q9$t0 z_uQ`uR<*Pww-{3V$e|$F=(6jpc7c)t;?P-z>1E);_`>8$5CbZE2BV1?x*b^~UO4P5soBE+j6Y z(f~5?NScHq+{fZ=9ibRV>pPS=rj&Wc=#jqafV#v#w7!=JMb172mj(~5F~3TZrF_PP zbl~koDxfT9b9s{40wgtEYk#I0Z)*`t7vk!#P3F@3QdW?}lwNHDSSPk&PKW?yv$27@ z5*=d&hFTxWjPjycsTk`fF+5xuq|ilmwm3H*3r1QO{SFn+LU@0V0C;fXvpZ8*GRr%V zpuFK@d_a86wW&~JjBn7X1%oGngpi2oC~%x$sj%#a^2qDXh$eg9My5lcX=)|LeMg^Z zJ3eXZnjqbpgIqngRly=T;ycIbI?m^2iTFl@eb#!3adNITp0|*|un~YP2un%Ki)x+0 z-|1?Nn$2Adgl}=A`R`dA{NyU6)(X(4#3xyUzLfV?ADD$|+A&M;I&@VRjqU9&q8INi zFLK5QwFIvoULY5|^1gOUO2ETb^6b#h6ziqfLu3In3mjep)9bl785m1^4u_@TSK|It z=L%va87}5FJprnbu-M|DOHSED`1+DjsqETLv1<~uvXnwfPz>kQ(R32_ zTHPD-10tEG>MHua20P`cd}}G#LIwU87_lYTjKV_4#dr_#{_%KLANYo(+P#; zRlKaPzkzJ(Iy_7!+=FVPTHUT(zjkeRclWBjYgD$c+Rpklzv_tHzH88xj<`N}2buTG zJ+fdr)(+~OTeUK_z{qw><1F2HZ{b!}+9XQnHTU`uSAkk}e=4diJbvA|wNOggE&$ju7)WSdu@$j&FMoMP-OzSUSVu;){duA zo1<=39_NA5K0*YPN>}PDfcL!D;75s}-SK_@K` zfhvo&S|k`s7w?VMiPBsZh3R>$7ZFWO@pgFg!lod*3i2Rv5r!{7YC%F>*ktLo^8@BF zAY;PmRYlGcpf0VZ4~qkTtql~^#;(+|BZDP1lVB)mcO`d;&AP|PH z8oDnEbkE!sMCrMu`7H(8IVAF*-?gfR4SLC}m?d+2!!DcTeX~k0pUtkFgZ#?-DFOFC zfj|$3(ek(;Plh(webEveuUKL(lE+`DTN3a&Qmo(6kFD=pKd_(ZW9Ux;5e7obav!cA zeD0VjPd&Tph-0>b^ZrSqP8R9Hnib4!5Mc{4u)53b>>acHY|tgD7uDNPx9w~6dV$9$ z_rmjbx$4-ZOL*~l0dnS1PaoDKU)jJ5<0S5*Ev_B`Rh_XGXZJt)ggI zWae5*3yTQjz(eHff{uh+D+!>W0>T??6s9Q_E7Sjagfy#usDhW>M(vOWJ$QtA_R`c~ z198zrhld*=y{=g@#`1v{l&BkN@OC}{s!>J(83D}UEmB}MVH%{~CqV?BeOz70B% z*t(6w7~+c0*QHDoE|6y}>u?~$Wru*t_8cg(U8pi{OtcKB5YLqI7!NW^(gzOyIWO&5 z<#n=TINdAGT3(Wc{chK$FGLpBb;#=yh$5kQAQ)_qQ`#VW$_q_y2slU`;#+dZPZ6|s zrr?&eIs7lhy~G-k9Y-bhz9tN6!bX1SbF(${to3OAQljmHsUule#9OKa0W0)i1YH=V z9&M=bMELOh?8;?-_7&csA#Agr*dkT9&+(=ekni)?IdCd5jfBx!BBLfy^7>q$GdQGU z@Xy?qT{SNWGq`-~PD%^OW19O3Ea|bg>z;(<$?Ueo8n(ZJj+C$Awyk@DE`5kNJm>WW zU5xStqhzeo0X{GRFmW5H>nh!nr2GfB0V=^_L7($Xtk)HW>)wZ+aLN6SgnpOx)jTnW zHq{YVXWq!@hl_WWbe^l+IBC@Zl83Y(3LC>a1Ncat!N5agdPqH%@2U41@#2@|#O8$; z`+J_ogxbi5z8hQdX_-D_eZZ+?vp)^HbY;-m(?q2iR(k2?I6Zf{3gg$q!+3|3_(-$( zylxZInaofet;iPk3CdDSL%|l&HAym&JeNuHBT)(U60^9F)X@V>gLxcXk&ft};~_oXy&H z*9lMZbBmnu#Fuk93@_Lc1>KdInEPi^^18;w5 zFchvR*pQC9WHkLHg;FmcdY#m>!7ojgB1dn|HEX@r-HuW`l*1PL1*$orxuTU_*q_O~ z+q3wjZ9xqPIX$8I-1xv7>bPN&3}#bxO(xK2uXoxci#rgCoutHOHI!Wb;t+4Qc()6x z4qhSm+FL&WH?G?UynaQFuk%d373^4tsekFO!=X}|+4&O7NP-IxhX<*I z8fs(M`oPneOKG*rYqqn6cq5}+B<2pod2bnIdV6klv9VYF&dtRu0y3juq0gmR1*i0^ z^(sJVt`H3bU=A&Pt7z6K2~z)0WW-cy_QouxPnBB_F%VIxJV5|MKYuQ&mYV+do^4+{ zGN9)Sg)AcA+e7~ON>}FKXA;4P(7&|)EggFOoCe&BF!LL;6e{ z|L>q;Wj5gvD5*!td8sy-29r_EVsTuYU_e7q8B4TqPLcz)GpNW6@e1HG%rLpBAhkbJ zNY+kp%?PWt5EV~sq?-lBb(H9R0N_ow;y?27ZKVl{CY z0#%Bsb87tbp_)`kLBuGMon4ah>Vzc?wuX!gyDB z{=OFId#~XKnl@$lO0f7F+4`*|dt@^Gi}yrZws6$giC%nR zOBU8hC?OehB+{|UJggxIilE$e8Mi6r>rCExet(fG*e3o8xrm$KJcjb4AISTzg;+eF zQuH>kISW)TdA3$utG+L#e9>KSaD->*VYZazi*X$uGUhp44ITM|4vXnqJTdXWY&toC z@#Yc@z#W>i;26|guNWortEyG9s+Nh(+}@vC>6+cK@~ijtwBAwjuh8-}xa+EztfI`A zH}~R(3w;R?j873-2f!zJaC|1TS`mK=0g(f)e?^PL4s!mJGqVFPAXa(3WNIj9y4D^R zB;rpkU)R0>fFqJYSr4jYwdMcaLlbjy&T|yr-sh0|{gR{X(rph|_J9RHK#M|1r9o8- zW*N>n&sDvplxiqFO4K4%?C#~VIEYZtCm082UtYTNep*CZuB0O7!W}y=ausHV*mIES zu|T(;{S^1HAOcetptINL!omRp&^yG3AT)Ih_D~&2IXSJHXHMv69w4q!klFDyy2nV? zl|a|I9f5(u;EC&exD*E5Q$NFMNM0pyg2yurJNj@q5;|}kN#0s7r>WYWyA%qjeEwc4 zlEWz+^`Lef(SgYiRPMq9seZ$t?4tHr<>NkeQPfXF7b;zdoa%~sxCt3sQtRjX7Y_8QqT zs-|NZrS4&aZ`_lKP+y_AhMuR1i9Te=e62Q@M5Z5b{m{a}Q^Yp+sV2eCvm$P*wFbZ; z16`ILJBC#E##Lr{hDO0nnsao&6Zn`TooSV?4&h9*XXRv8-k zV^6j#76kg{%0_9gVs%dh=jT$Yh`ds(rcv&c6t--U!h147uv^K`1$(QiH8Yyts;*1~ zGv!KC1TF1NN=bCKJe@3c!c2tCa>Nr{JmxP(T*MjCZW|^L`xR^%|`6Wbc3tjK1{c4ZZOIrS=Qeets@L_(>;mtcvE2 zS+chovW1kaHM6i+=w1)S{K8#EX!;Xu*r}4@fYWu1U6iaab9di zq&@WvWGN4fN-2m`@^B}-Nsc!os3#3?;43kfIrdB!1IDbHwps$>at|N?3b@Rrr!nv{ zRHY{9TCGGxNN&+AY#3#$vemWhh>v^7lN0GElB(x2(&O!vLGb!k93YL;=b40Tmg1d& zh^mMbW4s)So=RU_mwFZ@Uy(6_faJhYw3{tViJ#XO?mXCzhFeV~*j7l?*}M)gweO`% zV45AtyQvQjP0yC!zl}{*WDT)9VT8!QMI=Acd-DU&padtdL{DG89Kp^~D{p!TJsHnn zivGN$jIPf>bcT|dJ<>Ap5Jv={cMQYx9+TI)~ zc9CbCxoj!HR^|x?`h5A$IA&#IIoXdZIbT28mt{=lhZwNOnmJU0=&(H0FcfHmL%v)e zn3nrq^#>h6;V{d-c6W|?7g2kvTUm=*3)Ciqy!W0ZIgqIZnnp9;8W_#;h zJi#RKSZ^o&{1@~;IRFr;0Y54f4TFKWT!S2nv$BnLd!z*US7qR!9%D@@j;TW+J&A>b!rU2oI&TDq`d z7B)%MCRP4HtzXC=YJ>{}hF!2$ zMe|rqa^444KJ(T)dmsd7Zk{Dn&AO#R+Y>RZ>+Y`F+IM61%Tq}vMh zGFMtnPguaC*frW&lm`a*!1e4wYCc8{2?9r7E2PVB2t82SPq6s|9?Gygq)FJSc;8MH z4_%mrmzy1GNJ25J0?8MJiA2~^B!nj2>)I>zk#Mto>3J#tHQD6eesDF|$DUZuz#o3e zmUY+IGacCtsB6mqZax*>!A4dSf`G^)1mJw>sLGh%IYDC$^A>>Z^u@Yg;2(tc);W@1 zsZ!*QM+Rl-F+`q4yxV`;2R}}%V5KXJ8Ftw$8G99CICiaE>?UG*Eu2v@u zV;$09k=YCEfob*p^Q2uJWd}76+TE@^Lfst(O#{{_)G?l6TvmspZfFDo@5zQ9Y^%d* zpPi4u#!3Z-!Je7Q4SY4&ic_mpsby+@M0FBG7|rsI<=EwJGIy-pyeYa1gC6ikF=U5W z9^ltTiXv1@T}xr(xf50S&_pST2-WF;K~2em5Fk7drh#B2KJ?V_4}RAMAuLNJqslm6 zSe&cYJ@CuQ(xQql#Clv|J}A`Yyv3dHBiheA-1YC|7tcw@2HY7P!s;YIWPv@|upN`P zqlk{q2+}|B*(r~XDl>m3Q=~4nQH%G_ZgT)Xi^3iu8ki?`+#nf?!E#LGSD3>cQpsbb z|5m|7JE~i9C#@h3f%OTULioUvZ(NhH7JtuMb???RTy@5AC2nZtRB}Q2D9n9~SJLZK zy2wD~$59)32PE`5#d|(_;Rzt{b4zzpe%Jy`>oZ<({bfq?p7@6x;HcJr%J6=$V4|U? zA`;%k3pg;Z@BoOK6bKr91F<)5Qi>Y9mf(tEpTb-ON}L^sZ-WzNC&7nAbjw#xTbvUI zr{$uK+}~>#A)HA4k!o4++84Yd6k4(~fMLSjA-tkv9wWrEmani+24CD~+Ppev9dp5( zY8yyQ3Vp>Dm6~oE^n?GavIRHIvRScf4n6r@FIyk`)$*Mb?}O`>WP27oShuZKe|tj7 z{3?R2A@Z;sp?}jvKs=@k_2@aFQI5lUXK(@>&!Bp`0|pI9yJRx#&3KX68TaC4i(W4Q zhoFibct1QKOn2>WRvS`Dx_iDP$+eCvIoi~4T@Yl3ar*i*96;@M%8im!bghSAf6;p` z?GgI(Kh`cqUHt0Kg4ksV)mPh}>RW1uDv+o?+z5}NL!`t1{+tT`fCuhvq*#w6={?XR z%TKhp^1;X7d|*0V6&-27dp7WzLK7zDK^KGj<|?*6fJ`2J{8p{p<+51LOeBl?S`ERA>~C?vS>#kY zQ1JeM$q<0?aPNZy5TY1dUXM3u=m*LH$I{6V6utUL#D%BR5^cuZK9`a`j~n8kfLN>8 z@7oH)ISM9gjgcaGZ1S)GvG4o>^nG9<%4;kTIRp}zw+owQmDu!x>t?F$em<`dXSi_F zx=RkpJQO)0P0kIIUXsYxZ8P(Q`g?yk*?mQ<$U+3@K|MhL&LWTEr>Arxd+e;1y_CmEqte-;@&UltlDdQ1*oGzv^(9+0XPvn+4>z+3R#bO^` z&5h5Jc}DlS#%`!?g=Wz+K}F3S6K^6skS3059DXRssv0shwvV9<>=? zdUG{EOcu>m9o{va;OepF>sKPO_c%l5w!!;L=(-S7{&+WKJ;P3pRG!lqPo*1WAIs@Toa9$6l zq69N8v)G7tX{) zy7wj1_O4Ocj=TBUPS*E(@4(vCO;(d;FRn?WB$&^cd*&sDkXFvVzrIMYY;6tZ_F%(UcHNpzg&iXHJ_&C|COdtpn*r~X-oST?vn@K~cRI@W&5iqvUw&ny zb;F9e3_6bu(`2)8EVI%TgC}S!%(H<>o(;?(ICS77ty}Fmn@M(STfcMh5$eje8WH=L zoCAqo6yn|MtcXSgsQl>~#T2h&;KI!S%Akbcb83b#DaFjXc(>?=UEEtSKkCS;{1H>l zzKRHRLF9X$L9JOxnut16kXmJbXv)>RoP734$ozKuqn)g&5RH7mgs$0=mg5YF{kjC$ZsRI zLVQ}KUpJg$;#+#D(For;>)iR(Dg4Puh3^lRdhJE4%!1?8ShUyD)eSn8%d!{m@PQfq z@d^x_toonql1K;V-L)IwQl0*wAY4=&ry|91CQ=+>st#j8yCgBp%K?)Wzg*Y6W-;Hc ziQOf8%;J4IxaV|IHxrpL$|+K((9(BB$i8)-pQHwwm}^>ynGP4zs;lu(z%ijk0Bywy2+3DVfeS@j~6S zCX?TW#XBp@Hvv{jEy4Syu~}vc@Fsn}>415d@WxCh99ojD|E_s;%c?pi=)u9-gQfX9 zu4yi;@e19PTDf4Al0F$zr7a}bdA}x+XdMERn z@d4d=-`?I8-6Y7E_|@I{E4|wCE`?4mu;q8>2Yt8QS{O2Ub=(^%OM2hB1olv@&Ko7; zV>D&v0~!K*IU! z0nQobk%dg_(!9>!LrXupF*hv z6fcFWHW7qvtf#d?hootO@|-)=oSN@t`x}tCaQ5e~y;9WF zwB__J5PON25FvZ+Qd0PNaqC!R?q|r~M+Pnc{{9401*mZ_q5Cywk>DgdyyBwHTSoKX zMeq!!kO;_qAr7=WVAUung^frlyo_A;xf^gMDFPdwt}+T8Lz6F$po36Ig?Q}>wh-gO zaSr#IkRPQb0~;sdxXX0%VAOBDYv7XkD{n$o;Mm+1#09*-kW~m_qiDdOFFQ=Q$e|0X z@$Z~FoypDt<6R3`jk{NPu@g3?{s{wj7g`ifgdBHqK>*!Grfv`TKqoOlCN7u=JQB{j z{ve;MuK?%-iW~yVaH4G@z)>SDrQaiHB&s9-1A1WWM-VT|o}?jXhc|DnD=g`L@>^cm z=8_U(|BX}BY&?J}xuk+j{j81$N^zeCy7ftN9|48&26bP-$hZiAB~q>&-^HOaKXXcg z*BtQFW&2$?GXKmC0Z~(W8mdATIz2R;5JhR;izQUiQh_#xA^>hr zF|3Nk=F~qaJA>jY8qH{!>>kS^Azq;KnIKZSaJ!SFY(t&lQU1l*F+yeVBtM*EAZO;315vf$xAkNpnisgEt+PF z2PiGaTo{|7mg_(C`>P@cv81k$Y@NdJl$t68LC42ZUbm|A9W)Sx6m1|;iQ#F{13$~@Q~hxxg2j07KwZVv|c{QWUgkIOVOkH#R+9-qn&sa4z&D~?1jskg4t6YR@J;9UhwpdjBZC0@q(HHWeM=i* zjsl-!SlmHpx)#3a|3$K8` zjAC7igDXNf)XG92K;8dbucmfA2oy{fa8byJY*4mTslUu47fJ zW|>%Jvb|T`@G%-C99U0q^%BnE<4UdCTjZAQtTUXkUAj(gn`M9?(A8p7bIc91T!B)+ z8}}9~WX+-9pSO$VFYl6jwd!^)7V<(D)}D>RH%%+}rVqz6Q)}Z>nYFA@EEK4rGC7_# za+xV(HD^w(P0dVB77CM76S=NfFMp+qPCkEe6fr1d`q&oIeEoRR4FNO2m>tJ9e)dc9snbn$`@8fw(ht{|kS*KvcNzAblEMEAiuK@^ z^LDAWRpy_t-+MkN+wa^k%0>BKA1MEY`f@xwE|yiD`)$W6vLDy!zx0VXzf5jMV8Xlm z`8CfRsyHb}P7Z53#Vb^unkoNEe5ru{yX2gwja0?Id;LK{d|oowI;oqYFwHkGOV+OSRC^7MLAYq(J9Y<8lz=TB?aC5+F^WU}YF zIKA77iM~A0+40GlJ~`0YK07;`y5;Hhq}Fhu(%D?D4-a(0NZd>|u=ss+pyzJp)0!Ff z{76rXPiMPyOglc(xv9Qdo=x5I^mD`f@nCZV;I!;1n*D>Z{$v3azD)CL@tts2v3m**9TYseu6gS=MBvja3 zCpYI|vu_shpZU0Zo>cnPJ!qc^6wP%NixLJexB!lb{lveA)ch|X=bSHpTObT z9yB_8-aimnGQj3OXRSC9tOT&zz=M2G;Bc1Xl!BE)I1z8IrSw!HmKvg*|RzgAN7hy6CLRwP9Cq20!|T zCH`SAO-zRg@0eqF$Me@V47vDLtIt;au2rsmL?*A!cpaP0w7fRXkT4tlSnGSB&&!TyrmjRp9HM9L(=2NhZC6%@HM1484^7qQkwuvR z*geF?WWcH~yhT4Xz5GM&levrr)K%2ky}dkW5m1H!y`5`)c|B97NGVQn`?h}qD(slB zCZ!NHz+v)GOHQk1&1pZ41Vd><@8mTg+Gx)=Vxr*nMEZ79g=qCbOM z;D`mGPWhR9jm1oGIlB$q0M+_h!2fxf@1bweqN=JOx5?bn9o=k`7)EP=By_57KsniMvwVq067Q5PXjHhSJ@NtZ6WH$a0B9Fk zuH|1Zt^8*B{oB8pyL2S4Q_7h*93 z$cwQMB$4L2pc|B?QA#C8sw;ebetO!vYz-uUPzoKN2N)R}fHV_H;ytdmKn~Qtrx&%V{t$%2u8(RC$BOp>V5NUz|k>aiI<-tW`%Mav>4vCtWg|aIpL4M^&@ToHtV4FbRKCQnt&5^V>^}q(w8ezS1YN z31bJAZ_SgL$;-vh4v%Q`ike|$tqz1_^nizFBpH}f>R-v|5{IG~yw@uq$X@o(%Cm(h zV-pKE^VjJA%yl7)JlceFr*>x~{k>WE<@qjfB#qYn+^O9t*}H32Wn;AXy)eT@Qs0|} zrNaOM-e_9)|^R{V_>gC)~AWiE7eJ#TTSN?ch#XJ+HD#L?UVk*VLnalDyS@z@;%+m zZkEhK)v?P~ffVeb$u^&i-JHL1C51qy03wRWmX>kbZPMxeIb=rUwo$UJ%C&jB#vnUn zkxqe(-JV~(!iHg7ChgDK-_UPelxDDmj_?F??4G7!pCWpS0h_QPHTKmyM7k)* z%p+&dbLhKugk(HIn(99vld*Z2KxoU(z_@^_P+DDKC$WHl%GP7?d;5m<6o0L2`P(ZT zg-75hCUt1)FrE`TO*ko$yBoMd2b|BBbiECPpvGEWNJ8Niv82w<~ouZJ>hOT88MyY z+O7Pq{Ro>R)B`y?p4{~%6IpJ~lf{#@_2;ApAy@k?a*O_J>;Gwe)B3*k`_}i`G@zgv zRr0=sdiRXN;hWa~+xq9$Z(IM?`U8E;|7v~59w8>w0EP!XA)Gl9Pyo>&bU|rDxMEJyY1+zNK&QudV+^ z=l-3CWuU#UW7n_G}9vD*g zXSna*wf^8+yy&F+AL!Dt;(rhS2-|d)!DacVM(Z%e#(s%8+&X>hhw!3E=&es+10WzE zI8-*NjHDQ8$${VtfyL85) zn(Cm1B$tC!HV0G<@eh@?W#8r9z62vAC)x#0egF-G<!RTjqYM``!=&|Bc?d&PBY!3=-g892IhR;YhpT6H2jnY*PFMFlWaJ3a0TLw^JYMZKacFCNen8GKX|N}Jds%V-s6bc0{$=|c zd7-?N-bOeIWv$o~B9^8MJ9J+qNL!)B)y{GaBH(sbg-bV4jEe%KZ4pH>u=LC-x)N#Xt? zCsHS4o8}(br4I!NTZH}9;I}UQP%9$7N7l;t(7!$WR@xF$iqUxef}KSs(7vX3d^p}I zPdpW5^)WpZ^sw+`}e{rmScu;F>BvD5Ih|+4acY2$!S@IC{iF*jG$9L#G>W4+&&kSEl${*!XNiUxHpn zjzH#P(n;;Jtwg3aCc1D0!TJf_cZc2`jozA$c)Gp^DFm)J<%J1v5?F^>oCub|Pl0*t z33SWV9ouVRN=%htSR2iryKOX^=&wHICi4+*zZrRMz`66EbFoj7{Se3-zvQ^(y0;f% zt8vA(3Kc1S4X<$wxLWvQ-h0XehE^Y~Q}l?&4%(6+0|>wNsyQl6V@z5DQg}r`w_zx3 zd)q)$%hN6Enof*B_sKN_p16eI1!gfAh$ov!bzi2=fr2;;QVVr5DB-E z^MW95`8Tp#ZM3KuvU`Np1#msZ`$p1#L2oocvx06uK_%k3Qs9dBv=PR0^aRkIXRTNM zf(4y`oM#fz9rg#eBtD@tV&8Ar@~X4^y^CO^S2i+IK8x} z=sz?67$fGwaT2ERIq~&WROa37s2Qj@R%Hx~`!7T$;EX3?==0ehAIbL8{x#!4&sScS z`}4z{N1P}BP)Ri~H@<-tuyLg4g*L&;0(x^ducW+z|MTXP*x1aoigHMKTV1gu5CNFG zIk#{rvBw{L4v{C$?2R1x`U-oMGgHa>RYOpj|3Qi+$8D-3a zUcuZCveApe-O2Z&ZU7!&d$t$MN7PX>+yBrEq*;NeVMncNS?k)#(1Je*wtE(s<3iocXd|S8 zGOWq1zCW^(iu`cKFbfmrY%#M|SX<4l<;Jtcsf=k%n^Tj;LSbrVCOezW<%(U&JANtUU!J_+2?@h{WQFYNPApUftJ}K8wr5%Gj)*=k1KKR z46z=*Oks&`m!}!w5SV+ z;NJk0^}kww#Bv3^uRO=t#k_&j0m{HnvM*k+4sU+I3?IySD@7^tq@9Y=>y9Y! z@p2VC5D*2x8wkKuLTK;bhMan4c1D{!zwqbRb_Xuk9@JSrC!yDV=zwS3doeK$&wA9R z_By7Le`jtYoy+t^SJlb!g!}D6@67CY;N=D*=9y>^s}JO?f5a?d@CmkPof%IDx}S{% ztv3p7Vx|j?=tc@{BxhcQ);D4{QfNahXcPT{tr;n_p_Vgdp;TE=$pp69W zG6e0tn|&i`quX;>2FK)W?3&A)tVF4`LG{k z8)7sg`5wvlaLV^Y|0wUb&s!gfc2`w*ra$C5mwfH~L}oflWk)YfC&ey*Z)|PFU=;A`37$jXF zJ;_XD$NN}My*(n<7rZ)?;|Y@#a1jd_K5wsxv46q}x1oCWn)*9$arWdn#o1}BlS%uU zmh7jY% zmnwPME``;O@?JhoEI@n7s{=WEu&<~Q%6+xdg%@fQQM_VxM2z9kkLYYWnw;htj`=P~THsv@g3kyE=v+raGQ?Rw~_J^BxGwRKr=f%UP?~ z7q(euJbBw}HZvZ8M)i?xRwch6nd@YW{OybXAd}OX@kuf^IYkz&8&^_foBgtbP!M}q zRy-^-JDHmzW0~0tKa4$PLOw2=otdGJ%Z5I#*Gt*QyiS!au{mAjj3pfN2VT+HOh1PL zxABa<4|1ISKQhxyjAytUJM@<`9UO~oJY(`<^oUJOUiex3h{>nr$k;?S^l80b$UZ({ zt9^9B5>6S%@cR0kS2ROPvW)7dsMOp}c8z++{I`*AL zC8e~Cuzuo1L0ue3hq*m64>b(JaZ)&%yeG?SUJLtOE-ELQ9anOq-ehRlJEUD2&Gcq* ztr9mK+7YGofA4TP>tu{-+=>n@6qXI1QJTJbhD@ox133I1Xrc1W$z7bp;96h>IcJ`xa!LiC-8j7n+V`cj(n&x{)q(7CrWk&s`t zoz84wyf8Uy7INnFggKF&nOe(bXJ)gr#p&!!ajG~oK9!vsFA4~8vYuS${%llmK+A~z zcKCH8aOcS1iyuE3fjhf5%MrM91nwMxJG(u#5xBFLf-wSj4*v-oA>umokw@A35hAY7 zj_e2#H#)K-MBG3f*%2acbYL&{zz#klP8a_6GhQga%Z~eg=S6-^DflNA2YbqUFTY}t zwlwsL#a6!cw6}3`R{&ps^3Q;%Gw`);)~s37eBP*^Jns+98_>310%t=5+W@mZ^UwlU zcB8J7zdd|L|1Y$OG_X80TcH#F_24l+h3Uof-OpPH7)*4d5zjw2s&@ zq~}U<0`=E?2O^V2Rb#XL3A+i?t^a`g{TN!;pAw(zhw1(_J1&JqBrkoWmVy@-=UP4(ANM5H7CxdRz(e+8eQX$PIt8EqL@ z1E36Zx6o(>Q3h8dt5+4 z=t%`!@BH-9YupXI2J;t>*cM>)z;lYh`Fua{C$AW1X2_q2#o+goFDAhpTfgxo7&oCj zvhNpgO{@kZFMSQcqce70^X2iCg5p}-oS#4cy^@Mw{A>Gb>Wo7`>XbYG`ysJ|?^=KG zg)YJ=TX`(zNecf=7iz!*&i?le!d|*KcQ#>&iW<+)O$Bb>fx(q$6ORAixRjOf1$q-$ zhAyUirl&8wCRYgyG=IkElwD80)l88)@7>(V_)gy+THl49KKgeoAc?^_7KmekK{qgW z$WAAkXd&uTmqqZ`mU{!eIVFqmg2fBzyk4{X!At3{fI^V|N|#EdfA5Y>LVcx>dgyK_ z*B^tX%nNmj0TKa8_8m~b>?({7DTlo+6|8^f#`h`vW`MaHhbQn6lc_q3a8L<)OVl#G zqJ9A519`Q96oT&50{uK;)iW`jFhJR}1ketvCt;9~7kIrdw$eIUZaORS|{id4+PHvPdFLD%E2TW*T4TW)H!Zt>S` zVus5b{b96j@z*Vv&EUGxA4cmIcWUpYvlA1rZdLlj=4jpGuiK1Rx0%tpb+B%e-n=(o|j#a}m7zm3){{<^99ZM1H2r#4@s z|4as%vqtL`v0m9+E)!s)8?9IfyV$)2>dcRiM69C)V*tF-f_1Q9^tS9Td}6;Z*i>fn z@>^>U@`BA|W=BUd=G4~KiW}xg>36tbBc??4c;A_70`2{)guVbixe2etAV!V$_uzHEr0{9<%KChs(;2Sn3Tlg0QSDpT@ zsi`pF_1Y(}2z4?>e?G-Q`7GIn;9EhJ0(-(ypzjM?TtKZVxH{OeBS0b7+4LAp>kIm4 zU$nnbfOhna81-b6j(o}hz_4&In-p2Oo4=ON-@PI?ELi``o73nvCwxPLa+d-jVl!qa zY{ZMXSh6Mn2fyYohy};65Om?+UIfsnI`@BX{gz7C3lIiIUU0&WNnc%|{mVHU3)0k! ziG7c^4CofAWBS*0>pOCy>twaX@1tCb6k4K_vA zj7pW5JEpU@yJ0%!NG5wOlXExo>G@v77VPfiF&uD_tc%b(v)u_ASl9QpjV~ogO9s!#gDL4yjqjs0q9QwV3R7;hliW z(D;`KhQ=qHjPYUXCunDK%DW<~h&lFf4?ks7L&b`CvloDa13Ix})&6C2W?lGde0yPX z*{Mk_?Cspouk8*z9PZqc-#c|a;K;aMTO&7%3;8)RcC!ct!YOjII5|1fAF=U?T=KTb z%y?v%x?amnAD5PV$R)+CCQlJjiQgykGL@{n;2V#mSxGqL zz#BwP^>u^DK9(2O0%JMP`e5YyBtqH+$9QHu6GfUm5|2pn$alL-%1BDyFnrQ$DS<1; zDDRO?bB|Q4kNX7UF_AFDXdv#IPI~KT0%Ovp)(6IBJndE=LzNFJmV8Lvt!EG#gO87} zMiL4b53o)$9caL^m(Z8g?hd_GcXjf7omf!&}&lE&X!-3X=UF zw|)Y0{c~Ec`nQk8+dQxR=Gm0Vgy9_Q{H3$w7st0G-R*p`3*F8c{ndqEu%}H=CKJwW z^VN8R-U6)M2^3>v!SOznD?<(VLkMi|%U&2?L2>=l;Hfxc)z~k2&r?Qif67X?PgxY3 zeesC2PTXE|O6@iLAw0GYO&>&!xu)yJA)V(BQ0@N^N~TX?lJxkVTupk15(Yg&3HU#? z_hnaRR_+eLZ&(dj2W$rkar|%C51(MmF1`Yuf_mBWG^qXXApw=eKGdjhG6tQZUtrr4 zk{!=ZlGcl>0juN!Bbbw6xR@-5t_h6(K9 z@XG_%w~6W#P|asReZtsNo~ATSq?n>UV@e&A3se3F;wbPjUVzqm!gV#LU*RcWWCx*t z`~urYu@7SR31dFUwXomKMtLte#e3m*wWl9bx|oLLJ%T2&4SvypQ6AS($#kmm11+Jh zV^bx~93mIU`=SbdfiC+2c4Ff%neB?x^*iq;3IA0Ns&4S`|NXF*!ALOqHv*noCL}zg89^i%DI-_^QXF$?K zr?U@NHa%ot2)ZKC(+#PKptl;k`M<=`&{h!R3FC>LxKn!mx#4>1X?BY$=D=<1296+8 zD}mPqb>m$=s;&NtgikzRyb$A0nCbqwSzTd zU*}J`472k)wj4k4>FkSF;gStqviV}M<=p2I!&tZEDxKiO;Q&xEZ$C@nd#ijrW+$fC3ago}C{3TDR|(db8UK{4o>%O{lzMD({P=(zo_Qkx@+-*P7Fd5lQ3i$$^TFYeKI9B$Fdj%SSo5-% zD*HHaHK;KGMU30~33rs96q}S-M`@-MU|EqWj|tS7d+D4>9oXax0#_>DpK##Ov}7Cl zljn{ETpu%T_l44ByNEjHgx!r&m#XG3?AU(mgm442&YiEOSa;OD4bCgqIs~8VP#y2f z{$KJR1@Ry~1do}p3wk|I@Ckf;YOK(2wT@W_i<)Cq_pVkys&ckNW>uepi2*&#aZ4}+ z^#Zl_BF7jixncqN!f*z_Ta5m5qsIxth zC^0#D9b#P#W+i+Ddv^q9>`by6!j4Tv8+}Byy56KNNXS>nR=vLpn^l@$8YpQjlz&Px0^D zpR+p%H}e(uuBAakc#O3URHr|o7D4t(dJQ-RzcLekn#xRrhiu3KH)|2$kQi3mT1qc1L+FTk)BdX%oeW3SrP z3e%%0*gkf5!)_d);*xnZ`X3*rm*Ly#6=PkhGz`0&afw-QYWomq-(jIkgM;IriibX_Ub}(~@EoiVZn~WY?Hac;ImB@3_t|%!x#phcg_v^T4btmS+W^-glaZIMdC5L% zg7#vb(WR0RBVom1ZNo(h0>YEfgo#W(wmuW35;y%oejbGrKxF zK3mKbX6S#;PR*_vQ&X#xUGYjWEQ$K`HF#Q4K`$O*rYou>LbWv0{o;u7JE4J}KZM)o zi5DTkgA?F`3NKO#VBx(+Egi{dtqGt(0Ef`YpixeTOZj3Oa*2K9*@2iH+=flBT0*lz zlTPNB(ZkSvOJOYSITLa>V(Xa#h7!^1ZEzbOEJuE8f9{6cbe^6}r{hfMD*O>bKSE35 zH}`Sz64p&qU2x5O_8qfBK!~Jq1JOO*YGVLR8@B*z^;2%5;07w0a2~(lz6fkR^HRpB z!vuB@7%~{9MKA+SS zg?=b8J zfXn(hyeee=xP$Zww|f9*hFxJaL2r&UqStyIG&8+lQZjJi3;IDfpTH%;uy7jdUMlSWCtbLoY&h>>l!nbcn?1JcEfy&tO{d45o9FMqxTTJ2jad&*o+`{Qo0gEMBgpi>muPG-;?hCf5{ohv#1dU%XFeL^eta=bxP;nYGYBcHEf`1S-u=1!63Ndk zE~@Avd@gEl`53gyn>_mZ8A$Pw8@=$j%Md5QLwAyrIWUb?=Dpw*(D_%29JqqSk1980 z(Cv!$&D;x8`gmTI(SDY&UoqVcb^jbMaMwaQh>F66r5Jw_k+hc5mFiR2M;6ba4Lw)R;Q}EAOwh0g`)f^jkl>gbe_!xRmn(@Ez8Ul2DxQ9B0D5d$F;^}A5w74% zO50tAP`L;yMBRkgQ(wBx{Ddxl$PFsLi3OV^pv`r5FQ~sigUu2s3dloi+Bt=4$lJF*nScVA0-}-1$C8iD2(bi~y@PAU>#0#`wO=k3s9XXaf)_ z7MuF{F9?DF5jq0=1?YXqTl{>SQlJk?hS&Ab>EH8Dy{%-QLui2-7e60gAtGwSCVWJf zSNQXqvahDF>yID-@fcJ1-uQ*4!zrBxNI!&~l-&P5%lX4=ghq{;O3Pa@F?9Oq4+s&W z?{ozMWX}RX8ZAT|BVlS=SPt~XY50^kKfns+7B?*zMD)oG3s_)Ri~cA{F}6!1K<;o1*5eiqwKKZX!Eb3Aw~kz>nU6>}ymU~gh7Y(XKF zs=tpJ(1TAFE94TpQMbsgbe*pgah3zcU~xCL|Di-P$w7${ zE^fyd>dJ;=8db7r7ft%7>tud|{bzo|G^;T{K>e^R30Gr#mSu}C%Rnr}MAFsLJj!mb zRd)@?By*KY%`wUalPnrl0F^T*`W*U*kpqMfBae1}AH?Nb{zxzkOG@bq@5&wM%@#eY+oE~%ZGejDc za91GZLca|NGIkjS5N!O;3OanpN~4q95c3cTPqaP9f_nM>2Mmn}MW<-` z_+s<)yPspt&WW%n1xooRSg$jTOaY+^Gm*K!2EPQ1&?6r42O|XPiC`RzWSxNRDty+H z-VltBcZ*s}N!hW{Ov6gcx;kE*$H5`0Mmh)c8+^kp@S+IBZiktRMyfsa@ zV8F&n6z!cMS=BrL^;hrBQ46$UY*>yRZ%q@XvD-4Nk87JoHx~5TZf}`R-=(Hxh2(4W zH7c7{ywy#Z7VklYk3J*nzJTr{1$JxEGbyD$m6`J0=S4XbKZ zHlhgEdM!G0<)UNmk{xR2uud-ds$JNOCq@Z7xpW3}0>*=3RC&u5UDU;R%bGCZ+9vg~ zs~fg6G$s#qQ#OkxxoK<~6{{L=O%rB1$0-cSdM;Xp4Z|#v+lI4l)k>w9_D;fX&epmZ zen^&e+1Q3yoh7VwH`L$NSjWdDk|bb#lY0ndNfKc+Paft_Ms(%wT}TCu%ke#*S4a3#L)spcdS^ z8E;_|c0&XMLDAUh%GKO!mG`c_Q6}?-t&-<84{^|*V-bt%yQL^ z7m1us*xz|zZLPuRL$aKUMzw0%WQl$pZ#@%sbQUMs_)9~wnt5~8s8lVpOx7*xyczM9 zG+{p{zhqnG>g2_#%llZJ=BwroU0o6PxM3JE)j-0I&rWfb4m~7N`>yGjTYKb&U0&bV zr3*U0VaE&b&Lr&mJb;N5=sc=5BD zguNfSjRu>=kgVvku?8_o$28+z%QH#$+lC3i_!n3lrq zCF(ovyC>{q6zC}{S*A1F&+RMUGa0(({#A0{h#4xFN!W4N+}))^574=ZG-_?9$WUM# zrn42(Ntj94NqA6UgQwSaixsnQ;brZlGW=Qx-;L8pYBpg5zi5^iD$d*eut z!rsFc8$WGqTb45{3Sh~oIt(VVu)7ymMicfS3U<+Sw&^tNVR6hbF*RQ@oXvPa>Dh$c zh$5Rn0me@o!x>31HjNF#sgZl@MkQXDdNyH)q{^pYvl$GDN6$E;T3 zEo{Qx4i#Ign8^*#rB$`}j7p819_Y2ESiVbEHf$#@HXt{i zu(!YfyXDG;QM7kwFW#-YzqBu1&@H1vSe0QcIAm@-VV}XMY?sYycW}GCw!)Tev&69b z&Q>f-Avd0|>)_DwD=_?!Nb9>MeWfzFZRmNUM-9+m7LSfvLL9+Ka7 ztn#{9jd`ggY|mHN94cZ819VU$7j}Ekv148&33~u#+o^68x9!rfl-Imtlq=*N({W5E zR&*qnN!Y#EpcB~M*dCze)UHaxPROF+d^C}XoyF~yubD~Mv6wfUl3kgjMoqbBM%ik; zJ~qF$%k;)vu2tfxp-jTQ!k$A%o}KOr^0gNV9cpXIqG3HSotP_{ba{qR-ZHH8`%(N= zgS4b~YpeGE_anLCnAJ*QqikBmcv+iVCSfOGmCnH097g-@=8i$FXUABxsKp-(1e(hv z>}s$&KR*7D$n9K}E~@GHoXY6Gi2?A)Ws=T4REH3Vq`1tC_ zLn4?9_Lfz){;_6~i2;=@JdYvF!AA$%qU|_gZom%$*{gp+V+0 zH;mm_0KHr`@%+fnP+EGD)yb+<80UVhwM{xVQm{*V)!Oi+gsWtZ#nCD;Q6brcT@z~D zRVxo7ndM+5$d%jQQG;T<8BIz0uI)Pmre@K?}UAtV~Bl*Hc*{W98W7>8T3Hu>1 z33m>|s9p0`X~#0i2mkrsOYz*2iG3G4Mmb(EWHMnx->Pg` z6?5AdPSY+QlSMZ-nXpHZHy%7Nic5CQ8GPSzGGTARS&e32>GhGkVV2FJwOJ)Mj9Sdt zPtxr?w~R{FD6syn!=mS~ThY6QQ=}GdyfsbOnRviv@Bk+;jJj^oa5l+}np2Kj!!en3 zP4)~9K0p$yU6zFXmSUx_v1>RV&-QbX)%@P7>7?hjxASHpmhj{fc0tq$47dR0680ok ztkns}ip>A@l_I)fRm*0ja-Z6j@kA+MA7K^8-=*UZkR(N_5M#?S%d2**#&o${!Y+aw zeMnZ58X;zpESmAUUgdHLy9N)o=*Vx%LD*j_D&TOYS=x&0$mWuUF;)2J!)V*xaLh6z z&%F1yhyUliT`t@4+>%_vZb_|Dd0-Ds2RvxmXpt4G8n5ARE|+wAgH51X9hP>#tVB1x zgxrv~9+;(=w^hPkh*2%oKC-G^snowrBQoj6fQ&njB^n3CihSR+N@UR}7GsizB;Dbh zjgP|*kR(OM2LzPSbd0Ulcx#%lC$qHV2nl=gh9aVdyuo1=CGPr)S zVdl+p#kAtViIZ+2)CClI98=lJ9JOAbox7H?74Ntt>=>|t7wlEmU6dZ1A<;y)9D^>}f?2lWMFx^?`Tf8w zT9rbzD}6#3GoBnJY{J9%F#M1lP9Wtb%jWvJ6*st+ zbWd+~KiCeR!H_I#zP4vje>3k`JFF@tX5nAb9m6Xyi`;lFijShNHD9!==xmZDJ9d0M z=|2ufEipz(v8a3 z?Nz6`K0xcKU6h2~k+qVYUM)qfN?&QY+ck@NPc>@qEd1yHy;focj`3tEVV`7O%p*N4 zB@HWfZH*qxIg1|Cm}{D_S5k!;qz#zCkgV!^rp0)HY`a)8RJYg`OIByu`evI-9j@*bl*kGGyl_cFJ)jH*33EFj;! zRVEn0{o3Nu(bSg0T0LiL$S(0u_XcjGJ!{{|5sP-+DF zJwoq!fL38$Q@pW3fQ#pr-TEXbPI28F)D+t(_nIu50x9@lxZ*5e!$@RlLd~r$f(Ga3 z?GM@SbnH0T*9ubhwe^fMEpcr#?zP4|PDP!fUzIj@sZYn}>;_V!arB%KH5vD0E4v{E z?el3M-P_1|jWW8Z+-!5~a5T~>8-dff#R78PZ=Kp8yzY)eTq+no z(+2#NP}LE7QgNuHmu%tMlBxN-x3VW9v?V6B!pW?R>;^J+uUD2Y3&7P0)Fj^ERY><5 z)X1y{Z9|;s_d#U5r!&6kfr$l-PO?pznlJljkcsFCcZO#3Ja%9bYY1Gz*bzjWZ3~;~ zbz@kJe-=t7tfQc0V?)`KI7u%x*eTEuqdxMLQ0!6Qh@K*9uI*BMkX|Em9<&Q_^1g&z zw$?&Q0h!gRW!JiLigc)MVKmDTe1y zLglCYIIfdeb_Z)e3*o$ode<+gSBg*xhO1YqM5V)Mw6?%=%=C+{*B)`CEn6x$T55`F?giJJ<~*Y2n(l+mgyJJV2~CVaI?HPdqgxs4 zj4lGqoJ~QZ2u~wwBI(dImF*O0h{KMd1b!ZvLLnmnabe!*f=kg+|On;)n<1d+q9ba$=u)~DUWrLk+k7$8 zNDADDnqoTPnFtGk4RO-v&`266O9Koj%AUk!%~pX@enU*!GmuSkImMZixQy|#eF?LH zraas2YZLlD2V#MAPvR0L_P3GyS;>Oo6Znw+pkv3BJ1 zlydQg`>2Xt%%CRCo^Um3&_YH(Y_=KrDWbU5NR(=7QtfiTk1X1?f*h^V<~0?r1n+o) z33AvIS5NDpLBQ^iUV|nE){f+FtOtcc_IXj0a)X!O5O4igz=&t7l3|uB4PJgT^7Qi{?Bxvr4NR?M{g+7N6hiXD-pS8AlI8J5c$@+&El=5;fN~6s-jm zH5xEg+KhF^#{Q+&2DkN?n&{dqu$SKulWLi;4EdCrn&mp-D{i1k%Q-r*N~!nXjhG?V za;ZtOv!I1>jcSdiX2iBmh)UMYW4n@2Q*C)HIT+-~q~^Eg0m}Hh5;Yp42hBsA-KTP% zFBf8d!Y=fpaf^1;wA0E5ptQbx(^aZH6}S|Rnx9%0n^vrormWHXdD4Z4bAl%vw?s$H zWt|zPOwyDUy2poS)(38LyCdls{59QD{4;a*iYLKFP1`{GV{>bewIu+nQtefjG3`cbUI53fP+d_|OOJHMm4K#9$39tHu!Q?;agNGv zuBbVweL1s8xbfn5^>9NBJ1i-aP!=UFXO<$?Y5pNtZew zXV*J72|&tTrZ<)q$?(gkv$O7Xbbj6bv_Ca4;be4saeZ^PKj~9?7tXdX+nrtGY0ANe z?jfJ-{&oA>S6=&1_<5LxAI&+P`S&ijAKQuw zKi%hWILlpmSiZN_``deAz<u=SS|Je*#cT0|XQR0tg5IzYc+cuK^D>?Sd z?gK>eDrwJV=k(Z4;u$;Xu{z0~ebIqPNQ49e8~~JB{p+_tbz5u)658!}T$9UbNtD2^ zz(U6^u=HP=f6KNK`ng4)Vwv{ z!B3?5{zYwV`(IIH%9=IQj8w}cTv;jIPz!JMI%;XTrE3-?<8cw`;TSI-kNMrrp=D1Q zQLR?IWUp1(HB4I1z>(~lCDQ=^#dmM3?_cP*Rs7<+8>-jLe*fa*#Sx7A;=Aapp)mF! znE41HIYBsH`Rey))&iL)1nB_5{k5-+Vb7NHPhn&y7=z1S8_7yZdqbCkeZ-NUaD2S@ zwNY63?Fm6~LeO70UXH*1R46Nz9q{I4I2HF7zcz|eHSW?0#PkH>;hG=A{r6|5@7Ii0 zOy5u3p9k?c>{$Tu_)`SwzZyaODT3r*jUaiDcukba8bPoIMjg6vZSe>x|g zL-6O_fj6L~Ps(b*SPiQ6I|4xw zErnV~8>1xQ5+(_5tm%>qZVzPF3Hk7jJ9&2;>Ak7|@S9uswxnNG$o-L^G@JdAAh-pL zSuTpZ}U-Yd!G9C6eONUa)E-urRb^y6(=n(`#UUNxl4<= zyVjHUl0LdlsH_OnT4~ZSV}LMNaHA8c*Glm6fRxVZ^Xb&e7&7OUEk3Y+y2rWr z0lvdDP^{U`ty`o#J$wFw?TKFWM9)jjTj#7`CpRhbFQE6(TD8`+t$DeaTcttlqNFlT z$Iqtn^)K%iuY_72BLUc-=PdgoLYLIAYVp7GId(eZ@fSQ%<}Oo#TD9iSr|$~r-)pdrpXsjs@7|#7;)0|{FV4X*Kew%%T7>@ z(@Iar&tHr0L5eP}jNxnPZite;Bz?Yt`ipa+6O?4d)5){R`l$Rco7_qMe7+14__DqK z2B|3kkZVH4T7g4dHz>kB>G=5;&b3xnSs2pA21NJopg!XC`Q(0hGru{7Loia8jGymQ z&6#mq<%{=J0w1FlvRVFo5^rkl2y*ZRRy!b>d;xu$O4BNB7w_nSY2>^*d%m{(6|RD$ z;X7KoD4nwRwkt+DzktmDegAIp0DAETgsMd!lT2qm`Kp?h0ebhlQK?6Vc4SqgRVS-7 zqHN90E{;cSwZcF_mii3w2ha^IqgIJSoQ`t>eTJp^~x;1Jv)xVyW%ySoKqS)2-B?z(9&+(d0-Hz27V)+IQrs! zcjb%X0%1NJJwd#;w(B{f{N(Aa>uCc{$X+aRs9z@e5j^m&n|}wqvO04ytxEd-+aVw%}WYtowAAhV=uVm3vs^a_} zsW2`2q_yyEOW%N)_FBc^2l*&pwAaeo;kPyxnEE+ElG!5pNwP*8#WP1rAVL3Rk#$;p z`VX33piS#x8;TTwdta({*hWM7DK1(W1M-Qm%m~F zcjkinnMgGsE7WmS8CH#Ya}hT-mPZYsV(!H#f47=SP!QQBfIDHXIq)7*<+1mnF#9L~ zyPdM+`?-Nf-PqgU&abs!f1a_0_S*}s9=bGbr4Sn_fP9na)iLe6!c)HP6vMSn;tdg? zC(co6R@UheCjBX}0Uuh5fyFR9G52Lcio%l|XWmB(>IQFt75c5cZyHWK5SY{%M}syUSn%`jTk0B$W3e|ZBr5kgip8!MN{o#O4KOeXIM^5UW(Z1g2Qpz$# z$NUfk{@j}I?IzTzfpJw=IE^BaWoxR4fEf~ErjL=mP!8>nZw}q}m@dfMfd&r&gvkS7 z9P|+SP+b764>yL&qqNQ1gT+4fuVl;Sh@H0DrS$a|T*&;xyQ9BfFz1CcXuqUa*{g@P z*-`q1Kh+s$YB$lNmFw&gNxS+#ieDM~%|#F6FLc}4bwi79cVeT*HQd2I#*U)gF^PO~ zqxJsyje33)UkLjX6DXYhML~An%U(iJ|Nfp8SKr5LacVI#qs4XD-u)@WZq>m5$u61m zOnkns<8wI!ceZi_M00J!Ht7KY`_lti2-Aiq|krE5WR~~uBRS{4m zDk6Pf@)p+^faCV66pr8r4*>klZ6e<-l+Yv{MSYxcI)?2Io;&Fwuoju@O#uwH0<*5@*mrVFr zaQl|E#mlAsp=}vp5;WRdq`FXU{PbjD%Aq@?#}UO??BwKcOWv3`tRzM@&fZE4ynDz z1&FryQZuFU^ydp&t2%xR8pWR(!u*Z{OQ|grG#Ea3HVGOno?!*87p;qB%!2$*<6-{Y zOd?XmJH@s_r1oNPI5xB6Sr2Ulm}C&|VlCg|xaYfpqOs?;VWgE*K6e>gbsOsqQ*R zJ6{cjTtW}AOzf|^4V#7ygnkw&f~ha&!crq90T$`wN%eBYdfYc%dIUEwNNqDA45Ym; zlUKIZB&b7z*N&Q$`y+OL(JM_GuO?3#&4kA|U%e5G7)jI`j$U>O`t47>1BOpE9+Srt z_*-Rcw;KX*7*%MGfuL7>iduf`Rb=4*_1Y!#vmib7P?aOX1UCGaESO;MZp^?7A;LoQ zfkb&muWjU-8SAct?*&sW8MS{-P?=b_=qvET8t>U9@dB%<`+J%-h`E1Z)MTa|<3{p! zj4hJ-hGW$or)tLZUV#GVq*an`P|*>|`kScCx`H99;%X^jkpI?@*s~m2?3U0mHU(m?MFflBQX>irgN$9R^IVMxHB3Y>*6r^OR6WQqw~S zg+$i2?KuXKV5Gjv5jmipZRMU287rJIiVj=8fL5+p*uV@k zphosAH3dIJ1PueoKM$y?Ogxr@6&(>-rss}jYZo*aibUABD8opWB>0rIw&-UUjzi&2 zt-!W423SR|wC$ZwC9;Z^X~4ccE{pocFDASucG&FG*Wo+Q}*Sx_ZgXvbRzOP#%|Fws!55*c#O zvIM0CWaic}rkq&znJ#RSMqy_BpXMfCI;OQO-S^08|m;(igm3D_L%J@#F zkNDf0robYsNTwB*t#k*k>WnNRjj9`3lgwVZk}uZQ-Xo7DJ}VS|VFp<;v(Kavzpi0n zj)hg|C%qQP^ZQ!3H(!SJc!AbT+4X zL^?<2ATO2{2qYr}iO;PH+sVay;5G81x(EEB7KnF3=%#30jlMnsmkUt!HS&5^u)HO; zXk&u0A$n@hv3xChL`59*^{~nYRxchU;6v-XQ)BeCNe%o*7Xs9AOWe59n_%xOPzgCh z9Wlx&MTw;-k=^?CSB<(eVQ!E!ElSB7s2s^|{29#6+f=;R+PCUa7Qh-@wFvTS1p^dB zTCM{)sOqplgKSeiN&ly9*x(fW3h83{*z+qvKmG0zObY{43`c!5DrAV()kq5HQJE#{2hK~#Wco`}^o*BRs={G_$C1QmmTaUa7N~1# zbo2Vdt>aD5h7@vJ5O3s1Z%22-fc))2v`0tbeEbD%|u~E_dRoDj`~m=#Z?u@IXxPRq0AqlAo4Iqr%-&^lpkMi0Ze3tm+~rBHYi< zgz$9%SJ4_I7G)WfX)$!lG!AuKD+rhYtX$owb()0sPplq!7?;N)xf0fr9aGo{6Pbs;DDmTl(qi77t^6pSyp$7h?fMLTb@|0y=8pNL5~PxV zwPeO}{t^x~ga&)+^Z|dC3R7gEZxL)G1JoFg{W20f(hr!gr^|R^n@j}ifaaRYFF~JY zrOwT$A{%bHBUn>8?FB+fstaJ<&;6UuXG2Pn~>TPUw>J-;)67I+)A%1l14>U;& z2Cyqs!^PTZ6moSI!_qTC^;RN^#vSn%4SjFf(GqSek-#g3bR4j$MB!SyBe5SVMA+l_ zj!#EcP_+~oyUlj9FU(5Fb21aJhtXG2^p(rTBy>SK*Pu~ptF%-JeG6gi%@ax9?+5mlccSDxX|jql7RFXy1A?k}on{NdDa?5$L}V=r z`yWF>xWH72*pe~8;NoXCs*v)xu`Y?L1Iu-3et*ff*;Cg28VB zzp^)@4;BkaO{D3P`+=gj-XoF8MeY)}bk&Sskj6!%eTuUtORYJ8Gt5{kXnIZt`&GjU z##kZ6Nl(AyD8u2<;&VdI2M$!?X0laiwz@dF6iw~@Cwy4FAbh^HLnKAiR;~-%I`3WrLWxWWdyGZcc3xg#WrxXkI zi^kGCJ%zhAFAWN^N|L&Trd3w?VF&tUt8tqU!gPqaMJXO!>iuL8ssdt+h~kB8@sm~h z9-MIuF_#<2^C{6Bs_y0%oo3~~Z^A{VXEH}Yc3ciMvM!+%DE!(EwoW2oc2a%H@xY_&{b`c;GEsBe z>#9m&sFU@CeDq;06w=r{k&hKfPe5?zOBi9Rx73oh*Zot5ZkpKo*s(T%bq z|8@wBGhFd5cGh!RDTymNh*_`=6vXP-lDpd;pFe%HV;Ym*v8ujjKQwtT*Y!1X?r`64 zu2RVzcIalJ1WI+(a*;d8=)xf%g$H~#Ok{U>s8#v)krCcq=evcAV^}jn-$2FjVWfw* zzW5_ISX<{8Uv=@*Zs*$()}(-fGg@RWQBfxobqC$E(z!E6y?Hb1j)16xfP=37@LLnB zb|7_wd+9>wo3SdBO!y_nB>(DOW71n)L)`DAD4&dtL$Is|gHs};KhILtInaN|hlTE7 zi<^tA2+b_%AeI)J&W_oNzq!1N^`arND*Yq`6BJIPbbi2fF18i1-C9SZL|B02CmGbH zG<;ZtIDqeq0xeZ1BTZcHnxTTfG1@#%moNSWrfZY(GguOdA-scD!%@S4xxzc9J4Zq* zwGVQ@s?|lSI>@Yw?Wa8@!PqGe^;J1!$sc6M7fnimgl+Ig`0z7`Dt&!q)E;UdF~y7~U*?*44X=Sde@m_`evprR>5(>shuOxZ5Mt1AN*h`(I4!twlU7EfNDl$(!6;Yu$zo}l5f1}p!;hh?(-%kcn;2$ z11ziOb6H)kKe}2ad>H!Sss8?vP9SJ0NjYD_3ND&FiI&^S_d9!UXaBhlKrTtC!3uHNzen=Zlz(}4*EGxs>s!2D90yct zvKnTq(uW8riqgAyWv8aRj~v*)Dz6WUAk!yVG2lA+?0s&gz~agbrv#2PGG$9l1*!4| z>9+F*$2E6oWluQ96|FD}(U=U?peI_i@BOxsnVlc`1RV#%R?|!#z85*`#T-lax~#_U z7qQ?aWqE*+SYo2rr*OTiX=M>rG{SU$zwYMjKoj=>&OTA$N*c&lZNsB&m)rSy-SE1N zMXyv?JhfJSsJ9n?C}QY4ME~uucRvN+7XUi)(31=Dh+soXd&~|SZp?ajG#*9DEH)R_ zHRLBk@={B`X3pSqPdTUB%dR(zO=$l$bYs{lIJ;S+VzysK^A2$jxr8arR@z9lqY%z7 z>*_SL6%I?T5sbJ~)3sELgzuy)qK`BPbgD+|3WqBtYgWu|$Wp^vrB{r)d?k;tX+P0Z z*lhw-(FWxfJ3xWU1Lj6-;_#qu1+~RJ#R*aowe(oD1(ZKK{ZQz>6I~$~!>Vd}wfGnc z2v_iWpkpkkxftY}zOQUC_N7C~`sF2h@Tf=1qjnb8=PctR`Drrm@&lEo>RXP+7kN_0 zYfpZ?Go?gSHa=w*z2eA1i6EPOLl!GbjZH_xt@Ce^M3eQBKU+25rZgUxYG_d1Cy2GQ zgVrHZeVfvG@~GP5O@Y0NUU+Kc;8BY->v89O4v@M1K}tb(QLoW4?nIoCPihCC<8C=WzM6Y$t(nm^IJK5SMeb_WUmtEWK)*h1x&kN7 zYgt<<8*pGQoPamDYqJi~J7*bVZVzLkYt*p=i4BvxNfxOE>S@P^6OVV!_J=L~?;bah z_SjtZemNW9Yg`M(wZLPD3k_Z|md!)!`@z<28@rsnXL42!yd91|w}1XG)gCMEs~R8# z14B>+2Lo;Xn`)cd**V+VIh#2BH`aE-=dAyrrGDN20b|dlmZ+5_Yhg3!un^l+l4zZc zjb#eG=idj04ki-$a$m}vOh*F_C%IAOuTo1TZIYk;?rVYfv;|@1EwwyeXgdUr>9OU6)t;Hmed8slA~5L$I6aCAJ%ZexBE zICXjAPVnpLAo2vWAuNvR3YVNS<|OsR^Lsf5O^Bwb6^H`QupoV|vKWSH@v1)$>3of0 zb!wS`Q2}gmE?!wm_D9(j{2>;y;CLk!y82XS+MCWU1DHx!QJh7}y_Q=zdolbN^`2W& z&C4Uc_9i!@;_{?vKe7RQ?yKBJ$EsaZj%xF=CB7v0x#G>Qr;xEKmK==+xBYgFN#XD! zil4{!>v}dWpxyn24VtgyLZvVn{J6oN(f0cG%6y_iw^u{^t-;LnN&Cll%KqDORbscI zF3Ni)INkGv8Ezl`Y)xE|gSGm8%7?7iuh^TtR_V}@?5pigQOTudlLB>s>8OAsk75rq zLS@o_L14E{ji#AKEBB`V3xNkwqSS;_$U9;GJaUf$!>1DQR2e_mbB#(_iTrvvN7iP) z=c!gd-yXl_AT&Rq^qG!~O;4wBVk>8j)-F z_|Em`X?90Vm7!)XbQnrd<4vLkgFL%oZ`l~==i|`kPPtfx2Nd0#VUq>=D>Z3y_lGCd z9Om}%wEHSz(t8Q9%hB=?3jCq-1*2|nWeTk=dKFB*BR{@Hnv0tVkyA*-l&74eIBmG; zwRWU@zI|qq*c!cfz%0rK6Rd&7q=iCunJs{QE!sWQ;!4xhFfowC#z%ek3wjBkJxqE% z9)COGCkRYvH-7WZwVa5KYGveCfb))49Ws5smF%=^BpvF(RzLSQzJa>4pph+Y)afks zDoMCKIeT8YF>}WvL)x4f5j{@sYSLkzd4@9nIPHDyCp_xMN3Fo}kzvVx-mA3afj(M) z6-yyH??_NdQ0=Ok4X?-KT;(Eixkm#)X`Hb3T?)1|Mt&uKaQHd_SCtkwYa9yYc@m?# zCd65<#{d;2Gf2Z0ZU$VMzWk(zPlFh89=pq2#znVvxVA7Y6z6Z9&R8y{;aZTR$qez=hQ zGihNPLLP^fMl+9ltgXH(+?lss4Zpr&& z2It{5rAGj?U#dso3-ZtT#uX;MoiPR!<1(5Gb{)<7Wd}=6OEZoi>ISftC!q-Us#Kq8P85ANO6!|(~B%|3+mKeDb%N$>rBhV4|ih#DE z;t7QTKP=1D_S!9}-oyu};RC%T({3S;O`t5P2K;>=_Ur)NX4lSdGX!X9kWgwSz?oYn z!evA_1P^B^R3Cn77Q~~Zx!p#nY3wAgh~UP#!?uaigKEEx|toR?Zv@_5{&q+@VuvWol2S z1%8oM@3=mJAx=3)1LLv64|>?|PBIZ1p?$F9IiyNvNzCx1Y}rq9xT`GNVt&zORZTnh zOnBcK$Y*6#=`?5QW5#S!?AVfD>*cSM=68sPA4ArX=3D}iAm>{~kt^3{0VsEZGR5sa zZ7pMOlRJzTn}6Qr6xvRXBYi4ITtWgC`qFMYOPf?UwPC-~O_Du(T$poA*H%UQwzjuN z>rRi{hi>KV(UFEyJqJu@TA+8KMV}Z{L3kjUp#n@Cc9iMmOROj8Jc{Q+8`9>ljHY`c z_7=GYTKn1tZwwt9ckwrVW_~_$`XzeV_7kB=n@$J4xq-YK>Ny}V()x^Bu4-0$8B-*K+cE7>20{j z%psbt;sTB^GqDT#ni*VQ@4-{M((7c*UC9jjZYuv?mMjVl*;A6@h5{)Z`VlgQV>HoL zrpFM3fSeLWn7;&A&7?{(*8~u$gW;gW!g~d$ z@e=1GkLvZ}?wf&>ud1vRwdx3$T@d&LA-B3Ryc08kH7y2#>32lYwd$*9ghBIBpIDMU z)h9fc*Z|84et(fjh)TPh;ZF;0ob*1`=^kd%p}oC~-WFk`eF91w^(_@9oOb0kT>lVY zyZUXwKLl7U295JC0eW(~~-*lNQGNy8N&B@R%?2omc-$fQhcHloignX%(D6)0_=f)hOVPT0SzL+`x@I>XTHI19|tM>R0P9x zc@BqZkoqd$DH4sZ@b`fw&mqe@T&BYx9y`IywH+ZJgB~qW!{od z@X{QUlla;-$vGMwq5&@68)SJ(!#p69ZgJz1Yg<9t9 zf0}9$6n_CqrlL$ipui^NQOPkTf{ogGRKKKj_cV&;;XzK(5NzN4<|O`ubDU#M72As$ z9-f9FBVvIw__G#x&4)6@p-D|(+Vj*YpjDrF3LPPedeyF-0zU*saO2{+u||_Yhfkvr zZ8r*_ry*}i#BJDx4gpv01Lsi4#20FT45>^X3;;k+V2f{4VFBe9jfzau6GFjH`Zz5< zU@b+3OjYphfeNt8yu^rLHK@)oCpi5~sotI&2yXT%rj?kbXd%FH?_0Gva8|%Zfu+5K z)@FQ>Q5{k-*AfQ;#-ZA8ms=J-5k<4KXVbpVg;3V*g{r$uoj3m5`!C^(@KNIE`Wo}D zd|*M!15%L%qFe|O+Op4)>0*)?AF`i@R@)^hxZ(BI-165y`-{~I__m(0>lG}m@lH9Z z&ZY)&*C;UAo^<#;f~yZ_fOQYRmaNC)bGAT)Ng&L{FXjc?rK=9(48}*Uac)HfdWI|92s{R1V7-Q9`1sP)Lq`YHwk|sW7(XKLaBp?ZdDH}#Acq-RBA|F zL=?}KCko$Ku#OVG!4g7VVv$v}w)g}~Gw0n;o@RxSU$^E4*k@i!RkSFf`Y!y5O0k;V zTR*Pwlnte^XmMrV9x>8i_Mk)P1bl(8L89IHMlekdDYvEY1$uC7pF|;d#8Mp|N@0_C z#3-*O+SMf}2x{k+WVAo&C{ejwVM#+&-x9sUbY62i9x}vE?*7w)Nxw5=Fv&ddL^`%G znqdm3elO5Xiw4RBO}vldaeR|U3=v-&9s|H}E4X5?T-&xX#TT2DntK?mQaq0gnBvtR ztNC6|pLqGF)1vNV9Y;w$KJNi5?ch z1(*B^{(T;wY+}(PV15dphB~$WL{PBCz|(I%-#?S`aQq@PNmrFQHZVfawCd9-aP^8E zx~lE6d4se{yNo_@cuPZ2-$Bw&VQgj+Vu1LplqB;(VkJ1L+n%PTXGAWs^&2<`6G=dp z*txw-&?rDBV6AbjF7`oUglwWvCn&qAAT#okJ!?_00F%xxms#7TXVRvK zuCk6(gh&jOCN4~;;b+ov4U|TWs&y5jd1y&*(!NeH$=~~___2kPU9gBJI4zRXkJ)Y!#Ba zK0S%<5JZFFVoBIy77{#oDim~;O?O&j%#4Kl7u2^E>#b}oZ8i+-2a^EX&T-qYA_FRf zB5TN9JUGCQ7UaGermp^;Dp7s8prbbCzg1!}P6b)#?$;Gar$E1#h6(_D*Q_`WfaVY8q z+y;Qtsucx^Dhvfk=5fPr*;;m}O6%&w|1s&T=8t?#bubA_68P!kLTw;{qgUZ_bgp^s!um51=|t_+2j zwbI;X>H&~f&@a*?NEkMPms!!MZ80YQ3jp8T7!0i76fGtks{sF)We*ti00oOkO z7-=16!Yagw>wf_7X9a(xy}tlh#1I^?M4}L}W0^P5ho@|P^5X3^QNYmfg}?25ZJvf83(r?v@Ch#f}Z=1T7>M=r8h~nz*%DklR z?AW}^i&7?2!-u(;gz%ebEpR0`!w=`Ns_;y}qB`-t5hN`y(LyH5?EcgQr`-!8Z$i@~ zOy|-KDS_F=fdvYvqFY}*#$B<*@fYqo<7(3IA|}QmOe+0n?Z?%qUhr@IrNDk50cJnJ zpg@MQoA(F*y!t{_pfB3}FjJ8vQMIzyiOS^Mt1|}xxd;>Dg2J+roUdmbgf%g*krWw# z{dTW2!GwnV0c+4bpTr&p1_wg5k`LLB0;O?>kl`-5GBY36!#JR5X#Ks=RtXQfQh!vLGMbsMX>B5XYg(pjw~ViWwJak7KH+5O7e z#&IM#DB)a)0isbsF`8&FGYZBUzO>7-T9z{}C=f{&%#Q9rJw0o-GNyzSc2qYGiV^qV zCz}aC+750dZY>_uK>QNo7u*HA=TIdZ?$m9OfVSqTJe`Kk3_8p=_t0x31?wq6ix<^qiXuuJ*H zrvqDt5)*mw3$cM$TY@E}q+L3NbhRd8-mPGioZXn_cDSE0cp(aWau^4fdvP~NST9(CY@AIx3 z^gCNt;R!*s8)5aaM2|s@4}O>SVS(0ih5c8A!Sojn>}lWh8z6$iyD?rXb~`#9P>+US^7C?v zH@BXIoSJBcSNv33Lgco%7`QNgsLX+{cZ7pr6Jgg{=eV#Z!4ma*M$&tG(CZ)m8+5*K zaPL2}4&uLVHqeD*TVUC*t`9_a;Kyh(4328*GGD7xwV4v>28@TnS@5#cp9o?F6r7#_ z<;lra^;gQQXp95qWmn_d3OttWy^$B6G-m0^W!eK`@t{aS^9HkCa~EW`hMQ!sVU69m>O2SFxO+2sRTQpyy{MH#u_?hDN#VOirNE3V z--1v{{XVv64YDO4wUX>^U~O<>6>tEY*PG_T-{}~PMS2d+9Zn7+v3k-+b6i@eQmPb- z{}gUC8tUs%1PO#jvgwC z<%X6Pd(gJ`?cqMEviG#mL0Ff%ZLd=Iv#yXym;3nF{0HQ_9YBh6e`r{XT~D3#Pdntp z+%{?4wj-O}8CbUu?3{54qD!}TFAmbr9J@|481uSM7pxzwj|Id|3L+QWKPbs#KHGHs z@!~KR-WaZFiP9_Ex(9sNmmWQALkwxY*}J&3wH9SI*GyYElm{QJpDJ2s)uvobt~DPA zReKaRtrExgGqj@ncsgCb^x`AFCO(N-y=T0#c-1lfVrkdtbfmUo|L%Ckd=^nVdm+D; z$VE{L3FF+?jn6!s$@Mx(L-I%No4)$yH6k6e+I*-6M#P^bHL*vt3wdD%hRyZd;-_0+ zr%TvjE)@k_e;kTZ&T_I%s&~2TS6B_Uti3P(d}(M>e@d??j|_rB_S@0lQT&_j4dS3Nep z^YGT}0$IO-vpaF;i`NeE_~E!fW@E6qCGIDJ*i9iFa})YZON`BO( zBg~Qb42GNE+Hbp!FuGYc-zD6B()w3}mV1S0A|d@3|CJE85!t#OHr4wN|K()6i>+H_ z$qM*~{|apqs(aZ?-+}n=p+8Y(OBlPAN=8^0i2s_p*!(a5E&t1ZD{cSsU)R6<_ho_| z#D6U~I;=XiQ>JY=c4}tOiKZObC6CD%Ny%Dd2Z378Kj!k{ar@-wz9n^tb^FEO!8bM_kn5JJVciynpfp&)js7+EHuTo_ z>DK1c79W5g(LjvxGus2Y{SKbWuKkWTdKEzz`4d}K=!%z;m&lH!ah7gY<^{^HL|PH< zHe!JQIqyR1=T@@Y=hDmJtW&wNAj*&1(#O3-OHP%OY%;Y>q-hz)@^#bZYOlAP5fyyrl3oU+i|nQa7p=52{UgZP6u~XTsbP6dXIf@B;LRiK!l=mFzlu;aEhYGKRMj88 zT+6<>ymp^VM61`Th;NI3SC-bPnXR|vS|;HC0AB9agr*K-rbV}L-?)`WK*fI9iKu0z zm!U+v%fpnk-t9$=}`DTa&Z6{CK zfrRe@uPcX>)1K0jy+4F!8u2o5EPc7G2+!l4aZ7-0udxhr`#t=50~+(TqIIQB=dqKk zm%g8Mj6nQ%vk1h0?c|2m)7;1?Nt6*VHsuejIB;RPS+@P7a}VH)N8XG~3l#V`SJrnMva14IY^_JCv78?BzIQso|2b<2 zyCK@9aV@CGC!CVnSvvN7+;w7(*KEHlQ>;VjlPz-VGbpdS#{@07zHb|VgObrJ8t*yl z*6dh6m?Q{?ZK5>uz;f~F07fwAb&=kRcrCrX)3W^X!Ch`Q^&=}WI-!kphxTbnQ!pUE z>4WniNQhdzeKyQW49?5QNPPaPLLiD~O^cnRp*R|vfG)lvm%MjPmxU1()&JP#qPHrF z1Tl$g93@?+)jd;-?F56-k1;dm#(g5VTTh~Ytyvt_l+6{pWp}Mu*|XU1^IMEJ24D1z z_LjXXrzgA52qVb9;U}Z58=jlz_o*wF$*b819{CGOb8nqBO1cK+zX13Y1b}DlvBf>! zYCAS58yDf$k~E?LkJNh4kQc{XVh)co2OVAqbQc(d`oqh!PsW+WR1+pIbMHADdTY-v z4g#_{U>6WD7p2F9-7&k`FE3dWTRHtkWUoFWs(#`4zJy~*yaHweVuP*Yn;)P5F96oF z+K=Hv1_PV_4GxC(KLFU)#m3OY(Zbg3FZw;t9=F{ULmSlVXQ~^-{rPLDC_z$CagQWw z+1h{1aI#(|E~##`jFt`*P>`=N^E3Ub=-HnlTqTtn zhWTHwgJ}I9Cs}b(&%?5bwX-G<2gzNoa`K7R&7Berk9Kl@J{WxWvwd&x)jm(upZ0qs zVvEbe2U+`Y$Toc5{Gn^ZQQ0tU&etJ@HG6+5`gJtzbbtTg-ntEko{@1@gQb0_^fP?N zC%1GSnkqS36aXno zu|Ibk>YC7xU#u~e_WMfh4t))6l?l9^@6{(7@=f_t05zBl#X1 zv8^uJ98=nGldJiz@dzAuCAXgzW#Ox|Y4~ZbAyAzj3^@E68>^7jSch+~C=FBLSk7Ma z0_7lq4s*$OyTO)g$U64Cyy(jA5I7t?o!`*1JUm~0cl=|})O>s2JMXMArWCcj+;Z7q z!q1nBJ+CvHkM?d+#KmtZm|RhkRv` z=j?pxEpOM8m4~fvPKVE}>Ca3xJ6tP)OnbGBoXpK+vzeWJj`(p)-Q;leufSa{Yy1I@ zyOErAJgi_W#*5e-y~)F2)5}|(o9l};KfjO3k3K!q`E3tJ4csc= zLhGvk$YU4x{Ms_m!};;z?SWj^G|MHU=bn!KUO`AtrI@-jgKqdG^8|Y&k++g*=1 zZ1jlE(|I=1d0c+1ytMc{a5-t2UVaX7@Tjf_rj>;ael3w?D~X7OY&+!p1--A&rv4U| z4n6PBMkTrm_i=>h3{xbu-S0>32+%FxKp zz&y0})l(>G;eP0whC{-<=iJ2qxDHWsXaoaNp;#v4Hz zHVE(Y*8q3yuf6gV@xM!2ObunMPD8x(&eo%2G&s^1ud-uw5wckS)P_4IqZah<5~8W^ z7t>UB(*rpSZq4=uP{}{$ou`16JbDNeF_ZTpRQ zaUHBv7QWQxC9WZ|7@6gg@dRwMGh20epbkcW>O=ZZeOpucZ9vRC1#RXMA1!lNVN83% ztp`Lw);!!PM0031(5?S>X;sk4hf#3bBhtad&npxyVYl^yf6(9be=Px-7FMYL9P`=# z;KkJcx7+9;?doPuejBz0Cj=WH6MXz1>kNPBf0ve_Gfz9frOc{YvDGi3hX^rSM;sow zq5orwJ0+tP^v^-hU~G#mfaFLET%LugDsDGEA|oEb|2_5pZKQzU@mDGAC2NH7Z7yeS z?AFqM_2h2@FxX&0efnGCn9|-vRd9%7W#-tN?PRjeB`gyRIlIPZjlJse`FLMs_`GJ4 zS<7iROJ@-^xR^3%ok3om{zw({Qhb<~zT5PBrKWdB95id?cSo3d*tj!Z)BAO#bM+Tw z+fMaU-D%z4C|3SfJ?5ed;ew*+%ZDh{n``&Hi~0p;K9pHfkJ}#m&-LEffOR{l!54uqw;+Ai${~HV98=dDVK5_Et1+9p3v748;An}8)t1FV+{|_1ZW#Y?_Fi_5; zr+bMwU2{w3_PYb2|1Cd2Cbjv$V#nJ32srL*Yo6vv%oEvMj zgM0|nu0KpCj9jl77Amc}wdS-gmSy&lQFyxrP*cuec6)g3&y1V4G zt}~5ZIPF@sZ<@D?5-j}X!{RHfVX^Z)r2mHwCm)>lCw80vhqHGKuPj&^g=0-@+qRud zjEQYbY}>YNOl)gn+t$R{v3WD+ocBHF+~<3~ANNOh*Q!<3dq1mdRd;pQssa}Rw2>^d z+ce_yFjrRNG!4ff0@@W43EQf1zI1)Xnb?=^@38q2+3GW~FSUBwuJARe9X9vx^G*{( z9?Z>KFvKy$wzyGsz8QF|^A@uR-!jUYj{hps{~yI%1U9LMTz9$bdxM$;Da)z-itM5L zTGHknA>U5=gx|O|{*e02=B@QsO)@`?n0`?Vboq5zg+NDq#@n)dIe{=1IL+ST`*EVD{PS^I;63sD zZHvZwnzjFNY@KEDy6fgaropSGlW(4Po5psUb^agd`!BRpLzi*v)Z>A{I9AV~%EEVM zX^i>j{qPqQ&-czVKj+__;=ffZ0-Xm6#0OL@L!1ZdUyA z&cd9(+9l$%ur7Y2^~xVhNUwav&FU@n0FPwAQrRZhyZ&`K$d1hcqvt>z4s8194_tQC zuh=(mzO!b(U_;i7kMY@A*G~FfCYZ21LN@FY^L^Br*`9}k*SeLb!If2gEc!l zW%KF^;hL!t3J)t*=2QOaN=cs#=B$;Kk^y;!8GCaXBZ?9$&bo41IBiC>HT47-=Hw7N znrUB@sZk~jORrc%oosOWmwED+ZRekCAOBF;oA&`?fYZ*#c+qCd1G*#aXBvRH;(sPuiM+Xw7b}qvKrI( ziY8GhqLpw(A!ilPvstU_e(5SRoSd==)Ye zIy$*q{nNh~prhfs&iUn9%hff_ z(qkX6xfQe7bk=q~J+52I(mtXujFP0^;fz-gmDL~f#8lyng&a!^;p239QHTqe1p_ca zalA6xNubUmU38+_{_OApp2vd{J;DPHVf4!ZVhjM5 z5d{i;`xR<0X?eqW0TIGNZMOjzih_hW!5A9ubCCcK$lBi8eikyT;foM;H&$TQf?bj7 zNPjabCh3s?b3x(!R^No6i%TZZ&tUMt@;dmT0q%pV5!T<*7vXc3HNJs%6 z&sl=l1Tl8wS0X$7kwfm1ny#*6V}#ER!&7H3J6V?t9@hq z`9P6|4&P8Rw3z%rSS!=G;7Q<|eg`?-eQsrOZ(zc zz_>~@lah9e{2;?cT6FX_d=A~j77=@Vz{AJ9=2#(}AhM?wC0czT>Xt_x7>v8f1_S|z z@EGl5MIzV)3D$rOX5jJ0>ic^OBeOw-APO_$20;bv5`rPZLK6AxaE6MNz`{prV&S6C zGIP?d6$eC!b$lUQz7POrPO!Dj);e)fjNnI!_O*%ajc>%L-`oIO&+PYbh~)Xa-(Cmd z0Ua}2+gg&u?Q{159IW5i1*&k8%BuZ@9Y52HCQg3qeEJD4pm4JC(E!!4RsjvnHGv=s zt@A7Daog`~5q;-h4t2K5`|Sa{&Qm1E5U{t(6i|exVsH?Glp{Q1&m{V+w0G0pe*+%- zE_%F%1S`}(CI-_Ih(#_Y(DmD0ka^iY32N^)j*$c2_3T98~HReIW($g?pW>wq)Rs&^K*J zmsX*GSL6hzM>&~V!WzKlmWUFI1tmclaNkuj=1vt}yQCbnY>$oIOzVV^llrF+F4+7d zRjpmUR4xM3xB;_kYh+aDj!@PPksCr(sneJQ7?x2dg&Wj9U#|$x+Clu7{w0_=X`x)S_K5o!222+(DOO`G&0suYGp8}mE{M4 zesj{}iWv4(AO3~!9uYcpYHJ+5+y(~Q^b^xuW&Jh)h=$EID_DJTZmF%@l~#0=ZT*4&h?c+e&8}BNEbUGM*ifp*k7(mgoT?J4PumR}vwR z5be2g;N28tAM@h3#+U!_JMUq3lCzAPwTil#oB5ZAQ;B?ejBG_jm7Gk)LvXp~f%?jB zpfd5$i^>}>rSizGI*t5yYx921cN)Inaufa7pPA@F#Ev(H~9+T%QD9U@d0L_Q_JA9 zfs0?^<~Du{n1?A6(FQgN3z(+Ok{Sf2MGK6FOHyB$<^@cW%z$Wh=7Bqdo7yk#pE~M0i2K<+KK~W2-B;~)m z{Wo(-v+)1TY4HEdsqp{CnV-C1^?l(y(XUzoeevoRgwDO*#`{1(X_?fdN!`6irniwb z7rZyn~;iv*;>O{~o{<*vljB5tlu%zg@8|bVL8LDx?94mYWL70 z!f7ePvbsdVw2Eri0={a%Ftq|fHk^&xr3VI4bMz14kOfp#Pz0?KJx z?6B>=xTe3lCLazy#-6fA0-5+{`LBNG9KH_Kv4hmKz4LO17Qy6}v}N-K4=t9UYg$j8 z`)S|{Y~0A|D^1-7Z>zs5mb$OXvBA`hthVW^I@Ns7X;%=+xDZ z_uX)4q&D0y-HBt8sg)JmI&%k(y76k5UION&=L_y46<-p%q9rAGW{sA;suBy^CECqH zTsH3|9a1%}_s@vh+9qQJNHNk5Kqm+r&Q@9@XSttoo@Gs~;&|aA6n@eS>m=GcF8kFH zRar}2O?M~J`Z)Y4tR##N?)Va=^|?S%>K<9F%2#DFCVkDx zyTnJKuo@I7$u+M>O)KN6G(;Yo$VWTs614c8h+_O&Kc&WqV6b!rwRgKBl`m*S8G%@d z&p7=QYjmLu@GGfd%ZpXd3CMvwLb;_Bz3d_qt!ztzSaDS(OyZu1cu^d^%m;_KNj;jU z%bX;B4zp~FCHdF2LP2{)uOTn6^cWB^6{xW!RwEHr;rE|2fW?HQiA7F(R#wG%0g5vF z2H!)Z1f2khSw!ORBF0qM{I*osS&67k)NB!c#2uvtoDYOO#l*=Jq0GxJ2@SU6H%0B+ z!bDJQ96qp7$^pQ~JdxnzND5iJ%Az9A3T@QpUCb9`*4BXHdg0I8t!-3*tq-G^0KP3v z3ByGAk$2<#a$wh?POO!Yqw2XAC9>red$S7?}G;P>eR{+tl&MUZ#;SRA^kg5=5~ZH*)(qhgH(u(0WM#C$Oe zj@+Y-rR(zW3**wZsBp3iN(!EM>-UWLRpVK_n8R{ZX(nmer%EXg5}s5Qt^t1s^p1pS z!!xV5HnqNBZWL(wh|txlyXWlNQMfxGT`UvxdQZ2r4q|A&?gUwfR=%>qnuOt5JUY*J zYV?CL^rjv=WwB*}#WE$+G~{_ozW7bPH<>W1+nE?>$W+?dOJ8jHYn+*E^7F3BF?HhsRqTPDRo=d6<@c&nR+QJCoW!m z3}n)>;84U$WH7rp$(?w9_6OHdVGJ?Ee(P%3?Hfq?mY6ymY>L7}j!`YsW_N$ndSyv* zbZRV)ka2#TPsVfe)X%zVUoZ9SkbvjBj9B5m9(vOpJG9Op*FrHKJRRHur+TZd$|b<7 znHqc;o0(d7K$@>(a?i?o5=cVzU8R@sZ|l0BbZS(h7a+mOWY)yFoOu=0R{Zu)E^eEI^@oI4bZD*P$PZ^udryptk-kO!rLy-9~b$ zPCvF_a?EQPh4i{;r+y&)*vAMOX>jSDw>z?ugXW=j18bN>!_F6d-W9aIyJ%Gtrn!Vg z<1r=ZIyj&bTSI*^C2;Tu-M7K{1+)8CS@0m|2OY!@chhXP+rW^~QVX^MlU=8Pc6fzr zwhebq(bX)2yySW+@gqP{m74h&m-MXvzD2p%`KC$OVg0eX%x`oD5ot<=j4ETCMkMDT_V>auQZ*wxC zt>Dr!Ser{7>2pO&aD!A_%c_Q30Pfy5XmQVO@)12T-uDbbak;p{(laZaVwmDDh8t0oC4p6D?5 zY3WIwg}_cu>Af_Abl_Po5i?F*Qm!hhGJudhG2Z%tTtZCosV6S#3bZ;U{tj@+T)*cY zNKZmRaiSLSer>YjhaE0f!=Wy#_ROd>8^?w7_@+MB-ml=Ri+e%eO6=^#8$-@NCJ}FB3+>AKz z)kF41yTQg#o4gA8xAL&$^6bVlrLwpR^XGm_|ssZ0f4avujf+DDoA3fp`; zA*4AAHO_GQn`wo+jd1j{9*JYYI>u-15^`;yoM`S&9f@G4pBUHcS2S4;#XVT9ekGCG zRN)z@^!!6pop9M|@Y=|S#uZ87)czRniw)LFaHd`P`4X5{1Op`uijfA%-Y4s*{u?C zfqbEIt&<0zK`IoCgq)C>cyoquBWMuU+fWreDd-QjB@MK@Fg+1dQF{cByu^Zb8Tyb4 zotXw2P1*d0X|7$J#!Wm)UigkS!ICc`BsGtMt~9%;J)@Vf0&OxP@!4V`RQe4v(@Ycp z;+!)xxg+p+xw)}Sb+Sb{u~b@!2iclGv}T;Gsi!XDQwch~=VrTqCP#I#p3xR625Z`S z7sNOmWeac%qY(jfJF#Z_C9hwxlUNHrW}UhZpvIRXYElg+mf+!3@Ktg z_i%5H26sL1deVsmU3|>zIT!IL=Gx6g|@(^YF)dnjk!7-Z)*mBjC)F) zkVkb#gj@G6PT?_9BWl>-6>K-~!Yk$f%)VfsTM6iB$MH|8VH5>xRFWkX?ZI|m>!8f7 zy>^Lj%^aV?6@#^a%O_^jF9L-$NGJN!Ok>TJv^Fu4#UX%K-QPpD zeEy@-weh391#Rbt>0=Z775Tw(|ErPloN;b-y3X91B1vD$yGsU@ z?TT$Fntg{)CSap^1HKv3oZlcd*l^%uB!ohDk{V~bp)E~?@5eExUP4VlHh8yN^I2)d zlnM)wC!3y)jsDxK;=XVFF5=>o(SXfEcRqZK+UWKgx#^s{1zIJ`u`*U2@}yYlz5lCv z#@JLm!?BT=F0h%Cq%p&@77U)0d0YYMI#IWUSF%}QCb6$%EKYSL-y{t7jiQYE?BEmw)D_RfFXbA*%BH>6Vm(@{ICp_(?m6Z0a% zvB007b0e}>gs@>W2{Gbx07c{U$@+b{x>QFUG^#$2o?4^Vkfk{1Tn5XzPnxyYeRmLb zJc_9*fMkbG66?ubo{>^LiK~ZL$BpFDQNhl6d*=-ZPl|IJC1(fyG^jv?wceU#cctVo zMIwB+42886Pd1;e*a=fHn?q>LJL`D%T+s?nG?OflL=%({2bwRl< zu(liMwMUgI&}R3QSMq!UI`~gY#I%>sr)g+6@%c`~loz5>>_}m3LEb1(^SYd6?=Um$ z0eT4~=WWK4<9!LNP}N1_F`>1^Tx?-+zU2$xi6C31ox~ z(E~q_6LC!=2fI_e2XE#RL=_Gf-5X&y_IxdFw9;9W{e>Z(^6uMXRl4TgN|Xtk0InAa zC_zlW#@0NGZF2MF`NLqitXy{vv;vAVmhf8%%W{?_R8eZK%RYh~F-pD(euhep3f~0G z3N(OSH2etSSs8VDj_Pa>e1Azl@2ryDbEc3b2LtNy8yG=w9u{h8Z&`~!I`)F0sGjbR zwgznfynXFJn(3tR2Fj98)I^+=?p8Y0T6t+LREtSty7H%CkHAF)#Doa(H++T=NX#Dj z9s!KOd-*ZL(cInz;lQ6~!_UYys+SEQ;H=K*K zQoTHlL@H*~pxN~P`zaFGfTFB^ol@C@00ANW&uNvBt@Yn5FaL;#lReuT(NBm7v7-jP zr8Li%^gZK2@d3ISfpCabcqkqV&v-+{RU~orezq~jrOWTLVX73 zGPSK~|NdUqGx+QzGe+olA78O?sZp#7%LGA2mf0I{hzD`zSS1dEcbja(Oyul8qkcHi zOWBigNGQa^fDW<5xbir)@-5@!BOqWPpRf^)i03rz=&%=@9=q9)xCXr(;wKc=tNIb# zuh4p2GA3WC3C5J}MqAaD$KvE5T^0>-?k){mJJY~8CHsOSH!3Se-JXvd$_S~PkN-=W z(9UQkJ-?)>@n6s3E7Q#n2U|Nw1|wSslfTZP#R;-<{fvmgHHId++~(%N1?;qfm4d4U@`tv1W;{p@-B-x3Q1Lpi0I?Aw8aTBp9mNctpstbS${F@_hMFTf=b)hOMn~(NTbt=_gk-ZBCvj-M{bA zkTFSWN$=B6oFEZ*q2&r(tJvWS&mlrft#FpUCcQ<~{d$-g*T|MX7=%g-DLHYJK19}gM}TJ3<2nf6KPGidy{d}*!FBam z=R|kTZT$uO&Q&`S+HYMY8bE*j0SSNMpm&uTZHStIvz9|(HZw=Ti-9W|9vVg!Elv~y zOn7qgvk$$LvvB#{2J)To5%Rk(e+p}}yS3aAG#sp0T^iJKuV~m@F3~V&&~rs6SP>qR ztG!x1t}Dj6*%%(eOWyZMs5xY7M&Eqvlk}y*8!7 zsPS~s4>MsqKVet=FrvS)aP$}0Aq)_Dx8+Q>Nju`551Vs=yqDbbE*uA#K1m}UOcwnv zMK~=Bu^-YHe9qKBRI=3*l9QKgDXFzZDBVq@Zm2G_ItTA`# zZM%+De^-4a$;V~?(F%U{_IQF-P#yTMfo~oYB*OOUXw>qZ>(6L-Zb$pG(ZF=D=zYkp zx~l_PB&Ye8THWZ(O?+yq)d~LbRP9=cuW=^e7)m?Is4(wwbxOHv=t7F#QMdRvAvkZ# zBWPD^Q(Kd+YX{Nd0)4KeiRzWemy@g+GNnk7W^P#WX1@czVL$G(j6p;NW9oY3Rzenoh^Qpp8|wqGR}|sNFxQbYGNqgf5DCyuL-Xdfc@a4D<$pH@;cDIqw_Bg}vp0Dt zs9^x>Q3~3}@>Si~3h0lTSwB z94kgV<_(!a=j3GK?qWF#l~`DkTRJEpWL)Sl#pWmZ{#zcD)}YXL2_G5ON^7V$80E8W zR--8zYgYPH8vU9C)32wquTrtBIpb<_$RII@`)MV3r55%nUH_}cKimMzYwEn`X8p`lk zyeU2?iq$IA(GDQ?r+%p9bAZWfOh_nPQ~K=9zGuG?-?AMI5y2IqLu@Q`7#z9sRg7H6 zTt+)E$>I3@pt~o;Y$!;?k>K-VPPF@@Bv*#iR54Mjy2bO5Q(J=;Mkoq4li`Bdxfy4^ zmRX$_H6UVk`@q9ICNtW1Dj--8uKBFUn0pU^?zWab+YjBwrwfkP`*Q!~w`Gni9fns- zH}J8@3kV<1J2j>SLHF5)FAs)W9ncy<_qsZNTh(^&7V{l6N^;I@t2`Rr!V8QB9pRxQ z?S{Vf93HDB^eeRT%Bt!Oezf%^O^{0^_9UQWZAv?s0k4Q5#yCy_WL`te^Igi6Z?-T> zVV7;O9yr>)91orp z>d6rZ@O$4i44z`kkZhjbKkB``-zi-!-(KnpJded3aeqAK^1lL>832O$pnBf#=dl>m zy56_XxdOa(zdK-KoSul}5Ft5cm|A5~xR}O)%mzNP2Mu8BY-VLi;FZ!=)n`DFaE@^t zCGxJR5bM)6`&Yuw_~9`RoM?aZ!FnKSi8zFb z4_Rnp>GX$BjBkkjI9v~#{Lq;x960QbjgcwZK#N<^CN>PZrp|&+Q^)ELIv(MpG{hMV zwe)lHJT*ezI}gVkUSEjszmNnsS0bbFJL zL&3?Xw6Scw>Df|GAAGmiA`fWyBm(amuXPr$8h>KnXm@)}3VzzNbS0RY(~_{k_;%Oj z)RTJg+2v%rK7GWnLKCf;`m|SGy+NvV2{4iw@lQi(98PX`AQb$W4 z!eWOMSPqMcmaC6MFknX=T2_uk+--+v&seOTgHXPD%5z58V4NG`ZrP;Cn=S=PsS3F9 zqFOsJC%st`bG(OYcB-+6_fV#XGH(7131Ux^EU+P(rNy2m%r|wRr(HuwubOyQML)HS zM{D~8n)r&~ypa{JZ5x-zIId))XZ*Oq(nXhc*l3w@(!^4IlxQ9p)Vv{syv7`55Vn*# z&GnT=Tnf%ZgOc5xRqK*?IX$e>98_`=n={3;`a+TeILjrgt`lp_kU9Cott2x})O;9v zfOzKfyGBV=B>x|KcqN_ZHxyb#P%sLIsxx!KlL)P*rHMl~q0uH93(<~23JFXx3ryVK8xfFA$)9a*u;u8CFlWLg$9tw#2|A9k?Go=?st3HYILoyh?G`M z--*(P?CcAU4RiWc+$F^`Lk-*cX&SoICMd@e?v_d~R>d?z$uqRz@bfFq|Q=}c&vFx`>dtb^Y;luWH z%Peqe$d8Y^wV%D+b+VCq(Nvs>bCKTm#1FKgl`Zq>DL^JLFE|mXb(ilgbM(p^JB3E8 zI+7K~&z7WhrYqDSb(`ic7xBmP!Z^!3o>xSkc|{H*IT*^l_W{z1+6@fgtW-+Q2=p{Y z_YcLI>mLu``dI0Z(QCCjwvX7wE?qpdZST4j3lBJ5iaom=ul?PZO>6z3@SKYJEn1J8 zLwPC|%HBPH*r~DJRXY}(ESsv=&zm7^9(ReC91aIvk#q+w9|^wZjQ?I-{GC-;oJa%K zzSg33aQ|h4+Bhj27+U?qZ1|HRE5FW&IeeM;fLE|V#86aIKuGD7$;t^^lC3jrT{-At z+(FmX=Y53N9Lor(mF&2(rnWzzIj>6;R=`<04>m7U#W|{bpWfHY@tp%~vZQbu5u>4X z?n7jDpCQJ4mwB$;@8$iNC zO6`O(6*GxRa3LUtnTvLn;rT-TtSdD8gOA6RcxNc`-3xEmbOc9fi+_iOKurYo7mu>D zUiM5V%A;(RGAlW>NOWEx7amGSO``<&G&QdtMm*qP7HT9NpiB`C_umSdM8(peQpbO4 z9-hI zTVg?82>K!(G!2i&%7;kHu~sLoTWO(!#oTc~zjrk0{=3CK)}C-YP{TK1;sv~h**py7xQoz*pM}Qs!)+};MPCNB5Pvbh_q~!jX==}3Y28=QK4JeR>TsvT((#mLPF}EmW5o z8P07F|5ODE8#q2Xg$9x9GWf+*zf35sg>^vUyt4j2V!BO0l7tXtEh2 z5=tA)uwPERn>YIGl1Qx^=(Ol9{SPuZjTdD*7;N)v1gzpn#kJJNB2tfLRGG*;&ORx! zd~)S73y5%4wC|W~_ydIE6jMkCoJc9)QujC5A9}4q z0v0KPFvCP^bgJxT4L5A3+_Nw&$c+d>dGJy$4B&N2%vTx9D;BV5Xz93>2gWqd8`>mP&Ns$HQ^+ng@bHkr4+(W`oIc10wUI_- zuE5^5{drQ4p%0ipjK1NK%?XAAW?k6yzB`B81ctsIM3f%_?Pxskur5%ObcfaC$96g8 zeIc+;kYbLKWeoV0-&LGHB6yEfvuO)HNVxUq{bV7}IrWD@*}tt={gwl9Vb(7N=DAmI zHpoQgSf4U(PJb9)(ljq(g+pC_g^?)e))Sp3oL+~&0T^vSDnqr~I=@Q18LShw>U=09)Yp2!mLGfu~m>_bzA$yci+^k4W13i9!gwdzniz9XoRA}tmL8(!jiSW zuc7X2Rzc^=ei)d>K1ub|tgXfd2qY#RlS%Wk4opJfRtGJ}H{@QR66^?La5OoOP_G9+ zqR@991Dn~tu+-G@&_5#wU3$E#F0I|rlBrsfGT%vJY_Qn=gd0Z=qa%FW$>@L?WwkD^ z5kh@a?M^nhXy{4jlO-PpIC$A+u|)i|9zXd&Tf{}ssXF|idN^x+y@6v@#Cul!74;)( z31GzckQ8;XT?iip`?MH9QP4OQz#8Kjt|B}}CXP%h$#C_04>NW_xE#P9c=0>`GsJzy z7XIb!6zD~wq}sz?q~LUo#E!f{qcw7^>Ib-gRl}W~{O$gSgzDMeZA^O>T>2i};bXJ> zqEw^vcGz6FL)Q1<7y|2B+tA6J0vzqV2YOn`t;|Hm+LH8E8Bk9YSxTh?};9Wmq*{DlB^ zn*$%7ON4pF*dI{v-5&tCW_=k^Nh(Y>8<*rZucxP3kK&ow-yW&XJ3&@JbqmK98`7W8 z|MswX)Sj`4VXYQ&Xjna^&rg%VOFMpeX!x;QO0eDfTzS@Dny!*hMSqC!ox|7l`Q6oa z`RHu#bh_YjpQA%V*}VOhyC-e?;r-OB?)YZCV5+^LmO7*Lmb=k;X*d=zSunNcd!cH3 z^P{G|yOX-2-dCLvXu5?Nu>33N?2MU#Kj^KRKEubX$1IYXI;5n7PHj`p`kl?*@%ee0L)NUJf|~lfScBQ&Dq-g{ zj%UXz?BLV=xZ4u__^VAvcGWb8OYIJ3ltceTMXlEp<9YjZ`7z?{UhVZxE(Db@{DjSW zgQQ;%9xmGB6<;wnmYX*PZj3VMbKpH_@#h4ajk8=RITL>G0;8GF1(1N_YSM__4EzO( zaIwCdfr}$^BBpnxuEayZ8x9+H4#be!)iT4b`N681@93jB@)9EAn(q*v!BS#X%EcH_ zIty&1EZ)S0J50F&^|J~h-S(7oM6Kh6rg{y4P}S<2l#zxLjbryi2uXuUf{IUo3Q=iL zOM*dKTB2Dna4P=Z?RryA!&Gy@8Ny*9XLiwlFti=yX0YLYf>u(5*jg2T}UfQ zD<2#RaVHn>Tb5r%0q%tFt_8ck6V8$n4-_0E&{j>n;k?k=h%87=af5# z6ZMm!?B#>A{ehpn93x>mbW_As+}9 zUO-w9R4l2RIw4AFr><^H5(Gl&Ecf({O{B6LCJ0E1Yg=(&zvTnidIfQxkp(`!q~)2Q z8);v^CQ5@4g?t)WFKDmF&3W{dL{O-bpqau=tf-q?ag<5Y{llnR)cWq%>{{UQRQ3Ft z8rv^0T25W*`*~klx4Jc*qy6!-JTs<5dT?l+_)W*YrWyrY61 z>Q+UT^v?tD_dIGRb6Sf${`^S2GWtqTpwTgua>$>1QKe z9-}@s&d_6ZYtywV7K3e0awGoa9&TkNO8gEGp=VW`z?)todmBsM-eicXJZvnoYI_7S*4*~R@Jnqx$s+X!R{h={&ls%Iz_Z+{za33X)Ju7qO$v=5wC{Jv=m2< z$J6OfeE9Y8k^;MUEzUs1Y9~*~2aeU8bADz@2Ja`u8>l19hpe1rGi$WcemXgicl%a( zc{#v%Q!-jyUw=xvUb(43&!ZgmX@tJJYLr;BnN1cD*$(C^%@q^yk^0UQ@|^uS*3ko^>#JdPua9S!qS#cD z@pN!=;%MBYbDjyLnh~UYWEQ2qHnf(42pS28Z z?5egV4LtYUx_lj}ZB*%tM636gdlVy;wQHkcSZi*x89^qUh<2=5V4=9MzShUtD2IHa z$r+FKMQS$w^%k2J5l93LYuT!7b54?zP0ZO1TWleuAPkiJ+{THzwf&UT)Sp=CSoD*# zatqNV7n5}n7idiEvcZO_Y6H36U>iD$k#(^IJQviJ?d4JfWp&tP4Mx~ST_y)EjW@s8 zSXrH@+zBBt1@vlqR|Dy42)7qEcE0qk)|{tkFO)QrP(1#G-1U@-ioP5sIP}WGjIrnV z<63@%Nb}96O7rPvGX0>}Z!U%4>3l}YBu36VgqFo)_4KrgUUF1>Q^vddKH z&Ndd|uu)|tjs5c1tKR-*NAa>M-KI4;sR}U45qBN5H7Op~D)I#(htmUKL&4h~E;cPK)vE1B zA;Eg{MjykuXCUBkjm-me1mW`_-$UY0Pfu|j2+P8$2w~+GvTFk&5!T+;ZR+gzhr?&Z zwWi{5b4h3abU&@)t*sG{{AjxjtJ3Hia!I*ptj{)a*&BdPooS@w5m*oTbGQcNJ;cBF z-2fL!PB4kuU{xd(L8~cfxqdlywZs|6+Hh2KJe9<7Ey|qT;ZCAdIt{FgOEq<1MQBBk zlskNln^vVm_o>p$whb@U!!Yl6Vv_NsM^rRwEiR_^w)@cwqaY&{!ve$Q!up;lZ{bU9 z_z6wb!xIw@n?({P-*nuc1<+YHozXskWsu~o>dpyZ-DTzD#(OI?DhifnwkV6+x*QIN zUmIHzS@w#Ugk;`au;YYg!s~Q_s$!*QyZLg(K&2dkrbkTE_I>T%Wp4#qsC}Q^{L~nS z5C`lMhv>OjJHS%-HOkbY687wmg^*SRXqe=nv z2Z=C%Zk;AJnl%tM!&Fj?RKnD>gk0SCNzD56y@%0RODhtv?kSjfS&L~BZH*!qj06FT zslPvfdu!7^THRq2Q{>{0HUvYb_2b)P4$i5^upK`!fmJqG?}bi>)t`}g)#jhEJxeuu z40Nsir=+s-WBigTJ;U<26bw=!^GLgPOu_TXP<#vgynkLuZs6==+zzMxZPlHXCN{0Wq%+fCe}mc8~Q~+_DAZ%6t9Mna=#V;}ib) z>nAhK0k!$U+(dG@EVlZ8GRX+?tFlQ}HIQsl|%&7{^PMQABb+ui2;X}_9IPpN5WXc7?|B5^c5S!>bI(C7!J z!cMRR3E?J~m2FBoE<1)zr_#;e$&h-t)c3k{^esBs7{`3yj)&n3Ey^uAu}~=F5RGK& z7<`{?&zH1p`9it$6+w(vh$h>8dg;Dd{bFQ8;YaO6?r^Ny#xq z@O?JGpJpsR)sAk|)93Mg- z5Y<_n-L#dsJh1Jtj^%quvtH|5weVLsB|&-i|8(deT%gGYL0%iCLT|$mJ!AZ*d{s*PU3A9Wj0oAfK_VrgHE_qbKg8NP(L6hf2$Fvxw z3xORrSWGDK>gp;#W0mzj*DDlq zLdj&7>G%DJbF18uv^LT)?Y{4g;4R2LTO7Kco8>eWI)h4!eiN{Pk~W>!Pflyw^cHCq!BwQ!uulRpqWLR|ZoXUBHs`FcH5H zrrcf+`qoIQTo_OTq7zfR{$GN`H8oKKZA`K>c1L#(tCnl_#hO4j?X>Z26e0nysgEAHn*&6gwNT1wSo`eeC{M5ISt0 zrRr2hsuVasj1WKM9uZHkBa=DIOIkgf;b6cCLC;SMKe6#CEG=cy4ugzG4Dz3_b0#7a zIc(B5^XHQsTeaB%Dx9c0-$*%i8BUL*9SouXpjgjjC&sH6%o@KlH>Sg}I$~5P2}J%!QGvMLvVK|xVyW%yF>8c1PkuYL4&)yOK^8S?(H5uy8C_q!5(|BnorfP zwdPDV?O(P}#EfU22Fqf?G$B6$)klQw{Zp9NDycmKLBjlmXBmATxyybL)FhLrs?kW4 z%T0)eeBCHYqD&`HvKkuCyl@j~1%i8l29_1*2j&wH^uge)m>-nl+0V|tcBLN^T$11% zUJ6$?)9Npfe?Z_sEjJgvsx$INm7k%8NqoGpp_@2G`|IoL0d%>#yWLXjmda0ex;N97 zh+WWO!Jk+2mv(#YNEf5QiBhD+h*)=@Ps0I?Q*ZYMI!@A2CPwBr2bg5K^ZeF#mama& zgw?=EeNlzLiwznH5_&Y>+yW`$3(Bu%?s*q+QnTj@MLL-lyD@d0CgYNym$d1w^69^` zj0K-SC}$TPm+JfMOKa%GZidFIJ*OKURVvl2+knQdkC%VvUp7-zBH=&>-=OgM!MdH~ ziW&y3UBpm}J;fL1_8y2opYxhOd%-QNGrnczslR3#{#&eSAS~eph(dGknOht^ zbseMRlH?yJm&j6-{~I{QqwX@%Fgr5ua4kiOqJz~i1Uf;otG3&=pqSa>KrI+hI}Dt9 zXsp#QrSU8l8FePo#9%SjPx)QAxIgkg(p*vu!(fty33ufn18d7X_((i)64}exd`*xw!kWv4&i$MdnoeqFO!D&((WyI_czpyV)%Am|*;R9k&qJ%Q~&@xNsfE&4~W~ zB=>=Ufkp!{k*{jRU~X~{rP=COfB;E?e?|VGU0wPq=h(NjavE?l`Rn4<+&K1I&fgzE zir&a+htqB19Uo(ak~NQ2Dlev1^9v*{oQ#)`*Gms<3ij~dtr&R$A6`C(D;DPm8v0J< zajD2|Wb64nd-3i(uE+UQWrj(OwCMQVnMe#1gn*qsRzYV$N`aa93Ypcyy>7+CAIxWfpfeyuI3+_-p*V zTk5BU8h*01o$7B5kc>t&`cIQa-w|igLE^UgN`bg?=zMrm+AkbZcM{ouDbGa0uFY7h zb=zh){r@rc1VEh{Fzp^(GPHDDw9BR#mMKQ6HF+HVSxIYo5>LowwThHP#Ub;ut|gIH zd}-=1v!wu&<}u`nte3=Mm7CXql(Z&avDkW9Y&k;)p#r}_;t1vk8Af@dxRLWvSsHe~ zEYy5I?6)3%jI*X-m(zbCEF_!;?7{TB3L{zm!oi0Ikdew8T}`^?Z%FM` ztu?Rt{9D8aPrrb_0!T;h5Kb)@T+UDI=W^P$v$@K|IQN+r=l0O_YBD zQ|w8BXhhqLyT}PbFDZ$Z21c8_*N$Z@^o&GYdQ8pV5LQ4FjhNHeewxnB4gEuDPxszr0)qLrT;da2Wx{eYZ|MYA$O&kB?L=a z&*g?y`XF_pZtTMK9fGs(KBS^_yFIAfK7+SKRutw>coKkR3N{AD75d#i< z2EwObrEYv&EYZl+yU6=K z>~$fqS}bxZT9V?!l{wGGpJ67T-Sn)?MOlFbQIC;BA{ZqUaTCrr^A`djvTv_lBGz3u zC3sSa1p0!G^`3+Q02lTz5fO)y0`eO7@OmUaDv^?bTS5izLNn=4d zga%ipZI7ECT*%dmp>~a^I#~2hv}}xdsVh0#C%e$fWXoZ?Jo=!g7F|cAzTgv?64V-l?89!3xPw zjv;~TRz+)>iWX}BJ~ubwV@%71h3l)eh+h~PP@rCZBkQPzGUfA)*mj@A67sQWZldxJ zsb2266K#082tzQ19jE8VfLE?1|7F(Cqa?{fxcN=))uH!HOrVFMCbG*PEeVQXB&o=V za2F%rAutW2c_zG-&FKekpWQ0ip&_Ax!4@BlOuMuW=qP#eq{dKxlRnRJ0le|carHl& z!^8n{HN*TJF;TsjM)^3Q_r{xp%-zRBi|O4@;vKR}E8BkJXuvF~QfCH+4CG$};Ubqw zL2g9%!uT)X4gNa?5ji{|Jy|TjH?EuUXTg~vloDyWM zl$T%spgwa+kCiV{vO`7b2Z$(H@_{E$3IitlP3jHM%8Mi`32KyK#Dc(|5U(>P<_G1r z8m&^OClbs2m6Cr^-fr_4I>Ml_Pi%P|xZ|WU(8&g1_hl#w)ajy#PKzfI~K&q z`##BthAJD+dyyhi;FDI>R_xFNCKvl!r)w|J$TS`q3S&J0e=VQ4MitN2My5-|!f6Ng z>SFJ!gR0g^lhYq#n0%;OD3|x3pYys%Y2pIUR`+50&XXJ@fk6@V7~ss*no+ixwO~W& z(>INX?!Us<2KB5EKTIT!fQw2pIu&s3GWD+4;vd5Mob&{I+XiVN>(ss&U6EJ3)~?3^ zr#k4<)})N?cB2Lfy>QlH$f>D38xFf3{~W~P=s=J9L)o5wlNsuL1xgg4V5=A+LIZwJ zVqRQUKGaJiXxU2f#e4k7*YWocLhq|!{92~Ys7JF*o8=B=Z#{nq3Fw|Mr*QNZA_99& zK&E{yzo?`$MH;_J6{2&9UXg3zXgn%dKy@C6D)-3Zp=ygN!rSF{`{8Bh(d}JLaBaCJ zWie)<`@WtobuXgHBfpDACaI5$36=4vTA0%$=*TV)tot76>U%DD&d@l^%nE_QA}^P{;5Wb^R}Kpyck4t#ji4Bc11N{pX;3Jl(w za^Ky-a|Kz&}Auz}+1vIY<*~S?h*V;&V9pj7UqIjFbTmL-0QEWfpyR znE<$glwf*bKqh)=ZmI(>d}FK<@oeLF%WO%atsi9AuHhfsp6I=Ymb=Ec(+Z8!CzCW0 zIX<&6`J+Nj3n}N5nW5M7QsYMou}GjIi8@xmGOD5}-Y^(w`x7o=B2V3g_aQsi%=sJl@K|2N#yCTmaYwkm=suu^1E^wU~Z9B^)-Q?hzNySx#&Jp{_*PSrFZ!rf=<*3D36kIeF zU6p+Y8%=O{?!UR*0N$X`gTBVkx2ezl0^5xEoXkF!uzFeOHW&((%b8zYRjV&xQ-5*9 zqgjfzk|y7`W>}dl1^r%JxrT7@hu~Ybs0FU!4jMZ55fE{TmVWlVR6C2}VDoVnqj3){ zu?&TMB!fLk+^G58zRF*}H^%_1kyh1(3*F*LO_J^LkS&F>C;oDVFc?HS&u zP$$op&h6M=#5E$RU~-`n3P%eM0D*{j!-;=(bQP7bg+-HjN7RiRA%dRb7bb;vWp?#b zdr27dZvJLMK<;qGdkj*%`L94-%=;3P9J2}QAOW9Z@(gSpMvwc3dNuu|-1{QYo{{O9 zUi~Y;+7n&xc4K0G&0L`y={BSR73m*RN`xJsf7wL=R9&Z}+)E#%?@{?sOSOqAzd6)6 znv3S63V-zVqxb~UdZr0{L@7ptOZw#Ou2|$c?Gdgw$TGiE^aoL;OoL0!eM}wyQi)eD2KCL-Py?dzR8dd8F z=wqS4VatL@Axz9#BO`!K6Ae?wMtq@uuDy27kC%!V=zzE*dB=E*hz7iZ3kJJdfPgW+ zNn~GAuq|+@vNyd;8iCA8imiX$4A64;|T&YKNN1jTB<^1#3tpJqhuAl1Sv_T|F=Znl1avh+c5OPHOGz)7f1wH1ShQp`T00Hl62 z74DzVChV_g(T{~uVzV>_AWSE+vtrCNW5}PU-+YU`)(gP2OPFl7We^ z;n$wL*^AQGV926AWN2k#YD8mQOxR&R{WAIuK9em7mgwM+W~<;=ofSq1k_*hxl~09z znstyUhF&X5BWT;i7@3fBUSkFf`+>L&l}T@JT*RK0DBqK6kg7L(mP}rJ2ge=m^7_ar zw!7dRmM=&{3+uNIZ}SvdvqV*cHUFtcXXD|iQsnonIUmoU2Z&Tt%7k`(dzqog9CsD0 zaCmJ}L`^^-Hq68*_ugtqofX1kP@R$KENmpnEv~jB;`-DB+FEK+oNyfHEk7)W)^bbM zJ6up3kqXMhzk){;ASa=eyvDBbC%c0b2`5s7RZ@j0d*XJ7BZGz}1_J)S>~(Z=9)W|# zypQ?AP0u1Wet@?`1yWI%maeL*S>F4)sPQ%gai=qy*Vc#M!)s|kX`IKRHRC1&3VI#w zyY&Gbvq85A{`EZF3jcy}U51ILW$=DTT_$%Ungp~&9iY7Cr65654UVxr4q7w3F}9q5 zWnkTlt6Z?DdP1R`u%@$KZJcF5bnbC%Vwl48DhLusNlM)Pr`t<;y{@=q9a`@n%opLF zD=LP7Bf{4SRYe}in_u41L*Kltnbvyi~Rrt!K$2~XXm#h|^l()Wem@ofi zfDrmx8wxi$nl6I!+x5|(`(^S4gUx={KCuP76?H&3?aVIjCL7b|s@a~g6lOOnCZbf{ z-z0d9EL)9OEeh(*@S#Ci5pYu3s_mlSw{2gJr);sN_VtM8Rjl z&LI{?x@l&9uWMWJR0XRtBT9r%H7xB(FJ&$`khE3Q3Z6HDW4HB~oxzJOTW%eDhaXv* zc8sSw+ncwp_42RBzZOh0sY2?0SExVIH8r8*6tg)Bu6v+ZBEa4RPN&79jc@1~-OQ*L z3sg@&rjE&vgP)%c6%N^-#+Gy5zGxA7fF(DvOKW>*7zGD>f|;ladLpGS(rDG8*6S{E z(-R-VUJ(16eB(qEgSl43k~VI*NB{@JXgK(WPSl?eTne^6-s{ZxkDQc9=Ws}kSnl~Z zB5)p8PPD763$ffgUpmVCy&olDq{{P3j|Me~1jQbB5#g2~k@4Lw8vV0LFn4viiW}jl z?ofw`0$gBN4Au)Bd4^E})?+TJXv%Wfub`pKfLlJ4;Mhc=jNd|X^%<*_?mqv3t<&ab z_bv7tJ{Ql1uMpcXw1{UTEUcU=DaYnx*v-_zFz-`Hqd7I?=R?I5Z{s{{zJjiu1h%p; z6GngGS-7u^U)b&PSp32PBVt^bL5iE|O_^#4Llyd+U}u`uVMMLpgV=?XR{MV!3f1}u zc-JfqdwRChse3U0WWvqXMSzYKFT^3_Se3>Y`YkGkiwjUwbUX^G0%>!SwG=8*^WgIzOw#sLgjN6{)E8Fc0Re-!K6}k=>$eMwdu#Oo z`UMzW)8cjejdt;lrnC+UvEEu-vz=v;2;w5+S+TEM{9+^47hjgJ+nE7C!?IAaywJ!c z$Wu~weo1moCkGQ+kURVz88CJb{T+i$zbEG?Waiq(k9~U@hd=U-fQf9BRl~5KSTROvUDs(3`0GV?dUoqH zRzvid>t@qT`(k-23S-jpkzfwoDBiQgS9eti4h`3X7>(i%-LC;j{^{D9bVH*wp^L%1 z_CI)8yW)DK9`;O(>wjMp8u?g8K$C3&LefV@AP^vINC{WC;+LFq2LdISa&>L%`ZAcs zb_9BRH_fdr=O|4o1$XoR!irWIG8k{yKA<6Fis9wF0caCdfLeV0J14!jLEj4j65+rd zKEZrJUlb@ZboR*4I2+vkr>(wcPbJ5&>%v}GTVCB_d3`8d_a1r1|B+Ws`$|Nq z!wHqkAvPaKZjUFi@Yp@DbNPbaXm)?IA_SoDM(=rFbOe%D<>gtaghj-kTHo|^%iY?O z)fiuS<__gGfJ+H=xk?W<82Oc--yA_BYj3-w2@0a&m_@l;C2owe#hgKERRVe!KQMJJ z4Sh?{cv$z}N<&%>mEf!DQtIn939N4dPSeWfQW_#DMe}7tFe-#Y*7=}=<}XvoDj20P z;s((nVZ^{oeeKrc=}|j7?QYe#B;tDUYSGK2>T%uCw6a-1MGSBP5I|dYctt?KLqy#D z>-lk};*pVUhEBDhwD5z8#9)L-DQFdk_igg*e0*SMJ=asR(CEsL{pF$KMnvh#sc6?q z^$l| z2yI6L;AX{28Bys^mJ_7!#xnX?q?AP54GCOX>|yTn${9njJ?JM;89F?bF^6J(J(6#^ zwtoo#&lxETKfB51J)6l4$i7Isd~?9;H$&vL@3V?*nANd^Q=FSq9;9V-dKvKf`hdU) z1Nkom|GEcR!;|N$=Oi3!Gm~D6?0aMzWtfSHM2x^QlUvduK?r!_1*Y#V5bK@%7dT%` z_Sg7}gvI^aRz9QFS>n&1bf0f=gfR|U^RgWy*9z*}2*(5Tcqtb<##1fr|9H7gZd;Lx z5xhY1Xd(3;4G-hWg(wm;I30V{;twygO9UW!Sb;_9cn}&&4pomN4j$HoiNA2pcY7qIW-7d4sYX^_Dg+s|=jZ#dX&w$Br85 zf!tMS2lps-!u zG__!C+h2Lqe%m|@+VhBO8EEHwUO>te*~T8J@>d(D$G|q&U-ecD{nE&Wlc*aw z!fKCX!1LtNg9G9C%;v1S!ebt9{PRKAqollOZx~f`OXJ>0thD6ZcL7&|iv^TMwl;@) zN!9F0OVv@dQPdKsGpx~5`zuUjcTR7y=-c9IcE`$f)y!z*`hN5^LJ~?N_V2@{B;H{` zL1A)th_U#->*;Hv7a#yx`=AV7vlajt#on3jSkoHz z#>H%x%$m88Qs7u(E_eeTU`7E|V>hWF%|F2MUj@nf;>rWQPVIui8k)#+xNgHIHA z;G(DfHk!rR^f?J5q0WgUPVB*x*t9byFoVS>TvnW@4X8IR=8UPhF0Qioy8q@J7F-_j z@3)k7gHe$r%1>-`erDZlXM}{?T|PWfQA<=dWU2lbj#OS556{T~ck#;%U(8_OJ`s?u zbSmrO-Yeq)ON^PnD(|h5$DSsc1v>38GyF_oG(1GgaotHut~#X7NQ4tOu6z}=4tbM0a&*{@ zng|EZw%2ar(l4d`56!2;-Fl`^IFAAqxhOTqD7o~vT(&Kn`NW+RxebFCvS(OsT!Uo7 z<#LBb4Vx>;_xF>D-6XE2Zy|ifv9Qp>o-eY-IO@KZ2DR9hsWUEH+~*2F-a@>JuI0wubq}ne-sFiS4l_q*KHVb6c3KElo^)Y zWSdcQX~?c0m_tIg=Kfl~-D=tN1GF7ZwVg4jDW^xIJh77oahB#l9~(3Ft`lt=4iLtT z;{#+@3jcXg5L95-7`Aa`bSxcATr4`7!9TXa8~T)V*g;W}-rYH{oS3XOBZga3fP{TB z*{cd&;Xo0ZgeX?+ZD2P4E2#;Y5zh9UiT?Hv4`*afzS?@+D8!#>KsfSrh(&*G4=gaT z%KK49NGK)OkSNv<>pJ-Z_`7y`_(aYmWau&!J*O~LeN}8LBej7-&e{2H9T$#@^#yiz z<|5Z}Eo{28!(}pv?3W@uTWWj~@74HRz+ED3g5c!bDH6Il^uO{SwoO2kfE9%OcXt!g1HH{8KzLTy3lFQ7njsQ4g=&6l?Q%V@L{+F- zKD%Yvrl$MUYrm*T%6)Wy#J#j0C*W<5*r(e47yH_LdGxxBbsyjD(bS`v8HH1l?a&A5 zG{ZCvi(k-(vIs^N6qlW#w4nhF$vH@se7Q3s5MSCpmgO<8;IdA0{E-!$DJgthfOg-8 ztr_i1Mh=0wB@My&Oh^s3M?5ja?ym$5OmOK)VKR=C{ysM<1L*{&0q3S4kt@n?(>DGk z$=D5^M`3i`*$|FsV2dIaCHuAS@JTSC5DMpM0m(*r2=){Y1NPl=n@hS4CY7#bWu9-? zM{lZ>sBQe$IvMkS>L<27stoJaVL&kRT8FmEv)zyg{*>1?>K8#OCPBvxU!gPL&-Sc0 zrUj}Owqr=2!4lQ)Akz*q5NK8`DAdq_L96ajc1Xqu2iJlJG)PfMVx(=s)>+5~r&PoY zBV@R7{ERWS&4@;>(XJcKb9Nlwi1}kWN+EqgZC>|IUt)!r)e^Kazy+SH&chj~K zov}dSOSP1>uxhVzg0i-X4ki+ovT&%Ft}-3=M}&1Vahgy?HaUb5*>h;8vWDTlMDrUA zT{WE*2n>=J79p{3%oI}K+Ss|Lcwwh$*m?um>!QuV@5j^8{X9qPUlCzcTR_^+svqcr zlrwlz6W6f`>bJ|C(lofY$&pyJjgsY=qGt!+z!0VI*!IQC{nzdSFOPf!|c9|ux(^_`)685Zc zLVP|+Fe4asw$=-aeE_-Clf&f!daR$%%u#u1S%*oYeYZfiQ)H`yuP>Mp)<4Ezv$8d209889{o4bmRgX%x0<#_7aacIbMK@2YykZVrL$ zcAVTx;6KzMPdroH!q5v=?;m_wEA^+xwrZQ0d)LZt6Vl9PWRJJn?W$%Z{&<%ZbUtRW zc(COHrdvG|K}7pHKak~A50a0^3fc@I1HzLs>c;JhsYyMF>iff(~vLEL1nA9poaj+^r(9)ZO(;AiMXxJ<=#8NVU44346Ya zywPA$)5QoaesG%wGzu1s_6eyc*D6DFY3Pg=Z=8-py7eMsA|jjjG3*n2K+95QPJzV< zuKbzfuHT6E$iTFL@6b8o|M@ETv3L2xzG&6Nkgbn#UzoTBOmL4V&MxZu5p-h!bJ z-cFGIVDOd0jXCqGKqW5w9-ip6&Rm7wg+{;#_t&!{_OR4tI9!gU;ns})z4v=+3_`Y1 zUD?3mB6%V%N{5(hIFhQw$)0+Ce*PF>r;^tEHjj~VZ9L53xGJuPjdvjt8adG1-)YDV z%dXTBZjL;z1~kh@Pj%+oi~oVW-Rl2dw6G8_=(+@)O9C6F%!IqTf)$9JJT2n*nEV*c z%`P0qVxvjTRhrRv3jSK@mc$e!;~4a&EcQu0B+F@WCYA*72qi&ka*IW)1Q@!oCe&eyiW6*6zLgtM_ zjV9V4gLnM~w)W#!`?Bu=kVh^YV3D6F5;}M7c*QH5tN9(EnnEcxX&V|rUVfeuYBLDC zt-$GElsE$sdg5gaCWrpkI@5H`*xD{IM{f%-{5Ia_LhS`jp`+HzeE|O~`1k z|Be*I$Z%ygN8p@)T?W{h!RQJJkHuE9%AxO>}Oe;YMy;)cl z#<$)cn;k@BdgJryDxmnW>wCo%&XXut`sgW~ahAl3mcDCgg-Mp!_$@N(F{Tu%K^k3= zgv!IB@=DMrvUZ0i1ydB~uUHlUqX0Y07sM_dgzH6F*z0?_X9;ZJq{9v&3j!r#tNyJC zODd9fWYN%Haj{~4m1g#GE4O3bAU#&zW*3J1F{TeD7*T~}Njuw6(LSo`3|jtb!FD6& zQmQI#RL!TYjZcjz%2MN-@=JUB2eb@PNucMr&hNW0N+aQ~b}jlqzd+d|nK2yi6%!8Z#ROLm>vkrB2y!uM z4(#f`&h?iJ48^v~uPPvXBcj6L>#I}RU7NVnfJ8}B6icKJlkZRtky?C`h!`^P>0yTl zkaOu0;_!7wY{9UXS26k#ggM2EAyHA@1TKI zRU)nG^W|0J9Ah$o9EbQbGF-#JjwrA8zzk8&x9JAQ*j9=NjQ(d}u?13XxFJ{(Em1v=naZ6LQcQ09Sk$!p!G~lDnqB=3Hda@x)g&E{!OLb=9QIQ=X=?|P z=T_>)Hvn7mp7DS*tkEs%@9r_*lp|M*;zGxG=qYj4cC2@+?}W}H3s^PIm_$Gwm; zuZTY%{=nO5fxtQCJ3dys4z9cRk6M3r za+^kZv)c&~{`Tzq!|fVsT}MByQ4{#lU_u$mLuP<@X!hdMVuj?fV0k?zY&Z}w$c+|y z8Of8&uXxBjRI_t?v$K|R{g@YkJF0B$agI%lyF=^CfJjtU)k{n!NgItpN-NlRtq`;G z^9^c=RoK@JbU9z92yrL=n0R0p~wic4PueRzgf<_rcY=V{?sSoCWMLscD*rh82t>!0#^G~lC7 za&2^Bxm>vIn~o~oB+7;K1CRaF59>-NCg7<^z9oom?rsD%|JwBCdJ}K$r%qn0lYc{3 zEdj=Aak5U^)b2CF;g{Ie$>(l6^?A4pJwZrKiM7!@qxm>kaA`UUh@}L;xO}rvhqR66%e^kqMt)_Im&Csa@DF z`62~-?N{5B`trt!{Bi{O{|Oq~f6Ugt1T8)r_+=_Ue@~criQ)3MoW_(Ht7$@SVM8Er zi5sNtnFQG)(aWH~kgx?*0B< zi*zbY%)D4Bneup?!F$#Bqp^CIkBvxE7GEQaiiTO1(8Shi5>TfKDpyuNAEo^PQMnPX z8cuJy8{37m+cT`4yKc!(Z8A?V)=@4%vZ z;z0YUxpG+t{i-0c)LlyryvhtGbw$tTNnp99*u4l*+CY zB7?K+f+nEoTTe!DG!Y=h?3{=5PoO4^l}mNaH>ROkLly_p;e;IS=)(8vSx~R@vw@Ec zbHQ1l=swpq_MrIl@IWuIBN?(&6AszV6u%B7M1Ad=r<$dGFg~I!2_wlFI94i>?GvNP z0uXpkH}CY+J8Q|4uIfav3B`%CJp6&>0$F<|FwnVRG_^ZK-W9-L*MsXeO&BLAvF0vc z=FAnut117ol~(L0H!iEden%y|cdkz-x(TlY7&#Lb@V)v^A!>eB5T zinvjSxAI)Kz^?_M&|v`_dQD!(KPnVv+#lTzaH#Wx?N;`sOW!ZJnps8&JM^-;Epf)j zrveg&A-mq4|HxP2OR4%OR{VN!F(qh^ zVwDRAQ&=vCLZG~la`T(6)-c)b6n~s9!HyG(YBMNm9RDS#hLH(}N~KSY zP3$X=4hfm~b%r$v8TC(KL4*s1wKE@EFp4Od!!D)X^c6hnA4eQlLdXg_AyF*J!;d&~*gjVyEluJq957gWca-2kVcEY3J7aZxE^}`0%;!(iHmG%C_ z)R!st-VI}gz`wYMkwsd=EzrCINgwFalAKeu;IrF#h3BaJr-$fI%A*{ZI7RNXdf+nI zIxAtT?nn8BW&T1Hu`+x5^i_TV6xfpZ?h~`DQF70Fm4D>){KF?JTP-)pZ=dVAMyBY^ z&v^TB87<6`{6*^NGDlq+>W63UQ^mY41=sP45QE_|cr44w$`vEI6%LU=p3)$#Hxbep zOGhF1AWxm}l)ys(3pSXvKzQUIWUmS)^?{Z=`ZYWnGpYXZTAAetZJgL-v*V+0hnSjBk!;hs!!iXyZaJ}<&CfGBMwbN+|8fz~4L1re(@NBfgjevV?Tw zrm0l`6MV%L%0eCb*lEyXx`f8wDmxp{OMALLe_#Y&D*&>#vMOTH+n%vxa6wBEZIB1! zd(AC{?l_jyZJ=qG!lPv-0AySJ7*SdaGkrsNPl^NBp&{tw+{W+}2XPb8S&dpXkhbdM zEU8SDH21m9JL_5SyY&NO@s475embg!;It!)e@h*!=)G4!9lp8RdX)_F)ZZ=vgK2V1 zwP%*d#r02l;P)M*?`78?HRqwoUYA9_F$$uZyPW!5(PCC|Q6smYZr|8`q_Jm(X0KJ* z9EJEd$KD?Cu4JRml^AW_;@hEf7Dy4mxRTZd{q&R7O~HY?Q>4o!@(Xe9p8x8%#|jy~ z5O*G#s%8V>TQ(x}#ki?@dxn&}fbbFioa~)`L#*cp;p5>L&^tveOkGc;sGwZ17Vx#8 zuprSxWdVlnsIxYE;c>(Jy5x{cyl|?ZhF%n*UW0LlEk;S(j8Q7i#mwH&&!C`CPVQBR zdau*pjoPh2_{52v&J7B8Qn~bHUd}q%Fu`Cq;`}-$MY?EI!iDsoWFMU*ZlY3RK1TEd z$zrQ^xF$nbF`(eRH< z3ZfJwM#ld}lcYY{CoSwuQ5pRM88>;8W12FGI3(~!~5cb;9i&E@;h z@@x*A@o=ze(Vx-v47#8nX-=b8%9)soZ@o3$jmoK72(n$MUL;rx+}@{>vPe9^PH;KK zSr~iESIwRR%%CNY3^8cv56(#FA_CXM7~b*%ZQy2nbb?Ts1fgjlD(QtoPc}lK zu;|RhGdMAS=65AI*$K9xuhxU@|Vav5&G z1y)Ar5x})U6XK#%?27}5jHa=~5{fhC??^woljNXmzJtI z#{PCYa*=;~k0{U5@L&>>@Ffus=9J+vN7ZL^;xDqTi?>`|5C0oUG_hQO@aS0Yy#+E(QF?Zb=m%DNHkah!~c`i+7ZzVBT;C}nM{-D zde(RxaH&*mNVqsCU6L+@}puX)hIOVbz;L3-h`&QMIAuoi-Km;R!SG z)sgRC^gHyk1l0cB7iodopK8+NtmLnoNS$imGm@K8D!0_s`gE^>1c{CLWQIVvY3e8CRZDL&*^Jjy>1Xk}i&|3d7K| zVC&>UiQDl=Jw{?#MwGAcKM7{**zw|{qxTcvLEi~qmsL%W!3cVgcDUTHB6fR=tna%U zy9`}b&#m_T8pr%FR!6gY@io7{qsS)rOl4$qROEAg8@Y1+p%QNIQVW~B66ni*3j6mH zRsFfl;CeDKu9q(&JEnEw-UM_v=3zo_GumR;3Ldmy0ActOc5W6PBj-p%s(enyM$%`) zH6qnMo~__F;c$TYM;g3v3^rKopG9WWKjbdCukc+3U!@n6Ht7v0Is7@h4P=-x4CC(~+as--n zZC>YaBc5K}svSq%1eU{m+Vo|My4u+l=Zf+OpYJC}63{Q12GbT`gvawnuCI2S1H~cY zq-if_@|9U~k~Y3o(BX)lR?^Y5@xNSoW7jA-N2qIZIWQ!e>cE+`!ayk-QNbP(yPEx6 zx5``yKR8uQ)#M(&p&w;D8m|-hTeJcqG~;JwtTm=Fib=cAzJ-zcRgmc4CuHpcPL~dW zoj#ZJ>;XJcEWD;To!BVbx_$FpjOnAfh}&~IM$QTPH#jNS?n**;O0#wwp01V2q{)vG z0>=ootZqYn+M`eia8s-P}F!;s*KaIc_ytb2Dy~?_%HZ0!&-)W5O;N7 zWHOd|(wC|2eq1EFF9?4;=X(vE-FTemU#Ar8JQf+2xu5Uag<6coHpbDnHCubxVQ3mZ z6p~+lo2_q~_HUnB`S!<}RyBTn8&>J(ZTQ!qiqljsFhQkYCpLc-_P2FY7{P}T_zsNh z2d2>@Ltr2dB@y1eUc!x=+K$ak7lY;j~4RgAJfwQtC6)M&!|% zkj;lED5K|S>!)7kS=P036}Ho(X1W>wh4c*4x6WBjcsPj2FfF4OlKYG%ihd^5nPr%` zCrr4Qpc#xK_CLL2?^(P1v1A8ybw{U%0~+Z+$z}bwnTA=5#5O__9+EobhK2baP&{a9 z@3^wM&?&XPg-8xwe{u(oxjMYgy}9xPRzh9m@`3GZ(3mQ%wQTNz8m~VI=fH^ zp7f%Ct&btaDwfFC54T~3i1$ar=v31st6lDneGvLcf5Op_DBY!?ErKz>A(OLqyzS+9 z6Qk~L_OY>pzaRJRi&3_+QflUr)949jk_=}kM}nVs{%pEZ_MkHrL@oxx6?)p0X(zGv zJ}7hx@my!RW0BmFM#p30q|)UTrCgrwe{Bo+d+dWEy(%VZ0whNGy6yb&X-E zv)^{n9dyDUt);dRbB^S~ew{4P-!{5UEuX{wNgx>AJl7r<$`udiR<$p~b&q*dp! zarbnhLxR@e*x%tHCxTZQv&-<S;Q4vGzTJr6Y*Z9d5DXXkrF5RcMPyl>$h(LNC>?utEg zwVdX@?q8ba7`-MF>NlKO31i1CrtVQgN8*M_oBfTp=)f!n(i2mip z`zC&$E@kFuZ4rJn`((qGzYR8;lSt4;%fw|rDyw-keko7qA*z)w;j<3RP#&YpQFjS* zA-XXWEUDawAJ#yxtKY&%2Yg3%eNuh5xl@!sdk4igtWB4~nG)$HdWfp>XdjS*tfQZx z{mVsYab)V8v}EAINSz3>a-(%i+@33KC9 z?-buJjv>$g!sryTAwwBFsz6}R6}LZNG*4|yN&qZ12MoZ@b39i-4YbsiMffe@sK@aj z6~o=;%18>6SV(h*>tv4Vzq{**pCU8w@UbO3=u~(k?AWtL!EU0?3N&pV^-a~5FZXx`Tpsb?AX{cNYN^AkC*ZVMQr3E3 zUF&t9i^`D0i!r*8mXR7aGn5V$H{|#Vo{6U3sUDcJmzDPIY~$`ljjPxKBpT%N&lp1x zIqkH%+0QO&_M2nB?@G6+ z@AI>Ir+Zv2r{%saS##bgmTtzr70&d%$6p?)NPZJnG_9HRG4KaR=(y6~mz!6)+ZFeD zU)joB8@tvn8uJt)s9>E{qb-%4qOb4MQ-k9(lXg9CZ$z(Xqr3K`QkCf%oUFzKAixr`^yGGQrgp8+IN`|zB8OoiQa%$MTg^PlhjV6C7a&cPImnA|37R-0 zomRkKuWRkxIAVT2he0)O{>&lIth+JP@4@J%vk8%;J(W;Jpe{g1(*-9x0t8pC{u_DHTd*`=d4EmT0cA@G2q+-L=pnR)Qx9{*e5ENby zu(n5*L*yJ{L1~M=m!pT^4}JdpPA#}DpdjIr(&Xn$_YwI|y=SbU>orqv-r*@Pe~;s< z-%~C$dme(LDkmYFD)-`dt@w2`(dI7;Uf8>}u;DbsZLhsbQYu+-f9kcvn%&d^?Dg-% zN&O*j|1Yi#eg)dxz%s4y(QhcI$DjZ24vzon<7i=HWM=ZeG;)OH0IeHS|7+y96j9Ux ze!;X56;+ZJ6(t2%G?`jhn?OO)#C|X|RFPt!88AXOG#nVEr$uyhRr&NOLdCFayc;P< zM2IFWSyy)j7j5OMABI=kw{G}c=Dz_WUn)@OS7f9a72qa){kY$@WEThd`@eZUpuxmU z3svLkXC0ew&Eom&lOBvSX-o%fuR>_GqTjU8tZTQWNI<&(E~*fx0ebQ%Ozmf8qA%D` zH96-2e%T*nd{j!I2QKhKAQ0?SifeyT8tDp}XA@&ru!-U++jx|SQQa{z>W3q;KYu8* zu(Gh57(xZV6+7D!vUg(*&k+7Z1|?!01@k=cK?M#DA_)H`ULP(5mKO=>R`u0;%Mc_a z=xZdTn@x%&>_p*6BV$%mL(<+CQ27YbsN};dK47Y!>TM|m^*_BWcQasnVck3fu2PE?Ckn=@~GpXN6*D*?b}F3 zis!?Y`({hs#aR1+yD!^Yhb4@OOxjn72r*Fq>t{AdNG|P5bh7xcx!G7iJV{^AeF z&Cbbcp5!r&oBO5G&CTFi|FPPyTcZo#>-8``?`yRmWFDt~UQgsA2sDUS^dFzZC%^d+ zZcwf@=fQA>N3B3;<1X+0O+$8}*`dM4nE;;P^)qzRCq5*ULV1PJ#BO#3oJi4{Oa>6A zt?}U&r>%89$V;611JE<$^_=5bsjjMQwZkM59E&rREJQAjQjuvej%xbnb7*J^^_{6W zI(0hf3W1u-o13&8;v0%5z6X4{4%(-0hfX?#)O02A-S+OABX~R>>z~rO-BlDaxpTZT zRsI$!X8q)2?0{AK5`;i08iEu@_CaFsa@mZkA(O*OLps|h@9A0eW5&o<{*e^j8Qkyl z&Rvgqw#xto25x9oG<5xN^{b;89@{I<{lC!TW7fZF2me-eG5wl~V>455C--z=>|LDs zWq(T{1pV))Q`k>Jewlj=LcFmdn`FFIsaI<@PW-D1Ddpy34+EEjHVWg@EAkNI!8mcp zjUh@fYmj#L6B&gD;Y_opCr zX5${ihYTDjnDhZS)JW-Ch*(Svw5o;m2~lbxFj9U`e00gc`q57{M}LJOE<^kc`kFyT z(>Mn=8Fh?r8g0-qG1m|87nBU3w|^APM5F~L`qxRtzK-Lx(e{38X!Z2?R-S?Jc|g@x zeRMeeqx`PRr=$Gg#_nn>%h$ZO{tzKX8HU3N6fRIM=4AEaK4Bg_}DB{Mj z>>I4o{jIHwA^NCz^atS2&)lpaj5-=ST;`;~FL8cW88wPMWmGHiFy>RI{$G87FG}HauN_gkVzpat z-FQyEiB=&;YF4Q`S#2a*qE(Z7d3E*fo%)W%Q%^Be1}3h3+WjX7^bc+`-c5d^O?d)b z+0F#TJn6GVcna0NAc2Qlr>ozenJJWW#abJNL!R8r?O9-U^xYzW4bkUGM8=KM*--_< zlq-$wdTA+@DAmmiv*dLmzdcuxwmzP<%qyde@#GE`MfhH9 zL8HG#V9;h7>3p!H7eykte>=7i2;-I9O`YZSI^(S?Wc}GQ0XctB>L=`CnG|>c@u-s$ z)uQ!&Vt$y!(Z{h?z7pz`SCg(<&i3yO#~N;sXvTTU3;At4e)}<*$L(d!?eQ=(tMLGu z`{j!N;9RvQ`XLH*Ro8v%>E4Xu@#g4XqUXP9o;2_;XxYkaNGRj?HLeHx+p{%!FvQ#| zzoLHW)Ad0haxzxs>=twa zIr}@4qX8aQU_ik7&k7yK zlTG=(6UcSD$6l&#i=%j@ZYM*rrSIw&SRUW|_Qrh`vxPw;Xp71GSp5zU=|PnO!lh7x zxTg$UD-8^gSU>=DPm3AL;2i`Jo`0e4!Ufzsx;c_U=?&nMG9wNJRbxx@lq=IYZnMVcT&ZG=|pQA)>AH2%myeA1|c z0A@7RA`ZFxxb_Ws`&V7jNDBXawLp7^k(+X7EP3eqP@-&YS$f#7YUAO}1_`>L#yr2N z{{zO*adBxtC-IqxtRYTfHhPrXXR@swXv`LUedKZlb_VKsTZ^r`E~H~G&Mz!5>7)5$e| zOaon&2VMnwRJ+z4_A+EgBp)Wz>z5~EYbY?w-9>?Z$W12mKPzfo_OwBij!ai`=cQf6 zC{}H%^m@3v(C)iAY+7l0(pzYdgPl4i34>Mbd$oasSIpN<%+vpOnA?HIFJHO^fsHBwC|jQDTRn(h^es&Sds`PMm51U-r|l@))Ri ziOJP!Y;X3OY8}=jh;$n4REv4_i|vhQZ|-kW$uL65!>?e7i|gUxRYU!qeoYoQ-ru^P zB-Z-D9TMAu3UqdhNiqBVr=wZMG>P_#)NK4t#rS z*ge?Pld@RPK_rPwWBlcL!B;BdE^ab#dzcqZVKS6(P8<`|g%g3IPy|B#NRayZ$e+CGUqR%jnz zLJB`*1bZ}X*o5T7RCK8aRp3&{@@FY!pW3wJCb9DoOzniNR0)gS5?{*E&4J_LiZFpi zWpwGra8lB<=PzX1-HuKzVk(|o=Vp1Z4mfB4dA{?wzsw^&UC@LP_pzj{8Y!JFMG$eK z?UXhIKt9#MDF;!x%k!dgT&Vj>(Dc;YsD?g^XPuDdpB?Ad2V%i?@3YpbQVCa$KEM0R zHB{>J+Ji#)t_r1`fT=PA1F+-Fm;IHT77+lpvv_y`JXJ!TWYnLfPAr1ci;E=xp$~QK z*I7?nX7Z!uytvBZ{V0>_eN_Mh2glnS>dggiEvHMx!6@mPPnW8L zaMU$mni%*42Zo1pzQK<9&HLWN;8n+nCpMR%G?;B(dr(;X>$Q9u`>S>AQ&R+Z_?T;C ze5s6afp{1M4385f9?s|RyNhj_-=c`1A ze#rNT`V9pPf>T|UuwqCAym0#<=XX4w=ev_ycsBIvr4&9sKIcU698EC(Y-VHdUnYGY z_PDCX+EU2P6l~IIRr0H0TaFEN6|2b*h0R=jZ1@lxMxP%Ig&~Fia1!%yaV)vXbye38Fz<-np@ha) z0RkeCRe(Deo{lR>|4VJVae$>Fz2xv6@+Wni_D@-9yTXr%OzyBEE$W>cXYZBYm~f-< z_?`Zl5aqO+Tc;%V5QvDT*GS0nxemjC*Z-)-gZnR(D|?l#tV$HC*XCjYH>%TQ`)=>D zxqMub#G4|6*A+V`T~(@k2nNEaN7vzThVEwX@i~D>Pg|mtFRf;+_XtAfK=_nd(?Sc_ zO)a#$*Rfm9Dg^`tFnl!BRj1Od)IAoRsZ=ReBGXJ;@u668fJRk&mUFcBZ4iha>-&ps z#0SftP(XWNx~}3k6S8ygt=94XAo=bYgv)wmr@gs`W0N0+(1GELlmOdI>Tev20>fi( zx|ulDyJOaCrFewsJauNCut7iz80?jff0PyU-w>lb#kk8wy3Ha}=^@NXfaQ6JV{Jat zSiM%~Sb&eUH`;TFDORwbxheS;O;QuSbs4E}DX(U0FDjDDpaZa`CV+R!|DS>S!L$eX zDdKZ%JsgGB+stbK`1t;BV6uR>$M%n=D$+U?w`D*{I`}uB)dX)bU57PE_hqZ6VqfN^)gxIeg zQb}B^as0cxg|??^@<7Y$e*N&Se47v?JY%q9WI$}vzYg|&5(IL~b{9pY{!oJl_tIPl zn&G{(yh*1^Xz=awiKBP5mE9IMk?NL$R?HGe48x!r$QBMs%QU2a6w2FJ z-4?&AE4=;QP}UnsFrzsp9Tg8l_}Y&!%|^Qk0>TJ)eaAGXi2A94dekxu0=kww$ByVf zFD?WPpw>EOR1Ah!|m?8yEz#fEUts#q=c+g#*JeU8J@`P?UwAWRow z0c3}hGHIL@!#4Jk=%oHQFs9>~jLWXuuTiZbicRlMHYaO7^y55V#eZU?F+$BSxuG`| z$X#Cc51s553$re8qn6WU!$2D{|6ae!Bbitsn|Jl%)>s6?-;lePsoSHMH< zBf5bqRsi-dt3-iY^=F`{4>MqiWRXjvv=z(oKNTnQV65$?ZqH^63Wi;m-7!<&W|)kn zzoSw}r2vf3wFqw?EWirIGhKS0%jE~47E&whTa0Z!@>jvl@gz)ImE=4qPs%4C$xDpt z2H?6=IVOvh$>(ut5pkFpJ|u*i0&$+vOGb$U{ZJpe+0^T7S`*03#-D{Z2U1i4vZXv+ z$bS+|wv!spiwOJs`=>g5Vba%3q}PPdsuoRVU;SQK!$)vS7Xob8xR4cnuJ7i}VfQnO zl4IEU4c@Jz=R+v}zPA^|k1;Zp%Wf&5P(F3`+dQH~7@25jcve={c&0faH-c8Mkiy2@ zr)t}_^)lT$j|L<{mTtPs;ulZYj#hx*UPLO*^@O%Mn}E}11SOP2AxtSQ$ix`THCo~P zGQEw2k?Q^m6H|pwoJJ{=aA-eX`7u<)d>F#?(Z+0F{E4O3m+E$r80`_fqxk!?vf(zz zPjhoXIWPZPQI@v8CY=;?rxdAvyBn+Rty>8|y^JBt3i45e{EofYtt!(0dJc4!RKE&D z*b3bil~i_HYj%vL`DhI4C=Ij$CVfL&)MVrszeog91C!A6J(K-~76^&>BZKQi%rILe z9VVdz-}isJ4MUb^^KO=z+zuk0cbf!(4$aGa5yELo4EOpQuaN5u{*)5;5 zlN4RcCbQ(oJ)CLMsujnm-Z*?fKcs?IEs_Vfxiv{=b$YMg-`zCg0;e^R55$Q{F)Y%$ zRtEJJ4j|%x_{dR0^2Dm)%8-T}7w?#wqw=!f?=>wC2|nEBiOPQCh-G-kdUe*cOyRn} z@a^Llh;%m`Or>5I)e98DnCxs)_v_t~N6j2gTTt_8@d5FL%~Ji~B(L2I7AedbRQkUJ?NwtE{e%bKj%?@kUT#tlOn!seCzE&4F)j2xm zb1;kV-pN0ySBIcgTVGy1PyAf9gkvyJAe)4Q*GwDF@*Q66}xUc%JY@5bayQrXI1B?6%NVx)I``=XBZl9(V> z;R1%;P(0PXT|`GJW>4%1`xHOQ$W$whDhP0CZG1F&uBWQ24Qt<`aXcjP(%j3$=;%V}e+YO&;OsP+$dlj^32 z*BUE!Kig5aSnljFSp^SNm59Wr6#tCfP#&cg0aGrL?Xoxbn9h;USoV1srL*KIc+oC@ zLvJ^Lh(*WUkVVZU0CJqCJJZAQdbP|?yar36-$q0#QG)QvP$GSyNLcwv791)BB%>r7 z5q!a9UPeQeW&@z9aq|~M4ak@x-Y?-mBbWaZfCo6)&YCP#i-rt*?@UTjcGI6QTR!n_ z6^YRj)xv>N^)fyVm!g~Psg^pma;=H&yXNNzm#qGl>Se*}KXt3^{cV(ikSi+@L1?l4 z#V{GO)$6L(22a)DiE-N}_?bkc9{#R%yj(Z?xHFJs;ImDmX$vg+ki=iDL`6DBB)Gn- z(Pq9-U95>d-R1_5 zvbScPt;(i652OLTbGC{`j`gd0ReX8$5_OBi>gTM-B?x9yNNM-?_YlGth!uB7{Ura} zqxByjef#m+`B&@5GW`#e4H<+yPD3C`EE=BiXO0_yOcJs~aBq|}KsWUhmCMyj=Xql# zl`kJfVv;LeMZC?D%53BNv=MxCG4-Q6AY@om*qjeVtFPTS&S898vFvqTDQ%B6^23%Ks< z4zw<6@;dL*fZ$iX&H@yy*8u!B5+=F3~Pt8eoyYpSlFkk-u z(no!F0ZG(tae7H*RZcaY$seykCw31K*cz&l*H2&`zhM|Y+o|5qXAeG?Jto1Ca}(p^ ziW0PnWfanJxYMxnl+UuLs!fKmZEgYIO{~X8n*O=AqE@A^w=-2yCaK!mcy!S9Fq9vL z@zEwe@~NGY@_(K`K`uE$=+x}(dN3in`J`-@&m8OY4K0Z z9uZhd5M_zCXCf4Ql;SzvPd3={{z}~t79RWPcRJHf+FX)9G4Zp(ev*-?ZaLpRH%#ZJ z9#;ZK0-2u56%ddzyouVItkYDiBDmU_E))Hx)~nGHmFnNh*VR-`bi-f3q5l&-_y(4x}q&K>wwdLKFNZ-8r*n!65WTSS@k+l%kc^|vo5Je;F>KZTaX zQ+F~L0BN)QohnFAt%mIr?&o5){q;=i+{$kxDq}R?~}n2 z?YtB_pmWBDS)&&^YhVJz#ik+7w}Zg7NyYP zVk(a**TH>4-0Rs!8JYCIdqTSLD}zDeu>4Z|=KZC;=0`T;u47PVvO%YgWRVtm&FK%4 zfG#`%{@i|aw=Pld!Gb+1+yWTfdpIOJNn zBWgm-y=%VrLBstiZ#{6HxtWkp_kue@>mPK|NiHAymJb(Pep=19{jq2NA4af`<_5y7 z3$ri`Nw^VEhBS3z5MNvnm#xRSnnf%m{pa1g386!%JVg79>D{6G6k~*1Fa8*zSe);i z!BiS_F~w6WLR>$0(F0-4!Lr@0xecVb8>73rx>Rp=8r~4ICsk=xx@!Wa@ukAlb#D$! zC4ve#g=276SKD+Z*Dlh*A;1VSiZ8L`(>OntvRh6`tw_t(P(N#j*Kc)})~PJ98cgTL1U*ECq37>dyWDF*Yq0)b8InJR;V>_qh!?nqRsF;$ zzG18k44aNqW0a1gO7!!CvN77h@yxWE0u?3QTnG!T?y5|>?KGNIx(H6uJxpkmC{J7{Ci+>FRXI3SfKYVF z4U?6f5{70%e!VS|T7514NSHK~Lp|Kc{8xsS=pj`xtsi%IO$Oe2o?FAm28E%AloND7 zul2%X1>9~834Yw8oBfNauScSBsWj8Lw}8txb$$MqI+0Fe3Q1H0cNj>v1=~pmG9VC@ zXGe|y^$R@%F>lEK`HOXs10dvcQ>vsnz_okTZcl2!4AHYpXO>mjm`LIGba4m54q%Bz z>!WF!tY%}k$EE@|7rEk}^F?pYTcf%_4ZviLDz)DHDdd|*xfYp0lSSTNd&}ukNaN|*2e1fnGD_&mC+L0`F@c5=ur7ph zhzPjiP!FduZ-rf9GNTVVE;7IBW$<5oDNdm=dL4SDh-=rx(Lkk>qND@%G>!UM0GZ?1&gEtJ1d`%NKvocI*)cO)Dl z@Not-MQ1I;6FmU=*0`f}+RyvmKZ*^4E#B&mUDsVBCWDqz zc!{T6r`J`wqa3_#Xcj1!DNUE(AzUmRQ{;QG2Xch6Ml0G@=Zi0mPCyX*30Zk$U-ZTS zT)zI$$762~;HiAQ)mPLjFZh3HzT;)Ho&By-Bu#$k5{iMewCz-C=776e@qU-Rw>XSN z!}SXsD7PMHOg0(M|AO+Eb$iB#*`tF&EOqGR{H@qsKUe|g<#DB(2;3d}fKs68A+FMN zhiE^FN{$Gu#Z+}H%S^1)UyTam?Kn#9VoermHbERFU7CvNk8#8f-$-EFl`8bwG$716 zRK5>)O$Ema1cDwj9zszJZuUmoReTvn>p>1Dfv5s8DwfCab;JJ?-2Jy;qKJ834^Q!% zg0d3rRssXg_q>h@D;XTK$?UpV&B0qLudr4%6&62$Y~%dEBz$5x>u~hO*LNF>A-kPK)@mag#a;M7hYuY!5 zU)aF8-i;z~EBWxqSa{C|AQDWoN(PUt{7A_~a3O9|Zv8sY;&$}jrsp{pQab#bzTqNu z(}+m?w*d45ar+Q{g$Laz<>dZS)Nm@lSph23uvzoNc5ZGYA~qex^fdqG*Jy#sFYJ1D zznU(3+g^=Lfb@dwp9|vU!r!-lUabah;HbC3=%=}zU*%h>kN!wjE*U#nC$7Zso8X^4 zA=)ArnOjxXEp)ahIb00|Id7Kp1hJX6JOhT!f?u-g_@Dp{Bs%wixlKGDu*@!dJea`x^>C>Up4gHgv4^>k6KQUtT@ zzqGwy6GnI4CjQ5}vWq?(m2z`sJZ^hZm)59J`QA7>5QM|5e z4WnfBUboE-DhhZ@F^a?oB<$upuFbKvTNlf|NvR;KmT zNRS(P8}>>CjwUI*CgG&W;S;%K$|sO^^_9rq0?#O#Lt`s? z+YW|6@jdSQeF2qF?dFQgyhl(pNk`G)kSAf}SjaO4#r2;~N`NL*IrEOqYzVknW@LQ! z?^F{;EBUyxP}?5>Gaw@=u3lyqc+ds)1@EmxIc{x*N9D!deJ1vqK@fUm@%qh$?Zb3r6Nm%@m&TTy`MTJ$MK;#XHn$hXUBQM%I~ zpMTt0_(fxDodolRGUo1Vmu#7Y$3yI;IO^5wfW*&9Od(f&Qh8KJ;qW)r0VC-gsz3rF z>rDSkOG^45@(=!+vwhg#?v9dC2T`7VAD->#4$>Y4B3H)&bklA}`N^UyK;(=or6VlM z@mQ6lbpP+XgWL0G`AdE?1QFQ%QN(8R_XK%WdK?8V$$rz`bzw0+JJAJfe^ue2OTJ`I%? ze<}68BM#h>%+IDTh)DU=D`JTo-U742&I%+I_bxfSJ-lfd@$^y3uS=s8)e2a$cln?| zx72c}8&8aRVzd~+)oXpHE}**@MhQ$ppb#j<5NTa(Hu^B&Ax57xRc=}hsccY?z$`+?PcE^=(kg1&mvNalf!>GgrC8$ z^!Sw08EQ%J&sJ$S40#}`kUx^aPkvC92B07tf~r0dEdOwe(W7xYCkLIJ+|LiU4Mix= zZ&KLlaS>_$DO&v%<@!Wj+*;7mTD_I08)qMz<-3nQtR?|^(YY7fcU$3Db2k|2BE&RX zXs+Tod4-#cd340@#L--$9_bvnEL5GALBs7(#b+P$yv>}iq4jisVz(W(k6-4Qma3J! zo}b!VMj@#&RY<#fxoK4wW{b+A_S^;0stP1bvh8EAU{Lc%T=CChyJbhd=ZF>nS=JG# zKgF&q*o7F)piKR-nBl&tozudP^UhxB(dW{@ucWFMDG+VXG%@op=Ng&>XMx*k%7gRB zL-VWhvxHxfVm=pUatLog07|!n<#ajib2y~Kl#?HGl0kE@1Pg*1uhefAFWhMFoMMJTI_zd@}vUhubG=F^n=zt@>H4@7vH}hZ}?qzy6v_VfcPoT#R z$HiVYls_16+#f~6R1&&|32Grh5=6bl`K|P*Hb;TVhRpH1jPZ5g9+E)W9|E1S&bt^X z9zeYzO0Oj3@x5OQUwNg@h2XM+G$ zFJI##YL*m%TX+R%H`-FyfcIp~((e|w;&M>SC8IT}V?12zyBh+hNd%2dz>c}zn9kt| z(I_Cu92k=Vsvw2W?Il^8^;|uzF@HNq?-}57Z~?vybQ4rNwx%x8IQ=rrV?;Za!}48F zl&KmLl1C?fua)?9>x5Y#>6~cJN}cx2kLP(9FkHKOZLWjswDAB{%NKl1`&nx|h+gwv zKPA1zQTpS?nHg+LZUjG#v#5I_)MU9~A%PJF<_)@#&uVFwmk6`Y4Y7!&0<^v?6j?4H zT+hlBzj^FE`)*_i64*1ZK{?Yg()iCT@ADLfWI=-$D%M|+przuK@4DY4D1sZ0lqP)*-C#8hvW>Ntf_6)_?>x@- zHxi6aMi=Zt*pX3tfq)czdv`qaVnYD_1WSeIwluuqvJ|i-YF%dG5vnN7kVfVmZ?dnF zNJ(q`(V?UPuGWjZAJwJ$Kq0Mrxbs!z=X&d3D&U-3PR;IOS(E8HsQ;Te?-_=sgXXkc zkop!$VwUoSyEs6OCb14T9O2hGvjSUGg;_M=|VG~uCx7-lLI%^T=JDMgf@anb}G3!arihnz>%1*xcgX@pr}oXHV=F^Yjk zHqRn+{&!iC*L7!C>Ekg_AVcxqMu-;3BqE;Z9g+Zo4!B}1yhur)$$oo_O1qoGVCq?m z5yz#ctAK&$9*3*T#h*^qLWPNMS=v8Q8Yi3s@gIl^jhNI_0Fm8r@ePzJ?WyEnc7K3T!V4)dzY|6&dqq zXr7RG>(bY=^joF3fP1d|E}xP*d#oK6@ekMOb)gv6^WPY#y@$!)iWZM+GS!LGShU7d z*d*WA4P-AWIDj$`ePO6rDCC`)X!hFv@aKIUuP=!MZ;+^>9ej_X2{dD-(2=~a9k3f$Sv9tmmG>N2p--BZq>EzT)n*%aMB6pTUNSAO4|{@cy}6)g=Z9Z zX_e^fSWZ`JmAJ57X>U2-Xp^siUs-SQO~B2!+dcf^^}kuj zFei+0VfbidAGj|(9*X=gU`wR<=!?!BgP8d^W2t@S>MbB)*iK@0wrh(pXxoULRXK;x9z`zywdxtVC-Gzy*ZLYW+MF8TsT9!vg;IXhhzwXXn7s!vz{gDM^Z zVKgW-%^{GjdEX~;usLy-K&xt5r@Bue`%`umLPTr~N54Cyx>ib_t>8Z&mt0400~MC(0^ZtV#jwQB+}yqm zw@t$^XVCndR@^u%c$D=0s1drGFDk-0zn)E6{w|{Gsx3Ct=9~F_A8;dwe@2KM^E&tu ztAKhJ{0+96r4IqC7>TP6SuOePd$BSw7b!qMwYb174=hQ98At1)$ukAzTow6{udR=~ z4_l`#zw)i}LbQ29$iL1SO%v=4>l(tNFdq6;TuZCd zYE@^?vn_H993*-u%Czf<-0NNyalXa7MVls;40Xd`z$&vVfTd|3XCy= zUF}z!X>mH>=!o&BW0T1r9$)KFFc!4FU<65%@Oo*jY}aXuYgsFg|LzwN7Y%NTrtT!j zrWys>7cDsHav|p0dgfpMw!`ymvVz~0K!g!Gy~wU~D|^?jJx6}GP$qF`(Nu4VWK6wh zoS)@dlFA;ldwstvd|Mzr%aW&jOr0KgRg!)yHI7n7>Xmv@cT&Fd_GIdth57ynCnOg* zw;n6vBTN3vMH~sYvciGxAhgO1qPHKzPtjVer*u0!8YoMTd$=bg)TMJ{{FGtvIjr-8 zh1MtuYrXm$Z379I_ zclR6>y4ihB8WD$%0aWCckfHh?ri%;bfN@z)@5h>9gz!-aNftP-|B-_*r1U!&nc}(M zEB#uu?parVX<{5XFg$C07qLsS1wE-`h(3J1++&7($d$nFpBtQhWo_B>*r>dUzi?xWOJ z;GDv$-HP|NfG*rz37$4Y8T&Kcj|!WRusU!~PDi7}a|Hhk#YzJHZ6+;m364`fZ`jaZ zn%o-qYfoGeUiu6YevkF-O3~}U8OqGSaC%9Md@!%larOidMh|%6rLL(0AI4=vMhkUjip~x6pfT$I^a2GESIUlyq?opoe-kkdN={`9gn=yNNRWZJVR*gDc z&bS)cpH3>bK{0(z#i6%!>t?O2`S&FvjD{;G)4GMtOFv6=G_jeq^QodY-M!$529IOY zBL7PoNT3TfI4R;c8v;LugBu0}_aa$d67nnDY0mcVF$Uhp3AD#a#|!29c_ET{%0AcI z)H;|`qRBgk1!dH*@vYC*ZTo%Iq9k#zVr=_oU{GiVY_6J)7lMqoLBKqx37Gis&D>~^ zcrPL29Rz9@55(?QZnC!O!O@;)`;6}Dsho;0ky00@ILKZ*3>Ncfwv6hKU5Mgg(Z!1Q z?|gqH{QH6e3i>d?vVx8@6w)IKH=NnAswpOs{AXCA*LJZj7&Mz$#Qr&)$arzAIk!yn zJ}>l!%hB?+V4NN-oC1Y5INs5mBTA!{y>e1bDe4*4>VVr=j+Pr_&q%+{7m=Fmqth+> zLlxG>-X^6m;=HR=$u~$qRUgf7>y#N3;FFwedG3-S8o3NGivM?*gdAaocP;FKHb2^8 zs=3CL!lK0S3tPvx&w1g{QqR>c9}v}XYl4n7&VopLRhi9T$ejU~EoQ?l2H30-ME8{4=q9uB7VU2XBe!S9Y(n4n+LD0Me=4hBhg*v`k}(Cu688Io&)drRh~5h?;A1!S5USP zR{K7GtL#`hk9zQ5-l~z#9wpT0g)W&vyOeWR9Ds+>DZAP=i7G8K-dA#lD2>kBVyO?U zPKUoBv4hlG{1^%yN;91B4K5wQr#~hbQ{`f*t7^%_7rd`p4YR3V5kD!b>WtH{tc98R zDANnGQsT#FteRjZZ-5nI>invLXUFS7!=2szL$OY8!qrOvjf&v2CtIjXrOh--_(O^l z@U?xU6_Lk6?z# zSB{a-ik5R5X_{1VKaOB8q`xeKM)W|4keaD9h^J4gGGF4+k`ymac)BBe({y2IJNiHJ~F4W<{CX5Y%8VS&3@m{d~ak79ZMXA(tv7YsptuRS(U!m3@& zF5q25`iX7#ueY+|Sn<1`@^tLb0VmHwhI#~%Q7~+ymhGQkgTjmew7l;DxuSZV2d`Tk zHz!T`0z_Y;IU+F&V`6!{QzEmwI^Iyx->8SjUQgz8xlLYK#r=!AFBnrao;hUYF!kml zx@_ZvbOv36sXeklW%C<_hmWlrW6LXVc&>SDKtp*F^za?GI&h}2*Ex^s@;&RYW<=@$ zS!t-5v+)+CNV#Njx_(Z4pJXGyFNTfC3uZwY%w;I>T#1jKm zznYal(3cdnG0|`bBM@RnzEMRfvvdRfNPPO*X5}&>cIN+>!>ApLMQIf(I_$x34#bMS z^e!nowtc--t<0(#{1Y6*#nfw*h3=GxTJ@BW0f+NUy1V@$Qbr%vxg*U9E;fHzs+2_` z*0CQG2Rhqoa9ECAF~1&#?=;6ai2Z-aIt!?(w(ji<90{dE=`IQB?m9F`90Vn$yE_D= zOArC2k&tdt8tHDNq&uWLzjf~azVE&7_{KP6=ooshn|=0PYp!QL&u=oKhn6_XIQv*VEPTkgH64Ijw5I zNW=An0O{N@Q`iXpMB$QN=wI)4a6|`=Dji|p2YPvs9HRHM+tl1)cSD9iEFL#(HgLFO z-Fd!!F%drNH>*{uUtjnWQpHo~|Ktf_h*8)hUI(}Bad|E|=tpe7g(lzRIDB%s{8kLM z(gP;n?DzA&Ua~$1)E5u$>p{S8BoU->6ol_RaBM8g%J^=pdUm3d`Kdp(bIj(WiL4jh zDE!p#xR@n*m_BJeabK<$xI-0zkTt{C;fl!k1rjqc9tq}p_{NZl6nak6Sc?6n0-jJm zU=!ijBBVR;$(9%ssgn~4{Ne~J)QkgWnA%Bgh&P+YymG$qy%V7+B*lBzI*3<_FB^hM z(M=PBrVwEb8O>8W32D=f`#7#PhX&L1U{}q(1X#<0ZlbjAOf=QHUyFX z2(_CkmjJ!XCtngZ(vyo|6=AdA?L&8Mem#mXhlGv_79thWr3st*O*Ld+&6o-i_Pv-O zQItk(V~9#Y=*b`vL{f*y_2NJKmKxR_8J3blMyE4s@+x6hB~7RYxRu(_si=|6m!-o^ zM_1)>>da^w+kj~V-Q0;`Q-#p?&sA4&;#$ZfUl+%N?PGB_hL!_O| z<&I26pD{;UYRydMBzYcjg*QE%8CF{CK4vo%iAH&auYxiGW5S{-qv;OVtyIIC_}>3y zbs=A;C~?dxa~QLO6p`JB`dml)a%hn!tkC_L#xp7NUd`kRyti$O;YnIW1BM}aVeQL! zovOoygwM5qQ2uUTW+UOp5%tp;@R6bI-nUwnq5R_a=SswB&Z}Mx?;hz>|D}HIS<17Q z<46~v@5O^t=DoQZ#ldRtb!X;jiA!ri|h3 z)u|T`K^~bf^9{ELyR$_|*77`sheVgi1IwH!Y>zgbf&5xvKcfjL{01OFzMiVe;~FPa z{>~dI_RR@*w^v(Zi;5-1upx17t0qYBTc|wc>l&NnpSQZ~KEY{? z-HdTVq$4YiYJ&P2ujv>^aQC=x!&AeYMGwiE?K}0=M96^eo z^8IdK`bCIKI~3UTd;%ZPU%3||azN!yiFs)4=Nq8hf5vQiVR#>aI>Z+gK%oA(QMi2I zo0JYW7 zaVkF?n43ETyerp;BB7=@FrthEa&5?9ymEQhV z=cu;s<(P!-er`NyUKpe_KGY$w41d!L7LZ_ZGT3kx04$a6ZV!v*2a>a3Zj4t;24n(( zzbD1MiKw`KECV!>CtAJkwMy^sukrjRX@rF<8dyGIC?)Zx(f%gTCcm z#x!LblCwj?KVd z2J61hZuKpvFNUB4gr@BSP%OPaQ^=z)Gz)Y)VhZbvxmtSxz3ln@-E~=??PdjyS!csY zzU6q|`qymK40%D5 zo8Fr%^ol@X;x%?)4AUm)RA(7Ol{H29gnnZid3(_o24`*U@ETZ8`~dzE_r~c;kw`po zyQy20GiyZ)m|8KTZ^+39DkF`G&nny61STb8<)v26KZYA};CuP#{ z*zVf)bq2a|z<0BAyE!G1hPQ>iC5;o&kVy@DTn|M;Dhfs{;)p}Y{7bAkc5)gMT~&_l zhG7j^pbF9&Vj+H2NgLHu%MoKz&k5W6Q~9$TvS@1(q;~vK!qUFgYJbXr0fS#`#93fX zUXCO20U?RexUkW1RYe8&R9ymU=8Ns>0*yA-{N2*@6wL_9(CFl>m5I4OQxmshR~NAUYA3#m>R53lE?EPsE20 zA0JKhe-e;#<9L}e#y}qR1Y~k>XerNRE~SGx&Oy5=HdQy~sKM{Hjb*@1l_? zILiiZ7vQg;(Y{z>fb*}+Y)^Nip~@nbAeVYziwIq{1uo?u?J*#X`qRtsW7={^9=F{6QnTkpZ7=t5?b6(h;E13v$vX|ar7JLC$8;4#nKEpLfVM|2*a4wF zIZH+X@4{-2pMw5xJ{sUAj>n!yzv<1F=SY7bIn0q&>i&p}20grVlwC4uxg&z(;rk+# z_MY2={(^cn4T8r&MXZNd<>Nnt67sw!75K7-5Hp&OW}gbm+BzZ3?`K`bNRJ*6QV~rQ zcMelYnO=k~C9=;Gb3khf*aAQV%MvS>JqRSrIC30=?iY0d;N$pMHKClyXg3bF;dgsF znd|&@kZDp{Bmf}+7r04U?58rbfL)sJ2E%7}mY7L4dm5@NJnp_TKWE)7_T%kB?4$R! zbBuNyJPsoK*x4Q#>Ps&fwdDSi0A8Z${&4siOU(ijTn;e0y$xD~@;tRM0gEUt$CxCc z*CdDNE`Y%Dr|x04XfQ;VE|%vtFW67s@2M5a2|R2w`v@Iq)+%*@xzC+lYX_&3JY$D` zv!B#I+UR4;hQ8;_5sZ(!sjACE(UR8`&l}TzmNG3{Y^4S^Y+Un0jAw> z;4*#$c~PuxFaMb{*Nz9}F1Ya0wB)@<`ZNaAKqJE#4^Wa@T0Io=7V%$E~JinR3uVNjMEA_BYB>W|dsq(Dh zfth}q{W)I);Fi8qo2UaBzB~eqqrH(jQ9+M7KQIuwly9-aoA}SqJ=8i_Z~hkRo1l?L z^VKZ#ihkEsKz(|?Zv)2V5 z@A+fcRFs>jG~VAF4IXUaEc%`E@g*9*CX9dS&^nLOHIRV3{nXG9T+_o2#&m|*nFo8& zREl(lHgZsI_0t*#89k6;g5TaiN9d|M-|}yV#0VV07XN^AtB4I$LPurx<=+RSIAE~sg6~D1{sv@4;z0CTzKSgc?Z^&}9TJwM1c4Cs zjVi(PonbSPC91gl_`>T)NB~jItAz2ID2b+XV`HYKL74V@SSoaLJ5%( z(GPk#F=CYkdEZD*hdH8wp9bKrP074i*D! z)DngU@M)U{zqEp12{EzP1-!;BJi%D)e$8Otc>f`655Q8&)#y^m+jv?jcmP-++1FbyuLQAm0J9K_N-52lbJrDwR%bH8C8DDfWNoKEu zbN(8L;nultE4|B)H6f5MeBP_qv_rk{_P&v-_CYbH%C-dJAT~R74rD%buFfsny&4IH z+Mvnjja%5U*JFHavsqxr>zRYOET0OFJUV#Q#G5PRZ} zyE`+?9)@dP>YJOxY}vdj?q$&p3ck{qQ9tOlmu^nJt!$R8_|Eww7QP=pHpHg39f=Azzb#T?PzPv!wll3rh2e#OT1yEee{NQ8tplwQJahuntDB0>30 zqM(+V+sbaHx@SD#D{Mj$EQxOlF>zdDZjyn^FBYdwRt`?1n~7S8_n*X@sx*!K2m+nR z_uSfCaOjSK(^~&p`A>?3EI3R>uikCqk@Mkw&m{;odhZJ~#}9gc@@*bA=7$QG6CD~B zbZIv>MtdL=##4;tZ~gg-(Itx*g2 _x!o@9f{v>{k;}csWcqqj-=C=ZF`zQRZ$cf z8NK_3X!g3-OE=>g_^-L&`Ga!+t6U?|S403^c z$nyP!935im%@A6w*r?B(3Lrwbm9Vvrrjg@d6yQkc89RWxYEY_GlB_egGg^j|o?I~= zowDqS$YI;VbEbeNXTs$yNY5FWWp>7_SCl3inTeOy~y%CWS`EX4->?KsIWB{qW4jF?9(20l%kQKpKWBOx zZiRV&vbv=a`rXx~jj(W-wBr~8EO%MnU%@g}$J~PqmMIox@b;nZbES)|j-dbeF2+N- zP*`OW6{fv(xwWh2@b-EWSr|!Y>Bc1k{dM^xgcAR$rM9|4ygiahvv{c?BWww|!Zb*_ zI^0Q9Vce1+PI9Q4L zXbKw=L`LHu&4*lmeHege1pTie9vO}qSyimVFE;o&XwX|?&i7JY6Ca|VL=A~Id2$kQ zTje;7zi#ERqE=1+3+T6Q?TQf6@aK7*4b3J!-*oG?58$xO96FU5M3y^FZj+bKsaFI)NS zdVSjI7&S=jOAUKZx|^GDr?(4@-rwhM`6trTB!_5-wZVRtYtZahX?aW!N3a5$f#4VA z%f=);aZX*r`gpKrfo!C2Q~JrJ*9qasH);Vl=psf!*`I!jI`jTdYNKCO*}5IA5_dH% z6`8b(Ews)Pcb`sd{RgFKh>tLD9z{*!SZ_kkk&^UwNn^NA`hpK+9H~=J6M;y4PcF;| zNDq_s6klhmq~a)LQ8aTLaGq&rX2OvgoW55swO)S;v+JFNBJsi~#G1_VgDNY-$Q$BKLAq6pYqxPkWhIih3x+aDZ)3~ zj$is5R>`+-k^w-w2gEAAy$_0?`FYv|$dHIw0kR>OeM8qX>^^<8^?pb$QT+WjarB zYyv|5PW$sBzQpFtak%1=GwtEHimlRUJo`OxSaQZePW$;!{e%lqrlDRrA*Ur-kK@+( z$-!30=sHCsn8|K6Uui}b2~ziH=qd0-BLy`^^YqVbXmR!j?|%!J^`C%wQPEIjgU@)QBdq^^34);KTf zgCNXG;!c5(ex)Ol;c&St9&(6hv9PrUvxKxDK73@M9|Me(Q11OW-p{DNX+F{Xfsl6! zIIoYRN5;qqunhl? zFMu670FY57i=iWF&~d*?03vl>@5i~_{kG6n1y=76_y(y1Lj5eSs^xZfznPB*FvT|e zYZhy&9j*5;k7Ud86_RMolw3H<{P~eWAhZ(g zj94>m?BoAnb|H9S1yB)z|D5PNHVCUYmDDe`;JDna8lnYwcP}2xS~qo&odmh^SkS9}rSd%=Um>1XSu^Fp z9Sev3n%L{&z-VBW^zz+*-sitC?PrvR(&H1~b|(LDcv#7Uf7u$*==WSdCRsl?&y*N# z=lTG~S}sUQar)hOT%M)a1Lzcs7msa`Tcz0m(>r9$58$Qr4wg6u=bykgOgQpsL)#t= za%$3b{KvO|akbaK{`;3WVh<7`tupa(R6l8}7S{04vG(^%uAc zY%tMioqZQh3_PQlVgp9`csvHxZjk?!WSXN1HFL^&)%{V&X>E`$_%T7^1JkI$?`CTX z38sU;1!@GpfM9b?LeqRHOKCPZZt~cEI=FayJiw>Clkq_U@~I7H6&jMu-fsZM z-qP);4QgmGLlfZ{pdR|yBi+J-=ukfV+HSs~pmD#&@!kJ*{&7$_tkMOXJI8xxQ7fQR zJakTo?9{MgZME0W4VqYhyDuJe1whB$o7=vn`@Cka3{EpjH25|i<^5~o2sU7t8ARp0 z^d%UKPkCty(gJ}G$?YbJUM9uS$UdScE`H9TsqRQv;k4Rq=T_$_&Ju>cgTAEy^p8M3m0kDAlAujaTZ^pUD6!DA!wIgXz>iBLQ zyHyuNsca=Cb^&RuyUF*u`eD`(us@dzLxQGW7HKJqmK+vL75oS@>%VaZPE7%gQvJq4 z67!%E6l7!tP@4m4E_2;CYfUNsF2Gu#qJF$uxZP z`uoGL`asPIU@zjJDFO?H-JpM*OC6nDnz;hsk}+|?T}-~ER>;nKC(9Bz08)kYfKNO6 z#KTDvd)bHbz#r~|y}La(5CAnrZo~bH37{igy&3N}gyjFe^8)mGPP1LY=(5@9;IRiz zc{4vViHZf$w}BN7l&>{%MTsRg8@43EnD&=ZAaS9k{rG<0tQ)L(JY|kTd9m#8p8k6f z1T%I^JuRup$w%M|?**{G;210~byGM2KMO60kY@msC`XO!#Aw8v>{7A30f?C;62D)> zmR|xVy3@&&ngGZ>gXm{(c5rB{&^Lh4SI_psn1#85nAV5Hd#B^Xfh$rbSo*q6e`+}6?cK8jGg|?wJK%S3{)fX_ z^=KI$`a1yjFeF2yf(~fV2QwkUl^8f<{#VwrRC4C9BD`2%TQd^#xp?v1pq6E_R6pK& zvaDx-gm3LEZ5Cd%@69zcT-^4oFdUssYXqR=8L)_XvhG>qf)4)x7zYKg*75Yw>#Pxe zyNumQ0v_FlC1LN$PWco!fM-n}ATV;<>*-bjMfD@F5hdqFsGg+&DxyZ0FKE?qYM=}a z{>Aw@aZ&s|4LLBN`kIFL)6K@;w37TrV<>KXQEcse}3HX~G`> z(56-1=AKz*HpUbg1Z$$zU)0OsyW|}eZ0+-N!Rc?_N!+%hnn3ScYft|@PKKzX%xjg- z?)agf%9UX+5BMR_ME{`@Q>n-7X*WwCO#k&Vk!H@P`f;yDX4dzj44$g_~Ng^^Y&YH32X-XeO*@|cGd@q4(f3f=u*HtovG7#6&(`=7;S8)+dWvAjxVuAYZphU4Tl=X@AcdYpF|>{BeZw&x3SYM_f;E*ykx* zT)g$YzV2Tkj_#BN#R|L ze12r`97kdgMm^fk z6*KHgm`Fyjx={e|iaxJaG-TZmum0Q(&3m>?JNP=@7*1|Cp3i%~e?kY5aG?%+5=Z&U z<-?}l39j0Q*dRu#Aj)9uMiiaK*QPi{rDx6Ncb+MFH4PvHm3HpeWxnfeZzpgr1l)P4 z-g^S1djS|JUGHUmg-s;+BiA-K55L%AKS22V6DzsM6L+8yq86X9R<6&w;1#((l%e`i zT3rzp)&BwNCy5rYBR9G9MAiJZqbc&Z2=Vu~LIk2@Ht-J;kp~vKh8Mo&t+Si1>j2 znV5N;>1pX5Pp@n-b+FWFU@IZc0e-Am?2BeK4U=ZAXS-?;1cU?#zwvq0XD;0%Y|UIY z5?m4++MF>U0nw=dtxK|y#)~UxjhaHdqGxR@l=fv{+C0v!$cAj+?dalHOeoAq1o&W&j9R|3cTp{n9yIK2c(_=F$V4lNCkH904fZvW5 z7$SJmM65LB^OQb^nFmo)8uB3UVuH~L>3~9G={iY%-laG^oxg>xlB}U_g17nya1vZV z#d-y5NOT&8t};icN5Mhh!1UtjBTx4ZdC9FtmywX(h zYNy*^^=a38FagDsko$1%J^trs6lN1G8e<;=GI9QS1s)*up_V&KJjS_p8ksau+>a+y zN(^6>XgG9My5(EQnQ7IbaZTnPy@sNI=Wkwuk{3&=qY{Q9+GHUq-eQGlQ%u6{;LnPY z+#g{~2YpiY;k+Wr1f)Ll0e<5no#KFeD7Bqvy9vVs371t)Bvie}KusfX}2atGEtXJ-)aDZPU{ZReF- zyQ6^Pa?pH4XQtlbVGE%G_8fW>k@4q)halZaaF&?#P3Vnjh%aHsWBo#MTwL4^eV^h$ z@sN`(m%#wirXn5)Q97jh5FFiHItx0jq7I}9B?-E1iktR*%;L;d z9244akfI6Bat0CjYE?q<{hQmf7dmDe@IVlekhaFM zGQ5Hj_KtGi>W6a;TggVVEPw3yiOyPz?}jn|xmtgJPe|P(`vEYj!g>kS>GsOC?)kF4 z6Z+u62SHb>USQa&Si?nQa=yJzUOAHjkE_o+{{`g^tn{slo8Nqc+!)YW_XT}mSo=6D z@4`(e2_dk%$MbDa)K~C3pPxf@edFc4eeyOvS+@o-CZJ}nF=E8}`p?cE*)CLw+{jj2 zoifoF;dBiLZAwr!9{kcY8*gxw!a^NJ{AZyMZ!twAjj_53LZhaINi9#L2}T(0;v)}% zqzPA`7bs=Cdxm?Us!e<$;Qr^+9Gq-vj0v6BuSrv5k9lKE8oq)cV9Fw~nc_?}m~ts6 zbBCMwgqv)UYSd@Fm&|5ej^WrjDHy|3UH9?(}C3LjFrO62VJ02DbH!du;Gv)Yu5-YHv0|VpzaFv|($1g_vrppYX%^u3(hlHt;`>EVyyf zD*ndSg9PL z38DgcdbGTlLP1H{$4+-3X03h@Z8-D&ZHDp7DTBR?m4ky$zDJv~=C=!|r-rWUN}k*!oc}z?7xV#fts2M69g)?}8!BaxmU#f9A?K+%Kr(q} z#%nZ%zCY39DCBH1q(a(Ej)+LPNR03dIuKi5+VR_2dF_)TO_+Uu)QeUTL<8Sb0@ho< z0`COd7m-O%WEu8Y#5T@UGQus!SBHrCtdu|^JrY~h9Q>krmvA(0z#>n?!ipdQN(? zA;LHNg><(FZ!ZHl%YPW`EYYktpNu;qWWd}PwBt<^sjqSQavmN>xbC0|5nqK|Tn^hD z))x)u_oSO?f3P~ElJN$;^sfRLLs{VVdhkT;z6oI$L~9}8w0$3&k1>c!z?Hv;mM8ZM`9He+G1dR`eSiAb#Zv*B-y< zh#-i@Kps5E5q_Jd;J7YJ$Ri>aVuA3_v+qLLa(?qT$mn=3hRhNio(1!Blu-QU;o$p< z;J2c0f;q#ayF&uFbo*8OhI%3?DHnGj{IyBb%kF%%?Yq2bc5G;gnSuk49;VT>AXgD_ znGFw-__>t^Dl5XL#B}cZ+Id?+-;A3m0mDu%08u7f$fgD-W$sVccOCp%Jr`!yDb*D) zUO6YtOo>kIJexGCb67%rd-H)*%rVs?rP;7)>8H*&1z4eOEhi9yHghX4fGSX!bh)5L zI^WLoiV@?VQi>9rEa2jBWh^lGu_YKxRlT`Wmd(6fbq!kqL$;7Kw+nhgh)_{K$@p`nsHSs%_PhSWSCu?olLjEzAS*wx zn8J}5Ui^TB!n2?wQldhD*)aHszyfF;MiZop!)>Cd=Yi%lU=)Li%?(G_zA4r~c2~?O zfbVSqm7L8qTg+{j@bK*N_fYiOmaEkyKwv%!wkBZHqsqJ@W;XT=U|x~c`DdSefZ&Yg zP&o<&Sq&q{_o84blJQz%t%!%YwN3w$ZP(c!9OUlvoh4(p^`4X@;B1uxBObzDVA_kf z>_MisdUoDe75XjKT+1We-h(e@;1I79k7U|Mg8zxB((>MsGp|LZ5m)8fA22{9(s0~` zMZ%pv3gV67M5;WmJvA0D!i{u~nbVAPp9l1c*tYtQu8Y&k^Pm+a1I}4_0AtB`;+hWV>e_we#D!27~YD5yFgzxo<=d+X_@_HB2T)U8RFrCTxvDhM5R7g4p zB&h?eK~g?CrwDM=(y{etqg%E#zUJibcA*JthHs$rwUQ&Wz{me-G~^w-b6 zs9GON=QRRtv@1WhetM{O38dDft;YM~XiyTEbb7Vj2G{g;0|zq%n1y4ggChx3vN1_` z1oAdO`YhboNgu6FQaEOa{w);g3X9!uip=zo&kVfb6<8F)VLI|3|9h5zzu|NUXY9I7 zZypYSDGeZ4_~FpTurI(O{{(0hVc$VTL^RVu(37lyO5^l!iBdh=Ou3g?Sdfa+kO48E z>wQY;^NlSvt8pd9KnyAI7Cc12NzVgD(P1Diidc4PxfW>_NZMdWsq8H@tEMYyJ0PD} zEgP7O>h||Ku_%Z70G$q6NfCp$QgFcecpiR&wbaOGL#2I@>Khk558r|Q``M?%1`{Q{ zzH2aeRY@Qv3%W9~f@uOY9}~`Fv={0AmNscCSTJ)RyKpZym9EDjWPYrkq~KhKh0&HJ!49H z{7g6BVao3eB(;maR`>|-N;M1zf(Kz2$-~OZkz5?@zZZrbt4tZq{v6B$2;_Y<)CvNv zI9>BW-83!CJ78Fb4B#RoH|jKt`Z7fI>`oyfApDiR9(I|ysKcAZvwyD26M>SQ_Z8K* zMig996sZL8)to&;-u?NB)w+hTYqvlRF0YK7jburMqE7eN&(+D?qMR_qRG^K7J{U?B z!rRwO?8L%XN$w%Wn|b)p{lX4Q76%j+i!a&{O@D^Of>)&2-ee<5KMw%V+3**7w*@wz zIl1kA^Dmoop`va|F9Px%ZCn0lQ9Z#9V4h1H-gd#xj1+}TWeWJTA0!1n+sV!nRt8*6 z*003pH0p06`;32Ay1rGa~(b2JFlOL2z{4elN!TukVlm z0+eoLxbaPnvo0EbZUsIc`k1#Uak7h`a^SXJS1Q!bLX0Nk3gMsShJbmx<%&U%S62tk z6v=U3^VUR#q`~l~>r?51oiGuzva&)XoPn)8=Dp84o4N2%N>{D_a5^y$5fhtbm0k_4~<)zxJn{Aq?)la^6Y0pVu5-|xx@dq|LVM{dm z@Mk9C`JEZZKspzRSSC(>zGwE4VA0XJ42JE=qkk{`1PGXsnvGtr#JoN~;wHSmqUxPa zul9`RDU&eiRMOIErmk`_HU7C0C~E+q2MQkB(I9Y4Fr73Kw@<+{6dD9!y__g&gS(s6 zbEUw?`BgKWA!=hfnxY1K;RhGQ0#>wtX7|0xlYI_I8m9fHxJGq2+BC+9vgvo)kSF&j z+`abu2AE1hybyH)2$mQ9)93o}~h#D1uQ6(*$rXve-8*SrNB!Pz(| zn^60|oTswLCFI}us_~eeJpTKRYvB;`y5z(3vM8|2gT%qKRYs6g=4~dq7?+eGPuTQXO!|ndV47KH$Hr^Tk59(LH1h7=CC;r z$nfS3hmoviQkvn$p9>4`M#}CWPyA|Q;d;d_K|;>b4vzr?FMb`986l5nkJ$Ypn71&U zyXX1&CMP`J0ua)vXP30HpL>PN>){B*1#(|$5~JBTws)%X0?Tyl#y6Mk5{a8>+kr^lvlI0&J4cKb(ei%{Fj&{_rG;;TXgpNaWTjB zKse)jiuHIt&e}lAB)b_h3d)!pPMhhkU7hi7iZ8#KZCWo@vhb1Gatk1HrE3TMZUasH)hs;ihlE}e%fW1NS}@4Sv4oxwie?PqS)#%om!Tsj{W zZ>H*Kz=}3k@WhhrZ2UwMUZahDRsL!@_LZnY4eST@CJJRQ%hJCpXE)(NH0gKLF0Yp% z#Q6U{WjqLAM+8ZG%6TSOA^sUr^ADO2I0C{#WSuH^eF8uXtWPrqLzB6|%pqcShs?B4 zggGASmW6PHHxug^IQv?Opx-Q3Y?<3PL=hSi@+|NvWea4g&tdAo=;UBYD&wJgjg5|1 z)m@6+`}<$Y$HF`V>{dtOxC|;vNGRwzV1Vh^Z?^T(hRfr8u&Q(_znevpk@<=$>~}L& z;Kcc;1BYwrf3^v1Fy8?9$<)yfcUxb3EX5k^#;&k?q+jv5F|e8PF_UUv+?h146MQJs zDv(^ek5*$WqNv^>fpkWbDeiXDDvpAsdP(>67z}Zncp3Fa^uVYM7Ukem{-BGGNW_fW z5n0H9ASQddN>=rKh&}WJWhmmyz|t4_pM1gquyTdw{aw@5c9CYCi{-2PW3M{T9r~zb z@)4KPBcQ~mGBajr>IOHn;fB1U|3~EmDjsE&xVZQOz(X0DY8Az2vaFcgC%_#U;4 z4)=v;S~SC;1edG1`Rh7)rv&N6!18eP{vbK{@ZT;!l&= zjSw*?M1=#JJdh9vaW8B}X+Z^8Sk*Dd)WzWlA~i%=rRv#v3RquI@eiN^0m{ubUqCaR zX;LZ|5nvedigl{IiUU8VCl`aXB_HsN9X=TGAA^uTI}0(F68X1A0`Au0J;cM5+#b`I zK`0Ik&l?5&aTNd%WBxPW_*y4*(7yRHWTwV8(p)UH_&JVY{k&luz6DrHo=-S`1-|ZR zkO}9;DeQ~^L$!mjihYh>ELF-ecZD~7VQ3+$F&|7N@}**1xOVINUH}{}c~M7aC9`?e zD;BFa!N)O47uH;eg;G9XBdVCr3atD0N+~Kw3Gk<#N2j2+9{Z51Xn7q&1|20I9Jc%B z5U8d?43u+ov~rv#w~|+hgxo9b;Zk~aZocw7xj;#XjZMODMQM`pFS&vnnU{I5es$lI z*n%c{0l>%K`z|gq$G|M}QpK>c^F9lg*uY1KYPp@O8!(~$cKiqE`#rFQ=IOELPD*9iU$NCU=tPmgu%!dq;dl(JX~6C(3ii8ec>l7 zpg1>=r-CmGvw}vSIuMJ6j@@>K8$M|v*LQnd2Q&@~K&{ozb9v}pb+mvX!PB65NCtHAZ_9EZi{t@uXtMhRsEGHy2=%z~b9xj0A_VaW@ zbO+GQ62rO-J-diqy2*PePVd6tW6+dS z-rDu)*!e60_`xVASR})=J2;Zvs&|p8UOAmxo$gt?{bR|<{4ekQ{%>>f z2>{)}+XA1I zyQCqhT`BRkQ=WvdQ>6bE53#b8z@wuHX54y`Wv(Tm=4kF>pL~$K015Vk(Jk;ys{ySq z*MXllDj6HQJo$mSp#5B4^w?ad)}I2;Y1wF96$&c0XWdo8*1t**KaBj~jiOghesOFz zpjWhNwgobMKXkaRtVr*Fy~G$Di68MU>)o;5)+{&)LHhH*3(z`5zeGJ)A?Z1*DSjv> z*@w~R#18|yQOl7g%;Om}>fQcO&yuZ~SHQfj^lN&V!$z8o%#U9zlj*%#IrdD6J(IKJi?p*{g8s+e?V=Z z>CuSidL!m{qy6ER#S_RKP0LV>0oyBSQs!TW8I@x^skCZCj5{e2R z{x|u##6W1@rPrxt|fxhXFv-#ARr>w(G$K_dab_DXN%)2t?IR3N-BamgPGh zZwz^>lezNHw}?e?nGFtWO9>P@KIsKohsN$yXKFyI$`=cm)|vC(-ZC8_Pj*Y`T32CN z$xS_wY5pnvhcjB-7kp)bXO0^-0=gOM`|m|LzbSJ+;R#@(u2~1K?w99_>*O9*b!eCq zU+7+3PQ0`P<00S%A&WkNs^fd;06J0XGv-`$@5H$V&v^$cLzDoVINU93Eg~=UH}XMurTg3n})!WSNwFTJ(_- zR*8T5bZ;#6n_@7COi5UM2h&Ef!51SRK1mI8q_Dkdc$000OvvMV(%)A8?^?2$J{G_p zfmaJ{uGZLYc`6i(;*|*g$wn|F0{@xhzU!V6sJnPYq%$f+wN5!Dc&#J>@uGq5yY zs*@&w7RVT235TtG&i?>3O}TyI`Q%ZYlwUuAM5AooHxa@w`lvFaUIAn6-~Xt1i!UPZ z*ts=3;qy?4dSG{u`=BF^;4PZB)}3w>ad5pX(N_iyGLE^-9%91hrl2Pgu20hA4eL1m zD9n;!>o-^DdIIb!*Zmif1gy|^C>UB+!zNR2fz3+Lnb+zGlct=P*d|E615?gf0}kKo z?vDahA1PS)CM0|=bKr%zMb}=vfo%>X#6-9v5LWfMS?&Ati86x>P*JSgz`pkp zK?jQIAsa5Qk<<<^!tv5IW%Z&_A>j1Z%J$SMCr%dz@4*4*XBL>pP)jB-B50nR#0n_$ ziE|HU_ySshA{O-mfu4I!3vas8%(aM|Dd1m6J5V?Okfkg^A_(VI>L$V>uNcqkxidvSss8%`{jHAv-S@MbFIqczq}vMRfVgpd*zi z`BB9a+7?tG#=F}xG<|8Mtg9oc= zJkqfy28U|aOUWnKz|%4eq@HSRr#=44=DREA;GiJ>d4=2Si$mjOk7!Gln0PAJ7y48D z2CA?}_vzqx_pcTD0i>7)8zqL}`A@rrETqP>8SCd05=OVELA9^f2IFN5++<@&)n>#5 z-7{JM3fgjHS!R#VFg_Vrv$Lt*oyt906+c_;!2|Z1+LaQzw-t~%+rspW&$hS;XfDe8_Pe=HOC;6uV`%$8e-j` z^$z)jLL8Vj1@rOpki1`_=wUqaw(p2kOp0acel)mu=D2=h34G64^%EkcT@_j$;YdNK z)6^5G4;S}{&o`)ZP-&eIN$omp5cc!Km+MJ*NOlnrgmA?NZG^~qHqjB!Xs~N;QYoZi zkJyq{Q;3Aoi-aGQo|7@YIS0|!-$;)9Q2A zi=<_=FTW!gx^)BTY7aD)hxr%??z!p5*I1T!0K8I}SKU_l;M-SJcZ^7=*W zx4yXq^wG|=!loFY(=Q~R+(<*ks~(a&nBlpWiV&qca1LT^K=CRxN#jaJZGK9bk4u|+ zVD|ofO;OhL=3c>I&1hE=?{t^xl$PnIIsAjm={IJ)BDg)vkbnWD_?fR$ZYYtfn}nPY0q=b{7}3YU`fZ&Z1MJ?EFfK=%ap~X8tg0B`{DniN z@rgF9Apefc@x1#&J}jwkQam_X1V=u3aLFeV1ss0e&-$X7S zhVqADNr)yMVFnoi2FU^01-rJRwoBhh!rvbS zLS1aE{>P{-gg6H06RkWhR!C4`B^nrkoRa9*tm(#=_J~l9srK|Y(zV2VD};I`G(vNO@uFc*~6r{AiGyd{^)z)i+0ES6cwsM zgeATgrQ9XRiN4A?s7f|nn;nn-t}F_T*}XGFkTO#UfhdHT2#=u7S+gV~DqKNV7DfR( zp}-43{gnb*p&H<9W?V>PE5>Fy2PFFHvypNE$P-q5X)N0Qyp-&;of2AwPhlbGl4zMMaHoTS*= zemtUiJ^uAel=D`pTohV(sy}{qUeGXgob`KEiI#bY$<5$gsCnHQLooWjHqkkG;yZ~@ zePzl(wRqWAITmWUNb|MEp`&*ro+l7^p#*{oVNJ2oXX`y_p?NB43Z{LD6Z$)I-fm-< z%1sm!FJoEczT<@$7w^G@pJ{52@mCL$7D-bJe42J@do1PhX+RF@4SetHjnhHlxS!|q zgfQqq`JHAp^6RH3F%LPBk()_1(JAWgHwNui_m`dD=JYkQSW)?9;bfLU0++1u|3}wb z09Dnt`@?`Jp>%gjNGaVQ-Ki1^NJtAJ-JsIl-64q5g3^-GARr;q(%m57ck#UcbI$vy z-^?BchS_VceXl#N_yqun<|Qofd0sYAp!LjmgqZnTnqNWA#c}B@&;g-ji!_0uZ3snE znf*C~QJ+1hzK>?vL%ExBFr5qODNYCCupU3%GSs`@tK*RjycfVX3?>(HiZsiKB*^W0~CRYQ}IQ|pgz2bRM^-zQsWJopRA z7M>shiNO6t5=-o^919j=c1=IF9PO;AT)Xpx8D?P0mAIW+zqNuClq(~wbl5cc3`cKH zv-Uw-yR|})(`J$_XEl%F{AP5di=+#JXtmqnvOKJd^4_R_%9v32;XO4v`N$hUs}v;WuW<>&Rrq;SX-~puEqu45bBp>bF2D0d-3o0SXaepoOmZs@M-sCNAw4IH%By#;Rx^F^g z^4a4AIy05L`RO{>3YeEC-N;q8(<-THQ^mO0*y2!=6vZIpRkGk@bv}MdKILu zrXCQ(_!(7d!<@=nkFKdh(otA>ME{}~$NgjFTa@V>+3>na6459bACVc8)eg z4SG+ zBwxY!$`%hv4G(!3_c01KNjr;>P+NfrZShgx&cTyFie1&u#C#K#SiW)@Ghm|g+5vez z?%Eb%UI4YkQsdd~b-g;5JI!WJF7sPksuUB>nZOZ?2@McuA>Q7-uYeKt|6+C(Y8~h@^R;?ib7?v`#{uMxU#$g@BIXhzDMdYw z^ZI*EXKphH=}WlYYi{8;7amfv{V7xuYYfdZ;S`-ra<(saAfafS$_ zUy3RN@FE|Rl27|Zafd4jDX9X$=e|mk5LJGT5yDbV&~4@GUn;x95(T z1kpp2Pss^JM!Plg6g5-%?e-Dp@)-aJZC7DBJi==`ERzyAKV6*hXyFzlgc^V?PrDcVfGC{rP$k9L983)t zFo6ER-{dY7|? z&rU<_VH{oy6}wy;8aYg<-Xu)SFCnH=b3QCL z$M@=3FUu0yqQTBnuki3gSCH-O&UA3m)6+~eGP5I)k zBYs>oTAUo#U3pk~Hpv}J$wP1a@f{1gop5inbnpia>2KvgwvEkB(JRi=xMr)K<3ZPG zK1j=4-zms3dA~|6OJeguSk)9LrB-4%zo`TE2mXLDOV00%w=5!#Kl z4jwDob8@OK#wNwV2N$IpUb2*jYW2E~$s$&~01xkNiQj))Y~RC1%rla~rB$MTGu-dB zhCbw9b0#;YsG)oq&lw5{#t`5d^D4t+eyKk0jS%|+MT6WKrtG9a(Uff_6;_75o_IxC znwdTdp&pyBP8(^0j=^L0YE@v~8R*j7GU`_nQC>G5g3q?P=5ogi`&keIqh}}qOT40E zDzk?MtJpNHQK;m?r6yD^v@sMc$YUfmO0(5t(4;JeFGIZ_;Hkc_`N%39sE>9SMk2ld zb@9D~#Cmq99469uUL(EZfqbw&9y6vnMCKP0@(dM0?+3`I%lTv<&z#Z6e|w`spVxw% zs1rZ~H4Gp|vR5RB4D=D%FX579(JbO!iumEkj-SN`At52j#g~24^E~mbD5baU1v7=3 zqWIC_lsld^PmGiHPL^8HNIZ3*S;)eClmeMnET65uflNr*OYq|bmjk&Ide=qI!*R2& zEge1BIMIQV5uI%THJm_34H^jMe3`%zpe9(z?l*ED7EM*3ju)%d(wza~lZ^b*ZWly38hrEjnY z(dyyr`*Y?3Pr4Ot*#S>yD#!b52j%2B5?P-@!}B~qi;W2#7I8EVZ|s*VQR#b$DMr(z ziS#*~ZR%blqVV-eK{mPREnMm?#+HC@+1#7uCe3s4eQJBJU!$FN?NMYlE9rp+5-60i zu<%;$M(KpyT#nDk^pGsc33%LwP7sy{1$-XHbl)SVvX@8xecki*=VvpaOPuB8HO*|s z`AV^1MyU11+@K1CH@`S6$k)Jnkh7X5BD;{Lr+Unxt)p>&?qnvYk26N#xre3D*@a6p zM|ll-_j!z}XpnWna6dFsWT1hm@pIt4U3z3BL9O1Rvy@i)z;)yvYHIs(Hz<8OsGCRz zfK?PIjSPdiy*+72ZX8q)WpB9TPn=0VDc@t?3MaQc-v%Xf=9)pzz`ROLfifG|>bvd*X0bEVu2R+~A0Rr`8}0 zRo|Jm2xWIMuvmR7emiIpP-M$3APQ#5whL5`w{U@;uKC z&3|tbldz?OqqrxH>M=d?UXjQR!uOEcx>FH%!ksVnIvP;qe8LmvbhoJpt&}E2tGyF? zjM!j46cZbX$GJc9Q5jS7@YByN#Weh)iwP@1Iv*QqY#D0Z98;g$=5MM7_K2KX{4osC z=lvcbu{ zqdSk~a3nOc6rB^WL^Cs_7mWjdB3}|MAa|fu;iOgM=Wi%3%XMk~Xyk`p?yq7Hd~;CD z5_?Kw0>QvMvA)18xRm$JtNtZm^cJp8?Ro)+PtlX!jmVCcjWwn6tTbDagQlsGgOl-H z1ci_c#YA<&>CcUu0kmC)rJk=C9jk4pDW8z2I^(nGrvjR0$%3l@3n?Bu@M}RQ>AfQT z@3_+0YbL!D?*}*9MPpD)t9>y2qXBrW33q3{xny4mjR|~c>%_>Imzb{K-c0$#w{dku zvGPZr5DFIMJweiRhe!f%jg=;;CFK;Jm^Vn%p$#0SqXO}%t5T{OD7OlCp3pLAb;q+Y zOP!f^#+pX=Ur}}R&au%`O$n^>+S0ENOgM6{eWuX`8Nw~9#TO@gD_ruOl(AUssYpbv zTUtfc)A3d7skLvIh2P?+a*;dKAtMr@aa&G~wUHJROamgNekA)URHAy{2Qxi=`}j%D zwp(Y+Jcwr^J;g4?@J$R$CUu#!CO~{vV$f(qR^W7hKj6L?)6o}J^*Utb6hURywpE4H zps|EDuvGau3mt@H$;#aTs$mE6Vl89W=)~S58D@_7%q7sjT^$%p6aW~aC0iW^hh7c+ zdk$NRRJ<5RymT~A(bGWws7xjKSSFl$W`+@m_)!CIJ<9@Q-iAiTcr-5nj|v)Z%T)uj zJ&=HgA~!>|@0Nh$>OE3wi47MkrJ-|Lbve47OxB;t9iEr_sc}}{AZt0k z`{=!keQFx)m4mg-iN=1`z=6@nW1)o%=LNB*I)XR-jl?}aqK5=HbhcsAirLeEvQ(gr zFI{Ct!(-rn!1Z}JYOC?GjV@B-{MuV8-_jO`Qn4gmq|m$3Yoe|EY_k^1V8Dq1o>27+ zgJ{HJPm*MBGH)JPbQ(Ut$*byO+U;aKq$`8z2#hAczj@~%a^lu>zI|{kSjU^Q(0d{+ zN)WUT*k1{-N{=W{)e&;ZQ;5!$@3q9-@bPg#xq?6dDE>rmVl`d2+GS1Je7?5G_Wl08;JJ&_;g_}$g^o5FT9fv) zdx9Ulh0Ii``ZjI+o{`UYW_X&m%9*ILy;V9EbL17aGu`WoyEXXi&g@MV#odsO#FBb2 zAK46{vO2k-xK1hPIs>r{XXuvoGvh09dVY>ecebUPp_1{Qq8$+AD`A3;<~_@URjTnH zC0jk*HC@iOwcpD54_E04%>^+-RoTZ3d5X}G_HFXy{F)t#sd@|U3XwS0!M#PGF8)waRO*o_u zU!53j65W%X{P2y&%Y?fnsyrlV*=DTHkxWLJ8AU8vCLs{z`N$;%3CK=dOxK|!6i6X!(_HfaFNi=RGH0nJWZ#A z8w}V@?)x7?(U@2E>Bat-wnwH?ar`;0^8F5O(o1lbW70z^GJ=_S=Rk# zygK_fDTV-qIW;cfAloH*Zs(6>c%#5;EHIdEX!pccb?XkNq14ynH8tx>6*!Z1!9be8 zdv?p5s)KNzYzcY_EEEIPbA}fLc3CeI6=z;Mis5jGRZEPiY1KY>IxjOiYHTXlB4iPr zs~~KiHW=3Z>eVaa3jg(wC{e1^{QQahiY1nVpWLU>uN_Q##2h=DErnA&a3K1MLdFG= zhnY3#a%Z9wu;6x78yPT}(9C-IgH;gn^*!8(ii(QeP7q-~58H97zXsuE+TQ#-F zhZ`;$g+;etjnOznFd9qgVV6dW3zd=1)Y>-k6#sm1&>fRPZs}iruTWDnY*e2Mm&jfl z4YPJGthrGOQkLxLRuk;$rS5PcastT=*hX$?e-Yy_BbojW|Lap-lak=GrRo7`~^LngS{nl^PWD7uzM?{e^n86`K$qvz<&mX9_p{ z<%V)dq@M}(=r~TBi~8@hH-6RaybmJTll0oby&1Z8mm#G23IDZ@4zca6MvKPVCYuEM z(%$G-INeiu{}&4Ex68R*Q0##bUtj$p1)tV@Jn7{ z;0Kgj^i|fh{>9(PS&ntR)L%u--KGnWE~h{25_Z|nBs@Bj6ulsJA|&cl#UBaq8ItK0 zG%`&z7A(N$ZF={p?8QWgQXIBDsx>xNce$;EVj$V3^F-Zz9Hq=6xnIG(>ZfWuBY?-K=2ectYFL05a!4zVuQc=Vm; zG`!X(av4+nGKGEtk_v{%PfA=a!gq0XNXiz;W5_(%W~O5vXVGzxm>K^dn0?pguhih% z$aJxqI&$)oU9TYZHtx9kDVp(w%X{Hpyq7O=5`rHJklkmhXQicAM+a+YaY1-Q~UA#5q z37xdhZ3$Th;hmY8UKSVfX^X{PyG?fe8WWEQ7=ovz5pOZ>XM_>@6N!nvrn0(M802-g z$qCs-fZyO7A**)gJ?93|vYiONfbCbhDrMQjI}ck%8zAk#WfWXoqniHp`NNjoKGleU z%6iMuU9GluyX_Oo&pQv>8nryqMwI!}La4qEsKh-WHxikssO3*N)z>`XXfl z8a2)(QIDlM$|{c7Gsy0wQF$2mcaM)Be zM-MJW)oYssj<&SW`#`g$49Fp-Bps0b4Ci(a|&W)(8Bp2U9+uijTSU} zRsW2fvcsccC%}KY?yg{_p0~Ppw9|%iv5b$}|80k&dhI9?gZ;^? zgxdgQ6vya(svES#_&@d+bc=+uoWKOZIOHvZssk}zZS#kuN7g~D3pNsV8!FVB zzM=Azc2o<$wmc&nnXD$S1i9Y~IASy)%Lw{OcF`SUJ()2t8i*0&@%={_qpyob0-qQA z7gr=cP8FRtlQH5ljjKpVPB&*N)nibOO`)q-tsVSYLnU3C~{iA?{0sA9!W!b^~X1;*+_gf*Hk6f&-q4nQZF*4RNeCaoT zZL-)nGK-I6K7+^IDe_YqP0FG zrjhrt&pXSgVy;z-3mb1+Qlg@c#rY_Xi-4NU>o$G?F49&mq_bzW)+e0(q^?;`#i<{c zVU;6q6BdN~^Ri7)%_SRTjujUg$)$SF8YWmx@6T|jI2Man-(5@-K&7-_+DHGIQ zNwMzQrf6_4go9lKt6#VwP_|mFHTDg329G0lCi0Q_XTJdGv=ftZr;pZjUdTO-c0Ht` z^$|;lB5p?*l`2MSS6(7LP)IAycZ}#hYAHP_n|4GBk`7hlEq(S#^D_A2K|W5hEj<2S z`EtmQM{51s^$wlIX(p9T6hy>Yyl0&SoiCq)_5h)=e|5fDz^5A=%9wKf?LEvfuhoD* zC!&e^p6+I(KKxK|Se*YaKGi4Zio-gi{`BnjjuI&eD_BAs6ZWJZuPW{yJas zu$tYo+9U|as{8AeASu@iz(}K$J*9!;;T3+xQco5jz4*T~aj5?C8t0@_j~$(S*)(9h74xWX&FbZggH*_neDGaMsI_A$s7 zSVi58Dmh;-M5UoSoa>E!#OLFEbwY4_0eSVLw6(EZ0T8tkpweAX1nLUtX{-R+8-`qj_;9OvfTl}%We0CUTOP{2)@ceUrY@kX6`gQZMQPQ;0Ij} zK4l#{R&|Zb?eUdY9~@3_H^$0ZZpJCbu}aUkhv&dU&;+seM{h!!)A2s1UX@YqXP&6I z+Cm2+0zbNzuVO6_?f6!u>)Q>bVbU*gVMPX5Gd4#*FTMuk&Lv zAF;MiYw8)HtZ_#Dpp{Sz*;76*p$*bIq7(@XGsiwaMv}TAb=Y;baWq{B3BAl1!hvq# zpwIj)n3edhj+B(hAf_DXD$%PP-<{;B|Mdx_^+?iGVZ?GI)cDir4Y?j+g1X5M`8?e9G=r1l+c~D03__oP4#EZ$H_?-bNxa z?Y<>)Iv*hxdYrVqekwLQZ1H6P0vC%NzG-SoLwrUGZ?le&^+k|li4;sqfzaK!bCENu z05NHmPK@98gU!T`sKJb3bQYQ_CAk#v()fg3$A1_ zTT#c2FLCRUjzV92U1kGPv%(XwS8v_6O!hXpl!}Rw#wDeAW$XVK|M`X-y>jyKZ5x}P zd#Vs|A%X5q*ZXT~6KqK96r4t_s1s%Oj0aS=eZ~S&T$98hnh6U~Ih=aT!HNoP)7=*2)8aRqqSUm(azkuk zw`DVe_Hni4ESdcwxwPq2K}0KPCzywQu=7$sUffZR`dDllmOOJr3smd9g}d=RI?F&~ zO*Y3@#}KWiM7Oo*8^*j7fDjPG@3@;Q5av2|se~nL{mHq=UhNRJW?~>lEt&gmcb%@h z&REW6==e$&t^_+?=*ZQu)?T4diDC-%hJg97d24TG$``yriRK<6M>l8H6fXG%@y#yr zw+$t3N-m)c@=dw41j=>{Gj~lW_pqfh+$$HKrk-I#<{u=r z{q*V6eoI$eg0X57VzSqX`3$6_}`Js?=i~f23ehgeF6q zKa)e+e+C#6EaK)7?7zlNQ2=kqqNLMDJ`O4vMiCfk^$0EahdV?c_ZGfFi7?<&gA^XV zLwLEmVK9S!vNio&ihAG@GAJ`Dh`1kcRsj%)_|5@uh<1eg(MHYylkl?0*2quY8Ts@% z+9?`$y5RyHJe^2o{?;E-sSZ;h94Ie#w*B%BVvRv+!qlzxJFQDt(=83UdBMEtKGu_O zHD8C9K}939fiP)pH1IY(4Xs0DHM#+jRmdGaoEY4?N4S?g$TZ|Jk~fka;q6W!k$>uX z?lv!K4lKES&@9;^ugq27vAtSSUckKRJ9eEAuO?bNN9Q5V_UD35tXjzX@<4_2$IEm& zBj;@lOVHqsUCYivD)N(ML#gHXrQq7a#RX@A;2X5GY-$h#SJ}-hf=o+XYsC6Bk^5em zRt9D>rP5_>1)LmCK9hC4nyPT-*ubB9?qTl@lsag~-D%WJsro!+Pp%qK|ACy6N;{5b z>2bbX)QgE~TU%>@CUC`<*gg8PK^uzHu~1b}N)v-o?dV4|vqozXy_qy~Liu!fc~GXx zLG;?Xc+;K14a!YF#+wR(H;)LUC+kNohcf}jK7La9ViOjG4faf_?v~T4iM5CF{0P!F zDb`)U$Y{|42B5sT*B-{Duv>^gQ^eY!+ht1gAgmC0uj>p6f#xpUT0J-;< z7#zrA#9=mQz6*9bH>h)o3MOP$08&1+z71v>l`lwFn7`u=OS$ zy`$6ReI1|a@#N=}G*8`^S(YV8(=5+~C8zk?w?L0V`sb^oMMOgvC|3CJ;&BZ6E(A0M z&moo?41}{}Z!QNyl{yn81=KCe^h72a zUW4@5K(Xj=Y&3$qu^@qu2JI5!kFG`-)?Ql9C>WX=u zR`$P=nccgUl6c(Ley=#EeG=FT z3B6FKZ`mA12hw9;V{bDc)p6(O?3t=FxM_%dg`&MW2r=C&GW>Z#1Q2(izI`)^$ zl6R=@)y22H{?YeCT@7V@!ogf59Xt)b8=J3H(>VK-^)+1XT0d~dD=*^=;g0}f8?#pc zIvI)c_24|$sS9jkAn%aB1XBH=VcE{kV-D|dJ+r*hSsp;@$Le?lR0M}L_SXf6@X;q# z?8<@K)3yqd$GiDb5wkX@#c6lyhOayIShngnKaIp)GvI>uGUQ-8j$H0l*0J}k&-en4 zDO&0yi)At0R+O5Ia~QB}vOjMMf+90pduR6v{~9wyLt#x#cdrCd={v;IybQREl^yT( z@(Mzt8u2Fh*aj$=TE$#snf!a!?V%)bYe-j9>6-Rp>Wq9DiCt@N^6GPv)5bfMMXeNT zf9dlUC?pa?cr{IV9jkPynYt^6(VE!N+JlmxH@v=QirKDhcMwp^#`9$MUKAW&9tx~= zY-97ZS!2hJxOX}eC0YmO-hQzjn+e^ndxbuCj(n`!-aT3ZrG!WQo1i3RXLCV!u`6&Q zp89e&6cH02!Rn(B3-pl}@HT7-Y*&m(WNuJg_=izh>(`O<}VU45f>YXV& z=Y;waXB1A>J*oAsC!ff>sec(qXuakJFCfc~SRUa`=8CViA zyX8H}6S%t-J+B}5i$N)}=>v)p3QNbi8fU{VoW}cSDQ(`G!E2_1ce1*Vq&`rUUkKlg zm{M-Shr(Rla}RQg_)psy+cHs~V(P^px&!JrAl#-skJ92LPYaG@?@1FcP;cT9i+Kt6 zrrv2ezozuIv-6f|PpXAch&lSd5WM@ekCis1ILo?Y+S*?gCq_Cd9dAob0yQc%CS%h@PEvpbay&t%$;Nz2ojK09}*wjA1$}cfFeYTEC*s|ex?s`AzoiZoJ z*`0rh`ye3NGBn93=gJ=GOw5Uw9YNg_L>8@mCZ|1D? z?&Apa^o?M?{@zLVP12D*XRKb8Kwa%}hHzjXL(fi-3TmKma zAD@rNN_>{(ZX&HMW$c%-ajVmfVl;~x?6SyiE()2CbUYa_$cdjVGR|3+cjU7_pKC=+7O>A}Ulqr~-VPLR zQy_T1SJ0B{yBDzk=_LyHvnGTk7Hzd%a3{$fE6Y10*Ul8F`JZw9KZ?e-G}4!JBeB&X zS(bDzv!2YD<`3}1YVqXaI0*>Ybm7EkDp)z2ok2Fer2aL$Sctx?2Lgvge)DSY|Iv>A zmu~^zJ(q+BQdMbypzvrt#L{&Kb|lErMYsqEA|tP>WI~Lqi!lp&Sh_1YMVvr}$v@d! zw8+!XXz+Z$cQ%5K9sA!*qW|3SK(r5c4nxEPKHFZP$>A_!zJL-x8n77B0h9Tr_jbCd z>zgq4np@5O2I<aJX)FTBtVAc0VtFfV?Mq9&X za;(fjJtr?C{sw893k9N>nAjV=qAK2bw_W`7s$ zeI(3RYAVlt91yLvYFPx@)Nqb0mfI}GbN?Z{#)|qe`drt zoJgBt6WZ@JPM1m{7FW$Ch6^hVTE|}b_@tq6TaT$-KbSosKQJT)U9>bIXZBSj^uxN5 z@|!<;;uP=pFXR68b{_|+a|Own?`Cb^`yxMvI;6MkaI~qHHvEE}dIr}QG-fmlHS!+4 zq06~lo*}E^c*!|B|B@HAb#LDSREff{$%AWTtN&aF)Q`~-6+@HXT0s881iXxVrl$|+ zh@_e`RmDzP-!6h4A`{I3WRW+|{kQJD4xO4k&^QrfVhX&rzg42)C--xcR(MIk0r79s zVqK|;Glzlk`l+_$l{rxSumBk>CsF@_?;U9POlm%tMzOKYAY>DFSn_bGCr7J4eIF2X z=6R&5tf2R%&ytpT<1hQ-2g%E;vK*}zm1u+|^L!uFw4_i;v^!kaDfG;=!;X~CbgfwA zOo=Fa3KK$#8;IQ#4W90;SUfHrc#6WGfTsR`3-*5=SS?;DXbP43-yo5&yMk0XNBDdR z)6r{7#0^Y?9=P2lxnx^`LMIbA?er1y)sqYJ{F1DJ&b`I1S;qO1FGGooL=a>AW%uXz z*9-vWPvAvw>Kf|gNl=}$*fyO{y>h8UN5400)<}mIcsBm2Jo1E%w9yQvu zp5MU07*XM4LPolSWBya+TVn9z#-M*NI*?3rl}Ya151b&}Nf@8hcKI=c&{g_Lg|lwM!vwMQGwz+|x8T7zQOjaz|YM7LX^@ z?)sM02O8iKB5sEc`Al8^?;!i%T^)Y$*+69iz~?*A22}$PU?p<30zGCjzu}Acn!C){ zf#Krdqr?Pi3xfoA95Xmbd2B%%1^g)U;K)qw`tr72CgejKL_&Z2u{s$ppLyja9_CuHFD~CvYF09vFHX?FXa5%?PGD_ z$-GuFpw!`j%tLL}qKFFr3h<39ZAOykK@0&C3ps@Ev>S^ErKB$WErsa@euKh9EGY80(oR$EkiDn3;Dq-92PT;^J z!{EP*3g@#pc*P*^gVaV|(dyO`M?KaE#aW$~2nKEzlS3RZpy#V<8@e|yEC znM2RLtX?+{{XGGRpJN;pINV+jGB&}#n5_Sd^16(;P!7YDb%>+@GAjEp9w_74m>b`QAeF5g z!3p;Dd5K`gu(fZ)*zu6r`<;Ruz4Qq&>Gv{YluM0qu(qEkR(SL6d$p~>E%0>`ygI=3 zmwj4WNnA0AGkAGgorO#ijY{_-GQ2o_1r6~xhhb^%a)T62?Tv}!%5X6UYo zSxtOk4K<(PGD(zojY|Z#?qy<92qp8HawGpS?g&Uu)R}qeF`rGawT=7sHdAHkR|c; z=Fqk*ZKE|ARW-<>@YkUtr;BCPlXxc<&|B{uUp@c*Y=BLS`lZiT8RbJ!kU%hNZ6{9q z(J@j~2yD#lvEdWyyL>OjLl)VXAW6s{LJeFJNl#9_@wV-ut@^WPr7NjD)}?8IYd_uI z>6-EeRsFe^#G81LD|szB+hUnDzx3!-$SoZwzhxxj1-O*wJL9dgbnIz{Cd#-iCy!AF z)SdY@zItT>3}6W)>T=tv@D&?q4b~5N#xraBU&AC{c5uZ<{(X+Zl(nVHtXGfmwU3Tb z4Zs{p7vYfh)}mh*f8elz6{pJbIp~Q(ER*4_m&j03XdGhIbO zM|JQjsVJ1W13b)Xo9|G7eV+}x%`JY?KIhJ$^f7x8$O8JbB;^<~<=zx}IiUD*>pkJCvlwDnrJmCSI)$2( z7G<^A!hA#_gn5+JFR%UWA#5UBKN$v7%S@dLvr7`%`z5dC0UA2qY2YPPjuN1sGWY^+ zR|7zE$|QAqVaY{W@3Q;0>SckAnExztTrNi@tRQR~Dc~>12m&hhcvnFu3M;r5a63+L z2U9%s9uWw6-f|6N85Sx3sJOTg5`eGw4Xd$~2U+aqTJtN7pU_pba$dq-hG4gNxBm5A z!!8k%IGt?R^CI@&x!#wb>BEORFwIGfb^tJ84ah6##&f1+fiIrV5JraAvHsEr8Wy`t z{i-m^JKAhQBs>|yt`Z<^m1$?(;U;XuLMj)}N&*1!0Dk-5m5%<|j4t(#tSyF3Mu2Le zr2I6JKhW_RI~K(P2X=LrpPbQ1o;3^Rsur1}jfBhuhV z>SDk;%j;k2<6%?sk?qR-FX`j|9W`^QrYad_Q+@^34wDjPAyoH(1A?hMJVvF`mo)=} z0jSRwcVP$pC}M3H4vMwzaj-HQ+U!1|e3wHc)P+eV?<1j`t* zoMh&?xyvopeE{<+u=!O)q{zjD=o##mLmQ`5Gfje`_uYC&zmqa?M1%vb{~>Hc4*SdM zmfMRd4giuUs@eaLA?kUmR)2aRVuOP5zc>GXzrfQdeXkyah3X!7sYwSQ?58R76$&Pg zyo#i+*SHwqJgoGfn}7Uz>48(<%F**eE%WaoHeiYfKOk#NRbNK{tcuT;*ho$*k&}u zg1yUY7eHNoDt!I`|8z0MHuT0)>dK@_^V`O=RTjEf|FnJo;=ddnnZZ7zBs?T0pazod zwDGOTXw|6^vWt5LCPMlZreWWnX3~Ni2Q{evUFy@lZWb`| zGini#nainqTb#)1ppHS=NojQERZVUo7lX9gv6vLILehT`>h~E=xF1+B4{z^Lva5=Thns~uy}*Q zIGUi3nY|k4d+l!@M~9?uHN0SaTf;=O_}5|zuORuaLJ;VB-lA4vU?LCa`z@q{)vq~F zn3Eaz1Oz5CM9b=%2_Ik14+8urDVg`F0@PR{$KztFpnIrjFGZUJ%sx2_s<6LBwS0Kn z0Btmr$N-KAR5FI*J0dZ7tV_YF3B3#v1qtaEs)JiK9>f3wUy83UaA2=2m5VKG$#7lR zpyn)AnDv`Do4NfYuXdQ&Ur~R~Q!mN=x1&s7rl}|_+2ifm*_nAwSQv^w--KBP$+grF z-hG+9@~se6%m79d5W`c3^WN3s3^*9xD_rAL+no0LHVysx`aSF8f`Gw#V=>f8INm|D z@wb8z7qXEE(VWuV+5}hd{HUkn%-NcF4>Pkw%^X|$XQ%rXqyvqO8;rCrXupop@BrE-Gv$(ao8d2~e`%^uKM7CLGjnq$ z$Bl`R!)|R?*7bJ+V4?;BW%P}HK0aF5F1rh8y-6Y|`6?+gSrL@uZc5~%2_5PWTM;ki z1^#>`N;WZuC5MKGF+e#ff28O^lB9+qOR7sQ2rRX`MAIw3QNweFx7m?IVM(+cua9$)!qWAG^i|*PUd&BJQ(|7g zIeaN!VADs$d^zx<2|{9vw}Av}7rxFH4Mww)5bb=1Y8yAAk>f2Youe?ptUW1?V% zKN2$IoU40FLQ@kLw&0e#JP)FE0KgdYVkP!D!kgi*u4vPM$=Fv?e;1cg{t`bY*CwsO z@z)*K=LGrj@L9r&R8*_+>Hf+h-h(ltFj5}#ftgRSJXR0m<&+I=SpLM5tq{Y zZ0Zi?Pngf3MTRGFFkvjw-KCoi9+Uwl$HL zty6wTrBI^b1!)8~kd96b+?}Z=?>jEpoyDNYN#I6D`e4WA5~o|y`C`m9U;F%7BI|uO zCpFTKPgnik)qF224&gkodw_obS?!B4#EB>Bb~WZMk*f&V_i&qugOP8G`y(JCqDj!w zT>G4E|By)W<-*F*v#l*pv%bmcE$1zfB@Y9}v%Mdw?xGjR#;R>`>FLEkO#Smk?5TYa zkWl~ohtC$WoTa{TEku(d=1wvt#l;Pa!L^MOKT5ewdj={khVY4qmNp+R*IQjZBqUn% zBhrsNcV2v-13s;82cwM-G&G_|CFm%TvBeP(|LeyK6`x#F5y^71eoAG&&PE9FM(szw zi;efb+Vq}5R8HcQzH{f!CZ_*XtxRTat`tYI$s*+IdP7U?4iJe9>TY)%-0E6)>ht~W zb`g*oh^Px)DU56J_9_cCpTykJ7uL|wxD-2tCW5;9;Gq7EsKgiInU$6IphY$eE_(O1 zw1|*JEKk^lA74<2oG#~}U%zg3(p8A_-}n2^?XMD07wT|yXL!AR`*zqmrgW_8>9^|1 zADfC`95L{Ayn+V^I`1up+P{Aq_?d~r?=s_4k#hoC(!vMf6ShdQQc}xFW*H-3e%5fp zm4Wl`0l^k;!a}0wvGws-`EnD&P+8kzeb1Ld-#rCrXzs=^sD6#5`lY?0oE>w;Hy?Gu zcDfiE>z2T6Qg)r>>2GasUv1R)(h(34C|=>Bkp9mvm@gIf)3Zty}p6 zL11l@>iqNgy#f%lGWgX);=6`E*80o;VC?{EmR$`IU)MU=swcCxl;)~{Nve+(cl_H! z#75Ocj7|&3^k@$)&=7 z`Bo-|U&}>`cBOgLdXFjQe@%-2Tpl$QLB3aJA|WBcDt=t#3`m0(3o)DZB6M^uuC_B` zQ2)!#r9ZkR(f?5DG01VboxdNAO-OhRju_?As}7Pkv66oc94BO4+?$=9wOMBOl=^)% zhF~;OZrAbf@FWX47cWg$xUz-mC0`uT$t94y3u2yIESdWaB}vZCS; zq&hrK>)O0fwZ-Nw81?h>Q=zr5cQwmbUJRH3EEEi$0RkEq2pDz08z0ol=0t-a!UEYai4tCse*1eZ!9 zz}M&LqUYbLSz~YO=&0pO#9ll3bOj|0tpDDrV8pnk;PR5Oq;?T{H9xl{v4ZFa z?{n8miLkIJN-9MU#p~C*S9A{Cr)=~r7mD-VACz_bb$;~TaqU4IC^l7BeIJNSOF9`d zj$pneIDzp!FXCT2Azc4eC4#&%)eZ07wh*_ep0P(|Mt)e9&fam%8{b$M89U^kP5f9z zs|y%1dubW7#v62U5zhv$Wv?x*tUSNQKV+%$j<~+q?`%p~%X95C?Dr>JfEGEtKO1Pv z)0rzv=_&=bj~}rf+BuKFG_KjG`o{gZ3E@e~F5mgjig7hA|NTf;D$~1neVr1cGcrm5 zQ^uRayCs&Kl2YW_cs6FesWxaJN9<=3ukF73%#I`PLDcxNKm~uy&AyXC%?CdJ_z3%)!_g8YJ^2hexRZrcjB~dRR zCmF2{Jz2EfV{#?^ZT|ZDz#_cSgk1;K#bm4a zhTR6q>6vc}BW!v#Oz$-r9XW5lw>NWK9aD$%K<&9gu!fSng2JwqQBi(=yS&oGkJ+lR zGBLZe58=N)j+x|NirF1vCc3@P*ZeL$Y2`~9h5z@Q?Mc64#WW?-oxNdr)-K(ok_5=_5{UNQBhIa^V#OBOFUN&?_a4(6>?U&fB$|K24&{*M&F{U z*mVfA-ki-lD!nC*w4UJ8UnTO`L zui_)Fh6+RY!myO^8aZ#)KO`!HT%@@h7Brz1{Zm5i1NxY#foPsc*e6I#n-Kw%&tz z^$)U4nLj@FnIF7e>&DQC3MA56uPX*Y$A)1qDklzv15>GXhdN zHg)03u3^t~gWmOCQ;Dl5C+rcgHtC+-pII|m?D@H+rJ&F?a@|AX_m4$H4u#u}I3pP& zNeLljA9jjaSP*Y|hXmnZUyo8sPvuts!taq2Tw@gvLbHtE5O0=Sx4wYHWb4 z_i*TBm}qI66|-=z|8Wn;cVSUcMZU}mf;jEq>o;4glkz90`$MWPvlRDfTA`;zcW@2| zB!JqUn40=)@4xyzMnFJfV}=v_CXb%RXgGyX;`3`wdL}1(hllSeC*J;~ zV>HzuiNY5kG5tpbN-YPm{}73!9lW4vKPeL;tsyNBDb&!3G-8FB)RS8 zq%K93;9#N*i!J>#2Ev9I=t>r)$%R@P#viln|GxOkOXdFKN=(E=%st80UXSJVRrs*Vsx^zNX z*576YGVGJ4)WdpHrWO{374|jC&o;*^I(`feoZI4=59NnFfBu~N3o8dzd`i*S*qCi? zn$@4*!p8u<#i`$TZCI+Xs|GYyzb-1LR6hO2%S*D`q&5xKP+dG|N-3>%^Wj3nHI7zT zQqrh@TxI4a45mJ5FG7cgv6FH?Uu}W+_H4j}DSG$t6=7-&Yf(W#-SI2e%(pY|c0ue8 zm<+3#m`VTNA{6)&`7(ZcJSmwy0*)*zk};EK%UIrO5QeO`OOpE%1%`$WKb`)W&UM{B zQr_ec06<}0NMfw}e=c%T8kng#+LIH)h$+LBoxK$K_?wf3UnB#PwP;lN5*qoWfX6l5__G5P8*x0D0B^JDTj?3JMt`=xu8RtXTWRCcF2|JsQV1bc=+ zsjZaTEzQmQX~lXYM~B}=pdI*ne|cOJ2M4FYB2xE{Re%6OvT#Nr2rBCv%s|Y3i=Ex6 zOW%H~+BO4LmD4$j#Bp$%Z&FlL765&U`kfn#pcGyJ8B)1W{Ga(V0+K!XDaHH zu)Dpzy(adV;Eyf-|C_^s#lWm)YqepaKp3z|ZTI_)F|e`!vP1K@|C|e)#+NUj`?h7i zz46mSt=x{jiPO7pFG&R+7=A_5G<4;&Ia%lC`W`Y`>n*-?rb}8(OiaLWhv(RG0I<#T zWxK`OpP>t$J#r15@x5f;+7%ZhgZCNCKOY_j%$#1K&tiT)KVN3HV(!<Tnk68bl&5R5T+qf7Qgh2{XK(upyUP)?RNqk6UL27ZV zUPW#Wx&hnEm%M)t)N~1GEH{egCqQH4i&Arn_4Pm`y2hoejMi`b&B(AIh@U|aMdKHs zQRVqXDf%h-$)&kK>#^C}o9>k~M~;EvNGv0R42t$E{}>_KA(kT>g4H2smL6GiOcv<+ zFh&L-g#=c~G9jCkmY-jemtT@v3~~=vqvErl_FC{UFkC&v$RLDd5Cg+%Yp79qrMXF| zMVWc&*gQ4=bgZMbBm;xLJ|hD^ihf})sQ%)T${dIb&;xW2gK(x8FwDJ~8PF`RPKIhm z@d3Ji`8;Ofn?Oqofx(X&AqP{S`jhi>LGb|&0Cer5ueHxs1FheJq5Whk69X_70*dkr ziuIH8i&9};*M%lT;94MtjL!1uprq-1u)&n$#{F&z6IBSmNT)V zC*wt#NV=0ti%arzVFn;uzbZ)ezA_sFL$?$IgD8siE3=`VFUd&FP1OgJhS-cSE>UT^ z1@ys2Ui9$)4-8Upf=&Zwr;x;?9C!#I`(dt%pl9f;IiO);<}xi%@`O!7}bQ-TBr%RsVSL> z`bC~8MuvI?dFh}ufb0fIC4&Wvfo`Y=CSKG?^a3Uea1dmqCZ?noVGY3FhePgp00XcC z7yzicrFWv}HpUkGugwl7gA&gfVE#kZJ#jaRZX;~E&;32ejoog>15n+d%#&J#)o!^- zuOx+885rDwnI6^d@eg-8+t>=*AjqnQXhHzW}5AGBEi|BS$*} z_gScJNI{4c^6#J~W;sCh~E iJk%gaI?BvVOizU-BvxSNV_=X1!s$R(;3i;3U;qG92yJ@+ diff --git a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.flat.json b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.flat.json deleted file mode 100644 index d637dcf5c6..0000000000 --- a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.flat.json +++ /dev/null @@ -1,3109 +0,0 @@ -{ - "requirements": [ - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.1", - "section_name": "Архитектура кодировки и нейтрализации", - "req_id": "V1.1.1", - "req_description": "Убедитесь, что входные данные декодируются или деэкранируются в каноническую форму (в стандартное представление) только один раз. Декодирование происходит только тогда, когда ожидаются закодированные данные в этой форме, и что это делается перед дальнейшей обработкой входных данных, например, это не выполняется после проверки или нейтрализации.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.1", - "section_name": "Архитектура кодировки и нейтрализации", - "req_id": "V1.1.2", - "req_description": "Убедитесь, что приложение выполняет кодирование и экранирование выходных данных либо в качестве последнего шага перед использованием интерпретатором, для которого оно предназначено, либо самим интерпретатором.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.2", - "section_name": "Предотвращение инъекций", - "req_id": "V1.2.1", - "req_description": "Убедитесь, что выходная кодировка для ответа HTTP, документа HTML или документа XML соответствует требуемому контексту, например, кодировка соответствующих символов для элементов HTML, атрибутов HTML, комментариев HTML, CSS или полей заголовка HTTP делается таким способом, чтобы избежать изменения структуры сообщения или документа.", - "L": "1" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.2", - "section_name": "Предотвращение инъекций", - "req_id": "V1.2.2", - "req_description": "Убедитесь, что при динамическом построении URL-адресов недоверенные данные кодируются в соответствии с их контекстом (например, кодирование URL-адресов или кодирование base64url для query или path параметров или пути). Убедитесь, что разрешены только безопасные протоколы URL-адресов (например, запрещен javascript: или data:).", - "L": "1" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.2", - "section_name": "Предотвращение инъекций", - "req_id": "V1.2.3", - "req_description": "Убедитесь, что при динамическом построении содержимого JavaScript (включая JSON) используется кодирование или экранирование выходных данных, чтобы избежать изменения структуры сообщения или документа (чтобы избежать JavaScript и JSON-инъекций).", - "L": "1" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.2", - "section_name": "Предотвращение инъекций", - "req_id": "V1.2.4", - "req_description": "Убедитесь, что выборка данных (Redis, Memcached, чтение из файлов, обращение по API) или запросы к базе данных (например, SQL, HQL, NoSQL, Cypher) используют параметризованные запросы, ORM, Entity Frameworks или иным образом защищены от SQL-инъекций и других атак. Это также актуально при написании хранимых процедур.", - "L": "1" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.2", - "section_name": "Предотвращение инъекций", - "req_id": "V1.2.5", - "req_description": "Убедитесь, что приложение защищено от внедрения команд ОС и что вызовы операционной системы используют параметризованные запросы к ОС или используют контекстное кодирование вывода командной строки.", - "L": "1" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.2", - "section_name": "Предотвращение инъекций", - "req_id": "V1.2.6", - "req_description": "Убедитесь, что приложение защищено от LDAP-инъекций, или что реализованы специальные меры безопасности для их предотвращения.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.2", - "section_name": "Предотвращение инъекций", - "req_id": "V1.2.7", - "req_description": "Убедитесь, что приложение защищено от атак с использованием XPath-инъекций с помощью параметризации запросов или предварительно скомпилированных запросов.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.2", - "section_name": "Предотвращение инъекций", - "req_id": "V1.2.8", - "req_description": "Убедитесь, что процессоры LaTeX настроены безопасно (например, не используется флаг «–shell‑escape») и используется разрешенный список команд для предотвращения LaTeX-инъекций.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.2", - "section_name": "Предотвращение инъекций", - "req_id": "V1.2.9", - "req_description": "Убедитесь, что приложение экранирует специальные символы в регулярных выражениях (обычно с помощью обратной косой черты), чтобы предотвратить их ошибочную интерпретацию как метасимволов.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.2", - "section_name": "Предотвращение инъекций", - "req_id": "V1.2.10", - "req_description": "Убедитесь, что приложение защищено от внедрения формул CSV (CSV Injection). Приложение должно следовать правилам экранирования, определенным в RFC 4180, разделы 2.6 и 2.7, при экспорте содержимого CSV. Кроме того, при экспорте в CSV или другие форматы электронных таблиц (такие как XLS, XLSX или ODF) специальные символы (включая '=', '+', '-', '@', '\\t' (табуляция), и '\\0' (нулевой символ)) должны экранироваться одинарной кавычкой, если они появляются в качестве первого символа в значении поля.", - "L": "3" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.3", - "section_name": "Нейтрализация", - "req_id": "V1.3.1", - "req_description": "Убедитесь, что все ненадежные входные данные HTML из редакторов WYSIWYG или аналогичных программ нейтрализуются с помощью известных и безопасных библиотек или функций фреймворка для санитизации HTML.", - "L": "1" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.3", - "section_name": "Нейтрализация", - "req_id": "V1.3.2", - "req_description": "Убедитесь, что приложение избегает использования eval() или других динамических функций выполнения кода, таких как Spring Expression Language (SpEL). Если нет альтернативы, любой пользовательский ввод должен быть нейтрализован перед выполнением.", - "L": "1" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.3", - "section_name": "Нейтрализация", - "req_id": "V1.3.3", - "req_description": "Убедитесь, что данные, передаваемые в потенциально опасный контекст, предварительно нейтрализованы, чтобы обеспечить соблюдение мер безопасности, таких как разрешение только тех символов, которые безопасны для данного контекста, и обрезка слишком длинного ввода.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.3", - "section_name": "Нейтрализация", - "req_id": "V1.3.4", - "req_description": "Убедитесь, что предоставленный пользователем файл .SVG проверен или нейтрализован, чтобы он содержал только теги и атрибуты (например, относящиеся к рисованию), которые безопасны для приложения, например, не содержат скриптов и foreignObject.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.3", - "section_name": "Нейтрализация", - "req_id": "V1.3.5", - "req_description": "Убедитесь, что приложение нейтралует или отключает предоставленные пользователем скриптовые данные или выражения шаблонных языков, такие как таблицы стилей Markdown, CSS или XSL, BBCode или аналогичные.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.3", - "section_name": "Нейтрализация", - "req_id": "V1.3.6", - "req_description": "Убедитесь, что приложение защищено от атак с подделкой запросов на стороне сервера (SSRF), проверяя ненадежные данные по разрешенному списку протоколов, доменов, путей и портов, а также нейтрализуя потенциально опасные символы перед использованием данных для вызова другой службы.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.3", - "section_name": "Нейтрализация", - "req_id": "V1.3.7", - "req_description": "Убедитесь, что приложение защищено от атак с внедрением шаблонов (template injection), не позволяя создавать шаблоны на основе недоверенных входных данных. Если нет альтернативы, любые недоверенные входные данные, включаемые динамически во время создания шаблона, должны быть нейтрализованы или тщательно провалидированы.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.3", - "section_name": "Нейтрализация", - "req_id": "V1.3.8", - "req_description": "Убедитесь, что приложение надлежащим образом нейтрализует недоверенные входные данные перед использованием в запросах Java Naming and Directory Interface (JNDI) и что JNDI настроен безопасно для предотвращения атак с использованием JNDI-инъекций.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.3", - "section_name": "Нейтрализация", - "req_id": "V1.3.9", - "req_description": "Убедитесь, что приложение нейтрализует данные перед отправкой в Memcache, чтобы предотвратить атаки методом инъекций.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.3", - "section_name": "Нейтрализация", - "req_id": "V1.3.10", - "req_description": "Убедитесь, что строки форматирования, которые могут быть использованы неожидаемым или вредоносным образом, нейтрализуются перед дальнейшим использованием.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.3", - "section_name": "Нейтрализация", - "req_id": "V1.3.11", - "req_description": "Убедитесь, что приложение нейтрализует вводимые пользователем данные перед передачей в почтовые системы для защиты от SMTP или IMAP-инъекций.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.3", - "section_name": "Нейтрализация", - "req_id": "V1.3.12", - "req_description": "Убедитесь, что регулярные выражения не содержат элементов, вызывающих экспоненциальный возврат, и убедитесь в нейтрализации недоверенных входных данных для предотвращения атак ReDoS или Runaway Regex.", - "L": "3" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.4", - "section_name": "Память, строки и неуправляемый код", - "req_id": "V1.4.1", - "req_description": "Убедитесь, что для обнаружения или предотвращения ситуаций переполнения стека, буфера или кучи приложение учитывает размер доступной области памяти при строковых операциях, копировании в память, в арифметике указателей и т.п.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.4", - "section_name": "Память, строки и неуправляемый код", - "req_id": "V1.4.2", - "req_description": "Убедитесь, что для предотвращения целочисленного переполнения применяется контроль знака, диапазона и типа допустимых входных данных.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.4", - "section_name": "Память, строки и неуправляемый код", - "req_id": "V1.4.3", - "req_description": "Убедитесь, что динамически выделенная память и ресурсы освобождены, а ссылки или указатели на освобожденную память удалены или установлены в значение null, чтобы предотвратить появление висячих указателей и уязвимостей, связанных с использованием памяти после освобождения.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.5", - "section_name": "Безопасная десериализация", - "req_id": "V1.5.1", - "req_description": "Убедитесь, что приложение настраивает XML-парсеры на использование строгой конфигурации и что небезопасные функции, такие как разрешение внешних сущностей, отключены для предотвращения атак XML eXternal Entity (XXE).", - "L": "1" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.5", - "section_name": "Безопасная десериализация", - "req_id": "V1.5.2", - "req_description": "Убедитесь, что десериализация недоверенных данных обеспечивает безопасную обработку ввода, например, используя список разрешенных типов объектов или ограничивая типы объектов, определяемые клиентом, для предотвращения атак десериализации. Механизмы десериализации, которые явно определены как небезопасные, не должны использоваться с недоверенным вводом.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.5", - "section_name": "Безопасная десериализация", - "req_id": "V1.5.3", - "req_description": "Убедитесь, что различные парсеры, используемые в приложении для одного и того же типа данных (например, парсеры JSON, XML, URL), выполняют парсинг согласованным образом и используют один и тот же механизм кодирования символов, чтобы избежать таких проблем, как уязвимости взаимодействия JSON (JSON Interoperability) или различное поведение анализа URI или файлов, которые могут использоваться в атаках удаленного включения файлов (RFI) или подделки запросов на стороне сервера (SSRF).", - "L": "3" - }, - { - "chapter_id": "V2", - "chapter_name": "Валидация и бизнес-логика", - "section_id": "V2.1", - "section_name": "Документация валидации и бизнес-логики", - "req_id": "V2.1.1", - "req_description": "Убедитесь, что в документации приложения определены правила проверки входных данных на соответствие ожидаемой структуре. Это могут быть распространённые форматы данных, такие как номера кредитных карт, адреса электронной почты, номера телефонов, или внутренний формат данных.", - "L": "1" - }, - { - "chapter_id": "V2", - "chapter_name": "Валидация и бизнес-логика", - "section_id": "V2.1", - "section_name": "Документация валидации и бизнес-логики", - "req_id": "V2.1.2", - "req_description": "Убедитесь, что в документации приложения указано, как проверять логическую и контекстную согласованность объединенных данных, например, проверять соответствие района и почтового индекса.", - "L": "2" - }, - { - "chapter_id": "V2", - "chapter_name": "Валидация и бизнес-логика", - "section_id": "V2.1", - "section_name": "Документация валидации и бизнес-логики", - "req_id": "V2.1.3", - "req_description": "Убедитесь, что ожидания относительно ограничений и проверок бизнес-логики задокументированы как для уровня отдельного пользователя, так и для глобального уровня всего приложения.", - "L": "2" - }, - { - "chapter_id": "V2", - "chapter_name": "Валидация и бизнес-логика", - "section_id": "V2.2", - "section_name": "Валидация ввода", - "req_id": "V2.2.1", - "req_description": "Убедитесь, что входные данные провалидированы для обеспечения соответствия бизнес- или функциональным ожиданиям. Валидация должна осуществляться либо по списку допустимых значений, шаблонов и диапазонов, либо путем сравнения входных данных с ожидаемой структурой и логическими ограничениями в соответствии с предопределенными правилами. Для L1 валидация может быть сосредоточена на входных данных, используемых для принятия конкретных бизнес-решений или решений, связанных с безопасностью. Для L2 и выше это должно применяться ко всем входным данным.", - "L": "1" - }, - { - "chapter_id": "V2", - "chapter_name": "Валидация и бизнес-логика", - "section_id": "V2.2", - "section_name": "Валидация ввода", - "req_id": "V2.2.2", - "req_description": "Убедитесь, что приложение разработано с принудительной валидацией входных данных на уровне доверенного сервиса. Хотя проверка на стороне клиента повышает удобство использования и должна поощряться, на неё не следует полагаться как на средство контроля безопасности.", - "L": "1" - }, - { - "chapter_id": "V2", - "chapter_name": "Валидация и бизнес-логика", - "section_id": "V2.2", - "section_name": "Валидация ввода", - "req_id": "V2.2.3", - "req_description": "Убедитесь, что приложение обеспечивает обоснованность комбинаций данных в соответствии с предопределенными правилам. Например: возраст должен соответствовать дате рождения; страна и почтовый индекс; количество товара в заказе и на складе.", - "L": "2" - }, - { - "chapter_id": "V2", - "chapter_name": "Валидация и бизнес-логика", - "section_id": "V2.3", - "section_name": "Безопасность бизнес-логики", - "req_id": "V2.3.1", - "req_description": "Убедитесь, что приложение обрабатывает потоки бизнес-логики для одного и того же пользователя в ожидаемом последовательном порядке шагов и без пропуска шагов.", - "L": "1" - }, - { - "chapter_id": "V2", - "chapter_name": "Валидация и бизнес-логика", - "section_id": "V2.3", - "section_name": "Безопасность бизнес-логики", - "req_id": "V2.3.2", - "req_description": "Убедитесь, что ограничения бизнес-логики реализованы в соответствии с документацией приложения, чтобы избежать эксплуатации её недостатков.", - "L": "2" - }, - { - "chapter_id": "V2", - "chapter_name": "Валидация и бизнес-логика", - "section_id": "V2.3", - "section_name": "Безопасность бизнес-логики", - "req_id": "V2.3.3", - "req_description": "Убедитесь, что транзакции используются на уровне бизнес-логики таким образом, что операция бизнес-логики либо выполняется полностью, либо откатывается к предыдущему корректному состоянию.", - "L": "2" - }, - { - "chapter_id": "V2", - "chapter_name": "Валидация и бизнес-логика", - "section_id": "V2.3", - "section_name": "Безопасность бизнес-логики", - "req_id": "V2.3.4", - "req_description": "Убедитесь, что на уровне бизнес-логики используются механизмы блокировки, чтобы гарантировать невозможность двойного бронирования ограниченных по количеству ресурсов (например, мест в театре или слотов доставки) путем манипулирования логикой приложения.", - "L": "2" - }, - { - "chapter_id": "V2", - "chapter_name": "Валидация и бизнес-логика", - "section_id": "V2.3", - "section_name": "Безопасность бизнес-логики", - "req_id": "V2.3.5", - "req_description": "Убедитесь, что для важных потоков бизнес-логики требуется многопользовательское (multi-user) одобрение, чтобы предотвратить несанкционированные или случайные действия. Потоки бизнес-логики могут включать, помимо прочего, крупные денежные переводы, утверждение контрактов, доступ к секретной информации или обход ограничений безопасности на производстве.", - "L": "3" - }, - { - "chapter_id": "V2", - "chapter_name": "Валидация и бизнес-логика", - "section_id": "V2.4", - "section_name": "Анти-автоматизация", - "req_id": "V2.4.1", - "req_description": "Убедитесь, что используются средства противодействия автоматизации для защиты от чрезмерных вызовов функций приложения, которые могут привести к утечке данных, созданию ненужных данных, исчерпанию квот, нарушению ограничений скорости, отказу в обслуживании или чрезмерному использованию дорогостоящих ресурсов.", - "L": "2" - }, - { - "chapter_id": "V2", - "chapter_name": "Валидация и бизнес-логика", - "section_id": "V2.4", - "section_name": "Анти-автоматизация", - "req_id": "V2.4.2", - "req_description": "Убедитесь, что потоки бизнес-логики требуют реалистичного человеческого времени, предотвращая чрезмерно быструю отправку транзакций.", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.1", - "section_name": "Документация по безопасности веб-интерфейса", - "req_id": "V3.1.1", - "req_description": "Убедитесь, что в документации приложения описаны ожидаемые функции безопасности, которые должны поддерживать браузеры, использующие приложение (такие как HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) и другие соответствующие механизмы безопасности HTTP). В документации также должно быть обязательно определено, как приложение должно себя вести, если некоторые из этих функций недоступны (например, предупреждать пользователя или блокировать доступ).", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.2", - "section_name": "Непреднамеренная интерпретация контента", - "req_id": "V3.2.1", - "req_description": "Убедитесь, что реализованы меры безопасности, предотвращающие отображение контента или функций браузерами в HTTP-ответах в некорректном контексте (например, запрос API, загруженный пользователем файл или другой ресурс запрашивается напрямую). Возможные способы контроля включают: не обрабатывать содержимое, если поля заголовка HTTP-запроса (например, Sec-Fetch-*) не указывают на корректность контекста; использование заголовка и значения Content-Security-Policy: sandbox directive; или использование заголовка и значения Content-Disposition: attachment.", - "L": "1" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.2", - "section_name": "Непреднамеренная интерпретация контента", - "req_id": "V3.2.2", - "req_description": "Убедитесь, что данные, предназначенные для отображения в виде текста, а не визуализации в виде HTML, обрабатывается с использованием безопасных функций визуализации (таких как createTextNode или textContent), чтобы предотвратить непреднамеренное выполнение содержимого, такого как HTML или JavaScript.", - "L": "1" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.2", - "section_name": "Непреднамеренная интерпретация контента", - "req_id": "V3.2.3", - "req_description": "Убедитесь, что приложение избегает затирания DOM при использовании JavaScript на стороне клиента, применяя явные объявления переменных, выполняя строгую проверку типов, избегая сохранения глобальных переменных в объекте документа и реализуя изоляцию пространства имен.", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.3", - "section_name": "Настройка файлов cookie", - "req_id": "V3.3.1", - "req_description": "Убедитесь, что у файлов cookie установлен атрибут «Secure», и если префикс «__Host‑» не используется в названии cookie, необходимо использовать префикс «__Secure‑».", - "L": "1" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.3", - "section_name": "Настройка файлов cookie", - "req_id": "V3.3.2", - "req_description": "Убедитесь, что значение атрибута SameSite каждой cookie установлено в соответствии с назначением cookie, чтобы ограничить подверженность атакам на восстановление пользовательского интерфейса и атакам с подделкой запросов на уровне браузера, обычно называемым подделкой межсайтовых запросов (CSRF).", - "L": "2" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.3", - "section_name": "Настройка файлов cookie", - "req_id": "V3.3.3", - "req_description": "Убедитесь, что cookie имеют префикс «__Host‑» в названии, если только они явно не предназначены для совместного использования с другими хостами.", - "L": "2" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.3", - "section_name": "Настройка файлов cookie", - "req_id": "V3.3.4", - "req_description": "Убедитесь, что если значение cookie не должно быть доступно для клиентских скриптов (например, сессионный токен), для cookie должен быть установлен атрибут «HttpOnly», а само значение должно передаваться клиенту только через поле заголовка «Set-Cookie».", - "L": "2" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.3", - "section_name": "Настройка файлов cookie", - "req_id": "V3.3.5", - "req_description": "Убедитесь, что при записи cookie приложением общая длина имени и значения cookie не превышает 4096 байт. Слишком большие cookie не будут сохраняться браузером и, следовательно, не будут отправляться с запросами, что помешает пользователю использовать функции приложения, зависящие от этого cookie.", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.4", - "section_name": "Заголовки механизма безопасности браузера", - "req_id": "V3.4.1", - "req_description": "Убедитесь, что поле заголовка Strict‑Transport‑Security включено во все ответы для реализации политики HTTP Strict Transport Security (HSTS). Необходимо указать максимальное время не менее 1 года, а для L2 и выше политика должна применяться также ко всем поддоменам.", - "L": "1" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.4", - "section_name": "Заголовки механизма безопасности браузера", - "req_id": "V3.4.2", - "req_description": "Убедитесь, что поле заголовка Cross‑Origin Resource Sharing (CORS) «Access‑Control‑Allow‑Origin» имеет фиксированное значение, заданное приложением, или, если используется заголовок Origin, оно проверяется по списку доверенных источников. При необходимости использования «Access‑Control‑Allow‑Origin: *» убедитесь, что ответ не содержит конфиденциальной информации.", - "L": "1" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.4", - "section_name": "Заголовки механизма безопасности браузера", - "req_id": "V3.4.3", - "req_description": "Убедитесь, что HTTP-ответы содержат поле заголовка Content-Security-Policy, которое определяет директивы, гарантирующие загрузку и выполнение браузером только доверенного контента или ресурсов, чтобы ограничить выполнение вредоносного JavaScript. Как минимум, необходимо использовать глобальную политику, включающую директивы object-src «none» и base-uri «none», а также определяющую список разрешенных адресов или использующую одноразовые коды или хэши. Для приложений L3 необходимо определить политику использования 'nonce' или hash-конструкций для каждого ответа.", - "L": "2" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.4", - "section_name": "Заголовки механизма безопасности браузера", - "req_id": "V3.4.4", - "req_description": "Убедитесь, что все HTTP-ответы содержат поле заголовка «X‑Content‑Type‑Options: nosniff». Это предписывает браузерам не использовать анализ контента и определение типа MIME для данного ответа, а также требовать, чтобы значение поля заголовка Content‑Type в ответе соответствовало целевому ресурсу. Например, ответ на запрос стиля принимается только в том случае, если Content‑Type в ответе — «text/css». Это также позволяет браузеру использовать функцию Cross‑Origin Read Blocking (CORB).", - "L": "2" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.4", - "section_name": "Заголовки механизма безопасности браузера", - "req_id": "V3.4.5", - "req_description": "Убедитесь, что приложение устанавливает политику реферера для предотвращения утечки технически конфиденциальных данных сторонним сервисам через поле заголовка HTTP-запроса «Referer». Это можно сделать с помощью поля заголовка HTTP-ответа «Referrer‑Policy» или через атрибуты HTML-элемента. Конфиденциальные данные могут включать путь и данные запроса в URL-адресе, а для внутренних непубличных приложений также имя хоста.", - "L": "2" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.4", - "section_name": "Заголовки механизма безопасности браузера", - "req_id": "V3.4.6", - "req_description": "Убедитесь, что веб-приложение использует директиву frame‑ancestors поля заголовка Content‑Security‑Policy для каждого HTTP-ответа, чтобы гарантировать невозможность его внедрения по умолчанию и внедрение определённых ресурсов разрешено только при необходимости. Обратите внимание, что поле заголовка X‑Frame‑Options, хотя и поддерживается браузерами, устарело и не может быть использовано в качестве основы.", - "L": "2" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.4", - "section_name": "Заголовки механизма безопасности браузера", - "req_id": "V3.4.7", - "req_description": "Убедитесь, что в поле заголовка Content‑Security‑Policy указано место, куда следует сообщать о нарушениях.", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.4", - "section_name": "Заголовки механизма безопасности браузера", - "req_id": "V3.4.8", - "req_description": "Убедитесь, что все HTTP-ответы, инициирующие рендеринг документа (например, ответы с типом содержимого text/html), включают поле заголовка Cross-Origin-Opener-Policy с директивой same-origin или same-origin-allow-popups (при необходимости). Это предотвращает атаки, злоупотребляющие общим доступом к объектам Window, такие как Tabnabbing и Frame Counting.", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.5", - "section_name": "Браузерное разделение источников", - "req_id": "V3.5.1", - "req_description": "Убедитесь, что, если приложение не использует механизм предварительной проверки CORS для предотвращения запрещённых кросс-доменных запросов на использование чувствительного функционала, эти запросы валидируются на предмет их происхождения от самого приложения. Это можно сделать, используя и проверяя специальные токены для защиты от подделки или требуя дополнительные поля HTTP-заголовка, не входящие в список «простых заголовков» (CORS-safelisted request-header). Это необходимо для защиты от атак с подделкой запросов через браузер, широко известных как межсайтовая подделка запросов (CSRF).", - "L": "1" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.5", - "section_name": "Браузерное разделение источников", - "req_id": "V3.5.2", - "req_description": "Убедитесь, что если приложение использует механизм предварительной проверки CORS для предотвращения неразрешённого использования чувствительного функционала между источниками, вызов этого функционала невозможен с помощью запроса, который не запускает предварительную проверку CORS. Для этого может потребоваться проверка значений полей заголовка запроса «Origin» и «Content-Type» или использование дополнительного поля заголовка, не входящего в безопасный список CORS.", - "L": "1" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.5", - "section_name": "Браузерное разделение источников", - "req_id": "V3.5.3", - "req_description": "Убедитесь, что HTTP-запросы к чувствительному функционалу используют соответствующие HTTP-методы, такие как POST, PUT, PATCH или DELETE, а не методы, определённые спецификацией HTTP как «безопасные», такие как HEAD, OPTIONS или GET. В качестве альтернативы можно использовать строгую валидацию полей заголовка запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, навигационного запроса или загрузки ресурса (например, источника изображения), где это не ожидается.", - "L": "1" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.5", - "section_name": "Браузерное разделение источников", - "req_id": "V3.5.4", - "req_description": "Убедитесь, что отдельные приложения размещены на разных именах хостов, чтобы использовать ограничения, предусмотренные политикой same-origin, включая то, как документы или скрипты, загруженные одним источником, могут взаимодействовать с ресурсами из другого источника, а также ограничения на cookie на основе имени хоста.", - "L": "2" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.5", - "section_name": "Браузерное разделение источников", - "req_id": "V3.5.5", - "req_description": "Убедитесь, что сообщения, полученные интерфейсом postMessage, отвергаются, если источник сообщения не является доверенным или если синтаксис сообщения недействителен.", - "L": "2" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.5", - "section_name": "Браузерное разделение источников", - "req_id": "V3.5.6", - "req_description": "Убедитесь, что функциональность JSONP не включена нигде в приложении, чтобы избежать атак с использованием межсайтового включения скриптов (XSSI).", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.5", - "section_name": "Браузерное разделение источников", - "req_id": "V3.5.7", - "req_description": "Убедитесь, что данные, требующие авторизации, не включены в ответы ресурсов скриптов, таких как файлы JavaScript, чтобы предотвратить атаки с использованием межсайтового включения скриптов (XSSI).", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.5", - "section_name": "Браузерное разделение источников", - "req_id": "V3.5.8", - "req_description": "Убедитесь, что аутентифицированные ресурсы (такие как изображения, видео, скрипты и другие документы) могут быть загружены или внедрены от имени пользователя только по назначению. Этого можно добиться путём строгой валидации полей заголовка HTTP-запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, или путём установки ограничительного поля заголовка HTTP-ответа Cross‑Origin‑Resource‑Policy, чтобы браузер блокировал возвращаемый контент.", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.6", - "section_name": "Целостность внешних ресурсов", - "req_id": "V3.6.1", - "req_description": "Убедитесь, что клиентские ресурсы, такие как библиотеки JavaScript, CSS или веб-шрифты, размещаются только на внешнем сервере (например, в сети доставки контента (Content Delivery Network)), если ресурс статический и имеет версии, а для проверки целостности ресурса используется механизм проверки целостности подресурсов (SRI). Если это невозможно, для каждого ресурса должно быть задокументировано решение по безопасности, обосновывающее это.", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.7", - "section_name": "Другие соображения по безопасности браузера", - "req_id": "V3.7.1", - "req_description": "Убедитесь, что приложение использует только те клиентские технологии, которые по-прежнему поддерживаются и считаются безопасными. Примерами технологий, не соответствующих этому требованию, являются плагины NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL или клиентские Java-апплеты.", - "L": "2" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.7", - "section_name": "Другие соображения по безопасности браузера", - "req_id": "V3.7.2", - "req_description": "Убедитесь, что приложение будет автоматически перенаправлять пользователя на другое имя хоста или домен (который не контролируется приложением), только если этот хост или домен указаны в списке разрешенных.", - "L": "2" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.7", - "section_name": "Другие соображения по безопасности браузера", - "req_id": "V3.7.3", - "req_description": "Убедитесь, что приложение отображает уведомление, что пользователь перенаправляется на URL-адрес, находящийся вне контроля приложения, с возможностью отмены навигации.", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.7", - "section_name": "Другие соображения по безопасности браузера", - "req_id": "V3.7.4", - "req_description": "Убедитесь, что домен верхнего уровня приложения (например, site.tld) ​​добавлен в публичный список предварительной загрузки (preload list) для HTTP Strict Transport Security (HSTS). Это гарантирует, что использование TLS для приложения будет встроено непосредственно в основные браузеры, а не будет полагаться только на поле заголовка ответа Strict-Transport-Security.", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.7", - "section_name": "Другие соображения по безопасности браузера", - "req_id": "V3.7.5", - "req_description": "Убедитесь, что приложение ведет себя так, как описано в документации (например, предупреждает пользователя или блокирует доступ), если браузер, используемый для доступа к приложению, не поддерживает ожидаемые функции безопасности.", - "L": "3" - }, - { - "chapter_id": "V4", - "chapter_name": "API и Веб-сервис", - "section_id": "V4.1", - "section_name": "Общая безопасность веб-сервисов", - "req_id": "V4.1.1", - "req_description": "Убедитесь, что каждый HTTP-ответ с телом сообщения содержит заголовок Content-Type, который соответствует фактическому содержимому ответа, таким как «text/», «/+xml» и «/xml», включая параметр charset для указания безопасной кодировки символов (например, UTF-8, ISO-8859-1) согласно IANA Media Types.", - "L": "1" - }, - { - "chapter_id": "V4", - "chapter_name": "API и Веб-сервис", - "section_id": "V4.1", - "section_name": "Общая безопасность веб-сервисов", - "req_id": "V4.1.2", - "req_description": "Убедитесь, что только конечные точки, предназначенные для взаимодействия с пользователем через веб-браузер, автоматически перенаправляют HTTP на HTTPS, в то время как другие сервисы или конечные точки не реализуют прозрачные редиректы. Это необходимо, чтобы избежать ситуации, когда клиент ошибочно отправляет незашифрованные HTTP-запросы а из-за того, что запрос по HTTP автоматически перенаправляется на HTTPS другим сервисом без обработки на входе, утечка чувствительных данных остаётся незамеченной.", - "L": "2" - }, - { - "chapter_id": "V4", - "chapter_name": "API и Веб-сервис", - "section_id": "V4.1", - "section_name": "Общая безопасность веб-сервисов", - "req_id": "V4.1.3", - "req_description": "Убедитесь, что любой HTTP-заголовок, используемый приложением и устанавливаемый промежуточным уровнем, таким как балансировщик нагрузки, веб-прокси или backend-for-frontend сервис, не может быть переопределён конечным пользователем. Примеры заголовков: X-Real-IP, X-Forwarded-*, X-User-ID.", - "L": "2" - }, - { - "chapter_id": "V4", - "chapter_name": "API и Веб-сервис", - "section_id": "V4.1", - "section_name": "Общая безопасность веб-сервисов", - "req_id": "V4.1.4", - "req_description": "Убедитесь, что разрешены только HTTP-методы, которые явно поддерживаются приложением или его API (включая OPTIONS для preflight-запросов), а неиспользуемые методы заблокированы.", - "L": "3" - }, - { - "chapter_id": "V4", - "chapter_name": "API и Веб-сервис", - "section_id": "V4.1", - "section_name": "Общая безопасность веб-сервисов", - "req_id": "V4.1.5", - "req_description": "Убедитесь, что для особо чувствительных запросов или транзакций, проходящих через несколько систем, используются цифровые подписи на уровне сообщений, дополнительно к транспортным средствам защиты.", - "L": "3" - }, - { - "chapter_id": "V4", - "chapter_name": "API и Веб-сервис", - "section_id": "V4.2", - "section_name": "Валидация структуры HTTP-сообщений", - "req_id": "V4.2.1", - "req_description": "Убедитесь, что все компоненты приложения (включая балансировщики нагрузки, файрволы и серверы приложений) определяют границы входящих HTTP-сообщений с использованием механизма, соответствующего версии HTTP, чтобы предотвратить HTTP request smuggling. В HTTP/1.x, если присутствует заголовок Transfer-Encoding, заголовок Content-Length должен игнорироваться согласно RFC 2616. При использовании HTTP/2 или HTTP/3, если присутствует Content-Length, веб-сервер должен убедиться, что он совпадает с длиной DATA-фреймов.", - "L": "2" - }, - { - "chapter_id": "V4", - "chapter_name": "API и Веб-сервис", - "section_id": "V4.2", - "section_name": "Валидация структуры HTTP-сообщений", - "req_id": "V4.2.2", - "req_description": "Убедитесь, что при генерации HTTP-сообщений заголовок Content-Length не конфликтует с длиной содержимого, определяемой рамками протокола HTTP, чтобы предотвратить HTTP Request Smuggling.", - "L": "3" - }, - { - "chapter_id": "V4", - "chapter_name": "API и Веб-сервис", - "section_id": "V4.2", - "section_name": "Валидация структуры HTTP-сообщений", - "req_id": "V4.2.3", - "req_description": "Убедитесь, что приложение не отправляет и не принимает HTTP/2 и HTTP/3 сообщения с заголовками, специфичными для соединения, такими как Transfer-Encoding, чтобы предотвратить HTTP Response Splitting и HTTP Header Injection.", - "L": "3" - }, - { - "chapter_id": "V4", - "chapter_name": "API и Веб-сервис", - "section_id": "V4.2", - "section_name": "Валидация структуры HTTP-сообщений", - "req_id": "V4.2.4", - "req_description": "Убедитесь, что приложение принимает HTTP/2 и HTTP/3 запросы только в случае, если поля заголовков и их значения не содержат последовательностей CR (\\r), LF (\\n) или CRLF (\\r\\n), чтобы предотвратить HTTP Header Injection.", - "L": "3" - }, - { - "chapter_id": "V4", - "chapter_name": "API и Веб-сервис", - "section_id": "V4.2", - "section_name": "Валидация структуры HTTP-сообщений", - "req_id": "V4.2.5", - "req_description": "Убедитесь, что если приложение (бекенд или фронтенд) формирует и отправляет запросы, оно использует валидацию, очистку или другие механизмы, чтобы не создавать URI (например, для API-вызовов) или HTTP-заголовки (например, Authorization или Cookie) слишком большой длины, чтобы их не принимал приёмник. Это может привести к отказу в обслуживании, например, при отправке слишком длинного запроса (длинный cookie-заголовок), из-за чего сервер постоянно возвращает ошибку.", - "L": "3" - }, - { - "chapter_id": "V4", - "chapter_name": "API и Веб-сервис", - "section_id": "V4.3", - "section_name": "GraphQL", - "req_id": "V4.3.1", - "req_description": "Убедитесь, что используется белый список запросов, ограничение глубины вложенности, ограничение количества или анализ стоимости запроса, чтобы предотвратить DoS-атаки на уровне GraphQL или слоя данных из-за дорогостоящих вложенных запросов.", - "L": "2" - }, - { - "chapter_id": "V4", - "chapter_name": "API и Веб-сервис", - "section_id": "V4.3", - "section_name": "GraphQL", - "req_id": "V4.3.2", - "req_description": "Убедитесь, что introspection-запросы GraphQL отключены в продакшен-среде, если GraphQL API не предназначен для использования сторонними клиентами.", - "L": "2" - }, - { - "chapter_id": "V4", - "chapter_name": "API и Веб-сервис", - "section_id": "V4.4", - "section_name": "WebSocket", - "req_id": "V4.4.1", - "req_description": "Убедитесь, что для всех WebSocket-соединений используется WebSocket поверх TLS (WSS).", - "L": "1" - }, - { - "chapter_id": "V4", - "chapter_name": "API и Веб-сервис", - "section_id": "V4.4", - "section_name": "WebSocket", - "req_id": "V4.4.2", - "req_description": "Убедитесь, что при первоначальном HTTP WebSocket handshake заголовок Origin проверяется на соответствие списку разрешённых источников для приложения.", - "L": "2" - }, - { - "chapter_id": "V4", - "chapter_name": "API и Веб-сервис", - "section_id": "V4.4", - "section_name": "WebSocket", - "req_id": "V4.4.3", - "req_description": "Убедитесь, что если стандартное управление сессиями приложения не может быть использовано, применяются специальные токены, соответствующие требованиям безопасности управления сессиями.", - "L": "2" - }, - { - "chapter_id": "V4", - "chapter_name": "API и Веб-сервис", - "section_id": "V4.4", - "section_name": "WebSocket", - "req_id": "V4.4.4", - "req_description": "Убедитесь, что специальные токены управления сессиями WebSocket изначально получаются или валидируются через ранее аутентифицированную HTTPS-сессию при переходе от HTTPS к WebSocket.", - "L": "2" - }, - { - "chapter_id": "V5", - "chapter_name": "Работа с файлами", - "section_id": "V5.1", - "section_name": "Документация по работе с файлами", - "req_id": "V5.1.1", - "req_description": "Убедитесь, что документация определяет допустимые типы файлов, ожидаемые расширения и максимальный размер (включая распакованный размер) для каждой функции загрузки. Также убедитесь, что в документации указано, как файлы обезвреживаются для конечных пользователей (например, как приложение ведёт себя при обнаружении вредоносного файла).", - "L": "2" - }, - { - "chapter_id": "V5", - "chapter_name": "Работа с файлами", - "section_id": "V5.2", - "section_name": "Загрузка файлов и содержимое", - "req_id": "V5.2.1", - "req_description": "Убедитесь, что приложение принимает только те файлы, которые может обработать без потери производительности или отказа в обслуживании.", - "L": "1" - }, - { - "chapter_id": "V5", - "chapter_name": "Работа с файлами", - "section_id": "V5.2", - "section_name": "Загрузка файлов и содержимое", - "req_id": "V5.2.2", - "req_description": "Убедитесь, что при загрузке файла (включая файлы внутри архивов, таких как ZIP) приложение проверяет, соответствует ли расширение ожидаемому, и валидирует, соответствует ли содержимое типу, указанному в расширении. Это включает проверку начальных 'magic bytes', перезапись изображений, использование специализированных библиотек. Для уровня 1 — достаточно проверок для файлов, критичных с точки зрения бизнеса или безопасности. Для уровней 2 и выше — для всех файлов.", - "L": "1" - }, - { - "chapter_id": "V5", - "chapter_name": "Работа с файлами", - "section_id": "V5.2", - "section_name": "Загрузка файлов и содержимое", - "req_id": "V5.2.3", - "req_description": "Убедитесь, что приложение проверяет архивы (например, zip, gz, docx, odt) на максимально допустимый распакованный размер и максимальное количество файлов до распаковки.", - "L": "2" - }, - { - "chapter_id": "V5", - "chapter_name": "Работа с файлами", - "section_id": "V5.2", - "section_name": "Загрузка файлов и содержимое", - "req_id": "V5.2.4", - "req_description": "Убедитесь, что для каждого пользователя установлены квоты на общий размер и количество файлов, чтобы один пользователь не мог переполнить хранилище.", - "L": "3" - }, - { - "chapter_id": "V5", - "chapter_name": "Работа с файлами", - "section_id": "V5.2", - "section_name": "Загрузка файлов и содержимое", - "req_id": "V5.2.5", - "req_description": "Убедитесь, что приложение не позволяет загружать архивы с символьными ссылками (symlinks), если это не требуется по бизнес-логике. Если требуется — разрешён только строго определённый список допустимых символьных ссылок.", - "L": "3" - }, - { - "chapter_id": "V5", - "chapter_name": "Работа с файлами", - "section_id": "V5.2", - "section_name": "Загрузка файлов и содержимое", - "req_id": "V5.2.6", - "req_description": "Убедитесь, что приложение отклоняет изображения с числом пикселей выше допустимого, чтобы предотвратить атаки 'pixel flood'.", - "L": "3" - }, - { - "chapter_id": "V5", - "chapter_name": "Работа с файлами", - "section_id": "V5.3", - "section_name": "Хранение файлов", - "req_id": "V5.3.1", - "req_description": "Убедитесь, что загруженные или сгенерированные из недоверенного ввода файлы, находящиеся в публичной директории, не исполняются как серверный код при обращении к ним по HTTP.", - "L": "1" - }, - { - "chapter_id": "V5", - "chapter_name": "Работа с файлами", - "section_id": "V5.3", - "section_name": "Хранение файлов", - "req_id": "V5.3.2", - "req_description": "Убедитесь, что при создании путей к файлам приложение использует внутренние или доверенные данные, а не пользовательские имена файлов. Если использование пользовательских имён или метаданных необходимо — требуется строгая проверка и очистка. Это защита от path traversal, LFI, RFI и SSRF.", - "L": "1" - }, - { - "chapter_id": "V5", - "chapter_name": "Работа с файлами", - "section_id": "V5.3", - "section_name": "Хранение файлов", - "req_id": "V5.3.3", - "req_description": "Убедитесь, что при обработке файлов на сервере (например, при распаковке) игнорируются пути, заданные пользователем, во избежание уязвимостей типа 'zip slip'.", - "L": "3" - }, - { - "chapter_id": "V5", - "chapter_name": "Работа с файлами", - "section_id": "V5.4", - "section_name": "Скачивание файлов", - "req_id": "V5.4.1", - "req_description": "Убедитесь, что приложение валидирует или игнорирует имена файлов, переданных пользователем (включая в JSON, JSONP или URL-параметре), и указывает имя файла в заголовке Content-Disposition при ответе.", - "L": "2" - }, - { - "chapter_id": "V5", - "chapter_name": "Работа с файлами", - "section_id": "V5.4", - "section_name": "Скачивание файлов", - "req_id": "V5.4.2", - "req_description": "Убедитесь, что имена файлов, передаваемые (например, в HTTP-заголовках или вложениях в email), кодируются или очищаются (например, по RFC 6266), чтобы сохранить структуру документа и предотвратить инъекции.", - "L": "2" - }, - { - "chapter_id": "V5", - "chapter_name": "Работа с файлами", - "section_id": "V5.4", - "section_name": "Скачивание файлов", - "req_id": "V5.4.3", - "req_description": "Убедитесь, что файлы, полученные из недоверенных источников, сканируются антивирусом, чтобы не распространять известное вредоносное содержимое.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.1", - "section_name": "Документация по аутентификации", - "req_id": "V6.1.1", - "req_description": "Убедитесь, что в документации приложения описано, как используются механизмы, такие как ограничение частоты запросов (rate limiting), защита от автоматизации и адаптивные реакции, для защиты от атак, таких как подстановка учётных данных и перебор паролей. Документация должна ясно описывать конфигурацию этих механизмов и предотвращение злонамеренной блокировки аккаунтов.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.1", - "section_name": "Документация по аутентификации", - "req_id": "V6.1.2", - "req_description": "Убедитесь, что задокументирован список контекстно-зависимых слов, запрещённых к использованию в паролях. В него могут входить производные от названий организаций, продуктов, идентификаторов систем, кодовых названий проектов, названий отделов или ролей и тому подобное.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.1", - "section_name": "Документация по аутентификации", - "req_id": "V6.1.3", - "req_description": "Убедитесь, что если приложение поддерживает несколько способов аутентификации, то все они документированы вместе с описанием применяемых средств защиты и уровнем стойкости аутентификации, которые должны быть одинаково применены ко всем способам.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.2", - "section_name": "Безопасность паролей", - "req_id": "V6.2.1", - "req_description": "Убедитесь, что пользовательские пароли содержат не менее 8 символов. Рекомендуется минимальная длина в 15 символов.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.2", - "section_name": "Безопасность паролей", - "req_id": "V6.2.2", - "req_description": "Убедитесь, что пользователи могут менять свои пароли.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.2", - "section_name": "Безопасность паролей", - "req_id": "V6.2.3", - "req_description": "Убедитесь, что для смены пароля требуется ввести как текущий, так и новый пароль.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.2", - "section_name": "Безопасность паролей", - "req_id": "V6.2.4", - "req_description": "Убедитесь, что при регистрации или смене пароля введённый пароль проверяется по списку как минимум из 3000 самых популярных паролей, соответствующих политике (например, минимальной длине).", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.2", - "section_name": "Безопасность паролей", - "req_id": "V6.2.5", - "req_description": "Убедитесь, что допускаются пароли любой структуры, без ограничений на использование определённых символов. Не должно быть требований по обязательному наличию заглавных/строчных букв, цифр или специальных символов.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.2", - "section_name": "Безопасность паролей", - "req_id": "V6.2.6", - "req_description": "Убедитесь, что поля ввода пароля используют type=password для скрытия символов. Разрешено временное отображение всего пароля или последнего введённого символа.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.2", - "section_name": "Безопасность паролей", - "req_id": "V6.2.7", - "req_description": "Убедитесь, что разрешены вставка (paste), использование менеджеров паролей браузера и внешних менеджеров паролей.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.2", - "section_name": "Безопасность паролей", - "req_id": "V6.2.8", - "req_description": "Убедитесь, что пароль проверяется строго в том виде, в котором он был введён пользователем — без обрезки, изменения регистра и других модификаций.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.2", - "section_name": "Безопасность паролей", - "req_id": "V6.2.9", - "req_description": "Убедитесь, что система позволяет использовать пароли длиной не менее 64 символов.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.2", - "section_name": "Безопасность паролей", - "req_id": "V6.2.10", - "req_description": "Убедитесь, что пароль остаётся действительным, пока не будет скомпрометирован или не будет изменён пользователем. Приложение не должно требовать регулярной смены пароля.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.2", - "section_name": "Безопасность паролей", - "req_id": "V6.2.11", - "req_description": "Убедитесь, что используется документированный список контекстно-зависимых слов (например, названия компаний, проектов и т.д.) для предотвращения использования легко угадываемых паролей.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.2", - "section_name": "Безопасность паролей", - "req_id": "V6.2.12", - "req_description": "Убедитесь, что при регистрации или смене пароля проверяется, не входит ли он в список скомпрометированных (утёкших) паролей.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.3", - "section_name": "Общие требования к безопасности аутентификации", - "req_id": "V6.3.1", - "req_description": "Убедитесь, что реализованы меры защиты от атак типа credential stuffing (массовая подстановка учётных данных) и brute-force (перебор паролей), согласно документации по безопасности приложения.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.3", - "section_name": "Общие требования к безопасности аутентификации", - "req_id": "V6.3.2", - "req_description": "Убедитесь, что в приложении отсутствуют или отключены учётные записи по умолчанию (например, root, admin, sa).", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.3", - "section_name": "Общие требования к безопасности аутентификации", - "req_id": "V6.3.3", - "req_description": "Убедитесь, что для доступа к приложению используется либо механизм многофакторной аутентификации, либо комбинация однофакторных. Для уровня L3 один из факторов должен быть аппаратным, обеспечивающим защиту от фишинга, устойчивость к компрометации и подтверждение намерения аутентификации через явное действие пользователя (например, нажатие кнопки на FIDO-ключе или телефоне). Ослабление этих требований допускается только при наличии обоснования и компенсирующих мер.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.3", - "section_name": "Общие требования к безопасности аутентификации", - "req_id": "V6.3.4", - "req_description": "Убедитесь, что при наличии нескольких способов аутентификации, они все задокументированы, и для них единообразно применяются меры защиты и уровни доверия.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.3", - "section_name": "Общие требования к безопасности аутентификации", - "req_id": "V6.3.5", - "req_description": "Убедитесь, что пользователи получают уведомления о подозрительных попытках аутентификации (удачных и неудачных). Это может включать попытки (например, подключения) с необычного устройства или места, частично успешную MFA, попытку после долгого отсутствия или успешную аутентификацию после серии неудачных.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.3", - "section_name": "Общие требования к безопасности аутентификации", - "req_id": "V6.3.6", - "req_description": "Убедитесь, что email не используется ни как однофакторный, ни как многофакторный механизм аутентификации.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.3", - "section_name": "Общие требования к безопасности аутентификации", - "req_id": "V6.3.7", - "req_description": "Убедитесь, что пользователи получают уведомление при изменении данных аутентификации, таких как сброс пароля или изменение логина/email.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.3", - "section_name": "Общие требования к безопасности аутентификации", - "req_id": "V6.3.8", - "req_description": "Убедитесь, что из сообщений об ошибке, HTTP-кодов ответа или различий во времени ответа нельзя определить, существует ли пользователь с таким логином. Это правило также должно применяться к функциям регистрации и восстановления пароля.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.4", - "section_name": "Жизненный цикл и восстановление факторов аутентификации", - "req_id": "V6.4.1", - "req_description": "Убедитесь, что начальные пароли или коды активации, генерируемые системой, создаются с использованием надёжного генератора случайных чисел, соответствуют текущей политике паролей и истекают через короткий период времени либо после первого использования. Эти секреты не должны использоваться как постоянные пароли.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.4", - "section_name": "Жизненный цикл и восстановление факторов аутентификации", - "req_id": "V6.4.2", - "req_description": "Убедитесь, что в системе отсутствуют подсказки к паролю или вопросы на знание («секретные вопросы»).", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.4", - "section_name": "Жизненный цикл и восстановление факторов аутентификации", - "req_id": "V6.4.3", - "req_description": "Убедитесь, что реализован безопасный процесс сброса забытого пароля, который не обходит активные механизмы многофакторной аутентификации.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.4", - "section_name": "Жизненный цикл и восстановление факторов аутентификации", - "req_id": "V6.4.4", - "req_description": "Убедитесь, что в случае утраты одного из факторов MFA проводится удостоверение личности (identity proofing) на том же уровне, что и при первичной регистрации.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.4", - "section_name": "Жизненный цикл и восстановление факторов аутентификации", - "req_id": "V6.4.5", - "req_description": "Убедитесь, что инструкции по обновлению истекающих механизмов аутентификации отправляются заранее, с достаточным запасом времени для выполнения замены, при необходимости с настройкой автоматических напоминаний.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.4", - "section_name": "Жизненный цикл и восстановление факторов аутентификации", - "req_id": "V6.4.6", - "req_description": "Убедитесь, что администраторы могут инициировать процесс сброса пароля, но не могут задать или выбрать новый пароль за пользователя. Это исключает ситуацию, при которой администратор знает пароль пользователя.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.5", - "section_name": "Общие требования к многофакторной аутентификации", - "req_id": "V6.5.1", - "req_description": "Убедитесь, что lookup-секреты, внеполосные коды/запросы и TOTP-коды можно использовать только один раз.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.5", - "section_name": "Общие требования к многофакторной аутентификации", - "req_id": "V6.5.2", - "req_description": "Убедитесь, что при хранении lookup-секретов с энтропией менее 112 бит (например, 19 случайных буквенно-цифровых символов или 34 случайные цифры) они хэшируются с использованием разрешённого алгоритма хеширования паролей и случайной соли минимум 32 бита. Если у секрета ≥112 бит энтропии — допустимо использовать стандартный хэш.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.5", - "section_name": "Общие требования к многофакторной аутентификации", - "req_id": "V6.5.3", - "req_description": "Убедитесь, что lookup-секреты, коды внеполосной аутентификации и сиды для TOTP генерируются с использованием криптографически стойкого генератора случайных чисел (CSPRNG), чтобы избежать предсказуемых значений.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.5", - "section_name": "Общие требования к многофакторной аутентификации", - "req_id": "V6.5.4", - "req_description": "Убедитесь, что lookup-секреты и внеполосные коды аутентификации имеют минимум 20 бит энтропии (достаточно, например, 4 случайных алфавитно-цифровых символов или 6 случайных цифр).", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.5", - "section_name": "Общие требования к многофакторной аутентификации", - "req_id": "V6.5.5", - "req_description": "Убедитесь, что все внеполосные запросы, коды и токены, а также TOTP-коды имеют ограниченный срок действия. Максимум для out-of-band — 10 минут, для TOTP — 30 секунд.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.5", - "section_name": "Общие требования к многофакторной аутентификации", - "req_id": "V6.5.6", - "req_description": "Убедитесь, что любой фактор аутентификации (включая физические устройства) может быть отозван в случае кражи или утери.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.5", - "section_name": "Общие требования к многофакторной аутентификации", - "req_id": "V6.5.7", - "req_description": "Убедитесь, что биометрические механизмы аутентификации используются только как вторичный фактор — в сочетании с «чем-то, что вы знаете» или «чем-то, что у вас есть».", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.5", - "section_name": "Общие требования к многофакторной аутентификации", - "req_id": "V6.5.8", - "req_description": "Убедитесь, что TOTP-коды проверяются по источнику времени, полученному от доверенного сервиса, а не от клиента или недоверенного источника.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.6", - "section_name": "Внеполосные механизмы аутентификации", - "req_id": "V6.6.1", - "req_description": "Убедитесь, что механизмы аутентификации через телефонную сеть общего пользования (PSTN) для доставки одноразовых паролей (OTP) по телефону или SMS используются только в случае предварительной валидации номера, при этом предлагаются альтернативные более безопасные методы (например, TOTP), и пользователю сообщаются риски. Для приложений уровня L3 использование телефона и SMS недопустимо.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.6", - "section_name": "Внеполосные механизмы аутентификации", - "req_id": "V6.6.2", - "req_description": "Убедитесь, что внеполосные запросы, коды или токены привязаны к исходному запросу аутентификации, для которого они были сгенерированы, и не могут быть использованы повторно для других попыток.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.6", - "section_name": "Внеполосные механизмы аутентификации", - "req_id": "V6.6.3", - "req_description": "Убедитесь, что внеполосные механизмы на основе кода защищены от атак методом подбора (brute force) путём применения ограничения частоты запросов (rate limiting). Также рекомендуется использовать коды с энтропией не менее 64 бит.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.6", - "section_name": "Внеполосные механизмы аутентификации", - "req_id": "V6.6.4", - "req_description": "Убедитесь, что при использовании push-уведомлений для MFA применяется ограничение частоты (rate limiting), чтобы предотвратить атаки push-бомбинга. Также может помочь механизм сопоставления номеров (number matching).", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.7", - "section_name": "Криптографические механизмы аутентификации", - "req_id": "V6.7.1", - "req_description": "Убедитесь, что сертификаты, используемые для проверки криптографических утверждений об аутентификации, хранятся таким образом, чтобы исключить возможность их модификации.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.7", - "section_name": "Криптографические механизмы аутентификации", - "req_id": "V6.7.2", - "req_description": "Убедитесь, что nonce (случайная строка), используемая в процессе вызова, имеет длину не менее 64 бит и является статистически уникальной или уникальной на протяжении всего срока службы криптографического устройства.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.8", - "section_name": "Аутентификация с использованием провайдера идентификаций (IdP)", - "req_id": "V6.8.1", - "req_description": "Убедитесь, что при поддержке несколькими IdP, невозможно подделать личность пользователя через другой IdP (например, с тем же user ID). Стандартным способом защиты является регистрация пользователя с использованием сочетания ID самого IdP (в качестве пространства имён) и пользовательского ID внутри IdP.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.8", - "section_name": "Аутентификация с использованием провайдера идентификаций (IdP)", - "req_id": "V6.8.2", - "req_description": "Убедитесь, что наличие и целостность цифровой подписи в утверждениях аутентификации (например, в JWT или SAML) всегда проверяются, а неподписанные или недействительные утверждения отклоняются.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.8", - "section_name": "Аутентификация с использованием провайдера идентификаций (IdP)", - "req_id": "V6.8.3", - "req_description": "Убедитесь, что SAML-утверждения обрабатываются только один раз в течение периода их действия, чтобы исключить атаки воспроизведения (replay attacks).", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.8", - "section_name": "Аутентификация с использованием провайдера идентификаций (IdP)", - "req_id": "V6.8.4", - "req_description": "Убедитесь, что если приложение использует внешний поставщик идентификации (IdP) и для определенных функций требуется особый уровень, метод или срок действия аутентификации, то приложение использует данные, возвращаемые IdP, для проверки этих условий. Например, при использовании OIDC можно проверить значения полей ID Token — acr, amr, auth_time (если они есть). Если IdP не предоставляет эти данные, приложение должно иметь документированный план действий по умолчанию, предполагающий использование минимально допустимой силы аутентификации (например, одноступенчатая — логин и пароль).", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.1", - "section_name": "Документация по управлению сессиями", - "req_id": "V7.1.1", - "req_description": "Убедитесь, что тайм-аут бездействия и абсолютное максимальное время жизни сессии задокументированы, соответствуют другим контрольным мерам и сопровождаются обоснованием любых отклонений от требований повторной аутентификации NIST SP 800-63B.", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.1", - "section_name": "Документация по управлению сессиями", - "req_id": "V7.1.2", - "req_description": "Убедитесь, что документация определяет допустимое количество одновременных (параллельных) сессий для одного аккаунта, а также поведение системы и действия при достижении этого лимита.", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.1", - "section_name": "Документация по управлению сессиями", - "req_id": "V7.1.3", - "req_description": "Убедитесь, что все системы, создающие и управляющие сессиями пользователей в рамках федеративной идентификации (например, SSO), задокументированы вместе с механизмами координации сроков действия сессий, условий завершения и случаев, требующих повторной аутентификации.", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.2", - "section_name": "Базовая безопасность сессий", - "req_id": "V7.2.1", - "req_description": "Убедитесь, что все проверки сессионных токенов выполняются на доверенной серверной стороне.", - "L": "1" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.2", - "section_name": "Базовая безопасность сессий", - "req_id": "V7.2.2", - "req_description": "Убедитесь, что приложение использует либо автономные токены, либо ссылочные токены, которые генерируются динамически, не используя статические API-секреты или ключи.", - "L": "1" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.2", - "section_name": "Базовая безопасность сессий", - "req_id": "V7.2.3", - "req_description": "Убедитесь, что ссылочные токены являются уникальными, создаются с использованием криптографически безопасного генератора псевдослучайных чисел (CSPRNG) и обладают энтропией не менее 128 бит.", - "L": "1" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.2", - "section_name": "Базовая безопасность сессий", - "req_id": "V7.2.4", - "req_description": "Убедитесь, что при аутентификации пользователя (включая повторную) создается новый токен сессии, а текущий — аннулируется.", - "L": "1" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.3", - "section_name": "Тайм-ауты сессии", - "req_id": "V7.3.1", - "req_description": "Убедитесь, что есть тайм-аут бездействия, после которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.3", - "section_name": "Тайм-ауты сессии", - "req_id": "V7.3.2", - "req_description": "Убедитесь, что установлено абсолютное максимальное время жизни сессии, по истечении которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.4", - "section_name": "Завершение сессий", - "req_id": "V7.4.1", - "req_description": "Убедитесь, что после завершения сессии (logout, истечение срока) дальнейшее её использование невозможно. Для ссылочных токенов или сессий с сохранением состояния это означает аннулирование на сервере. Для self-contained токенов необходимо реализовать механизм отзыва, например, список отозванных токенов, проверку времени выпуска или ротацию ключей подписи для каждого пользователя.", - "L": "1" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.4", - "section_name": "Завершение сессий", - "req_id": "V7.4.2", - "req_description": "Убедитесь, что при удалении или отключении пользователя все активные сессии немедленно завершаются.", - "L": "1" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.4", - "section_name": "Завершение сессий", - "req_id": "V7.4.3", - "req_description": "Убедитесь, что после изменения или удаления факторов аутентификации (например, смена пароля или MFA) приложение предлагает завершить все другие активные сессии.", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.4", - "section_name": "Завершение сессий", - "req_id": "V7.4.4", - "req_description": "Убедитесь, что на всех страницах, требующих аутентификации, имеется простой и видимый способ выхода.", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.4", - "section_name": "Завершение сессий", - "req_id": "V7.4.5", - "req_description": "Убедитесь, что администраторы могут завершать активные сессии конкретного пользователя или всех пользователей.", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.5", - "section_name": "Защита от злоупотреблений сессией", - "req_id": "V7.5.1", - "req_description": "Убедитесь, что приложение требует полной повторной аутентификации перед изменением чувствительных атрибутов аккаунта, которые могут влиять на аутентификацию (например, email, номер телефона, настройки MFA или данных восстановления доступа).", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.5", - "section_name": "Защита от злоупотреблений сессией", - "req_id": "V7.5.2", - "req_description": "Убедитесь, что пользователь может просматривать и (после повторной аутентификации хотя бы по одному фактору) завершать активные сессии.", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.5", - "section_name": "Защита от злоупотреблений сессией", - "req_id": "V7.5.3", - "req_description": "Убедитесь, что перед выполнением критически важных операций приложение требует повторной аутентификации (по крайней мере, одного фактора) или дополнительной проверки.", - "L": "3" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.6", - "section_name": "Федеративная повторная аутентификация", - "req_id": "V7.6.1", - "req_description": "Убедитесь, что срок действия и завершение сессий между RP и IdP соответствуют документации и включают повторную аутентификацию, если достигнут максимальный допустимый интервал между событиями аутентификации.", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.6", - "section_name": "Федеративная повторная аутентификация", - "req_id": "V7.6.2", - "req_description": "Убедитесь, что создание сессии требует согласия пользователя или явного действия, предотвращающего несанкционированное создание сессий без участия пользователя.", - "L": "2" - }, - { - "chapter_id": "V8", - "chapter_name": "Авторизация", - "section_id": "V8.1", - "section_name": "Документация по авторизации", - "req_id": "V8.1.1", - "req_description": "Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне функций и на уровне данных на основе прав субъекта и атрибутов ресурса.", - "L": "1" - }, - { - "chapter_id": "V8", - "chapter_name": "Авторизация", - "section_id": "V8.1", - "section_name": "Документация по авторизации", - "req_id": "V8.1.2", - "req_description": "Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне полей (как на чтение, так и на запись) на основе прав субъекта и атрибутов ресурса. Эти правила могут зависеть от других атрибутов объекта данных, например, статуса.", - "L": "2" - }, - { - "chapter_id": "V8", - "chapter_name": "Авторизация", - "section_id": "V8.1", - "section_name": "Документация по авторизации", - "req_id": "V8.1.3", - "req_description": "Убедитесь, что документация определяет, какие атрибуты окружения и контекста (например, время суток, IP-адрес, местоположение, устройство) используются приложением для принятия решений в области аутентификации и авторизации.", - "L": "3" - }, - { - "chapter_id": "V8", - "chapter_name": "Авторизация", - "section_id": "V8.1", - "section_name": "Документация по авторизации", - "req_id": "V8.1.4", - "req_description": "Убедитесь, что документация по аутентификации и авторизации определяет, как используются факторы окружения и контекста в принятии решений, наряду с правилами доступа к функциям, данным и полям. Документация должна содержать оцениваемые атрибуты, пороговые значения риска, действия (разрешить, отказать, повысить уровень аутентификации и др.).", - "L": "3" - }, - { - "chapter_id": "V8", - "chapter_name": "Авторизация", - "section_id": "V8.2", - "section_name": "Архитектура авторизации", - "req_id": "V8.2.1", - "req_description": "Убедитесь, что приложение обеспечивает доступ на уровне функций (function-level) только субъектам с явными разрешениями.", - "L": "1" - }, - { - "chapter_id": "V8", - "chapter_name": "Авторизация", - "section_id": "V8.2", - "section_name": "Архитектура авторизации", - "req_id": "V8.2.2", - "req_description": "Убедитесь, что приложение обеспечивает доступ на уровне данных (data-specific) только тем субъектам, которым явно предоставлены права к определённым элементам данных, чтобы предотвратить IDOR (Insecure Direct Object Reference) и BOLA-уязвимости (Broken Object Level Authorization).", - "L": "1" - }, - { - "chapter_id": "V8", - "chapter_name": "Авторизация", - "section_id": "V8.2", - "section_name": "Архитектура авторизации", - "req_id": "V8.2.3", - "req_description": "Убедитесь, что приложение обеспечивает доступ на уровне полей (field-level) только тем субъектам, которым явно предоставлены права к определённым полям, чтобы предотвратить BOPLA (Broken Object Property Level Authorization).", - "L": "2" - }, - { - "chapter_id": "V8", - "chapter_name": "Авторизация", - "section_id": "V8.2", - "section_name": "Архитектура авторизации", - "req_id": "V8.2.4", - "req_description": "Убедитесь, что реализованы адаптивные меры безопасности, основанные на атрибутах окружения и контекста субъекта (время, местоположение, IP, устройство), которые используются для принятия решений об аутентификации и авторизации, как это определено в документации приложения. Эти меры должны применяться как при попытке субъекта начать новую сессию, так и во время существующей сессии.", - "L": "3" - }, - { - "chapter_id": "V8", - "chapter_name": "Авторизация", - "section_id": "V8.3", - "section_name": "Авторизация на уровне операций", - "req_id": "V8.3.1", - "req_description": "Убедитесь, что правила авторизации реализуются на доверенном сервисном уровне и не зависят от элементов, которые может контролировать клиент (например, JavaScript на стороне клиента).", - "L": "1" - }, - { - "chapter_id": "V8", - "chapter_name": "Авторизация", - "section_id": "V8.3", - "section_name": "Авторизация на уровне операций", - "req_id": "V8.3.2", - "req_description": "Убедитесь, что изменения значений, влияющих на авторизацию, применяются немедленно. Если это невозможно (например, при использовании автономных токенов), должны быть реализованы компенсирующие меры: оповещения о попытке несанкционированного действия и откат изменений. Обратите внимание, что данный подход не предотвращает утечку информации.", - "L": "3" - }, - { - "chapter_id": "V8", - "chapter_name": "Авторизация", - "section_id": "V8.3", - "section_name": "Авторизация на уровне операций", - "req_id": "V8.3.3", - "req_description": "Убедитесь, что доступ к объекту осуществляется на основе прав субъекта, инициировавшего запрос, а не прав промежуточного сервиса, действующего от его имени. Например, если пользователь обращается к веб-сервису с автономным токеном для аутентификации, а сервис затем запрашивает данные у другого сервиса, второй сервис должен использовать токен пользователя, а не токен первого сервиса для принятия решения о доступе.", - "L": "3" - }, - { - "chapter_id": "V8", - "chapter_name": "Авторизация", - "section_id": "V8.4", - "section_name": "Прочие аспекты авторизации", - "req_id": "V8.4.1", - "req_description": "Убедитесь, что в мультитенантных приложениях реализованы механизмы, предотвращающие действия потребителя в отношении арендаторов, к которым у него нет доступа.", - "L": "2" - }, - { - "chapter_id": "V8", - "chapter_name": "Авторизация", - "section_id": "V8.4", - "section_name": "Прочие аспекты авторизации", - "req_id": "V8.4.2", - "req_description": "Убедитесь, что доступ к административным интерфейсам защищён несколькими уровнями контроля, включая непрерывную проверку личности, контроль защищённости устройства и анализ контекстных рисков. Недостаточно опираться только на IP-адрес или доверенные устройства.", - "L": "3" - }, - { - "chapter_id": "V9", - "chapter_name": "Автономные токены", - "section_id": "V9.1", - "section_name": "Источник токена и его целостность", - "req_id": "V9.1.1", - "req_description": "Убедитесь, что автономные токены проверяются на целостность с помощью цифровой подписи или MAC, прежде чем доверять их содержимому.", - "L": "1" - }, - { - "chapter_id": "V9", - "chapter_name": "Автономные токены", - "section_id": "V9.1", - "section_name": "Источник токена и его целостность", - "req_id": "V9.1.2", - "req_description": "Проверяйте, что автономные токены создаются и проверяются исключительно с помощью алгоритмов из списка допустимых в данном контексте. Список допустимых алгоритмов должен включать только разрешенные алгоритмы (желательно либо только симметричные, либо только асимметричные) и ни в коем случае не содержать алгоритм None. Если необходимо поддерживать оба типа алгоритмов, потребуются дополнительные средства контроля для предотвращения путаницы с ключами (key confusion).", - "L": "1" - }, - { - "chapter_id": "V9", - "chapter_name": "Автономные токены", - "section_id": "V9.1", - "section_name": "Источник токена и его целостность", - "req_id": "V9.1.3", - "req_description": "Убедитесь, что ключи, используемые для проверки автономных токенов, получены из доверенных, предварительно настроенных источников. Это предотвращает возможность указания злоумышленниками ненадёжных источников и ключей. Для JWT и других JWS структур заголовки 'jku', 'x5u' и 'jwk' должны проверяться по белому списку.", - "L": "1" - }, - { - "chapter_id": "V9", - "chapter_name": "Автономные токены", - "section_id": "V9.2", - "section_name": "Содержимое токена", - "req_id": "V9.2.1", - "req_description": "Убедитесь, что при указанном сроке действия токен и его содержимое принимаются только в том случае, если срок действия токена не истёк. Например, для JWT нужно проверить поля 'nbf' и 'exp'.", - "L": "1" - }, - { - "chapter_id": "V9", - "chapter_name": "Автономные токены", - "section_id": "V9.2", - "section_name": "Содержимое токена", - "req_id": "V9.2.2", - "req_description": "Убедитесь, что сервис, принимающий токен, проверяет его тип и соответствие назначению перед обработкой содержимого токена. Например, для принятия решений об авторизации могут быть приняты только Access Token, а для подтверждения аутентификации пользователя — только ID Token.", - "L": "2" - }, - { - "chapter_id": "V9", - "chapter_name": "Автономные токены", - "section_id": "V9.2", - "section_name": "Содержимое токена", - "req_id": "V9.2.3", - "req_description": "Убедитесь, что сервис принимает только токены, предназначенные для использования с этим сервисом (audience). Для JWT это можно сделать, проверив наличие утверждения «aud» по белому списку, определенному в сервисе.", - "L": "2" - }, - { - "chapter_id": "V9", - "chapter_name": "Автономные токены", - "section_id": "V9.2", - "section_name": "Содержимое токена", - "req_id": "V9.2.4", - "req_description": "Убедитесь, что, если эмитент токенов использует один и тот же закрытый ключ для выпуска токенов различным сервисам (audiences), выпущенные токены содержат явное указание целевых сервисов. Это предотвратит повторное использования токенов в не предназначенных для них сервисах. Если идентификатор сервиса (audience identifier) назначается динамически, эмитент токенов должен проверить audiences для исключения подмены получателей (audience impersonation).", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.1", - "section_name": "Общие требования безопасности OAuth и OIDC", - "req_id": "V10.1.1", - "req_description": "Убедитесь, что токены передаются только тем компонентам, которым они действительно необходимы. Например, при использовании схемы backend-for-frontend для браузерных JavaScript-приложений, access и refresh токены должны быть доступны только на backend.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.1", - "section_name": "Общие требования безопасности OAuth и OIDC", - "req_id": "V10.1.2", - "req_description": "Убедитесь, что клиент принимает значения от авторизационного сервера (например, authorization code или ID Token) только если они получены в результате авторизационного потока, инициированного в той же сессии пользовательского агента и в рамках той же транзакции. Для этого клиентские секреты, такие как proof key для code exchange (PKCE) — 'code_verifier', 'state' или OIDC 'nonce' — должны быть непредсказуемыми, специфичными для транзакции и надежно привязанными как к клиенту, так и к сессии пользовательского агента, в которой началась транзакция.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.2", - "section_name": "Клиент OAuth", - "req_id": "V10.2.1", - "req_description": "Убедитесь, что если используется механизм authorization code flow, OAuth клиент защищён от CSRF, вызывающих запросы токенов либо за счёт использования механизма proof key for code exchange (PKCE), либо за счёт проверки параметра 'state', который был отправлен в запросе авторизации.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.2", - "section_name": "Клиент OAuth", - "req_id": "V10.2.2", - "req_description": "Убедитесь, что если OAuth клиент может взаимодействовать с более чем одним сервером авторизации, у него есть защита от атак смешивания (mix-up attacks). Например, клиент должен требовать, чтобы сервер авторизации возвращал параметр 'iss' и проверять его в ответах на авторизацию и токены.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.2", - "section_name": "Клиент OAuth", - "req_id": "V10.2.3", - "req_description": "Убедитесь, что OAuth клиент запрашивает только необходимые области доступа (scopes) или другие параметры авторизации в запросах к серверу авторизации.", - "L": "3" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.3", - "section_name": "Сервер ресурсов OAuth", - "req_id": "V10.3.1", - "req_description": "Убедитесь, что сервер ресурсов принимает только те access токены, которые предназначены для использования с этим сервисом (свойство audience). Эта принадлежность сервису может быть включена в структурированный access токен (например, в поле 'aud' в JWT) или проверяться через endpoint интроспекции токена.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.3", - "section_name": "Сервер ресурсов OAuth", - "req_id": "V10.3.2", - "req_description": "Убедитесь, что сервер ресурсов принимает решения по авторизации на основе claims из access токена, определяющих делегированную авторизацию. Если присутствуют claims, такие как 'sub', 'scope' и 'authorization_details', они должны участвовать в принятии решения.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.3", - "section_name": "Сервер ресурсов OAuth", - "req_id": "V10.3.3", - "req_description": "Убедитесь, что если для принятия решения по контролю доступа необходимо однозначно идентифицировать пользователя из access токена (JWT или ответа интроспекции), сервер ресурсов использует claims, которые не могут быть переприсвоены другим пользователям. Обычно это комбинация claims 'iss' и 'sub'.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.3", - "section_name": "Сервер ресурсов OAuth", - "req_id": "V10.3.4", - "req_description": "Убедитесь, что если сервер ресурсов требует определённой силы аутентификации, методов или свежести аутентификации, он проверяет, что предъявленный access токен удовлетворяет этим требованиям. Например, при наличии, могут использоваться claims OIDC 'acr', 'amr' и 'auth_time'.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.3", - "section_name": "Сервер ресурсов OAuth", - "req_id": "V10.3.5", - "req_description": "Убедитесь, что сервер ресурсов предотвращает использование украденных access токенов или их повторное использование (replay) неавторизованными лицами, требуя access токены с подтверждением отправителя — например, Mutual TLS для OAuth 2 или OAuth 2 Demonstration of Proof of Possession (DPoP).", - "L": "3" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.4", - "section_name": "Сервер авторизации OAuth", - "req_id": "V10.4.1", - "req_description": "Убедитесь, что сервер авторизации проверяет URI перенаправления (redirect URI), сверяя его с заранее зарегистрированным списком разрешённых URI для данного клиента (allowlist), используя точное сравнение строк.", - "L": "1" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.4", - "section_name": "Сервер авторизации OAuth", - "req_id": "V10.4.2", - "req_description": "Убедитесь, что если сервер авторизации возвращает authorization code в ответе авторизации, этот код может быть использован только один раз для запроса токена. При втором валидном запросе с уже использованным кодом сервер должен отклонить запрос и отозвать любые токены, связанные с этим кодом.", - "L": "1" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.4", - "section_name": "Сервер авторизации OAuth", - "req_id": "V10.4.3", - "req_description": "Убедитесь, что authorization code имеет короткое время жизни. Максимальная продолжительность — до 10 минут для приложений L1 и L2 и до 1 минуты для приложений L3.", - "L": "1" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.4", - "section_name": "Сервер авторизации OAuth", - "req_id": "V10.4.4", - "req_description": "Убедитесь, что сервер авторизации для конкретного клиента разрешает использование только тех типов авторизации, которые необходимы этому клиенту. Обратите внимание, что тип авторизации Implicit flow и Resource Owner Password Credentials flow больше не должны использоваться.", - "L": "1" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.4", - "section_name": "Сервер авторизации OAuth", - "req_id": "V10.4.5", - "req_description": "Убедитесь, что сервер авторизации предотвращает атаки повторного использования refresh токенов для публичных клиентов, предпочтительно используя sender-constrained refresh токены, такие как DPoP или сертификат-связанные токены с mutual TLS (mTLS). Для L1 и L2 допускается ротация refresh токенов с обязательной их инвалидацией после использования. Если используется ротация, сервер должен отозвать все refresh токены при попытке использовать уже инвалидированный токен.", - "L": "1" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.4", - "section_name": "Сервер авторизации OAuth", - "req_id": "V10.4.6", - "req_description": "Убедитесь, что при использовании типа авторизации «Authorization Code» сервер предотвращает атаки перехвата authorization code, требуя Proof Key for Code Exchange (PKCE). В запросах авторизации сервер должен требовать валидное значение 'code_challenge' и не принимать 'code_challenge_method' со значением 'plain'. В запросах токена обязательно валидировать параметр 'code_verifier'.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.4", - "section_name": "Сервер авторизации OAuth", - "req_id": "V10.4.7", - "req_description": "Убедитесь, что если сервер авторизации поддерживает динамическую регистрацию клиентов без аутентификации, он минимизирует риски вредоносных клиентов. Сервер должен валидировать метаданные клиента (например, зарегистрированные URI), обеспечивать согласие пользователя и предупреждать пользователя перед обработкой запроса авторизации от недоверенного клиента.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.4", - "section_name": "Сервер авторизации OAuth", - "req_id": "V10.4.8", - "req_description": "Убедитесь, что refresh токены имеют абсолютный срок действия, включая случаи, когда применяется скользящее время истечения срока.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.4", - "section_name": "Сервер авторизации OAuth", - "req_id": "V10.4.9", - "req_description": "Убедитесь, что пользователи могут отзывать refresh токены и reference access токены через пользовательский интерфейс сервера авторизации для снижения риска от вредоносных клиентов или кражи токенов.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.4", - "section_name": "Сервер авторизации OAuth", - "req_id": "V10.4.10", - "req_description": "Убедитесь, что конфиденциальный клиент аутентифицируется при взаимодействии с сервером авторизации через backchannel, например при запросах токена, pushed authorization requests (PAR) и запросах на отзыв токенов.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.4", - "section_name": "Сервер авторизации OAuth", - "req_id": "V10.4.11", - "req_description": "Убедитесь, что конфигурация сервера авторизации назначает OAuth клиенту только необходимые области доступа (scopes).", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.4", - "section_name": "Сервер авторизации OAuth", - "req_id": "V10.4.12", - "req_description": "Убедитесь, что для конкретного клиента сервер авторизации разрешает только те значения 'response_mode', которые необходимы этому клиенту. Например, сервер должен валидировать это значение против ожидаемых или использовать pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).", - "L": "3" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.4", - "section_name": "Сервер авторизации OAuth", - "req_id": "V10.4.13", - "req_description": "Убедитесь, что грант типа 'code' всегда используется вместе с pushed authorization requests (PAR).", - "L": "3" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.4", - "section_name": "Сервер авторизации OAuth", - "req_id": "V10.4.14", - "req_description": "Убедитесь, что сервер авторизации выдаёт только sender-constrained (Proof-of-Possession) access токены, либо с сертификат-связанными токенами через mutual TLS (mTLS), либо DPoP-bound токены (Demonstration of Proof of Possession).", - "L": "3" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.4", - "section_name": "Сервер авторизации OAuth", - "req_id": "V10.4.15", - "req_description": "Убедитесь, что для серверного клиента (не выполняющегося на устройстве конечного пользователя) сервер авторизации проверяет, что значение параметра 'authorization_details' исходит из клиентского backend и что пользователь не изменял его. Например, это достигается использованием pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).", - "L": "3" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.4", - "section_name": "Сервер авторизации OAuth", - "req_id": "V10.4.16", - "req_description": "Убедитесь, что клиент является конфиденциальным и сервер авторизации требует использования сильных методов аутентификации клиента (основанных на криптографии с открытым ключом и устойчивых к атакам повторного воспроизведения), таких как mutual TLS ('tls_client_auth', 'self_signed_tls_client_auth') или private key JWT ('private_key_jwt').", - "L": "3" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.5", - "section_name": "Клиент OIDC", - "req_id": "V10.5.1", - "req_description": "Убедитесь, что клиент (relying party) защищается от повторного использования ID Token (replay-атак). Например, это достигается проверкой того, что значение 'nonce' в ID Token совпадает со значением 'nonce', отправленным в запросе аутентификации провайдеру OpenID (authorization server).", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.5", - "section_name": "Клиент OIDC", - "req_id": "V10.5.2", - "req_description": "Убедитесь, что клиент однозначно идентифицирует пользователя по утверждениям (claims) ID Token, обычно это 'sub', который не может быть переназначен другому пользователю (в пределах конкретного провайдера идентификации).", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.5", - "section_name": "Клиент OIDC", - "req_id": "V10.5.3", - "req_description": "Убедитесь, что клиент отклоняет попытки злоумышленного сервера авторизации выдавать себя за другой сервер авторизации через метаданные сервера авторизации. Клиент должен отклонить метаданные, если URL издателя (issuer) в метаданных не совпадает точно с преднастроенным URL издателя, ожидаемым клиентом.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.5", - "section_name": "Клиент OIDC", - "req_id": "V10.5.4", - "req_description": "Убедитесь, что клиент проверяет, что ID Token предназначен для него (проверка audience), сравнивая значение 'aud' в токене с 'client_id' клиента.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.5", - "section_name": "Клиент OIDC", - "req_id": "V10.5.5", - "req_description": "Убедитесь, что при использовании OIDC back-channel logout клиент снижает риск отказа в обслуживании, вызванный принудительным выходом из системы и путаницей между разными типами JWT (cross-JWT confusion) в процессе логаута. Клиент должен проверить, что токен выхода корректно типизирован со значением 'logout+jwt', содержит claim 'event' с правильным именем участника и не содержит 'nonce'. Также рекомендуется установить короткий срок действия токена (например, 2 минуты).", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.6", - "section_name": "Провайдер OpenID", - "req_id": "V10.6.1", - "req_description": "Убедитесь, что провайдер OpenID допускает только значения 'code', 'ciba', 'id_token' или 'id_token code' для параметра response mode. При этом предпочтение отдаётся 'code' по сравнению с 'id_token code' (гибридный поток OIDC), а значение 'token' (любой Implicit flow) не должно использоваться.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.6", - "section_name": "Провайдер OpenID", - "req_id": "V10.6.2", - "req_description": "Убедитесь, что провайдер OpenID предотвращает отказ в обслуживании (DoS) через принудительный выход (logout), запрашивая явное подтверждение от конечного пользователя или, если применимо, проверяя параметры в запросе выхода (инициированном relying party), например параметр 'id_token_hint'.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.7", - "section_name": "Управление согласием", - "req_id": "V10.7.1", - "req_description": "Убедитесь, что авторизационный сервер обеспечивает получение согласия пользователя для каждого запроса авторизации. Если личность клиента не может быть подтверждена, сервер авторизации всегда должен явно запрашивать согласие пользователя.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.7", - "section_name": "Управление согласием", - "req_id": "V10.7.2", - "req_description": "Убедитесь, что при запросе согласия пользователя авторизационный сервер предоставляет достаточную и понятную информацию о том, на что даётся согласие. При необходимости это должно включать характер запрашиваемых разрешений (обычно основанных на scope, ресурсном сервере, деталях авторизации Rich Authorization Requests (RAR)), идентификацию авторизованного приложения и срок действия этих разрешений.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.7", - "section_name": "Управление согласием", - "req_id": "V10.7.3", - "req_description": "Убедитесь, что пользователь может просматривать, изменять и отзывать согласия, которые он предоставил, через авторизационный сервер.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.1", - "section_name": "Инвентаризация и документирование криптографии", - "req_id": "V11.1.1", - "req_description": "Убедитесь, что задокументирована политика управления криптографическими ключами и описан их жизненный цикл в соответствии со стандартом управления ключей, таким как NIST SP 800-57. Убедитесь, что ключи известны только тем сущностям, которым они должны быть доступны (например, ключи не передавались более чем двум участникам для общих секретов и более чем одному участнику для приватных ключей).", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.1", - "section_name": "Инвентаризация и документирование криптографии", - "req_id": "V11.1.2", - "req_description": "Убедитесь, что проводится инвентаризация криптографических средств, которая непрерывно поддерживается, регулярно обновляется и включает все криптографические ключи, алгоритмы и сертификаты, используемые в приложении. Также должна быть задокументирована информация о том, где ключи могут и не могут использоваться в системе, а также какие типы данных могут и не могут быть защищены с помощью этих ключей.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.1", - "section_name": "Инвентаризация и документирование криптографии", - "req_id": "V11.1.3", - "req_description": "Убедитесь, что используются механизмы обнаружения криптографии для идентификации всех случаев применения криптографии в системе , включая операции шифрования, хеширования и цифровой подписи.", - "L": "3" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.1", - "section_name": "Инвентаризация и документирование криптографии", - "req_id": "V11.1.4", - "req_description": "Убедитесь, что ведётся и поддерживается инвентаризация криптографических средств. В неё должен входить документированный план, описывающий переход на новые криптографические стандарты, такие как постквантовая криптография, чтобы своевременно реагировать на будущие угрозы.", - "L": "3" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.2", - "section_name": "Безопасная реализация криптографии", - "req_id": "V11.2.1", - "req_description": "Убедитесь, что для криптографических операций используются утвержденные в индустрии реализации (включая библиотеки и аппаратные реализации).", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.2", - "section_name": "Безопасная реализация криптографии", - "req_id": "V11.2.2", - "req_description": "Убедитесь, что архитектура приложения поддерживает быструю реконфигурацию, усовершенствование или смену в любой момент случайных чисел, аутентифицированного шифрования, MAC, алгоритмов хеширования, длин ключей, количества раундов, шифров и режимов шифрования для защиты от криптографических атак. Также должна поддерживаться возможность смены ключей, паролей и повторного шифрования данных. Это позволит беспрепятственно перейти на постквантовую криптографию (PQC), как только станут широко доступны высоконадёжные реализации одобренных схем или стандартов PQC.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.2", - "section_name": "Безопасная реализация криптографии", - "req_id": "V11.2.3", - "req_description": "Убедитесь, что все криптографические примитивы используют как минимум 128-бит стойкости с учетом алгоритма, размера ключа и конфигурации. Например, 256-битный ECC ключ обеспечивает примерно 128 бит безопасности, тогда как для достижения того же уровня безопасности в RSA требуется ключ длиной 3072 бита.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.2", - "section_name": "Безопасная реализация криптографии", - "req_id": "V11.2.4", - "req_description": "Убедитесь, что все криптографические операции выполняются за константное время, без использования «short-circuit» операций в сравнениях, вычислениях, возвратах функций для избежания утечек информации.", - "L": "3" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.2", - "section_name": "Безопасная реализация криптографии", - "req_id": "V11.2.5", - "req_description": "Убедитесь, что все криптографические модули обеспечивают безопасное завершение работы при ошибках, а обработка ошибок реализована таким образом, чтобы не создавать уязвимостей, например, таких как атаки Padding Oracle.", - "L": "3" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.3", - "section_name": "Алгоритмы шифрования", - "req_id": "V11.3.1", - "req_description": "Убедитесь, что не используются небезопасные режимы блочного шифрования (н-р, ECB) и слабые схемы дополнения (padding) (н-р, PKCS#1 v1.5).", - "L": "1" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.3", - "section_name": "Алгоритмы шифрования", - "req_id": "V11.3.2", - "req_description": "Убедитесь, что используются только утверждённые шифры и режимы, такие как AES с GCM.", - "L": "1" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.3", - "section_name": "Алгоритмы шифрования", - "req_id": "V11.3.3", - "req_description": "Убедитесь, что зашифрованные данные защищены от несанкционированного изменения, предпочтительно с использованием утверждённого метода аутентифицированного шифрования или путём комбинирования утверждённого метода шифрования с утверждённым алгоритмом MAC.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.3", - "section_name": "Алгоритмы шифрования", - "req_id": "V11.3.4", - "req_description": "Убедитесь, что случайные числа (nonce), векторы инициализации (IV) и другие одноразовые числа не используются более одного раза для одной и той же пары ключа шифрования и элемента данных. Метод их генерации должен соответствовать требованиям используемого алгоритма.", - "L": "3" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.3", - "section_name": "Алгоритмы шифрования", - "req_id": "V11.3.5", - "req_description": "Убедитесь, что любая комбинация алгоритма шифрования и алгоритма MAC работает в режиме encrypt-then-MAC (EtM).", - "L": "3" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.4", - "section_name": "Хеширование и функции на основе хеширования", - "req_id": "V11.4.1", - "req_description": "Убедитесь, что только утвержденные хэш-функции используются для стандартных сценариев использования в криптографии, включая цифровую подпись, HMAC, KDF, генерацию случайных чисел. Запрещено использовать неустойчивые хэш-функции, (н-р, MD5) для любого использования в криптографии.", - "L": "1" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.4", - "section_name": "Хеширование и функции на основе хеширования", - "req_id": "V11.4.2", - "req_description": "Убедитесь, что пароли хранятся с использованием утверждённой, вычислительно затратной функции генерации ключа (также известной как «функция хеширования паролей»), с параметрами, настроенными в соответствии с актуальными рекомендациями. Настройки должны обеспечивать баланс между безопасностью и производительностью, чтобы сделать атаки перебором достаточно сложными для требуемого уровня безопасности.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.4", - "section_name": "Хеширование и функции на основе хеширования", - "req_id": "V11.4.3", - "req_description": "Убедитесь, что хэш-функции, используемые в формировании цифровой подписи, как часть аутентификации и целостности данных, устойчивы к коллизиям и имеют достаточную длину.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.4", - "section_name": "Хеширование и функции на основе хеширования", - "req_id": "V11.4.4", - "req_description": "Убедитесь, что приложение использует утвержденную функцию генерации ключа с использованием параметров расширения ключа (key stretching) при генерации ключа из пароля. Параметры должны быть сбалансированы с точки зрения безопасности, производительности и устойчивости к атакам полного перебора при компрометации результирующего криптографического ключа.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.5", - "section_name": "Случайные значения", - "req_id": "V11.5.1", - "req_description": "Убедитесь, что все случайные числа и строки, которые должны быть непредсказуемы, должны быть сгенерированы с помощью CSPRNG и иметь хотя бы 128 бит энтропии. Учтите, что UUID не удовлетворяют данному условию.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.5", - "section_name": "Случайные значения", - "req_id": "V11.5.2", - "req_description": "Убедитесь, что механизм генерации случайных чисел является надежным даже при высокой нагрузке.", - "L": "3" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.6", - "section_name": "Криптография с публичным ключом", - "req_id": "V11.6.1", - "req_description": "Убедитесь, что только утвержденные криптографические алгоритмы и режимы операций используются для генерации ключа и инициализации случайного значения для его генерации (seeding), а также для генерации цифровой подписи и верификации. Алгоритмы генерации ключей не должны генерировать небезопасные ключи уязвимые к известным атакам, например, ключи RSA уязвимы к факторизации Ферма.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.6", - "section_name": "Криптография с публичным ключом", - "req_id": "V11.6.2", - "req_description": "Убедитесь, что для обмена ключами используются утверждённые криптографические алгоритмы (например, Диффи-Хеллман) с особым вниманием к обеспечению использования безопасных параметров. Это предотвратит атаки на процесс установления ключа, которые могут привести к атакам «человек посередине» или криптографическим взломам.", - "L": "3" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.7", - "section_name": "Шифрование данных в процессе использования", - "req_id": "V11.7.1", - "req_description": "Убедитесь, что используется полное шифрование памяти, которое защищает конфиденциальные данные во время их использования, предотвращая доступ к ним неавторизованных пользователей или процессов.", - "L": "3" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.7", - "section_name": "Шифрование данных в процессе использования", - "req_id": "V11.7.2", - "req_description": "Убедитесь, что минимизация данных обеспечивает раскрытие минимально необходимого объёма данных во время обработки, а также что данные шифруются сразу после использования или как можно скорее.", - "L": "3" - }, - { - "chapter_id": "V12", - "chapter_name": "Безопасная коммуникация", - "section_id": "V12.1", - "section_name": "Общие рекомендации по безопасности TLS", - "req_id": "V12.1.1", - "req_description": "Убедитесь, что включены только актуальные и рекомендуемые версии протокола TLS, такие как TLS 1.2 и TLS 1.3. Наиболее свежая версия TLS должна быть выбрана как предпочтительная.", - "L": "1" - }, - { - "chapter_id": "V12", - "chapter_name": "Безопасная коммуникация", - "section_id": "V12.1", - "section_name": "Общие рекомендации по безопасности TLS", - "req_id": "V12.1.2", - "req_description": "Убедитесь, что включены рекомендуемые шифронаборы (cipher suites), предпочтение также стоит отдать самому сильному шифронабору. L3 приложения должны поддерживать только те наборы шифров (cipher suites), которые обеспечивают прямую (forward) секретность. Пояснение: Прямая секретность (Forward Secrecy, FS) — это криптографическая особенность, при которой сессионные ключи уникальны для каждой сессии и не зависят от долгосрочных ключей. Это гарантирует, что даже при компрометации долгосрочного ключа злоумышленник не сможет расшифровать ранее перехваченные зашифрованные сессии.", - "L": "2" - }, - { - "chapter_id": "V12", - "chapter_name": "Безопасная коммуникация", - "section_id": "V12.1", - "section_name": "Общие рекомендации по безопасности TLS", - "req_id": "V12.1.3", - "req_description": "Убедитесь, что приложение проверяет доверенность клиентских сертификатов mTLS, прежде чем использовать идентификацию по сертификату для аутентификации или авторизации.", - "L": "2" - }, - { - "chapter_id": "V12", - "chapter_name": "Безопасная коммуникация", - "section_id": "V12.1", - "section_name": "Общие рекомендации по безопасности TLS", - "req_id": "V12.1.4", - "req_description": "Убедитесь, что включена и настроена правильная проверка отзыва сертификатов, такая как Online Certificate Status Protocol (OCSP) Stapling.", - "L": "3" - }, - { - "chapter_id": "V12", - "chapter_name": "Безопасная коммуникация", - "section_id": "V12.1", - "section_name": "Общие рекомендации по безопасности TLS", - "req_id": "V12.1.5", - "req_description": "Убедитесь, что в настройках TLS приложения включена функция Encrypted Client Hello (ECH) для предотвращения раскрытия конфиденциальных метаданных, таких как Server Name Indication (SNI), во время процесса TLS-рукопожатия.", - "L": "3" - }, - { - "chapter_id": "V12", - "chapter_name": "Безопасная коммуникация", - "section_id": "V12.2", - "section_name": "HTTPS коммуникация с внешними сервисами", - "req_id": "V12.2.1", - "req_description": "Убедитесь, что для всех соединений между клиентом и внешними HTTP-сервисами используется TLS и не происходит отката к небезопасным или незашифрованным протоколам.", - "L": "1" - }, - { - "chapter_id": "V12", - "chapter_name": "Безопасная коммуникация", - "section_id": "V12.2", - "section_name": "HTTPS коммуникация с внешними сервисами", - "req_id": "V12.2.2", - "req_description": "Убедитесь, что внешние сервисы используют публично доверенные TLS-сертификаты.", - "L": "1" - }, - { - "chapter_id": "V12", - "chapter_name": "Безопасная коммуникация", - "section_id": "V12.3", - "section_name": "Общая безопасность межсервисного взаимодействия", - "req_id": "V12.3.1", - "req_description": "Убедитесь, что для всех входящих и исходящих соединений приложения используется зашифрованный протокол, например TLS, включая системы мониторинга, инструменты управления, удалённый доступ и SSH, промежуточное ПО, базы данных, мейнфреймы, партнёрские системы и внешние API. Сервер не должен допускать откат к небезопасным или незашифрованным протоколам.", - "L": "2" - }, - { - "chapter_id": "V12", - "chapter_name": "Безопасная коммуникация", - "section_id": "V12.3", - "section_name": "Общая безопасность межсервисного взаимодействия", - "req_id": "V12.3.2", - "req_description": "Убедитесь, что TLS-клиент проверяет сертификат сервера до установления защищенного соединения с TLS-сервером.", - "L": "2" - }, - { - "chapter_id": "V12", - "chapter_name": "Безопасная коммуникация", - "section_id": "V12.3", - "section_name": "Общая безопасность межсервисного взаимодействия", - "req_id": "V12.3.3", - "req_description": "Убедитесь, что все внутренние HTTP-взаимодействия между компонентами приложения используют TLS или другой подходящий механизм транспортного шифрования, и не происходит откат к небезопасным или незашифрованным коммуникациям.", - "L": "2" - }, - { - "chapter_id": "V12", - "chapter_name": "Безопасная коммуникация", - "section_id": "V12.3", - "section_name": "Общая безопасность межсервисного взаимодействия", - "req_id": "V12.3.4", - "req_description": "Убедитесь, что TLS-соединения между внутренними сервисами используют доверенные сертификаты. Если используются внутренние или самоподписанные сертификаты, потребляющий сервис должен быть настроен на доверие только к конкретным внутренним центрам сертификации (CA) и конкретным самоподписанным сертификатам.", - "L": "2" - }, - { - "chapter_id": "V12", - "chapter_name": "Безопасная коммуникация", - "section_id": "V12.3", - "section_name": "Общая безопасность межсервисного взаимодействия", - "req_id": "V12.3.5", - "req_description": "Убедитесь, что сервисы, взаимодействующие внутри системы (intra-service communications), используют строгую аутентификацию для проверки каждого конечного узла. Для проверки подлинности взаимодействующих сторон должны применяться методы строгой аутентификации, такие как аутентификация TLS-клиента, с использованием инфраструктуры открытых ключей и механизмов, устойчивых к атакам повтора (replay attacks). Для микросервисных архитектур рекомендуется использование service mesh для упрощения управления сертификатами и повышения безопасности.", - "L": "3" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.1", - "section_name": "Документация конфигурации", - "req_id": "V13.1.1", - "req_description": "Убедитесь, что все необходимые доступы приложения задокументированы. Сюда должны быть включены как внешние сервисы, от которых зависит приложение, так и сценарии, когда конечный пользователь может задавать адреса для внешнего подключения.", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.1", - "section_name": "Документация конфигурации", - "req_id": "V13.1.2", - "req_description": "Убедитесь, что для каждого сервиса, используемого приложением, в документации определено максимальное количество одновременных соединений (например, лимиты пула соединений) и описано поведение приложения при достижении этого лимита, включая любые механизмы отказоустойчивости или восстановления, чтобы предотвратить ситуации отказа в обслуживании (DoS).", - "L": "3" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.1", - "section_name": "Документация конфигурации", - "req_id": "V13.1.3", - "req_description": "Убедитесь, что в документации приложения определены стратегии управления ресурсами для каждой внешней системы или сервиса, которые оно использует (например, базы данных, файловые дескрипторы, потоки, HTTP-соединения). Стратегии должны включать процедуры освобождения ресурсов, настройки таймаутов, обработку сбоев, а также, если реализована логика повторных попыток, указание лимитов, задержек и алгоритмов back-off. Для синхронных HTTP-запросов должны быть заданы короткие таймауты, а повторные запросы должны быть отключены, либо строго ограничены по числу попыток, чтобы предотвратить каскадные задержки и истощение ресурсов.", - "L": "3" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.1", - "section_name": "Документация конфигурации", - "req_id": "V13.1.4", - "req_description": "Убедитесь, что в документации приложения определены секреты, критически важные для безопасности приложения, а также установлен график их ротации в соответствии с моделью угроз организации и её бизнес-требованиями.", - "L": "3" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.2", - "section_name": "Конфигурация бэкенд соединений", - "req_id": "V13.2.1", - "req_description": "Убедитесь, что коммуникации между компонентами бэкенда приложения (включая API, промежуточное ПО и уровни данных), которые не поддерживают стандартный механизм пользовательских сессий, проходят с аутентификацией. Аутентификация должна использовать индивидуальные сервисные аккаунты, краткосрочные токены или аутентификацию на основе сертификатов, а не постоянные учётные данные, такие как пароли, API-ключи или общие аккаунты с привилегированным доступом.", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.2", - "section_name": "Конфигурация бэкенд соединений", - "req_id": "V13.2.2", - "req_description": "Убедитесь, что коммуникации между компонентами бэкенда приложения, включая локальные или системные службы, API, промежуточное ПО и уровни данных, выполняются с использованием аккаунтов, которым назначены минимально необходимые привилегии.", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.2", - "section_name": "Конфигурация бэкенд соединений", - "req_id": "V13.2.3", - "req_description": "Убедитесь, что если для аутентификации в сервисе используются учётные данные, то используемые потребителем учётные данные не являются стандартными (например, root/root или admin/admin).", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.2", - "section_name": "Конфигурация бэкенд соединений", - "req_id": "V13.2.4", - "req_description": "Убедитесь, что используется белый список (allowlist) для определения внешних ресурсов или систем, с которыми приложению разрешено взаимодействовать (например, для исходящих запросов, загрузки данных или доступа к файлам). Этот белый список может быть реализован на уровне приложения, веб-сервера, межсетевого экрана или комбинации различных уровней.", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.2", - "section_name": "Конфигурация бэкенд соединений", - "req_id": "V13.2.5", - "req_description": "Убедитесь, что веб- или прикладной сервер настроен с белым списком ресурсов или систем, к которым сервер может отправлять запросы или из которых может загружать данные и файлы.", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.2", - "section_name": "Конфигурация бэкенд соединений", - "req_id": "V13.2.6", - "req_description": "Убедитесь, что при подключении приложения к другим сервисам соблюдается задокументированная конфигурация для каждого соединения, включая максимальное количество параллельных соединений, поведение при достижении их максимума, таймауты и стратегии повторных попыток подключения.", - "L": "3" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.3", - "section_name": "Управление секретами", - "req_id": "V13.3.1", - "req_description": "Убедитесь, что для безопасного создания, хранения, контроля доступа и уничтожения секретов бэкенда используется решение для управления секретами, например, хранилище ключей (key vault). Секретами могут быть пароли, ключевой материал, интеграции с базами данных и сторонними системами, ключи и seed-значения для токенов с ограниченным временем действия, другие внутренние секреты и API-ключи. Секреты не должны включаться в исходный код приложения или артефакты сборки. Для приложений уровня L3 необходимо использовать аппаратное решение, например, аппаратный модуль безопасности (HSM).", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.3", - "section_name": "Управление секретами", - "req_id": "V13.3.2", - "req_description": "Убедитесь, что доступ к секретным ресурсам осуществляется в соответствии с принципом минимально необходимых привилегий (least privilege).", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.3", - "section_name": "Управление секретами", - "req_id": "V13.3.3", - "req_description": "Убедитесь, что все криптографические операции выполняются с использованием изолированного модуля безопасности (например, хранилища ключей или аппаратного модуля безопасности), чтобы надежно управлять ключевым материалом и защищать его от утечки за пределы модуля безопасности.", - "L": "3" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.3", - "section_name": "Управление секретами", - "req_id": "V13.3.4", - "req_description": "Убедитесь, что секреты настроены на срок действия и ротацию в соответствии с документацией приложения.", - "L": "3" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.4", - "section_name": "Непреднамеренная утечка информации", - "req_id": "V13.4.1", - "req_description": "Убедитесь, что приложение развернуто либо без метаданных систем контроля версий (включая папки .git или .svn), либо так, чтобы эти папки были недоступны как извне, так и для самого приложения.", - "L": "1" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.4", - "section_name": "Непреднамеренная утечка информации", - "req_id": "V13.4.2", - "req_description": "Убедитесь, что режимы отладки отключены для всех компонентов в промышленной среде, чтобы предотвратить раскрытие функций отладки и утечку информации.", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.4", - "section_name": "Непреднамеренная утечка информации", - "req_id": "V13.4.3", - "req_description": "Убедитесь, что веб-серверы не показывают клиентам списки содержимого каталогов, если это явно не предусмотрено.", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.4", - "section_name": "Непреднамеренная утечка информации", - "req_id": "V13.4.4", - "req_description": "Убедитесь, что метод HTTP TRACE не поддерживается в продуктовой среде, чтобы избежать потенциальной утечки информации.", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.4", - "section_name": "Непреднамеренная утечка информации", - "req_id": "V13.4.5", - "req_description": "Убедитесь, что документация (например, по внутренним API) и мониторинговые эндпоинты не доступны, если это явно не предусмотрено.", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.4", - "section_name": "Непреднамеренная утечка информации", - "req_id": "V13.4.6", - "req_description": "Убедитесь, что приложение не раскрывает подробную информацию о версиях компонентов бэкенда.", - "L": "3" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.4", - "section_name": "Непреднамеренная утечка информации", - "req_id": "V13.4.7", - "req_description": "Убедитесь, что веб-слой настроен на обслуживание только файлов с определёнными расширениями, чтобы предотвратить непреднамеренную утечку информации, конфигураций и исходного кода.", - "L": "3" - }, - { - "chapter_id": "V14", - "chapter_name": "Защита информации", - "section_id": "V14.1", - "section_name": "Документация по защите информации", - "req_id": "V14.1.1", - "req_description": "Убедитесь, что все конфиденциальные данные, создаваемые и обрабатываемые приложением, идентифицированы и классифицированы по уровням защиты. Включая закодированные данные, которые легко декодируются, например, строки Base64 или незашифрованные данные в полезной нагрузке JWT. Уровни защиты должны учитывать требования по защите данных и конфиденциальности, которым должно соответствовать приложение.", - "L": "2" - }, - { - "chapter_id": "V14", - "chapter_name": "Защита информации", - "section_id": "V14.1", - "section_name": "Документация по защите информации", - "req_id": "V14.1.2", - "req_description": "Убедитесь, что для каждого уровня защиты конфиденциальных данных требования к защите задокументированы. Они должны включать (но не ограничиваться) требования по шифрованию, проверке целостности, срокам хранения, способам логирования данных, контролю доступа к чувствительным данным в логах, шифрованию на уровне базы данных, применению технологий повышения конфиденциальности, а также другим требованиям по конфиденциальности.", - "L": "2" - }, - { - "chapter_id": "V14", - "chapter_name": "Защита информации", - "section_id": "V14.2", - "section_name": "Базовые меры по защите информации", - "req_id": "V14.2.1", - "req_description": "Убедитесь, что конфиденциальные данные передаются на сервер только в теле HTTP-запроса или в заголовках. URL и строка запроса не должны содержать конфиденциальную информацию, такую как API-ключ или сессионный токен.", - "L": "1" - }, - { - "chapter_id": "V14", - "chapter_name": "Защита информации", - "section_id": "V14.2", - "section_name": "Базовые меры по защите информации", - "req_id": "V14.2.2", - "req_description": "Убедитесь, что приложение предотвращает кэширование конфиденциальных данных в серверных компонентах, таких как балансировщики нагрузки и кэши приложений, либо гарантирует их надежное удаление после использования.", - "L": "2" - }, - { - "chapter_id": "V14", - "chapter_name": "Защита информации", - "section_id": "V14.2", - "section_name": "Базовые меры по защите информации", - "req_id": "V14.2.3", - "req_description": "Убедитесь, что заранее определённые конфиденциальные данные не отправляются ненадёжным сторонам (например, системам трекинга пользователей), чтобы предотвратить нежелательный сбор данных вне контроля приложения.", - "L": "2" - }, - { - "chapter_id": "V14", - "chapter_name": "Защита информации", - "section_id": "V14.2", - "section_name": "Базовые меры по защите информации", - "req_id": "V14.2.4", - "req_description": "Убедитесь, что для конфиденциальных данных реализованы меры по шифрованию, проверке целостности, срокам хранения, способам логирования, контролю доступа к данным в логах, а также применяются технологии повышения конфиденциальности в соответствии с документацией для соответствующего уровня защиты данных.", - "L": "2" - }, - { - "chapter_id": "V14", - "chapter_name": "Защита информации", - "section_id": "V14.2", - "section_name": "Базовые меры по защите информации", - "req_id": "V14.2.5", - "req_description": "Убедитесь, что механизмы кэширования настроены так, чтобы кэшировать только ответы с ожидаемым типом содержимого для данного ресурса и не содержать конфиденциального динамического контента. При обращении к несуществующему файлу, веб-сервер должен возвращать ответ 404 или 302, а не подменять на другой существующий файл, что позволит предотвратить атаки типа Web Cache Deception.", - "L": "3" - }, - { - "chapter_id": "V14", - "chapter_name": "Защита информации", - "section_id": "V14.2", - "section_name": "Базовые меры по защите информации", - "req_id": "V14.2.6", - "req_description": "Убедитесь, что приложение возвращает только минимально необходимый объем конфиденциальных данных для выполнения своей функциональности. Например, показывает только часть цифр номера кредитной карты, а не полный номер. Если требуется отображение полных данных, они должны быть замаскированы в пользовательском интерфейсе, пока пользователь специально не запросил их просмотр.", - "L": "3" - }, - { - "chapter_id": "V14", - "chapter_name": "Защита информации", - "section_id": "V14.2", - "section_name": "Базовые меры по защите информации", - "req_id": "V14.2.7", - "req_description": "Убедитесь, что конфиденциальная информация подлежит классификации по срокам хранения, чтобы устаревшие или ненужные данные удалялись автоматически, по расписанию или по мере необходимости.", - "L": "3" - }, - { - "chapter_id": "V14", - "chapter_name": "Защита информации", - "section_id": "V14.2", - "section_name": "Базовые меры по защите информации", - "req_id": "V14.2.8", - "req_description": "Убедитесь, что конфиденциальная информация удаляется из метаданных файлов, загружаемых пользователями, если пользователь явно не согласился на ее хранение.", - "L": "3" - }, - { - "chapter_id": "V14", - "chapter_name": "Защита информации", - "section_id": "V14.3", - "section_name": "Защита данных на стороне клиента", - "req_id": "V14.3.1", - "req_description": "Убедитесь, что аутентифицированные данные очищаются из клиентского хранилища, например, из DOM браузера, после завершения работы клиента или сессии. Заголовок HTTP-ответа Clear-Site-Data может помочь в этом, но клиентская сторона также должна уметь очищать данные, если соединение с сервером недоступно при завершении сессии.", - "L": "1" - }, - { - "chapter_id": "V14", - "chapter_name": "Защита информации", - "section_id": "V14.3", - "section_name": "Защита данных на стороне клиента", - "req_id": "V14.3.2", - "req_description": "Убедитесь, что приложение устанавливает HTTP-заголовки, достаточные для предотвращения кэширования (например, Cache-Control: no-store), чтобы конфиденциальные данные не сохранялись в браузерах.", - "L": "2" - }, - { - "chapter_id": "V14", - "chapter_name": "Защита информации", - "section_id": "V14.3", - "section_name": "Защита данных на стороне клиента", - "req_id": "V14.3.3", - "req_description": "Убедитесь, что данные, хранящиеся в браузерном хранилище (например, localStorage, sessionStorage, IndexedDB или cookie), не содержат конфиденциальной информации, за исключением сессионных токенов.", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.1", - "section_name": "Документация по безопасной разработке и архитектуре", - "req_id": "V15.1.1", - "req_description": "Убедитесь, что в документации по приложению определены сроки устранения уязвимостей на основе оценки рисков для внешних зависимостей с уязвимостями и для обновления библиотек в целом, чтобы минимизировать риск, связанный с этими компонентами.", - "L": "1" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.1", - "section_name": "Документация по безопасной разработке и архитектуре", - "req_id": "V15.1.2", - "req_description": "Убедитесь, что ведется реестр всех используемых сторонних библиотек (например, Software Bill of Materials, SBOM), с обязательной проверкой, что компоненты получены из предопределенных, доверенных и регулярно поддерживаемых репозиториев.", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.1", - "section_name": "Документация по безопасной разработке и архитектуре", - "req_id": "V15.1.3", - "req_description": "Убедитесь, что в документации приложения указан функционал, требующий значительных временных или вычислительных ресурсов. Необходимо указать, как предотвратить потерю доступности из-за чрезмерного использования этого функционала и как избежать ситуаций, когда формирование ответа занимает больше времени, чем установленный системой таймаут. Возможные меры защиты могут включать асинхронную обработку, использование очередей и ограничение количества параллельных процессов для каждого пользователя и приложения.", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.1", - "section_name": "Документация по безопасной разработке и архитектуре", - "req_id": "V15.1.4", - "req_description": "Убедитесь, что в документации приложения указаны внешние библиотеки, которые считаются «компонентами с повышенным риском».", - "L": "3" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.1", - "section_name": "Документация по безопасной разработке и архитектуре", - "req_id": "V15.1.5", - "req_description": "Убедитесь, что в документации приложения выделены те части приложения, в которых используются «функционал с повышенным риском».", - "L": "3" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.2", - "section_name": "Архитектура безопасности и зависимости", - "req_id": "V15.2.1", - "req_description": "Убедитесь, что приложение содержит только те компоненты, которые не нарушили задокументированные сроки обновления и исправления.", - "L": "1" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.2", - "section_name": "Архитектура безопасности и зависимости", - "req_id": "V15.2.2", - "req_description": "Убедитесь, что в приложении реализованы меры защиты от потери доступности из-за функциональности, требующей много времени или ресурсов, на основе задокументированных решений и стратегий безопасности для этого.", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.2", - "section_name": "Архитектура безопасности и зависимости", - "req_id": "V15.2.3", - "req_description": "Убедитесь, что производственная среда включает только те функции, которые необходимы для работы приложения, и не предоставляет лишние функции, такие как тестовый код, примеры кода и инструменты разработки.", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.2", - "section_name": "Архитектура безопасности и зависимости", - "req_id": "V15.2.4", - "req_description": "Убедитесь, что сторонние компоненты и все их транзитивные зависимости загружаются только из ожидаемых репозиториев (внутренних или внешних) и отсутствует риск атаки через подмену зависимостей (dependency confusion attack)", - "L": "3" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.2", - "section_name": "Архитектура безопасности и зависимости", - "req_id": "V15.2.5", - "req_description": "Убедитесь, что приложение реализует дополнительные меры защиты для тех частей приложения, которые документированы как содержащие «функционал с повышенным риском» или использующие сторонние библиотеки, считающиеся «функционалом с повышенным риском». Это могут быть такие методы, как «песочница», инкапсуляция, контейнеризация или изоляция на сетевом уровне, чтобы задержать и предотвратить продвижение (pivoting) злоумышленников, скомпрометировавших одну часть приложения, к другим частям приложения.", - "L": "3" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.3", - "section_name": "Безопасное программирование", - "req_id": "V15.3.1", - "req_description": "Убедитесь, что приложение возвращает только необходимое подмножество полей из объекта данных. Например, оно не должно возвращать весь объект данных, поскольку некоторые отдельные поля должны быть недоступны пользователям.", - "L": "1" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.3", - "section_name": "Безопасное программирование", - "req_id": "V15.3.2", - "req_description": "Убедитесь, что при вызовах внешних URL-адресов бэкэнд приложения настроен так, чтобы не выполнять перенаправления, если только это не предусмотрено функционалом.", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.3", - "section_name": "Безопасное программирование", - "req_id": "V15.3.3", - "req_description": "Убедитесь, что в приложении реализованы защитные механизмы против атак типа массового присвоения (mass assignment) путем строгого ограничения разрешенных полей для каждого контроллера и действия, исключая возможность добавления или изменения значений полей, которые не должны быть доступны для данной конкретной операции.", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.3", - "section_name": "Безопасное программирование", - "req_id": "V15.3.4", - "req_description": "Убедитесь, что все прокси и промежуточное ПО корректно передают исходный IP-адрес пользователя, используя доверенные поля данных, которые не могут быть изменены конечным пользователем, а приложение и веб-сервер используют это правильное значение для ведения логирования и принятия решений по безопасности, таких как ограничение запросов. При этом следует учитывать, что даже исходный IP-адрес может быть ненадежным из-за динамических IP-адресов, VPN или корпоративных файрволов.", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.3", - "section_name": "Безопасное программирование", - "req_id": "V15.3.5", - "req_description": "Убедитесь, что приложение явно проверяет соответствие переменных ожидаемому типу данных и использует строгие операции сравнения. Это необходимо для предотвращения уязвимостей, связанных с type juggling и type confusion, вызванных тем, что код приложения делает предположения о типе переменной.", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.3", - "section_name": "Безопасное программирование", - "req_id": "V15.3.6", - "req_description": "Убедитесь, что JavaScript-код написан таким образом, чтобы предотвратить prototype pollution, например, используя Set() или Map() вместо обычных литералов объекта.", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.3", - "section_name": "Безопасное программирование", - "req_id": "V15.3.7", - "req_description": "Убедитесь, что приложение защищено от атак типа HTTP Parameter Pollution (HPP), особенно если используемый фреймворк не различает источники параметров запроса (строка запроса, тело запроса, куки или заголовки).", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.4", - "section_name": "Безопасная работа с параллельными процессами", - "req_id": "V15.4.1", - "req_description": "Убедитесь, что к общим объектам в многопоточном коде (например, кэшам, файлам или объектам в памяти, используемым несколькими потоками) используется безопасный многопоточный доступ и механизмов синхронизации, таких как блокировки или семафоры, чтобы избежать состояний гонки и повреждения данных.", - "L": "3" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.4", - "section_name": "Безопасная работа с параллельными процессами", - "req_id": "V15.4.2", - "req_description": "Убедитесь, что проверки состояния ресурса, например его существования или разрешений, а также зависящие от него действия выполняются как одна атомарная операция, чтобы предотвратить условия гонки времени проверки и времени использования (TOCTOU). Например, проверка существования файла перед его открытием или проверка прав доступа пользователя перед его предоставлением.", - "L": "3" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.4", - "section_name": "Безопасная работа с параллельными процессами", - "req_id": "V15.4.3", - "req_description": "Убедитесь, что блокировки применяются согласованно, чтобы предотвратить взаимные блокировки потоков (deadlocks) или их бесконечные повторы, а также что логика блокировки инкапсулирована в коде, отвечающем за управление ресурсом. Это гарантирует, что блокировки не могут быть случайно или намеренно изменены внешними классами или кодом.", - "L": "3" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.4", - "section_name": "Безопасная работа с параллельными процессами", - "req_id": "V15.4.4", - "req_description": "Убедитесь, что политики распределения ресурсов предотвращают нехватку ресурсов у потоков, обеспечивая справедливый доступ к ресурсам, например, используя пулы потоков, позволяя потокам с более низким приоритетом выполняться в течение разумного периода времени.", - "L": "3" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.1", - "section_name": "Документация по ведению логов", - "req_id": "V16.1.1", - "req_description": "Убедитесь в существовании реестра, в котором документируется ведение журнала на каждом уровне технологического стека приложения, включая какие события регистрируются, форматы логов, где хранятся эти журналы, как они используются, как контролируется доступ к ним и как долго хранятся журналы.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.2", - "section_name": "Общее журналирование", - "req_id": "V16.2.1", - "req_description": "Убедитесь, что каждая запись журнала содержит необходимые метаданные (например, когда, где, кто, что), которые позволят провести подробное исследование временной шкалы, когда произошло событие.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.2", - "section_name": "Общее журналирование", - "req_id": "V16.2.2", - "req_description": "Убедитесь, что все источники времени компонентов системы журналирования синхронизированы, а временные метки в метаданных событий безопасности используют UTC или содержат явное указание смещения часового пояса. Рекомендуется применять UTC для обеспечения согласованности в распределённых системах и предотвращения ошибок при переходе на летнее/зимнее время.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.2", - "section_name": "Общее журналирование", - "req_id": "V16.2.3", - "req_description": "Убедитесь, что приложение записывает и передаёт логи исключительно в те файлы и сервисы, которые указаны в реестре журналирования.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.2", - "section_name": "Общее журналирование", - "req_id": "V16.2.4", - "req_description": "Убедитесь, что логи могут быть прочитаны и коррелированы используемой системой обработки журналов, предпочтительно с использованием общего стандартного формата логирования.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.2", - "section_name": "Общее журналирование", - "req_id": "V16.2.5", - "req_description": "Убедитесь, что приложение применяет соответствующие меры защиты при логировании конфиденциальных данных в зависимости от уровня их чувствительности: например, полностью запрещает запись в логи таких данных, как учетные данные или платежные реквизиты, а для других данных (например, сессионных токенов) использует хеширование или частичное/полное маскирование.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.3", - "section_name": "Инциденты безопасности", - "req_id": "V16.3.1", - "req_description": "Убедитесь, что все операции аутентификации регистрируются, включая успешные и неудачные попытки. Также следует фиксировать дополнительные метаданные, такие как тип аутентификации или использованные факторы проверки.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.3", - "section_name": "Инциденты безопасности", - "req_id": "V16.3.2", - "req_description": "Убедитесь, что ведется журнал неудачных попыток авторизации. Для уровня L3 это должно включать в себя журналирование всех решений об авторизации, включая журналирование доступа к конфиденциальным данным (без регистрации самих конфиденциальных данных).", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.3", - "section_name": "Инциденты безопасности", - "req_id": "V16.3.3", - "req_description": "Убедитесь, что приложение регистрирует все события безопасности, определенные в документации, а также фиксирует попытки обхода механизмов защиты, включая проверку входных данных, бизнес-логики и системы защиты от автоматизированных атак.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.3", - "section_name": "Инциденты безопасности", - "req_id": "V16.3.4", - "req_description": "Убедитесь, что приложение регистрирует в журналах неожиданные ошибки и сбои механизмов безопасности, включая, например, ошибки TLS-соединения на стороне сервера.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.4", - "section_name": "Защита журналов", - "req_id": "V16.4.1", - "req_description": "Убедитесь, что все компоненты системы логирования корректно кодируют данные, чтобы предотвратить атаки типа внедрения в журналы (log injection).", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.4", - "section_name": "Защита журналов", - "req_id": "V16.4.2", - "req_description": "Убедитесь, что логи защищены от неавторизованного доступа и не могут быть модифицированы.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.4", - "section_name": "Защита журналов", - "req_id": "V16.4.3", - "req_description": "Убедитесь, что логи безопасно передаются в логически изолированную систему для анализа, обнаружения угроз, генерации оповещений и эскалации инцидентов. Это гарантирует сохранность журналов даже в случае компрометации основного приложения.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.5", - "section_name": "Обработка ошибок", - "req_id": "V16.5.1", - "req_description": "Убедитесь, что при возникновении непредвиденной или связанной с безопасностью ошибки пользователю возвращается только общее сообщение, гарантируя отсутствие раскрытия конфиденциальных внутренних данных системы, таких как трассировки стека, запросы, секретные ключи и токены.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.5", - "section_name": "Обработка ошибок", - "req_id": "V16.5.2", - "req_description": "Убедитесь, что приложение продолжает работать в безопасном режиме при недоступности внешних ресурсов, используя такие механизмы, как автоматические выключатели (circuit breakers) или плавное снижение функциональности (graceful degradation).", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.5", - "section_name": "Обработка ошибок", - "req_id": "V16.5.3", - "req_description": "Убедитесь, что приложение корректно и безопасно завершает работу при возникновении исключений, предотвращая опасные сценарии по типу «fail-open», когда, например, транзакция ошибочно выполняется, несмотря на ошибки в логике валидации.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.5", - "section_name": "Обработка ошибок", - "req_id": "V16.5.4", - "req_description": "Убедитесь, что определён обработчик ошибок «крайние меры», который будет перехватывать все необработанные ошибки. Это необходимо как для предотвращения потери информации об ошибках, которая должна быть записана в файлы журналов, так и для того, чтобы ошибка не остановила весь процесс приложения, что привело бы к потере доступности.", - "L": "3" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.1", - "section_name": "TURN-сервер", - "req_id": "V17.1.1", - "req_description": "Убедитесь, что сервис TURN (Traversal Using Relays around NAT) разрешает доступ только к IP-адресам, не зарезервированным для специальных целей (например, внутренние сети, широковещательная рассылка, loopback-адреса). Данное требование применяется как к IPv4, так и к IPv6 адресам.", - "L": "2" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.1", - "section_name": "TURN-сервер", - "req_id": "V17.1.2", - "req_description": "Убедитесь, что сервис TURN (Traversal Using Relays around NAT) защищен от исчерпания ресурсов при попытках легитимных пользователей открыть чрезмерное количество портов на сервере.", - "L": "3" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Требования к медиасерверам", - "req_id": "V17.2.1", - "req_description": "Убедитесь, что ключ сертификата Datagram Transport Layer Security (DTLS) управляется и защищается в соответствии с документированной политикой управления криптографическими ключами.", - "L": "2" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Требования к медиасерверам", - "req_id": "V17.2.2", - "req_description": "Убедитесь, что медиасервер настроен на использование только одобренных наборов шифров Datagram Transport Layer Security (DTLS) и защищенного профиля безопасности для расширения DTLS, применяемого при установке ключей для Secure Real-time Transport Protocol (DTLS-SRTP).", - "L": "2" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Требования к медиасерверам", - "req_id": "V17.2.3", - "req_description": "Убедитесь, что медиасервер проверяет аутентификацию Secure Real-time Transport Protocol (SRTP) для предотвращения атак с внедрением Real-time Transport Protocol (RTP), которые могут привести к отказу в обслуживании (Denial of Service) или вставке поддельного аудио-/видеоконтента в медиапотоки.", - "L": "2" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Требования к медиасерверам", - "req_id": "V17.2.4", - "req_description": "Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика при получении некорректных пакетов Secure Real-time Transport Protocol (SRTP).", - "L": "2" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Требования к медиасерверам", - "req_id": "V17.2.5", - "req_description": "Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетами Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.", - "L": "3" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Требования к медиасерверам", - "req_id": "V17.2.6", - "req_description": "Убедитесь, что медиасервер не подвержен уязвимости «Гонка ClientHello» (ClientHello Race Condition) в Datagram Transport Layer Security (DTLS), проверив наличие известных уязвимостей в публичных источниках или выполнив тестирование на воспроизведение условий гонки.", - "L": "3" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Требования к медиасерверам", - "req_id": "V17.2.7", - "req_description": "Убедитесь, что механизмы аудио- и видеозаписи, связанные с медиасервером, способны продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетов Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.", - "L": "3" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Требования к медиасерверам", - "req_id": "V17.2.8", - "req_description": "Убедитесь, что сертификат Datagram Transport Layer Security (DTLS) проверяется на соответствие атрибуту отпечатка (fingerprint) в Session Description Protocol (SDP), с немедленным прекращением медиапотока в случае несоответствия — это гарантирует подлинность передаваемых данных.", - "L": "3" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.3", - "section_name": "Сигнализация", - "req_id": "V17.3.1", - "req_description": "Убедитесь, что сигнальный сервер способен продолжать обработку легитимных входящих сообщений сигнализации даже в условиях флуд-атаки. Для этого необходимо реализовать механизм ограничения частоты запросов (rate limiting) на уровне сигнализации.", - "L": "2" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.3", - "section_name": "Сигнализация", - "req_id": "V17.3.2", - "req_description": "Убедитесь, что сигнальный сервер способен продолжать обработку легитимных сообщений сигнализации даже при получении некорректных сообщений, которые могут вызвать отказ в обслуживании (Denial of Service, DoS). Для этого необходимо реализовать: проверку входных данных (input validation), безопасную обработку целочисленных переполнений (integer overflows), защиту от переполнения буферов (buffer overflows) и другие надежные методы обработки ошибок.", - "L": "2" - } - ] -} diff --git a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.flat.legacy.json b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.flat.legacy.json deleted file mode 100644 index 04adb2eb46..0000000000 --- a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.flat.legacy.json +++ /dev/null @@ -1,4489 +0,0 @@ -{ - "requirements": [ - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.1", - "section_name": "Архитектура кодировки и нейтрализации", - "req_id": "V1.1.1", - "req_description": "Убедитесь, что входные данные декодируются или деэкранируются в каноническую форму (в стандартное представление) только один раз. Декодирование происходит только тогда, когда ожидаются закодированные данные в этой форме, и что это делается перед дальнейшей обработкой входных данных, например, это не выполняется после проверки или нейтрализации.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.1", - "section_name": "Архитектура кодировки и нейтрализации", - "req_id": "V1.1.2", - "req_description": "Убедитесь, что приложение выполняет кодирование и экранирование выходных данных либо в качестве последнего шага перед использованием интерпретатором, для которого оно предназначено, либо самим интерпретатором.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.2", - "section_name": "Предотвращение инъекций", - "req_id": "V1.2.1", - "req_description": "Убедитесь, что выходная кодировка для ответа HTTP, документа HTML или документа XML соответствует требуемому контексту, например, кодировка соответствующих символов для элементов HTML, атрибутов HTML, комментариев HTML, CSS или полей заголовка HTTP делается таким способом, чтобы избежать изменения структуры сообщения или документа.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.2", - "section_name": "Предотвращение инъекций", - "req_id": "V1.2.2", - "req_description": "Убедитесь, что при динамическом построении URL-адресов недоверенные данные кодируются в соответствии с их контекстом (например, кодирование URL-адресов или кодирование base64url для query или path параметров или пути). Убедитесь, что разрешены только безопасные протоколы URL-адресов (например, запрещен javascript: или data:).", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.2", - "section_name": "Предотвращение инъекций", - "req_id": "V1.2.3", - "req_description": "Убедитесь, что при динамическом построении содержимого JavaScript (включая JSON) используется кодирование или экранирование выходных данных, чтобы избежать изменения структуры сообщения или документа (чтобы избежать JavaScript и JSON-инъекций).", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.2", - "section_name": "Предотвращение инъекций", - "req_id": "V1.2.4", - "req_description": "Убедитесь, что выборка данных (Redis, Memcached, чтение из файлов, обращение по API) или запросы к базе данных (например, SQL, HQL, NoSQL, Cypher) используют параметризованные запросы, ORM, Entity Frameworks или иным образом защищены от SQL-инъекций и других атак. Это также актуально при написании хранимых процедур.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.2", - "section_name": "Предотвращение инъекций", - "req_id": "V1.2.5", - "req_description": "Убедитесь, что приложение защищено от внедрения команд ОС и что вызовы операционной системы используют параметризованные запросы к ОС или используют контекстное кодирование вывода командной строки.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.2", - "section_name": "Предотвращение инъекций", - "req_id": "V1.2.6", - "req_description": "Убедитесь, что приложение защищено от LDAP-инъекций, или что реализованы специальные меры безопасности для их предотвращения.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.2", - "section_name": "Предотвращение инъекций", - "req_id": "V1.2.7", - "req_description": "Убедитесь, что приложение защищено от атак с использованием XPath-инъекций с помощью параметризации запросов или предварительно скомпилированных запросов.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.2", - "section_name": "Предотвращение инъекций", - "req_id": "V1.2.8", - "req_description": "Убедитесь, что процессоры LaTeX настроены безопасно (например, не используется флаг «–shell‑escape») и используется разрешенный список команд для предотвращения LaTeX-инъекций.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.2", - "section_name": "Предотвращение инъекций", - "req_id": "V1.2.9", - "req_description": "Убедитесь, что приложение экранирует специальные символы в регулярных выражениях (обычно с помощью обратной косой черты), чтобы предотвратить их ошибочную интерпретацию как метасимволов.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.2", - "section_name": "Предотвращение инъекций", - "req_id": "V1.2.10", - "req_description": "Убедитесь, что приложение защищено от внедрения формул CSV (CSV Injection). Приложение должно следовать правилам экранирования, определенным в RFC 4180, разделы 2.6 и 2.7, при экспорте содержимого CSV. Кроме того, при экспорте в CSV или другие форматы электронных таблиц (такие как XLS, XLSX или ODF) специальные символы (включая '=', '+', '-', '@', '\\t' (табуляция), и '\\0' (нулевой символ)) должны экранироваться одинарной кавычкой, если они появляются в качестве первого символа в значении поля.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.3", - "section_name": "Нейтрализация", - "req_id": "V1.3.1", - "req_description": "Убедитесь, что все ненадежные входные данные HTML из редакторов WYSIWYG или аналогичных программ нейтрализуются с помощью известных и безопасных библиотек или функций фреймворка для санитизации HTML.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.3", - "section_name": "Нейтрализация", - "req_id": "V1.3.2", - "req_description": "Убедитесь, что приложение избегает использования eval() или других динамических функций выполнения кода, таких как Spring Expression Language (SpEL). Если нет альтернативы, любой пользовательский ввод должен быть нейтрализован перед выполнением.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.3", - "section_name": "Нейтрализация", - "req_id": "V1.3.3", - "req_description": "Убедитесь, что данные, передаваемые в потенциально опасный контекст, предварительно нейтрализованы, чтобы обеспечить соблюдение мер безопасности, таких как разрешение только тех символов, которые безопасны для данного контекста, и обрезка слишком длинного ввода.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.3", - "section_name": "Нейтрализация", - "req_id": "V1.3.4", - "req_description": "Убедитесь, что предоставленный пользователем файл .SVG проверен или нейтрализован, чтобы он содержал только теги и атрибуты (например, относящиеся к рисованию), которые безопасны для приложения, например, не содержат скриптов и foreignObject.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.3", - "section_name": "Нейтрализация", - "req_id": "V1.3.5", - "req_description": "Убедитесь, что приложение нейтралует или отключает предоставленные пользователем скриптовые данные или выражения шаблонных языков, такие как таблицы стилей Markdown, CSS или XSL, BBCode или аналогичные.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.3", - "section_name": "Нейтрализация", - "req_id": "V1.3.6", - "req_description": "Убедитесь, что приложение защищено от атак с подделкой запросов на стороне сервера (SSRF), проверяя ненадежные данные по разрешенному списку протоколов, доменов, путей и портов, а также нейтрализуя потенциально опасные символы перед использованием данных для вызова другой службы.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.3", - "section_name": "Нейтрализация", - "req_id": "V1.3.7", - "req_description": "Убедитесь, что приложение защищено от атак с внедрением шаблонов (template injection), не позволяя создавать шаблоны на основе недоверенных входных данных. Если нет альтернативы, любые недоверенные входные данные, включаемые динамически во время создания шаблона, должны быть нейтрализованы или тщательно провалидированы.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.3", - "section_name": "Нейтрализация", - "req_id": "V1.3.8", - "req_description": "Убедитесь, что приложение надлежащим образом нейтрализует недоверенные входные данные перед использованием в запросах Java Naming and Directory Interface (JNDI) и что JNDI настроен безопасно для предотвращения атак с использованием JNDI-инъекций.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.3", - "section_name": "Нейтрализация", - "req_id": "V1.3.9", - "req_description": "Убедитесь, что приложение нейтрализует данные перед отправкой в Memcache, чтобы предотвратить атаки методом инъекций.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.3", - "section_name": "Нейтрализация", - "req_id": "V1.3.10", - "req_description": "Убедитесь, что строки форматирования, которые могут быть использованы неожидаемым или вредоносным образом, нейтрализуются перед дальнейшим использованием.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.3", - "section_name": "Нейтрализация", - "req_id": "V1.3.11", - "req_description": "Убедитесь, что приложение нейтрализует вводимые пользователем данные перед передачей в почтовые системы для защиты от SMTP или IMAP-инъекций.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.3", - "section_name": "Нейтрализация", - "req_id": "V1.3.12", - "req_description": "Убедитесь, что регулярные выражения не содержат элементов, вызывающих экспоненциальный возврат, и убедитесь в нейтрализации недоверенных входных данных для предотвращения атак ReDoS или Runaway Regex.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.4", - "section_name": "Память, строки и неуправляемый код", - "req_id": "V1.4.1", - "req_description": "Убедитесь, что для обнаружения или предотвращения ситуаций переполнения стека, буфера или кучи приложение учитывает размер доступной области памяти при строковых операциях, копировании в память, в арифметике указателей и т.п.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.4", - "section_name": "Память, строки и неуправляемый код", - "req_id": "V1.4.2", - "req_description": "Убедитесь, что для предотвращения целочисленного переполнения применяется контроль знака, диапазона и типа допустимых входных данных.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.4", - "section_name": "Память, строки и неуправляемый код", - "req_id": "V1.4.3", - "req_description": "Убедитесь, что динамически выделенная память и ресурсы освобождены, а ссылки или указатели на освобожденную память удалены или установлены в значение null, чтобы предотвратить появление висячих указателей и уязвимостей, связанных с использованием памяти после освобождения.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.5", - "section_name": "Безопасная десериализация", - "req_id": "V1.5.1", - "req_description": "Убедитесь, что приложение настраивает XML-парсеры на использование строгой конфигурации и что небезопасные функции, такие как разрешение внешних сущностей, отключены для предотвращения атак XML eXternal Entity (XXE).", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.5", - "section_name": "Безопасная десериализация", - "req_id": "V1.5.2", - "req_description": "Убедитесь, что десериализация недоверенных данных обеспечивает безопасную обработку ввода, например, используя список разрешенных типов объектов или ограничивая типы объектов, определяемые клиентом, для предотвращения атак десериализации. Механизмы десериализации, которые явно определены как небезопасные, не должны использоваться с недоверенным вводом.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Кодировка и нейтрализация", - "section_id": "V1.5", - "section_name": "Безопасная десериализация", - "req_id": "V1.5.3", - "req_description": "Убедитесь, что различные парсеры, используемые в приложении для одного и того же типа данных (например, парсеры JSON, XML, URL), выполняют парсинг согласованным образом и используют один и тот же механизм кодирования символов, чтобы избежать таких проблем, как уязвимости взаимодействия JSON (JSON Interoperability) или различное поведение анализа URI или файлов, которые могут использоваться в атаках удаленного включения файлов (RFI) или подделки запросов на стороне сервера (SSRF).", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Валидация и бизнес-логика", - "section_id": "V2.1", - "section_name": "Документация валидации и бизнес-логики", - "req_id": "V2.1.1", - "req_description": "Убедитесь, что в документации приложения определены правила проверки входных данных на соответствие ожидаемой структуре. Это могут быть распространённые форматы данных, такие как номера кредитных карт, адреса электронной почты, номера телефонов, или внутренний формат данных.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Валидация и бизнес-логика", - "section_id": "V2.1", - "section_name": "Документация валидации и бизнес-логики", - "req_id": "V2.1.2", - "req_description": "Убедитесь, что в документации приложения указано, как проверять логическую и контекстную согласованность объединенных данных, например, проверять соответствие района и почтового индекса.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Валидация и бизнес-логика", - "section_id": "V2.1", - "section_name": "Документация валидации и бизнес-логики", - "req_id": "V2.1.3", - "req_description": "Убедитесь, что ожидания относительно ограничений и проверок бизнес-логики задокументированы как для уровня отдельного пользователя, так и для глобального уровня всего приложения.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Валидация и бизнес-логика", - "section_id": "V2.2", - "section_name": "Валидация ввода", - "req_id": "V2.2.1", - "req_description": "Убедитесь, что входные данные провалидированы для обеспечения соответствия бизнес- или функциональным ожиданиям. Валидация должна осуществляться либо по списку допустимых значений, шаблонов и диапазонов, либо путем сравнения входных данных с ожидаемой структурой и логическими ограничениями в соответствии с предопределенными правилами. Для L1 валидация может быть сосредоточена на входных данных, используемых для принятия конкретных бизнес-решений или решений, связанных с безопасностью. Для L2 и выше это должно применяться ко всем входным данным.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Валидация и бизнес-логика", - "section_id": "V2.2", - "section_name": "Валидация ввода", - "req_id": "V2.2.2", - "req_description": "Убедитесь, что приложение разработано с принудительной валидацией входных данных на уровне доверенного сервиса. Хотя проверка на стороне клиента повышает удобство использования и должна поощряться, на неё не следует полагаться как на средство контроля безопасности.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Валидация и бизнес-логика", - "section_id": "V2.2", - "section_name": "Валидация ввода", - "req_id": "V2.2.3", - "req_description": "Убедитесь, что приложение обеспечивает обоснованность комбинаций данных в соответствии с предопределенными правилам. Например: возраст должен соответствовать дате рождения; страна и почтовый индекс; количество товара в заказе и на складе.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Валидация и бизнес-логика", - "section_id": "V2.3", - "section_name": "Безопасность бизнес-логики", - "req_id": "V2.3.1", - "req_description": "Убедитесь, что приложение обрабатывает потоки бизнес-логики для одного и того же пользователя в ожидаемом последовательном порядке шагов и без пропуска шагов.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Валидация и бизнес-логика", - "section_id": "V2.3", - "section_name": "Безопасность бизнес-логики", - "req_id": "V2.3.2", - "req_description": "Убедитесь, что ограничения бизнес-логики реализованы в соответствии с документацией приложения, чтобы избежать эксплуатации её недостатков.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Валидация и бизнес-логика", - "section_id": "V2.3", - "section_name": "Безопасность бизнес-логики", - "req_id": "V2.3.3", - "req_description": "Убедитесь, что транзакции используются на уровне бизнес-логики таким образом, что операция бизнес-логики либо выполняется полностью, либо откатывается к предыдущему корректному состоянию.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Валидация и бизнес-логика", - "section_id": "V2.3", - "section_name": "Безопасность бизнес-логики", - "req_id": "V2.3.4", - "req_description": "Убедитесь, что на уровне бизнес-логики используются механизмы блокировки, чтобы гарантировать невозможность двойного бронирования ограниченных по количеству ресурсов (например, мест в театре или слотов доставки) путем манипулирования логикой приложения.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Валидация и бизнес-логика", - "section_id": "V2.3", - "section_name": "Безопасность бизнес-логики", - "req_id": "V2.3.5", - "req_description": "Убедитесь, что для важных потоков бизнес-логики требуется многопользовательское (multi-user) одобрение, чтобы предотвратить несанкционированные или случайные действия. Потоки бизнес-логики могут включать, помимо прочего, крупные денежные переводы, утверждение контрактов, доступ к секретной информации или обход ограничений безопасности на производстве.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Валидация и бизнес-логика", - "section_id": "V2.4", - "section_name": "Анти-автоматизация", - "req_id": "V2.4.1", - "req_description": "Убедитесь, что используются средства противодействия автоматизации для защиты от чрезмерных вызовов функций приложения, которые могут привести к утечке данных, созданию ненужных данных, исчерпанию квот, нарушению ограничений скорости, отказу в обслуживании или чрезмерному использованию дорогостоящих ресурсов.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Валидация и бизнес-логика", - "section_id": "V2.4", - "section_name": "Анти-автоматизация", - "req_id": "V2.4.2", - "req_description": "Убедитесь, что потоки бизнес-логики требуют реалистичного человеческого времени, предотвращая чрезмерно быструю отправку транзакций.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.1", - "section_name": "Документация по безопасности веб-интерфейса", - "req_id": "V3.1.1", - "req_description": "Убедитесь, что в документации приложения описаны ожидаемые функции безопасности, которые должны поддерживать браузеры, использующие приложение (такие как HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) и другие соответствующие механизмы безопасности HTTP). В документации также должно быть обязательно определено, как приложение должно себя вести, если некоторые из этих функций недоступны (например, предупреждать пользователя или блокировать доступ).", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.2", - "section_name": "Непреднамеренная интерпретация контента", - "req_id": "V3.2.1", - "req_description": "Убедитесь, что реализованы меры безопасности, предотвращающие отображение контента или функций браузерами в HTTP-ответах в некорректном контексте (например, запрос API, загруженный пользователем файл или другой ресурс запрашивается напрямую). Возможные способы контроля включают: не обрабатывать содержимое, если поля заголовка HTTP-запроса (например, Sec-Fetch-*) не указывают на корректность контекста; использование заголовка и значения Content-Security-Policy: sandbox directive; или использование заголовка и значения Content-Disposition: attachment.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.2", - "section_name": "Непреднамеренная интерпретация контента", - "req_id": "V3.2.2", - "req_description": "Убедитесь, что данные, предназначенные для отображения в виде текста, а не визуализации в виде HTML, обрабатывается с использованием безопасных функций визуализации (таких как createTextNode или textContent), чтобы предотвратить непреднамеренное выполнение содержимого, такого как HTML или JavaScript.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.2", - "section_name": "Непреднамеренная интерпретация контента", - "req_id": "V3.2.3", - "req_description": "Убедитесь, что приложение избегает затирания DOM при использовании JavaScript на стороне клиента, применяя явные объявления переменных, выполняя строгую проверку типов, избегая сохранения глобальных переменных в объекте документа и реализуя изоляцию пространства имен.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.3", - "section_name": "Настройка файлов cookie", - "req_id": "V3.3.1", - "req_description": "Убедитесь, что у файлов cookie установлен атрибут «Secure», и если префикс «__Host‑» не используется в названии cookie, необходимо использовать префикс «__Secure‑».", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.3", - "section_name": "Настройка файлов cookie", - "req_id": "V3.3.2", - "req_description": "Убедитесь, что значение атрибута SameSite каждой cookie установлено в соответствии с назначением cookie, чтобы ограничить подверженность атакам на восстановление пользовательского интерфейса и атакам с подделкой запросов на уровне браузера, обычно называемым подделкой межсайтовых запросов (CSRF).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.3", - "section_name": "Настройка файлов cookie", - "req_id": "V3.3.3", - "req_description": "Убедитесь, что cookie имеют префикс «__Host‑» в названии, если только они явно не предназначены для совместного использования с другими хостами.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.3", - "section_name": "Настройка файлов cookie", - "req_id": "V3.3.4", - "req_description": "Убедитесь, что если значение cookie не должно быть доступно для клиентских скриптов (например, сессионный токен), для cookie должен быть установлен атрибут «HttpOnly», а само значение должно передаваться клиенту только через поле заголовка «Set-Cookie».", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.3", - "section_name": "Настройка файлов cookie", - "req_id": "V3.3.5", - "req_description": "Убедитесь, что при записи cookie приложением общая длина имени и значения cookie не превышает 4096 байт. Слишком большие cookie не будут сохраняться браузером и, следовательно, не будут отправляться с запросами, что помешает пользователю использовать функции приложения, зависящие от этого cookie.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.4", - "section_name": "Заголовки механизма безопасности браузера", - "req_id": "V3.4.1", - "req_description": "Убедитесь, что поле заголовка Strict‑Transport‑Security включено во все ответы для реализации политики HTTP Strict Transport Security (HSTS). Необходимо указать максимальное время не менее 1 года, а для L2 и выше политика должна применяться также ко всем поддоменам.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.4", - "section_name": "Заголовки механизма безопасности браузера", - "req_id": "V3.4.2", - "req_description": "Убедитесь, что поле заголовка Cross‑Origin Resource Sharing (CORS) «Access‑Control‑Allow‑Origin» имеет фиксированное значение, заданное приложением, или, если используется заголовок Origin, оно проверяется по списку доверенных источников. При необходимости использования «Access‑Control‑Allow‑Origin: *» убедитесь, что ответ не содержит конфиденциальной информации.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.4", - "section_name": "Заголовки механизма безопасности браузера", - "req_id": "V3.4.3", - "req_description": "Убедитесь, что HTTP-ответы содержат поле заголовка Content-Security-Policy, которое определяет директивы, гарантирующие загрузку и выполнение браузером только доверенного контента или ресурсов, чтобы ограничить выполнение вредоносного JavaScript. Как минимум, необходимо использовать глобальную политику, включающую директивы object-src «none» и base-uri «none», а также определяющую список разрешенных адресов или использующую одноразовые коды или хэши. Для приложений L3 необходимо определить политику использования 'nonce' или hash-конструкций для каждого ответа.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.4", - "section_name": "Заголовки механизма безопасности браузера", - "req_id": "V3.4.4", - "req_description": "Убедитесь, что все HTTP-ответы содержат поле заголовка «X‑Content‑Type‑Options: nosniff». Это предписывает браузерам не использовать анализ контента и определение типа MIME для данного ответа, а также требовать, чтобы значение поля заголовка Content‑Type в ответе соответствовало целевому ресурсу. Например, ответ на запрос стиля принимается только в том случае, если Content‑Type в ответе — «text/css». Это также позволяет браузеру использовать функцию Cross‑Origin Read Blocking (CORB).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.4", - "section_name": "Заголовки механизма безопасности браузера", - "req_id": "V3.4.5", - "req_description": "Убедитесь, что приложение устанавливает политику реферера для предотвращения утечки технически конфиденциальных данных сторонним сервисам через поле заголовка HTTP-запроса «Referer». Это можно сделать с помощью поля заголовка HTTP-ответа «Referrer‑Policy» или через атрибуты HTML-элемента. Конфиденциальные данные могут включать путь и данные запроса в URL-адресе, а для внутренних непубличных приложений также имя хоста.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.4", - "section_name": "Заголовки механизма безопасности браузера", - "req_id": "V3.4.6", - "req_description": "Убедитесь, что веб-приложение использует директиву frame‑ancestors поля заголовка Content‑Security‑Policy для каждого HTTP-ответа, чтобы гарантировать невозможность его внедрения по умолчанию и внедрение определённых ресурсов разрешено только при необходимости. Обратите внимание, что поле заголовка X‑Frame‑Options, хотя и поддерживается браузерами, устарело и не может быть использовано в качестве основы.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.4", - "section_name": "Заголовки механизма безопасности браузера", - "req_id": "V3.4.7", - "req_description": "Убедитесь, что в поле заголовка Content‑Security‑Policy указано место, куда следует сообщать о нарушениях.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.4", - "section_name": "Заголовки механизма безопасности браузера", - "req_id": "V3.4.8", - "req_description": "Убедитесь, что все HTTP-ответы, инициирующие рендеринг документа (например, ответы с типом содержимого text/html), включают поле заголовка Cross-Origin-Opener-Policy с директивой same-origin или same-origin-allow-popups (при необходимости). Это предотвращает атаки, злоупотребляющие общим доступом к объектам Window, такие как Tabnabbing и Frame Counting.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.5", - "section_name": "Браузерное разделение источников", - "req_id": "V3.5.1", - "req_description": "Убедитесь, что, если приложение не использует механизм предварительной проверки CORS для предотвращения запрещённых кросс-доменных запросов на использование чувствительного функционала, эти запросы валидируются на предмет их происхождения от самого приложения. Это можно сделать, используя и проверяя специальные токены для защиты от подделки или требуя дополнительные поля HTTP-заголовка, не входящие в список «простых заголовков» (CORS-safelisted request-header). Это необходимо для защиты от атак с подделкой запросов через браузер, широко известных как межсайтовая подделка запросов (CSRF).", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.5", - "section_name": "Браузерное разделение источников", - "req_id": "V3.5.2", - "req_description": "Убедитесь, что если приложение использует механизм предварительной проверки CORS для предотвращения неразрешённого использования чувствительного функционала между источниками, вызов этого функционала невозможен с помощью запроса, который не запускает предварительную проверку CORS. Для этого может потребоваться проверка значений полей заголовка запроса «Origin» и «Content-Type» или использование дополнительного поля заголовка, не входящего в безопасный список CORS.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.5", - "section_name": "Браузерное разделение источников", - "req_id": "V3.5.3", - "req_description": "Убедитесь, что HTTP-запросы к чувствительному функционалу используют соответствующие HTTP-методы, такие как POST, PUT, PATCH или DELETE, а не методы, определённые спецификацией HTTP как «безопасные», такие как HEAD, OPTIONS или GET. В качестве альтернативы можно использовать строгую валидацию полей заголовка запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, навигационного запроса или загрузки ресурса (например, источника изображения), где это не ожидается.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.5", - "section_name": "Браузерное разделение источников", - "req_id": "V3.5.4", - "req_description": "Убедитесь, что отдельные приложения размещены на разных именах хостов, чтобы использовать ограничения, предусмотренные политикой same-origin, включая то, как документы или скрипты, загруженные одним источником, могут взаимодействовать с ресурсами из другого источника, а также ограничения на cookie на основе имени хоста.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.5", - "section_name": "Браузерное разделение источников", - "req_id": "V3.5.5", - "req_description": "Убедитесь, что сообщения, полученные интерфейсом postMessage, отвергаются, если источник сообщения не является доверенным или если синтаксис сообщения недействителен.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.5", - "section_name": "Браузерное разделение источников", - "req_id": "V3.5.6", - "req_description": "Убедитесь, что функциональность JSONP не включена нигде в приложении, чтобы избежать атак с использованием межсайтового включения скриптов (XSSI).", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.5", - "section_name": "Браузерное разделение источников", - "req_id": "V3.5.7", - "req_description": "Убедитесь, что данные, требующие авторизации, не включены в ответы ресурсов скриптов, таких как файлы JavaScript, чтобы предотвратить атаки с использованием межсайтового включения скриптов (XSSI).", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.5", - "section_name": "Браузерное разделение источников", - "req_id": "V3.5.8", - "req_description": "Убедитесь, что аутентифицированные ресурсы (такие как изображения, видео, скрипты и другие документы) могут быть загружены или внедрены от имени пользователя только по назначению. Этого можно добиться путём строгой валидации полей заголовка HTTP-запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, или путём установки ограничительного поля заголовка HTTP-ответа Cross‑Origin‑Resource‑Policy, чтобы браузер блокировал возвращаемый контент.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.6", - "section_name": "Целостность внешних ресурсов", - "req_id": "V3.6.1", - "req_description": "Убедитесь, что клиентские ресурсы, такие как библиотеки JavaScript, CSS или веб-шрифты, размещаются только на внешнем сервере (например, в сети доставки контента (Content Delivery Network)), если ресурс статический и имеет версии, а для проверки целостности ресурса используется механизм проверки целостности подресурсов (SRI). Если это невозможно, для каждого ресурса должно быть задокументировано решение по безопасности, обосновывающее это.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.7", - "section_name": "Другие соображения по безопасности браузера", - "req_id": "V3.7.1", - "req_description": "Убедитесь, что приложение использует только те клиентские технологии, которые по-прежнему поддерживаются и считаются безопасными. Примерами технологий, не соответствующих этому требованию, являются плагины NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL или клиентские Java-апплеты.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.7", - "section_name": "Другие соображения по безопасности браузера", - "req_id": "V3.7.2", - "req_description": "Убедитесь, что приложение будет автоматически перенаправлять пользователя на другое имя хоста или домен (который не контролируется приложением), только если этот хост или домен указаны в списке разрешенных.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.7", - "section_name": "Другие соображения по безопасности браузера", - "req_id": "V3.7.3", - "req_description": "Убедитесь, что приложение отображает уведомление, что пользователь перенаправляется на URL-адрес, находящийся вне контроля приложения, с возможностью отмены навигации.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.7", - "section_name": "Другие соображения по безопасности браузера", - "req_id": "V3.7.4", - "req_description": "Убедитесь, что домен верхнего уровня приложения (например, site.tld) ​​добавлен в публичный список предварительной загрузки (preload list) для HTTP Strict Transport Security (HSTS). Это гарантирует, что использование TLS для приложения будет встроено непосредственно в основные браузеры, а не будет полагаться только на поле заголовка ответа Strict-Transport-Security.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Безопасность веб-интерфейса", - "section_id": "V3.7", - "section_name": "Другие соображения по безопасности браузера", - "req_id": "V3.7.5", - "req_description": "Убедитесь, что приложение ведет себя так, как описано в документации (например, предупреждает пользователя или блокирует доступ), если браузер, используемый для доступа к приложению, не поддерживает ожидаемые функции безопасности.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API и Веб-сервис", - "section_id": "V4.1", - "section_name": "Общая безопасность веб-сервисов", - "req_id": "V4.1.1", - "req_description": "Убедитесь, что каждый HTTP-ответ с телом сообщения содержит заголовок Content-Type, который соответствует фактическому содержимому ответа, таким как «text/», «/+xml» и «/xml», включая параметр charset для указания безопасной кодировки символов (например, UTF-8, ISO-8859-1) согласно IANA Media Types.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API и Веб-сервис", - "section_id": "V4.1", - "section_name": "Общая безопасность веб-сервисов", - "req_id": "V4.1.2", - "req_description": "Убедитесь, что только конечные точки, предназначенные для взаимодействия с пользователем через веб-браузер, автоматически перенаправляют HTTP на HTTPS, в то время как другие сервисы или конечные точки не реализуют прозрачные редиректы. Это необходимо, чтобы избежать ситуации, когда клиент ошибочно отправляет незашифрованные HTTP-запросы а из-за того, что запрос по HTTP автоматически перенаправляется на HTTPS другим сервисом без обработки на входе, утечка чувствительных данных остаётся незамеченной.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API и Веб-сервис", - "section_id": "V4.1", - "section_name": "Общая безопасность веб-сервисов", - "req_id": "V4.1.3", - "req_description": "Убедитесь, что любой HTTP-заголовок, используемый приложением и устанавливаемый промежуточным уровнем, таким как балансировщик нагрузки, веб-прокси или backend-for-frontend сервис, не может быть переопределён конечным пользователем. Примеры заголовков: X-Real-IP, X-Forwarded-*, X-User-ID.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API и Веб-сервис", - "section_id": "V4.1", - "section_name": "Общая безопасность веб-сервисов", - "req_id": "V4.1.4", - "req_description": "Убедитесь, что разрешены только HTTP-методы, которые явно поддерживаются приложением или его API (включая OPTIONS для preflight-запросов), а неиспользуемые методы заблокированы.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API и Веб-сервис", - "section_id": "V4.1", - "section_name": "Общая безопасность веб-сервисов", - "req_id": "V4.1.5", - "req_description": "Убедитесь, что для особо чувствительных запросов или транзакций, проходящих через несколько систем, используются цифровые подписи на уровне сообщений, дополнительно к транспортным средствам защиты.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API и Веб-сервис", - "section_id": "V4.2", - "section_name": "Валидация структуры HTTP-сообщений", - "req_id": "V4.2.1", - "req_description": "Убедитесь, что все компоненты приложения (включая балансировщики нагрузки, файрволы и серверы приложений) определяют границы входящих HTTP-сообщений с использованием механизма, соответствующего версии HTTP, чтобы предотвратить HTTP request smuggling. В HTTP/1.x, если присутствует заголовок Transfer-Encoding, заголовок Content-Length должен игнорироваться согласно RFC 2616. При использовании HTTP/2 или HTTP/3, если присутствует Content-Length, веб-сервер должен убедиться, что он совпадает с длиной DATA-фреймов.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API и Веб-сервис", - "section_id": "V4.2", - "section_name": "Валидация структуры HTTP-сообщений", - "req_id": "V4.2.2", - "req_description": "Убедитесь, что при генерации HTTP-сообщений заголовок Content-Length не конфликтует с длиной содержимого, определяемой рамками протокола HTTP, чтобы предотвратить HTTP Request Smuggling.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API и Веб-сервис", - "section_id": "V4.2", - "section_name": "Валидация структуры HTTP-сообщений", - "req_id": "V4.2.3", - "req_description": "Убедитесь, что приложение не отправляет и не принимает HTTP/2 и HTTP/3 сообщения с заголовками, специфичными для соединения, такими как Transfer-Encoding, чтобы предотвратить HTTP Response Splitting и HTTP Header Injection.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API и Веб-сервис", - "section_id": "V4.2", - "section_name": "Валидация структуры HTTP-сообщений", - "req_id": "V4.2.4", - "req_description": "Убедитесь, что приложение принимает HTTP/2 и HTTP/3 запросы только в случае, если поля заголовков и их значения не содержат последовательностей CR (\\r), LF (\\n) или CRLF (\\r\\n), чтобы предотвратить HTTP Header Injection.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API и Веб-сервис", - "section_id": "V4.2", - "section_name": "Валидация структуры HTTP-сообщений", - "req_id": "V4.2.5", - "req_description": "Убедитесь, что если приложение (бекенд или фронтенд) формирует и отправляет запросы, оно использует валидацию, очистку или другие механизмы, чтобы не создавать URI (например, для API-вызовов) или HTTP-заголовки (например, Authorization или Cookie) слишком большой длины, чтобы их не принимал приёмник. Это может привести к отказу в обслуживании, например, при отправке слишком длинного запроса (длинный cookie-заголовок), из-за чего сервер постоянно возвращает ошибку.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API и Веб-сервис", - "section_id": "V4.3", - "section_name": "GraphQL", - "req_id": "V4.3.1", - "req_description": "Убедитесь, что используется белый список запросов, ограничение глубины вложенности, ограничение количества или анализ стоимости запроса, чтобы предотвратить DoS-атаки на уровне GraphQL или слоя данных из-за дорогостоящих вложенных запросов.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API и Веб-сервис", - "section_id": "V4.3", - "section_name": "GraphQL", - "req_id": "V4.3.2", - "req_description": "Убедитесь, что introspection-запросы GraphQL отключены в продакшен-среде, если GraphQL API не предназначен для использования сторонними клиентами.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API и Веб-сервис", - "section_id": "V4.4", - "section_name": "WebSocket", - "req_id": "V4.4.1", - "req_description": "Убедитесь, что для всех WebSocket-соединений используется WebSocket поверх TLS (WSS).", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API и Веб-сервис", - "section_id": "V4.4", - "section_name": "WebSocket", - "req_id": "V4.4.2", - "req_description": "Убедитесь, что при первоначальном HTTP WebSocket handshake заголовок Origin проверяется на соответствие списку разрешённых источников для приложения.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API и Веб-сервис", - "section_id": "V4.4", - "section_name": "WebSocket", - "req_id": "V4.4.3", - "req_description": "Убедитесь, что если стандартное управление сессиями приложения не может быть использовано, применяются специальные токены, соответствующие требованиям безопасности управления сессиями.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API и Веб-сервис", - "section_id": "V4.4", - "section_name": "WebSocket", - "req_id": "V4.4.4", - "req_description": "Убедитесь, что специальные токены управления сессиями WebSocket изначально получаются или валидируются через ранее аутентифицированную HTTPS-сессию при переходе от HTTPS к WebSocket.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Работа с файлами", - "section_id": "V5.1", - "section_name": "Документация по работе с файлами", - "req_id": "V5.1.1", - "req_description": "Убедитесь, что документация определяет допустимые типы файлов, ожидаемые расширения и максимальный размер (включая распакованный размер) для каждой функции загрузки. Также убедитесь, что в документации указано, как файлы обезвреживаются для конечных пользователей (например, как приложение ведёт себя при обнаружении вредоносного файла).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Работа с файлами", - "section_id": "V5.2", - "section_name": "Загрузка файлов и содержимое", - "req_id": "V5.2.1", - "req_description": "Убедитесь, что приложение принимает только те файлы, которые может обработать без потери производительности или отказа в обслуживании.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Работа с файлами", - "section_id": "V5.2", - "section_name": "Загрузка файлов и содержимое", - "req_id": "V5.2.2", - "req_description": "Убедитесь, что при загрузке файла (включая файлы внутри архивов, таких как ZIP) приложение проверяет, соответствует ли расширение ожидаемому, и валидирует, соответствует ли содержимое типу, указанному в расширении. Это включает проверку начальных 'magic bytes', перезапись изображений, использование специализированных библиотек. Для уровня 1 — достаточно проверок для файлов, критичных с точки зрения бизнеса или безопасности. Для уровней 2 и выше — для всех файлов.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Работа с файлами", - "section_id": "V5.2", - "section_name": "Загрузка файлов и содержимое", - "req_id": "V5.2.3", - "req_description": "Убедитесь, что приложение проверяет архивы (например, zip, gz, docx, odt) на максимально допустимый распакованный размер и максимальное количество файлов до распаковки.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Работа с файлами", - "section_id": "V5.2", - "section_name": "Загрузка файлов и содержимое", - "req_id": "V5.2.4", - "req_description": "Убедитесь, что для каждого пользователя установлены квоты на общий размер и количество файлов, чтобы один пользователь не мог переполнить хранилище.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Работа с файлами", - "section_id": "V5.2", - "section_name": "Загрузка файлов и содержимое", - "req_id": "V5.2.5", - "req_description": "Убедитесь, что приложение не позволяет загружать архивы с символьными ссылками (symlinks), если это не требуется по бизнес-логике. Если требуется — разрешён только строго определённый список допустимых символьных ссылок.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Работа с файлами", - "section_id": "V5.2", - "section_name": "Загрузка файлов и содержимое", - "req_id": "V5.2.6", - "req_description": "Убедитесь, что приложение отклоняет изображения с числом пикселей выше допустимого, чтобы предотвратить атаки 'pixel flood'.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Работа с файлами", - "section_id": "V5.3", - "section_name": "Хранение файлов", - "req_id": "V5.3.1", - "req_description": "Убедитесь, что загруженные или сгенерированные из недоверенного ввода файлы, находящиеся в публичной директории, не исполняются как серверный код при обращении к ним по HTTP.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Работа с файлами", - "section_id": "V5.3", - "section_name": "Хранение файлов", - "req_id": "V5.3.2", - "req_description": "Убедитесь, что при создании путей к файлам приложение использует внутренние или доверенные данные, а не пользовательские имена файлов. Если использование пользовательских имён или метаданных необходимо — требуется строгая проверка и очистка. Это защита от path traversal, LFI, RFI и SSRF.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Работа с файлами", - "section_id": "V5.3", - "section_name": "Хранение файлов", - "req_id": "V5.3.3", - "req_description": "Убедитесь, что при обработке файлов на сервере (например, при распаковке) игнорируются пути, заданные пользователем, во избежание уязвимостей типа 'zip slip'.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Работа с файлами", - "section_id": "V5.4", - "section_name": "Скачивание файлов", - "req_id": "V5.4.1", - "req_description": "Убедитесь, что приложение валидирует или игнорирует имена файлов, переданных пользователем (включая в JSON, JSONP или URL-параметре), и указывает имя файла в заголовке Content-Disposition при ответе.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Работа с файлами", - "section_id": "V5.4", - "section_name": "Скачивание файлов", - "req_id": "V5.4.2", - "req_description": "Убедитесь, что имена файлов, передаваемые (например, в HTTP-заголовках или вложениях в email), кодируются или очищаются (например, по RFC 6266), чтобы сохранить структуру документа и предотвратить инъекции.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Работа с файлами", - "section_id": "V5.4", - "section_name": "Скачивание файлов", - "req_id": "V5.4.3", - "req_description": "Убедитесь, что файлы, полученные из недоверенных источников, сканируются антивирусом, чтобы не распространять известное вредоносное содержимое.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.1", - "section_name": "Документация по аутентификации", - "req_id": "V6.1.1", - "req_description": "Убедитесь, что в документации приложения описано, как используются механизмы, такие как ограничение частоты запросов (rate limiting), защита от автоматизации и адаптивные реакции, для защиты от атак, таких как подстановка учётных данных и перебор паролей. Документация должна ясно описывать конфигурацию этих механизмов и предотвращение злонамеренной блокировки аккаунтов.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.1", - "section_name": "Документация по аутентификации", - "req_id": "V6.1.2", - "req_description": "Убедитесь, что задокументирован список контекстно-зависимых слов, запрещённых к использованию в паролях. В него могут входить производные от названий организаций, продуктов, идентификаторов систем, кодовых названий проектов, названий отделов или ролей и тому подобное.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.1", - "section_name": "Документация по аутентификации", - "req_id": "V6.1.3", - "req_description": "Убедитесь, что если приложение поддерживает несколько способов аутентификации, то все они документированы вместе с описанием применяемых средств защиты и уровнем стойкости аутентификации, которые должны быть одинаково применены ко всем способам.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.2", - "section_name": "Безопасность паролей", - "req_id": "V6.2.1", - "req_description": "Убедитесь, что пользовательские пароли содержат не менее 8 символов. Рекомендуется минимальная длина в 15 символов.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.2", - "section_name": "Безопасность паролей", - "req_id": "V6.2.2", - "req_description": "Убедитесь, что пользователи могут менять свои пароли.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.2", - "section_name": "Безопасность паролей", - "req_id": "V6.2.3", - "req_description": "Убедитесь, что для смены пароля требуется ввести как текущий, так и новый пароль.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.2", - "section_name": "Безопасность паролей", - "req_id": "V6.2.4", - "req_description": "Убедитесь, что при регистрации или смене пароля введённый пароль проверяется по списку как минимум из 3000 самых популярных паролей, соответствующих политике (например, минимальной длине).", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.2", - "section_name": "Безопасность паролей", - "req_id": "V6.2.5", - "req_description": "Убедитесь, что допускаются пароли любой структуры, без ограничений на использование определённых символов. Не должно быть требований по обязательному наличию заглавных/строчных букв, цифр или специальных символов.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.2", - "section_name": "Безопасность паролей", - "req_id": "V6.2.6", - "req_description": "Убедитесь, что поля ввода пароля используют type=password для скрытия символов. Разрешено временное отображение всего пароля или последнего введённого символа.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.2", - "section_name": "Безопасность паролей", - "req_id": "V6.2.7", - "req_description": "Убедитесь, что разрешены вставка (paste), использование менеджеров паролей браузера и внешних менеджеров паролей.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.2", - "section_name": "Безопасность паролей", - "req_id": "V6.2.8", - "req_description": "Убедитесь, что пароль проверяется строго в том виде, в котором он был введён пользователем — без обрезки, изменения регистра и других модификаций.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.2", - "section_name": "Безопасность паролей", - "req_id": "V6.2.9", - "req_description": "Убедитесь, что система позволяет использовать пароли длиной не менее 64 символов.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.2", - "section_name": "Безопасность паролей", - "req_id": "V6.2.10", - "req_description": "Убедитесь, что пароль остаётся действительным, пока не будет скомпрометирован или не будет изменён пользователем. Приложение не должно требовать регулярной смены пароля.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.2", - "section_name": "Безопасность паролей", - "req_id": "V6.2.11", - "req_description": "Убедитесь, что используется документированный список контекстно-зависимых слов (например, названия компаний, проектов и т.д.) для предотвращения использования легко угадываемых паролей.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.2", - "section_name": "Безопасность паролей", - "req_id": "V6.2.12", - "req_description": "Убедитесь, что при регистрации или смене пароля проверяется, не входит ли он в список скомпрометированных (утёкших) паролей.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.3", - "section_name": "Общие требования к безопасности аутентификации", - "req_id": "V6.3.1", - "req_description": "Убедитесь, что реализованы меры защиты от атак типа credential stuffing (массовая подстановка учётных данных) и brute-force (перебор паролей), согласно документации по безопасности приложения.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.3", - "section_name": "Общие требования к безопасности аутентификации", - "req_id": "V6.3.2", - "req_description": "Убедитесь, что в приложении отсутствуют или отключены учётные записи по умолчанию (например, root, admin, sa).", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.3", - "section_name": "Общие требования к безопасности аутентификации", - "req_id": "V6.3.3", - "req_description": "Убедитесь, что для доступа к приложению используется либо механизм многофакторной аутентификации, либо комбинация однофакторных. Для уровня L3 один из факторов должен быть аппаратным, обеспечивающим защиту от фишинга, устойчивость к компрометации и подтверждение намерения аутентификации через явное действие пользователя (например, нажатие кнопки на FIDO-ключе или телефоне). Ослабление этих требований допускается только при наличии обоснования и компенсирующих мер.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.3", - "section_name": "Общие требования к безопасности аутентификации", - "req_id": "V6.3.4", - "req_description": "Убедитесь, что при наличии нескольких способов аутентификации, они все задокументированы, и для них единообразно применяются меры защиты и уровни доверия.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.3", - "section_name": "Общие требования к безопасности аутентификации", - "req_id": "V6.3.5", - "req_description": "Убедитесь, что пользователи получают уведомления о подозрительных попытках аутентификации (удачных и неудачных). Это может включать попытки (например, подключения) с необычного устройства или места, частично успешную MFA, попытку после долгого отсутствия или успешную аутентификацию после серии неудачных.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.3", - "section_name": "Общие требования к безопасности аутентификации", - "req_id": "V6.3.6", - "req_description": "Убедитесь, что email не используется ни как однофакторный, ни как многофакторный механизм аутентификации.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.3", - "section_name": "Общие требования к безопасности аутентификации", - "req_id": "V6.3.7", - "req_description": "Убедитесь, что пользователи получают уведомление при изменении данных аутентификации, таких как сброс пароля или изменение логина/email.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.3", - "section_name": "Общие требования к безопасности аутентификации", - "req_id": "V6.3.8", - "req_description": "Убедитесь, что из сообщений об ошибке, HTTP-кодов ответа или различий во времени ответа нельзя определить, существует ли пользователь с таким логином. Это правило также должно применяться к функциям регистрации и восстановления пароля.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.4", - "section_name": "Жизненный цикл и восстановление факторов аутентификации", - "req_id": "V6.4.1", - "req_description": "Убедитесь, что начальные пароли или коды активации, генерируемые системой, создаются с использованием надёжного генератора случайных чисел, соответствуют текущей политике паролей и истекают через короткий период времени либо после первого использования. Эти секреты не должны использоваться как постоянные пароли.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.4", - "section_name": "Жизненный цикл и восстановление факторов аутентификации", - "req_id": "V6.4.2", - "req_description": "Убедитесь, что в системе отсутствуют подсказки к паролю или вопросы на знание («секретные вопросы»).", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.4", - "section_name": "Жизненный цикл и восстановление факторов аутентификации", - "req_id": "V6.4.3", - "req_description": "Убедитесь, что реализован безопасный процесс сброса забытого пароля, который не обходит активные механизмы многофакторной аутентификации.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.4", - "section_name": "Жизненный цикл и восстановление факторов аутентификации", - "req_id": "V6.4.4", - "req_description": "Убедитесь, что в случае утраты одного из факторов MFA проводится удостоверение личности (identity proofing) на том же уровне, что и при первичной регистрации.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.4", - "section_name": "Жизненный цикл и восстановление факторов аутентификации", - "req_id": "V6.4.5", - "req_description": "Убедитесь, что инструкции по обновлению истекающих механизмов аутентификации отправляются заранее, с достаточным запасом времени для выполнения замены, при необходимости с настройкой автоматических напоминаний.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.4", - "section_name": "Жизненный цикл и восстановление факторов аутентификации", - "req_id": "V6.4.6", - "req_description": "Убедитесь, что администраторы могут инициировать процесс сброса пароля, но не могут задать или выбрать новый пароль за пользователя. Это исключает ситуацию, при которой администратор знает пароль пользователя.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.5", - "section_name": "Общие требования к многофакторной аутентификации", - "req_id": "V6.5.1", - "req_description": "Убедитесь, что lookup-секреты, внеполосные коды/запросы и TOTP-коды можно использовать только один раз.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.5", - "section_name": "Общие требования к многофакторной аутентификации", - "req_id": "V6.5.2", - "req_description": "Убедитесь, что при хранении lookup-секретов с энтропией менее 112 бит (например, 19 случайных буквенно-цифровых символов или 34 случайные цифры) они хэшируются с использованием разрешённого алгоритма хеширования паролей и случайной соли минимум 32 бита. Если у секрета ≥112 бит энтропии — допустимо использовать стандартный хэш.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.5", - "section_name": "Общие требования к многофакторной аутентификации", - "req_id": "V6.5.3", - "req_description": "Убедитесь, что lookup-секреты, коды внеполосной аутентификации и сиды для TOTP генерируются с использованием криптографически стойкого генератора случайных чисел (CSPRNG), чтобы избежать предсказуемых значений.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.5", - "section_name": "Общие требования к многофакторной аутентификации", - "req_id": "V6.5.4", - "req_description": "Убедитесь, что lookup-секреты и внеполосные коды аутентификации имеют минимум 20 бит энтропии (достаточно, например, 4 случайных алфавитно-цифровых символов или 6 случайных цифр).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.5", - "section_name": "Общие требования к многофакторной аутентификации", - "req_id": "V6.5.5", - "req_description": "Убедитесь, что все внеполосные запросы, коды и токены, а также TOTP-коды имеют ограниченный срок действия. Максимум для out-of-band — 10 минут, для TOTP — 30 секунд.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.5", - "section_name": "Общие требования к многофакторной аутентификации", - "req_id": "V6.5.6", - "req_description": "Убедитесь, что любой фактор аутентификации (включая физические устройства) может быть отозван в случае кражи или утери.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.5", - "section_name": "Общие требования к многофакторной аутентификации", - "req_id": "V6.5.7", - "req_description": "Убедитесь, что биометрические механизмы аутентификации используются только как вторичный фактор — в сочетании с «чем-то, что вы знаете» или «чем-то, что у вас есть».", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.5", - "section_name": "Общие требования к многофакторной аутентификации", - "req_id": "V6.5.8", - "req_description": "Убедитесь, что TOTP-коды проверяются по источнику времени, полученному от доверенного сервиса, а не от клиента или недоверенного источника.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.6", - "section_name": "Внеполосные механизмы аутентификации", - "req_id": "V6.6.1", - "req_description": "Убедитесь, что механизмы аутентификации через телефонную сеть общего пользования (PSTN) для доставки одноразовых паролей (OTP) по телефону или SMS используются только в случае предварительной валидации номера, при этом предлагаются альтернативные более безопасные методы (например, TOTP), и пользователю сообщаются риски. Для приложений уровня L3 использование телефона и SMS недопустимо.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.6", - "section_name": "Внеполосные механизмы аутентификации", - "req_id": "V6.6.2", - "req_description": "Убедитесь, что внеполосные запросы, коды или токены привязаны к исходному запросу аутентификации, для которого они были сгенерированы, и не могут быть использованы повторно для других попыток.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.6", - "section_name": "Внеполосные механизмы аутентификации", - "req_id": "V6.6.3", - "req_description": "Убедитесь, что внеполосные механизмы на основе кода защищены от атак методом подбора (brute force) путём применения ограничения частоты запросов (rate limiting). Также рекомендуется использовать коды с энтропией не менее 64 бит.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.6", - "section_name": "Внеполосные механизмы аутентификации", - "req_id": "V6.6.4", - "req_description": "Убедитесь, что при использовании push-уведомлений для MFA применяется ограничение частоты (rate limiting), чтобы предотвратить атаки push-бомбинга. Также может помочь механизм сопоставления номеров (number matching).", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.7", - "section_name": "Криптографические механизмы аутентификации", - "req_id": "V6.7.1", - "req_description": "Убедитесь, что сертификаты, используемые для проверки криптографических утверждений об аутентификации, хранятся таким образом, чтобы исключить возможность их модификации.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.7", - "section_name": "Криптографические механизмы аутентификации", - "req_id": "V6.7.2", - "req_description": "Убедитесь, что nonce (случайная строка), используемая в процессе вызова, имеет длину не менее 64 бит и является статистически уникальной или уникальной на протяжении всего срока службы криптографического устройства.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.8", - "section_name": "Аутентификация с использованием провайдера идентификаций (IdP)", - "req_id": "V6.8.1", - "req_description": "Убедитесь, что при поддержке несколькими IdP, невозможно подделать личность пользователя через другой IdP (например, с тем же user ID). Стандартным способом защиты является регистрация пользователя с использованием сочетания ID самого IdP (в качестве пространства имён) и пользовательского ID внутри IdP.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.8", - "section_name": "Аутентификация с использованием провайдера идентификаций (IdP)", - "req_id": "V6.8.2", - "req_description": "Убедитесь, что наличие и целостность цифровой подписи в утверждениях аутентификации (например, в JWT или SAML) всегда проверяются, а неподписанные или недействительные утверждения отклоняются.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.8", - "section_name": "Аутентификация с использованием провайдера идентификаций (IdP)", - "req_id": "V6.8.3", - "req_description": "Убедитесь, что SAML-утверждения обрабатываются только один раз в течение периода их действия, чтобы исключить атаки воспроизведения (replay attacks).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Аутентификация", - "section_id": "V6.8", - "section_name": "Аутентификация с использованием провайдера идентификаций (IdP)", - "req_id": "V6.8.4", - "req_description": "Убедитесь, что если приложение использует внешний поставщик идентификации (IdP) и для определенных функций требуется особый уровень, метод или срок действия аутентификации, то приложение использует данные, возвращаемые IdP, для проверки этих условий. Например, при использовании OIDC можно проверить значения полей ID Token — acr, amr, auth_time (если они есть). Если IdP не предоставляет эти данные, приложение должно иметь документированный план действий по умолчанию, предполагающий использование минимально допустимой силы аутентификации (например, одноступенчатая — логин и пароль).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.1", - "section_name": "Документация по управлению сессиями", - "req_id": "V7.1.1", - "req_description": "Убедитесь, что тайм-аут бездействия и абсолютное максимальное время жизни сессии задокументированы, соответствуют другим контрольным мерам и сопровождаются обоснованием любых отклонений от требований повторной аутентификации NIST SP 800-63B.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.1", - "section_name": "Документация по управлению сессиями", - "req_id": "V7.1.2", - "req_description": "Убедитесь, что документация определяет допустимое количество одновременных (параллельных) сессий для одного аккаунта, а также поведение системы и действия при достижении этого лимита.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.1", - "section_name": "Документация по управлению сессиями", - "req_id": "V7.1.3", - "req_description": "Убедитесь, что все системы, создающие и управляющие сессиями пользователей в рамках федеративной идентификации (например, SSO), задокументированы вместе с механизмами координации сроков действия сессий, условий завершения и случаев, требующих повторной аутентификации.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.2", - "section_name": "Базовая безопасность сессий", - "req_id": "V7.2.1", - "req_description": "Убедитесь, что все проверки сессионных токенов выполняются на доверенной серверной стороне.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.2", - "section_name": "Базовая безопасность сессий", - "req_id": "V7.2.2", - "req_description": "Убедитесь, что приложение использует либо автономные токены, либо ссылочные токены, которые генерируются динамически, не используя статические API-секреты или ключи.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.2", - "section_name": "Базовая безопасность сессий", - "req_id": "V7.2.3", - "req_description": "Убедитесь, что ссылочные токены являются уникальными, создаются с использованием криптографически безопасного генератора псевдослучайных чисел (CSPRNG) и обладают энтропией не менее 128 бит.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.2", - "section_name": "Базовая безопасность сессий", - "req_id": "V7.2.4", - "req_description": "Убедитесь, что при аутентификации пользователя (включая повторную) создается новый токен сессии, а текущий — аннулируется.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.3", - "section_name": "Тайм-ауты сессии", - "req_id": "V7.3.1", - "req_description": "Убедитесь, что есть тайм-аут бездействия, после которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.3", - "section_name": "Тайм-ауты сессии", - "req_id": "V7.3.2", - "req_description": "Убедитесь, что установлено абсолютное максимальное время жизни сессии, по истечении которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.4", - "section_name": "Завершение сессий", - "req_id": "V7.4.1", - "req_description": "Убедитесь, что после завершения сессии (logout, истечение срока) дальнейшее её использование невозможно. Для ссылочных токенов или сессий с сохранением состояния это означает аннулирование на сервере. Для self-contained токенов необходимо реализовать механизм отзыва, например, список отозванных токенов, проверку времени выпуска или ротацию ключей подписи для каждого пользователя.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.4", - "section_name": "Завершение сессий", - "req_id": "V7.4.2", - "req_description": "Убедитесь, что при удалении или отключении пользователя все активные сессии немедленно завершаются.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.4", - "section_name": "Завершение сессий", - "req_id": "V7.4.3", - "req_description": "Убедитесь, что после изменения или удаления факторов аутентификации (например, смена пароля или MFA) приложение предлагает завершить все другие активные сессии.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.4", - "section_name": "Завершение сессий", - "req_id": "V7.4.4", - "req_description": "Убедитесь, что на всех страницах, требующих аутентификации, имеется простой и видимый способ выхода.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.4", - "section_name": "Завершение сессий", - "req_id": "V7.4.5", - "req_description": "Убедитесь, что администраторы могут завершать активные сессии конкретного пользователя или всех пользователей.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.5", - "section_name": "Защита от злоупотреблений сессией", - "req_id": "V7.5.1", - "req_description": "Убедитесь, что приложение требует полной повторной аутентификации перед изменением чувствительных атрибутов аккаунта, которые могут влиять на аутентификацию (например, email, номер телефона, настройки MFA или данных восстановления доступа).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.5", - "section_name": "Защита от злоупотреблений сессией", - "req_id": "V7.5.2", - "req_description": "Убедитесь, что пользователь может просматривать и (после повторной аутентификации хотя бы по одному фактору) завершать активные сессии.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.5", - "section_name": "Защита от злоупотреблений сессией", - "req_id": "V7.5.3", - "req_description": "Убедитесь, что перед выполнением критически важных операций приложение требует повторной аутентификации (по крайней мере, одного фактора) или дополнительной проверки.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.6", - "section_name": "Федеративная повторная аутентификация", - "req_id": "V7.6.1", - "req_description": "Убедитесь, что срок действия и завершение сессий между RP и IdP соответствуют документации и включают повторную аутентификацию, если достигнут максимальный допустимый интервал между событиями аутентификации.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Управление сессиями", - "section_id": "V7.6", - "section_name": "Федеративная повторная аутентификация", - "req_id": "V7.6.2", - "req_description": "Убедитесь, что создание сессии требует согласия пользователя или явного действия, предотвращающего несанкционированное создание сессий без участия пользователя.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Авторизация", - "section_id": "V8.1", - "section_name": "Документация по авторизации", - "req_id": "V8.1.1", - "req_description": "Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне функций и на уровне данных на основе прав субъекта и атрибутов ресурса.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Авторизация", - "section_id": "V8.1", - "section_name": "Документация по авторизации", - "req_id": "V8.1.2", - "req_description": "Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне полей (как на чтение, так и на запись) на основе прав субъекта и атрибутов ресурса. Эти правила могут зависеть от других атрибутов объекта данных, например, статуса.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Авторизация", - "section_id": "V8.1", - "section_name": "Документация по авторизации", - "req_id": "V8.1.3", - "req_description": "Убедитесь, что документация определяет, какие атрибуты окружения и контекста (например, время суток, IP-адрес, местоположение, устройство) используются приложением для принятия решений в области аутентификации и авторизации.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Авторизация", - "section_id": "V8.1", - "section_name": "Документация по авторизации", - "req_id": "V8.1.4", - "req_description": "Убедитесь, что документация по аутентификации и авторизации определяет, как используются факторы окружения и контекста в принятии решений, наряду с правилами доступа к функциям, данным и полям. Документация должна содержать оцениваемые атрибуты, пороговые значения риска, действия (разрешить, отказать, повысить уровень аутентификации и др.).", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Авторизация", - "section_id": "V8.2", - "section_name": "Архитектура авторизации", - "req_id": "V8.2.1", - "req_description": "Убедитесь, что приложение обеспечивает доступ на уровне функций (function-level) только субъектам с явными разрешениями.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Авторизация", - "section_id": "V8.2", - "section_name": "Архитектура авторизации", - "req_id": "V8.2.2", - "req_description": "Убедитесь, что приложение обеспечивает доступ на уровне данных (data-specific) только тем субъектам, которым явно предоставлены права к определённым элементам данных, чтобы предотвратить IDOR (Insecure Direct Object Reference) и BOLA-уязвимости (Broken Object Level Authorization).", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Авторизация", - "section_id": "V8.2", - "section_name": "Архитектура авторизации", - "req_id": "V8.2.3", - "req_description": "Убедитесь, что приложение обеспечивает доступ на уровне полей (field-level) только тем субъектам, которым явно предоставлены права к определённым полям, чтобы предотвратить BOPLA (Broken Object Property Level Authorization).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Авторизация", - "section_id": "V8.2", - "section_name": "Архитектура авторизации", - "req_id": "V8.2.4", - "req_description": "Убедитесь, что реализованы адаптивные меры безопасности, основанные на атрибутах окружения и контекста субъекта (время, местоположение, IP, устройство), которые используются для принятия решений об аутентификации и авторизации, как это определено в документации приложения. Эти меры должны применяться как при попытке субъекта начать новую сессию, так и во время существующей сессии.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Авторизация", - "section_id": "V8.3", - "section_name": "Авторизация на уровне операций", - "req_id": "V8.3.1", - "req_description": "Убедитесь, что правила авторизации реализуются на доверенном сервисном уровне и не зависят от элементов, которые может контролировать клиент (например, JavaScript на стороне клиента).", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Авторизация", - "section_id": "V8.3", - "section_name": "Авторизация на уровне операций", - "req_id": "V8.3.2", - "req_description": "Убедитесь, что изменения значений, влияющих на авторизацию, применяются немедленно. Если это невозможно (например, при использовании автономных токенов), должны быть реализованы компенсирующие меры: оповещения о попытке несанкционированного действия и откат изменений. Обратите внимание, что данный подход не предотвращает утечку информации.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Авторизация", - "section_id": "V8.3", - "section_name": "Авторизация на уровне операций", - "req_id": "V8.3.3", - "req_description": "Убедитесь, что доступ к объекту осуществляется на основе прав субъекта, инициировавшего запрос, а не прав промежуточного сервиса, действующего от его имени. Например, если пользователь обращается к веб-сервису с автономным токеном для аутентификации, а сервис затем запрашивает данные у другого сервиса, второй сервис должен использовать токен пользователя, а не токен первого сервиса для принятия решения о доступе.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Авторизация", - "section_id": "V8.4", - "section_name": "Прочие аспекты авторизации", - "req_id": "V8.4.1", - "req_description": "Убедитесь, что в мультитенантных приложениях реализованы механизмы, предотвращающие действия потребителя в отношении арендаторов, к которым у него нет доступа.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Авторизация", - "section_id": "V8.4", - "section_name": "Прочие аспекты авторизации", - "req_id": "V8.4.2", - "req_description": "Убедитесь, что доступ к административным интерфейсам защищён несколькими уровнями контроля, включая непрерывную проверку личности, контроль защищённости устройства и анализ контекстных рисков. Недостаточно опираться только на IP-адрес или доверенные устройства.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V9", - "chapter_name": "Автономные токены", - "section_id": "V9.1", - "section_name": "Источник токена и его целостность", - "req_id": "V9.1.1", - "req_description": "Убедитесь, что автономные токены проверяются на целостность с помощью цифровой подписи или MAC, прежде чем доверять их содержимому.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V9", - "chapter_name": "Автономные токены", - "section_id": "V9.1", - "section_name": "Источник токена и его целостность", - "req_id": "V9.1.2", - "req_description": "Проверяйте, что автономные токены создаются и проверяются исключительно с помощью алгоритмов из списка допустимых в данном контексте. Список допустимых алгоритмов должен включать только разрешенные алгоритмы (желательно либо только симметричные, либо только асимметричные) и ни в коем случае не содержать алгоритм None. Если необходимо поддерживать оба типа алгоритмов, потребуются дополнительные средства контроля для предотвращения путаницы с ключами (key confusion).", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V9", - "chapter_name": "Автономные токены", - "section_id": "V9.1", - "section_name": "Источник токена и его целостность", - "req_id": "V9.1.3", - "req_description": "Убедитесь, что ключи, используемые для проверки автономных токенов, получены из доверенных, предварительно настроенных источников. Это предотвращает возможность указания злоумышленниками ненадёжных источников и ключей. Для JWT и других JWS структур заголовки 'jku', 'x5u' и 'jwk' должны проверяться по белому списку.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V9", - "chapter_name": "Автономные токены", - "section_id": "V9.2", - "section_name": "Содержимое токена", - "req_id": "V9.2.1", - "req_description": "Убедитесь, что при указанном сроке действия токен и его содержимое принимаются только в том случае, если срок действия токена не истёк. Например, для JWT нужно проверить поля 'nbf' и 'exp'.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V9", - "chapter_name": "Автономные токены", - "section_id": "V9.2", - "section_name": "Содержимое токена", - "req_id": "V9.2.2", - "req_description": "Убедитесь, что сервис, принимающий токен, проверяет его тип и соответствие назначению перед обработкой содержимого токена. Например, для принятия решений об авторизации могут быть приняты только Access Token, а для подтверждения аутентификации пользователя — только ID Token.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V9", - "chapter_name": "Автономные токены", - "section_id": "V9.2", - "section_name": "Содержимое токена", - "req_id": "V9.2.3", - "req_description": "Убедитесь, что сервис принимает только токены, предназначенные для использования с этим сервисом (audience). Для JWT это можно сделать, проверив наличие утверждения «aud» по белому списку, определенному в сервисе.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V9", - "chapter_name": "Автономные токены", - "section_id": "V9.2", - "section_name": "Содержимое токена", - "req_id": "V9.2.4", - "req_description": "Убедитесь, что, если эмитент токенов использует один и тот же закрытый ключ для выпуска токенов различным сервисам (audiences), выпущенные токены содержат явное указание целевых сервисов. Это предотвратит повторное использования токенов в не предназначенных для них сервисах. Если идентификатор сервиса (audience identifier) назначается динамически, эмитент токенов должен проверить audiences для исключения подмены получателей (audience impersonation).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.1", - "section_name": "Общие требования безопасности OAuth и OIDC", - "req_id": "V10.1.1", - "req_description": "Убедитесь, что токены передаются только тем компонентам, которым они действительно необходимы. Например, при использовании схемы backend-for-frontend для браузерных JavaScript-приложений, access и refresh токены должны быть доступны только на backend.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.1", - "section_name": "Общие требования безопасности OAuth и OIDC", - "req_id": "V10.1.2", - "req_description": "Убедитесь, что клиент принимает значения от авторизационного сервера (например, authorization code или ID Token) только если они получены в результате авторизационного потока, инициированного в той же сессии пользовательского агента и в рамках той же транзакции. Для этого клиентские секреты, такие как proof key для code exchange (PKCE) — 'code_verifier', 'state' или OIDC 'nonce' — должны быть непредсказуемыми, специфичными для транзакции и надежно привязанными как к клиенту, так и к сессии пользовательского агента, в которой началась транзакция.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.2", - "section_name": "Клиент OAuth", - "req_id": "V10.2.1", - "req_description": "Убедитесь, что если используется механизм authorization code flow, OAuth клиент защищён от CSRF, вызывающих запросы токенов либо за счёт использования механизма proof key for code exchange (PKCE), либо за счёт проверки параметра 'state', который был отправлен в запросе авторизации.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.2", - "section_name": "Клиент OAuth", - "req_id": "V10.2.2", - "req_description": "Убедитесь, что если OAuth клиент может взаимодействовать с более чем одним сервером авторизации, у него есть защита от атак смешивания (mix-up attacks). Например, клиент должен требовать, чтобы сервер авторизации возвращал параметр 'iss' и проверять его в ответах на авторизацию и токены.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.2", - "section_name": "Клиент OAuth", - "req_id": "V10.2.3", - "req_description": "Убедитесь, что OAuth клиент запрашивает только необходимые области доступа (scopes) или другие параметры авторизации в запросах к серверу авторизации.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.3", - "section_name": "Сервер ресурсов OAuth", - "req_id": "V10.3.1", - "req_description": "Убедитесь, что сервер ресурсов принимает только те access токены, которые предназначены для использования с этим сервисом (свойство audience). Эта принадлежность сервису может быть включена в структурированный access токен (например, в поле 'aud' в JWT) или проверяться через endpoint интроспекции токена.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.3", - "section_name": "Сервер ресурсов OAuth", - "req_id": "V10.3.2", - "req_description": "Убедитесь, что сервер ресурсов принимает решения по авторизации на основе claims из access токена, определяющих делегированную авторизацию. Если присутствуют claims, такие как 'sub', 'scope' и 'authorization_details', они должны участвовать в принятии решения.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.3", - "section_name": "Сервер ресурсов OAuth", - "req_id": "V10.3.3", - "req_description": "Убедитесь, что если для принятия решения по контролю доступа необходимо однозначно идентифицировать пользователя из access токена (JWT или ответа интроспекции), сервер ресурсов использует claims, которые не могут быть переприсвоены другим пользователям. Обычно это комбинация claims 'iss' и 'sub'.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.3", - "section_name": "Сервер ресурсов OAuth", - "req_id": "V10.3.4", - "req_description": "Убедитесь, что если сервер ресурсов требует определённой силы аутентификации, методов или свежести аутентификации, он проверяет, что предъявленный access токен удовлетворяет этим требованиям. Например, при наличии, могут использоваться claims OIDC 'acr', 'amr' и 'auth_time'.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.3", - "section_name": "Сервер ресурсов OAuth", - "req_id": "V10.3.5", - "req_description": "Убедитесь, что сервер ресурсов предотвращает использование украденных access токенов или их повторное использование (replay) неавторизованными лицами, требуя access токены с подтверждением отправителя — например, Mutual TLS для OAuth 2 или OAuth 2 Demonstration of Proof of Possession (DPoP).", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.4", - "section_name": "Сервер авторизации OAuth", - "req_id": "V10.4.1", - "req_description": "Убедитесь, что сервер авторизации проверяет URI перенаправления (redirect URI), сверяя его с заранее зарегистрированным списком разрешённых URI для данного клиента (allowlist), используя точное сравнение строк.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.4", - "section_name": "Сервер авторизации OAuth", - "req_id": "V10.4.2", - "req_description": "Убедитесь, что если сервер авторизации возвращает authorization code в ответе авторизации, этот код может быть использован только один раз для запроса токена. При втором валидном запросе с уже использованным кодом сервер должен отклонить запрос и отозвать любые токены, связанные с этим кодом.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.4", - "section_name": "Сервер авторизации OAuth", - "req_id": "V10.4.3", - "req_description": "Убедитесь, что authorization code имеет короткое время жизни. Максимальная продолжительность — до 10 минут для приложений L1 и L2 и до 1 минуты для приложений L3.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.4", - "section_name": "Сервер авторизации OAuth", - "req_id": "V10.4.4", - "req_description": "Убедитесь, что сервер авторизации для конкретного клиента разрешает использование только тех типов авторизации, которые необходимы этому клиенту. Обратите внимание, что тип авторизации Implicit flow и Resource Owner Password Credentials flow больше не должны использоваться.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.4", - "section_name": "Сервер авторизации OAuth", - "req_id": "V10.4.5", - "req_description": "Убедитесь, что сервер авторизации предотвращает атаки повторного использования refresh токенов для публичных клиентов, предпочтительно используя sender-constrained refresh токены, такие как DPoP или сертификат-связанные токены с mutual TLS (mTLS). Для L1 и L2 допускается ротация refresh токенов с обязательной их инвалидацией после использования. Если используется ротация, сервер должен отозвать все refresh токены при попытке использовать уже инвалидированный токен.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.4", - "section_name": "Сервер авторизации OAuth", - "req_id": "V10.4.6", - "req_description": "Убедитесь, что при использовании типа авторизации «Authorization Code» сервер предотвращает атаки перехвата authorization code, требуя Proof Key for Code Exchange (PKCE). В запросах авторизации сервер должен требовать валидное значение 'code_challenge' и не принимать 'code_challenge_method' со значением 'plain'. В запросах токена обязательно валидировать параметр 'code_verifier'.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.4", - "section_name": "Сервер авторизации OAuth", - "req_id": "V10.4.7", - "req_description": "Убедитесь, что если сервер авторизации поддерживает динамическую регистрацию клиентов без аутентификации, он минимизирует риски вредоносных клиентов. Сервер должен валидировать метаданные клиента (например, зарегистрированные URI), обеспечивать согласие пользователя и предупреждать пользователя перед обработкой запроса авторизации от недоверенного клиента.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.4", - "section_name": "Сервер авторизации OAuth", - "req_id": "V10.4.8", - "req_description": "Убедитесь, что refresh токены имеют абсолютный срок действия, включая случаи, когда применяется скользящее время истечения срока.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.4", - "section_name": "Сервер авторизации OAuth", - "req_id": "V10.4.9", - "req_description": "Убедитесь, что пользователи могут отзывать refresh токены и reference access токены через пользовательский интерфейс сервера авторизации для снижения риска от вредоносных клиентов или кражи токенов.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.4", - "section_name": "Сервер авторизации OAuth", - "req_id": "V10.4.10", - "req_description": "Убедитесь, что конфиденциальный клиент аутентифицируется при взаимодействии с сервером авторизации через backchannel, например при запросах токена, pushed authorization requests (PAR) и запросах на отзыв токенов.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.4", - "section_name": "Сервер авторизации OAuth", - "req_id": "V10.4.11", - "req_description": "Убедитесь, что конфигурация сервера авторизации назначает OAuth клиенту только необходимые области доступа (scopes).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.4", - "section_name": "Сервер авторизации OAuth", - "req_id": "V10.4.12", - "req_description": "Убедитесь, что для конкретного клиента сервер авторизации разрешает только те значения 'response_mode', которые необходимы этому клиенту. Например, сервер должен валидировать это значение против ожидаемых или использовать pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.4", - "section_name": "Сервер авторизации OAuth", - "req_id": "V10.4.13", - "req_description": "Убедитесь, что грант типа 'code' всегда используется вместе с pushed authorization requests (PAR).", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.4", - "section_name": "Сервер авторизации OAuth", - "req_id": "V10.4.14", - "req_description": "Убедитесь, что сервер авторизации выдаёт только sender-constrained (Proof-of-Possession) access токены, либо с сертификат-связанными токенами через mutual TLS (mTLS), либо DPoP-bound токены (Demonstration of Proof of Possession).", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.4", - "section_name": "Сервер авторизации OAuth", - "req_id": "V10.4.15", - "req_description": "Убедитесь, что для серверного клиента (не выполняющегося на устройстве конечного пользователя) сервер авторизации проверяет, что значение параметра 'authorization_details' исходит из клиентского backend и что пользователь не изменял его. Например, это достигается использованием pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.4", - "section_name": "Сервер авторизации OAuth", - "req_id": "V10.4.16", - "req_description": "Убедитесь, что клиент является конфиденциальным и сервер авторизации требует использования сильных методов аутентификации клиента (основанных на криптографии с открытым ключом и устойчивых к атакам повторного воспроизведения), таких как mutual TLS ('tls_client_auth', 'self_signed_tls_client_auth') или private key JWT ('private_key_jwt').", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.5", - "section_name": "Клиент OIDC", - "req_id": "V10.5.1", - "req_description": "Убедитесь, что клиент (relying party) защищается от повторного использования ID Token (replay-атак). Например, это достигается проверкой того, что значение 'nonce' в ID Token совпадает со значением 'nonce', отправленным в запросе аутентификации провайдеру OpenID (authorization server).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.5", - "section_name": "Клиент OIDC", - "req_id": "V10.5.2", - "req_description": "Убедитесь, что клиент однозначно идентифицирует пользователя по утверждениям (claims) ID Token, обычно это 'sub', который не может быть переназначен другому пользователю (в пределах конкретного провайдера идентификации).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.5", - "section_name": "Клиент OIDC", - "req_id": "V10.5.3", - "req_description": "Убедитесь, что клиент отклоняет попытки злоумышленного сервера авторизации выдавать себя за другой сервер авторизации через метаданные сервера авторизации. Клиент должен отклонить метаданные, если URL издателя (issuer) в метаданных не совпадает точно с преднастроенным URL издателя, ожидаемым клиентом.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.5", - "section_name": "Клиент OIDC", - "req_id": "V10.5.4", - "req_description": "Убедитесь, что клиент проверяет, что ID Token предназначен для него (проверка audience), сравнивая значение 'aud' в токене с 'client_id' клиента.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.5", - "section_name": "Клиент OIDC", - "req_id": "V10.5.5", - "req_description": "Убедитесь, что при использовании OIDC back-channel logout клиент снижает риск отказа в обслуживании, вызванный принудительным выходом из системы и путаницей между разными типами JWT (cross-JWT confusion) в процессе логаута. Клиент должен проверить, что токен выхода корректно типизирован со значением 'logout+jwt', содержит claim 'event' с правильным именем участника и не содержит 'nonce'. Также рекомендуется установить короткий срок действия токена (например, 2 минуты).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.6", - "section_name": "Провайдер OpenID", - "req_id": "V10.6.1", - "req_description": "Убедитесь, что провайдер OpenID допускает только значения 'code', 'ciba', 'id_token' или 'id_token code' для параметра response mode. При этом предпочтение отдаётся 'code' по сравнению с 'id_token code' (гибридный поток OIDC), а значение 'token' (любой Implicit flow) не должно использоваться.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.6", - "section_name": "Провайдер OpenID", - "req_id": "V10.6.2", - "req_description": "Убедитесь, что провайдер OpenID предотвращает отказ в обслуживании (DoS) через принудительный выход (logout), запрашивая явное подтверждение от конечного пользователя или, если применимо, проверяя параметры в запросе выхода (инициированном relying party), например параметр 'id_token_hint'.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.7", - "section_name": "Управление согласием", - "req_id": "V10.7.1", - "req_description": "Убедитесь, что авторизационный сервер обеспечивает получение согласия пользователя для каждого запроса авторизации. Если личность клиента не может быть подтверждена, сервер авторизации всегда должен явно запрашивать согласие пользователя.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.7", - "section_name": "Управление согласием", - "req_id": "V10.7.2", - "req_description": "Убедитесь, что при запросе согласия пользователя авторизационный сервер предоставляет достаточную и понятную информацию о том, на что даётся согласие. При необходимости это должно включать характер запрашиваемых разрешений (обычно основанных на scope, ресурсном сервере, деталях авторизации Rich Authorization Requests (RAR)), идентификацию авторизованного приложения и срок действия этих разрешений.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth и OIDC", - "section_id": "V10.7", - "section_name": "Управление согласием", - "req_id": "V10.7.3", - "req_description": "Убедитесь, что пользователь может просматривать, изменять и отзывать согласия, которые он предоставил, через авторизационный сервер.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.1", - "section_name": "Инвентаризация и документирование криптографии", - "req_id": "V11.1.1", - "req_description": "Убедитесь, что задокументирована политика управления криптографическими ключами и описан их жизненный цикл в соответствии со стандартом управления ключей, таким как NIST SP 800-57. Убедитесь, что ключи известны только тем сущностям, которым они должны быть доступны (например, ключи не передавались более чем двум участникам для общих секретов и более чем одному участнику для приватных ключей).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.1", - "section_name": "Инвентаризация и документирование криптографии", - "req_id": "V11.1.2", - "req_description": "Убедитесь, что проводится инвентаризация криптографических средств, которая непрерывно поддерживается, регулярно обновляется и включает все криптографические ключи, алгоритмы и сертификаты, используемые в приложении. Также должна быть задокументирована информация о том, где ключи могут и не могут использоваться в системе, а также какие типы данных могут и не могут быть защищены с помощью этих ключей.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.1", - "section_name": "Инвентаризация и документирование криптографии", - "req_id": "V11.1.3", - "req_description": "Убедитесь, что используются механизмы обнаружения криптографии для идентификации всех случаев применения криптографии в системе , включая операции шифрования, хеширования и цифровой подписи.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.1", - "section_name": "Инвентаризация и документирование криптографии", - "req_id": "V11.1.4", - "req_description": "Убедитесь, что ведётся и поддерживается инвентаризация криптографических средств. В неё должен входить документированный план, описывающий переход на новые криптографические стандарты, такие как постквантовая криптография, чтобы своевременно реагировать на будущие угрозы.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.2", - "section_name": "Безопасная реализация криптографии", - "req_id": "V11.2.1", - "req_description": "Убедитесь, что для криптографических операций используются утвержденные в индустрии реализации (включая библиотеки и аппаратные реализации).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.2", - "section_name": "Безопасная реализация криптографии", - "req_id": "V11.2.2", - "req_description": "Убедитесь, что архитектура приложения поддерживает быструю реконфигурацию, усовершенствование или смену в любой момент случайных чисел, аутентифицированного шифрования, MAC, алгоритмов хеширования, длин ключей, количества раундов, шифров и режимов шифрования для защиты от криптографических атак. Также должна поддерживаться возможность смены ключей, паролей и повторного шифрования данных. Это позволит беспрепятственно перейти на постквантовую криптографию (PQC), как только станут широко доступны высоконадёжные реализации одобренных схем или стандартов PQC.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.2", - "section_name": "Безопасная реализация криптографии", - "req_id": "V11.2.3", - "req_description": "Убедитесь, что все криптографические примитивы используют как минимум 128-бит стойкости с учетом алгоритма, размера ключа и конфигурации. Например, 256-битный ECC ключ обеспечивает примерно 128 бит безопасности, тогда как для достижения того же уровня безопасности в RSA требуется ключ длиной 3072 бита.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.2", - "section_name": "Безопасная реализация криптографии", - "req_id": "V11.2.4", - "req_description": "Убедитесь, что все криптографические операции выполняются за константное время, без использования «short-circuit» операций в сравнениях, вычислениях, возвратах функций для избежания утечек информации.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.2", - "section_name": "Безопасная реализация криптографии", - "req_id": "V11.2.5", - "req_description": "Убедитесь, что все криптографические модули обеспечивают безопасное завершение работы при ошибках, а обработка ошибок реализована таким образом, чтобы не создавать уязвимостей, например, таких как атаки Padding Oracle.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.3", - "section_name": "Алгоритмы шифрования", - "req_id": "V11.3.1", - "req_description": "Убедитесь, что не используются небезопасные режимы блочного шифрования (н-р, ECB) и слабые схемы дополнения (padding) (н-р, PKCS#1 v1.5).", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.3", - "section_name": "Алгоритмы шифрования", - "req_id": "V11.3.2", - "req_description": "Убедитесь, что используются только утверждённые шифры и режимы, такие как AES с GCM.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.3", - "section_name": "Алгоритмы шифрования", - "req_id": "V11.3.3", - "req_description": "Убедитесь, что зашифрованные данные защищены от несанкционированного изменения, предпочтительно с использованием утверждённого метода аутентифицированного шифрования или путём комбинирования утверждённого метода шифрования с утверждённым алгоритмом MAC.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.3", - "section_name": "Алгоритмы шифрования", - "req_id": "V11.3.4", - "req_description": "Убедитесь, что случайные числа (nonce), векторы инициализации (IV) и другие одноразовые числа не используются более одного раза для одной и той же пары ключа шифрования и элемента данных. Метод их генерации должен соответствовать требованиям используемого алгоритма.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.3", - "section_name": "Алгоритмы шифрования", - "req_id": "V11.3.5", - "req_description": "Убедитесь, что любая комбинация алгоритма шифрования и алгоритма MAC работает в режиме encrypt-then-MAC (EtM).", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.4", - "section_name": "Хеширование и функции на основе хеширования", - "req_id": "V11.4.1", - "req_description": "Убедитесь, что только утвержденные хэш-функции используются для стандартных сценариев использования в криптографии, включая цифровую подпись, HMAC, KDF, генерацию случайных чисел. Запрещено использовать неустойчивые хэш-функции, (н-р, MD5) для любого использования в криптографии.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.4", - "section_name": "Хеширование и функции на основе хеширования", - "req_id": "V11.4.2", - "req_description": "Убедитесь, что пароли хранятся с использованием утверждённой, вычислительно затратной функции генерации ключа (также известной как «функция хеширования паролей»), с параметрами, настроенными в соответствии с актуальными рекомендациями. Настройки должны обеспечивать баланс между безопасностью и производительностью, чтобы сделать атаки перебором достаточно сложными для требуемого уровня безопасности.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.4", - "section_name": "Хеширование и функции на основе хеширования", - "req_id": "V11.4.3", - "req_description": "Убедитесь, что хэш-функции, используемые в формировании цифровой подписи, как часть аутентификации и целостности данных, устойчивы к коллизиям и имеют достаточную длину.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.4", - "section_name": "Хеширование и функции на основе хеширования", - "req_id": "V11.4.4", - "req_description": "Убедитесь, что приложение использует утвержденную функцию генерации ключа с использованием параметров расширения ключа (key stretching) при генерации ключа из пароля. Параметры должны быть сбалансированы с точки зрения безопасности, производительности и устойчивости к атакам полного перебора при компрометации результирующего криптографического ключа.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.5", - "section_name": "Случайные значения", - "req_id": "V11.5.1", - "req_description": "Убедитесь, что все случайные числа и строки, которые должны быть непредсказуемы, должны быть сгенерированы с помощью CSPRNG и иметь хотя бы 128 бит энтропии. Учтите, что UUID не удовлетворяют данному условию.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.5", - "section_name": "Случайные значения", - "req_id": "V11.5.2", - "req_description": "Убедитесь, что механизм генерации случайных чисел является надежным даже при высокой нагрузке.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.6", - "section_name": "Криптография с публичным ключом", - "req_id": "V11.6.1", - "req_description": "Убедитесь, что только утвержденные криптографические алгоритмы и режимы операций используются для генерации ключа и инициализации случайного значения для его генерации (seeding), а также для генерации цифровой подписи и верификации. Алгоритмы генерации ключей не должны генерировать небезопасные ключи уязвимые к известным атакам, например, ключи RSA уязвимы к факторизации Ферма.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.6", - "section_name": "Криптография с публичным ключом", - "req_id": "V11.6.2", - "req_description": "Убедитесь, что для обмена ключами используются утверждённые криптографические алгоритмы (например, Диффи-Хеллман) с особым вниманием к обеспечению использования безопасных параметров. Это предотвратит атаки на процесс установления ключа, которые могут привести к атакам «человек посередине» или криптографическим взломам.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.7", - "section_name": "Шифрование данных в процессе использования", - "req_id": "V11.7.1", - "req_description": "Убедитесь, что используется полное шифрование памяти, которое защищает конфиденциальные данные во время их использования, предотвращая доступ к ним неавторизованных пользователей или процессов.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Криптография", - "section_id": "V11.7", - "section_name": "Шифрование данных в процессе использования", - "req_id": "V11.7.2", - "req_description": "Убедитесь, что минимизация данных обеспечивает раскрытие минимально необходимого объёма данных во время обработки, а также что данные шифруются сразу после использования или как можно скорее.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Безопасная коммуникация", - "section_id": "V12.1", - "section_name": "Общие рекомендации по безопасности TLS", - "req_id": "V12.1.1", - "req_description": "Убедитесь, что включены только актуальные и рекомендуемые версии протокола TLS, такие как TLS 1.2 и TLS 1.3. Наиболее свежая версия TLS должна быть выбрана как предпочтительная.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Безопасная коммуникация", - "section_id": "V12.1", - "section_name": "Общие рекомендации по безопасности TLS", - "req_id": "V12.1.2", - "req_description": "Убедитесь, что включены рекомендуемые шифронаборы (cipher suites), предпочтение также стоит отдать самому сильному шифронабору. L3 приложения должны поддерживать только те наборы шифров (cipher suites), которые обеспечивают прямую (forward) секретность. Пояснение: Прямая секретность (Forward Secrecy, FS) — это криптографическая особенность, при которой сессионные ключи уникальны для каждой сессии и не зависят от долгосрочных ключей. Это гарантирует, что даже при компрометации долгосрочного ключа злоумышленник не сможет расшифровать ранее перехваченные зашифрованные сессии.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Безопасная коммуникация", - "section_id": "V12.1", - "section_name": "Общие рекомендации по безопасности TLS", - "req_id": "V12.1.3", - "req_description": "Убедитесь, что приложение проверяет доверенность клиентских сертификатов mTLS, прежде чем использовать идентификацию по сертификату для аутентификации или авторизации.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Безопасная коммуникация", - "section_id": "V12.1", - "section_name": "Общие рекомендации по безопасности TLS", - "req_id": "V12.1.4", - "req_description": "Убедитесь, что включена и настроена правильная проверка отзыва сертификатов, такая как Online Certificate Status Protocol (OCSP) Stapling.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Безопасная коммуникация", - "section_id": "V12.1", - "section_name": "Общие рекомендации по безопасности TLS", - "req_id": "V12.1.5", - "req_description": "Убедитесь, что в настройках TLS приложения включена функция Encrypted Client Hello (ECH) для предотвращения раскрытия конфиденциальных метаданных, таких как Server Name Indication (SNI), во время процесса TLS-рукопожатия.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Безопасная коммуникация", - "section_id": "V12.2", - "section_name": "HTTPS коммуникация с внешними сервисами", - "req_id": "V12.2.1", - "req_description": "Убедитесь, что для всех соединений между клиентом и внешними HTTP-сервисами используется TLS и не происходит отката к небезопасным или незашифрованным протоколам.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Безопасная коммуникация", - "section_id": "V12.2", - "section_name": "HTTPS коммуникация с внешними сервисами", - "req_id": "V12.2.2", - "req_description": "Убедитесь, что внешние сервисы используют публично доверенные TLS-сертификаты.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Безопасная коммуникация", - "section_id": "V12.3", - "section_name": "Общая безопасность межсервисного взаимодействия", - "req_id": "V12.3.1", - "req_description": "Убедитесь, что для всех входящих и исходящих соединений приложения используется зашифрованный протокол, например TLS, включая системы мониторинга, инструменты управления, удалённый доступ и SSH, промежуточное ПО, базы данных, мейнфреймы, партнёрские системы и внешние API. Сервер не должен допускать откат к небезопасным или незашифрованным протоколам.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Безопасная коммуникация", - "section_id": "V12.3", - "section_name": "Общая безопасность межсервисного взаимодействия", - "req_id": "V12.3.2", - "req_description": "Убедитесь, что TLS-клиент проверяет сертификат сервера до установления защищенного соединения с TLS-сервером.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Безопасная коммуникация", - "section_id": "V12.3", - "section_name": "Общая безопасность межсервисного взаимодействия", - "req_id": "V12.3.3", - "req_description": "Убедитесь, что все внутренние HTTP-взаимодействия между компонентами приложения используют TLS или другой подходящий механизм транспортного шифрования, и не происходит откат к небезопасным или незашифрованным коммуникациям.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Безопасная коммуникация", - "section_id": "V12.3", - "section_name": "Общая безопасность межсервисного взаимодействия", - "req_id": "V12.3.4", - "req_description": "Убедитесь, что TLS-соединения между внутренними сервисами используют доверенные сертификаты. Если используются внутренние или самоподписанные сертификаты, потребляющий сервис должен быть настроен на доверие только к конкретным внутренним центрам сертификации (CA) и конкретным самоподписанным сертификатам.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Безопасная коммуникация", - "section_id": "V12.3", - "section_name": "Общая безопасность межсервисного взаимодействия", - "req_id": "V12.3.5", - "req_description": "Убедитесь, что сервисы, взаимодействующие внутри системы (intra-service communications), используют строгую аутентификацию для проверки каждого конечного узла. Для проверки подлинности взаимодействующих сторон должны применяться методы строгой аутентификации, такие как аутентификация TLS-клиента, с использованием инфраструктуры открытых ключей и механизмов, устойчивых к атакам повтора (replay attacks). Для микросервисных архитектур рекомендуется использование service mesh для упрощения управления сертификатами и повышения безопасности.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.1", - "section_name": "Документация конфигурации", - "req_id": "V13.1.1", - "req_description": "Убедитесь, что все необходимые доступы приложения задокументированы. Сюда должны быть включены как внешние сервисы, от которых зависит приложение, так и сценарии, когда конечный пользователь может задавать адреса для внешнего подключения.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.1", - "section_name": "Документация конфигурации", - "req_id": "V13.1.2", - "req_description": "Убедитесь, что для каждого сервиса, используемого приложением, в документации определено максимальное количество одновременных соединений (например, лимиты пула соединений) и описано поведение приложения при достижении этого лимита, включая любые механизмы отказоустойчивости или восстановления, чтобы предотвратить ситуации отказа в обслуживании (DoS).", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.1", - "section_name": "Документация конфигурации", - "req_id": "V13.1.3", - "req_description": "Убедитесь, что в документации приложения определены стратегии управления ресурсами для каждой внешней системы или сервиса, которые оно использует (например, базы данных, файловые дескрипторы, потоки, HTTP-соединения). Стратегии должны включать процедуры освобождения ресурсов, настройки таймаутов, обработку сбоев, а также, если реализована логика повторных попыток, указание лимитов, задержек и алгоритмов back-off. Для синхронных HTTP-запросов должны быть заданы короткие таймауты, а повторные запросы должны быть отключены, либо строго ограничены по числу попыток, чтобы предотвратить каскадные задержки и истощение ресурсов.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.1", - "section_name": "Документация конфигурации", - "req_id": "V13.1.4", - "req_description": "Убедитесь, что в документации приложения определены секреты, критически важные для безопасности приложения, а также установлен график их ротации в соответствии с моделью угроз организации и её бизнес-требованиями.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.2", - "section_name": "Конфигурация бэкенд соединений", - "req_id": "V13.2.1", - "req_description": "Убедитесь, что коммуникации между компонентами бэкенда приложения (включая API, промежуточное ПО и уровни данных), которые не поддерживают стандартный механизм пользовательских сессий, проходят с аутентификацией. Аутентификация должна использовать индивидуальные сервисные аккаунты, краткосрочные токены или аутентификацию на основе сертификатов, а не постоянные учётные данные, такие как пароли, API-ключи или общие аккаунты с привилегированным доступом.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.2", - "section_name": "Конфигурация бэкенд соединений", - "req_id": "V13.2.2", - "req_description": "Убедитесь, что коммуникации между компонентами бэкенда приложения, включая локальные или системные службы, API, промежуточное ПО и уровни данных, выполняются с использованием аккаунтов, которым назначены минимально необходимые привилегии.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.2", - "section_name": "Конфигурация бэкенд соединений", - "req_id": "V13.2.3", - "req_description": "Убедитесь, что если для аутентификации в сервисе используются учётные данные, то используемые потребителем учётные данные не являются стандартными (например, root/root или admin/admin).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.2", - "section_name": "Конфигурация бэкенд соединений", - "req_id": "V13.2.4", - "req_description": "Убедитесь, что используется белый список (allowlist) для определения внешних ресурсов или систем, с которыми приложению разрешено взаимодействовать (например, для исходящих запросов, загрузки данных или доступа к файлам). Этот белый список может быть реализован на уровне приложения, веб-сервера, межсетевого экрана или комбинации различных уровней.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.2", - "section_name": "Конфигурация бэкенд соединений", - "req_id": "V13.2.5", - "req_description": "Убедитесь, что веб- или прикладной сервер настроен с белым списком ресурсов или систем, к которым сервер может отправлять запросы или из которых может загружать данные и файлы.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.2", - "section_name": "Конфигурация бэкенд соединений", - "req_id": "V13.2.6", - "req_description": "Убедитесь, что при подключении приложения к другим сервисам соблюдается задокументированная конфигурация для каждого соединения, включая максимальное количество параллельных соединений, поведение при достижении их максимума, таймауты и стратегии повторных попыток подключения.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.3", - "section_name": "Управление секретами", - "req_id": "V13.3.1", - "req_description": "Убедитесь, что для безопасного создания, хранения, контроля доступа и уничтожения секретов бэкенда используется решение для управления секретами, например, хранилище ключей (key vault). Секретами могут быть пароли, ключевой материал, интеграции с базами данных и сторонними системами, ключи и seed-значения для токенов с ограниченным временем действия, другие внутренние секреты и API-ключи. Секреты не должны включаться в исходный код приложения или артефакты сборки. Для приложений уровня L3 необходимо использовать аппаратное решение, например, аппаратный модуль безопасности (HSM).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.3", - "section_name": "Управление секретами", - "req_id": "V13.3.2", - "req_description": "Убедитесь, что доступ к секретным ресурсам осуществляется в соответствии с принципом минимально необходимых привилегий (least privilege).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.3", - "section_name": "Управление секретами", - "req_id": "V13.3.3", - "req_description": "Убедитесь, что все криптографические операции выполняются с использованием изолированного модуля безопасности (например, хранилища ключей или аппаратного модуля безопасности), чтобы надежно управлять ключевым материалом и защищать его от утечки за пределы модуля безопасности.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.3", - "section_name": "Управление секретами", - "req_id": "V13.3.4", - "req_description": "Убедитесь, что секреты настроены на срок действия и ротацию в соответствии с документацией приложения.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.4", - "section_name": "Непреднамеренная утечка информации", - "req_id": "V13.4.1", - "req_description": "Убедитесь, что приложение развернуто либо без метаданных систем контроля версий (включая папки .git или .svn), либо так, чтобы эти папки были недоступны как извне, так и для самого приложения.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.4", - "section_name": "Непреднамеренная утечка информации", - "req_id": "V13.4.2", - "req_description": "Убедитесь, что режимы отладки отключены для всех компонентов в промышленной среде, чтобы предотвратить раскрытие функций отладки и утечку информации.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.4", - "section_name": "Непреднамеренная утечка информации", - "req_id": "V13.4.3", - "req_description": "Убедитесь, что веб-серверы не показывают клиентам списки содержимого каталогов, если это явно не предусмотрено.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.4", - "section_name": "Непреднамеренная утечка информации", - "req_id": "V13.4.4", - "req_description": "Убедитесь, что метод HTTP TRACE не поддерживается в продуктовой среде, чтобы избежать потенциальной утечки информации.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.4", - "section_name": "Непреднамеренная утечка информации", - "req_id": "V13.4.5", - "req_description": "Убедитесь, что документация (например, по внутренним API) и мониторинговые эндпоинты не доступны, если это явно не предусмотрено.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.4", - "section_name": "Непреднамеренная утечка информации", - "req_id": "V13.4.6", - "req_description": "Убедитесь, что приложение не раскрывает подробную информацию о версиях компонентов бэкенда.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Конфигурация", - "section_id": "V13.4", - "section_name": "Непреднамеренная утечка информации", - "req_id": "V13.4.7", - "req_description": "Убедитесь, что веб-слой настроен на обслуживание только файлов с определёнными расширениями, чтобы предотвратить непреднамеренную утечку информации, конфигураций и исходного кода.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Защита информации", - "section_id": "V14.1", - "section_name": "Документация по защите информации", - "req_id": "V14.1.1", - "req_description": "Убедитесь, что все конфиденциальные данные, создаваемые и обрабатываемые приложением, идентифицированы и классифицированы по уровням защиты. Включая закодированные данные, которые легко декодируются, например, строки Base64 или незашифрованные данные в полезной нагрузке JWT. Уровни защиты должны учитывать требования по защите данных и конфиденциальности, которым должно соответствовать приложение.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Защита информации", - "section_id": "V14.1", - "section_name": "Документация по защите информации", - "req_id": "V14.1.2", - "req_description": "Убедитесь, что для каждого уровня защиты конфиденциальных данных требования к защите задокументированы. Они должны включать (но не ограничиваться) требования по шифрованию, проверке целостности, срокам хранения, способам логирования данных, контролю доступа к чувствительным данным в логах, шифрованию на уровне базы данных, применению технологий повышения конфиденциальности, а также другим требованиям по конфиденциальности.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Защита информации", - "section_id": "V14.2", - "section_name": "Базовые меры по защите информации", - "req_id": "V14.2.1", - "req_description": "Убедитесь, что конфиденциальные данные передаются на сервер только в теле HTTP-запроса или в заголовках. URL и строка запроса не должны содержать конфиденциальную информацию, такую как API-ключ или сессионный токен.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Защита информации", - "section_id": "V14.2", - "section_name": "Базовые меры по защите информации", - "req_id": "V14.2.2", - "req_description": "Убедитесь, что приложение предотвращает кэширование конфиденциальных данных в серверных компонентах, таких как балансировщики нагрузки и кэши приложений, либо гарантирует их надежное удаление после использования.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Защита информации", - "section_id": "V14.2", - "section_name": "Базовые меры по защите информации", - "req_id": "V14.2.3", - "req_description": "Убедитесь, что заранее определённые конфиденциальные данные не отправляются ненадёжным сторонам (например, системам трекинга пользователей), чтобы предотвратить нежелательный сбор данных вне контроля приложения.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Защита информации", - "section_id": "V14.2", - "section_name": "Базовые меры по защите информации", - "req_id": "V14.2.4", - "req_description": "Убедитесь, что для конфиденциальных данных реализованы меры по шифрованию, проверке целостности, срокам хранения, способам логирования, контролю доступа к данным в логах, а также применяются технологии повышения конфиденциальности в соответствии с документацией для соответствующего уровня защиты данных.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Защита информации", - "section_id": "V14.2", - "section_name": "Базовые меры по защите информации", - "req_id": "V14.2.5", - "req_description": "Убедитесь, что механизмы кэширования настроены так, чтобы кэшировать только ответы с ожидаемым типом содержимого для данного ресурса и не содержать конфиденциального динамического контента. При обращении к несуществующему файлу, веб-сервер должен возвращать ответ 404 или 302, а не подменять на другой существующий файл, что позволит предотвратить атаки типа Web Cache Deception.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Защита информации", - "section_id": "V14.2", - "section_name": "Базовые меры по защите информации", - "req_id": "V14.2.6", - "req_description": "Убедитесь, что приложение возвращает только минимально необходимый объем конфиденциальных данных для выполнения своей функциональности. Например, показывает только часть цифр номера кредитной карты, а не полный номер. Если требуется отображение полных данных, они должны быть замаскированы в пользовательском интерфейсе, пока пользователь специально не запросил их просмотр.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Защита информации", - "section_id": "V14.2", - "section_name": "Базовые меры по защите информации", - "req_id": "V14.2.7", - "req_description": "Убедитесь, что конфиденциальная информация подлежит классификации по срокам хранения, чтобы устаревшие или ненужные данные удалялись автоматически, по расписанию или по мере необходимости.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Защита информации", - "section_id": "V14.2", - "section_name": "Базовые меры по защите информации", - "req_id": "V14.2.8", - "req_description": "Убедитесь, что конфиденциальная информация удаляется из метаданных файлов, загружаемых пользователями, если пользователь явно не согласился на ее хранение.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Защита информации", - "section_id": "V14.3", - "section_name": "Защита данных на стороне клиента", - "req_id": "V14.3.1", - "req_description": "Убедитесь, что аутентифицированные данные очищаются из клиентского хранилища, например, из DOM браузера, после завершения работы клиента или сессии. Заголовок HTTP-ответа Clear-Site-Data может помочь в этом, но клиентская сторона также должна уметь очищать данные, если соединение с сервером недоступно при завершении сессии.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Защита информации", - "section_id": "V14.3", - "section_name": "Защита данных на стороне клиента", - "req_id": "V14.3.2", - "req_description": "Убедитесь, что приложение устанавливает HTTP-заголовки, достаточные для предотвращения кэширования (например, Cache-Control: no-store), чтобы конфиденциальные данные не сохранялись в браузерах.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Защита информации", - "section_id": "V14.3", - "section_name": "Защита данных на стороне клиента", - "req_id": "V14.3.3", - "req_description": "Убедитесь, что данные, хранящиеся в браузерном хранилище (например, localStorage, sessionStorage, IndexedDB или cookie), не содержат конфиденциальной информации, за исключением сессионных токенов.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.1", - "section_name": "Документация по безопасной разработке и архитектуре", - "req_id": "V15.1.1", - "req_description": "Убедитесь, что в документации по приложению определены сроки устранения уязвимостей на основе оценки рисков для внешних зависимостей с уязвимостями и для обновления библиотек в целом, чтобы минимизировать риск, связанный с этими компонентами.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.1", - "section_name": "Документация по безопасной разработке и архитектуре", - "req_id": "V15.1.2", - "req_description": "Убедитесь, что ведется реестр всех используемых сторонних библиотек (например, Software Bill of Materials, SBOM), с обязательной проверкой, что компоненты получены из предопределенных, доверенных и регулярно поддерживаемых репозиториев.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.1", - "section_name": "Документация по безопасной разработке и архитектуре", - "req_id": "V15.1.3", - "req_description": "Убедитесь, что в документации приложения указан функционал, требующий значительных временных или вычислительных ресурсов. Необходимо указать, как предотвратить потерю доступности из-за чрезмерного использования этого функционала и как избежать ситуаций, когда формирование ответа занимает больше времени, чем установленный системой таймаут. Возможные меры защиты могут включать асинхронную обработку, использование очередей и ограничение количества параллельных процессов для каждого пользователя и приложения.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.1", - "section_name": "Документация по безопасной разработке и архитектуре", - "req_id": "V15.1.4", - "req_description": "Убедитесь, что в документации приложения указаны внешние библиотеки, которые считаются «компонентами с повышенным риском».", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.1", - "section_name": "Документация по безопасной разработке и архитектуре", - "req_id": "V15.1.5", - "req_description": "Убедитесь, что в документации приложения выделены те части приложения, в которых используются «функционал с повышенным риском».", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.2", - "section_name": "Архитектура безопасности и зависимости", - "req_id": "V15.2.1", - "req_description": "Убедитесь, что приложение содержит только те компоненты, которые не нарушили задокументированные сроки обновления и исправления.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.2", - "section_name": "Архитектура безопасности и зависимости", - "req_id": "V15.2.2", - "req_description": "Убедитесь, что в приложении реализованы меры защиты от потери доступности из-за функциональности, требующей много времени или ресурсов, на основе задокументированных решений и стратегий безопасности для этого.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.2", - "section_name": "Архитектура безопасности и зависимости", - "req_id": "V15.2.3", - "req_description": "Убедитесь, что производственная среда включает только те функции, которые необходимы для работы приложения, и не предоставляет лишние функции, такие как тестовый код, примеры кода и инструменты разработки.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.2", - "section_name": "Архитектура безопасности и зависимости", - "req_id": "V15.2.4", - "req_description": "Убедитесь, что сторонние компоненты и все их транзитивные зависимости загружаются только из ожидаемых репозиториев (внутренних или внешних) и отсутствует риск атаки через подмену зависимостей (dependency confusion attack)", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.2", - "section_name": "Архитектура безопасности и зависимости", - "req_id": "V15.2.5", - "req_description": "Убедитесь, что приложение реализует дополнительные меры защиты для тех частей приложения, которые документированы как содержащие «функционал с повышенным риском» или использующие сторонние библиотеки, считающиеся «функционалом с повышенным риском». Это могут быть такие методы, как «песочница», инкапсуляция, контейнеризация или изоляция на сетевом уровне, чтобы задержать и предотвратить продвижение (pivoting) злоумышленников, скомпрометировавших одну часть приложения, к другим частям приложения.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.3", - "section_name": "Безопасное программирование", - "req_id": "V15.3.1", - "req_description": "Убедитесь, что приложение возвращает только необходимое подмножество полей из объекта данных. Например, оно не должно возвращать весь объект данных, поскольку некоторые отдельные поля должны быть недоступны пользователям.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.3", - "section_name": "Безопасное программирование", - "req_id": "V15.3.2", - "req_description": "Убедитесь, что при вызовах внешних URL-адресов бэкэнд приложения настроен так, чтобы не выполнять перенаправления, если только это не предусмотрено функционалом.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.3", - "section_name": "Безопасное программирование", - "req_id": "V15.3.3", - "req_description": "Убедитесь, что в приложении реализованы защитные механизмы против атак типа массового присвоения (mass assignment) путем строгого ограничения разрешенных полей для каждого контроллера и действия, исключая возможность добавления или изменения значений полей, которые не должны быть доступны для данной конкретной операции.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.3", - "section_name": "Безопасное программирование", - "req_id": "V15.3.4", - "req_description": "Убедитесь, что все прокси и промежуточное ПО корректно передают исходный IP-адрес пользователя, используя доверенные поля данных, которые не могут быть изменены конечным пользователем, а приложение и веб-сервер используют это правильное значение для ведения логирования и принятия решений по безопасности, таких как ограничение запросов. При этом следует учитывать, что даже исходный IP-адрес может быть ненадежным из-за динамических IP-адресов, VPN или корпоративных файрволов.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.3", - "section_name": "Безопасное программирование", - "req_id": "V15.3.5", - "req_description": "Убедитесь, что приложение явно проверяет соответствие переменных ожидаемому типу данных и использует строгие операции сравнения. Это необходимо для предотвращения уязвимостей, связанных с type juggling и type confusion, вызванных тем, что код приложения делает предположения о типе переменной.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.3", - "section_name": "Безопасное программирование", - "req_id": "V15.3.6", - "req_description": "Убедитесь, что JavaScript-код написан таким образом, чтобы предотвратить prototype pollution, например, используя Set() или Map() вместо обычных литералов объекта.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.3", - "section_name": "Безопасное программирование", - "req_id": "V15.3.7", - "req_description": "Убедитесь, что приложение защищено от атак типа HTTP Parameter Pollution (HPP), особенно если используемый фреймворк не различает источники параметров запроса (строка запроса, тело запроса, куки или заголовки).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.4", - "section_name": "Безопасная работа с параллельными процессами", - "req_id": "V15.4.1", - "req_description": "Убедитесь, что к общим объектам в многопоточном коде (например, кэшам, файлам или объектам в памяти, используемым несколькими потоками) используется безопасный многопоточный доступ и механизмов синхронизации, таких как блокировки или семафоры, чтобы избежать состояний гонки и повреждения данных.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.4", - "section_name": "Безопасная работа с параллельными процессами", - "req_id": "V15.4.2", - "req_description": "Убедитесь, что проверки состояния ресурса, например его существования или разрешений, а также зависящие от него действия выполняются как одна атомарная операция, чтобы предотвратить условия гонки времени проверки и времени использования (TOCTOU). Например, проверка существования файла перед его открытием или проверка прав доступа пользователя перед его предоставлением.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.4", - "section_name": "Безопасная работа с параллельными процессами", - "req_id": "V15.4.3", - "req_description": "Убедитесь, что блокировки применяются согласованно, чтобы предотвратить взаимные блокировки потоков (deadlocks) или их бесконечные повторы, а также что логика блокировки инкапсулирована в коде, отвечающем за управление ресурсом. Это гарантирует, что блокировки не могут быть случайно или намеренно изменены внешними классами или кодом.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Безопасная разработка и архитектура", - "section_id": "V15.4", - "section_name": "Безопасная работа с параллельными процессами", - "req_id": "V15.4.4", - "req_description": "Убедитесь, что политики распределения ресурсов предотвращают нехватку ресурсов у потоков, обеспечивая справедливый доступ к ресурсам, например, используя пулы потоков, позволяя потокам с более низким приоритетом выполняться в течение разумного периода времени.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.1", - "section_name": "Документация по ведению логов", - "req_id": "V16.1.1", - "req_description": "Убедитесь в существовании реестра, в котором документируется ведение журнала на каждом уровне технологического стека приложения, включая какие события регистрируются, форматы логов, где хранятся эти журналы, как они используются, как контролируется доступ к ним и как долго хранятся журналы.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.2", - "section_name": "Общее журналирование", - "req_id": "V16.2.1", - "req_description": "Убедитесь, что каждая запись журнала содержит необходимые метаданные (например, когда, где, кто, что), которые позволят провести подробное исследование временной шкалы, когда произошло событие.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.2", - "section_name": "Общее журналирование", - "req_id": "V16.2.2", - "req_description": "Убедитесь, что все источники времени компонентов системы журналирования синхронизированы, а временные метки в метаданных событий безопасности используют UTC или содержат явное указание смещения часового пояса. Рекомендуется применять UTC для обеспечения согласованности в распределённых системах и предотвращения ошибок при переходе на летнее/зимнее время.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.2", - "section_name": "Общее журналирование", - "req_id": "V16.2.3", - "req_description": "Убедитесь, что приложение записывает и передаёт логи исключительно в те файлы и сервисы, которые указаны в реестре журналирования.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.2", - "section_name": "Общее журналирование", - "req_id": "V16.2.4", - "req_description": "Убедитесь, что логи могут быть прочитаны и коррелированы используемой системой обработки журналов, предпочтительно с использованием общего стандартного формата логирования.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.2", - "section_name": "Общее журналирование", - "req_id": "V16.2.5", - "req_description": "Убедитесь, что приложение применяет соответствующие меры защиты при логировании конфиденциальных данных в зависимости от уровня их чувствительности: например, полностью запрещает запись в логи таких данных, как учетные данные или платежные реквизиты, а для других данных (например, сессионных токенов) использует хеширование или частичное/полное маскирование.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.3", - "section_name": "Инциденты безопасности", - "req_id": "V16.3.1", - "req_description": "Убедитесь, что все операции аутентификации регистрируются, включая успешные и неудачные попытки. Также следует фиксировать дополнительные метаданные, такие как тип аутентификации или использованные факторы проверки.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.3", - "section_name": "Инциденты безопасности", - "req_id": "V16.3.2", - "req_description": "Убедитесь, что ведется журнал неудачных попыток авторизации. Для уровня L3 это должно включать в себя журналирование всех решений об авторизации, включая журналирование доступа к конфиденциальным данным (без регистрации самих конфиденциальных данных).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.3", - "section_name": "Инциденты безопасности", - "req_id": "V16.3.3", - "req_description": "Убедитесь, что приложение регистрирует все события безопасности, определенные в документации, а также фиксирует попытки обхода механизмов защиты, включая проверку входных данных, бизнес-логики и системы защиты от автоматизированных атак.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.3", - "section_name": "Инциденты безопасности", - "req_id": "V16.3.4", - "req_description": "Убедитесь, что приложение регистрирует в журналах неожиданные ошибки и сбои механизмов безопасности, включая, например, ошибки TLS-соединения на стороне сервера.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.4", - "section_name": "Защита журналов", - "req_id": "V16.4.1", - "req_description": "Убедитесь, что все компоненты системы логирования корректно кодируют данные, чтобы предотвратить атаки типа внедрения в журналы (log injection).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.4", - "section_name": "Защита журналов", - "req_id": "V16.4.2", - "req_description": "Убедитесь, что логи защищены от неавторизованного доступа и не могут быть модифицированы.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.4", - "section_name": "Защита журналов", - "req_id": "V16.4.3", - "req_description": "Убедитесь, что логи безопасно передаются в логически изолированную систему для анализа, обнаружения угроз, генерации оповещений и эскалации инцидентов. Это гарантирует сохранность журналов даже в случае компрометации основного приложения.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.5", - "section_name": "Обработка ошибок", - "req_id": "V16.5.1", - "req_description": "Убедитесь, что при возникновении непредвиденной или связанной с безопасностью ошибки пользователю возвращается только общее сообщение, гарантируя отсутствие раскрытия конфиденциальных внутренних данных системы, таких как трассировки стека, запросы, секретные ключи и токены.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.5", - "section_name": "Обработка ошибок", - "req_id": "V16.5.2", - "req_description": "Убедитесь, что приложение продолжает работать в безопасном режиме при недоступности внешних ресурсов, используя такие механизмы, как автоматические выключатели (circuit breakers) или плавное снижение функциональности (graceful degradation).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.5", - "section_name": "Обработка ошибок", - "req_id": "V16.5.3", - "req_description": "Убедитесь, что приложение корректно и безопасно завершает работу при возникновении исключений, предотвращая опасные сценарии по типу «fail-open», когда, например, транзакция ошибочно выполняется, несмотря на ошибки в логике валидации.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Журналирование событий безопасности и обработка ошибок", - "section_id": "V16.5", - "section_name": "Обработка ошибок", - "req_id": "V16.5.4", - "req_description": "Убедитесь, что определён обработчик ошибок «крайние меры», который будет перехватывать все необработанные ошибки. Это необходимо как для предотвращения потери информации об ошибках, которая должна быть записана в файлы журналов, так и для того, чтобы ошибка не остановила весь процесс приложения, что привело бы к потере доступности.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.1", - "section_name": "TURN-сервер", - "req_id": "V17.1.1", - "req_description": "Убедитесь, что сервис TURN (Traversal Using Relays around NAT) разрешает доступ только к IP-адресам, не зарезервированным для специальных целей (например, внутренние сети, широковещательная рассылка, loopback-адреса). Данное требование применяется как к IPv4, так и к IPv6 адресам.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.1", - "section_name": "TURN-сервер", - "req_id": "V17.1.2", - "req_description": "Убедитесь, что сервис TURN (Traversal Using Relays around NAT) защищен от исчерпания ресурсов при попытках легитимных пользователей открыть чрезмерное количество портов на сервере.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Требования к медиасерверам", - "req_id": "V17.2.1", - "req_description": "Убедитесь, что ключ сертификата Datagram Transport Layer Security (DTLS) управляется и защищается в соответствии с документированной политикой управления криптографическими ключами.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Требования к медиасерверам", - "req_id": "V17.2.2", - "req_description": "Убедитесь, что медиасервер настроен на использование только одобренных наборов шифров Datagram Transport Layer Security (DTLS) и защищенного профиля безопасности для расширения DTLS, применяемого при установке ключей для Secure Real-time Transport Protocol (DTLS-SRTP).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Требования к медиасерверам", - "req_id": "V17.2.3", - "req_description": "Убедитесь, что медиасервер проверяет аутентификацию Secure Real-time Transport Protocol (SRTP) для предотвращения атак с внедрением Real-time Transport Protocol (RTP), которые могут привести к отказу в обслуживании (Denial of Service) или вставке поддельного аудио-/видеоконтента в медиапотоки.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Требования к медиасерверам", - "req_id": "V17.2.4", - "req_description": "Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика при получении некорректных пакетов Secure Real-time Transport Protocol (SRTP).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Требования к медиасерверам", - "req_id": "V17.2.5", - "req_description": "Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетами Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Требования к медиасерверам", - "req_id": "V17.2.6", - "req_description": "Убедитесь, что медиасервер не подвержен уязвимости «Гонка ClientHello» (ClientHello Race Condition) в Datagram Transport Layer Security (DTLS), проверив наличие известных уязвимостей в публичных источниках или выполнив тестирование на воспроизведение условий гонки.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Требования к медиасерверам", - "req_id": "V17.2.7", - "req_description": "Убедитесь, что механизмы аудио- и видеозаписи, связанные с медиасервером, способны продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетов Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Требования к медиасерверам", - "req_id": "V17.2.8", - "req_description": "Убедитесь, что сертификат Datagram Transport Layer Security (DTLS) проверяется на соответствие атрибуту отпечатка (fingerprint) в Session Description Protocol (SDP), с немедленным прекращением медиапотока в случае несоответствия — это гарантирует подлинность передаваемых данных.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.3", - "section_name": "Сигнализация", - "req_id": "V17.3.1", - "req_description": "Убедитесь, что сигнальный сервер способен продолжать обработку легитимных входящих сообщений сигнализации даже в условиях флуд-атаки. Для этого необходимо реализовать механизм ограничения частоты запросов (rate limiting) на уровне сигнализации.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.3", - "section_name": "Сигнализация", - "req_id": "V17.3.2", - "req_description": "Убедитесь, что сигнальный сервер способен продолжать обработку легитимных сообщений сигнализации даже при получении некорректных сообщений, которые могут вызвать отказ в обслуживании (Denial of Service, DoS). Для этого необходимо реализовать: проверку входных данных (input validation), безопасную обработку целочисленных переполнений (integer overflows), защиту от переполнения буферов (buffer overflows) и другие надежные методы обработки ошибок.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - } - ] -} diff --git a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.json b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.json deleted file mode 100644 index 9ba0fb1896..0000000000 --- a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.json +++ /dev/null @@ -1,2774 +0,0 @@ -{ - "Name": "Application Security Verification Standard Project", - "ShortName": "ASVS", - "Version": "", - "Description": "The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.", - "Requirements": [ - { - "Shortcode": "V1", - "Ordinal": 1, - "ShortName": "Encoding", - "Name": "Кодировка и нейтрализация", - "Items": [ - { - "Shortcode": "V1.1", - "Ordinal": 1, - "Name": "Архитектура кодировки и нейтрализации", - "Items": [ - { - "Shortcode": "V1.1.1", - "Ordinal": 1, - "Description": "Убедитесь, что входные данные декодируются или деэкранируются в каноническую форму (в стандартное представление) только один раз. Декодирование происходит только тогда, когда ожидаются закодированные данные в этой форме, и что это делается перед дальнейшей обработкой входных данных, например, это не выполняется после проверки или нейтрализации.", - "L": "2" - }, - { - "Shortcode": "V1.1.2", - "Ordinal": 2, - "Description": "Убедитесь, что приложение выполняет кодирование и экранирование выходных данных либо в качестве последнего шага перед использованием интерпретатором, для которого оно предназначено, либо самим интерпретатором.", - "L": "2" - } - ] - }, - { - "Shortcode": "V1.2", - "Ordinal": 2, - "Name": "Предотвращение инъекций", - "Items": [ - { - "Shortcode": "V1.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что выходная кодировка для ответа HTTP, документа HTML или документа XML соответствует требуемому контексту, например, кодировка соответствующих символов для элементов HTML, атрибутов HTML, комментариев HTML, CSS или полей заголовка HTTP делается таким способом, чтобы избежать изменения структуры сообщения или документа.", - "L": "1" - }, - { - "Shortcode": "V1.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что при динамическом построении URL-адресов недоверенные данные кодируются в соответствии с их контекстом (например, кодирование URL-адресов или кодирование base64url для query или path параметров или пути). Убедитесь, что разрешены только безопасные протоколы URL-адресов (например, запрещен javascript: или data:).", - "L": "1" - }, - { - "Shortcode": "V1.2.3", - "Ordinal": 3, - "Description": "Убедитесь, что при динамическом построении содержимого JavaScript (включая JSON) используется кодирование или экранирование выходных данных, чтобы избежать изменения структуры сообщения или документа (чтобы избежать JavaScript и JSON-инъекций).", - "L": "1" - }, - { - "Shortcode": "V1.2.4", - "Ordinal": 4, - "Description": "Убедитесь, что выборка данных (Redis, Memcached, чтение из файлов, обращение по API) или запросы к базе данных (например, SQL, HQL, NoSQL, Cypher) используют параметризованные запросы, ORM, Entity Frameworks или иным образом защищены от SQL-инъекций и других атак. Это также актуально при написании хранимых процедур.", - "L": "1" - }, - { - "Shortcode": "V1.2.5", - "Ordinal": 5, - "Description": "Убедитесь, что приложение защищено от внедрения команд ОС и что вызовы операционной системы используют параметризованные запросы к ОС или используют контекстное кодирование вывода командной строки.", - "L": "1" - }, - { - "Shortcode": "V1.2.6", - "Ordinal": 6, - "Description": "Убедитесь, что приложение защищено от LDAP-инъекций, или что реализованы специальные меры безопасности для их предотвращения.", - "L": "2" - }, - { - "Shortcode": "V1.2.7", - "Ordinal": 7, - "Description": "Убедитесь, что приложение защищено от атак с использованием XPath-инъекций с помощью параметризации запросов или предварительно скомпилированных запросов.", - "L": "2" - }, - { - "Shortcode": "V1.2.8", - "Ordinal": 8, - "Description": "Убедитесь, что процессоры LaTeX настроены безопасно (например, не используется флаг «–shell‑escape») и используется разрешенный список команд для предотвращения LaTeX-инъекций.", - "L": "2" - }, - { - "Shortcode": "V1.2.9", - "Ordinal": 9, - "Description": "Убедитесь, что приложение экранирует специальные символы в регулярных выражениях (обычно с помощью обратной косой черты), чтобы предотвратить их ошибочную интерпретацию как метасимволов.", - "L": "2" - }, - { - "Shortcode": "V1.2.10", - "Ordinal": 10, - "Description": "Убедитесь, что приложение защищено от внедрения формул CSV (CSV Injection). Приложение должно следовать правилам экранирования, определенным в RFC 4180, разделы 2.6 и 2.7, при экспорте содержимого CSV. Кроме того, при экспорте в CSV или другие форматы электронных таблиц (такие как XLS, XLSX или ODF) специальные символы (включая '=', '+', '-', '@', '\\t' (табуляция), и '\\0' (нулевой символ)) должны экранироваться одинарной кавычкой, если они появляются в качестве первого символа в значении поля.", - "L": "3" - } - ] - }, - { - "Shortcode": "V1.3", - "Ordinal": 3, - "Name": "Нейтрализация", - "Items": [ - { - "Shortcode": "V1.3.1", - "Ordinal": 1, - "Description": "Убедитесь, что все ненадежные входные данные HTML из редакторов WYSIWYG или аналогичных программ нейтрализуются с помощью известных и безопасных библиотек или функций фреймворка для санитизации HTML.", - "L": "1" - }, - { - "Shortcode": "V1.3.2", - "Ordinal": 2, - "Description": "Убедитесь, что приложение избегает использования eval() или других динамических функций выполнения кода, таких как Spring Expression Language (SpEL). Если нет альтернативы, любой пользовательский ввод должен быть нейтрализован перед выполнением.", - "L": "1" - }, - { - "Shortcode": "V1.3.3", - "Ordinal": 3, - "Description": "Убедитесь, что данные, передаваемые в потенциально опасный контекст, предварительно нейтрализованы, чтобы обеспечить соблюдение мер безопасности, таких как разрешение только тех символов, которые безопасны для данного контекста, и обрезка слишком длинного ввода.", - "L": "2" - }, - { - "Shortcode": "V1.3.4", - "Ordinal": 4, - "Description": "Убедитесь, что предоставленный пользователем файл .SVG проверен или нейтрализован, чтобы он содержал только теги и атрибуты (например, относящиеся к рисованию), которые безопасны для приложения, например, не содержат скриптов и foreignObject.", - "L": "2" - }, - { - "Shortcode": "V1.3.5", - "Ordinal": 5, - "Description": "Убедитесь, что приложение нейтралует или отключает предоставленные пользователем скриптовые данные или выражения шаблонных языков, такие как таблицы стилей Markdown, CSS или XSL, BBCode или аналогичные.", - "L": "2" - }, - { - "Shortcode": "V1.3.6", - "Ordinal": 6, - "Description": "Убедитесь, что приложение защищено от атак с подделкой запросов на стороне сервера (SSRF), проверяя ненадежные данные по разрешенному списку протоколов, доменов, путей и портов, а также нейтрализуя потенциально опасные символы перед использованием данных для вызова другой службы.", - "L": "2" - }, - { - "Shortcode": "V1.3.7", - "Ordinal": 7, - "Description": "Убедитесь, что приложение защищено от атак с внедрением шаблонов (template injection), не позволяя создавать шаблоны на основе недоверенных входных данных. Если нет альтернативы, любые недоверенные входные данные, включаемые динамически во время создания шаблона, должны быть нейтрализованы или тщательно провалидированы.", - "L": "2" - }, - { - "Shortcode": "V1.3.8", - "Ordinal": 8, - "Description": "Убедитесь, что приложение надлежащим образом нейтрализует недоверенные входные данные перед использованием в запросах Java Naming and Directory Interface (JNDI) и что JNDI настроен безопасно для предотвращения атак с использованием JNDI-инъекций.", - "L": "2" - }, - { - "Shortcode": "V1.3.9", - "Ordinal": 9, - "Description": "Убедитесь, что приложение нейтрализует данные перед отправкой в Memcache, чтобы предотвратить атаки методом инъекций.", - "L": "2" - }, - { - "Shortcode": "V1.3.10", - "Ordinal": 10, - "Description": "Убедитесь, что строки форматирования, которые могут быть использованы неожидаемым или вредоносным образом, нейтрализуются перед дальнейшим использованием.", - "L": "2" - }, - { - "Shortcode": "V1.3.11", - "Ordinal": 11, - "Description": "Убедитесь, что приложение нейтрализует вводимые пользователем данные перед передачей в почтовые системы для защиты от SMTP или IMAP-инъекций.", - "L": "2" - }, - { - "Shortcode": "V1.3.12", - "Ordinal": 12, - "Description": "Убедитесь, что регулярные выражения не содержат элементов, вызывающих экспоненциальный возврат, и убедитесь в нейтрализации недоверенных входных данных для предотвращения атак ReDoS или Runaway Regex.", - "L": "3" - } - ] - }, - { - "Shortcode": "V1.4", - "Ordinal": 4, - "Name": "Память, строки и неуправляемый код", - "Items": [ - { - "Shortcode": "V1.4.1", - "Ordinal": 1, - "Description": "Убедитесь, что для обнаружения или предотвращения ситуаций переполнения стека, буфера или кучи приложение учитывает размер доступной области памяти при строковых операциях, копировании в память, в арифметике указателей и т.п.", - "L": "2" - }, - { - "Shortcode": "V1.4.2", - "Ordinal": 2, - "Description": "Убедитесь, что для предотвращения целочисленного переполнения применяется контроль знака, диапазона и типа допустимых входных данных.", - "L": "2" - }, - { - "Shortcode": "V1.4.3", - "Ordinal": 3, - "Description": "Убедитесь, что динамически выделенная память и ресурсы освобождены, а ссылки или указатели на освобожденную память удалены или установлены в значение null, чтобы предотвратить появление висячих указателей и уязвимостей, связанных с использованием памяти после освобождения.", - "L": "2" - } - ] - }, - { - "Shortcode": "V1.5", - "Ordinal": 5, - "Name": "Безопасная десериализация", - "Items": [ - { - "Shortcode": "V1.5.1", - "Ordinal": 1, - "Description": "Убедитесь, что приложение настраивает XML-парсеры на использование строгой конфигурации и что небезопасные функции, такие как разрешение внешних сущностей, отключены для предотвращения атак XML eXternal Entity (XXE).", - "L": "1" - }, - { - "Shortcode": "V1.5.2", - "Ordinal": 2, - "Description": "Убедитесь, что десериализация недоверенных данных обеспечивает безопасную обработку ввода, например, используя список разрешенных типов объектов или ограничивая типы объектов, определяемые клиентом, для предотвращения атак десериализации. Механизмы десериализации, которые явно определены как небезопасные, не должны использоваться с недоверенным вводом.", - "L": "2" - }, - { - "Shortcode": "V1.5.3", - "Ordinal": 3, - "Description": "Убедитесь, что различные парсеры, используемые в приложении для одного и того же типа данных (например, парсеры JSON, XML, URL), выполняют парсинг согласованным образом и используют один и тот же механизм кодирования символов, чтобы избежать таких проблем, как уязвимости взаимодействия JSON (JSON Interoperability) или различное поведение анализа URI или файлов, которые могут использоваться в атаках удаленного включения файлов (RFI) или подделки запросов на стороне сервера (SSRF).", - "L": "3" - } - ] - } - ] - }, - { - "Shortcode": "V2", - "Ordinal": 2, - "ShortName": "Validation", - "Name": "Валидация и бизнес-логика", - "Items": [ - { - "Shortcode": "V2.1", - "Ordinal": 1, - "Name": "Документация валидации и бизнес-логики", - "Items": [ - { - "Shortcode": "V2.1.1", - "Ordinal": 1, - "Description": "Убедитесь, что в документации приложения определены правила проверки входных данных на соответствие ожидаемой структуре. Это могут быть распространённые форматы данных, такие как номера кредитных карт, адреса электронной почты, номера телефонов, или внутренний формат данных.", - "L": "1" - }, - { - "Shortcode": "V2.1.2", - "Ordinal": 2, - "Description": "Убедитесь, что в документации приложения указано, как проверять логическую и контекстную согласованность объединенных данных, например, проверять соответствие района и почтового индекса.", - "L": "2" - }, - { - "Shortcode": "V2.1.3", - "Ordinal": 3, - "Description": "Убедитесь, что ожидания относительно ограничений и проверок бизнес-логики задокументированы как для уровня отдельного пользователя, так и для глобального уровня всего приложения.", - "L": "2" - } - ] - }, - { - "Shortcode": "V2.2", - "Ordinal": 2, - "Name": "Валидация ввода", - "Items": [ - { - "Shortcode": "V2.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что входные данные провалидированы для обеспечения соответствия бизнес- или функциональным ожиданиям. Валидация должна осуществляться либо по списку допустимых значений, шаблонов и диапазонов, либо путем сравнения входных данных с ожидаемой структурой и логическими ограничениями в соответствии с предопределенными правилами. Для L1 валидация может быть сосредоточена на входных данных, используемых для принятия конкретных бизнес-решений или решений, связанных с безопасностью. Для L2 и выше это должно применяться ко всем входным данным.", - "L": "1" - }, - { - "Shortcode": "V2.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что приложение разработано с принудительной валидацией входных данных на уровне доверенного сервиса. Хотя проверка на стороне клиента повышает удобство использования и должна поощряться, на неё не следует полагаться как на средство контроля безопасности.", - "L": "1" - }, - { - "Shortcode": "V2.2.3", - "Ordinal": 3, - "Description": "Убедитесь, что приложение обеспечивает обоснованность комбинаций данных в соответствии с предопределенными правилам. Например: возраст должен соответствовать дате рождения; страна и почтовый индекс; количество товара в заказе и на складе.", - "L": "2" - } - ] - }, - { - "Shortcode": "V2.3", - "Ordinal": 3, - "Name": "Безопасность бизнес-логики", - "Items": [ - { - "Shortcode": "V2.3.1", - "Ordinal": 1, - "Description": "Убедитесь, что приложение обрабатывает потоки бизнес-логики для одного и того же пользователя в ожидаемом последовательном порядке шагов и без пропуска шагов.", - "L": "1" - }, - { - "Shortcode": "V2.3.2", - "Ordinal": 2, - "Description": "Убедитесь, что ограничения бизнес-логики реализованы в соответствии с документацией приложения, чтобы избежать эксплуатации её недостатков.", - "L": "2" - }, - { - "Shortcode": "V2.3.3", - "Ordinal": 3, - "Description": "Убедитесь, что транзакции используются на уровне бизнес-логики таким образом, что операция бизнес-логики либо выполняется полностью, либо откатывается к предыдущему корректному состоянию.", - "L": "2" - }, - { - "Shortcode": "V2.3.4", - "Ordinal": 4, - "Description": "Убедитесь, что на уровне бизнес-логики используются механизмы блокировки, чтобы гарантировать невозможность двойного бронирования ограниченных по количеству ресурсов (например, мест в театре или слотов доставки) путем манипулирования логикой приложения.", - "L": "2" - }, - { - "Shortcode": "V2.3.5", - "Ordinal": 5, - "Description": "Убедитесь, что для важных потоков бизнес-логики требуется многопользовательское (multi-user) одобрение, чтобы предотвратить несанкционированные или случайные действия. Потоки бизнес-логики могут включать, помимо прочего, крупные денежные переводы, утверждение контрактов, доступ к секретной информации или обход ограничений безопасности на производстве.", - "L": "3" - } - ] - }, - { - "Shortcode": "V2.4", - "Ordinal": 4, - "Name": "Анти-автоматизация", - "Items": [ - { - "Shortcode": "V2.4.1", - "Ordinal": 1, - "Description": "Убедитесь, что используются средства противодействия автоматизации для защиты от чрезмерных вызовов функций приложения, которые могут привести к утечке данных, созданию ненужных данных, исчерпанию квот, нарушению ограничений скорости, отказу в обслуживании или чрезмерному использованию дорогостоящих ресурсов.", - "L": "2" - }, - { - "Shortcode": "V2.4.2", - "Ordinal": 2, - "Description": "Убедитесь, что потоки бизнес-логики требуют реалистичного человеческого времени, предотвращая чрезмерно быструю отправку транзакций.", - "L": "3" - } - ] - } - ] - }, - { - "Shortcode": "V3", - "Ordinal": 3, - "ShortName": "Web", - "Name": "Безопасность веб-интерфейса", - "Items": [ - { - "Shortcode": "V3.1", - "Ordinal": 1, - "Name": "Документация по безопасности веб-интерфейса", - "Items": [ - { - "Shortcode": "V3.1.1", - "Ordinal": 1, - "Description": "Убедитесь, что в документации приложения описаны ожидаемые функции безопасности, которые должны поддерживать браузеры, использующие приложение (такие как HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) и другие соответствующие механизмы безопасности HTTP). В документации также должно быть обязательно определено, как приложение должно себя вести, если некоторые из этих функций недоступны (например, предупреждать пользователя или блокировать доступ).", - "L": "3" - } - ] - }, - { - "Shortcode": "V3.2", - "Ordinal": 2, - "Name": "Непреднамеренная интерпретация контента", - "Items": [ - { - "Shortcode": "V3.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что реализованы меры безопасности, предотвращающие отображение контента или функций браузерами в HTTP-ответах в некорректном контексте (например, запрос API, загруженный пользователем файл или другой ресурс запрашивается напрямую). Возможные способы контроля включают: не обрабатывать содержимое, если поля заголовка HTTP-запроса (например, Sec-Fetch-*) не указывают на корректность контекста; использование заголовка и значения Content-Security-Policy: sandbox directive; или использование заголовка и значения Content-Disposition: attachment.", - "L": "1" - }, - { - "Shortcode": "V3.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что данные, предназначенные для отображения в виде текста, а не визуализации в виде HTML, обрабатывается с использованием безопасных функций визуализации (таких как createTextNode или textContent), чтобы предотвратить непреднамеренное выполнение содержимого, такого как HTML или JavaScript.", - "L": "1" - }, - { - "Shortcode": "V3.2.3", - "Ordinal": 3, - "Description": "Убедитесь, что приложение избегает затирания DOM при использовании JavaScript на стороне клиента, применяя явные объявления переменных, выполняя строгую проверку типов, избегая сохранения глобальных переменных в объекте документа и реализуя изоляцию пространства имен.", - "L": "3" - } - ] - }, - { - "Shortcode": "V3.3", - "Ordinal": 3, - "Name": "Настройка файлов cookie", - "Items": [ - { - "Shortcode": "V3.3.1", - "Ordinal": 1, - "Description": "Убедитесь, что у файлов cookie установлен атрибут «Secure», и если префикс «__Host‑» не используется в названии cookie, необходимо использовать префикс «__Secure‑».", - "L": "1" - }, - { - "Shortcode": "V3.3.2", - "Ordinal": 2, - "Description": "Убедитесь, что значение атрибута SameSite каждой cookie установлено в соответствии с назначением cookie, чтобы ограничить подверженность атакам на восстановление пользовательского интерфейса и атакам с подделкой запросов на уровне браузера, обычно называемым подделкой межсайтовых запросов (CSRF).", - "L": "2" - }, - { - "Shortcode": "V3.3.3", - "Ordinal": 3, - "Description": "Убедитесь, что cookie имеют префикс «__Host‑» в названии, если только они явно не предназначены для совместного использования с другими хостами.", - "L": "2" - }, - { - "Shortcode": "V3.3.4", - "Ordinal": 4, - "Description": "Убедитесь, что если значение cookie не должно быть доступно для клиентских скриптов (например, сессионный токен), для cookie должен быть установлен атрибут «HttpOnly», а само значение должно передаваться клиенту только через поле заголовка «Set-Cookie».", - "L": "2" - }, - { - "Shortcode": "V3.3.5", - "Ordinal": 5, - "Description": "Убедитесь, что при записи cookie приложением общая длина имени и значения cookie не превышает 4096 байт. Слишком большие cookie не будут сохраняться браузером и, следовательно, не будут отправляться с запросами, что помешает пользователю использовать функции приложения, зависящие от этого cookie.", - "L": "3" - } - ] - }, - { - "Shortcode": "V3.4", - "Ordinal": 4, - "Name": "Заголовки механизма безопасности браузера", - "Items": [ - { - "Shortcode": "V3.4.1", - "Ordinal": 1, - "Description": "Убедитесь, что поле заголовка Strict‑Transport‑Security включено во все ответы для реализации политики HTTP Strict Transport Security (HSTS). Необходимо указать максимальное время не менее 1 года, а для L2 и выше политика должна применяться также ко всем поддоменам.", - "L": "1" - }, - { - "Shortcode": "V3.4.2", - "Ordinal": 2, - "Description": "Убедитесь, что поле заголовка Cross‑Origin Resource Sharing (CORS) «Access‑Control‑Allow‑Origin» имеет фиксированное значение, заданное приложением, или, если используется заголовок Origin, оно проверяется по списку доверенных источников. При необходимости использования «Access‑Control‑Allow‑Origin: *» убедитесь, что ответ не содержит конфиденциальной информации.", - "L": "1" - }, - { - "Shortcode": "V3.4.3", - "Ordinal": 3, - "Description": "Убедитесь, что HTTP-ответы содержат поле заголовка Content-Security-Policy, которое определяет директивы, гарантирующие загрузку и выполнение браузером только доверенного контента или ресурсов, чтобы ограничить выполнение вредоносного JavaScript. Как минимум, необходимо использовать глобальную политику, включающую директивы object-src «none» и base-uri «none», а также определяющую список разрешенных адресов или использующую одноразовые коды или хэши. Для приложений L3 необходимо определить политику использования 'nonce' или hash-конструкций для каждого ответа.", - "L": "2" - }, - { - "Shortcode": "V3.4.4", - "Ordinal": 4, - "Description": "Убедитесь, что все HTTP-ответы содержат поле заголовка «X‑Content‑Type‑Options: nosniff». Это предписывает браузерам не использовать анализ контента и определение типа MIME для данного ответа, а также требовать, чтобы значение поля заголовка Content‑Type в ответе соответствовало целевому ресурсу. Например, ответ на запрос стиля принимается только в том случае, если Content‑Type в ответе — «text/css». Это также позволяет браузеру использовать функцию Cross‑Origin Read Blocking (CORB).", - "L": "2" - }, - { - "Shortcode": "V3.4.5", - "Ordinal": 5, - "Description": "Убедитесь, что приложение устанавливает политику реферера для предотвращения утечки технически конфиденциальных данных сторонним сервисам через поле заголовка HTTP-запроса «Referer». Это можно сделать с помощью поля заголовка HTTP-ответа «Referrer‑Policy» или через атрибуты HTML-элемента. Конфиденциальные данные могут включать путь и данные запроса в URL-адресе, а для внутренних непубличных приложений также имя хоста.", - "L": "2" - }, - { - "Shortcode": "V3.4.6", - "Ordinal": 6, - "Description": "Убедитесь, что веб-приложение использует директиву frame‑ancestors поля заголовка Content‑Security‑Policy для каждого HTTP-ответа, чтобы гарантировать невозможность его внедрения по умолчанию и внедрение определённых ресурсов разрешено только при необходимости. Обратите внимание, что поле заголовка X‑Frame‑Options, хотя и поддерживается браузерами, устарело и не может быть использовано в качестве основы.", - "L": "2" - }, - { - "Shortcode": "V3.4.7", - "Ordinal": 7, - "Description": "Убедитесь, что в поле заголовка Content‑Security‑Policy указано место, куда следует сообщать о нарушениях.", - "L": "3" - }, - { - "Shortcode": "V3.4.8", - "Ordinal": 8, - "Description": "Убедитесь, что все HTTP-ответы, инициирующие рендеринг документа (например, ответы с типом содержимого text/html), включают поле заголовка Cross-Origin-Opener-Policy с директивой same-origin или same-origin-allow-popups (при необходимости). Это предотвращает атаки, злоупотребляющие общим доступом к объектам Window, такие как Tabnabbing и Frame Counting.", - "L": "3" - } - ] - }, - { - "Shortcode": "V3.5", - "Ordinal": 5, - "Name": "Браузерное разделение источников", - "Items": [ - { - "Shortcode": "V3.5.1", - "Ordinal": 1, - "Description": "Убедитесь, что, если приложение не использует механизм предварительной проверки CORS для предотвращения запрещённых кросс-доменных запросов на использование чувствительного функционала, эти запросы валидируются на предмет их происхождения от самого приложения. Это можно сделать, используя и проверяя специальные токены для защиты от подделки или требуя дополнительные поля HTTP-заголовка, не входящие в список «простых заголовков» (CORS-safelisted request-header). Это необходимо для защиты от атак с подделкой запросов через браузер, широко известных как межсайтовая подделка запросов (CSRF).", - "L": "1" - }, - { - "Shortcode": "V3.5.2", - "Ordinal": 2, - "Description": "Убедитесь, что если приложение использует механизм предварительной проверки CORS для предотвращения неразрешённого использования чувствительного функционала между источниками, вызов этого функционала невозможен с помощью запроса, который не запускает предварительную проверку CORS. Для этого может потребоваться проверка значений полей заголовка запроса «Origin» и «Content-Type» или использование дополнительного поля заголовка, не входящего в безопасный список CORS.", - "L": "1" - }, - { - "Shortcode": "V3.5.3", - "Ordinal": 3, - "Description": "Убедитесь, что HTTP-запросы к чувствительному функционалу используют соответствующие HTTP-методы, такие как POST, PUT, PATCH или DELETE, а не методы, определённые спецификацией HTTP как «безопасные», такие как HEAD, OPTIONS или GET. В качестве альтернативы можно использовать строгую валидацию полей заголовка запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, навигационного запроса или загрузки ресурса (например, источника изображения), где это не ожидается.", - "L": "1" - }, - { - "Shortcode": "V3.5.4", - "Ordinal": 4, - "Description": "Убедитесь, что отдельные приложения размещены на разных именах хостов, чтобы использовать ограничения, предусмотренные политикой same-origin, включая то, как документы или скрипты, загруженные одним источником, могут взаимодействовать с ресурсами из другого источника, а также ограничения на cookie на основе имени хоста.", - "L": "2" - }, - { - "Shortcode": "V3.5.5", - "Ordinal": 5, - "Description": "Убедитесь, что сообщения, полученные интерфейсом postMessage, отвергаются, если источник сообщения не является доверенным или если синтаксис сообщения недействителен.", - "L": "2" - }, - { - "Shortcode": "V3.5.6", - "Ordinal": 6, - "Description": "Убедитесь, что функциональность JSONP не включена нигде в приложении, чтобы избежать атак с использованием межсайтового включения скриптов (XSSI).", - "L": "3" - }, - { - "Shortcode": "V3.5.7", - "Ordinal": 7, - "Description": "Убедитесь, что данные, требующие авторизации, не включены в ответы ресурсов скриптов, таких как файлы JavaScript, чтобы предотвратить атаки с использованием межсайтового включения скриптов (XSSI).", - "L": "3" - }, - { - "Shortcode": "V3.5.8", - "Ordinal": 8, - "Description": "Убедитесь, что аутентифицированные ресурсы (такие как изображения, видео, скрипты и другие документы) могут быть загружены или внедрены от имени пользователя только по назначению. Этого можно добиться путём строгой валидации полей заголовка HTTP-запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, или путём установки ограничительного поля заголовка HTTP-ответа Cross‑Origin‑Resource‑Policy, чтобы браузер блокировал возвращаемый контент.", - "L": "3" - } - ] - }, - { - "Shortcode": "V3.6", - "Ordinal": 6, - "Name": "Целостность внешних ресурсов", - "Items": [ - { - "Shortcode": "V3.6.1", - "Ordinal": 1, - "Description": "Убедитесь, что клиентские ресурсы, такие как библиотеки JavaScript, CSS или веб-шрифты, размещаются только на внешнем сервере (например, в сети доставки контента (Content Delivery Network)), если ресурс статический и имеет версии, а для проверки целостности ресурса используется механизм проверки целостности подресурсов (SRI). Если это невозможно, для каждого ресурса должно быть задокументировано решение по безопасности, обосновывающее это.", - "L": "3" - } - ] - }, - { - "Shortcode": "V3.7", - "Ordinal": 7, - "Name": "Другие соображения по безопасности браузера", - "Items": [ - { - "Shortcode": "V3.7.1", - "Ordinal": 1, - "Description": "Убедитесь, что приложение использует только те клиентские технологии, которые по-прежнему поддерживаются и считаются безопасными. Примерами технологий, не соответствующих этому требованию, являются плагины NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL или клиентские Java-апплеты.", - "L": "2" - }, - { - "Shortcode": "V3.7.2", - "Ordinal": 2, - "Description": "Убедитесь, что приложение будет автоматически перенаправлять пользователя на другое имя хоста или домен (который не контролируется приложением), только если этот хост или домен указаны в списке разрешенных.", - "L": "2" - }, - { - "Shortcode": "V3.7.3", - "Ordinal": 3, - "Description": "Убедитесь, что приложение отображает уведомление, что пользователь перенаправляется на URL-адрес, находящийся вне контроля приложения, с возможностью отмены навигации.", - "L": "3" - }, - { - "Shortcode": "V3.7.4", - "Ordinal": 4, - "Description": "Убедитесь, что домен верхнего уровня приложения (например, site.tld) ​​добавлен в публичный список предварительной загрузки (preload list) для HTTP Strict Transport Security (HSTS). Это гарантирует, что использование TLS для приложения будет встроено непосредственно в основные браузеры, а не будет полагаться только на поле заголовка ответа Strict-Transport-Security.", - "L": "3" - }, - { - "Shortcode": "V3.7.5", - "Ordinal": 5, - "Description": "Убедитесь, что приложение ведет себя так, как описано в документации (например, предупреждает пользователя или блокирует доступ), если браузер, используемый для доступа к приложению, не поддерживает ожидаемые функции безопасности.", - "L": "3" - } - ] - } - ] - }, - { - "Shortcode": "V4", - "Ordinal": 4, - "ShortName": "API", - "Name": "API и Веб-сервис", - "Items": [ - { - "Shortcode": "V4.1", - "Ordinal": 1, - "Name": "Общая безопасность веб-сервисов", - "Items": [ - { - "Shortcode": "V4.1.1", - "Ordinal": 1, - "Description": "Убедитесь, что каждый HTTP-ответ с телом сообщения содержит заголовок Content-Type, который соответствует фактическому содержимому ответа, таким как «text/», «/+xml» и «/xml», включая параметр charset для указания безопасной кодировки символов (например, UTF-8, ISO-8859-1) согласно IANA Media Types.", - "L": "1" - }, - { - "Shortcode": "V4.1.2", - "Ordinal": 2, - "Description": "Убедитесь, что только конечные точки, предназначенные для взаимодействия с пользователем через веб-браузер, автоматически перенаправляют HTTP на HTTPS, в то время как другие сервисы или конечные точки не реализуют прозрачные редиректы. Это необходимо, чтобы избежать ситуации, когда клиент ошибочно отправляет незашифрованные HTTP-запросы а из-за того, что запрос по HTTP автоматически перенаправляется на HTTPS другим сервисом без обработки на входе, утечка чувствительных данных остаётся незамеченной.", - "L": "2" - }, - { - "Shortcode": "V4.1.3", - "Ordinal": 3, - "Description": "Убедитесь, что любой HTTP-заголовок, используемый приложением и устанавливаемый промежуточным уровнем, таким как балансировщик нагрузки, веб-прокси или backend-for-frontend сервис, не может быть переопределён конечным пользователем. Примеры заголовков: X-Real-IP, X-Forwarded-*, X-User-ID.", - "L": "2" - }, - { - "Shortcode": "V4.1.4", - "Ordinal": 4, - "Description": "Убедитесь, что разрешены только HTTP-методы, которые явно поддерживаются приложением или его API (включая OPTIONS для preflight-запросов), а неиспользуемые методы заблокированы.", - "L": "3" - }, - { - "Shortcode": "V4.1.5", - "Ordinal": 5, - "Description": "Убедитесь, что для особо чувствительных запросов или транзакций, проходящих через несколько систем, используются цифровые подписи на уровне сообщений, дополнительно к транспортным средствам защиты.", - "L": "3" - } - ] - }, - { - "Shortcode": "V4.2", - "Ordinal": 2, - "Name": "Валидация структуры HTTP-сообщений", - "Items": [ - { - "Shortcode": "V4.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что все компоненты приложения (включая балансировщики нагрузки, файрволы и серверы приложений) определяют границы входящих HTTP-сообщений с использованием механизма, соответствующего версии HTTP, чтобы предотвратить HTTP request smuggling. В HTTP/1.x, если присутствует заголовок Transfer-Encoding, заголовок Content-Length должен игнорироваться согласно RFC 2616. При использовании HTTP/2 или HTTP/3, если присутствует Content-Length, веб-сервер должен убедиться, что он совпадает с длиной DATA-фреймов.", - "L": "2" - }, - { - "Shortcode": "V4.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что при генерации HTTP-сообщений заголовок Content-Length не конфликтует с длиной содержимого, определяемой рамками протокола HTTP, чтобы предотвратить HTTP Request Smuggling.", - "L": "3" - }, - { - "Shortcode": "V4.2.3", - "Ordinal": 3, - "Description": "Убедитесь, что приложение не отправляет и не принимает HTTP/2 и HTTP/3 сообщения с заголовками, специфичными для соединения, такими как Transfer-Encoding, чтобы предотвратить HTTP Response Splitting и HTTP Header Injection.", - "L": "3" - }, - { - "Shortcode": "V4.2.4", - "Ordinal": 4, - "Description": "Убедитесь, что приложение принимает HTTP/2 и HTTP/3 запросы только в случае, если поля заголовков и их значения не содержат последовательностей CR (\\r), LF (\\n) или CRLF (\\r\\n), чтобы предотвратить HTTP Header Injection.", - "L": "3" - }, - { - "Shortcode": "V4.2.5", - "Ordinal": 5, - "Description": "Убедитесь, что если приложение (бекенд или фронтенд) формирует и отправляет запросы, оно использует валидацию, очистку или другие механизмы, чтобы не создавать URI (например, для API-вызовов) или HTTP-заголовки (например, Authorization или Cookie) слишком большой длины, чтобы их не принимал приёмник. Это может привести к отказу в обслуживании, например, при отправке слишком длинного запроса (длинный cookie-заголовок), из-за чего сервер постоянно возвращает ошибку.", - "L": "3" - } - ] - }, - { - "Shortcode": "V4.3", - "Ordinal": 3, - "Name": "GraphQL", - "Items": [ - { - "Shortcode": "V4.3.1", - "Ordinal": 1, - "Description": "Убедитесь, что используется белый список запросов, ограничение глубины вложенности, ограничение количества или анализ стоимости запроса, чтобы предотвратить DoS-атаки на уровне GraphQL или слоя данных из-за дорогостоящих вложенных запросов.", - "L": "2" - }, - { - "Shortcode": "V4.3.2", - "Ordinal": 2, - "Description": "Убедитесь, что introspection-запросы GraphQL отключены в продакшен-среде, если GraphQL API не предназначен для использования сторонними клиентами.", - "L": "2" - } - ] - }, - { - "Shortcode": "V4.4", - "Ordinal": 4, - "Name": "WebSocket", - "Items": [ - { - "Shortcode": "V4.4.1", - "Ordinal": 1, - "Description": "Убедитесь, что для всех WebSocket-соединений используется WebSocket поверх TLS (WSS).", - "L": "1" - }, - { - "Shortcode": "V4.4.2", - "Ordinal": 2, - "Description": "Убедитесь, что при первоначальном HTTP WebSocket handshake заголовок Origin проверяется на соответствие списку разрешённых источников для приложения.", - "L": "2" - }, - { - "Shortcode": "V4.4.3", - "Ordinal": 3, - "Description": "Убедитесь, что если стандартное управление сессиями приложения не может быть использовано, применяются специальные токены, соответствующие требованиям безопасности управления сессиями.", - "L": "2" - }, - { - "Shortcode": "V4.4.4", - "Ordinal": 4, - "Description": "Убедитесь, что специальные токены управления сессиями WebSocket изначально получаются или валидируются через ранее аутентифицированную HTTPS-сессию при переходе от HTTPS к WebSocket.", - "L": "2" - } - ] - } - ] - }, - { - "Shortcode": "V5", - "Ordinal": 5, - "ShortName": "File", - "Name": "Работа с файлами", - "Items": [ - { - "Shortcode": "V5.1", - "Ordinal": 1, - "Name": "Документация по работе с файлами", - "Items": [ - { - "Shortcode": "V5.1.1", - "Ordinal": 1, - "Description": "Убедитесь, что документация определяет допустимые типы файлов, ожидаемые расширения и максимальный размер (включая распакованный размер) для каждой функции загрузки. Также убедитесь, что в документации указано, как файлы обезвреживаются для конечных пользователей (например, как приложение ведёт себя при обнаружении вредоносного файла).", - "L": "2" - } - ] - }, - { - "Shortcode": "V5.2", - "Ordinal": 2, - "Name": "Загрузка файлов и содержимое", - "Items": [ - { - "Shortcode": "V5.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что приложение принимает только те файлы, которые может обработать без потери производительности или отказа в обслуживании.", - "L": "1" - }, - { - "Shortcode": "V5.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что при загрузке файла (включая файлы внутри архивов, таких как ZIP) приложение проверяет, соответствует ли расширение ожидаемому, и валидирует, соответствует ли содержимое типу, указанному в расширении. Это включает проверку начальных 'magic bytes', перезапись изображений, использование специализированных библиотек. Для уровня 1 — достаточно проверок для файлов, критичных с точки зрения бизнеса или безопасности. Для уровней 2 и выше — для всех файлов.", - "L": "1" - }, - { - "Shortcode": "V5.2.3", - "Ordinal": 3, - "Description": "Убедитесь, что приложение проверяет архивы (например, zip, gz, docx, odt) на максимально допустимый распакованный размер и максимальное количество файлов до распаковки.", - "L": "2" - }, - { - "Shortcode": "V5.2.4", - "Ordinal": 4, - "Description": "Убедитесь, что для каждого пользователя установлены квоты на общий размер и количество файлов, чтобы один пользователь не мог переполнить хранилище.", - "L": "3" - }, - { - "Shortcode": "V5.2.5", - "Ordinal": 5, - "Description": "Убедитесь, что приложение не позволяет загружать архивы с символьными ссылками (symlinks), если это не требуется по бизнес-логике. Если требуется — разрешён только строго определённый список допустимых символьных ссылок.", - "L": "3" - }, - { - "Shortcode": "V5.2.6", - "Ordinal": 6, - "Description": "Убедитесь, что приложение отклоняет изображения с числом пикселей выше допустимого, чтобы предотвратить атаки 'pixel flood'.", - "L": "3" - } - ] - }, - { - "Shortcode": "V5.3", - "Ordinal": 3, - "Name": "Хранение файлов", - "Items": [ - { - "Shortcode": "V5.3.1", - "Ordinal": 1, - "Description": "Убедитесь, что загруженные или сгенерированные из недоверенного ввода файлы, находящиеся в публичной директории, не исполняются как серверный код при обращении к ним по HTTP.", - "L": "1" - }, - { - "Shortcode": "V5.3.2", - "Ordinal": 2, - "Description": "Убедитесь, что при создании путей к файлам приложение использует внутренние или доверенные данные, а не пользовательские имена файлов. Если использование пользовательских имён или метаданных необходимо — требуется строгая проверка и очистка. Это защита от path traversal, LFI, RFI и SSRF.", - "L": "1" - }, - { - "Shortcode": "V5.3.3", - "Ordinal": 3, - "Description": "Убедитесь, что при обработке файлов на сервере (например, при распаковке) игнорируются пути, заданные пользователем, во избежание уязвимостей типа 'zip slip'.", - "L": "3" - } - ] - }, - { - "Shortcode": "V5.4", - "Ordinal": 4, - "Name": "Скачивание файлов", - "Items": [ - { - "Shortcode": "V5.4.1", - "Ordinal": 1, - "Description": "Убедитесь, что приложение валидирует или игнорирует имена файлов, переданных пользователем (включая в JSON, JSONP или URL-параметре), и указывает имя файла в заголовке Content-Disposition при ответе.", - "L": "2" - }, - { - "Shortcode": "V5.4.2", - "Ordinal": 2, - "Description": "Убедитесь, что имена файлов, передаваемые (например, в HTTP-заголовках или вложениях в email), кодируются или очищаются (например, по RFC 6266), чтобы сохранить структуру документа и предотвратить инъекции.", - "L": "2" - }, - { - "Shortcode": "V5.4.3", - "Ordinal": 3, - "Description": "Убедитесь, что файлы, полученные из недоверенных источников, сканируются антивирусом, чтобы не распространять известное вредоносное содержимое.", - "L": "2" - } - ] - } - ] - }, - { - "Shortcode": "V6", - "Ordinal": 6, - "ShortName": "Authentication", - "Name": "Аутентификация", - "Items": [ - { - "Shortcode": "V6.1", - "Ordinal": 1, - "Name": "Документация по аутентификации", - "Items": [ - { - "Shortcode": "V6.1.1", - "Ordinal": 1, - "Description": "Убедитесь, что в документации приложения описано, как используются механизмы, такие как ограничение частоты запросов (rate limiting), защита от автоматизации и адаптивные реакции, для защиты от атак, таких как подстановка учётных данных и перебор паролей. Документация должна ясно описывать конфигурацию этих механизмов и предотвращение злонамеренной блокировки аккаунтов.", - "L": "1" - }, - { - "Shortcode": "V6.1.2", - "Ordinal": 2, - "Description": "Убедитесь, что задокументирован список контекстно-зависимых слов, запрещённых к использованию в паролях. В него могут входить производные от названий организаций, продуктов, идентификаторов систем, кодовых названий проектов, названий отделов или ролей и тому подобное.", - "L": "2" - }, - { - "Shortcode": "V6.1.3", - "Ordinal": 3, - "Description": "Убедитесь, что если приложение поддерживает несколько способов аутентификации, то все они документированы вместе с описанием применяемых средств защиты и уровнем стойкости аутентификации, которые должны быть одинаково применены ко всем способам.", - "L": "2" - } - ] - }, - { - "Shortcode": "V6.2", - "Ordinal": 2, - "Name": "Безопасность паролей", - "Items": [ - { - "Shortcode": "V6.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что пользовательские пароли содержат не менее 8 символов. Рекомендуется минимальная длина в 15 символов.", - "L": "1" - }, - { - "Shortcode": "V6.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что пользователи могут менять свои пароли.", - "L": "1" - }, - { - "Shortcode": "V6.2.3", - "Ordinal": 3, - "Description": "Убедитесь, что для смены пароля требуется ввести как текущий, так и новый пароль.", - "L": "1" - }, - { - "Shortcode": "V6.2.4", - "Ordinal": 4, - "Description": "Убедитесь, что при регистрации или смене пароля введённый пароль проверяется по списку как минимум из 3000 самых популярных паролей, соответствующих политике (например, минимальной длине).", - "L": "1" - }, - { - "Shortcode": "V6.2.5", - "Ordinal": 5, - "Description": "Убедитесь, что допускаются пароли любой структуры, без ограничений на использование определённых символов. Не должно быть требований по обязательному наличию заглавных/строчных букв, цифр или специальных символов.", - "L": "1" - }, - { - "Shortcode": "V6.2.6", - "Ordinal": 6, - "Description": "Убедитесь, что поля ввода пароля используют type=password для скрытия символов. Разрешено временное отображение всего пароля или последнего введённого символа.", - "L": "1" - }, - { - "Shortcode": "V6.2.7", - "Ordinal": 7, - "Description": "Убедитесь, что разрешены вставка (paste), использование менеджеров паролей браузера и внешних менеджеров паролей.", - "L": "1" - }, - { - "Shortcode": "V6.2.8", - "Ordinal": 8, - "Description": "Убедитесь, что пароль проверяется строго в том виде, в котором он был введён пользователем — без обрезки, изменения регистра и других модификаций.", - "L": "1" - }, - { - "Shortcode": "V6.2.9", - "Ordinal": 9, - "Description": "Убедитесь, что система позволяет использовать пароли длиной не менее 64 символов.", - "L": "2" - }, - { - "Shortcode": "V6.2.10", - "Ordinal": 10, - "Description": "Убедитесь, что пароль остаётся действительным, пока не будет скомпрометирован или не будет изменён пользователем. Приложение не должно требовать регулярной смены пароля.", - "L": "2" - }, - { - "Shortcode": "V6.2.11", - "Ordinal": 11, - "Description": "Убедитесь, что используется документированный список контекстно-зависимых слов (например, названия компаний, проектов и т.д.) для предотвращения использования легко угадываемых паролей.", - "L": "2" - }, - { - "Shortcode": "V6.2.12", - "Ordinal": 12, - "Description": "Убедитесь, что при регистрации или смене пароля проверяется, не входит ли он в список скомпрометированных (утёкших) паролей.", - "L": "2" - } - ] - }, - { - "Shortcode": "V6.3", - "Ordinal": 3, - "Name": "Общие требования к безопасности аутентификации", - "Items": [ - { - "Shortcode": "V6.3.1", - "Ordinal": 1, - "Description": "Убедитесь, что реализованы меры защиты от атак типа credential stuffing (массовая подстановка учётных данных) и brute-force (перебор паролей), согласно документации по безопасности приложения.", - "L": "1" - }, - { - "Shortcode": "V6.3.2", - "Ordinal": 2, - "Description": "Убедитесь, что в приложении отсутствуют или отключены учётные записи по умолчанию (например, root, admin, sa).", - "L": "1" - }, - { - "Shortcode": "V6.3.3", - "Ordinal": 3, - "Description": "Убедитесь, что для доступа к приложению используется либо механизм многофакторной аутентификации, либо комбинация однофакторных. Для уровня L3 один из факторов должен быть аппаратным, обеспечивающим защиту от фишинга, устойчивость к компрометации и подтверждение намерения аутентификации через явное действие пользователя (например, нажатие кнопки на FIDO-ключе или телефоне). Ослабление этих требований допускается только при наличии обоснования и компенсирующих мер.", - "L": "2" - }, - { - "Shortcode": "V6.3.4", - "Ordinal": 4, - "Description": "Убедитесь, что при наличии нескольких способов аутентификации, они все задокументированы, и для них единообразно применяются меры защиты и уровни доверия.", - "L": "2" - }, - { - "Shortcode": "V6.3.5", - "Ordinal": 5, - "Description": "Убедитесь, что пользователи получают уведомления о подозрительных попытках аутентификации (удачных и неудачных). Это может включать попытки (например, подключения) с необычного устройства или места, частично успешную MFA, попытку после долгого отсутствия или успешную аутентификацию после серии неудачных.", - "L": "3" - }, - { - "Shortcode": "V6.3.6", - "Ordinal": 6, - "Description": "Убедитесь, что email не используется ни как однофакторный, ни как многофакторный механизм аутентификации.", - "L": "3" - }, - { - "Shortcode": "V6.3.7", - "Ordinal": 7, - "Description": "Убедитесь, что пользователи получают уведомление при изменении данных аутентификации, таких как сброс пароля или изменение логина/email.", - "L": "3" - }, - { - "Shortcode": "V6.3.8", - "Ordinal": 8, - "Description": "Убедитесь, что из сообщений об ошибке, HTTP-кодов ответа или различий во времени ответа нельзя определить, существует ли пользователь с таким логином. Это правило также должно применяться к функциям регистрации и восстановления пароля.", - "L": "3" - } - ] - }, - { - "Shortcode": "V6.4", - "Ordinal": 4, - "Name": "Жизненный цикл и восстановление факторов аутентификации", - "Items": [ - { - "Shortcode": "V6.4.1", - "Ordinal": 1, - "Description": "Убедитесь, что начальные пароли или коды активации, генерируемые системой, создаются с использованием надёжного генератора случайных чисел, соответствуют текущей политике паролей и истекают через короткий период времени либо после первого использования. Эти секреты не должны использоваться как постоянные пароли.", - "L": "1" - }, - { - "Shortcode": "V6.4.2", - "Ordinal": 2, - "Description": "Убедитесь, что в системе отсутствуют подсказки к паролю или вопросы на знание («секретные вопросы»).", - "L": "1" - }, - { - "Shortcode": "V6.4.3", - "Ordinal": 3, - "Description": "Убедитесь, что реализован безопасный процесс сброса забытого пароля, который не обходит активные механизмы многофакторной аутентификации.", - "L": "2" - }, - { - "Shortcode": "V6.4.4", - "Ordinal": 4, - "Description": "Убедитесь, что в случае утраты одного из факторов MFA проводится удостоверение личности (identity proofing) на том же уровне, что и при первичной регистрации.", - "L": "2" - }, - { - "Shortcode": "V6.4.5", - "Ordinal": 5, - "Description": "Убедитесь, что инструкции по обновлению истекающих механизмов аутентификации отправляются заранее, с достаточным запасом времени для выполнения замены, при необходимости с настройкой автоматических напоминаний.", - "L": "3" - }, - { - "Shortcode": "V6.4.6", - "Ordinal": 6, - "Description": "Убедитесь, что администраторы могут инициировать процесс сброса пароля, но не могут задать или выбрать новый пароль за пользователя. Это исключает ситуацию, при которой администратор знает пароль пользователя.", - "L": "3" - } - ] - }, - { - "Shortcode": "V6.5", - "Ordinal": 5, - "Name": "Общие требования к многофакторной аутентификации", - "Items": [ - { - "Shortcode": "V6.5.1", - "Ordinal": 1, - "Description": "Убедитесь, что lookup-секреты, внеполосные коды/запросы и TOTP-коды можно использовать только один раз.", - "L": "2" - }, - { - "Shortcode": "V6.5.2", - "Ordinal": 2, - "Description": "Убедитесь, что при хранении lookup-секретов с энтропией менее 112 бит (например, 19 случайных буквенно-цифровых символов или 34 случайные цифры) они хэшируются с использованием разрешённого алгоритма хеширования паролей и случайной соли минимум 32 бита. Если у секрета ≥112 бит энтропии — допустимо использовать стандартный хэш.", - "L": "2" - }, - { - "Shortcode": "V6.5.3", - "Ordinal": 3, - "Description": "Убедитесь, что lookup-секреты, коды внеполосной аутентификации и сиды для TOTP генерируются с использованием криптографически стойкого генератора случайных чисел (CSPRNG), чтобы избежать предсказуемых значений.", - "L": "2" - }, - { - "Shortcode": "V6.5.4", - "Ordinal": 4, - "Description": "Убедитесь, что lookup-секреты и внеполосные коды аутентификации имеют минимум 20 бит энтропии (достаточно, например, 4 случайных алфавитно-цифровых символов или 6 случайных цифр).", - "L": "2" - }, - { - "Shortcode": "V6.5.5", - "Ordinal": 5, - "Description": "Убедитесь, что все внеполосные запросы, коды и токены, а также TOTP-коды имеют ограниченный срок действия. Максимум для out-of-band — 10 минут, для TOTP — 30 секунд.", - "L": "2" - }, - { - "Shortcode": "V6.5.6", - "Ordinal": 6, - "Description": "Убедитесь, что любой фактор аутентификации (включая физические устройства) может быть отозван в случае кражи или утери.", - "L": "3" - }, - { - "Shortcode": "V6.5.7", - "Ordinal": 7, - "Description": "Убедитесь, что биометрические механизмы аутентификации используются только как вторичный фактор — в сочетании с «чем-то, что вы знаете» или «чем-то, что у вас есть».", - "L": "3" - }, - { - "Shortcode": "V6.5.8", - "Ordinal": 8, - "Description": "Убедитесь, что TOTP-коды проверяются по источнику времени, полученному от доверенного сервиса, а не от клиента или недоверенного источника.", - "L": "3" - } - ] - }, - { - "Shortcode": "V6.6", - "Ordinal": 6, - "Name": "Внеполосные механизмы аутентификации", - "Items": [ - { - "Shortcode": "V6.6.1", - "Ordinal": 1, - "Description": "Убедитесь, что механизмы аутентификации через телефонную сеть общего пользования (PSTN) для доставки одноразовых паролей (OTP) по телефону или SMS используются только в случае предварительной валидации номера, при этом предлагаются альтернативные более безопасные методы (например, TOTP), и пользователю сообщаются риски. Для приложений уровня L3 использование телефона и SMS недопустимо.", - "L": "2" - }, - { - "Shortcode": "V6.6.2", - "Ordinal": 2, - "Description": "Убедитесь, что внеполосные запросы, коды или токены привязаны к исходному запросу аутентификации, для которого они были сгенерированы, и не могут быть использованы повторно для других попыток.", - "L": "2" - }, - { - "Shortcode": "V6.6.3", - "Ordinal": 3, - "Description": "Убедитесь, что внеполосные механизмы на основе кода защищены от атак методом подбора (brute force) путём применения ограничения частоты запросов (rate limiting). Также рекомендуется использовать коды с энтропией не менее 64 бит.", - "L": "2" - }, - { - "Shortcode": "V6.6.4", - "Ordinal": 4, - "Description": "Убедитесь, что при использовании push-уведомлений для MFA применяется ограничение частоты (rate limiting), чтобы предотвратить атаки push-бомбинга. Также может помочь механизм сопоставления номеров (number matching).", - "L": "3" - } - ] - }, - { - "Shortcode": "V6.7", - "Ordinal": 7, - "Name": "Криптографические механизмы аутентификации", - "Items": [ - { - "Shortcode": "V6.7.1", - "Ordinal": 1, - "Description": "Убедитесь, что сертификаты, используемые для проверки криптографических утверждений об аутентификации, хранятся таким образом, чтобы исключить возможность их модификации.", - "L": "3" - }, - { - "Shortcode": "V6.7.2", - "Ordinal": 2, - "Description": "Убедитесь, что nonce (случайная строка), используемая в процессе вызова, имеет длину не менее 64 бит и является статистически уникальной или уникальной на протяжении всего срока службы криптографического устройства.", - "L": "3" - } - ] - }, - { - "Shortcode": "V6.8", - "Ordinal": 8, - "Name": "Аутентификация с использованием провайдера идентификаций (IdP)", - "Items": [ - { - "Shortcode": "V6.8.1", - "Ordinal": 1, - "Description": "Убедитесь, что при поддержке несколькими IdP, невозможно подделать личность пользователя через другой IdP (например, с тем же user ID). Стандартным способом защиты является регистрация пользователя с использованием сочетания ID самого IdP (в качестве пространства имён) и пользовательского ID внутри IdP.", - "L": "2" - }, - { - "Shortcode": "V6.8.2", - "Ordinal": 2, - "Description": "Убедитесь, что наличие и целостность цифровой подписи в утверждениях аутентификации (например, в JWT или SAML) всегда проверяются, а неподписанные или недействительные утверждения отклоняются.", - "L": "2" - }, - { - "Shortcode": "V6.8.3", - "Ordinal": 3, - "Description": "Убедитесь, что SAML-утверждения обрабатываются только один раз в течение периода их действия, чтобы исключить атаки воспроизведения (replay attacks).", - "L": "2" - }, - { - "Shortcode": "V6.8.4", - "Ordinal": 4, - "Description": "Убедитесь, что если приложение использует внешний поставщик идентификации (IdP) и для определенных функций требуется особый уровень, метод или срок действия аутентификации, то приложение использует данные, возвращаемые IdP, для проверки этих условий. Например, при использовании OIDC можно проверить значения полей ID Token — acr, amr, auth_time (если они есть). Если IdP не предоставляет эти данные, приложение должно иметь документированный план действий по умолчанию, предполагающий использование минимально допустимой силы аутентификации (например, одноступенчатая — логин и пароль).", - "L": "2" - } - ] - } - ] - }, - { - "Shortcode": "V7", - "Ordinal": 7, - "ShortName": "Session", - "Name": "Управление сессиями", - "Items": [ - { - "Shortcode": "V7.1", - "Ordinal": 1, - "Name": "Документация по управлению сессиями", - "Items": [ - { - "Shortcode": "V7.1.1", - "Ordinal": 1, - "Description": "Убедитесь, что тайм-аут бездействия и абсолютное максимальное время жизни сессии задокументированы, соответствуют другим контрольным мерам и сопровождаются обоснованием любых отклонений от требований повторной аутентификации NIST SP 800-63B.", - "L": "2" - }, - { - "Shortcode": "V7.1.2", - "Ordinal": 2, - "Description": "Убедитесь, что документация определяет допустимое количество одновременных (параллельных) сессий для одного аккаунта, а также поведение системы и действия при достижении этого лимита.", - "L": "2" - }, - { - "Shortcode": "V7.1.3", - "Ordinal": 3, - "Description": "Убедитесь, что все системы, создающие и управляющие сессиями пользователей в рамках федеративной идентификации (например, SSO), задокументированы вместе с механизмами координации сроков действия сессий, условий завершения и случаев, требующих повторной аутентификации.", - "L": "2" - } - ] - }, - { - "Shortcode": "V7.2", - "Ordinal": 2, - "Name": "Базовая безопасность сессий", - "Items": [ - { - "Shortcode": "V7.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что все проверки сессионных токенов выполняются на доверенной серверной стороне.", - "L": "1" - }, - { - "Shortcode": "V7.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что приложение использует либо автономные токены, либо ссылочные токены, которые генерируются динамически, не используя статические API-секреты или ключи.", - "L": "1" - }, - { - "Shortcode": "V7.2.3", - "Ordinal": 3, - "Description": "Убедитесь, что ссылочные токены являются уникальными, создаются с использованием криптографически безопасного генератора псевдослучайных чисел (CSPRNG) и обладают энтропией не менее 128 бит.", - "L": "1" - }, - { - "Shortcode": "V7.2.4", - "Ordinal": 4, - "Description": "Убедитесь, что при аутентификации пользователя (включая повторную) создается новый токен сессии, а текущий — аннулируется.", - "L": "1" - } - ] - }, - { - "Shortcode": "V7.3", - "Ordinal": 3, - "Name": "Тайм-ауты сессии", - "Items": [ - { - "Shortcode": "V7.3.1", - "Ordinal": 1, - "Description": "Убедитесь, что есть тайм-аут бездействия, после которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.", - "L": "2" - }, - { - "Shortcode": "V7.3.2", - "Ordinal": 2, - "Description": "Убедитесь, что установлено абсолютное максимальное время жизни сессии, по истечении которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.", - "L": "2" - } - ] - }, - { - "Shortcode": "V7.4", - "Ordinal": 4, - "Name": "Завершение сессий", - "Items": [ - { - "Shortcode": "V7.4.1", - "Ordinal": 1, - "Description": "Убедитесь, что после завершения сессии (logout, истечение срока) дальнейшее её использование невозможно. Для ссылочных токенов или сессий с сохранением состояния это означает аннулирование на сервере. Для self-contained токенов необходимо реализовать механизм отзыва, например, список отозванных токенов, проверку времени выпуска или ротацию ключей подписи для каждого пользователя.", - "L": "1" - }, - { - "Shortcode": "V7.4.2", - "Ordinal": 2, - "Description": "Убедитесь, что при удалении или отключении пользователя все активные сессии немедленно завершаются.", - "L": "1" - }, - { - "Shortcode": "V7.4.3", - "Ordinal": 3, - "Description": "Убедитесь, что после изменения или удаления факторов аутентификации (например, смена пароля или MFA) приложение предлагает завершить все другие активные сессии.", - "L": "2" - }, - { - "Shortcode": "V7.4.4", - "Ordinal": 4, - "Description": "Убедитесь, что на всех страницах, требующих аутентификации, имеется простой и видимый способ выхода.", - "L": "2" - }, - { - "Shortcode": "V7.4.5", - "Ordinal": 5, - "Description": "Убедитесь, что администраторы могут завершать активные сессии конкретного пользователя или всех пользователей.", - "L": "2" - } - ] - }, - { - "Shortcode": "V7.5", - "Ordinal": 5, - "Name": "Защита от злоупотреблений сессией", - "Items": [ - { - "Shortcode": "V7.5.1", - "Ordinal": 1, - "Description": "Убедитесь, что приложение требует полной повторной аутентификации перед изменением чувствительных атрибутов аккаунта, которые могут влиять на аутентификацию (например, email, номер телефона, настройки MFA или данных восстановления доступа).", - "L": "2" - }, - { - "Shortcode": "V7.5.2", - "Ordinal": 2, - "Description": "Убедитесь, что пользователь может просматривать и (после повторной аутентификации хотя бы по одному фактору) завершать активные сессии.", - "L": "2" - }, - { - "Shortcode": "V7.5.3", - "Ordinal": 3, - "Description": "Убедитесь, что перед выполнением критически важных операций приложение требует повторной аутентификации (по крайней мере, одного фактора) или дополнительной проверки.", - "L": "3" - } - ] - }, - { - "Shortcode": "V7.6", - "Ordinal": 6, - "Name": "Федеративная повторная аутентификация", - "Items": [ - { - "Shortcode": "V7.6.1", - "Ordinal": 1, - "Description": "Убедитесь, что срок действия и завершение сессий между RP и IdP соответствуют документации и включают повторную аутентификацию, если достигнут максимальный допустимый интервал между событиями аутентификации.", - "L": "2" - }, - { - "Shortcode": "V7.6.2", - "Ordinal": 2, - "Description": "Убедитесь, что создание сессии требует согласия пользователя или явного действия, предотвращающего несанкционированное создание сессий без участия пользователя.", - "L": "2" - } - ] - } - ] - }, - { - "Shortcode": "V8", - "Ordinal": 8, - "ShortName": "Authorization", - "Name": "Авторизация", - "Items": [ - { - "Shortcode": "V8.1", - "Ordinal": 1, - "Name": "Документация по авторизации", - "Items": [ - { - "Shortcode": "V8.1.1", - "Ordinal": 1, - "Description": "Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне функций и на уровне данных на основе прав субъекта и атрибутов ресурса.", - "L": "1" - }, - { - "Shortcode": "V8.1.2", - "Ordinal": 2, - "Description": "Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне полей (как на чтение, так и на запись) на основе прав субъекта и атрибутов ресурса. Эти правила могут зависеть от других атрибутов объекта данных, например, статуса.", - "L": "2" - }, - { - "Shortcode": "V8.1.3", - "Ordinal": 3, - "Description": "Убедитесь, что документация определяет, какие атрибуты окружения и контекста (например, время суток, IP-адрес, местоположение, устройство) используются приложением для принятия решений в области аутентификации и авторизации.", - "L": "3" - }, - { - "Shortcode": "V8.1.4", - "Ordinal": 4, - "Description": "Убедитесь, что документация по аутентификации и авторизации определяет, как используются факторы окружения и контекста в принятии решений, наряду с правилами доступа к функциям, данным и полям. Документация должна содержать оцениваемые атрибуты, пороговые значения риска, действия (разрешить, отказать, повысить уровень аутентификации и др.).", - "L": "3" - } - ] - }, - { - "Shortcode": "V8.2", - "Ordinal": 2, - "Name": "Архитектура авторизации", - "Items": [ - { - "Shortcode": "V8.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что приложение обеспечивает доступ на уровне функций (function-level) только субъектам с явными разрешениями.", - "L": "1" - }, - { - "Shortcode": "V8.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что приложение обеспечивает доступ на уровне данных (data-specific) только тем субъектам, которым явно предоставлены права к определённым элементам данных, чтобы предотвратить IDOR (Insecure Direct Object Reference) и BOLA-уязвимости (Broken Object Level Authorization).", - "L": "1" - }, - { - "Shortcode": "V8.2.3", - "Ordinal": 3, - "Description": "Убедитесь, что приложение обеспечивает доступ на уровне полей (field-level) только тем субъектам, которым явно предоставлены права к определённым полям, чтобы предотвратить BOPLA (Broken Object Property Level Authorization).", - "L": "2" - }, - { - "Shortcode": "V8.2.4", - "Ordinal": 4, - "Description": "Убедитесь, что реализованы адаптивные меры безопасности, основанные на атрибутах окружения и контекста субъекта (время, местоположение, IP, устройство), которые используются для принятия решений об аутентификации и авторизации, как это определено в документации приложения. Эти меры должны применяться как при попытке субъекта начать новую сессию, так и во время существующей сессии.", - "L": "3" - } - ] - }, - { - "Shortcode": "V8.3", - "Ordinal": 3, - "Name": "Авторизация на уровне операций", - "Items": [ - { - "Shortcode": "V8.3.1", - "Ordinal": 1, - "Description": "Убедитесь, что правила авторизации реализуются на доверенном сервисном уровне и не зависят от элементов, которые может контролировать клиент (например, JavaScript на стороне клиента).", - "L": "1" - }, - { - "Shortcode": "V8.3.2", - "Ordinal": 2, - "Description": "Убедитесь, что изменения значений, влияющих на авторизацию, применяются немедленно. Если это невозможно (например, при использовании автономных токенов), должны быть реализованы компенсирующие меры: оповещения о попытке несанкционированного действия и откат изменений. Обратите внимание, что данный подход не предотвращает утечку информации.", - "L": "3" - }, - { - "Shortcode": "V8.3.3", - "Ordinal": 3, - "Description": "Убедитесь, что доступ к объекту осуществляется на основе прав субъекта, инициировавшего запрос, а не прав промежуточного сервиса, действующего от его имени. Например, если пользователь обращается к веб-сервису с автономным токеном для аутентификации, а сервис затем запрашивает данные у другого сервиса, второй сервис должен использовать токен пользователя, а не токен первого сервиса для принятия решения о доступе.", - "L": "3" - } - ] - }, - { - "Shortcode": "V8.4", - "Ordinal": 4, - "Name": "Прочие аспекты авторизации", - "Items": [ - { - "Shortcode": "V8.4.1", - "Ordinal": 1, - "Description": "Убедитесь, что в мультитенантных приложениях реализованы механизмы, предотвращающие действия потребителя в отношении арендаторов, к которым у него нет доступа.", - "L": "2" - }, - { - "Shortcode": "V8.4.2", - "Ordinal": 2, - "Description": "Убедитесь, что доступ к административным интерфейсам защищён несколькими уровнями контроля, включая непрерывную проверку личности, контроль защищённости устройства и анализ контекстных рисков. Недостаточно опираться только на IP-адрес или доверенные устройства.", - "L": "3" - } - ] - } - ] - }, - { - "Shortcode": "V9", - "Ordinal": 9, - "ShortName": "Self", - "Name": "Автономные токены", - "Items": [ - { - "Shortcode": "V9.1", - "Ordinal": 1, - "Name": "Источник токена и его целостность", - "Items": [ - { - "Shortcode": "V9.1.1", - "Ordinal": 1, - "Description": "Убедитесь, что автономные токены проверяются на целостность с помощью цифровой подписи или MAC, прежде чем доверять их содержимому.", - "L": "1" - }, - { - "Shortcode": "V9.1.2", - "Ordinal": 2, - "Description": "Проверяйте, что автономные токены создаются и проверяются исключительно с помощью алгоритмов из списка допустимых в данном контексте. Список допустимых алгоритмов должен включать только разрешенные алгоритмы (желательно либо только симметричные, либо только асимметричные) и ни в коем случае не содержать алгоритм None. Если необходимо поддерживать оба типа алгоритмов, потребуются дополнительные средства контроля для предотвращения путаницы с ключами (key confusion).", - "L": "1" - }, - { - "Shortcode": "V9.1.3", - "Ordinal": 3, - "Description": "Убедитесь, что ключи, используемые для проверки автономных токенов, получены из доверенных, предварительно настроенных источников. Это предотвращает возможность указания злоумышленниками ненадёжных источников и ключей. Для JWT и других JWS структур заголовки 'jku', 'x5u' и 'jwk' должны проверяться по белому списку.", - "L": "1" - } - ] - }, - { - "Shortcode": "V9.2", - "Ordinal": 2, - "Name": "Содержимое токена", - "Items": [ - { - "Shortcode": "V9.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что при указанном сроке действия токен и его содержимое принимаются только в том случае, если срок действия токена не истёк. Например, для JWT нужно проверить поля 'nbf' и 'exp'.", - "L": "1" - }, - { - "Shortcode": "V9.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что сервис, принимающий токен, проверяет его тип и соответствие назначению перед обработкой содержимого токена. Например, для принятия решений об авторизации могут быть приняты только Access Token, а для подтверждения аутентификации пользователя — только ID Token.", - "L": "2" - }, - { - "Shortcode": "V9.2.3", - "Ordinal": 3, - "Description": "Убедитесь, что сервис принимает только токены, предназначенные для использования с этим сервисом (audience). Для JWT это можно сделать, проверив наличие утверждения «aud» по белому списку, определенному в сервисе.", - "L": "2" - }, - { - "Shortcode": "V9.2.4", - "Ordinal": 4, - "Description": "Убедитесь, что, если эмитент токенов использует один и тот же закрытый ключ для выпуска токенов различным сервисам (audiences), выпущенные токены содержат явное указание целевых сервисов. Это предотвратит повторное использования токенов в не предназначенных для них сервисах. Если идентификатор сервиса (audience identifier) назначается динамически, эмитент токенов должен проверить audiences для исключения подмены получателей (audience impersonation).", - "L": "2" - } - ] - } - ] - }, - { - "Shortcode": "V10", - "Ordinal": 10, - "ShortName": "OAuth", - "Name": "OAuth и OIDC", - "Items": [ - { - "Shortcode": "V10.1", - "Ordinal": 1, - "Name": "Общие требования безопасности OAuth и OIDC", - "Items": [ - { - "Shortcode": "V10.1.1", - "Ordinal": 1, - "Description": "Убедитесь, что токены передаются только тем компонентам, которым они действительно необходимы. Например, при использовании схемы backend-for-frontend для браузерных JavaScript-приложений, access и refresh токены должны быть доступны только на backend.", - "L": "2" - }, - { - "Shortcode": "V10.1.2", - "Ordinal": 2, - "Description": "Убедитесь, что клиент принимает значения от авторизационного сервера (например, authorization code или ID Token) только если они получены в результате авторизационного потока, инициированного в той же сессии пользовательского агента и в рамках той же транзакции. Для этого клиентские секреты, такие как proof key для code exchange (PKCE) — 'code_verifier', 'state' или OIDC 'nonce' — должны быть непредсказуемыми, специфичными для транзакции и надежно привязанными как к клиенту, так и к сессии пользовательского агента, в которой началась транзакция.", - "L": "2" - } - ] - }, - { - "Shortcode": "V10.2", - "Ordinal": 2, - "Name": "Клиент OAuth", - "Items": [ - { - "Shortcode": "V10.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что если используется механизм authorization code flow, OAuth клиент защищён от CSRF, вызывающих запросы токенов либо за счёт использования механизма proof key for code exchange (PKCE), либо за счёт проверки параметра 'state', который был отправлен в запросе авторизации.", - "L": "2" - }, - { - "Shortcode": "V10.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что если OAuth клиент может взаимодействовать с более чем одним сервером авторизации, у него есть защита от атак смешивания (mix-up attacks). Например, клиент должен требовать, чтобы сервер авторизации возвращал параметр 'iss' и проверять его в ответах на авторизацию и токены.", - "L": "2" - }, - { - "Shortcode": "V10.2.3", - "Ordinal": 3, - "Description": "Убедитесь, что OAuth клиент запрашивает только необходимые области доступа (scopes) или другие параметры авторизации в запросах к серверу авторизации.", - "L": "3" - } - ] - }, - { - "Shortcode": "V10.3", - "Ordinal": 3, - "Name": "Сервер ресурсов OAuth", - "Items": [ - { - "Shortcode": "V10.3.1", - "Ordinal": 1, - "Description": "Убедитесь, что сервер ресурсов принимает только те access токены, которые предназначены для использования с этим сервисом (свойство audience). Эта принадлежность сервису может быть включена в структурированный access токен (например, в поле 'aud' в JWT) или проверяться через endpoint интроспекции токена.", - "L": "2" - }, - { - "Shortcode": "V10.3.2", - "Ordinal": 2, - "Description": "Убедитесь, что сервер ресурсов принимает решения по авторизации на основе claims из access токена, определяющих делегированную авторизацию. Если присутствуют claims, такие как 'sub', 'scope' и 'authorization_details', они должны участвовать в принятии решения.", - "L": "2" - }, - { - "Shortcode": "V10.3.3", - "Ordinal": 3, - "Description": "Убедитесь, что если для принятия решения по контролю доступа необходимо однозначно идентифицировать пользователя из access токена (JWT или ответа интроспекции), сервер ресурсов использует claims, которые не могут быть переприсвоены другим пользователям. Обычно это комбинация claims 'iss' и 'sub'.", - "L": "2" - }, - { - "Shortcode": "V10.3.4", - "Ordinal": 4, - "Description": "Убедитесь, что если сервер ресурсов требует определённой силы аутентификации, методов или свежести аутентификации, он проверяет, что предъявленный access токен удовлетворяет этим требованиям. Например, при наличии, могут использоваться claims OIDC 'acr', 'amr' и 'auth_time'.", - "L": "2" - }, - { - "Shortcode": "V10.3.5", - "Ordinal": 5, - "Description": "Убедитесь, что сервер ресурсов предотвращает использование украденных access токенов или их повторное использование (replay) неавторизованными лицами, требуя access токены с подтверждением отправителя — например, Mutual TLS для OAuth 2 или OAuth 2 Demonstration of Proof of Possession (DPoP).", - "L": "3" - } - ] - }, - { - "Shortcode": "V10.4", - "Ordinal": 4, - "Name": "Сервер авторизации OAuth", - "Items": [ - { - "Shortcode": "V10.4.1", - "Ordinal": 1, - "Description": "Убедитесь, что сервер авторизации проверяет URI перенаправления (redirect URI), сверяя его с заранее зарегистрированным списком разрешённых URI для данного клиента (allowlist), используя точное сравнение строк.", - "L": "1" - }, - { - "Shortcode": "V10.4.2", - "Ordinal": 2, - "Description": "Убедитесь, что если сервер авторизации возвращает authorization code в ответе авторизации, этот код может быть использован только один раз для запроса токена. При втором валидном запросе с уже использованным кодом сервер должен отклонить запрос и отозвать любые токены, связанные с этим кодом.", - "L": "1" - }, - { - "Shortcode": "V10.4.3", - "Ordinal": 3, - "Description": "Убедитесь, что authorization code имеет короткое время жизни. Максимальная продолжительность — до 10 минут для приложений L1 и L2 и до 1 минуты для приложений L3.", - "L": "1" - }, - { - "Shortcode": "V10.4.4", - "Ordinal": 4, - "Description": "Убедитесь, что сервер авторизации для конкретного клиента разрешает использование только тех типов авторизации, которые необходимы этому клиенту. Обратите внимание, что тип авторизации Implicit flow и Resource Owner Password Credentials flow больше не должны использоваться.", - "L": "1" - }, - { - "Shortcode": "V10.4.5", - "Ordinal": 5, - "Description": "Убедитесь, что сервер авторизации предотвращает атаки повторного использования refresh токенов для публичных клиентов, предпочтительно используя sender-constrained refresh токены, такие как DPoP или сертификат-связанные токены с mutual TLS (mTLS). Для L1 и L2 допускается ротация refresh токенов с обязательной их инвалидацией после использования. Если используется ротация, сервер должен отозвать все refresh токены при попытке использовать уже инвалидированный токен.", - "L": "1" - }, - { - "Shortcode": "V10.4.6", - "Ordinal": 6, - "Description": "Убедитесь, что при использовании типа авторизации «Authorization Code» сервер предотвращает атаки перехвата authorization code, требуя Proof Key for Code Exchange (PKCE). В запросах авторизации сервер должен требовать валидное значение 'code_challenge' и не принимать 'code_challenge_method' со значением 'plain'. В запросах токена обязательно валидировать параметр 'code_verifier'.", - "L": "2" - }, - { - "Shortcode": "V10.4.7", - "Ordinal": 7, - "Description": "Убедитесь, что если сервер авторизации поддерживает динамическую регистрацию клиентов без аутентификации, он минимизирует риски вредоносных клиентов. Сервер должен валидировать метаданные клиента (например, зарегистрированные URI), обеспечивать согласие пользователя и предупреждать пользователя перед обработкой запроса авторизации от недоверенного клиента.", - "L": "2" - }, - { - "Shortcode": "V10.4.8", - "Ordinal": 8, - "Description": "Убедитесь, что refresh токены имеют абсолютный срок действия, включая случаи, когда применяется скользящее время истечения срока.", - "L": "2" - }, - { - "Shortcode": "V10.4.9", - "Ordinal": 9, - "Description": "Убедитесь, что пользователи могут отзывать refresh токены и reference access токены через пользовательский интерфейс сервера авторизации для снижения риска от вредоносных клиентов или кражи токенов.", - "L": "2" - }, - { - "Shortcode": "V10.4.10", - "Ordinal": 10, - "Description": "Убедитесь, что конфиденциальный клиент аутентифицируется при взаимодействии с сервером авторизации через backchannel, например при запросах токена, pushed authorization requests (PAR) и запросах на отзыв токенов.", - "L": "2" - }, - { - "Shortcode": "V10.4.11", - "Ordinal": 11, - "Description": "Убедитесь, что конфигурация сервера авторизации назначает OAuth клиенту только необходимые области доступа (scopes).", - "L": "2" - }, - { - "Shortcode": "V10.4.12", - "Ordinal": 12, - "Description": "Убедитесь, что для конкретного клиента сервер авторизации разрешает только те значения 'response_mode', которые необходимы этому клиенту. Например, сервер должен валидировать это значение против ожидаемых или использовать pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).", - "L": "3" - }, - { - "Shortcode": "V10.4.13", - "Ordinal": 13, - "Description": "Убедитесь, что грант типа 'code' всегда используется вместе с pushed authorization requests (PAR).", - "L": "3" - }, - { - "Shortcode": "V10.4.14", - "Ordinal": 14, - "Description": "Убедитесь, что сервер авторизации выдаёт только sender-constrained (Proof-of-Possession) access токены, либо с сертификат-связанными токенами через mutual TLS (mTLS), либо DPoP-bound токены (Demonstration of Proof of Possession).", - "L": "3" - }, - { - "Shortcode": "V10.4.15", - "Ordinal": 15, - "Description": "Убедитесь, что для серверного клиента (не выполняющегося на устройстве конечного пользователя) сервер авторизации проверяет, что значение параметра 'authorization_details' исходит из клиентского backend и что пользователь не изменял его. Например, это достигается использованием pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).", - "L": "3" - }, - { - "Shortcode": "V10.4.16", - "Ordinal": 16, - "Description": "Убедитесь, что клиент является конфиденциальным и сервер авторизации требует использования сильных методов аутентификации клиента (основанных на криптографии с открытым ключом и устойчивых к атакам повторного воспроизведения), таких как mutual TLS ('tls_client_auth', 'self_signed_tls_client_auth') или private key JWT ('private_key_jwt').", - "L": "3" - } - ] - }, - { - "Shortcode": "V10.5", - "Ordinal": 5, - "Name": "Клиент OIDC", - "Items": [ - { - "Shortcode": "V10.5.1", - "Ordinal": 1, - "Description": "Убедитесь, что клиент (relying party) защищается от повторного использования ID Token (replay-атак). Например, это достигается проверкой того, что значение 'nonce' в ID Token совпадает со значением 'nonce', отправленным в запросе аутентификации провайдеру OpenID (authorization server).", - "L": "2" - }, - { - "Shortcode": "V10.5.2", - "Ordinal": 2, - "Description": "Убедитесь, что клиент однозначно идентифицирует пользователя по утверждениям (claims) ID Token, обычно это 'sub', который не может быть переназначен другому пользователю (в пределах конкретного провайдера идентификации).", - "L": "2" - }, - { - "Shortcode": "V10.5.3", - "Ordinal": 3, - "Description": "Убедитесь, что клиент отклоняет попытки злоумышленного сервера авторизации выдавать себя за другой сервер авторизации через метаданные сервера авторизации. Клиент должен отклонить метаданные, если URL издателя (issuer) в метаданных не совпадает точно с преднастроенным URL издателя, ожидаемым клиентом.", - "L": "2" - }, - { - "Shortcode": "V10.5.4", - "Ordinal": 4, - "Description": "Убедитесь, что клиент проверяет, что ID Token предназначен для него (проверка audience), сравнивая значение 'aud' в токене с 'client_id' клиента.", - "L": "2" - }, - { - "Shortcode": "V10.5.5", - "Ordinal": 5, - "Description": "Убедитесь, что при использовании OIDC back-channel logout клиент снижает риск отказа в обслуживании, вызванный принудительным выходом из системы и путаницей между разными типами JWT (cross-JWT confusion) в процессе логаута. Клиент должен проверить, что токен выхода корректно типизирован со значением 'logout+jwt', содержит claim 'event' с правильным именем участника и не содержит 'nonce'. Также рекомендуется установить короткий срок действия токена (например, 2 минуты).", - "L": "2" - } - ] - }, - { - "Shortcode": "V10.6", - "Ordinal": 6, - "Name": "Провайдер OpenID", - "Items": [ - { - "Shortcode": "V10.6.1", - "Ordinal": 1, - "Description": "Убедитесь, что провайдер OpenID допускает только значения 'code', 'ciba', 'id_token' или 'id_token code' для параметра response mode. При этом предпочтение отдаётся 'code' по сравнению с 'id_token code' (гибридный поток OIDC), а значение 'token' (любой Implicit flow) не должно использоваться.", - "L": "2" - }, - { - "Shortcode": "V10.6.2", - "Ordinal": 2, - "Description": "Убедитесь, что провайдер OpenID предотвращает отказ в обслуживании (DoS) через принудительный выход (logout), запрашивая явное подтверждение от конечного пользователя или, если применимо, проверяя параметры в запросе выхода (инициированном relying party), например параметр 'id_token_hint'.", - "L": "2" - } - ] - }, - { - "Shortcode": "V10.7", - "Ordinal": 7, - "Name": "Управление согласием", - "Items": [ - { - "Shortcode": "V10.7.1", - "Ordinal": 1, - "Description": "Убедитесь, что авторизационный сервер обеспечивает получение согласия пользователя для каждого запроса авторизации. Если личность клиента не может быть подтверждена, сервер авторизации всегда должен явно запрашивать согласие пользователя.", - "L": "2" - }, - { - "Shortcode": "V10.7.2", - "Ordinal": 2, - "Description": "Убедитесь, что при запросе согласия пользователя авторизационный сервер предоставляет достаточную и понятную информацию о том, на что даётся согласие. При необходимости это должно включать характер запрашиваемых разрешений (обычно основанных на scope, ресурсном сервере, деталях авторизации Rich Authorization Requests (RAR)), идентификацию авторизованного приложения и срок действия этих разрешений.", - "L": "2" - }, - { - "Shortcode": "V10.7.3", - "Ordinal": 3, - "Description": "Убедитесь, что пользователь может просматривать, изменять и отзывать согласия, которые он предоставил, через авторизационный сервер.", - "L": "2" - } - ] - } - ] - }, - { - "Shortcode": "V11", - "Ordinal": 11, - "ShortName": "Cryptography", - "Name": "Криптография", - "Items": [ - { - "Shortcode": "V11.1", - "Ordinal": 1, - "Name": "Инвентаризация и документирование криптографии", - "Items": [ - { - "Shortcode": "V11.1.1", - "Ordinal": 1, - "Description": "Убедитесь, что задокументирована политика управления криптографическими ключами и описан их жизненный цикл в соответствии со стандартом управления ключей, таким как NIST SP 800-57. Убедитесь, что ключи известны только тем сущностям, которым они должны быть доступны (например, ключи не передавались более чем двум участникам для общих секретов и более чем одному участнику для приватных ключей).", - "L": "2" - }, - { - "Shortcode": "V11.1.2", - "Ordinal": 2, - "Description": "Убедитесь, что проводится инвентаризация криптографических средств, которая непрерывно поддерживается, регулярно обновляется и включает все криптографические ключи, алгоритмы и сертификаты, используемые в приложении. Также должна быть задокументирована информация о том, где ключи могут и не могут использоваться в системе, а также какие типы данных могут и не могут быть защищены с помощью этих ключей.", - "L": "2" - }, - { - "Shortcode": "V11.1.3", - "Ordinal": 3, - "Description": "Убедитесь, что используются механизмы обнаружения криптографии для идентификации всех случаев применения криптографии в системе , включая операции шифрования, хеширования и цифровой подписи.", - "L": "3" - }, - { - "Shortcode": "V11.1.4", - "Ordinal": 4, - "Description": "Убедитесь, что ведётся и поддерживается инвентаризация криптографических средств. В неё должен входить документированный план, описывающий переход на новые криптографические стандарты, такие как постквантовая криптография, чтобы своевременно реагировать на будущие угрозы.", - "L": "3" - } - ] - }, - { - "Shortcode": "V11.2", - "Ordinal": 2, - "Name": "Безопасная реализация криптографии", - "Items": [ - { - "Shortcode": "V11.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что для криптографических операций используются утвержденные в индустрии реализации (включая библиотеки и аппаратные реализации).", - "L": "2" - }, - { - "Shortcode": "V11.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что архитектура приложения поддерживает быструю реконфигурацию, усовершенствование или смену в любой момент случайных чисел, аутентифицированного шифрования, MAC, алгоритмов хеширования, длин ключей, количества раундов, шифров и режимов шифрования для защиты от криптографических атак. Также должна поддерживаться возможность смены ключей, паролей и повторного шифрования данных. Это позволит беспрепятственно перейти на постквантовую криптографию (PQC), как только станут широко доступны высоконадёжные реализации одобренных схем или стандартов PQC.", - "L": "2" - }, - { - "Shortcode": "V11.2.3", - "Ordinal": 3, - "Description": "Убедитесь, что все криптографические примитивы используют как минимум 128-бит стойкости с учетом алгоритма, размера ключа и конфигурации. Например, 256-битный ECC ключ обеспечивает примерно 128 бит безопасности, тогда как для достижения того же уровня безопасности в RSA требуется ключ длиной 3072 бита.", - "L": "2" - }, - { - "Shortcode": "V11.2.4", - "Ordinal": 4, - "Description": "Убедитесь, что все криптографические операции выполняются за константное время, без использования «short-circuit» операций в сравнениях, вычислениях, возвратах функций для избежания утечек информации.", - "L": "3" - }, - { - "Shortcode": "V11.2.5", - "Ordinal": 5, - "Description": "Убедитесь, что все криптографические модули обеспечивают безопасное завершение работы при ошибках, а обработка ошибок реализована таким образом, чтобы не создавать уязвимостей, например, таких как атаки Padding Oracle.", - "L": "3" - } - ] - }, - { - "Shortcode": "V11.3", - "Ordinal": 3, - "Name": "Алгоритмы шифрования", - "Items": [ - { - "Shortcode": "V11.3.1", - "Ordinal": 1, - "Description": "Убедитесь, что не используются небезопасные режимы блочного шифрования (н-р, ECB) и слабые схемы дополнения (padding) (н-р, PKCS#1 v1.5).", - "L": "1" - }, - { - "Shortcode": "V11.3.2", - "Ordinal": 2, - "Description": "Убедитесь, что используются только утверждённые шифры и режимы, такие как AES с GCM.", - "L": "1" - }, - { - "Shortcode": "V11.3.3", - "Ordinal": 3, - "Description": "Убедитесь, что зашифрованные данные защищены от несанкционированного изменения, предпочтительно с использованием утверждённого метода аутентифицированного шифрования или путём комбинирования утверждённого метода шифрования с утверждённым алгоритмом MAC.", - "L": "2" - }, - { - "Shortcode": "V11.3.4", - "Ordinal": 4, - "Description": "Убедитесь, что случайные числа (nonce), векторы инициализации (IV) и другие одноразовые числа не используются более одного раза для одной и той же пары ключа шифрования и элемента данных. Метод их генерации должен соответствовать требованиям используемого алгоритма.", - "L": "3" - }, - { - "Shortcode": "V11.3.5", - "Ordinal": 5, - "Description": "Убедитесь, что любая комбинация алгоритма шифрования и алгоритма MAC работает в режиме encrypt-then-MAC (EtM).", - "L": "3" - } - ] - }, - { - "Shortcode": "V11.4", - "Ordinal": 4, - "Name": "Хеширование и функции на основе хеширования", - "Items": [ - { - "Shortcode": "V11.4.1", - "Ordinal": 1, - "Description": "Убедитесь, что только утвержденные хэш-функции используются для стандартных сценариев использования в криптографии, включая цифровую подпись, HMAC, KDF, генерацию случайных чисел. Запрещено использовать неустойчивые хэш-функции, (н-р, MD5) для любого использования в криптографии.", - "L": "1" - }, - { - "Shortcode": "V11.4.2", - "Ordinal": 2, - "Description": "Убедитесь, что пароли хранятся с использованием утверждённой, вычислительно затратной функции генерации ключа (также известной как «функция хеширования паролей»), с параметрами, настроенными в соответствии с актуальными рекомендациями. Настройки должны обеспечивать баланс между безопасностью и производительностью, чтобы сделать атаки перебором достаточно сложными для требуемого уровня безопасности.", - "L": "2" - }, - { - "Shortcode": "V11.4.3", - "Ordinal": 3, - "Description": "Убедитесь, что хэш-функции, используемые в формировании цифровой подписи, как часть аутентификации и целостности данных, устойчивы к коллизиям и имеют достаточную длину.", - "L": "2" - }, - { - "Shortcode": "V11.4.4", - "Ordinal": 4, - "Description": "Убедитесь, что приложение использует утвержденную функцию генерации ключа с использованием параметров расширения ключа (key stretching) при генерации ключа из пароля. Параметры должны быть сбалансированы с точки зрения безопасности, производительности и устойчивости к атакам полного перебора при компрометации результирующего криптографического ключа.", - "L": "2" - } - ] - }, - { - "Shortcode": "V11.5", - "Ordinal": 5, - "Name": "Случайные значения", - "Items": [ - { - "Shortcode": "V11.5.1", - "Ordinal": 1, - "Description": "Убедитесь, что все случайные числа и строки, которые должны быть непредсказуемы, должны быть сгенерированы с помощью CSPRNG и иметь хотя бы 128 бит энтропии. Учтите, что UUID не удовлетворяют данному условию.", - "L": "2" - }, - { - "Shortcode": "V11.5.2", - "Ordinal": 2, - "Description": "Убедитесь, что механизм генерации случайных чисел является надежным даже при высокой нагрузке.", - "L": "3" - } - ] - }, - { - "Shortcode": "V11.6", - "Ordinal": 6, - "Name": "Криптография с публичным ключом", - "Items": [ - { - "Shortcode": "V11.6.1", - "Ordinal": 1, - "Description": "Убедитесь, что только утвержденные криптографические алгоритмы и режимы операций используются для генерации ключа и инициализации случайного значения для его генерации (seeding), а также для генерации цифровой подписи и верификации. Алгоритмы генерации ключей не должны генерировать небезопасные ключи уязвимые к известным атакам, например, ключи RSA уязвимы к факторизации Ферма.", - "L": "2" - }, - { - "Shortcode": "V11.6.2", - "Ordinal": 2, - "Description": "Убедитесь, что для обмена ключами используются утверждённые криптографические алгоритмы (например, Диффи-Хеллман) с особым вниманием к обеспечению использования безопасных параметров. Это предотвратит атаки на процесс установления ключа, которые могут привести к атакам «человек посередине» или криптографическим взломам.", - "L": "3" - } - ] - }, - { - "Shortcode": "V11.7", - "Ordinal": 7, - "Name": "Шифрование данных в процессе использования", - "Items": [ - { - "Shortcode": "V11.7.1", - "Ordinal": 1, - "Description": "Убедитесь, что используется полное шифрование памяти, которое защищает конфиденциальные данные во время их использования, предотвращая доступ к ним неавторизованных пользователей или процессов.", - "L": "3" - }, - { - "Shortcode": "V11.7.2", - "Ordinal": 2, - "Description": "Убедитесь, что минимизация данных обеспечивает раскрытие минимально необходимого объёма данных во время обработки, а также что данные шифруются сразу после использования или как можно скорее.", - "L": "3" - } - ] - } - ] - }, - { - "Shortcode": "V12", - "Ordinal": 12, - "ShortName": "Secure", - "Name": "Безопасная коммуникация", - "Items": [ - { - "Shortcode": "V12.1", - "Ordinal": 1, - "Name": "Общие рекомендации по безопасности TLS", - "Items": [ - { - "Shortcode": "V12.1.1", - "Ordinal": 1, - "Description": "Убедитесь, что включены только актуальные и рекомендуемые версии протокола TLS, такие как TLS 1.2 и TLS 1.3. Наиболее свежая версия TLS должна быть выбрана как предпочтительная.", - "L": "1" - }, - { - "Shortcode": "V12.1.2", - "Ordinal": 2, - "Description": "Убедитесь, что включены рекомендуемые шифронаборы (cipher suites), предпочтение также стоит отдать самому сильному шифронабору. L3 приложения должны поддерживать только те наборы шифров (cipher suites), которые обеспечивают прямую (forward) секретность. Пояснение: Прямая секретность (Forward Secrecy, FS) — это криптографическая особенность, при которой сессионные ключи уникальны для каждой сессии и не зависят от долгосрочных ключей. Это гарантирует, что даже при компрометации долгосрочного ключа злоумышленник не сможет расшифровать ранее перехваченные зашифрованные сессии.", - "L": "2" - }, - { - "Shortcode": "V12.1.3", - "Ordinal": 3, - "Description": "Убедитесь, что приложение проверяет доверенность клиентских сертификатов mTLS, прежде чем использовать идентификацию по сертификату для аутентификации или авторизации.", - "L": "2" - }, - { - "Shortcode": "V12.1.4", - "Ordinal": 4, - "Description": "Убедитесь, что включена и настроена правильная проверка отзыва сертификатов, такая как Online Certificate Status Protocol (OCSP) Stapling.", - "L": "3" - }, - { - "Shortcode": "V12.1.5", - "Ordinal": 5, - "Description": "Убедитесь, что в настройках TLS приложения включена функция Encrypted Client Hello (ECH) для предотвращения раскрытия конфиденциальных метаданных, таких как Server Name Indication (SNI), во время процесса TLS-рукопожатия.", - "L": "3" - } - ] - }, - { - "Shortcode": "V12.2", - "Ordinal": 2, - "Name": "HTTPS коммуникация с внешними сервисами", - "Items": [ - { - "Shortcode": "V12.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что для всех соединений между клиентом и внешними HTTP-сервисами используется TLS и не происходит отката к небезопасным или незашифрованным протоколам.", - "L": "1" - }, - { - "Shortcode": "V12.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что внешние сервисы используют публично доверенные TLS-сертификаты.", - "L": "1" - } - ] - }, - { - "Shortcode": "V12.3", - "Ordinal": 3, - "Name": "Общая безопасность межсервисного взаимодействия", - "Items": [ - { - "Shortcode": "V12.3.1", - "Ordinal": 1, - "Description": "Убедитесь, что для всех входящих и исходящих соединений приложения используется зашифрованный протокол, например TLS, включая системы мониторинга, инструменты управления, удалённый доступ и SSH, промежуточное ПО, базы данных, мейнфреймы, партнёрские системы и внешние API. Сервер не должен допускать откат к небезопасным или незашифрованным протоколам.", - "L": "2" - }, - { - "Shortcode": "V12.3.2", - "Ordinal": 2, - "Description": "Убедитесь, что TLS-клиент проверяет сертификат сервера до установления защищенного соединения с TLS-сервером.", - "L": "2" - }, - { - "Shortcode": "V12.3.3", - "Ordinal": 3, - "Description": "Убедитесь, что все внутренние HTTP-взаимодействия между компонентами приложения используют TLS или другой подходящий механизм транспортного шифрования, и не происходит откат к небезопасным или незашифрованным коммуникациям.", - "L": "2" - }, - { - "Shortcode": "V12.3.4", - "Ordinal": 4, - "Description": "Убедитесь, что TLS-соединения между внутренними сервисами используют доверенные сертификаты. Если используются внутренние или самоподписанные сертификаты, потребляющий сервис должен быть настроен на доверие только к конкретным внутренним центрам сертификации (CA) и конкретным самоподписанным сертификатам.", - "L": "2" - }, - { - "Shortcode": "V12.3.5", - "Ordinal": 5, - "Description": "Убедитесь, что сервисы, взаимодействующие внутри системы (intra-service communications), используют строгую аутентификацию для проверки каждого конечного узла. Для проверки подлинности взаимодействующих сторон должны применяться методы строгой аутентификации, такие как аутентификация TLS-клиента, с использованием инфраструктуры открытых ключей и механизмов, устойчивых к атакам повтора (replay attacks). Для микросервисных архитектур рекомендуется использование service mesh для упрощения управления сертификатами и повышения безопасности.", - "L": "3" - } - ] - } - ] - }, - { - "Shortcode": "V13", - "Ordinal": 13, - "ShortName": "Configuration", - "Name": "Конфигурация", - "Items": [ - { - "Shortcode": "V13.1", - "Ordinal": 1, - "Name": "Документация конфигурации", - "Items": [ - { - "Shortcode": "V13.1.1", - "Ordinal": 1, - "Description": "Убедитесь, что все необходимые доступы приложения задокументированы. Сюда должны быть включены как внешние сервисы, от которых зависит приложение, так и сценарии, когда конечный пользователь может задавать адреса для внешнего подключения.", - "L": "2" - }, - { - "Shortcode": "V13.1.2", - "Ordinal": 2, - "Description": "Убедитесь, что для каждого сервиса, используемого приложением, в документации определено максимальное количество одновременных соединений (например, лимиты пула соединений) и описано поведение приложения при достижении этого лимита, включая любые механизмы отказоустойчивости или восстановления, чтобы предотвратить ситуации отказа в обслуживании (DoS).", - "L": "3" - }, - { - "Shortcode": "V13.1.3", - "Ordinal": 3, - "Description": "Убедитесь, что в документации приложения определены стратегии управления ресурсами для каждой внешней системы или сервиса, которые оно использует (например, базы данных, файловые дескрипторы, потоки, HTTP-соединения). Стратегии должны включать процедуры освобождения ресурсов, настройки таймаутов, обработку сбоев, а также, если реализована логика повторных попыток, указание лимитов, задержек и алгоритмов back-off. Для синхронных HTTP-запросов должны быть заданы короткие таймауты, а повторные запросы должны быть отключены, либо строго ограничены по числу попыток, чтобы предотвратить каскадные задержки и истощение ресурсов.", - "L": "3" - }, - { - "Shortcode": "V13.1.4", - "Ordinal": 4, - "Description": "Убедитесь, что в документации приложения определены секреты, критически важные для безопасности приложения, а также установлен график их ротации в соответствии с моделью угроз организации и её бизнес-требованиями.", - "L": "3" - } - ] - }, - { - "Shortcode": "V13.2", - "Ordinal": 2, - "Name": "Конфигурация бэкенд соединений", - "Items": [ - { - "Shortcode": "V13.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что коммуникации между компонентами бэкенда приложения (включая API, промежуточное ПО и уровни данных), которые не поддерживают стандартный механизм пользовательских сессий, проходят с аутентификацией. Аутентификация должна использовать индивидуальные сервисные аккаунты, краткосрочные токены или аутентификацию на основе сертификатов, а не постоянные учётные данные, такие как пароли, API-ключи или общие аккаунты с привилегированным доступом.", - "L": "2" - }, - { - "Shortcode": "V13.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что коммуникации между компонентами бэкенда приложения, включая локальные или системные службы, API, промежуточное ПО и уровни данных, выполняются с использованием аккаунтов, которым назначены минимально необходимые привилегии.", - "L": "2" - }, - { - "Shortcode": "V13.2.3", - "Ordinal": 3, - "Description": "Убедитесь, что если для аутентификации в сервисе используются учётные данные, то используемые потребителем учётные данные не являются стандартными (например, root/root или admin/admin).", - "L": "2" - }, - { - "Shortcode": "V13.2.4", - "Ordinal": 4, - "Description": "Убедитесь, что используется белый список (allowlist) для определения внешних ресурсов или систем, с которыми приложению разрешено взаимодействовать (например, для исходящих запросов, загрузки данных или доступа к файлам). Этот белый список может быть реализован на уровне приложения, веб-сервера, межсетевого экрана или комбинации различных уровней.", - "L": "2" - }, - { - "Shortcode": "V13.2.5", - "Ordinal": 5, - "Description": "Убедитесь, что веб- или прикладной сервер настроен с белым списком ресурсов или систем, к которым сервер может отправлять запросы или из которых может загружать данные и файлы.", - "L": "2" - }, - { - "Shortcode": "V13.2.6", - "Ordinal": 6, - "Description": "Убедитесь, что при подключении приложения к другим сервисам соблюдается задокументированная конфигурация для каждого соединения, включая максимальное количество параллельных соединений, поведение при достижении их максимума, таймауты и стратегии повторных попыток подключения.", - "L": "3" - } - ] - }, - { - "Shortcode": "V13.3", - "Ordinal": 3, - "Name": "Управление секретами", - "Items": [ - { - "Shortcode": "V13.3.1", - "Ordinal": 1, - "Description": "Убедитесь, что для безопасного создания, хранения, контроля доступа и уничтожения секретов бэкенда используется решение для управления секретами, например, хранилище ключей (key vault). Секретами могут быть пароли, ключевой материал, интеграции с базами данных и сторонними системами, ключи и seed-значения для токенов с ограниченным временем действия, другие внутренние секреты и API-ключи. Секреты не должны включаться в исходный код приложения или артефакты сборки. Для приложений уровня L3 необходимо использовать аппаратное решение, например, аппаратный модуль безопасности (HSM).", - "L": "2" - }, - { - "Shortcode": "V13.3.2", - "Ordinal": 2, - "Description": "Убедитесь, что доступ к секретным ресурсам осуществляется в соответствии с принципом минимально необходимых привилегий (least privilege).", - "L": "2" - }, - { - "Shortcode": "V13.3.3", - "Ordinal": 3, - "Description": "Убедитесь, что все криптографические операции выполняются с использованием изолированного модуля безопасности (например, хранилища ключей или аппаратного модуля безопасности), чтобы надежно управлять ключевым материалом и защищать его от утечки за пределы модуля безопасности.", - "L": "3" - }, - { - "Shortcode": "V13.3.4", - "Ordinal": 4, - "Description": "Убедитесь, что секреты настроены на срок действия и ротацию в соответствии с документацией приложения.", - "L": "3" - } - ] - }, - { - "Shortcode": "V13.4", - "Ordinal": 4, - "Name": "Непреднамеренная утечка информации", - "Items": [ - { - "Shortcode": "V13.4.1", - "Ordinal": 1, - "Description": "Убедитесь, что приложение развернуто либо без метаданных систем контроля версий (включая папки .git или .svn), либо так, чтобы эти папки были недоступны как извне, так и для самого приложения.", - "L": "1" - }, - { - "Shortcode": "V13.4.2", - "Ordinal": 2, - "Description": "Убедитесь, что режимы отладки отключены для всех компонентов в промышленной среде, чтобы предотвратить раскрытие функций отладки и утечку информации.", - "L": "2" - }, - { - "Shortcode": "V13.4.3", - "Ordinal": 3, - "Description": "Убедитесь, что веб-серверы не показывают клиентам списки содержимого каталогов, если это явно не предусмотрено.", - "L": "2" - }, - { - "Shortcode": "V13.4.4", - "Ordinal": 4, - "Description": "Убедитесь, что метод HTTP TRACE не поддерживается в продуктовой среде, чтобы избежать потенциальной утечки информации.", - "L": "2" - }, - { - "Shortcode": "V13.4.5", - "Ordinal": 5, - "Description": "Убедитесь, что документация (например, по внутренним API) и мониторинговые эндпоинты не доступны, если это явно не предусмотрено.", - "L": "2" - }, - { - "Shortcode": "V13.4.6", - "Ordinal": 6, - "Description": "Убедитесь, что приложение не раскрывает подробную информацию о версиях компонентов бэкенда.", - "L": "3" - }, - { - "Shortcode": "V13.4.7", - "Ordinal": 7, - "Description": "Убедитесь, что веб-слой настроен на обслуживание только файлов с определёнными расширениями, чтобы предотвратить непреднамеренную утечку информации, конфигураций и исходного кода.", - "L": "3" - } - ] - } - ] - }, - { - "Shortcode": "V14", - "Ordinal": 14, - "ShortName": "Data", - "Name": "Защита информации", - "Items": [ - { - "Shortcode": "V14.1", - "Ordinal": 1, - "Name": "Документация по защите информации", - "Items": [ - { - "Shortcode": "V14.1.1", - "Ordinal": 1, - "Description": "Убедитесь, что все конфиденциальные данные, создаваемые и обрабатываемые приложением, идентифицированы и классифицированы по уровням защиты. Включая закодированные данные, которые легко декодируются, например, строки Base64 или незашифрованные данные в полезной нагрузке JWT. Уровни защиты должны учитывать требования по защите данных и конфиденциальности, которым должно соответствовать приложение.", - "L": "2" - }, - { - "Shortcode": "V14.1.2", - "Ordinal": 2, - "Description": "Убедитесь, что для каждого уровня защиты конфиденциальных данных требования к защите задокументированы. Они должны включать (но не ограничиваться) требования по шифрованию, проверке целостности, срокам хранения, способам логирования данных, контролю доступа к чувствительным данным в логах, шифрованию на уровне базы данных, применению технологий повышения конфиденциальности, а также другим требованиям по конфиденциальности.", - "L": "2" - } - ] - }, - { - "Shortcode": "V14.2", - "Ordinal": 2, - "Name": "Базовые меры по защите информации", - "Items": [ - { - "Shortcode": "V14.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что конфиденциальные данные передаются на сервер только в теле HTTP-запроса или в заголовках. URL и строка запроса не должны содержать конфиденциальную информацию, такую как API-ключ или сессионный токен.", - "L": "1" - }, - { - "Shortcode": "V14.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что приложение предотвращает кэширование конфиденциальных данных в серверных компонентах, таких как балансировщики нагрузки и кэши приложений, либо гарантирует их надежное удаление после использования.", - "L": "2" - }, - { - "Shortcode": "V14.2.3", - "Ordinal": 3, - "Description": "Убедитесь, что заранее определённые конфиденциальные данные не отправляются ненадёжным сторонам (например, системам трекинга пользователей), чтобы предотвратить нежелательный сбор данных вне контроля приложения.", - "L": "2" - }, - { - "Shortcode": "V14.2.4", - "Ordinal": 4, - "Description": "Убедитесь, что для конфиденциальных данных реализованы меры по шифрованию, проверке целостности, срокам хранения, способам логирования, контролю доступа к данным в логах, а также применяются технологии повышения конфиденциальности в соответствии с документацией для соответствующего уровня защиты данных.", - "L": "2" - }, - { - "Shortcode": "V14.2.5", - "Ordinal": 5, - "Description": "Убедитесь, что механизмы кэширования настроены так, чтобы кэшировать только ответы с ожидаемым типом содержимого для данного ресурса и не содержать конфиденциального динамического контента. При обращении к несуществующему файлу, веб-сервер должен возвращать ответ 404 или 302, а не подменять на другой существующий файл, что позволит предотвратить атаки типа Web Cache Deception.", - "L": "3" - }, - { - "Shortcode": "V14.2.6", - "Ordinal": 6, - "Description": "Убедитесь, что приложение возвращает только минимально необходимый объем конфиденциальных данных для выполнения своей функциональности. Например, показывает только часть цифр номера кредитной карты, а не полный номер. Если требуется отображение полных данных, они должны быть замаскированы в пользовательском интерфейсе, пока пользователь специально не запросил их просмотр.", - "L": "3" - }, - { - "Shortcode": "V14.2.7", - "Ordinal": 7, - "Description": "Убедитесь, что конфиденциальная информация подлежит классификации по срокам хранения, чтобы устаревшие или ненужные данные удалялись автоматически, по расписанию или по мере необходимости.", - "L": "3" - }, - { - "Shortcode": "V14.2.8", - "Ordinal": 8, - "Description": "Убедитесь, что конфиденциальная информация удаляется из метаданных файлов, загружаемых пользователями, если пользователь явно не согласился на ее хранение.", - "L": "3" - } - ] - }, - { - "Shortcode": "V14.3", - "Ordinal": 3, - "Name": "Защита данных на стороне клиента", - "Items": [ - { - "Shortcode": "V14.3.1", - "Ordinal": 1, - "Description": "Убедитесь, что аутентифицированные данные очищаются из клиентского хранилища, например, из DOM браузера, после завершения работы клиента или сессии. Заголовок HTTP-ответа Clear-Site-Data может помочь в этом, но клиентская сторона также должна уметь очищать данные, если соединение с сервером недоступно при завершении сессии.", - "L": "1" - }, - { - "Shortcode": "V14.3.2", - "Ordinal": 2, - "Description": "Убедитесь, что приложение устанавливает HTTP-заголовки, достаточные для предотвращения кэширования (например, Cache-Control: no-store), чтобы конфиденциальные данные не сохранялись в браузерах.", - "L": "2" - }, - { - "Shortcode": "V14.3.3", - "Ordinal": 3, - "Description": "Убедитесь, что данные, хранящиеся в браузерном хранилище (например, localStorage, sessionStorage, IndexedDB или cookie), не содержат конфиденциальной информации, за исключением сессионных токенов.", - "L": "2" - } - ] - } - ] - }, - { - "Shortcode": "V15", - "Ordinal": 15, - "ShortName": "Secure", - "Name": "Безопасная разработка и архитектура", - "Items": [ - { - "Shortcode": "V15.1", - "Ordinal": 1, - "Name": "Документация по безопасной разработке и архитектуре", - "Items": [ - { - "Shortcode": "V15.1.1", - "Ordinal": 1, - "Description": "Убедитесь, что в документации по приложению определены сроки устранения уязвимостей на основе оценки рисков для внешних зависимостей с уязвимостями и для обновления библиотек в целом, чтобы минимизировать риск, связанный с этими компонентами.", - "L": "1" - }, - { - "Shortcode": "V15.1.2", - "Ordinal": 2, - "Description": "Убедитесь, что ведется реестр всех используемых сторонних библиотек (например, Software Bill of Materials, SBOM), с обязательной проверкой, что компоненты получены из предопределенных, доверенных и регулярно поддерживаемых репозиториев.", - "L": "2" - }, - { - "Shortcode": "V15.1.3", - "Ordinal": 3, - "Description": "Убедитесь, что в документации приложения указан функционал, требующий значительных временных или вычислительных ресурсов. Необходимо указать, как предотвратить потерю доступности из-за чрезмерного использования этого функционала и как избежать ситуаций, когда формирование ответа занимает больше времени, чем установленный системой таймаут. Возможные меры защиты могут включать асинхронную обработку, использование очередей и ограничение количества параллельных процессов для каждого пользователя и приложения.", - "L": "2" - }, - { - "Shortcode": "V15.1.4", - "Ordinal": 4, - "Description": "Убедитесь, что в документации приложения указаны внешние библиотеки, которые считаются «компонентами с повышенным риском».", - "L": "3" - }, - { - "Shortcode": "V15.1.5", - "Ordinal": 5, - "Description": "Убедитесь, что в документации приложения выделены те части приложения, в которых используются «функционал с повышенным риском».", - "L": "3" - } - ] - }, - { - "Shortcode": "V15.2", - "Ordinal": 2, - "Name": "Архитектура безопасности и зависимости", - "Items": [ - { - "Shortcode": "V15.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что приложение содержит только те компоненты, которые не нарушили задокументированные сроки обновления и исправления.", - "L": "1" - }, - { - "Shortcode": "V15.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что в приложении реализованы меры защиты от потери доступности из-за функциональности, требующей много времени или ресурсов, на основе задокументированных решений и стратегий безопасности для этого.", - "L": "2" - }, - { - "Shortcode": "V15.2.3", - "Ordinal": 3, - "Description": "Убедитесь, что производственная среда включает только те функции, которые необходимы для работы приложения, и не предоставляет лишние функции, такие как тестовый код, примеры кода и инструменты разработки.", - "L": "2" - }, - { - "Shortcode": "V15.2.4", - "Ordinal": 4, - "Description": "Убедитесь, что сторонние компоненты и все их транзитивные зависимости загружаются только из ожидаемых репозиториев (внутренних или внешних) и отсутствует риск атаки через подмену зависимостей (dependency confusion attack)", - "L": "3" - }, - { - "Shortcode": "V15.2.5", - "Ordinal": 5, - "Description": "Убедитесь, что приложение реализует дополнительные меры защиты для тех частей приложения, которые документированы как содержащие «функционал с повышенным риском» или использующие сторонние библиотеки, считающиеся «функционалом с повышенным риском». Это могут быть такие методы, как «песочница», инкапсуляция, контейнеризация или изоляция на сетевом уровне, чтобы задержать и предотвратить продвижение (pivoting) злоумышленников, скомпрометировавших одну часть приложения, к другим частям приложения.", - "L": "3" - } - ] - }, - { - "Shortcode": "V15.3", - "Ordinal": 3, - "Name": "Безопасное программирование", - "Items": [ - { - "Shortcode": "V15.3.1", - "Ordinal": 1, - "Description": "Убедитесь, что приложение возвращает только необходимое подмножество полей из объекта данных. Например, оно не должно возвращать весь объект данных, поскольку некоторые отдельные поля должны быть недоступны пользователям.", - "L": "1" - }, - { - "Shortcode": "V15.3.2", - "Ordinal": 2, - "Description": "Убедитесь, что при вызовах внешних URL-адресов бэкэнд приложения настроен так, чтобы не выполнять перенаправления, если только это не предусмотрено функционалом.", - "L": "2" - }, - { - "Shortcode": "V15.3.3", - "Ordinal": 3, - "Description": "Убедитесь, что в приложении реализованы защитные механизмы против атак типа массового присвоения (mass assignment) путем строгого ограничения разрешенных полей для каждого контроллера и действия, исключая возможность добавления или изменения значений полей, которые не должны быть доступны для данной конкретной операции.", - "L": "2" - }, - { - "Shortcode": "V15.3.4", - "Ordinal": 4, - "Description": "Убедитесь, что все прокси и промежуточное ПО корректно передают исходный IP-адрес пользователя, используя доверенные поля данных, которые не могут быть изменены конечным пользователем, а приложение и веб-сервер используют это правильное значение для ведения логирования и принятия решений по безопасности, таких как ограничение запросов. При этом следует учитывать, что даже исходный IP-адрес может быть ненадежным из-за динамических IP-адресов, VPN или корпоративных файрволов.", - "L": "2" - }, - { - "Shortcode": "V15.3.5", - "Ordinal": 5, - "Description": "Убедитесь, что приложение явно проверяет соответствие переменных ожидаемому типу данных и использует строгие операции сравнения. Это необходимо для предотвращения уязвимостей, связанных с type juggling и type confusion, вызванных тем, что код приложения делает предположения о типе переменной.", - "L": "2" - }, - { - "Shortcode": "V15.3.6", - "Ordinal": 6, - "Description": "Убедитесь, что JavaScript-код написан таким образом, чтобы предотвратить prototype pollution, например, используя Set() или Map() вместо обычных литералов объекта.", - "L": "2" - }, - { - "Shortcode": "V15.3.7", - "Ordinal": 7, - "Description": "Убедитесь, что приложение защищено от атак типа HTTP Parameter Pollution (HPP), особенно если используемый фреймворк не различает источники параметров запроса (строка запроса, тело запроса, куки или заголовки).", - "L": "2" - } - ] - }, - { - "Shortcode": "V15.4", - "Ordinal": 4, - "Name": "Безопасная работа с параллельными процессами", - "Items": [ - { - "Shortcode": "V15.4.1", - "Ordinal": 1, - "Description": "Убедитесь, что к общим объектам в многопоточном коде (например, кэшам, файлам или объектам в памяти, используемым несколькими потоками) используется безопасный многопоточный доступ и механизмов синхронизации, таких как блокировки или семафоры, чтобы избежать состояний гонки и повреждения данных.", - "L": "3" - }, - { - "Shortcode": "V15.4.2", - "Ordinal": 2, - "Description": "Убедитесь, что проверки состояния ресурса, например его существования или разрешений, а также зависящие от него действия выполняются как одна атомарная операция, чтобы предотвратить условия гонки времени проверки и времени использования (TOCTOU). Например, проверка существования файла перед его открытием или проверка прав доступа пользователя перед его предоставлением.", - "L": "3" - }, - { - "Shortcode": "V15.4.3", - "Ordinal": 3, - "Description": "Убедитесь, что блокировки применяются согласованно, чтобы предотвратить взаимные блокировки потоков (deadlocks) или их бесконечные повторы, а также что логика блокировки инкапсулирована в коде, отвечающем за управление ресурсом. Это гарантирует, что блокировки не могут быть случайно или намеренно изменены внешними классами или кодом.", - "L": "3" - }, - { - "Shortcode": "V15.4.4", - "Ordinal": 4, - "Description": "Убедитесь, что политики распределения ресурсов предотвращают нехватку ресурсов у потоков, обеспечивая справедливый доступ к ресурсам, например, используя пулы потоков, позволяя потокам с более низким приоритетом выполняться в течение разумного периода времени.", - "L": "3" - } - ] - } - ] - }, - { - "Shortcode": "V16", - "Ordinal": 16, - "ShortName": "Security", - "Name": "Журналирование событий безопасности и обработка ошибок", - "Items": [ - { - "Shortcode": "V16.1", - "Ordinal": 1, - "Name": "Документация по ведению логов", - "Items": [ - { - "Shortcode": "V16.1.1", - "Ordinal": 1, - "Description": "Убедитесь в существовании реестра, в котором документируется ведение журнала на каждом уровне технологического стека приложения, включая какие события регистрируются, форматы логов, где хранятся эти журналы, как они используются, как контролируется доступ к ним и как долго хранятся журналы.", - "L": "2" - } - ] - }, - { - "Shortcode": "V16.2", - "Ordinal": 2, - "Name": "Общее журналирование", - "Items": [ - { - "Shortcode": "V16.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что каждая запись журнала содержит необходимые метаданные (например, когда, где, кто, что), которые позволят провести подробное исследование временной шкалы, когда произошло событие.", - "L": "2" - }, - { - "Shortcode": "V16.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что все источники времени компонентов системы журналирования синхронизированы, а временные метки в метаданных событий безопасности используют UTC или содержат явное указание смещения часового пояса. Рекомендуется применять UTC для обеспечения согласованности в распределённых системах и предотвращения ошибок при переходе на летнее/зимнее время.", - "L": "2" - }, - { - "Shortcode": "V16.2.3", - "Ordinal": 3, - "Description": "Убедитесь, что приложение записывает и передаёт логи исключительно в те файлы и сервисы, которые указаны в реестре журналирования.", - "L": "2" - }, - { - "Shortcode": "V16.2.4", - "Ordinal": 4, - "Description": "Убедитесь, что логи могут быть прочитаны и коррелированы используемой системой обработки журналов, предпочтительно с использованием общего стандартного формата логирования.", - "L": "2" - }, - { - "Shortcode": "V16.2.5", - "Ordinal": 5, - "Description": "Убедитесь, что приложение применяет соответствующие меры защиты при логировании конфиденциальных данных в зависимости от уровня их чувствительности: например, полностью запрещает запись в логи таких данных, как учетные данные или платежные реквизиты, а для других данных (например, сессионных токенов) использует хеширование или частичное/полное маскирование.", - "L": "2" - } - ] - }, - { - "Shortcode": "V16.3", - "Ordinal": 3, - "Name": "Инциденты безопасности", - "Items": [ - { - "Shortcode": "V16.3.1", - "Ordinal": 1, - "Description": "Убедитесь, что все операции аутентификации регистрируются, включая успешные и неудачные попытки. Также следует фиксировать дополнительные метаданные, такие как тип аутентификации или использованные факторы проверки.", - "L": "2" - }, - { - "Shortcode": "V16.3.2", - "Ordinal": 2, - "Description": "Убедитесь, что ведется журнал неудачных попыток авторизации. Для уровня L3 это должно включать в себя журналирование всех решений об авторизации, включая журналирование доступа к конфиденциальным данным (без регистрации самих конфиденциальных данных).", - "L": "2" - }, - { - "Shortcode": "V16.3.3", - "Ordinal": 3, - "Description": "Убедитесь, что приложение регистрирует все события безопасности, определенные в документации, а также фиксирует попытки обхода механизмов защиты, включая проверку входных данных, бизнес-логики и системы защиты от автоматизированных атак.", - "L": "2" - }, - { - "Shortcode": "V16.3.4", - "Ordinal": 4, - "Description": "Убедитесь, что приложение регистрирует в журналах неожиданные ошибки и сбои механизмов безопасности, включая, например, ошибки TLS-соединения на стороне сервера.", - "L": "2" - } - ] - }, - { - "Shortcode": "V16.4", - "Ordinal": 4, - "Name": "Защита журналов", - "Items": [ - { - "Shortcode": "V16.4.1", - "Ordinal": 1, - "Description": "Убедитесь, что все компоненты системы логирования корректно кодируют данные, чтобы предотвратить атаки типа внедрения в журналы (log injection).", - "L": "2" - }, - { - "Shortcode": "V16.4.2", - "Ordinal": 2, - "Description": "Убедитесь, что логи защищены от неавторизованного доступа и не могут быть модифицированы.", - "L": "2" - }, - { - "Shortcode": "V16.4.3", - "Ordinal": 3, - "Description": "Убедитесь, что логи безопасно передаются в логически изолированную систему для анализа, обнаружения угроз, генерации оповещений и эскалации инцидентов. Это гарантирует сохранность журналов даже в случае компрометации основного приложения.", - "L": "2" - } - ] - }, - { - "Shortcode": "V16.5", - "Ordinal": 5, - "Name": "Обработка ошибок", - "Items": [ - { - "Shortcode": "V16.5.1", - "Ordinal": 1, - "Description": "Убедитесь, что при возникновении непредвиденной или связанной с безопасностью ошибки пользователю возвращается только общее сообщение, гарантируя отсутствие раскрытия конфиденциальных внутренних данных системы, таких как трассировки стека, запросы, секретные ключи и токены.", - "L": "2" - }, - { - "Shortcode": "V16.5.2", - "Ordinal": 2, - "Description": "Убедитесь, что приложение продолжает работать в безопасном режиме при недоступности внешних ресурсов, используя такие механизмы, как автоматические выключатели (circuit breakers) или плавное снижение функциональности (graceful degradation).", - "L": "2" - }, - { - "Shortcode": "V16.5.3", - "Ordinal": 3, - "Description": "Убедитесь, что приложение корректно и безопасно завершает работу при возникновении исключений, предотвращая опасные сценарии по типу «fail-open», когда, например, транзакция ошибочно выполняется, несмотря на ошибки в логике валидации.", - "L": "2" - }, - { - "Shortcode": "V16.5.4", - "Ordinal": 4, - "Description": "Убедитесь, что определён обработчик ошибок «крайние меры», который будет перехватывать все необработанные ошибки. Это необходимо как для предотвращения потери информации об ошибках, которая должна быть записана в файлы журналов, так и для того, чтобы ошибка не остановила весь процесс приложения, что привело бы к потере доступности.", - "L": "3" - } - ] - } - ] - }, - { - "Shortcode": "V17", - "Ordinal": 17, - "ShortName": "WebRTC", - "Name": "WebRTC", - "Items": [ - { - "Shortcode": "V17.1", - "Ordinal": 1, - "Name": "TURN-сервер", - "Items": [ - { - "Shortcode": "V17.1.1", - "Ordinal": 1, - "Description": "Убедитесь, что сервис TURN (Traversal Using Relays around NAT) разрешает доступ только к IP-адресам, не зарезервированным для специальных целей (например, внутренние сети, широковещательная рассылка, loopback-адреса). Данное требование применяется как к IPv4, так и к IPv6 адресам.", - "L": "2" - }, - { - "Shortcode": "V17.1.2", - "Ordinal": 2, - "Description": "Убедитесь, что сервис TURN (Traversal Using Relays around NAT) защищен от исчерпания ресурсов при попытках легитимных пользователей открыть чрезмерное количество портов на сервере.", - "L": "3" - } - ] - }, - { - "Shortcode": "V17.2", - "Ordinal": 2, - "Name": "Требования к медиасерверам", - "Items": [ - { - "Shortcode": "V17.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что ключ сертификата Datagram Transport Layer Security (DTLS) управляется и защищается в соответствии с документированной политикой управления криптографическими ключами.", - "L": "2" - }, - { - "Shortcode": "V17.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что медиасервер настроен на использование только одобренных наборов шифров Datagram Transport Layer Security (DTLS) и защищенного профиля безопасности для расширения DTLS, применяемого при установке ключей для Secure Real-time Transport Protocol (DTLS-SRTP).", - "L": "2" - }, - { - "Shortcode": "V17.2.3", - "Ordinal": 3, - "Description": "Убедитесь, что медиасервер проверяет аутентификацию Secure Real-time Transport Protocol (SRTP) для предотвращения атак с внедрением Real-time Transport Protocol (RTP), которые могут привести к отказу в обслуживании (Denial of Service) или вставке поддельного аудио-/видеоконтента в медиапотоки.", - "L": "2" - }, - { - "Shortcode": "V17.2.4", - "Ordinal": 4, - "Description": "Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика при получении некорректных пакетов Secure Real-time Transport Protocol (SRTP).", - "L": "2" - }, - { - "Shortcode": "V17.2.5", - "Ordinal": 5, - "Description": "Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетами Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.", - "L": "3" - }, - { - "Shortcode": "V17.2.6", - "Ordinal": 6, - "Description": "Убедитесь, что медиасервер не подвержен уязвимости «Гонка ClientHello» (ClientHello Race Condition) в Datagram Transport Layer Security (DTLS), проверив наличие известных уязвимостей в публичных источниках или выполнив тестирование на воспроизведение условий гонки.", - "L": "3" - }, - { - "Shortcode": "V17.2.7", - "Ordinal": 7, - "Description": "Убедитесь, что механизмы аудио- и видеозаписи, связанные с медиасервером, способны продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетов Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.", - "L": "3" - }, - { - "Shortcode": "V17.2.8", - "Ordinal": 8, - "Description": "Убедитесь, что сертификат Datagram Transport Layer Security (DTLS) проверяется на соответствие атрибуту отпечатка (fingerprint) в Session Description Protocol (SDP), с немедленным прекращением медиапотока в случае несоответствия — это гарантирует подлинность передаваемых данных.", - "L": "3" - } - ] - }, - { - "Shortcode": "V17.3", - "Ordinal": 3, - "Name": "Сигнализация", - "Items": [ - { - "Shortcode": "V17.3.1", - "Ordinal": 1, - "Description": "Убедитесь, что сигнальный сервер способен продолжать обработку легитимных входящих сообщений сигнализации даже в условиях флуд-атаки. Для этого необходимо реализовать механизм ограничения частоты запросов (rate limiting) на уровне сигнализации.", - "L": "2" - }, - { - "Shortcode": "V17.3.2", - "Ordinal": 2, - "Description": "Убедитесь, что сигнальный сервер способен продолжать обработку легитимных сообщений сигнализации даже при получении некорректных сообщений, которые могут вызвать отказ в обслуживании (Denial of Service, DoS). Для этого необходимо реализовать: проверку входных данных (input validation), безопасную обработку целочисленных переполнений (integer overflows), защиту от переполнения буферов (buffer overflows) и другие надежные методы обработки ошибок.", - "L": "2" - } - ] - } - ] - } - ] -} diff --git a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.csv b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.csv deleted file mode 100644 index ee9c1f89e8..0000000000 --- a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.csv +++ /dev/null @@ -1,347 +0,0 @@ -chapter_id,chapter_name,section_id,section_name,req_id,req_description,level1,level2,level3,cwe,nist -V1,Кодировка и нейтрализация,V1.1,Архитектура кодировки и нейтрализации,V1.1.1,"Убедитесь, что входные данные декодируются или деэкранируются в каноническую форму (в стандартное представление) только один раз. Декодирование происходит только тогда, когда ожидаются закодированные данные в этой форме, и что это делается перед дальнейшей обработкой входных данных, например, это не выполняется после проверки или нейтрализации.",,✓,✓,, -V1,Кодировка и нейтрализация,V1.1,Архитектура кодировки и нейтрализации,V1.1.2,"Убедитесь, что приложение выполняет кодирование и экранирование выходных данных либо в качестве последнего шага перед использованием интерпретатором, для которого оно предназначено, либо самим интерпретатором.",,✓,✓,, -V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.1,"Убедитесь, что выходная кодировка для ответа HTTP, документа HTML или документа XML соответствует требуемому контексту, например, кодировка соответствующих символов для элементов HTML, атрибутов HTML, комментариев HTML, CSS или полей заголовка HTTP делается таким способом, чтобы избежать изменения структуры сообщения или документа.",✓,✓,✓,, -V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.2,"Убедитесь, что при динамическом построении URL-адресов недоверенные данные кодируются в соответствии с их контекстом (например, кодирование URL-адресов или кодирование base64url для query или path параметров или пути). Убедитесь, что разрешены только безопасные протоколы URL-адресов (например, запрещен javascript: или data:).",✓,✓,✓,, -V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.3,"Убедитесь, что при динамическом построении содержимого JavaScript (включая JSON) используется кодирование или экранирование выходных данных, чтобы избежать изменения структуры сообщения или документа (чтобы избежать JavaScript и JSON-инъекций).",✓,✓,✓,, -V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.4,"Убедитесь, что выборка данных (Redis, Memcached, чтение из файлов, обращение по API) или запросы к базе данных (например, SQL, HQL, NoSQL, Cypher) используют параметризованные запросы, ORM, Entity Frameworks или иным образом защищены от SQL-инъекций и других атак. Это также актуально при написании хранимых процедур.",✓,✓,✓,, -V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.5,"Убедитесь, что приложение защищено от внедрения команд ОС и что вызовы операционной системы используют параметризованные запросы к ОС или используют контекстное кодирование вывода командной строки.",✓,✓,✓,, -V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.6,"Убедитесь, что приложение защищено от LDAP-инъекций, или что реализованы специальные меры безопасности для их предотвращения.",,✓,✓,, -V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.7,"Убедитесь, что приложение защищено от атак с использованием XPath-инъекций с помощью параметризации запросов или предварительно скомпилированных запросов.",,✓,✓,, -V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.8,"Убедитесь, что процессоры LaTeX настроены безопасно (например, не используется флаг «–shell‑escape») и используется разрешенный список команд для предотвращения LaTeX-инъекций.",,✓,✓,, -V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.9,"Убедитесь, что приложение экранирует специальные символы в регулярных выражениях (обычно с помощью обратной косой черты), чтобы предотвратить их ошибочную интерпретацию как метасимволов.",,✓,✓,, -V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.10,"Убедитесь, что приложение защищено от внедрения формул CSV (CSV Injection). Приложение должно следовать правилам экранирования, определенным в RFC 4180, разделы 2.6 и 2.7, при экспорте содержимого CSV. Кроме того, при экспорте в CSV или другие форматы электронных таблиц (такие как XLS, XLSX или ODF) специальные символы (включая '=', '+', '-', '@', '\t' (табуляция), и '\0' (нулевой символ)) должны экранироваться одинарной кавычкой, если они появляются в качестве первого символа в значении поля.",,,✓,, -V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.1,"Убедитесь, что все ненадежные входные данные HTML из редакторов WYSIWYG или аналогичных программ нейтрализуются с помощью известных и безопасных библиотек или функций фреймворка для санитизации HTML.",✓,✓,✓,, -V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.2,"Убедитесь, что приложение избегает использования eval() или других динамических функций выполнения кода, таких как Spring Expression Language (SpEL). Если нет альтернативы, любой пользовательский ввод должен быть нейтрализован перед выполнением.",✓,✓,✓,, -V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.3,"Убедитесь, что данные, передаваемые в потенциально опасный контекст, предварительно нейтрализованы, чтобы обеспечить соблюдение мер безопасности, таких как разрешение только тех символов, которые безопасны для данного контекста, и обрезка слишком длинного ввода.",,✓,✓,, -V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.4,"Убедитесь, что предоставленный пользователем файл .SVG проверен или нейтрализован, чтобы он содержал только теги и атрибуты (например, относящиеся к рисованию), которые безопасны для приложения, например, не содержат скриптов и foreignObject.",,✓,✓,, -V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.5,"Убедитесь, что приложение нейтралует или отключает предоставленные пользователем скриптовые данные или выражения шаблонных языков, такие как таблицы стилей Markdown, CSS или XSL, BBCode или аналогичные.",,✓,✓,, -V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.6,"Убедитесь, что приложение защищено от атак с подделкой запросов на стороне сервера (SSRF), проверяя ненадежные данные по разрешенному списку протоколов, доменов, путей и портов, а также нейтрализуя потенциально опасные символы перед использованием данных для вызова другой службы.",,✓,✓,, -V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.7,"Убедитесь, что приложение защищено от атак с внедрением шаблонов (template injection), не позволяя создавать шаблоны на основе недоверенных входных данных. Если нет альтернативы, любые недоверенные входные данные, включаемые динамически во время создания шаблона, должны быть нейтрализованы или тщательно провалидированы.",,✓,✓,, -V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.8,"Убедитесь, что приложение надлежащим образом нейтрализует недоверенные входные данные перед использованием в запросах Java Naming and Directory Interface (JNDI) и что JNDI настроен безопасно для предотвращения атак с использованием JNDI-инъекций.",,✓,✓,, -V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.9,"Убедитесь, что приложение нейтрализует данные перед отправкой в Memcache, чтобы предотвратить атаки методом инъекций.",,✓,✓,, -V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.10,"Убедитесь, что строки форматирования, которые могут быть использованы неожидаемым или вредоносным образом, нейтрализуются перед дальнейшим использованием.",,✓,✓,, -V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.11,"Убедитесь, что приложение нейтрализует вводимые пользователем данные перед передачей в почтовые системы для защиты от SMTP или IMAP-инъекций.",,✓,✓,, -V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.12,"Убедитесь, что регулярные выражения не содержат элементов, вызывающих экспоненциальный возврат, и убедитесь в нейтрализации недоверенных входных данных для предотвращения атак ReDoS или Runaway Regex.",,,✓,, -V1,Кодировка и нейтрализация,V1.4,"Память, строки и неуправляемый код",V1.4.1,"Убедитесь, что для обнаружения или предотвращения ситуаций переполнения стека, буфера или кучи приложение учитывает размер доступной области памяти при строковых операциях, копировании в память, в арифметике указателей и т.п.",,✓,✓,, -V1,Кодировка и нейтрализация,V1.4,"Память, строки и неуправляемый код",V1.4.2,"Убедитесь, что для предотвращения целочисленного переполнения применяется контроль знака, диапазона и типа допустимых входных данных.",,✓,✓,, -V1,Кодировка и нейтрализация,V1.4,"Память, строки и неуправляемый код",V1.4.3,"Убедитесь, что динамически выделенная память и ресурсы освобождены, а ссылки или указатели на освобожденную память удалены или установлены в значение null, чтобы предотвратить появление висячих указателей и уязвимостей, связанных с использованием памяти после освобождения.",,✓,✓,, -V1,Кодировка и нейтрализация,V1.5,Безопасная десериализация,V1.5.1,"Убедитесь, что приложение настраивает XML-парсеры на использование строгой конфигурации и что небезопасные функции, такие как разрешение внешних сущностей, отключены для предотвращения атак XML eXternal Entity (XXE).",✓,✓,✓,, -V1,Кодировка и нейтрализация,V1.5,Безопасная десериализация,V1.5.2,"Убедитесь, что десериализация недоверенных данных обеспечивает безопасную обработку ввода, например, используя список разрешенных типов объектов или ограничивая типы объектов, определяемые клиентом, для предотвращения атак десериализации. Механизмы десериализации, которые явно определены как небезопасные, не должны использоваться с недоверенным вводом.",,✓,✓,, -V1,Кодировка и нейтрализация,V1.5,Безопасная десериализация,V1.5.3,"Убедитесь, что различные парсеры, используемые в приложении для одного и того же типа данных (например, парсеры JSON, XML, URL), выполняют парсинг согласованным образом и используют один и тот же механизм кодирования символов, чтобы избежать таких проблем, как уязвимости взаимодействия JSON (JSON Interoperability) или различное поведение анализа URI или файлов, которые могут использоваться в атаках удаленного включения файлов (RFI) или подделки запросов на стороне сервера (SSRF).",,,✓,, -V2,Валидация и бизнес-логика,V2.1,Документация валидации и бизнес-логики,V2.1.1,"Убедитесь, что в документации приложения определены правила проверки входных данных на соответствие ожидаемой структуре. Это могут быть распространённые форматы данных, такие как номера кредитных карт, адреса электронной почты, номера телефонов, или внутренний формат данных.",✓,✓,✓,, -V2,Валидация и бизнес-логика,V2.1,Документация валидации и бизнес-логики,V2.1.2,"Убедитесь, что в документации приложения указано, как проверять логическую и контекстную согласованность объединенных данных, например, проверять соответствие района и почтового индекса.",,✓,✓,, -V2,Валидация и бизнес-логика,V2.1,Документация валидации и бизнес-логики,V2.1.3,"Убедитесь, что ожидания относительно ограничений и проверок бизнес-логики задокументированы как для уровня отдельного пользователя, так и для глобального уровня всего приложения.",,✓,✓,, -V2,Валидация и бизнес-логика,V2.2,Валидация ввода,V2.2.1,"Убедитесь, что входные данные провалидированы для обеспечения соответствия бизнес- или функциональным ожиданиям. Валидация должна осуществляться либо по списку допустимых значений, шаблонов и диапазонов, либо путем сравнения входных данных с ожидаемой структурой и логическими ограничениями в соответствии с предопределенными правилами. Для L1 валидация может быть сосредоточена на входных данных, используемых для принятия конкретных бизнес-решений или решений, связанных с безопасностью. Для L2 и выше это должно применяться ко всем входным данным.",✓,✓,✓,, -V2,Валидация и бизнес-логика,V2.2,Валидация ввода,V2.2.2,"Убедитесь, что приложение разработано с принудительной валидацией входных данных на уровне доверенного сервиса. Хотя проверка на стороне клиента повышает удобство использования и должна поощряться, на неё не следует полагаться как на средство контроля безопасности.",✓,✓,✓,, -V2,Валидация и бизнес-логика,V2.2,Валидация ввода,V2.2.3,"Убедитесь, что приложение обеспечивает обоснованность комбинаций данных в соответствии с предопределенными правилам. Например: возраст должен соответствовать дате рождения; страна и почтовый индекс; количество товара в заказе и на складе.",,✓,✓,, -V2,Валидация и бизнес-логика,V2.3,Безопасность бизнес-логики,V2.3.1,"Убедитесь, что приложение обрабатывает потоки бизнес-логики для одного и того же пользователя в ожидаемом последовательном порядке шагов и без пропуска шагов.",✓,✓,✓,, -V2,Валидация и бизнес-логика,V2.3,Безопасность бизнес-логики,V2.3.2,"Убедитесь, что ограничения бизнес-логики реализованы в соответствии с документацией приложения, чтобы избежать эксплуатации её недостатков.",,✓,✓,, -V2,Валидация и бизнес-логика,V2.3,Безопасность бизнес-логики,V2.3.3,"Убедитесь, что транзакции используются на уровне бизнес-логики таким образом, что операция бизнес-логики либо выполняется полностью, либо откатывается к предыдущему корректному состоянию.",,✓,✓,, -V2,Валидация и бизнес-логика,V2.3,Безопасность бизнес-логики,V2.3.4,"Убедитесь, что на уровне бизнес-логики используются механизмы блокировки, чтобы гарантировать невозможность двойного бронирования ограниченных по количеству ресурсов (например, мест в театре или слотов доставки) путем манипулирования логикой приложения.",,✓,✓,, -V2,Валидация и бизнес-логика,V2.3,Безопасность бизнес-логики,V2.3.5,"Убедитесь, что для важных потоков бизнес-логики требуется многопользовательское (multi-user) одобрение, чтобы предотвратить несанкционированные или случайные действия. Потоки бизнес-логики могут включать, помимо прочего, крупные денежные переводы, утверждение контрактов, доступ к секретной информации или обход ограничений безопасности на производстве.",,,✓,, -V2,Валидация и бизнес-логика,V2.4,Анти-автоматизация,V2.4.1,"Убедитесь, что используются средства противодействия автоматизации для защиты от чрезмерных вызовов функций приложения, которые могут привести к утечке данных, созданию ненужных данных, исчерпанию квот, нарушению ограничений скорости, отказу в обслуживании или чрезмерному использованию дорогостоящих ресурсов.",,✓,✓,, -V2,Валидация и бизнес-логика,V2.4,Анти-автоматизация,V2.4.2,"Убедитесь, что потоки бизнес-логики требуют реалистичного человеческого времени, предотвращая чрезмерно быструю отправку транзакций.",,,✓,, -V3,Безопасность веб-интерфейса,V3.1,Документация по безопасности веб-интерфейса,V3.1.1,"Убедитесь, что в документации приложения описаны ожидаемые функции безопасности, которые должны поддерживать браузеры, использующие приложение (такие как HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) и другие соответствующие механизмы безопасности HTTP). В документации также должно быть обязательно определено, как приложение должно себя вести, если некоторые из этих функций недоступны (например, предупреждать пользователя или блокировать доступ).",,,✓,, -V3,Безопасность веб-интерфейса,V3.2,Непреднамеренная интерпретация контента,V3.2.1,"Убедитесь, что реализованы меры безопасности, предотвращающие отображение контента или функций браузерами в HTTP-ответах в некорректном контексте (например, запрос API, загруженный пользователем файл или другой ресурс запрашивается напрямую). Возможные способы контроля включают: не обрабатывать содержимое, если поля заголовка HTTP-запроса (например, Sec-Fetch-*) не указывают на корректность контекста; использование заголовка и значения Content-Security-Policy: sandbox directive; или использование заголовка и значения Content-Disposition: attachment.",✓,✓,✓,, -V3,Безопасность веб-интерфейса,V3.2,Непреднамеренная интерпретация контента,V3.2.2,"Убедитесь, что данные, предназначенные для отображения в виде текста, а не визуализации в виде HTML, обрабатывается с использованием безопасных функций визуализации (таких как createTextNode или textContent), чтобы предотвратить непреднамеренное выполнение содержимого, такого как HTML или JavaScript.",✓,✓,✓,, -V3,Безопасность веб-интерфейса,V3.2,Непреднамеренная интерпретация контента,V3.2.3,"Убедитесь, что приложение избегает затирания DOM при использовании JavaScript на стороне клиента, применяя явные объявления переменных, выполняя строгую проверку типов, избегая сохранения глобальных переменных в объекте документа и реализуя изоляцию пространства имен.",,,✓,, -V3,Безопасность веб-интерфейса,V3.3,Настройка файлов cookie,V3.3.1,"Убедитесь, что у файлов cookie установлен атрибут «Secure», и если префикс «__Host‑» не используется в названии cookie, необходимо использовать префикс «__Secure‑».",✓,✓,✓,, -V3,Безопасность веб-интерфейса,V3.3,Настройка файлов cookie,V3.3.2,"Убедитесь, что значение атрибута SameSite каждой cookie установлено в соответствии с назначением cookie, чтобы ограничить подверженность атакам на восстановление пользовательского интерфейса и атакам с подделкой запросов на уровне браузера, обычно называемым подделкой межсайтовых запросов (CSRF).",,✓,✓,, -V3,Безопасность веб-интерфейса,V3.3,Настройка файлов cookie,V3.3.3,"Убедитесь, что cookie имеют префикс «__Host‑» в названии, если только они явно не предназначены для совместного использования с другими хостами.",,✓,✓,, -V3,Безопасность веб-интерфейса,V3.3,Настройка файлов cookie,V3.3.4,"Убедитесь, что если значение cookie не должно быть доступно для клиентских скриптов (например, сессионный токен), для cookie должен быть установлен атрибут «HttpOnly», а само значение должно передаваться клиенту только через поле заголовка «Set-Cookie».",,✓,✓,, -V3,Безопасность веб-интерфейса,V3.3,Настройка файлов cookie,V3.3.5,"Убедитесь, что при записи cookie приложением общая длина имени и значения cookie не превышает 4096 байт. Слишком большие cookie не будут сохраняться браузером и, следовательно, не будут отправляться с запросами, что помешает пользователю использовать функции приложения, зависящие от этого cookie.",,,✓,, -V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.1,"Убедитесь, что поле заголовка Strict‑Transport‑Security включено во все ответы для реализации политики HTTP Strict Transport Security (HSTS). Необходимо указать максимальное время не менее 1 года, а для L2 и выше политика должна применяться также ко всем поддоменам.",✓,✓,✓,, -V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.2,"Убедитесь, что поле заголовка Cross‑Origin Resource Sharing (CORS) «Access‑Control‑Allow‑Origin» имеет фиксированное значение, заданное приложением, или, если используется заголовок Origin, оно проверяется по списку доверенных источников. При необходимости использования «Access‑Control‑Allow‑Origin: *» убедитесь, что ответ не содержит конфиденциальной информации.",✓,✓,✓,, -V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.3,"Убедитесь, что HTTP-ответы содержат поле заголовка Content-Security-Policy, которое определяет директивы, гарантирующие загрузку и выполнение браузером только доверенного контента или ресурсов, чтобы ограничить выполнение вредоносного JavaScript. Как минимум, необходимо использовать глобальную политику, включающую директивы object-src «none» и base-uri «none», а также определяющую список разрешенных адресов или использующую одноразовые коды или хэши. Для приложений L3 необходимо определить политику использования 'nonce' или hash-конструкций для каждого ответа.",,✓,✓,, -V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.4,"Убедитесь, что все HTTP-ответы содержат поле заголовка «X‑Content‑Type‑Options: nosniff». Это предписывает браузерам не использовать анализ контента и определение типа MIME для данного ответа, а также требовать, чтобы значение поля заголовка Content‑Type в ответе соответствовало целевому ресурсу. Например, ответ на запрос стиля принимается только в том случае, если Content‑Type в ответе — «text/css». Это также позволяет браузеру использовать функцию Cross‑Origin Read Blocking (CORB).",,✓,✓,, -V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.5,"Убедитесь, что приложение устанавливает политику реферера для предотвращения утечки технически конфиденциальных данных сторонним сервисам через поле заголовка HTTP-запроса «Referer». Это можно сделать с помощью поля заголовка HTTP-ответа «Referrer‑Policy» или через атрибуты HTML-элемента. Конфиденциальные данные могут включать путь и данные запроса в URL-адресе, а для внутренних непубличных приложений также имя хоста.",,✓,✓,, -V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.6,"Убедитесь, что веб-приложение использует директиву frame‑ancestors поля заголовка Content‑Security‑Policy для каждого HTTP-ответа, чтобы гарантировать невозможность его внедрения по умолчанию и внедрение определённых ресурсов разрешено только при необходимости. Обратите внимание, что поле заголовка X‑Frame‑Options, хотя и поддерживается браузерами, устарело и не может быть использовано в качестве основы.",,✓,✓,, -V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.7,"Убедитесь, что в поле заголовка Content‑Security‑Policy указано место, куда следует сообщать о нарушениях.",,,✓,, -V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.8,"Убедитесь, что все HTTP-ответы, инициирующие рендеринг документа (например, ответы с типом содержимого text/html), включают поле заголовка Cross-Origin-Opener-Policy с директивой same-origin или same-origin-allow-popups (при необходимости). Это предотвращает атаки, злоупотребляющие общим доступом к объектам Window, такие как Tabnabbing и Frame Counting.",,,✓,, -V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.1,"Убедитесь, что, если приложение не использует механизм предварительной проверки CORS для предотвращения запрещённых кросс-доменных запросов на использование чувствительного функционала, эти запросы валидируются на предмет их происхождения от самого приложения. Это можно сделать, используя и проверяя специальные токены для защиты от подделки или требуя дополнительные поля HTTP-заголовка, не входящие в список «простых заголовков» (CORS-safelisted request-header). Это необходимо для защиты от атак с подделкой запросов через браузер, широко известных как межсайтовая подделка запросов (CSRF).",✓,✓,✓,, -V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.2,"Убедитесь, что если приложение использует механизм предварительной проверки CORS для предотвращения неразрешённого использования чувствительного функционала между источниками, вызов этого функционала невозможен с помощью запроса, который не запускает предварительную проверку CORS. Для этого может потребоваться проверка значений полей заголовка запроса «Origin» и «Content-Type» или использование дополнительного поля заголовка, не входящего в безопасный список CORS.",✓,✓,✓,, -V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.3,"Убедитесь, что HTTP-запросы к чувствительному функционалу используют соответствующие HTTP-методы, такие как POST, PUT, PATCH или DELETE, а не методы, определённые спецификацией HTTP как «безопасные», такие как HEAD, OPTIONS или GET. В качестве альтернативы можно использовать строгую валидацию полей заголовка запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, навигационного запроса или загрузки ресурса (например, источника изображения), где это не ожидается.",✓,✓,✓,, -V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.4,"Убедитесь, что отдельные приложения размещены на разных именах хостов, чтобы использовать ограничения, предусмотренные политикой same-origin, включая то, как документы или скрипты, загруженные одним источником, могут взаимодействовать с ресурсами из другого источника, а также ограничения на cookie на основе имени хоста.",,✓,✓,, -V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.5,"Убедитесь, что сообщения, полученные интерфейсом postMessage, отвергаются, если источник сообщения не является доверенным или если синтаксис сообщения недействителен.",,✓,✓,, -V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.6,"Убедитесь, что функциональность JSONP не включена нигде в приложении, чтобы избежать атак с использованием межсайтового включения скриптов (XSSI).",,,✓,, -V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.7,"Убедитесь, что данные, требующие авторизации, не включены в ответы ресурсов скриптов, таких как файлы JavaScript, чтобы предотвратить атаки с использованием межсайтового включения скриптов (XSSI).",,,✓,, -V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.8,"Убедитесь, что аутентифицированные ресурсы (такие как изображения, видео, скрипты и другие документы) могут быть загружены или внедрены от имени пользователя только по назначению. Этого можно добиться путём строгой валидации полей заголовка HTTP-запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, или путём установки ограничительного поля заголовка HTTP-ответа Cross‑Origin‑Resource‑Policy, чтобы браузер блокировал возвращаемый контент.",,,✓,, -V3,Безопасность веб-интерфейса,V3.6,Целостность внешних ресурсов,V3.6.1,"Убедитесь, что клиентские ресурсы, такие как библиотеки JavaScript, CSS или веб-шрифты, размещаются только на внешнем сервере (например, в сети доставки контента (Content Delivery Network)), если ресурс статический и имеет версии, а для проверки целостности ресурса используется механизм проверки целостности подресурсов (SRI). Если это невозможно, для каждого ресурса должно быть задокументировано решение по безопасности, обосновывающее это.",,,✓,, -V3,Безопасность веб-интерфейса,V3.7,Другие соображения по безопасности браузера,V3.7.1,"Убедитесь, что приложение использует только те клиентские технологии, которые по-прежнему поддерживаются и считаются безопасными. Примерами технологий, не соответствующих этому требованию, являются плагины NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL или клиентские Java-апплеты.",,✓,✓,, -V3,Безопасность веб-интерфейса,V3.7,Другие соображения по безопасности браузера,V3.7.2,"Убедитесь, что приложение будет автоматически перенаправлять пользователя на другое имя хоста или домен (который не контролируется приложением), только если этот хост или домен указаны в списке разрешенных.",,✓,✓,, -V3,Безопасность веб-интерфейса,V3.7,Другие соображения по безопасности браузера,V3.7.3,"Убедитесь, что приложение отображает уведомление, что пользователь перенаправляется на URL-адрес, находящийся вне контроля приложения, с возможностью отмены навигации.",,,✓,, -V3,Безопасность веб-интерфейса,V3.7,Другие соображения по безопасности браузера,V3.7.4,"Убедитесь, что домен верхнего уровня приложения (например, site.tld) ​​добавлен в публичный список предварительной загрузки (preload list) для HTTP Strict Transport Security (HSTS). Это гарантирует, что использование TLS для приложения будет встроено непосредственно в основные браузеры, а не будет полагаться только на поле заголовка ответа Strict-Transport-Security.",,,✓,, -V3,Безопасность веб-интерфейса,V3.7,Другие соображения по безопасности браузера,V3.7.5,"Убедитесь, что приложение ведет себя так, как описано в документации (например, предупреждает пользователя или блокирует доступ), если браузер, используемый для доступа к приложению, не поддерживает ожидаемые функции безопасности.",,,✓,, -V4,API и Веб-сервис,V4.1,Общая безопасность веб-сервисов,V4.1.1,"Убедитесь, что каждый HTTP-ответ с телом сообщения содержит заголовок Content-Type, который соответствует фактическому содержимому ответа, таким как «text/», «/+xml» и «/xml», включая параметр charset для указания безопасной кодировки символов (например, UTF-8, ISO-8859-1) согласно IANA Media Types.",✓,✓,✓,, -V4,API и Веб-сервис,V4.1,Общая безопасность веб-сервисов,V4.1.2,"Убедитесь, что только конечные точки, предназначенные для взаимодействия с пользователем через веб-браузер, автоматически перенаправляют HTTP на HTTPS, в то время как другие сервисы или конечные точки не реализуют прозрачные редиректы. Это необходимо, чтобы избежать ситуации, когда клиент ошибочно отправляет незашифрованные HTTP-запросы а из-за того, что запрос по HTTP автоматически перенаправляется на HTTPS другим сервисом без обработки на входе, утечка чувствительных данных остаётся незамеченной.",,✓,✓,, -V4,API и Веб-сервис,V4.1,Общая безопасность веб-сервисов,V4.1.3,"Убедитесь, что любой HTTP-заголовок, используемый приложением и устанавливаемый промежуточным уровнем, таким как балансировщик нагрузки, веб-прокси или backend-for-frontend сервис, не может быть переопределён конечным пользователем. Примеры заголовков: X-Real-IP, X-Forwarded-*, X-User-ID.",,✓,✓,, -V4,API и Веб-сервис,V4.1,Общая безопасность веб-сервисов,V4.1.4,"Убедитесь, что разрешены только HTTP-методы, которые явно поддерживаются приложением или его API (включая OPTIONS для preflight-запросов), а неиспользуемые методы заблокированы.",,,✓,, -V4,API и Веб-сервис,V4.1,Общая безопасность веб-сервисов,V4.1.5,"Убедитесь, что для особо чувствительных запросов или транзакций, проходящих через несколько систем, используются цифровые подписи на уровне сообщений, дополнительно к транспортным средствам защиты.",,,✓,, -V4,API и Веб-сервис,V4.2,Валидация структуры HTTP-сообщений,V4.2.1,"Убедитесь, что все компоненты приложения (включая балансировщики нагрузки, файрволы и серверы приложений) определяют границы входящих HTTP-сообщений с использованием механизма, соответствующего версии HTTP, чтобы предотвратить HTTP request smuggling. В HTTP/1.x, если присутствует заголовок Transfer-Encoding, заголовок Content-Length должен игнорироваться согласно RFC 2616. При использовании HTTP/2 или HTTP/3, если присутствует Content-Length, веб-сервер должен убедиться, что он совпадает с длиной DATA-фреймов.",,✓,✓,, -V4,API и Веб-сервис,V4.2,Валидация структуры HTTP-сообщений,V4.2.2,"Убедитесь, что при генерации HTTP-сообщений заголовок Content-Length не конфликтует с длиной содержимого, определяемой рамками протокола HTTP, чтобы предотвратить HTTP Request Smuggling.",,,✓,, -V4,API и Веб-сервис,V4.2,Валидация структуры HTTP-сообщений,V4.2.3,"Убедитесь, что приложение не отправляет и не принимает HTTP/2 и HTTP/3 сообщения с заголовками, специфичными для соединения, такими как Transfer-Encoding, чтобы предотвратить HTTP Response Splitting и HTTP Header Injection.",,,✓,, -V4,API и Веб-сервис,V4.2,Валидация структуры HTTP-сообщений,V4.2.4,"Убедитесь, что приложение принимает HTTP/2 и HTTP/3 запросы только в случае, если поля заголовков и их значения не содержат последовательностей CR (\r), LF (\n) или CRLF (\r\n), чтобы предотвратить HTTP Header Injection.",,,✓,, -V4,API и Веб-сервис,V4.2,Валидация структуры HTTP-сообщений,V4.2.5,"Убедитесь, что если приложение (бекенд или фронтенд) формирует и отправляет запросы, оно использует валидацию, очистку или другие механизмы, чтобы не создавать URI (например, для API-вызовов) или HTTP-заголовки (например, Authorization или Cookie) слишком большой длины, чтобы их не принимал приёмник. Это может привести к отказу в обслуживании, например, при отправке слишком длинного запроса (длинный cookie-заголовок), из-за чего сервер постоянно возвращает ошибку.",,,✓,, -V4,API и Веб-сервис,V4.3,GraphQL,V4.3.1,"Убедитесь, что используется белый список запросов, ограничение глубины вложенности, ограничение количества или анализ стоимости запроса, чтобы предотвратить DoS-атаки на уровне GraphQL или слоя данных из-за дорогостоящих вложенных запросов.",,✓,✓,, -V4,API и Веб-сервис,V4.3,GraphQL,V4.3.2,"Убедитесь, что introspection-запросы GraphQL отключены в продакшен-среде, если GraphQL API не предназначен для использования сторонними клиентами.",,✓,✓,, -V4,API и Веб-сервис,V4.4,WebSocket,V4.4.1,"Убедитесь, что для всех WebSocket-соединений используется WebSocket поверх TLS (WSS).",✓,✓,✓,, -V4,API и Веб-сервис,V4.4,WebSocket,V4.4.2,"Убедитесь, что при первоначальном HTTP WebSocket handshake заголовок Origin проверяется на соответствие списку разрешённых источников для приложения.",,✓,✓,, -V4,API и Веб-сервис,V4.4,WebSocket,V4.4.3,"Убедитесь, что если стандартное управление сессиями приложения не может быть использовано, применяются специальные токены, соответствующие требованиям безопасности управления сессиями.",,✓,✓,, -V4,API и Веб-сервис,V4.4,WebSocket,V4.4.4,"Убедитесь, что специальные токены управления сессиями WebSocket изначально получаются или валидируются через ранее аутентифицированную HTTPS-сессию при переходе от HTTPS к WebSocket.",,✓,✓,, -V5,Работа с файлами,V5.1,Документация по работе с файлами,V5.1.1,"Убедитесь, что документация определяет допустимые типы файлов, ожидаемые расширения и максимальный размер (включая распакованный размер) для каждой функции загрузки. Также убедитесь, что в документации указано, как файлы обезвреживаются для конечных пользователей (например, как приложение ведёт себя при обнаружении вредоносного файла).",,✓,✓,, -V5,Работа с файлами,V5.2,Загрузка файлов и содержимое,V5.2.1,"Убедитесь, что приложение принимает только те файлы, которые может обработать без потери производительности или отказа в обслуживании.",✓,✓,✓,, -V5,Работа с файлами,V5.2,Загрузка файлов и содержимое,V5.2.2,"Убедитесь, что при загрузке файла (включая файлы внутри архивов, таких как ZIP) приложение проверяет, соответствует ли расширение ожидаемому, и валидирует, соответствует ли содержимое типу, указанному в расширении. Это включает проверку начальных 'magic bytes', перезапись изображений, использование специализированных библиотек. Для уровня 1 — достаточно проверок для файлов, критичных с точки зрения бизнеса или безопасности. Для уровней 2 и выше — для всех файлов.",✓,✓,✓,, -V5,Работа с файлами,V5.2,Загрузка файлов и содержимое,V5.2.3,"Убедитесь, что приложение проверяет архивы (например, zip, gz, docx, odt) на максимально допустимый распакованный размер и максимальное количество файлов до распаковки.",,✓,✓,, -V5,Работа с файлами,V5.2,Загрузка файлов и содержимое,V5.2.4,"Убедитесь, что для каждого пользователя установлены квоты на общий размер и количество файлов, чтобы один пользователь не мог переполнить хранилище.",,,✓,, -V5,Работа с файлами,V5.2,Загрузка файлов и содержимое,V5.2.5,"Убедитесь, что приложение не позволяет загружать архивы с символьными ссылками (symlinks), если это не требуется по бизнес-логике. Если требуется — разрешён только строго определённый список допустимых символьных ссылок.",,,✓,, -V5,Работа с файлами,V5.2,Загрузка файлов и содержимое,V5.2.6,"Убедитесь, что приложение отклоняет изображения с числом пикселей выше допустимого, чтобы предотвратить атаки 'pixel flood'.",,,✓,, -V5,Работа с файлами,V5.3,Хранение файлов,V5.3.1,"Убедитесь, что загруженные или сгенерированные из недоверенного ввода файлы, находящиеся в публичной директории, не исполняются как серверный код при обращении к ним по HTTP.",✓,✓,✓,, -V5,Работа с файлами,V5.3,Хранение файлов,V5.3.2,"Убедитесь, что при создании путей к файлам приложение использует внутренние или доверенные данные, а не пользовательские имена файлов. Если использование пользовательских имён или метаданных необходимо — требуется строгая проверка и очистка. Это защита от path traversal, LFI, RFI и SSRF.",✓,✓,✓,, -V5,Работа с файлами,V5.3,Хранение файлов,V5.3.3,"Убедитесь, что при обработке файлов на сервере (например, при распаковке) игнорируются пути, заданные пользователем, во избежание уязвимостей типа 'zip slip'.",,,✓,, -V5,Работа с файлами,V5.4,Скачивание файлов,V5.4.1,"Убедитесь, что приложение валидирует или игнорирует имена файлов, переданных пользователем (включая в JSON, JSONP или URL-параметре), и указывает имя файла в заголовке Content-Disposition при ответе.",,✓,✓,, -V5,Работа с файлами,V5.4,Скачивание файлов,V5.4.2,"Убедитесь, что имена файлов, передаваемые (например, в HTTP-заголовках или вложениях в email), кодируются или очищаются (например, по RFC 6266), чтобы сохранить структуру документа и предотвратить инъекции.",,✓,✓,, -V5,Работа с файлами,V5.4,Скачивание файлов,V5.4.3,"Убедитесь, что файлы, полученные из недоверенных источников, сканируются антивирусом, чтобы не распространять известное вредоносное содержимое.",,✓,✓,, -V6,Аутентификация,V6.1,Документация по аутентификации,V6.1.1,"Убедитесь, что в документации приложения описано, как используются механизмы, такие как ограничение частоты запросов (rate limiting), защита от автоматизации и адаптивные реакции, для защиты от атак, таких как подстановка учётных данных и перебор паролей. Документация должна ясно описывать конфигурацию этих механизмов и предотвращение злонамеренной блокировки аккаунтов.",✓,✓,✓,, -V6,Аутентификация,V6.1,Документация по аутентификации,V6.1.2,"Убедитесь, что задокументирован список контекстно-зависимых слов, запрещённых к использованию в паролях. В него могут входить производные от названий организаций, продуктов, идентификаторов систем, кодовых названий проектов, названий отделов или ролей и тому подобное.",,✓,✓,, -V6,Аутентификация,V6.1,Документация по аутентификации,V6.1.3,"Убедитесь, что если приложение поддерживает несколько способов аутентификации, то все они документированы вместе с описанием применяемых средств защиты и уровнем стойкости аутентификации, которые должны быть одинаково применены ко всем способам.",,✓,✓,, -V6,Аутентификация,V6.2,Безопасность паролей,V6.2.1,"Убедитесь, что пользовательские пароли содержат не менее 8 символов. Рекомендуется минимальная длина в 15 символов.",✓,✓,✓,, -V6,Аутентификация,V6.2,Безопасность паролей,V6.2.2,"Убедитесь, что пользователи могут менять свои пароли.",✓,✓,✓,, -V6,Аутентификация,V6.2,Безопасность паролей,V6.2.3,"Убедитесь, что для смены пароля требуется ввести как текущий, так и новый пароль.",✓,✓,✓,, -V6,Аутентификация,V6.2,Безопасность паролей,V6.2.4,"Убедитесь, что при регистрации или смене пароля введённый пароль проверяется по списку как минимум из 3000 самых популярных паролей, соответствующих политике (например, минимальной длине).",✓,✓,✓,, -V6,Аутентификация,V6.2,Безопасность паролей,V6.2.5,"Убедитесь, что допускаются пароли любой структуры, без ограничений на использование определённых символов. Не должно быть требований по обязательному наличию заглавных/строчных букв, цифр или специальных символов.",✓,✓,✓,, -V6,Аутентификация,V6.2,Безопасность паролей,V6.2.6,"Убедитесь, что поля ввода пароля используют type=password для скрытия символов. Разрешено временное отображение всего пароля или последнего введённого символа.",✓,✓,✓,, -V6,Аутентификация,V6.2,Безопасность паролей,V6.2.7,"Убедитесь, что разрешены вставка (paste), использование менеджеров паролей браузера и внешних менеджеров паролей.",✓,✓,✓,, -V6,Аутентификация,V6.2,Безопасность паролей,V6.2.8,"Убедитесь, что пароль проверяется строго в том виде, в котором он был введён пользователем — без обрезки, изменения регистра и других модификаций.",✓,✓,✓,, -V6,Аутентификация,V6.2,Безопасность паролей,V6.2.9,"Убедитесь, что система позволяет использовать пароли длиной не менее 64 символов.",,✓,✓,, -V6,Аутентификация,V6.2,Безопасность паролей,V6.2.10,"Убедитесь, что пароль остаётся действительным, пока не будет скомпрометирован или не будет изменён пользователем. Приложение не должно требовать регулярной смены пароля.",,✓,✓,, -V6,Аутентификация,V6.2,Безопасность паролей,V6.2.11,"Убедитесь, что используется документированный список контекстно-зависимых слов (например, названия компаний, проектов и т.д.) для предотвращения использования легко угадываемых паролей.",,✓,✓,, -V6,Аутентификация,V6.2,Безопасность паролей,V6.2.12,"Убедитесь, что при регистрации или смене пароля проверяется, не входит ли он в список скомпрометированных (утёкших) паролей.",,✓,✓,, -V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.1,"Убедитесь, что реализованы меры защиты от атак типа credential stuffing (массовая подстановка учётных данных) и brute-force (перебор паролей), согласно документации по безопасности приложения.",✓,✓,✓,, -V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.2,"Убедитесь, что в приложении отсутствуют или отключены учётные записи по умолчанию (например, root, admin, sa).",✓,✓,✓,, -V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.3,"Убедитесь, что для доступа к приложению используется либо механизм многофакторной аутентификации, либо комбинация однофакторных. Для уровня L3 один из факторов должен быть аппаратным, обеспечивающим защиту от фишинга, устойчивость к компрометации и подтверждение намерения аутентификации через явное действие пользователя (например, нажатие кнопки на FIDO-ключе или телефоне). Ослабление этих требований допускается только при наличии обоснования и компенсирующих мер.",,✓,✓,, -V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.4,"Убедитесь, что при наличии нескольких способов аутентификации, они все задокументированы, и для них единообразно применяются меры защиты и уровни доверия.",,✓,✓,, -V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.5,"Убедитесь, что пользователи получают уведомления о подозрительных попытках аутентификации (удачных и неудачных). Это может включать попытки (например, подключения) с необычного устройства или места, частично успешную MFA, попытку после долгого отсутствия или успешную аутентификацию после серии неудачных.",,,✓,, -V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.6,"Убедитесь, что email не используется ни как однофакторный, ни как многофакторный механизм аутентификации.",,,✓,, -V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.7,"Убедитесь, что пользователи получают уведомление при изменении данных аутентификации, таких как сброс пароля или изменение логина/email.",,,✓,, -V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.8,"Убедитесь, что из сообщений об ошибке, HTTP-кодов ответа или различий во времени ответа нельзя определить, существует ли пользователь с таким логином. Это правило также должно применяться к функциям регистрации и восстановления пароля.",,,✓,, -V6,Аутентификация,V6.4,Жизненный цикл и восстановление факторов аутентификации,V6.4.1,"Убедитесь, что начальные пароли или коды активации, генерируемые системой, создаются с использованием надёжного генератора случайных чисел, соответствуют текущей политике паролей и истекают через короткий период времени либо после первого использования. Эти секреты не должны использоваться как постоянные пароли.",✓,✓,✓,, -V6,Аутентификация,V6.4,Жизненный цикл и восстановление факторов аутентификации,V6.4.2,"Убедитесь, что в системе отсутствуют подсказки к паролю или вопросы на знание («секретные вопросы»).",✓,✓,✓,, -V6,Аутентификация,V6.4,Жизненный цикл и восстановление факторов аутентификации,V6.4.3,"Убедитесь, что реализован безопасный процесс сброса забытого пароля, который не обходит активные механизмы многофакторной аутентификации.",,✓,✓,, -V6,Аутентификация,V6.4,Жизненный цикл и восстановление факторов аутентификации,V6.4.4,"Убедитесь, что в случае утраты одного из факторов MFA проводится удостоверение личности (identity proofing) на том же уровне, что и при первичной регистрации.",,✓,✓,, -V6,Аутентификация,V6.4,Жизненный цикл и восстановление факторов аутентификации,V6.4.5,"Убедитесь, что инструкции по обновлению истекающих механизмов аутентификации отправляются заранее, с достаточным запасом времени для выполнения замены, при необходимости с настройкой автоматических напоминаний.",,,✓,, -V6,Аутентификация,V6.4,Жизненный цикл и восстановление факторов аутентификации,V6.4.6,"Убедитесь, что администраторы могут инициировать процесс сброса пароля, но не могут задать или выбрать новый пароль за пользователя. Это исключает ситуацию, при которой администратор знает пароль пользователя.",,,✓,, -V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.1,"Убедитесь, что lookup-секреты, внеполосные коды/запросы и TOTP-коды можно использовать только один раз.",,✓,✓,, -V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.2,"Убедитесь, что при хранении lookup-секретов с энтропией менее 112 бит (например, 19 случайных буквенно-цифровых символов или 34 случайные цифры) они хэшируются с использованием разрешённого алгоритма хеширования паролей и случайной соли минимум 32 бита. Если у секрета ≥112 бит энтропии — допустимо использовать стандартный хэш.",,✓,✓,, -V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.3,"Убедитесь, что lookup-секреты, коды внеполосной аутентификации и сиды для TOTP генерируются с использованием криптографически стойкого генератора случайных чисел (CSPRNG), чтобы избежать предсказуемых значений.",,✓,✓,, -V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.4,"Убедитесь, что lookup-секреты и внеполосные коды аутентификации имеют минимум 20 бит энтропии (достаточно, например, 4 случайных алфавитно-цифровых символов или 6 случайных цифр).",,✓,✓,, -V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.5,"Убедитесь, что все внеполосные запросы, коды и токены, а также TOTP-коды имеют ограниченный срок действия. Максимум для out-of-band — 10 минут, для TOTP — 30 секунд.",,✓,✓,, -V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.6,"Убедитесь, что любой фактор аутентификации (включая физические устройства) может быть отозван в случае кражи или утери.",,,✓,, -V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.7,"Убедитесь, что биометрические механизмы аутентификации используются только как вторичный фактор — в сочетании с «чем-то, что вы знаете» или «чем-то, что у вас есть».",,,✓,, -V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.8,"Убедитесь, что TOTP-коды проверяются по источнику времени, полученному от доверенного сервиса, а не от клиента или недоверенного источника.",,,✓,, -V6,Аутентификация,V6.6,Внеполосные механизмы аутентификации,V6.6.1,"Убедитесь, что механизмы аутентификации через телефонную сеть общего пользования (PSTN) для доставки одноразовых паролей (OTP) по телефону или SMS используются только в случае предварительной валидации номера, при этом предлагаются альтернативные более безопасные методы (например, TOTP), и пользователю сообщаются риски. Для приложений уровня L3 использование телефона и SMS недопустимо.",,✓,✓,, -V6,Аутентификация,V6.6,Внеполосные механизмы аутентификации,V6.6.2,"Убедитесь, что внеполосные запросы, коды или токены привязаны к исходному запросу аутентификации, для которого они были сгенерированы, и не могут быть использованы повторно для других попыток.",,✓,✓,, -V6,Аутентификация,V6.6,Внеполосные механизмы аутентификации,V6.6.3,"Убедитесь, что внеполосные механизмы на основе кода защищены от атак методом подбора (brute force) путём применения ограничения частоты запросов (rate limiting). Также рекомендуется использовать коды с энтропией не менее 64 бит.",,✓,✓,, -V6,Аутентификация,V6.6,Внеполосные механизмы аутентификации,V6.6.4,"Убедитесь, что при использовании push-уведомлений для MFA применяется ограничение частоты (rate limiting), чтобы предотвратить атаки push-бомбинга. Также может помочь механизм сопоставления номеров (number matching).",,,✓,, -V6,Аутентификация,V6.7,Криптографические механизмы аутентификации,V6.7.1,"Убедитесь, что сертификаты, используемые для проверки криптографических утверждений об аутентификации, хранятся таким образом, чтобы исключить возможность их модификации.",,,✓,, -V6,Аутентификация,V6.7,Криптографические механизмы аутентификации,V6.7.2,"Убедитесь, что nonce (случайная строка), используемая в процессе вызова, имеет длину не менее 64 бит и является статистически уникальной или уникальной на протяжении всего срока службы криптографического устройства.",,,✓,, -V6,Аутентификация,V6.8,Аутентификация с использованием провайдера идентификаций (IdP),V6.8.1,"Убедитесь, что при поддержке несколькими IdP, невозможно подделать личность пользователя через другой IdP (например, с тем же user ID). Стандартным способом защиты является регистрация пользователя с использованием сочетания ID самого IdP (в качестве пространства имён) и пользовательского ID внутри IdP.",,✓,✓,, -V6,Аутентификация,V6.8,Аутентификация с использованием провайдера идентификаций (IdP),V6.8.2,"Убедитесь, что наличие и целостность цифровой подписи в утверждениях аутентификации (например, в JWT или SAML) всегда проверяются, а неподписанные или недействительные утверждения отклоняются.",,✓,✓,, -V6,Аутентификация,V6.8,Аутентификация с использованием провайдера идентификаций (IdP),V6.8.3,"Убедитесь, что SAML-утверждения обрабатываются только один раз в течение периода их действия, чтобы исключить атаки воспроизведения (replay attacks).",,✓,✓,, -V6,Аутентификация,V6.8,Аутентификация с использованием провайдера идентификаций (IdP),V6.8.4,"Убедитесь, что если приложение использует внешний поставщик идентификации (IdP) и для определенных функций требуется особый уровень, метод или срок действия аутентификации, то приложение использует данные, возвращаемые IdP, для проверки этих условий. Например, при использовании OIDC можно проверить значения полей ID Token — acr, amr, auth_time (если они есть). Если IdP не предоставляет эти данные, приложение должно иметь документированный план действий по умолчанию, предполагающий использование минимально допустимой силы аутентификации (например, одноступенчатая — логин и пароль).",,✓,✓,, -V7,Управление сессиями,V7.1,Документация по управлению сессиями,V7.1.1,"Убедитесь, что тайм-аут бездействия и абсолютное максимальное время жизни сессии задокументированы, соответствуют другим контрольным мерам и сопровождаются обоснованием любых отклонений от требований повторной аутентификации NIST SP 800-63B.",,✓,✓,, -V7,Управление сессиями,V7.1,Документация по управлению сессиями,V7.1.2,"Убедитесь, что документация определяет допустимое количество одновременных (параллельных) сессий для одного аккаунта, а также поведение системы и действия при достижении этого лимита.",,✓,✓,, -V7,Управление сессиями,V7.1,Документация по управлению сессиями,V7.1.3,"Убедитесь, что все системы, создающие и управляющие сессиями пользователей в рамках федеративной идентификации (например, SSO), задокументированы вместе с механизмами координации сроков действия сессий, условий завершения и случаев, требующих повторной аутентификации.",,✓,✓,, -V7,Управление сессиями,V7.2,Базовая безопасность сессий,V7.2.1,"Убедитесь, что все проверки сессионных токенов выполняются на доверенной серверной стороне.",✓,✓,✓,, -V7,Управление сессиями,V7.2,Базовая безопасность сессий,V7.2.2,"Убедитесь, что приложение использует либо автономные токены, либо ссылочные токены, которые генерируются динамически, не используя статические API-секреты или ключи.",✓,✓,✓,, -V7,Управление сессиями,V7.2,Базовая безопасность сессий,V7.2.3,"Убедитесь, что ссылочные токены являются уникальными, создаются с использованием криптографически безопасного генератора псевдослучайных чисел (CSPRNG) и обладают энтропией не менее 128 бит.",✓,✓,✓,, -V7,Управление сессиями,V7.2,Базовая безопасность сессий,V7.2.4,"Убедитесь, что при аутентификации пользователя (включая повторную) создается новый токен сессии, а текущий — аннулируется.",✓,✓,✓,, -V7,Управление сессиями,V7.3,Тайм-ауты сессии,V7.3.1,"Убедитесь, что есть тайм-аут бездействия, после которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.",,✓,✓,, -V7,Управление сессиями,V7.3,Тайм-ауты сессии,V7.3.2,"Убедитесь, что установлено абсолютное максимальное время жизни сессии, по истечении которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.",,✓,✓,, -V7,Управление сессиями,V7.4,Завершение сессий,V7.4.1,"Убедитесь, что после завершения сессии (logout, истечение срока) дальнейшее её использование невозможно. Для ссылочных токенов или сессий с сохранением состояния это означает аннулирование на сервере. Для self-contained токенов необходимо реализовать механизм отзыва, например, список отозванных токенов, проверку времени выпуска или ротацию ключей подписи для каждого пользователя.",✓,✓,✓,, -V7,Управление сессиями,V7.4,Завершение сессий,V7.4.2,"Убедитесь, что при удалении или отключении пользователя все активные сессии немедленно завершаются.",✓,✓,✓,, -V7,Управление сессиями,V7.4,Завершение сессий,V7.4.3,"Убедитесь, что после изменения или удаления факторов аутентификации (например, смена пароля или MFA) приложение предлагает завершить все другие активные сессии.",,✓,✓,, -V7,Управление сессиями,V7.4,Завершение сессий,V7.4.4,"Убедитесь, что на всех страницах, требующих аутентификации, имеется простой и видимый способ выхода.",,✓,✓,, -V7,Управление сессиями,V7.4,Завершение сессий,V7.4.5,"Убедитесь, что администраторы могут завершать активные сессии конкретного пользователя или всех пользователей.",,✓,✓,, -V7,Управление сессиями,V7.5,Защита от злоупотреблений сессией,V7.5.1,"Убедитесь, что приложение требует полной повторной аутентификации перед изменением чувствительных атрибутов аккаунта, которые могут влиять на аутентификацию (например, email, номер телефона, настройки MFA или данных восстановления доступа).",,✓,✓,, -V7,Управление сессиями,V7.5,Защита от злоупотреблений сессией,V7.5.2,"Убедитесь, что пользователь может просматривать и (после повторной аутентификации хотя бы по одному фактору) завершать активные сессии.",,✓,✓,, -V7,Управление сессиями,V7.5,Защита от злоупотреблений сессией,V7.5.3,"Убедитесь, что перед выполнением критически важных операций приложение требует повторной аутентификации (по крайней мере, одного фактора) или дополнительной проверки.",,,✓,, -V7,Управление сессиями,V7.6,Федеративная повторная аутентификация,V7.6.1,"Убедитесь, что срок действия и завершение сессий между RP и IdP соответствуют документации и включают повторную аутентификацию, если достигнут максимальный допустимый интервал между событиями аутентификации.",,✓,✓,, -V7,Управление сессиями,V7.6,Федеративная повторная аутентификация,V7.6.2,"Убедитесь, что создание сессии требует согласия пользователя или явного действия, предотвращающего несанкционированное создание сессий без участия пользователя.",,✓,✓,, -V8,Авторизация,V8.1,Документация по авторизации,V8.1.1,"Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне функций и на уровне данных на основе прав субъекта и атрибутов ресурса.",✓,✓,✓,, -V8,Авторизация,V8.1,Документация по авторизации,V8.1.2,"Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне полей (как на чтение, так и на запись) на основе прав субъекта и атрибутов ресурса. Эти правила могут зависеть от других атрибутов объекта данных, например, статуса.",,✓,✓,, -V8,Авторизация,V8.1,Документация по авторизации,V8.1.3,"Убедитесь, что документация определяет, какие атрибуты окружения и контекста (например, время суток, IP-адрес, местоположение, устройство) используются приложением для принятия решений в области аутентификации и авторизации.",,,✓,, -V8,Авторизация,V8.1,Документация по авторизации,V8.1.4,"Убедитесь, что документация по аутентификации и авторизации определяет, как используются факторы окружения и контекста в принятии решений, наряду с правилами доступа к функциям, данным и полям. Документация должна содержать оцениваемые атрибуты, пороговые значения риска, действия (разрешить, отказать, повысить уровень аутентификации и др.).",,,✓,, -V8,Авторизация,V8.2,Архитектура авторизации,V8.2.1,"Убедитесь, что приложение обеспечивает доступ на уровне функций (function-level) только субъектам с явными разрешениями.",✓,✓,✓,, -V8,Авторизация,V8.2,Архитектура авторизации,V8.2.2,"Убедитесь, что приложение обеспечивает доступ на уровне данных (data-specific) только тем субъектам, которым явно предоставлены права к определённым элементам данных, чтобы предотвратить IDOR (Insecure Direct Object Reference) и BOLA-уязвимости (Broken Object Level Authorization).",✓,✓,✓,, -V8,Авторизация,V8.2,Архитектура авторизации,V8.2.3,"Убедитесь, что приложение обеспечивает доступ на уровне полей (field-level) только тем субъектам, которым явно предоставлены права к определённым полям, чтобы предотвратить BOPLA (Broken Object Property Level Authorization).",,✓,✓,, -V8,Авторизация,V8.2,Архитектура авторизации,V8.2.4,"Убедитесь, что реализованы адаптивные меры безопасности, основанные на атрибутах окружения и контекста субъекта (время, местоположение, IP, устройство), которые используются для принятия решений об аутентификации и авторизации, как это определено в документации приложения. Эти меры должны применяться как при попытке субъекта начать новую сессию, так и во время существующей сессии.",,,✓,, -V8,Авторизация,V8.3,Авторизация на уровне операций,V8.3.1,"Убедитесь, что правила авторизации реализуются на доверенном сервисном уровне и не зависят от элементов, которые может контролировать клиент (например, JavaScript на стороне клиента).",✓,✓,✓,, -V8,Авторизация,V8.3,Авторизация на уровне операций,V8.3.2,"Убедитесь, что изменения значений, влияющих на авторизацию, применяются немедленно. Если это невозможно (например, при использовании автономных токенов), должны быть реализованы компенсирующие меры: оповещения о попытке несанкционированного действия и откат изменений. Обратите внимание, что данный подход не предотвращает утечку информации.",,,✓,, -V8,Авторизация,V8.3,Авторизация на уровне операций,V8.3.3,"Убедитесь, что доступ к объекту осуществляется на основе прав субъекта, инициировавшего запрос, а не прав промежуточного сервиса, действующего от его имени. Например, если пользователь обращается к веб-сервису с автономным токеном для аутентификации, а сервис затем запрашивает данные у другого сервиса, второй сервис должен использовать токен пользователя, а не токен первого сервиса для принятия решения о доступе.",,,✓,, -V8,Авторизация,V8.4,Прочие аспекты авторизации,V8.4.1,"Убедитесь, что в мультитенантных приложениях реализованы механизмы, предотвращающие действия потребителя в отношении арендаторов, к которым у него нет доступа.",,✓,✓,, -V8,Авторизация,V8.4,Прочие аспекты авторизации,V8.4.2,"Убедитесь, что доступ к административным интерфейсам защищён несколькими уровнями контроля, включая непрерывную проверку личности, контроль защищённости устройства и анализ контекстных рисков. Недостаточно опираться только на IP-адрес или доверенные устройства.",,,✓,, -V9,Автономные токены,V9.1,Источник токена и его целостность,V9.1.1,"Убедитесь, что автономные токены проверяются на целостность с помощью цифровой подписи или MAC, прежде чем доверять их содержимому.",✓,✓,✓,, -V9,Автономные токены,V9.1,Источник токена и его целостность,V9.1.2,"Проверяйте, что автономные токены создаются и проверяются исключительно с помощью алгоритмов из списка допустимых в данном контексте. Список допустимых алгоритмов должен включать только разрешенные алгоритмы (желательно либо только симметричные, либо только асимметричные) и ни в коем случае не содержать алгоритм None. Если необходимо поддерживать оба типа алгоритмов, потребуются дополнительные средства контроля для предотвращения путаницы с ключами (key confusion).",✓,✓,✓,, -V9,Автономные токены,V9.1,Источник токена и его целостность,V9.1.3,"Убедитесь, что ключи, используемые для проверки автономных токенов, получены из доверенных, предварительно настроенных источников. Это предотвращает возможность указания злоумышленниками ненадёжных источников и ключей. Для JWT и других JWS структур заголовки 'jku', 'x5u' и 'jwk' должны проверяться по белому списку.",✓,✓,✓,, -V9,Автономные токены,V9.2,Содержимое токена,V9.2.1,"Убедитесь, что при указанном сроке действия токен и его содержимое принимаются только в том случае, если срок действия токена не истёк. Например, для JWT нужно проверить поля 'nbf' и 'exp'.",✓,✓,✓,, -V9,Автономные токены,V9.2,Содержимое токена,V9.2.2,"Убедитесь, что сервис, принимающий токен, проверяет его тип и соответствие назначению перед обработкой содержимого токена. Например, для принятия решений об авторизации могут быть приняты только Access Token, а для подтверждения аутентификации пользователя — только ID Token.",,✓,✓,, -V9,Автономные токены,V9.2,Содержимое токена,V9.2.3,"Убедитесь, что сервис принимает только токены, предназначенные для использования с этим сервисом (audience). Для JWT это можно сделать, проверив наличие утверждения «aud» по белому списку, определенному в сервисе.",,✓,✓,, -V9,Автономные токены,V9.2,Содержимое токена,V9.2.4,"Убедитесь, что, если эмитент токенов использует один и тот же закрытый ключ для выпуска токенов различным сервисам (audiences), выпущенные токены содержат явное указание целевых сервисов. Это предотвратит повторное использования токенов в не предназначенных для них сервисах. Если идентификатор сервиса (audience identifier) назначается динамически, эмитент токенов должен проверить audiences для исключения подмены получателей (audience impersonation).",,✓,✓,, -V10,OAuth и OIDC,V10.1,Общие требования безопасности OAuth и OIDC,V10.1.1,"Убедитесь, что токены передаются только тем компонентам, которым они действительно необходимы. Например, при использовании схемы backend-for-frontend для браузерных JavaScript-приложений, access и refresh токены должны быть доступны только на backend.",,✓,✓,, -V10,OAuth и OIDC,V10.1,Общие требования безопасности OAuth и OIDC,V10.1.2,"Убедитесь, что клиент принимает значения от авторизационного сервера (например, authorization code или ID Token) только если они получены в результате авторизационного потока, инициированного в той же сессии пользовательского агента и в рамках той же транзакции. Для этого клиентские секреты, такие как proof key для code exchange (PKCE) — 'code_verifier', 'state' или OIDC 'nonce' — должны быть непредсказуемыми, специфичными для транзакции и надежно привязанными как к клиенту, так и к сессии пользовательского агента, в которой началась транзакция.",,✓,✓,, -V10,OAuth и OIDC,V10.2,Клиент OAuth,V10.2.1,"Убедитесь, что если используется механизм authorization code flow, OAuth клиент защищён от CSRF, вызывающих запросы токенов либо за счёт использования механизма proof key for code exchange (PKCE), либо за счёт проверки параметра 'state', который был отправлен в запросе авторизации.",,✓,✓,, -V10,OAuth и OIDC,V10.2,Клиент OAuth,V10.2.2,"Убедитесь, что если OAuth клиент может взаимодействовать с более чем одним сервером авторизации, у него есть защита от атак смешивания (mix-up attacks). Например, клиент должен требовать, чтобы сервер авторизации возвращал параметр 'iss' и проверять его в ответах на авторизацию и токены.",,✓,✓,, -V10,OAuth и OIDC,V10.2,Клиент OAuth,V10.2.3,"Убедитесь, что OAuth клиент запрашивает только необходимые области доступа (scopes) или другие параметры авторизации в запросах к серверу авторизации.",,,✓,, -V10,OAuth и OIDC,V10.3,Сервер ресурсов OAuth,V10.3.1,"Убедитесь, что сервер ресурсов принимает только те access токены, которые предназначены для использования с этим сервисом (свойство audience). Эта принадлежность сервису может быть включена в структурированный access токен (например, в поле 'aud' в JWT) или проверяться через endpoint интроспекции токена.",,✓,✓,, -V10,OAuth и OIDC,V10.3,Сервер ресурсов OAuth,V10.3.2,"Убедитесь, что сервер ресурсов принимает решения по авторизации на основе claims из access токена, определяющих делегированную авторизацию. Если присутствуют claims, такие как 'sub', 'scope' и 'authorization_details', они должны участвовать в принятии решения.",,✓,✓,, -V10,OAuth и OIDC,V10.3,Сервер ресурсов OAuth,V10.3.3,"Убедитесь, что если для принятия решения по контролю доступа необходимо однозначно идентифицировать пользователя из access токена (JWT или ответа интроспекции), сервер ресурсов использует claims, которые не могут быть переприсвоены другим пользователям. Обычно это комбинация claims 'iss' и 'sub'.",,✓,✓,, -V10,OAuth и OIDC,V10.3,Сервер ресурсов OAuth,V10.3.4,"Убедитесь, что если сервер ресурсов требует определённой силы аутентификации, методов или свежести аутентификации, он проверяет, что предъявленный access токен удовлетворяет этим требованиям. Например, при наличии, могут использоваться claims OIDC 'acr', 'amr' и 'auth_time'.",,✓,✓,, -V10,OAuth и OIDC,V10.3,Сервер ресурсов OAuth,V10.3.5,"Убедитесь, что сервер ресурсов предотвращает использование украденных access токенов или их повторное использование (replay) неавторизованными лицами, требуя access токены с подтверждением отправителя — например, Mutual TLS для OAuth 2 или OAuth 2 Demonstration of Proof of Possession (DPoP).",,,✓,, -V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.1,"Убедитесь, что сервер авторизации проверяет URI перенаправления (redirect URI), сверяя его с заранее зарегистрированным списком разрешённых URI для данного клиента (allowlist), используя точное сравнение строк.",✓,✓,✓,, -V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.2,"Убедитесь, что если сервер авторизации возвращает authorization code в ответе авторизации, этот код может быть использован только один раз для запроса токена. При втором валидном запросе с уже использованным кодом сервер должен отклонить запрос и отозвать любые токены, связанные с этим кодом.",✓,✓,✓,, -V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.3,"Убедитесь, что authorization code имеет короткое время жизни. Максимальная продолжительность — до 10 минут для приложений L1 и L2 и до 1 минуты для приложений L3.",✓,✓,✓,, -V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.4,"Убедитесь, что сервер авторизации для конкретного клиента разрешает использование только тех типов авторизации, которые необходимы этому клиенту. Обратите внимание, что тип авторизации Implicit flow и Resource Owner Password Credentials flow больше не должны использоваться.",✓,✓,✓,, -V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.5,"Убедитесь, что сервер авторизации предотвращает атаки повторного использования refresh токенов для публичных клиентов, предпочтительно используя sender-constrained refresh токены, такие как DPoP или сертификат-связанные токены с mutual TLS (mTLS). Для L1 и L2 допускается ротация refresh токенов с обязательной их инвалидацией после использования. Если используется ротация, сервер должен отозвать все refresh токены при попытке использовать уже инвалидированный токен.",✓,✓,✓,, -V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.6,"Убедитесь, что при использовании типа авторизации «Authorization Code» сервер предотвращает атаки перехвата authorization code, требуя Proof Key for Code Exchange (PKCE). В запросах авторизации сервер должен требовать валидное значение 'code_challenge' и не принимать 'code_challenge_method' со значением 'plain'. В запросах токена обязательно валидировать параметр 'code_verifier'.",,✓,✓,, -V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.7,"Убедитесь, что если сервер авторизации поддерживает динамическую регистрацию клиентов без аутентификации, он минимизирует риски вредоносных клиентов. Сервер должен валидировать метаданные клиента (например, зарегистрированные URI), обеспечивать согласие пользователя и предупреждать пользователя перед обработкой запроса авторизации от недоверенного клиента.",,✓,✓,, -V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.8,"Убедитесь, что refresh токены имеют абсолютный срок действия, включая случаи, когда применяется скользящее время истечения срока.",,✓,✓,, -V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.9,"Убедитесь, что пользователи могут отзывать refresh токены и reference access токены через пользовательский интерфейс сервера авторизации для снижения риска от вредоносных клиентов или кражи токенов.",,✓,✓,, -V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.10,"Убедитесь, что конфиденциальный клиент аутентифицируется при взаимодействии с сервером авторизации через backchannel, например при запросах токена, pushed authorization requests (PAR) и запросах на отзыв токенов.",,✓,✓,, -V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.11,"Убедитесь, что конфигурация сервера авторизации назначает OAuth клиенту только необходимые области доступа (scopes).",,✓,✓,, -V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.12,"Убедитесь, что для конкретного клиента сервер авторизации разрешает только те значения 'response_mode', которые необходимы этому клиенту. Например, сервер должен валидировать это значение против ожидаемых или использовать pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).",,,✓,, -V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.13,"Убедитесь, что грант типа 'code' всегда используется вместе с pushed authorization requests (PAR).",,,✓,, -V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.14,"Убедитесь, что сервер авторизации выдаёт только sender-constrained (Proof-of-Possession) access токены, либо с сертификат-связанными токенами через mutual TLS (mTLS), либо DPoP-bound токены (Demonstration of Proof of Possession).",,,✓,, -V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.15,"Убедитесь, что для серверного клиента (не выполняющегося на устройстве конечного пользователя) сервер авторизации проверяет, что значение параметра 'authorization_details' исходит из клиентского backend и что пользователь не изменял его. Например, это достигается использованием pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).",,,✓,, -V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.16,"Убедитесь, что клиент является конфиденциальным и сервер авторизации требует использования сильных методов аутентификации клиента (основанных на криптографии с открытым ключом и устойчивых к атакам повторного воспроизведения), таких как mutual TLS ('tls_client_auth', 'self_signed_tls_client_auth') или private key JWT ('private_key_jwt').",,,✓,, -V10,OAuth и OIDC,V10.5,Клиент OIDC,V10.5.1,"Убедитесь, что клиент (relying party) защищается от повторного использования ID Token (replay-атак). Например, это достигается проверкой того, что значение 'nonce' в ID Token совпадает со значением 'nonce', отправленным в запросе аутентификации провайдеру OpenID (authorization server).",,✓,✓,, -V10,OAuth и OIDC,V10.5,Клиент OIDC,V10.5.2,"Убедитесь, что клиент однозначно идентифицирует пользователя по утверждениям (claims) ID Token, обычно это 'sub', который не может быть переназначен другому пользователю (в пределах конкретного провайдера идентификации).",,✓,✓,, -V10,OAuth и OIDC,V10.5,Клиент OIDC,V10.5.3,"Убедитесь, что клиент отклоняет попытки злоумышленного сервера авторизации выдавать себя за другой сервер авторизации через метаданные сервера авторизации. Клиент должен отклонить метаданные, если URL издателя (issuer) в метаданных не совпадает точно с преднастроенным URL издателя, ожидаемым клиентом.",,✓,✓,, -V10,OAuth и OIDC,V10.5,Клиент OIDC,V10.5.4,"Убедитесь, что клиент проверяет, что ID Token предназначен для него (проверка audience), сравнивая значение 'aud' в токене с 'client_id' клиента.",,✓,✓,, -V10,OAuth и OIDC,V10.5,Клиент OIDC,V10.5.5,"Убедитесь, что при использовании OIDC back-channel logout клиент снижает риск отказа в обслуживании, вызванный принудительным выходом из системы и путаницей между разными типами JWT (cross-JWT confusion) в процессе логаута. Клиент должен проверить, что токен выхода корректно типизирован со значением 'logout+jwt', содержит claim 'event' с правильным именем участника и не содержит 'nonce'. Также рекомендуется установить короткий срок действия токена (например, 2 минуты).",,✓,✓,, -V10,OAuth и OIDC,V10.6,Провайдер OpenID,V10.6.1,"Убедитесь, что провайдер OpenID допускает только значения 'code', 'ciba', 'id_token' или 'id_token code' для параметра response mode. При этом предпочтение отдаётся 'code' по сравнению с 'id_token code' (гибридный поток OIDC), а значение 'token' (любой Implicit flow) не должно использоваться.",,✓,✓,, -V10,OAuth и OIDC,V10.6,Провайдер OpenID,V10.6.2,"Убедитесь, что провайдер OpenID предотвращает отказ в обслуживании (DoS) через принудительный выход (logout), запрашивая явное подтверждение от конечного пользователя или, если применимо, проверяя параметры в запросе выхода (инициированном relying party), например параметр 'id_token_hint'.",,✓,✓,, -V10,OAuth и OIDC,V10.7,Управление согласием,V10.7.1,"Убедитесь, что авторизационный сервер обеспечивает получение согласия пользователя для каждого запроса авторизации. Если личность клиента не может быть подтверждена, сервер авторизации всегда должен явно запрашивать согласие пользователя.",,✓,✓,, -V10,OAuth и OIDC,V10.7,Управление согласием,V10.7.2,"Убедитесь, что при запросе согласия пользователя авторизационный сервер предоставляет достаточную и понятную информацию о том, на что даётся согласие. При необходимости это должно включать характер запрашиваемых разрешений (обычно основанных на scope, ресурсном сервере, деталях авторизации Rich Authorization Requests (RAR)), идентификацию авторизованного приложения и срок действия этих разрешений.",,✓,✓,, -V10,OAuth и OIDC,V10.7,Управление согласием,V10.7.3,"Убедитесь, что пользователь может просматривать, изменять и отзывать согласия, которые он предоставил, через авторизационный сервер.",,✓,✓,, -V11,Криптография,V11.1,Инвентаризация и документирование криптографии,V11.1.1,"Убедитесь, что задокументирована политика управления криптографическими ключами и описан их жизненный цикл в соответствии со стандартом управления ключей, таким как NIST SP 800-57. Убедитесь, что ключи известны только тем сущностям, которым они должны быть доступны (например, ключи не передавались более чем двум участникам для общих секретов и более чем одному участнику для приватных ключей).",,✓,✓,, -V11,Криптография,V11.1,Инвентаризация и документирование криптографии,V11.1.2,"Убедитесь, что проводится инвентаризация криптографических средств, которая непрерывно поддерживается, регулярно обновляется и включает все криптографические ключи, алгоритмы и сертификаты, используемые в приложении. Также должна быть задокументирована информация о том, где ключи могут и не могут использоваться в системе, а также какие типы данных могут и не могут быть защищены с помощью этих ключей.",,✓,✓,, -V11,Криптография,V11.1,Инвентаризация и документирование криптографии,V11.1.3,"Убедитесь, что используются механизмы обнаружения криптографии для идентификации всех случаев применения криптографии в системе , включая операции шифрования, хеширования и цифровой подписи.",,,✓,, -V11,Криптография,V11.1,Инвентаризация и документирование криптографии,V11.1.4,"Убедитесь, что ведётся и поддерживается инвентаризация криптографических средств. В неё должен входить документированный план, описывающий переход на новые криптографические стандарты, такие как постквантовая криптография, чтобы своевременно реагировать на будущие угрозы.",,,✓,, -V11,Криптография,V11.2,Безопасная реализация криптографии,V11.2.1,"Убедитесь, что для криптографических операций используются утвержденные в индустрии реализации (включая библиотеки и аппаратные реализации).",,✓,✓,, -V11,Криптография,V11.2,Безопасная реализация криптографии,V11.2.2,"Убедитесь, что архитектура приложения поддерживает быструю реконфигурацию, усовершенствование или смену в любой момент случайных чисел, аутентифицированного шифрования, MAC, алгоритмов хеширования, длин ключей, количества раундов, шифров и режимов шифрования для защиты от криптографических атак. Также должна поддерживаться возможность смены ключей, паролей и повторного шифрования данных. Это позволит беспрепятственно перейти на постквантовую криптографию (PQC), как только станут широко доступны высоконадёжные реализации одобренных схем или стандартов PQC.",,✓,✓,, -V11,Криптография,V11.2,Безопасная реализация криптографии,V11.2.3,"Убедитесь, что все криптографические примитивы используют как минимум 128-бит стойкости с учетом алгоритма, размера ключа и конфигурации. Например, 256-битный ECC ключ обеспечивает примерно 128 бит безопасности, тогда как для достижения того же уровня безопасности в RSA требуется ключ длиной 3072 бита.",,✓,✓,, -V11,Криптография,V11.2,Безопасная реализация криптографии,V11.2.4,"Убедитесь, что все криптографические операции выполняются за константное время, без использования «short-circuit» операций в сравнениях, вычислениях, возвратах функций для избежания утечек информации.",,,✓,, -V11,Криптография,V11.2,Безопасная реализация криптографии,V11.2.5,"Убедитесь, что все криптографические модули обеспечивают безопасное завершение работы при ошибках, а обработка ошибок реализована таким образом, чтобы не создавать уязвимостей, например, таких как атаки Padding Oracle.",,,✓,, -V11,Криптография,V11.3,Алгоритмы шифрования,V11.3.1,"Убедитесь, что не используются небезопасные режимы блочного шифрования (н-р, ECB) и слабые схемы дополнения (padding) (н-р, PKCS#1 v1.5).",✓,✓,✓,, -V11,Криптография,V11.3,Алгоритмы шифрования,V11.3.2,"Убедитесь, что используются только утверждённые шифры и режимы, такие как AES с GCM.",✓,✓,✓,, -V11,Криптография,V11.3,Алгоритмы шифрования,V11.3.3,"Убедитесь, что зашифрованные данные защищены от несанкционированного изменения, предпочтительно с использованием утверждённого метода аутентифицированного шифрования или путём комбинирования утверждённого метода шифрования с утверждённым алгоритмом MAC.",,✓,✓,, -V11,Криптография,V11.3,Алгоритмы шифрования,V11.3.4,"Убедитесь, что случайные числа (nonce), векторы инициализации (IV) и другие одноразовые числа не используются более одного раза для одной и той же пары ключа шифрования и элемента данных. Метод их генерации должен соответствовать требованиям используемого алгоритма.",,,✓,, -V11,Криптография,V11.3,Алгоритмы шифрования,V11.3.5,"Убедитесь, что любая комбинация алгоритма шифрования и алгоритма MAC работает в режиме encrypt-then-MAC (EtM).",,,✓,, -V11,Криптография,V11.4,Хеширование и функции на основе хеширования,V11.4.1,"Убедитесь, что только утвержденные хэш-функции используются для стандартных сценариев использования в криптографии, включая цифровую подпись, HMAC, KDF, генерацию случайных чисел. Запрещено использовать неустойчивые хэш-функции, (н-р, MD5) для любого использования в криптографии.",✓,✓,✓,, -V11,Криптография,V11.4,Хеширование и функции на основе хеширования,V11.4.2,"Убедитесь, что пароли хранятся с использованием утверждённой, вычислительно затратной функции генерации ключа (также известной как «функция хеширования паролей»), с параметрами, настроенными в соответствии с актуальными рекомендациями. Настройки должны обеспечивать баланс между безопасностью и производительностью, чтобы сделать атаки перебором достаточно сложными для требуемого уровня безопасности.",,✓,✓,, -V11,Криптография,V11.4,Хеширование и функции на основе хеширования,V11.4.3,"Убедитесь, что хэш-функции, используемые в формировании цифровой подписи, как часть аутентификации и целостности данных, устойчивы к коллизиям и имеют достаточную длину.",,✓,✓,, -V11,Криптография,V11.4,Хеширование и функции на основе хеширования,V11.4.4,"Убедитесь, что приложение использует утвержденную функцию генерации ключа с использованием параметров расширения ключа (key stretching) при генерации ключа из пароля. Параметры должны быть сбалансированы с точки зрения безопасности, производительности и устойчивости к атакам полного перебора при компрометации результирующего криптографического ключа.",,✓,✓,, -V11,Криптография,V11.5,Случайные значения,V11.5.1,"Убедитесь, что все случайные числа и строки, которые должны быть непредсказуемы, должны быть сгенерированы с помощью CSPRNG и иметь хотя бы 128 бит энтропии. Учтите, что UUID не удовлетворяют данному условию.",,✓,✓,, -V11,Криптография,V11.5,Случайные значения,V11.5.2,"Убедитесь, что механизм генерации случайных чисел является надежным даже при высокой нагрузке.",,,✓,, -V11,Криптография,V11.6,Криптография с публичным ключом,V11.6.1,"Убедитесь, что только утвержденные криптографические алгоритмы и режимы операций используются для генерации ключа и инициализации случайного значения для его генерации (seeding), а также для генерации цифровой подписи и верификации. Алгоритмы генерации ключей не должны генерировать небезопасные ключи уязвимые к известным атакам, например, ключи RSA уязвимы к факторизации Ферма.",,✓,✓,, -V11,Криптография,V11.6,Криптография с публичным ключом,V11.6.2,"Убедитесь, что для обмена ключами используются утверждённые криптографические алгоритмы (например, Диффи-Хеллман) с особым вниманием к обеспечению использования безопасных параметров. Это предотвратит атаки на процесс установления ключа, которые могут привести к атакам «человек посередине» или криптографическим взломам.",,,✓,, -V11,Криптография,V11.7,Шифрование данных в процессе использования,V11.7.1,"Убедитесь, что используется полное шифрование памяти, которое защищает конфиденциальные данные во время их использования, предотвращая доступ к ним неавторизованных пользователей или процессов.",,,✓,, -V11,Криптография,V11.7,Шифрование данных в процессе использования,V11.7.2,"Убедитесь, что минимизация данных обеспечивает раскрытие минимально необходимого объёма данных во время обработки, а также что данные шифруются сразу после использования или как можно скорее.",,,✓,, -V12,Безопасная коммуникация,V12.1,Общие рекомендации по безопасности TLS,V12.1.1,"Убедитесь, что включены только актуальные и рекомендуемые версии протокола TLS, такие как TLS 1.2 и TLS 1.3. Наиболее свежая версия TLS должна быть выбрана как предпочтительная.",✓,✓,✓,, -V12,Безопасная коммуникация,V12.1,Общие рекомендации по безопасности TLS,V12.1.2,"Убедитесь, что включены рекомендуемые шифронаборы (cipher suites), предпочтение также стоит отдать самому сильному шифронабору. L3 приложения должны поддерживать только те наборы шифров (cipher suites), которые обеспечивают прямую (forward) секретность. Пояснение: Прямая секретность (Forward Secrecy, FS) — это криптографическая особенность, при которой сессионные ключи уникальны для каждой сессии и не зависят от долгосрочных ключей. Это гарантирует, что даже при компрометации долгосрочного ключа злоумышленник не сможет расшифровать ранее перехваченные зашифрованные сессии.",,✓,✓,, -V12,Безопасная коммуникация,V12.1,Общие рекомендации по безопасности TLS,V12.1.3,"Убедитесь, что приложение проверяет доверенность клиентских сертификатов mTLS, прежде чем использовать идентификацию по сертификату для аутентификации или авторизации.",,✓,✓,, -V12,Безопасная коммуникация,V12.1,Общие рекомендации по безопасности TLS,V12.1.4,"Убедитесь, что включена и настроена правильная проверка отзыва сертификатов, такая как Online Certificate Status Protocol (OCSP) Stapling.",,,✓,, -V12,Безопасная коммуникация,V12.1,Общие рекомендации по безопасности TLS,V12.1.5,"Убедитесь, что в настройках TLS приложения включена функция Encrypted Client Hello (ECH) для предотвращения раскрытия конфиденциальных метаданных, таких как Server Name Indication (SNI), во время процесса TLS-рукопожатия.",,,✓,, -V12,Безопасная коммуникация,V12.2,HTTPS коммуникация с внешними сервисами,V12.2.1,"Убедитесь, что для всех соединений между клиентом и внешними HTTP-сервисами используется TLS и не происходит отката к небезопасным или незашифрованным протоколам.",✓,✓,✓,, -V12,Безопасная коммуникация,V12.2,HTTPS коммуникация с внешними сервисами,V12.2.2,"Убедитесь, что внешние сервисы используют публично доверенные TLS-сертификаты.",✓,✓,✓,, -V12,Безопасная коммуникация,V12.3,Общая безопасность межсервисного взаимодействия,V12.3.1,"Убедитесь, что для всех входящих и исходящих соединений приложения используется зашифрованный протокол, например TLS, включая системы мониторинга, инструменты управления, удалённый доступ и SSH, промежуточное ПО, базы данных, мейнфреймы, партнёрские системы и внешние API. Сервер не должен допускать откат к небезопасным или незашифрованным протоколам.",,✓,✓,, -V12,Безопасная коммуникация,V12.3,Общая безопасность межсервисного взаимодействия,V12.3.2,"Убедитесь, что TLS-клиент проверяет сертификат сервера до установления защищенного соединения с TLS-сервером.",,✓,✓,, -V12,Безопасная коммуникация,V12.3,Общая безопасность межсервисного взаимодействия,V12.3.3,"Убедитесь, что все внутренние HTTP-взаимодействия между компонентами приложения используют TLS или другой подходящий механизм транспортного шифрования, и не происходит откат к небезопасным или незашифрованным коммуникациям.",,✓,✓,, -V12,Безопасная коммуникация,V12.3,Общая безопасность межсервисного взаимодействия,V12.3.4,"Убедитесь, что TLS-соединения между внутренними сервисами используют доверенные сертификаты. Если используются внутренние или самоподписанные сертификаты, потребляющий сервис должен быть настроен на доверие только к конкретным внутренним центрам сертификации (CA) и конкретным самоподписанным сертификатам.",,✓,✓,, -V12,Безопасная коммуникация,V12.3,Общая безопасность межсервисного взаимодействия,V12.3.5,"Убедитесь, что сервисы, взаимодействующие внутри системы (intra-service communications), используют строгую аутентификацию для проверки каждого конечного узла. Для проверки подлинности взаимодействующих сторон должны применяться методы строгой аутентификации, такие как аутентификация TLS-клиента, с использованием инфраструктуры открытых ключей и механизмов, устойчивых к атакам повтора (replay attacks). Для микросервисных архитектур рекомендуется использование service mesh для упрощения управления сертификатами и повышения безопасности.",,,✓,, -V13,Конфигурация,V13.1,Документация конфигурации,V13.1.1,"Убедитесь, что все необходимые доступы приложения задокументированы. Сюда должны быть включены как внешние сервисы, от которых зависит приложение, так и сценарии, когда конечный пользователь может задавать адреса для внешнего подключения.",,✓,✓,, -V13,Конфигурация,V13.1,Документация конфигурации,V13.1.2,"Убедитесь, что для каждого сервиса, используемого приложением, в документации определено максимальное количество одновременных соединений (например, лимиты пула соединений) и описано поведение приложения при достижении этого лимита, включая любые механизмы отказоустойчивости или восстановления, чтобы предотвратить ситуации отказа в обслуживании (DoS).",,,✓,, -V13,Конфигурация,V13.1,Документация конфигурации,V13.1.3,"Убедитесь, что в документации приложения определены стратегии управления ресурсами для каждой внешней системы или сервиса, которые оно использует (например, базы данных, файловые дескрипторы, потоки, HTTP-соединения). Стратегии должны включать процедуры освобождения ресурсов, настройки таймаутов, обработку сбоев, а также, если реализована логика повторных попыток, указание лимитов, задержек и алгоритмов back-off. Для синхронных HTTP-запросов должны быть заданы короткие таймауты, а повторные запросы должны быть отключены, либо строго ограничены по числу попыток, чтобы предотвратить каскадные задержки и истощение ресурсов.",,,✓,, -V13,Конфигурация,V13.1,Документация конфигурации,V13.1.4,"Убедитесь, что в документации приложения определены секреты, критически важные для безопасности приложения, а также установлен график их ротации в соответствии с моделью угроз организации и её бизнес-требованиями.",,,✓,, -V13,Конфигурация,V13.2,Конфигурация бэкенд соединений,V13.2.1,"Убедитесь, что коммуникации между компонентами бэкенда приложения (включая API, промежуточное ПО и уровни данных), которые не поддерживают стандартный механизм пользовательских сессий, проходят с аутентификацией. Аутентификация должна использовать индивидуальные сервисные аккаунты, краткосрочные токены или аутентификацию на основе сертификатов, а не постоянные учётные данные, такие как пароли, API-ключи или общие аккаунты с привилегированным доступом.",,✓,✓,, -V13,Конфигурация,V13.2,Конфигурация бэкенд соединений,V13.2.2,"Убедитесь, что коммуникации между компонентами бэкенда приложения, включая локальные или системные службы, API, промежуточное ПО и уровни данных, выполняются с использованием аккаунтов, которым назначены минимально необходимые привилегии.",,✓,✓,, -V13,Конфигурация,V13.2,Конфигурация бэкенд соединений,V13.2.3,"Убедитесь, что если для аутентификации в сервисе используются учётные данные, то используемые потребителем учётные данные не являются стандартными (например, root/root или admin/admin).",,✓,✓,, -V13,Конфигурация,V13.2,Конфигурация бэкенд соединений,V13.2.4,"Убедитесь, что используется белый список (allowlist) для определения внешних ресурсов или систем, с которыми приложению разрешено взаимодействовать (например, для исходящих запросов, загрузки данных или доступа к файлам). Этот белый список может быть реализован на уровне приложения, веб-сервера, межсетевого экрана или комбинации различных уровней.",,✓,✓,, -V13,Конфигурация,V13.2,Конфигурация бэкенд соединений,V13.2.5,"Убедитесь, что веб- или прикладной сервер настроен с белым списком ресурсов или систем, к которым сервер может отправлять запросы или из которых может загружать данные и файлы.",,✓,✓,, -V13,Конфигурация,V13.2,Конфигурация бэкенд соединений,V13.2.6,"Убедитесь, что при подключении приложения к другим сервисам соблюдается задокументированная конфигурация для каждого соединения, включая максимальное количество параллельных соединений, поведение при достижении их максимума, таймауты и стратегии повторных попыток подключения.",,,✓,, -V13,Конфигурация,V13.3,Управление секретами,V13.3.1,"Убедитесь, что для безопасного создания, хранения, контроля доступа и уничтожения секретов бэкенда используется решение для управления секретами, например, хранилище ключей (key vault). Секретами могут быть пароли, ключевой материал, интеграции с базами данных и сторонними системами, ключи и seed-значения для токенов с ограниченным временем действия, другие внутренние секреты и API-ключи. Секреты не должны включаться в исходный код приложения или артефакты сборки. Для приложений уровня L3 необходимо использовать аппаратное решение, например, аппаратный модуль безопасности (HSM).",,✓,✓,, -V13,Конфигурация,V13.3,Управление секретами,V13.3.2,"Убедитесь, что доступ к секретным ресурсам осуществляется в соответствии с принципом минимально необходимых привилегий (least privilege).",,✓,✓,, -V13,Конфигурация,V13.3,Управление секретами,V13.3.3,"Убедитесь, что все криптографические операции выполняются с использованием изолированного модуля безопасности (например, хранилища ключей или аппаратного модуля безопасности), чтобы надежно управлять ключевым материалом и защищать его от утечки за пределы модуля безопасности.",,,✓,, -V13,Конфигурация,V13.3,Управление секретами,V13.3.4,"Убедитесь, что секреты настроены на срок действия и ротацию в соответствии с документацией приложения.",,,✓,, -V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.1,"Убедитесь, что приложение развернуто либо без метаданных систем контроля версий (включая папки .git или .svn), либо так, чтобы эти папки были недоступны как извне, так и для самого приложения.",✓,✓,✓,, -V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.2,"Убедитесь, что режимы отладки отключены для всех компонентов в промышленной среде, чтобы предотвратить раскрытие функций отладки и утечку информации.",,✓,✓,, -V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.3,"Убедитесь, что веб-серверы не показывают клиентам списки содержимого каталогов, если это явно не предусмотрено.",,✓,✓,, -V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.4,"Убедитесь, что метод HTTP TRACE не поддерживается в продуктовой среде, чтобы избежать потенциальной утечки информации.",,✓,✓,, -V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.5,"Убедитесь, что документация (например, по внутренним API) и мониторинговые эндпоинты не доступны, если это явно не предусмотрено.",,✓,✓,, -V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.6,"Убедитесь, что приложение не раскрывает подробную информацию о версиях компонентов бэкенда.",,,✓,, -V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.7,"Убедитесь, что веб-слой настроен на обслуживание только файлов с определёнными расширениями, чтобы предотвратить непреднамеренную утечку информации, конфигураций и исходного кода.",,,✓,, -V14,Защита информации,V14.1,Документация по защите информации,V14.1.1,"Убедитесь, что все конфиденциальные данные, создаваемые и обрабатываемые приложением, идентифицированы и классифицированы по уровням защиты. Включая закодированные данные, которые легко декодируются, например, строки Base64 или незашифрованные данные в полезной нагрузке JWT. Уровни защиты должны учитывать требования по защите данных и конфиденциальности, которым должно соответствовать приложение.",,✓,✓,, -V14,Защита информации,V14.1,Документация по защите информации,V14.1.2,"Убедитесь, что для каждого уровня защиты конфиденциальных данных требования к защите задокументированы. Они должны включать (но не ограничиваться) требования по шифрованию, проверке целостности, срокам хранения, способам логирования данных, контролю доступа к чувствительным данным в логах, шифрованию на уровне базы данных, применению технологий повышения конфиденциальности, а также другим требованиям по конфиденциальности.",,✓,✓,, -V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.1,"Убедитесь, что конфиденциальные данные передаются на сервер только в теле HTTP-запроса или в заголовках. URL и строка запроса не должны содержать конфиденциальную информацию, такую как API-ключ или сессионный токен.",✓,✓,✓,, -V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.2,"Убедитесь, что приложение предотвращает кэширование конфиденциальных данных в серверных компонентах, таких как балансировщики нагрузки и кэши приложений, либо гарантирует их надежное удаление после использования.",,✓,✓,, -V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.3,"Убедитесь, что заранее определённые конфиденциальные данные не отправляются ненадёжным сторонам (например, системам трекинга пользователей), чтобы предотвратить нежелательный сбор данных вне контроля приложения.",,✓,✓,, -V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.4,"Убедитесь, что для конфиденциальных данных реализованы меры по шифрованию, проверке целостности, срокам хранения, способам логирования, контролю доступа к данным в логах, а также применяются технологии повышения конфиденциальности в соответствии с документацией для соответствующего уровня защиты данных.",,✓,✓,, -V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.5,"Убедитесь, что механизмы кэширования настроены так, чтобы кэшировать только ответы с ожидаемым типом содержимого для данного ресурса и не содержать конфиденциального динамического контента. При обращении к несуществующему файлу, веб-сервер должен возвращать ответ 404 или 302, а не подменять на другой существующий файл, что позволит предотвратить атаки типа Web Cache Deception.",,,✓,, -V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.6,"Убедитесь, что приложение возвращает только минимально необходимый объем конфиденциальных данных для выполнения своей функциональности. Например, показывает только часть цифр номера кредитной карты, а не полный номер. Если требуется отображение полных данных, они должны быть замаскированы в пользовательском интерфейсе, пока пользователь специально не запросил их просмотр.",,,✓,, -V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.7,"Убедитесь, что конфиденциальная информация подлежит классификации по срокам хранения, чтобы устаревшие или ненужные данные удалялись автоматически, по расписанию или по мере необходимости.",,,✓,, -V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.8,"Убедитесь, что конфиденциальная информация удаляется из метаданных файлов, загружаемых пользователями, если пользователь явно не согласился на ее хранение.",,,✓,, -V14,Защита информации,V14.3,Защита данных на стороне клиента,V14.3.1,"Убедитесь, что аутентифицированные данные очищаются из клиентского хранилища, например, из DOM браузера, после завершения работы клиента или сессии. Заголовок HTTP-ответа Clear-Site-Data может помочь в этом, но клиентская сторона также должна уметь очищать данные, если соединение с сервером недоступно при завершении сессии.",✓,✓,✓,, -V14,Защита информации,V14.3,Защита данных на стороне клиента,V14.3.2,"Убедитесь, что приложение устанавливает HTTP-заголовки, достаточные для предотвращения кэширования (например, Cache-Control: no-store), чтобы конфиденциальные данные не сохранялись в браузерах.",,✓,✓,, -V14,Защита информации,V14.3,Защита данных на стороне клиента,V14.3.3,"Убедитесь, что данные, хранящиеся в браузерном хранилище (например, localStorage, sessionStorage, IndexedDB или cookie), не содержат конфиденциальной информации, за исключением сессионных токенов.",,✓,✓,, -V15,Безопасная разработка и архитектура,V15.1,Документация по безопасной разработке и архитектуре,V15.1.1,"Убедитесь, что в документации по приложению определены сроки устранения уязвимостей на основе оценки рисков для внешних зависимостей с уязвимостями и для обновления библиотек в целом, чтобы минимизировать риск, связанный с этими компонентами.",✓,✓,✓,, -V15,Безопасная разработка и архитектура,V15.1,Документация по безопасной разработке и архитектуре,V15.1.2,"Убедитесь, что ведется реестр всех используемых сторонних библиотек (например, Software Bill of Materials, SBOM), с обязательной проверкой, что компоненты получены из предопределенных, доверенных и регулярно поддерживаемых репозиториев.",,✓,✓,, -V15,Безопасная разработка и архитектура,V15.1,Документация по безопасной разработке и архитектуре,V15.1.3,"Убедитесь, что в документации приложения указан функционал, требующий значительных временных или вычислительных ресурсов. Необходимо указать, как предотвратить потерю доступности из-за чрезмерного использования этого функционала и как избежать ситуаций, когда формирование ответа занимает больше времени, чем установленный системой таймаут. Возможные меры защиты могут включать асинхронную обработку, использование очередей и ограничение количества параллельных процессов для каждого пользователя и приложения.",,✓,✓,, -V15,Безопасная разработка и архитектура,V15.1,Документация по безопасной разработке и архитектуре,V15.1.4,"Убедитесь, что в документации приложения указаны внешние библиотеки, которые считаются «компонентами с повышенным риском».",,,✓,, -V15,Безопасная разработка и архитектура,V15.1,Документация по безопасной разработке и архитектуре,V15.1.5,"Убедитесь, что в документации приложения выделены те части приложения, в которых используются «функционал с повышенным риском».",,,✓,, -V15,Безопасная разработка и архитектура,V15.2,Архитектура безопасности и зависимости,V15.2.1,"Убедитесь, что приложение содержит только те компоненты, которые не нарушили задокументированные сроки обновления и исправления.",✓,✓,✓,, -V15,Безопасная разработка и архитектура,V15.2,Архитектура безопасности и зависимости,V15.2.2,"Убедитесь, что в приложении реализованы меры защиты от потери доступности из-за функциональности, требующей много времени или ресурсов, на основе задокументированных решений и стратегий безопасности для этого.",,✓,✓,, -V15,Безопасная разработка и архитектура,V15.2,Архитектура безопасности и зависимости,V15.2.3,"Убедитесь, что производственная среда включает только те функции, которые необходимы для работы приложения, и не предоставляет лишние функции, такие как тестовый код, примеры кода и инструменты разработки.",,✓,✓,, -V15,Безопасная разработка и архитектура,V15.2,Архитектура безопасности и зависимости,V15.2.4,"Убедитесь, что сторонние компоненты и все их транзитивные зависимости загружаются только из ожидаемых репозиториев (внутренних или внешних) и отсутствует риск атаки через подмену зависимостей (dependency confusion attack)",,,✓,, -V15,Безопасная разработка и архитектура,V15.2,Архитектура безопасности и зависимости,V15.2.5,"Убедитесь, что приложение реализует дополнительные меры защиты для тех частей приложения, которые документированы как содержащие «функционал с повышенным риском» или использующие сторонние библиотеки, считающиеся «функционалом с повышенным риском». Это могут быть такие методы, как «песочница», инкапсуляция, контейнеризация или изоляция на сетевом уровне, чтобы задержать и предотвратить продвижение (pivoting) злоумышленников, скомпрометировавших одну часть приложения, к другим частям приложения.",,,✓,, -V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.1,"Убедитесь, что приложение возвращает только необходимое подмножество полей из объекта данных. Например, оно не должно возвращать весь объект данных, поскольку некоторые отдельные поля должны быть недоступны пользователям.",✓,✓,✓,, -V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.2,"Убедитесь, что при вызовах внешних URL-адресов бэкэнд приложения настроен так, чтобы не выполнять перенаправления, если только это не предусмотрено функционалом.",,✓,✓,, -V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.3,"Убедитесь, что в приложении реализованы защитные механизмы против атак типа массового присвоения (mass assignment) путем строгого ограничения разрешенных полей для каждого контроллера и действия, исключая возможность добавления или изменения значений полей, которые не должны быть доступны для данной конкретной операции.",,✓,✓,, -V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.4,"Убедитесь, что все прокси и промежуточное ПО корректно передают исходный IP-адрес пользователя, используя доверенные поля данных, которые не могут быть изменены конечным пользователем, а приложение и веб-сервер используют это правильное значение для ведения логирования и принятия решений по безопасности, таких как ограничение запросов. При этом следует учитывать, что даже исходный IP-адрес может быть ненадежным из-за динамических IP-адресов, VPN или корпоративных файрволов.",,✓,✓,, -V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.5,"Убедитесь, что приложение явно проверяет соответствие переменных ожидаемому типу данных и использует строгие операции сравнения. Это необходимо для предотвращения уязвимостей, связанных с type juggling и type confusion, вызванных тем, что код приложения делает предположения о типе переменной.",,✓,✓,, -V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.6,"Убедитесь, что JavaScript-код написан таким образом, чтобы предотвратить prototype pollution, например, используя Set() или Map() вместо обычных литералов объекта.",,✓,✓,, -V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.7,"Убедитесь, что приложение защищено от атак типа HTTP Parameter Pollution (HPP), особенно если используемый фреймворк не различает источники параметров запроса (строка запроса, тело запроса, куки или заголовки).",,✓,✓,, -V15,Безопасная разработка и архитектура,V15.4,Безопасная работа с параллельными процессами,V15.4.1,"Убедитесь, что к общим объектам в многопоточном коде (например, кэшам, файлам или объектам в памяти, используемым несколькими потоками) используется безопасный многопоточный доступ и механизмов синхронизации, таких как блокировки или семафоры, чтобы избежать состояний гонки и повреждения данных.",,,✓,, -V15,Безопасная разработка и архитектура,V15.4,Безопасная работа с параллельными процессами,V15.4.2,"Убедитесь, что проверки состояния ресурса, например его существования или разрешений, а также зависящие от него действия выполняются как одна атомарная операция, чтобы предотвратить условия гонки времени проверки и времени использования (TOCTOU). Например, проверка существования файла перед его открытием или проверка прав доступа пользователя перед его предоставлением.",,,✓,, -V15,Безопасная разработка и архитектура,V15.4,Безопасная работа с параллельными процессами,V15.4.3,"Убедитесь, что блокировки применяются согласованно, чтобы предотвратить взаимные блокировки потоков (deadlocks) или их бесконечные повторы, а также что логика блокировки инкапсулирована в коде, отвечающем за управление ресурсом. Это гарантирует, что блокировки не могут быть случайно или намеренно изменены внешними классами или кодом.",,,✓,, -V15,Безопасная разработка и архитектура,V15.4,Безопасная работа с параллельными процессами,V15.4.4,"Убедитесь, что политики распределения ресурсов предотвращают нехватку ресурсов у потоков, обеспечивая справедливый доступ к ресурсам, например, используя пулы потоков, позволяя потокам с более низким приоритетом выполняться в течение разумного периода времени.",,,✓,, -V16,Журналирование событий безопасности и обработка ошибок,V16.1,Документация по ведению логов,V16.1.1,"Убедитесь в существовании реестра, в котором документируется ведение журнала на каждом уровне технологического стека приложения, включая какие события регистрируются, форматы логов, где хранятся эти журналы, как они используются, как контролируется доступ к ним и как долго хранятся журналы.",,✓,✓,, -V16,Журналирование событий безопасности и обработка ошибок,V16.2,Общее журналирование,V16.2.1,"Убедитесь, что каждая запись журнала содержит необходимые метаданные (например, когда, где, кто, что), которые позволят провести подробное исследование временной шкалы, когда произошло событие.",,✓,✓,, -V16,Журналирование событий безопасности и обработка ошибок,V16.2,Общее журналирование,V16.2.2,"Убедитесь, что все источники времени компонентов системы журналирования синхронизированы, а временные метки в метаданных событий безопасности используют UTC или содержат явное указание смещения часового пояса. Рекомендуется применять UTC для обеспечения согласованности в распределённых системах и предотвращения ошибок при переходе на летнее/зимнее время.",,✓,✓,, -V16,Журналирование событий безопасности и обработка ошибок,V16.2,Общее журналирование,V16.2.3,"Убедитесь, что приложение записывает и передаёт логи исключительно в те файлы и сервисы, которые указаны в реестре журналирования.",,✓,✓,, -V16,Журналирование событий безопасности и обработка ошибок,V16.2,Общее журналирование,V16.2.4,"Убедитесь, что логи могут быть прочитаны и коррелированы используемой системой обработки журналов, предпочтительно с использованием общего стандартного формата логирования.",,✓,✓,, -V16,Журналирование событий безопасности и обработка ошибок,V16.2,Общее журналирование,V16.2.5,"Убедитесь, что приложение применяет соответствующие меры защиты при логировании конфиденциальных данных в зависимости от уровня их чувствительности: например, полностью запрещает запись в логи таких данных, как учетные данные или платежные реквизиты, а для других данных (например, сессионных токенов) использует хеширование или частичное/полное маскирование.",,✓,✓,, -V16,Журналирование событий безопасности и обработка ошибок,V16.3,Инциденты безопасности,V16.3.1,"Убедитесь, что все операции аутентификации регистрируются, включая успешные и неудачные попытки. Также следует фиксировать дополнительные метаданные, такие как тип аутентификации или использованные факторы проверки.",,✓,✓,, -V16,Журналирование событий безопасности и обработка ошибок,V16.3,Инциденты безопасности,V16.3.2,"Убедитесь, что ведется журнал неудачных попыток авторизации. Для уровня L3 это должно включать в себя журналирование всех решений об авторизации, включая журналирование доступа к конфиденциальным данным (без регистрации самих конфиденциальных данных).",,✓,✓,, -V16,Журналирование событий безопасности и обработка ошибок,V16.3,Инциденты безопасности,V16.3.3,"Убедитесь, что приложение регистрирует все события безопасности, определенные в документации, а также фиксирует попытки обхода механизмов защиты, включая проверку входных данных, бизнес-логики и системы защиты от автоматизированных атак.",,✓,✓,, -V16,Журналирование событий безопасности и обработка ошибок,V16.3,Инциденты безопасности,V16.3.4,"Убедитесь, что приложение регистрирует в журналах неожиданные ошибки и сбои механизмов безопасности, включая, например, ошибки TLS-соединения на стороне сервера.",,✓,✓,, -V16,Журналирование событий безопасности и обработка ошибок,V16.4,Защита журналов,V16.4.1,"Убедитесь, что все компоненты системы логирования корректно кодируют данные, чтобы предотвратить атаки типа внедрения в журналы (log injection).",,✓,✓,, -V16,Журналирование событий безопасности и обработка ошибок,V16.4,Защита журналов,V16.4.2,"Убедитесь, что логи защищены от неавторизованного доступа и не могут быть модифицированы.",,✓,✓,, -V16,Журналирование событий безопасности и обработка ошибок,V16.4,Защита журналов,V16.4.3,"Убедитесь, что логи безопасно передаются в логически изолированную систему для анализа, обнаружения угроз, генерации оповещений и эскалации инцидентов. Это гарантирует сохранность журналов даже в случае компрометации основного приложения.",,✓,✓,, -V16,Журналирование событий безопасности и обработка ошибок,V16.5,Обработка ошибок,V16.5.1,"Убедитесь, что при возникновении непредвиденной или связанной с безопасностью ошибки пользователю возвращается только общее сообщение, гарантируя отсутствие раскрытия конфиденциальных внутренних данных системы, таких как трассировки стека, запросы, секретные ключи и токены.",,✓,✓,, -V16,Журналирование событий безопасности и обработка ошибок,V16.5,Обработка ошибок,V16.5.2,"Убедитесь, что приложение продолжает работать в безопасном режиме при недоступности внешних ресурсов, используя такие механизмы, как автоматические выключатели (circuit breakers) или плавное снижение функциональности (graceful degradation).",,✓,✓,, -V16,Журналирование событий безопасности и обработка ошибок,V16.5,Обработка ошибок,V16.5.3,"Убедитесь, что приложение корректно и безопасно завершает работу при возникновении исключений, предотвращая опасные сценарии по типу «fail-open», когда, например, транзакция ошибочно выполняется, несмотря на ошибки в логике валидации.",,✓,✓,, -V16,Журналирование событий безопасности и обработка ошибок,V16.5,Обработка ошибок,V16.5.4,"Убедитесь, что определён обработчик ошибок «крайние меры», который будет перехватывать все необработанные ошибки. Это необходимо как для предотвращения потери информации об ошибках, которая должна быть записана в файлы журналов, так и для того, чтобы ошибка не остановила весь процесс приложения, что привело бы к потере доступности.",,,✓,, -V17,WebRTC,V17.1,TURN-сервер,V17.1.1,"Убедитесь, что сервис TURN (Traversal Using Relays around NAT) разрешает доступ только к IP-адресам, не зарезервированным для специальных целей (например, внутренние сети, широковещательная рассылка, loopback-адреса). Данное требование применяется как к IPv4, так и к IPv6 адресам.",,✓,✓,, -V17,WebRTC,V17.1,TURN-сервер,V17.1.2,"Убедитесь, что сервис TURN (Traversal Using Relays around NAT) защищен от исчерпания ресурсов при попытках легитимных пользователей открыть чрезмерное количество портов на сервере.",,,✓,, -V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.1,"Убедитесь, что ключ сертификата Datagram Transport Layer Security (DTLS) управляется и защищается в соответствии с документированной политикой управления криптографическими ключами.",,✓,✓,, -V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.2,"Убедитесь, что медиасервер настроен на использование только одобренных наборов шифров Datagram Transport Layer Security (DTLS) и защищенного профиля безопасности для расширения DTLS, применяемого при установке ключей для Secure Real-time Transport Protocol (DTLS-SRTP).",,✓,✓,, -V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.3,"Убедитесь, что медиасервер проверяет аутентификацию Secure Real-time Transport Protocol (SRTP) для предотвращения атак с внедрением Real-time Transport Protocol (RTP), которые могут привести к отказу в обслуживании (Denial of Service) или вставке поддельного аудио-/видеоконтента в медиапотоки.",,✓,✓,, -V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.4,"Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика при получении некорректных пакетов Secure Real-time Transport Protocol (SRTP).",,✓,✓,, -V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.5,"Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетами Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.",,,✓,, -V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.6,"Убедитесь, что медиасервер не подвержен уязвимости «Гонка ClientHello» (ClientHello Race Condition) в Datagram Transport Layer Security (DTLS), проверив наличие известных уязвимостей в публичных источниках или выполнив тестирование на воспроизведение условий гонки.",,,✓,, -V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.7,"Убедитесь, что механизмы аудио- и видеозаписи, связанные с медиасервером, способны продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетов Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.",,,✓,, -V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.8,"Убедитесь, что сертификат Datagram Transport Layer Security (DTLS) проверяется на соответствие атрибуту отпечатка (fingerprint) в Session Description Protocol (SDP), с немедленным прекращением медиапотока в случае несоответствия — это гарантирует подлинность передаваемых данных.",,,✓,, -V17,WebRTC,V17.3,Сигнализация,V17.3.1,"Убедитесь, что сигнальный сервер способен продолжать обработку легитимных входящих сообщений сигнализации даже в условиях флуд-атаки. Для этого необходимо реализовать механизм ограничения частоты запросов (rate limiting) на уровне сигнализации.",,✓,✓,, -V17,WebRTC,V17.3,Сигнализация,V17.3.2,"Убедитесь, что сигнальный сервер способен продолжать обработку легитимных сообщений сигнализации даже при получении некорректных сообщений, которые могут вызвать отказ в обслуживании (Denial of Service, DoS). Для этого необходимо реализовать: проверку входных данных (input validation), безопасную обработку целочисленных переполнений (integer overflows), защиту от переполнения буферов (buffer overflows) и другие надежные методы обработки ошибок.",,✓,✓,, - diff --git a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.json b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.json deleted file mode 100644 index 8c9bf3051f..0000000000 --- a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.json +++ /dev/null @@ -1,7259 +0,0 @@ -{ - "Name": "Application Security Verification Standard Project", - "ShortName": "ASVS", - "Version": "", - "Description": "The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.", - "Requirements": [ - { - "Shortcode": "V1", - "Ordinal": 1, - "ShortName": "Encoding", - "Name": "Кодировка и нейтрализация", - "Items": [ - { - "Shortcode": "V1.1", - "Ordinal": 1, - "Name": "Архитектура кодировки и нейтрализации", - "Items": [ - { - "Shortcode": "V1.1.1", - "Ordinal": 1, - "Description": "Убедитесь, что входные данные декодируются или деэкранируются в каноническую форму (в стандартное представление) только один раз. Декодирование происходит только тогда, когда ожидаются закодированные данные в этой форме, и что это делается перед дальнейшей обработкой входных данных, например, это не выполняется после проверки или нейтрализации.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.1.2", - "Ordinal": 2, - "Description": "Убедитесь, что приложение выполняет кодирование и экранирование выходных данных либо в качестве последнего шага перед использованием интерпретатором, для которого оно предназначено, либо самим интерпретатором.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V1.2", - "Ordinal": 2, - "Name": "Предотвращение инъекций", - "Items": [ - { - "Shortcode": "V1.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что выходная кодировка для ответа HTTP, документа HTML или документа XML соответствует требуемому контексту, например, кодировка соответствующих символов для элементов HTML, атрибутов HTML, комментариев HTML, CSS или полей заголовка HTTP делается таким способом, чтобы избежать изменения структуры сообщения или документа.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что при динамическом построении URL-адресов недоверенные данные кодируются в соответствии с их контекстом (например, кодирование URL-адресов или кодирование base64url для query или path параметров или пути). Убедитесь, что разрешены только безопасные протоколы URL-адресов (например, запрещен javascript: или data:).", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.2.3", - "Ordinal": 3, - "Description": "Убедитесь, что при динамическом построении содержимого JavaScript (включая JSON) используется кодирование или экранирование выходных данных, чтобы избежать изменения структуры сообщения или документа (чтобы избежать JavaScript и JSON-инъекций).", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.2.4", - "Ordinal": 4, - "Description": "Убедитесь, что выборка данных (Redis, Memcached, чтение из файлов, обращение по API) или запросы к базе данных (например, SQL, HQL, NoSQL, Cypher) используют параметризованные запросы, ORM, Entity Frameworks или иным образом защищены от SQL-инъекций и других атак. Это также актуально при написании хранимых процедур.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.2.5", - "Ordinal": 5, - "Description": "Убедитесь, что приложение защищено от внедрения команд ОС и что вызовы операционной системы используют параметризованные запросы к ОС или используют контекстное кодирование вывода командной строки.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.2.6", - "Ordinal": 6, - "Description": "Убедитесь, что приложение защищено от LDAP-инъекций, или что реализованы специальные меры безопасности для их предотвращения.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.2.7", - "Ordinal": 7, - "Description": "Убедитесь, что приложение защищено от атак с использованием XPath-инъекций с помощью параметризации запросов или предварительно скомпилированных запросов.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.2.8", - "Ordinal": 8, - "Description": "Убедитесь, что процессоры LaTeX настроены безопасно (например, не используется флаг «–shell‑escape») и используется разрешенный список команд для предотвращения LaTeX-инъекций.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.2.9", - "Ordinal": 9, - "Description": "Убедитесь, что приложение экранирует специальные символы в регулярных выражениях (обычно с помощью обратной косой черты), чтобы предотвратить их ошибочную интерпретацию как метасимволов.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.2.10", - "Ordinal": 10, - "Description": "Убедитесь, что приложение защищено от внедрения формул CSV (CSV Injection). Приложение должно следовать правилам экранирования, определенным в RFC 4180, разделы 2.6 и 2.7, при экспорте содержимого CSV. Кроме того, при экспорте в CSV или другие форматы электронных таблиц (такие как XLS, XLSX или ODF) специальные символы (включая '=', '+', '-', '@', '\\t' (табуляция), и '\\0' (нулевой символ)) должны экранироваться одинарной кавычкой, если они появляются в качестве первого символа в значении поля.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V1.3", - "Ordinal": 3, - "Name": "Нейтрализация", - "Items": [ - { - "Shortcode": "V1.3.1", - "Ordinal": 1, - "Description": "Убедитесь, что все ненадежные входные данные HTML из редакторов WYSIWYG или аналогичных программ нейтрализуются с помощью известных и безопасных библиотек или функций фреймворка для санитизации HTML.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.2", - "Ordinal": 2, - "Description": "Убедитесь, что приложение избегает использования eval() или других динамических функций выполнения кода, таких как Spring Expression Language (SpEL). Если нет альтернативы, любой пользовательский ввод должен быть нейтрализован перед выполнением.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.3", - "Ordinal": 3, - "Description": "Убедитесь, что данные, передаваемые в потенциально опасный контекст, предварительно нейтрализованы, чтобы обеспечить соблюдение мер безопасности, таких как разрешение только тех символов, которые безопасны для данного контекста, и обрезка слишком длинного ввода.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.4", - "Ordinal": 4, - "Description": "Убедитесь, что предоставленный пользователем файл .SVG проверен или нейтрализован, чтобы он содержал только теги и атрибуты (например, относящиеся к рисованию), которые безопасны для приложения, например, не содержат скриптов и foreignObject.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.5", - "Ordinal": 5, - "Description": "Убедитесь, что приложение нейтралует или отключает предоставленные пользователем скриптовые данные или выражения шаблонных языков, такие как таблицы стилей Markdown, CSS или XSL, BBCode или аналогичные.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.6", - "Ordinal": 6, - "Description": "Убедитесь, что приложение защищено от атак с подделкой запросов на стороне сервера (SSRF), проверяя ненадежные данные по разрешенному списку протоколов, доменов, путей и портов, а также нейтрализуя потенциально опасные символы перед использованием данных для вызова другой службы.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.7", - "Ordinal": 7, - "Description": "Убедитесь, что приложение защищено от атак с внедрением шаблонов (template injection), не позволяя создавать шаблоны на основе недоверенных входных данных. Если нет альтернативы, любые недоверенные входные данные, включаемые динамически во время создания шаблона, должны быть нейтрализованы или тщательно провалидированы.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.8", - "Ordinal": 8, - "Description": "Убедитесь, что приложение надлежащим образом нейтрализует недоверенные входные данные перед использованием в запросах Java Naming and Directory Interface (JNDI) и что JNDI настроен безопасно для предотвращения атак с использованием JNDI-инъекций.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.9", - "Ordinal": 9, - "Description": "Убедитесь, что приложение нейтрализует данные перед отправкой в Memcache, чтобы предотвратить атаки методом инъекций.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.10", - "Ordinal": 10, - "Description": "Убедитесь, что строки форматирования, которые могут быть использованы неожидаемым или вредоносным образом, нейтрализуются перед дальнейшим использованием.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.11", - "Ordinal": 11, - "Description": "Убедитесь, что приложение нейтрализует вводимые пользователем данные перед передачей в почтовые системы для защиты от SMTP или IMAP-инъекций.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.12", - "Ordinal": 12, - "Description": "Убедитесь, что регулярные выражения не содержат элементов, вызывающих экспоненциальный возврат, и убедитесь в нейтрализации недоверенных входных данных для предотвращения атак ReDoS или Runaway Regex.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V1.4", - "Ordinal": 4, - "Name": "Память, строки и неуправляемый код", - "Items": [ - { - "Shortcode": "V1.4.1", - "Ordinal": 1, - "Description": "Убедитесь, что для обнаружения или предотвращения ситуаций переполнения стека, буфера или кучи приложение учитывает размер доступной области памяти при строковых операциях, копировании в память, в арифметике указателей и т.п.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.4.2", - "Ordinal": 2, - "Description": "Убедитесь, что для предотвращения целочисленного переполнения применяется контроль знака, диапазона и типа допустимых входных данных.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.4.3", - "Ordinal": 3, - "Description": "Убедитесь, что динамически выделенная память и ресурсы освобождены, а ссылки или указатели на освобожденную память удалены или установлены в значение null, чтобы предотвратить появление висячих указателей и уязвимостей, связанных с использованием памяти после освобождения.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V1.5", - "Ordinal": 5, - "Name": "Безопасная десериализация", - "Items": [ - { - "Shortcode": "V1.5.1", - "Ordinal": 1, - "Description": "Убедитесь, что приложение настраивает XML-парсеры на использование строгой конфигурации и что небезопасные функции, такие как разрешение внешних сущностей, отключены для предотвращения атак XML eXternal Entity (XXE).", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.5.2", - "Ordinal": 2, - "Description": "Убедитесь, что десериализация недоверенных данных обеспечивает безопасную обработку ввода, например, используя список разрешенных типов объектов или ограничивая типы объектов, определяемые клиентом, для предотвращения атак десериализации. Механизмы десериализации, которые явно определены как небезопасные, не должны использоваться с недоверенным вводом.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.5.3", - "Ordinal": 3, - "Description": "Убедитесь, что различные парсеры, используемые в приложении для одного и того же типа данных (например, парсеры JSON, XML, URL), выполняют парсинг согласованным образом и используют один и тот же механизм кодирования символов, чтобы избежать таких проблем, как уязвимости взаимодействия JSON (JSON Interoperability) или различное поведение анализа URI или файлов, которые могут использоваться в атаках удаленного включения файлов (RFI) или подделки запросов на стороне сервера (SSRF).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V2", - "Ordinal": 2, - "ShortName": "Validation", - "Name": "Валидация и бизнес-логика", - "Items": [ - { - "Shortcode": "V2.1", - "Ordinal": 1, - "Name": "Документация валидации и бизнес-логики", - "Items": [ - { - "Shortcode": "V2.1.1", - "Ordinal": 1, - "Description": "Убедитесь, что в документации приложения определены правила проверки входных данных на соответствие ожидаемой структуре. Это могут быть распространённые форматы данных, такие как номера кредитных карт, адреса электронной почты, номера телефонов, или внутренний формат данных.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V2.1.2", - "Ordinal": 2, - "Description": "Убедитесь, что в документации приложения указано, как проверять логическую и контекстную согласованность объединенных данных, например, проверять соответствие района и почтового индекса.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V2.1.3", - "Ordinal": 3, - "Description": "Убедитесь, что ожидания относительно ограничений и проверок бизнес-логики задокументированы как для уровня отдельного пользователя, так и для глобального уровня всего приложения.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V2.2", - "Ordinal": 2, - "Name": "Валидация ввода", - "Items": [ - { - "Shortcode": "V2.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что входные данные провалидированы для обеспечения соответствия бизнес- или функциональным ожиданиям. Валидация должна осуществляться либо по списку допустимых значений, шаблонов и диапазонов, либо путем сравнения входных данных с ожидаемой структурой и логическими ограничениями в соответствии с предопределенными правилами. Для L1 валидация может быть сосредоточена на входных данных, используемых для принятия конкретных бизнес-решений или решений, связанных с безопасностью. Для L2 и выше это должно применяться ко всем входным данным.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V2.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что приложение разработано с принудительной валидацией входных данных на уровне доверенного сервиса. Хотя проверка на стороне клиента повышает удобство использования и должна поощряться, на неё не следует полагаться как на средство контроля безопасности.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V2.2.3", - "Ordinal": 3, - "Description": "Убедитесь, что приложение обеспечивает обоснованность комбинаций данных в соответствии с предопределенными правилам. Например: возраст должен соответствовать дате рождения; страна и почтовый индекс; количество товара в заказе и на складе.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V2.3", - "Ordinal": 3, - "Name": "Безопасность бизнес-логики", - "Items": [ - { - "Shortcode": "V2.3.1", - "Ordinal": 1, - "Description": "Убедитесь, что приложение обрабатывает потоки бизнес-логики для одного и того же пользователя в ожидаемом последовательном порядке шагов и без пропуска шагов.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V2.3.2", - "Ordinal": 2, - "Description": "Убедитесь, что ограничения бизнес-логики реализованы в соответствии с документацией приложения, чтобы избежать эксплуатации её недостатков.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V2.3.3", - "Ordinal": 3, - "Description": "Убедитесь, что транзакции используются на уровне бизнес-логики таким образом, что операция бизнес-логики либо выполняется полностью, либо откатывается к предыдущему корректному состоянию.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V2.3.4", - "Ordinal": 4, - "Description": "Убедитесь, что на уровне бизнес-логики используются механизмы блокировки, чтобы гарантировать невозможность двойного бронирования ограниченных по количеству ресурсов (например, мест в театре или слотов доставки) путем манипулирования логикой приложения.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V2.3.5", - "Ordinal": 5, - "Description": "Убедитесь, что для важных потоков бизнес-логики требуется многопользовательское (multi-user) одобрение, чтобы предотвратить несанкционированные или случайные действия. Потоки бизнес-логики могут включать, помимо прочего, крупные денежные переводы, утверждение контрактов, доступ к секретной информации или обход ограничений безопасности на производстве.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V2.4", - "Ordinal": 4, - "Name": "Анти-автоматизация", - "Items": [ - { - "Shortcode": "V2.4.1", - "Ordinal": 1, - "Description": "Убедитесь, что используются средства противодействия автоматизации для защиты от чрезмерных вызовов функций приложения, которые могут привести к утечке данных, созданию ненужных данных, исчерпанию квот, нарушению ограничений скорости, отказу в обслуживании или чрезмерному использованию дорогостоящих ресурсов.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V2.4.2", - "Ordinal": 2, - "Description": "Убедитесь, что потоки бизнес-логики требуют реалистичного человеческого времени, предотвращая чрезмерно быструю отправку транзакций.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V3", - "Ordinal": 3, - "ShortName": "Web", - "Name": "Безопасность веб-интерфейса", - "Items": [ - { - "Shortcode": "V3.1", - "Ordinal": 1, - "Name": "Документация по безопасности веб-интерфейса", - "Items": [ - { - "Shortcode": "V3.1.1", - "Ordinal": 1, - "Description": "Убедитесь, что в документации приложения описаны ожидаемые функции безопасности, которые должны поддерживать браузеры, использующие приложение (такие как HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) и другие соответствующие механизмы безопасности HTTP). В документации также должно быть обязательно определено, как приложение должно себя вести, если некоторые из этих функций недоступны (например, предупреждать пользователя или блокировать доступ).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V3.2", - "Ordinal": 2, - "Name": "Непреднамеренная интерпретация контента", - "Items": [ - { - "Shortcode": "V3.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что реализованы меры безопасности, предотвращающие отображение контента или функций браузерами в HTTP-ответах в некорректном контексте (например, запрос API, загруженный пользователем файл или другой ресурс запрашивается напрямую). Возможные способы контроля включают: не обрабатывать содержимое, если поля заголовка HTTP-запроса (например, Sec-Fetch-*) не указывают на корректность контекста; использование заголовка и значения Content-Security-Policy: sandbox directive; или использование заголовка и значения Content-Disposition: attachment.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что данные, предназначенные для отображения в виде текста, а не визуализации в виде HTML, обрабатывается с использованием безопасных функций визуализации (таких как createTextNode или textContent), чтобы предотвратить непреднамеренное выполнение содержимого, такого как HTML или JavaScript.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.2.3", - "Ordinal": 3, - "Description": "Убедитесь, что приложение избегает затирания DOM при использовании JavaScript на стороне клиента, применяя явные объявления переменных, выполняя строгую проверку типов, избегая сохранения глобальных переменных в объекте документа и реализуя изоляцию пространства имен.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V3.3", - "Ordinal": 3, - "Name": "Настройка файлов cookie", - "Items": [ - { - "Shortcode": "V3.3.1", - "Ordinal": 1, - "Description": "Убедитесь, что у файлов cookie установлен атрибут «Secure», и если префикс «__Host‑» не используется в названии cookie, необходимо использовать префикс «__Secure‑».", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.3.2", - "Ordinal": 2, - "Description": "Убедитесь, что значение атрибута SameSite каждой cookie установлено в соответствии с назначением cookie, чтобы ограничить подверженность атакам на восстановление пользовательского интерфейса и атакам с подделкой запросов на уровне браузера, обычно называемым подделкой межсайтовых запросов (CSRF).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.3.3", - "Ordinal": 3, - "Description": "Убедитесь, что cookie имеют префикс «__Host‑» в названии, если только они явно не предназначены для совместного использования с другими хостами.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.3.4", - "Ordinal": 4, - "Description": "Убедитесь, что если значение cookie не должно быть доступно для клиентских скриптов (например, сессионный токен), для cookie должен быть установлен атрибут «HttpOnly», а само значение должно передаваться клиенту только через поле заголовка «Set-Cookie».", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.3.5", - "Ordinal": 5, - "Description": "Убедитесь, что при записи cookie приложением общая длина имени и значения cookie не превышает 4096 байт. Слишком большие cookie не будут сохраняться браузером и, следовательно, не будут отправляться с запросами, что помешает пользователю использовать функции приложения, зависящие от этого cookie.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V3.4", - "Ordinal": 4, - "Name": "Заголовки механизма безопасности браузера", - "Items": [ - { - "Shortcode": "V3.4.1", - "Ordinal": 1, - "Description": "Убедитесь, что поле заголовка Strict‑Transport‑Security включено во все ответы для реализации политики HTTP Strict Transport Security (HSTS). Необходимо указать максимальное время не менее 1 года, а для L2 и выше политика должна применяться также ко всем поддоменам.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.4.2", - "Ordinal": 2, - "Description": "Убедитесь, что поле заголовка Cross‑Origin Resource Sharing (CORS) «Access‑Control‑Allow‑Origin» имеет фиксированное значение, заданное приложением, или, если используется заголовок Origin, оно проверяется по списку доверенных источников. При необходимости использования «Access‑Control‑Allow‑Origin: *» убедитесь, что ответ не содержит конфиденциальной информации.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.4.3", - "Ordinal": 3, - "Description": "Убедитесь, что HTTP-ответы содержат поле заголовка Content-Security-Policy, которое определяет директивы, гарантирующие загрузку и выполнение браузером только доверенного контента или ресурсов, чтобы ограничить выполнение вредоносного JavaScript. Как минимум, необходимо использовать глобальную политику, включающую директивы object-src «none» и base-uri «none», а также определяющую список разрешенных адресов или использующую одноразовые коды или хэши. Для приложений L3 необходимо определить политику использования 'nonce' или hash-конструкций для каждого ответа.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.4.4", - "Ordinal": 4, - "Description": "Убедитесь, что все HTTP-ответы содержат поле заголовка «X‑Content‑Type‑Options: nosniff». Это предписывает браузерам не использовать анализ контента и определение типа MIME для данного ответа, а также требовать, чтобы значение поля заголовка Content‑Type в ответе соответствовало целевому ресурсу. Например, ответ на запрос стиля принимается только в том случае, если Content‑Type в ответе — «text/css». Это также позволяет браузеру использовать функцию Cross‑Origin Read Blocking (CORB).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.4.5", - "Ordinal": 5, - "Description": "Убедитесь, что приложение устанавливает политику реферера для предотвращения утечки технически конфиденциальных данных сторонним сервисам через поле заголовка HTTP-запроса «Referer». Это можно сделать с помощью поля заголовка HTTP-ответа «Referrer‑Policy» или через атрибуты HTML-элемента. Конфиденциальные данные могут включать путь и данные запроса в URL-адресе, а для внутренних непубличных приложений также имя хоста.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.4.6", - "Ordinal": 6, - "Description": "Убедитесь, что веб-приложение использует директиву frame‑ancestors поля заголовка Content‑Security‑Policy для каждого HTTP-ответа, чтобы гарантировать невозможность его внедрения по умолчанию и внедрение определённых ресурсов разрешено только при необходимости. Обратите внимание, что поле заголовка X‑Frame‑Options, хотя и поддерживается браузерами, устарело и не может быть использовано в качестве основы.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.4.7", - "Ordinal": 7, - "Description": "Убедитесь, что в поле заголовка Content‑Security‑Policy указано место, куда следует сообщать о нарушениях.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.4.8", - "Ordinal": 8, - "Description": "Убедитесь, что все HTTP-ответы, инициирующие рендеринг документа (например, ответы с типом содержимого text/html), включают поле заголовка Cross-Origin-Opener-Policy с директивой same-origin или same-origin-allow-popups (при необходимости). Это предотвращает атаки, злоупотребляющие общим доступом к объектам Window, такие как Tabnabbing и Frame Counting.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V3.5", - "Ordinal": 5, - "Name": "Браузерное разделение источников", - "Items": [ - { - "Shortcode": "V3.5.1", - "Ordinal": 1, - "Description": "Убедитесь, что, если приложение не использует механизм предварительной проверки CORS для предотвращения запрещённых кросс-доменных запросов на использование чувствительного функционала, эти запросы валидируются на предмет их происхождения от самого приложения. Это можно сделать, используя и проверяя специальные токены для защиты от подделки или требуя дополнительные поля HTTP-заголовка, не входящие в список «простых заголовков» (CORS-safelisted request-header). Это необходимо для защиты от атак с подделкой запросов через браузер, широко известных как межсайтовая подделка запросов (CSRF).", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.5.2", - "Ordinal": 2, - "Description": "Убедитесь, что если приложение использует механизм предварительной проверки CORS для предотвращения неразрешённого использования чувствительного функционала между источниками, вызов этого функционала невозможен с помощью запроса, который не запускает предварительную проверку CORS. Для этого может потребоваться проверка значений полей заголовка запроса «Origin» и «Content-Type» или использование дополнительного поля заголовка, не входящего в безопасный список CORS.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.5.3", - "Ordinal": 3, - "Description": "Убедитесь, что HTTP-запросы к чувствительному функционалу используют соответствующие HTTP-методы, такие как POST, PUT, PATCH или DELETE, а не методы, определённые спецификацией HTTP как «безопасные», такие как HEAD, OPTIONS или GET. В качестве альтернативы можно использовать строгую валидацию полей заголовка запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, навигационного запроса или загрузки ресурса (например, источника изображения), где это не ожидается.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.5.4", - "Ordinal": 4, - "Description": "Убедитесь, что отдельные приложения размещены на разных именах хостов, чтобы использовать ограничения, предусмотренные политикой same-origin, включая то, как документы или скрипты, загруженные одним источником, могут взаимодействовать с ресурсами из другого источника, а также ограничения на cookie на основе имени хоста.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.5.5", - "Ordinal": 5, - "Description": "Убедитесь, что сообщения, полученные интерфейсом postMessage, отвергаются, если источник сообщения не является доверенным или если синтаксис сообщения недействителен.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.5.6", - "Ordinal": 6, - "Description": "Убедитесь, что функциональность JSONP не включена нигде в приложении, чтобы избежать атак с использованием межсайтового включения скриптов (XSSI).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.5.7", - "Ordinal": 7, - "Description": "Убедитесь, что данные, требующие авторизации, не включены в ответы ресурсов скриптов, таких как файлы JavaScript, чтобы предотвратить атаки с использованием межсайтового включения скриптов (XSSI).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.5.8", - "Ordinal": 8, - "Description": "Убедитесь, что аутентифицированные ресурсы (такие как изображения, видео, скрипты и другие документы) могут быть загружены или внедрены от имени пользователя только по назначению. Этого можно добиться путём строгой валидации полей заголовка HTTP-запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, или путём установки ограничительного поля заголовка HTTP-ответа Cross‑Origin‑Resource‑Policy, чтобы браузер блокировал возвращаемый контент.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V3.6", - "Ordinal": 6, - "Name": "Целостность внешних ресурсов", - "Items": [ - { - "Shortcode": "V3.6.1", - "Ordinal": 1, - "Description": "Убедитесь, что клиентские ресурсы, такие как библиотеки JavaScript, CSS или веб-шрифты, размещаются только на внешнем сервере (например, в сети доставки контента (Content Delivery Network)), если ресурс статический и имеет версии, а для проверки целостности ресурса используется механизм проверки целостности подресурсов (SRI). Если это невозможно, для каждого ресурса должно быть задокументировано решение по безопасности, обосновывающее это.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V3.7", - "Ordinal": 7, - "Name": "Другие соображения по безопасности браузера", - "Items": [ - { - "Shortcode": "V3.7.1", - "Ordinal": 1, - "Description": "Убедитесь, что приложение использует только те клиентские технологии, которые по-прежнему поддерживаются и считаются безопасными. Примерами технологий, не соответствующих этому требованию, являются плагины NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL или клиентские Java-апплеты.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.7.2", - "Ordinal": 2, - "Description": "Убедитесь, что приложение будет автоматически перенаправлять пользователя на другое имя хоста или домен (который не контролируется приложением), только если этот хост или домен указаны в списке разрешенных.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.7.3", - "Ordinal": 3, - "Description": "Убедитесь, что приложение отображает уведомление, что пользователь перенаправляется на URL-адрес, находящийся вне контроля приложения, с возможностью отмены навигации.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.7.4", - "Ordinal": 4, - "Description": "Убедитесь, что домен верхнего уровня приложения (например, site.tld) ​​добавлен в публичный список предварительной загрузки (preload list) для HTTP Strict Transport Security (HSTS). Это гарантирует, что использование TLS для приложения будет встроено непосредственно в основные браузеры, а не будет полагаться только на поле заголовка ответа Strict-Transport-Security.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.7.5", - "Ordinal": 5, - "Description": "Убедитесь, что приложение ведет себя так, как описано в документации (например, предупреждает пользователя или блокирует доступ), если браузер, используемый для доступа к приложению, не поддерживает ожидаемые функции безопасности.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V4", - "Ordinal": 4, - "ShortName": "API", - "Name": "API и Веб-сервис", - "Items": [ - { - "Shortcode": "V4.1", - "Ordinal": 1, - "Name": "Общая безопасность веб-сервисов", - "Items": [ - { - "Shortcode": "V4.1.1", - "Ordinal": 1, - "Description": "Убедитесь, что каждый HTTP-ответ с телом сообщения содержит заголовок Content-Type, который соответствует фактическому содержимому ответа, таким как «text/», «/+xml» и «/xml», включая параметр charset для указания безопасной кодировки символов (например, UTF-8, ISO-8859-1) согласно IANA Media Types.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.1.2", - "Ordinal": 2, - "Description": "Убедитесь, что только конечные точки, предназначенные для взаимодействия с пользователем через веб-браузер, автоматически перенаправляют HTTP на HTTPS, в то время как другие сервисы или конечные точки не реализуют прозрачные редиректы. Это необходимо, чтобы избежать ситуации, когда клиент ошибочно отправляет незашифрованные HTTP-запросы а из-за того, что запрос по HTTP автоматически перенаправляется на HTTPS другим сервисом без обработки на входе, утечка чувствительных данных остаётся незамеченной.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.1.3", - "Ordinal": 3, - "Description": "Убедитесь, что любой HTTP-заголовок, используемый приложением и устанавливаемый промежуточным уровнем, таким как балансировщик нагрузки, веб-прокси или backend-for-frontend сервис, не может быть переопределён конечным пользователем. Примеры заголовков: X-Real-IP, X-Forwarded-*, X-User-ID.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.1.4", - "Ordinal": 4, - "Description": "Убедитесь, что разрешены только HTTP-методы, которые явно поддерживаются приложением или его API (включая OPTIONS для preflight-запросов), а неиспользуемые методы заблокированы.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.1.5", - "Ordinal": 5, - "Description": "Убедитесь, что для особо чувствительных запросов или транзакций, проходящих через несколько систем, используются цифровые подписи на уровне сообщений, дополнительно к транспортным средствам защиты.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V4.2", - "Ordinal": 2, - "Name": "Валидация структуры HTTP-сообщений", - "Items": [ - { - "Shortcode": "V4.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что все компоненты приложения (включая балансировщики нагрузки, файрволы и серверы приложений) определяют границы входящих HTTP-сообщений с использованием механизма, соответствующего версии HTTP, чтобы предотвратить HTTP request smuggling. В HTTP/1.x, если присутствует заголовок Transfer-Encoding, заголовок Content-Length должен игнорироваться согласно RFC 2616. При использовании HTTP/2 или HTTP/3, если присутствует Content-Length, веб-сервер должен убедиться, что он совпадает с длиной DATA-фреймов.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что при генерации HTTP-сообщений заголовок Content-Length не конфликтует с длиной содержимого, определяемой рамками протокола HTTP, чтобы предотвратить HTTP Request Smuggling.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.2.3", - "Ordinal": 3, - "Description": "Убедитесь, что приложение не отправляет и не принимает HTTP/2 и HTTP/3 сообщения с заголовками, специфичными для соединения, такими как Transfer-Encoding, чтобы предотвратить HTTP Response Splitting и HTTP Header Injection.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.2.4", - "Ordinal": 4, - "Description": "Убедитесь, что приложение принимает HTTP/2 и HTTP/3 запросы только в случае, если поля заголовков и их значения не содержат последовательностей CR (\\r), LF (\\n) или CRLF (\\r\\n), чтобы предотвратить HTTP Header Injection.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.2.5", - "Ordinal": 5, - "Description": "Убедитесь, что если приложение (бекенд или фронтенд) формирует и отправляет запросы, оно использует валидацию, очистку или другие механизмы, чтобы не создавать URI (например, для API-вызовов) или HTTP-заголовки (например, Authorization или Cookie) слишком большой длины, чтобы их не принимал приёмник. Это может привести к отказу в обслуживании, например, при отправке слишком длинного запроса (длинный cookie-заголовок), из-за чего сервер постоянно возвращает ошибку.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V4.3", - "Ordinal": 3, - "Name": "GraphQL", - "Items": [ - { - "Shortcode": "V4.3.1", - "Ordinal": 1, - "Description": "Убедитесь, что используется белый список запросов, ограничение глубины вложенности, ограничение количества или анализ стоимости запроса, чтобы предотвратить DoS-атаки на уровне GraphQL или слоя данных из-за дорогостоящих вложенных запросов.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.3.2", - "Ordinal": 2, - "Description": "Убедитесь, что introspection-запросы GraphQL отключены в продакшен-среде, если GraphQL API не предназначен для использования сторонними клиентами.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V4.4", - "Ordinal": 4, - "Name": "WebSocket", - "Items": [ - { - "Shortcode": "V4.4.1", - "Ordinal": 1, - "Description": "Убедитесь, что для всех WebSocket-соединений используется WebSocket поверх TLS (WSS).", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.4.2", - "Ordinal": 2, - "Description": "Убедитесь, что при первоначальном HTTP WebSocket handshake заголовок Origin проверяется на соответствие списку разрешённых источников для приложения.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.4.3", - "Ordinal": 3, - "Description": "Убедитесь, что если стандартное управление сессиями приложения не может быть использовано, применяются специальные токены, соответствующие требованиям безопасности управления сессиями.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.4.4", - "Ordinal": 4, - "Description": "Убедитесь, что специальные токены управления сессиями WebSocket изначально получаются или валидируются через ранее аутентифицированную HTTPS-сессию при переходе от HTTPS к WebSocket.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V5", - "Ordinal": 5, - "ShortName": "File", - "Name": "Работа с файлами", - "Items": [ - { - "Shortcode": "V5.1", - "Ordinal": 1, - "Name": "Документация по работе с файлами", - "Items": [ - { - "Shortcode": "V5.1.1", - "Ordinal": 1, - "Description": "Убедитесь, что документация определяет допустимые типы файлов, ожидаемые расширения и максимальный размер (включая распакованный размер) для каждой функции загрузки. Также убедитесь, что в документации указано, как файлы обезвреживаются для конечных пользователей (например, как приложение ведёт себя при обнаружении вредоносного файла).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V5.2", - "Ordinal": 2, - "Name": "Загрузка файлов и содержимое", - "Items": [ - { - "Shortcode": "V5.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что приложение принимает только те файлы, которые может обработать без потери производительности или отказа в обслуживании.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V5.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что при загрузке файла (включая файлы внутри архивов, таких как ZIP) приложение проверяет, соответствует ли расширение ожидаемому, и валидирует, соответствует ли содержимое типу, указанному в расширении. Это включает проверку начальных 'magic bytes', перезапись изображений, использование специализированных библиотек. Для уровня 1 — достаточно проверок для файлов, критичных с точки зрения бизнеса или безопасности. Для уровней 2 и выше — для всех файлов.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V5.2.3", - "Ordinal": 3, - "Description": "Убедитесь, что приложение проверяет архивы (например, zip, gz, docx, odt) на максимально допустимый распакованный размер и максимальное количество файлов до распаковки.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V5.2.4", - "Ordinal": 4, - "Description": "Убедитесь, что для каждого пользователя установлены квоты на общий размер и количество файлов, чтобы один пользователь не мог переполнить хранилище.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V5.2.5", - "Ordinal": 5, - "Description": "Убедитесь, что приложение не позволяет загружать архивы с символьными ссылками (symlinks), если это не требуется по бизнес-логике. Если требуется — разрешён только строго определённый список допустимых символьных ссылок.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V5.2.6", - "Ordinal": 6, - "Description": "Убедитесь, что приложение отклоняет изображения с числом пикселей выше допустимого, чтобы предотвратить атаки 'pixel flood'.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V5.3", - "Ordinal": 3, - "Name": "Хранение файлов", - "Items": [ - { - "Shortcode": "V5.3.1", - "Ordinal": 1, - "Description": "Убедитесь, что загруженные или сгенерированные из недоверенного ввода файлы, находящиеся в публичной директории, не исполняются как серверный код при обращении к ним по HTTP.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V5.3.2", - "Ordinal": 2, - "Description": "Убедитесь, что при создании путей к файлам приложение использует внутренние или доверенные данные, а не пользовательские имена файлов. Если использование пользовательских имён или метаданных необходимо — требуется строгая проверка и очистка. Это защита от path traversal, LFI, RFI и SSRF.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V5.3.3", - "Ordinal": 3, - "Description": "Убедитесь, что при обработке файлов на сервере (например, при распаковке) игнорируются пути, заданные пользователем, во избежание уязвимостей типа 'zip slip'.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V5.4", - "Ordinal": 4, - "Name": "Скачивание файлов", - "Items": [ - { - "Shortcode": "V5.4.1", - "Ordinal": 1, - "Description": "Убедитесь, что приложение валидирует или игнорирует имена файлов, переданных пользователем (включая в JSON, JSONP или URL-параметре), и указывает имя файла в заголовке Content-Disposition при ответе.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V5.4.2", - "Ordinal": 2, - "Description": "Убедитесь, что имена файлов, передаваемые (например, в HTTP-заголовках или вложениях в email), кодируются или очищаются (например, по RFC 6266), чтобы сохранить структуру документа и предотвратить инъекции.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V5.4.3", - "Ordinal": 3, - "Description": "Убедитесь, что файлы, полученные из недоверенных источников, сканируются антивирусом, чтобы не распространять известное вредоносное содержимое.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V6", - "Ordinal": 6, - "ShortName": "Authentication", - "Name": "Аутентификация", - "Items": [ - { - "Shortcode": "V6.1", - "Ordinal": 1, - "Name": "Документация по аутентификации", - "Items": [ - { - "Shortcode": "V6.1.1", - "Ordinal": 1, - "Description": "Убедитесь, что в документации приложения описано, как используются механизмы, такие как ограничение частоты запросов (rate limiting), защита от автоматизации и адаптивные реакции, для защиты от атак, таких как подстановка учётных данных и перебор паролей. Документация должна ясно описывать конфигурацию этих механизмов и предотвращение злонамеренной блокировки аккаунтов.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.1.2", - "Ordinal": 2, - "Description": "Убедитесь, что задокументирован список контекстно-зависимых слов, запрещённых к использованию в паролях. В него могут входить производные от названий организаций, продуктов, идентификаторов систем, кодовых названий проектов, названий отделов или ролей и тому подобное.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.1.3", - "Ordinal": 3, - "Description": "Убедитесь, что если приложение поддерживает несколько способов аутентификации, то все они документированы вместе с описанием применяемых средств защиты и уровнем стойкости аутентификации, которые должны быть одинаково применены ко всем способам.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V6.2", - "Ordinal": 2, - "Name": "Безопасность паролей", - "Items": [ - { - "Shortcode": "V6.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что пользовательские пароли содержат не менее 8 символов. Рекомендуется минимальная длина в 15 символов.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что пользователи могут менять свои пароли.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.3", - "Ordinal": 3, - "Description": "Убедитесь, что для смены пароля требуется ввести как текущий, так и новый пароль.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.4", - "Ordinal": 4, - "Description": "Убедитесь, что при регистрации или смене пароля введённый пароль проверяется по списку как минимум из 3000 самых популярных паролей, соответствующих политике (например, минимальной длине).", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.5", - "Ordinal": 5, - "Description": "Убедитесь, что допускаются пароли любой структуры, без ограничений на использование определённых символов. Не должно быть требований по обязательному наличию заглавных/строчных букв, цифр или специальных символов.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.6", - "Ordinal": 6, - "Description": "Убедитесь, что поля ввода пароля используют type=password для скрытия символов. Разрешено временное отображение всего пароля или последнего введённого символа.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.7", - "Ordinal": 7, - "Description": "Убедитесь, что разрешены вставка (paste), использование менеджеров паролей браузера и внешних менеджеров паролей.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.8", - "Ordinal": 8, - "Description": "Убедитесь, что пароль проверяется строго в том виде, в котором он был введён пользователем — без обрезки, изменения регистра и других модификаций.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.9", - "Ordinal": 9, - "Description": "Убедитесь, что система позволяет использовать пароли длиной не менее 64 символов.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.10", - "Ordinal": 10, - "Description": "Убедитесь, что пароль остаётся действительным, пока не будет скомпрометирован или не будет изменён пользователем. Приложение не должно требовать регулярной смены пароля.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.11", - "Ordinal": 11, - "Description": "Убедитесь, что используется документированный список контекстно-зависимых слов (например, названия компаний, проектов и т.д.) для предотвращения использования легко угадываемых паролей.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.12", - "Ordinal": 12, - "Description": "Убедитесь, что при регистрации или смене пароля проверяется, не входит ли он в список скомпрометированных (утёкших) паролей.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V6.3", - "Ordinal": 3, - "Name": "Общие требования к безопасности аутентификации", - "Items": [ - { - "Shortcode": "V6.3.1", - "Ordinal": 1, - "Description": "Убедитесь, что реализованы меры защиты от атак типа credential stuffing (массовая подстановка учётных данных) и brute-force (перебор паролей), согласно документации по безопасности приложения.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.3.2", - "Ordinal": 2, - "Description": "Убедитесь, что в приложении отсутствуют или отключены учётные записи по умолчанию (например, root, admin, sa).", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.3.3", - "Ordinal": 3, - "Description": "Убедитесь, что для доступа к приложению используется либо механизм многофакторной аутентификации, либо комбинация однофакторных. Для уровня L3 один из факторов должен быть аппаратным, обеспечивающим защиту от фишинга, устойчивость к компрометации и подтверждение намерения аутентификации через явное действие пользователя (например, нажатие кнопки на FIDO-ключе или телефоне). Ослабление этих требований допускается только при наличии обоснования и компенсирующих мер.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.3.4", - "Ordinal": 4, - "Description": "Убедитесь, что при наличии нескольких способов аутентификации, они все задокументированы, и для них единообразно применяются меры защиты и уровни доверия.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.3.5", - "Ordinal": 5, - "Description": "Убедитесь, что пользователи получают уведомления о подозрительных попытках аутентификации (удачных и неудачных). Это может включать попытки (например, подключения) с необычного устройства или места, частично успешную MFA, попытку после долгого отсутствия или успешную аутентификацию после серии неудачных.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.3.6", - "Ordinal": 6, - "Description": "Убедитесь, что email не используется ни как однофакторный, ни как многофакторный механизм аутентификации.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.3.7", - "Ordinal": 7, - "Description": "Убедитесь, что пользователи получают уведомление при изменении данных аутентификации, таких как сброс пароля или изменение логина/email.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.3.8", - "Ordinal": 8, - "Description": "Убедитесь, что из сообщений об ошибке, HTTP-кодов ответа или различий во времени ответа нельзя определить, существует ли пользователь с таким логином. Это правило также должно применяться к функциям регистрации и восстановления пароля.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V6.4", - "Ordinal": 4, - "Name": "Жизненный цикл и восстановление факторов аутентификации", - "Items": [ - { - "Shortcode": "V6.4.1", - "Ordinal": 1, - "Description": "Убедитесь, что начальные пароли или коды активации, генерируемые системой, создаются с использованием надёжного генератора случайных чисел, соответствуют текущей политике паролей и истекают через короткий период времени либо после первого использования. Эти секреты не должны использоваться как постоянные пароли.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.4.2", - "Ordinal": 2, - "Description": "Убедитесь, что в системе отсутствуют подсказки к паролю или вопросы на знание («секретные вопросы»).", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.4.3", - "Ordinal": 3, - "Description": "Убедитесь, что реализован безопасный процесс сброса забытого пароля, который не обходит активные механизмы многофакторной аутентификации.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.4.4", - "Ordinal": 4, - "Description": "Убедитесь, что в случае утраты одного из факторов MFA проводится удостоверение личности (identity proofing) на том же уровне, что и при первичной регистрации.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.4.5", - "Ordinal": 5, - "Description": "Убедитесь, что инструкции по обновлению истекающих механизмов аутентификации отправляются заранее, с достаточным запасом времени для выполнения замены, при необходимости с настройкой автоматических напоминаний.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.4.6", - "Ordinal": 6, - "Description": "Убедитесь, что администраторы могут инициировать процесс сброса пароля, но не могут задать или выбрать новый пароль за пользователя. Это исключает ситуацию, при которой администратор знает пароль пользователя.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V6.5", - "Ordinal": 5, - "Name": "Общие требования к многофакторной аутентификации", - "Items": [ - { - "Shortcode": "V6.5.1", - "Ordinal": 1, - "Description": "Убедитесь, что lookup-секреты, внеполосные коды/запросы и TOTP-коды можно использовать только один раз.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.5.2", - "Ordinal": 2, - "Description": "Убедитесь, что при хранении lookup-секретов с энтропией менее 112 бит (например, 19 случайных буквенно-цифровых символов или 34 случайные цифры) они хэшируются с использованием разрешённого алгоритма хеширования паролей и случайной соли минимум 32 бита. Если у секрета ≥112 бит энтропии — допустимо использовать стандартный хэш.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.5.3", - "Ordinal": 3, - "Description": "Убедитесь, что lookup-секреты, коды внеполосной аутентификации и сиды для TOTP генерируются с использованием криптографически стойкого генератора случайных чисел (CSPRNG), чтобы избежать предсказуемых значений.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.5.4", - "Ordinal": 4, - "Description": "Убедитесь, что lookup-секреты и внеполосные коды аутентификации имеют минимум 20 бит энтропии (достаточно, например, 4 случайных алфавитно-цифровых символов или 6 случайных цифр).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.5.5", - "Ordinal": 5, - "Description": "Убедитесь, что все внеполосные запросы, коды и токены, а также TOTP-коды имеют ограниченный срок действия. Максимум для out-of-band — 10 минут, для TOTP — 30 секунд.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.5.6", - "Ordinal": 6, - "Description": "Убедитесь, что любой фактор аутентификации (включая физические устройства) может быть отозван в случае кражи или утери.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.5.7", - "Ordinal": 7, - "Description": "Убедитесь, что биометрические механизмы аутентификации используются только как вторичный фактор — в сочетании с «чем-то, что вы знаете» или «чем-то, что у вас есть».", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.5.8", - "Ordinal": 8, - "Description": "Убедитесь, что TOTP-коды проверяются по источнику времени, полученному от доверенного сервиса, а не от клиента или недоверенного источника.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V6.6", - "Ordinal": 6, - "Name": "Внеполосные механизмы аутентификации", - "Items": [ - { - "Shortcode": "V6.6.1", - "Ordinal": 1, - "Description": "Убедитесь, что механизмы аутентификации через телефонную сеть общего пользования (PSTN) для доставки одноразовых паролей (OTP) по телефону или SMS используются только в случае предварительной валидации номера, при этом предлагаются альтернативные более безопасные методы (например, TOTP), и пользователю сообщаются риски. Для приложений уровня L3 использование телефона и SMS недопустимо.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.6.2", - "Ordinal": 2, - "Description": "Убедитесь, что внеполосные запросы, коды или токены привязаны к исходному запросу аутентификации, для которого они были сгенерированы, и не могут быть использованы повторно для других попыток.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.6.3", - "Ordinal": 3, - "Description": "Убедитесь, что внеполосные механизмы на основе кода защищены от атак методом подбора (brute force) путём применения ограничения частоты запросов (rate limiting). Также рекомендуется использовать коды с энтропией не менее 64 бит.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.6.4", - "Ordinal": 4, - "Description": "Убедитесь, что при использовании push-уведомлений для MFA применяется ограничение частоты (rate limiting), чтобы предотвратить атаки push-бомбинга. Также может помочь механизм сопоставления номеров (number matching).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V6.7", - "Ordinal": 7, - "Name": "Криптографические механизмы аутентификации", - "Items": [ - { - "Shortcode": "V6.7.1", - "Ordinal": 1, - "Description": "Убедитесь, что сертификаты, используемые для проверки криптографических утверждений об аутентификации, хранятся таким образом, чтобы исключить возможность их модификации.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.7.2", - "Ordinal": 2, - "Description": "Убедитесь, что nonce (случайная строка), используемая в процессе вызова, имеет длину не менее 64 бит и является статистически уникальной или уникальной на протяжении всего срока службы криптографического устройства.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V6.8", - "Ordinal": 8, - "Name": "Аутентификация с использованием провайдера идентификаций (IdP)", - "Items": [ - { - "Shortcode": "V6.8.1", - "Ordinal": 1, - "Description": "Убедитесь, что при поддержке несколькими IdP, невозможно подделать личность пользователя через другой IdP (например, с тем же user ID). Стандартным способом защиты является регистрация пользователя с использованием сочетания ID самого IdP (в качестве пространства имён) и пользовательского ID внутри IdP.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.8.2", - "Ordinal": 2, - "Description": "Убедитесь, что наличие и целостность цифровой подписи в утверждениях аутентификации (например, в JWT или SAML) всегда проверяются, а неподписанные или недействительные утверждения отклоняются.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.8.3", - "Ordinal": 3, - "Description": "Убедитесь, что SAML-утверждения обрабатываются только один раз в течение периода их действия, чтобы исключить атаки воспроизведения (replay attacks).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.8.4", - "Ordinal": 4, - "Description": "Убедитесь, что если приложение использует внешний поставщик идентификации (IdP) и для определенных функций требуется особый уровень, метод или срок действия аутентификации, то приложение использует данные, возвращаемые IdP, для проверки этих условий. Например, при использовании OIDC можно проверить значения полей ID Token — acr, amr, auth_time (если они есть). Если IdP не предоставляет эти данные, приложение должно иметь документированный план действий по умолчанию, предполагающий использование минимально допустимой силы аутентификации (например, одноступенчатая — логин и пароль).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V7", - "Ordinal": 7, - "ShortName": "Session", - "Name": "Управление сессиями", - "Items": [ - { - "Shortcode": "V7.1", - "Ordinal": 1, - "Name": "Документация по управлению сессиями", - "Items": [ - { - "Shortcode": "V7.1.1", - "Ordinal": 1, - "Description": "Убедитесь, что тайм-аут бездействия и абсолютное максимальное время жизни сессии задокументированы, соответствуют другим контрольным мерам и сопровождаются обоснованием любых отклонений от требований повторной аутентификации NIST SP 800-63B.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.1.2", - "Ordinal": 2, - "Description": "Убедитесь, что документация определяет допустимое количество одновременных (параллельных) сессий для одного аккаунта, а также поведение системы и действия при достижении этого лимита.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.1.3", - "Ordinal": 3, - "Description": "Убедитесь, что все системы, создающие и управляющие сессиями пользователей в рамках федеративной идентификации (например, SSO), задокументированы вместе с механизмами координации сроков действия сессий, условий завершения и случаев, требующих повторной аутентификации.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V7.2", - "Ordinal": 2, - "Name": "Базовая безопасность сессий", - "Items": [ - { - "Shortcode": "V7.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что все проверки сессионных токенов выполняются на доверенной серверной стороне.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что приложение использует либо автономные токены, либо ссылочные токены, которые генерируются динамически, не используя статические API-секреты или ключи.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.2.3", - "Ordinal": 3, - "Description": "Убедитесь, что ссылочные токены являются уникальными, создаются с использованием криптографически безопасного генератора псевдослучайных чисел (CSPRNG) и обладают энтропией не менее 128 бит.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.2.4", - "Ordinal": 4, - "Description": "Убедитесь, что при аутентификации пользователя (включая повторную) создается новый токен сессии, а текущий — аннулируется.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V7.3", - "Ordinal": 3, - "Name": "Тайм-ауты сессии", - "Items": [ - { - "Shortcode": "V7.3.1", - "Ordinal": 1, - "Description": "Убедитесь, что есть тайм-аут бездействия, после которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.3.2", - "Ordinal": 2, - "Description": "Убедитесь, что установлено абсолютное максимальное время жизни сессии, по истечении которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V7.4", - "Ordinal": 4, - "Name": "Завершение сессий", - "Items": [ - { - "Shortcode": "V7.4.1", - "Ordinal": 1, - "Description": "Убедитесь, что после завершения сессии (logout, истечение срока) дальнейшее её использование невозможно. Для ссылочных токенов или сессий с сохранением состояния это означает аннулирование на сервере. Для self-contained токенов необходимо реализовать механизм отзыва, например, список отозванных токенов, проверку времени выпуска или ротацию ключей подписи для каждого пользователя.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.4.2", - "Ordinal": 2, - "Description": "Убедитесь, что при удалении или отключении пользователя все активные сессии немедленно завершаются.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.4.3", - "Ordinal": 3, - "Description": "Убедитесь, что после изменения или удаления факторов аутентификации (например, смена пароля или MFA) приложение предлагает завершить все другие активные сессии.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.4.4", - "Ordinal": 4, - "Description": "Убедитесь, что на всех страницах, требующих аутентификации, имеется простой и видимый способ выхода.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.4.5", - "Ordinal": 5, - "Description": "Убедитесь, что администраторы могут завершать активные сессии конкретного пользователя или всех пользователей.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V7.5", - "Ordinal": 5, - "Name": "Защита от злоупотреблений сессией", - "Items": [ - { - "Shortcode": "V7.5.1", - "Ordinal": 1, - "Description": "Убедитесь, что приложение требует полной повторной аутентификации перед изменением чувствительных атрибутов аккаунта, которые могут влиять на аутентификацию (например, email, номер телефона, настройки MFA или данных восстановления доступа).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.5.2", - "Ordinal": 2, - "Description": "Убедитесь, что пользователь может просматривать и (после повторной аутентификации хотя бы по одному фактору) завершать активные сессии.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.5.3", - "Ordinal": 3, - "Description": "Убедитесь, что перед выполнением критически важных операций приложение требует повторной аутентификации (по крайней мере, одного фактора) или дополнительной проверки.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V7.6", - "Ordinal": 6, - "Name": "Федеративная повторная аутентификация", - "Items": [ - { - "Shortcode": "V7.6.1", - "Ordinal": 1, - "Description": "Убедитесь, что срок действия и завершение сессий между RP и IdP соответствуют документации и включают повторную аутентификацию, если достигнут максимальный допустимый интервал между событиями аутентификации.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.6.2", - "Ordinal": 2, - "Description": "Убедитесь, что создание сессии требует согласия пользователя или явного действия, предотвращающего несанкционированное создание сессий без участия пользователя.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V8", - "Ordinal": 8, - "ShortName": "Authorization", - "Name": "Авторизация", - "Items": [ - { - "Shortcode": "V8.1", - "Ordinal": 1, - "Name": "Документация по авторизации", - "Items": [ - { - "Shortcode": "V8.1.1", - "Ordinal": 1, - "Description": "Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне функций и на уровне данных на основе прав субъекта и атрибутов ресурса.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V8.1.2", - "Ordinal": 2, - "Description": "Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне полей (как на чтение, так и на запись) на основе прав субъекта и атрибутов ресурса. Эти правила могут зависеть от других атрибутов объекта данных, например, статуса.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V8.1.3", - "Ordinal": 3, - "Description": "Убедитесь, что документация определяет, какие атрибуты окружения и контекста (например, время суток, IP-адрес, местоположение, устройство) используются приложением для принятия решений в области аутентификации и авторизации.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V8.1.4", - "Ordinal": 4, - "Description": "Убедитесь, что документация по аутентификации и авторизации определяет, как используются факторы окружения и контекста в принятии решений, наряду с правилами доступа к функциям, данным и полям. Документация должна содержать оцениваемые атрибуты, пороговые значения риска, действия (разрешить, отказать, повысить уровень аутентификации и др.).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V8.2", - "Ordinal": 2, - "Name": "Архитектура авторизации", - "Items": [ - { - "Shortcode": "V8.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что приложение обеспечивает доступ на уровне функций (function-level) только субъектам с явными разрешениями.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V8.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что приложение обеспечивает доступ на уровне данных (data-specific) только тем субъектам, которым явно предоставлены права к определённым элементам данных, чтобы предотвратить IDOR (Insecure Direct Object Reference) и BOLA-уязвимости (Broken Object Level Authorization).", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V8.2.3", - "Ordinal": 3, - "Description": "Убедитесь, что приложение обеспечивает доступ на уровне полей (field-level) только тем субъектам, которым явно предоставлены права к определённым полям, чтобы предотвратить BOPLA (Broken Object Property Level Authorization).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V8.2.4", - "Ordinal": 4, - "Description": "Убедитесь, что реализованы адаптивные меры безопасности, основанные на атрибутах окружения и контекста субъекта (время, местоположение, IP, устройство), которые используются для принятия решений об аутентификации и авторизации, как это определено в документации приложения. Эти меры должны применяться как при попытке субъекта начать новую сессию, так и во время существующей сессии.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V8.3", - "Ordinal": 3, - "Name": "Авторизация на уровне операций", - "Items": [ - { - "Shortcode": "V8.3.1", - "Ordinal": 1, - "Description": "Убедитесь, что правила авторизации реализуются на доверенном сервисном уровне и не зависят от элементов, которые может контролировать клиент (например, JavaScript на стороне клиента).", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V8.3.2", - "Ordinal": 2, - "Description": "Убедитесь, что изменения значений, влияющих на авторизацию, применяются немедленно. Если это невозможно (например, при использовании автономных токенов), должны быть реализованы компенсирующие меры: оповещения о попытке несанкционированного действия и откат изменений. Обратите внимание, что данный подход не предотвращает утечку информации.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V8.3.3", - "Ordinal": 3, - "Description": "Убедитесь, что доступ к объекту осуществляется на основе прав субъекта, инициировавшего запрос, а не прав промежуточного сервиса, действующего от его имени. Например, если пользователь обращается к веб-сервису с автономным токеном для аутентификации, а сервис затем запрашивает данные у другого сервиса, второй сервис должен использовать токен пользователя, а не токен первого сервиса для принятия решения о доступе.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V8.4", - "Ordinal": 4, - "Name": "Прочие аспекты авторизации", - "Items": [ - { - "Shortcode": "V8.4.1", - "Ordinal": 1, - "Description": "Убедитесь, что в мультитенантных приложениях реализованы механизмы, предотвращающие действия потребителя в отношении арендаторов, к которым у него нет доступа.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V8.4.2", - "Ordinal": 2, - "Description": "Убедитесь, что доступ к административным интерфейсам защищён несколькими уровнями контроля, включая непрерывную проверку личности, контроль защищённости устройства и анализ контекстных рисков. Недостаточно опираться только на IP-адрес или доверенные устройства.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V9", - "Ordinal": 9, - "ShortName": "Self", - "Name": "Автономные токены", - "Items": [ - { - "Shortcode": "V9.1", - "Ordinal": 1, - "Name": "Источник токена и его целостность", - "Items": [ - { - "Shortcode": "V9.1.1", - "Ordinal": 1, - "Description": "Убедитесь, что автономные токены проверяются на целостность с помощью цифровой подписи или MAC, прежде чем доверять их содержимому.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V9.1.2", - "Ordinal": 2, - "Description": "Проверяйте, что автономные токены создаются и проверяются исключительно с помощью алгоритмов из списка допустимых в данном контексте. Список допустимых алгоритмов должен включать только разрешенные алгоритмы (желательно либо только симметричные, либо только асимметричные) и ни в коем случае не содержать алгоритм None. Если необходимо поддерживать оба типа алгоритмов, потребуются дополнительные средства контроля для предотвращения путаницы с ключами (key confusion).", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V9.1.3", - "Ordinal": 3, - "Description": "Убедитесь, что ключи, используемые для проверки автономных токенов, получены из доверенных, предварительно настроенных источников. Это предотвращает возможность указания злоумышленниками ненадёжных источников и ключей. Для JWT и других JWS структур заголовки 'jku', 'x5u' и 'jwk' должны проверяться по белому списку.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V9.2", - "Ordinal": 2, - "Name": "Содержимое токена", - "Items": [ - { - "Shortcode": "V9.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что при указанном сроке действия токен и его содержимое принимаются только в том случае, если срок действия токена не истёк. Например, для JWT нужно проверить поля 'nbf' и 'exp'.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V9.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что сервис, принимающий токен, проверяет его тип и соответствие назначению перед обработкой содержимого токена. Например, для принятия решений об авторизации могут быть приняты только Access Token, а для подтверждения аутентификации пользователя — только ID Token.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V9.2.3", - "Ordinal": 3, - "Description": "Убедитесь, что сервис принимает только токены, предназначенные для использования с этим сервисом (audience). Для JWT это можно сделать, проверив наличие утверждения «aud» по белому списку, определенному в сервисе.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V9.2.4", - "Ordinal": 4, - "Description": "Убедитесь, что, если эмитент токенов использует один и тот же закрытый ключ для выпуска токенов различным сервисам (audiences), выпущенные токены содержат явное указание целевых сервисов. Это предотвратит повторное использования токенов в не предназначенных для них сервисах. Если идентификатор сервиса (audience identifier) назначается динамически, эмитент токенов должен проверить audiences для исключения подмены получателей (audience impersonation).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V10", - "Ordinal": 10, - "ShortName": "OAuth", - "Name": "OAuth и OIDC", - "Items": [ - { - "Shortcode": "V10.1", - "Ordinal": 1, - "Name": "Общие требования безопасности OAuth и OIDC", - "Items": [ - { - "Shortcode": "V10.1.1", - "Ordinal": 1, - "Description": "Убедитесь, что токены передаются только тем компонентам, которым они действительно необходимы. Например, при использовании схемы backend-for-frontend для браузерных JavaScript-приложений, access и refresh токены должны быть доступны только на backend.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.1.2", - "Ordinal": 2, - "Description": "Убедитесь, что клиент принимает значения от авторизационного сервера (например, authorization code или ID Token) только если они получены в результате авторизационного потока, инициированного в той же сессии пользовательского агента и в рамках той же транзакции. Для этого клиентские секреты, такие как proof key для code exchange (PKCE) — 'code_verifier', 'state' или OIDC 'nonce' — должны быть непредсказуемыми, специфичными для транзакции и надежно привязанными как к клиенту, так и к сессии пользовательского агента, в которой началась транзакция.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V10.2", - "Ordinal": 2, - "Name": "Клиент OAuth", - "Items": [ - { - "Shortcode": "V10.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что если используется механизм authorization code flow, OAuth клиент защищён от CSRF, вызывающих запросы токенов либо за счёт использования механизма proof key for code exchange (PKCE), либо за счёт проверки параметра 'state', который был отправлен в запросе авторизации.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что если OAuth клиент может взаимодействовать с более чем одним сервером авторизации, у него есть защита от атак смешивания (mix-up attacks). Например, клиент должен требовать, чтобы сервер авторизации возвращал параметр 'iss' и проверять его в ответах на авторизацию и токены.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.2.3", - "Ordinal": 3, - "Description": "Убедитесь, что OAuth клиент запрашивает только необходимые области доступа (scopes) или другие параметры авторизации в запросах к серверу авторизации.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V10.3", - "Ordinal": 3, - "Name": "Сервер ресурсов OAuth", - "Items": [ - { - "Shortcode": "V10.3.1", - "Ordinal": 1, - "Description": "Убедитесь, что сервер ресурсов принимает только те access токены, которые предназначены для использования с этим сервисом (свойство audience). Эта принадлежность сервису может быть включена в структурированный access токен (например, в поле 'aud' в JWT) или проверяться через endpoint интроспекции токена.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.3.2", - "Ordinal": 2, - "Description": "Убедитесь, что сервер ресурсов принимает решения по авторизации на основе claims из access токена, определяющих делегированную авторизацию. Если присутствуют claims, такие как 'sub', 'scope' и 'authorization_details', они должны участвовать в принятии решения.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.3.3", - "Ordinal": 3, - "Description": "Убедитесь, что если для принятия решения по контролю доступа необходимо однозначно идентифицировать пользователя из access токена (JWT или ответа интроспекции), сервер ресурсов использует claims, которые не могут быть переприсвоены другим пользователям. Обычно это комбинация claims 'iss' и 'sub'.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.3.4", - "Ordinal": 4, - "Description": "Убедитесь, что если сервер ресурсов требует определённой силы аутентификации, методов или свежести аутентификации, он проверяет, что предъявленный access токен удовлетворяет этим требованиям. Например, при наличии, могут использоваться claims OIDC 'acr', 'amr' и 'auth_time'.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.3.5", - "Ordinal": 5, - "Description": "Убедитесь, что сервер ресурсов предотвращает использование украденных access токенов или их повторное использование (replay) неавторизованными лицами, требуя access токены с подтверждением отправителя — например, Mutual TLS для OAuth 2 или OAuth 2 Demonstration of Proof of Possession (DPoP).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V10.4", - "Ordinal": 4, - "Name": "Сервер авторизации OAuth", - "Items": [ - { - "Shortcode": "V10.4.1", - "Ordinal": 1, - "Description": "Убедитесь, что сервер авторизации проверяет URI перенаправления (redirect URI), сверяя его с заранее зарегистрированным списком разрешённых URI для данного клиента (allowlist), используя точное сравнение строк.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.2", - "Ordinal": 2, - "Description": "Убедитесь, что если сервер авторизации возвращает authorization code в ответе авторизации, этот код может быть использован только один раз для запроса токена. При втором валидном запросе с уже использованным кодом сервер должен отклонить запрос и отозвать любые токены, связанные с этим кодом.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.3", - "Ordinal": 3, - "Description": "Убедитесь, что authorization code имеет короткое время жизни. Максимальная продолжительность — до 10 минут для приложений L1 и L2 и до 1 минуты для приложений L3.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.4", - "Ordinal": 4, - "Description": "Убедитесь, что сервер авторизации для конкретного клиента разрешает использование только тех типов авторизации, которые необходимы этому клиенту. Обратите внимание, что тип авторизации Implicit flow и Resource Owner Password Credentials flow больше не должны использоваться.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.5", - "Ordinal": 5, - "Description": "Убедитесь, что сервер авторизации предотвращает атаки повторного использования refresh токенов для публичных клиентов, предпочтительно используя sender-constrained refresh токены, такие как DPoP или сертификат-связанные токены с mutual TLS (mTLS). Для L1 и L2 допускается ротация refresh токенов с обязательной их инвалидацией после использования. Если используется ротация, сервер должен отозвать все refresh токены при попытке использовать уже инвалидированный токен.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.6", - "Ordinal": 6, - "Description": "Убедитесь, что при использовании типа авторизации «Authorization Code» сервер предотвращает атаки перехвата authorization code, требуя Proof Key for Code Exchange (PKCE). В запросах авторизации сервер должен требовать валидное значение 'code_challenge' и не принимать 'code_challenge_method' со значением 'plain'. В запросах токена обязательно валидировать параметр 'code_verifier'.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.7", - "Ordinal": 7, - "Description": "Убедитесь, что если сервер авторизации поддерживает динамическую регистрацию клиентов без аутентификации, он минимизирует риски вредоносных клиентов. Сервер должен валидировать метаданные клиента (например, зарегистрированные URI), обеспечивать согласие пользователя и предупреждать пользователя перед обработкой запроса авторизации от недоверенного клиента.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.8", - "Ordinal": 8, - "Description": "Убедитесь, что refresh токены имеют абсолютный срок действия, включая случаи, когда применяется скользящее время истечения срока.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.9", - "Ordinal": 9, - "Description": "Убедитесь, что пользователи могут отзывать refresh токены и reference access токены через пользовательский интерфейс сервера авторизации для снижения риска от вредоносных клиентов или кражи токенов.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.10", - "Ordinal": 10, - "Description": "Убедитесь, что конфиденциальный клиент аутентифицируется при взаимодействии с сервером авторизации через backchannel, например при запросах токена, pushed authorization requests (PAR) и запросах на отзыв токенов.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.11", - "Ordinal": 11, - "Description": "Убедитесь, что конфигурация сервера авторизации назначает OAuth клиенту только необходимые области доступа (scopes).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.12", - "Ordinal": 12, - "Description": "Убедитесь, что для конкретного клиента сервер авторизации разрешает только те значения 'response_mode', которые необходимы этому клиенту. Например, сервер должен валидировать это значение против ожидаемых или использовать pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.13", - "Ordinal": 13, - "Description": "Убедитесь, что грант типа 'code' всегда используется вместе с pushed authorization requests (PAR).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.14", - "Ordinal": 14, - "Description": "Убедитесь, что сервер авторизации выдаёт только sender-constrained (Proof-of-Possession) access токены, либо с сертификат-связанными токенами через mutual TLS (mTLS), либо DPoP-bound токены (Demonstration of Proof of Possession).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.15", - "Ordinal": 15, - "Description": "Убедитесь, что для серверного клиента (не выполняющегося на устройстве конечного пользователя) сервер авторизации проверяет, что значение параметра 'authorization_details' исходит из клиентского backend и что пользователь не изменял его. Например, это достигается использованием pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.16", - "Ordinal": 16, - "Description": "Убедитесь, что клиент является конфиденциальным и сервер авторизации требует использования сильных методов аутентификации клиента (основанных на криптографии с открытым ключом и устойчивых к атакам повторного воспроизведения), таких как mutual TLS ('tls_client_auth', 'self_signed_tls_client_auth') или private key JWT ('private_key_jwt').", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V10.5", - "Ordinal": 5, - "Name": "Клиент OIDC", - "Items": [ - { - "Shortcode": "V10.5.1", - "Ordinal": 1, - "Description": "Убедитесь, что клиент (relying party) защищается от повторного использования ID Token (replay-атак). Например, это достигается проверкой того, что значение 'nonce' в ID Token совпадает со значением 'nonce', отправленным в запросе аутентификации провайдеру OpenID (authorization server).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.5.2", - "Ordinal": 2, - "Description": "Убедитесь, что клиент однозначно идентифицирует пользователя по утверждениям (claims) ID Token, обычно это 'sub', который не может быть переназначен другому пользователю (в пределах конкретного провайдера идентификации).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.5.3", - "Ordinal": 3, - "Description": "Убедитесь, что клиент отклоняет попытки злоумышленного сервера авторизации выдавать себя за другой сервер авторизации через метаданные сервера авторизации. Клиент должен отклонить метаданные, если URL издателя (issuer) в метаданных не совпадает точно с преднастроенным URL издателя, ожидаемым клиентом.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.5.4", - "Ordinal": 4, - "Description": "Убедитесь, что клиент проверяет, что ID Token предназначен для него (проверка audience), сравнивая значение 'aud' в токене с 'client_id' клиента.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.5.5", - "Ordinal": 5, - "Description": "Убедитесь, что при использовании OIDC back-channel logout клиент снижает риск отказа в обслуживании, вызванный принудительным выходом из системы и путаницей между разными типами JWT (cross-JWT confusion) в процессе логаута. Клиент должен проверить, что токен выхода корректно типизирован со значением 'logout+jwt', содержит claim 'event' с правильным именем участника и не содержит 'nonce'. Также рекомендуется установить короткий срок действия токена (например, 2 минуты).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V10.6", - "Ordinal": 6, - "Name": "Провайдер OpenID", - "Items": [ - { - "Shortcode": "V10.6.1", - "Ordinal": 1, - "Description": "Убедитесь, что провайдер OpenID допускает только значения 'code', 'ciba', 'id_token' или 'id_token code' для параметра response mode. При этом предпочтение отдаётся 'code' по сравнению с 'id_token code' (гибридный поток OIDC), а значение 'token' (любой Implicit flow) не должно использоваться.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.6.2", - "Ordinal": 2, - "Description": "Убедитесь, что провайдер OpenID предотвращает отказ в обслуживании (DoS) через принудительный выход (logout), запрашивая явное подтверждение от конечного пользователя или, если применимо, проверяя параметры в запросе выхода (инициированном relying party), например параметр 'id_token_hint'.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V10.7", - "Ordinal": 7, - "Name": "Управление согласием", - "Items": [ - { - "Shortcode": "V10.7.1", - "Ordinal": 1, - "Description": "Убедитесь, что авторизационный сервер обеспечивает получение согласия пользователя для каждого запроса авторизации. Если личность клиента не может быть подтверждена, сервер авторизации всегда должен явно запрашивать согласие пользователя.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.7.2", - "Ordinal": 2, - "Description": "Убедитесь, что при запросе согласия пользователя авторизационный сервер предоставляет достаточную и понятную информацию о том, на что даётся согласие. При необходимости это должно включать характер запрашиваемых разрешений (обычно основанных на scope, ресурсном сервере, деталях авторизации Rich Authorization Requests (RAR)), идентификацию авторизованного приложения и срок действия этих разрешений.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.7.3", - "Ordinal": 3, - "Description": "Убедитесь, что пользователь может просматривать, изменять и отзывать согласия, которые он предоставил, через авторизационный сервер.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V11", - "Ordinal": 11, - "ShortName": "Cryptography", - "Name": "Криптография", - "Items": [ - { - "Shortcode": "V11.1", - "Ordinal": 1, - "Name": "Инвентаризация и документирование криптографии", - "Items": [ - { - "Shortcode": "V11.1.1", - "Ordinal": 1, - "Description": "Убедитесь, что задокументирована политика управления криптографическими ключами и описан их жизненный цикл в соответствии со стандартом управления ключей, таким как NIST SP 800-57. Убедитесь, что ключи известны только тем сущностям, которым они должны быть доступны (например, ключи не передавались более чем двум участникам для общих секретов и более чем одному участнику для приватных ключей).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.1.2", - "Ordinal": 2, - "Description": "Убедитесь, что проводится инвентаризация криптографических средств, которая непрерывно поддерживается, регулярно обновляется и включает все криптографические ключи, алгоритмы и сертификаты, используемые в приложении. Также должна быть задокументирована информация о том, где ключи могут и не могут использоваться в системе, а также какие типы данных могут и не могут быть защищены с помощью этих ключей.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.1.3", - "Ordinal": 3, - "Description": "Убедитесь, что используются механизмы обнаружения криптографии для идентификации всех случаев применения криптографии в системе , включая операции шифрования, хеширования и цифровой подписи.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.1.4", - "Ordinal": 4, - "Description": "Убедитесь, что ведётся и поддерживается инвентаризация криптографических средств. В неё должен входить документированный план, описывающий переход на новые криптографические стандарты, такие как постквантовая криптография, чтобы своевременно реагировать на будущие угрозы.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V11.2", - "Ordinal": 2, - "Name": "Безопасная реализация криптографии", - "Items": [ - { - "Shortcode": "V11.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что для криптографических операций используются утвержденные в индустрии реализации (включая библиотеки и аппаратные реализации).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что архитектура приложения поддерживает быструю реконфигурацию, усовершенствование или смену в любой момент случайных чисел, аутентифицированного шифрования, MAC, алгоритмов хеширования, длин ключей, количества раундов, шифров и режимов шифрования для защиты от криптографических атак. Также должна поддерживаться возможность смены ключей, паролей и повторного шифрования данных. Это позволит беспрепятственно перейти на постквантовую криптографию (PQC), как только станут широко доступны высоконадёжные реализации одобренных схем или стандартов PQC.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.2.3", - "Ordinal": 3, - "Description": "Убедитесь, что все криптографические примитивы используют как минимум 128-бит стойкости с учетом алгоритма, размера ключа и конфигурации. Например, 256-битный ECC ключ обеспечивает примерно 128 бит безопасности, тогда как для достижения того же уровня безопасности в RSA требуется ключ длиной 3072 бита.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.2.4", - "Ordinal": 4, - "Description": "Убедитесь, что все криптографические операции выполняются за константное время, без использования «short-circuit» операций в сравнениях, вычислениях, возвратах функций для избежания утечек информации.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.2.5", - "Ordinal": 5, - "Description": "Убедитесь, что все криптографические модули обеспечивают безопасное завершение работы при ошибках, а обработка ошибок реализована таким образом, чтобы не создавать уязвимостей, например, таких как атаки Padding Oracle.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V11.3", - "Ordinal": 3, - "Name": "Алгоритмы шифрования", - "Items": [ - { - "Shortcode": "V11.3.1", - "Ordinal": 1, - "Description": "Убедитесь, что не используются небезопасные режимы блочного шифрования (н-р, ECB) и слабые схемы дополнения (padding) (н-р, PKCS#1 v1.5).", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.3.2", - "Ordinal": 2, - "Description": "Убедитесь, что используются только утверждённые шифры и режимы, такие как AES с GCM.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.3.3", - "Ordinal": 3, - "Description": "Убедитесь, что зашифрованные данные защищены от несанкционированного изменения, предпочтительно с использованием утверждённого метода аутентифицированного шифрования или путём комбинирования утверждённого метода шифрования с утверждённым алгоритмом MAC.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.3.4", - "Ordinal": 4, - "Description": "Убедитесь, что случайные числа (nonce), векторы инициализации (IV) и другие одноразовые числа не используются более одного раза для одной и той же пары ключа шифрования и элемента данных. Метод их генерации должен соответствовать требованиям используемого алгоритма.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.3.5", - "Ordinal": 5, - "Description": "Убедитесь, что любая комбинация алгоритма шифрования и алгоритма MAC работает в режиме encrypt-then-MAC (EtM).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V11.4", - "Ordinal": 4, - "Name": "Хеширование и функции на основе хеширования", - "Items": [ - { - "Shortcode": "V11.4.1", - "Ordinal": 1, - "Description": "Убедитесь, что только утвержденные хэш-функции используются для стандартных сценариев использования в криптографии, включая цифровую подпись, HMAC, KDF, генерацию случайных чисел. Запрещено использовать неустойчивые хэш-функции, (н-р, MD5) для любого использования в криптографии.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.4.2", - "Ordinal": 2, - "Description": "Убедитесь, что пароли хранятся с использованием утверждённой, вычислительно затратной функции генерации ключа (также известной как «функция хеширования паролей»), с параметрами, настроенными в соответствии с актуальными рекомендациями. Настройки должны обеспечивать баланс между безопасностью и производительностью, чтобы сделать атаки перебором достаточно сложными для требуемого уровня безопасности.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.4.3", - "Ordinal": 3, - "Description": "Убедитесь, что хэш-функции, используемые в формировании цифровой подписи, как часть аутентификации и целостности данных, устойчивы к коллизиям и имеют достаточную длину.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.4.4", - "Ordinal": 4, - "Description": "Убедитесь, что приложение использует утвержденную функцию генерации ключа с использованием параметров расширения ключа (key stretching) при генерации ключа из пароля. Параметры должны быть сбалансированы с точки зрения безопасности, производительности и устойчивости к атакам полного перебора при компрометации результирующего криптографического ключа.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V11.5", - "Ordinal": 5, - "Name": "Случайные значения", - "Items": [ - { - "Shortcode": "V11.5.1", - "Ordinal": 1, - "Description": "Убедитесь, что все случайные числа и строки, которые должны быть непредсказуемы, должны быть сгенерированы с помощью CSPRNG и иметь хотя бы 128 бит энтропии. Учтите, что UUID не удовлетворяют данному условию.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.5.2", - "Ordinal": 2, - "Description": "Убедитесь, что механизм генерации случайных чисел является надежным даже при высокой нагрузке.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V11.6", - "Ordinal": 6, - "Name": "Криптография с публичным ключом", - "Items": [ - { - "Shortcode": "V11.6.1", - "Ordinal": 1, - "Description": "Убедитесь, что только утвержденные криптографические алгоритмы и режимы операций используются для генерации ключа и инициализации случайного значения для его генерации (seeding), а также для генерации цифровой подписи и верификации. Алгоритмы генерации ключей не должны генерировать небезопасные ключи уязвимые к известным атакам, например, ключи RSA уязвимы к факторизации Ферма.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.6.2", - "Ordinal": 2, - "Description": "Убедитесь, что для обмена ключами используются утверждённые криптографические алгоритмы (например, Диффи-Хеллман) с особым вниманием к обеспечению использования безопасных параметров. Это предотвратит атаки на процесс установления ключа, которые могут привести к атакам «человек посередине» или криптографическим взломам.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V11.7", - "Ordinal": 7, - "Name": "Шифрование данных в процессе использования", - "Items": [ - { - "Shortcode": "V11.7.1", - "Ordinal": 1, - "Description": "Убедитесь, что используется полное шифрование памяти, которое защищает конфиденциальные данные во время их использования, предотвращая доступ к ним неавторизованных пользователей или процессов.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.7.2", - "Ordinal": 2, - "Description": "Убедитесь, что минимизация данных обеспечивает раскрытие минимально необходимого объёма данных во время обработки, а также что данные шифруются сразу после использования или как можно скорее.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V12", - "Ordinal": 12, - "ShortName": "Secure", - "Name": "Безопасная коммуникация", - "Items": [ - { - "Shortcode": "V12.1", - "Ordinal": 1, - "Name": "Общие рекомендации по безопасности TLS", - "Items": [ - { - "Shortcode": "V12.1.1", - "Ordinal": 1, - "Description": "Убедитесь, что включены только актуальные и рекомендуемые версии протокола TLS, такие как TLS 1.2 и TLS 1.3. Наиболее свежая версия TLS должна быть выбрана как предпочтительная.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V12.1.2", - "Ordinal": 2, - "Description": "Убедитесь, что включены рекомендуемые шифронаборы (cipher suites), предпочтение также стоит отдать самому сильному шифронабору. L3 приложения должны поддерживать только те наборы шифров (cipher suites), которые обеспечивают прямую (forward) секретность. Пояснение: Прямая секретность (Forward Secrecy, FS) — это криптографическая особенность, при которой сессионные ключи уникальны для каждой сессии и не зависят от долгосрочных ключей. Это гарантирует, что даже при компрометации долгосрочного ключа злоумышленник не сможет расшифровать ранее перехваченные зашифрованные сессии.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V12.1.3", - "Ordinal": 3, - "Description": "Убедитесь, что приложение проверяет доверенность клиентских сертификатов mTLS, прежде чем использовать идентификацию по сертификату для аутентификации или авторизации.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V12.1.4", - "Ordinal": 4, - "Description": "Убедитесь, что включена и настроена правильная проверка отзыва сертификатов, такая как Online Certificate Status Protocol (OCSP) Stapling.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V12.1.5", - "Ordinal": 5, - "Description": "Убедитесь, что в настройках TLS приложения включена функция Encrypted Client Hello (ECH) для предотвращения раскрытия конфиденциальных метаданных, таких как Server Name Indication (SNI), во время процесса TLS-рукопожатия.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V12.2", - "Ordinal": 2, - "Name": "HTTPS коммуникация с внешними сервисами", - "Items": [ - { - "Shortcode": "V12.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что для всех соединений между клиентом и внешними HTTP-сервисами используется TLS и не происходит отката к небезопасным или незашифрованным протоколам.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V12.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что внешние сервисы используют публично доверенные TLS-сертификаты.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V12.3", - "Ordinal": 3, - "Name": "Общая безопасность межсервисного взаимодействия", - "Items": [ - { - "Shortcode": "V12.3.1", - "Ordinal": 1, - "Description": "Убедитесь, что для всех входящих и исходящих соединений приложения используется зашифрованный протокол, например TLS, включая системы мониторинга, инструменты управления, удалённый доступ и SSH, промежуточное ПО, базы данных, мейнфреймы, партнёрские системы и внешние API. Сервер не должен допускать откат к небезопасным или незашифрованным протоколам.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V12.3.2", - "Ordinal": 2, - "Description": "Убедитесь, что TLS-клиент проверяет сертификат сервера до установления защищенного соединения с TLS-сервером.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V12.3.3", - "Ordinal": 3, - "Description": "Убедитесь, что все внутренние HTTP-взаимодействия между компонентами приложения используют TLS или другой подходящий механизм транспортного шифрования, и не происходит откат к небезопасным или незашифрованным коммуникациям.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V12.3.4", - "Ordinal": 4, - "Description": "Убедитесь, что TLS-соединения между внутренними сервисами используют доверенные сертификаты. Если используются внутренние или самоподписанные сертификаты, потребляющий сервис должен быть настроен на доверие только к конкретным внутренним центрам сертификации (CA) и конкретным самоподписанным сертификатам.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V12.3.5", - "Ordinal": 5, - "Description": "Убедитесь, что сервисы, взаимодействующие внутри системы (intra-service communications), используют строгую аутентификацию для проверки каждого конечного узла. Для проверки подлинности взаимодействующих сторон должны применяться методы строгой аутентификации, такие как аутентификация TLS-клиента, с использованием инфраструктуры открытых ключей и механизмов, устойчивых к атакам повтора (replay attacks). Для микросервисных архитектур рекомендуется использование service mesh для упрощения управления сертификатами и повышения безопасности.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V13", - "Ordinal": 13, - "ShortName": "Configuration", - "Name": "Конфигурация", - "Items": [ - { - "Shortcode": "V13.1", - "Ordinal": 1, - "Name": "Документация конфигурации", - "Items": [ - { - "Shortcode": "V13.1.1", - "Ordinal": 1, - "Description": "Убедитесь, что все необходимые доступы приложения задокументированы. Сюда должны быть включены как внешние сервисы, от которых зависит приложение, так и сценарии, когда конечный пользователь может задавать адреса для внешнего подключения.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.1.2", - "Ordinal": 2, - "Description": "Убедитесь, что для каждого сервиса, используемого приложением, в документации определено максимальное количество одновременных соединений (например, лимиты пула соединений) и описано поведение приложения при достижении этого лимита, включая любые механизмы отказоустойчивости или восстановления, чтобы предотвратить ситуации отказа в обслуживании (DoS).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.1.3", - "Ordinal": 3, - "Description": "Убедитесь, что в документации приложения определены стратегии управления ресурсами для каждой внешней системы или сервиса, которые оно использует (например, базы данных, файловые дескрипторы, потоки, HTTP-соединения). Стратегии должны включать процедуры освобождения ресурсов, настройки таймаутов, обработку сбоев, а также, если реализована логика повторных попыток, указание лимитов, задержек и алгоритмов back-off. Для синхронных HTTP-запросов должны быть заданы короткие таймауты, а повторные запросы должны быть отключены, либо строго ограничены по числу попыток, чтобы предотвратить каскадные задержки и истощение ресурсов.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.1.4", - "Ordinal": 4, - "Description": "Убедитесь, что в документации приложения определены секреты, критически важные для безопасности приложения, а также установлен график их ротации в соответствии с моделью угроз организации и её бизнес-требованиями.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V13.2", - "Ordinal": 2, - "Name": "Конфигурация бэкенд соединений", - "Items": [ - { - "Shortcode": "V13.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что коммуникации между компонентами бэкенда приложения (включая API, промежуточное ПО и уровни данных), которые не поддерживают стандартный механизм пользовательских сессий, проходят с аутентификацией. Аутентификация должна использовать индивидуальные сервисные аккаунты, краткосрочные токены или аутентификацию на основе сертификатов, а не постоянные учётные данные, такие как пароли, API-ключи или общие аккаунты с привилегированным доступом.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что коммуникации между компонентами бэкенда приложения, включая локальные или системные службы, API, промежуточное ПО и уровни данных, выполняются с использованием аккаунтов, которым назначены минимально необходимые привилегии.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.2.3", - "Ordinal": 3, - "Description": "Убедитесь, что если для аутентификации в сервисе используются учётные данные, то используемые потребителем учётные данные не являются стандартными (например, root/root или admin/admin).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.2.4", - "Ordinal": 4, - "Description": "Убедитесь, что используется белый список (allowlist) для определения внешних ресурсов или систем, с которыми приложению разрешено взаимодействовать (например, для исходящих запросов, загрузки данных или доступа к файлам). Этот белый список может быть реализован на уровне приложения, веб-сервера, межсетевого экрана или комбинации различных уровней.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.2.5", - "Ordinal": 5, - "Description": "Убедитесь, что веб- или прикладной сервер настроен с белым списком ресурсов или систем, к которым сервер может отправлять запросы или из которых может загружать данные и файлы.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.2.6", - "Ordinal": 6, - "Description": "Убедитесь, что при подключении приложения к другим сервисам соблюдается задокументированная конфигурация для каждого соединения, включая максимальное количество параллельных соединений, поведение при достижении их максимума, таймауты и стратегии повторных попыток подключения.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V13.3", - "Ordinal": 3, - "Name": "Управление секретами", - "Items": [ - { - "Shortcode": "V13.3.1", - "Ordinal": 1, - "Description": "Убедитесь, что для безопасного создания, хранения, контроля доступа и уничтожения секретов бэкенда используется решение для управления секретами, например, хранилище ключей (key vault). Секретами могут быть пароли, ключевой материал, интеграции с базами данных и сторонними системами, ключи и seed-значения для токенов с ограниченным временем действия, другие внутренние секреты и API-ключи. Секреты не должны включаться в исходный код приложения или артефакты сборки. Для приложений уровня L3 необходимо использовать аппаратное решение, например, аппаратный модуль безопасности (HSM).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.3.2", - "Ordinal": 2, - "Description": "Убедитесь, что доступ к секретным ресурсам осуществляется в соответствии с принципом минимально необходимых привилегий (least privilege).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.3.3", - "Ordinal": 3, - "Description": "Убедитесь, что все криптографические операции выполняются с использованием изолированного модуля безопасности (например, хранилища ключей или аппаратного модуля безопасности), чтобы надежно управлять ключевым материалом и защищать его от утечки за пределы модуля безопасности.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.3.4", - "Ordinal": 4, - "Description": "Убедитесь, что секреты настроены на срок действия и ротацию в соответствии с документацией приложения.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V13.4", - "Ordinal": 4, - "Name": "Непреднамеренная утечка информации", - "Items": [ - { - "Shortcode": "V13.4.1", - "Ordinal": 1, - "Description": "Убедитесь, что приложение развернуто либо без метаданных систем контроля версий (включая папки .git или .svn), либо так, чтобы эти папки были недоступны как извне, так и для самого приложения.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.4.2", - "Ordinal": 2, - "Description": "Убедитесь, что режимы отладки отключены для всех компонентов в промышленной среде, чтобы предотвратить раскрытие функций отладки и утечку информации.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.4.3", - "Ordinal": 3, - "Description": "Убедитесь, что веб-серверы не показывают клиентам списки содержимого каталогов, если это явно не предусмотрено.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.4.4", - "Ordinal": 4, - "Description": "Убедитесь, что метод HTTP TRACE не поддерживается в продуктовой среде, чтобы избежать потенциальной утечки информации.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.4.5", - "Ordinal": 5, - "Description": "Убедитесь, что документация (например, по внутренним API) и мониторинговые эндпоинты не доступны, если это явно не предусмотрено.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.4.6", - "Ordinal": 6, - "Description": "Убедитесь, что приложение не раскрывает подробную информацию о версиях компонентов бэкенда.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.4.7", - "Ordinal": 7, - "Description": "Убедитесь, что веб-слой настроен на обслуживание только файлов с определёнными расширениями, чтобы предотвратить непреднамеренную утечку информации, конфигураций и исходного кода.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V14", - "Ordinal": 14, - "ShortName": "Data", - "Name": "Защита информации", - "Items": [ - { - "Shortcode": "V14.1", - "Ordinal": 1, - "Name": "Документация по защите информации", - "Items": [ - { - "Shortcode": "V14.1.1", - "Ordinal": 1, - "Description": "Убедитесь, что все конфиденциальные данные, создаваемые и обрабатываемые приложением, идентифицированы и классифицированы по уровням защиты. Включая закодированные данные, которые легко декодируются, например, строки Base64 или незашифрованные данные в полезной нагрузке JWT. Уровни защиты должны учитывать требования по защите данных и конфиденциальности, которым должно соответствовать приложение.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V14.1.2", - "Ordinal": 2, - "Description": "Убедитесь, что для каждого уровня защиты конфиденциальных данных требования к защите задокументированы. Они должны включать (но не ограничиваться) требования по шифрованию, проверке целостности, срокам хранения, способам логирования данных, контролю доступа к чувствительным данным в логах, шифрованию на уровне базы данных, применению технологий повышения конфиденциальности, а также другим требованиям по конфиденциальности.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V14.2", - "Ordinal": 2, - "Name": "Базовые меры по защите информации", - "Items": [ - { - "Shortcode": "V14.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что конфиденциальные данные передаются на сервер только в теле HTTP-запроса или в заголовках. URL и строка запроса не должны содержать конфиденциальную информацию, такую как API-ключ или сессионный токен.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V14.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что приложение предотвращает кэширование конфиденциальных данных в серверных компонентах, таких как балансировщики нагрузки и кэши приложений, либо гарантирует их надежное удаление после использования.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V14.2.3", - "Ordinal": 3, - "Description": "Убедитесь, что заранее определённые конфиденциальные данные не отправляются ненадёжным сторонам (например, системам трекинга пользователей), чтобы предотвратить нежелательный сбор данных вне контроля приложения.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V14.2.4", - "Ordinal": 4, - "Description": "Убедитесь, что для конфиденциальных данных реализованы меры по шифрованию, проверке целостности, срокам хранения, способам логирования, контролю доступа к данным в логах, а также применяются технологии повышения конфиденциальности в соответствии с документацией для соответствующего уровня защиты данных.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V14.2.5", - "Ordinal": 5, - "Description": "Убедитесь, что механизмы кэширования настроены так, чтобы кэшировать только ответы с ожидаемым типом содержимого для данного ресурса и не содержать конфиденциального динамического контента. При обращении к несуществующему файлу, веб-сервер должен возвращать ответ 404 или 302, а не подменять на другой существующий файл, что позволит предотвратить атаки типа Web Cache Deception.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V14.2.6", - "Ordinal": 6, - "Description": "Убедитесь, что приложение возвращает только минимально необходимый объем конфиденциальных данных для выполнения своей функциональности. Например, показывает только часть цифр номера кредитной карты, а не полный номер. Если требуется отображение полных данных, они должны быть замаскированы в пользовательском интерфейсе, пока пользователь специально не запросил их просмотр.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V14.2.7", - "Ordinal": 7, - "Description": "Убедитесь, что конфиденциальная информация подлежит классификации по срокам хранения, чтобы устаревшие или ненужные данные удалялись автоматически, по расписанию или по мере необходимости.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V14.2.8", - "Ordinal": 8, - "Description": "Убедитесь, что конфиденциальная информация удаляется из метаданных файлов, загружаемых пользователями, если пользователь явно не согласился на ее хранение.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V14.3", - "Ordinal": 3, - "Name": "Защита данных на стороне клиента", - "Items": [ - { - "Shortcode": "V14.3.1", - "Ordinal": 1, - "Description": "Убедитесь, что аутентифицированные данные очищаются из клиентского хранилища, например, из DOM браузера, после завершения работы клиента или сессии. Заголовок HTTP-ответа Clear-Site-Data может помочь в этом, но клиентская сторона также должна уметь очищать данные, если соединение с сервером недоступно при завершении сессии.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V14.3.2", - "Ordinal": 2, - "Description": "Убедитесь, что приложение устанавливает HTTP-заголовки, достаточные для предотвращения кэширования (например, Cache-Control: no-store), чтобы конфиденциальные данные не сохранялись в браузерах.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V14.3.3", - "Ordinal": 3, - "Description": "Убедитесь, что данные, хранящиеся в браузерном хранилище (например, localStorage, sessionStorage, IndexedDB или cookie), не содержат конфиденциальной информации, за исключением сессионных токенов.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V15", - "Ordinal": 15, - "ShortName": "Secure", - "Name": "Безопасная разработка и архитектура", - "Items": [ - { - "Shortcode": "V15.1", - "Ordinal": 1, - "Name": "Документация по безопасной разработке и архитектуре", - "Items": [ - { - "Shortcode": "V15.1.1", - "Ordinal": 1, - "Description": "Убедитесь, что в документации по приложению определены сроки устранения уязвимостей на основе оценки рисков для внешних зависимостей с уязвимостями и для обновления библиотек в целом, чтобы минимизировать риск, связанный с этими компонентами.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.1.2", - "Ordinal": 2, - "Description": "Убедитесь, что ведется реестр всех используемых сторонних библиотек (например, Software Bill of Materials, SBOM), с обязательной проверкой, что компоненты получены из предопределенных, доверенных и регулярно поддерживаемых репозиториев.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.1.3", - "Ordinal": 3, - "Description": "Убедитесь, что в документации приложения указан функционал, требующий значительных временных или вычислительных ресурсов. Необходимо указать, как предотвратить потерю доступности из-за чрезмерного использования этого функционала и как избежать ситуаций, когда формирование ответа занимает больше времени, чем установленный системой таймаут. Возможные меры защиты могут включать асинхронную обработку, использование очередей и ограничение количества параллельных процессов для каждого пользователя и приложения.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.1.4", - "Ordinal": 4, - "Description": "Убедитесь, что в документации приложения указаны внешние библиотеки, которые считаются «компонентами с повышенным риском».", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.1.5", - "Ordinal": 5, - "Description": "Убедитесь, что в документации приложения выделены те части приложения, в которых используются «функционал с повышенным риском».", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V15.2", - "Ordinal": 2, - "Name": "Архитектура безопасности и зависимости", - "Items": [ - { - "Shortcode": "V15.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что приложение содержит только те компоненты, которые не нарушили задокументированные сроки обновления и исправления.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что в приложении реализованы меры защиты от потери доступности из-за функциональности, требующей много времени или ресурсов, на основе задокументированных решений и стратегий безопасности для этого.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.2.3", - "Ordinal": 3, - "Description": "Убедитесь, что производственная среда включает только те функции, которые необходимы для работы приложения, и не предоставляет лишние функции, такие как тестовый код, примеры кода и инструменты разработки.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.2.4", - "Ordinal": 4, - "Description": "Убедитесь, что сторонние компоненты и все их транзитивные зависимости загружаются только из ожидаемых репозиториев (внутренних или внешних) и отсутствует риск атаки через подмену зависимостей (dependency confusion attack)", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.2.5", - "Ordinal": 5, - "Description": "Убедитесь, что приложение реализует дополнительные меры защиты для тех частей приложения, которые документированы как содержащие «функционал с повышенным риском» или использующие сторонние библиотеки, считающиеся «функционалом с повышенным риском». Это могут быть такие методы, как «песочница», инкапсуляция, контейнеризация или изоляция на сетевом уровне, чтобы задержать и предотвратить продвижение (pivoting) злоумышленников, скомпрометировавших одну часть приложения, к другим частям приложения.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V15.3", - "Ordinal": 3, - "Name": "Безопасное программирование", - "Items": [ - { - "Shortcode": "V15.3.1", - "Ordinal": 1, - "Description": "Убедитесь, что приложение возвращает только необходимое подмножество полей из объекта данных. Например, оно не должно возвращать весь объект данных, поскольку некоторые отдельные поля должны быть недоступны пользователям.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.3.2", - "Ordinal": 2, - "Description": "Убедитесь, что при вызовах внешних URL-адресов бэкэнд приложения настроен так, чтобы не выполнять перенаправления, если только это не предусмотрено функционалом.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.3.3", - "Ordinal": 3, - "Description": "Убедитесь, что в приложении реализованы защитные механизмы против атак типа массового присвоения (mass assignment) путем строгого ограничения разрешенных полей для каждого контроллера и действия, исключая возможность добавления или изменения значений полей, которые не должны быть доступны для данной конкретной операции.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.3.4", - "Ordinal": 4, - "Description": "Убедитесь, что все прокси и промежуточное ПО корректно передают исходный IP-адрес пользователя, используя доверенные поля данных, которые не могут быть изменены конечным пользователем, а приложение и веб-сервер используют это правильное значение для ведения логирования и принятия решений по безопасности, таких как ограничение запросов. При этом следует учитывать, что даже исходный IP-адрес может быть ненадежным из-за динамических IP-адресов, VPN или корпоративных файрволов.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.3.5", - "Ordinal": 5, - "Description": "Убедитесь, что приложение явно проверяет соответствие переменных ожидаемому типу данных и использует строгие операции сравнения. Это необходимо для предотвращения уязвимостей, связанных с type juggling и type confusion, вызванных тем, что код приложения делает предположения о типе переменной.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.3.6", - "Ordinal": 6, - "Description": "Убедитесь, что JavaScript-код написан таким образом, чтобы предотвратить prototype pollution, например, используя Set() или Map() вместо обычных литералов объекта.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.3.7", - "Ordinal": 7, - "Description": "Убедитесь, что приложение защищено от атак типа HTTP Parameter Pollution (HPP), особенно если используемый фреймворк не различает источники параметров запроса (строка запроса, тело запроса, куки или заголовки).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V15.4", - "Ordinal": 4, - "Name": "Безопасная работа с параллельными процессами", - "Items": [ - { - "Shortcode": "V15.4.1", - "Ordinal": 1, - "Description": "Убедитесь, что к общим объектам в многопоточном коде (например, кэшам, файлам или объектам в памяти, используемым несколькими потоками) используется безопасный многопоточный доступ и механизмов синхронизации, таких как блокировки или семафоры, чтобы избежать состояний гонки и повреждения данных.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.4.2", - "Ordinal": 2, - "Description": "Убедитесь, что проверки состояния ресурса, например его существования или разрешений, а также зависящие от него действия выполняются как одна атомарная операция, чтобы предотвратить условия гонки времени проверки и времени использования (TOCTOU). Например, проверка существования файла перед его открытием или проверка прав доступа пользователя перед его предоставлением.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.4.3", - "Ordinal": 3, - "Description": "Убедитесь, что блокировки применяются согласованно, чтобы предотвратить взаимные блокировки потоков (deadlocks) или их бесконечные повторы, а также что логика блокировки инкапсулирована в коде, отвечающем за управление ресурсом. Это гарантирует, что блокировки не могут быть случайно или намеренно изменены внешними классами или кодом.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.4.4", - "Ordinal": 4, - "Description": "Убедитесь, что политики распределения ресурсов предотвращают нехватку ресурсов у потоков, обеспечивая справедливый доступ к ресурсам, например, используя пулы потоков, позволяя потокам с более низким приоритетом выполняться в течение разумного периода времени.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V16", - "Ordinal": 16, - "ShortName": "Security", - "Name": "Журналирование событий безопасности и обработка ошибок", - "Items": [ - { - "Shortcode": "V16.1", - "Ordinal": 1, - "Name": "Документация по ведению логов", - "Items": [ - { - "Shortcode": "V16.1.1", - "Ordinal": 1, - "Description": "Убедитесь в существовании реестра, в котором документируется ведение журнала на каждом уровне технологического стека приложения, включая какие события регистрируются, форматы логов, где хранятся эти журналы, как они используются, как контролируется доступ к ним и как долго хранятся журналы.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V16.2", - "Ordinal": 2, - "Name": "Общее журналирование", - "Items": [ - { - "Shortcode": "V16.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что каждая запись журнала содержит необходимые метаданные (например, когда, где, кто, что), которые позволят провести подробное исследование временной шкалы, когда произошло событие.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что все источники времени компонентов системы журналирования синхронизированы, а временные метки в метаданных событий безопасности используют UTC или содержат явное указание смещения часового пояса. Рекомендуется применять UTC для обеспечения согласованности в распределённых системах и предотвращения ошибок при переходе на летнее/зимнее время.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.2.3", - "Ordinal": 3, - "Description": "Убедитесь, что приложение записывает и передаёт логи исключительно в те файлы и сервисы, которые указаны в реестре журналирования.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.2.4", - "Ordinal": 4, - "Description": "Убедитесь, что логи могут быть прочитаны и коррелированы используемой системой обработки журналов, предпочтительно с использованием общего стандартного формата логирования.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.2.5", - "Ordinal": 5, - "Description": "Убедитесь, что приложение применяет соответствующие меры защиты при логировании конфиденциальных данных в зависимости от уровня их чувствительности: например, полностью запрещает запись в логи таких данных, как учетные данные или платежные реквизиты, а для других данных (например, сессионных токенов) использует хеширование или частичное/полное маскирование.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V16.3", - "Ordinal": 3, - "Name": "Инциденты безопасности", - "Items": [ - { - "Shortcode": "V16.3.1", - "Ordinal": 1, - "Description": "Убедитесь, что все операции аутентификации регистрируются, включая успешные и неудачные попытки. Также следует фиксировать дополнительные метаданные, такие как тип аутентификации или использованные факторы проверки.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.3.2", - "Ordinal": 2, - "Description": "Убедитесь, что ведется журнал неудачных попыток авторизации. Для уровня L3 это должно включать в себя журналирование всех решений об авторизации, включая журналирование доступа к конфиденциальным данным (без регистрации самих конфиденциальных данных).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.3.3", - "Ordinal": 3, - "Description": "Убедитесь, что приложение регистрирует все события безопасности, определенные в документации, а также фиксирует попытки обхода механизмов защиты, включая проверку входных данных, бизнес-логики и системы защиты от автоматизированных атак.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.3.4", - "Ordinal": 4, - "Description": "Убедитесь, что приложение регистрирует в журналах неожиданные ошибки и сбои механизмов безопасности, включая, например, ошибки TLS-соединения на стороне сервера.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V16.4", - "Ordinal": 4, - "Name": "Защита журналов", - "Items": [ - { - "Shortcode": "V16.4.1", - "Ordinal": 1, - "Description": "Убедитесь, что все компоненты системы логирования корректно кодируют данные, чтобы предотвратить атаки типа внедрения в журналы (log injection).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.4.2", - "Ordinal": 2, - "Description": "Убедитесь, что логи защищены от неавторизованного доступа и не могут быть модифицированы.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.4.3", - "Ordinal": 3, - "Description": "Убедитесь, что логи безопасно передаются в логически изолированную систему для анализа, обнаружения угроз, генерации оповещений и эскалации инцидентов. Это гарантирует сохранность журналов даже в случае компрометации основного приложения.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V16.5", - "Ordinal": 5, - "Name": "Обработка ошибок", - "Items": [ - { - "Shortcode": "V16.5.1", - "Ordinal": 1, - "Description": "Убедитесь, что при возникновении непредвиденной или связанной с безопасностью ошибки пользователю возвращается только общее сообщение, гарантируя отсутствие раскрытия конфиденциальных внутренних данных системы, таких как трассировки стека, запросы, секретные ключи и токены.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.5.2", - "Ordinal": 2, - "Description": "Убедитесь, что приложение продолжает работать в безопасном режиме при недоступности внешних ресурсов, используя такие механизмы, как автоматические выключатели (circuit breakers) или плавное снижение функциональности (graceful degradation).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.5.3", - "Ordinal": 3, - "Description": "Убедитесь, что приложение корректно и безопасно завершает работу при возникновении исключений, предотвращая опасные сценарии по типу «fail-open», когда, например, транзакция ошибочно выполняется, несмотря на ошибки в логике валидации.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.5.4", - "Ordinal": 4, - "Description": "Убедитесь, что определён обработчик ошибок «крайние меры», который будет перехватывать все необработанные ошибки. Это необходимо как для предотвращения потери информации об ошибках, которая должна быть записана в файлы журналов, так и для того, чтобы ошибка не остановила весь процесс приложения, что привело бы к потере доступности.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V17", - "Ordinal": 17, - "ShortName": "WebRTC", - "Name": "WebRTC", - "Items": [ - { - "Shortcode": "V17.1", - "Ordinal": 1, - "Name": "TURN-сервер", - "Items": [ - { - "Shortcode": "V17.1.1", - "Ordinal": 1, - "Description": "Убедитесь, что сервис TURN (Traversal Using Relays around NAT) разрешает доступ только к IP-адресам, не зарезервированным для специальных целей (например, внутренние сети, широковещательная рассылка, loopback-адреса). Данное требование применяется как к IPv4, так и к IPv6 адресам.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V17.1.2", - "Ordinal": 2, - "Description": "Убедитесь, что сервис TURN (Traversal Using Relays around NAT) защищен от исчерпания ресурсов при попытках легитимных пользователей открыть чрезмерное количество портов на сервере.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V17.2", - "Ordinal": 2, - "Name": "Требования к медиасерверам", - "Items": [ - { - "Shortcode": "V17.2.1", - "Ordinal": 1, - "Description": "Убедитесь, что ключ сертификата Datagram Transport Layer Security (DTLS) управляется и защищается в соответствии с документированной политикой управления криптографическими ключами.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V17.2.2", - "Ordinal": 2, - "Description": "Убедитесь, что медиасервер настроен на использование только одобренных наборов шифров Datagram Transport Layer Security (DTLS) и защищенного профиля безопасности для расширения DTLS, применяемого при установке ключей для Secure Real-time Transport Protocol (DTLS-SRTP).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V17.2.3", - "Ordinal": 3, - "Description": "Убедитесь, что медиасервер проверяет аутентификацию Secure Real-time Transport Protocol (SRTP) для предотвращения атак с внедрением Real-time Transport Protocol (RTP), которые могут привести к отказу в обслуживании (Denial of Service) или вставке поддельного аудио-/видеоконтента в медиапотоки.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V17.2.4", - "Ordinal": 4, - "Description": "Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика при получении некорректных пакетов Secure Real-time Transport Protocol (SRTP).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V17.2.5", - "Ordinal": 5, - "Description": "Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетами Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V17.2.6", - "Ordinal": 6, - "Description": "Убедитесь, что медиасервер не подвержен уязвимости «Гонка ClientHello» (ClientHello Race Condition) в Datagram Transport Layer Security (DTLS), проверив наличие известных уязвимостей в публичных источниках или выполнив тестирование на воспроизведение условий гонки.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V17.2.7", - "Ordinal": 7, - "Description": "Убедитесь, что механизмы аудио- и видеозаписи, связанные с медиасервером, способны продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетов Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V17.2.8", - "Ordinal": 8, - "Description": "Убедитесь, что сертификат Datagram Transport Layer Security (DTLS) проверяется на соответствие атрибуту отпечатка (fingerprint) в Session Description Protocol (SDP), с немедленным прекращением медиапотока в случае несоответствия — это гарантирует подлинность передаваемых данных.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V17.3", - "Ordinal": 3, - "Name": "Сигнализация", - "Items": [ - { - "Shortcode": "V17.3.1", - "Ordinal": 1, - "Description": "Убедитесь, что сигнальный сервер способен продолжать обработку легитимных входящих сообщений сигнализации даже в условиях флуд-атаки. Для этого необходимо реализовать механизм ограничения частоты запросов (rate limiting) на уровне сигнализации.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V17.3.2", - "Ordinal": 2, - "Description": "Убедитесь, что сигнальный сервер способен продолжать обработку легитимных сообщений сигнализации даже при получении некорректных сообщений, которые могут вызвать отказ в обслуживании (Denial of Service, DoS). Для этого необходимо реализовать: проверку входных данных (input validation), безопасную обработку целочисленных переполнений (integer overflows), защиту от переполнения буферов (buffer overflows) и другие надежные методы обработки ошибок.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - } - ] -} diff --git a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.xml b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.xml deleted file mode 100644 index 6141d39972..0000000000 --- a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.xml +++ /dev/null @@ -1 +0,0 @@ -Application Security Verification Standard ProjectASVSThe OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.V11EncodingКодировка и нейтрализацияV1.11Архитектура кодировки и нейтрализацииV1.1.11Убедитесь, что входные данные декодируются или деэкранируются в каноническую форму (в стандартное представление) только один раз. Декодирование происходит только тогда, когда ожидаются закодированные данные в этой форме, и что это делается перед дальнейшей обработкой входных данных, например, это не выполняется после проверки или нейтрализации.FalseTrue✓True✓V1.1.22Убедитесь, что приложение выполняет кодирование и экранирование выходных данных либо в качестве последнего шага перед использованием интерпретатором, для которого оно предназначено, либо самим интерпретатором.FalseTrue✓True✓V1.22Предотвращение инъекцийV1.2.11Убедитесь, что выходная кодировка для ответа HTTP, документа HTML или документа XML соответствует требуемому контексту, например, кодировка соответствующих символов для элементов HTML, атрибутов HTML, комментариев HTML, CSS или полей заголовка HTTP делается таким способом, чтобы избежать изменения структуры сообщения или документа.True✓True✓True✓V1.2.22Убедитесь, что при динамическом построении URL-адресов недоверенные данные кодируются в соответствии с их контекстом (например, кодирование URL-адресов или кодирование base64url для query или path параметров или пути). Убедитесь, что разрешены только безопасные протоколы URL-адресов (например, запрещен javascript: или data:).True✓True✓True✓V1.2.33Убедитесь, что при динамическом построении содержимого JavaScript (включая JSON) используется кодирование или экранирование выходных данных, чтобы избежать изменения структуры сообщения или документа (чтобы избежать JavaScript и JSON-инъекций).True✓True✓True✓V1.2.44Убедитесь, что выборка данных (Redis, Memcached, чтение из файлов, обращение по API) или запросы к базе данных (например, SQL, HQL, NoSQL, Cypher) используют параметризованные запросы, ORM, Entity Frameworks или иным образом защищены от SQL-инъекций и других атак. Это также актуально при написании хранимых процедур.True✓True✓True✓V1.2.55Убедитесь, что приложение защищено от внедрения команд ОС и что вызовы операционной системы используют параметризованные запросы к ОС или используют контекстное кодирование вывода командной строки.True✓True✓True✓V1.2.66Убедитесь, что приложение защищено от LDAP-инъекций, или что реализованы специальные меры безопасности для их предотвращения.FalseTrue✓True✓V1.2.77Убедитесь, что приложение защищено от атак с использованием XPath-инъекций с помощью параметризации запросов или предварительно скомпилированных запросов.FalseTrue✓True✓V1.2.88Убедитесь, что процессоры LaTeX настроены безопасно (например, не используется флаг «–shell‑escape») и используется разрешенный список команд для предотвращения LaTeX-инъекций.FalseTrue✓True✓V1.2.99Убедитесь, что приложение экранирует специальные символы в регулярных выражениях (обычно с помощью обратной косой черты), чтобы предотвратить их ошибочную интерпретацию как метасимволов.FalseTrue✓True✓V1.2.1010Убедитесь, что приложение защищено от внедрения формул CSV (CSV Injection). Приложение должно следовать правилам экранирования, определенным в RFC 4180, разделы 2.6 и 2.7, при экспорте содержимого CSV. Кроме того, при экспорте в CSV или другие форматы электронных таблиц (такие как XLS, XLSX или ODF) специальные символы (включая '=', '+', '-', '@', '\t' (табуляция), и '\0' (нулевой символ)) должны экранироваться одинарной кавычкой, если они появляются в качестве первого символа в значении поля.FalseFalseTrue✓V1.33НейтрализацияV1.3.11Убедитесь, что все ненадежные входные данные HTML из редакторов WYSIWYG или аналогичных программ нейтрализуются с помощью известных и безопасных библиотек или функций фреймворка для санитизации HTML.True✓True✓True✓V1.3.22Убедитесь, что приложение избегает использования eval() или других динамических функций выполнения кода, таких как Spring Expression Language (SpEL). Если нет альтернативы, любой пользовательский ввод должен быть нейтрализован перед выполнением.True✓True✓True✓V1.3.33Убедитесь, что данные, передаваемые в потенциально опасный контекст, предварительно нейтрализованы, чтобы обеспечить соблюдение мер безопасности, таких как разрешение только тех символов, которые безопасны для данного контекста, и обрезка слишком длинного ввода.FalseTrue✓True✓V1.3.44Убедитесь, что предоставленный пользователем файл .SVG проверен или нейтрализован, чтобы он содержал только теги и атрибуты (например, относящиеся к рисованию), которые безопасны для приложения, например, не содержат скриптов и foreignObject.FalseTrue✓True✓V1.3.55Убедитесь, что приложение нейтралует или отключает предоставленные пользователем скриптовые данные или выражения шаблонных языков, такие как таблицы стилей Markdown, CSS или XSL, BBCode или аналогичные.FalseTrue✓True✓V1.3.66Убедитесь, что приложение защищено от атак с подделкой запросов на стороне сервера (SSRF), проверяя ненадежные данные по разрешенному списку протоколов, доменов, путей и портов, а также нейтрализуя потенциально опасные символы перед использованием данных для вызова другой службы.FalseTrue✓True✓V1.3.77Убедитесь, что приложение защищено от атак с внедрением шаблонов (template injection), не позволяя создавать шаблоны на основе недоверенных входных данных. Если нет альтернативы, любые недоверенные входные данные, включаемые динамически во время создания шаблона, должны быть нейтрализованы или тщательно провалидированы.FalseTrue✓True✓V1.3.88Убедитесь, что приложение надлежащим образом нейтрализует недоверенные входные данные перед использованием в запросах Java Naming and Directory Interface (JNDI) и что JNDI настроен безопасно для предотвращения атак с использованием JNDI-инъекций.FalseTrue✓True✓V1.3.99Убедитесь, что приложение нейтрализует данные перед отправкой в Memcache, чтобы предотвратить атаки методом инъекций.FalseTrue✓True✓V1.3.1010Убедитесь, что строки форматирования, которые могут быть использованы неожидаемым или вредоносным образом, нейтрализуются перед дальнейшим использованием.FalseTrue✓True✓V1.3.1111Убедитесь, что приложение нейтрализует вводимые пользователем данные перед передачей в почтовые системы для защиты от SMTP или IMAP-инъекций.FalseTrue✓True✓V1.3.1212Убедитесь, что регулярные выражения не содержат элементов, вызывающих экспоненциальный возврат, и убедитесь в нейтрализации недоверенных входных данных для предотвращения атак ReDoS или Runaway Regex.FalseFalseTrue✓V1.44Память, строки и неуправляемый кодV1.4.11Убедитесь, что для обнаружения или предотвращения ситуаций переполнения стека, буфера или кучи приложение учитывает размер доступной области памяти при строковых операциях, копировании в память, в арифметике указателей и т.п.FalseTrue✓True✓V1.4.22Убедитесь, что для предотвращения целочисленного переполнения применяется контроль знака, диапазона и типа допустимых входных данных.FalseTrue✓True✓V1.4.33Убедитесь, что динамически выделенная память и ресурсы освобождены, а ссылки или указатели на освобожденную память удалены или установлены в значение null, чтобы предотвратить появление висячих указателей и уязвимостей, связанных с использованием памяти после освобождения.FalseTrue✓True✓V1.55Безопасная десериализацияV1.5.11Убедитесь, что приложение настраивает XML-парсеры на использование строгой конфигурации и что небезопасные функции, такие как разрешение внешних сущностей, отключены для предотвращения атак XML eXternal Entity (XXE).True✓True✓True✓V1.5.22Убедитесь, что десериализация недоверенных данных обеспечивает безопасную обработку ввода, например, используя список разрешенных типов объектов или ограничивая типы объектов, определяемые клиентом, для предотвращения атак десериализации. Механизмы десериализации, которые явно определены как небезопасные, не должны использоваться с недоверенным вводом.FalseTrue✓True✓V1.5.33Убедитесь, что различные парсеры, используемые в приложении для одного и того же типа данных (например, парсеры JSON, XML, URL), выполняют парсинг согласованным образом и используют один и тот же механизм кодирования символов, чтобы избежать таких проблем, как уязвимости взаимодействия JSON (JSON Interoperability) или различное поведение анализа URI или файлов, которые могут использоваться в атаках удаленного включения файлов (RFI) или подделки запросов на стороне сервера (SSRF).FalseFalseTrue✓V22ValidationВалидация и бизнес-логикаV2.11Документация валидации и бизнес-логикиV2.1.11Убедитесь, что в документации приложения определены правила проверки входных данных на соответствие ожидаемой структуре. Это могут быть распространённые форматы данных, такие как номера кредитных карт, адреса электронной почты, номера телефонов, или внутренний формат данных.True✓True✓True✓V2.1.22Убедитесь, что в документации приложения указано, как проверять логическую и контекстную согласованность объединенных данных, например, проверять соответствие района и почтового индекса.FalseTrue✓True✓V2.1.33Убедитесь, что ожидания относительно ограничений и проверок бизнес-логики задокументированы как для уровня отдельного пользователя, так и для глобального уровня всего приложения.FalseTrue✓True✓V2.22Валидация вводаV2.2.11Убедитесь, что входные данные провалидированы для обеспечения соответствия бизнес- или функциональным ожиданиям. Валидация должна осуществляться либо по списку допустимых значений, шаблонов и диапазонов, либо путем сравнения входных данных с ожидаемой структурой и логическими ограничениями в соответствии с предопределенными правилами. Для L1 валидация может быть сосредоточена на входных данных, используемых для принятия конкретных бизнес-решений или решений, связанных с безопасностью. Для L2 и выше это должно применяться ко всем входным данным.True✓True✓True✓V2.2.22Убедитесь, что приложение разработано с принудительной валидацией входных данных на уровне доверенного сервиса. Хотя проверка на стороне клиента повышает удобство использования и должна поощряться, на неё не следует полагаться как на средство контроля безопасности.True✓True✓True✓V2.2.33Убедитесь, что приложение обеспечивает обоснованность комбинаций данных в соответствии с предопределенными правилам. Например: возраст должен соответствовать дате рождения; страна и почтовый индекс; количество товара в заказе и на складе.FalseTrue✓True✓V2.33Безопасность бизнес-логикиV2.3.11Убедитесь, что приложение обрабатывает потоки бизнес-логики для одного и того же пользователя в ожидаемом последовательном порядке шагов и без пропуска шагов.True✓True✓True✓V2.3.22Убедитесь, что ограничения бизнес-логики реализованы в соответствии с документацией приложения, чтобы избежать эксплуатации её недостатков.FalseTrue✓True✓V2.3.33Убедитесь, что транзакции используются на уровне бизнес-логики таким образом, что операция бизнес-логики либо выполняется полностью, либо откатывается к предыдущему корректному состоянию.FalseTrue✓True✓V2.3.44Убедитесь, что на уровне бизнес-логики используются механизмы блокировки, чтобы гарантировать невозможность двойного бронирования ограниченных по количеству ресурсов (например, мест в театре или слотов доставки) путем манипулирования логикой приложения.FalseTrue✓True✓V2.3.55Убедитесь, что для важных потоков бизнес-логики требуется многопользовательское (multi-user) одобрение, чтобы предотвратить несанкционированные или случайные действия. Потоки бизнес-логики могут включать, помимо прочего, крупные денежные переводы, утверждение контрактов, доступ к секретной информации или обход ограничений безопасности на производстве.FalseFalseTrue✓V2.44Анти-автоматизацияV2.4.11Убедитесь, что используются средства противодействия автоматизации для защиты от чрезмерных вызовов функций приложения, которые могут привести к утечке данных, созданию ненужных данных, исчерпанию квот, нарушению ограничений скорости, отказу в обслуживании или чрезмерному использованию дорогостоящих ресурсов.FalseTrue✓True✓V2.4.22Убедитесь, что потоки бизнес-логики требуют реалистичного человеческого времени, предотвращая чрезмерно быструю отправку транзакций.FalseFalseTrue✓V33WebБезопасность веб-интерфейсаV3.11Документация по безопасности веб-интерфейсаV3.1.11Убедитесь, что в документации приложения описаны ожидаемые функции безопасности, которые должны поддерживать браузеры, использующие приложение (такие как HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) и другие соответствующие механизмы безопасности HTTP). В документации также должно быть обязательно определено, как приложение должно себя вести, если некоторые из этих функций недоступны (например, предупреждать пользователя или блокировать доступ).FalseFalseTrue✓V3.22Непреднамеренная интерпретация контентаV3.2.11Убедитесь, что реализованы меры безопасности, предотвращающие отображение контента или функций браузерами в HTTP-ответах в некорректном контексте (например, запрос API, загруженный пользователем файл или другой ресурс запрашивается напрямую). Возможные способы контроля включают: не обрабатывать содержимое, если поля заголовка HTTP-запроса (например, Sec-Fetch-*) не указывают на корректность контекста; использование заголовка и значения Content-Security-Policy: sandbox directive; или использование заголовка и значения Content-Disposition: attachment.True✓True✓True✓V3.2.22Убедитесь, что данные, предназначенные для отображения в виде текста, а не визуализации в виде HTML, обрабатывается с использованием безопасных функций визуализации (таких как createTextNode или textContent), чтобы предотвратить непреднамеренное выполнение содержимого, такого как HTML или JavaScript.True✓True✓True✓V3.2.33Убедитесь, что приложение избегает затирания DOM при использовании JavaScript на стороне клиента, применяя явные объявления переменных, выполняя строгую проверку типов, избегая сохранения глобальных переменных в объекте документа и реализуя изоляцию пространства имен.FalseFalseTrue✓V3.33Настройка файлов cookieV3.3.11Убедитесь, что у файлов cookie установлен атрибут «Secure», и если префикс «__Host‑» не используется в названии cookie, необходимо использовать префикс «__Secure‑».True✓True✓True✓V3.3.22Убедитесь, что значение атрибута SameSite каждой cookie установлено в соответствии с назначением cookie, чтобы ограничить подверженность атакам на восстановление пользовательского интерфейса и атакам с подделкой запросов на уровне браузера, обычно называемым подделкой межсайтовых запросов (CSRF).FalseTrue✓True✓V3.3.33Убедитесь, что cookie имеют префикс «__Host‑» в названии, если только они явно не предназначены для совместного использования с другими хостами.FalseTrue✓True✓V3.3.44Убедитесь, что если значение cookie не должно быть доступно для клиентских скриптов (например, сессионный токен), для cookie должен быть установлен атрибут «HttpOnly», а само значение должно передаваться клиенту только через поле заголовка «Set-Cookie».FalseTrue✓True✓V3.3.55Убедитесь, что при записи cookie приложением общая длина имени и значения cookie не превышает 4096 байт. Слишком большие cookie не будут сохраняться браузером и, следовательно, не будут отправляться с запросами, что помешает пользователю использовать функции приложения, зависящие от этого cookie.FalseFalseTrue✓V3.44Заголовки механизма безопасности браузераV3.4.11Убедитесь, что поле заголовка Strict‑Transport‑Security включено во все ответы для реализации политики HTTP Strict Transport Security (HSTS). Необходимо указать максимальное время не менее 1 года, а для L2 и выше политика должна применяться также ко всем поддоменам.True✓True✓True✓V3.4.22Убедитесь, что поле заголовка Cross‑Origin Resource Sharing (CORS) «Access‑Control‑Allow‑Origin» имеет фиксированное значение, заданное приложением, или, если используется заголовок Origin, оно проверяется по списку доверенных источников. При необходимости использования «Access‑Control‑Allow‑Origin: *» убедитесь, что ответ не содержит конфиденциальной информации.True✓True✓True✓V3.4.33Убедитесь, что HTTP-ответы содержат поле заголовка Content-Security-Policy, которое определяет директивы, гарантирующие загрузку и выполнение браузером только доверенного контента или ресурсов, чтобы ограничить выполнение вредоносного JavaScript. Как минимум, необходимо использовать глобальную политику, включающую директивы object-src «none» и base-uri «none», а также определяющую список разрешенных адресов или использующую одноразовые коды или хэши. Для приложений L3 необходимо определить политику использования 'nonce' или hash-конструкций для каждого ответа.FalseTrue✓True✓V3.4.44Убедитесь, что все HTTP-ответы содержат поле заголовка «X‑Content‑Type‑Options: nosniff». Это предписывает браузерам не использовать анализ контента и определение типа MIME для данного ответа, а также требовать, чтобы значение поля заголовка Content‑Type в ответе соответствовало целевому ресурсу. Например, ответ на запрос стиля принимается только в том случае, если Content‑Type в ответе — «text/css». Это также позволяет браузеру использовать функцию Cross‑Origin Read Blocking (CORB).FalseTrue✓True✓V3.4.55Убедитесь, что приложение устанавливает политику реферера для предотвращения утечки технически конфиденциальных данных сторонним сервисам через поле заголовка HTTP-запроса «Referer». Это можно сделать с помощью поля заголовка HTTP-ответа «Referrer‑Policy» или через атрибуты HTML-элемента. Конфиденциальные данные могут включать путь и данные запроса в URL-адресе, а для внутренних непубличных приложений также имя хоста.FalseTrue✓True✓V3.4.66Убедитесь, что веб-приложение использует директиву frame‑ancestors поля заголовка Content‑Security‑Policy для каждого HTTP-ответа, чтобы гарантировать невозможность его внедрения по умолчанию и внедрение определённых ресурсов разрешено только при необходимости. Обратите внимание, что поле заголовка X‑Frame‑Options, хотя и поддерживается браузерами, устарело и не может быть использовано в качестве основы.FalseTrue✓True✓V3.4.77Убедитесь, что в поле заголовка Content‑Security‑Policy указано место, куда следует сообщать о нарушениях.FalseFalseTrue✓V3.4.88Убедитесь, что все HTTP-ответы, инициирующие рендеринг документа (например, ответы с типом содержимого text/html), включают поле заголовка Cross-Origin-Opener-Policy с директивой same-origin или same-origin-allow-popups (при необходимости). Это предотвращает атаки, злоупотребляющие общим доступом к объектам Window, такие как Tabnabbing и Frame Counting.FalseFalseTrue✓V3.55Браузерное разделение источниковV3.5.11Убедитесь, что, если приложение не использует механизм предварительной проверки CORS для предотвращения запрещённых кросс-доменных запросов на использование чувствительного функционала, эти запросы валидируются на предмет их происхождения от самого приложения. Это можно сделать, используя и проверяя специальные токены для защиты от подделки или требуя дополнительные поля HTTP-заголовка, не входящие в список «простых заголовков» (CORS-safelisted request-header). Это необходимо для защиты от атак с подделкой запросов через браузер, широко известных как межсайтовая подделка запросов (CSRF).True✓True✓True✓V3.5.22Убедитесь, что если приложение использует механизм предварительной проверки CORS для предотвращения неразрешённого использования чувствительного функционала между источниками, вызов этого функционала невозможен с помощью запроса, который не запускает предварительную проверку CORS. Для этого может потребоваться проверка значений полей заголовка запроса «Origin» и «Content-Type» или использование дополнительного поля заголовка, не входящего в безопасный список CORS.True✓True✓True✓V3.5.33Убедитесь, что HTTP-запросы к чувствительному функционалу используют соответствующие HTTP-методы, такие как POST, PUT, PATCH или DELETE, а не методы, определённые спецификацией HTTP как «безопасные», такие как HEAD, OPTIONS или GET. В качестве альтернативы можно использовать строгую валидацию полей заголовка запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, навигационного запроса или загрузки ресурса (например, источника изображения), где это не ожидается.True✓True✓True✓V3.5.44Убедитесь, что отдельные приложения размещены на разных именах хостов, чтобы использовать ограничения, предусмотренные политикой same-origin, включая то, как документы или скрипты, загруженные одним источником, могут взаимодействовать с ресурсами из другого источника, а также ограничения на cookie на основе имени хоста.FalseTrue✓True✓V3.5.55Убедитесь, что сообщения, полученные интерфейсом postMessage, отвергаются, если источник сообщения не является доверенным или если синтаксис сообщения недействителен.FalseTrue✓True✓V3.5.66Убедитесь, что функциональность JSONP не включена нигде в приложении, чтобы избежать атак с использованием межсайтового включения скриптов (XSSI).FalseFalseTrue✓V3.5.77Убедитесь, что данные, требующие авторизации, не включены в ответы ресурсов скриптов, таких как файлы JavaScript, чтобы предотвратить атаки с использованием межсайтового включения скриптов (XSSI).FalseFalseTrue✓V3.5.88Убедитесь, что аутентифицированные ресурсы (такие как изображения, видео, скрипты и другие документы) могут быть загружены или внедрены от имени пользователя только по назначению. Этого можно добиться путём строгой валидации полей заголовка HTTP-запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, или путём установки ограничительного поля заголовка HTTP-ответа Cross‑Origin‑Resource‑Policy, чтобы браузер блокировал возвращаемый контент.FalseFalseTrue✓V3.66Целостность внешних ресурсовV3.6.11Убедитесь, что клиентские ресурсы, такие как библиотеки JavaScript, CSS или веб-шрифты, размещаются только на внешнем сервере (например, в сети доставки контента (Content Delivery Network)), если ресурс статический и имеет версии, а для проверки целостности ресурса используется механизм проверки целостности подресурсов (SRI). Если это невозможно, для каждого ресурса должно быть задокументировано решение по безопасности, обосновывающее это.FalseFalseTrue✓V3.77Другие соображения по безопасности браузераV3.7.11Убедитесь, что приложение использует только те клиентские технологии, которые по-прежнему поддерживаются и считаются безопасными. Примерами технологий, не соответствующих этому требованию, являются плагины NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL или клиентские Java-апплеты.FalseTrue✓True✓V3.7.22Убедитесь, что приложение будет автоматически перенаправлять пользователя на другое имя хоста или домен (который не контролируется приложением), только если этот хост или домен указаны в списке разрешенных.FalseTrue✓True✓V3.7.33Убедитесь, что приложение отображает уведомление, что пользователь перенаправляется на URL-адрес, находящийся вне контроля приложения, с возможностью отмены навигации.FalseFalseTrue✓V3.7.44Убедитесь, что домен верхнего уровня приложения (например, site.tld) ​​добавлен в публичный список предварительной загрузки (preload list) для HTTP Strict Transport Security (HSTS). Это гарантирует, что использование TLS для приложения будет встроено непосредственно в основные браузеры, а не будет полагаться только на поле заголовка ответа Strict-Transport-Security.FalseFalseTrue✓V3.7.55Убедитесь, что приложение ведет себя так, как описано в документации (например, предупреждает пользователя или блокирует доступ), если браузер, используемый для доступа к приложению, не поддерживает ожидаемые функции безопасности.FalseFalseTrue✓V44APIAPI и Веб-сервисV4.11Общая безопасность веб-сервисовV4.1.11Убедитесь, что каждый HTTP-ответ с телом сообщения содержит заголовок Content-Type, который соответствует фактическому содержимому ответа, таким как «text/», «/+xml» и «/xml», включая параметр charset для указания безопасной кодировки символов (например, UTF-8, ISO-8859-1) согласно IANA Media Types.True✓True✓True✓V4.1.22Убедитесь, что только конечные точки, предназначенные для взаимодействия с пользователем через веб-браузер, автоматически перенаправляют HTTP на HTTPS, в то время как другие сервисы или конечные точки не реализуют прозрачные редиректы. Это необходимо, чтобы избежать ситуации, когда клиент ошибочно отправляет незашифрованные HTTP-запросы а из-за того, что запрос по HTTP автоматически перенаправляется на HTTPS другим сервисом без обработки на входе, утечка чувствительных данных остаётся незамеченной.FalseTrue✓True✓V4.1.33Убедитесь, что любой HTTP-заголовок, используемый приложением и устанавливаемый промежуточным уровнем, таким как балансировщик нагрузки, веб-прокси или backend-for-frontend сервис, не может быть переопределён конечным пользователем. Примеры заголовков: X-Real-IP, X-Forwarded-*, X-User-ID.FalseTrue✓True✓V4.1.44Убедитесь, что разрешены только HTTP-методы, которые явно поддерживаются приложением или его API (включая OPTIONS для preflight-запросов), а неиспользуемые методы заблокированы.FalseFalseTrue✓V4.1.55Убедитесь, что для особо чувствительных запросов или транзакций, проходящих через несколько систем, используются цифровые подписи на уровне сообщений, дополнительно к транспортным средствам защиты.FalseFalseTrue✓V4.22Валидация структуры HTTP-сообщенийV4.2.11Убедитесь, что все компоненты приложения (включая балансировщики нагрузки, файрволы и серверы приложений) определяют границы входящих HTTP-сообщений с использованием механизма, соответствующего версии HTTP, чтобы предотвратить HTTP request smuggling. В HTTP/1.x, если присутствует заголовок Transfer-Encoding, заголовок Content-Length должен игнорироваться согласно RFC 2616. При использовании HTTP/2 или HTTP/3, если присутствует Content-Length, веб-сервер должен убедиться, что он совпадает с длиной DATA-фреймов.FalseTrue✓True✓V4.2.22Убедитесь, что при генерации HTTP-сообщений заголовок Content-Length не конфликтует с длиной содержимого, определяемой рамками протокола HTTP, чтобы предотвратить HTTP Request Smuggling.FalseFalseTrue✓V4.2.33Убедитесь, что приложение не отправляет и не принимает HTTP/2 и HTTP/3 сообщения с заголовками, специфичными для соединения, такими как Transfer-Encoding, чтобы предотвратить HTTP Response Splitting и HTTP Header Injection.FalseFalseTrue✓V4.2.44Убедитесь, что приложение принимает HTTP/2 и HTTP/3 запросы только в случае, если поля заголовков и их значения не содержат последовательностей CR (\r), LF (\n) или CRLF (\r\n), чтобы предотвратить HTTP Header Injection.FalseFalseTrue✓V4.2.55Убедитесь, что если приложение (бекенд или фронтенд) формирует и отправляет запросы, оно использует валидацию, очистку или другие механизмы, чтобы не создавать URI (например, для API-вызовов) или HTTP-заголовки (например, Authorization или Cookie) слишком большой длины, чтобы их не принимал приёмник. Это может привести к отказу в обслуживании, например, при отправке слишком длинного запроса (длинный cookie-заголовок), из-за чего сервер постоянно возвращает ошибку.FalseFalseTrue✓V4.33GraphQLV4.3.11Убедитесь, что используется белый список запросов, ограничение глубины вложенности, ограничение количества или анализ стоимости запроса, чтобы предотвратить DoS-атаки на уровне GraphQL или слоя данных из-за дорогостоящих вложенных запросов.FalseTrue✓True✓V4.3.22Убедитесь, что introspection-запросы GraphQL отключены в продакшен-среде, если GraphQL API не предназначен для использования сторонними клиентами.FalseTrue✓True✓V4.44WebSocketV4.4.11Убедитесь, что для всех WebSocket-соединений используется WebSocket поверх TLS (WSS).True✓True✓True✓V4.4.22Убедитесь, что при первоначальном HTTP WebSocket handshake заголовок Origin проверяется на соответствие списку разрешённых источников для приложения.FalseTrue✓True✓V4.4.33Убедитесь, что если стандартное управление сессиями приложения не может быть использовано, применяются специальные токены, соответствующие требованиям безопасности управления сессиями.FalseTrue✓True✓V4.4.44Убедитесь, что специальные токены управления сессиями WebSocket изначально получаются или валидируются через ранее аутентифицированную HTTPS-сессию при переходе от HTTPS к WebSocket.FalseTrue✓True✓V55FileРабота с файламиV5.11Документация по работе с файламиV5.1.11Убедитесь, что документация определяет допустимые типы файлов, ожидаемые расширения и максимальный размер (включая распакованный размер) для каждой функции загрузки. Также убедитесь, что в документации указано, как файлы обезвреживаются для конечных пользователей (например, как приложение ведёт себя при обнаружении вредоносного файла).FalseTrue✓True✓V5.22Загрузка файлов и содержимоеV5.2.11Убедитесь, что приложение принимает только те файлы, которые может обработать без потери производительности или отказа в обслуживании.True✓True✓True✓V5.2.22Убедитесь, что при загрузке файла (включая файлы внутри архивов, таких как ZIP) приложение проверяет, соответствует ли расширение ожидаемому, и валидирует, соответствует ли содержимое типу, указанному в расширении. Это включает проверку начальных 'magic bytes', перезапись изображений, использование специализированных библиотек. Для уровня 1 — достаточно проверок для файлов, критичных с точки зрения бизнеса или безопасности. Для уровней 2 и выше — для всех файлов.True✓True✓True✓V5.2.33Убедитесь, что приложение проверяет архивы (например, zip, gz, docx, odt) на максимально допустимый распакованный размер и максимальное количество файлов до распаковки.FalseTrue✓True✓V5.2.44Убедитесь, что для каждого пользователя установлены квоты на общий размер и количество файлов, чтобы один пользователь не мог переполнить хранилище.FalseFalseTrue✓V5.2.55Убедитесь, что приложение не позволяет загружать архивы с символьными ссылками (symlinks), если это не требуется по бизнес-логике. Если требуется — разрешён только строго определённый список допустимых символьных ссылок.FalseFalseTrue✓V5.2.66Убедитесь, что приложение отклоняет изображения с числом пикселей выше допустимого, чтобы предотвратить атаки 'pixel flood'.FalseFalseTrue✓V5.33Хранение файловV5.3.11Убедитесь, что загруженные или сгенерированные из недоверенного ввода файлы, находящиеся в публичной директории, не исполняются как серверный код при обращении к ним по HTTP.True✓True✓True✓V5.3.22Убедитесь, что при создании путей к файлам приложение использует внутренние или доверенные данные, а не пользовательские имена файлов. Если использование пользовательских имён или метаданных необходимо — требуется строгая проверка и очистка. Это защита от path traversal, LFI, RFI и SSRF.True✓True✓True✓V5.3.33Убедитесь, что при обработке файлов на сервере (например, при распаковке) игнорируются пути, заданные пользователем, во избежание уязвимостей типа 'zip slip'.FalseFalseTrue✓V5.44Скачивание файловV5.4.11Убедитесь, что приложение валидирует или игнорирует имена файлов, переданных пользователем (включая в JSON, JSONP или URL-параметре), и указывает имя файла в заголовке Content-Disposition при ответе.FalseTrue✓True✓V5.4.22Убедитесь, что имена файлов, передаваемые (например, в HTTP-заголовках или вложениях в email), кодируются или очищаются (например, по RFC 6266), чтобы сохранить структуру документа и предотвратить инъекции.FalseTrue✓True✓V5.4.33Убедитесь, что файлы, полученные из недоверенных источников, сканируются антивирусом, чтобы не распространять известное вредоносное содержимое.FalseTrue✓True✓V66AuthenticationАутентификацияV6.11Документация по аутентификацииV6.1.11Убедитесь, что в документации приложения описано, как используются механизмы, такие как ограничение частоты запросов (rate limiting), защита от автоматизации и адаптивные реакции, для защиты от атак, таких как подстановка учётных данных и перебор паролей. Документация должна ясно описывать конфигурацию этих механизмов и предотвращение злонамеренной блокировки аккаунтов.True✓True✓True✓V6.1.22Убедитесь, что задокументирован список контекстно-зависимых слов, запрещённых к использованию в паролях. В него могут входить производные от названий организаций, продуктов, идентификаторов систем, кодовых названий проектов, названий отделов или ролей и тому подобное.FalseTrue✓True✓V6.1.33Убедитесь, что если приложение поддерживает несколько способов аутентификации, то все они документированы вместе с описанием применяемых средств защиты и уровнем стойкости аутентификации, которые должны быть одинаково применены ко всем способам.FalseTrue✓True✓V6.22Безопасность паролейV6.2.11Убедитесь, что пользовательские пароли содержат не менее 8 символов. Рекомендуется минимальная длина в 15 символов.True✓True✓True✓V6.2.22Убедитесь, что пользователи могут менять свои пароли.True✓True✓True✓V6.2.33Убедитесь, что для смены пароля требуется ввести как текущий, так и новый пароль.True✓True✓True✓V6.2.44Убедитесь, что при регистрации или смене пароля введённый пароль проверяется по списку как минимум из 3000 самых популярных паролей, соответствующих политике (например, минимальной длине).True✓True✓True✓V6.2.55Убедитесь, что допускаются пароли любой структуры, без ограничений на использование определённых символов. Не должно быть требований по обязательному наличию заглавных/строчных букв, цифр или специальных символов.True✓True✓True✓V6.2.66Убедитесь, что поля ввода пароля используют type=password для скрытия символов. Разрешено временное отображение всего пароля или последнего введённого символа.True✓True✓True✓V6.2.77Убедитесь, что разрешены вставка (paste), использование менеджеров паролей браузера и внешних менеджеров паролей.True✓True✓True✓V6.2.88Убедитесь, что пароль проверяется строго в том виде, в котором он был введён пользователем — без обрезки, изменения регистра и других модификаций.True✓True✓True✓V6.2.99Убедитесь, что система позволяет использовать пароли длиной не менее 64 символов.FalseTrue✓True✓V6.2.1010Убедитесь, что пароль остаётся действительным, пока не будет скомпрометирован или не будет изменён пользователем. Приложение не должно требовать регулярной смены пароля.FalseTrue✓True✓V6.2.1111Убедитесь, что используется документированный список контекстно-зависимых слов (например, названия компаний, проектов и т.д.) для предотвращения использования легко угадываемых паролей.FalseTrue✓True✓V6.2.1212Убедитесь, что при регистрации или смене пароля проверяется, не входит ли он в список скомпрометированных (утёкших) паролей.FalseTrue✓True✓V6.33Общие требования к безопасности аутентификацииV6.3.11Убедитесь, что реализованы меры защиты от атак типа credential stuffing (массовая подстановка учётных данных) и brute-force (перебор паролей), согласно документации по безопасности приложения.True✓True✓True✓V6.3.22Убедитесь, что в приложении отсутствуют или отключены учётные записи по умолчанию (например, root, admin, sa).True✓True✓True✓V6.3.33Убедитесь, что для доступа к приложению используется либо механизм многофакторной аутентификации, либо комбинация однофакторных. Для уровня L3 один из факторов должен быть аппаратным, обеспечивающим защиту от фишинга, устойчивость к компрометации и подтверждение намерения аутентификации через явное действие пользователя (например, нажатие кнопки на FIDO-ключе или телефоне). Ослабление этих требований допускается только при наличии обоснования и компенсирующих мер.FalseTrue✓True✓V6.3.44Убедитесь, что при наличии нескольких способов аутентификации, они все задокументированы, и для них единообразно применяются меры защиты и уровни доверия.FalseTrue✓True✓V6.3.55Убедитесь, что пользователи получают уведомления о подозрительных попытках аутентификации (удачных и неудачных). Это может включать попытки (например, подключения) с необычного устройства или места, частично успешную MFA, попытку после долгого отсутствия или успешную аутентификацию после серии неудачных.FalseFalseTrue✓V6.3.66Убедитесь, что email не используется ни как однофакторный, ни как многофакторный механизм аутентификации.FalseFalseTrue✓V6.3.77Убедитесь, что пользователи получают уведомление при изменении данных аутентификации, таких как сброс пароля или изменение логина/email.FalseFalseTrue✓V6.3.88Убедитесь, что из сообщений об ошибке, HTTP-кодов ответа или различий во времени ответа нельзя определить, существует ли пользователь с таким логином. Это правило также должно применяться к функциям регистрации и восстановления пароля.FalseFalseTrue✓V6.44Жизненный цикл и восстановление факторов аутентификацииV6.4.11Убедитесь, что начальные пароли или коды активации, генерируемые системой, создаются с использованием надёжного генератора случайных чисел, соответствуют текущей политике паролей и истекают через короткий период времени либо после первого использования. Эти секреты не должны использоваться как постоянные пароли.True✓True✓True✓V6.4.22Убедитесь, что в системе отсутствуют подсказки к паролю или вопросы на знание («секретные вопросы»).True✓True✓True✓V6.4.33Убедитесь, что реализован безопасный процесс сброса забытого пароля, который не обходит активные механизмы многофакторной аутентификации.FalseTrue✓True✓V6.4.44Убедитесь, что в случае утраты одного из факторов MFA проводится удостоверение личности (identity proofing) на том же уровне, что и при первичной регистрации.FalseTrue✓True✓V6.4.55Убедитесь, что инструкции по обновлению истекающих механизмов аутентификации отправляются заранее, с достаточным запасом времени для выполнения замены, при необходимости с настройкой автоматических напоминаний.FalseFalseTrue✓V6.4.66Убедитесь, что администраторы могут инициировать процесс сброса пароля, но не могут задать или выбрать новый пароль за пользователя. Это исключает ситуацию, при которой администратор знает пароль пользователя.FalseFalseTrue✓V6.55Общие требования к многофакторной аутентификацииV6.5.11Убедитесь, что lookup-секреты, внеполосные коды/запросы и TOTP-коды можно использовать только один раз.FalseTrue✓True✓V6.5.22Убедитесь, что при хранении lookup-секретов с энтропией менее 112 бит (например, 19 случайных буквенно-цифровых символов или 34 случайные цифры) они хэшируются с использованием разрешённого алгоритма хеширования паролей и случайной соли минимум 32 бита. Если у секрета ≥112 бит энтропии — допустимо использовать стандартный хэш.FalseTrue✓True✓V6.5.33Убедитесь, что lookup-секреты, коды внеполосной аутентификации и сиды для TOTP генерируются с использованием криптографически стойкого генератора случайных чисел (CSPRNG), чтобы избежать предсказуемых значений.FalseTrue✓True✓V6.5.44Убедитесь, что lookup-секреты и внеполосные коды аутентификации имеют минимум 20 бит энтропии (достаточно, например, 4 случайных алфавитно-цифровых символов или 6 случайных цифр).FalseTrue✓True✓V6.5.55Убедитесь, что все внеполосные запросы, коды и токены, а также TOTP-коды имеют ограниченный срок действия. Максимум для out-of-band — 10 минут, для TOTP — 30 секунд.FalseTrue✓True✓V6.5.66Убедитесь, что любой фактор аутентификации (включая физические устройства) может быть отозван в случае кражи или утери.FalseFalseTrue✓V6.5.77Убедитесь, что биометрические механизмы аутентификации используются только как вторичный фактор — в сочетании с «чем-то, что вы знаете» или «чем-то, что у вас есть».FalseFalseTrue✓V6.5.88Убедитесь, что TOTP-коды проверяются по источнику времени, полученному от доверенного сервиса, а не от клиента или недоверенного источника.FalseFalseTrue✓V6.66Внеполосные механизмы аутентификацииV6.6.11Убедитесь, что механизмы аутентификации через телефонную сеть общего пользования (PSTN) для доставки одноразовых паролей (OTP) по телефону или SMS используются только в случае предварительной валидации номера, при этом предлагаются альтернативные более безопасные методы (например, TOTP), и пользователю сообщаются риски. Для приложений уровня L3 использование телефона и SMS недопустимо.FalseTrue✓True✓V6.6.22Убедитесь, что внеполосные запросы, коды или токены привязаны к исходному запросу аутентификации, для которого они были сгенерированы, и не могут быть использованы повторно для других попыток.FalseTrue✓True✓V6.6.33Убедитесь, что внеполосные механизмы на основе кода защищены от атак методом подбора (brute force) путём применения ограничения частоты запросов (rate limiting). Также рекомендуется использовать коды с энтропией не менее 64 бит.FalseTrue✓True✓V6.6.44Убедитесь, что при использовании push-уведомлений для MFA применяется ограничение частоты (rate limiting), чтобы предотвратить атаки push-бомбинга. Также может помочь механизм сопоставления номеров (number matching).FalseFalseTrue✓V6.77Криптографические механизмы аутентификацииV6.7.11Убедитесь, что сертификаты, используемые для проверки криптографических утверждений об аутентификации, хранятся таким образом, чтобы исключить возможность их модификации.FalseFalseTrue✓V6.7.22Убедитесь, что nonce (случайная строка), используемая в процессе вызова, имеет длину не менее 64 бит и является статистически уникальной или уникальной на протяжении всего срока службы криптографического устройства.FalseFalseTrue✓V6.88Аутентификация с использованием провайдера идентификаций (IdP)V6.8.11Убедитесь, что при поддержке несколькими IdP, невозможно подделать личность пользователя через другой IdP (например, с тем же user ID). Стандартным способом защиты является регистрация пользователя с использованием сочетания ID самого IdP (в качестве пространства имён) и пользовательского ID внутри IdP.FalseTrue✓True✓V6.8.22Убедитесь, что наличие и целостность цифровой подписи в утверждениях аутентификации (например, в JWT или SAML) всегда проверяются, а неподписанные или недействительные утверждения отклоняются.FalseTrue✓True✓V6.8.33Убедитесь, что SAML-утверждения обрабатываются только один раз в течение периода их действия, чтобы исключить атаки воспроизведения (replay attacks).FalseTrue✓True✓V6.8.44Убедитесь, что если приложение использует внешний поставщик идентификации (IdP) и для определенных функций требуется особый уровень, метод или срок действия аутентификации, то приложение использует данные, возвращаемые IdP, для проверки этих условий. Например, при использовании OIDC можно проверить значения полей ID Token — acr, amr, auth_time (если они есть). Если IdP не предоставляет эти данные, приложение должно иметь документированный план действий по умолчанию, предполагающий использование минимально допустимой силы аутентификации (например, одноступенчатая — логин и пароль).FalseTrue✓True✓V77SessionУправление сессиямиV7.11Документация по управлению сессиямиV7.1.11Убедитесь, что тайм-аут бездействия и абсолютное максимальное время жизни сессии задокументированы, соответствуют другим контрольным мерам и сопровождаются обоснованием любых отклонений от требований повторной аутентификации NIST SP 800-63B.FalseTrue✓True✓V7.1.22Убедитесь, что документация определяет допустимое количество одновременных (параллельных) сессий для одного аккаунта, а также поведение системы и действия при достижении этого лимита.FalseTrue✓True✓V7.1.33Убедитесь, что все системы, создающие и управляющие сессиями пользователей в рамках федеративной идентификации (например, SSO), задокументированы вместе с механизмами координации сроков действия сессий, условий завершения и случаев, требующих повторной аутентификации.FalseTrue✓True✓V7.22Базовая безопасность сессийV7.2.11Убедитесь, что все проверки сессионных токенов выполняются на доверенной серверной стороне.True✓True✓True✓V7.2.22Убедитесь, что приложение использует либо автономные токены, либо ссылочные токены, которые генерируются динамически, не используя статические API-секреты или ключи.True✓True✓True✓V7.2.33Убедитесь, что ссылочные токены являются уникальными, создаются с использованием криптографически безопасного генератора псевдослучайных чисел (CSPRNG) и обладают энтропией не менее 128 бит.True✓True✓True✓V7.2.44Убедитесь, что при аутентификации пользователя (включая повторную) создается новый токен сессии, а текущий — аннулируется.True✓True✓True✓V7.33Тайм-ауты сессииV7.3.11Убедитесь, что есть тайм-аут бездействия, после которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.FalseTrue✓True✓V7.3.22Убедитесь, что установлено абсолютное максимальное время жизни сессии, по истечении которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.FalseTrue✓True✓V7.44Завершение сессийV7.4.11Убедитесь, что после завершения сессии (logout, истечение срока) дальнейшее её использование невозможно. Для ссылочных токенов или сессий с сохранением состояния это означает аннулирование на сервере. Для self-contained токенов необходимо реализовать механизм отзыва, например, список отозванных токенов, проверку времени выпуска или ротацию ключей подписи для каждого пользователя.True✓True✓True✓V7.4.22Убедитесь, что при удалении или отключении пользователя все активные сессии немедленно завершаются.True✓True✓True✓V7.4.33Убедитесь, что после изменения или удаления факторов аутентификации (например, смена пароля или MFA) приложение предлагает завершить все другие активные сессии.FalseTrue✓True✓V7.4.44Убедитесь, что на всех страницах, требующих аутентификации, имеется простой и видимый способ выхода.FalseTrue✓True✓V7.4.55Убедитесь, что администраторы могут завершать активные сессии конкретного пользователя или всех пользователей.FalseTrue✓True✓V7.55Защита от злоупотреблений сессиейV7.5.11Убедитесь, что приложение требует полной повторной аутентификации перед изменением чувствительных атрибутов аккаунта, которые могут влиять на аутентификацию (например, email, номер телефона, настройки MFA или данных восстановления доступа).FalseTrue✓True✓V7.5.22Убедитесь, что пользователь может просматривать и (после повторной аутентификации хотя бы по одному фактору) завершать активные сессии.FalseTrue✓True✓V7.5.33Убедитесь, что перед выполнением критически важных операций приложение требует повторной аутентификации (по крайней мере, одного фактора) или дополнительной проверки.FalseFalseTrue✓V7.66Федеративная повторная аутентификацияV7.6.11Убедитесь, что срок действия и завершение сессий между RP и IdP соответствуют документации и включают повторную аутентификацию, если достигнут максимальный допустимый интервал между событиями аутентификации.FalseTrue✓True✓V7.6.22Убедитесь, что создание сессии требует согласия пользователя или явного действия, предотвращающего несанкционированное создание сессий без участия пользователя.FalseTrue✓True✓V88AuthorizationАвторизацияV8.11Документация по авторизацииV8.1.11Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне функций и на уровне данных на основе прав субъекта и атрибутов ресурса.True✓True✓True✓V8.1.22Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне полей (как на чтение, так и на запись) на основе прав субъекта и атрибутов ресурса. Эти правила могут зависеть от других атрибутов объекта данных, например, статуса.FalseTrue✓True✓V8.1.33Убедитесь, что документация определяет, какие атрибуты окружения и контекста (например, время суток, IP-адрес, местоположение, устройство) используются приложением для принятия решений в области аутентификации и авторизации.FalseFalseTrue✓V8.1.44Убедитесь, что документация по аутентификации и авторизации определяет, как используются факторы окружения и контекста в принятии решений, наряду с правилами доступа к функциям, данным и полям. Документация должна содержать оцениваемые атрибуты, пороговые значения риска, действия (разрешить, отказать, повысить уровень аутентификации и др.).FalseFalseTrue✓V8.22Архитектура авторизацииV8.2.11Убедитесь, что приложение обеспечивает доступ на уровне функций (function-level) только субъектам с явными разрешениями.True✓True✓True✓V8.2.22Убедитесь, что приложение обеспечивает доступ на уровне данных (data-specific) только тем субъектам, которым явно предоставлены права к определённым элементам данных, чтобы предотвратить IDOR (Insecure Direct Object Reference) и BOLA-уязвимости (Broken Object Level Authorization).True✓True✓True✓V8.2.33Убедитесь, что приложение обеспечивает доступ на уровне полей (field-level) только тем субъектам, которым явно предоставлены права к определённым полям, чтобы предотвратить BOPLA (Broken Object Property Level Authorization).FalseTrue✓True✓V8.2.44Убедитесь, что реализованы адаптивные меры безопасности, основанные на атрибутах окружения и контекста субъекта (время, местоположение, IP, устройство), которые используются для принятия решений об аутентификации и авторизации, как это определено в документации приложения. Эти меры должны применяться как при попытке субъекта начать новую сессию, так и во время существующей сессии.FalseFalseTrue✓V8.33Авторизация на уровне операцийV8.3.11Убедитесь, что правила авторизации реализуются на доверенном сервисном уровне и не зависят от элементов, которые может контролировать клиент (например, JavaScript на стороне клиента).True✓True✓True✓V8.3.22Убедитесь, что изменения значений, влияющих на авторизацию, применяются немедленно. Если это невозможно (например, при использовании автономных токенов), должны быть реализованы компенсирующие меры: оповещения о попытке несанкционированного действия и откат изменений. Обратите внимание, что данный подход не предотвращает утечку информации.FalseFalseTrue✓V8.3.33Убедитесь, что доступ к объекту осуществляется на основе прав субъекта, инициировавшего запрос, а не прав промежуточного сервиса, действующего от его имени. Например, если пользователь обращается к веб-сервису с автономным токеном для аутентификации, а сервис затем запрашивает данные у другого сервиса, второй сервис должен использовать токен пользователя, а не токен первого сервиса для принятия решения о доступе.FalseFalseTrue✓V8.44Прочие аспекты авторизацииV8.4.11Убедитесь, что в мультитенантных приложениях реализованы механизмы, предотвращающие действия потребителя в отношении арендаторов, к которым у него нет доступа.FalseTrue✓True✓V8.4.22Убедитесь, что доступ к административным интерфейсам защищён несколькими уровнями контроля, включая непрерывную проверку личности, контроль защищённости устройства и анализ контекстных рисков. Недостаточно опираться только на IP-адрес или доверенные устройства.FalseFalseTrue✓V99SelfАвтономные токеныV9.11Источник токена и его целостностьV9.1.11Убедитесь, что автономные токены проверяются на целостность с помощью цифровой подписи или MAC, прежде чем доверять их содержимому.True✓True✓True✓V9.1.22Проверяйте, что автономные токены создаются и проверяются исключительно с помощью алгоритмов из списка допустимых в данном контексте. Список допустимых алгоритмов должен включать только разрешенные алгоритмы (желательно либо только симметричные, либо только асимметричные) и ни в коем случае не содержать алгоритм None. Если необходимо поддерживать оба типа алгоритмов, потребуются дополнительные средства контроля для предотвращения путаницы с ключами (key confusion).True✓True✓True✓V9.1.33Убедитесь, что ключи, используемые для проверки автономных токенов, получены из доверенных, предварительно настроенных источников. Это предотвращает возможность указания злоумышленниками ненадёжных источников и ключей. Для JWT и других JWS структур заголовки 'jku', 'x5u' и 'jwk' должны проверяться по белому списку.True✓True✓True✓V9.22Содержимое токенаV9.2.11Убедитесь, что при указанном сроке действия токен и его содержимое принимаются только в том случае, если срок действия токена не истёк. Например, для JWT нужно проверить поля 'nbf' и 'exp'.True✓True✓True✓V9.2.22Убедитесь, что сервис, принимающий токен, проверяет его тип и соответствие назначению перед обработкой содержимого токена. Например, для принятия решений об авторизации могут быть приняты только Access Token, а для подтверждения аутентификации пользователя — только ID Token.FalseTrue✓True✓V9.2.33Убедитесь, что сервис принимает только токены, предназначенные для использования с этим сервисом (audience). Для JWT это можно сделать, проверив наличие утверждения «aud» по белому списку, определенному в сервисе.FalseTrue✓True✓V9.2.44Убедитесь, что, если эмитент токенов использует один и тот же закрытый ключ для выпуска токенов различным сервисам (audiences), выпущенные токены содержат явное указание целевых сервисов. Это предотвратит повторное использования токенов в не предназначенных для них сервисах. Если идентификатор сервиса (audience identifier) назначается динамически, эмитент токенов должен проверить audiences для исключения подмены получателей (audience impersonation).FalseTrue✓True✓V1010OAuthOAuth и OIDCV10.11Общие требования безопасности OAuth и OIDCV10.1.11Убедитесь, что токены передаются только тем компонентам, которым они действительно необходимы. Например, при использовании схемы backend-for-frontend для браузерных JavaScript-приложений, access и refresh токены должны быть доступны только на backend.FalseTrue✓True✓V10.1.22Убедитесь, что клиент принимает значения от авторизационного сервера (например, authorization code или ID Token) только если они получены в результате авторизационного потока, инициированного в той же сессии пользовательского агента и в рамках той же транзакции. Для этого клиентские секреты, такие как proof key для code exchange (PKCE) — 'code_verifier', 'state' или OIDC 'nonce' — должны быть непредсказуемыми, специфичными для транзакции и надежно привязанными как к клиенту, так и к сессии пользовательского агента, в которой началась транзакция.FalseTrue✓True✓V10.22Клиент OAuthV10.2.11Убедитесь, что если используется механизм authorization code flow, OAuth клиент защищён от CSRF, вызывающих запросы токенов либо за счёт использования механизма proof key for code exchange (PKCE), либо за счёт проверки параметра 'state', который был отправлен в запросе авторизации.FalseTrue✓True✓V10.2.22Убедитесь, что если OAuth клиент может взаимодействовать с более чем одним сервером авторизации, у него есть защита от атак смешивания (mix-up attacks). Например, клиент должен требовать, чтобы сервер авторизации возвращал параметр 'iss' и проверять его в ответах на авторизацию и токены.FalseTrue✓True✓V10.2.33Убедитесь, что OAuth клиент запрашивает только необходимые области доступа (scopes) или другие параметры авторизации в запросах к серверу авторизации.FalseFalseTrue✓V10.33Сервер ресурсов OAuthV10.3.11Убедитесь, что сервер ресурсов принимает только те access токены, которые предназначены для использования с этим сервисом (свойство audience). Эта принадлежность сервису может быть включена в структурированный access токен (например, в поле 'aud' в JWT) или проверяться через endpoint интроспекции токена.FalseTrue✓True✓V10.3.22Убедитесь, что сервер ресурсов принимает решения по авторизации на основе claims из access токена, определяющих делегированную авторизацию. Если присутствуют claims, такие как 'sub', 'scope' и 'authorization_details', они должны участвовать в принятии решения.FalseTrue✓True✓V10.3.33Убедитесь, что если для принятия решения по контролю доступа необходимо однозначно идентифицировать пользователя из access токена (JWT или ответа интроспекции), сервер ресурсов использует claims, которые не могут быть переприсвоены другим пользователям. Обычно это комбинация claims 'iss' и 'sub'.FalseTrue✓True✓V10.3.44Убедитесь, что если сервер ресурсов требует определённой силы аутентификации, методов или свежести аутентификации, он проверяет, что предъявленный access токен удовлетворяет этим требованиям. Например, при наличии, могут использоваться claims OIDC 'acr', 'amr' и 'auth_time'.FalseTrue✓True✓V10.3.55Убедитесь, что сервер ресурсов предотвращает использование украденных access токенов или их повторное использование (replay) неавторизованными лицами, требуя access токены с подтверждением отправителя — например, Mutual TLS для OAuth 2 или OAuth 2 Demonstration of Proof of Possession (DPoP).FalseFalseTrue✓V10.44Сервер авторизации OAuthV10.4.11Убедитесь, что сервер авторизации проверяет URI перенаправления (redirect URI), сверяя его с заранее зарегистрированным списком разрешённых URI для данного клиента (allowlist), используя точное сравнение строк.True✓True✓True✓V10.4.22Убедитесь, что если сервер авторизации возвращает authorization code в ответе авторизации, этот код может быть использован только один раз для запроса токена. При втором валидном запросе с уже использованным кодом сервер должен отклонить запрос и отозвать любые токены, связанные с этим кодом.True✓True✓True✓V10.4.33Убедитесь, что authorization code имеет короткое время жизни. Максимальная продолжительность — до 10 минут для приложений L1 и L2 и до 1 минуты для приложений L3.True✓True✓True✓V10.4.44Убедитесь, что сервер авторизации для конкретного клиента разрешает использование только тех типов авторизации, которые необходимы этому клиенту. Обратите внимание, что тип авторизации Implicit flow и Resource Owner Password Credentials flow больше не должны использоваться.True✓True✓True✓V10.4.55Убедитесь, что сервер авторизации предотвращает атаки повторного использования refresh токенов для публичных клиентов, предпочтительно используя sender-constrained refresh токены, такие как DPoP или сертификат-связанные токены с mutual TLS (mTLS). Для L1 и L2 допускается ротация refresh токенов с обязательной их инвалидацией после использования. Если используется ротация, сервер должен отозвать все refresh токены при попытке использовать уже инвалидированный токен.True✓True✓True✓V10.4.66Убедитесь, что при использовании типа авторизации «Authorization Code» сервер предотвращает атаки перехвата authorization code, требуя Proof Key for Code Exchange (PKCE). В запросах авторизации сервер должен требовать валидное значение 'code_challenge' и не принимать 'code_challenge_method' со значением 'plain'. В запросах токена обязательно валидировать параметр 'code_verifier'.FalseTrue✓True✓V10.4.77Убедитесь, что если сервер авторизации поддерживает динамическую регистрацию клиентов без аутентификации, он минимизирует риски вредоносных клиентов. Сервер должен валидировать метаданные клиента (например, зарегистрированные URI), обеспечивать согласие пользователя и предупреждать пользователя перед обработкой запроса авторизации от недоверенного клиента.FalseTrue✓True✓V10.4.88Убедитесь, что refresh токены имеют абсолютный срок действия, включая случаи, когда применяется скользящее время истечения срока.FalseTrue✓True✓V10.4.99Убедитесь, что пользователи могут отзывать refresh токены и reference access токены через пользовательский интерфейс сервера авторизации для снижения риска от вредоносных клиентов или кражи токенов.FalseTrue✓True✓V10.4.1010Убедитесь, что конфиденциальный клиент аутентифицируется при взаимодействии с сервером авторизации через backchannel, например при запросах токена, pushed authorization requests (PAR) и запросах на отзыв токенов.FalseTrue✓True✓V10.4.1111Убедитесь, что конфигурация сервера авторизации назначает OAuth клиенту только необходимые области доступа (scopes).FalseTrue✓True✓V10.4.1212Убедитесь, что для конкретного клиента сервер авторизации разрешает только те значения 'response_mode', которые необходимы этому клиенту. Например, сервер должен валидировать это значение против ожидаемых или использовать pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).FalseFalseTrue✓V10.4.1313Убедитесь, что грант типа 'code' всегда используется вместе с pushed authorization requests (PAR).FalseFalseTrue✓V10.4.1414Убедитесь, что сервер авторизации выдаёт только sender-constrained (Proof-of-Possession) access токены, либо с сертификат-связанными токенами через mutual TLS (mTLS), либо DPoP-bound токены (Demonstration of Proof of Possession).FalseFalseTrue✓V10.4.1515Убедитесь, что для серверного клиента (не выполняющегося на устройстве конечного пользователя) сервер авторизации проверяет, что значение параметра 'authorization_details' исходит из клиентского backend и что пользователь не изменял его. Например, это достигается использованием pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).FalseFalseTrue✓V10.4.1616Убедитесь, что клиент является конфиденциальным и сервер авторизации требует использования сильных методов аутентификации клиента (основанных на криптографии с открытым ключом и устойчивых к атакам повторного воспроизведения), таких как mutual TLS ('tls_client_auth', 'self_signed_tls_client_auth') или private key JWT ('private_key_jwt').FalseFalseTrue✓V10.55Клиент OIDCV10.5.11Убедитесь, что клиент (relying party) защищается от повторного использования ID Token (replay-атак). Например, это достигается проверкой того, что значение 'nonce' в ID Token совпадает со значением 'nonce', отправленным в запросе аутентификации провайдеру OpenID (authorization server).FalseTrue✓True✓V10.5.22Убедитесь, что клиент однозначно идентифицирует пользователя по утверждениям (claims) ID Token, обычно это 'sub', который не может быть переназначен другому пользователю (в пределах конкретного провайдера идентификации).FalseTrue✓True✓V10.5.33Убедитесь, что клиент отклоняет попытки злоумышленного сервера авторизации выдавать себя за другой сервер авторизации через метаданные сервера авторизации. Клиент должен отклонить метаданные, если URL издателя (issuer) в метаданных не совпадает точно с преднастроенным URL издателя, ожидаемым клиентом.FalseTrue✓True✓V10.5.44Убедитесь, что клиент проверяет, что ID Token предназначен для него (проверка audience), сравнивая значение 'aud' в токене с 'client_id' клиента.FalseTrue✓True✓V10.5.55Убедитесь, что при использовании OIDC back-channel logout клиент снижает риск отказа в обслуживании, вызванный принудительным выходом из системы и путаницей между разными типами JWT (cross-JWT confusion) в процессе логаута. Клиент должен проверить, что токен выхода корректно типизирован со значением 'logout+jwt', содержит claim 'event' с правильным именем участника и не содержит 'nonce'. Также рекомендуется установить короткий срок действия токена (например, 2 минуты).FalseTrue✓True✓V10.66Провайдер OpenIDV10.6.11Убедитесь, что провайдер OpenID допускает только значения 'code', 'ciba', 'id_token' или 'id_token code' для параметра response mode. При этом предпочтение отдаётся 'code' по сравнению с 'id_token code' (гибридный поток OIDC), а значение 'token' (любой Implicit flow) не должно использоваться.FalseTrue✓True✓V10.6.22Убедитесь, что провайдер OpenID предотвращает отказ в обслуживании (DoS) через принудительный выход (logout), запрашивая явное подтверждение от конечного пользователя или, если применимо, проверяя параметры в запросе выхода (инициированном relying party), например параметр 'id_token_hint'.FalseTrue✓True✓V10.77Управление согласиемV10.7.11Убедитесь, что авторизационный сервер обеспечивает получение согласия пользователя для каждого запроса авторизации. Если личность клиента не может быть подтверждена, сервер авторизации всегда должен явно запрашивать согласие пользователя.FalseTrue✓True✓V10.7.22Убедитесь, что при запросе согласия пользователя авторизационный сервер предоставляет достаточную и понятную информацию о том, на что даётся согласие. При необходимости это должно включать характер запрашиваемых разрешений (обычно основанных на scope, ресурсном сервере, деталях авторизации Rich Authorization Requests (RAR)), идентификацию авторизованного приложения и срок действия этих разрешений.FalseTrue✓True✓V10.7.33Убедитесь, что пользователь может просматривать, изменять и отзывать согласия, которые он предоставил, через авторизационный сервер.FalseTrue✓True✓V1111CryptographyКриптографияV11.11Инвентаризация и документирование криптографииV11.1.11Убедитесь, что задокументирована политика управления криптографическими ключами и описан их жизненный цикл в соответствии со стандартом управления ключей, таким как NIST SP 800-57. Убедитесь, что ключи известны только тем сущностям, которым они должны быть доступны (например, ключи не передавались более чем двум участникам для общих секретов и более чем одному участнику для приватных ключей).FalseTrue✓True✓V11.1.22Убедитесь, что проводится инвентаризация криптографических средств, которая непрерывно поддерживается, регулярно обновляется и включает все криптографические ключи, алгоритмы и сертификаты, используемые в приложении. Также должна быть задокументирована информация о том, где ключи могут и не могут использоваться в системе, а также какие типы данных могут и не могут быть защищены с помощью этих ключей.FalseTrue✓True✓V11.1.33Убедитесь, что используются механизмы обнаружения криптографии для идентификации всех случаев применения криптографии в системе , включая операции шифрования, хеширования и цифровой подписи.FalseFalseTrue✓V11.1.44Убедитесь, что ведётся и поддерживается инвентаризация криптографических средств. В неё должен входить документированный план, описывающий переход на новые криптографические стандарты, такие как постквантовая криптография, чтобы своевременно реагировать на будущие угрозы.FalseFalseTrue✓V11.22Безопасная реализация криптографииV11.2.11Убедитесь, что для криптографических операций используются утвержденные в индустрии реализации (включая библиотеки и аппаратные реализации).FalseTrue✓True✓V11.2.22Убедитесь, что архитектура приложения поддерживает быструю реконфигурацию, усовершенствование или смену в любой момент случайных чисел, аутентифицированного шифрования, MAC, алгоритмов хеширования, длин ключей, количества раундов, шифров и режимов шифрования для защиты от криптографических атак. Также должна поддерживаться возможность смены ключей, паролей и повторного шифрования данных. Это позволит беспрепятственно перейти на постквантовую криптографию (PQC), как только станут широко доступны высоконадёжные реализации одобренных схем или стандартов PQC.FalseTrue✓True✓V11.2.33Убедитесь, что все криптографические примитивы используют как минимум 128-бит стойкости с учетом алгоритма, размера ключа и конфигурации. Например, 256-битный ECC ключ обеспечивает примерно 128 бит безопасности, тогда как для достижения того же уровня безопасности в RSA требуется ключ длиной 3072 бита.FalseTrue✓True✓V11.2.44Убедитесь, что все криптографические операции выполняются за константное время, без использования «short-circuit» операций в сравнениях, вычислениях, возвратах функций для избежания утечек информации.FalseFalseTrue✓V11.2.55Убедитесь, что все криптографические модули обеспечивают безопасное завершение работы при ошибках, а обработка ошибок реализована таким образом, чтобы не создавать уязвимостей, например, таких как атаки Padding Oracle.FalseFalseTrue✓V11.33Алгоритмы шифрованияV11.3.11Убедитесь, что не используются небезопасные режимы блочного шифрования (н-р, ECB) и слабые схемы дополнения (padding) (н-р, PKCS#1 v1.5).True✓True✓True✓V11.3.22Убедитесь, что используются только утверждённые шифры и режимы, такие как AES с GCM.True✓True✓True✓V11.3.33Убедитесь, что зашифрованные данные защищены от несанкционированного изменения, предпочтительно с использованием утверждённого метода аутентифицированного шифрования или путём комбинирования утверждённого метода шифрования с утверждённым алгоритмом MAC.FalseTrue✓True✓V11.3.44Убедитесь, что случайные числа (nonce), векторы инициализации (IV) и другие одноразовые числа не используются более одного раза для одной и той же пары ключа шифрования и элемента данных. Метод их генерации должен соответствовать требованиям используемого алгоритма.FalseFalseTrue✓V11.3.55Убедитесь, что любая комбинация алгоритма шифрования и алгоритма MAC работает в режиме encrypt-then-MAC (EtM).FalseFalseTrue✓V11.44Хеширование и функции на основе хешированияV11.4.11Убедитесь, что только утвержденные хэш-функции используются для стандартных сценариев использования в криптографии, включая цифровую подпись, HMAC, KDF, генерацию случайных чисел. Запрещено использовать неустойчивые хэш-функции, (н-р, MD5) для любого использования в криптографии.True✓True✓True✓V11.4.22Убедитесь, что пароли хранятся с использованием утверждённой, вычислительно затратной функции генерации ключа (также известной как «функция хеширования паролей»), с параметрами, настроенными в соответствии с актуальными рекомендациями. Настройки должны обеспечивать баланс между безопасностью и производительностью, чтобы сделать атаки перебором достаточно сложными для требуемого уровня безопасности.FalseTrue✓True✓V11.4.33Убедитесь, что хэш-функции, используемые в формировании цифровой подписи, как часть аутентификации и целостности данных, устойчивы к коллизиям и имеют достаточную длину.FalseTrue✓True✓V11.4.44Убедитесь, что приложение использует утвержденную функцию генерации ключа с использованием параметров расширения ключа (key stretching) при генерации ключа из пароля. Параметры должны быть сбалансированы с точки зрения безопасности, производительности и устойчивости к атакам полного перебора при компрометации результирующего криптографического ключа.FalseTrue✓True✓V11.55Случайные значенияV11.5.11Убедитесь, что все случайные числа и строки, которые должны быть непредсказуемы, должны быть сгенерированы с помощью CSPRNG и иметь хотя бы 128 бит энтропии. Учтите, что UUID не удовлетворяют данному условию.FalseTrue✓True✓V11.5.22Убедитесь, что механизм генерации случайных чисел является надежным даже при высокой нагрузке.FalseFalseTrue✓V11.66Криптография с публичным ключомV11.6.11Убедитесь, что только утвержденные криптографические алгоритмы и режимы операций используются для генерации ключа и инициализации случайного значения для его генерации (seeding), а также для генерации цифровой подписи и верификации. Алгоритмы генерации ключей не должны генерировать небезопасные ключи уязвимые к известным атакам, например, ключи RSA уязвимы к факторизации Ферма.FalseTrue✓True✓V11.6.22Убедитесь, что для обмена ключами используются утверждённые криптографические алгоритмы (например, Диффи-Хеллман) с особым вниманием к обеспечению использования безопасных параметров. Это предотвратит атаки на процесс установления ключа, которые могут привести к атакам «человек посередине» или криптографическим взломам.FalseFalseTrue✓V11.77Шифрование данных в процессе использованияV11.7.11Убедитесь, что используется полное шифрование памяти, которое защищает конфиденциальные данные во время их использования, предотвращая доступ к ним неавторизованных пользователей или процессов.FalseFalseTrue✓V11.7.22Убедитесь, что минимизация данных обеспечивает раскрытие минимально необходимого объёма данных во время обработки, а также что данные шифруются сразу после использования или как можно скорее.FalseFalseTrue✓V1212SecureБезопасная коммуникацияV12.11Общие рекомендации по безопасности TLSV12.1.11Убедитесь, что включены только актуальные и рекомендуемые версии протокола TLS, такие как TLS 1.2 и TLS 1.3. Наиболее свежая версия TLS должна быть выбрана как предпочтительная.True✓True✓True✓V12.1.22Убедитесь, что включены рекомендуемые шифронаборы (cipher suites), предпочтение также стоит отдать самому сильному шифронабору. L3 приложения должны поддерживать только те наборы шифров (cipher suites), которые обеспечивают прямую (forward) секретность. Пояснение: Прямая секретность (Forward Secrecy, FS) — это криптографическая особенность, при которой сессионные ключи уникальны для каждой сессии и не зависят от долгосрочных ключей. Это гарантирует, что даже при компрометации долгосрочного ключа злоумышленник не сможет расшифровать ранее перехваченные зашифрованные сессии.FalseTrue✓True✓V12.1.33Убедитесь, что приложение проверяет доверенность клиентских сертификатов mTLS, прежде чем использовать идентификацию по сертификату для аутентификации или авторизации.FalseTrue✓True✓V12.1.44Убедитесь, что включена и настроена правильная проверка отзыва сертификатов, такая как Online Certificate Status Protocol (OCSP) Stapling.FalseFalseTrue✓V12.1.55Убедитесь, что в настройках TLS приложения включена функция Encrypted Client Hello (ECH) для предотвращения раскрытия конфиденциальных метаданных, таких как Server Name Indication (SNI), во время процесса TLS-рукопожатия.FalseFalseTrue✓V12.22HTTPS коммуникация с внешними сервисамиV12.2.11Убедитесь, что для всех соединений между клиентом и внешними HTTP-сервисами используется TLS и не происходит отката к небезопасным или незашифрованным протоколам.True✓True✓True✓V12.2.22Убедитесь, что внешние сервисы используют публично доверенные TLS-сертификаты.True✓True✓True✓V12.33Общая безопасность межсервисного взаимодействияV12.3.11Убедитесь, что для всех входящих и исходящих соединений приложения используется зашифрованный протокол, например TLS, включая системы мониторинга, инструменты управления, удалённый доступ и SSH, промежуточное ПО, базы данных, мейнфреймы, партнёрские системы и внешние API. Сервер не должен допускать откат к небезопасным или незашифрованным протоколам.FalseTrue✓True✓V12.3.22Убедитесь, что TLS-клиент проверяет сертификат сервера до установления защищенного соединения с TLS-сервером.FalseTrue✓True✓V12.3.33Убедитесь, что все внутренние HTTP-взаимодействия между компонентами приложения используют TLS или другой подходящий механизм транспортного шифрования, и не происходит откат к небезопасным или незашифрованным коммуникациям.FalseTrue✓True✓V12.3.44Убедитесь, что TLS-соединения между внутренними сервисами используют доверенные сертификаты. Если используются внутренние или самоподписанные сертификаты, потребляющий сервис должен быть настроен на доверие только к конкретным внутренним центрам сертификации (CA) и конкретным самоподписанным сертификатам.FalseTrue✓True✓V12.3.55Убедитесь, что сервисы, взаимодействующие внутри системы (intra-service communications), используют строгую аутентификацию для проверки каждого конечного узла. Для проверки подлинности взаимодействующих сторон должны применяться методы строгой аутентификации, такие как аутентификация TLS-клиента, с использованием инфраструктуры открытых ключей и механизмов, устойчивых к атакам повтора (replay attacks). Для микросервисных архитектур рекомендуется использование service mesh для упрощения управления сертификатами и повышения безопасности.FalseFalseTrue✓V1313ConfigurationКонфигурацияV13.11Документация конфигурацииV13.1.11Убедитесь, что все необходимые доступы приложения задокументированы. Сюда должны быть включены как внешние сервисы, от которых зависит приложение, так и сценарии, когда конечный пользователь может задавать адреса для внешнего подключения.FalseTrue✓True✓V13.1.22Убедитесь, что для каждого сервиса, используемого приложением, в документации определено максимальное количество одновременных соединений (например, лимиты пула соединений) и описано поведение приложения при достижении этого лимита, включая любые механизмы отказоустойчивости или восстановления, чтобы предотвратить ситуации отказа в обслуживании (DoS).FalseFalseTrue✓V13.1.33Убедитесь, что в документации приложения определены стратегии управления ресурсами для каждой внешней системы или сервиса, которые оно использует (например, базы данных, файловые дескрипторы, потоки, HTTP-соединения). Стратегии должны включать процедуры освобождения ресурсов, настройки таймаутов, обработку сбоев, а также, если реализована логика повторных попыток, указание лимитов, задержек и алгоритмов back-off. Для синхронных HTTP-запросов должны быть заданы короткие таймауты, а повторные запросы должны быть отключены, либо строго ограничены по числу попыток, чтобы предотвратить каскадные задержки и истощение ресурсов.FalseFalseTrue✓V13.1.44Убедитесь, что в документации приложения определены секреты, критически важные для безопасности приложения, а также установлен график их ротации в соответствии с моделью угроз организации и её бизнес-требованиями.FalseFalseTrue✓V13.22Конфигурация бэкенд соединенийV13.2.11Убедитесь, что коммуникации между компонентами бэкенда приложения (включая API, промежуточное ПО и уровни данных), которые не поддерживают стандартный механизм пользовательских сессий, проходят с аутентификацией. Аутентификация должна использовать индивидуальные сервисные аккаунты, краткосрочные токены или аутентификацию на основе сертификатов, а не постоянные учётные данные, такие как пароли, API-ключи или общие аккаунты с привилегированным доступом.FalseTrue✓True✓V13.2.22Убедитесь, что коммуникации между компонентами бэкенда приложения, включая локальные или системные службы, API, промежуточное ПО и уровни данных, выполняются с использованием аккаунтов, которым назначены минимально необходимые привилегии.FalseTrue✓True✓V13.2.33Убедитесь, что если для аутентификации в сервисе используются учётные данные, то используемые потребителем учётные данные не являются стандартными (например, root/root или admin/admin).FalseTrue✓True✓V13.2.44Убедитесь, что используется белый список (allowlist) для определения внешних ресурсов или систем, с которыми приложению разрешено взаимодействовать (например, для исходящих запросов, загрузки данных или доступа к файлам). Этот белый список может быть реализован на уровне приложения, веб-сервера, межсетевого экрана или комбинации различных уровней.FalseTrue✓True✓V13.2.55Убедитесь, что веб- или прикладной сервер настроен с белым списком ресурсов или систем, к которым сервер может отправлять запросы или из которых может загружать данные и файлы.FalseTrue✓True✓V13.2.66Убедитесь, что при подключении приложения к другим сервисам соблюдается задокументированная конфигурация для каждого соединения, включая максимальное количество параллельных соединений, поведение при достижении их максимума, таймауты и стратегии повторных попыток подключения.FalseFalseTrue✓V13.33Управление секретамиV13.3.11Убедитесь, что для безопасного создания, хранения, контроля доступа и уничтожения секретов бэкенда используется решение для управления секретами, например, хранилище ключей (key vault). Секретами могут быть пароли, ключевой материал, интеграции с базами данных и сторонними системами, ключи и seed-значения для токенов с ограниченным временем действия, другие внутренние секреты и API-ключи. Секреты не должны включаться в исходный код приложения или артефакты сборки. Для приложений уровня L3 необходимо использовать аппаратное решение, например, аппаратный модуль безопасности (HSM).FalseTrue✓True✓V13.3.22Убедитесь, что доступ к секретным ресурсам осуществляется в соответствии с принципом минимально необходимых привилегий (least privilege).FalseTrue✓True✓V13.3.33Убедитесь, что все криптографические операции выполняются с использованием изолированного модуля безопасности (например, хранилища ключей или аппаратного модуля безопасности), чтобы надежно управлять ключевым материалом и защищать его от утечки за пределы модуля безопасности.FalseFalseTrue✓V13.3.44Убедитесь, что секреты настроены на срок действия и ротацию в соответствии с документацией приложения.FalseFalseTrue✓V13.44Непреднамеренная утечка информацииV13.4.11Убедитесь, что приложение развернуто либо без метаданных систем контроля версий (включая папки .git или .svn), либо так, чтобы эти папки были недоступны как извне, так и для самого приложения.True✓True✓True✓V13.4.22Убедитесь, что режимы отладки отключены для всех компонентов в промышленной среде, чтобы предотвратить раскрытие функций отладки и утечку информации.FalseTrue✓True✓V13.4.33Убедитесь, что веб-серверы не показывают клиентам списки содержимого каталогов, если это явно не предусмотрено.FalseTrue✓True✓V13.4.44Убедитесь, что метод HTTP TRACE не поддерживается в продуктовой среде, чтобы избежать потенциальной утечки информации.FalseTrue✓True✓V13.4.55Убедитесь, что документация (например, по внутренним API) и мониторинговые эндпоинты не доступны, если это явно не предусмотрено.FalseTrue✓True✓V13.4.66Убедитесь, что приложение не раскрывает подробную информацию о версиях компонентов бэкенда.FalseFalseTrue✓V13.4.77Убедитесь, что веб-слой настроен на обслуживание только файлов с определёнными расширениями, чтобы предотвратить непреднамеренную утечку информации, конфигураций и исходного кода.FalseFalseTrue✓V1414DataЗащита информацииV14.11Документация по защите информацииV14.1.11Убедитесь, что все конфиденциальные данные, создаваемые и обрабатываемые приложением, идентифицированы и классифицированы по уровням защиты. Включая закодированные данные, которые легко декодируются, например, строки Base64 или незашифрованные данные в полезной нагрузке JWT. Уровни защиты должны учитывать требования по защите данных и конфиденциальности, которым должно соответствовать приложение.FalseTrue✓True✓V14.1.22Убедитесь, что для каждого уровня защиты конфиденциальных данных требования к защите задокументированы. Они должны включать (но не ограничиваться) требования по шифрованию, проверке целостности, срокам хранения, способам логирования данных, контролю доступа к чувствительным данным в логах, шифрованию на уровне базы данных, применению технологий повышения конфиденциальности, а также другим требованиям по конфиденциальности.FalseTrue✓True✓V14.22Базовые меры по защите информацииV14.2.11Убедитесь, что конфиденциальные данные передаются на сервер только в теле HTTP-запроса или в заголовках. URL и строка запроса не должны содержать конфиденциальную информацию, такую как API-ключ или сессионный токен.True✓True✓True✓V14.2.22Убедитесь, что приложение предотвращает кэширование конфиденциальных данных в серверных компонентах, таких как балансировщики нагрузки и кэши приложений, либо гарантирует их надежное удаление после использования.FalseTrue✓True✓V14.2.33Убедитесь, что заранее определённые конфиденциальные данные не отправляются ненадёжным сторонам (например, системам трекинга пользователей), чтобы предотвратить нежелательный сбор данных вне контроля приложения.FalseTrue✓True✓V14.2.44Убедитесь, что для конфиденциальных данных реализованы меры по шифрованию, проверке целостности, срокам хранения, способам логирования, контролю доступа к данным в логах, а также применяются технологии повышения конфиденциальности в соответствии с документацией для соответствующего уровня защиты данных.FalseTrue✓True✓V14.2.55Убедитесь, что механизмы кэширования настроены так, чтобы кэшировать только ответы с ожидаемым типом содержимого для данного ресурса и не содержать конфиденциального динамического контента. При обращении к несуществующему файлу, веб-сервер должен возвращать ответ 404 или 302, а не подменять на другой существующий файл, что позволит предотвратить атаки типа Web Cache Deception.FalseFalseTrue✓V14.2.66Убедитесь, что приложение возвращает только минимально необходимый объем конфиденциальных данных для выполнения своей функциональности. Например, показывает только часть цифр номера кредитной карты, а не полный номер. Если требуется отображение полных данных, они должны быть замаскированы в пользовательском интерфейсе, пока пользователь специально не запросил их просмотр.FalseFalseTrue✓V14.2.77Убедитесь, что конфиденциальная информация подлежит классификации по срокам хранения, чтобы устаревшие или ненужные данные удалялись автоматически, по расписанию или по мере необходимости.FalseFalseTrue✓V14.2.88Убедитесь, что конфиденциальная информация удаляется из метаданных файлов, загружаемых пользователями, если пользователь явно не согласился на ее хранение.FalseFalseTrue✓V14.33Защита данных на стороне клиентаV14.3.11Убедитесь, что аутентифицированные данные очищаются из клиентского хранилища, например, из DOM браузера, после завершения работы клиента или сессии. Заголовок HTTP-ответа Clear-Site-Data может помочь в этом, но клиентская сторона также должна уметь очищать данные, если соединение с сервером недоступно при завершении сессии.True✓True✓True✓V14.3.22Убедитесь, что приложение устанавливает HTTP-заголовки, достаточные для предотвращения кэширования (например, Cache-Control: no-store), чтобы конфиденциальные данные не сохранялись в браузерах.FalseTrue✓True✓V14.3.33Убедитесь, что данные, хранящиеся в браузерном хранилище (например, localStorage, sessionStorage, IndexedDB или cookie), не содержат конфиденциальной информации, за исключением сессионных токенов.FalseTrue✓True✓V1515SecureБезопасная разработка и архитектураV15.11Документация по безопасной разработке и архитектуреV15.1.11Убедитесь, что в документации по приложению определены сроки устранения уязвимостей на основе оценки рисков для внешних зависимостей с уязвимостями и для обновления библиотек в целом, чтобы минимизировать риск, связанный с этими компонентами.True✓True✓True✓V15.1.22Убедитесь, что ведется реестр всех используемых сторонних библиотек (например, Software Bill of Materials, SBOM), с обязательной проверкой, что компоненты получены из предопределенных, доверенных и регулярно поддерживаемых репозиториев.FalseTrue✓True✓V15.1.33Убедитесь, что в документации приложения указан функционал, требующий значительных временных или вычислительных ресурсов. Необходимо указать, как предотвратить потерю доступности из-за чрезмерного использования этого функционала и как избежать ситуаций, когда формирование ответа занимает больше времени, чем установленный системой таймаут. Возможные меры защиты могут включать асинхронную обработку, использование очередей и ограничение количества параллельных процессов для каждого пользователя и приложения.FalseTrue✓True✓V15.1.44Убедитесь, что в документации приложения указаны внешние библиотеки, которые считаются «компонентами с повышенным риском».FalseFalseTrue✓V15.1.55Убедитесь, что в документации приложения выделены те части приложения, в которых используются «функционал с повышенным риском».FalseFalseTrue✓V15.22Архитектура безопасности и зависимостиV15.2.11Убедитесь, что приложение содержит только те компоненты, которые не нарушили задокументированные сроки обновления и исправления.True✓True✓True✓V15.2.22Убедитесь, что в приложении реализованы меры защиты от потери доступности из-за функциональности, требующей много времени или ресурсов, на основе задокументированных решений и стратегий безопасности для этого.FalseTrue✓True✓V15.2.33Убедитесь, что производственная среда включает только те функции, которые необходимы для работы приложения, и не предоставляет лишние функции, такие как тестовый код, примеры кода и инструменты разработки.FalseTrue✓True✓V15.2.44Убедитесь, что сторонние компоненты и все их транзитивные зависимости загружаются только из ожидаемых репозиториев (внутренних или внешних) и отсутствует риск атаки через подмену зависимостей (dependency confusion attack)FalseFalseTrue✓V15.2.55Убедитесь, что приложение реализует дополнительные меры защиты для тех частей приложения, которые документированы как содержащие «функционал с повышенным риском» или использующие сторонние библиотеки, считающиеся «функционалом с повышенным риском». Это могут быть такие методы, как «песочница», инкапсуляция, контейнеризация или изоляция на сетевом уровне, чтобы задержать и предотвратить продвижение (pivoting) злоумышленников, скомпрометировавших одну часть приложения, к другим частям приложения.FalseFalseTrue✓V15.33Безопасное программированиеV15.3.11Убедитесь, что приложение возвращает только необходимое подмножество полей из объекта данных. Например, оно не должно возвращать весь объект данных, поскольку некоторые отдельные поля должны быть недоступны пользователям.True✓True✓True✓V15.3.22Убедитесь, что при вызовах внешних URL-адресов бэкэнд приложения настроен так, чтобы не выполнять перенаправления, если только это не предусмотрено функционалом.FalseTrue✓True✓V15.3.33Убедитесь, что в приложении реализованы защитные механизмы против атак типа массового присвоения (mass assignment) путем строгого ограничения разрешенных полей для каждого контроллера и действия, исключая возможность добавления или изменения значений полей, которые не должны быть доступны для данной конкретной операции.FalseTrue✓True✓V15.3.44Убедитесь, что все прокси и промежуточное ПО корректно передают исходный IP-адрес пользователя, используя доверенные поля данных, которые не могут быть изменены конечным пользователем, а приложение и веб-сервер используют это правильное значение для ведения логирования и принятия решений по безопасности, таких как ограничение запросов. При этом следует учитывать, что даже исходный IP-адрес может быть ненадежным из-за динамических IP-адресов, VPN или корпоративных файрволов.FalseTrue✓True✓V15.3.55Убедитесь, что приложение явно проверяет соответствие переменных ожидаемому типу данных и использует строгие операции сравнения. Это необходимо для предотвращения уязвимостей, связанных с type juggling и type confusion, вызванных тем, что код приложения делает предположения о типе переменной.FalseTrue✓True✓V15.3.66Убедитесь, что JavaScript-код написан таким образом, чтобы предотвратить prototype pollution, например, используя Set() или Map() вместо обычных литералов объекта.FalseTrue✓True✓V15.3.77Убедитесь, что приложение защищено от атак типа HTTP Parameter Pollution (HPP), особенно если используемый фреймворк не различает источники параметров запроса (строка запроса, тело запроса, куки или заголовки).FalseTrue✓True✓V15.44Безопасная работа с параллельными процессамиV15.4.11Убедитесь, что к общим объектам в многопоточном коде (например, кэшам, файлам или объектам в памяти, используемым несколькими потоками) используется безопасный многопоточный доступ и механизмов синхронизации, таких как блокировки или семафоры, чтобы избежать состояний гонки и повреждения данных.FalseFalseTrue✓V15.4.22Убедитесь, что проверки состояния ресурса, например его существования или разрешений, а также зависящие от него действия выполняются как одна атомарная операция, чтобы предотвратить условия гонки времени проверки и времени использования (TOCTOU). Например, проверка существования файла перед его открытием или проверка прав доступа пользователя перед его предоставлением.FalseFalseTrue✓V15.4.33Убедитесь, что блокировки применяются согласованно, чтобы предотвратить взаимные блокировки потоков (deadlocks) или их бесконечные повторы, а также что логика блокировки инкапсулирована в коде, отвечающем за управление ресурсом. Это гарантирует, что блокировки не могут быть случайно или намеренно изменены внешними классами или кодом.FalseFalseTrue✓V15.4.44Убедитесь, что политики распределения ресурсов предотвращают нехватку ресурсов у потоков, обеспечивая справедливый доступ к ресурсам, например, используя пулы потоков, позволяя потокам с более низким приоритетом выполняться в течение разумного периода времени.FalseFalseTrue✓V1616SecurityЖурналирование событий безопасности и обработка ошибокV16.11Документация по ведению логовV16.1.11Убедитесь в существовании реестра, в котором документируется ведение журнала на каждом уровне технологического стека приложения, включая какие события регистрируются, форматы логов, где хранятся эти журналы, как они используются, как контролируется доступ к ним и как долго хранятся журналы.FalseTrue✓True✓V16.22Общее журналированиеV16.2.11Убедитесь, что каждая запись журнала содержит необходимые метаданные (например, когда, где, кто, что), которые позволят провести подробное исследование временной шкалы, когда произошло событие.FalseTrue✓True✓V16.2.22Убедитесь, что все источники времени компонентов системы журналирования синхронизированы, а временные метки в метаданных событий безопасности используют UTC или содержат явное указание смещения часового пояса. Рекомендуется применять UTC для обеспечения согласованности в распределённых системах и предотвращения ошибок при переходе на летнее/зимнее время.FalseTrue✓True✓V16.2.33Убедитесь, что приложение записывает и передаёт логи исключительно в те файлы и сервисы, которые указаны в реестре журналирования.FalseTrue✓True✓V16.2.44Убедитесь, что логи могут быть прочитаны и коррелированы используемой системой обработки журналов, предпочтительно с использованием общего стандартного формата логирования.FalseTrue✓True✓V16.2.55Убедитесь, что приложение применяет соответствующие меры защиты при логировании конфиденциальных данных в зависимости от уровня их чувствительности: например, полностью запрещает запись в логи таких данных, как учетные данные или платежные реквизиты, а для других данных (например, сессионных токенов) использует хеширование или частичное/полное маскирование.FalseTrue✓True✓V16.33Инциденты безопасностиV16.3.11Убедитесь, что все операции аутентификации регистрируются, включая успешные и неудачные попытки. Также следует фиксировать дополнительные метаданные, такие как тип аутентификации или использованные факторы проверки.FalseTrue✓True✓V16.3.22Убедитесь, что ведется журнал неудачных попыток авторизации. Для уровня L3 это должно включать в себя журналирование всех решений об авторизации, включая журналирование доступа к конфиденциальным данным (без регистрации самих конфиденциальных данных).FalseTrue✓True✓V16.3.33Убедитесь, что приложение регистрирует все события безопасности, определенные в документации, а также фиксирует попытки обхода механизмов защиты, включая проверку входных данных, бизнес-логики и системы защиты от автоматизированных атак.FalseTrue✓True✓V16.3.44Убедитесь, что приложение регистрирует в журналах неожиданные ошибки и сбои механизмов безопасности, включая, например, ошибки TLS-соединения на стороне сервера.FalseTrue✓True✓V16.44Защита журналовV16.4.11Убедитесь, что все компоненты системы логирования корректно кодируют данные, чтобы предотвратить атаки типа внедрения в журналы (log injection).FalseTrue✓True✓V16.4.22Убедитесь, что логи защищены от неавторизованного доступа и не могут быть модифицированы.FalseTrue✓True✓V16.4.33Убедитесь, что логи безопасно передаются в логически изолированную систему для анализа, обнаружения угроз, генерации оповещений и эскалации инцидентов. Это гарантирует сохранность журналов даже в случае компрометации основного приложения.FalseTrue✓True✓V16.55Обработка ошибокV16.5.11Убедитесь, что при возникновении непредвиденной или связанной с безопасностью ошибки пользователю возвращается только общее сообщение, гарантируя отсутствие раскрытия конфиденциальных внутренних данных системы, таких как трассировки стека, запросы, секретные ключи и токены.FalseTrue✓True✓V16.5.22Убедитесь, что приложение продолжает работать в безопасном режиме при недоступности внешних ресурсов, используя такие механизмы, как автоматические выключатели (circuit breakers) или плавное снижение функциональности (graceful degradation).FalseTrue✓True✓V16.5.33Убедитесь, что приложение корректно и безопасно завершает работу при возникновении исключений, предотвращая опасные сценарии по типу «fail-open», когда, например, транзакция ошибочно выполняется, несмотря на ошибки в логике валидации.FalseTrue✓True✓V16.5.44Убедитесь, что определён обработчик ошибок «крайние меры», который будет перехватывать все необработанные ошибки. Это необходимо как для предотвращения потери информации об ошибках, которая должна быть записана в файлы журналов, так и для того, чтобы ошибка не остановила весь процесс приложения, что привело бы к потере доступности.FalseFalseTrue✓V1717WebRTCWebRTCV17.11TURN-серверV17.1.11Убедитесь, что сервис TURN (Traversal Using Relays around NAT) разрешает доступ только к IP-адресам, не зарезервированным для специальных целей (например, внутренние сети, широковещательная рассылка, loopback-адреса). Данное требование применяется как к IPv4, так и к IPv6 адресам.FalseTrue✓True✓V17.1.22Убедитесь, что сервис TURN (Traversal Using Relays around NAT) защищен от исчерпания ресурсов при попытках легитимных пользователей открыть чрезмерное количество портов на сервере.FalseFalseTrue✓V17.22Требования к медиасерверамV17.2.11Убедитесь, что ключ сертификата Datagram Transport Layer Security (DTLS) управляется и защищается в соответствии с документированной политикой управления криптографическими ключами.FalseTrue✓True✓V17.2.22Убедитесь, что медиасервер настроен на использование только одобренных наборов шифров Datagram Transport Layer Security (DTLS) и защищенного профиля безопасности для расширения DTLS, применяемого при установке ключей для Secure Real-time Transport Protocol (DTLS-SRTP).FalseTrue✓True✓V17.2.33Убедитесь, что медиасервер проверяет аутентификацию Secure Real-time Transport Protocol (SRTP) для предотвращения атак с внедрением Real-time Transport Protocol (RTP), которые могут привести к отказу в обслуживании (Denial of Service) или вставке поддельного аудио-/видеоконтента в медиапотоки.FalseTrue✓True✓V17.2.44Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика при получении некорректных пакетов Secure Real-time Transport Protocol (SRTP).FalseTrue✓True✓V17.2.55Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетами Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.FalseFalseTrue✓V17.2.66Убедитесь, что медиасервер не подвержен уязвимости «Гонка ClientHello» (ClientHello Race Condition) в Datagram Transport Layer Security (DTLS), проверив наличие известных уязвимостей в публичных источниках или выполнив тестирование на воспроизведение условий гонки.FalseFalseTrue✓V17.2.77Убедитесь, что механизмы аудио- и видеозаписи, связанные с медиасервером, способны продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетов Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.FalseFalseTrue✓V17.2.88Убедитесь, что сертификат Datagram Transport Layer Security (DTLS) проверяется на соответствие атрибуту отпечатка (fingerprint) в Session Description Protocol (SDP), с немедленным прекращением медиапотока в случае несоответствия — это гарантирует подлинность передаваемых данных.FalseFalseTrue✓V17.33СигнализацияV17.3.11Убедитесь, что сигнальный сервер способен продолжать обработку легитимных входящих сообщений сигнализации даже в условиях флуд-атаки. Для этого необходимо реализовать механизм ограничения частоты запросов (rate limiting) на уровне сигнализации.FalseTrue✓True✓V17.3.22Убедитесь, что сигнальный сервер способен продолжать обработку легитимных сообщений сигнализации даже при получении некорректных сообщений, которые могут вызвать отказ в обслуживании (Denial of Service, DoS). Для этого необходимо реализовать: проверку входных данных (input validation), безопасную обработку целочисленных переполнений (integer overflows), защиту от переполнения буферов (buffer overflows) и другие надежные методы обработки ошибок.FalseTrue✓True✓ diff --git a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.xml b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.xml deleted file mode 100644 index ef668c334f..0000000000 --- a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.xml +++ /dev/null @@ -1 +0,0 @@ -Application Security Verification Standard ProjectASVSThe OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.V11EncodingКодировка и нейтрализацияV1.11Архитектура кодировки и нейтрализацииV1.1.11Убедитесь, что входные данные декодируются или деэкранируются в каноническую форму (в стандартное представление) только один раз. Декодирование происходит только тогда, когда ожидаются закодированные данные в этой форме, и что это делается перед дальнейшей обработкой входных данных, например, это не выполняется после проверки или нейтрализации.2V1.1.22Убедитесь, что приложение выполняет кодирование и экранирование выходных данных либо в качестве последнего шага перед использованием интерпретатором, для которого оно предназначено, либо самим интерпретатором.2V1.22Предотвращение инъекцийV1.2.11Убедитесь, что выходная кодировка для ответа HTTP, документа HTML или документа XML соответствует требуемому контексту, например, кодировка соответствующих символов для элементов HTML, атрибутов HTML, комментариев HTML, CSS или полей заголовка HTTP делается таким способом, чтобы избежать изменения структуры сообщения или документа.1V1.2.22Убедитесь, что при динамическом построении URL-адресов недоверенные данные кодируются в соответствии с их контекстом (например, кодирование URL-адресов или кодирование base64url для query или path параметров или пути). Убедитесь, что разрешены только безопасные протоколы URL-адресов (например, запрещен javascript: или data:).1V1.2.33Убедитесь, что при динамическом построении содержимого JavaScript (включая JSON) используется кодирование или экранирование выходных данных, чтобы избежать изменения структуры сообщения или документа (чтобы избежать JavaScript и JSON-инъекций).1V1.2.44Убедитесь, что выборка данных (Redis, Memcached, чтение из файлов, обращение по API) или запросы к базе данных (например, SQL, HQL, NoSQL, Cypher) используют параметризованные запросы, ORM, Entity Frameworks или иным образом защищены от SQL-инъекций и других атак. Это также актуально при написании хранимых процедур.1V1.2.55Убедитесь, что приложение защищено от внедрения команд ОС и что вызовы операционной системы используют параметризованные запросы к ОС или используют контекстное кодирование вывода командной строки.1V1.2.66Убедитесь, что приложение защищено от LDAP-инъекций, или что реализованы специальные меры безопасности для их предотвращения.2V1.2.77Убедитесь, что приложение защищено от атак с использованием XPath-инъекций с помощью параметризации запросов или предварительно скомпилированных запросов.2V1.2.88Убедитесь, что процессоры LaTeX настроены безопасно (например, не используется флаг «–shell‑escape») и используется разрешенный список команд для предотвращения LaTeX-инъекций.2V1.2.99Убедитесь, что приложение экранирует специальные символы в регулярных выражениях (обычно с помощью обратной косой черты), чтобы предотвратить их ошибочную интерпретацию как метасимволов.2V1.2.1010Убедитесь, что приложение защищено от внедрения формул CSV (CSV Injection). Приложение должно следовать правилам экранирования, определенным в RFC 4180, разделы 2.6 и 2.7, при экспорте содержимого CSV. Кроме того, при экспорте в CSV или другие форматы электронных таблиц (такие как XLS, XLSX или ODF) специальные символы (включая '=', '+', '-', '@', '\t' (табуляция), и '\0' (нулевой символ)) должны экранироваться одинарной кавычкой, если они появляются в качестве первого символа в значении поля.3V1.33НейтрализацияV1.3.11Убедитесь, что все ненадежные входные данные HTML из редакторов WYSIWYG или аналогичных программ нейтрализуются с помощью известных и безопасных библиотек или функций фреймворка для санитизации HTML.1V1.3.22Убедитесь, что приложение избегает использования eval() или других динамических функций выполнения кода, таких как Spring Expression Language (SpEL). Если нет альтернативы, любой пользовательский ввод должен быть нейтрализован перед выполнением.1V1.3.33Убедитесь, что данные, передаваемые в потенциально опасный контекст, предварительно нейтрализованы, чтобы обеспечить соблюдение мер безопасности, таких как разрешение только тех символов, которые безопасны для данного контекста, и обрезка слишком длинного ввода.2V1.3.44Убедитесь, что предоставленный пользователем файл .SVG проверен или нейтрализован, чтобы он содержал только теги и атрибуты (например, относящиеся к рисованию), которые безопасны для приложения, например, не содержат скриптов и foreignObject.2V1.3.55Убедитесь, что приложение нейтралует или отключает предоставленные пользователем скриптовые данные или выражения шаблонных языков, такие как таблицы стилей Markdown, CSS или XSL, BBCode или аналогичные.2V1.3.66Убедитесь, что приложение защищено от атак с подделкой запросов на стороне сервера (SSRF), проверяя ненадежные данные по разрешенному списку протоколов, доменов, путей и портов, а также нейтрализуя потенциально опасные символы перед использованием данных для вызова другой службы.2V1.3.77Убедитесь, что приложение защищено от атак с внедрением шаблонов (template injection), не позволяя создавать шаблоны на основе недоверенных входных данных. Если нет альтернативы, любые недоверенные входные данные, включаемые динамически во время создания шаблона, должны быть нейтрализованы или тщательно провалидированы.2V1.3.88Убедитесь, что приложение надлежащим образом нейтрализует недоверенные входные данные перед использованием в запросах Java Naming and Directory Interface (JNDI) и что JNDI настроен безопасно для предотвращения атак с использованием JNDI-инъекций.2V1.3.99Убедитесь, что приложение нейтрализует данные перед отправкой в Memcache, чтобы предотвратить атаки методом инъекций.2V1.3.1010Убедитесь, что строки форматирования, которые могут быть использованы неожидаемым или вредоносным образом, нейтрализуются перед дальнейшим использованием.2V1.3.1111Убедитесь, что приложение нейтрализует вводимые пользователем данные перед передачей в почтовые системы для защиты от SMTP или IMAP-инъекций.2V1.3.1212Убедитесь, что регулярные выражения не содержат элементов, вызывающих экспоненциальный возврат, и убедитесь в нейтрализации недоверенных входных данных для предотвращения атак ReDoS или Runaway Regex.3V1.44Память, строки и неуправляемый кодV1.4.11Убедитесь, что для обнаружения или предотвращения ситуаций переполнения стека, буфера или кучи приложение учитывает размер доступной области памяти при строковых операциях, копировании в память, в арифметике указателей и т.п.2V1.4.22Убедитесь, что для предотвращения целочисленного переполнения применяется контроль знака, диапазона и типа допустимых входных данных.2V1.4.33Убедитесь, что динамически выделенная память и ресурсы освобождены, а ссылки или указатели на освобожденную память удалены или установлены в значение null, чтобы предотвратить появление висячих указателей и уязвимостей, связанных с использованием памяти после освобождения.2V1.55Безопасная десериализацияV1.5.11Убедитесь, что приложение настраивает XML-парсеры на использование строгой конфигурации и что небезопасные функции, такие как разрешение внешних сущностей, отключены для предотвращения атак XML eXternal Entity (XXE).1V1.5.22Убедитесь, что десериализация недоверенных данных обеспечивает безопасную обработку ввода, например, используя список разрешенных типов объектов или ограничивая типы объектов, определяемые клиентом, для предотвращения атак десериализации. Механизмы десериализации, которые явно определены как небезопасные, не должны использоваться с недоверенным вводом.2V1.5.33Убедитесь, что различные парсеры, используемые в приложении для одного и того же типа данных (например, парсеры JSON, XML, URL), выполняют парсинг согласованным образом и используют один и тот же механизм кодирования символов, чтобы избежать таких проблем, как уязвимости взаимодействия JSON (JSON Interoperability) или различное поведение анализа URI или файлов, которые могут использоваться в атаках удаленного включения файлов (RFI) или подделки запросов на стороне сервера (SSRF).3V22ValidationВалидация и бизнес-логикаV2.11Документация валидации и бизнес-логикиV2.1.11Убедитесь, что в документации приложения определены правила проверки входных данных на соответствие ожидаемой структуре. Это могут быть распространённые форматы данных, такие как номера кредитных карт, адреса электронной почты, номера телефонов, или внутренний формат данных.1V2.1.22Убедитесь, что в документации приложения указано, как проверять логическую и контекстную согласованность объединенных данных, например, проверять соответствие района и почтового индекса.2V2.1.33Убедитесь, что ожидания относительно ограничений и проверок бизнес-логики задокументированы как для уровня отдельного пользователя, так и для глобального уровня всего приложения.2V2.22Валидация вводаV2.2.11Убедитесь, что входные данные провалидированы для обеспечения соответствия бизнес- или функциональным ожиданиям. Валидация должна осуществляться либо по списку допустимых значений, шаблонов и диапазонов, либо путем сравнения входных данных с ожидаемой структурой и логическими ограничениями в соответствии с предопределенными правилами. Для L1 валидация может быть сосредоточена на входных данных, используемых для принятия конкретных бизнес-решений или решений, связанных с безопасностью. Для L2 и выше это должно применяться ко всем входным данным.1V2.2.22Убедитесь, что приложение разработано с принудительной валидацией входных данных на уровне доверенного сервиса. Хотя проверка на стороне клиента повышает удобство использования и должна поощряться, на неё не следует полагаться как на средство контроля безопасности.1V2.2.33Убедитесь, что приложение обеспечивает обоснованность комбинаций данных в соответствии с предопределенными правилам. Например: возраст должен соответствовать дате рождения; страна и почтовый индекс; количество товара в заказе и на складе.2V2.33Безопасность бизнес-логикиV2.3.11Убедитесь, что приложение обрабатывает потоки бизнес-логики для одного и того же пользователя в ожидаемом последовательном порядке шагов и без пропуска шагов.1V2.3.22Убедитесь, что ограничения бизнес-логики реализованы в соответствии с документацией приложения, чтобы избежать эксплуатации её недостатков.2V2.3.33Убедитесь, что транзакции используются на уровне бизнес-логики таким образом, что операция бизнес-логики либо выполняется полностью, либо откатывается к предыдущему корректному состоянию.2V2.3.44Убедитесь, что на уровне бизнес-логики используются механизмы блокировки, чтобы гарантировать невозможность двойного бронирования ограниченных по количеству ресурсов (например, мест в театре или слотов доставки) путем манипулирования логикой приложения.2V2.3.55Убедитесь, что для важных потоков бизнес-логики требуется многопользовательское (multi-user) одобрение, чтобы предотвратить несанкционированные или случайные действия. Потоки бизнес-логики могут включать, помимо прочего, крупные денежные переводы, утверждение контрактов, доступ к секретной информации или обход ограничений безопасности на производстве.3V2.44Анти-автоматизацияV2.4.11Убедитесь, что используются средства противодействия автоматизации для защиты от чрезмерных вызовов функций приложения, которые могут привести к утечке данных, созданию ненужных данных, исчерпанию квот, нарушению ограничений скорости, отказу в обслуживании или чрезмерному использованию дорогостоящих ресурсов.2V2.4.22Убедитесь, что потоки бизнес-логики требуют реалистичного человеческого времени, предотвращая чрезмерно быструю отправку транзакций.3V33WebБезопасность веб-интерфейсаV3.11Документация по безопасности веб-интерфейсаV3.1.11Убедитесь, что в документации приложения описаны ожидаемые функции безопасности, которые должны поддерживать браузеры, использующие приложение (такие как HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) и другие соответствующие механизмы безопасности HTTP). В документации также должно быть обязательно определено, как приложение должно себя вести, если некоторые из этих функций недоступны (например, предупреждать пользователя или блокировать доступ).3V3.22Непреднамеренная интерпретация контентаV3.2.11Убедитесь, что реализованы меры безопасности, предотвращающие отображение контента или функций браузерами в HTTP-ответах в некорректном контексте (например, запрос API, загруженный пользователем файл или другой ресурс запрашивается напрямую). Возможные способы контроля включают: не обрабатывать содержимое, если поля заголовка HTTP-запроса (например, Sec-Fetch-*) не указывают на корректность контекста; использование заголовка и значения Content-Security-Policy: sandbox directive; или использование заголовка и значения Content-Disposition: attachment.1V3.2.22Убедитесь, что данные, предназначенные для отображения в виде текста, а не визуализации в виде HTML, обрабатывается с использованием безопасных функций визуализации (таких как createTextNode или textContent), чтобы предотвратить непреднамеренное выполнение содержимого, такого как HTML или JavaScript.1V3.2.33Убедитесь, что приложение избегает затирания DOM при использовании JavaScript на стороне клиента, применяя явные объявления переменных, выполняя строгую проверку типов, избегая сохранения глобальных переменных в объекте документа и реализуя изоляцию пространства имен.3V3.33Настройка файлов cookieV3.3.11Убедитесь, что у файлов cookie установлен атрибут «Secure», и если префикс «__Host‑» не используется в названии cookie, необходимо использовать префикс «__Secure‑».1V3.3.22Убедитесь, что значение атрибута SameSite каждой cookie установлено в соответствии с назначением cookie, чтобы ограничить подверженность атакам на восстановление пользовательского интерфейса и атакам с подделкой запросов на уровне браузера, обычно называемым подделкой межсайтовых запросов (CSRF).2V3.3.33Убедитесь, что cookie имеют префикс «__Host‑» в названии, если только они явно не предназначены для совместного использования с другими хостами.2V3.3.44Убедитесь, что если значение cookie не должно быть доступно для клиентских скриптов (например, сессионный токен), для cookie должен быть установлен атрибут «HttpOnly», а само значение должно передаваться клиенту только через поле заголовка «Set-Cookie».2V3.3.55Убедитесь, что при записи cookie приложением общая длина имени и значения cookie не превышает 4096 байт. Слишком большие cookie не будут сохраняться браузером и, следовательно, не будут отправляться с запросами, что помешает пользователю использовать функции приложения, зависящие от этого cookie.3V3.44Заголовки механизма безопасности браузераV3.4.11Убедитесь, что поле заголовка Strict‑Transport‑Security включено во все ответы для реализации политики HTTP Strict Transport Security (HSTS). Необходимо указать максимальное время не менее 1 года, а для L2 и выше политика должна применяться также ко всем поддоменам.1V3.4.22Убедитесь, что поле заголовка Cross‑Origin Resource Sharing (CORS) «Access‑Control‑Allow‑Origin» имеет фиксированное значение, заданное приложением, или, если используется заголовок Origin, оно проверяется по списку доверенных источников. При необходимости использования «Access‑Control‑Allow‑Origin: *» убедитесь, что ответ не содержит конфиденциальной информации.1V3.4.33Убедитесь, что HTTP-ответы содержат поле заголовка Content-Security-Policy, которое определяет директивы, гарантирующие загрузку и выполнение браузером только доверенного контента или ресурсов, чтобы ограничить выполнение вредоносного JavaScript. Как минимум, необходимо использовать глобальную политику, включающую директивы object-src «none» и base-uri «none», а также определяющую список разрешенных адресов или использующую одноразовые коды или хэши. Для приложений L3 необходимо определить политику использования 'nonce' или hash-конструкций для каждого ответа.2V3.4.44Убедитесь, что все HTTP-ответы содержат поле заголовка «X‑Content‑Type‑Options: nosniff». Это предписывает браузерам не использовать анализ контента и определение типа MIME для данного ответа, а также требовать, чтобы значение поля заголовка Content‑Type в ответе соответствовало целевому ресурсу. Например, ответ на запрос стиля принимается только в том случае, если Content‑Type в ответе — «text/css». Это также позволяет браузеру использовать функцию Cross‑Origin Read Blocking (CORB).2V3.4.55Убедитесь, что приложение устанавливает политику реферера для предотвращения утечки технически конфиденциальных данных сторонним сервисам через поле заголовка HTTP-запроса «Referer». Это можно сделать с помощью поля заголовка HTTP-ответа «Referrer‑Policy» или через атрибуты HTML-элемента. Конфиденциальные данные могут включать путь и данные запроса в URL-адресе, а для внутренних непубличных приложений также имя хоста.2V3.4.66Убедитесь, что веб-приложение использует директиву frame‑ancestors поля заголовка Content‑Security‑Policy для каждого HTTP-ответа, чтобы гарантировать невозможность его внедрения по умолчанию и внедрение определённых ресурсов разрешено только при необходимости. Обратите внимание, что поле заголовка X‑Frame‑Options, хотя и поддерживается браузерами, устарело и не может быть использовано в качестве основы.2V3.4.77Убедитесь, что в поле заголовка Content‑Security‑Policy указано место, куда следует сообщать о нарушениях.3V3.4.88Убедитесь, что все HTTP-ответы, инициирующие рендеринг документа (например, ответы с типом содержимого text/html), включают поле заголовка Cross-Origin-Opener-Policy с директивой same-origin или same-origin-allow-popups (при необходимости). Это предотвращает атаки, злоупотребляющие общим доступом к объектам Window, такие как Tabnabbing и Frame Counting.3V3.55Браузерное разделение источниковV3.5.11Убедитесь, что, если приложение не использует механизм предварительной проверки CORS для предотвращения запрещённых кросс-доменных запросов на использование чувствительного функционала, эти запросы валидируются на предмет их происхождения от самого приложения. Это можно сделать, используя и проверяя специальные токены для защиты от подделки или требуя дополнительные поля HTTP-заголовка, не входящие в список «простых заголовков» (CORS-safelisted request-header). Это необходимо для защиты от атак с подделкой запросов через браузер, широко известных как межсайтовая подделка запросов (CSRF).1V3.5.22Убедитесь, что если приложение использует механизм предварительной проверки CORS для предотвращения неразрешённого использования чувствительного функционала между источниками, вызов этого функционала невозможен с помощью запроса, который не запускает предварительную проверку CORS. Для этого может потребоваться проверка значений полей заголовка запроса «Origin» и «Content-Type» или использование дополнительного поля заголовка, не входящего в безопасный список CORS.1V3.5.33Убедитесь, что HTTP-запросы к чувствительному функционалу используют соответствующие HTTP-методы, такие как POST, PUT, PATCH или DELETE, а не методы, определённые спецификацией HTTP как «безопасные», такие как HEAD, OPTIONS или GET. В качестве альтернативы можно использовать строгую валидацию полей заголовка запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, навигационного запроса или загрузки ресурса (например, источника изображения), где это не ожидается.1V3.5.44Убедитесь, что отдельные приложения размещены на разных именах хостов, чтобы использовать ограничения, предусмотренные политикой same-origin, включая то, как документы или скрипты, загруженные одним источником, могут взаимодействовать с ресурсами из другого источника, а также ограничения на cookie на основе имени хоста.2V3.5.55Убедитесь, что сообщения, полученные интерфейсом postMessage, отвергаются, если источник сообщения не является доверенным или если синтаксис сообщения недействителен.2V3.5.66Убедитесь, что функциональность JSONP не включена нигде в приложении, чтобы избежать атак с использованием межсайтового включения скриптов (XSSI).3V3.5.77Убедитесь, что данные, требующие авторизации, не включены в ответы ресурсов скриптов, таких как файлы JavaScript, чтобы предотвратить атаки с использованием межсайтового включения скриптов (XSSI).3V3.5.88Убедитесь, что аутентифицированные ресурсы (такие как изображения, видео, скрипты и другие документы) могут быть загружены или внедрены от имени пользователя только по назначению. Этого можно добиться путём строгой валидации полей заголовка HTTP-запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, или путём установки ограничительного поля заголовка HTTP-ответа Cross‑Origin‑Resource‑Policy, чтобы браузер блокировал возвращаемый контент.3V3.66Целостность внешних ресурсовV3.6.11Убедитесь, что клиентские ресурсы, такие как библиотеки JavaScript, CSS или веб-шрифты, размещаются только на внешнем сервере (например, в сети доставки контента (Content Delivery Network)), если ресурс статический и имеет версии, а для проверки целостности ресурса используется механизм проверки целостности подресурсов (SRI). Если это невозможно, для каждого ресурса должно быть задокументировано решение по безопасности, обосновывающее это.3V3.77Другие соображения по безопасности браузераV3.7.11Убедитесь, что приложение использует только те клиентские технологии, которые по-прежнему поддерживаются и считаются безопасными. Примерами технологий, не соответствующих этому требованию, являются плагины NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL или клиентские Java-апплеты.2V3.7.22Убедитесь, что приложение будет автоматически перенаправлять пользователя на другое имя хоста или домен (который не контролируется приложением), только если этот хост или домен указаны в списке разрешенных.2V3.7.33Убедитесь, что приложение отображает уведомление, что пользователь перенаправляется на URL-адрес, находящийся вне контроля приложения, с возможностью отмены навигации.3V3.7.44Убедитесь, что домен верхнего уровня приложения (например, site.tld) ​​добавлен в публичный список предварительной загрузки (preload list) для HTTP Strict Transport Security (HSTS). Это гарантирует, что использование TLS для приложения будет встроено непосредственно в основные браузеры, а не будет полагаться только на поле заголовка ответа Strict-Transport-Security.3V3.7.55Убедитесь, что приложение ведет себя так, как описано в документации (например, предупреждает пользователя или блокирует доступ), если браузер, используемый для доступа к приложению, не поддерживает ожидаемые функции безопасности.3V44APIAPI и Веб-сервисV4.11Общая безопасность веб-сервисовV4.1.11Убедитесь, что каждый HTTP-ответ с телом сообщения содержит заголовок Content-Type, который соответствует фактическому содержимому ответа, таким как «text/», «/+xml» и «/xml», включая параметр charset для указания безопасной кодировки символов (например, UTF-8, ISO-8859-1) согласно IANA Media Types.1V4.1.22Убедитесь, что только конечные точки, предназначенные для взаимодействия с пользователем через веб-браузер, автоматически перенаправляют HTTP на HTTPS, в то время как другие сервисы или конечные точки не реализуют прозрачные редиректы. Это необходимо, чтобы избежать ситуации, когда клиент ошибочно отправляет незашифрованные HTTP-запросы а из-за того, что запрос по HTTP автоматически перенаправляется на HTTPS другим сервисом без обработки на входе, утечка чувствительных данных остаётся незамеченной.2V4.1.33Убедитесь, что любой HTTP-заголовок, используемый приложением и устанавливаемый промежуточным уровнем, таким как балансировщик нагрузки, веб-прокси или backend-for-frontend сервис, не может быть переопределён конечным пользователем. Примеры заголовков: X-Real-IP, X-Forwarded-*, X-User-ID.2V4.1.44Убедитесь, что разрешены только HTTP-методы, которые явно поддерживаются приложением или его API (включая OPTIONS для preflight-запросов), а неиспользуемые методы заблокированы.3V4.1.55Убедитесь, что для особо чувствительных запросов или транзакций, проходящих через несколько систем, используются цифровые подписи на уровне сообщений, дополнительно к транспортным средствам защиты.3V4.22Валидация структуры HTTP-сообщенийV4.2.11Убедитесь, что все компоненты приложения (включая балансировщики нагрузки, файрволы и серверы приложений) определяют границы входящих HTTP-сообщений с использованием механизма, соответствующего версии HTTP, чтобы предотвратить HTTP request smuggling. В HTTP/1.x, если присутствует заголовок Transfer-Encoding, заголовок Content-Length должен игнорироваться согласно RFC 2616. При использовании HTTP/2 или HTTP/3, если присутствует Content-Length, веб-сервер должен убедиться, что он совпадает с длиной DATA-фреймов.2V4.2.22Убедитесь, что при генерации HTTP-сообщений заголовок Content-Length не конфликтует с длиной содержимого, определяемой рамками протокола HTTP, чтобы предотвратить HTTP Request Smuggling.3V4.2.33Убедитесь, что приложение не отправляет и не принимает HTTP/2 и HTTP/3 сообщения с заголовками, специфичными для соединения, такими как Transfer-Encoding, чтобы предотвратить HTTP Response Splitting и HTTP Header Injection.3V4.2.44Убедитесь, что приложение принимает HTTP/2 и HTTP/3 запросы только в случае, если поля заголовков и их значения не содержат последовательностей CR (\r), LF (\n) или CRLF (\r\n), чтобы предотвратить HTTP Header Injection.3V4.2.55Убедитесь, что если приложение (бекенд или фронтенд) формирует и отправляет запросы, оно использует валидацию, очистку или другие механизмы, чтобы не создавать URI (например, для API-вызовов) или HTTP-заголовки (например, Authorization или Cookie) слишком большой длины, чтобы их не принимал приёмник. Это может привести к отказу в обслуживании, например, при отправке слишком длинного запроса (длинный cookie-заголовок), из-за чего сервер постоянно возвращает ошибку.3V4.33GraphQLV4.3.11Убедитесь, что используется белый список запросов, ограничение глубины вложенности, ограничение количества или анализ стоимости запроса, чтобы предотвратить DoS-атаки на уровне GraphQL или слоя данных из-за дорогостоящих вложенных запросов.2V4.3.22Убедитесь, что introspection-запросы GraphQL отключены в продакшен-среде, если GraphQL API не предназначен для использования сторонними клиентами.2V4.44WebSocketV4.4.11Убедитесь, что для всех WebSocket-соединений используется WebSocket поверх TLS (WSS).1V4.4.22Убедитесь, что при первоначальном HTTP WebSocket handshake заголовок Origin проверяется на соответствие списку разрешённых источников для приложения.2V4.4.33Убедитесь, что если стандартное управление сессиями приложения не может быть использовано, применяются специальные токены, соответствующие требованиям безопасности управления сессиями.2V4.4.44Убедитесь, что специальные токены управления сессиями WebSocket изначально получаются или валидируются через ранее аутентифицированную HTTPS-сессию при переходе от HTTPS к WebSocket.2V55FileРабота с файламиV5.11Документация по работе с файламиV5.1.11Убедитесь, что документация определяет допустимые типы файлов, ожидаемые расширения и максимальный размер (включая распакованный размер) для каждой функции загрузки. Также убедитесь, что в документации указано, как файлы обезвреживаются для конечных пользователей (например, как приложение ведёт себя при обнаружении вредоносного файла).2V5.22Загрузка файлов и содержимоеV5.2.11Убедитесь, что приложение принимает только те файлы, которые может обработать без потери производительности или отказа в обслуживании.1V5.2.22Убедитесь, что при загрузке файла (включая файлы внутри архивов, таких как ZIP) приложение проверяет, соответствует ли расширение ожидаемому, и валидирует, соответствует ли содержимое типу, указанному в расширении. Это включает проверку начальных 'magic bytes', перезапись изображений, использование специализированных библиотек. Для уровня 1 — достаточно проверок для файлов, критичных с точки зрения бизнеса или безопасности. Для уровней 2 и выше — для всех файлов.1V5.2.33Убедитесь, что приложение проверяет архивы (например, zip, gz, docx, odt) на максимально допустимый распакованный размер и максимальное количество файлов до распаковки.2V5.2.44Убедитесь, что для каждого пользователя установлены квоты на общий размер и количество файлов, чтобы один пользователь не мог переполнить хранилище.3V5.2.55Убедитесь, что приложение не позволяет загружать архивы с символьными ссылками (symlinks), если это не требуется по бизнес-логике. Если требуется — разрешён только строго определённый список допустимых символьных ссылок.3V5.2.66Убедитесь, что приложение отклоняет изображения с числом пикселей выше допустимого, чтобы предотвратить атаки 'pixel flood'.3V5.33Хранение файловV5.3.11Убедитесь, что загруженные или сгенерированные из недоверенного ввода файлы, находящиеся в публичной директории, не исполняются как серверный код при обращении к ним по HTTP.1V5.3.22Убедитесь, что при создании путей к файлам приложение использует внутренние или доверенные данные, а не пользовательские имена файлов. Если использование пользовательских имён или метаданных необходимо — требуется строгая проверка и очистка. Это защита от path traversal, LFI, RFI и SSRF.1V5.3.33Убедитесь, что при обработке файлов на сервере (например, при распаковке) игнорируются пути, заданные пользователем, во избежание уязвимостей типа 'zip slip'.3V5.44Скачивание файловV5.4.11Убедитесь, что приложение валидирует или игнорирует имена файлов, переданных пользователем (включая в JSON, JSONP или URL-параметре), и указывает имя файла в заголовке Content-Disposition при ответе.2V5.4.22Убедитесь, что имена файлов, передаваемые (например, в HTTP-заголовках или вложениях в email), кодируются или очищаются (например, по RFC 6266), чтобы сохранить структуру документа и предотвратить инъекции.2V5.4.33Убедитесь, что файлы, полученные из недоверенных источников, сканируются антивирусом, чтобы не распространять известное вредоносное содержимое.2V66AuthenticationАутентификацияV6.11Документация по аутентификацииV6.1.11Убедитесь, что в документации приложения описано, как используются механизмы, такие как ограничение частоты запросов (rate limiting), защита от автоматизации и адаптивные реакции, для защиты от атак, таких как подстановка учётных данных и перебор паролей. Документация должна ясно описывать конфигурацию этих механизмов и предотвращение злонамеренной блокировки аккаунтов.1V6.1.22Убедитесь, что задокументирован список контекстно-зависимых слов, запрещённых к использованию в паролях. В него могут входить производные от названий организаций, продуктов, идентификаторов систем, кодовых названий проектов, названий отделов или ролей и тому подобное.2V6.1.33Убедитесь, что если приложение поддерживает несколько способов аутентификации, то все они документированы вместе с описанием применяемых средств защиты и уровнем стойкости аутентификации, которые должны быть одинаково применены ко всем способам.2V6.22Безопасность паролейV6.2.11Убедитесь, что пользовательские пароли содержат не менее 8 символов. Рекомендуется минимальная длина в 15 символов.1V6.2.22Убедитесь, что пользователи могут менять свои пароли.1V6.2.33Убедитесь, что для смены пароля требуется ввести как текущий, так и новый пароль.1V6.2.44Убедитесь, что при регистрации или смене пароля введённый пароль проверяется по списку как минимум из 3000 самых популярных паролей, соответствующих политике (например, минимальной длине).1V6.2.55Убедитесь, что допускаются пароли любой структуры, без ограничений на использование определённых символов. Не должно быть требований по обязательному наличию заглавных/строчных букв, цифр или специальных символов.1V6.2.66Убедитесь, что поля ввода пароля используют type=password для скрытия символов. Разрешено временное отображение всего пароля или последнего введённого символа.1V6.2.77Убедитесь, что разрешены вставка (paste), использование менеджеров паролей браузера и внешних менеджеров паролей.1V6.2.88Убедитесь, что пароль проверяется строго в том виде, в котором он был введён пользователем — без обрезки, изменения регистра и других модификаций.1V6.2.99Убедитесь, что система позволяет использовать пароли длиной не менее 64 символов.2V6.2.1010Убедитесь, что пароль остаётся действительным, пока не будет скомпрометирован или не будет изменён пользователем. Приложение не должно требовать регулярной смены пароля.2V6.2.1111Убедитесь, что используется документированный список контекстно-зависимых слов (например, названия компаний, проектов и т.д.) для предотвращения использования легко угадываемых паролей.2V6.2.1212Убедитесь, что при регистрации или смене пароля проверяется, не входит ли он в список скомпрометированных (утёкших) паролей.2V6.33Общие требования к безопасности аутентификацииV6.3.11Убедитесь, что реализованы меры защиты от атак типа credential stuffing (массовая подстановка учётных данных) и brute-force (перебор паролей), согласно документации по безопасности приложения.1V6.3.22Убедитесь, что в приложении отсутствуют или отключены учётные записи по умолчанию (например, root, admin, sa).1V6.3.33Убедитесь, что для доступа к приложению используется либо механизм многофакторной аутентификации, либо комбинация однофакторных. Для уровня L3 один из факторов должен быть аппаратным, обеспечивающим защиту от фишинга, устойчивость к компрометации и подтверждение намерения аутентификации через явное действие пользователя (например, нажатие кнопки на FIDO-ключе или телефоне). Ослабление этих требований допускается только при наличии обоснования и компенсирующих мер.2V6.3.44Убедитесь, что при наличии нескольких способов аутентификации, они все задокументированы, и для них единообразно применяются меры защиты и уровни доверия.2V6.3.55Убедитесь, что пользователи получают уведомления о подозрительных попытках аутентификации (удачных и неудачных). Это может включать попытки (например, подключения) с необычного устройства или места, частично успешную MFA, попытку после долгого отсутствия или успешную аутентификацию после серии неудачных.3V6.3.66Убедитесь, что email не используется ни как однофакторный, ни как многофакторный механизм аутентификации.3V6.3.77Убедитесь, что пользователи получают уведомление при изменении данных аутентификации, таких как сброс пароля или изменение логина/email.3V6.3.88Убедитесь, что из сообщений об ошибке, HTTP-кодов ответа или различий во времени ответа нельзя определить, существует ли пользователь с таким логином. Это правило также должно применяться к функциям регистрации и восстановления пароля.3V6.44Жизненный цикл и восстановление факторов аутентификацииV6.4.11Убедитесь, что начальные пароли или коды активации, генерируемые системой, создаются с использованием надёжного генератора случайных чисел, соответствуют текущей политике паролей и истекают через короткий период времени либо после первого использования. Эти секреты не должны использоваться как постоянные пароли.1V6.4.22Убедитесь, что в системе отсутствуют подсказки к паролю или вопросы на знание («секретные вопросы»).1V6.4.33Убедитесь, что реализован безопасный процесс сброса забытого пароля, который не обходит активные механизмы многофакторной аутентификации.2V6.4.44Убедитесь, что в случае утраты одного из факторов MFA проводится удостоверение личности (identity proofing) на том же уровне, что и при первичной регистрации.2V6.4.55Убедитесь, что инструкции по обновлению истекающих механизмов аутентификации отправляются заранее, с достаточным запасом времени для выполнения замены, при необходимости с настройкой автоматических напоминаний.3V6.4.66Убедитесь, что администраторы могут инициировать процесс сброса пароля, но не могут задать или выбрать новый пароль за пользователя. Это исключает ситуацию, при которой администратор знает пароль пользователя.3V6.55Общие требования к многофакторной аутентификацииV6.5.11Убедитесь, что lookup-секреты, внеполосные коды/запросы и TOTP-коды можно использовать только один раз.2V6.5.22Убедитесь, что при хранении lookup-секретов с энтропией менее 112 бит (например, 19 случайных буквенно-цифровых символов или 34 случайные цифры) они хэшируются с использованием разрешённого алгоритма хеширования паролей и случайной соли минимум 32 бита. Если у секрета ≥112 бит энтропии — допустимо использовать стандартный хэш.2V6.5.33Убедитесь, что lookup-секреты, коды внеполосной аутентификации и сиды для TOTP генерируются с использованием криптографически стойкого генератора случайных чисел (CSPRNG), чтобы избежать предсказуемых значений.2V6.5.44Убедитесь, что lookup-секреты и внеполосные коды аутентификации имеют минимум 20 бит энтропии (достаточно, например, 4 случайных алфавитно-цифровых символов или 6 случайных цифр).2V6.5.55Убедитесь, что все внеполосные запросы, коды и токены, а также TOTP-коды имеют ограниченный срок действия. Максимум для out-of-band — 10 минут, для TOTP — 30 секунд.2V6.5.66Убедитесь, что любой фактор аутентификации (включая физические устройства) может быть отозван в случае кражи или утери.3V6.5.77Убедитесь, что биометрические механизмы аутентификации используются только как вторичный фактор — в сочетании с «чем-то, что вы знаете» или «чем-то, что у вас есть».3V6.5.88Убедитесь, что TOTP-коды проверяются по источнику времени, полученному от доверенного сервиса, а не от клиента или недоверенного источника.3V6.66Внеполосные механизмы аутентификацииV6.6.11Убедитесь, что механизмы аутентификации через телефонную сеть общего пользования (PSTN) для доставки одноразовых паролей (OTP) по телефону или SMS используются только в случае предварительной валидации номера, при этом предлагаются альтернативные более безопасные методы (например, TOTP), и пользователю сообщаются риски. Для приложений уровня L3 использование телефона и SMS недопустимо.2V6.6.22Убедитесь, что внеполосные запросы, коды или токены привязаны к исходному запросу аутентификации, для которого они были сгенерированы, и не могут быть использованы повторно для других попыток.2V6.6.33Убедитесь, что внеполосные механизмы на основе кода защищены от атак методом подбора (brute force) путём применения ограничения частоты запросов (rate limiting). Также рекомендуется использовать коды с энтропией не менее 64 бит.2V6.6.44Убедитесь, что при использовании push-уведомлений для MFA применяется ограничение частоты (rate limiting), чтобы предотвратить атаки push-бомбинга. Также может помочь механизм сопоставления номеров (number matching).3V6.77Криптографические механизмы аутентификацииV6.7.11Убедитесь, что сертификаты, используемые для проверки криптографических утверждений об аутентификации, хранятся таким образом, чтобы исключить возможность их модификации.3V6.7.22Убедитесь, что nonce (случайная строка), используемая в процессе вызова, имеет длину не менее 64 бит и является статистически уникальной или уникальной на протяжении всего срока службы криптографического устройства.3V6.88Аутентификация с использованием провайдера идентификаций (IdP)V6.8.11Убедитесь, что при поддержке несколькими IdP, невозможно подделать личность пользователя через другой IdP (например, с тем же user ID). Стандартным способом защиты является регистрация пользователя с использованием сочетания ID самого IdP (в качестве пространства имён) и пользовательского ID внутри IdP.2V6.8.22Убедитесь, что наличие и целостность цифровой подписи в утверждениях аутентификации (например, в JWT или SAML) всегда проверяются, а неподписанные или недействительные утверждения отклоняются.2V6.8.33Убедитесь, что SAML-утверждения обрабатываются только один раз в течение периода их действия, чтобы исключить атаки воспроизведения (replay attacks).2V6.8.44Убедитесь, что если приложение использует внешний поставщик идентификации (IdP) и для определенных функций требуется особый уровень, метод или срок действия аутентификации, то приложение использует данные, возвращаемые IdP, для проверки этих условий. Например, при использовании OIDC можно проверить значения полей ID Token — acr, amr, auth_time (если они есть). Если IdP не предоставляет эти данные, приложение должно иметь документированный план действий по умолчанию, предполагающий использование минимально допустимой силы аутентификации (например, одноступенчатая — логин и пароль).2V77SessionУправление сессиямиV7.11Документация по управлению сессиямиV7.1.11Убедитесь, что тайм-аут бездействия и абсолютное максимальное время жизни сессии задокументированы, соответствуют другим контрольным мерам и сопровождаются обоснованием любых отклонений от требований повторной аутентификации NIST SP 800-63B.2V7.1.22Убедитесь, что документация определяет допустимое количество одновременных (параллельных) сессий для одного аккаунта, а также поведение системы и действия при достижении этого лимита.2V7.1.33Убедитесь, что все системы, создающие и управляющие сессиями пользователей в рамках федеративной идентификации (например, SSO), задокументированы вместе с механизмами координации сроков действия сессий, условий завершения и случаев, требующих повторной аутентификации.2V7.22Базовая безопасность сессийV7.2.11Убедитесь, что все проверки сессионных токенов выполняются на доверенной серверной стороне.1V7.2.22Убедитесь, что приложение использует либо автономные токены, либо ссылочные токены, которые генерируются динамически, не используя статические API-секреты или ключи.1V7.2.33Убедитесь, что ссылочные токены являются уникальными, создаются с использованием криптографически безопасного генератора псевдослучайных чисел (CSPRNG) и обладают энтропией не менее 128 бит.1V7.2.44Убедитесь, что при аутентификации пользователя (включая повторную) создается новый токен сессии, а текущий — аннулируется.1V7.33Тайм-ауты сессииV7.3.11Убедитесь, что есть тайм-аут бездействия, после которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.2V7.3.22Убедитесь, что установлено абсолютное максимальное время жизни сессии, по истечении которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.2V7.44Завершение сессийV7.4.11Убедитесь, что после завершения сессии (logout, истечение срока) дальнейшее её использование невозможно. Для ссылочных токенов или сессий с сохранением состояния это означает аннулирование на сервере. Для self-contained токенов необходимо реализовать механизм отзыва, например, список отозванных токенов, проверку времени выпуска или ротацию ключей подписи для каждого пользователя.1V7.4.22Убедитесь, что при удалении или отключении пользователя все активные сессии немедленно завершаются.1V7.4.33Убедитесь, что после изменения или удаления факторов аутентификации (например, смена пароля или MFA) приложение предлагает завершить все другие активные сессии.2V7.4.44Убедитесь, что на всех страницах, требующих аутентификации, имеется простой и видимый способ выхода.2V7.4.55Убедитесь, что администраторы могут завершать активные сессии конкретного пользователя или всех пользователей.2V7.55Защита от злоупотреблений сессиейV7.5.11Убедитесь, что приложение требует полной повторной аутентификации перед изменением чувствительных атрибутов аккаунта, которые могут влиять на аутентификацию (например, email, номер телефона, настройки MFA или данных восстановления доступа).2V7.5.22Убедитесь, что пользователь может просматривать и (после повторной аутентификации хотя бы по одному фактору) завершать активные сессии.2V7.5.33Убедитесь, что перед выполнением критически важных операций приложение требует повторной аутентификации (по крайней мере, одного фактора) или дополнительной проверки.3V7.66Федеративная повторная аутентификацияV7.6.11Убедитесь, что срок действия и завершение сессий между RP и IdP соответствуют документации и включают повторную аутентификацию, если достигнут максимальный допустимый интервал между событиями аутентификации.2V7.6.22Убедитесь, что создание сессии требует согласия пользователя или явного действия, предотвращающего несанкционированное создание сессий без участия пользователя.2V88AuthorizationАвторизацияV8.11Документация по авторизацииV8.1.11Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне функций и на уровне данных на основе прав субъекта и атрибутов ресурса.1V8.1.22Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне полей (как на чтение, так и на запись) на основе прав субъекта и атрибутов ресурса. Эти правила могут зависеть от других атрибутов объекта данных, например, статуса.2V8.1.33Убедитесь, что документация определяет, какие атрибуты окружения и контекста (например, время суток, IP-адрес, местоположение, устройство) используются приложением для принятия решений в области аутентификации и авторизации.3V8.1.44Убедитесь, что документация по аутентификации и авторизации определяет, как используются факторы окружения и контекста в принятии решений, наряду с правилами доступа к функциям, данным и полям. Документация должна содержать оцениваемые атрибуты, пороговые значения риска, действия (разрешить, отказать, повысить уровень аутентификации и др.).3V8.22Архитектура авторизацииV8.2.11Убедитесь, что приложение обеспечивает доступ на уровне функций (function-level) только субъектам с явными разрешениями.1V8.2.22Убедитесь, что приложение обеспечивает доступ на уровне данных (data-specific) только тем субъектам, которым явно предоставлены права к определённым элементам данных, чтобы предотвратить IDOR (Insecure Direct Object Reference) и BOLA-уязвимости (Broken Object Level Authorization).1V8.2.33Убедитесь, что приложение обеспечивает доступ на уровне полей (field-level) только тем субъектам, которым явно предоставлены права к определённым полям, чтобы предотвратить BOPLA (Broken Object Property Level Authorization).2V8.2.44Убедитесь, что реализованы адаптивные меры безопасности, основанные на атрибутах окружения и контекста субъекта (время, местоположение, IP, устройство), которые используются для принятия решений об аутентификации и авторизации, как это определено в документации приложения. Эти меры должны применяться как при попытке субъекта начать новую сессию, так и во время существующей сессии.3V8.33Авторизация на уровне операцийV8.3.11Убедитесь, что правила авторизации реализуются на доверенном сервисном уровне и не зависят от элементов, которые может контролировать клиент (например, JavaScript на стороне клиента).1V8.3.22Убедитесь, что изменения значений, влияющих на авторизацию, применяются немедленно. Если это невозможно (например, при использовании автономных токенов), должны быть реализованы компенсирующие меры: оповещения о попытке несанкционированного действия и откат изменений. Обратите внимание, что данный подход не предотвращает утечку информации.3V8.3.33Убедитесь, что доступ к объекту осуществляется на основе прав субъекта, инициировавшего запрос, а не прав промежуточного сервиса, действующего от его имени. Например, если пользователь обращается к веб-сервису с автономным токеном для аутентификации, а сервис затем запрашивает данные у другого сервиса, второй сервис должен использовать токен пользователя, а не токен первого сервиса для принятия решения о доступе.3V8.44Прочие аспекты авторизацииV8.4.11Убедитесь, что в мультитенантных приложениях реализованы механизмы, предотвращающие действия потребителя в отношении арендаторов, к которым у него нет доступа.2V8.4.22Убедитесь, что доступ к административным интерфейсам защищён несколькими уровнями контроля, включая непрерывную проверку личности, контроль защищённости устройства и анализ контекстных рисков. Недостаточно опираться только на IP-адрес или доверенные устройства.3V99SelfАвтономные токеныV9.11Источник токена и его целостностьV9.1.11Убедитесь, что автономные токены проверяются на целостность с помощью цифровой подписи или MAC, прежде чем доверять их содержимому.1V9.1.22Проверяйте, что автономные токены создаются и проверяются исключительно с помощью алгоритмов из списка допустимых в данном контексте. Список допустимых алгоритмов должен включать только разрешенные алгоритмы (желательно либо только симметричные, либо только асимметричные) и ни в коем случае не содержать алгоритм None. Если необходимо поддерживать оба типа алгоритмов, потребуются дополнительные средства контроля для предотвращения путаницы с ключами (key confusion).1V9.1.33Убедитесь, что ключи, используемые для проверки автономных токенов, получены из доверенных, предварительно настроенных источников. Это предотвращает возможность указания злоумышленниками ненадёжных источников и ключей. Для JWT и других JWS структур заголовки 'jku', 'x5u' и 'jwk' должны проверяться по белому списку.1V9.22Содержимое токенаV9.2.11Убедитесь, что при указанном сроке действия токен и его содержимое принимаются только в том случае, если срок действия токена не истёк. Например, для JWT нужно проверить поля 'nbf' и 'exp'.1V9.2.22Убедитесь, что сервис, принимающий токен, проверяет его тип и соответствие назначению перед обработкой содержимого токена. Например, для принятия решений об авторизации могут быть приняты только Access Token, а для подтверждения аутентификации пользователя — только ID Token.2V9.2.33Убедитесь, что сервис принимает только токены, предназначенные для использования с этим сервисом (audience). Для JWT это можно сделать, проверив наличие утверждения «aud» по белому списку, определенному в сервисе.2V9.2.44Убедитесь, что, если эмитент токенов использует один и тот же закрытый ключ для выпуска токенов различным сервисам (audiences), выпущенные токены содержат явное указание целевых сервисов. Это предотвратит повторное использования токенов в не предназначенных для них сервисах. Если идентификатор сервиса (audience identifier) назначается динамически, эмитент токенов должен проверить audiences для исключения подмены получателей (audience impersonation).2V1010OAuthOAuth и OIDCV10.11Общие требования безопасности OAuth и OIDCV10.1.11Убедитесь, что токены передаются только тем компонентам, которым они действительно необходимы. Например, при использовании схемы backend-for-frontend для браузерных JavaScript-приложений, access и refresh токены должны быть доступны только на backend.2V10.1.22Убедитесь, что клиент принимает значения от авторизационного сервера (например, authorization code или ID Token) только если они получены в результате авторизационного потока, инициированного в той же сессии пользовательского агента и в рамках той же транзакции. Для этого клиентские секреты, такие как proof key для code exchange (PKCE) — 'code_verifier', 'state' или OIDC 'nonce' — должны быть непредсказуемыми, специфичными для транзакции и надежно привязанными как к клиенту, так и к сессии пользовательского агента, в которой началась транзакция.2V10.22Клиент OAuthV10.2.11Убедитесь, что если используется механизм authorization code flow, OAuth клиент защищён от CSRF, вызывающих запросы токенов либо за счёт использования механизма proof key for code exchange (PKCE), либо за счёт проверки параметра 'state', который был отправлен в запросе авторизации.2V10.2.22Убедитесь, что если OAuth клиент может взаимодействовать с более чем одним сервером авторизации, у него есть защита от атак смешивания (mix-up attacks). Например, клиент должен требовать, чтобы сервер авторизации возвращал параметр 'iss' и проверять его в ответах на авторизацию и токены.2V10.2.33Убедитесь, что OAuth клиент запрашивает только необходимые области доступа (scopes) или другие параметры авторизации в запросах к серверу авторизации.3V10.33Сервер ресурсов OAuthV10.3.11Убедитесь, что сервер ресурсов принимает только те access токены, которые предназначены для использования с этим сервисом (свойство audience). Эта принадлежность сервису может быть включена в структурированный access токен (например, в поле 'aud' в JWT) или проверяться через endpoint интроспекции токена.2V10.3.22Убедитесь, что сервер ресурсов принимает решения по авторизации на основе claims из access токена, определяющих делегированную авторизацию. Если присутствуют claims, такие как 'sub', 'scope' и 'authorization_details', они должны участвовать в принятии решения.2V10.3.33Убедитесь, что если для принятия решения по контролю доступа необходимо однозначно идентифицировать пользователя из access токена (JWT или ответа интроспекции), сервер ресурсов использует claims, которые не могут быть переприсвоены другим пользователям. Обычно это комбинация claims 'iss' и 'sub'.2V10.3.44Убедитесь, что если сервер ресурсов требует определённой силы аутентификации, методов или свежести аутентификации, он проверяет, что предъявленный access токен удовлетворяет этим требованиям. Например, при наличии, могут использоваться claims OIDC 'acr', 'amr' и 'auth_time'.2V10.3.55Убедитесь, что сервер ресурсов предотвращает использование украденных access токенов или их повторное использование (replay) неавторизованными лицами, требуя access токены с подтверждением отправителя — например, Mutual TLS для OAuth 2 или OAuth 2 Demonstration of Proof of Possession (DPoP).3V10.44Сервер авторизации OAuthV10.4.11Убедитесь, что сервер авторизации проверяет URI перенаправления (redirect URI), сверяя его с заранее зарегистрированным списком разрешённых URI для данного клиента (allowlist), используя точное сравнение строк.1V10.4.22Убедитесь, что если сервер авторизации возвращает authorization code в ответе авторизации, этот код может быть использован только один раз для запроса токена. При втором валидном запросе с уже использованным кодом сервер должен отклонить запрос и отозвать любые токены, связанные с этим кодом.1V10.4.33Убедитесь, что authorization code имеет короткое время жизни. Максимальная продолжительность — до 10 минут для приложений L1 и L2 и до 1 минуты для приложений L3.1V10.4.44Убедитесь, что сервер авторизации для конкретного клиента разрешает использование только тех типов авторизации, которые необходимы этому клиенту. Обратите внимание, что тип авторизации Implicit flow и Resource Owner Password Credentials flow больше не должны использоваться.1V10.4.55Убедитесь, что сервер авторизации предотвращает атаки повторного использования refresh токенов для публичных клиентов, предпочтительно используя sender-constrained refresh токены, такие как DPoP или сертификат-связанные токены с mutual TLS (mTLS). Для L1 и L2 допускается ротация refresh токенов с обязательной их инвалидацией после использования. Если используется ротация, сервер должен отозвать все refresh токены при попытке использовать уже инвалидированный токен.1V10.4.66Убедитесь, что при использовании типа авторизации «Authorization Code» сервер предотвращает атаки перехвата authorization code, требуя Proof Key for Code Exchange (PKCE). В запросах авторизации сервер должен требовать валидное значение 'code_challenge' и не принимать 'code_challenge_method' со значением 'plain'. В запросах токена обязательно валидировать параметр 'code_verifier'.2V10.4.77Убедитесь, что если сервер авторизации поддерживает динамическую регистрацию клиентов без аутентификации, он минимизирует риски вредоносных клиентов. Сервер должен валидировать метаданные клиента (например, зарегистрированные URI), обеспечивать согласие пользователя и предупреждать пользователя перед обработкой запроса авторизации от недоверенного клиента.2V10.4.88Убедитесь, что refresh токены имеют абсолютный срок действия, включая случаи, когда применяется скользящее время истечения срока.2V10.4.99Убедитесь, что пользователи могут отзывать refresh токены и reference access токены через пользовательский интерфейс сервера авторизации для снижения риска от вредоносных клиентов или кражи токенов.2V10.4.1010Убедитесь, что конфиденциальный клиент аутентифицируется при взаимодействии с сервером авторизации через backchannel, например при запросах токена, pushed authorization requests (PAR) и запросах на отзыв токенов.2V10.4.1111Убедитесь, что конфигурация сервера авторизации назначает OAuth клиенту только необходимые области доступа (scopes).2V10.4.1212Убедитесь, что для конкретного клиента сервер авторизации разрешает только те значения 'response_mode', которые необходимы этому клиенту. Например, сервер должен валидировать это значение против ожидаемых или использовать pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).3V10.4.1313Убедитесь, что грант типа 'code' всегда используется вместе с pushed authorization requests (PAR).3V10.4.1414Убедитесь, что сервер авторизации выдаёт только sender-constrained (Proof-of-Possession) access токены, либо с сертификат-связанными токенами через mutual TLS (mTLS), либо DPoP-bound токены (Demonstration of Proof of Possession).3V10.4.1515Убедитесь, что для серверного клиента (не выполняющегося на устройстве конечного пользователя) сервер авторизации проверяет, что значение параметра 'authorization_details' исходит из клиентского backend и что пользователь не изменял его. Например, это достигается использованием pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).3V10.4.1616Убедитесь, что клиент является конфиденциальным и сервер авторизации требует использования сильных методов аутентификации клиента (основанных на криптографии с открытым ключом и устойчивых к атакам повторного воспроизведения), таких как mutual TLS ('tls_client_auth', 'self_signed_tls_client_auth') или private key JWT ('private_key_jwt').3V10.55Клиент OIDCV10.5.11Убедитесь, что клиент (relying party) защищается от повторного использования ID Token (replay-атак). Например, это достигается проверкой того, что значение 'nonce' в ID Token совпадает со значением 'nonce', отправленным в запросе аутентификации провайдеру OpenID (authorization server).2V10.5.22Убедитесь, что клиент однозначно идентифицирует пользователя по утверждениям (claims) ID Token, обычно это 'sub', который не может быть переназначен другому пользователю (в пределах конкретного провайдера идентификации).2V10.5.33Убедитесь, что клиент отклоняет попытки злоумышленного сервера авторизации выдавать себя за другой сервер авторизации через метаданные сервера авторизации. Клиент должен отклонить метаданные, если URL издателя (issuer) в метаданных не совпадает точно с преднастроенным URL издателя, ожидаемым клиентом.2V10.5.44Убедитесь, что клиент проверяет, что ID Token предназначен для него (проверка audience), сравнивая значение 'aud' в токене с 'client_id' клиента.2V10.5.55Убедитесь, что при использовании OIDC back-channel logout клиент снижает риск отказа в обслуживании, вызванный принудительным выходом из системы и путаницей между разными типами JWT (cross-JWT confusion) в процессе логаута. Клиент должен проверить, что токен выхода корректно типизирован со значением 'logout+jwt', содержит claim 'event' с правильным именем участника и не содержит 'nonce'. Также рекомендуется установить короткий срок действия токена (например, 2 минуты).2V10.66Провайдер OpenIDV10.6.11Убедитесь, что провайдер OpenID допускает только значения 'code', 'ciba', 'id_token' или 'id_token code' для параметра response mode. При этом предпочтение отдаётся 'code' по сравнению с 'id_token code' (гибридный поток OIDC), а значение 'token' (любой Implicit flow) не должно использоваться.2V10.6.22Убедитесь, что провайдер OpenID предотвращает отказ в обслуживании (DoS) через принудительный выход (logout), запрашивая явное подтверждение от конечного пользователя или, если применимо, проверяя параметры в запросе выхода (инициированном relying party), например параметр 'id_token_hint'.2V10.77Управление согласиемV10.7.11Убедитесь, что авторизационный сервер обеспечивает получение согласия пользователя для каждого запроса авторизации. Если личность клиента не может быть подтверждена, сервер авторизации всегда должен явно запрашивать согласие пользователя.2V10.7.22Убедитесь, что при запросе согласия пользователя авторизационный сервер предоставляет достаточную и понятную информацию о том, на что даётся согласие. При необходимости это должно включать характер запрашиваемых разрешений (обычно основанных на scope, ресурсном сервере, деталях авторизации Rich Authorization Requests (RAR)), идентификацию авторизованного приложения и срок действия этих разрешений.2V10.7.33Убедитесь, что пользователь может просматривать, изменять и отзывать согласия, которые он предоставил, через авторизационный сервер.2V1111CryptographyКриптографияV11.11Инвентаризация и документирование криптографииV11.1.11Убедитесь, что задокументирована политика управления криптографическими ключами и описан их жизненный цикл в соответствии со стандартом управления ключей, таким как NIST SP 800-57. Убедитесь, что ключи известны только тем сущностям, которым они должны быть доступны (например, ключи не передавались более чем двум участникам для общих секретов и более чем одному участнику для приватных ключей).2V11.1.22Убедитесь, что проводится инвентаризация криптографических средств, которая непрерывно поддерживается, регулярно обновляется и включает все криптографические ключи, алгоритмы и сертификаты, используемые в приложении. Также должна быть задокументирована информация о том, где ключи могут и не могут использоваться в системе, а также какие типы данных могут и не могут быть защищены с помощью этих ключей.2V11.1.33Убедитесь, что используются механизмы обнаружения криптографии для идентификации всех случаев применения криптографии в системе , включая операции шифрования, хеширования и цифровой подписи.3V11.1.44Убедитесь, что ведётся и поддерживается инвентаризация криптографических средств. В неё должен входить документированный план, описывающий переход на новые криптографические стандарты, такие как постквантовая криптография, чтобы своевременно реагировать на будущие угрозы.3V11.22Безопасная реализация криптографииV11.2.11Убедитесь, что для криптографических операций используются утвержденные в индустрии реализации (включая библиотеки и аппаратные реализации).2V11.2.22Убедитесь, что архитектура приложения поддерживает быструю реконфигурацию, усовершенствование или смену в любой момент случайных чисел, аутентифицированного шифрования, MAC, алгоритмов хеширования, длин ключей, количества раундов, шифров и режимов шифрования для защиты от криптографических атак. Также должна поддерживаться возможность смены ключей, паролей и повторного шифрования данных. Это позволит беспрепятственно перейти на постквантовую криптографию (PQC), как только станут широко доступны высоконадёжные реализации одобренных схем или стандартов PQC.2V11.2.33Убедитесь, что все криптографические примитивы используют как минимум 128-бит стойкости с учетом алгоритма, размера ключа и конфигурации. Например, 256-битный ECC ключ обеспечивает примерно 128 бит безопасности, тогда как для достижения того же уровня безопасности в RSA требуется ключ длиной 3072 бита.2V11.2.44Убедитесь, что все криптографические операции выполняются за константное время, без использования «short-circuit» операций в сравнениях, вычислениях, возвратах функций для избежания утечек информации.3V11.2.55Убедитесь, что все криптографические модули обеспечивают безопасное завершение работы при ошибках, а обработка ошибок реализована таким образом, чтобы не создавать уязвимостей, например, таких как атаки Padding Oracle.3V11.33Алгоритмы шифрованияV11.3.11Убедитесь, что не используются небезопасные режимы блочного шифрования (н-р, ECB) и слабые схемы дополнения (padding) (н-р, PKCS#1 v1.5).1V11.3.22Убедитесь, что используются только утверждённые шифры и режимы, такие как AES с GCM.1V11.3.33Убедитесь, что зашифрованные данные защищены от несанкционированного изменения, предпочтительно с использованием утверждённого метода аутентифицированного шифрования или путём комбинирования утверждённого метода шифрования с утверждённым алгоритмом MAC.2V11.3.44Убедитесь, что случайные числа (nonce), векторы инициализации (IV) и другие одноразовые числа не используются более одного раза для одной и той же пары ключа шифрования и элемента данных. Метод их генерации должен соответствовать требованиям используемого алгоритма.3V11.3.55Убедитесь, что любая комбинация алгоритма шифрования и алгоритма MAC работает в режиме encrypt-then-MAC (EtM).3V11.44Хеширование и функции на основе хешированияV11.4.11Убедитесь, что только утвержденные хэш-функции используются для стандартных сценариев использования в криптографии, включая цифровую подпись, HMAC, KDF, генерацию случайных чисел. Запрещено использовать неустойчивые хэш-функции, (н-р, MD5) для любого использования в криптографии.1V11.4.22Убедитесь, что пароли хранятся с использованием утверждённой, вычислительно затратной функции генерации ключа (также известной как «функция хеширования паролей»), с параметрами, настроенными в соответствии с актуальными рекомендациями. Настройки должны обеспечивать баланс между безопасностью и производительностью, чтобы сделать атаки перебором достаточно сложными для требуемого уровня безопасности.2V11.4.33Убедитесь, что хэш-функции, используемые в формировании цифровой подписи, как часть аутентификации и целостности данных, устойчивы к коллизиям и имеют достаточную длину.2V11.4.44Убедитесь, что приложение использует утвержденную функцию генерации ключа с использованием параметров расширения ключа (key stretching) при генерации ключа из пароля. Параметры должны быть сбалансированы с точки зрения безопасности, производительности и устойчивости к атакам полного перебора при компрометации результирующего криптографического ключа.2V11.55Случайные значенияV11.5.11Убедитесь, что все случайные числа и строки, которые должны быть непредсказуемы, должны быть сгенерированы с помощью CSPRNG и иметь хотя бы 128 бит энтропии. Учтите, что UUID не удовлетворяют данному условию.2V11.5.22Убедитесь, что механизм генерации случайных чисел является надежным даже при высокой нагрузке.3V11.66Криптография с публичным ключомV11.6.11Убедитесь, что только утвержденные криптографические алгоритмы и режимы операций используются для генерации ключа и инициализации случайного значения для его генерации (seeding), а также для генерации цифровой подписи и верификации. Алгоритмы генерации ключей не должны генерировать небезопасные ключи уязвимые к известным атакам, например, ключи RSA уязвимы к факторизации Ферма.2V11.6.22Убедитесь, что для обмена ключами используются утверждённые криптографические алгоритмы (например, Диффи-Хеллман) с особым вниманием к обеспечению использования безопасных параметров. Это предотвратит атаки на процесс установления ключа, которые могут привести к атакам «человек посередине» или криптографическим взломам.3V11.77Шифрование данных в процессе использованияV11.7.11Убедитесь, что используется полное шифрование памяти, которое защищает конфиденциальные данные во время их использования, предотвращая доступ к ним неавторизованных пользователей или процессов.3V11.7.22Убедитесь, что минимизация данных обеспечивает раскрытие минимально необходимого объёма данных во время обработки, а также что данные шифруются сразу после использования или как можно скорее.3V1212SecureБезопасная коммуникацияV12.11Общие рекомендации по безопасности TLSV12.1.11Убедитесь, что включены только актуальные и рекомендуемые версии протокола TLS, такие как TLS 1.2 и TLS 1.3. Наиболее свежая версия TLS должна быть выбрана как предпочтительная.1V12.1.22Убедитесь, что включены рекомендуемые шифронаборы (cipher suites), предпочтение также стоит отдать самому сильному шифронабору. L3 приложения должны поддерживать только те наборы шифров (cipher suites), которые обеспечивают прямую (forward) секретность. Пояснение: Прямая секретность (Forward Secrecy, FS) — это криптографическая особенность, при которой сессионные ключи уникальны для каждой сессии и не зависят от долгосрочных ключей. Это гарантирует, что даже при компрометации долгосрочного ключа злоумышленник не сможет расшифровать ранее перехваченные зашифрованные сессии.2V12.1.33Убедитесь, что приложение проверяет доверенность клиентских сертификатов mTLS, прежде чем использовать идентификацию по сертификату для аутентификации или авторизации.2V12.1.44Убедитесь, что включена и настроена правильная проверка отзыва сертификатов, такая как Online Certificate Status Protocol (OCSP) Stapling.3V12.1.55Убедитесь, что в настройках TLS приложения включена функция Encrypted Client Hello (ECH) для предотвращения раскрытия конфиденциальных метаданных, таких как Server Name Indication (SNI), во время процесса TLS-рукопожатия.3V12.22HTTPS коммуникация с внешними сервисамиV12.2.11Убедитесь, что для всех соединений между клиентом и внешними HTTP-сервисами используется TLS и не происходит отката к небезопасным или незашифрованным протоколам.1V12.2.22Убедитесь, что внешние сервисы используют публично доверенные TLS-сертификаты.1V12.33Общая безопасность межсервисного взаимодействияV12.3.11Убедитесь, что для всех входящих и исходящих соединений приложения используется зашифрованный протокол, например TLS, включая системы мониторинга, инструменты управления, удалённый доступ и SSH, промежуточное ПО, базы данных, мейнфреймы, партнёрские системы и внешние API. Сервер не должен допускать откат к небезопасным или незашифрованным протоколам.2V12.3.22Убедитесь, что TLS-клиент проверяет сертификат сервера до установления защищенного соединения с TLS-сервером.2V12.3.33Убедитесь, что все внутренние HTTP-взаимодействия между компонентами приложения используют TLS или другой подходящий механизм транспортного шифрования, и не происходит откат к небезопасным или незашифрованным коммуникациям.2V12.3.44Убедитесь, что TLS-соединения между внутренними сервисами используют доверенные сертификаты. Если используются внутренние или самоподписанные сертификаты, потребляющий сервис должен быть настроен на доверие только к конкретным внутренним центрам сертификации (CA) и конкретным самоподписанным сертификатам.2V12.3.55Убедитесь, что сервисы, взаимодействующие внутри системы (intra-service communications), используют строгую аутентификацию для проверки каждого конечного узла. Для проверки подлинности взаимодействующих сторон должны применяться методы строгой аутентификации, такие как аутентификация TLS-клиента, с использованием инфраструктуры открытых ключей и механизмов, устойчивых к атакам повтора (replay attacks). Для микросервисных архитектур рекомендуется использование service mesh для упрощения управления сертификатами и повышения безопасности.3V1313ConfigurationКонфигурацияV13.11Документация конфигурацииV13.1.11Убедитесь, что все необходимые доступы приложения задокументированы. Сюда должны быть включены как внешние сервисы, от которых зависит приложение, так и сценарии, когда конечный пользователь может задавать адреса для внешнего подключения.2V13.1.22Убедитесь, что для каждого сервиса, используемого приложением, в документации определено максимальное количество одновременных соединений (например, лимиты пула соединений) и описано поведение приложения при достижении этого лимита, включая любые механизмы отказоустойчивости или восстановления, чтобы предотвратить ситуации отказа в обслуживании (DoS).3V13.1.33Убедитесь, что в документации приложения определены стратегии управления ресурсами для каждой внешней системы или сервиса, которые оно использует (например, базы данных, файловые дескрипторы, потоки, HTTP-соединения). Стратегии должны включать процедуры освобождения ресурсов, настройки таймаутов, обработку сбоев, а также, если реализована логика повторных попыток, указание лимитов, задержек и алгоритмов back-off. Для синхронных HTTP-запросов должны быть заданы короткие таймауты, а повторные запросы должны быть отключены, либо строго ограничены по числу попыток, чтобы предотвратить каскадные задержки и истощение ресурсов.3V13.1.44Убедитесь, что в документации приложения определены секреты, критически важные для безопасности приложения, а также установлен график их ротации в соответствии с моделью угроз организации и её бизнес-требованиями.3V13.22Конфигурация бэкенд соединенийV13.2.11Убедитесь, что коммуникации между компонентами бэкенда приложения (включая API, промежуточное ПО и уровни данных), которые не поддерживают стандартный механизм пользовательских сессий, проходят с аутентификацией. Аутентификация должна использовать индивидуальные сервисные аккаунты, краткосрочные токены или аутентификацию на основе сертификатов, а не постоянные учётные данные, такие как пароли, API-ключи или общие аккаунты с привилегированным доступом.2V13.2.22Убедитесь, что коммуникации между компонентами бэкенда приложения, включая локальные или системные службы, API, промежуточное ПО и уровни данных, выполняются с использованием аккаунтов, которым назначены минимально необходимые привилегии.2V13.2.33Убедитесь, что если для аутентификации в сервисе используются учётные данные, то используемые потребителем учётные данные не являются стандартными (например, root/root или admin/admin).2V13.2.44Убедитесь, что используется белый список (allowlist) для определения внешних ресурсов или систем, с которыми приложению разрешено взаимодействовать (например, для исходящих запросов, загрузки данных или доступа к файлам). Этот белый список может быть реализован на уровне приложения, веб-сервера, межсетевого экрана или комбинации различных уровней.2V13.2.55Убедитесь, что веб- или прикладной сервер настроен с белым списком ресурсов или систем, к которым сервер может отправлять запросы или из которых может загружать данные и файлы.2V13.2.66Убедитесь, что при подключении приложения к другим сервисам соблюдается задокументированная конфигурация для каждого соединения, включая максимальное количество параллельных соединений, поведение при достижении их максимума, таймауты и стратегии повторных попыток подключения.3V13.33Управление секретамиV13.3.11Убедитесь, что для безопасного создания, хранения, контроля доступа и уничтожения секретов бэкенда используется решение для управления секретами, например, хранилище ключей (key vault). Секретами могут быть пароли, ключевой материал, интеграции с базами данных и сторонними системами, ключи и seed-значения для токенов с ограниченным временем действия, другие внутренние секреты и API-ключи. Секреты не должны включаться в исходный код приложения или артефакты сборки. Для приложений уровня L3 необходимо использовать аппаратное решение, например, аппаратный модуль безопасности (HSM).2V13.3.22Убедитесь, что доступ к секретным ресурсам осуществляется в соответствии с принципом минимально необходимых привилегий (least privilege).2V13.3.33Убедитесь, что все криптографические операции выполняются с использованием изолированного модуля безопасности (например, хранилища ключей или аппаратного модуля безопасности), чтобы надежно управлять ключевым материалом и защищать его от утечки за пределы модуля безопасности.3V13.3.44Убедитесь, что секреты настроены на срок действия и ротацию в соответствии с документацией приложения.3V13.44Непреднамеренная утечка информацииV13.4.11Убедитесь, что приложение развернуто либо без метаданных систем контроля версий (включая папки .git или .svn), либо так, чтобы эти папки были недоступны как извне, так и для самого приложения.1V13.4.22Убедитесь, что режимы отладки отключены для всех компонентов в промышленной среде, чтобы предотвратить раскрытие функций отладки и утечку информации.2V13.4.33Убедитесь, что веб-серверы не показывают клиентам списки содержимого каталогов, если это явно не предусмотрено.2V13.4.44Убедитесь, что метод HTTP TRACE не поддерживается в продуктовой среде, чтобы избежать потенциальной утечки информации.2V13.4.55Убедитесь, что документация (например, по внутренним API) и мониторинговые эндпоинты не доступны, если это явно не предусмотрено.2V13.4.66Убедитесь, что приложение не раскрывает подробную информацию о версиях компонентов бэкенда.3V13.4.77Убедитесь, что веб-слой настроен на обслуживание только файлов с определёнными расширениями, чтобы предотвратить непреднамеренную утечку информации, конфигураций и исходного кода.3V1414DataЗащита информацииV14.11Документация по защите информацииV14.1.11Убедитесь, что все конфиденциальные данные, создаваемые и обрабатываемые приложением, идентифицированы и классифицированы по уровням защиты. Включая закодированные данные, которые легко декодируются, например, строки Base64 или незашифрованные данные в полезной нагрузке JWT. Уровни защиты должны учитывать требования по защите данных и конфиденциальности, которым должно соответствовать приложение.2V14.1.22Убедитесь, что для каждого уровня защиты конфиденциальных данных требования к защите задокументированы. Они должны включать (но не ограничиваться) требования по шифрованию, проверке целостности, срокам хранения, способам логирования данных, контролю доступа к чувствительным данным в логах, шифрованию на уровне базы данных, применению технологий повышения конфиденциальности, а также другим требованиям по конфиденциальности.2V14.22Базовые меры по защите информацииV14.2.11Убедитесь, что конфиденциальные данные передаются на сервер только в теле HTTP-запроса или в заголовках. URL и строка запроса не должны содержать конфиденциальную информацию, такую как API-ключ или сессионный токен.1V14.2.22Убедитесь, что приложение предотвращает кэширование конфиденциальных данных в серверных компонентах, таких как балансировщики нагрузки и кэши приложений, либо гарантирует их надежное удаление после использования.2V14.2.33Убедитесь, что заранее определённые конфиденциальные данные не отправляются ненадёжным сторонам (например, системам трекинга пользователей), чтобы предотвратить нежелательный сбор данных вне контроля приложения.2V14.2.44Убедитесь, что для конфиденциальных данных реализованы меры по шифрованию, проверке целостности, срокам хранения, способам логирования, контролю доступа к данным в логах, а также применяются технологии повышения конфиденциальности в соответствии с документацией для соответствующего уровня защиты данных.2V14.2.55Убедитесь, что механизмы кэширования настроены так, чтобы кэшировать только ответы с ожидаемым типом содержимого для данного ресурса и не содержать конфиденциального динамического контента. При обращении к несуществующему файлу, веб-сервер должен возвращать ответ 404 или 302, а не подменять на другой существующий файл, что позволит предотвратить атаки типа Web Cache Deception.3V14.2.66Убедитесь, что приложение возвращает только минимально необходимый объем конфиденциальных данных для выполнения своей функциональности. Например, показывает только часть цифр номера кредитной карты, а не полный номер. Если требуется отображение полных данных, они должны быть замаскированы в пользовательском интерфейсе, пока пользователь специально не запросил их просмотр.3V14.2.77Убедитесь, что конфиденциальная информация подлежит классификации по срокам хранения, чтобы устаревшие или ненужные данные удалялись автоматически, по расписанию или по мере необходимости.3V14.2.88Убедитесь, что конфиденциальная информация удаляется из метаданных файлов, загружаемых пользователями, если пользователь явно не согласился на ее хранение.3V14.33Защита данных на стороне клиентаV14.3.11Убедитесь, что аутентифицированные данные очищаются из клиентского хранилища, например, из DOM браузера, после завершения работы клиента или сессии. Заголовок HTTP-ответа Clear-Site-Data может помочь в этом, но клиентская сторона также должна уметь очищать данные, если соединение с сервером недоступно при завершении сессии.1V14.3.22Убедитесь, что приложение устанавливает HTTP-заголовки, достаточные для предотвращения кэширования (например, Cache-Control: no-store), чтобы конфиденциальные данные не сохранялись в браузерах.2V14.3.33Убедитесь, что данные, хранящиеся в браузерном хранилище (например, localStorage, sessionStorage, IndexedDB или cookie), не содержат конфиденциальной информации, за исключением сессионных токенов.2V1515SecureБезопасная разработка и архитектураV15.11Документация по безопасной разработке и архитектуреV15.1.11Убедитесь, что в документации по приложению определены сроки устранения уязвимостей на основе оценки рисков для внешних зависимостей с уязвимостями и для обновления библиотек в целом, чтобы минимизировать риск, связанный с этими компонентами.1V15.1.22Убедитесь, что ведется реестр всех используемых сторонних библиотек (например, Software Bill of Materials, SBOM), с обязательной проверкой, что компоненты получены из предопределенных, доверенных и регулярно поддерживаемых репозиториев.2V15.1.33Убедитесь, что в документации приложения указан функционал, требующий значительных временных или вычислительных ресурсов. Необходимо указать, как предотвратить потерю доступности из-за чрезмерного использования этого функционала и как избежать ситуаций, когда формирование ответа занимает больше времени, чем установленный системой таймаут. Возможные меры защиты могут включать асинхронную обработку, использование очередей и ограничение количества параллельных процессов для каждого пользователя и приложения.2V15.1.44Убедитесь, что в документации приложения указаны внешние библиотеки, которые считаются «компонентами с повышенным риском».3V15.1.55Убедитесь, что в документации приложения выделены те части приложения, в которых используются «функционал с повышенным риском».3V15.22Архитектура безопасности и зависимостиV15.2.11Убедитесь, что приложение содержит только те компоненты, которые не нарушили задокументированные сроки обновления и исправления.1V15.2.22Убедитесь, что в приложении реализованы меры защиты от потери доступности из-за функциональности, требующей много времени или ресурсов, на основе задокументированных решений и стратегий безопасности для этого.2V15.2.33Убедитесь, что производственная среда включает только те функции, которые необходимы для работы приложения, и не предоставляет лишние функции, такие как тестовый код, примеры кода и инструменты разработки.2V15.2.44Убедитесь, что сторонние компоненты и все их транзитивные зависимости загружаются только из ожидаемых репозиториев (внутренних или внешних) и отсутствует риск атаки через подмену зависимостей (dependency confusion attack)3V15.2.55Убедитесь, что приложение реализует дополнительные меры защиты для тех частей приложения, которые документированы как содержащие «функционал с повышенным риском» или использующие сторонние библиотеки, считающиеся «функционалом с повышенным риском». Это могут быть такие методы, как «песочница», инкапсуляция, контейнеризация или изоляция на сетевом уровне, чтобы задержать и предотвратить продвижение (pivoting) злоумышленников, скомпрометировавших одну часть приложения, к другим частям приложения.3V15.33Безопасное программированиеV15.3.11Убедитесь, что приложение возвращает только необходимое подмножество полей из объекта данных. Например, оно не должно возвращать весь объект данных, поскольку некоторые отдельные поля должны быть недоступны пользователям.1V15.3.22Убедитесь, что при вызовах внешних URL-адресов бэкэнд приложения настроен так, чтобы не выполнять перенаправления, если только это не предусмотрено функционалом.2V15.3.33Убедитесь, что в приложении реализованы защитные механизмы против атак типа массового присвоения (mass assignment) путем строгого ограничения разрешенных полей для каждого контроллера и действия, исключая возможность добавления или изменения значений полей, которые не должны быть доступны для данной конкретной операции.2V15.3.44Убедитесь, что все прокси и промежуточное ПО корректно передают исходный IP-адрес пользователя, используя доверенные поля данных, которые не могут быть изменены конечным пользователем, а приложение и веб-сервер используют это правильное значение для ведения логирования и принятия решений по безопасности, таких как ограничение запросов. При этом следует учитывать, что даже исходный IP-адрес может быть ненадежным из-за динамических IP-адресов, VPN или корпоративных файрволов.2V15.3.55Убедитесь, что приложение явно проверяет соответствие переменных ожидаемому типу данных и использует строгие операции сравнения. Это необходимо для предотвращения уязвимостей, связанных с type juggling и type confusion, вызванных тем, что код приложения делает предположения о типе переменной.2V15.3.66Убедитесь, что JavaScript-код написан таким образом, чтобы предотвратить prototype pollution, например, используя Set() или Map() вместо обычных литералов объекта.2V15.3.77Убедитесь, что приложение защищено от атак типа HTTP Parameter Pollution (HPP), особенно если используемый фреймворк не различает источники параметров запроса (строка запроса, тело запроса, куки или заголовки).2V15.44Безопасная работа с параллельными процессамиV15.4.11Убедитесь, что к общим объектам в многопоточном коде (например, кэшам, файлам или объектам в памяти, используемым несколькими потоками) используется безопасный многопоточный доступ и механизмов синхронизации, таких как блокировки или семафоры, чтобы избежать состояний гонки и повреждения данных.3V15.4.22Убедитесь, что проверки состояния ресурса, например его существования или разрешений, а также зависящие от него действия выполняются как одна атомарная операция, чтобы предотвратить условия гонки времени проверки и времени использования (TOCTOU). Например, проверка существования файла перед его открытием или проверка прав доступа пользователя перед его предоставлением.3V15.4.33Убедитесь, что блокировки применяются согласованно, чтобы предотвратить взаимные блокировки потоков (deadlocks) или их бесконечные повторы, а также что логика блокировки инкапсулирована в коде, отвечающем за управление ресурсом. Это гарантирует, что блокировки не могут быть случайно или намеренно изменены внешними классами или кодом.3V15.4.44Убедитесь, что политики распределения ресурсов предотвращают нехватку ресурсов у потоков, обеспечивая справедливый доступ к ресурсам, например, используя пулы потоков, позволяя потокам с более низким приоритетом выполняться в течение разумного периода времени.3V1616SecurityЖурналирование событий безопасности и обработка ошибокV16.11Документация по ведению логовV16.1.11Убедитесь в существовании реестра, в котором документируется ведение журнала на каждом уровне технологического стека приложения, включая какие события регистрируются, форматы логов, где хранятся эти журналы, как они используются, как контролируется доступ к ним и как долго хранятся журналы.2V16.22Общее журналированиеV16.2.11Убедитесь, что каждая запись журнала содержит необходимые метаданные (например, когда, где, кто, что), которые позволят провести подробное исследование временной шкалы, когда произошло событие.2V16.2.22Убедитесь, что все источники времени компонентов системы журналирования синхронизированы, а временные метки в метаданных событий безопасности используют UTC или содержат явное указание смещения часового пояса. Рекомендуется применять UTC для обеспечения согласованности в распределённых системах и предотвращения ошибок при переходе на летнее/зимнее время.2V16.2.33Убедитесь, что приложение записывает и передаёт логи исключительно в те файлы и сервисы, которые указаны в реестре журналирования.2V16.2.44Убедитесь, что логи могут быть прочитаны и коррелированы используемой системой обработки журналов, предпочтительно с использованием общего стандартного формата логирования.2V16.2.55Убедитесь, что приложение применяет соответствующие меры защиты при логировании конфиденциальных данных в зависимости от уровня их чувствительности: например, полностью запрещает запись в логи таких данных, как учетные данные или платежные реквизиты, а для других данных (например, сессионных токенов) использует хеширование или частичное/полное маскирование.2V16.33Инциденты безопасностиV16.3.11Убедитесь, что все операции аутентификации регистрируются, включая успешные и неудачные попытки. Также следует фиксировать дополнительные метаданные, такие как тип аутентификации или использованные факторы проверки.2V16.3.22Убедитесь, что ведется журнал неудачных попыток авторизации. Для уровня L3 это должно включать в себя журналирование всех решений об авторизации, включая журналирование доступа к конфиденциальным данным (без регистрации самих конфиденциальных данных).2V16.3.33Убедитесь, что приложение регистрирует все события безопасности, определенные в документации, а также фиксирует попытки обхода механизмов защиты, включая проверку входных данных, бизнес-логики и системы защиты от автоматизированных атак.2V16.3.44Убедитесь, что приложение регистрирует в журналах неожиданные ошибки и сбои механизмов безопасности, включая, например, ошибки TLS-соединения на стороне сервера.2V16.44Защита журналовV16.4.11Убедитесь, что все компоненты системы логирования корректно кодируют данные, чтобы предотвратить атаки типа внедрения в журналы (log injection).2V16.4.22Убедитесь, что логи защищены от неавторизованного доступа и не могут быть модифицированы.2V16.4.33Убедитесь, что логи безопасно передаются в логически изолированную систему для анализа, обнаружения угроз, генерации оповещений и эскалации инцидентов. Это гарантирует сохранность журналов даже в случае компрометации основного приложения.2V16.55Обработка ошибокV16.5.11Убедитесь, что при возникновении непредвиденной или связанной с безопасностью ошибки пользователю возвращается только общее сообщение, гарантируя отсутствие раскрытия конфиденциальных внутренних данных системы, таких как трассировки стека, запросы, секретные ключи и токены.2V16.5.22Убедитесь, что приложение продолжает работать в безопасном режиме при недоступности внешних ресурсов, используя такие механизмы, как автоматические выключатели (circuit breakers) или плавное снижение функциональности (graceful degradation).2V16.5.33Убедитесь, что приложение корректно и безопасно завершает работу при возникновении исключений, предотвращая опасные сценарии по типу «fail-open», когда, например, транзакция ошибочно выполняется, несмотря на ошибки в логике валидации.2V16.5.44Убедитесь, что определён обработчик ошибок «крайние меры», который будет перехватывать все необработанные ошибки. Это необходимо как для предотвращения потери информации об ошибках, которая должна быть записана в файлы журналов, так и для того, чтобы ошибка не остановила весь процесс приложения, что привело бы к потере доступности.3V1717WebRTCWebRTCV17.11TURN-серверV17.1.11Убедитесь, что сервис TURN (Traversal Using Relays around NAT) разрешает доступ только к IP-адресам, не зарезервированным для специальных целей (например, внутренние сети, широковещательная рассылка, loopback-адреса). Данное требование применяется как к IPv4, так и к IPv6 адресам.2V17.1.22Убедитесь, что сервис TURN (Traversal Using Relays around NAT) защищен от исчерпания ресурсов при попытках легитимных пользователей открыть чрезмерное количество портов на сервере.3V17.22Требования к медиасерверамV17.2.11Убедитесь, что ключ сертификата Datagram Transport Layer Security (DTLS) управляется и защищается в соответствии с документированной политикой управления криптографическими ключами.2V17.2.22Убедитесь, что медиасервер настроен на использование только одобренных наборов шифров Datagram Transport Layer Security (DTLS) и защищенного профиля безопасности для расширения DTLS, применяемого при установке ключей для Secure Real-time Transport Protocol (DTLS-SRTP).2V17.2.33Убедитесь, что медиасервер проверяет аутентификацию Secure Real-time Transport Protocol (SRTP) для предотвращения атак с внедрением Real-time Transport Protocol (RTP), которые могут привести к отказу в обслуживании (Denial of Service) или вставке поддельного аудио-/видеоконтента в медиапотоки.2V17.2.44Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика при получении некорректных пакетов Secure Real-time Transport Protocol (SRTP).2V17.2.55Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетами Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.3V17.2.66Убедитесь, что медиасервер не подвержен уязвимости «Гонка ClientHello» (ClientHello Race Condition) в Datagram Transport Layer Security (DTLS), проверив наличие известных уязвимостей в публичных источниках или выполнив тестирование на воспроизведение условий гонки.3V17.2.77Убедитесь, что механизмы аудио- и видеозаписи, связанные с медиасервером, способны продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетов Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.3V17.2.88Убедитесь, что сертификат Datagram Transport Layer Security (DTLS) проверяется на соответствие атрибуту отпечатка (fingerprint) в Session Description Protocol (SDP), с немедленным прекращением медиапотока в случае несоответствия — это гарантирует подлинность передаваемых данных.3V17.33СигнализацияV17.3.11Убедитесь, что сигнальный сервер способен продолжать обработку легитимных входящих сообщений сигнализации даже в условиях флуд-атаки. Для этого необходимо реализовать механизм ограничения частоты запросов (rate limiting) на уровне сигнализации.2V17.3.22Убедитесь, что сигнальный сервер способен продолжать обработку легитимных сообщений сигнализации даже при получении некорректных сообщений, которые могут вызвать отказ в обслуживании (Denial of Service, DoS). Для этого необходимо реализовать: проверку входных данных (input validation), безопасную обработку целочисленных переполнений (integer overflows), защиту от переполнения буферов (buffer overflows) и другие надежные методы обработки ошибок.2 diff --git a/5.0/docs_ru/ru b/5.0/docs_ru/ru deleted file mode 100644 index e69de29bb2..0000000000 diff --git a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.cdx.json b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.cdx.json deleted file mode 100644 index 0a861097af..0000000000 --- a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.cdx.json +++ /dev/null @@ -1,3029 +0,0 @@ -{ - "bomFormat": "CycloneDX", - "specVersion": "1.6", - "serialNumber": "urn:uuid:43ba8da1-08c5-467c-8d5f-003dcc94f473", - "version": 1, - "metadata": { - "timestamp": "2025-10-12T15:34:49+00:00", - "licenses": [ - { - "license": { - "id": "CC-BY-SA-4.0", - "url": "https://creativecommons.org/licenses/by-sa/4.0/legalcode.txt" - } - } - ], - "supplier": { - "name": "OWASP Foundation", - "url": [ - "https://owasp.org" - ] - } - }, - "declarations": { - "standards": [ - { - "bom-ref": "ASVS-", - "name": "Application Security Verification Standard (ASVS)", - "version": "", - "description": "The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.", - "owner": "Application Security Verification Standard Project", - "requirements": [ - { - "bom-ref": "V1", - "identifier": "V1", - "title": "Kodlama (Encoding) ve Temizleme" - }, - { - "bom-ref": "V1.1", - "identifier": "V1.1", - "title": "Kodlama ve Temizleme Mimarisi", - "parent": "V1" - }, - { - "bom-ref": "V1.1.1", - "identifier": "V1.1.1", - "text": "Girdinin yalnızca bir kez kanonik forma (canonical form) çözümlendiği veya kaçış işlemlerinin kaldırıldığı, bu işlemin yalnızca verinin bu biçimde beklenmesi durumunda yapıldığı ve bu işlemin girdi doğrulama veya temizleme işlemlerinden sonra değil, önce gerçekleştiği doğrulanmalıdır.", - "parent": "V1.1" - }, - { - "bom-ref": "V1.1.2", - "identifier": "V1.1.2", - "text": "Uygulamanın, çıktıyı kullanılması gereken yorumlayıcıya verilmeden hemen önce veya yorumlayıcının kendisi tarafından çıktı kodlaması ya da kaçış işlemi yaptığı doğrulanmalıdır.", - "parent": "V1.1" - }, - { - "bom-ref": "V1.2", - "identifier": "V1.2", - "title": "Enjeksiyon Önleme", - "parent": "V1" - }, - { - "bom-ref": "V1.2.1", - "identifier": "V1.2.1", - "text": "HTTP yanıtı, HTML veya XML belgesi için yapılan çıktı kodlamasının; HTML elemanları, HTML öznitelikleri, HTML yorumları, CSS ya da HTTP başlık alanları gibi bağlamlara uygun olduğu doğrulanmalıdır. Böylece mesaj veya belge yapısının bozulması önlenir.", - "parent": "V1.2" - }, - { - "bom-ref": "V1.2.2", - "identifier": "V1.2.2", - "text": "Dinamik olarak URL oluşturulurken, güvenilmeyen verinin bağlamına göre (örneğin, sorgu veya yol parametreleri için URL kodlaması ya da base64url kodlaması) kodlandığı doğrulanmalıdır. Yalnızca güvenli URL protokollerine izin verilmelidir (örneğin, javascript: veya data: yasaklanmalıdır).", - "parent": "V1.2" - }, - { - "bom-ref": "V1.2.3", - "identifier": "V1.2.3", - "text": "JavaScript içeriği (JSON dahil) dinamik olarak oluşturulurken çıktı kodlama/kaçış kullanıldığı doğrulanmalıdır. Böylece mesaj veya belge yapısı değiştirilmemiş olur (JavaScript ve JSON enjeksiyonlarının önüne geçilir).", - "parent": "V1.2" - }, - { - "bom-ref": "V1.2.4", - "identifier": "V1.2.4", - "text": "Veri sorguları veya veritabanı sorguları (SQL, HQL, NoSQL, Cypher vb.) için parametreli sorgular, ORM’ler, entity framework’ler kullanıldığı ya da SQL enjeksiyonu ve diğer veritabanı enjeksiyon saldırılarına karşı koruma sağlandığı doğrulanmalıdır. Bu durum, saklı yordam (stored procedure) yazarken de geçerlidir.", - "parent": "V1.2" - }, - { - "bom-ref": "V1.2.5", - "identifier": "V1.2.5", - "text": "Uygulamanın işletim sistemi komut enjeksiyonlarına karşı korunduğu ve işletim sistemi çağrılarında parametreli OS sorguları veya bağlama özgü komut satırı çıktı kodlamasının kullanıldığı doğrulanmalıdır.", - "parent": "V1.2" - }, - { - "bom-ref": "V1.2.6", - "identifier": "V1.2.6", - "text": "Uygulamanın LDAP enjeksiyon zafiyetlerine karşı korunduğu ya da LDAP enjeksiyonlarını önlemek için özel güvenlik kontrollerinin uygulandığı doğrulanmalıdır.", - "parent": "V1.2" - }, - { - "bom-ref": "V1.2.7", - "identifier": "V1.2.7", - "text": "XPath enjeksiyon saldırılarına karşı, sorgu parametrelemesi veya önceden derlenmiş sorgular kullanılarak koruma sağlandığı doğrulanmalıdır.", - "parent": "V1.2" - }, - { - "bom-ref": "V1.2.8", - "identifier": "V1.2.8", - "text": "LaTeX işlemcilerinin güvenli şekilde yapılandırıldığı (örneğin, --shell-escape bayrağının kullanılmadığı) ve yalnızca izin verilen komutlardan oluşan bir listeyle çalıştırıldığı doğrulanmalıdır.", - "parent": "V1.2" - }, - { - "bom-ref": "V1.2.9", - "identifier": "V1.2.9", - "text": "Düzenli ifadelerde (regex) özel karakterlerin (genellikle ters eğik çizgi \\ ile) kaçırılarak meta karakter olarak yorumlanmalarının önlendiği doğrulanmalıdır.", - "parent": "V1.2" - }, - { - "bom-ref": "V1.2.10", - "identifier": "V1.2.10", - "text": "Uygulamanın CSV ve formül enjeksiyonlarına karşı korunduğu doğrulanmalıdır. Uygulama, CSV içeriği dışa aktarırken RFC 4180 Bölüm 2.6 ve 2.7'de tanımlanan kaçış kurallarına uymalıdır. Ayrıca, CSV veya diğer tablo formatlarına (XLS, XLSX, ODF gibi) aktarım yapılırken, alanın ilk karakteri olarak çıkan özel karakterler ('=', '+', '-', '@', '\\t' (sekme), '\\0' (null karakter)) tek tırnak (') ile kaçırılmalıdır.", - "parent": "V1.2" - }, - { - "bom-ref": "V1.3", - "identifier": "V1.3", - "title": "Temizleme (Sanitization)", - "parent": "V1" - }, - { - "bom-ref": "V1.3.1", - "identifier": "V1.3.1", - "text": "WYSIWYG editörlerinden veya benzer kaynaklardan gelen tüm güvenilmeyen HTML girdilerinin, bilinen ve güvenli bir HTML temizleme kütüphanesi ya da çerçeve özelliği ile temizlendiği doğrulanmalıdır.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.2", - "identifier": "V1.3.2", - "text": "Uygulamanın eval() veya Spring Expression Language (SpEL) gibi dinamik kod çalıştırma özelliklerini kullanmaktan kaçındığı doğrulanmalıdır. Alternatif yoksa, kullanıcı girdisi çalıştırılmadan önce mutlaka temizlenmelidir.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.3", - "identifier": "V1.3.3", - "text": "Potansiyel olarak tehlikeli bir bağlamda kullanılacak verilerin, bu bağlama uygun karakterlere izin vermek ve çok uzun girdileri kısaltmak gibi güvenlik önlemleriyle önceden temizlendiği doğrulanmalıdır.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.4", - "identifier": "V1.3.4", - "text": "Kullanıcı tarafından sağlanan SVG içeriğinin, yalnızca güvenli etiket ve özellikler (örneğin grafik çizme ile ilgili) içerdiğinden emin olmak için onaylandığı veya temizlendiği doğrulanmalıdır (ör. script veya foreignObject içermemelidir).", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.5", - "identifier": "V1.3.5", - "text": "Markdown, CSS, XSL stil sayfaları, BBCode veya benzeri ifade şablon dillerinde kullanıcı girdisinin temizlendiği veya bu tür özelliklerin devre dışı bırakıldığı doğrulanmalıdır.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.6", - "identifier": "V1.3.6", - "text": "Uygulamanın, güvenilmeyen verileri başka servislere iletmeden önce izinli protokol, alan adı, yol ve port listelerine göre doğruladığı ve tehlikeli karakterleri temizlediği doğrulanarak SSRF (Sunucu Taraflı İstek Sahteciliği) saldırılarına karşı korunduğu doğrulanmalıdır.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.7", - "identifier": "V1.3.7", - "text": "Uygulamanın şablon enjeksiyon saldırılarına karşı, güvenilmeyen girdilere dayalı şablon oluşturmayı engellediği; eğer bu kaçınılmazsa, bu girdilerin mutlaka temizlendiği veya sıkı şekilde onaylandığı doğrulanmalıdır.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.8", - "identifier": "V1.3.8", - "text": "JNDI sorgularında kullanılmadan önce güvenilmeyen girdilerin temizlendiği ve JNDI'nin enjeksiyonlara karşı güvenli şekilde yapılandırıldığı doğrulanmalıdır.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.9", - "identifier": "V1.3.9", - "text": "Memcache’e gönderilmeden önce içeriğin temizlenerek enjeksiyon saldırılarına karşı korunduğu doğrulanmalıdır.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.10", - "identifier": "V1.3.10", - "text": "Format dizgilerinin (format strings) beklenmeyen veya zararlı şekilde çözümlenmesini önlemek için işlenmeden önce temizlendiği doğrulanmalıdır.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.11", - "identifier": "V1.3.11", - "text": "SMTP veya IMAP enjeksiyonlarını önlemek için, kullanıcı girdisinin posta sistemlerine iletilmeden önce temizlendiği doğrulanmalıdır.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.3.12", - "identifier": "V1.3.12", - "text": "Regex girdilerinin üstel geri izlemeye (exponential backtracking) neden olan öğeler içermediği ve güvenilmeyen girdilerin ReDoS (Regex Denial of Service) gibi saldırılara karşı temizlendiği doğrulanmalıdır.", - "parent": "V1.3" - }, - { - "bom-ref": "V1.4", - "identifier": "V1.4", - "title": "Bellek, Dizgi ve Yönetilmeyen Kod", - "parent": "V1" - }, - { - "bom-ref": "V1.4.1", - "identifier": "V1.4.1", - "text": "Yığın, arabellek (buffer) veya yığın belleği taşmalarını önlemek ya da tespit etmek amacıyla, bellek güvenli dizgi işlemlerinin, daha güvenli bellek kopyalama ve işaretçi aritmetiğinin kullanıldığı doğrulanmalıdır.", - "parent": "V1.4" - }, - { - "bom-ref": "V1.4.2", - "identifier": "V1.4.2", - "text": "Tamsayı taşmalarını önlemek için işaret (sign), aralık (range) ve giriş doğrulama tekniklerinin kullanıldığı doğrulanmalıdır.", - "parent": "V1.4" - }, - { - "bom-ref": "V1.4.3", - "identifier": "V1.4.3", - "text": "Dinamik olarak ayrılan belleğin ve kaynakların serbest bırakıldığı ve boşaltılan belleklere ait referansların veya işaretçilerin kaldırıldığı veya null yapıldığı doğrulanmalıdır (dangling pointer ve use-after-free zafiyetlerine karşı).", - "parent": "V1.4" - }, - { - "bom-ref": "V1.5", - "identifier": "V1.5", - "title": "Güvenli Ters Serileştirme (Safe Deserialization)", - "parent": "V1" - }, - { - "bom-ref": "V1.5.1", - "identifier": "V1.5.1", - "text": "XML ayrıştırıcılarının (parser) kısıtlayıcı şekilde yapılandırıldığı ve dış varlık çözümleme (external entity resolution) gibi güvensiz özelliklerin XXE (XML eXternal Entity) saldırılarına karşı devre dışı bırakıldığı doğrulanmalıdır .", - "parent": "V1.5" - }, - { - "bom-ref": "V1.5.2", - "identifier": "V1.5.2", - "text": "Güvenilmeyen verilerin ters serileştirilmesinde, nesne türleri için izinli liste kullanımı veya istemci tanımlı nesne türlerinin kısıtlanması gibi güvenli giriş işleme önlemlerinin uygulandığı doğrulanmalıdır. Güvensiz olarak tanımlanmış ters serileştirme mekanizmaları, güvenilmeyen girdilerle kullanılmamalıdır.", - "parent": "V1.5" - }, - { - "bom-ref": "V1.5.3", - "identifier": "V1.5.3", - "text": "Aynı veri türü için uygulamada kullanılan farklı parser'ların (ör. JSON, XML, URL parser'ları), veriyi tutarlı şekilde ayrıştırdığı ve aynı karakter kodlamasını kullandığı doğrulanmalıdır. Böylece JSON birlikte çalışabilirlik açıkları, URI veya dosya ayrıştırma farkları gibi sorunlar nedeniyle RFI veya SSRF saldırılarının istismar edilmesi önlenir.", - "parent": "V1.5" - }, - { - "bom-ref": "V2", - "identifier": "V2", - "title": "Doğrulama ve İş Mantığı" - }, - { - "bom-ref": "V2.1", - "identifier": "V2.1", - "title": "Doğrulama ve İş Mantığı Dokümantasyonu", - "parent": "V2" - }, - { - "bom-ref": "V2.1.1", - "identifier": "V2.1.1", - "text": "Uygulama dokümantasyonunda, veri öğelerinin beklenen yapıya göre nasıl doğrulanacağına ilişkin giriş doğrulama kurallarının tanımlandığı doğrulanmalıdır. Bu; kredi kartı numaraları, e-posta adresleri, telefon numaraları gibi yaygın veri biçimleri olabileceği gibi iç sistemlere özel biçimler de olabilir.", - "parent": "V2.1" - }, - { - "bom-ref": "V2.1.2", - "identifier": "V2.1.2", - "text": "Uygulama dokümantasyonunda, birleştirilmiş veri öğelerinin mantıksal ve bağlamsal tutarlılığının nasıl doğrulanacağı tanımlanmalıdır (örneğin, mahalle ve posta kodunun eşleşip eşleşmediğinin kontrolü).", - "parent": "V2.1" - }, - { - "bom-ref": "V2.1.3", - "identifier": "V2.1.3", - "text": "Hem kullanıcı bazında hem de uygulama genelinde geçerli olacak şekilde, iş mantığı sınırları ve doğrulama beklentilerinin belgelendiği doğrulanmalıdır.", - "parent": "V2.1" - }, - { - "bom-ref": "V2.2", - "identifier": "V2.2", - "title": "Girdi Doğrulama", - "parent": "V2" - }, - { - "bom-ref": "V2.2.1", - "identifier": "V2.2.1", - "text": "Girdilerin, işlevsel ya da iş gereksinimlerine uygunluğunun doğrulandığı teyit edilmelidir. Bu işlem; izinli değerler, desenler ve aralıklar listesine karşı pozitif doğrulama ile ya da girdinin beklenen yapıya ve mantıksal sınırlara uygunluğunun önceden tanımlanmış kurallara göre karşılaştırılması ile yapılmalıdır. Seviye 1 için bu, güvenlik veya iş kararlarında kullanılan girdilere odaklanabilir. Seviye 2 ve üstü için tüm girdilere uygulanmalıdır.", - "parent": "V2.2" - }, - { - "bom-ref": "V2.2.2", - "identifier": "V2.2.2", - "text": "Uygulamanın, güvenilir bir servis katmanında girdi doğrulama zorunluluğu uygulayacak şekilde tasarlandığı doğrulanmalıdır. İstemci tarafında gerçekleştirilen doğrulama, kullanılabilirliği artırabilir ve teşvik edilmelidir. Ancak bu doğrulama,güvenlik kontrolü olarak kabul edilmemelidir.", - "parent": "V2.2" - }, - { - "bom-ref": "V2.2.3", - "identifier": "V2.2.3", - "text": "Uygulamanın, ilişkili veri öğelerinin önceden tanımlanmış kurallara göre makul olup olmadığını kontrol ettiği doğrulanmalıdır.", - "parent": "V2.2" - }, - { - "bom-ref": "V2.3", - "identifier": "V2.3", - "title": "İş Mantığı Güvenliği", - "parent": "V2" - }, - { - "bom-ref": "V2.3.1", - "identifier": "V2.3.1", - "text": "Uygulamanın, aynı kullanıcı için iş mantığı akışlarını yalnızca beklenen adım sırasına göre ve adım atlamadan işlediği doğrulanmalıdır.", - "parent": "V2.3" - }, - { - "bom-ref": "V2.3.2", - "identifier": "V2.3.2", - "text": "İş mantığı sınırlarının, uygulama dokümantasyonuna uygun şekilde uygulandığı doğrulanmalıdır.", - "parent": "V2.3" - }, - { - "bom-ref": "V2.3.3", - "identifier": "V2.3.3", - "text": "İş mantığı seviyesinde işlemlerin (transaction) kullanıldığı ve bir iş mantığı işleminin ya bütünüyle başarıyla tamamlandığı ya da önceki geçerli duruma geri döndürüldüğü (rollback) doğrulanmalıdır.", - "parent": "V2.3" - }, - { - "bom-ref": "V2.3.4", - "identifier": "V2.3.4", - "text": "İş mantığı düzeyinde kilitleme mekanizmalarının, sınırlı kaynakların (ör. sinema koltukları, teslimat zamanları) uygulamanın mantığı manipüle edilerek çift rezervasyona neden olmamasını sağladığı doğrulanmalıdır.", - "parent": "V2.3" - }, - { - "bom-ref": "V2.3.5", - "identifier": "V2.3.5", - "text": "Yüksek değerli iş mantığı akışlarının, yetkisiz veya kazara gerçekleşebilecek işlemleri önlemek için çoklu kullanıcı onayı gerektirdiği doğrulanmalıdır. Bu işlemler büyük para transferleri, sözleşme onayları, gizli bilgilere erişim veya üretimde güvenlik kurallarının geçersiz kılınmaları gibi durumları içerebilir.", - "parent": "V2.3" - }, - { - "bom-ref": "V2.4", - "identifier": "V2.4", - "title": "Otomasyon Karşıtı Önlemler", - "parent": "V2" - }, - { - "bom-ref": "V2.4.1", - "identifier": "V2.4.1", - "text": "Uygulama işlevlerine yönelik aşırı miktardaki çağrılara karşı; veri sızdırma, anlamsız veri üretme, kota tüketme, hız sınırının aşılması, hizmet reddi (DoS) ya da maliyetli kaynakların aşırı kullanımı gibi risklere karşı otomasyon karşıtı kontrollerin bulunduğu doğrulanmalıdır.", - "parent": "V2.4" - }, - { - "bom-ref": "V2.4.2", - "identifier": "V2.4.2", - "text": "İş mantığı akışlarının, aşırı hızlı işlem gönderimlerini önleyecek şekilde gerçekçi insan zamanlaması gerektirdiği doğrulanmalıdır.", - "parent": "V2.4" - }, - { - "bom-ref": "V3", - "identifier": "V3", - "title": "Web Ön Uç (Frontend) Güvenliği" - }, - { - "bom-ref": "V3.1", - "identifier": "V3.1", - "title": "Web Frontend Güvenlik Dokümantasyonu", - "parent": "V3" - }, - { - "bom-ref": "V3.1.1", - "identifier": "V3.1.1", - "text": "Uygulama dokümantasyonunda, uygulamayı kullanan tarayıcıların desteklemesi gereken güvenlik özelliklerinin (ör. HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) ve diğer ilgili HTTP güvenlik mekanizmaları) tanımlandığı doğrulanmalıdır. Ayrıca bu özelliklerin mevcut olmadığı durumlarda uygulamanın nasıl davranması gerektiği (ör. kullanıcıyı uyarmak veya erişimi engellemek) de tanımlanmalıdır.", - "parent": "V3.1" - }, - { - "bom-ref": "V3.2", - "identifier": "V3.2", - "title": "İçeriğin Yanlış Yorumlanması", - "parent": "V3" - }, - { - "bom-ref": "V3.2.1", - "identifier": "V3.2.1", - "text": "Tarayıcıların HTTP yanıtlarında içerik veya işlevi yanlış bir bağlamda sunmalarını önlemek amacıyla güvenlik kontrollerinin uygulandığı doğrulanmalıdır (ör. API, kullanıcı tarafından yüklenen dosya veya başka bir kaynağın doğrudan çağrılması durumunda). Olası kontroller arasında; yalnızca HTTP istek başlıklarının (ör. Sec-Fetch-\\*) doğru bağlamı gösterdiği durumlarda içeriğin sunulması, Content-Security-Policy başlığında \"sandbox\" yönergesinin kullanılması veya Content-Disposition başlığında \"attachment\" biçiminin kullanılması yer alabilir.", - "parent": "V3.2" - }, - { - "bom-ref": "V3.2.2", - "identifier": "V3.2.2", - "text": "HTML yerine metin olarak görüntülenmesi amaçlanan içeriğin, HTML veya JavaScript gibi içeriklerin istenmeden çalıştırılmasını önleyecek şekilde \"createTextNode\" veya \"textContent\" gibi güvenli işleme fonksiyonlarıyla işlendiği doğrulanmalıdır.", - "parent": "V3.2" - }, - { - "bom-ref": "V3.2.3", - "identifier": "V3.2.3", - "text": "Uygulamanın istemci tarafı JavaScript kullanırken açık değişken tanımlamaları yaparak, sıkı tür kontrolü uygulayarak, global değişkenleri document nesnesine kaydetmekten kaçınarak ve ad alanı izolasyonu sağlayarak DOM clobbering’den kaçındığı doğrulanmalıdır.", - "parent": "V3.2" - }, - { - "bom-ref": "V3.3", - "identifier": "V3.3", - "title": "Çerez Yapılandırması", - "parent": "V3" - }, - { - "bom-ref": "V3.3.1", - "identifier": "V3.3.1", - "text": "Çerezlerin 'Secure' niteliğine sahip olduğu ve eğer çerez adı '\\__Host-' ön eki ile başlamıyorsa, '__Secure-' ön ekinin kullanıldığı doğrulanmalıdır.", - "parent": "V3.3" - }, - { - "bom-ref": "V3.3.2", - "identifier": "V3.3.2", - "text": "Kullanıcı arayüzü kandırma saldırılarına ve tarayıcı tabanlı istek sahteciliği saldırılarına (CSRF) karşı koruma sağlamak amacıyla, her çerezin 'SameSite' niteliğinin kullanım amacına uygun şekilde ayarlandığı doğrulanmalıdır.", - "parent": "V3.3" - }, - { - "bom-ref": "V3.3.3", - "identifier": "V3.3.3", - "text": "Çerez adı, diğer sunucularla paylaşılmak üzere açıkça tasarlanmadığı sürece '__Host-' ön eki ile tanımlanmalıdır.", - "parent": "V3.3" - }, - { - "bom-ref": "V3.3.4", - "identifier": "V3.3.4", - "text": "Bir çerez değeri istemci tarafı betikleri tarafından erişilememesi gereken bir veri içeriyorsa (ör. oturum token'ı), çerezin 'HttpOnly' niteliğine sahip olduğu ve aynı değerin (ör. oturum token'ı) yalnızca 'Set-Cookie' başlığı ile istemciye iletildiği doğrulanmalıdır.", - "parent": "V3.3" - }, - { - "bom-ref": "V3.3.5", - "identifier": "V3.3.5", - "text": "Uygulama bir çerez oluştururken, çerez adı ve değerinin toplam uzunluğunun 4096 baytı aşmadığı doğrulanmalıdır. Çok büyük çerezler tarayıcı tarafından saklanmaz ve isteklerle gönderilmez; bu da çereze bağlı çalışan uygulama işlevlerinin bozulmasına yol açabilir.", - "parent": "V3.3" - }, - { - "bom-ref": "V3.4", - "identifier": "V3.4", - "title": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", - "parent": "V3" - }, - { - "bom-ref": "V3.4.2", - "identifier": "V3.4.2", - "text": "Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header'ı, uygulama tarafından sabit bir değer olarak tanımlanmalı veya gelen Origin header değeri güvenilir origin’lerden oluşan bir izinli listeye karşı doğrulanmalıdır. ‘Access-Control-Allow-Origin: *’ kullanılması gerekiyorsa, yanıtın hassas bilgi içermediği doğrulanmalıdır.", - "parent": "V3.4" - }, - { - "bom-ref": "V3.4.3", - "identifier": "V3.4.3", - "text": "HTTP yanıtlarında Content-Security-Policy header'ı bulunduğu ve bu header'ın yalnızca güvenilen içeriklerin veya kaynakların yüklenmesini ve çalıştırılmasını sağlayan yönergeler içerdiği doğrulanmalıdır. Minimum olarak \"global policy\", object-src 'none', base-uri 'none' yönergelerini içermeli ve izinli liste, nonce veya hash temelli bir yapı içermelidir. Seviye 3 uygulamalarında her yanıt için nonce veya hash içeren özel bir politika tanımlanmalıdır.", - "parent": "V3.4" - }, - { - "bom-ref": "V3.4.4", - "identifier": "V3.4.4", - "text": "Tüm HTTP yanıtlarının 'X-Content-Type-Options: nosniff' header'ını içerdiği doğrulanmalıdır. Bu, tarayıcıya içerik türünü tahmin etmeyi bırakmasını ve yanıtın Content-Type header'ında belirtilen MIME türünün, beklenen kaynak türüyle eşleşmesini zorunlu kılar. Ayrıca bu, tarayıcıda CORB (Cross-Origin Read Blocking) özelliğini etkinleştirir.", - "parent": "V3.4" - }, - { - "bom-ref": "V3.4.5", - "identifier": "V3.4.5", - "text": "Uygulamanın, 'Referer' başlığı yoluyla üçüncü taraflara teknik olarak hassas verilerin sızmasını önlemek için bir 'referrer policy' belirlediği doğrulanmalıdır. Bu, Referrer-Policy HTTP header'ıyla veya HTML öğe nitelikleriyle (element attributes) sağlanabilir. Sızabilecek hassas bilgiler, URL’deki yol ve sorgu parametreleri ile sınırlı uygulamalarda hostname bilgisini içerebilir.", - "parent": "V3.4" - }, - { - "bom-ref": "V3.4.6", - "identifier": "V3.4.6", - "text": "Uygulamanın, Content-Security-Policy header'ı altında 'frame-ancestors' yönergesini her HTTP yanıtında tanımladığı ve bu sayede içeriklerin varsayılan olarak başka sayfalara gömülmesini engellediği doğrulanmalıdır. Gerekli durumlarda özel olarak izin verildiğinden emin olunmalıdır. 'X-Frame-Options' header'ı, tarayıcılar tarafından desteklenmesine rağmen, artık güncel değildir ve güvenlik amacıyla kullanılmamalıdır.", - "parent": "V3.4" - }, - { - "bom-ref": "V3.4.8", - "identifier": "V3.4.8", - "text": "Bir belgenin işlenmesini ve sunulmasını başlatan tüm HTTP yanıtlarında (örneğin 'text/html' tipi yanıtlar), 'Cross-Origin-Opener-Policy' header'ı 'same-origin' veya 'same-origin-allow-popups' yönergeleriyle birlikte yer almalıdır. Bu, tabnabbing ve frame counting gibi, pencere nesnelerine paylaşımlı erişimi sömüren saldırılara karşı koruma sağlar.", - "parent": "V3.4" - }, - { - "bom-ref": "V3.5", - "identifier": "V3.5", - "title": "Tarayıcı Menşei Ayırımı", - "parent": "V3" - }, - { - "bom-ref": "V3.5.1", - "identifier": "V3.5.1", - "text": "Uygulama, hassas işlevselliğe yönelik izinsiz cross-origin istekleri önlemek için CORS preflight mekanizmasına güvenmiyorsa, bu tür isteklerin gerçekten uygulamadan geldiği doğrulanmalıdır. Bu, anti-forgery token kullanımı veya CORS tarafından güvenli kabul edilmeyen özel HTTP header'larının zorunlu kılınmasıyla yapılabilir. Bu, tarayıcı tabanlı istek sahteciliği (CSRF) saldırılarına karşı bir savunmadır.", - "parent": "V3.5" - }, - { - "bom-ref": "V3.5.2", - "identifier": "V3.5.2", - "text": "Uygulama, hassas işlevlerin izinsiz cross-origin çağrılmasını önlemek için CORS preflight mekanizmasına güveniyorsa, bu işlevlerin bir CORS-preflight isteğini tetiklemeden çağrılamadığı doğrulanmalıdır. Bu, 'Origin' ve 'Content-Type' header'larının doğrulanmasını veya CORS-safelisted olmayan bir header'ın ve alanın kullanılmasını gerektirebilir.", - "parent": "V3.5" - }, - { - "bom-ref": "V3.5.4", - "identifier": "V3.5.4", - "text": "Farklı uygulamaların farklı hostname'lerde barındırıldığı ve böylece Same-Origin Policy tarafından sağlanan kısıtlamalardan (örneğin çerez erişim sınırları, kaynaklar arası etkileşim kontrolleri) faydalanıldığı doğrulanmalıdır.", - "parent": "V3.5" - }, - { - "bom-ref": "V3.5.6", - "identifier": "V3.5.6", - "text": "Uygulamanın herhangi bir yerinde JSONP işlevselliğinin etkin olmadığı doğrulanmalıdır. Bu, XSSI (Cross-Site Script Inclusion) saldırılarını önlemek içindir.", - "parent": "V3.5" - }, - { - "bom-ref": "V3.5.7", - "identifier": "V3.5.7", - "text": "Yetkilendirme gerektiren verilerin, JavaScript dosyaları gibi betik kaynaklarının yanıtlarında yer almadığı, XSSI saldırılarını önlemek için doğrulanmalıdır.", - "parent": "V3.5" - }, - { - "bom-ref": "V3.5.8", - "identifier": "V3.5.8", - "text": "Kimliği doğrulanmış kaynakların (örneğin görseller, videolar, betikler ve belgeler) yalnızca gerçekten amaçlandığında kullanıcı adına yüklenebildiği veya gömülebildiği doğrulanmalıdır. Bu, isteğin uygun olmayan bir çapraz kaynak çağrısından kaynaklanmadığından emin olmak için Sec-Fetch-* HTTP istek başlığı alanlarının sıkı bir şekilde doğrulanmasıyla veya tarayıcıya döndürülen içeriği engelleme talimatı vermek için kısıtlayıcı bir Cross-Origin-Resource-Policy HTTP yanıt başlığı alanı ayarlayarak gerçekleştirilebilir.", - "parent": "V3.5" - }, - { - "bom-ref": "V3.6", - "identifier": "V3.6", - "title": "Harici Kaynak Bütünlüğü", - "parent": "V3" - }, - { - "bom-ref": "V3.6.1", - "identifier": "V3.6.1", - "text": "JavaScript kütüphaneleri, CSS veya web fontları gibi istemci tarafı varlıkların yalnızca statik ve sürümlü olması, varlığın bütünlüğünü doğrulamak için Subresource Integrity (SRI) kullanılması durumunda harici olarak (örneğin, bir İçerik Dağıtım Ağı üzerinde) barındırıldığı doğrulanmalıdır. Bu mümkün değilse, her bir kaynak için bunu gerekçelendiren belgelenmiş bir güvenlik kararı bulunmalıdır.", - "parent": "V3.6" - }, - { - "bom-ref": "V3.7", - "identifier": "V3.7", - "title": "Diğer Tarayıcı Güvenliği Hususları", - "parent": "V3" - }, - { - "bom-ref": "V3.7.1", - "identifier": "V3.7.1", - "text": "Uygulamanın yalnızca hâlâ desteklenen ve güvenli kabul edilen istemci tarafı teknolojileri kullandığı doğrulanmalıdır. Bu gereksinimi karşılamayan teknolojilere örnek olarak NSAPI eklentileri, Flash, Shockwave, ActiveX, Silverlight, NACL veya istemci tarafı Java applet’leri verilebilir.", - "parent": "V3.7" - }, - { - "bom-ref": "V3.7.2", - "identifier": "V3.7.2", - "text": "Uygulamanın, yalnızca hedef adres bir izinli listede yer alıyorsa kullanıcıyı otomatik olarak farklı bir ana makine adına veya uygulamanın kontrolünde olmayan bir etki alanına yönlendirdiği doğrulanmalıdır.", - "parent": "V3.7" - }, - { - "bom-ref": "V3.7.3", - "identifier": "V3.7.3", - "text": "Uygulamanın, kullanıcı uygulamanın kontrolü dışındaki bir URL’ye yönlendirildiğinde, yönlendirme hakkında bir bildirim gösterdiği ve kullanıcının bu gezintiyi iptal edebilmesi için bir seçenek sunduğu doğrulanmalıdır.", - "parent": "V3.7" - }, - { - "bom-ref": "V3.7.4", - "identifier": "V3.7.4", - "text": "Uygulamanın en üst düzey etki alanının (örneğin, site.tld) HTTP Strict Transport Security (HSTS) için genel preload listesine eklendiği doğrulanmalıdır. Bu, uygulamanın TLS kullanımının ana tarayıcılar tarafından doğrudan tanınmasını ve yalnızca Strict-Transport-Security yanıt header'ına bağlı kalınmamasını sağlar.", - "parent": "V3.7" - }, - { - "bom-ref": "V3.7.5", - "identifier": "V3.7.5", - "text": "Uygulamaya erişen tarayıcının beklenen güvenlik özelliklerini desteklememesi durumunda, uygulamanın dokümantasyona uygun şekilde davrandığı (örneğin kullanıcıyı uyarma veya erişimi engelleme) doğrulanmalıdır.", - "parent": "V3.7" - }, - { - "bom-ref": "V4", - "identifier": "V4", - "title": "API ve Web Servisi" - }, - { - "bom-ref": "V4.1", - "identifier": "V4.1", - "title": "Genel Web Servisi Güvenliği", - "parent": "V4" - }, - { - "bom-ref": "V4.1.1", - "identifier": "V4.1.1", - "text": "İleti gövdesi içeren her HTTP yanıtında, yanıtın gerçek içeriğiyle eşleşen bir Content-Type header alanı bulunduğu ve güvenli karakter kodlamasını (örneğin, UTF-8, ISO-8859-1) belirtmek üzere charset parametresi içerdiği doğrulanmalıdır. Bu işlem, IANA Medya Türleri'nden \"text/\", \"/+xml\" ve \"/xml\" gibi içerikler için geçerlidir.", - "parent": "V4.1" - }, - { - "bom-ref": "V4.1.2", - "identifier": "V4.1.2", - "text": "Yalnızca kullanıcı arayüzüne yönelik uç noktaların (manuel olarak web tarayıcısı ile erişilmesi amaçlanan) otomatik olarak HTTP'den HTTPS'e yönlendirme yaptığı ve diğer hizmetlerin veya uç noktaların şeffaf yönlendirme gerçekleştirmediği doğrulanmalıdır. Bu, istemcinin farkında olmadan şifrelenmemiş HTTP istekleri göndermesi ve bu isteklerin otomatik olarak HTTPS'e yönlendirilmesi sonucunda hassas verilerin sızmasının fark edilmemesi riskini önlemek içindir.", - "parent": "V4.1" - }, - { - "bom-ref": "V4.1.3", - "identifier": "V4.1.3", - "text": "Uygulama tarafından kullanılan ve yük dengeleyici, web proxy veya frontend için backend hizmeti gibi bir ara katman tarafından ayarlanan herhangi bir HTTP başlık alanının, son kullanıcı tarafından geçersiz kılınamayacağı doğrulanmalıdır. Örnek başlıklar arasında X-Real-IP, X-Forwarded-* veya X-User-ID yer alabilir.", - "parent": "V4.1" - }, - { - "bom-ref": "V4.1.4", - "identifier": "V4.1.4", - "text": "Uygulama veya API tarafından açıkça desteklenen HTTP yöntemlerinin (preflight istekleri sırasında OPTIONS dahil) dışında hiçbir yöntemin kullanılmadığı ve kullanılmayan yöntemlerin engellendiği doğrulanmalıdır.", - "parent": "V4.1" - }, - { - "bom-ref": "V4.1.5", - "identifier": "V4.1.5", - "text": "Çok hassas istekler veya birçok sistemden geçen işlemler için, taşıma katmanı güvenliğinin üzerine ek bir güvence sağlamak amacıyla, her iletiye özel dijital imzaların kullanıldığı doğrulanmalıdır.", - "parent": "V4.1" - }, - { - "bom-ref": "V4.2", - "identifier": "V4.2", - "title": "HTTP İleti Yapısı Doğrulama", - "parent": "V4" - }, - { - "bom-ref": "V4.2.1", - "identifier": "V4.2.1", - "text": "Tüm uygulama bileşenlerinin (yük dengeleyiciler, güvenlik duvarları ve uygulama sunucuları dahil) HTTP sürümüne uygun mekanizmaları kullanarak gelen HTTP iletilerinin sınırlarını belirlediği ve bu sayede HTTP istek kaçakçılığına karşı koruma sağlandığı doğrulanmalıdır. HTTP/1.x sürümünde Transfer-Encoding başlık alanı varsa, RFC 2616'ya göre Content-Length başlığı göz ardı edilmelidir. HTTP/2 veya HTTP/3 kullanıldığında, Content-Length başlığı varsa, alıcının bu değerin DATA çerçevelerinin uzunluğuyla tutarlı olduğunu doğrulaması gerekir.", - "parent": "V4.2" - }, - { - "bom-ref": "V4.2.2", - "identifier": "V4.2.2", - "text": "HTTP iletileri üretilirken, Content-Length başlığının, HTTP protokolünün çerçeveleme yöntemine göre belirlenen içerik uzunluğu ile çelişmediği doğrulanmalıdır. Bu, istek kaçakçılığı saldırılarını önlemek için gereklidir.", - "parent": "V4.2" - }, - { - "bom-ref": "V4.2.3", - "identifier": "V4.2.3", - "text": "Uygulamanın, yanıt bölme ve header enjeksiyonu saldırılarını önlemek amacıyla, bağlantıya özel başlık alanları (örneğin Transfer-Encoding) içeren HTTP/2 veya HTTP/3 iletilerini göndermediği ve kabul etmediği doğrulanmalıdır.", - "parent": "V4.2" - }, - { - "bom-ref": "V4.2.4", - "identifier": "V4.2.4", - "text": "Uygulamanın yalnızca başlık alanları ve değerleri CR (\\r), LF (\\n) veya CRLF (\\r\\n) karakter dizileri içermeyen HTTP/2 ve HTTP/3 isteklerini kabul ettiği doğrulanmalıdır. Bu, başlık enjeksiyonu saldırılarını önlemek içindir.", - "parent": "V4.2" - }, - { - "bom-ref": "V4.2.5", - "identifier": "V4.2.5", - "text": "Uygulama (backend veya frontend) istek oluşturuyor ve gönderiyorsa, URI'ler (örneğin API çağrıları için) veya HTTP istek başlıkları (örneğin Authorization veya Cookie) gibi bileşenlerin, alıcı sistemler tarafından kabul edilemeyecek kadar uzun olmamasını sağlamak amacıyla doğrulama, temizleme veya diğer mekanizmaları kullandığı doğrulanmalıdır. Bu tür çok uzun istekler (örneğin çok uzun bir Cookie başlığı) gönderildiğinde sunucunun sürekli hata durumu döndürmesiyle hizmet reddi oluşabilir.", - "parent": "V4.2" - }, - { - "bom-ref": "V4.3", - "identifier": "V4.3", - "title": "GraphQL", - "parent": "V4" - }, - { - "bom-ref": "V4.3.1", - "identifier": "V4.3.1", - "text": "Maliyetli ve iç içe geçmiş sorgular sonucu oluşabilecek GraphQL veya veri katmanı ifadelerine yönelik Hizmet Reddi (DoS) saldırılarını önlemek için, sorgu izin listesi (allowlist), derinlik sınırlandırması, sorgu sayısı sınırlandırması veya sorgu maliyeti analizi kullanıldığı doğrulanmalıdır.", - "parent": "V4.3" - }, - { - "bom-ref": "V4.3.2", - "identifier": "V4.3.2", - "text": "GraphQL introspection (iç yapı sorgulama) sorgularının, GraphQL API'nin üçüncü taraflar tarafından kullanılmasına yönelik olmadığı sürece, üretim ortamında devre dışı bırakıldığı doğrulanmalıdır.", - "parent": "V4.3" - }, - { - "bom-ref": "V4.4", - "identifier": "V4.4", - "title": "WebSocket", - "parent": "V4" - }, - { - "bom-ref": "V4.4.1", - "identifier": "V4.4.1", - "text": "Tüm WebSocket bağlantılarında TLS üzerinden WebSocket (WSS) kullanıldığı doğrulanmalıdır.", - "parent": "V4.4" - }, - { - "bom-ref": "V4.4.2", - "identifier": "V4.4.2", - "text": "WebSocket'in başlangıçtaki HTTP el sıkışması (handshake) sırasında, Origin başlık alanının uygulama için izin verilen origin listesiyle karşılaştırılarak kontrol edildiği doğrulanmalıdır.", - "parent": "V4.4" - }, - { - "bom-ref": "V4.4.3", - "identifier": "V4.4.3", - "text": "Uygulamanın standart oturum yönetimi kullanılamıyorsa, bunun yerine ilgili Oturum Yönetimi güvenlik gereksinimlerine uygun özel token'ların kullanıldığı doğrulanmalıdır.", - "parent": "V4.4" - }, - { - "bom-ref": "V4.4.4", - "identifier": "V4.4.4", - "text": "HTTPS oturumu WebSocket kanalına geçerken, özel WebSocket oturum yönetim token’larının önceki şekilde kimliği doğrulanmış HTTPS oturumu aracılığıyla elde edildiği veya doğrulandığı doğrulanmalıdır.", - "parent": "V4.4" - }, - { - "bom-ref": "V5", - "identifier": "V5", - "title": "Dosya İşleme" - }, - { - "bom-ref": "V5.1", - "identifier": "V5.1", - "title": "Dosya İşleme Dokümantasyonu", - "parent": "V5" - }, - { - "bom-ref": "V5.1.1", - "identifier": "V5.1.1", - "text": "Dokümantasyonun, her yükleme özelliği için izin verilen dosya türlerini, beklenen dosya uzantılarını ve maksimum boyutu (açılmış hali dahil) tanımladığı doğrulanmalıdır. Ayrıca, dosyaların son kullanıcılar için nasıl güvenli hâle getirileceği (örneğin kötü amaçlı bir dosya tespit edildiğinde uygulamanın nasıl davranacağı) gibi bilgilerin de belgede yer aldığı doğrulanmalıdır.", - "parent": "V5.1" - }, - { - "bom-ref": "V5.2", - "identifier": "V5.2", - "title": "Dosya Yükleme ve İçerik", - "parent": "V5" - }, - { - "bom-ref": "V5.2.1", - "identifier": "V5.2.1", - "text": "Uygulamanın, yalnızca performans kaybına veya hizmet reddine yol açmayacak boyuttaki dosyaları kabul ettiği doğrulanmalıdır.", - "parent": "V5.2" - }, - { - "bom-ref": "V5.2.2", - "identifier": "V5.2.2", - "text": "Uygulama bir dosyayı, doğrudan veya bir arşiv (ör. zip dosyası) içinde kabul ettiğinde, dosya uzantısının beklenen uzantıyla eşleşip eşleşmediğini kontrol ettiği ve içeriğin uzantı tarafından temsil edilen türle uyumlu olduğunu doğruladığı kontrol edilmelidir. Bu; ilk 'magic byte' kontrolü, görüntü yeniden yazımı ve dosya içeriği doğrulama için özel kütüphanelerin kullanımı gibi yöntemleri içerir. Seviye 1 için bu, yalnızca iş veya güvenlik kararlarında kullanılan dosyalarla sınırlı olabilir. Seviye 2 ve üzeri için tüm dosyalar bu kontrole tabi olmalıdır.", - "parent": "V5.2" - }, - { - "bom-ref": "V5.2.3", - "identifier": "V5.2.3", - "text": "Sıkıştırılmış dosyaların (ör. zip, gz, docx, odt) açılmadan önce, izin verilen maksimum açılmış boyuta ve maksimum dosya sayısına göre kontrol edildiği doğrulanmalıdır.", - "parent": "V5.2" - }, - { - "bom-ref": "V5.2.4", - "identifier": "V5.2.4", - "text": "Her kullanıcı için dosya boyutu kotası ve maksimum dosya sayısının uygulandığı doğrulanmalıdır. Böylece tek bir kullanıcının çok sayıda veya aşırı büyük dosya yükleyerek depolama alanını doldurması engellenir.", - "parent": "V5.2" - }, - { - "bom-ref": "V5.2.5", - "identifier": "V5.2.5", - "text": "Uygulamanın, içinde sembolik bağlantılar (symlink) bulunan sıkıştırılmış dosyaların yüklenmesine yalnızca bu durum özel olarak gerekli olduğunda izin verdiği doğrulanmalıdır. Bu durumda, sembolik bağlantı verilebilecek dosyaların bir izinli listesi uygulanmalıdır.", - "parent": "V5.2" - }, - { - "bom-ref": "V5.2.6", - "identifier": "V5.2.6", - "text": "Uygulamanın, piksel boyutu izin verilen maksimum değeri aşan görüntü dosyalarının yüklenmesini reddettiği doğrulanmalıdır. Bu, pixel flood saldırılarını önlemek için gereklidir.", - "parent": "V5.2" - }, - { - "bom-ref": "V5.3", - "identifier": "V5.3", - "title": "Dosya Depolama", - "parent": "V5" - }, - { - "bom-ref": "V5.3.1", - "identifier": "V5.3.1", - "text": "Güvenilmeyen girdilerle yüklenen veya oluşturulan ve herkese açık klasörlerde depolanan dosyaların, bir HTTP isteğiyle doğrudan erişildiğinde sunucu taraflı program kodu olarak çalıştırılmadığı doğrulanmalıdır.", - "parent": "V5.3" - }, - { - "bom-ref": "V5.3.2", - "identifier": "V5.3.2", - "text": "Uygulamanın, dosya işlemleri için dosya yollarını oluştururken kullanıcı tarafından gönderilen dosya adlarını değil, dahili olarak oluşturulan veya güvenilir verileri kullandığı; eğer kullanıcı tarafından gönderilen dosya adları veya meta veriler kullanılacaksa, sıkı doğrulama ve temizleme işlemlerinin uygulandığı doğrulanmalıdır. Bu, yol geçişi (path traversal), yerel veya uzak dosya dahil etme (LFI, RFI) ve sunucu tarafı istek sahteciliği (SSRF) saldırılarına karşı koruma sağlar.", - "parent": "V5.3" - }, - { - "bom-ref": "V5.3.3", - "identifier": "V5.3.3", - "text": "Sunucu tarafında gerçekleşen dosya işlemlerinin (örneğin dosya açma/decompress işlemi), kullanıcı tarafından sağlanan yol bilgilerini yok saydığı ve zip slip gibi güvenlik açıklarını önlediği doğrulanmalıdır.", - "parent": "V5.3" - }, - { - "bom-ref": "V5.4", - "identifier": "V5.4", - "title": "Dosya İndirme", - "parent": "V5" - }, - { - "bom-ref": "V5.4.1", - "identifier": "V5.4.1", - "text": "Uygulamanın, kullanıcı tarafından gönderilen dosya adlarını (ör. JSON, JSONP veya URL parametresinde) doğruladığı veya göz ardı ettiği ve yanıtın Content-Disposition başlık alanında bir dosya adı belirttiği doğrulanmalıdır.", - "parent": "V5.4" - }, - { - "bom-ref": "V5.4.2", - "identifier": "V5.4.2", - "text": "Sunulan dosya adlarının (örneğin HTTP yanıt header'larında veya e-posta eklerinde), belge yapısını korumak ve enjeksiyon saldırılarını önlemek için kodlandığı veya temizlendiği (ör. RFC 6266’ya uygun) doğrulanmalıdır.", - "parent": "V5.4" - }, - { - "bom-ref": "V5.4.3", - "identifier": "V5.4.3", - "text": "Güvenilmeyen kaynaklardan elde edilen dosyaların, bilinen kötü amaçlı içeriklerin sunulmasını önlemek amacıyla antivirüs tarayıcılarıyla tarandığı doğrulanmalıdır.", - "parent": "V5.4" - }, - { - "bom-ref": "V6", - "identifier": "V6", - "title": "Kimlik Doğrulama" - }, - { - "bom-ref": "V6.1", - "identifier": "V6.1", - "title": "Kimlik Doğrulama Dokümantasyonu", - "parent": "V6" - }, - { - "bom-ref": "V6.1.1", - "identifier": "V6.1.1", - "text": "Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırılarına karşı oran sınırlama (rate limiting), otomasyon karşıtı önlemler ve uyarlanabilir yanıt gibi kontrollerin nasıl kullanıldığını açıklayan bir uygulama dokümantasyonu bulunduğu doğrulanmalıdır. Dokümantasyon, bu kontrollerin nasıl yapılandırıldığını ve kötü niyetli hesap kilitlemenin nasıl önlendiğini açıkça ortaya koymalıdır.", - "parent": "V6.1" - }, - { - "bom-ref": "V6.1.2", - "identifier": "V6.1.2", - "text": "Parolalarda kullanılmasını önlemek amacıyla, bağlama özgü sözcüklerin (örneğin kurum adlarının permütasyonları, ürün adları, sistem tanımlayıcıları, proje kod adları, departman veya rol adları vb.) bulunduğu belgelenmiş bir liste mevcut olduğu doğrulanmalıdır.", - "parent": "V6.1" - }, - { - "bom-ref": "V6.1.3", - "identifier": "V6.1.3", - "text": "Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, bunların tümünün belgelenmiş olduğu ve her yol için tutarlı şekilde uygulanması gereken güvenlik kontrolleri ile kimlik doğrulama gücünün tanımlandığı doğrulanmalıdır.", - "parent": "V6.1" - }, - { - "bom-ref": "V6.2", - "identifier": "V6.2", - "title": "Parola Güvenliği", - "parent": "V6" - }, - { - "bom-ref": "V6.2.1", - "identifier": "V6.2.1", - "text": "Kullanıcı tarafından belirlenen parolaların en az 8 karakter uzunluğunda olması sağlanmalı, ancak 15 karakter ve üzeri uzunlukta parolalar olmaları şiddetle tavsiye edilir.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.2", - "identifier": "V6.2.2", - "text": "Kullanıcıların parolalarını değiştirebilmeleri sağlanmalıdır.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.3", - "identifier": "V6.2.3", - "text": "Parola değiştirme işlevinin hem mevcut hem de yeni parolayı gerektirdiği doğrulanmalıdır.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.4", - "identifier": "V6.2.4", - "text": "Kayıt veya parola değişimi sırasında girilen parolaların, uygulamanın parola politikasına (örneğin minimum uzunluk) uyan ilk 3000 yaygın parolaya karşı kontrol edildiği doğrulanmalıdır.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.5", - "identifier": "V6.2.5", - "text": "Her tür karakterin kullanılmasına izin verildiği ve büyük/küçük harf, sayı veya özel karakter şartlarının zorunlu tutulmadığı doğrulanmalıdır.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.6", - "identifier": "V6.2.6", - "text": "Parola giriş alanlarının, girdiyi maskelemek için \"type=password\" kullandığı doğrulanmalıdır. Uygulamalar, kullanıcının tüm maskelenmiş parolayı ya da son girilen karakteri geçici olarak görüntülemesine izin verebilir.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.7", - "identifier": "V6.2.7", - "text": "\"Yapıştır\" özelliğinin, tarayıcı parola yardımcılarının ve harici parola yöneticilerinin kullanımına izin verildiği doğrulanmalıdır.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.8", - "identifier": "V6.2.8", - "text": "Uygulamanın, kullanıcıdan aldığı parolayı herhangi bir şekilde değiştirmeden, örneğin kesmeden veya harf büyüklüğünü değiştirmeden, tam olarak doğruladığı teyit edilmelidir.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.9", - "identifier": "V6.2.9", - "text": "En az 64 karakter uzunluğundaki parolalara izin verildiği doğrulanmalıdır.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.10", - "identifier": "V6.2.10", - "text": "Kullanıcının parolasının, yalnızca ele geçirildiği tespit edildiğinde veya kullanıcı tarafından yenilendiğinde geçerliliğini yitirdiği doğrulanmalıdır. Uygulama, belirli aralıklarla parola yenilenmesini zorunlu kılmamalıdır.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.11", - "identifier": "V6.2.11", - "text": "Tahmin edilmesi kolay parolaların oluşturulmasını önlemek amacıyla, bağlama özgü kelimelerin yer aldığı belgelenmiş listenin parola doğrulamada kullanıldığı teyit edilmelidir.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.2.12", - "identifier": "V6.2.12", - "text": "Kayıt veya parola değişikliği sırasında girilen parolaların, ele geçirilmiş parolalar listesine karşı kontrol edildiği doğrulanmalıdır.", - "parent": "V6.2" - }, - { - "bom-ref": "V6.3", - "identifier": "V6.3", - "title": "Genel Kimlik Doğrulama Güvenliği", - "parent": "V6" - }, - { - "bom-ref": "V6.3.1", - "identifier": "V6.3.1", - "text": "Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırıları gibi saldırıları önlemeye yönelik kontrollerin, uygulamanın güvenlik dokümantasyonuna göre uygulandığı doğrulanmalıdır.", - "parent": "V6.3" - }, - { - "bom-ref": "V6.3.2", - "identifier": "V6.3.2", - "text": "\"root\", \"admin\" veya \"sa\" gibi varsayılan kullanıcı hesaplarının uygulamada yer almadığı veya devre dışı bırakıldığı doğrulanmalıdır.", - "parent": "V6.3" - }, - { - "bom-ref": "V6.3.3", - "identifier": "V6.3.3", - "text": "Uygulamaya erişim için ya çok faktörlü bir kimlik doğrulama mekanizması ya da tek faktörlü mekanizmaların kombinasyonu kullanılmalıdır. Seviye 3 için, bu faktörlerden biri, oltalama saldırılarına karşı direnç sağlayan ve kimlik doğrulama niyetini bir kullanıcı etkileşimi (örneğin FIDO donanım anahtarında bir düğmeye basma veya mobil telefonda bir onay) gerektirerek doğrulayan donanım tabanlı bir kimlik doğrulayıcı olmalıdır. Bu gereksinimdeki herhangi bir esneklik için, gerekçesi belgelenmiş ve riskleri azaltıcı kapsamlı kontroller içeren bir plan gereklidir.", - "parent": "V6.3" - }, - { - "bom-ref": "V6.3.4", - "identifier": "V6.3.4", - "text": "Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, belgelendirilmemiş bir yol bulunmadığı ve tüm yollar için güvenlik kontrolleri ile kimlik doğrulama gücünün tutarlı şekilde uygulandığı doğrulanmalıdır.", - "parent": "V6.3" - }, - { - "bom-ref": "V6.3.5", - "identifier": "V6.3.5", - "text": "Başarılı veya başarısız şüpheli kimlik doğrulama girişimlerinin kullanıcıya bildirildiği doğrulanmalıdır. Bu, olağandışı bir konum veya istemciden gelen girişimler, yalnızca bir faktörle yapılan kısmen başarılı doğrulamalar, uzun süreli inaktiflik sonrası yapılan girişimler veya birçok başarısız denemeden sonraki başarılı girişimler gibi durumları içerebilir.", - "parent": "V6.3" - }, - { - "bom-ref": "V6.3.6", - "identifier": "V6.3.6", - "text": "E-postanın, tek faktörlü ya da çok faktörlü kimlik doğrulama mekanizması olarak kullanılmadığı doğrulanmalıdır.", - "parent": "V6.3" - }, - { - "bom-ref": "V6.3.7", - "identifier": "V6.3.7", - "text": "Kimlik doğrulama detaylarında yapılan güncellemeler sonrasında (örneğin kimlik bilgisi sıfırlama, kullanıcı adı veya e-posta adresi değişiklikleri), kullanıcıların bilgilendirildiği doğrulanmalıdır.", - "parent": "V6.3" - }, - { - "bom-ref": "V6.3.8", - "identifier": "V6.3.8", - "text": "Başarısız kimlik doğrulama girişimlerinden, geçerli kullanıcıların hata mesajları, HTTP yanıt kodları veya farklı yanıt süreleri gibi sonuçlara dayanarak tespit edilemediği doğrulanmalıdır. Bu koruma, kayıt ve \"parolamı unuttum\" işlevselliğinde de geçerli olmalıdır.", - "parent": "V6.3" - }, - { - "bom-ref": "V6.4", - "identifier": "V6.4", - "title": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", - "parent": "V6" - }, - { - "bom-ref": "V6.4.1", - "identifier": "V6.4.1", - "text": "Sistem tarafından oluşturulan ilk parolaların veya etkinleştirme kodlarının güvenli bir şekilde rastgele üretildiği, mevcut parola politikasına uygun olduğu, kısa bir süre içinde veya ilk kullanım sonrasında geçerliliğini yitirdiği doğrulanmalıdır. Bu başlangıç sırları uzun vadeli parola olarak kullanılmasına izin verilmemelidir.", - "parent": "V6.4" - }, - { - "bom-ref": "V6.4.2", - "identifier": "V6.4.2", - "text": "Parola ipuçlarının veya \"gizli sorular\" olarak bilinen, bilgiye dayalı kimlik doğrulama mekanizmalarının mevcut olmadığı doğrulanmalıdır.", - "parent": "V6.4" - }, - { - "bom-ref": "V6.4.3", - "identifier": "V6.4.3", - "text": "Unutulmuş parolanın sıfırlanması için, etkin olan çok faktörlü kimlik doğrulama mekanizmalarını atlamayan güvenli bir sürecin uygulandığı doğrulanmalıdır.", - "parent": "V6.4" - }, - { - "bom-ref": "V6.4.4", - "identifier": "V6.4.4", - "text": "Çok faktörlü kimlik doğrulama faktörlerinden biri kaybolursa, kayıt sırasında uygulanan kimlik kanıtlama seviyesiyle aynı seviyede kimlik doğrulama yapıldığı doğrulanmalıdır.", - "parent": "V6.4" - }, - { - "bom-ref": "V6.4.5", - "identifier": "V6.4.5", - "text": "Süresi dolacak kimlik doğrulama mekanizmalarının yenilenmesine ilişkin talimatların, süresi dolmadan önce tamamlanacak şekilde yeterli sürede gönderildiği ve gerekiyorsa otomatik hatırlatıcıların yapılandırıldığı doğrulanmalıdır.", - "parent": "V6.4" - }, - { - "bom-ref": "V6.4.6", - "identifier": "V6.4.6", - "text": "Yönetici yetkisi olan kullanıcıların, kullanıcının parola sıfırlama sürecini başlatabildiği ancak kullanıcının yeni parolasını belirleyemediği veya değiştiremediği doğrulanmalıdır. Bu, yönetici yetkisi olan kullanıcıların, kullanıcı parolasını bilmesini engeller.", - "parent": "V6.4" - }, - { - "bom-ref": "V6.5", - "identifier": "V6.5", - "title": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", - "parent": "V6" - }, - { - "bom-ref": "V6.5.1", - "identifier": "V6.5.1", - "text": "Arama sırları, bant dışı kimlik doğrulama istekleri veya kodları ve zamana dayalı tek kullanımlık parolaların (TOTP) yalnızca bir kez kullanılabildiği doğrulanmalıdır.", - "parent": "V6.5" - }, - { - "bom-ref": "V6.5.2", - "identifier": "V6.5.2", - "text": "Uygulamanın backend tarafında saklanırken, 112 bitten az entropiye sahip (örneğin 19 rastgele harf-rakam karakteri veya 34 rastgele rakam) arama sırlarının, 32-bit rastgele bir salt içeren onaylı bir parola saklama algoritmasıyla hash’lendiği doğrulanmalıdır. Gizli bilginin entropisi 112 bit veya daha fazlaysa standart bir hash fonksiyonu kullanılabilir.", - "parent": "V6.5" - }, - { - "bom-ref": "V6.5.3", - "identifier": "V6.5.3", - "text": "Arama sırları, bant dışı kimlik doğrulama kodları ve zamana dayalı tek kullanımlık parola seed'lerinin, öngörülebilir değerlerden kaçınmak için Kriptografik Olarak Güvenli Sözde Rastgele Sayı Üreteci (CSPRNG) ile oluşturulduğu doğrulanmalıdır.", - "parent": "V6.5" - }, - { - "bom-ref": "V6.5.4", - "identifier": "V6.5.4", - "text": "Arama sırlarının ve bant dışı kimlik doğrulama kodlarının en az 20 bit entropiye (genellikle 4 rastgele harf-rakam karakteri veya 6 rastgele rakam) sahip olduğu doğrulanmalıdır.", - "parent": "V6.5" - }, - { - "bom-ref": "V6.5.5", - "identifier": "V6.5.5", - "text": "Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının ve zamana dayalı tek kullanımlık parolaların (TOTP) belirli bir ömre sahip olduğu doğrulanmalıdır. Bant dışı istekler en fazla 10 dakika, TOTP’ler ise en fazla 30 saniye geçerli olmalıdır.", - "parent": "V6.5" - }, - { - "bom-ref": "V6.5.6", - "identifier": "V6.5.6", - "text": "Herhangi bir kimlik doğrulama faktörünün (fiziksel cihazlar dahil) çalınması veya kaybı durumunda iptal edilebildiği doğrulanmalıdır.", - "parent": "V6.5" - }, - { - "bom-ref": "V6.5.7", - "identifier": "V6.5.7", - "text": "Biyometrik kimlik doğrulama mekanizmalarının yalnızca ikincil faktör olarak, “sahip olduğunuz bir şey” veya “bildiğiniz bir şey” ile birlikte kullanıldığı doğrulanmalıdır.", - "parent": "V6.5" - }, - { - "bom-ref": "V6.5.8", - "identifier": "V6.5.8", - "text": "Zamana dayalı tek kullanımlık parolaların (TOTP) doğrulamasının, güvenilir bir hizmetten alınan zaman kaynağına dayanarak yapıldığı ve güvenilir olmayan veya istemci tarafından sağlanan zaman kaynağına dayanmadığı doğrulanmalıdır.", - "parent": "V6.5" - }, - { - "bom-ref": "V6.6", - "identifier": "V6.6", - "title": "Bant Dışı Kimlik Doğrulama Mekanizmaları", - "parent": "V6" - }, - { - "bom-ref": "V6.6.1", - "identifier": "V6.6.1", - "text": "Tek kullanımlık parolaların (OTP) telefon veya SMS ile Public Switched Telephone Network (PSTN) üzerinden iletildiği kimlik doğrulama mekanizmalarının, yalnızca telefon numarası önceden doğrulanmışsa, alternatif daha güçlü yöntemler (örneğin TOTP) de sunuluyorsa ve kullanıcıya güvenlik riskleri hakkında bilgi veriliyorsa sunulduğu doğrulanmalıdır. Seviye 3 uygulamalar için telefon ve SMS seçenekleri sunulmamalıdır.", - "parent": "V6.6" - }, - { - "bom-ref": "V6.6.2", - "identifier": "V6.6.2", - "text": "Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının, oluşturuldukları özgün kimlik doğrulama isteğiyle bağlantılı olduğu ve daha önceki ya da sonraki bir istek için kullanılamadığı doğrulanmalıdır.", - "parent": "V6.6" - }, - { - "bom-ref": "V6.6.3", - "identifier": "V6.6.3", - "text": "Kod tabanlı bant dışı kimlik doğrulama mekanizmalarının, oran sınırlaması ile kaba kuvvet saldırılarına karşı korunduğu doğrulanmalıdır. En az 64 bit entropiye sahip kodlar kullanılması da değerlendirilmelidir.", - "parent": "V6.6" - }, - { - "bom-ref": "V6.6.4", - "identifier": "V6.6.4", - "text": "Çok faktörlü kimlik doğrulama için push bildirimleri kullanılıyorsa, push bombing saldırılarına karşı oran sınırlamasının kullanıldığı doğrulanmalıdır. “Numara eşleştirme” de bu riski azaltabilir.", - "parent": "V6.6" - }, - { - "bom-ref": "V6.7", - "identifier": "V6.7", - "title": "Kriptografik Kimlik Doğrulama Mekanizması", - "parent": "V6" - }, - { - "bom-ref": "V6.7.1", - "identifier": "V6.7.1", - "text": "Kriptografik kimlik doğrulama beyanlarını doğrulamak için kullanılan sertifikaların, değiştirilmeye karşı korumalı şekilde saklandığı doğrulanmalıdır.", - "parent": "V6.7" - }, - { - "bom-ref": "V6.7.2", - "identifier": "V6.7.2", - "text": "Challenge nonce değerinin en az 64 bit uzunluğunda olduğu ve istatistiksel olarak benzersiz ya da cihazın ömrü boyunca benzersiz olduğu doğrulanmalıdır.", - "parent": "V6.7" - }, - { - "bom-ref": "V6.8", - "identifier": "V6.8", - "title": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", - "parent": "V6" - }, - { - "bom-ref": "V6.8.1", - "identifier": "V6.8.1", - "text": "Uygulama birden fazla kimlik sağlayıcıyı (IdP) destekliyorsa, başka bir desteklenen kimlik sağlayıcı aracılığıyla (örneğin aynı kullanıcı tanımlayıcısını kullanarak) kullanıcının kimliğinin taklit edilemediği doğrulanmalıdır. Standart önlem, uygulamanın kullanıcıyı IdP kimliği (bir ad alanı işlevi görür) ve IdP içindeki kullanıcı kimliğinin birleşimiyle kaydetmesi ve tanımlamasıdır.", - "parent": "V6.8" - }, - { - "bom-ref": "V6.8.2", - "identifier": "V6.8.2", - "text": "Kimlik doğrulama beyanları üzerindeki dijital imzaların (örneğin JWT veya SAML beyanları) varlığı ve bütünlüğünün her zaman doğrulandığı ve imzasız veya geçersiz imzalı beyanların reddedildiği doğrulanmalıdır.", - "parent": "V6.8" - }, - { - "bom-ref": "V6.8.3", - "identifier": "V6.8.3", - "text": "SAML beyanlarının benzersiz biçimde işlendiği ve yalnızca geçerlilik süresi içinde bir kez kullanıldığı, tekrar oynatma (replay) saldırılarını önlemek amacıyla doğrulanmalıdır.", - "parent": "V6.8" - }, - { - "bom-ref": "V6.8.4", - "identifier": "V6.8.4", - "text": "Uygulama ayrı bir Kimlik Sağlayıcı (IdP) kullanıyorsa ve belirli işlemler için belirli kimlik doğrulama gücü, yöntemleri veya zaman bilgisi bekliyorsa, uygulamanın bu bilgileri IdP tarafından döndürülen veriler üzerinden doğruladığı teyit edilmelidir. Örneğin OIDC kullanılıyorsa, bu durum ID Token üzerindeki 'acr', 'amr' ve 'auth_time' gibi claim’lerin (varsa) doğrulanması ile sağlanabilir. Eğer IdP bu bilgileri sağlamıyorsa, uygulamanın asgari kimlik doğrulama gücünün kullanıldığını varsayan (örneğin yalnızca kullanıcı adı ve parola ile tek faktörlü doğrulama) belgelenmiş bir yedek yaklaşımı olmalıdır.", - "parent": "V6.8" - }, - { - "bom-ref": "V7", - "identifier": "V7", - "title": "Oturum Yönetimi" - }, - { - "bom-ref": "V7.1", - "identifier": "V7.1", - "title": "Oturum Yönetim Dokümantasyonu", - "parent": "V7" - }, - { - "bom-ref": "V7.1.1", - "identifier": "V7.1.1", - "text": "Kullanıcının oturum inaktivite zaman aşımı süresi ve mutlak maksimum oturum süresinin belgelendiği, diğer kontrollerle birlikte uygun olduğu ve NIST SP 800-63B yeniden kimlik doğrulama gereksinimlerinden herhangi bir sapma varsa gerekçesinin belgede yer aldığı doğrulanmalıdır.", - "parent": "V7.1" - }, - { - "bom-ref": "V7.1.2", - "identifier": "V7.1.2", - "text": "Belgede bir hesap için kaç adet eşzamanlı (paralel) oturuma izin verildiği ile birlikte, maksimum aktif oturum sayısına ulaşıldığında uygulanacak davranış ve işlemlerin tanımlandığı doğrulanmalıdır.", - "parent": "V7.1" - }, - { - "bom-ref": "V7.1.3", - "identifier": "V7.1.3", - "text": "Birleşik kimlik yönetim ekosisteminin bir parçası olarak kullanıcı oturumu oluşturan ve yöneten tüm sistemlerin, oturum ömrü, sonlandırma ve yeniden kimlik doğrulama gerektiren diğer koşulların nasıl koordine edildiğini açıklayan kontrollerle birlikte belgede yer aldığı doğrulanmalıdır.", - "parent": "V7.1" - }, - { - "bom-ref": "V7.2", - "identifier": "V7.2", - "title": "Temel Oturum Yönetimi Güvenliği", - "parent": "V7" - }, - { - "bom-ref": "V7.2.1", - "identifier": "V7.2.1", - "text": "Uygulamanın tüm oturum token'ı doğrulama işlemlerini güvenilir bir backend servisi aracılığıyla gerçekleştirdiği doğrulanmalıdır.", - "parent": "V7.2" - }, - { - "bom-ref": "V7.2.2", - "identifier": "V7.2.2", - "text": "Uygulamanın, statik API gizli anahtarları veya sabit değerler yerine, oturum yönetimi için dinamik olarak oluşturulan kendi kendine yeterli veya referans token'ları kullandığı doğrulanmalıdır.", - "parent": "V7.2" - }, - { - "bom-ref": "V7.2.3", - "identifier": "V7.2.3", - "text": "Uygulama kullanıcı oturumlarını temsil etmek için referans token'ları kullanıyorsa, bu token'ların benzersiz olduğu, kriptografik olarak güvenli bir sözde rastgele sayı üreteci (CSPRNG) kullanılarak üretildiği ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır.", - "parent": "V7.2" - }, - { - "bom-ref": "V7.2.4", - "identifier": "V7.2.4", - "text": "Uygulamanın, kullanıcı kimlik doğrulaması (yeniden kimlik doğrulama dahil) sırasında yeni bir oturum token'ı oluşturduğu ve mevcut oturum token'ını sonlandırdığı doğrulanmalıdır.", - "parent": "V7.2" - }, - { - "bom-ref": "V7.3", - "identifier": "V7.3", - "title": "Oturum Zaman Aşımı", - "parent": "V7" - }, - { - "bom-ref": "V7.3.1", - "identifier": "V7.3.1", - "text": "Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde bir hareketsizlik zaman aşımı bulunduğu doğrulanmalıdır.", - "parent": "V7.3" - }, - { - "bom-ref": "V7.3.2", - "identifier": "V7.3.2", - "text": "Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde mutlak bir maksimum oturum süresi bulunduğu doğrulanmalıdır.", - "parent": "V7.3" - }, - { - "bom-ref": "V7.4", - "identifier": "V7.4", - "title": "Oturum Sonlandırma", - "parent": "V7" - }, - { - "bom-ref": "V7.4.1", - "identifier": "V7.4.1", - "text": "Oturum sonlandırma tetiklendiğinde (örneğin, çıkış yapıldığında veya süre dolduğunda), uygulamanın oturumun daha fazla kullanılmasına izin vermediği doğrulanmalıdır. Referans token'lar veya durum bilgili oturumlar için bu, oturum verilerinin uygulama arka ucunda geçersiz kılınması anlamına gelir. Kapsamlı token kullanan uygulamaların; sonlandırılmış token listesi tutmak, kullanıcıya özel tarih ve saatten önce oluşturulan token'ları reddetmek veya kullanıcıya özel imzalama anahtarını yenilemek gibi bir çözüm uygulaması gerekir.", - "parent": "V7.4" - }, - { - "bom-ref": "V7.4.2", - "identifier": "V7.4.2", - "text": "Bir kullanıcı hesabı devre dışı bırakıldığında veya silindiğinde (örneğin bir çalışanın şirketten ayrılması), uygulamanın tüm aktif oturumları sonlandırdığı doğrulanmalıdır.", - "parent": "V7.4" - }, - { - "bom-ref": "V7.4.3", - "identifier": "V7.4.3", - "text": "Herhangi bir kimlik doğrulama faktörünün başarılı bir şekilde değiştirilmesi veya kaldırılmasından (şifre sıfırlama veya kurtarma yoluyla yapılan değişiklikler dahil ve varsa MFA ayarları güncellemeleri dahil) sonra, uygulamanın diğer tüm aktif oturumları sonlandırma seçeneği sunduğu doğrulanmalıdır.", - "parent": "V7.4" - }, - { - "bom-ref": "V7.4.4", - "identifier": "V7.4.4", - "text": "Kimlik doğrulama gerektiren tüm sayfalarda kolay erişilebilir ve görünür bir çıkış yap (logout) işlevi bulunduğu doğrulanmalıdır.", - "parent": "V7.4" - }, - { - "bom-ref": "V7.4.5", - "identifier": "V7.4.5", - "text": "Uygulama yöneticilerinin, bireysel bir kullanıcının veya tüm kullanıcıların aktif oturumlarını sonlandırabilme yetkisine sahip olduğu doğrulanmalıdır.", - "parent": "V7.4" - }, - { - "bom-ref": "V7.5", - "identifier": "V7.5", - "title": "Oturum Kötüye Kullanımına Karşı Savunmalar", - "parent": "V7" - }, - { - "bom-ref": "V7.5.1", - "identifier": "V7.5.1", - "text": "E-posta adresi, telefon numarası, MFA yapılandırması veya hesap kurtarmada kullanılan diğer bilgiler gibi kimlik doğrulamayı etkileyebilecek hassas hesap özniteliklerinde değişiklik yapılmadan önce uygulamanın tam yeniden kimlik doğrulama gerektirdiği doğrulanmalıdır.", - "parent": "V7.5" - }, - { - "bom-ref": "V7.5.2", - "identifier": "V7.5.2", - "text": "Kullanıcıların, (en az bir faktörle yeniden kimlik doğrulama yaptıktan sonra) mevcut tüm aktif oturumları görüntüleyebilmesi ve sonlandırabilmesinin mümkün olduğu doğrulanmalıdır.", - "parent": "V7.5" - }, - { - "bom-ref": "V7.5.3", - "identifier": "V7.5.3", - "text": "Uygulamanın, son derece hassas işlemler veya operasyonlar gerçekleştirilmeden önce en az bir faktörle ek kimlik doğrulaması veya ikincil bir doğrulama gerektirdiği doğrulanmalıdır.", - "parent": "V7.5" - }, - { - "bom-ref": "V7.6", - "identifier": "V7.6", - "title": "Birleşik Yeniden Kimlik Doğrulama", - "parent": "V7" - }, - { - "bom-ref": "V7.6.1", - "identifier": "V7.6.1", - "text": "Güvenen Taraf (RP) ile Kimlik Sağlayıcı (IdP) arasındaki oturum süresi ve oturum sonlandırma davranışlarının belgelenmiş olduğu ve, örneğin IdP kimlik doğrulama olayları arasında maksimum süreye ulaşıldığında yeniden kimlik doğrulamanın gerekli kılındığı doğrulanmalıdır.", - "parent": "V7.6" - }, - { - "bom-ref": "V7.6.2", - "identifier": "V7.6.2", - "text": "Yeni bir oturum oluşturulmasının, kullanıcı onayı veya açık bir eylem gerektirdiği; kullanıcı etkileşimi olmaksızın yeni uygulama oturumlarının oluşturulmasının önlendiği doğrulanmalıdır.", - "parent": "V7.6" - }, - { - "bom-ref": "V8", - "identifier": "V8", - "title": "Yetkilendirme" - }, - { - "bom-ref": "V8.1", - "identifier": "V8.1", - "title": "Yetkilendirme Dokümantasyonu", - "parent": "V8" - }, - { - "bom-ref": "V8.1.1", - "identifier": "V8.1.1", - "text": "Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak işlev düzeyinde ve veriye özel erişim kısıtlamaları için kuralları tanımladığı doğrulanmalıdır.", - "parent": "V8.1" - }, - { - "bom-ref": "V8.1.2", - "identifier": "V8.1.2", - "text": "Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak alan (field) düzeyinde erişim kısıtlamaları (hem okuma hem yazma) için kuralları tanımladığı doğrulanmalıdır. Bu kuralların, ilgili veri nesnesinin durum veya statü gibi diğer özniteliklerine bağlı olabileceği unutulmamalıdır.", - "parent": "V8.1" - }, - { - "bom-ref": "V8.1.3", - "identifier": "V8.1.3", - "text": "Uygulamanın dokümantasyonunun, kimlik doğrulama ve yetkilendirme ile ilgili güvenlik kararlarının alınmasında kullanılan çevresel ve bağlamsal öznitelikleri (günün saati, kullanıcı konumu, IP adresi veya cihaz gibi) tanımladığı doğrulanmalıdır.", - "parent": "V8.1" - }, - { - "bom-ref": "V8.1.4", - "identifier": "V8.1.4", - "text": "Kimlik doğrulama ve yetkilendirme dokümantasyonunun; işlev düzeyinde, veriye özel ve alan düzeyinde yetkilendirmenin yanı sıra çevresel ve bağlamsal faktörlerin karar almada nasıl kullanıldığını tanımladığı doğrulanmalıdır. Bu, değerlendirilen öznitelikleri, risk eşiklerini ve alınan aksiyonları (ör. izin ver, doğrulama iste, reddet, step-up kimlik doğrulama) içermelidir.", - "parent": "V8.1" - }, - { - "bom-ref": "V8.2", - "identifier": "V8.2", - "title": "Genel Yetkilendirme Tasarımı", - "parent": "V8" - }, - { - "bom-ref": "V8.2.1", - "identifier": "V8.2.1", - "text": "Uygulamanın, işlev düzeyindeki erişimin yalnızca açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır.", - "parent": "V8.2" - }, - { - "bom-ref": "V8.2.2", - "identifier": "V8.2.2", - "text": "Uygulamanın, veriye özel erişimin yalnızca belirli veri öğelerine açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, doğrudan nesne referansı güvenlik açıkları (IDOR) ve bozuk nesne düzeyinde yetkilendirme (BOLA) risklerini azaltır.", - "parent": "V8.2" - }, - { - "bom-ref": "V8.2.3", - "identifier": "V8.2.3", - "text": "Uygulamanın, alan (field) düzeyindeki erişimin yalnızca belirli alanlara açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, bozuk nesne özelliği düzeyinde yetkilendirme (BOPLA) risklerini azaltır.", - "parent": "V8.2" - }, - { - "bom-ref": "V8.2.4", - "identifier": "V8.2.4", - "text": "Tüketicinin çevresel ve bağlamsal özniteliklerine (ör. günün saati, konum, IP adresi veya cihaz) dayalı uyarlanabilir güvenlik kontrollerinin, uygulama dokümantasyonunda tanımlandığı şekilde, kimlik doğrulama ve yetkilendirme kararları için uygulandığı doğrulanmalıdır. Bu kontroller, tüketici yeni bir oturum başlatmaya çalışırken ve mevcut bir oturum sırasında uygulanmalıdır.", - "parent": "V8.2" - }, - { - "bom-ref": "V8.3", - "identifier": "V8.3", - "title": "İşlem Düzeyinde Yetkilendirme", - "parent": "V8" - }, - { - "bom-ref": "V8.3.1", - "identifier": "V8.3.1", - "text": "Uygulamanın yetkilendirme kurallarını güvenilir bir servis katmanında uyguladığı ve istemci taraflı JavaScript gibi güvenilmeyen tüketiciler tarafından değiştirilebilecek kontrollerle yetinmediği doğrulanmalıdır.", - "parent": "V8.3" - }, - { - "bom-ref": "V8.3.2", - "identifier": "V8.3.2", - "text": "Yetkilendirme kararlarının temelini oluşturan değerlerdeki değişikliklerin hemen uygulandığı doğrulanmalıdır. Değişikliklerin anında uygulanamadığı durumlarda (örneğin self-contained token içindeki verilere güveniliyorsa), tüketici artık yetkili olmadığı hâlde bir işlem gerçekleştirdiğinde uyarı verecek ve değişikliği geri alacak önlemler uygulanmalıdır. Bu alternatifin bilgi sızıntısını önlemeyeceği unutulmamalıdır.", - "parent": "V8.3" - }, - { - "bom-ref": "V8.3.3", - "identifier": "V8.3.3", - "text": "Bir nesneye erişimin, herhangi bir aracı veya onun adına hareket eden bir servis yerine yalnızca erişimi başlatan öznenin (ör. tüketici) izinlerine dayandığı doğrulanmalıdır. Örneğin, bir tüketici kimlik doğrulama için bir self-contained token kullanarak bir web servis çağırırsa ve bu servis başka bir servisten veri talep ederse, ikinci servis izin kararlarını verirken birinci servisin makine-makine token'ı yerine tüketicinin token'ını kullanmalıdır.", - "parent": "V8.3" - }, - { - "bom-ref": "V8.4", - "identifier": "V8.4", - "title": "Diğer Yetkilendirme Hususları", - "parent": "V8" - }, - { - "bom-ref": "V8.4.1", - "identifier": "V8.4.1", - "text": "Multi-tenant uygulamaların, tüketici işlemlerinin izinli olmadıkları tenant'lar üzerinde asla etkili olmamasını sağlamak için tenant'lar arası kontroller kullandığı doğrulanmalıdır.", - "parent": "V8.4" - }, - { - "bom-ref": "V8.4.2", - "identifier": "V8.4.2", - "text": "Yönetici arayüzlerine erişimin, sürekli tüketici kimlik doğrulaması, cihaz güvenlik durumu değerlendirmesi ve bağlamsal risk analizi dahil olmak üzere çok katmanlı güvenlik içerdiği doğrulanmalıdır. Yetkilendirme için yalnızca ağ konumu veya güvenilir uç noktalar yeterli olmamalıdır; ancak bu tür faktörler yetkisiz erişim olasılığını azaltabilir.", - "parent": "V8.4" - }, - { - "bom-ref": "V9", - "identifier": "V9", - "title": "Kendi İçinde Taşıyıcı Token (Self-contained Token)" - }, - { - "bom-ref": "V9.1", - "identifier": "V9.1", - "title": "Token Kaynağı ve Bütünlüğü", - "parent": "V9" - }, - { - "bom-ref": "V9.1.1", - "identifier": "V9.1.1", - "text": "Self-contained token'ların içerikleri kabul edilmeden önce, oynama (tampering) saldırılarına karşı dijital imza veya MAC ile doğrulama yapıldığı doğrulanmalıdır.", - "parent": "V9.1" - }, - { - "bom-ref": "V9.1.2", - "identifier": "V9.1.2", - "text": "Belirli bir bağlam için yalnızca bir allowlist üzerinde bulunan algoritmaların self-contained token oluşturmak ve doğrulamak için kullanılabildiği doğrulanmalıdır. Bu allowlist, yalnızca simetrik ya da yalnızca asimetrik algoritmaları içermeli ve kesinlikle 'None' algoritmasını içermemelidir. Hem simetrik hem de asimetrik algoritmalar desteklenmek zorundaysa, anahtar karışıklığını (key confusion) önlemek için ek kontroller uygulanmalıdır.", - "parent": "V9.1" - }, - { - "bom-ref": "V9.1.3", - "identifier": "V9.1.3", - "text": "Self-contained token'ları doğrulamak için kullanılan anahtar malzemesinin, token issuer için önceden yapılandırılmış güvenilir kaynaklardan alındığı doğrulanmalıdır. Bu, saldırganların güvenilmeyen kaynak ve anahtarları belirtmesini engeller. JWT ve diğer JWS yapılarında 'jku', 'x5u' ve 'jwk' gibi header'lar güvenilir kaynaklardan oluşan bir allowlist'e göre doğrulanmalıdır.", - "parent": "V9.1" - }, - { - "bom-ref": "V9.2", - "identifier": "V9.2", - "title": "Token İçeriği", - "parent": "V9" - }, - { - "bom-ref": "V9.2.1", - "identifier": "V9.2.1", - "text": "Token verisinde bir geçerlilik zaman aralığı (validity time span) varsa, yalnızca doğrulama zamanı bu zaman aralığı içerisindeyse token ve içeriği kabul edilmelidir. Örneğin, JWT'ler için 'nbf' ve 'exp' claim'leri doğrulanmalıdır.", - "parent": "V9.2" - }, - { - "bom-ref": "V9.2.2", - "identifier": "V9.2.2", - "text": "Token'ı alan hizmetin, token içeriğini kabul etmeden önce bu token'ın doğru türde olduğunu ve sunulma amacına uygun olduğunu doğruladığı teyit edilmelidir. Örneğin, yalnızca erişim token'ları yetkilendirme kararları için, yalnızca ID Token'lar kullanıcı kimlik doğrulamasını kanıtlamak için kullanılabilir.", - "parent": "V9.2" - }, - { - "bom-ref": "V9.2.3", - "identifier": "V9.2.3", - "text": "Hizmetin yalnızca kendisiyle kullanılması amaçlanan (audience) token'ları kabul ettiği doğrulanmalıdır. JWT'lerde bu, 'aud' claim'inin hizmet içinde tanımlı bir allowlist ile doğrulanması yoluyla sağlanabilir.", - "parent": "V9.2" - }, - { - "bom-ref": "V9.2.4", - "identifier": "V9.2.4", - "text": "Eğer bir token issuer, farklı audience'lara token oluşturmak için aynı private key'i kullanıyorsa, oluşturulan token'ların hedef audience'ları benzersiz şekilde tanımlayan bir audience kısıtlaması içerdiği doğrulanmalıdır. Bu, bir token'ın farklı bir audience ile yeniden kullanılmasını önler. Audience tanımlayıcısı dinamik olarak sağlanıyorsa, token issuer bu audience'ları doğrulamalı ve audience taklitlerinin (impersonation) önüne geçmelidir.", - "parent": "V9.2" - }, - { - "bom-ref": "V10", - "identifier": "V10", - "title": "OAuth ve OIDC" - }, - { - "bom-ref": "V10.1", - "identifier": "V10.1", - "title": "Genel OAuth ve OIDC Güvenliği", - "parent": "V10" - }, - { - "bom-ref": "V10.1.1", - "identifier": "V10.1.1", - "text": "Token'ların yalnızca kesinlikle ihtiyaç duyan bileşenlere gönderildiği doğrulanmalıdır. Örneğin, tarayıcı tabanlı JavaScript uygulamaları için bir backend-for-frontend modeli kullanıldığında, access ve refresh token'lara yalnızca backend'in erişebilmesi gerekir.", - "parent": "V10.1" - }, - { - "bom-ref": "V10.1.2", - "identifier": "V10.1.2", - "text": "Authorization server'dan gelen değerler (örneğin authorization code veya ID Token gibi) yalnızca aynı user agent oturumu ve işlemi tarafından başlatılmış bir yetkilendirme akışının sonucuysa kabul edildiği doğrulanmalıdır. Bu, client tarafından oluşturulan secret’ların 'proof key for code exchange' (PKCE) ‘code_verifier’, ‘state’ veya OIDC ‘nonce’ gibi tahmin edilemez, işleme özgü ve hem client’a hem de işlem başlatılan user agent oturumuna güvenli bir şekilde bağlı olmasını gerektirir.", - "parent": "V10.1" - }, - { - "bom-ref": "V10.2", - "identifier": "V10.2", - "title": "OAuth İstemcisi", - "parent": "V10" - }, - { - "bom-ref": "V10.2.1", - "identifier": "V10.2.1", - "text": "Code flow kullanılıyorsa, OAuth client’ın token taleplerini tetikleyen CSRF saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Bu genellikle PKCE kullanılarak veya authorization isteğinde gönderilen ‘state’ parametresinin kontrolü ile sağlanır.", - "parent": "V10.2" - }, - { - "bom-ref": "V10.2.2", - "identifier": "V10.2.2", - "text": "OAuth istemcisi birden fazla AS ile etkileşime girebiliyorsa, mix-up saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Örneğin, authorization server’ın 'iss' parametresini döndürmesi zorunlu kılınabilir ve bu parametrenin hem authorization yanıtında hem de token yanıtında doğrulanması gerekir.", - "parent": "V10.2" - }, - { - "bom-ref": "V10.2.3", - "identifier": "V10.2.3", - "text": "OAuth istemcisinin authorization server’a yaptığı taleplerde yalnızca gerekli scope’ları (veya diğer yetkilendirme parametrelerini) talep ettiği doğrulanmalıdır.", - "parent": "V10.2" - }, - { - "bom-ref": "V10.3", - "identifier": "V10.3", - "title": "OAuth Kaynak Sunucusu (RS)", - "parent": "V10" - }, - { - "bom-ref": "V10.3.1", - "identifier": "V10.3.1", - "text": "RS'nin yalnızca bu servisle kullanılmak üzere tasarlanmış access token’ları kabul ettiği doğrulanmalıdır (audience kontrolü). Audience bilgisi yapılandırılmış token’larda (örneğin JWT içindeki ‘aud’ claim’i) yer alabilir veya token introspection endpoint aracılığıyla kontrol edilebilir.", - "parent": "V10.3" - }, - { - "bom-ref": "V10.3.2", - "identifier": "V10.3.2", - "text": "RS'nin, access token’dan gelen claim’lere dayanarak yetki devri tanımına uygun şekilde yetkilendirme kararları uyguladığı doğrulanmalıdır. ‘sub’, ‘scope’ ve ‘authorization_details’ gibi claim’ler varsa, bu kararın parçası olmalıdır.", - "parent": "V10.3" - }, - { - "bom-ref": "V10.3.3", - "identifier": "V10.3.3", - "text": "Erişim kontrolü kararında, access token’dan (JWT veya ilgili token introspection yanıtı) benzersiz bir kullanıcının tanımlanması gerekiyorsa, RS'nin başka kullanıcılara devredilemeyecek claim’ler ile kullanıcıyı tanımladığı doğrulanmalıdır. Genellikle bu, ‘iss’ ve ‘sub’ claim’lerinin birlikte kullanılması anlamına gelir.", - "parent": "V10.3" - }, - { - "bom-ref": "V10.3.4", - "identifier": "V10.3.4", - "text": "RS'nin belirli bir kimlik doğrulama gücü, yöntemi veya güncelliği (recentness) gerektirmesi durumunda, sunulan access token’ın bu kısıtlamaları karşıladığını doğruladığı, örneğin, OIDC ‘acr’, ‘amr’ ve ‘auth_time’ claim’leri kullanılarak doğrulanmalıdır. ", - "parent": "V10.3" - }, - { - "bom-ref": "V10.3.5", - "identifier": "V10.3.5", - "text": "RS'nin, (yetkisiz taraflarca) çalınmış veya tekrar edilen access token’ların kullanımını önlemek için sender-constrained access token’lar kullandığı doğrulanmalıdır. Bu, OAuth 2 için Mutual TLS veya OAuth 2 Demonstration of Proof of Possession (DPoP) ile sağlanabilir.", - "parent": "V10.3" - }, - { - "bom-ref": "V10.4", - "identifier": "V10.4", - "title": "OAuth Yetkilendirme Sunucusu (AS)", - "parent": "V10" - }, - { - "bom-ref": "V10.4.1", - "identifier": "V10.4.1", - "text": "AS'nin, istemciye özel önceden kaydedilmiş URI’lerden oluşan bir allowlist kullanarak redirect URI’leri tam dize karşılaştırması ile doğruladığı doğrulanmalıdır.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.2", - "identifier": "V10.4.2", - "text": "AS'nin, \"authorization response\" içinde \"authorization code\" döndürdüğü durumlarda, bu kodun yalnızca bir kez kullanılabildiği doğrulanmalıdır. Daha önce access token vermek için kullanılmış bir authorization code ile yapılan ikinci geçerli token isteği reddedilmeli ve ilgili tüm token’lar iptal edilmelidir.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.3", - "identifier": "V10.4.3", - "text": "Authorization code’un kısa ömürlü olduğu doğrulanmalıdır. L1 ve L2 uygulamalar için maksimum yaşam süresi 10 dakika, L3 uygulamalar için 1 dakikadır.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.4", - "identifier": "V10.4.4", - "text": "Belirli bir istemci için AS'nin yalnızca o istemcinin ihtiyaç duyduğu grant türlerine izin verdiği doğrulanmalıdır. \"Token\" (Implicit flow) ve \"password\" (Resource Owner Password Credentials flow) grant türlerinin artık kullanılmaması gerekir.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.5", - "identifier": "V10.4.5", - "text": "AS'nin, açık istemciler için refresh token replay saldırılarını azalttığı doğrulanmalıdır. Tercihen sender-constrained refresh token’lar (DPoP veya mutual TLS ile certificate-bound access token’lar) kullanılmalıdır. L1 ve L2 uygulamalar için refresh token rotation kullanılabilir. Rotation kullanılıyorsa, AS refresh token’ı kullanım sonrası geçersiz kılmalı ve geçersiz bir refresh token sunulması durumunda o yetkilendirme ile ilişkili tüm refresh token’ları iptal etmelidir.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.6", - "identifier": "V10.4.6", - "text": "Code grant kullanılıyorsa, AS'nin authorization code interception saldırılarına karşı koruma sağladığı doğrulanmalıdır. Yetkilendirme isteğinde geçerli bir \"code_challenge\" değeri zorunlu olmalı ve \"code_challenge_method\" olarak \"plain\" kabul edilmemelidir. Token isteğinde ise \"code_verifier\" parametresi doğrulanmalıdır.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.7", - "identifier": "V10.4.7", - "text": "AS'nin, kimlik doğrulaması yapılmamış dinamik istemci kaydını desteklemesi durumunda, kötü niyetli istemci uygulamalarına karşı riskleri azalttığı doğrulanmalıdır. Kayıtlı URI’ler gibi client metadata’sı doğrulanmalı, kullanıcı onayı alınmalı ve güvenilmeyen bir client uygulamasıyla yapılan yetkilendirme isteği işlenmeden önce kullanıcı uyarılmalıdır.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.8", - "identifier": "V10.4.8", - "text": "Refresh token’ların, sliding expiration kullanılsa bile mutlak bir sona erme süresine sahip olduğu doğrulanmalıdır.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.9", - "identifier": "V10.4.9", - "text": "Yetkili bir kullanıcı tarafından AS kullanıcı arayüzü üzerinden refresh token’ların ve reference access token’ların iptal edilebildiği doğrulanmalıdır.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.10", - "identifier": "V10.4.10", - "text": "Gizli istemcilerin token istekleri, pushed authorization request (PAR) ve token iptal istekleri gibi server’a yapılan backchannel isteklerinde kimliğinin kontrol edildiği doğrulanmalıdır.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.11", - "identifier": "V10.4.11", - "text": "AS yapılandırmasının, OAuth istemcisine yalnızca gerekli scope’ları atadığı doğrulanmalıdır.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.12", - "identifier": "V10.4.12", - "text": "Belirli bir client için, authorization server’ın yalnızca client’ın ihtiyaç duyduğu 'response_mode' değerine izin verdiği doğrulanmalıdır. Örneğin, bu değer ya beklenenlerle karşılaştırılarak doğrulanmalı ya da PAR veya JAR kullanılmalıdır.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.13", - "identifier": "V10.4.13", - "text": "\"Code\" grant türünün daima pushed authorization request (PAR) ile birlikte kullanıldığı doğrulanmalıdır.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.14", - "identifier": "V10.4.14", - "text": "AS'nin yalnızca sender-constrained (Proof-of-Possession) access token’lar ürettiği doğrulanmalıdır. Bu, mutual TLS ile certificate-bound access token ya da DPoP ile DPoP-bound access token olabilir.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.15", - "identifier": "V10.4.15", - "text": "Sunucu taraflı istemciler için (kullanıcı cihazında çalışmayan), AS'nin \"authorization_details\" parametresinin istemci backend'i tarafından sağlandığını ve kullanıcı tarafından değiştirilmediğini doğruladığı, örneğin pushed authorization request (PAR) or JWT-secured Authorization Request (JAR) zorunlu kılınarak doğrulanmalıdır.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.4.16", - "identifier": "V10.4.16", - "text": "Bir istemci gizli ise, AS'nin güçlü istemci kimlik doğrulama yöntemlerini zorunlu kıldığı doğrulanmalıdır. Bu yöntemler, public-key cryptography’ye dayalı ve replay saldırılarına karşı dayanıklı olmalı, örneğin mutual TLS (\"tls_client_auth\", \"self_signed_tls_client_auth\") veya private key JWT (\"private_key_jwt\") gibi.", - "parent": "V10.4" - }, - { - "bom-ref": "V10.5", - "identifier": "V10.5", - "title": "OIDC İstemcisi", - "parent": "V10" - }, - { - "bom-ref": "V10.5.1", - "identifier": "V10.5.1", - "text": "İstemcinin (relying party olarak) ID Token replay saldırılarını azalttığı doğrulanmalıdır. Örneğin, ID Token’daki 'nonce' claim’inin, OpenID Provider’a gönderilen kimlik doğrulama isteğindeki 'nonce' değeriyle eşleştiği doğrulanmalıdır.", - "parent": "V10.5" - }, - { - "bom-ref": "V10.5.2", - "identifier": "V10.5.2", - "text": "İstemcinin kullanıcıyı ID Token claim’lerinden (genellikle, başka kullanıcılarla yeniden atanamayan 'sub' claim’i) benzersiz şekilde tanımladığı doğrulanmalıdır.", - "parent": "V10.5" - }, - { - "bom-ref": "V10.5.3", - "identifier": "V10.5.3", - "text": "İstemcinin, kötü niyetli bir AS'nin başka bir AS'yi taklit etmesini AS metadata’sı üzerinden reddettiği doğrulanmalıdır. AS metadata’sındaki issuer URL’si, istemci tarafından beklenen önceden yapılandırılmış issuer URL’siyle tam olarak eşleşmiyorsa, metadata reddedilmelidir.", - "parent": "V10.5" - }, - { - "bom-ref": "V10.5.4", - "identifier": "V10.5.4", - "text": "İstemcinin, ID Token’ın kendisi için (audience) kullanılması amaçlandığını doğruladığı doğrulanmalıdır. Bu, token’daki 'aud' claim’inin istemcinin 'client_id' değeriyle eşit olup olmadığının kontrol edilmesiyle yapılır.", - "parent": "V10.5" - }, - { - "bom-ref": "V10.5.5", - "identifier": "V10.5.5", - "text": "OIDC back-channel logout kullanıldığında, relying party’nin \"forced logout\" ve \"logout\" akışında \"cross-JWT confusion\" gibi saldırılara karşı koruma sağladığı doğrulanmalıdır. Client, logout token’ın 'logout+jwt' türünde olduğunu, 'event' claim’inin doğru üyeye sahip olduğunu ve 'nonce' claim’i içermediğini doğrulamalıdır. Ayrıca token için kısa bir sona erme süresi (örneğin 2 dakika) önerilir.", - "parent": "V10.5" - }, - { - "bom-ref": "V10.6", - "identifier": "V10.6", - "title": "OpenID Provider", - "parent": "V10" - }, - { - "bom-ref": "V10.6.1", - "identifier": "V10.6.1", - "text": "OpenID Provider’ın yalnızca 'code', 'ciba', 'id_token' veya 'id_token code' response mode değerlerine izin verdiği doğrulanmalıdır. 'code' değeri, 'id_token code' (OIDC Hybrid flow) yerine tercih edilmelidir. 'token' (Implicit flow) kullanılmamalıdır.", - "parent": "V10.6" - }, - { - "bom-ref": "V10.6.2", - "identifier": "V10.6.2", - "text": "OpenID Provider’ın forced logout yoluyla yapılan hizmet reddi saldırılarını önlediği doğrulanmalıdır. Bu, son kullanıcıdan açık onay alınarak veya varsa logout isteğinde (relying party tarafından başlatılan) bulunan parametrelerin, örneğin 'id_token_hint', doğrulanmasıyla yapılabilir.", - "parent": "V10.6" - }, - { - "bom-ref": "V10.7", - "identifier": "V10.7", - "title": "Onay (Consent) Yönetimi", - "parent": "V10" - }, - { - "bom-ref": "V10.7.1", - "identifier": "V10.7.1", - "text": "AS'nin her yetkilendirme isteği için kullanıcının onayını aldığı doğrulanmalıdır. İstemcinin kimliği garanti altına alınamıyorsa, AS daima kullanıcıdan açıkça onay istemelidir.", - "parent": "V10.7" - }, - { - "bom-ref": "V10.7.2", - "identifier": "V10.7.2", - "text": "AS'nin kullanıcıdan onay istediğinde, neye onay verildiğini açık ve yeterli şekilde gösterdiği doğrulanmalıdır. Uygun olduğunda bu bilgiler, istenen yetkilendirmelerin doğasını (genellikle scope, resource server, RAR gibi detaylara dayalı), yetkilendirilmiş uygulamanın kimliğini ve bu yetkilendirmelerin süresini içermelidir.", - "parent": "V10.7" - }, - { - "bom-ref": "V10.7.3", - "identifier": "V10.7.3", - "text": "Kullanıcının, AS üzerinden verdiği onayları görüntüleyebildiği, değiştirebildiği ve iptal edebildiği doğrulanmalıdır.", - "parent": "V10.7" - }, - { - "bom-ref": "V11", - "identifier": "V11", - "title": "Kriptografi" - }, - { - "bom-ref": "V11.1", - "identifier": "V11.1", - "title": "Kriptografik Envanter ve Dokümantasyon", - "parent": "V11" - }, - { - "bom-ref": "V11.1.1", - "identifier": "V11.1.1", - "text": "Kriptografik anahtarların yönetimi için belgelenmiş bir politika ve NIST SP 800-57 gibi bir anahtar yönetim standardını izleyen bir kriptografik anahtar yaşam döngüsü tanımlandığı doğrulanmalıdır. Bu, anahtarların aşırı miktarda paylaşılmadığını (örneğin, paylaşılan sırlar için ikiden fazla tarafla veya özel anahtarlar için birden fazla tarafla) garanti altına almalıdır.", - "parent": "V11.1" - }, - { - "bom-ref": "V11.1.2", - "identifier": "V11.1.2", - "text": "Tüm kriptografik anahtarlar, algoritmalar ve uygulama tarafından kullanılan sertifikaları içeren bir kriptografik envanterin oluşturulduğu, sürdürüldüğü ve düzenli olarak güncellendiği doğrulanmalıdır. Bu envanter ayrıca, sistemde anahtarların nerede kullanılabileceğini ve kullanılamayacağını, ve hangi veri türlerinin bu anahtarlarla korunup korunamayacağını da belgelemelidir.", - "parent": "V11.1" - }, - { - "bom-ref": "V11.1.3", - "identifier": "V11.1.3", - "text": "Sistem içerisinde şifreleme, özetleme ve imzalama işlemleri dahil olmak üzere kriptografi kullanımının tüm örneklerini tespit etmek için kriptografik keşif mekanizmalarının kullanıldığı doğrulanmalıdır.", - "parent": "V11.1" - }, - { - "bom-ref": "V11.1.4", - "identifier": "V11.1.4", - "text": "Kriptografik bir envanterin sürdürüldüğü doğrulanmalıdır. Bu envanter, gelecekteki tehditlere karşı tepki verebilmek amacıyla post-kuantum kriptografiye geçiş yolunu belirten belgelenmiş bir plan içermelidir.", - "parent": "V11.1" - }, - { - "bom-ref": "V11.2", - "identifier": "V11.2", - "title": "Güvenli Kriptografi Uygulaması", - "parent": "V11" - }, - { - "bom-ref": "V11.2.1", - "identifier": "V11.2.1", - "text": "Kriptografik işlemler için sektör tarafından doğrulanmış uygulamaların (kütüphaneler ve donanım hızlandırmalı uygulamalar dahil) kullanıldığı doğrulanmalıdır.", - "parent": "V11.2" - }, - { - "bom-ref": "V11.2.2", - "identifier": "V11.2.2", - "text": "Uygulamanın, rastgele sayı üreticileri, kimliği doğrulanmış şifreleme, MAC veya özetleme algoritmaları, anahtar uzunlukları, turlar, şifreler ve modların herhangi bir zamanda yeniden yapılandırılabilir, yükseltilebilir veya değiştirilebilir olacağı şekilde kripto çevikliği (crypto agility) ile tasarlandığı doğrulanmalıdır. Aynı şekilde, anahtarların ve parolaların değiştirilebilmesi ve verilerin yeniden şifrelenebilmesi mümkün olmalıdır. Bu, onaylanmış PQC şemalarının yüksek güvenlikli uygulamaları yaygın olarak kullanılabilir hale geldiğinde sorunsuz geçişe olanak tanır.", - "parent": "V11.2" - }, - { - "bom-ref": "V11.2.3", - "identifier": "V11.2.3", - "text": "Tüm kriptografik ilkeliklerin, algoritma, anahtar boyutu ve yapılandırmaya göre minimum 128 bit güvenlik sağladığı doğrulanmalıdır. Örneğin, 256-bit ECC anahtarı yaklaşık 128 bit güvenlik sağlarken, RSA için aynı güvenliği elde etmek 3072-bit anahtar gerektirir.", - "parent": "V11.2" - }, - { - "bom-ref": "V11.2.4", - "identifier": "V11.2.4", - "text": "Tüm kriptografik işlemlerin sabit süreli (constant-time) olduğu, karşılaştırmalarda, hesaplamalarda veya geri dönüşlerde kısa devre (short-circuit) işlemleri yapılmadığı doğrulanmalıdır; bu, bilgi sızıntısını önlemek için gereklidir.", - "parent": "V11.2" - }, - { - "bom-ref": "V11.2.5", - "identifier": "V11.2.5", - "text": "Tüm kriptografik modüllerin güvenli şekilde hata verdiği ve hataların, padding oracle saldırıları gibi zafiyetleri mümkün kılmayacak şekilde ele alındığı doğrulanmalıdır.", - "parent": "V11.2" - }, - { - "bom-ref": "V11.3", - "identifier": "V11.3", - "title": "Şifreleme Algoritmaları", - "parent": "V11" - }, - { - "bom-ref": "V11.3.1", - "identifier": "V11.3.1", - "text": "Güvensiz blok modlarının (örneğin, ECB) ve zayıf doldurma (padding) şemalarının (örneğin, PKCS#1 v1.5) kullanılmadığı doğrulanmalıdır.", - "parent": "V11.3" - }, - { - "bom-ref": "V11.3.2", - "identifier": "V11.3.2", - "text": "Yalnızca AES ile GCM gibi onaylı şifreleme algoritmalarının ve modlarının kullanıldığı doğrulanmalıdır.", - "parent": "V11.3" - }, - { - "bom-ref": "V11.3.3", - "identifier": "V11.3.3", - "text": "Şifrelenmiş verilerin yetkisiz değişikliklere karşı korunduğu doğrulanmalıdır. Tercihen bu koruma, onaylı bir kimliği doğrulanmış şifreleme yöntemi kullanılarak ya da onaylı bir şifreleme yöntemi ile onaylı bir MAC algoritmasının kombinasyonu ile sağlanmalıdır.", - "parent": "V11.3" - }, - { - "bom-ref": "V11.3.4", - "identifier": "V11.3.4", - "text": "Sayılar, başlatma vektörleri (IV) ve diğer tek kullanımlık değerlerin, aynı şifreleme anahtarı ve veri öğesi çifti için birden fazla kez kullanılmadığı doğrulanmalıdır. Oluşturma yöntemi kullanılan algoritmaya uygun olmalıdır.", - "parent": "V11.3" - }, - { - "bom-ref": "V11.3.5", - "identifier": "V11.3.5", - "text": "Şifreleme algoritması ve MAC algoritması kombinasyonlarının \"encrypt-then-MAC\" modunda çalıştığı doğrulanmalıdır.", - "parent": "V11.3" - }, - { - "bom-ref": "V11.4", - "identifier": "V11.4", - "title": "Hashing ve Hash Tabanlı Fonksiyonlar", - "parent": "V11" - }, - { - "bom-ref": "V11.4.1", - "identifier": "V11.4.1", - "text": "Dijital imzalar, HMAC, KDF ve rastgele bit üretimi gibi genel kriptografik kullanım senaryolarında yalnızca onaylı hash fonksiyonlarının kullanıldığı doğrulanmalıdır. MD5 gibi yasaklı hash fonksiyonları hiçbir kriptografik amaçla kullanılmamalıdır.", - "parent": "V11.4" - }, - { - "bom-ref": "V11.4.2", - "identifier": "V11.4.2", - "text": "Parolaların, onaylı, hesaplama açısından yoğun ve mevcut rehberliğe göre yapılandırılmış bir anahtar türetme fonksiyonu (diğer adıyla parola hash'leme fonksiyonu) kullanılarak saklandığı doğrulanmalıdır. Ayarlar, güvenlik ve performans dengesini sağlayarak kaba kuvvet saldırılarını zorlaştırmalıdır.", - "parent": "V11.4" - }, - { - "bom-ref": "V11.4.3", - "identifier": "V11.4.3", - "text": "Dijital imzalarda kullanılan hash fonksiyonlarının, veri bütünlüğü ve kimlik doğrulama amacıyla kullanıldığında çakışmaya karşı dayanıklı ve yeterli bit uzunluğuna sahip olduğu doğrulanmalıdır. Çakışma dayanıklılığı gerekiyorsa çıktı uzunluğu en az 256 bit olmalıdır. Sadece ikinci ön-görüntü (2nd pre-iamge) saldırılarına karşı dayanıklılık gerekiyorsa çıktı uzunluğu en az 128 bit olmalıdır.", - "parent": "V11.4" - }, - { - "bom-ref": "V11.4.4", - "identifier": "V11.4.4", - "text": "Parolalardan gizli anahtarlar türetilirken, onaylı anahtar türetme fonksiyonlarının anahtar uzatma (key stretching) parametreleriyle birlikte kullanıldığı doğrulanmalıdır. Bu parametreler, kaba kuvvet saldırılarını önleyecek şekilde güvenlik ve performans dengesine sahip olmalıdır.", - "parent": "V11.4" - }, - { - "bom-ref": "V11.5", - "identifier": "V11.5", - "title": "Rastgele Değerler", - "parent": "V11" - }, - { - "bom-ref": "V11.5.1", - "identifier": "V11.5.1", - "text": "Tahmin edilemez olması amaçlanan tüm rastgele sayıların ve dizelerin, CSPRNG ile oluşturulduğu ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. UUID'lerin bu koşulu dikkate almadığını unutmayın.", - "parent": "V11.5" - }, - { - "bom-ref": "V11.5.2", - "identifier": "V11.5.2", - "text": "Kullanılan rastgele sayı üretim mekanizmasının, yoğun talep altında dahi güvenli çalışacak şekilde tasarlandığı doğrulanmalıdır.", - "parent": "V11.5" - }, - { - "bom-ref": "V11.6", - "identifier": "V11.6", - "title": "Açık Anahtar (Public Key) Kriptografisi", - "parent": "V11" - }, - { - "bom-ref": "V11.6.1", - "identifier": "V11.6.1", - "text": "Anahtar üretimi, tohumlama (seeding) ve dijital imza üretimi ve doğrulama için yalnızca onaylı kriptografik algoritmalar ve çalışma modlarının kullanıldığı doğrulanmalıdır. Anahtar üretim algoritmaları, bilinen saldırılara karşı savunmasız anahtarlar üretmemelidir. Örneğin, Fermat çarpanlama yöntemine karşı savunmasız RSA anahtarları oluşturulmamalıdır.", - "parent": "V11.6" - }, - { - "bom-ref": "V11.6.2", - "identifier": "V11.6.2", - "text": "Anahtar değişimi için yalnızca onaylı kriptografik algoritmaların kullanıldığı doğrulanmalıdır (örneğin Diffie-Hellman). Kullanılan parametrelerin güvenli olması gerektiğine dikkat edilmelidir. Bu, anahtar kurulum sürecine yönelik saldırıları önleyecek ve araya girme (adversary-in-the-middle) ya da kriptografik kırılmaları engelleyecektir.", - "parent": "V11.6" - }, - { - "bom-ref": "V11.7", - "identifier": "V11.7", - "title": "Kullanım Halindeki Verilerin Kriptografisi", - "parent": "V11" - }, - { - "bom-ref": "V11.7.1", - "identifier": "V11.7.1", - "text": "Hassas verilerin kullanım sırasında korunmasını sağlamak amacıyla, yetkisiz kullanıcıların veya süreçlerin bu verilere erişmesini engelleyen tam bellek şifrelemesinin kullanıldığı doğrulanmalıdır.", - "parent": "V11.7" - }, - { - "bom-ref": "V11.7.2", - "identifier": "V11.7.2", - "text": "Veri asgariyetinin sağlandığı, yani işleme sırasında mümkün olan en az miktarda verinin ortaya çıktığı ve verilerin kullanımdan hemen sonra veya mümkün olan en kısa sürede şifrelendiği doğrulanmalıdır.", - "parent": "V11.7" - }, - { - "bom-ref": "V12", - "identifier": "V12", - "title": "Güvenli İletişim" - }, - { - "bom-ref": "V12.1", - "identifier": "V12.1", - "title": "Genel TLS Güvenlik Rehberi", - "parent": "V12" - }, - { - "bom-ref": "V12.1.1", - "identifier": "V12.1.1", - "text": "Yalnızca TLS protokolünün en güncel ve önerilen sürümlerinin (örneğin TLS 1.2 ve TLS 1.3) etkinleştirildiği ve en son sürümün varsayılan olarak tercih edildiği doğrulanmalıdır.", - "parent": "V12.1" - }, - { - "bom-ref": "V12.1.2", - "identifier": "V12.1.2", - "text": "Yalnızca önerilen şifre takımlarının (cipher suite) etkinleştirildiği ve en güçlü şifre takımlarının tercih edildiği doğrulanmalıdır. Seviye 3 (L3) uygulamalar yalnızca ileri gizlilik (forward secrecy) sağlayan şifre takımlarını desteklemelidir.", - "parent": "V12.1" - }, - { - "bom-ref": "V12.1.3", - "identifier": "V12.1.3", - "text": "Uygulamanın, mTLS istemci sertifikalarını kimlik doğrulama veya yetkilendirme amacıyla kullanmadan önce bu sertifikaların güvendiği sertifikalar arasında olduğunu doğruladığı kontrol edilmelidir.", - "parent": "V12.1" - }, - { - "bom-ref": "V12.1.4", - "identifier": "V12.1.4", - "text": "Online Certificate Status Protocol (OCSP) Stapling gibi geçerli bir sertifika iptal kontrolü yönteminin etkinleştirildiği ve yapılandırıldığı doğrulanmalıdır.", - "parent": "V12.1" - }, - { - "bom-ref": "V12.1.5", - "identifier": "V12.1.5", - "text": "TLS el sıkışma (handshake) sürecinde Server Name Indication (SNI) gibi hassas meta verilerin ifşa edilmesini önlemek için, uygulamanın TLS yapılandırmasında Encrypted Client Hello (ECH) özelliğinin etkinleştirildiği doğrulanmalıdır.", - "parent": "V12.1" - }, - { - "bom-ref": "V12.2", - "identifier": "V12.2", - "title": "Dışa Açık Hizmetlerle HTTPS İletişimi", - "parent": "V12" - }, - { - "bom-ref": "V12.2.1", - "identifier": "V12.2.1", - "text": "İstemci ile dışa açık, HTTP tabanlı hizmetler arasındaki tüm bağlantılarda TLS kullanıldığı ve bu bağlantıların güvensiz ya da şifrelenmemiş iletişime geri dönmediği doğrulanmalıdır.", - "parent": "V12.2" - }, - { - "bom-ref": "V12.2.2", - "identifier": "V12.2.2", - "text": "Dışa açık hizmetlerin herkese açık olarak güvenilen TLS sertifikaları kullandığı doğrulanmalıdır.", - "parent": "V12.2" - }, - { - "bom-ref": "V12.3", - "identifier": "V12.3", - "title": "Genel Servisler Arası İletişim Güvenliği", - "parent": "V12" - }, - { - "bom-ref": "V12.3.1", - "identifier": "V12.3.1", - "text": "Uygulamaya gelen ve uygulamadan çıkan tüm bağlantılarda izleme sistemleri, yönetim araçları, uzaktan erişim ve SSH, ara yazılımlar, veritabanları, ana sistemler (mainframe), iş ortağı sistemleri ya da dış API'ler dahil olmak üzere TLS gibi şifreli bir protokolün kullanıldığı ve güvensiz ya da şifrelenmemiş protokollere geri dönülmediği doğrulanmalıdır.", - "parent": "V12.3" - }, - { - "bom-ref": "V12.3.2", - "identifier": "V12.3.2", - "text": "TLS istemcilerinin bir TLS sunucusu ile iletişime geçmeden önce alınan sertifikaları doğruladığı kontrol edilmelidir.", - "parent": "V12.3" - }, - { - "bom-ref": "V12.3.3", - "identifier": "V12.3.3", - "text": "Uygulama içindeki HTTP tabanlı iç hizmetler arasında gerçekleşen tüm bağlantılarda TLS ya da uygun başka bir aktarım şifreleme mekanizmasının kullanıldığı ve güvensiz ya da şifrelenmemiş iletişime geri dönülmediği doğrulanmalıdır.", - "parent": "V12.3" - }, - { - "bom-ref": "V12.3.4", - "identifier": "V12.3.4", - "text": "İç hizmetler arasındaki TLS bağlantılarında güvenilir sertifikaların kullanıldığı doğrulanmalıdır. İç sistemlerde oluşturulmuş ya da kendinden imzalı (self-signed) sertifikalar kullanılıyorsa, bu sertifikalara güvenen hizmetlerin yalnızca belirli dahili sertifika otoritelerine (CA) ve belirli kendinden imzalı sertifikalara güvenecek şekilde yapılandırıldıkları doğrulanmalıdır.", - "parent": "V12.3" - }, - { - "bom-ref": "V12.3.5", - "identifier": "V12.3.5", - "text": "Sistem içindeki hizmetlerin birbiriyle iletişim kurarken her bir uç noktanın kimliğini doğrulamak için güçlü kimlik doğrulama yöntemlerinin kullanıldığı doğrulanmalıdır. Bu yöntemler arasında, açık anahtar altyapısı (public-key infrastructure) kullanan ve tekrar oynatma saldırılarına karşı dayanıklı olan TLS istemci kimlik doğrulaması gibi yöntemler yer almalıdır. Mikroservis mimarilerinde, sertifika yönetimini basitleştirmek ve güvenliği artırmak amacıyla bir servis ağı (service mesh) kullanılması değerlendirilmelidir.", - "parent": "V12.3" - }, - { - "bom-ref": "V13", - "identifier": "V13", - "title": "Konfigürasyon" - }, - { - "bom-ref": "V13.1", - "identifier": "V13.1", - "title": "Konfigürasyon Dokümantasyonu", - "parent": "V13" - }, - { - "bom-ref": "V13.1.1", - "identifier": "V13.1.1", - "text": "Uygulamanın tüm iletişim ihtiyaçlarının dokümante edildiği doğrulanmalıdır. Buna, uygulamanın bağımlı olduğu dış hizmetler ve son kullanıcının uygulamanın bağlantı kurmasını sağlayabileceği dış konumlar da dahil olmalıdır.", - "parent": "V13.1" - }, - { - "bom-ref": "V13.1.2", - "identifier": "V13.1.2", - "text": "Uygulamanın kullandığı her bir hizmet için, dokümantasyonda eşzamanlı bağlantı sayısı (örn. bağlantı havuzu limitleri) ve bu sınır aşıldığında uygulamanın davranışı, geri dönüş veya kurtarma mekanizmaları da dahil olmak üzere hizmet reddi koşullarını önlemek için tanımlandığı doğrulanmalıdır.", - "parent": "V13.1" - }, - { - "bom-ref": "V13.1.3", - "identifier": "V13.1.3", - "text": "Uygulamanın, kullandığı her bir dış sistem veya hizmet (örn. veritabanları, dosya tanıtıcıları, iş parçacıkları, HTTP bağlantıları) için kaynak yönetimi stratejilerini tanımladığı doğrulanmalıdır. Bu stratejiler, kaynak serbest bırakma prosedürlerini, zaman aşımı ayarlarını, hata durumlarını ve tekrar deneme mantığı uygulanmışsa sınırları, gecikmeleri ve geri çekilme (back-off) algoritmalarını içermelidir. Senkron HTTP istek–yanıt işlemleri için kısa zaman aşımı süreleri zorunlu tutulmalı ve tekrar eden denemeler devre dışı bırakılmalı ya da sıkı şekilde sınırlandırılmalıdır.", - "parent": "V13.1" - }, - { - "bom-ref": "V13.1.4", - "identifier": "V13.1.4", - "text": "Uygulamanın, güvenlik açısından kritik olan gizli verileri tanımladığı ve kuruluşun tehdit modeli ve iş ihtiyaçlarına göre bu verilerin döndürülme (rotation) zamanlamasının belgelendiği doğrulanmalıdır.", - "parent": "V13.1" - }, - { - "bom-ref": "V13.2", - "identifier": "V13.2", - "title": "Backend İletişim Konfigürasyonu", - "parent": "V13" - }, - { - "bom-ref": "V13.2.1", - "identifier": "V13.2.1", - "text": "Uygulamanın, standart kullanıcı oturum mekanizmasını desteklemeyen backend bileşenleri (örneğin API'ler, ara katmanlar, veri katmanları) arasında gerçekleşen iletişimlerin kimlik doğrulamasıyla korunduğu doğrulanmalıdır. Kimlik doğrulama; bireysel hizmet hesapları, kısa ömürlü token'lar ya da sertifika tabanlı kimlik doğrulama ile yapılmalıdır ve parola, API anahtarı ya da ayrıcalıklı erişime sahip paylaşımlı hesaplar gibi sabit kimlik bilgileri kullanılmamalıdır.", - "parent": "V13.2" - }, - { - "bom-ref": "V13.2.2", - "identifier": "V13.2.2", - "text": "Uygulamanın backend bileşenleri arasında (yerel hizmetler, işletim sistemi hizmetleri, API'ler, ara katmanlar ve veri katmanları dahil) gerçekleştirilen iletişimlerin, yalnızca gerekli en az ayrıcalığa sahip hesaplarla yapıldığı doğrulanmalıdır.", - "parent": "V13.2" - }, - { - "bom-ref": "V13.2.3", - "identifier": "V13.2.3", - "text": "Bir hizmet kimlik doğrulaması için bir kimlik bilgisi kullanılması gerekiyorsa, bu kimlik bilgisinin varsayılan bir değer (örneğin root/root veya admin/admin) olmadığının doğrulanması gereklidir.", - "parent": "V13.2" - }, - { - "bom-ref": "V13.2.4", - "identifier": "V13.2.4", - "text": "Uygulamanın iletişim kurmasına izin verilen dış kaynaklar ya da sistemlerin, bir allowlist (izinli liste) ile tanımlandığı doğrulanmalıdır. Bu liste, uygulama katmanında, web sunucusunda, güvenlik duvarında veya farklı katmanların birleşiminde uygulanabilir.", - "parent": "V13.2" - }, - { - "bom-ref": "V13.2.5", - "identifier": "V13.2.5", - "text": "Web veya uygulama sunucusunun, dış sistemlere veri veya dosya gönderimi veya yüklemesi yaparken sadece belirli kaynaklara izin verecek şekilde allowlist ile yapılandırıldığı doğrulanmalıdır.", - "parent": "V13.2" - }, - { - "bom-ref": "V13.2.6", - "identifier": "V13.2.6", - "text": "Uygulamanın farklı hizmetlere bağlantı kurduğu durumlarda, bu bağlantılar için belgelenmiş yapılandırmaları (örn. maksimum eşzamanlı bağlantı, bağlantı limiti aşıldığında davranış, zaman aşımı, tekrar deneme stratejileri) takip ettiğinin doğrulanması gereklidir.", - "parent": "V13.2" - }, - { - "bom-ref": "V13.3", - "identifier": "V13.3", - "title": "Gizli Bilgi Yönetimi", - "parent": "V13" - }, - { - "bom-ref": "V13.3.1", - "identifier": "V13.3.1", - "text": "Parolalar, anahtar materyalleri, veritabanı ve üçüncü parti sistemlerle entegrasyon bilgileri, zaman tabanlı token'lar için tohum (seed) bilgileri, dahili gizli veriler ve API anahtarları gibi backend sırlarının güvenli bir şekilde oluşturulması, saklanması, erişim denetiminin sağlanması ve imha edilmesi için bir gizli bilgi yönetim çözümünün (örneğin key vault) kullanıldığı doğrulanmalıdır. Bu gizli bilgiler uygulama kaynak koduna dahil edilmemeli ve yapı çıktılarında yer almamalıdır. Seviye 3 uygulamalar için donanım destekli bir çözüm (örneğin HSM) gereklidir.", - "parent": "V13.3" - }, - { - "bom-ref": "V13.3.2", - "identifier": "V13.3.2", - "text": "Gizli bilgilere erişimin en az ayrıcalık prensibine uygun şekilde yapılandırıldığı doğrulanmalıdır.", - "parent": "V13.3" - }, - { - "bom-ref": "V13.3.3", - "identifier": "V13.3.3", - "text": "Tüm kriptografik işlemlerin, anahtar materyallerinin güvenli bir şekilde yönetilmesi ve dışarıya sızmasının engellenmesi amacıyla, izole edilmiş bir güvenlik modülü (örneğin vault ya da donanım güvenlik modülü) aracılığıyla gerçekleştirildiği doğrulanmalıdır.", - "parent": "V13.3" - }, - { - "bom-ref": "V13.3.4", - "identifier": "V13.3.4", - "text": "Uygulamanın belgelerinde belirtildiği şekilde gizli bilgilerin süresinin dolacak şekilde yapılandırıldığı ve düzenli olarak döndürüldüğü doğrulanmalıdır.", - "parent": "V13.3" - }, - { - "bom-ref": "V13.4", - "identifier": "V13.4", - "title": "İstenmeyen Bilgi Sızıntısı", - "parent": "V13" - }, - { - "bom-ref": "V13.4.1", - "identifier": "V13.4.1", - "text": "Uygulamanın .git veya .svn klasörleri gibi kaynak kontrolüyle ilgili metadata içermeyecek şekilde deploy edildiğini ya da bu klasörlerin hem dış erişime hem de uygulama erişimine kapalı olduğu doğrulanmalıdır.", - "parent": "V13.4" - }, - { - "bom-ref": "V13.4.2", - "identifier": "V13.4.2", - "text": "Tüm bileşenler için üretim ortamlarında hata ayıklama (debug) modlarının devre dışı bırakıldığı doğrulanmalıdır.", - "parent": "V13.4" - }, - { - "bom-ref": "V13.4.3", - "identifier": "V13.4.3", - "text": "Web sunucularının, açık şekilde istenmediği sürece dizin listelemesi (directory listing) özelliğini istemcilere sunmadığı doğrulanmalıdır.", - "parent": "V13.4" - }, - { - "bom-ref": "V13.4.4", - "identifier": "V13.4.4", - "text": "HTTP TRACE metodunun üretim ortamlarında desteklenmediği, böylece potansiyel bilgi sızıntılarının önlendiği doğrulanmalıdır.", - "parent": "V13.4" - }, - { - "bom-ref": "V13.4.5", - "identifier": "V13.4.5", - "text": "Belgeler (örneğin dahili API belgeleri) ve izleme uç noktalarının (monitoring endpoints) yalnızca açıkça belirtildiği durumlarda erişilebilir olduğu doğrulanmalıdır.", - "parent": "V13.4" - }, - { - "bom-ref": "V13.4.6", - "identifier": "V13.4.6", - "text": "Uygulamanın arka uç bileşenlerinin ayrıntılı sürüm bilgilerini ifşa etmediği doğrulanmalıdır.", - "parent": "V13.4" - }, - { - "bom-ref": "V13.4.7", - "identifier": "V13.4.7", - "text": "Web katmanının yalnızca belirli dosya uzantılarına sahip dosyaları sunacak şekilde yapılandırıldığı, bu sayede istem dışı bilgi, yapılandırma ya da kaynak kod sızıntılarının önlendiği doğrulanmalıdır.", - "parent": "V13.4" - }, - { - "bom-ref": "V14", - "identifier": "V14", - "title": "Veri Koruma" - }, - { - "bom-ref": "V14.1", - "identifier": "V14.1", - "title": "Veri Koruma Dokümantasyonu", - "parent": "V14" - }, - { - "bom-ref": "V14.1.1", - "identifier": "V14.1.1", - "text": "Uygulama tarafından oluşturulan ve işlenen tüm hassas verilerin tanımlanıp, koruma seviyelerine göre sınıflandırıldığından emin olun. Bu, yalnızca kodlanmış (örneğin Base64 stringleri ya da JWT içindeki düz metin yükler gibi) ve bu nedenle kolayca çözülebilir verileri de içermelidir. Koruma seviyeleri, uygulamanın uymakla yükümlü olduğu veri koruma ve gizlilik düzenlemeleri ile standartlarını dikkate almalıdır.", - "parent": "V14.1" - }, - { - "bom-ref": "V14.1.2", - "identifier": "V14.1.2", - "text": "Tüm hassas veri koruma seviyeleri için belgelenmiş bir koruma gereksinimleri seti tanımlandığından emin olun. Bu gereksinimler genel şifreleme, bütünlük doğrulama, saklama süresi, verinin nasıl günlüğe kaydedileceği, günlüklerdeki hassas verilere erişim kontrolleri, veritabanı düzeyinde şifreleme, gizlilik ve gizliliği artırıcı teknolojiler ile diğer gizlilik gereksinimlerini kapsamalıdır.", - "parent": "V14.1" - }, - { - "bom-ref": "V14.2", - "identifier": "V14.2", - "title": "Genel Veri Koruması", - "parent": "V14" - }, - { - "bom-ref": "V14.2.1", - "identifier": "V14.2.1", - "text": "Hassas verilerin yalnızca HTTP message body veya header alanlarında sunucuya gönderildiği ve URL ile sorgu parametrelerinin, API anahtarı veya session token’ı gibi hassas bilgiler içermediği doğrulanmalıdır.", - "parent": "V14.2" - }, - { - "bom-ref": "V14.2.2", - "identifier": "V14.2.2", - "text": "Hassas verilerin, yük dengeleyiciler ve uygulama önbellekleri gibi sunucu bileşenlerinde önbelleğe alınmasının engellendiği veya kullanım sonrası bu verilerin güvenli biçimde temizlendiği doğrulanmalıdır.", - "parent": "V14.2" - }, - { - "bom-ref": "V14.2.3", - "identifier": "V14.2.3", - "text": "Uygulama kontrolü dışında veri toplanmasını engellemek için, tanımlanmış hassas verilerin, kullanıcı izleyicileri gibi güvensiz taraflara gönderilmediği doğrulanmalıdır.", - "parent": "V14.2" - }, - { - "bom-ref": "V14.2.4", - "identifier": "V14.2.4", - "text": "Hassas verilere yönelik şifreleme, bütünlük doğrulama, veri saklama, loglama yöntemi, loglardaki erişim kontrolleri, gizlilik teknolojileri gibi kontrollerin, söz konusu verinin belgelenmiş koruma seviyesinde tanımlandığı şekilde uygulandığı doğrulanmalıdır.", - "parent": "V14.2" - }, - { - "bom-ref": "V14.2.5", - "identifier": "V14.2.5", - "text": "Önbellekleme mekanizmalarının yalnızca belirli içerik türüne sahip yanıtları önbelleğe alacak şekilde yapılandırıldığı ve hassas, dinamik içeriklerin önbelleğe alınmadığı doğrulanmalıdır. Web sunucusu, mevcut olmayan bir dosya talebinde geçerli ama farklı bir dosya döndürmek yerine 404 veya 302 cevabı vermelidir. Bu, Web Cache Deception saldırılarını önlemeye yardımcı olur.", - "parent": "V14.2" - }, - { - "bom-ref": "V14.2.6", - "identifier": "V14.2.6", - "text": "Uygulamanın yalnızca işlevsellik için gerekli olan asgari hassas veriyi döndürdüğü doğrulanmalıdır. Örneğin, kredi kartı numarasının yalnızca bazı rakamlarının döndürülmesi; tam numaranın döndürülmesi gerekiyorsa, kullanıcı arayüzünde gizlenmiş (maskelenmiş) şekilde sunulması gerekir, aksi kullanıcı özel olarak görüntülemek istemedikçe gösterilmemelidir.", - "parent": "V14.2" - }, - { - "bom-ref": "V14.2.7", - "identifier": "V14.2.7", - "text": "Hassas bilgilerin, veri saklama sınıflandırmasına tabi tutulduğu, geçerliliğini yitirmiş veya artık gerekli olmayan verilerin belirlenmiş bir zaman çizelgesiyle ya da gerektiğinde otomatik olarak silindiği doğrulanmalıdır.", - "parent": "V14.2" - }, - { - "bom-ref": "V14.2.8", - "identifier": "V14.2.8", - "text": "Kullanıcı tarafından yüklenen dosyaların meta verilerinden hassas bilgilerin çıkarıldığı veya bu bilgilerin yalnızca kullanıcıdan açık onay alındığında saklandığı doğrulanmalıdır.", - "parent": "V14.2" - }, - { - "bom-ref": "V14.3", - "identifier": "V14.3", - "title": "İstemci Tarafı Veri Koruması", - "parent": "V14" - }, - { - "bom-ref": "V14.3.1", - "identifier": "V14.3.1", - "text": "Kimliği doğrulanmış verilerin, istemci veya oturum sonlandığında istemci depolamasından (örneğin tarayıcı DOM’undan) temizlendiği doğrulanmalıdır. 'Clear-Site-Data' HTTP response header bu konuda yardımcı olabilir ancak istemci tarafı, sunucu bağlantısı mevcut olmadığında da temizlik işlemini yapabiliyor olmalıdır.", - "parent": "V14.3" - }, - { - "bom-ref": "V14.3.2", - "identifier": "V14.3.2", - "text": "Uygulamanın, tarayıcılarda hassas verilerin önbelleğe alınmasını önlemek amacıyla yeterli anti-önbellekleme HTTP response header (örneğin Cache-Control: no-store) ayarladığı doğrulanmalıdır.", - "parent": "V14.3" - }, - { - "bom-ref": "V14.3.3", - "identifier": "V14.3.3", - "text": "Tarayıcıda depolanan verilerin (örneğin localStorage, sessionStorage, IndexedDB veya çerezler) hassas veri içermediği, yalnızca session token’larının istisna olarak kabul edildiği doğrulanmalıdır.", - "parent": "V14.3" - }, - { - "bom-ref": "V15", - "identifier": "V15", - "title": "Güvenli Kodlama ve Mimari" - }, - { - "bom-ref": "V15.1", - "identifier": "V15.1", - "title": "Güvenli Kodlama ve Mimari Dokümantasyonu", - "parent": "V15" - }, - { - "bom-ref": "V15.1.1", - "identifier": "V15.1.1", - "text": "Güvenlik açığı içeren üçüncü taraf bileşen sürümleri ve genel olarak kütüphane güncellemeleri için, uygulama dokümantasyonunda risk bazlı düzeltme zamanlarının tanımlandığı doğrulanmalıdır.", - "parent": "V15.1" - }, - { - "bom-ref": "V15.1.2", - "identifier": "V15.1.2", - "text": "Yazılım bileşen listesi (Software Bill of Materials - SBOM) gibi bir envanterin tutulduğu, kullanılan tüm üçüncü taraf kütüphanelerin önceden tanımlanmış, güvenilir ve düzenli olarak güncellenen depolardan alındığı doğrulanmalıdır.", - "parent": "V15.1" - }, - { - "bom-ref": "V15.1.3", - "identifier": "V15.1.3", - "text": "Uygulama dokümantasyonunda zaman veya kaynak açısından yoğun işlevlerin tanımlandığı, bu işlevlerin aşırı kullanımı durumunda kullanılabilirlik kaybının nasıl önleneceği ve yanıt oluşturma süresinin istemci zaman aşımını aşmaması için hangi önlemlerin alındığı belirtilmelidir. Örnek savunmalar kuyruklama, eşzamansız işleme, kullanıcı başına ve uygulama genelinde paralel işlem sınırlarını içerebilir.", - "parent": "V15.1" - }, - { - "bom-ref": "V15.1.4", - "identifier": "V15.1.4", - "text": "Uygulama dokümantasyonunda \"riskli bileşenler\" olarak değerlendirilen üçüncü taraf kütüphanelerin vurgulandığı doğrulanmalıdır.", - "parent": "V15.1" - }, - { - "bom-ref": "V15.1.5", - "identifier": "V15.1.5", - "text": "Uygulama dokümantasyonunda \"tehlikeli işlevsellik\" içeren uygulama bölümlerinin açıkça belirtildiği doğrulanmalıdır.", - "parent": "V15.1" - }, - { - "bom-ref": "V15.2", - "identifier": "V15.2", - "title": "Güvenlik Mimarisi ve Bağımlılıklar", - "parent": "V15" - }, - { - "bom-ref": "V15.2.1", - "identifier": "V15.2.1", - "text": "Uygulamanın yalnızca, belgelenmiş güncelleme ve düzeltme sürelerini aşmamış bileşenleri içerdiği doğrulanmalıdır.", - "parent": "V15.2" - }, - { - "bom-ref": "V15.2.2", - "identifier": "V15.2.2", - "text": "Uygulamanın, belgelenmiş güvenlik kararları ve stratejilere dayanarak, zaman veya kaynak açısından yoğun işlevlerin neden olabileceği kullanılabilirlik kaybına karşı savunmalar uyguladığı doğrulanmalıdır.", - "parent": "V15.2" - }, - { - "bom-ref": "V15.2.3", - "identifier": "V15.2.3", - "text": "Üretim ortamının yalnızca uygulamanın çalışması için gerekli işlevleri içerdiği ve test kodları, örnek kod parçaları veya geliştirme işlevleri gibi gereksiz işlevsellikleri açığa çıkarmadığı doğrulanmalıdır.", - "parent": "V15.2" - }, - { - "bom-ref": "V15.2.4", - "identifier": "V15.2.4", - "text": "Üçüncü taraf bileşenlerin ve bunların tüm transitif bağımlılıklarının beklenen depolardan (iç kaynaklı ya da harici) alındığı ve bağımlılık karışıklığı (dependency confusion) saldırılarına açık olmadığı doğrulanmalıdır.", - "parent": "V15.2" - }, - { - "bom-ref": "V15.2.5", - "identifier": "V15.2.5", - "text": "Uygulamanın, “tehlikeli işlevsellik” içeren veya “riskli bileşenler” kullanan bölümlerine ek korumalar uyguladığı doğrulanmalıdır. Bu korumalar sandbox, kapsülleme, konteynerleştirme veya ağ düzeyinde izolasyon gibi teknikler aracılığıyla, bir uygulama bölümünün ele geçirilmesi durumunda saldırganın diğer bölümlere sıçramasını geciktirmeyi veya engellemeyi amaçlamalıdır.", - "parent": "V15.2" - }, - { - "bom-ref": "V15.3", - "identifier": "V15.3", - "title": "Savunmacı Kodlama", - "parent": "V15" - }, - { - "bom-ref": "V15.3.1", - "identifier": "V15.3.1", - "text": "Uygulamanın yalnızca gerekli alanların bir alt kümesini veri nesnesinden döndürdüğü doğrulanmalıdır. Örneğin, bazı alanlara kullanıcıların erişmemesi gerektiğinden tüm veri nesnesi döndürülmemelidir.", - "parent": "V15.3" - }, - { - "bom-ref": "V15.3.2", - "identifier": "V15.3.2", - "text": "Uygulama backend'i harici URL’lere çağrı yaptığında, yalnızca amaçlanan işlevsellik söz konusuysa yönlendirmeleri takip edecek şekilde yapılandırıldığının doğrulanması gerekir.", - "parent": "V15.3" - }, - { - "bom-ref": "V15.3.3", - "identifier": "V15.3.3", - "text": "Uygulamanın, kitlesel atama saldırılarına karşı, her bir controller ve eylem için izin verilen alanları sınırlandırarak savunmalar sağladığı doğrulanmalıdır. Örneğin, bir alan değeri, bu işlemde değiştirilmesi amaçlanmadıysa eklenememeli veya güncellenememelidir.", - "parent": "V15.3" - }, - { - "bom-ref": "V15.3.4", - "identifier": "V15.3.4", - "text": "Tüm proxy ve ara katman bileşenlerinin kullanıcının orijinal IP adresini, uç kullanıcı tarafından değiştirilemeyecek güvenilir veri alanları kullanarak doğru şekilde ilettiği ve uygulamanın ve web sunucusunun bu doğru değeri, loglama ve hız sınırlama gibi güvenlik kararları için kullandığı doğrulanmalıdır. Ayrıca, orijinal IP adresinin bile dinamik IP'ler, VPN'ler veya kurumsal güvenlik duvarları nedeniyle güvenilir olmayabileceği dikkate alınmalıdır.", - "parent": "V15.3" - }, - { - "bom-ref": "V15.3.5", - "identifier": "V15.3.5", - "text": "Uygulamanın değişkenlerin doğru türde olduğunu açıkça doğruladığı ve sıkı eşitlik ve karşılaştırma işlemleri kullandığı doğrulanmalıdır. Bu, değişken türüyle ilgili varsayımlardan kaynaklanan tür oynama (type juggling) veya tür karışıklığı (type confusion) güvenlik açıklarını önlemek içindir.", - "parent": "V15.3" - }, - { - "bom-ref": "V15.3.6", - "identifier": "V15.3.6", - "text": "JavaScript kodunun prototip zehirleme (prototype pollution) saldırılarını önleyecek şekilde yazıldığı, örneğin, nesne literal’leri yerine Set() veya Map() gibi yapılar kullanıldığı doğrulanmalıdır.", - "parent": "V15.3" - }, - { - "bom-ref": "V15.3.7", - "identifier": "V15.3.7", - "text": "Uygulamanın, özellikle framework'ün istek parametrelerinin kaynağı (sorgu dizgisi, gövde parametreleri, çerezler veya başlık alanları) arasında ayrım yapmadığı durumlarda, HTTP parametre kirliliği (HTTP parameter pollution) saldırılarına karşı savunmalar uyguladığı doğrulanmalıdır.", - "parent": "V15.3" - }, - { - "bom-ref": "V15.4", - "identifier": "V15.4", - "title": "Güvenli Eş Zamanlılık (Concurrency)", - "parent": "V15" - }, - { - "bom-ref": "V15.4.1", - "identifier": "V15.4.1", - "text": "Çok iş parçacıklı kodda (örneğin cache'ler, dosyalar veya birden fazla iş parçacığı tarafından erişilen bellek içi nesneler gibi) paylaşılan nesnelere yalnızca thread-safe (iş parçacığı güvenli) türler ve kilitleme (lock) veya semaphore gibi senkronizasyon mekanizmaları kullanılarak erişildiği doğrulanmalıdır. Bu, yarış durumlarını ve veri bozulmasını önlemeye yöneliktir.", - "parent": "V15.4" - }, - { - "bom-ref": "V15.4.2", - "identifier": "V15.4.2", - "text": "Bir kaynağın durumu üzerindeki kontroller (örneğin varlığı ya da izinleri gibi) ile bu kontrole bağlı eylemlerin tek bir atomik işlem olarak gerçekleştirildiği doğrulanmalıdır. Bu, TOCTOU (time-of-check to time-of-use) yarış durumlarını önlemeye yöneliktir. Bir dosyanın varlığının kontrol edilip ardından açılması veya bir kullanıcının erişiminin doğrulanıp ardından yetki verilmesi gibi işlemler buna örnektir.", - "parent": "V15.4" - }, - { - "bom-ref": "V15.4.3", - "identifier": "V15.4.3", - "text": "Kilitlerin (locks) tutarlı biçimde kullanıldığı, iş parçacıklarının birbirini beklemesi ya da sonsuz döngüye girmesi (deadlock veya livelock) gibi durumların önlendiği doğrulanmalıdır. Ayrıca, kilitleme mantığı, kaynağı yöneten kod içinde kalmalı ve dış sınıflar veya dış kodlar tarafından istemeden veya kötü niyetli şekilde değiştirilememelidir.", - "parent": "V15.4" - }, - { - "bom-ref": "V15.4.4", - "identifier": "V15.4.4", - "text": "Kaynak tahsis politikalarının, iş parçacığı açlığını önleyecek şekilde, kaynaklara adil erişimi sağladığı doğrulanmalıdır. Örneğin, thread pool (iş parçacığı havuzu) kullanımı, düşük öncelikli iş parçacıklarının da makul sürelerde çalışabilmesi için uygulanmalıdır.", - "parent": "V15.4" - }, - { - "bom-ref": "V16", - "identifier": "V16", - "title": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi" - }, - { - "bom-ref": "V16.1", - "identifier": "V16.1", - "title": "Güvenlik Loglaması Dokümantasyonu", - "parent": "V16" - }, - { - "bom-ref": "V16.1.1", - "identifier": "V16.1.1", - "text": "Uygulamanın teknoloji yığını boyunca her katmanda hangi olayların loglandığını, log formatlarını, logların nereye yazıldığını, nasıl kullanıldığını, erişimin nasıl kontrol edildiğini ve logların ne kadar süre saklandığını belgeleyen bir envanterin mevcut olduğu doğrulanmalıdır.", - "parent": "V16.1" - }, - { - "bom-ref": "V16.2", - "identifier": "V16.2", - "title": "Genel Loglama", - "parent": "V16" - }, - { - "bom-ref": "V16.2.1", - "identifier": "V16.2.1", - "text": "Her bir log girdisinin, olayın ne zaman, nerede, kim tarafından ve ne olduğuna dair detaylı bir zaman çizelgesi oluşturulmasına olanak tanıyacak gerekli meta verileri içerdiği doğrulanmalıdır.", - "parent": "V16.2" - }, - { - "bom-ref": "V16.2.2", - "identifier": "V16.2.2", - "text": "Tüm loglama bileşenlerinin zaman kaynaklarının senkronize olduğu ve güvenlik olayı meta verisindeki zaman damgalarının UTC kullanarak ya da açık zaman dilimi ofsetiyle belirtildiği doğrulanmalıdır. UTC kullanımı, özellikle yaz saati uygulamaları nedeniyle oluşabilecek karışıklıkları önlemek için tavsiye edilir.", - "parent": "V16.2" - }, - { - "bom-ref": "V16.2.3", - "identifier": "V16.2.3", - "text": "Uygulamanın yalnızca log envanterinde belgelenmiş dosya ve hizmetlere log yazdığı ya da ilettiği doğrulanmalıdır.", - "parent": "V16.2" - }, - { - "bom-ref": "V16.2.4", - "identifier": "V16.2.4", - "text": "Logların kullanılan log işleyici (log processor) tarafından okunabildiği ve ilişkilendirilebildiği doğrulanmalıdır. Tercihen yaygın bir log formatı kullanılmalıdır.", - "parent": "V16.2" - }, - { - "bom-ref": "V16.2.5", - "identifier": "V16.2.5", - "text": "Hassas veriler loglanırken, uygulamanın veri koruma seviyesine uygun olarak loglama yaptığı doğrulanmalıdır. Örneğin kimlik bilgileri veya ödeme detayları gibi bazı verilerin loglanmasına izin verilmemelidir. Session token’ları gibi veriler ise yalnızca tamamen ya da kısmen maskelenmiş ya da hash’lenmiş olarak loglanmalıdır.", - "parent": "V16.2" - }, - { - "bom-ref": "V16.3", - "identifier": "V16.3", - "title": "Güvenlik Olayları", - "parent": "V16" - }, - { - "bom-ref": "V16.3.1", - "identifier": "V16.3.1", - "text": "Tüm kimlik doğrulama işlemlerinin (başarılı ve başarısız girişimler dahil) loglandığı doğrulanmalıdır. Kullanılan kimlik doğrulama türü veya faktörleri gibi ek meta veriler de toplanmalıdır.", - "parent": "V16.3" - }, - { - "bom-ref": "V16.3.2", - "identifier": "V16.3.2", - "text": "Başarısız yetkilendirme girişimlerinin loglandığı doğrulanmalıdır. Seviye 3 uygulamalar için, tüm yetkilendirme kararlarının ve hassas verilere erişim olaylarının (verinin kendisi olmadan) loglandığı da doğrulanmalıdır.", - "parent": "V16.3" - }, - { - "bom-ref": "V16.3.3", - "identifier": "V16.3.3", - "text": "Uygulamanın, belgelenmiş güvenlik olaylarını ve güvenlik kontrollerini aşma girişimlerini (girdi doğrulama, iş mantığı, otomasyon karşıtı kontroller vb.) logladığı doğrulanmalıdır.", - "parent": "V16.3" - }, - { - "bom-ref": "V16.3.4", - "identifier": "V16.3.4", - "text": "Beklenmeyen hatalar ve güvenlik kontrolü başarısızlıkları (örneğin backend TLS hataları gibi) loglandığı doğrulanmalıdır.", - "parent": "V16.3" - }, - { - "bom-ref": "V16.4", - "identifier": "V16.4", - "title": "Log Koruması", - "parent": "V16" - }, - { - "bom-ref": "V16.4.1", - "identifier": "V16.4.1", - "text": "Tüm loglama bileşenlerinin, log enjeksiyonunu (log injection) önlemek amacıyla verileri uygun biçimde encode ettiği doğrulanmalıdır.", - "parent": "V16.4" - }, - { - "bom-ref": "V16.4.2", - "identifier": "V16.4.2", - "text": "Logların yetkisiz erişime karşı korunduğu ve değiştirilemez olduğu doğrulanmalıdır.", - "parent": "V16.4" - }, - { - "bom-ref": "V16.4.3", - "identifier": "V16.4.3", - "text": "Logların analiz, tespit, uyarı ve yükseltme amacıyla mantıksal olarak ayrı bir sisteme güvenli biçimde iletildiği doğrulanmalıdır. Böylece uygulama ihlal edilse bile logların tehlikeye girmesi önlenmiş olur.", - "parent": "V16.4" - }, - { - "bom-ref": "V16.5", - "identifier": "V16.5", - "title": "Hata Yönetimi", - "parent": "V16" - }, - { - "bom-ref": "V16.5.1", - "identifier": "V16.5.1", - "text": "Beklenmedik ya da güvenlikle ilgili bir hata oluştuğunda, tüketiciye genel bir mesaj döndürüldüğü ve yığın izleri (stack trace), sorgular, gizli anahtarlar, token’lar gibi hassas sistem içi verilerin açıklanmadığı doğrulanmalıdır.", - "parent": "V16.5" - }, - { - "bom-ref": "V16.5.2", - "identifier": "V16.5.2", - "text": "Uygulamanın, dış kaynaklara erişim başarısız olduğunda bile güvenli şekilde çalışmaya devam ettiği doğrulanmalıdır. Örneğin, circuit breaker ya da graceful degradation gibi desenler kullanılmalıdır.", - "parent": "V16.5" - }, - { - "bom-ref": "V16.5.3", - "identifier": "V16.5.3", - "text": "Uygulamanın hata durumlarında güvenli ve düzenli şekilde başarısız olduğu doğrulanmalıdır. Bu, örneğin doğrulama hatalarına rağmen işlemlerin işlenmesine yol açabilecek fail-open durumlarını önlemelidir.", - "parent": "V16.5" - }, - { - "bom-ref": "V16.5.4", - "identifier": "V16.5.4", - "text": "Ele alınmamış tüm istisnaları yakalayacak şekilde tanımlanmış bir “son çare hata yöneticisi” bulunduğu doğrulanmalıdır. Bu, hem loglara gitmesi gereken hata detaylarının kaybolmaması hem de tüm uygulama sürecinin çökerek hizmet dışı kalmasının önlenmesi açısından önemlidir.", - "parent": "V16.5" - }, - { - "bom-ref": "V17", - "identifier": "V17", - "title": "WebRTC" - }, - { - "bom-ref": "V17.1", - "identifier": "V17.1", - "title": "TURN Sunucusu", - "parent": "V17" - }, - { - "bom-ref": "V17.1.1", - "identifier": "V17.1.1", - "text": "TURN hizmetinin yalnızca özel amaçlar için ayrılmamış IP adreslerine (ör. iç ağlar, yayın adresleri, loopback) erişime izin verdiği doğrulanmalıdır. Bu gereksinim hem IPv4 hem de IPv6 adresleri için geçerlidir.", - "parent": "V17.1" - }, - { - "bom-ref": "V17.1.2", - "identifier": "V17.1.2", - "text": "TURN hizmetinin, meşru kullanıcıların sunucuda çok sayıda bağlantı noktası açmaya çalışması durumunda kaynak tüketimi saldırılarına karşı dayanıklı olduğu doğrulanmalıdır.", - "parent": "V17.1" - }, - { - "bom-ref": "V17.2", - "identifier": "V17.2", - "title": "Medya", - "parent": "V17" - }, - { - "bom-ref": "V17.2.1", - "identifier": "V17.2.1", - "text": "DTLS sertifikası anahtarının, belgelenmiş kriptografik anahtar yönetim politikasına uygun şekilde yönetildiği ve korunduğu doğrulanmalıdır.", - "parent": "V17.2" - }, - { - "bom-ref": "V17.2.2", - "identifier": "V17.2.2", - "text": "Medya sunucusunun onaylı DTLS şifre takımlarını (cipher suites) ve Güvenli Gerçek Zamanlı Aktarım Protokolü (Secure Real-time Transport Protocol - SRTP) için anahtarlar oluşturmaya yönelik DTLS Uzantısı için güvenli bir koruma profilini kullanacak ve destekleyecek şekilde yapılandırıldığı (DTLS-SRTP) doğrulanmalıdır.", - "parent": "V17.2" - }, - { - "bom-ref": "V17.2.3", - "identifier": "V17.2.3", - "text": "Real-time Transport Protocol (RTP) injection saldırılarının bir hizmet reddi durumuna veya medya akışlarına ses veya video medyası eklenmesine yol açmasını önlemek için medya sunucusunda Güvenli SRTP kimlik doğrulamasının kontrol edildiği doğrulanmalıdır.", - "parent": "V17.2" - }, - { - "bom-ref": "V17.2.4", - "identifier": "V17.2.4", - "text": "Verify that the media server is able to continue processing incoming media traffic when encountering malformed Secure Real-time Transport Protocol (SRTP) packets.", - "parent": "V17.2" - }, - { - "bom-ref": "V17.2.5", - "identifier": "V17.2.5", - "text": "Medya sunucusunun, meşru kullanıcılardan gelen SRTP flood'ı sırasında gelen medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.", - "parent": "V17.2" - }, - { - "bom-ref": "V17.2.6", - "identifier": "V17.2.6", - "text": "Medya sunucusunun DTLS içinde yer alan \"ClientHello\" yarış durumu güvenlik açığına karşı savunmasız olmadığı, medya sunucusunun güvenlik açığına sahip olduğunun açıkça bilinip bilinmediği kontrol edilerek veya yarış koşulu testi gerçekleştirilerek doğrulanmalıdır.", - "parent": "V17.2" - }, - { - "bom-ref": "V17.2.7", - "identifier": "V17.2.7", - "text": "Medya sunucusuna bağlı ses veya video kayıt mekanizmalarının, meşru kullanıcı kaynaklı SRTP flood'ı sırasında medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.", - "parent": "V17.2" - }, - { - "bom-ref": "V17.2.8", - "identifier": "V17.2.8", - "text": "DTLS sertifikasının, SDP (Session Description Protocol) fingerprint özelliği ile karşılaştırıldığı ve doğrulama başarısız olursa medya akışının sonlandırıldığı, medya akışının özgünlüğünü sağlamak için doğrulanmalıdır.", - "parent": "V17.2" - }, - { - "bom-ref": "V17.3", - "identifier": "V17.3", - "title": "Sinyalizasyon", - "parent": "V17" - }, - { - "bom-ref": "V17.3.1", - "identifier": "V17.3.1", - "text": "Sinyalizasyon sunucusunun, flood saldırısı altında bile meşru sinyalizasyon mesajlarını işlemeye devam edebildiği doğrulanmalıdır. Bu, sinyalizasyon düzeyinde oran sınırlaması uygulanarak sağlanmalıdır.", - "parent": "V17.3" - }, - { - "bom-ref": "V17.3.2", - "identifier": "V17.3.2", - "text": "Sinyalizasyon sunucusunun, hizmet reddine yol açabilecek şekilde yapılandırılmış bozuk sinyalizasyon mesajlarıyla karşılaştığında bile meşru mesajları işlemeye devam edebildiği doğrulanmalıdır. Bu, girdi doğrulaması, integer overflow ve buffer overflow'a karşı savunma ve sağlam hata işleme teknikleri ile sağlanmalıdır.", - "parent": "V17.3" - } - ], - "levels": [ - { - "bom-ref": "level-1", - "identifier": "Level 1", - "description": "This level contains the minimum requirements to consider when securing an application and represents a critical starting point.", - "requirements": [ - "V1.2.1", - "V1.2.2", - "V1.2.3", - "V1.2.4", - "V1.2.5", - "V1.3.1", - "V1.3.2", - "V1.5.1", - "V2.1.1", - "V2.2.1", - "V2.2.2", - "V2.3.1", - "V3.2.1", - "V3.2.2", - "V3.3.1", - "V3.4.2", - "V3.5.1", - "V3.5.2", - "V4.1.1", - "V4.4.1", - "V5.2.1", - "V5.2.2", - "V5.3.1", - "V5.3.2", - "V6.1.1", - "V6.2.1", - "V6.2.2", - "V6.2.3", - "V6.2.4", - "V6.2.5", - "V6.2.6", - "V6.2.7", - "V6.2.8", - "V6.3.1", - "V6.3.2", - "V6.4.1", - "V6.4.2", - "V7.2.1", - "V7.2.2", - "V7.2.3", - "V7.2.4", - "V7.4.1", - "V7.4.2", - "V8.1.1", - "V8.2.1", - "V8.2.2", - "V8.3.1", - "V9.1.1", - "V9.1.2", - "V9.1.3", - "V9.2.1", - "V10.4.1", - "V10.4.2", - "V10.4.3", - "V10.4.4", - "V10.4.5", - "V11.3.1", - "V11.3.2", - "V11.4.1", - "V12.1.1", - "V12.2.1", - "V12.2.2", - "V13.4.1", - "V14.2.1", - "V14.3.1", - "V15.1.1", - "V15.2.1", - "V15.3.1" - ] - }, - { - "bom-ref": "level-2", - "identifier": "Level 2", - "description": "ASVS Level 2 requirements generally relate to either less common attacks or more complicated protections against common attacks. They may still be a first layer of defense, or they may require certain preconditions for the attack to be successful.", - "requirements": [ - "V1.1.1", - "V1.1.2", - "V1.2.6", - "V1.2.7", - "V1.2.8", - "V1.2.9", - "V1.3.3", - "V1.3.4", - "V1.3.5", - "V1.3.6", - "V1.3.7", - "V1.3.8", - "V1.3.9", - "V1.3.10", - "V1.3.11", - "V1.4.1", - "V1.4.2", - "V1.4.3", - "V1.5.2", - "V2.1.2", - "V2.1.3", - "V2.2.3", - "V2.3.2", - "V2.3.3", - "V2.3.4", - "V2.4.1", - "V3.3.2", - "V3.3.3", - "V3.3.4", - "V3.4.3", - "V3.4.4", - "V3.4.5", - "V3.4.6", - "V3.5.4", - "V3.7.1", - "V3.7.2", - "V4.1.2", - "V4.1.3", - "V4.2.1", - "V4.3.1", - "V4.3.2", - "V4.4.2", - "V4.4.3", - "V4.4.4", - "V5.1.1", - "V5.2.3", - "V5.4.1", - "V5.4.2", - "V5.4.3", - "V6.1.2", - "V6.1.3", - "V6.2.9", - "V6.2.10", - "V6.2.11", - "V6.2.12", - "V6.3.3", - "V6.3.4", - "V6.4.3", - "V6.4.4", - "V6.5.1", - "V6.5.2", - "V6.5.3", - "V6.5.4", - "V6.5.5", - "V6.6.1", - "V6.6.2", - "V6.6.3", - "V6.8.1", - "V6.8.2", - "V6.8.3", - "V6.8.4", - "V7.1.1", - "V7.1.2", - "V7.1.3", - "V7.3.1", - "V7.3.2", - "V7.4.3", - "V7.4.4", - "V7.4.5", - "V7.5.1", - "V7.5.2", - "V7.6.1", - "V7.6.2", - "V8.1.2", - "V8.2.3", - "V8.4.1", - "V9.2.2", - "V9.2.3", - "V9.2.4", - "V10.1.1", - "V10.1.2", - "V10.2.1", - "V10.2.2", - "V10.3.1", - "V10.3.2", - "V10.3.3", - "V10.3.4", - "V10.4.6", - "V10.4.7", - "V10.4.8", - "V10.4.9", - "V10.4.10", - "V10.4.11", - "V10.5.1", - "V10.5.2", - "V10.5.3", - "V10.5.4", - "V10.5.5", - "V10.6.1", - "V10.6.2", - "V10.7.1", - "V10.7.2", - "V10.7.3", - "V11.1.1", - "V11.1.2", - "V11.2.1", - "V11.2.2", - "V11.2.3", - "V11.3.3", - "V11.4.2", - "V11.4.3", - "V11.4.4", - "V11.5.1", - "V11.6.1", - "V12.1.2", - "V12.1.3", - "V12.3.1", - "V12.3.2", - "V12.3.3", - "V12.3.4", - "V13.1.1", - "V13.2.1", - "V13.2.2", - "V13.2.3", - "V13.2.4", - "V13.2.5", - "V13.3.1", - "V13.3.2", - "V13.4.2", - "V13.4.3", - "V13.4.4", - "V13.4.5", - "V14.1.1", - "V14.1.2", - "V14.2.2", - "V14.2.3", - "V14.2.4", - "V14.3.2", - "V14.3.3", - "V15.1.2", - "V15.1.3", - "V15.2.2", - "V15.2.3", - "V15.3.2", - "V15.3.3", - "V15.3.4", - "V15.3.5", - "V15.3.6", - "V15.3.7", - "V16.1.1", - "V16.2.1", - "V16.2.2", - "V16.2.3", - "V16.2.4", - "V16.2.5", - "V16.3.1", - "V16.3.2", - "V16.3.3", - "V16.3.4", - "V16.4.1", - "V16.4.2", - "V16.4.3", - "V16.5.1", - "V16.5.2", - "V16.5.3", - "V17.1.1", - "V17.2.1", - "V17.2.2", - "V17.2.3", - "V17.2.4", - "V17.3.1", - "V17.3.2" - ] - }, - { - "bom-ref": "level-3", - "identifier": "Level 3", - "description": "ASVS Level 3 should be the goal for applications looking to demonstrate the highest levels of security and requirements in this section are generally either defense-in-depth mechanisms or other useful but hard-to-implement controls.", - "requirements": [ - "V1.2.10", - "V1.3.12", - "V1.5.3", - "V2.3.5", - "V2.4.2", - "V3.1.1", - "V3.2.3", - "V3.3.5", - "V3.4.8", - "V3.5.6", - "V3.5.7", - "V3.5.8", - "V3.6.1", - "V3.7.3", - "V3.7.4", - "V3.7.5", - "V4.1.4", - "V4.1.5", - "V4.2.2", - "V4.2.3", - "V4.2.4", - "V4.2.5", - "V5.2.4", - "V5.2.5", - "V5.2.6", - "V5.3.3", - "V6.3.5", - "V6.3.6", - "V6.3.7", - "V6.3.8", - "V6.4.5", - "V6.4.6", - "V6.5.6", - "V6.5.7", - "V6.5.8", - "V6.6.4", - "V6.7.1", - "V6.7.2", - "V7.5.3", - "V8.1.3", - "V8.1.4", - "V8.2.4", - "V8.3.2", - "V8.3.3", - "V8.4.2", - "V10.2.3", - "V10.3.5", - "V10.4.12", - "V10.4.13", - "V10.4.14", - "V10.4.15", - "V10.4.16", - "V11.1.3", - "V11.1.4", - "V11.2.4", - "V11.2.5", - "V11.3.4", - "V11.3.5", - "V11.5.2", - "V11.6.2", - "V11.7.1", - "V11.7.2", - "V12.1.4", - "V12.1.5", - "V12.3.5", - "V13.1.2", - "V13.1.3", - "V13.1.4", - "V13.2.6", - "V13.3.3", - "V13.3.4", - "V13.4.6", - "V13.4.7", - "V14.2.5", - "V14.2.6", - "V14.2.7", - "V14.2.8", - "V15.1.4", - "V15.1.5", - "V15.2.4", - "V15.2.5", - "V15.4.1", - "V15.4.2", - "V15.4.3", - "V15.4.4", - "V16.5.4", - "V17.1.2", - "V17.2.5", - "V17.2.6", - "V17.2.7", - "V17.2.8" - ] - } - ], - "externalReferences": [ - { - "type": "website", - "url": "https://owasp.org/asvs" - }, - { - "type": "vcs", - "url": "https://github.com/OWASP/ASVS" - }, - { - "type": "issue-tracker", - "url": "https://github.com/OWASP/ASVS/issues" - }, - { - "type": "social", - "url": "https://twitter.com/OWASP_ASVS" - } - ] - } - ] - } -} diff --git a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.csv b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.csv deleted file mode 100644 index 487b444c7d..0000000000 --- a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.csv +++ /dev/null @@ -1,343 +0,0 @@ -chapter_id,chapter_name,section_id,section_name,req_id,req_description,L -V1,Kodlama (Encoding) ve Temizleme,V1.1,Kodlama ve Temizleme Mimarisi,V1.1.1,"Girdinin yalnızca bir kez kanonik forma (canonical form) çözümlendiği veya kaçış işlemlerinin kaldırıldığı, bu işlemin yalnızca verinin bu biçimde beklenmesi durumunda yapıldığı ve bu işlemin girdi doğrulama veya temizleme işlemlerinden sonra değil, önce gerçekleştiği doğrulanmalıdır.",2 -V1,Kodlama (Encoding) ve Temizleme,V1.1,Kodlama ve Temizleme Mimarisi,V1.1.2,"Uygulamanın, çıktıyı kullanılması gereken yorumlayıcıya verilmeden hemen önce veya yorumlayıcının kendisi tarafından çıktı kodlaması ya da kaçış işlemi yaptığı doğrulanmalıdır.",2 -V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.1,"HTTP yanıtı, HTML veya XML belgesi için yapılan çıktı kodlamasının; HTML elemanları, HTML öznitelikleri, HTML yorumları, CSS ya da HTTP başlık alanları gibi bağlamlara uygun olduğu doğrulanmalıdır. Böylece mesaj veya belge yapısının bozulması önlenir.",1 -V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.2,"Dinamik olarak URL oluşturulurken, güvenilmeyen verinin bağlamına göre (örneğin, sorgu veya yol parametreleri için URL kodlaması ya da base64url kodlaması) kodlandığı doğrulanmalıdır. Yalnızca güvenli URL protokollerine izin verilmelidir (örneğin, javascript: veya data: yasaklanmalıdır).",1 -V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.3,JavaScript içeriği (JSON dahil) dinamik olarak oluşturulurken çıktı kodlama/kaçış kullanıldığı doğrulanmalıdır. Böylece mesaj veya belge yapısı değiştirilmemiş olur (JavaScript ve JSON enjeksiyonlarının önüne geçilir).,1 -V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.4,"Veri sorguları veya veritabanı sorguları (SQL, HQL, NoSQL, Cypher vb.) için parametreli sorgular, ORM’ler, entity framework’ler kullanıldığı ya da SQL enjeksiyonu ve diğer veritabanı enjeksiyon saldırılarına karşı koruma sağlandığı doğrulanmalıdır. Bu durum, saklı yordam (stored procedure) yazarken de geçerlidir.",1 -V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.5,Uygulamanın işletim sistemi komut enjeksiyonlarına karşı korunduğu ve işletim sistemi çağrılarında parametreli OS sorguları veya bağlama özgü komut satırı çıktı kodlamasının kullanıldığı doğrulanmalıdır.,1 -V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.6,Uygulamanın LDAP enjeksiyon zafiyetlerine karşı korunduğu ya da LDAP enjeksiyonlarını önlemek için özel güvenlik kontrollerinin uygulandığı doğrulanmalıdır.,2 -V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.7,"XPath enjeksiyon saldırılarına karşı, sorgu parametrelemesi veya önceden derlenmiş sorgular kullanılarak koruma sağlandığı doğrulanmalıdır.",2 -V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.8,"LaTeX işlemcilerinin güvenli şekilde yapılandırıldığı (örneğin, --shell-escape bayrağının kullanılmadığı) ve yalnızca izin verilen komutlardan oluşan bir listeyle çalıştırıldığı doğrulanmalıdır.",2 -V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.9,Düzenli ifadelerde (regex) özel karakterlerin (genellikle ters eğik çizgi \ ile) kaçırılarak meta karakter olarak yorumlanmalarının önlendiği doğrulanmalıdır.,2 -V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.10,"Uygulamanın CSV ve formül enjeksiyonlarına karşı korunduğu doğrulanmalıdır. Uygulama, CSV içeriği dışa aktarırken RFC 4180 Bölüm 2.6 ve 2.7'de tanımlanan kaçış kurallarına uymalıdır. Ayrıca, CSV veya diğer tablo formatlarına (XLS, XLSX, ODF gibi) aktarım yapılırken, alanın ilk karakteri olarak çıkan özel karakterler ('=', '+', '-', '@', '\t' (sekme), '\0' (null karakter)) tek tırnak (') ile kaçırılmalıdır.",3 -V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.1,"WYSIWYG editörlerinden veya benzer kaynaklardan gelen tüm güvenilmeyen HTML girdilerinin, bilinen ve güvenli bir HTML temizleme kütüphanesi ya da çerçeve özelliği ile temizlendiği doğrulanmalıdır.",1 -V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.2,"Uygulamanın eval() veya Spring Expression Language (SpEL) gibi dinamik kod çalıştırma özelliklerini kullanmaktan kaçındığı doğrulanmalıdır. Alternatif yoksa, kullanıcı girdisi çalıştırılmadan önce mutlaka temizlenmelidir.",1 -V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.3,"Potansiyel olarak tehlikeli bir bağlamda kullanılacak verilerin, bu bağlama uygun karakterlere izin vermek ve çok uzun girdileri kısaltmak gibi güvenlik önlemleriyle önceden temizlendiği doğrulanmalıdır.",2 -V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.4,"Kullanıcı tarafından sağlanan SVG içeriğinin, yalnızca güvenli etiket ve özellikler (örneğin grafik çizme ile ilgili) içerdiğinden emin olmak için onaylandığı veya temizlendiği doğrulanmalıdır (ör. script veya foreignObject içermemelidir).",2 -V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.5,"Markdown, CSS, XSL stil sayfaları, BBCode veya benzeri ifade şablon dillerinde kullanıcı girdisinin temizlendiği veya bu tür özelliklerin devre dışı bırakıldığı doğrulanmalıdır.",2 -V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.6,"Uygulamanın, güvenilmeyen verileri başka servislere iletmeden önce izinli protokol, alan adı, yol ve port listelerine göre doğruladığı ve tehlikeli karakterleri temizlediği doğrulanarak SSRF (Sunucu Taraflı İstek Sahteciliği) saldırılarına karşı korunduğu doğrulanmalıdır.",2 -V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.7,"Uygulamanın şablon enjeksiyon saldırılarına karşı, güvenilmeyen girdilere dayalı şablon oluşturmayı engellediği; eğer bu kaçınılmazsa, bu girdilerin mutlaka temizlendiği veya sıkı şekilde onaylandığı doğrulanmalıdır.",2 -V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.8,JNDI sorgularında kullanılmadan önce güvenilmeyen girdilerin temizlendiği ve JNDI'nin enjeksiyonlara karşı güvenli şekilde yapılandırıldığı doğrulanmalıdır.,2 -V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.9,Memcache’e gönderilmeden önce içeriğin temizlenerek enjeksiyon saldırılarına karşı korunduğu doğrulanmalıdır.,2 -V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.10,Format dizgilerinin (format strings) beklenmeyen veya zararlı şekilde çözümlenmesini önlemek için işlenmeden önce temizlendiği doğrulanmalıdır.,2 -V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.11,"SMTP veya IMAP enjeksiyonlarını önlemek için, kullanıcı girdisinin posta sistemlerine iletilmeden önce temizlendiği doğrulanmalıdır.",2 -V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.12,Regex girdilerinin üstel geri izlemeye (exponential backtracking) neden olan öğeler içermediği ve güvenilmeyen girdilerin ReDoS (Regex Denial of Service) gibi saldırılara karşı temizlendiği doğrulanmalıdır.,3 -V1,Kodlama (Encoding) ve Temizleme,V1.4,"Bellek, Dizgi ve Yönetilmeyen Kod",V1.4.1,"Yığın, arabellek (buffer) veya yığın belleği taşmalarını önlemek ya da tespit etmek amacıyla, bellek güvenli dizgi işlemlerinin, daha güvenli bellek kopyalama ve işaretçi aritmetiğinin kullanıldığı doğrulanmalıdır.",2 -V1,Kodlama (Encoding) ve Temizleme,V1.4,"Bellek, Dizgi ve Yönetilmeyen Kod",V1.4.2,"Tamsayı taşmalarını önlemek için işaret (sign), aralık (range) ve giriş doğrulama tekniklerinin kullanıldığı doğrulanmalıdır.",2 -V1,Kodlama (Encoding) ve Temizleme,V1.4,"Bellek, Dizgi ve Yönetilmeyen Kod",V1.4.3,Dinamik olarak ayrılan belleğin ve kaynakların serbest bırakıldığı ve boşaltılan belleklere ait referansların veya işaretçilerin kaldırıldığı veya null yapıldığı doğrulanmalıdır (dangling pointer ve use-after-free zafiyetlerine karşı).,2 -V1,Kodlama (Encoding) ve Temizleme,V1.5,Güvenli Ters Serileştirme (Safe Deserialization),V1.5.1,XML ayrıştırıcılarının (parser) kısıtlayıcı şekilde yapılandırıldığı ve dış varlık çözümleme (external entity resolution) gibi güvensiz özelliklerin XXE (XML eXternal Entity) saldırılarına karşı devre dışı bırakıldığı doğrulanmalıdır .,1 -V1,Kodlama (Encoding) ve Temizleme,V1.5,Güvenli Ters Serileştirme (Safe Deserialization),V1.5.2,"Güvenilmeyen verilerin ters serileştirilmesinde, nesne türleri için izinli liste kullanımı veya istemci tanımlı nesne türlerinin kısıtlanması gibi güvenli giriş işleme önlemlerinin uygulandığı doğrulanmalıdır. Güvensiz olarak tanımlanmış ters serileştirme mekanizmaları, güvenilmeyen girdilerle kullanılmamalıdır.",2 -V1,Kodlama (Encoding) ve Temizleme,V1.5,Güvenli Ters Serileştirme (Safe Deserialization),V1.5.3,"Aynı veri türü için uygulamada kullanılan farklı parser'ların (ör. JSON, XML, URL parser'ları), veriyi tutarlı şekilde ayrıştırdığı ve aynı karakter kodlamasını kullandığı doğrulanmalıdır. Böylece JSON birlikte çalışabilirlik açıkları, URI veya dosya ayrıştırma farkları gibi sorunlar nedeniyle RFI veya SSRF saldırılarının istismar edilmesi önlenir.",3 -V2,Doğrulama ve İş Mantığı,V2.1,Doğrulama ve İş Mantığı Dokümantasyonu,V2.1.1,"Uygulama dokümantasyonunda, veri öğelerinin beklenen yapıya göre nasıl doğrulanacağına ilişkin giriş doğrulama kurallarının tanımlandığı doğrulanmalıdır. Bu; kredi kartı numaraları, e-posta adresleri, telefon numaraları gibi yaygın veri biçimleri olabileceği gibi iç sistemlere özel biçimler de olabilir.",1 -V2,Doğrulama ve İş Mantığı,V2.1,Doğrulama ve İş Mantığı Dokümantasyonu,V2.1.2,"Uygulama dokümantasyonunda, birleştirilmiş veri öğelerinin mantıksal ve bağlamsal tutarlılığının nasıl doğrulanacağı tanımlanmalıdır (örneğin, mahalle ve posta kodunun eşleşip eşleşmediğinin kontrolü).",2 -V2,Doğrulama ve İş Mantığı,V2.1,Doğrulama ve İş Mantığı Dokümantasyonu,V2.1.3,"Hem kullanıcı bazında hem de uygulama genelinde geçerli olacak şekilde, iş mantığı sınırları ve doğrulama beklentilerinin belgelendiği doğrulanmalıdır.",2 -V2,Doğrulama ve İş Mantığı,V2.2,Girdi Doğrulama,V2.2.1,"Girdilerin, işlevsel ya da iş gereksinimlerine uygunluğunun doğrulandığı teyit edilmelidir. Bu işlem; izinli değerler, desenler ve aralıklar listesine karşı pozitif doğrulama ile ya da girdinin beklenen yapıya ve mantıksal sınırlara uygunluğunun önceden tanımlanmış kurallara göre karşılaştırılması ile yapılmalıdır. Seviye 1 için bu, güvenlik veya iş kararlarında kullanılan girdilere odaklanabilir. Seviye 2 ve üstü için tüm girdilere uygulanmalıdır.",1 -V2,Doğrulama ve İş Mantığı,V2.2,Girdi Doğrulama,V2.2.2,"Uygulamanın, güvenilir bir servis katmanında girdi doğrulama zorunluluğu uygulayacak şekilde tasarlandığı doğrulanmalıdır. İstemci tarafında gerçekleştirilen doğrulama, kullanılabilirliği artırabilir ve teşvik edilmelidir. Ancak bu doğrulama,güvenlik kontrolü olarak kabul edilmemelidir.",1 -V2,Doğrulama ve İş Mantığı,V2.2,Girdi Doğrulama,V2.2.3,"Uygulamanın, ilişkili veri öğelerinin önceden tanımlanmış kurallara göre makul olup olmadığını kontrol ettiği doğrulanmalıdır.",2 -V2,Doğrulama ve İş Mantığı,V2.3,İş Mantığı Güvenliği,V2.3.1,"Uygulamanın, aynı kullanıcı için iş mantığı akışlarını yalnızca beklenen adım sırasına göre ve adım atlamadan işlediği doğrulanmalıdır.",1 -V2,Doğrulama ve İş Mantığı,V2.3,İş Mantığı Güvenliği,V2.3.2,"İş mantığı sınırlarının, uygulama dokümantasyonuna uygun şekilde uygulandığı doğrulanmalıdır.",2 -V2,Doğrulama ve İş Mantığı,V2.3,İş Mantığı Güvenliği,V2.3.3,İş mantığı seviyesinde işlemlerin (transaction) kullanıldığı ve bir iş mantığı işleminin ya bütünüyle başarıyla tamamlandığı ya da önceki geçerli duruma geri döndürüldüğü (rollback) doğrulanmalıdır.,2 -V2,Doğrulama ve İş Mantığı,V2.3,İş Mantığı Güvenliği,V2.3.4,"İş mantığı düzeyinde kilitleme mekanizmalarının, sınırlı kaynakların (ör. sinema koltukları, teslimat zamanları) uygulamanın mantığı manipüle edilerek çift rezervasyona neden olmamasını sağladığı doğrulanmalıdır.",2 -V2,Doğrulama ve İş Mantığı,V2.3,İş Mantığı Güvenliği,V2.3.5,"Yüksek değerli iş mantığı akışlarının, yetkisiz veya kazara gerçekleşebilecek işlemleri önlemek için çoklu kullanıcı onayı gerektirdiği doğrulanmalıdır. Bu işlemler büyük para transferleri, sözleşme onayları, gizli bilgilere erişim veya üretimde güvenlik kurallarının geçersiz kılınmaları gibi durumları içerebilir.",3 -V2,Doğrulama ve İş Mantığı,V2.4,Otomasyon Karşıtı Önlemler,V2.4.1,"Uygulama işlevlerine yönelik aşırı miktardaki çağrılara karşı; veri sızdırma, anlamsız veri üretme, kota tüketme, hız sınırının aşılması, hizmet reddi (DoS) ya da maliyetli kaynakların aşırı kullanımı gibi risklere karşı otomasyon karşıtı kontrollerin bulunduğu doğrulanmalıdır.",2 -V2,Doğrulama ve İş Mantığı,V2.4,Otomasyon Karşıtı Önlemler,V2.4.2,"İş mantığı akışlarının, aşırı hızlı işlem gönderimlerini önleyecek şekilde gerçekçi insan zamanlaması gerektirdiği doğrulanmalıdır.",3 -V3,Web Ön Uç (Frontend) Güvenliği,V3.1,Web Frontend Güvenlik Dokümantasyonu,V3.1.1,"Uygulama dokümantasyonunda, uygulamayı kullanan tarayıcıların desteklemesi gereken güvenlik özelliklerinin (ör. HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) ve diğer ilgili HTTP güvenlik mekanizmaları) tanımlandığı doğrulanmalıdır. Ayrıca bu özelliklerin mevcut olmadığı durumlarda uygulamanın nasıl davranması gerektiği (ör. kullanıcıyı uyarmak veya erişimi engellemek) de tanımlanmalıdır.",3 -V3,Web Ön Uç (Frontend) Güvenliği,V3.2,İçeriğin Yanlış Yorumlanması,V3.2.1,"Tarayıcıların HTTP yanıtlarında içerik veya işlevi yanlış bir bağlamda sunmalarını önlemek amacıyla güvenlik kontrollerinin uygulandığı doğrulanmalıdır (ör. API, kullanıcı tarafından yüklenen dosya veya başka bir kaynağın doğrudan çağrılması durumunda). Olası kontroller arasında; yalnızca HTTP istek başlıklarının (ör. Sec-Fetch-\*) doğru bağlamı gösterdiği durumlarda içeriğin sunulması, Content-Security-Policy başlığında ""sandbox"" yönergesinin kullanılması veya Content-Disposition başlığında ""attachment"" biçiminin kullanılması yer alabilir.",1 -V3,Web Ön Uç (Frontend) Güvenliği,V3.2,İçeriğin Yanlış Yorumlanması,V3.2.2,"HTML yerine metin olarak görüntülenmesi amaçlanan içeriğin, HTML veya JavaScript gibi içeriklerin istenmeden çalıştırılmasını önleyecek şekilde ""createTextNode"" veya ""textContent"" gibi güvenli işleme fonksiyonlarıyla işlendiği doğrulanmalıdır.",1 -V3,Web Ön Uç (Frontend) Güvenliği,V3.2,İçeriğin Yanlış Yorumlanması,V3.2.3,"Uygulamanın istemci tarafı JavaScript kullanırken açık değişken tanımlamaları yaparak, sıkı tür kontrolü uygulayarak, global değişkenleri document nesnesine kaydetmekten kaçınarak ve ad alanı izolasyonu sağlayarak DOM clobbering’den kaçındığı doğrulanmalıdır.",3 -V3,Web Ön Uç (Frontend) Güvenliği,V3.3,Çerez Yapılandırması,V3.3.1,"Çerezlerin 'Secure' niteliğine sahip olduğu ve eğer çerez adı '\__Host-' ön eki ile başlamıyorsa, '__Secure-' ön ekinin kullanıldığı doğrulanmalıdır.",1 -V3,Web Ön Uç (Frontend) Güvenliği,V3.3,Çerez Yapılandırması,V3.3.2,"Kullanıcı arayüzü kandırma saldırılarına ve tarayıcı tabanlı istek sahteciliği saldırılarına (CSRF) karşı koruma sağlamak amacıyla, her çerezin 'SameSite' niteliğinin kullanım amacına uygun şekilde ayarlandığı doğrulanmalıdır.",2 -V3,Web Ön Uç (Frontend) Güvenliği,V3.3,Çerez Yapılandırması,V3.3.3,"Çerez adı, diğer sunucularla paylaşılmak üzere açıkça tasarlanmadığı sürece '__Host-' ön eki ile tanımlanmalıdır.",2 -V3,Web Ön Uç (Frontend) Güvenliği,V3.3,Çerez Yapılandırması,V3.3.4,"Bir çerez değeri istemci tarafı betikleri tarafından erişilememesi gereken bir veri içeriyorsa (ör. oturum token'ı), çerezin 'HttpOnly' niteliğine sahip olduğu ve aynı değerin (ör. oturum token'ı) yalnızca 'Set-Cookie' başlığı ile istemciye iletildiği doğrulanmalıdır.",2 -V3,Web Ön Uç (Frontend) Güvenliği,V3.3,Çerez Yapılandırması,V3.3.5,"Uygulama bir çerez oluştururken, çerez adı ve değerinin toplam uzunluğunun 4096 baytı aşmadığı doğrulanmalıdır. Çok büyük çerezler tarayıcı tarafından saklanmaz ve isteklerle gönderilmez; bu da çereze bağlı çalışan uygulama işlevlerinin bozulmasına yol açabilir.",3 -V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.2,"Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header'ı, uygulama tarafından sabit bir değer olarak tanımlanmalı veya gelen Origin header değeri güvenilir origin’lerden oluşan bir izinli listeye karşı doğrulanmalıdır. ‘Access-Control-Allow-Origin: *’ kullanılması gerekiyorsa, yanıtın hassas bilgi içermediği doğrulanmalıdır.",1 -V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.3,"HTTP yanıtlarında Content-Security-Policy header'ı bulunduğu ve bu header'ın yalnızca güvenilen içeriklerin veya kaynakların yüklenmesini ve çalıştırılmasını sağlayan yönergeler içerdiği doğrulanmalıdır. Minimum olarak ""global policy"", object-src 'none', base-uri 'none' yönergelerini içermeli ve izinli liste, nonce veya hash temelli bir yapı içermelidir. Seviye 3 uygulamalarında her yanıt için nonce veya hash içeren özel bir politika tanımlanmalıdır.",2 -V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.4,"Tüm HTTP yanıtlarının 'X-Content-Type-Options: nosniff' header'ını içerdiği doğrulanmalıdır. Bu, tarayıcıya içerik türünü tahmin etmeyi bırakmasını ve yanıtın Content-Type header'ında belirtilen MIME türünün, beklenen kaynak türüyle eşleşmesini zorunlu kılar. Ayrıca bu, tarayıcıda CORB (Cross-Origin Read Blocking) özelliğini etkinleştirir.",2 -V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.5,"Uygulamanın, 'Referer' başlığı yoluyla üçüncü taraflara teknik olarak hassas verilerin sızmasını önlemek için bir 'referrer policy' belirlediği doğrulanmalıdır. Bu, Referrer-Policy HTTP header'ıyla veya HTML öğe nitelikleriyle (element attributes) sağlanabilir. Sızabilecek hassas bilgiler, URL’deki yol ve sorgu parametreleri ile sınırlı uygulamalarda hostname bilgisini içerebilir.",2 -V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.6,"Uygulamanın, Content-Security-Policy header'ı altında 'frame-ancestors' yönergesini her HTTP yanıtında tanımladığı ve bu sayede içeriklerin varsayılan olarak başka sayfalara gömülmesini engellediği doğrulanmalıdır. Gerekli durumlarda özel olarak izin verildiğinden emin olunmalıdır. 'X-Frame-Options' header'ı, tarayıcılar tarafından desteklenmesine rağmen, artık güncel değildir ve güvenlik amacıyla kullanılmamalıdır.",2 -V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.8,"Bir belgenin işlenmesini ve sunulmasını başlatan tüm HTTP yanıtlarında (örneğin 'text/html' tipi yanıtlar), 'Cross-Origin-Opener-Policy' header'ı 'same-origin' veya 'same-origin-allow-popups' yönergeleriyle birlikte yer almalıdır. Bu, tabnabbing ve frame counting gibi, pencere nesnelerine paylaşımlı erişimi sömüren saldırılara karşı koruma sağlar.",3 -V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.1,"Uygulama, hassas işlevselliğe yönelik izinsiz cross-origin istekleri önlemek için CORS preflight mekanizmasına güvenmiyorsa, bu tür isteklerin gerçekten uygulamadan geldiği doğrulanmalıdır. Bu, anti-forgery token kullanımı veya CORS tarafından güvenli kabul edilmeyen özel HTTP header'larının zorunlu kılınmasıyla yapılabilir. Bu, tarayıcı tabanlı istek sahteciliği (CSRF) saldırılarına karşı bir savunmadır.",1 -V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.2,"Uygulama, hassas işlevlerin izinsiz cross-origin çağrılmasını önlemek için CORS preflight mekanizmasına güveniyorsa, bu işlevlerin bir CORS-preflight isteğini tetiklemeden çağrılamadığı doğrulanmalıdır. Bu, 'Origin' ve 'Content-Type' header'larının doğrulanmasını veya CORS-safelisted olmayan bir header'ın ve alanın kullanılmasını gerektirebilir.",1 -V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.4,"Farklı uygulamaların farklı hostname'lerde barındırıldığı ve böylece Same-Origin Policy tarafından sağlanan kısıtlamalardan (örneğin çerez erişim sınırları, kaynaklar arası etkileşim kontrolleri) faydalanıldığı doğrulanmalıdır.",2 -V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.6,"Uygulamanın herhangi bir yerinde JSONP işlevselliğinin etkin olmadığı doğrulanmalıdır. Bu, XSSI (Cross-Site Script Inclusion) saldırılarını önlemek içindir.",3 -V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.7,"Yetkilendirme gerektiren verilerin, JavaScript dosyaları gibi betik kaynaklarının yanıtlarında yer almadığı, XSSI saldırılarını önlemek için doğrulanmalıdır.",3 -V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.8,"Kimliği doğrulanmış kaynakların (örneğin görseller, videolar, betikler ve belgeler) yalnızca gerçekten amaçlandığında kullanıcı adına yüklenebildiği veya gömülebildiği doğrulanmalıdır. Bu, isteğin uygun olmayan bir çapraz kaynak çağrısından kaynaklanmadığından emin olmak için Sec-Fetch-* HTTP istek başlığı alanlarının sıkı bir şekilde doğrulanmasıyla veya tarayıcıya döndürülen içeriği engelleme talimatı vermek için kısıtlayıcı bir Cross-Origin-Resource-Policy HTTP yanıt başlığı alanı ayarlayarak gerçekleştirilebilir.",3 -V3,Web Ön Uç (Frontend) Güvenliği,V3.6,Harici Kaynak Bütünlüğü,V3.6.1,"JavaScript kütüphaneleri, CSS veya web fontları gibi istemci tarafı varlıkların yalnızca statik ve sürümlü olması, varlığın bütünlüğünü doğrulamak için Subresource Integrity (SRI) kullanılması durumunda harici olarak (örneğin, bir İçerik Dağıtım Ağı üzerinde) barındırıldığı doğrulanmalıdır. Bu mümkün değilse, her bir kaynak için bunu gerekçelendiren belgelenmiş bir güvenlik kararı bulunmalıdır.",3 -V3,Web Ön Uç (Frontend) Güvenliği,V3.7,Diğer Tarayıcı Güvenliği Hususları,V3.7.1,"Uygulamanın yalnızca hâlâ desteklenen ve güvenli kabul edilen istemci tarafı teknolojileri kullandığı doğrulanmalıdır. Bu gereksinimi karşılamayan teknolojilere örnek olarak NSAPI eklentileri, Flash, Shockwave, ActiveX, Silverlight, NACL veya istemci tarafı Java applet’leri verilebilir.",2 -V3,Web Ön Uç (Frontend) Güvenliği,V3.7,Diğer Tarayıcı Güvenliği Hususları,V3.7.2,"Uygulamanın, yalnızca hedef adres bir izinli listede yer alıyorsa kullanıcıyı otomatik olarak farklı bir ana makine adına veya uygulamanın kontrolünde olmayan bir etki alanına yönlendirdiği doğrulanmalıdır.",2 -V3,Web Ön Uç (Frontend) Güvenliği,V3.7,Diğer Tarayıcı Güvenliği Hususları,V3.7.3,"Uygulamanın, kullanıcı uygulamanın kontrolü dışındaki bir URL’ye yönlendirildiğinde, yönlendirme hakkında bir bildirim gösterdiği ve kullanıcının bu gezintiyi iptal edebilmesi için bir seçenek sunduğu doğrulanmalıdır.",3 -V3,Web Ön Uç (Frontend) Güvenliği,V3.7,Diğer Tarayıcı Güvenliği Hususları,V3.7.4,"Uygulamanın en üst düzey etki alanının (örneğin, site.tld) HTTP Strict Transport Security (HSTS) için genel preload listesine eklendiği doğrulanmalıdır. Bu, uygulamanın TLS kullanımının ana tarayıcılar tarafından doğrudan tanınmasını ve yalnızca Strict-Transport-Security yanıt header'ına bağlı kalınmamasını sağlar.",3 -V3,Web Ön Uç (Frontend) Güvenliği,V3.7,Diğer Tarayıcı Güvenliği Hususları,V3.7.5,"Uygulamaya erişen tarayıcının beklenen güvenlik özelliklerini desteklememesi durumunda, uygulamanın dokümantasyona uygun şekilde davrandığı (örneğin kullanıcıyı uyarma veya erişimi engelleme) doğrulanmalıdır.",3 -V4,API ve Web Servisi,V4.1,Genel Web Servisi Güvenliği,V4.1.1,"İleti gövdesi içeren her HTTP yanıtında, yanıtın gerçek içeriğiyle eşleşen bir Content-Type header alanı bulunduğu ve güvenli karakter kodlamasını (örneğin, UTF-8, ISO-8859-1) belirtmek üzere charset parametresi içerdiği doğrulanmalıdır. Bu işlem, IANA Medya Türleri'nden ""text/"", ""/+xml"" ve ""/xml"" gibi içerikler için geçerlidir.",1 -V4,API ve Web Servisi,V4.1,Genel Web Servisi Güvenliği,V4.1.2,"Yalnızca kullanıcı arayüzüne yönelik uç noktaların (manuel olarak web tarayıcısı ile erişilmesi amaçlanan) otomatik olarak HTTP'den HTTPS'e yönlendirme yaptığı ve diğer hizmetlerin veya uç noktaların şeffaf yönlendirme gerçekleştirmediği doğrulanmalıdır. Bu, istemcinin farkında olmadan şifrelenmemiş HTTP istekleri göndermesi ve bu isteklerin otomatik olarak HTTPS'e yönlendirilmesi sonucunda hassas verilerin sızmasının fark edilmemesi riskini önlemek içindir.",2 -V4,API ve Web Servisi,V4.1,Genel Web Servisi Güvenliği,V4.1.3,"Uygulama tarafından kullanılan ve yük dengeleyici, web proxy veya frontend için backend hizmeti gibi bir ara katman tarafından ayarlanan herhangi bir HTTP başlık alanının, son kullanıcı tarafından geçersiz kılınamayacağı doğrulanmalıdır. Örnek başlıklar arasında X-Real-IP, X-Forwarded-* veya X-User-ID yer alabilir.",2 -V4,API ve Web Servisi,V4.1,Genel Web Servisi Güvenliği,V4.1.4,Uygulama veya API tarafından açıkça desteklenen HTTP yöntemlerinin (preflight istekleri sırasında OPTIONS dahil) dışında hiçbir yöntemin kullanılmadığı ve kullanılmayan yöntemlerin engellendiği doğrulanmalıdır.,3 -V4,API ve Web Servisi,V4.1,Genel Web Servisi Güvenliği,V4.1.5,"Çok hassas istekler veya birçok sistemden geçen işlemler için, taşıma katmanı güvenliğinin üzerine ek bir güvence sağlamak amacıyla, her iletiye özel dijital imzaların kullanıldığı doğrulanmalıdır.",3 -V4,API ve Web Servisi,V4.2,HTTP İleti Yapısı Doğrulama,V4.2.1,"Tüm uygulama bileşenlerinin (yük dengeleyiciler, güvenlik duvarları ve uygulama sunucuları dahil) HTTP sürümüne uygun mekanizmaları kullanarak gelen HTTP iletilerinin sınırlarını belirlediği ve bu sayede HTTP istek kaçakçılığına karşı koruma sağlandığı doğrulanmalıdır. HTTP/1.x sürümünde Transfer-Encoding başlık alanı varsa, RFC 2616'ya göre Content-Length başlığı göz ardı edilmelidir. HTTP/2 veya HTTP/3 kullanıldığında, Content-Length başlığı varsa, alıcının bu değerin DATA çerçevelerinin uzunluğuyla tutarlı olduğunu doğrulaması gerekir.",2 -V4,API ve Web Servisi,V4.2,HTTP İleti Yapısı Doğrulama,V4.2.2,"HTTP iletileri üretilirken, Content-Length başlığının, HTTP protokolünün çerçeveleme yöntemine göre belirlenen içerik uzunluğu ile çelişmediği doğrulanmalıdır. Bu, istek kaçakçılığı saldırılarını önlemek için gereklidir.",3 -V4,API ve Web Servisi,V4.2,HTTP İleti Yapısı Doğrulama,V4.2.3,"Uygulamanın, yanıt bölme ve header enjeksiyonu saldırılarını önlemek amacıyla, bağlantıya özel başlık alanları (örneğin Transfer-Encoding) içeren HTTP/2 veya HTTP/3 iletilerini göndermediği ve kabul etmediği doğrulanmalıdır.",3 -V4,API ve Web Servisi,V4.2,HTTP İleti Yapısı Doğrulama,V4.2.4,"Uygulamanın yalnızca başlık alanları ve değerleri CR (\r), LF (\n) veya CRLF (\r\n) karakter dizileri içermeyen HTTP/2 ve HTTP/3 isteklerini kabul ettiği doğrulanmalıdır. Bu, başlık enjeksiyonu saldırılarını önlemek içindir.",3 -V4,API ve Web Servisi,V4.2,HTTP İleti Yapısı Doğrulama,V4.2.5,"Uygulama (backend veya frontend) istek oluşturuyor ve gönderiyorsa, URI'ler (örneğin API çağrıları için) veya HTTP istek başlıkları (örneğin Authorization veya Cookie) gibi bileşenlerin, alıcı sistemler tarafından kabul edilemeyecek kadar uzun olmamasını sağlamak amacıyla doğrulama, temizleme veya diğer mekanizmaları kullandığı doğrulanmalıdır. Bu tür çok uzun istekler (örneğin çok uzun bir Cookie başlığı) gönderildiğinde sunucunun sürekli hata durumu döndürmesiyle hizmet reddi oluşabilir.",3 -V4,API ve Web Servisi,V4.3,GraphQL,V4.3.1,"Maliyetli ve iç içe geçmiş sorgular sonucu oluşabilecek GraphQL veya veri katmanı ifadelerine yönelik Hizmet Reddi (DoS) saldırılarını önlemek için, sorgu izin listesi (allowlist), derinlik sınırlandırması, sorgu sayısı sınırlandırması veya sorgu maliyeti analizi kullanıldığı doğrulanmalıdır.",2 -V4,API ve Web Servisi,V4.3,GraphQL,V4.3.2,"GraphQL introspection (iç yapı sorgulama) sorgularının, GraphQL API'nin üçüncü taraflar tarafından kullanılmasına yönelik olmadığı sürece, üretim ortamında devre dışı bırakıldığı doğrulanmalıdır.",2 -V4,API ve Web Servisi,V4.4,WebSocket,V4.4.1,Tüm WebSocket bağlantılarında TLS üzerinden WebSocket (WSS) kullanıldığı doğrulanmalıdır.,1 -V4,API ve Web Servisi,V4.4,WebSocket,V4.4.2,"WebSocket'in başlangıçtaki HTTP el sıkışması (handshake) sırasında, Origin başlık alanının uygulama için izin verilen origin listesiyle karşılaştırılarak kontrol edildiği doğrulanmalıdır.",2 -V4,API ve Web Servisi,V4.4,WebSocket,V4.4.3,"Uygulamanın standart oturum yönetimi kullanılamıyorsa, bunun yerine ilgili Oturum Yönetimi güvenlik gereksinimlerine uygun özel token'ların kullanıldığı doğrulanmalıdır.",2 -V4,API ve Web Servisi,V4.4,WebSocket,V4.4.4,"HTTPS oturumu WebSocket kanalına geçerken, özel WebSocket oturum yönetim token’larının önceki şekilde kimliği doğrulanmış HTTPS oturumu aracılığıyla elde edildiği veya doğrulandığı doğrulanmalıdır.",2 -V5,Dosya İşleme,V5.1,Dosya İşleme Dokümantasyonu,V5.1.1,"Dokümantasyonun, her yükleme özelliği için izin verilen dosya türlerini, beklenen dosya uzantılarını ve maksimum boyutu (açılmış hali dahil) tanımladığı doğrulanmalıdır. Ayrıca, dosyaların son kullanıcılar için nasıl güvenli hâle getirileceği (örneğin kötü amaçlı bir dosya tespit edildiğinde uygulamanın nasıl davranacağı) gibi bilgilerin de belgede yer aldığı doğrulanmalıdır.",2 -V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.1,"Uygulamanın, yalnızca performans kaybına veya hizmet reddine yol açmayacak boyuttaki dosyaları kabul ettiği doğrulanmalıdır.",1 -V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.2,"Uygulama bir dosyayı, doğrudan veya bir arşiv (ör. zip dosyası) içinde kabul ettiğinde, dosya uzantısının beklenen uzantıyla eşleşip eşleşmediğini kontrol ettiği ve içeriğin uzantı tarafından temsil edilen türle uyumlu olduğunu doğruladığı kontrol edilmelidir. Bu; ilk 'magic byte' kontrolü, görüntü yeniden yazımı ve dosya içeriği doğrulama için özel kütüphanelerin kullanımı gibi yöntemleri içerir. Seviye 1 için bu, yalnızca iş veya güvenlik kararlarında kullanılan dosyalarla sınırlı olabilir. Seviye 2 ve üzeri için tüm dosyalar bu kontrole tabi olmalıdır.",1 -V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.3,"Sıkıştırılmış dosyaların (ör. zip, gz, docx, odt) açılmadan önce, izin verilen maksimum açılmış boyuta ve maksimum dosya sayısına göre kontrol edildiği doğrulanmalıdır.",2 -V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.4,Her kullanıcı için dosya boyutu kotası ve maksimum dosya sayısının uygulandığı doğrulanmalıdır. Böylece tek bir kullanıcının çok sayıda veya aşırı büyük dosya yükleyerek depolama alanını doldurması engellenir.,3 -V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.5,"Uygulamanın, içinde sembolik bağlantılar (symlink) bulunan sıkıştırılmış dosyaların yüklenmesine yalnızca bu durum özel olarak gerekli olduğunda izin verdiği doğrulanmalıdır. Bu durumda, sembolik bağlantı verilebilecek dosyaların bir izinli listesi uygulanmalıdır.",3 -V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.6,"Uygulamanın, piksel boyutu izin verilen maksimum değeri aşan görüntü dosyalarının yüklenmesini reddettiği doğrulanmalıdır. Bu, pixel flood saldırılarını önlemek için gereklidir.",3 -V5,Dosya İşleme,V5.3,Dosya Depolama,V5.3.1,"Güvenilmeyen girdilerle yüklenen veya oluşturulan ve herkese açık klasörlerde depolanan dosyaların, bir HTTP isteğiyle doğrudan erişildiğinde sunucu taraflı program kodu olarak çalıştırılmadığı doğrulanmalıdır.",1 -V5,Dosya İşleme,V5.3,Dosya Depolama,V5.3.2,"Uygulamanın, dosya işlemleri için dosya yollarını oluştururken kullanıcı tarafından gönderilen dosya adlarını değil, dahili olarak oluşturulan veya güvenilir verileri kullandığı; eğer kullanıcı tarafından gönderilen dosya adları veya meta veriler kullanılacaksa, sıkı doğrulama ve temizleme işlemlerinin uygulandığı doğrulanmalıdır. Bu, yol geçişi (path traversal), yerel veya uzak dosya dahil etme (LFI, RFI) ve sunucu tarafı istek sahteciliği (SSRF) saldırılarına karşı koruma sağlar.",1 -V5,Dosya İşleme,V5.3,Dosya Depolama,V5.3.3,"Sunucu tarafında gerçekleşen dosya işlemlerinin (örneğin dosya açma/decompress işlemi), kullanıcı tarafından sağlanan yol bilgilerini yok saydığı ve zip slip gibi güvenlik açıklarını önlediği doğrulanmalıdır.",3 -V5,Dosya İşleme,V5.4,Dosya İndirme,V5.4.1,"Uygulamanın, kullanıcı tarafından gönderilen dosya adlarını (ör. JSON, JSONP veya URL parametresinde) doğruladığı veya göz ardı ettiği ve yanıtın Content-Disposition başlık alanında bir dosya adı belirttiği doğrulanmalıdır.",2 -V5,Dosya İşleme,V5.4,Dosya İndirme,V5.4.2,"Sunulan dosya adlarının (örneğin HTTP yanıt header'larında veya e-posta eklerinde), belge yapısını korumak ve enjeksiyon saldırılarını önlemek için kodlandığı veya temizlendiği (ör. RFC 6266’ya uygun) doğrulanmalıdır.",2 -V5,Dosya İşleme,V5.4,Dosya İndirme,V5.4.3,"Güvenilmeyen kaynaklardan elde edilen dosyaların, bilinen kötü amaçlı içeriklerin sunulmasını önlemek amacıyla antivirüs tarayıcılarıyla tarandığı doğrulanmalıdır.",2 -V6,Kimlik Doğrulama,V6.1,Kimlik Doğrulama Dokümantasyonu,V6.1.1,"Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırılarına karşı oran sınırlama (rate limiting), otomasyon karşıtı önlemler ve uyarlanabilir yanıt gibi kontrollerin nasıl kullanıldığını açıklayan bir uygulama dokümantasyonu bulunduğu doğrulanmalıdır. Dokümantasyon, bu kontrollerin nasıl yapılandırıldığını ve kötü niyetli hesap kilitlemenin nasıl önlendiğini açıkça ortaya koymalıdır.",1 -V6,Kimlik Doğrulama,V6.1,Kimlik Doğrulama Dokümantasyonu,V6.1.2,"Parolalarda kullanılmasını önlemek amacıyla, bağlama özgü sözcüklerin (örneğin kurum adlarının permütasyonları, ürün adları, sistem tanımlayıcıları, proje kod adları, departman veya rol adları vb.) bulunduğu belgelenmiş bir liste mevcut olduğu doğrulanmalıdır.",2 -V6,Kimlik Doğrulama,V6.1,Kimlik Doğrulama Dokümantasyonu,V6.1.3,"Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, bunların tümünün belgelenmiş olduğu ve her yol için tutarlı şekilde uygulanması gereken güvenlik kontrolleri ile kimlik doğrulama gücünün tanımlandığı doğrulanmalıdır.",2 -V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.1,"Kullanıcı tarafından belirlenen parolaların en az 8 karakter uzunluğunda olması sağlanmalı, ancak 15 karakter ve üzeri uzunlukta parolalar olmaları şiddetle tavsiye edilir.",1 -V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.2,Kullanıcıların parolalarını değiştirebilmeleri sağlanmalıdır.,1 -V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.3,Parola değiştirme işlevinin hem mevcut hem de yeni parolayı gerektirdiği doğrulanmalıdır.,1 -V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.4,"Kayıt veya parola değişimi sırasında girilen parolaların, uygulamanın parola politikasına (örneğin minimum uzunluk) uyan ilk 3000 yaygın parolaya karşı kontrol edildiği doğrulanmalıdır.",1 -V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.5,"Her tür karakterin kullanılmasına izin verildiği ve büyük/küçük harf, sayı veya özel karakter şartlarının zorunlu tutulmadığı doğrulanmalıdır.",1 -V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.6,"Parola giriş alanlarının, girdiyi maskelemek için ""type=password"" kullandığı doğrulanmalıdır. Uygulamalar, kullanıcının tüm maskelenmiş parolayı ya da son girilen karakteri geçici olarak görüntülemesine izin verebilir.",1 -V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.7,"""Yapıştır"" özelliğinin, tarayıcı parola yardımcılarının ve harici parola yöneticilerinin kullanımına izin verildiği doğrulanmalıdır.",1 -V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.8,"Uygulamanın, kullanıcıdan aldığı parolayı herhangi bir şekilde değiştirmeden, örneğin kesmeden veya harf büyüklüğünü değiştirmeden, tam olarak doğruladığı teyit edilmelidir.",1 -V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.9,En az 64 karakter uzunluğundaki parolalara izin verildiği doğrulanmalıdır.,2 -V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.10,"Kullanıcının parolasının, yalnızca ele geçirildiği tespit edildiğinde veya kullanıcı tarafından yenilendiğinde geçerliliğini yitirdiği doğrulanmalıdır. Uygulama, belirli aralıklarla parola yenilenmesini zorunlu kılmamalıdır.",2 -V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.11,"Tahmin edilmesi kolay parolaların oluşturulmasını önlemek amacıyla, bağlama özgü kelimelerin yer aldığı belgelenmiş listenin parola doğrulamada kullanıldığı teyit edilmelidir.",2 -V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.12,"Kayıt veya parola değişikliği sırasında girilen parolaların, ele geçirilmiş parolalar listesine karşı kontrol edildiği doğrulanmalıdır.",2 -V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.1,"Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırıları gibi saldırıları önlemeye yönelik kontrollerin, uygulamanın güvenlik dokümantasyonuna göre uygulandığı doğrulanmalıdır.",1 -V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.2,"""root"", ""admin"" veya ""sa"" gibi varsayılan kullanıcı hesaplarının uygulamada yer almadığı veya devre dışı bırakıldığı doğrulanmalıdır.",1 -V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.3,"Uygulamaya erişim için ya çok faktörlü bir kimlik doğrulama mekanizması ya da tek faktörlü mekanizmaların kombinasyonu kullanılmalıdır. Seviye 3 için, bu faktörlerden biri, oltalama saldırılarına karşı direnç sağlayan ve kimlik doğrulama niyetini bir kullanıcı etkileşimi (örneğin FIDO donanım anahtarında bir düğmeye basma veya mobil telefonda bir onay) gerektirerek doğrulayan donanım tabanlı bir kimlik doğrulayıcı olmalıdır. Bu gereksinimdeki herhangi bir esneklik için, gerekçesi belgelenmiş ve riskleri azaltıcı kapsamlı kontroller içeren bir plan gereklidir.",2 -V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.4,"Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, belgelendirilmemiş bir yol bulunmadığı ve tüm yollar için güvenlik kontrolleri ile kimlik doğrulama gücünün tutarlı şekilde uygulandığı doğrulanmalıdır.",2 -V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.5,"Başarılı veya başarısız şüpheli kimlik doğrulama girişimlerinin kullanıcıya bildirildiği doğrulanmalıdır. Bu, olağandışı bir konum veya istemciden gelen girişimler, yalnızca bir faktörle yapılan kısmen başarılı doğrulamalar, uzun süreli inaktiflik sonrası yapılan girişimler veya birçok başarısız denemeden sonraki başarılı girişimler gibi durumları içerebilir.",3 -V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.6,"E-postanın, tek faktörlü ya da çok faktörlü kimlik doğrulama mekanizması olarak kullanılmadığı doğrulanmalıdır.",3 -V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.7,"Kimlik doğrulama detaylarında yapılan güncellemeler sonrasında (örneğin kimlik bilgisi sıfırlama, kullanıcı adı veya e-posta adresi değişiklikleri), kullanıcıların bilgilendirildiği doğrulanmalıdır.",3 -V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.8,"Başarısız kimlik doğrulama girişimlerinden, geçerli kullanıcıların hata mesajları, HTTP yanıt kodları veya farklı yanıt süreleri gibi sonuçlara dayanarak tespit edilemediği doğrulanmalıdır. Bu koruma, kayıt ve ""parolamı unuttum"" işlevselliğinde de geçerli olmalıdır.",3 -V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.1,"Sistem tarafından oluşturulan ilk parolaların veya etkinleştirme kodlarının güvenli bir şekilde rastgele üretildiği, mevcut parola politikasına uygun olduğu, kısa bir süre içinde veya ilk kullanım sonrasında geçerliliğini yitirdiği doğrulanmalıdır. Bu başlangıç sırları uzun vadeli parola olarak kullanılmasına izin verilmemelidir.",1 -V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.2,"Parola ipuçlarının veya ""gizli sorular"" olarak bilinen, bilgiye dayalı kimlik doğrulama mekanizmalarının mevcut olmadığı doğrulanmalıdır.",1 -V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.3,"Unutulmuş parolanın sıfırlanması için, etkin olan çok faktörlü kimlik doğrulama mekanizmalarını atlamayan güvenli bir sürecin uygulandığı doğrulanmalıdır.",2 -V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.4,"Çok faktörlü kimlik doğrulama faktörlerinden biri kaybolursa, kayıt sırasında uygulanan kimlik kanıtlama seviyesiyle aynı seviyede kimlik doğrulama yapıldığı doğrulanmalıdır.",2 -V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.5,"Süresi dolacak kimlik doğrulama mekanizmalarının yenilenmesine ilişkin talimatların, süresi dolmadan önce tamamlanacak şekilde yeterli sürede gönderildiği ve gerekiyorsa otomatik hatırlatıcıların yapılandırıldığı doğrulanmalıdır.",3 -V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.6,"Yönetici yetkisi olan kullanıcıların, kullanıcının parola sıfırlama sürecini başlatabildiği ancak kullanıcının yeni parolasını belirleyemediği veya değiştiremediği doğrulanmalıdır. Bu, yönetici yetkisi olan kullanıcıların, kullanıcı parolasını bilmesini engeller.",3 -V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.1,"Arama sırları, bant dışı kimlik doğrulama istekleri veya kodları ve zamana dayalı tek kullanımlık parolaların (TOTP) yalnızca bir kez kullanılabildiği doğrulanmalıdır.",2 -V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.2,"Uygulamanın backend tarafında saklanırken, 112 bitten az entropiye sahip (örneğin 19 rastgele harf-rakam karakteri veya 34 rastgele rakam) arama sırlarının, 32-bit rastgele bir salt içeren onaylı bir parola saklama algoritmasıyla hash’lendiği doğrulanmalıdır. Gizli bilginin entropisi 112 bit veya daha fazlaysa standart bir hash fonksiyonu kullanılabilir.",2 -V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.3,"Arama sırları, bant dışı kimlik doğrulama kodları ve zamana dayalı tek kullanımlık parola seed'lerinin, öngörülebilir değerlerden kaçınmak için Kriptografik Olarak Güvenli Sözde Rastgele Sayı Üreteci (CSPRNG) ile oluşturulduğu doğrulanmalıdır.",2 -V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.4,Arama sırlarının ve bant dışı kimlik doğrulama kodlarının en az 20 bit entropiye (genellikle 4 rastgele harf-rakam karakteri veya 6 rastgele rakam) sahip olduğu doğrulanmalıdır.,2 -V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.5,"Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının ve zamana dayalı tek kullanımlık parolaların (TOTP) belirli bir ömre sahip olduğu doğrulanmalıdır. Bant dışı istekler en fazla 10 dakika, TOTP’ler ise en fazla 30 saniye geçerli olmalıdır.",2 -V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.6,Herhangi bir kimlik doğrulama faktörünün (fiziksel cihazlar dahil) çalınması veya kaybı durumunda iptal edilebildiği doğrulanmalıdır.,3 -V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.7,"Biyometrik kimlik doğrulama mekanizmalarının yalnızca ikincil faktör olarak, “sahip olduğunuz bir şey” veya “bildiğiniz bir şey” ile birlikte kullanıldığı doğrulanmalıdır.",3 -V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.8,"Zamana dayalı tek kullanımlık parolaların (TOTP) doğrulamasının, güvenilir bir hizmetten alınan zaman kaynağına dayanarak yapıldığı ve güvenilir olmayan veya istemci tarafından sağlanan zaman kaynağına dayanmadığı doğrulanmalıdır.",3 -V6,Kimlik Doğrulama,V6.6,Bant Dışı Kimlik Doğrulama Mekanizmaları,V6.6.1,"Tek kullanımlık parolaların (OTP) telefon veya SMS ile Public Switched Telephone Network (PSTN) üzerinden iletildiği kimlik doğrulama mekanizmalarının, yalnızca telefon numarası önceden doğrulanmışsa, alternatif daha güçlü yöntemler (örneğin TOTP) de sunuluyorsa ve kullanıcıya güvenlik riskleri hakkında bilgi veriliyorsa sunulduğu doğrulanmalıdır. Seviye 3 uygulamalar için telefon ve SMS seçenekleri sunulmamalıdır.",2 -V6,Kimlik Doğrulama,V6.6,Bant Dışı Kimlik Doğrulama Mekanizmaları,V6.6.2,"Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının, oluşturuldukları özgün kimlik doğrulama isteğiyle bağlantılı olduğu ve daha önceki ya da sonraki bir istek için kullanılamadığı doğrulanmalıdır.",2 -V6,Kimlik Doğrulama,V6.6,Bant Dışı Kimlik Doğrulama Mekanizmaları,V6.6.3,"Kod tabanlı bant dışı kimlik doğrulama mekanizmalarının, oran sınırlaması ile kaba kuvvet saldırılarına karşı korunduğu doğrulanmalıdır. En az 64 bit entropiye sahip kodlar kullanılması da değerlendirilmelidir.",2 -V6,Kimlik Doğrulama,V6.6,Bant Dışı Kimlik Doğrulama Mekanizmaları,V6.6.4,"Çok faktörlü kimlik doğrulama için push bildirimleri kullanılıyorsa, push bombing saldırılarına karşı oran sınırlamasının kullanıldığı doğrulanmalıdır. “Numara eşleştirme” de bu riski azaltabilir.",3 -V6,Kimlik Doğrulama,V6.7,Kriptografik Kimlik Doğrulama Mekanizması,V6.7.1,"Kriptografik kimlik doğrulama beyanlarını doğrulamak için kullanılan sertifikaların, değiştirilmeye karşı korumalı şekilde saklandığı doğrulanmalıdır.",3 -V6,Kimlik Doğrulama,V6.7,Kriptografik Kimlik Doğrulama Mekanizması,V6.7.2,Challenge nonce değerinin en az 64 bit uzunluğunda olduğu ve istatistiksel olarak benzersiz ya da cihazın ömrü boyunca benzersiz olduğu doğrulanmalıdır.,3 -V6,Kimlik Doğrulama,V6.8,Kimlik Sağlayıcısı ile Kimlik Doğrulama,V6.8.1,"Uygulama birden fazla kimlik sağlayıcıyı (IdP) destekliyorsa, başka bir desteklenen kimlik sağlayıcı aracılığıyla (örneğin aynı kullanıcı tanımlayıcısını kullanarak) kullanıcının kimliğinin taklit edilemediği doğrulanmalıdır. Standart önlem, uygulamanın kullanıcıyı IdP kimliği (bir ad alanı işlevi görür) ve IdP içindeki kullanıcı kimliğinin birleşimiyle kaydetmesi ve tanımlamasıdır.",2 -V6,Kimlik Doğrulama,V6.8,Kimlik Sağlayıcısı ile Kimlik Doğrulama,V6.8.2,Kimlik doğrulama beyanları üzerindeki dijital imzaların (örneğin JWT veya SAML beyanları) varlığı ve bütünlüğünün her zaman doğrulandığı ve imzasız veya geçersiz imzalı beyanların reddedildiği doğrulanmalıdır.,2 -V6,Kimlik Doğrulama,V6.8,Kimlik Sağlayıcısı ile Kimlik Doğrulama,V6.8.3,"SAML beyanlarının benzersiz biçimde işlendiği ve yalnızca geçerlilik süresi içinde bir kez kullanıldığı, tekrar oynatma (replay) saldırılarını önlemek amacıyla doğrulanmalıdır.",2 -V6,Kimlik Doğrulama,V6.8,Kimlik Sağlayıcısı ile Kimlik Doğrulama,V6.8.4,"Uygulama ayrı bir Kimlik Sağlayıcı (IdP) kullanıyorsa ve belirli işlemler için belirli kimlik doğrulama gücü, yöntemleri veya zaman bilgisi bekliyorsa, uygulamanın bu bilgileri IdP tarafından döndürülen veriler üzerinden doğruladığı teyit edilmelidir. Örneğin OIDC kullanılıyorsa, bu durum ID Token üzerindeki 'acr', 'amr' ve 'auth_time' gibi claim’lerin (varsa) doğrulanması ile sağlanabilir. Eğer IdP bu bilgileri sağlamıyorsa, uygulamanın asgari kimlik doğrulama gücünün kullanıldığını varsayan (örneğin yalnızca kullanıcı adı ve parola ile tek faktörlü doğrulama) belgelenmiş bir yedek yaklaşımı olmalıdır.",2 -V7,Oturum Yönetimi,V7.1,Oturum Yönetim Dokümantasyonu,V7.1.1,"Kullanıcının oturum inaktivite zaman aşımı süresi ve mutlak maksimum oturum süresinin belgelendiği, diğer kontrollerle birlikte uygun olduğu ve NIST SP 800-63B yeniden kimlik doğrulama gereksinimlerinden herhangi bir sapma varsa gerekçesinin belgede yer aldığı doğrulanmalıdır.",2 -V7,Oturum Yönetimi,V7.1,Oturum Yönetim Dokümantasyonu,V7.1.2,"Belgede bir hesap için kaç adet eşzamanlı (paralel) oturuma izin verildiği ile birlikte, maksimum aktif oturum sayısına ulaşıldığında uygulanacak davranış ve işlemlerin tanımlandığı doğrulanmalıdır.",2 -V7,Oturum Yönetimi,V7.1,Oturum Yönetim Dokümantasyonu,V7.1.3,"Birleşik kimlik yönetim ekosisteminin bir parçası olarak kullanıcı oturumu oluşturan ve yöneten tüm sistemlerin, oturum ömrü, sonlandırma ve yeniden kimlik doğrulama gerektiren diğer koşulların nasıl koordine edildiğini açıklayan kontrollerle birlikte belgede yer aldığı doğrulanmalıdır.",2 -V7,Oturum Yönetimi,V7.2,Temel Oturum Yönetimi Güvenliği,V7.2.1,Uygulamanın tüm oturum token'ı doğrulama işlemlerini güvenilir bir backend servisi aracılığıyla gerçekleştirdiği doğrulanmalıdır.,1 -V7,Oturum Yönetimi,V7.2,Temel Oturum Yönetimi Güvenliği,V7.2.2,"Uygulamanın, statik API gizli anahtarları veya sabit değerler yerine, oturum yönetimi için dinamik olarak oluşturulan kendi kendine yeterli veya referans token'ları kullandığı doğrulanmalıdır.",1 -V7,Oturum Yönetimi,V7.2,Temel Oturum Yönetimi Güvenliği,V7.2.3,"Uygulama kullanıcı oturumlarını temsil etmek için referans token'ları kullanıyorsa, bu token'ların benzersiz olduğu, kriptografik olarak güvenli bir sözde rastgele sayı üreteci (CSPRNG) kullanılarak üretildiği ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır.",1 -V7,Oturum Yönetimi,V7.2,Temel Oturum Yönetimi Güvenliği,V7.2.4,"Uygulamanın, kullanıcı kimlik doğrulaması (yeniden kimlik doğrulama dahil) sırasında yeni bir oturum token'ı oluşturduğu ve mevcut oturum token'ını sonlandırdığı doğrulanmalıdır.",1 -V7,Oturum Yönetimi,V7.3,Oturum Zaman Aşımı,V7.3.1,Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde bir hareketsizlik zaman aşımı bulunduğu doğrulanmalıdır.,2 -V7,Oturum Yönetimi,V7.3,Oturum Zaman Aşımı,V7.3.2,Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde mutlak bir maksimum oturum süresi bulunduğu doğrulanmalıdır.,2 -V7,Oturum Yönetimi,V7.4,Oturum Sonlandırma,V7.4.1,"Oturum sonlandırma tetiklendiğinde (örneğin, çıkış yapıldığında veya süre dolduğunda), uygulamanın oturumun daha fazla kullanılmasına izin vermediği doğrulanmalıdır. Referans token'lar veya durum bilgili oturumlar için bu, oturum verilerinin uygulama arka ucunda geçersiz kılınması anlamına gelir. Kapsamlı token kullanan uygulamaların; sonlandırılmış token listesi tutmak, kullanıcıya özel tarih ve saatten önce oluşturulan token'ları reddetmek veya kullanıcıya özel imzalama anahtarını yenilemek gibi bir çözüm uygulaması gerekir.",1 -V7,Oturum Yönetimi,V7.4,Oturum Sonlandırma,V7.4.2,"Bir kullanıcı hesabı devre dışı bırakıldığında veya silindiğinde (örneğin bir çalışanın şirketten ayrılması), uygulamanın tüm aktif oturumları sonlandırdığı doğrulanmalıdır.",1 -V7,Oturum Yönetimi,V7.4,Oturum Sonlandırma,V7.4.3,"Herhangi bir kimlik doğrulama faktörünün başarılı bir şekilde değiştirilmesi veya kaldırılmasından (şifre sıfırlama veya kurtarma yoluyla yapılan değişiklikler dahil ve varsa MFA ayarları güncellemeleri dahil) sonra, uygulamanın diğer tüm aktif oturumları sonlandırma seçeneği sunduğu doğrulanmalıdır.",2 -V7,Oturum Yönetimi,V7.4,Oturum Sonlandırma,V7.4.4,Kimlik doğrulama gerektiren tüm sayfalarda kolay erişilebilir ve görünür bir çıkış yap (logout) işlevi bulunduğu doğrulanmalıdır.,2 -V7,Oturum Yönetimi,V7.4,Oturum Sonlandırma,V7.4.5,"Uygulama yöneticilerinin, bireysel bir kullanıcının veya tüm kullanıcıların aktif oturumlarını sonlandırabilme yetkisine sahip olduğu doğrulanmalıdır.",2 -V7,Oturum Yönetimi,V7.5,Oturum Kötüye Kullanımına Karşı Savunmalar,V7.5.1,"E-posta adresi, telefon numarası, MFA yapılandırması veya hesap kurtarmada kullanılan diğer bilgiler gibi kimlik doğrulamayı etkileyebilecek hassas hesap özniteliklerinde değişiklik yapılmadan önce uygulamanın tam yeniden kimlik doğrulama gerektirdiği doğrulanmalıdır.",2 -V7,Oturum Yönetimi,V7.5,Oturum Kötüye Kullanımına Karşı Savunmalar,V7.5.2,"Kullanıcıların, (en az bir faktörle yeniden kimlik doğrulama yaptıktan sonra) mevcut tüm aktif oturumları görüntüleyebilmesi ve sonlandırabilmesinin mümkün olduğu doğrulanmalıdır.",2 -V7,Oturum Yönetimi,V7.5,Oturum Kötüye Kullanımına Karşı Savunmalar,V7.5.3,"Uygulamanın, son derece hassas işlemler veya operasyonlar gerçekleştirilmeden önce en az bir faktörle ek kimlik doğrulaması veya ikincil bir doğrulama gerektirdiği doğrulanmalıdır.",3 -V7,Oturum Yönetimi,V7.6,Birleşik Yeniden Kimlik Doğrulama,V7.6.1,"Güvenen Taraf (RP) ile Kimlik Sağlayıcı (IdP) arasındaki oturum süresi ve oturum sonlandırma davranışlarının belgelenmiş olduğu ve, örneğin IdP kimlik doğrulama olayları arasında maksimum süreye ulaşıldığında yeniden kimlik doğrulamanın gerekli kılındığı doğrulanmalıdır.",2 -V7,Oturum Yönetimi,V7.6,Birleşik Yeniden Kimlik Doğrulama,V7.6.2,"Yeni bir oturum oluşturulmasının, kullanıcı onayı veya açık bir eylem gerektirdiği; kullanıcı etkileşimi olmaksızın yeni uygulama oturumlarının oluşturulmasının önlendiği doğrulanmalıdır.",2 -V8,Yetkilendirme,V8.1,Yetkilendirme Dokümantasyonu,V8.1.1,"Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak işlev düzeyinde ve veriye özel erişim kısıtlamaları için kuralları tanımladığı doğrulanmalıdır.",1 -V8,Yetkilendirme,V8.1,Yetkilendirme Dokümantasyonu,V8.1.2,"Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak alan (field) düzeyinde erişim kısıtlamaları (hem okuma hem yazma) için kuralları tanımladığı doğrulanmalıdır. Bu kuralların, ilgili veri nesnesinin durum veya statü gibi diğer özniteliklerine bağlı olabileceği unutulmamalıdır.",2 -V8,Yetkilendirme,V8.1,Yetkilendirme Dokümantasyonu,V8.1.3,"Uygulamanın dokümantasyonunun, kimlik doğrulama ve yetkilendirme ile ilgili güvenlik kararlarının alınmasında kullanılan çevresel ve bağlamsal öznitelikleri (günün saati, kullanıcı konumu, IP adresi veya cihaz gibi) tanımladığı doğrulanmalıdır.",3 -V8,Yetkilendirme,V8.1,Yetkilendirme Dokümantasyonu,V8.1.4,"Kimlik doğrulama ve yetkilendirme dokümantasyonunun; işlev düzeyinde, veriye özel ve alan düzeyinde yetkilendirmenin yanı sıra çevresel ve bağlamsal faktörlerin karar almada nasıl kullanıldığını tanımladığı doğrulanmalıdır. Bu, değerlendirilen öznitelikleri, risk eşiklerini ve alınan aksiyonları (ör. izin ver, doğrulama iste, reddet, step-up kimlik doğrulama) içermelidir.",3 -V8,Yetkilendirme,V8.2,Genel Yetkilendirme Tasarımı,V8.2.1,"Uygulamanın, işlev düzeyindeki erişimin yalnızca açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır.",1 -V8,Yetkilendirme,V8.2,Genel Yetkilendirme Tasarımı,V8.2.2,"Uygulamanın, veriye özel erişimin yalnızca belirli veri öğelerine açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, doğrudan nesne referansı güvenlik açıkları (IDOR) ve bozuk nesne düzeyinde yetkilendirme (BOLA) risklerini azaltır.",1 -V8,Yetkilendirme,V8.2,Genel Yetkilendirme Tasarımı,V8.2.3,"Uygulamanın, alan (field) düzeyindeki erişimin yalnızca belirli alanlara açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, bozuk nesne özelliği düzeyinde yetkilendirme (BOPLA) risklerini azaltır.",2 -V8,Yetkilendirme,V8.2,Genel Yetkilendirme Tasarımı,V8.2.4,"Tüketicinin çevresel ve bağlamsal özniteliklerine (ör. günün saati, konum, IP adresi veya cihaz) dayalı uyarlanabilir güvenlik kontrollerinin, uygulama dokümantasyonunda tanımlandığı şekilde, kimlik doğrulama ve yetkilendirme kararları için uygulandığı doğrulanmalıdır. Bu kontroller, tüketici yeni bir oturum başlatmaya çalışırken ve mevcut bir oturum sırasında uygulanmalıdır.",3 -V8,Yetkilendirme,V8.3,İşlem Düzeyinde Yetkilendirme,V8.3.1,Uygulamanın yetkilendirme kurallarını güvenilir bir servis katmanında uyguladığı ve istemci taraflı JavaScript gibi güvenilmeyen tüketiciler tarafından değiştirilebilecek kontrollerle yetinmediği doğrulanmalıdır.,1 -V8,Yetkilendirme,V8.3,İşlem Düzeyinde Yetkilendirme,V8.3.2,"Yetkilendirme kararlarının temelini oluşturan değerlerdeki değişikliklerin hemen uygulandığı doğrulanmalıdır. Değişikliklerin anında uygulanamadığı durumlarda (örneğin self-contained token içindeki verilere güveniliyorsa), tüketici artık yetkili olmadığı hâlde bir işlem gerçekleştirdiğinde uyarı verecek ve değişikliği geri alacak önlemler uygulanmalıdır. Bu alternatifin bilgi sızıntısını önlemeyeceği unutulmamalıdır.",3 -V8,Yetkilendirme,V8.3,İşlem Düzeyinde Yetkilendirme,V8.3.3,"Bir nesneye erişimin, herhangi bir aracı veya onun adına hareket eden bir servis yerine yalnızca erişimi başlatan öznenin (ör. tüketici) izinlerine dayandığı doğrulanmalıdır. Örneğin, bir tüketici kimlik doğrulama için bir self-contained token kullanarak bir web servis çağırırsa ve bu servis başka bir servisten veri talep ederse, ikinci servis izin kararlarını verirken birinci servisin makine-makine token'ı yerine tüketicinin token'ını kullanmalıdır.",3 -V8,Yetkilendirme,V8.4,Diğer Yetkilendirme Hususları,V8.4.1,"Multi-tenant uygulamaların, tüketici işlemlerinin izinli olmadıkları tenant'lar üzerinde asla etkili olmamasını sağlamak için tenant'lar arası kontroller kullandığı doğrulanmalıdır.",2 -V8,Yetkilendirme,V8.4,Diğer Yetkilendirme Hususları,V8.4.2,"Yönetici arayüzlerine erişimin, sürekli tüketici kimlik doğrulaması, cihaz güvenlik durumu değerlendirmesi ve bağlamsal risk analizi dahil olmak üzere çok katmanlı güvenlik içerdiği doğrulanmalıdır. Yetkilendirme için yalnızca ağ konumu veya güvenilir uç noktalar yeterli olmamalıdır; ancak bu tür faktörler yetkisiz erişim olasılığını azaltabilir.",3 -V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.1,Token Kaynağı ve Bütünlüğü,V9.1.1,"Self-contained token'ların içerikleri kabul edilmeden önce, oynama (tampering) saldırılarına karşı dijital imza veya MAC ile doğrulama yapıldığı doğrulanmalıdır.",1 -V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.1,Token Kaynağı ve Bütünlüğü,V9.1.2,"Belirli bir bağlam için yalnızca bir allowlist üzerinde bulunan algoritmaların self-contained token oluşturmak ve doğrulamak için kullanılabildiği doğrulanmalıdır. Bu allowlist, yalnızca simetrik ya da yalnızca asimetrik algoritmaları içermeli ve kesinlikle 'None' algoritmasını içermemelidir. Hem simetrik hem de asimetrik algoritmalar desteklenmek zorundaysa, anahtar karışıklığını (key confusion) önlemek için ek kontroller uygulanmalıdır.",1 -V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.1,Token Kaynağı ve Bütünlüğü,V9.1.3,"Self-contained token'ları doğrulamak için kullanılan anahtar malzemesinin, token issuer için önceden yapılandırılmış güvenilir kaynaklardan alındığı doğrulanmalıdır. Bu, saldırganların güvenilmeyen kaynak ve anahtarları belirtmesini engeller. JWT ve diğer JWS yapılarında 'jku', 'x5u' ve 'jwk' gibi header'lar güvenilir kaynaklardan oluşan bir allowlist'e göre doğrulanmalıdır.",1 -V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.2,Token İçeriği,V9.2.1,"Token verisinde bir geçerlilik zaman aralığı (validity time span) varsa, yalnızca doğrulama zamanı bu zaman aralığı içerisindeyse token ve içeriği kabul edilmelidir. Örneğin, JWT'ler için 'nbf' ve 'exp' claim'leri doğrulanmalıdır.",1 -V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.2,Token İçeriği,V9.2.2,"Token'ı alan hizmetin, token içeriğini kabul etmeden önce bu token'ın doğru türde olduğunu ve sunulma amacına uygun olduğunu doğruladığı teyit edilmelidir. Örneğin, yalnızca erişim token'ları yetkilendirme kararları için, yalnızca ID Token'lar kullanıcı kimlik doğrulamasını kanıtlamak için kullanılabilir.",2 -V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.2,Token İçeriği,V9.2.3,"Hizmetin yalnızca kendisiyle kullanılması amaçlanan (audience) token'ları kabul ettiği doğrulanmalıdır. JWT'lerde bu, 'aud' claim'inin hizmet içinde tanımlı bir allowlist ile doğrulanması yoluyla sağlanabilir.",2 -V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.2,Token İçeriği,V9.2.4,"Eğer bir token issuer, farklı audience'lara token oluşturmak için aynı private key'i kullanıyorsa, oluşturulan token'ların hedef audience'ları benzersiz şekilde tanımlayan bir audience kısıtlaması içerdiği doğrulanmalıdır. Bu, bir token'ın farklı bir audience ile yeniden kullanılmasını önler. Audience tanımlayıcısı dinamik olarak sağlanıyorsa, token issuer bu audience'ları doğrulamalı ve audience taklitlerinin (impersonation) önüne geçmelidir.",2 -V10,OAuth ve OIDC,V10.1,Genel OAuth ve OIDC Güvenliği,V10.1.1,"Token'ların yalnızca kesinlikle ihtiyaç duyan bileşenlere gönderildiği doğrulanmalıdır. Örneğin, tarayıcı tabanlı JavaScript uygulamaları için bir backend-for-frontend modeli kullanıldığında, access ve refresh token'lara yalnızca backend'in erişebilmesi gerekir.",2 -V10,OAuth ve OIDC,V10.1,Genel OAuth ve OIDC Güvenliği,V10.1.2,"Authorization server'dan gelen değerler (örneğin authorization code veya ID Token gibi) yalnızca aynı user agent oturumu ve işlemi tarafından başlatılmış bir yetkilendirme akışının sonucuysa kabul edildiği doğrulanmalıdır. Bu, client tarafından oluşturulan secret’ların 'proof key for code exchange' (PKCE) ‘code_verifier’, ‘state’ veya OIDC ‘nonce’ gibi tahmin edilemez, işleme özgü ve hem client’a hem de işlem başlatılan user agent oturumuna güvenli bir şekilde bağlı olmasını gerektirir.",2 -V10,OAuth ve OIDC,V10.2,OAuth İstemcisi,V10.2.1,"Code flow kullanılıyorsa, OAuth client’ın token taleplerini tetikleyen CSRF saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Bu genellikle PKCE kullanılarak veya authorization isteğinde gönderilen ‘state’ parametresinin kontrolü ile sağlanır.",2 -V10,OAuth ve OIDC,V10.2,OAuth İstemcisi,V10.2.2,"OAuth istemcisi birden fazla AS ile etkileşime girebiliyorsa, mix-up saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Örneğin, authorization server’ın 'iss' parametresini döndürmesi zorunlu kılınabilir ve bu parametrenin hem authorization yanıtında hem de token yanıtında doğrulanması gerekir.",2 -V10,OAuth ve OIDC,V10.2,OAuth İstemcisi,V10.2.3,OAuth istemcisinin authorization server’a yaptığı taleplerde yalnızca gerekli scope’ları (veya diğer yetkilendirme parametrelerini) talep ettiği doğrulanmalıdır.,3 -V10,OAuth ve OIDC,V10.3,OAuth Kaynak Sunucusu (RS),V10.3.1,RS'nin yalnızca bu servisle kullanılmak üzere tasarlanmış access token’ları kabul ettiği doğrulanmalıdır (audience kontrolü). Audience bilgisi yapılandırılmış token’larda (örneğin JWT içindeki ‘aud’ claim’i) yer alabilir veya token introspection endpoint aracılığıyla kontrol edilebilir.,2 -V10,OAuth ve OIDC,V10.3,OAuth Kaynak Sunucusu (RS),V10.3.2,"RS'nin, access token’dan gelen claim’lere dayanarak yetki devri tanımına uygun şekilde yetkilendirme kararları uyguladığı doğrulanmalıdır. ‘sub’, ‘scope’ ve ‘authorization_details’ gibi claim’ler varsa, bu kararın parçası olmalıdır.",2 -V10,OAuth ve OIDC,V10.3,OAuth Kaynak Sunucusu (RS),V10.3.3,"Erişim kontrolü kararında, access token’dan (JWT veya ilgili token introspection yanıtı) benzersiz bir kullanıcının tanımlanması gerekiyorsa, RS'nin başka kullanıcılara devredilemeyecek claim’ler ile kullanıcıyı tanımladığı doğrulanmalıdır. Genellikle bu, ‘iss’ ve ‘sub’ claim’lerinin birlikte kullanılması anlamına gelir.",2 -V10,OAuth ve OIDC,V10.3,OAuth Kaynak Sunucusu (RS),V10.3.4,"RS'nin belirli bir kimlik doğrulama gücü, yöntemi veya güncelliği (recentness) gerektirmesi durumunda, sunulan access token’ın bu kısıtlamaları karşıladığını doğruladığı, örneğin, OIDC ‘acr’, ‘amr’ ve ‘auth_time’ claim’leri kullanılarak doğrulanmalıdır. ",2 -V10,OAuth ve OIDC,V10.3,OAuth Kaynak Sunucusu (RS),V10.3.5,"RS'nin, (yetkisiz taraflarca) çalınmış veya tekrar edilen access token’ların kullanımını önlemek için sender-constrained access token’lar kullandığı doğrulanmalıdır. Bu, OAuth 2 için Mutual TLS veya OAuth 2 Demonstration of Proof of Possession (DPoP) ile sağlanabilir.",3 -V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.1,"AS'nin, istemciye özel önceden kaydedilmiş URI’lerden oluşan bir allowlist kullanarak redirect URI’leri tam dize karşılaştırması ile doğruladığı doğrulanmalıdır.",1 -V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.2,"AS'nin, ""authorization response"" içinde ""authorization code"" döndürdüğü durumlarda, bu kodun yalnızca bir kez kullanılabildiği doğrulanmalıdır. Daha önce access token vermek için kullanılmış bir authorization code ile yapılan ikinci geçerli token isteği reddedilmeli ve ilgili tüm token’lar iptal edilmelidir.",1 -V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.3,"Authorization code’un kısa ömürlü olduğu doğrulanmalıdır. L1 ve L2 uygulamalar için maksimum yaşam süresi 10 dakika, L3 uygulamalar için 1 dakikadır.",1 -V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.4,"Belirli bir istemci için AS'nin yalnızca o istemcinin ihtiyaç duyduğu grant türlerine izin verdiği doğrulanmalıdır. ""Token"" (Implicit flow) ve ""password"" (Resource Owner Password Credentials flow) grant türlerinin artık kullanılmaması gerekir.",1 -V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.5,"AS'nin, açık istemciler için refresh token replay saldırılarını azalttığı doğrulanmalıdır. Tercihen sender-constrained refresh token’lar (DPoP veya mutual TLS ile certificate-bound access token’lar) kullanılmalıdır. L1 ve L2 uygulamalar için refresh token rotation kullanılabilir. Rotation kullanılıyorsa, AS refresh token’ı kullanım sonrası geçersiz kılmalı ve geçersiz bir refresh token sunulması durumunda o yetkilendirme ile ilişkili tüm refresh token’ları iptal etmelidir.",1 -V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.6,"Code grant kullanılıyorsa, AS'nin authorization code interception saldırılarına karşı koruma sağladığı doğrulanmalıdır. Yetkilendirme isteğinde geçerli bir ""code_challenge"" değeri zorunlu olmalı ve ""code_challenge_method"" olarak ""plain"" kabul edilmemelidir. Token isteğinde ise ""code_verifier"" parametresi doğrulanmalıdır.",2 -V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.7,"AS'nin, kimlik doğrulaması yapılmamış dinamik istemci kaydını desteklemesi durumunda, kötü niyetli istemci uygulamalarına karşı riskleri azalttığı doğrulanmalıdır. Kayıtlı URI’ler gibi client metadata’sı doğrulanmalı, kullanıcı onayı alınmalı ve güvenilmeyen bir client uygulamasıyla yapılan yetkilendirme isteği işlenmeden önce kullanıcı uyarılmalıdır.",2 -V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.8,"Refresh token’ların, sliding expiration kullanılsa bile mutlak bir sona erme süresine sahip olduğu doğrulanmalıdır.",2 -V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.9,Yetkili bir kullanıcı tarafından AS kullanıcı arayüzü üzerinden refresh token’ların ve reference access token’ların iptal edilebildiği doğrulanmalıdır.,2 -V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.10,"Gizli istemcilerin token istekleri, pushed authorization request (PAR) ve token iptal istekleri gibi server’a yapılan backchannel isteklerinde kimliğinin kontrol edildiği doğrulanmalıdır.",2 -V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.11,"AS yapılandırmasının, OAuth istemcisine yalnızca gerekli scope’ları atadığı doğrulanmalıdır.",2 -V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.12,"Belirli bir client için, authorization server’ın yalnızca client’ın ihtiyaç duyduğu 'response_mode' değerine izin verdiği doğrulanmalıdır. Örneğin, bu değer ya beklenenlerle karşılaştırılarak doğrulanmalı ya da PAR veya JAR kullanılmalıdır.",3 -V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.13,"""Code"" grant türünün daima pushed authorization request (PAR) ile birlikte kullanıldığı doğrulanmalıdır.",3 -V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.14,"AS'nin yalnızca sender-constrained (Proof-of-Possession) access token’lar ürettiği doğrulanmalıdır. Bu, mutual TLS ile certificate-bound access token ya da DPoP ile DPoP-bound access token olabilir.",3 -V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.15,"Sunucu taraflı istemciler için (kullanıcı cihazında çalışmayan), AS'nin ""authorization_details"" parametresinin istemci backend'i tarafından sağlandığını ve kullanıcı tarafından değiştirilmediğini doğruladığı, örneğin pushed authorization request (PAR) or JWT-secured Authorization Request (JAR) zorunlu kılınarak doğrulanmalıdır.",3 -V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.16,"Bir istemci gizli ise, AS'nin güçlü istemci kimlik doğrulama yöntemlerini zorunlu kıldığı doğrulanmalıdır. Bu yöntemler, public-key cryptography’ye dayalı ve replay saldırılarına karşı dayanıklı olmalı, örneğin mutual TLS (""tls_client_auth"", ""self_signed_tls_client_auth"") veya private key JWT (""private_key_jwt"") gibi.",3 -V10,OAuth ve OIDC,V10.5,OIDC İstemcisi,V10.5.1,"İstemcinin (relying party olarak) ID Token replay saldırılarını azalttığı doğrulanmalıdır. Örneğin, ID Token’daki 'nonce' claim’inin, OpenID Provider’a gönderilen kimlik doğrulama isteğindeki 'nonce' değeriyle eşleştiği doğrulanmalıdır.",2 -V10,OAuth ve OIDC,V10.5,OIDC İstemcisi,V10.5.2,"İstemcinin kullanıcıyı ID Token claim’lerinden (genellikle, başka kullanıcılarla yeniden atanamayan 'sub' claim’i) benzersiz şekilde tanımladığı doğrulanmalıdır.",2 -V10,OAuth ve OIDC,V10.5,OIDC İstemcisi,V10.5.3,"İstemcinin, kötü niyetli bir AS'nin başka bir AS'yi taklit etmesini AS metadata’sı üzerinden reddettiği doğrulanmalıdır. AS metadata’sındaki issuer URL’si, istemci tarafından beklenen önceden yapılandırılmış issuer URL’siyle tam olarak eşleşmiyorsa, metadata reddedilmelidir.",2 -V10,OAuth ve OIDC,V10.5,OIDC İstemcisi,V10.5.4,"İstemcinin, ID Token’ın kendisi için (audience) kullanılması amaçlandığını doğruladığı doğrulanmalıdır. Bu, token’daki 'aud' claim’inin istemcinin 'client_id' değeriyle eşit olup olmadığının kontrol edilmesiyle yapılır.",2 -V10,OAuth ve OIDC,V10.5,OIDC İstemcisi,V10.5.5,"OIDC back-channel logout kullanıldığında, relying party’nin ""forced logout"" ve ""logout"" akışında ""cross-JWT confusion"" gibi saldırılara karşı koruma sağladığı doğrulanmalıdır. Client, logout token’ın 'logout+jwt' türünde olduğunu, 'event' claim’inin doğru üyeye sahip olduğunu ve 'nonce' claim’i içermediğini doğrulamalıdır. Ayrıca token için kısa bir sona erme süresi (örneğin 2 dakika) önerilir.",2 -V10,OAuth ve OIDC,V10.6,OpenID Provider,V10.6.1,"OpenID Provider’ın yalnızca 'code', 'ciba', 'id_token' veya 'id_token code' response mode değerlerine izin verdiği doğrulanmalıdır. 'code' değeri, 'id_token code' (OIDC Hybrid flow) yerine tercih edilmelidir. 'token' (Implicit flow) kullanılmamalıdır.",2 -V10,OAuth ve OIDC,V10.6,OpenID Provider,V10.6.2,"OpenID Provider’ın forced logout yoluyla yapılan hizmet reddi saldırılarını önlediği doğrulanmalıdır. Bu, son kullanıcıdan açık onay alınarak veya varsa logout isteğinde (relying party tarafından başlatılan) bulunan parametrelerin, örneğin 'id_token_hint', doğrulanmasıyla yapılabilir.",2 -V10,OAuth ve OIDC,V10.7,Onay (Consent) Yönetimi,V10.7.1,"AS'nin her yetkilendirme isteği için kullanıcının onayını aldığı doğrulanmalıdır. İstemcinin kimliği garanti altına alınamıyorsa, AS daima kullanıcıdan açıkça onay istemelidir.",2 -V10,OAuth ve OIDC,V10.7,Onay (Consent) Yönetimi,V10.7.2,"AS'nin kullanıcıdan onay istediğinde, neye onay verildiğini açık ve yeterli şekilde gösterdiği doğrulanmalıdır. Uygun olduğunda bu bilgiler, istenen yetkilendirmelerin doğasını (genellikle scope, resource server, RAR gibi detaylara dayalı), yetkilendirilmiş uygulamanın kimliğini ve bu yetkilendirmelerin süresini içermelidir.",2 -V10,OAuth ve OIDC,V10.7,Onay (Consent) Yönetimi,V10.7.3,"Kullanıcının, AS üzerinden verdiği onayları görüntüleyebildiği, değiştirebildiği ve iptal edebildiği doğrulanmalıdır.",2 -V11,Kriptografi,V11.1,Kriptografik Envanter ve Dokümantasyon,V11.1.1,"Kriptografik anahtarların yönetimi için belgelenmiş bir politika ve NIST SP 800-57 gibi bir anahtar yönetim standardını izleyen bir kriptografik anahtar yaşam döngüsü tanımlandığı doğrulanmalıdır. Bu, anahtarların aşırı miktarda paylaşılmadığını (örneğin, paylaşılan sırlar için ikiden fazla tarafla veya özel anahtarlar için birden fazla tarafla) garanti altına almalıdır.",2 -V11,Kriptografi,V11.1,Kriptografik Envanter ve Dokümantasyon,V11.1.2,"Tüm kriptografik anahtarlar, algoritmalar ve uygulama tarafından kullanılan sertifikaları içeren bir kriptografik envanterin oluşturulduğu, sürdürüldüğü ve düzenli olarak güncellendiği doğrulanmalıdır. Bu envanter ayrıca, sistemde anahtarların nerede kullanılabileceğini ve kullanılamayacağını, ve hangi veri türlerinin bu anahtarlarla korunup korunamayacağını da belgelemelidir.",2 -V11,Kriptografi,V11.1,Kriptografik Envanter ve Dokümantasyon,V11.1.3,"Sistem içerisinde şifreleme, özetleme ve imzalama işlemleri dahil olmak üzere kriptografi kullanımının tüm örneklerini tespit etmek için kriptografik keşif mekanizmalarının kullanıldığı doğrulanmalıdır.",3 -V11,Kriptografi,V11.1,Kriptografik Envanter ve Dokümantasyon,V11.1.4,"Kriptografik bir envanterin sürdürüldüğü doğrulanmalıdır. Bu envanter, gelecekteki tehditlere karşı tepki verebilmek amacıyla post-kuantum kriptografiye geçiş yolunu belirten belgelenmiş bir plan içermelidir.",3 -V11,Kriptografi,V11.2,Güvenli Kriptografi Uygulaması,V11.2.1,Kriptografik işlemler için sektör tarafından doğrulanmış uygulamaların (kütüphaneler ve donanım hızlandırmalı uygulamalar dahil) kullanıldığı doğrulanmalıdır.,2 -V11,Kriptografi,V11.2,Güvenli Kriptografi Uygulaması,V11.2.2,"Uygulamanın, rastgele sayı üreticileri, kimliği doğrulanmış şifreleme, MAC veya özetleme algoritmaları, anahtar uzunlukları, turlar, şifreler ve modların herhangi bir zamanda yeniden yapılandırılabilir, yükseltilebilir veya değiştirilebilir olacağı şekilde kripto çevikliği (crypto agility) ile tasarlandığı doğrulanmalıdır. Aynı şekilde, anahtarların ve parolaların değiştirilebilmesi ve verilerin yeniden şifrelenebilmesi mümkün olmalıdır. Bu, onaylanmış PQC şemalarının yüksek güvenlikli uygulamaları yaygın olarak kullanılabilir hale geldiğinde sorunsuz geçişe olanak tanır.",2 -V11,Kriptografi,V11.2,Güvenli Kriptografi Uygulaması,V11.2.3,"Tüm kriptografik ilkeliklerin, algoritma, anahtar boyutu ve yapılandırmaya göre minimum 128 bit güvenlik sağladığı doğrulanmalıdır. Örneğin, 256-bit ECC anahtarı yaklaşık 128 bit güvenlik sağlarken, RSA için aynı güvenliği elde etmek 3072-bit anahtar gerektirir.",2 -V11,Kriptografi,V11.2,Güvenli Kriptografi Uygulaması,V11.2.4,"Tüm kriptografik işlemlerin sabit süreli (constant-time) olduğu, karşılaştırmalarda, hesaplamalarda veya geri dönüşlerde kısa devre (short-circuit) işlemleri yapılmadığı doğrulanmalıdır; bu, bilgi sızıntısını önlemek için gereklidir.",3 -V11,Kriptografi,V11.2,Güvenli Kriptografi Uygulaması,V11.2.5,"Tüm kriptografik modüllerin güvenli şekilde hata verdiği ve hataların, padding oracle saldırıları gibi zafiyetleri mümkün kılmayacak şekilde ele alındığı doğrulanmalıdır.",3 -V11,Kriptografi,V11.3,Şifreleme Algoritmaları,V11.3.1,"Güvensiz blok modlarının (örneğin, ECB) ve zayıf doldurma (padding) şemalarının (örneğin, PKCS#1 v1.5) kullanılmadığı doğrulanmalıdır.",1 -V11,Kriptografi,V11.3,Şifreleme Algoritmaları,V11.3.2,Yalnızca AES ile GCM gibi onaylı şifreleme algoritmalarının ve modlarının kullanıldığı doğrulanmalıdır.,1 -V11,Kriptografi,V11.3,Şifreleme Algoritmaları,V11.3.3,"Şifrelenmiş verilerin yetkisiz değişikliklere karşı korunduğu doğrulanmalıdır. Tercihen bu koruma, onaylı bir kimliği doğrulanmış şifreleme yöntemi kullanılarak ya da onaylı bir şifreleme yöntemi ile onaylı bir MAC algoritmasının kombinasyonu ile sağlanmalıdır.",2 -V11,Kriptografi,V11.3,Şifreleme Algoritmaları,V11.3.4,"Sayılar, başlatma vektörleri (IV) ve diğer tek kullanımlık değerlerin, aynı şifreleme anahtarı ve veri öğesi çifti için birden fazla kez kullanılmadığı doğrulanmalıdır. Oluşturma yöntemi kullanılan algoritmaya uygun olmalıdır.",3 -V11,Kriptografi,V11.3,Şifreleme Algoritmaları,V11.3.5,"Şifreleme algoritması ve MAC algoritması kombinasyonlarının ""encrypt-then-MAC"" modunda çalıştığı doğrulanmalıdır.",3 -V11,Kriptografi,V11.4,Hashing ve Hash Tabanlı Fonksiyonlar,V11.4.1,"Dijital imzalar, HMAC, KDF ve rastgele bit üretimi gibi genel kriptografik kullanım senaryolarında yalnızca onaylı hash fonksiyonlarının kullanıldığı doğrulanmalıdır. MD5 gibi yasaklı hash fonksiyonları hiçbir kriptografik amaçla kullanılmamalıdır.",1 -V11,Kriptografi,V11.4,Hashing ve Hash Tabanlı Fonksiyonlar,V11.4.2,"Parolaların, onaylı, hesaplama açısından yoğun ve mevcut rehberliğe göre yapılandırılmış bir anahtar türetme fonksiyonu (diğer adıyla parola hash'leme fonksiyonu) kullanılarak saklandığı doğrulanmalıdır. Ayarlar, güvenlik ve performans dengesini sağlayarak kaba kuvvet saldırılarını zorlaştırmalıdır.",2 -V11,Kriptografi,V11.4,Hashing ve Hash Tabanlı Fonksiyonlar,V11.4.3,"Dijital imzalarda kullanılan hash fonksiyonlarının, veri bütünlüğü ve kimlik doğrulama amacıyla kullanıldığında çakışmaya karşı dayanıklı ve yeterli bit uzunluğuna sahip olduğu doğrulanmalıdır. Çakışma dayanıklılığı gerekiyorsa çıktı uzunluğu en az 256 bit olmalıdır. Sadece ikinci ön-görüntü (2nd pre-iamge) saldırılarına karşı dayanıklılık gerekiyorsa çıktı uzunluğu en az 128 bit olmalıdır.",2 -V11,Kriptografi,V11.4,Hashing ve Hash Tabanlı Fonksiyonlar,V11.4.4,"Parolalardan gizli anahtarlar türetilirken, onaylı anahtar türetme fonksiyonlarının anahtar uzatma (key stretching) parametreleriyle birlikte kullanıldığı doğrulanmalıdır. Bu parametreler, kaba kuvvet saldırılarını önleyecek şekilde güvenlik ve performans dengesine sahip olmalıdır.",2 -V11,Kriptografi,V11.5,Rastgele Değerler,V11.5.1,"Tahmin edilemez olması amaçlanan tüm rastgele sayıların ve dizelerin, CSPRNG ile oluşturulduğu ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. UUID'lerin bu koşulu dikkate almadığını unutmayın.",2 -V11,Kriptografi,V11.5,Rastgele Değerler,V11.5.2,"Kullanılan rastgele sayı üretim mekanizmasının, yoğun talep altında dahi güvenli çalışacak şekilde tasarlandığı doğrulanmalıdır.",3 -V11,Kriptografi,V11.6,Açık Anahtar (Public Key) Kriptografisi,V11.6.1,"Anahtar üretimi, tohumlama (seeding) ve dijital imza üretimi ve doğrulama için yalnızca onaylı kriptografik algoritmalar ve çalışma modlarının kullanıldığı doğrulanmalıdır. Anahtar üretim algoritmaları, bilinen saldırılara karşı savunmasız anahtarlar üretmemelidir. Örneğin, Fermat çarpanlama yöntemine karşı savunmasız RSA anahtarları oluşturulmamalıdır.",2 -V11,Kriptografi,V11.6,Açık Anahtar (Public Key) Kriptografisi,V11.6.2,"Anahtar değişimi için yalnızca onaylı kriptografik algoritmaların kullanıldığı doğrulanmalıdır (örneğin Diffie-Hellman). Kullanılan parametrelerin güvenli olması gerektiğine dikkat edilmelidir. Bu, anahtar kurulum sürecine yönelik saldırıları önleyecek ve araya girme (adversary-in-the-middle) ya da kriptografik kırılmaları engelleyecektir.",3 -V11,Kriptografi,V11.7,Kullanım Halindeki Verilerin Kriptografisi,V11.7.1,"Hassas verilerin kullanım sırasında korunmasını sağlamak amacıyla, yetkisiz kullanıcıların veya süreçlerin bu verilere erişmesini engelleyen tam bellek şifrelemesinin kullanıldığı doğrulanmalıdır.",3 -V11,Kriptografi,V11.7,Kullanım Halindeki Verilerin Kriptografisi,V11.7.2,"Veri asgariyetinin sağlandığı, yani işleme sırasında mümkün olan en az miktarda verinin ortaya çıktığı ve verilerin kullanımdan hemen sonra veya mümkün olan en kısa sürede şifrelendiği doğrulanmalıdır.",3 -V12,Güvenli İletişim,V12.1,Genel TLS Güvenlik Rehberi,V12.1.1,Yalnızca TLS protokolünün en güncel ve önerilen sürümlerinin (örneğin TLS 1.2 ve TLS 1.3) etkinleştirildiği ve en son sürümün varsayılan olarak tercih edildiği doğrulanmalıdır.,1 -V12,Güvenli İletişim,V12.1,Genel TLS Güvenlik Rehberi,V12.1.2,Yalnızca önerilen şifre takımlarının (cipher suite) etkinleştirildiği ve en güçlü şifre takımlarının tercih edildiği doğrulanmalıdır. Seviye 3 (L3) uygulamalar yalnızca ileri gizlilik (forward secrecy) sağlayan şifre takımlarını desteklemelidir.,2 -V12,Güvenli İletişim,V12.1,Genel TLS Güvenlik Rehberi,V12.1.3,"Uygulamanın, mTLS istemci sertifikalarını kimlik doğrulama veya yetkilendirme amacıyla kullanmadan önce bu sertifikaların güvendiği sertifikalar arasında olduğunu doğruladığı kontrol edilmelidir.",2 -V12,Güvenli İletişim,V12.1,Genel TLS Güvenlik Rehberi,V12.1.4,Online Certificate Status Protocol (OCSP) Stapling gibi geçerli bir sertifika iptal kontrolü yönteminin etkinleştirildiği ve yapılandırıldığı doğrulanmalıdır.,3 -V12,Güvenli İletişim,V12.1,Genel TLS Güvenlik Rehberi,V12.1.5,"TLS el sıkışma (handshake) sürecinde Server Name Indication (SNI) gibi hassas meta verilerin ifşa edilmesini önlemek için, uygulamanın TLS yapılandırmasında Encrypted Client Hello (ECH) özelliğinin etkinleştirildiği doğrulanmalıdır.",3 -V12,Güvenli İletişim,V12.2,Dışa Açık Hizmetlerle HTTPS İletişimi,V12.2.1,"İstemci ile dışa açık, HTTP tabanlı hizmetler arasındaki tüm bağlantılarda TLS kullanıldığı ve bu bağlantıların güvensiz ya da şifrelenmemiş iletişime geri dönmediği doğrulanmalıdır.",1 -V12,Güvenli İletişim,V12.2,Dışa Açık Hizmetlerle HTTPS İletişimi,V12.2.2,Dışa açık hizmetlerin herkese açık olarak güvenilen TLS sertifikaları kullandığı doğrulanmalıdır.,1 -V12,Güvenli İletişim,V12.3,Genel Servisler Arası İletişim Güvenliği,V12.3.1,"Uygulamaya gelen ve uygulamadan çıkan tüm bağlantılarda izleme sistemleri, yönetim araçları, uzaktan erişim ve SSH, ara yazılımlar, veritabanları, ana sistemler (mainframe), iş ortağı sistemleri ya da dış API'ler dahil olmak üzere TLS gibi şifreli bir protokolün kullanıldığı ve güvensiz ya da şifrelenmemiş protokollere geri dönülmediği doğrulanmalıdır.",2 -V12,Güvenli İletişim,V12.3,Genel Servisler Arası İletişim Güvenliği,V12.3.2,TLS istemcilerinin bir TLS sunucusu ile iletişime geçmeden önce alınan sertifikaları doğruladığı kontrol edilmelidir.,2 -V12,Güvenli İletişim,V12.3,Genel Servisler Arası İletişim Güvenliği,V12.3.3,Uygulama içindeki HTTP tabanlı iç hizmetler arasında gerçekleşen tüm bağlantılarda TLS ya da uygun başka bir aktarım şifreleme mekanizmasının kullanıldığı ve güvensiz ya da şifrelenmemiş iletişime geri dönülmediği doğrulanmalıdır.,2 -V12,Güvenli İletişim,V12.3,Genel Servisler Arası İletişim Güvenliği,V12.3.4,"İç hizmetler arasındaki TLS bağlantılarında güvenilir sertifikaların kullanıldığı doğrulanmalıdır. İç sistemlerde oluşturulmuş ya da kendinden imzalı (self-signed) sertifikalar kullanılıyorsa, bu sertifikalara güvenen hizmetlerin yalnızca belirli dahili sertifika otoritelerine (CA) ve belirli kendinden imzalı sertifikalara güvenecek şekilde yapılandırıldıkları doğrulanmalıdır.",2 -V12,Güvenli İletişim,V12.3,Genel Servisler Arası İletişim Güvenliği,V12.3.5,"Sistem içindeki hizmetlerin birbiriyle iletişim kurarken her bir uç noktanın kimliğini doğrulamak için güçlü kimlik doğrulama yöntemlerinin kullanıldığı doğrulanmalıdır. Bu yöntemler arasında, açık anahtar altyapısı (public-key infrastructure) kullanan ve tekrar oynatma saldırılarına karşı dayanıklı olan TLS istemci kimlik doğrulaması gibi yöntemler yer almalıdır. Mikroservis mimarilerinde, sertifika yönetimini basitleştirmek ve güvenliği artırmak amacıyla bir servis ağı (service mesh) kullanılması değerlendirilmelidir.",3 -V13,Konfigürasyon,V13.1,Konfigürasyon Dokümantasyonu,V13.1.1,"Uygulamanın tüm iletişim ihtiyaçlarının dokümante edildiği doğrulanmalıdır. Buna, uygulamanın bağımlı olduğu dış hizmetler ve son kullanıcının uygulamanın bağlantı kurmasını sağlayabileceği dış konumlar da dahil olmalıdır.",2 -V13,Konfigürasyon,V13.1,Konfigürasyon Dokümantasyonu,V13.1.2,"Uygulamanın kullandığı her bir hizmet için, dokümantasyonda eşzamanlı bağlantı sayısı (örn. bağlantı havuzu limitleri) ve bu sınır aşıldığında uygulamanın davranışı, geri dönüş veya kurtarma mekanizmaları da dahil olmak üzere hizmet reddi koşullarını önlemek için tanımlandığı doğrulanmalıdır.",3 -V13,Konfigürasyon,V13.1,Konfigürasyon Dokümantasyonu,V13.1.3,"Uygulamanın, kullandığı her bir dış sistem veya hizmet (örn. veritabanları, dosya tanıtıcıları, iş parçacıkları, HTTP bağlantıları) için kaynak yönetimi stratejilerini tanımladığı doğrulanmalıdır. Bu stratejiler, kaynak serbest bırakma prosedürlerini, zaman aşımı ayarlarını, hata durumlarını ve tekrar deneme mantığı uygulanmışsa sınırları, gecikmeleri ve geri çekilme (back-off) algoritmalarını içermelidir. Senkron HTTP istek–yanıt işlemleri için kısa zaman aşımı süreleri zorunlu tutulmalı ve tekrar eden denemeler devre dışı bırakılmalı ya da sıkı şekilde sınırlandırılmalıdır.",3 -V13,Konfigürasyon,V13.1,Konfigürasyon Dokümantasyonu,V13.1.4,"Uygulamanın, güvenlik açısından kritik olan gizli verileri tanımladığı ve kuruluşun tehdit modeli ve iş ihtiyaçlarına göre bu verilerin döndürülme (rotation) zamanlamasının belgelendiği doğrulanmalıdır.",3 -V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.1,"Uygulamanın, standart kullanıcı oturum mekanizmasını desteklemeyen backend bileşenleri (örneğin API'ler, ara katmanlar, veri katmanları) arasında gerçekleşen iletişimlerin kimlik doğrulamasıyla korunduğu doğrulanmalıdır. Kimlik doğrulama; bireysel hizmet hesapları, kısa ömürlü token'lar ya da sertifika tabanlı kimlik doğrulama ile yapılmalıdır ve parola, API anahtarı ya da ayrıcalıklı erişime sahip paylaşımlı hesaplar gibi sabit kimlik bilgileri kullanılmamalıdır.",2 -V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.2,"Uygulamanın backend bileşenleri arasında (yerel hizmetler, işletim sistemi hizmetleri, API'ler, ara katmanlar ve veri katmanları dahil) gerçekleştirilen iletişimlerin, yalnızca gerekli en az ayrıcalığa sahip hesaplarla yapıldığı doğrulanmalıdır.",2 -V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.3,"Bir hizmet kimlik doğrulaması için bir kimlik bilgisi kullanılması gerekiyorsa, bu kimlik bilgisinin varsayılan bir değer (örneğin root/root veya admin/admin) olmadığının doğrulanması gereklidir.",2 -V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.4,"Uygulamanın iletişim kurmasına izin verilen dış kaynaklar ya da sistemlerin, bir allowlist (izinli liste) ile tanımlandığı doğrulanmalıdır. Bu liste, uygulama katmanında, web sunucusunda, güvenlik duvarında veya farklı katmanların birleşiminde uygulanabilir.",2 -V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.5,"Web veya uygulama sunucusunun, dış sistemlere veri veya dosya gönderimi veya yüklemesi yaparken sadece belirli kaynaklara izin verecek şekilde allowlist ile yapılandırıldığı doğrulanmalıdır.",2 -V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.6,"Uygulamanın farklı hizmetlere bağlantı kurduğu durumlarda, bu bağlantılar için belgelenmiş yapılandırmaları (örn. maksimum eşzamanlı bağlantı, bağlantı limiti aşıldığında davranış, zaman aşımı, tekrar deneme stratejileri) takip ettiğinin doğrulanması gereklidir.",3 -V13,Konfigürasyon,V13.3,Gizli Bilgi Yönetimi,V13.3.1,"Parolalar, anahtar materyalleri, veritabanı ve üçüncü parti sistemlerle entegrasyon bilgileri, zaman tabanlı token'lar için tohum (seed) bilgileri, dahili gizli veriler ve API anahtarları gibi backend sırlarının güvenli bir şekilde oluşturulması, saklanması, erişim denetiminin sağlanması ve imha edilmesi için bir gizli bilgi yönetim çözümünün (örneğin key vault) kullanıldığı doğrulanmalıdır. Bu gizli bilgiler uygulama kaynak koduna dahil edilmemeli ve yapı çıktılarında yer almamalıdır. Seviye 3 uygulamalar için donanım destekli bir çözüm (örneğin HSM) gereklidir.",2 -V13,Konfigürasyon,V13.3,Gizli Bilgi Yönetimi,V13.3.2,Gizli bilgilere erişimin en az ayrıcalık prensibine uygun şekilde yapılandırıldığı doğrulanmalıdır.,2 -V13,Konfigürasyon,V13.3,Gizli Bilgi Yönetimi,V13.3.3,"Tüm kriptografik işlemlerin, anahtar materyallerinin güvenli bir şekilde yönetilmesi ve dışarıya sızmasının engellenmesi amacıyla, izole edilmiş bir güvenlik modülü (örneğin vault ya da donanım güvenlik modülü) aracılığıyla gerçekleştirildiği doğrulanmalıdır.",3 -V13,Konfigürasyon,V13.3,Gizli Bilgi Yönetimi,V13.3.4,Uygulamanın belgelerinde belirtildiği şekilde gizli bilgilerin süresinin dolacak şekilde yapılandırıldığı ve düzenli olarak döndürüldüğü doğrulanmalıdır.,3 -V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.1,Uygulamanın .git veya .svn klasörleri gibi kaynak kontrolüyle ilgili metadata içermeyecek şekilde deploy edildiğini ya da bu klasörlerin hem dış erişime hem de uygulama erişimine kapalı olduğu doğrulanmalıdır.,1 -V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.2,Tüm bileşenler için üretim ortamlarında hata ayıklama (debug) modlarının devre dışı bırakıldığı doğrulanmalıdır.,2 -V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.3,"Web sunucularının, açık şekilde istenmediği sürece dizin listelemesi (directory listing) özelliğini istemcilere sunmadığı doğrulanmalıdır.",2 -V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.4,"HTTP TRACE metodunun üretim ortamlarında desteklenmediği, böylece potansiyel bilgi sızıntılarının önlendiği doğrulanmalıdır.",2 -V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.5,Belgeler (örneğin dahili API belgeleri) ve izleme uç noktalarının (monitoring endpoints) yalnızca açıkça belirtildiği durumlarda erişilebilir olduğu doğrulanmalıdır.,2 -V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.6,Uygulamanın arka uç bileşenlerinin ayrıntılı sürüm bilgilerini ifşa etmediği doğrulanmalıdır.,3 -V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.7,"Web katmanının yalnızca belirli dosya uzantılarına sahip dosyaları sunacak şekilde yapılandırıldığı, bu sayede istem dışı bilgi, yapılandırma ya da kaynak kod sızıntılarının önlendiği doğrulanmalıdır.",3 -V14,Veri Koruma,V14.1,Veri Koruma Dokümantasyonu,V14.1.1,"Uygulama tarafından oluşturulan ve işlenen tüm hassas verilerin tanımlanıp, koruma seviyelerine göre sınıflandırıldığından emin olun. Bu, yalnızca kodlanmış (örneğin Base64 stringleri ya da JWT içindeki düz metin yükler gibi) ve bu nedenle kolayca çözülebilir verileri de içermelidir. Koruma seviyeleri, uygulamanın uymakla yükümlü olduğu veri koruma ve gizlilik düzenlemeleri ile standartlarını dikkate almalıdır.",2 -V14,Veri Koruma,V14.1,Veri Koruma Dokümantasyonu,V14.1.2,"Tüm hassas veri koruma seviyeleri için belgelenmiş bir koruma gereksinimleri seti tanımlandığından emin olun. Bu gereksinimler genel şifreleme, bütünlük doğrulama, saklama süresi, verinin nasıl günlüğe kaydedileceği, günlüklerdeki hassas verilere erişim kontrolleri, veritabanı düzeyinde şifreleme, gizlilik ve gizliliği artırıcı teknolojiler ile diğer gizlilik gereksinimlerini kapsamalıdır.",2 -V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.1,"Hassas verilerin yalnızca HTTP message body veya header alanlarında sunucuya gönderildiği ve URL ile sorgu parametrelerinin, API anahtarı veya session token’ı gibi hassas bilgiler içermediği doğrulanmalıdır.",1 -V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.2,"Hassas verilerin, yük dengeleyiciler ve uygulama önbellekleri gibi sunucu bileşenlerinde önbelleğe alınmasının engellendiği veya kullanım sonrası bu verilerin güvenli biçimde temizlendiği doğrulanmalıdır.",2 -V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.3,"Uygulama kontrolü dışında veri toplanmasını engellemek için, tanımlanmış hassas verilerin, kullanıcı izleyicileri gibi güvensiz taraflara gönderilmediği doğrulanmalıdır.",2 -V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.4,"Hassas verilere yönelik şifreleme, bütünlük doğrulama, veri saklama, loglama yöntemi, loglardaki erişim kontrolleri, gizlilik teknolojileri gibi kontrollerin, söz konusu verinin belgelenmiş koruma seviyesinde tanımlandığı şekilde uygulandığı doğrulanmalıdır.",2 -V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.5,"Önbellekleme mekanizmalarının yalnızca belirli içerik türüne sahip yanıtları önbelleğe alacak şekilde yapılandırıldığı ve hassas, dinamik içeriklerin önbelleğe alınmadığı doğrulanmalıdır. Web sunucusu, mevcut olmayan bir dosya talebinde geçerli ama farklı bir dosya döndürmek yerine 404 veya 302 cevabı vermelidir. Bu, Web Cache Deception saldırılarını önlemeye yardımcı olur.",3 -V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.6,"Uygulamanın yalnızca işlevsellik için gerekli olan asgari hassas veriyi döndürdüğü doğrulanmalıdır. Örneğin, kredi kartı numarasının yalnızca bazı rakamlarının döndürülmesi; tam numaranın döndürülmesi gerekiyorsa, kullanıcı arayüzünde gizlenmiş (maskelenmiş) şekilde sunulması gerekir, aksi kullanıcı özel olarak görüntülemek istemedikçe gösterilmemelidir.",3 -V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.7,"Hassas bilgilerin, veri saklama sınıflandırmasına tabi tutulduğu, geçerliliğini yitirmiş veya artık gerekli olmayan verilerin belirlenmiş bir zaman çizelgesiyle ya da gerektiğinde otomatik olarak silindiği doğrulanmalıdır.",3 -V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.8,Kullanıcı tarafından yüklenen dosyaların meta verilerinden hassas bilgilerin çıkarıldığı veya bu bilgilerin yalnızca kullanıcıdan açık onay alındığında saklandığı doğrulanmalıdır.,3 -V14,Veri Koruma,V14.3,İstemci Tarafı Veri Koruması,V14.3.1,"Kimliği doğrulanmış verilerin, istemci veya oturum sonlandığında istemci depolamasından (örneğin tarayıcı DOM’undan) temizlendiği doğrulanmalıdır. 'Clear-Site-Data' HTTP response header bu konuda yardımcı olabilir ancak istemci tarafı, sunucu bağlantısı mevcut olmadığında da temizlik işlemini yapabiliyor olmalıdır.",1 -V14,Veri Koruma,V14.3,İstemci Tarafı Veri Koruması,V14.3.2,"Uygulamanın, tarayıcılarda hassas verilerin önbelleğe alınmasını önlemek amacıyla yeterli anti-önbellekleme HTTP response header (örneğin Cache-Control: no-store) ayarladığı doğrulanmalıdır.",2 -V14,Veri Koruma,V14.3,İstemci Tarafı Veri Koruması,V14.3.3,"Tarayıcıda depolanan verilerin (örneğin localStorage, sessionStorage, IndexedDB veya çerezler) hassas veri içermediği, yalnızca session token’larının istisna olarak kabul edildiği doğrulanmalıdır.",2 -V15,Güvenli Kodlama ve Mimari,V15.1,Güvenli Kodlama ve Mimari Dokümantasyonu,V15.1.1,"Güvenlik açığı içeren üçüncü taraf bileşen sürümleri ve genel olarak kütüphane güncellemeleri için, uygulama dokümantasyonunda risk bazlı düzeltme zamanlarının tanımlandığı doğrulanmalıdır.",1 -V15,Güvenli Kodlama ve Mimari,V15.1,Güvenli Kodlama ve Mimari Dokümantasyonu,V15.1.2,"Yazılım bileşen listesi (Software Bill of Materials - SBOM) gibi bir envanterin tutulduğu, kullanılan tüm üçüncü taraf kütüphanelerin önceden tanımlanmış, güvenilir ve düzenli olarak güncellenen depolardan alındığı doğrulanmalıdır.",2 -V15,Güvenli Kodlama ve Mimari,V15.1,Güvenli Kodlama ve Mimari Dokümantasyonu,V15.1.3,"Uygulama dokümantasyonunda zaman veya kaynak açısından yoğun işlevlerin tanımlandığı, bu işlevlerin aşırı kullanımı durumunda kullanılabilirlik kaybının nasıl önleneceği ve yanıt oluşturma süresinin istemci zaman aşımını aşmaması için hangi önlemlerin alındığı belirtilmelidir. Örnek savunmalar kuyruklama, eşzamansız işleme, kullanıcı başına ve uygulama genelinde paralel işlem sınırlarını içerebilir.",2 -V15,Güvenli Kodlama ve Mimari,V15.1,Güvenli Kodlama ve Mimari Dokümantasyonu,V15.1.4,"Uygulama dokümantasyonunda ""riskli bileşenler"" olarak değerlendirilen üçüncü taraf kütüphanelerin vurgulandığı doğrulanmalıdır.",3 -V15,Güvenli Kodlama ve Mimari,V15.1,Güvenli Kodlama ve Mimari Dokümantasyonu,V15.1.5,"Uygulama dokümantasyonunda ""tehlikeli işlevsellik"" içeren uygulama bölümlerinin açıkça belirtildiği doğrulanmalıdır.",3 -V15,Güvenli Kodlama ve Mimari,V15.2,Güvenlik Mimarisi ve Bağımlılıklar,V15.2.1,"Uygulamanın yalnızca, belgelenmiş güncelleme ve düzeltme sürelerini aşmamış bileşenleri içerdiği doğrulanmalıdır.",1 -V15,Güvenli Kodlama ve Mimari,V15.2,Güvenlik Mimarisi ve Bağımlılıklar,V15.2.2,"Uygulamanın, belgelenmiş güvenlik kararları ve stratejilere dayanarak, zaman veya kaynak açısından yoğun işlevlerin neden olabileceği kullanılabilirlik kaybına karşı savunmalar uyguladığı doğrulanmalıdır.",2 -V15,Güvenli Kodlama ve Mimari,V15.2,Güvenlik Mimarisi ve Bağımlılıklar,V15.2.3,"Üretim ortamının yalnızca uygulamanın çalışması için gerekli işlevleri içerdiği ve test kodları, örnek kod parçaları veya geliştirme işlevleri gibi gereksiz işlevsellikleri açığa çıkarmadığı doğrulanmalıdır.",2 -V15,Güvenli Kodlama ve Mimari,V15.2,Güvenlik Mimarisi ve Bağımlılıklar,V15.2.4,Üçüncü taraf bileşenlerin ve bunların tüm transitif bağımlılıklarının beklenen depolardan (iç kaynaklı ya da harici) alındığı ve bağımlılık karışıklığı (dependency confusion) saldırılarına açık olmadığı doğrulanmalıdır.,3 -V15,Güvenli Kodlama ve Mimari,V15.2,Güvenlik Mimarisi ve Bağımlılıklar,V15.2.5,"Uygulamanın, “tehlikeli işlevsellik” içeren veya “riskli bileşenler” kullanan bölümlerine ek korumalar uyguladığı doğrulanmalıdır. Bu korumalar sandbox, kapsülleme, konteynerleştirme veya ağ düzeyinde izolasyon gibi teknikler aracılığıyla, bir uygulama bölümünün ele geçirilmesi durumunda saldırganın diğer bölümlere sıçramasını geciktirmeyi veya engellemeyi amaçlamalıdır.",3 -V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.1,"Uygulamanın yalnızca gerekli alanların bir alt kümesini veri nesnesinden döndürdüğü doğrulanmalıdır. Örneğin, bazı alanlara kullanıcıların erişmemesi gerektiğinden tüm veri nesnesi döndürülmemelidir.",1 -V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.2,"Uygulama backend'i harici URL’lere çağrı yaptığında, yalnızca amaçlanan işlevsellik söz konusuysa yönlendirmeleri takip edecek şekilde yapılandırıldığının doğrulanması gerekir.",2 -V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.3,"Uygulamanın, kitlesel atama saldırılarına karşı, her bir controller ve eylem için izin verilen alanları sınırlandırarak savunmalar sağladığı doğrulanmalıdır. Örneğin, bir alan değeri, bu işlemde değiştirilmesi amaçlanmadıysa eklenememeli veya güncellenememelidir.",2 -V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.4,"Tüm proxy ve ara katman bileşenlerinin kullanıcının orijinal IP adresini, uç kullanıcı tarafından değiştirilemeyecek güvenilir veri alanları kullanarak doğru şekilde ilettiği ve uygulamanın ve web sunucusunun bu doğru değeri, loglama ve hız sınırlama gibi güvenlik kararları için kullandığı doğrulanmalıdır. Ayrıca, orijinal IP adresinin bile dinamik IP'ler, VPN'ler veya kurumsal güvenlik duvarları nedeniyle güvenilir olmayabileceği dikkate alınmalıdır.",2 -V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.5,"Uygulamanın değişkenlerin doğru türde olduğunu açıkça doğruladığı ve sıkı eşitlik ve karşılaştırma işlemleri kullandığı doğrulanmalıdır. Bu, değişken türüyle ilgili varsayımlardan kaynaklanan tür oynama (type juggling) veya tür karışıklığı (type confusion) güvenlik açıklarını önlemek içindir.",2 -V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.6,"JavaScript kodunun prototip zehirleme (prototype pollution) saldırılarını önleyecek şekilde yazıldığı, örneğin, nesne literal’leri yerine Set() veya Map() gibi yapılar kullanıldığı doğrulanmalıdır.",2 -V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.7,"Uygulamanın, özellikle framework'ün istek parametrelerinin kaynağı (sorgu dizgisi, gövde parametreleri, çerezler veya başlık alanları) arasında ayrım yapmadığı durumlarda, HTTP parametre kirliliği (HTTP parameter pollution) saldırılarına karşı savunmalar uyguladığı doğrulanmalıdır.",2 -V15,Güvenli Kodlama ve Mimari,V15.4,Güvenli Eş Zamanlılık (Concurrency),V15.4.1,"Çok iş parçacıklı kodda (örneğin cache'ler, dosyalar veya birden fazla iş parçacığı tarafından erişilen bellek içi nesneler gibi) paylaşılan nesnelere yalnızca thread-safe (iş parçacığı güvenli) türler ve kilitleme (lock) veya semaphore gibi senkronizasyon mekanizmaları kullanılarak erişildiği doğrulanmalıdır. Bu, yarış durumlarını ve veri bozulmasını önlemeye yöneliktir.",3 -V15,Güvenli Kodlama ve Mimari,V15.4,Güvenli Eş Zamanlılık (Concurrency),V15.4.2,"Bir kaynağın durumu üzerindeki kontroller (örneğin varlığı ya da izinleri gibi) ile bu kontrole bağlı eylemlerin tek bir atomik işlem olarak gerçekleştirildiği doğrulanmalıdır. Bu, TOCTOU (time-of-check to time-of-use) yarış durumlarını önlemeye yöneliktir. Bir dosyanın varlığının kontrol edilip ardından açılması veya bir kullanıcının erişiminin doğrulanıp ardından yetki verilmesi gibi işlemler buna örnektir.",3 -V15,Güvenli Kodlama ve Mimari,V15.4,Güvenli Eş Zamanlılık (Concurrency),V15.4.3,"Kilitlerin (locks) tutarlı biçimde kullanıldığı, iş parçacıklarının birbirini beklemesi ya da sonsuz döngüye girmesi (deadlock veya livelock) gibi durumların önlendiği doğrulanmalıdır. Ayrıca, kilitleme mantığı, kaynağı yöneten kod içinde kalmalı ve dış sınıflar veya dış kodlar tarafından istemeden veya kötü niyetli şekilde değiştirilememelidir.",3 -V15,Güvenli Kodlama ve Mimari,V15.4,Güvenli Eş Zamanlılık (Concurrency),V15.4.4,"Kaynak tahsis politikalarının, iş parçacığı açlığını önleyecek şekilde, kaynaklara adil erişimi sağladığı doğrulanmalıdır. Örneğin, thread pool (iş parçacığı havuzu) kullanımı, düşük öncelikli iş parçacıklarının da makul sürelerde çalışabilmesi için uygulanmalıdır.",3 -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.1,Güvenlik Loglaması Dokümantasyonu,V16.1.1,"Uygulamanın teknoloji yığını boyunca her katmanda hangi olayların loglandığını, log formatlarını, logların nereye yazıldığını, nasıl kullanıldığını, erişimin nasıl kontrol edildiğini ve logların ne kadar süre saklandığını belgeleyen bir envanterin mevcut olduğu doğrulanmalıdır.",2 -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.2,Genel Loglama,V16.2.1,"Her bir log girdisinin, olayın ne zaman, nerede, kim tarafından ve ne olduğuna dair detaylı bir zaman çizelgesi oluşturulmasına olanak tanıyacak gerekli meta verileri içerdiği doğrulanmalıdır.",2 -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.2,Genel Loglama,V16.2.2,"Tüm loglama bileşenlerinin zaman kaynaklarının senkronize olduğu ve güvenlik olayı meta verisindeki zaman damgalarının UTC kullanarak ya da açık zaman dilimi ofsetiyle belirtildiği doğrulanmalıdır. UTC kullanımı, özellikle yaz saati uygulamaları nedeniyle oluşabilecek karışıklıkları önlemek için tavsiye edilir.",2 -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.2,Genel Loglama,V16.2.3,Uygulamanın yalnızca log envanterinde belgelenmiş dosya ve hizmetlere log yazdığı ya da ilettiği doğrulanmalıdır.,2 -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.2,Genel Loglama,V16.2.4,Logların kullanılan log işleyici (log processor) tarafından okunabildiği ve ilişkilendirilebildiği doğrulanmalıdır. Tercihen yaygın bir log formatı kullanılmalıdır.,2 -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.2,Genel Loglama,V16.2.5,"Hassas veriler loglanırken, uygulamanın veri koruma seviyesine uygun olarak loglama yaptığı doğrulanmalıdır. Örneğin kimlik bilgileri veya ödeme detayları gibi bazı verilerin loglanmasına izin verilmemelidir. Session token’ları gibi veriler ise yalnızca tamamen ya da kısmen maskelenmiş ya da hash’lenmiş olarak loglanmalıdır.",2 -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.3,Güvenlik Olayları,V16.3.1,Tüm kimlik doğrulama işlemlerinin (başarılı ve başarısız girişimler dahil) loglandığı doğrulanmalıdır. Kullanılan kimlik doğrulama türü veya faktörleri gibi ek meta veriler de toplanmalıdır.,2 -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.3,Güvenlik Olayları,V16.3.2,"Başarısız yetkilendirme girişimlerinin loglandığı doğrulanmalıdır. Seviye 3 uygulamalar için, tüm yetkilendirme kararlarının ve hassas verilere erişim olaylarının (verinin kendisi olmadan) loglandığı da doğrulanmalıdır.",2 -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.3,Güvenlik Olayları,V16.3.3,"Uygulamanın, belgelenmiş güvenlik olaylarını ve güvenlik kontrollerini aşma girişimlerini (girdi doğrulama, iş mantığı, otomasyon karşıtı kontroller vb.) logladığı doğrulanmalıdır.",2 -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.3,Güvenlik Olayları,V16.3.4,Beklenmeyen hatalar ve güvenlik kontrolü başarısızlıkları (örneğin backend TLS hataları gibi) loglandığı doğrulanmalıdır.,2 -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.4,Log Koruması,V16.4.1,"Tüm loglama bileşenlerinin, log enjeksiyonunu (log injection) önlemek amacıyla verileri uygun biçimde encode ettiği doğrulanmalıdır.",2 -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.4,Log Koruması,V16.4.2,Logların yetkisiz erişime karşı korunduğu ve değiştirilemez olduğu doğrulanmalıdır.,2 -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.4,Log Koruması,V16.4.3,"Logların analiz, tespit, uyarı ve yükseltme amacıyla mantıksal olarak ayrı bir sisteme güvenli biçimde iletildiği doğrulanmalıdır. Böylece uygulama ihlal edilse bile logların tehlikeye girmesi önlenmiş olur.",2 -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.5,Hata Yönetimi,V16.5.1,"Beklenmedik ya da güvenlikle ilgili bir hata oluştuğunda, tüketiciye genel bir mesaj döndürüldüğü ve yığın izleri (stack trace), sorgular, gizli anahtarlar, token’lar gibi hassas sistem içi verilerin açıklanmadığı doğrulanmalıdır.",2 -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.5,Hata Yönetimi,V16.5.2,"Uygulamanın, dış kaynaklara erişim başarısız olduğunda bile güvenli şekilde çalışmaya devam ettiği doğrulanmalıdır. Örneğin, circuit breaker ya da graceful degradation gibi desenler kullanılmalıdır.",2 -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.5,Hata Yönetimi,V16.5.3,"Uygulamanın hata durumlarında güvenli ve düzenli şekilde başarısız olduğu doğrulanmalıdır. Bu, örneğin doğrulama hatalarına rağmen işlemlerin işlenmesine yol açabilecek fail-open durumlarını önlemelidir.",2 -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.5,Hata Yönetimi,V16.5.4,"Ele alınmamış tüm istisnaları yakalayacak şekilde tanımlanmış bir “son çare hata yöneticisi” bulunduğu doğrulanmalıdır. Bu, hem loglara gitmesi gereken hata detaylarının kaybolmaması hem de tüm uygulama sürecinin çökerek hizmet dışı kalmasının önlenmesi açısından önemlidir.",3 -V17,WebRTC,V17.1,TURN Sunucusu,V17.1.1,"TURN hizmetinin yalnızca özel amaçlar için ayrılmamış IP adreslerine (ör. iç ağlar, yayın adresleri, loopback) erişime izin verdiği doğrulanmalıdır. Bu gereksinim hem IPv4 hem de IPv6 adresleri için geçerlidir.",2 -V17,WebRTC,V17.1,TURN Sunucusu,V17.1.2,"TURN hizmetinin, meşru kullanıcıların sunucuda çok sayıda bağlantı noktası açmaya çalışması durumunda kaynak tüketimi saldırılarına karşı dayanıklı olduğu doğrulanmalıdır.",3 -V17,WebRTC,V17.2,Medya,V17.2.1,"DTLS sertifikası anahtarının, belgelenmiş kriptografik anahtar yönetim politikasına uygun şekilde yönetildiği ve korunduğu doğrulanmalıdır.",2 -V17,WebRTC,V17.2,Medya,V17.2.2,Medya sunucusunun onaylı DTLS şifre takımlarını (cipher suites) ve Güvenli Gerçek Zamanlı Aktarım Protokolü (Secure Real-time Transport Protocol - SRTP) için anahtarlar oluşturmaya yönelik DTLS Uzantısı için güvenli bir koruma profilini kullanacak ve destekleyecek şekilde yapılandırıldığı (DTLS-SRTP) doğrulanmalıdır.,2 -V17,WebRTC,V17.2,Medya,V17.2.3,Real-time Transport Protocol (RTP) injection saldırılarının bir hizmet reddi durumuna veya medya akışlarına ses veya video medyası eklenmesine yol açmasını önlemek için medya sunucusunda Güvenli SRTP kimlik doğrulamasının kontrol edildiği doğrulanmalıdır.,2 -V17,WebRTC,V17.2,Medya,V17.2.4,Verify that the media server is able to continue processing incoming media traffic when encountering malformed Secure Real-time Transport Protocol (SRTP) packets.,2 -V17,WebRTC,V17.2,Medya,V17.2.5,"Medya sunucusunun, meşru kullanıcılardan gelen SRTP flood'ı sırasında gelen medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.",3 -V17,WebRTC,V17.2,Medya,V17.2.6,"Medya sunucusunun DTLS içinde yer alan ""ClientHello"" yarış durumu güvenlik açığına karşı savunmasız olmadığı, medya sunucusunun güvenlik açığına sahip olduğunun açıkça bilinip bilinmediği kontrol edilerek veya yarış koşulu testi gerçekleştirilerek doğrulanmalıdır.",3 -V17,WebRTC,V17.2,Medya,V17.2.7,"Medya sunucusuna bağlı ses veya video kayıt mekanizmalarının, meşru kullanıcı kaynaklı SRTP flood'ı sırasında medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.",3 -V17,WebRTC,V17.2,Medya,V17.2.8,"DTLS sertifikasının, SDP (Session Description Protocol) fingerprint özelliği ile karşılaştırıldığı ve doğrulama başarısız olursa medya akışının sonlandırıldığı, medya akışının özgünlüğünü sağlamak için doğrulanmalıdır.",3 -V17,WebRTC,V17.3,Sinyalizasyon,V17.3.1,"Sinyalizasyon sunucusunun, flood saldırısı altında bile meşru sinyalizasyon mesajlarını işlemeye devam edebildiği doğrulanmalıdır. Bu, sinyalizasyon düzeyinde oran sınırlaması uygulanarak sağlanmalıdır.",2 -V17,WebRTC,V17.3,Sinyalizasyon,V17.3.2,"Sinyalizasyon sunucusunun, hizmet reddine yol açabilecek şekilde yapılandırılmış bozuk sinyalizasyon mesajlarıyla karşılaştığında bile meşru mesajları işlemeye devam edebildiği doğrulanmalıdır. Bu, girdi doğrulaması, integer overflow ve buffer overflow'a karşı savunma ve sağlam hata işleme teknikleri ile sağlanmalıdır.",2 - diff --git a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.docx b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.docx deleted file mode 100644 index 17f91f91bee1f780c3d84af2af21621c8de993ed..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 223892 zcmV)WK(4<~O9KQH00IaI09brXTf7#JoU;J{0JaJM022TJ09!+EZggdCbYE0?aAk8{ zE_iKh#g^G>!!QsN0)1%%O+P@9#)+u4AWgQv@7QikNki;3F?liA znz{GrN-`RZH#&<};DfSe826HH9Dxy5Dl;F(pVODleLNlwrdtOgqEZuv@dD93Fc!oD zG!Kb&U}z+@UUQ^ZKWC1MFFps>?{@E)um-_k2Xl>hG>_EbDTs zVa%P&l;B9itQchn8$D#LMyq?4?^$a}KUY?_puBQmCg%KJj zfwcdieD==fC}iqAQ*xN{Sq7J%cqM(5g8C=ky1>ZoYzD|rk_6cy5C+YH*+>4k2+f2DA7f@(x_W$HnM)p>ObQS6kP96*c4 zVjJsGN!L>>fJ^Y_|8@Q_l)_B`Zm$i{zaBuoTCF5d3O5C4A%W8XTG)h50W?U(nSYi2 zUgFGr4?^ku3Rrxv7b%MCRakKm9eo2(O9KQH00IaI09brXTeo+l@8+Noe~dmdUru;%oQpS5O9KQH00IaI09brXTNav8 zs+p_-0B=JL01*HH0C#V4WG`fIV|8t1ZgehqZEWnl+in}#nkM)vfoxPk>LG1XXE|$E zkI(6CJMFfVC!m1FB4bgCWH3S<2RX^By4w%Xz(yA^GamGfF?Ty}^2%2&=Zn;n%zs*^ zAVrH#k*0R3YQrgs!H5;>@E^bb`~T^`{4z?Tb6u24p8e^o?w!t8kwlA)7yJ--mgbGt0K5QEAPGi(^sceb$0LW-LikGN2M%*I-R|{Bb8)d$!$hgxlKM8Bz^rz24HSdotm2zpL>%+r>cVY zE>DxQ(%dco(^qwo-IH6jM@hfP%Y0C^`}yb|-$njozHvV98|S0cT=%xyxx&41(#$v1 zRo*Nv)Z0s@_blmu#vR~WRbANEdwcd7_XwB%5r6mYu+GpVX-uDZIR*FMaYW z(E`^#z4&mhvo!hmE?LqO9_1h370Y~uqe^A5D&mj724A{sR^ig6II4Tqf~)a8%93%O zE$LNu?{w~T7JQ3Gs#@d?UaIlOU&|$pf2*^#J9GGDT*-fUgdlKVtD<_<``P>LsY+8_ zjO|HLJ$TD}5IxMZ3dCATZ)vaoE=&Gwl2``z`P13$>OKXEEwJ^V&1)C&tt<S6RRdGwF} zz0RwzyX|fMA^Mlo=wBw$ztlJcdxtp#DD{~t%r3h0DxJk8tGyzGS9G_|8dslB96Uq!^j!UcNfAG~ET(=7Il!nd>rZh+EzeOBO3t z`&12wAAg0PuR6}H1;#1DtBSrcPg(HzKS_$Rg1xU!3Uzk+8Hy$HR6yi}b>zfqD;gy* zQ>iLi(TPrz-``b9k@R7D;SZHAtEirgR0f~pwI_1BVFW62pi7XJ8qamoieQu%@1s&x zAAjwC{FSZ;>ny4+J`8omH;iC4)PN=;v$u+B87qGU2KMpS5&k}GMM?JiI~D0_q=zyX z`Wf#V+m{(e$;JC5i-vWY;+Ine8&LP*GIMA9ES!ZCUFadG_GE>%7-G)c0tX#(KJH{u;*25WlK~GxM z4m8R%BDL3wST#kLDv`^F@KBwhsjK5B$q5;E(_;`54t_iXp_nF_rXN8vqTS#B1>A#f z=Wu5qrmqh|c&D?qy}ieC4p$8Zx?er!YkPnC3RW_ue+&AzqJQ~P)I>!T>#`4@rC{@B zC5(scj6Z$#RYYqI&)}7QZH!U)uDVC_m-M|KLAR@@E|NcB=l=6Q!B1!_^AFiMJQJq{ zf9ZdF?#6oOE*$a`UEY;J-#J5NNaNj}HC}TAzMaBHyvX~*GRksL8rg}yUljSoUZz(_~QUB zegjXSyL+G94ey4(m9Rmg-rJXX4DY7uD*p;^@XMeW;eWwpiGHD#9h>!4xL@XOmb>oz zXK*Z@>U3ZRDQXO z-;&oX&+KH<%HIukl>a-P6L%o)dgtV-XYU#A8aaRq9Ddnl3m)_b;9sFNv%rHM=4ay~ zIXSJO|NZ}gZ0Q`dQNTpUr#gD|!~LVz(UZIeZG*#~Ey=HSG!JS}OT&u~pfCS`4Sot1 zSpiEngwv47QP}y)-ldRngzCY3$69f(=T2LpVNO6NJj_RcIb*nefN{v`Aw7@dW-0cjWPHAMTkU&i?z|;JX#ytk3^~ ze)`19!108cujC0o_s!o^Jy>KXKZf%gy#W0@W1a50@vL}Mf6mL(=wbA<$jh=RF@v$) zwG;PcrtiE~-Te~(~DI*lII)oD)`)hFlgu04`7WXs+>*|P6s%f)*XTfe^> zsrE@x_v&Q`my5rcXTauwXZ(kiF5Sa}nbPI6|GpN|=s52s3QUgE42>dOrc9Kb9>k3bDn3W9vC2KN|E@}E=z|CuvuS5bfa^VHvgQ-5*t@trQ( zV9x7NnzVjjUL#i{)bhOH^Trw`Z?D{OeXkH zkHAx2t7G)6RH`4n&~N7{y)Q1l;Z#NsRgvlOT20;&?A{`eo~pY42W8N~JQ;N8WYCX$ zTU)BLr{Z33r`y>*(7nTMtPeYby`8=8;g0U@@AM8k@%9oW(F_TM8HPt1Kjp-n&eECN zeBOXQJJ}$^GU7OL;uwQBUPcGB?Bikd_}~Ba-^M!9!&Jw~a0Q{H$27d%JHN~tq8(d| zLn@OY4S1OR{w|5mRZ%KR%wa;S(!+%Aa&qw@>to_=q$zC`^UGu-xQ%4P(u)t(0Mz5t zr23}r!3*Ov;l6pQ#*w;s4->P37hfa~iQ!uur;hF)eSZ{n?{sL?8GO(^7V{7V#aX>@(R)6mHz#m9>Qc4FkkSxlRId0^l{gf@W+b}m@=LI zzD#+gMrJEF_8>hLZbE5$|6cGX+{b#HT(TKwh{?l-m~s1N9tDmoE19$x5zV9PB--8`i` zuWB+s{w*D%d@R(Egi$nx)5qa_JQHwPN+Pt%&r;a=!wANPf1p{%0kBA@5Q31AkZDDu z91c=xa52#f@|L)}8ImsLV6UJ+;EU zE7B2O$%l7jbW4yq@GY4}){$^I=B+B#ht)+fm!zO+czIH7CL32&oI9G+m=ZUmD9b^R zmhNX(pkdCznMsB`tEdb!Q3;|5VCw6B9oJXRY;AYv z3GOWqwq*qu{I3lcO1f>Bw3Bp*)36LFgxl`Oe{yu+dvb(gL$A=-eNaa|Saduwg+5Ov z<2-BOW*s8_szQ@6!pXQa@ksK`moWUpy-$umt4I7plAfp5TbCJ!51+;6kKInkDoy#; z6%BdZw%_UsJPZ_VxCdXsB;WHC8SP!W5n2)2H@p!1?y-WCu7=H^$n|BV|NUS8uLZ6) z8oFgwG?;~+hK4sZFu{e!@P9Aq?Go6bBs|#uMOjjh>rq;xW(;H}DXbtTA3gOI4{S=< zWS|{kVTM^UY$(7S z-ZPz>LyJbJ4~^O#qPNQb@}KNuM+A6)^~p5e5nM5tg1EK=YFr5axp==AL}3L7>VZzt zdCW+&*&PVSt02rLjQbH77U(P8i=5WsljK%nXfLOQ=$V`HQp5_a4}a<5H&z;zMhs;H zBCAwmn8qlX!1r`7p^X7cTvQx7=&6tI=sd*r7#;=V@^%ZN*eY^x@gc1!FHRI#s|w+# zqI29>QO2PeCW{0@5C!6Cm5fn7!lR0$B;A#fhy;Izo@n-Erf{Q!0D%$Xkk(@vpBlx? z3wZ=`pR~R#8d^}OgAu3;?~GPWid%UIXAE3B)DLhjMkOwp-S`*@NEPo@-ok8EmUMGx zE}~s9r7iBr7@}^=xYOgrJY}Tu0ic9PI3qGftm-L|f$M?SmFgV5Re1+qxl*=-bz$X+ zTPngGAnnaMJSxF+b@$wklG2zvG{Z11)UYMkJu)BssJ?Dk*Eq}g zp!L`%KZ*GJ34<9h(KvB7gaGgKlq|v&PAA*CAOCjo9$sSTAO7w>*cZQn?><6#ikkHI zcOd7Y?cI*|?&O1L|BUl@Nbrkf#Baev17NneOL+2W-x>6_5!~^`hl$Q)qtixvs^J0* zX*70hV3DGSfvW2qjWx!qq2C7I98|E9pgCa8aUW=WeX(g}i+xID&oEfG<{7Np&R|vL zc?oBs%>g`k?`7DhUO4NidCtm=QJ7M5^fF%%qc4`YGaQ}5GUNPD@Is0eVc=-Q%hyY) zkskBNqm!hUuuzH6ZZ#hbX)}Z_ps|DT#w2Q7n9Ors=nJ}^!0pcAxl}^nDJH&K%Xg6Q zh6%_`|1Pkx$qe97tNneT#<9XZq{@ca!cd$7(`EwaVT_;9tH&yc<|gCBZbwv{d>AHr z1pl6*4TEYI$4QZ5x3O&u!jBi`DQLcmZ2Zg>KZLQ&LL*wp1|3+@JKG3j1rZ)W(vM#3 z6kT#yj$97$N}XU^D&o2P-tzLC@kKZ`4${z@nHl+{<$5gh*_v52f>VWd#Rz<76hpWf z2S%x(-I#J+3XcT+6X#P~ojBIb;Oz)p6e3-JNgA3PV+6{n1CgEelhk3f`N;CZ#i$id6O;(3jp)Q_&vNB2 zi4J4gK~@7UGrABJxjR=mhW>%t=}wyh=53d32|Sm_tm=5pSWi;PsNT&naQUcv(E@Ri zJJEM+gQo1J&@t2g!IR*hf8;{@5Q~$VrGJ_12$ZmFdSr6OPF0a$EUm6;jCml!KO;$w z)~g0>!ISIjiZJ5NJCe5%Ce?=Y7_@Gsrl2C(ITP3t4h0MtgO?87FdtGJi1ngTfh@c~cy)!*1G@z@LF$r1(YRpw~ma?m1*(VOMyfb5l~S>o&(6h;?+Ei$rt!0!6? zi0+k{aIYP!8W$2k1>gCMM@13D^AM?o$>eH9fq@4)1LMHD^S&9D6kxL?M&L2`L}d;E zx!M?*gdGNY#axAkig%IBsf#4xto7Ml5~IeCt&j&_Q0@rdN>@WV8OaEDHT*3n03U6E z(6-{$@=jM0u1T=a!E?wFf&*a@f8KgE2is4=T>`5WOWZwti3aya5-hJsC=vFbfC+iQ zhItjM+g`=0m4(Z&qpa{>l_B+wmULK}uy^jsdI|N!h@xWwnQ=gk&lv2Ul4XFAQ_+K@ zc{lu+r6?t8)x?DsdR{n|;^9UIv*cs*#lM#*3%*^5BEmcw?KRK?rPVN*5#Bsj%$H77 zTCGyBe*7B=pwjv1E!d%PRH6V9t(~Vyl?yfiR=a}3TgWg^)JSy__n;;$1i-CB&(gyD-PM!0^$f0k4TV(d1uB?*66rOrze zrAF6NYH}zUdNK>aZvu6PSXl7#(FUag5L!6Txt13D=)f)bV z1<|G55GKfu?w(Gk+*=z;A3Hj}HCfI&SVj1i7R;@dAl>y1TdfF#PJV9j7~kVL&i#2k zsjs?l%NIE$KS~wrzV`7`mgSMbQ;z5eq%OJlcon-ILxOB@G`$t&!+KozDPqV1hu}S# zPt7O*P?FPQIi}`V57l|0BufX9%%FSV^FG{*0EVSHP0r}qr3obx1Y^Oh_`CwkZLh%6 zZO^5+qxSA!z)l~+q*KU1G-a$MDrjPT2C9X+2CFitG!8a5f046$1?A$54Z$m%X;Jyc zh@25(ZUn;Z9t_QmjZs}zo3fSYY=JrkBjopYb?WSo^HQ?H(MEZi*J-?I@MxDrC$2XF z1#dazddgUjDIV5}u=K64@&PO#n7`j99xOyuI=jtoDa^Y=?kPkG*~@lQ$7 zmvu(LR*nNT6e67unPWaBcBMvY6_YYE8E9jj$}p{px*pTcJE1hmNKwFB1j5X;E=x+v z2ho-Y097*q+KO?>2Bgh;ki)AEt?i*pAJkJYt%f!0*&!aF3T0!ZM@g8T!4=k(iJ%3k zmzV=7Q%3Do#aOcdG5{R-G|V3KyKN`6?XcX-kZu9qd=`LwRYLElORB^Cq@OFfpFOH$W=Q8% z6yL)&CX<8%dKAj{&lx;(0J|Nh@l=(iDk&cB;e-71hQN0;O1#_}rZZOts=x#)__w9% z38r0?z*<<~6!?^6LiGE)WKeK12jL*r!rZ1Xt;6pp14Z@sVmJnBk1?qzZcmW`BE)_X zT$65t3dogCx@sd2!Q*`2l8L};3=tRJ7V_ZmBS#bvCg}`=Ku{x-1l3OJ6F49bmt;Zk zNG*$^go|i#%j#%?va&FYkQqdn za$qBZP<`Zdo-M4BN%6s$&fHl3Y&@E~#qh8&6d#Y1z%miyfz>#eU>6V73e9K(zvA$l zO1wfj9EFONEode@ z4pnTo8VAjQT4?+Xr>IG>B#DR1Wpy@8B>8OsIo?;i<^!w4&dwGRl@wdq`d2cBZNTsj zl_&EbTQfH~?Qk!H3}-{7vRrBIHRll{LlcN;Fmpo6hm5hHUc6 zjids|6fKKT8d(AfKjv<@aX2F4m~lu(p~pB9!D`G7?|`z6ZT8m~?tLeEU8pKCG$t(@ zba49KI45b?n??IUK8ggkJZ2$!dHZB#Wv`GCfLY@H>3MQ#*z8Q*DrytjS~M*@lm80nc2o6k%w9Agla&s3~egyLsfS(!~xsT zuzSeT#9)=F%3J1-6k*H$mP^2ZqqsN`Rn(oMNV^= z+0|xDJV70M62V$QPiKUpW-S=r_`H^Sc%DJ+z}JmO-|y*(C)9iidRW&%l%t5|unl@{Nfq*yXgDO} zlM$Y4FA$fSP%>F;zKcsw;Sdq=o{lNn#P$#+*tra{$s4 z)@Bv&{!@}^7ObZ{?L`;zB?*-X+aPtx5oT z=XhQ?E`YF2Q6s|X(PIp2xEf;F;HOhL(R5%?t^qZl=r>+1iRA+7{M@wH4$|HlhgK?r}aWjV9I-%rX~_y!xy< z*g`lLVZrGt7UVf7Zw`bJ%_yHL-qF4#>Ltuf5(ArACKKQ0rwT5VdT2hX=pVYB4kZP~ z(q>hHTwKP2PJ~x#+X4f8sElJQWGzgfoN>{TIS!skZvs=f#ac=y&_e=;&{HGPP02sz z07ILGoi7&hbY8=g9x#H9g(<6k#EDu;DC#0ZnbL`kJ%zMbF6umO zb0;$$5;p9m>`kiKIOAh*37Au!S>21W$`WIlbMG7BVlTxBMY09TcPd>*P*7)?FleR97kJ z=;#d2L&eM-ba7%#0*+Eqd3%Z(wGD#ppw?dtFbkS9pz5o7p(iX0xI#0x*#cGHS5vMF za-g~v6CfImwc|D!xdI{0;erKEJ5BDdKn?Fqso||9s^P6wso{&iph@YRjb7~st|Y($ zBC5t|bsCGjFBAJQfounjo-+7CwYke`6JtsC5wRw517|OpM#%XW>Yym=s*l{qN1{^M zppfy4E=94nru6$}fJ3EEzX$@y*RrNod6ouDmEk*>{!AI)*o0Or3K2nmla!n#nEe*KLfIdlmzrToI%_o?!|(Q2JK8&x;$*IHdDf_;z-u4(XM9Ieo?<-Tnf$ zvd*jyZk|)|(e0r$j+6@}IPMZWVN^uesF-&TLh5plgftAkOo?YuegCkHM-09A)g_aC zUc9CN2u{%K*h7d?<`AmzVv(y)P;*pAK^$t5`^ZKNITHf;>P;JV=8-$>c;pU*@oAed zYrD2wZs~F$=-&{g$cA-;=dFxwlKLhw#=OU*+@%X{&dGwzVjqQ-IgxltR+~O1mz6OH zDygY^PQ6Kq7Xm7AV!`F8gW+2)b&PJPG?`Ech&$Fao{x}igwYXsKaxi=f+D!eOLY5e z^A?ke-*tRQ9MrwSi&+jWlS)}pX|DzOj8%$B>V8n%JW62EFi_>g*^$?mOm_||5j&Wo z*bGIk6SnYMq}Upj)E@JoaTP$6X^K_Tu^%fA{^65YUl~J{!wK0C;X&{9c>z8I+=u_f z7^#MoMq4g*cq#%sxr>AeNPDRk42cl5j(lpW4X+dmq)!xH&yYb)>J9Is zd4>PG+fAZdf)%v=^0#I2a~cSP|E$?!X{KO3m}V3;q^Qdfrd~z8dCY3l;dCHI6rsL^ ziQdy)f};#IsN=I2IxD{|$TtqujJPM2R_0goubbDez!;FhoHqx9fw-})tYjBb0&@Z5 zkL3}Qa$YJlbo{}CB&`YqOK&pjS50&xo?7@jobms)Q;+ajWS9|k<%SNq^n7i5Isk^EWnO7IQ zb2!y~s$Euvs`Ssvl5(*8l*m10l?Tp;psq!H=cW2NFYdfdGWhqks`{sE5$D-h+WS7> zEZLps(iQK{Pm3`pE%wfvu2&3p=HYxHT9$;5l$~h!K243crMg7h6jb?;Q;1aEPgV?d z196=hg*vcU#cscK zc?0RI%66UPK*YwXoM6>$S*KAHvJ-+i2$^`%xoGuM5Zc3hRAMe#^_t$w{A5B6wx=>i$A?uojctt ztk!ka#MeU<8RAX~XO>qFa%mXanw4?V?DChe$B4Aan7~H=-t@>R0=h*@M#bDzMrsck zzuyYmu6iF@f~y8=`*?2k!3;BR9&f^Kr{NI7)U*wXd|7@Knd{~uE8hb)rJbql@_HMK zA98U<3a{Y8a+a5n2ZR!G-88(KAu3JMc7kaf62o12%bT>H{ z{E7v5%8Y9)oO2T!4jHEMKtz_;SUc!a`SD#MsivWaDOgF3 zW2{wbK^4qzz&j^Ev&p$5w23!cY(S&jE|ZBLNC?!?lzSaLMTzoXU$oExKg#<xQL~4!I98@c7~#zA^nP1*W$q8ObIV+VSX{Jsd_VX zKjAr(!P!8`P-xjCLefYOp&v44O>|BPlsPD+X+^W!ER6{ijn@(AN8Q=k+uA+Y@5DR1 zJNw)5;ZDD^-QVrU2U|Nko$mhNaB#R2FC{}yOB5<{5M1AKX!1V1?x0f918h=;H32J2 zn^@{>8Wr#Pi{DPPFmj-)NIsuH%>JmzDP%;!;J?>JPgTk2;i)Rj(B;BQ?){Hx^|hQY zH0$o*@7$!o{qEih|Fk4o$>r^qr_k1zQ$}U1Jjw(Y<6DzC1VP=sv%SDzuGz=g{(K*2 zIlE|Ck*ofxI;+qjVuLzq0QNxOYCkB>dJwmHxq}Re|^OFMERpIV8@Vt6bep%SGw;0SHe+QXv%v{w z${tHd#9Tf%;1F;9M?A!9d~)G`YcW-iv!8{39=2|_h7%QE&O&^{#oJ1Z){R2{_c|$H zU9-xQay^#_7b)x25MIU!@71^aS!}-{b0!g3KdH1vGH`cEv;6zJ+Q!`C%c{EOgfG&( zKU^?=@m)~fPaGrIVI1+CNZ+52>MGLqaMzhb`f|8M{PNguJT!fui}!F<;RD9b!0{Yu zL^&kWmzQ~gqq0y*Zul@NRVpJY74sI_R$*9QVSrB@q44<-9nF5WvN-;6;MY;A*4y4* z2HzuA^|F6bv`M^Q5}Y>`C9MdCk{3*tgQ3YHXcib03mRwB3n9@QSyHFz>cKB}w9ZkS z$;_ZEYcJJjN0Eb+gn#($FV$-QbAhYnwHLbozb$FxerPa)gNgiOA(`OX>=;rL?L}pB zYf8PWiyd`qa^7^4(*pz=xZUoZ!2ThoWZ~1>cu=oPaBrscb>seTVW4t}wx(nWFmF;h z>aNX2jiJSJIp5~hz353^j8tX4b|VHEKw?;&33^~!<9fup7BB^~9u~YTfArG^$N7>L z=;Al9N2CQN6Gn+`VQen!$a<~{0jXKGLncQ;7)bOlz;^1g8!X4NZb(aXsKM8GmFY_DuW#I2xP}9g^+O0i6uy z?I0eiPcUWA$hysAo!i|C;T_|o4Q@k)WTqq4##HyRx^g;9#Km9C1EY;6^29|2&u4oK z&mFv>#XNBySzAK&JJgS+(8I8giH~k5KaFje!ZP5>4qbB#JgOFDgdEG`Sb0>14}@~x ze6ck<6VGRp`x_(u6YNH0`ibR)UHmr2oyOV!CewAZebJ|J0XHYtudtFI8=HP+w!i#T zw*QI0m?P8I+N(A)B;-P^WOx8&d_k=jlRudaWh%yb_ia<*QbNeHxe{-N9B9(ecpuFx zjo&?-F08TAtgTEn#j>h`q{ha{Py57GiHJ)I2mS6j$yECXu0X*Wk6}o?C6zeH$|^0f zvVwvJwt>JjpSe-x9tXEng$T08o2U&gW+6GsTu?rcoLz}c+JDGxk%P*nhGDZN7!lM` zA()wd8*?{Xux&g>g&+H!Ztw7LZ)bn28+W$U?w;!I?sfd`yM39!fRS6}jXv$6FnGmt{9HhHtJ+*wx5;pQg@V+u0nAu4vXoJA`AmT$d|6&n zS0B!Rp{f3M0U5gmz+y2(5upFj+??HAePpKA$wPx5@`^mkPK^z2DH`eXeqF)Ercig* z=!IaYFt9VO(J*k#sm4gAP$;zx&Ml3CP`3K4I0=<~*``Qb947D|LSPO#h(2Zk4yQK< z87@uL;IUvBdvDq}^><{$ao_KG{YM;+yN5sat;M;m1ZK$gd5j9X9;3pKz1{7DuIhIV z2K{)ubFj7F8SHH9!`;4CgU+DS?W&!<-QE5&4k_<6Zad7qeTd)DoQcRpXx<=WIF)&S zsq@O4b9Q$FSQQggwkJbE9ev0VeBJ2V>n$c;}>5FLwY)8v(8|W224=zd(s{I3} znX7}ydy6ev)KQI@rjzpqG1OUr1P&~(05X^bFX%H*c$WznQM#q!x=ROD1I_eIK3@=A zd^pADmJaoJsgx*4tecKFO}1zfv_(jKbVrMZtZ;Y;}h)`i}Hm{*W zCwE9NsN``+II}ey(3YXBjJZ1T4H+GjxCA5ZaXPTygj)vHLo7ryt z`aG#8OD&aHqmo|w`G8s&DdMSy;f<-^pw*DD%x4OdV)7SwfV_s+L)H(M@Q1N(MM0Mk zjBeUIxV^tI4E+FV_%&&afvqdgnw5>%0u=jM*5~KCa=cl@fc@gp{nt4ENB{MOpVP-b z{djcb4t_GLZwhlg2IHkNR*I5aW@17#!+k1k-@}qb+I!R!VajR2=+iXnjj<7(8&JzV zg`+{H&~U^|-Zp zWuKFr8Db8hWf~*{Oj*E%XJW4j{u`6?@Oht-4m3XJc_%$p=t_Do&T6AW=f{6ZTt6l* znd($GHVb68q3>?k2e(W`yb3v!wd=9g?VykxmGy)x-leIMi^21r2&2&KGEgQ7E42fg zQyKCkGemMB3=z%(oX@72Aa%NA?)63kl@VFvL)X{uj3ZNXYawUIoVm0|9(mA@2YZKG zgTem(e&-Mz-|qH)r@ObkyWQ{Zc6JZ8JA;0&qYk!~Qha0=+BNAu!t`4f-Io)t#C}C5 z;4zv#=qF$Ng}R4=c>bbR?X*Z@%ould9v@Nek5Wp@3f}ARqIiuRl>aQW&b2VI(AK~=;?h7 zZe{ZynYf&b2b>#H<4VERQEyShm%o79)@1JSKAKnUz1NwJ^`BAS#7eh)mc%7T`(Mj5 zC1uUeT-9cNA|k2Mr*TrT*fwHnlvl~QX`6?Rw`rrsP8s-g(oO@psL`0C3RB^KAulaY z^Pdw_J!x7xaf-_22geFwm$hZcn4%Q7^=ivcz&#IQA1wxsGFLvj1fse)S>@iDvZD=a zB&6vy?xP9cg7-mRVkqnMEAtbWK_ci6L^Fi%% z-G=F`Y}3W7o}cal3-u@@PC=i;f8>=jH+vo?;K!YKKaP9*yPa*-)w>5-yr z-RkwXy1QFS>3Dz8S%y4#^~3$6*Ic76*;IKO8}njy89h>?6ZzwF)9i4VM8|bikLp!P z4H|7L5dJ-a1dllHOc|F#@`9);EAD$>li6N|o2fgwsF!a?%upVrn*U_Dp{<#85yV%)fKVKDe^+hmyeuc(`? zux8hoEj9}fSVXm$+3?$yW!Su?GkXoL%(k~V4CAK_*)5at^E>xkQ)2(fd+y4r>rGb2 z9T7uD>LQm@eXnU@D=)1uL}kQI3OHVs9$AXuiOtk=NLCus3qcG8p6bHmp#Bt_#>_?a zs9U{Wp;ET6kkz(`%i`s#-*}H&)yh4keu+bDD~)n?q@+iOsn%fk*pLhx5_=NKX97X!s$er7t@hJ5OTvV~t;=9xI?v!pU# znx-1ULM_*3)ND?WnZHdgKA5@{jLyL@z0?=uIBnGR!Hj%B&=c1WI|T43Ms4<(GsSjM zx&QhZ=w}9pNeGvErDJq#Q-;moqaZyr=>Z)fHaFpIO~?f+aJvvTN& z^;^X|^;@8~LeLU-0xu0G+!Sf}to}q^mve#Y+NME0Mo~C;UBD%0qEESvG(HL}m}rPp zWO$CfX&EMP&B zxMj&cF${6>9{WiOCYmguNitR#xwn*{jl1^LkW#sHcY|!Vz%K7mmVnE;-P0XiGd8BU zlaW_`r&tis#UKDoIVg1|hi40pcy(sdgW8c)kED{Wj`CrRuVn1U=GsgBp)7u80wT)C zOTxyhBwYlekpsq~t#2alh2XR&D zKM%~bw?9+*hfs+n>wuTR!&apUSg&8w(9l}2LC>C~V3_$NRR%o3c>|MjFpWq3EU2Nz zBIZgtB(h@D=p9SPA{1d3;=fFhZ6 z4-T^B1MNJtwe8w))j5?Wb5mf52X!ii)s{{&qxiC`m+`VC_yW>-SJ@mp%v_dNV$R~p z%|x1K6`FrkdV*;wA*v?vaU$)18S0+qC*`K)LpJ*OCuw2v}K~*boPOvE8c^3XiP1XV)d$l4gn{z>R&-@`}}7n;JF-J`=;@V`Re z3-iT`2PYZF>+pHBcintVfoFO({3kj~&X8gr%~T}-9qnwz4DCo&VhcFM3cAq(nr-z< zI!@ENKJYA|6AG>dy?X!Up^Cn9)lA5j5$kEzoW zoZ_>5l7N&TYBf9^ewQ=n-{Ru(@X_)?xr3;ew6d*ZsnhPI(Xi{bUClbSW-?!p`@$`X zO!2tS0?eTvU&Z=9M<74A-MF9Z3|9`tAZNoV62}2CqmH`ISG#%LvA!hA$?+HZ!}JrQM_SDwt|jsD1b(u+rO@ldYO#l@=h_Fa21E26-N=gk3P(z1rBk$s&-jJvRA#A=kCkRUnBa@FseM!)*}FWaD&LVCR@fr#sq{+G zL+h$*Yatlo2bF)2;3)d=`gJt6~VgmwY`Vms4Mq^~eX`2&|c6MzS~x~%|A zLtQXRBt`Ji=3?*#_6r)B+@=-7Nk)I4dA;7ODM)5G`}kPFv$7eVm3}gZi(r;XYkG&? zZEjMs5@F>wPLp1dRGYKzrrb-fS%lOQ01hLJ0UrnDliX+gK>sRjqE;2QXg7w zf%JswM3`{Xmb^S5GTpl8%F^@l_LX~09H;lu<*2v4d8oGozf^hqaCfi2y?-$1?DzZK zt!=#<>w~?n+TJ_t$Ag{jPG772xO-Lcya<5jeCN(DH2u#FERZEfK=Km(WY*?U*eK@8 zzW%-k^5ed#?JK{|A{qXtbnjK^7Ace_;3v+b-+2h;5qxz{_=cTyiIgnVNp|nE=hkS) zlbCirEfG)BkJ5N=Fp6lP(^3yK=XypWM6nu^DWBnN6x3vrNj}hzFqJE-acNB>MQTyT z&{r@`S}ZHTbj#WV?;|EDkqjc!CA-+_<;8K8un2%Y&6m*w1vy1PMF(kLml zcV98F992-k$SBbBoN&ff-~a#t{H7bg9h+9D-Oizp&E5Ei?SsvTHpOsyp&Rh5ATDVX zyeV)AAWS9;zuO_g5fOg)+9l?i&^T$qL=wVxOdUcqojH@i7S>Qi1h&sM6NCsSL$fwc zDr9YCbS0gp5^~XJAq>LEP60MnU^c{K2P^`I=;38cwp+64POzrI z>r_W>%S#2)hYnSB7S&K zJ6fB|d?u|%IUA>04Kl#S?m44kA@S5*mixqhHD8H+2_j$nb{jI=2jSmkF)Ryk-cH+a`{oTV|r8`?&+i_=m zptj=9?!lq%9V}yC`PuF0Cl*F7NAnFYGyV1AuNnA>-)qT9eSs~=c8&2_{MJbgYt6a9 zr{)DreVnOBpIP}vJYl#mrwj`;Z-TwivUi&GFkKk{^;8zd6WlY0;vpNYRRW49;+h?U z4;Vdv&da__OYuHTMITq_lND)bvS$2Un+18hF?K$-L!)Z1~y0e1j8a(sb+K-jN`LBO)4z* z4BCz|#0BGth5(E^R63Ldg%3@u;-(R<&kOwV_jfdbnBEggilDPGqnc+JC9TNfqQNXr zn2-!n+h8vXXp!jV8Vynf^Mmj0hh6;;Xp%*KjU|@8!aLyoN!ZK@g2v>eI2doGQhmlW z9F-o&$qHl779+-SV+#iXaQx8_;N*|!ezh{pgM*se={{vm8vm&qZp-HxwVE>r& zIB+u03sa&Tvhi#j9lhFYu;g%qlUTc0iI32;;htIi7eg1?R@Mwdpd1VbK}m2kRg80% z^W?dWRb~kT{G&+6-$t|$rjuf8Ta2&LUv=~{hbQ1mJV%n!Qv=Gbl)Td1D7RmUZx1t$56HaO^( z76aBZZ7SEDW}7Zzn&gG$%M^*t3yYKI_;0;xh`Chf%K%bOwbnAY-K0RU&zMXM*jLU6#0AZO ziO)1oD?uP||9aAUH%OydYnbi#8CeQq>~OE`PIQI&nMIHgUwE&8FhqAC`Uy^IK+L@H zqyT#z<}o_b{kll1@g{AUW0-W=OO@&o*fn%nGTap^^YD$SgOs=^jucd4Xva{NGTEZB z`a?c~%y)vC%?wrAl(w@-LUeK!^o7irKhJ`%_ z!J?s}6Nhqo&r2h-=%lF6W<~72pj9iaLyVq5BE_kk9L6YN=U^GKb!wc7QW?kFrkyZk zoq+!!9@=x5JUYiI7VgF#L`#u^WIixHt)!;jbtN<%4u?K(xro*V5IXVYkE{m`t`+HW zn6U7)65HL=;k8lUo959aNb)L~DC{j9{i7P4eI04rPukLyk;J9*^!aQ4S$J0tQheVv zJKl98H@?fvv|9Ul#GGMXVW|3n>YQ1+tRuu}$wHHD$=+xne91CI67sO14^H zHHnZa{nsHY%YhN8G}>jWFWJ`!;N*Nw&4k@xtmp%k54QO_#d zpVZa0tISlQ6=*;_{NXW9(znk{eN(tJW~a?u8j;JfK1U#7Wl$t@-*4tw+xMxb_IG#V z?XBK+=WwU9w-xVf@96HJ*V{kbI_!70_Vj-DP}_>&Yt0PMBs@xfPAZi~&p~8iTEM5d zk2W49C-mvF7=w`2IC@%x8->+eP9@WMaPjj&}?-OMd^xB!Vwyl zHW;9y!1u*(MTKFfiw~@{R}w<-TRWUy{IB%le+5NBHpA@ANr@hgX-US>GdLPVeZ(&? zqQ6!Ip|rJul+mTYWMJ8NA4`PN(3w~)7ugsXT#+P@<&!72TCUS-CW^!Yp&SBY)>+uOhw_+Y%$pEVuvy#h}Mde_TzxdRERn z2Hbt00e82zyS2T$v)kJq><#vJw)O^{ozDL5;bCvkQ)=sAXM1aFtG5)!ZBes7Xf*^W zQ2IKS+#A%iKY*tFP9|`59Jg~u#$#%Eytlp+K2Za7v^+uKfWN%&VIK}$9 zix3P|rB8CW6Ss~aOF2wop(1BirdETiHbC=Mnrr=0?W4M~fJ5BFBW;tF)`;<=x955m z+EJtzraKW6F#~95oK(+>z~^hvW<``F*4Agf;hHI7y2%$d?Juth*q>Vy;K37^XtZsn z+0?&F;ItjHyv-zEungN@>ZFdt5l|uxXXQ~if-i=);)%iqf6JKJFVW1Cb*a$SFnj>HR|<}kz$(QRoP9K8wf(*84td)uY2H?VW9=s zrb>ghRAiYAyA-}Ev^SqqV;-*2k~-YgX$~r1=}}dIV5;oyA4c7+4u||$;e);hGr?2} zPv`Ls!jZD_v06aFEU&hGv}6sn$jD7b5Kbs=-Yhw@sAvn$^4OZta${T`Q$4uiov<(_ zBZE){{hvf6SWre&#GyPxSt}M3SHX!lGp2xU&@q`Zu$Zr~X-$kn;B#6+dI3ByEuz}zcYQi0`9lf*}ST?d@!%*=D@3A z!J^={Bey`b?wADO3B@RuA+?aTAbRXSGWyATb(ec~%#$VWVNAZbX7i83Kr1>ddq%JM}o^vEfo* zsewUIE&_Y0HwVgU1M_8y4gQw}1NSlTNUa_;V-w9Dn7L^^M>I@i9rdNu)MG0YBx3Mo zK^0DMw>VN=EjMg@uZaEiiU$=3gVXbhpT>CSbXD5Ol!bYIuSrIDbyB?0W0D=% z1(E~yM4?)7G>=voqz`pw=WXF6D*8jx@ezd}5`DU`^w>dNM+P}d-WQf!ReDaXgEjBG z)TYl<04|ze33k%FId|TITsxU7c3#kRYs_Ejy{OESm*mMJ3>47vf zgMZC>2GrU?zv)FY6$j12G4G?xOCt{El}2utn zZ9KMkB3Phf^VF+H4!klCIa6)6QI-*Vel86y?$Z-iCfF=q$w&~~Mq_QttqN<|p*2N8 zKypk>m4y3vYGL%84>4h@7BPH}KoB*$Q82B@80XHVTuRR7ZO&yPHq0JQFJuApvk(#i z?QO(-D5h^3Cgk0jGu=#PHw_%q{0hlLedaUyO?4|bMMPG=ax?ULnxkbcJo!ffFy-Ul z;N4$ZKJDwX0LXlXQlAISJlOMf`W>g$eP!Ne1pRUnv){v0eHgk`<^s=MT}a&_ z{DwXZH}))W%V^>bsTUt{s>f;5Oj}H5%U5K~_vEWO*VXs30x;=1jkhwu>BD=Yfu_~i?qA6$B;#0H;nmoNyv)t6da3+JKzhA2*ow!XdyOd!pZx%Tuf}Jv=~P|i zc<|o3q7V4|1sqWL;{Z4Cn;br)a4~p|{2OJv=);HDPdt;q;OD^~vizF|uqO7m@4er+ z&ZM)|G3UY``_m$c@y8SRFWiyGx3#xphPc?@?*{j*_#uUT7>WwmE;6L5sI~o;xv0(uoj*sj>uj< zsJm{xmpww+E4_!MD7h=aW8{mUlYy88_%dpGqOp%amZOhC8TDwRPrvp-vf>{$ zEkzLpfj-)9aK?xZt!7sNATrz26T!ocfrvB_u2y|$z?_Z-iDB&?y|aJ6sZyrPO?sk3 z#PS#$q2lt%}Rx2$9dK!+v@5u!UesFt?03R6xJYL8W>!H3-LOyREBKgUYEdWzn%o`koTKMSvR%K zE|ui2CF!Lx4&k`XOk1`Y_nviUR1lnIbSXBk$C=Rz6l=5H=Ym5N9GuHMBW>EC@Q@{h zW1JeRJ_ur?i=htanp!fI@No^6%+|P%3^$qSM6)((2|E|a;^2ZBJ|B@r&iTFc4 zw0(H-p}P2R1|As)-vUp~#q?x$L;uW6uXwFu?VmWF!}X!uLB_VtuHAPDrpj` zgtadBIom@bf+W9NmX-! z@SJ7&IYvB66!S~b3)!+nraH9xOhQnzb=8;L_H%a3jo9()<=#A!9+;x-zkBn-qlOYt z+w6R)YwvAf2QG%%;v}JQa#AmU=&*bEtSOJCr%JuIQx~cC(WXRSLHxT(}V7?_C~%hP6}ac_^r=O2mfwK@`ihHY>}+rU}+ z(FRqSQ2XUg+c;JZP2<2!X@tAh)3G6gd0Y9@qI!0-j~aHfH+Jx_Xw1&@b#;df=+oTG z2K=ZE7n%&eXF?id=; z*=UegZ(f?RWnqID;AL;~V#t4=-u^7};VIrOt*Ly2$z}X8x+}oBG+|`H$rzvlb}bs2 z_N8<6g==|NGVBx4*lHAQlvQ5n7!^lf!xefHJ!eJdI@Z>2y#xz)dt^TU$n37wk@3U6 z9;q2u_QO6K)zy?_4fkQj#`w9O{`$px*r0a%!U^yX)T^VZqiTaB!urUMFQq&1Wgf_t zw9V}%zSd2=x4xVB#iRSLeIe?xT4Z|G&Sl};_?qobFHv+;j@!hJ%%;V^IUDh2C(*X< z?61{E{PDG_POqZDjpOL~i&9lE7DC^c6menDF-BB2TCQK&5V+lT*ShTv)@s|mP{;a5 zNpAFQnZtBesL{2_Y!^Q^@bCZnKgv^`rfmW^W8KKOPy$5F{8X@fc{Ah%4*HCc`X;^v zS00aOixka+F=fkKAN3ohzHj>WJzT5p`-u5}6DH!|el{D0KGDByioV5)ouO%p7j2xl zgez95M!0veiC8i@NuvM#|H9_mj2w881SJSrWpC5SsAi@DKtcu<;&ZzZm!1~stkq5o z49SN_-=lCt_}9gU^lDzvEEn9|l=xx1P#YDws|bO{a6j_A-#mF3?Q{=1rs+%smNt$7 z>>R9w^%&Gt7J1P&Q>~LJA`G{Wwoqbz7qoOa;80d_O* zzHFM|8D@VTXp53Gw=RryhMUT8 z7!dQif$egcOBPO)LkKV#)7S7}UrjL$l&19<9O|JGt{E5>lHzf(>72uR3%s54_q%Uz zfwzAw=x__XU0#G~d(D8iKm2s`?1!J8qPZc|Ok9#D;3w+tFjV6Vfp`=*XC4XS9}eM( z1g9m5Xz689gk{WgVYLQII=a+V1A284Wg^*6OH&ewIZA~t6klb5eNzIWH#@Puy=JJ{ zARemW4jaOEb94rK?j(Br3tn4dXNeaoJE_$PT8w9pUr3$50T6yXzYVq50YI_lVDMKv{e0b~k3NtrDpCfdreEeJ-#eCe zm$qIJ_b+3ju<3y3DEs6Cm+o15@|~zO7;gB=ATM-slD+Evtos53e*= zP^hk(#=|4bK_0z`$|^~bQ)r;1Tu`GruJsVC7q~TW293;xn-@8qu|>h(Zmm+TypJ2xpgKZNg~g+n&%mfQWj?ESo6sM$Y%`{bXi_s*~;BD|w?^$yTtPJCV&lY6@vm%SO+3j_O7kNT>As$u((&d*{;rzOV2 zbQX;|QC+oO@K$TDD&w$TnARr*@&xB-a$-vZHW>K{P8No7%gqK&Ht5O;by)GWrAL6s zjn$f^QHG7zZQ0wv)rxoCdL_G#ULL>Z-Sq6`Rf_9o#_(~wp5FvZ#UZ) z+-&QWs(ORfxCeL zQVBy^6Yo-E@Qr?yA4MBHj7M+@HeVb>M;Hz0Yr}i(DQKsiZ`#gX1hP2;_||N69su7C z1K`_EyN52|uua+v+470yy^{Gy8vP|<;C7-1^yF6bh^mTU>3{Mcja>ROreWSdu7@$d zK|jwz5kpFF*AZoso`IuIN#w zZNf@`X;TQXO8x#0`>Ybk&(H}(h@X?zhGW65A?pPk_RXkJWrfHJVS5}=11jp$J*M7s z)kvH01N_8owQO#Vs4p`|6iHRO8Rw4{iK?YlC;*%(p3X{Hy!z3Z`FR=PY(xR0Po=Kdi7wS3qd7WIZvOWF~zE3+TUQ*n~{dtSIITcHKNr8>zZPea_k`^uu+xy*;pCk zXD6*;#0fk^ny}nR#+sY$uI#KCu>B}~#4XNM`0=p$S$u?=@6GiGqp};yJ?gel` zkRQZr{=mKVY%7Y}t+wi|wqBUG2J@*J7tH5tWMsx1^@2I3Mv%JbVYlfi*aNm5$ze-k zdu4kIZlR|@jusk3vC2xnhR(@AHg%^uqwr-^&KUMMnS~jOVcVw&JUz=3TsN}wOWjrj z_@zB4w4P1(bOYf-b6x1eIWF{J$GOlyZf|uvJG=32U+Ke6Z+GYLV9+_-+S-ei?rz1Z zKhXQ}zHM54-A?pw^wj9bW8~>LBB+FMxi*f}Ku3@8`b4FxE;0MQ(OhlhdSOazF`<@c z=<1A0MAl<)$Toz?beS25hG{EZk?$xS7o<@MMU#l6r1W3DMZO+BqS9WQRP@h%hDd)i z)8T27ub3DLn zb^b5@YEW8OiZ`L)S#xepZ5`8&JGVP)MoA3amZ^Q9ey92H;=@Q~6*c6h)=MrPVlcyo zgu^z8oQ@0%Dk#-c3fSEei~279m#ykU#Xq?dJ@*ET#l`YAViDLC##K$QFF8gi%&Ok@ zkGOTkZ(Z@fKUaKr&0KM86G4WgDXr-n%mGDN&s0&OQ$8exQQ4kFp8~y{3*;2akQ07vU)V&3e^ zq1`oe*q_eC{7##8+;A(yZpLIHl7ZzlgAfQXA$)^&?`(NuGN+#y3j_Wf-h_-mbEq<} zZLc*bBpkpNq4u&CS7WCYgZ)xtXO_8TTcit6e|C!0w}eLOHukWjQ?p*Nhx_AA?)(d!VX0(Zg~=1w8`zV$MB%KY9N<9P337C zMPsv+kO8N-jOt3=E2#MdSmU5=Do1I`d=d?p3J3m7c=+-X{`E!%E(yK9YkXvzWD_od zN&??Jk*^b!zoEQ{j<2keas=Pu#9W!IZF{3X1|m2#*8HppNVl`?LLgpHY8g?EH}3YU zid;Ox#KS;MQsgm7Peila`{d)Zdc;2@>3M3sE14Ad@L6pB*zI)o%z*5-F5d@k*r(tx z!luuLQ9&zFJc|#zUp2*A5l*`K&R16wa<6{4fApH!+Mi`uDTu}AuM2eF>BonsT2;}} zsn%6I&(k^q+hgZW=U((MO<;=JNB9T%_-0Jd-ZCZ#dw0R^>E|&Y zvK*!O&6tn<>zxmfKdFgXp`gD(Vt<`Xf~- z);Kq0imur!xSt^xRhk!eZpbZvhE8b?cOrKjtd;NUG&8>?3yXsP^Ycm?Ly%c1|bACp2pPsR*u*HMguNZsF}3d4s3VQ-=JMbt-$aYZW6=wb>+3*i=S{{sIuN>Z%&22rA7 zI3^Lo@Jy*nUgcmPC&Na7*em`xbJZ;dYRZ9cs_j5Lplxd?b?589tA2tRE#Y-yVhZ76 zndx07aroiIZ`H+zv6q5_8PCAO%5D7+UlL^mz)G+W4imOwrPRch?BI6I8r`u4nngE( z^GOTg$aPvcsO0S8LrM^%mKge2as#)jxbZbMRl_nPtVe>kO0gj66WxH3;6$Bb=<3QG z^rU&_gwZ_(`(r=e+1c+YwY#gkdY}&ay&bjJ-`O8*b@zIDYj?lf-|uhrmVzYQy3?Jn zYvI!XwzaZQd@!iShHF5{zHWZ*P8|Kv@-f_AODDnICWXr|Cxlci5?iL4aPbz=Qo=T| zIj~feB5r?5LtVUAHlsT$ndK$sGCg)FV@Wlm(xD;-__U&?2)9tPh5vr{?Jd;o7HYQa z5q=(o03_|2LCuVDJOi2Ank58@$V6uhF&iu4&&yDLrJlFZ=ccB%nmLK<1_ZbI)Fm;*K@ z0%|*mQ_==96hRj2m~kbN#sGke;Bn>obO>Y_AQlqm1?YG;VK!b zG^waGtEf0^V?zWOH<*9}2hS?FT$8(IP;abW&6bm4{Gf(dC~|ei&9@sgm{KJLs-Ys2 zN?HO3B$+%<4s%Ix%1r9a&TN-OA0%yy@V%B`$!V30F*1y=pTld#%GQitDd=|{ea~zc zh~R1SzqY)FjI<9Iy89yC7{6w)0g}j=ri!>?Zyp~V6B>QU+g$*+W)<;I-y9#mrtOnD zcq__cJ)xL&oRmXGxyom_<0{pYM@Xbo708=&|25L4(%$2aM{}C7UGHLJ5nZS!tgS&b z5D4L=yoBvN*X?wu6?f*sxYSLKs`>M@J`1|#xf@1sY=ziIo+<*tXdjqvjTM=6ClM>| z`Dhw(lR!Mps1rSU9$cs~-yPQgL=TM3-YarF9`H_Bt$G5NU={|sl%t`ZIM}lIMW}rF z>Epbx?!(tn@8ZMQyfOz`TbQL`nIlC9W3ui}v5f@QgvTI7Hy-6jo6OmS9W#;Z9G*O{ z=iaq0^Y8zUCac(p^3s#7VB6MMkRUBVOO#2nx$U-;xICtm?;-}yQfNsxbvPI(Z>1sx z9xy^$C}%g|^Ek?m?K4=tn6l3KeM6T$4b10-Z9c+e+i6|aC6Ux|!KqL5bj|s+!)wn3 zQ0o7ve;U4R1l|Um8!Q39)3p||eN1QF7T1(yH;gVmEKS@m@+z3Fs*({LWi-RFFI}%r zWg}pz12x)Qi)nf zo+bql+@PVknq_p{XUz0(q;JL8+Zey;>Hu9m>}9pBxAXzGIh`*T`?<~OEHBQtwPrb; zrR}Rf}suq6fvb5;$EmI zyYy(IqO*LGV2e@Dip0ivJW}ftPUW27wq7jVMIKe-MO=r+u*ljZo=o=2g511LrsPwk z)6_2!@7Jg+`U8VKj^D@P$A-l3Kh^g{`R#e~n3$2oKQTAnB7O6rtZX$ecPF-Avyg!` z4VT{Rq|?@#CY{38XxK{?qaxG`4K`cF7noDyA1HCe=}^et83&SD&! z38qCRiV?7hhBoNvIprheGeb$OHpXu$Y0Cidg1fB!{_Y$OP9R)N7}dX>J7YG2WGEDT z$LY4s@KVmidgZagGvWBsr&F$1)c_*}yLEnev8w)qq^tJlrmGHubk%mF5TI?2DNNOp z5?9+(;KZlynF|K_t^sV{NL4knq8Q}4crQ)Zn@JoY!w3ET@f~>HF)`nu+!O1D>?Z+l zJMM`9n_8;#nj@f-VCQ-;{W^${RwyDH79ia13{=3aU%K$$Z~f9+zjS@|_V$|jrJ>#y zf*=o%VoA9#sVm4Rx@TIiTelE}-iXUtN)nE&(@}WRCs@X4{P0YvxBa zi=rCU0h!a|Q}8|sD>%LVX`Z(=+e$YZMz_6Y?#I+tB27_pV#PJFh&HJ7O!b*TbE;7Q zSDiG)o#C2JFx-WBfQqmL_!g#n5GIu=3-0Yf4w;d=Ly0dz?GYqEaf>ztCd5pk9kaz5 zZ6MyNM=hIfH}SGJ@y=RrVy^t9J&e9|MQN>&dXmMY5u8Ns=XEt;5{shw` z2K6;nuZ%^_zfBmePxm$yu*rmQYv~E61T>b`BqKqRGOi@nUS6V6YQy>g-+oBY)okQf z#+crJY>~tL*RrDu*VGWLPlpw&F5IVM$zEY_^<2y*{ zyp#ucmGWbR0$$z)^EOa*8>qSsRNY8xV%=IH+Dbo0PY6oFR-4R{WEbzj{%mxf{+csV z7@X$^q3568&(tR8~b^(jUoPGK#p;_O}%Ct?~mH2^Lo&AyB?*P$H2ZEKC{154)(6K zjQ%i#V0S5ult1WRbfo)rfy|0c+T*Qz(X;HVu8@Q^iJ6vh`P|3XIcG~DuK(1WJ*Y84 zRhH3<{3PkG?~Kj0M6)Vsqti0tW$%+a7ODPeqR(|4G1b60daK4Ix@-NkCRWMnl)8B$ z4<-B-0w@F*q@RC zt6}rK&Uv|JDt)gc<_Z%qL-Tf zpT^p2;#Wvu+NJ+&wcOk#_c!=l^k3IQ|NYoG*x8Qvq+dnH7=Jj+K@(Z$ZsVJy>T%N?A>}_t z4O!XR>|};)oFf_?7Sh4NoMS&#rF!Mo;G**Hzkb#V5M{33Hlt<*T=Kx}jcLf1VX)wo zFO`4E1BgG+B&ONO5R$N1ZQhAqrA&C@AU29iC}Q=sS7<@AMr3s%A6@2PpJ05opXjQ8 z+WyZ5N^GW${Mp~&+a`183?fgP_)14Cy0)?C+G5ek!==9M55%wMUArJN5-e#i|7D^3 zFN+$9;0eVEYFp&=bu2cep#wA%`zQfhx=biuyoQsis!H`wM=;X0m{(@{o;9fqNV}!} zUWP7NGVWpF`6L?8F#~}{x}wTjVjq~Yb;VjHhuBHD788Lo(V;q5+y>ba%%cio9})#E z+y{;2nI^VTJRx{uEe>uUQ*;_x6Ti(D8q)F(FV6Q`%uNNeBJy`FCWbbiF;^^)*&xq` zWirmWO2ah=yD6ZXn=bX1TWSYUjQTOo1s32al3eZ!O)j1`tT z45^rCh(_+khr;7^F)TH7$w`{`RO;Q0Irj2?jTS5wShSug{&bB&1Xl=XAY}9STx5yCJ z@b1EZgs4_s9o&Cl_js#5(e)#<7Y?jy7Q6aG5>KeP6t9 zg?HwhGj42KrR+O~t~VaRax;ViBZD-e=*FfpiVFN}RZw4hnQ7*=v^EI0E1Xz+gNzoc zfiCNb!)wZsw1o4StB|_1N#1RQ?>54B8{xa5_Q}%uL>8V@)(9lDmS*Mu&jqfgkkw+I z&%Z5c;8{{>LVIPJ8<&EX;GzwX_EaS+Du!56A{fYj`)}XmWz~kCP>x4PB#;R00LAgf zc~PnsU&$}(UmL_nZjQ-xvpt5Tv#cyUpU=J6we)QOi+*UVwdpRqNCN4gPu#&odTxY` zeW$;=@$l%)lg%pt?poCInYa78ND8o{kKl-|nXK>*@kr)xn*RoUrd$4-6&~_+3k!%N zhKi$Q@HLph>BBC7oe`ZOQ-Rbg+NSD$hh!$4btoC)Nd%YVaxJv}xR#r~$(GDdv+#Uk z8z-?)nAIbhia_;rB|R5>ZDNDjn_WfAnZxtf? zZ$>!&ri;WSa~yp>BDd#cqmBJx?7bEEbm!V0L}dQW&)~aJJ@Gmu>~s$Iz`+}1jX&(U z(LDaF=;AN=&~g>o@MLJcJ1JaJ8OumbD7q-E4pVI_!PAkRd`%?pN^T}Skukw(+U0ri zPLGNKISBGeZ83+R?05Gi*X$3*lNheZ143Bx4T$X=3M0D%w*BzquO;2XB)-g3TpnN+B<)mXCyDo@Q<^92b7f&y z;(|4S<1h{-0npn3{NjJV`}Q^fe;a^bUyEevJV}c~Y_T_yFTSo=w-cS^X#&pMtXA9@ zGhpG!cWK+ZSV*XdL`mvrrZVAjzQxBNGAB_t8e`E7MH{5??@0a9RwvE)0t)Z2AJarU zN8&%SqvzgCDy?WFV0Bq=Fm`>yt_o{wo8Rof_tJ@x7M{QzVI^4(@rlD2UL&bJTEOGwg_HTV0ULUxeGmI5yWaM%6mU+Q1NBa zUyDFsmS@Wg0k)!^Ds>yS?ce{qeop0zc+w*DxjD73gjx{{xv%+nf}S|#ZdPK+5!lXs zIre&LZd-lod~75XCdndJUGvsVeVwtJPY-ZL-)$~x$%<&*a#7^wOlc$d-&!2xAKOML z9*@s-`_&oIqTPcnU1rH(uoh?B*TA24*B;bSi9~@cRV2UjP`3$$0#&95#@{={-`>raWhwxtlO_x`1 z9)KqhItnU|9;A7H2wuXbi79d<&yOgsUtIg9i0t(PLOf$}CNb^LmVJP0Z}js39lsXyPK3TN@tZ1Z7^F)YM#Mq^p9gOvcP*_= zx}J?tZn_}eTeJBLyHs8!+@R8Gxz+QFNRI(-^R@zKrmXU!Tnp*pQxlNq_5ZW?F3W9W zS-SA6AkN@~cn;~*U3TS2zNX90w2$TNtn5h!NPr>|AixGdIjQ&uHR}iHh>q@vKH-R- zcv?Nlkw-_)7pW)t*KOYbkPwI83Efwm2S6=*_|) ztkh=wyugqu@%0F{P+-81hrSZ^9$$S_LrKDrHQ#qV!%Af0P*ZT$C)dXul+O^l2GM|8 z;>wLV;FrqGanop-0at;pgOV^j`qe~g$GKPNTpb3E+B#ITy8m6$HM zVPUZf&D#upO2fL?S}~d>*EeXh>U)0K;5_DFqKpmB@wJSTYJ2a-5=>wWD~1#1!9*%5l<) zqoRx^ky)@#I}%~LVgmDa>xK=Dzf$;}7mRqqtYvq9X%!TRs)E}Q@lj)=# zL7Lr!A+>49_oKKBh2^SNob5wC-bZKy_&~}zyg@ciNpA(YWxC!3Ne1$e89GElO%Dc* zG3(YGwgtuO`OT>GH}JT{KjtHRm1t8l!gt?c-8kx*__+tc@gMKQsE7Z~Nz-jj*xn-> z+xtD=)jQR9ZTS3)p5e0ryk|6GX5|d3`lGSomPj8VSRkPw5mCQCO*}{?86!V+GJJVa z>hd$kNP0vl-kEO$X7IA~0654dr@a|?raVT3-Nls8g%?|8Ii(M&W=ZPS0&KDKNgEn7 z2f;gkVIO9}4B5Aq#6)X)OJ_9;0ylTP7{cUA=1k0(I9y;NVg8v#T#3mYmsN*ZKDHuk zj=0q~qM1W>=svN&CL;dj+e3HK>2h{%k&b}JG1|;&WP>)eSX`LepN5#VX#^~w=>pG3 z`9`=C-Ql_#-^y1$_enXDdf4LPVAZ-duadwZ(Ys2+NYWZYpr{E9^D3Muw)Odl<*QLy zLN&7~EET_wz%m}@ocXhJ+6C-*qawuS)fr7>3Qv=vPA@D`YyHEnHw0IPUS2bk#-&R~ zswYGBJSZ8_^y-6`X7FNTLUE4IishIATm|lhLYnZ`&$)*`_bx=(ll!^4V8aNybPSx& zzU8#u0`9+L_^}1tudfzy)H=Yu>P~bUPHXI^>G%hW)GH+%zpyh}QAT;y zrqWU?R>VfQwPIZwysu?ZHmxL?XyFe-Lih%h0?%Xs#X;>Ow?rbjxid(TTH@gCL}+Zf zqix+-$l}Py=v7Fyp%r`d^{cbDYulUcaLliN{OUj9>Dx!&wZg-;rm6Ax$;&5ipR{64 zsM^I`b=-Ibk5KCRAfFl*z=&Q`Ou`}>;vh0f8?ts;JLD8pnzPgm)}RL-kv@A z+MUd+*KeP{`r)hs%owQ1u z9#gk%!tJSaQrtmF-C$9Wc*PXp^%>5@buSyWd-eMaVRY1v>bXrTm&<@L{b_|H34do0 zQi{$@kOCUAk2mj{32o7>qlqaTn1WYY`gf%=k=buCRfc7tbV(4eHEvN?^EK%OUX*=H!ujHrJtD2oSbM zv)VfZTR$y9$_V1ZUPPhB_uH zN*@DxoL{8leT=%hGJepNcTxP|xn~J7FByowjz^~bTrr+LhfjLWOuuJuo_DIOpM>I{ z^6Unk9#RT7QC^pVg-?GI#;3iAT#~|rr#EdJ_$qi0j7KbAT3&W8^CmcEH@fd+UtEAQo z*1k8I7Sn=Ea!sMhiT9Z27#buAFns+^Kfo6WQ!0D3VLk&N($Wb|Xq!+q{EzohiBuK* z`7A3m^={nN;|xyJw0ZQSB3!^x(>AQxhBYgAo+KPDGX%8_YStIjoUA*jS@OGfYTzak z8D0Hna`m5v{Dn%9O%VSut$WTePO~KYl?s;?fX|#T!04_=3a5_`g#{Y>YN1E*h$fQz z;q3JFbB`X7dqZ9CDY&Ik*E<_!gZQ0)0rAA?po}iUzrfF;0g2ra|gih8yE^v$8(6zTi7=%M6pQ(}X2Wl8!w3zMM8=@o zeJj(o>*vkZ#M9PP%Z|C}$sCQd&@v^%t=6@EIu0RCjAP;IrSW@aZo+Cj?1)^|=k3R! zyZ6!6!`>;Q8HBi#(x>_VKF^yQ!cVWjELMaBc-<&tQ4Rx|^?9*-H5*&y6Sd?CX zRfd`4_}pGpm+Hy)$|UIAQ1M9Rb7`31NLP~i0lRe~yQ9!zabL;VU2k8W*^`ni3YYqe z==JEbOhJ*V`A1Ebtpt2gQ`Ar>p&nu2))p* zIItU5G5y@~g9`jbty$LxEA}2_@zqCUwje-jO_DzFFLD$6TP@>Ch%}uM;RnS&ntn)k zGdo{}^Iu%ZJ6u%AJFwV>h=v-x0PNzPYDTWKQ1`~%;I7JWkNuGkVew_+8-b}P{nNF# zPp4!43nX@lE;7lYz%QQ%>W6!~dwc4E^tzj0wG ze|ib|6J+jva7l%DqVWxury(vnsN${c-z{u@9v)fE&%>TSiFy}d?_JpM;gd&2bko>r zZ;3$W9}Yb%NJHxOQ`m=1MK@{;W18bUt6?j3njZ6~_YQ9QxXXlkFN8DhlcA{({7BqbvEH;YrkV_gt2NS%@S54LPse1 z`3nF@K)1h(xsHEA8pU@(cle@8@7VRSk{BI{x1q#54EsJX9HU*N-(saOMIM}lBq!t^iWO5#qE8@{F{%e) zY3L6|!eGjHDX3Y2-%?SeL?2EqEBJl$+BSKa#hIDoW$x|u$b@V+V?!*~f~$bLde5kQ zW%(Q%S8-SS+TILYPeUY>EQ5`qz?;d&sO?EIH|E~7-#vCsj?Np-c%0dFzPQE9x;~y3QqWlH>Ptyvx8gH? z^S^&vQXynrL^Nxp+*@iv+Oi%D`__{$y3NQjZwn`SH<`HuPm6Zph8G6<)(B4~(%oe4tuy$0=mI$)AuSD0 zh@^BQNJYa^l>G>hRC!1^yM{x5=w8a5032TjC0WrdNy|?tjK=iFJSt*rleT_Pf0Hp*xUJiX zv1%?%vB(IHDMMb1&FgR$4Wce>;YptTHsifC%qiXr6x_)lpsI=Nxkv{3BVx~iK(8EE zluCH!7V9exV+HLH8PSa`a7-7C-0?yVXSZTQQS{pc8yNU=vAS3PO88rKBg688o9HjS zH=&>Op1F{zQCw^RSQ~dtneu0p z?6Gm?b&^Op6ekW{HlG4ub=vfVozDyWQIvEnY$NQes}Dr!!dHx(O0q?fW&IQZw)O)k zD9U^!Sj&uflkrq&#O=aUUHx;W70s3Pu|b1fU44LG78J~2ltm6TH4;ed&_4~b1Sx$Pij6LehfG_EpCdZnp_51ALq@MJ%+}C@o@7u5hYp>UHd`(ZJ zRw5O8cPFN3B#sAr1tT95W2IC?kyjJblCE%|#PD}N#$P6ieMqs2z$1*quDMN^{)(eO z$oos|^0;rXCpNuQ1j3pL4nvQDz9e!(a1cerZW2kk{6;!pFYijn%}h2CKMprWtmS4; z5t4M+$DBKEwPL}y6=5yrNR|fIg&g?HWaw3=_|Ahif=*twOKFU9r;NSL+ zRBK~YdKF_q(UDMBC1Le!Nx253d2Oj1gAJ4<)YDD^%Swmpl_lG5ZeERm3=!D__FG98O zc-AM_^};i~oR+NqXn-OnNV`Utbz4dJeCN@wih3ok;aCZ_BS{C(w?8g{(VHiER%S5` z(jwuEWpv}vR0l%YEwa~BO|TamtE3V<^3Xu=c9Sx9gHyPkcT*@vT3A!w?CQdPOKZw% z}7BdDix_DojoaOr4}L&G^>9h9aWW9ELDAEI2a zJGMr>QloBX-M7Lj(qMqtbQBOExb;VGydCF*EWS;r>%Dxs+&e_y?#jeOTWat--$?DMJ?jR_j_MOSJ;aX07g;j><2?emXIaij zG4jYtg!IQZ3Vv<*d+f#-ksREMWKtdD=3N5gxOQTkPRmi2N0&Tr#v6;~7(1$qX{C5N z2asxc4c~7lg>X*|C~6A)oC|*l45&=8J0)=k!j6I5rBv0-TtQ?0cMUHQ2`W>GpPoWj z{~aw9^;^dB(Hy50fp+wlp}909X-(lhnBEbS+{iC|8MD^>&ImO?lX9w>^i{XBcY53E z{qe%;{fSe(Kj=}t`=63EmFW-E%*S1o=w6046IuqwA{A*d0V$e{bJ z;!O?bPv_$NDVJ^8d0TegmYp{;ggR(h+4*}vfh9#x34sy#If~nW23sweJcc`0L` zup2J&P$9g$K7zpFugrWGhsh@k!{qx;n0$z{s6_@5V!5V3`4Hz$&*%i%}Q=gU20~j06W0r79+CSkjvnwWj&G=^9{0cF)`2-P`kK z43-6BeE#I^Q^&rs^LBiAbfnPdMG1}=zMlj#!cvq>&~)+ds$L`reL;7i$#w!u zFS@_$rBnE-eGUFV5;#G$n9m8>e1g~Z@vWMKtMm&(4C~w84e&)L1{TEf+nd+!{B(BK*~CD8vxg23TNcP`gMfH~28;ec3p)Sw zUsoSW|k(t>Fj0BTCNCTa?A-!&;4nm!+n#>Od@pdFB#nF1})wu%ziLIb1P&s&wV=W%>Dn zM%cEY96*Ipl^NTk< zPnTlTJ@OvoJ-knUIZIy1Y7;-b~kligh7BD&q**Jw#N4 z(YD}^Fn71|`SR*xj9fc~49!;ZdxJGX-W$ZfDfp1!&>SF8f2v*<2|s70bBLYp*MiUmfK_6+vpAZLQh{PBL81k-IR zX8E6g^KRRU*|uWV{e+)a06JkO$@ax3jZQHj{I{tK#aR1+;#Okd^F)46cJPT#9=XsN>h+RoV%kHCU;^@FyR<8 zg97J*YYsv_U$m;~f166y;X+)`;e98l*_WV386}Ea$eik$0-AjZXnt1P0PObD-}shy z8}RClND5G4@i%u+HrJ=ZhYF+*s~u?hhTjQ6~L*0p73w#f*Tqt=mh{AkF1BrKd^QOal>E7n90 zAtBKPMV9xx%V@%{E-)hG!RF94B~l=F;%7xsr=x56IkiSvUjZ&Fe-j=896D2|6ERVq z36UdRUBfAml;OCDbcKWidpP;0<7C=ENu$D58{MM$bRJH>^`gWLmsZyb`TJl0ZHZTp z{qtzx^=IWW%>94=>%Xt*;k7P(mk3y{KBkywKsXm6)@_C&USpvPAS=*cnk`EuZDQ6uP#jCDBdVKD9dy1WTYI{nY7a|k3idz`>X^5W91+Bay*rS@s zp#e-)GnG5-Gxgu4JVit%HrDUP=v3AQq1^q5<|MY>bS>VrUGS(g!Rgs!15T!*y(jFM zOLUKe-@0BFlpRm%2Q=zSc$2PMq|gNiyU;)fy6@B@c(1A1vQ$xtZJ~R2Z<{T{NTK+U zMJg|{eq=6E#EP?0h7af3lfjZMCSthyeTKCtJ?&%NnITm~!i-l9By`oZvHh!$Oe|=X z4rV;$UTcKGi?F}IO$f#Ly@@mn?Y880GOTb`q=L^P9QQLk-yIyjw^Pi<*kSLmGMArf zF!fv~%_hgqve4#2nljyogex*GW@eH&umpQnj(edf7hMWb+YJvcUSEwgSIT2_eYm5V zJk~miu?=UhJt--zOY@F}*Zs zYBdC_9I_&f68o8jI5a#04+%-Ro%(bC3VpOzT2u`MQH4rW?x`aOR5%_RlXr9ef?5PB zj8OhxO}j6HfZ6r{wmpDt4`3tD`?itcJaZfy>AJILGwzl0C&LfMs%9e`cPT>YR(fD9 z1)Th>`OfYz^&QXLHL7G7Sc>qisRWCHVTBS;I77f)Px1^-i!mzPPE~MRbM2dh4cP3; zSlcLT+^AIw!b)-}a*7eNEYTsPHfj<F5__`Wtf%Sq6@@W z=+&B%F5~349>vkiKLuZZ9G1SivQ>2+K$MP2AhZ8jmGO(vV#PE|Wk3wqFkyD7`-gLH zxNW_iiC>PqGWX#TAXM)l)HsLWoy9^geN}IvWg;GEZ|CLH=O|3@90^99?T+OmA{s6H zQ5g;*hF0yIoxOQlW6zqSrLf)aE8g!dtAsn&f<+NaYgTU%*Q_njn(QBJU4IjV19&F5 zav`sezMfZDk;eB}X~?G3%x{~@K3J5> z9_>1*?4g3`Ge_u}GTB27%jesCiA*+P1>%tUfG$cC>|8Qd6hqESM3#~LXhK3gTH#;% zNlDPN>vBqP-$=Ip?R75P5RX??(^S`$heaycGnN{u{Yh__SpU)i8o2EULH}`-+S34A z2H0)VyG?q(zNEKp)Jkr;@L6#`x7z=F_UeZ&{r5G8x<9^o=}q7o5RT_q;0wY|4GARq zfKk{o$Rk#JL8qz|j2=hDBr77C_O3GT1QxE!!^^Ws(Z*oyHoF7gHnt~>i8ai~GF2z? zWi4&i6k;VIO+}(Q*OlauR#93gamUKT!Lq$uQ z_Z5+5?jMU>9o6(ZTZ3M^LANW(b4!ynuYqY36$=&BO<1cjCK1*wt7AzLnKJOtimDs6 zvOGU6ql+lN`dH9`FjFH^{9F9de;+=bBNccy=WKKMbk;Id|F!bz9H^?!2(P5T*XZSG zOMg$;`-ihKEY|n*|99h79O(OfyEyIRkmsCbBM)>`bU~R=zJzaq22u?X2MC$F3 zYSE{2zq^M`=fXpP@agrEvy@4}+n*Vf?s=yq6VkVFk|NtzhNB=V!SN8F5fK4kwU7%( z1$;DL&ojnV@9JHm8yRZB&(!y_0Ji~7uzl+o1r4f^l!_(jH|CxdBX!39C5fbsCPiq8}o%bRHL^qX8TQHPalqQ(K|2@%Hc+IJ_8(D%P_8rK9|r z3BE{NO%Y_sp@tpJSO~oohfcRbF9&NCmy9jL6V3=%GHHCxTxt7Sxbx|Z)NXjn(!he% z!L90*eLhxI0H6*J;mlJ?mDYGCuexG4GxHf~E4<#%_EWdcZwU_|d_C8Q5H$tu3%UM| zY_7lKdwcb;{Z9D);LZ)FOA9FfaIdLNh~Y|Y`&gn$<+N0Cu!^h3UAww8k_9o)#DDdB zR0sft2&%Fpts9pTzpDq2ZIyU7@z_UePxmh%CwSv zIaWE1rl6=1LhPP}U5nPjd4$TLU_A(?(A?!qMb38=7XAc|n*`IGacCVav<9i7eBqCP z*^eOV;%wI1_T44}hjD|p3ncMcmDFr*mIbZgu8d8CeM3fY4#tKBkpa!daKEJ?bz#8Is@r!MP=s6WuMYk+B0Vq%jHYmY+VJK zo$tdjN(+SniYMh^S#(sDP46)gsh*hCmI(Ih_dWv#yWZ>PKOm?u%<;S`sH990SuQ=a zR(uQWB)m8b43#eymt)4%B8>$yUtInE={*IK1-9O(LfDG$s>W9*T|Vzwm`c;D70cXL z6TQ(Ttt*@WvsNsiDj#dHizt^A2?q~V$r<9k+SwDBI=i}v3M6?m-%aB##e^~myH?}D zZ5V3?cYW%bsZ<^DUdZrgTH~lTtp)3C@RzwmMbF$?AaZbFG@$qsNz*>SO8*BqwITOI z;4kd30I3dVSQ1XTTqm8;XRv1aP$spg{B*K^5H7* zjj#ISu2^~S|9$XCx1yf!u0`c8{`6l3@|JS7o+jz$av#0hR=Bqn?rnv8GYbf9Wx5uS# zZo>q~bi)7fK0;bKVn)6wFl^w^u5AT?%`WP;jb;9YqhmysSIYzyNee+f(dgrcHpfc_i$cZl>*`u0|4e)FaV>lcjPYH6Pz%@eLI1fYcVgiLX9lZ6WqXem?9n zfjS$#NNA{d?2q?;UYbVdB~BY8Qw12?oJP#1n_s)Qqved{85bg{&?eGlYROsTff>f3 zMG0_=y3XRF(K2Ofs&-8LqIj3(!BTfwSAE*y25bb-{Ai%m-I@RbA@OCYxzl7q86F!# z0Z?^VX?MXBMgz@bXxO}yP$rC&`v~V&MYkLJ^EdQKt2XqKkaL7;F_^m*TgZ$QK!o45 zm>g6DHlr59cwp#CnA+CQaSNyy@$k} zI|}oWpPomm9m=gaJ1-5w6o(fzt}HC*XClD}k(r9ulBi(+(h6FDp8Fo zAKn`Ex{SJAJ*&6=XpG7$qQc_Ecoe&Bss?DxO~ByDdOH?5(HVGFbKpD3Sb|<-?5Jvo zHkhb7WYPZfdE?EqW$ml^#pRf(@2@W~JM17P-N){z=(suLAe&bxz9nS(cp;13u{$(; z&^t#IWy9$3`Z3f8jNoh-9{vKLYI|__I&@uXV-E2E4-LgPE$1BIAZFachG0zq6olNc z#5-8kyJX=EGq&a106~{rAn1juY1-6p1y6i#ivPeylQUw6@m;ID53yNBZ z2ilEfSb{KJ9Qr}Y3w-V|KibaQdN*278yxv!Y4)LQCSKJa!esdc zg|9REwvrN~5}t4`g|4D9h!6k1_~U(8O2C6PEaF{=BO1+7EL2Uq+M54Y(gJ#nk|YLL zR>mC%b!RDMGIT->08N&pXjg5OQhW(p511uu0Zb8ctR8^4dT7hTh5`r1)y1)e?1J2zQ^6?1=LOchk?PW|;Eh z74xP3zYpGF69Dw)9C)k#fQM`NfDMX>U+x1Qtzjyl0WP@~&v>!wk&xpRGdsd+G%^CL zWi`afDS9@JD7F(4{D|8LiCaF;c0!^x^}Mzz>aLyxhzWWsKhyH%M()k#QeO*&bj z>7i8f_dL9T>SxPLceA_1ZBx))4(gLRgN9Z+y22DF@g|@mmjryqMYffq^OiWqjy&EW&h zku+TcfVqAET4G|~+BC*96bnt9@=}?_VTy2B{Jp6@nV*W1BxLa8u*~5;gt*0&oE!#m z2Rr1v;03DHzZox6pqGgjug={nW5|T(bXA1l)e>sQhb;)mU)gZMk z73zvV?q*Y=-m*Q`2z*+x0Vv>8z1y*F=+l-Ub_;*{^6~r@{ zaINszIit5+C@5ppF;>isDlc`1(LBII>PCE@aLu7Dr(jm-T>3y?C#@X z%K#ZaE5=VWt{6MrSp{XTEVatID_NY?7}tk+Bw1kTD@i<&IjLU5(j5>YDv?&1=?0@9 z*R`g_;>KgwP?#?Bfhy0yodYcbxewP$l%}+9c0xF`_r}0kWR<^ zmngYNbm>~m1Ah5DP(R$;-8)pzrr$MxzufE-oaVT&XS(dPgVp)zL~FdZ{rUe9dz`-a zSQ7cSVeBcEN`&3Vo|gXgcHX{v`?~cX=%JsM-eWUS)<(xMwY%D?%T<2Z znsgC!ZMC1S7x*KeLqAMysv@LRfQqw#>Fv-Z1l-n6sa^l+Z-^indq4Bc3bVv`KTOBS z5z5=(?dcC42sX0<>Af{4=Csc4jy40*lXWRh~IMS1hBGQEF$67HIYribVaZPaC zj)_NR;F9uqI&G(5ug&{|i)`d%`8)Hd*k2|F2OEmsHZl}>lC9|Uq4Wy`JSbgj8o0or zDz89-uhdbFy%Xfa(%!D?4Wr8lX~Ec7HIStMv$nu0fqX;?NWoH702xxo_4}pWQrVdl z;WWs4IXI^#dMEKf-w`JPuT{NVS@ zw0%{4xcLp(ZkS#oI)>AVG#dHQT=SXH$phA-{VGz=$smz}+2Ja^e*Ob)tZCPVIgy?_ z!i*5k_~Y3_*hMk^^@pdAkfP7D@nnAF5@!d^)Z_9#Qv=Ee{CvdI%0J+WiT~sSHgt}^+(%qJ0UdtCqc(lS z)l<+N-HK!Hi!!vGtcS1eZeWTrp_J9Q$ij^uB3VT?=egi2s zWVo^LP|uw5kax)myTTdGOOvI=$T@puR6Pza4dl=ChuYtF-0YTmLs-)a?htAN_WeN| zrh$c{m68;gL5wwp|Y?k1fqlGU|RO~M1}2m3v^t9dQu!hTZfiYT)9C~_Xv5B15ddVYd+j*=i$$nrk&ixE{X z()s<%XH@7VG#_$G$mc8~_4%b4inU_mTA3AazY>mM?B3xs;7zJoDtA}^k%whCh`gOgXRqJ<@T^18v+0mfopXD9tliez1s6Q6yK8D` z+|1(X<$RXx?~-FRN6HTM->IbN9p2W%nrk=Bc7X*S-Y~i*|LIsHnUgbe zt?c@<;%=oBiGjh@@8dkY-Y`Aq;nkyhn%iw}*FzQ6*zekXny3iPOAdD7Hpr^D5flcS zZu;#46Mkn?P0mGd%h>;pZslqw0f=m)q~l$EKy#7l1I|JHSs%fv$QVY-QxHb@qQ$d8 zDdc8DSC3jo`1H_j(%uA+t?Lj`9HoOOQ3fgCi7hbYCPn?04CSd^58rXSRw&{+0jt2( z_&I@_absGGoM+}J!=^e9c(#zsVR%ydDMyHSPNu9@X!CZt!%JGN zldgub8Ixlh%28*Yo%ypD++vf)M{kLnM`Zjr_U|0r{QX^YJe| zLc9`>F9MD_nh{DPUG2}Z4IZw4?Hp9=9YDu~b{2i#KfHSWnkmb)`6wTFP4&nc*T8{3 zhoyowIq!L|&))ukcRBn1jOvtzj=6TZKOhCi(mkuFS}yk%tKSHlI9V-hVva?w;?lf1 zb2F7l`qJyV+Z;n*#ibi}#VRg5H^Zs!p}Uf!Mf1l<_X4L=bJ-g=FITCMhrzQ1>O~em z(zzIS-sUPMVxg2~N5CnO>bKAS(oZu~qlT~bBFC%ageQF`S~?qhmN-qXt2ZfY zw}rX+e&FytJ^P0<1?5F;891qo>^eU+8V_+bvho|_sO7r+p+qQV|L=eOca}Nvi^4A) zvdBR6SCpm8W)(gXJCY0fD5QF)lXkty|3+ zG}`rwX%UH3G`8a>OCuo}`>u6_>7BSQ8hDYpN;3<58==`o06k636jjbTF(xdlLO0gzuC0P?tH0LZu3RNW{7 ztp!n-zP+CIlW5?by^G4hC=9%}@S@2m1E=;wSiZ~h*xSL3uTv{HNK5J_eF%#`Y&(-HzcgccP3MX+9TI2bU6|hc`o{7ZTBR-lqo@;c@C|CHlsEAfjNsPdh!GZ@CR-Pi}tcF8Y_s z!kKc#p#^9~G7dpse=0RCQuA%+IKVBtv-efb+}xerx4N_U{oTC>dnfn%M~C6j;b6EI z_ID3=`-A&?!~I|w?1ue*|8Re>rta*Ci-TX#oh|OJH|spowH!VkDaRAnG^{b685E0= zI<|;n8(xbBp|S>NLL3=Ld?DPIW@^A`2v7l=N&3#C!k=-SI<_^)?fvIaX@qIzbC{lP zT|7zkpSunB_bc=>R3U7I3mT04BthCjFU_jF5?{*wsE&I6t+XHbYceWSfj>w0fTzIx ziV28;nFf>QL(i3*9qS}G(oc19rK%Q`FkQFed$hJ=E51Wr6-Ux9-Q=l#GivC~QP#@C z5wcRDvM?oBGm$6edHBTFc)6~w6U;E(x(t)rd+(y}a*ZpLum`0@sXeB}qnW48c7IK= zi>MxBe+!F5s6fgpBK5c9+#pj^J7#K9OtgAU-erk!%%#@*Qs(@##Wp-%rg^nSi$;oC z{!&sLYG}ne@dT)l@{U`$_4{E$YUE?4!CzCxg%jblDpT`Dq9J- zZFBJpmQJ?K#r2iRPFmJnye3%eLtvO{5ghZ2db=R?;EH7gm+=)ty`jCwn(HidYP=Nj zRa2$S={RimoJqs6_C>Amk(>5Qy^S6~Mx1Wi?z|RAjDerVE zMMH6ySSbjVM+Da>9v4#q7D>Y^$dRE^m3Yq z-s$76_bM(Sd4G+)jOXy?GAd_W0C<*V=WtD`dC~|p=K4rYE$0Gnqo=SKXf|E%?K|W& z%Dd`~bdjGz*vzH5NO|=!W>ux=99}`Z$aDps4r88V9Pvv1nU_Xo z$ReHrdxt3L!p9840S@XXa>@)MMrv|eRg-H0C&MlvXG|nXT)2y-T>#{1S06%F4Gp3g ziJv_`aX7|HdLHbqtFbmER79TrvxOiOuvWIk8hUTf7Lbuf9W_$9&T6xjTeXjcvM}2OcbnjD6WonVE$+80!BtF+ z4WW|jQ%Pq54rv6L5@s(F^aobjV_(iUM)Rd%+H?t|VH{9X5IruQBo=^`J0bSjT{5EA zM78Dxn80*u0gQ^EQW9c}QQ3hwWEP3aohgDvcJro30o6XxYO^u}Q*OR>jMJuZ<)m8drwQ=Aa{vj9)_f)pRs8c+kgjhWVFqq6R|EYYvy z6zo7mq0nQDxqpq2BZ);v80c>H(w~2ND@ga#?_XM%0Hf3a4-x8JeT4iYh0x^Fd*N*w z!P&@E5PG**)Dn0*FvLp}3v*?F9)t89bv?|>!vIBKHio`w(=EAOAlZuLF%ht?B=ylN zqS6d`%~T8Anpp`&FGpvHsOX9-trJa)h2pGiocoXy&r-}Xy`4NnA)ZbZlxRowVCw@u zjJ77aZWC=61XhPWK2GA2RW($uBj{~{yXL`V-$bNTtaDn{34nqWW5{+1zc z5nRB;R!%Sixg))X-iV=vP2>|G3JdlLa`g&x1vb#l;F5X}<;}}*Ch<|d;^Dn|{`gS? z&=;P7050D1$KG2U%&^ZS=eu1c!s6eSc(p%R1`+f3zyA9YuU;Q?Y^hH;Uf(CYGXaFOpjYHuBC+{|;9|J3ot-X)O1%jk zpWqkgem>vXP)JujCaKhg4~0lQD{3@{ubru&!$5y06yf;X73Ds2*Ny`q5(!H14ajaF za5}4^Q{j`91q<6HA=Fl5+gT@l#8rnXOwQ_-s zlG1^=Vo~WM^*~E$7&k(qRxH2eQqy=n?{RcaIhyVwAv7$+ennAT6ALuerWIPTBv*yJ z2bSm*yf-e+z%QdLMZzraWi$*2vjN=XdvJ~C5TmE%hAh|dS`F&y>Hpb~byzVa*{h#U zVHMtnMTtFG+C<*rz1=_Q9}Tm-Vo4jaP%Flu@MRM4Nh4WmFVE}&)vU6P48w}Ls*P~2dt3qo>~k@O--mpc2<;)Hn0z3Gchtm)tb20x zdwKP77FK^Ly$Pwx^0&$@Kz^h!t**QO$9rOJ$4NKu>SIxQ0aj*b)sIpcu)?Jl(77Ta zVK&ix#aa9DXL;4@Z5=V7*s+A~0Ri+(1B7Mpu2=e_G2){c03aPpJ=TdI_wss-T5CQe z0rg`3b_C9Vd&hKOW7?R=twDX-6ajx1Q5jmQI=t;v87}p`>8JPk@*}sm;fJ?J{S?B~ zSR`_#&CZzzcoakm^NOS)@zsagewjzTeTki$VL}ilrXa}zo;0U{THKa|F1|$#xbeJS zYqjJvt4XUXZOgH#ptRQroUe99R9b3Pzuce#)F<``_*1p{2t=%w zmQhmr((+QC-ZyN5?x}K%jrAG1%bZvL6!yKRIT$TU53A!H+~!g@yqlrxX);acbM~~# z&|YAa#zdIJtrEkwv?%(N;c>KrxD7mv$6;!j*9@Ep?Z|+d-g%^m!>#N1n_yvPEk6BC zFUDK*A=+nYhQ1vM>&iI|xaNFtp*YS1Cm+1GSIr1}K^DVP_-RQ~1JkvPL&1HkDWdn- zz3*LxI&a~oc8m_O7N%O*IHi;Uzk~_wgjjKt)0{{Wc5xnPtXV{Sx&{QX7kQZC=$@ue zqbM(dfF6S+3ndzR@KujvZ2R&Ukd;DMS%5wu5n@VJ^pJ48l!f5FBsNTaj4;L}l<|9F zeK9)|1#@#7CL_&8kNzEGd?=Xcm@d8 zIk$7EyW^F4Y_jV_(TLI)Sxhgz9h|@nhtovyi{d|%uqZm}Q;#iHFk1(s2r1L<%F=o0 z1!Ii(FT(0t^UN>?%oO7yJm&+f6>op_#gT!{^Q(3~IP;APA1*F@7iKu>g%yF1Y+X=f zV-|Bez50L{ytA`c9rx3*#5cUtR0g~tTtrb=ij{B4#3(ud16JOVT+`&zi6tk>XT3GH zU&TwzAdU{g#sOK^i{pzNuUz1iCWF5CwGgjb52!QV%^{fBWGFOlf_BZFJQORSG3^kn zMGqQZeemG8D3NuO_5ns1I}-@`k}y%Ri*L#0F_hny$?cl`Ayde*OR!8=a3NBPvVkUS zlYlSvajMx!Qc-PF0j_Dviv!;cVn*3?!)@1?$wQf))8srlc?jdo${*0M!D_EQPyi|n zD0a6>dN+E8pG0#_zlEY^J&uo@0Aj^VmV&eVsWS_Hjjv|9T74Y+@qQ{r5ii9jOyFl( z9$;FgN2qXIU*Zy?*lavQzFv3!&ASD_+Xp8Ls}uK~>coDp#O_+HYu!6HRl+qDDE1*g zf?L-**>ek&YphY&v;<ojlvQNd>yv_Qy zS>HD6`+Bmz{g!2YKic&~I@~KR(4q6QV@_52#C8pN#lAm?vB!j0MqEveLAhvJk(b?-aKRoMHxb#^zBGGIE z%$>Qnf4@;JYjfBxH{JZ(NejTPx=to&#RXVP*qNW{2Vh4@2b;E}_K9UJe6fu&wZaYM zvvv7b=nQMGq_(CmH+)TAdU1|_e_@XQz{&9sRCZ5A%bqIUuPLoRPzn7%Qmf!p?siw1 zyxhFfr>LU8#g5MXVuEH{ghhcfm!s%c2w>qe6JwQBq~x_Vz~z{DGLXBas{Rf3R`?|b zzZRh)Iar9E8QDFHG(`KJtd!eSVd$FE)Sd$~uu;nktbJQD*p>{oC4&u(3l3UVGI(R- zm#W~KMn9!6Npm9vsyuFkX+|9|U3q05w^VB>;CSp6SN+xpw(_Bt|??aR3Yn`b+0=PSe>4! zD1=rCSg~qVL=M#%Rjz7vFb!$tN||?d_R1ljC0M0(l^KzxL3o=$giEAu*S*87<3@=P zoi7%lbU}>~O-?r4h(D}9Df}^~jWphsVSf#AovO9w^X_G+1#!gE-S|lm?fEf{QM!Ys zU`&VDW#L`03RrBpEBf{ZBj{e^iRi;7Ji6*QA&q?1RzS)SxQJcNuNy0)@fnyZ#9Ro0 zHkerK_2c?zbqV?+2&fue$6U4I1#$t!RhY0=xQ$YGBbCv_Dg+CxK{YANcVC$uWDS1LY`aI0k2J_1O_1ZWwn# zK;I8@gd(1Pk=bsOz-Qo{iMJj+{fuh&bZ4EvK4gPWw)BT%<{tQ1u&~VULqD*EoM`&f8i5w4t zTHl)vru8#LB?}(%CGf~OiV@-QLXi%h+4L}qjG@YF@U6Ab_-Sb!`5h#Xgn{9-gww^T z(`$8UIP9Vk&BOS9i6}mrYI2*S?y*Ij<<-dl%M$U2QSS7O5K-MHnW+oh>uAMTslm2T+~g7{`mZ|^u`1lrf4pbs zAOcTl+eBi`4x#EoD7>|?*D{{_RrZkDZK&<)^nYj1h}8R+!tpCK!Z;s_c9RHKx-R*+ zI;Mp{OJYsAKbGca>g|BN4s#;(7}6N)*jJ7=2Um*8J2+>=Oet|Kb#Y8UNC%LTWAy1f z%<}!yQ?Pu6oPiV$96Ti$#9^cwuvwZ{iIb(#b?w%GXToX9khUOda(z98t9I{{c7X!w z!YmeypN9kd*$~4P@ZzKg=!GcQr>aC~vFBJY$$k5wKvh!?OcC?PrS5_r$x3L|y z%GfjjORAd#6?Au*=n9zt`fiLtK8;){8KbMNN(^CDALpV-Sg;bofpJt|`E=7TP`9ho zQzd>uoqo?!{Ou2q{iBn^;r-yj$$rq^^H28r;ovaXJwDj;cZdGre&F|q{WaC?k5t|M zg~DdMFxU)8uwDot^ufM+P^-;^J*H3zrtSEiY53rera(QrpEcMbUggkgg zbt$2Cm8}aklETCQDpe1BhlW$JD2i+mA9l5p0`?f0^oNAY!$BA;t#iIQxJuTtkA=v> zDFA5NC{0mSDRlYc8w_4=$^_PCCsju+E6Tp8rbJzDhX+6~f>Ux_>hFR^i!@V zbreE>P7z7+eFRsqxhqlMYTCt2ESk9OYf8G>ZK3S|en5f0s>W7k1T!pt=HMcghcrr) zjDVViIk6ftRK>+6jdAu~Tx64#hjH^X3tc&a)N2rNjbVfR=YntdMkRs0g(ZOl2fBCM z(Mf#g<}8Z#KmGCKTko`hS6-*Qv$|AvhaUjl3!YdHMaa41<>9EWD8@<|s2p?m zXPdq*{qt@5x=ml(8z3FGEPbt=CvXrT)7*U3ZeI=F#!+<&0lZq)0Om4WbJtKBUxap< z8C84h83XnKITz3mVx}VKL1tkS`Q6P>&;qgA9Pq|wrwhj|OK5+tjFKBzn*zsI#@Dly z>Ms;;F_WBWUbw;ix6bnV3;m~_@;xYXlO{^f|y}m>@G6VY zoiCMBPLcCZQ|bh&o2f_ayB=hLVF{NO6sa}%dO=%eIxhUgn`B8;MmPltSBHy07(Q(p zl8rg;S8(h&$9G{+j^aLq_$wpP;=w^3?jm*@*UgXc=|GFl^qyt#E z(9k2(30y_7z%~3CF%-yDK4bhPk|UH04z!@Mssalt-xrg&F7-&H(&f;>k`4|wrwq8s zGhFvuC*87kWAzcCJJ&>aM&a1YV$_Afzs-CI5;~t{xY)(D@`A3?u*0q5 zrD2f@bS9ALD)dYq!lNSI_UaPB_LPfN$D0 z^={5ZSc&v+B8TZ4%B%`v(qyq0p-N;in0L+9+c}r{OB`a4DulG~uww|;pT8DJC+~ql zH1aQL3v@Q{c(@+6({4L&``}{DjO*6_Z9PKiy79?H$mfD}9yk|e!Dq@n5#~78*zMYm zRr7(ZqI8hdjb*TvBc zxAmUkZ7a2-xB9ksRW|zcH`-dfpPKd&5jmtK58Ass)iAnQ6fAtYbe*asHW?=kroc?;X0^67ltjN;a>FuP zbCs>5tL0N-AyZ9ls~+g&Y=(ubR(1*ex}3QJvfQW~X)2FWY?u7-x&pg?K)Y2?6{_$kAohMarTVI`aD?SlI4#B zj|&fD@3C=}*JBOWjp3{E`#IFIR6rj`u%yUIMQ0HH3JZl`h$&LA%DeZ+3g zu4t4o^OAsKG+rSH6C>*?Eac(M5Hj2P$F}~lt$%zy^^dkmO*zfU*?gF6Rf-zl9u?vq z?Xy>f0B}?b(pgk4;AemKFZ{CsDz0+ZTwN3S%UmqAqa0$hzG^NP6H5@2Mj53G7|B~^ z$D5s0woQ!c=Q*J%17DG#7gI4cBPRAlQrC3O*TMpXl7u%3X&=|#>h1*y2TYbJBWv(W zi)S11gkf(0rtCvX5D4Ksh1B$H!h#=~-ADRC9Xou601(sQnI#;f?umF;QF7z>qe&n> zB`~nafitN6!U>jePn~1n0-5)~w^dYX(KZJ8knx6j3fat%c*JoYOQ!frMRlk`pxLGX zVm2EnaL}?U5R%qYS!EWQN>3NIokbDOjFmz^11YPAMh$VeC=z-^I%6F~BE@COMe4#T zo%FdUPjCTFz4aFA*l0COvKMaptAEvs8+d=S5$k!gs9MldHth2XwdcFAuRaZ=y?Fne zq;9E@Fjc?8j}!aWM=wJj%YY*@2`9KPIqD=avyOTf;R#$_TYL{C)%_^9UW)WkKD;;V z@gKHsv@CLI*E?LXX#PkWypI>B-wSzq_V%6h`>@BLzzX_cG%cnDeFurAB-dLw?Dqi1Po~j}_<-p~2c@WQ33P*G( zFD+KShKOllVU$P&S?ag&yqFN9Bq>U*7=&?svNTHwWNdoS z)Eb^oy}!v(^8Ugo`KXzUW-ZhaUnv=l3G;4Et+ID;*JL!O({hyM(Irt%R+nXk{4=Xu zq_r^iI16!m>KWWv-^}}6m6pcYlKWQT`jnMd}ue6tuYfq@f>dz@lAur(=Px2_y>fZaid;6?%3a8+kr;ohjlfwtz zE3{#6|K2VRL#6@c)>!@~td>RBO5hK=Y*$otr0|SotWk71#{SK`$u=6(iS<+`)yxLI zG?{XN$V5R9siDw8;z#3-`qVyG;H)xMH1u((6w*`%dRZ7Ve4!v?WVx8?g`g+;K?%5t zz?D2q^z3TxD~a40#!z@$zlcg(_7$61G;_hB$yvkd^9xbF94<3EXC}Km4M~yk&u6cG zAm2(xUwAuz{^>1&F3(QCe+ij@@b=2h?nXMk=|kvIDzYLr5_rm2&mTWhnxteUSQA2$ zOPUfs^FB zck$O!>V!MXneam0nFyqvJKvSVwaLhBBdoN|sjZFHE_~M9f#V{lPU*8*Dk2c9KvD&+ z8gHmfVUAGQwz#=1Zf=X4UrTZGLF?FS<_9pObVyz(7S6!_G?6n?%Y}56r`sw0@dTaU zc?Vpa5_6`j_=;}O3!-16(oei-d?`}S-=99BwvsEHV+Oc4po+Q4NT3I;BdB>eH;!{d zd_PIDcS%%~)}c!x$QYj|=a7__I_hdnkrbE+PvQ&P0NpeNjkqs|{5(v&eil0qDI!QT za#A7l2z0FLmHIdCbDEKVqT9i^lzOVp*Ry!>mXpx@w29dp5sfs3Mpo+yc(hpQakz@N@I6Bh`wpR$ikb{CBmOmHQiG=bYOd;z}uqgBA zpWa%8$$$RoOg%7D(YC^={Tff#=F_^Z_=LY5t?v^q^VApZIK_T_7q?B)!P+s|b(3dAFz&xsYLc?}1as+Ltnxu1~M2XtggzD{OM`jqa>Q zH4lhtO7en#rHXc?98ZOKVwlsCxRp|u)JpLkO8Q83Adm<@nNIl6u{|VW*Iv26?#zDJ zzlP)Q>OeqEwt*NBWXdQ4ai9=jzq24LO!v|;PiF0JIw5x{-q$$-*`Z&y#wy=o2ttxJ- zircEDG+ zN_fcwkJxOhU5w8{y7R1%=?5BSRA;19%ap=_H4_543x;JX=W0dhn)ZjS2whte$%ns9 zTCp62Q($A+POYxr%eAXk{np@7hzCi5OS-j~Tzj0-mRd*9sTF*)`B2mvga)mEo=akG zk5Nvk37FMulb5-aaht zCd1Spw2nXQJB7fiP|g++-pkFmI9)`nPwMUX(;y0A+jJ_%s&-a6w?(7RbLtVbqcR7d zrd02@QpV9@m=HQD2B^yJ(yQY1haj4$ zt${gw6E4;H=3a3Um8v?n6Crq`$Wj8bQ&aQmV;WM<)>0DsTgol(EhM4e-)o+5Sqr@U zYn^b>a|5>?-q_z=$MA*=#kQw6ykV9T)6oq_I#zca?~vMo+V3-^fNtjAlpFa2;mV6= zCM;{;ud*K4zgsx#b!5$YUF_}lGJjf*5FMOF!C);DBzwCq+)5zo zW-f#lXW!c~F!O*9Fdsr`UO6?-KsnXGkCDH&Bcuvm5MJbwLaU?!sszKo&F}{uVR!%{ z4Qg0T9r*?(V^hp0iYQD0-d*V-yB%aDmkL)!ttJ8!I`0y`nA6wKIeZVj9advDJyLvu z(O~BDaW+5tTuVQu3}d2nVW{IZ8L*`A7%P*A2}KqJ-XM};@6{wsA*p_prD-@Qy&c>E z9rJY*k@^Y*_Qti<+FiNG$;56Rf}CcgmI^k5Z6aZWD&bkiq*IM|=_(t5Fo>TS^jwkSHQ0ys<;Ub;+0e^`CdKmH)=$yOOFTm%@KZUfl|SvW8( z*Mye#_5yVMS+6DIL)Yaqz0-YbY*)Bl*p1hUk$|+CTxVji~C-i(EVe3y>qd zM)D-cf&}bBIUhfYT!|g=&hy}PhtP_-*SG?ivck_{$HE5ouaV=(<7 zB$|x+1sn!*LvNt_306&CAuCygT!5|BC3mPY8#P*Lsk12;)U<8ki6(glM|PGt7~9y- z$G#d{iaq9?U|xbi)LAa6$)DOv)JpP*s4o_EmRH9E2D|qALa*CR(^W+ z4`(j*0>v9HD%M(imRB#GxN9SGI`RT)m8Ud+3092M-&J+wad`PHM{1S{Rq8MX@Fx(MEWZ7&FA7aH!Tcfg^6o2~W8!D>bgB}0P{x^5hX1EoKuW@BoOs}O^W`gZgTABbN zx+KFks8gf<7mt?0vYX2@4A!7cIT%RXdOD@@4Wd$9t`CT;` z;O_uPB>1vZO<<#sUfG67+oQUul!J^ZIqdr}MWZ(;L9D_j z_z9B@ImaUvZD3t5rRA-r$nl`mb?2`3aaOcO$*$xZ@P7W7@V_o67kp}pT&+F*spj0R^Ag{Q(Q80z5cbz}m+se&kPx;3pJGhHaqgjC-Bxs9 z#gR_Zj2%)e%+Z@O0fVQIdz@*8s;*s6Q2m;G9PyD_MEI{kG-9Zv&{f^>8qqnqK9u=? zEb(fp|15R&|GTE=CS!@ZZuX9o$s)jFLT?qFtvHWAT6vOr>b5kb8tDhPL*JY^$%g)P zl2W8ZVC#DkHk|SFqiUan!;`F#{467U1aBq8WK2Wh%;HsN&SwqRo5P*4mZI9~m;6mQ zgujp6HMjB0Svu8q(Z*70GwBtX{(%8vm(L4MIJCS zQ?dfvyf3c_AylQMbx}9R4npYOUXM;(7b(=UC?3}`l#Ms$-ftzkcxG;V_r}_-1&h+f zrs3qV{k0mwu|CIo^jTQXw3=DR{-l^!Ro_nWZl`$Hi2B}6@vaNuj~=XzW4s1vZ%^zf zb}}y-mC+1I9fB#hGq7`nbqA6>{2emtd=Y(`1ueulLlIp2eb$Ju!(gDYQDP16%{A5)jHwYIwL=Dfx zUEmg!u(I~Yduaj}8CI8Og>Q|$FCK1TFp+alX8?y$M%po~t#q->K;0zIvLTKS5qO_g zJ^XEeYLx9DF5G$j;?a{%E0ziu=NAN84x=z%+v2oi&ax=|vK4tDDjtQQ{SKOW=ifmjWf{SaOH1*vQzV2rT??16l2{wj~ zb`&b#z|;MkcMC?|_7^M2oVaQHz9jG($Fr`qeP43qPk&Q)y2Cu(NvtdAy2gmJ$WQ}( znn-IMOtAE4nuZh3&qsWAns7kt0xLY86;^sXR(Ikd|J-{D=hsse$V%(a)=chn?YLLT z12f=}dMF}za>hy)r7oYLQPa>*5(A)mN%xTS*F!t7q2y0uIVvgtmpW>w zW7{FkIfqZ5*VVedl*?}_P4bs2-;N1X7nLfvrLJwMYg_8t%v8T^jCGGNVZ<(&-Fp?9 z1$L@B_Qaf82uA%RoCu=VYMebfd-HU@2nNF7XdF(Vg{k8-Pg}r>4={nOOy1Ht@75de zoD*d>U4C05x?nSNu?b4Og=Nk}>x!`-TX{)nST;5=0ciQ2Z&!J*GN^z7b3i1*$cu3* zb3{~D!%-R7Pu!c0#4U`Y-+IW0yn>BxRl%E32<&uPv4^9gXx|R@0`zoOA6b-|q&$)- zA`KC#=m_)aw-Mb{IIb-BOr|R_Ae91x(%Lk?s8C;RTLJ6w744#}tN4nvR_E6{l@zQ> z#lt8O0&;NcdOukVBs;|*n;5R99XiYfi0_v3wbgR0(c#N3;=F5_G2T*+e1D;q<^FxQ za&;h;E1rYwsk%!qFV&*l8x&XDn=|i^_tR8ZLUDdv3~t5X%j0!}FAM*%Pjer3FY<0;$GIvLTLYL`nD~IB9=5j{^#fPm;?k!Eaqibii&;n{sZA@m z6T*%hF+tk4Ppk;--H)r7TQdb{zDort$P&($x+0Y&AtsZALBb7FE z)TVgUv8Y_>AS|M0l|JiM;M#ZGxIxI5W48QMzq8iEUmDG@$5~N ztiM=Qe%fE#7H>yWoa!vCaAPe|&v7bOzaWGqO4?D@B`}z^8=zveeerG zZMC%Gwedc@UFFv&Qjjv8I%N(PqTlxGJ1jtqGqYUOX$lflRlj421ytyC2|=yt!t8Q@ zbb)mIi4ertApoXv0z5qg);J>uP20L7D?$~9DRr+!8kjD}X)9bxTlzvR@v!SWR6kdr zEM+hv*iBg%+DW-kjLnH{M7(-$+Air9+Q@G!vu5S`}x4{2$Wru zRACVRdcuq5p9TMF$gv%x|sT9DtzhlCJ?!+wJ%rxep*ib z#C!Yl%xD?hF=8gZ%!S%=<*qKY+M%pJ8CSmiw%HUAi zFgvv52mg%88Z~3pEC|pZwQFRZ`lX1@!H4`(CdDtJZh+rRD~?(f5wDzJ^ucOrG~YaZ z%Gw zbh9O*g;nVsHRkl&NDgZrWI%kR&E|0Ltch~rvNXT2DTwWAM>A=VvXccanyF|Cj9vS(^45pmu9_>0v zG%0-sA+=Osd*l6PyE@pXHLGH^Q&R2)GabV|z`pjPF~OI6Xi+cs8&qz_eq2Ojl#W5h z>@jO|6_K~M>mhY^3_I%OLBsp@loV1rcbsx9@#q2 za~}!f&}LbSMk&Y5b;qqZ2j8}a-+t%$7)f}dl1K-zbl8don)pTWF3Xn#{jP0|-l(CU zS0sY?S{}}Ol!qdLTgdWN>=CCka}-6gaSp8>*WGwu*RKATNu6E#C!_A=aKFO8CW$|* z&hjHL=F(5fazVH1E$N4ZjqR@nepzluaT{xF+FBT34#K>QhDgj6_WId0ZEBx&Y=gc@ zTu}L#S;_H7wU+6)p=@S=0 zIexVs@wE~73uLV&QG4CV@??&P=ug3*{lG7M_*GH6MAspE%~HIUQn*y{E3u-WOF?o! zjA7-%mf9i?mg)lWtSKO1rs~utOR(=eo%y*F)Nl9NYWLdxR_(P$VLI4(1)f>yxflL6 ziSkN9R`{f@f@x!d#K@@52L|hfghS(cZ&4e^Sr1xeS)7eT)j2jt%mXrd`&Y>O zef9AYoU>LtPMb6AR8(_BVzL<}Y&u)vqW;|03|EX@*=>~_KC?;MS)b7~O6g?pdXs4} zLX>!=iT_Vi2qCEAu%DtDlA=!?5{RvZ z-j#*64PI4|(PjaVv?2pRhw63YjSyaL4kBvv4XIs_D7&#LsevfB&L{J=EXpCVtF>C! zR;gG9kFS7Lzl@iK4y_A;FLlG4be?S*!TwZ~KTr?5k7q+lT7^js^4L5&Co@>}UV(nr+mo*K9F4Zd+FHN0xd^P^1>1B&Ft+wWR8*^8@V8DClzm)Hz;h0S*;?Sh^> zv>>!fjWD!8C+AlmuRf5T(7btTMXDp}QMOqv=0>pIhy}EM5)FE&dOXNylQN?j_!*Oc zEB0*Z|N#3^CaDQ9_u7|PS;W+kx?!@J_3u|G!yb5!^c6AQvIbs=ijEZ`FRy zt=NNYW0H?-u>`Gwa|6|a?Y>;?zHApH!rGU$Q4dm?t;l5PpUtor6em$hbGxMGeR@`% z*>G^lL9nP|cFwJEJ$?-y^(4*|spf zbxML(XL_9-{bkljnm|!IR?3aJ!9i!qbVBVxV~;M99{u-BQ>ASW{nh)pcHwHM%Yvwm zo*KAFvh!?O)*ym30O}MdT7;t+W;q=8^5{$5WnGo#mXIH`Xhr-OBQG+fRxHgR&x)dl z-Sa_~4yTB0Y{fe9RFqZY`wTvlM|28x)n2ybnp$y4@?-t)W$^^-Iwb{84LPuk+@>v2 ztOxccQodgop60mPCusPTYr)er z3e~95$J4XT0I)Qx2({uQZY7vSm&lPd)7v37H2N!{s*_Fwk(x6wL4z8Y=UtN4k+Kzb zHJa`$OIUZ{>O&S=A6)oSu(*D?#YQas^Kag5u@PHr#JZpGvuhK_EyG6C&o^i4x)ovO z(n1WIrx-hk`pcpBHt!=w!7t^~yyELq#+|jpw$-XEuQsx-rOAcFz(W!Pp#k{f?Deg2 z7oX7?XxH{@kD={QUHrRQA7VA(r=PK%l|&XkU-jintzmooS5+6m;qTu zKf`THkp~M)k%w+6@}!6MN5mTNoIM=>4a;b}wh6xz?-knn&Lh5I$NO2`vEfs%r8HR= z=B{(}687Nq%%ui!j0m@V>`w|G_V#GZNJYml*vbL@THElO9Sqzxo}nuz(nn!vcjq z2z;c6?9*f~1|4{N1cN)fhnbA=Vk*Y4hD(?f7LjhETSuP~F7@X04HFh4OVf;CIl|7; z>Dt#9A#WutzyM24TZ|tPp0MG06#KhI32gVyI`&SxMlN2so}0X@H7KFWnYd?|r5H8@ zVwE7!O<*%Aa`vvpsbv`3QMy=&+`ldw_ra8#SlQl#b>w1i%nj}; z@e&e~MAI7tD4{*{FB6~rBF7AWy7qa}>6rf#B^Sy6&)&NkAJw_$A9zVN%vf#Ja!*# zV@9sb`Vg6&4x}i9?m*soWR_&8C*2V&{GGj{8vZ4?>z1RdKUE?(5dg~|e=KqVC; zQUs?$^=$Nc=^t;uJ5_o@P8vEUs`q@!li+xHR&cajD}X^bJlcO8TnwaR3qD8UcbLO` zpXKo?C(06s=y(M~bg+H9A^J9WB1H~1#Yn7og}9oDeH%J#kC#7e$2*UmA-fplxU#&? zLYV{tw&gBTaz^DOz-%N|186Xd^%$@H?WK>`(c#`Lak3==$SGD3UHAEBe|BQP2j-M@ekyf4ZuFK8l~kz14D*%ws3A;qJQR%Q*grAVmfeLmZ&9%7&vM>yN9lq&3x6hB-HCNNJ|bx zaFBLk=FRi1x|C)MUNA4iix8G}76+)d!%@%D|jvxeRtz>+~*hFqRw>e0OsG!dvmQr+bUxs3|`jRLc+UcL$3~ z6Gz)FYHX(y=Ml?6T;3WewsR+-*iP`$UZU3a>q{ty_C6JLOh*hw|I@!ZJKMLt)4P;W zUMhZ?6S~M}C+YGaY_H~rs}A)!hF{FkznKqyusgo ziH4d3i>w}}mn6KbtC?so;M(bQ0i;h2i#3S7g|*h_Dm5}h(lMC5N> zlPUDhh4xHv&4gJ5uO18p-geN-CgT(-JYeVW?c^FBlHi*>U0`j!G~(q7@1d-$FMa%- z<=_H~1;ZlHbFATi_8N94g5Tlhkt;}GkMxaYs^5h&ReCpfB`x^FJL)sqEY)5|w^6%I z-uyb1us#nZt5YIC3(O)HB>f8yawUVOac~-RT=yja7X^kVFZmoUb%S3@t^@(4j8k|u z8Zt)9A=oAFjp{7Tkeeb5P{sZE-1%3U?ZK zip3gR2w}7g{-AzX>f(mOg^;Er>yQ6=XInl#I2Qfgz1_ob|MF6Zz3rpRu-8A{J-8Hm zhdaH4o$#Q)3O5}Bibq~Z5eHAxYk}x5G>Wq9k?!wE<3H))H zXpdTJ>5a)HFzzGMt!WGJ7AZ#`aK;@NM(~OvN;kl>+Kr7(2Ho!GFd}f33A(D$CH9S> zp~Yg7;?)Xnhk^BO09VG-SC1vLEWp1V$73W$9wZ_mhjs!{lDPSR%hxjtX;n8wHv?Nk z+x#skMqrqwT8&|ns3WHlj2*6qwC*wiGd(A4Qdg+!2?2wH!F68wq#43Q1nx!N-G=B6 zO~h!Z+YXB?Mdl#b$YXl%ZP&8|OB;sL*qXLI>;Rae%fXu#jJ;}d0)MOz%gNluWT|WH z#b-R4s+TzH;k04L=M_QDIyTp`;#XS7NclWtHIZ;#A2L1~w&@h+Y>J;Jy5q1rAJ9yhYA)hjV6JgHc(=V`; zIj2Rsyr-w9tTc&G!Yk_V^Dh{d^ zBsjQz$`vX1^$*$grfG4(=ij{FG%Z%{XVbK}^gH~69WCH+H>_##WldsC?O!$=<5h}6 zd0b+#Ukbg;QI_CVgelwL`xo7dpnD!1Z*O-Fj#Q9F8S!ea%|>0gQ%tcfCS8!Do5|Pc ztbF=8JqG`2D8r6B#xR0#E(a%LggrX=sYkExP_(w4Lj=dDa56O-QB2ZB?4(djd?MIk z#C%BNTwM=el+XNNtEPQ(jr)8WKJ%K@hdJw=Ta#&fZVt{b9btIv3ns~d)+uvDV8z18 z{@X7l28Yy**>;oP@W-cLV78%?UkMYG6GLAAe0CRep+GQ4a$9-L;2HWe zGld&Pzt%hqct_+LtNu&-1xkc*tdL@D?;0yc=~YDCspMsnM~-uC>|6tBA}B{R;y?Y< zV4_K_Y?~g=)y%tQ^>B8{3RSAJpgf<=)U<6jo7yplQ^7iss4&G+!w{QBiAv~G@29NK z=&MXVl@(}9;Yte@X^WB4-l{1Ha2Ot4R?Br>#cq8x-xj?4^)TLMNnCmE8m{fma$d7~ ze`aZJt26|MpH87&Cj&}3ifMVpeq=OPhE-rhJHniUPAoX~JCVdnjXolh^rU01WtFnd zfy9lg$?fx>x885wFKBH(I9gZ-IQH;Ek9Ipc_u@i{I(p{^_j6TMfZf1gG2HCYJA38( zO8+}WJhBku_V7B%NSg(zC-j3bCmXdrmKIw>LlMPdh$BRK#2!bglk(G zV+}BAYaE8}l2N4%tK`F*kJU7plO;;qCK==;i-ao>fgx2pc+q|H&5Ng}TlM8vT>~+h zXdl!;#S^|=m30nYqQ5srT0EHkn5T~YB?W~PsggUAGVkONa?AH-EETi~PFpI!bcE3D z*klc3+}%n=@v8VXwBJZ?W;RK@aO>J6yEe(LO|olUy{FwKC%cSGulAO@)!h0|wDMI- z%B}e3Be?e?2tuj)im`H*GMr}sdxfo6!y@SXmP3fGb#&*~JQm$;SPsaArnQ3{b{TY# zVauM70y8SV^a*C(eo1<66I?;e??XfU3R(_|d0Ps=f9o%G3a7ZpV1 zY)-VGOGb6=(2BQL^qQGIwyn#aCEPxJ!Z&7VkId(pssCCa2hGy}0)uPtmguQl{d|I- z39O@)lPwRfu_zOKGD)3NSF^(C!H67gL6^iU_owl9#D7LnmVRtKRH-=(9KKL8%vpJFUhgp zEGx@iR+^RKnoTYHk%w6n?0SGG*m6uzQ)fP7rc^I)rawk4O3|&_jCAbFh%$Fv3j~6C*ANvX3y^eL(JHBJSs?6?Q z@Z0~RFBzP8m%Oi(?#a_GTHWdM6Zqfmw&qJ!u;lSA0-Kp2Mm0`)lb{ltGn;i9*&_EQ zzj*i0H~Ga)ezCz@^IpU9i(Ex3qG`}eve+h2C|T&h%ATG+p?b~~^E{WZ@PXqAUS`lz z+woR4LE!%Q{N-u)|J(_#cOD&hT3ze2=`MI_>tS`xN+SNnR3>q&#k|IhmJA+uV$8LQm35qFEZW(pYRred59quuhF*h@!(Dt7Vdr?Ylk7N1;XP}yE z{cD~>+G|)2sf*h()kBni;1C07st!^V+w(E za92Gv#Og}uu7buj@E&IIrB>H0EK{llc1qYsI&j-}y3ndRhQWa%Iis5oIF%@Gye6*G zm!`n95=(6g>~P27I_MwmZtubW9fiko_psmF+d1qX9v)uq^>+`&_D%@rlE*umJ7MX$ zu>Ihoo<$wsV(!mgdVPxyv;LA`pg5!gm4-lr_d_cfCcBgv@wGnc& z$3(H@;tHz_0;AYjn=>-uFwm@m zC*}N~OC>Pt0FQ%~%Ee%2gu2t%y)tgKcl1^zbx2OwXF#N?E!(2f(4&_5WtI;`S}@TT zsljS`T7qdpd;!^E$vuM-JrFbh7hUBP9%m` za%(=Vm48d|?e0foQ5&2fUHb{ztkl2R&2Y22il#6V93mIqc@S|=U}WueeI_$Q9+>UB zpmIVhmXn|;;qd-|3jVNRiJ>g1`68OQJl41J-JXoSGqgXm^$>P+f}P*4bo=71O`0`e zjVHsxROaE%!c^w2kLEk*Xg|JV>OHGUT^|hZr9{aKAhYz=`kC5 zhDdMtmw9SREm0KhOcQf{Vty^f05hb-z|1W>c3Gh$l_Hm-9-q9#4Vrc(E=mhS6idI| zXz#E@$ zOfgzGezsbhC-N5I#=Cbf&bVS0DKybXgQ99|yp%T+nehXL4J1ks?3CNPS~oN#8IpUZ%Vzt@f` z{Qk~uJwfI6XIgJD0hP+s%PHF`OChe6=F8O0o2$IICi!&vK)#dtP?UJj`3ME@9Mrm_ zmg1flDL`BjA1ADAFzR5b!IOrgaWt_Z9}R`%Vyhbi51)U^?=?N*GHbeT2PEsT9gx ze@g3%AmxtW*M%4&^K(MAM$1)4mmAZtGinh5K?y&uaBzzy0jx)A5l15+&D(aii3rz?UyV{o&5` z-j2Q@^Q-x`U~d3mK%c+6w)yU070q`)%3jb#Y*kcFf(u!c*y{Rh9EI{*^UupHhvQ&h zabQ`K>M%K-c}*I$!&MBL2T!|W+hUUj=V-Zu^WBT{Zm_ez-I-aJ8v6Xl%YA-d&hi#x zP`4&mJL8@2jr~)YQ=higc;(w(IuJUAFukM+az5Rk8ZG-fbT_&HizQSe~TA z{%dDvXB9imOTGw7^z^@uMiKZWT(Qqm*DVjIe%;5KBm$p$q921R5)7j0P@>qUah34* z;I6=SWi`cXenM4K^Q$=WvnP?FQqpB{Px*+lj^H1$DyduC7P`xRrasHsc=rVe&;?-1 z%CJL-;Ct?b6xX@HLN0i8V}#SA@3!Q9efJNoLW`ctP9An;se)}^aAN$^s2#xeEE0{Y z_Ur&g#CozOjr{qS@|7Rn;h33~Fl+}UF@Q0&FrBGgSpkX~nMIiz%`DT?PXTUy_3s|R23bTF39X8u&HN^tBC^tV4YUY_~=XuK) z{TkaNA%LtkM=nVVDVCI2sM7luv#q69pZli%f%)U~EX7AHW1l&4el~Mk8 zR>2s%R#Fy6$(4KycLd(YruSo%gnih`=picewL(-wnG3UzV=CjyaLiKeGYL^_N2CZ! zWu`fELOPeKz0JZ|t7Xz-iMeb$2M7UNn>$B~8=x<|9`6hbU@;YbNF}xf>>U zt#UzyBtb*Eh*1f_)#5Yb%+EwOSY17hy)vPs0{tolNuv(rl)o0sFlC2wrNQIc$Lg$D6kR= zGpR417(?sLY4>~!KOQAmJX8#Im>gCSkq!T%5n|bu8NupoK-`$as$a}2`MM3%+6V;YODDFC13(T$eP#((&!@~gF2mq7iQu&a2m{ZstMK_2msd>o zqt4}egOvMXklmYk=q%()02-6FAw&14)=EVcBQ-wA3xsPzPvnmyxs2~hWq>5 z;qK96Ev~opJn3$5MyV&=ApBex+2G92FD}lzPWkiR@}{l>!4)Iw-PPDAO32~O1tliB zm7zJ+Aub@{Z6~%=a80g4m*yV!YU%HyN)@#%q)D zT31(Lw_zEtPybXQ6{!W7H4+S zi3(hDPH4$-oJdoRhjrk-{K@V(9ru0TFM`NQQfZWdXK0_8$0UMXT0cqcj&f93Dz+u& zN5L5rY`Y*Pg5J+8kxu#6Z+(pj;p5?*yrp;JM{fMcjUV|S{m7;XHS1U#TjkMv!-YvF zfhftYK&Z9;Vl?HBC%qCzZ4C$+8qg8KNybwVml!DLya&KFy4~k(JO;eSDUogsNmT$- zRqVO)F9i~=8#r)lD5CTdxdpb`*l$Gumrs@^ixzfvM;T~(a{hvu5$iydxa3l<%%l!5 zk?RzXYklF*`Mr)E;90Zuvt6r)4rQkoBj09diw=CNAs+PTqfcoV)@S{?`r`u zbVaxG#39v!zi7fB#1~LqL3bOp3YlDXis&kp;g%0OaHvH|W@QFntM3|4=jKK%0;dOy zIaZpZ)J0@S=Hz+O#)|U zacvWJ0r(&3vzRp-sk#KQAR&GY_lYsgr8Gm|pXMK8eVD)2;(c_>gF&;+B7zixLOV~l zm4UH8v+G8?N}DQ@k}Mu`Gp!M^B6m=chT@E(%*TD0`cmtpF|}?fV|dOWo1~;*a~q{4 z&Jej!sF}y4>=20#+WVg1y}J@nucJ863QDg9!)Pc}VLy~@XHn2G7!Gt#6v!y7IvZlU z2ea0&$XRsF?VnO`7Q6%pS1tNiAGi2ouvKk<(2_5R)oQHU`K1N@g`^Tk^GGFD((3zA zNhS954SjJ7{LxBCB|58o{FQ`_KOE(251)wRqw# zx#@R_W4mOQiZ`9ExGZ6gD)sd|`$_go9AP+H6ygZa4C^hdux=|@z-4i~n9JhWZH(RP z#B?(^AHmO;*5qtJK;<{oO90u-IM2zV>w}EIh24+q&bwopBoiL-aYo zvEuwO;V?~k&r;c0;)(Qg0)dMj=!+O6yl&Pu_IztL(U3g45^q%e_KWE>RXLtns*Dfd zIfDNfRfdD2$54QyINOlC`UicQ*o-LL*O(a-P)z}%W%#&cm1WHc3~n#6byKR#MgvYe zwtbJ4##Zeyll-NI(JGFS31`>l(}UD45DPo!kG;O=3n=|=B8`V9xxe`n%4^UWTR5JVu~*|@gq{*=pj^D6Wf&hfvk|eq=dzZxm3RJfyDv6Xt(t`?g2X_7$dp zdNR49v=1_)#9~y;n|T|szy>U^0Sl~SMsTljZPuQ%L^UJ3(rRre+ka{nS^1eB)FI)+CP1*MmfVBnGa)j(X2r{f?27nD4W zEd{n#xIr-z+u$WTfvce1g>O1iiaEn zTr0Q)LOQSp6SR;uvy)w3ZdHYTbku6JcDgc+bJ$23^^8OfzyJInRJbY?r@3arj5N1+ z!_%rY}?*W(-yy#awBvWNfN49+}EWR_ZqrJ0{sx5@Dqu(Td~yvqCXz zS}_SEGlc~vB;p^Ma(Px#UU`e>hpOqaAIj1Ce-{q^)x_m?=1ID+X9!XkZ9gWLvBHFlbQq_Ajv6mI74AVB}EdbP<2r* zd3!UFlnuS`%s2nVo*{Lm#G*H5I4Nhh6uqM7h8BvB)S$aH3Ux+4*gBmQdQle)?f651 znidsqV7v!KYxo?gpkt-wOx|lXTpYV&k;s~au8&gjl*{Yra@Cd!M-XHSui#T5aGY>^ zy2GVrz`xH*zxuxT@c-7@%Lc3J3bQ!4Rd#G{S;yF9Q#aYvO*VBso!X|g@cT}!*+yOQ zgbZ=V!z#4i;nPF)GA)qc?0}KWX6g76tWaE%cdA?q`)>@O=QRjKK8=4Jc#-JYa6eS( z+M1yHW%XzOhKT|>DP*E^0|Qxzk&19R*u435h~f3k$DqvMIq^}5osa@VgLyO!53}%5 z?5*Lw+bY?@?miOWqzH1gG#b{8%1z@uc;^=)YUZe&Y^@1+kBRG&Q|1NxDA^x&!Po7%Gg`~WxpSJm z?k#sd6BXCYq;5O?2FjULigk82eELPGIiRgR5o&I&Pbzrr?Yvp3;3u{+Qj2LQV}qCyk+g zK7QNS>lfH-b90G)R)GC0Y->kjQ!LG@GEC`z$MG=z=4qQdB9kP0pTMU<3x5u4C;mfj zk@s<%dKso<=qEO{p_Xygxbj~1OusOFVAG)C_*%pG$nGyiPJWBC4bY6?BoHANRcS$G zST+{FT#Ij3BNxhHl3f_XGIlh^LbjiGQ!WJO8L1?9g?VoHY^Xk++fikvQ%$v)~lHDd}RgCqXJD;P7T>@@M^-^`B3E- zYBBfIxa=dViu6##MKpwfyB^BXcCSyMjc694VNn^?T5!8k=yj{oTS%D?ZnZ2+O=!9{ z{>hgXix$$G9q;?aqP-54_B!Mic1($XRRyBG;2BjCpHSP|U-ac_bHgjB3Gu~E8X?72 z%ziG*EemdN+yxTO)5TDOGftg~rBko)N~a~(6DHyk?+)t3el8Br?lsdJt-F zc)nI?!nxf$U1Q}X33R`7V{gp;w&28-OtWbkIJ^RO>VR3eK24Mv1vdR>A)Y1Ou*Gdk z7GGn_-jpm>=$|!>E$*Ch=2Sb-1PVj&Ve*McI5TO$3S2=)P6w3Uy7`Fdc5s(m(o7t# zE49yO2^;U#GlPAPb$7-$G`J zYcWpBty{BTTzM{pn_D12W1NL!1I^$Y94ZtPIm%1`=o0Mct*cH%%GHnJhYYin`yy4% zibqyIq5EvlyRWwz?B%X`q}Mc3Jm0gGdJ>V&vtM(F1Nc>1z?@B`>Z@HqRbRi zs|Im_Yl$a*ZIR1q{a%$ux7D;|c73p~2_cdlhC3@s4o4aSopumSvxJ+TDC0m2y-C&% zv+(94mb0C;kJfa}T&h>h*`H8-zE4DAXy;gQua@;54#KqI6QIFG4bvNpktStiwGxgs z@~diQfk6C)$~+|t0g?`ix~eDcK%(J~PrrbfKLlG`oWNR04t0FsC$RQA=mMt%-BDRA zkG5b{nXLVQBt!VZDxcMLFMMA)t(*TO9rn6BY+I+1rd)#{xiXi^Vd57N5dLFUK3Zy9 z1CgU29&UN9o9GCmczU&UKv5ea3r~_@6F#PBiRhFHfxVlLSnCM#s4&tLRl2i6Vh6qg zWUG_%iD7k~Mrj|*ZYe$%OfiBo!Q9Y#?LW+F1^34OSs30-;!-N!aM0Rn3~{nnSm>}7 zCmCbI61wK3^~PLp_rpbU^LMqiwNlu zL4(_Vi3pt1o;(UeG5t4qCs=u+nkqr%qS}_Dp@1v-a-#~s&TUWbRrCg3Of;ovMZN@H z7`$Y(zyLYVbsvI+4yR9?s!;b%isF(tkW18M-rStR8q z6S&C)ehnXFlL=g*!@1wEOrYm*KDvq&;_6Xxo$6IksfPC=n`=^s!*IJMa&9_tPdx3!4C;3D{@%<>6+48fnTvh1jfNWAE95wpR@?3QbG&B_B2iNnR) zlhdcTvtn&$Ja1LgO+?xN+Xz0GAR$sP%1V(I;4>wvG-WdscEzKBd~G_~*WS*W1u1=^ zQjBgATh(8&+-fqA#Au{s!i*SzwV~E9OCyx9NUs90rBN28WwGTnqVS4&^FdVdm=^Ts z(=V=(N4NGC*zLxLF}Wwj4MZu&0GVIcWo29QO3MDDqej^g zI&P-#0&S^Ag@;h_CuG zrS+GCh4q)CIpQ2EAu)fb;vD<>hQ65j|9HvL6HNGzv)0IQTu2I%f@i2T@ojMG2~fa9 z3eG62Gz2>hUW-&*N&2h$S#{uUCkudP_RYNSju#l{-nK`FwBNzXSBELaZ)>4<(*)QL ze!$G!OS(j@nbc1tN9Cp}2(Y(`x%71f0jLH;6)4N?U&vJClg#DrbJ-ef>xWC6+1EOr zgry(KDODp={4|kmqX*TG1~`Xv$~P5-C^Upoa&-!eqB?_ViSVp`mMvOYD*vyeJundI zRaD<}Kt(Xs;bOWXhoY^C+v!l)HFZ6UcU+}iP_Ixx-3Kn!6!j*=6gX6xi&2pM<1nZ+J-F+||52*ix^d7R<^j$Fu1j~v4hCYh1*i=p;Ur1!}ldi7CL!=o( z2kvzKRke4hz!UQ=%4!)FR!c63fCBK$qBurn8rHJF;(vvvgIb;0*=wZ*sl3l*K42@6!9SdYZ5}fWM`QLIz!oQ9cibzk{-*6Vb; zb=vNFtE=(uJB|w3h+#gnq&G0CpZ*D!_S&$?Hf~r0sdZe2$k8@`r>b+QswzyLtMYi; zbEzKfxK7pmsHnh2T{r7%NvQnb@50#b?{pw=+aJt3%l92Jw?;I(jVrHYh8dF1=Wgr> zYAGd>4o{^yf;tGF(*% zC0iHE+psf3d;qFn(YeW2Hy_JONoR&1;Eg%ZQoc1w@TcoB*sx*dWOIXcBt-?}NcWbQ zQ5sK&st*Yrqw8@@>T?>88!4Mu9!clZZW$@`6!%kdiXZ7(5Q$oeOia!m>g7y&nXXAuA6z)a4Z-DkixI-Y`T}kx?};en z;XV>nfZs!_J7=B$^y7si2aXFgR+*_g9T{Pm0#S>YsCW^sk%&oO=$=1as52W!C@X>l zFRKq(A$!IR68q-yqA+IIN~5cO*G^Eab^B^IOpLcR-=;~`*l4V=iSo5B8SXbu^5>#5 z<7TH<9e)h7WYB??L`ng3VTS8#b^`i8x{YS&tB0EqF%8=mf6!*cjyI zkgw}Q3L6WJu$)u19h1IANjVixQAjgx2e#{~Mk`iP0%-Cw)|9o^E%B7xogpST8;GL- zGxbX9h;y^Qf?b=~T2rWIEGA6rg`Pxu(^elllP;~qxX4C`O1?3jF;yfz_Nj6Ati*hq zux1n1Y{Hrc6xKA2xBhuGMzQe(!B2-0zQ2NXDGMh`_l;+eNHiH~s3|BNc1eZo14rWB z+gI$OXZh6_iDO_pELmYJ#g0Osv7N3^z%{YDui0YslCJz5Lw}+ojdelBtaaDNe&Z=xhF>LxDD-?Jir=mZQ!I|vK5dn8Ad>B@he1fBs!*@fH%u2?M zn|*8DqOsp>mUuhUsFHSF5R*?`5>6CXBKK0?NC~4XbOBpc;E>tGIruq2O!@5~g$*M& zUcNKs#T35HMJ$GPMexLei|F4__Eepr?t5Pj$92r$2N1PP8A3&5IlO_j!1IgscDCh^ zB*A?4BzBOzHForO`ZSdgMys$rn4E;umsqSL_YrZU@Z2%Xb&aagM4=62>RkKT)~tr8 z=Y9$WXMyXsRVvRqYh4O(!HE8dDzj~~Q|O-cNrbRvG+f5#FgnRjSl)ANL~H<;x(3HQ z!7$CI=*AV%gmgrLP*l)CS(y!m5(Y=>F5ni{CW>BrTRv`-Ex&Y@JQtL~_yt5^xa3~Q zO=B%Elxa1chz^zp%Vd6TGhTx;}sEdqlD2{l`9S&V{CB)Nv}uLmAZC zy|dC#va@r_C5vx^H0u;)mdmXGqF`{w)+Y*B^Fl-8ge{DL5@Q?gRH>I1acn5b`U2eQ z41x)4S!G0w`S%M5VE-z^vnRYOqPH$#56iba1hk8faT^7y_!^tnL_)$M6|;ST>yl#m zQarEbk*O#5*qy^Zvl7OPhsr*4pl|4l*=HW_Eth@9Hnv|^AwZxO z>iMHf)I>L?OBRO3hU311b-%%hBXWEW=!du_cuEA^RD*|1t3zMIU(iPo{sZuBw^IvrD#XkhXlhIVB*5H zueTDzH~MSq+1dHqtsn!x^*WO8*JRk1ykJ*`tvX!Y@d!t!$Z{~e7w8zLvNVSIG`)&a zDT#geds)8E@^~#qac_HjxuZCTWoH?uzC{vlIZsf_*t3jN*QWQDabn|#arVRzpuwMO zVum}*HN!g8+d#xIXEEOoz=(p8fK%RLcxEG2ibcPf_uXFQJ1>ge*>|h22OZs=&>{YS zq3B%8&M<87c*$49aO*W)u{P4IkHz=r6Ikxw_Qsn}U`dp5)t+iX zZ*nVa5Mu$w#bI+s$k#yg8e)9`Q$Z!=R8tXa)Ha=jVV|62ubjm6)G$s@u~+Es);Tz` zMI-cuG?lJaH3WSa3nIr`EEU605-DN9h(7bk`h12aZp^giyL#nTh8MhkbqkaY6>FI|)_Y}QP#m{sHHa41B3vytN0_LBO zwhwlX}?+$?ZAHy!sGDqG5-I4c)7RNUk!fa;L*;4mE>!2w3$1)Mo{=Q z!ZlUt3+ElbvouPpD)gz-7tfR1wLELzp@o5vEjXe_*V34VwccBHqsQ>1xdKXgDh=FH zq0ClH7Fg1%rgojfa_?M>r5wO$BIl=zOTN?PRz<={Nq$*1g~?qi#H$-Oq()^oP~Tf4 z#%!j%0pm9kIdbGFx>eI$M|%T_p-^2p4v_UBm+eZ5adw+9lC<|QUGDZ$F4n=Ab7M4Z zwVWYHT@!vNW=8mLf!GbjnoLRcR){ByV7Hx8YGI480Vz^o4wXkk&P^0Y2{U4{jtHDX zBc3Zd?05^h9|w1GO{Iv(Q~8cuCG@{S-kzyW9Iyw5PryAiEU3e7*3HM84>upv{>?|m zK$wR$NC~TQ%>I|=`l;1CuAm05(XlBx(3n7+n&LmH=ZHI)6K?fUlE=8TPr$K-^WmjQ zvJoM)g=DSdxorVo)rjBvE6d8Pw_U%P1~}Pc^){zi!MU7iC}boPzWbTi-GU=Wntjc6 zPlu8lK4R*z91TP&sgH`fR*02NHL0K@aPuo1i zYrN(`<2XA1g1xi}66F}9Bxzif#qDO7<$ICK;7ODuSWbN{O7i0iEVDj&^Lk5VAi9xSY!VTH!N^~U7aTJ;kWiNN@#$1-%)!+4igGrxO|@!@P?s4Y`G{=aZTngS z^ImIwCz^M&@SX1#tdQ(aavvAV{n65``xGXa%un5H`pj}k!Z7Xuv+_V_bl4w3SG2Q% z0!j*C#H6PdW5qJd+Ja0h%hChLU}3V8mY)`#Uk%&mXQ9gv89yypSfJp2i1Z~;Z-Qaf z>Tcbsq4i%4PXxy|oH6AremtJ!W5p!{O9fpMyV!I+!tbN+(cPrN(#ILs zEOw=)&$u-x?U)TsWxtI6^*lZG2QbGtBSe;8Q=(oZ61=y4=mA`ic3sEI3fNLa2y*F> zGUZSyOu-7bsyg*ITqJc~ZTBno(Ivk=jY5@`lsa5skyuG7%0*tpsT7y0uAn zExbl8jG|-+J0aPK0)v5e4kS~>qZ%kRlS3WIR&_Zh?h6(HElx2N3!6qbhFA2H zCd5CAOECVFj%mS}B{G)wCqX|;FUJMJS}PRl!tjqK>tx_-o^5ZMmVxJLG$Kc{2Kn^{ z=d&6yPV6rt@Ykt7$bfcfWXipjlZbeBd$`Iid5NVti6rC`|MZKiS!=RNyz`qBl48YG z>*gfE04~aB$|nj0U4_9r&VKwH+ug2_kRA_;%x~g+=RfU(mplhzBTLf#Kb;UK7w%2+)$}>3C zkV~Qw!&7XXMYnRsXe%S@WtfnSU26pJ_s0y=VX#{sWZ-VVFI$-841OA4UBS7pw%T~X zGApA|FqH!&-Ny_re})Hw&ytL}PsY&&n?=gowpYUNkxxz@53ROSEHOX+m zv5FIlx*QeKNL6^ec3T(jikFG=XjI~By0l6I&XPv&z+pL{Wt$#Rn$p&N7ONb^VwHs| z<*<1)s9kNzRZbTK`~gI=!h%zM#$~G z=52v~777Pq>_WS)qCBLAFB~jtowmI)Mq7n$O@ocSqa+`OondiQCNOqMAWFQ*??3-X z0FP1x@c+>jSXEl0SB(_3v{bVm6XMw1Q`<+@Dl;rZM*9YCC;iA{pbbtCj;aLDcnNTx zj#(F{QL6S-V!#FCLYA+qP1$Kvc3RVDy=m&>zUleLa6nG5eS`xl^x72}g%f<(-V(Av z7OAtfR1Pl|rODhSnihSLD)%(99Y6>u^FyJ+q?uS17H14sCU`wIfKJ`F*4Slw?d`u= zC9ezIt4DeE*9n30aH|*P&}VVrq(>zxg=p`m2ev9dKsc&`$6PiSHG z8Yy$fsZpnKk}Gx*hu@c_E)Z9_P2M}Y#_2evIGKNM=82`T3kKLTW+o-(d;Bz)gS+5) z&9}8^ikiGj-4OA>8p4shjE6IRCb_0? z92FM3hGv)7em*z1!l!3ktP9v`9$-Eg#ZtL3IvqQmBHEsv0yIpH82$!}0c?(u0vppd zm0Z*_3^ox zYy)*>{+-PZxbzv*EQRquiEGjAV@e;(E3{?Yx+XG5r+!k6Ii@z$P!J||;V3>1kohwg z2`~Q>Q9g)|;clH$-!F;6~`v z(3;+^6!0MM(sJQJ%l!&2Hh;SPH-V$#AM>m0M+>X#$9{Ev-_m)*e%@gQ9!8dRU~lY? z^Bi$xt17tfTSnfezx@*YU(V%&)~UVzR?V0!x}85X+XAj?Nt;yVJyF&Z)(`d}ovyA5n0+HHy(zAJy$y9! zTw9^{wBNAe+Rfjx*k5nC6*ddOdvTOD`zX?(lQcvSj9vzNKv9n6E>=XGUAo=e7lREj z70d*{6kHlm4XxW-@bgI`IIy;W9O()N&|c6f#3ckIvlrA0_Z9`gDkqJ|rjkP#++$Qk zQOF_elv%EH8!FofM85+5p`-$wh9FGFsYjXHtVZGeWM*ScdE=raUoV?#VtX5KPo&|v zFPj&1uQ?EXzhTwECx~;>@kgqVVHQaiM-H2^I~y?rs;r%XfEpa7rV!>J2RJaa%5XZ{JTAjLwT37nLq`F5 zShT#5V`=buyfn>Z>@~NUAzc`*T3HmO$?akHi%=a{n<={dDcY>c=u6%> zNO&4|j$#YhG|3>rykPsnDq}SZ)vj)-wh=1I;eQBC>9J0Fq1o<>EG@=U!ic~QHo+~4 z*!r=vi9;l|X&ol1OqesB0$ux`H(5gMyAwYs0r9(kr>1$gI{^) zx-^~uf685o-o8(qh}2@sRUPJJPr;kRILKrOXAr54EWNJ%1Z!65^(A*`mts&v1*W;8 zGKz(nF?HDhn*^AXYi^rj3B>XuM3A?J7T*b5z@8@D6zn!Np5{PYkEdggnx>7|+TVV; z`4}^6E~X-*xvK$8`=Nke8*+qDn)YDKF;ocmo1DP=()O6+MF~9Aj<3~}Ux|p_L)DZ& z)Hn3yGLS0~;XXIDrE{I^hR-AfbN4B~Ce3>25LLq8(gZep<;k~RWmi`Ugb_SPW$M3ZcE{SKyneHD#3QSstp}^v z@4k*`s~tqbq2=UHm0DsIjEUso)53gBk;Em8R>H*;QskHscC|>gcD1*u!X5uPggy0Bgz%!DFfZL(D`WJg9OPCg5;-jGgag~_zF zedEJjqnfOkt71^UGc9CN-tm}}47jIO=L^cgv zi|t}sC@eM1D_T!HcCJmg>!u*Tl>6BfkO1x=E!C)LqwRUR!d5YdJd=ijPUFrm6+i@>bSmP!YkS-mf*yyVzj?{6mBcqh$ zmgYj`*}#J8UIy+t#2zp7RKa}Z$`<#m5tYPkNxhcxaiBn;X)@|}*| z4(+7c;aHV-u^T)iK}6+Qd<{3^Y9?;vsiKQ=^Lktj&;prUG#%j(e9oD`fI7!@SThl( zGF=s1&}2U+=xMlf2|R2B3%V7sEFPzdx(CZ=RAws)l}Nz=#v53)*WnmKhdDr_$fRdF zo76MhchF^hN*lZ0d>|g(1og*su%%-sjbAkS+*XgA`?0`(>)X)F=f%-O$$XIJyg?e3 zl7oR*OmQvB6)O)M2g}f9&M~kF2TAS_{W{&eL#quqpk9%Q-iM?l4HsZEJT)D%WT%Sb zkxh!;jW8(Cdy;deHn&99a39!F<>lUR4&hpFzKjezn;uOLVR4A*(NqkJzm0Po8J24f z<^5=ypFqfo^C1**U0^UK#B1lR=X+s&xOr}Xn?7}%Q4OZ7SaiIBIsSD#tB*%4TiPur8{h#1_RL`Xj*_O z^#R+M0oEwL+ib$dK>g+!wsLD@g#xzn*+MbAvRI$s-NmU(c);}-mHAUY08e-b=6zX! z!-fO!Sy4adqza+q^aw(@3tpipBa@x1G7B(!DANg4c*kSq2Ya2;Fu|@1SVI||x|uM` zo-oZqhtA<9!=>J)E<)+cnGmp<+Sj5f%nRynz+ZqdhCZs>5PWP_;*}d#vrv(*Oftc? zolyA0g~bW-hqdsZqde=&qR8^C+I)i%5Yha;T9&xCXvw^gc|RIRH0jBeX4bR$L$?`b zW00#d$YwFBJoghk9EihfCj#pV`A{Ay5_|9tFrFwd8>XqRX=m3yhNZh(48_$z52|ge zj#*?*{x!sm54*x#PsDr%vo_WyM^fQXl39p((1kgK5V|sh2f{u#dp48PD!e8%xcwo` z5Rzd0^sfT{1=onpILTvY~p~U z(HHv~d2CY-=Ui#waNO5}g{pR3rva?>Q#teM{B$BP-Kmm%h)*945dPw|y>rD0;YE?E zi)&nwNh2yi5tGY%m2yPOpzy=ZN5;eP4-|>Zm2?RBTq!nAH_qvzT6!im7nEY8M^n9_ zk(Saj$>o&Oo&kpK`W-T)h7n5~WiiG~AjK}#RtmjBjwd>i4$Hn& zsw1Yb5$WrM96HU16K%4to2=_5>$;x)YSUQ5DU~$~54NyO+@4w*?wDwmIS2jdKzXr> z7$sXisG`YphIGmBR+#!ON5=OJ*=IXElvV0Zs~sP zCxP}6y4c~gVX?aO&ptvIgO~a;_m%k3O-nOb6{4FD6Wx!cuyavryN+U9KM}GUD!`lW zI8yx+EYAUt1gGv}b5R1pe2@AkI05OgYV>SlMeeYs>nWH0M_EgZwjvl`G@g+6Thpn8QGZadA&JXqUd zx4La;6Ktu9+xt;p+gXe_a}Xo5fGX5e%RS*=*h{nCn_a39r?rqI^XAtHI=W8HcaR9~ zk}D)jAz4S$G684?K<4#R@PY9f8t>vb@$sTKad+E~6AwBVR(B?vS7lX!;=yhBTkZ)W zpyf?fo+2a_EG;5&8xjW_dZ+*mEEg#;9N>&F#j)8YGrtXf6Mo=dH{nM!mikRmcZK`< zLBqn2C(a7U$*mf|6zvsQ*i7eV!< z6YvFAx>ivNWVS|al&y9^azT_FBZeRJH3lVB(b_JKkgL0D;Z@u}#CvZ6icZGpA*F{K zZrja@cl>IZqEfajwz~XU+1o>9-t0uqx&oR_mJ*1eycWYn5w**G+mG`8I4Xl)E=7!V zSUlg*_AkfiI$R-~j(8`Th#DRQQvn-j`06dUS<#l)1XIUMrmYfVbQCvOXh5ha~$B-46ff<`isuf6>?tN!~mG3vm~ zYe@JQ*r=l-Rb@7YPjlO>v0NSar2H%JCcMX5e9_y!Ix+f zE<`ufC#2HNhnrtxJe%sj)3{_7I4IOPRnBDwu};hwja(J(!oa?K;Cc6bbXm58XBpur zqx|Lr#Oaq=%C!K@HPD>V3%t{(17DD;lsDn9n%u0})QHLB&*&MN*D1Aq&_;$4&y`G6 zKAevAYxq3}^+L7#g+#Tpo~5K!b8fN-X^T{o)(2vCyvB?s*LW(f;%7)kYf^^0I;&Ej zGIR)(J+*+9uqQuMwSXgiLtji_zPl2Z_uCSfKh1NbF&Alw^61quS|;WD5=U$$lkip(ph$~sF$&l@>V#pMq`+X@ZEO9vYS7Jeq48<)1~>nOSvEN%{;W=EdmhusdS3_>bU=^F-9q>N3i~P$H8>KJP!N(**V+vD z*sr#wpRKno)wNg8H4;|4AOWqs%5u!9Q>9!{t1sCXIj*dWx4Ze9|3t$9 zi}bwUZ}rQfbUy($F(RB|^YYA#BVlebgbBrdQ_>Nb7*e8GiI>Sx#waVGzH zB1)tWQIL7q%7)`qZzlT7A`tLD@ayvHs4s&~aC$C8cgwspO66Uv_vB4`8+n|Zzi0>D zvzG+LRdf8Ck-C8MHdXYmJ|KZmx;M^4(1mBeM3zaoct0|hPi$6fOWf?t{8gIkm82Ka z(7Zt=Smp`Lk&`ty%t`ddmKG=q3e6fjm#OmWyxy)qF5d=fu2mvVqxd*yG+DJ3Q*SuC zX2#I4Yq$frV6w)@cQ>YGR40?F*TiV_I*(KZ4)$UW-r9T|OzC!zrHG&pFwI=TfvlF2 z5GcKFlZv#3N1D#SBstvHJ3BJBdzVXxlaQUx+g3bMG~w~F68Ejs%dcNe{p#B0SItV{ zq=HmyFgR`sQ-bLM%BL-P&v^WYeCbQLD>V&=8Rbhwa39gICMCGCvhRPnG=|9BOvVmLln!{Csdc(b& zj}z8TP2d%L3}wxIq3IRaz?F;%4oP>^{h_Pmw#Y@b4_uU}kC2y2VN7bS)KWNV=e!0H zRBm!dZJ^zSR7blW)zQ(Toer!MX$J;$+#eS!5&?qC1Q+k#ejjwzW$u5oQG_{s8?B36 zK(L0O+IIz}4Bkq3m*D5+85maZ{mI2vphqMfvyX?y;85e=J|^Nz^68Yv7L(1C+I|AC zr69|}08E8?D8mWUEs`+&OfuV*Work57;+}G{S(cXr!x>5g)h!=(wN*!(C(vA@Jh-dS62Y;O~d_60?y>(<=RIjsHOlZWi*gV!>^22Yv$!GP}O< zg_T=D?tg}Px(No!itG;?hdAd~a61J-E-n5NKQ$6JGyAx1e%F^0W?K(2S;d6oYt+zo z7cfelSG|xsV)wD{RquAlfm@X~y&Js7)8C^P?Tg^p71c|GvD4~!x~ZZfc@%WNd)E$L zpTd7)w9(Q%N`XCKb&I^uxBME#jPva*hdds>lg)P{V#_6pIUaQ7eZ?zS(^;{}Kbpx-g8f;Z8i}t%7Yx*Ub@Urh2*E|= z;Cm~HcWL5|&9#OAKtR90@$f~|AnTW)c6o?!;4x&(eG|R$<)zHG6mp69%pg?1gsnWB zzwnuO#$?=LOLy{wVr4H~Ga`T(gP$c;i=x=i#bLsO=XS)vY3gppMpjJ?Pkp9(XfT6s=9jqN zsnCT$t1p9*lzFGjI{2p>sZ-9~rk(791?vkRR!tM6Diwv3hB2Qozwb-k8X2KlXE5Th z9}I&FtU8P`*wbDKc$WsrwB<^bU`Mh-;`uv5kEo21U0JjCzC;R+3{HIs3#M&EqV{>+ z!m6eQC2^GkUR5W^8;7q2xpbc8PS;o&V%ZTIH<^``hW$;-8cdG-AP%=KmZ*Yc_XjM9 zp#3?I7CepNLq%l&{fq8J&^-^1x3_=)`TsuH4c^M@NB`gdyW0+)bYBD)Z{fr3-JR`S z_;WXC?QZWL;3qp<3P;P-dbyEDS2eW-naoWFXp;fjWPsK)er}q;9c^v!_cDUbhofKK zfVg~Aq5h0(b}F++nT?4h4%pAMioSf56}55rUz#5huX)y{X6Dm!w4NLt z)`#7s6LjBRoNwt^$arH8QoyD2qx*d~r3_MGkr8gppyYH$d3K5Xj>hf9LKHC{aRyHR~=k+!mXy=4+eHkZ|=65yX^VC|OSP{-y;=zxsg^dPruSs=&1&!c0V1)> zNl*?%3ICC3OA#6+e2Jo70Y*AOnFW0?l_(ucEvbh{g(&T3L;MT>s06R&GJ+dHZ9F6> z9J9hBd@mA&m&!1>%?8op#dm~c(Pgo*za`sWvy}5@9F;i*rjW5yU|F=JQFiqApZ|eq zCrrr~3QQ(TleSWH3n^_Ve7fGR zmFzoBB6uOsWs+o#NcK%w;aRyg4uFeFLPQ5;OB98;R?ObavlnXBiQ&u}s6P?O!xvk(mOa*^iv{!9*sb*Q`aic7ACT+;p);&ANEDOu= zI^^=kd)^8z!Q+A>)KvnN`21oAtmniRFx{uuhHh!jD}w@;ysu@+a-O z16da|O_)3|z4P(*;&ZrySMFQcJ?|DU`>#mnbet9h27Z;y6$Cao^a7c zmxzQn9m3AtRKYu6hlraCl4>v}p)O_R3m*6blFu~dQ7Q7u+4S;P>le0hHx zA`WDK7rMQZPKxj_ymP|hQG^Ki>#_PiDErK4ZoQ<-g3`B$_KtY6h%uI-o4Nhi=WD%9#@-o=h zn!dBW?4evTE1@!!Dqlb&l$a;`?M4#l@d-z@Fi6~%;S;I+ww35L)M6{(g&QlnTC;N;t&tFExzaAM~Vz3(qba-8&vEE$87_*(om z8jgp7E*-v#E+y?ct=Ho+5iuMP7j(oMu6Nx0eVE^T^tYa6qG0}mySf~@&y`*3E`Xb7 zM36-w_uvGR4#PXO{jCmpqu970HWZ=F@4#L5#w_2__8>3JB{0nS+(l*9A41;yE=d z-0fOr8$QJ#dVde@T^Y1K{S&EHUSTDzh*mju_(H6Z$A5BB($#fJ_%>WssG1}kCJb#A zK5|bRqm`60_fEI=Z!0aM4tPFSGM}&v;R;{V6U}iOI=L!rvM*6=hh_qfDhx6+PUKGW z7Jfl5jg?3wA3nbMz$_{X4oipA1eeILnmI(jR@_JBk$q}qou}0R5T*)H@TS|9rW^jI z9X5U&pJ_EV(;)%lx5}AnuIE&J3|_&Vn<6PuyapmnCCP^Ueu|19Ra!9`oW}G|BFI9) zvY0WVR`D>dbOv2h%s+v{o>&GRou>_6XCWA(>bq{eL4~*O1b6bAz22X0`u@kDdJQXMer0ZtkS|OdReX0AD?ao_{#pml0(k$+G#k&jqTDfve6qY zvr#fm#<92A*`jEo-j)tegEx5z6C6JZqoiGX8D~0L&L_pGJ|tQ_4yc{`F+gIZkrS{) zlng^rjo3(J*%Q@MmZ*@dvn>k1gQ(&MU_PS^B2sXeo+$TzmCN@TbGSK?1W9mee#DsK zj0g=PMlP^0Dv0#~dCXztClGh3x;eL#xtTB~j|fS%=3&h290jw=NF+uj=seG`hbcFH z&=bTz6j7b_$OgR{(VzmFotr;04_}_~z!8JMbC&sy_Eg*fM1tu9l3uP|V~w zxi^cpdYuNHQJ5mDaB``b5Gx}4%ZIQ_pXOOnbh?Ni=~537g#Gghq?ZaX4ZPtHE!=t@+DN2F z#iCQ>%I~O&As)u^Fku?9(ID!h9_1J=*79gH;lrDc$tpK~pS3eVIl0oMyq(a?{D#}H z>KQ&cEg~_vPRWCFJwp9kC3R@Ncz~}^B*}zPmogX?avWwI@S4JG7{KlHWKKyVhyb#@ z@|Lv-kZu~o%6ljSnCB&?j+o_LjdFiwnRIj>-hTfKw*}|!;64l;tY*WrLT$Nm_+XkY zzU{VeK68!=TBmdm^SzNZx0u_&+sq+?isK@9sq+5!QBYCnIvx3=hi}yd3VKyjboH?w zR!gAn=v$Ki;J)>dqOpTj4Rw-UbVnJayxP!9wZGT_qsV5aoGvU}0HvvcRZ zwklNM;|Z=)=}>Q!j~E%g^Jq^UfGDNMJNrk!|NM_onlRM)!GkxtrGY8$#$|Zo(nP~C zZ)S81&8?fC&rF8cVJ=+htWbo7dTJ1I%jbO8WTKdm&9M>4Q)VO!m27-iJ^1vm*a&mj zRH)C)I9oCfG*}j_wS17)3QpivT1jVLh=O1L{Z|+~X>RbzqM^W86~mf`ThBY2VBWnS z)YkPbIOz;qmCDY~)bwILW_8o?q7h6Mfgu)9qzd}Gl8ok6(q>2dMOV(03 zxCL3EoKhB}s0>gwLa$0CS|gV&Ts`au^xpm1r{D8entZ;5k<0H>*s@d2Yx=_ClcR(1 z5Q3HOz~v5JoT>cZ8`79w)%^VK#n~G@KPTBxmZ+P?iv!VBXti~OxIl!9w8j_txWF=| z`xQjQ1-8(fzusyG@48Q%H%hoN)PSXzPa*_X5qCBv>1ZOPk@sp-l%NnKg@vCOzjfvm zzK$z44L*#e{<+A*_ae6)g=*wcqlg1~XIa-CTthU(QW5CSz3HaYR2aIw#$p3GBlHiLg3BiQnlNUz4?YGu><`Mlu(jPe;L`M9j~|{6 zgkca^{L=V+b#i^__Sl2Mi{WrwLpksRS z>6f7OJ8d(uEHRs5FZRXw{$xR<{2T_`tNPX&o`b@ZSnc5iscCZtw-3(Tji! zeiHi{Tu)dx9zu5QMGB{jt|^TZ4P`bigVs~(I(vhf*rL*xx9T`wcfR?ZbrzDXHbHK) zL)Fe)6H#+FoD4(^-bbZn&UVVFPD@rT73!f3Xy75m0x!}LyvrX1xXUVQ!}_83le593 z^wGi2W6%3HxoJiO(1^o3Ah2I+HaN#cnp?M`9O8X0{r`Fm@3=*XZiD@U^&#KVXT*d~ z(BcCpZs(oO0+|>DX7842-%_dgn~ygiG)*dQS+pOkIsd2bo9}t^hNvc0p?>g^uq}je zNfpLLg)Nkj2wH_qE;}gXA)-`<{OJ~|Z0E{XSaUObmGwmue1{X$pqW;+H@y1Jpp?86 zuSMwAKd&`5)BZMkUP*7-1ZX}r=m|DMu{&K zBpi972lR$t!xGYuvT+fdW;pj=GVbd{?hn)~N)e&1s$dz0D}P!hhHRsAZ=a@J7BsoQ2rC6Z{atyH@1&*!UC%}A)d-zYEc{Xt~hO?<|y`e?575x1Go@>OD-vg)U za|NybK=$KeJls;1-G|^Fz8)vol@I64^6L9;-TW!LOe24ZS$z0A-5BBr@!bki9yeZ{1|ZL^`8MV=+AThrd?jB{6nvQJ(AUcbvwXOyw(l^2m=3$p#?Bf7(ffI1-B ziyyN*3Ev}_xE4=zo@Y24SN1-Ti-F&WaTZ<2TqT4Y3~L&>k;g=81Zo>gop|Dey5E=x zgoA(Xpe!*ucpZ@ph%L=MO?54}HGA{AuOfOiSKOm7)*1Gwge)?j5!Chh`(bv!cle#TUU__W0O-cnpa9e$^uy*n~kA^CV!c|dpx0Tj` zQ@qy-XMXhMW?R?Z>c&0TtjOA4q?hi?h+QX6P%)}v#9RH_u5nKMI{P-BpfOXGuS+XlJCN)yGSJvEo1b7)c3)I>Dc~E zZ%ehM#UKi7OUugM6}6sRe=)LedE;`bgn(}|K4&teRNTFc)2Z_HDdXh|Wg6IbsqQPb z&>mPOOXa& zbslx@wnK}6*acWy9n6`w%PGY{N_`3ZFENx_s>(AtXP0zQRQ=$YNeE3 z$PCB+u@h>k7#39dTz@{Dw=$Vv%hI{XR|el~y*;n8BzRRQCVrmeDs!jOs)d7R;+VH4 z-HLu$X*An85|%zD(Kv1T1Mk|n2*M6;bl&T55;gZzV{PtqAmuQo|H8H!d@%S&O2nzU znRopyXPCj(a6gELw~Tmr=b{~^5D-paUDFH9-4PGtDe4?*KxjKckcv510la9J9>hWKPWT6yPS_vG~}kD74C?KMs<`J9OIP*A_BYe~Go z4*3gij#L=Ox3$GRAKIZoCzR@TZmkX$K@}dsr-=9IcHeC2_TKPeWU^dAvdiddoNG+D znOuKyRE$^7kN>W|ou6^}st9p4civZKyXXs@fZ^T%>>QnVkHZ0V@-U!V?z^Pj-Fb^I z`J>gUNImgL_(FCUqDqe67QrU`R=8%MUnbmPKp_Xde%QmERXel=@;K4bu{2fjM6S|> zx`4U^tSE$_Oa@C21z$d z$BI0@kZ~G3xj;n~UH8(Y(bBEd+fA1s60jO$f~}N;Fe(*eM}#7NSv#ooHwFX@m~&iLmtAAm=o8oa&C zqnCeGM6py+Ch)Xke&&qlP-R_px)J_@FORXEDe{?8CznRI^_WEz>0N9Z)ugqYysFNk z#(IZPQGxa3X5qsYDXe5ZqMxEtB-}p4DJ*mxyly}wvt?j1gZteAJySn1Q8tDiDI$Mv z{+_3}Am-l&=6$we6xv0aF(%k1>l?%Mib8ghlk>1k5>04yaahN#~`%f-Zl0g+{F= zg#lg~uSOtsA)+aQcW;s1!t|us9BQt1LWF53j{OI)h_UG9nJk#In6*q-+V0&wn=SQe zLO$N7n8C{}>oK7oW*2xbWp|%F3swo^G9M=eyxu|180;S$9^#kcL1qm2C2~*rWhC!{ z4!p~&!#Vi1l4t4>&sOO$i$0bG*@hTyr3;tI*j4;=%aa<=!#m!me=_=hBHPaTp|?>h zGRNM6-a-YlWIhD&m3~pHt}laYp_#o(h(hc7cP&pGQcqFl!1^lWv?90KsGQvhp$;`Ch zpIoeLd%1Y0;89P};mB1^%GX8l(T{L9EHlbFNE4dP!#>yll?;N1DWM$n{_*1nyQ4(u zRU&Kp&X5HiJ2U2YovoI5gi?`}+PqbYTSOz^&QBAam`?)EJw&=Z|JyHe60{g#OQFm8 zi|;Xtkw|ec5sE)OUUoQ^&l`$L`Jb`C&Lw)9 znbCyl1O%ohoilMl4k*Qy21TiqvbOiItHb@)0!9(lR; zJXN;WA=yPsOCk)EEx9HoX4*=>ME%2IiBz9J$Xsd}!Ju^sD~&`<^p?Z$>BaDFjvt#5 zaFfJiV=*c;j?T!`Jp|uJ+YG6}6%nmYC#gs#MYKB9%IS&UE2kDDreK1-vF#-JTphvL zH%tP5BM~D|h5l(%xR|5y!g3?Xt0sU`tcSp6me)JBXkJVFJdu_;-zDbO`9Oo*B&%Wt zE2Y!h>Jp_m0r2q5hVWr19?rI>?J1PkGRa0*Gl1!GDf^Rtvbxgm*{f5nOKH@9VD?8z z%!>!Mq5S{ty<2Y^NtQ19R|36(fs8HMyi2MuLMDJk9rfQ-yGm8qk~XbHmGnADgg>2EK(7gePLT#+S%WPL;iB(H*ep_7vS-Wy3CRPeK+8sHud0bb1oAcQkrJ8oBJU;k zTg34;*b%tYC1gfArQFKwS4D^6y?viZ(pL&aYXW#`JMdyAQ(YN52ut9(bGD1HPu7GL zZ0rX7oV=iLGiOt|E!AlTZ?RSIGV z27zqV%cmFrJ=q^g8#-l>D5W#yu7CIOk^pm3J68OJY5d~uvKSVz23SfVObhWeasRO1 zx-b_v2u%Sj1aaa(7&mO`%AV=Z-mj&b^lO>XDy>8hix4lNM<=2BLv)aoy@t~rBU8CU z$emlR=T`j4bzyNYq_i{XoR)d7-iW2m=oi5^sXy1sWnN>9rwyX5u%r4I{012S7aEfY zI{J^AS8+fNDcZ04fw~;}jE30p0>Qcm=oS)bE8>kJ+w%%AemRzMjxubYGG$~$ER`_H z_hik9yH+))8jAvv*}`y9*)y#;nEI~=JPZ*O9k25~icAH9H{bp$PQ19Qb6TqS5-A?d6Aq%MU+J z!736|YZZc=mWVAbV3ml7pb;8L_MXzkw-JjC&O|R#QLFf4iPaJ>d78VcG91(mi;i;i zOUD_3u4*KK5J(DMJx<&mi%t?k)Tis4?%)cjue(gb_tLev%8}jRGDM`4J9t(B*%BN@ z$)U_`CeMy{>lSJRUxP2%nFxnBrHLekA zAA;x^Hb*bZJmMmL6o>fl!Yvk4 zY0NaX6{QApL*nc%G@Mg0L6!2ApqHpva1wU$ABIhogG`&FV~UZmuq2|7$^cPtee>fe zTWo$pNgcOM*CAqje`Dn3^g~YA2V1(Na26By$21*aKF2ie;9l4V`L3a{`kNPLX#}V< zUof!U15gOO$TdZF#1{VND2&yPxUa7v;y}qgCOu5YGLwQ7x3@oDEX?po;UXj=0;eaE z3T2^Mf}JIV2|P!g#vsCn7(%w;cTlUIwg7Ut3Suq5;KX#3bU*AE?>0)h8&CWH?zUTN zn}irQf@GiI5h5&r|9~K61>z)K9vz{&(-l%%Dxq9-9C4NE z%x^q}yCHQ|37a;HR6mDe7$;)LHiZj7#-#@>jr2y{b=lgv9-r~1E^ZB4+_s*d&Es|8 z4LnV+5lGY^pC?#f95;{@;SV7eR94rvszl+%Whp)m*%L{Lod_&!tLl4Ri0K9)lKwHI zEY3%i#1DS+*;u8Hyy>2;5z<7==U6bo!HSleOq$D;Q$E&YigYENam)8mn;i3CJGrH9 zNay_R_FQex)SZOpKeD|oTGb``D*Ohnod7gslyKHe5s>`M7HwI3Jnr8!=bZwUj6M1y z`PG^Y52nICN?y_szl-i(S@j8WHkyIu(d9zcU9iB5eBhMAGw-*4ymzInYj8C!Wv!ZRtTGK@*BPu**ACg23sG6 zUV$5P8pFl7KuDK`A)6(=D>nthBeGAHK-FABx=S0vo)CEb?@{_xkgcP!&s;>G+)sG# zat67qFn!_2AKxC%C93W6*YNiJQwaDf%AG_Uz3Dl6Y zt#?nmDbI#VvXpAvWHy&*rpss|JkXL@UEk7`f~o_{}%F6wyy{PU5DZ3zo~5#BE>RJJq~TOy!9V+>*@GvP2g4<{L? zEweyZSiN_5dClJ)AsHk z;H66)ST?gNy-KV(!>Hw?d&}SJ+jFD4@q$~4Dui=&JOvS`$2dP z2Vj8MqK_E3^X;=l(Z}=6%YrNWKwylUw;G@q*jglSZVJq)GVgA z(6q16_4T#fStG23-l!5XH>=lBY4-tbkR)DwsghogBW^P7d(wK&JpqHJ5-0OkR5EX6 zfa_YxZGv+GKjUK-BiaSpx2OG_+cS#SBY-1tJuA5_NqJZ&2oP@1VC0O3@-T^{S1gh{ zJA0vhvv!_yvjXZktGPWA_8IS0<_85`HnsZRvu=i1Q)MXElxJHOsgS!_DrBoRug4fL z91J~V3@6}o7RdPo1u8WMI40@hm>3mA^pbNqrcMoW;px)6q5F~4Of&XMpMispTv4-T z@uZUq#z1Url@%j}dbYq^1H;tjoLsU`k2$Eq@62a0 zOffnd(gc|ntLP(N_MFEKdQvY(H?{Vjl&xwpM_CY9&{v+GRD;U5uE{MVGQl3OlwU>7H0AMV#j|(HiYI1z7v_?{c?eqeZXH(kSRU5$j-gn(%68 z!h#y3F1}9$N3cX!F7%!+cw>}JdBFoqyL#MeEMZg7u&h;Ac}o_XmI8`dePdyJYZ(`f z-&KAb?OXb+PJ+2}_IR6gk=$=(%Ke?G-2ZvEwbwVQy(XnHmi+laq8UrxZi*~&DP*#>#cf;33r!6cyjOpZ-=68P{5GNKfC(mi1c)b(iTR?jPoeRWC!d$L_VWTt z213OJ2AJ`R;}?a$Q}-TAq_J&oZc$yWRk!apu)%L|IqKVi#H4_1A* zQ>pdMm(^JxnC^Wm$Q_VUJNIpR1JnP=UGtS#Sp`>CftAfVvz}(CwdWlJ>CdvlmCbax zl35j_k^&B>#EmM1%~DYQ+rbayWIAL5nql987%R})dtAk9YPyg3RdMyL2+t++nFDGv zgAr`dGU2n;5h(yJ*%b4)P(m3YB$9(5i86gUwH4g9SkmzfOOx@Tm_sk1R1!o11kc7# z(M4$q3~uJ95xf+@PW+@EbGZ}9K3E9-$i96Z!?y&SvS`1DJ+T~YER!@lfX5a@x;5E& z(Tc~#%2;`Bu((B5?1@ZUfmg0t`OO?@UDUVP}HEsIBz2R zdI~`j=1isj-7#;;57X#;8s{Y4$40qWJeN*XcjXzBX5Frq9sTzo%sj@~AX}Xmv#U!T z?wO7~MF5iNU)xb&ak6#F2Gp3$Eo|%b#eIuQL8EU2zhe@{M08z7@HQL1abqL^U<^k{ zJtr)# z#v;p%;VI`?;86(ty8O+NgcIIQbtae|as>}b4rZb~U%>ekum6klY z!$7w5rLe^kPLMC#BxXOM<|~-%nYQb){UDREJnWR7`Z*CuS4x1v5pir)N-b13(oh8L zMcXry5ij4AXh_}8qRvpvGKCZxNIY`U?*|SLwrvp&$L4=1D%RqAlOUS7U~K$XkPCi< zW{QuIKgtw5W%w*aaV~yE1WdiW{jg$u*o7L^y$s7)`?AUCE`>U8awEJDNkLl2Sd- zk*&7LrRUi{2*@&wECRJ~YCan>HxLyy`yb8%()Z!}2VnXC>6Cnk!cmkfpt`_WwUe2Q zyOU1Js_*oxjh!~@wd=e6om#VDwoTJ8b{cyPqg89~v|3fR(`y!f_2FfOeGOH9*3q}m zQp91-E*#`%Oj@}8k67cIk>nCC4i!b!K@D+93^t<_58}C^L{hFl)($xl1<4MnZIfWqf4Ni3!I5FlR{yAxdiKnWE`c&kaTI*^5#A5s zDS!L}jY1E3^Ll#Z;qy~qVtBKU8+zfvXF_wcsrsw>hxo$-&yE~dy@Q|6yy1Fp_QBFg z{`x8Pmy|NqdNrm|dhW+QH}T~F{)H#X`PEvx@u4X8{Z}({2<4>wWOA~wC|*M7M=beO z{3S#F_uPNz45!8A^$%A@{JzclkI|W??MdL3arTYj_KN zZoo}|3Uo`bz>}n&P3G8lxnU=HdYaVgP+?l$Ry0a^pzGD16{6~7_wT8!&mehAcrgvi< zuj0W|Gk8q6ua$V`^%Y_!9@ccCL%_+_Ywq%pk=LBr=1ko4#Si4L+u0_sUmw2NCTD;8 zsqAZfz+F4PaD)#SFrU1JQ9PgDNC1pE3S4v-xeZFS>{-w6+#+ZF!1Jp+IuJX2WXgXI z@@}-I0OWfw{DDjpaj@HDMBOlQQdrF~tiFpGCL-Y@?#v2*i|w{k+22PZk_ykm>0$1~ z^g-(P@Y=+lG6C#$12ZPW$W6+tN3s(}NQVx0Wy8G?k)~xDoJePJ=necnH-7L=CIrK7 z3dGi@L5O*pl{n+25O}ByH3~V5M|rNzp4n$ixoVLICZq43U6@_vK9FAZT?BXccH=4P zdH>b*(u24L!>qDLB@zeRDOTHg^qjf^-rRW=V||xwdLX$MqmM6hQis^{{TWTZ`zN^2 zviphoJaX%Cc5&`8cdbl?6gd#qxs_#}}EGgc+; ziygW1je9iEOmjly#p{EeR%7qU1bfWQ9AX1Ug7p*G9fFt1>~LV=fAy+r^px&NB9u;G z4$V8d`%seR<7G*g85cs59C)M2{v>2s8JGI@7tV@0Ho8gl5W>upNQ8g@7YhY$A=D9i zDF_BtOv&T4bE%(V0~*nchA2Y_%QP2>kmVndjM(~$Ub|6=?_KOn#eGwD!*WS%Im$-v zN$JQ;m4N956D$ZQ*?JCD*Xm>qc2eMhe}PSY`^5?vmh0IFpvJLmB=o%zmu*K?MV?%9 z+4Rx1Iuz*2Ke)W89A4}nFM-YruYh6_!Z9CwuX<xFxg!)=HMYIqMv31i3Cj97^&0XpoYJBLDTJ`0Eq?G>@JtMOkw$4U582Y@w6Le)-90$SoCPXLkt*T zpLsA5L{0)2TA~YAg3y#WaC&rtakbc=@sb=O6oiDxGr7Rx5I|M%gn$0!uM(n%Bbbea zuxlZ9PZm}PVz?oq#%gNP_)h^TT#42zk)9I$LhQv9(90zB;NL_3@^VI(+5xRUf2#f>&e+q8EG5=P>Qxeqn2~fS-0;a$ruK83!%_}T(cB#< zSsgj_X+PYs$dg#4RI)^~v-RjxhzOGIfP_Ov)Jlo#xyHjC6gJ$FkrP)AZqXbSzj%E> zcAJ?QkQ>&>)K-^K$Gy>3SAsK^0NSzP3>oPtFJ}}4xE2q-Y|7t>o|T94NO-czYH~O!}ZG{JY2HhGu`nY z8F*X>hOn1H>!&QJsED^CdT`|rayK4lkf?|N<90Gb{8x?5}5eCb4)(d+^;Yc;6838^rKThU6v{a&)l&LXFA& z+h5_m=^&BHMhWIM*$aG-ieHO$-f-98 zz6jqtETC5~We4%oWu2P<*ukD_5$RIV$z^@guDe5HS#A2xio;j1F#)#b&8uhy5Z@Sg$-izOJc<`xjO zcmn#`BVZM693c~tB^iU02>Xj-YSXYESluE@=teGrRSu~;5K+WwMKp#eu~v3lJ{10( z#`G+5`{joD=~{L1TZ&y7&N>Iv+SUMmm#(80jpS{3i~8`CUbIb)Tm$jGDwjj%Rg$pv1LSBqcPJk3Q+!cV0h;kS*D+x~$lLuDnyXJl2zY?*Q zq}2>bfEE*^(}j!T4XoKUDH$*y0TpZ}BA(nf1v93J?=YLM0yTt{ zeg_B+*0?QrgN59J|0fe_!^bxUCG93bO2l{&Kun;`5c_rjJMBk^c}eIEsnvI9zK4A& zd}hJ71Y9P(3=n04v|rX=?umqfXc9SgLMFPei;e>75L2Qs z!?`k}ub*Lgw_m<}zWw6fegPJ-LUCfSt%%D^AQQrF6MTFAU@gLMn2~KtuuOyTEDp!x z)90`twil!_+&%cPO(4(UYnaVJdyy>|TP9rmeA(S5KOg;!uTL*NPE$WZK7!{e8JMuu zV_+usGP{uM?WGcLWCeL8K-pZe*ramp)6ob{a3T3Os$RV-Zi1~7HX$F?aElU=vqpb% zB2KDdjz!e+NgyXQM&@xT-c-nOw(JFi5AZmp|r0#iOS}>-LLM+lKH3iTW&F3fy#)^{0In zUfm&Z>aK*L1r)Xvz9ySJtFGjdu>jOov*ykX#izZ1Z@Z$S1HTdQRAL=C)>ICdY~+dc zNIe)%F>DtcPfOjwc4Wyz7bs*XIN|UzMsxAvl)mB*#O;5^M9_`Qwx_vw$87xR^*m_` zK_QDKf*U|78&A8Dg=}a7N4hM&2vE85IcV`FuWO39-N-eXZpB7PR%6A2Q~R57?Gd+@==gx^Ev;CF=oGowb8%7L|t`F6{8LY{nl zc50PNnlGC_N?bvG^6`Ab93^Ltg1pQpiN68W2`5UNKhh&f6zl@(EvnA`ZoP=m@|89n zupa2BQ;mEZz7A?igvtZ4rbaPg?wDd-hpA5*f51B%md@fJKobw9|O`jV`_3b&gy>uIkmQe^o3m=AgN@BJ^ zdmA!0L?kU{!oCWpH#R-40L#39ud=jb0{KShtSO(>)Pb+&fPSpsGx9YLhXf32&*0)C zlZI4Gr*nAUguqGDPo|EHOEMs-C00?mlN>PtqP-s^m<$6=5m@@E2AyznHX+ zZ^N%#8uEVZCQ1J|MaJY2=-W+yXFlZMs`uky2@=18UlJ{j;R_RNC5DAq!nv@>wNMC| z5P?_BMRCAC|MFLbXq>X#ZJM%~rG+$v_frv*sh1byI^){QIy}f!Pf|uwh|T((1+{bE zb-&;5$tc1@m-e@o$_CjOMo-z%ZeRMLA^bIRLz)B@SIoz<)TCh?9ysqvCmNHsRi>&AY$WcM~3l zn#F%+!N8``0uc{*b>C<8tVlvF1tNwWyedftufjTIi6r#bGs7%ceb%5F+GCkaG{|a- zq;|}=9?Sf8a!GsCML%(RhBNcimpn7uEDIwP5{1ikFbVPD#%QxUnTiSh+^g5yd%fNM zZmZR9_V@Po40EsFG-`dL$69Qs)!MB!`wgRr;E=39m`2}(lT7)Q#d?>x|DA82MXy1V zTAYNmXM31rZt^Q0Qd{M(`4aL?1aZ=FJu8*LY$j{MO&3m~Qs(we97pfDlRdmXmEOZ$z*S=p)k{twl-Fn2(HUk$g75GOc$2qS-3h7nnPV z&Lt!lw7vb61d%H#+nXlsW4Fd_a&q_@-xpmPMSdpc-H}Ajq{C$@>=@<>_$`^_^_Hmk z2$@Sv?C?o%WCAu!enMsK$0BBR(@YvO=7fdJpTah#55LS;Uhtb#-3aCzgP^|4zl)2T z4&~Pq(UE+A8>VeyKDr3PB`LW{5ef$LaC+0~i1}=C5rl-FV3MRE!n`gDwLoOA-vMn* z=5%j6#_u7XSKHfN7`J=!`>(E7Ezb95womJ`o64D9*%gfPEn!9}xWRelv{d$6_f4l! zY1K;6+NN36-1JB^FsWDXEN(UYD_RZa67X4h*i3VvTlUG>tybM**{nb-4V!HQ+FCPOqdal^jX+ytK0^)dRcTmlBh=QL**1)}VYKI9w3DOKaN6ef zTvtBZKSe%!ey`|4Hq)G}E!Xw~3Ai&7!HmG6ws_IUG$$I6v%@*o94x50cZ6IT@mxmwk!xTkr{X>~X8z=Q$oxBX)f*06j%iWfIOdkdXwRS8oi&>z z>1G>KZtiB1r81kcK}Ac%-oj0@Vet)%uPuu=$|J(RKbw8S-9-!VS~*yIM}NU?qqdVJ zxU)&~n8f^lq0Z=EAMyPhXrIlhW(Y7ONV~STxyioQvwm=KK(=N8*rS`swIgd06nGKF z*b>(Ky)@Q2J1mKUQUL5itx>O*SZIAeELI9+k7iACnY3cDJ6h29%VPM?y``hI`O?wZ zqQdsHsBlDm&!&}tT9|lV5!YqqchrnNrl{~-j7_?70G>c$zwG4~5+18kHX?~4ijPt~ zQUq}R!t%LAnC1Hsnb0xCb}IObba5HNjH)3l_^v}mBcLG*=tvOa#`A6L%iu-?b`5dO zWp|7o*8YsgEW{e30H$Lj>Uz4oOoAR#P<`&N0NYdqJ>mUV*Q-_$1S)Z<6!lV80Ucur zARKs<77hy$Vf6XCm}g!pZwv-CcNG{ocnd zo0KI+ObH6YNqNc{)9l+8h<$stGW)wm@{GL~d|dw@wH;*RUB$;fe7O6FV=6mnc=qL=dogldOe3NvI z;R0m;5}iH63*<#oyW?Eiu<|`d^*(6+^$PmMD`hI7t!Ym0OE*iYHL`-E+4R!f|LyzC zZr~xRU?Qy`z!-X7iS)vNX0y;h@2+x2GKtk=v&uSd;(yH=~#oBbY*;a?w&$2|ta zHSVB#8B^u!-=|~|ed!P3)mShgSe3G%As`h@zggU=e(`dv)8z_4&WhTOO1vG<5POt> zrgv7HBk=e=#LvE?4q0W5lVxJSEn!|Ik3_v$#y&38!3xL-ZSA% zy-l{`Cfjk7?O62GHrbBLWQx{10^~|o=_1#pORnutHSk1DyPIb3tHdwpC z_S*H`y+)B~R)+{j^zAcu$QiS!%Wo7ofK0VI`eYym5Q7i#1rHpNX?67T;!LaiXQ;2Q zcAIoWgVw|ge===|8}Q$8fHQe|rk(ch>7`vy!CqMGQ{~%drYK%SsT8Dl@WHt7G$B)g1TB4W{@Z+Emic8DANsg!+4r#<%*aaGl>P3M~I0FBM%j49uCPxw^KPk zIq3ek8X4DK76308&vDrs^oCAAzbzHdJSNRccR5v}@XYG<1KvYr{f7rF8aHy}3vQ3? zL@ibnfe+uB@td`3E3vGSUp>q(*(eSs`j2m)1yn6LPCFiNf4$>qSzlQSSDZx-iEiQ0*wLIJI7u?uuFZAsu@4vcUHQ(;B??t0h*;OFU!zd#;f7u54 zIX1J}CIK@>@WS8Z4(F#^tF7qPYH#S4pKgs^#c%LpL$~~NYt?I#Zt!A5x4ct3sni<{ zLAMZISR16Vsn8@lDETUx$t=$3bCB0-^f7j|evuMB$CTdmq17_SY*?ty0da0teHb;Dwh zA{ZuwZ3y-Vg28QBu6((&6RcfpK7SM2RVLVOZEtfVb55<_H-~H^^dCvEjnIE2!8Stw zkp$Za{YMgP1%*ETbAQq0Jbr!pv)!y*nMSJU?&qCWwXs`m8@qcAx@*?<8oN97n$f7$ zn!OgS*Jy9AU)yQN&wDU;<}pQ=XDpysi%jT9w3JretYIV=bDIpfZ*t<KDW z4iKhYiF(0+VyU4_+l<6lSja6Figk!oA?EWJDtQY=gLnV=m%n1_aa@i_xD6kPV%d@J zg`VZvqKMFBWb5`f-^FYrmt3B9Uv;~uF9?iI`m@I~zQg1>h1N^C?M?%a^^KCiB@3oo{*}4;Vd=D08 z=q>LqC?z)K0|kOhn9<4Cf56U#Ds!>C3P)y1c7XvTDxSR{M9cOhj; zghi5}aXxi6@xbLgevRGdw~;o-Z*%-M$FEc%mYd_ZIey>I@jHRzSF1n2zkVU3)e3~R z+s!I)*>KzQaa&oeoDH|FJGbqhc215OWXoa`X8w6dgCTJ|lRZBK%R+q1w&nt8xmeF- zq^~-=Zj(L@Lc+$(pIi@_&o(@{be`-Sbt?xT1xvw$jRIPbG@E;OaD-Mz)h)2XxUrjs zQLs6G&v*WgOLP7-gJ8_E+a2to4ZA)2I?p|OQfpLO72vyau$*SVk;@??=|y5d7NhVL zIva&IK=In}*OF^_H8I>eEA z*zJ(5BU2QkZj&Rk+1xFMN4v43U!&NqX11hSHnWttjNxa+Dbvd3Z4y^~mxNz-_412c z@rGNTBvuXtvncpAg(fDzu}Z=#njHnI8(h28-QY^hFW6JyqKl0My5;a|HVZIkcdNB5 z2;~iXWU@!M=(ZCZF8Q5Kk7aX-xN@jF5lu@1ep8anjHc$qpq0359@D5~fjg_2*|@V+ zO*L+es2fI3CGcEP+E@AZnfK94;jl^&f?*H8dlUfsV;o&4a&XdBgOhK6iw7s&^xzAq zQHTdDo={AUbO|S@V}Ck$F^j%FGq2wtZfI)GcR*IJ)T>WV0MXq=xLH6KVMH~0@&cFI zZKA0;_^YV#bm;iUP-8|opp$dH`zRddh~Rg&NiQO)ug6_d{KQ^^6u-Ilg=40`>?)}y5KXYu0IXms$PYZGD3fT;6o~4Go=kpNj`lp}*u1&vv zb|{(L{^o|v(cLAasoAXrcRTBQpGa`~#TVh8Opj!lrN3q$%E8e0P*fyzd7eNR_OC;% zjLGd6OW;IIzW&1yNEZ?{LZC&sAfkg18&$gwvqC0B^+_5YBZSY1=ZDmhGR~w@?8BvS z`y~i{bqknmY_m|t+)zCe7#*V_buq4HviL&qY%>DchfkRTa`Zq<=5JZls?Mp<>Cb9e z>UBG%UNfs=Rzf-s_ylK|SBb7Y##d;O!ym|HGDhYCXYGJgSbG3h@3+sDdJ$^=v3T}# z>F_@){UGUpgepV|^hFsKrn*SCI^CbTFG%ZUH9k7GU&xT&eEo+n_{O)GyNw@XUmc2| zCJ6t6Kr#xXWP%+XMOQ48u;O#(3Q!i4-|(0t$4vIM!>-cewt`n*KeL!ql^6y#g?YUs z`;i;D#APP@L<|mR3FhL!gi%}i&1VFsO)NSJ5LE>k-IJZU1fGpJE7T5|@6wR>GUjOj3CYryF-s5J#QLLQIJ1aZhm)W7{zoKJNUOm0~e zm;m!H-1yXh!VQxOVE`qu1*%aV#(q>+&t^^ zFz(}#7E1a=$U(;tgqgxHrM?f(FyIN8Tk|XImIQ2iC~u`ir1>$;2G;FwmXOM>K)OPG zf|8fl%(g3*>s`Ck&$bi2VM^0M(oruE%qVzfNG(gs-vHQlgfa=|o4{)!vjXKnK*l0e zP`4-Ph{ma$1*?oau=0qqpSbE!3tX#2zfC6;&hn7Kg%q&3fh|5OU`7O5{p4l%2~1%x zm?%b%zI_hC5VTikv%dZvWw*g&%~7GFO;OfhVcTjS@L-DN4?&E9N(jeU?lNMNB|kt7 zGP$W^8Da@UF*n`#@;~4{v+$%u0tJo-;--sb$OLy6Z)P9Q2)qGIF@eLu=ca3UZsVisotfN#xA$fz706~e(VM(vozUVanZ?T8Ty-xfou z>nk+^EW)!rbL$Vdp0Iwhi z6cEq#98f7>Lwev*RHM+(m{Qp!Nm1ic z_f_hoNf{(__JQK4jB$8hHB7#HVn8*VZM&UnhhB_!t)G-%|86pBD*=K81kHfrp++|W z99N)&MJFz`@C#DinyRZIlg5VB!jf}7btD9fi9$}i(FABF@sDM5a><~Q#>k>6M-_++ z#7L$Ir%qLt5Pd&fdXatf;^35$;qfPEX%(Z}>EDdo|GaT|$n5yIg8T(D6dmETC-mNV zO5c9LEi)rGZJ7$IHUJq9EG@ZIu{v&5@<=fNZnN|`20X0<3S%?gO%{gYYMgp01thfx zHTi`aWei$E7Hlilv0Pm$r^|GSiwE8ow~TVQC0Ci!{o&e|W`XBMfv`d1*+?lf^&88e{bCgeW}IkB-#!b) z0q3Y$N7&J?BQT7~hiG28vG78LCw94;l%)7p8En*@^%tguw57E4*|3Kujz!WQ8dNqCB~HQJa|!(~MQSjDUx&$Df;iIz z9*ygea#Q(Q`I_ty@^R_{B0~B&^AEIK139K zk?Vi{<-Z>BZS;4g7q09ukdJ*3Vh)e}OmNa|HbE~H-hD_B6U}co_2z^-puYoOTB;9% z8$ZUKe~b)qsMvS%9QiIj=26T2zY8LyNCBALQ<=PFJt8((2F6aLEH_Xk7WOXYB}AZL zx(TQ9l$5rxgNQ>D11+&=;t0*6m z;Jdoxg~l48W7fj=R0|XgWLUSq0gt0I9aIV-tWBl)iv}bw(c@0xSOrtn#z*(EbU1=B z;yFF4-U}!V@yb+hy$~%&m^~2o91|9uG&w{|m6U`+lUNORL}BN^z8MUH?UZdYq!^T$ z2p2Rg3(h=D7e{?T(gaQ8v{#(lPmb(g3()JJw7bCJbpYk?mPEQkawk#<&@vxraRH zg`NWjx0U#sOrflYsOpHL5@*(8`E@jlaWK19n5<1>6)je_C|ac>AcR`{^w`Ka?9@-7 zh$IvMwnA6MokJ*chg@4Zr{?m~;L!dmx*?5Ko*IU)MBGyTX<;NLvATs$Dzkj%_)1BY zsZJY+0P^T}DwU;=z3l3Xy=czbmZtLM&}TFxXQ=RVcR&t?_-A*>SePT4QU%vfYRcDGJw~Oh#H{r0{1xa*}q3DuKK$kxQb^x0AFkzr)Qp67-v@pWp6^Kj%8;_l zcmPwxY%uXL8Yrne5-`)j&ci7OsK(rE6Hw5@zR>M&(D{zKGryfy)C?hK z_vPSgLe391dYZ7>VLUM{Z=8>&nzNBSISJDnuL)J({@afy9njV=!Pocl(NuGtvqSk! zWYHoB`s#YQs1xr%?FvXYf@K7tGUTGJ=DO*tK#jg840~jA(xueQM@-EI@#QdbP3CvK zRT8QT38UE#w5(vrLmmvXYJZo_Ivv;a*)JY(5=stHk288?rGLI4Zx#KBf7@z^-P)XKeOh=r!Tmcg$zbgzS6nV0aA#Js5iV z9K5@lO`j_<5d(%_A<8Z!jBd-tr+iQehMqeqv7Uax4TJioN4nhSgD4*hX|`p2ZUkcV zb(DUWoV`YgrXO; zFMN_dV>z#7-Mx>*1jP7HN7XFJ6{6X2ajvL4s2E<4+7IV0KBK%_xOUA(h5@I{=FHzK zb1Q)phS@bAUy_eBr>kI3v*BP}U&GKVbZ#=0T2B-yb%)G%avBMHnvI0300*!1ug!oN zPbTYQD*RqO;=6gUkM}ey_*fqvf|5U4mw3@zci@o=8s+s%?`bv+IE-KM#rW%}@E&sC zA|F|pH;r>ovo&G**JAKB;np(`Bog^I?z#Ew`#sIpgM;H&=!kQFT?D{64Sh@#IlP|a zQcqBWZ`pcqyR=7&6tGLs6Iw#k|;jgUJ-#FSX_ zQnRLbaY`-pi(9C`M-l-In$4z_Ou zT6-?UrP(AF}VWFffKL<7U37O{=EaNa*?4NoyVTyQ47$?HRiTgT|jL3A9zyY-(VgpBjHn z__h-QQJJs1d3vj+JN6LL;LbG5bw^42L;1DxaA#e2eTGr3_HNdMF%Lb&U;Fonk&Cy- zZ;mc6KjfpSW&_0MgCSUQp1F<^^@&9ws&Jih18-h zTM8XhpM^v6hD}(`3ske2F@(c5W`5|cQiZ@m!srfOj7Hqf1WH@hN}IZM{AkQAO8t<# zrH<8rHAL-vr=+P_ZI?r@qX0UjE@$@nkmk)6YiicuJE2X3Hz0*T2(6F^%9_nJ2oCa^ z`WQ#ZM^nw}J5Hc4$6phYc3{e&tW!{$uh=+WaHgqQVFz7Z4ZkKtJ*SaP&Wr=<=5vNL zH7okqt}9?8x}K_CHz$g2tEt(d=+dhzYMy(MzxuYN?!JzGFB^Sj*++7pxy;F6lyzs=jd4Hn-Mlp%E!{QQ zyK?Xq;@E{`(QLPvfib+M{>@&Qi>wYNJ?2+BqfwU``Itwu36h?`sxy#gOX8CE8a~gA z|CLG*?eoxOLGTgu%6zP(*+%He@vmY072>2!5kei#+@6=KFyoPK`cN$ZmMqfwWZr^93q458+B4bDx>!Bp+dQH{^i-;xtxO=q;p?X3OP_ zS}yG#eOU7OT)0%-<=@n|ZkX@YtMx2HZP{n%lv5|yanaoY90xx1de~hQj?J1#qSrnJ zq8&1q=kpBcZux!1Odc3vA$>)ct$2M1LyvSLJEw<0ci(Rhh7WM`6=KzebkW`RoBFm* zuiLx3trCkliLOB2c|+=wH=gaV{*~wF3&-ki|4oN5K3^ALfD6j%PkT(yYRZ@x}0KaySJjH@RSg z0nh7P)7{e>?+4FUGguR{cB2Ued$a5FF;=DIEd0~mF+32nXjNNTcoe0UeA%X=Z;^8^ zw|`xCqjAg*^4x2-E~yzE{|Z!}Q|jc!MAF@9oZ4dSH6iEm?f-`@c=mn9$2=cOq3%ZI z1Fz?YgB7CZLZWCkNBXu`>DgISDV3BvjyPCP5$HRIxBt6uV}WBnUeaun4B~lI)}^H3 z(u?|VFgqNMX-=AIwn{=Vg9;ThSQDzAFpjuDo@d%DU#*DlR^kCOBJ7D}vUN!k?{e48 ztK{f5c)WgiO?@V(u&Qe0LP}{iW4P^&f$K_aJgdHv`wTH_a;kWmEt1P2JEV~t+ALTX zJ@1_t^|(vk(O!?{YwX?D-Prp|OkqvvIf+O=y5gRd%VuutZUe5yo)pq^XW7am`^1bZ zFUaMCZR_qe9uK}IeA=gxh_e*U2eK;LN0iZaX%+TbtBvQ zSAo)Z)`Y0XwC8h%HDUh0NBQ*ew(j2N$Gu6by^hlK&}Y{o#n-;cM_A2Haadm*X4}7wrQ9bY`?9$5xMV;T(6KW#LE^z z=R5Or%^9`BTwcMp?l$BOwHt*5?4D83 z>24%`MsL`M{^ih%2E%aK*w&d=0m4(zfV`%5&cmqLDxj{(`!M)AO1pPh@SBUMnhk?1 z82A%&8NXQ$u4W+~w}o%2tmpB$95^fcswEE%R0Rj=JQ~GptYfm`FRat!v`oD=vR@xAh+L z5qAR$=d0Pss&-%6dNnKCBcD&G8w?{Wa;V?f+sV7;W$QxkX-K-%!X`uc0wvn}Xsf|j z=m2HSW}m@@;=r}`=JtO@Jv%4NL|bRib8R%n$QX zQ8(c1n44ZSu#3U8T($`94jJ|^3(g~dl#@-hx9T1WjMZQyrm#Znx{x@!(~%73N4D)% zjENETc$T@k>=XKiA+!oP@+Y6jIl{%WfE<7lWDN6VbLeidJ!CMG(YinizV(^Q2x7z7 zIZYGYy|p>cpkA*PQtz~EIrz?V>5%+VIm<^{&9=?uapjU3L%vGVFKaf3Lr}-B$UYtV zUcUC6ZQaeddvfeGA?Q2S$L1SX<9x6oZQaejuUOxa!>|o~(yr5k%NdclO>%j3cGkJb$5fi_lS>Ex?_$+CN_WvVs8PN*$t<>6wm9l~L(-+8 zm(N+Cz3;a-3~=xjXB^$VzI`_Ed)%DNJD)&tQefx{x-S75#UVJM7qV*v&EZ4NkkIOjFj~FZ(BI zoBWuE)!f}Ymo1q1HN{@Sc~6jLZJP%}?|N;z82`jw&m3SQDb2 zurYVZ3D4K)sja)$wiq5qUmEa?Ndq>(i+5oO_{9 zj&1(!|93gN=0-jw2i=XPM+2MRs0pm9G|HOVB{f+T+>no$41_Ia^HEu|eGtl7T*s4G z6CQp~1MU-QQSzSVELqpxqZ*rYu9i?(NEO|1LM#lyB&PUpR%Xw#8R(RP!TyHkZJg59 z-FOoFi*4=CR9St1rvMyW#nb1kgK9wCma!Hqu zsY!#ps-9-$KV)=FT^_6w3uVpbmnew(aD8h7@sZ$NA`~ z9fpW|_PRI%u;4U*Kcu$qzR@9fMq>2cED()VBIq&2B%2GGt6g+kce`jYIt-qPNwTu~ zqT}Ukf!o&IV%lU5M@QhAFzFd4l48qJgaOS(Pt9hHoPZdAO-Op|Q>Pc%{aobK-S!&B z1{3Cnu1jq9o#$iT=Q+3Xv8V2i*9I&jf?Fw|KI_p!@`IKwOW#q<^0@GFXI|-UeSL)! zsBm}81MaPhxwy|js^)cO=x&rQ*BZ2V^3-;1v#2E zn~y^t3h<6o+RJ(DHCs>DI0MA)uwe%4C|El-`$UfE#Lb!KrMoFNh4I&fTVEqaJQ<4) zv&_vI57XVgyN{EAIoM(fD@56a#L;XQU9rd?WKv~mE7feVfPU|tF*|qLjHQbq1uB0M z`C+~UCEdNQ>7-)O$qF5qtl3<84!MMvp6BN)J=Wdm8YU2rza}L0Y?C-Sqtv>)T$^mn ze7a8V91punxwl_@KFI0I)!ii9!CCm>TBSzo?uZ?PoM(33TsA9lx9wLjwjMuS@s1 zed_n9Pf?GfpvvXb;&ycRvhD?9_;r+`7tFo=-{gWtIkO#hba%7vz^m@6mpts~?n!OH zwM`9c#O*S79=e1_=Hwd9HUs|DuN&(U+kF!aa$!5~=!q=6R&E874pYib`oA=CD4 zk4-4c=b_rs-CDZqIn3pBU9MwL7A;~j&=#+9YB!qg88Bxolld^bvWM4%uot3bQZ9;W zHfKiM@P<(#SmaBfqwM2M4quYX$j_}V>ISb8lQ2UugS8Z`+_uTVkcLC*Dl=Ep66L8TaR259)jDpQ>!U9K_F!q6NnXX^Wu+xs8)~m+Vws7 zSiN=bE4eiKys5Z|peYaNv!J!BL__XX>#YR-f`_V7m`?A{;$z{bo~!`}P# zT5bA$ll5t2#|+)~ym0YPnhS@x|ND*mhPZ!L)#*?A+z%d}Q+@FdMuYARd@%guA8PI0 zrg-W#ysqt4tI0Ru9wxYHVdy#VSyO&Z4h35WcLe-7h(htF_)N|_`3w*I^oKql3{!uG z-YEVQcUjYCd0001YZ*pWWUvgz^b1!6X zV|8t1ZgehqZEP-bWo&cRU0ajeHnRRJDf{J|2Z-WT($;2Ev$m6X*G^`wNwRfbR3Hh7 zkVt?FfYNAw{b^7$7RL(-vJ$U*bE%O;3H%yt^bOsOKYw@M)Zc8G(p-vfUxcIai*J}H zWXZ+q+ZVsweNUz@zWd9cKd_n__=c`{tG|Jt2>tDg%9!>~L7TMam_~wqP6*J$y_;_&yYdFMeqh27Y@)kR1{97Y>)hFFzI12x$hqIT=pH z-#_;(4+41`oqa{<16ZgkKJPdmhKsf#sLHwUa5Ppgv`cET> zp0myun1jQxrxC=TBKX7Sz=t6D6u}?PiKh_!ad+SiXz8P}8ZcJFN=}3R!%=H>>X!pi z!APp+Vslj7;~|T~Ei~LC=em;ZQr?e1Py~4`SHW6KLAZcPf*UKE^O~DI*><&fddIE2 zJB;*RmH_z8J$zfxFDm5zouD`!|2si&3mCIv%xEx8K=#TV)op)|x1wbCH}hZTqssI= z_4O%;qR*mWa4ERyK*b5ei~bIaSN76kZm;#^y`;~s6Dmr=l#+@xOlx3J6pt_(F8C`Z zKq~&=rXK@!;q3DmbV%K+N=gmZ+yWll;+Ou_oE4pdwYd04$8>*RoK#2I^;CoP2sb*C zdMj&Q>~Yc=|Bk1tq}F844O@I*|FVyB@jZNpDWF)ftzEZBd3tue#OjG&^hD1K#arvF zU?(@qeg`wFeQV@O(YE5nVs4}Yv5S(*S$s8-uYZ2O$f;)K;-B+5_NO_UT~8;omuZb! z-%PKk&x#*u7PnOEom3@G`oin^^sQ(+v-lMrV2SquM$z>uw(;fY*G=DXK7w~M!8&5HghA{RJubUnwuldF~0kT~hO-fn-Q>sMLOysN3g zY2L-*^=t7xNYTZO)_f)G4N=k;#n)RlKU?1`LP=IQonB4WN9BjvR*SOh`O-_^%l7db zq@n;otO%`F;AESsK@l&A$Jbjpw@MmmU`Xp!*4=-D`UvCe$^GzVes}bvF;W+e)2peQ zGi~=+7w@S6K1M5K!{~ZxbXRd$skc$W&VQZP(Hl3uTA z?kZ(zwD4=J#!xi5o{#So6}pwmEZ)&QQ^*(W?D_}!3tRLwWcuLVK|P) z2^R29x7BJGzGXI3!g9MEyM~d4W;)3CMAIM{jRO?$GnYA`RWTA=o6$;cgSN}-$2~tC zl*~|G1N#Ki@tC9&(tZZOx!+p1!PZPkH!%q zs_)F~iA^0U8@QHJe^Cb8*1IAaFEO@6=cn*IaC`3Xt zp12(H)A%PrYrq9WBs!Dmv!u^t5-3cPCvz#S9UC>=DAo^)0_McEOrOClsi8s1U}g`2 zzaR`FG-1kk;##I2{LvHo^VkjND2 z^Ee4@TNHc!QRu#w!vi4XUBBe zuZ#W~c|XmLd1zm^zTq0apH7a6f?rqWT*EmQ{Yya`Ml`FJ#O8#9kzFul_|k6FgFn%s zNYjg48%&pwH^G7a8f$bm&TuRY*JhI+{h-wL>!Npr2K?wFESz(V88;j3_k3OS*O+m$ z1c?!vT%!jDF< zk!#EFNNXb>cwN(ecqYg%b4#-heq(v?BK&hPSq5P(QML z7rf)zEaY;rcge4BFm&-S#XFUuwxqN$Z+Z zkkyFx?i@;f#mxv*q+oSFZrkN>+a`b?cK5;Ig8fclq}tND)Q2l0`;kp`hCko&^4n=R zW!ZR=rxP#=V6n`mQBu+}i|H&YB1W@33Uj(d5iU$!C96PB)#bfT3bhogJX9$1uu@lA z!~pCKUnZua6$Y$X>d=HktTq1-y|e6t0qtb$Shqv8AP~W>!T>dOg=>aTO-=QWy{U^L z29S);udu(qyZQT@m>5PszP7a~I#6^M01m($MCJz;#u14&j1f_JQrC!T>gQwQ(APt?2{U^1pFW20#CHGruLaPasJ~W8igd z8$8qpU>gt&{pyd@+wbVCt%|waAGECF+Qt;J2XNugkEfT4nr4CDWfcFRRWPebM zi96Q7Z|}ecN8!9@6GtTL8SX6?ALxFDBJP&C{DmRfe4nBSv1P7Gogq*~<$G{QQDAlL zNe{5TeQ4-w$@E*3GaMd%<_g>o5dV$xhW#KL_V5E$1*dZ=P{4N8EIxy+L07YRQOWuN z1K`A!e>emznOgl-bxa6`LT9J(d3)$@Qiwgwui(b4a6ryn!T15>zcUcPf9DJd2cKt% zcU0*gF#t_nG3g;tPMg;<&tVv*P?%_mE5Boa_dmo1=QrWWbyoLUrKCqvcca`i`mBHatWakn8#CZLlmL(2Z zo49Ip253J}n+bwLhq=7kOJ#T`2pi9c?-cdu5d6v1FferA^-@Gy$g(I1G zH17OXa$yn_yEv&U`DBQduGh4@m7StB#{f9a&TBDna10f8+wyT!T`|o-vsI4`#otR5 zA}#g=R!@^r^kn3+A%J0pLsh#PFAs?+#^W4?&`Ui+Z(c}aeq?onV_s(-v~p>7RIxe7 z;&o0uJ0NojV{y8{fHiYf;0&aDBwBP*R&I+ zW*UVtoOrf3?yAm8;yDh@k-E}dhG=;nE8d})+00cXGsN21e?Fjq>MAfCLY2)OQ(Gx< zY&B=Dl;;85Uuj+PAGjH#u-((i`N{p2ivk9FJ;wkxb7eF?2P?}P0oECgSb91=uNr72 z>xQF{2dQU~(V8}3@?wCRP0uR@S~C>sJee!S^BGQVs4i<1teR!#b(i&cG?HCxPxuj_ z@+GZNSh8t)-r%yS^vswo3asPvCIJ;v>>Jr>65~)^u2R_{-nQj+jYDL)O3;Q-6>TcH z)vVp)&|HbfQJ`wW%P>XZ*`}U+3#wbe43-=x&%A<0u=O-3u(}Rpd4{#_?z!2c!0Ji1 zu*XdBdd;>tQbSy=ET5qT9;oXGMRI!Ps%?G-mY1?y)i{_o^JIenT8SfEp1C^Y50UQ4 zhT>RUo``r(!88<_aUApN>b>#|ZKb5dVHS+f`?EPKxvG#@1Rk%;W~qP-z#(6!=gqC0 ziM*mUiuP@(r$i;^Mlh{+T%#~xve3f@QgL0=EkWTbrlDtnf%C;tIEs_;`S?q&`yOdH zpq^h{1qGQ^Y{2N@A~6Sz{b)rwPrLf(}Y>M^`*9r0Qs@n~Gl zIG$r|I{*f&jO7$XiE!c*xr*`?(UlY^{F}_PZ)-c5q$qrGPu9r+Xz=>y_qUzmOB9ov zdTP!}+Hf$(B?`ukJt40WbS|p_u+}wGw#kj{TY*EQd2+~0P{I#P$!LtDNk!^v@cInz zmhCv)6UU}w;#qp74TFJBRvSiWhXHZwI#POwn0>Fts}%|%k+?dRJi}Tuz{Oe|wTPb5 zl9DyNWH|DCQcv`@WLp%HH}i79mMMy2N;6MTq2wzrxLBhIg{7{OHHTmuMuncDPzjkQ zMYU9L!wyH)Y3eCSFO}WH(I^5oiK`#nGpsvikW}fUo+_OZ?zf}r0Y}f}%#)wWN`~X8 z`pk8j#t^7Yqg_4VV1e+w$g=Syy5v+y6n0kT>Dt8ZS+SNlBthmnhj4&(SuoYrwIs#9 z=yHxDjm}dTvg9>yw^Y=W2^uHg|btQK=y1}KMsz9zAu31Yv9BC4s9LhD=Su1Loo}kzk%{<+R*R)}p3fAF=quw>$ z@_SGd`~d~)rk(_vH7mI;432=Z=OlnNTQ-cZw>XN16Cdj`#hQIlNfe2SnJ2Sy%{sV- zVudB19p*J}mM|C&agcf%rmulx4O#9=ERJq;-Yd7kdIEQBD~_W?Aak99^bBy9a}=zQ zc)AFzHCSK`B3?*5y<*q8gYWAN3IUdQ8mw)=mo$}BNO-{${Mu~bmj+xk6bJSto@%_! zZil5{$g^crGp>*@zomk;W=tw-x5}OrV<2Hc~1KQNn(yduB zMH>`rES-4xfEN|56)kCj!vy!Fs5V^5NFa&PdZ4bUSb@Kg(;9{LO=cb|TbZ!BN{n|U%(Y)%r{@w(=;v6%>ZCnbuU<;>&qwyT;y2yUy$Q5cOAPeHcb zZ{%%hY(x}=&QRq2q@F@jMYkM0v>Hd$#&ZmV%8>*`Gf%fK#a0q#mev%7 zg2+6_$t$)qILff5=Y4dwR7iAg;z?TtoSG}XLQ&tCdQ<}7tQeS%IC#L*tU*auYXdhy z5e3UUwwIEvKw{NK=Y@c#8*ZZ>7_g?EX0V!yhH~=LI}~6&;TfGHX{edT=Z!2~$a-&Z zv=_=eXK;WaV3geB@Mls_Dc<2gPq8W)ijYU**%Wy?f7EtL!+oOW%NzF_ z8xu{mV^3_`wr$&XGD#+$I1}5pZQI7g$;6nu=bZD?yVkwyuJ@1bU0wV8RCjgPQ{7#k z>Z%huZ@04dDDWElT-EoORy*#+y{~jdS;35~)y*3?4U`a?$sR}QYUwx;`OIT0%=K24 z1k)~qAnf-IeKYB`ZMk5gA&mE=8`i?ATNoK0JYtG<8D4vOYc;g43j5csf{Y@frFOgWN|gtNMK+t!tJ3ylGY(aPD)^|a2!aOkrI z1NGZEkA-Fuw>?bqmz}vyf~Wm4pE0t&o5}07=i+K9E{xN&`TcdZXhl<>4L#kWLe2N_(Z`C z?$V~&drD&IkyCn!6!VFax07vu8p9Bs;}}e2w$o}H-YqiEGRC(hY|fQ3=H#TmITuRT z4aqlr8z{DaWK~uS?03ADSdp^{*?^t1EE-W7g#tfWP|lmT>`dm^BZwF-fsAT0iOjQr zPW8Y!4zQPV1jwa($-Qsh_DQ(L25Huxbfj+HCd13N?nr*?=eY(%Hgr-*-1;iXQ$OG_ z7Z{8=%7^4alshBm8j~p&v+2sES*MB%eMtRe!$zT@@79x_wQ(1{FW4jdYW*o}aY z-cl?}nM|-y&0tl&fHxaHYlp&|UD@MXZ-qRlk>+=&<=@fy0Zlw3@QwDegvkfjKX0ZZ zVNEkU@)%By)RRvOMS?C=zN&)!M$@V`(9I|#+Q0`u$fJ#(hS!eES(cm(Pv09B_K0FB zjJoj)5xp3zJA;Doa()Gl(&+t~+~6|U;ERDQ`E`~icOdB(Nt5gPp_j=czZi8Z;yL`Q z1|BSPDfjBgO=a22^qvm{Y zQ_jz0LMbXOS#>nzjQDea+nvX_u%q0;s=3KCs*GrRm9L>qBa4f=TGmdase*>5BJsjF z03tC70j|$Yco`|YQr>Eoh*wFM(M-|c4QFw8peNvSWT`p_RJExMQgoh^5)D|1WY8lP zE=C7V93Ro?{m=z*LN$Fo`hyZJSoyhqNwIY9D$U_27u0n{+ES@ChAxpWzrd^9c)LGBDzt_lTl0}*DjR5Z^ zRELg>0iWAeqm_~>21z^jjAv1r>P?igD0(ln@WeX~B1&KD3@e{-!nI}1xlh2S@}dp; z-q5{9Q&MI+C>=}EjfUda$PbPXm-C;4JLF~ddtxqwse(b9i^Yc!559`hy<^^h9^Ln| z&7Rg8kTfDE*bWFGgwcg!y5IpxK@#WkS^hE)aCpE8VR=jn0xTmY{ki;CL9lI8;5XX# zCenS3aM$r?8?fvik}SG=4md{3j0ScK*D0UF?9*7`q7zsXAkTl6>=X&i7YPP(exqAb zeFrmzU{SODL5y%>tUfkE^~(yr+e|B8tE@_dgB=ul;X2vgvX&z93^5@*PN$-o1~F`R zo4$Yg06Sg{<`1H{uL(Bm3i!ag9$mmzQpi(ipZjnrnM%ORnbKu|{h;opxOZ z4YJv?lemTF5P?s%xg|UO85zr0+XksABd#!`DVZs&^`6hsvy*#Cn+7SqTch~>nL2i- zZ$!$dVF#*{pm?*_{jmi5yYUWQwapG@LQRq$D8ZziOm(L)gU*)Dsh?PSf6XMNdkj{H zbgRSVXQc28&FOK_@0h(c&g%q>>2)Mh>lx_qRV~cWvk}=Dg5CWhbu;|hO2Yo2LaQ=&D7c&as?4mY0Xvw?`+)r&Lp0viGZj83jgU60-NH0d)TH1ldcuU2K zO3T^d9L2c3FEd?n=$$lD=(cvk>K@awB0>GV={g-)3Hue$(}NDzPNV7&qS!hIW$6#I z$~%r&y56aFPutsX;IPn~U@gT&-EWwq!;~>pu)4ILrooXNLEIa2F5s2ieHx9*@{pfE4#&) zsKgaR1UxOoU&hIGGt<;jt`5^MhUD+*K;tvO42c{D=0@ zbR4YI+$zv*7-;#g*X&N?)zJgumn#fxe;?R?3j`gh8WghR;1;y(WxarmJ_zypsXV50Il5+KNelq=!dDnXnF{C*m)uIRTCANyJ_fQLXJPnwC6^y zu(|*0D%FJk0nwy3dHEAZ?H6@M|3z#eoxEkgOht>qM3&ce19W}Q>@A-YE7Ie91cdMT zPoepIOg7`w{0lpE^Q&B#R#R50Lh^pEPTt({LNWw=WD6ZrxKE>G#j!>J$v$@$P-vf<+z34+6S#Z_^u@_||%IO^x_Ugm} z6O8TQn&v}nz2)kw2|C{_w;O_ZPzzvZVD0yXb@}}b4h@-K^zkr?tZfEcC&3zDbaB5( zl{u`q%}(qJYQB&ih8FsZwC^aI1`d`*gZ;Eg%oe9LlfR(yu*UdUEe{tdS~IJI6cyFZ zNeanbynmP;ZlGvwcU7V1&zJ!ZDN_s&%b;DegkStj0!=J* zvC_a1)#d}xhiKZ1QuR%TiI;Sgluy^m% zwK7CXY{B(LS|t{kObpqS6g^r|V(44py>kJfh%=QS+0>%xvyJ__Vkh;^o`na@j0s(FVq;_ zwmk6$R(coW(j(5{&h`1=?ua`&X6Ryh(6?`hFVs6dmqUjV+aLduCX;A45pC@Z;&PN` zAaH&0;0fXKltaW(NokLZ>XhaZOB`2adFYgLL-L!E?$8aa{3H71>5au~b<`{Kvk8tV zkn&^!AT~Ib3d=!W5iT`3#F(~IDy2QvGbk**roJJDwcP7}5d1GvR}0uj6~YGrc~S=j z!TVpNZf0-qVrTDS>ipkKJ!PFO;e(p5Bj;MCi*3= zR1pKVH~N~%FzCA?KL}u@?ryr#AesXhafd1laROo%V$$tehP5^8*UO*j?-Y%-1A~G{ zpK0J?=tR{!ZFj^va4u^+4(Vu*F4qLMq+brWa_h)ttP3T_zk%9`+`uGqyb7b`uyo(e z#|E}}Ja{5_$!wO3QGw5y19{!e-L=(JnO?t^ℜ;Sqr^fS>m2k8O8{nC4pq8T9CST zrc06k&Z(6tLYnjVXM$DxOGmn{;4211bn7P9v(HrW({w2s;ImPIC!U3#=6K2^6zo(V zAk1gJ=8IDERlAEuc1ciw5oj;Q_-g(R{qGAkUN`*z5NJ6H=af=`O8cUe`Qw4ux+rU_ z3As}o3g4SUpBFW^PTe;!UKhCh!KfZ;};LmZGMUvwBCZOa(8sm^!ia(f{}Dp z-*%}_?Y<^-k#=s>J@5EbLy&3SxOg#YW`8Fz)25}OJ02$tq;G$X(d*v=oxL2 zjUv{Ii=l6JsA{Ym>x-KzMSu4Xdigp(KKlM-=681@Zd^czeT=EhZax%h1$+#I_yeH# z51cGr<{dOjmsR@ros%=MeU6mTyIFvpqT5{0nz;S~(8>B$mUcK77B1J2YQ~glI#a{! z=~DAlwwPBZS(XRzZf?)PZ`f5qEr;4#tyn2_k5D{fT;?gb&A;z}02=f!038Jc(9yn7 zp;p{bC!1GdN%$A-@v8A^ofY$6>oC~YIq+TYfdIPH9+WS@&Jx2_>U`fN6Ag==pm-Dk z{?|gg=rzdZh+iu@4HI7ZHQ|G3fPd`Ml7b6NW7*afC(ItZ#^1ywo25&+{NpaB0|yUOyg`(HByC zvW=Gsg7x=6vppXwj=H6yBF_B87@`df-8edWHFqY@TEp{9`w<5T47h8tD$kMaU_zuZ1^;*69gdx_eWhxPd%01>n(tQ0TUGmD^?W?>@7P{5YCBXqC%jmz5{z>N+T zu4+sv_6D>u_Zr`Q^_=Sm{63^=q$-}!mWK!PiPUzzw=l2+qFUFVHb^0FXM~(A# zQj$1R9AbojE6pXN^baJoWI8a^Q5Vtbw?%thQ+T0UdPUd=p8{^lIcD^YqNj!+V?uY= zZQ%0xzcd2V?XweKCfSIIIgsC6J3Pnkm^9}p7&a}&A z{;i~0k0_F8puk8rejA7An(S1(l1&sW3nS^U#L zOfSMBrOmDlZL<&S8}`R5e}9q^oqLzTF15q9J^|~!bta#JMpbtm7%qfq(r3?03%1$n zif?``t*tS7vtz0w205hnh1Xf~qsZTuWHL^Y3{;SHVMnYrg0U#0e6@wM35R z&FRZ`r}Kg_M(rJ41cALC4hIh`hS@ueS@~y6&83y#Z^0ok(yBAV zUDKtx_ZsH)|*h? zYPzG5FgM(Z%YP+Dt^umPZHUt?Vt@GbpH&y%e8aj}AlH;VBQC7Zlft4M zBc(e<6>VX7OsW9mmDNY$qGFS(8q>%h=^yj8L=iWreqyRev}G`$b&4hD8T#@xeDK4V z0KtO7c)E>O3?2;S{0oADvwq7FRvE^^8$)Uvr4h*L(=WK!hs{O)?ScWOm(#{_S;qLH zb{GecqY`wNekB?Vg4F?I96V)_!y+@RxX+-0H?)b?YfjJLgP_ami=GIW2=%cx)htjo zrPa~%j2ePhJ;}e5#<^au&lca(TlfM=aias5qpej$)p&<{DO#(|w@_%SOFob3!1kI% z_cKl0%>(Ikmr1&gD;{d8?g75^1I*Rq&Zu8Cb|QO4==N3sVoaYWJ$aVI6556~9sk@r zg6Kx&^)vji#kg+_@qpUX7uT3TtFo zD*M&PGE?_$WnD+EVpK>Q{mDJF6(|?h4E1PKcPtR|uD5>Up2*Y1<~DOBCUh=tdHHo= z{x4LI4BZLZ?R}uF*O2?MgufF5K|UzVB{-f~ggf%r-U2`^E~6v~zz-XIE5}g73~@pu zlAmw6V?K3HSD6090bh7ao0+31aUnTE}hh6;xgEB*aL zW23U077?Ofw*fO5>SJpJsTPhCXEXt7v==c}Y{wcMQ<4VICRGMBa_m?&pS$2PNh;X4 z6LHm80g%+_T`!ZyHHhtP@A`lj`bRwUYxFbgHEC*KI~#&|;6-#sk$ZwijIi@TmrIIq zLx&9OmEwfWZg~Rd&{~^6UtYjZY6hOLvNhbIW~tp3D>@&lX>kYt+`OZ0XKpdW_T$9) z#8>zf4B#g(F`zcP;}(8!YK!Wq70iIzUp`)1tTSQ}$w2(Qq=Bm<3*ZGf&@U8v3JBcqi5OTk2L2L zB~BQPI>Jp*TR^DG2ZNPg2_#c!i29FT;6pA6)P-`J1x2y0?@1uuG}ie9efALe3IU|g zyXCfiV9Cp6`mg{QZHPKSkjg$3I(i?x+t`2TbKqAG$zGQ4VSniJS?4W;ZGKW8kUq=5 z){~XD+5zb^X!W@1KlHhHvNB<`4%qtt+Qg%fr{qMP#>j1_fW;sRFaR%XMRAcU$ zXc+AHIHJewnfP#hD5d9$;~Q5omK(q#sauXW=E3057Fip&$?fRE6TeU3~OlSKcJMOkTf{UPIo z-sM4fb^yZS^}hS=3LJ}k@Zcygy*|AOFyR;)%^qfFysO2({UF`VJu4h)h~}m zAtF*H{ow=(4M=dEihji?EK1r^&2j56l4%NL5qs+yQysNp0w&f+$w8MIsjDlpXBB_pnlF-sJnA$5c1L1>F`9*aVEiq{!oQzW2@Cx ztHeN(RCt;q;^}LvNWBbIC|FbX9d#_2g@hAM*15KmF3geH`?_*aKYtTKCgVV*z_LOE zwvIIJH@O&g=~&V5#zIl?rP2*6;0V;%tx(EVk>@v$0ZxV2au_-kDP>0pk3!?l!;hZJ zI*xSb!@#{eD4MIPQw0G;bVgQmzleUJOo+L6kg}hMsK;jwJys`pN$ApAu7rfk44vH< z3Idaf^Jeb-lJwh+R0i1doHO25vNL)Wke+%#ng|ez&fvS6g6W z7ObV!f@njjwj4*G+66DN2At76;(faH9&gm zun$RHrj%^iaO!tlXvGW^>$Gk=Y|bHn!h>6y1czm@R&!R?1b`m)NP<{5*NbEi^yWc>`eo2P z#N`SrKs-WVmmBgFcBkurQiBNI1w{k5rbkPpBM#DQuu2wrn;jP&j0T=XV?BW061On^ zT8QweakYn@w#9-H>3ke)(IaCMNxE0TU|fu$DxRUo@=SmRab6oRp#|~6@-+)rm@{%A zk@!;~+AH_o?FFO3B)BK^MZtCs8geh)_T(L}W0?WszBWb?=te7t$~r zy$~#Q`_y%OaZok`8_pW3ORN~#FrI^ltFl+ITVK6 znSKU}4nim#@S?X?{e~Lo8sLZDP-SYMA|%lqMoC*ZWjCn;iFXtsl;#(3l@-yYso_(h z8FF#^Ju4kpC=ds@zcXf{Jb^&2^mI|Sz+0_o^nf(MnB=u&lGg1DIjptGK-4S4iB378 zIC!=v?YJkje{n(=+b30syLiC$RM*Bt`BM!%HCQ@>Y}BTo^2YS^ks8psbSPZ|@AAa3 z4%J8AaNU>eyeE6;qq9SSclABlEOe!K(63N?Q|V=T1(1;)**ppoWv9u(;p7e?wqU~y zC#aGN4KOaRb2fzrW~Dil=prZ_a(eYY1{K3tc`x$M3dQoA>jl=n?6BzEVMM+R@#LU_ znD_U%4D^Brnjva28q#b)h@w}(tmtXEqDH7@WPSzYXvc*rAl)-bJ5AbRFt zsQ0qH{0luJH}o-tG0rMQ5cj1*qh3ZAww;&Da^dGwu1l%eU~e+?J$1@>`%ZL6E@^Ivc9@R7LO5W zq4ashp5b+kfz;DLl<;v&X*uVYop?Evyp%Ix_2wL+ZOP?g zM4c5){)I1FxdFQPy9A1bE?jE!P8}{f4hOQ!Qa$3gE;EiAC>vdMVJQBh#!FzXyGG{AP5 zpreO0ik2Q+m^yYO{;a1&e5v0kdx(>4Jc}Ic!MAm}E60{o(VbLr%n{pCHVwI{aj^C{ zx0D?VEPmM2^-cq>QU?wsP}ueHXccZruYMLyt3@M_AJ9@RUdBss;%_AISd9j=OESvn z7a;Wl`+)07s+fMsyPnc+Z9UCGdqoE8_{`7s+FOp6lqo#Yj;YXr!tqVb5RzT;_!fg* z#>px&+IHT6!y8e7&W}_v zGFHn2XrYoRFLg50WT-a9QdPuH*$TBmuC^J;4(<-0cw|Y735xi*3k#jFx>>@Lz%UI3 zD%;*+LQmvuWk;E~^a6PUgy;U#}Ly?8TY>Bh&S zq^?!?{94d=_#J~v@+R&m9@;;Ig$0@RKFLl`Zq>%8(3qxytgGsBOf!*WlmSudhhw z`h`K>dQ(b|;H>I0FU-)OY(91)e7G(lrzrV@={1k|coSxVrIu4KEp*fkE3-`Sb+`Kf zrd8`nug7_`>3v=i2baxY*PY6A;k9{bT5Y;|Ox~3MDvjS|rt!BRhV5M|d06n9Mz=Hk zh4A%WGuB#gcpM{))!Kv^@yh|C0%d)AD1Jp@G4Enfoq%<8Jw_^bhT z%x2YsdvZ2GQ#}*P+1dam@oyWcZ-s>hiei4IhkGmg8QcE;j?PbhEOH~%WGOz2XZ`FY z6`0l792nlvUN>1%ZASg$uh}`Ng-O1hAEsz~nB)xd$VQl9spVGvG?6md zEAHPP^w~IJTig6zTT1ri6K^|}`F;z{vQMZ_a~2@*7J>5=nCD!d8tI$tbM_Q@kNiQ; zKB^YSK=kaiLz%k}_UnhSY_zH3vlYm6F%?-EK@&i#MqP5U2?PXI7qfm%K>cUaQH%`y zp31+_^F)kxk4~@;N`>`z6A`9%WgJoU(3R!JN1Ye=okclp>C}atwAS{7gmIh*ecaa= zXpY1tnh4l$%T8x(y0KZca|3;U&~vr!W-CO|Z&-*I9K9?_10**P$0$XHx`HZ?7|Qi{ z+If$J1Y>>wtNPP%w7G{qr-1|Asq9wmfXOWo>B!>qh+r1|xP6;B)Vxwt5eE%FXxH4N zMhm4#pTZLJ`Q)~~pMs0di%cnA!TW*FG2(oQCCQD@$~IB?tZL`wJ$#9uC%FX6iJ+o` z(Def!(h5>dRr4*JabNqq{fL0dGl694xe&WTz51(xg zKMnuAx!4`&5JwU4%5#v?9q;sQFEwFh8SIAT8VlM%AAT*D&~;dyx+uKh28cce?6`B0 z!bBm@zBg>B3~MiifqYh&Zc+klam040bh6`Oa(VE<(Rhg;E5yK1^G6NU ze+^RZB*AN(6xcA+XJYtT7?8I;T zmgq0?%qn?GN>2hL&%<48^>S7Ux~zYZ=L(kua)RPhj+i@^G_l{3Wh6I$ljq&4a3Fc! ztpk#0!@tRM?bYApxi~}t8Ic@tjCl5bedD{ePXf*ty(mVX-H=PTQ^{5)mJ4p2EqHc9 z+v~Z`vcQ+HhKnjsy#8x#;SYJXLpVH${EIvn9rPzm920bt*yGa%XY+TFEUUBw$un8& ztPRY1g7pP?z3nEDJXgI0{vppr`{pe>t(vQ~T6OuB&sp%zh2naOAYyv;k*@uT-F2U# z2-}h13vbS`rKs&r2rUqrCq!7a=k!)a7CF*^oltjO1$%`Z5qD|79ujfUzb;{m1ynjU z5`=&+)1M}OAx?-b#z^**@HzHr_cU-d7pqt<%fF^@YP7ObU#_##SOwVq*7$iF$2M^g zDLu4N3XSZ|01u$OLet;BX80j7Q`|+z0`7Inl+3q!Y3GWBAE}~EE>VfVS+%^5)~3VN zw{sIPwAcg|ujA}RKNL^uQ#>tkbZpUCTwo|iWT}Pdip$Dh(HP?0{5OxR-HotX$}HI)6NP| z>9mWs=*6QJ=TK$~45gV}J%SO_IFM5K-pVyUh-|nW(!G7J4&}p(Fb=W^g#+X~GVp)C zJmZxkXUulrtE_doVjR=KFPyp?msXSx8LpEt$3h>TsDD?F`9QhI_fCTRTwaS);w8VpYq$A%g+QB!d|Oye=W8I8=7 zXPkU+&+10ke$%+UOmK%Y*v1jj4PN8r-smzQ?<6hbIp!A6LPrgPMz8!ALlfFCiVsvI zV6fCFjh_FV#SZEHk%I)MG*0=_l@^wG{7T4N6L;T@@50wkQK^6?}1viyh3V zB3;vprajuGceD8LX;rZo`WJk*bG0=xb+WWG|AU<`eoWf!i=htd4>HsY zW7l@C6vRskC>{_;t=a@k7){s7#70Pb7Z}Y-(~h%7;-rbw3GO^6Ie(piKc}XlN=xQ# zNGG6O7d`)7fUTrjMYq`fI*dB_@iQYf>UmT)p?co*;pls(o1A=tO;d+N{iD6y?+-e^ z!ykTk_v!>wb!UT~37F#YaKSddY_jzP+nIW{Y~}T{7QF3JpXcw-M7hRO&JGWc?rmDJ zXzA(aHJRE*iV5J_QQT9xzf{OkBf~q+t_I`NCS#83=&0zK5pci8<*zQXY?Bf^@@be; zSRKT6w2^G}qd1FYF6u_$pVH=+aVB&EFccSgO8v6%u`}1F(W<@Y-gzS0D5|rIwK!?5 z{F2K_si$=5?gm|y-`M^A&ur>4b?FmqlsTL?6diAWPK{PXrwp?EzVW&*`)bF!S#W&H zv+1+;Qno<@JpAL;)ygP!cknN=Q*MkKT`HeFw@>a&^ag4smefzJbUoV{-`_I^JG{2T z+5GSOnYuL&$2IHpFbR5$^h{|dFE<#92Lq(}y`z$EDWk`xH&#E+^bRTtzkGr2ILax+ z`U0)D*-K-|iRgD~%(A|0drD!;Nv7_%!Oef#`MvF|AOlymRnuQ<1D^8iXvnd9Vxmk| za}%zutTv&AiKtK*CHccpt$C zl!#NeCY@Af7gt{@VCmQ;`KA&r1z91%c^RG_@_3pGb6ih9&ds>!V@5bo4J+j3#STjc z?|l-xWbG23+vUp(yyh2+?|3?&fTPvxWwra>nE@Yp?Xj)-(;d{eveLJ|o6qeXvc*kW z>3#o-#?`gYVS_uw_G>I_6X$ctXZp*SEdA-@QM0Q%-P@bX4S)ZS>5l<@v&CIcCr#{% zuIcd<7HV;C*2yhD-o%eMzIJ+lngwBCCf+Mmba@=lab}^#Q3p<1q$RgauFPvg52k!8Yy^Xm$}}wOlJ~z~pHYTKrsw#$WyX?EVN;ep z(+?=N$q1zGR@>Z8*lhLjFH*U;Qn_6-*It@^A2^(~&8`SS9X%`Sx>8EQhq;O*S&AZJ zAX<-kyP*yZSTx?kQ=t|ESSUr;VLwiAT%ZdC4;y}*#Fhy1Vj+InbR+ktL-Ycl%b{ME zyB43>IRU-H4^Gqkk%n<>!A)_ArPYA)xkH{>U)$B+Pol~oAY2y53WIjEA`agRI!-4qcIN;6HT+Pgk<)N4w zOphdU@Z=pg{!0h-n&mbkq!VNcUT9NU z&B&Zdml_H(H_{h=6=G(EO$avA!U23{0q#f9qNqsFX+}mmxIf6u3J1W&vg{6qK9|Ok ztG*erft#+&4oA@y+s-^==|^Qz$2Vj|>+o{O`W-tPn9^!w}+nLF2?ZU`W z&|xg{)wXaG!f?Rbc|Z_g&cU8Ruz+F#UiyDR>jKWc^a8t{k&dSR-eIWm`z@Dz!vSXh zR)VKnT7UY>h9KbR#VnxDef*eueLE|+71NR(j0HR$bn-8CS^(5Pp;f5#vvyD^^NJQs zjVq`TJdBnx#|KWR|46ZCWVD0-GI|DKS#AdZ9%+fqy);w7>CTI9%q{TmUH|Vv@(Y}D zNnx(oz)$XSxNu^&6#t!*KL>!$0t3v`pAg%O&h{q-$5>`Yw(a>22D@y$5`ob38(ij? z>t5fF_hmYQ4b${$cKdl6%c$Yyq+y#hvdYv)%HWs6vDVn`}h*G|}^(?w-TmqwAI@JOeTs2-y zqZA~IF;-mgk{|0tPnfnMInu-LAwU$j@nja&}I!Udd&v(pIo}I{wu!$M=3!^FP9cl za6_q|n`UTC4#MJ*9y$Ghh2x@70x{jvwvdCyqNpi}7+Ai@|EqkF!c8u)NFb&EagrIJ zlL&|Zl}sB_td1%CfjZTVm2E*xp{eslIa zK$@tpmX<|&s^EboixlLa0}U_(`uRT>9@nDkDyHa-ao^Fv*E=i{0~6E_=HJ;cL;XK= z#Q5ABcec5l=}&?zH#3(1DLs&gV1F06dPJayh&!htcwnhMpLcU>QRb~!t|_H*>R6>f zcJj?EB4^0owWn?solQQ@`@HaFS5w7)-|CM?swvO!%+$7Z`D^vIpy3TJAs5~qq{5@H^Xdn$iE^-76uBbu0ne)&qTK%v zH}p@(l_931SVT+p7Iwbjl*}IV=z{vk{lL?yEdF*c@O0ap)-LlLZlobApGUOrj~PI0 zX9PPe$lw0;r?ivj2>#<7O#x<#+sq2g{^ucf_h{W)Gk`L%^v0_T=ReNaZCDLSj^NTC%7q?Bk+8K27g*PqpNRqM{&qWHk*zut16Hd)+Z2HpwcYOiecoka z$cw3I3ywI3*dFk$);}GOW!`EQ89u$V@#IfM`u|Ze7eGwvqt;$6``@B}hnD5gc}4Zo zdo619jg)UAeZp_p8h=Q6X7$y6D+s*ssC71ZJ0)4K)i@p*U=}&@^d(M|Cs>W);Sw*( z;;Y*%+u~$;1pZH3@PlN2`cv9vA;=YQvl5w>_>8A{`Dy}rEO?r&+5h8IU&Z`!n*TlV z{B4WccABOCacrG=@}~3lL8jiPx`TI~XPer7nq~g4=zCzaOMRzF?9}6-;W&2ppz4As zlQic1^M1q&n)iFhS%7O#hj@=#d9dq1p7?;8b(rfwo%{eBb%g6c8F2e7%5}gl_G_gY z-q}}I;O`Rg+1E}!l=TXQC6rfQ;wFvex(lzQi>1;{h@ zU^ZBuvCL`hD2dFPSd!vygm;TjnaoENgf=Ld{zPW}YRL`xMjgSB6gN8qv{Hl!wZfBSj6cZMHPi57;{ORkVd7beMakX+SIXoH>){c$spk;L>?%2#&xGEzW(aDyL zjk0NVg>cQx7>%0+JL4&Lb)~3J25Z*FM%j=&-GZ&DlmShd1$SK~HG(ER+V;x?aFF03 zHVm`AZ)V0BaLm18^|i90X~5T$KW00Bn|=Ik7WTK9*dH^Q6_wPQQU=3{8ee@sKjz=- zvI)nhqO0GlS+}l!cz-QE2M zId{aQzN&NdC1YI2bbeHs?FY|)|6mkxsjOVOJ_(|w%-I8+#qU%KarM*9I@Vp{$^xp|%Jxmy+$T-|DsglSIB zP!ypNQ6vpl-TJ67anKXULRc9X%-h{IzgyP*kC1rWCwuy~-zPd61MWf5XWN~fPw!^; zW==O({_l4;&6FRf@gsTmue0{t#}|XXfGhv@j&GUXb@loF5Z-(9eYT%2&r?4TuISv| zo*Y)X9fLNvVm2GkT5qPu^@^F>Mht||z8kc=;?==q_QyOimiuF)#u7vMxm;c511@GE zE*N3hUl|-E&}UIDJJ9XT+xg}>V$6U=!JrhJ)W37T zILNO1cpHY>R~7rr+tYvjee`%1)q(TQ`u=0FV`9i%6aT*JDXCK}4@LD$nbC4-(R?m6 zG{2wsEJ1977@Nr}kpuq75m!-lXXl9t^6z$|pRPU*vTm2$?)5|;H>+1y-63|Ll)$ea z_I`fxKiO`_y}ihK>J~Ri?3my}u}$U&)XD$K=sI49MdT;5^^olRJ)Lnz-i>sL(wvwm z3*{hxK2V^k%R7_=D<(hiwS{q9;52y7pq-rdKD(l@H?fh$r!HAcerfJ$R4biFQ(C>U z`QQcjwqJ>`KhO&}wFgZO=;xVF@D?GEEJI-F2B5mE(2?NcWHFgJkGlz3Ak+i(oHar^ z8Q|0d&A>qBpFle>u<<9*4GiF=gBIJR-e-NuBw$}|w*55V_X&-fod45~O?FUi%O_Zd zG&sqx%yI~s3p1u@F3udoX5E2zKK?K%!=zUAL6wcJS4cz=>Fz(Cwj;#*y~np~C<)1p zB=&?)NZ{Nhnn+2zgcZmDD2vX%M$h4!IKpC&4|w=kH|#5<6GV>VV%1`jy`B_l`*IQPu1`+3?)lw#F0_tS$Xfa ztN#`<_Fd#;4Fy54e@qOnIT)KBD z@#E2pE9B75-(K8KB{0_&?DhhDN!)weM@FA#{XV{>*{8l(HliIe`0sd(Kj=*(mONb0bHo3$Ne|3~f+HcyZaLtAR}_-` z31Q)+cQCTBcp6(++%D;Bm;k3hVA|{GH_RKw50Bt@ePUd_2%bUmH!`H-buu?L(Nu1s zH>{E61A~2Y(dUdD_SP6K!S{>|ANpx;6206CfzW7Yf>@u{gKXTIO|r z7JKyLX>S#&6}bZuR<(alY-QPd-LV|CMk@~aa?{sFcN;Sb+GjGJ?IK-mGWadg3rcp3 zl7Fr!l0PBZd*#r#F~l+EC18y=_n{}}VRn+El#8YEOA{AUiI+=}d|8Zad1R%WO!-4- znbx7k%5Ja<@z9Iv8xN(*$gT#pyr`{ZzgGO0vatfkilkz+!P=sjL>hswGE57EtO2=S zN&4hDJ1mkV8$Iv(5gU;(EYokACQB?AMw zNP$rp_lsa?JXc4f7mPN%q$^?Ev7$EWS!{}+$Q=qOtyJjFT8m_GXvFv@UhUUhfE6_u z$f6oVNnsPQ3~eKZ;olZ&0|DigUqRKiQNXL3TuDGp-@UA;`+64t6~8X1+=v1C$9O?W z8>J}uf0O->aZ!`d|7mIXe{HGwe`lGSv|uB;aGn@YrTBUA`VNfNv(C=L2mKCS&>BY><6WBi$C0jq1~#dFF(6N2*_m|vLW!wr;nKE^fF zkZNebgupmVSJ@{lq=tp#a=58e0qgkZvOWmT862acg6A$QE?L;dMziqpP1S|vbcd=g z35&|zBdbW4rF846A_=ofs$DCj$^oO4a%9;E)-P_|aG$hB4+w{>U@Ai*X_V=3Q}5&u z4S{qhgpqym6GPJ%N2_b~Xh`!0oO1GE(I4Q>9f50QL_GjZBH*;uJ(fL=DCK;^q7~@? zOk1+lePW2zeMFijoILzt$V?~zX6;XBoq@7ZN5>d&XPpp`zm|?ulgferHslpx7#4;3 zXZh*{z;wWI09s80lO`VyJ;9lBL;;)ld-YIqe_$U$RM{jBNjZWZ(b2|39+D z`za)2_`6R$P*0#?uFoD$MCxEubi4H{hnl0$wa;*tx4+)Qy2+@EeC4N%ruo&SzEJ4a z){XbwvTLT)-!J_V$0AcNEwp##3Lf>~(KNfdn3tZ<`xT}1lF%6~DZxE!yzEn%nBOMR zW*O$Tc`xadqIt7_M%3Cm8N*MCnR*C5L0Esb(h@bx^^E&0Yi1M2gBYo3PCcxf=;*v0 zP)k&4D|J2H^_|Ag=^(#?Fg~J#(B8+-K3wxgaq2dustlHw;Bh#AkSdn|X4PMc%Q5YD z9;!&*Io@l`gpd*c1lH<&xcJh+#0kb(gP<48V)&KbY*{A!?f=8pI|ug?JbS~*iEZ1q zZQC|ZY}>YNoY>ZhZGYqB#I}<+zgu;m=iaB@KXztzw{~i)r>CcTy64j}w-*8>>HB2y zYCnb9gv>1`?+PD<(t1d+6xX5wHLa|-$_ROUG9T@@Tgb8)5yj-KVOpID!EpH+YX44E zI$y|`DgvV&!#_2+2nx;$;c+ z3O^j;7R^|m9!rwM1h&G7~_=R3N5OSj|LK#bUqbE|-&1rj|J! zSy`1A1t=;UoBWTElJtTk=Mjm;L`5`w|7u4 z?fn?V1@P@@${401kA0gLSA%bVVT)C}`yfQ8Ch>0Y-qNLzSwEfIlTsNJ^i#w`Bm0^;Rd#RT8BH>9_ z;~ENdLhnkNH9oib=+GDlrIk#YUisM zu1gx7$D{N9q((oiKyT@DP!(SlSguep&p=+JxSA?xC#kc{WR$d%DO;LK9a6HD~fkFpq zTrioZCECU_Eu&VWLsEOSDzCixeA%sn(`KwI?9twOrH|Jvh<{68Qk9rk7PHfaV?UdU zq6zzT!Ee_b#fKJ3?M%-ZU%qxpNb_490z^VUJv1zKfXmWHY^j}EQ)WNFd|w^*O! zCnulgAML+7)@9YuHEgQNSt|gfrK-a;I~{weibjd`Ph|A0cDbwDvVFgPIk!7q`>^E5 z_GCUMPALYM(Pf`)9e6X4i>E1Z57$!cLT6^dW0?l@3^+w5-C1#*%SipIaA<;4a?a}P z_!Oozb}c?tmCj{gmTYqHb=ZD74AmLL4+{O3WAFl&g{#ea>?!VK{=fJSG0mmC9L+1T zTAw=Be^`H7af}?zn+vw*bVjpqcZg=TJP7Va4mTWIMJO~+$3=mWdh{dFei+h8)V60kuV?W9&34C9NYCwx{>NN-Da8;3Ga{7j&bhF2bWd!ws4XrAgfu|`R>9DWY`xq~$J zmaJ<-x0bPJJ*S1-h6Yt*YiUlW1rICI!3-}hSv@85 zUB0E)9L*10eBf0*ks89?n#Y={HII5NszSj*l_)nO@?uM85Q(e&oY1g-NI~}6UQov3 z;MFklToFIkEiIKY^w520yc=v!jWa;RY+cvV49eMJ}!!If3e4z~u<*Q&J8Ch3H>buEt|+qj&mi-U{j4|0CbVyA0{mrs9f)_x zM>|76B#oMdY6%BTQuG%sc-81`G?BFYhi&$~fblFO+G4nNNE)A1f5QH}pjPfqYMilM zmx7c?bd>+H@}kK?;2^K^S)N5Y^eUf>nV=~pUlUUuM97|;X!}GiDX#p|mk@IUQk$0e zaCyYsxbGQEPeMU)suA^hYqlGJ9VuSNp(&^F%BV7*z=iYtp}EjGsN}DYdrXljIn9qU z!(ds*J3#N-pd1}DV`*lneR+07#WjuOwrJ_zfty#ED)K7q?NHxyenA;3vo#N?@V57S z>j1$Xz%h(TAgPI%%mc>Yueyod@82g-&0nope1!{AsTSO`sk`n8wZN!5c+iLX46Uz6 zu+mVGhQBkcw1lfrSG8rOmn-`|XuKm-7V~A4{x$kYD)EX@x<5=nG8{?4Jea8&eD^!k z(jtL5C=}WW-JMLrax7!rx+JQcw033Wut zLrzRNFc3n%qDmM}WD2f_t^`^X`ufS9cI?!tggIUTI8~9Ib>sG|6#7vrbAh+~=i#o- zaVEav4*za&8O~y@bDY6eTH#(39K)Pv;&{-m$$5vQeESy{nujxIBG}m%#*M}`ZI&Ym zFIJmBDWrBact&b{|0StTx$L!g?G(ZjN~Ce>6(xeZ>CpGO&qJxUOMnvIj^c9G( zbu)4GsD@Y~U#bRl^WZZ`hl7%k6EYKT%@J;f4CDG5tAnM4{KK}Uf$|ilCt@n;jN(y{ zT+*#TA5o*T&_biBSll$vcWBVMOC%|X+|?ym@kfN9=26m@VK;YV^buB~O+_R=UrvV1 zyhCQ1YvEsBaAhWU2A-_6G?lGQwW=hR&It1&0|Y{8C)k^N>m$CDq0@VBbp~d0)Rr2U zY@=eZW^D9;Pr_j~C5c0U0@SU6X2*}npG0GB&~{f5KTPq0I_y7bvuC!f$Y#r$LL-(A z&X3n!hT$~C*B^X9OaBCV6><}FyMF{w7=^I<!?q-O&~yJFaYT3yD>yYjfG~k~t<|Zo3ZeHJ4wKXBiQ%TAdm> z7q2qDURZ8yJF7C=>t@$(SzC{q?c!tbAjO%Z=uVOrEQfP_{nLaQA9bCmX#B{+lzcy2E0iaAW zkoM`8MP(P2%UNxh}0_4qRU}tCe@veN}-?)dk{9-a>_taYmAEzPIHDQ%fhM7lxLYvq$_QJhWeFBOkdTg^8OjeVyq z>p4HXK#+ihD;$1yB%V{TKpdT_#xQfkGxbNc?s9F*QD?akEnb4V$i7+UHM`%xFL` z!25ycFHJm(nVL(fF1-}i(}w~Rl|~YGFY&HBsg>iR-HXodyI(wMt{s$|UG%dc0#UXG z0PEgrsZok#_+D8GTWOwLK6~*~rcySi@Ve(AM_YyEYvtQlR{{8nXNpTtB`3GsnGJP! zeV>C1@I6v!le;hnXKuz0og>z-)d$KS_d4G2Xg_=2yY;sYknojrCuB$?y zUKRNl+ZDN^ih#zmB_0;wdyA1tdaIR2C3?o&y-J}uv)2o=O$kcxF*R074z{YUJT7*5 zG958JmSFr;Uow4eJHq_)pGlh!1nDnzwMb&87v9?wm--*~pOrn2qY{n`y6qVJhlb)& zqr8+MPrO!!!}Nak1AQ?$Nu&PlE7IGumUEln(givkx}V!Frl3OqrA5v9_F{K#}^fh1GR3* zTlbGL!yclSQF5;4mB0ShT8$@bQDgZwc&PgZ{@;F{CWN{7_X`}TmY?s;7la_Rl%~JX9-u9Ug&X*Vn>WoXn~)j zlBdEq1GNDOVi%1(27gsWon4?h9|k*EF)TQ*X7`>eX34{Ve1-uf2ra-uE$^>r3q;3W zG8Q$^SL|rQ4lFp(4W^k*nQWpg`$kR1N$YK=Q?FN$(LuGEHl?e48TATYMnFu8lK8-9 z2!p`vQ|J@G7=BckFdonEUlI=feLnh%Tt`l+3i|^r-r7QGF2@PR8`?FUX+zD$G1j5+ z)xPOkqLc39Z6Z=Nrvb%g@V}`@U!oRs_NkR^gFEER^Tl)dkHTd*~l2^SwXk!R-fx37d{_crV(! z9trh1oZHNfw&Uk#Mc?qNi|hnpz++<7=CxL-IxG`78CiCJ&=DT^xpR%gFTDFyJ7yx+ zz&XvMsea17tRq4p9tL#q6~?vanKhWK)32bQp+drDG$Nj}jN_wzFna7(W8ymWO7P#1 zSnrz0aDT!ZamkqcrKcFvdYkRl*PcsLL-bj+B)EID>>bR56I2|Fjy`ATyzM#>Y{86dJT4(Or^(J{4)`bs{v?<15LOt+62M-1-a3gG<|sw_8+7jJ{XUiC1ox=pp?EggpXzq2_lIQl8^ z+xMpYVq)0k!HkiEq`4Hq)vL2_gLR8c?yoe8FQW!`{)h|#Zu{^4Dj)xY;6Ok`Ko*hi z>A*isCkzS%g!sdF|A*j44i5jJcaG|$-3B9KH^zwoV)tlDjs#4wc>*`3lZ6$C`UQ(f zjZG1%R6-2W^Lba2vAUgClsrqiMR(XU*J~F0bh6l5lVWEv-~~fBc|cc)7%7Sf9tUPfiMlqLcK|?Wpj{s zxxRLNq+IlVSikiz9TDHXCPF;a-{B8R^MHyOgH2V5c&{LhIWH2Fi2SW=bLFljr?jeW zC#fvyHo~%W&Dof`fAB?=TsS~Gor)5Uuc1xAx5N7270B|6vXj;`;yF8>_RUF9ziIGW zpy@lw6V2>1T&|tj`3G*1trZ!B%8MyEaa6uUHu}ea<}?$!2tU83^~`;0N&><34OkaM zcQ5P%1p+SAyOKKZ-6fkq{`~tD`Nl!-EiYi)~EOa^L z&B@O`@>a>h6>uNScgjb|@4ositjq4v_CU~dxMp*0RL{MpWp}+o!<Da;Ng;N1lIwg8=<+Ii(;dd^z+pKfl0%fKdJ?yO_8-yV%?QhhutD=k2l?QNs*| z_r1VDO5u=7w3DBT7R#i^y>O655lJsh*27CI03w%oPlhaKlHr|tHYhy<4%Of9LtJ4O zZ&K|4C}V1b4)sr1;vt8P463M~`R%Vxrn>Y^5x|=nHDP2n{mh)N1O6Nf8NLdQ4ZPJ> z>z0C&z__%PK^M?k)2sj0p+W^mGD!!vrwb~1!#(CZo{oR1OZ49D$@SfI0UXjb=I`NA zk*&OMzBfvzRjCaiV{etoU^m``l{tEet;aN+kZW(3UfcJ1i9TnO#QzbF+SJ+hPY|n- zRy<*j=d^zqFVgb)1=>iTLS_fi;Xf9Xu8j_R@!cE&5$zjj9P+K{veT!9+(4Nb;=`0c z1FT$dD*hmzk|Ckn%i`+lp-*(e>$ZwlaBkC=Gem>c?YEJ_)*J@Yh+alNK1}*6JvhL% z=et-?0OOYQql%?(%P4l*gBJfCWHXRBa@L1E@~;izU*lCsfVL1^4rMra4BohnEDgDm z%LM0dMZMRCMjO!%wcu??ulh2p@t!r)V&@gEsK20u z-=eIT$Cn}T4ab@I2Tam{)O=r7$nK#*>&yQmBPx~2c1V5(JQ^Da2<^WYCl?DdTQi3L zDw+N>>=#;c(KsBKy%=u#mQC3q7vy9Tp5l2*)mT_k+j=O!$hgp< zOD#_e1Gl{>Z9$+OlD@KRRRE}W7?txLHsfhp02@OptwC*q+4r;gcj@! z2N`8}N*SnGlUwcQP(f%Ih3uw1L9vTB`6^ylH+Y%C&0Lu};4n&jL`%7cQr7F(Dvv&FOQu z23`Zk{3~{~LgCZ*D>;)^BEmLrA8AELLOcab0HxR$3iboIME)DQ`{NS z)5S$?8kR4@&g_la7$GUx%tnjm7v@~~+UE7%G=PZN9fOYwm@H^NseoXAaV_RV$31#o z>hI_nvMK5}zg%&=KUM~=eynob=rO!wdVoztUxE8^K4>s433|>q{e&Id>w(k>dNwo! z+N*c^wps3?QId1!+7!^}7hhpC=?Rad=r#>(ZXR@c;S@}q66X#cuaVNU@{ z)unWR9`cDAVNBp8K;|{Zyx5~mgRzHJnJ{xMRmW04yYqi?RFe_|y(0Xhbu0(GV=?gp zgwM!}hIedox;#&4umAOObm;8xb~1cgY#>h{!0-FeG<=3FOR{zL_-yd;`Ji&MdVj4i z@H!E9%>DJ8&;Ne8%5W)I2x8#-c@d8>tM7aNnlHfH@b@R(fy)b#JR$_g98xi<^|uU z?Ou}9LDADOpP70HVl>57^JPJ-emCaStE$_BQ`p}2vHigShZz8as$$D3b zn#mXT%}$T^l+c%bYj=W~1szE{448)=m%j9??;aQXjoD*{HJVuU^q2k0+D%fO>q`^a zvA_(J=F!wnXRaOxN*pyYEII;|vIbiEFct@-;7V9bw0uJ(f*}X$@QO+#;$8iGoEw8Ce!>dPwN(K-b`r_O7+V-A1c71CF$LYxbq`qt4p0#qL(T?q-pDSSO|ND zRFNIgJT3MtVWGJjJuLtoy=LlD9sSHY5v}7JXv%NtW-}*I*FK?uaZ<(3!1Q^OrH3x# zsM$L0w1uViIN35dq;*pk8NeK46tR*$%e8u`CJpDMMagc-s&h@eni)}T2_iL(&6(z1 zdnLsIoa2_$(2X@=%$)k=QI?$`YB>ruL_GH`rd1Xb&Hv94UPbTq1BDh51eC(5=G>C- zG)kvsW$MU7XuO36gTd)cMu8bSUWu@^xw^8E!QJ@MSH?lTkVWc^5I(*?VrtEn66BDr zN()G2YM42T$Q-b*FXkv$i>@>OGHlZ#MwB_?;8=8GoHwZEDJ78|ZrsUF)6|Fsi$n8pp{LgMQuw?z7unvQ&|*nF7;A}n1l_7i zJsH5I581qzCgZ$;<+xqm|5iB-AF;1rVTDsiesa>Q`|9hdmy6VorshJNkMyxGai|NW zYF$WA@oNh6iW7lafA!Hi&!DooTWGwdD^+>&d__iYwn_s+zh&Wi8GoW6g0sTwbxq`z zSL7&~gQ3#*;8I3ew}}Cal}g1Gfu6?X@u^gMF@u^?6 z^n}x++_%T^KG=KR0vHU3=TtUq(|O(+DNwUg_3it|PL1`c-nHan-BP=8(F$(&yhps^ zbTsUaq(5x^{FA-&|4}9Wqj|EpkOl#MG|vXO|7AGZxu_Z$+x(ZV|1V8WVS^EK^g8(o zuV|Bqp`@;ekkTcal@qosS8vp|df3ghi>_zD_ZY7=p7F9?s_Vv<+VPO)q9IvW31{UZ z)UsF|=eXf>_P`*|f8lbAC5_vJ7!9ra06e?*95GHz_O$-$Rq_?p8G0= z(%t>|H2G4>o3LFSzWTUw+F?|#c?OVI?jVe*oJ~xE3l1U7T(YMM&lmP@L#Z_oY%-zD zH%poCQFy1WD>Oz|LJSrhH5nvOBF4dX)jO%AfU;fMqU^{j*>#Crcq9`wgA&Z!+_H8Q z@sNXAsF`$#GEF!#a64og6-$ds6aS@kbU`Ojn=Q~msvvG$i!Ii?aIb$t3=dmlv0~?B z&O_+HZMGjxrrofgCR^;a!El5>M9W=1CPeWk4VS4UN56pWvPnA(s{_R ze>~+;%<2GZUpNscY=rW%-49NCH~W3<=G>wB6>gOU#WARaSezsu^Jov)m^F8%SebF? zJ}|~AXX?O&v|^l%K-mQngk3(-(W*srIaMinxAaRgAWRC?Kl6R>Ag%c!KczDk?T_U|G_B7xNIdR2T^ujXX zyjr1zMm!1GG9zWq0w^%8)Yw8a)q)WTr2~32ATQCw7kz$3q}~H$R`i};kxX9eP1OM! z+wv9xt29~}kltKE>eY%W8(qLTAWc?Cu3BLQ9;uEdhRKFML?}TqgLKG=lm;gK$P{uc zWnkdf+554t+vD&4xM$K(ks6z|wJ zpRK1mH6xJDHNK<>qc7Q!JdyE zvzd#_&w+98Nt$%}mzlFv!IS;R`R|)QH!Q6PFr!ro@(68drQi zpCqwiqTpo60x?+2XCHdJeV(oe$Rv0Oqs1AD#+8s`1&_-Fd$dFiuF`Jv=ezEk%=0W-_Q0B()xQIl+YAt-NC>N#2(II6uD$?OIynW?>re=WZ*M;1xB@R}TO9;K&< zE2U<=;Ti^VV%SQfor{mQ4!;cAg#@h91ffTX0Cei?7EO0-XWaA9EXd6WLIv>BZVX@z zD$F-ot7}%UXlR+Z)rY1uuba9oQa?Bqbrg4IAgMx$S2Z9ltbq0TcDk|+nRYbnw3$Z|i4jEBaiTNE`}+9`vPt;DhG zRda|Q4Y0_t;x9=}U7P`kCylXYWUk=;j)O%~uaPh4e~kW-(XC0w0v0{k^!~d?I|Ro5 zUPP2%0-b0)@UU)>({x9*=e0E)e3*QWXsN)naO{Us1fr>bbNei#9cFZwZu85esvy1kMTyDOt4dqbowtxY_~ba$)16+up(?l^s&{D;`Q4HB=$ZuY>i%x z$ezmF;>9f6P_)9)q1W=!hhfP&KLMz_TQyMma$iQ~@h{SSb%6EwAc5rM6EYcI)}d)g z+}e;Og{J%~RDxY$42~ApG3t%bXB7JG6JQJbHF42c8cLcU|*JlD2keAf>`6cBh`c_$RvvHgRlM;eusI^*~7nmoB_Q_meqPWiWHpzNF2zUwA!NqHHu(?HBAo= z3ik(JlIrLC_i>#$aGCpbN6)Pa%hJuRll3>t0WXUa<=7#v80f>qZ{+*g8zN6aqZkJ8 z+0+soXZ_*NKxA-Uf$|JNG+&l0Bpyawd>vvDF|1_Xrq z--eO9nX$_Mn7bFba`p%8h+)@YZv?PA9Qg2DBFt;1ftN*MftL^f+v})mQem?BgcOfO z0|V_w6z}B0&S*{EDY7D}dpNfEu)#w9kEgBU&a5pATaBhmV^OtnHP`XdA}4uAL8Pj~y(+g zna-wq>a6yA?q=7O(fG^hq8WhymAd_%VqIfzH+5B`za}BjY#a0C>YtGFb7ltqkdIpW zEI*4ri)d=XjV*cGPd2ObIeHD-vFO_9Q5B71{oK^);uz-HkTYg`5scdRCJ)99 zd^qKXj-WzS4TWDWIY9gd?{;0eHM1OU^}CocPJ>rf z^*%3*7oD?}Cy4jMW$by41kvYy8ZhxK{wW-7466RnRmZ8~3p@9Y8U$!J?H1hokKq^(Dzls`{iZn~3I!T5Nqty=BEQesuh$C*&N3T&n=-z7vk&3FI}vI-*I_f>MlY~Y2b`wab} zsy8&NAdMuN#2y3}k^z+hk(dGzqSB(40)?=)MzdnzRQ|iy{S0oxP5GY|l9u=6KHg8? z!4s4ug}iXMD_+L-X7$p)!lM?ci)p236+*+oALJwbNe4*G4<`g_lOf~BJuMDcc}Osd z7Ip&-aU1WYJxclqho(RfLq^9vVM{SEHn5tPC;B-pB3~73{4P^OWZZQ5QSbBDK1LFV z#j)#bBmVQed`vk8+C&ubK7ZvyG-5@Ij^dj}+n)mkyUjrV_vaH}(6Dw+M`q(ukI3uH zLbw2}IL(khQ{?hKVtyFKl4JXgoKyY+PBcK4vY!vmUJ*ZaHBQp5Dr*3*nJFMji(E%V zbLSTk(`3hY*2?$MY1Quo*%*MZB{YH3{EZ`Ym7&j+?394x-=}SEhp{9%*?l-u#Qy!K z6*i{t$Z{EKc(F0c!d{{AMJZ{UIIYT(_^TT2E$Qwrd@k{iIkkNm<8BFGZcUIA&9++!4gbeP26a#}=4l7uZ z1eQ01Xp3$)l=oYr9xoXP*rUw)rTxKl1wk1hknyA*nuI9j-TL}*Dc}g@^W3v{cG0RH zn7@9dxp$Nf3|c>dZd4Hum{{TCOIe=_dXNqbYNIp>Q7B}P^@H?#-Ce}qNQQ)~2wEuJ z#fy4)l*X8)JU)$k#BA*Stgb~~FEy|4>G6XCloAzE^#H!i zg>q0|O+AiJ2mwVVByE6%dI2>~T;teS!!*gpw7*;%CzYqp9db;%syMCIt2kBlB46gy z<2xv!uDDVy?HY;vaSHAaNpbz3}=Q+IEid3(CF{(O6GYi(tJJiW-5>8owI#|9f(t8sf%?Ky;- zZGs^1nNwb=)w5P(Q#1ZaS)QD2@;mu~3TmWR9a$={0Bq3vxRcBU5PkCfm40JV*Gr+* zHIjD3pMO`DtI=5#$S5@~<#sY=WNl;BNFouZIWfu5XLE1Yvo0QoZAo$`@!}b2VfJKp4GbSKHW+Z3jSV>VK%@4r+$_DYz%FeFQ(yXXyS=L_qE4buvmB0AD z-ej95+PCg+d-MUo1ffR#t5CmDDU~EPCIt;WgtO zApbN^!_^Vrhds-x{W-3p?sgNgj9d3O3*?(FOZ*dpQpMuO9fHj~S(aY9>dE7k7YxhaDqV$HbYu~0yVbo6e<5I4E*h>vp`fkeocx9?C0r>K z@hrDGq#%b@4BJd35)QcO-a}^hRA*$~$tuyWplS4-aXyIVE>S|~Q&Co_uDgO!$*<%w z!`arcmw?A>IJ07E$tdaV)qjS=oj3P=U?3wKR$f%LRa_yQoSoJ14%eIyab%Z7X~Y7z zCuoYcnla0PHQ}*cB5Ias3Ne;Wh^mzbAcWZIzVxWJfQL&B0R3%eG|6tU0?&1_RBNr8 zf{!+IrBL7;%(IOh65UvjXn217kU}s}3iF$%8UP1r>FK|*GO_5V=jE4T%dVyyqOQ=G*yTcv(=~?jeL*+%l%pHs z33#rkt2-;DhbkJdE1FEOOM1)>-J0+Iu(7hbPP z<(Q`)8bF%IJ@xADwz8(C;TB~?r~l6{sXJP!TU|Nqx8-*eFk6P`h6*59C{w{{{1k$2 z7w?KHJ@Zea9?mdT$ZI1+9+c>vcwByCHHj*pBtoRdlC!WwIF!NTjgUwbI(G7-vpRoq z|Iu8Fu&P2qh|$a-*l@6pr>iY%YmHjRaR|`!D!^Xgw9L?Za(S!zuuR1JOF@rOtIrSqDHG{#4YWr zxiQzwZGQ+VeXf~~M_?oD-w^=FcZ7dm%m^1rUND8)Xk8>6L8m2TwQ)6lz04KI)_7cW zGM&U25M#;i^dMO-lL6YprJg>tCbT9<${h*drd8|Gf2sDd@4!pqd8(T*!kG%wyeEcg4y=B z;8zPn85C=oLrg3IhkOv(Y$kVSen&!4u55R%)$z*ZMoD4S(pT~JwzAY`xIvN?59gZm>ui;7WSTRRJdmV;tc4K)lpiCRxI zWG@kDX6*Njg`om>D`<8e>TOn5R*e#fB8l)N-3Cp3ENd`qmbsKTsie7i8M%b%i@5FC zXCI@hj!yLDhPPnybv>q8tSyRsC=xgU- zmrZau>|Pu3xD`vL)sKebbKQjtC#U?0w=WjjLmG?4`N`z+IUY|Y2!5L*sIiW0;a%5* zOuD9?_^BycADhM-Ehgz|xPKf@aY&i2HOE66GD-w{r}J1wrO8t@TS;xpO3>0=c6u%O zGyb%kol(=!&?F-`MdN6Dv(}@bq0tY|M4Vy?62eU}tJ;-yU3ZO|&tzJDk|FhPYwq{x z8CrF-F;4h@oQ%R3TUA!*XU`NPPD z!jIaG+~t1VdhLJh-D-NO%)!f*mX>FZ;QwlbL%{%gMOO7%=2(y;49L@_nE!3 z4sV&dRoZ165F%1tKezFAs^AZ>>-%)W5Y=0r-?EpyKD6(%jpuvHumyClTLmhek)XT= zemnJ{#WEn%VjUhpOp``+R-GmJl^e9buhifB%z=OCFQ7g(s8%{ytsj zZ&ugy6;`9&10aH4Eo?J){h+oo#nrm@P42WaIApR>%B{@Tl+-d-F5l3BWzNz z@^3u(5@+Y53~w2fl8(+51DF3$BfZy3_9+G!>x#GsaimPoVkAB9JK0vNZm|G;W{eWEY5={FVrQ2Dv0pg6WbVFXxB;s)l04r$==RL9InJi+w>Lvv(n z@UVf`DcNr;QXJVn*K_r34*NW_$O1G+H^*$G`IkaumI#f5pSPkvjxm+S_8Y$(92VT zzTZ{>;*&F2I;x~yMp@4ovMzDI8k?DNICTx&Q4;TjAAZ9 zuwKbdP1moOwf<&r&PHM<%x*&%|M>;;M^9hUfY?GvThHcqyWL0(mi&#dT-;AsaooX8 zug72EuT7`DE5FlE(Ir+2>}N<2&xYr&_WRq_HZM{n%*H;SJ_r9MLZv8?YVWI_RdT9D zn|5&SUWaKY%dS+XiokLZ6uczU!8N-C)HsGYpe%Y+6Oz;Z#_-UCbNMB$()x>j5QtQ0 zrist-hwL{2O=9tyI*kO`y!a@P_pRbYvUFTU%aN(fD_7xmMqtnWp*4A$p`~~jeIO`H zh9|{1){BcDt@LY}Ljsu1Q~u^|PW=s}x*wQP%hg%0=7OYIIW@#Ek(UQDWE->i-{$6~ zKXsn&ey`-Fh0@D|?%kXPY!7&7(D%*Kwe3MC+|@)-f+SH1Ec(Ou%cy_z?8l>lj-ynh ziIMr;Au6%%5}(zB#e0M*UM*vUzKDFl)fS~VAq|pGUZEtx71>V&_L8$0k=bjd0=0CT z?WDR+i*ae{HC4KcTzXlSvA|0|!o^kBwfaBS)eYnlS3_e!-`SRXjdCsXE@*Sl*W3B! z4>lCJa2TV#Phi;6aKm0wWgV^7K5WSE1I?LKv42zX^8-d=@~ zeFDFCiD!BybFhIv1m8WF1^PD5Sgv%8ylM_oTmPq*gC~OT*ZkJ+zreq(GSIT})!#D> z&sS=i@Je|=MZh@^%zq!h^qe5%5f+>zmCBG-oDZE~Q}mcrvUxs=02QbTGOGCG2= zs&v}4A(+`&j&cD<(!UXN_Gh~Ud)~${r5o-5a!>kp^D8(G%#63M_iJ|yQr57t zc9eYoFHi5I_1~9=8v2eEu_^Gb#G3_N2XSs(E++-#e+(0wsoYSfrhS72sTmmDK{Cgu zNO23gku!MY8sbeY+Y}jmyK@%MO!6V37&lxaw`V9}W5D|Mdf@o)GkRQrF!1Y5`h&n~ z^9cEaw^2g9h_-Pngfc+c!mFr3Vd1ap6gfSzAs~ricyDVWFzLrX&;Mu|Vi_H~tb|kT5?@n7u*(~vd-I;p^ITRjBGKx)k{}IH}5d`^T@{f3hIo+VOa}`^XfI@*`vMqE|yJiE4;<%1@z|= zX&e?@2zCB84l&Rm@x>nzUkKzN3l`g5Y*O@!6dZP&dV!vYMx61-t8xt|6xdRzAft$INCNgS+%Oj(A!uZ< z9I6AGsWm1yRqTWMySQ7NgL{gXuC%Vv2R@yG$`wS zaxrnhL5YdvjBaLJ3brH2& zoyDz6S(kXHC;&C|cadrRJc{hIzUQ-;6ek?%EZqObRhHzyKnq`$It9pS&BRIfRF>by!!>w;aQLMeAl{;cglJEq91uc)b{3uXpw zp%itT{FkP4cSrM7W$>k(T)*ufK0|8Q|4-7sd(9}Qf6ar>;nfJm;ab`<{#f6mpNIx+ zE+5hwVZk&;H$(PDB})*JsFA}Jz5Ge?RNdH_gZmfzz+-S_`EF-mgDK|yQ6`Uic59<%K!Y$Y`kC)5T@;`Yjm1ZQ^$j*&& z-dIbPvNq?Wun;9FK_gmB=nR-|-zwd>=J>!ezUHI9NYspI&Pb1D% zXKT~V{NS2TQD9`QaO~_9Z<3Kg`oPToTUl{{j1e=lJR{zA$sEL{e{iV~=XQr(N!xEd zXzqFck#;3<-Ua;e*-zome~`CDjJ2W>vr!VHUoH&!)_%0}{+*^5f1H)%nPBzk*u;Yn zLSVO{d@^%kKqCeYI>lq$bd!T-6bZqvsF@!LX+fbv&l6xV$w)zNv5s!X3nCN9XgS4| zu}=kYe%%`VaoiQd5}DMfb{GdXxlRu&l#h@&{hPBFmVP@!n1m9m6X{KuifIbK1}t}Y z`61NJjM5+S{2C~X>Xa}RkcDY-q2G1C>%#&8RE~6NL^ePoXIr0u{GvdQ_H4yZ4s`_A zah?iIe#3hUcL1q$kVjOGS#`8zQim#>pR3GK;PJfWvI+-G#6*XcIVYn$^~j9K%gecu z6J4g*uoX$LqK^d zk=?ex20X18p6%~!--ke@#5dar|82X1m2_nrh2MayE5Qk>#q#p)%|>`GN(NZ}Up^zN z$mKsums>HN-YcaflXIN-6*z4PKPhQ^pH8LY3fPNZW*B>)`he47bn)K^ck_rSK*46p^3uOIAx72b~+GF=F*7<$lf4UxWm3oTB)`497>4 z3xaNj-i{7%-Ckq*7|EUppyYGU&>1uvseG^BjAfkdqDkA3GUpj{jKS0apYQ{- zIYW~k`TNc&UWkC9YzPYuS~i1vbzSw;CMe%{{59z}9carXm&z1wMw2W;W)ry~(ZbYtmj4abeG;P7CxeZs zEusKzThQx^ot;m8a5K%Z%X81b&wGQ+BN$^!@Ld^Igy5CC$n7h_$ zGS4^BbXOzr1c3fd*sMPJp)% z^fb2KD!J`&(%>ygO8B+HXo@Qg56oG_I%M*u8!4|0SGO)lW*h4Nqw6iB>WG#oVdUZt z32woii$idCmteu&-QC?Cf)fG+m*DR1?(Xh7H*e;f_07D@T77?XuXVet>s0Ms-KWnk z@E;yiVHb-UW||Edo6XrtOGJ8BX$4zO1uPsuvQZ`6kYz(%R@?#Cn5!7+%UmAZAgy>g z;2{#nXgywXWYj?b9Ju!5g74eLco?=Xwm;)wp1cqe5YW#+gKO$|uzn~;(bNSw>#oFZ zf9r@6H8|)tdfLe0jFE-?t3K#)-5f&%@`0T_XG$;94{rN}DptKABx-%@smH4G9K51I zpS2DZQilIXIu{SW%Qa@omIrr|uKn^yk-?*9p6+XX7S{NIYvH+A7bgT)Cj(&2@3%h# zaC-|%2GWpH+M@QD=nPIaEzAr%EwPtP54;v#F@P56n~q+bon*@mUl*l7 zG+p=AEK{6tLzM)}Ddc_A4ZU;UY}?>wQm#(&Xq+lE%X1ngcUYi)F7a$UJ?LsyV)Q^R z3aP6=teP3Hh$?S{I{?ySr+($*fIsg=1hxX~N8jR6n>G zn5e&+i$=_e#@s%WVrN@{(s$K3ZYU72H^F3Acn~hW%$4PnexYbgrlC*FBv1!MAwUXV z6n6aM&##Z~pAWmsS|F^a;6XDq_Fn=fh(3+M`{+{i2gP+_a(Czk2S{4IB`5zd4unRz zuI{Dk{n=Fyzh-}9uZt+7w?7yF@$r_{{Temq8Q|Jzee|uv$GpM5hhk;^{AycF26o;- zE_r~Kn{wD}*L4{L@;P9hhqy8mPeg;}TLFMnxhMj(;PeTrLi?+tKx%Fzu!AnQPh^;g zvfDCgU^2+qVEsse1H}Fq@dCe8ARtD)(y&61G2l(M`dllJIznCSZJN)+GlZXmgm$ZM znzj~;+DXCF;|t649YS}JuUcWeUL*JFOHd0l$T+A<+seB4*6QJKU4C*n13bEd_PXmn zUMD_w^Q_WhveLVmf@`Fqn_$S4E~b98l`lVoO$=g-Mlcm>#E-viOffT<@q0fzarEQh z^~3+!pya!P+pBHeML@(ZSV#sf0B{h-#^PZwMC0sVVCoNkPXN15pYWMaXOBWVp!3nM zX0#PvnMO{S39%fgrmO!`|KuI3F}vOSe%8B)wxf5KNSQEQJhNqU9$kl|^oawNKrlkE z7YIbe9f^)n^In zeAbJI_>e_V3kmobnWJlEJAByP->L2`;nE$3_JmB!@ZwVn)*R<_yB!(%W9kxJU%NI1 zC{KHzSR`oo^uszFpzJgu;Zl4rd56k_TC7P}_Sv@5&O|sDRq(yL2gTEm+AW3eJzPEl zT--Bjd&xB0eurQ=6e3!KGM&+oz?Ht_vnYIdZ8L8ao8l%`()(}%-?hY|I!qe#O9&Uc zz_PaXl;h6K`lMVI9vU?DAfn+->ZJNO<@UaoQ+Smdpqq&dn(KF;=A5VIG#}Kj`wu*F)8|#wi181 zML^Q|Z^o;8C=2goHw2lf2l41r{?S0K#M( zQ?sD^ngCWmi<$JjU{~@>neNAO?X#cd`uvIM*PGe`EHQKWze%x%91ic;V)R*G$lpGW z5D^eX0520QIK+kuCe}x_`o$K!*MNw-g0$B9PueGhHSgwx^-h%TT0JJUem!$TBYi51 zLV^~X$>-tE@aZi6u!MX2R2z9es?9M1ksM+AFFi|bQY`$1F}^pV)OBqd8Xyy}&wiT% z!@4K>h05@KXH>|BnK0LlqK~38bDBg}bPL-B?&9jeKB_(M4VK6Mn+E1jE$)U1v<9*A zS_|G|*VelIV}-D<88e=4{`U|`M&z;0IyO@MVOcIpm?7|*Ul7#+epoPL!<;+Ifz{>+ z5B}BqM$@oi#5Xvac8IGJ_h>6g1<``h>^HoyY#NJyGTz|)n+TOq#!m7cP=M?N60+a6 z6+c*QC5YLPLe1k#g<0b^TkPn*sbe7Eon)?}n{e^%)#bd;?ytKQu(IoY#i{`%mCt#x>MC&b&C$^6A$3tD_)NX4?i?lj^%Y}sB?OhNH7cV_ zy}~mOBVz+(MwkAO*a{M&F3HZ%B{kZj;?-!Kzdt<-c3e`>`5q9wj48`=L07DKaUA zu#eg$_2|`bLJ`B%^TSI$8XM_aLb;PYTXd=|k8UZWgyngx3fRC|LXclq6BfXjoNYaT z%$_|kbrCm%|@(M(GrR z)jvzs9%$<8(Xk6z?D$t*QOpovLH&VKqR>XyzUyC4sTJ~7j6Woe$c}=a9rx$=+Z;!g zu-`mu5W0dT)U!%zx_;9S@cjTYROWX>N}Z?Ds79^Pp68?`I)ptZ@-h6(jwk|iC66g- zPavJGJ6lNyCik55hBXUK%{JTIVo%hX95| zI6nEyudCIkt0453>a>ELs#gRPHh%SI6;N32`I#?J<;mw!xiH}7)=Z=3%9zZ6lc|jW z9VMENO~AG+iP8U4SOfg} zQ$>Lf8IdzbxFineC5MtvY1mlMreo_cg_KwXokHl4U)P9;-XE%S^Ls(8ybYkguO4a@ znNs*H`0P7_qzwguIY0pQnc1M1PdB>TMt#%b_1yH%Ld}3ZsL%ZD#T0xq)eERy6iAR27`o_k6PKP{5MR;C`UK5SCjs~F z;)$?7kI+*on4an;g{lYpl_H0qP}opXjQo-4(O>U02M6l6hsl=s1MfvbwU%Z^vi!=x zAC@$d5Cd?NzIXU2&tj$mOwf`%whFiC!3aC@a|smP8w3eb zBGAXV&wND$;foDmcO!SQQgQN$S5Tyei-_MY{kl6Z^O2+Q>nFyLt!-7^oyI7##n;)nZen3JLvC2cznwb> zD_pKeXRujykA{#gf}8aUppH`lYVh=I9d+LLf6WJog#fpB_;dNaP@qWAS;Ib}Epc`q zH@ctP6zqbp@;hOzxU~yq@fbxjf;|}b2!4vppjpwN8aJaCPkkd{w+iG{1d36#hnHtdOSj>a=_S>LmA zc#TMnSOq3bqZ*uELqU@A1Pp}V&+zpF+(fb?cI?e*8<4~xiGRhNHfrxsS{z#1wt?Vr zHA@aSqsPw9Pi6ry3^ar*A<468J7d3qMZ}v}U3YWN-q?};HoEl08N{s%ml))DnHr!w z^dmR7A(Tqm#%fEw%b$vE8s&DGs4m><(-cyp0??!Io}qQ2|8wlO`&FNf6r{x_s9;DZL~{bRRk-j0kwKm-T84Eoy74 z^^MwwSac_D75XoU8XOlijZCJl0y;Q82%r@!ygb17J~aC775ADl~m6Ziy@YTg0FUBBDkV#%8nm$DUTnD5Kyv%ybw@e0O zAnQE!;`JV*_Y|S~uIDncUPj9nc42l_iNA*a@rCcl%RK@;4CF~5-c<+kH#aWOHzy&O z>*=%_Bwxdt$b$_H#UlBh7@Xtx@dLr*&Odo=12Nx7e}MBuW`dT#h?(BKZsgKyoW><5 z(|o)}6GYl-%u2TmUCF6!A{_S8;wGMN8BF|XKH=sxylF%#L~!qtEs>q}LJO>Mt-T*r z%tsNM!fx5A5WRn%Uch(E6O(p5ulcxR{4nq>l673P%u23 z{DbZULt zMeZSoJLYMx?Lk~txHFid;ZNPpdz7U3%vU}q{PQ`KI+iBe8gb>!aWmy%v|-dDs8h`0 zW1GuQ$S&+2A`v%*6|8n;tIFvS$TdCaD+I*k`mA3EjEFsg{r!VwZV{vKyjD|JgwMMG zB+Y$NxD6V_*nvfIf-`>NaD#}7{dnh;`SDiHqb8?a`5j-$9`=-WmhZkR3Dm~GprAr_ zj^nb6cy)&3E!aBkcZv3}_TFr@%Za|ltodl88kX*yYLC>fV6B}`w@Iy-=qvb*#AO2{ zfHX@rDS9J?l8M|UD+rnMKXBskQH9!L&1n4&KIIP#$i4`D0XJX1HFueLb)Wtu^<2q) z^hD$9aW4Np-W2a}LFXuhw6Ol6L?u8M_>0xj;77IpXF-S=NmD?HTpEBHS;zS3a}#{y zo5^VUQ3~J0tAGJa$#9HJEZ;MRZqA_3gsAAw>l4eai{6#4nV=9+qQ7Q)FMMdF+G9S zkvMkL-lNE*!zW-GlV^yuC}9)u`>2S+C;3%TrJa}ESBKz$lF*Z%5*D@k1>z{lSm?Zr z+L;aru{Ya1xWd9_s4U15J&|ll+)}P?LoWi`GyVUAV6Ue*z~a>0y~ot#HL*x?{6?O?Buzx2MeCn4jH67{#Xn^-tyoOPZY4-9>D-asg0rJ*#bYlPTTClioQS`^9gS_r zbJTwhS2Db`&@ zvFg0?a&d@=o73)KO1-*o{aN=xf#`BCYRLr6h9QS@VH-#oV_J_l={FPyZhM2-#%8MT zuH;%T|C+pqw#KfoHt4F)>JTc4Yo$V*rrOiN`V@8Bina*{29+s7>vKl=M@p}>wf;<^$+Edj53ydrGc#skhNX*tFjPl03 zN_YqUtePA+k}(YIzX(Fl%1=^T7THKkswIKR$Degl+!)!eA3AW;a$YR&$D!1uA4S|14TowjaCi7Sv0) z4DSxP6xU$;zU~ltR=E6NU70P3Se3Hq=D9hTcrZ35vyZpxfB!N`H%Z0h?f6k*c$4GCutMK^pKNxQLR4uzzoh1A2P~Ey=%$RfOaY+gTVMF1;OA{ zKn1o#G%nD3P>c#Dpm-=h0b4?6mlKul%h)Gf_H}PUCzPK?O}q=@QEOZeg6P`Qfou`L zKk}I5tXEzGM*#!^DD201#A_viSQA`yShtH!j;WTPD74MWa=e1yJCh`YtztlVGUD^t zLu7GK7Tm5yhhXf!3T>WawI&wuA*-q1BZO2)jQ%NPiAI+<)2+sU8mN}vj3IdnOIWjo zOx;I^uUZ7Lm*SQIJl_**>5HWGb<eoT!GB? z>PIjMA-qMtvjce^efhWjg$gE4ly4W}^?lkAWNea(5{LQ`Uu4pNI_tk@G!GidOK)kO zJO!f&mWRQnBwGoASBbIwMyHN3=|!-U8rHO8Hq3AWJf86|Lm1Uo7IX96 z0GXtt{l#8d%;YD=@SK#4{dnQ-8z9RuviTlp1k-}M$W6ZbPD(H#c-^BSH4w+2vtvGj{6ciBZH*AEn~X-faVKFQB$@Tp>lV33%TQ!YgvAahOU`o9sY839V_3tp zZ5{IYc;SCs2lDX6Ch1`+L-JpVUD0LHM00ueJu?5f_rO@1mo7iaCv$0p3)+GT+&M4- z^Me$pLG~nztG7ATkI%&C?EydsD|VSEnlA)DqnC&t&uDnWmu++7N*>?f3p=PIQ%hRD zEjud$B`{!Z5vN1C;3_8@%JzO}<0+ZihgbJ?4ZcEfz`OUq20$Ua9wGh4;3h zid*#BKl$Iq~%L^xn%#A*ud(79;V>V1UhTS@b&=?zvb{SZ_m5s~#sTt3peN3G%24&^Q-8 z$$@7lMipzb(dVsTZZ3x3X#qGB4>mxa4tIG8%NI3%T)_4|{yv5n|M#+#gu46Gkkc2B7YT``GV!qpPG@yR|gM9UHx5cpbnRg0cK_h z6ljrQkN`3@e^R}y)db*!hk1%?N=E^^TGLORxOcQ(9D(HCAW08`d5H*BDuu4RZu8t$ys8MWgqOO9J{T4+!RF6k-Gty z4Ek&1RQ(lwV>90jtrbA;^Juptr8_j4mP#k*9{dyk%d4Zu{CG^v86wj2Qdla2H*fAE{%DTPBD>EPpQ9ixfYoB)*UdxGhpj7vu|C znw}1FY+K-s#wZR0wpbQGpGbQ&?pvfz-(vN~`pbBLX~YVkHwY@jc-7cov35}zU3-2w z@yWk$dtEYwaK*_KKe!2|oyK#crEZ&oOyO!;cFFGRhP$UC@k%yJx)x|35kK<0B-|2O+V+O2cr@;y&@$ZVmQXZ@fjxUh3WBR7Ebwme@KeQaljC#7Zw0T(Bp=%NJ3AQs4heCOAopLU9RZLQ7 zL52#?gm=p83D7K1DVCP)D%*QsgLmD-iuI__e*V`P=n;H}rC||Lp7sQNOr(&@s?pt8 zoOrv1%>ScSB88Z@!l~dL{TyY7cuH@yQ$*0O^AosQaJvH`gukPHgI`#c|f-jpw$b7oN}?(8dhw!oREMYJ9)h`L?9Vv;(b;_=K?ssw}uzm_AM$E{i4@lo8ejA|9 z*&b-&8JMJ~oJfU`Ucmpk4i|?6m|Fl^hwBS!^z>K6%+=Pxh|$bg-^keEKiWivDJwSr zS%ZskO8{8o{;J+!_2s_1dXH6r-LiM-o;jC#8J#2?Aep1^>5%&t>4l6y31&r=Lp2LQ zi!}V^Drd{CcZD&Oj?E<~GH9Q4rm0#sa5qg%vK=RVLwEm&zd3C9HEa?w#cA1i6igvLvWC@rJ%RYS)WWrO34bcI=Lm4S$SSEuJW`l4MTE0O?L~)3_^Z5=h(w$^0^}hm#a=I zwW#*+?_WjJ4srPM9o}!ad~I~m8{OhnJqT>`=~>EpW~$6Sw}(p0cJt1!20TJq=p-B_1*2fmuORf4wOs4()U_; zDYX+T=F|2*^i1BbDjXStCn0$iAv(J_<5!+EeV^%!yRn%#dZ|eG30=Mb7^%X}IBrt8 zOACQtU{xcXxoOqm;>>sJLaL9eir^Z~#m0n7(UL~chgRN16j%;I$~ ze3VrY52bC_?E6DfJcFGeOA+AjRU~fu{Px7peS%{VLdM+Cy43j&>R=oNj`Z7auBP*u zm42hk<5$`oQenO}eTyc2vv@$;PbXnrg4Yb?IZYdEue~3YO`Zr{-NNOkwO|g;Lbwb2iqx0Qb?J3+eZ#<^#2FRV+9jJ_CP*H)`AbS)70RQrS}N zmMh%(Pvc0J_E~u1b8>4h8^<4do1F|#29%bin0*$cDi?AfvHv~F*870?S@m(2(TQ2^ zs*F4Dg%lpyGP{I!5QzMBZopxh1a9sgZ&9c1?X{~)Mb({!VV5^AJr7ZWN@5aDlp9qG zu{<36p@Bft9`ztK)(xb920n)|^ z11W<1Ux3E)S8NRgXfc^Ukf;Fd9YNd$hT~ufl@TLm{n+=pH9o%u&Mr-_I9Z|Vdjbqt zbMtROyAT+ePp=bhCcAetlAqS&aYmA56o7Z}17xZ=sV{&xkGHQHUnWvSObQhe$PY*9 zJeIxQ>ngT+SP0dn@xEnHP%%mq7+RT+1FDs~N)*-3hN)E{%GP3(Luiee@t^&5JIo8H zYB3u;D6S>wEbMMsqf&5`{Hr0yfn(v+OC^Q?SK<9f1f4s>vR1D173a=FifKA`SKib#9?PPE^~GXmdh;1ANPnR9~egm4NddBSbJ*NAZBrla+e! zN6^XkKVsBG+`9G-BB^Rd7fD)^RX50ERuj>XR)qVCjl*%DSk{(EsC$~3R}U0^?MN$( zAOs{DpK-DO_EV=acdV%V%+Nor$7K6uAU2CLBLA&ox~tRSN!L?~G4Iq*c$eb}t55W4 zptqCAjs)4h9-Cxqf>(XF`X4hTG>nYDlHoHpZ1 zRkp`phhoQG9C*icgseK{>usIWpV;mvZS$qG?!a-LB#7o0TXB*7<-p<3tuFh#ky7X_ zGb$~|dP^a=bEZQhybiAb7&;Z?^SFa+q{J`7JN^dh`9Law*Vts1mfn|vT@xG?j@dOT zKZ80~J9#V3(PHHT#OpbudPyhV@YN9;5%u^XwG@LNacxrc^8 z9Tvd$z25y$wN!4(<-vImn=&`RdTCd(`0bpdfoX`K<$FfE8TRPtgm3HsWZRp=Zz)sx zAUf<>S!ckSjlk6u#`8Pw?BIm}kSma2 zUSz3BLaDlCKbFpFlW`m_3DD^+f=4kOEnU)+nqw34+%O~#nl_M|k8T}EgjQV4Ql$xJ%pIjW@LpgY+ znBEwoTv`FpcPha9)dOah(W$e}k_G3Cdv!|mO1M6w2#Hlh1QfiA}7*#LbzqS&*?Qi^y zg5@5}(g9so6%V1sRWOs+1b1Js0b5k~-RzqfZlYbBgf!;E=CxlMb+8wdCW;!moo5}s zoANsM0HbgZqPCLlR06S^kwrfzjg)rY$)OHhUv9jJ`@89E7JI|E3k!7w*BVX(LQ_NgUd@N}&Dmbc;no>5eZ9Y)hFhjFeDXkAfoXoH`hrTIT zs&T|cnEdf-(K_`b^QB)(X@h=DW_FgdJ#h&L;9t49y>saEiCAhPR?EDEN&BTSfICO`xDl9!(s=c+UZLvzqt zl{xpY=5bZD&mo#WkylA8j8OB9eu^bhLDQICBHGc|M$cO}FJDIHMSyar)yJ9AxmNJV zo|MKJ3TIrg_<2^wB0(=!cRTd#Dl$>BU|7uY%ZYe5jW|x6LR>CJ#69tRqh_jDbh>Wl zWic;<#m)6PKH`j>6Su`n+>vLg{ju(&?(MlQs3`w$mK%Q?NBA$6`zsx8?C>v^6CU&z z{X*+ppwd*3ziNv8@TFq;)(ls{ zng~pzCJhVJt?da&i)|wWSH~FGaPL~fNqcYYLS^8Grh+J=6%0CB3xdL=F&0f@|CF5D z7H@CO-@KeUy%XuZ#)|nf_5&-iKHsyeu#9IQ{0+D{g%tz$yETyp@sl%XCY*o z@_g+kN7OG9z2)r5gdR`A=n%)HawLQAA?$Qzmans%;9l-Qr#btu3LvPPpU{%JkTAV`Ef=zyZ1)BihF{w5W_1mm|*T(5Cf#Lm*Z)^!|fDy~LVo#uob2_a%^u16hG@=}* zh?v<&4e!|+z!?|59guG!;W%g72}&WI;i{E|Oofw`Y{E_NU^r+SWNj2Mj&RW2j(_rN zdOCVN$lUVEkb z3{CvBZ7|)KA>l3?Y(yvNnOu0OH~v@n8&f16O^DX^Ty-3_n0f$|atV-U9ks;-eTX9`g61__$uc~nTv690XV;MR)Rq zW=1xS-5GY>j<_1qS`PoQZUpz=&4bWOhMk#)$H+SPCQ&jYWhw5t<`kM_6T_1ClVHHt zi0Y&>Tgm48c@1B%gmp zc09KBYvbnCZ9cM_>O6YK{t!9K|D-k(!WBAi_#9Tq$Ww9c5%lfILrU>Lh&cjK-ahin`XCKb;uF!ZC<+v9^)7_|0 zM7KZQXx7(C8tc($w?X?vtQ;mOrkUh7&3p~|LQ8{)o63!y%wV){s&Wa>KaE#6je0hZ z&Aob}jLPfYKMyGNaMzyHDr47|@QqQ(S&PhG1`jr_3nF;Z1K)sQJ-`%NWC#qz{&<4h zmkYR2!@IA*of7`oQx2$*u`XNpS?mn`Q8-N@#QY9n? zS*BHuY`M+U@TqqClfaHX+Qu34F;`n5DTYP#d{WQhIN^`@YU4CRm)J2!Lp0q{#Gc1D ztQ`v%Z>CJ&w)TkB5I`O62dT8rCc^-8fyi25?0tNT%zz-zJ&G$e^({w68#=kh=Ronk zs}D}U5hvT1nP&{CpN!P&R3$ zA+ReN%DfV^#L-31^)1SA|ZM8xkEF?A& zvkp;rbHE@Fyf0AayxB@GsLGKA+7bnF=fJ5sqi=)k-)1DB&oKMe&}lf!@y-}F|LUH9K!^r5qzFD^VTe7FD+HySPw`p>`-i`%w;zg=IfyF73wX@EQ{;!}GL&tC9Ei@0_zOyRA^Vlk zt7~mQDaM0+iOU{ z1s4Sx#mTVZpcBM8GfF9Q&f=OjM5@r2H2C(y&ayp~LiPTs{uS!IfUOqIg;WT4lPx7KNNg&} z9-@^#tn=ogC3=j^xW&VgV5>vM7`*#uQ(Lv<*p4{{Y9D2h@6Y~K-)znA4d3dDp9@$s zO9v-qkMl}?Cj0z_Lnx!4)yac;6#&v`O~;sDNr5 z)!b9HNh_?hOJ_w%1Tt0zNW^4xt!O6;xM!Et{9|F&AtKQ-6D^SUiG%RPP!X_RtSk&9MXJquTMC3Z4 z$Q<*Ph5y*aLy+f8ME{d(0w>&?KgXqK^+PJPb=>de~g%gDRr~ISx_ktdlGS`NVori`3xhM)KC*@cRMaS6Z_pFTI#O%~l z&({~>C+gUaGl>jEntDge3ATPZfsKFHq~_4gc(LIE1NFO{wxV7XLdkDbonT5I3$da2G9>kKA*(nkghJ?%Rml;X z{$y|=b|229ArFyJ3LR3|+F%4|wOQbB?NmxB+&hGW!UuNcx3y<H!`-cIZr{6Ngj~j;STO^)FEH(F2=)8We`)^% zPt=-$uf$gyp!LlKD>n+d77VmH_rgdSin()wn>E!58=g8Q#ifH#+=@oq@CN9uGR*yc z+kTq;RO5NlC~Hph?c>PjwmIzgJr3#6mD#Ag&XmtT`KOcuxxE$Sq%Z$3XZ@#)|Bthx zCaNQPfQZnWZ@CwGbsTbElXk)qi|~!;&mdv7>}3p>7Tb5O@7bKp^LnBa9y^Hcc5-z4 z7>iCJXb&?m0oBO;)v9)FUKjj=y8%{qNHXy3!$9Pg*moJ)6x`v+NDY*)=S(Ne=ZxGIH(MJefZOmrd!2?!uat)4XB2_VKvrWtuwZVHy8{6`H|B^Rf?;34gsfr!kbxgc(9kLT zuuO?M&>>J?5fNXN(F`m?5D_7s5fNYZ$x<c&xuKt&{ zr2yFf)V4hR0hRXI7;6Bfo>+Qd8i^!tnwXdvHb6=O7FLRsIB$BJ@(Tg_^mN|z^cN+F zX{1Oe*PiLCwvVpwF8VwDqd(F;KMvgYn`$4%TQA&wS-9=jF{ZMq(ct0Y!2X}xVvvAL z=Ak5;qyPuR!^H*`-NX6XOv=mg%~pZdPKS-u-IQtBv;c)=qe^cqHKH#Q)fc z$OQ_1#uB>O;;|#feq+#0aXgq9X>vT+<$W)JK6KGUvB+L1#A75TF^9Wza{&5}9#kEkw`Y#=|@F{6ZU_0&H z_eXKKJa)sfINg=xvN`j-vz1PY<#XnF=-Z%Fx`W`zg+mY%z8H!PJ#Ls%)Mv9+8t&f-7dv#30no!+!lApDTRjdUI4o%F=O+*o<5o*GLnoCT z3`?^KET(eqq@FJHy=x0gcCTat5dXck3;K!4Zg7sL5bo_sry3npe6KN`AY7_MOn-Se z!@y>vj==~+BMmVcN)UC}8zu*NEv41{MoO-pklV#-0BPqYD8l!#gC@ShpzsFi=#CB>+O03`hWv1xw+ zjUVl7V{8wAunc}1q-&NkmdQS}Pp@V4(qN7L>C^7z`>KL2#L-OgLR4mOvVW~aJV^q( zwWc?>p5?#o+XM&M=K)qz>1=;{sHoB5(+29>WczfG<7?JicL^7#_?d|2{k-Mc=4xAM z_lGN)U;qGfKBYANp8?+K2s+udj9q3Yq-v|_PJi_ELaAzvCjG(q562c+_Dy#Pkltsi z*VDD+5wme&l%_&hn9x6l0%WNg8R$+w$3`GIHGABZ{#LIRde>}HVz*lCEZt@2G#M{V z6AS*CO8s4PIEA)2xO5;2XJ(0_k@w$Ohb;seTHz`W(*i6;oh0Ltl%eS&Y2&it*r(eg z6>9l7r*26^QJ5;;pv0 z%BL{uR^Tvy==_n(=5gQlMCCLHg(U;!Am96=VTpE81W1)_AkVuI?cev=C=D{q70zSo z{jxWU%P@par#0>KNZVnfhXoaAae6Xtjt>n;?IN5^K6_Ppt%m5|81dKhD1^6@!tD-w z5u+Jw(k5eB)B~|ZC~p`GlAYubu;PrWrAf2DRi&lMgoF|0UExSw|A{wYL157t@ts%u zIqcTUWHZI`se7fD69wY2t?s|@Gs6K&MN;JT77Hnw!<{&&sCxMnry2ipcxNW;3Kr=8H7fkA(a)ms@i{ z-qCT30>uz*fmn3H7>zAOFyOZwvCV3u=K5HFG#-M3ozg%5DnU#GGD1vrkfNgp!*M8q zoY`Sl0*=S7lR{Hj7Tryd*km+KsY&Xy`BZ+e(RkKVABr~VKT+C073A6{bkvqNIK%yI z(MY4kDt(8bKHpQ9$6vObfPC>-hGZJmgp_hk$rL(`?xg_Tf9Cz;S5ORFdq8)lHJNP* z;oRR${5Gm07O!=chf3gUW02KZe*V2ILBMo?Y5+6-oY((1RTx z@0P-6CCqS~;$YdCbEV%>K>;L@!D^nhlCG8bFXVCin?=@6>KrBA{BJK0sXw?~79}i8 zr68VBFK=!VzdD}`f7A6QmrSIXD^_gyC+6r$gM7NYSw+C*rS9=?PG9z|vcbPWB_0q( zzIk!MIF`wgDpsoLk;Q2rbrx0rPb<_DK=+ZtLpPE97qk!wdDMMg?!E~k%Yq7mP6UV& zrJ{s;g0B*vRhbB$IH>=L2kpY36hb=}@I2b2Du#iZW===&;_qvfi zS}xDroyghvDy4|=&kPoZoBU-?rE`F%+hP*!bg}+DhKT?Cb$m4t;FZ=%nd3$BgWEM_ z7aW{V#$TB7A91lk3_<|Wn41#i;@ts4UO@8LUt25C1lna)Br7*^{d*%mkJO7bV*Lw+ z{PzA{{rZc?>tprn^#~)g(IBe(1$9wbb*@FD_{@4it&R_{osq9j#s*S1u22toh+ofoUQyVj(97?R38^e7CxxxP0GR8_tzX zSBLZ=%%=sE}z7ByHo_DqO!3BoYcz-mV z+#6IrDbnLGnJuBIO8l`6j0Hhnk6_IT3J z-Qi^EnzF3$r7EM5{dzH)poRj!+5c6Hp<`oHft17-qH@-Ken;c#8tnae=^*k!Rgo(G zXKlBb`u8q5U4EG%U&sUzDdUs+RoP=RDjt%{XY(w3Q0zsAd!@EBz}oWXURRM&o{azC zuHQRNXK9b=E4fPbxZpk7=;%mE=qw>V4Se7BZP zJ=gCOgOUh5CfzR_rtf3cM+72SczwpnWsV0i1U2p>m`gS8wI;V-r4cxaBouzY+y6n= zS3gAk23sR82uMgucXyYB)B@7orP3`8(%qnxbh9)_cPo-of;0jW(%rld-+O<0_5K69 zpL%A_oO5R8?lGdwCr(q!#juWl-pPNV0Ffl=F{6B=OB$G}+>aUPS>;x9(94`1m2!~6 zWLTDhr>V#$e;WhlAvc)L{V4zJx~mJabacA9hakfWHcYLd;{E;Yxo+R}LBn#xKcj^v z6*#FQ(h%G#-^=yq1TdjaQen@0r$1+QtO~QWs-NG=G8B|3KWEWZzq!5L6(%RL#K@zK zO4H`OJ&x5ZSb%O5RahmJ>6p%Z&-tKMAe8;@TX{%Sf}~XH)ppmr4WAuXp(J{B_G&Oe zLzsgJ!}Z;DDg|~3Rm3HP6jqCbq!#M$^mDx6-QA7HapGq`!~;@0;6UfL9G7(1`*$`g zdq6E2F=$Z|8R{I_V9M(DWUhCbnD(VKnJ+V$_eBmh22$1j%l9vx-0}96oA{rz=~72N zXG@YxX1(l$QIS!$hWQc-X{+YTU|xp&Gr!1ma)a339DWB5^|&1FV~|Ncq_O<;Iu|N= zTlr?gsSn9mw)DtUwKWuuvB-Y5R`vl? z$t65L>Uo0EYVLp@0|_pjb=xE#PUUfOz_9x#@>phgxCt4;kRiO`v_Vs{V>5}xE)0>2 zmsUSYX!_Kr-u)(ZK7@Q8vy&-iw_g`O)JiuUg#?Pb}lg z|M{L96~KFV{tO^b9nZUqJo1xyEr^tl6+`7v$y5olxD!LWtT6!csg6!LC@LLZ=M|$b zJ1<4ePAp8SnX&}di0S`2aejRu7i{%DYOXASx@q?L-Ce9=(4BqWFGT7nSI!BTEHyF$ zC(dHYU)gB^8DKlh`zIh$CFDuRY%aFr5}ll%C;Jb)scF5+`uCTa^6=$6xy%xDd6nvY zSpY#q6l@Ij<^x+xE0UOMOnO2-Xo3y6aW5qy%K8>lB^n?db@ZDh22MPO2=LC;*|TxH z?mY-zc^CDM!(}WBp0=O^Fc$x$R7m5-T*EstLq7BLD=byLQTBNKU# z-Y@9hQkXJIL})5(`9>`W)QmJCMYZ_WpL5Pj^vXlcV9hx;FQ0y3%Mm;!k!J z-qDz6UcUS%Ra*MTb}_^Pt&Z-**nhoAIArZ45Cv9<3DtS-!RXt!KZZW7+*sXLa+(fM z+s@X;M+|Ub_xaIN8&mraCbJE~;;BrpDmwMq`e=O0^S?j$Eop7aUbXW;MB@@v%8%d#v zB^CahaTm`Jl`AHCw!=_oJso4ib@$K1lZ_1?xP-ru+g>_1%*Y6xL=b0N@4Aw5!^nF5 zlTIEKaHLF0w@-R8XHwzb*`X8h%A1X*(!etJ6vpKh!pNVnO$fM8sH|)M4Ohx!!1KP3 zd1Y*zJ$e1>sTi!RAu0VG@NS@xMN626z$s$@x}~8g8o@<$!G-vH^cwztqiy1x{L4#opBcEC8s};{iU_U2n}LrC!E+ zHxt>|GzHO57HXor$orJaeo+EYdfb2;N$B* zfhi*1o?8LQ_0+_p8I!pzTBFu&I2Q_ zzZyn#Q<+W~c%>|n#Bgld{%o^P9DwpkpK8p;sx0YEc@_VP8p}^1@4vtV z^l(Wnmnt%BV=aeLIMxAmmSi@ZCI{k}%?or!MfkmE{7zT3wQBcY`ZjcYdKJp8QpPl2<@VME^`ds_We#|^{l!Gmg_gl60xqE+MVTZZp(+(BrhSop zDxC9~X{9iYokcHps)KPOfjQji2sW4X@1iL zJh5b=tWzbLiGQXm_0n$SW+~?1Z&sP8=1PVq`>bSvD~iE#zc|Qwh-8JOads`TeXkPV z!WfahAfvUA2yDy!^@xoTA60T%8Me48l=vKlrwe(Eqb9MQhX+s`jK50bEg!UXkj5hS ze-1Gl&16|}+oHsvFV?_YU{%+?Mk*u86}{ zQ>BA|8?yLbyCNW+ST2`+<$JGXX~V0+?m0<+sh}bG?~+4Ov6D%NCrj9iwp_P9p)c~e zw21E0+lYA&5Oxy*Z=fr~R05)b6kKrNY^@#3!@%|7&ey$R6ssC5*&k@+W})Vcul~B} zm++ai%ec^CAMfjd&9OY;;gR*b53~x5Z@$JPzP~(fnMZU3b*MvBCt$@2!1?8b7PwbM z0!Dq18CN`uN*cWdCNKQ2Jedcvv7fv-oi-{MbX)SkNqv!FI+CtKtC&g+Dnhp+f<5p8 zmZ=})>}XSX?7D0k?HJ##8qOE zrqR4gIB*!Pa0wN+7))Yyu{Gb5`p2s_l<9PZ4tI&(Qvdl;QFoK$r}evEB`^O=QI@Wu z7NZP&y9~Kut2?LNje9Xby(}S1iV88r!tZ+VnpI{0jvQF*sea`s2<7@ss;S&|Hr&_^ zbFtWTF`Cc%Sq+WtFjCOs{GyS`jZ8z&c1`!@o07<+9xAwYlnnC~@h*;DFgNu9duvJ2&Ud;+hrE5-A}@%b&{ zCX4m>c3v`HJQw1b*=ex!%bv%lEJWW;OB*kHeO#!XgqC6~gUBY%IY z#h?z0Q@eJ2gLOa)uU4c0wz)OPX0>~--Q8Z-)H~+<@J4v<^5mI5$ zLHh)qI4(Pz+~aDe_<=J=)D_h_T)0PhV!K%TZCucPzEK5K9`sw|1vRyq>M{SwCqdtaScmScI|-CVMiQsMq9OH(0f|4^%mJ^C)> zycvi2=10LWnEI#yB2+JNYV-HEREsj%Dm~Buc%eAiZQs6_BZFktq{;{p<4!n%D&G#0 zLsj#CoC$|del*dk)|!<`Af&Yj(dW6HsIAnkeu;hVDNUe|x;yvjC0KT{e#^OUEy4fp zB+TZs`(Z|y_Wi|btZJRrRG1I%?X`3)sq7zKTN^dYMQ3C6zrdSJCliwP2+ZSjTf=gx zz0Gt5{Gb{%nvg~+60fc-Mm-8rCZ6rOJNqE#C}b@8+z&Ha2^2hORk&ud??=I9A=jA$Wuv9A=F!H@MEkWN&|Ho%5B-N=39WGWY>@U$M z72>s!=b~9^1NYe2jd->2IY`8oc&HzskYiRs|5ba?mJZ%dKwX6rASwm!EA3 z)ExhD-3|$UrctQ}zdpaaSTlFo?oT%I*`n9717Gw3nZJ6ms%(yUaBWAu?OdUTWCK&W z`{A!|VC@-=R0K{EaW^Q-@+CsilP05I{X;$Q%Y-nSOuh$L*?DhLmQ=_+dt=7gx^&WO zUlx>i&epML@qU$WA_#i4AXG_@lXyl;R`$BjT#-q9`;SjwjcDT!o(HIx8qG^Ez~0*-4t-EMu)Ha z>WmcA`6-fF4N%OPyu39&t21mJuEr**UtOL4IihMCWbv?p;rtcy{6rw~d{%b{9rxb= zTYo|j9aG*JXSqJ_A&8!+5br0AwDv8HE$i8&rb&WRb!=9#Nb|Hmu_>oa{Oj(k|`(Jz0?f0DQoaof}HZ(h(6bl#x{ z$**dS9WYpw0Q}bF+kt!fyX2XtFiurD{xO_3UT3Z4=FDfa^bnmcQE*YMv(P^Jv0;Vb zGHLc#WeIs>eYQKt4f=sW!YeI~iHMGGEYJpf_SgNxAvel(a_5;<8n&$s ztPk#OS6<(NgO~`2{6CAVMAVOr=p42ui=RP&sDh$%9)gP_M#$w^d(jtT+q5E|$}I~{ zs_Fmr%MzV9dA~)8_y&ePaV?C^#d)h0DYA&xj5kr({G>bZbyv~*PN9LNi@W{uo-I-zB_JZmk4}K=tPdYl)J?Beg-Bf<+Q3VJjNmG-# zA|f)z*D<@}HCjrQM3>uBr4nD%TeT14T)tFw^5j}? zP0=VdU=ohb=Ip^ItV214`{vSm%4k+aYO{&WU9t$!S6t-0_KWkX=Ew6*PU|&-F4Vqv zH%a4>|Gb78h>+Q&3g$tD0dio16-rr*s(v;B*ALf3cEcs+&ZWBbdD7a3oZRf*UoGNsLe7R zH6Tx|gzpjW<#{#Oar$-z$e@j(^L;`48{NuuQp1zhu%2vNw#Ciz8u_vSFu{W?+(P4D z^QNEjoeqGxe{(H;afgprCDkbxB=B^FxTDu=Q}msAB+2>ubo9FqK`qf!Bt{;+CSpfoLK?m4~kOYqg0SdiJI zL((Z6Hoxb@4VORjY&YL0CE&Nn7Vm_#W~Hjcv1Y$axRCOeX<6SfM!0 zD?K8s{+(Bi*KVHv;Ip$7twLu0E*=gJHJ~=9e>?;WgrnyU1p<{bMV}b)aa2ZBY7oOv zcDuIFhsOPH|3TgOl|oQ?th!+wuP+?5T)5tL908xnI->@vWm@zVuRjpSOW>I+HW-CG zj`9(|qaXwTy?gDbOUQL6g*U$1`KM}=+kWN`#l!)P_s#5Rs8fN6XrJW|>40sXVhxJ^`rUUo?R0Mm^+(DXkWfOytMVJ6) zNJ}pc<;gi|>DmW3^Qigc|Dt;*F?NrMQ>P=bI+zmS@|ikP4#?){k^b zNp6uHOn_K(v}$#4YymQNeQZZZhuZaa9S13Qa;0{KhZd+by35Vnc4u)_qi8`;I0C!6 zTBb7jc2M^Z07iJF^b}Vijn}1w+iFr~Syrx^?olg}VY9QWUPZBWzlMel>bXJLQnQPk z-BJ^kTh)Afx%V$qtdLjCU4KSeMRKC;eax=~mW%mbx{)bKe$o3E(%3Yw^6OT-q=TtwAB{d^AA*HH{nlvY zb2vm#ytCf2-#%doBc4xBi}zE59QYyhER!AI$AzE~3fAp|vO~OH>6xfle{+#0a7d8@ zl0gHbbQG<0@9c&79`UXT{H}V5`nMAYPq(jm(|4yt+;Ip`@%l4`y-uvg%UvDX(MdQZ zuZp|HaQ|sG zn#zyHapb*KjXe9r@Nu~y;eU)3%L4H3crRW{I$DObR2O6UeuEy)sS- z7( z$j=w0GAoo)4+WE^N~othh5z!vB2!XjT(irzplSaLuQMB@_@HpCkTRk+_|;w{+<=>n z0a2G-#+g4jh6ZGs7s}K1yYu)$lUHYd=n@$=Rvh0}AKYpR7 zAmw8^^r4-tPbi^3-kMYlz^BUstC@3^hUVb)fTDE5+Xe}9?& zP9DiFGz-{eO41d!i5Ch-l!Tt_0*z44WLekxY~iWNF-T%Rl9nH;FQ&Hve7^qhM0cf?;Qf4#%q3kzr0bn8Y0cI*E7 z6w}fCZuAG$?U4{pmmW5$%)xu-FE9_oU`5E&qY8I%#9QuuYE@clR~@8e;5g{!0)4&fMPMuW z;Lu1!*Bd|*OmRvF4=qo8%0+f1ZBS|M>2GpBd~MtH7#B4iiKB0@NW&~Dn(zex{eav) zKw1{SGWm3TcOhXsnct`gmucLn^=2zKHyQ$e=v_myQGY1H`p0SrnMajqvmw| zvROY_z9qhubhkdR$;!LltXmLBoFp<#E1fR;Q7SuEAE-QQwN3Gpk<<6?{h)h{Zg6;u z=kojgQq?RRO*Tm&jgPf*S$=m;wwk#;d>QAucO15WYPx&W`}H-0T0x6i|@s2I~&W1@BBh z37STbqeYD6mZ}^B7iH2wfsT&<5J+UoGM#FW&t_gL{+lorY_9IcttXLriy2*WFRlgL z7WLJR>R?Sy?M?n-Wkkud zWe}tt0(wY8hfC`uXM@OmF2qn6Hex`bYuTq1O;}X{RcMvhrtx4pI&;~c|4DCWlMLym ziMu`Bp;#gl@RWQig>gw4kQkZF8gkhulShjhfplFJFqF=t1}Gqk_VhmtP@BJXfS?JpSuBH<&X$?4m?4-ycuMpmv`o78-PW&yxGZ23w6hRD0@kX?L{j!RbEnO! zoL_^ah|wC_pXr=pg3@hP%E)bu(^0T1`u?I7vVJXK+!r|WZ?_#ihw$JBl|6gE%->n`!WB@Nt=&d+8l zi24-PD{h4!(F9rM<^+_AM~6JYF2U3*sq|r*p2cD6Dn(qm+k9ZqEwNhcB#>kq8-^jf zy`<wtC%-Mdsz<+1Z@g#L_yMt zY((SAGixoZ2J?Nexx0?rtJ3UePy0CFUrb6qiuwdgiTLRlaf-Cu${9zG@It1#jg9I=A1X<@tPd9+1XtOh2{ z+E~qp)u6@IT5B(N-aalX9Ty)?(*T3m-1Dv5jR@S?YwUD!Qu>W&Zc@+l3V$!;F_P*? zJ#&qDDChX);A*su>TU+gBYiCLe&_Ur)-rC!Z#ixqJ)3~>(CiDHh(fE$sIyL2G`+sC(GV@Ozw zLsxNt7ZQjd8cohGWQTQm3RKr$9qD9@u7U873~YbMj4FCMaWVp+^iER7genkvQ;Oh- ziHRMpCmRjKbp?70(%JL|mE8_;U;$kS`2zGtf zGFp#5mh4-iSLfIVNT+MuM9nmLC_?DMc7Q2UEhHq5QT9$dv1j9$ zO(gk@WY$`Pfn(xv9yWw;$DqaS+Zw}1fT|S=T+)7ge)|op`nBPw^rm;RF6*b}2u-CfGRFSTB86O0wRIv*}%vid!kd8_K~^4rKeD{fJ~5|=8a+|9=|+W@`KYXbtA?5ZKa46oLx&8(_G>GUKHobUo;GS( z(_XDt!7i9}Yu+@#6+&tg87#5#dq8-G!__2YG;s`Sw7X)E9-|u9Xh25s_RbU{Da-cn&} zDGR&+$%EGFAomaQ>er5oKx;yOU{tq4RB)4^4x1o^EH|O|Jc_i_UUgS~3QqW#5SNO| z3-@iX`9gBr*N&%=39bkKetAf0^X#H*9|lDsWR0QFl=SswFyoHnAbv7_E?cwry{U9%k;96SrJ)l^HUY{x#d*vER;5wtpWev^jX&+JR>}>)x6A?XfpFp-Tbfs!y3)< zILA*-@UbSeIKGaMIO|%IK*WG#oQU&hjqZoJ?{iR*PBafP-wedZ`57QT6lB0u^ZJ_w zRtqPOp1pi3kMbz`qH#X7-(wXTJwM`Ye#T*P&xQo7395sS2jO$rQXGcg!_!BEe#16b zrEXlu3i?z;6Zt$%^j*QD68Mm_n3^C}_3nDeGRt(1#FJs{XB2bnug?A~DG9o5?ak92`o2 z;j6gZ7D15nfEG`!rojI(23W0`p+r^pKf3x3pIP@&-R`4!Fv_R!9xQLFCn`kiQcnY0 z7J5O|heaz-AC5&cF0#tl<0DkJjJ+Y~6I+h=9;$ZF1YD7En*(#iq#GB$UL{{DyhS{6 z6?TM_HMryLaY-lKrq*7@ai0Cc#^^mr`BJoSRGq0on#Qg@`iV>WbxnWvf}$g^ff$Ox z#lxX(Pseh9{u=SPuZ{A8H1HagHrCPiFqTLwj*j#^X_+R(v;GSg!5+s&ZyV1A>9PER zJ!$cQ#JuRiP2fgN%l74q3lS&1V4)@D^W?N`5p124kGKRTA1|GF>5N|x4&upz_QaGNIq`lqh0_52iO6)MOQ&^vWfI)O^Nn==V4{>V?`CPsI z1mp0E89`7tswd5Tva4hR@X_#K`J&(_+X zvhcIgBWe~p6NIw9%Q^209D1<)!FbzU7j!QHOsY-S*u;F(3YFlj&G4ezZ*ZcvN}~s|7eL(?z^>M_>q~kKEnA47N-`*fQvUOew9O7Ccb; zessv4jpyYNygjGmR=_u=XF#xn>N9F7DZW6Oba zON}rBD2gB_9CR#g;w(Sb3=@OGFpbxuXU)j6S4qhZ_kKTPv}W3Sg8ws0b8i!l~&`^9@$>4-^h z8!N%@w_jHfBMFf|ean{$|d%ud>|f*`6O*;&@F9y)*axUrCeCl8O zqRs1cyj<9gNSp;ey~w^~BYVfbHAi8m@Kxf#f|iZs(k>Ia%vGMF04oyqymTjQx5^K)OLoKRg6-Mg$w53PhR7M?@hOAGru zgPv7nki2k-IC<7&GpXO^Sw~ZH)Wtsr)sW4N^HYHk^4R1Dzg(pu{`|i0ooyk8z&py1 z4NIOc0AsQnm&QezN83#v0Sv6xKgy6N*7mu4rrUv4(mQ3};Px>Fe51##EXs36X5h#z zroiw&NS6}J0oP?UwHI%W9U?^iQo6u-ZBssp`O{ZN6EgyjJLR7XHeG8PPfg!O_Ycn4 z+(zw?ZNQH!8)J>4b_Kr6=?+G~&@WIgL6BekDd5bKLJ?JS5Q4so8GS-zJzbFqT#VmD z8IxmlhE~eMtvQ4Q=^r?HV{U)2vtqFG(c`E++U_$G{0FM7!1)uWZZpA)0>%gnWh90W z6}(8siE`VJ@EXu3r>9x$HAHxdZVg3xk;x!f{M;#DFnr(-eQveKl^4FaAX5gJu;rlaM3_7LJae;|&|0XMIlpxa&< z?wivBb)mW`9{A~(M$aW#C`qtsgV1lUD>WsIlivw-3J=(b^%AEGI*^3P=$~~!-?!lA zTh&<|y*ssF+LR&ztqx`t@p9M{yj=mrvHe~IpIU7?=bP7?rp+X;TlLwI=2jkA^na%? zc_$04?Vwuf$T8#IrENLiNm9v^{$}5CPkV5{DSq(mzHh_G0y+eGt*s0?Tkxi4hCi^S z@i+;#E+QF>X1t(F={=IVRKVRqxv}T$`M4_0e|ewaXnXv7_y{0t>lLeqhBGaEZmM5M zl_Mc&L?ztMCf=3~n9SFhD>>IOfx)Q%GYepth$nY9`sywswVYJ&ZJ5e%jln~Ogd_n+ zN}qWaC&riwHV+NRCw6$GE2?&(B3eS&K8&{cbLb3CeR*uO#rl|f!l z{B0@5PxG#6PKy1fJ+#0{-sgvwfY}CvX4+(p^1g_7?G=G5uLab3h$9>&Pj}jG;cW(I zE1N+*KqvNguWDz24XC!iE6jQQd{GW=`o3(y1K!0d?uTRk(fk4|9aXc~tuu2#?K<#i z9brpm=)>9W>^I=Epxjxc$)jbiw>CPWkF0tU=xb4kHK!`mX#wBZl$*4BQOw-(> zxyv0!cR|%8D@a`d-Q4lR?Iuux)&t}qZ)WW(@cg5l?#>>Z3`h|^)KZ^CV@K|;8X=8tTyhkMYb`+l${hw$6#d=xiq(sluFl=H0@5f*w%lVPk>=OO!ywGdDcUF|59}Ex>6{&SW zdq-oA1ig0l@^KZ7gjaa8BYu6^v)mvD7N#|!sMHi6y-v9aH3VA++fRj2XB{QVzCj{t zhR^&qPS}6}pX_+UYli~G#I>JA>c3_ZD&%Fs)$ntM{8-D$#%eQa%i?$4Ty0+>^CIA7 z9;;v6qiEn)2OVji29fuwv6&-Kod$Q2NZAQdxQlj49v$H_<)=n;N7?2|r_g=*BSRL3 zBWa>0bRVS^!_BWHOwnM!fVFm65Z5^f!GeWXkE%C{2sN6+giaj39ON^rD;lOHoLjhK zakaALUD+j}XjKJpb2J4IqcZo4`h6-}Mqrbm7+jS;T06w{xLK=CB16S3uZ9JT%u2`~ z1foXavHM9yk}Bj%tNpq6hQ?wVyzYxC(CCQ4F4Cvud`bcNAJrsPVCMFDMTDOehx-N3LOUtPplV;2QA=F_N8T~OIJXNLw7VtsW; zF9Q9ZwPW2pf1?<=wD_h{+1E%iB_>yFQN#DUT)@Jr3*#2?t|kxT+WF(HqBH{2`Juqb z4Igm)C}f~Z6b&8QE@sK$@f9#;1U$?89*`?x(7sRE^zQe#nNWbl(`WBc*~D;gJ#~~R z>@SbjRSnl`k?_`1gj{b@mRIoqVC;#;6^&*NSUXN~oX3`~zmd>TS^!6RBwAP`r0( zULRRn<`B3NumuC<$*>}}-D^NkVXt!@?Zs=(L9M9Neu|P%bLY1kG~#8_uyn(mkA2eh z!oJwH;!oH_>2bcR-x@6o+9U|6gXLCDw;venqQr+>Wjl+IhcwUC<+BMG`X~4#Jvwsm zX#jPW!aSNsJ4VQ3^>*``6%02G>M2>7qSp_cRDz<6$faj7kN?6qO@zyq+-{3Q|padhn~c0P_ll9ind^xXI2%e zy9piAcH3AdM9lWZxMc$K6{e5Oy6Q+touQ)o_`}F_Dpg-MS=I&jN;;8JK|=zI5CR2b zIM!W5=H{iKPv9Y1u+w`-O|&nouC{Z}8`+5Aw(iv~>?B5AtmU?SQyEZqBx53;znw(qh2|9+=~#c|&qkFuOvME)tn~cB$iz6&9BSyL zR_|NYZSwKN8$hWm&#(AiFt$7N-2!_* zo*p&qoHW7-^3bij{tHM|^*J9~!nAW#CYs)?mg?nQ=mWQ1KA3zmUScXYd^swE2Smc( znJU&>%t5gF1P((b+ndR$qfv3-f#7s>_g1sKzF(kqz z9zUrpMgL;~PblHog!wh`X%61!iA@MM%LoVLI%<@t#{)A=)3i3ki%o4&0VZ_+4&M}# z=CxxT#4Ev<2SF$6r;0&-6=4k-FO;L}D5cEIf*nuLw|w!`2)_lMz5t;J94v<*xbe+l zbrmE)06HaS2U^kg3m1 zYu?qY=?nZp+!}=q`($Yw1bjIK6ChjO^y!Zy( zNR0#8^-+YPEm8ryyKqcgXD%C}PtKoR__0^P;$k;Z`<^o%kiUWVu>{|};(S`7f z$cPE{byKN8GxdbrI}$}h`h0DPbu+1x)J6DJ-pp_&jfyh237gSKWb!K<#V1o5j2Kjv zRQ>)tpH;A@8iw%JmS8%iNfTDt-_iSs;o09)p6f_njxO_rmAEmeF-VvXsHawA`}Qn{ zCu^1t8;2Bz_5Q;CqV&B4pH;h&e7^S=8xcRIh>zOvdnxMveXBJo@?4+YE8%wwo-Hca z_m5MCE)AQ`(ipTRA7237iwEN^*D3qweHZI#!XHB7pL7=VjaregZ^Uq2Hp^O9qMxN> zlxtAX{ioe*N*Ui?oqF=%7Lo`t-Eh0JJ6VL}{8}V)7yBv-Kn5^!XZ$ zPh9i%G&xBN53@UNGsYF3>S+XB3QOXYjXx7|rFD}r5|39|`?zQ;Vl1&RrF(xGV4AZB z&fN^!KO&+L$<%F6t(7Jj$yP45fxVNsz7=ua*XO}RskV4*?x{Y7M|<+=>?%!qe3M7< z(EO*U>G1^IRI{;5((>ehqsF}7l(sAj)>B*9M}yEB-15#rnn1vb6+0dTZeZYA&>P?=Lg9%}o=Rw(!Gge|WI_6NWY z@df$gsy=NKsv5q>75BdMa=V948qT@y&fA7ucSyn^NSR1-iu0BtiK8Glio-FS`Y4Zi zLy?8TpBE!_8#~Ux!k;ncF_(7@@E_^O(e$}UMYOA_i(G9|X}PY8&|A9z75sY3Bsc~POKBM??yfvb|Wb|k}H{jZ%@nRKvk3(LLVLeJ)CAOAf=$v z8!Ff*Q3%>&l%nvzI0gMoWf|1Sq{-{9877?r!>!f;bsYlpx5j;UsCq&Nx1S$_=wX%X zw`>=P`t0hXaU>{3HR&9T?|mc|i(Y?;lC69fh%S=JrB`QVD)R?OPf_eNi4-KzG5XB? zv%LkPKFx~Tc~y>D>j92w=+39MgN~&U@;8S%xR&9s2S5M`eo3P7y#@?es@U27E&>Z6 zWk%natQGgq1_b}NH2ZdfvX+S~AS6$9d){kS+~Hhf`%O~`301c;r=ZCv^Je5Lq-l;9 zza6*;dNhPB6?t%QJQhkOdx_B45ec zP{E?ts5}qqmRBX?jA>A|gD!63$H>>jkKCUTzxo!#xLaVpr) z^_lSDty>7hV}6P6&el%|wcM#XUf}H0_^r)pyY9?mn#J{-Bfl|kKG~x7ZazuP!TvG= ze8fRN6=Ovm+S`nNdo$b`TK>Ekg%0DJ_6|ca40dM_$CcHK_4{H zA0DuZ)C>IWv?fNK>zY$&%|tLNkmAmS#1P`%@{qUrm|DM(*9!eIVNlb zS-q|>&W{PAOjVFMQ1C(*_tli%vw#@JO`ufgyn!mH3-i60e`ez4NnH}0v-OA9$a<;~ z_)FZ{ets5?#C~ZvbNl4XTFyd4rHtM?5r>dP zEsOaueFUqKzAGWvqxvL7YZ2LAypS`Q0sry?^=JwiM*IyGl? zYGHR~>Q?mX;*EcD1}S`?3{W`gs@|?yNRHb@*kiw}rW{gi7m^5f2#+G*wE8lFO2B3D z=U~T~htIGJ9s%L$(bQ0ifP^cDR@wv|X%rsl$-$&1Ka;wY4CXioa#LKoe#}v;&uue# zQ(HsueHQPsi3q4=1GbBCR*|WdSLhz*UzypS?nFZsge^f|>VYjhbj=pHlpA|vKr?EW zr|}5_3UIO(NfMF@_k}riYurYCr)l@}9nBK$C}ngMeS+LM$EQ{(|L*3(@yWS^O$`?w zXY-3fj)u>Kk7m@A)jfduvbnTgBRE?kH!3u+%N{g)H#05U1VYu>*mQF9e@9QZDA@~u zHv1YzM=vsR2QW0|Cs?h$Gkcq>N)z?Vp#Z(z66}Xw+BPTEh=ibPXUYA0(w)Q_qP zRVD;1qBI?2l3(Z%9ilpe2`szK2zesG5Ph0B9z9-=Ph$5}N@N5Oddw1_!yTFx&KhnD zXV==nnM4fi&^r5R!=sHswmfJoXTIRa_^TRQ>t`=DDw8E<;+3!yr%g78(rIemeoL2n z&}YA_ngd;%+XCu{#H3XsA81Ao?axRA&3Fr?4k6o=15;d9zt4b)<%7aPeybR3arbK| z64~$QY(mGhCR9!#!$$Xb=x|u|!>fAq1W8|g8cZ38=38XX)u|^y_Xlk{A;;xjMh2Xl ztqz(@_)jYE511wMT56=bPj{X09a#KA1tRt-Gq8do^ArbT(qvn9lR+Z%*+c~@PKk_I zZ|ljk3hDA|U%_RlEtDZ*klwtaAW%9P6={uyvxCT>#F`Gz@=!cRMMC->mB#*VZ?WdZ znpZ{ZD>%bh&=Kf$`h@HbG3R2PN&Wi=*0k_Pizth)CjtLhxJMr!13$IRkV)nD-n`Lp zlSJIS_i{ymaVH$Oj8P!UWvceFpEwKbc%Gd67$%zYTJQ_k&*u}vHL8hZBXsonMci-a zmorQ>$|C#)V$Yv0&7XCGBlLI-R!pa|WK(+4vQNl)5a{oZCHy%lejj6z-|W?oG9BS7 z)v(aVI4c%2RXN{>XNRcv7rc#tTl!9Asu}d~72={D?Ts~y2)Z}>fQ8T%e9L`agu7jP zNX;4puq~F?L1QS3wakmlmt54*M={fSQT(DOKjL>me~EUQA0{*}f${5$J|{@juX49T z3av1FN1yJ_5I5@xb0qS09Wd|8Wq&BlNy3fhXZAXB=h)+YsOKPu1~HRr-fzLDI7mkc z$z~Rf?D^`q`6a0L9*y5kMYstnKKhv>KQy**md@uVXd&aMYw)ieS{IVL1mKePo*Em2 zYeMLw&!mf+h1-LslV#HNkOH_hL~R^o0w=}z@OT3pp=)k@zvdm1A}|Fz{ru0ZA~ull z9TnJr%^whBp1s9|4>Oji=4o61{0=Yjgz@+spx5&)XD?h~98c2B*PvG<9<*M|*07}^ zAK5*O9TJiz2Mr;r8#RKNf4-XuuTUKJV2E;SSO+z9uFeqkBIRi?{wCvG|9@nC1yEJp z`o6%Ck`C!EC8WDUIwS=pr4Jz8Em9I9DJ?18A&qo*E8X24{@1y`d++C+|ID7z8T>x> z*=Mh{-uHQ*m|$y*=?Xb*$K%_J1>Y$byfh&qJlato2YQr}0M9##*$~HeofPRU!;k)h zv-a0>7YiOfH*@x9Q^(ClVn%{etxx$hsFdJK|9VgvKlNdh4~f>0U0I-6E8-AJA8kk8c*X;*`HhY`rWZ&n7qhcKPZFLY7ELQh zz1SLP5P-(VtNSXT!41xTue7D)_Svf*Mv1Hq(C4oM8E(Dnj$%MwlnK6E!HYh<=3VMV z-#<-Mb&rZTly}78hp^bFvmpz?^Yt!Su2l#~)CSF7?_5GoJ)XFo3HmYiDUs(FqzM+GKsT+g(m$sKC6FsVG#ZYdK zFM&uQi`RJmU?wM@JZ0mQ@0SXygzal%70c1a$6-$VZcnLrdyy!-mX@ZvtX*{J%tbse zir6DO%QR`oXYQ^mwtv!GWirwH5M^)Ox|c960juB&9*(AjMw)QOYgzjTr!>u15~Cv* zmvHHn^wQD1?L8wqPfr@OUM)V+dBk=^W^u}D@%%b!F6jHYs@@6z@0ybeU`u>gfPw8C zd6xuOeo@%%GO{o?y1DSh7{6)UnF`aeSRm*`{KKWq2{YX>a9AH$FZ)RmmjN?V(Q9y- zM0Gs=(|Zj>jh=`6Eipr$U%gvKjQOO6%7~5)^Sia1nj+i~31cY6^S1ZDqj$@|2jQ}{ z;l6m`_(0tftNJRwck10hdhuFZpUqJ zpr~it8Ts22x6I_ zg3bB+HGjJCZZBLnhhH5w;!E>Huos>1_snK3JzSKdxgl1xU2lsJ)fnQ#KQqg5g&VRv z{3z(MhgC_j1T8%X7S4eTUr3hb%mP3z!LwiFEyo12nUIh`th zWV9KE2EJqVpRr#7Gsg~V;CRsGf+x3|tn`ABAQX!6=WK0TJ-F7{shzN3gtYS%0w{MG zp5MVXRnOFm2(~F^C9wLC4>{9B*GAEP)QWObE*4apgokJ^UvKZJ+WFpYAqpYrEZ;e$ zqrELdg)8=(S#GZ{z&#+DHj9xQHo_8@El7o=slk{u<;Gp|iDRaF*#gdVaJ9&!XhK_4 z55H%<;Q^Dwp#_`w4Ij`0ZItgyf_}FUw{-jT zj7pY~SDSq7G-$1nmj}sjiI36F!iUA0-8qQ3pxF)+Z`-(`)GBF-FoPdLdM9SG+*uNS$&X4?yBSLNE+F8*w3}UeS=wQ zaCqN1)p_g}WHmSlhT(=#h&G$$eJtmgG0ZRiV_w$bvC!>TbU~#e$!B zt#}n>et`1Cb`YqNzvgxTLqet9WU~L?ND+3}c24QDLzC{`B>@BNULdQe{`@g!?&o2k3dYPWa8ekcJs`jhJ? zYlB%tO~TwFO}GByr@)|T)QsULSG!Z_R~E9kH+<96B>Gd8QY*}0-5a4g$gsWFrd0eK}&`y z8YvLD|JRe8f+mX9*Jt}~-nBkbpamKu0k1`WRG{iO{X+emMK?Pn|K2mx(XDE-Sp7Al zW)UrbGUEcnp7sHHu+V7r^f?@YNqyBet#NL6w16g5{6U_Oezh}<;drGx26BvRvADgi zX$fhCe~fCO9|?$*(p-mMcoLC+(|o1bhmd#iJ8n#%g?)K%vGloN;yyrH2?4Is5;pPu zzpD(zpFt&kPD=ey755Nc8*n}qAZ>))*b*LhGwkZ!pZhkOso5kZz)RN%a+M~3n!U}O2YtW>15Wt=yO^aOS%&_H7r-Vx2rQ$Dmx4!Ar6+tUfDx(V#sK#H zUiD&oCD^@#Ut2UqTXN+p`(> zUtn+OTMV627q$4oqY3-PHmI7#%10D|nk`**Gh&U@@!0>d*@fVSp2e(b3 zONH4WV*nyXG+30Lf#Rp2|M~Ea5nC>Gc*m_#R#mE=@AMvcTpbK-{GJkn??r&8RU$qO zAK>f8Boi=MLZ0RNYsL62Kmb^x-)JXp%RNgD`$3}wW%&0EAo|juZH+M~Yn9TT>(LC+ z4b!%>e#)xD4D)FPGo9f1k^YBIU?-Wl&4jVQhT@Gj*!EzKffp1rtbiyVgUg`O1N5H~ zjPo?XW)9hJdSZ1P)`#cL;C;TZAadKP1~`ziRkNf&P|Lf-2zy@iz(h*BHN{^xqylR3z^S zhuHw3e*%X?0WiUS%VYhUlE9jy5(UBO;5RVG-q!7```FlMh9b;8NIm@5E8WTsZ&x<* z_WeR*e$!#AeZc=s{;`qSp=tb%T@!u3kjtfKxal0=*{C&(v{m1}Flc55?7kQ<6#x@= zPcGZmp39npQka`jyg~IuxaZX5iRPf;w~thg%b9^7KIOG3Pz!u`O#Xhd@O8o$8W~i2 z;-VMq8fx~08&P$T& z)p7_7?0^@LAH<0s>)iy`xB{**aP3GKl01Fbz-rS4QYstq$vxmS*3;~LTlF|&7|@@~ zgdiVhUKeU9i4-5_&*c9IF&nsZ1WZkS^%DK20uu9&#Yl*V@}M>cuDMM0)m9pkeBHon zfs(@at~{QjHN;Cudi$Vwzpe0>V#fE}#Isr0;q~u}Pvw!S1F*gLBAv{?SkMFJ$2rsy zNhRM_VMj6s4tR=5_tf%PxdAfF9|nP{kRJHcjy-jAkic5;qCE10@n9eBFAexXO_9_1 z=hY;@k#62i3>ZT4em{5s_j(SqJ;I36UlD=hj~sI6etsh=5pnC?=&%Ug{;3&ar zV4<&;<$?Z7(;3LLqT~NKoW>8{kW#W*J?<(x{Bzj^E3X0fijmUu_XvjB2e*S0+h~5TfIUOzrbogB#Qnd1v zc~=Epr`88hGwA`v88hFoqeqpSFc_e)G<$&=*L)1m-Y^l@UCB^{(=?l2lFiqSNFZE z3@2x^>i$T%2F#-FEC*INV8TBL;-G-7bqsyP2FoX(y=OfM{BAvl#UY=`&UqC!0cTAP zSYYIIG|;U97u8rmBTCBoq;ioAToKi~y}_uCLmg>&=%3@OH3$MMzO6#0fHyuUbi3sX zwTjU!(<4B0c*O%ZnCA{$&Go`k`NAgl2<*(y&*S!ifi|tu4%gfYlQD+y5ZDu;|8l(y zd`Q|=#?rpL6qv2{OyIH^(*StidPmyt2{L#cB_3!Rn|<^E+53O%*Z;Mez2Y8Gdjp?6 zD%s~bwP--x{3##L9O z$Qy4Brnld&k7G5^@9(|=va^0rbWl$qNiX{cAok5UTdl)rAtrJ$FMrq^VScr!1CXqi z9pY`fhwfKqr5J&z9&yvJc!BjHJAo|7hnNt4uk zc|oPPepJOOiy{t7t#AsNGnM9_(Y8dz!0_+8yI4~G+7!#%>NdHfwvRF!pVpbyMwTV9 z3n0U<*JiB&mbB(B_&G(`RjYsAV|#_J4w(Pw)_J@vyonrfCX6S;U)#(F_KIF_R@G%( zk8k!Lh8NshXYIW0?+mARnl2YSKR=~|h&xe-JpDrX#wmJB?+iyZI_l#ys*jX`SWQSe zO>a%H3rj9q%pcs7^=cY{2rBi`r`vqb)Al|8r66GErFb6jlOFh^CwG6A@fI?X;0s&d z!FmMu?<-1TiTlfudXQ>N+t6EcQ-T3rv=6Fr3D@pNgNASJ zSE21+wRg|obdZo#0@b`&%fkgzdF^^w+d@1r)bKqvPFSeK=6pS*8_R2;zrq{=PGoxJ z5067-{Ync9!jn==!aqBIfS^z_2D(x{g8%O|hqIJjQW5{{^qae-XAHfP#mv!imw}DA z7(4h_zp$=aRMkydw4U#&Lg3)yAbiG`;fb8OCs-OetRy%j+)ycyw~z_)Wkz$Ak}W#> z@SWEC@cT92G<)$+=IaIH(8-&e4KAAMzZomh6TES}O|P&xxx7*_hU~aFM zzoDjsku|xQ_1OY|`dn^DhJ8S*u5hkO2>ZuvxUgIIXYa`Pn4V7YZkgY3sdOCzJOrel zwCKt*X%&?<+PVsQT^&)`+?e8WyH&zn-`=W&|551b+k;=VpM9>+3Fhh?&8yg7WbG!j zd|vO1&suvPJ^oqrflyD?81#vk7VDTy`Obw?*nJiHrCL6dGr*n}t$nvkiG+rhHjGS= zCr2?cdMsO6(sC@9-7IiCN5Pzsh0~-*42Eov&@cRu7OO_OGd*sA&&svxM#~ZZ&!-d< z~$ii^CpAt0p{n(}bZKa=D6$A?6<`DGj;d zcrZY8LK<+Pv2>m$zwA~Rna$hAQchA=Gr?Wk2R;c-pkloNH6$7hLwBjYv|IkshwCTL zfaOI8ikX|cAS+FzoK~s6%@#NrR%F8}GAc9+wI(V|6>fHW4Auy`KZ67mQ$nue`OkQX z&ne6%Th+&7{l8)VvjiT&^&^)#ia)`=br_vCP&kYsQ;ZK?6K_0rRJ`Y1%${r0p>a;) z8oQN70`K2~I3*9JWM_pYl1Q_Kgjg#S-nxi{&CZVnJ!#;RF`e|&%IM4T1QVe8$OHBp zv2+SgA9|iI6NW@u&!%WL0#7#O$yGYqy<(!6GIKKkyXA@b!^cYh&TIWfgv&mBaa!RW z=b*D}lGtaTW&6)9mI?a5pRdR6F0WMsvtWgEuRHcQmbdXc&Burl#Qf1dz?Z(>Wj`qn z`i&L*N6FYBgOxNx9uB>PZxK5&7dW~;@|@G#$Y+KWbWQyUvSo^D`$FP0j z|E`%&j|3_0QoQg_?yemL9M+HrQw0+QT(-na`(raWaumh|4;v+E0y7+e1ingzQ0(yT z^fT)D2m`X8pBdzC#yEnNv_R@Sptit1%YYjKkASc}o{{bm2zPLj)2~q>)oUSMFJSaj zdJuerL^i-qFMVgaP-W5UR;kMSNcm!FEn6JOp(4teQMDy0#c1Eif1!Rn-?*J*^ox1_ zJs;6UYth39#y@xK=jRToN3|UUQ59Cp$PV{6&h;-=Y#q>sj-myep?!d`Rlbgc!svK^ zo3wf%30_yP0KY}0PRz9J^1I)>LtN<6b*_v0fUp+(OU{XlPy&Mg{tvEqqk_J?&*j2A zvhzC+$DK3Zv?Sdc;4vX><{T+Xtgrw464hq0T=-6=3VO~+V}#v3@^MR?vgv3_!)&6_ zUJ?^|1pc3mLafyko-`7A_YsAfR#S3iGF9M{(H>5ng2`pLQ zA6xDv^YW0l1Dzi7_sup#0MlRo{^s)gXd8Qna$BJ)@G!HnUOwOWn722Zs7}at%}OG0 z&C0;KarFlayqI+mkep!Rf#g$*$D-sEP8(-O6zu1x2oLI>9Gyz@-aQGqUnyA61nix+ z`D^i=xI@4>Z*C&yS~XuLF1hkG(Yng12jl_e-3HHZ?^G97fs};qZah3ZDPaD{!=rzp z`lh4B2!UY{>)4vL;|+X@searK$A|ne{QD38d1b+alT!9Gwjw8>YUG=UoexZR#31D} zv|jFRll$VZHegA}=XlC-;Tw^vQ)x;gD%x`N@|YNGTnO-y9UbIc$7-4_zIaG8n%5)u zIOtwW&cGV{Eo^h%a$a45Df%KOB|a}&im6oDA)w6##kD_ihiE7h&$sw4BA**NZz#HR zjdJ|+B45$_e`!-cUFi&~a@GnQ2EuFQ{I6f?4`^ z{`BDt@Oa(0!}s0=u?e6w6OqmzJi9Faz7f_I)C~q0W2`NAI5lAj-%b@3KpA1tafIDf zao!$`Iqn~TgodyQEHB#of_#7acY#s#J8J-b?I_vE9|>3k%aC1{=n^0F0?d=_BF_vL}UBJTn@LZo_v{5f?8lzoPK z!zd}2b|HLq39~D%ytEyAJgM(lQR2S|45B_xrD;X1B;qt187A>@DfytJ085GK+Vg(z z36*{~VWJ2KJ2}9JGVV$yB{1RJ;cP?q(bU?d5R*=cF2C{WCF!^1h?K62X`_0(Wq9Aa zXi`!86u0CS!{+6mI@R);1-f+{00`R3skj2DKtaOwqAKY^2ltz2=>L>blvrf`SI4X4 z9|E6Pf?%qut=-Zrrk%=L01GHK+RRqa!6RTabd#q_4=8sV80{%WXj)as_8d~yAI zIAVR<89EItFi``o@LBb!zTFTr8N2&4t;*>9b51^jb40PL7z2Q;x{>{75s->xydGaC z>}GCdJ+N%keX);?*mJqNZ0xepo16fct+F8EA>;WM;c}_Z_srXQ}2^4(|RB z_+kc+al3FyX1&Duo|-DI9Gp1vSX3BsR;=%X0Ff}m2`6T8SNd>>C%OZv(t`HPc#JR? z!XJ$67KA^!0I!H@Z-{kXnpIi=qo|jl&&mZh)?HjCd%pgDJ61(IUk6#2THpSC=P}4! zRtqVg5}t{B-=4WYPyQjNcO}KS2Pp&TOvX<{m%ye%(lsbS?QaE?@)6mEz(*|&OaE6y z>$dv$?7Y2h6d{e!9i;b~tI{nSIEDx_Gxo-ow@)hdH!d<&td6B}n*cW2ofp+GJ6yL6 zRBKYuiGeRPNO6ohecCQV>-xGMhSK?&gd(W}!w8eJFi5!hb2owdEY#RRAEjPGC~}zI zR~q34lg(#_%=DPo46N{SObVe89l6;5_7boaP6v0vrrZ4P@gPWP0K&rPV{5~He~Y{` zfKi0hf{KV}t`omENgkQT;qfx1T9%noACr&(6{R5qynpxSrBP0npGqQj*0h-vj z%Si3P9*ICsVphFP8-OeaA@uE5LsgsVo%8*)OTczEkCGB)II;G%s+{7v*VdX?I~JB* z!XpwcnF#WAbwnjI&DVE!owSjrzuDu$pnqmL&9mlAX-}W)=Go2oTmYqZ;rDVcp*_jQ zkq_WS*h6rGLhZ@LQ2u*kSW!xp5o|9&9>514)ZsQDXvOYc_}D|!%Crl@GF}2-WW*+& z77=fT@ZP-{csRI!X|G3|Ca>yof8pA`P~rZBl$HA(*}Fyr+)_BHIN;S>JV)I7`IW`0 zhOm1tUlj(gj9!dpNCqR%_S(+Zzr05}V~8wA84Z3koFa&Os1e_ViKm>@ON=}B_@C#6 z6_O+dTvRMFwLdlQ4~qt_O0vGoLXdjl4@_r6U+LZFTPJdGz5mU(V$O+-yd|{+obPDc z^Abh$1UdnEE`DUk3F}*!2xR6PzgNdm!iVR(Ss6k~z*m#yJMra2UTl1p(xq@Txt_3cOiw5~g!MY;a^4)GxX=~jXf-()%JBVc_i;Q7!; z`XYUiSpt;N zz$mj_r2R=XL_^;^{S&SJ|GZ#}bglg(g<6HuxKgA&!qokj1g9IS;2?ee-7ea%hYI`< zz{^S?1Ry6zA$|l164#wRYKgbX!NZa*V(9dk;zbQaj3)4;ku_Hc7$OTwMoZCA2o;82 zraU#^vbedvR{iB-lPUuJ$s3URf<#k1GL9(b$a*(qnI;eR&U||DV8%X}#z`Xj4LdK- zJ?liE@Z|C(y3HBt-&;RE97dQ%lZP`gkJpbclb+v^_0DJ4dM9#~NEmf0Xz4Uk);JiO z_HX!08-dXS1-H%EN6;piP8*5YCgU0k4gs-Vb~v@c!`<4Y;)f@Bm2+J|s^dBuA_fPc zM_0uBP}==pho0m~UPmO2vwkz2V>;~Z>f=ON^tx-2 zgcNNzmY2y;i3X4gd&EW}Arc4uh*=>Or4d=(Tg19V-oq!aNTKsy%Tt{I;ggrd;w)Hp zF|D>O55zVWg1pHvSWy*-(|c9cPaNYge;s^~6y8NS;um;-$2SMyp7T_z5t=_UwHBjo zbV>tk(5_hKt(SpUX0(p+1JZU-49LLAu5AmBc`InaSve@1kq0s_Q7~q{4dS|{sKilqV)z7<%o!c(%=N}8jz6pV+1g;R&Gr1^`f~a zwt{128#rxpZJrK42LUsz1g#8|hSdJ|)C9nS?5(2paZ4_M;msS5!&uBDHA0OO3kn`a zOCKOled?lMc*Q+_T=w!Vw*dnWUOl53A-8+4=$|E!w=kP?;GTGw9U5Z+9MY+OEo)`H z@SJtHdPK;hCt)dX6gRCC*TS0HDoOMA-M+zHV%}|x^IVTZ_Hd{m4bF)9Q&ApM>-g@u zpy=jRh4p-W+?(d}r!3k(qM{j84*H+5x%5Kl!@ky4ti_$IN94Z5KymK%Sn8zNJ@Sxg z5G}d>0zShAS%AGU9w4n{0duGyx-q`36p46_8vxpVLBg%G45}yfKM(hopla+0vg9c$ zH;QRTK0BOVq&rkefcqu^foCkOWb`$l7HcK>XPbWnmrmWP9|GLF*+JoM9zajRLx!jl zY`zIt@4eU(OkVD`-rgWt47%7X>Ki zh>~ji9n+Qk=2x8~gZB&F6>m+xYYdVP`G!K8|c`FTJd1s zELvol(?3iR92E5Y0|8|#WTxM4=E&&mXjwA-v09C_jz{G~^83$!rj$;FxChywCt^4Z z%8Cd`XxSjZbo@8###rO^X&%^Bx|9NbA-sI~9a+fdZYJM>1GN*IbNPRc2`rFr0Qh8T zD93wkZ{3!o4ECZ{+1%1@cwHD+O?jC}wXYsbnl|vGOSSSP*8fDPJ}acC+9iQ>MUW}% z_0TGefvtL3_xu!uxJ|we-xoPDYS#?6^D2AP%}XR~#$}HvXn-G?HCrj8@;S&>I+`*V z{`H5FS9xE(LV#iAD$VDI=9`^Djd~}`H-An&>fLwg!;{EIok~ss5}(5KEJH&#u!R*T zD1iPSlnWDC(!= zGcax;KX=@%aZgLy6Bz1ebl4c!{-V6hF&H@iKM)DUHqsAc8KV`d`b9ZB>1E45f>f?+!2v}6uEuwlq8(y8<)`jD8G zR0PzPynr)y{Ako~976v5BFJ1)_-~8^Jguca5I0kDTMT0c!7m^@Zw&a4D+2>Dru~Jc zw>l|9wk_8|b2T<$=AtP@FR%?877V}OS%9tN#iZkR!0V0xns6@cg04sqs{IkO$m{gg za)m5YcW84aLn~2@`A`axHx=vRtxJDxK47@yhM!y%|H`dewOG3gJdI4avf_jK zkZZLgR8p_r#aoU$2OtSiQ3-f$NX;+(if>><<`tfssh&S1HeiUJ5A5UrcrPt8MQU2+ zrifx@Z;<+yBQ4;22*ysVN&x;{4J-$DkTFc1-)RCX|#n^Vh0`t?+iH>|S)h;z$C3i!e>%4zheKVUM` zvDwUV!IBnoymuyaz~C?+)LI>!PG%_PQM~Fy=>e+aifLLkIdgf5ltvOv!C}q+#p?fs zQZpeRof>gte|DTbS?98vVg?6LjOpr%2`d&>NO&vA_t+X&5y@brhCAY=)`bgJDU$%r zo%FotSx8kO%v2!KDHxvu)=9n#-=cxSi-zq%-#*OXIK#0n#sFU!Vj(xS>*TLgNt`{& z`*7apbDF@9=}Q6y`XOoBj+HeSTsPt}OF#arP(Z z-a_@B@q1KSqF3iY*TjNzrct2%WoC8PBLGeVAk%Wf^S5$?QMP@3mGCkjC$wf;g zmh)e$b^Ej~J$bQA=?!p$d5(VX^ej<0-|m*ean+JTIn8@{HPA$yhrg~Z-yJx!wl!5g z(1j;WamsxD`vqE%q0G>R<97MY$EaG7UA~vFYS0%Af_-5_l{}D%SWz$5K#c2lcg0S| z@9^>AcTGf1sLk*~6JEhcZ@$O*4k*RipM_r2scq%E-(J|X8@}5Z`}Iub6WJWr5^L{| z<5jPz+s`rIy>5EHOHT<_Vt$&H`#^eQUqMO8O~$o%dYRjsfvii$PjX20_g#U%Z(vz0 zH1g*trzS1n+Vi@{r7_R`FhU4Vs#s!tpD;{<@z@>6@X8_*;wUiDvc<|%fivAs-Fn{< z7)YtCGAM@Bd{R?UO4BoJHv`PZ7MRpo8z$~4ibXFZE^%% z7YME6&f;hJb(QC8iwd~%YP_6rD{%>px+#)<$BW>-O`L74s#*DD%xSzaK)4_1BZub! zJ=p?hFLqY+*s~0yeiWEPVo0~4dpEID4|y-e`9laS22Cm1_kF+4d#`0+elUiS)DdJG zGRvz84l2?WQ;z>VgJ7`9(by3T7XyK^12$KSQ*J0XV8_e@D^6{0IzyGVWNP`DRB=1R z=m#s%s82k8m|sm0dija)NiTCN=6prtl*vv+jUK}hI3knIW@-C5OzKK9eiI+M`lK^{ zYOUu86izqo2@GR{_AN0sD5Y_!(LL|5eIgN-m-*S}{|*-~e=r@q&-c1MX=c-~>Ebi) zLYt$EPL&W7LxT6dy~q)*vCaUvimd7;Nb=FQnTUl)k4Ta*1eg_I!3%$%J5k7R+vY7@ z4ZcG32et7SKpeb`%UHuJoOh=*fCz~|g!@l%(JZ~lds5GUgki}&NwM{F?zoV1g#Q)~ zQ8JW(qoV;bZr#bgttTL7YwTg2MN3=(1^dz1Hh8C10oIpe$448UgoRa>^vGPmc0M;^ ze7;L-Ki_>;CPG)4f{OKdPo{I_DTQ@J)^n~iydGX7ym$eHb|8DV3r&meb1I4O69{9{THHTHs`p%v2L z0C6&4pQuWCgyh#ujA!EB5{UscNZW3qEq}kH;P27MjWoULF`Vy2eeSfQr!1aA9%x#J zBMn&JNRcv4X@-(vv69otMzv0Q{H zRy|<7RwsV*9Nke!34`dHyqfWK9pl*+!9P%{SZgpcEXYCr#B?aBcucM>7$ZXkGfp^S zx=3%=JtdCOv!}nZ{3oR!vFomB3Ts(X|%Sjp7i32h_;~C^pP*A>fEw4Ow zgUSamWf-ODXg+83eXS8m;{8u4>o<>lgql7w@=Bc-!{BjwkY7uSsAlmSO?mUOY1yBj zq#yeOOcRHp@%DW$4tVydzZAoZD2RYm?JQsYJ@1NK=abE0Pc<@UZu(Zya89$K5p7BS z0{f?Z0P9fSo9RmNPf^aa(A2tcJUCdPBjnC%Em`j_C@sEg05Huzh5tx;tLvh-4B*Uh zX^w(vhT7q05sqpluBY7ojMOz7VCiPQSlS?WgVv*9OlH!(x}JP(3F0AO1R;xl{>sxo z(t~J3DbJa5&^+Vk8{K2nC}UFani)yfDP#=f1yDD!Zk1^fpsS4ORVf^m_gZoTB^J6UeVdxzp78YBW7$9nFXNh>{y{U$p zamxj%s-L%S@*f|eXXRRUYlH<2r3otZzh<76ASjG|rdfe^PH-@uQmqgOBvazhT97u9 z1-=-$&}nK-dkUMo#&=m}h=knUX9MkJf7g;l^ija<5pcCo=Ie~#ugnBvQoIqyJKGF| ze8PJ!ap-)Y2dOd5!8zG26^=LzkjJ%t2aF0*txVg;BixkxM6jYd!fOP;x3uD z)t~PWv2(sI)>i@pGWPjzy~KnsOu#%I3X`3%riZU?Ty@L8k- zkkGZDBPKJxfMzA&$OC=Ks3Geix&@T)fRuC5h|T-9Czii5mV%jgQk?sr*8r3~M;`Fo zbRAWjSmppijE5ltA(e?Osrk~pn7~2ikqe(qZfe; z0o_|0D*-h7i>@YY1_zj*86c0Lj*Nd)z&t5|1-Q(|&p)2y^=}1;SokYAdaiXX+}R2< z=R$Hu|G!#0P&faOp)5us%Ffz32E!25{kBa?Lo8Y5Hgb)kSN{6=y#)oD#q#;%+2yg} z07*F8wvJUb4HSjT%FRL2Gc!Nk7|ucxS;-u-rxGDQDSwJM2pCzoB(bLbIsFMHuKpKF zly+*z+?wZ7i73dUkbg#4;1|z)5*y2wv&mtNt!985(uU=n!$7CF7n+|=Lf1qYap(lM zh@_QVu-ECf3c|xSrS@vU(p}-c#Ja`d^SWXKvx&}T1UvE5wiShOtId^piYWnFI~2|Wo6<558W zGu)Zv@ToHR9OkL@{g~iQlfycyJ$2qpc?793>t5$uJ>)ww!aR+*B5j|NSWy9_zjlNp zVR$xZy~}`s`#OHR-R2vX+c+}@>5FVG9#PQ~g17KSUlp-LML0cv&@RlvC{ z>YCWaS}!i3*VL^R)A^P|=5YqzySC|%`%(yQxOl5D(PLG5gBjRa716}skLBNufxiXH zo%satQF&y zLRT6{xJmZl-~@5RhO7n2xwp{ZFKDo8?oueEG*MX-){=>Y&8n;oACqn1KaJ`^=~*IkSGmFilV((S4*H;?kzYgJLUC+F=H}!h^SsC(-Jx9s z;t~M#$+n&##XXwnjp@6Q={~@|@;cZ&(5wzC87M^jPi z&uAD~_P@W?duHP^s>=oq67P&KB}7#)kaZ6^d3R`>@?AAOjbo~@W!Fb7^X;ps>i+pSw6U(#g62qo(=W!K-APG{RX!%S zGsAT*5hhBr;~2u+l*TRBApKH2X8lvrd_v094WsYh_Y`hLZ|)HY_KXfiu`bt_T~aRx zXpZ-BIDE#9R|R%{F~p%uQ~b=+DKiw$VWi-*6SMrY_1hhW=vUb-OKdXDx zptgz_qO0EfEmOkRhwko~qAEkJ4VMS*YQkgnm$X$xmNGndM-Kr=xmGO3ZGBF3qm;-N zVq#r~DYXpIlS^ey*=-0YE!!Li!uo2Y6n=h45b7dhwSA-ZAmT{uue5SFm_Z*4Do{WK za&o*+i-rqteC=YU`x7Xb3)?d*>8(p2p|4n<7J#MBRKu;GZ^lsh2N)dnTZ?qnX#NT6 z$TQ@6Y$9~k#}*>R3E8_z@IyNQU$iU6*YIFvB22M^aHVbm4zx9nAr-ROx~v$qfYNXj zCfBYY0m^TJa6~~&M7a3%jvB@3;i2-nGMW^cXB4>p$WzH+6sit-Gvfjp8&Ouvc>vK@ zU5u9TL!PqeOJULuyjBbO+CQ$05Kt(PWQ*t6#8UMWP+o{S4B%TNZW z6WiWW)BeQ~NjUM(76QMUIeibS^5*!l>mbS6{sWcf?Zo%YaL4Tu*>IH56hFMI+>ayF zU#vc>h_^04Ozwu}gU##L83NG`wTUjt;{(Kl^_3_;sK&^=$+l3ZR}h^Zl;5e)(W#&A#N6aWMlL2*MCZtR z)ePEguCKeQ=k+x*SdjT-V9qQ<_)ZxUfIze=VTs2b&`O3fu-YAF9t5>OfMjF4_2%gS zqh!le{_!JFil#gd;`oGY=Rm260v#YfNj_i92JI8s`n~XEyt=&;6!14Y!OV&;f**#r!l$)g6BavEYs+nYm_{ZKU#|4*urH0ula=(pl=&J3AQ}BFv}OhN~!F zfIE9bR`l!XFUNL0ttC%Z^#HWgl$0tM5MyMRaGYvyZk>k!UymDgtoOwkeKIvi{@#Qz z+LW+SlS5*0L1xKRMX9qNY4*txpj#e^jOnvcli^IbeJYna#^Lgwb9zg}#sBN7!n9wA ztUmwTln`A}a|DUx7E~>9k@aq&IP$lbRgOfw)R}>0314-$n(2o5moE8oJkQ*wEcT+ zNl4Qbs((Uw(w$)fjk$8p>SCjNC3r8d`yn;9i^?gf3ne&MSYiN^6hSB9QMBY>cD=H} zCwJp$B=|krsTv%^(1R?sZ$aU!N7LFZ=`5r)ssB)d?O9h`XKiG_=^!qT*j`+CMnLDclHa z&n@BBS!gMD!R+bE{)x=;FTLZAsPH5DiXrqxkvD`*i4c7bsKaUwK5PGc(adU(V(Y@l z({9JRlR{P-!PpOvQOCl8Z%KrJ?TiDOsO^=GLX#=8?TEuSo>x1=Hovlky#xjCI86Ka z-fHwaSdQoBfJD1{xieV<$pBaLc)_+#RXrC9zCnv zPe6PZgK0uE1%j_^ap7O#LMCtwk+6umm;?no^Mt8OE{BfKO+&~|RC)+`=c+LMWz&~H zh|YH>$X*=c;nSR8N{P*uyOSq+jc)91<}PllhleU;bFSZjMl2>gSd5AA=tNTob31JZ zK&0OxgN3CY+wRm~hy;Lsegj=rT*1f3CszN%@(#c{P^DKJ^!ip(b+WF4Nn56@`QbmW zBt(&mcwOZT58N!V(F^KJxNEev^BGLLx1qxLUZikDEzT8aHbW6Twen;D9Xf;iE}#0Q z4;6bH|7C!P5+GjWVvzG{e<G zK)bzi^-KUYJn4oMe{#BCEk{8;h0p#BZY7r<@SyE0%_b&!Y-c4%lQG|+`vZnY;({u4 z5OyAM12&*iBO}5Ig@17yf`0r_$2}O2m~z|pyYLTunQbGV;t)C-oWkAr_j>^`A>^)= zYmDD%Qz8&HDT}vP-fDZ|;RYUSL=q?sX%{p;L5FGLjHmMtK|`npxaFxDpR@=fc`uZc zT`fSU;Tk%@GA_e;grm#;O|`}6$1ZOq{SqPyhAN8NrM?nXRmy_GCqzmdU@%;g!d2J^ z{t5{%zMy?>2T*?3NM&^cxLy7ir6q;%MLD;B7G{>7fk;2VyVPLkV!2(T%@B0m=g{Mw z9OlTyL`MJMX9CZWmdZD@njgbJXBD~O?hJSXw~9zqt0`=Ha$H-d5Nd8HM;ut{jDeMa zzJrQ_qFNA8>iV$s6XC{Z_Oj;ZE1=n)X|4bKk)qnd?Pscj;G}ffk=g&TG zuW-k2FaFLJ0(Pq{-B3U_=YKuYsU{lQOBLb;zw2`&C(lqZ^u#r8kh-_$rVyDM;ab$+ zfY$AEbx4~_sTPb52>(nR4cs#QRQWN`@cE4X}?Alx8DSkl1xFI_Z)-dPm!t*CMyXd z05xUIQ%CHoaJnQZqQB~*?Cv*LEIBu=aa}PJs=d%)+sjWs)L#Co0AkzN%w)Zi95qB+ z)hsWX7K>5p=S{r=tiLsDUS&ueXhqa40H@R{bXT0>6&x3^3N<7Ov6FRMe1zw*)3~uR z!7(ZK6YLMvFLk(3;fb+&7@mvVR2=TF(q{cMvQv1hGd{GF2g&4uYJmhk zd131P-EM9x>U&a(K899>QLTqEH6I!Bi&sr=oRfsDcmO?ous!~)sKjxAg^+tPo%406 zK3!zscQt*`f329HEl>jZFrFhEG#KN6*O*fkA^k_iaPYI}7yu2jm!4%Nj*287JyT|; zKOKlypr%?HA`={VKjpHYD&YKS#_?4R2=5GWYipklEd5;3I2(q?va{>P?t^6)`iQ|h z9G@v(!8zr*mm0I^BK5m)$u*cKR5lo6$Xk-eNUD`(s>Yy5Sx&%8y>*bOzILE%6$zw| z_UP|~{Q=d*A4ZAw?pD6|O6846%j0v+tex$b!?9*laGOw2IXybns zDAVS&L%!++QvnPE2qRxqCWVa*5jbw*kYrG8;KEG&uw`cN;zQx#;br5?f9ZK&`&X9H z+75y+h5Ewy>4{`^?|M_?#MA4|4iqA99WX3pdVZMzyFvxuZ3x0js@Ng3~+deXeZ(DA`Ijy}~a zJU=5}LK*-!JswWPnWtU;F21t7LNYa?4+Fz`=3^dB>w;y$%k#sJv#aLA>O^gen^XZv z{T6eZzrY?ut%s){#E}hj(j6#UPPjS?S-yA2NY@VVBt!De4mp4=HY0dZ$l5Zoe^#ML zq3s(c%Ua=bi(Mi;?uu*NtR{>8+M}NN8|tipPM1g|I(#A;4)~af3@lUZYg|| zqk^=)jm0=uF&2aozAmsZr~$^CV@_*w^~lgF%Wk7+|X1j#S&HMMdE^=xw-4y-pi>0vVvBbgb|I z(6^JSiDWQ{iULj}6Cm8)kvJ?n4j_oqC(lLT;qH;8tR|RWmyiN@LM4BS)EB{jqF4~( z<#@eHe7<0?ER&*RqDR92j`sX;F&$8;$b1rBxA*`<;fvJ(RrPtQX#9YIIP7ick-aGz zYkcvmW+8z3E_HrZ@)QLTt3_gLp&Nijw$%pQ@+VE^JB9ps2MpW zaA^-hH$q(v)P-l#Dxr*2$qncLdI6wC_!oU3vzc)3z79i%%7g5KEuxIUBhMUc?JR!+ zPiI!ekii}5Vaym z+29l1s3;U`L1ONafyLLRJo8UwJOv+zH-Vxze`n#u2Wa>dylFiM?5SCpldJB^G9_85 zT3c8-7>YlW2}+aA)h68B?$ZTR_ZgLWe`Ij3wOu4PB~o$4W71CnY?@6=&OA)`c&w1A zyk26BLj8H1mzldJgLBoR`&}Y2$Yr&D7(vm1c&!fZ&f;LxF&_*j@W5CnM%tp(Y>(|A z`6uuG<4J|8^&CMYOmYnY;xwlyd|$QgR;f*;WbT*(_{H#MR>(f6*VNr{9{vU z`q%yOEYGFx%z9(ZqK6SwoPD$2>!~D%)c73gH-#izdN$ap^??q7kz(V+_31XJTrYVn z=8F_~f{w%2g|&?HAb?h@wkhm>iTjq^;rb9q9L#vfX$^=*2Fjh$q06)OIa(QRH4J?;)IOmCGyz3 zS)tQr3=F7cy?yYEV|4Rg1jUkO{RA_R)pMPVXLP`21Ha6j^Tt%7Z#!-^Lt7#1n?tWS zYSBpAuf%n$-5gU=!CpDq(Dv0h&>Co9^l_P}L5K5!P+j$rFD=^F(?Ei^_}DbI5ib=o z7Xiyso;tp4hZzNzo=c0fXX49Y3v7%oT<`kbS1K23i%qUjnkJm@+u}3VS#fvJ0AMhn zi2*vH+9i6C&l>}Yl7mS+IV91kczh-wYfGq)l5pV>M$;ZKm;n7vv6Jw%N9+C3`ISH; zPuAMt^-B@_&^^HYl>kxcpDR*y1l@AvqqF4(p&0vqeopZ0#N0XobJbP~uW55JuBgcS z&)#LOJv;z0Ia9A&nuac$sM{Zec0u6y6McZ$`o!vlIq|?@cY|eK^Gx90&E?|%)%6u% zSvFhO4~P;<2ntGfsDLyQf~0gR4bt7+pmZxBT_Pn)2!hg*B1j`4(%l`3`0wX^&pDsL zkB?k%>CD{sp4zi#t+o4F!lm0VXS2@5-U@}M??juuJXPF|H`QO>4H~G>;hzp=f~c~eDcU%p zKK0Awv6&Tn2!TY>I^VQ8aUDCn9l}t1i$<`mYX0r&>p<*LaKYogVvnMus9^FM54_Cr zS3)LGZ|0G}+rhMZ7C0zW#9cpSrfI|~wjXe0uuh~ZIrjDom5&i;)8p6SNsBhaHO?dw za!lw#$r1@6=njKO2ojK;0xh_n?{{wvyCs#yJHQn>O)k0VgN2Bvsbq<@m%OEh7q`CK z)+=?B3+5xixynXU6@2rArY3UC?jva$ZJdyR-RNG>J_L=g$YkHTGdwLGZZ)Uj1!5$k zrk~RiTzAwv;b)mEjZmjUe%N)jqQrvN0~Lqwzr*y&A*41TpICtlelZK* zs8*F6X>oAzU29tO;GzQ;qa<(qJ9TN+y+(o>#}+aAV8pZ{hd`+9f)uCgyHbK7;5Fv! zP1Ln|<0*J_L{X9Js&Si`eoVb}Ea`@gI!a)7&5WXraE4?7?i8+*^;AylpIo-jdXy+L znddBYkyWTtWLQzH`o8sy#L$qT311Vx`IG0;0%mEwksSd60awa`R^OpNR-okNP2`m+ zw&;EDIe~RX|g}rH`Iz{DsTouY3UF0C=ELqfm78>mS-IA(^^Fg-spd03ktaYN()a z*_G<(<}=$BLO-8p_P0G@xM$IR2?zusk>8EGXjj;tqA$JZm zBZ=b#+#NKU>j@T4Zi=ax?0u`0WAzco9B1d&hoa*Vw#(Fh4vOJq;Ho}`&=!oJcy)1g7 zbEFuM;_nBypfCt$?`%aDT4d8tFxo#ue6^Wfb?IqZ>3F~BTf(@6!Ft`SzX}_0E-W=z zZe-a0&)c6U_uN~dxbRGgsgcDeME?w0@I}853?*Ji4hD}BEZl4FGY?)rdDtDEXKxDfnGp?vrn`rUMdTo~x$6?lNxreXNWWFS%)E8(~B|p+s$8V|4}O7*1IMaI-cF;r1mTIg`YKBZ$hu` zi27{d(?zV@p$~5~<~`TeCbYRxZ(e`XX#KLTxG&ZjcF&Z;C!_|A!GaN#NHodC$@UjY z)K1M`n6;9J^3OBdcgmeu&qQuG@^(uW^yL(UyhXo8TVX{VRP>ef`k|(eQo!Tsn>4}V zuW9!`3b<`%5*{3g-afhFLP*r5aA`2uuV3O5pMgoDAz%I_?uJ*|r4L8LW#jQ2F|6=# zJ6_w0$b^uryN=e(#FId=8R3sv);nq z3Asp<4;gmSxs9d0b-6n__}m>a+Jrvdc#5^tEPr?m#1E}1j*L<*E60hrw$%HV$sP@y@@}f^bON+RATBC z6F;Vms?{+6<5=CTc|2~5*QWL+Q$Ic~(CP8G$xsR0;gu(0wKgi|8|NJpHEJa1$0Zk_ z)P4Ga?VkHgyY=l#(B-g5RZHcZ0t&QrYdYx35ew;yBrdOs3AC+ItKut&eYkYeRf>|p z6I_B$px|J1v7PY9BSxO~8>d_NOv8k)NxE=zxG{~m-%SxodV#IU$xqkaNGHtaKiRLd z=vEndMS}^fOQK(5-^++33?dQ|%A>GUEeQ3w)8K;Uc8gc<3*im*OjXyq+ofC4Ji(g* zn)0R32DY@ChU(zhfzQA`(27bJ^9t9gF9+1t@fKoi2ib%9O4<3b5|~lE+UIPmo1gHR2GrV-lDB!)ZRM72x|**O>D6!+@W9Oj zji);#Q_or6IoN7JKUutl(fwtMta9Zb5u3$0AmJte8HI8DPtKg{f#?SHl}mHGvzmnh zSuT(S!7%(Ky@Jyfg6hV%N!nJS&9gQl_G|K#>;4f^KQG^&V+i>1s^cz zkz|B^CpqbewHnKqxgCNX>-BXmlEL3iIf2KArOzFehh1Ky#c23Ssq$G=R2RC*a-~@G zLld~wt5grmQ5_OyPJ-foIfOa* zLn3l^0AgQw$!)}+;yw@@U{(W#AXPDHVtv@^Oc8}P(4w5o0vx0#WLe6p@6eeDJ)>PX+e&GF&ytF zGa?9TGI=e$w>XHKIZ%)7s;!RLyNTViT#8cPEyhL*Wl0e*yw5yBC2^e?r8;4ZNM0w` zSy6RTcd&5E0;+X% z5mfC0=oQjmwjAlVCOVnZfP!{aK7J1QO$&+8)^f5{_ZAsF)o@l8LELVEx)8}q#pbvd za5H!qy)~MP#yiyqpwo67@~tjvlNo-`H0ssxvS#h;Z8G?6krWEp%^!0TX@NpoZnkAW z^G;3HxOBo9HB>x8k-NlBTLtNSaiJY1*%lmrEq~M>$R)P=<$RmQ`~;)?IywqUHGy4w ze)}V9&>kQ(464jE4Ss)tRSxHFcWWn8Y@QV43#4eN7@-_EPtlUppcU$T->-{m{5(^vRmtLAX%u?Vvg7laP%-xtz(`|}SX06F z5OAq%p)(7RUc6r!SrvZzjIh%vJ?W2EyeWZ7N@H8f+ji@-5KN^8P1M!FN`pD+=^kc0 zPy7$m_=n7Tb*a2w=xAs){(c=2az1#IvhgpB2XTe2Bwe|;qThCMD{~tH#$WFXf-L@S zJ3~g#Y&U&V;u5#`!nJKzIagL{oG9$ak`F+(!16KOY)cWu1{L^o9ilmY3uAH}~;?yK+ z?c%!WYLTVE&ah?Eu=*(gc;-35gS>EKgT~xCT>9uZ95n}Yz}My8D^ycqDNRP8qK=C+ z7-!Q9H4GN0NFE*DDjZJG^Ul%6<-b;9Fo#t+z@nXhGxEyqhxGD^cXMP4a78CSQ(CDr zIp%h1S^}b|rpZuyp?RB+?0LZl1P-WwBxDw8RpP|*Uo18I&H^#<)<`eONcMn^fR;Ny zk8T&hv4g#O>s!Uhm7|$tE^_8xnfPn*`bIt={aTZr(23%Jal_}zg8Ew|%<&DH+cQr< z@N(Ms(aLVV5WFP6*A-g@h#9sZ^jmm~jPyw-a?HA#V=>#8A&q~O3GmVy=ZK44Yfw_+hcx-XfaW@LIamg+tu|A~{ zNw&))b|}5k2$F-_goWpaZ_ZhE+`A=nz>wi1?b!UJMi{;yx^TA>4eRnXqZ<<&y=5T&5^P8xh)G)dK}e* zw;a_JF1T>%h!v7Why&m-;KBlH<9p9y>dDV(#9D_F79+~%@yc3=_IjHjxzDp|d{`o~ z^n8x!G`U7%Gw;9BlaSnXhSE`06~!vBdBtrGV>h*gntxI3FcxnMUZ!DjC1Q>|Mimx1Q*VcVT2a z^s_CA2ZRzVnNFo?6uMXkCTCjWl?3@|Nyy!Q1u3eVajRd< z!A2o*PHfO)IP0hL$`FjcXzF`hN{wOzFU>iUg=}v-ul2>R#yIo$`MXU8r)EVZ;4NRf zX_4$}gp`Vj6~`wg3$P7(aLHlqF0EYhz)c&Q?>h?MaiN0l&Br(A6i1m+SIO87nlVO8 z9U1m0Zu$*}pt~mtgEtcyEWbbgfRz{HBFWY7`zw+ul~!5w)IKHmI(DSPO2|nG^}j`2 zjU$mFiBMsSJRHZl!W&Z&A{AOW;q%2wK_hho9OiAz8WvKc;kWHlwTEv&757-)y9WK_ z>olz}$ecX~Jeo4F8s7N$>~1v$PNm2;tX;n#G`roj9!>qA(qf9lai3J&WIR8*8MG73 zBH!BkC>_pk$vu8oWD=P?c|Z+R>z&yGpGl%*Va1CWJR8~ki9bT5 zh)k(2cqVej%9n}!A$Mq^nU~-J-ISs0^Akw%dCOevbjIAlUxh z?iqt0Sy1|RB0%K{VKACBBjsd;Qmpe_3NBehGFy0%PL3uvs+A&*5+AfH%A@ ztIm@Vn-uRQfdaIF%>OK)wcnMvNS9^PE_!(>MqR zN(mirK4L?u(o0PkzqZQOyns8=RHvB}#+~kGHTF^^FRBzG8WDAbNh?DkH)*M;onk7n z^oT6O*?2C-;@4>7Bkv&7(1x$R5N(TUbpeU|Z|*-lW^S7SOKul5OEyT$pDS(Io-KZz z&$RA8e4db?>WOf+hStT+5Bcr5)o||10Ts@ zw0jc=2kZ%aFEG=dQGyt_{B~v`oV0}12CedlJa9yv&t# z?b5h|m!mIG>fkz#tzIRi;={NjsX}z^TT*fg^?0g<2f242KOC*JwY36h0>{&0d+ok8 z>Il@f*^06fs#xqw=Rl>9S*>q(PGPK z11Xf2`n(zNCqd<>R;i+B8dExSYMw19|_<7i+= zvk;$2iB;tgSQHZ3R8q1fr8Y(4%xzaP#hy0YmnS2MMRL{kd{~bA_zB(>An%Yq0#bdi ze(BcM16JQC9n+kWDK0?j$7y&4mxV>vch`i4^Ux-hZQlj8r%icOuU9iAf~GAl^Anzw zb)UCtac!08-Ver~)8l~aWjKRvIdgbcSjFA5I_3#JBx|aTDU!tTSdwip%%;b+dG=wQ z4-}c1TiZL1cvqOf8;WdbxN|0yLf0vd>QOM#S9VtY#LWi>)#w*thc-aLR4d{j$>iO! zYK^!Wzk+%;m8M}Qw#LAp;fi}T9k(t!DfLsA(#K0h>U~|lw+e`a5CIe9=W$CG8Yw@< zGFV-4w(=t9<&LWD9A~m`+3p3@vf&JgqYoLYkC*g~8s^~{>a5{IXMDEyM3Ls6>6d+0 z!;=x4H33-DKhO>}TRVn|A(Wuqy$(uJ_BJOpC)>ArmEkD|j{xRRm3)O=)gd|76W11p=CgkwY<=O`NC+ua?Gegb=v;!Qo=fXDsz zI+HzwR+Klnr{>yylf13AenipKO&kj@MAi?jDz&F<{UFp8IVN+l>P)S5KYCBvLHW}# zS`Fs+XM)Mpi&5=5Gnx!V?p|xv%(v@zHfp11$U};wr#5`YxI(r!p3LZm{G^wSX?Tln zfPTI0ha!93&x`fK4#eJ4ygm`Q6Fn~1a0vo)H4a{+WKZ93VsA=3 zeji&a1l}D`zX9Pk;eC+yRPo)}NF7*T1busqRj@XvgfTF}0XW7F|F;<1Qci<)i{!JQzoBqnWrzDGz#;|D_e5W@( zXQlo8lF+bbSs$1<=2iqICZ|u;FbY`I9ZsL`CT1&jVVK(bP22~8VoTp3A+5XpDNB~u z3e)rX&NTx0^tNL6In0e2_M2uNJ4t?}BT0Tt5_0D@(?jZW!>ul9Jgc<+k{iy~a|TV8 zssSb2JxEc~U#Y(=yOB*wwB^YIve|ew-7Jt}RhZ zdyM?AJ=%Z)8*wOm{~-KCSeVcsjapX*j@L$98%ourMA*~h{;+fPR5`DV72e4D{GGy! zGV2~E=5Is@=u!C0Wql^|kLETM#CfKo)xndrX(-62W6Xw0mSt+VAE)lB!bCx_ zrBZx*SD!g}n^847r(d%%RH6Vbpn6KPC9|3I*NOlWq5g%+t*B*k+O{FYI*|_D2 zdLgR$3>HZ=4>##dZ4GaFY*It_=Th@F!MCe^B3&OiC2Ny#Ifjba0x6?cf`Sp;i(j-L z|NWWmVvNDS4Tfop*KN5h4%5w;$+sMHS(b%y@is$*Tcj_)*~xEu?!Obf`~DF+r(FYL z;kvrwHe@GxK3tk}OsbwKSoL4K{vSnSQyjG~-9Tu$U-Ei7hiPYKY~x$#v1)?5@$8o` zGi$<*(U8A%JT-}Cf~5Y{J)C`lj0XaTL~8x)r~jiJ{f}<}@BaKM7aUc^0fNG%riH8N z3G7Iaql1w`&Cc;47GB)1Orn3E zxaWx0{uB=L3*=B6G)JZ8jC*$b_;xsoh6d@s@ z7dnL%+%q2Am(r8j$Rgm}(hEb@@S4feNnPUytiPWU0f71#7_XER-n$n;w9>L^9%xeo z*^;;(-!7#akCI+uoF?>#Ye6KqZ0v=l3!R&Vgu-rv{~1o>?b*fi8Z`-moE>pYhW5pa zIKQoIuz@?(44S6h9bfXV6t;KnmW#gBiLy!r2l_;NAEX26L0Yn2O9Da8D&>F7W~ zxnA>dfS+F)Ca2Y~;`zO)Bho$nE1-*(#_!6qjEc2iGx(Zrt}|ZdPWK}IsgL_0REZ<> zuGx0hrfQ$mFh;-5qSL{;PTIgj7RpI{f6$mwDNxSQenFFc^L2)#yfcz>^rJ85@rLTI zIj9mv;*o|`Nml+n4=5jCp~yrezch#Q4&UEhm)IhQ+FE1A8_-!})LOqGzT-@xvTs zuv~5j^?Yr^yu_&JhfEY3*9by3@%zPE3!T|&-RZl4pfk%MR=5FrZ@SmhGB2F6F1{5- z)_VP5xv*F{GMVdZuZjhke4_pSsz!l#rafMaRHl2`JbOxXsWl7;F-{AL(l_~2Hp3#a}~+90)rJ?%SWe2N;^LnZ^^SVQ1(Yk`X%0-#-#g$g7nXd;C3FRBQp8I z`VWAdKq@YaHoLtS_c(n|yw-Lficn5o@CS063Xt&9n8MicF$BC0W5x-{C#qU{XS4QK z2gBV&Fi%?t$3=ugm11jyz&XpNYf_?-1P$Bj@&RmVe_>fPRS(P7=P8vN6to6A0a-%H#?w2Sst&tpBW$%|Kn=8e2&n{oTum06K;>VW#RUVfcKuTn2ea-l< zS!F|?zegab^rXb@sQzwf7wXIb{9aJuK=PYhYHYOYZJK{vz{Vbw=V3%cWxHthUH(gA z*n|4ee=s_5nC2)I-%0j3`085lAWLMPE9B|FYr=2eg$YolBa`6)a;In{%pOudBL+40 z>^kpnV#jzJ!VTw;LfSHLiC?CwqPI5yN`9oy_(4q|PpJO!OHvnTfQtxv>^tQ$e*Diy z_P3hunD9cPgdvX-Bd9I(US@O7U?t|V z1!)w>N0|d#X7b0rm#q@vZ(G1K;3&LRe&(+shd|Z5s0iy1aRv^VG^hjiVnv81fk;gM zflLD5_%tiV@I!>>5)#zNuH(&YG6TV)3%H-)%&*=$93Pd;Z7Bgt9j-Z8A5YtjUtyT( z56GtRabc4SsB77s5x+kJu~qXzic4pJZ(MFOm^=+a*CQ*`cTfJ+L*NN|J563C%w7RUYOty(|ja$&rm9)9G!NLMyV{Q%)98uokc_bV@ z&&&vigxr3NkOjf?Q)Z6Z8$_@f$8)Lrxf5Gc7!|a+k4zC6K7eX)DiD zq^H(f+wc99NhRnU4(Xzk`z5qL$0!V0Tbj&TrC5K*C$S2_ID_eetm3|Ew5!7Roz`&U z6|R2>HI|NJ)W7x!4HG|cG(D_!9}woufx+{@`n>0~;gkUx0kf7kOzwt9FPBp@Vw}>+ zSeV0&`R!ig_^m+@;b#(?(;i9{SWM%#W~8NUeuu?)78MJ_$)~uiK!Oc;n3XnPApra4 z8LT$fc!|4Q+e6cb9R=YO(4{6K^~VfD{<k z`;=LkoJe7)OcS|JDYSQi;>)RH%u{3DPrpn#tpaokMHe;lN}<`A=mK!_$SWV6JFOGe z(X5OIAgN`hMwuy+g!X2^XR(KhhI;~d3FSkVvA)s!18!FtKyz|eYjh%$3)Nmd>)NQ5 z1U6!>UChYcY>CMH$W7GXQ??NV2HwcW{C4ykkiCG@d6YAZOv`uhR=7jcIqXH4q`X7I z!u+TJzTVZZ#Fgv4Za>|eTW)AfQ`XFmguV2`YVm6I^Q*dTB1T~v$w-GnmOr`P$Tt0W z@OviMuVC&0OjsGt6*ME+6OzCe&!vwfA!u8D-eYA(Lak3Qt!yhe86ZBs1~wv)-k*x&U4T2Aa}cs1eUo< zJiMMT;V-VE%8=1XppOYg4EbQ?3w8$7<({lFNS(9$&Pz%{z&gw6Ug+Xtmi3eTnE8wJ z@&Bx5Ce~0PA!ouXeWT5&SdJgVGkEXvcn$%BY{{dlp59;#yZLQcLEi});GES*SNN2f zN%@$xfXRBKW@N2YQ^)?{TU}uNj4s>sQk=F>C^Wz{hEq;5)ATfQN%ic(ISXulc|kE! zA%0qV`^AX*afM8y&?mbdpN75?GqOfU0j^&QmLaFzMJ0>P`4lGrNfcJ?zRkGp{Y|m< z+n%5eI`;n_{{Mb}-Y9va6pM@D8G_WL0}!@#%1oKGk+x5v`1vZ2y%*L_LC>Hm5O|Jb zvF1xaPo@^fN?1|Xn99rWd6p}eJiPqV;@Wep(%N>mIYyoZvCq$$K!=dO&Jz zdGt+T3h%%@E#_$}ZmS-@u5`gddCc7ls1JqV*qU#fQ5Og4UGm%jb@jf$;r^v>^C`9w z7Zy^N#^f7c)*mllr-=(n+YKr@W$VZc^BcO#b=3&eK%Tj*eJM0pcBzNcg{qzrziydH z*{86a<;M?24B~sft}q=s`TArWseyrG|6wO6FBUvMskSxWh_UY4oXlTOu7ja(~G$;)M(_t7_! zsT7$iR4eX_p%OKl3Btbb1RMl5!!~6|4wLgHI_Q*1+(3kJ7y(NXJ;V4CC*N(mNmRx}#{3XXyjnRH z_ga!OJx_VsO%~MKFeRD}S4TLAVd{Fr@m1GeHI`1s%28o`&g$4P1D=57oIM!C-)2`76v1(f*Dajf+Eeh#kWgj?3a02P* zo1UjD#n?UP1^eSz^t&SXPh$M=;+|hgx1{mMo^Cw%;e$xln+|qL)VcR(17B5rEiDRX z-?P7ub<;+ZObOO>DSs2rhW(F&yvArFz~zIW$ygiBC^2nllN?6?CNZL!e^(`ps_x?XHEcVKsP@ zf@Urf#YIJR^I_HXqjM!3CY?Ry=KYt5h!)l#EY@0{-6tek2_({u`QbYMCL8j!dh89= z-&a6j{LwUdFCW4}`O}okEc-rg1#T#-Q{3l8mejHu>=pq1Xw z&a3__Si{XfgZ5VTAZGcoF8cFI8*}B@Gd0=i3Sg4z;>I8T(TR8%nkY|_Bd-uwU-*%Q zPB8#LAd;;(Puovd*~K7EGmz#wzBEp`_^uo6#fulatt-Vyh5y$Znb?6%Cn@UXW{+1p zO>ll06#rI_k&2M|Br%$hkYM?AMDQ3$gXXib>$QS3G)?ZdlR^;xd;XmE;G9Ueme>Q3 z>RFAv8a-cBDy(>nr5Do;vRF-I^iko$bVJT*+@kSuK^;g+zK@ zO7Gsi^YwnL_oqRGDJhYazpn#16v4gOSP-EtPF4!%r;wA8>4&2Zm&>X;H$-jmxbues z0|Vu$9c$f9bLHlPM*$0k%M3i-oV+{$fHjBzF|LIb&&Lc{&2O%bzL5crMIXfbk~L!a zDWXF{dM0p)pHoDTzXEPgA@c^Y(}J*1_7FI>L*R9k+pKBE$H#lmNSk>dzsL2>2M`Jq zJw1InDud>qme-~fRxUexZV6;Zzp3pM)#Bbh%sgx1XnPr{Gy;5mu8*|58&xYTEp2Vp zJc)QKNAJ&|r;5#M#&+HibYg6N_Oruo&64oMyNgsVjc<>Ybrbuq8T3#Bru}(raUGqs zr>uHK?%hHZPda*wjmtx+s#V~GkH z3|Y(aEG#X(KR?yFUf~;ke!kn)gs__H+_%U-dpI96W?*+J#Fnf5xg@!}7^HoChpT1p zItatKYOUf6=Ys}>amqH&kMCt8iX1_^G42#5ckcMRBtFT=CSKh9(O;xzJbU(Rx0yh}tZ%k`PkWBx&k=-&;Q|f#5N8eA z)?_WDd&&b-?m#7c+?<|;MZWfvC-3*&rR?$C;hk5N=2zI^%hh9&cOnPf{# zi#!uE^B}-)MFKNhraQa3KKmvPi8?_RxR&MT)PJ?LSqz;ag}J${QnI6SQx(IdLiWdRqkg^{Hp)ec z+3jOXhYWcPZBBX2Cz(3+%kc!hMVq4ev)8b}s3^p3A3sV12~FW=nS-&P2j1wXQS2~$ z0)oK`Yc10QXU~fEp2Wl};wjUqpFD}QlIYei&X3!1a13n0`Q*7FA$kGOIChQT_2Me!_|vV8Vy`B^*Bp zVZnxE$Ips8O<@x-t7>>PPgdBSoHOrwfpmCR+715?>!YAO)P(7chusZpW!k|>?ZJBW zoq_9B5B>Pjrl+TOA@R87a=Cd}M1+%M-V)v4i-Q!Djve;;-UD0T-mZ#5L3#N=CAJbj zD*44L93~Mv#KHR}9E^W&NSk%AAyJaejE-u);!MG)g^dfqBH@&4bYDd%OHd(0?GS{2cEjp9g~ICpT~p6yD5+rnIH`;Mwye7bBlvRvZU~qFV0`9 z&2uQ2aN#?oA})XM9`)6y4o9izC3;k5)|k}Pm%b@Sq@}$-s!c-O}3XA)whP`o}Jb@F#)wsOGU^j4m*p z^J2$tFfwBFk@qp9C9~p@k-dVue9OUL2e;hpTCGuypC}SCIHtgBP`ta`n79)AThbSzTvwu&A8~1k2#z(r;;l_2+`#@ zm>?EY1gw7#4P_V_H1Ee8zGpo`-}~5?<6-%Uc<}S*s+=#o9L;EauIn#-li5UpubGgR z)Bd;5`QMF4+p8N6sJj#OKVCu9Cnqcni%3#rsFpS+K0as3gkk3*jRYe#b)!ty#q)nX z!{Hs6R1`6fvO>X6+xz^**7E4J@weT6g-2O3yHw3^r$n>&12#wiwHce31gY-^{OKbg zP??!v2dCrGQ67pS<1crZleYF+AbXlyZPYn7_Gw^1RW9-7dkur}I#G0A~&-BJUCcDDWqpxca#gs9WujB3i!}bU1TtaP&!T09Dh;)^treC?g9tE=>b??wNdJd}RI zhVVAr64#s8nORxYbam6WJI{%NTZCJ>hic>%*T4hI?eL$xA4=0xA+z~QXQEp z;I0f8tDooPQp&BraC2YXZcvJMQb>=aef6W2}2+6`8h2WFZ)tdyL{Td64%ST_atp*1N`G7cEw$%fkv(twg zT99kIB#QLbv*cvrXfgL6H^FTiq+^zwkWx?!8fnf0Ms}CUZI^`Y&CSgfp%0h;TH=Kp zvSF$T@|9%a-3OQY_V-l|aQ2r%nA#LldoVfr`@8nbGlV$i8UxSYk<(8I|MJ`z1j7fI zxb79qr&@HS$u+XSk|D}T5;M`()>dp2UN~(AfX}mA$-8!RFLQoc{9fXLQ~Im?o~tT# zH#54`?!)AizBjLZw9xIsou9Vn-aBU7T`}3=Go(jI_OK9HV&J+XDj7=-yc7J#Q9!!_nR;=4eupqxX~6 z?80A;fB@yDuao>v+J&Yi9C3yD1(BEKwN@Bf`L%?lGUmqj7}{>K_Duy z5C{U~fBfxBOVrlJ$=Jq8Pu1Pd*inbY&D!eE3MyTnZ!AEeKB)HmZ-r-}T0IA2D@Rrq zP!zE>z`e>tMucWNYYb4b7j{uFU1VuU9D$h*CWi1nF0+E&gxgzgBYUgWUIHR(|*Uf66;Lxm*4F z1b-T|20>s>2sW2FgZQIy?aQeDTI9Dk__I8P%^89bXw)9e|9gi#Bm7T!LtATPfBa*B zKZ_d|Y>$XQ^M4nAL4=BcUQl$fwR2=Ov~@84@2fNaXCML=2w@iLnt&XdB4`K%-fyo? za`l(u`gV5zE&b~-RuC3hYlg;8&iy%zrAdA%ZRqUiWNZE33Vv<=g)-d)4HOP1Mj$T# z*1Qnee_r0n%-GtP^`Gx-r&Yn>MEh_Q-k=owPy5Hy{LlV2POAC_R{yiWukVmX%SIjs zeOHP3r~NbN|5M)4*vSco&j0NH>l^4E3?uBpctXa=N`L)QzxJQvuEqu`f7I~r10eoc z3x@QI-j#795Xis3*YKU?KQ&kz8=32~I!GC@v$5FOm?Fo(ug`Fm`etS}JcBO`-rqZM z()d3$m>KIE89SV6!0%0}<9ES;Az*;tOP5;wR+{59^RIBfH$)DePMCkcmu9g3tu*^- zrMrG~oj<+p1Q^i&tVYPmW9)Eh+vHD{uM(U^AS7YZ|K2vX({H6uZF?Mtafc2{FaK3q z-u<`Ir&`VYTouVKbay`tf0AFj9g*eppVI#>guht+e~Z_zo%ezsr>+Jnp!%z#F5gos z`sY>ts0i6S72?AL)19qp1OoZ@_qo*M_n(UX9Y^NY`liPJ8AxYg@*xn!@FxL&S}=r( GfcSq9TX~`Y diff --git a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.flat.json b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.flat.json deleted file mode 100644 index 54ef32c420..0000000000 --- a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.flat.json +++ /dev/null @@ -1,3073 +0,0 @@ -{ - "requirements": [ - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.1", - "section_name": "Kodlama ve Temizleme Mimarisi", - "req_id": "V1.1.1", - "req_description": "Girdinin yalnızca bir kez kanonik forma (canonical form) çözümlendiği veya kaçış işlemlerinin kaldırıldığı, bu işlemin yalnızca verinin bu biçimde beklenmesi durumunda yapıldığı ve bu işlemin girdi doğrulama veya temizleme işlemlerinden sonra değil, önce gerçekleştiği doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.1", - "section_name": "Kodlama ve Temizleme Mimarisi", - "req_id": "V1.1.2", - "req_description": "Uygulamanın, çıktıyı kullanılması gereken yorumlayıcıya verilmeden hemen önce veya yorumlayıcının kendisi tarafından çıktı kodlaması ya da kaçış işlemi yaptığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.2", - "section_name": "Enjeksiyon Önleme", - "req_id": "V1.2.1", - "req_description": "HTTP yanıtı, HTML veya XML belgesi için yapılan çıktı kodlamasının; HTML elemanları, HTML öznitelikleri, HTML yorumları, CSS ya da HTTP başlık alanları gibi bağlamlara uygun olduğu doğrulanmalıdır. Böylece mesaj veya belge yapısının bozulması önlenir.", - "L": "1" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.2", - "section_name": "Enjeksiyon Önleme", - "req_id": "V1.2.2", - "req_description": "Dinamik olarak URL oluşturulurken, güvenilmeyen verinin bağlamına göre (örneğin, sorgu veya yol parametreleri için URL kodlaması ya da base64url kodlaması) kodlandığı doğrulanmalıdır. Yalnızca güvenli URL protokollerine izin verilmelidir (örneğin, javascript: veya data: yasaklanmalıdır).", - "L": "1" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.2", - "section_name": "Enjeksiyon Önleme", - "req_id": "V1.2.3", - "req_description": "JavaScript içeriği (JSON dahil) dinamik olarak oluşturulurken çıktı kodlama/kaçış kullanıldığı doğrulanmalıdır. Böylece mesaj veya belge yapısı değiştirilmemiş olur (JavaScript ve JSON enjeksiyonlarının önüne geçilir).", - "L": "1" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.2", - "section_name": "Enjeksiyon Önleme", - "req_id": "V1.2.4", - "req_description": "Veri sorguları veya veritabanı sorguları (SQL, HQL, NoSQL, Cypher vb.) için parametreli sorgular, ORM’ler, entity framework’ler kullanıldığı ya da SQL enjeksiyonu ve diğer veritabanı enjeksiyon saldırılarına karşı koruma sağlandığı doğrulanmalıdır. Bu durum, saklı yordam (stored procedure) yazarken de geçerlidir.", - "L": "1" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.2", - "section_name": "Enjeksiyon Önleme", - "req_id": "V1.2.5", - "req_description": "Uygulamanın işletim sistemi komut enjeksiyonlarına karşı korunduğu ve işletim sistemi çağrılarında parametreli OS sorguları veya bağlama özgü komut satırı çıktı kodlamasının kullanıldığı doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.2", - "section_name": "Enjeksiyon Önleme", - "req_id": "V1.2.6", - "req_description": "Uygulamanın LDAP enjeksiyon zafiyetlerine karşı korunduğu ya da LDAP enjeksiyonlarını önlemek için özel güvenlik kontrollerinin uygulandığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.2", - "section_name": "Enjeksiyon Önleme", - "req_id": "V1.2.7", - "req_description": "XPath enjeksiyon saldırılarına karşı, sorgu parametrelemesi veya önceden derlenmiş sorgular kullanılarak koruma sağlandığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.2", - "section_name": "Enjeksiyon Önleme", - "req_id": "V1.2.8", - "req_description": "LaTeX işlemcilerinin güvenli şekilde yapılandırıldığı (örneğin, --shell-escape bayrağının kullanılmadığı) ve yalnızca izin verilen komutlardan oluşan bir listeyle çalıştırıldığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.2", - "section_name": "Enjeksiyon Önleme", - "req_id": "V1.2.9", - "req_description": "Düzenli ifadelerde (regex) özel karakterlerin (genellikle ters eğik çizgi \\ ile) kaçırılarak meta karakter olarak yorumlanmalarının önlendiği doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.2", - "section_name": "Enjeksiyon Önleme", - "req_id": "V1.2.10", - "req_description": "Uygulamanın CSV ve formül enjeksiyonlarına karşı korunduğu doğrulanmalıdır. Uygulama, CSV içeriği dışa aktarırken RFC 4180 Bölüm 2.6 ve 2.7'de tanımlanan kaçış kurallarına uymalıdır. Ayrıca, CSV veya diğer tablo formatlarına (XLS, XLSX, ODF gibi) aktarım yapılırken, alanın ilk karakteri olarak çıkan özel karakterler ('=', '+', '-', '@', '\\t' (sekme), '\\0' (null karakter)) tek tırnak (') ile kaçırılmalıdır.", - "L": "3" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.3", - "section_name": "Temizleme (Sanitization)", - "req_id": "V1.3.1", - "req_description": "WYSIWYG editörlerinden veya benzer kaynaklardan gelen tüm güvenilmeyen HTML girdilerinin, bilinen ve güvenli bir HTML temizleme kütüphanesi ya da çerçeve özelliği ile temizlendiği doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.3", - "section_name": "Temizleme (Sanitization)", - "req_id": "V1.3.2", - "req_description": "Uygulamanın eval() veya Spring Expression Language (SpEL) gibi dinamik kod çalıştırma özelliklerini kullanmaktan kaçındığı doğrulanmalıdır. Alternatif yoksa, kullanıcı girdisi çalıştırılmadan önce mutlaka temizlenmelidir.", - "L": "1" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.3", - "section_name": "Temizleme (Sanitization)", - "req_id": "V1.3.3", - "req_description": "Potansiyel olarak tehlikeli bir bağlamda kullanılacak verilerin, bu bağlama uygun karakterlere izin vermek ve çok uzun girdileri kısaltmak gibi güvenlik önlemleriyle önceden temizlendiği doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.3", - "section_name": "Temizleme (Sanitization)", - "req_id": "V1.3.4", - "req_description": "Kullanıcı tarafından sağlanan SVG içeriğinin, yalnızca güvenli etiket ve özellikler (örneğin grafik çizme ile ilgili) içerdiğinden emin olmak için onaylandığı veya temizlendiği doğrulanmalıdır (ör. script veya foreignObject içermemelidir).", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.3", - "section_name": "Temizleme (Sanitization)", - "req_id": "V1.3.5", - "req_description": "Markdown, CSS, XSL stil sayfaları, BBCode veya benzeri ifade şablon dillerinde kullanıcı girdisinin temizlendiği veya bu tür özelliklerin devre dışı bırakıldığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.3", - "section_name": "Temizleme (Sanitization)", - "req_id": "V1.3.6", - "req_description": "Uygulamanın, güvenilmeyen verileri başka servislere iletmeden önce izinli protokol, alan adı, yol ve port listelerine göre doğruladığı ve tehlikeli karakterleri temizlediği doğrulanarak SSRF (Sunucu Taraflı İstek Sahteciliği) saldırılarına karşı korunduğu doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.3", - "section_name": "Temizleme (Sanitization)", - "req_id": "V1.3.7", - "req_description": "Uygulamanın şablon enjeksiyon saldırılarına karşı, güvenilmeyen girdilere dayalı şablon oluşturmayı engellediği; eğer bu kaçınılmazsa, bu girdilerin mutlaka temizlendiği veya sıkı şekilde onaylandığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.3", - "section_name": "Temizleme (Sanitization)", - "req_id": "V1.3.8", - "req_description": "JNDI sorgularında kullanılmadan önce güvenilmeyen girdilerin temizlendiği ve JNDI'nin enjeksiyonlara karşı güvenli şekilde yapılandırıldığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.3", - "section_name": "Temizleme (Sanitization)", - "req_id": "V1.3.9", - "req_description": "Memcache’e gönderilmeden önce içeriğin temizlenerek enjeksiyon saldırılarına karşı korunduğu doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.3", - "section_name": "Temizleme (Sanitization)", - "req_id": "V1.3.10", - "req_description": "Format dizgilerinin (format strings) beklenmeyen veya zararlı şekilde çözümlenmesini önlemek için işlenmeden önce temizlendiği doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.3", - "section_name": "Temizleme (Sanitization)", - "req_id": "V1.3.11", - "req_description": "SMTP veya IMAP enjeksiyonlarını önlemek için, kullanıcı girdisinin posta sistemlerine iletilmeden önce temizlendiği doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.3", - "section_name": "Temizleme (Sanitization)", - "req_id": "V1.3.12", - "req_description": "Regex girdilerinin üstel geri izlemeye (exponential backtracking) neden olan öğeler içermediği ve güvenilmeyen girdilerin ReDoS (Regex Denial of Service) gibi saldırılara karşı temizlendiği doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.4", - "section_name": "Bellek, Dizgi ve Yönetilmeyen Kod", - "req_id": "V1.4.1", - "req_description": "Yığın, arabellek (buffer) veya yığın belleği taşmalarını önlemek ya da tespit etmek amacıyla, bellek güvenli dizgi işlemlerinin, daha güvenli bellek kopyalama ve işaretçi aritmetiğinin kullanıldığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.4", - "section_name": "Bellek, Dizgi ve Yönetilmeyen Kod", - "req_id": "V1.4.2", - "req_description": "Tamsayı taşmalarını önlemek için işaret (sign), aralık (range) ve giriş doğrulama tekniklerinin kullanıldığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.4", - "section_name": "Bellek, Dizgi ve Yönetilmeyen Kod", - "req_id": "V1.4.3", - "req_description": "Dinamik olarak ayrılan belleğin ve kaynakların serbest bırakıldığı ve boşaltılan belleklere ait referansların veya işaretçilerin kaldırıldığı veya null yapıldığı doğrulanmalıdır (dangling pointer ve use-after-free zafiyetlerine karşı).", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.5", - "section_name": "Güvenli Ters Serileştirme (Safe Deserialization)", - "req_id": "V1.5.1", - "req_description": "XML ayrıştırıcılarının (parser) kısıtlayıcı şekilde yapılandırıldığı ve dış varlık çözümleme (external entity resolution) gibi güvensiz özelliklerin XXE (XML eXternal Entity) saldırılarına karşı devre dışı bırakıldığı doğrulanmalıdır .", - "L": "1" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.5", - "section_name": "Güvenli Ters Serileştirme (Safe Deserialization)", - "req_id": "V1.5.2", - "req_description": "Güvenilmeyen verilerin ters serileştirilmesinde, nesne türleri için izinli liste kullanımı veya istemci tanımlı nesne türlerinin kısıtlanması gibi güvenli giriş işleme önlemlerinin uygulandığı doğrulanmalıdır. Güvensiz olarak tanımlanmış ters serileştirme mekanizmaları, güvenilmeyen girdilerle kullanılmamalıdır.", - "L": "2" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.5", - "section_name": "Güvenli Ters Serileştirme (Safe Deserialization)", - "req_id": "V1.5.3", - "req_description": "Aynı veri türü için uygulamada kullanılan farklı parser'ların (ör. JSON, XML, URL parser'ları), veriyi tutarlı şekilde ayrıştırdığı ve aynı karakter kodlamasını kullandığı doğrulanmalıdır. Böylece JSON birlikte çalışabilirlik açıkları, URI veya dosya ayrıştırma farkları gibi sorunlar nedeniyle RFI veya SSRF saldırılarının istismar edilmesi önlenir.", - "L": "3" - }, - { - "chapter_id": "V2", - "chapter_name": "Doğrulama ve İş Mantığı", - "section_id": "V2.1", - "section_name": "Doğrulama ve İş Mantığı Dokümantasyonu", - "req_id": "V2.1.1", - "req_description": "Uygulama dokümantasyonunda, veri öğelerinin beklenen yapıya göre nasıl doğrulanacağına ilişkin giriş doğrulama kurallarının tanımlandığı doğrulanmalıdır. Bu; kredi kartı numaraları, e-posta adresleri, telefon numaraları gibi yaygın veri biçimleri olabileceği gibi iç sistemlere özel biçimler de olabilir.", - "L": "1" - }, - { - "chapter_id": "V2", - "chapter_name": "Doğrulama ve İş Mantığı", - "section_id": "V2.1", - "section_name": "Doğrulama ve İş Mantığı Dokümantasyonu", - "req_id": "V2.1.2", - "req_description": "Uygulama dokümantasyonunda, birleştirilmiş veri öğelerinin mantıksal ve bağlamsal tutarlılığının nasıl doğrulanacağı tanımlanmalıdır (örneğin, mahalle ve posta kodunun eşleşip eşleşmediğinin kontrolü).", - "L": "2" - }, - { - "chapter_id": "V2", - "chapter_name": "Doğrulama ve İş Mantığı", - "section_id": "V2.1", - "section_name": "Doğrulama ve İş Mantığı Dokümantasyonu", - "req_id": "V2.1.3", - "req_description": "Hem kullanıcı bazında hem de uygulama genelinde geçerli olacak şekilde, iş mantığı sınırları ve doğrulama beklentilerinin belgelendiği doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V2", - "chapter_name": "Doğrulama ve İş Mantığı", - "section_id": "V2.2", - "section_name": "Girdi Doğrulama", - "req_id": "V2.2.1", - "req_description": "Girdilerin, işlevsel ya da iş gereksinimlerine uygunluğunun doğrulandığı teyit edilmelidir. Bu işlem; izinli değerler, desenler ve aralıklar listesine karşı pozitif doğrulama ile ya da girdinin beklenen yapıya ve mantıksal sınırlara uygunluğunun önceden tanımlanmış kurallara göre karşılaştırılması ile yapılmalıdır. Seviye 1 için bu, güvenlik veya iş kararlarında kullanılan girdilere odaklanabilir. Seviye 2 ve üstü için tüm girdilere uygulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V2", - "chapter_name": "Doğrulama ve İş Mantığı", - "section_id": "V2.2", - "section_name": "Girdi Doğrulama", - "req_id": "V2.2.2", - "req_description": "Uygulamanın, güvenilir bir servis katmanında girdi doğrulama zorunluluğu uygulayacak şekilde tasarlandığı doğrulanmalıdır. İstemci tarafında gerçekleştirilen doğrulama, kullanılabilirliği artırabilir ve teşvik edilmelidir. Ancak bu doğrulama,güvenlik kontrolü olarak kabul edilmemelidir.", - "L": "1" - }, - { - "chapter_id": "V2", - "chapter_name": "Doğrulama ve İş Mantığı", - "section_id": "V2.2", - "section_name": "Girdi Doğrulama", - "req_id": "V2.2.3", - "req_description": "Uygulamanın, ilişkili veri öğelerinin önceden tanımlanmış kurallara göre makul olup olmadığını kontrol ettiği doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V2", - "chapter_name": "Doğrulama ve İş Mantığı", - "section_id": "V2.3", - "section_name": "İş Mantığı Güvenliği", - "req_id": "V2.3.1", - "req_description": "Uygulamanın, aynı kullanıcı için iş mantığı akışlarını yalnızca beklenen adım sırasına göre ve adım atlamadan işlediği doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V2", - "chapter_name": "Doğrulama ve İş Mantığı", - "section_id": "V2.3", - "section_name": "İş Mantığı Güvenliği", - "req_id": "V2.3.2", - "req_description": "İş mantığı sınırlarının, uygulama dokümantasyonuna uygun şekilde uygulandığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V2", - "chapter_name": "Doğrulama ve İş Mantığı", - "section_id": "V2.3", - "section_name": "İş Mantığı Güvenliği", - "req_id": "V2.3.3", - "req_description": "İş mantığı seviyesinde işlemlerin (transaction) kullanıldığı ve bir iş mantığı işleminin ya bütünüyle başarıyla tamamlandığı ya da önceki geçerli duruma geri döndürüldüğü (rollback) doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V2", - "chapter_name": "Doğrulama ve İş Mantığı", - "section_id": "V2.3", - "section_name": "İş Mantığı Güvenliği", - "req_id": "V2.3.4", - "req_description": "İş mantığı düzeyinde kilitleme mekanizmalarının, sınırlı kaynakların (ör. sinema koltukları, teslimat zamanları) uygulamanın mantığı manipüle edilerek çift rezervasyona neden olmamasını sağladığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V2", - "chapter_name": "Doğrulama ve İş Mantığı", - "section_id": "V2.3", - "section_name": "İş Mantığı Güvenliği", - "req_id": "V2.3.5", - "req_description": "Yüksek değerli iş mantığı akışlarının, yetkisiz veya kazara gerçekleşebilecek işlemleri önlemek için çoklu kullanıcı onayı gerektirdiği doğrulanmalıdır. Bu işlemler büyük para transferleri, sözleşme onayları, gizli bilgilere erişim veya üretimde güvenlik kurallarının geçersiz kılınmaları gibi durumları içerebilir.", - "L": "3" - }, - { - "chapter_id": "V2", - "chapter_name": "Doğrulama ve İş Mantığı", - "section_id": "V2.4", - "section_name": "Otomasyon Karşıtı Önlemler", - "req_id": "V2.4.1", - "req_description": "Uygulama işlevlerine yönelik aşırı miktardaki çağrılara karşı; veri sızdırma, anlamsız veri üretme, kota tüketme, hız sınırının aşılması, hizmet reddi (DoS) ya da maliyetli kaynakların aşırı kullanımı gibi risklere karşı otomasyon karşıtı kontrollerin bulunduğu doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V2", - "chapter_name": "Doğrulama ve İş Mantığı", - "section_id": "V2.4", - "section_name": "Otomasyon Karşıtı Önlemler", - "req_id": "V2.4.2", - "req_description": "İş mantığı akışlarının, aşırı hızlı işlem gönderimlerini önleyecek şekilde gerçekçi insan zamanlaması gerektirdiği doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.1", - "section_name": "Web Frontend Güvenlik Dokümantasyonu", - "req_id": "V3.1.1", - "req_description": "Uygulama dokümantasyonunda, uygulamayı kullanan tarayıcıların desteklemesi gereken güvenlik özelliklerinin (ör. HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) ve diğer ilgili HTTP güvenlik mekanizmaları) tanımlandığı doğrulanmalıdır. Ayrıca bu özelliklerin mevcut olmadığı durumlarda uygulamanın nasıl davranması gerektiği (ör. kullanıcıyı uyarmak veya erişimi engellemek) de tanımlanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.2", - "section_name": "İçeriğin Yanlış Yorumlanması", - "req_id": "V3.2.1", - "req_description": "Tarayıcıların HTTP yanıtlarında içerik veya işlevi yanlış bir bağlamda sunmalarını önlemek amacıyla güvenlik kontrollerinin uygulandığı doğrulanmalıdır (ör. API, kullanıcı tarafından yüklenen dosya veya başka bir kaynağın doğrudan çağrılması durumunda). Olası kontroller arasında; yalnızca HTTP istek başlıklarının (ör. Sec-Fetch-\\*) doğru bağlamı gösterdiği durumlarda içeriğin sunulması, Content-Security-Policy başlığında \"sandbox\" yönergesinin kullanılması veya Content-Disposition başlığında \"attachment\" biçiminin kullanılması yer alabilir.", - "L": "1" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.2", - "section_name": "İçeriğin Yanlış Yorumlanması", - "req_id": "V3.2.2", - "req_description": "HTML yerine metin olarak görüntülenmesi amaçlanan içeriğin, HTML veya JavaScript gibi içeriklerin istenmeden çalıştırılmasını önleyecek şekilde \"createTextNode\" veya \"textContent\" gibi güvenli işleme fonksiyonlarıyla işlendiği doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.2", - "section_name": "İçeriğin Yanlış Yorumlanması", - "req_id": "V3.2.3", - "req_description": "Uygulamanın istemci tarafı JavaScript kullanırken açık değişken tanımlamaları yaparak, sıkı tür kontrolü uygulayarak, global değişkenleri document nesnesine kaydetmekten kaçınarak ve ad alanı izolasyonu sağlayarak DOM clobbering’den kaçındığı doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.3", - "section_name": "Çerez Yapılandırması", - "req_id": "V3.3.1", - "req_description": "Çerezlerin 'Secure' niteliğine sahip olduğu ve eğer çerez adı '\\__Host-' ön eki ile başlamıyorsa, '__Secure-' ön ekinin kullanıldığı doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.3", - "section_name": "Çerez Yapılandırması", - "req_id": "V3.3.2", - "req_description": "Kullanıcı arayüzü kandırma saldırılarına ve tarayıcı tabanlı istek sahteciliği saldırılarına (CSRF) karşı koruma sağlamak amacıyla, her çerezin 'SameSite' niteliğinin kullanım amacına uygun şekilde ayarlandığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.3", - "section_name": "Çerez Yapılandırması", - "req_id": "V3.3.3", - "req_description": "Çerez adı, diğer sunucularla paylaşılmak üzere açıkça tasarlanmadığı sürece '__Host-' ön eki ile tanımlanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.3", - "section_name": "Çerez Yapılandırması", - "req_id": "V3.3.4", - "req_description": "Bir çerez değeri istemci tarafı betikleri tarafından erişilememesi gereken bir veri içeriyorsa (ör. oturum token'ı), çerezin 'HttpOnly' niteliğine sahip olduğu ve aynı değerin (ör. oturum token'ı) yalnızca 'Set-Cookie' başlığı ile istemciye iletildiği doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.3", - "section_name": "Çerez Yapılandırması", - "req_id": "V3.3.5", - "req_description": "Uygulama bir çerez oluştururken, çerez adı ve değerinin toplam uzunluğunun 4096 baytı aşmadığı doğrulanmalıdır. Çok büyük çerezler tarayıcı tarafından saklanmaz ve isteklerle gönderilmez; bu da çereze bağlı çalışan uygulama işlevlerinin bozulmasına yol açabilir.", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.4", - "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", - "req_id": "V3.4.2", - "req_description": "Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header'ı, uygulama tarafından sabit bir değer olarak tanımlanmalı veya gelen Origin header değeri güvenilir origin’lerden oluşan bir izinli listeye karşı doğrulanmalıdır. ‘Access-Control-Allow-Origin: *’ kullanılması gerekiyorsa, yanıtın hassas bilgi içermediği doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.4", - "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", - "req_id": "V3.4.3", - "req_description": "HTTP yanıtlarında Content-Security-Policy header'ı bulunduğu ve bu header'ın yalnızca güvenilen içeriklerin veya kaynakların yüklenmesini ve çalıştırılmasını sağlayan yönergeler içerdiği doğrulanmalıdır. Minimum olarak \"global policy\", object-src 'none', base-uri 'none' yönergelerini içermeli ve izinli liste, nonce veya hash temelli bir yapı içermelidir. Seviye 3 uygulamalarında her yanıt için nonce veya hash içeren özel bir politika tanımlanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.4", - "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", - "req_id": "V3.4.4", - "req_description": "Tüm HTTP yanıtlarının 'X-Content-Type-Options: nosniff' header'ını içerdiği doğrulanmalıdır. Bu, tarayıcıya içerik türünü tahmin etmeyi bırakmasını ve yanıtın Content-Type header'ında belirtilen MIME türünün, beklenen kaynak türüyle eşleşmesini zorunlu kılar. Ayrıca bu, tarayıcıda CORB (Cross-Origin Read Blocking) özelliğini etkinleştirir.", - "L": "2" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.4", - "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", - "req_id": "V3.4.5", - "req_description": "Uygulamanın, 'Referer' başlığı yoluyla üçüncü taraflara teknik olarak hassas verilerin sızmasını önlemek için bir 'referrer policy' belirlediği doğrulanmalıdır. Bu, Referrer-Policy HTTP header'ıyla veya HTML öğe nitelikleriyle (element attributes) sağlanabilir. Sızabilecek hassas bilgiler, URL’deki yol ve sorgu parametreleri ile sınırlı uygulamalarda hostname bilgisini içerebilir.", - "L": "2" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.4", - "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", - "req_id": "V3.4.6", - "req_description": "Uygulamanın, Content-Security-Policy header'ı altında 'frame-ancestors' yönergesini her HTTP yanıtında tanımladığı ve bu sayede içeriklerin varsayılan olarak başka sayfalara gömülmesini engellediği doğrulanmalıdır. Gerekli durumlarda özel olarak izin verildiğinden emin olunmalıdır. 'X-Frame-Options' header'ı, tarayıcılar tarafından desteklenmesine rağmen, artık güncel değildir ve güvenlik amacıyla kullanılmamalıdır.", - "L": "2" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.4", - "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", - "req_id": "V3.4.8", - "req_description": "Bir belgenin işlenmesini ve sunulmasını başlatan tüm HTTP yanıtlarında (örneğin 'text/html' tipi yanıtlar), 'Cross-Origin-Opener-Policy' header'ı 'same-origin' veya 'same-origin-allow-popups' yönergeleriyle birlikte yer almalıdır. Bu, tabnabbing ve frame counting gibi, pencere nesnelerine paylaşımlı erişimi sömüren saldırılara karşı koruma sağlar.", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.5", - "section_name": "Tarayıcı Menşei Ayırımı", - "req_id": "V3.5.1", - "req_description": "Uygulama, hassas işlevselliğe yönelik izinsiz cross-origin istekleri önlemek için CORS preflight mekanizmasına güvenmiyorsa, bu tür isteklerin gerçekten uygulamadan geldiği doğrulanmalıdır. Bu, anti-forgery token kullanımı veya CORS tarafından güvenli kabul edilmeyen özel HTTP header'larının zorunlu kılınmasıyla yapılabilir. Bu, tarayıcı tabanlı istek sahteciliği (CSRF) saldırılarına karşı bir savunmadır.", - "L": "1" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.5", - "section_name": "Tarayıcı Menşei Ayırımı", - "req_id": "V3.5.2", - "req_description": "Uygulama, hassas işlevlerin izinsiz cross-origin çağrılmasını önlemek için CORS preflight mekanizmasına güveniyorsa, bu işlevlerin bir CORS-preflight isteğini tetiklemeden çağrılamadığı doğrulanmalıdır. Bu, 'Origin' ve 'Content-Type' header'larının doğrulanmasını veya CORS-safelisted olmayan bir header'ın ve alanın kullanılmasını gerektirebilir.", - "L": "1" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.5", - "section_name": "Tarayıcı Menşei Ayırımı", - "req_id": "V3.5.4", - "req_description": "Farklı uygulamaların farklı hostname'lerde barındırıldığı ve böylece Same-Origin Policy tarafından sağlanan kısıtlamalardan (örneğin çerez erişim sınırları, kaynaklar arası etkileşim kontrolleri) faydalanıldığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.5", - "section_name": "Tarayıcı Menşei Ayırımı", - "req_id": "V3.5.6", - "req_description": "Uygulamanın herhangi bir yerinde JSONP işlevselliğinin etkin olmadığı doğrulanmalıdır. Bu, XSSI (Cross-Site Script Inclusion) saldırılarını önlemek içindir.", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.5", - "section_name": "Tarayıcı Menşei Ayırımı", - "req_id": "V3.5.7", - "req_description": "Yetkilendirme gerektiren verilerin, JavaScript dosyaları gibi betik kaynaklarının yanıtlarında yer almadığı, XSSI saldırılarını önlemek için doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.5", - "section_name": "Tarayıcı Menşei Ayırımı", - "req_id": "V3.5.8", - "req_description": "Kimliği doğrulanmış kaynakların (örneğin görseller, videolar, betikler ve belgeler) yalnızca gerçekten amaçlandığında kullanıcı adına yüklenebildiği veya gömülebildiği doğrulanmalıdır. Bu, isteğin uygun olmayan bir çapraz kaynak çağrısından kaynaklanmadığından emin olmak için Sec-Fetch-* HTTP istek başlığı alanlarının sıkı bir şekilde doğrulanmasıyla veya tarayıcıya döndürülen içeriği engelleme talimatı vermek için kısıtlayıcı bir Cross-Origin-Resource-Policy HTTP yanıt başlığı alanı ayarlayarak gerçekleştirilebilir.", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.6", - "section_name": "Harici Kaynak Bütünlüğü", - "req_id": "V3.6.1", - "req_description": "JavaScript kütüphaneleri, CSS veya web fontları gibi istemci tarafı varlıkların yalnızca statik ve sürümlü olması, varlığın bütünlüğünü doğrulamak için Subresource Integrity (SRI) kullanılması durumunda harici olarak (örneğin, bir İçerik Dağıtım Ağı üzerinde) barındırıldığı doğrulanmalıdır. Bu mümkün değilse, her bir kaynak için bunu gerekçelendiren belgelenmiş bir güvenlik kararı bulunmalıdır.", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.7", - "section_name": "Diğer Tarayıcı Güvenliği Hususları", - "req_id": "V3.7.1", - "req_description": "Uygulamanın yalnızca hâlâ desteklenen ve güvenli kabul edilen istemci tarafı teknolojileri kullandığı doğrulanmalıdır. Bu gereksinimi karşılamayan teknolojilere örnek olarak NSAPI eklentileri, Flash, Shockwave, ActiveX, Silverlight, NACL veya istemci tarafı Java applet’leri verilebilir.", - "L": "2" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.7", - "section_name": "Diğer Tarayıcı Güvenliği Hususları", - "req_id": "V3.7.2", - "req_description": "Uygulamanın, yalnızca hedef adres bir izinli listede yer alıyorsa kullanıcıyı otomatik olarak farklı bir ana makine adına veya uygulamanın kontrolünde olmayan bir etki alanına yönlendirdiği doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.7", - "section_name": "Diğer Tarayıcı Güvenliği Hususları", - "req_id": "V3.7.3", - "req_description": "Uygulamanın, kullanıcı uygulamanın kontrolü dışındaki bir URL’ye yönlendirildiğinde, yönlendirme hakkında bir bildirim gösterdiği ve kullanıcının bu gezintiyi iptal edebilmesi için bir seçenek sunduğu doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.7", - "section_name": "Diğer Tarayıcı Güvenliği Hususları", - "req_id": "V3.7.4", - "req_description": "Uygulamanın en üst düzey etki alanının (örneğin, site.tld) HTTP Strict Transport Security (HSTS) için genel preload listesine eklendiği doğrulanmalıdır. Bu, uygulamanın TLS kullanımının ana tarayıcılar tarafından doğrudan tanınmasını ve yalnızca Strict-Transport-Security yanıt header'ına bağlı kalınmamasını sağlar.", - "L": "3" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.7", - "section_name": "Diğer Tarayıcı Güvenliği Hususları", - "req_id": "V3.7.5", - "req_description": "Uygulamaya erişen tarayıcının beklenen güvenlik özelliklerini desteklememesi durumunda, uygulamanın dokümantasyona uygun şekilde davrandığı (örneğin kullanıcıyı uyarma veya erişimi engelleme) doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V4", - "chapter_name": "API ve Web Servisi", - "section_id": "V4.1", - "section_name": "Genel Web Servisi Güvenliği", - "req_id": "V4.1.1", - "req_description": "İleti gövdesi içeren her HTTP yanıtında, yanıtın gerçek içeriğiyle eşleşen bir Content-Type header alanı bulunduğu ve güvenli karakter kodlamasını (örneğin, UTF-8, ISO-8859-1) belirtmek üzere charset parametresi içerdiği doğrulanmalıdır. Bu işlem, IANA Medya Türleri'nden \"text/\", \"/+xml\" ve \"/xml\" gibi içerikler için geçerlidir.", - "L": "1" - }, - { - "chapter_id": "V4", - "chapter_name": "API ve Web Servisi", - "section_id": "V4.1", - "section_name": "Genel Web Servisi Güvenliği", - "req_id": "V4.1.2", - "req_description": "Yalnızca kullanıcı arayüzüne yönelik uç noktaların (manuel olarak web tarayıcısı ile erişilmesi amaçlanan) otomatik olarak HTTP'den HTTPS'e yönlendirme yaptığı ve diğer hizmetlerin veya uç noktaların şeffaf yönlendirme gerçekleştirmediği doğrulanmalıdır. Bu, istemcinin farkında olmadan şifrelenmemiş HTTP istekleri göndermesi ve bu isteklerin otomatik olarak HTTPS'e yönlendirilmesi sonucunda hassas verilerin sızmasının fark edilmemesi riskini önlemek içindir.", - "L": "2" - }, - { - "chapter_id": "V4", - "chapter_name": "API ve Web Servisi", - "section_id": "V4.1", - "section_name": "Genel Web Servisi Güvenliği", - "req_id": "V4.1.3", - "req_description": "Uygulama tarafından kullanılan ve yük dengeleyici, web proxy veya frontend için backend hizmeti gibi bir ara katman tarafından ayarlanan herhangi bir HTTP başlık alanının, son kullanıcı tarafından geçersiz kılınamayacağı doğrulanmalıdır. Örnek başlıklar arasında X-Real-IP, X-Forwarded-* veya X-User-ID yer alabilir.", - "L": "2" - }, - { - "chapter_id": "V4", - "chapter_name": "API ve Web Servisi", - "section_id": "V4.1", - "section_name": "Genel Web Servisi Güvenliği", - "req_id": "V4.1.4", - "req_description": "Uygulama veya API tarafından açıkça desteklenen HTTP yöntemlerinin (preflight istekleri sırasında OPTIONS dahil) dışında hiçbir yöntemin kullanılmadığı ve kullanılmayan yöntemlerin engellendiği doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V4", - "chapter_name": "API ve Web Servisi", - "section_id": "V4.1", - "section_name": "Genel Web Servisi Güvenliği", - "req_id": "V4.1.5", - "req_description": "Çok hassas istekler veya birçok sistemden geçen işlemler için, taşıma katmanı güvenliğinin üzerine ek bir güvence sağlamak amacıyla, her iletiye özel dijital imzaların kullanıldığı doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V4", - "chapter_name": "API ve Web Servisi", - "section_id": "V4.2", - "section_name": "HTTP İleti Yapısı Doğrulama", - "req_id": "V4.2.1", - "req_description": "Tüm uygulama bileşenlerinin (yük dengeleyiciler, güvenlik duvarları ve uygulama sunucuları dahil) HTTP sürümüne uygun mekanizmaları kullanarak gelen HTTP iletilerinin sınırlarını belirlediği ve bu sayede HTTP istek kaçakçılığına karşı koruma sağlandığı doğrulanmalıdır. HTTP/1.x sürümünde Transfer-Encoding başlık alanı varsa, RFC 2616'ya göre Content-Length başlığı göz ardı edilmelidir. HTTP/2 veya HTTP/3 kullanıldığında, Content-Length başlığı varsa, alıcının bu değerin DATA çerçevelerinin uzunluğuyla tutarlı olduğunu doğrulaması gerekir.", - "L": "2" - }, - { - "chapter_id": "V4", - "chapter_name": "API ve Web Servisi", - "section_id": "V4.2", - "section_name": "HTTP İleti Yapısı Doğrulama", - "req_id": "V4.2.2", - "req_description": "HTTP iletileri üretilirken, Content-Length başlığının, HTTP protokolünün çerçeveleme yöntemine göre belirlenen içerik uzunluğu ile çelişmediği doğrulanmalıdır. Bu, istek kaçakçılığı saldırılarını önlemek için gereklidir.", - "L": "3" - }, - { - "chapter_id": "V4", - "chapter_name": "API ve Web Servisi", - "section_id": "V4.2", - "section_name": "HTTP İleti Yapısı Doğrulama", - "req_id": "V4.2.3", - "req_description": "Uygulamanın, yanıt bölme ve header enjeksiyonu saldırılarını önlemek amacıyla, bağlantıya özel başlık alanları (örneğin Transfer-Encoding) içeren HTTP/2 veya HTTP/3 iletilerini göndermediği ve kabul etmediği doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V4", - "chapter_name": "API ve Web Servisi", - "section_id": "V4.2", - "section_name": "HTTP İleti Yapısı Doğrulama", - "req_id": "V4.2.4", - "req_description": "Uygulamanın yalnızca başlık alanları ve değerleri CR (\\r), LF (\\n) veya CRLF (\\r\\n) karakter dizileri içermeyen HTTP/2 ve HTTP/3 isteklerini kabul ettiği doğrulanmalıdır. Bu, başlık enjeksiyonu saldırılarını önlemek içindir.", - "L": "3" - }, - { - "chapter_id": "V4", - "chapter_name": "API ve Web Servisi", - "section_id": "V4.2", - "section_name": "HTTP İleti Yapısı Doğrulama", - "req_id": "V4.2.5", - "req_description": "Uygulama (backend veya frontend) istek oluşturuyor ve gönderiyorsa, URI'ler (örneğin API çağrıları için) veya HTTP istek başlıkları (örneğin Authorization veya Cookie) gibi bileşenlerin, alıcı sistemler tarafından kabul edilemeyecek kadar uzun olmamasını sağlamak amacıyla doğrulama, temizleme veya diğer mekanizmaları kullandığı doğrulanmalıdır. Bu tür çok uzun istekler (örneğin çok uzun bir Cookie başlığı) gönderildiğinde sunucunun sürekli hata durumu döndürmesiyle hizmet reddi oluşabilir.", - "L": "3" - }, - { - "chapter_id": "V4", - "chapter_name": "API ve Web Servisi", - "section_id": "V4.3", - "section_name": "GraphQL", - "req_id": "V4.3.1", - "req_description": "Maliyetli ve iç içe geçmiş sorgular sonucu oluşabilecek GraphQL veya veri katmanı ifadelerine yönelik Hizmet Reddi (DoS) saldırılarını önlemek için, sorgu izin listesi (allowlist), derinlik sınırlandırması, sorgu sayısı sınırlandırması veya sorgu maliyeti analizi kullanıldığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V4", - "chapter_name": "API ve Web Servisi", - "section_id": "V4.3", - "section_name": "GraphQL", - "req_id": "V4.3.2", - "req_description": "GraphQL introspection (iç yapı sorgulama) sorgularının, GraphQL API'nin üçüncü taraflar tarafından kullanılmasına yönelik olmadığı sürece, üretim ortamında devre dışı bırakıldığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V4", - "chapter_name": "API ve Web Servisi", - "section_id": "V4.4", - "section_name": "WebSocket", - "req_id": "V4.4.1", - "req_description": "Tüm WebSocket bağlantılarında TLS üzerinden WebSocket (WSS) kullanıldığı doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V4", - "chapter_name": "API ve Web Servisi", - "section_id": "V4.4", - "section_name": "WebSocket", - "req_id": "V4.4.2", - "req_description": "WebSocket'in başlangıçtaki HTTP el sıkışması (handshake) sırasında, Origin başlık alanının uygulama için izin verilen origin listesiyle karşılaştırılarak kontrol edildiği doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V4", - "chapter_name": "API ve Web Servisi", - "section_id": "V4.4", - "section_name": "WebSocket", - "req_id": "V4.4.3", - "req_description": "Uygulamanın standart oturum yönetimi kullanılamıyorsa, bunun yerine ilgili Oturum Yönetimi güvenlik gereksinimlerine uygun özel token'ların kullanıldığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V4", - "chapter_name": "API ve Web Servisi", - "section_id": "V4.4", - "section_name": "WebSocket", - "req_id": "V4.4.4", - "req_description": "HTTPS oturumu WebSocket kanalına geçerken, özel WebSocket oturum yönetim token’larının önceki şekilde kimliği doğrulanmış HTTPS oturumu aracılığıyla elde edildiği veya doğrulandığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V5", - "chapter_name": "Dosya İşleme", - "section_id": "V5.1", - "section_name": "Dosya İşleme Dokümantasyonu", - "req_id": "V5.1.1", - "req_description": "Dokümantasyonun, her yükleme özelliği için izin verilen dosya türlerini, beklenen dosya uzantılarını ve maksimum boyutu (açılmış hali dahil) tanımladığı doğrulanmalıdır. Ayrıca, dosyaların son kullanıcılar için nasıl güvenli hâle getirileceği (örneğin kötü amaçlı bir dosya tespit edildiğinde uygulamanın nasıl davranacağı) gibi bilgilerin de belgede yer aldığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V5", - "chapter_name": "Dosya İşleme", - "section_id": "V5.2", - "section_name": "Dosya Yükleme ve İçerik", - "req_id": "V5.2.1", - "req_description": "Uygulamanın, yalnızca performans kaybına veya hizmet reddine yol açmayacak boyuttaki dosyaları kabul ettiği doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V5", - "chapter_name": "Dosya İşleme", - "section_id": "V5.2", - "section_name": "Dosya Yükleme ve İçerik", - "req_id": "V5.2.2", - "req_description": "Uygulama bir dosyayı, doğrudan veya bir arşiv (ör. zip dosyası) içinde kabul ettiğinde, dosya uzantısının beklenen uzantıyla eşleşip eşleşmediğini kontrol ettiği ve içeriğin uzantı tarafından temsil edilen türle uyumlu olduğunu doğruladığı kontrol edilmelidir. Bu; ilk 'magic byte' kontrolü, görüntü yeniden yazımı ve dosya içeriği doğrulama için özel kütüphanelerin kullanımı gibi yöntemleri içerir. Seviye 1 için bu, yalnızca iş veya güvenlik kararlarında kullanılan dosyalarla sınırlı olabilir. Seviye 2 ve üzeri için tüm dosyalar bu kontrole tabi olmalıdır.", - "L": "1" - }, - { - "chapter_id": "V5", - "chapter_name": "Dosya İşleme", - "section_id": "V5.2", - "section_name": "Dosya Yükleme ve İçerik", - "req_id": "V5.2.3", - "req_description": "Sıkıştırılmış dosyaların (ör. zip, gz, docx, odt) açılmadan önce, izin verilen maksimum açılmış boyuta ve maksimum dosya sayısına göre kontrol edildiği doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V5", - "chapter_name": "Dosya İşleme", - "section_id": "V5.2", - "section_name": "Dosya Yükleme ve İçerik", - "req_id": "V5.2.4", - "req_description": "Her kullanıcı için dosya boyutu kotası ve maksimum dosya sayısının uygulandığı doğrulanmalıdır. Böylece tek bir kullanıcının çok sayıda veya aşırı büyük dosya yükleyerek depolama alanını doldurması engellenir.", - "L": "3" - }, - { - "chapter_id": "V5", - "chapter_name": "Dosya İşleme", - "section_id": "V5.2", - "section_name": "Dosya Yükleme ve İçerik", - "req_id": "V5.2.5", - "req_description": "Uygulamanın, içinde sembolik bağlantılar (symlink) bulunan sıkıştırılmış dosyaların yüklenmesine yalnızca bu durum özel olarak gerekli olduğunda izin verdiği doğrulanmalıdır. Bu durumda, sembolik bağlantı verilebilecek dosyaların bir izinli listesi uygulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V5", - "chapter_name": "Dosya İşleme", - "section_id": "V5.2", - "section_name": "Dosya Yükleme ve İçerik", - "req_id": "V5.2.6", - "req_description": "Uygulamanın, piksel boyutu izin verilen maksimum değeri aşan görüntü dosyalarının yüklenmesini reddettiği doğrulanmalıdır. Bu, pixel flood saldırılarını önlemek için gereklidir.", - "L": "3" - }, - { - "chapter_id": "V5", - "chapter_name": "Dosya İşleme", - "section_id": "V5.3", - "section_name": "Dosya Depolama", - "req_id": "V5.3.1", - "req_description": "Güvenilmeyen girdilerle yüklenen veya oluşturulan ve herkese açık klasörlerde depolanan dosyaların, bir HTTP isteğiyle doğrudan erişildiğinde sunucu taraflı program kodu olarak çalıştırılmadığı doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V5", - "chapter_name": "Dosya İşleme", - "section_id": "V5.3", - "section_name": "Dosya Depolama", - "req_id": "V5.3.2", - "req_description": "Uygulamanın, dosya işlemleri için dosya yollarını oluştururken kullanıcı tarafından gönderilen dosya adlarını değil, dahili olarak oluşturulan veya güvenilir verileri kullandığı; eğer kullanıcı tarafından gönderilen dosya adları veya meta veriler kullanılacaksa, sıkı doğrulama ve temizleme işlemlerinin uygulandığı doğrulanmalıdır. Bu, yol geçişi (path traversal), yerel veya uzak dosya dahil etme (LFI, RFI) ve sunucu tarafı istek sahteciliği (SSRF) saldırılarına karşı koruma sağlar.", - "L": "1" - }, - { - "chapter_id": "V5", - "chapter_name": "Dosya İşleme", - "section_id": "V5.3", - "section_name": "Dosya Depolama", - "req_id": "V5.3.3", - "req_description": "Sunucu tarafında gerçekleşen dosya işlemlerinin (örneğin dosya açma/decompress işlemi), kullanıcı tarafından sağlanan yol bilgilerini yok saydığı ve zip slip gibi güvenlik açıklarını önlediği doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V5", - "chapter_name": "Dosya İşleme", - "section_id": "V5.4", - "section_name": "Dosya İndirme", - "req_id": "V5.4.1", - "req_description": "Uygulamanın, kullanıcı tarafından gönderilen dosya adlarını (ör. JSON, JSONP veya URL parametresinde) doğruladığı veya göz ardı ettiği ve yanıtın Content-Disposition başlık alanında bir dosya adı belirttiği doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V5", - "chapter_name": "Dosya İşleme", - "section_id": "V5.4", - "section_name": "Dosya İndirme", - "req_id": "V5.4.2", - "req_description": "Sunulan dosya adlarının (örneğin HTTP yanıt header'larında veya e-posta eklerinde), belge yapısını korumak ve enjeksiyon saldırılarını önlemek için kodlandığı veya temizlendiği (ör. RFC 6266’ya uygun) doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V5", - "chapter_name": "Dosya İşleme", - "section_id": "V5.4", - "section_name": "Dosya İndirme", - "req_id": "V5.4.3", - "req_description": "Güvenilmeyen kaynaklardan elde edilen dosyaların, bilinen kötü amaçlı içeriklerin sunulmasını önlemek amacıyla antivirüs tarayıcılarıyla tarandığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.1", - "section_name": "Kimlik Doğrulama Dokümantasyonu", - "req_id": "V6.1.1", - "req_description": "Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırılarına karşı oran sınırlama (rate limiting), otomasyon karşıtı önlemler ve uyarlanabilir yanıt gibi kontrollerin nasıl kullanıldığını açıklayan bir uygulama dokümantasyonu bulunduğu doğrulanmalıdır. Dokümantasyon, bu kontrollerin nasıl yapılandırıldığını ve kötü niyetli hesap kilitlemenin nasıl önlendiğini açıkça ortaya koymalıdır.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.1", - "section_name": "Kimlik Doğrulama Dokümantasyonu", - "req_id": "V6.1.2", - "req_description": "Parolalarda kullanılmasını önlemek amacıyla, bağlama özgü sözcüklerin (örneğin kurum adlarının permütasyonları, ürün adları, sistem tanımlayıcıları, proje kod adları, departman veya rol adları vb.) bulunduğu belgelenmiş bir liste mevcut olduğu doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.1", - "section_name": "Kimlik Doğrulama Dokümantasyonu", - "req_id": "V6.1.3", - "req_description": "Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, bunların tümünün belgelenmiş olduğu ve her yol için tutarlı şekilde uygulanması gereken güvenlik kontrolleri ile kimlik doğrulama gücünün tanımlandığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.2", - "section_name": "Parola Güvenliği", - "req_id": "V6.2.1", - "req_description": "Kullanıcı tarafından belirlenen parolaların en az 8 karakter uzunluğunda olması sağlanmalı, ancak 15 karakter ve üzeri uzunlukta parolalar olmaları şiddetle tavsiye edilir.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.2", - "section_name": "Parola Güvenliği", - "req_id": "V6.2.2", - "req_description": "Kullanıcıların parolalarını değiştirebilmeleri sağlanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.2", - "section_name": "Parola Güvenliği", - "req_id": "V6.2.3", - "req_description": "Parola değiştirme işlevinin hem mevcut hem de yeni parolayı gerektirdiği doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.2", - "section_name": "Parola Güvenliği", - "req_id": "V6.2.4", - "req_description": "Kayıt veya parola değişimi sırasında girilen parolaların, uygulamanın parola politikasına (örneğin minimum uzunluk) uyan ilk 3000 yaygın parolaya karşı kontrol edildiği doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.2", - "section_name": "Parola Güvenliği", - "req_id": "V6.2.5", - "req_description": "Her tür karakterin kullanılmasına izin verildiği ve büyük/küçük harf, sayı veya özel karakter şartlarının zorunlu tutulmadığı doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.2", - "section_name": "Parola Güvenliği", - "req_id": "V6.2.6", - "req_description": "Parola giriş alanlarının, girdiyi maskelemek için \"type=password\" kullandığı doğrulanmalıdır. Uygulamalar, kullanıcının tüm maskelenmiş parolayı ya da son girilen karakteri geçici olarak görüntülemesine izin verebilir.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.2", - "section_name": "Parola Güvenliği", - "req_id": "V6.2.7", - "req_description": "\"Yapıştır\" özelliğinin, tarayıcı parola yardımcılarının ve harici parola yöneticilerinin kullanımına izin verildiği doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.2", - "section_name": "Parola Güvenliği", - "req_id": "V6.2.8", - "req_description": "Uygulamanın, kullanıcıdan aldığı parolayı herhangi bir şekilde değiştirmeden, örneğin kesmeden veya harf büyüklüğünü değiştirmeden, tam olarak doğruladığı teyit edilmelidir.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.2", - "section_name": "Parola Güvenliği", - "req_id": "V6.2.9", - "req_description": "En az 64 karakter uzunluğundaki parolalara izin verildiği doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.2", - "section_name": "Parola Güvenliği", - "req_id": "V6.2.10", - "req_description": "Kullanıcının parolasının, yalnızca ele geçirildiği tespit edildiğinde veya kullanıcı tarafından yenilendiğinde geçerliliğini yitirdiği doğrulanmalıdır. Uygulama, belirli aralıklarla parola yenilenmesini zorunlu kılmamalıdır.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.2", - "section_name": "Parola Güvenliği", - "req_id": "V6.2.11", - "req_description": "Tahmin edilmesi kolay parolaların oluşturulmasını önlemek amacıyla, bağlama özgü kelimelerin yer aldığı belgelenmiş listenin parola doğrulamada kullanıldığı teyit edilmelidir.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.2", - "section_name": "Parola Güvenliği", - "req_id": "V6.2.12", - "req_description": "Kayıt veya parola değişikliği sırasında girilen parolaların, ele geçirilmiş parolalar listesine karşı kontrol edildiği doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.3", - "section_name": "Genel Kimlik Doğrulama Güvenliği", - "req_id": "V6.3.1", - "req_description": "Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırıları gibi saldırıları önlemeye yönelik kontrollerin, uygulamanın güvenlik dokümantasyonuna göre uygulandığı doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.3", - "section_name": "Genel Kimlik Doğrulama Güvenliği", - "req_id": "V6.3.2", - "req_description": "\"root\", \"admin\" veya \"sa\" gibi varsayılan kullanıcı hesaplarının uygulamada yer almadığı veya devre dışı bırakıldığı doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.3", - "section_name": "Genel Kimlik Doğrulama Güvenliği", - "req_id": "V6.3.3", - "req_description": "Uygulamaya erişim için ya çok faktörlü bir kimlik doğrulama mekanizması ya da tek faktörlü mekanizmaların kombinasyonu kullanılmalıdır. Seviye 3 için, bu faktörlerden biri, oltalama saldırılarına karşı direnç sağlayan ve kimlik doğrulama niyetini bir kullanıcı etkileşimi (örneğin FIDO donanım anahtarında bir düğmeye basma veya mobil telefonda bir onay) gerektirerek doğrulayan donanım tabanlı bir kimlik doğrulayıcı olmalıdır. Bu gereksinimdeki herhangi bir esneklik için, gerekçesi belgelenmiş ve riskleri azaltıcı kapsamlı kontroller içeren bir plan gereklidir.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.3", - "section_name": "Genel Kimlik Doğrulama Güvenliği", - "req_id": "V6.3.4", - "req_description": "Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, belgelendirilmemiş bir yol bulunmadığı ve tüm yollar için güvenlik kontrolleri ile kimlik doğrulama gücünün tutarlı şekilde uygulandığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.3", - "section_name": "Genel Kimlik Doğrulama Güvenliği", - "req_id": "V6.3.5", - "req_description": "Başarılı veya başarısız şüpheli kimlik doğrulama girişimlerinin kullanıcıya bildirildiği doğrulanmalıdır. Bu, olağandışı bir konum veya istemciden gelen girişimler, yalnızca bir faktörle yapılan kısmen başarılı doğrulamalar, uzun süreli inaktiflik sonrası yapılan girişimler veya birçok başarısız denemeden sonraki başarılı girişimler gibi durumları içerebilir.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.3", - "section_name": "Genel Kimlik Doğrulama Güvenliği", - "req_id": "V6.3.6", - "req_description": "E-postanın, tek faktörlü ya da çok faktörlü kimlik doğrulama mekanizması olarak kullanılmadığı doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.3", - "section_name": "Genel Kimlik Doğrulama Güvenliği", - "req_id": "V6.3.7", - "req_description": "Kimlik doğrulama detaylarında yapılan güncellemeler sonrasında (örneğin kimlik bilgisi sıfırlama, kullanıcı adı veya e-posta adresi değişiklikleri), kullanıcıların bilgilendirildiği doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.3", - "section_name": "Genel Kimlik Doğrulama Güvenliği", - "req_id": "V6.3.8", - "req_description": "Başarısız kimlik doğrulama girişimlerinden, geçerli kullanıcıların hata mesajları, HTTP yanıt kodları veya farklı yanıt süreleri gibi sonuçlara dayanarak tespit edilemediği doğrulanmalıdır. Bu koruma, kayıt ve \"parolamı unuttum\" işlevselliğinde de geçerli olmalıdır.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.4", - "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", - "req_id": "V6.4.1", - "req_description": "Sistem tarafından oluşturulan ilk parolaların veya etkinleştirme kodlarının güvenli bir şekilde rastgele üretildiği, mevcut parola politikasına uygun olduğu, kısa bir süre içinde veya ilk kullanım sonrasında geçerliliğini yitirdiği doğrulanmalıdır. Bu başlangıç sırları uzun vadeli parola olarak kullanılmasına izin verilmemelidir.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.4", - "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", - "req_id": "V6.4.2", - "req_description": "Parola ipuçlarının veya \"gizli sorular\" olarak bilinen, bilgiye dayalı kimlik doğrulama mekanizmalarının mevcut olmadığı doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.4", - "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", - "req_id": "V6.4.3", - "req_description": "Unutulmuş parolanın sıfırlanması için, etkin olan çok faktörlü kimlik doğrulama mekanizmalarını atlamayan güvenli bir sürecin uygulandığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.4", - "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", - "req_id": "V6.4.4", - "req_description": "Çok faktörlü kimlik doğrulama faktörlerinden biri kaybolursa, kayıt sırasında uygulanan kimlik kanıtlama seviyesiyle aynı seviyede kimlik doğrulama yapıldığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.4", - "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", - "req_id": "V6.4.5", - "req_description": "Süresi dolacak kimlik doğrulama mekanizmalarının yenilenmesine ilişkin talimatların, süresi dolmadan önce tamamlanacak şekilde yeterli sürede gönderildiği ve gerekiyorsa otomatik hatırlatıcıların yapılandırıldığı doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.4", - "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", - "req_id": "V6.4.6", - "req_description": "Yönetici yetkisi olan kullanıcıların, kullanıcının parola sıfırlama sürecini başlatabildiği ancak kullanıcının yeni parolasını belirleyemediği veya değiştiremediği doğrulanmalıdır. Bu, yönetici yetkisi olan kullanıcıların, kullanıcı parolasını bilmesini engeller.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.5", - "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", - "req_id": "V6.5.1", - "req_description": "Arama sırları, bant dışı kimlik doğrulama istekleri veya kodları ve zamana dayalı tek kullanımlık parolaların (TOTP) yalnızca bir kez kullanılabildiği doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.5", - "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", - "req_id": "V6.5.2", - "req_description": "Uygulamanın backend tarafında saklanırken, 112 bitten az entropiye sahip (örneğin 19 rastgele harf-rakam karakteri veya 34 rastgele rakam) arama sırlarının, 32-bit rastgele bir salt içeren onaylı bir parola saklama algoritmasıyla hash’lendiği doğrulanmalıdır. Gizli bilginin entropisi 112 bit veya daha fazlaysa standart bir hash fonksiyonu kullanılabilir.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.5", - "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", - "req_id": "V6.5.3", - "req_description": "Arama sırları, bant dışı kimlik doğrulama kodları ve zamana dayalı tek kullanımlık parola seed'lerinin, öngörülebilir değerlerden kaçınmak için Kriptografik Olarak Güvenli Sözde Rastgele Sayı Üreteci (CSPRNG) ile oluşturulduğu doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.5", - "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", - "req_id": "V6.5.4", - "req_description": "Arama sırlarının ve bant dışı kimlik doğrulama kodlarının en az 20 bit entropiye (genellikle 4 rastgele harf-rakam karakteri veya 6 rastgele rakam) sahip olduğu doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.5", - "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", - "req_id": "V6.5.5", - "req_description": "Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının ve zamana dayalı tek kullanımlık parolaların (TOTP) belirli bir ömre sahip olduğu doğrulanmalıdır. Bant dışı istekler en fazla 10 dakika, TOTP’ler ise en fazla 30 saniye geçerli olmalıdır.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.5", - "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", - "req_id": "V6.5.6", - "req_description": "Herhangi bir kimlik doğrulama faktörünün (fiziksel cihazlar dahil) çalınması veya kaybı durumunda iptal edilebildiği doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.5", - "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", - "req_id": "V6.5.7", - "req_description": "Biyometrik kimlik doğrulama mekanizmalarının yalnızca ikincil faktör olarak, “sahip olduğunuz bir şey” veya “bildiğiniz bir şey” ile birlikte kullanıldığı doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.5", - "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", - "req_id": "V6.5.8", - "req_description": "Zamana dayalı tek kullanımlık parolaların (TOTP) doğrulamasının, güvenilir bir hizmetten alınan zaman kaynağına dayanarak yapıldığı ve güvenilir olmayan veya istemci tarafından sağlanan zaman kaynağına dayanmadığı doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.6", - "section_name": "Bant Dışı Kimlik Doğrulama Mekanizmaları", - "req_id": "V6.6.1", - "req_description": "Tek kullanımlık parolaların (OTP) telefon veya SMS ile Public Switched Telephone Network (PSTN) üzerinden iletildiği kimlik doğrulama mekanizmalarının, yalnızca telefon numarası önceden doğrulanmışsa, alternatif daha güçlü yöntemler (örneğin TOTP) de sunuluyorsa ve kullanıcıya güvenlik riskleri hakkında bilgi veriliyorsa sunulduğu doğrulanmalıdır. Seviye 3 uygulamalar için telefon ve SMS seçenekleri sunulmamalıdır.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.6", - "section_name": "Bant Dışı Kimlik Doğrulama Mekanizmaları", - "req_id": "V6.6.2", - "req_description": "Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının, oluşturuldukları özgün kimlik doğrulama isteğiyle bağlantılı olduğu ve daha önceki ya da sonraki bir istek için kullanılamadığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.6", - "section_name": "Bant Dışı Kimlik Doğrulama Mekanizmaları", - "req_id": "V6.6.3", - "req_description": "Kod tabanlı bant dışı kimlik doğrulama mekanizmalarının, oran sınırlaması ile kaba kuvvet saldırılarına karşı korunduğu doğrulanmalıdır. En az 64 bit entropiye sahip kodlar kullanılması da değerlendirilmelidir.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.6", - "section_name": "Bant Dışı Kimlik Doğrulama Mekanizmaları", - "req_id": "V6.6.4", - "req_description": "Çok faktörlü kimlik doğrulama için push bildirimleri kullanılıyorsa, push bombing saldırılarına karşı oran sınırlamasının kullanıldığı doğrulanmalıdır. “Numara eşleştirme” de bu riski azaltabilir.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.7", - "section_name": "Kriptografik Kimlik Doğrulama Mekanizması", - "req_id": "V6.7.1", - "req_description": "Kriptografik kimlik doğrulama beyanlarını doğrulamak için kullanılan sertifikaların, değiştirilmeye karşı korumalı şekilde saklandığı doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.7", - "section_name": "Kriptografik Kimlik Doğrulama Mekanizması", - "req_id": "V6.7.2", - "req_description": "Challenge nonce değerinin en az 64 bit uzunluğunda olduğu ve istatistiksel olarak benzersiz ya da cihazın ömrü boyunca benzersiz olduğu doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.8", - "section_name": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", - "req_id": "V6.8.1", - "req_description": "Uygulama birden fazla kimlik sağlayıcıyı (IdP) destekliyorsa, başka bir desteklenen kimlik sağlayıcı aracılığıyla (örneğin aynı kullanıcı tanımlayıcısını kullanarak) kullanıcının kimliğinin taklit edilemediği doğrulanmalıdır. Standart önlem, uygulamanın kullanıcıyı IdP kimliği (bir ad alanı işlevi görür) ve IdP içindeki kullanıcı kimliğinin birleşimiyle kaydetmesi ve tanımlamasıdır.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.8", - "section_name": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", - "req_id": "V6.8.2", - "req_description": "Kimlik doğrulama beyanları üzerindeki dijital imzaların (örneğin JWT veya SAML beyanları) varlığı ve bütünlüğünün her zaman doğrulandığı ve imzasız veya geçersiz imzalı beyanların reddedildiği doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.8", - "section_name": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", - "req_id": "V6.8.3", - "req_description": "SAML beyanlarının benzersiz biçimde işlendiği ve yalnızca geçerlilik süresi içinde bir kez kullanıldığı, tekrar oynatma (replay) saldırılarını önlemek amacıyla doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.8", - "section_name": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", - "req_id": "V6.8.4", - "req_description": "Uygulama ayrı bir Kimlik Sağlayıcı (IdP) kullanıyorsa ve belirli işlemler için belirli kimlik doğrulama gücü, yöntemleri veya zaman bilgisi bekliyorsa, uygulamanın bu bilgileri IdP tarafından döndürülen veriler üzerinden doğruladığı teyit edilmelidir. Örneğin OIDC kullanılıyorsa, bu durum ID Token üzerindeki 'acr', 'amr' ve 'auth_time' gibi claim’lerin (varsa) doğrulanması ile sağlanabilir. Eğer IdP bu bilgileri sağlamıyorsa, uygulamanın asgari kimlik doğrulama gücünün kullanıldığını varsayan (örneğin yalnızca kullanıcı adı ve parola ile tek faktörlü doğrulama) belgelenmiş bir yedek yaklaşımı olmalıdır.", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.1", - "section_name": "Oturum Yönetim Dokümantasyonu", - "req_id": "V7.1.1", - "req_description": "Kullanıcının oturum inaktivite zaman aşımı süresi ve mutlak maksimum oturum süresinin belgelendiği, diğer kontrollerle birlikte uygun olduğu ve NIST SP 800-63B yeniden kimlik doğrulama gereksinimlerinden herhangi bir sapma varsa gerekçesinin belgede yer aldığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.1", - "section_name": "Oturum Yönetim Dokümantasyonu", - "req_id": "V7.1.2", - "req_description": "Belgede bir hesap için kaç adet eşzamanlı (paralel) oturuma izin verildiği ile birlikte, maksimum aktif oturum sayısına ulaşıldığında uygulanacak davranış ve işlemlerin tanımlandığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.1", - "section_name": "Oturum Yönetim Dokümantasyonu", - "req_id": "V7.1.3", - "req_description": "Birleşik kimlik yönetim ekosisteminin bir parçası olarak kullanıcı oturumu oluşturan ve yöneten tüm sistemlerin, oturum ömrü, sonlandırma ve yeniden kimlik doğrulama gerektiren diğer koşulların nasıl koordine edildiğini açıklayan kontrollerle birlikte belgede yer aldığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.2", - "section_name": "Temel Oturum Yönetimi Güvenliği", - "req_id": "V7.2.1", - "req_description": "Uygulamanın tüm oturum token'ı doğrulama işlemlerini güvenilir bir backend servisi aracılığıyla gerçekleştirdiği doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.2", - "section_name": "Temel Oturum Yönetimi Güvenliği", - "req_id": "V7.2.2", - "req_description": "Uygulamanın, statik API gizli anahtarları veya sabit değerler yerine, oturum yönetimi için dinamik olarak oluşturulan kendi kendine yeterli veya referans token'ları kullandığı doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.2", - "section_name": "Temel Oturum Yönetimi Güvenliği", - "req_id": "V7.2.3", - "req_description": "Uygulama kullanıcı oturumlarını temsil etmek için referans token'ları kullanıyorsa, bu token'ların benzersiz olduğu, kriptografik olarak güvenli bir sözde rastgele sayı üreteci (CSPRNG) kullanılarak üretildiği ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.2", - "section_name": "Temel Oturum Yönetimi Güvenliği", - "req_id": "V7.2.4", - "req_description": "Uygulamanın, kullanıcı kimlik doğrulaması (yeniden kimlik doğrulama dahil) sırasında yeni bir oturum token'ı oluşturduğu ve mevcut oturum token'ını sonlandırdığı doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.3", - "section_name": "Oturum Zaman Aşımı", - "req_id": "V7.3.1", - "req_description": "Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde bir hareketsizlik zaman aşımı bulunduğu doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.3", - "section_name": "Oturum Zaman Aşımı", - "req_id": "V7.3.2", - "req_description": "Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde mutlak bir maksimum oturum süresi bulunduğu doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.4", - "section_name": "Oturum Sonlandırma", - "req_id": "V7.4.1", - "req_description": "Oturum sonlandırma tetiklendiğinde (örneğin, çıkış yapıldığında veya süre dolduğunda), uygulamanın oturumun daha fazla kullanılmasına izin vermediği doğrulanmalıdır. Referans token'lar veya durum bilgili oturumlar için bu, oturum verilerinin uygulama arka ucunda geçersiz kılınması anlamına gelir. Kapsamlı token kullanan uygulamaların; sonlandırılmış token listesi tutmak, kullanıcıya özel tarih ve saatten önce oluşturulan token'ları reddetmek veya kullanıcıya özel imzalama anahtarını yenilemek gibi bir çözüm uygulaması gerekir.", - "L": "1" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.4", - "section_name": "Oturum Sonlandırma", - "req_id": "V7.4.2", - "req_description": "Bir kullanıcı hesabı devre dışı bırakıldığında veya silindiğinde (örneğin bir çalışanın şirketten ayrılması), uygulamanın tüm aktif oturumları sonlandırdığı doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.4", - "section_name": "Oturum Sonlandırma", - "req_id": "V7.4.3", - "req_description": "Herhangi bir kimlik doğrulama faktörünün başarılı bir şekilde değiştirilmesi veya kaldırılmasından (şifre sıfırlama veya kurtarma yoluyla yapılan değişiklikler dahil ve varsa MFA ayarları güncellemeleri dahil) sonra, uygulamanın diğer tüm aktif oturumları sonlandırma seçeneği sunduğu doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.4", - "section_name": "Oturum Sonlandırma", - "req_id": "V7.4.4", - "req_description": "Kimlik doğrulama gerektiren tüm sayfalarda kolay erişilebilir ve görünür bir çıkış yap (logout) işlevi bulunduğu doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.4", - "section_name": "Oturum Sonlandırma", - "req_id": "V7.4.5", - "req_description": "Uygulama yöneticilerinin, bireysel bir kullanıcının veya tüm kullanıcıların aktif oturumlarını sonlandırabilme yetkisine sahip olduğu doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.5", - "section_name": "Oturum Kötüye Kullanımına Karşı Savunmalar", - "req_id": "V7.5.1", - "req_description": "E-posta adresi, telefon numarası, MFA yapılandırması veya hesap kurtarmada kullanılan diğer bilgiler gibi kimlik doğrulamayı etkileyebilecek hassas hesap özniteliklerinde değişiklik yapılmadan önce uygulamanın tam yeniden kimlik doğrulama gerektirdiği doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.5", - "section_name": "Oturum Kötüye Kullanımına Karşı Savunmalar", - "req_id": "V7.5.2", - "req_description": "Kullanıcıların, (en az bir faktörle yeniden kimlik doğrulama yaptıktan sonra) mevcut tüm aktif oturumları görüntüleyebilmesi ve sonlandırabilmesinin mümkün olduğu doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.5", - "section_name": "Oturum Kötüye Kullanımına Karşı Savunmalar", - "req_id": "V7.5.3", - "req_description": "Uygulamanın, son derece hassas işlemler veya operasyonlar gerçekleştirilmeden önce en az bir faktörle ek kimlik doğrulaması veya ikincil bir doğrulama gerektirdiği doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.6", - "section_name": "Birleşik Yeniden Kimlik Doğrulama", - "req_id": "V7.6.1", - "req_description": "Güvenen Taraf (RP) ile Kimlik Sağlayıcı (IdP) arasındaki oturum süresi ve oturum sonlandırma davranışlarının belgelenmiş olduğu ve, örneğin IdP kimlik doğrulama olayları arasında maksimum süreye ulaşıldığında yeniden kimlik doğrulamanın gerekli kılındığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.6", - "section_name": "Birleşik Yeniden Kimlik Doğrulama", - "req_id": "V7.6.2", - "req_description": "Yeni bir oturum oluşturulmasının, kullanıcı onayı veya açık bir eylem gerektirdiği; kullanıcı etkileşimi olmaksızın yeni uygulama oturumlarının oluşturulmasının önlendiği doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V8", - "chapter_name": "Yetkilendirme", - "section_id": "V8.1", - "section_name": "Yetkilendirme Dokümantasyonu", - "req_id": "V8.1.1", - "req_description": "Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak işlev düzeyinde ve veriye özel erişim kısıtlamaları için kuralları tanımladığı doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V8", - "chapter_name": "Yetkilendirme", - "section_id": "V8.1", - "section_name": "Yetkilendirme Dokümantasyonu", - "req_id": "V8.1.2", - "req_description": "Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak alan (field) düzeyinde erişim kısıtlamaları (hem okuma hem yazma) için kuralları tanımladığı doğrulanmalıdır. Bu kuralların, ilgili veri nesnesinin durum veya statü gibi diğer özniteliklerine bağlı olabileceği unutulmamalıdır.", - "L": "2" - }, - { - "chapter_id": "V8", - "chapter_name": "Yetkilendirme", - "section_id": "V8.1", - "section_name": "Yetkilendirme Dokümantasyonu", - "req_id": "V8.1.3", - "req_description": "Uygulamanın dokümantasyonunun, kimlik doğrulama ve yetkilendirme ile ilgili güvenlik kararlarının alınmasında kullanılan çevresel ve bağlamsal öznitelikleri (günün saati, kullanıcı konumu, IP adresi veya cihaz gibi) tanımladığı doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V8", - "chapter_name": "Yetkilendirme", - "section_id": "V8.1", - "section_name": "Yetkilendirme Dokümantasyonu", - "req_id": "V8.1.4", - "req_description": "Kimlik doğrulama ve yetkilendirme dokümantasyonunun; işlev düzeyinde, veriye özel ve alan düzeyinde yetkilendirmenin yanı sıra çevresel ve bağlamsal faktörlerin karar almada nasıl kullanıldığını tanımladığı doğrulanmalıdır. Bu, değerlendirilen öznitelikleri, risk eşiklerini ve alınan aksiyonları (ör. izin ver, doğrulama iste, reddet, step-up kimlik doğrulama) içermelidir.", - "L": "3" - }, - { - "chapter_id": "V8", - "chapter_name": "Yetkilendirme", - "section_id": "V8.2", - "section_name": "Genel Yetkilendirme Tasarımı", - "req_id": "V8.2.1", - "req_description": "Uygulamanın, işlev düzeyindeki erişimin yalnızca açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V8", - "chapter_name": "Yetkilendirme", - "section_id": "V8.2", - "section_name": "Genel Yetkilendirme Tasarımı", - "req_id": "V8.2.2", - "req_description": "Uygulamanın, veriye özel erişimin yalnızca belirli veri öğelerine açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, doğrudan nesne referansı güvenlik açıkları (IDOR) ve bozuk nesne düzeyinde yetkilendirme (BOLA) risklerini azaltır.", - "L": "1" - }, - { - "chapter_id": "V8", - "chapter_name": "Yetkilendirme", - "section_id": "V8.2", - "section_name": "Genel Yetkilendirme Tasarımı", - "req_id": "V8.2.3", - "req_description": "Uygulamanın, alan (field) düzeyindeki erişimin yalnızca belirli alanlara açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, bozuk nesne özelliği düzeyinde yetkilendirme (BOPLA) risklerini azaltır.", - "L": "2" - }, - { - "chapter_id": "V8", - "chapter_name": "Yetkilendirme", - "section_id": "V8.2", - "section_name": "Genel Yetkilendirme Tasarımı", - "req_id": "V8.2.4", - "req_description": "Tüketicinin çevresel ve bağlamsal özniteliklerine (ör. günün saati, konum, IP adresi veya cihaz) dayalı uyarlanabilir güvenlik kontrollerinin, uygulama dokümantasyonunda tanımlandığı şekilde, kimlik doğrulama ve yetkilendirme kararları için uygulandığı doğrulanmalıdır. Bu kontroller, tüketici yeni bir oturum başlatmaya çalışırken ve mevcut bir oturum sırasında uygulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V8", - "chapter_name": "Yetkilendirme", - "section_id": "V8.3", - "section_name": "İşlem Düzeyinde Yetkilendirme", - "req_id": "V8.3.1", - "req_description": "Uygulamanın yetkilendirme kurallarını güvenilir bir servis katmanında uyguladığı ve istemci taraflı JavaScript gibi güvenilmeyen tüketiciler tarafından değiştirilebilecek kontrollerle yetinmediği doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V8", - "chapter_name": "Yetkilendirme", - "section_id": "V8.3", - "section_name": "İşlem Düzeyinde Yetkilendirme", - "req_id": "V8.3.2", - "req_description": "Yetkilendirme kararlarının temelini oluşturan değerlerdeki değişikliklerin hemen uygulandığı doğrulanmalıdır. Değişikliklerin anında uygulanamadığı durumlarda (örneğin self-contained token içindeki verilere güveniliyorsa), tüketici artık yetkili olmadığı hâlde bir işlem gerçekleştirdiğinde uyarı verecek ve değişikliği geri alacak önlemler uygulanmalıdır. Bu alternatifin bilgi sızıntısını önlemeyeceği unutulmamalıdır.", - "L": "3" - }, - { - "chapter_id": "V8", - "chapter_name": "Yetkilendirme", - "section_id": "V8.3", - "section_name": "İşlem Düzeyinde Yetkilendirme", - "req_id": "V8.3.3", - "req_description": "Bir nesneye erişimin, herhangi bir aracı veya onun adına hareket eden bir servis yerine yalnızca erişimi başlatan öznenin (ör. tüketici) izinlerine dayandığı doğrulanmalıdır. Örneğin, bir tüketici kimlik doğrulama için bir self-contained token kullanarak bir web servis çağırırsa ve bu servis başka bir servisten veri talep ederse, ikinci servis izin kararlarını verirken birinci servisin makine-makine token'ı yerine tüketicinin token'ını kullanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V8", - "chapter_name": "Yetkilendirme", - "section_id": "V8.4", - "section_name": "Diğer Yetkilendirme Hususları", - "req_id": "V8.4.1", - "req_description": "Multi-tenant uygulamaların, tüketici işlemlerinin izinli olmadıkları tenant'lar üzerinde asla etkili olmamasını sağlamak için tenant'lar arası kontroller kullandığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V8", - "chapter_name": "Yetkilendirme", - "section_id": "V8.4", - "section_name": "Diğer Yetkilendirme Hususları", - "req_id": "V8.4.2", - "req_description": "Yönetici arayüzlerine erişimin, sürekli tüketici kimlik doğrulaması, cihaz güvenlik durumu değerlendirmesi ve bağlamsal risk analizi dahil olmak üzere çok katmanlı güvenlik içerdiği doğrulanmalıdır. Yetkilendirme için yalnızca ağ konumu veya güvenilir uç noktalar yeterli olmamalıdır; ancak bu tür faktörler yetkisiz erişim olasılığını azaltabilir.", - "L": "3" - }, - { - "chapter_id": "V9", - "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", - "section_id": "V9.1", - "section_name": "Token Kaynağı ve Bütünlüğü", - "req_id": "V9.1.1", - "req_description": "Self-contained token'ların içerikleri kabul edilmeden önce, oynama (tampering) saldırılarına karşı dijital imza veya MAC ile doğrulama yapıldığı doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V9", - "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", - "section_id": "V9.1", - "section_name": "Token Kaynağı ve Bütünlüğü", - "req_id": "V9.1.2", - "req_description": "Belirli bir bağlam için yalnızca bir allowlist üzerinde bulunan algoritmaların self-contained token oluşturmak ve doğrulamak için kullanılabildiği doğrulanmalıdır. Bu allowlist, yalnızca simetrik ya da yalnızca asimetrik algoritmaları içermeli ve kesinlikle 'None' algoritmasını içermemelidir. Hem simetrik hem de asimetrik algoritmalar desteklenmek zorundaysa, anahtar karışıklığını (key confusion) önlemek için ek kontroller uygulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V9", - "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", - "section_id": "V9.1", - "section_name": "Token Kaynağı ve Bütünlüğü", - "req_id": "V9.1.3", - "req_description": "Self-contained token'ları doğrulamak için kullanılan anahtar malzemesinin, token issuer için önceden yapılandırılmış güvenilir kaynaklardan alındığı doğrulanmalıdır. Bu, saldırganların güvenilmeyen kaynak ve anahtarları belirtmesini engeller. JWT ve diğer JWS yapılarında 'jku', 'x5u' ve 'jwk' gibi header'lar güvenilir kaynaklardan oluşan bir allowlist'e göre doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V9", - "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", - "section_id": "V9.2", - "section_name": "Token İçeriği", - "req_id": "V9.2.1", - "req_description": "Token verisinde bir geçerlilik zaman aralığı (validity time span) varsa, yalnızca doğrulama zamanı bu zaman aralığı içerisindeyse token ve içeriği kabul edilmelidir. Örneğin, JWT'ler için 'nbf' ve 'exp' claim'leri doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V9", - "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", - "section_id": "V9.2", - "section_name": "Token İçeriği", - "req_id": "V9.2.2", - "req_description": "Token'ı alan hizmetin, token içeriğini kabul etmeden önce bu token'ın doğru türde olduğunu ve sunulma amacına uygun olduğunu doğruladığı teyit edilmelidir. Örneğin, yalnızca erişim token'ları yetkilendirme kararları için, yalnızca ID Token'lar kullanıcı kimlik doğrulamasını kanıtlamak için kullanılabilir.", - "L": "2" - }, - { - "chapter_id": "V9", - "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", - "section_id": "V9.2", - "section_name": "Token İçeriği", - "req_id": "V9.2.3", - "req_description": "Hizmetin yalnızca kendisiyle kullanılması amaçlanan (audience) token'ları kabul ettiği doğrulanmalıdır. JWT'lerde bu, 'aud' claim'inin hizmet içinde tanımlı bir allowlist ile doğrulanması yoluyla sağlanabilir.", - "L": "2" - }, - { - "chapter_id": "V9", - "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", - "section_id": "V9.2", - "section_name": "Token İçeriği", - "req_id": "V9.2.4", - "req_description": "Eğer bir token issuer, farklı audience'lara token oluşturmak için aynı private key'i kullanıyorsa, oluşturulan token'ların hedef audience'ları benzersiz şekilde tanımlayan bir audience kısıtlaması içerdiği doğrulanmalıdır. Bu, bir token'ın farklı bir audience ile yeniden kullanılmasını önler. Audience tanımlayıcısı dinamik olarak sağlanıyorsa, token issuer bu audience'ları doğrulamalı ve audience taklitlerinin (impersonation) önüne geçmelidir.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.1", - "section_name": "Genel OAuth ve OIDC Güvenliği", - "req_id": "V10.1.1", - "req_description": "Token'ların yalnızca kesinlikle ihtiyaç duyan bileşenlere gönderildiği doğrulanmalıdır. Örneğin, tarayıcı tabanlı JavaScript uygulamaları için bir backend-for-frontend modeli kullanıldığında, access ve refresh token'lara yalnızca backend'in erişebilmesi gerekir.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.1", - "section_name": "Genel OAuth ve OIDC Güvenliği", - "req_id": "V10.1.2", - "req_description": "Authorization server'dan gelen değerler (örneğin authorization code veya ID Token gibi) yalnızca aynı user agent oturumu ve işlemi tarafından başlatılmış bir yetkilendirme akışının sonucuysa kabul edildiği doğrulanmalıdır. Bu, client tarafından oluşturulan secret’ların 'proof key for code exchange' (PKCE) ‘code_verifier’, ‘state’ veya OIDC ‘nonce’ gibi tahmin edilemez, işleme özgü ve hem client’a hem de işlem başlatılan user agent oturumuna güvenli bir şekilde bağlı olmasını gerektirir.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.2", - "section_name": "OAuth İstemcisi", - "req_id": "V10.2.1", - "req_description": "Code flow kullanılıyorsa, OAuth client’ın token taleplerini tetikleyen CSRF saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Bu genellikle PKCE kullanılarak veya authorization isteğinde gönderilen ‘state’ parametresinin kontrolü ile sağlanır.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.2", - "section_name": "OAuth İstemcisi", - "req_id": "V10.2.2", - "req_description": "OAuth istemcisi birden fazla AS ile etkileşime girebiliyorsa, mix-up saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Örneğin, authorization server’ın 'iss' parametresini döndürmesi zorunlu kılınabilir ve bu parametrenin hem authorization yanıtında hem de token yanıtında doğrulanması gerekir.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.2", - "section_name": "OAuth İstemcisi", - "req_id": "V10.2.3", - "req_description": "OAuth istemcisinin authorization server’a yaptığı taleplerde yalnızca gerekli scope’ları (veya diğer yetkilendirme parametrelerini) talep ettiği doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.3", - "section_name": "OAuth Kaynak Sunucusu (RS)", - "req_id": "V10.3.1", - "req_description": "RS'nin yalnızca bu servisle kullanılmak üzere tasarlanmış access token’ları kabul ettiği doğrulanmalıdır (audience kontrolü). Audience bilgisi yapılandırılmış token’larda (örneğin JWT içindeki ‘aud’ claim’i) yer alabilir veya token introspection endpoint aracılığıyla kontrol edilebilir.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.3", - "section_name": "OAuth Kaynak Sunucusu (RS)", - "req_id": "V10.3.2", - "req_description": "RS'nin, access token’dan gelen claim’lere dayanarak yetki devri tanımına uygun şekilde yetkilendirme kararları uyguladığı doğrulanmalıdır. ‘sub’, ‘scope’ ve ‘authorization_details’ gibi claim’ler varsa, bu kararın parçası olmalıdır.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.3", - "section_name": "OAuth Kaynak Sunucusu (RS)", - "req_id": "V10.3.3", - "req_description": "Erişim kontrolü kararında, access token’dan (JWT veya ilgili token introspection yanıtı) benzersiz bir kullanıcının tanımlanması gerekiyorsa, RS'nin başka kullanıcılara devredilemeyecek claim’ler ile kullanıcıyı tanımladığı doğrulanmalıdır. Genellikle bu, ‘iss’ ve ‘sub’ claim’lerinin birlikte kullanılması anlamına gelir.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.3", - "section_name": "OAuth Kaynak Sunucusu (RS)", - "req_id": "V10.3.4", - "req_description": "RS'nin belirli bir kimlik doğrulama gücü, yöntemi veya güncelliği (recentness) gerektirmesi durumunda, sunulan access token’ın bu kısıtlamaları karşıladığını doğruladığı, örneğin, OIDC ‘acr’, ‘amr’ ve ‘auth_time’ claim’leri kullanılarak doğrulanmalıdır. ", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.3", - "section_name": "OAuth Kaynak Sunucusu (RS)", - "req_id": "V10.3.5", - "req_description": "RS'nin, (yetkisiz taraflarca) çalınmış veya tekrar edilen access token’ların kullanımını önlemek için sender-constrained access token’lar kullandığı doğrulanmalıdır. Bu, OAuth 2 için Mutual TLS veya OAuth 2 Demonstration of Proof of Possession (DPoP) ile sağlanabilir.", - "L": "3" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.4", - "section_name": "OAuth Yetkilendirme Sunucusu (AS)", - "req_id": "V10.4.1", - "req_description": "AS'nin, istemciye özel önceden kaydedilmiş URI’lerden oluşan bir allowlist kullanarak redirect URI’leri tam dize karşılaştırması ile doğruladığı doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.4", - "section_name": "OAuth Yetkilendirme Sunucusu (AS)", - "req_id": "V10.4.2", - "req_description": "AS'nin, \"authorization response\" içinde \"authorization code\" döndürdüğü durumlarda, bu kodun yalnızca bir kez kullanılabildiği doğrulanmalıdır. Daha önce access token vermek için kullanılmış bir authorization code ile yapılan ikinci geçerli token isteği reddedilmeli ve ilgili tüm token’lar iptal edilmelidir.", - "L": "1" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.4", - "section_name": "OAuth Yetkilendirme Sunucusu (AS)", - "req_id": "V10.4.3", - "req_description": "Authorization code’un kısa ömürlü olduğu doğrulanmalıdır. L1 ve L2 uygulamalar için maksimum yaşam süresi 10 dakika, L3 uygulamalar için 1 dakikadır.", - "L": "1" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.4", - "section_name": "OAuth Yetkilendirme Sunucusu (AS)", - "req_id": "V10.4.4", - "req_description": "Belirli bir istemci için AS'nin yalnızca o istemcinin ihtiyaç duyduğu grant türlerine izin verdiği doğrulanmalıdır. \"Token\" (Implicit flow) ve \"password\" (Resource Owner Password Credentials flow) grant türlerinin artık kullanılmaması gerekir.", - "L": "1" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.4", - "section_name": "OAuth Yetkilendirme Sunucusu (AS)", - "req_id": "V10.4.5", - "req_description": "AS'nin, açık istemciler için refresh token replay saldırılarını azalttığı doğrulanmalıdır. Tercihen sender-constrained refresh token’lar (DPoP veya mutual TLS ile certificate-bound access token’lar) kullanılmalıdır. L1 ve L2 uygulamalar için refresh token rotation kullanılabilir. Rotation kullanılıyorsa, AS refresh token’ı kullanım sonrası geçersiz kılmalı ve geçersiz bir refresh token sunulması durumunda o yetkilendirme ile ilişkili tüm refresh token’ları iptal etmelidir.", - "L": "1" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.4", - "section_name": "OAuth Yetkilendirme Sunucusu (AS)", - "req_id": "V10.4.6", - "req_description": "Code grant kullanılıyorsa, AS'nin authorization code interception saldırılarına karşı koruma sağladığı doğrulanmalıdır. Yetkilendirme isteğinde geçerli bir \"code_challenge\" değeri zorunlu olmalı ve \"code_challenge_method\" olarak \"plain\" kabul edilmemelidir. Token isteğinde ise \"code_verifier\" parametresi doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.4", - "section_name": "OAuth Yetkilendirme Sunucusu (AS)", - "req_id": "V10.4.7", - "req_description": "AS'nin, kimlik doğrulaması yapılmamış dinamik istemci kaydını desteklemesi durumunda, kötü niyetli istemci uygulamalarına karşı riskleri azalttığı doğrulanmalıdır. Kayıtlı URI’ler gibi client metadata’sı doğrulanmalı, kullanıcı onayı alınmalı ve güvenilmeyen bir client uygulamasıyla yapılan yetkilendirme isteği işlenmeden önce kullanıcı uyarılmalıdır.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.4", - "section_name": "OAuth Yetkilendirme Sunucusu (AS)", - "req_id": "V10.4.8", - "req_description": "Refresh token’ların, sliding expiration kullanılsa bile mutlak bir sona erme süresine sahip olduğu doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.4", - "section_name": "OAuth Yetkilendirme Sunucusu (AS)", - "req_id": "V10.4.9", - "req_description": "Yetkili bir kullanıcı tarafından AS kullanıcı arayüzü üzerinden refresh token’ların ve reference access token’ların iptal edilebildiği doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.4", - "section_name": "OAuth Yetkilendirme Sunucusu (AS)", - "req_id": "V10.4.10", - "req_description": "Gizli istemcilerin token istekleri, pushed authorization request (PAR) ve token iptal istekleri gibi server’a yapılan backchannel isteklerinde kimliğinin kontrol edildiği doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.4", - "section_name": "OAuth Yetkilendirme Sunucusu (AS)", - "req_id": "V10.4.11", - "req_description": "AS yapılandırmasının, OAuth istemcisine yalnızca gerekli scope’ları atadığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.4", - "section_name": "OAuth Yetkilendirme Sunucusu (AS)", - "req_id": "V10.4.12", - "req_description": "Belirli bir client için, authorization server’ın yalnızca client’ın ihtiyaç duyduğu 'response_mode' değerine izin verdiği doğrulanmalıdır. Örneğin, bu değer ya beklenenlerle karşılaştırılarak doğrulanmalı ya da PAR veya JAR kullanılmalıdır.", - "L": "3" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.4", - "section_name": "OAuth Yetkilendirme Sunucusu (AS)", - "req_id": "V10.4.13", - "req_description": "\"Code\" grant türünün daima pushed authorization request (PAR) ile birlikte kullanıldığı doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.4", - "section_name": "OAuth Yetkilendirme Sunucusu (AS)", - "req_id": "V10.4.14", - "req_description": "AS'nin yalnızca sender-constrained (Proof-of-Possession) access token’lar ürettiği doğrulanmalıdır. Bu, mutual TLS ile certificate-bound access token ya da DPoP ile DPoP-bound access token olabilir.", - "L": "3" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.4", - "section_name": "OAuth Yetkilendirme Sunucusu (AS)", - "req_id": "V10.4.15", - "req_description": "Sunucu taraflı istemciler için (kullanıcı cihazında çalışmayan), AS'nin \"authorization_details\" parametresinin istemci backend'i tarafından sağlandığını ve kullanıcı tarafından değiştirilmediğini doğruladığı, örneğin pushed authorization request (PAR) or JWT-secured Authorization Request (JAR) zorunlu kılınarak doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.4", - "section_name": "OAuth Yetkilendirme Sunucusu (AS)", - "req_id": "V10.4.16", - "req_description": "Bir istemci gizli ise, AS'nin güçlü istemci kimlik doğrulama yöntemlerini zorunlu kıldığı doğrulanmalıdır. Bu yöntemler, public-key cryptography’ye dayalı ve replay saldırılarına karşı dayanıklı olmalı, örneğin mutual TLS (\"tls_client_auth\", \"self_signed_tls_client_auth\") veya private key JWT (\"private_key_jwt\") gibi.", - "L": "3" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.5", - "section_name": "OIDC İstemcisi", - "req_id": "V10.5.1", - "req_description": "İstemcinin (relying party olarak) ID Token replay saldırılarını azalttığı doğrulanmalıdır. Örneğin, ID Token’daki 'nonce' claim’inin, OpenID Provider’a gönderilen kimlik doğrulama isteğindeki 'nonce' değeriyle eşleştiği doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.5", - "section_name": "OIDC İstemcisi", - "req_id": "V10.5.2", - "req_description": "İstemcinin kullanıcıyı ID Token claim’lerinden (genellikle, başka kullanıcılarla yeniden atanamayan 'sub' claim’i) benzersiz şekilde tanımladığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.5", - "section_name": "OIDC İstemcisi", - "req_id": "V10.5.3", - "req_description": "İstemcinin, kötü niyetli bir AS'nin başka bir AS'yi taklit etmesini AS metadata’sı üzerinden reddettiği doğrulanmalıdır. AS metadata’sındaki issuer URL’si, istemci tarafından beklenen önceden yapılandırılmış issuer URL’siyle tam olarak eşleşmiyorsa, metadata reddedilmelidir.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.5", - "section_name": "OIDC İstemcisi", - "req_id": "V10.5.4", - "req_description": "İstemcinin, ID Token’ın kendisi için (audience) kullanılması amaçlandığını doğruladığı doğrulanmalıdır. Bu, token’daki 'aud' claim’inin istemcinin 'client_id' değeriyle eşit olup olmadığının kontrol edilmesiyle yapılır.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.5", - "section_name": "OIDC İstemcisi", - "req_id": "V10.5.5", - "req_description": "OIDC back-channel logout kullanıldığında, relying party’nin \"forced logout\" ve \"logout\" akışında \"cross-JWT confusion\" gibi saldırılara karşı koruma sağladığı doğrulanmalıdır. Client, logout token’ın 'logout+jwt' türünde olduğunu, 'event' claim’inin doğru üyeye sahip olduğunu ve 'nonce' claim’i içermediğini doğrulamalıdır. Ayrıca token için kısa bir sona erme süresi (örneğin 2 dakika) önerilir.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.6", - "section_name": "OpenID Provider", - "req_id": "V10.6.1", - "req_description": "OpenID Provider’ın yalnızca 'code', 'ciba', 'id_token' veya 'id_token code' response mode değerlerine izin verdiği doğrulanmalıdır. 'code' değeri, 'id_token code' (OIDC Hybrid flow) yerine tercih edilmelidir. 'token' (Implicit flow) kullanılmamalıdır.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.6", - "section_name": "OpenID Provider", - "req_id": "V10.6.2", - "req_description": "OpenID Provider’ın forced logout yoluyla yapılan hizmet reddi saldırılarını önlediği doğrulanmalıdır. Bu, son kullanıcıdan açık onay alınarak veya varsa logout isteğinde (relying party tarafından başlatılan) bulunan parametrelerin, örneğin 'id_token_hint', doğrulanmasıyla yapılabilir.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.7", - "section_name": "Onay (Consent) Yönetimi", - "req_id": "V10.7.1", - "req_description": "AS'nin her yetkilendirme isteği için kullanıcının onayını aldığı doğrulanmalıdır. İstemcinin kimliği garanti altına alınamıyorsa, AS daima kullanıcıdan açıkça onay istemelidir.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.7", - "section_name": "Onay (Consent) Yönetimi", - "req_id": "V10.7.2", - "req_description": "AS'nin kullanıcıdan onay istediğinde, neye onay verildiğini açık ve yeterli şekilde gösterdiği doğrulanmalıdır. Uygun olduğunda bu bilgiler, istenen yetkilendirmelerin doğasını (genellikle scope, resource server, RAR gibi detaylara dayalı), yetkilendirilmiş uygulamanın kimliğini ve bu yetkilendirmelerin süresini içermelidir.", - "L": "2" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.7", - "section_name": "Onay (Consent) Yönetimi", - "req_id": "V10.7.3", - "req_description": "Kullanıcının, AS üzerinden verdiği onayları görüntüleyebildiği, değiştirebildiği ve iptal edebildiği doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.1", - "section_name": "Kriptografik Envanter ve Dokümantasyon", - "req_id": "V11.1.1", - "req_description": "Kriptografik anahtarların yönetimi için belgelenmiş bir politika ve NIST SP 800-57 gibi bir anahtar yönetim standardını izleyen bir kriptografik anahtar yaşam döngüsü tanımlandığı doğrulanmalıdır. Bu, anahtarların aşırı miktarda paylaşılmadığını (örneğin, paylaşılan sırlar için ikiden fazla tarafla veya özel anahtarlar için birden fazla tarafla) garanti altına almalıdır.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.1", - "section_name": "Kriptografik Envanter ve Dokümantasyon", - "req_id": "V11.1.2", - "req_description": "Tüm kriptografik anahtarlar, algoritmalar ve uygulama tarafından kullanılan sertifikaları içeren bir kriptografik envanterin oluşturulduğu, sürdürüldüğü ve düzenli olarak güncellendiği doğrulanmalıdır. Bu envanter ayrıca, sistemde anahtarların nerede kullanılabileceğini ve kullanılamayacağını, ve hangi veri türlerinin bu anahtarlarla korunup korunamayacağını da belgelemelidir.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.1", - "section_name": "Kriptografik Envanter ve Dokümantasyon", - "req_id": "V11.1.3", - "req_description": "Sistem içerisinde şifreleme, özetleme ve imzalama işlemleri dahil olmak üzere kriptografi kullanımının tüm örneklerini tespit etmek için kriptografik keşif mekanizmalarının kullanıldığı doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.1", - "section_name": "Kriptografik Envanter ve Dokümantasyon", - "req_id": "V11.1.4", - "req_description": "Kriptografik bir envanterin sürdürüldüğü doğrulanmalıdır. Bu envanter, gelecekteki tehditlere karşı tepki verebilmek amacıyla post-kuantum kriptografiye geçiş yolunu belirten belgelenmiş bir plan içermelidir.", - "L": "3" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.2", - "section_name": "Güvenli Kriptografi Uygulaması", - "req_id": "V11.2.1", - "req_description": "Kriptografik işlemler için sektör tarafından doğrulanmış uygulamaların (kütüphaneler ve donanım hızlandırmalı uygulamalar dahil) kullanıldığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.2", - "section_name": "Güvenli Kriptografi Uygulaması", - "req_id": "V11.2.2", - "req_description": "Uygulamanın, rastgele sayı üreticileri, kimliği doğrulanmış şifreleme, MAC veya özetleme algoritmaları, anahtar uzunlukları, turlar, şifreler ve modların herhangi bir zamanda yeniden yapılandırılabilir, yükseltilebilir veya değiştirilebilir olacağı şekilde kripto çevikliği (crypto agility) ile tasarlandığı doğrulanmalıdır. Aynı şekilde, anahtarların ve parolaların değiştirilebilmesi ve verilerin yeniden şifrelenebilmesi mümkün olmalıdır. Bu, onaylanmış PQC şemalarının yüksek güvenlikli uygulamaları yaygın olarak kullanılabilir hale geldiğinde sorunsuz geçişe olanak tanır.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.2", - "section_name": "Güvenli Kriptografi Uygulaması", - "req_id": "V11.2.3", - "req_description": "Tüm kriptografik ilkeliklerin, algoritma, anahtar boyutu ve yapılandırmaya göre minimum 128 bit güvenlik sağladığı doğrulanmalıdır. Örneğin, 256-bit ECC anahtarı yaklaşık 128 bit güvenlik sağlarken, RSA için aynı güvenliği elde etmek 3072-bit anahtar gerektirir.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.2", - "section_name": "Güvenli Kriptografi Uygulaması", - "req_id": "V11.2.4", - "req_description": "Tüm kriptografik işlemlerin sabit süreli (constant-time) olduğu, karşılaştırmalarda, hesaplamalarda veya geri dönüşlerde kısa devre (short-circuit) işlemleri yapılmadığı doğrulanmalıdır; bu, bilgi sızıntısını önlemek için gereklidir.", - "L": "3" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.2", - "section_name": "Güvenli Kriptografi Uygulaması", - "req_id": "V11.2.5", - "req_description": "Tüm kriptografik modüllerin güvenli şekilde hata verdiği ve hataların, padding oracle saldırıları gibi zafiyetleri mümkün kılmayacak şekilde ele alındığı doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.3", - "section_name": "Şifreleme Algoritmaları", - "req_id": "V11.3.1", - "req_description": "Güvensiz blok modlarının (örneğin, ECB) ve zayıf doldurma (padding) şemalarının (örneğin, PKCS#1 v1.5) kullanılmadığı doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.3", - "section_name": "Şifreleme Algoritmaları", - "req_id": "V11.3.2", - "req_description": "Yalnızca AES ile GCM gibi onaylı şifreleme algoritmalarının ve modlarının kullanıldığı doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.3", - "section_name": "Şifreleme Algoritmaları", - "req_id": "V11.3.3", - "req_description": "Şifrelenmiş verilerin yetkisiz değişikliklere karşı korunduğu doğrulanmalıdır. Tercihen bu koruma, onaylı bir kimliği doğrulanmış şifreleme yöntemi kullanılarak ya da onaylı bir şifreleme yöntemi ile onaylı bir MAC algoritmasının kombinasyonu ile sağlanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.3", - "section_name": "Şifreleme Algoritmaları", - "req_id": "V11.3.4", - "req_description": "Sayılar, başlatma vektörleri (IV) ve diğer tek kullanımlık değerlerin, aynı şifreleme anahtarı ve veri öğesi çifti için birden fazla kez kullanılmadığı doğrulanmalıdır. Oluşturma yöntemi kullanılan algoritmaya uygun olmalıdır.", - "L": "3" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.3", - "section_name": "Şifreleme Algoritmaları", - "req_id": "V11.3.5", - "req_description": "Şifreleme algoritması ve MAC algoritması kombinasyonlarının \"encrypt-then-MAC\" modunda çalıştığı doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.4", - "section_name": "Hashing ve Hash Tabanlı Fonksiyonlar", - "req_id": "V11.4.1", - "req_description": "Dijital imzalar, HMAC, KDF ve rastgele bit üretimi gibi genel kriptografik kullanım senaryolarında yalnızca onaylı hash fonksiyonlarının kullanıldığı doğrulanmalıdır. MD5 gibi yasaklı hash fonksiyonları hiçbir kriptografik amaçla kullanılmamalıdır.", - "L": "1" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.4", - "section_name": "Hashing ve Hash Tabanlı Fonksiyonlar", - "req_id": "V11.4.2", - "req_description": "Parolaların, onaylı, hesaplama açısından yoğun ve mevcut rehberliğe göre yapılandırılmış bir anahtar türetme fonksiyonu (diğer adıyla parola hash'leme fonksiyonu) kullanılarak saklandığı doğrulanmalıdır. Ayarlar, güvenlik ve performans dengesini sağlayarak kaba kuvvet saldırılarını zorlaştırmalıdır.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.4", - "section_name": "Hashing ve Hash Tabanlı Fonksiyonlar", - "req_id": "V11.4.3", - "req_description": "Dijital imzalarda kullanılan hash fonksiyonlarının, veri bütünlüğü ve kimlik doğrulama amacıyla kullanıldığında çakışmaya karşı dayanıklı ve yeterli bit uzunluğuna sahip olduğu doğrulanmalıdır. Çakışma dayanıklılığı gerekiyorsa çıktı uzunluğu en az 256 bit olmalıdır. Sadece ikinci ön-görüntü (2nd pre-iamge) saldırılarına karşı dayanıklılık gerekiyorsa çıktı uzunluğu en az 128 bit olmalıdır.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.4", - "section_name": "Hashing ve Hash Tabanlı Fonksiyonlar", - "req_id": "V11.4.4", - "req_description": "Parolalardan gizli anahtarlar türetilirken, onaylı anahtar türetme fonksiyonlarının anahtar uzatma (key stretching) parametreleriyle birlikte kullanıldığı doğrulanmalıdır. Bu parametreler, kaba kuvvet saldırılarını önleyecek şekilde güvenlik ve performans dengesine sahip olmalıdır.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.5", - "section_name": "Rastgele Değerler", - "req_id": "V11.5.1", - "req_description": "Tahmin edilemez olması amaçlanan tüm rastgele sayıların ve dizelerin, CSPRNG ile oluşturulduğu ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. UUID'lerin bu koşulu dikkate almadığını unutmayın.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.5", - "section_name": "Rastgele Değerler", - "req_id": "V11.5.2", - "req_description": "Kullanılan rastgele sayı üretim mekanizmasının, yoğun talep altında dahi güvenli çalışacak şekilde tasarlandığı doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.6", - "section_name": "Açık Anahtar (Public Key) Kriptografisi", - "req_id": "V11.6.1", - "req_description": "Anahtar üretimi, tohumlama (seeding) ve dijital imza üretimi ve doğrulama için yalnızca onaylı kriptografik algoritmalar ve çalışma modlarının kullanıldığı doğrulanmalıdır. Anahtar üretim algoritmaları, bilinen saldırılara karşı savunmasız anahtarlar üretmemelidir. Örneğin, Fermat çarpanlama yöntemine karşı savunmasız RSA anahtarları oluşturulmamalıdır.", - "L": "2" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.6", - "section_name": "Açık Anahtar (Public Key) Kriptografisi", - "req_id": "V11.6.2", - "req_description": "Anahtar değişimi için yalnızca onaylı kriptografik algoritmaların kullanıldığı doğrulanmalıdır (örneğin Diffie-Hellman). Kullanılan parametrelerin güvenli olması gerektiğine dikkat edilmelidir. Bu, anahtar kurulum sürecine yönelik saldırıları önleyecek ve araya girme (adversary-in-the-middle) ya da kriptografik kırılmaları engelleyecektir.", - "L": "3" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.7", - "section_name": "Kullanım Halindeki Verilerin Kriptografisi", - "req_id": "V11.7.1", - "req_description": "Hassas verilerin kullanım sırasında korunmasını sağlamak amacıyla, yetkisiz kullanıcıların veya süreçlerin bu verilere erişmesini engelleyen tam bellek şifrelemesinin kullanıldığı doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.7", - "section_name": "Kullanım Halindeki Verilerin Kriptografisi", - "req_id": "V11.7.2", - "req_description": "Veri asgariyetinin sağlandığı, yani işleme sırasında mümkün olan en az miktarda verinin ortaya çıktığı ve verilerin kullanımdan hemen sonra veya mümkün olan en kısa sürede şifrelendiği doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V12", - "chapter_name": "Güvenli İletişim", - "section_id": "V12.1", - "section_name": "Genel TLS Güvenlik Rehberi", - "req_id": "V12.1.1", - "req_description": "Yalnızca TLS protokolünün en güncel ve önerilen sürümlerinin (örneğin TLS 1.2 ve TLS 1.3) etkinleştirildiği ve en son sürümün varsayılan olarak tercih edildiği doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V12", - "chapter_name": "Güvenli İletişim", - "section_id": "V12.1", - "section_name": "Genel TLS Güvenlik Rehberi", - "req_id": "V12.1.2", - "req_description": "Yalnızca önerilen şifre takımlarının (cipher suite) etkinleştirildiği ve en güçlü şifre takımlarının tercih edildiği doğrulanmalıdır. Seviye 3 (L3) uygulamalar yalnızca ileri gizlilik (forward secrecy) sağlayan şifre takımlarını desteklemelidir.", - "L": "2" - }, - { - "chapter_id": "V12", - "chapter_name": "Güvenli İletişim", - "section_id": "V12.1", - "section_name": "Genel TLS Güvenlik Rehberi", - "req_id": "V12.1.3", - "req_description": "Uygulamanın, mTLS istemci sertifikalarını kimlik doğrulama veya yetkilendirme amacıyla kullanmadan önce bu sertifikaların güvendiği sertifikalar arasında olduğunu doğruladığı kontrol edilmelidir.", - "L": "2" - }, - { - "chapter_id": "V12", - "chapter_name": "Güvenli İletişim", - "section_id": "V12.1", - "section_name": "Genel TLS Güvenlik Rehberi", - "req_id": "V12.1.4", - "req_description": "Online Certificate Status Protocol (OCSP) Stapling gibi geçerli bir sertifika iptal kontrolü yönteminin etkinleştirildiği ve yapılandırıldığı doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V12", - "chapter_name": "Güvenli İletişim", - "section_id": "V12.1", - "section_name": "Genel TLS Güvenlik Rehberi", - "req_id": "V12.1.5", - "req_description": "TLS el sıkışma (handshake) sürecinde Server Name Indication (SNI) gibi hassas meta verilerin ifşa edilmesini önlemek için, uygulamanın TLS yapılandırmasında Encrypted Client Hello (ECH) özelliğinin etkinleştirildiği doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V12", - "chapter_name": "Güvenli İletişim", - "section_id": "V12.2", - "section_name": "Dışa Açık Hizmetlerle HTTPS İletişimi", - "req_id": "V12.2.1", - "req_description": "İstemci ile dışa açık, HTTP tabanlı hizmetler arasındaki tüm bağlantılarda TLS kullanıldığı ve bu bağlantıların güvensiz ya da şifrelenmemiş iletişime geri dönmediği doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V12", - "chapter_name": "Güvenli İletişim", - "section_id": "V12.2", - "section_name": "Dışa Açık Hizmetlerle HTTPS İletişimi", - "req_id": "V12.2.2", - "req_description": "Dışa açık hizmetlerin herkese açık olarak güvenilen TLS sertifikaları kullandığı doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V12", - "chapter_name": "Güvenli İletişim", - "section_id": "V12.3", - "section_name": "Genel Servisler Arası İletişim Güvenliği", - "req_id": "V12.3.1", - "req_description": "Uygulamaya gelen ve uygulamadan çıkan tüm bağlantılarda izleme sistemleri, yönetim araçları, uzaktan erişim ve SSH, ara yazılımlar, veritabanları, ana sistemler (mainframe), iş ortağı sistemleri ya da dış API'ler dahil olmak üzere TLS gibi şifreli bir protokolün kullanıldığı ve güvensiz ya da şifrelenmemiş protokollere geri dönülmediği doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V12", - "chapter_name": "Güvenli İletişim", - "section_id": "V12.3", - "section_name": "Genel Servisler Arası İletişim Güvenliği", - "req_id": "V12.3.2", - "req_description": "TLS istemcilerinin bir TLS sunucusu ile iletişime geçmeden önce alınan sertifikaları doğruladığı kontrol edilmelidir.", - "L": "2" - }, - { - "chapter_id": "V12", - "chapter_name": "Güvenli İletişim", - "section_id": "V12.3", - "section_name": "Genel Servisler Arası İletişim Güvenliği", - "req_id": "V12.3.3", - "req_description": "Uygulama içindeki HTTP tabanlı iç hizmetler arasında gerçekleşen tüm bağlantılarda TLS ya da uygun başka bir aktarım şifreleme mekanizmasının kullanıldığı ve güvensiz ya da şifrelenmemiş iletişime geri dönülmediği doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V12", - "chapter_name": "Güvenli İletişim", - "section_id": "V12.3", - "section_name": "Genel Servisler Arası İletişim Güvenliği", - "req_id": "V12.3.4", - "req_description": "İç hizmetler arasındaki TLS bağlantılarında güvenilir sertifikaların kullanıldığı doğrulanmalıdır. İç sistemlerde oluşturulmuş ya da kendinden imzalı (self-signed) sertifikalar kullanılıyorsa, bu sertifikalara güvenen hizmetlerin yalnızca belirli dahili sertifika otoritelerine (CA) ve belirli kendinden imzalı sertifikalara güvenecek şekilde yapılandırıldıkları doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V12", - "chapter_name": "Güvenli İletişim", - "section_id": "V12.3", - "section_name": "Genel Servisler Arası İletişim Güvenliği", - "req_id": "V12.3.5", - "req_description": "Sistem içindeki hizmetlerin birbiriyle iletişim kurarken her bir uç noktanın kimliğini doğrulamak için güçlü kimlik doğrulama yöntemlerinin kullanıldığı doğrulanmalıdır. Bu yöntemler arasında, açık anahtar altyapısı (public-key infrastructure) kullanan ve tekrar oynatma saldırılarına karşı dayanıklı olan TLS istemci kimlik doğrulaması gibi yöntemler yer almalıdır. Mikroservis mimarilerinde, sertifika yönetimini basitleştirmek ve güvenliği artırmak amacıyla bir servis ağı (service mesh) kullanılması değerlendirilmelidir.", - "L": "3" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.1", - "section_name": "Konfigürasyon Dokümantasyonu", - "req_id": "V13.1.1", - "req_description": "Uygulamanın tüm iletişim ihtiyaçlarının dokümante edildiği doğrulanmalıdır. Buna, uygulamanın bağımlı olduğu dış hizmetler ve son kullanıcının uygulamanın bağlantı kurmasını sağlayabileceği dış konumlar da dahil olmalıdır.", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.1", - "section_name": "Konfigürasyon Dokümantasyonu", - "req_id": "V13.1.2", - "req_description": "Uygulamanın kullandığı her bir hizmet için, dokümantasyonda eşzamanlı bağlantı sayısı (örn. bağlantı havuzu limitleri) ve bu sınır aşıldığında uygulamanın davranışı, geri dönüş veya kurtarma mekanizmaları da dahil olmak üzere hizmet reddi koşullarını önlemek için tanımlandığı doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.1", - "section_name": "Konfigürasyon Dokümantasyonu", - "req_id": "V13.1.3", - "req_description": "Uygulamanın, kullandığı her bir dış sistem veya hizmet (örn. veritabanları, dosya tanıtıcıları, iş parçacıkları, HTTP bağlantıları) için kaynak yönetimi stratejilerini tanımladığı doğrulanmalıdır. Bu stratejiler, kaynak serbest bırakma prosedürlerini, zaman aşımı ayarlarını, hata durumlarını ve tekrar deneme mantığı uygulanmışsa sınırları, gecikmeleri ve geri çekilme (back-off) algoritmalarını içermelidir. Senkron HTTP istek–yanıt işlemleri için kısa zaman aşımı süreleri zorunlu tutulmalı ve tekrar eden denemeler devre dışı bırakılmalı ya da sıkı şekilde sınırlandırılmalıdır.", - "L": "3" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.1", - "section_name": "Konfigürasyon Dokümantasyonu", - "req_id": "V13.1.4", - "req_description": "Uygulamanın, güvenlik açısından kritik olan gizli verileri tanımladığı ve kuruluşun tehdit modeli ve iş ihtiyaçlarına göre bu verilerin döndürülme (rotation) zamanlamasının belgelendiği doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.2", - "section_name": "Backend İletişim Konfigürasyonu", - "req_id": "V13.2.1", - "req_description": "Uygulamanın, standart kullanıcı oturum mekanizmasını desteklemeyen backend bileşenleri (örneğin API'ler, ara katmanlar, veri katmanları) arasında gerçekleşen iletişimlerin kimlik doğrulamasıyla korunduğu doğrulanmalıdır. Kimlik doğrulama; bireysel hizmet hesapları, kısa ömürlü token'lar ya da sertifika tabanlı kimlik doğrulama ile yapılmalıdır ve parola, API anahtarı ya da ayrıcalıklı erişime sahip paylaşımlı hesaplar gibi sabit kimlik bilgileri kullanılmamalıdır.", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.2", - "section_name": "Backend İletişim Konfigürasyonu", - "req_id": "V13.2.2", - "req_description": "Uygulamanın backend bileşenleri arasında (yerel hizmetler, işletim sistemi hizmetleri, API'ler, ara katmanlar ve veri katmanları dahil) gerçekleştirilen iletişimlerin, yalnızca gerekli en az ayrıcalığa sahip hesaplarla yapıldığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.2", - "section_name": "Backend İletişim Konfigürasyonu", - "req_id": "V13.2.3", - "req_description": "Bir hizmet kimlik doğrulaması için bir kimlik bilgisi kullanılması gerekiyorsa, bu kimlik bilgisinin varsayılan bir değer (örneğin root/root veya admin/admin) olmadığının doğrulanması gereklidir.", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.2", - "section_name": "Backend İletişim Konfigürasyonu", - "req_id": "V13.2.4", - "req_description": "Uygulamanın iletişim kurmasına izin verilen dış kaynaklar ya da sistemlerin, bir allowlist (izinli liste) ile tanımlandığı doğrulanmalıdır. Bu liste, uygulama katmanında, web sunucusunda, güvenlik duvarında veya farklı katmanların birleşiminde uygulanabilir.", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.2", - "section_name": "Backend İletişim Konfigürasyonu", - "req_id": "V13.2.5", - "req_description": "Web veya uygulama sunucusunun, dış sistemlere veri veya dosya gönderimi veya yüklemesi yaparken sadece belirli kaynaklara izin verecek şekilde allowlist ile yapılandırıldığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.2", - "section_name": "Backend İletişim Konfigürasyonu", - "req_id": "V13.2.6", - "req_description": "Uygulamanın farklı hizmetlere bağlantı kurduğu durumlarda, bu bağlantılar için belgelenmiş yapılandırmaları (örn. maksimum eşzamanlı bağlantı, bağlantı limiti aşıldığında davranış, zaman aşımı, tekrar deneme stratejileri) takip ettiğinin doğrulanması gereklidir.", - "L": "3" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.3", - "section_name": "Gizli Bilgi Yönetimi", - "req_id": "V13.3.1", - "req_description": "Parolalar, anahtar materyalleri, veritabanı ve üçüncü parti sistemlerle entegrasyon bilgileri, zaman tabanlı token'lar için tohum (seed) bilgileri, dahili gizli veriler ve API anahtarları gibi backend sırlarının güvenli bir şekilde oluşturulması, saklanması, erişim denetiminin sağlanması ve imha edilmesi için bir gizli bilgi yönetim çözümünün (örneğin key vault) kullanıldığı doğrulanmalıdır. Bu gizli bilgiler uygulama kaynak koduna dahil edilmemeli ve yapı çıktılarında yer almamalıdır. Seviye 3 uygulamalar için donanım destekli bir çözüm (örneğin HSM) gereklidir.", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.3", - "section_name": "Gizli Bilgi Yönetimi", - "req_id": "V13.3.2", - "req_description": "Gizli bilgilere erişimin en az ayrıcalık prensibine uygun şekilde yapılandırıldığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.3", - "section_name": "Gizli Bilgi Yönetimi", - "req_id": "V13.3.3", - "req_description": "Tüm kriptografik işlemlerin, anahtar materyallerinin güvenli bir şekilde yönetilmesi ve dışarıya sızmasının engellenmesi amacıyla, izole edilmiş bir güvenlik modülü (örneğin vault ya da donanım güvenlik modülü) aracılığıyla gerçekleştirildiği doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.3", - "section_name": "Gizli Bilgi Yönetimi", - "req_id": "V13.3.4", - "req_description": "Uygulamanın belgelerinde belirtildiği şekilde gizli bilgilerin süresinin dolacak şekilde yapılandırıldığı ve düzenli olarak döndürüldüğü doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.4", - "section_name": "İstenmeyen Bilgi Sızıntısı", - "req_id": "V13.4.1", - "req_description": "Uygulamanın .git veya .svn klasörleri gibi kaynak kontrolüyle ilgili metadata içermeyecek şekilde deploy edildiğini ya da bu klasörlerin hem dış erişime hem de uygulama erişimine kapalı olduğu doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.4", - "section_name": "İstenmeyen Bilgi Sızıntısı", - "req_id": "V13.4.2", - "req_description": "Tüm bileşenler için üretim ortamlarında hata ayıklama (debug) modlarının devre dışı bırakıldığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.4", - "section_name": "İstenmeyen Bilgi Sızıntısı", - "req_id": "V13.4.3", - "req_description": "Web sunucularının, açık şekilde istenmediği sürece dizin listelemesi (directory listing) özelliğini istemcilere sunmadığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.4", - "section_name": "İstenmeyen Bilgi Sızıntısı", - "req_id": "V13.4.4", - "req_description": "HTTP TRACE metodunun üretim ortamlarında desteklenmediği, böylece potansiyel bilgi sızıntılarının önlendiği doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.4", - "section_name": "İstenmeyen Bilgi Sızıntısı", - "req_id": "V13.4.5", - "req_description": "Belgeler (örneğin dahili API belgeleri) ve izleme uç noktalarının (monitoring endpoints) yalnızca açıkça belirtildiği durumlarda erişilebilir olduğu doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.4", - "section_name": "İstenmeyen Bilgi Sızıntısı", - "req_id": "V13.4.6", - "req_description": "Uygulamanın arka uç bileşenlerinin ayrıntılı sürüm bilgilerini ifşa etmediği doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.4", - "section_name": "İstenmeyen Bilgi Sızıntısı", - "req_id": "V13.4.7", - "req_description": "Web katmanının yalnızca belirli dosya uzantılarına sahip dosyaları sunacak şekilde yapılandırıldığı, bu sayede istem dışı bilgi, yapılandırma ya da kaynak kod sızıntılarının önlendiği doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V14", - "chapter_name": "Veri Koruma", - "section_id": "V14.1", - "section_name": "Veri Koruma Dokümantasyonu", - "req_id": "V14.1.1", - "req_description": "Uygulama tarafından oluşturulan ve işlenen tüm hassas verilerin tanımlanıp, koruma seviyelerine göre sınıflandırıldığından emin olun. Bu, yalnızca kodlanmış (örneğin Base64 stringleri ya da JWT içindeki düz metin yükler gibi) ve bu nedenle kolayca çözülebilir verileri de içermelidir. Koruma seviyeleri, uygulamanın uymakla yükümlü olduğu veri koruma ve gizlilik düzenlemeleri ile standartlarını dikkate almalıdır.", - "L": "2" - }, - { - "chapter_id": "V14", - "chapter_name": "Veri Koruma", - "section_id": "V14.1", - "section_name": "Veri Koruma Dokümantasyonu", - "req_id": "V14.1.2", - "req_description": "Tüm hassas veri koruma seviyeleri için belgelenmiş bir koruma gereksinimleri seti tanımlandığından emin olun. Bu gereksinimler genel şifreleme, bütünlük doğrulama, saklama süresi, verinin nasıl günlüğe kaydedileceği, günlüklerdeki hassas verilere erişim kontrolleri, veritabanı düzeyinde şifreleme, gizlilik ve gizliliği artırıcı teknolojiler ile diğer gizlilik gereksinimlerini kapsamalıdır.", - "L": "2" - }, - { - "chapter_id": "V14", - "chapter_name": "Veri Koruma", - "section_id": "V14.2", - "section_name": "Genel Veri Koruması", - "req_id": "V14.2.1", - "req_description": "Hassas verilerin yalnızca HTTP message body veya header alanlarında sunucuya gönderildiği ve URL ile sorgu parametrelerinin, API anahtarı veya session token’ı gibi hassas bilgiler içermediği doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V14", - "chapter_name": "Veri Koruma", - "section_id": "V14.2", - "section_name": "Genel Veri Koruması", - "req_id": "V14.2.2", - "req_description": "Hassas verilerin, yük dengeleyiciler ve uygulama önbellekleri gibi sunucu bileşenlerinde önbelleğe alınmasının engellendiği veya kullanım sonrası bu verilerin güvenli biçimde temizlendiği doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V14", - "chapter_name": "Veri Koruma", - "section_id": "V14.2", - "section_name": "Genel Veri Koruması", - "req_id": "V14.2.3", - "req_description": "Uygulama kontrolü dışında veri toplanmasını engellemek için, tanımlanmış hassas verilerin, kullanıcı izleyicileri gibi güvensiz taraflara gönderilmediği doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V14", - "chapter_name": "Veri Koruma", - "section_id": "V14.2", - "section_name": "Genel Veri Koruması", - "req_id": "V14.2.4", - "req_description": "Hassas verilere yönelik şifreleme, bütünlük doğrulama, veri saklama, loglama yöntemi, loglardaki erişim kontrolleri, gizlilik teknolojileri gibi kontrollerin, söz konusu verinin belgelenmiş koruma seviyesinde tanımlandığı şekilde uygulandığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V14", - "chapter_name": "Veri Koruma", - "section_id": "V14.2", - "section_name": "Genel Veri Koruması", - "req_id": "V14.2.5", - "req_description": "Önbellekleme mekanizmalarının yalnızca belirli içerik türüne sahip yanıtları önbelleğe alacak şekilde yapılandırıldığı ve hassas, dinamik içeriklerin önbelleğe alınmadığı doğrulanmalıdır. Web sunucusu, mevcut olmayan bir dosya talebinde geçerli ama farklı bir dosya döndürmek yerine 404 veya 302 cevabı vermelidir. Bu, Web Cache Deception saldırılarını önlemeye yardımcı olur.", - "L": "3" - }, - { - "chapter_id": "V14", - "chapter_name": "Veri Koruma", - "section_id": "V14.2", - "section_name": "Genel Veri Koruması", - "req_id": "V14.2.6", - "req_description": "Uygulamanın yalnızca işlevsellik için gerekli olan asgari hassas veriyi döndürdüğü doğrulanmalıdır. Örneğin, kredi kartı numarasının yalnızca bazı rakamlarının döndürülmesi; tam numaranın döndürülmesi gerekiyorsa, kullanıcı arayüzünde gizlenmiş (maskelenmiş) şekilde sunulması gerekir, aksi kullanıcı özel olarak görüntülemek istemedikçe gösterilmemelidir.", - "L": "3" - }, - { - "chapter_id": "V14", - "chapter_name": "Veri Koruma", - "section_id": "V14.2", - "section_name": "Genel Veri Koruması", - "req_id": "V14.2.7", - "req_description": "Hassas bilgilerin, veri saklama sınıflandırmasına tabi tutulduğu, geçerliliğini yitirmiş veya artık gerekli olmayan verilerin belirlenmiş bir zaman çizelgesiyle ya da gerektiğinde otomatik olarak silindiği doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V14", - "chapter_name": "Veri Koruma", - "section_id": "V14.2", - "section_name": "Genel Veri Koruması", - "req_id": "V14.2.8", - "req_description": "Kullanıcı tarafından yüklenen dosyaların meta verilerinden hassas bilgilerin çıkarıldığı veya bu bilgilerin yalnızca kullanıcıdan açık onay alındığında saklandığı doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V14", - "chapter_name": "Veri Koruma", - "section_id": "V14.3", - "section_name": "İstemci Tarafı Veri Koruması", - "req_id": "V14.3.1", - "req_description": "Kimliği doğrulanmış verilerin, istemci veya oturum sonlandığında istemci depolamasından (örneğin tarayıcı DOM’undan) temizlendiği doğrulanmalıdır. 'Clear-Site-Data' HTTP response header bu konuda yardımcı olabilir ancak istemci tarafı, sunucu bağlantısı mevcut olmadığında da temizlik işlemini yapabiliyor olmalıdır.", - "L": "1" - }, - { - "chapter_id": "V14", - "chapter_name": "Veri Koruma", - "section_id": "V14.3", - "section_name": "İstemci Tarafı Veri Koruması", - "req_id": "V14.3.2", - "req_description": "Uygulamanın, tarayıcılarda hassas verilerin önbelleğe alınmasını önlemek amacıyla yeterli anti-önbellekleme HTTP response header (örneğin Cache-Control: no-store) ayarladığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V14", - "chapter_name": "Veri Koruma", - "section_id": "V14.3", - "section_name": "İstemci Tarafı Veri Koruması", - "req_id": "V14.3.3", - "req_description": "Tarayıcıda depolanan verilerin (örneğin localStorage, sessionStorage, IndexedDB veya çerezler) hassas veri içermediği, yalnızca session token’larının istisna olarak kabul edildiği doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.1", - "section_name": "Güvenli Kodlama ve Mimari Dokümantasyonu", - "req_id": "V15.1.1", - "req_description": "Güvenlik açığı içeren üçüncü taraf bileşen sürümleri ve genel olarak kütüphane güncellemeleri için, uygulama dokümantasyonunda risk bazlı düzeltme zamanlarının tanımlandığı doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.1", - "section_name": "Güvenli Kodlama ve Mimari Dokümantasyonu", - "req_id": "V15.1.2", - "req_description": "Yazılım bileşen listesi (Software Bill of Materials - SBOM) gibi bir envanterin tutulduğu, kullanılan tüm üçüncü taraf kütüphanelerin önceden tanımlanmış, güvenilir ve düzenli olarak güncellenen depolardan alındığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.1", - "section_name": "Güvenli Kodlama ve Mimari Dokümantasyonu", - "req_id": "V15.1.3", - "req_description": "Uygulama dokümantasyonunda zaman veya kaynak açısından yoğun işlevlerin tanımlandığı, bu işlevlerin aşırı kullanımı durumunda kullanılabilirlik kaybının nasıl önleneceği ve yanıt oluşturma süresinin istemci zaman aşımını aşmaması için hangi önlemlerin alındığı belirtilmelidir. Örnek savunmalar kuyruklama, eşzamansız işleme, kullanıcı başına ve uygulama genelinde paralel işlem sınırlarını içerebilir.", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.1", - "section_name": "Güvenli Kodlama ve Mimari Dokümantasyonu", - "req_id": "V15.1.4", - "req_description": "Uygulama dokümantasyonunda \"riskli bileşenler\" olarak değerlendirilen üçüncü taraf kütüphanelerin vurgulandığı doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.1", - "section_name": "Güvenli Kodlama ve Mimari Dokümantasyonu", - "req_id": "V15.1.5", - "req_description": "Uygulama dokümantasyonunda \"tehlikeli işlevsellik\" içeren uygulama bölümlerinin açıkça belirtildiği doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.2", - "section_name": "Güvenlik Mimarisi ve Bağımlılıklar", - "req_id": "V15.2.1", - "req_description": "Uygulamanın yalnızca, belgelenmiş güncelleme ve düzeltme sürelerini aşmamış bileşenleri içerdiği doğrulanmalıdır.", - "L": "1" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.2", - "section_name": "Güvenlik Mimarisi ve Bağımlılıklar", - "req_id": "V15.2.2", - "req_description": "Uygulamanın, belgelenmiş güvenlik kararları ve stratejilere dayanarak, zaman veya kaynak açısından yoğun işlevlerin neden olabileceği kullanılabilirlik kaybına karşı savunmalar uyguladığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.2", - "section_name": "Güvenlik Mimarisi ve Bağımlılıklar", - "req_id": "V15.2.3", - "req_description": "Üretim ortamının yalnızca uygulamanın çalışması için gerekli işlevleri içerdiği ve test kodları, örnek kod parçaları veya geliştirme işlevleri gibi gereksiz işlevsellikleri açığa çıkarmadığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.2", - "section_name": "Güvenlik Mimarisi ve Bağımlılıklar", - "req_id": "V15.2.4", - "req_description": "Üçüncü taraf bileşenlerin ve bunların tüm transitif bağımlılıklarının beklenen depolardan (iç kaynaklı ya da harici) alındığı ve bağımlılık karışıklığı (dependency confusion) saldırılarına açık olmadığı doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.2", - "section_name": "Güvenlik Mimarisi ve Bağımlılıklar", - "req_id": "V15.2.5", - "req_description": "Uygulamanın, “tehlikeli işlevsellik” içeren veya “riskli bileşenler” kullanan bölümlerine ek korumalar uyguladığı doğrulanmalıdır. Bu korumalar sandbox, kapsülleme, konteynerleştirme veya ağ düzeyinde izolasyon gibi teknikler aracılığıyla, bir uygulama bölümünün ele geçirilmesi durumunda saldırganın diğer bölümlere sıçramasını geciktirmeyi veya engellemeyi amaçlamalıdır.", - "L": "3" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.3", - "section_name": "Savunmacı Kodlama", - "req_id": "V15.3.1", - "req_description": "Uygulamanın yalnızca gerekli alanların bir alt kümesini veri nesnesinden döndürdüğü doğrulanmalıdır. Örneğin, bazı alanlara kullanıcıların erişmemesi gerektiğinden tüm veri nesnesi döndürülmemelidir.", - "L": "1" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.3", - "section_name": "Savunmacı Kodlama", - "req_id": "V15.3.2", - "req_description": "Uygulama backend'i harici URL’lere çağrı yaptığında, yalnızca amaçlanan işlevsellik söz konusuysa yönlendirmeleri takip edecek şekilde yapılandırıldığının doğrulanması gerekir.", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.3", - "section_name": "Savunmacı Kodlama", - "req_id": "V15.3.3", - "req_description": "Uygulamanın, kitlesel atama saldırılarına karşı, her bir controller ve eylem için izin verilen alanları sınırlandırarak savunmalar sağladığı doğrulanmalıdır. Örneğin, bir alan değeri, bu işlemde değiştirilmesi amaçlanmadıysa eklenememeli veya güncellenememelidir.", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.3", - "section_name": "Savunmacı Kodlama", - "req_id": "V15.3.4", - "req_description": "Tüm proxy ve ara katman bileşenlerinin kullanıcının orijinal IP adresini, uç kullanıcı tarafından değiştirilemeyecek güvenilir veri alanları kullanarak doğru şekilde ilettiği ve uygulamanın ve web sunucusunun bu doğru değeri, loglama ve hız sınırlama gibi güvenlik kararları için kullandığı doğrulanmalıdır. Ayrıca, orijinal IP adresinin bile dinamik IP'ler, VPN'ler veya kurumsal güvenlik duvarları nedeniyle güvenilir olmayabileceği dikkate alınmalıdır.", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.3", - "section_name": "Savunmacı Kodlama", - "req_id": "V15.3.5", - "req_description": "Uygulamanın değişkenlerin doğru türde olduğunu açıkça doğruladığı ve sıkı eşitlik ve karşılaştırma işlemleri kullandığı doğrulanmalıdır. Bu, değişken türüyle ilgili varsayımlardan kaynaklanan tür oynama (type juggling) veya tür karışıklığı (type confusion) güvenlik açıklarını önlemek içindir.", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.3", - "section_name": "Savunmacı Kodlama", - "req_id": "V15.3.6", - "req_description": "JavaScript kodunun prototip zehirleme (prototype pollution) saldırılarını önleyecek şekilde yazıldığı, örneğin, nesne literal’leri yerine Set() veya Map() gibi yapılar kullanıldığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.3", - "section_name": "Savunmacı Kodlama", - "req_id": "V15.3.7", - "req_description": "Uygulamanın, özellikle framework'ün istek parametrelerinin kaynağı (sorgu dizgisi, gövde parametreleri, çerezler veya başlık alanları) arasında ayrım yapmadığı durumlarda, HTTP parametre kirliliği (HTTP parameter pollution) saldırılarına karşı savunmalar uyguladığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.4", - "section_name": "Güvenli Eş Zamanlılık (Concurrency)", - "req_id": "V15.4.1", - "req_description": "Çok iş parçacıklı kodda (örneğin cache'ler, dosyalar veya birden fazla iş parçacığı tarafından erişilen bellek içi nesneler gibi) paylaşılan nesnelere yalnızca thread-safe (iş parçacığı güvenli) türler ve kilitleme (lock) veya semaphore gibi senkronizasyon mekanizmaları kullanılarak erişildiği doğrulanmalıdır. Bu, yarış durumlarını ve veri bozulmasını önlemeye yöneliktir.", - "L": "3" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.4", - "section_name": "Güvenli Eş Zamanlılık (Concurrency)", - "req_id": "V15.4.2", - "req_description": "Bir kaynağın durumu üzerindeki kontroller (örneğin varlığı ya da izinleri gibi) ile bu kontrole bağlı eylemlerin tek bir atomik işlem olarak gerçekleştirildiği doğrulanmalıdır. Bu, TOCTOU (time-of-check to time-of-use) yarış durumlarını önlemeye yöneliktir. Bir dosyanın varlığının kontrol edilip ardından açılması veya bir kullanıcının erişiminin doğrulanıp ardından yetki verilmesi gibi işlemler buna örnektir.", - "L": "3" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.4", - "section_name": "Güvenli Eş Zamanlılık (Concurrency)", - "req_id": "V15.4.3", - "req_description": "Kilitlerin (locks) tutarlı biçimde kullanıldığı, iş parçacıklarının birbirini beklemesi ya da sonsuz döngüye girmesi (deadlock veya livelock) gibi durumların önlendiği doğrulanmalıdır. Ayrıca, kilitleme mantığı, kaynağı yöneten kod içinde kalmalı ve dış sınıflar veya dış kodlar tarafından istemeden veya kötü niyetli şekilde değiştirilememelidir.", - "L": "3" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.4", - "section_name": "Güvenli Eş Zamanlılık (Concurrency)", - "req_id": "V15.4.4", - "req_description": "Kaynak tahsis politikalarının, iş parçacığı açlığını önleyecek şekilde, kaynaklara adil erişimi sağladığı doğrulanmalıdır. Örneğin, thread pool (iş parçacığı havuzu) kullanımı, düşük öncelikli iş parçacıklarının da makul sürelerde çalışabilmesi için uygulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.1", - "section_name": "Güvenlik Loglaması Dokümantasyonu", - "req_id": "V16.1.1", - "req_description": "Uygulamanın teknoloji yığını boyunca her katmanda hangi olayların loglandığını, log formatlarını, logların nereye yazıldığını, nasıl kullanıldığını, erişimin nasıl kontrol edildiğini ve logların ne kadar süre saklandığını belgeleyen bir envanterin mevcut olduğu doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.2", - "section_name": "Genel Loglama", - "req_id": "V16.2.1", - "req_description": "Her bir log girdisinin, olayın ne zaman, nerede, kim tarafından ve ne olduğuna dair detaylı bir zaman çizelgesi oluşturulmasına olanak tanıyacak gerekli meta verileri içerdiği doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.2", - "section_name": "Genel Loglama", - "req_id": "V16.2.2", - "req_description": "Tüm loglama bileşenlerinin zaman kaynaklarının senkronize olduğu ve güvenlik olayı meta verisindeki zaman damgalarının UTC kullanarak ya da açık zaman dilimi ofsetiyle belirtildiği doğrulanmalıdır. UTC kullanımı, özellikle yaz saati uygulamaları nedeniyle oluşabilecek karışıklıkları önlemek için tavsiye edilir.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.2", - "section_name": "Genel Loglama", - "req_id": "V16.2.3", - "req_description": "Uygulamanın yalnızca log envanterinde belgelenmiş dosya ve hizmetlere log yazdığı ya da ilettiği doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.2", - "section_name": "Genel Loglama", - "req_id": "V16.2.4", - "req_description": "Logların kullanılan log işleyici (log processor) tarafından okunabildiği ve ilişkilendirilebildiği doğrulanmalıdır. Tercihen yaygın bir log formatı kullanılmalıdır.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.2", - "section_name": "Genel Loglama", - "req_id": "V16.2.5", - "req_description": "Hassas veriler loglanırken, uygulamanın veri koruma seviyesine uygun olarak loglama yaptığı doğrulanmalıdır. Örneğin kimlik bilgileri veya ödeme detayları gibi bazı verilerin loglanmasına izin verilmemelidir. Session token’ları gibi veriler ise yalnızca tamamen ya da kısmen maskelenmiş ya da hash’lenmiş olarak loglanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.3", - "section_name": "Güvenlik Olayları", - "req_id": "V16.3.1", - "req_description": "Tüm kimlik doğrulama işlemlerinin (başarılı ve başarısız girişimler dahil) loglandığı doğrulanmalıdır. Kullanılan kimlik doğrulama türü veya faktörleri gibi ek meta veriler de toplanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.3", - "section_name": "Güvenlik Olayları", - "req_id": "V16.3.2", - "req_description": "Başarısız yetkilendirme girişimlerinin loglandığı doğrulanmalıdır. Seviye 3 uygulamalar için, tüm yetkilendirme kararlarının ve hassas verilere erişim olaylarının (verinin kendisi olmadan) loglandığı da doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.3", - "section_name": "Güvenlik Olayları", - "req_id": "V16.3.3", - "req_description": "Uygulamanın, belgelenmiş güvenlik olaylarını ve güvenlik kontrollerini aşma girişimlerini (girdi doğrulama, iş mantığı, otomasyon karşıtı kontroller vb.) logladığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.3", - "section_name": "Güvenlik Olayları", - "req_id": "V16.3.4", - "req_description": "Beklenmeyen hatalar ve güvenlik kontrolü başarısızlıkları (örneğin backend TLS hataları gibi) loglandığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.4", - "section_name": "Log Koruması", - "req_id": "V16.4.1", - "req_description": "Tüm loglama bileşenlerinin, log enjeksiyonunu (log injection) önlemek amacıyla verileri uygun biçimde encode ettiği doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.4", - "section_name": "Log Koruması", - "req_id": "V16.4.2", - "req_description": "Logların yetkisiz erişime karşı korunduğu ve değiştirilemez olduğu doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.4", - "section_name": "Log Koruması", - "req_id": "V16.4.3", - "req_description": "Logların analiz, tespit, uyarı ve yükseltme amacıyla mantıksal olarak ayrı bir sisteme güvenli biçimde iletildiği doğrulanmalıdır. Böylece uygulama ihlal edilse bile logların tehlikeye girmesi önlenmiş olur.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.5", - "section_name": "Hata Yönetimi", - "req_id": "V16.5.1", - "req_description": "Beklenmedik ya da güvenlikle ilgili bir hata oluştuğunda, tüketiciye genel bir mesaj döndürüldüğü ve yığın izleri (stack trace), sorgular, gizli anahtarlar, token’lar gibi hassas sistem içi verilerin açıklanmadığı doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.5", - "section_name": "Hata Yönetimi", - "req_id": "V16.5.2", - "req_description": "Uygulamanın, dış kaynaklara erişim başarısız olduğunda bile güvenli şekilde çalışmaya devam ettiği doğrulanmalıdır. Örneğin, circuit breaker ya da graceful degradation gibi desenler kullanılmalıdır.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.5", - "section_name": "Hata Yönetimi", - "req_id": "V16.5.3", - "req_description": "Uygulamanın hata durumlarında güvenli ve düzenli şekilde başarısız olduğu doğrulanmalıdır. Bu, örneğin doğrulama hatalarına rağmen işlemlerin işlenmesine yol açabilecek fail-open durumlarını önlemelidir.", - "L": "2" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.5", - "section_name": "Hata Yönetimi", - "req_id": "V16.5.4", - "req_description": "Ele alınmamış tüm istisnaları yakalayacak şekilde tanımlanmış bir “son çare hata yöneticisi” bulunduğu doğrulanmalıdır. Bu, hem loglara gitmesi gereken hata detaylarının kaybolmaması hem de tüm uygulama sürecinin çökerek hizmet dışı kalmasının önlenmesi açısından önemlidir.", - "L": "3" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.1", - "section_name": "TURN Sunucusu", - "req_id": "V17.1.1", - "req_description": "TURN hizmetinin yalnızca özel amaçlar için ayrılmamış IP adreslerine (ör. iç ağlar, yayın adresleri, loopback) erişime izin verdiği doğrulanmalıdır. Bu gereksinim hem IPv4 hem de IPv6 adresleri için geçerlidir.", - "L": "2" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.1", - "section_name": "TURN Sunucusu", - "req_id": "V17.1.2", - "req_description": "TURN hizmetinin, meşru kullanıcıların sunucuda çok sayıda bağlantı noktası açmaya çalışması durumunda kaynak tüketimi saldırılarına karşı dayanıklı olduğu doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Medya", - "req_id": "V17.2.1", - "req_description": "DTLS sertifikası anahtarının, belgelenmiş kriptografik anahtar yönetim politikasına uygun şekilde yönetildiği ve korunduğu doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Medya", - "req_id": "V17.2.2", - "req_description": "Medya sunucusunun onaylı DTLS şifre takımlarını (cipher suites) ve Güvenli Gerçek Zamanlı Aktarım Protokolü (Secure Real-time Transport Protocol - SRTP) için anahtarlar oluşturmaya yönelik DTLS Uzantısı için güvenli bir koruma profilini kullanacak ve destekleyecek şekilde yapılandırıldığı (DTLS-SRTP) doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Medya", - "req_id": "V17.2.3", - "req_description": "Real-time Transport Protocol (RTP) injection saldırılarının bir hizmet reddi durumuna veya medya akışlarına ses veya video medyası eklenmesine yol açmasını önlemek için medya sunucusunda Güvenli SRTP kimlik doğrulamasının kontrol edildiği doğrulanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Medya", - "req_id": "V17.2.4", - "req_description": "Verify that the media server is able to continue processing incoming media traffic when encountering malformed Secure Real-time Transport Protocol (SRTP) packets.", - "L": "2" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Medya", - "req_id": "V17.2.5", - "req_description": "Medya sunucusunun, meşru kullanıcılardan gelen SRTP flood'ı sırasında gelen medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Medya", - "req_id": "V17.2.6", - "req_description": "Medya sunucusunun DTLS içinde yer alan \"ClientHello\" yarış durumu güvenlik açığına karşı savunmasız olmadığı, medya sunucusunun güvenlik açığına sahip olduğunun açıkça bilinip bilinmediği kontrol edilerek veya yarış koşulu testi gerçekleştirilerek doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Medya", - "req_id": "V17.2.7", - "req_description": "Medya sunucusuna bağlı ses veya video kayıt mekanizmalarının, meşru kullanıcı kaynaklı SRTP flood'ı sırasında medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Medya", - "req_id": "V17.2.8", - "req_description": "DTLS sertifikasının, SDP (Session Description Protocol) fingerprint özelliği ile karşılaştırıldığı ve doğrulama başarısız olursa medya akışının sonlandırıldığı, medya akışının özgünlüğünü sağlamak için doğrulanmalıdır.", - "L": "3" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.3", - "section_name": "Sinyalizasyon", - "req_id": "V17.3.1", - "req_description": "Sinyalizasyon sunucusunun, flood saldırısı altında bile meşru sinyalizasyon mesajlarını işlemeye devam edebildiği doğrulanmalıdır. Bu, sinyalizasyon düzeyinde oran sınırlaması uygulanarak sağlanmalıdır.", - "L": "2" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.3", - "section_name": "Sinyalizasyon", - "req_id": "V17.3.2", - "req_description": "Sinyalizasyon sunucusunun, hizmet reddine yol açabilecek şekilde yapılandırılmış bozuk sinyalizasyon mesajlarıyla karşılaştığında bile meşru mesajları işlemeye devam edebildiği doğrulanmalıdır. Bu, girdi doğrulaması, integer overflow ve buffer overflow'a karşı savunma ve sağlam hata işleme teknikleri ile sağlanmalıdır.", - "L": "2" - } - ] -} diff --git a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.flat.legacy.json b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.flat.legacy.json deleted file mode 100644 index 500f60643c..0000000000 --- a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.flat.legacy.json +++ /dev/null @@ -1,4437 +0,0 @@ -{ - "requirements": [ - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.1", - "section_name": "Kodlama ve Temizleme Mimarisi", - "req_id": "V1.1.1", - "req_description": "Girdinin yalnızca bir kez kanonik forma (canonical form) çözümlendiği veya kaçış işlemlerinin kaldırıldığı, bu işlemin yalnızca verinin bu biçimde beklenmesi durumunda yapıldığı ve bu işlemin girdi doğrulama veya temizleme işlemlerinden sonra değil, önce gerçekleştiği doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.1", - "section_name": "Kodlama ve Temizleme Mimarisi", - "req_id": "V1.1.2", - "req_description": "Uygulamanın, çıktıyı kullanılması gereken yorumlayıcıya verilmeden hemen önce veya yorumlayıcının kendisi tarafından çıktı kodlaması ya da kaçış işlemi yaptığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.2", - "section_name": "Enjeksiyon Önleme", - "req_id": "V1.2.1", - "req_description": "HTTP yanıtı, HTML veya XML belgesi için yapılan çıktı kodlamasının; HTML elemanları, HTML öznitelikleri, HTML yorumları, CSS ya da HTTP başlık alanları gibi bağlamlara uygun olduğu doğrulanmalıdır. Böylece mesaj veya belge yapısının bozulması önlenir.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.2", - "section_name": "Enjeksiyon Önleme", - "req_id": "V1.2.2", - "req_description": "Dinamik olarak URL oluşturulurken, güvenilmeyen verinin bağlamına göre (örneğin, sorgu veya yol parametreleri için URL kodlaması ya da base64url kodlaması) kodlandığı doğrulanmalıdır. Yalnızca güvenli URL protokollerine izin verilmelidir (örneğin, javascript: veya data: yasaklanmalıdır).", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.2", - "section_name": "Enjeksiyon Önleme", - "req_id": "V1.2.3", - "req_description": "JavaScript içeriği (JSON dahil) dinamik olarak oluşturulurken çıktı kodlama/kaçış kullanıldığı doğrulanmalıdır. Böylece mesaj veya belge yapısı değiştirilmemiş olur (JavaScript ve JSON enjeksiyonlarının önüne geçilir).", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.2", - "section_name": "Enjeksiyon Önleme", - "req_id": "V1.2.4", - "req_description": "Veri sorguları veya veritabanı sorguları (SQL, HQL, NoSQL, Cypher vb.) için parametreli sorgular, ORM’ler, entity framework’ler kullanıldığı ya da SQL enjeksiyonu ve diğer veritabanı enjeksiyon saldırılarına karşı koruma sağlandığı doğrulanmalıdır. Bu durum, saklı yordam (stored procedure) yazarken de geçerlidir.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.2", - "section_name": "Enjeksiyon Önleme", - "req_id": "V1.2.5", - "req_description": "Uygulamanın işletim sistemi komut enjeksiyonlarına karşı korunduğu ve işletim sistemi çağrılarında parametreli OS sorguları veya bağlama özgü komut satırı çıktı kodlamasının kullanıldığı doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.2", - "section_name": "Enjeksiyon Önleme", - "req_id": "V1.2.6", - "req_description": "Uygulamanın LDAP enjeksiyon zafiyetlerine karşı korunduğu ya da LDAP enjeksiyonlarını önlemek için özel güvenlik kontrollerinin uygulandığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.2", - "section_name": "Enjeksiyon Önleme", - "req_id": "V1.2.7", - "req_description": "XPath enjeksiyon saldırılarına karşı, sorgu parametrelemesi veya önceden derlenmiş sorgular kullanılarak koruma sağlandığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.2", - "section_name": "Enjeksiyon Önleme", - "req_id": "V1.2.8", - "req_description": "LaTeX işlemcilerinin güvenli şekilde yapılandırıldığı (örneğin, --shell-escape bayrağının kullanılmadığı) ve yalnızca izin verilen komutlardan oluşan bir listeyle çalıştırıldığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.2", - "section_name": "Enjeksiyon Önleme", - "req_id": "V1.2.9", - "req_description": "Düzenli ifadelerde (regex) özel karakterlerin (genellikle ters eğik çizgi \\ ile) kaçırılarak meta karakter olarak yorumlanmalarının önlendiği doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.2", - "section_name": "Enjeksiyon Önleme", - "req_id": "V1.2.10", - "req_description": "Uygulamanın CSV ve formül enjeksiyonlarına karşı korunduğu doğrulanmalıdır. Uygulama, CSV içeriği dışa aktarırken RFC 4180 Bölüm 2.6 ve 2.7'de tanımlanan kaçış kurallarına uymalıdır. Ayrıca, CSV veya diğer tablo formatlarına (XLS, XLSX, ODF gibi) aktarım yapılırken, alanın ilk karakteri olarak çıkan özel karakterler ('=', '+', '-', '@', '\\t' (sekme), '\\0' (null karakter)) tek tırnak (') ile kaçırılmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.3", - "section_name": "Temizleme (Sanitization)", - "req_id": "V1.3.1", - "req_description": "WYSIWYG editörlerinden veya benzer kaynaklardan gelen tüm güvenilmeyen HTML girdilerinin, bilinen ve güvenli bir HTML temizleme kütüphanesi ya da çerçeve özelliği ile temizlendiği doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.3", - "section_name": "Temizleme (Sanitization)", - "req_id": "V1.3.2", - "req_description": "Uygulamanın eval() veya Spring Expression Language (SpEL) gibi dinamik kod çalıştırma özelliklerini kullanmaktan kaçındığı doğrulanmalıdır. Alternatif yoksa, kullanıcı girdisi çalıştırılmadan önce mutlaka temizlenmelidir.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.3", - "section_name": "Temizleme (Sanitization)", - "req_id": "V1.3.3", - "req_description": "Potansiyel olarak tehlikeli bir bağlamda kullanılacak verilerin, bu bağlama uygun karakterlere izin vermek ve çok uzun girdileri kısaltmak gibi güvenlik önlemleriyle önceden temizlendiği doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.3", - "section_name": "Temizleme (Sanitization)", - "req_id": "V1.3.4", - "req_description": "Kullanıcı tarafından sağlanan SVG içeriğinin, yalnızca güvenli etiket ve özellikler (örneğin grafik çizme ile ilgili) içerdiğinden emin olmak için onaylandığı veya temizlendiği doğrulanmalıdır (ör. script veya foreignObject içermemelidir).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.3", - "section_name": "Temizleme (Sanitization)", - "req_id": "V1.3.5", - "req_description": "Markdown, CSS, XSL stil sayfaları, BBCode veya benzeri ifade şablon dillerinde kullanıcı girdisinin temizlendiği veya bu tür özelliklerin devre dışı bırakıldığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.3", - "section_name": "Temizleme (Sanitization)", - "req_id": "V1.3.6", - "req_description": "Uygulamanın, güvenilmeyen verileri başka servislere iletmeden önce izinli protokol, alan adı, yol ve port listelerine göre doğruladığı ve tehlikeli karakterleri temizlediği doğrulanarak SSRF (Sunucu Taraflı İstek Sahteciliği) saldırılarına karşı korunduğu doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.3", - "section_name": "Temizleme (Sanitization)", - "req_id": "V1.3.7", - "req_description": "Uygulamanın şablon enjeksiyon saldırılarına karşı, güvenilmeyen girdilere dayalı şablon oluşturmayı engellediği; eğer bu kaçınılmazsa, bu girdilerin mutlaka temizlendiği veya sıkı şekilde onaylandığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.3", - "section_name": "Temizleme (Sanitization)", - "req_id": "V1.3.8", - "req_description": "JNDI sorgularında kullanılmadan önce güvenilmeyen girdilerin temizlendiği ve JNDI'nin enjeksiyonlara karşı güvenli şekilde yapılandırıldığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.3", - "section_name": "Temizleme (Sanitization)", - "req_id": "V1.3.9", - "req_description": "Memcache’e gönderilmeden önce içeriğin temizlenerek enjeksiyon saldırılarına karşı korunduğu doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.3", - "section_name": "Temizleme (Sanitization)", - "req_id": "V1.3.10", - "req_description": "Format dizgilerinin (format strings) beklenmeyen veya zararlı şekilde çözümlenmesini önlemek için işlenmeden önce temizlendiği doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.3", - "section_name": "Temizleme (Sanitization)", - "req_id": "V1.3.11", - "req_description": "SMTP veya IMAP enjeksiyonlarını önlemek için, kullanıcı girdisinin posta sistemlerine iletilmeden önce temizlendiği doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.3", - "section_name": "Temizleme (Sanitization)", - "req_id": "V1.3.12", - "req_description": "Regex girdilerinin üstel geri izlemeye (exponential backtracking) neden olan öğeler içermediği ve güvenilmeyen girdilerin ReDoS (Regex Denial of Service) gibi saldırılara karşı temizlendiği doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.4", - "section_name": "Bellek, Dizgi ve Yönetilmeyen Kod", - "req_id": "V1.4.1", - "req_description": "Yığın, arabellek (buffer) veya yığın belleği taşmalarını önlemek ya da tespit etmek amacıyla, bellek güvenli dizgi işlemlerinin, daha güvenli bellek kopyalama ve işaretçi aritmetiğinin kullanıldığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.4", - "section_name": "Bellek, Dizgi ve Yönetilmeyen Kod", - "req_id": "V1.4.2", - "req_description": "Tamsayı taşmalarını önlemek için işaret (sign), aralık (range) ve giriş doğrulama tekniklerinin kullanıldığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.4", - "section_name": "Bellek, Dizgi ve Yönetilmeyen Kod", - "req_id": "V1.4.3", - "req_description": "Dinamik olarak ayrılan belleğin ve kaynakların serbest bırakıldığı ve boşaltılan belleklere ait referansların veya işaretçilerin kaldırıldığı veya null yapıldığı doğrulanmalıdır (dangling pointer ve use-after-free zafiyetlerine karşı).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.5", - "section_name": "Güvenli Ters Serileştirme (Safe Deserialization)", - "req_id": "V1.5.1", - "req_description": "XML ayrıştırıcılarının (parser) kısıtlayıcı şekilde yapılandırıldığı ve dış varlık çözümleme (external entity resolution) gibi güvensiz özelliklerin XXE (XML eXternal Entity) saldırılarına karşı devre dışı bırakıldığı doğrulanmalıdır .", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.5", - "section_name": "Güvenli Ters Serileştirme (Safe Deserialization)", - "req_id": "V1.5.2", - "req_description": "Güvenilmeyen verilerin ters serileştirilmesinde, nesne türleri için izinli liste kullanımı veya istemci tanımlı nesne türlerinin kısıtlanması gibi güvenli giriş işleme önlemlerinin uygulandığı doğrulanmalıdır. Güvensiz olarak tanımlanmış ters serileştirme mekanizmaları, güvenilmeyen girdilerle kullanılmamalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V1", - "chapter_name": "Kodlama (Encoding) ve Temizleme", - "section_id": "V1.5", - "section_name": "Güvenli Ters Serileştirme (Safe Deserialization)", - "req_id": "V1.5.3", - "req_description": "Aynı veri türü için uygulamada kullanılan farklı parser'ların (ör. JSON, XML, URL parser'ları), veriyi tutarlı şekilde ayrıştırdığı ve aynı karakter kodlamasını kullandığı doğrulanmalıdır. Böylece JSON birlikte çalışabilirlik açıkları, URI veya dosya ayrıştırma farkları gibi sorunlar nedeniyle RFI veya SSRF saldırılarının istismar edilmesi önlenir.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Doğrulama ve İş Mantığı", - "section_id": "V2.1", - "section_name": "Doğrulama ve İş Mantığı Dokümantasyonu", - "req_id": "V2.1.1", - "req_description": "Uygulama dokümantasyonunda, veri öğelerinin beklenen yapıya göre nasıl doğrulanacağına ilişkin giriş doğrulama kurallarının tanımlandığı doğrulanmalıdır. Bu; kredi kartı numaraları, e-posta adresleri, telefon numaraları gibi yaygın veri biçimleri olabileceği gibi iç sistemlere özel biçimler de olabilir.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Doğrulama ve İş Mantığı", - "section_id": "V2.1", - "section_name": "Doğrulama ve İş Mantığı Dokümantasyonu", - "req_id": "V2.1.2", - "req_description": "Uygulama dokümantasyonunda, birleştirilmiş veri öğelerinin mantıksal ve bağlamsal tutarlılığının nasıl doğrulanacağı tanımlanmalıdır (örneğin, mahalle ve posta kodunun eşleşip eşleşmediğinin kontrolü).", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Doğrulama ve İş Mantığı", - "section_id": "V2.1", - "section_name": "Doğrulama ve İş Mantığı Dokümantasyonu", - "req_id": "V2.1.3", - "req_description": "Hem kullanıcı bazında hem de uygulama genelinde geçerli olacak şekilde, iş mantığı sınırları ve doğrulama beklentilerinin belgelendiği doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Doğrulama ve İş Mantığı", - "section_id": "V2.2", - "section_name": "Girdi Doğrulama", - "req_id": "V2.2.1", - "req_description": "Girdilerin, işlevsel ya da iş gereksinimlerine uygunluğunun doğrulandığı teyit edilmelidir. Bu işlem; izinli değerler, desenler ve aralıklar listesine karşı pozitif doğrulama ile ya da girdinin beklenen yapıya ve mantıksal sınırlara uygunluğunun önceden tanımlanmış kurallara göre karşılaştırılması ile yapılmalıdır. Seviye 1 için bu, güvenlik veya iş kararlarında kullanılan girdilere odaklanabilir. Seviye 2 ve üstü için tüm girdilere uygulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Doğrulama ve İş Mantığı", - "section_id": "V2.2", - "section_name": "Girdi Doğrulama", - "req_id": "V2.2.2", - "req_description": "Uygulamanın, güvenilir bir servis katmanında girdi doğrulama zorunluluğu uygulayacak şekilde tasarlandığı doğrulanmalıdır. İstemci tarafında gerçekleştirilen doğrulama, kullanılabilirliği artırabilir ve teşvik edilmelidir. Ancak bu doğrulama,güvenlik kontrolü olarak kabul edilmemelidir.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Doğrulama ve İş Mantığı", - "section_id": "V2.2", - "section_name": "Girdi Doğrulama", - "req_id": "V2.2.3", - "req_description": "Uygulamanın, ilişkili veri öğelerinin önceden tanımlanmış kurallara göre makul olup olmadığını kontrol ettiği doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Doğrulama ve İş Mantığı", - "section_id": "V2.3", - "section_name": "İş Mantığı Güvenliği", - "req_id": "V2.3.1", - "req_description": "Uygulamanın, aynı kullanıcı için iş mantığı akışlarını yalnızca beklenen adım sırasına göre ve adım atlamadan işlediği doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Doğrulama ve İş Mantığı", - "section_id": "V2.3", - "section_name": "İş Mantığı Güvenliği", - "req_id": "V2.3.2", - "req_description": "İş mantığı sınırlarının, uygulama dokümantasyonuna uygun şekilde uygulandığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Doğrulama ve İş Mantığı", - "section_id": "V2.3", - "section_name": "İş Mantığı Güvenliği", - "req_id": "V2.3.3", - "req_description": "İş mantığı seviyesinde işlemlerin (transaction) kullanıldığı ve bir iş mantığı işleminin ya bütünüyle başarıyla tamamlandığı ya da önceki geçerli duruma geri döndürüldüğü (rollback) doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Doğrulama ve İş Mantığı", - "section_id": "V2.3", - "section_name": "İş Mantığı Güvenliği", - "req_id": "V2.3.4", - "req_description": "İş mantığı düzeyinde kilitleme mekanizmalarının, sınırlı kaynakların (ör. sinema koltukları, teslimat zamanları) uygulamanın mantığı manipüle edilerek çift rezervasyona neden olmamasını sağladığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Doğrulama ve İş Mantığı", - "section_id": "V2.3", - "section_name": "İş Mantığı Güvenliği", - "req_id": "V2.3.5", - "req_description": "Yüksek değerli iş mantığı akışlarının, yetkisiz veya kazara gerçekleşebilecek işlemleri önlemek için çoklu kullanıcı onayı gerektirdiği doğrulanmalıdır. Bu işlemler büyük para transferleri, sözleşme onayları, gizli bilgilere erişim veya üretimde güvenlik kurallarının geçersiz kılınmaları gibi durumları içerebilir.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Doğrulama ve İş Mantığı", - "section_id": "V2.4", - "section_name": "Otomasyon Karşıtı Önlemler", - "req_id": "V2.4.1", - "req_description": "Uygulama işlevlerine yönelik aşırı miktardaki çağrılara karşı; veri sızdırma, anlamsız veri üretme, kota tüketme, hız sınırının aşılması, hizmet reddi (DoS) ya da maliyetli kaynakların aşırı kullanımı gibi risklere karşı otomasyon karşıtı kontrollerin bulunduğu doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V2", - "chapter_name": "Doğrulama ve İş Mantığı", - "section_id": "V2.4", - "section_name": "Otomasyon Karşıtı Önlemler", - "req_id": "V2.4.2", - "req_description": "İş mantığı akışlarının, aşırı hızlı işlem gönderimlerini önleyecek şekilde gerçekçi insan zamanlaması gerektirdiği doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.1", - "section_name": "Web Frontend Güvenlik Dokümantasyonu", - "req_id": "V3.1.1", - "req_description": "Uygulama dokümantasyonunda, uygulamayı kullanan tarayıcıların desteklemesi gereken güvenlik özelliklerinin (ör. HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) ve diğer ilgili HTTP güvenlik mekanizmaları) tanımlandığı doğrulanmalıdır. Ayrıca bu özelliklerin mevcut olmadığı durumlarda uygulamanın nasıl davranması gerektiği (ör. kullanıcıyı uyarmak veya erişimi engellemek) de tanımlanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.2", - "section_name": "İçeriğin Yanlış Yorumlanması", - "req_id": "V3.2.1", - "req_description": "Tarayıcıların HTTP yanıtlarında içerik veya işlevi yanlış bir bağlamda sunmalarını önlemek amacıyla güvenlik kontrollerinin uygulandığı doğrulanmalıdır (ör. API, kullanıcı tarafından yüklenen dosya veya başka bir kaynağın doğrudan çağrılması durumunda). Olası kontroller arasında; yalnızca HTTP istek başlıklarının (ör. Sec-Fetch-\\*) doğru bağlamı gösterdiği durumlarda içeriğin sunulması, Content-Security-Policy başlığında \"sandbox\" yönergesinin kullanılması veya Content-Disposition başlığında \"attachment\" biçiminin kullanılması yer alabilir.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.2", - "section_name": "İçeriğin Yanlış Yorumlanması", - "req_id": "V3.2.2", - "req_description": "HTML yerine metin olarak görüntülenmesi amaçlanan içeriğin, HTML veya JavaScript gibi içeriklerin istenmeden çalıştırılmasını önleyecek şekilde \"createTextNode\" veya \"textContent\" gibi güvenli işleme fonksiyonlarıyla işlendiği doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.2", - "section_name": "İçeriğin Yanlış Yorumlanması", - "req_id": "V3.2.3", - "req_description": "Uygulamanın istemci tarafı JavaScript kullanırken açık değişken tanımlamaları yaparak, sıkı tür kontrolü uygulayarak, global değişkenleri document nesnesine kaydetmekten kaçınarak ve ad alanı izolasyonu sağlayarak DOM clobbering’den kaçındığı doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.3", - "section_name": "Çerez Yapılandırması", - "req_id": "V3.3.1", - "req_description": "Çerezlerin 'Secure' niteliğine sahip olduğu ve eğer çerez adı '\\__Host-' ön eki ile başlamıyorsa, '__Secure-' ön ekinin kullanıldığı doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.3", - "section_name": "Çerez Yapılandırması", - "req_id": "V3.3.2", - "req_description": "Kullanıcı arayüzü kandırma saldırılarına ve tarayıcı tabanlı istek sahteciliği saldırılarına (CSRF) karşı koruma sağlamak amacıyla, her çerezin 'SameSite' niteliğinin kullanım amacına uygun şekilde ayarlandığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.3", - "section_name": "Çerez Yapılandırması", - "req_id": "V3.3.3", - "req_description": "Çerez adı, diğer sunucularla paylaşılmak üzere açıkça tasarlanmadığı sürece '__Host-' ön eki ile tanımlanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.3", - "section_name": "Çerez Yapılandırması", - "req_id": "V3.3.4", - "req_description": "Bir çerez değeri istemci tarafı betikleri tarafından erişilememesi gereken bir veri içeriyorsa (ör. oturum token'ı), çerezin 'HttpOnly' niteliğine sahip olduğu ve aynı değerin (ör. oturum token'ı) yalnızca 'Set-Cookie' başlığı ile istemciye iletildiği doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.3", - "section_name": "Çerez Yapılandırması", - "req_id": "V3.3.5", - "req_description": "Uygulama bir çerez oluştururken, çerez adı ve değerinin toplam uzunluğunun 4096 baytı aşmadığı doğrulanmalıdır. Çok büyük çerezler tarayıcı tarafından saklanmaz ve isteklerle gönderilmez; bu da çereze bağlı çalışan uygulama işlevlerinin bozulmasına yol açabilir.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.4", - "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", - "req_id": "V3.4.2", - "req_description": "Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header'ı, uygulama tarafından sabit bir değer olarak tanımlanmalı veya gelen Origin header değeri güvenilir origin’lerden oluşan bir izinli listeye karşı doğrulanmalıdır. ‘Access-Control-Allow-Origin: *’ kullanılması gerekiyorsa, yanıtın hassas bilgi içermediği doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.4", - "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", - "req_id": "V3.4.3", - "req_description": "HTTP yanıtlarında Content-Security-Policy header'ı bulunduğu ve bu header'ın yalnızca güvenilen içeriklerin veya kaynakların yüklenmesini ve çalıştırılmasını sağlayan yönergeler içerdiği doğrulanmalıdır. Minimum olarak \"global policy\", object-src 'none', base-uri 'none' yönergelerini içermeli ve izinli liste, nonce veya hash temelli bir yapı içermelidir. Seviye 3 uygulamalarında her yanıt için nonce veya hash içeren özel bir politika tanımlanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.4", - "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", - "req_id": "V3.4.4", - "req_description": "Tüm HTTP yanıtlarının 'X-Content-Type-Options: nosniff' header'ını içerdiği doğrulanmalıdır. Bu, tarayıcıya içerik türünü tahmin etmeyi bırakmasını ve yanıtın Content-Type header'ında belirtilen MIME türünün, beklenen kaynak türüyle eşleşmesini zorunlu kılar. Ayrıca bu, tarayıcıda CORB (Cross-Origin Read Blocking) özelliğini etkinleştirir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.4", - "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", - "req_id": "V3.4.5", - "req_description": "Uygulamanın, 'Referer' başlığı yoluyla üçüncü taraflara teknik olarak hassas verilerin sızmasını önlemek için bir 'referrer policy' belirlediği doğrulanmalıdır. Bu, Referrer-Policy HTTP header'ıyla veya HTML öğe nitelikleriyle (element attributes) sağlanabilir. Sızabilecek hassas bilgiler, URL’deki yol ve sorgu parametreleri ile sınırlı uygulamalarda hostname bilgisini içerebilir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.4", - "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", - "req_id": "V3.4.6", - "req_description": "Uygulamanın, Content-Security-Policy header'ı altında 'frame-ancestors' yönergesini her HTTP yanıtında tanımladığı ve bu sayede içeriklerin varsayılan olarak başka sayfalara gömülmesini engellediği doğrulanmalıdır. Gerekli durumlarda özel olarak izin verildiğinden emin olunmalıdır. 'X-Frame-Options' header'ı, tarayıcılar tarafından desteklenmesine rağmen, artık güncel değildir ve güvenlik amacıyla kullanılmamalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.4", - "section_name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", - "req_id": "V3.4.8", - "req_description": "Bir belgenin işlenmesini ve sunulmasını başlatan tüm HTTP yanıtlarında (örneğin 'text/html' tipi yanıtlar), 'Cross-Origin-Opener-Policy' header'ı 'same-origin' veya 'same-origin-allow-popups' yönergeleriyle birlikte yer almalıdır. Bu, tabnabbing ve frame counting gibi, pencere nesnelerine paylaşımlı erişimi sömüren saldırılara karşı koruma sağlar.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.5", - "section_name": "Tarayıcı Menşei Ayırımı", - "req_id": "V3.5.1", - "req_description": "Uygulama, hassas işlevselliğe yönelik izinsiz cross-origin istekleri önlemek için CORS preflight mekanizmasına güvenmiyorsa, bu tür isteklerin gerçekten uygulamadan geldiği doğrulanmalıdır. Bu, anti-forgery token kullanımı veya CORS tarafından güvenli kabul edilmeyen özel HTTP header'larının zorunlu kılınmasıyla yapılabilir. Bu, tarayıcı tabanlı istek sahteciliği (CSRF) saldırılarına karşı bir savunmadır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.5", - "section_name": "Tarayıcı Menşei Ayırımı", - "req_id": "V3.5.2", - "req_description": "Uygulama, hassas işlevlerin izinsiz cross-origin çağrılmasını önlemek için CORS preflight mekanizmasına güveniyorsa, bu işlevlerin bir CORS-preflight isteğini tetiklemeden çağrılamadığı doğrulanmalıdır. Bu, 'Origin' ve 'Content-Type' header'larının doğrulanmasını veya CORS-safelisted olmayan bir header'ın ve alanın kullanılmasını gerektirebilir.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.5", - "section_name": "Tarayıcı Menşei Ayırımı", - "req_id": "V3.5.4", - "req_description": "Farklı uygulamaların farklı hostname'lerde barındırıldığı ve böylece Same-Origin Policy tarafından sağlanan kısıtlamalardan (örneğin çerez erişim sınırları, kaynaklar arası etkileşim kontrolleri) faydalanıldığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.5", - "section_name": "Tarayıcı Menşei Ayırımı", - "req_id": "V3.5.6", - "req_description": "Uygulamanın herhangi bir yerinde JSONP işlevselliğinin etkin olmadığı doğrulanmalıdır. Bu, XSSI (Cross-Site Script Inclusion) saldırılarını önlemek içindir.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.5", - "section_name": "Tarayıcı Menşei Ayırımı", - "req_id": "V3.5.7", - "req_description": "Yetkilendirme gerektiren verilerin, JavaScript dosyaları gibi betik kaynaklarının yanıtlarında yer almadığı, XSSI saldırılarını önlemek için doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.5", - "section_name": "Tarayıcı Menşei Ayırımı", - "req_id": "V3.5.8", - "req_description": "Kimliği doğrulanmış kaynakların (örneğin görseller, videolar, betikler ve belgeler) yalnızca gerçekten amaçlandığında kullanıcı adına yüklenebildiği veya gömülebildiği doğrulanmalıdır. Bu, isteğin uygun olmayan bir çapraz kaynak çağrısından kaynaklanmadığından emin olmak için Sec-Fetch-* HTTP istek başlığı alanlarının sıkı bir şekilde doğrulanmasıyla veya tarayıcıya döndürülen içeriği engelleme talimatı vermek için kısıtlayıcı bir Cross-Origin-Resource-Policy HTTP yanıt başlığı alanı ayarlayarak gerçekleştirilebilir.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.6", - "section_name": "Harici Kaynak Bütünlüğü", - "req_id": "V3.6.1", - "req_description": "JavaScript kütüphaneleri, CSS veya web fontları gibi istemci tarafı varlıkların yalnızca statik ve sürümlü olması, varlığın bütünlüğünü doğrulamak için Subresource Integrity (SRI) kullanılması durumunda harici olarak (örneğin, bir İçerik Dağıtım Ağı üzerinde) barındırıldığı doğrulanmalıdır. Bu mümkün değilse, her bir kaynak için bunu gerekçelendiren belgelenmiş bir güvenlik kararı bulunmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.7", - "section_name": "Diğer Tarayıcı Güvenliği Hususları", - "req_id": "V3.7.1", - "req_description": "Uygulamanın yalnızca hâlâ desteklenen ve güvenli kabul edilen istemci tarafı teknolojileri kullandığı doğrulanmalıdır. Bu gereksinimi karşılamayan teknolojilere örnek olarak NSAPI eklentileri, Flash, Shockwave, ActiveX, Silverlight, NACL veya istemci tarafı Java applet’leri verilebilir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.7", - "section_name": "Diğer Tarayıcı Güvenliği Hususları", - "req_id": "V3.7.2", - "req_description": "Uygulamanın, yalnızca hedef adres bir izinli listede yer alıyorsa kullanıcıyı otomatik olarak farklı bir ana makine adına veya uygulamanın kontrolünde olmayan bir etki alanına yönlendirdiği doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.7", - "section_name": "Diğer Tarayıcı Güvenliği Hususları", - "req_id": "V3.7.3", - "req_description": "Uygulamanın, kullanıcı uygulamanın kontrolü dışındaki bir URL’ye yönlendirildiğinde, yönlendirme hakkında bir bildirim gösterdiği ve kullanıcının bu gezintiyi iptal edebilmesi için bir seçenek sunduğu doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.7", - "section_name": "Diğer Tarayıcı Güvenliği Hususları", - "req_id": "V3.7.4", - "req_description": "Uygulamanın en üst düzey etki alanının (örneğin, site.tld) HTTP Strict Transport Security (HSTS) için genel preload listesine eklendiği doğrulanmalıdır. Bu, uygulamanın TLS kullanımının ana tarayıcılar tarafından doğrudan tanınmasını ve yalnızca Strict-Transport-Security yanıt header'ına bağlı kalınmamasını sağlar.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V3", - "chapter_name": "Web Ön Uç (Frontend) Güvenliği", - "section_id": "V3.7", - "section_name": "Diğer Tarayıcı Güvenliği Hususları", - "req_id": "V3.7.5", - "req_description": "Uygulamaya erişen tarayıcının beklenen güvenlik özelliklerini desteklememesi durumunda, uygulamanın dokümantasyona uygun şekilde davrandığı (örneğin kullanıcıyı uyarma veya erişimi engelleme) doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API ve Web Servisi", - "section_id": "V4.1", - "section_name": "Genel Web Servisi Güvenliği", - "req_id": "V4.1.1", - "req_description": "İleti gövdesi içeren her HTTP yanıtında, yanıtın gerçek içeriğiyle eşleşen bir Content-Type header alanı bulunduğu ve güvenli karakter kodlamasını (örneğin, UTF-8, ISO-8859-1) belirtmek üzere charset parametresi içerdiği doğrulanmalıdır. Bu işlem, IANA Medya Türleri'nden \"text/\", \"/+xml\" ve \"/xml\" gibi içerikler için geçerlidir.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API ve Web Servisi", - "section_id": "V4.1", - "section_name": "Genel Web Servisi Güvenliği", - "req_id": "V4.1.2", - "req_description": "Yalnızca kullanıcı arayüzüne yönelik uç noktaların (manuel olarak web tarayıcısı ile erişilmesi amaçlanan) otomatik olarak HTTP'den HTTPS'e yönlendirme yaptığı ve diğer hizmetlerin veya uç noktaların şeffaf yönlendirme gerçekleştirmediği doğrulanmalıdır. Bu, istemcinin farkında olmadan şifrelenmemiş HTTP istekleri göndermesi ve bu isteklerin otomatik olarak HTTPS'e yönlendirilmesi sonucunda hassas verilerin sızmasının fark edilmemesi riskini önlemek içindir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API ve Web Servisi", - "section_id": "V4.1", - "section_name": "Genel Web Servisi Güvenliği", - "req_id": "V4.1.3", - "req_description": "Uygulama tarafından kullanılan ve yük dengeleyici, web proxy veya frontend için backend hizmeti gibi bir ara katman tarafından ayarlanan herhangi bir HTTP başlık alanının, son kullanıcı tarafından geçersiz kılınamayacağı doğrulanmalıdır. Örnek başlıklar arasında X-Real-IP, X-Forwarded-* veya X-User-ID yer alabilir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API ve Web Servisi", - "section_id": "V4.1", - "section_name": "Genel Web Servisi Güvenliği", - "req_id": "V4.1.4", - "req_description": "Uygulama veya API tarafından açıkça desteklenen HTTP yöntemlerinin (preflight istekleri sırasında OPTIONS dahil) dışında hiçbir yöntemin kullanılmadığı ve kullanılmayan yöntemlerin engellendiği doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API ve Web Servisi", - "section_id": "V4.1", - "section_name": "Genel Web Servisi Güvenliği", - "req_id": "V4.1.5", - "req_description": "Çok hassas istekler veya birçok sistemden geçen işlemler için, taşıma katmanı güvenliğinin üzerine ek bir güvence sağlamak amacıyla, her iletiye özel dijital imzaların kullanıldığı doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API ve Web Servisi", - "section_id": "V4.2", - "section_name": "HTTP İleti Yapısı Doğrulama", - "req_id": "V4.2.1", - "req_description": "Tüm uygulama bileşenlerinin (yük dengeleyiciler, güvenlik duvarları ve uygulama sunucuları dahil) HTTP sürümüne uygun mekanizmaları kullanarak gelen HTTP iletilerinin sınırlarını belirlediği ve bu sayede HTTP istek kaçakçılığına karşı koruma sağlandığı doğrulanmalıdır. HTTP/1.x sürümünde Transfer-Encoding başlık alanı varsa, RFC 2616'ya göre Content-Length başlığı göz ardı edilmelidir. HTTP/2 veya HTTP/3 kullanıldığında, Content-Length başlığı varsa, alıcının bu değerin DATA çerçevelerinin uzunluğuyla tutarlı olduğunu doğrulaması gerekir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API ve Web Servisi", - "section_id": "V4.2", - "section_name": "HTTP İleti Yapısı Doğrulama", - "req_id": "V4.2.2", - "req_description": "HTTP iletileri üretilirken, Content-Length başlığının, HTTP protokolünün çerçeveleme yöntemine göre belirlenen içerik uzunluğu ile çelişmediği doğrulanmalıdır. Bu, istek kaçakçılığı saldırılarını önlemek için gereklidir.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API ve Web Servisi", - "section_id": "V4.2", - "section_name": "HTTP İleti Yapısı Doğrulama", - "req_id": "V4.2.3", - "req_description": "Uygulamanın, yanıt bölme ve header enjeksiyonu saldırılarını önlemek amacıyla, bağlantıya özel başlık alanları (örneğin Transfer-Encoding) içeren HTTP/2 veya HTTP/3 iletilerini göndermediği ve kabul etmediği doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API ve Web Servisi", - "section_id": "V4.2", - "section_name": "HTTP İleti Yapısı Doğrulama", - "req_id": "V4.2.4", - "req_description": "Uygulamanın yalnızca başlık alanları ve değerleri CR (\\r), LF (\\n) veya CRLF (\\r\\n) karakter dizileri içermeyen HTTP/2 ve HTTP/3 isteklerini kabul ettiği doğrulanmalıdır. Bu, başlık enjeksiyonu saldırılarını önlemek içindir.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API ve Web Servisi", - "section_id": "V4.2", - "section_name": "HTTP İleti Yapısı Doğrulama", - "req_id": "V4.2.5", - "req_description": "Uygulama (backend veya frontend) istek oluşturuyor ve gönderiyorsa, URI'ler (örneğin API çağrıları için) veya HTTP istek başlıkları (örneğin Authorization veya Cookie) gibi bileşenlerin, alıcı sistemler tarafından kabul edilemeyecek kadar uzun olmamasını sağlamak amacıyla doğrulama, temizleme veya diğer mekanizmaları kullandığı doğrulanmalıdır. Bu tür çok uzun istekler (örneğin çok uzun bir Cookie başlığı) gönderildiğinde sunucunun sürekli hata durumu döndürmesiyle hizmet reddi oluşabilir.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API ve Web Servisi", - "section_id": "V4.3", - "section_name": "GraphQL", - "req_id": "V4.3.1", - "req_description": "Maliyetli ve iç içe geçmiş sorgular sonucu oluşabilecek GraphQL veya veri katmanı ifadelerine yönelik Hizmet Reddi (DoS) saldırılarını önlemek için, sorgu izin listesi (allowlist), derinlik sınırlandırması, sorgu sayısı sınırlandırması veya sorgu maliyeti analizi kullanıldığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API ve Web Servisi", - "section_id": "V4.3", - "section_name": "GraphQL", - "req_id": "V4.3.2", - "req_description": "GraphQL introspection (iç yapı sorgulama) sorgularının, GraphQL API'nin üçüncü taraflar tarafından kullanılmasına yönelik olmadığı sürece, üretim ortamında devre dışı bırakıldığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API ve Web Servisi", - "section_id": "V4.4", - "section_name": "WebSocket", - "req_id": "V4.4.1", - "req_description": "Tüm WebSocket bağlantılarında TLS üzerinden WebSocket (WSS) kullanıldığı doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API ve Web Servisi", - "section_id": "V4.4", - "section_name": "WebSocket", - "req_id": "V4.4.2", - "req_description": "WebSocket'in başlangıçtaki HTTP el sıkışması (handshake) sırasında, Origin başlık alanının uygulama için izin verilen origin listesiyle karşılaştırılarak kontrol edildiği doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API ve Web Servisi", - "section_id": "V4.4", - "section_name": "WebSocket", - "req_id": "V4.4.3", - "req_description": "Uygulamanın standart oturum yönetimi kullanılamıyorsa, bunun yerine ilgili Oturum Yönetimi güvenlik gereksinimlerine uygun özel token'ların kullanıldığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V4", - "chapter_name": "API ve Web Servisi", - "section_id": "V4.4", - "section_name": "WebSocket", - "req_id": "V4.4.4", - "req_description": "HTTPS oturumu WebSocket kanalına geçerken, özel WebSocket oturum yönetim token’larının önceki şekilde kimliği doğrulanmış HTTPS oturumu aracılığıyla elde edildiği veya doğrulandığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Dosya İşleme", - "section_id": "V5.1", - "section_name": "Dosya İşleme Dokümantasyonu", - "req_id": "V5.1.1", - "req_description": "Dokümantasyonun, her yükleme özelliği için izin verilen dosya türlerini, beklenen dosya uzantılarını ve maksimum boyutu (açılmış hali dahil) tanımladığı doğrulanmalıdır. Ayrıca, dosyaların son kullanıcılar için nasıl güvenli hâle getirileceği (örneğin kötü amaçlı bir dosya tespit edildiğinde uygulamanın nasıl davranacağı) gibi bilgilerin de belgede yer aldığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Dosya İşleme", - "section_id": "V5.2", - "section_name": "Dosya Yükleme ve İçerik", - "req_id": "V5.2.1", - "req_description": "Uygulamanın, yalnızca performans kaybına veya hizmet reddine yol açmayacak boyuttaki dosyaları kabul ettiği doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Dosya İşleme", - "section_id": "V5.2", - "section_name": "Dosya Yükleme ve İçerik", - "req_id": "V5.2.2", - "req_description": "Uygulama bir dosyayı, doğrudan veya bir arşiv (ör. zip dosyası) içinde kabul ettiğinde, dosya uzantısının beklenen uzantıyla eşleşip eşleşmediğini kontrol ettiği ve içeriğin uzantı tarafından temsil edilen türle uyumlu olduğunu doğruladığı kontrol edilmelidir. Bu; ilk 'magic byte' kontrolü, görüntü yeniden yazımı ve dosya içeriği doğrulama için özel kütüphanelerin kullanımı gibi yöntemleri içerir. Seviye 1 için bu, yalnızca iş veya güvenlik kararlarında kullanılan dosyalarla sınırlı olabilir. Seviye 2 ve üzeri için tüm dosyalar bu kontrole tabi olmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Dosya İşleme", - "section_id": "V5.2", - "section_name": "Dosya Yükleme ve İçerik", - "req_id": "V5.2.3", - "req_description": "Sıkıştırılmış dosyaların (ör. zip, gz, docx, odt) açılmadan önce, izin verilen maksimum açılmış boyuta ve maksimum dosya sayısına göre kontrol edildiği doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Dosya İşleme", - "section_id": "V5.2", - "section_name": "Dosya Yükleme ve İçerik", - "req_id": "V5.2.4", - "req_description": "Her kullanıcı için dosya boyutu kotası ve maksimum dosya sayısının uygulandığı doğrulanmalıdır. Böylece tek bir kullanıcının çok sayıda veya aşırı büyük dosya yükleyerek depolama alanını doldurması engellenir.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Dosya İşleme", - "section_id": "V5.2", - "section_name": "Dosya Yükleme ve İçerik", - "req_id": "V5.2.5", - "req_description": "Uygulamanın, içinde sembolik bağlantılar (symlink) bulunan sıkıştırılmış dosyaların yüklenmesine yalnızca bu durum özel olarak gerekli olduğunda izin verdiği doğrulanmalıdır. Bu durumda, sembolik bağlantı verilebilecek dosyaların bir izinli listesi uygulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Dosya İşleme", - "section_id": "V5.2", - "section_name": "Dosya Yükleme ve İçerik", - "req_id": "V5.2.6", - "req_description": "Uygulamanın, piksel boyutu izin verilen maksimum değeri aşan görüntü dosyalarının yüklenmesini reddettiği doğrulanmalıdır. Bu, pixel flood saldırılarını önlemek için gereklidir.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Dosya İşleme", - "section_id": "V5.3", - "section_name": "Dosya Depolama", - "req_id": "V5.3.1", - "req_description": "Güvenilmeyen girdilerle yüklenen veya oluşturulan ve herkese açık klasörlerde depolanan dosyaların, bir HTTP isteğiyle doğrudan erişildiğinde sunucu taraflı program kodu olarak çalıştırılmadığı doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Dosya İşleme", - "section_id": "V5.3", - "section_name": "Dosya Depolama", - "req_id": "V5.3.2", - "req_description": "Uygulamanın, dosya işlemleri için dosya yollarını oluştururken kullanıcı tarafından gönderilen dosya adlarını değil, dahili olarak oluşturulan veya güvenilir verileri kullandığı; eğer kullanıcı tarafından gönderilen dosya adları veya meta veriler kullanılacaksa, sıkı doğrulama ve temizleme işlemlerinin uygulandığı doğrulanmalıdır. Bu, yol geçişi (path traversal), yerel veya uzak dosya dahil etme (LFI, RFI) ve sunucu tarafı istek sahteciliği (SSRF) saldırılarına karşı koruma sağlar.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Dosya İşleme", - "section_id": "V5.3", - "section_name": "Dosya Depolama", - "req_id": "V5.3.3", - "req_description": "Sunucu tarafında gerçekleşen dosya işlemlerinin (örneğin dosya açma/decompress işlemi), kullanıcı tarafından sağlanan yol bilgilerini yok saydığı ve zip slip gibi güvenlik açıklarını önlediği doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Dosya İşleme", - "section_id": "V5.4", - "section_name": "Dosya İndirme", - "req_id": "V5.4.1", - "req_description": "Uygulamanın, kullanıcı tarafından gönderilen dosya adlarını (ör. JSON, JSONP veya URL parametresinde) doğruladığı veya göz ardı ettiği ve yanıtın Content-Disposition başlık alanında bir dosya adı belirttiği doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Dosya İşleme", - "section_id": "V5.4", - "section_name": "Dosya İndirme", - "req_id": "V5.4.2", - "req_description": "Sunulan dosya adlarının (örneğin HTTP yanıt header'larında veya e-posta eklerinde), belge yapısını korumak ve enjeksiyon saldırılarını önlemek için kodlandığı veya temizlendiği (ör. RFC 6266’ya uygun) doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V5", - "chapter_name": "Dosya İşleme", - "section_id": "V5.4", - "section_name": "Dosya İndirme", - "req_id": "V5.4.3", - "req_description": "Güvenilmeyen kaynaklardan elde edilen dosyaların, bilinen kötü amaçlı içeriklerin sunulmasını önlemek amacıyla antivirüs tarayıcılarıyla tarandığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.1", - "section_name": "Kimlik Doğrulama Dokümantasyonu", - "req_id": "V6.1.1", - "req_description": "Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırılarına karşı oran sınırlama (rate limiting), otomasyon karşıtı önlemler ve uyarlanabilir yanıt gibi kontrollerin nasıl kullanıldığını açıklayan bir uygulama dokümantasyonu bulunduğu doğrulanmalıdır. Dokümantasyon, bu kontrollerin nasıl yapılandırıldığını ve kötü niyetli hesap kilitlemenin nasıl önlendiğini açıkça ortaya koymalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.1", - "section_name": "Kimlik Doğrulama Dokümantasyonu", - "req_id": "V6.1.2", - "req_description": "Parolalarda kullanılmasını önlemek amacıyla, bağlama özgü sözcüklerin (örneğin kurum adlarının permütasyonları, ürün adları, sistem tanımlayıcıları, proje kod adları, departman veya rol adları vb.) bulunduğu belgelenmiş bir liste mevcut olduğu doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.1", - "section_name": "Kimlik Doğrulama Dokümantasyonu", - "req_id": "V6.1.3", - "req_description": "Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, bunların tümünün belgelenmiş olduğu ve her yol için tutarlı şekilde uygulanması gereken güvenlik kontrolleri ile kimlik doğrulama gücünün tanımlandığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.2", - "section_name": "Parola Güvenliği", - "req_id": "V6.2.1", - "req_description": "Kullanıcı tarafından belirlenen parolaların en az 8 karakter uzunluğunda olması sağlanmalı, ancak 15 karakter ve üzeri uzunlukta parolalar olmaları şiddetle tavsiye edilir.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.2", - "section_name": "Parola Güvenliği", - "req_id": "V6.2.2", - "req_description": "Kullanıcıların parolalarını değiştirebilmeleri sağlanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.2", - "section_name": "Parola Güvenliği", - "req_id": "V6.2.3", - "req_description": "Parola değiştirme işlevinin hem mevcut hem de yeni parolayı gerektirdiği doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.2", - "section_name": "Parola Güvenliği", - "req_id": "V6.2.4", - "req_description": "Kayıt veya parola değişimi sırasında girilen parolaların, uygulamanın parola politikasına (örneğin minimum uzunluk) uyan ilk 3000 yaygın parolaya karşı kontrol edildiği doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.2", - "section_name": "Parola Güvenliği", - "req_id": "V6.2.5", - "req_description": "Her tür karakterin kullanılmasına izin verildiği ve büyük/küçük harf, sayı veya özel karakter şartlarının zorunlu tutulmadığı doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.2", - "section_name": "Parola Güvenliği", - "req_id": "V6.2.6", - "req_description": "Parola giriş alanlarının, girdiyi maskelemek için \"type=password\" kullandığı doğrulanmalıdır. Uygulamalar, kullanıcının tüm maskelenmiş parolayı ya da son girilen karakteri geçici olarak görüntülemesine izin verebilir.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.2", - "section_name": "Parola Güvenliği", - "req_id": "V6.2.7", - "req_description": "\"Yapıştır\" özelliğinin, tarayıcı parola yardımcılarının ve harici parola yöneticilerinin kullanımına izin verildiği doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.2", - "section_name": "Parola Güvenliği", - "req_id": "V6.2.8", - "req_description": "Uygulamanın, kullanıcıdan aldığı parolayı herhangi bir şekilde değiştirmeden, örneğin kesmeden veya harf büyüklüğünü değiştirmeden, tam olarak doğruladığı teyit edilmelidir.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.2", - "section_name": "Parola Güvenliği", - "req_id": "V6.2.9", - "req_description": "En az 64 karakter uzunluğundaki parolalara izin verildiği doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.2", - "section_name": "Parola Güvenliği", - "req_id": "V6.2.10", - "req_description": "Kullanıcının parolasının, yalnızca ele geçirildiği tespit edildiğinde veya kullanıcı tarafından yenilendiğinde geçerliliğini yitirdiği doğrulanmalıdır. Uygulama, belirli aralıklarla parola yenilenmesini zorunlu kılmamalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.2", - "section_name": "Parola Güvenliği", - "req_id": "V6.2.11", - "req_description": "Tahmin edilmesi kolay parolaların oluşturulmasını önlemek amacıyla, bağlama özgü kelimelerin yer aldığı belgelenmiş listenin parola doğrulamada kullanıldığı teyit edilmelidir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.2", - "section_name": "Parola Güvenliği", - "req_id": "V6.2.12", - "req_description": "Kayıt veya parola değişikliği sırasında girilen parolaların, ele geçirilmiş parolalar listesine karşı kontrol edildiği doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.3", - "section_name": "Genel Kimlik Doğrulama Güvenliği", - "req_id": "V6.3.1", - "req_description": "Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırıları gibi saldırıları önlemeye yönelik kontrollerin, uygulamanın güvenlik dokümantasyonuna göre uygulandığı doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.3", - "section_name": "Genel Kimlik Doğrulama Güvenliği", - "req_id": "V6.3.2", - "req_description": "\"root\", \"admin\" veya \"sa\" gibi varsayılan kullanıcı hesaplarının uygulamada yer almadığı veya devre dışı bırakıldığı doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.3", - "section_name": "Genel Kimlik Doğrulama Güvenliği", - "req_id": "V6.3.3", - "req_description": "Uygulamaya erişim için ya çok faktörlü bir kimlik doğrulama mekanizması ya da tek faktörlü mekanizmaların kombinasyonu kullanılmalıdır. Seviye 3 için, bu faktörlerden biri, oltalama saldırılarına karşı direnç sağlayan ve kimlik doğrulama niyetini bir kullanıcı etkileşimi (örneğin FIDO donanım anahtarında bir düğmeye basma veya mobil telefonda bir onay) gerektirerek doğrulayan donanım tabanlı bir kimlik doğrulayıcı olmalıdır. Bu gereksinimdeki herhangi bir esneklik için, gerekçesi belgelenmiş ve riskleri azaltıcı kapsamlı kontroller içeren bir plan gereklidir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.3", - "section_name": "Genel Kimlik Doğrulama Güvenliği", - "req_id": "V6.3.4", - "req_description": "Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, belgelendirilmemiş bir yol bulunmadığı ve tüm yollar için güvenlik kontrolleri ile kimlik doğrulama gücünün tutarlı şekilde uygulandığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.3", - "section_name": "Genel Kimlik Doğrulama Güvenliği", - "req_id": "V6.3.5", - "req_description": "Başarılı veya başarısız şüpheli kimlik doğrulama girişimlerinin kullanıcıya bildirildiği doğrulanmalıdır. Bu, olağandışı bir konum veya istemciden gelen girişimler, yalnızca bir faktörle yapılan kısmen başarılı doğrulamalar, uzun süreli inaktiflik sonrası yapılan girişimler veya birçok başarısız denemeden sonraki başarılı girişimler gibi durumları içerebilir.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.3", - "section_name": "Genel Kimlik Doğrulama Güvenliği", - "req_id": "V6.3.6", - "req_description": "E-postanın, tek faktörlü ya da çok faktörlü kimlik doğrulama mekanizması olarak kullanılmadığı doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.3", - "section_name": "Genel Kimlik Doğrulama Güvenliği", - "req_id": "V6.3.7", - "req_description": "Kimlik doğrulama detaylarında yapılan güncellemeler sonrasında (örneğin kimlik bilgisi sıfırlama, kullanıcı adı veya e-posta adresi değişiklikleri), kullanıcıların bilgilendirildiği doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.3", - "section_name": "Genel Kimlik Doğrulama Güvenliği", - "req_id": "V6.3.8", - "req_description": "Başarısız kimlik doğrulama girişimlerinden, geçerli kullanıcıların hata mesajları, HTTP yanıt kodları veya farklı yanıt süreleri gibi sonuçlara dayanarak tespit edilemediği doğrulanmalıdır. Bu koruma, kayıt ve \"parolamı unuttum\" işlevselliğinde de geçerli olmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.4", - "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", - "req_id": "V6.4.1", - "req_description": "Sistem tarafından oluşturulan ilk parolaların veya etkinleştirme kodlarının güvenli bir şekilde rastgele üretildiği, mevcut parola politikasına uygun olduğu, kısa bir süre içinde veya ilk kullanım sonrasında geçerliliğini yitirdiği doğrulanmalıdır. Bu başlangıç sırları uzun vadeli parola olarak kullanılmasına izin verilmemelidir.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.4", - "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", - "req_id": "V6.4.2", - "req_description": "Parola ipuçlarının veya \"gizli sorular\" olarak bilinen, bilgiye dayalı kimlik doğrulama mekanizmalarının mevcut olmadığı doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.4", - "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", - "req_id": "V6.4.3", - "req_description": "Unutulmuş parolanın sıfırlanması için, etkin olan çok faktörlü kimlik doğrulama mekanizmalarını atlamayan güvenli bir sürecin uygulandığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.4", - "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", - "req_id": "V6.4.4", - "req_description": "Çok faktörlü kimlik doğrulama faktörlerinden biri kaybolursa, kayıt sırasında uygulanan kimlik kanıtlama seviyesiyle aynı seviyede kimlik doğrulama yapıldığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.4", - "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", - "req_id": "V6.4.5", - "req_description": "Süresi dolacak kimlik doğrulama mekanizmalarının yenilenmesine ilişkin talimatların, süresi dolmadan önce tamamlanacak şekilde yeterli sürede gönderildiği ve gerekiyorsa otomatik hatırlatıcıların yapılandırıldığı doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.4", - "section_name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", - "req_id": "V6.4.6", - "req_description": "Yönetici yetkisi olan kullanıcıların, kullanıcının parola sıfırlama sürecini başlatabildiği ancak kullanıcının yeni parolasını belirleyemediği veya değiştiremediği doğrulanmalıdır. Bu, yönetici yetkisi olan kullanıcıların, kullanıcı parolasını bilmesini engeller.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.5", - "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", - "req_id": "V6.5.1", - "req_description": "Arama sırları, bant dışı kimlik doğrulama istekleri veya kodları ve zamana dayalı tek kullanımlık parolaların (TOTP) yalnızca bir kez kullanılabildiği doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.5", - "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", - "req_id": "V6.5.2", - "req_description": "Uygulamanın backend tarafında saklanırken, 112 bitten az entropiye sahip (örneğin 19 rastgele harf-rakam karakteri veya 34 rastgele rakam) arama sırlarının, 32-bit rastgele bir salt içeren onaylı bir parola saklama algoritmasıyla hash’lendiği doğrulanmalıdır. Gizli bilginin entropisi 112 bit veya daha fazlaysa standart bir hash fonksiyonu kullanılabilir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.5", - "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", - "req_id": "V6.5.3", - "req_description": "Arama sırları, bant dışı kimlik doğrulama kodları ve zamana dayalı tek kullanımlık parola seed'lerinin, öngörülebilir değerlerden kaçınmak için Kriptografik Olarak Güvenli Sözde Rastgele Sayı Üreteci (CSPRNG) ile oluşturulduğu doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.5", - "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", - "req_id": "V6.5.4", - "req_description": "Arama sırlarının ve bant dışı kimlik doğrulama kodlarının en az 20 bit entropiye (genellikle 4 rastgele harf-rakam karakteri veya 6 rastgele rakam) sahip olduğu doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.5", - "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", - "req_id": "V6.5.5", - "req_description": "Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının ve zamana dayalı tek kullanımlık parolaların (TOTP) belirli bir ömre sahip olduğu doğrulanmalıdır. Bant dışı istekler en fazla 10 dakika, TOTP’ler ise en fazla 30 saniye geçerli olmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.5", - "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", - "req_id": "V6.5.6", - "req_description": "Herhangi bir kimlik doğrulama faktörünün (fiziksel cihazlar dahil) çalınması veya kaybı durumunda iptal edilebildiği doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.5", - "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", - "req_id": "V6.5.7", - "req_description": "Biyometrik kimlik doğrulama mekanizmalarının yalnızca ikincil faktör olarak, “sahip olduğunuz bir şey” veya “bildiğiniz bir şey” ile birlikte kullanıldığı doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.5", - "section_name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", - "req_id": "V6.5.8", - "req_description": "Zamana dayalı tek kullanımlık parolaların (TOTP) doğrulamasının, güvenilir bir hizmetten alınan zaman kaynağına dayanarak yapıldığı ve güvenilir olmayan veya istemci tarafından sağlanan zaman kaynağına dayanmadığı doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.6", - "section_name": "Bant Dışı Kimlik Doğrulama Mekanizmaları", - "req_id": "V6.6.1", - "req_description": "Tek kullanımlık parolaların (OTP) telefon veya SMS ile Public Switched Telephone Network (PSTN) üzerinden iletildiği kimlik doğrulama mekanizmalarının, yalnızca telefon numarası önceden doğrulanmışsa, alternatif daha güçlü yöntemler (örneğin TOTP) de sunuluyorsa ve kullanıcıya güvenlik riskleri hakkında bilgi veriliyorsa sunulduğu doğrulanmalıdır. Seviye 3 uygulamalar için telefon ve SMS seçenekleri sunulmamalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.6", - "section_name": "Bant Dışı Kimlik Doğrulama Mekanizmaları", - "req_id": "V6.6.2", - "req_description": "Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının, oluşturuldukları özgün kimlik doğrulama isteğiyle bağlantılı olduğu ve daha önceki ya da sonraki bir istek için kullanılamadığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.6", - "section_name": "Bant Dışı Kimlik Doğrulama Mekanizmaları", - "req_id": "V6.6.3", - "req_description": "Kod tabanlı bant dışı kimlik doğrulama mekanizmalarının, oran sınırlaması ile kaba kuvvet saldırılarına karşı korunduğu doğrulanmalıdır. En az 64 bit entropiye sahip kodlar kullanılması da değerlendirilmelidir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.6", - "section_name": "Bant Dışı Kimlik Doğrulama Mekanizmaları", - "req_id": "V6.6.4", - "req_description": "Çok faktörlü kimlik doğrulama için push bildirimleri kullanılıyorsa, push bombing saldırılarına karşı oran sınırlamasının kullanıldığı doğrulanmalıdır. “Numara eşleştirme” de bu riski azaltabilir.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.7", - "section_name": "Kriptografik Kimlik Doğrulama Mekanizması", - "req_id": "V6.7.1", - "req_description": "Kriptografik kimlik doğrulama beyanlarını doğrulamak için kullanılan sertifikaların, değiştirilmeye karşı korumalı şekilde saklandığı doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.7", - "section_name": "Kriptografik Kimlik Doğrulama Mekanizması", - "req_id": "V6.7.2", - "req_description": "Challenge nonce değerinin en az 64 bit uzunluğunda olduğu ve istatistiksel olarak benzersiz ya da cihazın ömrü boyunca benzersiz olduğu doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.8", - "section_name": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", - "req_id": "V6.8.1", - "req_description": "Uygulama birden fazla kimlik sağlayıcıyı (IdP) destekliyorsa, başka bir desteklenen kimlik sağlayıcı aracılığıyla (örneğin aynı kullanıcı tanımlayıcısını kullanarak) kullanıcının kimliğinin taklit edilemediği doğrulanmalıdır. Standart önlem, uygulamanın kullanıcıyı IdP kimliği (bir ad alanı işlevi görür) ve IdP içindeki kullanıcı kimliğinin birleşimiyle kaydetmesi ve tanımlamasıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.8", - "section_name": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", - "req_id": "V6.8.2", - "req_description": "Kimlik doğrulama beyanları üzerindeki dijital imzaların (örneğin JWT veya SAML beyanları) varlığı ve bütünlüğünün her zaman doğrulandığı ve imzasız veya geçersiz imzalı beyanların reddedildiği doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.8", - "section_name": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", - "req_id": "V6.8.3", - "req_description": "SAML beyanlarının benzersiz biçimde işlendiği ve yalnızca geçerlilik süresi içinde bir kez kullanıldığı, tekrar oynatma (replay) saldırılarını önlemek amacıyla doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V6", - "chapter_name": "Kimlik Doğrulama", - "section_id": "V6.8", - "section_name": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", - "req_id": "V6.8.4", - "req_description": "Uygulama ayrı bir Kimlik Sağlayıcı (IdP) kullanıyorsa ve belirli işlemler için belirli kimlik doğrulama gücü, yöntemleri veya zaman bilgisi bekliyorsa, uygulamanın bu bilgileri IdP tarafından döndürülen veriler üzerinden doğruladığı teyit edilmelidir. Örneğin OIDC kullanılıyorsa, bu durum ID Token üzerindeki 'acr', 'amr' ve 'auth_time' gibi claim’lerin (varsa) doğrulanması ile sağlanabilir. Eğer IdP bu bilgileri sağlamıyorsa, uygulamanın asgari kimlik doğrulama gücünün kullanıldığını varsayan (örneğin yalnızca kullanıcı adı ve parola ile tek faktörlü doğrulama) belgelenmiş bir yedek yaklaşımı olmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.1", - "section_name": "Oturum Yönetim Dokümantasyonu", - "req_id": "V7.1.1", - "req_description": "Kullanıcının oturum inaktivite zaman aşımı süresi ve mutlak maksimum oturum süresinin belgelendiği, diğer kontrollerle birlikte uygun olduğu ve NIST SP 800-63B yeniden kimlik doğrulama gereksinimlerinden herhangi bir sapma varsa gerekçesinin belgede yer aldığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.1", - "section_name": "Oturum Yönetim Dokümantasyonu", - "req_id": "V7.1.2", - "req_description": "Belgede bir hesap için kaç adet eşzamanlı (paralel) oturuma izin verildiği ile birlikte, maksimum aktif oturum sayısına ulaşıldığında uygulanacak davranış ve işlemlerin tanımlandığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.1", - "section_name": "Oturum Yönetim Dokümantasyonu", - "req_id": "V7.1.3", - "req_description": "Birleşik kimlik yönetim ekosisteminin bir parçası olarak kullanıcı oturumu oluşturan ve yöneten tüm sistemlerin, oturum ömrü, sonlandırma ve yeniden kimlik doğrulama gerektiren diğer koşulların nasıl koordine edildiğini açıklayan kontrollerle birlikte belgede yer aldığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.2", - "section_name": "Temel Oturum Yönetimi Güvenliği", - "req_id": "V7.2.1", - "req_description": "Uygulamanın tüm oturum token'ı doğrulama işlemlerini güvenilir bir backend servisi aracılığıyla gerçekleştirdiği doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.2", - "section_name": "Temel Oturum Yönetimi Güvenliği", - "req_id": "V7.2.2", - "req_description": "Uygulamanın, statik API gizli anahtarları veya sabit değerler yerine, oturum yönetimi için dinamik olarak oluşturulan kendi kendine yeterli veya referans token'ları kullandığı doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.2", - "section_name": "Temel Oturum Yönetimi Güvenliği", - "req_id": "V7.2.3", - "req_description": "Uygulama kullanıcı oturumlarını temsil etmek için referans token'ları kullanıyorsa, bu token'ların benzersiz olduğu, kriptografik olarak güvenli bir sözde rastgele sayı üreteci (CSPRNG) kullanılarak üretildiği ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.2", - "section_name": "Temel Oturum Yönetimi Güvenliği", - "req_id": "V7.2.4", - "req_description": "Uygulamanın, kullanıcı kimlik doğrulaması (yeniden kimlik doğrulama dahil) sırasında yeni bir oturum token'ı oluşturduğu ve mevcut oturum token'ını sonlandırdığı doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.3", - "section_name": "Oturum Zaman Aşımı", - "req_id": "V7.3.1", - "req_description": "Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde bir hareketsizlik zaman aşımı bulunduğu doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.3", - "section_name": "Oturum Zaman Aşımı", - "req_id": "V7.3.2", - "req_description": "Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde mutlak bir maksimum oturum süresi bulunduğu doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.4", - "section_name": "Oturum Sonlandırma", - "req_id": "V7.4.1", - "req_description": "Oturum sonlandırma tetiklendiğinde (örneğin, çıkış yapıldığında veya süre dolduğunda), uygulamanın oturumun daha fazla kullanılmasına izin vermediği doğrulanmalıdır. Referans token'lar veya durum bilgili oturumlar için bu, oturum verilerinin uygulama arka ucunda geçersiz kılınması anlamına gelir. Kapsamlı token kullanan uygulamaların; sonlandırılmış token listesi tutmak, kullanıcıya özel tarih ve saatten önce oluşturulan token'ları reddetmek veya kullanıcıya özel imzalama anahtarını yenilemek gibi bir çözüm uygulaması gerekir.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.4", - "section_name": "Oturum Sonlandırma", - "req_id": "V7.4.2", - "req_description": "Bir kullanıcı hesabı devre dışı bırakıldığında veya silindiğinde (örneğin bir çalışanın şirketten ayrılması), uygulamanın tüm aktif oturumları sonlandırdığı doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.4", - "section_name": "Oturum Sonlandırma", - "req_id": "V7.4.3", - "req_description": "Herhangi bir kimlik doğrulama faktörünün başarılı bir şekilde değiştirilmesi veya kaldırılmasından (şifre sıfırlama veya kurtarma yoluyla yapılan değişiklikler dahil ve varsa MFA ayarları güncellemeleri dahil) sonra, uygulamanın diğer tüm aktif oturumları sonlandırma seçeneği sunduğu doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.4", - "section_name": "Oturum Sonlandırma", - "req_id": "V7.4.4", - "req_description": "Kimlik doğrulama gerektiren tüm sayfalarda kolay erişilebilir ve görünür bir çıkış yap (logout) işlevi bulunduğu doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.4", - "section_name": "Oturum Sonlandırma", - "req_id": "V7.4.5", - "req_description": "Uygulama yöneticilerinin, bireysel bir kullanıcının veya tüm kullanıcıların aktif oturumlarını sonlandırabilme yetkisine sahip olduğu doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.5", - "section_name": "Oturum Kötüye Kullanımına Karşı Savunmalar", - "req_id": "V7.5.1", - "req_description": "E-posta adresi, telefon numarası, MFA yapılandırması veya hesap kurtarmada kullanılan diğer bilgiler gibi kimlik doğrulamayı etkileyebilecek hassas hesap özniteliklerinde değişiklik yapılmadan önce uygulamanın tam yeniden kimlik doğrulama gerektirdiği doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.5", - "section_name": "Oturum Kötüye Kullanımına Karşı Savunmalar", - "req_id": "V7.5.2", - "req_description": "Kullanıcıların, (en az bir faktörle yeniden kimlik doğrulama yaptıktan sonra) mevcut tüm aktif oturumları görüntüleyebilmesi ve sonlandırabilmesinin mümkün olduğu doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.5", - "section_name": "Oturum Kötüye Kullanımına Karşı Savunmalar", - "req_id": "V7.5.3", - "req_description": "Uygulamanın, son derece hassas işlemler veya operasyonlar gerçekleştirilmeden önce en az bir faktörle ek kimlik doğrulaması veya ikincil bir doğrulama gerektirdiği doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.6", - "section_name": "Birleşik Yeniden Kimlik Doğrulama", - "req_id": "V7.6.1", - "req_description": "Güvenen Taraf (RP) ile Kimlik Sağlayıcı (IdP) arasındaki oturum süresi ve oturum sonlandırma davranışlarının belgelenmiş olduğu ve, örneğin IdP kimlik doğrulama olayları arasında maksimum süreye ulaşıldığında yeniden kimlik doğrulamanın gerekli kılındığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V7", - "chapter_name": "Oturum Yönetimi", - "section_id": "V7.6", - "section_name": "Birleşik Yeniden Kimlik Doğrulama", - "req_id": "V7.6.2", - "req_description": "Yeni bir oturum oluşturulmasının, kullanıcı onayı veya açık bir eylem gerektirdiği; kullanıcı etkileşimi olmaksızın yeni uygulama oturumlarının oluşturulmasının önlendiği doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Yetkilendirme", - "section_id": "V8.1", - "section_name": "Yetkilendirme Dokümantasyonu", - "req_id": "V8.1.1", - "req_description": "Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak işlev düzeyinde ve veriye özel erişim kısıtlamaları için kuralları tanımladığı doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Yetkilendirme", - "section_id": "V8.1", - "section_name": "Yetkilendirme Dokümantasyonu", - "req_id": "V8.1.2", - "req_description": "Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak alan (field) düzeyinde erişim kısıtlamaları (hem okuma hem yazma) için kuralları tanımladığı doğrulanmalıdır. Bu kuralların, ilgili veri nesnesinin durum veya statü gibi diğer özniteliklerine bağlı olabileceği unutulmamalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Yetkilendirme", - "section_id": "V8.1", - "section_name": "Yetkilendirme Dokümantasyonu", - "req_id": "V8.1.3", - "req_description": "Uygulamanın dokümantasyonunun, kimlik doğrulama ve yetkilendirme ile ilgili güvenlik kararlarının alınmasında kullanılan çevresel ve bağlamsal öznitelikleri (günün saati, kullanıcı konumu, IP adresi veya cihaz gibi) tanımladığı doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Yetkilendirme", - "section_id": "V8.1", - "section_name": "Yetkilendirme Dokümantasyonu", - "req_id": "V8.1.4", - "req_description": "Kimlik doğrulama ve yetkilendirme dokümantasyonunun; işlev düzeyinde, veriye özel ve alan düzeyinde yetkilendirmenin yanı sıra çevresel ve bağlamsal faktörlerin karar almada nasıl kullanıldığını tanımladığı doğrulanmalıdır. Bu, değerlendirilen öznitelikleri, risk eşiklerini ve alınan aksiyonları (ör. izin ver, doğrulama iste, reddet, step-up kimlik doğrulama) içermelidir.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Yetkilendirme", - "section_id": "V8.2", - "section_name": "Genel Yetkilendirme Tasarımı", - "req_id": "V8.2.1", - "req_description": "Uygulamanın, işlev düzeyindeki erişimin yalnızca açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Yetkilendirme", - "section_id": "V8.2", - "section_name": "Genel Yetkilendirme Tasarımı", - "req_id": "V8.2.2", - "req_description": "Uygulamanın, veriye özel erişimin yalnızca belirli veri öğelerine açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, doğrudan nesne referansı güvenlik açıkları (IDOR) ve bozuk nesne düzeyinde yetkilendirme (BOLA) risklerini azaltır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Yetkilendirme", - "section_id": "V8.2", - "section_name": "Genel Yetkilendirme Tasarımı", - "req_id": "V8.2.3", - "req_description": "Uygulamanın, alan (field) düzeyindeki erişimin yalnızca belirli alanlara açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, bozuk nesne özelliği düzeyinde yetkilendirme (BOPLA) risklerini azaltır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Yetkilendirme", - "section_id": "V8.2", - "section_name": "Genel Yetkilendirme Tasarımı", - "req_id": "V8.2.4", - "req_description": "Tüketicinin çevresel ve bağlamsal özniteliklerine (ör. günün saati, konum, IP adresi veya cihaz) dayalı uyarlanabilir güvenlik kontrollerinin, uygulama dokümantasyonunda tanımlandığı şekilde, kimlik doğrulama ve yetkilendirme kararları için uygulandığı doğrulanmalıdır. Bu kontroller, tüketici yeni bir oturum başlatmaya çalışırken ve mevcut bir oturum sırasında uygulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Yetkilendirme", - "section_id": "V8.3", - "section_name": "İşlem Düzeyinde Yetkilendirme", - "req_id": "V8.3.1", - "req_description": "Uygulamanın yetkilendirme kurallarını güvenilir bir servis katmanında uyguladığı ve istemci taraflı JavaScript gibi güvenilmeyen tüketiciler tarafından değiştirilebilecek kontrollerle yetinmediği doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Yetkilendirme", - "section_id": "V8.3", - "section_name": "İşlem Düzeyinde Yetkilendirme", - "req_id": "V8.3.2", - "req_description": "Yetkilendirme kararlarının temelini oluşturan değerlerdeki değişikliklerin hemen uygulandığı doğrulanmalıdır. Değişikliklerin anında uygulanamadığı durumlarda (örneğin self-contained token içindeki verilere güveniliyorsa), tüketici artık yetkili olmadığı hâlde bir işlem gerçekleştirdiğinde uyarı verecek ve değişikliği geri alacak önlemler uygulanmalıdır. Bu alternatifin bilgi sızıntısını önlemeyeceği unutulmamalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Yetkilendirme", - "section_id": "V8.3", - "section_name": "İşlem Düzeyinde Yetkilendirme", - "req_id": "V8.3.3", - "req_description": "Bir nesneye erişimin, herhangi bir aracı veya onun adına hareket eden bir servis yerine yalnızca erişimi başlatan öznenin (ör. tüketici) izinlerine dayandığı doğrulanmalıdır. Örneğin, bir tüketici kimlik doğrulama için bir self-contained token kullanarak bir web servis çağırırsa ve bu servis başka bir servisten veri talep ederse, ikinci servis izin kararlarını verirken birinci servisin makine-makine token'ı yerine tüketicinin token'ını kullanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Yetkilendirme", - "section_id": "V8.4", - "section_name": "Diğer Yetkilendirme Hususları", - "req_id": "V8.4.1", - "req_description": "Multi-tenant uygulamaların, tüketici işlemlerinin izinli olmadıkları tenant'lar üzerinde asla etkili olmamasını sağlamak için tenant'lar arası kontroller kullandığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V8", - "chapter_name": "Yetkilendirme", - "section_id": "V8.4", - "section_name": "Diğer Yetkilendirme Hususları", - "req_id": "V8.4.2", - "req_description": "Yönetici arayüzlerine erişimin, sürekli tüketici kimlik doğrulaması, cihaz güvenlik durumu değerlendirmesi ve bağlamsal risk analizi dahil olmak üzere çok katmanlı güvenlik içerdiği doğrulanmalıdır. Yetkilendirme için yalnızca ağ konumu veya güvenilir uç noktalar yeterli olmamalıdır; ancak bu tür faktörler yetkisiz erişim olasılığını azaltabilir.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V9", - "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", - "section_id": "V9.1", - "section_name": "Token Kaynağı ve Bütünlüğü", - "req_id": "V9.1.1", - "req_description": "Self-contained token'ların içerikleri kabul edilmeden önce, oynama (tampering) saldırılarına karşı dijital imza veya MAC ile doğrulama yapıldığı doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V9", - "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", - "section_id": "V9.1", - "section_name": "Token Kaynağı ve Bütünlüğü", - "req_id": "V9.1.2", - "req_description": "Belirli bir bağlam için yalnızca bir allowlist üzerinde bulunan algoritmaların self-contained token oluşturmak ve doğrulamak için kullanılabildiği doğrulanmalıdır. Bu allowlist, yalnızca simetrik ya da yalnızca asimetrik algoritmaları içermeli ve kesinlikle 'None' algoritmasını içermemelidir. Hem simetrik hem de asimetrik algoritmalar desteklenmek zorundaysa, anahtar karışıklığını (key confusion) önlemek için ek kontroller uygulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V9", - "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", - "section_id": "V9.1", - "section_name": "Token Kaynağı ve Bütünlüğü", - "req_id": "V9.1.3", - "req_description": "Self-contained token'ları doğrulamak için kullanılan anahtar malzemesinin, token issuer için önceden yapılandırılmış güvenilir kaynaklardan alındığı doğrulanmalıdır. Bu, saldırganların güvenilmeyen kaynak ve anahtarları belirtmesini engeller. JWT ve diğer JWS yapılarında 'jku', 'x5u' ve 'jwk' gibi header'lar güvenilir kaynaklardan oluşan bir allowlist'e göre doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V9", - "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", - "section_id": "V9.2", - "section_name": "Token İçeriği", - "req_id": "V9.2.1", - "req_description": "Token verisinde bir geçerlilik zaman aralığı (validity time span) varsa, yalnızca doğrulama zamanı bu zaman aralığı içerisindeyse token ve içeriği kabul edilmelidir. Örneğin, JWT'ler için 'nbf' ve 'exp' claim'leri doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V9", - "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", - "section_id": "V9.2", - "section_name": "Token İçeriği", - "req_id": "V9.2.2", - "req_description": "Token'ı alan hizmetin, token içeriğini kabul etmeden önce bu token'ın doğru türde olduğunu ve sunulma amacına uygun olduğunu doğruladığı teyit edilmelidir. Örneğin, yalnızca erişim token'ları yetkilendirme kararları için, yalnızca ID Token'lar kullanıcı kimlik doğrulamasını kanıtlamak için kullanılabilir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V9", - "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", - "section_id": "V9.2", - "section_name": "Token İçeriği", - "req_id": "V9.2.3", - "req_description": "Hizmetin yalnızca kendisiyle kullanılması amaçlanan (audience) token'ları kabul ettiği doğrulanmalıdır. JWT'lerde bu, 'aud' claim'inin hizmet içinde tanımlı bir allowlist ile doğrulanması yoluyla sağlanabilir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V9", - "chapter_name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", - "section_id": "V9.2", - "section_name": "Token İçeriği", - "req_id": "V9.2.4", - "req_description": "Eğer bir token issuer, farklı audience'lara token oluşturmak için aynı private key'i kullanıyorsa, oluşturulan token'ların hedef audience'ları benzersiz şekilde tanımlayan bir audience kısıtlaması içerdiği doğrulanmalıdır. Bu, bir token'ın farklı bir audience ile yeniden kullanılmasını önler. Audience tanımlayıcısı dinamik olarak sağlanıyorsa, token issuer bu audience'ları doğrulamalı ve audience taklitlerinin (impersonation) önüne geçmelidir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.1", - "section_name": "Genel OAuth ve OIDC Güvenliği", - "req_id": "V10.1.1", - "req_description": "Token'ların yalnızca kesinlikle ihtiyaç duyan bileşenlere gönderildiği doğrulanmalıdır. Örneğin, tarayıcı tabanlı JavaScript uygulamaları için bir backend-for-frontend modeli kullanıldığında, access ve refresh token'lara yalnızca backend'in erişebilmesi gerekir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.1", - "section_name": "Genel OAuth ve OIDC Güvenliği", - "req_id": "V10.1.2", - "req_description": "Authorization server'dan gelen değerler (örneğin authorization code veya ID Token gibi) yalnızca aynı user agent oturumu ve işlemi tarafından başlatılmış bir yetkilendirme akışının sonucuysa kabul edildiği doğrulanmalıdır. Bu, client tarafından oluşturulan secret’ların 'proof key for code exchange' (PKCE) ‘code_verifier’, ‘state’ veya OIDC ‘nonce’ gibi tahmin edilemez, işleme özgü ve hem client’a hem de işlem başlatılan user agent oturumuna güvenli bir şekilde bağlı olmasını gerektirir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.2", - "section_name": "OAuth İstemcisi", - "req_id": "V10.2.1", - "req_description": "Code flow kullanılıyorsa, OAuth client’ın token taleplerini tetikleyen CSRF saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Bu genellikle PKCE kullanılarak veya authorization isteğinde gönderilen ‘state’ parametresinin kontrolü ile sağlanır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.2", - "section_name": "OAuth İstemcisi", - "req_id": "V10.2.2", - "req_description": "OAuth istemcisi birden fazla AS ile etkileşime girebiliyorsa, mix-up saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Örneğin, authorization server’ın 'iss' parametresini döndürmesi zorunlu kılınabilir ve bu parametrenin hem authorization yanıtında hem de token yanıtında doğrulanması gerekir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.2", - "section_name": "OAuth İstemcisi", - "req_id": "V10.2.3", - "req_description": "OAuth istemcisinin authorization server’a yaptığı taleplerde yalnızca gerekli scope’ları (veya diğer yetkilendirme parametrelerini) talep ettiği doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.3", - "section_name": "OAuth Kaynak Sunucusu (RS)", - "req_id": "V10.3.1", - "req_description": "RS'nin yalnızca bu servisle kullanılmak üzere tasarlanmış access token’ları kabul ettiği doğrulanmalıdır (audience kontrolü). Audience bilgisi yapılandırılmış token’larda (örneğin JWT içindeki ‘aud’ claim’i) yer alabilir veya token introspection endpoint aracılığıyla kontrol edilebilir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.3", - "section_name": "OAuth Kaynak Sunucusu (RS)", - "req_id": "V10.3.2", - "req_description": "RS'nin, access token’dan gelen claim’lere dayanarak yetki devri tanımına uygun şekilde yetkilendirme kararları uyguladığı doğrulanmalıdır. ‘sub’, ‘scope’ ve ‘authorization_details’ gibi claim’ler varsa, bu kararın parçası olmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.3", - "section_name": "OAuth Kaynak Sunucusu (RS)", - "req_id": "V10.3.3", - "req_description": "Erişim kontrolü kararında, access token’dan (JWT veya ilgili token introspection yanıtı) benzersiz bir kullanıcının tanımlanması gerekiyorsa, RS'nin başka kullanıcılara devredilemeyecek claim’ler ile kullanıcıyı tanımladığı doğrulanmalıdır. Genellikle bu, ‘iss’ ve ‘sub’ claim’lerinin birlikte kullanılması anlamına gelir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.3", - "section_name": "OAuth Kaynak Sunucusu (RS)", - "req_id": "V10.3.4", - "req_description": "RS'nin belirli bir kimlik doğrulama gücü, yöntemi veya güncelliği (recentness) gerektirmesi durumunda, sunulan access token’ın bu kısıtlamaları karşıladığını doğruladığı, örneğin, OIDC ‘acr’, ‘amr’ ve ‘auth_time’ claim’leri kullanılarak doğrulanmalıdır. ", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.3", - "section_name": "OAuth Kaynak Sunucusu (RS)", - "req_id": "V10.3.5", - "req_description": "RS'nin, (yetkisiz taraflarca) çalınmış veya tekrar edilen access token’ların kullanımını önlemek için sender-constrained access token’lar kullandığı doğrulanmalıdır. Bu, OAuth 2 için Mutual TLS veya OAuth 2 Demonstration of Proof of Possession (DPoP) ile sağlanabilir.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.4", - "section_name": "OAuth Yetkilendirme Sunucusu (AS)", - "req_id": "V10.4.1", - "req_description": "AS'nin, istemciye özel önceden kaydedilmiş URI’lerden oluşan bir allowlist kullanarak redirect URI’leri tam dize karşılaştırması ile doğruladığı doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.4", - "section_name": "OAuth Yetkilendirme Sunucusu (AS)", - "req_id": "V10.4.2", - "req_description": "AS'nin, \"authorization response\" içinde \"authorization code\" döndürdüğü durumlarda, bu kodun yalnızca bir kez kullanılabildiği doğrulanmalıdır. Daha önce access token vermek için kullanılmış bir authorization code ile yapılan ikinci geçerli token isteği reddedilmeli ve ilgili tüm token’lar iptal edilmelidir.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.4", - "section_name": "OAuth Yetkilendirme Sunucusu (AS)", - "req_id": "V10.4.3", - "req_description": "Authorization code’un kısa ömürlü olduğu doğrulanmalıdır. L1 ve L2 uygulamalar için maksimum yaşam süresi 10 dakika, L3 uygulamalar için 1 dakikadır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.4", - "section_name": "OAuth Yetkilendirme Sunucusu (AS)", - "req_id": "V10.4.4", - "req_description": "Belirli bir istemci için AS'nin yalnızca o istemcinin ihtiyaç duyduğu grant türlerine izin verdiği doğrulanmalıdır. \"Token\" (Implicit flow) ve \"password\" (Resource Owner Password Credentials flow) grant türlerinin artık kullanılmaması gerekir.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.4", - "section_name": "OAuth Yetkilendirme Sunucusu (AS)", - "req_id": "V10.4.5", - "req_description": "AS'nin, açık istemciler için refresh token replay saldırılarını azalttığı doğrulanmalıdır. Tercihen sender-constrained refresh token’lar (DPoP veya mutual TLS ile certificate-bound access token’lar) kullanılmalıdır. L1 ve L2 uygulamalar için refresh token rotation kullanılabilir. Rotation kullanılıyorsa, AS refresh token’ı kullanım sonrası geçersiz kılmalı ve geçersiz bir refresh token sunulması durumunda o yetkilendirme ile ilişkili tüm refresh token’ları iptal etmelidir.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.4", - "section_name": "OAuth Yetkilendirme Sunucusu (AS)", - "req_id": "V10.4.6", - "req_description": "Code grant kullanılıyorsa, AS'nin authorization code interception saldırılarına karşı koruma sağladığı doğrulanmalıdır. Yetkilendirme isteğinde geçerli bir \"code_challenge\" değeri zorunlu olmalı ve \"code_challenge_method\" olarak \"plain\" kabul edilmemelidir. Token isteğinde ise \"code_verifier\" parametresi doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.4", - "section_name": "OAuth Yetkilendirme Sunucusu (AS)", - "req_id": "V10.4.7", - "req_description": "AS'nin, kimlik doğrulaması yapılmamış dinamik istemci kaydını desteklemesi durumunda, kötü niyetli istemci uygulamalarına karşı riskleri azalttığı doğrulanmalıdır. Kayıtlı URI’ler gibi client metadata’sı doğrulanmalı, kullanıcı onayı alınmalı ve güvenilmeyen bir client uygulamasıyla yapılan yetkilendirme isteği işlenmeden önce kullanıcı uyarılmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.4", - "section_name": "OAuth Yetkilendirme Sunucusu (AS)", - "req_id": "V10.4.8", - "req_description": "Refresh token’ların, sliding expiration kullanılsa bile mutlak bir sona erme süresine sahip olduğu doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.4", - "section_name": "OAuth Yetkilendirme Sunucusu (AS)", - "req_id": "V10.4.9", - "req_description": "Yetkili bir kullanıcı tarafından AS kullanıcı arayüzü üzerinden refresh token’ların ve reference access token’ların iptal edilebildiği doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.4", - "section_name": "OAuth Yetkilendirme Sunucusu (AS)", - "req_id": "V10.4.10", - "req_description": "Gizli istemcilerin token istekleri, pushed authorization request (PAR) ve token iptal istekleri gibi server’a yapılan backchannel isteklerinde kimliğinin kontrol edildiği doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.4", - "section_name": "OAuth Yetkilendirme Sunucusu (AS)", - "req_id": "V10.4.11", - "req_description": "AS yapılandırmasının, OAuth istemcisine yalnızca gerekli scope’ları atadığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.4", - "section_name": "OAuth Yetkilendirme Sunucusu (AS)", - "req_id": "V10.4.12", - "req_description": "Belirli bir client için, authorization server’ın yalnızca client’ın ihtiyaç duyduğu 'response_mode' değerine izin verdiği doğrulanmalıdır. Örneğin, bu değer ya beklenenlerle karşılaştırılarak doğrulanmalı ya da PAR veya JAR kullanılmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.4", - "section_name": "OAuth Yetkilendirme Sunucusu (AS)", - "req_id": "V10.4.13", - "req_description": "\"Code\" grant türünün daima pushed authorization request (PAR) ile birlikte kullanıldığı doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.4", - "section_name": "OAuth Yetkilendirme Sunucusu (AS)", - "req_id": "V10.4.14", - "req_description": "AS'nin yalnızca sender-constrained (Proof-of-Possession) access token’lar ürettiği doğrulanmalıdır. Bu, mutual TLS ile certificate-bound access token ya da DPoP ile DPoP-bound access token olabilir.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.4", - "section_name": "OAuth Yetkilendirme Sunucusu (AS)", - "req_id": "V10.4.15", - "req_description": "Sunucu taraflı istemciler için (kullanıcı cihazında çalışmayan), AS'nin \"authorization_details\" parametresinin istemci backend'i tarafından sağlandığını ve kullanıcı tarafından değiştirilmediğini doğruladığı, örneğin pushed authorization request (PAR) or JWT-secured Authorization Request (JAR) zorunlu kılınarak doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.4", - "section_name": "OAuth Yetkilendirme Sunucusu (AS)", - "req_id": "V10.4.16", - "req_description": "Bir istemci gizli ise, AS'nin güçlü istemci kimlik doğrulama yöntemlerini zorunlu kıldığı doğrulanmalıdır. Bu yöntemler, public-key cryptography’ye dayalı ve replay saldırılarına karşı dayanıklı olmalı, örneğin mutual TLS (\"tls_client_auth\", \"self_signed_tls_client_auth\") veya private key JWT (\"private_key_jwt\") gibi.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.5", - "section_name": "OIDC İstemcisi", - "req_id": "V10.5.1", - "req_description": "İstemcinin (relying party olarak) ID Token replay saldırılarını azalttığı doğrulanmalıdır. Örneğin, ID Token’daki 'nonce' claim’inin, OpenID Provider’a gönderilen kimlik doğrulama isteğindeki 'nonce' değeriyle eşleştiği doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.5", - "section_name": "OIDC İstemcisi", - "req_id": "V10.5.2", - "req_description": "İstemcinin kullanıcıyı ID Token claim’lerinden (genellikle, başka kullanıcılarla yeniden atanamayan 'sub' claim’i) benzersiz şekilde tanımladığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.5", - "section_name": "OIDC İstemcisi", - "req_id": "V10.5.3", - "req_description": "İstemcinin, kötü niyetli bir AS'nin başka bir AS'yi taklit etmesini AS metadata’sı üzerinden reddettiği doğrulanmalıdır. AS metadata’sındaki issuer URL’si, istemci tarafından beklenen önceden yapılandırılmış issuer URL’siyle tam olarak eşleşmiyorsa, metadata reddedilmelidir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.5", - "section_name": "OIDC İstemcisi", - "req_id": "V10.5.4", - "req_description": "İstemcinin, ID Token’ın kendisi için (audience) kullanılması amaçlandığını doğruladığı doğrulanmalıdır. Bu, token’daki 'aud' claim’inin istemcinin 'client_id' değeriyle eşit olup olmadığının kontrol edilmesiyle yapılır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.5", - "section_name": "OIDC İstemcisi", - "req_id": "V10.5.5", - "req_description": "OIDC back-channel logout kullanıldığında, relying party’nin \"forced logout\" ve \"logout\" akışında \"cross-JWT confusion\" gibi saldırılara karşı koruma sağladığı doğrulanmalıdır. Client, logout token’ın 'logout+jwt' türünde olduğunu, 'event' claim’inin doğru üyeye sahip olduğunu ve 'nonce' claim’i içermediğini doğrulamalıdır. Ayrıca token için kısa bir sona erme süresi (örneğin 2 dakika) önerilir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.6", - "section_name": "OpenID Provider", - "req_id": "V10.6.1", - "req_description": "OpenID Provider’ın yalnızca 'code', 'ciba', 'id_token' veya 'id_token code' response mode değerlerine izin verdiği doğrulanmalıdır. 'code' değeri, 'id_token code' (OIDC Hybrid flow) yerine tercih edilmelidir. 'token' (Implicit flow) kullanılmamalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.6", - "section_name": "OpenID Provider", - "req_id": "V10.6.2", - "req_description": "OpenID Provider’ın forced logout yoluyla yapılan hizmet reddi saldırılarını önlediği doğrulanmalıdır. Bu, son kullanıcıdan açık onay alınarak veya varsa logout isteğinde (relying party tarafından başlatılan) bulunan parametrelerin, örneğin 'id_token_hint', doğrulanmasıyla yapılabilir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.7", - "section_name": "Onay (Consent) Yönetimi", - "req_id": "V10.7.1", - "req_description": "AS'nin her yetkilendirme isteği için kullanıcının onayını aldığı doğrulanmalıdır. İstemcinin kimliği garanti altına alınamıyorsa, AS daima kullanıcıdan açıkça onay istemelidir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.7", - "section_name": "Onay (Consent) Yönetimi", - "req_id": "V10.7.2", - "req_description": "AS'nin kullanıcıdan onay istediğinde, neye onay verildiğini açık ve yeterli şekilde gösterdiği doğrulanmalıdır. Uygun olduğunda bu bilgiler, istenen yetkilendirmelerin doğasını (genellikle scope, resource server, RAR gibi detaylara dayalı), yetkilendirilmiş uygulamanın kimliğini ve bu yetkilendirmelerin süresini içermelidir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V10", - "chapter_name": "OAuth ve OIDC", - "section_id": "V10.7", - "section_name": "Onay (Consent) Yönetimi", - "req_id": "V10.7.3", - "req_description": "Kullanıcının, AS üzerinden verdiği onayları görüntüleyebildiği, değiştirebildiği ve iptal edebildiği doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.1", - "section_name": "Kriptografik Envanter ve Dokümantasyon", - "req_id": "V11.1.1", - "req_description": "Kriptografik anahtarların yönetimi için belgelenmiş bir politika ve NIST SP 800-57 gibi bir anahtar yönetim standardını izleyen bir kriptografik anahtar yaşam döngüsü tanımlandığı doğrulanmalıdır. Bu, anahtarların aşırı miktarda paylaşılmadığını (örneğin, paylaşılan sırlar için ikiden fazla tarafla veya özel anahtarlar için birden fazla tarafla) garanti altına almalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.1", - "section_name": "Kriptografik Envanter ve Dokümantasyon", - "req_id": "V11.1.2", - "req_description": "Tüm kriptografik anahtarlar, algoritmalar ve uygulama tarafından kullanılan sertifikaları içeren bir kriptografik envanterin oluşturulduğu, sürdürüldüğü ve düzenli olarak güncellendiği doğrulanmalıdır. Bu envanter ayrıca, sistemde anahtarların nerede kullanılabileceğini ve kullanılamayacağını, ve hangi veri türlerinin bu anahtarlarla korunup korunamayacağını da belgelemelidir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.1", - "section_name": "Kriptografik Envanter ve Dokümantasyon", - "req_id": "V11.1.3", - "req_description": "Sistem içerisinde şifreleme, özetleme ve imzalama işlemleri dahil olmak üzere kriptografi kullanımının tüm örneklerini tespit etmek için kriptografik keşif mekanizmalarının kullanıldığı doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.1", - "section_name": "Kriptografik Envanter ve Dokümantasyon", - "req_id": "V11.1.4", - "req_description": "Kriptografik bir envanterin sürdürüldüğü doğrulanmalıdır. Bu envanter, gelecekteki tehditlere karşı tepki verebilmek amacıyla post-kuantum kriptografiye geçiş yolunu belirten belgelenmiş bir plan içermelidir.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.2", - "section_name": "Güvenli Kriptografi Uygulaması", - "req_id": "V11.2.1", - "req_description": "Kriptografik işlemler için sektör tarafından doğrulanmış uygulamaların (kütüphaneler ve donanım hızlandırmalı uygulamalar dahil) kullanıldığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.2", - "section_name": "Güvenli Kriptografi Uygulaması", - "req_id": "V11.2.2", - "req_description": "Uygulamanın, rastgele sayı üreticileri, kimliği doğrulanmış şifreleme, MAC veya özetleme algoritmaları, anahtar uzunlukları, turlar, şifreler ve modların herhangi bir zamanda yeniden yapılandırılabilir, yükseltilebilir veya değiştirilebilir olacağı şekilde kripto çevikliği (crypto agility) ile tasarlandığı doğrulanmalıdır. Aynı şekilde, anahtarların ve parolaların değiştirilebilmesi ve verilerin yeniden şifrelenebilmesi mümkün olmalıdır. Bu, onaylanmış PQC şemalarının yüksek güvenlikli uygulamaları yaygın olarak kullanılabilir hale geldiğinde sorunsuz geçişe olanak tanır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.2", - "section_name": "Güvenli Kriptografi Uygulaması", - "req_id": "V11.2.3", - "req_description": "Tüm kriptografik ilkeliklerin, algoritma, anahtar boyutu ve yapılandırmaya göre minimum 128 bit güvenlik sağladığı doğrulanmalıdır. Örneğin, 256-bit ECC anahtarı yaklaşık 128 bit güvenlik sağlarken, RSA için aynı güvenliği elde etmek 3072-bit anahtar gerektirir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.2", - "section_name": "Güvenli Kriptografi Uygulaması", - "req_id": "V11.2.4", - "req_description": "Tüm kriptografik işlemlerin sabit süreli (constant-time) olduğu, karşılaştırmalarda, hesaplamalarda veya geri dönüşlerde kısa devre (short-circuit) işlemleri yapılmadığı doğrulanmalıdır; bu, bilgi sızıntısını önlemek için gereklidir.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.2", - "section_name": "Güvenli Kriptografi Uygulaması", - "req_id": "V11.2.5", - "req_description": "Tüm kriptografik modüllerin güvenli şekilde hata verdiği ve hataların, padding oracle saldırıları gibi zafiyetleri mümkün kılmayacak şekilde ele alındığı doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.3", - "section_name": "Şifreleme Algoritmaları", - "req_id": "V11.3.1", - "req_description": "Güvensiz blok modlarının (örneğin, ECB) ve zayıf doldurma (padding) şemalarının (örneğin, PKCS#1 v1.5) kullanılmadığı doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.3", - "section_name": "Şifreleme Algoritmaları", - "req_id": "V11.3.2", - "req_description": "Yalnızca AES ile GCM gibi onaylı şifreleme algoritmalarının ve modlarının kullanıldığı doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.3", - "section_name": "Şifreleme Algoritmaları", - "req_id": "V11.3.3", - "req_description": "Şifrelenmiş verilerin yetkisiz değişikliklere karşı korunduğu doğrulanmalıdır. Tercihen bu koruma, onaylı bir kimliği doğrulanmış şifreleme yöntemi kullanılarak ya da onaylı bir şifreleme yöntemi ile onaylı bir MAC algoritmasının kombinasyonu ile sağlanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.3", - "section_name": "Şifreleme Algoritmaları", - "req_id": "V11.3.4", - "req_description": "Sayılar, başlatma vektörleri (IV) ve diğer tek kullanımlık değerlerin, aynı şifreleme anahtarı ve veri öğesi çifti için birden fazla kez kullanılmadığı doğrulanmalıdır. Oluşturma yöntemi kullanılan algoritmaya uygun olmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.3", - "section_name": "Şifreleme Algoritmaları", - "req_id": "V11.3.5", - "req_description": "Şifreleme algoritması ve MAC algoritması kombinasyonlarının \"encrypt-then-MAC\" modunda çalıştığı doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.4", - "section_name": "Hashing ve Hash Tabanlı Fonksiyonlar", - "req_id": "V11.4.1", - "req_description": "Dijital imzalar, HMAC, KDF ve rastgele bit üretimi gibi genel kriptografik kullanım senaryolarında yalnızca onaylı hash fonksiyonlarının kullanıldığı doğrulanmalıdır. MD5 gibi yasaklı hash fonksiyonları hiçbir kriptografik amaçla kullanılmamalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.4", - "section_name": "Hashing ve Hash Tabanlı Fonksiyonlar", - "req_id": "V11.4.2", - "req_description": "Parolaların, onaylı, hesaplama açısından yoğun ve mevcut rehberliğe göre yapılandırılmış bir anahtar türetme fonksiyonu (diğer adıyla parola hash'leme fonksiyonu) kullanılarak saklandığı doğrulanmalıdır. Ayarlar, güvenlik ve performans dengesini sağlayarak kaba kuvvet saldırılarını zorlaştırmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.4", - "section_name": "Hashing ve Hash Tabanlı Fonksiyonlar", - "req_id": "V11.4.3", - "req_description": "Dijital imzalarda kullanılan hash fonksiyonlarının, veri bütünlüğü ve kimlik doğrulama amacıyla kullanıldığında çakışmaya karşı dayanıklı ve yeterli bit uzunluğuna sahip olduğu doğrulanmalıdır. Çakışma dayanıklılığı gerekiyorsa çıktı uzunluğu en az 256 bit olmalıdır. Sadece ikinci ön-görüntü (2nd pre-iamge) saldırılarına karşı dayanıklılık gerekiyorsa çıktı uzunluğu en az 128 bit olmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.4", - "section_name": "Hashing ve Hash Tabanlı Fonksiyonlar", - "req_id": "V11.4.4", - "req_description": "Parolalardan gizli anahtarlar türetilirken, onaylı anahtar türetme fonksiyonlarının anahtar uzatma (key stretching) parametreleriyle birlikte kullanıldığı doğrulanmalıdır. Bu parametreler, kaba kuvvet saldırılarını önleyecek şekilde güvenlik ve performans dengesine sahip olmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.5", - "section_name": "Rastgele Değerler", - "req_id": "V11.5.1", - "req_description": "Tahmin edilemez olması amaçlanan tüm rastgele sayıların ve dizelerin, CSPRNG ile oluşturulduğu ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. UUID'lerin bu koşulu dikkate almadığını unutmayın.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.5", - "section_name": "Rastgele Değerler", - "req_id": "V11.5.2", - "req_description": "Kullanılan rastgele sayı üretim mekanizmasının, yoğun talep altında dahi güvenli çalışacak şekilde tasarlandığı doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.6", - "section_name": "Açık Anahtar (Public Key) Kriptografisi", - "req_id": "V11.6.1", - "req_description": "Anahtar üretimi, tohumlama (seeding) ve dijital imza üretimi ve doğrulama için yalnızca onaylı kriptografik algoritmalar ve çalışma modlarının kullanıldığı doğrulanmalıdır. Anahtar üretim algoritmaları, bilinen saldırılara karşı savunmasız anahtarlar üretmemelidir. Örneğin, Fermat çarpanlama yöntemine karşı savunmasız RSA anahtarları oluşturulmamalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.6", - "section_name": "Açık Anahtar (Public Key) Kriptografisi", - "req_id": "V11.6.2", - "req_description": "Anahtar değişimi için yalnızca onaylı kriptografik algoritmaların kullanıldığı doğrulanmalıdır (örneğin Diffie-Hellman). Kullanılan parametrelerin güvenli olması gerektiğine dikkat edilmelidir. Bu, anahtar kurulum sürecine yönelik saldırıları önleyecek ve araya girme (adversary-in-the-middle) ya da kriptografik kırılmaları engelleyecektir.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.7", - "section_name": "Kullanım Halindeki Verilerin Kriptografisi", - "req_id": "V11.7.1", - "req_description": "Hassas verilerin kullanım sırasında korunmasını sağlamak amacıyla, yetkisiz kullanıcıların veya süreçlerin bu verilere erişmesini engelleyen tam bellek şifrelemesinin kullanıldığı doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V11", - "chapter_name": "Kriptografi", - "section_id": "V11.7", - "section_name": "Kullanım Halindeki Verilerin Kriptografisi", - "req_id": "V11.7.2", - "req_description": "Veri asgariyetinin sağlandığı, yani işleme sırasında mümkün olan en az miktarda verinin ortaya çıktığı ve verilerin kullanımdan hemen sonra veya mümkün olan en kısa sürede şifrelendiği doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Güvenli İletişim", - "section_id": "V12.1", - "section_name": "Genel TLS Güvenlik Rehberi", - "req_id": "V12.1.1", - "req_description": "Yalnızca TLS protokolünün en güncel ve önerilen sürümlerinin (örneğin TLS 1.2 ve TLS 1.3) etkinleştirildiği ve en son sürümün varsayılan olarak tercih edildiği doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Güvenli İletişim", - "section_id": "V12.1", - "section_name": "Genel TLS Güvenlik Rehberi", - "req_id": "V12.1.2", - "req_description": "Yalnızca önerilen şifre takımlarının (cipher suite) etkinleştirildiği ve en güçlü şifre takımlarının tercih edildiği doğrulanmalıdır. Seviye 3 (L3) uygulamalar yalnızca ileri gizlilik (forward secrecy) sağlayan şifre takımlarını desteklemelidir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Güvenli İletişim", - "section_id": "V12.1", - "section_name": "Genel TLS Güvenlik Rehberi", - "req_id": "V12.1.3", - "req_description": "Uygulamanın, mTLS istemci sertifikalarını kimlik doğrulama veya yetkilendirme amacıyla kullanmadan önce bu sertifikaların güvendiği sertifikalar arasında olduğunu doğruladığı kontrol edilmelidir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Güvenli İletişim", - "section_id": "V12.1", - "section_name": "Genel TLS Güvenlik Rehberi", - "req_id": "V12.1.4", - "req_description": "Online Certificate Status Protocol (OCSP) Stapling gibi geçerli bir sertifika iptal kontrolü yönteminin etkinleştirildiği ve yapılandırıldığı doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Güvenli İletişim", - "section_id": "V12.1", - "section_name": "Genel TLS Güvenlik Rehberi", - "req_id": "V12.1.5", - "req_description": "TLS el sıkışma (handshake) sürecinde Server Name Indication (SNI) gibi hassas meta verilerin ifşa edilmesini önlemek için, uygulamanın TLS yapılandırmasında Encrypted Client Hello (ECH) özelliğinin etkinleştirildiği doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Güvenli İletişim", - "section_id": "V12.2", - "section_name": "Dışa Açık Hizmetlerle HTTPS İletişimi", - "req_id": "V12.2.1", - "req_description": "İstemci ile dışa açık, HTTP tabanlı hizmetler arasındaki tüm bağlantılarda TLS kullanıldığı ve bu bağlantıların güvensiz ya da şifrelenmemiş iletişime geri dönmediği doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Güvenli İletişim", - "section_id": "V12.2", - "section_name": "Dışa Açık Hizmetlerle HTTPS İletişimi", - "req_id": "V12.2.2", - "req_description": "Dışa açık hizmetlerin herkese açık olarak güvenilen TLS sertifikaları kullandığı doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Güvenli İletişim", - "section_id": "V12.3", - "section_name": "Genel Servisler Arası İletişim Güvenliği", - "req_id": "V12.3.1", - "req_description": "Uygulamaya gelen ve uygulamadan çıkan tüm bağlantılarda izleme sistemleri, yönetim araçları, uzaktan erişim ve SSH, ara yazılımlar, veritabanları, ana sistemler (mainframe), iş ortağı sistemleri ya da dış API'ler dahil olmak üzere TLS gibi şifreli bir protokolün kullanıldığı ve güvensiz ya da şifrelenmemiş protokollere geri dönülmediği doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Güvenli İletişim", - "section_id": "V12.3", - "section_name": "Genel Servisler Arası İletişim Güvenliği", - "req_id": "V12.3.2", - "req_description": "TLS istemcilerinin bir TLS sunucusu ile iletişime geçmeden önce alınan sertifikaları doğruladığı kontrol edilmelidir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Güvenli İletişim", - "section_id": "V12.3", - "section_name": "Genel Servisler Arası İletişim Güvenliği", - "req_id": "V12.3.3", - "req_description": "Uygulama içindeki HTTP tabanlı iç hizmetler arasında gerçekleşen tüm bağlantılarda TLS ya da uygun başka bir aktarım şifreleme mekanizmasının kullanıldığı ve güvensiz ya da şifrelenmemiş iletişime geri dönülmediği doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Güvenli İletişim", - "section_id": "V12.3", - "section_name": "Genel Servisler Arası İletişim Güvenliği", - "req_id": "V12.3.4", - "req_description": "İç hizmetler arasındaki TLS bağlantılarında güvenilir sertifikaların kullanıldığı doğrulanmalıdır. İç sistemlerde oluşturulmuş ya da kendinden imzalı (self-signed) sertifikalar kullanılıyorsa, bu sertifikalara güvenen hizmetlerin yalnızca belirli dahili sertifika otoritelerine (CA) ve belirli kendinden imzalı sertifikalara güvenecek şekilde yapılandırıldıkları doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V12", - "chapter_name": "Güvenli İletişim", - "section_id": "V12.3", - "section_name": "Genel Servisler Arası İletişim Güvenliği", - "req_id": "V12.3.5", - "req_description": "Sistem içindeki hizmetlerin birbiriyle iletişim kurarken her bir uç noktanın kimliğini doğrulamak için güçlü kimlik doğrulama yöntemlerinin kullanıldığı doğrulanmalıdır. Bu yöntemler arasında, açık anahtar altyapısı (public-key infrastructure) kullanan ve tekrar oynatma saldırılarına karşı dayanıklı olan TLS istemci kimlik doğrulaması gibi yöntemler yer almalıdır. Mikroservis mimarilerinde, sertifika yönetimini basitleştirmek ve güvenliği artırmak amacıyla bir servis ağı (service mesh) kullanılması değerlendirilmelidir.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.1", - "section_name": "Konfigürasyon Dokümantasyonu", - "req_id": "V13.1.1", - "req_description": "Uygulamanın tüm iletişim ihtiyaçlarının dokümante edildiği doğrulanmalıdır. Buna, uygulamanın bağımlı olduğu dış hizmetler ve son kullanıcının uygulamanın bağlantı kurmasını sağlayabileceği dış konumlar da dahil olmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.1", - "section_name": "Konfigürasyon Dokümantasyonu", - "req_id": "V13.1.2", - "req_description": "Uygulamanın kullandığı her bir hizmet için, dokümantasyonda eşzamanlı bağlantı sayısı (örn. bağlantı havuzu limitleri) ve bu sınır aşıldığında uygulamanın davranışı, geri dönüş veya kurtarma mekanizmaları da dahil olmak üzere hizmet reddi koşullarını önlemek için tanımlandığı doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.1", - "section_name": "Konfigürasyon Dokümantasyonu", - "req_id": "V13.1.3", - "req_description": "Uygulamanın, kullandığı her bir dış sistem veya hizmet (örn. veritabanları, dosya tanıtıcıları, iş parçacıkları, HTTP bağlantıları) için kaynak yönetimi stratejilerini tanımladığı doğrulanmalıdır. Bu stratejiler, kaynak serbest bırakma prosedürlerini, zaman aşımı ayarlarını, hata durumlarını ve tekrar deneme mantığı uygulanmışsa sınırları, gecikmeleri ve geri çekilme (back-off) algoritmalarını içermelidir. Senkron HTTP istek–yanıt işlemleri için kısa zaman aşımı süreleri zorunlu tutulmalı ve tekrar eden denemeler devre dışı bırakılmalı ya da sıkı şekilde sınırlandırılmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.1", - "section_name": "Konfigürasyon Dokümantasyonu", - "req_id": "V13.1.4", - "req_description": "Uygulamanın, güvenlik açısından kritik olan gizli verileri tanımladığı ve kuruluşun tehdit modeli ve iş ihtiyaçlarına göre bu verilerin döndürülme (rotation) zamanlamasının belgelendiği doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.2", - "section_name": "Backend İletişim Konfigürasyonu", - "req_id": "V13.2.1", - "req_description": "Uygulamanın, standart kullanıcı oturum mekanizmasını desteklemeyen backend bileşenleri (örneğin API'ler, ara katmanlar, veri katmanları) arasında gerçekleşen iletişimlerin kimlik doğrulamasıyla korunduğu doğrulanmalıdır. Kimlik doğrulama; bireysel hizmet hesapları, kısa ömürlü token'lar ya da sertifika tabanlı kimlik doğrulama ile yapılmalıdır ve parola, API anahtarı ya da ayrıcalıklı erişime sahip paylaşımlı hesaplar gibi sabit kimlik bilgileri kullanılmamalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.2", - "section_name": "Backend İletişim Konfigürasyonu", - "req_id": "V13.2.2", - "req_description": "Uygulamanın backend bileşenleri arasında (yerel hizmetler, işletim sistemi hizmetleri, API'ler, ara katmanlar ve veri katmanları dahil) gerçekleştirilen iletişimlerin, yalnızca gerekli en az ayrıcalığa sahip hesaplarla yapıldığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.2", - "section_name": "Backend İletişim Konfigürasyonu", - "req_id": "V13.2.3", - "req_description": "Bir hizmet kimlik doğrulaması için bir kimlik bilgisi kullanılması gerekiyorsa, bu kimlik bilgisinin varsayılan bir değer (örneğin root/root veya admin/admin) olmadığının doğrulanması gereklidir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.2", - "section_name": "Backend İletişim Konfigürasyonu", - "req_id": "V13.2.4", - "req_description": "Uygulamanın iletişim kurmasına izin verilen dış kaynaklar ya da sistemlerin, bir allowlist (izinli liste) ile tanımlandığı doğrulanmalıdır. Bu liste, uygulama katmanında, web sunucusunda, güvenlik duvarında veya farklı katmanların birleşiminde uygulanabilir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.2", - "section_name": "Backend İletişim Konfigürasyonu", - "req_id": "V13.2.5", - "req_description": "Web veya uygulama sunucusunun, dış sistemlere veri veya dosya gönderimi veya yüklemesi yaparken sadece belirli kaynaklara izin verecek şekilde allowlist ile yapılandırıldığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.2", - "section_name": "Backend İletişim Konfigürasyonu", - "req_id": "V13.2.6", - "req_description": "Uygulamanın farklı hizmetlere bağlantı kurduğu durumlarda, bu bağlantılar için belgelenmiş yapılandırmaları (örn. maksimum eşzamanlı bağlantı, bağlantı limiti aşıldığında davranış, zaman aşımı, tekrar deneme stratejileri) takip ettiğinin doğrulanması gereklidir.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.3", - "section_name": "Gizli Bilgi Yönetimi", - "req_id": "V13.3.1", - "req_description": "Parolalar, anahtar materyalleri, veritabanı ve üçüncü parti sistemlerle entegrasyon bilgileri, zaman tabanlı token'lar için tohum (seed) bilgileri, dahili gizli veriler ve API anahtarları gibi backend sırlarının güvenli bir şekilde oluşturulması, saklanması, erişim denetiminin sağlanması ve imha edilmesi için bir gizli bilgi yönetim çözümünün (örneğin key vault) kullanıldığı doğrulanmalıdır. Bu gizli bilgiler uygulama kaynak koduna dahil edilmemeli ve yapı çıktılarında yer almamalıdır. Seviye 3 uygulamalar için donanım destekli bir çözüm (örneğin HSM) gereklidir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.3", - "section_name": "Gizli Bilgi Yönetimi", - "req_id": "V13.3.2", - "req_description": "Gizli bilgilere erişimin en az ayrıcalık prensibine uygun şekilde yapılandırıldığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.3", - "section_name": "Gizli Bilgi Yönetimi", - "req_id": "V13.3.3", - "req_description": "Tüm kriptografik işlemlerin, anahtar materyallerinin güvenli bir şekilde yönetilmesi ve dışarıya sızmasının engellenmesi amacıyla, izole edilmiş bir güvenlik modülü (örneğin vault ya da donanım güvenlik modülü) aracılığıyla gerçekleştirildiği doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.3", - "section_name": "Gizli Bilgi Yönetimi", - "req_id": "V13.3.4", - "req_description": "Uygulamanın belgelerinde belirtildiği şekilde gizli bilgilerin süresinin dolacak şekilde yapılandırıldığı ve düzenli olarak döndürüldüğü doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.4", - "section_name": "İstenmeyen Bilgi Sızıntısı", - "req_id": "V13.4.1", - "req_description": "Uygulamanın .git veya .svn klasörleri gibi kaynak kontrolüyle ilgili metadata içermeyecek şekilde deploy edildiğini ya da bu klasörlerin hem dış erişime hem de uygulama erişimine kapalı olduğu doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.4", - "section_name": "İstenmeyen Bilgi Sızıntısı", - "req_id": "V13.4.2", - "req_description": "Tüm bileşenler için üretim ortamlarında hata ayıklama (debug) modlarının devre dışı bırakıldığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.4", - "section_name": "İstenmeyen Bilgi Sızıntısı", - "req_id": "V13.4.3", - "req_description": "Web sunucularının, açık şekilde istenmediği sürece dizin listelemesi (directory listing) özelliğini istemcilere sunmadığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.4", - "section_name": "İstenmeyen Bilgi Sızıntısı", - "req_id": "V13.4.4", - "req_description": "HTTP TRACE metodunun üretim ortamlarında desteklenmediği, böylece potansiyel bilgi sızıntılarının önlendiği doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.4", - "section_name": "İstenmeyen Bilgi Sızıntısı", - "req_id": "V13.4.5", - "req_description": "Belgeler (örneğin dahili API belgeleri) ve izleme uç noktalarının (monitoring endpoints) yalnızca açıkça belirtildiği durumlarda erişilebilir olduğu doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.4", - "section_name": "İstenmeyen Bilgi Sızıntısı", - "req_id": "V13.4.6", - "req_description": "Uygulamanın arka uç bileşenlerinin ayrıntılı sürüm bilgilerini ifşa etmediği doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V13", - "chapter_name": "Konfigürasyon", - "section_id": "V13.4", - "section_name": "İstenmeyen Bilgi Sızıntısı", - "req_id": "V13.4.7", - "req_description": "Web katmanının yalnızca belirli dosya uzantılarına sahip dosyaları sunacak şekilde yapılandırıldığı, bu sayede istem dışı bilgi, yapılandırma ya da kaynak kod sızıntılarının önlendiği doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Veri Koruma", - "section_id": "V14.1", - "section_name": "Veri Koruma Dokümantasyonu", - "req_id": "V14.1.1", - "req_description": "Uygulama tarafından oluşturulan ve işlenen tüm hassas verilerin tanımlanıp, koruma seviyelerine göre sınıflandırıldığından emin olun. Bu, yalnızca kodlanmış (örneğin Base64 stringleri ya da JWT içindeki düz metin yükler gibi) ve bu nedenle kolayca çözülebilir verileri de içermelidir. Koruma seviyeleri, uygulamanın uymakla yükümlü olduğu veri koruma ve gizlilik düzenlemeleri ile standartlarını dikkate almalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Veri Koruma", - "section_id": "V14.1", - "section_name": "Veri Koruma Dokümantasyonu", - "req_id": "V14.1.2", - "req_description": "Tüm hassas veri koruma seviyeleri için belgelenmiş bir koruma gereksinimleri seti tanımlandığından emin olun. Bu gereksinimler genel şifreleme, bütünlük doğrulama, saklama süresi, verinin nasıl günlüğe kaydedileceği, günlüklerdeki hassas verilere erişim kontrolleri, veritabanı düzeyinde şifreleme, gizlilik ve gizliliği artırıcı teknolojiler ile diğer gizlilik gereksinimlerini kapsamalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Veri Koruma", - "section_id": "V14.2", - "section_name": "Genel Veri Koruması", - "req_id": "V14.2.1", - "req_description": "Hassas verilerin yalnızca HTTP message body veya header alanlarında sunucuya gönderildiği ve URL ile sorgu parametrelerinin, API anahtarı veya session token’ı gibi hassas bilgiler içermediği doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Veri Koruma", - "section_id": "V14.2", - "section_name": "Genel Veri Koruması", - "req_id": "V14.2.2", - "req_description": "Hassas verilerin, yük dengeleyiciler ve uygulama önbellekleri gibi sunucu bileşenlerinde önbelleğe alınmasının engellendiği veya kullanım sonrası bu verilerin güvenli biçimde temizlendiği doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Veri Koruma", - "section_id": "V14.2", - "section_name": "Genel Veri Koruması", - "req_id": "V14.2.3", - "req_description": "Uygulama kontrolü dışında veri toplanmasını engellemek için, tanımlanmış hassas verilerin, kullanıcı izleyicileri gibi güvensiz taraflara gönderilmediği doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Veri Koruma", - "section_id": "V14.2", - "section_name": "Genel Veri Koruması", - "req_id": "V14.2.4", - "req_description": "Hassas verilere yönelik şifreleme, bütünlük doğrulama, veri saklama, loglama yöntemi, loglardaki erişim kontrolleri, gizlilik teknolojileri gibi kontrollerin, söz konusu verinin belgelenmiş koruma seviyesinde tanımlandığı şekilde uygulandığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Veri Koruma", - "section_id": "V14.2", - "section_name": "Genel Veri Koruması", - "req_id": "V14.2.5", - "req_description": "Önbellekleme mekanizmalarının yalnızca belirli içerik türüne sahip yanıtları önbelleğe alacak şekilde yapılandırıldığı ve hassas, dinamik içeriklerin önbelleğe alınmadığı doğrulanmalıdır. Web sunucusu, mevcut olmayan bir dosya talebinde geçerli ama farklı bir dosya döndürmek yerine 404 veya 302 cevabı vermelidir. Bu, Web Cache Deception saldırılarını önlemeye yardımcı olur.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Veri Koruma", - "section_id": "V14.2", - "section_name": "Genel Veri Koruması", - "req_id": "V14.2.6", - "req_description": "Uygulamanın yalnızca işlevsellik için gerekli olan asgari hassas veriyi döndürdüğü doğrulanmalıdır. Örneğin, kredi kartı numarasının yalnızca bazı rakamlarının döndürülmesi; tam numaranın döndürülmesi gerekiyorsa, kullanıcı arayüzünde gizlenmiş (maskelenmiş) şekilde sunulması gerekir, aksi kullanıcı özel olarak görüntülemek istemedikçe gösterilmemelidir.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Veri Koruma", - "section_id": "V14.2", - "section_name": "Genel Veri Koruması", - "req_id": "V14.2.7", - "req_description": "Hassas bilgilerin, veri saklama sınıflandırmasına tabi tutulduğu, geçerliliğini yitirmiş veya artık gerekli olmayan verilerin belirlenmiş bir zaman çizelgesiyle ya da gerektiğinde otomatik olarak silindiği doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Veri Koruma", - "section_id": "V14.2", - "section_name": "Genel Veri Koruması", - "req_id": "V14.2.8", - "req_description": "Kullanıcı tarafından yüklenen dosyaların meta verilerinden hassas bilgilerin çıkarıldığı veya bu bilgilerin yalnızca kullanıcıdan açık onay alındığında saklandığı doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Veri Koruma", - "section_id": "V14.3", - "section_name": "İstemci Tarafı Veri Koruması", - "req_id": "V14.3.1", - "req_description": "Kimliği doğrulanmış verilerin, istemci veya oturum sonlandığında istemci depolamasından (örneğin tarayıcı DOM’undan) temizlendiği doğrulanmalıdır. 'Clear-Site-Data' HTTP response header bu konuda yardımcı olabilir ancak istemci tarafı, sunucu bağlantısı mevcut olmadığında da temizlik işlemini yapabiliyor olmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Veri Koruma", - "section_id": "V14.3", - "section_name": "İstemci Tarafı Veri Koruması", - "req_id": "V14.3.2", - "req_description": "Uygulamanın, tarayıcılarda hassas verilerin önbelleğe alınmasını önlemek amacıyla yeterli anti-önbellekleme HTTP response header (örneğin Cache-Control: no-store) ayarladığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V14", - "chapter_name": "Veri Koruma", - "section_id": "V14.3", - "section_name": "İstemci Tarafı Veri Koruması", - "req_id": "V14.3.3", - "req_description": "Tarayıcıda depolanan verilerin (örneğin localStorage, sessionStorage, IndexedDB veya çerezler) hassas veri içermediği, yalnızca session token’larının istisna olarak kabul edildiği doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.1", - "section_name": "Güvenli Kodlama ve Mimari Dokümantasyonu", - "req_id": "V15.1.1", - "req_description": "Güvenlik açığı içeren üçüncü taraf bileşen sürümleri ve genel olarak kütüphane güncellemeleri için, uygulama dokümantasyonunda risk bazlı düzeltme zamanlarının tanımlandığı doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.1", - "section_name": "Güvenli Kodlama ve Mimari Dokümantasyonu", - "req_id": "V15.1.2", - "req_description": "Yazılım bileşen listesi (Software Bill of Materials - SBOM) gibi bir envanterin tutulduğu, kullanılan tüm üçüncü taraf kütüphanelerin önceden tanımlanmış, güvenilir ve düzenli olarak güncellenen depolardan alındığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.1", - "section_name": "Güvenli Kodlama ve Mimari Dokümantasyonu", - "req_id": "V15.1.3", - "req_description": "Uygulama dokümantasyonunda zaman veya kaynak açısından yoğun işlevlerin tanımlandığı, bu işlevlerin aşırı kullanımı durumunda kullanılabilirlik kaybının nasıl önleneceği ve yanıt oluşturma süresinin istemci zaman aşımını aşmaması için hangi önlemlerin alındığı belirtilmelidir. Örnek savunmalar kuyruklama, eşzamansız işleme, kullanıcı başına ve uygulama genelinde paralel işlem sınırlarını içerebilir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.1", - "section_name": "Güvenli Kodlama ve Mimari Dokümantasyonu", - "req_id": "V15.1.4", - "req_description": "Uygulama dokümantasyonunda \"riskli bileşenler\" olarak değerlendirilen üçüncü taraf kütüphanelerin vurgulandığı doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.1", - "section_name": "Güvenli Kodlama ve Mimari Dokümantasyonu", - "req_id": "V15.1.5", - "req_description": "Uygulama dokümantasyonunda \"tehlikeli işlevsellik\" içeren uygulama bölümlerinin açıkça belirtildiği doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.2", - "section_name": "Güvenlik Mimarisi ve Bağımlılıklar", - "req_id": "V15.2.1", - "req_description": "Uygulamanın yalnızca, belgelenmiş güncelleme ve düzeltme sürelerini aşmamış bileşenleri içerdiği doğrulanmalıdır.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.2", - "section_name": "Güvenlik Mimarisi ve Bağımlılıklar", - "req_id": "V15.2.2", - "req_description": "Uygulamanın, belgelenmiş güvenlik kararları ve stratejilere dayanarak, zaman veya kaynak açısından yoğun işlevlerin neden olabileceği kullanılabilirlik kaybına karşı savunmalar uyguladığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.2", - "section_name": "Güvenlik Mimarisi ve Bağımlılıklar", - "req_id": "V15.2.3", - "req_description": "Üretim ortamının yalnızca uygulamanın çalışması için gerekli işlevleri içerdiği ve test kodları, örnek kod parçaları veya geliştirme işlevleri gibi gereksiz işlevsellikleri açığa çıkarmadığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.2", - "section_name": "Güvenlik Mimarisi ve Bağımlılıklar", - "req_id": "V15.2.4", - "req_description": "Üçüncü taraf bileşenlerin ve bunların tüm transitif bağımlılıklarının beklenen depolardan (iç kaynaklı ya da harici) alındığı ve bağımlılık karışıklığı (dependency confusion) saldırılarına açık olmadığı doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.2", - "section_name": "Güvenlik Mimarisi ve Bağımlılıklar", - "req_id": "V15.2.5", - "req_description": "Uygulamanın, “tehlikeli işlevsellik” içeren veya “riskli bileşenler” kullanan bölümlerine ek korumalar uyguladığı doğrulanmalıdır. Bu korumalar sandbox, kapsülleme, konteynerleştirme veya ağ düzeyinde izolasyon gibi teknikler aracılığıyla, bir uygulama bölümünün ele geçirilmesi durumunda saldırganın diğer bölümlere sıçramasını geciktirmeyi veya engellemeyi amaçlamalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.3", - "section_name": "Savunmacı Kodlama", - "req_id": "V15.3.1", - "req_description": "Uygulamanın yalnızca gerekli alanların bir alt kümesini veri nesnesinden döndürdüğü doğrulanmalıdır. Örneğin, bazı alanlara kullanıcıların erişmemesi gerektiğinden tüm veri nesnesi döndürülmemelidir.", - "level1": "✓", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.3", - "section_name": "Savunmacı Kodlama", - "req_id": "V15.3.2", - "req_description": "Uygulama backend'i harici URL’lere çağrı yaptığında, yalnızca amaçlanan işlevsellik söz konusuysa yönlendirmeleri takip edecek şekilde yapılandırıldığının doğrulanması gerekir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.3", - "section_name": "Savunmacı Kodlama", - "req_id": "V15.3.3", - "req_description": "Uygulamanın, kitlesel atama saldırılarına karşı, her bir controller ve eylem için izin verilen alanları sınırlandırarak savunmalar sağladığı doğrulanmalıdır. Örneğin, bir alan değeri, bu işlemde değiştirilmesi amaçlanmadıysa eklenememeli veya güncellenememelidir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.3", - "section_name": "Savunmacı Kodlama", - "req_id": "V15.3.4", - "req_description": "Tüm proxy ve ara katman bileşenlerinin kullanıcının orijinal IP adresini, uç kullanıcı tarafından değiştirilemeyecek güvenilir veri alanları kullanarak doğru şekilde ilettiği ve uygulamanın ve web sunucusunun bu doğru değeri, loglama ve hız sınırlama gibi güvenlik kararları için kullandığı doğrulanmalıdır. Ayrıca, orijinal IP adresinin bile dinamik IP'ler, VPN'ler veya kurumsal güvenlik duvarları nedeniyle güvenilir olmayabileceği dikkate alınmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.3", - "section_name": "Savunmacı Kodlama", - "req_id": "V15.3.5", - "req_description": "Uygulamanın değişkenlerin doğru türde olduğunu açıkça doğruladığı ve sıkı eşitlik ve karşılaştırma işlemleri kullandığı doğrulanmalıdır. Bu, değişken türüyle ilgili varsayımlardan kaynaklanan tür oynama (type juggling) veya tür karışıklığı (type confusion) güvenlik açıklarını önlemek içindir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.3", - "section_name": "Savunmacı Kodlama", - "req_id": "V15.3.6", - "req_description": "JavaScript kodunun prototip zehirleme (prototype pollution) saldırılarını önleyecek şekilde yazıldığı, örneğin, nesne literal’leri yerine Set() veya Map() gibi yapılar kullanıldığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.3", - "section_name": "Savunmacı Kodlama", - "req_id": "V15.3.7", - "req_description": "Uygulamanın, özellikle framework'ün istek parametrelerinin kaynağı (sorgu dizgisi, gövde parametreleri, çerezler veya başlık alanları) arasında ayrım yapmadığı durumlarda, HTTP parametre kirliliği (HTTP parameter pollution) saldırılarına karşı savunmalar uyguladığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.4", - "section_name": "Güvenli Eş Zamanlılık (Concurrency)", - "req_id": "V15.4.1", - "req_description": "Çok iş parçacıklı kodda (örneğin cache'ler, dosyalar veya birden fazla iş parçacığı tarafından erişilen bellek içi nesneler gibi) paylaşılan nesnelere yalnızca thread-safe (iş parçacığı güvenli) türler ve kilitleme (lock) veya semaphore gibi senkronizasyon mekanizmaları kullanılarak erişildiği doğrulanmalıdır. Bu, yarış durumlarını ve veri bozulmasını önlemeye yöneliktir.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.4", - "section_name": "Güvenli Eş Zamanlılık (Concurrency)", - "req_id": "V15.4.2", - "req_description": "Bir kaynağın durumu üzerindeki kontroller (örneğin varlığı ya da izinleri gibi) ile bu kontrole bağlı eylemlerin tek bir atomik işlem olarak gerçekleştirildiği doğrulanmalıdır. Bu, TOCTOU (time-of-check to time-of-use) yarış durumlarını önlemeye yöneliktir. Bir dosyanın varlığının kontrol edilip ardından açılması veya bir kullanıcının erişiminin doğrulanıp ardından yetki verilmesi gibi işlemler buna örnektir.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.4", - "section_name": "Güvenli Eş Zamanlılık (Concurrency)", - "req_id": "V15.4.3", - "req_description": "Kilitlerin (locks) tutarlı biçimde kullanıldığı, iş parçacıklarının birbirini beklemesi ya da sonsuz döngüye girmesi (deadlock veya livelock) gibi durumların önlendiği doğrulanmalıdır. Ayrıca, kilitleme mantığı, kaynağı yöneten kod içinde kalmalı ve dış sınıflar veya dış kodlar tarafından istemeden veya kötü niyetli şekilde değiştirilememelidir.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V15", - "chapter_name": "Güvenli Kodlama ve Mimari", - "section_id": "V15.4", - "section_name": "Güvenli Eş Zamanlılık (Concurrency)", - "req_id": "V15.4.4", - "req_description": "Kaynak tahsis politikalarının, iş parçacığı açlığını önleyecek şekilde, kaynaklara adil erişimi sağladığı doğrulanmalıdır. Örneğin, thread pool (iş parçacığı havuzu) kullanımı, düşük öncelikli iş parçacıklarının da makul sürelerde çalışabilmesi için uygulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.1", - "section_name": "Güvenlik Loglaması Dokümantasyonu", - "req_id": "V16.1.1", - "req_description": "Uygulamanın teknoloji yığını boyunca her katmanda hangi olayların loglandığını, log formatlarını, logların nereye yazıldığını, nasıl kullanıldığını, erişimin nasıl kontrol edildiğini ve logların ne kadar süre saklandığını belgeleyen bir envanterin mevcut olduğu doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.2", - "section_name": "Genel Loglama", - "req_id": "V16.2.1", - "req_description": "Her bir log girdisinin, olayın ne zaman, nerede, kim tarafından ve ne olduğuna dair detaylı bir zaman çizelgesi oluşturulmasına olanak tanıyacak gerekli meta verileri içerdiği doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.2", - "section_name": "Genel Loglama", - "req_id": "V16.2.2", - "req_description": "Tüm loglama bileşenlerinin zaman kaynaklarının senkronize olduğu ve güvenlik olayı meta verisindeki zaman damgalarının UTC kullanarak ya da açık zaman dilimi ofsetiyle belirtildiği doğrulanmalıdır. UTC kullanımı, özellikle yaz saati uygulamaları nedeniyle oluşabilecek karışıklıkları önlemek için tavsiye edilir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.2", - "section_name": "Genel Loglama", - "req_id": "V16.2.3", - "req_description": "Uygulamanın yalnızca log envanterinde belgelenmiş dosya ve hizmetlere log yazdığı ya da ilettiği doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.2", - "section_name": "Genel Loglama", - "req_id": "V16.2.4", - "req_description": "Logların kullanılan log işleyici (log processor) tarafından okunabildiği ve ilişkilendirilebildiği doğrulanmalıdır. Tercihen yaygın bir log formatı kullanılmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.2", - "section_name": "Genel Loglama", - "req_id": "V16.2.5", - "req_description": "Hassas veriler loglanırken, uygulamanın veri koruma seviyesine uygun olarak loglama yaptığı doğrulanmalıdır. Örneğin kimlik bilgileri veya ödeme detayları gibi bazı verilerin loglanmasına izin verilmemelidir. Session token’ları gibi veriler ise yalnızca tamamen ya da kısmen maskelenmiş ya da hash’lenmiş olarak loglanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.3", - "section_name": "Güvenlik Olayları", - "req_id": "V16.3.1", - "req_description": "Tüm kimlik doğrulama işlemlerinin (başarılı ve başarısız girişimler dahil) loglandığı doğrulanmalıdır. Kullanılan kimlik doğrulama türü veya faktörleri gibi ek meta veriler de toplanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.3", - "section_name": "Güvenlik Olayları", - "req_id": "V16.3.2", - "req_description": "Başarısız yetkilendirme girişimlerinin loglandığı doğrulanmalıdır. Seviye 3 uygulamalar için, tüm yetkilendirme kararlarının ve hassas verilere erişim olaylarının (verinin kendisi olmadan) loglandığı da doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.3", - "section_name": "Güvenlik Olayları", - "req_id": "V16.3.3", - "req_description": "Uygulamanın, belgelenmiş güvenlik olaylarını ve güvenlik kontrollerini aşma girişimlerini (girdi doğrulama, iş mantığı, otomasyon karşıtı kontroller vb.) logladığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.3", - "section_name": "Güvenlik Olayları", - "req_id": "V16.3.4", - "req_description": "Beklenmeyen hatalar ve güvenlik kontrolü başarısızlıkları (örneğin backend TLS hataları gibi) loglandığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.4", - "section_name": "Log Koruması", - "req_id": "V16.4.1", - "req_description": "Tüm loglama bileşenlerinin, log enjeksiyonunu (log injection) önlemek amacıyla verileri uygun biçimde encode ettiği doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.4", - "section_name": "Log Koruması", - "req_id": "V16.4.2", - "req_description": "Logların yetkisiz erişime karşı korunduğu ve değiştirilemez olduğu doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.4", - "section_name": "Log Koruması", - "req_id": "V16.4.3", - "req_description": "Logların analiz, tespit, uyarı ve yükseltme amacıyla mantıksal olarak ayrı bir sisteme güvenli biçimde iletildiği doğrulanmalıdır. Böylece uygulama ihlal edilse bile logların tehlikeye girmesi önlenmiş olur.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.5", - "section_name": "Hata Yönetimi", - "req_id": "V16.5.1", - "req_description": "Beklenmedik ya da güvenlikle ilgili bir hata oluştuğunda, tüketiciye genel bir mesaj döndürüldüğü ve yığın izleri (stack trace), sorgular, gizli anahtarlar, token’lar gibi hassas sistem içi verilerin açıklanmadığı doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.5", - "section_name": "Hata Yönetimi", - "req_id": "V16.5.2", - "req_description": "Uygulamanın, dış kaynaklara erişim başarısız olduğunda bile güvenli şekilde çalışmaya devam ettiği doğrulanmalıdır. Örneğin, circuit breaker ya da graceful degradation gibi desenler kullanılmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.5", - "section_name": "Hata Yönetimi", - "req_id": "V16.5.3", - "req_description": "Uygulamanın hata durumlarında güvenli ve düzenli şekilde başarısız olduğu doğrulanmalıdır. Bu, örneğin doğrulama hatalarına rağmen işlemlerin işlenmesine yol açabilecek fail-open durumlarını önlemelidir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V16", - "chapter_name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "section_id": "V16.5", - "section_name": "Hata Yönetimi", - "req_id": "V16.5.4", - "req_description": "Ele alınmamış tüm istisnaları yakalayacak şekilde tanımlanmış bir “son çare hata yöneticisi” bulunduğu doğrulanmalıdır. Bu, hem loglara gitmesi gereken hata detaylarının kaybolmaması hem de tüm uygulama sürecinin çökerek hizmet dışı kalmasının önlenmesi açısından önemlidir.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.1", - "section_name": "TURN Sunucusu", - "req_id": "V17.1.1", - "req_description": "TURN hizmetinin yalnızca özel amaçlar için ayrılmamış IP adreslerine (ör. iç ağlar, yayın adresleri, loopback) erişime izin verdiği doğrulanmalıdır. Bu gereksinim hem IPv4 hem de IPv6 adresleri için geçerlidir.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.1", - "section_name": "TURN Sunucusu", - "req_id": "V17.1.2", - "req_description": "TURN hizmetinin, meşru kullanıcıların sunucuda çok sayıda bağlantı noktası açmaya çalışması durumunda kaynak tüketimi saldırılarına karşı dayanıklı olduğu doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Medya", - "req_id": "V17.2.1", - "req_description": "DTLS sertifikası anahtarının, belgelenmiş kriptografik anahtar yönetim politikasına uygun şekilde yönetildiği ve korunduğu doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Medya", - "req_id": "V17.2.2", - "req_description": "Medya sunucusunun onaylı DTLS şifre takımlarını (cipher suites) ve Güvenli Gerçek Zamanlı Aktarım Protokolü (Secure Real-time Transport Protocol - SRTP) için anahtarlar oluşturmaya yönelik DTLS Uzantısı için güvenli bir koruma profilini kullanacak ve destekleyecek şekilde yapılandırıldığı (DTLS-SRTP) doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Medya", - "req_id": "V17.2.3", - "req_description": "Real-time Transport Protocol (RTP) injection saldırılarının bir hizmet reddi durumuna veya medya akışlarına ses veya video medyası eklenmesine yol açmasını önlemek için medya sunucusunda Güvenli SRTP kimlik doğrulamasının kontrol edildiği doğrulanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Medya", - "req_id": "V17.2.4", - "req_description": "Verify that the media server is able to continue processing incoming media traffic when encountering malformed Secure Real-time Transport Protocol (SRTP) packets.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Medya", - "req_id": "V17.2.5", - "req_description": "Medya sunucusunun, meşru kullanıcılardan gelen SRTP flood'ı sırasında gelen medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Medya", - "req_id": "V17.2.6", - "req_description": "Medya sunucusunun DTLS içinde yer alan \"ClientHello\" yarış durumu güvenlik açığına karşı savunmasız olmadığı, medya sunucusunun güvenlik açığına sahip olduğunun açıkça bilinip bilinmediği kontrol edilerek veya yarış koşulu testi gerçekleştirilerek doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Medya", - "req_id": "V17.2.7", - "req_description": "Medya sunucusuna bağlı ses veya video kayıt mekanizmalarının, meşru kullanıcı kaynaklı SRTP flood'ı sırasında medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.2", - "section_name": "Medya", - "req_id": "V17.2.8", - "req_description": "DTLS sertifikasının, SDP (Session Description Protocol) fingerprint özelliği ile karşılaştırıldığı ve doğrulama başarısız olursa medya akışının sonlandırıldığı, medya akışının özgünlüğünü sağlamak için doğrulanmalıdır.", - "level1": "", - "level2": "", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.3", - "section_name": "Sinyalizasyon", - "req_id": "V17.3.1", - "req_description": "Sinyalizasyon sunucusunun, flood saldırısı altında bile meşru sinyalizasyon mesajlarını işlemeye devam edebildiği doğrulanmalıdır. Bu, sinyalizasyon düzeyinde oran sınırlaması uygulanarak sağlanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - }, - { - "chapter_id": "V17", - "chapter_name": "WebRTC", - "section_id": "V17.3", - "section_name": "Sinyalizasyon", - "req_id": "V17.3.2", - "req_description": "Sinyalizasyon sunucusunun, hizmet reddine yol açabilecek şekilde yapılandırılmış bozuk sinyalizasyon mesajlarıyla karşılaştığında bile meşru mesajları işlemeye devam edebildiği doğrulanmalıdır. Bu, girdi doğrulaması, integer overflow ve buffer overflow'a karşı savunma ve sağlam hata işleme teknikleri ile sağlanmalıdır.", - "level1": "", - "level2": "✓", - "level3": "✓", - "cwe": "", - "nist": "" - } - ] -} diff --git a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.json b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.json deleted file mode 100644 index e5bc5ab39c..0000000000 --- a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.json +++ /dev/null @@ -1,2750 +0,0 @@ -{ - "Name": "Application Security Verification Standard Project", - "ShortName": "ASVS", - "Version": "", - "Description": "The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.", - "Requirements": [ - { - "Shortcode": "V1", - "Ordinal": 1, - "ShortName": "Encoding", - "Name": "Kodlama (Encoding) ve Temizleme", - "Items": [ - { - "Shortcode": "V1.1", - "Ordinal": 1, - "Name": "Kodlama ve Temizleme Mimarisi", - "Items": [ - { - "Shortcode": "V1.1.1", - "Ordinal": 1, - "Description": "Girdinin yalnızca bir kez kanonik forma (canonical form) çözümlendiği veya kaçış işlemlerinin kaldırıldığı, bu işlemin yalnızca verinin bu biçimde beklenmesi durumunda yapıldığı ve bu işlemin girdi doğrulama veya temizleme işlemlerinden sonra değil, önce gerçekleştiği doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V1.1.2", - "Ordinal": 2, - "Description": "Uygulamanın, çıktıyı kullanılması gereken yorumlayıcıya verilmeden hemen önce veya yorumlayıcının kendisi tarafından çıktı kodlaması ya da kaçış işlemi yaptığı doğrulanmalıdır.", - "L": "2" - } - ] - }, - { - "Shortcode": "V1.2", - "Ordinal": 2, - "Name": "Enjeksiyon Önleme", - "Items": [ - { - "Shortcode": "V1.2.1", - "Ordinal": 1, - "Description": "HTTP yanıtı, HTML veya XML belgesi için yapılan çıktı kodlamasının; HTML elemanları, HTML öznitelikleri, HTML yorumları, CSS ya da HTTP başlık alanları gibi bağlamlara uygun olduğu doğrulanmalıdır. Böylece mesaj veya belge yapısının bozulması önlenir.", - "L": "1" - }, - { - "Shortcode": "V1.2.2", - "Ordinal": 2, - "Description": "Dinamik olarak URL oluşturulurken, güvenilmeyen verinin bağlamına göre (örneğin, sorgu veya yol parametreleri için URL kodlaması ya da base64url kodlaması) kodlandığı doğrulanmalıdır. Yalnızca güvenli URL protokollerine izin verilmelidir (örneğin, javascript: veya data: yasaklanmalıdır).", - "L": "1" - }, - { - "Shortcode": "V1.2.3", - "Ordinal": 3, - "Description": "JavaScript içeriği (JSON dahil) dinamik olarak oluşturulurken çıktı kodlama/kaçış kullanıldığı doğrulanmalıdır. Böylece mesaj veya belge yapısı değiştirilmemiş olur (JavaScript ve JSON enjeksiyonlarının önüne geçilir).", - "L": "1" - }, - { - "Shortcode": "V1.2.4", - "Ordinal": 4, - "Description": "Veri sorguları veya veritabanı sorguları (SQL, HQL, NoSQL, Cypher vb.) için parametreli sorgular, ORM’ler, entity framework’ler kullanıldığı ya da SQL enjeksiyonu ve diğer veritabanı enjeksiyon saldırılarına karşı koruma sağlandığı doğrulanmalıdır. Bu durum, saklı yordam (stored procedure) yazarken de geçerlidir.", - "L": "1" - }, - { - "Shortcode": "V1.2.5", - "Ordinal": 5, - "Description": "Uygulamanın işletim sistemi komut enjeksiyonlarına karşı korunduğu ve işletim sistemi çağrılarında parametreli OS sorguları veya bağlama özgü komut satırı çıktı kodlamasının kullanıldığı doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V1.2.6", - "Ordinal": 6, - "Description": "Uygulamanın LDAP enjeksiyon zafiyetlerine karşı korunduğu ya da LDAP enjeksiyonlarını önlemek için özel güvenlik kontrollerinin uygulandığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V1.2.7", - "Ordinal": 7, - "Description": "XPath enjeksiyon saldırılarına karşı, sorgu parametrelemesi veya önceden derlenmiş sorgular kullanılarak koruma sağlandığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V1.2.8", - "Ordinal": 8, - "Description": "LaTeX işlemcilerinin güvenli şekilde yapılandırıldığı (örneğin, --shell-escape bayrağının kullanılmadığı) ve yalnızca izin verilen komutlardan oluşan bir listeyle çalıştırıldığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V1.2.9", - "Ordinal": 9, - "Description": "Düzenli ifadelerde (regex) özel karakterlerin (genellikle ters eğik çizgi \\ ile) kaçırılarak meta karakter olarak yorumlanmalarının önlendiği doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V1.2.10", - "Ordinal": 10, - "Description": "Uygulamanın CSV ve formül enjeksiyonlarına karşı korunduğu doğrulanmalıdır. Uygulama, CSV içeriği dışa aktarırken RFC 4180 Bölüm 2.6 ve 2.7'de tanımlanan kaçış kurallarına uymalıdır. Ayrıca, CSV veya diğer tablo formatlarına (XLS, XLSX, ODF gibi) aktarım yapılırken, alanın ilk karakteri olarak çıkan özel karakterler ('=', '+', '-', '@', '\\t' (sekme), '\\0' (null karakter)) tek tırnak (') ile kaçırılmalıdır.", - "L": "3" - } - ] - }, - { - "Shortcode": "V1.3", - "Ordinal": 3, - "Name": "Temizleme (Sanitization)", - "Items": [ - { - "Shortcode": "V1.3.1", - "Ordinal": 1, - "Description": "WYSIWYG editörlerinden veya benzer kaynaklardan gelen tüm güvenilmeyen HTML girdilerinin, bilinen ve güvenli bir HTML temizleme kütüphanesi ya da çerçeve özelliği ile temizlendiği doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V1.3.2", - "Ordinal": 2, - "Description": "Uygulamanın eval() veya Spring Expression Language (SpEL) gibi dinamik kod çalıştırma özelliklerini kullanmaktan kaçındığı doğrulanmalıdır. Alternatif yoksa, kullanıcı girdisi çalıştırılmadan önce mutlaka temizlenmelidir.", - "L": "1" - }, - { - "Shortcode": "V1.3.3", - "Ordinal": 3, - "Description": "Potansiyel olarak tehlikeli bir bağlamda kullanılacak verilerin, bu bağlama uygun karakterlere izin vermek ve çok uzun girdileri kısaltmak gibi güvenlik önlemleriyle önceden temizlendiği doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V1.3.4", - "Ordinal": 4, - "Description": "Kullanıcı tarafından sağlanan SVG içeriğinin, yalnızca güvenli etiket ve özellikler (örneğin grafik çizme ile ilgili) içerdiğinden emin olmak için onaylandığı veya temizlendiği doğrulanmalıdır (ör. script veya foreignObject içermemelidir).", - "L": "2" - }, - { - "Shortcode": "V1.3.5", - "Ordinal": 5, - "Description": "Markdown, CSS, XSL stil sayfaları, BBCode veya benzeri ifade şablon dillerinde kullanıcı girdisinin temizlendiği veya bu tür özelliklerin devre dışı bırakıldığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V1.3.6", - "Ordinal": 6, - "Description": "Uygulamanın, güvenilmeyen verileri başka servislere iletmeden önce izinli protokol, alan adı, yol ve port listelerine göre doğruladığı ve tehlikeli karakterleri temizlediği doğrulanarak SSRF (Sunucu Taraflı İstek Sahteciliği) saldırılarına karşı korunduğu doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V1.3.7", - "Ordinal": 7, - "Description": "Uygulamanın şablon enjeksiyon saldırılarına karşı, güvenilmeyen girdilere dayalı şablon oluşturmayı engellediği; eğer bu kaçınılmazsa, bu girdilerin mutlaka temizlendiği veya sıkı şekilde onaylandığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V1.3.8", - "Ordinal": 8, - "Description": "JNDI sorgularında kullanılmadan önce güvenilmeyen girdilerin temizlendiği ve JNDI'nin enjeksiyonlara karşı güvenli şekilde yapılandırıldığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V1.3.9", - "Ordinal": 9, - "Description": "Memcache’e gönderilmeden önce içeriğin temizlenerek enjeksiyon saldırılarına karşı korunduğu doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V1.3.10", - "Ordinal": 10, - "Description": "Format dizgilerinin (format strings) beklenmeyen veya zararlı şekilde çözümlenmesini önlemek için işlenmeden önce temizlendiği doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V1.3.11", - "Ordinal": 11, - "Description": "SMTP veya IMAP enjeksiyonlarını önlemek için, kullanıcı girdisinin posta sistemlerine iletilmeden önce temizlendiği doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V1.3.12", - "Ordinal": 12, - "Description": "Regex girdilerinin üstel geri izlemeye (exponential backtracking) neden olan öğeler içermediği ve güvenilmeyen girdilerin ReDoS (Regex Denial of Service) gibi saldırılara karşı temizlendiği doğrulanmalıdır.", - "L": "3" - } - ] - }, - { - "Shortcode": "V1.4", - "Ordinal": 4, - "Name": "Bellek, Dizgi ve Yönetilmeyen Kod", - "Items": [ - { - "Shortcode": "V1.4.1", - "Ordinal": 1, - "Description": "Yığın, arabellek (buffer) veya yığın belleği taşmalarını önlemek ya da tespit etmek amacıyla, bellek güvenli dizgi işlemlerinin, daha güvenli bellek kopyalama ve işaretçi aritmetiğinin kullanıldığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V1.4.2", - "Ordinal": 2, - "Description": "Tamsayı taşmalarını önlemek için işaret (sign), aralık (range) ve giriş doğrulama tekniklerinin kullanıldığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V1.4.3", - "Ordinal": 3, - "Description": "Dinamik olarak ayrılan belleğin ve kaynakların serbest bırakıldığı ve boşaltılan belleklere ait referansların veya işaretçilerin kaldırıldığı veya null yapıldığı doğrulanmalıdır (dangling pointer ve use-after-free zafiyetlerine karşı).", - "L": "2" - } - ] - }, - { - "Shortcode": "V1.5", - "Ordinal": 5, - "Name": "Güvenli Ters Serileştirme (Safe Deserialization)", - "Items": [ - { - "Shortcode": "V1.5.1", - "Ordinal": 1, - "Description": "XML ayrıştırıcılarının (parser) kısıtlayıcı şekilde yapılandırıldığı ve dış varlık çözümleme (external entity resolution) gibi güvensiz özelliklerin XXE (XML eXternal Entity) saldırılarına karşı devre dışı bırakıldığı doğrulanmalıdır .", - "L": "1" - }, - { - "Shortcode": "V1.5.2", - "Ordinal": 2, - "Description": "Güvenilmeyen verilerin ters serileştirilmesinde, nesne türleri için izinli liste kullanımı veya istemci tanımlı nesne türlerinin kısıtlanması gibi güvenli giriş işleme önlemlerinin uygulandığı doğrulanmalıdır. Güvensiz olarak tanımlanmış ters serileştirme mekanizmaları, güvenilmeyen girdilerle kullanılmamalıdır.", - "L": "2" - }, - { - "Shortcode": "V1.5.3", - "Ordinal": 3, - "Description": "Aynı veri türü için uygulamada kullanılan farklı parser'ların (ör. JSON, XML, URL parser'ları), veriyi tutarlı şekilde ayrıştırdığı ve aynı karakter kodlamasını kullandığı doğrulanmalıdır. Böylece JSON birlikte çalışabilirlik açıkları, URI veya dosya ayrıştırma farkları gibi sorunlar nedeniyle RFI veya SSRF saldırılarının istismar edilmesi önlenir.", - "L": "3" - } - ] - } - ] - }, - { - "Shortcode": "V2", - "Ordinal": 2, - "ShortName": "Validation", - "Name": "Doğrulama ve İş Mantığı", - "Items": [ - { - "Shortcode": "V2.1", - "Ordinal": 1, - "Name": "Doğrulama ve İş Mantığı Dokümantasyonu", - "Items": [ - { - "Shortcode": "V2.1.1", - "Ordinal": 1, - "Description": "Uygulama dokümantasyonunda, veri öğelerinin beklenen yapıya göre nasıl doğrulanacağına ilişkin giriş doğrulama kurallarının tanımlandığı doğrulanmalıdır. Bu; kredi kartı numaraları, e-posta adresleri, telefon numaraları gibi yaygın veri biçimleri olabileceği gibi iç sistemlere özel biçimler de olabilir.", - "L": "1" - }, - { - "Shortcode": "V2.1.2", - "Ordinal": 2, - "Description": "Uygulama dokümantasyonunda, birleştirilmiş veri öğelerinin mantıksal ve bağlamsal tutarlılığının nasıl doğrulanacağı tanımlanmalıdır (örneğin, mahalle ve posta kodunun eşleşip eşleşmediğinin kontrolü).", - "L": "2" - }, - { - "Shortcode": "V2.1.3", - "Ordinal": 3, - "Description": "Hem kullanıcı bazında hem de uygulama genelinde geçerli olacak şekilde, iş mantığı sınırları ve doğrulama beklentilerinin belgelendiği doğrulanmalıdır.", - "L": "2" - } - ] - }, - { - "Shortcode": "V2.2", - "Ordinal": 2, - "Name": "Girdi Doğrulama", - "Items": [ - { - "Shortcode": "V2.2.1", - "Ordinal": 1, - "Description": "Girdilerin, işlevsel ya da iş gereksinimlerine uygunluğunun doğrulandığı teyit edilmelidir. Bu işlem; izinli değerler, desenler ve aralıklar listesine karşı pozitif doğrulama ile ya da girdinin beklenen yapıya ve mantıksal sınırlara uygunluğunun önceden tanımlanmış kurallara göre karşılaştırılması ile yapılmalıdır. Seviye 1 için bu, güvenlik veya iş kararlarında kullanılan girdilere odaklanabilir. Seviye 2 ve üstü için tüm girdilere uygulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V2.2.2", - "Ordinal": 2, - "Description": "Uygulamanın, güvenilir bir servis katmanında girdi doğrulama zorunluluğu uygulayacak şekilde tasarlandığı doğrulanmalıdır. İstemci tarafında gerçekleştirilen doğrulama, kullanılabilirliği artırabilir ve teşvik edilmelidir. Ancak bu doğrulama,güvenlik kontrolü olarak kabul edilmemelidir.", - "L": "1" - }, - { - "Shortcode": "V2.2.3", - "Ordinal": 3, - "Description": "Uygulamanın, ilişkili veri öğelerinin önceden tanımlanmış kurallara göre makul olup olmadığını kontrol ettiği doğrulanmalıdır.", - "L": "2" - } - ] - }, - { - "Shortcode": "V2.3", - "Ordinal": 3, - "Name": "İş Mantığı Güvenliği", - "Items": [ - { - "Shortcode": "V2.3.1", - "Ordinal": 1, - "Description": "Uygulamanın, aynı kullanıcı için iş mantığı akışlarını yalnızca beklenen adım sırasına göre ve adım atlamadan işlediği doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V2.3.2", - "Ordinal": 2, - "Description": "İş mantığı sınırlarının, uygulama dokümantasyonuna uygun şekilde uygulandığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V2.3.3", - "Ordinal": 3, - "Description": "İş mantığı seviyesinde işlemlerin (transaction) kullanıldığı ve bir iş mantığı işleminin ya bütünüyle başarıyla tamamlandığı ya da önceki geçerli duruma geri döndürüldüğü (rollback) doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V2.3.4", - "Ordinal": 4, - "Description": "İş mantığı düzeyinde kilitleme mekanizmalarının, sınırlı kaynakların (ör. sinema koltukları, teslimat zamanları) uygulamanın mantığı manipüle edilerek çift rezervasyona neden olmamasını sağladığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V2.3.5", - "Ordinal": 5, - "Description": "Yüksek değerli iş mantığı akışlarının, yetkisiz veya kazara gerçekleşebilecek işlemleri önlemek için çoklu kullanıcı onayı gerektirdiği doğrulanmalıdır. Bu işlemler büyük para transferleri, sözleşme onayları, gizli bilgilere erişim veya üretimde güvenlik kurallarının geçersiz kılınmaları gibi durumları içerebilir.", - "L": "3" - } - ] - }, - { - "Shortcode": "V2.4", - "Ordinal": 4, - "Name": "Otomasyon Karşıtı Önlemler", - "Items": [ - { - "Shortcode": "V2.4.1", - "Ordinal": 1, - "Description": "Uygulama işlevlerine yönelik aşırı miktardaki çağrılara karşı; veri sızdırma, anlamsız veri üretme, kota tüketme, hız sınırının aşılması, hizmet reddi (DoS) ya da maliyetli kaynakların aşırı kullanımı gibi risklere karşı otomasyon karşıtı kontrollerin bulunduğu doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V2.4.2", - "Ordinal": 2, - "Description": "İş mantığı akışlarının, aşırı hızlı işlem gönderimlerini önleyecek şekilde gerçekçi insan zamanlaması gerektirdiği doğrulanmalıdır.", - "L": "3" - } - ] - } - ] - }, - { - "Shortcode": "V3", - "Ordinal": 3, - "ShortName": "Web", - "Name": "Web Ön Uç (Frontend) Güvenliği", - "Items": [ - { - "Shortcode": "V3.1", - "Ordinal": 1, - "Name": "Web Frontend Güvenlik Dokümantasyonu", - "Items": [ - { - "Shortcode": "V3.1.1", - "Ordinal": 1, - "Description": "Uygulama dokümantasyonunda, uygulamayı kullanan tarayıcıların desteklemesi gereken güvenlik özelliklerinin (ör. HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) ve diğer ilgili HTTP güvenlik mekanizmaları) tanımlandığı doğrulanmalıdır. Ayrıca bu özelliklerin mevcut olmadığı durumlarda uygulamanın nasıl davranması gerektiği (ör. kullanıcıyı uyarmak veya erişimi engellemek) de tanımlanmalıdır.", - "L": "3" - } - ] - }, - { - "Shortcode": "V3.2", - "Ordinal": 2, - "Name": "İçeriğin Yanlış Yorumlanması", - "Items": [ - { - "Shortcode": "V3.2.1", - "Ordinal": 1, - "Description": "Tarayıcıların HTTP yanıtlarında içerik veya işlevi yanlış bir bağlamda sunmalarını önlemek amacıyla güvenlik kontrollerinin uygulandığı doğrulanmalıdır (ör. API, kullanıcı tarafından yüklenen dosya veya başka bir kaynağın doğrudan çağrılması durumunda). Olası kontroller arasında; yalnızca HTTP istek başlıklarının (ör. Sec-Fetch-\\*) doğru bağlamı gösterdiği durumlarda içeriğin sunulması, Content-Security-Policy başlığında \"sandbox\" yönergesinin kullanılması veya Content-Disposition başlığında \"attachment\" biçiminin kullanılması yer alabilir.", - "L": "1" - }, - { - "Shortcode": "V3.2.2", - "Ordinal": 2, - "Description": "HTML yerine metin olarak görüntülenmesi amaçlanan içeriğin, HTML veya JavaScript gibi içeriklerin istenmeden çalıştırılmasını önleyecek şekilde \"createTextNode\" veya \"textContent\" gibi güvenli işleme fonksiyonlarıyla işlendiği doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V3.2.3", - "Ordinal": 3, - "Description": "Uygulamanın istemci tarafı JavaScript kullanırken açık değişken tanımlamaları yaparak, sıkı tür kontrolü uygulayarak, global değişkenleri document nesnesine kaydetmekten kaçınarak ve ad alanı izolasyonu sağlayarak DOM clobbering’den kaçındığı doğrulanmalıdır.", - "L": "3" - } - ] - }, - { - "Shortcode": "V3.3", - "Ordinal": 3, - "Name": "Çerez Yapılandırması", - "Items": [ - { - "Shortcode": "V3.3.1", - "Ordinal": 1, - "Description": "Çerezlerin 'Secure' niteliğine sahip olduğu ve eğer çerez adı '\\__Host-' ön eki ile başlamıyorsa, '__Secure-' ön ekinin kullanıldığı doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V3.3.2", - "Ordinal": 2, - "Description": "Kullanıcı arayüzü kandırma saldırılarına ve tarayıcı tabanlı istek sahteciliği saldırılarına (CSRF) karşı koruma sağlamak amacıyla, her çerezin 'SameSite' niteliğinin kullanım amacına uygun şekilde ayarlandığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V3.3.3", - "Ordinal": 3, - "Description": "Çerez adı, diğer sunucularla paylaşılmak üzere açıkça tasarlanmadığı sürece '__Host-' ön eki ile tanımlanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V3.3.4", - "Ordinal": 4, - "Description": "Bir çerez değeri istemci tarafı betikleri tarafından erişilememesi gereken bir veri içeriyorsa (ör. oturum token'ı), çerezin 'HttpOnly' niteliğine sahip olduğu ve aynı değerin (ör. oturum token'ı) yalnızca 'Set-Cookie' başlığı ile istemciye iletildiği doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V3.3.5", - "Ordinal": 5, - "Description": "Uygulama bir çerez oluştururken, çerez adı ve değerinin toplam uzunluğunun 4096 baytı aşmadığı doğrulanmalıdır. Çok büyük çerezler tarayıcı tarafından saklanmaz ve isteklerle gönderilmez; bu da çereze bağlı çalışan uygulama işlevlerinin bozulmasına yol açabilir.", - "L": "3" - } - ] - }, - { - "Shortcode": "V3.4", - "Ordinal": 4, - "Name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", - "Items": [ - { - "Shortcode": "V3.4.2", - "Ordinal": 2, - "Description": "Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header'ı, uygulama tarafından sabit bir değer olarak tanımlanmalı veya gelen Origin header değeri güvenilir origin’lerden oluşan bir izinli listeye karşı doğrulanmalıdır. ‘Access-Control-Allow-Origin: *’ kullanılması gerekiyorsa, yanıtın hassas bilgi içermediği doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V3.4.3", - "Ordinal": 3, - "Description": "HTTP yanıtlarında Content-Security-Policy header'ı bulunduğu ve bu header'ın yalnızca güvenilen içeriklerin veya kaynakların yüklenmesini ve çalıştırılmasını sağlayan yönergeler içerdiği doğrulanmalıdır. Minimum olarak \"global policy\", object-src 'none', base-uri 'none' yönergelerini içermeli ve izinli liste, nonce veya hash temelli bir yapı içermelidir. Seviye 3 uygulamalarında her yanıt için nonce veya hash içeren özel bir politika tanımlanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V3.4.4", - "Ordinal": 4, - "Description": "Tüm HTTP yanıtlarının 'X-Content-Type-Options: nosniff' header'ını içerdiği doğrulanmalıdır. Bu, tarayıcıya içerik türünü tahmin etmeyi bırakmasını ve yanıtın Content-Type header'ında belirtilen MIME türünün, beklenen kaynak türüyle eşleşmesini zorunlu kılar. Ayrıca bu, tarayıcıda CORB (Cross-Origin Read Blocking) özelliğini etkinleştirir.", - "L": "2" - }, - { - "Shortcode": "V3.4.5", - "Ordinal": 5, - "Description": "Uygulamanın, 'Referer' başlığı yoluyla üçüncü taraflara teknik olarak hassas verilerin sızmasını önlemek için bir 'referrer policy' belirlediği doğrulanmalıdır. Bu, Referrer-Policy HTTP header'ıyla veya HTML öğe nitelikleriyle (element attributes) sağlanabilir. Sızabilecek hassas bilgiler, URL’deki yol ve sorgu parametreleri ile sınırlı uygulamalarda hostname bilgisini içerebilir.", - "L": "2" - }, - { - "Shortcode": "V3.4.6", - "Ordinal": 6, - "Description": "Uygulamanın, Content-Security-Policy header'ı altında 'frame-ancestors' yönergesini her HTTP yanıtında tanımladığı ve bu sayede içeriklerin varsayılan olarak başka sayfalara gömülmesini engellediği doğrulanmalıdır. Gerekli durumlarda özel olarak izin verildiğinden emin olunmalıdır. 'X-Frame-Options' header'ı, tarayıcılar tarafından desteklenmesine rağmen, artık güncel değildir ve güvenlik amacıyla kullanılmamalıdır.", - "L": "2" - }, - { - "Shortcode": "V3.4.8", - "Ordinal": 8, - "Description": "Bir belgenin işlenmesini ve sunulmasını başlatan tüm HTTP yanıtlarında (örneğin 'text/html' tipi yanıtlar), 'Cross-Origin-Opener-Policy' header'ı 'same-origin' veya 'same-origin-allow-popups' yönergeleriyle birlikte yer almalıdır. Bu, tabnabbing ve frame counting gibi, pencere nesnelerine paylaşımlı erişimi sömüren saldırılara karşı koruma sağlar.", - "L": "3" - } - ] - }, - { - "Shortcode": "V3.5", - "Ordinal": 5, - "Name": "Tarayıcı Menşei Ayırımı", - "Items": [ - { - "Shortcode": "V3.5.1", - "Ordinal": 1, - "Description": "Uygulama, hassas işlevselliğe yönelik izinsiz cross-origin istekleri önlemek için CORS preflight mekanizmasına güvenmiyorsa, bu tür isteklerin gerçekten uygulamadan geldiği doğrulanmalıdır. Bu, anti-forgery token kullanımı veya CORS tarafından güvenli kabul edilmeyen özel HTTP header'larının zorunlu kılınmasıyla yapılabilir. Bu, tarayıcı tabanlı istek sahteciliği (CSRF) saldırılarına karşı bir savunmadır.", - "L": "1" - }, - { - "Shortcode": "V3.5.2", - "Ordinal": 2, - "Description": "Uygulama, hassas işlevlerin izinsiz cross-origin çağrılmasını önlemek için CORS preflight mekanizmasına güveniyorsa, bu işlevlerin bir CORS-preflight isteğini tetiklemeden çağrılamadığı doğrulanmalıdır. Bu, 'Origin' ve 'Content-Type' header'larının doğrulanmasını veya CORS-safelisted olmayan bir header'ın ve alanın kullanılmasını gerektirebilir.", - "L": "1" - }, - { - "Shortcode": "V3.5.4", - "Ordinal": 4, - "Description": "Farklı uygulamaların farklı hostname'lerde barındırıldığı ve böylece Same-Origin Policy tarafından sağlanan kısıtlamalardan (örneğin çerez erişim sınırları, kaynaklar arası etkileşim kontrolleri) faydalanıldığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V3.5.6", - "Ordinal": 6, - "Description": "Uygulamanın herhangi bir yerinde JSONP işlevselliğinin etkin olmadığı doğrulanmalıdır. Bu, XSSI (Cross-Site Script Inclusion) saldırılarını önlemek içindir.", - "L": "3" - }, - { - "Shortcode": "V3.5.7", - "Ordinal": 7, - "Description": "Yetkilendirme gerektiren verilerin, JavaScript dosyaları gibi betik kaynaklarının yanıtlarında yer almadığı, XSSI saldırılarını önlemek için doğrulanmalıdır.", - "L": "3" - }, - { - "Shortcode": "V3.5.8", - "Ordinal": 8, - "Description": "Kimliği doğrulanmış kaynakların (örneğin görseller, videolar, betikler ve belgeler) yalnızca gerçekten amaçlandığında kullanıcı adına yüklenebildiği veya gömülebildiği doğrulanmalıdır. Bu, isteğin uygun olmayan bir çapraz kaynak çağrısından kaynaklanmadığından emin olmak için Sec-Fetch-* HTTP istek başlığı alanlarının sıkı bir şekilde doğrulanmasıyla veya tarayıcıya döndürülen içeriği engelleme talimatı vermek için kısıtlayıcı bir Cross-Origin-Resource-Policy HTTP yanıt başlığı alanı ayarlayarak gerçekleştirilebilir.", - "L": "3" - } - ] - }, - { - "Shortcode": "V3.6", - "Ordinal": 6, - "Name": "Harici Kaynak Bütünlüğü", - "Items": [ - { - "Shortcode": "V3.6.1", - "Ordinal": 1, - "Description": "JavaScript kütüphaneleri, CSS veya web fontları gibi istemci tarafı varlıkların yalnızca statik ve sürümlü olması, varlığın bütünlüğünü doğrulamak için Subresource Integrity (SRI) kullanılması durumunda harici olarak (örneğin, bir İçerik Dağıtım Ağı üzerinde) barındırıldığı doğrulanmalıdır. Bu mümkün değilse, her bir kaynak için bunu gerekçelendiren belgelenmiş bir güvenlik kararı bulunmalıdır.", - "L": "3" - } - ] - }, - { - "Shortcode": "V3.7", - "Ordinal": 7, - "Name": "Diğer Tarayıcı Güvenliği Hususları", - "Items": [ - { - "Shortcode": "V3.7.1", - "Ordinal": 1, - "Description": "Uygulamanın yalnızca hâlâ desteklenen ve güvenli kabul edilen istemci tarafı teknolojileri kullandığı doğrulanmalıdır. Bu gereksinimi karşılamayan teknolojilere örnek olarak NSAPI eklentileri, Flash, Shockwave, ActiveX, Silverlight, NACL veya istemci tarafı Java applet’leri verilebilir.", - "L": "2" - }, - { - "Shortcode": "V3.7.2", - "Ordinal": 2, - "Description": "Uygulamanın, yalnızca hedef adres bir izinli listede yer alıyorsa kullanıcıyı otomatik olarak farklı bir ana makine adına veya uygulamanın kontrolünde olmayan bir etki alanına yönlendirdiği doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V3.7.3", - "Ordinal": 3, - "Description": "Uygulamanın, kullanıcı uygulamanın kontrolü dışındaki bir URL’ye yönlendirildiğinde, yönlendirme hakkında bir bildirim gösterdiği ve kullanıcının bu gezintiyi iptal edebilmesi için bir seçenek sunduğu doğrulanmalıdır.", - "L": "3" - }, - { - "Shortcode": "V3.7.4", - "Ordinal": 4, - "Description": "Uygulamanın en üst düzey etki alanının (örneğin, site.tld) HTTP Strict Transport Security (HSTS) için genel preload listesine eklendiği doğrulanmalıdır. Bu, uygulamanın TLS kullanımının ana tarayıcılar tarafından doğrudan tanınmasını ve yalnızca Strict-Transport-Security yanıt header'ına bağlı kalınmamasını sağlar.", - "L": "3" - }, - { - "Shortcode": "V3.7.5", - "Ordinal": 5, - "Description": "Uygulamaya erişen tarayıcının beklenen güvenlik özelliklerini desteklememesi durumunda, uygulamanın dokümantasyona uygun şekilde davrandığı (örneğin kullanıcıyı uyarma veya erişimi engelleme) doğrulanmalıdır.", - "L": "3" - } - ] - } - ] - }, - { - "Shortcode": "V4", - "Ordinal": 4, - "ShortName": "API", - "Name": "API ve Web Servisi", - "Items": [ - { - "Shortcode": "V4.1", - "Ordinal": 1, - "Name": "Genel Web Servisi Güvenliği", - "Items": [ - { - "Shortcode": "V4.1.1", - "Ordinal": 1, - "Description": "İleti gövdesi içeren her HTTP yanıtında, yanıtın gerçek içeriğiyle eşleşen bir Content-Type header alanı bulunduğu ve güvenli karakter kodlamasını (örneğin, UTF-8, ISO-8859-1) belirtmek üzere charset parametresi içerdiği doğrulanmalıdır. Bu işlem, IANA Medya Türleri'nden \"text/\", \"/+xml\" ve \"/xml\" gibi içerikler için geçerlidir.", - "L": "1" - }, - { - "Shortcode": "V4.1.2", - "Ordinal": 2, - "Description": "Yalnızca kullanıcı arayüzüne yönelik uç noktaların (manuel olarak web tarayıcısı ile erişilmesi amaçlanan) otomatik olarak HTTP'den HTTPS'e yönlendirme yaptığı ve diğer hizmetlerin veya uç noktaların şeffaf yönlendirme gerçekleştirmediği doğrulanmalıdır. Bu, istemcinin farkında olmadan şifrelenmemiş HTTP istekleri göndermesi ve bu isteklerin otomatik olarak HTTPS'e yönlendirilmesi sonucunda hassas verilerin sızmasının fark edilmemesi riskini önlemek içindir.", - "L": "2" - }, - { - "Shortcode": "V4.1.3", - "Ordinal": 3, - "Description": "Uygulama tarafından kullanılan ve yük dengeleyici, web proxy veya frontend için backend hizmeti gibi bir ara katman tarafından ayarlanan herhangi bir HTTP başlık alanının, son kullanıcı tarafından geçersiz kılınamayacağı doğrulanmalıdır. Örnek başlıklar arasında X-Real-IP, X-Forwarded-* veya X-User-ID yer alabilir.", - "L": "2" - }, - { - "Shortcode": "V4.1.4", - "Ordinal": 4, - "Description": "Uygulama veya API tarafından açıkça desteklenen HTTP yöntemlerinin (preflight istekleri sırasında OPTIONS dahil) dışında hiçbir yöntemin kullanılmadığı ve kullanılmayan yöntemlerin engellendiği doğrulanmalıdır.", - "L": "3" - }, - { - "Shortcode": "V4.1.5", - "Ordinal": 5, - "Description": "Çok hassas istekler veya birçok sistemden geçen işlemler için, taşıma katmanı güvenliğinin üzerine ek bir güvence sağlamak amacıyla, her iletiye özel dijital imzaların kullanıldığı doğrulanmalıdır.", - "L": "3" - } - ] - }, - { - "Shortcode": "V4.2", - "Ordinal": 2, - "Name": "HTTP İleti Yapısı Doğrulama", - "Items": [ - { - "Shortcode": "V4.2.1", - "Ordinal": 1, - "Description": "Tüm uygulama bileşenlerinin (yük dengeleyiciler, güvenlik duvarları ve uygulama sunucuları dahil) HTTP sürümüne uygun mekanizmaları kullanarak gelen HTTP iletilerinin sınırlarını belirlediği ve bu sayede HTTP istek kaçakçılığına karşı koruma sağlandığı doğrulanmalıdır. HTTP/1.x sürümünde Transfer-Encoding başlık alanı varsa, RFC 2616'ya göre Content-Length başlığı göz ardı edilmelidir. HTTP/2 veya HTTP/3 kullanıldığında, Content-Length başlığı varsa, alıcının bu değerin DATA çerçevelerinin uzunluğuyla tutarlı olduğunu doğrulaması gerekir.", - "L": "2" - }, - { - "Shortcode": "V4.2.2", - "Ordinal": 2, - "Description": "HTTP iletileri üretilirken, Content-Length başlığının, HTTP protokolünün çerçeveleme yöntemine göre belirlenen içerik uzunluğu ile çelişmediği doğrulanmalıdır. Bu, istek kaçakçılığı saldırılarını önlemek için gereklidir.", - "L": "3" - }, - { - "Shortcode": "V4.2.3", - "Ordinal": 3, - "Description": "Uygulamanın, yanıt bölme ve header enjeksiyonu saldırılarını önlemek amacıyla, bağlantıya özel başlık alanları (örneğin Transfer-Encoding) içeren HTTP/2 veya HTTP/3 iletilerini göndermediği ve kabul etmediği doğrulanmalıdır.", - "L": "3" - }, - { - "Shortcode": "V4.2.4", - "Ordinal": 4, - "Description": "Uygulamanın yalnızca başlık alanları ve değerleri CR (\\r), LF (\\n) veya CRLF (\\r\\n) karakter dizileri içermeyen HTTP/2 ve HTTP/3 isteklerini kabul ettiği doğrulanmalıdır. Bu, başlık enjeksiyonu saldırılarını önlemek içindir.", - "L": "3" - }, - { - "Shortcode": "V4.2.5", - "Ordinal": 5, - "Description": "Uygulama (backend veya frontend) istek oluşturuyor ve gönderiyorsa, URI'ler (örneğin API çağrıları için) veya HTTP istek başlıkları (örneğin Authorization veya Cookie) gibi bileşenlerin, alıcı sistemler tarafından kabul edilemeyecek kadar uzun olmamasını sağlamak amacıyla doğrulama, temizleme veya diğer mekanizmaları kullandığı doğrulanmalıdır. Bu tür çok uzun istekler (örneğin çok uzun bir Cookie başlığı) gönderildiğinde sunucunun sürekli hata durumu döndürmesiyle hizmet reddi oluşabilir.", - "L": "3" - } - ] - }, - { - "Shortcode": "V4.3", - "Ordinal": 3, - "Name": "GraphQL", - "Items": [ - { - "Shortcode": "V4.3.1", - "Ordinal": 1, - "Description": "Maliyetli ve iç içe geçmiş sorgular sonucu oluşabilecek GraphQL veya veri katmanı ifadelerine yönelik Hizmet Reddi (DoS) saldırılarını önlemek için, sorgu izin listesi (allowlist), derinlik sınırlandırması, sorgu sayısı sınırlandırması veya sorgu maliyeti analizi kullanıldığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V4.3.2", - "Ordinal": 2, - "Description": "GraphQL introspection (iç yapı sorgulama) sorgularının, GraphQL API'nin üçüncü taraflar tarafından kullanılmasına yönelik olmadığı sürece, üretim ortamında devre dışı bırakıldığı doğrulanmalıdır.", - "L": "2" - } - ] - }, - { - "Shortcode": "V4.4", - "Ordinal": 4, - "Name": "WebSocket", - "Items": [ - { - "Shortcode": "V4.4.1", - "Ordinal": 1, - "Description": "Tüm WebSocket bağlantılarında TLS üzerinden WebSocket (WSS) kullanıldığı doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V4.4.2", - "Ordinal": 2, - "Description": "WebSocket'in başlangıçtaki HTTP el sıkışması (handshake) sırasında, Origin başlık alanının uygulama için izin verilen origin listesiyle karşılaştırılarak kontrol edildiği doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V4.4.3", - "Ordinal": 3, - "Description": "Uygulamanın standart oturum yönetimi kullanılamıyorsa, bunun yerine ilgili Oturum Yönetimi güvenlik gereksinimlerine uygun özel token'ların kullanıldığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V4.4.4", - "Ordinal": 4, - "Description": "HTTPS oturumu WebSocket kanalına geçerken, özel WebSocket oturum yönetim token’larının önceki şekilde kimliği doğrulanmış HTTPS oturumu aracılığıyla elde edildiği veya doğrulandığı doğrulanmalıdır.", - "L": "2" - } - ] - } - ] - }, - { - "Shortcode": "V5", - "Ordinal": 5, - "ShortName": "File", - "Name": "Dosya İşleme", - "Items": [ - { - "Shortcode": "V5.1", - "Ordinal": 1, - "Name": "Dosya İşleme Dokümantasyonu", - "Items": [ - { - "Shortcode": "V5.1.1", - "Ordinal": 1, - "Description": "Dokümantasyonun, her yükleme özelliği için izin verilen dosya türlerini, beklenen dosya uzantılarını ve maksimum boyutu (açılmış hali dahil) tanımladığı doğrulanmalıdır. Ayrıca, dosyaların son kullanıcılar için nasıl güvenli hâle getirileceği (örneğin kötü amaçlı bir dosya tespit edildiğinde uygulamanın nasıl davranacağı) gibi bilgilerin de belgede yer aldığı doğrulanmalıdır.", - "L": "2" - } - ] - }, - { - "Shortcode": "V5.2", - "Ordinal": 2, - "Name": "Dosya Yükleme ve İçerik", - "Items": [ - { - "Shortcode": "V5.2.1", - "Ordinal": 1, - "Description": "Uygulamanın, yalnızca performans kaybına veya hizmet reddine yol açmayacak boyuttaki dosyaları kabul ettiği doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V5.2.2", - "Ordinal": 2, - "Description": "Uygulama bir dosyayı, doğrudan veya bir arşiv (ör. zip dosyası) içinde kabul ettiğinde, dosya uzantısının beklenen uzantıyla eşleşip eşleşmediğini kontrol ettiği ve içeriğin uzantı tarafından temsil edilen türle uyumlu olduğunu doğruladığı kontrol edilmelidir. Bu; ilk 'magic byte' kontrolü, görüntü yeniden yazımı ve dosya içeriği doğrulama için özel kütüphanelerin kullanımı gibi yöntemleri içerir. Seviye 1 için bu, yalnızca iş veya güvenlik kararlarında kullanılan dosyalarla sınırlı olabilir. Seviye 2 ve üzeri için tüm dosyalar bu kontrole tabi olmalıdır.", - "L": "1" - }, - { - "Shortcode": "V5.2.3", - "Ordinal": 3, - "Description": "Sıkıştırılmış dosyaların (ör. zip, gz, docx, odt) açılmadan önce, izin verilen maksimum açılmış boyuta ve maksimum dosya sayısına göre kontrol edildiği doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V5.2.4", - "Ordinal": 4, - "Description": "Her kullanıcı için dosya boyutu kotası ve maksimum dosya sayısının uygulandığı doğrulanmalıdır. Böylece tek bir kullanıcının çok sayıda veya aşırı büyük dosya yükleyerek depolama alanını doldurması engellenir.", - "L": "3" - }, - { - "Shortcode": "V5.2.5", - "Ordinal": 5, - "Description": "Uygulamanın, içinde sembolik bağlantılar (symlink) bulunan sıkıştırılmış dosyaların yüklenmesine yalnızca bu durum özel olarak gerekli olduğunda izin verdiği doğrulanmalıdır. Bu durumda, sembolik bağlantı verilebilecek dosyaların bir izinli listesi uygulanmalıdır.", - "L": "3" - }, - { - "Shortcode": "V5.2.6", - "Ordinal": 6, - "Description": "Uygulamanın, piksel boyutu izin verilen maksimum değeri aşan görüntü dosyalarının yüklenmesini reddettiği doğrulanmalıdır. Bu, pixel flood saldırılarını önlemek için gereklidir.", - "L": "3" - } - ] - }, - { - "Shortcode": "V5.3", - "Ordinal": 3, - "Name": "Dosya Depolama", - "Items": [ - { - "Shortcode": "V5.3.1", - "Ordinal": 1, - "Description": "Güvenilmeyen girdilerle yüklenen veya oluşturulan ve herkese açık klasörlerde depolanan dosyaların, bir HTTP isteğiyle doğrudan erişildiğinde sunucu taraflı program kodu olarak çalıştırılmadığı doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V5.3.2", - "Ordinal": 2, - "Description": "Uygulamanın, dosya işlemleri için dosya yollarını oluştururken kullanıcı tarafından gönderilen dosya adlarını değil, dahili olarak oluşturulan veya güvenilir verileri kullandığı; eğer kullanıcı tarafından gönderilen dosya adları veya meta veriler kullanılacaksa, sıkı doğrulama ve temizleme işlemlerinin uygulandığı doğrulanmalıdır. Bu, yol geçişi (path traversal), yerel veya uzak dosya dahil etme (LFI, RFI) ve sunucu tarafı istek sahteciliği (SSRF) saldırılarına karşı koruma sağlar.", - "L": "1" - }, - { - "Shortcode": "V5.3.3", - "Ordinal": 3, - "Description": "Sunucu tarafında gerçekleşen dosya işlemlerinin (örneğin dosya açma/decompress işlemi), kullanıcı tarafından sağlanan yol bilgilerini yok saydığı ve zip slip gibi güvenlik açıklarını önlediği doğrulanmalıdır.", - "L": "3" - } - ] - }, - { - "Shortcode": "V5.4", - "Ordinal": 4, - "Name": "Dosya İndirme", - "Items": [ - { - "Shortcode": "V5.4.1", - "Ordinal": 1, - "Description": "Uygulamanın, kullanıcı tarafından gönderilen dosya adlarını (ör. JSON, JSONP veya URL parametresinde) doğruladığı veya göz ardı ettiği ve yanıtın Content-Disposition başlık alanında bir dosya adı belirttiği doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V5.4.2", - "Ordinal": 2, - "Description": "Sunulan dosya adlarının (örneğin HTTP yanıt header'larında veya e-posta eklerinde), belge yapısını korumak ve enjeksiyon saldırılarını önlemek için kodlandığı veya temizlendiği (ör. RFC 6266’ya uygun) doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V5.4.3", - "Ordinal": 3, - "Description": "Güvenilmeyen kaynaklardan elde edilen dosyaların, bilinen kötü amaçlı içeriklerin sunulmasını önlemek amacıyla antivirüs tarayıcılarıyla tarandığı doğrulanmalıdır.", - "L": "2" - } - ] - } - ] - }, - { - "Shortcode": "V6", - "Ordinal": 6, - "ShortName": "Authentication", - "Name": "Kimlik Doğrulama", - "Items": [ - { - "Shortcode": "V6.1", - "Ordinal": 1, - "Name": "Kimlik Doğrulama Dokümantasyonu", - "Items": [ - { - "Shortcode": "V6.1.1", - "Ordinal": 1, - "Description": "Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırılarına karşı oran sınırlama (rate limiting), otomasyon karşıtı önlemler ve uyarlanabilir yanıt gibi kontrollerin nasıl kullanıldığını açıklayan bir uygulama dokümantasyonu bulunduğu doğrulanmalıdır. Dokümantasyon, bu kontrollerin nasıl yapılandırıldığını ve kötü niyetli hesap kilitlemenin nasıl önlendiğini açıkça ortaya koymalıdır.", - "L": "1" - }, - { - "Shortcode": "V6.1.2", - "Ordinal": 2, - "Description": "Parolalarda kullanılmasını önlemek amacıyla, bağlama özgü sözcüklerin (örneğin kurum adlarının permütasyonları, ürün adları, sistem tanımlayıcıları, proje kod adları, departman veya rol adları vb.) bulunduğu belgelenmiş bir liste mevcut olduğu doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V6.1.3", - "Ordinal": 3, - "Description": "Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, bunların tümünün belgelenmiş olduğu ve her yol için tutarlı şekilde uygulanması gereken güvenlik kontrolleri ile kimlik doğrulama gücünün tanımlandığı doğrulanmalıdır.", - "L": "2" - } - ] - }, - { - "Shortcode": "V6.2", - "Ordinal": 2, - "Name": "Parola Güvenliği", - "Items": [ - { - "Shortcode": "V6.2.1", - "Ordinal": 1, - "Description": "Kullanıcı tarafından belirlenen parolaların en az 8 karakter uzunluğunda olması sağlanmalı, ancak 15 karakter ve üzeri uzunlukta parolalar olmaları şiddetle tavsiye edilir.", - "L": "1" - }, - { - "Shortcode": "V6.2.2", - "Ordinal": 2, - "Description": "Kullanıcıların parolalarını değiştirebilmeleri sağlanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V6.2.3", - "Ordinal": 3, - "Description": "Parola değiştirme işlevinin hem mevcut hem de yeni parolayı gerektirdiği doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V6.2.4", - "Ordinal": 4, - "Description": "Kayıt veya parola değişimi sırasında girilen parolaların, uygulamanın parola politikasına (örneğin minimum uzunluk) uyan ilk 3000 yaygın parolaya karşı kontrol edildiği doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V6.2.5", - "Ordinal": 5, - "Description": "Her tür karakterin kullanılmasına izin verildiği ve büyük/küçük harf, sayı veya özel karakter şartlarının zorunlu tutulmadığı doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V6.2.6", - "Ordinal": 6, - "Description": "Parola giriş alanlarının, girdiyi maskelemek için \"type=password\" kullandığı doğrulanmalıdır. Uygulamalar, kullanıcının tüm maskelenmiş parolayı ya da son girilen karakteri geçici olarak görüntülemesine izin verebilir.", - "L": "1" - }, - { - "Shortcode": "V6.2.7", - "Ordinal": 7, - "Description": "\"Yapıştır\" özelliğinin, tarayıcı parola yardımcılarının ve harici parola yöneticilerinin kullanımına izin verildiği doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V6.2.8", - "Ordinal": 8, - "Description": "Uygulamanın, kullanıcıdan aldığı parolayı herhangi bir şekilde değiştirmeden, örneğin kesmeden veya harf büyüklüğünü değiştirmeden, tam olarak doğruladığı teyit edilmelidir.", - "L": "1" - }, - { - "Shortcode": "V6.2.9", - "Ordinal": 9, - "Description": "En az 64 karakter uzunluğundaki parolalara izin verildiği doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V6.2.10", - "Ordinal": 10, - "Description": "Kullanıcının parolasının, yalnızca ele geçirildiği tespit edildiğinde veya kullanıcı tarafından yenilendiğinde geçerliliğini yitirdiği doğrulanmalıdır. Uygulama, belirli aralıklarla parola yenilenmesini zorunlu kılmamalıdır.", - "L": "2" - }, - { - "Shortcode": "V6.2.11", - "Ordinal": 11, - "Description": "Tahmin edilmesi kolay parolaların oluşturulmasını önlemek amacıyla, bağlama özgü kelimelerin yer aldığı belgelenmiş listenin parola doğrulamada kullanıldığı teyit edilmelidir.", - "L": "2" - }, - { - "Shortcode": "V6.2.12", - "Ordinal": 12, - "Description": "Kayıt veya parola değişikliği sırasında girilen parolaların, ele geçirilmiş parolalar listesine karşı kontrol edildiği doğrulanmalıdır.", - "L": "2" - } - ] - }, - { - "Shortcode": "V6.3", - "Ordinal": 3, - "Name": "Genel Kimlik Doğrulama Güvenliği", - "Items": [ - { - "Shortcode": "V6.3.1", - "Ordinal": 1, - "Description": "Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırıları gibi saldırıları önlemeye yönelik kontrollerin, uygulamanın güvenlik dokümantasyonuna göre uygulandığı doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V6.3.2", - "Ordinal": 2, - "Description": "\"root\", \"admin\" veya \"sa\" gibi varsayılan kullanıcı hesaplarının uygulamada yer almadığı veya devre dışı bırakıldığı doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V6.3.3", - "Ordinal": 3, - "Description": "Uygulamaya erişim için ya çok faktörlü bir kimlik doğrulama mekanizması ya da tek faktörlü mekanizmaların kombinasyonu kullanılmalıdır. Seviye 3 için, bu faktörlerden biri, oltalama saldırılarına karşı direnç sağlayan ve kimlik doğrulama niyetini bir kullanıcı etkileşimi (örneğin FIDO donanım anahtarında bir düğmeye basma veya mobil telefonda bir onay) gerektirerek doğrulayan donanım tabanlı bir kimlik doğrulayıcı olmalıdır. Bu gereksinimdeki herhangi bir esneklik için, gerekçesi belgelenmiş ve riskleri azaltıcı kapsamlı kontroller içeren bir plan gereklidir.", - "L": "2" - }, - { - "Shortcode": "V6.3.4", - "Ordinal": 4, - "Description": "Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, belgelendirilmemiş bir yol bulunmadığı ve tüm yollar için güvenlik kontrolleri ile kimlik doğrulama gücünün tutarlı şekilde uygulandığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V6.3.5", - "Ordinal": 5, - "Description": "Başarılı veya başarısız şüpheli kimlik doğrulama girişimlerinin kullanıcıya bildirildiği doğrulanmalıdır. Bu, olağandışı bir konum veya istemciden gelen girişimler, yalnızca bir faktörle yapılan kısmen başarılı doğrulamalar, uzun süreli inaktiflik sonrası yapılan girişimler veya birçok başarısız denemeden sonraki başarılı girişimler gibi durumları içerebilir.", - "L": "3" - }, - { - "Shortcode": "V6.3.6", - "Ordinal": 6, - "Description": "E-postanın, tek faktörlü ya da çok faktörlü kimlik doğrulama mekanizması olarak kullanılmadığı doğrulanmalıdır.", - "L": "3" - }, - { - "Shortcode": "V6.3.7", - "Ordinal": 7, - "Description": "Kimlik doğrulama detaylarında yapılan güncellemeler sonrasında (örneğin kimlik bilgisi sıfırlama, kullanıcı adı veya e-posta adresi değişiklikleri), kullanıcıların bilgilendirildiği doğrulanmalıdır.", - "L": "3" - }, - { - "Shortcode": "V6.3.8", - "Ordinal": 8, - "Description": "Başarısız kimlik doğrulama girişimlerinden, geçerli kullanıcıların hata mesajları, HTTP yanıt kodları veya farklı yanıt süreleri gibi sonuçlara dayanarak tespit edilemediği doğrulanmalıdır. Bu koruma, kayıt ve \"parolamı unuttum\" işlevselliğinde de geçerli olmalıdır.", - "L": "3" - } - ] - }, - { - "Shortcode": "V6.4", - "Ordinal": 4, - "Name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", - "Items": [ - { - "Shortcode": "V6.4.1", - "Ordinal": 1, - "Description": "Sistem tarafından oluşturulan ilk parolaların veya etkinleştirme kodlarının güvenli bir şekilde rastgele üretildiği, mevcut parola politikasına uygun olduğu, kısa bir süre içinde veya ilk kullanım sonrasında geçerliliğini yitirdiği doğrulanmalıdır. Bu başlangıç sırları uzun vadeli parola olarak kullanılmasına izin verilmemelidir.", - "L": "1" - }, - { - "Shortcode": "V6.4.2", - "Ordinal": 2, - "Description": "Parola ipuçlarının veya \"gizli sorular\" olarak bilinen, bilgiye dayalı kimlik doğrulama mekanizmalarının mevcut olmadığı doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V6.4.3", - "Ordinal": 3, - "Description": "Unutulmuş parolanın sıfırlanması için, etkin olan çok faktörlü kimlik doğrulama mekanizmalarını atlamayan güvenli bir sürecin uygulandığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V6.4.4", - "Ordinal": 4, - "Description": "Çok faktörlü kimlik doğrulama faktörlerinden biri kaybolursa, kayıt sırasında uygulanan kimlik kanıtlama seviyesiyle aynı seviyede kimlik doğrulama yapıldığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V6.4.5", - "Ordinal": 5, - "Description": "Süresi dolacak kimlik doğrulama mekanizmalarının yenilenmesine ilişkin talimatların, süresi dolmadan önce tamamlanacak şekilde yeterli sürede gönderildiği ve gerekiyorsa otomatik hatırlatıcıların yapılandırıldığı doğrulanmalıdır.", - "L": "3" - }, - { - "Shortcode": "V6.4.6", - "Ordinal": 6, - "Description": "Yönetici yetkisi olan kullanıcıların, kullanıcının parola sıfırlama sürecini başlatabildiği ancak kullanıcının yeni parolasını belirleyemediği veya değiştiremediği doğrulanmalıdır. Bu, yönetici yetkisi olan kullanıcıların, kullanıcı parolasını bilmesini engeller.", - "L": "3" - } - ] - }, - { - "Shortcode": "V6.5", - "Ordinal": 5, - "Name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", - "Items": [ - { - "Shortcode": "V6.5.1", - "Ordinal": 1, - "Description": "Arama sırları, bant dışı kimlik doğrulama istekleri veya kodları ve zamana dayalı tek kullanımlık parolaların (TOTP) yalnızca bir kez kullanılabildiği doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V6.5.2", - "Ordinal": 2, - "Description": "Uygulamanın backend tarafında saklanırken, 112 bitten az entropiye sahip (örneğin 19 rastgele harf-rakam karakteri veya 34 rastgele rakam) arama sırlarının, 32-bit rastgele bir salt içeren onaylı bir parola saklama algoritmasıyla hash’lendiği doğrulanmalıdır. Gizli bilginin entropisi 112 bit veya daha fazlaysa standart bir hash fonksiyonu kullanılabilir.", - "L": "2" - }, - { - "Shortcode": "V6.5.3", - "Ordinal": 3, - "Description": "Arama sırları, bant dışı kimlik doğrulama kodları ve zamana dayalı tek kullanımlık parola seed'lerinin, öngörülebilir değerlerden kaçınmak için Kriptografik Olarak Güvenli Sözde Rastgele Sayı Üreteci (CSPRNG) ile oluşturulduğu doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V6.5.4", - "Ordinal": 4, - "Description": "Arama sırlarının ve bant dışı kimlik doğrulama kodlarının en az 20 bit entropiye (genellikle 4 rastgele harf-rakam karakteri veya 6 rastgele rakam) sahip olduğu doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V6.5.5", - "Ordinal": 5, - "Description": "Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının ve zamana dayalı tek kullanımlık parolaların (TOTP) belirli bir ömre sahip olduğu doğrulanmalıdır. Bant dışı istekler en fazla 10 dakika, TOTP’ler ise en fazla 30 saniye geçerli olmalıdır.", - "L": "2" - }, - { - "Shortcode": "V6.5.6", - "Ordinal": 6, - "Description": "Herhangi bir kimlik doğrulama faktörünün (fiziksel cihazlar dahil) çalınması veya kaybı durumunda iptal edilebildiği doğrulanmalıdır.", - "L": "3" - }, - { - "Shortcode": "V6.5.7", - "Ordinal": 7, - "Description": "Biyometrik kimlik doğrulama mekanizmalarının yalnızca ikincil faktör olarak, “sahip olduğunuz bir şey” veya “bildiğiniz bir şey” ile birlikte kullanıldığı doğrulanmalıdır.", - "L": "3" - }, - { - "Shortcode": "V6.5.8", - "Ordinal": 8, - "Description": "Zamana dayalı tek kullanımlık parolaların (TOTP) doğrulamasının, güvenilir bir hizmetten alınan zaman kaynağına dayanarak yapıldığı ve güvenilir olmayan veya istemci tarafından sağlanan zaman kaynağına dayanmadığı doğrulanmalıdır.", - "L": "3" - } - ] - }, - { - "Shortcode": "V6.6", - "Ordinal": 6, - "Name": "Bant Dışı Kimlik Doğrulama Mekanizmaları", - "Items": [ - { - "Shortcode": "V6.6.1", - "Ordinal": 1, - "Description": "Tek kullanımlık parolaların (OTP) telefon veya SMS ile Public Switched Telephone Network (PSTN) üzerinden iletildiği kimlik doğrulama mekanizmalarının, yalnızca telefon numarası önceden doğrulanmışsa, alternatif daha güçlü yöntemler (örneğin TOTP) de sunuluyorsa ve kullanıcıya güvenlik riskleri hakkında bilgi veriliyorsa sunulduğu doğrulanmalıdır. Seviye 3 uygulamalar için telefon ve SMS seçenekleri sunulmamalıdır.", - "L": "2" - }, - { - "Shortcode": "V6.6.2", - "Ordinal": 2, - "Description": "Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının, oluşturuldukları özgün kimlik doğrulama isteğiyle bağlantılı olduğu ve daha önceki ya da sonraki bir istek için kullanılamadığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V6.6.3", - "Ordinal": 3, - "Description": "Kod tabanlı bant dışı kimlik doğrulama mekanizmalarının, oran sınırlaması ile kaba kuvvet saldırılarına karşı korunduğu doğrulanmalıdır. En az 64 bit entropiye sahip kodlar kullanılması da değerlendirilmelidir.", - "L": "2" - }, - { - "Shortcode": "V6.6.4", - "Ordinal": 4, - "Description": "Çok faktörlü kimlik doğrulama için push bildirimleri kullanılıyorsa, push bombing saldırılarına karşı oran sınırlamasının kullanıldığı doğrulanmalıdır. “Numara eşleştirme” de bu riski azaltabilir.", - "L": "3" - } - ] - }, - { - "Shortcode": "V6.7", - "Ordinal": 7, - "Name": "Kriptografik Kimlik Doğrulama Mekanizması", - "Items": [ - { - "Shortcode": "V6.7.1", - "Ordinal": 1, - "Description": "Kriptografik kimlik doğrulama beyanlarını doğrulamak için kullanılan sertifikaların, değiştirilmeye karşı korumalı şekilde saklandığı doğrulanmalıdır.", - "L": "3" - }, - { - "Shortcode": "V6.7.2", - "Ordinal": 2, - "Description": "Challenge nonce değerinin en az 64 bit uzunluğunda olduğu ve istatistiksel olarak benzersiz ya da cihazın ömrü boyunca benzersiz olduğu doğrulanmalıdır.", - "L": "3" - } - ] - }, - { - "Shortcode": "V6.8", - "Ordinal": 8, - "Name": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", - "Items": [ - { - "Shortcode": "V6.8.1", - "Ordinal": 1, - "Description": "Uygulama birden fazla kimlik sağlayıcıyı (IdP) destekliyorsa, başka bir desteklenen kimlik sağlayıcı aracılığıyla (örneğin aynı kullanıcı tanımlayıcısını kullanarak) kullanıcının kimliğinin taklit edilemediği doğrulanmalıdır. Standart önlem, uygulamanın kullanıcıyı IdP kimliği (bir ad alanı işlevi görür) ve IdP içindeki kullanıcı kimliğinin birleşimiyle kaydetmesi ve tanımlamasıdır.", - "L": "2" - }, - { - "Shortcode": "V6.8.2", - "Ordinal": 2, - "Description": "Kimlik doğrulama beyanları üzerindeki dijital imzaların (örneğin JWT veya SAML beyanları) varlığı ve bütünlüğünün her zaman doğrulandığı ve imzasız veya geçersiz imzalı beyanların reddedildiği doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V6.8.3", - "Ordinal": 3, - "Description": "SAML beyanlarının benzersiz biçimde işlendiği ve yalnızca geçerlilik süresi içinde bir kez kullanıldığı, tekrar oynatma (replay) saldırılarını önlemek amacıyla doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V6.8.4", - "Ordinal": 4, - "Description": "Uygulama ayrı bir Kimlik Sağlayıcı (IdP) kullanıyorsa ve belirli işlemler için belirli kimlik doğrulama gücü, yöntemleri veya zaman bilgisi bekliyorsa, uygulamanın bu bilgileri IdP tarafından döndürülen veriler üzerinden doğruladığı teyit edilmelidir. Örneğin OIDC kullanılıyorsa, bu durum ID Token üzerindeki 'acr', 'amr' ve 'auth_time' gibi claim’lerin (varsa) doğrulanması ile sağlanabilir. Eğer IdP bu bilgileri sağlamıyorsa, uygulamanın asgari kimlik doğrulama gücünün kullanıldığını varsayan (örneğin yalnızca kullanıcı adı ve parola ile tek faktörlü doğrulama) belgelenmiş bir yedek yaklaşımı olmalıdır.", - "L": "2" - } - ] - } - ] - }, - { - "Shortcode": "V7", - "Ordinal": 7, - "ShortName": "Session", - "Name": "Oturum Yönetimi", - "Items": [ - { - "Shortcode": "V7.1", - "Ordinal": 1, - "Name": "Oturum Yönetim Dokümantasyonu", - "Items": [ - { - "Shortcode": "V7.1.1", - "Ordinal": 1, - "Description": "Kullanıcının oturum inaktivite zaman aşımı süresi ve mutlak maksimum oturum süresinin belgelendiği, diğer kontrollerle birlikte uygun olduğu ve NIST SP 800-63B yeniden kimlik doğrulama gereksinimlerinden herhangi bir sapma varsa gerekçesinin belgede yer aldığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V7.1.2", - "Ordinal": 2, - "Description": "Belgede bir hesap için kaç adet eşzamanlı (paralel) oturuma izin verildiği ile birlikte, maksimum aktif oturum sayısına ulaşıldığında uygulanacak davranış ve işlemlerin tanımlandığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V7.1.3", - "Ordinal": 3, - "Description": "Birleşik kimlik yönetim ekosisteminin bir parçası olarak kullanıcı oturumu oluşturan ve yöneten tüm sistemlerin, oturum ömrü, sonlandırma ve yeniden kimlik doğrulama gerektiren diğer koşulların nasıl koordine edildiğini açıklayan kontrollerle birlikte belgede yer aldığı doğrulanmalıdır.", - "L": "2" - } - ] - }, - { - "Shortcode": "V7.2", - "Ordinal": 2, - "Name": "Temel Oturum Yönetimi Güvenliği", - "Items": [ - { - "Shortcode": "V7.2.1", - "Ordinal": 1, - "Description": "Uygulamanın tüm oturum token'ı doğrulama işlemlerini güvenilir bir backend servisi aracılığıyla gerçekleştirdiği doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V7.2.2", - "Ordinal": 2, - "Description": "Uygulamanın, statik API gizli anahtarları veya sabit değerler yerine, oturum yönetimi için dinamik olarak oluşturulan kendi kendine yeterli veya referans token'ları kullandığı doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V7.2.3", - "Ordinal": 3, - "Description": "Uygulama kullanıcı oturumlarını temsil etmek için referans token'ları kullanıyorsa, bu token'ların benzersiz olduğu, kriptografik olarak güvenli bir sözde rastgele sayı üreteci (CSPRNG) kullanılarak üretildiği ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V7.2.4", - "Ordinal": 4, - "Description": "Uygulamanın, kullanıcı kimlik doğrulaması (yeniden kimlik doğrulama dahil) sırasında yeni bir oturum token'ı oluşturduğu ve mevcut oturum token'ını sonlandırdığı doğrulanmalıdır.", - "L": "1" - } - ] - }, - { - "Shortcode": "V7.3", - "Ordinal": 3, - "Name": "Oturum Zaman Aşımı", - "Items": [ - { - "Shortcode": "V7.3.1", - "Ordinal": 1, - "Description": "Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde bir hareketsizlik zaman aşımı bulunduğu doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V7.3.2", - "Ordinal": 2, - "Description": "Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde mutlak bir maksimum oturum süresi bulunduğu doğrulanmalıdır.", - "L": "2" - } - ] - }, - { - "Shortcode": "V7.4", - "Ordinal": 4, - "Name": "Oturum Sonlandırma", - "Items": [ - { - "Shortcode": "V7.4.1", - "Ordinal": 1, - "Description": "Oturum sonlandırma tetiklendiğinde (örneğin, çıkış yapıldığında veya süre dolduğunda), uygulamanın oturumun daha fazla kullanılmasına izin vermediği doğrulanmalıdır. Referans token'lar veya durum bilgili oturumlar için bu, oturum verilerinin uygulama arka ucunda geçersiz kılınması anlamına gelir. Kapsamlı token kullanan uygulamaların; sonlandırılmış token listesi tutmak, kullanıcıya özel tarih ve saatten önce oluşturulan token'ları reddetmek veya kullanıcıya özel imzalama anahtarını yenilemek gibi bir çözüm uygulaması gerekir.", - "L": "1" - }, - { - "Shortcode": "V7.4.2", - "Ordinal": 2, - "Description": "Bir kullanıcı hesabı devre dışı bırakıldığında veya silindiğinde (örneğin bir çalışanın şirketten ayrılması), uygulamanın tüm aktif oturumları sonlandırdığı doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V7.4.3", - "Ordinal": 3, - "Description": "Herhangi bir kimlik doğrulama faktörünün başarılı bir şekilde değiştirilmesi veya kaldırılmasından (şifre sıfırlama veya kurtarma yoluyla yapılan değişiklikler dahil ve varsa MFA ayarları güncellemeleri dahil) sonra, uygulamanın diğer tüm aktif oturumları sonlandırma seçeneği sunduğu doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V7.4.4", - "Ordinal": 4, - "Description": "Kimlik doğrulama gerektiren tüm sayfalarda kolay erişilebilir ve görünür bir çıkış yap (logout) işlevi bulunduğu doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V7.4.5", - "Ordinal": 5, - "Description": "Uygulama yöneticilerinin, bireysel bir kullanıcının veya tüm kullanıcıların aktif oturumlarını sonlandırabilme yetkisine sahip olduğu doğrulanmalıdır.", - "L": "2" - } - ] - }, - { - "Shortcode": "V7.5", - "Ordinal": 5, - "Name": "Oturum Kötüye Kullanımına Karşı Savunmalar", - "Items": [ - { - "Shortcode": "V7.5.1", - "Ordinal": 1, - "Description": "E-posta adresi, telefon numarası, MFA yapılandırması veya hesap kurtarmada kullanılan diğer bilgiler gibi kimlik doğrulamayı etkileyebilecek hassas hesap özniteliklerinde değişiklik yapılmadan önce uygulamanın tam yeniden kimlik doğrulama gerektirdiği doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V7.5.2", - "Ordinal": 2, - "Description": "Kullanıcıların, (en az bir faktörle yeniden kimlik doğrulama yaptıktan sonra) mevcut tüm aktif oturumları görüntüleyebilmesi ve sonlandırabilmesinin mümkün olduğu doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V7.5.3", - "Ordinal": 3, - "Description": "Uygulamanın, son derece hassas işlemler veya operasyonlar gerçekleştirilmeden önce en az bir faktörle ek kimlik doğrulaması veya ikincil bir doğrulama gerektirdiği doğrulanmalıdır.", - "L": "3" - } - ] - }, - { - "Shortcode": "V7.6", - "Ordinal": 6, - "Name": "Birleşik Yeniden Kimlik Doğrulama", - "Items": [ - { - "Shortcode": "V7.6.1", - "Ordinal": 1, - "Description": "Güvenen Taraf (RP) ile Kimlik Sağlayıcı (IdP) arasındaki oturum süresi ve oturum sonlandırma davranışlarının belgelenmiş olduğu ve, örneğin IdP kimlik doğrulama olayları arasında maksimum süreye ulaşıldığında yeniden kimlik doğrulamanın gerekli kılındığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V7.6.2", - "Ordinal": 2, - "Description": "Yeni bir oturum oluşturulmasının, kullanıcı onayı veya açık bir eylem gerektirdiği; kullanıcı etkileşimi olmaksızın yeni uygulama oturumlarının oluşturulmasının önlendiği doğrulanmalıdır.", - "L": "2" - } - ] - } - ] - }, - { - "Shortcode": "V8", - "Ordinal": 8, - "ShortName": "Authorization", - "Name": "Yetkilendirme", - "Items": [ - { - "Shortcode": "V8.1", - "Ordinal": 1, - "Name": "Yetkilendirme Dokümantasyonu", - "Items": [ - { - "Shortcode": "V8.1.1", - "Ordinal": 1, - "Description": "Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak işlev düzeyinde ve veriye özel erişim kısıtlamaları için kuralları tanımladığı doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V8.1.2", - "Ordinal": 2, - "Description": "Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak alan (field) düzeyinde erişim kısıtlamaları (hem okuma hem yazma) için kuralları tanımladığı doğrulanmalıdır. Bu kuralların, ilgili veri nesnesinin durum veya statü gibi diğer özniteliklerine bağlı olabileceği unutulmamalıdır.", - "L": "2" - }, - { - "Shortcode": "V8.1.3", - "Ordinal": 3, - "Description": "Uygulamanın dokümantasyonunun, kimlik doğrulama ve yetkilendirme ile ilgili güvenlik kararlarının alınmasında kullanılan çevresel ve bağlamsal öznitelikleri (günün saati, kullanıcı konumu, IP adresi veya cihaz gibi) tanımladığı doğrulanmalıdır.", - "L": "3" - }, - { - "Shortcode": "V8.1.4", - "Ordinal": 4, - "Description": "Kimlik doğrulama ve yetkilendirme dokümantasyonunun; işlev düzeyinde, veriye özel ve alan düzeyinde yetkilendirmenin yanı sıra çevresel ve bağlamsal faktörlerin karar almada nasıl kullanıldığını tanımladığı doğrulanmalıdır. Bu, değerlendirilen öznitelikleri, risk eşiklerini ve alınan aksiyonları (ör. izin ver, doğrulama iste, reddet, step-up kimlik doğrulama) içermelidir.", - "L": "3" - } - ] - }, - { - "Shortcode": "V8.2", - "Ordinal": 2, - "Name": "Genel Yetkilendirme Tasarımı", - "Items": [ - { - "Shortcode": "V8.2.1", - "Ordinal": 1, - "Description": "Uygulamanın, işlev düzeyindeki erişimin yalnızca açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V8.2.2", - "Ordinal": 2, - "Description": "Uygulamanın, veriye özel erişimin yalnızca belirli veri öğelerine açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, doğrudan nesne referansı güvenlik açıkları (IDOR) ve bozuk nesne düzeyinde yetkilendirme (BOLA) risklerini azaltır.", - "L": "1" - }, - { - "Shortcode": "V8.2.3", - "Ordinal": 3, - "Description": "Uygulamanın, alan (field) düzeyindeki erişimin yalnızca belirli alanlara açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, bozuk nesne özelliği düzeyinde yetkilendirme (BOPLA) risklerini azaltır.", - "L": "2" - }, - { - "Shortcode": "V8.2.4", - "Ordinal": 4, - "Description": "Tüketicinin çevresel ve bağlamsal özniteliklerine (ör. günün saati, konum, IP adresi veya cihaz) dayalı uyarlanabilir güvenlik kontrollerinin, uygulama dokümantasyonunda tanımlandığı şekilde, kimlik doğrulama ve yetkilendirme kararları için uygulandığı doğrulanmalıdır. Bu kontroller, tüketici yeni bir oturum başlatmaya çalışırken ve mevcut bir oturum sırasında uygulanmalıdır.", - "L": "3" - } - ] - }, - { - "Shortcode": "V8.3", - "Ordinal": 3, - "Name": "İşlem Düzeyinde Yetkilendirme", - "Items": [ - { - "Shortcode": "V8.3.1", - "Ordinal": 1, - "Description": "Uygulamanın yetkilendirme kurallarını güvenilir bir servis katmanında uyguladığı ve istemci taraflı JavaScript gibi güvenilmeyen tüketiciler tarafından değiştirilebilecek kontrollerle yetinmediği doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V8.3.2", - "Ordinal": 2, - "Description": "Yetkilendirme kararlarının temelini oluşturan değerlerdeki değişikliklerin hemen uygulandığı doğrulanmalıdır. Değişikliklerin anında uygulanamadığı durumlarda (örneğin self-contained token içindeki verilere güveniliyorsa), tüketici artık yetkili olmadığı hâlde bir işlem gerçekleştirdiğinde uyarı verecek ve değişikliği geri alacak önlemler uygulanmalıdır. Bu alternatifin bilgi sızıntısını önlemeyeceği unutulmamalıdır.", - "L": "3" - }, - { - "Shortcode": "V8.3.3", - "Ordinal": 3, - "Description": "Bir nesneye erişimin, herhangi bir aracı veya onun adına hareket eden bir servis yerine yalnızca erişimi başlatan öznenin (ör. tüketici) izinlerine dayandığı doğrulanmalıdır. Örneğin, bir tüketici kimlik doğrulama için bir self-contained token kullanarak bir web servis çağırırsa ve bu servis başka bir servisten veri talep ederse, ikinci servis izin kararlarını verirken birinci servisin makine-makine token'ı yerine tüketicinin token'ını kullanmalıdır.", - "L": "3" - } - ] - }, - { - "Shortcode": "V8.4", - "Ordinal": 4, - "Name": "Diğer Yetkilendirme Hususları", - "Items": [ - { - "Shortcode": "V8.4.1", - "Ordinal": 1, - "Description": "Multi-tenant uygulamaların, tüketici işlemlerinin izinli olmadıkları tenant'lar üzerinde asla etkili olmamasını sağlamak için tenant'lar arası kontroller kullandığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V8.4.2", - "Ordinal": 2, - "Description": "Yönetici arayüzlerine erişimin, sürekli tüketici kimlik doğrulaması, cihaz güvenlik durumu değerlendirmesi ve bağlamsal risk analizi dahil olmak üzere çok katmanlı güvenlik içerdiği doğrulanmalıdır. Yetkilendirme için yalnızca ağ konumu veya güvenilir uç noktalar yeterli olmamalıdır; ancak bu tür faktörler yetkisiz erişim olasılığını azaltabilir.", - "L": "3" - } - ] - } - ] - }, - { - "Shortcode": "V9", - "Ordinal": 9, - "ShortName": "Self", - "Name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", - "Items": [ - { - "Shortcode": "V9.1", - "Ordinal": 1, - "Name": "Token Kaynağı ve Bütünlüğü", - "Items": [ - { - "Shortcode": "V9.1.1", - "Ordinal": 1, - "Description": "Self-contained token'ların içerikleri kabul edilmeden önce, oynama (tampering) saldırılarına karşı dijital imza veya MAC ile doğrulama yapıldığı doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V9.1.2", - "Ordinal": 2, - "Description": "Belirli bir bağlam için yalnızca bir allowlist üzerinde bulunan algoritmaların self-contained token oluşturmak ve doğrulamak için kullanılabildiği doğrulanmalıdır. Bu allowlist, yalnızca simetrik ya da yalnızca asimetrik algoritmaları içermeli ve kesinlikle 'None' algoritmasını içermemelidir. Hem simetrik hem de asimetrik algoritmalar desteklenmek zorundaysa, anahtar karışıklığını (key confusion) önlemek için ek kontroller uygulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V9.1.3", - "Ordinal": 3, - "Description": "Self-contained token'ları doğrulamak için kullanılan anahtar malzemesinin, token issuer için önceden yapılandırılmış güvenilir kaynaklardan alındığı doğrulanmalıdır. Bu, saldırganların güvenilmeyen kaynak ve anahtarları belirtmesini engeller. JWT ve diğer JWS yapılarında 'jku', 'x5u' ve 'jwk' gibi header'lar güvenilir kaynaklardan oluşan bir allowlist'e göre doğrulanmalıdır.", - "L": "1" - } - ] - }, - { - "Shortcode": "V9.2", - "Ordinal": 2, - "Name": "Token İçeriği", - "Items": [ - { - "Shortcode": "V9.2.1", - "Ordinal": 1, - "Description": "Token verisinde bir geçerlilik zaman aralığı (validity time span) varsa, yalnızca doğrulama zamanı bu zaman aralığı içerisindeyse token ve içeriği kabul edilmelidir. Örneğin, JWT'ler için 'nbf' ve 'exp' claim'leri doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V9.2.2", - "Ordinal": 2, - "Description": "Token'ı alan hizmetin, token içeriğini kabul etmeden önce bu token'ın doğru türde olduğunu ve sunulma amacına uygun olduğunu doğruladığı teyit edilmelidir. Örneğin, yalnızca erişim token'ları yetkilendirme kararları için, yalnızca ID Token'lar kullanıcı kimlik doğrulamasını kanıtlamak için kullanılabilir.", - "L": "2" - }, - { - "Shortcode": "V9.2.3", - "Ordinal": 3, - "Description": "Hizmetin yalnızca kendisiyle kullanılması amaçlanan (audience) token'ları kabul ettiği doğrulanmalıdır. JWT'lerde bu, 'aud' claim'inin hizmet içinde tanımlı bir allowlist ile doğrulanması yoluyla sağlanabilir.", - "L": "2" - }, - { - "Shortcode": "V9.2.4", - "Ordinal": 4, - "Description": "Eğer bir token issuer, farklı audience'lara token oluşturmak için aynı private key'i kullanıyorsa, oluşturulan token'ların hedef audience'ları benzersiz şekilde tanımlayan bir audience kısıtlaması içerdiği doğrulanmalıdır. Bu, bir token'ın farklı bir audience ile yeniden kullanılmasını önler. Audience tanımlayıcısı dinamik olarak sağlanıyorsa, token issuer bu audience'ları doğrulamalı ve audience taklitlerinin (impersonation) önüne geçmelidir.", - "L": "2" - } - ] - } - ] - }, - { - "Shortcode": "V10", - "Ordinal": 10, - "ShortName": "OAuth", - "Name": "OAuth ve OIDC", - "Items": [ - { - "Shortcode": "V10.1", - "Ordinal": 1, - "Name": "Genel OAuth ve OIDC Güvenliği", - "Items": [ - { - "Shortcode": "V10.1.1", - "Ordinal": 1, - "Description": "Token'ların yalnızca kesinlikle ihtiyaç duyan bileşenlere gönderildiği doğrulanmalıdır. Örneğin, tarayıcı tabanlı JavaScript uygulamaları için bir backend-for-frontend modeli kullanıldığında, access ve refresh token'lara yalnızca backend'in erişebilmesi gerekir.", - "L": "2" - }, - { - "Shortcode": "V10.1.2", - "Ordinal": 2, - "Description": "Authorization server'dan gelen değerler (örneğin authorization code veya ID Token gibi) yalnızca aynı user agent oturumu ve işlemi tarafından başlatılmış bir yetkilendirme akışının sonucuysa kabul edildiği doğrulanmalıdır. Bu, client tarafından oluşturulan secret’ların 'proof key for code exchange' (PKCE) ‘code_verifier’, ‘state’ veya OIDC ‘nonce’ gibi tahmin edilemez, işleme özgü ve hem client’a hem de işlem başlatılan user agent oturumuna güvenli bir şekilde bağlı olmasını gerektirir.", - "L": "2" - } - ] - }, - { - "Shortcode": "V10.2", - "Ordinal": 2, - "Name": "OAuth İstemcisi", - "Items": [ - { - "Shortcode": "V10.2.1", - "Ordinal": 1, - "Description": "Code flow kullanılıyorsa, OAuth client’ın token taleplerini tetikleyen CSRF saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Bu genellikle PKCE kullanılarak veya authorization isteğinde gönderilen ‘state’ parametresinin kontrolü ile sağlanır.", - "L": "2" - }, - { - "Shortcode": "V10.2.2", - "Ordinal": 2, - "Description": "OAuth istemcisi birden fazla AS ile etkileşime girebiliyorsa, mix-up saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Örneğin, authorization server’ın 'iss' parametresini döndürmesi zorunlu kılınabilir ve bu parametrenin hem authorization yanıtında hem de token yanıtında doğrulanması gerekir.", - "L": "2" - }, - { - "Shortcode": "V10.2.3", - "Ordinal": 3, - "Description": "OAuth istemcisinin authorization server’a yaptığı taleplerde yalnızca gerekli scope’ları (veya diğer yetkilendirme parametrelerini) talep ettiği doğrulanmalıdır.", - "L": "3" - } - ] - }, - { - "Shortcode": "V10.3", - "Ordinal": 3, - "Name": "OAuth Kaynak Sunucusu (RS)", - "Items": [ - { - "Shortcode": "V10.3.1", - "Ordinal": 1, - "Description": "RS'nin yalnızca bu servisle kullanılmak üzere tasarlanmış access token’ları kabul ettiği doğrulanmalıdır (audience kontrolü). Audience bilgisi yapılandırılmış token’larda (örneğin JWT içindeki ‘aud’ claim’i) yer alabilir veya token introspection endpoint aracılığıyla kontrol edilebilir.", - "L": "2" - }, - { - "Shortcode": "V10.3.2", - "Ordinal": 2, - "Description": "RS'nin, access token’dan gelen claim’lere dayanarak yetki devri tanımına uygun şekilde yetkilendirme kararları uyguladığı doğrulanmalıdır. ‘sub’, ‘scope’ ve ‘authorization_details’ gibi claim’ler varsa, bu kararın parçası olmalıdır.", - "L": "2" - }, - { - "Shortcode": "V10.3.3", - "Ordinal": 3, - "Description": "Erişim kontrolü kararında, access token’dan (JWT veya ilgili token introspection yanıtı) benzersiz bir kullanıcının tanımlanması gerekiyorsa, RS'nin başka kullanıcılara devredilemeyecek claim’ler ile kullanıcıyı tanımladığı doğrulanmalıdır. Genellikle bu, ‘iss’ ve ‘sub’ claim’lerinin birlikte kullanılması anlamına gelir.", - "L": "2" - }, - { - "Shortcode": "V10.3.4", - "Ordinal": 4, - "Description": "RS'nin belirli bir kimlik doğrulama gücü, yöntemi veya güncelliği (recentness) gerektirmesi durumunda, sunulan access token’ın bu kısıtlamaları karşıladığını doğruladığı, örneğin, OIDC ‘acr’, ‘amr’ ve ‘auth_time’ claim’leri kullanılarak doğrulanmalıdır. ", - "L": "2" - }, - { - "Shortcode": "V10.3.5", - "Ordinal": 5, - "Description": "RS'nin, (yetkisiz taraflarca) çalınmış veya tekrar edilen access token’ların kullanımını önlemek için sender-constrained access token’lar kullandığı doğrulanmalıdır. Bu, OAuth 2 için Mutual TLS veya OAuth 2 Demonstration of Proof of Possession (DPoP) ile sağlanabilir.", - "L": "3" - } - ] - }, - { - "Shortcode": "V10.4", - "Ordinal": 4, - "Name": "OAuth Yetkilendirme Sunucusu (AS)", - "Items": [ - { - "Shortcode": "V10.4.1", - "Ordinal": 1, - "Description": "AS'nin, istemciye özel önceden kaydedilmiş URI’lerden oluşan bir allowlist kullanarak redirect URI’leri tam dize karşılaştırması ile doğruladığı doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V10.4.2", - "Ordinal": 2, - "Description": "AS'nin, \"authorization response\" içinde \"authorization code\" döndürdüğü durumlarda, bu kodun yalnızca bir kez kullanılabildiği doğrulanmalıdır. Daha önce access token vermek için kullanılmış bir authorization code ile yapılan ikinci geçerli token isteği reddedilmeli ve ilgili tüm token’lar iptal edilmelidir.", - "L": "1" - }, - { - "Shortcode": "V10.4.3", - "Ordinal": 3, - "Description": "Authorization code’un kısa ömürlü olduğu doğrulanmalıdır. L1 ve L2 uygulamalar için maksimum yaşam süresi 10 dakika, L3 uygulamalar için 1 dakikadır.", - "L": "1" - }, - { - "Shortcode": "V10.4.4", - "Ordinal": 4, - "Description": "Belirli bir istemci için AS'nin yalnızca o istemcinin ihtiyaç duyduğu grant türlerine izin verdiği doğrulanmalıdır. \"Token\" (Implicit flow) ve \"password\" (Resource Owner Password Credentials flow) grant türlerinin artık kullanılmaması gerekir.", - "L": "1" - }, - { - "Shortcode": "V10.4.5", - "Ordinal": 5, - "Description": "AS'nin, açık istemciler için refresh token replay saldırılarını azalttığı doğrulanmalıdır. Tercihen sender-constrained refresh token’lar (DPoP veya mutual TLS ile certificate-bound access token’lar) kullanılmalıdır. L1 ve L2 uygulamalar için refresh token rotation kullanılabilir. Rotation kullanılıyorsa, AS refresh token’ı kullanım sonrası geçersiz kılmalı ve geçersiz bir refresh token sunulması durumunda o yetkilendirme ile ilişkili tüm refresh token’ları iptal etmelidir.", - "L": "1" - }, - { - "Shortcode": "V10.4.6", - "Ordinal": 6, - "Description": "Code grant kullanılıyorsa, AS'nin authorization code interception saldırılarına karşı koruma sağladığı doğrulanmalıdır. Yetkilendirme isteğinde geçerli bir \"code_challenge\" değeri zorunlu olmalı ve \"code_challenge_method\" olarak \"plain\" kabul edilmemelidir. Token isteğinde ise \"code_verifier\" parametresi doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V10.4.7", - "Ordinal": 7, - "Description": "AS'nin, kimlik doğrulaması yapılmamış dinamik istemci kaydını desteklemesi durumunda, kötü niyetli istemci uygulamalarına karşı riskleri azalttığı doğrulanmalıdır. Kayıtlı URI’ler gibi client metadata’sı doğrulanmalı, kullanıcı onayı alınmalı ve güvenilmeyen bir client uygulamasıyla yapılan yetkilendirme isteği işlenmeden önce kullanıcı uyarılmalıdır.", - "L": "2" - }, - { - "Shortcode": "V10.4.8", - "Ordinal": 8, - "Description": "Refresh token’ların, sliding expiration kullanılsa bile mutlak bir sona erme süresine sahip olduğu doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V10.4.9", - "Ordinal": 9, - "Description": "Yetkili bir kullanıcı tarafından AS kullanıcı arayüzü üzerinden refresh token’ların ve reference access token’ların iptal edilebildiği doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V10.4.10", - "Ordinal": 10, - "Description": "Gizli istemcilerin token istekleri, pushed authorization request (PAR) ve token iptal istekleri gibi server’a yapılan backchannel isteklerinde kimliğinin kontrol edildiği doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V10.4.11", - "Ordinal": 11, - "Description": "AS yapılandırmasının, OAuth istemcisine yalnızca gerekli scope’ları atadığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V10.4.12", - "Ordinal": 12, - "Description": "Belirli bir client için, authorization server’ın yalnızca client’ın ihtiyaç duyduğu 'response_mode' değerine izin verdiği doğrulanmalıdır. Örneğin, bu değer ya beklenenlerle karşılaştırılarak doğrulanmalı ya da PAR veya JAR kullanılmalıdır.", - "L": "3" - }, - { - "Shortcode": "V10.4.13", - "Ordinal": 13, - "Description": "\"Code\" grant türünün daima pushed authorization request (PAR) ile birlikte kullanıldığı doğrulanmalıdır.", - "L": "3" - }, - { - "Shortcode": "V10.4.14", - "Ordinal": 14, - "Description": "AS'nin yalnızca sender-constrained (Proof-of-Possession) access token’lar ürettiği doğrulanmalıdır. Bu, mutual TLS ile certificate-bound access token ya da DPoP ile DPoP-bound access token olabilir.", - "L": "3" - }, - { - "Shortcode": "V10.4.15", - "Ordinal": 15, - "Description": "Sunucu taraflı istemciler için (kullanıcı cihazında çalışmayan), AS'nin \"authorization_details\" parametresinin istemci backend'i tarafından sağlandığını ve kullanıcı tarafından değiştirilmediğini doğruladığı, örneğin pushed authorization request (PAR) or JWT-secured Authorization Request (JAR) zorunlu kılınarak doğrulanmalıdır.", - "L": "3" - }, - { - "Shortcode": "V10.4.16", - "Ordinal": 16, - "Description": "Bir istemci gizli ise, AS'nin güçlü istemci kimlik doğrulama yöntemlerini zorunlu kıldığı doğrulanmalıdır. Bu yöntemler, public-key cryptography’ye dayalı ve replay saldırılarına karşı dayanıklı olmalı, örneğin mutual TLS (\"tls_client_auth\", \"self_signed_tls_client_auth\") veya private key JWT (\"private_key_jwt\") gibi.", - "L": "3" - } - ] - }, - { - "Shortcode": "V10.5", - "Ordinal": 5, - "Name": "OIDC İstemcisi", - "Items": [ - { - "Shortcode": "V10.5.1", - "Ordinal": 1, - "Description": "İstemcinin (relying party olarak) ID Token replay saldırılarını azalttığı doğrulanmalıdır. Örneğin, ID Token’daki 'nonce' claim’inin, OpenID Provider’a gönderilen kimlik doğrulama isteğindeki 'nonce' değeriyle eşleştiği doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V10.5.2", - "Ordinal": 2, - "Description": "İstemcinin kullanıcıyı ID Token claim’lerinden (genellikle, başka kullanıcılarla yeniden atanamayan 'sub' claim’i) benzersiz şekilde tanımladığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V10.5.3", - "Ordinal": 3, - "Description": "İstemcinin, kötü niyetli bir AS'nin başka bir AS'yi taklit etmesini AS metadata’sı üzerinden reddettiği doğrulanmalıdır. AS metadata’sındaki issuer URL’si, istemci tarafından beklenen önceden yapılandırılmış issuer URL’siyle tam olarak eşleşmiyorsa, metadata reddedilmelidir.", - "L": "2" - }, - { - "Shortcode": "V10.5.4", - "Ordinal": 4, - "Description": "İstemcinin, ID Token’ın kendisi için (audience) kullanılması amaçlandığını doğruladığı doğrulanmalıdır. Bu, token’daki 'aud' claim’inin istemcinin 'client_id' değeriyle eşit olup olmadığının kontrol edilmesiyle yapılır.", - "L": "2" - }, - { - "Shortcode": "V10.5.5", - "Ordinal": 5, - "Description": "OIDC back-channel logout kullanıldığında, relying party’nin \"forced logout\" ve \"logout\" akışında \"cross-JWT confusion\" gibi saldırılara karşı koruma sağladığı doğrulanmalıdır. Client, logout token’ın 'logout+jwt' türünde olduğunu, 'event' claim’inin doğru üyeye sahip olduğunu ve 'nonce' claim’i içermediğini doğrulamalıdır. Ayrıca token için kısa bir sona erme süresi (örneğin 2 dakika) önerilir.", - "L": "2" - } - ] - }, - { - "Shortcode": "V10.6", - "Ordinal": 6, - "Name": "OpenID Provider", - "Items": [ - { - "Shortcode": "V10.6.1", - "Ordinal": 1, - "Description": "OpenID Provider’ın yalnızca 'code', 'ciba', 'id_token' veya 'id_token code' response mode değerlerine izin verdiği doğrulanmalıdır. 'code' değeri, 'id_token code' (OIDC Hybrid flow) yerine tercih edilmelidir. 'token' (Implicit flow) kullanılmamalıdır.", - "L": "2" - }, - { - "Shortcode": "V10.6.2", - "Ordinal": 2, - "Description": "OpenID Provider’ın forced logout yoluyla yapılan hizmet reddi saldırılarını önlediği doğrulanmalıdır. Bu, son kullanıcıdan açık onay alınarak veya varsa logout isteğinde (relying party tarafından başlatılan) bulunan parametrelerin, örneğin 'id_token_hint', doğrulanmasıyla yapılabilir.", - "L": "2" - } - ] - }, - { - "Shortcode": "V10.7", - "Ordinal": 7, - "Name": "Onay (Consent) Yönetimi", - "Items": [ - { - "Shortcode": "V10.7.1", - "Ordinal": 1, - "Description": "AS'nin her yetkilendirme isteği için kullanıcının onayını aldığı doğrulanmalıdır. İstemcinin kimliği garanti altına alınamıyorsa, AS daima kullanıcıdan açıkça onay istemelidir.", - "L": "2" - }, - { - "Shortcode": "V10.7.2", - "Ordinal": 2, - "Description": "AS'nin kullanıcıdan onay istediğinde, neye onay verildiğini açık ve yeterli şekilde gösterdiği doğrulanmalıdır. Uygun olduğunda bu bilgiler, istenen yetkilendirmelerin doğasını (genellikle scope, resource server, RAR gibi detaylara dayalı), yetkilendirilmiş uygulamanın kimliğini ve bu yetkilendirmelerin süresini içermelidir.", - "L": "2" - }, - { - "Shortcode": "V10.7.3", - "Ordinal": 3, - "Description": "Kullanıcının, AS üzerinden verdiği onayları görüntüleyebildiği, değiştirebildiği ve iptal edebildiği doğrulanmalıdır.", - "L": "2" - } - ] - } - ] - }, - { - "Shortcode": "V11", - "Ordinal": 11, - "ShortName": "Cryptography", - "Name": "Kriptografi", - "Items": [ - { - "Shortcode": "V11.1", - "Ordinal": 1, - "Name": "Kriptografik Envanter ve Dokümantasyon", - "Items": [ - { - "Shortcode": "V11.1.1", - "Ordinal": 1, - "Description": "Kriptografik anahtarların yönetimi için belgelenmiş bir politika ve NIST SP 800-57 gibi bir anahtar yönetim standardını izleyen bir kriptografik anahtar yaşam döngüsü tanımlandığı doğrulanmalıdır. Bu, anahtarların aşırı miktarda paylaşılmadığını (örneğin, paylaşılan sırlar için ikiden fazla tarafla veya özel anahtarlar için birden fazla tarafla) garanti altına almalıdır.", - "L": "2" - }, - { - "Shortcode": "V11.1.2", - "Ordinal": 2, - "Description": "Tüm kriptografik anahtarlar, algoritmalar ve uygulama tarafından kullanılan sertifikaları içeren bir kriptografik envanterin oluşturulduğu, sürdürüldüğü ve düzenli olarak güncellendiği doğrulanmalıdır. Bu envanter ayrıca, sistemde anahtarların nerede kullanılabileceğini ve kullanılamayacağını, ve hangi veri türlerinin bu anahtarlarla korunup korunamayacağını da belgelemelidir.", - "L": "2" - }, - { - "Shortcode": "V11.1.3", - "Ordinal": 3, - "Description": "Sistem içerisinde şifreleme, özetleme ve imzalama işlemleri dahil olmak üzere kriptografi kullanımının tüm örneklerini tespit etmek için kriptografik keşif mekanizmalarının kullanıldığı doğrulanmalıdır.", - "L": "3" - }, - { - "Shortcode": "V11.1.4", - "Ordinal": 4, - "Description": "Kriptografik bir envanterin sürdürüldüğü doğrulanmalıdır. Bu envanter, gelecekteki tehditlere karşı tepki verebilmek amacıyla post-kuantum kriptografiye geçiş yolunu belirten belgelenmiş bir plan içermelidir.", - "L": "3" - } - ] - }, - { - "Shortcode": "V11.2", - "Ordinal": 2, - "Name": "Güvenli Kriptografi Uygulaması", - "Items": [ - { - "Shortcode": "V11.2.1", - "Ordinal": 1, - "Description": "Kriptografik işlemler için sektör tarafından doğrulanmış uygulamaların (kütüphaneler ve donanım hızlandırmalı uygulamalar dahil) kullanıldığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V11.2.2", - "Ordinal": 2, - "Description": "Uygulamanın, rastgele sayı üreticileri, kimliği doğrulanmış şifreleme, MAC veya özetleme algoritmaları, anahtar uzunlukları, turlar, şifreler ve modların herhangi bir zamanda yeniden yapılandırılabilir, yükseltilebilir veya değiştirilebilir olacağı şekilde kripto çevikliği (crypto agility) ile tasarlandığı doğrulanmalıdır. Aynı şekilde, anahtarların ve parolaların değiştirilebilmesi ve verilerin yeniden şifrelenebilmesi mümkün olmalıdır. Bu, onaylanmış PQC şemalarının yüksek güvenlikli uygulamaları yaygın olarak kullanılabilir hale geldiğinde sorunsuz geçişe olanak tanır.", - "L": "2" - }, - { - "Shortcode": "V11.2.3", - "Ordinal": 3, - "Description": "Tüm kriptografik ilkeliklerin, algoritma, anahtar boyutu ve yapılandırmaya göre minimum 128 bit güvenlik sağladığı doğrulanmalıdır. Örneğin, 256-bit ECC anahtarı yaklaşık 128 bit güvenlik sağlarken, RSA için aynı güvenliği elde etmek 3072-bit anahtar gerektirir.", - "L": "2" - }, - { - "Shortcode": "V11.2.4", - "Ordinal": 4, - "Description": "Tüm kriptografik işlemlerin sabit süreli (constant-time) olduğu, karşılaştırmalarda, hesaplamalarda veya geri dönüşlerde kısa devre (short-circuit) işlemleri yapılmadığı doğrulanmalıdır; bu, bilgi sızıntısını önlemek için gereklidir.", - "L": "3" - }, - { - "Shortcode": "V11.2.5", - "Ordinal": 5, - "Description": "Tüm kriptografik modüllerin güvenli şekilde hata verdiği ve hataların, padding oracle saldırıları gibi zafiyetleri mümkün kılmayacak şekilde ele alındığı doğrulanmalıdır.", - "L": "3" - } - ] - }, - { - "Shortcode": "V11.3", - "Ordinal": 3, - "Name": "Şifreleme Algoritmaları", - "Items": [ - { - "Shortcode": "V11.3.1", - "Ordinal": 1, - "Description": "Güvensiz blok modlarının (örneğin, ECB) ve zayıf doldurma (padding) şemalarının (örneğin, PKCS#1 v1.5) kullanılmadığı doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V11.3.2", - "Ordinal": 2, - "Description": "Yalnızca AES ile GCM gibi onaylı şifreleme algoritmalarının ve modlarının kullanıldığı doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V11.3.3", - "Ordinal": 3, - "Description": "Şifrelenmiş verilerin yetkisiz değişikliklere karşı korunduğu doğrulanmalıdır. Tercihen bu koruma, onaylı bir kimliği doğrulanmış şifreleme yöntemi kullanılarak ya da onaylı bir şifreleme yöntemi ile onaylı bir MAC algoritmasının kombinasyonu ile sağlanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V11.3.4", - "Ordinal": 4, - "Description": "Sayılar, başlatma vektörleri (IV) ve diğer tek kullanımlık değerlerin, aynı şifreleme anahtarı ve veri öğesi çifti için birden fazla kez kullanılmadığı doğrulanmalıdır. Oluşturma yöntemi kullanılan algoritmaya uygun olmalıdır.", - "L": "3" - }, - { - "Shortcode": "V11.3.5", - "Ordinal": 5, - "Description": "Şifreleme algoritması ve MAC algoritması kombinasyonlarının \"encrypt-then-MAC\" modunda çalıştığı doğrulanmalıdır.", - "L": "3" - } - ] - }, - { - "Shortcode": "V11.4", - "Ordinal": 4, - "Name": "Hashing ve Hash Tabanlı Fonksiyonlar", - "Items": [ - { - "Shortcode": "V11.4.1", - "Ordinal": 1, - "Description": "Dijital imzalar, HMAC, KDF ve rastgele bit üretimi gibi genel kriptografik kullanım senaryolarında yalnızca onaylı hash fonksiyonlarının kullanıldığı doğrulanmalıdır. MD5 gibi yasaklı hash fonksiyonları hiçbir kriptografik amaçla kullanılmamalıdır.", - "L": "1" - }, - { - "Shortcode": "V11.4.2", - "Ordinal": 2, - "Description": "Parolaların, onaylı, hesaplama açısından yoğun ve mevcut rehberliğe göre yapılandırılmış bir anahtar türetme fonksiyonu (diğer adıyla parola hash'leme fonksiyonu) kullanılarak saklandığı doğrulanmalıdır. Ayarlar, güvenlik ve performans dengesini sağlayarak kaba kuvvet saldırılarını zorlaştırmalıdır.", - "L": "2" - }, - { - "Shortcode": "V11.4.3", - "Ordinal": 3, - "Description": "Dijital imzalarda kullanılan hash fonksiyonlarının, veri bütünlüğü ve kimlik doğrulama amacıyla kullanıldığında çakışmaya karşı dayanıklı ve yeterli bit uzunluğuna sahip olduğu doğrulanmalıdır. Çakışma dayanıklılığı gerekiyorsa çıktı uzunluğu en az 256 bit olmalıdır. Sadece ikinci ön-görüntü (2nd pre-iamge) saldırılarına karşı dayanıklılık gerekiyorsa çıktı uzunluğu en az 128 bit olmalıdır.", - "L": "2" - }, - { - "Shortcode": "V11.4.4", - "Ordinal": 4, - "Description": "Parolalardan gizli anahtarlar türetilirken, onaylı anahtar türetme fonksiyonlarının anahtar uzatma (key stretching) parametreleriyle birlikte kullanıldığı doğrulanmalıdır. Bu parametreler, kaba kuvvet saldırılarını önleyecek şekilde güvenlik ve performans dengesine sahip olmalıdır.", - "L": "2" - } - ] - }, - { - "Shortcode": "V11.5", - "Ordinal": 5, - "Name": "Rastgele Değerler", - "Items": [ - { - "Shortcode": "V11.5.1", - "Ordinal": 1, - "Description": "Tahmin edilemez olması amaçlanan tüm rastgele sayıların ve dizelerin, CSPRNG ile oluşturulduğu ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. UUID'lerin bu koşulu dikkate almadığını unutmayın.", - "L": "2" - }, - { - "Shortcode": "V11.5.2", - "Ordinal": 2, - "Description": "Kullanılan rastgele sayı üretim mekanizmasının, yoğun talep altında dahi güvenli çalışacak şekilde tasarlandığı doğrulanmalıdır.", - "L": "3" - } - ] - }, - { - "Shortcode": "V11.6", - "Ordinal": 6, - "Name": "Açık Anahtar (Public Key) Kriptografisi", - "Items": [ - { - "Shortcode": "V11.6.1", - "Ordinal": 1, - "Description": "Anahtar üretimi, tohumlama (seeding) ve dijital imza üretimi ve doğrulama için yalnızca onaylı kriptografik algoritmalar ve çalışma modlarının kullanıldığı doğrulanmalıdır. Anahtar üretim algoritmaları, bilinen saldırılara karşı savunmasız anahtarlar üretmemelidir. Örneğin, Fermat çarpanlama yöntemine karşı savunmasız RSA anahtarları oluşturulmamalıdır.", - "L": "2" - }, - { - "Shortcode": "V11.6.2", - "Ordinal": 2, - "Description": "Anahtar değişimi için yalnızca onaylı kriptografik algoritmaların kullanıldığı doğrulanmalıdır (örneğin Diffie-Hellman). Kullanılan parametrelerin güvenli olması gerektiğine dikkat edilmelidir. Bu, anahtar kurulum sürecine yönelik saldırıları önleyecek ve araya girme (adversary-in-the-middle) ya da kriptografik kırılmaları engelleyecektir.", - "L": "3" - } - ] - }, - { - "Shortcode": "V11.7", - "Ordinal": 7, - "Name": "Kullanım Halindeki Verilerin Kriptografisi", - "Items": [ - { - "Shortcode": "V11.7.1", - "Ordinal": 1, - "Description": "Hassas verilerin kullanım sırasında korunmasını sağlamak amacıyla, yetkisiz kullanıcıların veya süreçlerin bu verilere erişmesini engelleyen tam bellek şifrelemesinin kullanıldığı doğrulanmalıdır.", - "L": "3" - }, - { - "Shortcode": "V11.7.2", - "Ordinal": 2, - "Description": "Veri asgariyetinin sağlandığı, yani işleme sırasında mümkün olan en az miktarda verinin ortaya çıktığı ve verilerin kullanımdan hemen sonra veya mümkün olan en kısa sürede şifrelendiği doğrulanmalıdır.", - "L": "3" - } - ] - } - ] - }, - { - "Shortcode": "V12", - "Ordinal": 12, - "ShortName": "Secure", - "Name": "Güvenli İletişim", - "Items": [ - { - "Shortcode": "V12.1", - "Ordinal": 1, - "Name": "Genel TLS Güvenlik Rehberi", - "Items": [ - { - "Shortcode": "V12.1.1", - "Ordinal": 1, - "Description": "Yalnızca TLS protokolünün en güncel ve önerilen sürümlerinin (örneğin TLS 1.2 ve TLS 1.3) etkinleştirildiği ve en son sürümün varsayılan olarak tercih edildiği doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V12.1.2", - "Ordinal": 2, - "Description": "Yalnızca önerilen şifre takımlarının (cipher suite) etkinleştirildiği ve en güçlü şifre takımlarının tercih edildiği doğrulanmalıdır. Seviye 3 (L3) uygulamalar yalnızca ileri gizlilik (forward secrecy) sağlayan şifre takımlarını desteklemelidir.", - "L": "2" - }, - { - "Shortcode": "V12.1.3", - "Ordinal": 3, - "Description": "Uygulamanın, mTLS istemci sertifikalarını kimlik doğrulama veya yetkilendirme amacıyla kullanmadan önce bu sertifikaların güvendiği sertifikalar arasında olduğunu doğruladığı kontrol edilmelidir.", - "L": "2" - }, - { - "Shortcode": "V12.1.4", - "Ordinal": 4, - "Description": "Online Certificate Status Protocol (OCSP) Stapling gibi geçerli bir sertifika iptal kontrolü yönteminin etkinleştirildiği ve yapılandırıldığı doğrulanmalıdır.", - "L": "3" - }, - { - "Shortcode": "V12.1.5", - "Ordinal": 5, - "Description": "TLS el sıkışma (handshake) sürecinde Server Name Indication (SNI) gibi hassas meta verilerin ifşa edilmesini önlemek için, uygulamanın TLS yapılandırmasında Encrypted Client Hello (ECH) özelliğinin etkinleştirildiği doğrulanmalıdır.", - "L": "3" - } - ] - }, - { - "Shortcode": "V12.2", - "Ordinal": 2, - "Name": "Dışa Açık Hizmetlerle HTTPS İletişimi", - "Items": [ - { - "Shortcode": "V12.2.1", - "Ordinal": 1, - "Description": "İstemci ile dışa açık, HTTP tabanlı hizmetler arasındaki tüm bağlantılarda TLS kullanıldığı ve bu bağlantıların güvensiz ya da şifrelenmemiş iletişime geri dönmediği doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V12.2.2", - "Ordinal": 2, - "Description": "Dışa açık hizmetlerin herkese açık olarak güvenilen TLS sertifikaları kullandığı doğrulanmalıdır.", - "L": "1" - } - ] - }, - { - "Shortcode": "V12.3", - "Ordinal": 3, - "Name": "Genel Servisler Arası İletişim Güvenliği", - "Items": [ - { - "Shortcode": "V12.3.1", - "Ordinal": 1, - "Description": "Uygulamaya gelen ve uygulamadan çıkan tüm bağlantılarda izleme sistemleri, yönetim araçları, uzaktan erişim ve SSH, ara yazılımlar, veritabanları, ana sistemler (mainframe), iş ortağı sistemleri ya da dış API'ler dahil olmak üzere TLS gibi şifreli bir protokolün kullanıldığı ve güvensiz ya da şifrelenmemiş protokollere geri dönülmediği doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V12.3.2", - "Ordinal": 2, - "Description": "TLS istemcilerinin bir TLS sunucusu ile iletişime geçmeden önce alınan sertifikaları doğruladığı kontrol edilmelidir.", - "L": "2" - }, - { - "Shortcode": "V12.3.3", - "Ordinal": 3, - "Description": "Uygulama içindeki HTTP tabanlı iç hizmetler arasında gerçekleşen tüm bağlantılarda TLS ya da uygun başka bir aktarım şifreleme mekanizmasının kullanıldığı ve güvensiz ya da şifrelenmemiş iletişime geri dönülmediği doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V12.3.4", - "Ordinal": 4, - "Description": "İç hizmetler arasındaki TLS bağlantılarında güvenilir sertifikaların kullanıldığı doğrulanmalıdır. İç sistemlerde oluşturulmuş ya da kendinden imzalı (self-signed) sertifikalar kullanılıyorsa, bu sertifikalara güvenen hizmetlerin yalnızca belirli dahili sertifika otoritelerine (CA) ve belirli kendinden imzalı sertifikalara güvenecek şekilde yapılandırıldıkları doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V12.3.5", - "Ordinal": 5, - "Description": "Sistem içindeki hizmetlerin birbiriyle iletişim kurarken her bir uç noktanın kimliğini doğrulamak için güçlü kimlik doğrulama yöntemlerinin kullanıldığı doğrulanmalıdır. Bu yöntemler arasında, açık anahtar altyapısı (public-key infrastructure) kullanan ve tekrar oynatma saldırılarına karşı dayanıklı olan TLS istemci kimlik doğrulaması gibi yöntemler yer almalıdır. Mikroservis mimarilerinde, sertifika yönetimini basitleştirmek ve güvenliği artırmak amacıyla bir servis ağı (service mesh) kullanılması değerlendirilmelidir.", - "L": "3" - } - ] - } - ] - }, - { - "Shortcode": "V13", - "Ordinal": 13, - "ShortName": "Configuration", - "Name": "Konfigürasyon", - "Items": [ - { - "Shortcode": "V13.1", - "Ordinal": 1, - "Name": "Konfigürasyon Dokümantasyonu", - "Items": [ - { - "Shortcode": "V13.1.1", - "Ordinal": 1, - "Description": "Uygulamanın tüm iletişim ihtiyaçlarının dokümante edildiği doğrulanmalıdır. Buna, uygulamanın bağımlı olduğu dış hizmetler ve son kullanıcının uygulamanın bağlantı kurmasını sağlayabileceği dış konumlar da dahil olmalıdır.", - "L": "2" - }, - { - "Shortcode": "V13.1.2", - "Ordinal": 2, - "Description": "Uygulamanın kullandığı her bir hizmet için, dokümantasyonda eşzamanlı bağlantı sayısı (örn. bağlantı havuzu limitleri) ve bu sınır aşıldığında uygulamanın davranışı, geri dönüş veya kurtarma mekanizmaları da dahil olmak üzere hizmet reddi koşullarını önlemek için tanımlandığı doğrulanmalıdır.", - "L": "3" - }, - { - "Shortcode": "V13.1.3", - "Ordinal": 3, - "Description": "Uygulamanın, kullandığı her bir dış sistem veya hizmet (örn. veritabanları, dosya tanıtıcıları, iş parçacıkları, HTTP bağlantıları) için kaynak yönetimi stratejilerini tanımladığı doğrulanmalıdır. Bu stratejiler, kaynak serbest bırakma prosedürlerini, zaman aşımı ayarlarını, hata durumlarını ve tekrar deneme mantığı uygulanmışsa sınırları, gecikmeleri ve geri çekilme (back-off) algoritmalarını içermelidir. Senkron HTTP istek–yanıt işlemleri için kısa zaman aşımı süreleri zorunlu tutulmalı ve tekrar eden denemeler devre dışı bırakılmalı ya da sıkı şekilde sınırlandırılmalıdır.", - "L": "3" - }, - { - "Shortcode": "V13.1.4", - "Ordinal": 4, - "Description": "Uygulamanın, güvenlik açısından kritik olan gizli verileri tanımladığı ve kuruluşun tehdit modeli ve iş ihtiyaçlarına göre bu verilerin döndürülme (rotation) zamanlamasının belgelendiği doğrulanmalıdır.", - "L": "3" - } - ] - }, - { - "Shortcode": "V13.2", - "Ordinal": 2, - "Name": "Backend İletişim Konfigürasyonu", - "Items": [ - { - "Shortcode": "V13.2.1", - "Ordinal": 1, - "Description": "Uygulamanın, standart kullanıcı oturum mekanizmasını desteklemeyen backend bileşenleri (örneğin API'ler, ara katmanlar, veri katmanları) arasında gerçekleşen iletişimlerin kimlik doğrulamasıyla korunduğu doğrulanmalıdır. Kimlik doğrulama; bireysel hizmet hesapları, kısa ömürlü token'lar ya da sertifika tabanlı kimlik doğrulama ile yapılmalıdır ve parola, API anahtarı ya da ayrıcalıklı erişime sahip paylaşımlı hesaplar gibi sabit kimlik bilgileri kullanılmamalıdır.", - "L": "2" - }, - { - "Shortcode": "V13.2.2", - "Ordinal": 2, - "Description": "Uygulamanın backend bileşenleri arasında (yerel hizmetler, işletim sistemi hizmetleri, API'ler, ara katmanlar ve veri katmanları dahil) gerçekleştirilen iletişimlerin, yalnızca gerekli en az ayrıcalığa sahip hesaplarla yapıldığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V13.2.3", - "Ordinal": 3, - "Description": "Bir hizmet kimlik doğrulaması için bir kimlik bilgisi kullanılması gerekiyorsa, bu kimlik bilgisinin varsayılan bir değer (örneğin root/root veya admin/admin) olmadığının doğrulanması gereklidir.", - "L": "2" - }, - { - "Shortcode": "V13.2.4", - "Ordinal": 4, - "Description": "Uygulamanın iletişim kurmasına izin verilen dış kaynaklar ya da sistemlerin, bir allowlist (izinli liste) ile tanımlandığı doğrulanmalıdır. Bu liste, uygulama katmanında, web sunucusunda, güvenlik duvarında veya farklı katmanların birleşiminde uygulanabilir.", - "L": "2" - }, - { - "Shortcode": "V13.2.5", - "Ordinal": 5, - "Description": "Web veya uygulama sunucusunun, dış sistemlere veri veya dosya gönderimi veya yüklemesi yaparken sadece belirli kaynaklara izin verecek şekilde allowlist ile yapılandırıldığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V13.2.6", - "Ordinal": 6, - "Description": "Uygulamanın farklı hizmetlere bağlantı kurduğu durumlarda, bu bağlantılar için belgelenmiş yapılandırmaları (örn. maksimum eşzamanlı bağlantı, bağlantı limiti aşıldığında davranış, zaman aşımı, tekrar deneme stratejileri) takip ettiğinin doğrulanması gereklidir.", - "L": "3" - } - ] - }, - { - "Shortcode": "V13.3", - "Ordinal": 3, - "Name": "Gizli Bilgi Yönetimi", - "Items": [ - { - "Shortcode": "V13.3.1", - "Ordinal": 1, - "Description": "Parolalar, anahtar materyalleri, veritabanı ve üçüncü parti sistemlerle entegrasyon bilgileri, zaman tabanlı token'lar için tohum (seed) bilgileri, dahili gizli veriler ve API anahtarları gibi backend sırlarının güvenli bir şekilde oluşturulması, saklanması, erişim denetiminin sağlanması ve imha edilmesi için bir gizli bilgi yönetim çözümünün (örneğin key vault) kullanıldığı doğrulanmalıdır. Bu gizli bilgiler uygulama kaynak koduna dahil edilmemeli ve yapı çıktılarında yer almamalıdır. Seviye 3 uygulamalar için donanım destekli bir çözüm (örneğin HSM) gereklidir.", - "L": "2" - }, - { - "Shortcode": "V13.3.2", - "Ordinal": 2, - "Description": "Gizli bilgilere erişimin en az ayrıcalık prensibine uygun şekilde yapılandırıldığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V13.3.3", - "Ordinal": 3, - "Description": "Tüm kriptografik işlemlerin, anahtar materyallerinin güvenli bir şekilde yönetilmesi ve dışarıya sızmasının engellenmesi amacıyla, izole edilmiş bir güvenlik modülü (örneğin vault ya da donanım güvenlik modülü) aracılığıyla gerçekleştirildiği doğrulanmalıdır.", - "L": "3" - }, - { - "Shortcode": "V13.3.4", - "Ordinal": 4, - "Description": "Uygulamanın belgelerinde belirtildiği şekilde gizli bilgilerin süresinin dolacak şekilde yapılandırıldığı ve düzenli olarak döndürüldüğü doğrulanmalıdır.", - "L": "3" - } - ] - }, - { - "Shortcode": "V13.4", - "Ordinal": 4, - "Name": "İstenmeyen Bilgi Sızıntısı", - "Items": [ - { - "Shortcode": "V13.4.1", - "Ordinal": 1, - "Description": "Uygulamanın .git veya .svn klasörleri gibi kaynak kontrolüyle ilgili metadata içermeyecek şekilde deploy edildiğini ya da bu klasörlerin hem dış erişime hem de uygulama erişimine kapalı olduğu doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V13.4.2", - "Ordinal": 2, - "Description": "Tüm bileşenler için üretim ortamlarında hata ayıklama (debug) modlarının devre dışı bırakıldığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V13.4.3", - "Ordinal": 3, - "Description": "Web sunucularının, açık şekilde istenmediği sürece dizin listelemesi (directory listing) özelliğini istemcilere sunmadığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V13.4.4", - "Ordinal": 4, - "Description": "HTTP TRACE metodunun üretim ortamlarında desteklenmediği, böylece potansiyel bilgi sızıntılarının önlendiği doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V13.4.5", - "Ordinal": 5, - "Description": "Belgeler (örneğin dahili API belgeleri) ve izleme uç noktalarının (monitoring endpoints) yalnızca açıkça belirtildiği durumlarda erişilebilir olduğu doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V13.4.6", - "Ordinal": 6, - "Description": "Uygulamanın arka uç bileşenlerinin ayrıntılı sürüm bilgilerini ifşa etmediği doğrulanmalıdır.", - "L": "3" - }, - { - "Shortcode": "V13.4.7", - "Ordinal": 7, - "Description": "Web katmanının yalnızca belirli dosya uzantılarına sahip dosyaları sunacak şekilde yapılandırıldığı, bu sayede istem dışı bilgi, yapılandırma ya da kaynak kod sızıntılarının önlendiği doğrulanmalıdır.", - "L": "3" - } - ] - } - ] - }, - { - "Shortcode": "V14", - "Ordinal": 14, - "ShortName": "Data", - "Name": "Veri Koruma", - "Items": [ - { - "Shortcode": "V14.1", - "Ordinal": 1, - "Name": "Veri Koruma Dokümantasyonu", - "Items": [ - { - "Shortcode": "V14.1.1", - "Ordinal": 1, - "Description": "Uygulama tarafından oluşturulan ve işlenen tüm hassas verilerin tanımlanıp, koruma seviyelerine göre sınıflandırıldığından emin olun. Bu, yalnızca kodlanmış (örneğin Base64 stringleri ya da JWT içindeki düz metin yükler gibi) ve bu nedenle kolayca çözülebilir verileri de içermelidir. Koruma seviyeleri, uygulamanın uymakla yükümlü olduğu veri koruma ve gizlilik düzenlemeleri ile standartlarını dikkate almalıdır.", - "L": "2" - }, - { - "Shortcode": "V14.1.2", - "Ordinal": 2, - "Description": "Tüm hassas veri koruma seviyeleri için belgelenmiş bir koruma gereksinimleri seti tanımlandığından emin olun. Bu gereksinimler genel şifreleme, bütünlük doğrulama, saklama süresi, verinin nasıl günlüğe kaydedileceği, günlüklerdeki hassas verilere erişim kontrolleri, veritabanı düzeyinde şifreleme, gizlilik ve gizliliği artırıcı teknolojiler ile diğer gizlilik gereksinimlerini kapsamalıdır.", - "L": "2" - } - ] - }, - { - "Shortcode": "V14.2", - "Ordinal": 2, - "Name": "Genel Veri Koruması", - "Items": [ - { - "Shortcode": "V14.2.1", - "Ordinal": 1, - "Description": "Hassas verilerin yalnızca HTTP message body veya header alanlarında sunucuya gönderildiği ve URL ile sorgu parametrelerinin, API anahtarı veya session token’ı gibi hassas bilgiler içermediği doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V14.2.2", - "Ordinal": 2, - "Description": "Hassas verilerin, yük dengeleyiciler ve uygulama önbellekleri gibi sunucu bileşenlerinde önbelleğe alınmasının engellendiği veya kullanım sonrası bu verilerin güvenli biçimde temizlendiği doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V14.2.3", - "Ordinal": 3, - "Description": "Uygulama kontrolü dışında veri toplanmasını engellemek için, tanımlanmış hassas verilerin, kullanıcı izleyicileri gibi güvensiz taraflara gönderilmediği doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V14.2.4", - "Ordinal": 4, - "Description": "Hassas verilere yönelik şifreleme, bütünlük doğrulama, veri saklama, loglama yöntemi, loglardaki erişim kontrolleri, gizlilik teknolojileri gibi kontrollerin, söz konusu verinin belgelenmiş koruma seviyesinde tanımlandığı şekilde uygulandığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V14.2.5", - "Ordinal": 5, - "Description": "Önbellekleme mekanizmalarının yalnızca belirli içerik türüne sahip yanıtları önbelleğe alacak şekilde yapılandırıldığı ve hassas, dinamik içeriklerin önbelleğe alınmadığı doğrulanmalıdır. Web sunucusu, mevcut olmayan bir dosya talebinde geçerli ama farklı bir dosya döndürmek yerine 404 veya 302 cevabı vermelidir. Bu, Web Cache Deception saldırılarını önlemeye yardımcı olur.", - "L": "3" - }, - { - "Shortcode": "V14.2.6", - "Ordinal": 6, - "Description": "Uygulamanın yalnızca işlevsellik için gerekli olan asgari hassas veriyi döndürdüğü doğrulanmalıdır. Örneğin, kredi kartı numarasının yalnızca bazı rakamlarının döndürülmesi; tam numaranın döndürülmesi gerekiyorsa, kullanıcı arayüzünde gizlenmiş (maskelenmiş) şekilde sunulması gerekir, aksi kullanıcı özel olarak görüntülemek istemedikçe gösterilmemelidir.", - "L": "3" - }, - { - "Shortcode": "V14.2.7", - "Ordinal": 7, - "Description": "Hassas bilgilerin, veri saklama sınıflandırmasına tabi tutulduğu, geçerliliğini yitirmiş veya artık gerekli olmayan verilerin belirlenmiş bir zaman çizelgesiyle ya da gerektiğinde otomatik olarak silindiği doğrulanmalıdır.", - "L": "3" - }, - { - "Shortcode": "V14.2.8", - "Ordinal": 8, - "Description": "Kullanıcı tarafından yüklenen dosyaların meta verilerinden hassas bilgilerin çıkarıldığı veya bu bilgilerin yalnızca kullanıcıdan açık onay alındığında saklandığı doğrulanmalıdır.", - "L": "3" - } - ] - }, - { - "Shortcode": "V14.3", - "Ordinal": 3, - "Name": "İstemci Tarafı Veri Koruması", - "Items": [ - { - "Shortcode": "V14.3.1", - "Ordinal": 1, - "Description": "Kimliği doğrulanmış verilerin, istemci veya oturum sonlandığında istemci depolamasından (örneğin tarayıcı DOM’undan) temizlendiği doğrulanmalıdır. 'Clear-Site-Data' HTTP response header bu konuda yardımcı olabilir ancak istemci tarafı, sunucu bağlantısı mevcut olmadığında da temizlik işlemini yapabiliyor olmalıdır.", - "L": "1" - }, - { - "Shortcode": "V14.3.2", - "Ordinal": 2, - "Description": "Uygulamanın, tarayıcılarda hassas verilerin önbelleğe alınmasını önlemek amacıyla yeterli anti-önbellekleme HTTP response header (örneğin Cache-Control: no-store) ayarladığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V14.3.3", - "Ordinal": 3, - "Description": "Tarayıcıda depolanan verilerin (örneğin localStorage, sessionStorage, IndexedDB veya çerezler) hassas veri içermediği, yalnızca session token’larının istisna olarak kabul edildiği doğrulanmalıdır.", - "L": "2" - } - ] - } - ] - }, - { - "Shortcode": "V15", - "Ordinal": 15, - "ShortName": "Secure", - "Name": "Güvenli Kodlama ve Mimari", - "Items": [ - { - "Shortcode": "V15.1", - "Ordinal": 1, - "Name": "Güvenli Kodlama ve Mimari Dokümantasyonu", - "Items": [ - { - "Shortcode": "V15.1.1", - "Ordinal": 1, - "Description": "Güvenlik açığı içeren üçüncü taraf bileşen sürümleri ve genel olarak kütüphane güncellemeleri için, uygulama dokümantasyonunda risk bazlı düzeltme zamanlarının tanımlandığı doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V15.1.2", - "Ordinal": 2, - "Description": "Yazılım bileşen listesi (Software Bill of Materials - SBOM) gibi bir envanterin tutulduğu, kullanılan tüm üçüncü taraf kütüphanelerin önceden tanımlanmış, güvenilir ve düzenli olarak güncellenen depolardan alındığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V15.1.3", - "Ordinal": 3, - "Description": "Uygulama dokümantasyonunda zaman veya kaynak açısından yoğun işlevlerin tanımlandığı, bu işlevlerin aşırı kullanımı durumunda kullanılabilirlik kaybının nasıl önleneceği ve yanıt oluşturma süresinin istemci zaman aşımını aşmaması için hangi önlemlerin alındığı belirtilmelidir. Örnek savunmalar kuyruklama, eşzamansız işleme, kullanıcı başına ve uygulama genelinde paralel işlem sınırlarını içerebilir.", - "L": "2" - }, - { - "Shortcode": "V15.1.4", - "Ordinal": 4, - "Description": "Uygulama dokümantasyonunda \"riskli bileşenler\" olarak değerlendirilen üçüncü taraf kütüphanelerin vurgulandığı doğrulanmalıdır.", - "L": "3" - }, - { - "Shortcode": "V15.1.5", - "Ordinal": 5, - "Description": "Uygulama dokümantasyonunda \"tehlikeli işlevsellik\" içeren uygulama bölümlerinin açıkça belirtildiği doğrulanmalıdır.", - "L": "3" - } - ] - }, - { - "Shortcode": "V15.2", - "Ordinal": 2, - "Name": "Güvenlik Mimarisi ve Bağımlılıklar", - "Items": [ - { - "Shortcode": "V15.2.1", - "Ordinal": 1, - "Description": "Uygulamanın yalnızca, belgelenmiş güncelleme ve düzeltme sürelerini aşmamış bileşenleri içerdiği doğrulanmalıdır.", - "L": "1" - }, - { - "Shortcode": "V15.2.2", - "Ordinal": 2, - "Description": "Uygulamanın, belgelenmiş güvenlik kararları ve stratejilere dayanarak, zaman veya kaynak açısından yoğun işlevlerin neden olabileceği kullanılabilirlik kaybına karşı savunmalar uyguladığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V15.2.3", - "Ordinal": 3, - "Description": "Üretim ortamının yalnızca uygulamanın çalışması için gerekli işlevleri içerdiği ve test kodları, örnek kod parçaları veya geliştirme işlevleri gibi gereksiz işlevsellikleri açığa çıkarmadığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V15.2.4", - "Ordinal": 4, - "Description": "Üçüncü taraf bileşenlerin ve bunların tüm transitif bağımlılıklarının beklenen depolardan (iç kaynaklı ya da harici) alındığı ve bağımlılık karışıklığı (dependency confusion) saldırılarına açık olmadığı doğrulanmalıdır.", - "L": "3" - }, - { - "Shortcode": "V15.2.5", - "Ordinal": 5, - "Description": "Uygulamanın, “tehlikeli işlevsellik” içeren veya “riskli bileşenler” kullanan bölümlerine ek korumalar uyguladığı doğrulanmalıdır. Bu korumalar sandbox, kapsülleme, konteynerleştirme veya ağ düzeyinde izolasyon gibi teknikler aracılığıyla, bir uygulama bölümünün ele geçirilmesi durumunda saldırganın diğer bölümlere sıçramasını geciktirmeyi veya engellemeyi amaçlamalıdır.", - "L": "3" - } - ] - }, - { - "Shortcode": "V15.3", - "Ordinal": 3, - "Name": "Savunmacı Kodlama", - "Items": [ - { - "Shortcode": "V15.3.1", - "Ordinal": 1, - "Description": "Uygulamanın yalnızca gerekli alanların bir alt kümesini veri nesnesinden döndürdüğü doğrulanmalıdır. Örneğin, bazı alanlara kullanıcıların erişmemesi gerektiğinden tüm veri nesnesi döndürülmemelidir.", - "L": "1" - }, - { - "Shortcode": "V15.3.2", - "Ordinal": 2, - "Description": "Uygulama backend'i harici URL’lere çağrı yaptığında, yalnızca amaçlanan işlevsellik söz konusuysa yönlendirmeleri takip edecek şekilde yapılandırıldığının doğrulanması gerekir.", - "L": "2" - }, - { - "Shortcode": "V15.3.3", - "Ordinal": 3, - "Description": "Uygulamanın, kitlesel atama saldırılarına karşı, her bir controller ve eylem için izin verilen alanları sınırlandırarak savunmalar sağladığı doğrulanmalıdır. Örneğin, bir alan değeri, bu işlemde değiştirilmesi amaçlanmadıysa eklenememeli veya güncellenememelidir.", - "L": "2" - }, - { - "Shortcode": "V15.3.4", - "Ordinal": 4, - "Description": "Tüm proxy ve ara katman bileşenlerinin kullanıcının orijinal IP adresini, uç kullanıcı tarafından değiştirilemeyecek güvenilir veri alanları kullanarak doğru şekilde ilettiği ve uygulamanın ve web sunucusunun bu doğru değeri, loglama ve hız sınırlama gibi güvenlik kararları için kullandığı doğrulanmalıdır. Ayrıca, orijinal IP adresinin bile dinamik IP'ler, VPN'ler veya kurumsal güvenlik duvarları nedeniyle güvenilir olmayabileceği dikkate alınmalıdır.", - "L": "2" - }, - { - "Shortcode": "V15.3.5", - "Ordinal": 5, - "Description": "Uygulamanın değişkenlerin doğru türde olduğunu açıkça doğruladığı ve sıkı eşitlik ve karşılaştırma işlemleri kullandığı doğrulanmalıdır. Bu, değişken türüyle ilgili varsayımlardan kaynaklanan tür oynama (type juggling) veya tür karışıklığı (type confusion) güvenlik açıklarını önlemek içindir.", - "L": "2" - }, - { - "Shortcode": "V15.3.6", - "Ordinal": 6, - "Description": "JavaScript kodunun prototip zehirleme (prototype pollution) saldırılarını önleyecek şekilde yazıldığı, örneğin, nesne literal’leri yerine Set() veya Map() gibi yapılar kullanıldığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V15.3.7", - "Ordinal": 7, - "Description": "Uygulamanın, özellikle framework'ün istek parametrelerinin kaynağı (sorgu dizgisi, gövde parametreleri, çerezler veya başlık alanları) arasında ayrım yapmadığı durumlarda, HTTP parametre kirliliği (HTTP parameter pollution) saldırılarına karşı savunmalar uyguladığı doğrulanmalıdır.", - "L": "2" - } - ] - }, - { - "Shortcode": "V15.4", - "Ordinal": 4, - "Name": "Güvenli Eş Zamanlılık (Concurrency)", - "Items": [ - { - "Shortcode": "V15.4.1", - "Ordinal": 1, - "Description": "Çok iş parçacıklı kodda (örneğin cache'ler, dosyalar veya birden fazla iş parçacığı tarafından erişilen bellek içi nesneler gibi) paylaşılan nesnelere yalnızca thread-safe (iş parçacığı güvenli) türler ve kilitleme (lock) veya semaphore gibi senkronizasyon mekanizmaları kullanılarak erişildiği doğrulanmalıdır. Bu, yarış durumlarını ve veri bozulmasını önlemeye yöneliktir.", - "L": "3" - }, - { - "Shortcode": "V15.4.2", - "Ordinal": 2, - "Description": "Bir kaynağın durumu üzerindeki kontroller (örneğin varlığı ya da izinleri gibi) ile bu kontrole bağlı eylemlerin tek bir atomik işlem olarak gerçekleştirildiği doğrulanmalıdır. Bu, TOCTOU (time-of-check to time-of-use) yarış durumlarını önlemeye yöneliktir. Bir dosyanın varlığının kontrol edilip ardından açılması veya bir kullanıcının erişiminin doğrulanıp ardından yetki verilmesi gibi işlemler buna örnektir.", - "L": "3" - }, - { - "Shortcode": "V15.4.3", - "Ordinal": 3, - "Description": "Kilitlerin (locks) tutarlı biçimde kullanıldığı, iş parçacıklarının birbirini beklemesi ya da sonsuz döngüye girmesi (deadlock veya livelock) gibi durumların önlendiği doğrulanmalıdır. Ayrıca, kilitleme mantığı, kaynağı yöneten kod içinde kalmalı ve dış sınıflar veya dış kodlar tarafından istemeden veya kötü niyetli şekilde değiştirilememelidir.", - "L": "3" - }, - { - "Shortcode": "V15.4.4", - "Ordinal": 4, - "Description": "Kaynak tahsis politikalarının, iş parçacığı açlığını önleyecek şekilde, kaynaklara adil erişimi sağladığı doğrulanmalıdır. Örneğin, thread pool (iş parçacığı havuzu) kullanımı, düşük öncelikli iş parçacıklarının da makul sürelerde çalışabilmesi için uygulanmalıdır.", - "L": "3" - } - ] - } - ] - }, - { - "Shortcode": "V16", - "Ordinal": 16, - "ShortName": "Security", - "Name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "Items": [ - { - "Shortcode": "V16.1", - "Ordinal": 1, - "Name": "Güvenlik Loglaması Dokümantasyonu", - "Items": [ - { - "Shortcode": "V16.1.1", - "Ordinal": 1, - "Description": "Uygulamanın teknoloji yığını boyunca her katmanda hangi olayların loglandığını, log formatlarını, logların nereye yazıldığını, nasıl kullanıldığını, erişimin nasıl kontrol edildiğini ve logların ne kadar süre saklandığını belgeleyen bir envanterin mevcut olduğu doğrulanmalıdır.", - "L": "2" - } - ] - }, - { - "Shortcode": "V16.2", - "Ordinal": 2, - "Name": "Genel Loglama", - "Items": [ - { - "Shortcode": "V16.2.1", - "Ordinal": 1, - "Description": "Her bir log girdisinin, olayın ne zaman, nerede, kim tarafından ve ne olduğuna dair detaylı bir zaman çizelgesi oluşturulmasına olanak tanıyacak gerekli meta verileri içerdiği doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V16.2.2", - "Ordinal": 2, - "Description": "Tüm loglama bileşenlerinin zaman kaynaklarının senkronize olduğu ve güvenlik olayı meta verisindeki zaman damgalarının UTC kullanarak ya da açık zaman dilimi ofsetiyle belirtildiği doğrulanmalıdır. UTC kullanımı, özellikle yaz saati uygulamaları nedeniyle oluşabilecek karışıklıkları önlemek için tavsiye edilir.", - "L": "2" - }, - { - "Shortcode": "V16.2.3", - "Ordinal": 3, - "Description": "Uygulamanın yalnızca log envanterinde belgelenmiş dosya ve hizmetlere log yazdığı ya da ilettiği doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V16.2.4", - "Ordinal": 4, - "Description": "Logların kullanılan log işleyici (log processor) tarafından okunabildiği ve ilişkilendirilebildiği doğrulanmalıdır. Tercihen yaygın bir log formatı kullanılmalıdır.", - "L": "2" - }, - { - "Shortcode": "V16.2.5", - "Ordinal": 5, - "Description": "Hassas veriler loglanırken, uygulamanın veri koruma seviyesine uygun olarak loglama yaptığı doğrulanmalıdır. Örneğin kimlik bilgileri veya ödeme detayları gibi bazı verilerin loglanmasına izin verilmemelidir. Session token’ları gibi veriler ise yalnızca tamamen ya da kısmen maskelenmiş ya da hash’lenmiş olarak loglanmalıdır.", - "L": "2" - } - ] - }, - { - "Shortcode": "V16.3", - "Ordinal": 3, - "Name": "Güvenlik Olayları", - "Items": [ - { - "Shortcode": "V16.3.1", - "Ordinal": 1, - "Description": "Tüm kimlik doğrulama işlemlerinin (başarılı ve başarısız girişimler dahil) loglandığı doğrulanmalıdır. Kullanılan kimlik doğrulama türü veya faktörleri gibi ek meta veriler de toplanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V16.3.2", - "Ordinal": 2, - "Description": "Başarısız yetkilendirme girişimlerinin loglandığı doğrulanmalıdır. Seviye 3 uygulamalar için, tüm yetkilendirme kararlarının ve hassas verilere erişim olaylarının (verinin kendisi olmadan) loglandığı da doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V16.3.3", - "Ordinal": 3, - "Description": "Uygulamanın, belgelenmiş güvenlik olaylarını ve güvenlik kontrollerini aşma girişimlerini (girdi doğrulama, iş mantığı, otomasyon karşıtı kontroller vb.) logladığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V16.3.4", - "Ordinal": 4, - "Description": "Beklenmeyen hatalar ve güvenlik kontrolü başarısızlıkları (örneğin backend TLS hataları gibi) loglandığı doğrulanmalıdır.", - "L": "2" - } - ] - }, - { - "Shortcode": "V16.4", - "Ordinal": 4, - "Name": "Log Koruması", - "Items": [ - { - "Shortcode": "V16.4.1", - "Ordinal": 1, - "Description": "Tüm loglama bileşenlerinin, log enjeksiyonunu (log injection) önlemek amacıyla verileri uygun biçimde encode ettiği doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V16.4.2", - "Ordinal": 2, - "Description": "Logların yetkisiz erişime karşı korunduğu ve değiştirilemez olduğu doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V16.4.3", - "Ordinal": 3, - "Description": "Logların analiz, tespit, uyarı ve yükseltme amacıyla mantıksal olarak ayrı bir sisteme güvenli biçimde iletildiği doğrulanmalıdır. Böylece uygulama ihlal edilse bile logların tehlikeye girmesi önlenmiş olur.", - "L": "2" - } - ] - }, - { - "Shortcode": "V16.5", - "Ordinal": 5, - "Name": "Hata Yönetimi", - "Items": [ - { - "Shortcode": "V16.5.1", - "Ordinal": 1, - "Description": "Beklenmedik ya da güvenlikle ilgili bir hata oluştuğunda, tüketiciye genel bir mesaj döndürüldüğü ve yığın izleri (stack trace), sorgular, gizli anahtarlar, token’lar gibi hassas sistem içi verilerin açıklanmadığı doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V16.5.2", - "Ordinal": 2, - "Description": "Uygulamanın, dış kaynaklara erişim başarısız olduğunda bile güvenli şekilde çalışmaya devam ettiği doğrulanmalıdır. Örneğin, circuit breaker ya da graceful degradation gibi desenler kullanılmalıdır.", - "L": "2" - }, - { - "Shortcode": "V16.5.3", - "Ordinal": 3, - "Description": "Uygulamanın hata durumlarında güvenli ve düzenli şekilde başarısız olduğu doğrulanmalıdır. Bu, örneğin doğrulama hatalarına rağmen işlemlerin işlenmesine yol açabilecek fail-open durumlarını önlemelidir.", - "L": "2" - }, - { - "Shortcode": "V16.5.4", - "Ordinal": 4, - "Description": "Ele alınmamış tüm istisnaları yakalayacak şekilde tanımlanmış bir “son çare hata yöneticisi” bulunduğu doğrulanmalıdır. Bu, hem loglara gitmesi gereken hata detaylarının kaybolmaması hem de tüm uygulama sürecinin çökerek hizmet dışı kalmasının önlenmesi açısından önemlidir.", - "L": "3" - } - ] - } - ] - }, - { - "Shortcode": "V17", - "Ordinal": 17, - "ShortName": "WebRTC", - "Name": "WebRTC", - "Items": [ - { - "Shortcode": "V17.1", - "Ordinal": 1, - "Name": "TURN Sunucusu", - "Items": [ - { - "Shortcode": "V17.1.1", - "Ordinal": 1, - "Description": "TURN hizmetinin yalnızca özel amaçlar için ayrılmamış IP adreslerine (ör. iç ağlar, yayın adresleri, loopback) erişime izin verdiği doğrulanmalıdır. Bu gereksinim hem IPv4 hem de IPv6 adresleri için geçerlidir.", - "L": "2" - }, - { - "Shortcode": "V17.1.2", - "Ordinal": 2, - "Description": "TURN hizmetinin, meşru kullanıcıların sunucuda çok sayıda bağlantı noktası açmaya çalışması durumunda kaynak tüketimi saldırılarına karşı dayanıklı olduğu doğrulanmalıdır.", - "L": "3" - } - ] - }, - { - "Shortcode": "V17.2", - "Ordinal": 2, - "Name": "Medya", - "Items": [ - { - "Shortcode": "V17.2.1", - "Ordinal": 1, - "Description": "DTLS sertifikası anahtarının, belgelenmiş kriptografik anahtar yönetim politikasına uygun şekilde yönetildiği ve korunduğu doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V17.2.2", - "Ordinal": 2, - "Description": "Medya sunucusunun onaylı DTLS şifre takımlarını (cipher suites) ve Güvenli Gerçek Zamanlı Aktarım Protokolü (Secure Real-time Transport Protocol - SRTP) için anahtarlar oluşturmaya yönelik DTLS Uzantısı için güvenli bir koruma profilini kullanacak ve destekleyecek şekilde yapılandırıldığı (DTLS-SRTP) doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V17.2.3", - "Ordinal": 3, - "Description": "Real-time Transport Protocol (RTP) injection saldırılarının bir hizmet reddi durumuna veya medya akışlarına ses veya video medyası eklenmesine yol açmasını önlemek için medya sunucusunda Güvenli SRTP kimlik doğrulamasının kontrol edildiği doğrulanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V17.2.4", - "Ordinal": 4, - "Description": "Verify that the media server is able to continue processing incoming media traffic when encountering malformed Secure Real-time Transport Protocol (SRTP) packets.", - "L": "2" - }, - { - "Shortcode": "V17.2.5", - "Ordinal": 5, - "Description": "Medya sunucusunun, meşru kullanıcılardan gelen SRTP flood'ı sırasında gelen medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.", - "L": "3" - }, - { - "Shortcode": "V17.2.6", - "Ordinal": 6, - "Description": "Medya sunucusunun DTLS içinde yer alan \"ClientHello\" yarış durumu güvenlik açığına karşı savunmasız olmadığı, medya sunucusunun güvenlik açığına sahip olduğunun açıkça bilinip bilinmediği kontrol edilerek veya yarış koşulu testi gerçekleştirilerek doğrulanmalıdır.", - "L": "3" - }, - { - "Shortcode": "V17.2.7", - "Ordinal": 7, - "Description": "Medya sunucusuna bağlı ses veya video kayıt mekanizmalarının, meşru kullanıcı kaynaklı SRTP flood'ı sırasında medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.", - "L": "3" - }, - { - "Shortcode": "V17.2.8", - "Ordinal": 8, - "Description": "DTLS sertifikasının, SDP (Session Description Protocol) fingerprint özelliği ile karşılaştırıldığı ve doğrulama başarısız olursa medya akışının sonlandırıldığı, medya akışının özgünlüğünü sağlamak için doğrulanmalıdır.", - "L": "3" - } - ] - }, - { - "Shortcode": "V17.3", - "Ordinal": 3, - "Name": "Sinyalizasyon", - "Items": [ - { - "Shortcode": "V17.3.1", - "Ordinal": 1, - "Description": "Sinyalizasyon sunucusunun, flood saldırısı altında bile meşru sinyalizasyon mesajlarını işlemeye devam edebildiği doğrulanmalıdır. Bu, sinyalizasyon düzeyinde oran sınırlaması uygulanarak sağlanmalıdır.", - "L": "2" - }, - { - "Shortcode": "V17.3.2", - "Ordinal": 2, - "Description": "Sinyalizasyon sunucusunun, hizmet reddine yol açabilecek şekilde yapılandırılmış bozuk sinyalizasyon mesajlarıyla karşılaştığında bile meşru mesajları işlemeye devam edebildiği doğrulanmalıdır. Bu, girdi doğrulaması, integer overflow ve buffer overflow'a karşı savunma ve sağlam hata işleme teknikleri ile sağlanmalıdır.", - "L": "2" - } - ] - } - ] - } - ] -} diff --git a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.csv b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.csv deleted file mode 100644 index 5e3bcb81df..0000000000 --- a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.csv +++ /dev/null @@ -1,343 +0,0 @@ -chapter_id,chapter_name,section_id,section_name,req_id,req_description,level1,level2,level3,cwe,nist -V1,Kodlama (Encoding) ve Temizleme,V1.1,Kodlama ve Temizleme Mimarisi,V1.1.1,"Girdinin yalnızca bir kez kanonik forma (canonical form) çözümlendiği veya kaçış işlemlerinin kaldırıldığı, bu işlemin yalnızca verinin bu biçimde beklenmesi durumunda yapıldığı ve bu işlemin girdi doğrulama veya temizleme işlemlerinden sonra değil, önce gerçekleştiği doğrulanmalıdır.",,✓,✓,, -V1,Kodlama (Encoding) ve Temizleme,V1.1,Kodlama ve Temizleme Mimarisi,V1.1.2,"Uygulamanın, çıktıyı kullanılması gereken yorumlayıcıya verilmeden hemen önce veya yorumlayıcının kendisi tarafından çıktı kodlaması ya da kaçış işlemi yaptığı doğrulanmalıdır.",,✓,✓,, -V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.1,"HTTP yanıtı, HTML veya XML belgesi için yapılan çıktı kodlamasının; HTML elemanları, HTML öznitelikleri, HTML yorumları, CSS ya da HTTP başlık alanları gibi bağlamlara uygun olduğu doğrulanmalıdır. Böylece mesaj veya belge yapısının bozulması önlenir.",✓,✓,✓,, -V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.2,"Dinamik olarak URL oluşturulurken, güvenilmeyen verinin bağlamına göre (örneğin, sorgu veya yol parametreleri için URL kodlaması ya da base64url kodlaması) kodlandığı doğrulanmalıdır. Yalnızca güvenli URL protokollerine izin verilmelidir (örneğin, javascript: veya data: yasaklanmalıdır).",✓,✓,✓,, -V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.3,JavaScript içeriği (JSON dahil) dinamik olarak oluşturulurken çıktı kodlama/kaçış kullanıldığı doğrulanmalıdır. Böylece mesaj veya belge yapısı değiştirilmemiş olur (JavaScript ve JSON enjeksiyonlarının önüne geçilir).,✓,✓,✓,, -V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.4,"Veri sorguları veya veritabanı sorguları (SQL, HQL, NoSQL, Cypher vb.) için parametreli sorgular, ORM’ler, entity framework’ler kullanıldığı ya da SQL enjeksiyonu ve diğer veritabanı enjeksiyon saldırılarına karşı koruma sağlandığı doğrulanmalıdır. Bu durum, saklı yordam (stored procedure) yazarken de geçerlidir.",✓,✓,✓,, -V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.5,Uygulamanın işletim sistemi komut enjeksiyonlarına karşı korunduğu ve işletim sistemi çağrılarında parametreli OS sorguları veya bağlama özgü komut satırı çıktı kodlamasının kullanıldığı doğrulanmalıdır.,✓,✓,✓,, -V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.6,Uygulamanın LDAP enjeksiyon zafiyetlerine karşı korunduğu ya da LDAP enjeksiyonlarını önlemek için özel güvenlik kontrollerinin uygulandığı doğrulanmalıdır.,,✓,✓,, -V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.7,"XPath enjeksiyon saldırılarına karşı, sorgu parametrelemesi veya önceden derlenmiş sorgular kullanılarak koruma sağlandığı doğrulanmalıdır.",,✓,✓,, -V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.8,"LaTeX işlemcilerinin güvenli şekilde yapılandırıldığı (örneğin, --shell-escape bayrağının kullanılmadığı) ve yalnızca izin verilen komutlardan oluşan bir listeyle çalıştırıldığı doğrulanmalıdır.",,✓,✓,, -V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.9,Düzenli ifadelerde (regex) özel karakterlerin (genellikle ters eğik çizgi \ ile) kaçırılarak meta karakter olarak yorumlanmalarının önlendiği doğrulanmalıdır.,,✓,✓,, -V1,Kodlama (Encoding) ve Temizleme,V1.2,Enjeksiyon Önleme,V1.2.10,"Uygulamanın CSV ve formül enjeksiyonlarına karşı korunduğu doğrulanmalıdır. Uygulama, CSV içeriği dışa aktarırken RFC 4180 Bölüm 2.6 ve 2.7'de tanımlanan kaçış kurallarına uymalıdır. Ayrıca, CSV veya diğer tablo formatlarına (XLS, XLSX, ODF gibi) aktarım yapılırken, alanın ilk karakteri olarak çıkan özel karakterler ('=', '+', '-', '@', '\t' (sekme), '\0' (null karakter)) tek tırnak (') ile kaçırılmalıdır.",,,✓,, -V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.1,"WYSIWYG editörlerinden veya benzer kaynaklardan gelen tüm güvenilmeyen HTML girdilerinin, bilinen ve güvenli bir HTML temizleme kütüphanesi ya da çerçeve özelliği ile temizlendiği doğrulanmalıdır.",✓,✓,✓,, -V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.2,"Uygulamanın eval() veya Spring Expression Language (SpEL) gibi dinamik kod çalıştırma özelliklerini kullanmaktan kaçındığı doğrulanmalıdır. Alternatif yoksa, kullanıcı girdisi çalıştırılmadan önce mutlaka temizlenmelidir.",✓,✓,✓,, -V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.3,"Potansiyel olarak tehlikeli bir bağlamda kullanılacak verilerin, bu bağlama uygun karakterlere izin vermek ve çok uzun girdileri kısaltmak gibi güvenlik önlemleriyle önceden temizlendiği doğrulanmalıdır.",,✓,✓,, -V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.4,"Kullanıcı tarafından sağlanan SVG içeriğinin, yalnızca güvenli etiket ve özellikler (örneğin grafik çizme ile ilgili) içerdiğinden emin olmak için onaylandığı veya temizlendiği doğrulanmalıdır (ör. script veya foreignObject içermemelidir).",,✓,✓,, -V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.5,"Markdown, CSS, XSL stil sayfaları, BBCode veya benzeri ifade şablon dillerinde kullanıcı girdisinin temizlendiği veya bu tür özelliklerin devre dışı bırakıldığı doğrulanmalıdır.",,✓,✓,, -V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.6,"Uygulamanın, güvenilmeyen verileri başka servislere iletmeden önce izinli protokol, alan adı, yol ve port listelerine göre doğruladığı ve tehlikeli karakterleri temizlediği doğrulanarak SSRF (Sunucu Taraflı İstek Sahteciliği) saldırılarına karşı korunduğu doğrulanmalıdır.",,✓,✓,, -V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.7,"Uygulamanın şablon enjeksiyon saldırılarına karşı, güvenilmeyen girdilere dayalı şablon oluşturmayı engellediği; eğer bu kaçınılmazsa, bu girdilerin mutlaka temizlendiği veya sıkı şekilde onaylandığı doğrulanmalıdır.",,✓,✓,, -V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.8,JNDI sorgularında kullanılmadan önce güvenilmeyen girdilerin temizlendiği ve JNDI'nin enjeksiyonlara karşı güvenli şekilde yapılandırıldığı doğrulanmalıdır.,,✓,✓,, -V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.9,Memcache’e gönderilmeden önce içeriğin temizlenerek enjeksiyon saldırılarına karşı korunduğu doğrulanmalıdır.,,✓,✓,, -V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.10,Format dizgilerinin (format strings) beklenmeyen veya zararlı şekilde çözümlenmesini önlemek için işlenmeden önce temizlendiği doğrulanmalıdır.,,✓,✓,, -V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.11,"SMTP veya IMAP enjeksiyonlarını önlemek için, kullanıcı girdisinin posta sistemlerine iletilmeden önce temizlendiği doğrulanmalıdır.",,✓,✓,, -V1,Kodlama (Encoding) ve Temizleme,V1.3,Temizleme (Sanitization),V1.3.12,Regex girdilerinin üstel geri izlemeye (exponential backtracking) neden olan öğeler içermediği ve güvenilmeyen girdilerin ReDoS (Regex Denial of Service) gibi saldırılara karşı temizlendiği doğrulanmalıdır.,,,✓,, -V1,Kodlama (Encoding) ve Temizleme,V1.4,"Bellek, Dizgi ve Yönetilmeyen Kod",V1.4.1,"Yığın, arabellek (buffer) veya yığın belleği taşmalarını önlemek ya da tespit etmek amacıyla, bellek güvenli dizgi işlemlerinin, daha güvenli bellek kopyalama ve işaretçi aritmetiğinin kullanıldığı doğrulanmalıdır.",,✓,✓,, -V1,Kodlama (Encoding) ve Temizleme,V1.4,"Bellek, Dizgi ve Yönetilmeyen Kod",V1.4.2,"Tamsayı taşmalarını önlemek için işaret (sign), aralık (range) ve giriş doğrulama tekniklerinin kullanıldığı doğrulanmalıdır.",,✓,✓,, -V1,Kodlama (Encoding) ve Temizleme,V1.4,"Bellek, Dizgi ve Yönetilmeyen Kod",V1.4.3,Dinamik olarak ayrılan belleğin ve kaynakların serbest bırakıldığı ve boşaltılan belleklere ait referansların veya işaretçilerin kaldırıldığı veya null yapıldığı doğrulanmalıdır (dangling pointer ve use-after-free zafiyetlerine karşı).,,✓,✓,, -V1,Kodlama (Encoding) ve Temizleme,V1.5,Güvenli Ters Serileştirme (Safe Deserialization),V1.5.1,XML ayrıştırıcılarının (parser) kısıtlayıcı şekilde yapılandırıldığı ve dış varlık çözümleme (external entity resolution) gibi güvensiz özelliklerin XXE (XML eXternal Entity) saldırılarına karşı devre dışı bırakıldığı doğrulanmalıdır .,✓,✓,✓,, -V1,Kodlama (Encoding) ve Temizleme,V1.5,Güvenli Ters Serileştirme (Safe Deserialization),V1.5.2,"Güvenilmeyen verilerin ters serileştirilmesinde, nesne türleri için izinli liste kullanımı veya istemci tanımlı nesne türlerinin kısıtlanması gibi güvenli giriş işleme önlemlerinin uygulandığı doğrulanmalıdır. Güvensiz olarak tanımlanmış ters serileştirme mekanizmaları, güvenilmeyen girdilerle kullanılmamalıdır.",,✓,✓,, -V1,Kodlama (Encoding) ve Temizleme,V1.5,Güvenli Ters Serileştirme (Safe Deserialization),V1.5.3,"Aynı veri türü için uygulamada kullanılan farklı parser'ların (ör. JSON, XML, URL parser'ları), veriyi tutarlı şekilde ayrıştırdığı ve aynı karakter kodlamasını kullandığı doğrulanmalıdır. Böylece JSON birlikte çalışabilirlik açıkları, URI veya dosya ayrıştırma farkları gibi sorunlar nedeniyle RFI veya SSRF saldırılarının istismar edilmesi önlenir.",,,✓,, -V2,Doğrulama ve İş Mantığı,V2.1,Doğrulama ve İş Mantığı Dokümantasyonu,V2.1.1,"Uygulama dokümantasyonunda, veri öğelerinin beklenen yapıya göre nasıl doğrulanacağına ilişkin giriş doğrulama kurallarının tanımlandığı doğrulanmalıdır. Bu; kredi kartı numaraları, e-posta adresleri, telefon numaraları gibi yaygın veri biçimleri olabileceği gibi iç sistemlere özel biçimler de olabilir.",✓,✓,✓,, -V2,Doğrulama ve İş Mantığı,V2.1,Doğrulama ve İş Mantığı Dokümantasyonu,V2.1.2,"Uygulama dokümantasyonunda, birleştirilmiş veri öğelerinin mantıksal ve bağlamsal tutarlılığının nasıl doğrulanacağı tanımlanmalıdır (örneğin, mahalle ve posta kodunun eşleşip eşleşmediğinin kontrolü).",,✓,✓,, -V2,Doğrulama ve İş Mantığı,V2.1,Doğrulama ve İş Mantığı Dokümantasyonu,V2.1.3,"Hem kullanıcı bazında hem de uygulama genelinde geçerli olacak şekilde, iş mantığı sınırları ve doğrulama beklentilerinin belgelendiği doğrulanmalıdır.",,✓,✓,, -V2,Doğrulama ve İş Mantığı,V2.2,Girdi Doğrulama,V2.2.1,"Girdilerin, işlevsel ya da iş gereksinimlerine uygunluğunun doğrulandığı teyit edilmelidir. Bu işlem; izinli değerler, desenler ve aralıklar listesine karşı pozitif doğrulama ile ya da girdinin beklenen yapıya ve mantıksal sınırlara uygunluğunun önceden tanımlanmış kurallara göre karşılaştırılması ile yapılmalıdır. Seviye 1 için bu, güvenlik veya iş kararlarında kullanılan girdilere odaklanabilir. Seviye 2 ve üstü için tüm girdilere uygulanmalıdır.",✓,✓,✓,, -V2,Doğrulama ve İş Mantığı,V2.2,Girdi Doğrulama,V2.2.2,"Uygulamanın, güvenilir bir servis katmanında girdi doğrulama zorunluluğu uygulayacak şekilde tasarlandığı doğrulanmalıdır. İstemci tarafında gerçekleştirilen doğrulama, kullanılabilirliği artırabilir ve teşvik edilmelidir. Ancak bu doğrulama,güvenlik kontrolü olarak kabul edilmemelidir.",✓,✓,✓,, -V2,Doğrulama ve İş Mantığı,V2.2,Girdi Doğrulama,V2.2.3,"Uygulamanın, ilişkili veri öğelerinin önceden tanımlanmış kurallara göre makul olup olmadığını kontrol ettiği doğrulanmalıdır.",,✓,✓,, -V2,Doğrulama ve İş Mantığı,V2.3,İş Mantığı Güvenliği,V2.3.1,"Uygulamanın, aynı kullanıcı için iş mantığı akışlarını yalnızca beklenen adım sırasına göre ve adım atlamadan işlediği doğrulanmalıdır.",✓,✓,✓,, -V2,Doğrulama ve İş Mantığı,V2.3,İş Mantığı Güvenliği,V2.3.2,"İş mantığı sınırlarının, uygulama dokümantasyonuna uygun şekilde uygulandığı doğrulanmalıdır.",,✓,✓,, -V2,Doğrulama ve İş Mantığı,V2.3,İş Mantığı Güvenliği,V2.3.3,İş mantığı seviyesinde işlemlerin (transaction) kullanıldığı ve bir iş mantığı işleminin ya bütünüyle başarıyla tamamlandığı ya da önceki geçerli duruma geri döndürüldüğü (rollback) doğrulanmalıdır.,,✓,✓,, -V2,Doğrulama ve İş Mantığı,V2.3,İş Mantığı Güvenliği,V2.3.4,"İş mantığı düzeyinde kilitleme mekanizmalarının, sınırlı kaynakların (ör. sinema koltukları, teslimat zamanları) uygulamanın mantığı manipüle edilerek çift rezervasyona neden olmamasını sağladığı doğrulanmalıdır.",,✓,✓,, -V2,Doğrulama ve İş Mantığı,V2.3,İş Mantığı Güvenliği,V2.3.5,"Yüksek değerli iş mantığı akışlarının, yetkisiz veya kazara gerçekleşebilecek işlemleri önlemek için çoklu kullanıcı onayı gerektirdiği doğrulanmalıdır. Bu işlemler büyük para transferleri, sözleşme onayları, gizli bilgilere erişim veya üretimde güvenlik kurallarının geçersiz kılınmaları gibi durumları içerebilir.",,,✓,, -V2,Doğrulama ve İş Mantığı,V2.4,Otomasyon Karşıtı Önlemler,V2.4.1,"Uygulama işlevlerine yönelik aşırı miktardaki çağrılara karşı; veri sızdırma, anlamsız veri üretme, kota tüketme, hız sınırının aşılması, hizmet reddi (DoS) ya da maliyetli kaynakların aşırı kullanımı gibi risklere karşı otomasyon karşıtı kontrollerin bulunduğu doğrulanmalıdır.",,✓,✓,, -V2,Doğrulama ve İş Mantığı,V2.4,Otomasyon Karşıtı Önlemler,V2.4.2,"İş mantığı akışlarının, aşırı hızlı işlem gönderimlerini önleyecek şekilde gerçekçi insan zamanlaması gerektirdiği doğrulanmalıdır.",,,✓,, -V3,Web Ön Uç (Frontend) Güvenliği,V3.1,Web Frontend Güvenlik Dokümantasyonu,V3.1.1,"Uygulama dokümantasyonunda, uygulamayı kullanan tarayıcıların desteklemesi gereken güvenlik özelliklerinin (ör. HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) ve diğer ilgili HTTP güvenlik mekanizmaları) tanımlandığı doğrulanmalıdır. Ayrıca bu özelliklerin mevcut olmadığı durumlarda uygulamanın nasıl davranması gerektiği (ör. kullanıcıyı uyarmak veya erişimi engellemek) de tanımlanmalıdır.",,,✓,, -V3,Web Ön Uç (Frontend) Güvenliği,V3.2,İçeriğin Yanlış Yorumlanması,V3.2.1,"Tarayıcıların HTTP yanıtlarında içerik veya işlevi yanlış bir bağlamda sunmalarını önlemek amacıyla güvenlik kontrollerinin uygulandığı doğrulanmalıdır (ör. API, kullanıcı tarafından yüklenen dosya veya başka bir kaynağın doğrudan çağrılması durumunda). Olası kontroller arasında; yalnızca HTTP istek başlıklarının (ör. Sec-Fetch-\*) doğru bağlamı gösterdiği durumlarda içeriğin sunulması, Content-Security-Policy başlığında ""sandbox"" yönergesinin kullanılması veya Content-Disposition başlığında ""attachment"" biçiminin kullanılması yer alabilir.",✓,✓,✓,, -V3,Web Ön Uç (Frontend) Güvenliği,V3.2,İçeriğin Yanlış Yorumlanması,V3.2.2,"HTML yerine metin olarak görüntülenmesi amaçlanan içeriğin, HTML veya JavaScript gibi içeriklerin istenmeden çalıştırılmasını önleyecek şekilde ""createTextNode"" veya ""textContent"" gibi güvenli işleme fonksiyonlarıyla işlendiği doğrulanmalıdır.",✓,✓,✓,, -V3,Web Ön Uç (Frontend) Güvenliği,V3.2,İçeriğin Yanlış Yorumlanması,V3.2.3,"Uygulamanın istemci tarafı JavaScript kullanırken açık değişken tanımlamaları yaparak, sıkı tür kontrolü uygulayarak, global değişkenleri document nesnesine kaydetmekten kaçınarak ve ad alanı izolasyonu sağlayarak DOM clobbering’den kaçındığı doğrulanmalıdır.",,,✓,, -V3,Web Ön Uç (Frontend) Güvenliği,V3.3,Çerez Yapılandırması,V3.3.1,"Çerezlerin 'Secure' niteliğine sahip olduğu ve eğer çerez adı '\__Host-' ön eki ile başlamıyorsa, '__Secure-' ön ekinin kullanıldığı doğrulanmalıdır.",✓,✓,✓,, -V3,Web Ön Uç (Frontend) Güvenliği,V3.3,Çerez Yapılandırması,V3.3.2,"Kullanıcı arayüzü kandırma saldırılarına ve tarayıcı tabanlı istek sahteciliği saldırılarına (CSRF) karşı koruma sağlamak amacıyla, her çerezin 'SameSite' niteliğinin kullanım amacına uygun şekilde ayarlandığı doğrulanmalıdır.",,✓,✓,, -V3,Web Ön Uç (Frontend) Güvenliği,V3.3,Çerez Yapılandırması,V3.3.3,"Çerez adı, diğer sunucularla paylaşılmak üzere açıkça tasarlanmadığı sürece '__Host-' ön eki ile tanımlanmalıdır.",,✓,✓,, -V3,Web Ön Uç (Frontend) Güvenliği,V3.3,Çerez Yapılandırması,V3.3.4,"Bir çerez değeri istemci tarafı betikleri tarafından erişilememesi gereken bir veri içeriyorsa (ör. oturum token'ı), çerezin 'HttpOnly' niteliğine sahip olduğu ve aynı değerin (ör. oturum token'ı) yalnızca 'Set-Cookie' başlığı ile istemciye iletildiği doğrulanmalıdır.",,✓,✓,, -V3,Web Ön Uç (Frontend) Güvenliği,V3.3,Çerez Yapılandırması,V3.3.5,"Uygulama bir çerez oluştururken, çerez adı ve değerinin toplam uzunluğunun 4096 baytı aşmadığı doğrulanmalıdır. Çok büyük çerezler tarayıcı tarafından saklanmaz ve isteklerle gönderilmez; bu da çereze bağlı çalışan uygulama işlevlerinin bozulmasına yol açabilir.",,,✓,, -V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.2,"Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header'ı, uygulama tarafından sabit bir değer olarak tanımlanmalı veya gelen Origin header değeri güvenilir origin’lerden oluşan bir izinli listeye karşı doğrulanmalıdır. ‘Access-Control-Allow-Origin: *’ kullanılması gerekiyorsa, yanıtın hassas bilgi içermediği doğrulanmalıdır.",✓,✓,✓,, -V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.3,"HTTP yanıtlarında Content-Security-Policy header'ı bulunduğu ve bu header'ın yalnızca güvenilen içeriklerin veya kaynakların yüklenmesini ve çalıştırılmasını sağlayan yönergeler içerdiği doğrulanmalıdır. Minimum olarak ""global policy"", object-src 'none', base-uri 'none' yönergelerini içermeli ve izinli liste, nonce veya hash temelli bir yapı içermelidir. Seviye 3 uygulamalarında her yanıt için nonce veya hash içeren özel bir politika tanımlanmalıdır.",,✓,✓,, -V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.4,"Tüm HTTP yanıtlarının 'X-Content-Type-Options: nosniff' header'ını içerdiği doğrulanmalıdır. Bu, tarayıcıya içerik türünü tahmin etmeyi bırakmasını ve yanıtın Content-Type header'ında belirtilen MIME türünün, beklenen kaynak türüyle eşleşmesini zorunlu kılar. Ayrıca bu, tarayıcıda CORB (Cross-Origin Read Blocking) özelliğini etkinleştirir.",,✓,✓,, -V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.5,"Uygulamanın, 'Referer' başlığı yoluyla üçüncü taraflara teknik olarak hassas verilerin sızmasını önlemek için bir 'referrer policy' belirlediği doğrulanmalıdır. Bu, Referrer-Policy HTTP header'ıyla veya HTML öğe nitelikleriyle (element attributes) sağlanabilir. Sızabilecek hassas bilgiler, URL’deki yol ve sorgu parametreleri ile sınırlı uygulamalarda hostname bilgisini içerebilir.",,✓,✓,, -V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.6,"Uygulamanın, Content-Security-Policy header'ı altında 'frame-ancestors' yönergesini her HTTP yanıtında tanımladığı ve bu sayede içeriklerin varsayılan olarak başka sayfalara gömülmesini engellediği doğrulanmalıdır. Gerekli durumlarda özel olarak izin verildiğinden emin olunmalıdır. 'X-Frame-Options' header'ı, tarayıcılar tarafından desteklenmesine rağmen, artık güncel değildir ve güvenlik amacıyla kullanılmamalıdır.",,✓,✓,, -V3,Web Ön Uç (Frontend) Güvenliği,V3.4,Tarayıcı Güvenlik Mekanizması Başlıkları (Header),V3.4.8,"Bir belgenin işlenmesini ve sunulmasını başlatan tüm HTTP yanıtlarında (örneğin 'text/html' tipi yanıtlar), 'Cross-Origin-Opener-Policy' header'ı 'same-origin' veya 'same-origin-allow-popups' yönergeleriyle birlikte yer almalıdır. Bu, tabnabbing ve frame counting gibi, pencere nesnelerine paylaşımlı erişimi sömüren saldırılara karşı koruma sağlar.",,,✓,, -V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.1,"Uygulama, hassas işlevselliğe yönelik izinsiz cross-origin istekleri önlemek için CORS preflight mekanizmasına güvenmiyorsa, bu tür isteklerin gerçekten uygulamadan geldiği doğrulanmalıdır. Bu, anti-forgery token kullanımı veya CORS tarafından güvenli kabul edilmeyen özel HTTP header'larının zorunlu kılınmasıyla yapılabilir. Bu, tarayıcı tabanlı istek sahteciliği (CSRF) saldırılarına karşı bir savunmadır.",✓,✓,✓,, -V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.2,"Uygulama, hassas işlevlerin izinsiz cross-origin çağrılmasını önlemek için CORS preflight mekanizmasına güveniyorsa, bu işlevlerin bir CORS-preflight isteğini tetiklemeden çağrılamadığı doğrulanmalıdır. Bu, 'Origin' ve 'Content-Type' header'larının doğrulanmasını veya CORS-safelisted olmayan bir header'ın ve alanın kullanılmasını gerektirebilir.",✓,✓,✓,, -V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.4,"Farklı uygulamaların farklı hostname'lerde barındırıldığı ve böylece Same-Origin Policy tarafından sağlanan kısıtlamalardan (örneğin çerez erişim sınırları, kaynaklar arası etkileşim kontrolleri) faydalanıldığı doğrulanmalıdır.",,✓,✓,, -V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.6,"Uygulamanın herhangi bir yerinde JSONP işlevselliğinin etkin olmadığı doğrulanmalıdır. Bu, XSSI (Cross-Site Script Inclusion) saldırılarını önlemek içindir.",,,✓,, -V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.7,"Yetkilendirme gerektiren verilerin, JavaScript dosyaları gibi betik kaynaklarının yanıtlarında yer almadığı, XSSI saldırılarını önlemek için doğrulanmalıdır.",,,✓,, -V3,Web Ön Uç (Frontend) Güvenliği,V3.5,Tarayıcı Menşei Ayırımı,V3.5.8,"Kimliği doğrulanmış kaynakların (örneğin görseller, videolar, betikler ve belgeler) yalnızca gerçekten amaçlandığında kullanıcı adına yüklenebildiği veya gömülebildiği doğrulanmalıdır. Bu, isteğin uygun olmayan bir çapraz kaynak çağrısından kaynaklanmadığından emin olmak için Sec-Fetch-* HTTP istek başlığı alanlarının sıkı bir şekilde doğrulanmasıyla veya tarayıcıya döndürülen içeriği engelleme talimatı vermek için kısıtlayıcı bir Cross-Origin-Resource-Policy HTTP yanıt başlığı alanı ayarlayarak gerçekleştirilebilir.",,,✓,, -V3,Web Ön Uç (Frontend) Güvenliği,V3.6,Harici Kaynak Bütünlüğü,V3.6.1,"JavaScript kütüphaneleri, CSS veya web fontları gibi istemci tarafı varlıkların yalnızca statik ve sürümlü olması, varlığın bütünlüğünü doğrulamak için Subresource Integrity (SRI) kullanılması durumunda harici olarak (örneğin, bir İçerik Dağıtım Ağı üzerinde) barındırıldığı doğrulanmalıdır. Bu mümkün değilse, her bir kaynak için bunu gerekçelendiren belgelenmiş bir güvenlik kararı bulunmalıdır.",,,✓,, -V3,Web Ön Uç (Frontend) Güvenliği,V3.7,Diğer Tarayıcı Güvenliği Hususları,V3.7.1,"Uygulamanın yalnızca hâlâ desteklenen ve güvenli kabul edilen istemci tarafı teknolojileri kullandığı doğrulanmalıdır. Bu gereksinimi karşılamayan teknolojilere örnek olarak NSAPI eklentileri, Flash, Shockwave, ActiveX, Silverlight, NACL veya istemci tarafı Java applet’leri verilebilir.",,✓,✓,, -V3,Web Ön Uç (Frontend) Güvenliği,V3.7,Diğer Tarayıcı Güvenliği Hususları,V3.7.2,"Uygulamanın, yalnızca hedef adres bir izinli listede yer alıyorsa kullanıcıyı otomatik olarak farklı bir ana makine adına veya uygulamanın kontrolünde olmayan bir etki alanına yönlendirdiği doğrulanmalıdır.",,✓,✓,, -V3,Web Ön Uç (Frontend) Güvenliği,V3.7,Diğer Tarayıcı Güvenliği Hususları,V3.7.3,"Uygulamanın, kullanıcı uygulamanın kontrolü dışındaki bir URL’ye yönlendirildiğinde, yönlendirme hakkında bir bildirim gösterdiği ve kullanıcının bu gezintiyi iptal edebilmesi için bir seçenek sunduğu doğrulanmalıdır.",,,✓,, -V3,Web Ön Uç (Frontend) Güvenliği,V3.7,Diğer Tarayıcı Güvenliği Hususları,V3.7.4,"Uygulamanın en üst düzey etki alanının (örneğin, site.tld) HTTP Strict Transport Security (HSTS) için genel preload listesine eklendiği doğrulanmalıdır. Bu, uygulamanın TLS kullanımının ana tarayıcılar tarafından doğrudan tanınmasını ve yalnızca Strict-Transport-Security yanıt header'ına bağlı kalınmamasını sağlar.",,,✓,, -V3,Web Ön Uç (Frontend) Güvenliği,V3.7,Diğer Tarayıcı Güvenliği Hususları,V3.7.5,"Uygulamaya erişen tarayıcının beklenen güvenlik özelliklerini desteklememesi durumunda, uygulamanın dokümantasyona uygun şekilde davrandığı (örneğin kullanıcıyı uyarma veya erişimi engelleme) doğrulanmalıdır.",,,✓,, -V4,API ve Web Servisi,V4.1,Genel Web Servisi Güvenliği,V4.1.1,"İleti gövdesi içeren her HTTP yanıtında, yanıtın gerçek içeriğiyle eşleşen bir Content-Type header alanı bulunduğu ve güvenli karakter kodlamasını (örneğin, UTF-8, ISO-8859-1) belirtmek üzere charset parametresi içerdiği doğrulanmalıdır. Bu işlem, IANA Medya Türleri'nden ""text/"", ""/+xml"" ve ""/xml"" gibi içerikler için geçerlidir.",✓,✓,✓,, -V4,API ve Web Servisi,V4.1,Genel Web Servisi Güvenliği,V4.1.2,"Yalnızca kullanıcı arayüzüne yönelik uç noktaların (manuel olarak web tarayıcısı ile erişilmesi amaçlanan) otomatik olarak HTTP'den HTTPS'e yönlendirme yaptığı ve diğer hizmetlerin veya uç noktaların şeffaf yönlendirme gerçekleştirmediği doğrulanmalıdır. Bu, istemcinin farkında olmadan şifrelenmemiş HTTP istekleri göndermesi ve bu isteklerin otomatik olarak HTTPS'e yönlendirilmesi sonucunda hassas verilerin sızmasının fark edilmemesi riskini önlemek içindir.",,✓,✓,, -V4,API ve Web Servisi,V4.1,Genel Web Servisi Güvenliği,V4.1.3,"Uygulama tarafından kullanılan ve yük dengeleyici, web proxy veya frontend için backend hizmeti gibi bir ara katman tarafından ayarlanan herhangi bir HTTP başlık alanının, son kullanıcı tarafından geçersiz kılınamayacağı doğrulanmalıdır. Örnek başlıklar arasında X-Real-IP, X-Forwarded-* veya X-User-ID yer alabilir.",,✓,✓,, -V4,API ve Web Servisi,V4.1,Genel Web Servisi Güvenliği,V4.1.4,Uygulama veya API tarafından açıkça desteklenen HTTP yöntemlerinin (preflight istekleri sırasında OPTIONS dahil) dışında hiçbir yöntemin kullanılmadığı ve kullanılmayan yöntemlerin engellendiği doğrulanmalıdır.,,,✓,, -V4,API ve Web Servisi,V4.1,Genel Web Servisi Güvenliği,V4.1.5,"Çok hassas istekler veya birçok sistemden geçen işlemler için, taşıma katmanı güvenliğinin üzerine ek bir güvence sağlamak amacıyla, her iletiye özel dijital imzaların kullanıldığı doğrulanmalıdır.",,,✓,, -V4,API ve Web Servisi,V4.2,HTTP İleti Yapısı Doğrulama,V4.2.1,"Tüm uygulama bileşenlerinin (yük dengeleyiciler, güvenlik duvarları ve uygulama sunucuları dahil) HTTP sürümüne uygun mekanizmaları kullanarak gelen HTTP iletilerinin sınırlarını belirlediği ve bu sayede HTTP istek kaçakçılığına karşı koruma sağlandığı doğrulanmalıdır. HTTP/1.x sürümünde Transfer-Encoding başlık alanı varsa, RFC 2616'ya göre Content-Length başlığı göz ardı edilmelidir. HTTP/2 veya HTTP/3 kullanıldığında, Content-Length başlığı varsa, alıcının bu değerin DATA çerçevelerinin uzunluğuyla tutarlı olduğunu doğrulaması gerekir.",,✓,✓,, -V4,API ve Web Servisi,V4.2,HTTP İleti Yapısı Doğrulama,V4.2.2,"HTTP iletileri üretilirken, Content-Length başlığının, HTTP protokolünün çerçeveleme yöntemine göre belirlenen içerik uzunluğu ile çelişmediği doğrulanmalıdır. Bu, istek kaçakçılığı saldırılarını önlemek için gereklidir.",,,✓,, -V4,API ve Web Servisi,V4.2,HTTP İleti Yapısı Doğrulama,V4.2.3,"Uygulamanın, yanıt bölme ve header enjeksiyonu saldırılarını önlemek amacıyla, bağlantıya özel başlık alanları (örneğin Transfer-Encoding) içeren HTTP/2 veya HTTP/3 iletilerini göndermediği ve kabul etmediği doğrulanmalıdır.",,,✓,, -V4,API ve Web Servisi,V4.2,HTTP İleti Yapısı Doğrulama,V4.2.4,"Uygulamanın yalnızca başlık alanları ve değerleri CR (\r), LF (\n) veya CRLF (\r\n) karakter dizileri içermeyen HTTP/2 ve HTTP/3 isteklerini kabul ettiği doğrulanmalıdır. Bu, başlık enjeksiyonu saldırılarını önlemek içindir.",,,✓,, -V4,API ve Web Servisi,V4.2,HTTP İleti Yapısı Doğrulama,V4.2.5,"Uygulama (backend veya frontend) istek oluşturuyor ve gönderiyorsa, URI'ler (örneğin API çağrıları için) veya HTTP istek başlıkları (örneğin Authorization veya Cookie) gibi bileşenlerin, alıcı sistemler tarafından kabul edilemeyecek kadar uzun olmamasını sağlamak amacıyla doğrulama, temizleme veya diğer mekanizmaları kullandığı doğrulanmalıdır. Bu tür çok uzun istekler (örneğin çok uzun bir Cookie başlığı) gönderildiğinde sunucunun sürekli hata durumu döndürmesiyle hizmet reddi oluşabilir.",,,✓,, -V4,API ve Web Servisi,V4.3,GraphQL,V4.3.1,"Maliyetli ve iç içe geçmiş sorgular sonucu oluşabilecek GraphQL veya veri katmanı ifadelerine yönelik Hizmet Reddi (DoS) saldırılarını önlemek için, sorgu izin listesi (allowlist), derinlik sınırlandırması, sorgu sayısı sınırlandırması veya sorgu maliyeti analizi kullanıldığı doğrulanmalıdır.",,✓,✓,, -V4,API ve Web Servisi,V4.3,GraphQL,V4.3.2,"GraphQL introspection (iç yapı sorgulama) sorgularının, GraphQL API'nin üçüncü taraflar tarafından kullanılmasına yönelik olmadığı sürece, üretim ortamında devre dışı bırakıldığı doğrulanmalıdır.",,✓,✓,, -V4,API ve Web Servisi,V4.4,WebSocket,V4.4.1,Tüm WebSocket bağlantılarında TLS üzerinden WebSocket (WSS) kullanıldığı doğrulanmalıdır.,✓,✓,✓,, -V4,API ve Web Servisi,V4.4,WebSocket,V4.4.2,"WebSocket'in başlangıçtaki HTTP el sıkışması (handshake) sırasında, Origin başlık alanının uygulama için izin verilen origin listesiyle karşılaştırılarak kontrol edildiği doğrulanmalıdır.",,✓,✓,, -V4,API ve Web Servisi,V4.4,WebSocket,V4.4.3,"Uygulamanın standart oturum yönetimi kullanılamıyorsa, bunun yerine ilgili Oturum Yönetimi güvenlik gereksinimlerine uygun özel token'ların kullanıldığı doğrulanmalıdır.",,✓,✓,, -V4,API ve Web Servisi,V4.4,WebSocket,V4.4.4,"HTTPS oturumu WebSocket kanalına geçerken, özel WebSocket oturum yönetim token’larının önceki şekilde kimliği doğrulanmış HTTPS oturumu aracılığıyla elde edildiği veya doğrulandığı doğrulanmalıdır.",,✓,✓,, -V5,Dosya İşleme,V5.1,Dosya İşleme Dokümantasyonu,V5.1.1,"Dokümantasyonun, her yükleme özelliği için izin verilen dosya türlerini, beklenen dosya uzantılarını ve maksimum boyutu (açılmış hali dahil) tanımladığı doğrulanmalıdır. Ayrıca, dosyaların son kullanıcılar için nasıl güvenli hâle getirileceği (örneğin kötü amaçlı bir dosya tespit edildiğinde uygulamanın nasıl davranacağı) gibi bilgilerin de belgede yer aldığı doğrulanmalıdır.",,✓,✓,, -V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.1,"Uygulamanın, yalnızca performans kaybına veya hizmet reddine yol açmayacak boyuttaki dosyaları kabul ettiği doğrulanmalıdır.",✓,✓,✓,, -V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.2,"Uygulama bir dosyayı, doğrudan veya bir arşiv (ör. zip dosyası) içinde kabul ettiğinde, dosya uzantısının beklenen uzantıyla eşleşip eşleşmediğini kontrol ettiği ve içeriğin uzantı tarafından temsil edilen türle uyumlu olduğunu doğruladığı kontrol edilmelidir. Bu; ilk 'magic byte' kontrolü, görüntü yeniden yazımı ve dosya içeriği doğrulama için özel kütüphanelerin kullanımı gibi yöntemleri içerir. Seviye 1 için bu, yalnızca iş veya güvenlik kararlarında kullanılan dosyalarla sınırlı olabilir. Seviye 2 ve üzeri için tüm dosyalar bu kontrole tabi olmalıdır.",✓,✓,✓,, -V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.3,"Sıkıştırılmış dosyaların (ör. zip, gz, docx, odt) açılmadan önce, izin verilen maksimum açılmış boyuta ve maksimum dosya sayısına göre kontrol edildiği doğrulanmalıdır.",,✓,✓,, -V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.4,Her kullanıcı için dosya boyutu kotası ve maksimum dosya sayısının uygulandığı doğrulanmalıdır. Böylece tek bir kullanıcının çok sayıda veya aşırı büyük dosya yükleyerek depolama alanını doldurması engellenir.,,,✓,, -V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.5,"Uygulamanın, içinde sembolik bağlantılar (symlink) bulunan sıkıştırılmış dosyaların yüklenmesine yalnızca bu durum özel olarak gerekli olduğunda izin verdiği doğrulanmalıdır. Bu durumda, sembolik bağlantı verilebilecek dosyaların bir izinli listesi uygulanmalıdır.",,,✓,, -V5,Dosya İşleme,V5.2,Dosya Yükleme ve İçerik,V5.2.6,"Uygulamanın, piksel boyutu izin verilen maksimum değeri aşan görüntü dosyalarının yüklenmesini reddettiği doğrulanmalıdır. Bu, pixel flood saldırılarını önlemek için gereklidir.",,,✓,, -V5,Dosya İşleme,V5.3,Dosya Depolama,V5.3.1,"Güvenilmeyen girdilerle yüklenen veya oluşturulan ve herkese açık klasörlerde depolanan dosyaların, bir HTTP isteğiyle doğrudan erişildiğinde sunucu taraflı program kodu olarak çalıştırılmadığı doğrulanmalıdır.",✓,✓,✓,, -V5,Dosya İşleme,V5.3,Dosya Depolama,V5.3.2,"Uygulamanın, dosya işlemleri için dosya yollarını oluştururken kullanıcı tarafından gönderilen dosya adlarını değil, dahili olarak oluşturulan veya güvenilir verileri kullandığı; eğer kullanıcı tarafından gönderilen dosya adları veya meta veriler kullanılacaksa, sıkı doğrulama ve temizleme işlemlerinin uygulandığı doğrulanmalıdır. Bu, yol geçişi (path traversal), yerel veya uzak dosya dahil etme (LFI, RFI) ve sunucu tarafı istek sahteciliği (SSRF) saldırılarına karşı koruma sağlar.",✓,✓,✓,, -V5,Dosya İşleme,V5.3,Dosya Depolama,V5.3.3,"Sunucu tarafında gerçekleşen dosya işlemlerinin (örneğin dosya açma/decompress işlemi), kullanıcı tarafından sağlanan yol bilgilerini yok saydığı ve zip slip gibi güvenlik açıklarını önlediği doğrulanmalıdır.",,,✓,, -V5,Dosya İşleme,V5.4,Dosya İndirme,V5.4.1,"Uygulamanın, kullanıcı tarafından gönderilen dosya adlarını (ör. JSON, JSONP veya URL parametresinde) doğruladığı veya göz ardı ettiği ve yanıtın Content-Disposition başlık alanında bir dosya adı belirttiği doğrulanmalıdır.",,✓,✓,, -V5,Dosya İşleme,V5.4,Dosya İndirme,V5.4.2,"Sunulan dosya adlarının (örneğin HTTP yanıt header'larında veya e-posta eklerinde), belge yapısını korumak ve enjeksiyon saldırılarını önlemek için kodlandığı veya temizlendiği (ör. RFC 6266’ya uygun) doğrulanmalıdır.",,✓,✓,, -V5,Dosya İşleme,V5.4,Dosya İndirme,V5.4.3,"Güvenilmeyen kaynaklardan elde edilen dosyaların, bilinen kötü amaçlı içeriklerin sunulmasını önlemek amacıyla antivirüs tarayıcılarıyla tarandığı doğrulanmalıdır.",,✓,✓,, -V6,Kimlik Doğrulama,V6.1,Kimlik Doğrulama Dokümantasyonu,V6.1.1,"Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırılarına karşı oran sınırlama (rate limiting), otomasyon karşıtı önlemler ve uyarlanabilir yanıt gibi kontrollerin nasıl kullanıldığını açıklayan bir uygulama dokümantasyonu bulunduğu doğrulanmalıdır. Dokümantasyon, bu kontrollerin nasıl yapılandırıldığını ve kötü niyetli hesap kilitlemenin nasıl önlendiğini açıkça ortaya koymalıdır.",✓,✓,✓,, -V6,Kimlik Doğrulama,V6.1,Kimlik Doğrulama Dokümantasyonu,V6.1.2,"Parolalarda kullanılmasını önlemek amacıyla, bağlama özgü sözcüklerin (örneğin kurum adlarının permütasyonları, ürün adları, sistem tanımlayıcıları, proje kod adları, departman veya rol adları vb.) bulunduğu belgelenmiş bir liste mevcut olduğu doğrulanmalıdır.",,✓,✓,, -V6,Kimlik Doğrulama,V6.1,Kimlik Doğrulama Dokümantasyonu,V6.1.3,"Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, bunların tümünün belgelenmiş olduğu ve her yol için tutarlı şekilde uygulanması gereken güvenlik kontrolleri ile kimlik doğrulama gücünün tanımlandığı doğrulanmalıdır.",,✓,✓,, -V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.1,"Kullanıcı tarafından belirlenen parolaların en az 8 karakter uzunluğunda olması sağlanmalı, ancak 15 karakter ve üzeri uzunlukta parolalar olmaları şiddetle tavsiye edilir.",✓,✓,✓,, -V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.2,Kullanıcıların parolalarını değiştirebilmeleri sağlanmalıdır.,✓,✓,✓,, -V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.3,Parola değiştirme işlevinin hem mevcut hem de yeni parolayı gerektirdiği doğrulanmalıdır.,✓,✓,✓,, -V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.4,"Kayıt veya parola değişimi sırasında girilen parolaların, uygulamanın parola politikasına (örneğin minimum uzunluk) uyan ilk 3000 yaygın parolaya karşı kontrol edildiği doğrulanmalıdır.",✓,✓,✓,, -V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.5,"Her tür karakterin kullanılmasına izin verildiği ve büyük/küçük harf, sayı veya özel karakter şartlarının zorunlu tutulmadığı doğrulanmalıdır.",✓,✓,✓,, -V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.6,"Parola giriş alanlarının, girdiyi maskelemek için ""type=password"" kullandığı doğrulanmalıdır. Uygulamalar, kullanıcının tüm maskelenmiş parolayı ya da son girilen karakteri geçici olarak görüntülemesine izin verebilir.",✓,✓,✓,, -V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.7,"""Yapıştır"" özelliğinin, tarayıcı parola yardımcılarının ve harici parola yöneticilerinin kullanımına izin verildiği doğrulanmalıdır.",✓,✓,✓,, -V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.8,"Uygulamanın, kullanıcıdan aldığı parolayı herhangi bir şekilde değiştirmeden, örneğin kesmeden veya harf büyüklüğünü değiştirmeden, tam olarak doğruladığı teyit edilmelidir.",✓,✓,✓,, -V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.9,En az 64 karakter uzunluğundaki parolalara izin verildiği doğrulanmalıdır.,,✓,✓,, -V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.10,"Kullanıcının parolasının, yalnızca ele geçirildiği tespit edildiğinde veya kullanıcı tarafından yenilendiğinde geçerliliğini yitirdiği doğrulanmalıdır. Uygulama, belirli aralıklarla parola yenilenmesini zorunlu kılmamalıdır.",,✓,✓,, -V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.11,"Tahmin edilmesi kolay parolaların oluşturulmasını önlemek amacıyla, bağlama özgü kelimelerin yer aldığı belgelenmiş listenin parola doğrulamada kullanıldığı teyit edilmelidir.",,✓,✓,, -V6,Kimlik Doğrulama,V6.2,Parola Güvenliği,V6.2.12,"Kayıt veya parola değişikliği sırasında girilen parolaların, ele geçirilmiş parolalar listesine karşı kontrol edildiği doğrulanmalıdır.",,✓,✓,, -V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.1,"Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırıları gibi saldırıları önlemeye yönelik kontrollerin, uygulamanın güvenlik dokümantasyonuna göre uygulandığı doğrulanmalıdır.",✓,✓,✓,, -V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.2,"""root"", ""admin"" veya ""sa"" gibi varsayılan kullanıcı hesaplarının uygulamada yer almadığı veya devre dışı bırakıldığı doğrulanmalıdır.",✓,✓,✓,, -V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.3,"Uygulamaya erişim için ya çok faktörlü bir kimlik doğrulama mekanizması ya da tek faktörlü mekanizmaların kombinasyonu kullanılmalıdır. Seviye 3 için, bu faktörlerden biri, oltalama saldırılarına karşı direnç sağlayan ve kimlik doğrulama niyetini bir kullanıcı etkileşimi (örneğin FIDO donanım anahtarında bir düğmeye basma veya mobil telefonda bir onay) gerektirerek doğrulayan donanım tabanlı bir kimlik doğrulayıcı olmalıdır. Bu gereksinimdeki herhangi bir esneklik için, gerekçesi belgelenmiş ve riskleri azaltıcı kapsamlı kontroller içeren bir plan gereklidir.",,✓,✓,, -V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.4,"Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, belgelendirilmemiş bir yol bulunmadığı ve tüm yollar için güvenlik kontrolleri ile kimlik doğrulama gücünün tutarlı şekilde uygulandığı doğrulanmalıdır.",,✓,✓,, -V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.5,"Başarılı veya başarısız şüpheli kimlik doğrulama girişimlerinin kullanıcıya bildirildiği doğrulanmalıdır. Bu, olağandışı bir konum veya istemciden gelen girişimler, yalnızca bir faktörle yapılan kısmen başarılı doğrulamalar, uzun süreli inaktiflik sonrası yapılan girişimler veya birçok başarısız denemeden sonraki başarılı girişimler gibi durumları içerebilir.",,,✓,, -V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.6,"E-postanın, tek faktörlü ya da çok faktörlü kimlik doğrulama mekanizması olarak kullanılmadığı doğrulanmalıdır.",,,✓,, -V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.7,"Kimlik doğrulama detaylarında yapılan güncellemeler sonrasında (örneğin kimlik bilgisi sıfırlama, kullanıcı adı veya e-posta adresi değişiklikleri), kullanıcıların bilgilendirildiği doğrulanmalıdır.",,,✓,, -V6,Kimlik Doğrulama,V6.3,Genel Kimlik Doğrulama Güvenliği,V6.3.8,"Başarısız kimlik doğrulama girişimlerinden, geçerli kullanıcıların hata mesajları, HTTP yanıt kodları veya farklı yanıt süreleri gibi sonuçlara dayanarak tespit edilemediği doğrulanmalıdır. Bu koruma, kayıt ve ""parolamı unuttum"" işlevselliğinde de geçerli olmalıdır.",,,✓,, -V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.1,"Sistem tarafından oluşturulan ilk parolaların veya etkinleştirme kodlarının güvenli bir şekilde rastgele üretildiği, mevcut parola politikasına uygun olduğu, kısa bir süre içinde veya ilk kullanım sonrasında geçerliliğini yitirdiği doğrulanmalıdır. Bu başlangıç sırları uzun vadeli parola olarak kullanılmasına izin verilmemelidir.",✓,✓,✓,, -V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.2,"Parola ipuçlarının veya ""gizli sorular"" olarak bilinen, bilgiye dayalı kimlik doğrulama mekanizmalarının mevcut olmadığı doğrulanmalıdır.",✓,✓,✓,, -V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.3,"Unutulmuş parolanın sıfırlanması için, etkin olan çok faktörlü kimlik doğrulama mekanizmalarını atlamayan güvenli bir sürecin uygulandığı doğrulanmalıdır.",,✓,✓,, -V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.4,"Çok faktörlü kimlik doğrulama faktörlerinden biri kaybolursa, kayıt sırasında uygulanan kimlik kanıtlama seviyesiyle aynı seviyede kimlik doğrulama yapıldığı doğrulanmalıdır.",,✓,✓,, -V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.5,"Süresi dolacak kimlik doğrulama mekanizmalarının yenilenmesine ilişkin talimatların, süresi dolmadan önce tamamlanacak şekilde yeterli sürede gönderildiği ve gerekiyorsa otomatik hatırlatıcıların yapılandırıldığı doğrulanmalıdır.",,,✓,, -V6,Kimlik Doğrulama,V6.4,Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma,V6.4.6,"Yönetici yetkisi olan kullanıcıların, kullanıcının parola sıfırlama sürecini başlatabildiği ancak kullanıcının yeni parolasını belirleyemediği veya değiştiremediği doğrulanmalıdır. Bu, yönetici yetkisi olan kullanıcıların, kullanıcı parolasını bilmesini engeller.",,,✓,, -V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.1,"Arama sırları, bant dışı kimlik doğrulama istekleri veya kodları ve zamana dayalı tek kullanımlık parolaların (TOTP) yalnızca bir kez kullanılabildiği doğrulanmalıdır.",,✓,✓,, -V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.2,"Uygulamanın backend tarafında saklanırken, 112 bitten az entropiye sahip (örneğin 19 rastgele harf-rakam karakteri veya 34 rastgele rakam) arama sırlarının, 32-bit rastgele bir salt içeren onaylı bir parola saklama algoritmasıyla hash’lendiği doğrulanmalıdır. Gizli bilginin entropisi 112 bit veya daha fazlaysa standart bir hash fonksiyonu kullanılabilir.",,✓,✓,, -V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.3,"Arama sırları, bant dışı kimlik doğrulama kodları ve zamana dayalı tek kullanımlık parola seed'lerinin, öngörülebilir değerlerden kaçınmak için Kriptografik Olarak Güvenli Sözde Rastgele Sayı Üreteci (CSPRNG) ile oluşturulduğu doğrulanmalıdır.",,✓,✓,, -V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.4,Arama sırlarının ve bant dışı kimlik doğrulama kodlarının en az 20 bit entropiye (genellikle 4 rastgele harf-rakam karakteri veya 6 rastgele rakam) sahip olduğu doğrulanmalıdır.,,✓,✓,, -V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.5,"Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının ve zamana dayalı tek kullanımlık parolaların (TOTP) belirli bir ömre sahip olduğu doğrulanmalıdır. Bant dışı istekler en fazla 10 dakika, TOTP’ler ise en fazla 30 saniye geçerli olmalıdır.",,✓,✓,, -V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.6,Herhangi bir kimlik doğrulama faktörünün (fiziksel cihazlar dahil) çalınması veya kaybı durumunda iptal edilebildiği doğrulanmalıdır.,,,✓,, -V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.7,"Biyometrik kimlik doğrulama mekanizmalarının yalnızca ikincil faktör olarak, “sahip olduğunuz bir şey” veya “bildiğiniz bir şey” ile birlikte kullanıldığı doğrulanmalıdır.",,,✓,, -V6,Kimlik Doğrulama,V6.5,Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler,V6.5.8,"Zamana dayalı tek kullanımlık parolaların (TOTP) doğrulamasının, güvenilir bir hizmetten alınan zaman kaynağına dayanarak yapıldığı ve güvenilir olmayan veya istemci tarafından sağlanan zaman kaynağına dayanmadığı doğrulanmalıdır.",,,✓,, -V6,Kimlik Doğrulama,V6.6,Bant Dışı Kimlik Doğrulama Mekanizmaları,V6.6.1,"Tek kullanımlık parolaların (OTP) telefon veya SMS ile Public Switched Telephone Network (PSTN) üzerinden iletildiği kimlik doğrulama mekanizmalarının, yalnızca telefon numarası önceden doğrulanmışsa, alternatif daha güçlü yöntemler (örneğin TOTP) de sunuluyorsa ve kullanıcıya güvenlik riskleri hakkında bilgi veriliyorsa sunulduğu doğrulanmalıdır. Seviye 3 uygulamalar için telefon ve SMS seçenekleri sunulmamalıdır.",,✓,✓,, -V6,Kimlik Doğrulama,V6.6,Bant Dışı Kimlik Doğrulama Mekanizmaları,V6.6.2,"Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının, oluşturuldukları özgün kimlik doğrulama isteğiyle bağlantılı olduğu ve daha önceki ya da sonraki bir istek için kullanılamadığı doğrulanmalıdır.",,✓,✓,, -V6,Kimlik Doğrulama,V6.6,Bant Dışı Kimlik Doğrulama Mekanizmaları,V6.6.3,"Kod tabanlı bant dışı kimlik doğrulama mekanizmalarının, oran sınırlaması ile kaba kuvvet saldırılarına karşı korunduğu doğrulanmalıdır. En az 64 bit entropiye sahip kodlar kullanılması da değerlendirilmelidir.",,✓,✓,, -V6,Kimlik Doğrulama,V6.6,Bant Dışı Kimlik Doğrulama Mekanizmaları,V6.6.4,"Çok faktörlü kimlik doğrulama için push bildirimleri kullanılıyorsa, push bombing saldırılarına karşı oran sınırlamasının kullanıldığı doğrulanmalıdır. “Numara eşleştirme” de bu riski azaltabilir.",,,✓,, -V6,Kimlik Doğrulama,V6.7,Kriptografik Kimlik Doğrulama Mekanizması,V6.7.1,"Kriptografik kimlik doğrulama beyanlarını doğrulamak için kullanılan sertifikaların, değiştirilmeye karşı korumalı şekilde saklandığı doğrulanmalıdır.",,,✓,, -V6,Kimlik Doğrulama,V6.7,Kriptografik Kimlik Doğrulama Mekanizması,V6.7.2,Challenge nonce değerinin en az 64 bit uzunluğunda olduğu ve istatistiksel olarak benzersiz ya da cihazın ömrü boyunca benzersiz olduğu doğrulanmalıdır.,,,✓,, -V6,Kimlik Doğrulama,V6.8,Kimlik Sağlayıcısı ile Kimlik Doğrulama,V6.8.1,"Uygulama birden fazla kimlik sağlayıcıyı (IdP) destekliyorsa, başka bir desteklenen kimlik sağlayıcı aracılığıyla (örneğin aynı kullanıcı tanımlayıcısını kullanarak) kullanıcının kimliğinin taklit edilemediği doğrulanmalıdır. Standart önlem, uygulamanın kullanıcıyı IdP kimliği (bir ad alanı işlevi görür) ve IdP içindeki kullanıcı kimliğinin birleşimiyle kaydetmesi ve tanımlamasıdır.",,✓,✓,, -V6,Kimlik Doğrulama,V6.8,Kimlik Sağlayıcısı ile Kimlik Doğrulama,V6.8.2,Kimlik doğrulama beyanları üzerindeki dijital imzaların (örneğin JWT veya SAML beyanları) varlığı ve bütünlüğünün her zaman doğrulandığı ve imzasız veya geçersiz imzalı beyanların reddedildiği doğrulanmalıdır.,,✓,✓,, -V6,Kimlik Doğrulama,V6.8,Kimlik Sağlayıcısı ile Kimlik Doğrulama,V6.8.3,"SAML beyanlarının benzersiz biçimde işlendiği ve yalnızca geçerlilik süresi içinde bir kez kullanıldığı, tekrar oynatma (replay) saldırılarını önlemek amacıyla doğrulanmalıdır.",,✓,✓,, -V6,Kimlik Doğrulama,V6.8,Kimlik Sağlayıcısı ile Kimlik Doğrulama,V6.8.4,"Uygulama ayrı bir Kimlik Sağlayıcı (IdP) kullanıyorsa ve belirli işlemler için belirli kimlik doğrulama gücü, yöntemleri veya zaman bilgisi bekliyorsa, uygulamanın bu bilgileri IdP tarafından döndürülen veriler üzerinden doğruladığı teyit edilmelidir. Örneğin OIDC kullanılıyorsa, bu durum ID Token üzerindeki 'acr', 'amr' ve 'auth_time' gibi claim’lerin (varsa) doğrulanması ile sağlanabilir. Eğer IdP bu bilgileri sağlamıyorsa, uygulamanın asgari kimlik doğrulama gücünün kullanıldığını varsayan (örneğin yalnızca kullanıcı adı ve parola ile tek faktörlü doğrulama) belgelenmiş bir yedek yaklaşımı olmalıdır.",,✓,✓,, -V7,Oturum Yönetimi,V7.1,Oturum Yönetim Dokümantasyonu,V7.1.1,"Kullanıcının oturum inaktivite zaman aşımı süresi ve mutlak maksimum oturum süresinin belgelendiği, diğer kontrollerle birlikte uygun olduğu ve NIST SP 800-63B yeniden kimlik doğrulama gereksinimlerinden herhangi bir sapma varsa gerekçesinin belgede yer aldığı doğrulanmalıdır.",,✓,✓,, -V7,Oturum Yönetimi,V7.1,Oturum Yönetim Dokümantasyonu,V7.1.2,"Belgede bir hesap için kaç adet eşzamanlı (paralel) oturuma izin verildiği ile birlikte, maksimum aktif oturum sayısına ulaşıldığında uygulanacak davranış ve işlemlerin tanımlandığı doğrulanmalıdır.",,✓,✓,, -V7,Oturum Yönetimi,V7.1,Oturum Yönetim Dokümantasyonu,V7.1.3,"Birleşik kimlik yönetim ekosisteminin bir parçası olarak kullanıcı oturumu oluşturan ve yöneten tüm sistemlerin, oturum ömrü, sonlandırma ve yeniden kimlik doğrulama gerektiren diğer koşulların nasıl koordine edildiğini açıklayan kontrollerle birlikte belgede yer aldığı doğrulanmalıdır.",,✓,✓,, -V7,Oturum Yönetimi,V7.2,Temel Oturum Yönetimi Güvenliği,V7.2.1,Uygulamanın tüm oturum token'ı doğrulama işlemlerini güvenilir bir backend servisi aracılığıyla gerçekleştirdiği doğrulanmalıdır.,✓,✓,✓,, -V7,Oturum Yönetimi,V7.2,Temel Oturum Yönetimi Güvenliği,V7.2.2,"Uygulamanın, statik API gizli anahtarları veya sabit değerler yerine, oturum yönetimi için dinamik olarak oluşturulan kendi kendine yeterli veya referans token'ları kullandığı doğrulanmalıdır.",✓,✓,✓,, -V7,Oturum Yönetimi,V7.2,Temel Oturum Yönetimi Güvenliği,V7.2.3,"Uygulama kullanıcı oturumlarını temsil etmek için referans token'ları kullanıyorsa, bu token'ların benzersiz olduğu, kriptografik olarak güvenli bir sözde rastgele sayı üreteci (CSPRNG) kullanılarak üretildiği ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır.",✓,✓,✓,, -V7,Oturum Yönetimi,V7.2,Temel Oturum Yönetimi Güvenliği,V7.2.4,"Uygulamanın, kullanıcı kimlik doğrulaması (yeniden kimlik doğrulama dahil) sırasında yeni bir oturum token'ı oluşturduğu ve mevcut oturum token'ını sonlandırdığı doğrulanmalıdır.",✓,✓,✓,, -V7,Oturum Yönetimi,V7.3,Oturum Zaman Aşımı,V7.3.1,Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde bir hareketsizlik zaman aşımı bulunduğu doğrulanmalıdır.,,✓,✓,, -V7,Oturum Yönetimi,V7.3,Oturum Zaman Aşımı,V7.3.2,Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde mutlak bir maksimum oturum süresi bulunduğu doğrulanmalıdır.,,✓,✓,, -V7,Oturum Yönetimi,V7.4,Oturum Sonlandırma,V7.4.1,"Oturum sonlandırma tetiklendiğinde (örneğin, çıkış yapıldığında veya süre dolduğunda), uygulamanın oturumun daha fazla kullanılmasına izin vermediği doğrulanmalıdır. Referans token'lar veya durum bilgili oturumlar için bu, oturum verilerinin uygulama arka ucunda geçersiz kılınması anlamına gelir. Kapsamlı token kullanan uygulamaların; sonlandırılmış token listesi tutmak, kullanıcıya özel tarih ve saatten önce oluşturulan token'ları reddetmek veya kullanıcıya özel imzalama anahtarını yenilemek gibi bir çözüm uygulaması gerekir.",✓,✓,✓,, -V7,Oturum Yönetimi,V7.4,Oturum Sonlandırma,V7.4.2,"Bir kullanıcı hesabı devre dışı bırakıldığında veya silindiğinde (örneğin bir çalışanın şirketten ayrılması), uygulamanın tüm aktif oturumları sonlandırdığı doğrulanmalıdır.",✓,✓,✓,, -V7,Oturum Yönetimi,V7.4,Oturum Sonlandırma,V7.4.3,"Herhangi bir kimlik doğrulama faktörünün başarılı bir şekilde değiştirilmesi veya kaldırılmasından (şifre sıfırlama veya kurtarma yoluyla yapılan değişiklikler dahil ve varsa MFA ayarları güncellemeleri dahil) sonra, uygulamanın diğer tüm aktif oturumları sonlandırma seçeneği sunduğu doğrulanmalıdır.",,✓,✓,, -V7,Oturum Yönetimi,V7.4,Oturum Sonlandırma,V7.4.4,Kimlik doğrulama gerektiren tüm sayfalarda kolay erişilebilir ve görünür bir çıkış yap (logout) işlevi bulunduğu doğrulanmalıdır.,,✓,✓,, -V7,Oturum Yönetimi,V7.4,Oturum Sonlandırma,V7.4.5,"Uygulama yöneticilerinin, bireysel bir kullanıcının veya tüm kullanıcıların aktif oturumlarını sonlandırabilme yetkisine sahip olduğu doğrulanmalıdır.",,✓,✓,, -V7,Oturum Yönetimi,V7.5,Oturum Kötüye Kullanımına Karşı Savunmalar,V7.5.1,"E-posta adresi, telefon numarası, MFA yapılandırması veya hesap kurtarmada kullanılan diğer bilgiler gibi kimlik doğrulamayı etkileyebilecek hassas hesap özniteliklerinde değişiklik yapılmadan önce uygulamanın tam yeniden kimlik doğrulama gerektirdiği doğrulanmalıdır.",,✓,✓,, -V7,Oturum Yönetimi,V7.5,Oturum Kötüye Kullanımına Karşı Savunmalar,V7.5.2,"Kullanıcıların, (en az bir faktörle yeniden kimlik doğrulama yaptıktan sonra) mevcut tüm aktif oturumları görüntüleyebilmesi ve sonlandırabilmesinin mümkün olduğu doğrulanmalıdır.",,✓,✓,, -V7,Oturum Yönetimi,V7.5,Oturum Kötüye Kullanımına Karşı Savunmalar,V7.5.3,"Uygulamanın, son derece hassas işlemler veya operasyonlar gerçekleştirilmeden önce en az bir faktörle ek kimlik doğrulaması veya ikincil bir doğrulama gerektirdiği doğrulanmalıdır.",,,✓,, -V7,Oturum Yönetimi,V7.6,Birleşik Yeniden Kimlik Doğrulama,V7.6.1,"Güvenen Taraf (RP) ile Kimlik Sağlayıcı (IdP) arasındaki oturum süresi ve oturum sonlandırma davranışlarının belgelenmiş olduğu ve, örneğin IdP kimlik doğrulama olayları arasında maksimum süreye ulaşıldığında yeniden kimlik doğrulamanın gerekli kılındığı doğrulanmalıdır.",,✓,✓,, -V7,Oturum Yönetimi,V7.6,Birleşik Yeniden Kimlik Doğrulama,V7.6.2,"Yeni bir oturum oluşturulmasının, kullanıcı onayı veya açık bir eylem gerektirdiği; kullanıcı etkileşimi olmaksızın yeni uygulama oturumlarının oluşturulmasının önlendiği doğrulanmalıdır.",,✓,✓,, -V8,Yetkilendirme,V8.1,Yetkilendirme Dokümantasyonu,V8.1.1,"Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak işlev düzeyinde ve veriye özel erişim kısıtlamaları için kuralları tanımladığı doğrulanmalıdır.",✓,✓,✓,, -V8,Yetkilendirme,V8.1,Yetkilendirme Dokümantasyonu,V8.1.2,"Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak alan (field) düzeyinde erişim kısıtlamaları (hem okuma hem yazma) için kuralları tanımladığı doğrulanmalıdır. Bu kuralların, ilgili veri nesnesinin durum veya statü gibi diğer özniteliklerine bağlı olabileceği unutulmamalıdır.",,✓,✓,, -V8,Yetkilendirme,V8.1,Yetkilendirme Dokümantasyonu,V8.1.3,"Uygulamanın dokümantasyonunun, kimlik doğrulama ve yetkilendirme ile ilgili güvenlik kararlarının alınmasında kullanılan çevresel ve bağlamsal öznitelikleri (günün saati, kullanıcı konumu, IP adresi veya cihaz gibi) tanımladığı doğrulanmalıdır.",,,✓,, -V8,Yetkilendirme,V8.1,Yetkilendirme Dokümantasyonu,V8.1.4,"Kimlik doğrulama ve yetkilendirme dokümantasyonunun; işlev düzeyinde, veriye özel ve alan düzeyinde yetkilendirmenin yanı sıra çevresel ve bağlamsal faktörlerin karar almada nasıl kullanıldığını tanımladığı doğrulanmalıdır. Bu, değerlendirilen öznitelikleri, risk eşiklerini ve alınan aksiyonları (ör. izin ver, doğrulama iste, reddet, step-up kimlik doğrulama) içermelidir.",,,✓,, -V8,Yetkilendirme,V8.2,Genel Yetkilendirme Tasarımı,V8.2.1,"Uygulamanın, işlev düzeyindeki erişimin yalnızca açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır.",✓,✓,✓,, -V8,Yetkilendirme,V8.2,Genel Yetkilendirme Tasarımı,V8.2.2,"Uygulamanın, veriye özel erişimin yalnızca belirli veri öğelerine açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, doğrudan nesne referansı güvenlik açıkları (IDOR) ve bozuk nesne düzeyinde yetkilendirme (BOLA) risklerini azaltır.",✓,✓,✓,, -V8,Yetkilendirme,V8.2,Genel Yetkilendirme Tasarımı,V8.2.3,"Uygulamanın, alan (field) düzeyindeki erişimin yalnızca belirli alanlara açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, bozuk nesne özelliği düzeyinde yetkilendirme (BOPLA) risklerini azaltır.",,✓,✓,, -V8,Yetkilendirme,V8.2,Genel Yetkilendirme Tasarımı,V8.2.4,"Tüketicinin çevresel ve bağlamsal özniteliklerine (ör. günün saati, konum, IP adresi veya cihaz) dayalı uyarlanabilir güvenlik kontrollerinin, uygulama dokümantasyonunda tanımlandığı şekilde, kimlik doğrulama ve yetkilendirme kararları için uygulandığı doğrulanmalıdır. Bu kontroller, tüketici yeni bir oturum başlatmaya çalışırken ve mevcut bir oturum sırasında uygulanmalıdır.",,,✓,, -V8,Yetkilendirme,V8.3,İşlem Düzeyinde Yetkilendirme,V8.3.1,Uygulamanın yetkilendirme kurallarını güvenilir bir servis katmanında uyguladığı ve istemci taraflı JavaScript gibi güvenilmeyen tüketiciler tarafından değiştirilebilecek kontrollerle yetinmediği doğrulanmalıdır.,✓,✓,✓,, -V8,Yetkilendirme,V8.3,İşlem Düzeyinde Yetkilendirme,V8.3.2,"Yetkilendirme kararlarının temelini oluşturan değerlerdeki değişikliklerin hemen uygulandığı doğrulanmalıdır. Değişikliklerin anında uygulanamadığı durumlarda (örneğin self-contained token içindeki verilere güveniliyorsa), tüketici artık yetkili olmadığı hâlde bir işlem gerçekleştirdiğinde uyarı verecek ve değişikliği geri alacak önlemler uygulanmalıdır. Bu alternatifin bilgi sızıntısını önlemeyeceği unutulmamalıdır.",,,✓,, -V8,Yetkilendirme,V8.3,İşlem Düzeyinde Yetkilendirme,V8.3.3,"Bir nesneye erişimin, herhangi bir aracı veya onun adına hareket eden bir servis yerine yalnızca erişimi başlatan öznenin (ör. tüketici) izinlerine dayandığı doğrulanmalıdır. Örneğin, bir tüketici kimlik doğrulama için bir self-contained token kullanarak bir web servis çağırırsa ve bu servis başka bir servisten veri talep ederse, ikinci servis izin kararlarını verirken birinci servisin makine-makine token'ı yerine tüketicinin token'ını kullanmalıdır.",,,✓,, -V8,Yetkilendirme,V8.4,Diğer Yetkilendirme Hususları,V8.4.1,"Multi-tenant uygulamaların, tüketici işlemlerinin izinli olmadıkları tenant'lar üzerinde asla etkili olmamasını sağlamak için tenant'lar arası kontroller kullandığı doğrulanmalıdır.",,✓,✓,, -V8,Yetkilendirme,V8.4,Diğer Yetkilendirme Hususları,V8.4.2,"Yönetici arayüzlerine erişimin, sürekli tüketici kimlik doğrulaması, cihaz güvenlik durumu değerlendirmesi ve bağlamsal risk analizi dahil olmak üzere çok katmanlı güvenlik içerdiği doğrulanmalıdır. Yetkilendirme için yalnızca ağ konumu veya güvenilir uç noktalar yeterli olmamalıdır; ancak bu tür faktörler yetkisiz erişim olasılığını azaltabilir.",,,✓,, -V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.1,Token Kaynağı ve Bütünlüğü,V9.1.1,"Self-contained token'ların içerikleri kabul edilmeden önce, oynama (tampering) saldırılarına karşı dijital imza veya MAC ile doğrulama yapıldığı doğrulanmalıdır.",✓,✓,✓,, -V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.1,Token Kaynağı ve Bütünlüğü,V9.1.2,"Belirli bir bağlam için yalnızca bir allowlist üzerinde bulunan algoritmaların self-contained token oluşturmak ve doğrulamak için kullanılabildiği doğrulanmalıdır. Bu allowlist, yalnızca simetrik ya da yalnızca asimetrik algoritmaları içermeli ve kesinlikle 'None' algoritmasını içermemelidir. Hem simetrik hem de asimetrik algoritmalar desteklenmek zorundaysa, anahtar karışıklığını (key confusion) önlemek için ek kontroller uygulanmalıdır.",✓,✓,✓,, -V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.1,Token Kaynağı ve Bütünlüğü,V9.1.3,"Self-contained token'ları doğrulamak için kullanılan anahtar malzemesinin, token issuer için önceden yapılandırılmış güvenilir kaynaklardan alındığı doğrulanmalıdır. Bu, saldırganların güvenilmeyen kaynak ve anahtarları belirtmesini engeller. JWT ve diğer JWS yapılarında 'jku', 'x5u' ve 'jwk' gibi header'lar güvenilir kaynaklardan oluşan bir allowlist'e göre doğrulanmalıdır.",✓,✓,✓,, -V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.2,Token İçeriği,V9.2.1,"Token verisinde bir geçerlilik zaman aralığı (validity time span) varsa, yalnızca doğrulama zamanı bu zaman aralığı içerisindeyse token ve içeriği kabul edilmelidir. Örneğin, JWT'ler için 'nbf' ve 'exp' claim'leri doğrulanmalıdır.",✓,✓,✓,, -V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.2,Token İçeriği,V9.2.2,"Token'ı alan hizmetin, token içeriğini kabul etmeden önce bu token'ın doğru türde olduğunu ve sunulma amacına uygun olduğunu doğruladığı teyit edilmelidir. Örneğin, yalnızca erişim token'ları yetkilendirme kararları için, yalnızca ID Token'lar kullanıcı kimlik doğrulamasını kanıtlamak için kullanılabilir.",,✓,✓,, -V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.2,Token İçeriği,V9.2.3,"Hizmetin yalnızca kendisiyle kullanılması amaçlanan (audience) token'ları kabul ettiği doğrulanmalıdır. JWT'lerde bu, 'aud' claim'inin hizmet içinde tanımlı bir allowlist ile doğrulanması yoluyla sağlanabilir.",,✓,✓,, -V9,Kendi İçinde Taşıyıcı Token (Self-contained Token),V9.2,Token İçeriği,V9.2.4,"Eğer bir token issuer, farklı audience'lara token oluşturmak için aynı private key'i kullanıyorsa, oluşturulan token'ların hedef audience'ları benzersiz şekilde tanımlayan bir audience kısıtlaması içerdiği doğrulanmalıdır. Bu, bir token'ın farklı bir audience ile yeniden kullanılmasını önler. Audience tanımlayıcısı dinamik olarak sağlanıyorsa, token issuer bu audience'ları doğrulamalı ve audience taklitlerinin (impersonation) önüne geçmelidir.",,✓,✓,, -V10,OAuth ve OIDC,V10.1,Genel OAuth ve OIDC Güvenliği,V10.1.1,"Token'ların yalnızca kesinlikle ihtiyaç duyan bileşenlere gönderildiği doğrulanmalıdır. Örneğin, tarayıcı tabanlı JavaScript uygulamaları için bir backend-for-frontend modeli kullanıldığında, access ve refresh token'lara yalnızca backend'in erişebilmesi gerekir.",,✓,✓,, -V10,OAuth ve OIDC,V10.1,Genel OAuth ve OIDC Güvenliği,V10.1.2,"Authorization server'dan gelen değerler (örneğin authorization code veya ID Token gibi) yalnızca aynı user agent oturumu ve işlemi tarafından başlatılmış bir yetkilendirme akışının sonucuysa kabul edildiği doğrulanmalıdır. Bu, client tarafından oluşturulan secret’ların 'proof key for code exchange' (PKCE) ‘code_verifier’, ‘state’ veya OIDC ‘nonce’ gibi tahmin edilemez, işleme özgü ve hem client’a hem de işlem başlatılan user agent oturumuna güvenli bir şekilde bağlı olmasını gerektirir.",,✓,✓,, -V10,OAuth ve OIDC,V10.2,OAuth İstemcisi,V10.2.1,"Code flow kullanılıyorsa, OAuth client’ın token taleplerini tetikleyen CSRF saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Bu genellikle PKCE kullanılarak veya authorization isteğinde gönderilen ‘state’ parametresinin kontrolü ile sağlanır.",,✓,✓,, -V10,OAuth ve OIDC,V10.2,OAuth İstemcisi,V10.2.2,"OAuth istemcisi birden fazla AS ile etkileşime girebiliyorsa, mix-up saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Örneğin, authorization server’ın 'iss' parametresini döndürmesi zorunlu kılınabilir ve bu parametrenin hem authorization yanıtında hem de token yanıtında doğrulanması gerekir.",,✓,✓,, -V10,OAuth ve OIDC,V10.2,OAuth İstemcisi,V10.2.3,OAuth istemcisinin authorization server’a yaptığı taleplerde yalnızca gerekli scope’ları (veya diğer yetkilendirme parametrelerini) talep ettiği doğrulanmalıdır.,,,✓,, -V10,OAuth ve OIDC,V10.3,OAuth Kaynak Sunucusu (RS),V10.3.1,RS'nin yalnızca bu servisle kullanılmak üzere tasarlanmış access token’ları kabul ettiği doğrulanmalıdır (audience kontrolü). Audience bilgisi yapılandırılmış token’larda (örneğin JWT içindeki ‘aud’ claim’i) yer alabilir veya token introspection endpoint aracılığıyla kontrol edilebilir.,,✓,✓,, -V10,OAuth ve OIDC,V10.3,OAuth Kaynak Sunucusu (RS),V10.3.2,"RS'nin, access token’dan gelen claim’lere dayanarak yetki devri tanımına uygun şekilde yetkilendirme kararları uyguladığı doğrulanmalıdır. ‘sub’, ‘scope’ ve ‘authorization_details’ gibi claim’ler varsa, bu kararın parçası olmalıdır.",,✓,✓,, -V10,OAuth ve OIDC,V10.3,OAuth Kaynak Sunucusu (RS),V10.3.3,"Erişim kontrolü kararında, access token’dan (JWT veya ilgili token introspection yanıtı) benzersiz bir kullanıcının tanımlanması gerekiyorsa, RS'nin başka kullanıcılara devredilemeyecek claim’ler ile kullanıcıyı tanımladığı doğrulanmalıdır. Genellikle bu, ‘iss’ ve ‘sub’ claim’lerinin birlikte kullanılması anlamına gelir.",,✓,✓,, -V10,OAuth ve OIDC,V10.3,OAuth Kaynak Sunucusu (RS),V10.3.4,"RS'nin belirli bir kimlik doğrulama gücü, yöntemi veya güncelliği (recentness) gerektirmesi durumunda, sunulan access token’ın bu kısıtlamaları karşıladığını doğruladığı, örneğin, OIDC ‘acr’, ‘amr’ ve ‘auth_time’ claim’leri kullanılarak doğrulanmalıdır. ",,✓,✓,, -V10,OAuth ve OIDC,V10.3,OAuth Kaynak Sunucusu (RS),V10.3.5,"RS'nin, (yetkisiz taraflarca) çalınmış veya tekrar edilen access token’ların kullanımını önlemek için sender-constrained access token’lar kullandığı doğrulanmalıdır. Bu, OAuth 2 için Mutual TLS veya OAuth 2 Demonstration of Proof of Possession (DPoP) ile sağlanabilir.",,,✓,, -V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.1,"AS'nin, istemciye özel önceden kaydedilmiş URI’lerden oluşan bir allowlist kullanarak redirect URI’leri tam dize karşılaştırması ile doğruladığı doğrulanmalıdır.",✓,✓,✓,, -V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.2,"AS'nin, ""authorization response"" içinde ""authorization code"" döndürdüğü durumlarda, bu kodun yalnızca bir kez kullanılabildiği doğrulanmalıdır. Daha önce access token vermek için kullanılmış bir authorization code ile yapılan ikinci geçerli token isteği reddedilmeli ve ilgili tüm token’lar iptal edilmelidir.",✓,✓,✓,, -V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.3,"Authorization code’un kısa ömürlü olduğu doğrulanmalıdır. L1 ve L2 uygulamalar için maksimum yaşam süresi 10 dakika, L3 uygulamalar için 1 dakikadır.",✓,✓,✓,, -V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.4,"Belirli bir istemci için AS'nin yalnızca o istemcinin ihtiyaç duyduğu grant türlerine izin verdiği doğrulanmalıdır. ""Token"" (Implicit flow) ve ""password"" (Resource Owner Password Credentials flow) grant türlerinin artık kullanılmaması gerekir.",✓,✓,✓,, -V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.5,"AS'nin, açık istemciler için refresh token replay saldırılarını azalttığı doğrulanmalıdır. Tercihen sender-constrained refresh token’lar (DPoP veya mutual TLS ile certificate-bound access token’lar) kullanılmalıdır. L1 ve L2 uygulamalar için refresh token rotation kullanılabilir. Rotation kullanılıyorsa, AS refresh token’ı kullanım sonrası geçersiz kılmalı ve geçersiz bir refresh token sunulması durumunda o yetkilendirme ile ilişkili tüm refresh token’ları iptal etmelidir.",✓,✓,✓,, -V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.6,"Code grant kullanılıyorsa, AS'nin authorization code interception saldırılarına karşı koruma sağladığı doğrulanmalıdır. Yetkilendirme isteğinde geçerli bir ""code_challenge"" değeri zorunlu olmalı ve ""code_challenge_method"" olarak ""plain"" kabul edilmemelidir. Token isteğinde ise ""code_verifier"" parametresi doğrulanmalıdır.",,✓,✓,, -V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.7,"AS'nin, kimlik doğrulaması yapılmamış dinamik istemci kaydını desteklemesi durumunda, kötü niyetli istemci uygulamalarına karşı riskleri azalttığı doğrulanmalıdır. Kayıtlı URI’ler gibi client metadata’sı doğrulanmalı, kullanıcı onayı alınmalı ve güvenilmeyen bir client uygulamasıyla yapılan yetkilendirme isteği işlenmeden önce kullanıcı uyarılmalıdır.",,✓,✓,, -V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.8,"Refresh token’ların, sliding expiration kullanılsa bile mutlak bir sona erme süresine sahip olduğu doğrulanmalıdır.",,✓,✓,, -V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.9,Yetkili bir kullanıcı tarafından AS kullanıcı arayüzü üzerinden refresh token’ların ve reference access token’ların iptal edilebildiği doğrulanmalıdır.,,✓,✓,, -V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.10,"Gizli istemcilerin token istekleri, pushed authorization request (PAR) ve token iptal istekleri gibi server’a yapılan backchannel isteklerinde kimliğinin kontrol edildiği doğrulanmalıdır.",,✓,✓,, -V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.11,"AS yapılandırmasının, OAuth istemcisine yalnızca gerekli scope’ları atadığı doğrulanmalıdır.",,✓,✓,, -V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.12,"Belirli bir client için, authorization server’ın yalnızca client’ın ihtiyaç duyduğu 'response_mode' değerine izin verdiği doğrulanmalıdır. Örneğin, bu değer ya beklenenlerle karşılaştırılarak doğrulanmalı ya da PAR veya JAR kullanılmalıdır.",,,✓,, -V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.13,"""Code"" grant türünün daima pushed authorization request (PAR) ile birlikte kullanıldığı doğrulanmalıdır.",,,✓,, -V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.14,"AS'nin yalnızca sender-constrained (Proof-of-Possession) access token’lar ürettiği doğrulanmalıdır. Bu, mutual TLS ile certificate-bound access token ya da DPoP ile DPoP-bound access token olabilir.",,,✓,, -V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.15,"Sunucu taraflı istemciler için (kullanıcı cihazında çalışmayan), AS'nin ""authorization_details"" parametresinin istemci backend'i tarafından sağlandığını ve kullanıcı tarafından değiştirilmediğini doğruladığı, örneğin pushed authorization request (PAR) or JWT-secured Authorization Request (JAR) zorunlu kılınarak doğrulanmalıdır.",,,✓,, -V10,OAuth ve OIDC,V10.4,OAuth Yetkilendirme Sunucusu (AS),V10.4.16,"Bir istemci gizli ise, AS'nin güçlü istemci kimlik doğrulama yöntemlerini zorunlu kıldığı doğrulanmalıdır. Bu yöntemler, public-key cryptography’ye dayalı ve replay saldırılarına karşı dayanıklı olmalı, örneğin mutual TLS (""tls_client_auth"", ""self_signed_tls_client_auth"") veya private key JWT (""private_key_jwt"") gibi.",,,✓,, -V10,OAuth ve OIDC,V10.5,OIDC İstemcisi,V10.5.1,"İstemcinin (relying party olarak) ID Token replay saldırılarını azalttığı doğrulanmalıdır. Örneğin, ID Token’daki 'nonce' claim’inin, OpenID Provider’a gönderilen kimlik doğrulama isteğindeki 'nonce' değeriyle eşleştiği doğrulanmalıdır.",,✓,✓,, -V10,OAuth ve OIDC,V10.5,OIDC İstemcisi,V10.5.2,"İstemcinin kullanıcıyı ID Token claim’lerinden (genellikle, başka kullanıcılarla yeniden atanamayan 'sub' claim’i) benzersiz şekilde tanımladığı doğrulanmalıdır.",,✓,✓,, -V10,OAuth ve OIDC,V10.5,OIDC İstemcisi,V10.5.3,"İstemcinin, kötü niyetli bir AS'nin başka bir AS'yi taklit etmesini AS metadata’sı üzerinden reddettiği doğrulanmalıdır. AS metadata’sındaki issuer URL’si, istemci tarafından beklenen önceden yapılandırılmış issuer URL’siyle tam olarak eşleşmiyorsa, metadata reddedilmelidir.",,✓,✓,, -V10,OAuth ve OIDC,V10.5,OIDC İstemcisi,V10.5.4,"İstemcinin, ID Token’ın kendisi için (audience) kullanılması amaçlandığını doğruladığı doğrulanmalıdır. Bu, token’daki 'aud' claim’inin istemcinin 'client_id' değeriyle eşit olup olmadığının kontrol edilmesiyle yapılır.",,✓,✓,, -V10,OAuth ve OIDC,V10.5,OIDC İstemcisi,V10.5.5,"OIDC back-channel logout kullanıldığında, relying party’nin ""forced logout"" ve ""logout"" akışında ""cross-JWT confusion"" gibi saldırılara karşı koruma sağladığı doğrulanmalıdır. Client, logout token’ın 'logout+jwt' türünde olduğunu, 'event' claim’inin doğru üyeye sahip olduğunu ve 'nonce' claim’i içermediğini doğrulamalıdır. Ayrıca token için kısa bir sona erme süresi (örneğin 2 dakika) önerilir.",,✓,✓,, -V10,OAuth ve OIDC,V10.6,OpenID Provider,V10.6.1,"OpenID Provider’ın yalnızca 'code', 'ciba', 'id_token' veya 'id_token code' response mode değerlerine izin verdiği doğrulanmalıdır. 'code' değeri, 'id_token code' (OIDC Hybrid flow) yerine tercih edilmelidir. 'token' (Implicit flow) kullanılmamalıdır.",,✓,✓,, -V10,OAuth ve OIDC,V10.6,OpenID Provider,V10.6.2,"OpenID Provider’ın forced logout yoluyla yapılan hizmet reddi saldırılarını önlediği doğrulanmalıdır. Bu, son kullanıcıdan açık onay alınarak veya varsa logout isteğinde (relying party tarafından başlatılan) bulunan parametrelerin, örneğin 'id_token_hint', doğrulanmasıyla yapılabilir.",,✓,✓,, -V10,OAuth ve OIDC,V10.7,Onay (Consent) Yönetimi,V10.7.1,"AS'nin her yetkilendirme isteği için kullanıcının onayını aldığı doğrulanmalıdır. İstemcinin kimliği garanti altına alınamıyorsa, AS daima kullanıcıdan açıkça onay istemelidir.",,✓,✓,, -V10,OAuth ve OIDC,V10.7,Onay (Consent) Yönetimi,V10.7.2,"AS'nin kullanıcıdan onay istediğinde, neye onay verildiğini açık ve yeterli şekilde gösterdiği doğrulanmalıdır. Uygun olduğunda bu bilgiler, istenen yetkilendirmelerin doğasını (genellikle scope, resource server, RAR gibi detaylara dayalı), yetkilendirilmiş uygulamanın kimliğini ve bu yetkilendirmelerin süresini içermelidir.",,✓,✓,, -V10,OAuth ve OIDC,V10.7,Onay (Consent) Yönetimi,V10.7.3,"Kullanıcının, AS üzerinden verdiği onayları görüntüleyebildiği, değiştirebildiği ve iptal edebildiği doğrulanmalıdır.",,✓,✓,, -V11,Kriptografi,V11.1,Kriptografik Envanter ve Dokümantasyon,V11.1.1,"Kriptografik anahtarların yönetimi için belgelenmiş bir politika ve NIST SP 800-57 gibi bir anahtar yönetim standardını izleyen bir kriptografik anahtar yaşam döngüsü tanımlandığı doğrulanmalıdır. Bu, anahtarların aşırı miktarda paylaşılmadığını (örneğin, paylaşılan sırlar için ikiden fazla tarafla veya özel anahtarlar için birden fazla tarafla) garanti altına almalıdır.",,✓,✓,, -V11,Kriptografi,V11.1,Kriptografik Envanter ve Dokümantasyon,V11.1.2,"Tüm kriptografik anahtarlar, algoritmalar ve uygulama tarafından kullanılan sertifikaları içeren bir kriptografik envanterin oluşturulduğu, sürdürüldüğü ve düzenli olarak güncellendiği doğrulanmalıdır. Bu envanter ayrıca, sistemde anahtarların nerede kullanılabileceğini ve kullanılamayacağını, ve hangi veri türlerinin bu anahtarlarla korunup korunamayacağını da belgelemelidir.",,✓,✓,, -V11,Kriptografi,V11.1,Kriptografik Envanter ve Dokümantasyon,V11.1.3,"Sistem içerisinde şifreleme, özetleme ve imzalama işlemleri dahil olmak üzere kriptografi kullanımının tüm örneklerini tespit etmek için kriptografik keşif mekanizmalarının kullanıldığı doğrulanmalıdır.",,,✓,, -V11,Kriptografi,V11.1,Kriptografik Envanter ve Dokümantasyon,V11.1.4,"Kriptografik bir envanterin sürdürüldüğü doğrulanmalıdır. Bu envanter, gelecekteki tehditlere karşı tepki verebilmek amacıyla post-kuantum kriptografiye geçiş yolunu belirten belgelenmiş bir plan içermelidir.",,,✓,, -V11,Kriptografi,V11.2,Güvenli Kriptografi Uygulaması,V11.2.1,Kriptografik işlemler için sektör tarafından doğrulanmış uygulamaların (kütüphaneler ve donanım hızlandırmalı uygulamalar dahil) kullanıldığı doğrulanmalıdır.,,✓,✓,, -V11,Kriptografi,V11.2,Güvenli Kriptografi Uygulaması,V11.2.2,"Uygulamanın, rastgele sayı üreticileri, kimliği doğrulanmış şifreleme, MAC veya özetleme algoritmaları, anahtar uzunlukları, turlar, şifreler ve modların herhangi bir zamanda yeniden yapılandırılabilir, yükseltilebilir veya değiştirilebilir olacağı şekilde kripto çevikliği (crypto agility) ile tasarlandığı doğrulanmalıdır. Aynı şekilde, anahtarların ve parolaların değiştirilebilmesi ve verilerin yeniden şifrelenebilmesi mümkün olmalıdır. Bu, onaylanmış PQC şemalarının yüksek güvenlikli uygulamaları yaygın olarak kullanılabilir hale geldiğinde sorunsuz geçişe olanak tanır.",,✓,✓,, -V11,Kriptografi,V11.2,Güvenli Kriptografi Uygulaması,V11.2.3,"Tüm kriptografik ilkeliklerin, algoritma, anahtar boyutu ve yapılandırmaya göre minimum 128 bit güvenlik sağladığı doğrulanmalıdır. Örneğin, 256-bit ECC anahtarı yaklaşık 128 bit güvenlik sağlarken, RSA için aynı güvenliği elde etmek 3072-bit anahtar gerektirir.",,✓,✓,, -V11,Kriptografi,V11.2,Güvenli Kriptografi Uygulaması,V11.2.4,"Tüm kriptografik işlemlerin sabit süreli (constant-time) olduğu, karşılaştırmalarda, hesaplamalarda veya geri dönüşlerde kısa devre (short-circuit) işlemleri yapılmadığı doğrulanmalıdır; bu, bilgi sızıntısını önlemek için gereklidir.",,,✓,, -V11,Kriptografi,V11.2,Güvenli Kriptografi Uygulaması,V11.2.5,"Tüm kriptografik modüllerin güvenli şekilde hata verdiği ve hataların, padding oracle saldırıları gibi zafiyetleri mümkün kılmayacak şekilde ele alındığı doğrulanmalıdır.",,,✓,, -V11,Kriptografi,V11.3,Şifreleme Algoritmaları,V11.3.1,"Güvensiz blok modlarının (örneğin, ECB) ve zayıf doldurma (padding) şemalarının (örneğin, PKCS#1 v1.5) kullanılmadığı doğrulanmalıdır.",✓,✓,✓,, -V11,Kriptografi,V11.3,Şifreleme Algoritmaları,V11.3.2,Yalnızca AES ile GCM gibi onaylı şifreleme algoritmalarının ve modlarının kullanıldığı doğrulanmalıdır.,✓,✓,✓,, -V11,Kriptografi,V11.3,Şifreleme Algoritmaları,V11.3.3,"Şifrelenmiş verilerin yetkisiz değişikliklere karşı korunduğu doğrulanmalıdır. Tercihen bu koruma, onaylı bir kimliği doğrulanmış şifreleme yöntemi kullanılarak ya da onaylı bir şifreleme yöntemi ile onaylı bir MAC algoritmasının kombinasyonu ile sağlanmalıdır.",,✓,✓,, -V11,Kriptografi,V11.3,Şifreleme Algoritmaları,V11.3.4,"Sayılar, başlatma vektörleri (IV) ve diğer tek kullanımlık değerlerin, aynı şifreleme anahtarı ve veri öğesi çifti için birden fazla kez kullanılmadığı doğrulanmalıdır. Oluşturma yöntemi kullanılan algoritmaya uygun olmalıdır.",,,✓,, -V11,Kriptografi,V11.3,Şifreleme Algoritmaları,V11.3.5,"Şifreleme algoritması ve MAC algoritması kombinasyonlarının ""encrypt-then-MAC"" modunda çalıştığı doğrulanmalıdır.",,,✓,, -V11,Kriptografi,V11.4,Hashing ve Hash Tabanlı Fonksiyonlar,V11.4.1,"Dijital imzalar, HMAC, KDF ve rastgele bit üretimi gibi genel kriptografik kullanım senaryolarında yalnızca onaylı hash fonksiyonlarının kullanıldığı doğrulanmalıdır. MD5 gibi yasaklı hash fonksiyonları hiçbir kriptografik amaçla kullanılmamalıdır.",✓,✓,✓,, -V11,Kriptografi,V11.4,Hashing ve Hash Tabanlı Fonksiyonlar,V11.4.2,"Parolaların, onaylı, hesaplama açısından yoğun ve mevcut rehberliğe göre yapılandırılmış bir anahtar türetme fonksiyonu (diğer adıyla parola hash'leme fonksiyonu) kullanılarak saklandığı doğrulanmalıdır. Ayarlar, güvenlik ve performans dengesini sağlayarak kaba kuvvet saldırılarını zorlaştırmalıdır.",,✓,✓,, -V11,Kriptografi,V11.4,Hashing ve Hash Tabanlı Fonksiyonlar,V11.4.3,"Dijital imzalarda kullanılan hash fonksiyonlarının, veri bütünlüğü ve kimlik doğrulama amacıyla kullanıldığında çakışmaya karşı dayanıklı ve yeterli bit uzunluğuna sahip olduğu doğrulanmalıdır. Çakışma dayanıklılığı gerekiyorsa çıktı uzunluğu en az 256 bit olmalıdır. Sadece ikinci ön-görüntü (2nd pre-iamge) saldırılarına karşı dayanıklılık gerekiyorsa çıktı uzunluğu en az 128 bit olmalıdır.",,✓,✓,, -V11,Kriptografi,V11.4,Hashing ve Hash Tabanlı Fonksiyonlar,V11.4.4,"Parolalardan gizli anahtarlar türetilirken, onaylı anahtar türetme fonksiyonlarının anahtar uzatma (key stretching) parametreleriyle birlikte kullanıldığı doğrulanmalıdır. Bu parametreler, kaba kuvvet saldırılarını önleyecek şekilde güvenlik ve performans dengesine sahip olmalıdır.",,✓,✓,, -V11,Kriptografi,V11.5,Rastgele Değerler,V11.5.1,"Tahmin edilemez olması amaçlanan tüm rastgele sayıların ve dizelerin, CSPRNG ile oluşturulduğu ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. UUID'lerin bu koşulu dikkate almadığını unutmayın.",,✓,✓,, -V11,Kriptografi,V11.5,Rastgele Değerler,V11.5.2,"Kullanılan rastgele sayı üretim mekanizmasının, yoğun talep altında dahi güvenli çalışacak şekilde tasarlandığı doğrulanmalıdır.",,,✓,, -V11,Kriptografi,V11.6,Açık Anahtar (Public Key) Kriptografisi,V11.6.1,"Anahtar üretimi, tohumlama (seeding) ve dijital imza üretimi ve doğrulama için yalnızca onaylı kriptografik algoritmalar ve çalışma modlarının kullanıldığı doğrulanmalıdır. Anahtar üretim algoritmaları, bilinen saldırılara karşı savunmasız anahtarlar üretmemelidir. Örneğin, Fermat çarpanlama yöntemine karşı savunmasız RSA anahtarları oluşturulmamalıdır.",,✓,✓,, -V11,Kriptografi,V11.6,Açık Anahtar (Public Key) Kriptografisi,V11.6.2,"Anahtar değişimi için yalnızca onaylı kriptografik algoritmaların kullanıldığı doğrulanmalıdır (örneğin Diffie-Hellman). Kullanılan parametrelerin güvenli olması gerektiğine dikkat edilmelidir. Bu, anahtar kurulum sürecine yönelik saldırıları önleyecek ve araya girme (adversary-in-the-middle) ya da kriptografik kırılmaları engelleyecektir.",,,✓,, -V11,Kriptografi,V11.7,Kullanım Halindeki Verilerin Kriptografisi,V11.7.1,"Hassas verilerin kullanım sırasında korunmasını sağlamak amacıyla, yetkisiz kullanıcıların veya süreçlerin bu verilere erişmesini engelleyen tam bellek şifrelemesinin kullanıldığı doğrulanmalıdır.",,,✓,, -V11,Kriptografi,V11.7,Kullanım Halindeki Verilerin Kriptografisi,V11.7.2,"Veri asgariyetinin sağlandığı, yani işleme sırasında mümkün olan en az miktarda verinin ortaya çıktığı ve verilerin kullanımdan hemen sonra veya mümkün olan en kısa sürede şifrelendiği doğrulanmalıdır.",,,✓,, -V12,Güvenli İletişim,V12.1,Genel TLS Güvenlik Rehberi,V12.1.1,Yalnızca TLS protokolünün en güncel ve önerilen sürümlerinin (örneğin TLS 1.2 ve TLS 1.3) etkinleştirildiği ve en son sürümün varsayılan olarak tercih edildiği doğrulanmalıdır.,✓,✓,✓,, -V12,Güvenli İletişim,V12.1,Genel TLS Güvenlik Rehberi,V12.1.2,Yalnızca önerilen şifre takımlarının (cipher suite) etkinleştirildiği ve en güçlü şifre takımlarının tercih edildiği doğrulanmalıdır. Seviye 3 (L3) uygulamalar yalnızca ileri gizlilik (forward secrecy) sağlayan şifre takımlarını desteklemelidir.,,✓,✓,, -V12,Güvenli İletişim,V12.1,Genel TLS Güvenlik Rehberi,V12.1.3,"Uygulamanın, mTLS istemci sertifikalarını kimlik doğrulama veya yetkilendirme amacıyla kullanmadan önce bu sertifikaların güvendiği sertifikalar arasında olduğunu doğruladığı kontrol edilmelidir.",,✓,✓,, -V12,Güvenli İletişim,V12.1,Genel TLS Güvenlik Rehberi,V12.1.4,Online Certificate Status Protocol (OCSP) Stapling gibi geçerli bir sertifika iptal kontrolü yönteminin etkinleştirildiği ve yapılandırıldığı doğrulanmalıdır.,,,✓,, -V12,Güvenli İletişim,V12.1,Genel TLS Güvenlik Rehberi,V12.1.5,"TLS el sıkışma (handshake) sürecinde Server Name Indication (SNI) gibi hassas meta verilerin ifşa edilmesini önlemek için, uygulamanın TLS yapılandırmasında Encrypted Client Hello (ECH) özelliğinin etkinleştirildiği doğrulanmalıdır.",,,✓,, -V12,Güvenli İletişim,V12.2,Dışa Açık Hizmetlerle HTTPS İletişimi,V12.2.1,"İstemci ile dışa açık, HTTP tabanlı hizmetler arasındaki tüm bağlantılarda TLS kullanıldığı ve bu bağlantıların güvensiz ya da şifrelenmemiş iletişime geri dönmediği doğrulanmalıdır.",✓,✓,✓,, -V12,Güvenli İletişim,V12.2,Dışa Açık Hizmetlerle HTTPS İletişimi,V12.2.2,Dışa açık hizmetlerin herkese açık olarak güvenilen TLS sertifikaları kullandığı doğrulanmalıdır.,✓,✓,✓,, -V12,Güvenli İletişim,V12.3,Genel Servisler Arası İletişim Güvenliği,V12.3.1,"Uygulamaya gelen ve uygulamadan çıkan tüm bağlantılarda izleme sistemleri, yönetim araçları, uzaktan erişim ve SSH, ara yazılımlar, veritabanları, ana sistemler (mainframe), iş ortağı sistemleri ya da dış API'ler dahil olmak üzere TLS gibi şifreli bir protokolün kullanıldığı ve güvensiz ya da şifrelenmemiş protokollere geri dönülmediği doğrulanmalıdır.",,✓,✓,, -V12,Güvenli İletişim,V12.3,Genel Servisler Arası İletişim Güvenliği,V12.3.2,TLS istemcilerinin bir TLS sunucusu ile iletişime geçmeden önce alınan sertifikaları doğruladığı kontrol edilmelidir.,,✓,✓,, -V12,Güvenli İletişim,V12.3,Genel Servisler Arası İletişim Güvenliği,V12.3.3,Uygulama içindeki HTTP tabanlı iç hizmetler arasında gerçekleşen tüm bağlantılarda TLS ya da uygun başka bir aktarım şifreleme mekanizmasının kullanıldığı ve güvensiz ya da şifrelenmemiş iletişime geri dönülmediği doğrulanmalıdır.,,✓,✓,, -V12,Güvenli İletişim,V12.3,Genel Servisler Arası İletişim Güvenliği,V12.3.4,"İç hizmetler arasındaki TLS bağlantılarında güvenilir sertifikaların kullanıldığı doğrulanmalıdır. İç sistemlerde oluşturulmuş ya da kendinden imzalı (self-signed) sertifikalar kullanılıyorsa, bu sertifikalara güvenen hizmetlerin yalnızca belirli dahili sertifika otoritelerine (CA) ve belirli kendinden imzalı sertifikalara güvenecek şekilde yapılandırıldıkları doğrulanmalıdır.",,✓,✓,, -V12,Güvenli İletişim,V12.3,Genel Servisler Arası İletişim Güvenliği,V12.3.5,"Sistem içindeki hizmetlerin birbiriyle iletişim kurarken her bir uç noktanın kimliğini doğrulamak için güçlü kimlik doğrulama yöntemlerinin kullanıldığı doğrulanmalıdır. Bu yöntemler arasında, açık anahtar altyapısı (public-key infrastructure) kullanan ve tekrar oynatma saldırılarına karşı dayanıklı olan TLS istemci kimlik doğrulaması gibi yöntemler yer almalıdır. Mikroservis mimarilerinde, sertifika yönetimini basitleştirmek ve güvenliği artırmak amacıyla bir servis ağı (service mesh) kullanılması değerlendirilmelidir.",,,✓,, -V13,Konfigürasyon,V13.1,Konfigürasyon Dokümantasyonu,V13.1.1,"Uygulamanın tüm iletişim ihtiyaçlarının dokümante edildiği doğrulanmalıdır. Buna, uygulamanın bağımlı olduğu dış hizmetler ve son kullanıcının uygulamanın bağlantı kurmasını sağlayabileceği dış konumlar da dahil olmalıdır.",,✓,✓,, -V13,Konfigürasyon,V13.1,Konfigürasyon Dokümantasyonu,V13.1.2,"Uygulamanın kullandığı her bir hizmet için, dokümantasyonda eşzamanlı bağlantı sayısı (örn. bağlantı havuzu limitleri) ve bu sınır aşıldığında uygulamanın davranışı, geri dönüş veya kurtarma mekanizmaları da dahil olmak üzere hizmet reddi koşullarını önlemek için tanımlandığı doğrulanmalıdır.",,,✓,, -V13,Konfigürasyon,V13.1,Konfigürasyon Dokümantasyonu,V13.1.3,"Uygulamanın, kullandığı her bir dış sistem veya hizmet (örn. veritabanları, dosya tanıtıcıları, iş parçacıkları, HTTP bağlantıları) için kaynak yönetimi stratejilerini tanımladığı doğrulanmalıdır. Bu stratejiler, kaynak serbest bırakma prosedürlerini, zaman aşımı ayarlarını, hata durumlarını ve tekrar deneme mantığı uygulanmışsa sınırları, gecikmeleri ve geri çekilme (back-off) algoritmalarını içermelidir. Senkron HTTP istek–yanıt işlemleri için kısa zaman aşımı süreleri zorunlu tutulmalı ve tekrar eden denemeler devre dışı bırakılmalı ya da sıkı şekilde sınırlandırılmalıdır.",,,✓,, -V13,Konfigürasyon,V13.1,Konfigürasyon Dokümantasyonu,V13.1.4,"Uygulamanın, güvenlik açısından kritik olan gizli verileri tanımladığı ve kuruluşun tehdit modeli ve iş ihtiyaçlarına göre bu verilerin döndürülme (rotation) zamanlamasının belgelendiği doğrulanmalıdır.",,,✓,, -V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.1,"Uygulamanın, standart kullanıcı oturum mekanizmasını desteklemeyen backend bileşenleri (örneğin API'ler, ara katmanlar, veri katmanları) arasında gerçekleşen iletişimlerin kimlik doğrulamasıyla korunduğu doğrulanmalıdır. Kimlik doğrulama; bireysel hizmet hesapları, kısa ömürlü token'lar ya da sertifika tabanlı kimlik doğrulama ile yapılmalıdır ve parola, API anahtarı ya da ayrıcalıklı erişime sahip paylaşımlı hesaplar gibi sabit kimlik bilgileri kullanılmamalıdır.",,✓,✓,, -V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.2,"Uygulamanın backend bileşenleri arasında (yerel hizmetler, işletim sistemi hizmetleri, API'ler, ara katmanlar ve veri katmanları dahil) gerçekleştirilen iletişimlerin, yalnızca gerekli en az ayrıcalığa sahip hesaplarla yapıldığı doğrulanmalıdır.",,✓,✓,, -V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.3,"Bir hizmet kimlik doğrulaması için bir kimlik bilgisi kullanılması gerekiyorsa, bu kimlik bilgisinin varsayılan bir değer (örneğin root/root veya admin/admin) olmadığının doğrulanması gereklidir.",,✓,✓,, -V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.4,"Uygulamanın iletişim kurmasına izin verilen dış kaynaklar ya da sistemlerin, bir allowlist (izinli liste) ile tanımlandığı doğrulanmalıdır. Bu liste, uygulama katmanında, web sunucusunda, güvenlik duvarında veya farklı katmanların birleşiminde uygulanabilir.",,✓,✓,, -V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.5,"Web veya uygulama sunucusunun, dış sistemlere veri veya dosya gönderimi veya yüklemesi yaparken sadece belirli kaynaklara izin verecek şekilde allowlist ile yapılandırıldığı doğrulanmalıdır.",,✓,✓,, -V13,Konfigürasyon,V13.2,Backend İletişim Konfigürasyonu,V13.2.6,"Uygulamanın farklı hizmetlere bağlantı kurduğu durumlarda, bu bağlantılar için belgelenmiş yapılandırmaları (örn. maksimum eşzamanlı bağlantı, bağlantı limiti aşıldığında davranış, zaman aşımı, tekrar deneme stratejileri) takip ettiğinin doğrulanması gereklidir.",,,✓,, -V13,Konfigürasyon,V13.3,Gizli Bilgi Yönetimi,V13.3.1,"Parolalar, anahtar materyalleri, veritabanı ve üçüncü parti sistemlerle entegrasyon bilgileri, zaman tabanlı token'lar için tohum (seed) bilgileri, dahili gizli veriler ve API anahtarları gibi backend sırlarının güvenli bir şekilde oluşturulması, saklanması, erişim denetiminin sağlanması ve imha edilmesi için bir gizli bilgi yönetim çözümünün (örneğin key vault) kullanıldığı doğrulanmalıdır. Bu gizli bilgiler uygulama kaynak koduna dahil edilmemeli ve yapı çıktılarında yer almamalıdır. Seviye 3 uygulamalar için donanım destekli bir çözüm (örneğin HSM) gereklidir.",,✓,✓,, -V13,Konfigürasyon,V13.3,Gizli Bilgi Yönetimi,V13.3.2,Gizli bilgilere erişimin en az ayrıcalık prensibine uygun şekilde yapılandırıldığı doğrulanmalıdır.,,✓,✓,, -V13,Konfigürasyon,V13.3,Gizli Bilgi Yönetimi,V13.3.3,"Tüm kriptografik işlemlerin, anahtar materyallerinin güvenli bir şekilde yönetilmesi ve dışarıya sızmasının engellenmesi amacıyla, izole edilmiş bir güvenlik modülü (örneğin vault ya da donanım güvenlik modülü) aracılığıyla gerçekleştirildiği doğrulanmalıdır.",,,✓,, -V13,Konfigürasyon,V13.3,Gizli Bilgi Yönetimi,V13.3.4,Uygulamanın belgelerinde belirtildiği şekilde gizli bilgilerin süresinin dolacak şekilde yapılandırıldığı ve düzenli olarak döndürüldüğü doğrulanmalıdır.,,,✓,, -V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.1,Uygulamanın .git veya .svn klasörleri gibi kaynak kontrolüyle ilgili metadata içermeyecek şekilde deploy edildiğini ya da bu klasörlerin hem dış erişime hem de uygulama erişimine kapalı olduğu doğrulanmalıdır.,✓,✓,✓,, -V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.2,Tüm bileşenler için üretim ortamlarında hata ayıklama (debug) modlarının devre dışı bırakıldığı doğrulanmalıdır.,,✓,✓,, -V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.3,"Web sunucularının, açık şekilde istenmediği sürece dizin listelemesi (directory listing) özelliğini istemcilere sunmadığı doğrulanmalıdır.",,✓,✓,, -V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.4,"HTTP TRACE metodunun üretim ortamlarında desteklenmediği, böylece potansiyel bilgi sızıntılarının önlendiği doğrulanmalıdır.",,✓,✓,, -V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.5,Belgeler (örneğin dahili API belgeleri) ve izleme uç noktalarının (monitoring endpoints) yalnızca açıkça belirtildiği durumlarda erişilebilir olduğu doğrulanmalıdır.,,✓,✓,, -V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.6,Uygulamanın arka uç bileşenlerinin ayrıntılı sürüm bilgilerini ifşa etmediği doğrulanmalıdır.,,,✓,, -V13,Konfigürasyon,V13.4,İstenmeyen Bilgi Sızıntısı,V13.4.7,"Web katmanının yalnızca belirli dosya uzantılarına sahip dosyaları sunacak şekilde yapılandırıldığı, bu sayede istem dışı bilgi, yapılandırma ya da kaynak kod sızıntılarının önlendiği doğrulanmalıdır.",,,✓,, -V14,Veri Koruma,V14.1,Veri Koruma Dokümantasyonu,V14.1.1,"Uygulama tarafından oluşturulan ve işlenen tüm hassas verilerin tanımlanıp, koruma seviyelerine göre sınıflandırıldığından emin olun. Bu, yalnızca kodlanmış (örneğin Base64 stringleri ya da JWT içindeki düz metin yükler gibi) ve bu nedenle kolayca çözülebilir verileri de içermelidir. Koruma seviyeleri, uygulamanın uymakla yükümlü olduğu veri koruma ve gizlilik düzenlemeleri ile standartlarını dikkate almalıdır.",,✓,✓,, -V14,Veri Koruma,V14.1,Veri Koruma Dokümantasyonu,V14.1.2,"Tüm hassas veri koruma seviyeleri için belgelenmiş bir koruma gereksinimleri seti tanımlandığından emin olun. Bu gereksinimler genel şifreleme, bütünlük doğrulama, saklama süresi, verinin nasıl günlüğe kaydedileceği, günlüklerdeki hassas verilere erişim kontrolleri, veritabanı düzeyinde şifreleme, gizlilik ve gizliliği artırıcı teknolojiler ile diğer gizlilik gereksinimlerini kapsamalıdır.",,✓,✓,, -V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.1,"Hassas verilerin yalnızca HTTP message body veya header alanlarında sunucuya gönderildiği ve URL ile sorgu parametrelerinin, API anahtarı veya session token’ı gibi hassas bilgiler içermediği doğrulanmalıdır.",✓,✓,✓,, -V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.2,"Hassas verilerin, yük dengeleyiciler ve uygulama önbellekleri gibi sunucu bileşenlerinde önbelleğe alınmasının engellendiği veya kullanım sonrası bu verilerin güvenli biçimde temizlendiği doğrulanmalıdır.",,✓,✓,, -V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.3,"Uygulama kontrolü dışında veri toplanmasını engellemek için, tanımlanmış hassas verilerin, kullanıcı izleyicileri gibi güvensiz taraflara gönderilmediği doğrulanmalıdır.",,✓,✓,, -V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.4,"Hassas verilere yönelik şifreleme, bütünlük doğrulama, veri saklama, loglama yöntemi, loglardaki erişim kontrolleri, gizlilik teknolojileri gibi kontrollerin, söz konusu verinin belgelenmiş koruma seviyesinde tanımlandığı şekilde uygulandığı doğrulanmalıdır.",,✓,✓,, -V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.5,"Önbellekleme mekanizmalarının yalnızca belirli içerik türüne sahip yanıtları önbelleğe alacak şekilde yapılandırıldığı ve hassas, dinamik içeriklerin önbelleğe alınmadığı doğrulanmalıdır. Web sunucusu, mevcut olmayan bir dosya talebinde geçerli ama farklı bir dosya döndürmek yerine 404 veya 302 cevabı vermelidir. Bu, Web Cache Deception saldırılarını önlemeye yardımcı olur.",,,✓,, -V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.6,"Uygulamanın yalnızca işlevsellik için gerekli olan asgari hassas veriyi döndürdüğü doğrulanmalıdır. Örneğin, kredi kartı numarasının yalnızca bazı rakamlarının döndürülmesi; tam numaranın döndürülmesi gerekiyorsa, kullanıcı arayüzünde gizlenmiş (maskelenmiş) şekilde sunulması gerekir, aksi kullanıcı özel olarak görüntülemek istemedikçe gösterilmemelidir.",,,✓,, -V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.7,"Hassas bilgilerin, veri saklama sınıflandırmasına tabi tutulduğu, geçerliliğini yitirmiş veya artık gerekli olmayan verilerin belirlenmiş bir zaman çizelgesiyle ya da gerektiğinde otomatik olarak silindiği doğrulanmalıdır.",,,✓,, -V14,Veri Koruma,V14.2,Genel Veri Koruması,V14.2.8,Kullanıcı tarafından yüklenen dosyaların meta verilerinden hassas bilgilerin çıkarıldığı veya bu bilgilerin yalnızca kullanıcıdan açık onay alındığında saklandığı doğrulanmalıdır.,,,✓,, -V14,Veri Koruma,V14.3,İstemci Tarafı Veri Koruması,V14.3.1,"Kimliği doğrulanmış verilerin, istemci veya oturum sonlandığında istemci depolamasından (örneğin tarayıcı DOM’undan) temizlendiği doğrulanmalıdır. 'Clear-Site-Data' HTTP response header bu konuda yardımcı olabilir ancak istemci tarafı, sunucu bağlantısı mevcut olmadığında da temizlik işlemini yapabiliyor olmalıdır.",✓,✓,✓,, -V14,Veri Koruma,V14.3,İstemci Tarafı Veri Koruması,V14.3.2,"Uygulamanın, tarayıcılarda hassas verilerin önbelleğe alınmasını önlemek amacıyla yeterli anti-önbellekleme HTTP response header (örneğin Cache-Control: no-store) ayarladığı doğrulanmalıdır.",,✓,✓,, -V14,Veri Koruma,V14.3,İstemci Tarafı Veri Koruması,V14.3.3,"Tarayıcıda depolanan verilerin (örneğin localStorage, sessionStorage, IndexedDB veya çerezler) hassas veri içermediği, yalnızca session token’larının istisna olarak kabul edildiği doğrulanmalıdır.",,✓,✓,, -V15,Güvenli Kodlama ve Mimari,V15.1,Güvenli Kodlama ve Mimari Dokümantasyonu,V15.1.1,"Güvenlik açığı içeren üçüncü taraf bileşen sürümleri ve genel olarak kütüphane güncellemeleri için, uygulama dokümantasyonunda risk bazlı düzeltme zamanlarının tanımlandığı doğrulanmalıdır.",✓,✓,✓,, -V15,Güvenli Kodlama ve Mimari,V15.1,Güvenli Kodlama ve Mimari Dokümantasyonu,V15.1.2,"Yazılım bileşen listesi (Software Bill of Materials - SBOM) gibi bir envanterin tutulduğu, kullanılan tüm üçüncü taraf kütüphanelerin önceden tanımlanmış, güvenilir ve düzenli olarak güncellenen depolardan alındığı doğrulanmalıdır.",,✓,✓,, -V15,Güvenli Kodlama ve Mimari,V15.1,Güvenli Kodlama ve Mimari Dokümantasyonu,V15.1.3,"Uygulama dokümantasyonunda zaman veya kaynak açısından yoğun işlevlerin tanımlandığı, bu işlevlerin aşırı kullanımı durumunda kullanılabilirlik kaybının nasıl önleneceği ve yanıt oluşturma süresinin istemci zaman aşımını aşmaması için hangi önlemlerin alındığı belirtilmelidir. Örnek savunmalar kuyruklama, eşzamansız işleme, kullanıcı başına ve uygulama genelinde paralel işlem sınırlarını içerebilir.",,✓,✓,, -V15,Güvenli Kodlama ve Mimari,V15.1,Güvenli Kodlama ve Mimari Dokümantasyonu,V15.1.4,"Uygulama dokümantasyonunda ""riskli bileşenler"" olarak değerlendirilen üçüncü taraf kütüphanelerin vurgulandığı doğrulanmalıdır.",,,✓,, -V15,Güvenli Kodlama ve Mimari,V15.1,Güvenli Kodlama ve Mimari Dokümantasyonu,V15.1.5,"Uygulama dokümantasyonunda ""tehlikeli işlevsellik"" içeren uygulama bölümlerinin açıkça belirtildiği doğrulanmalıdır.",,,✓,, -V15,Güvenli Kodlama ve Mimari,V15.2,Güvenlik Mimarisi ve Bağımlılıklar,V15.2.1,"Uygulamanın yalnızca, belgelenmiş güncelleme ve düzeltme sürelerini aşmamış bileşenleri içerdiği doğrulanmalıdır.",✓,✓,✓,, -V15,Güvenli Kodlama ve Mimari,V15.2,Güvenlik Mimarisi ve Bağımlılıklar,V15.2.2,"Uygulamanın, belgelenmiş güvenlik kararları ve stratejilere dayanarak, zaman veya kaynak açısından yoğun işlevlerin neden olabileceği kullanılabilirlik kaybına karşı savunmalar uyguladığı doğrulanmalıdır.",,✓,✓,, -V15,Güvenli Kodlama ve Mimari,V15.2,Güvenlik Mimarisi ve Bağımlılıklar,V15.2.3,"Üretim ortamının yalnızca uygulamanın çalışması için gerekli işlevleri içerdiği ve test kodları, örnek kod parçaları veya geliştirme işlevleri gibi gereksiz işlevsellikleri açığa çıkarmadığı doğrulanmalıdır.",,✓,✓,, -V15,Güvenli Kodlama ve Mimari,V15.2,Güvenlik Mimarisi ve Bağımlılıklar,V15.2.4,Üçüncü taraf bileşenlerin ve bunların tüm transitif bağımlılıklarının beklenen depolardan (iç kaynaklı ya da harici) alındığı ve bağımlılık karışıklığı (dependency confusion) saldırılarına açık olmadığı doğrulanmalıdır.,,,✓,, -V15,Güvenli Kodlama ve Mimari,V15.2,Güvenlik Mimarisi ve Bağımlılıklar,V15.2.5,"Uygulamanın, “tehlikeli işlevsellik” içeren veya “riskli bileşenler” kullanan bölümlerine ek korumalar uyguladığı doğrulanmalıdır. Bu korumalar sandbox, kapsülleme, konteynerleştirme veya ağ düzeyinde izolasyon gibi teknikler aracılığıyla, bir uygulama bölümünün ele geçirilmesi durumunda saldırganın diğer bölümlere sıçramasını geciktirmeyi veya engellemeyi amaçlamalıdır.",,,✓,, -V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.1,"Uygulamanın yalnızca gerekli alanların bir alt kümesini veri nesnesinden döndürdüğü doğrulanmalıdır. Örneğin, bazı alanlara kullanıcıların erişmemesi gerektiğinden tüm veri nesnesi döndürülmemelidir.",✓,✓,✓,, -V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.2,"Uygulama backend'i harici URL’lere çağrı yaptığında, yalnızca amaçlanan işlevsellik söz konusuysa yönlendirmeleri takip edecek şekilde yapılandırıldığının doğrulanması gerekir.",,✓,✓,, -V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.3,"Uygulamanın, kitlesel atama saldırılarına karşı, her bir controller ve eylem için izin verilen alanları sınırlandırarak savunmalar sağladığı doğrulanmalıdır. Örneğin, bir alan değeri, bu işlemde değiştirilmesi amaçlanmadıysa eklenememeli veya güncellenememelidir.",,✓,✓,, -V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.4,"Tüm proxy ve ara katman bileşenlerinin kullanıcının orijinal IP adresini, uç kullanıcı tarafından değiştirilemeyecek güvenilir veri alanları kullanarak doğru şekilde ilettiği ve uygulamanın ve web sunucusunun bu doğru değeri, loglama ve hız sınırlama gibi güvenlik kararları için kullandığı doğrulanmalıdır. Ayrıca, orijinal IP adresinin bile dinamik IP'ler, VPN'ler veya kurumsal güvenlik duvarları nedeniyle güvenilir olmayabileceği dikkate alınmalıdır.",,✓,✓,, -V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.5,"Uygulamanın değişkenlerin doğru türde olduğunu açıkça doğruladığı ve sıkı eşitlik ve karşılaştırma işlemleri kullandığı doğrulanmalıdır. Bu, değişken türüyle ilgili varsayımlardan kaynaklanan tür oynama (type juggling) veya tür karışıklığı (type confusion) güvenlik açıklarını önlemek içindir.",,✓,✓,, -V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.6,"JavaScript kodunun prototip zehirleme (prototype pollution) saldırılarını önleyecek şekilde yazıldığı, örneğin, nesne literal’leri yerine Set() veya Map() gibi yapılar kullanıldığı doğrulanmalıdır.",,✓,✓,, -V15,Güvenli Kodlama ve Mimari,V15.3,Savunmacı Kodlama,V15.3.7,"Uygulamanın, özellikle framework'ün istek parametrelerinin kaynağı (sorgu dizgisi, gövde parametreleri, çerezler veya başlık alanları) arasında ayrım yapmadığı durumlarda, HTTP parametre kirliliği (HTTP parameter pollution) saldırılarına karşı savunmalar uyguladığı doğrulanmalıdır.",,✓,✓,, -V15,Güvenli Kodlama ve Mimari,V15.4,Güvenli Eş Zamanlılık (Concurrency),V15.4.1,"Çok iş parçacıklı kodda (örneğin cache'ler, dosyalar veya birden fazla iş parçacığı tarafından erişilen bellek içi nesneler gibi) paylaşılan nesnelere yalnızca thread-safe (iş parçacığı güvenli) türler ve kilitleme (lock) veya semaphore gibi senkronizasyon mekanizmaları kullanılarak erişildiği doğrulanmalıdır. Bu, yarış durumlarını ve veri bozulmasını önlemeye yöneliktir.",,,✓,, -V15,Güvenli Kodlama ve Mimari,V15.4,Güvenli Eş Zamanlılık (Concurrency),V15.4.2,"Bir kaynağın durumu üzerindeki kontroller (örneğin varlığı ya da izinleri gibi) ile bu kontrole bağlı eylemlerin tek bir atomik işlem olarak gerçekleştirildiği doğrulanmalıdır. Bu, TOCTOU (time-of-check to time-of-use) yarış durumlarını önlemeye yöneliktir. Bir dosyanın varlığının kontrol edilip ardından açılması veya bir kullanıcının erişiminin doğrulanıp ardından yetki verilmesi gibi işlemler buna örnektir.",,,✓,, -V15,Güvenli Kodlama ve Mimari,V15.4,Güvenli Eş Zamanlılık (Concurrency),V15.4.3,"Kilitlerin (locks) tutarlı biçimde kullanıldığı, iş parçacıklarının birbirini beklemesi ya da sonsuz döngüye girmesi (deadlock veya livelock) gibi durumların önlendiği doğrulanmalıdır. Ayrıca, kilitleme mantığı, kaynağı yöneten kod içinde kalmalı ve dış sınıflar veya dış kodlar tarafından istemeden veya kötü niyetli şekilde değiştirilememelidir.",,,✓,, -V15,Güvenli Kodlama ve Mimari,V15.4,Güvenli Eş Zamanlılık (Concurrency),V15.4.4,"Kaynak tahsis politikalarının, iş parçacığı açlığını önleyecek şekilde, kaynaklara adil erişimi sağladığı doğrulanmalıdır. Örneğin, thread pool (iş parçacığı havuzu) kullanımı, düşük öncelikli iş parçacıklarının da makul sürelerde çalışabilmesi için uygulanmalıdır.",,,✓,, -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.1,Güvenlik Loglaması Dokümantasyonu,V16.1.1,"Uygulamanın teknoloji yığını boyunca her katmanda hangi olayların loglandığını, log formatlarını, logların nereye yazıldığını, nasıl kullanıldığını, erişimin nasıl kontrol edildiğini ve logların ne kadar süre saklandığını belgeleyen bir envanterin mevcut olduğu doğrulanmalıdır.",,✓,✓,, -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.2,Genel Loglama,V16.2.1,"Her bir log girdisinin, olayın ne zaman, nerede, kim tarafından ve ne olduğuna dair detaylı bir zaman çizelgesi oluşturulmasına olanak tanıyacak gerekli meta verileri içerdiği doğrulanmalıdır.",,✓,✓,, -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.2,Genel Loglama,V16.2.2,"Tüm loglama bileşenlerinin zaman kaynaklarının senkronize olduğu ve güvenlik olayı meta verisindeki zaman damgalarının UTC kullanarak ya da açık zaman dilimi ofsetiyle belirtildiği doğrulanmalıdır. UTC kullanımı, özellikle yaz saati uygulamaları nedeniyle oluşabilecek karışıklıkları önlemek için tavsiye edilir.",,✓,✓,, -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.2,Genel Loglama,V16.2.3,Uygulamanın yalnızca log envanterinde belgelenmiş dosya ve hizmetlere log yazdığı ya da ilettiği doğrulanmalıdır.,,✓,✓,, -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.2,Genel Loglama,V16.2.4,Logların kullanılan log işleyici (log processor) tarafından okunabildiği ve ilişkilendirilebildiği doğrulanmalıdır. Tercihen yaygın bir log formatı kullanılmalıdır.,,✓,✓,, -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.2,Genel Loglama,V16.2.5,"Hassas veriler loglanırken, uygulamanın veri koruma seviyesine uygun olarak loglama yaptığı doğrulanmalıdır. Örneğin kimlik bilgileri veya ödeme detayları gibi bazı verilerin loglanmasına izin verilmemelidir. Session token’ları gibi veriler ise yalnızca tamamen ya da kısmen maskelenmiş ya da hash’lenmiş olarak loglanmalıdır.",,✓,✓,, -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.3,Güvenlik Olayları,V16.3.1,Tüm kimlik doğrulama işlemlerinin (başarılı ve başarısız girişimler dahil) loglandığı doğrulanmalıdır. Kullanılan kimlik doğrulama türü veya faktörleri gibi ek meta veriler de toplanmalıdır.,,✓,✓,, -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.3,Güvenlik Olayları,V16.3.2,"Başarısız yetkilendirme girişimlerinin loglandığı doğrulanmalıdır. Seviye 3 uygulamalar için, tüm yetkilendirme kararlarının ve hassas verilere erişim olaylarının (verinin kendisi olmadan) loglandığı da doğrulanmalıdır.",,✓,✓,, -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.3,Güvenlik Olayları,V16.3.3,"Uygulamanın, belgelenmiş güvenlik olaylarını ve güvenlik kontrollerini aşma girişimlerini (girdi doğrulama, iş mantığı, otomasyon karşıtı kontroller vb.) logladığı doğrulanmalıdır.",,✓,✓,, -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.3,Güvenlik Olayları,V16.3.4,Beklenmeyen hatalar ve güvenlik kontrolü başarısızlıkları (örneğin backend TLS hataları gibi) loglandığı doğrulanmalıdır.,,✓,✓,, -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.4,Log Koruması,V16.4.1,"Tüm loglama bileşenlerinin, log enjeksiyonunu (log injection) önlemek amacıyla verileri uygun biçimde encode ettiği doğrulanmalıdır.",,✓,✓,, -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.4,Log Koruması,V16.4.2,Logların yetkisiz erişime karşı korunduğu ve değiştirilemez olduğu doğrulanmalıdır.,,✓,✓,, -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.4,Log Koruması,V16.4.3,"Logların analiz, tespit, uyarı ve yükseltme amacıyla mantıksal olarak ayrı bir sisteme güvenli biçimde iletildiği doğrulanmalıdır. Böylece uygulama ihlal edilse bile logların tehlikeye girmesi önlenmiş olur.",,✓,✓,, -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.5,Hata Yönetimi,V16.5.1,"Beklenmedik ya da güvenlikle ilgili bir hata oluştuğunda, tüketiciye genel bir mesaj döndürüldüğü ve yığın izleri (stack trace), sorgular, gizli anahtarlar, token’lar gibi hassas sistem içi verilerin açıklanmadığı doğrulanmalıdır.",,✓,✓,, -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.5,Hata Yönetimi,V16.5.2,"Uygulamanın, dış kaynaklara erişim başarısız olduğunda bile güvenli şekilde çalışmaya devam ettiği doğrulanmalıdır. Örneğin, circuit breaker ya da graceful degradation gibi desenler kullanılmalıdır.",,✓,✓,, -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.5,Hata Yönetimi,V16.5.3,"Uygulamanın hata durumlarında güvenli ve düzenli şekilde başarısız olduğu doğrulanmalıdır. Bu, örneğin doğrulama hatalarına rağmen işlemlerin işlenmesine yol açabilecek fail-open durumlarını önlemelidir.",,✓,✓,, -V16,Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi,V16.5,Hata Yönetimi,V16.5.4,"Ele alınmamış tüm istisnaları yakalayacak şekilde tanımlanmış bir “son çare hata yöneticisi” bulunduğu doğrulanmalıdır. Bu, hem loglara gitmesi gereken hata detaylarının kaybolmaması hem de tüm uygulama sürecinin çökerek hizmet dışı kalmasının önlenmesi açısından önemlidir.",,,✓,, -V17,WebRTC,V17.1,TURN Sunucusu,V17.1.1,"TURN hizmetinin yalnızca özel amaçlar için ayrılmamış IP adreslerine (ör. iç ağlar, yayın adresleri, loopback) erişime izin verdiği doğrulanmalıdır. Bu gereksinim hem IPv4 hem de IPv6 adresleri için geçerlidir.",,✓,✓,, -V17,WebRTC,V17.1,TURN Sunucusu,V17.1.2,"TURN hizmetinin, meşru kullanıcıların sunucuda çok sayıda bağlantı noktası açmaya çalışması durumunda kaynak tüketimi saldırılarına karşı dayanıklı olduğu doğrulanmalıdır.",,,✓,, -V17,WebRTC,V17.2,Medya,V17.2.1,"DTLS sertifikası anahtarının, belgelenmiş kriptografik anahtar yönetim politikasına uygun şekilde yönetildiği ve korunduğu doğrulanmalıdır.",,✓,✓,, -V17,WebRTC,V17.2,Medya,V17.2.2,Medya sunucusunun onaylı DTLS şifre takımlarını (cipher suites) ve Güvenli Gerçek Zamanlı Aktarım Protokolü (Secure Real-time Transport Protocol - SRTP) için anahtarlar oluşturmaya yönelik DTLS Uzantısı için güvenli bir koruma profilini kullanacak ve destekleyecek şekilde yapılandırıldığı (DTLS-SRTP) doğrulanmalıdır.,,✓,✓,, -V17,WebRTC,V17.2,Medya,V17.2.3,Real-time Transport Protocol (RTP) injection saldırılarının bir hizmet reddi durumuna veya medya akışlarına ses veya video medyası eklenmesine yol açmasını önlemek için medya sunucusunda Güvenli SRTP kimlik doğrulamasının kontrol edildiği doğrulanmalıdır.,,✓,✓,, -V17,WebRTC,V17.2,Medya,V17.2.4,Verify that the media server is able to continue processing incoming media traffic when encountering malformed Secure Real-time Transport Protocol (SRTP) packets.,,✓,✓,, -V17,WebRTC,V17.2,Medya,V17.2.5,"Medya sunucusunun, meşru kullanıcılardan gelen SRTP flood'ı sırasında gelen medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.",,,✓,, -V17,WebRTC,V17.2,Medya,V17.2.6,"Medya sunucusunun DTLS içinde yer alan ""ClientHello"" yarış durumu güvenlik açığına karşı savunmasız olmadığı, medya sunucusunun güvenlik açığına sahip olduğunun açıkça bilinip bilinmediği kontrol edilerek veya yarış koşulu testi gerçekleştirilerek doğrulanmalıdır.",,,✓,, -V17,WebRTC,V17.2,Medya,V17.2.7,"Medya sunucusuna bağlı ses veya video kayıt mekanizmalarının, meşru kullanıcı kaynaklı SRTP flood'ı sırasında medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.",,,✓,, -V17,WebRTC,V17.2,Medya,V17.2.8,"DTLS sertifikasının, SDP (Session Description Protocol) fingerprint özelliği ile karşılaştırıldığı ve doğrulama başarısız olursa medya akışının sonlandırıldığı, medya akışının özgünlüğünü sağlamak için doğrulanmalıdır.",,,✓,, -V17,WebRTC,V17.3,Sinyalizasyon,V17.3.1,"Sinyalizasyon sunucusunun, flood saldırısı altında bile meşru sinyalizasyon mesajlarını işlemeye devam edebildiği doğrulanmalıdır. Bu, sinyalizasyon düzeyinde oran sınırlaması uygulanarak sağlanmalıdır.",,✓,✓,, -V17,WebRTC,V17.3,Sinyalizasyon,V17.3.2,"Sinyalizasyon sunucusunun, hizmet reddine yol açabilecek şekilde yapılandırılmış bozuk sinyalizasyon mesajlarıyla karşılaştığında bile meşru mesajları işlemeye devam edebildiği doğrulanmalıdır. Bu, girdi doğrulaması, integer overflow ve buffer overflow'a karşı savunma ve sağlam hata işleme teknikleri ile sağlanmalıdır.",,✓,✓,, - diff --git a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.json b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.json deleted file mode 100644 index 52c7591547..0000000000 --- a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.json +++ /dev/null @@ -1,7183 +0,0 @@ -{ - "Name": "Application Security Verification Standard Project", - "ShortName": "ASVS", - "Version": "", - "Description": "The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.", - "Requirements": [ - { - "Shortcode": "V1", - "Ordinal": 1, - "ShortName": "Encoding", - "Name": "Kodlama (Encoding) ve Temizleme", - "Items": [ - { - "Shortcode": "V1.1", - "Ordinal": 1, - "Name": "Kodlama ve Temizleme Mimarisi", - "Items": [ - { - "Shortcode": "V1.1.1", - "Ordinal": 1, - "Description": "Girdinin yalnızca bir kez kanonik forma (canonical form) çözümlendiği veya kaçış işlemlerinin kaldırıldığı, bu işlemin yalnızca verinin bu biçimde beklenmesi durumunda yapıldığı ve bu işlemin girdi doğrulama veya temizleme işlemlerinden sonra değil, önce gerçekleştiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.1.2", - "Ordinal": 2, - "Description": "Uygulamanın, çıktıyı kullanılması gereken yorumlayıcıya verilmeden hemen önce veya yorumlayıcının kendisi tarafından çıktı kodlaması ya da kaçış işlemi yaptığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V1.2", - "Ordinal": 2, - "Name": "Enjeksiyon Önleme", - "Items": [ - { - "Shortcode": "V1.2.1", - "Ordinal": 1, - "Description": "HTTP yanıtı, HTML veya XML belgesi için yapılan çıktı kodlamasının; HTML elemanları, HTML öznitelikleri, HTML yorumları, CSS ya da HTTP başlık alanları gibi bağlamlara uygun olduğu doğrulanmalıdır. Böylece mesaj veya belge yapısının bozulması önlenir.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.2.2", - "Ordinal": 2, - "Description": "Dinamik olarak URL oluşturulurken, güvenilmeyen verinin bağlamına göre (örneğin, sorgu veya yol parametreleri için URL kodlaması ya da base64url kodlaması) kodlandığı doğrulanmalıdır. Yalnızca güvenli URL protokollerine izin verilmelidir (örneğin, javascript: veya data: yasaklanmalıdır).", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.2.3", - "Ordinal": 3, - "Description": "JavaScript içeriği (JSON dahil) dinamik olarak oluşturulurken çıktı kodlama/kaçış kullanıldığı doğrulanmalıdır. Böylece mesaj veya belge yapısı değiştirilmemiş olur (JavaScript ve JSON enjeksiyonlarının önüne geçilir).", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.2.4", - "Ordinal": 4, - "Description": "Veri sorguları veya veritabanı sorguları (SQL, HQL, NoSQL, Cypher vb.) için parametreli sorgular, ORM’ler, entity framework’ler kullanıldığı ya da SQL enjeksiyonu ve diğer veritabanı enjeksiyon saldırılarına karşı koruma sağlandığı doğrulanmalıdır. Bu durum, saklı yordam (stored procedure) yazarken de geçerlidir.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.2.5", - "Ordinal": 5, - "Description": "Uygulamanın işletim sistemi komut enjeksiyonlarına karşı korunduğu ve işletim sistemi çağrılarında parametreli OS sorguları veya bağlama özgü komut satırı çıktı kodlamasının kullanıldığı doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.2.6", - "Ordinal": 6, - "Description": "Uygulamanın LDAP enjeksiyon zafiyetlerine karşı korunduğu ya da LDAP enjeksiyonlarını önlemek için özel güvenlik kontrollerinin uygulandığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.2.7", - "Ordinal": 7, - "Description": "XPath enjeksiyon saldırılarına karşı, sorgu parametrelemesi veya önceden derlenmiş sorgular kullanılarak koruma sağlandığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.2.8", - "Ordinal": 8, - "Description": "LaTeX işlemcilerinin güvenli şekilde yapılandırıldığı (örneğin, --shell-escape bayrağının kullanılmadığı) ve yalnızca izin verilen komutlardan oluşan bir listeyle çalıştırıldığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.2.9", - "Ordinal": 9, - "Description": "Düzenli ifadelerde (regex) özel karakterlerin (genellikle ters eğik çizgi \\ ile) kaçırılarak meta karakter olarak yorumlanmalarının önlendiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.2.10", - "Ordinal": 10, - "Description": "Uygulamanın CSV ve formül enjeksiyonlarına karşı korunduğu doğrulanmalıdır. Uygulama, CSV içeriği dışa aktarırken RFC 4180 Bölüm 2.6 ve 2.7'de tanımlanan kaçış kurallarına uymalıdır. Ayrıca, CSV veya diğer tablo formatlarına (XLS, XLSX, ODF gibi) aktarım yapılırken, alanın ilk karakteri olarak çıkan özel karakterler ('=', '+', '-', '@', '\\t' (sekme), '\\0' (null karakter)) tek tırnak (') ile kaçırılmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V1.3", - "Ordinal": 3, - "Name": "Temizleme (Sanitization)", - "Items": [ - { - "Shortcode": "V1.3.1", - "Ordinal": 1, - "Description": "WYSIWYG editörlerinden veya benzer kaynaklardan gelen tüm güvenilmeyen HTML girdilerinin, bilinen ve güvenli bir HTML temizleme kütüphanesi ya da çerçeve özelliği ile temizlendiği doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.2", - "Ordinal": 2, - "Description": "Uygulamanın eval() veya Spring Expression Language (SpEL) gibi dinamik kod çalıştırma özelliklerini kullanmaktan kaçındığı doğrulanmalıdır. Alternatif yoksa, kullanıcı girdisi çalıştırılmadan önce mutlaka temizlenmelidir.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.3", - "Ordinal": 3, - "Description": "Potansiyel olarak tehlikeli bir bağlamda kullanılacak verilerin, bu bağlama uygun karakterlere izin vermek ve çok uzun girdileri kısaltmak gibi güvenlik önlemleriyle önceden temizlendiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.4", - "Ordinal": 4, - "Description": "Kullanıcı tarafından sağlanan SVG içeriğinin, yalnızca güvenli etiket ve özellikler (örneğin grafik çizme ile ilgili) içerdiğinden emin olmak için onaylandığı veya temizlendiği doğrulanmalıdır (ör. script veya foreignObject içermemelidir).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.5", - "Ordinal": 5, - "Description": "Markdown, CSS, XSL stil sayfaları, BBCode veya benzeri ifade şablon dillerinde kullanıcı girdisinin temizlendiği veya bu tür özelliklerin devre dışı bırakıldığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.6", - "Ordinal": 6, - "Description": "Uygulamanın, güvenilmeyen verileri başka servislere iletmeden önce izinli protokol, alan adı, yol ve port listelerine göre doğruladığı ve tehlikeli karakterleri temizlediği doğrulanarak SSRF (Sunucu Taraflı İstek Sahteciliği) saldırılarına karşı korunduğu doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.7", - "Ordinal": 7, - "Description": "Uygulamanın şablon enjeksiyon saldırılarına karşı, güvenilmeyen girdilere dayalı şablon oluşturmayı engellediği; eğer bu kaçınılmazsa, bu girdilerin mutlaka temizlendiği veya sıkı şekilde onaylandığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.8", - "Ordinal": 8, - "Description": "JNDI sorgularında kullanılmadan önce güvenilmeyen girdilerin temizlendiği ve JNDI'nin enjeksiyonlara karşı güvenli şekilde yapılandırıldığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.9", - "Ordinal": 9, - "Description": "Memcache’e gönderilmeden önce içeriğin temizlenerek enjeksiyon saldırılarına karşı korunduğu doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.10", - "Ordinal": 10, - "Description": "Format dizgilerinin (format strings) beklenmeyen veya zararlı şekilde çözümlenmesini önlemek için işlenmeden önce temizlendiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.11", - "Ordinal": 11, - "Description": "SMTP veya IMAP enjeksiyonlarını önlemek için, kullanıcı girdisinin posta sistemlerine iletilmeden önce temizlendiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.3.12", - "Ordinal": 12, - "Description": "Regex girdilerinin üstel geri izlemeye (exponential backtracking) neden olan öğeler içermediği ve güvenilmeyen girdilerin ReDoS (Regex Denial of Service) gibi saldırılara karşı temizlendiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V1.4", - "Ordinal": 4, - "Name": "Bellek, Dizgi ve Yönetilmeyen Kod", - "Items": [ - { - "Shortcode": "V1.4.1", - "Ordinal": 1, - "Description": "Yığın, arabellek (buffer) veya yığın belleği taşmalarını önlemek ya da tespit etmek amacıyla, bellek güvenli dizgi işlemlerinin, daha güvenli bellek kopyalama ve işaretçi aritmetiğinin kullanıldığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.4.2", - "Ordinal": 2, - "Description": "Tamsayı taşmalarını önlemek için işaret (sign), aralık (range) ve giriş doğrulama tekniklerinin kullanıldığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.4.3", - "Ordinal": 3, - "Description": "Dinamik olarak ayrılan belleğin ve kaynakların serbest bırakıldığı ve boşaltılan belleklere ait referansların veya işaretçilerin kaldırıldığı veya null yapıldığı doğrulanmalıdır (dangling pointer ve use-after-free zafiyetlerine karşı).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V1.5", - "Ordinal": 5, - "Name": "Güvenli Ters Serileştirme (Safe Deserialization)", - "Items": [ - { - "Shortcode": "V1.5.1", - "Ordinal": 1, - "Description": "XML ayrıştırıcılarının (parser) kısıtlayıcı şekilde yapılandırıldığı ve dış varlık çözümleme (external entity resolution) gibi güvensiz özelliklerin XXE (XML eXternal Entity) saldırılarına karşı devre dışı bırakıldığı doğrulanmalıdır .", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.5.2", - "Ordinal": 2, - "Description": "Güvenilmeyen verilerin ters serileştirilmesinde, nesne türleri için izinli liste kullanımı veya istemci tanımlı nesne türlerinin kısıtlanması gibi güvenli giriş işleme önlemlerinin uygulandığı doğrulanmalıdır. Güvensiz olarak tanımlanmış ters serileştirme mekanizmaları, güvenilmeyen girdilerle kullanılmamalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V1.5.3", - "Ordinal": 3, - "Description": "Aynı veri türü için uygulamada kullanılan farklı parser'ların (ör. JSON, XML, URL parser'ları), veriyi tutarlı şekilde ayrıştırdığı ve aynı karakter kodlamasını kullandığı doğrulanmalıdır. Böylece JSON birlikte çalışabilirlik açıkları, URI veya dosya ayrıştırma farkları gibi sorunlar nedeniyle RFI veya SSRF saldırılarının istismar edilmesi önlenir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V2", - "Ordinal": 2, - "ShortName": "Validation", - "Name": "Doğrulama ve İş Mantığı", - "Items": [ - { - "Shortcode": "V2.1", - "Ordinal": 1, - "Name": "Doğrulama ve İş Mantığı Dokümantasyonu", - "Items": [ - { - "Shortcode": "V2.1.1", - "Ordinal": 1, - "Description": "Uygulama dokümantasyonunda, veri öğelerinin beklenen yapıya göre nasıl doğrulanacağına ilişkin giriş doğrulama kurallarının tanımlandığı doğrulanmalıdır. Bu; kredi kartı numaraları, e-posta adresleri, telefon numaraları gibi yaygın veri biçimleri olabileceği gibi iç sistemlere özel biçimler de olabilir.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V2.1.2", - "Ordinal": 2, - "Description": "Uygulama dokümantasyonunda, birleştirilmiş veri öğelerinin mantıksal ve bağlamsal tutarlılığının nasıl doğrulanacağı tanımlanmalıdır (örneğin, mahalle ve posta kodunun eşleşip eşleşmediğinin kontrolü).", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V2.1.3", - "Ordinal": 3, - "Description": "Hem kullanıcı bazında hem de uygulama genelinde geçerli olacak şekilde, iş mantığı sınırları ve doğrulama beklentilerinin belgelendiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V2.2", - "Ordinal": 2, - "Name": "Girdi Doğrulama", - "Items": [ - { - "Shortcode": "V2.2.1", - "Ordinal": 1, - "Description": "Girdilerin, işlevsel ya da iş gereksinimlerine uygunluğunun doğrulandığı teyit edilmelidir. Bu işlem; izinli değerler, desenler ve aralıklar listesine karşı pozitif doğrulama ile ya da girdinin beklenen yapıya ve mantıksal sınırlara uygunluğunun önceden tanımlanmış kurallara göre karşılaştırılması ile yapılmalıdır. Seviye 1 için bu, güvenlik veya iş kararlarında kullanılan girdilere odaklanabilir. Seviye 2 ve üstü için tüm girdilere uygulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V2.2.2", - "Ordinal": 2, - "Description": "Uygulamanın, güvenilir bir servis katmanında girdi doğrulama zorunluluğu uygulayacak şekilde tasarlandığı doğrulanmalıdır. İstemci tarafında gerçekleştirilen doğrulama, kullanılabilirliği artırabilir ve teşvik edilmelidir. Ancak bu doğrulama,güvenlik kontrolü olarak kabul edilmemelidir.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V2.2.3", - "Ordinal": 3, - "Description": "Uygulamanın, ilişkili veri öğelerinin önceden tanımlanmış kurallara göre makul olup olmadığını kontrol ettiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V2.3", - "Ordinal": 3, - "Name": "İş Mantığı Güvenliği", - "Items": [ - { - "Shortcode": "V2.3.1", - "Ordinal": 1, - "Description": "Uygulamanın, aynı kullanıcı için iş mantığı akışlarını yalnızca beklenen adım sırasına göre ve adım atlamadan işlediği doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V2.3.2", - "Ordinal": 2, - "Description": "İş mantığı sınırlarının, uygulama dokümantasyonuna uygun şekilde uygulandığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V2.3.3", - "Ordinal": 3, - "Description": "İş mantığı seviyesinde işlemlerin (transaction) kullanıldığı ve bir iş mantığı işleminin ya bütünüyle başarıyla tamamlandığı ya da önceki geçerli duruma geri döndürüldüğü (rollback) doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V2.3.4", - "Ordinal": 4, - "Description": "İş mantığı düzeyinde kilitleme mekanizmalarının, sınırlı kaynakların (ör. sinema koltukları, teslimat zamanları) uygulamanın mantığı manipüle edilerek çift rezervasyona neden olmamasını sağladığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V2.3.5", - "Ordinal": 5, - "Description": "Yüksek değerli iş mantığı akışlarının, yetkisiz veya kazara gerçekleşebilecek işlemleri önlemek için çoklu kullanıcı onayı gerektirdiği doğrulanmalıdır. Bu işlemler büyük para transferleri, sözleşme onayları, gizli bilgilere erişim veya üretimde güvenlik kurallarının geçersiz kılınmaları gibi durumları içerebilir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V2.4", - "Ordinal": 4, - "Name": "Otomasyon Karşıtı Önlemler", - "Items": [ - { - "Shortcode": "V2.4.1", - "Ordinal": 1, - "Description": "Uygulama işlevlerine yönelik aşırı miktardaki çağrılara karşı; veri sızdırma, anlamsız veri üretme, kota tüketme, hız sınırının aşılması, hizmet reddi (DoS) ya da maliyetli kaynakların aşırı kullanımı gibi risklere karşı otomasyon karşıtı kontrollerin bulunduğu doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V2.4.2", - "Ordinal": 2, - "Description": "İş mantığı akışlarının, aşırı hızlı işlem gönderimlerini önleyecek şekilde gerçekçi insan zamanlaması gerektirdiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V3", - "Ordinal": 3, - "ShortName": "Web", - "Name": "Web Ön Uç (Frontend) Güvenliği", - "Items": [ - { - "Shortcode": "V3.1", - "Ordinal": 1, - "Name": "Web Frontend Güvenlik Dokümantasyonu", - "Items": [ - { - "Shortcode": "V3.1.1", - "Ordinal": 1, - "Description": "Uygulama dokümantasyonunda, uygulamayı kullanan tarayıcıların desteklemesi gereken güvenlik özelliklerinin (ör. HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) ve diğer ilgili HTTP güvenlik mekanizmaları) tanımlandığı doğrulanmalıdır. Ayrıca bu özelliklerin mevcut olmadığı durumlarda uygulamanın nasıl davranması gerektiği (ör. kullanıcıyı uyarmak veya erişimi engellemek) de tanımlanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V3.2", - "Ordinal": 2, - "Name": "İçeriğin Yanlış Yorumlanması", - "Items": [ - { - "Shortcode": "V3.2.1", - "Ordinal": 1, - "Description": "Tarayıcıların HTTP yanıtlarında içerik veya işlevi yanlış bir bağlamda sunmalarını önlemek amacıyla güvenlik kontrollerinin uygulandığı doğrulanmalıdır (ör. API, kullanıcı tarafından yüklenen dosya veya başka bir kaynağın doğrudan çağrılması durumunda). Olası kontroller arasında; yalnızca HTTP istek başlıklarının (ör. Sec-Fetch-\\*) doğru bağlamı gösterdiği durumlarda içeriğin sunulması, Content-Security-Policy başlığında \"sandbox\" yönergesinin kullanılması veya Content-Disposition başlığında \"attachment\" biçiminin kullanılması yer alabilir.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.2.2", - "Ordinal": 2, - "Description": "HTML yerine metin olarak görüntülenmesi amaçlanan içeriğin, HTML veya JavaScript gibi içeriklerin istenmeden çalıştırılmasını önleyecek şekilde \"createTextNode\" veya \"textContent\" gibi güvenli işleme fonksiyonlarıyla işlendiği doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.2.3", - "Ordinal": 3, - "Description": "Uygulamanın istemci tarafı JavaScript kullanırken açık değişken tanımlamaları yaparak, sıkı tür kontrolü uygulayarak, global değişkenleri document nesnesine kaydetmekten kaçınarak ve ad alanı izolasyonu sağlayarak DOM clobbering’den kaçındığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V3.3", - "Ordinal": 3, - "Name": "Çerez Yapılandırması", - "Items": [ - { - "Shortcode": "V3.3.1", - "Ordinal": 1, - "Description": "Çerezlerin 'Secure' niteliğine sahip olduğu ve eğer çerez adı '\\__Host-' ön eki ile başlamıyorsa, '__Secure-' ön ekinin kullanıldığı doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.3.2", - "Ordinal": 2, - "Description": "Kullanıcı arayüzü kandırma saldırılarına ve tarayıcı tabanlı istek sahteciliği saldırılarına (CSRF) karşı koruma sağlamak amacıyla, her çerezin 'SameSite' niteliğinin kullanım amacına uygun şekilde ayarlandığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.3.3", - "Ordinal": 3, - "Description": "Çerez adı, diğer sunucularla paylaşılmak üzere açıkça tasarlanmadığı sürece '__Host-' ön eki ile tanımlanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.3.4", - "Ordinal": 4, - "Description": "Bir çerez değeri istemci tarafı betikleri tarafından erişilememesi gereken bir veri içeriyorsa (ör. oturum token'ı), çerezin 'HttpOnly' niteliğine sahip olduğu ve aynı değerin (ör. oturum token'ı) yalnızca 'Set-Cookie' başlığı ile istemciye iletildiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.3.5", - "Ordinal": 5, - "Description": "Uygulama bir çerez oluştururken, çerez adı ve değerinin toplam uzunluğunun 4096 baytı aşmadığı doğrulanmalıdır. Çok büyük çerezler tarayıcı tarafından saklanmaz ve isteklerle gönderilmez; bu da çereze bağlı çalışan uygulama işlevlerinin bozulmasına yol açabilir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V3.4", - "Ordinal": 4, - "Name": "Tarayıcı Güvenlik Mekanizması Başlıkları (Header)", - "Items": [ - { - "Shortcode": "V3.4.2", - "Ordinal": 2, - "Description": "Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header'ı, uygulama tarafından sabit bir değer olarak tanımlanmalı veya gelen Origin header değeri güvenilir origin’lerden oluşan bir izinli listeye karşı doğrulanmalıdır. ‘Access-Control-Allow-Origin: *’ kullanılması gerekiyorsa, yanıtın hassas bilgi içermediği doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.4.3", - "Ordinal": 3, - "Description": "HTTP yanıtlarında Content-Security-Policy header'ı bulunduğu ve bu header'ın yalnızca güvenilen içeriklerin veya kaynakların yüklenmesini ve çalıştırılmasını sağlayan yönergeler içerdiği doğrulanmalıdır. Minimum olarak \"global policy\", object-src 'none', base-uri 'none' yönergelerini içermeli ve izinli liste, nonce veya hash temelli bir yapı içermelidir. Seviye 3 uygulamalarında her yanıt için nonce veya hash içeren özel bir politika tanımlanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.4.4", - "Ordinal": 4, - "Description": "Tüm HTTP yanıtlarının 'X-Content-Type-Options: nosniff' header'ını içerdiği doğrulanmalıdır. Bu, tarayıcıya içerik türünü tahmin etmeyi bırakmasını ve yanıtın Content-Type header'ında belirtilen MIME türünün, beklenen kaynak türüyle eşleşmesini zorunlu kılar. Ayrıca bu, tarayıcıda CORB (Cross-Origin Read Blocking) özelliğini etkinleştirir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.4.5", - "Ordinal": 5, - "Description": "Uygulamanın, 'Referer' başlığı yoluyla üçüncü taraflara teknik olarak hassas verilerin sızmasını önlemek için bir 'referrer policy' belirlediği doğrulanmalıdır. Bu, Referrer-Policy HTTP header'ıyla veya HTML öğe nitelikleriyle (element attributes) sağlanabilir. Sızabilecek hassas bilgiler, URL’deki yol ve sorgu parametreleri ile sınırlı uygulamalarda hostname bilgisini içerebilir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.4.6", - "Ordinal": 6, - "Description": "Uygulamanın, Content-Security-Policy header'ı altında 'frame-ancestors' yönergesini her HTTP yanıtında tanımladığı ve bu sayede içeriklerin varsayılan olarak başka sayfalara gömülmesini engellediği doğrulanmalıdır. Gerekli durumlarda özel olarak izin verildiğinden emin olunmalıdır. 'X-Frame-Options' header'ı, tarayıcılar tarafından desteklenmesine rağmen, artık güncel değildir ve güvenlik amacıyla kullanılmamalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.4.8", - "Ordinal": 8, - "Description": "Bir belgenin işlenmesini ve sunulmasını başlatan tüm HTTP yanıtlarında (örneğin 'text/html' tipi yanıtlar), 'Cross-Origin-Opener-Policy' header'ı 'same-origin' veya 'same-origin-allow-popups' yönergeleriyle birlikte yer almalıdır. Bu, tabnabbing ve frame counting gibi, pencere nesnelerine paylaşımlı erişimi sömüren saldırılara karşı koruma sağlar.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V3.5", - "Ordinal": 5, - "Name": "Tarayıcı Menşei Ayırımı", - "Items": [ - { - "Shortcode": "V3.5.1", - "Ordinal": 1, - "Description": "Uygulama, hassas işlevselliğe yönelik izinsiz cross-origin istekleri önlemek için CORS preflight mekanizmasına güvenmiyorsa, bu tür isteklerin gerçekten uygulamadan geldiği doğrulanmalıdır. Bu, anti-forgery token kullanımı veya CORS tarafından güvenli kabul edilmeyen özel HTTP header'larının zorunlu kılınmasıyla yapılabilir. Bu, tarayıcı tabanlı istek sahteciliği (CSRF) saldırılarına karşı bir savunmadır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.5.2", - "Ordinal": 2, - "Description": "Uygulama, hassas işlevlerin izinsiz cross-origin çağrılmasını önlemek için CORS preflight mekanizmasına güveniyorsa, bu işlevlerin bir CORS-preflight isteğini tetiklemeden çağrılamadığı doğrulanmalıdır. Bu, 'Origin' ve 'Content-Type' header'larının doğrulanmasını veya CORS-safelisted olmayan bir header'ın ve alanın kullanılmasını gerektirebilir.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.5.4", - "Ordinal": 4, - "Description": "Farklı uygulamaların farklı hostname'lerde barındırıldığı ve böylece Same-Origin Policy tarafından sağlanan kısıtlamalardan (örneğin çerez erişim sınırları, kaynaklar arası etkileşim kontrolleri) faydalanıldığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.5.6", - "Ordinal": 6, - "Description": "Uygulamanın herhangi bir yerinde JSONP işlevselliğinin etkin olmadığı doğrulanmalıdır. Bu, XSSI (Cross-Site Script Inclusion) saldırılarını önlemek içindir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.5.7", - "Ordinal": 7, - "Description": "Yetkilendirme gerektiren verilerin, JavaScript dosyaları gibi betik kaynaklarının yanıtlarında yer almadığı, XSSI saldırılarını önlemek için doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.5.8", - "Ordinal": 8, - "Description": "Kimliği doğrulanmış kaynakların (örneğin görseller, videolar, betikler ve belgeler) yalnızca gerçekten amaçlandığında kullanıcı adına yüklenebildiği veya gömülebildiği doğrulanmalıdır. Bu, isteğin uygun olmayan bir çapraz kaynak çağrısından kaynaklanmadığından emin olmak için Sec-Fetch-* HTTP istek başlığı alanlarının sıkı bir şekilde doğrulanmasıyla veya tarayıcıya döndürülen içeriği engelleme talimatı vermek için kısıtlayıcı bir Cross-Origin-Resource-Policy HTTP yanıt başlığı alanı ayarlayarak gerçekleştirilebilir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V3.6", - "Ordinal": 6, - "Name": "Harici Kaynak Bütünlüğü", - "Items": [ - { - "Shortcode": "V3.6.1", - "Ordinal": 1, - "Description": "JavaScript kütüphaneleri, CSS veya web fontları gibi istemci tarafı varlıkların yalnızca statik ve sürümlü olması, varlığın bütünlüğünü doğrulamak için Subresource Integrity (SRI) kullanılması durumunda harici olarak (örneğin, bir İçerik Dağıtım Ağı üzerinde) barındırıldığı doğrulanmalıdır. Bu mümkün değilse, her bir kaynak için bunu gerekçelendiren belgelenmiş bir güvenlik kararı bulunmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V3.7", - "Ordinal": 7, - "Name": "Diğer Tarayıcı Güvenliği Hususları", - "Items": [ - { - "Shortcode": "V3.7.1", - "Ordinal": 1, - "Description": "Uygulamanın yalnızca hâlâ desteklenen ve güvenli kabul edilen istemci tarafı teknolojileri kullandığı doğrulanmalıdır. Bu gereksinimi karşılamayan teknolojilere örnek olarak NSAPI eklentileri, Flash, Shockwave, ActiveX, Silverlight, NACL veya istemci tarafı Java applet’leri verilebilir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.7.2", - "Ordinal": 2, - "Description": "Uygulamanın, yalnızca hedef adres bir izinli listede yer alıyorsa kullanıcıyı otomatik olarak farklı bir ana makine adına veya uygulamanın kontrolünde olmayan bir etki alanına yönlendirdiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.7.3", - "Ordinal": 3, - "Description": "Uygulamanın, kullanıcı uygulamanın kontrolü dışındaki bir URL’ye yönlendirildiğinde, yönlendirme hakkında bir bildirim gösterdiği ve kullanıcının bu gezintiyi iptal edebilmesi için bir seçenek sunduğu doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.7.4", - "Ordinal": 4, - "Description": "Uygulamanın en üst düzey etki alanının (örneğin, site.tld) HTTP Strict Transport Security (HSTS) için genel preload listesine eklendiği doğrulanmalıdır. Bu, uygulamanın TLS kullanımının ana tarayıcılar tarafından doğrudan tanınmasını ve yalnızca Strict-Transport-Security yanıt header'ına bağlı kalınmamasını sağlar.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V3.7.5", - "Ordinal": 5, - "Description": "Uygulamaya erişen tarayıcının beklenen güvenlik özelliklerini desteklememesi durumunda, uygulamanın dokümantasyona uygun şekilde davrandığı (örneğin kullanıcıyı uyarma veya erişimi engelleme) doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V4", - "Ordinal": 4, - "ShortName": "API", - "Name": "API ve Web Servisi", - "Items": [ - { - "Shortcode": "V4.1", - "Ordinal": 1, - "Name": "Genel Web Servisi Güvenliği", - "Items": [ - { - "Shortcode": "V4.1.1", - "Ordinal": 1, - "Description": "İleti gövdesi içeren her HTTP yanıtında, yanıtın gerçek içeriğiyle eşleşen bir Content-Type header alanı bulunduğu ve güvenli karakter kodlamasını (örneğin, UTF-8, ISO-8859-1) belirtmek üzere charset parametresi içerdiği doğrulanmalıdır. Bu işlem, IANA Medya Türleri'nden \"text/\", \"/+xml\" ve \"/xml\" gibi içerikler için geçerlidir.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.1.2", - "Ordinal": 2, - "Description": "Yalnızca kullanıcı arayüzüne yönelik uç noktaların (manuel olarak web tarayıcısı ile erişilmesi amaçlanan) otomatik olarak HTTP'den HTTPS'e yönlendirme yaptığı ve diğer hizmetlerin veya uç noktaların şeffaf yönlendirme gerçekleştirmediği doğrulanmalıdır. Bu, istemcinin farkında olmadan şifrelenmemiş HTTP istekleri göndermesi ve bu isteklerin otomatik olarak HTTPS'e yönlendirilmesi sonucunda hassas verilerin sızmasının fark edilmemesi riskini önlemek içindir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.1.3", - "Ordinal": 3, - "Description": "Uygulama tarafından kullanılan ve yük dengeleyici, web proxy veya frontend için backend hizmeti gibi bir ara katman tarafından ayarlanan herhangi bir HTTP başlık alanının, son kullanıcı tarafından geçersiz kılınamayacağı doğrulanmalıdır. Örnek başlıklar arasında X-Real-IP, X-Forwarded-* veya X-User-ID yer alabilir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.1.4", - "Ordinal": 4, - "Description": "Uygulama veya API tarafından açıkça desteklenen HTTP yöntemlerinin (preflight istekleri sırasında OPTIONS dahil) dışında hiçbir yöntemin kullanılmadığı ve kullanılmayan yöntemlerin engellendiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.1.5", - "Ordinal": 5, - "Description": "Çok hassas istekler veya birçok sistemden geçen işlemler için, taşıma katmanı güvenliğinin üzerine ek bir güvence sağlamak amacıyla, her iletiye özel dijital imzaların kullanıldığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V4.2", - "Ordinal": 2, - "Name": "HTTP İleti Yapısı Doğrulama", - "Items": [ - { - "Shortcode": "V4.2.1", - "Ordinal": 1, - "Description": "Tüm uygulama bileşenlerinin (yük dengeleyiciler, güvenlik duvarları ve uygulama sunucuları dahil) HTTP sürümüne uygun mekanizmaları kullanarak gelen HTTP iletilerinin sınırlarını belirlediği ve bu sayede HTTP istek kaçakçılığına karşı koruma sağlandığı doğrulanmalıdır. HTTP/1.x sürümünde Transfer-Encoding başlık alanı varsa, RFC 2616'ya göre Content-Length başlığı göz ardı edilmelidir. HTTP/2 veya HTTP/3 kullanıldığında, Content-Length başlığı varsa, alıcının bu değerin DATA çerçevelerinin uzunluğuyla tutarlı olduğunu doğrulaması gerekir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.2.2", - "Ordinal": 2, - "Description": "HTTP iletileri üretilirken, Content-Length başlığının, HTTP protokolünün çerçeveleme yöntemine göre belirlenen içerik uzunluğu ile çelişmediği doğrulanmalıdır. Bu, istek kaçakçılığı saldırılarını önlemek için gereklidir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.2.3", - "Ordinal": 3, - "Description": "Uygulamanın, yanıt bölme ve header enjeksiyonu saldırılarını önlemek amacıyla, bağlantıya özel başlık alanları (örneğin Transfer-Encoding) içeren HTTP/2 veya HTTP/3 iletilerini göndermediği ve kabul etmediği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.2.4", - "Ordinal": 4, - "Description": "Uygulamanın yalnızca başlık alanları ve değerleri CR (\\r), LF (\\n) veya CRLF (\\r\\n) karakter dizileri içermeyen HTTP/2 ve HTTP/3 isteklerini kabul ettiği doğrulanmalıdır. Bu, başlık enjeksiyonu saldırılarını önlemek içindir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.2.5", - "Ordinal": 5, - "Description": "Uygulama (backend veya frontend) istek oluşturuyor ve gönderiyorsa, URI'ler (örneğin API çağrıları için) veya HTTP istek başlıkları (örneğin Authorization veya Cookie) gibi bileşenlerin, alıcı sistemler tarafından kabul edilemeyecek kadar uzun olmamasını sağlamak amacıyla doğrulama, temizleme veya diğer mekanizmaları kullandığı doğrulanmalıdır. Bu tür çok uzun istekler (örneğin çok uzun bir Cookie başlığı) gönderildiğinde sunucunun sürekli hata durumu döndürmesiyle hizmet reddi oluşabilir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V4.3", - "Ordinal": 3, - "Name": "GraphQL", - "Items": [ - { - "Shortcode": "V4.3.1", - "Ordinal": 1, - "Description": "Maliyetli ve iç içe geçmiş sorgular sonucu oluşabilecek GraphQL veya veri katmanı ifadelerine yönelik Hizmet Reddi (DoS) saldırılarını önlemek için, sorgu izin listesi (allowlist), derinlik sınırlandırması, sorgu sayısı sınırlandırması veya sorgu maliyeti analizi kullanıldığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.3.2", - "Ordinal": 2, - "Description": "GraphQL introspection (iç yapı sorgulama) sorgularının, GraphQL API'nin üçüncü taraflar tarafından kullanılmasına yönelik olmadığı sürece, üretim ortamında devre dışı bırakıldığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V4.4", - "Ordinal": 4, - "Name": "WebSocket", - "Items": [ - { - "Shortcode": "V4.4.1", - "Ordinal": 1, - "Description": "Tüm WebSocket bağlantılarında TLS üzerinden WebSocket (WSS) kullanıldığı doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.4.2", - "Ordinal": 2, - "Description": "WebSocket'in başlangıçtaki HTTP el sıkışması (handshake) sırasında, Origin başlık alanının uygulama için izin verilen origin listesiyle karşılaştırılarak kontrol edildiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.4.3", - "Ordinal": 3, - "Description": "Uygulamanın standart oturum yönetimi kullanılamıyorsa, bunun yerine ilgili Oturum Yönetimi güvenlik gereksinimlerine uygun özel token'ların kullanıldığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V4.4.4", - "Ordinal": 4, - "Description": "HTTPS oturumu WebSocket kanalına geçerken, özel WebSocket oturum yönetim token’larının önceki şekilde kimliği doğrulanmış HTTPS oturumu aracılığıyla elde edildiği veya doğrulandığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V5", - "Ordinal": 5, - "ShortName": "File", - "Name": "Dosya İşleme", - "Items": [ - { - "Shortcode": "V5.1", - "Ordinal": 1, - "Name": "Dosya İşleme Dokümantasyonu", - "Items": [ - { - "Shortcode": "V5.1.1", - "Ordinal": 1, - "Description": "Dokümantasyonun, her yükleme özelliği için izin verilen dosya türlerini, beklenen dosya uzantılarını ve maksimum boyutu (açılmış hali dahil) tanımladığı doğrulanmalıdır. Ayrıca, dosyaların son kullanıcılar için nasıl güvenli hâle getirileceği (örneğin kötü amaçlı bir dosya tespit edildiğinde uygulamanın nasıl davranacağı) gibi bilgilerin de belgede yer aldığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V5.2", - "Ordinal": 2, - "Name": "Dosya Yükleme ve İçerik", - "Items": [ - { - "Shortcode": "V5.2.1", - "Ordinal": 1, - "Description": "Uygulamanın, yalnızca performans kaybına veya hizmet reddine yol açmayacak boyuttaki dosyaları kabul ettiği doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V5.2.2", - "Ordinal": 2, - "Description": "Uygulama bir dosyayı, doğrudan veya bir arşiv (ör. zip dosyası) içinde kabul ettiğinde, dosya uzantısının beklenen uzantıyla eşleşip eşleşmediğini kontrol ettiği ve içeriğin uzantı tarafından temsil edilen türle uyumlu olduğunu doğruladığı kontrol edilmelidir. Bu; ilk 'magic byte' kontrolü, görüntü yeniden yazımı ve dosya içeriği doğrulama için özel kütüphanelerin kullanımı gibi yöntemleri içerir. Seviye 1 için bu, yalnızca iş veya güvenlik kararlarında kullanılan dosyalarla sınırlı olabilir. Seviye 2 ve üzeri için tüm dosyalar bu kontrole tabi olmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V5.2.3", - "Ordinal": 3, - "Description": "Sıkıştırılmış dosyaların (ör. zip, gz, docx, odt) açılmadan önce, izin verilen maksimum açılmış boyuta ve maksimum dosya sayısına göre kontrol edildiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V5.2.4", - "Ordinal": 4, - "Description": "Her kullanıcı için dosya boyutu kotası ve maksimum dosya sayısının uygulandığı doğrulanmalıdır. Böylece tek bir kullanıcının çok sayıda veya aşırı büyük dosya yükleyerek depolama alanını doldurması engellenir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V5.2.5", - "Ordinal": 5, - "Description": "Uygulamanın, içinde sembolik bağlantılar (symlink) bulunan sıkıştırılmış dosyaların yüklenmesine yalnızca bu durum özel olarak gerekli olduğunda izin verdiği doğrulanmalıdır. Bu durumda, sembolik bağlantı verilebilecek dosyaların bir izinli listesi uygulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V5.2.6", - "Ordinal": 6, - "Description": "Uygulamanın, piksel boyutu izin verilen maksimum değeri aşan görüntü dosyalarının yüklenmesini reddettiği doğrulanmalıdır. Bu, pixel flood saldırılarını önlemek için gereklidir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V5.3", - "Ordinal": 3, - "Name": "Dosya Depolama", - "Items": [ - { - "Shortcode": "V5.3.1", - "Ordinal": 1, - "Description": "Güvenilmeyen girdilerle yüklenen veya oluşturulan ve herkese açık klasörlerde depolanan dosyaların, bir HTTP isteğiyle doğrudan erişildiğinde sunucu taraflı program kodu olarak çalıştırılmadığı doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V5.3.2", - "Ordinal": 2, - "Description": "Uygulamanın, dosya işlemleri için dosya yollarını oluştururken kullanıcı tarafından gönderilen dosya adlarını değil, dahili olarak oluşturulan veya güvenilir verileri kullandığı; eğer kullanıcı tarafından gönderilen dosya adları veya meta veriler kullanılacaksa, sıkı doğrulama ve temizleme işlemlerinin uygulandığı doğrulanmalıdır. Bu, yol geçişi (path traversal), yerel veya uzak dosya dahil etme (LFI, RFI) ve sunucu tarafı istek sahteciliği (SSRF) saldırılarına karşı koruma sağlar.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V5.3.3", - "Ordinal": 3, - "Description": "Sunucu tarafında gerçekleşen dosya işlemlerinin (örneğin dosya açma/decompress işlemi), kullanıcı tarafından sağlanan yol bilgilerini yok saydığı ve zip slip gibi güvenlik açıklarını önlediği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V5.4", - "Ordinal": 4, - "Name": "Dosya İndirme", - "Items": [ - { - "Shortcode": "V5.4.1", - "Ordinal": 1, - "Description": "Uygulamanın, kullanıcı tarafından gönderilen dosya adlarını (ör. JSON, JSONP veya URL parametresinde) doğruladığı veya göz ardı ettiği ve yanıtın Content-Disposition başlık alanında bir dosya adı belirttiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V5.4.2", - "Ordinal": 2, - "Description": "Sunulan dosya adlarının (örneğin HTTP yanıt header'larında veya e-posta eklerinde), belge yapısını korumak ve enjeksiyon saldırılarını önlemek için kodlandığı veya temizlendiği (ör. RFC 6266’ya uygun) doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V5.4.3", - "Ordinal": 3, - "Description": "Güvenilmeyen kaynaklardan elde edilen dosyaların, bilinen kötü amaçlı içeriklerin sunulmasını önlemek amacıyla antivirüs tarayıcılarıyla tarandığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V6", - "Ordinal": 6, - "ShortName": "Authentication", - "Name": "Kimlik Doğrulama", - "Items": [ - { - "Shortcode": "V6.1", - "Ordinal": 1, - "Name": "Kimlik Doğrulama Dokümantasyonu", - "Items": [ - { - "Shortcode": "V6.1.1", - "Ordinal": 1, - "Description": "Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırılarına karşı oran sınırlama (rate limiting), otomasyon karşıtı önlemler ve uyarlanabilir yanıt gibi kontrollerin nasıl kullanıldığını açıklayan bir uygulama dokümantasyonu bulunduğu doğrulanmalıdır. Dokümantasyon, bu kontrollerin nasıl yapılandırıldığını ve kötü niyetli hesap kilitlemenin nasıl önlendiğini açıkça ortaya koymalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.1.2", - "Ordinal": 2, - "Description": "Parolalarda kullanılmasını önlemek amacıyla, bağlama özgü sözcüklerin (örneğin kurum adlarının permütasyonları, ürün adları, sistem tanımlayıcıları, proje kod adları, departman veya rol adları vb.) bulunduğu belgelenmiş bir liste mevcut olduğu doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.1.3", - "Ordinal": 3, - "Description": "Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, bunların tümünün belgelenmiş olduğu ve her yol için tutarlı şekilde uygulanması gereken güvenlik kontrolleri ile kimlik doğrulama gücünün tanımlandığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V6.2", - "Ordinal": 2, - "Name": "Parola Güvenliği", - "Items": [ - { - "Shortcode": "V6.2.1", - "Ordinal": 1, - "Description": "Kullanıcı tarafından belirlenen parolaların en az 8 karakter uzunluğunda olması sağlanmalı, ancak 15 karakter ve üzeri uzunlukta parolalar olmaları şiddetle tavsiye edilir.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.2", - "Ordinal": 2, - "Description": "Kullanıcıların parolalarını değiştirebilmeleri sağlanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.3", - "Ordinal": 3, - "Description": "Parola değiştirme işlevinin hem mevcut hem de yeni parolayı gerektirdiği doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.4", - "Ordinal": 4, - "Description": "Kayıt veya parola değişimi sırasında girilen parolaların, uygulamanın parola politikasına (örneğin minimum uzunluk) uyan ilk 3000 yaygın parolaya karşı kontrol edildiği doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.5", - "Ordinal": 5, - "Description": "Her tür karakterin kullanılmasına izin verildiği ve büyük/küçük harf, sayı veya özel karakter şartlarının zorunlu tutulmadığı doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.6", - "Ordinal": 6, - "Description": "Parola giriş alanlarının, girdiyi maskelemek için \"type=password\" kullandığı doğrulanmalıdır. Uygulamalar, kullanıcının tüm maskelenmiş parolayı ya da son girilen karakteri geçici olarak görüntülemesine izin verebilir.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.7", - "Ordinal": 7, - "Description": "\"Yapıştır\" özelliğinin, tarayıcı parola yardımcılarının ve harici parola yöneticilerinin kullanımına izin verildiği doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.8", - "Ordinal": 8, - "Description": "Uygulamanın, kullanıcıdan aldığı parolayı herhangi bir şekilde değiştirmeden, örneğin kesmeden veya harf büyüklüğünü değiştirmeden, tam olarak doğruladığı teyit edilmelidir.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.9", - "Ordinal": 9, - "Description": "En az 64 karakter uzunluğundaki parolalara izin verildiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.10", - "Ordinal": 10, - "Description": "Kullanıcının parolasının, yalnızca ele geçirildiği tespit edildiğinde veya kullanıcı tarafından yenilendiğinde geçerliliğini yitirdiği doğrulanmalıdır. Uygulama, belirli aralıklarla parola yenilenmesini zorunlu kılmamalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.11", - "Ordinal": 11, - "Description": "Tahmin edilmesi kolay parolaların oluşturulmasını önlemek amacıyla, bağlama özgü kelimelerin yer aldığı belgelenmiş listenin parola doğrulamada kullanıldığı teyit edilmelidir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.2.12", - "Ordinal": 12, - "Description": "Kayıt veya parola değişikliği sırasında girilen parolaların, ele geçirilmiş parolalar listesine karşı kontrol edildiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V6.3", - "Ordinal": 3, - "Name": "Genel Kimlik Doğrulama Güvenliği", - "Items": [ - { - "Shortcode": "V6.3.1", - "Ordinal": 1, - "Description": "Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırıları gibi saldırıları önlemeye yönelik kontrollerin, uygulamanın güvenlik dokümantasyonuna göre uygulandığı doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.3.2", - "Ordinal": 2, - "Description": "\"root\", \"admin\" veya \"sa\" gibi varsayılan kullanıcı hesaplarının uygulamada yer almadığı veya devre dışı bırakıldığı doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.3.3", - "Ordinal": 3, - "Description": "Uygulamaya erişim için ya çok faktörlü bir kimlik doğrulama mekanizması ya da tek faktörlü mekanizmaların kombinasyonu kullanılmalıdır. Seviye 3 için, bu faktörlerden biri, oltalama saldırılarına karşı direnç sağlayan ve kimlik doğrulama niyetini bir kullanıcı etkileşimi (örneğin FIDO donanım anahtarında bir düğmeye basma veya mobil telefonda bir onay) gerektirerek doğrulayan donanım tabanlı bir kimlik doğrulayıcı olmalıdır. Bu gereksinimdeki herhangi bir esneklik için, gerekçesi belgelenmiş ve riskleri azaltıcı kapsamlı kontroller içeren bir plan gereklidir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.3.4", - "Ordinal": 4, - "Description": "Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, belgelendirilmemiş bir yol bulunmadığı ve tüm yollar için güvenlik kontrolleri ile kimlik doğrulama gücünün tutarlı şekilde uygulandığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.3.5", - "Ordinal": 5, - "Description": "Başarılı veya başarısız şüpheli kimlik doğrulama girişimlerinin kullanıcıya bildirildiği doğrulanmalıdır. Bu, olağandışı bir konum veya istemciden gelen girişimler, yalnızca bir faktörle yapılan kısmen başarılı doğrulamalar, uzun süreli inaktiflik sonrası yapılan girişimler veya birçok başarısız denemeden sonraki başarılı girişimler gibi durumları içerebilir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.3.6", - "Ordinal": 6, - "Description": "E-postanın, tek faktörlü ya da çok faktörlü kimlik doğrulama mekanizması olarak kullanılmadığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.3.7", - "Ordinal": 7, - "Description": "Kimlik doğrulama detaylarında yapılan güncellemeler sonrasında (örneğin kimlik bilgisi sıfırlama, kullanıcı adı veya e-posta adresi değişiklikleri), kullanıcıların bilgilendirildiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.3.8", - "Ordinal": 8, - "Description": "Başarısız kimlik doğrulama girişimlerinden, geçerli kullanıcıların hata mesajları, HTTP yanıt kodları veya farklı yanıt süreleri gibi sonuçlara dayanarak tespit edilemediği doğrulanmalıdır. Bu koruma, kayıt ve \"parolamı unuttum\" işlevselliğinde de geçerli olmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V6.4", - "Ordinal": 4, - "Name": "Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve Kurtarma", - "Items": [ - { - "Shortcode": "V6.4.1", - "Ordinal": 1, - "Description": "Sistem tarafından oluşturulan ilk parolaların veya etkinleştirme kodlarının güvenli bir şekilde rastgele üretildiği, mevcut parola politikasına uygun olduğu, kısa bir süre içinde veya ilk kullanım sonrasında geçerliliğini yitirdiği doğrulanmalıdır. Bu başlangıç sırları uzun vadeli parola olarak kullanılmasına izin verilmemelidir.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.4.2", - "Ordinal": 2, - "Description": "Parola ipuçlarının veya \"gizli sorular\" olarak bilinen, bilgiye dayalı kimlik doğrulama mekanizmalarının mevcut olmadığı doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.4.3", - "Ordinal": 3, - "Description": "Unutulmuş parolanın sıfırlanması için, etkin olan çok faktörlü kimlik doğrulama mekanizmalarını atlamayan güvenli bir sürecin uygulandığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.4.4", - "Ordinal": 4, - "Description": "Çok faktörlü kimlik doğrulama faktörlerinden biri kaybolursa, kayıt sırasında uygulanan kimlik kanıtlama seviyesiyle aynı seviyede kimlik doğrulama yapıldığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.4.5", - "Ordinal": 5, - "Description": "Süresi dolacak kimlik doğrulama mekanizmalarının yenilenmesine ilişkin talimatların, süresi dolmadan önce tamamlanacak şekilde yeterli sürede gönderildiği ve gerekiyorsa otomatik hatırlatıcıların yapılandırıldığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.4.6", - "Ordinal": 6, - "Description": "Yönetici yetkisi olan kullanıcıların, kullanıcının parola sıfırlama sürecini başlatabildiği ancak kullanıcının yeni parolasını belirleyemediği veya değiştiremediği doğrulanmalıdır. Bu, yönetici yetkisi olan kullanıcıların, kullanıcı parolasını bilmesini engeller.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V6.5", - "Ordinal": 5, - "Name": "Çok Faktörlü Kimlik Doğrulama İçin Genel Gereksinimler", - "Items": [ - { - "Shortcode": "V6.5.1", - "Ordinal": 1, - "Description": "Arama sırları, bant dışı kimlik doğrulama istekleri veya kodları ve zamana dayalı tek kullanımlık parolaların (TOTP) yalnızca bir kez kullanılabildiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.5.2", - "Ordinal": 2, - "Description": "Uygulamanın backend tarafında saklanırken, 112 bitten az entropiye sahip (örneğin 19 rastgele harf-rakam karakteri veya 34 rastgele rakam) arama sırlarının, 32-bit rastgele bir salt içeren onaylı bir parola saklama algoritmasıyla hash’lendiği doğrulanmalıdır. Gizli bilginin entropisi 112 bit veya daha fazlaysa standart bir hash fonksiyonu kullanılabilir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.5.3", - "Ordinal": 3, - "Description": "Arama sırları, bant dışı kimlik doğrulama kodları ve zamana dayalı tek kullanımlık parola seed'lerinin, öngörülebilir değerlerden kaçınmak için Kriptografik Olarak Güvenli Sözde Rastgele Sayı Üreteci (CSPRNG) ile oluşturulduğu doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.5.4", - "Ordinal": 4, - "Description": "Arama sırlarının ve bant dışı kimlik doğrulama kodlarının en az 20 bit entropiye (genellikle 4 rastgele harf-rakam karakteri veya 6 rastgele rakam) sahip olduğu doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.5.5", - "Ordinal": 5, - "Description": "Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının ve zamana dayalı tek kullanımlık parolaların (TOTP) belirli bir ömre sahip olduğu doğrulanmalıdır. Bant dışı istekler en fazla 10 dakika, TOTP’ler ise en fazla 30 saniye geçerli olmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.5.6", - "Ordinal": 6, - "Description": "Herhangi bir kimlik doğrulama faktörünün (fiziksel cihazlar dahil) çalınması veya kaybı durumunda iptal edilebildiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.5.7", - "Ordinal": 7, - "Description": "Biyometrik kimlik doğrulama mekanizmalarının yalnızca ikincil faktör olarak, “sahip olduğunuz bir şey” veya “bildiğiniz bir şey” ile birlikte kullanıldığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.5.8", - "Ordinal": 8, - "Description": "Zamana dayalı tek kullanımlık parolaların (TOTP) doğrulamasının, güvenilir bir hizmetten alınan zaman kaynağına dayanarak yapıldığı ve güvenilir olmayan veya istemci tarafından sağlanan zaman kaynağına dayanmadığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V6.6", - "Ordinal": 6, - "Name": "Bant Dışı Kimlik Doğrulama Mekanizmaları", - "Items": [ - { - "Shortcode": "V6.6.1", - "Ordinal": 1, - "Description": "Tek kullanımlık parolaların (OTP) telefon veya SMS ile Public Switched Telephone Network (PSTN) üzerinden iletildiği kimlik doğrulama mekanizmalarının, yalnızca telefon numarası önceden doğrulanmışsa, alternatif daha güçlü yöntemler (örneğin TOTP) de sunuluyorsa ve kullanıcıya güvenlik riskleri hakkında bilgi veriliyorsa sunulduğu doğrulanmalıdır. Seviye 3 uygulamalar için telefon ve SMS seçenekleri sunulmamalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.6.2", - "Ordinal": 2, - "Description": "Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının, oluşturuldukları özgün kimlik doğrulama isteğiyle bağlantılı olduğu ve daha önceki ya da sonraki bir istek için kullanılamadığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.6.3", - "Ordinal": 3, - "Description": "Kod tabanlı bant dışı kimlik doğrulama mekanizmalarının, oran sınırlaması ile kaba kuvvet saldırılarına karşı korunduğu doğrulanmalıdır. En az 64 bit entropiye sahip kodlar kullanılması da değerlendirilmelidir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.6.4", - "Ordinal": 4, - "Description": "Çok faktörlü kimlik doğrulama için push bildirimleri kullanılıyorsa, push bombing saldırılarına karşı oran sınırlamasının kullanıldığı doğrulanmalıdır. “Numara eşleştirme” de bu riski azaltabilir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V6.7", - "Ordinal": 7, - "Name": "Kriptografik Kimlik Doğrulama Mekanizması", - "Items": [ - { - "Shortcode": "V6.7.1", - "Ordinal": 1, - "Description": "Kriptografik kimlik doğrulama beyanlarını doğrulamak için kullanılan sertifikaların, değiştirilmeye karşı korumalı şekilde saklandığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.7.2", - "Ordinal": 2, - "Description": "Challenge nonce değerinin en az 64 bit uzunluğunda olduğu ve istatistiksel olarak benzersiz ya da cihazın ömrü boyunca benzersiz olduğu doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V6.8", - "Ordinal": 8, - "Name": "Kimlik Sağlayıcısı ile Kimlik Doğrulama", - "Items": [ - { - "Shortcode": "V6.8.1", - "Ordinal": 1, - "Description": "Uygulama birden fazla kimlik sağlayıcıyı (IdP) destekliyorsa, başka bir desteklenen kimlik sağlayıcı aracılığıyla (örneğin aynı kullanıcı tanımlayıcısını kullanarak) kullanıcının kimliğinin taklit edilemediği doğrulanmalıdır. Standart önlem, uygulamanın kullanıcıyı IdP kimliği (bir ad alanı işlevi görür) ve IdP içindeki kullanıcı kimliğinin birleşimiyle kaydetmesi ve tanımlamasıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.8.2", - "Ordinal": 2, - "Description": "Kimlik doğrulama beyanları üzerindeki dijital imzaların (örneğin JWT veya SAML beyanları) varlığı ve bütünlüğünün her zaman doğrulandığı ve imzasız veya geçersiz imzalı beyanların reddedildiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.8.3", - "Ordinal": 3, - "Description": "SAML beyanlarının benzersiz biçimde işlendiği ve yalnızca geçerlilik süresi içinde bir kez kullanıldığı, tekrar oynatma (replay) saldırılarını önlemek amacıyla doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V6.8.4", - "Ordinal": 4, - "Description": "Uygulama ayrı bir Kimlik Sağlayıcı (IdP) kullanıyorsa ve belirli işlemler için belirli kimlik doğrulama gücü, yöntemleri veya zaman bilgisi bekliyorsa, uygulamanın bu bilgileri IdP tarafından döndürülen veriler üzerinden doğruladığı teyit edilmelidir. Örneğin OIDC kullanılıyorsa, bu durum ID Token üzerindeki 'acr', 'amr' ve 'auth_time' gibi claim’lerin (varsa) doğrulanması ile sağlanabilir. Eğer IdP bu bilgileri sağlamıyorsa, uygulamanın asgari kimlik doğrulama gücünün kullanıldığını varsayan (örneğin yalnızca kullanıcı adı ve parola ile tek faktörlü doğrulama) belgelenmiş bir yedek yaklaşımı olmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V7", - "Ordinal": 7, - "ShortName": "Session", - "Name": "Oturum Yönetimi", - "Items": [ - { - "Shortcode": "V7.1", - "Ordinal": 1, - "Name": "Oturum Yönetim Dokümantasyonu", - "Items": [ - { - "Shortcode": "V7.1.1", - "Ordinal": 1, - "Description": "Kullanıcının oturum inaktivite zaman aşımı süresi ve mutlak maksimum oturum süresinin belgelendiği, diğer kontrollerle birlikte uygun olduğu ve NIST SP 800-63B yeniden kimlik doğrulama gereksinimlerinden herhangi bir sapma varsa gerekçesinin belgede yer aldığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.1.2", - "Ordinal": 2, - "Description": "Belgede bir hesap için kaç adet eşzamanlı (paralel) oturuma izin verildiği ile birlikte, maksimum aktif oturum sayısına ulaşıldığında uygulanacak davranış ve işlemlerin tanımlandığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.1.3", - "Ordinal": 3, - "Description": "Birleşik kimlik yönetim ekosisteminin bir parçası olarak kullanıcı oturumu oluşturan ve yöneten tüm sistemlerin, oturum ömrü, sonlandırma ve yeniden kimlik doğrulama gerektiren diğer koşulların nasıl koordine edildiğini açıklayan kontrollerle birlikte belgede yer aldığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V7.2", - "Ordinal": 2, - "Name": "Temel Oturum Yönetimi Güvenliği", - "Items": [ - { - "Shortcode": "V7.2.1", - "Ordinal": 1, - "Description": "Uygulamanın tüm oturum token'ı doğrulama işlemlerini güvenilir bir backend servisi aracılığıyla gerçekleştirdiği doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.2.2", - "Ordinal": 2, - "Description": "Uygulamanın, statik API gizli anahtarları veya sabit değerler yerine, oturum yönetimi için dinamik olarak oluşturulan kendi kendine yeterli veya referans token'ları kullandığı doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.2.3", - "Ordinal": 3, - "Description": "Uygulama kullanıcı oturumlarını temsil etmek için referans token'ları kullanıyorsa, bu token'ların benzersiz olduğu, kriptografik olarak güvenli bir sözde rastgele sayı üreteci (CSPRNG) kullanılarak üretildiği ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.2.4", - "Ordinal": 4, - "Description": "Uygulamanın, kullanıcı kimlik doğrulaması (yeniden kimlik doğrulama dahil) sırasında yeni bir oturum token'ı oluşturduğu ve mevcut oturum token'ını sonlandırdığı doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V7.3", - "Ordinal": 3, - "Name": "Oturum Zaman Aşımı", - "Items": [ - { - "Shortcode": "V7.3.1", - "Ordinal": 1, - "Description": "Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde bir hareketsizlik zaman aşımı bulunduğu doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.3.2", - "Ordinal": 2, - "Description": "Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde mutlak bir maksimum oturum süresi bulunduğu doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V7.4", - "Ordinal": 4, - "Name": "Oturum Sonlandırma", - "Items": [ - { - "Shortcode": "V7.4.1", - "Ordinal": 1, - "Description": "Oturum sonlandırma tetiklendiğinde (örneğin, çıkış yapıldığında veya süre dolduğunda), uygulamanın oturumun daha fazla kullanılmasına izin vermediği doğrulanmalıdır. Referans token'lar veya durum bilgili oturumlar için bu, oturum verilerinin uygulama arka ucunda geçersiz kılınması anlamına gelir. Kapsamlı token kullanan uygulamaların; sonlandırılmış token listesi tutmak, kullanıcıya özel tarih ve saatten önce oluşturulan token'ları reddetmek veya kullanıcıya özel imzalama anahtarını yenilemek gibi bir çözüm uygulaması gerekir.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.4.2", - "Ordinal": 2, - "Description": "Bir kullanıcı hesabı devre dışı bırakıldığında veya silindiğinde (örneğin bir çalışanın şirketten ayrılması), uygulamanın tüm aktif oturumları sonlandırdığı doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.4.3", - "Ordinal": 3, - "Description": "Herhangi bir kimlik doğrulama faktörünün başarılı bir şekilde değiştirilmesi veya kaldırılmasından (şifre sıfırlama veya kurtarma yoluyla yapılan değişiklikler dahil ve varsa MFA ayarları güncellemeleri dahil) sonra, uygulamanın diğer tüm aktif oturumları sonlandırma seçeneği sunduğu doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.4.4", - "Ordinal": 4, - "Description": "Kimlik doğrulama gerektiren tüm sayfalarda kolay erişilebilir ve görünür bir çıkış yap (logout) işlevi bulunduğu doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.4.5", - "Ordinal": 5, - "Description": "Uygulama yöneticilerinin, bireysel bir kullanıcının veya tüm kullanıcıların aktif oturumlarını sonlandırabilme yetkisine sahip olduğu doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V7.5", - "Ordinal": 5, - "Name": "Oturum Kötüye Kullanımına Karşı Savunmalar", - "Items": [ - { - "Shortcode": "V7.5.1", - "Ordinal": 1, - "Description": "E-posta adresi, telefon numarası, MFA yapılandırması veya hesap kurtarmada kullanılan diğer bilgiler gibi kimlik doğrulamayı etkileyebilecek hassas hesap özniteliklerinde değişiklik yapılmadan önce uygulamanın tam yeniden kimlik doğrulama gerektirdiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.5.2", - "Ordinal": 2, - "Description": "Kullanıcıların, (en az bir faktörle yeniden kimlik doğrulama yaptıktan sonra) mevcut tüm aktif oturumları görüntüleyebilmesi ve sonlandırabilmesinin mümkün olduğu doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.5.3", - "Ordinal": 3, - "Description": "Uygulamanın, son derece hassas işlemler veya operasyonlar gerçekleştirilmeden önce en az bir faktörle ek kimlik doğrulaması veya ikincil bir doğrulama gerektirdiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V7.6", - "Ordinal": 6, - "Name": "Birleşik Yeniden Kimlik Doğrulama", - "Items": [ - { - "Shortcode": "V7.6.1", - "Ordinal": 1, - "Description": "Güvenen Taraf (RP) ile Kimlik Sağlayıcı (IdP) arasındaki oturum süresi ve oturum sonlandırma davranışlarının belgelenmiş olduğu ve, örneğin IdP kimlik doğrulama olayları arasında maksimum süreye ulaşıldığında yeniden kimlik doğrulamanın gerekli kılındığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V7.6.2", - "Ordinal": 2, - "Description": "Yeni bir oturum oluşturulmasının, kullanıcı onayı veya açık bir eylem gerektirdiği; kullanıcı etkileşimi olmaksızın yeni uygulama oturumlarının oluşturulmasının önlendiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V8", - "Ordinal": 8, - "ShortName": "Authorization", - "Name": "Yetkilendirme", - "Items": [ - { - "Shortcode": "V8.1", - "Ordinal": 1, - "Name": "Yetkilendirme Dokümantasyonu", - "Items": [ - { - "Shortcode": "V8.1.1", - "Ordinal": 1, - "Description": "Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak işlev düzeyinde ve veriye özel erişim kısıtlamaları için kuralları tanımladığı doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V8.1.2", - "Ordinal": 2, - "Description": "Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak alan (field) düzeyinde erişim kısıtlamaları (hem okuma hem yazma) için kuralları tanımladığı doğrulanmalıdır. Bu kuralların, ilgili veri nesnesinin durum veya statü gibi diğer özniteliklerine bağlı olabileceği unutulmamalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V8.1.3", - "Ordinal": 3, - "Description": "Uygulamanın dokümantasyonunun, kimlik doğrulama ve yetkilendirme ile ilgili güvenlik kararlarının alınmasında kullanılan çevresel ve bağlamsal öznitelikleri (günün saati, kullanıcı konumu, IP adresi veya cihaz gibi) tanımladığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V8.1.4", - "Ordinal": 4, - "Description": "Kimlik doğrulama ve yetkilendirme dokümantasyonunun; işlev düzeyinde, veriye özel ve alan düzeyinde yetkilendirmenin yanı sıra çevresel ve bağlamsal faktörlerin karar almada nasıl kullanıldığını tanımladığı doğrulanmalıdır. Bu, değerlendirilen öznitelikleri, risk eşiklerini ve alınan aksiyonları (ör. izin ver, doğrulama iste, reddet, step-up kimlik doğrulama) içermelidir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V8.2", - "Ordinal": 2, - "Name": "Genel Yetkilendirme Tasarımı", - "Items": [ - { - "Shortcode": "V8.2.1", - "Ordinal": 1, - "Description": "Uygulamanın, işlev düzeyindeki erişimin yalnızca açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V8.2.2", - "Ordinal": 2, - "Description": "Uygulamanın, veriye özel erişimin yalnızca belirli veri öğelerine açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, doğrudan nesne referansı güvenlik açıkları (IDOR) ve bozuk nesne düzeyinde yetkilendirme (BOLA) risklerini azaltır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V8.2.3", - "Ordinal": 3, - "Description": "Uygulamanın, alan (field) düzeyindeki erişimin yalnızca belirli alanlara açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, bozuk nesne özelliği düzeyinde yetkilendirme (BOPLA) risklerini azaltır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V8.2.4", - "Ordinal": 4, - "Description": "Tüketicinin çevresel ve bağlamsal özniteliklerine (ör. günün saati, konum, IP adresi veya cihaz) dayalı uyarlanabilir güvenlik kontrollerinin, uygulama dokümantasyonunda tanımlandığı şekilde, kimlik doğrulama ve yetkilendirme kararları için uygulandığı doğrulanmalıdır. Bu kontroller, tüketici yeni bir oturum başlatmaya çalışırken ve mevcut bir oturum sırasında uygulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V8.3", - "Ordinal": 3, - "Name": "İşlem Düzeyinde Yetkilendirme", - "Items": [ - { - "Shortcode": "V8.3.1", - "Ordinal": 1, - "Description": "Uygulamanın yetkilendirme kurallarını güvenilir bir servis katmanında uyguladığı ve istemci taraflı JavaScript gibi güvenilmeyen tüketiciler tarafından değiştirilebilecek kontrollerle yetinmediği doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V8.3.2", - "Ordinal": 2, - "Description": "Yetkilendirme kararlarının temelini oluşturan değerlerdeki değişikliklerin hemen uygulandığı doğrulanmalıdır. Değişikliklerin anında uygulanamadığı durumlarda (örneğin self-contained token içindeki verilere güveniliyorsa), tüketici artık yetkili olmadığı hâlde bir işlem gerçekleştirdiğinde uyarı verecek ve değişikliği geri alacak önlemler uygulanmalıdır. Bu alternatifin bilgi sızıntısını önlemeyeceği unutulmamalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V8.3.3", - "Ordinal": 3, - "Description": "Bir nesneye erişimin, herhangi bir aracı veya onun adına hareket eden bir servis yerine yalnızca erişimi başlatan öznenin (ör. tüketici) izinlerine dayandığı doğrulanmalıdır. Örneğin, bir tüketici kimlik doğrulama için bir self-contained token kullanarak bir web servis çağırırsa ve bu servis başka bir servisten veri talep ederse, ikinci servis izin kararlarını verirken birinci servisin makine-makine token'ı yerine tüketicinin token'ını kullanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V8.4", - "Ordinal": 4, - "Name": "Diğer Yetkilendirme Hususları", - "Items": [ - { - "Shortcode": "V8.4.1", - "Ordinal": 1, - "Description": "Multi-tenant uygulamaların, tüketici işlemlerinin izinli olmadıkları tenant'lar üzerinde asla etkili olmamasını sağlamak için tenant'lar arası kontroller kullandığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V8.4.2", - "Ordinal": 2, - "Description": "Yönetici arayüzlerine erişimin, sürekli tüketici kimlik doğrulaması, cihaz güvenlik durumu değerlendirmesi ve bağlamsal risk analizi dahil olmak üzere çok katmanlı güvenlik içerdiği doğrulanmalıdır. Yetkilendirme için yalnızca ağ konumu veya güvenilir uç noktalar yeterli olmamalıdır; ancak bu tür faktörler yetkisiz erişim olasılığını azaltabilir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V9", - "Ordinal": 9, - "ShortName": "Self", - "Name": "Kendi İçinde Taşıyıcı Token (Self-contained Token)", - "Items": [ - { - "Shortcode": "V9.1", - "Ordinal": 1, - "Name": "Token Kaynağı ve Bütünlüğü", - "Items": [ - { - "Shortcode": "V9.1.1", - "Ordinal": 1, - "Description": "Self-contained token'ların içerikleri kabul edilmeden önce, oynama (tampering) saldırılarına karşı dijital imza veya MAC ile doğrulama yapıldığı doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V9.1.2", - "Ordinal": 2, - "Description": "Belirli bir bağlam için yalnızca bir allowlist üzerinde bulunan algoritmaların self-contained token oluşturmak ve doğrulamak için kullanılabildiği doğrulanmalıdır. Bu allowlist, yalnızca simetrik ya da yalnızca asimetrik algoritmaları içermeli ve kesinlikle 'None' algoritmasını içermemelidir. Hem simetrik hem de asimetrik algoritmalar desteklenmek zorundaysa, anahtar karışıklığını (key confusion) önlemek için ek kontroller uygulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V9.1.3", - "Ordinal": 3, - "Description": "Self-contained token'ları doğrulamak için kullanılan anahtar malzemesinin, token issuer için önceden yapılandırılmış güvenilir kaynaklardan alındığı doğrulanmalıdır. Bu, saldırganların güvenilmeyen kaynak ve anahtarları belirtmesini engeller. JWT ve diğer JWS yapılarında 'jku', 'x5u' ve 'jwk' gibi header'lar güvenilir kaynaklardan oluşan bir allowlist'e göre doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V9.2", - "Ordinal": 2, - "Name": "Token İçeriği", - "Items": [ - { - "Shortcode": "V9.2.1", - "Ordinal": 1, - "Description": "Token verisinde bir geçerlilik zaman aralığı (validity time span) varsa, yalnızca doğrulama zamanı bu zaman aralığı içerisindeyse token ve içeriği kabul edilmelidir. Örneğin, JWT'ler için 'nbf' ve 'exp' claim'leri doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V9.2.2", - "Ordinal": 2, - "Description": "Token'ı alan hizmetin, token içeriğini kabul etmeden önce bu token'ın doğru türde olduğunu ve sunulma amacına uygun olduğunu doğruladığı teyit edilmelidir. Örneğin, yalnızca erişim token'ları yetkilendirme kararları için, yalnızca ID Token'lar kullanıcı kimlik doğrulamasını kanıtlamak için kullanılabilir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V9.2.3", - "Ordinal": 3, - "Description": "Hizmetin yalnızca kendisiyle kullanılması amaçlanan (audience) token'ları kabul ettiği doğrulanmalıdır. JWT'lerde bu, 'aud' claim'inin hizmet içinde tanımlı bir allowlist ile doğrulanması yoluyla sağlanabilir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V9.2.4", - "Ordinal": 4, - "Description": "Eğer bir token issuer, farklı audience'lara token oluşturmak için aynı private key'i kullanıyorsa, oluşturulan token'ların hedef audience'ları benzersiz şekilde tanımlayan bir audience kısıtlaması içerdiği doğrulanmalıdır. Bu, bir token'ın farklı bir audience ile yeniden kullanılmasını önler. Audience tanımlayıcısı dinamik olarak sağlanıyorsa, token issuer bu audience'ları doğrulamalı ve audience taklitlerinin (impersonation) önüne geçmelidir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V10", - "Ordinal": 10, - "ShortName": "OAuth", - "Name": "OAuth ve OIDC", - "Items": [ - { - "Shortcode": "V10.1", - "Ordinal": 1, - "Name": "Genel OAuth ve OIDC Güvenliği", - "Items": [ - { - "Shortcode": "V10.1.1", - "Ordinal": 1, - "Description": "Token'ların yalnızca kesinlikle ihtiyaç duyan bileşenlere gönderildiği doğrulanmalıdır. Örneğin, tarayıcı tabanlı JavaScript uygulamaları için bir backend-for-frontend modeli kullanıldığında, access ve refresh token'lara yalnızca backend'in erişebilmesi gerekir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.1.2", - "Ordinal": 2, - "Description": "Authorization server'dan gelen değerler (örneğin authorization code veya ID Token gibi) yalnızca aynı user agent oturumu ve işlemi tarafından başlatılmış bir yetkilendirme akışının sonucuysa kabul edildiği doğrulanmalıdır. Bu, client tarafından oluşturulan secret’ların 'proof key for code exchange' (PKCE) ‘code_verifier’, ‘state’ veya OIDC ‘nonce’ gibi tahmin edilemez, işleme özgü ve hem client’a hem de işlem başlatılan user agent oturumuna güvenli bir şekilde bağlı olmasını gerektirir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V10.2", - "Ordinal": 2, - "Name": "OAuth İstemcisi", - "Items": [ - { - "Shortcode": "V10.2.1", - "Ordinal": 1, - "Description": "Code flow kullanılıyorsa, OAuth client’ın token taleplerini tetikleyen CSRF saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Bu genellikle PKCE kullanılarak veya authorization isteğinde gönderilen ‘state’ parametresinin kontrolü ile sağlanır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.2.2", - "Ordinal": 2, - "Description": "OAuth istemcisi birden fazla AS ile etkileşime girebiliyorsa, mix-up saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Örneğin, authorization server’ın 'iss' parametresini döndürmesi zorunlu kılınabilir ve bu parametrenin hem authorization yanıtında hem de token yanıtında doğrulanması gerekir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.2.3", - "Ordinal": 3, - "Description": "OAuth istemcisinin authorization server’a yaptığı taleplerde yalnızca gerekli scope’ları (veya diğer yetkilendirme parametrelerini) talep ettiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V10.3", - "Ordinal": 3, - "Name": "OAuth Kaynak Sunucusu (RS)", - "Items": [ - { - "Shortcode": "V10.3.1", - "Ordinal": 1, - "Description": "RS'nin yalnızca bu servisle kullanılmak üzere tasarlanmış access token’ları kabul ettiği doğrulanmalıdır (audience kontrolü). Audience bilgisi yapılandırılmış token’larda (örneğin JWT içindeki ‘aud’ claim’i) yer alabilir veya token introspection endpoint aracılığıyla kontrol edilebilir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.3.2", - "Ordinal": 2, - "Description": "RS'nin, access token’dan gelen claim’lere dayanarak yetki devri tanımına uygun şekilde yetkilendirme kararları uyguladığı doğrulanmalıdır. ‘sub’, ‘scope’ ve ‘authorization_details’ gibi claim’ler varsa, bu kararın parçası olmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.3.3", - "Ordinal": 3, - "Description": "Erişim kontrolü kararında, access token’dan (JWT veya ilgili token introspection yanıtı) benzersiz bir kullanıcının tanımlanması gerekiyorsa, RS'nin başka kullanıcılara devredilemeyecek claim’ler ile kullanıcıyı tanımladığı doğrulanmalıdır. Genellikle bu, ‘iss’ ve ‘sub’ claim’lerinin birlikte kullanılması anlamına gelir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.3.4", - "Ordinal": 4, - "Description": "RS'nin belirli bir kimlik doğrulama gücü, yöntemi veya güncelliği (recentness) gerektirmesi durumunda, sunulan access token’ın bu kısıtlamaları karşıladığını doğruladığı, örneğin, OIDC ‘acr’, ‘amr’ ve ‘auth_time’ claim’leri kullanılarak doğrulanmalıdır. ", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.3.5", - "Ordinal": 5, - "Description": "RS'nin, (yetkisiz taraflarca) çalınmış veya tekrar edilen access token’ların kullanımını önlemek için sender-constrained access token’lar kullandığı doğrulanmalıdır. Bu, OAuth 2 için Mutual TLS veya OAuth 2 Demonstration of Proof of Possession (DPoP) ile sağlanabilir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V10.4", - "Ordinal": 4, - "Name": "OAuth Yetkilendirme Sunucusu (AS)", - "Items": [ - { - "Shortcode": "V10.4.1", - "Ordinal": 1, - "Description": "AS'nin, istemciye özel önceden kaydedilmiş URI’lerden oluşan bir allowlist kullanarak redirect URI’leri tam dize karşılaştırması ile doğruladığı doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.2", - "Ordinal": 2, - "Description": "AS'nin, \"authorization response\" içinde \"authorization code\" döndürdüğü durumlarda, bu kodun yalnızca bir kez kullanılabildiği doğrulanmalıdır. Daha önce access token vermek için kullanılmış bir authorization code ile yapılan ikinci geçerli token isteği reddedilmeli ve ilgili tüm token’lar iptal edilmelidir.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.3", - "Ordinal": 3, - "Description": "Authorization code’un kısa ömürlü olduğu doğrulanmalıdır. L1 ve L2 uygulamalar için maksimum yaşam süresi 10 dakika, L3 uygulamalar için 1 dakikadır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.4", - "Ordinal": 4, - "Description": "Belirli bir istemci için AS'nin yalnızca o istemcinin ihtiyaç duyduğu grant türlerine izin verdiği doğrulanmalıdır. \"Token\" (Implicit flow) ve \"password\" (Resource Owner Password Credentials flow) grant türlerinin artık kullanılmaması gerekir.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.5", - "Ordinal": 5, - "Description": "AS'nin, açık istemciler için refresh token replay saldırılarını azalttığı doğrulanmalıdır. Tercihen sender-constrained refresh token’lar (DPoP veya mutual TLS ile certificate-bound access token’lar) kullanılmalıdır. L1 ve L2 uygulamalar için refresh token rotation kullanılabilir. Rotation kullanılıyorsa, AS refresh token’ı kullanım sonrası geçersiz kılmalı ve geçersiz bir refresh token sunulması durumunda o yetkilendirme ile ilişkili tüm refresh token’ları iptal etmelidir.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.6", - "Ordinal": 6, - "Description": "Code grant kullanılıyorsa, AS'nin authorization code interception saldırılarına karşı koruma sağladığı doğrulanmalıdır. Yetkilendirme isteğinde geçerli bir \"code_challenge\" değeri zorunlu olmalı ve \"code_challenge_method\" olarak \"plain\" kabul edilmemelidir. Token isteğinde ise \"code_verifier\" parametresi doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.7", - "Ordinal": 7, - "Description": "AS'nin, kimlik doğrulaması yapılmamış dinamik istemci kaydını desteklemesi durumunda, kötü niyetli istemci uygulamalarına karşı riskleri azalttığı doğrulanmalıdır. Kayıtlı URI’ler gibi client metadata’sı doğrulanmalı, kullanıcı onayı alınmalı ve güvenilmeyen bir client uygulamasıyla yapılan yetkilendirme isteği işlenmeden önce kullanıcı uyarılmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.8", - "Ordinal": 8, - "Description": "Refresh token’ların, sliding expiration kullanılsa bile mutlak bir sona erme süresine sahip olduğu doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.9", - "Ordinal": 9, - "Description": "Yetkili bir kullanıcı tarafından AS kullanıcı arayüzü üzerinden refresh token’ların ve reference access token’ların iptal edilebildiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.10", - "Ordinal": 10, - "Description": "Gizli istemcilerin token istekleri, pushed authorization request (PAR) ve token iptal istekleri gibi server’a yapılan backchannel isteklerinde kimliğinin kontrol edildiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.11", - "Ordinal": 11, - "Description": "AS yapılandırmasının, OAuth istemcisine yalnızca gerekli scope’ları atadığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.12", - "Ordinal": 12, - "Description": "Belirli bir client için, authorization server’ın yalnızca client’ın ihtiyaç duyduğu 'response_mode' değerine izin verdiği doğrulanmalıdır. Örneğin, bu değer ya beklenenlerle karşılaştırılarak doğrulanmalı ya da PAR veya JAR kullanılmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.13", - "Ordinal": 13, - "Description": "\"Code\" grant türünün daima pushed authorization request (PAR) ile birlikte kullanıldığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.14", - "Ordinal": 14, - "Description": "AS'nin yalnızca sender-constrained (Proof-of-Possession) access token’lar ürettiği doğrulanmalıdır. Bu, mutual TLS ile certificate-bound access token ya da DPoP ile DPoP-bound access token olabilir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.15", - "Ordinal": 15, - "Description": "Sunucu taraflı istemciler için (kullanıcı cihazında çalışmayan), AS'nin \"authorization_details\" parametresinin istemci backend'i tarafından sağlandığını ve kullanıcı tarafından değiştirilmediğini doğruladığı, örneğin pushed authorization request (PAR) or JWT-secured Authorization Request (JAR) zorunlu kılınarak doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.4.16", - "Ordinal": 16, - "Description": "Bir istemci gizli ise, AS'nin güçlü istemci kimlik doğrulama yöntemlerini zorunlu kıldığı doğrulanmalıdır. Bu yöntemler, public-key cryptography’ye dayalı ve replay saldırılarına karşı dayanıklı olmalı, örneğin mutual TLS (\"tls_client_auth\", \"self_signed_tls_client_auth\") veya private key JWT (\"private_key_jwt\") gibi.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V10.5", - "Ordinal": 5, - "Name": "OIDC İstemcisi", - "Items": [ - { - "Shortcode": "V10.5.1", - "Ordinal": 1, - "Description": "İstemcinin (relying party olarak) ID Token replay saldırılarını azalttığı doğrulanmalıdır. Örneğin, ID Token’daki 'nonce' claim’inin, OpenID Provider’a gönderilen kimlik doğrulama isteğindeki 'nonce' değeriyle eşleştiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.5.2", - "Ordinal": 2, - "Description": "İstemcinin kullanıcıyı ID Token claim’lerinden (genellikle, başka kullanıcılarla yeniden atanamayan 'sub' claim’i) benzersiz şekilde tanımladığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.5.3", - "Ordinal": 3, - "Description": "İstemcinin, kötü niyetli bir AS'nin başka bir AS'yi taklit etmesini AS metadata’sı üzerinden reddettiği doğrulanmalıdır. AS metadata’sındaki issuer URL’si, istemci tarafından beklenen önceden yapılandırılmış issuer URL’siyle tam olarak eşleşmiyorsa, metadata reddedilmelidir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.5.4", - "Ordinal": 4, - "Description": "İstemcinin, ID Token’ın kendisi için (audience) kullanılması amaçlandığını doğruladığı doğrulanmalıdır. Bu, token’daki 'aud' claim’inin istemcinin 'client_id' değeriyle eşit olup olmadığının kontrol edilmesiyle yapılır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.5.5", - "Ordinal": 5, - "Description": "OIDC back-channel logout kullanıldığında, relying party’nin \"forced logout\" ve \"logout\" akışında \"cross-JWT confusion\" gibi saldırılara karşı koruma sağladığı doğrulanmalıdır. Client, logout token’ın 'logout+jwt' türünde olduğunu, 'event' claim’inin doğru üyeye sahip olduğunu ve 'nonce' claim’i içermediğini doğrulamalıdır. Ayrıca token için kısa bir sona erme süresi (örneğin 2 dakika) önerilir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V10.6", - "Ordinal": 6, - "Name": "OpenID Provider", - "Items": [ - { - "Shortcode": "V10.6.1", - "Ordinal": 1, - "Description": "OpenID Provider’ın yalnızca 'code', 'ciba', 'id_token' veya 'id_token code' response mode değerlerine izin verdiği doğrulanmalıdır. 'code' değeri, 'id_token code' (OIDC Hybrid flow) yerine tercih edilmelidir. 'token' (Implicit flow) kullanılmamalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.6.2", - "Ordinal": 2, - "Description": "OpenID Provider’ın forced logout yoluyla yapılan hizmet reddi saldırılarını önlediği doğrulanmalıdır. Bu, son kullanıcıdan açık onay alınarak veya varsa logout isteğinde (relying party tarafından başlatılan) bulunan parametrelerin, örneğin 'id_token_hint', doğrulanmasıyla yapılabilir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V10.7", - "Ordinal": 7, - "Name": "Onay (Consent) Yönetimi", - "Items": [ - { - "Shortcode": "V10.7.1", - "Ordinal": 1, - "Description": "AS'nin her yetkilendirme isteği için kullanıcının onayını aldığı doğrulanmalıdır. İstemcinin kimliği garanti altına alınamıyorsa, AS daima kullanıcıdan açıkça onay istemelidir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.7.2", - "Ordinal": 2, - "Description": "AS'nin kullanıcıdan onay istediğinde, neye onay verildiğini açık ve yeterli şekilde gösterdiği doğrulanmalıdır. Uygun olduğunda bu bilgiler, istenen yetkilendirmelerin doğasını (genellikle scope, resource server, RAR gibi detaylara dayalı), yetkilendirilmiş uygulamanın kimliğini ve bu yetkilendirmelerin süresini içermelidir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V10.7.3", - "Ordinal": 3, - "Description": "Kullanıcının, AS üzerinden verdiği onayları görüntüleyebildiği, değiştirebildiği ve iptal edebildiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V11", - "Ordinal": 11, - "ShortName": "Cryptography", - "Name": "Kriptografi", - "Items": [ - { - "Shortcode": "V11.1", - "Ordinal": 1, - "Name": "Kriptografik Envanter ve Dokümantasyon", - "Items": [ - { - "Shortcode": "V11.1.1", - "Ordinal": 1, - "Description": "Kriptografik anahtarların yönetimi için belgelenmiş bir politika ve NIST SP 800-57 gibi bir anahtar yönetim standardını izleyen bir kriptografik anahtar yaşam döngüsü tanımlandığı doğrulanmalıdır. Bu, anahtarların aşırı miktarda paylaşılmadığını (örneğin, paylaşılan sırlar için ikiden fazla tarafla veya özel anahtarlar için birden fazla tarafla) garanti altına almalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.1.2", - "Ordinal": 2, - "Description": "Tüm kriptografik anahtarlar, algoritmalar ve uygulama tarafından kullanılan sertifikaları içeren bir kriptografik envanterin oluşturulduğu, sürdürüldüğü ve düzenli olarak güncellendiği doğrulanmalıdır. Bu envanter ayrıca, sistemde anahtarların nerede kullanılabileceğini ve kullanılamayacağını, ve hangi veri türlerinin bu anahtarlarla korunup korunamayacağını da belgelemelidir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.1.3", - "Ordinal": 3, - "Description": "Sistem içerisinde şifreleme, özetleme ve imzalama işlemleri dahil olmak üzere kriptografi kullanımının tüm örneklerini tespit etmek için kriptografik keşif mekanizmalarının kullanıldığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.1.4", - "Ordinal": 4, - "Description": "Kriptografik bir envanterin sürdürüldüğü doğrulanmalıdır. Bu envanter, gelecekteki tehditlere karşı tepki verebilmek amacıyla post-kuantum kriptografiye geçiş yolunu belirten belgelenmiş bir plan içermelidir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V11.2", - "Ordinal": 2, - "Name": "Güvenli Kriptografi Uygulaması", - "Items": [ - { - "Shortcode": "V11.2.1", - "Ordinal": 1, - "Description": "Kriptografik işlemler için sektör tarafından doğrulanmış uygulamaların (kütüphaneler ve donanım hızlandırmalı uygulamalar dahil) kullanıldığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.2.2", - "Ordinal": 2, - "Description": "Uygulamanın, rastgele sayı üreticileri, kimliği doğrulanmış şifreleme, MAC veya özetleme algoritmaları, anahtar uzunlukları, turlar, şifreler ve modların herhangi bir zamanda yeniden yapılandırılabilir, yükseltilebilir veya değiştirilebilir olacağı şekilde kripto çevikliği (crypto agility) ile tasarlandığı doğrulanmalıdır. Aynı şekilde, anahtarların ve parolaların değiştirilebilmesi ve verilerin yeniden şifrelenebilmesi mümkün olmalıdır. Bu, onaylanmış PQC şemalarının yüksek güvenlikli uygulamaları yaygın olarak kullanılabilir hale geldiğinde sorunsuz geçişe olanak tanır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.2.3", - "Ordinal": 3, - "Description": "Tüm kriptografik ilkeliklerin, algoritma, anahtar boyutu ve yapılandırmaya göre minimum 128 bit güvenlik sağladığı doğrulanmalıdır. Örneğin, 256-bit ECC anahtarı yaklaşık 128 bit güvenlik sağlarken, RSA için aynı güvenliği elde etmek 3072-bit anahtar gerektirir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.2.4", - "Ordinal": 4, - "Description": "Tüm kriptografik işlemlerin sabit süreli (constant-time) olduğu, karşılaştırmalarda, hesaplamalarda veya geri dönüşlerde kısa devre (short-circuit) işlemleri yapılmadığı doğrulanmalıdır; bu, bilgi sızıntısını önlemek için gereklidir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.2.5", - "Ordinal": 5, - "Description": "Tüm kriptografik modüllerin güvenli şekilde hata verdiği ve hataların, padding oracle saldırıları gibi zafiyetleri mümkün kılmayacak şekilde ele alındığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V11.3", - "Ordinal": 3, - "Name": "Şifreleme Algoritmaları", - "Items": [ - { - "Shortcode": "V11.3.1", - "Ordinal": 1, - "Description": "Güvensiz blok modlarının (örneğin, ECB) ve zayıf doldurma (padding) şemalarının (örneğin, PKCS#1 v1.5) kullanılmadığı doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.3.2", - "Ordinal": 2, - "Description": "Yalnızca AES ile GCM gibi onaylı şifreleme algoritmalarının ve modlarının kullanıldığı doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.3.3", - "Ordinal": 3, - "Description": "Şifrelenmiş verilerin yetkisiz değişikliklere karşı korunduğu doğrulanmalıdır. Tercihen bu koruma, onaylı bir kimliği doğrulanmış şifreleme yöntemi kullanılarak ya da onaylı bir şifreleme yöntemi ile onaylı bir MAC algoritmasının kombinasyonu ile sağlanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.3.4", - "Ordinal": 4, - "Description": "Sayılar, başlatma vektörleri (IV) ve diğer tek kullanımlık değerlerin, aynı şifreleme anahtarı ve veri öğesi çifti için birden fazla kez kullanılmadığı doğrulanmalıdır. Oluşturma yöntemi kullanılan algoritmaya uygun olmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.3.5", - "Ordinal": 5, - "Description": "Şifreleme algoritması ve MAC algoritması kombinasyonlarının \"encrypt-then-MAC\" modunda çalıştığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V11.4", - "Ordinal": 4, - "Name": "Hashing ve Hash Tabanlı Fonksiyonlar", - "Items": [ - { - "Shortcode": "V11.4.1", - "Ordinal": 1, - "Description": "Dijital imzalar, HMAC, KDF ve rastgele bit üretimi gibi genel kriptografik kullanım senaryolarında yalnızca onaylı hash fonksiyonlarının kullanıldığı doğrulanmalıdır. MD5 gibi yasaklı hash fonksiyonları hiçbir kriptografik amaçla kullanılmamalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.4.2", - "Ordinal": 2, - "Description": "Parolaların, onaylı, hesaplama açısından yoğun ve mevcut rehberliğe göre yapılandırılmış bir anahtar türetme fonksiyonu (diğer adıyla parola hash'leme fonksiyonu) kullanılarak saklandığı doğrulanmalıdır. Ayarlar, güvenlik ve performans dengesini sağlayarak kaba kuvvet saldırılarını zorlaştırmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.4.3", - "Ordinal": 3, - "Description": "Dijital imzalarda kullanılan hash fonksiyonlarının, veri bütünlüğü ve kimlik doğrulama amacıyla kullanıldığında çakışmaya karşı dayanıklı ve yeterli bit uzunluğuna sahip olduğu doğrulanmalıdır. Çakışma dayanıklılığı gerekiyorsa çıktı uzunluğu en az 256 bit olmalıdır. Sadece ikinci ön-görüntü (2nd pre-iamge) saldırılarına karşı dayanıklılık gerekiyorsa çıktı uzunluğu en az 128 bit olmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.4.4", - "Ordinal": 4, - "Description": "Parolalardan gizli anahtarlar türetilirken, onaylı anahtar türetme fonksiyonlarının anahtar uzatma (key stretching) parametreleriyle birlikte kullanıldığı doğrulanmalıdır. Bu parametreler, kaba kuvvet saldırılarını önleyecek şekilde güvenlik ve performans dengesine sahip olmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V11.5", - "Ordinal": 5, - "Name": "Rastgele Değerler", - "Items": [ - { - "Shortcode": "V11.5.1", - "Ordinal": 1, - "Description": "Tahmin edilemez olması amaçlanan tüm rastgele sayıların ve dizelerin, CSPRNG ile oluşturulduğu ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. UUID'lerin bu koşulu dikkate almadığını unutmayın.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.5.2", - "Ordinal": 2, - "Description": "Kullanılan rastgele sayı üretim mekanizmasının, yoğun talep altında dahi güvenli çalışacak şekilde tasarlandığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V11.6", - "Ordinal": 6, - "Name": "Açık Anahtar (Public Key) Kriptografisi", - "Items": [ - { - "Shortcode": "V11.6.1", - "Ordinal": 1, - "Description": "Anahtar üretimi, tohumlama (seeding) ve dijital imza üretimi ve doğrulama için yalnızca onaylı kriptografik algoritmalar ve çalışma modlarının kullanıldığı doğrulanmalıdır. Anahtar üretim algoritmaları, bilinen saldırılara karşı savunmasız anahtarlar üretmemelidir. Örneğin, Fermat çarpanlama yöntemine karşı savunmasız RSA anahtarları oluşturulmamalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.6.2", - "Ordinal": 2, - "Description": "Anahtar değişimi için yalnızca onaylı kriptografik algoritmaların kullanıldığı doğrulanmalıdır (örneğin Diffie-Hellman). Kullanılan parametrelerin güvenli olması gerektiğine dikkat edilmelidir. Bu, anahtar kurulum sürecine yönelik saldırıları önleyecek ve araya girme (adversary-in-the-middle) ya da kriptografik kırılmaları engelleyecektir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V11.7", - "Ordinal": 7, - "Name": "Kullanım Halindeki Verilerin Kriptografisi", - "Items": [ - { - "Shortcode": "V11.7.1", - "Ordinal": 1, - "Description": "Hassas verilerin kullanım sırasında korunmasını sağlamak amacıyla, yetkisiz kullanıcıların veya süreçlerin bu verilere erişmesini engelleyen tam bellek şifrelemesinin kullanıldığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V11.7.2", - "Ordinal": 2, - "Description": "Veri asgariyetinin sağlandığı, yani işleme sırasında mümkün olan en az miktarda verinin ortaya çıktığı ve verilerin kullanımdan hemen sonra veya mümkün olan en kısa sürede şifrelendiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V12", - "Ordinal": 12, - "ShortName": "Secure", - "Name": "Güvenli İletişim", - "Items": [ - { - "Shortcode": "V12.1", - "Ordinal": 1, - "Name": "Genel TLS Güvenlik Rehberi", - "Items": [ - { - "Shortcode": "V12.1.1", - "Ordinal": 1, - "Description": "Yalnızca TLS protokolünün en güncel ve önerilen sürümlerinin (örneğin TLS 1.2 ve TLS 1.3) etkinleştirildiği ve en son sürümün varsayılan olarak tercih edildiği doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V12.1.2", - "Ordinal": 2, - "Description": "Yalnızca önerilen şifre takımlarının (cipher suite) etkinleştirildiği ve en güçlü şifre takımlarının tercih edildiği doğrulanmalıdır. Seviye 3 (L3) uygulamalar yalnızca ileri gizlilik (forward secrecy) sağlayan şifre takımlarını desteklemelidir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V12.1.3", - "Ordinal": 3, - "Description": "Uygulamanın, mTLS istemci sertifikalarını kimlik doğrulama veya yetkilendirme amacıyla kullanmadan önce bu sertifikaların güvendiği sertifikalar arasında olduğunu doğruladığı kontrol edilmelidir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V12.1.4", - "Ordinal": 4, - "Description": "Online Certificate Status Protocol (OCSP) Stapling gibi geçerli bir sertifika iptal kontrolü yönteminin etkinleştirildiği ve yapılandırıldığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V12.1.5", - "Ordinal": 5, - "Description": "TLS el sıkışma (handshake) sürecinde Server Name Indication (SNI) gibi hassas meta verilerin ifşa edilmesini önlemek için, uygulamanın TLS yapılandırmasında Encrypted Client Hello (ECH) özelliğinin etkinleştirildiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V12.2", - "Ordinal": 2, - "Name": "Dışa Açık Hizmetlerle HTTPS İletişimi", - "Items": [ - { - "Shortcode": "V12.2.1", - "Ordinal": 1, - "Description": "İstemci ile dışa açık, HTTP tabanlı hizmetler arasındaki tüm bağlantılarda TLS kullanıldığı ve bu bağlantıların güvensiz ya da şifrelenmemiş iletişime geri dönmediği doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V12.2.2", - "Ordinal": 2, - "Description": "Dışa açık hizmetlerin herkese açık olarak güvenilen TLS sertifikaları kullandığı doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V12.3", - "Ordinal": 3, - "Name": "Genel Servisler Arası İletişim Güvenliği", - "Items": [ - { - "Shortcode": "V12.3.1", - "Ordinal": 1, - "Description": "Uygulamaya gelen ve uygulamadan çıkan tüm bağlantılarda izleme sistemleri, yönetim araçları, uzaktan erişim ve SSH, ara yazılımlar, veritabanları, ana sistemler (mainframe), iş ortağı sistemleri ya da dış API'ler dahil olmak üzere TLS gibi şifreli bir protokolün kullanıldığı ve güvensiz ya da şifrelenmemiş protokollere geri dönülmediği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V12.3.2", - "Ordinal": 2, - "Description": "TLS istemcilerinin bir TLS sunucusu ile iletişime geçmeden önce alınan sertifikaları doğruladığı kontrol edilmelidir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V12.3.3", - "Ordinal": 3, - "Description": "Uygulama içindeki HTTP tabanlı iç hizmetler arasında gerçekleşen tüm bağlantılarda TLS ya da uygun başka bir aktarım şifreleme mekanizmasının kullanıldığı ve güvensiz ya da şifrelenmemiş iletişime geri dönülmediği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V12.3.4", - "Ordinal": 4, - "Description": "İç hizmetler arasındaki TLS bağlantılarında güvenilir sertifikaların kullanıldığı doğrulanmalıdır. İç sistemlerde oluşturulmuş ya da kendinden imzalı (self-signed) sertifikalar kullanılıyorsa, bu sertifikalara güvenen hizmetlerin yalnızca belirli dahili sertifika otoritelerine (CA) ve belirli kendinden imzalı sertifikalara güvenecek şekilde yapılandırıldıkları doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V12.3.5", - "Ordinal": 5, - "Description": "Sistem içindeki hizmetlerin birbiriyle iletişim kurarken her bir uç noktanın kimliğini doğrulamak için güçlü kimlik doğrulama yöntemlerinin kullanıldığı doğrulanmalıdır. Bu yöntemler arasında, açık anahtar altyapısı (public-key infrastructure) kullanan ve tekrar oynatma saldırılarına karşı dayanıklı olan TLS istemci kimlik doğrulaması gibi yöntemler yer almalıdır. Mikroservis mimarilerinde, sertifika yönetimini basitleştirmek ve güvenliği artırmak amacıyla bir servis ağı (service mesh) kullanılması değerlendirilmelidir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V13", - "Ordinal": 13, - "ShortName": "Configuration", - "Name": "Konfigürasyon", - "Items": [ - { - "Shortcode": "V13.1", - "Ordinal": 1, - "Name": "Konfigürasyon Dokümantasyonu", - "Items": [ - { - "Shortcode": "V13.1.1", - "Ordinal": 1, - "Description": "Uygulamanın tüm iletişim ihtiyaçlarının dokümante edildiği doğrulanmalıdır. Buna, uygulamanın bağımlı olduğu dış hizmetler ve son kullanıcının uygulamanın bağlantı kurmasını sağlayabileceği dış konumlar da dahil olmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.1.2", - "Ordinal": 2, - "Description": "Uygulamanın kullandığı her bir hizmet için, dokümantasyonda eşzamanlı bağlantı sayısı (örn. bağlantı havuzu limitleri) ve bu sınır aşıldığında uygulamanın davranışı, geri dönüş veya kurtarma mekanizmaları da dahil olmak üzere hizmet reddi koşullarını önlemek için tanımlandığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.1.3", - "Ordinal": 3, - "Description": "Uygulamanın, kullandığı her bir dış sistem veya hizmet (örn. veritabanları, dosya tanıtıcıları, iş parçacıkları, HTTP bağlantıları) için kaynak yönetimi stratejilerini tanımladığı doğrulanmalıdır. Bu stratejiler, kaynak serbest bırakma prosedürlerini, zaman aşımı ayarlarını, hata durumlarını ve tekrar deneme mantığı uygulanmışsa sınırları, gecikmeleri ve geri çekilme (back-off) algoritmalarını içermelidir. Senkron HTTP istek–yanıt işlemleri için kısa zaman aşımı süreleri zorunlu tutulmalı ve tekrar eden denemeler devre dışı bırakılmalı ya da sıkı şekilde sınırlandırılmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.1.4", - "Ordinal": 4, - "Description": "Uygulamanın, güvenlik açısından kritik olan gizli verileri tanımladığı ve kuruluşun tehdit modeli ve iş ihtiyaçlarına göre bu verilerin döndürülme (rotation) zamanlamasının belgelendiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V13.2", - "Ordinal": 2, - "Name": "Backend İletişim Konfigürasyonu", - "Items": [ - { - "Shortcode": "V13.2.1", - "Ordinal": 1, - "Description": "Uygulamanın, standart kullanıcı oturum mekanizmasını desteklemeyen backend bileşenleri (örneğin API'ler, ara katmanlar, veri katmanları) arasında gerçekleşen iletişimlerin kimlik doğrulamasıyla korunduğu doğrulanmalıdır. Kimlik doğrulama; bireysel hizmet hesapları, kısa ömürlü token'lar ya da sertifika tabanlı kimlik doğrulama ile yapılmalıdır ve parola, API anahtarı ya da ayrıcalıklı erişime sahip paylaşımlı hesaplar gibi sabit kimlik bilgileri kullanılmamalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.2.2", - "Ordinal": 2, - "Description": "Uygulamanın backend bileşenleri arasında (yerel hizmetler, işletim sistemi hizmetleri, API'ler, ara katmanlar ve veri katmanları dahil) gerçekleştirilen iletişimlerin, yalnızca gerekli en az ayrıcalığa sahip hesaplarla yapıldığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.2.3", - "Ordinal": 3, - "Description": "Bir hizmet kimlik doğrulaması için bir kimlik bilgisi kullanılması gerekiyorsa, bu kimlik bilgisinin varsayılan bir değer (örneğin root/root veya admin/admin) olmadığının doğrulanması gereklidir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.2.4", - "Ordinal": 4, - "Description": "Uygulamanın iletişim kurmasına izin verilen dış kaynaklar ya da sistemlerin, bir allowlist (izinli liste) ile tanımlandığı doğrulanmalıdır. Bu liste, uygulama katmanında, web sunucusunda, güvenlik duvarında veya farklı katmanların birleşiminde uygulanabilir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.2.5", - "Ordinal": 5, - "Description": "Web veya uygulama sunucusunun, dış sistemlere veri veya dosya gönderimi veya yüklemesi yaparken sadece belirli kaynaklara izin verecek şekilde allowlist ile yapılandırıldığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.2.6", - "Ordinal": 6, - "Description": "Uygulamanın farklı hizmetlere bağlantı kurduğu durumlarda, bu bağlantılar için belgelenmiş yapılandırmaları (örn. maksimum eşzamanlı bağlantı, bağlantı limiti aşıldığında davranış, zaman aşımı, tekrar deneme stratejileri) takip ettiğinin doğrulanması gereklidir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V13.3", - "Ordinal": 3, - "Name": "Gizli Bilgi Yönetimi", - "Items": [ - { - "Shortcode": "V13.3.1", - "Ordinal": 1, - "Description": "Parolalar, anahtar materyalleri, veritabanı ve üçüncü parti sistemlerle entegrasyon bilgileri, zaman tabanlı token'lar için tohum (seed) bilgileri, dahili gizli veriler ve API anahtarları gibi backend sırlarının güvenli bir şekilde oluşturulması, saklanması, erişim denetiminin sağlanması ve imha edilmesi için bir gizli bilgi yönetim çözümünün (örneğin key vault) kullanıldığı doğrulanmalıdır. Bu gizli bilgiler uygulama kaynak koduna dahil edilmemeli ve yapı çıktılarında yer almamalıdır. Seviye 3 uygulamalar için donanım destekli bir çözüm (örneğin HSM) gereklidir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.3.2", - "Ordinal": 2, - "Description": "Gizli bilgilere erişimin en az ayrıcalık prensibine uygun şekilde yapılandırıldığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.3.3", - "Ordinal": 3, - "Description": "Tüm kriptografik işlemlerin, anahtar materyallerinin güvenli bir şekilde yönetilmesi ve dışarıya sızmasının engellenmesi amacıyla, izole edilmiş bir güvenlik modülü (örneğin vault ya da donanım güvenlik modülü) aracılığıyla gerçekleştirildiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.3.4", - "Ordinal": 4, - "Description": "Uygulamanın belgelerinde belirtildiği şekilde gizli bilgilerin süresinin dolacak şekilde yapılandırıldığı ve düzenli olarak döndürüldüğü doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V13.4", - "Ordinal": 4, - "Name": "İstenmeyen Bilgi Sızıntısı", - "Items": [ - { - "Shortcode": "V13.4.1", - "Ordinal": 1, - "Description": "Uygulamanın .git veya .svn klasörleri gibi kaynak kontrolüyle ilgili metadata içermeyecek şekilde deploy edildiğini ya da bu klasörlerin hem dış erişime hem de uygulama erişimine kapalı olduğu doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.4.2", - "Ordinal": 2, - "Description": "Tüm bileşenler için üretim ortamlarında hata ayıklama (debug) modlarının devre dışı bırakıldığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.4.3", - "Ordinal": 3, - "Description": "Web sunucularının, açık şekilde istenmediği sürece dizin listelemesi (directory listing) özelliğini istemcilere sunmadığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.4.4", - "Ordinal": 4, - "Description": "HTTP TRACE metodunun üretim ortamlarında desteklenmediği, böylece potansiyel bilgi sızıntılarının önlendiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.4.5", - "Ordinal": 5, - "Description": "Belgeler (örneğin dahili API belgeleri) ve izleme uç noktalarının (monitoring endpoints) yalnızca açıkça belirtildiği durumlarda erişilebilir olduğu doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.4.6", - "Ordinal": 6, - "Description": "Uygulamanın arka uç bileşenlerinin ayrıntılı sürüm bilgilerini ifşa etmediği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V13.4.7", - "Ordinal": 7, - "Description": "Web katmanının yalnızca belirli dosya uzantılarına sahip dosyaları sunacak şekilde yapılandırıldığı, bu sayede istem dışı bilgi, yapılandırma ya da kaynak kod sızıntılarının önlendiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V14", - "Ordinal": 14, - "ShortName": "Data", - "Name": "Veri Koruma", - "Items": [ - { - "Shortcode": "V14.1", - "Ordinal": 1, - "Name": "Veri Koruma Dokümantasyonu", - "Items": [ - { - "Shortcode": "V14.1.1", - "Ordinal": 1, - "Description": "Uygulama tarafından oluşturulan ve işlenen tüm hassas verilerin tanımlanıp, koruma seviyelerine göre sınıflandırıldığından emin olun. Bu, yalnızca kodlanmış (örneğin Base64 stringleri ya da JWT içindeki düz metin yükler gibi) ve bu nedenle kolayca çözülebilir verileri de içermelidir. Koruma seviyeleri, uygulamanın uymakla yükümlü olduğu veri koruma ve gizlilik düzenlemeleri ile standartlarını dikkate almalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V14.1.2", - "Ordinal": 2, - "Description": "Tüm hassas veri koruma seviyeleri için belgelenmiş bir koruma gereksinimleri seti tanımlandığından emin olun. Bu gereksinimler genel şifreleme, bütünlük doğrulama, saklama süresi, verinin nasıl günlüğe kaydedileceği, günlüklerdeki hassas verilere erişim kontrolleri, veritabanı düzeyinde şifreleme, gizlilik ve gizliliği artırıcı teknolojiler ile diğer gizlilik gereksinimlerini kapsamalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V14.2", - "Ordinal": 2, - "Name": "Genel Veri Koruması", - "Items": [ - { - "Shortcode": "V14.2.1", - "Ordinal": 1, - "Description": "Hassas verilerin yalnızca HTTP message body veya header alanlarında sunucuya gönderildiği ve URL ile sorgu parametrelerinin, API anahtarı veya session token’ı gibi hassas bilgiler içermediği doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V14.2.2", - "Ordinal": 2, - "Description": "Hassas verilerin, yük dengeleyiciler ve uygulama önbellekleri gibi sunucu bileşenlerinde önbelleğe alınmasının engellendiği veya kullanım sonrası bu verilerin güvenli biçimde temizlendiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V14.2.3", - "Ordinal": 3, - "Description": "Uygulama kontrolü dışında veri toplanmasını engellemek için, tanımlanmış hassas verilerin, kullanıcı izleyicileri gibi güvensiz taraflara gönderilmediği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V14.2.4", - "Ordinal": 4, - "Description": "Hassas verilere yönelik şifreleme, bütünlük doğrulama, veri saklama, loglama yöntemi, loglardaki erişim kontrolleri, gizlilik teknolojileri gibi kontrollerin, söz konusu verinin belgelenmiş koruma seviyesinde tanımlandığı şekilde uygulandığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V14.2.5", - "Ordinal": 5, - "Description": "Önbellekleme mekanizmalarının yalnızca belirli içerik türüne sahip yanıtları önbelleğe alacak şekilde yapılandırıldığı ve hassas, dinamik içeriklerin önbelleğe alınmadığı doğrulanmalıdır. Web sunucusu, mevcut olmayan bir dosya talebinde geçerli ama farklı bir dosya döndürmek yerine 404 veya 302 cevabı vermelidir. Bu, Web Cache Deception saldırılarını önlemeye yardımcı olur.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V14.2.6", - "Ordinal": 6, - "Description": "Uygulamanın yalnızca işlevsellik için gerekli olan asgari hassas veriyi döndürdüğü doğrulanmalıdır. Örneğin, kredi kartı numarasının yalnızca bazı rakamlarının döndürülmesi; tam numaranın döndürülmesi gerekiyorsa, kullanıcı arayüzünde gizlenmiş (maskelenmiş) şekilde sunulması gerekir, aksi kullanıcı özel olarak görüntülemek istemedikçe gösterilmemelidir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V14.2.7", - "Ordinal": 7, - "Description": "Hassas bilgilerin, veri saklama sınıflandırmasına tabi tutulduğu, geçerliliğini yitirmiş veya artık gerekli olmayan verilerin belirlenmiş bir zaman çizelgesiyle ya da gerektiğinde otomatik olarak silindiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V14.2.8", - "Ordinal": 8, - "Description": "Kullanıcı tarafından yüklenen dosyaların meta verilerinden hassas bilgilerin çıkarıldığı veya bu bilgilerin yalnızca kullanıcıdan açık onay alındığında saklandığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V14.3", - "Ordinal": 3, - "Name": "İstemci Tarafı Veri Koruması", - "Items": [ - { - "Shortcode": "V14.3.1", - "Ordinal": 1, - "Description": "Kimliği doğrulanmış verilerin, istemci veya oturum sonlandığında istemci depolamasından (örneğin tarayıcı DOM’undan) temizlendiği doğrulanmalıdır. 'Clear-Site-Data' HTTP response header bu konuda yardımcı olabilir ancak istemci tarafı, sunucu bağlantısı mevcut olmadığında da temizlik işlemini yapabiliyor olmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V14.3.2", - "Ordinal": 2, - "Description": "Uygulamanın, tarayıcılarda hassas verilerin önbelleğe alınmasını önlemek amacıyla yeterli anti-önbellekleme HTTP response header (örneğin Cache-Control: no-store) ayarladığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V14.3.3", - "Ordinal": 3, - "Description": "Tarayıcıda depolanan verilerin (örneğin localStorage, sessionStorage, IndexedDB veya çerezler) hassas veri içermediği, yalnızca session token’larının istisna olarak kabul edildiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V15", - "Ordinal": 15, - "ShortName": "Secure", - "Name": "Güvenli Kodlama ve Mimari", - "Items": [ - { - "Shortcode": "V15.1", - "Ordinal": 1, - "Name": "Güvenli Kodlama ve Mimari Dokümantasyonu", - "Items": [ - { - "Shortcode": "V15.1.1", - "Ordinal": 1, - "Description": "Güvenlik açığı içeren üçüncü taraf bileşen sürümleri ve genel olarak kütüphane güncellemeleri için, uygulama dokümantasyonunda risk bazlı düzeltme zamanlarının tanımlandığı doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.1.2", - "Ordinal": 2, - "Description": "Yazılım bileşen listesi (Software Bill of Materials - SBOM) gibi bir envanterin tutulduğu, kullanılan tüm üçüncü taraf kütüphanelerin önceden tanımlanmış, güvenilir ve düzenli olarak güncellenen depolardan alındığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.1.3", - "Ordinal": 3, - "Description": "Uygulama dokümantasyonunda zaman veya kaynak açısından yoğun işlevlerin tanımlandığı, bu işlevlerin aşırı kullanımı durumunda kullanılabilirlik kaybının nasıl önleneceği ve yanıt oluşturma süresinin istemci zaman aşımını aşmaması için hangi önlemlerin alındığı belirtilmelidir. Örnek savunmalar kuyruklama, eşzamansız işleme, kullanıcı başına ve uygulama genelinde paralel işlem sınırlarını içerebilir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.1.4", - "Ordinal": 4, - "Description": "Uygulama dokümantasyonunda \"riskli bileşenler\" olarak değerlendirilen üçüncü taraf kütüphanelerin vurgulandığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.1.5", - "Ordinal": 5, - "Description": "Uygulama dokümantasyonunda \"tehlikeli işlevsellik\" içeren uygulama bölümlerinin açıkça belirtildiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V15.2", - "Ordinal": 2, - "Name": "Güvenlik Mimarisi ve Bağımlılıklar", - "Items": [ - { - "Shortcode": "V15.2.1", - "Ordinal": 1, - "Description": "Uygulamanın yalnızca, belgelenmiş güncelleme ve düzeltme sürelerini aşmamış bileşenleri içerdiği doğrulanmalıdır.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.2.2", - "Ordinal": 2, - "Description": "Uygulamanın, belgelenmiş güvenlik kararları ve stratejilere dayanarak, zaman veya kaynak açısından yoğun işlevlerin neden olabileceği kullanılabilirlik kaybına karşı savunmalar uyguladığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.2.3", - "Ordinal": 3, - "Description": "Üretim ortamının yalnızca uygulamanın çalışması için gerekli işlevleri içerdiği ve test kodları, örnek kod parçaları veya geliştirme işlevleri gibi gereksiz işlevsellikleri açığa çıkarmadığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.2.4", - "Ordinal": 4, - "Description": "Üçüncü taraf bileşenlerin ve bunların tüm transitif bağımlılıklarının beklenen depolardan (iç kaynaklı ya da harici) alındığı ve bağımlılık karışıklığı (dependency confusion) saldırılarına açık olmadığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.2.5", - "Ordinal": 5, - "Description": "Uygulamanın, “tehlikeli işlevsellik” içeren veya “riskli bileşenler” kullanan bölümlerine ek korumalar uyguladığı doğrulanmalıdır. Bu korumalar sandbox, kapsülleme, konteynerleştirme veya ağ düzeyinde izolasyon gibi teknikler aracılığıyla, bir uygulama bölümünün ele geçirilmesi durumunda saldırganın diğer bölümlere sıçramasını geciktirmeyi veya engellemeyi amaçlamalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V15.3", - "Ordinal": 3, - "Name": "Savunmacı Kodlama", - "Items": [ - { - "Shortcode": "V15.3.1", - "Ordinal": 1, - "Description": "Uygulamanın yalnızca gerekli alanların bir alt kümesini veri nesnesinden döndürdüğü doğrulanmalıdır. Örneğin, bazı alanlara kullanıcıların erişmemesi gerektiğinden tüm veri nesnesi döndürülmemelidir.", - "L1": { - "Required": true, - "Requirement": "✓" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.3.2", - "Ordinal": 2, - "Description": "Uygulama backend'i harici URL’lere çağrı yaptığında, yalnızca amaçlanan işlevsellik söz konusuysa yönlendirmeleri takip edecek şekilde yapılandırıldığının doğrulanması gerekir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.3.3", - "Ordinal": 3, - "Description": "Uygulamanın, kitlesel atama saldırılarına karşı, her bir controller ve eylem için izin verilen alanları sınırlandırarak savunmalar sağladığı doğrulanmalıdır. Örneğin, bir alan değeri, bu işlemde değiştirilmesi amaçlanmadıysa eklenememeli veya güncellenememelidir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.3.4", - "Ordinal": 4, - "Description": "Tüm proxy ve ara katman bileşenlerinin kullanıcının orijinal IP adresini, uç kullanıcı tarafından değiştirilemeyecek güvenilir veri alanları kullanarak doğru şekilde ilettiği ve uygulamanın ve web sunucusunun bu doğru değeri, loglama ve hız sınırlama gibi güvenlik kararları için kullandığı doğrulanmalıdır. Ayrıca, orijinal IP adresinin bile dinamik IP'ler, VPN'ler veya kurumsal güvenlik duvarları nedeniyle güvenilir olmayabileceği dikkate alınmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.3.5", - "Ordinal": 5, - "Description": "Uygulamanın değişkenlerin doğru türde olduğunu açıkça doğruladığı ve sıkı eşitlik ve karşılaştırma işlemleri kullandığı doğrulanmalıdır. Bu, değişken türüyle ilgili varsayımlardan kaynaklanan tür oynama (type juggling) veya tür karışıklığı (type confusion) güvenlik açıklarını önlemek içindir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.3.6", - "Ordinal": 6, - "Description": "JavaScript kodunun prototip zehirleme (prototype pollution) saldırılarını önleyecek şekilde yazıldığı, örneğin, nesne literal’leri yerine Set() veya Map() gibi yapılar kullanıldığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.3.7", - "Ordinal": 7, - "Description": "Uygulamanın, özellikle framework'ün istek parametrelerinin kaynağı (sorgu dizgisi, gövde parametreleri, çerezler veya başlık alanları) arasında ayrım yapmadığı durumlarda, HTTP parametre kirliliği (HTTP parameter pollution) saldırılarına karşı savunmalar uyguladığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V15.4", - "Ordinal": 4, - "Name": "Güvenli Eş Zamanlılık (Concurrency)", - "Items": [ - { - "Shortcode": "V15.4.1", - "Ordinal": 1, - "Description": "Çok iş parçacıklı kodda (örneğin cache'ler, dosyalar veya birden fazla iş parçacığı tarafından erişilen bellek içi nesneler gibi) paylaşılan nesnelere yalnızca thread-safe (iş parçacığı güvenli) türler ve kilitleme (lock) veya semaphore gibi senkronizasyon mekanizmaları kullanılarak erişildiği doğrulanmalıdır. Bu, yarış durumlarını ve veri bozulmasını önlemeye yöneliktir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.4.2", - "Ordinal": 2, - "Description": "Bir kaynağın durumu üzerindeki kontroller (örneğin varlığı ya da izinleri gibi) ile bu kontrole bağlı eylemlerin tek bir atomik işlem olarak gerçekleştirildiği doğrulanmalıdır. Bu, TOCTOU (time-of-check to time-of-use) yarış durumlarını önlemeye yöneliktir. Bir dosyanın varlığının kontrol edilip ardından açılması veya bir kullanıcının erişiminin doğrulanıp ardından yetki verilmesi gibi işlemler buna örnektir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.4.3", - "Ordinal": 3, - "Description": "Kilitlerin (locks) tutarlı biçimde kullanıldığı, iş parçacıklarının birbirini beklemesi ya da sonsuz döngüye girmesi (deadlock veya livelock) gibi durumların önlendiği doğrulanmalıdır. Ayrıca, kilitleme mantığı, kaynağı yöneten kod içinde kalmalı ve dış sınıflar veya dış kodlar tarafından istemeden veya kötü niyetli şekilde değiştirilememelidir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V15.4.4", - "Ordinal": 4, - "Description": "Kaynak tahsis politikalarının, iş parçacığı açlığını önleyecek şekilde, kaynaklara adil erişimi sağladığı doğrulanmalıdır. Örneğin, thread pool (iş parçacığı havuzu) kullanımı, düşük öncelikli iş parçacıklarının da makul sürelerde çalışabilmesi için uygulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V16", - "Ordinal": 16, - "ShortName": "Security", - "Name": "Güvenlik Günlüklemesi (Logging) ve Hata Yönetimi", - "Items": [ - { - "Shortcode": "V16.1", - "Ordinal": 1, - "Name": "Güvenlik Loglaması Dokümantasyonu", - "Items": [ - { - "Shortcode": "V16.1.1", - "Ordinal": 1, - "Description": "Uygulamanın teknoloji yığını boyunca her katmanda hangi olayların loglandığını, log formatlarını, logların nereye yazıldığını, nasıl kullanıldığını, erişimin nasıl kontrol edildiğini ve logların ne kadar süre saklandığını belgeleyen bir envanterin mevcut olduğu doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V16.2", - "Ordinal": 2, - "Name": "Genel Loglama", - "Items": [ - { - "Shortcode": "V16.2.1", - "Ordinal": 1, - "Description": "Her bir log girdisinin, olayın ne zaman, nerede, kim tarafından ve ne olduğuna dair detaylı bir zaman çizelgesi oluşturulmasına olanak tanıyacak gerekli meta verileri içerdiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.2.2", - "Ordinal": 2, - "Description": "Tüm loglama bileşenlerinin zaman kaynaklarının senkronize olduğu ve güvenlik olayı meta verisindeki zaman damgalarının UTC kullanarak ya da açık zaman dilimi ofsetiyle belirtildiği doğrulanmalıdır. UTC kullanımı, özellikle yaz saati uygulamaları nedeniyle oluşabilecek karışıklıkları önlemek için tavsiye edilir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.2.3", - "Ordinal": 3, - "Description": "Uygulamanın yalnızca log envanterinde belgelenmiş dosya ve hizmetlere log yazdığı ya da ilettiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.2.4", - "Ordinal": 4, - "Description": "Logların kullanılan log işleyici (log processor) tarafından okunabildiği ve ilişkilendirilebildiği doğrulanmalıdır. Tercihen yaygın bir log formatı kullanılmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.2.5", - "Ordinal": 5, - "Description": "Hassas veriler loglanırken, uygulamanın veri koruma seviyesine uygun olarak loglama yaptığı doğrulanmalıdır. Örneğin kimlik bilgileri veya ödeme detayları gibi bazı verilerin loglanmasına izin verilmemelidir. Session token’ları gibi veriler ise yalnızca tamamen ya da kısmen maskelenmiş ya da hash’lenmiş olarak loglanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V16.3", - "Ordinal": 3, - "Name": "Güvenlik Olayları", - "Items": [ - { - "Shortcode": "V16.3.1", - "Ordinal": 1, - "Description": "Tüm kimlik doğrulama işlemlerinin (başarılı ve başarısız girişimler dahil) loglandığı doğrulanmalıdır. Kullanılan kimlik doğrulama türü veya faktörleri gibi ek meta veriler de toplanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.3.2", - "Ordinal": 2, - "Description": "Başarısız yetkilendirme girişimlerinin loglandığı doğrulanmalıdır. Seviye 3 uygulamalar için, tüm yetkilendirme kararlarının ve hassas verilere erişim olaylarının (verinin kendisi olmadan) loglandığı da doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.3.3", - "Ordinal": 3, - "Description": "Uygulamanın, belgelenmiş güvenlik olaylarını ve güvenlik kontrollerini aşma girişimlerini (girdi doğrulama, iş mantığı, otomasyon karşıtı kontroller vb.) logladığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.3.4", - "Ordinal": 4, - "Description": "Beklenmeyen hatalar ve güvenlik kontrolü başarısızlıkları (örneğin backend TLS hataları gibi) loglandığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V16.4", - "Ordinal": 4, - "Name": "Log Koruması", - "Items": [ - { - "Shortcode": "V16.4.1", - "Ordinal": 1, - "Description": "Tüm loglama bileşenlerinin, log enjeksiyonunu (log injection) önlemek amacıyla verileri uygun biçimde encode ettiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.4.2", - "Ordinal": 2, - "Description": "Logların yetkisiz erişime karşı korunduğu ve değiştirilemez olduğu doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.4.3", - "Ordinal": 3, - "Description": "Logların analiz, tespit, uyarı ve yükseltme amacıyla mantıksal olarak ayrı bir sisteme güvenli biçimde iletildiği doğrulanmalıdır. Böylece uygulama ihlal edilse bile logların tehlikeye girmesi önlenmiş olur.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V16.5", - "Ordinal": 5, - "Name": "Hata Yönetimi", - "Items": [ - { - "Shortcode": "V16.5.1", - "Ordinal": 1, - "Description": "Beklenmedik ya da güvenlikle ilgili bir hata oluştuğunda, tüketiciye genel bir mesaj döndürüldüğü ve yığın izleri (stack trace), sorgular, gizli anahtarlar, token’lar gibi hassas sistem içi verilerin açıklanmadığı doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.5.2", - "Ordinal": 2, - "Description": "Uygulamanın, dış kaynaklara erişim başarısız olduğunda bile güvenli şekilde çalışmaya devam ettiği doğrulanmalıdır. Örneğin, circuit breaker ya da graceful degradation gibi desenler kullanılmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.5.3", - "Ordinal": 3, - "Description": "Uygulamanın hata durumlarında güvenli ve düzenli şekilde başarısız olduğu doğrulanmalıdır. Bu, örneğin doğrulama hatalarına rağmen işlemlerin işlenmesine yol açabilecek fail-open durumlarını önlemelidir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V16.5.4", - "Ordinal": 4, - "Description": "Ele alınmamış tüm istisnaları yakalayacak şekilde tanımlanmış bir “son çare hata yöneticisi” bulunduğu doğrulanmalıdır. Bu, hem loglara gitmesi gereken hata detaylarının kaybolmaması hem de tüm uygulama sürecinin çökerek hizmet dışı kalmasının önlenmesi açısından önemlidir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - }, - { - "Shortcode": "V17", - "Ordinal": 17, - "ShortName": "WebRTC", - "Name": "WebRTC", - "Items": [ - { - "Shortcode": "V17.1", - "Ordinal": 1, - "Name": "TURN Sunucusu", - "Items": [ - { - "Shortcode": "V17.1.1", - "Ordinal": 1, - "Description": "TURN hizmetinin yalnızca özel amaçlar için ayrılmamış IP adreslerine (ör. iç ağlar, yayın adresleri, loopback) erişime izin verdiği doğrulanmalıdır. Bu gereksinim hem IPv4 hem de IPv6 adresleri için geçerlidir.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V17.1.2", - "Ordinal": 2, - "Description": "TURN hizmetinin, meşru kullanıcıların sunucuda çok sayıda bağlantı noktası açmaya çalışması durumunda kaynak tüketimi saldırılarına karşı dayanıklı olduğu doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V17.2", - "Ordinal": 2, - "Name": "Medya", - "Items": [ - { - "Shortcode": "V17.2.1", - "Ordinal": 1, - "Description": "DTLS sertifikası anahtarının, belgelenmiş kriptografik anahtar yönetim politikasına uygun şekilde yönetildiği ve korunduğu doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V17.2.2", - "Ordinal": 2, - "Description": "Medya sunucusunun onaylı DTLS şifre takımlarını (cipher suites) ve Güvenli Gerçek Zamanlı Aktarım Protokolü (Secure Real-time Transport Protocol - SRTP) için anahtarlar oluşturmaya yönelik DTLS Uzantısı için güvenli bir koruma profilini kullanacak ve destekleyecek şekilde yapılandırıldığı (DTLS-SRTP) doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V17.2.3", - "Ordinal": 3, - "Description": "Real-time Transport Protocol (RTP) injection saldırılarının bir hizmet reddi durumuna veya medya akışlarına ses veya video medyası eklenmesine yol açmasını önlemek için medya sunucusunda Güvenli SRTP kimlik doğrulamasının kontrol edildiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V17.2.4", - "Ordinal": 4, - "Description": "Verify that the media server is able to continue processing incoming media traffic when encountering malformed Secure Real-time Transport Protocol (SRTP) packets.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V17.2.5", - "Ordinal": 5, - "Description": "Medya sunucusunun, meşru kullanıcılardan gelen SRTP flood'ı sırasında gelen medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V17.2.6", - "Ordinal": 6, - "Description": "Medya sunucusunun DTLS içinde yer alan \"ClientHello\" yarış durumu güvenlik açığına karşı savunmasız olmadığı, medya sunucusunun güvenlik açığına sahip olduğunun açıkça bilinip bilinmediği kontrol edilerek veya yarış koşulu testi gerçekleştirilerek doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V17.2.7", - "Ordinal": 7, - "Description": "Medya sunucusuna bağlı ses veya video kayıt mekanizmalarının, meşru kullanıcı kaynaklı SRTP flood'ı sırasında medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V17.2.8", - "Ordinal": 8, - "Description": "DTLS sertifikasının, SDP (Session Description Protocol) fingerprint özelliği ile karşılaştırıldığı ve doğrulama başarısız olursa medya akışının sonlandırıldığı, medya akışının özgünlüğünü sağlamak için doğrulanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": false, - "Requirement": "" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - }, - { - "Shortcode": "V17.3", - "Ordinal": 3, - "Name": "Sinyalizasyon", - "Items": [ - { - "Shortcode": "V17.3.1", - "Ordinal": 1, - "Description": "Sinyalizasyon sunucusunun, flood saldırısı altında bile meşru sinyalizasyon mesajlarını işlemeye devam edebildiği doğrulanmalıdır. Bu, sinyalizasyon düzeyinde oran sınırlaması uygulanarak sağlanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - }, - { - "Shortcode": "V17.3.2", - "Ordinal": 2, - "Description": "Sinyalizasyon sunucusunun, hizmet reddine yol açabilecek şekilde yapılandırılmış bozuk sinyalizasyon mesajlarıyla karşılaştığında bile meşru mesajları işlemeye devam edebildiği doğrulanmalıdır. Bu, girdi doğrulaması, integer overflow ve buffer overflow'a karşı savunma ve sağlam hata işleme teknikleri ile sağlanmalıdır.", - "L1": { - "Required": false, - "Requirement": "" - }, - "L2": { - "Required": true, - "Requirement": "✓" - }, - "L3": { - "Required": true, - "Requirement": "✓" - }, - "CWE": [], - "NIST": [] - } - ] - } - ] - } - ] -} diff --git a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.xml b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.xml deleted file mode 100644 index cfd57f8eca..0000000000 --- a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.legacy.xml +++ /dev/null @@ -1 +0,0 @@ -Application Security Verification Standard ProjectASVSThe OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.V11EncodingKodlama (Encoding) ve TemizlemeV1.11Kodlama ve Temizleme MimarisiV1.1.11Girdinin yalnızca bir kez kanonik forma (canonical form) çözümlendiği veya kaçış işlemlerinin kaldırıldığı, bu işlemin yalnızca verinin bu biçimde beklenmesi durumunda yapıldığı ve bu işlemin girdi doğrulama veya temizleme işlemlerinden sonra değil, önce gerçekleştiği doğrulanmalıdır.FalseTrue✓True✓V1.1.22Uygulamanın, çıktıyı kullanılması gereken yorumlayıcıya verilmeden hemen önce veya yorumlayıcının kendisi tarafından çıktı kodlaması ya da kaçış işlemi yaptığı doğrulanmalıdır.FalseTrue✓True✓V1.22Enjeksiyon ÖnlemeV1.2.11HTTP yanıtı, HTML veya XML belgesi için yapılan çıktı kodlamasının; HTML elemanları, HTML öznitelikleri, HTML yorumları, CSS ya da HTTP başlık alanları gibi bağlamlara uygun olduğu doğrulanmalıdır. Böylece mesaj veya belge yapısının bozulması önlenir.True✓True✓True✓V1.2.22Dinamik olarak URL oluşturulurken, güvenilmeyen verinin bağlamına göre (örneğin, sorgu veya yol parametreleri için URL kodlaması ya da base64url kodlaması) kodlandığı doğrulanmalıdır. Yalnızca güvenli URL protokollerine izin verilmelidir (örneğin, javascript: veya data: yasaklanmalıdır).True✓True✓True✓V1.2.33JavaScript içeriği (JSON dahil) dinamik olarak oluşturulurken çıktı kodlama/kaçış kullanıldığı doğrulanmalıdır. Böylece mesaj veya belge yapısı değiştirilmemiş olur (JavaScript ve JSON enjeksiyonlarının önüne geçilir).True✓True✓True✓V1.2.44Veri sorguları veya veritabanı sorguları (SQL, HQL, NoSQL, Cypher vb.) için parametreli sorgular, ORM’ler, entity framework’ler kullanıldığı ya da SQL enjeksiyonu ve diğer veritabanı enjeksiyon saldırılarına karşı koruma sağlandığı doğrulanmalıdır. Bu durum, saklı yordam (stored procedure) yazarken de geçerlidir.True✓True✓True✓V1.2.55Uygulamanın işletim sistemi komut enjeksiyonlarına karşı korunduğu ve işletim sistemi çağrılarında parametreli OS sorguları veya bağlama özgü komut satırı çıktı kodlamasının kullanıldığı doğrulanmalıdır.True✓True✓True✓V1.2.66Uygulamanın LDAP enjeksiyon zafiyetlerine karşı korunduğu ya da LDAP enjeksiyonlarını önlemek için özel güvenlik kontrollerinin uygulandığı doğrulanmalıdır.FalseTrue✓True✓V1.2.77XPath enjeksiyon saldırılarına karşı, sorgu parametrelemesi veya önceden derlenmiş sorgular kullanılarak koruma sağlandığı doğrulanmalıdır.FalseTrue✓True✓V1.2.88LaTeX işlemcilerinin güvenli şekilde yapılandırıldığı (örneğin, --shell-escape bayrağının kullanılmadığı) ve yalnızca izin verilen komutlardan oluşan bir listeyle çalıştırıldığı doğrulanmalıdır.FalseTrue✓True✓V1.2.99Düzenli ifadelerde (regex) özel karakterlerin (genellikle ters eğik çizgi \ ile) kaçırılarak meta karakter olarak yorumlanmalarının önlendiği doğrulanmalıdır.FalseTrue✓True✓V1.2.1010Uygulamanın CSV ve formül enjeksiyonlarına karşı korunduğu doğrulanmalıdır. Uygulama, CSV içeriği dışa aktarırken RFC 4180 Bölüm 2.6 ve 2.7'de tanımlanan kaçış kurallarına uymalıdır. Ayrıca, CSV veya diğer tablo formatlarına (XLS, XLSX, ODF gibi) aktarım yapılırken, alanın ilk karakteri olarak çıkan özel karakterler ('=', '+', '-', '@', '\t' (sekme), '\0' (null karakter)) tek tırnak (') ile kaçırılmalıdır.FalseFalseTrue✓V1.33Temizleme (Sanitization)V1.3.11WYSIWYG editörlerinden veya benzer kaynaklardan gelen tüm güvenilmeyen HTML girdilerinin, bilinen ve güvenli bir HTML temizleme kütüphanesi ya da çerçeve özelliği ile temizlendiği doğrulanmalıdır.True✓True✓True✓V1.3.22Uygulamanın eval() veya Spring Expression Language (SpEL) gibi dinamik kod çalıştırma özelliklerini kullanmaktan kaçındığı doğrulanmalıdır. Alternatif yoksa, kullanıcı girdisi çalıştırılmadan önce mutlaka temizlenmelidir.True✓True✓True✓V1.3.33Potansiyel olarak tehlikeli bir bağlamda kullanılacak verilerin, bu bağlama uygun karakterlere izin vermek ve çok uzun girdileri kısaltmak gibi güvenlik önlemleriyle önceden temizlendiği doğrulanmalıdır.FalseTrue✓True✓V1.3.44Kullanıcı tarafından sağlanan SVG içeriğinin, yalnızca güvenli etiket ve özellikler (örneğin grafik çizme ile ilgili) içerdiğinden emin olmak için onaylandığı veya temizlendiği doğrulanmalıdır (ör. script veya foreignObject içermemelidir).FalseTrue✓True✓V1.3.55Markdown, CSS, XSL stil sayfaları, BBCode veya benzeri ifade şablon dillerinde kullanıcı girdisinin temizlendiği veya bu tür özelliklerin devre dışı bırakıldığı doğrulanmalıdır.FalseTrue✓True✓V1.3.66Uygulamanın, güvenilmeyen verileri başka servislere iletmeden önce izinli protokol, alan adı, yol ve port listelerine göre doğruladığı ve tehlikeli karakterleri temizlediği doğrulanarak SSRF (Sunucu Taraflı İstek Sahteciliği) saldırılarına karşı korunduğu doğrulanmalıdır.FalseTrue✓True✓V1.3.77Uygulamanın şablon enjeksiyon saldırılarına karşı, güvenilmeyen girdilere dayalı şablon oluşturmayı engellediği; eğer bu kaçınılmazsa, bu girdilerin mutlaka temizlendiği veya sıkı şekilde onaylandığı doğrulanmalıdır.FalseTrue✓True✓V1.3.88JNDI sorgularında kullanılmadan önce güvenilmeyen girdilerin temizlendiği ve JNDI'nin enjeksiyonlara karşı güvenli şekilde yapılandırıldığı doğrulanmalıdır.FalseTrue✓True✓V1.3.99Memcache’e gönderilmeden önce içeriğin temizlenerek enjeksiyon saldırılarına karşı korunduğu doğrulanmalıdır.FalseTrue✓True✓V1.3.1010Format dizgilerinin (format strings) beklenmeyen veya zararlı şekilde çözümlenmesini önlemek için işlenmeden önce temizlendiği doğrulanmalıdır.FalseTrue✓True✓V1.3.1111SMTP veya IMAP enjeksiyonlarını önlemek için, kullanıcı girdisinin posta sistemlerine iletilmeden önce temizlendiği doğrulanmalıdır.FalseTrue✓True✓V1.3.1212Regex girdilerinin üstel geri izlemeye (exponential backtracking) neden olan öğeler içermediği ve güvenilmeyen girdilerin ReDoS (Regex Denial of Service) gibi saldırılara karşı temizlendiği doğrulanmalıdır.FalseFalseTrue✓V1.44Bellek, Dizgi ve Yönetilmeyen KodV1.4.11Yığın, arabellek (buffer) veya yığın belleği taşmalarını önlemek ya da tespit etmek amacıyla, bellek güvenli dizgi işlemlerinin, daha güvenli bellek kopyalama ve işaretçi aritmetiğinin kullanıldığı doğrulanmalıdır.FalseTrue✓True✓V1.4.22Tamsayı taşmalarını önlemek için işaret (sign), aralık (range) ve giriş doğrulama tekniklerinin kullanıldığı doğrulanmalıdır.FalseTrue✓True✓V1.4.33Dinamik olarak ayrılan belleğin ve kaynakların serbest bırakıldığı ve boşaltılan belleklere ait referansların veya işaretçilerin kaldırıldığı veya null yapıldığı doğrulanmalıdır (dangling pointer ve use-after-free zafiyetlerine karşı).FalseTrue✓True✓V1.55Güvenli Ters Serileştirme (Safe Deserialization)V1.5.11XML ayrıştırıcılarının (parser) kısıtlayıcı şekilde yapılandırıldığı ve dış varlık çözümleme (external entity resolution) gibi güvensiz özelliklerin XXE (XML eXternal Entity) saldırılarına karşı devre dışı bırakıldığı doğrulanmalıdır .True✓True✓True✓V1.5.22Güvenilmeyen verilerin ters serileştirilmesinde, nesne türleri için izinli liste kullanımı veya istemci tanımlı nesne türlerinin kısıtlanması gibi güvenli giriş işleme önlemlerinin uygulandığı doğrulanmalıdır. Güvensiz olarak tanımlanmış ters serileştirme mekanizmaları, güvenilmeyen girdilerle kullanılmamalıdır.FalseTrue✓True✓V1.5.33Aynı veri türü için uygulamada kullanılan farklı parser'ların (ör. JSON, XML, URL parser'ları), veriyi tutarlı şekilde ayrıştırdığı ve aynı karakter kodlamasını kullandığı doğrulanmalıdır. Böylece JSON birlikte çalışabilirlik açıkları, URI veya dosya ayrıştırma farkları gibi sorunlar nedeniyle RFI veya SSRF saldırılarının istismar edilmesi önlenir.FalseFalseTrue✓V22ValidationDoğrulama ve İş MantığıV2.11Doğrulama ve İş Mantığı DokümantasyonuV2.1.11Uygulama dokümantasyonunda, veri öğelerinin beklenen yapıya göre nasıl doğrulanacağına ilişkin giriş doğrulama kurallarının tanımlandığı doğrulanmalıdır. Bu; kredi kartı numaraları, e-posta adresleri, telefon numaraları gibi yaygın veri biçimleri olabileceği gibi iç sistemlere özel biçimler de olabilir.True✓True✓True✓V2.1.22Uygulama dokümantasyonunda, birleştirilmiş veri öğelerinin mantıksal ve bağlamsal tutarlılığının nasıl doğrulanacağı tanımlanmalıdır (örneğin, mahalle ve posta kodunun eşleşip eşleşmediğinin kontrolü).FalseTrue✓True✓V2.1.33Hem kullanıcı bazında hem de uygulama genelinde geçerli olacak şekilde, iş mantığı sınırları ve doğrulama beklentilerinin belgelendiği doğrulanmalıdır.FalseTrue✓True✓V2.22Girdi DoğrulamaV2.2.11Girdilerin, işlevsel ya da iş gereksinimlerine uygunluğunun doğrulandığı teyit edilmelidir. Bu işlem; izinli değerler, desenler ve aralıklar listesine karşı pozitif doğrulama ile ya da girdinin beklenen yapıya ve mantıksal sınırlara uygunluğunun önceden tanımlanmış kurallara göre karşılaştırılması ile yapılmalıdır. Seviye 1 için bu, güvenlik veya iş kararlarında kullanılan girdilere odaklanabilir. Seviye 2 ve üstü için tüm girdilere uygulanmalıdır.True✓True✓True✓V2.2.22Uygulamanın, güvenilir bir servis katmanında girdi doğrulama zorunluluğu uygulayacak şekilde tasarlandığı doğrulanmalıdır. İstemci tarafında gerçekleştirilen doğrulama, kullanılabilirliği artırabilir ve teşvik edilmelidir. Ancak bu doğrulama,güvenlik kontrolü olarak kabul edilmemelidir.True✓True✓True✓V2.2.33Uygulamanın, ilişkili veri öğelerinin önceden tanımlanmış kurallara göre makul olup olmadığını kontrol ettiği doğrulanmalıdır.FalseTrue✓True✓V2.33İş Mantığı GüvenliğiV2.3.11Uygulamanın, aynı kullanıcı için iş mantığı akışlarını yalnızca beklenen adım sırasına göre ve adım atlamadan işlediği doğrulanmalıdır.True✓True✓True✓V2.3.22İş mantığı sınırlarının, uygulama dokümantasyonuna uygun şekilde uygulandığı doğrulanmalıdır.FalseTrue✓True✓V2.3.33İş mantığı seviyesinde işlemlerin (transaction) kullanıldığı ve bir iş mantığı işleminin ya bütünüyle başarıyla tamamlandığı ya da önceki geçerli duruma geri döndürüldüğü (rollback) doğrulanmalıdır.FalseTrue✓True✓V2.3.44İş mantığı düzeyinde kilitleme mekanizmalarının, sınırlı kaynakların (ör. sinema koltukları, teslimat zamanları) uygulamanın mantığı manipüle edilerek çift rezervasyona neden olmamasını sağladığı doğrulanmalıdır.FalseTrue✓True✓V2.3.55Yüksek değerli iş mantığı akışlarının, yetkisiz veya kazara gerçekleşebilecek işlemleri önlemek için çoklu kullanıcı onayı gerektirdiği doğrulanmalıdır. Bu işlemler büyük para transferleri, sözleşme onayları, gizli bilgilere erişim veya üretimde güvenlik kurallarının geçersiz kılınmaları gibi durumları içerebilir.FalseFalseTrue✓V2.44Otomasyon Karşıtı ÖnlemlerV2.4.11Uygulama işlevlerine yönelik aşırı miktardaki çağrılara karşı; veri sızdırma, anlamsız veri üretme, kota tüketme, hız sınırının aşılması, hizmet reddi (DoS) ya da maliyetli kaynakların aşırı kullanımı gibi risklere karşı otomasyon karşıtı kontrollerin bulunduğu doğrulanmalıdır.FalseTrue✓True✓V2.4.22İş mantığı akışlarının, aşırı hızlı işlem gönderimlerini önleyecek şekilde gerçekçi insan zamanlaması gerektirdiği doğrulanmalıdır.FalseFalseTrue✓V33WebWeb Ön Uç (Frontend) GüvenliğiV3.11Web Frontend Güvenlik DokümantasyonuV3.1.11Uygulama dokümantasyonunda, uygulamayı kullanan tarayıcıların desteklemesi gereken güvenlik özelliklerinin (ör. HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) ve diğer ilgili HTTP güvenlik mekanizmaları) tanımlandığı doğrulanmalıdır. Ayrıca bu özelliklerin mevcut olmadığı durumlarda uygulamanın nasıl davranması gerektiği (ör. kullanıcıyı uyarmak veya erişimi engellemek) de tanımlanmalıdır.FalseFalseTrue✓V3.22İçeriğin Yanlış YorumlanmasıV3.2.11Tarayıcıların HTTP yanıtlarında içerik veya işlevi yanlış bir bağlamda sunmalarını önlemek amacıyla güvenlik kontrollerinin uygulandığı doğrulanmalıdır (ör. API, kullanıcı tarafından yüklenen dosya veya başka bir kaynağın doğrudan çağrılması durumunda). Olası kontroller arasında; yalnızca HTTP istek başlıklarının (ör. Sec-Fetch-\*) doğru bağlamı gösterdiği durumlarda içeriğin sunulması, Content-Security-Policy başlığında "sandbox" yönergesinin kullanılması veya Content-Disposition başlığında "attachment" biçiminin kullanılması yer alabilir.True✓True✓True✓V3.2.22HTML yerine metin olarak görüntülenmesi amaçlanan içeriğin, HTML veya JavaScript gibi içeriklerin istenmeden çalıştırılmasını önleyecek şekilde "createTextNode" veya "textContent" gibi güvenli işleme fonksiyonlarıyla işlendiği doğrulanmalıdır.True✓True✓True✓V3.2.33Uygulamanın istemci tarafı JavaScript kullanırken açık değişken tanımlamaları yaparak, sıkı tür kontrolü uygulayarak, global değişkenleri document nesnesine kaydetmekten kaçınarak ve ad alanı izolasyonu sağlayarak DOM clobbering’den kaçındığı doğrulanmalıdır.FalseFalseTrue✓V3.33Çerez YapılandırmasıV3.3.11Çerezlerin 'Secure' niteliğine sahip olduğu ve eğer çerez adı '\__Host-' ön eki ile başlamıyorsa, '__Secure-' ön ekinin kullanıldığı doğrulanmalıdır.True✓True✓True✓V3.3.22Kullanıcı arayüzü kandırma saldırılarına ve tarayıcı tabanlı istek sahteciliği saldırılarına (CSRF) karşı koruma sağlamak amacıyla, her çerezin 'SameSite' niteliğinin kullanım amacına uygun şekilde ayarlandığı doğrulanmalıdır.FalseTrue✓True✓V3.3.33Çerez adı, diğer sunucularla paylaşılmak üzere açıkça tasarlanmadığı sürece '__Host-' ön eki ile tanımlanmalıdır.FalseTrue✓True✓V3.3.44Bir çerez değeri istemci tarafı betikleri tarafından erişilememesi gereken bir veri içeriyorsa (ör. oturum token'ı), çerezin 'HttpOnly' niteliğine sahip olduğu ve aynı değerin (ör. oturum token'ı) yalnızca 'Set-Cookie' başlığı ile istemciye iletildiği doğrulanmalıdır.FalseTrue✓True✓V3.3.55Uygulama bir çerez oluştururken, çerez adı ve değerinin toplam uzunluğunun 4096 baytı aşmadığı doğrulanmalıdır. Çok büyük çerezler tarayıcı tarafından saklanmaz ve isteklerle gönderilmez; bu da çereze bağlı çalışan uygulama işlevlerinin bozulmasına yol açabilir.FalseFalseTrue✓V3.44Tarayıcı Güvenlik Mekanizması Başlıkları (Header)V3.4.22Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header'ı, uygulama tarafından sabit bir değer olarak tanımlanmalı veya gelen Origin header değeri güvenilir origin’lerden oluşan bir izinli listeye karşı doğrulanmalıdır. ‘Access-Control-Allow-Origin: *’ kullanılması gerekiyorsa, yanıtın hassas bilgi içermediği doğrulanmalıdır.True✓True✓True✓V3.4.33HTTP yanıtlarında Content-Security-Policy header'ı bulunduğu ve bu header'ın yalnızca güvenilen içeriklerin veya kaynakların yüklenmesini ve çalıştırılmasını sağlayan yönergeler içerdiği doğrulanmalıdır. Minimum olarak "global policy", object-src 'none', base-uri 'none' yönergelerini içermeli ve izinli liste, nonce veya hash temelli bir yapı içermelidir. Seviye 3 uygulamalarında her yanıt için nonce veya hash içeren özel bir politika tanımlanmalıdır.FalseTrue✓True✓V3.4.44Tüm HTTP yanıtlarının 'X-Content-Type-Options: nosniff' header'ını içerdiği doğrulanmalıdır. Bu, tarayıcıya içerik türünü tahmin etmeyi bırakmasını ve yanıtın Content-Type header'ında belirtilen MIME türünün, beklenen kaynak türüyle eşleşmesini zorunlu kılar. Ayrıca bu, tarayıcıda CORB (Cross-Origin Read Blocking) özelliğini etkinleştirir.FalseTrue✓True✓V3.4.55Uygulamanın, 'Referer' başlığı yoluyla üçüncü taraflara teknik olarak hassas verilerin sızmasını önlemek için bir 'referrer policy' belirlediği doğrulanmalıdır. Bu, Referrer-Policy HTTP header'ıyla veya HTML öğe nitelikleriyle (element attributes) sağlanabilir. Sızabilecek hassas bilgiler, URL’deki yol ve sorgu parametreleri ile sınırlı uygulamalarda hostname bilgisini içerebilir.FalseTrue✓True✓V3.4.66Uygulamanın, Content-Security-Policy header'ı altında 'frame-ancestors' yönergesini her HTTP yanıtında tanımladığı ve bu sayede içeriklerin varsayılan olarak başka sayfalara gömülmesini engellediği doğrulanmalıdır. Gerekli durumlarda özel olarak izin verildiğinden emin olunmalıdır. 'X-Frame-Options' header'ı, tarayıcılar tarafından desteklenmesine rağmen, artık güncel değildir ve güvenlik amacıyla kullanılmamalıdır.FalseTrue✓True✓V3.4.88Bir belgenin işlenmesini ve sunulmasını başlatan tüm HTTP yanıtlarında (örneğin 'text/html' tipi yanıtlar), 'Cross-Origin-Opener-Policy' header'ı 'same-origin' veya 'same-origin-allow-popups' yönergeleriyle birlikte yer almalıdır. Bu, tabnabbing ve frame counting gibi, pencere nesnelerine paylaşımlı erişimi sömüren saldırılara karşı koruma sağlar.FalseFalseTrue✓V3.55Tarayıcı Menşei AyırımıV3.5.11Uygulama, hassas işlevselliğe yönelik izinsiz cross-origin istekleri önlemek için CORS preflight mekanizmasına güvenmiyorsa, bu tür isteklerin gerçekten uygulamadan geldiği doğrulanmalıdır. Bu, anti-forgery token kullanımı veya CORS tarafından güvenli kabul edilmeyen özel HTTP header'larının zorunlu kılınmasıyla yapılabilir. Bu, tarayıcı tabanlı istek sahteciliği (CSRF) saldırılarına karşı bir savunmadır.True✓True✓True✓V3.5.22Uygulama, hassas işlevlerin izinsiz cross-origin çağrılmasını önlemek için CORS preflight mekanizmasına güveniyorsa, bu işlevlerin bir CORS-preflight isteğini tetiklemeden çağrılamadığı doğrulanmalıdır. Bu, 'Origin' ve 'Content-Type' header'larının doğrulanmasını veya CORS-safelisted olmayan bir header'ın ve alanın kullanılmasını gerektirebilir.True✓True✓True✓V3.5.44Farklı uygulamaların farklı hostname'lerde barındırıldığı ve böylece Same-Origin Policy tarafından sağlanan kısıtlamalardan (örneğin çerez erişim sınırları, kaynaklar arası etkileşim kontrolleri) faydalanıldığı doğrulanmalıdır.FalseTrue✓True✓V3.5.66Uygulamanın herhangi bir yerinde JSONP işlevselliğinin etkin olmadığı doğrulanmalıdır. Bu, XSSI (Cross-Site Script Inclusion) saldırılarını önlemek içindir.FalseFalseTrue✓V3.5.77Yetkilendirme gerektiren verilerin, JavaScript dosyaları gibi betik kaynaklarının yanıtlarında yer almadığı, XSSI saldırılarını önlemek için doğrulanmalıdır.FalseFalseTrue✓V3.5.88Kimliği doğrulanmış kaynakların (örneğin görseller, videolar, betikler ve belgeler) yalnızca gerçekten amaçlandığında kullanıcı adına yüklenebildiği veya gömülebildiği doğrulanmalıdır. Bu, isteğin uygun olmayan bir çapraz kaynak çağrısından kaynaklanmadığından emin olmak için Sec-Fetch-* HTTP istek başlığı alanlarının sıkı bir şekilde doğrulanmasıyla veya tarayıcıya döndürülen içeriği engelleme talimatı vermek için kısıtlayıcı bir Cross-Origin-Resource-Policy HTTP yanıt başlığı alanı ayarlayarak gerçekleştirilebilir.FalseFalseTrue✓V3.66Harici Kaynak BütünlüğüV3.6.11JavaScript kütüphaneleri, CSS veya web fontları gibi istemci tarafı varlıkların yalnızca statik ve sürümlü olması, varlığın bütünlüğünü doğrulamak için Subresource Integrity (SRI) kullanılması durumunda harici olarak (örneğin, bir İçerik Dağıtım Ağı üzerinde) barındırıldığı doğrulanmalıdır. Bu mümkün değilse, her bir kaynak için bunu gerekçelendiren belgelenmiş bir güvenlik kararı bulunmalıdır.FalseFalseTrue✓V3.77Diğer Tarayıcı Güvenliği HususlarıV3.7.11Uygulamanın yalnızca hâlâ desteklenen ve güvenli kabul edilen istemci tarafı teknolojileri kullandığı doğrulanmalıdır. Bu gereksinimi karşılamayan teknolojilere örnek olarak NSAPI eklentileri, Flash, Shockwave, ActiveX, Silverlight, NACL veya istemci tarafı Java applet’leri verilebilir.FalseTrue✓True✓V3.7.22Uygulamanın, yalnızca hedef adres bir izinli listede yer alıyorsa kullanıcıyı otomatik olarak farklı bir ana makine adına veya uygulamanın kontrolünde olmayan bir etki alanına yönlendirdiği doğrulanmalıdır.FalseTrue✓True✓V3.7.33Uygulamanın, kullanıcı uygulamanın kontrolü dışındaki bir URL’ye yönlendirildiğinde, yönlendirme hakkında bir bildirim gösterdiği ve kullanıcının bu gezintiyi iptal edebilmesi için bir seçenek sunduğu doğrulanmalıdır.FalseFalseTrue✓V3.7.44Uygulamanın en üst düzey etki alanının (örneğin, site.tld) HTTP Strict Transport Security (HSTS) için genel preload listesine eklendiği doğrulanmalıdır. Bu, uygulamanın TLS kullanımının ana tarayıcılar tarafından doğrudan tanınmasını ve yalnızca Strict-Transport-Security yanıt header'ına bağlı kalınmamasını sağlar.FalseFalseTrue✓V3.7.55Uygulamaya erişen tarayıcının beklenen güvenlik özelliklerini desteklememesi durumunda, uygulamanın dokümantasyona uygun şekilde davrandığı (örneğin kullanıcıyı uyarma veya erişimi engelleme) doğrulanmalıdır.FalseFalseTrue✓V44APIAPI ve Web ServisiV4.11Genel Web Servisi GüvenliğiV4.1.11İleti gövdesi içeren her HTTP yanıtında, yanıtın gerçek içeriğiyle eşleşen bir Content-Type header alanı bulunduğu ve güvenli karakter kodlamasını (örneğin, UTF-8, ISO-8859-1) belirtmek üzere charset parametresi içerdiği doğrulanmalıdır. Bu işlem, IANA Medya Türleri'nden "text/", "/+xml" ve "/xml" gibi içerikler için geçerlidir.True✓True✓True✓V4.1.22Yalnızca kullanıcı arayüzüne yönelik uç noktaların (manuel olarak web tarayıcısı ile erişilmesi amaçlanan) otomatik olarak HTTP'den HTTPS'e yönlendirme yaptığı ve diğer hizmetlerin veya uç noktaların şeffaf yönlendirme gerçekleştirmediği doğrulanmalıdır. Bu, istemcinin farkında olmadan şifrelenmemiş HTTP istekleri göndermesi ve bu isteklerin otomatik olarak HTTPS'e yönlendirilmesi sonucunda hassas verilerin sızmasının fark edilmemesi riskini önlemek içindir.FalseTrue✓True✓V4.1.33Uygulama tarafından kullanılan ve yük dengeleyici, web proxy veya frontend için backend hizmeti gibi bir ara katman tarafından ayarlanan herhangi bir HTTP başlık alanının, son kullanıcı tarafından geçersiz kılınamayacağı doğrulanmalıdır. Örnek başlıklar arasında X-Real-IP, X-Forwarded-* veya X-User-ID yer alabilir.FalseTrue✓True✓V4.1.44Uygulama veya API tarafından açıkça desteklenen HTTP yöntemlerinin (preflight istekleri sırasında OPTIONS dahil) dışında hiçbir yöntemin kullanılmadığı ve kullanılmayan yöntemlerin engellendiği doğrulanmalıdır.FalseFalseTrue✓V4.1.55Çok hassas istekler veya birçok sistemden geçen işlemler için, taşıma katmanı güvenliğinin üzerine ek bir güvence sağlamak amacıyla, her iletiye özel dijital imzaların kullanıldığı doğrulanmalıdır.FalseFalseTrue✓V4.22HTTP İleti Yapısı DoğrulamaV4.2.11Tüm uygulama bileşenlerinin (yük dengeleyiciler, güvenlik duvarları ve uygulama sunucuları dahil) HTTP sürümüne uygun mekanizmaları kullanarak gelen HTTP iletilerinin sınırlarını belirlediği ve bu sayede HTTP istek kaçakçılığına karşı koruma sağlandığı doğrulanmalıdır. HTTP/1.x sürümünde Transfer-Encoding başlık alanı varsa, RFC 2616'ya göre Content-Length başlığı göz ardı edilmelidir. HTTP/2 veya HTTP/3 kullanıldığında, Content-Length başlığı varsa, alıcının bu değerin DATA çerçevelerinin uzunluğuyla tutarlı olduğunu doğrulaması gerekir.FalseTrue✓True✓V4.2.22HTTP iletileri üretilirken, Content-Length başlığının, HTTP protokolünün çerçeveleme yöntemine göre belirlenen içerik uzunluğu ile çelişmediği doğrulanmalıdır. Bu, istek kaçakçılığı saldırılarını önlemek için gereklidir.FalseFalseTrue✓V4.2.33Uygulamanın, yanıt bölme ve header enjeksiyonu saldırılarını önlemek amacıyla, bağlantıya özel başlık alanları (örneğin Transfer-Encoding) içeren HTTP/2 veya HTTP/3 iletilerini göndermediği ve kabul etmediği doğrulanmalıdır.FalseFalseTrue✓V4.2.44Uygulamanın yalnızca başlık alanları ve değerleri CR (\r), LF (\n) veya CRLF (\r\n) karakter dizileri içermeyen HTTP/2 ve HTTP/3 isteklerini kabul ettiği doğrulanmalıdır. Bu, başlık enjeksiyonu saldırılarını önlemek içindir.FalseFalseTrue✓V4.2.55Uygulama (backend veya frontend) istek oluşturuyor ve gönderiyorsa, URI'ler (örneğin API çağrıları için) veya HTTP istek başlıkları (örneğin Authorization veya Cookie) gibi bileşenlerin, alıcı sistemler tarafından kabul edilemeyecek kadar uzun olmamasını sağlamak amacıyla doğrulama, temizleme veya diğer mekanizmaları kullandığı doğrulanmalıdır. Bu tür çok uzun istekler (örneğin çok uzun bir Cookie başlığı) gönderildiğinde sunucunun sürekli hata durumu döndürmesiyle hizmet reddi oluşabilir.FalseFalseTrue✓V4.33GraphQLV4.3.11Maliyetli ve iç içe geçmiş sorgular sonucu oluşabilecek GraphQL veya veri katmanı ifadelerine yönelik Hizmet Reddi (DoS) saldırılarını önlemek için, sorgu izin listesi (allowlist), derinlik sınırlandırması, sorgu sayısı sınırlandırması veya sorgu maliyeti analizi kullanıldığı doğrulanmalıdır.FalseTrue✓True✓V4.3.22GraphQL introspection (iç yapı sorgulama) sorgularının, GraphQL API'nin üçüncü taraflar tarafından kullanılmasına yönelik olmadığı sürece, üretim ortamında devre dışı bırakıldığı doğrulanmalıdır.FalseTrue✓True✓V4.44WebSocketV4.4.11Tüm WebSocket bağlantılarında TLS üzerinden WebSocket (WSS) kullanıldığı doğrulanmalıdır.True✓True✓True✓V4.4.22WebSocket'in başlangıçtaki HTTP el sıkışması (handshake) sırasında, Origin başlık alanının uygulama için izin verilen origin listesiyle karşılaştırılarak kontrol edildiği doğrulanmalıdır.FalseTrue✓True✓V4.4.33Uygulamanın standart oturum yönetimi kullanılamıyorsa, bunun yerine ilgili Oturum Yönetimi güvenlik gereksinimlerine uygun özel token'ların kullanıldığı doğrulanmalıdır.FalseTrue✓True✓V4.4.44HTTPS oturumu WebSocket kanalına geçerken, özel WebSocket oturum yönetim token’larının önceki şekilde kimliği doğrulanmış HTTPS oturumu aracılığıyla elde edildiği veya doğrulandığı doğrulanmalıdır.FalseTrue✓True✓V55FileDosya İşlemeV5.11Dosya İşleme DokümantasyonuV5.1.11Dokümantasyonun, her yükleme özelliği için izin verilen dosya türlerini, beklenen dosya uzantılarını ve maksimum boyutu (açılmış hali dahil) tanımladığı doğrulanmalıdır. Ayrıca, dosyaların son kullanıcılar için nasıl güvenli hâle getirileceği (örneğin kötü amaçlı bir dosya tespit edildiğinde uygulamanın nasıl davranacağı) gibi bilgilerin de belgede yer aldığı doğrulanmalıdır.FalseTrue✓True✓V5.22Dosya Yükleme ve İçerikV5.2.11Uygulamanın, yalnızca performans kaybına veya hizmet reddine yol açmayacak boyuttaki dosyaları kabul ettiği doğrulanmalıdır.True✓True✓True✓V5.2.22Uygulama bir dosyayı, doğrudan veya bir arşiv (ör. zip dosyası) içinde kabul ettiğinde, dosya uzantısının beklenen uzantıyla eşleşip eşleşmediğini kontrol ettiği ve içeriğin uzantı tarafından temsil edilen türle uyumlu olduğunu doğruladığı kontrol edilmelidir. Bu; ilk 'magic byte' kontrolü, görüntü yeniden yazımı ve dosya içeriği doğrulama için özel kütüphanelerin kullanımı gibi yöntemleri içerir. Seviye 1 için bu, yalnızca iş veya güvenlik kararlarında kullanılan dosyalarla sınırlı olabilir. Seviye 2 ve üzeri için tüm dosyalar bu kontrole tabi olmalıdır.True✓True✓True✓V5.2.33Sıkıştırılmış dosyaların (ör. zip, gz, docx, odt) açılmadan önce, izin verilen maksimum açılmış boyuta ve maksimum dosya sayısına göre kontrol edildiği doğrulanmalıdır.FalseTrue✓True✓V5.2.44Her kullanıcı için dosya boyutu kotası ve maksimum dosya sayısının uygulandığı doğrulanmalıdır. Böylece tek bir kullanıcının çok sayıda veya aşırı büyük dosya yükleyerek depolama alanını doldurması engellenir.FalseFalseTrue✓V5.2.55Uygulamanın, içinde sembolik bağlantılar (symlink) bulunan sıkıştırılmış dosyaların yüklenmesine yalnızca bu durum özel olarak gerekli olduğunda izin verdiği doğrulanmalıdır. Bu durumda, sembolik bağlantı verilebilecek dosyaların bir izinli listesi uygulanmalıdır.FalseFalseTrue✓V5.2.66Uygulamanın, piksel boyutu izin verilen maksimum değeri aşan görüntü dosyalarının yüklenmesini reddettiği doğrulanmalıdır. Bu, pixel flood saldırılarını önlemek için gereklidir.FalseFalseTrue✓V5.33Dosya DepolamaV5.3.11Güvenilmeyen girdilerle yüklenen veya oluşturulan ve herkese açık klasörlerde depolanan dosyaların, bir HTTP isteğiyle doğrudan erişildiğinde sunucu taraflı program kodu olarak çalıştırılmadığı doğrulanmalıdır.True✓True✓True✓V5.3.22Uygulamanın, dosya işlemleri için dosya yollarını oluştururken kullanıcı tarafından gönderilen dosya adlarını değil, dahili olarak oluşturulan veya güvenilir verileri kullandığı; eğer kullanıcı tarafından gönderilen dosya adları veya meta veriler kullanılacaksa, sıkı doğrulama ve temizleme işlemlerinin uygulandığı doğrulanmalıdır. Bu, yol geçişi (path traversal), yerel veya uzak dosya dahil etme (LFI, RFI) ve sunucu tarafı istek sahteciliği (SSRF) saldırılarına karşı koruma sağlar.True✓True✓True✓V5.3.33Sunucu tarafında gerçekleşen dosya işlemlerinin (örneğin dosya açma/decompress işlemi), kullanıcı tarafından sağlanan yol bilgilerini yok saydığı ve zip slip gibi güvenlik açıklarını önlediği doğrulanmalıdır.FalseFalseTrue✓V5.44Dosya İndirmeV5.4.11Uygulamanın, kullanıcı tarafından gönderilen dosya adlarını (ör. JSON, JSONP veya URL parametresinde) doğruladığı veya göz ardı ettiği ve yanıtın Content-Disposition başlık alanında bir dosya adı belirttiği doğrulanmalıdır.FalseTrue✓True✓V5.4.22Sunulan dosya adlarının (örneğin HTTP yanıt header'larında veya e-posta eklerinde), belge yapısını korumak ve enjeksiyon saldırılarını önlemek için kodlandığı veya temizlendiği (ör. RFC 6266’ya uygun) doğrulanmalıdır.FalseTrue✓True✓V5.4.33Güvenilmeyen kaynaklardan elde edilen dosyaların, bilinen kötü amaçlı içeriklerin sunulmasını önlemek amacıyla antivirüs tarayıcılarıyla tarandığı doğrulanmalıdır.FalseTrue✓True✓V66AuthenticationKimlik DoğrulamaV6.11Kimlik Doğrulama DokümantasyonuV6.1.11Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırılarına karşı oran sınırlama (rate limiting), otomasyon karşıtı önlemler ve uyarlanabilir yanıt gibi kontrollerin nasıl kullanıldığını açıklayan bir uygulama dokümantasyonu bulunduğu doğrulanmalıdır. Dokümantasyon, bu kontrollerin nasıl yapılandırıldığını ve kötü niyetli hesap kilitlemenin nasıl önlendiğini açıkça ortaya koymalıdır.True✓True✓True✓V6.1.22Parolalarda kullanılmasını önlemek amacıyla, bağlama özgü sözcüklerin (örneğin kurum adlarının permütasyonları, ürün adları, sistem tanımlayıcıları, proje kod adları, departman veya rol adları vb.) bulunduğu belgelenmiş bir liste mevcut olduğu doğrulanmalıdır.FalseTrue✓True✓V6.1.33Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, bunların tümünün belgelenmiş olduğu ve her yol için tutarlı şekilde uygulanması gereken güvenlik kontrolleri ile kimlik doğrulama gücünün tanımlandığı doğrulanmalıdır.FalseTrue✓True✓V6.22Parola GüvenliğiV6.2.11Kullanıcı tarafından belirlenen parolaların en az 8 karakter uzunluğunda olması sağlanmalı, ancak 15 karakter ve üzeri uzunlukta parolalar olmaları şiddetle tavsiye edilir.True✓True✓True✓V6.2.22Kullanıcıların parolalarını değiştirebilmeleri sağlanmalıdır.True✓True✓True✓V6.2.33Parola değiştirme işlevinin hem mevcut hem de yeni parolayı gerektirdiği doğrulanmalıdır.True✓True✓True✓V6.2.44Kayıt veya parola değişimi sırasında girilen parolaların, uygulamanın parola politikasına (örneğin minimum uzunluk) uyan ilk 3000 yaygın parolaya karşı kontrol edildiği doğrulanmalıdır.True✓True✓True✓V6.2.55Her tür karakterin kullanılmasına izin verildiği ve büyük/küçük harf, sayı veya özel karakter şartlarının zorunlu tutulmadığı doğrulanmalıdır.True✓True✓True✓V6.2.66Parola giriş alanlarının, girdiyi maskelemek için "type=password" kullandığı doğrulanmalıdır. Uygulamalar, kullanıcının tüm maskelenmiş parolayı ya da son girilen karakteri geçici olarak görüntülemesine izin verebilir.True✓True✓True✓V6.2.77"Yapıştır" özelliğinin, tarayıcı parola yardımcılarının ve harici parola yöneticilerinin kullanımına izin verildiği doğrulanmalıdır.True✓True✓True✓V6.2.88Uygulamanın, kullanıcıdan aldığı parolayı herhangi bir şekilde değiştirmeden, örneğin kesmeden veya harf büyüklüğünü değiştirmeden, tam olarak doğruladığı teyit edilmelidir.True✓True✓True✓V6.2.99En az 64 karakter uzunluğundaki parolalara izin verildiği doğrulanmalıdır.FalseTrue✓True✓V6.2.1010Kullanıcının parolasının, yalnızca ele geçirildiği tespit edildiğinde veya kullanıcı tarafından yenilendiğinde geçerliliğini yitirdiği doğrulanmalıdır. Uygulama, belirli aralıklarla parola yenilenmesini zorunlu kılmamalıdır.FalseTrue✓True✓V6.2.1111Tahmin edilmesi kolay parolaların oluşturulmasını önlemek amacıyla, bağlama özgü kelimelerin yer aldığı belgelenmiş listenin parola doğrulamada kullanıldığı teyit edilmelidir.FalseTrue✓True✓V6.2.1212Kayıt veya parola değişikliği sırasında girilen parolaların, ele geçirilmiş parolalar listesine karşı kontrol edildiği doğrulanmalıdır.FalseTrue✓True✓V6.33Genel Kimlik Doğrulama GüvenliğiV6.3.11Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırıları gibi saldırıları önlemeye yönelik kontrollerin, uygulamanın güvenlik dokümantasyonuna göre uygulandığı doğrulanmalıdır.True✓True✓True✓V6.3.22"root", "admin" veya "sa" gibi varsayılan kullanıcı hesaplarının uygulamada yer almadığı veya devre dışı bırakıldığı doğrulanmalıdır.True✓True✓True✓V6.3.33Uygulamaya erişim için ya çok faktörlü bir kimlik doğrulama mekanizması ya da tek faktörlü mekanizmaların kombinasyonu kullanılmalıdır. Seviye 3 için, bu faktörlerden biri, oltalama saldırılarına karşı direnç sağlayan ve kimlik doğrulama niyetini bir kullanıcı etkileşimi (örneğin FIDO donanım anahtarında bir düğmeye basma veya mobil telefonda bir onay) gerektirerek doğrulayan donanım tabanlı bir kimlik doğrulayıcı olmalıdır. Bu gereksinimdeki herhangi bir esneklik için, gerekçesi belgelenmiş ve riskleri azaltıcı kapsamlı kontroller içeren bir plan gereklidir.FalseTrue✓True✓V6.3.44Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, belgelendirilmemiş bir yol bulunmadığı ve tüm yollar için güvenlik kontrolleri ile kimlik doğrulama gücünün tutarlı şekilde uygulandığı doğrulanmalıdır.FalseTrue✓True✓V6.3.55Başarılı veya başarısız şüpheli kimlik doğrulama girişimlerinin kullanıcıya bildirildiği doğrulanmalıdır. Bu, olağandışı bir konum veya istemciden gelen girişimler, yalnızca bir faktörle yapılan kısmen başarılı doğrulamalar, uzun süreli inaktiflik sonrası yapılan girişimler veya birçok başarısız denemeden sonraki başarılı girişimler gibi durumları içerebilir.FalseFalseTrue✓V6.3.66E-postanın, tek faktörlü ya da çok faktörlü kimlik doğrulama mekanizması olarak kullanılmadığı doğrulanmalıdır.FalseFalseTrue✓V6.3.77Kimlik doğrulama detaylarında yapılan güncellemeler sonrasında (örneğin kimlik bilgisi sıfırlama, kullanıcı adı veya e-posta adresi değişiklikleri), kullanıcıların bilgilendirildiği doğrulanmalıdır.FalseFalseTrue✓V6.3.88Başarısız kimlik doğrulama girişimlerinden, geçerli kullanıcıların hata mesajları, HTTP yanıt kodları veya farklı yanıt süreleri gibi sonuçlara dayanarak tespit edilemediği doğrulanmalıdır. Bu koruma, kayıt ve "parolamı unuttum" işlevselliğinde de geçerli olmalıdır.FalseFalseTrue✓V6.44Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve KurtarmaV6.4.11Sistem tarafından oluşturulan ilk parolaların veya etkinleştirme kodlarının güvenli bir şekilde rastgele üretildiği, mevcut parola politikasına uygun olduğu, kısa bir süre içinde veya ilk kullanım sonrasında geçerliliğini yitirdiği doğrulanmalıdır. Bu başlangıç sırları uzun vadeli parola olarak kullanılmasına izin verilmemelidir.True✓True✓True✓V6.4.22Parola ipuçlarının veya "gizli sorular" olarak bilinen, bilgiye dayalı kimlik doğrulama mekanizmalarının mevcut olmadığı doğrulanmalıdır.True✓True✓True✓V6.4.33Unutulmuş parolanın sıfırlanması için, etkin olan çok faktörlü kimlik doğrulama mekanizmalarını atlamayan güvenli bir sürecin uygulandığı doğrulanmalıdır.FalseTrue✓True✓V6.4.44Çok faktörlü kimlik doğrulama faktörlerinden biri kaybolursa, kayıt sırasında uygulanan kimlik kanıtlama seviyesiyle aynı seviyede kimlik doğrulama yapıldığı doğrulanmalıdır.FalseTrue✓True✓V6.4.55Süresi dolacak kimlik doğrulama mekanizmalarının yenilenmesine ilişkin talimatların, süresi dolmadan önce tamamlanacak şekilde yeterli sürede gönderildiği ve gerekiyorsa otomatik hatırlatıcıların yapılandırıldığı doğrulanmalıdır.FalseFalseTrue✓V6.4.66Yönetici yetkisi olan kullanıcıların, kullanıcının parola sıfırlama sürecini başlatabildiği ancak kullanıcının yeni parolasını belirleyemediği veya değiştiremediği doğrulanmalıdır. Bu, yönetici yetkisi olan kullanıcıların, kullanıcı parolasını bilmesini engeller.FalseFalseTrue✓V6.55Çok Faktörlü Kimlik Doğrulama İçin Genel GereksinimlerV6.5.11Arama sırları, bant dışı kimlik doğrulama istekleri veya kodları ve zamana dayalı tek kullanımlık parolaların (TOTP) yalnızca bir kez kullanılabildiği doğrulanmalıdır.FalseTrue✓True✓V6.5.22Uygulamanın backend tarafında saklanırken, 112 bitten az entropiye sahip (örneğin 19 rastgele harf-rakam karakteri veya 34 rastgele rakam) arama sırlarının, 32-bit rastgele bir salt içeren onaylı bir parola saklama algoritmasıyla hash’lendiği doğrulanmalıdır. Gizli bilginin entropisi 112 bit veya daha fazlaysa standart bir hash fonksiyonu kullanılabilir.FalseTrue✓True✓V6.5.33Arama sırları, bant dışı kimlik doğrulama kodları ve zamana dayalı tek kullanımlık parola seed'lerinin, öngörülebilir değerlerden kaçınmak için Kriptografik Olarak Güvenli Sözde Rastgele Sayı Üreteci (CSPRNG) ile oluşturulduğu doğrulanmalıdır.FalseTrue✓True✓V6.5.44Arama sırlarının ve bant dışı kimlik doğrulama kodlarının en az 20 bit entropiye (genellikle 4 rastgele harf-rakam karakteri veya 6 rastgele rakam) sahip olduğu doğrulanmalıdır.FalseTrue✓True✓V6.5.55Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının ve zamana dayalı tek kullanımlık parolaların (TOTP) belirli bir ömre sahip olduğu doğrulanmalıdır. Bant dışı istekler en fazla 10 dakika, TOTP’ler ise en fazla 30 saniye geçerli olmalıdır.FalseTrue✓True✓V6.5.66Herhangi bir kimlik doğrulama faktörünün (fiziksel cihazlar dahil) çalınması veya kaybı durumunda iptal edilebildiği doğrulanmalıdır.FalseFalseTrue✓V6.5.77Biyometrik kimlik doğrulama mekanizmalarının yalnızca ikincil faktör olarak, “sahip olduğunuz bir şey” veya “bildiğiniz bir şey” ile birlikte kullanıldığı doğrulanmalıdır.FalseFalseTrue✓V6.5.88Zamana dayalı tek kullanımlık parolaların (TOTP) doğrulamasının, güvenilir bir hizmetten alınan zaman kaynağına dayanarak yapıldığı ve güvenilir olmayan veya istemci tarafından sağlanan zaman kaynağına dayanmadığı doğrulanmalıdır.FalseFalseTrue✓V6.66Bant Dışı Kimlik Doğrulama MekanizmalarıV6.6.11Tek kullanımlık parolaların (OTP) telefon veya SMS ile Public Switched Telephone Network (PSTN) üzerinden iletildiği kimlik doğrulama mekanizmalarının, yalnızca telefon numarası önceden doğrulanmışsa, alternatif daha güçlü yöntemler (örneğin TOTP) de sunuluyorsa ve kullanıcıya güvenlik riskleri hakkında bilgi veriliyorsa sunulduğu doğrulanmalıdır. Seviye 3 uygulamalar için telefon ve SMS seçenekleri sunulmamalıdır.FalseTrue✓True✓V6.6.22Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının, oluşturuldukları özgün kimlik doğrulama isteğiyle bağlantılı olduğu ve daha önceki ya da sonraki bir istek için kullanılamadığı doğrulanmalıdır.FalseTrue✓True✓V6.6.33Kod tabanlı bant dışı kimlik doğrulama mekanizmalarının, oran sınırlaması ile kaba kuvvet saldırılarına karşı korunduğu doğrulanmalıdır. En az 64 bit entropiye sahip kodlar kullanılması da değerlendirilmelidir.FalseTrue✓True✓V6.6.44Çok faktörlü kimlik doğrulama için push bildirimleri kullanılıyorsa, push bombing saldırılarına karşı oran sınırlamasının kullanıldığı doğrulanmalıdır. “Numara eşleştirme” de bu riski azaltabilir.FalseFalseTrue✓V6.77Kriptografik Kimlik Doğrulama MekanizmasıV6.7.11Kriptografik kimlik doğrulama beyanlarını doğrulamak için kullanılan sertifikaların, değiştirilmeye karşı korumalı şekilde saklandığı doğrulanmalıdır.FalseFalseTrue✓V6.7.22Challenge nonce değerinin en az 64 bit uzunluğunda olduğu ve istatistiksel olarak benzersiz ya da cihazın ömrü boyunca benzersiz olduğu doğrulanmalıdır.FalseFalseTrue✓V6.88Kimlik Sağlayıcısı ile Kimlik DoğrulamaV6.8.11Uygulama birden fazla kimlik sağlayıcıyı (IdP) destekliyorsa, başka bir desteklenen kimlik sağlayıcı aracılığıyla (örneğin aynı kullanıcı tanımlayıcısını kullanarak) kullanıcının kimliğinin taklit edilemediği doğrulanmalıdır. Standart önlem, uygulamanın kullanıcıyı IdP kimliği (bir ad alanı işlevi görür) ve IdP içindeki kullanıcı kimliğinin birleşimiyle kaydetmesi ve tanımlamasıdır.FalseTrue✓True✓V6.8.22Kimlik doğrulama beyanları üzerindeki dijital imzaların (örneğin JWT veya SAML beyanları) varlığı ve bütünlüğünün her zaman doğrulandığı ve imzasız veya geçersiz imzalı beyanların reddedildiği doğrulanmalıdır.FalseTrue✓True✓V6.8.33SAML beyanlarının benzersiz biçimde işlendiği ve yalnızca geçerlilik süresi içinde bir kez kullanıldığı, tekrar oynatma (replay) saldırılarını önlemek amacıyla doğrulanmalıdır.FalseTrue✓True✓V6.8.44Uygulama ayrı bir Kimlik Sağlayıcı (IdP) kullanıyorsa ve belirli işlemler için belirli kimlik doğrulama gücü, yöntemleri veya zaman bilgisi bekliyorsa, uygulamanın bu bilgileri IdP tarafından döndürülen veriler üzerinden doğruladığı teyit edilmelidir. Örneğin OIDC kullanılıyorsa, bu durum ID Token üzerindeki 'acr', 'amr' ve 'auth_time' gibi claim’lerin (varsa) doğrulanması ile sağlanabilir. Eğer IdP bu bilgileri sağlamıyorsa, uygulamanın asgari kimlik doğrulama gücünün kullanıldığını varsayan (örneğin yalnızca kullanıcı adı ve parola ile tek faktörlü doğrulama) belgelenmiş bir yedek yaklaşımı olmalıdır.FalseTrue✓True✓V77SessionOturum YönetimiV7.11Oturum Yönetim DokümantasyonuV7.1.11Kullanıcının oturum inaktivite zaman aşımı süresi ve mutlak maksimum oturum süresinin belgelendiği, diğer kontrollerle birlikte uygun olduğu ve NIST SP 800-63B yeniden kimlik doğrulama gereksinimlerinden herhangi bir sapma varsa gerekçesinin belgede yer aldığı doğrulanmalıdır.FalseTrue✓True✓V7.1.22Belgede bir hesap için kaç adet eşzamanlı (paralel) oturuma izin verildiği ile birlikte, maksimum aktif oturum sayısına ulaşıldığında uygulanacak davranış ve işlemlerin tanımlandığı doğrulanmalıdır.FalseTrue✓True✓V7.1.33Birleşik kimlik yönetim ekosisteminin bir parçası olarak kullanıcı oturumu oluşturan ve yöneten tüm sistemlerin, oturum ömrü, sonlandırma ve yeniden kimlik doğrulama gerektiren diğer koşulların nasıl koordine edildiğini açıklayan kontrollerle birlikte belgede yer aldığı doğrulanmalıdır.FalseTrue✓True✓V7.22Temel Oturum Yönetimi GüvenliğiV7.2.11Uygulamanın tüm oturum token'ı doğrulama işlemlerini güvenilir bir backend servisi aracılığıyla gerçekleştirdiği doğrulanmalıdır.True✓True✓True✓V7.2.22Uygulamanın, statik API gizli anahtarları veya sabit değerler yerine, oturum yönetimi için dinamik olarak oluşturulan kendi kendine yeterli veya referans token'ları kullandığı doğrulanmalıdır.True✓True✓True✓V7.2.33Uygulama kullanıcı oturumlarını temsil etmek için referans token'ları kullanıyorsa, bu token'ların benzersiz olduğu, kriptografik olarak güvenli bir sözde rastgele sayı üreteci (CSPRNG) kullanılarak üretildiği ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır.True✓True✓True✓V7.2.44Uygulamanın, kullanıcı kimlik doğrulaması (yeniden kimlik doğrulama dahil) sırasında yeni bir oturum token'ı oluşturduğu ve mevcut oturum token'ını sonlandırdığı doğrulanmalıdır.True✓True✓True✓V7.33Oturum Zaman AşımıV7.3.11Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde bir hareketsizlik zaman aşımı bulunduğu doğrulanmalıdır.FalseTrue✓True✓V7.3.22Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde mutlak bir maksimum oturum süresi bulunduğu doğrulanmalıdır.FalseTrue✓True✓V7.44Oturum SonlandırmaV7.4.11Oturum sonlandırma tetiklendiğinde (örneğin, çıkış yapıldığında veya süre dolduğunda), uygulamanın oturumun daha fazla kullanılmasına izin vermediği doğrulanmalıdır. Referans token'lar veya durum bilgili oturumlar için bu, oturum verilerinin uygulama arka ucunda geçersiz kılınması anlamına gelir. Kapsamlı token kullanan uygulamaların; sonlandırılmış token listesi tutmak, kullanıcıya özel tarih ve saatten önce oluşturulan token'ları reddetmek veya kullanıcıya özel imzalama anahtarını yenilemek gibi bir çözüm uygulaması gerekir.True✓True✓True✓V7.4.22Bir kullanıcı hesabı devre dışı bırakıldığında veya silindiğinde (örneğin bir çalışanın şirketten ayrılması), uygulamanın tüm aktif oturumları sonlandırdığı doğrulanmalıdır.True✓True✓True✓V7.4.33Herhangi bir kimlik doğrulama faktörünün başarılı bir şekilde değiştirilmesi veya kaldırılmasından (şifre sıfırlama veya kurtarma yoluyla yapılan değişiklikler dahil ve varsa MFA ayarları güncellemeleri dahil) sonra, uygulamanın diğer tüm aktif oturumları sonlandırma seçeneği sunduğu doğrulanmalıdır.FalseTrue✓True✓V7.4.44Kimlik doğrulama gerektiren tüm sayfalarda kolay erişilebilir ve görünür bir çıkış yap (logout) işlevi bulunduğu doğrulanmalıdır.FalseTrue✓True✓V7.4.55Uygulama yöneticilerinin, bireysel bir kullanıcının veya tüm kullanıcıların aktif oturumlarını sonlandırabilme yetkisine sahip olduğu doğrulanmalıdır.FalseTrue✓True✓V7.55Oturum Kötüye Kullanımına Karşı SavunmalarV7.5.11E-posta adresi, telefon numarası, MFA yapılandırması veya hesap kurtarmada kullanılan diğer bilgiler gibi kimlik doğrulamayı etkileyebilecek hassas hesap özniteliklerinde değişiklik yapılmadan önce uygulamanın tam yeniden kimlik doğrulama gerektirdiği doğrulanmalıdır.FalseTrue✓True✓V7.5.22Kullanıcıların, (en az bir faktörle yeniden kimlik doğrulama yaptıktan sonra) mevcut tüm aktif oturumları görüntüleyebilmesi ve sonlandırabilmesinin mümkün olduğu doğrulanmalıdır.FalseTrue✓True✓V7.5.33Uygulamanın, son derece hassas işlemler veya operasyonlar gerçekleştirilmeden önce en az bir faktörle ek kimlik doğrulaması veya ikincil bir doğrulama gerektirdiği doğrulanmalıdır.FalseFalseTrue✓V7.66Birleşik Yeniden Kimlik DoğrulamaV7.6.11Güvenen Taraf (RP) ile Kimlik Sağlayıcı (IdP) arasındaki oturum süresi ve oturum sonlandırma davranışlarının belgelenmiş olduğu ve, örneğin IdP kimlik doğrulama olayları arasında maksimum süreye ulaşıldığında yeniden kimlik doğrulamanın gerekli kılındığı doğrulanmalıdır.FalseTrue✓True✓V7.6.22Yeni bir oturum oluşturulmasının, kullanıcı onayı veya açık bir eylem gerektirdiği; kullanıcı etkileşimi olmaksızın yeni uygulama oturumlarının oluşturulmasının önlendiği doğrulanmalıdır.FalseTrue✓True✓V88AuthorizationYetkilendirmeV8.11Yetkilendirme DokümantasyonuV8.1.11Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak işlev düzeyinde ve veriye özel erişim kısıtlamaları için kuralları tanımladığı doğrulanmalıdır.True✓True✓True✓V8.1.22Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak alan (field) düzeyinde erişim kısıtlamaları (hem okuma hem yazma) için kuralları tanımladığı doğrulanmalıdır. Bu kuralların, ilgili veri nesnesinin durum veya statü gibi diğer özniteliklerine bağlı olabileceği unutulmamalıdır.FalseTrue✓True✓V8.1.33Uygulamanın dokümantasyonunun, kimlik doğrulama ve yetkilendirme ile ilgili güvenlik kararlarının alınmasında kullanılan çevresel ve bağlamsal öznitelikleri (günün saati, kullanıcı konumu, IP adresi veya cihaz gibi) tanımladığı doğrulanmalıdır.FalseFalseTrue✓V8.1.44Kimlik doğrulama ve yetkilendirme dokümantasyonunun; işlev düzeyinde, veriye özel ve alan düzeyinde yetkilendirmenin yanı sıra çevresel ve bağlamsal faktörlerin karar almada nasıl kullanıldığını tanımladığı doğrulanmalıdır. Bu, değerlendirilen öznitelikleri, risk eşiklerini ve alınan aksiyonları (ör. izin ver, doğrulama iste, reddet, step-up kimlik doğrulama) içermelidir.FalseFalseTrue✓V8.22Genel Yetkilendirme TasarımıV8.2.11Uygulamanın, işlev düzeyindeki erişimin yalnızca açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır.True✓True✓True✓V8.2.22Uygulamanın, veriye özel erişimin yalnızca belirli veri öğelerine açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, doğrudan nesne referansı güvenlik açıkları (IDOR) ve bozuk nesne düzeyinde yetkilendirme (BOLA) risklerini azaltır.True✓True✓True✓V8.2.33Uygulamanın, alan (field) düzeyindeki erişimin yalnızca belirli alanlara açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, bozuk nesne özelliği düzeyinde yetkilendirme (BOPLA) risklerini azaltır.FalseTrue✓True✓V8.2.44Tüketicinin çevresel ve bağlamsal özniteliklerine (ör. günün saati, konum, IP adresi veya cihaz) dayalı uyarlanabilir güvenlik kontrollerinin, uygulama dokümantasyonunda tanımlandığı şekilde, kimlik doğrulama ve yetkilendirme kararları için uygulandığı doğrulanmalıdır. Bu kontroller, tüketici yeni bir oturum başlatmaya çalışırken ve mevcut bir oturum sırasında uygulanmalıdır.FalseFalseTrue✓V8.33İşlem Düzeyinde YetkilendirmeV8.3.11Uygulamanın yetkilendirme kurallarını güvenilir bir servis katmanında uyguladığı ve istemci taraflı JavaScript gibi güvenilmeyen tüketiciler tarafından değiştirilebilecek kontrollerle yetinmediği doğrulanmalıdır.True✓True✓True✓V8.3.22Yetkilendirme kararlarının temelini oluşturan değerlerdeki değişikliklerin hemen uygulandığı doğrulanmalıdır. Değişikliklerin anında uygulanamadığı durumlarda (örneğin self-contained token içindeki verilere güveniliyorsa), tüketici artık yetkili olmadığı hâlde bir işlem gerçekleştirdiğinde uyarı verecek ve değişikliği geri alacak önlemler uygulanmalıdır. Bu alternatifin bilgi sızıntısını önlemeyeceği unutulmamalıdır.FalseFalseTrue✓V8.3.33Bir nesneye erişimin, herhangi bir aracı veya onun adına hareket eden bir servis yerine yalnızca erişimi başlatan öznenin (ör. tüketici) izinlerine dayandığı doğrulanmalıdır. Örneğin, bir tüketici kimlik doğrulama için bir self-contained token kullanarak bir web servis çağırırsa ve bu servis başka bir servisten veri talep ederse, ikinci servis izin kararlarını verirken birinci servisin makine-makine token'ı yerine tüketicinin token'ını kullanmalıdır.FalseFalseTrue✓V8.44Diğer Yetkilendirme HususlarıV8.4.11Multi-tenant uygulamaların, tüketici işlemlerinin izinli olmadıkları tenant'lar üzerinde asla etkili olmamasını sağlamak için tenant'lar arası kontroller kullandığı doğrulanmalıdır.FalseTrue✓True✓V8.4.22Yönetici arayüzlerine erişimin, sürekli tüketici kimlik doğrulaması, cihaz güvenlik durumu değerlendirmesi ve bağlamsal risk analizi dahil olmak üzere çok katmanlı güvenlik içerdiği doğrulanmalıdır. Yetkilendirme için yalnızca ağ konumu veya güvenilir uç noktalar yeterli olmamalıdır; ancak bu tür faktörler yetkisiz erişim olasılığını azaltabilir.FalseFalseTrue✓V99SelfKendi İçinde Taşıyıcı Token (Self-contained Token)V9.11Token Kaynağı ve BütünlüğüV9.1.11Self-contained token'ların içerikleri kabul edilmeden önce, oynama (tampering) saldırılarına karşı dijital imza veya MAC ile doğrulama yapıldığı doğrulanmalıdır.True✓True✓True✓V9.1.22Belirli bir bağlam için yalnızca bir allowlist üzerinde bulunan algoritmaların self-contained token oluşturmak ve doğrulamak için kullanılabildiği doğrulanmalıdır. Bu allowlist, yalnızca simetrik ya da yalnızca asimetrik algoritmaları içermeli ve kesinlikle 'None' algoritmasını içermemelidir. Hem simetrik hem de asimetrik algoritmalar desteklenmek zorundaysa, anahtar karışıklığını (key confusion) önlemek için ek kontroller uygulanmalıdır.True✓True✓True✓V9.1.33Self-contained token'ları doğrulamak için kullanılan anahtar malzemesinin, token issuer için önceden yapılandırılmış güvenilir kaynaklardan alındığı doğrulanmalıdır. Bu, saldırganların güvenilmeyen kaynak ve anahtarları belirtmesini engeller. JWT ve diğer JWS yapılarında 'jku', 'x5u' ve 'jwk' gibi header'lar güvenilir kaynaklardan oluşan bir allowlist'e göre doğrulanmalıdır.True✓True✓True✓V9.22Token İçeriğiV9.2.11Token verisinde bir geçerlilik zaman aralığı (validity time span) varsa, yalnızca doğrulama zamanı bu zaman aralığı içerisindeyse token ve içeriği kabul edilmelidir. Örneğin, JWT'ler için 'nbf' ve 'exp' claim'leri doğrulanmalıdır.True✓True✓True✓V9.2.22Token'ı alan hizmetin, token içeriğini kabul etmeden önce bu token'ın doğru türde olduğunu ve sunulma amacına uygun olduğunu doğruladığı teyit edilmelidir. Örneğin, yalnızca erişim token'ları yetkilendirme kararları için, yalnızca ID Token'lar kullanıcı kimlik doğrulamasını kanıtlamak için kullanılabilir.FalseTrue✓True✓V9.2.33Hizmetin yalnızca kendisiyle kullanılması amaçlanan (audience) token'ları kabul ettiği doğrulanmalıdır. JWT'lerde bu, 'aud' claim'inin hizmet içinde tanımlı bir allowlist ile doğrulanması yoluyla sağlanabilir.FalseTrue✓True✓V9.2.44Eğer bir token issuer, farklı audience'lara token oluşturmak için aynı private key'i kullanıyorsa, oluşturulan token'ların hedef audience'ları benzersiz şekilde tanımlayan bir audience kısıtlaması içerdiği doğrulanmalıdır. Bu, bir token'ın farklı bir audience ile yeniden kullanılmasını önler. Audience tanımlayıcısı dinamik olarak sağlanıyorsa, token issuer bu audience'ları doğrulamalı ve audience taklitlerinin (impersonation) önüne geçmelidir.FalseTrue✓True✓V1010OAuthOAuth ve OIDCV10.11Genel OAuth ve OIDC GüvenliğiV10.1.11Token'ların yalnızca kesinlikle ihtiyaç duyan bileşenlere gönderildiği doğrulanmalıdır. Örneğin, tarayıcı tabanlı JavaScript uygulamaları için bir backend-for-frontend modeli kullanıldığında, access ve refresh token'lara yalnızca backend'in erişebilmesi gerekir.FalseTrue✓True✓V10.1.22Authorization server'dan gelen değerler (örneğin authorization code veya ID Token gibi) yalnızca aynı user agent oturumu ve işlemi tarafından başlatılmış bir yetkilendirme akışının sonucuysa kabul edildiği doğrulanmalıdır. Bu, client tarafından oluşturulan secret’ların 'proof key for code exchange' (PKCE) ‘code_verifier’, ‘state’ veya OIDC ‘nonce’ gibi tahmin edilemez, işleme özgü ve hem client’a hem de işlem başlatılan user agent oturumuna güvenli bir şekilde bağlı olmasını gerektirir.FalseTrue✓True✓V10.22OAuth İstemcisiV10.2.11Code flow kullanılıyorsa, OAuth client’ın token taleplerini tetikleyen CSRF saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Bu genellikle PKCE kullanılarak veya authorization isteğinde gönderilen ‘state’ parametresinin kontrolü ile sağlanır.FalseTrue✓True✓V10.2.22OAuth istemcisi birden fazla AS ile etkileşime girebiliyorsa, mix-up saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Örneğin, authorization server’ın 'iss' parametresini döndürmesi zorunlu kılınabilir ve bu parametrenin hem authorization yanıtında hem de token yanıtında doğrulanması gerekir.FalseTrue✓True✓V10.2.33OAuth istemcisinin authorization server’a yaptığı taleplerde yalnızca gerekli scope’ları (veya diğer yetkilendirme parametrelerini) talep ettiği doğrulanmalıdır.FalseFalseTrue✓V10.33OAuth Kaynak Sunucusu (RS)V10.3.11RS'nin yalnızca bu servisle kullanılmak üzere tasarlanmış access token’ları kabul ettiği doğrulanmalıdır (audience kontrolü). Audience bilgisi yapılandırılmış token’larda (örneğin JWT içindeki ‘aud’ claim’i) yer alabilir veya token introspection endpoint aracılığıyla kontrol edilebilir.FalseTrue✓True✓V10.3.22RS'nin, access token’dan gelen claim’lere dayanarak yetki devri tanımına uygun şekilde yetkilendirme kararları uyguladığı doğrulanmalıdır. ‘sub’, ‘scope’ ve ‘authorization_details’ gibi claim’ler varsa, bu kararın parçası olmalıdır.FalseTrue✓True✓V10.3.33Erişim kontrolü kararında, access token’dan (JWT veya ilgili token introspection yanıtı) benzersiz bir kullanıcının tanımlanması gerekiyorsa, RS'nin başka kullanıcılara devredilemeyecek claim’ler ile kullanıcıyı tanımladığı doğrulanmalıdır. Genellikle bu, ‘iss’ ve ‘sub’ claim’lerinin birlikte kullanılması anlamına gelir.FalseTrue✓True✓V10.3.44RS'nin belirli bir kimlik doğrulama gücü, yöntemi veya güncelliği (recentness) gerektirmesi durumunda, sunulan access token’ın bu kısıtlamaları karşıladığını doğruladığı, örneğin, OIDC ‘acr’, ‘amr’ ve ‘auth_time’ claim’leri kullanılarak doğrulanmalıdır. FalseTrue✓True✓V10.3.55RS'nin, (yetkisiz taraflarca) çalınmış veya tekrar edilen access token’ların kullanımını önlemek için sender-constrained access token’lar kullandığı doğrulanmalıdır. Bu, OAuth 2 için Mutual TLS veya OAuth 2 Demonstration of Proof of Possession (DPoP) ile sağlanabilir.FalseFalseTrue✓V10.44OAuth Yetkilendirme Sunucusu (AS)V10.4.11AS'nin, istemciye özel önceden kaydedilmiş URI’lerden oluşan bir allowlist kullanarak redirect URI’leri tam dize karşılaştırması ile doğruladığı doğrulanmalıdır.True✓True✓True✓V10.4.22AS'nin, "authorization response" içinde "authorization code" döndürdüğü durumlarda, bu kodun yalnızca bir kez kullanılabildiği doğrulanmalıdır. Daha önce access token vermek için kullanılmış bir authorization code ile yapılan ikinci geçerli token isteği reddedilmeli ve ilgili tüm token’lar iptal edilmelidir.True✓True✓True✓V10.4.33Authorization code’un kısa ömürlü olduğu doğrulanmalıdır. L1 ve L2 uygulamalar için maksimum yaşam süresi 10 dakika, L3 uygulamalar için 1 dakikadır.True✓True✓True✓V10.4.44Belirli bir istemci için AS'nin yalnızca o istemcinin ihtiyaç duyduğu grant türlerine izin verdiği doğrulanmalıdır. "Token" (Implicit flow) ve "password" (Resource Owner Password Credentials flow) grant türlerinin artık kullanılmaması gerekir.True✓True✓True✓V10.4.55AS'nin, açık istemciler için refresh token replay saldırılarını azalttığı doğrulanmalıdır. Tercihen sender-constrained refresh token’lar (DPoP veya mutual TLS ile certificate-bound access token’lar) kullanılmalıdır. L1 ve L2 uygulamalar için refresh token rotation kullanılabilir. Rotation kullanılıyorsa, AS refresh token’ı kullanım sonrası geçersiz kılmalı ve geçersiz bir refresh token sunulması durumunda o yetkilendirme ile ilişkili tüm refresh token’ları iptal etmelidir.True✓True✓True✓V10.4.66Code grant kullanılıyorsa, AS'nin authorization code interception saldırılarına karşı koruma sağladığı doğrulanmalıdır. Yetkilendirme isteğinde geçerli bir "code_challenge" değeri zorunlu olmalı ve "code_challenge_method" olarak "plain" kabul edilmemelidir. Token isteğinde ise "code_verifier" parametresi doğrulanmalıdır.FalseTrue✓True✓V10.4.77AS'nin, kimlik doğrulaması yapılmamış dinamik istemci kaydını desteklemesi durumunda, kötü niyetli istemci uygulamalarına karşı riskleri azalttığı doğrulanmalıdır. Kayıtlı URI’ler gibi client metadata’sı doğrulanmalı, kullanıcı onayı alınmalı ve güvenilmeyen bir client uygulamasıyla yapılan yetkilendirme isteği işlenmeden önce kullanıcı uyarılmalıdır.FalseTrue✓True✓V10.4.88Refresh token’ların, sliding expiration kullanılsa bile mutlak bir sona erme süresine sahip olduğu doğrulanmalıdır.FalseTrue✓True✓V10.4.99Yetkili bir kullanıcı tarafından AS kullanıcı arayüzü üzerinden refresh token’ların ve reference access token’ların iptal edilebildiği doğrulanmalıdır.FalseTrue✓True✓V10.4.1010Gizli istemcilerin token istekleri, pushed authorization request (PAR) ve token iptal istekleri gibi server’a yapılan backchannel isteklerinde kimliğinin kontrol edildiği doğrulanmalıdır.FalseTrue✓True✓V10.4.1111AS yapılandırmasının, OAuth istemcisine yalnızca gerekli scope’ları atadığı doğrulanmalıdır.FalseTrue✓True✓V10.4.1212Belirli bir client için, authorization server’ın yalnızca client’ın ihtiyaç duyduğu 'response_mode' değerine izin verdiği doğrulanmalıdır. Örneğin, bu değer ya beklenenlerle karşılaştırılarak doğrulanmalı ya da PAR veya JAR kullanılmalıdır.FalseFalseTrue✓V10.4.1313"Code" grant türünün daima pushed authorization request (PAR) ile birlikte kullanıldığı doğrulanmalıdır.FalseFalseTrue✓V10.4.1414AS'nin yalnızca sender-constrained (Proof-of-Possession) access token’lar ürettiği doğrulanmalıdır. Bu, mutual TLS ile certificate-bound access token ya da DPoP ile DPoP-bound access token olabilir.FalseFalseTrue✓V10.4.1515Sunucu taraflı istemciler için (kullanıcı cihazında çalışmayan), AS'nin "authorization_details" parametresinin istemci backend'i tarafından sağlandığını ve kullanıcı tarafından değiştirilmediğini doğruladığı, örneğin pushed authorization request (PAR) or JWT-secured Authorization Request (JAR) zorunlu kılınarak doğrulanmalıdır.FalseFalseTrue✓V10.4.1616Bir istemci gizli ise, AS'nin güçlü istemci kimlik doğrulama yöntemlerini zorunlu kıldığı doğrulanmalıdır. Bu yöntemler, public-key cryptography’ye dayalı ve replay saldırılarına karşı dayanıklı olmalı, örneğin mutual TLS ("tls_client_auth", "self_signed_tls_client_auth") veya private key JWT ("private_key_jwt") gibi.FalseFalseTrue✓V10.55OIDC İstemcisiV10.5.11İstemcinin (relying party olarak) ID Token replay saldırılarını azalttığı doğrulanmalıdır. Örneğin, ID Token’daki 'nonce' claim’inin, OpenID Provider’a gönderilen kimlik doğrulama isteğindeki 'nonce' değeriyle eşleştiği doğrulanmalıdır.FalseTrue✓True✓V10.5.22İstemcinin kullanıcıyı ID Token claim’lerinden (genellikle, başka kullanıcılarla yeniden atanamayan 'sub' claim’i) benzersiz şekilde tanımladığı doğrulanmalıdır.FalseTrue✓True✓V10.5.33İstemcinin, kötü niyetli bir AS'nin başka bir AS'yi taklit etmesini AS metadata’sı üzerinden reddettiği doğrulanmalıdır. AS metadata’sındaki issuer URL’si, istemci tarafından beklenen önceden yapılandırılmış issuer URL’siyle tam olarak eşleşmiyorsa, metadata reddedilmelidir.FalseTrue✓True✓V10.5.44İstemcinin, ID Token’ın kendisi için (audience) kullanılması amaçlandığını doğruladığı doğrulanmalıdır. Bu, token’daki 'aud' claim’inin istemcinin 'client_id' değeriyle eşit olup olmadığının kontrol edilmesiyle yapılır.FalseTrue✓True✓V10.5.55OIDC back-channel logout kullanıldığında, relying party’nin "forced logout" ve "logout" akışında "cross-JWT confusion" gibi saldırılara karşı koruma sağladığı doğrulanmalıdır. Client, logout token’ın 'logout+jwt' türünde olduğunu, 'event' claim’inin doğru üyeye sahip olduğunu ve 'nonce' claim’i içermediğini doğrulamalıdır. Ayrıca token için kısa bir sona erme süresi (örneğin 2 dakika) önerilir.FalseTrue✓True✓V10.66OpenID ProviderV10.6.11OpenID Provider’ın yalnızca 'code', 'ciba', 'id_token' veya 'id_token code' response mode değerlerine izin verdiği doğrulanmalıdır. 'code' değeri, 'id_token code' (OIDC Hybrid flow) yerine tercih edilmelidir. 'token' (Implicit flow) kullanılmamalıdır.FalseTrue✓True✓V10.6.22OpenID Provider’ın forced logout yoluyla yapılan hizmet reddi saldırılarını önlediği doğrulanmalıdır. Bu, son kullanıcıdan açık onay alınarak veya varsa logout isteğinde (relying party tarafından başlatılan) bulunan parametrelerin, örneğin 'id_token_hint', doğrulanmasıyla yapılabilir.FalseTrue✓True✓V10.77Onay (Consent) YönetimiV10.7.11AS'nin her yetkilendirme isteği için kullanıcının onayını aldığı doğrulanmalıdır. İstemcinin kimliği garanti altına alınamıyorsa, AS daima kullanıcıdan açıkça onay istemelidir.FalseTrue✓True✓V10.7.22AS'nin kullanıcıdan onay istediğinde, neye onay verildiğini açık ve yeterli şekilde gösterdiği doğrulanmalıdır. Uygun olduğunda bu bilgiler, istenen yetkilendirmelerin doğasını (genellikle scope, resource server, RAR gibi detaylara dayalı), yetkilendirilmiş uygulamanın kimliğini ve bu yetkilendirmelerin süresini içermelidir.FalseTrue✓True✓V10.7.33Kullanıcının, AS üzerinden verdiği onayları görüntüleyebildiği, değiştirebildiği ve iptal edebildiği doğrulanmalıdır.FalseTrue✓True✓V1111CryptographyKriptografiV11.11Kriptografik Envanter ve DokümantasyonV11.1.11Kriptografik anahtarların yönetimi için belgelenmiş bir politika ve NIST SP 800-57 gibi bir anahtar yönetim standardını izleyen bir kriptografik anahtar yaşam döngüsü tanımlandığı doğrulanmalıdır. Bu, anahtarların aşırı miktarda paylaşılmadığını (örneğin, paylaşılan sırlar için ikiden fazla tarafla veya özel anahtarlar için birden fazla tarafla) garanti altına almalıdır.FalseTrue✓True✓V11.1.22Tüm kriptografik anahtarlar, algoritmalar ve uygulama tarafından kullanılan sertifikaları içeren bir kriptografik envanterin oluşturulduğu, sürdürüldüğü ve düzenli olarak güncellendiği doğrulanmalıdır. Bu envanter ayrıca, sistemde anahtarların nerede kullanılabileceğini ve kullanılamayacağını, ve hangi veri türlerinin bu anahtarlarla korunup korunamayacağını da belgelemelidir.FalseTrue✓True✓V11.1.33Sistem içerisinde şifreleme, özetleme ve imzalama işlemleri dahil olmak üzere kriptografi kullanımının tüm örneklerini tespit etmek için kriptografik keşif mekanizmalarının kullanıldığı doğrulanmalıdır.FalseFalseTrue✓V11.1.44Kriptografik bir envanterin sürdürüldüğü doğrulanmalıdır. Bu envanter, gelecekteki tehditlere karşı tepki verebilmek amacıyla post-kuantum kriptografiye geçiş yolunu belirten belgelenmiş bir plan içermelidir.FalseFalseTrue✓V11.22Güvenli Kriptografi UygulamasıV11.2.11Kriptografik işlemler için sektör tarafından doğrulanmış uygulamaların (kütüphaneler ve donanım hızlandırmalı uygulamalar dahil) kullanıldığı doğrulanmalıdır.FalseTrue✓True✓V11.2.22Uygulamanın, rastgele sayı üreticileri, kimliği doğrulanmış şifreleme, MAC veya özetleme algoritmaları, anahtar uzunlukları, turlar, şifreler ve modların herhangi bir zamanda yeniden yapılandırılabilir, yükseltilebilir veya değiştirilebilir olacağı şekilde kripto çevikliği (crypto agility) ile tasarlandığı doğrulanmalıdır. Aynı şekilde, anahtarların ve parolaların değiştirilebilmesi ve verilerin yeniden şifrelenebilmesi mümkün olmalıdır. Bu, onaylanmış PQC şemalarının yüksek güvenlikli uygulamaları yaygın olarak kullanılabilir hale geldiğinde sorunsuz geçişe olanak tanır.FalseTrue✓True✓V11.2.33Tüm kriptografik ilkeliklerin, algoritma, anahtar boyutu ve yapılandırmaya göre minimum 128 bit güvenlik sağladığı doğrulanmalıdır. Örneğin, 256-bit ECC anahtarı yaklaşık 128 bit güvenlik sağlarken, RSA için aynı güvenliği elde etmek 3072-bit anahtar gerektirir.FalseTrue✓True✓V11.2.44Tüm kriptografik işlemlerin sabit süreli (constant-time) olduğu, karşılaştırmalarda, hesaplamalarda veya geri dönüşlerde kısa devre (short-circuit) işlemleri yapılmadığı doğrulanmalıdır; bu, bilgi sızıntısını önlemek için gereklidir.FalseFalseTrue✓V11.2.55Tüm kriptografik modüllerin güvenli şekilde hata verdiği ve hataların, padding oracle saldırıları gibi zafiyetleri mümkün kılmayacak şekilde ele alındığı doğrulanmalıdır.FalseFalseTrue✓V11.33Şifreleme AlgoritmalarıV11.3.11Güvensiz blok modlarının (örneğin, ECB) ve zayıf doldurma (padding) şemalarının (örneğin, PKCS#1 v1.5) kullanılmadığı doğrulanmalıdır.True✓True✓True✓V11.3.22Yalnızca AES ile GCM gibi onaylı şifreleme algoritmalarının ve modlarının kullanıldığı doğrulanmalıdır.True✓True✓True✓V11.3.33Şifrelenmiş verilerin yetkisiz değişikliklere karşı korunduğu doğrulanmalıdır. Tercihen bu koruma, onaylı bir kimliği doğrulanmış şifreleme yöntemi kullanılarak ya da onaylı bir şifreleme yöntemi ile onaylı bir MAC algoritmasının kombinasyonu ile sağlanmalıdır.FalseTrue✓True✓V11.3.44Sayılar, başlatma vektörleri (IV) ve diğer tek kullanımlık değerlerin, aynı şifreleme anahtarı ve veri öğesi çifti için birden fazla kez kullanılmadığı doğrulanmalıdır. Oluşturma yöntemi kullanılan algoritmaya uygun olmalıdır.FalseFalseTrue✓V11.3.55Şifreleme algoritması ve MAC algoritması kombinasyonlarının "encrypt-then-MAC" modunda çalıştığı doğrulanmalıdır.FalseFalseTrue✓V11.44Hashing ve Hash Tabanlı FonksiyonlarV11.4.11Dijital imzalar, HMAC, KDF ve rastgele bit üretimi gibi genel kriptografik kullanım senaryolarında yalnızca onaylı hash fonksiyonlarının kullanıldığı doğrulanmalıdır. MD5 gibi yasaklı hash fonksiyonları hiçbir kriptografik amaçla kullanılmamalıdır.True✓True✓True✓V11.4.22Parolaların, onaylı, hesaplama açısından yoğun ve mevcut rehberliğe göre yapılandırılmış bir anahtar türetme fonksiyonu (diğer adıyla parola hash'leme fonksiyonu) kullanılarak saklandığı doğrulanmalıdır. Ayarlar, güvenlik ve performans dengesini sağlayarak kaba kuvvet saldırılarını zorlaştırmalıdır.FalseTrue✓True✓V11.4.33Dijital imzalarda kullanılan hash fonksiyonlarının, veri bütünlüğü ve kimlik doğrulama amacıyla kullanıldığında çakışmaya karşı dayanıklı ve yeterli bit uzunluğuna sahip olduğu doğrulanmalıdır. Çakışma dayanıklılığı gerekiyorsa çıktı uzunluğu en az 256 bit olmalıdır. Sadece ikinci ön-görüntü (2nd pre-iamge) saldırılarına karşı dayanıklılık gerekiyorsa çıktı uzunluğu en az 128 bit olmalıdır.FalseTrue✓True✓V11.4.44Parolalardan gizli anahtarlar türetilirken, onaylı anahtar türetme fonksiyonlarının anahtar uzatma (key stretching) parametreleriyle birlikte kullanıldığı doğrulanmalıdır. Bu parametreler, kaba kuvvet saldırılarını önleyecek şekilde güvenlik ve performans dengesine sahip olmalıdır.FalseTrue✓True✓V11.55Rastgele DeğerlerV11.5.11Tahmin edilemez olması amaçlanan tüm rastgele sayıların ve dizelerin, CSPRNG ile oluşturulduğu ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. UUID'lerin bu koşulu dikkate almadığını unutmayın.FalseTrue✓True✓V11.5.22Kullanılan rastgele sayı üretim mekanizmasının, yoğun talep altında dahi güvenli çalışacak şekilde tasarlandığı doğrulanmalıdır.FalseFalseTrue✓V11.66Açık Anahtar (Public Key) KriptografisiV11.6.11Anahtar üretimi, tohumlama (seeding) ve dijital imza üretimi ve doğrulama için yalnızca onaylı kriptografik algoritmalar ve çalışma modlarının kullanıldığı doğrulanmalıdır. Anahtar üretim algoritmaları, bilinen saldırılara karşı savunmasız anahtarlar üretmemelidir. Örneğin, Fermat çarpanlama yöntemine karşı savunmasız RSA anahtarları oluşturulmamalıdır.FalseTrue✓True✓V11.6.22Anahtar değişimi için yalnızca onaylı kriptografik algoritmaların kullanıldığı doğrulanmalıdır (örneğin Diffie-Hellman). Kullanılan parametrelerin güvenli olması gerektiğine dikkat edilmelidir. Bu, anahtar kurulum sürecine yönelik saldırıları önleyecek ve araya girme (adversary-in-the-middle) ya da kriptografik kırılmaları engelleyecektir.FalseFalseTrue✓V11.77Kullanım Halindeki Verilerin KriptografisiV11.7.11Hassas verilerin kullanım sırasında korunmasını sağlamak amacıyla, yetkisiz kullanıcıların veya süreçlerin bu verilere erişmesini engelleyen tam bellek şifrelemesinin kullanıldığı doğrulanmalıdır.FalseFalseTrue✓V11.7.22Veri asgariyetinin sağlandığı, yani işleme sırasında mümkün olan en az miktarda verinin ortaya çıktığı ve verilerin kullanımdan hemen sonra veya mümkün olan en kısa sürede şifrelendiği doğrulanmalıdır.FalseFalseTrue✓V1212SecureGüvenli İletişimV12.11Genel TLS Güvenlik RehberiV12.1.11Yalnızca TLS protokolünün en güncel ve önerilen sürümlerinin (örneğin TLS 1.2 ve TLS 1.3) etkinleştirildiği ve en son sürümün varsayılan olarak tercih edildiği doğrulanmalıdır.True✓True✓True✓V12.1.22Yalnızca önerilen şifre takımlarının (cipher suite) etkinleştirildiği ve en güçlü şifre takımlarının tercih edildiği doğrulanmalıdır. Seviye 3 (L3) uygulamalar yalnızca ileri gizlilik (forward secrecy) sağlayan şifre takımlarını desteklemelidir.FalseTrue✓True✓V12.1.33Uygulamanın, mTLS istemci sertifikalarını kimlik doğrulama veya yetkilendirme amacıyla kullanmadan önce bu sertifikaların güvendiği sertifikalar arasında olduğunu doğruladığı kontrol edilmelidir.FalseTrue✓True✓V12.1.44Online Certificate Status Protocol (OCSP) Stapling gibi geçerli bir sertifika iptal kontrolü yönteminin etkinleştirildiği ve yapılandırıldığı doğrulanmalıdır.FalseFalseTrue✓V12.1.55TLS el sıkışma (handshake) sürecinde Server Name Indication (SNI) gibi hassas meta verilerin ifşa edilmesini önlemek için, uygulamanın TLS yapılandırmasında Encrypted Client Hello (ECH) özelliğinin etkinleştirildiği doğrulanmalıdır.FalseFalseTrue✓V12.22Dışa Açık Hizmetlerle HTTPS İletişimiV12.2.11İstemci ile dışa açık, HTTP tabanlı hizmetler arasındaki tüm bağlantılarda TLS kullanıldığı ve bu bağlantıların güvensiz ya da şifrelenmemiş iletişime geri dönmediği doğrulanmalıdır.True✓True✓True✓V12.2.22Dışa açık hizmetlerin herkese açık olarak güvenilen TLS sertifikaları kullandığı doğrulanmalıdır.True✓True✓True✓V12.33Genel Servisler Arası İletişim GüvenliğiV12.3.11Uygulamaya gelen ve uygulamadan çıkan tüm bağlantılarda izleme sistemleri, yönetim araçları, uzaktan erişim ve SSH, ara yazılımlar, veritabanları, ana sistemler (mainframe), iş ortağı sistemleri ya da dış API'ler dahil olmak üzere TLS gibi şifreli bir protokolün kullanıldığı ve güvensiz ya da şifrelenmemiş protokollere geri dönülmediği doğrulanmalıdır.FalseTrue✓True✓V12.3.22TLS istemcilerinin bir TLS sunucusu ile iletişime geçmeden önce alınan sertifikaları doğruladığı kontrol edilmelidir.FalseTrue✓True✓V12.3.33Uygulama içindeki HTTP tabanlı iç hizmetler arasında gerçekleşen tüm bağlantılarda TLS ya da uygun başka bir aktarım şifreleme mekanizmasının kullanıldığı ve güvensiz ya da şifrelenmemiş iletişime geri dönülmediği doğrulanmalıdır.FalseTrue✓True✓V12.3.44İç hizmetler arasındaki TLS bağlantılarında güvenilir sertifikaların kullanıldığı doğrulanmalıdır. İç sistemlerde oluşturulmuş ya da kendinden imzalı (self-signed) sertifikalar kullanılıyorsa, bu sertifikalara güvenen hizmetlerin yalnızca belirli dahili sertifika otoritelerine (CA) ve belirli kendinden imzalı sertifikalara güvenecek şekilde yapılandırıldıkları doğrulanmalıdır.FalseTrue✓True✓V12.3.55Sistem içindeki hizmetlerin birbiriyle iletişim kurarken her bir uç noktanın kimliğini doğrulamak için güçlü kimlik doğrulama yöntemlerinin kullanıldığı doğrulanmalıdır. Bu yöntemler arasında, açık anahtar altyapısı (public-key infrastructure) kullanan ve tekrar oynatma saldırılarına karşı dayanıklı olan TLS istemci kimlik doğrulaması gibi yöntemler yer almalıdır. Mikroservis mimarilerinde, sertifika yönetimini basitleştirmek ve güvenliği artırmak amacıyla bir servis ağı (service mesh) kullanılması değerlendirilmelidir.FalseFalseTrue✓V1313ConfigurationKonfigürasyonV13.11Konfigürasyon DokümantasyonuV13.1.11Uygulamanın tüm iletişim ihtiyaçlarının dokümante edildiği doğrulanmalıdır. Buna, uygulamanın bağımlı olduğu dış hizmetler ve son kullanıcının uygulamanın bağlantı kurmasını sağlayabileceği dış konumlar da dahil olmalıdır.FalseTrue✓True✓V13.1.22Uygulamanın kullandığı her bir hizmet için, dokümantasyonda eşzamanlı bağlantı sayısı (örn. bağlantı havuzu limitleri) ve bu sınır aşıldığında uygulamanın davranışı, geri dönüş veya kurtarma mekanizmaları da dahil olmak üzere hizmet reddi koşullarını önlemek için tanımlandığı doğrulanmalıdır.FalseFalseTrue✓V13.1.33Uygulamanın, kullandığı her bir dış sistem veya hizmet (örn. veritabanları, dosya tanıtıcıları, iş parçacıkları, HTTP bağlantıları) için kaynak yönetimi stratejilerini tanımladığı doğrulanmalıdır. Bu stratejiler, kaynak serbest bırakma prosedürlerini, zaman aşımı ayarlarını, hata durumlarını ve tekrar deneme mantığı uygulanmışsa sınırları, gecikmeleri ve geri çekilme (back-off) algoritmalarını içermelidir. Senkron HTTP istek–yanıt işlemleri için kısa zaman aşımı süreleri zorunlu tutulmalı ve tekrar eden denemeler devre dışı bırakılmalı ya da sıkı şekilde sınırlandırılmalıdır.FalseFalseTrue✓V13.1.44Uygulamanın, güvenlik açısından kritik olan gizli verileri tanımladığı ve kuruluşun tehdit modeli ve iş ihtiyaçlarına göre bu verilerin döndürülme (rotation) zamanlamasının belgelendiği doğrulanmalıdır.FalseFalseTrue✓V13.22Backend İletişim KonfigürasyonuV13.2.11Uygulamanın, standart kullanıcı oturum mekanizmasını desteklemeyen backend bileşenleri (örneğin API'ler, ara katmanlar, veri katmanları) arasında gerçekleşen iletişimlerin kimlik doğrulamasıyla korunduğu doğrulanmalıdır. Kimlik doğrulama; bireysel hizmet hesapları, kısa ömürlü token'lar ya da sertifika tabanlı kimlik doğrulama ile yapılmalıdır ve parola, API anahtarı ya da ayrıcalıklı erişime sahip paylaşımlı hesaplar gibi sabit kimlik bilgileri kullanılmamalıdır.FalseTrue✓True✓V13.2.22Uygulamanın backend bileşenleri arasında (yerel hizmetler, işletim sistemi hizmetleri, API'ler, ara katmanlar ve veri katmanları dahil) gerçekleştirilen iletişimlerin, yalnızca gerekli en az ayrıcalığa sahip hesaplarla yapıldığı doğrulanmalıdır.FalseTrue✓True✓V13.2.33Bir hizmet kimlik doğrulaması için bir kimlik bilgisi kullanılması gerekiyorsa, bu kimlik bilgisinin varsayılan bir değer (örneğin root/root veya admin/admin) olmadığının doğrulanması gereklidir.FalseTrue✓True✓V13.2.44Uygulamanın iletişim kurmasına izin verilen dış kaynaklar ya da sistemlerin, bir allowlist (izinli liste) ile tanımlandığı doğrulanmalıdır. Bu liste, uygulama katmanında, web sunucusunda, güvenlik duvarında veya farklı katmanların birleşiminde uygulanabilir.FalseTrue✓True✓V13.2.55Web veya uygulama sunucusunun, dış sistemlere veri veya dosya gönderimi veya yüklemesi yaparken sadece belirli kaynaklara izin verecek şekilde allowlist ile yapılandırıldığı doğrulanmalıdır.FalseTrue✓True✓V13.2.66Uygulamanın farklı hizmetlere bağlantı kurduğu durumlarda, bu bağlantılar için belgelenmiş yapılandırmaları (örn. maksimum eşzamanlı bağlantı, bağlantı limiti aşıldığında davranış, zaman aşımı, tekrar deneme stratejileri) takip ettiğinin doğrulanması gereklidir.FalseFalseTrue✓V13.33Gizli Bilgi YönetimiV13.3.11Parolalar, anahtar materyalleri, veritabanı ve üçüncü parti sistemlerle entegrasyon bilgileri, zaman tabanlı token'lar için tohum (seed) bilgileri, dahili gizli veriler ve API anahtarları gibi backend sırlarının güvenli bir şekilde oluşturulması, saklanması, erişim denetiminin sağlanması ve imha edilmesi için bir gizli bilgi yönetim çözümünün (örneğin key vault) kullanıldığı doğrulanmalıdır. Bu gizli bilgiler uygulama kaynak koduna dahil edilmemeli ve yapı çıktılarında yer almamalıdır. Seviye 3 uygulamalar için donanım destekli bir çözüm (örneğin HSM) gereklidir.FalseTrue✓True✓V13.3.22Gizli bilgilere erişimin en az ayrıcalık prensibine uygun şekilde yapılandırıldığı doğrulanmalıdır.FalseTrue✓True✓V13.3.33Tüm kriptografik işlemlerin, anahtar materyallerinin güvenli bir şekilde yönetilmesi ve dışarıya sızmasının engellenmesi amacıyla, izole edilmiş bir güvenlik modülü (örneğin vault ya da donanım güvenlik modülü) aracılığıyla gerçekleştirildiği doğrulanmalıdır.FalseFalseTrue✓V13.3.44Uygulamanın belgelerinde belirtildiği şekilde gizli bilgilerin süresinin dolacak şekilde yapılandırıldığı ve düzenli olarak döndürüldüğü doğrulanmalıdır.FalseFalseTrue✓V13.44İstenmeyen Bilgi SızıntısıV13.4.11Uygulamanın .git veya .svn klasörleri gibi kaynak kontrolüyle ilgili metadata içermeyecek şekilde deploy edildiğini ya da bu klasörlerin hem dış erişime hem de uygulama erişimine kapalı olduğu doğrulanmalıdır.True✓True✓True✓V13.4.22Tüm bileşenler için üretim ortamlarında hata ayıklama (debug) modlarının devre dışı bırakıldığı doğrulanmalıdır.FalseTrue✓True✓V13.4.33Web sunucularının, açık şekilde istenmediği sürece dizin listelemesi (directory listing) özelliğini istemcilere sunmadığı doğrulanmalıdır.FalseTrue✓True✓V13.4.44HTTP TRACE metodunun üretim ortamlarında desteklenmediği, böylece potansiyel bilgi sızıntılarının önlendiği doğrulanmalıdır.FalseTrue✓True✓V13.4.55Belgeler (örneğin dahili API belgeleri) ve izleme uç noktalarının (monitoring endpoints) yalnızca açıkça belirtildiği durumlarda erişilebilir olduğu doğrulanmalıdır.FalseTrue✓True✓V13.4.66Uygulamanın arka uç bileşenlerinin ayrıntılı sürüm bilgilerini ifşa etmediği doğrulanmalıdır.FalseFalseTrue✓V13.4.77Web katmanının yalnızca belirli dosya uzantılarına sahip dosyaları sunacak şekilde yapılandırıldığı, bu sayede istem dışı bilgi, yapılandırma ya da kaynak kod sızıntılarının önlendiği doğrulanmalıdır.FalseFalseTrue✓V1414DataVeri KorumaV14.11Veri Koruma DokümantasyonuV14.1.11Uygulama tarafından oluşturulan ve işlenen tüm hassas verilerin tanımlanıp, koruma seviyelerine göre sınıflandırıldığından emin olun. Bu, yalnızca kodlanmış (örneğin Base64 stringleri ya da JWT içindeki düz metin yükler gibi) ve bu nedenle kolayca çözülebilir verileri de içermelidir. Koruma seviyeleri, uygulamanın uymakla yükümlü olduğu veri koruma ve gizlilik düzenlemeleri ile standartlarını dikkate almalıdır.FalseTrue✓True✓V14.1.22Tüm hassas veri koruma seviyeleri için belgelenmiş bir koruma gereksinimleri seti tanımlandığından emin olun. Bu gereksinimler genel şifreleme, bütünlük doğrulama, saklama süresi, verinin nasıl günlüğe kaydedileceği, günlüklerdeki hassas verilere erişim kontrolleri, veritabanı düzeyinde şifreleme, gizlilik ve gizliliği artırıcı teknolojiler ile diğer gizlilik gereksinimlerini kapsamalıdır.FalseTrue✓True✓V14.22Genel Veri KorumasıV14.2.11Hassas verilerin yalnızca HTTP message body veya header alanlarında sunucuya gönderildiği ve URL ile sorgu parametrelerinin, API anahtarı veya session token’ı gibi hassas bilgiler içermediği doğrulanmalıdır.True✓True✓True✓V14.2.22Hassas verilerin, yük dengeleyiciler ve uygulama önbellekleri gibi sunucu bileşenlerinde önbelleğe alınmasının engellendiği veya kullanım sonrası bu verilerin güvenli biçimde temizlendiği doğrulanmalıdır.FalseTrue✓True✓V14.2.33Uygulama kontrolü dışında veri toplanmasını engellemek için, tanımlanmış hassas verilerin, kullanıcı izleyicileri gibi güvensiz taraflara gönderilmediği doğrulanmalıdır.FalseTrue✓True✓V14.2.44Hassas verilere yönelik şifreleme, bütünlük doğrulama, veri saklama, loglama yöntemi, loglardaki erişim kontrolleri, gizlilik teknolojileri gibi kontrollerin, söz konusu verinin belgelenmiş koruma seviyesinde tanımlandığı şekilde uygulandığı doğrulanmalıdır.FalseTrue✓True✓V14.2.55Önbellekleme mekanizmalarının yalnızca belirli içerik türüne sahip yanıtları önbelleğe alacak şekilde yapılandırıldığı ve hassas, dinamik içeriklerin önbelleğe alınmadığı doğrulanmalıdır. Web sunucusu, mevcut olmayan bir dosya talebinde geçerli ama farklı bir dosya döndürmek yerine 404 veya 302 cevabı vermelidir. Bu, Web Cache Deception saldırılarını önlemeye yardımcı olur.FalseFalseTrue✓V14.2.66Uygulamanın yalnızca işlevsellik için gerekli olan asgari hassas veriyi döndürdüğü doğrulanmalıdır. Örneğin, kredi kartı numarasının yalnızca bazı rakamlarının döndürülmesi; tam numaranın döndürülmesi gerekiyorsa, kullanıcı arayüzünde gizlenmiş (maskelenmiş) şekilde sunulması gerekir, aksi kullanıcı özel olarak görüntülemek istemedikçe gösterilmemelidir.FalseFalseTrue✓V14.2.77Hassas bilgilerin, veri saklama sınıflandırmasına tabi tutulduğu, geçerliliğini yitirmiş veya artık gerekli olmayan verilerin belirlenmiş bir zaman çizelgesiyle ya da gerektiğinde otomatik olarak silindiği doğrulanmalıdır.FalseFalseTrue✓V14.2.88Kullanıcı tarafından yüklenen dosyaların meta verilerinden hassas bilgilerin çıkarıldığı veya bu bilgilerin yalnızca kullanıcıdan açık onay alındığında saklandığı doğrulanmalıdır.FalseFalseTrue✓V14.33İstemci Tarafı Veri KorumasıV14.3.11Kimliği doğrulanmış verilerin, istemci veya oturum sonlandığında istemci depolamasından (örneğin tarayıcı DOM’undan) temizlendiği doğrulanmalıdır. 'Clear-Site-Data' HTTP response header bu konuda yardımcı olabilir ancak istemci tarafı, sunucu bağlantısı mevcut olmadığında da temizlik işlemini yapabiliyor olmalıdır.True✓True✓True✓V14.3.22Uygulamanın, tarayıcılarda hassas verilerin önbelleğe alınmasını önlemek amacıyla yeterli anti-önbellekleme HTTP response header (örneğin Cache-Control: no-store) ayarladığı doğrulanmalıdır.FalseTrue✓True✓V14.3.33Tarayıcıda depolanan verilerin (örneğin localStorage, sessionStorage, IndexedDB veya çerezler) hassas veri içermediği, yalnızca session token’larının istisna olarak kabul edildiği doğrulanmalıdır.FalseTrue✓True✓V1515SecureGüvenli Kodlama ve MimariV15.11Güvenli Kodlama ve Mimari DokümantasyonuV15.1.11Güvenlik açığı içeren üçüncü taraf bileşen sürümleri ve genel olarak kütüphane güncellemeleri için, uygulama dokümantasyonunda risk bazlı düzeltme zamanlarının tanımlandığı doğrulanmalıdır.True✓True✓True✓V15.1.22Yazılım bileşen listesi (Software Bill of Materials - SBOM) gibi bir envanterin tutulduğu, kullanılan tüm üçüncü taraf kütüphanelerin önceden tanımlanmış, güvenilir ve düzenli olarak güncellenen depolardan alındığı doğrulanmalıdır.FalseTrue✓True✓V15.1.33Uygulama dokümantasyonunda zaman veya kaynak açısından yoğun işlevlerin tanımlandığı, bu işlevlerin aşırı kullanımı durumunda kullanılabilirlik kaybının nasıl önleneceği ve yanıt oluşturma süresinin istemci zaman aşımını aşmaması için hangi önlemlerin alındığı belirtilmelidir. Örnek savunmalar kuyruklama, eşzamansız işleme, kullanıcı başına ve uygulama genelinde paralel işlem sınırlarını içerebilir.FalseTrue✓True✓V15.1.44Uygulama dokümantasyonunda "riskli bileşenler" olarak değerlendirilen üçüncü taraf kütüphanelerin vurgulandığı doğrulanmalıdır.FalseFalseTrue✓V15.1.55Uygulama dokümantasyonunda "tehlikeli işlevsellik" içeren uygulama bölümlerinin açıkça belirtildiği doğrulanmalıdır.FalseFalseTrue✓V15.22Güvenlik Mimarisi ve BağımlılıklarV15.2.11Uygulamanın yalnızca, belgelenmiş güncelleme ve düzeltme sürelerini aşmamış bileşenleri içerdiği doğrulanmalıdır.True✓True✓True✓V15.2.22Uygulamanın, belgelenmiş güvenlik kararları ve stratejilere dayanarak, zaman veya kaynak açısından yoğun işlevlerin neden olabileceği kullanılabilirlik kaybına karşı savunmalar uyguladığı doğrulanmalıdır.FalseTrue✓True✓V15.2.33Üretim ortamının yalnızca uygulamanın çalışması için gerekli işlevleri içerdiği ve test kodları, örnek kod parçaları veya geliştirme işlevleri gibi gereksiz işlevsellikleri açığa çıkarmadığı doğrulanmalıdır.FalseTrue✓True✓V15.2.44Üçüncü taraf bileşenlerin ve bunların tüm transitif bağımlılıklarının beklenen depolardan (iç kaynaklı ya da harici) alındığı ve bağımlılık karışıklığı (dependency confusion) saldırılarına açık olmadığı doğrulanmalıdır.FalseFalseTrue✓V15.2.55Uygulamanın, “tehlikeli işlevsellik” içeren veya “riskli bileşenler” kullanan bölümlerine ek korumalar uyguladığı doğrulanmalıdır. Bu korumalar sandbox, kapsülleme, konteynerleştirme veya ağ düzeyinde izolasyon gibi teknikler aracılığıyla, bir uygulama bölümünün ele geçirilmesi durumunda saldırganın diğer bölümlere sıçramasını geciktirmeyi veya engellemeyi amaçlamalıdır.FalseFalseTrue✓V15.33Savunmacı KodlamaV15.3.11Uygulamanın yalnızca gerekli alanların bir alt kümesini veri nesnesinden döndürdüğü doğrulanmalıdır. Örneğin, bazı alanlara kullanıcıların erişmemesi gerektiğinden tüm veri nesnesi döndürülmemelidir.True✓True✓True✓V15.3.22Uygulama backend'i harici URL’lere çağrı yaptığında, yalnızca amaçlanan işlevsellik söz konusuysa yönlendirmeleri takip edecek şekilde yapılandırıldığının doğrulanması gerekir.FalseTrue✓True✓V15.3.33Uygulamanın, kitlesel atama saldırılarına karşı, her bir controller ve eylem için izin verilen alanları sınırlandırarak savunmalar sağladığı doğrulanmalıdır. Örneğin, bir alan değeri, bu işlemde değiştirilmesi amaçlanmadıysa eklenememeli veya güncellenememelidir.FalseTrue✓True✓V15.3.44Tüm proxy ve ara katman bileşenlerinin kullanıcının orijinal IP adresini, uç kullanıcı tarafından değiştirilemeyecek güvenilir veri alanları kullanarak doğru şekilde ilettiği ve uygulamanın ve web sunucusunun bu doğru değeri, loglama ve hız sınırlama gibi güvenlik kararları için kullandığı doğrulanmalıdır. Ayrıca, orijinal IP adresinin bile dinamik IP'ler, VPN'ler veya kurumsal güvenlik duvarları nedeniyle güvenilir olmayabileceği dikkate alınmalıdır.FalseTrue✓True✓V15.3.55Uygulamanın değişkenlerin doğru türde olduğunu açıkça doğruladığı ve sıkı eşitlik ve karşılaştırma işlemleri kullandığı doğrulanmalıdır. Bu, değişken türüyle ilgili varsayımlardan kaynaklanan tür oynama (type juggling) veya tür karışıklığı (type confusion) güvenlik açıklarını önlemek içindir.FalseTrue✓True✓V15.3.66JavaScript kodunun prototip zehirleme (prototype pollution) saldırılarını önleyecek şekilde yazıldığı, örneğin, nesne literal’leri yerine Set() veya Map() gibi yapılar kullanıldığı doğrulanmalıdır.FalseTrue✓True✓V15.3.77Uygulamanın, özellikle framework'ün istek parametrelerinin kaynağı (sorgu dizgisi, gövde parametreleri, çerezler veya başlık alanları) arasında ayrım yapmadığı durumlarda, HTTP parametre kirliliği (HTTP parameter pollution) saldırılarına karşı savunmalar uyguladığı doğrulanmalıdır.FalseTrue✓True✓V15.44Güvenli Eş Zamanlılık (Concurrency)V15.4.11Çok iş parçacıklı kodda (örneğin cache'ler, dosyalar veya birden fazla iş parçacığı tarafından erişilen bellek içi nesneler gibi) paylaşılan nesnelere yalnızca thread-safe (iş parçacığı güvenli) türler ve kilitleme (lock) veya semaphore gibi senkronizasyon mekanizmaları kullanılarak erişildiği doğrulanmalıdır. Bu, yarış durumlarını ve veri bozulmasını önlemeye yöneliktir.FalseFalseTrue✓V15.4.22Bir kaynağın durumu üzerindeki kontroller (örneğin varlığı ya da izinleri gibi) ile bu kontrole bağlı eylemlerin tek bir atomik işlem olarak gerçekleştirildiği doğrulanmalıdır. Bu, TOCTOU (time-of-check to time-of-use) yarış durumlarını önlemeye yöneliktir. Bir dosyanın varlığının kontrol edilip ardından açılması veya bir kullanıcının erişiminin doğrulanıp ardından yetki verilmesi gibi işlemler buna örnektir.FalseFalseTrue✓V15.4.33Kilitlerin (locks) tutarlı biçimde kullanıldığı, iş parçacıklarının birbirini beklemesi ya da sonsuz döngüye girmesi (deadlock veya livelock) gibi durumların önlendiği doğrulanmalıdır. Ayrıca, kilitleme mantığı, kaynağı yöneten kod içinde kalmalı ve dış sınıflar veya dış kodlar tarafından istemeden veya kötü niyetli şekilde değiştirilememelidir.FalseFalseTrue✓V15.4.44Kaynak tahsis politikalarının, iş parçacığı açlığını önleyecek şekilde, kaynaklara adil erişimi sağladığı doğrulanmalıdır. Örneğin, thread pool (iş parçacığı havuzu) kullanımı, düşük öncelikli iş parçacıklarının da makul sürelerde çalışabilmesi için uygulanmalıdır.FalseFalseTrue✓V1616SecurityGüvenlik Günlüklemesi (Logging) ve Hata YönetimiV16.11Güvenlik Loglaması DokümantasyonuV16.1.11Uygulamanın teknoloji yığını boyunca her katmanda hangi olayların loglandığını, log formatlarını, logların nereye yazıldığını, nasıl kullanıldığını, erişimin nasıl kontrol edildiğini ve logların ne kadar süre saklandığını belgeleyen bir envanterin mevcut olduğu doğrulanmalıdır.FalseTrue✓True✓V16.22Genel LoglamaV16.2.11Her bir log girdisinin, olayın ne zaman, nerede, kim tarafından ve ne olduğuna dair detaylı bir zaman çizelgesi oluşturulmasına olanak tanıyacak gerekli meta verileri içerdiği doğrulanmalıdır.FalseTrue✓True✓V16.2.22Tüm loglama bileşenlerinin zaman kaynaklarının senkronize olduğu ve güvenlik olayı meta verisindeki zaman damgalarının UTC kullanarak ya da açık zaman dilimi ofsetiyle belirtildiği doğrulanmalıdır. UTC kullanımı, özellikle yaz saati uygulamaları nedeniyle oluşabilecek karışıklıkları önlemek için tavsiye edilir.FalseTrue✓True✓V16.2.33Uygulamanın yalnızca log envanterinde belgelenmiş dosya ve hizmetlere log yazdığı ya da ilettiği doğrulanmalıdır.FalseTrue✓True✓V16.2.44Logların kullanılan log işleyici (log processor) tarafından okunabildiği ve ilişkilendirilebildiği doğrulanmalıdır. Tercihen yaygın bir log formatı kullanılmalıdır.FalseTrue✓True✓V16.2.55Hassas veriler loglanırken, uygulamanın veri koruma seviyesine uygun olarak loglama yaptığı doğrulanmalıdır. Örneğin kimlik bilgileri veya ödeme detayları gibi bazı verilerin loglanmasına izin verilmemelidir. Session token’ları gibi veriler ise yalnızca tamamen ya da kısmen maskelenmiş ya da hash’lenmiş olarak loglanmalıdır.FalseTrue✓True✓V16.33Güvenlik OlaylarıV16.3.11Tüm kimlik doğrulama işlemlerinin (başarılı ve başarısız girişimler dahil) loglandığı doğrulanmalıdır. Kullanılan kimlik doğrulama türü veya faktörleri gibi ek meta veriler de toplanmalıdır.FalseTrue✓True✓V16.3.22Başarısız yetkilendirme girişimlerinin loglandığı doğrulanmalıdır. Seviye 3 uygulamalar için, tüm yetkilendirme kararlarının ve hassas verilere erişim olaylarının (verinin kendisi olmadan) loglandığı da doğrulanmalıdır.FalseTrue✓True✓V16.3.33Uygulamanın, belgelenmiş güvenlik olaylarını ve güvenlik kontrollerini aşma girişimlerini (girdi doğrulama, iş mantığı, otomasyon karşıtı kontroller vb.) logladığı doğrulanmalıdır.FalseTrue✓True✓V16.3.44Beklenmeyen hatalar ve güvenlik kontrolü başarısızlıkları (örneğin backend TLS hataları gibi) loglandığı doğrulanmalıdır.FalseTrue✓True✓V16.44Log KorumasıV16.4.11Tüm loglama bileşenlerinin, log enjeksiyonunu (log injection) önlemek amacıyla verileri uygun biçimde encode ettiği doğrulanmalıdır.FalseTrue✓True✓V16.4.22Logların yetkisiz erişime karşı korunduğu ve değiştirilemez olduğu doğrulanmalıdır.FalseTrue✓True✓V16.4.33Logların analiz, tespit, uyarı ve yükseltme amacıyla mantıksal olarak ayrı bir sisteme güvenli biçimde iletildiği doğrulanmalıdır. Böylece uygulama ihlal edilse bile logların tehlikeye girmesi önlenmiş olur.FalseTrue✓True✓V16.55Hata YönetimiV16.5.11Beklenmedik ya da güvenlikle ilgili bir hata oluştuğunda, tüketiciye genel bir mesaj döndürüldüğü ve yığın izleri (stack trace), sorgular, gizli anahtarlar, token’lar gibi hassas sistem içi verilerin açıklanmadığı doğrulanmalıdır.FalseTrue✓True✓V16.5.22Uygulamanın, dış kaynaklara erişim başarısız olduğunda bile güvenli şekilde çalışmaya devam ettiği doğrulanmalıdır. Örneğin, circuit breaker ya da graceful degradation gibi desenler kullanılmalıdır.FalseTrue✓True✓V16.5.33Uygulamanın hata durumlarında güvenli ve düzenli şekilde başarısız olduğu doğrulanmalıdır. Bu, örneğin doğrulama hatalarına rağmen işlemlerin işlenmesine yol açabilecek fail-open durumlarını önlemelidir.FalseTrue✓True✓V16.5.44Ele alınmamış tüm istisnaları yakalayacak şekilde tanımlanmış bir “son çare hata yöneticisi” bulunduğu doğrulanmalıdır. Bu, hem loglara gitmesi gereken hata detaylarının kaybolmaması hem de tüm uygulama sürecinin çökerek hizmet dışı kalmasının önlenmesi açısından önemlidir.FalseFalseTrue✓V1717WebRTCWebRTCV17.11TURN SunucusuV17.1.11TURN hizmetinin yalnızca özel amaçlar için ayrılmamış IP adreslerine (ör. iç ağlar, yayın adresleri, loopback) erişime izin verdiği doğrulanmalıdır. Bu gereksinim hem IPv4 hem de IPv6 adresleri için geçerlidir.FalseTrue✓True✓V17.1.22TURN hizmetinin, meşru kullanıcıların sunucuda çok sayıda bağlantı noktası açmaya çalışması durumunda kaynak tüketimi saldırılarına karşı dayanıklı olduğu doğrulanmalıdır.FalseFalseTrue✓V17.22MedyaV17.2.11DTLS sertifikası anahtarının, belgelenmiş kriptografik anahtar yönetim politikasına uygun şekilde yönetildiği ve korunduğu doğrulanmalıdır.FalseTrue✓True✓V17.2.22Medya sunucusunun onaylı DTLS şifre takımlarını (cipher suites) ve Güvenli Gerçek Zamanlı Aktarım Protokolü (Secure Real-time Transport Protocol - SRTP) için anahtarlar oluşturmaya yönelik DTLS Uzantısı için güvenli bir koruma profilini kullanacak ve destekleyecek şekilde yapılandırıldığı (DTLS-SRTP) doğrulanmalıdır.FalseTrue✓True✓V17.2.33Real-time Transport Protocol (RTP) injection saldırılarının bir hizmet reddi durumuna veya medya akışlarına ses veya video medyası eklenmesine yol açmasını önlemek için medya sunucusunda Güvenli SRTP kimlik doğrulamasının kontrol edildiği doğrulanmalıdır.FalseTrue✓True✓V17.2.44Verify that the media server is able to continue processing incoming media traffic when encountering malformed Secure Real-time Transport Protocol (SRTP) packets.FalseTrue✓True✓V17.2.55Medya sunucusunun, meşru kullanıcılardan gelen SRTP flood'ı sırasında gelen medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.FalseFalseTrue✓V17.2.66Medya sunucusunun DTLS içinde yer alan "ClientHello" yarış durumu güvenlik açığına karşı savunmasız olmadığı, medya sunucusunun güvenlik açığına sahip olduğunun açıkça bilinip bilinmediği kontrol edilerek veya yarış koşulu testi gerçekleştirilerek doğrulanmalıdır.FalseFalseTrue✓V17.2.77Medya sunucusuna bağlı ses veya video kayıt mekanizmalarının, meşru kullanıcı kaynaklı SRTP flood'ı sırasında medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.FalseFalseTrue✓V17.2.88DTLS sertifikasının, SDP (Session Description Protocol) fingerprint özelliği ile karşılaştırıldığı ve doğrulama başarısız olursa medya akışının sonlandırıldığı, medya akışının özgünlüğünü sağlamak için doğrulanmalıdır.FalseFalseTrue✓V17.33SinyalizasyonV17.3.11Sinyalizasyon sunucusunun, flood saldırısı altında bile meşru sinyalizasyon mesajlarını işlemeye devam edebildiği doğrulanmalıdır. Bu, sinyalizasyon düzeyinde oran sınırlaması uygulanarak sağlanmalıdır.FalseTrue✓True✓V17.3.22Sinyalizasyon sunucusunun, hizmet reddine yol açabilecek şekilde yapılandırılmış bozuk sinyalizasyon mesajlarıyla karşılaştığında bile meşru mesajları işlemeye devam edebildiği doğrulanmalıdır. Bu, girdi doğrulaması, integer overflow ve buffer overflow'a karşı savunma ve sağlam hata işleme teknikleri ile sağlanmalıdır.FalseTrue✓True✓ diff --git a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.xml b/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.xml deleted file mode 100644 index 2b8087fa93..0000000000 --- a/5.0/docs_tr/OWASP_Application_Security_Verification_Standard_5.0.0_tr.xml +++ /dev/null @@ -1 +0,0 @@ -Application Security Verification Standard ProjectASVSThe OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.V11EncodingKodlama (Encoding) ve TemizlemeV1.11Kodlama ve Temizleme MimarisiV1.1.11Girdinin yalnızca bir kez kanonik forma (canonical form) çözümlendiği veya kaçış işlemlerinin kaldırıldığı, bu işlemin yalnızca verinin bu biçimde beklenmesi durumunda yapıldığı ve bu işlemin girdi doğrulama veya temizleme işlemlerinden sonra değil, önce gerçekleştiği doğrulanmalıdır.2V1.1.22Uygulamanın, çıktıyı kullanılması gereken yorumlayıcıya verilmeden hemen önce veya yorumlayıcının kendisi tarafından çıktı kodlaması ya da kaçış işlemi yaptığı doğrulanmalıdır.2V1.22Enjeksiyon ÖnlemeV1.2.11HTTP yanıtı, HTML veya XML belgesi için yapılan çıktı kodlamasının; HTML elemanları, HTML öznitelikleri, HTML yorumları, CSS ya da HTTP başlık alanları gibi bağlamlara uygun olduğu doğrulanmalıdır. Böylece mesaj veya belge yapısının bozulması önlenir.1V1.2.22Dinamik olarak URL oluşturulurken, güvenilmeyen verinin bağlamına göre (örneğin, sorgu veya yol parametreleri için URL kodlaması ya da base64url kodlaması) kodlandığı doğrulanmalıdır. Yalnızca güvenli URL protokollerine izin verilmelidir (örneğin, javascript: veya data: yasaklanmalıdır).1V1.2.33JavaScript içeriği (JSON dahil) dinamik olarak oluşturulurken çıktı kodlama/kaçış kullanıldığı doğrulanmalıdır. Böylece mesaj veya belge yapısı değiştirilmemiş olur (JavaScript ve JSON enjeksiyonlarının önüne geçilir).1V1.2.44Veri sorguları veya veritabanı sorguları (SQL, HQL, NoSQL, Cypher vb.) için parametreli sorgular, ORM’ler, entity framework’ler kullanıldığı ya da SQL enjeksiyonu ve diğer veritabanı enjeksiyon saldırılarına karşı koruma sağlandığı doğrulanmalıdır. Bu durum, saklı yordam (stored procedure) yazarken de geçerlidir.1V1.2.55Uygulamanın işletim sistemi komut enjeksiyonlarına karşı korunduğu ve işletim sistemi çağrılarında parametreli OS sorguları veya bağlama özgü komut satırı çıktı kodlamasının kullanıldığı doğrulanmalıdır.1V1.2.66Uygulamanın LDAP enjeksiyon zafiyetlerine karşı korunduğu ya da LDAP enjeksiyonlarını önlemek için özel güvenlik kontrollerinin uygulandığı doğrulanmalıdır.2V1.2.77XPath enjeksiyon saldırılarına karşı, sorgu parametrelemesi veya önceden derlenmiş sorgular kullanılarak koruma sağlandığı doğrulanmalıdır.2V1.2.88LaTeX işlemcilerinin güvenli şekilde yapılandırıldığı (örneğin, --shell-escape bayrağının kullanılmadığı) ve yalnızca izin verilen komutlardan oluşan bir listeyle çalıştırıldığı doğrulanmalıdır.2V1.2.99Düzenli ifadelerde (regex) özel karakterlerin (genellikle ters eğik çizgi \ ile) kaçırılarak meta karakter olarak yorumlanmalarının önlendiği doğrulanmalıdır.2V1.2.1010Uygulamanın CSV ve formül enjeksiyonlarına karşı korunduğu doğrulanmalıdır. Uygulama, CSV içeriği dışa aktarırken RFC 4180 Bölüm 2.6 ve 2.7'de tanımlanan kaçış kurallarına uymalıdır. Ayrıca, CSV veya diğer tablo formatlarına (XLS, XLSX, ODF gibi) aktarım yapılırken, alanın ilk karakteri olarak çıkan özel karakterler ('=', '+', '-', '@', '\t' (sekme), '\0' (null karakter)) tek tırnak (') ile kaçırılmalıdır.3V1.33Temizleme (Sanitization)V1.3.11WYSIWYG editörlerinden veya benzer kaynaklardan gelen tüm güvenilmeyen HTML girdilerinin, bilinen ve güvenli bir HTML temizleme kütüphanesi ya da çerçeve özelliği ile temizlendiği doğrulanmalıdır.1V1.3.22Uygulamanın eval() veya Spring Expression Language (SpEL) gibi dinamik kod çalıştırma özelliklerini kullanmaktan kaçındığı doğrulanmalıdır. Alternatif yoksa, kullanıcı girdisi çalıştırılmadan önce mutlaka temizlenmelidir.1V1.3.33Potansiyel olarak tehlikeli bir bağlamda kullanılacak verilerin, bu bağlama uygun karakterlere izin vermek ve çok uzun girdileri kısaltmak gibi güvenlik önlemleriyle önceden temizlendiği doğrulanmalıdır.2V1.3.44Kullanıcı tarafından sağlanan SVG içeriğinin, yalnızca güvenli etiket ve özellikler (örneğin grafik çizme ile ilgili) içerdiğinden emin olmak için onaylandığı veya temizlendiği doğrulanmalıdır (ör. script veya foreignObject içermemelidir).2V1.3.55Markdown, CSS, XSL stil sayfaları, BBCode veya benzeri ifade şablon dillerinde kullanıcı girdisinin temizlendiği veya bu tür özelliklerin devre dışı bırakıldığı doğrulanmalıdır.2V1.3.66Uygulamanın, güvenilmeyen verileri başka servislere iletmeden önce izinli protokol, alan adı, yol ve port listelerine göre doğruladığı ve tehlikeli karakterleri temizlediği doğrulanarak SSRF (Sunucu Taraflı İstek Sahteciliği) saldırılarına karşı korunduğu doğrulanmalıdır.2V1.3.77Uygulamanın şablon enjeksiyon saldırılarına karşı, güvenilmeyen girdilere dayalı şablon oluşturmayı engellediği; eğer bu kaçınılmazsa, bu girdilerin mutlaka temizlendiği veya sıkı şekilde onaylandığı doğrulanmalıdır.2V1.3.88JNDI sorgularında kullanılmadan önce güvenilmeyen girdilerin temizlendiği ve JNDI'nin enjeksiyonlara karşı güvenli şekilde yapılandırıldığı doğrulanmalıdır.2V1.3.99Memcache’e gönderilmeden önce içeriğin temizlenerek enjeksiyon saldırılarına karşı korunduğu doğrulanmalıdır.2V1.3.1010Format dizgilerinin (format strings) beklenmeyen veya zararlı şekilde çözümlenmesini önlemek için işlenmeden önce temizlendiği doğrulanmalıdır.2V1.3.1111SMTP veya IMAP enjeksiyonlarını önlemek için, kullanıcı girdisinin posta sistemlerine iletilmeden önce temizlendiği doğrulanmalıdır.2V1.3.1212Regex girdilerinin üstel geri izlemeye (exponential backtracking) neden olan öğeler içermediği ve güvenilmeyen girdilerin ReDoS (Regex Denial of Service) gibi saldırılara karşı temizlendiği doğrulanmalıdır.3V1.44Bellek, Dizgi ve Yönetilmeyen KodV1.4.11Yığın, arabellek (buffer) veya yığın belleği taşmalarını önlemek ya da tespit etmek amacıyla, bellek güvenli dizgi işlemlerinin, daha güvenli bellek kopyalama ve işaretçi aritmetiğinin kullanıldığı doğrulanmalıdır.2V1.4.22Tamsayı taşmalarını önlemek için işaret (sign), aralık (range) ve giriş doğrulama tekniklerinin kullanıldığı doğrulanmalıdır.2V1.4.33Dinamik olarak ayrılan belleğin ve kaynakların serbest bırakıldığı ve boşaltılan belleklere ait referansların veya işaretçilerin kaldırıldığı veya null yapıldığı doğrulanmalıdır (dangling pointer ve use-after-free zafiyetlerine karşı).2V1.55Güvenli Ters Serileştirme (Safe Deserialization)V1.5.11XML ayrıştırıcılarının (parser) kısıtlayıcı şekilde yapılandırıldığı ve dış varlık çözümleme (external entity resolution) gibi güvensiz özelliklerin XXE (XML eXternal Entity) saldırılarına karşı devre dışı bırakıldığı doğrulanmalıdır .1V1.5.22Güvenilmeyen verilerin ters serileştirilmesinde, nesne türleri için izinli liste kullanımı veya istemci tanımlı nesne türlerinin kısıtlanması gibi güvenli giriş işleme önlemlerinin uygulandığı doğrulanmalıdır. Güvensiz olarak tanımlanmış ters serileştirme mekanizmaları, güvenilmeyen girdilerle kullanılmamalıdır.2V1.5.33Aynı veri türü için uygulamada kullanılan farklı parser'ların (ör. JSON, XML, URL parser'ları), veriyi tutarlı şekilde ayrıştırdığı ve aynı karakter kodlamasını kullandığı doğrulanmalıdır. Böylece JSON birlikte çalışabilirlik açıkları, URI veya dosya ayrıştırma farkları gibi sorunlar nedeniyle RFI veya SSRF saldırılarının istismar edilmesi önlenir.3V22ValidationDoğrulama ve İş MantığıV2.11Doğrulama ve İş Mantığı DokümantasyonuV2.1.11Uygulama dokümantasyonunda, veri öğelerinin beklenen yapıya göre nasıl doğrulanacağına ilişkin giriş doğrulama kurallarının tanımlandığı doğrulanmalıdır. Bu; kredi kartı numaraları, e-posta adresleri, telefon numaraları gibi yaygın veri biçimleri olabileceği gibi iç sistemlere özel biçimler de olabilir.1V2.1.22Uygulama dokümantasyonunda, birleştirilmiş veri öğelerinin mantıksal ve bağlamsal tutarlılığının nasıl doğrulanacağı tanımlanmalıdır (örneğin, mahalle ve posta kodunun eşleşip eşleşmediğinin kontrolü).2V2.1.33Hem kullanıcı bazında hem de uygulama genelinde geçerli olacak şekilde, iş mantığı sınırları ve doğrulama beklentilerinin belgelendiği doğrulanmalıdır.2V2.22Girdi DoğrulamaV2.2.11Girdilerin, işlevsel ya da iş gereksinimlerine uygunluğunun doğrulandığı teyit edilmelidir. Bu işlem; izinli değerler, desenler ve aralıklar listesine karşı pozitif doğrulama ile ya da girdinin beklenen yapıya ve mantıksal sınırlara uygunluğunun önceden tanımlanmış kurallara göre karşılaştırılması ile yapılmalıdır. Seviye 1 için bu, güvenlik veya iş kararlarında kullanılan girdilere odaklanabilir. Seviye 2 ve üstü için tüm girdilere uygulanmalıdır.1V2.2.22Uygulamanın, güvenilir bir servis katmanında girdi doğrulama zorunluluğu uygulayacak şekilde tasarlandığı doğrulanmalıdır. İstemci tarafında gerçekleştirilen doğrulama, kullanılabilirliği artırabilir ve teşvik edilmelidir. Ancak bu doğrulama,güvenlik kontrolü olarak kabul edilmemelidir.1V2.2.33Uygulamanın, ilişkili veri öğelerinin önceden tanımlanmış kurallara göre makul olup olmadığını kontrol ettiği doğrulanmalıdır.2V2.33İş Mantığı GüvenliğiV2.3.11Uygulamanın, aynı kullanıcı için iş mantığı akışlarını yalnızca beklenen adım sırasına göre ve adım atlamadan işlediği doğrulanmalıdır.1V2.3.22İş mantığı sınırlarının, uygulama dokümantasyonuna uygun şekilde uygulandığı doğrulanmalıdır.2V2.3.33İş mantığı seviyesinde işlemlerin (transaction) kullanıldığı ve bir iş mantığı işleminin ya bütünüyle başarıyla tamamlandığı ya da önceki geçerli duruma geri döndürüldüğü (rollback) doğrulanmalıdır.2V2.3.44İş mantığı düzeyinde kilitleme mekanizmalarının, sınırlı kaynakların (ör. sinema koltukları, teslimat zamanları) uygulamanın mantığı manipüle edilerek çift rezervasyona neden olmamasını sağladığı doğrulanmalıdır.2V2.3.55Yüksek değerli iş mantığı akışlarının, yetkisiz veya kazara gerçekleşebilecek işlemleri önlemek için çoklu kullanıcı onayı gerektirdiği doğrulanmalıdır. Bu işlemler büyük para transferleri, sözleşme onayları, gizli bilgilere erişim veya üretimde güvenlik kurallarının geçersiz kılınmaları gibi durumları içerebilir.3V2.44Otomasyon Karşıtı ÖnlemlerV2.4.11Uygulama işlevlerine yönelik aşırı miktardaki çağrılara karşı; veri sızdırma, anlamsız veri üretme, kota tüketme, hız sınırının aşılması, hizmet reddi (DoS) ya da maliyetli kaynakların aşırı kullanımı gibi risklere karşı otomasyon karşıtı kontrollerin bulunduğu doğrulanmalıdır.2V2.4.22İş mantığı akışlarının, aşırı hızlı işlem gönderimlerini önleyecek şekilde gerçekçi insan zamanlaması gerektirdiği doğrulanmalıdır.3V33WebWeb Ön Uç (Frontend) GüvenliğiV3.11Web Frontend Güvenlik DokümantasyonuV3.1.11Uygulama dokümantasyonunda, uygulamayı kullanan tarayıcıların desteklemesi gereken güvenlik özelliklerinin (ör. HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) ve diğer ilgili HTTP güvenlik mekanizmaları) tanımlandığı doğrulanmalıdır. Ayrıca bu özelliklerin mevcut olmadığı durumlarda uygulamanın nasıl davranması gerektiği (ör. kullanıcıyı uyarmak veya erişimi engellemek) de tanımlanmalıdır.3V3.22İçeriğin Yanlış YorumlanmasıV3.2.11Tarayıcıların HTTP yanıtlarında içerik veya işlevi yanlış bir bağlamda sunmalarını önlemek amacıyla güvenlik kontrollerinin uygulandığı doğrulanmalıdır (ör. API, kullanıcı tarafından yüklenen dosya veya başka bir kaynağın doğrudan çağrılması durumunda). Olası kontroller arasında; yalnızca HTTP istek başlıklarının (ör. Sec-Fetch-\*) doğru bağlamı gösterdiği durumlarda içeriğin sunulması, Content-Security-Policy başlığında "sandbox" yönergesinin kullanılması veya Content-Disposition başlığında "attachment" biçiminin kullanılması yer alabilir.1V3.2.22HTML yerine metin olarak görüntülenmesi amaçlanan içeriğin, HTML veya JavaScript gibi içeriklerin istenmeden çalıştırılmasını önleyecek şekilde "createTextNode" veya "textContent" gibi güvenli işleme fonksiyonlarıyla işlendiği doğrulanmalıdır.1V3.2.33Uygulamanın istemci tarafı JavaScript kullanırken açık değişken tanımlamaları yaparak, sıkı tür kontrolü uygulayarak, global değişkenleri document nesnesine kaydetmekten kaçınarak ve ad alanı izolasyonu sağlayarak DOM clobbering’den kaçındığı doğrulanmalıdır.3V3.33Çerez YapılandırmasıV3.3.11Çerezlerin 'Secure' niteliğine sahip olduğu ve eğer çerez adı '\__Host-' ön eki ile başlamıyorsa, '__Secure-' ön ekinin kullanıldığı doğrulanmalıdır.1V3.3.22Kullanıcı arayüzü kandırma saldırılarına ve tarayıcı tabanlı istek sahteciliği saldırılarına (CSRF) karşı koruma sağlamak amacıyla, her çerezin 'SameSite' niteliğinin kullanım amacına uygun şekilde ayarlandığı doğrulanmalıdır.2V3.3.33Çerez adı, diğer sunucularla paylaşılmak üzere açıkça tasarlanmadığı sürece '__Host-' ön eki ile tanımlanmalıdır.2V3.3.44Bir çerez değeri istemci tarafı betikleri tarafından erişilememesi gereken bir veri içeriyorsa (ör. oturum token'ı), çerezin 'HttpOnly' niteliğine sahip olduğu ve aynı değerin (ör. oturum token'ı) yalnızca 'Set-Cookie' başlığı ile istemciye iletildiği doğrulanmalıdır.2V3.3.55Uygulama bir çerez oluştururken, çerez adı ve değerinin toplam uzunluğunun 4096 baytı aşmadığı doğrulanmalıdır. Çok büyük çerezler tarayıcı tarafından saklanmaz ve isteklerle gönderilmez; bu da çereze bağlı çalışan uygulama işlevlerinin bozulmasına yol açabilir.3V3.44Tarayıcı Güvenlik Mekanizması Başlıkları (Header)V3.4.22Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header'ı, uygulama tarafından sabit bir değer olarak tanımlanmalı veya gelen Origin header değeri güvenilir origin’lerden oluşan bir izinli listeye karşı doğrulanmalıdır. ‘Access-Control-Allow-Origin: *’ kullanılması gerekiyorsa, yanıtın hassas bilgi içermediği doğrulanmalıdır.1V3.4.33HTTP yanıtlarında Content-Security-Policy header'ı bulunduğu ve bu header'ın yalnızca güvenilen içeriklerin veya kaynakların yüklenmesini ve çalıştırılmasını sağlayan yönergeler içerdiği doğrulanmalıdır. Minimum olarak "global policy", object-src 'none', base-uri 'none' yönergelerini içermeli ve izinli liste, nonce veya hash temelli bir yapı içermelidir. Seviye 3 uygulamalarında her yanıt için nonce veya hash içeren özel bir politika tanımlanmalıdır.2V3.4.44Tüm HTTP yanıtlarının 'X-Content-Type-Options: nosniff' header'ını içerdiği doğrulanmalıdır. Bu, tarayıcıya içerik türünü tahmin etmeyi bırakmasını ve yanıtın Content-Type header'ında belirtilen MIME türünün, beklenen kaynak türüyle eşleşmesini zorunlu kılar. Ayrıca bu, tarayıcıda CORB (Cross-Origin Read Blocking) özelliğini etkinleştirir.2V3.4.55Uygulamanın, 'Referer' başlığı yoluyla üçüncü taraflara teknik olarak hassas verilerin sızmasını önlemek için bir 'referrer policy' belirlediği doğrulanmalıdır. Bu, Referrer-Policy HTTP header'ıyla veya HTML öğe nitelikleriyle (element attributes) sağlanabilir. Sızabilecek hassas bilgiler, URL’deki yol ve sorgu parametreleri ile sınırlı uygulamalarda hostname bilgisini içerebilir.2V3.4.66Uygulamanın, Content-Security-Policy header'ı altında 'frame-ancestors' yönergesini her HTTP yanıtında tanımladığı ve bu sayede içeriklerin varsayılan olarak başka sayfalara gömülmesini engellediği doğrulanmalıdır. Gerekli durumlarda özel olarak izin verildiğinden emin olunmalıdır. 'X-Frame-Options' header'ı, tarayıcılar tarafından desteklenmesine rağmen, artık güncel değildir ve güvenlik amacıyla kullanılmamalıdır.2V3.4.88Bir belgenin işlenmesini ve sunulmasını başlatan tüm HTTP yanıtlarında (örneğin 'text/html' tipi yanıtlar), 'Cross-Origin-Opener-Policy' header'ı 'same-origin' veya 'same-origin-allow-popups' yönergeleriyle birlikte yer almalıdır. Bu, tabnabbing ve frame counting gibi, pencere nesnelerine paylaşımlı erişimi sömüren saldırılara karşı koruma sağlar.3V3.55Tarayıcı Menşei AyırımıV3.5.11Uygulama, hassas işlevselliğe yönelik izinsiz cross-origin istekleri önlemek için CORS preflight mekanizmasına güvenmiyorsa, bu tür isteklerin gerçekten uygulamadan geldiği doğrulanmalıdır. Bu, anti-forgery token kullanımı veya CORS tarafından güvenli kabul edilmeyen özel HTTP header'larının zorunlu kılınmasıyla yapılabilir. Bu, tarayıcı tabanlı istek sahteciliği (CSRF) saldırılarına karşı bir savunmadır.1V3.5.22Uygulama, hassas işlevlerin izinsiz cross-origin çağrılmasını önlemek için CORS preflight mekanizmasına güveniyorsa, bu işlevlerin bir CORS-preflight isteğini tetiklemeden çağrılamadığı doğrulanmalıdır. Bu, 'Origin' ve 'Content-Type' header'larının doğrulanmasını veya CORS-safelisted olmayan bir header'ın ve alanın kullanılmasını gerektirebilir.1V3.5.44Farklı uygulamaların farklı hostname'lerde barındırıldığı ve böylece Same-Origin Policy tarafından sağlanan kısıtlamalardan (örneğin çerez erişim sınırları, kaynaklar arası etkileşim kontrolleri) faydalanıldığı doğrulanmalıdır.2V3.5.66Uygulamanın herhangi bir yerinde JSONP işlevselliğinin etkin olmadığı doğrulanmalıdır. Bu, XSSI (Cross-Site Script Inclusion) saldırılarını önlemek içindir.3V3.5.77Yetkilendirme gerektiren verilerin, JavaScript dosyaları gibi betik kaynaklarının yanıtlarında yer almadığı, XSSI saldırılarını önlemek için doğrulanmalıdır.3V3.5.88Kimliği doğrulanmış kaynakların (örneğin görseller, videolar, betikler ve belgeler) yalnızca gerçekten amaçlandığında kullanıcı adına yüklenebildiği veya gömülebildiği doğrulanmalıdır. Bu, isteğin uygun olmayan bir çapraz kaynak çağrısından kaynaklanmadığından emin olmak için Sec-Fetch-* HTTP istek başlığı alanlarının sıkı bir şekilde doğrulanmasıyla veya tarayıcıya döndürülen içeriği engelleme talimatı vermek için kısıtlayıcı bir Cross-Origin-Resource-Policy HTTP yanıt başlığı alanı ayarlayarak gerçekleştirilebilir.3V3.66Harici Kaynak BütünlüğüV3.6.11JavaScript kütüphaneleri, CSS veya web fontları gibi istemci tarafı varlıkların yalnızca statik ve sürümlü olması, varlığın bütünlüğünü doğrulamak için Subresource Integrity (SRI) kullanılması durumunda harici olarak (örneğin, bir İçerik Dağıtım Ağı üzerinde) barındırıldığı doğrulanmalıdır. Bu mümkün değilse, her bir kaynak için bunu gerekçelendiren belgelenmiş bir güvenlik kararı bulunmalıdır.3V3.77Diğer Tarayıcı Güvenliği HususlarıV3.7.11Uygulamanın yalnızca hâlâ desteklenen ve güvenli kabul edilen istemci tarafı teknolojileri kullandığı doğrulanmalıdır. Bu gereksinimi karşılamayan teknolojilere örnek olarak NSAPI eklentileri, Flash, Shockwave, ActiveX, Silverlight, NACL veya istemci tarafı Java applet’leri verilebilir.2V3.7.22Uygulamanın, yalnızca hedef adres bir izinli listede yer alıyorsa kullanıcıyı otomatik olarak farklı bir ana makine adına veya uygulamanın kontrolünde olmayan bir etki alanına yönlendirdiği doğrulanmalıdır.2V3.7.33Uygulamanın, kullanıcı uygulamanın kontrolü dışındaki bir URL’ye yönlendirildiğinde, yönlendirme hakkında bir bildirim gösterdiği ve kullanıcının bu gezintiyi iptal edebilmesi için bir seçenek sunduğu doğrulanmalıdır.3V3.7.44Uygulamanın en üst düzey etki alanının (örneğin, site.tld) HTTP Strict Transport Security (HSTS) için genel preload listesine eklendiği doğrulanmalıdır. Bu, uygulamanın TLS kullanımının ana tarayıcılar tarafından doğrudan tanınmasını ve yalnızca Strict-Transport-Security yanıt header'ına bağlı kalınmamasını sağlar.3V3.7.55Uygulamaya erişen tarayıcının beklenen güvenlik özelliklerini desteklememesi durumunda, uygulamanın dokümantasyona uygun şekilde davrandığı (örneğin kullanıcıyı uyarma veya erişimi engelleme) doğrulanmalıdır.3V44APIAPI ve Web ServisiV4.11Genel Web Servisi GüvenliğiV4.1.11İleti gövdesi içeren her HTTP yanıtında, yanıtın gerçek içeriğiyle eşleşen bir Content-Type header alanı bulunduğu ve güvenli karakter kodlamasını (örneğin, UTF-8, ISO-8859-1) belirtmek üzere charset parametresi içerdiği doğrulanmalıdır. Bu işlem, IANA Medya Türleri'nden "text/", "/+xml" ve "/xml" gibi içerikler için geçerlidir.1V4.1.22Yalnızca kullanıcı arayüzüne yönelik uç noktaların (manuel olarak web tarayıcısı ile erişilmesi amaçlanan) otomatik olarak HTTP'den HTTPS'e yönlendirme yaptığı ve diğer hizmetlerin veya uç noktaların şeffaf yönlendirme gerçekleştirmediği doğrulanmalıdır. Bu, istemcinin farkında olmadan şifrelenmemiş HTTP istekleri göndermesi ve bu isteklerin otomatik olarak HTTPS'e yönlendirilmesi sonucunda hassas verilerin sızmasının fark edilmemesi riskini önlemek içindir.2V4.1.33Uygulama tarafından kullanılan ve yük dengeleyici, web proxy veya frontend için backend hizmeti gibi bir ara katman tarafından ayarlanan herhangi bir HTTP başlık alanının, son kullanıcı tarafından geçersiz kılınamayacağı doğrulanmalıdır. Örnek başlıklar arasında X-Real-IP, X-Forwarded-* veya X-User-ID yer alabilir.2V4.1.44Uygulama veya API tarafından açıkça desteklenen HTTP yöntemlerinin (preflight istekleri sırasında OPTIONS dahil) dışında hiçbir yöntemin kullanılmadığı ve kullanılmayan yöntemlerin engellendiği doğrulanmalıdır.3V4.1.55Çok hassas istekler veya birçok sistemden geçen işlemler için, taşıma katmanı güvenliğinin üzerine ek bir güvence sağlamak amacıyla, her iletiye özel dijital imzaların kullanıldığı doğrulanmalıdır.3V4.22HTTP İleti Yapısı DoğrulamaV4.2.11Tüm uygulama bileşenlerinin (yük dengeleyiciler, güvenlik duvarları ve uygulama sunucuları dahil) HTTP sürümüne uygun mekanizmaları kullanarak gelen HTTP iletilerinin sınırlarını belirlediği ve bu sayede HTTP istek kaçakçılığına karşı koruma sağlandığı doğrulanmalıdır. HTTP/1.x sürümünde Transfer-Encoding başlık alanı varsa, RFC 2616'ya göre Content-Length başlığı göz ardı edilmelidir. HTTP/2 veya HTTP/3 kullanıldığında, Content-Length başlığı varsa, alıcının bu değerin DATA çerçevelerinin uzunluğuyla tutarlı olduğunu doğrulaması gerekir.2V4.2.22HTTP iletileri üretilirken, Content-Length başlığının, HTTP protokolünün çerçeveleme yöntemine göre belirlenen içerik uzunluğu ile çelişmediği doğrulanmalıdır. Bu, istek kaçakçılığı saldırılarını önlemek için gereklidir.3V4.2.33Uygulamanın, yanıt bölme ve header enjeksiyonu saldırılarını önlemek amacıyla, bağlantıya özel başlık alanları (örneğin Transfer-Encoding) içeren HTTP/2 veya HTTP/3 iletilerini göndermediği ve kabul etmediği doğrulanmalıdır.3V4.2.44Uygulamanın yalnızca başlık alanları ve değerleri CR (\r), LF (\n) veya CRLF (\r\n) karakter dizileri içermeyen HTTP/2 ve HTTP/3 isteklerini kabul ettiği doğrulanmalıdır. Bu, başlık enjeksiyonu saldırılarını önlemek içindir.3V4.2.55Uygulama (backend veya frontend) istek oluşturuyor ve gönderiyorsa, URI'ler (örneğin API çağrıları için) veya HTTP istek başlıkları (örneğin Authorization veya Cookie) gibi bileşenlerin, alıcı sistemler tarafından kabul edilemeyecek kadar uzun olmamasını sağlamak amacıyla doğrulama, temizleme veya diğer mekanizmaları kullandığı doğrulanmalıdır. Bu tür çok uzun istekler (örneğin çok uzun bir Cookie başlığı) gönderildiğinde sunucunun sürekli hata durumu döndürmesiyle hizmet reddi oluşabilir.3V4.33GraphQLV4.3.11Maliyetli ve iç içe geçmiş sorgular sonucu oluşabilecek GraphQL veya veri katmanı ifadelerine yönelik Hizmet Reddi (DoS) saldırılarını önlemek için, sorgu izin listesi (allowlist), derinlik sınırlandırması, sorgu sayısı sınırlandırması veya sorgu maliyeti analizi kullanıldığı doğrulanmalıdır.2V4.3.22GraphQL introspection (iç yapı sorgulama) sorgularının, GraphQL API'nin üçüncü taraflar tarafından kullanılmasına yönelik olmadığı sürece, üretim ortamında devre dışı bırakıldığı doğrulanmalıdır.2V4.44WebSocketV4.4.11Tüm WebSocket bağlantılarında TLS üzerinden WebSocket (WSS) kullanıldığı doğrulanmalıdır.1V4.4.22WebSocket'in başlangıçtaki HTTP el sıkışması (handshake) sırasında, Origin başlık alanının uygulama için izin verilen origin listesiyle karşılaştırılarak kontrol edildiği doğrulanmalıdır.2V4.4.33Uygulamanın standart oturum yönetimi kullanılamıyorsa, bunun yerine ilgili Oturum Yönetimi güvenlik gereksinimlerine uygun özel token'ların kullanıldığı doğrulanmalıdır.2V4.4.44HTTPS oturumu WebSocket kanalına geçerken, özel WebSocket oturum yönetim token’larının önceki şekilde kimliği doğrulanmış HTTPS oturumu aracılığıyla elde edildiği veya doğrulandığı doğrulanmalıdır.2V55FileDosya İşlemeV5.11Dosya İşleme DokümantasyonuV5.1.11Dokümantasyonun, her yükleme özelliği için izin verilen dosya türlerini, beklenen dosya uzantılarını ve maksimum boyutu (açılmış hali dahil) tanımladığı doğrulanmalıdır. Ayrıca, dosyaların son kullanıcılar için nasıl güvenli hâle getirileceği (örneğin kötü amaçlı bir dosya tespit edildiğinde uygulamanın nasıl davranacağı) gibi bilgilerin de belgede yer aldığı doğrulanmalıdır.2V5.22Dosya Yükleme ve İçerikV5.2.11Uygulamanın, yalnızca performans kaybına veya hizmet reddine yol açmayacak boyuttaki dosyaları kabul ettiği doğrulanmalıdır.1V5.2.22Uygulama bir dosyayı, doğrudan veya bir arşiv (ör. zip dosyası) içinde kabul ettiğinde, dosya uzantısının beklenen uzantıyla eşleşip eşleşmediğini kontrol ettiği ve içeriğin uzantı tarafından temsil edilen türle uyumlu olduğunu doğruladığı kontrol edilmelidir. Bu; ilk 'magic byte' kontrolü, görüntü yeniden yazımı ve dosya içeriği doğrulama için özel kütüphanelerin kullanımı gibi yöntemleri içerir. Seviye 1 için bu, yalnızca iş veya güvenlik kararlarında kullanılan dosyalarla sınırlı olabilir. Seviye 2 ve üzeri için tüm dosyalar bu kontrole tabi olmalıdır.1V5.2.33Sıkıştırılmış dosyaların (ör. zip, gz, docx, odt) açılmadan önce, izin verilen maksimum açılmış boyuta ve maksimum dosya sayısına göre kontrol edildiği doğrulanmalıdır.2V5.2.44Her kullanıcı için dosya boyutu kotası ve maksimum dosya sayısının uygulandığı doğrulanmalıdır. Böylece tek bir kullanıcının çok sayıda veya aşırı büyük dosya yükleyerek depolama alanını doldurması engellenir.3V5.2.55Uygulamanın, içinde sembolik bağlantılar (symlink) bulunan sıkıştırılmış dosyaların yüklenmesine yalnızca bu durum özel olarak gerekli olduğunda izin verdiği doğrulanmalıdır. Bu durumda, sembolik bağlantı verilebilecek dosyaların bir izinli listesi uygulanmalıdır.3V5.2.66Uygulamanın, piksel boyutu izin verilen maksimum değeri aşan görüntü dosyalarının yüklenmesini reddettiği doğrulanmalıdır. Bu, pixel flood saldırılarını önlemek için gereklidir.3V5.33Dosya DepolamaV5.3.11Güvenilmeyen girdilerle yüklenen veya oluşturulan ve herkese açık klasörlerde depolanan dosyaların, bir HTTP isteğiyle doğrudan erişildiğinde sunucu taraflı program kodu olarak çalıştırılmadığı doğrulanmalıdır.1V5.3.22Uygulamanın, dosya işlemleri için dosya yollarını oluştururken kullanıcı tarafından gönderilen dosya adlarını değil, dahili olarak oluşturulan veya güvenilir verileri kullandığı; eğer kullanıcı tarafından gönderilen dosya adları veya meta veriler kullanılacaksa, sıkı doğrulama ve temizleme işlemlerinin uygulandığı doğrulanmalıdır. Bu, yol geçişi (path traversal), yerel veya uzak dosya dahil etme (LFI, RFI) ve sunucu tarafı istek sahteciliği (SSRF) saldırılarına karşı koruma sağlar.1V5.3.33Sunucu tarafında gerçekleşen dosya işlemlerinin (örneğin dosya açma/decompress işlemi), kullanıcı tarafından sağlanan yol bilgilerini yok saydığı ve zip slip gibi güvenlik açıklarını önlediği doğrulanmalıdır.3V5.44Dosya İndirmeV5.4.11Uygulamanın, kullanıcı tarafından gönderilen dosya adlarını (ör. JSON, JSONP veya URL parametresinde) doğruladığı veya göz ardı ettiği ve yanıtın Content-Disposition başlık alanında bir dosya adı belirttiği doğrulanmalıdır.2V5.4.22Sunulan dosya adlarının (örneğin HTTP yanıt header'larında veya e-posta eklerinde), belge yapısını korumak ve enjeksiyon saldırılarını önlemek için kodlandığı veya temizlendiği (ör. RFC 6266’ya uygun) doğrulanmalıdır.2V5.4.33Güvenilmeyen kaynaklardan elde edilen dosyaların, bilinen kötü amaçlı içeriklerin sunulmasını önlemek amacıyla antivirüs tarayıcılarıyla tarandığı doğrulanmalıdır.2V66AuthenticationKimlik DoğrulamaV6.11Kimlik Doğrulama DokümantasyonuV6.1.11Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırılarına karşı oran sınırlama (rate limiting), otomasyon karşıtı önlemler ve uyarlanabilir yanıt gibi kontrollerin nasıl kullanıldığını açıklayan bir uygulama dokümantasyonu bulunduğu doğrulanmalıdır. Dokümantasyon, bu kontrollerin nasıl yapılandırıldığını ve kötü niyetli hesap kilitlemenin nasıl önlendiğini açıkça ortaya koymalıdır.1V6.1.22Parolalarda kullanılmasını önlemek amacıyla, bağlama özgü sözcüklerin (örneğin kurum adlarının permütasyonları, ürün adları, sistem tanımlayıcıları, proje kod adları, departman veya rol adları vb.) bulunduğu belgelenmiş bir liste mevcut olduğu doğrulanmalıdır.2V6.1.33Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, bunların tümünün belgelenmiş olduğu ve her yol için tutarlı şekilde uygulanması gereken güvenlik kontrolleri ile kimlik doğrulama gücünün tanımlandığı doğrulanmalıdır.2V6.22Parola GüvenliğiV6.2.11Kullanıcı tarafından belirlenen parolaların en az 8 karakter uzunluğunda olması sağlanmalı, ancak 15 karakter ve üzeri uzunlukta parolalar olmaları şiddetle tavsiye edilir.1V6.2.22Kullanıcıların parolalarını değiştirebilmeleri sağlanmalıdır.1V6.2.33Parola değiştirme işlevinin hem mevcut hem de yeni parolayı gerektirdiği doğrulanmalıdır.1V6.2.44Kayıt veya parola değişimi sırasında girilen parolaların, uygulamanın parola politikasına (örneğin minimum uzunluk) uyan ilk 3000 yaygın parolaya karşı kontrol edildiği doğrulanmalıdır.1V6.2.55Her tür karakterin kullanılmasına izin verildiği ve büyük/küçük harf, sayı veya özel karakter şartlarının zorunlu tutulmadığı doğrulanmalıdır.1V6.2.66Parola giriş alanlarının, girdiyi maskelemek için "type=password" kullandığı doğrulanmalıdır. Uygulamalar, kullanıcının tüm maskelenmiş parolayı ya da son girilen karakteri geçici olarak görüntülemesine izin verebilir.1V6.2.77"Yapıştır" özelliğinin, tarayıcı parola yardımcılarının ve harici parola yöneticilerinin kullanımına izin verildiği doğrulanmalıdır.1V6.2.88Uygulamanın, kullanıcıdan aldığı parolayı herhangi bir şekilde değiştirmeden, örneğin kesmeden veya harf büyüklüğünü değiştirmeden, tam olarak doğruladığı teyit edilmelidir.1V6.2.99En az 64 karakter uzunluğundaki parolalara izin verildiği doğrulanmalıdır.2V6.2.1010Kullanıcının parolasının, yalnızca ele geçirildiği tespit edildiğinde veya kullanıcı tarafından yenilendiğinde geçerliliğini yitirdiği doğrulanmalıdır. Uygulama, belirli aralıklarla parola yenilenmesini zorunlu kılmamalıdır.2V6.2.1111Tahmin edilmesi kolay parolaların oluşturulmasını önlemek amacıyla, bağlama özgü kelimelerin yer aldığı belgelenmiş listenin parola doğrulamada kullanıldığı teyit edilmelidir.2V6.2.1212Kayıt veya parola değişikliği sırasında girilen parolaların, ele geçirilmiş parolalar listesine karşı kontrol edildiği doğrulanmalıdır.2V6.33Genel Kimlik Doğrulama GüvenliğiV6.3.11Kimlik bilgisi doldurma (credential stuffing) ve parola kaba kuvvet saldırıları gibi saldırıları önlemeye yönelik kontrollerin, uygulamanın güvenlik dokümantasyonuna göre uygulandığı doğrulanmalıdır.1V6.3.22"root", "admin" veya "sa" gibi varsayılan kullanıcı hesaplarının uygulamada yer almadığı veya devre dışı bırakıldığı doğrulanmalıdır.1V6.3.33Uygulamaya erişim için ya çok faktörlü bir kimlik doğrulama mekanizması ya da tek faktörlü mekanizmaların kombinasyonu kullanılmalıdır. Seviye 3 için, bu faktörlerden biri, oltalama saldırılarına karşı direnç sağlayan ve kimlik doğrulama niyetini bir kullanıcı etkileşimi (örneğin FIDO donanım anahtarında bir düğmeye basma veya mobil telefonda bir onay) gerektirerek doğrulayan donanım tabanlı bir kimlik doğrulayıcı olmalıdır. Bu gereksinimdeki herhangi bir esneklik için, gerekçesi belgelenmiş ve riskleri azaltıcı kapsamlı kontroller içeren bir plan gereklidir.2V6.3.44Uygulama birden fazla kimlik doğrulama yolu içeriyorsa, belgelendirilmemiş bir yol bulunmadığı ve tüm yollar için güvenlik kontrolleri ile kimlik doğrulama gücünün tutarlı şekilde uygulandığı doğrulanmalıdır.2V6.3.55Başarılı veya başarısız şüpheli kimlik doğrulama girişimlerinin kullanıcıya bildirildiği doğrulanmalıdır. Bu, olağandışı bir konum veya istemciden gelen girişimler, yalnızca bir faktörle yapılan kısmen başarılı doğrulamalar, uzun süreli inaktiflik sonrası yapılan girişimler veya birçok başarısız denemeden sonraki başarılı girişimler gibi durumları içerebilir.3V6.3.66E-postanın, tek faktörlü ya da çok faktörlü kimlik doğrulama mekanizması olarak kullanılmadığı doğrulanmalıdır.3V6.3.77Kimlik doğrulama detaylarında yapılan güncellemeler sonrasında (örneğin kimlik bilgisi sıfırlama, kullanıcı adı veya e-posta adresi değişiklikleri), kullanıcıların bilgilendirildiği doğrulanmalıdır.3V6.3.88Başarısız kimlik doğrulama girişimlerinden, geçerli kullanıcıların hata mesajları, HTTP yanıt kodları veya farklı yanıt süreleri gibi sonuçlara dayanarak tespit edilemediği doğrulanmalıdır. Bu koruma, kayıt ve "parolamı unuttum" işlevselliğinde de geçerli olmalıdır.3V6.44Kimlik Doğrulama Faktörünün Yaşam Döngüsü ve KurtarmaV6.4.11Sistem tarafından oluşturulan ilk parolaların veya etkinleştirme kodlarının güvenli bir şekilde rastgele üretildiği, mevcut parola politikasına uygun olduğu, kısa bir süre içinde veya ilk kullanım sonrasında geçerliliğini yitirdiği doğrulanmalıdır. Bu başlangıç sırları uzun vadeli parola olarak kullanılmasına izin verilmemelidir.1V6.4.22Parola ipuçlarının veya "gizli sorular" olarak bilinen, bilgiye dayalı kimlik doğrulama mekanizmalarının mevcut olmadığı doğrulanmalıdır.1V6.4.33Unutulmuş parolanın sıfırlanması için, etkin olan çok faktörlü kimlik doğrulama mekanizmalarını atlamayan güvenli bir sürecin uygulandığı doğrulanmalıdır.2V6.4.44Çok faktörlü kimlik doğrulama faktörlerinden biri kaybolursa, kayıt sırasında uygulanan kimlik kanıtlama seviyesiyle aynı seviyede kimlik doğrulama yapıldığı doğrulanmalıdır.2V6.4.55Süresi dolacak kimlik doğrulama mekanizmalarının yenilenmesine ilişkin talimatların, süresi dolmadan önce tamamlanacak şekilde yeterli sürede gönderildiği ve gerekiyorsa otomatik hatırlatıcıların yapılandırıldığı doğrulanmalıdır.3V6.4.66Yönetici yetkisi olan kullanıcıların, kullanıcının parola sıfırlama sürecini başlatabildiği ancak kullanıcının yeni parolasını belirleyemediği veya değiştiremediği doğrulanmalıdır. Bu, yönetici yetkisi olan kullanıcıların, kullanıcı parolasını bilmesini engeller.3V6.55Çok Faktörlü Kimlik Doğrulama İçin Genel GereksinimlerV6.5.11Arama sırları, bant dışı kimlik doğrulama istekleri veya kodları ve zamana dayalı tek kullanımlık parolaların (TOTP) yalnızca bir kez kullanılabildiği doğrulanmalıdır.2V6.5.22Uygulamanın backend tarafında saklanırken, 112 bitten az entropiye sahip (örneğin 19 rastgele harf-rakam karakteri veya 34 rastgele rakam) arama sırlarının, 32-bit rastgele bir salt içeren onaylı bir parola saklama algoritmasıyla hash’lendiği doğrulanmalıdır. Gizli bilginin entropisi 112 bit veya daha fazlaysa standart bir hash fonksiyonu kullanılabilir.2V6.5.33Arama sırları, bant dışı kimlik doğrulama kodları ve zamana dayalı tek kullanımlık parola seed'lerinin, öngörülebilir değerlerden kaçınmak için Kriptografik Olarak Güvenli Sözde Rastgele Sayı Üreteci (CSPRNG) ile oluşturulduğu doğrulanmalıdır.2V6.5.44Arama sırlarının ve bant dışı kimlik doğrulama kodlarının en az 20 bit entropiye (genellikle 4 rastgele harf-rakam karakteri veya 6 rastgele rakam) sahip olduğu doğrulanmalıdır.2V6.5.55Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının ve zamana dayalı tek kullanımlık parolaların (TOTP) belirli bir ömre sahip olduğu doğrulanmalıdır. Bant dışı istekler en fazla 10 dakika, TOTP’ler ise en fazla 30 saniye geçerli olmalıdır.2V6.5.66Herhangi bir kimlik doğrulama faktörünün (fiziksel cihazlar dahil) çalınması veya kaybı durumunda iptal edilebildiği doğrulanmalıdır.3V6.5.77Biyometrik kimlik doğrulama mekanizmalarının yalnızca ikincil faktör olarak, “sahip olduğunuz bir şey” veya “bildiğiniz bir şey” ile birlikte kullanıldığı doğrulanmalıdır.3V6.5.88Zamana dayalı tek kullanımlık parolaların (TOTP) doğrulamasının, güvenilir bir hizmetten alınan zaman kaynağına dayanarak yapıldığı ve güvenilir olmayan veya istemci tarafından sağlanan zaman kaynağına dayanmadığı doğrulanmalıdır.3V6.66Bant Dışı Kimlik Doğrulama MekanizmalarıV6.6.11Tek kullanımlık parolaların (OTP) telefon veya SMS ile Public Switched Telephone Network (PSTN) üzerinden iletildiği kimlik doğrulama mekanizmalarının, yalnızca telefon numarası önceden doğrulanmışsa, alternatif daha güçlü yöntemler (örneğin TOTP) de sunuluyorsa ve kullanıcıya güvenlik riskleri hakkında bilgi veriliyorsa sunulduğu doğrulanmalıdır. Seviye 3 uygulamalar için telefon ve SMS seçenekleri sunulmamalıdır.2V6.6.22Bant dışı kimlik doğrulama isteklerinin, kodlarının veya token'larının, oluşturuldukları özgün kimlik doğrulama isteğiyle bağlantılı olduğu ve daha önceki ya da sonraki bir istek için kullanılamadığı doğrulanmalıdır.2V6.6.33Kod tabanlı bant dışı kimlik doğrulama mekanizmalarının, oran sınırlaması ile kaba kuvvet saldırılarına karşı korunduğu doğrulanmalıdır. En az 64 bit entropiye sahip kodlar kullanılması da değerlendirilmelidir.2V6.6.44Çok faktörlü kimlik doğrulama için push bildirimleri kullanılıyorsa, push bombing saldırılarına karşı oran sınırlamasının kullanıldığı doğrulanmalıdır. “Numara eşleştirme” de bu riski azaltabilir.3V6.77Kriptografik Kimlik Doğrulama MekanizmasıV6.7.11Kriptografik kimlik doğrulama beyanlarını doğrulamak için kullanılan sertifikaların, değiştirilmeye karşı korumalı şekilde saklandığı doğrulanmalıdır.3V6.7.22Challenge nonce değerinin en az 64 bit uzunluğunda olduğu ve istatistiksel olarak benzersiz ya da cihazın ömrü boyunca benzersiz olduğu doğrulanmalıdır.3V6.88Kimlik Sağlayıcısı ile Kimlik DoğrulamaV6.8.11Uygulama birden fazla kimlik sağlayıcıyı (IdP) destekliyorsa, başka bir desteklenen kimlik sağlayıcı aracılığıyla (örneğin aynı kullanıcı tanımlayıcısını kullanarak) kullanıcının kimliğinin taklit edilemediği doğrulanmalıdır. Standart önlem, uygulamanın kullanıcıyı IdP kimliği (bir ad alanı işlevi görür) ve IdP içindeki kullanıcı kimliğinin birleşimiyle kaydetmesi ve tanımlamasıdır.2V6.8.22Kimlik doğrulama beyanları üzerindeki dijital imzaların (örneğin JWT veya SAML beyanları) varlığı ve bütünlüğünün her zaman doğrulandığı ve imzasız veya geçersiz imzalı beyanların reddedildiği doğrulanmalıdır.2V6.8.33SAML beyanlarının benzersiz biçimde işlendiği ve yalnızca geçerlilik süresi içinde bir kez kullanıldığı, tekrar oynatma (replay) saldırılarını önlemek amacıyla doğrulanmalıdır.2V6.8.44Uygulama ayrı bir Kimlik Sağlayıcı (IdP) kullanıyorsa ve belirli işlemler için belirli kimlik doğrulama gücü, yöntemleri veya zaman bilgisi bekliyorsa, uygulamanın bu bilgileri IdP tarafından döndürülen veriler üzerinden doğruladığı teyit edilmelidir. Örneğin OIDC kullanılıyorsa, bu durum ID Token üzerindeki 'acr', 'amr' ve 'auth_time' gibi claim’lerin (varsa) doğrulanması ile sağlanabilir. Eğer IdP bu bilgileri sağlamıyorsa, uygulamanın asgari kimlik doğrulama gücünün kullanıldığını varsayan (örneğin yalnızca kullanıcı adı ve parola ile tek faktörlü doğrulama) belgelenmiş bir yedek yaklaşımı olmalıdır.2V77SessionOturum YönetimiV7.11Oturum Yönetim DokümantasyonuV7.1.11Kullanıcının oturum inaktivite zaman aşımı süresi ve mutlak maksimum oturum süresinin belgelendiği, diğer kontrollerle birlikte uygun olduğu ve NIST SP 800-63B yeniden kimlik doğrulama gereksinimlerinden herhangi bir sapma varsa gerekçesinin belgede yer aldığı doğrulanmalıdır.2V7.1.22Belgede bir hesap için kaç adet eşzamanlı (paralel) oturuma izin verildiği ile birlikte, maksimum aktif oturum sayısına ulaşıldığında uygulanacak davranış ve işlemlerin tanımlandığı doğrulanmalıdır.2V7.1.33Birleşik kimlik yönetim ekosisteminin bir parçası olarak kullanıcı oturumu oluşturan ve yöneten tüm sistemlerin, oturum ömrü, sonlandırma ve yeniden kimlik doğrulama gerektiren diğer koşulların nasıl koordine edildiğini açıklayan kontrollerle birlikte belgede yer aldığı doğrulanmalıdır.2V7.22Temel Oturum Yönetimi GüvenliğiV7.2.11Uygulamanın tüm oturum token'ı doğrulama işlemlerini güvenilir bir backend servisi aracılığıyla gerçekleştirdiği doğrulanmalıdır.1V7.2.22Uygulamanın, statik API gizli anahtarları veya sabit değerler yerine, oturum yönetimi için dinamik olarak oluşturulan kendi kendine yeterli veya referans token'ları kullandığı doğrulanmalıdır.1V7.2.33Uygulama kullanıcı oturumlarını temsil etmek için referans token'ları kullanıyorsa, bu token'ların benzersiz olduğu, kriptografik olarak güvenli bir sözde rastgele sayı üreteci (CSPRNG) kullanılarak üretildiği ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır.1V7.2.44Uygulamanın, kullanıcı kimlik doğrulaması (yeniden kimlik doğrulama dahil) sırasında yeni bir oturum token'ı oluşturduğu ve mevcut oturum token'ını sonlandırdığı doğrulanmalıdır.1V7.33Oturum Zaman AşımıV7.3.11Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde bir hareketsizlik zaman aşımı bulunduğu doğrulanmalıdır.2V7.3.22Risk analizi ve belgelenmiş güvenlik kararlarına göre yeniden kimlik doğrulamanın zorunlu kılınmasını sağlayacak şekilde mutlak bir maksimum oturum süresi bulunduğu doğrulanmalıdır.2V7.44Oturum SonlandırmaV7.4.11Oturum sonlandırma tetiklendiğinde (örneğin, çıkış yapıldığında veya süre dolduğunda), uygulamanın oturumun daha fazla kullanılmasına izin vermediği doğrulanmalıdır. Referans token'lar veya durum bilgili oturumlar için bu, oturum verilerinin uygulama arka ucunda geçersiz kılınması anlamına gelir. Kapsamlı token kullanan uygulamaların; sonlandırılmış token listesi tutmak, kullanıcıya özel tarih ve saatten önce oluşturulan token'ları reddetmek veya kullanıcıya özel imzalama anahtarını yenilemek gibi bir çözüm uygulaması gerekir.1V7.4.22Bir kullanıcı hesabı devre dışı bırakıldığında veya silindiğinde (örneğin bir çalışanın şirketten ayrılması), uygulamanın tüm aktif oturumları sonlandırdığı doğrulanmalıdır.1V7.4.33Herhangi bir kimlik doğrulama faktörünün başarılı bir şekilde değiştirilmesi veya kaldırılmasından (şifre sıfırlama veya kurtarma yoluyla yapılan değişiklikler dahil ve varsa MFA ayarları güncellemeleri dahil) sonra, uygulamanın diğer tüm aktif oturumları sonlandırma seçeneği sunduğu doğrulanmalıdır.2V7.4.44Kimlik doğrulama gerektiren tüm sayfalarda kolay erişilebilir ve görünür bir çıkış yap (logout) işlevi bulunduğu doğrulanmalıdır.2V7.4.55Uygulama yöneticilerinin, bireysel bir kullanıcının veya tüm kullanıcıların aktif oturumlarını sonlandırabilme yetkisine sahip olduğu doğrulanmalıdır.2V7.55Oturum Kötüye Kullanımına Karşı SavunmalarV7.5.11E-posta adresi, telefon numarası, MFA yapılandırması veya hesap kurtarmada kullanılan diğer bilgiler gibi kimlik doğrulamayı etkileyebilecek hassas hesap özniteliklerinde değişiklik yapılmadan önce uygulamanın tam yeniden kimlik doğrulama gerektirdiği doğrulanmalıdır.2V7.5.22Kullanıcıların, (en az bir faktörle yeniden kimlik doğrulama yaptıktan sonra) mevcut tüm aktif oturumları görüntüleyebilmesi ve sonlandırabilmesinin mümkün olduğu doğrulanmalıdır.2V7.5.33Uygulamanın, son derece hassas işlemler veya operasyonlar gerçekleştirilmeden önce en az bir faktörle ek kimlik doğrulaması veya ikincil bir doğrulama gerektirdiği doğrulanmalıdır.3V7.66Birleşik Yeniden Kimlik DoğrulamaV7.6.11Güvenen Taraf (RP) ile Kimlik Sağlayıcı (IdP) arasındaki oturum süresi ve oturum sonlandırma davranışlarının belgelenmiş olduğu ve, örneğin IdP kimlik doğrulama olayları arasında maksimum süreye ulaşıldığında yeniden kimlik doğrulamanın gerekli kılındığı doğrulanmalıdır.2V7.6.22Yeni bir oturum oluşturulmasının, kullanıcı onayı veya açık bir eylem gerektirdiği; kullanıcı etkileşimi olmaksızın yeni uygulama oturumlarının oluşturulmasının önlendiği doğrulanmalıdır.2V88AuthorizationYetkilendirmeV8.11Yetkilendirme DokümantasyonuV8.1.11Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak işlev düzeyinde ve veriye özel erişim kısıtlamaları için kuralları tanımladığı doğrulanmalıdır.1V8.1.22Yetkilendirme dokümantasyonunun, tüketici izinlerine ve kaynak özniteliklerine dayalı olarak alan (field) düzeyinde erişim kısıtlamaları (hem okuma hem yazma) için kuralları tanımladığı doğrulanmalıdır. Bu kuralların, ilgili veri nesnesinin durum veya statü gibi diğer özniteliklerine bağlı olabileceği unutulmamalıdır.2V8.1.33Uygulamanın dokümantasyonunun, kimlik doğrulama ve yetkilendirme ile ilgili güvenlik kararlarının alınmasında kullanılan çevresel ve bağlamsal öznitelikleri (günün saati, kullanıcı konumu, IP adresi veya cihaz gibi) tanımladığı doğrulanmalıdır.3V8.1.44Kimlik doğrulama ve yetkilendirme dokümantasyonunun; işlev düzeyinde, veriye özel ve alan düzeyinde yetkilendirmenin yanı sıra çevresel ve bağlamsal faktörlerin karar almada nasıl kullanıldığını tanımladığı doğrulanmalıdır. Bu, değerlendirilen öznitelikleri, risk eşiklerini ve alınan aksiyonları (ör. izin ver, doğrulama iste, reddet, step-up kimlik doğrulama) içermelidir.3V8.22Genel Yetkilendirme TasarımıV8.2.11Uygulamanın, işlev düzeyindeki erişimin yalnızca açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır.1V8.2.22Uygulamanın, veriye özel erişimin yalnızca belirli veri öğelerine açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, doğrudan nesne referansı güvenlik açıkları (IDOR) ve bozuk nesne düzeyinde yetkilendirme (BOLA) risklerini azaltır.1V8.2.33Uygulamanın, alan (field) düzeyindeki erişimin yalnızca belirli alanlara açık izinlere sahip tüketicilerle sınırlandığını sağladığı doğrulanmalıdır. Bu, bozuk nesne özelliği düzeyinde yetkilendirme (BOPLA) risklerini azaltır.2V8.2.44Tüketicinin çevresel ve bağlamsal özniteliklerine (ör. günün saati, konum, IP adresi veya cihaz) dayalı uyarlanabilir güvenlik kontrollerinin, uygulama dokümantasyonunda tanımlandığı şekilde, kimlik doğrulama ve yetkilendirme kararları için uygulandığı doğrulanmalıdır. Bu kontroller, tüketici yeni bir oturum başlatmaya çalışırken ve mevcut bir oturum sırasında uygulanmalıdır.3V8.33İşlem Düzeyinde YetkilendirmeV8.3.11Uygulamanın yetkilendirme kurallarını güvenilir bir servis katmanında uyguladığı ve istemci taraflı JavaScript gibi güvenilmeyen tüketiciler tarafından değiştirilebilecek kontrollerle yetinmediği doğrulanmalıdır.1V8.3.22Yetkilendirme kararlarının temelini oluşturan değerlerdeki değişikliklerin hemen uygulandığı doğrulanmalıdır. Değişikliklerin anında uygulanamadığı durumlarda (örneğin self-contained token içindeki verilere güveniliyorsa), tüketici artık yetkili olmadığı hâlde bir işlem gerçekleştirdiğinde uyarı verecek ve değişikliği geri alacak önlemler uygulanmalıdır. Bu alternatifin bilgi sızıntısını önlemeyeceği unutulmamalıdır.3V8.3.33Bir nesneye erişimin, herhangi bir aracı veya onun adına hareket eden bir servis yerine yalnızca erişimi başlatan öznenin (ör. tüketici) izinlerine dayandığı doğrulanmalıdır. Örneğin, bir tüketici kimlik doğrulama için bir self-contained token kullanarak bir web servis çağırırsa ve bu servis başka bir servisten veri talep ederse, ikinci servis izin kararlarını verirken birinci servisin makine-makine token'ı yerine tüketicinin token'ını kullanmalıdır.3V8.44Diğer Yetkilendirme HususlarıV8.4.11Multi-tenant uygulamaların, tüketici işlemlerinin izinli olmadıkları tenant'lar üzerinde asla etkili olmamasını sağlamak için tenant'lar arası kontroller kullandığı doğrulanmalıdır.2V8.4.22Yönetici arayüzlerine erişimin, sürekli tüketici kimlik doğrulaması, cihaz güvenlik durumu değerlendirmesi ve bağlamsal risk analizi dahil olmak üzere çok katmanlı güvenlik içerdiği doğrulanmalıdır. Yetkilendirme için yalnızca ağ konumu veya güvenilir uç noktalar yeterli olmamalıdır; ancak bu tür faktörler yetkisiz erişim olasılığını azaltabilir.3V99SelfKendi İçinde Taşıyıcı Token (Self-contained Token)V9.11Token Kaynağı ve BütünlüğüV9.1.11Self-contained token'ların içerikleri kabul edilmeden önce, oynama (tampering) saldırılarına karşı dijital imza veya MAC ile doğrulama yapıldığı doğrulanmalıdır.1V9.1.22Belirli bir bağlam için yalnızca bir allowlist üzerinde bulunan algoritmaların self-contained token oluşturmak ve doğrulamak için kullanılabildiği doğrulanmalıdır. Bu allowlist, yalnızca simetrik ya da yalnızca asimetrik algoritmaları içermeli ve kesinlikle 'None' algoritmasını içermemelidir. Hem simetrik hem de asimetrik algoritmalar desteklenmek zorundaysa, anahtar karışıklığını (key confusion) önlemek için ek kontroller uygulanmalıdır.1V9.1.33Self-contained token'ları doğrulamak için kullanılan anahtar malzemesinin, token issuer için önceden yapılandırılmış güvenilir kaynaklardan alındığı doğrulanmalıdır. Bu, saldırganların güvenilmeyen kaynak ve anahtarları belirtmesini engeller. JWT ve diğer JWS yapılarında 'jku', 'x5u' ve 'jwk' gibi header'lar güvenilir kaynaklardan oluşan bir allowlist'e göre doğrulanmalıdır.1V9.22Token İçeriğiV9.2.11Token verisinde bir geçerlilik zaman aralığı (validity time span) varsa, yalnızca doğrulama zamanı bu zaman aralığı içerisindeyse token ve içeriği kabul edilmelidir. Örneğin, JWT'ler için 'nbf' ve 'exp' claim'leri doğrulanmalıdır.1V9.2.22Token'ı alan hizmetin, token içeriğini kabul etmeden önce bu token'ın doğru türde olduğunu ve sunulma amacına uygun olduğunu doğruladığı teyit edilmelidir. Örneğin, yalnızca erişim token'ları yetkilendirme kararları için, yalnızca ID Token'lar kullanıcı kimlik doğrulamasını kanıtlamak için kullanılabilir.2V9.2.33Hizmetin yalnızca kendisiyle kullanılması amaçlanan (audience) token'ları kabul ettiği doğrulanmalıdır. JWT'lerde bu, 'aud' claim'inin hizmet içinde tanımlı bir allowlist ile doğrulanması yoluyla sağlanabilir.2V9.2.44Eğer bir token issuer, farklı audience'lara token oluşturmak için aynı private key'i kullanıyorsa, oluşturulan token'ların hedef audience'ları benzersiz şekilde tanımlayan bir audience kısıtlaması içerdiği doğrulanmalıdır. Bu, bir token'ın farklı bir audience ile yeniden kullanılmasını önler. Audience tanımlayıcısı dinamik olarak sağlanıyorsa, token issuer bu audience'ları doğrulamalı ve audience taklitlerinin (impersonation) önüne geçmelidir.2V1010OAuthOAuth ve OIDCV10.11Genel OAuth ve OIDC GüvenliğiV10.1.11Token'ların yalnızca kesinlikle ihtiyaç duyan bileşenlere gönderildiği doğrulanmalıdır. Örneğin, tarayıcı tabanlı JavaScript uygulamaları için bir backend-for-frontend modeli kullanıldığında, access ve refresh token'lara yalnızca backend'in erişebilmesi gerekir.2V10.1.22Authorization server'dan gelen değerler (örneğin authorization code veya ID Token gibi) yalnızca aynı user agent oturumu ve işlemi tarafından başlatılmış bir yetkilendirme akışının sonucuysa kabul edildiği doğrulanmalıdır. Bu, client tarafından oluşturulan secret’ların 'proof key for code exchange' (PKCE) ‘code_verifier’, ‘state’ veya OIDC ‘nonce’ gibi tahmin edilemez, işleme özgü ve hem client’a hem de işlem başlatılan user agent oturumuna güvenli bir şekilde bağlı olmasını gerektirir.2V10.22OAuth İstemcisiV10.2.11Code flow kullanılıyorsa, OAuth client’ın token taleplerini tetikleyen CSRF saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Bu genellikle PKCE kullanılarak veya authorization isteğinde gönderilen ‘state’ parametresinin kontrolü ile sağlanır.2V10.2.22OAuth istemcisi birden fazla AS ile etkileşime girebiliyorsa, mix-up saldırılarına karşı korumaya sahip olduğu doğrulanmalıdır. Örneğin, authorization server’ın 'iss' parametresini döndürmesi zorunlu kılınabilir ve bu parametrenin hem authorization yanıtında hem de token yanıtında doğrulanması gerekir.2V10.2.33OAuth istemcisinin authorization server’a yaptığı taleplerde yalnızca gerekli scope’ları (veya diğer yetkilendirme parametrelerini) talep ettiği doğrulanmalıdır.3V10.33OAuth Kaynak Sunucusu (RS)V10.3.11RS'nin yalnızca bu servisle kullanılmak üzere tasarlanmış access token’ları kabul ettiği doğrulanmalıdır (audience kontrolü). Audience bilgisi yapılandırılmış token’larda (örneğin JWT içindeki ‘aud’ claim’i) yer alabilir veya token introspection endpoint aracılığıyla kontrol edilebilir.2V10.3.22RS'nin, access token’dan gelen claim’lere dayanarak yetki devri tanımına uygun şekilde yetkilendirme kararları uyguladığı doğrulanmalıdır. ‘sub’, ‘scope’ ve ‘authorization_details’ gibi claim’ler varsa, bu kararın parçası olmalıdır.2V10.3.33Erişim kontrolü kararında, access token’dan (JWT veya ilgili token introspection yanıtı) benzersiz bir kullanıcının tanımlanması gerekiyorsa, RS'nin başka kullanıcılara devredilemeyecek claim’ler ile kullanıcıyı tanımladığı doğrulanmalıdır. Genellikle bu, ‘iss’ ve ‘sub’ claim’lerinin birlikte kullanılması anlamına gelir.2V10.3.44RS'nin belirli bir kimlik doğrulama gücü, yöntemi veya güncelliği (recentness) gerektirmesi durumunda, sunulan access token’ın bu kısıtlamaları karşıladığını doğruladığı, örneğin, OIDC ‘acr’, ‘amr’ ve ‘auth_time’ claim’leri kullanılarak doğrulanmalıdır. 2V10.3.55RS'nin, (yetkisiz taraflarca) çalınmış veya tekrar edilen access token’ların kullanımını önlemek için sender-constrained access token’lar kullandığı doğrulanmalıdır. Bu, OAuth 2 için Mutual TLS veya OAuth 2 Demonstration of Proof of Possession (DPoP) ile sağlanabilir.3V10.44OAuth Yetkilendirme Sunucusu (AS)V10.4.11AS'nin, istemciye özel önceden kaydedilmiş URI’lerden oluşan bir allowlist kullanarak redirect URI’leri tam dize karşılaştırması ile doğruladığı doğrulanmalıdır.1V10.4.22AS'nin, "authorization response" içinde "authorization code" döndürdüğü durumlarda, bu kodun yalnızca bir kez kullanılabildiği doğrulanmalıdır. Daha önce access token vermek için kullanılmış bir authorization code ile yapılan ikinci geçerli token isteği reddedilmeli ve ilgili tüm token’lar iptal edilmelidir.1V10.4.33Authorization code’un kısa ömürlü olduğu doğrulanmalıdır. L1 ve L2 uygulamalar için maksimum yaşam süresi 10 dakika, L3 uygulamalar için 1 dakikadır.1V10.4.44Belirli bir istemci için AS'nin yalnızca o istemcinin ihtiyaç duyduğu grant türlerine izin verdiği doğrulanmalıdır. "Token" (Implicit flow) ve "password" (Resource Owner Password Credentials flow) grant türlerinin artık kullanılmaması gerekir.1V10.4.55AS'nin, açık istemciler için refresh token replay saldırılarını azalttığı doğrulanmalıdır. Tercihen sender-constrained refresh token’lar (DPoP veya mutual TLS ile certificate-bound access token’lar) kullanılmalıdır. L1 ve L2 uygulamalar için refresh token rotation kullanılabilir. Rotation kullanılıyorsa, AS refresh token’ı kullanım sonrası geçersiz kılmalı ve geçersiz bir refresh token sunulması durumunda o yetkilendirme ile ilişkili tüm refresh token’ları iptal etmelidir.1V10.4.66Code grant kullanılıyorsa, AS'nin authorization code interception saldırılarına karşı koruma sağladığı doğrulanmalıdır. Yetkilendirme isteğinde geçerli bir "code_challenge" değeri zorunlu olmalı ve "code_challenge_method" olarak "plain" kabul edilmemelidir. Token isteğinde ise "code_verifier" parametresi doğrulanmalıdır.2V10.4.77AS'nin, kimlik doğrulaması yapılmamış dinamik istemci kaydını desteklemesi durumunda, kötü niyetli istemci uygulamalarına karşı riskleri azalttığı doğrulanmalıdır. Kayıtlı URI’ler gibi client metadata’sı doğrulanmalı, kullanıcı onayı alınmalı ve güvenilmeyen bir client uygulamasıyla yapılan yetkilendirme isteği işlenmeden önce kullanıcı uyarılmalıdır.2V10.4.88Refresh token’ların, sliding expiration kullanılsa bile mutlak bir sona erme süresine sahip olduğu doğrulanmalıdır.2V10.4.99Yetkili bir kullanıcı tarafından AS kullanıcı arayüzü üzerinden refresh token’ların ve reference access token’ların iptal edilebildiği doğrulanmalıdır.2V10.4.1010Gizli istemcilerin token istekleri, pushed authorization request (PAR) ve token iptal istekleri gibi server’a yapılan backchannel isteklerinde kimliğinin kontrol edildiği doğrulanmalıdır.2V10.4.1111AS yapılandırmasının, OAuth istemcisine yalnızca gerekli scope’ları atadığı doğrulanmalıdır.2V10.4.1212Belirli bir client için, authorization server’ın yalnızca client’ın ihtiyaç duyduğu 'response_mode' değerine izin verdiği doğrulanmalıdır. Örneğin, bu değer ya beklenenlerle karşılaştırılarak doğrulanmalı ya da PAR veya JAR kullanılmalıdır.3V10.4.1313"Code" grant türünün daima pushed authorization request (PAR) ile birlikte kullanıldığı doğrulanmalıdır.3V10.4.1414AS'nin yalnızca sender-constrained (Proof-of-Possession) access token’lar ürettiği doğrulanmalıdır. Bu, mutual TLS ile certificate-bound access token ya da DPoP ile DPoP-bound access token olabilir.3V10.4.1515Sunucu taraflı istemciler için (kullanıcı cihazında çalışmayan), AS'nin "authorization_details" parametresinin istemci backend'i tarafından sağlandığını ve kullanıcı tarafından değiştirilmediğini doğruladığı, örneğin pushed authorization request (PAR) or JWT-secured Authorization Request (JAR) zorunlu kılınarak doğrulanmalıdır.3V10.4.1616Bir istemci gizli ise, AS'nin güçlü istemci kimlik doğrulama yöntemlerini zorunlu kıldığı doğrulanmalıdır. Bu yöntemler, public-key cryptography’ye dayalı ve replay saldırılarına karşı dayanıklı olmalı, örneğin mutual TLS ("tls_client_auth", "self_signed_tls_client_auth") veya private key JWT ("private_key_jwt") gibi.3V10.55OIDC İstemcisiV10.5.11İstemcinin (relying party olarak) ID Token replay saldırılarını azalttığı doğrulanmalıdır. Örneğin, ID Token’daki 'nonce' claim’inin, OpenID Provider’a gönderilen kimlik doğrulama isteğindeki 'nonce' değeriyle eşleştiği doğrulanmalıdır.2V10.5.22İstemcinin kullanıcıyı ID Token claim’lerinden (genellikle, başka kullanıcılarla yeniden atanamayan 'sub' claim’i) benzersiz şekilde tanımladığı doğrulanmalıdır.2V10.5.33İstemcinin, kötü niyetli bir AS'nin başka bir AS'yi taklit etmesini AS metadata’sı üzerinden reddettiği doğrulanmalıdır. AS metadata’sındaki issuer URL’si, istemci tarafından beklenen önceden yapılandırılmış issuer URL’siyle tam olarak eşleşmiyorsa, metadata reddedilmelidir.2V10.5.44İstemcinin, ID Token’ın kendisi için (audience) kullanılması amaçlandığını doğruladığı doğrulanmalıdır. Bu, token’daki 'aud' claim’inin istemcinin 'client_id' değeriyle eşit olup olmadığının kontrol edilmesiyle yapılır.2V10.5.55OIDC back-channel logout kullanıldığında, relying party’nin "forced logout" ve "logout" akışında "cross-JWT confusion" gibi saldırılara karşı koruma sağladığı doğrulanmalıdır. Client, logout token’ın 'logout+jwt' türünde olduğunu, 'event' claim’inin doğru üyeye sahip olduğunu ve 'nonce' claim’i içermediğini doğrulamalıdır. Ayrıca token için kısa bir sona erme süresi (örneğin 2 dakika) önerilir.2V10.66OpenID ProviderV10.6.11OpenID Provider’ın yalnızca 'code', 'ciba', 'id_token' veya 'id_token code' response mode değerlerine izin verdiği doğrulanmalıdır. 'code' değeri, 'id_token code' (OIDC Hybrid flow) yerine tercih edilmelidir. 'token' (Implicit flow) kullanılmamalıdır.2V10.6.22OpenID Provider’ın forced logout yoluyla yapılan hizmet reddi saldırılarını önlediği doğrulanmalıdır. Bu, son kullanıcıdan açık onay alınarak veya varsa logout isteğinde (relying party tarafından başlatılan) bulunan parametrelerin, örneğin 'id_token_hint', doğrulanmasıyla yapılabilir.2V10.77Onay (Consent) YönetimiV10.7.11AS'nin her yetkilendirme isteği için kullanıcının onayını aldığı doğrulanmalıdır. İstemcinin kimliği garanti altına alınamıyorsa, AS daima kullanıcıdan açıkça onay istemelidir.2V10.7.22AS'nin kullanıcıdan onay istediğinde, neye onay verildiğini açık ve yeterli şekilde gösterdiği doğrulanmalıdır. Uygun olduğunda bu bilgiler, istenen yetkilendirmelerin doğasını (genellikle scope, resource server, RAR gibi detaylara dayalı), yetkilendirilmiş uygulamanın kimliğini ve bu yetkilendirmelerin süresini içermelidir.2V10.7.33Kullanıcının, AS üzerinden verdiği onayları görüntüleyebildiği, değiştirebildiği ve iptal edebildiği doğrulanmalıdır.2V1111CryptographyKriptografiV11.11Kriptografik Envanter ve DokümantasyonV11.1.11Kriptografik anahtarların yönetimi için belgelenmiş bir politika ve NIST SP 800-57 gibi bir anahtar yönetim standardını izleyen bir kriptografik anahtar yaşam döngüsü tanımlandığı doğrulanmalıdır. Bu, anahtarların aşırı miktarda paylaşılmadığını (örneğin, paylaşılan sırlar için ikiden fazla tarafla veya özel anahtarlar için birden fazla tarafla) garanti altına almalıdır.2V11.1.22Tüm kriptografik anahtarlar, algoritmalar ve uygulama tarafından kullanılan sertifikaları içeren bir kriptografik envanterin oluşturulduğu, sürdürüldüğü ve düzenli olarak güncellendiği doğrulanmalıdır. Bu envanter ayrıca, sistemde anahtarların nerede kullanılabileceğini ve kullanılamayacağını, ve hangi veri türlerinin bu anahtarlarla korunup korunamayacağını da belgelemelidir.2V11.1.33Sistem içerisinde şifreleme, özetleme ve imzalama işlemleri dahil olmak üzere kriptografi kullanımının tüm örneklerini tespit etmek için kriptografik keşif mekanizmalarının kullanıldığı doğrulanmalıdır.3V11.1.44Kriptografik bir envanterin sürdürüldüğü doğrulanmalıdır. Bu envanter, gelecekteki tehditlere karşı tepki verebilmek amacıyla post-kuantum kriptografiye geçiş yolunu belirten belgelenmiş bir plan içermelidir.3V11.22Güvenli Kriptografi UygulamasıV11.2.11Kriptografik işlemler için sektör tarafından doğrulanmış uygulamaların (kütüphaneler ve donanım hızlandırmalı uygulamalar dahil) kullanıldığı doğrulanmalıdır.2V11.2.22Uygulamanın, rastgele sayı üreticileri, kimliği doğrulanmış şifreleme, MAC veya özetleme algoritmaları, anahtar uzunlukları, turlar, şifreler ve modların herhangi bir zamanda yeniden yapılandırılabilir, yükseltilebilir veya değiştirilebilir olacağı şekilde kripto çevikliği (crypto agility) ile tasarlandığı doğrulanmalıdır. Aynı şekilde, anahtarların ve parolaların değiştirilebilmesi ve verilerin yeniden şifrelenebilmesi mümkün olmalıdır. Bu, onaylanmış PQC şemalarının yüksek güvenlikli uygulamaları yaygın olarak kullanılabilir hale geldiğinde sorunsuz geçişe olanak tanır.2V11.2.33Tüm kriptografik ilkeliklerin, algoritma, anahtar boyutu ve yapılandırmaya göre minimum 128 bit güvenlik sağladığı doğrulanmalıdır. Örneğin, 256-bit ECC anahtarı yaklaşık 128 bit güvenlik sağlarken, RSA için aynı güvenliği elde etmek 3072-bit anahtar gerektirir.2V11.2.44Tüm kriptografik işlemlerin sabit süreli (constant-time) olduğu, karşılaştırmalarda, hesaplamalarda veya geri dönüşlerde kısa devre (short-circuit) işlemleri yapılmadığı doğrulanmalıdır; bu, bilgi sızıntısını önlemek için gereklidir.3V11.2.55Tüm kriptografik modüllerin güvenli şekilde hata verdiği ve hataların, padding oracle saldırıları gibi zafiyetleri mümkün kılmayacak şekilde ele alındığı doğrulanmalıdır.3V11.33Şifreleme AlgoritmalarıV11.3.11Güvensiz blok modlarının (örneğin, ECB) ve zayıf doldurma (padding) şemalarının (örneğin, PKCS#1 v1.5) kullanılmadığı doğrulanmalıdır.1V11.3.22Yalnızca AES ile GCM gibi onaylı şifreleme algoritmalarının ve modlarının kullanıldığı doğrulanmalıdır.1V11.3.33Şifrelenmiş verilerin yetkisiz değişikliklere karşı korunduğu doğrulanmalıdır. Tercihen bu koruma, onaylı bir kimliği doğrulanmış şifreleme yöntemi kullanılarak ya da onaylı bir şifreleme yöntemi ile onaylı bir MAC algoritmasının kombinasyonu ile sağlanmalıdır.2V11.3.44Sayılar, başlatma vektörleri (IV) ve diğer tek kullanımlık değerlerin, aynı şifreleme anahtarı ve veri öğesi çifti için birden fazla kez kullanılmadığı doğrulanmalıdır. Oluşturma yöntemi kullanılan algoritmaya uygun olmalıdır.3V11.3.55Şifreleme algoritması ve MAC algoritması kombinasyonlarının "encrypt-then-MAC" modunda çalıştığı doğrulanmalıdır.3V11.44Hashing ve Hash Tabanlı FonksiyonlarV11.4.11Dijital imzalar, HMAC, KDF ve rastgele bit üretimi gibi genel kriptografik kullanım senaryolarında yalnızca onaylı hash fonksiyonlarının kullanıldığı doğrulanmalıdır. MD5 gibi yasaklı hash fonksiyonları hiçbir kriptografik amaçla kullanılmamalıdır.1V11.4.22Parolaların, onaylı, hesaplama açısından yoğun ve mevcut rehberliğe göre yapılandırılmış bir anahtar türetme fonksiyonu (diğer adıyla parola hash'leme fonksiyonu) kullanılarak saklandığı doğrulanmalıdır. Ayarlar, güvenlik ve performans dengesini sağlayarak kaba kuvvet saldırılarını zorlaştırmalıdır.2V11.4.33Dijital imzalarda kullanılan hash fonksiyonlarının, veri bütünlüğü ve kimlik doğrulama amacıyla kullanıldığında çakışmaya karşı dayanıklı ve yeterli bit uzunluğuna sahip olduğu doğrulanmalıdır. Çakışma dayanıklılığı gerekiyorsa çıktı uzunluğu en az 256 bit olmalıdır. Sadece ikinci ön-görüntü (2nd pre-iamge) saldırılarına karşı dayanıklılık gerekiyorsa çıktı uzunluğu en az 128 bit olmalıdır.2V11.4.44Parolalardan gizli anahtarlar türetilirken, onaylı anahtar türetme fonksiyonlarının anahtar uzatma (key stretching) parametreleriyle birlikte kullanıldığı doğrulanmalıdır. Bu parametreler, kaba kuvvet saldırılarını önleyecek şekilde güvenlik ve performans dengesine sahip olmalıdır.2V11.55Rastgele DeğerlerV11.5.11Tahmin edilemez olması amaçlanan tüm rastgele sayıların ve dizelerin, CSPRNG ile oluşturulduğu ve en az 128 bit entropiye sahip olduğu doğrulanmalıdır. UUID'lerin bu koşulu dikkate almadığını unutmayın.2V11.5.22Kullanılan rastgele sayı üretim mekanizmasının, yoğun talep altında dahi güvenli çalışacak şekilde tasarlandığı doğrulanmalıdır.3V11.66Açık Anahtar (Public Key) KriptografisiV11.6.11Anahtar üretimi, tohumlama (seeding) ve dijital imza üretimi ve doğrulama için yalnızca onaylı kriptografik algoritmalar ve çalışma modlarının kullanıldığı doğrulanmalıdır. Anahtar üretim algoritmaları, bilinen saldırılara karşı savunmasız anahtarlar üretmemelidir. Örneğin, Fermat çarpanlama yöntemine karşı savunmasız RSA anahtarları oluşturulmamalıdır.2V11.6.22Anahtar değişimi için yalnızca onaylı kriptografik algoritmaların kullanıldığı doğrulanmalıdır (örneğin Diffie-Hellman). Kullanılan parametrelerin güvenli olması gerektiğine dikkat edilmelidir. Bu, anahtar kurulum sürecine yönelik saldırıları önleyecek ve araya girme (adversary-in-the-middle) ya da kriptografik kırılmaları engelleyecektir.3V11.77Kullanım Halindeki Verilerin KriptografisiV11.7.11Hassas verilerin kullanım sırasında korunmasını sağlamak amacıyla, yetkisiz kullanıcıların veya süreçlerin bu verilere erişmesini engelleyen tam bellek şifrelemesinin kullanıldığı doğrulanmalıdır.3V11.7.22Veri asgariyetinin sağlandığı, yani işleme sırasında mümkün olan en az miktarda verinin ortaya çıktığı ve verilerin kullanımdan hemen sonra veya mümkün olan en kısa sürede şifrelendiği doğrulanmalıdır.3V1212SecureGüvenli İletişimV12.11Genel TLS Güvenlik RehberiV12.1.11Yalnızca TLS protokolünün en güncel ve önerilen sürümlerinin (örneğin TLS 1.2 ve TLS 1.3) etkinleştirildiği ve en son sürümün varsayılan olarak tercih edildiği doğrulanmalıdır.1V12.1.22Yalnızca önerilen şifre takımlarının (cipher suite) etkinleştirildiği ve en güçlü şifre takımlarının tercih edildiği doğrulanmalıdır. Seviye 3 (L3) uygulamalar yalnızca ileri gizlilik (forward secrecy) sağlayan şifre takımlarını desteklemelidir.2V12.1.33Uygulamanın, mTLS istemci sertifikalarını kimlik doğrulama veya yetkilendirme amacıyla kullanmadan önce bu sertifikaların güvendiği sertifikalar arasında olduğunu doğruladığı kontrol edilmelidir.2V12.1.44Online Certificate Status Protocol (OCSP) Stapling gibi geçerli bir sertifika iptal kontrolü yönteminin etkinleştirildiği ve yapılandırıldığı doğrulanmalıdır.3V12.1.55TLS el sıkışma (handshake) sürecinde Server Name Indication (SNI) gibi hassas meta verilerin ifşa edilmesini önlemek için, uygulamanın TLS yapılandırmasında Encrypted Client Hello (ECH) özelliğinin etkinleştirildiği doğrulanmalıdır.3V12.22Dışa Açık Hizmetlerle HTTPS İletişimiV12.2.11İstemci ile dışa açık, HTTP tabanlı hizmetler arasındaki tüm bağlantılarda TLS kullanıldığı ve bu bağlantıların güvensiz ya da şifrelenmemiş iletişime geri dönmediği doğrulanmalıdır.1V12.2.22Dışa açık hizmetlerin herkese açık olarak güvenilen TLS sertifikaları kullandığı doğrulanmalıdır.1V12.33Genel Servisler Arası İletişim GüvenliğiV12.3.11Uygulamaya gelen ve uygulamadan çıkan tüm bağlantılarda izleme sistemleri, yönetim araçları, uzaktan erişim ve SSH, ara yazılımlar, veritabanları, ana sistemler (mainframe), iş ortağı sistemleri ya da dış API'ler dahil olmak üzere TLS gibi şifreli bir protokolün kullanıldığı ve güvensiz ya da şifrelenmemiş protokollere geri dönülmediği doğrulanmalıdır.2V12.3.22TLS istemcilerinin bir TLS sunucusu ile iletişime geçmeden önce alınan sertifikaları doğruladığı kontrol edilmelidir.2V12.3.33Uygulama içindeki HTTP tabanlı iç hizmetler arasında gerçekleşen tüm bağlantılarda TLS ya da uygun başka bir aktarım şifreleme mekanizmasının kullanıldığı ve güvensiz ya da şifrelenmemiş iletişime geri dönülmediği doğrulanmalıdır.2V12.3.44İç hizmetler arasındaki TLS bağlantılarında güvenilir sertifikaların kullanıldığı doğrulanmalıdır. İç sistemlerde oluşturulmuş ya da kendinden imzalı (self-signed) sertifikalar kullanılıyorsa, bu sertifikalara güvenen hizmetlerin yalnızca belirli dahili sertifika otoritelerine (CA) ve belirli kendinden imzalı sertifikalara güvenecek şekilde yapılandırıldıkları doğrulanmalıdır.2V12.3.55Sistem içindeki hizmetlerin birbiriyle iletişim kurarken her bir uç noktanın kimliğini doğrulamak için güçlü kimlik doğrulama yöntemlerinin kullanıldığı doğrulanmalıdır. Bu yöntemler arasında, açık anahtar altyapısı (public-key infrastructure) kullanan ve tekrar oynatma saldırılarına karşı dayanıklı olan TLS istemci kimlik doğrulaması gibi yöntemler yer almalıdır. Mikroservis mimarilerinde, sertifika yönetimini basitleştirmek ve güvenliği artırmak amacıyla bir servis ağı (service mesh) kullanılması değerlendirilmelidir.3V1313ConfigurationKonfigürasyonV13.11Konfigürasyon DokümantasyonuV13.1.11Uygulamanın tüm iletişim ihtiyaçlarının dokümante edildiği doğrulanmalıdır. Buna, uygulamanın bağımlı olduğu dış hizmetler ve son kullanıcının uygulamanın bağlantı kurmasını sağlayabileceği dış konumlar da dahil olmalıdır.2V13.1.22Uygulamanın kullandığı her bir hizmet için, dokümantasyonda eşzamanlı bağlantı sayısı (örn. bağlantı havuzu limitleri) ve bu sınır aşıldığında uygulamanın davranışı, geri dönüş veya kurtarma mekanizmaları da dahil olmak üzere hizmet reddi koşullarını önlemek için tanımlandığı doğrulanmalıdır.3V13.1.33Uygulamanın, kullandığı her bir dış sistem veya hizmet (örn. veritabanları, dosya tanıtıcıları, iş parçacıkları, HTTP bağlantıları) için kaynak yönetimi stratejilerini tanımladığı doğrulanmalıdır. Bu stratejiler, kaynak serbest bırakma prosedürlerini, zaman aşımı ayarlarını, hata durumlarını ve tekrar deneme mantığı uygulanmışsa sınırları, gecikmeleri ve geri çekilme (back-off) algoritmalarını içermelidir. Senkron HTTP istek–yanıt işlemleri için kısa zaman aşımı süreleri zorunlu tutulmalı ve tekrar eden denemeler devre dışı bırakılmalı ya da sıkı şekilde sınırlandırılmalıdır.3V13.1.44Uygulamanın, güvenlik açısından kritik olan gizli verileri tanımladığı ve kuruluşun tehdit modeli ve iş ihtiyaçlarına göre bu verilerin döndürülme (rotation) zamanlamasının belgelendiği doğrulanmalıdır.3V13.22Backend İletişim KonfigürasyonuV13.2.11Uygulamanın, standart kullanıcı oturum mekanizmasını desteklemeyen backend bileşenleri (örneğin API'ler, ara katmanlar, veri katmanları) arasında gerçekleşen iletişimlerin kimlik doğrulamasıyla korunduğu doğrulanmalıdır. Kimlik doğrulama; bireysel hizmet hesapları, kısa ömürlü token'lar ya da sertifika tabanlı kimlik doğrulama ile yapılmalıdır ve parola, API anahtarı ya da ayrıcalıklı erişime sahip paylaşımlı hesaplar gibi sabit kimlik bilgileri kullanılmamalıdır.2V13.2.22Uygulamanın backend bileşenleri arasında (yerel hizmetler, işletim sistemi hizmetleri, API'ler, ara katmanlar ve veri katmanları dahil) gerçekleştirilen iletişimlerin, yalnızca gerekli en az ayrıcalığa sahip hesaplarla yapıldığı doğrulanmalıdır.2V13.2.33Bir hizmet kimlik doğrulaması için bir kimlik bilgisi kullanılması gerekiyorsa, bu kimlik bilgisinin varsayılan bir değer (örneğin root/root veya admin/admin) olmadığının doğrulanması gereklidir.2V13.2.44Uygulamanın iletişim kurmasına izin verilen dış kaynaklar ya da sistemlerin, bir allowlist (izinli liste) ile tanımlandığı doğrulanmalıdır. Bu liste, uygulama katmanında, web sunucusunda, güvenlik duvarında veya farklı katmanların birleşiminde uygulanabilir.2V13.2.55Web veya uygulama sunucusunun, dış sistemlere veri veya dosya gönderimi veya yüklemesi yaparken sadece belirli kaynaklara izin verecek şekilde allowlist ile yapılandırıldığı doğrulanmalıdır.2V13.2.66Uygulamanın farklı hizmetlere bağlantı kurduğu durumlarda, bu bağlantılar için belgelenmiş yapılandırmaları (örn. maksimum eşzamanlı bağlantı, bağlantı limiti aşıldığında davranış, zaman aşımı, tekrar deneme stratejileri) takip ettiğinin doğrulanması gereklidir.3V13.33Gizli Bilgi YönetimiV13.3.11Parolalar, anahtar materyalleri, veritabanı ve üçüncü parti sistemlerle entegrasyon bilgileri, zaman tabanlı token'lar için tohum (seed) bilgileri, dahili gizli veriler ve API anahtarları gibi backend sırlarının güvenli bir şekilde oluşturulması, saklanması, erişim denetiminin sağlanması ve imha edilmesi için bir gizli bilgi yönetim çözümünün (örneğin key vault) kullanıldığı doğrulanmalıdır. Bu gizli bilgiler uygulama kaynak koduna dahil edilmemeli ve yapı çıktılarında yer almamalıdır. Seviye 3 uygulamalar için donanım destekli bir çözüm (örneğin HSM) gereklidir.2V13.3.22Gizli bilgilere erişimin en az ayrıcalık prensibine uygun şekilde yapılandırıldığı doğrulanmalıdır.2V13.3.33Tüm kriptografik işlemlerin, anahtar materyallerinin güvenli bir şekilde yönetilmesi ve dışarıya sızmasının engellenmesi amacıyla, izole edilmiş bir güvenlik modülü (örneğin vault ya da donanım güvenlik modülü) aracılığıyla gerçekleştirildiği doğrulanmalıdır.3V13.3.44Uygulamanın belgelerinde belirtildiği şekilde gizli bilgilerin süresinin dolacak şekilde yapılandırıldığı ve düzenli olarak döndürüldüğü doğrulanmalıdır.3V13.44İstenmeyen Bilgi SızıntısıV13.4.11Uygulamanın .git veya .svn klasörleri gibi kaynak kontrolüyle ilgili metadata içermeyecek şekilde deploy edildiğini ya da bu klasörlerin hem dış erişime hem de uygulama erişimine kapalı olduğu doğrulanmalıdır.1V13.4.22Tüm bileşenler için üretim ortamlarında hata ayıklama (debug) modlarının devre dışı bırakıldığı doğrulanmalıdır.2V13.4.33Web sunucularının, açık şekilde istenmediği sürece dizin listelemesi (directory listing) özelliğini istemcilere sunmadığı doğrulanmalıdır.2V13.4.44HTTP TRACE metodunun üretim ortamlarında desteklenmediği, böylece potansiyel bilgi sızıntılarının önlendiği doğrulanmalıdır.2V13.4.55Belgeler (örneğin dahili API belgeleri) ve izleme uç noktalarının (monitoring endpoints) yalnızca açıkça belirtildiği durumlarda erişilebilir olduğu doğrulanmalıdır.2V13.4.66Uygulamanın arka uç bileşenlerinin ayrıntılı sürüm bilgilerini ifşa etmediği doğrulanmalıdır.3V13.4.77Web katmanının yalnızca belirli dosya uzantılarına sahip dosyaları sunacak şekilde yapılandırıldığı, bu sayede istem dışı bilgi, yapılandırma ya da kaynak kod sızıntılarının önlendiği doğrulanmalıdır.3V1414DataVeri KorumaV14.11Veri Koruma DokümantasyonuV14.1.11Uygulama tarafından oluşturulan ve işlenen tüm hassas verilerin tanımlanıp, koruma seviyelerine göre sınıflandırıldığından emin olun. Bu, yalnızca kodlanmış (örneğin Base64 stringleri ya da JWT içindeki düz metin yükler gibi) ve bu nedenle kolayca çözülebilir verileri de içermelidir. Koruma seviyeleri, uygulamanın uymakla yükümlü olduğu veri koruma ve gizlilik düzenlemeleri ile standartlarını dikkate almalıdır.2V14.1.22Tüm hassas veri koruma seviyeleri için belgelenmiş bir koruma gereksinimleri seti tanımlandığından emin olun. Bu gereksinimler genel şifreleme, bütünlük doğrulama, saklama süresi, verinin nasıl günlüğe kaydedileceği, günlüklerdeki hassas verilere erişim kontrolleri, veritabanı düzeyinde şifreleme, gizlilik ve gizliliği artırıcı teknolojiler ile diğer gizlilik gereksinimlerini kapsamalıdır.2V14.22Genel Veri KorumasıV14.2.11Hassas verilerin yalnızca HTTP message body veya header alanlarında sunucuya gönderildiği ve URL ile sorgu parametrelerinin, API anahtarı veya session token’ı gibi hassas bilgiler içermediği doğrulanmalıdır.1V14.2.22Hassas verilerin, yük dengeleyiciler ve uygulama önbellekleri gibi sunucu bileşenlerinde önbelleğe alınmasının engellendiği veya kullanım sonrası bu verilerin güvenli biçimde temizlendiği doğrulanmalıdır.2V14.2.33Uygulama kontrolü dışında veri toplanmasını engellemek için, tanımlanmış hassas verilerin, kullanıcı izleyicileri gibi güvensiz taraflara gönderilmediği doğrulanmalıdır.2V14.2.44Hassas verilere yönelik şifreleme, bütünlük doğrulama, veri saklama, loglama yöntemi, loglardaki erişim kontrolleri, gizlilik teknolojileri gibi kontrollerin, söz konusu verinin belgelenmiş koruma seviyesinde tanımlandığı şekilde uygulandığı doğrulanmalıdır.2V14.2.55Önbellekleme mekanizmalarının yalnızca belirli içerik türüne sahip yanıtları önbelleğe alacak şekilde yapılandırıldığı ve hassas, dinamik içeriklerin önbelleğe alınmadığı doğrulanmalıdır. Web sunucusu, mevcut olmayan bir dosya talebinde geçerli ama farklı bir dosya döndürmek yerine 404 veya 302 cevabı vermelidir. Bu, Web Cache Deception saldırılarını önlemeye yardımcı olur.3V14.2.66Uygulamanın yalnızca işlevsellik için gerekli olan asgari hassas veriyi döndürdüğü doğrulanmalıdır. Örneğin, kredi kartı numarasının yalnızca bazı rakamlarının döndürülmesi; tam numaranın döndürülmesi gerekiyorsa, kullanıcı arayüzünde gizlenmiş (maskelenmiş) şekilde sunulması gerekir, aksi kullanıcı özel olarak görüntülemek istemedikçe gösterilmemelidir.3V14.2.77Hassas bilgilerin, veri saklama sınıflandırmasına tabi tutulduğu, geçerliliğini yitirmiş veya artık gerekli olmayan verilerin belirlenmiş bir zaman çizelgesiyle ya da gerektiğinde otomatik olarak silindiği doğrulanmalıdır.3V14.2.88Kullanıcı tarafından yüklenen dosyaların meta verilerinden hassas bilgilerin çıkarıldığı veya bu bilgilerin yalnızca kullanıcıdan açık onay alındığında saklandığı doğrulanmalıdır.3V14.33İstemci Tarafı Veri KorumasıV14.3.11Kimliği doğrulanmış verilerin, istemci veya oturum sonlandığında istemci depolamasından (örneğin tarayıcı DOM’undan) temizlendiği doğrulanmalıdır. 'Clear-Site-Data' HTTP response header bu konuda yardımcı olabilir ancak istemci tarafı, sunucu bağlantısı mevcut olmadığında da temizlik işlemini yapabiliyor olmalıdır.1V14.3.22Uygulamanın, tarayıcılarda hassas verilerin önbelleğe alınmasını önlemek amacıyla yeterli anti-önbellekleme HTTP response header (örneğin Cache-Control: no-store) ayarladığı doğrulanmalıdır.2V14.3.33Tarayıcıda depolanan verilerin (örneğin localStorage, sessionStorage, IndexedDB veya çerezler) hassas veri içermediği, yalnızca session token’larının istisna olarak kabul edildiği doğrulanmalıdır.2V1515SecureGüvenli Kodlama ve MimariV15.11Güvenli Kodlama ve Mimari DokümantasyonuV15.1.11Güvenlik açığı içeren üçüncü taraf bileşen sürümleri ve genel olarak kütüphane güncellemeleri için, uygulama dokümantasyonunda risk bazlı düzeltme zamanlarının tanımlandığı doğrulanmalıdır.1V15.1.22Yazılım bileşen listesi (Software Bill of Materials - SBOM) gibi bir envanterin tutulduğu, kullanılan tüm üçüncü taraf kütüphanelerin önceden tanımlanmış, güvenilir ve düzenli olarak güncellenen depolardan alındığı doğrulanmalıdır.2V15.1.33Uygulama dokümantasyonunda zaman veya kaynak açısından yoğun işlevlerin tanımlandığı, bu işlevlerin aşırı kullanımı durumunda kullanılabilirlik kaybının nasıl önleneceği ve yanıt oluşturma süresinin istemci zaman aşımını aşmaması için hangi önlemlerin alındığı belirtilmelidir. Örnek savunmalar kuyruklama, eşzamansız işleme, kullanıcı başına ve uygulama genelinde paralel işlem sınırlarını içerebilir.2V15.1.44Uygulama dokümantasyonunda "riskli bileşenler" olarak değerlendirilen üçüncü taraf kütüphanelerin vurgulandığı doğrulanmalıdır.3V15.1.55Uygulama dokümantasyonunda "tehlikeli işlevsellik" içeren uygulama bölümlerinin açıkça belirtildiği doğrulanmalıdır.3V15.22Güvenlik Mimarisi ve BağımlılıklarV15.2.11Uygulamanın yalnızca, belgelenmiş güncelleme ve düzeltme sürelerini aşmamış bileşenleri içerdiği doğrulanmalıdır.1V15.2.22Uygulamanın, belgelenmiş güvenlik kararları ve stratejilere dayanarak, zaman veya kaynak açısından yoğun işlevlerin neden olabileceği kullanılabilirlik kaybına karşı savunmalar uyguladığı doğrulanmalıdır.2V15.2.33Üretim ortamının yalnızca uygulamanın çalışması için gerekli işlevleri içerdiği ve test kodları, örnek kod parçaları veya geliştirme işlevleri gibi gereksiz işlevsellikleri açığa çıkarmadığı doğrulanmalıdır.2V15.2.44Üçüncü taraf bileşenlerin ve bunların tüm transitif bağımlılıklarının beklenen depolardan (iç kaynaklı ya da harici) alındığı ve bağımlılık karışıklığı (dependency confusion) saldırılarına açık olmadığı doğrulanmalıdır.3V15.2.55Uygulamanın, “tehlikeli işlevsellik” içeren veya “riskli bileşenler” kullanan bölümlerine ek korumalar uyguladığı doğrulanmalıdır. Bu korumalar sandbox, kapsülleme, konteynerleştirme veya ağ düzeyinde izolasyon gibi teknikler aracılığıyla, bir uygulama bölümünün ele geçirilmesi durumunda saldırganın diğer bölümlere sıçramasını geciktirmeyi veya engellemeyi amaçlamalıdır.3V15.33Savunmacı KodlamaV15.3.11Uygulamanın yalnızca gerekli alanların bir alt kümesini veri nesnesinden döndürdüğü doğrulanmalıdır. Örneğin, bazı alanlara kullanıcıların erişmemesi gerektiğinden tüm veri nesnesi döndürülmemelidir.1V15.3.22Uygulama backend'i harici URL’lere çağrı yaptığında, yalnızca amaçlanan işlevsellik söz konusuysa yönlendirmeleri takip edecek şekilde yapılandırıldığının doğrulanması gerekir.2V15.3.33Uygulamanın, kitlesel atama saldırılarına karşı, her bir controller ve eylem için izin verilen alanları sınırlandırarak savunmalar sağladığı doğrulanmalıdır. Örneğin, bir alan değeri, bu işlemde değiştirilmesi amaçlanmadıysa eklenememeli veya güncellenememelidir.2V15.3.44Tüm proxy ve ara katman bileşenlerinin kullanıcının orijinal IP adresini, uç kullanıcı tarafından değiştirilemeyecek güvenilir veri alanları kullanarak doğru şekilde ilettiği ve uygulamanın ve web sunucusunun bu doğru değeri, loglama ve hız sınırlama gibi güvenlik kararları için kullandığı doğrulanmalıdır. Ayrıca, orijinal IP adresinin bile dinamik IP'ler, VPN'ler veya kurumsal güvenlik duvarları nedeniyle güvenilir olmayabileceği dikkate alınmalıdır.2V15.3.55Uygulamanın değişkenlerin doğru türde olduğunu açıkça doğruladığı ve sıkı eşitlik ve karşılaştırma işlemleri kullandığı doğrulanmalıdır. Bu, değişken türüyle ilgili varsayımlardan kaynaklanan tür oynama (type juggling) veya tür karışıklığı (type confusion) güvenlik açıklarını önlemek içindir.2V15.3.66JavaScript kodunun prototip zehirleme (prototype pollution) saldırılarını önleyecek şekilde yazıldığı, örneğin, nesne literal’leri yerine Set() veya Map() gibi yapılar kullanıldığı doğrulanmalıdır.2V15.3.77Uygulamanın, özellikle framework'ün istek parametrelerinin kaynağı (sorgu dizgisi, gövde parametreleri, çerezler veya başlık alanları) arasında ayrım yapmadığı durumlarda, HTTP parametre kirliliği (HTTP parameter pollution) saldırılarına karşı savunmalar uyguladığı doğrulanmalıdır.2V15.44Güvenli Eş Zamanlılık (Concurrency)V15.4.11Çok iş parçacıklı kodda (örneğin cache'ler, dosyalar veya birden fazla iş parçacığı tarafından erişilen bellek içi nesneler gibi) paylaşılan nesnelere yalnızca thread-safe (iş parçacığı güvenli) türler ve kilitleme (lock) veya semaphore gibi senkronizasyon mekanizmaları kullanılarak erişildiği doğrulanmalıdır. Bu, yarış durumlarını ve veri bozulmasını önlemeye yöneliktir.3V15.4.22Bir kaynağın durumu üzerindeki kontroller (örneğin varlığı ya da izinleri gibi) ile bu kontrole bağlı eylemlerin tek bir atomik işlem olarak gerçekleştirildiği doğrulanmalıdır. Bu, TOCTOU (time-of-check to time-of-use) yarış durumlarını önlemeye yöneliktir. Bir dosyanın varlığının kontrol edilip ardından açılması veya bir kullanıcının erişiminin doğrulanıp ardından yetki verilmesi gibi işlemler buna örnektir.3V15.4.33Kilitlerin (locks) tutarlı biçimde kullanıldığı, iş parçacıklarının birbirini beklemesi ya da sonsuz döngüye girmesi (deadlock veya livelock) gibi durumların önlendiği doğrulanmalıdır. Ayrıca, kilitleme mantığı, kaynağı yöneten kod içinde kalmalı ve dış sınıflar veya dış kodlar tarafından istemeden veya kötü niyetli şekilde değiştirilememelidir.3V15.4.44Kaynak tahsis politikalarının, iş parçacığı açlığını önleyecek şekilde, kaynaklara adil erişimi sağladığı doğrulanmalıdır. Örneğin, thread pool (iş parçacığı havuzu) kullanımı, düşük öncelikli iş parçacıklarının da makul sürelerde çalışabilmesi için uygulanmalıdır.3V1616SecurityGüvenlik Günlüklemesi (Logging) ve Hata YönetimiV16.11Güvenlik Loglaması DokümantasyonuV16.1.11Uygulamanın teknoloji yığını boyunca her katmanda hangi olayların loglandığını, log formatlarını, logların nereye yazıldığını, nasıl kullanıldığını, erişimin nasıl kontrol edildiğini ve logların ne kadar süre saklandığını belgeleyen bir envanterin mevcut olduğu doğrulanmalıdır.2V16.22Genel LoglamaV16.2.11Her bir log girdisinin, olayın ne zaman, nerede, kim tarafından ve ne olduğuna dair detaylı bir zaman çizelgesi oluşturulmasına olanak tanıyacak gerekli meta verileri içerdiği doğrulanmalıdır.2V16.2.22Tüm loglama bileşenlerinin zaman kaynaklarının senkronize olduğu ve güvenlik olayı meta verisindeki zaman damgalarının UTC kullanarak ya da açık zaman dilimi ofsetiyle belirtildiği doğrulanmalıdır. UTC kullanımı, özellikle yaz saati uygulamaları nedeniyle oluşabilecek karışıklıkları önlemek için tavsiye edilir.2V16.2.33Uygulamanın yalnızca log envanterinde belgelenmiş dosya ve hizmetlere log yazdığı ya da ilettiği doğrulanmalıdır.2V16.2.44Logların kullanılan log işleyici (log processor) tarafından okunabildiği ve ilişkilendirilebildiği doğrulanmalıdır. Tercihen yaygın bir log formatı kullanılmalıdır.2V16.2.55Hassas veriler loglanırken, uygulamanın veri koruma seviyesine uygun olarak loglama yaptığı doğrulanmalıdır. Örneğin kimlik bilgileri veya ödeme detayları gibi bazı verilerin loglanmasına izin verilmemelidir. Session token’ları gibi veriler ise yalnızca tamamen ya da kısmen maskelenmiş ya da hash’lenmiş olarak loglanmalıdır.2V16.33Güvenlik OlaylarıV16.3.11Tüm kimlik doğrulama işlemlerinin (başarılı ve başarısız girişimler dahil) loglandığı doğrulanmalıdır. Kullanılan kimlik doğrulama türü veya faktörleri gibi ek meta veriler de toplanmalıdır.2V16.3.22Başarısız yetkilendirme girişimlerinin loglandığı doğrulanmalıdır. Seviye 3 uygulamalar için, tüm yetkilendirme kararlarının ve hassas verilere erişim olaylarının (verinin kendisi olmadan) loglandığı da doğrulanmalıdır.2V16.3.33Uygulamanın, belgelenmiş güvenlik olaylarını ve güvenlik kontrollerini aşma girişimlerini (girdi doğrulama, iş mantığı, otomasyon karşıtı kontroller vb.) logladığı doğrulanmalıdır.2V16.3.44Beklenmeyen hatalar ve güvenlik kontrolü başarısızlıkları (örneğin backend TLS hataları gibi) loglandığı doğrulanmalıdır.2V16.44Log KorumasıV16.4.11Tüm loglama bileşenlerinin, log enjeksiyonunu (log injection) önlemek amacıyla verileri uygun biçimde encode ettiği doğrulanmalıdır.2V16.4.22Logların yetkisiz erişime karşı korunduğu ve değiştirilemez olduğu doğrulanmalıdır.2V16.4.33Logların analiz, tespit, uyarı ve yükseltme amacıyla mantıksal olarak ayrı bir sisteme güvenli biçimde iletildiği doğrulanmalıdır. Böylece uygulama ihlal edilse bile logların tehlikeye girmesi önlenmiş olur.2V16.55Hata YönetimiV16.5.11Beklenmedik ya da güvenlikle ilgili bir hata oluştuğunda, tüketiciye genel bir mesaj döndürüldüğü ve yığın izleri (stack trace), sorgular, gizli anahtarlar, token’lar gibi hassas sistem içi verilerin açıklanmadığı doğrulanmalıdır.2V16.5.22Uygulamanın, dış kaynaklara erişim başarısız olduğunda bile güvenli şekilde çalışmaya devam ettiği doğrulanmalıdır. Örneğin, circuit breaker ya da graceful degradation gibi desenler kullanılmalıdır.2V16.5.33Uygulamanın hata durumlarında güvenli ve düzenli şekilde başarısız olduğu doğrulanmalıdır. Bu, örneğin doğrulama hatalarına rağmen işlemlerin işlenmesine yol açabilecek fail-open durumlarını önlemelidir.2V16.5.44Ele alınmamış tüm istisnaları yakalayacak şekilde tanımlanmış bir “son çare hata yöneticisi” bulunduğu doğrulanmalıdır. Bu, hem loglara gitmesi gereken hata detaylarının kaybolmaması hem de tüm uygulama sürecinin çökerek hizmet dışı kalmasının önlenmesi açısından önemlidir.3V1717WebRTCWebRTCV17.11TURN SunucusuV17.1.11TURN hizmetinin yalnızca özel amaçlar için ayrılmamış IP adreslerine (ör. iç ağlar, yayın adresleri, loopback) erişime izin verdiği doğrulanmalıdır. Bu gereksinim hem IPv4 hem de IPv6 adresleri için geçerlidir.2V17.1.22TURN hizmetinin, meşru kullanıcıların sunucuda çok sayıda bağlantı noktası açmaya çalışması durumunda kaynak tüketimi saldırılarına karşı dayanıklı olduğu doğrulanmalıdır.3V17.22MedyaV17.2.11DTLS sertifikası anahtarının, belgelenmiş kriptografik anahtar yönetim politikasına uygun şekilde yönetildiği ve korunduğu doğrulanmalıdır.2V17.2.22Medya sunucusunun onaylı DTLS şifre takımlarını (cipher suites) ve Güvenli Gerçek Zamanlı Aktarım Protokolü (Secure Real-time Transport Protocol - SRTP) için anahtarlar oluşturmaya yönelik DTLS Uzantısı için güvenli bir koruma profilini kullanacak ve destekleyecek şekilde yapılandırıldığı (DTLS-SRTP) doğrulanmalıdır.2V17.2.33Real-time Transport Protocol (RTP) injection saldırılarının bir hizmet reddi durumuna veya medya akışlarına ses veya video medyası eklenmesine yol açmasını önlemek için medya sunucusunda Güvenli SRTP kimlik doğrulamasının kontrol edildiği doğrulanmalıdır.2V17.2.44Verify that the media server is able to continue processing incoming media traffic when encountering malformed Secure Real-time Transport Protocol (SRTP) packets.2V17.2.55Medya sunucusunun, meşru kullanıcılardan gelen SRTP flood'ı sırasında gelen medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.3V17.2.66Medya sunucusunun DTLS içinde yer alan "ClientHello" yarış durumu güvenlik açığına karşı savunmasız olmadığı, medya sunucusunun güvenlik açığına sahip olduğunun açıkça bilinip bilinmediği kontrol edilerek veya yarış koşulu testi gerçekleştirilerek doğrulanmalıdır.3V17.2.77Medya sunucusuna bağlı ses veya video kayıt mekanizmalarının, meşru kullanıcı kaynaklı SRTP flood'ı sırasında medya trafiğini işlemeye devam edebildiği doğrulanmalıdır.3V17.2.88DTLS sertifikasının, SDP (Session Description Protocol) fingerprint özelliği ile karşılaştırıldığı ve doğrulama başarısız olursa medya akışının sonlandırıldığı, medya akışının özgünlüğünü sağlamak için doğrulanmalıdır.3V17.33SinyalizasyonV17.3.11Sinyalizasyon sunucusunun, flood saldırısı altında bile meşru sinyalizasyon mesajlarını işlemeye devam edebildiği doğrulanmalıdır. Bu, sinyalizasyon düzeyinde oran sınırlaması uygulanarak sağlanmalıdır.2V17.3.22Sinyalizasyon sunucusunun, hizmet reddine yol açabilecek şekilde yapılandırılmış bozuk sinyalizasyon mesajlarıyla karşılaştığında bile meşru mesajları işlemeye devam edebildiği doğrulanmalıdır. Bu, girdi doğrulaması, integer overflow ve buffer overflow'a karşı savunma ve sağlam hata işleme teknikleri ile sağlanmalıdır.2 diff --git a/5.0/docs_tr/tr b/5.0/docs_tr/tr deleted file mode 100644 index e69de29bb2..0000000000 diff --git a/5.0/fr/0x00-Header.yaml b/5.0/fr/0x00-Header.yaml deleted file mode 100644 index baa283a0b7..0000000000 --- a/5.0/fr/0x00-Header.yaml +++ /dev/null @@ -1,16 +0,0 @@ ---- - title: "Référentiel de vérification de la sécurité des applications" - subtitle: "Version 5.0.0" - date: Mai 2025 - titlepage: true - titlepage-rule-height: 0 - titlepage-logo: "images/owasp_logo_1c_notext.png" - table-use-row-colors: true - toc: true - toc-own-page: true - geometry: "left=2cm,right=2cm,top=3cm,bottom=3cm" - CJKmainfont: "Noto Sans CJK JP" - mainfont: "Source Serif 4" - sansfont: "Source Sans 3" ---- - diff --git a/5.0/fr/0x01-Frontispiece.md b/5.0/fr/0x01-Frontispiece.md deleted file mode 100644 index 17644d009b..0000000000 --- a/5.0/fr/0x01-Frontispiece.md +++ /dev/null @@ -1,46 +0,0 @@ -# Frontispice - -## À propos du référentiel - -Le Référentiel de vérification de la sécurité des applications (Application Security Verification Standard) est une liste d'exigences de sécurité des applications que les architectes, les développeurs, les testeurs, les professionnels de la sécurité, les fournisseurs d'outils et les consommateurs peuvent utiliser pour définir, créer, tester et vérifier des applications sécurisées. - -## Copyright et licence - -Version 5.0.0, Mai 2025 - -![license](../images/license.png) - -Copyright © 2008-2025 La Fondation OWASP. - -Ce document est publié sous la [licence Creative Commons Attribution ShareAlike 4.0](https://creativecommons.org/licenses/by-sa/4.0/). - -Pour toute réutilisation ou distribution, vous devez indiquer clairement aux autres les termes de la licence de ce travail. - -## Chefs de projet - -| | | -|---------------------- |----------------- | -| Elar Lang | Josh C Grossman | -| Jim Manico | Daniel Cuthbert | - -## Groupes de travail - -| | | | | -|---------------- |------------------ |------------------- |----------------- | -| Tobias Ahnoff | Ralph Andalis | Ryan Armstrong | Gabriel Corona | -| Meghan Jacquot | Shanni Prutchi | Iman Sharafaldin | Eden Yardeni | - -## Autres contributeurs majeurs - -| | | -|------------------ |-------------------| -| Sjoerd Langkemper | Isaac Lewis | -| Mark Carney | Sandro Gauci | - -## Contributeurs et relecteurs - -Nous avons inclus une liste des autres contributeurs dans l’annexe E. - -S'il manque un crédit dans la liste des crédits 5.0, veuillez enregistrer un ticket sur GitHub pour être reconnu dans les futures mises à jour. - -Le référentiel de vérification de la sécurité des applications repose sur les épaules des personnes concernées, de ASVS 1.0 en 2008 à 4.0 en 2019. Une grande partie de la structure et des éléments de vérification qui sont encore dans l'ASVS aujourd'hui ont été écrits à l'origine par Andrew van der Stock, Mike Boberski, Jeff Williams et/ou Dave Wichers, mais il y a beaucoup plus de contributeurs. Merci à tous ceux qui y ont participé précédemment. Pour une liste complète de tous ceux qui ont contribué aux versions précédentes, veuillez consulter chaque version antérieure. diff --git a/5.0/fr/0x02-Preface.md b/5.0/fr/0x02-Preface.md deleted file mode 100644 index 6322e99ace..0000000000 --- a/5.0/fr/0x02-Preface.md +++ /dev/null @@ -1,29 +0,0 @@ -# Préface - -Bienvenue dans la version 5.0 du référentiel de vérification de la sécurité des applications (ASVS). - -## Introduction - -Lancé à l'origine en 2008 grâce à une collaboration communautaire mondiale, l'ASVS définit un ensemble exhaustif d'exigences de sécurité pour la conception, le développement et le test d'applications et de services Web modernes. - -Après la sortie d'ASVS 4.0 en 2019 et sa mise à jour mineure (v4.0.3) en 2021, la version 5.0 représente une étape importante, modernisée pour refléter les dernières avancées en matière de sécurité logicielle. - -ASVS 5.0 est le résultat de nombreuses contributions des chefs de projet, des membres du groupe de travail et de la communauté OWASP au sens large pour mettre à jour et améliorer ce référentiel important. - -## Principes derrière la version 5.0 - -Cette révision majeure a été élaborée en gardant à l’esprit plusieurs principes clés : - -* Périmètre et orientation affinées : Cette version du référentiel a été conçue pour s'aligner plus directement sur les piliers fondamentaux de son nom : Application, Sécurité, Vérification et Référentiel. Les exigences ont été réécrites afin de mettre l'accent sur la prévention des failles de sécurité plutôt que d'imposer des implémentations techniques spécifiques. Les textes des exigences sont explicites et expliquent leur raison d'être. - -* Prise en charge des décisions de sécurité documentées : ASVS 5.0 introduit des exigences de documentation des décisions de sécurité clés. Cela améliore la traçabilité et prend en charge les implémentations qui dépendent du contexte, permettant aux organisations d'adapter leur posture de sécurité à leurs besoins et risques spécifiques. - -* Niveaux mis à jour : Bien qu'ASVS conserve son modèle à trois niveaux, les définitions des niveaux ont évolué pour faciliter son adoption. Le niveau 1 est conçu comme la première étape de l'adoption d'ASVS, fournissant la première couche de défense. Le niveau 2 offre une vue d'ensemble des pratiques de sécurité standard, et le niveau 3 répond aux exigences avancées de haute assurance. - -* Contenu restructuré et enrichi : ASVS 5.0 comprend environ 350 exigences réparties en 17 chapitres. Les chapitres ont été réorganisés pour plus de clarté et de praticité. Un mappage bidirectionnel entre les versions 4.0 et 5.0 est fourni pour faciliter la migration. - -## Regard vers l'avenir - -Tout comme la sécurisation d'une application n'est jamais vraiment achevée, l'ASVS ne l'est pas non plus. Bien que la version 5.0 soit une version majeure, le développement se poursuit. Cette version permet à la communauté de bénéficier des améliorations et des ajouts accumulés, et pose également les bases de futures améliorations. Cela pourrait inclure des efforts communautaires pour créer des guides de mise en œuvre et de vérification, basés sur les exigences de base. - -ASVS 5.0 est conçu pour servir de base fiable au développement de logiciels sécurisés. La communauté est invitée à adopter, contribuer et développer ce référentiel afin de faire progresser collectivement la sécurité des applications. diff --git a/5.0/fr/0x03-What-is-the-ASVS.md b/5.0/fr/0x03-What-is-the-ASVS.md deleted file mode 100644 index fe9cf4ebac..0000000000 --- a/5.0/fr/0x03-What-is-the-ASVS.md +++ /dev/null @@ -1,195 +0,0 @@ -# Qu'est-ce que l'ASVS ? - -Le Référentiel de vérification de la sécurité des applications (ASVS) définit des exigences de sécurité pour les applications et services web. Elle constitue une ressource précieuse pour quiconque souhaite concevoir, développer et maintenir des applications sécurisées ou évaluer leur sécurité. - -Ce chapitre décrit les aspects essentiels de l'utilisation de l'ASVS, notamment son champ d'application, la structure de ses niveaux de priorité et ses principaux cas d'utilisation. - -## Périmètre de l'ASVS - -Le périmètre de l'ASVS est définie par son nom : Application, Sécurité, Vérification et Référentiel. Elle établit les exigences incluses ou exclues, avec pour objectif principal d'identifier les principes de sécurité à respecter. Elle prend également en compte les exigences de documentation, qui servent de base aux exigences de mise en œuvre. - -Il n'existe aucun périmètre pour les attaquants. Par conséquent, les exigences de l'ASVS doivent être évaluées parallèlement aux recommandations relatives aux autres aspects du cycle de vie des applications, notamment les processus CI/CD, l'hébergement et les activités opérationnelles. - -### Application - -ASVS définit une « application » comme le produit logiciel en cours de développement, dans lequel des contrôles de sécurité doivent être intégrés. ASVS ne prescrit pas les activités du cycle de développement ni la manière dont l'application doit être construite via un pipeline CI/CD ; il spécifie plutôt les résultats de sécurité à atteindre au sein même du produit. - -Les composants qui traitent, modifient ou valident le trafic HTTP, tels que les pares-feux d'applications web (WAF), les équilibreurs de charge ou les proxys, peuvent être considérés comme faisant partie de l'application à ces fins spécifiques, car certains contrôles de sécurité en dépendent directement ou peuvent être implémentés par leur intermédiaire. Ces composants doivent être pris en compte pour les exigences liées aux réponses mises en cache, à la limitation du débit ou à la restriction des connexions entrantes et sortantes en fonction de la source et de la destination. - -À l'inverse, ASVS exclut généralement les exigences qui ne concernent pas directement l'application ou dont la configuration ne relève pas de sa responsabilité. Par exemple, les problèmes DNS sont généralement gérés par une équipe ou une fonction distincte. - -De même, si l'application est responsable de la manière dont elle consomme les entrées et produit les sorties, l'interaction d'un processus externe avec l'application ou ses données est considérée comme hors du périmètre d'ASVS. Par exemple, la sauvegarde de l'application ou de ses données relève généralement de la responsabilité d'un processus externe et n'est pas contrôlée par l'application ou ses développeurs. - -### Sécurité - -Chaque exigence doit avoir un impact démontrable sur la sécurité. L'absence d'exigence doit entraîner une application moins sécurisée, et sa mise en œuvre doit réduire la probabilité ou l'impact d'un risque de sécurité. - -Toutes les autres considérations, telles que les aspects fonctionnels, le style de code ou les exigences de politique, sont hors du périmètre d'application. - -### Vérification - -L'exigence doit être vérifiable et la vérification doit aboutir à une décision d'échec ou de réussite. - -### Référentiel - -L'ASVS est conçue comme un recueil d'exigences de sécurité à mettre en œuvre pour se conformer au référentiel. Cela signifie que les exigences se limitent à la définition de l'objectif de sécurité à atteindre. D'autres informations connexes peuvent être intégrées à l'ASVS ou reliées par des mappings. - -Plus précisément, l'OWASP comporte de nombreux projets, et l'ASVS évite délibérément tout chevauchement avec le contenu d'autres projets. Par exemple, les développeurs peuvent se demander : « Comment implémenter une exigence particulière dans ma technologie ou mon environnement ? » Cette question devrait être traitée par le projet « Cheat-Sheets ». Les vérificateurs peuvent se demander : « Comment tester cette exigence dans cet environnement ? » Cette question devrait être traitée par le projet « Web Security Testing Guide ». - -Bien que l'ASVS ne soit pas uniquement destiné aux experts en sécurité, il attend du lecteur des connaissances techniques pour comprendre le contenu ou la capacité à rechercher des concepts spécifiques. - -### Exigence - -Le terme « exigence » est utilisé spécifiquement dans l'ASVS car il décrit ce qui doit être accompli pour la satisfaire. L'ASVS ne contient que des exigences (doit) et ne contient pas de recommandations (devrait) comme condition principale. - -En d'autres termes, les recommandations, qu'elles constituent une solution parmi d'autres ou des considérations de style de code, ne répondent pas à la définition d'une exigence. - -Les exigences de l'ASVS visent à répondre à des principes de sécurité spécifiques sans être trop spécifiques à une implémentation ou à une technologie, tout en étant explicites quant à leur raison d'être. Cela signifie également que les exigences ne sont pas construites autour d'une méthode de vérification ou d'une implémentation particulière. - -### Décisions de sécurité documentées - -En matière de sécurité logicielle, planifier la conception de la sécurité et les mécanismes à utiliser en amont permettra une implémentation plus cohérente et fiable du produit fini ou de la fonctionnalité. - -De plus, pour certaines exigences, la mise en œuvre sera complexe et très spécifique aux besoins de l'application. Parmi les exemples courants, on peut citer les autorisations, la validation des entrées et les contrôles de protection autour de différents niveaux de données sensibles. - -Pour tenir compte de cela, plutôt que de formuler des affirmations générales telles que « toutes les données doivent être chiffrées » ou de tenter de couvrir tous les cas d'utilisation possibles dans une exigence, des exigences de documentation ont été incluses, exigeant que l'approche et la configuration du développeur d'applications pour ces types de contrôles soient documentées. Ceci peut ensuite être vérifié pour en vérifier la pertinence, puis la mise en œuvre réelle peut être comparée à la documentation afin d'évaluer si elle répond aux attentes. - -Ces exigences visent à documenter les décisions prises par l'organisation développant l'application concernant la mise en œuvre de certaines exigences de sécurité. - -Les exigences de documentation figurent toujours dans la première section d'un chapitre (bien que tous les chapitres n'en disposent pas) et sont toujours associées à une exigence de mise en œuvre, où les décisions documentées doivent être effectivement mises en œuvre. L'essentiel est de distinguer la vérification de la documentation et de la mise en œuvre effective. - -L'inclusion de ces exigences repose sur deux facteurs clés. Le premier est qu'une exigence de sécurité implique souvent l'application de règles, par exemple concernant les types de fichiers autorisés à être téléchargés, les contrôles métier à appliquer et les caractères autorisés pour un champ particulier. Ces règles diffèrent d'une application à l'autre ; par conséquent, l'ASVS ne peut pas les définir de manière prescriptive, et un aide-mémoire ou une réponse plus détaillée ne serait d'aucune utilité dans ce cas précis. De même, sans documentation de ces décisions, il sera impossible de vérifier les exigences qui les mettent en œuvre. - -Le deuxième facteur est que, pour certaines exigences, il est important d'offrir au développement d'applications une certaine flexibilité quant à la manière de répondre à des défis de sécurité particuliers. Par exemple, dans les versions précédentes d'ASVS, les règles d'expiration de session étaient très strictes. En pratique, de nombreuses applications, notamment celles destinées aux utilisateurs, ont des règles beaucoup plus souples et préfèrent mettre en œuvre d'autres contrôles d'atténuation. Les exigences de documentation permettent donc explicitement cette flexibilité. - -Il est clair que les développeurs ne sont pas censés prendre et documenter ces décisions individuellement, mais que l'organisation dans son ensemble les prend et s'assure qu'elles sont communiquées aux développeurs, qui s'assurent ensuite de les respecter. - -Fournir aux développeurs des spécifications et des conceptions pour de nouvelles fonctionnalités est une étape standard du développement logiciel. De même, les développeurs sont censés utiliser des composants et des mécanismes d'interface utilisateur communs plutôt que de prendre leurs propres décisions à chaque fois. Par conséquent, étendre ce principe à la sécurité ne devrait pas être perçu comme surprenant ou controversé. - -La manière d'y parvenir est également flexible. Les décisions de sécurité peuvent être documentées dans un document littéral, auquel les développeurs sont tenus de se référer. Alternativement, elles peuvent être documentées et implémentées dans une bibliothèque de code commune que tous les développeurs sont tenus d'utiliser. Dans les deux cas, le résultat souhaité est atteint. - -## Niveaux de vérification de la sécurité des applications - -L'ASVS définit trois niveaux de vérification de la sécurité, chaque niveau augmentant en profondeur et en complexité. L'objectif général est que les organisations commencent par le premier niveau pour répondre aux préoccupations de sécurité les plus critiques, puis progressent vers les niveaux supérieurs en fonction des besoins de l'organisation et des applications. Les niveaux peuvent être présentés comme L1, L2 et L3 dans le document et dans les textes d'exigences. - -Chaque niveau ASVS indique les exigences de sécurité à atteindre à partir de ce niveau, les exigences des niveaux supérieurs restants étant des recommandations. - -Afin d'éviter les doublons ou les exigences obsolètes aux niveaux supérieurs, certaines exigences s'appliquent à un niveau particulier, mais sont soumises à des conditions plus strictes pour les niveaux supérieurs. - -### Évaluation des niveaux - -Les niveaux sont définis par une évaluation de priorité de chaque exigence, basée sur l'expérience de mise en œuvre et de test des exigences de sécurité. L'accent est mis principalement sur la balance entre la réduction des risques et les efforts nécessaires à la mise en œuvre de l'exigence. Un autre facteur clé est de maintenir une faible barrière à l'entrée. - -La réduction des risques évalue dans quelle mesure l'exigence réduit le niveau de risque de sécurité au sein de l'application, en tenant compte des facteurs d'impact classiques de confidentialité, d'intégrité et de disponibilité, et en déterminant s'il s'agit d'une couche de défense principale ou d'une défense en profondeur. - -Les discussions rigoureuses autour des critères et des décisions de nivellement ont abouti à une répartition qui devrait s'appliquer à la grande majorité des cas, tout en admettant qu'elle ne soit pas parfaitement adaptée à toutes les situations. Cela signifie que, dans certains cas, les organisations peuvent souhaiter prioriser les exigences d'un niveau supérieur en amont, en fonction de leurs propres considérations de risque. - -Les types d'exigences à chaque niveau peuvent être caractérisés comme suit. - -### Niveau 1 - -Ce niveau contient les exigences minimales à prendre en compte pour sécuriser une application et constitue un point de départ essentiel. Il comprend environ 20 % des exigences de l'ASVS. L'objectif est de réduire au minimum les exigences afin de réduire les obstacles à l'entrée. - -Ces exigences sont généralement critiques ou basiques, et constituent la première couche de défense pour prévenir les attaques courantes. Elles ne nécessitent pas d'autres vulnérabilités ou conditions préalables pour être exploitables. - -Outre les exigences de la première couche de défense, certaines exigences ont moins d'impact aux niveaux supérieurs, comme celles relatives aux mots de passe. Celles-ci sont plus importantes pour le Niveau 1, car à partir de ces niveaux, les exigences d'authentification multifacteur deviennent pertinentes. - -Le Niveau 1 n'est pas nécessairement testable par un testeur externe sans accès interne à la documentation ou au code (comme les tests « boîte noire »), bien que le nombre réduit d'exigences devrait faciliter sa vérification. - -### Niveau 2 - -La plupart des applications devraient s'efforcer d'atteindre ce niveau de sécurité. Environ 50 % des exigences de l'ASVS sont de niveau 2, ce qui signifie qu'une application doit implémenter environ 70 % des exigences de l'ASVS (l'ensemble des exigences de niveau 1 et 2) pour être conforme à ce niveau. - -Ces exigences concernent généralement des attaques moins courantes ou des protections plus complexes contre les attaques courantes. Elles peuvent constituer une première couche de défense ou nécessiter certaines conditions préalables pour que l'attaque réussisse. - -### Niveau 3 - -Ce niveau doit être l'objectif des applications souhaitant démontrer les plus hauts niveaux de sécurité et représente environ 30 % des exigences à respecter. - -Les exigences de cette section concernent généralement des mécanismes de défense en profondeur ou d'autres contrôles utiles, mais difficiles à mettre en œuvre. - -### Quel niveau atteindre ? - -Les niveaux de priorité visent à refléter la maturité de l'organisation et de l'application en matière de sécurité applicative. Plutôt que d'imposer un niveau de sécurité normatif pour une application, l'organisation doit analyser ses risques et déterminer le niveau qu'elle estime approprié, en fonction de la sensibilité de l'application et, bien sûr, des attentes de ses utilisateurs. - -Par exemple, une jeune start-up qui ne collecte que des données sensibles limitées peut décider de se concentrer sur le niveau 1 pour ses objectifs de sécurité initiaux, tandis qu'une banque peut avoir du mal à justifier auprès de ses clients un niveau inférieur au niveau 3 pour son application de banque en ligne. - -## Comment utiliser l'ASVS ? - -### Structure de l'ASVS - -L'ASVS comprend environ 350 exigences, réparties en 17 chapitres, chacun étant lui-même subdivisé en sections. - -L'objectif de cette division est de simplifier la sélection ou le filtrage des chapitres et sections en fonction de leur pertinence pour l'application. Par exemple, pour une API machine-to-machine, les exigences du chapitre V3 relatives aux interfaces web ne seront pas pertinentes. Si OAuth ou WebRTC n'est pas utilisé, ces chapitres peuvent également être ignorés. - -### Stratégie de publication - -Les publications ASVS suivent le modèle « Majeure.Mineure.Correctif » et les numéros indiquent les modifications apportées. Pour une publication majeure, le premier numéro change, pour une publication mineure, le deuxième, et pour une publication corrective, le troisième. - -* Publication majeure : Réorganisation complète, presque tout peut avoir changé, y compris les numéros d'exigences. Une réévaluation de conformité sera nécessaire (par exemple, 4.0.3 -> 5.0.0). -* Publication mineure : Des exigences peuvent être ajoutées ou supprimées, mais la numérotation globale reste inchangée. Une réévaluation de conformité sera nécessaire, mais devrait être plus simple (par exemple, 5.0.0 -> 5.1.0). -* Publication corrective : Des exigences peuvent être supprimées (par exemple, si elles sont dupliquées ou obsolètes) ou assouplies, mais une application conforme à la publication précédente sera également conforme à la publication corrective (par exemple, 5.0.0 -> 5.0.1). - -Les informations ci-dessus concernent spécifiquement les exigences de l'ASVS. Les modifications apportées au texte environnant et à d'autres contenus, tels que les annexes, ne seront pas considérées comme des modifications majeures. - -### Flexibilité avec l'ASVS - -Plusieurs points décrits ci-dessus, tels que les exigences de documentation et le mécanisme de niveaux, permettent une utilisation de l'ASVS plus flexible et plus spécifique à l'organisation. - -De plus, il est fortement encouragé aux organisations de créer un fork spécifique à l'organisation ou au domaine, afin d'ajuster les exigences en fonction des caractéristiques et des niveaux de risque de leurs applications. Cependant, il est important de maintenir une traçabilité afin que la conformité à l'exigence 4.1.1 soit identique pour toutes les versions. - -Idéalement, chaque organisation devrait créer son propre ASVS personnalisé, en supprimant les sections non pertinentes (par exemple, GraphQL, WebSockets, SOAP, si elles ne sont pas utilisées). Une version ou un supplément ASVS spécifique à l'organisation est également un bon support pour fournir des conseils d'implémentation spécifiques à l'organisation, détaillant les bibliothèques ou les ressources à utiliser pour se conformer aux exigences. - -### Comment référencer les exigences de l'ASVS ? - -Chaque exigence possède un identifiant au format `.

JU3e^yBo5XfO_Ua4 zFfujOqBMqaP2s5hmCGwI6~c*-=nA%)A+;hjG&>fD5nfLY1k#QT8pn4+3tZ$`b<3BA zu?ZT*cacI6h&lrZIQJhK!jQGIRSMv8m>~nBM(yI!)i!*f?|S9v#JH|=M@>#;@rTlo z5(4QAXc0HOF}dPS(C^+sg2^HvS^j}Ke$lL$GhEv?rK#t>X{RQ1zHOZ$1r7LmqrH=_ z`S%uCrCfBO`6fAH#ZkErf8&z3HXi#7CD-iIQHu78XqXn{rRqgKU4{4Q06pM663gJ_ ztkMt|7JtGk`!O-21`vM$Lz0VLOrJ+oS* zp8ep8w6x(1*nCQ)4- z)X0M0+Lq{MOS&T&nfrjKp3(FlrA=#xpyi75d^)6^B&IExGR}9J?jf{|bMj_j7|cH= z!IB?1>#?B~H3l*Ybw@e|zkm#?C#`1P;LRh3Ed^Chd&RzfO)g}q0d+qYHn>h33O$4O z=|s=#I`IBo+je}mjTZ$S&* zE#t?{F~K_CS`!YSTjC|Ldst-}hlu{J?xbvP_>KI824kU6{|Q1fDAA(!DG+^RST_{C z+}OCY-I4*}`Bk)y@UojbBF880l8%3i+>L8ayRo$lptn7PlAYw8(?KJF8x$v#mV44< z51B9N8+!zPNiVdq31@$^1IA?8I7fOqY^ERQ14leHGaLbgU@eKFWMMEIn`j;B_K-kW zJx{0)8q*#yC);CJP-pGDch!uc5b{ozP|yWZon5u+ItxAGDjy$zxMCJP21LVyOM`=x zny%^;Nq9MN_Y_8Wa47+d`Gc>wv1M48o&@Jmf>Ii#&4w1va=^;7g$o02UfUvKkb$iy zCQctL&5!}OS=0}#3VQ|;&B5BP$X0r5#oolS21wd>yXePQD=HYu{omCw74-8`-_jhf z5jvt}JOMfn!5gP4@SrrR0?yq&H#sR&79u3^MS>>^jcSODUki=qnECVg3e{;NclzF# z?P)3;-)#{p4EPc$g{_(K_LpDOsDzB$4CLsT@+pAqv+l@>U#Zk|U^~)CPeEjN5p=Az zpj{O}<=PO3tbsI#zvr{H4(kw2UD01D04}vnJHebe2y&}|8GDCg>cj7aBhBUhnl$X) z>ILnfS>kL)n-hmXz@2tYOSG;-Fnl}@y2k$YEJbnJk66dvG}&h#e=ha*dD8dCFcCe| zv)BQ@);HcjH_pSBt%7Fibu&i;SSmja&vLxd&0mHZv9B9g-pjRpxY-X)L8%(SOv{xt&{YJ~; zhq+@?v)y>a8rfJwVExgCYO+Ib`JETxiBCsCZT0ERF@3J?WZe7zP|6G1=LRJscW+&1 zX1QN$nrW3>cSF)RX&_t3YM?@_RU{mJux8=NOIXW3q{VfM=LQ$Cp|J5*DV4U->s0^T zzuM;_aSRzmSxehu=kkw*#Y1r3FRXs)mvI~}AP+rC@yAW5+vyUfML}0!MW(eTwfdAn zCF>4d8ev))VHO(pDdYDti~b0QAsYCPT`VfN^oqOqE(Yk8A;j7s(JlcqgXPa4WuE?U z%s*oP1pk?duL3Jv!nq>*>yAS4>;hIUBikf(qelny+$>CDV@ptk1+!tGUR%9?5Y>gI zeI5!_ZmJA15Q8-b`6T2lM!3G=XlS`)%CbQ5tq5V4QYDz|bwLotzCgrrKp?)N{*d%m zfvw??F>ZEDso?`i#`~(Ak`q6F%zxxP(i-CPBEFnXi#cE&Fhmrnb(}~EWdLWzCcBK_|p}Z&r${31q(z{5$I^=dxf;A|d zqNx`&cqGCM4|eo|JA@kTFoHFxbzr$G|7gq?5(wzkfZ@*ulc0f$RqB9JE$4L>~Ye-j2V(eK&f(t z%0T_+f09stp2{j;SuO_?nSELPzT8rQI_z}L_yL$(Bf9GxR8@=L0#N!JoV*=PlIRSD zGB;P$bqTh#bP(B?YOY97ILsWaEO(GK9F9dhNJK*KarT@o@f78Lwoo)}IOgZmtX>a^ zR;vk7R)mF@{U;)$N@idl6fR1ekK7Ia$)+9H=26vt3b79!JLyiV1$hYe$(UJ$fs+a% zyeg9nvae{59xJ&92grliW9?+&qCw$=%Qc0@gP3iouuFyN!u9|LJzeOX2J%RjGzQ}9 z!D&s$I!PnuhoF%*1rVqhaP{Yh(VtJJD~Ek398 zZmn-NrJcGULv_EtVXk$Eq-H4<{0VI?CNv(#Yy=nr?CH>N0H;;pHUg;??CFBrG>Avs zIJnTz664bF>3S59fB3u`{YO^lk#DN(po5_7_=+mB$+F;pJ+&_PA?R>kRT*cCJqUl%} z+wb^!yfs;!0JB}$ektDbZ;EV}cZ4GbI|Qy{pneZaQU4s5?Oi?q7{#rX6QAY0R<}(F z+0z@AWVQCFO{&D|9&v4E;2^k z-lbPaKGrT2OI_t^Z0FPkaD`j5pX15Mf%7LB3_$SMg zT@stH$f1|vA+F-)!S$M$UnK42(IIroHG9o)JF#_y?Vi+dRq?{;8=)DQZAF@8b9$I?LYQwpH}&#TTC)<11TFS6ouSh6lBItw${)5Holis>2d;&ZI zL;1IZU`+;}+0`!-p$-Z2nTxc{<>83H05N5iTjE@y=9F8se+J@wY~*+8(r~w;^eR8Y z(oq>2ra{y(DRP}*6|GTv${>k)Ti8lsCPsoO>f-U=vPr+FzY(9G%EpS==Geqd#|qLWQnHHL0qPwV z$^)aSG+c`~^GVVOS>(!z(%t`PmxAcoGBQ!y6-Ane8%h=>trd%LJYu(SWqFf2MAf)K#Y#QuK~hGl6@#UF4+cVDZ#a5f=dA%FLUhPnG~tqy2W z9`8;&{dVU7&{&y1F7tox2Z(C=6OFBTkDBK!pZGzk#QpWFb3g*S(f~_H!tfiW+y7^6P#IaIiRAz z4YY&|b@kwgVHpx5WX!m1mco;Fj7iJ}TN4qE0m0aR1(?j%>maOt8~8~BVHyNVgJ7Pw za`?g4`HOKT7}n&6+E>>D$d4tmw;D(z4T}d;bAP)YhVg|6>zyRE!7-5&iTZgqOd2x~ z_YTrsk-tFH*(#Dt4vCZ-p6sh_Edhm)4i||-;v6Vrdo{LlKsHLR*5wfsW^{yeAd?=p z1LOz&MYAU6538sDghJ__=bQb0RY=*Tp#|Z9RjaX^L0Gp(1+_5nEC8Li1FZ0K9wZolF4%HmZs0c>1g~6nukC zuZ9YNq^_2_IFZhFPq;0k4q}7eIU3Q01MnZ!WF!(^gJCC*V`a+aqy?UUSi4O!gs~Op z)H7bOSBkB)L*AAq=z|6YvFwvmMAck(tyP;upM#A?3PazeXb7{Cw(%G&qnBinx&dZM z;D}eZreyY@rx-q}$x;@Fp}+Vw;2F1N?`@|K!5<>$!eG z3SRqS_eHf*Z-jj&Re_B}!ohJEgVz3S4Fkr0;T|;cS8!0_O-XsS(rqQ0)qf9%_5X{6 zc)_Sr&@}!IY?ND{99-$_(7~bsaV_J=^uggH|DJ*`Ac`+@^?q28 zMIVg^_4+q<5+iAV$XQ{Sz`nTbuH#(aU3LH`VVvEMEMX|Hs(Q){GcBAHsC(X>FVqMq zp-npttvk>)2LVzpOazh(;C(~)`~JbBUFYjHW#abC!vpaCyyNETjs02C%JBVm0m#f| z_;w0oJ9qisrAtt@T+HhOz}Ow=0>0mS(s*T3Z)hj)dk|_Q_<~>2Zm?BQOAE`u7u&l{ z@N1;{v>KQRU8bmALFO#;LD|e`0_iWtRWhLrXl4vk6_z*iyyjw&5*Zr1k40ZCXcQE) zxrekvapGW(q(qeSc!Lzwb-=JY%UEq`rZS}ODKsD(i=h?j6DxcH(X6@XvvClO{kx3_ zX854ve&brGtG~fZA?5bQ^3Ed$vBki%ozWGdtx&nji6Ms>a|+u;p3~WW8_`!-w%^9n z|CI^n|9$HsEA~}h3alCh)nHr>*u3f@3SdyW&&1ITc!Q8m`@J=uT5>IW1Y@+|W>B(g zl&+ixs_?IcZ2+C7}{206b>MTW}gYQob{otfzk151T1}w}2 zFBMyN5gQn09&olSw73`xR(i%p<|nxHW9)xY;t7+TWx;{lT`SW!iWj^*5^-`VkMO?N ze-e8C=6|uY;{6jqM0jDCJ-3;J{B*NU@NVp$xN%EJ;AJFpbi6?A(P>_ zVJM*RmtC#zP=#cV+~FKtr|`!i;iXWdmbF>s5@(9 z0yh?(A*|zq0;2kbOja^6vat(Gd6Js6EQ82_h8SvBlqgm*umdA_==p`rElOF1XE^wo zU5^tfy4@mX);sQeR_GI>U`MhRE=$q4&EraBvGVkL?tE0iinG3cv4gNpcGD`@xWzatINTkDO#>Srrupkw|4m@tDvB;%HsVYfK(0;iSn3{zuZUbP_orPFCF)#QSX zz3XmLmpr8)6vn4)-|EW&%o`k|RhAq=3u)uP@-P~Dy;3;xyMh;P?abRY+}7}JW^+yArz6LY=#=c?S#3rjgx2tdvtlbaz+(<`O%N~4&fYWfx2!5Ek^21W zB5~;$+LpcnzihTdD9g+Nj6d$a2K6cJhsD&emw8 z5f(Z3bT^V3I-P?wl2RN6qmH4P1FkU_5q5m6HJiC0QNd=-&S4fc}*+hooyME20t~@V}pkx598znx-hnCex9Mdn=P!$e4$Srwq7n_WtDC>9Q|J>pU$j6v;!wSr@iHag< zIV`K@mf7O>qNg}iD9bX(omQek8fwk`78SM7c&G}%3w>J#wmJfFlS9I!@K>kk{duQ} zg;0J%B2FZY!GmG553MW@@o)&q89YaO$YRt{%7F8Mle54g+YvJ>WJZn?wu{93+t-7$ zmrj7k_sgw=$9wblfzxL>K$$#{x8fM)y*ACW?)YAJE23v}wblkh>EIJ~SUgpx18?3UtV5WwI zo;uo4ra9ygk4-)i6N{YCjV^R9BTwuH;7#7Nh?P5F*_;fHdy4Ny9?PZ1iiJ+77Osbq ziP7ZV$qH#drm41!TE(d#l2^85X%IJ%dm{jMXLAQ9nYYmBfuuHk<{)e!QK6_26wQ}? z!zc*VgBc?6ugd3izmiVACdnc9_7lPng@H7xL{rNFon4iivO+DR1xH_u^Na5WbO?e- zw;vM4HS<~-x98{|W~4NFg2LpnsR`j3s(0m~1Z zJsborKuKJ7_hUVNIdy8i34!ththtI)ceQ2+6;@(cPG}W&5N&s&Q}`5Cd+@(|djMK7 zreySlJv%i-9lR)?erwU|#v_5Sr(?N4Jo^Qp$c#yJrs-1LZe~_rtJNf>+G4XFRSSeo zGFCh*cs<~gvo5~cSCQCUHJtCa2#TcmP3@-4piZ{4MWj|zy9Mz?POvBdw^ednh=EH| z|Pb|5MbUgD~OxlMjK$=(?*)>%)gCD4U0k%KwDq{dD<<+{(pD|Tw!g( za+-c~2-JH~;`g2Uj?&}cBdv8${k_l9Y25y0$?>9RokFwJwmh1_Z8=@7sjMMLCIYFx zJ*5x%i+!2m-y6}5&0gZ5q=^|&%tD0+s2kYOIsEQz$MJcK@3RJL&u*d)S%xW0_cf#9 zJxRSEPJJ8>yV89jKonMHJDj!{0+h{&i4Cii7`LoX5PnS({%k=WUHs}i!?9U2W8KEu zVl+n%XE?L$(h=-DelQ0K-5}Kh;a<-b9%r1;#3?HIEk^zj%oR!WFz~?s)nTa3~EHUEbWlm3r z+l*~hEf^lasV;snKN))lsTjt{F}xpM#N)RH$!S_PCQccW{F4CegWCL5Jsp0NJZ}u*N_ZzQtMSi#yo{v3k*Y(ss0k>Wl#|02n$SiGeUQFX zY^3zGjK3-zV3ll+8p106bd_Pf@=YE;Xm8Vtv4wGSTd2$!^`-oS&q=0FS-HjlNEbYs z>qaQPv>yD2h4N2u(IB~GwDF>Y5Hrr5IHXa*PmCF79fbc>g@)Fc^~Wwqg^h1jWa1WW zuEOCwHDaeVrWdOJTaXSL->wSE!F5{hmr+R1<^@>y{GifMzVClR5wyN;SZs&(n$=(+ z7ZY;Gu>fLdQ(*H=*(|XEsfqDN!W0|Ty%8?0L&+Ne%AWDQV)Q*>Yc+&@$&J{keb56V zP19#qLs^5{eA#@~Hr-7YJ(b&xPo`rSOD4)-v6G3N!frJlH9@md58&x9*^)NG#cO6* zdp9*1XCG}eOJf{<#Fah81TX;JT?p zt%{f<)>tTpvRDw?p$h|QjEtw}u0%WOl?jaA&J{^(4f1@@Xewi zgX2QQinYm}Vm$@r)5oy?cu6{3E1hwK@t=mfq{y-mN9_we02S6PMI~@vV;T>+9m_tI zgD5t=6Irv_4|!~!d}Yc!%_Gq3rUxL_K#xfP-ozhcD2QYxMP&GtVV{buD*=x&;+sBj z`i{wn#_%(d8_D=Oa&fjO*0^)H@gc?`18&Ee)`p>Z;cJwd7Ig$!gT-lr=3)dGBhJmX zMowG}5wk~C^k~60b?o?vnVtZRXgjK3+NM{nWDe<}6h9zY*o2ckItJJTF$u?pyg{ew zLDZlWM~dvy+RS^v^p@zXJ|L&@e6i_#5nk6OR>9c1p1~38!T8gOwSmoA84O~9LQK!C zm%`X*c-dG&Jm@sj997k3I)h#4^0@QI)Snj6OBk1!e!O{~xNS)aC>|I7G-rl`AdZ5r z&vmwg`@CwN9;ImE&z3Q?sqMAf<5cX&^a8Px^`rLpoMaG}d7eH7XgSgmY8ZyTOn(@k z_7ZQoC8gm&gUBiRU-p9)gN(z-ayUj_bZQdvd$S*_31JU_ZSG@{FFH(j&fvb;x?uMd zdtDr~=}*eN#Qc7!m64tJIEea&W6Y$maTBx31?uNiLoOSO6BEZUbb#u+Vdn1-am zxyZBE=vHUGbup4pi+qd{;a%JwFjt+s z&KWF<)kZrK>z3kdVl> z`fO??G5E{wKtLt*-OYx;F(Nne_at;;UHD(tazyphFBzy;{<76&5`+k_|h7XRrj z9A^r?jDZelZm@B%ESPa-ZjL8oh;BPV!vMII4kiFQ__Cd$RqVM(OQc-e--5|z7eBV( z2glrA9G^;kKeow~h~O`;1Azfpsk$7pG;r>>uxPy0be zkDKTyFGZKI6}o>>I}#S!FTwvL>9wX_7>9%PqG}`IeSmoyO;!)eN^^{o!7Kxr*xi=T z2Cx9Q{%rls>`o03Q%@X@>Ah3oo3@wIF>` zAYn2TgytItk6&KHAtvWfs@p9kcl^tc2w}(!93P_^-G6x*tqGdq8>nNis8z(S6TG8(%14nLa0B?aEiSMJ5_o-_I+i$=Y zW%4`W$$>&=+t-)NA7gzQhDF=p926UAvZ}z@T;fmf8IMmm+xn< z&?v673JQFL4A+Dwl$}CuU+%my#@TX*TihZe;Z5&|9+i$Z*!kzR1iP>o+7fv&rzFhG2#t zMm#R(t0#dXq{;-kzYaHd`v3r44-+MyX+P>OTi?8$UU&?KktwDQcS~E0Vei)=6VJ_- zbKBq3_IK{zj|X!3(UGn#w;p0w53unkpD{5zx~qcUjvs7nl&(J)MFfWTi-{wj@?AsH zkd~4I)f8hL+TJPi)hc;g&%w8ofk#H%6|Ga7#^;rln3e^V1~2RGdKEf+#OAHR1_iGk z9e`Hx=KFO8-uJTyZx7Q#O$eo4^reRfcQ_kp^We%tOU%7h&j(jFtwGlrs?8hRr-;O`|^F*d2mnazv;@x#zT1BpxV{kzdQX-Jd{pZ$79qDO`Hfn56tip>@5Cs-m&;Ty z4p8rPoB*eOm{*C@Vpp8)5oe5(?M|3wv-B7eIwzwdqCy6^juYH@Ke(?nz$SAd(x4n`@WO zf5UmAp6&1A7RL;UrlTV8((5S^QJN%?4|>7QPbD7g5MY?5EFL;3Pjyw0FIEapXr1pn z&7=r%#|4#iM-F6AM6~EDTrSiInpTdx2Oa+!Nd|(3O#uT-b;RP2hvpw*3g|sg zoWWscz5kmF0s@OWLlk9Plv>v}>ySu5G(szm=8vAJ4|Rt22^E@bIb?5jXZ|aOPk^#TwDIjFs$xA%+)hbUsanclgTB)cTVnwVSRULAaTmum* zdI(x?Eg0BOt>X|rb0H2ryi`0P9|wBvP(b*fG7LC!8D}yaNp_X5AbT-A zcokj;nkGH1@nf&$97{RO7LP|xV?P%ep|lhy_z|X}%pvBH);7mKlgM zq((TDY!F4(z9~Cb1{w#tICFT`R{~q3n4ovDLcN(JiPjW*vm#!VSw?Ka3pCV+96moN znELPOKSg29;fTqg;{ZJ=6GaV9LGxg_U-Jlu;v}Hbt7ylP=E?RLMx?Z$Q&NGPDgp!I z#CRh3d}&-WUJ4kVZqmiAP=J{>%2bQ~25<0sp%}?|GcP^Rh%@taNB<#O5KXL(9<(^V z$yrd6dGbniUoWKC<#_(JkGBg3fUWNO{n`DDt@29!IzD2|+%!_;18 zx3{!}tTR_*h@+#M8A18ejoUw+YSZVbr;Deu*M|{?@6~QrLW5E)2SDAcDR+4}!^YO1 z8}P9S*ua0)WE^mk2I46HMb%ja)fIKw8VMx9gF6HWA=m*9?hXm=Zo%DMHtr6=T|=b9w4tklwdB;fOW zR!pQP$z+Sxa{g?|-LWP>(sK9m;_&nr&&QTbHhV@E{`K_77Sdm0kIsp3_PL(B)^gpJ zou(z!XpV~sB}cR7vvxsKQjodA-@N+}K#22vQcQ5tHKb<*PDvz9g+zDdOzWal_Dlq9 z8j7GNdIo3fQ(3=u-t^^anr#j@7ckR3n(3*qmgR71>ruCdw9?vCo)S@wi~Osnl_OWS z;tph@oARVs>U~q(T~9F0`8&tgYNnH1cPq5wJ8OAAS%(1K-8KP!K7~3h8I}WJ)Zu%S z$KW2H=~Bn*)BT<+MnjVj>dT$?(7bvt|x6A$ztCBHAC^c`@pLB1Osug zm61p!RDeh4oxP?YNV+@vyQUXVCOA#13pzMPjUf%^ZRbO;_l8k%;Wyq-9x35tEyl`U zrVe`6r#)=(s2@~3dp}IDHqB<%&w?NZc|bdQ4`w6L;By&ZC8HiSIwEWXwqI9Djr6;k z%IlM_FO4S$Z>lun{jq9-1~ho36j0n{8$fH9L_hgSJj`7NyYFrk`8ZZWibh(lB{W3p z+JADL)xb7OIUR(fH>;uCT(**o=R?V2^i~jCCz93jR(+ph>&Y)5bA2JGkO-~x_T3wK zPZJs&tbId$30U>7ll|ntf%A$?*8SY&3yM`PqIPeWE1$>73tLurixuRn8rxeCprEU= zkP)41vp^LiaO-XuGWzrvHz#$BZTHMF{ZEW}*ZR~s;o`uz*I8@5?6*}@+|g`A2){;S zeZhVV%aH8uH`_BiWtEA8Yq~raZUfX(*@JTjl3@;G>oq$c#Se0TDY%!Mj{MH4*TEzB z(<%Y!iZ|G0udmBX>f6dawQN>;6GpesoPLI(_rX2^S2HE0)njS<;P{2+*Ito zdX70lhzCg5ab-h95@WIF2s)ZU7@?U&raDHzB-ygSIDKaKK$Iz7}3J zEwliYGn~rCPHMgaXm`Gz2e?(8(L5 zudBmXKUj!$(oWNbJrdc7>SeR86tKP<5V*H}@OfP5c&n+xZ?oSau~~3&Y&^XOUT!pW z<|Z!2g9!<59^%)7)eUusE?t598!Sy2&grQN0`QW3Zci5P;Q}6BKW`iq^7U+RSn}T)lf2pL;CI z@FI@CwHp&H>FKrYEngen_`I>x_DC_*oYEZq>Ll5adGNe#Wlg<*au{yQcVZB~emVol zIY1OoCc8j+Y~ShR_PRIPRO&AYFa)`w=%HF>AG5 z%SAj1sK^vwWCKAPk{GnQ73y%G1oz1ND6zH>;!Ir$Q3Py@?i9k+%+`IzcpE2DjXlDy zBJ8a>R|^_It7KEqm&8|t{+Exo&djTmFTZs5W2&;3@Dk~|)6o~=1x!3hfK?WtP^g2q zg*6ZC3^GKz!(0<%tVvGMv8>UWZdHI{AhlL&xFvSDRw~h+FhW5}T%=1pDrz0)>w#Y@ z$1#RaXEpAUUY7W%pOxc$kk%HSj6H&GhMLuwb+C6$*D6!c%paci&O_ak`v$OYhEJ9w zkE}<|2XC^Q^PT&gy5_w8*^WJwPWibL{xz5G8c(Ku{8lYXHhZhyuU&a%JnqJ(Md@K9 zGb4ts=|zU$D_bX$$SNbw`~*y+o;nD5fQ= zv=g-4EL|;Zy!RpNJEmVpGH!nFuMama9jE4U{AuNYuLMj=4TIa?KC?G4b~cxIK5Xj- z4{^!Nr;Y`$8TXb}vl-q%MNnO+D5IOwrQ5P-pR9!kSf`rsjn6f>Dgp4=C}tN zLz|kGs{R3PHcIuKhW9*69QpG>kDd&cU==wUcBx+5Wo=V-Q&ym68#pqm*GRs1uyke^ zTW-^wqcP|cknPiK-dj+0Esddh2{_+W+s>aPS#`2^>~j*ijZWWrgY9RX@%f+jm6e(K zzuH%-5&Vf_i|8(A)LL*7r`CxoiZdnmry;lY9lRCswN>&a`?yDF;L_S9_@k0-T5mVB?O;epC6b1 z-HDgWSfozXzED14zBAA@{HyIQOx=_;&Qp|2J@G6M%k3TJ2(K!;a}g~(cBHtP3uML* z8Q=iH3htI6>MCiuPDlC}oqj2ko||S-ejlr&UR1r_MF+;`E3m!pZsF<&@V=Z1D@g6mrcJV%I$2ZbBf>(0XR4?osR)U;Ez^YpCc`lTxF15?9-ZS3 z1Jjx9gt53G_`Hh6A2T=8T&cD=fgRXynx?$|aQOV{XfV_C>fgBC0*}+KzWUSQ-heA> zw<3xDrO2Ue&%eik>l#o-ZT0gNruhe!gCItyFw03ESvzc+nvP~7-YGv}H+;#&M=_jc zhkN(o%Q`G9!3=vr{OF|k0nf7dms|!uv|P<%Yr7OxxTUS1)}juZ6fhygS%4cwQlEXr zr_u8qBofuQ3|gT#)cx&Va5sDIKiz%H#d{bzI$_+KF#5%B+;s3;41)+V#*wiYX?hAl zyTrSK+lTT`F#L0$M!iGC41vvh-);6Sd`Z0=p6?`Xgu86sp*m$G~ zZ$)CG&J)Gm<7+?IRHvT8auDder#+wKr-Vnd1hX`bSy}YCX7c-z>`Pzz60$3e<)*o3 z>-Nmh6Zl=gz=By~iG|8Bcq78p3ksa6KYq4dGbOwrNnn&5Bj9KpiU;hK8hhjIk;zvO zcT8q2{%#`Xg>wsK+NY}(A%cfXW#q2HLQzfmDx?J-`iMT!35Ib{B#Ctu%A&~|Q{d`5 zKhn0*Y=NQJR^vwRExNi)V0G;d={p3mjz4nI^tB@~ZOHUetakDvGjM%?6baIM4H6>f z%1Uk#uOnD1=})I}x&aP1(Mz&}E2aW|@$2S9Qm{GckzWd^=ujOnDwbj4*;Ogwm|%|Fr=J(rTqx| z<-5cSa^zzXm_PeQwT}F({V28l($gGt-;jj>^YW!b_vp|9;Q}hA)-)NHh`{_*RAZ`h z$cX%AlO6UetN4XZp!yFCX3Wd)H{(UHK(lexrLf$$Bal;Rgg24`-di}{?llJ=JNL0= ziNNK@j(+q9qi61INj0xY-qa9qkUI6QGwJY1_^W-jUO)ja5(R<<>6>`!FAimdPD%jxVMs9&UN z`Q(Hqk+B@qE?mr&K2J5`-E)kaS3ZfYT$J_!$5NI+2dsW%Dg0DP^1JFrZkYTfIHs^F z9A6rfi5GRnVf={~xJOgJzpF6(nsGHSx2S^aKcY>W^Lz(2e3_`Ui9_K`i(lf>eRLJG zA2nbGG<=tF$km6!TMt7X>jE>b8W1P*P}~{y@!?h9dQ}8a#v{Cs(}Bs&ak!?9%3wI4 z+V&O@TaNGG(eVI52cX^o61~d;&iSshdX^Kn@I;ev8#?^;iFI$$sO#{zTG>4z-v5Hj zAX*P1Qc*Q;Hc;5Rjyc=Yh`!w>A4-FWmxqSpwZO_}t*1T~z15rd4|2NGcq{YE8%7HP zvTo`dgFWHHU=l~;BhzPmE%(y$NV4Vw)i!|1Cv)dxhrRZBrKKn8(r9T@TDIri;k54E zX=jGUlhkeJ@!vyRE$ACD$aXX4jbYCHUaz6>1#)jlqVY5mae=vn%%u(htmicLp!9;nW^KIzp< zfPK5rWv!NR)+fgF(Q0fe>#_XD<)yT3M%0;x&q>vIk>{CZz7cN>`yw~q+iIljp^Vh4 zb=!9Z;^gHbwW~wRbK7l_I`CCgJCIiCY*lBV<83otTz=#25aI05NJLy$dpTOslxGTQ z9UuFyhbUpBm(1Z&7BJDigeZQ^@%YEmsm3}JFQ8b!7B_s}39Vw;*)p@emVJV+B~KEl zSl4A<%-&kl3{j^KxM$2Rzs+cMc}(+OqGvX-4Jf6*Y)gol#|9;!;)b{p09KECV(T{p zCcL^gmWODRSv4(P?T%HK*7o7ApE|r*_zy_e9Pk1*r|+%FMqv1X$Fk}1cKdt+m-#Q% z&%+_V4o4$fevQs&I#x!skN0xWrS7pPZOnR$GM*Y6U+c2y9Ue-V?qBP5-L*T;tE`+t zQna>>3wPz+#u?f_qf0GP0D4c)!()(IPm}B`S1AAUe#lFDCJgfWGxT}*>j?+Pzx>){ z@2|}$g&Z3h4!4lBC5|frTF4ql3<=<3(vMzp`~d!*3shmV0*rf=rUU7AYixg zSW*ABaaUQfbEvuFlHIxkaR(=4wr|`|O)Rc?PrM$|dTt>(t>Lj~nZWU-&+}LJ4IHdS zkr9ovU_P}^xOtMfKQ?J*DTU}6K8=hTmNR4r+*w-QhUo?$vU%Uw{Yz{3T5Ny(NA9rvf4M^nFmwJNMAk2LsifWi=pC=` zx;>>;P_F>@^~cv}{aeXlDkYV+lAlO$VRGa!KdJ{5(9P%2XGCV7M-+gRjKjrS-xLLCmV}#X9|J0%b}C9T$6r-}hLP9gu*%B;bYpFg3Bqg~*-gyRgo`oI5YQLp~vV$qdSdLd=CW4uf z2g@V-2Prl+kN9WG=1i<`=yo-rf28)ru*ZMpLXTo3jApVzSQv)ptXOAt&E1rDjqsbWUaZUalYaJluY@YN zQxLbb|8M>W`Ghie!3koRE?Lfi3!$sOdVfa|t1Y^?m2h2|GP;k^RMUJ}=`}211AMU! z6zy!#Fa!0Ii)K5E=GATB_chZ4yE9u9;ej&vD%#9epL{QmnmjC^k9HdOUMSaeX{StNn#Yy;WJV3YqSZ1Tg193xp}Z z{)AP1qy3JN#^C^bN6eNH7V?8#EF)-yWTseU(*3N?r}CckfK_-%NeR^AH}i(m-ek|i z*A+Kz`=}lI-6(jbbKpwFiH5)gV;^xQ>K;**N~njxuX@jCQS5sh3D5f_@ zEB(c}XH8jIsB@|2$(s#7lkPL)Ps?|E&E-?&>uCmykoB~ae(gB*&%8YJ9P`w)2vR+* zMlW&ealOe?^Eu_}!2hv+%h#~^>fDH38``n^ddeG;-Y^#OD-O?*KIDML!!XJ9qVajm z-TfYDiz6cS^8Dpk;58Ao`nPFnpu=ZaXbPFx;^---5_-LLuCYu1qV6?-;`aVr9KgOG zXGb*#oshCp_aPiA@Juz)A1+U~6fpg?=g~ zj{|zpy>K`7xW;kW)NSjXibOabGx3DaJEEe!d3av|KR@ri@I=d)0}@DJFIt+0!fklE z6&TW7OzdwBD_8TeBCxjAuruAXM<@utre4jRWd6G4b8D2tYtl41w5_L~(0m~*@$dv> z*O%EaRwLa1xe9bftRX`my^oNPIqgf@oqx>%t1IC;qnWDR~^`Q`S@Y=arV|lZ@Z!TzN%j;vUog%zV~1oEmCY@u=xp+SGaTl zMctjNtm0!EwPIbrIFnrzda)ccyp=-3tAJArKDtN3 ziz#o<4bGveW7B7xv7Q@0U5pOx(Zs@wTH;$%+tc*JO6D_^ zkJrEfxe{%Kn)URmp#h|V}%=bKn-o_@)_lf3H7%37Hb7VoRV}TIyeHZ9`DSm8BzVYdAR)V z%^mj)eLFmd+Ct6c*l6y_XrdS?4DtzePP{{h!|`#^ASJaT zt0nF$Bd?+7Yh`LDjm>Jyxb*HFUE9g)vR!V?d#(y%HQPlmO4kn8G4)2WORkAGfukI& zi2rC8@c-5>TrB^4R`W|kt9p+bcAhVmDZCOu6MM^r3i^5Bg;A zarSBYHQ3JQ@Ue(#!%X?E=Z^jWvgz({@i0P2+0E7zQ@K6PqLLA*oEP5Z)L|#Uu{l$lG@weN5QY*KuroxKnOyRrtXSFj)UNiw_t4 z*OeEcCs6VacG7zbnV=(sxZl08q44(d;u&&*%H(UDAs^rcVMHlV#Q%Is__b%*Yea+W zu8;X=_C2*hng@w~pT!q-9yPku0)-J@*G|@QZ^=y^qM*?5zN#G*epr4+yKn~ffFIY^n*pv$Mn`JrSO$##C0 zb^Eh}BA;7hr@vzGE2~DbY})Y)gKG6R7*v0%%xaWQ=AbGIDj6sZJTkDYVdjW2L81(NrWm7r|8JF~SYVd+K1vfc z(Jw|5wV+#~{B9G=8yR3qj?pwexs1^iYq?Y?^~2}1#3^;-u$aqPmncWP+GlnPozgEy zYFd;iC+ytwzQD+z8WIT>SE*szW+ud*@SS11w?|Zshy-(IEmADmSccgnt`A)h=O8Me z3y^;vrA?Pqx%)1HRT?h-IF?!d6tnU6a$@_CqP|c_{qA<-tsMZ~4jOE6GyuJ1laI{L zRcHwt3sZHNvYxTFCC6=EG4D_SMz9}bM8(5@=KgpNOZ!FJ*3C=L_CfEVr`cRsRrf$| zVXew1EvC7BFrsLc^d>ojbhI=SEytsj)H(i%j+ZJS;u&*DcfX@ubuK_ABu0LKPAe8|Zq9Mq z(khS3r7+t#?5OJZcQk0^ll-js2%^YxJz z*_|`CL{mdYFclv(q7N`vvM;|h@HngO09`s`yDs4Z_xslB3?-+E_` z%X+fUN!#Pbe<~Wb-%1_~&eJY>*d4+^vkxM#K?ib|QK;^<9=096w*daev7;T{J}Z-D z^7Ce1pq5`$8BNV(KdT^C<_kB>XF$35;D{X^>u zEEL-J%@WLC(@iGGy(OJ)MKdd{Nb{v%+gCLmR|-NjmW?kbw63bpv;_*u@P0pw)x_U5 ztxUqP@$LDD@r!pQj=*1yCDcEsBEmcV`RW4TX$n(HmD{H78MZZ;o0K9u*3!-l4oE#| z5$P>t$4h~gpOzz& zbDgc|M`P~iX~(v3Z6cs%lcV~p6;u+<8gBfr#VNrE})9R^|0|Z`M~x`$bvmk zlNyqR&=v(g==G9vhV>SMoMB0y?)jw>dyky|`!$c(8&%&qVGJDU&Vxcdhbroh+6zad zXKCk0ye~OJ1+t^Wo++DJKi!YFf8nFPmh2!{!r3LizpU}U$+!e-Y$7=If9wGD2dlCh zc43og5E*6@Zcuml#+;fS%ROw%R)K(+>~KAEt|2a$zUY_nR5eSj3T^fs+a@NxE3Iw3 z9kn!R*CdsW?SAfG*}M}sq$8O{eWK`7d!IJwnzSxU9vfe1eJr!iHZlN$)+WP|9)xSIBZ`n6QdQvyoRy=<`aCJZB=2$+>4cHG( zoHl4Azc(1zHF%zW=H;b6J^(tnbSnedQB~=j9V>Vf8n^@u&rk1XH3XwfFY1njt-sv9 zKb~qJdOmkV*W4gz4f5#wQnF^4?g)M4+BJC+oBoqXoG^4~;F-1QAEhMbrnr~aVRl^L zGpC{&3lmPK2A)ip*7gUAQ(6e6oDCcqG?2+1E+g<1$cSHjV|5R`6MVmY`caO*>s{w} z;AlqF2X6l(#;qC(H}Ii3U5-5nt2*0@JXQXFRw!jKKxRtxDPL||RLClp+GVQ9?WdxK zP_n}yXoPB9*CgfLnX#&vm>wdeX!FJxMgXDa^B;a8XJCaA~SkxYAg1)5LTb9q4aBA^O+(eND_1i$-9p#h`xd3=ef$gqr`51}FoYw|a z6aLONEnFih{uPtm+${h1bi6fL>-UoBz%j36 zz+v=SNriL8>W_b#V@QR;U}}25Ju)XCJsPL`(Ea=Hz<4vm6j!~M{sVE zCQaL$AbwY}^p0zF$b7glL+y!$d)%kWbZS&>WQvG-NO2^c{4Y+@-)0I6Tq0_Q8VnT0 zp(PsiiscWe2?bc8M$syU7^n%dpZs?H$Br3sd83k|{N1OksH;cloEWr1` z1QlTY{WSnOqEyEW&9I*rpH=VzKI3Lod?2Vg)8^%DvBR0EGAukq7av`{hom1B_V@!}7H!Z*D5k6<9&{OR`ca?sEyk%_ zeRF6%f_hAUWC;x}Wszur@GE#-H85;R--Ld&>mW{=n7IQlk_!A_j%n))UdK>Ygi(^A zDfWA%BW8%f&WqnMXadDugR^>R;3L!hr#`6n(=A?GWhDNRNef3wA`?ve_Br&(YLp1I z_&5{z)=V#xNn*Q9bWn|hrDzg`c@6dk^|wY$S4`j@6@BFFD9(^pjgbViuAR>Pwy0k$ z>(?$36&|venDYAGKR1;Qj=H{yIwkTxX81=^RA^>L`b>!i`i36WoBxILJ2mYHaGg9s zKAVfM&bokCW+!>4Ujd%_5a5tR#OVB+!hr%1?uS)e7h>r#^yxAaFd2!&9U{t(oddIQ z94S%G>36Q$IS|3KeIFCStZk=cJvR^MJ02%rk8|5^d55ml7_r)8nxN+`Tr~9#G4ydCDSgR0y|@kH zADH^0->wkd?2dbznNgXXV)Fjrgl{L~!i&!^!{BcR%XFDhO)qW>^rLA^meQJ7 zZT%=Q!e`wf!E!IgtyqaPQ+d&-e2!=99r$YNwZR?jx?gG>z3;vx|7%5RJ+Sz7W6I&T zImvYFU7yY*|9Mqzd4JebkgEH9z#uoUwN@KaKcB0?4%tds>Wx_&m{vng*(nm33^=KC z&6uGk>+XB1IEEWDFcf#fJGn3E(%r|dzvT=@zb^r)Jmdx>E1=t!;Jv_Jch?I<-43Af zOKUTCkUY9xD!g5(Cgq=;0+oCBvpvd6WOoma-647}5LMa@UYdzJ|rUHQon_zdKG*psoUV(T=%EZ4*WoiW^%^#)C|eWtYe zJie5Lna)wVI?)9-93%!^5hBBd*~6zqahYTnuhOSUHfws`5bO4Q0I~A=C}T;!Z^oDF z_MHk2wEe&=tW6IciH~doj81NSd>baS9Nj`&HPGAb*Wc@fk=bmF6(7;fWYfgiEi{5) zzw+-~kof@8ud(RJY9Gl|_@qS2-anI3p*PZkJ)g^%as+szNuC;zJL*TZMi_bPvyD1* zV@?Wiw8hHC+)oDIpmBu^^jj9*t(-B1?-%j|jt9x@={p7*3e14{ zTfBcp&zxcxuXR^u4vC}+JO8?0cI!%XKlf{wHrNpJqVT5NeXtJWLeI~acwRhqmx4Tx zK!Ft(Cr=i@2APJAN`{A5UKN;(UAB-pe9q(eYJ-QPb({(CsEj_HyUx1Vn7?M?XB(H#aObZXgULaw;>rd&l=CA_1t3(F9L?{CXkLp zIfD0EQnpz>mCvtdM{;DZuUkhedce!x+CcJsw$H=GjIHVGSUQK?MjP~TuUM`@N^IsH z1bTxywE&5{sz?#SMUu3_Hl8M)#&B&f=s~r+ton>83zYHbgKvS zXAV*@Ek|fO6Xs)nFtrfRtRikqQu7KA5lk1`dufwQj^Ne3LWpo31%C-yP)}Mk)-GVL z0JySR`+Q~|*kk%jxce2>VTm>V_9hc~c876n;5Aha@Wx)^TiOsFiBNi1@LFINND}-U z86ec|8%NO2MZ|O2)Re3)VaAw1)~f(X*(En`L3}m#@K!&U8<_DLnw9-|XZw5P-^>$k zOH#jzgh;p_i*OSuXG!)E?%BLRwx=re09beX-SE3_M3R?vTTarn&_FMgS|!K3f;)^( zWm^)*N_h)QKIu=@W*&}SKk^6)vocEtEx#Ne5s7NbFqH#kf*H*Dp8ze*L3-ur6{!(% zEz`kWg{6RCGNe^xfkds<_6Nb4{#=y9c#bD_RTwqC>jqOlvI$I!ns@0Ip_j}-lYrib z1WE&`SwffIn;f%73=)aFbf#EO`5Oe)r6^I3TIu|LE>&%OWH?!6&9v6Kl%I7z-fzOz z_`hY&r6LwwJX*HH2f~Ftt4m10r;ge+)3=_pf_phY5&L4YWAk?w}z^FP*`ZUvM6HAUQ?va?C&l|xtDzrJ~I zP|{`_Pwx+aZc7^DKFUPMnG%yp=^%L{IO8UhbC8uMr93{Y9)zw5YrXS_9-dYFS%V zP(RMg{6JeqR&ZabAlfA!DseU8~!owrV4Avd(U*{jn6<;K~``+CV#Nc*o5* zfcW0k=)!-c==a}_jTc5lsn2n1g-N!c;9d8Dtq4!tgz3#J@LBXb12wF>z3lpt2v2;P z&Q6t8VrGI0ff>6WtHhTJ02Z%9*qs+8ubB*dK)l$F!9cTO!J* zQ;tHjV=C9-a%W&~#HKuoCyWY`lG*Wqt5>f)R~E#$M9d zUca@JvsQ+9#=EWQlb0(zFeywAVKumG@thbz2fMgpl)qkXFYeH77BB#ahS?`Wr?;o< z=!C^0Cr;e<9-iq7x@#=idNb(+r51mFS4tmNq}VN7b!5B`{@XlW_>3k|toAzhiE5VY z6QA1S-T5{Kj+V!M(U;u|w)2-Co5>aPDr6>;P$MEOlg<5OznKF)GVd|uQT&)h?ZZ;@ zh+c2LjcLa@mOi9!BW!EHwR5JdO@YT#B;};vXXgNq6vDz(^K*&{!l}7OnUV1^)9-uf za!_Xg_T^`BQ&CkE>mf_n44XWSbs0g{;xJ3Q{H|WBF2riZZpY{7XMXh9F4PElj zG78v_S8`bAS6z5MX`3XGR@)$`o5@M$ywu_zm4XO3OFOAN#WF2v`#30JH!$Hx8ht%$ zW?tasfo`#Dyibco5nobwh1~krT$&j_AGFhqTt^=Z-`c;mET@G}<4!1lWN+5-bxTNnw%vh7q?>g-hbORx zV1LKM|HG%;S7(Echf>CBKWpA{Ob6;48S^`+qj(4a!9)oFwe8Y>k_^)V6zslQcQM|k z*>FDyF_azaDHS(b6R1A8W*=)K)E0(L)}p{do&$sb`0i)#ou;Eby{!c$J=DliRInyf zjzxrs^lWdPw!SICG{KynbzPqCY9*nleDQWIv?M+X$D2!V*-+tr(%l>y$go^XzH2WR zxQQl*q{qBsgxlf`&UhO;mw?{jON#0K)1`9!4><503-iA>eFo;RME~f4%>TzJFsJjc zQRQ%Ge^$FNBl;UMLH_Xr94`B50IFftyv(G~@qlpW&;H3sl;;f|e-smD^;Bt9=UaAq z{n@3t)KNE|PgDU4^8pH)8f5v^^HXAqj7f6UaCjFK=D)1+kn%*k}})Gd-~tgUrUK`~9*;$3fkcWz=F1M25JdP;~-qqL@Qd~ul$^}KOy z4!J(KvBT1Gn`4ac^ALbr)#QozE4S}z8txa8dXt)4p2Icb2-YK}st70WI$Su!?U3ia<`+{L@Pzc z03ryMjz?>t@Yi)?Y3V(s)>_ROA8-{g98=5me%|0TJZh!m;0d8Nx3k-`2l&S3Nx zI{}Z!+P|Zk;7lGyePEX;*#5GH!KV=X24*DkKw09@ZMnj4AKO81?rm_dJVH#&7b?x^ zf@?=b&7ct}C#=QHLs=64lB~8_gZQnm3lOfdqq*N+5k}eT8`P4F6ZKa$li%IL+(7Kx zgg;&vq?r$BH_71-b}=S@Pl$41J$38=YG-Kf=8eS*%46?r=u>|egq~xY`d?oOuCjge zILt_I@S7{X_eH^>87kVxV_aI(WU$~z$I{t;+DP)AVs;0mA+KQ!ncK5A_nImI6gTXF z2vk)}F`fF(G@$5*GQ{pE!Tk_+$(?CrWOJARr4S=Avt*hwl$rX4Z=mG$n#>mAulggA99-PJ}n_z_6RY6flr-fhXgpC*CJ8GnNtCS^f#2?m0kuV!~%5#A=1Wdk0W-idT+3!xj@p8JvdjkAk*5;Lr*Ql?r0@ zok=ip|L3M4d0ajSWpgD~ycrL+*IWbySIaYtQ-a6UJ0hPd7Pv5#@Bu?AV_Yo$19%)? zNn9|NqXHvL)KGiU_#KMMA(trV=SKwsy0lEQ%E)RN-j(H=}OkpC18C2W~d~T^9EMgTZhm2qhV8>#J zKfrlg=v*qaB8i>)F-H8L*D1WhfJ^9M5(gwY9ch$2zHLW~aDDogRzdtJ2GR>7|0*ps z6@QeU%)`nz&B?d@u^1Nm5j3<)Q~lmwZn_?MZah@3H&8TfpfoQ~6v)Prr$X)=Q4ggI zXK5qu+nLOZSUy5pdu)O5LoZGmI$FK%pRS(%)VXTrS6S4Wp@JSj+XC+vLbH{mX@G&} zO#*?LTmHaK2Xu?_)qsLT&tbM8y(i*<@S|rrpz|JjPz*q?dXnYdUK;fDvf80fd)FIp zhV{Tb^gjD_Z(##y_n`#pQWjs1W;))qeIklp?&S1*-d<#&A`dqM*?{NcOF1DTbStK# z?SiGH$uf4rM_k!S_qJ8-)o!?zNXgA_Uqq`c&6Q@ z&969;oG`PZ%4yttmetryf;@zF5rovK|1!7b$7IFjfK1eHou)4L*1y3s8Is?k=IE!y(u66b*vsWxFNcT7E_Wnzany;De#Gwzfbq!9?;qD| zi;MPd0)fjv5mELnoo@K7J^PBGS9rAnlg!q%qN~MRrvHRMmoJZgju5?5;4QgAXci{3 zC2#;S$DX;h{9Anf>S`5TvY5|U>pasuuGu&@KO~aA934{@izXmA) z5tBvlRtUPtKgc4#YiY2gY8=Pl>7?yXFCKj$08{7}w{}K$7-4&F))6D7QEQ&Nu_?x9=Y@ZT?O)_Q_Znq}=cQ0z_ zay5{ENHH1rH2tN|(2nP(?Ot$n^M29T+lVgZ9(i=-v+>CD=y{QKk2k6@lu7*i*XP|A zmm-7yS}f@hgrb2kdgyad*hj^hl^Y4UkJ4Z`vDk^fg8Gn4D}UzU45y`+EYN+ZhWGwu z)?<6`eQHF1#D07z>vmHH+93+4i_NIy)~tLQoDoIKB37kllhCkmn^b$*B8&| z?@xW~Y!*rkD`Wh+Jmt+c!7NW^tzQm%umwdYC*1v-7R`HW!fw+%0zcmS?lgB2MAv#+ z)GG-dC45}=@F+HdE6TB_es&F04;d21n5kT?9Ip!0td5O|M_^vaC22&L#Lc^~qW%d` znkUge7&tS!{~toRN&*f)MvVwOA7?CCWKOGU<|6<@-WC78<9Dj@%F$RNqbX2vp z$Ja{6N=~OguHcYk;A|dB$}{%eJSNkGOM}T2H>GA^G$@I#zNDsUabXVo#qJnvNPY4V zERJk)3J137j%+EbVx=m@;QKN;{sDX5dKJ#k=jV^tcx2omq!PKX8!$j2mIHom!(ix% z3H&rq6&$k(PC`APDo zdilI+w(Q-z0P}wpTH2xyw0l+Y`pwl07*d$mWq%?;m~!_s;}}Y8A%JMr-XWS8^p}0e zQUx)ckm>s~(28MwU^vfO~Wx(4G-5IOL&z$txB+kslK8x^(I1s22+Gt zOK(}h(10+zO;q8Hc`EnFf4NdCXpsIiaYV}-QGL~S?v{A(5Z9W2taNWf-7yh$JUz=V z8$Q6}CLzfMGQsoH`A0b;3x_7xmg0Qrt!Vz>vTq5cfAJ1t#sPX!q{}5$%k(frJ$TxC z7p*(LhT*ML=XH?Q=!LCVSn0Mr&edab;0&VJm8Vp#T*xk^vw`J#=6cqy1V%R~EQz73nP*g8IeaoQtFr;9QHzANEzS~^=+s)cPm>-^ZkZJupq{ykdvAk+g zTEa+z9mKQ>S_1B#txU4z-8@=-&nL2sa#v|k3}R(LA9~7}@zUxE!CF=snCT|H;nMx7 z2tT2yz3e6Yu2{|Kqq4Z|sJ%RKDx58XFY>#H-kAkN!(Qo+DK=V*I_VR+-_nr2X$^H_ z3uk09)3Urjz{L+@EJ1s}BDTe?(EdlIiD(zW5qx1sK?K-A>YNPLM$P4npO{X$kb+f} zAJ`=K^bdO-#JR(R9L_qu2OWax&HwvABLqiAT=^^4S-4IDtmi}i4gIn;gr5#|H1)^V zn`rHjuf3y`d5tG0@Ui{Y_7D(tIBaLG`HrnkHq^>C7<|7aFc~Vov#P{Px%ry@dT#-l zB7&*{xTjH(5u1=P&(F4#SQN5*Pz=LHQCQ|ZyPv~bW7Bz6(vUXjhs0mTcGA7#(^k~U zAp{|i;|^gCtt{+K?eeD9Lh^y(?fU*7HE7J>I|Dyv9#fR_rS9tLPHQT~Q+rQ0kU)H& z3FW{0c4W#cmn>FG=Z>$T(_$RTa}^mfSH}+A3@oJ)re_O5OkW2ljE*;VBpwJ*e5ki` z1-Sb5Zmh+?qQ@VcTU!2BI@g8!w*i(otq6;TRT{rSql7>#RtG5V3)WW*k7NY|aTL)A zHIlnwvuZy+RUR|QF2LqzF=6%wvM-8>zl7C7M#azd$H!B!5*9acQ;`SQfffQW0ZKsr z-P9)D$H0@o1DCD$nV#BOY!7a`O#*{0#eYH=u~7C* zg)~z?R1g-FeQwim}eq#S1s!`<(T?20&i2A!^^i_z9)Y7Ji1pEI`YM z+v%IK-r}tXm+cIm5Z<<29PcwhE*yFn2op)icb|KiA^+c&={V||kDtTX3=tqC_vZ-| z3(gZ2V@aRP+~0_u&?bgP8VK%AaQDUu5&{HwcMlL; zP67m%pp6qCxOe03*0{S{aCaH*z3=_&{qx?;tTp|uu2og%RG(9|tG<%1+WQLmRzZ=( z<3oZ&Lf>nW59Jt?Gabg|c+oh*lrs&PAarV3i?$_}fq*+ZeFKd^|Ay5#)y6nBJDomO z>5C&j?irI3tuUk|B~}j4FX7bt=WqSC(VLIn8*A}vOyf;QWLmiL0Nb5|W1qfI9!o>t z*LFerpzt4j;B%o~M{3=RHZ1n<6Jq_sC`W@Yn?#-7s}lulj!uiadZy?`iB4F-Ws!?k ze%vV*oMICSIiwQ(n*TD4vbzUbyHRTKDMIxd%+~-k@8q>H(1XTpHlPfp#5|&6;+RQG zTNK>`??F?qZVwLpfRs0_yGbuP30=d(Ue2I+>0NybVj8Z^w6-JHwRKA4wkN_kT%J&% za7%VSKn_%J4M!PoVInDkb}O!4xq2T^lR*4}5_?&6C555RKe&jrftBAWMZD8~Ii zGuWwVPx@FnxE9g#omVQ7*GLEg2>dBm@~#-pT_J;WGM%BiWDFT7FG6=wstulPBqogU zC2{6N*4pbWk&zk zWD+vnSNa$N&38NzaA=~T=<-v(DhsVTpxu1H%U((6N3Oq!vw`upuGxv;~W|GY8j%? zI8NquI1eG4lPO1f5M>m-Oz4)qZ)sjuCzJ`hBOZ$Q9J*r_jI}MXLYjKIwBdXGkxqBnrleMeK^Z-s7h* zHPa7|OZB_}9jssU+~eh_KWe1`^$7X_BhiaQdI~nG&Nt%iloUdh_H-Wu5zO-)QJ z+8fFD7hQjt(a$`~0n}Y>noz@lA=i{@S@t@s3D?8LAs%(k;sSJxzEL|eDlZQ zHcK@p`32g+rH+ZN>3c7Ko7tUqJ0q0_`$ z+mG7Q&IPtr4{_javAi?g%it@N)}dGAjl21MQ_(Ljvu8it z`COd?ylg8LsKH3?6REaGY>RzzMwiN02&t8Lsg11ry7yBk_eUvlZQ8LMQup%Su_{eZ z4to|&OfxSXe-cC{|GKGgR9e<>$(!v+2n!slnO#dpIoJGBCetzE(GWsgT8(q{tfw?s zikX}+zs(4~N_tA)Q|o~niyDoKOpw&-Q=I4~py2laH@E$m5{(}G?!52#J>l2qJd{>I zI8i+#ZmF9N=-E7@UMBq90bWZ#l-ci=zS{tuG|JqD`wC_QJmZ36t2(fXro)!Z?7p8B z^qj(r?w$3#llxk=A*_-O43~^A4cTF z)RDgPU84v2lnf1+xW=qX)LnQj@QjDquy0ggPv6-V9?|FZe-p{D3-K70Ly%-8n3^xR zL9dO8nq?Iea)CzpD&IE-Te}{6t%9ThpMu7tIY05M*F3|ES9PG17K_hQr`MNyM?>wB6s z$XUT-7tKCF9wT8(fvKddg$ysOh&q>oU{oq?rV=or`z7 zRB60VkFF}HwjFt$1w*KX9<}3tEOiU>%rMnSEO{&~Iod6K+#2Mgv#Ds6g~lMc##Pk9 z8e4jK`&lpa^~e_!h9OM2yNbYEI@`L%K(N)N5of71=hWG5CSA8oT&SE{1sv7OJ_(`*js}>&7fkIyC=hdMQUY!8XI^FBm=x3DoSmh0^sj8 zmw)Zr>P;ra7QXXUn^H`&Q8sY23O)v6l*LK17$gQF~K zI&8JOi2S)OiAi645m~^ICajrvdwUCp_*K{-L5L+oMX*iT1bbeDzu-qJBq1>p_cDiEH=6R zs&LA`K>Mc1x~Zm6ZM1NTrbrvH*t+0*p_)Y@?x#X+zkF+@j6%T7r7$6@pkBVvTF<}G zMY2$RJ74>X1F0s#wHT>JJ?p&vz~b!SrfiU|^wZc<3Zvlsk4n838 z_~*uAC8JejR-Wrlc2VJTu6^{XBI)q4dtlGH22sa40clyC-kG2)s3YBC<^uID-DsP0 z|Czpq%by5bMS%`d%bC|`cfXA2xb}YpE{>Fw5xPotq+8D5$X|4c`2>EqR0JGFlXttC zUg{u;SFy40KOgs>Ef*njwd^3Zo5?}Dt2D~v*`EwtoGUj-Xw6D8 zY1G4Hc?aR8W(SMSj0KutiBTE%es$o(RQWpLrEW*5%?#j%CRk>4#J%4f_%K}#pR(JQ zja3^6e0Vc?i)k+1JChZh0x2- zE@E<%T7rf4HjqHT#8_L#p1tn%CT_frra4(DwIz9s@Z%+Qbkwb*98{3jom zPUK+1!|ZJW{jj-HfvPuH>)M20B1&^vwBA)_1*?)c>K50g z=N|n={Bt4=-7MF@+jdXOy4P2c7Oy?y-y+-eP%+_##(h?cUx7(j(M(vA(>B`q4VxyU+$Td&9EqL4cON-wdx47=VkRepOco9KA!Mk~2521P zw()*>Yb7@9Pa;E=B^Va?hCg8MStx!H)J);hy(;9|IJ(?I34s zUZ=Ec4T%2;bmu8ML6W;;Cn39hOGJCh98`!6kJ0t4po`Hx(CB`p2w!TYNbIHbKqu8o zKWU+%P~C)HUmthei%~rvU^=!2Nw+Am%0{r~Me|H+f}ruMBOb%JPAbC*-2U!&*IJ*y zWj!mn_oEJY`Cjy(X@c#Ixtb*ae{`JhiH{cjN;%W3d>ki$Fm8%y!}7E1vRL~sv|841 zf6-lBQN!SxLnQba-V0Lw7a4ziu3`ui>#DA?np1cUO_3|RE$Q&sYF~dv6gI+kw^~78 z{lbJ8uuN$PUv-+>phEGBEr0{wm?QrvjyiBePgHKnSoxdil6MqUNYG~kAT$xt^C+4c zZkZ^KbTz}dltL%~X2`iD@r3VZe$Akd=+yR|4cn4;KMihM@P;(xMQBHPH`|vvuD}!f zX^F_q6Sn5v5ivs{Dbg@;mpa?kg6}tG^B2F^LFd>i(fa-AS>N=yaepLpvI%)}np@9% zAl%8Yu0}DBnFjpwXYa*)3*Z_d1b?6AXNupehP{HPup*I^LtQl|^_#$&eGTVlBsqy8 z;(hxEHvPPqenDo?{BoPubTdQv;iBc~=JXFM@T75na{(J}Aqf#!y8i>t06P53GEiDE zF&;11qktD7d;VpKCtlvi*UDER8ISizK(_|rlW6EkURegg2o3xuKn4Hyt62L{Y&oxK zurbZ^*Q{T3NDg7QRdflLdP6wmHUahFCk5ES$1bWY2c+XDSS(XktLk-v_o_{MoiZp{ zn&3`Zio^`mxH(P+JXBW=ttiJPaEYc8m!RkVf$-AP68SLtXqltrL2E!155 zU|mL{<|qgLxSIm1?rvK}_3|_OeXuT=33i&RK#e71^MxnVH?TU$33%1Zoy)fX1M_jL zd(2#)(dO)2jH{x}#xBLPWNV(<#YXXi zDyxNN8F^BIBvC$8(;Utr#n?sXlq}F1-H;IMSWV)-Fp*2G;^8R&?0@rjHl%bbTsgb6 zeXG}!J|Bd?73??`J9eI!cvo{#K)b;R& zqNTvn3sC2hnB7|#^C9RAI#xuzfRK+K#@3Ql4s(2^&0)cqcNL#hvZCV;b-p)$ObEF( z(^>nC!AGw{GHGD(lSVqpJId5c&NEvQd?*^CZ1FM8;svvZoeqH}j7pTuzKPX!!iBZ- zK=_0Q%VGJb&&gKr5_hgi(vA#Lm}YhJr5`4Y2Xq9Pb8_pL&rs|U&IR47^aqn5lJAER zZ`#FVQ%0&216I4@N?LugX&frk1E@LC6VXY{dIPE)9pW<9DJ)x8ctmmyRK8Cwbq})( z#hp1r-{nlT@Gsd9O}%EoUGe3=aBwRrxxSCQ5`Tvz|0|p;P3rk?nSmXAtET2mlBomA zD1gvFa~`Qkz(|cw046z>kdz;FQe;BAEAXS;MeJG}5})$HKYijs6dg)`;+t_j!@Tp5 ze#Z_YE41Yb7_8}o6j#_1X`8Kih>0J?0zXrR&czV&9!TRyEsRcR6?C8oM4EdZeRH3W zd%r_5T;`R)jWY9_!hN?1mFHU@FzFT(P@nCkNQW>pwR}x6d%xJPmsP*1q;wi+0P$xa z6Ue`^d6l4@7p6DYg8%q9*r=xy4;5M2{x$3`T~oDPqhy1zFgBP=yCY}JgLO9g3cx$u zQ8MiIShS61s=@1X(cK_@Oobd-Pp*^Qu`j9qfUQlO@^Dm^i_bn+i`j#x_we&M$qz;y z+0CD{&G{w4XsR%H8A}4E;7$6&9Z04Ch1HRa)(+q1melgjL#4A&$5Hrzx0HGMHkzKR zB{Rl{U>1SO`u!0FnT1y->-ymz0Saqj7t44OZL=Wt*-SNc&wlh0h(yu;2m^|?nOG5% zW&Gm}t&zeQQZI%=mFe-SJv4ddNxW$ryzm|D?8;?2VdDwRKg$Jxy^AVd z#d3lNBZeNK9SX0lXGTEdy2SqA?s!rRM0Jv<=z4N0cuG1UFm$=UQm{-NaEPruO^7>R zb8!3UgHC4As2};&>dE+cgs35?pSWZnCx5VC4wKV|>8YPM&?kh?j43X?U(HM@ zkBL6ctVjW-t_Ln*4Qq@m+0^HDwO(N(C1TnYh>CU@)#%x>v5SrK^S)IT5rWtAYfK z3QQ!IpdL^ac?7;Msl21UAYpct9>JBqC}E2AWTt{Yi><7-{n8A?N&`uSweX!rhY8Q%!@G(;x0t;2h!cO;^q)jXHx6* z^g|hMyR4Z4c3T+vnH~j0Z%Mt}n(B=g9}>!TcY9sMm*=rVT?xuI_=7(3_U;vVldxSa z;ojrrs&EIVgbh$2eXW`jYk9*H;(DggEln`fw$&6QaS)*on_Blc@vBK2^LSco^mSZn z#@DQ&+2d%>is1g4Dsy)Oa@*n#{7Nd4kvF`arlFelJEdkc3mQ0wd*?%XBJjS;N?*H+V?}3Jp?AR_y_73{h-?7ns;t+Ay%AeeYXRX#kk{1kfe%tHqnygGCV@B zs&{LWNHD(3pIz-eEws$n$f;()&xYV>{M7SxV)xdJE8%|WO}Rx2iBaHq1^%im81j7H z&Wd)9Mrp&e_-**rO?XdYE;I}$7seceu2yD66t4@gMy-$tn`HFnx?S6Pn99*+;1V4j zM?d(m)0&uYRGW`?-9B`68*3fu5%9Zwt;IOvoXhUGoORc=0VT5MI+-x=<~nhPwx|EB zpfml1+r2JvR-o@wGL2bq|DkNUBJ9K|33D+bg486t$34cb(b>L{-mH^(54%)_FFlID zXb}n6lhWjEuYWg{R(?3{`lD* zr`!cAIwx`^C8TmzkrS`yz#ELaPRf6Aov$lhX}-wAlfQ%{{MH zKD`+Fm!lAv%IlJPM@$DOG&&jAylZHRM&I+?*6*#ub80Vp=bPq5@f`3l>mm?QK>cd` z>m7U={!XVT9fAP+h=<1p#uL2cSngY7a7+Xo7Ci6sey&U;L|TCJzaE&@Q`U3vW5f2@ z);J$EV;`Z+e?tKm7cekrwgX!#Z{owEmv2LSde|v}4AAEA=UovWN-q}AU_%Ik?+OI< z+eLS!kkNeHCW(9B3`Kl>PnEUWL9z<2iFbO|=%-AkhSDkTcDHynZxaH6#59R0HiRXT zVF3JSA>ZZ@$n24k8rF?fmTuwZ#HUC?D1+W!*_fKIK-qfn@4cz&5l}^n8qop!bSumt&(u*3>VUk+fZp#;*Krd3g^@?8= z&)R2tF^-YwwS^@2f)Jky&hZCh76N~m6A5X{&2}>31-@y=CaA9Jy@d{BMLg*ESz1;3 zMp{-8W1hX=!lAy5EMYoj)?Oa(@ZNF$@x6rdxMphlP9xkZn&5y-%XiY#mTQPi+OmF8 zCNVvDH%@8w@ik6!LF3=EUvO$2A{rP({E`shWM}`kvL2NS^JjbeVx^&lvWG?PB)Sk= z@>z2j#+{*^n~{SRN4jPC(nsmWiOpzMr!g%IHd?}su&cDz;k!9Ia2?A;L^jhoz)g^&c1~VzmxP@ zKi#DMC(C>3*Rhyb#Umu{TIG?cW|IO=7?rnIA`410Iq@y+YnSWwLP)M=huFFKd=xnO z)RG_I=xGmRyvEYMQcID@;1o#aV1^9I@rSA;U_(1WQYYUe-BvL}oSZ;H3i_XII5akz z2sKLgCbE^BDqMZIo_m*$Cf%~tQAbWfydP&61jmWQ|EwwS^74Vd!^2a9$59Y50a)ak zDC&o+n^0|6n+ZzS=Z&MkLEKDRN%j#F4L`9z{iY2GEnhjJJ1K!nmVqMy`y4pMLuG1a zt8JvKuB~qCC$i^i^i0kRL{hYi(u6D1B#M)(Ntyc`e2Nh)qJ4`3k0zChy2`G~W;530 z=#6rC4witM5{&Jr{>H{8T^8qascy)e$|(SOuX!{tv#_e5-rsfV@Z5HyJ~2Ha zyJ5>{QDVa0;HhL_KW${=K>4RbKxone6HfoT%mq9eqK+pV`!`w(NK3-908@^*J~=?4 z_2$)y3Bd+Sv^6)P%Fj1Aa+z##SQ41I@7t5(WEd$zjWZK}GNeGta`wjP%@Gst#im8kWLQ^!@W6<20)on+-%3)pK1Tdz{-m5}erUy>@z5}f*2f=- zVms=ezd3bgy8Rezt``ya1Oeiqo0ad|nuV^$t(1v4WGBW}vN5COJGaCP2 zRe}cK<@&c~7X54sh5T*L@&n^xg-P7~46ZiPcjingq64Y%F^g>Qz-T`H*~pWxlmwaU zuVelruRMcnNU1eFljO2g1p@O|aVP)mWK;>u3cMI<`Y&z!;=UH}lhh1Xs$@Ig-s-X3 zt>4YBi)l@M=1(BYXz}#v^abjbp~4xivIxWtzxWop#OuH4ao3EleTFHBrN8^u+t+D1 zh^AhqTXoI0-Ha+tWr|VcJbV3#)5@m{F6T!g_74Ye03%12<3wC$CPX@>hXuLUjRn~+ z=1Fkaukc_7gS%9q1WO~WyH9169_^fXhh~KKGp;3(<-2^;N;K7*Bsuack6YWtMSdQF z^`(`Ei^Bm7Ospe=U-9W`z7KFDgMJ5pw;(v)SkWU|uocF0^U?c@hrF*eHY$3QzN!p6 zk^4;|lP)0UJ;3p3c|EhxT+riPSW2~<9eE&u1?^s`uliQbF6|bOB&Nz&QLQqz!j~E@ zTHPa&2U_{$YFtn58QMIWp3%g6oBb#H#z9MOdwx6A7ALtB4V<$29^6p>Em+nztzOv1 z^xhBFC=dm_yUejh#O-+|p&B$YI%o4RRdg@!%tmyk6HFam=-Sam(ybg8mE)|DLKuF{{Q~{>66jYVSe}cbdmFDgw zQ}_~^O#bwX{ovX{+Zn)XPJ$JS*LlpGS>jx*EdD{<6cghGv9@4kz3#`FR+Gh_$|2<* zjP-6<_{cq%WU2 zDSG}D4fy=+bDqwn$?B7^9~+znKR8x7 zN#U?d*O{>!Ja|#Pb=*KJw>L2CWy>5LLmH7~d zMcFKQh7(*VlHzWllhTQKcP$X*!bC>jUgbt`R?tlp)4W4qlleot-sW3 z&U~Be%7HhmgiYMX#%ZAdPL*=>7B!L8>?U1DC>H!SNj;B=}D0 zU$SM-enkiTn=W9z&+;}MY^Y6l8ap!_ABE9>h#}ebAunn2CRF+_66?qc5zg}sQ9Sup z6L}`Kz7%Sr+oLbAl#l=V(_4Fx=XrHF0K#7(>h^IklS&4kuX>h3v)9Ky(CB z-|$UN&N7Dd!Pkxn)u!f$0F{~m! zPOjevV@F8r;V+F|YZoBQq!!Xr4%!ajNUNeND$fZp}bHMcRW_Y zQe86u)LevG*!E^Uny&UigQQemUH&Y5%|u(!s>dt$gdN6Wa-1bri^?~J*N?AX6a_i= z{;NnRN}j9xmpVjr@Mmm9Qg~iIo*GANL?YH_A3u1sH7$OKkXO$^zJGouDF~4nj_sf3 z_4o5`gAmDHvT@W91tWeXc*(|9^PFlK3%rMhNCyU2BJzTlu@F(gDVd0DHON(nqOaiC zV;!$(|9TxXuy5USTAshpGvK3gv$0B9IXQnN=i+7qE7iRs0eJpR##PA<4n(|I-OE=h z`>~Dz!>p`(Z)j<(d%akCBP!m!_BN>{=cxvTOz?%u_vgx1U?}^UWXgS?n zQ&_biE1qbE2pP@6jXo*n$sER2GhJD0rVW|TrC~=K7Pn*jARGJJLn9l%?T#mT z{y^#sFI<|Ey=OUGI)S}kL7BDSD~+566@s4zk&p-1i)X;zd>vDzk`4EFNByw-=+U2=4ndyuRbzXr;PRc>S#x+ z4$p?M>xZ8hhvS(v;;(n%v!@3#BbbhT0$!<@|=OPPk^yXxNd=?wlf4>vD1Pc?5e_cPBjk1>z?^pTb(Hb%DZ zx2ZA*ebV1SBAS1oQ8us47~0{p8CvhFQ?`X7o;mcBx9BrcDm{yVh#w1B>6=f7b0{I`PQ z?)k*wT=6gWBm11lx#Wh=4NZCl>sqfA3E5=e5v*Ft(eQu6`EwcmL_i(;CiZ`hB>0c~ z7tP1iGZ*~N4)A}x@?S69q^-t!*S3(}mmJ@`7Ti0{p%&0OpmA%;uwN?c&|RJ;d9p5Q z2t8*^xx%z-5DyeU42}E4sYKf@Ng!I~Lxv@eE%mdHOYCJ#2&A^~;bG^1Eh#c%_-S`W zKLdDh`)S~GuGilVIC6)B&x+{Cf}+SOWHOAjwz%ggE@VzJEy|mFzTN3&#NSnKb$kok zTU#{T)GBtN0`J|$SkNvDvbq$P-#ln$1VO9Zu6-#FLhP#U|LmC7H{ws&7rLllI8|Aw ziO3O2JTI=<+LKvv@$&RAxrmo!4~y55)c|p2QD|>Egh(E|xifS#&@`eRlkfSPQoZlb zHO}s+{PkX5tz7j)?S1{U4edB_a{qeG>f8ApCvs)}`q42B>IUxEpC!=PD;zM82m4_5 z&EJ^fKh)zd>9Mlra#{wWEQgDr;-NHNjbG$_n5J|F33%VealzAs`w{|v&V(8gYklez=-?Wm4xr%z%3HVa`a-O9GACvrGZ5cyq$PXI_(e4cOx;?_z411SQ#Rh>N+V zp;Sv7UZhna5LgI=X@(XZRcP0-5aQbjDmKq7)h{IvZH~;35a4-Ar)|GOv+zVjfnOH=G_cwn55F5VSWAo;5&ffZ74M%xGv!BK!s*l(-h|6bJ%}hw;|yFc1PzE;r_9m zIEleNR8z?D;)~gUZPBlUQ{at#N#yZsbrS9lY+ zqi^0a$2kd;!M$>kCn$?KU1;@qxy7I@?4ErZLIAQUu}%o1fE#8>ECMuTx;ucE)gN&y z+7hfpofBP!S>C)q+n@4&n>eE(luJzOk??j`+!HhAT=S6aw+jQBBHmr{=%03MC0Q7@ z(Z@yw*-$f7a&laJ)UHM#jymp@eLhBifDBI=WNF!SoPkINI*&(N{4M*yRe11DUsp{w zCrMaC;c}k!9O+n3elgO5H`ioXb8l4ss87{4T5-p=Z?}0B$5lCdeGdbMRT71MlTMa6 zdUj&`UNNJ^<7(?6YMB&#Fni)&U5+@sjTd{myIRiIkgRX)^%(Kg6!)Vqs}gGXG3{>l8(YpG!4()YHUa#S?dGtr)RON5F_{9s+)8~j}-Nr z?w`lNuPoPYjlHWRBu@6MdN(z>cTl^0kk`uDKfOIKUT$HXa<6mi|;-tVhLwMYoL zh3`jvJ7tEORDAS8-ihQn%+9QRPPV^T93R;G@*+QbM%X zx9~&j4Pk*oG6Eg(k5|}Z$s~Ds4#3UhO^wJP*ctaMY+B^;$|<|%Nt2z1aAC?cVmw>2?DD{yC-0IGA=8c|*VA%{LA<%JcbO4^qH}4d3!lpKjfXso z?zR*&)?J}CakD7wF-e5%Mx$oYI7HB;9k||DCi-?6v8=r>TQVOkRN&J)<)H|VfhL%1 zPg4C#0t0X0ZdpH_IL*GRJ>KFTm?}{PWCaV7WuHtJ=fc_DSaeNc?KtkM$cE5nK297BW5?f{OgnAi9>Mg4>{@tqkch zUmM_V-sPa`>gpi%`6Keg&zskN+cT=dq?=pMm_LdW*i9LfpMd+!jsTHA=sY zkqu!!PGCL`yS0m4)r?$sS6Go$STj{vRaICQOdTRf?bAvfbmI?l=8rn7`*!3=fp_A= zvW3NB#twGm*Z4vsvQij#W>98o^N?8uH2;1KCUfSV{=z(c^3J#aVxe`oHaev?NvAe` zzBVnx8PUxNuVuyFw@>Ik)T=J)&f^=RM{tlwfV4+=kIIn91#Ifp#>PkO0j*`z?LJ-P z_?6-*Hn3rpzN+=u=^TEx17c;1ED8%R@k!Famvf3}ITdg?rgb>sIXY%JIuRxVjw#4; zQbm{tr>-h4BKSpCRfN}_AJwg8t$@Vki*UvGorjO-zBHaKSWN~YOJ$Nr8d+D2qj&$G z(J`q~^lC(4<^#E@6ZMZ53JImahr*`@NMj}9UaM=aReLvm1Vg{@%vOvSJu_iE4Kp={vbGC{oc2f3+)78$gvuC@g4I<8lNGZ^%-CqI7FN@tv)oJw ziHd+4zl~kdMNJ$_O9oAjjgpb??A#(_2F(FYo$!2on#yfh%aFF9<)9q!r|i;PR$5l< z<5P}$LL(FXr#}GdK#W4nOjOz|O^(O`OuNClB+=2+COw+4W4o5Vg z8)&i*af0@e38)F3nA`z?1b?`L6QA_&1%eKUV#IlY6unzpBohIRRjL#CVVQ}5*(%0q zx|t7QDTYg~Za&wdZ$4&=-p%0$69JV~32BN`R8yi;YGa8fi0%s|ougB~5I28{Z|I-- zyoE43sA=JEiT~4qXuiT^o=!Tvw?*;MDW@Fsl z^gPsRD_1CSj6JS>vRT&QuluIaoAOB?@rsKh4o*x`1gWH6Q7&|n8P-1|$Xo)S26DqrA5N9%9q!2> z8{bU7_NSb%$)SJj&c`@mi~8O8V;yQ0nQU&`uj5EA7b)AF*XZH{-KeFG94@<&@1MVY zf=oG7DadDxveQ9Ba*W}HT944#s00FIy1SNh`IJe8+BKkgOBxmC#~+`mssJ3VaS zBUO-F>jiZ{>5o`_!BvmHUG)3!FbpjE`1`!*k1$w0Lo#SkRF*`VYh6>pozWiOTaGDN zPdLhs8OlyH^taKLHkg;TNR~E*mJ~gnyqWJV5u1gEegx4UE$g3eM{U5AeMkG501qau z^wXl{!5F$2KGyUTtA2;;GOa!5k|Jf_lt-=8l;7v!y*^FnyDG=av~im`F2*cp%8w&0 z1E=2OWwJLW$k5-S5Cy$n$^?^}I1xK39<$dfzR9QCkHT^cAE)x}&Eg@yV>Y01Ew@?; zstLBr8nQPjPl=mqn>s3wU@-JIkZh{cFXF@}S19M2Z&OZdQ^B)W&azh_OjK^vFLDAv z>bN;-(&(S=f#Dc1wZZRuok_^=3RAa!K%GV|S*BT;*Nl_LA}sFdh|El-nrm|@?#XQ& z@;iRRu%Gp&;kjY*$DKa?IfDL<*a)s?p05xR{Cy9kCCd{~1(+0&x5xttok*+h4Ego! za>fD2CG{wRP{xJ|K`)3jgXN6KovrR>i$=@eq+IZ85@Opw{mFv^=j(DTjSr1T;a!ej zn+v3|<^B^x;)swOg3M5^p9d#&!=cU}levCJ88YdFIolz=nA%wHMrI!)B6E?L8 zd&+HfBBtZs#>qOnigoEk%59SXEca%B%WaZ~K&aK+epTHbSaUkWQfweqPb9AhhT z4Eb?_2BDyyjBCzyq?T3#eCZV$eTCP62jkr(WAj7EEyH?#ZTDVd-;7&@+u<>fiNS)2 zZ3m)vBJv|J9=1eP`gvHTP2^rK0pz-k<>Gz!S09j|?|(|0pzni>h{})xsZn zNtB=A!kL=Qke?lhtJoNv^<$n5Etw6pn~gk}1-_Hqa0pg#HkAJ@_HsId)uR2brTvcS z8SukQ2K==EqSM>u6+`sZ&&_>C#6y_GeM-cGHP<{nUzmCv{~bF}M z8m{vftP3;v!rQVz>f6<{(DMLl^#^r!fZDS`-Rt+s%f~vtJx4e2ipQo5`%d)p{(1Xt zd}06UdGC|9|1X5F4KKVwCA{@cc=LG|gN0QTc)7Z`N9S-(Rhw>$BkG39kRnVoa#QO& zj#fy#)(xSi11$Uf_WMJm`+XYM|9iJY+{w$AC;{-rIXK}5Ilq#2!j^v45s*W@a6Huwjut~VG|EbGQ4>PODMmOfvlHsW#syH<}nG4^|KB}=D1DV zFc}kzj8Ecd^?{Z@_c%Ql|IJ%;v*IJB3#7;m&F=cR%lyr-hr{aM#dyrzkwI?E0MYVk zp?8#G6Hw%WzWtHMM$hVYX8mjcS~1*gn|wuG5w#^pdpB_>T&3OI$|YBot}?w!TXN)> zY06pSl;R!j`8+J*T_^T1(91w0*zPiRdBNao_wWr(YYxdK&_xbMZaEw5Y4>rAm+{CG$L>uyE(r7Zkc@X~ z-MMc(ZI!N#wPmI3g^rkStl8Upi9r8p#3GCc0+m&wXgGS2?cYmp!{C!kANSGu^Y z{5?xb2hL+ZQFzlki%qpYAK^958*bQ76Z_Z=2f0$4h%>jw-zfs!+SBp|AD&l_4xsF$ z4Q(kgI~ggQrCl`>cHXWbo&bV{O;bsv&B;raxMd}Wb@W4HUH`+=^bN*C?kBU;yIo3k zLz-^)i|+zcISgJLrD7P9O|wBh1k+X0-UD=}Z&C-`HWVkJ`0GD!7P2mqJO$mHqVDTF zMb?vIrI>6OT(IfqqJ3~9~ z@!MYI7E}}xEm*5UDlL9KX1D)CCQJnU%ySEifSUGip4kCUju8W z6s+$H4+u8qad)$^i-(=D3}y2fXg|}{O?T(zK9fU9WOFINdv_vHVmDDluwH*~$_H&W z43}C1g>tf2%i7L&g1Q~Y#Pq($^CzrVxvDA}g=<*!8t^>T7KJi;={B@X&xNof3-zgh zn2*-9)t{*{ezMY4ZQ77|DxrrbL@{DRhd8fF&`XAvqkATHQ^=<^T_ zzqp5@EhFxdOBN`is_^@xiF?W_(Up(P!ttYepP4V1vGigRzp2L%J$k~}hX>qa`2}}* zQ}!d+eX)5AMfHYvgu>j+<~fK87{VW6Z3;gk=Hu!3Hv!hcF>s2OofT}N1r zq-oaj40NFVcKv5;_ydmDlU?^rb8B49WXHxRZ}VU+Vn*A8wuued2D?;?(2_T)b_`*0 z2e|TiA}R}F-|2pRD!Y4C7rHmd?3vgXa~58)fa8(c!h6%|YS~u(obFR>XWb3*`X@jd z5DGil$eiKrzHqF69-ndER_r*;YwekZv$y7HTX2+8&EsDgU~D*o&l6j;wqABu@pZF} z+C;4Kbtef+3q?3)oN~8}3xLn~41C)c^sDtZH%>NwQx=sA*jPs}vxR5#tCJ2Z(|)0< zId(1y!&g*Tv+DQ~8O^G$xPjelQjnzxgt1#MEcQHH<9dMRXNUG0VLjSmbpzhU)VT9( zQ$BT`G$O0G-4_Cfb1Y}V8GRbsk6X4KGxkE2&w6w|a>Sl+**1d?ZPo}z8DO)KtTqoa zixEw=!ACX^noWKuvp(Ta+vjOW$vt`03F3`_4tci{yLI7UptcF>RFwZsF6a=b#$`({ zVcv8q*{f?Kj4%Xwh4|bid4f#7Huar`Pt_|4MV!1cj|Jt<_SY(Uv~Fwja;E2Rz>W&a z`f3CWwEHsh*ZFnMvm6r^t9Y}?Na>eLN!v!l(=9Tl_&nWY)|wx6y44r|G^~}{F=X>5 z=5QZIZGFk!EQU>2`eq&ue-v19TZrzTITF_SWPN3x-z$|Noo{i3(4;-6`qG#bOr`|%#DY3%dHMTm zrF1uN^uc5rJucg%CaA>gGds)L<;*7MIO`RM`(5}Zs1vu$>wU7igFsNy8L|h6Uu$58 zQP^~$?*7+OtNcQDEs9{~(x7|yMf7dqR4k|qf3m0Po_Q%gL%rwXwt&e`S$Zdj9z8;yZA%zAMEYn7EC^~8D-8tr)Jux2l#J))_Bqi(ES$}oRRajQO#ZMzRy+BV*kY5*C|khy;?td z%H8uV)mXpwI(}q!6L@OJ1D*Z${w{o*&Jl#V+HlI}y9Q3<2e#hz?An!_q>NfFbyx4!qxAVwP&DAY0e?{aohxCS3T6L(A&h?4JI@TV!6YBxf`ysUBg! zqv%bZx`S(e0*+-@3H&|K!SAO|yE}U8v!}Km7*f80C(PWNjxBXkq}}63*YTN@jIwJ< zcDjlt2Mn1$%!ZJ@!T&)kMY}F{65u563;ZECyD314cUk^~}ZgavHqdhRj=4J zu2{cO>{u;!z88PHLKSD<`vXrfp3lc~_}Ej?OUKnAt_AVTJo^0T;jb`yo?jUK^Ce#9 zRo>>Wyv6Ih!JD>5Y?(WZyQ;gq$NPN9Cw#=mj9(?5@)@6-XSr1P_y3r^xtW;DJm#~2 zg)CxKmS+W4WF=N+71n1pR%Z>?WV~})n{`;1^%!pzHDG^3He$S^)R;{eZve$RNAaFf zyjv9S6U943@!n83#ydgn*q$BOkuS3oJF^SB@-=p65BB6Me3iY}n|(Nlec6xwIe@Qo zAm8L09Lymc%CQ{A;T*w{9L3R$H!FS zIG6J{p9_EZ9*en%?{hJia4F-R%4J;66$!oSaU(Zz z3wLoVw{bf^=ML`Vcl?6889mrO?%`M5%Y)p{13bb*Jj~-f%43W-F2CWoJjL(%15fZI zfAs&Kn*J#o=hO|J=UJZPWnSP#Ugs5F<1^l2^hkgA`G`+_OF5=g_`kb)b8vq47DEy1 zGTu8V&v>(-2J0}EHr~35f9c0R{~NF=TQL3uA8+%;zxU(+`SIWTE{uQO$6Ipo&Rx7! zH2bYYA8IL&p1ATNrO$#s9t6asxLr-ldASmg3#0UHqJ1av%3NW@3+= zV7#Mrm|rvAB>IN&U+b%k_k-e1qIetV0^_Zp_+Rudyu@d`#@oEkn~ZmJ?(iPt7<OW`is}?fe=*(wD7O_05u@Zl)q@vvaRXPGG%HLRK!Jo@4*RRa-hsvzj ztjx;YviUb=om5n1MOj|uX_m+Tjq9eOe*aLG_wSkIEmm z?w%|1ukn0O%%>JsYXTAzQw-1!Ajx19Xlz779HH$#9ud*%+Ed>F5<)(qr~KFFm48jZb4-p|oAH^1bTT{-qwsCwR^4|~;q)?@gW_Kt>} zK*UgVl*Zv=btF_`b6b3JhI}ZKwt77xJb%OXC*FQ5TQnh9y6ktrU|4wWcRy9Cbf}Vx z6R}b67GgK1di(GL&qJuOv-s4r2m@$Y>XWYB)&Z`Qh2Ee6SCb~+HGgTrmQ2>e)>t*0 z?fHU+K;1t(!ByjO2a^}7iwN*)l%gQUEBCx&1aTb>FYZ*E%6qs&vw5JmlN-k9eJzf(I z37I7;g}6e)2{z%d4kpqyWX$QMTCv^eQ=FL(??_7?9UoA2Y=v405PGycvfmPGHfaxT z2UQGUW*XNb0IY7X%HegV7TVEu}$NF$|2_(f6e=o z7vUa%9l#+X*b5v1l386?J3TWglY>(^^x}km-G&xD9aU6JIo{ir%K@s|%|?3ItM>zj z3UX(VgbS8&D9l@`Kg5`P8G}bi#HAih1>tQa@oqki;Z+*5=KjWHKGOXrhPk>fkWgzZ z=IAc;bvYfE*EIfZSy}g60`(d z^T5P$(rN}zzsTD0$^B*9JFZXmO!i_XmhU~1+W|EqmaR}L?$8LPrJS%F0#vah96S{jx|=T+VBM z;|X!T^>FVb7LrRQgWPM$Jue)00EtW}0O`5|NVaFziK*!#dZS>hT43N}&@OtiWXfjk z8L>kl8LwFIT$Dg3i&(|;eI}nP3eeQbtxa0U9AdCX;=kI5x7cbJ(+qjWY#%NLPB^452lbw*D2iK~QSSK$ zup$EAjVmQlZ>0e=Xa47$*B3AMDfWmpx&TE&OODP-sYVt))Wz1o`=uB%q{D1I+-wnb z1bmI}D6&h7*LJ2fZTP<3QcO3whj0+K6rO2B7LSZY`P2hmitC}m^R|q=q#i(iiGE`; z_*io9cbD8{Z<)}#ZZo)5cb~_9n4bLzYpkYv!(?I^qKXr4uCLyq8r^Id$MX6p2{Tn& zdl|0ux=W@(O^Yuy%Us4l-;m@qmr9olaIH;TQL33N!PPD-QL^s3W>qf0mt^-nm-^N$|pcEeI8efx@KeNYoSqw6ccReP#?cupTipQjCYd?2)8){lG;h+JvPrTJ~QK;dG z&T(k4(9kuW`6_k%SoEq7YPwgGp2BkRK6RNZ5!rQhcV09p)rSo}v!315_ zx1-DSOzRf7fZDM@)x=IeBTfnD>H*D5ei&<_YxbJDl6==AJ50{Qy=AS9y%_5i>-n;Psm>^V%vn9V%K?~YzV8l`?BpDOR_Py~8x~$tHHxqCs7oY+!WBh% z9(_9rM5Yr-p#4vsYtb_y&7(;mGK^#Se3X!us;#{+Z$nQhrW}bnu5%K|KTPKq%d+Zi zXumn5*+nR0biBGUr!qTTm33R$ddKXZD5o?w6H)w_jm=a90ZMwu%Lq8LTD71w<9ukF z{H!>Cv=3~zgIC`Bx1`L5by$~YOq-~R_QK9uhLLOwc3;%&-08c&-^W7+dI0g8+BG8j z^SG=3UOUNz6%Bw@tdF4mI|^-9YWR`4v+SISn)ev7dJG44p3;aB6`jXj4flpSG!pQY z^Kx>R14Z9QUQU(T#@&Xz+(^TWb9G+cmkc|9Mc8mDd9zI{clB0)^bWZAMuYgO1NsuU zZ60(((oM#S;|v_a-lW@TfpLHT=%kwr<5(LXCF!PWJCD0s(2a3SfUP5naglV-A0oI^ z528nOk+nC$mbW@FHa;=>1=H$WJ|dGn%15i9BBE-8YWv$(6}o*87(7}DtXET2YJSNY z<@-cmtcXt!POlU#Kdrx2H1B`?*FQ*c*POGU=D!$!Gd?~Fb98cLVQmU{+SOfMuVuGw zeebW>k8K`wB~qj$ATZz$I5iNULF}Rd3_rx~pm2lE6wU-_{(aZd`5K4!0D0N;1i1Ge zopbiqrYMpk7b)E)M?Km&mK|*#qIk0o^>Ii&tlA;%@ZJxRV@$>O$3j#3(WiIJ$-ypcbvz$k;g5oh ziT-q=i)M%7mS*GV6#kE3ZmR_ z$;2DSS6~v@>Kzw5ZuJVzE_?*~N5x0DZmgdqNHbonvT! ztE0cUAQxc9s>gCXceP_pOd^{L#4d##G%#*aAO!5A7**ZZqXDKJYfx4&a?Dq&v-0!C z*5rGE09A@fMOTe7(JK0C95wDot7Ebn?`k&LLU(OYz$$**bhdD<)O|GsO?h%!%+3~`Aqy;jL;nzG^vM3v5@!p~PzckpKUeGfNoe_G3(wHW zZ=fMfm$5JO*(>?LXLnJy@Y{9pnN$_KJRL1JwieZgETqEprEK9DR(S`MrkRj(s7*7F zK#I`ni*(=$bKb}2*cfc#8Meq1r9xI?ua&Av-a|f{3#1Vgq18DT970P8Hu{WA8%;TcBs`u|am)*kgk#wJ{dQfM<-g$3>e{2V1yn3g?Wy zPh}5~Pv{Qk91@L*-bRInWcW5OXf4VBN3bd>g8H?ED>)jpsBw+6y}Gl7-{q7f2xD7g zj}UjQ$x%Y`AVQo+a8By(bty?up36xUmkUdtkCMm+`rBzA^R1@PN zx1o1}=^h+4TAiH4{et0h)JjvxnTJveI$(=tchx;=Sl&t=Lp4Qs4Gbw-O6kHZiu65J z&or!ctWBBV^V4c+!zJ0%43DM~v5o}fj4OVMzJD2xZW zgVtgX&|m44Js5MeWOD+~0E5`t#@sfa&~j1)u1lZW{G+G7z;|#A#-3U%7^xV(C-2Zw zj*zPdOwZ;WTFyJ5zhaX;@Htp0*upcsZr*Vn0%yoYwA9(cU2dce`YZ0>3%H2ZUd(u{ zPa}_Uzc2DhxQbE#z)!S)gmM90#TY^5uYdjW<-51<`GS=K3+L}&zJ%3hCdH?Op@4oo*<(oJE_a0yW@xR`DetG%q^77SppM3I9 zxbvI8{_mTYPv5?M_x|PUzkL6m?|%E^+dsX0_U@*J0(L)gcq6AVr zkkTj{w34&Xb9Au+*YRX6Zu4)|7+!C2SSIKYmjeT5dWM`x5Lxq4wr8ik(C0U5ktOJ{ z1d%nXWp>6G&>FbrZe^^MKuM5T12Y(yz_BXuh!8cbV*O-)DG?7+Qb%!GHiZrk#y724 z8wnhlf6I|hNu}fCwa}3@SbMBN=aKROHTn?RHOnO+>}Ar8wO-)Q^tsBkoq6;#V!SYl~Y>=aB34u|6@E&APNC>dtJwxb4*DA*ZTM%J{ z)P+$!0>vHAj|s`jF~JrjSP+fK*oaH%#9tg#NsbBjAi<)L5#kgLepV;eVP*Nsp(aXj zqq9jAp8f;zAc#?p;qzdI8(ur%;mNglS54~!>vM2-~nUNWJ(Bv%m^j{E(@XDgoqFb2VqQFKynbh zTnV|sq(uHNIO!EI{a66eSpy=9fTuHguqqsXI40X10Z)P-J%b-TgtlRBzs$kF(PT)C7J zAm*wh%|T)kVQe1b%I~3 z?M15VfC<#I6Nw+Bs;&#SE@m)UbHkiQ;v3rb6eZFixiTRgEP<0zs$YO@JuT(%sM-jD zwLnCSRa+GnMv0@$lA_HqK_yIot+MFtYFW02XBnPdkLbS8;zL*~xWO7caw~-`QEWLg zyQUFAhGnHZF`iv;;g2OA@c~Mp=!rN>a^a>vs`<&8SVYAh)bZ zW4S53+{HDTzV{tKe+q}be2GA2eGI_p&&u6`CJ-DIZpT2dHMmp3h>2%#+MlAMEFrQ? zbhP<%cyuD%WAW%<0(Zot6=yw;M9b z_;a+Ak4_aO+sl7m=EWqR5m^?^y_9u`i z{I$X@Q+bf+^k)1hs!rZl8 z>^oY9nTu(<-Y6b)=LXB2cd2i;p0S4^B5aHDvF`fZTV*!&?1KFd5_C5-mKX`u`C|H& zB}+pycoNYy*w@K_+Upw{>j*?WV`E2+z_41`TMPRn*FYOWfSR$jBWC6lwqJH-n{DJ? zVf!V);!4cSX~pZ_Jgf~)VdmO=27_v?+|!W|IF7DhrjE)Vo2SbX2G3A)gX|H=Er{LT^yksmSMpkhoc$2TU-% zGg!aS55w!yl=+EpFvazeUo_iClq8T6GjImO&$H5)-r2Ok@QY{c;g1X5ip-!MZ(CDm?38^mY0f3qfwXTbZNptyIJ&I(KhM$^=DB4K%Q*oEO1woSM+s)07>w`bV?n1AaquyY?3*16dZw6!v8hW9k0;3D|8xh{C{ z=#U%=(=Ri_%#By-Ew9@l5!>;oG@bZ7MT=qr?v8x2uCVq* zXuO|0Yx$#cWD!L56j zzVJ1Jl!yj5hzHL@9E6Sbxr0>e3|b5!Y9@e<0XXVW1uqV$!ON2c&p8t49);f8t$nvk@w5so~rT`_v~Zu+e*VdHD>XCDcndABAM$1DzHD=$gsAt^C^Q)Bk+4tq|l&Uv7x#yxd+(DMfFoeFwB2npV;@>Jb*Nndw_;Vj}C8E}pID+QLb zC^tRcYG6fk4oA?Kd?V_~e zQ5x#0G5>Z$J$Z8L=1UgpsiQtYJ;@eMRT}E4G5vN!Js$;@XQG}DLSlg>4D6zjYq~uJ z9tAo)Wqw{Mu*C9HKPa%|R??LDiHI7vQtkhXWP6t{^ZP9Y@{Gwhp4!HLvj{fAxC<;7 z|EWU;Ew2<<&f@z&cJY6o$gVWAnPKK)^6id#-k{*0p`IW8xtki(c=v-h4emM=;M{{Z zAA|&tV>H`2Dpm*Zz>*=Wv=oRW=I|W;@%2Ow9^o}$sD@`)g_y!4%*e1o_R&$I}O*zWk%eet_H{<(Vn<+=O$H`xItmRjhZFWnPJ!l~|n z5m2mqKK-?$l(L>v_sR}EpjYh%GuH}+Z)pDnyU>yk7d*w5 z?hG!5mVEfD?zO+}f7k-{aR2(f-Gx8Gv6sVJ>)u{MAJbQ-`0>*J{rpEKxFSYdHwkfs z=bpvZzFFv#yE^R8?l^|m1Nf7FeV&}q^!lwM+#1>amnT#c>OOz%gi=Hr9zXxv{n>q) z7Y_{L5yHu{5RdB|vDRey3^IuaP2&%9#kre#YeOrkPHtRue~<(Y(LSmk#Rd5RI z)4UiUe31q@f3%TdaKkF{D<}{0Mwh4=z{Q<{)1`lMLVoBw_Bro+3qK^G0Y3(|lFpq)+O(j zV}|B-1!mR~D|lsQozV$oB^or+VPX{jjI+R#>WjWef3o*c%TaIazmr;2f&i6xG#hEJ z#T=UD70dxB!YFIhZNaG&yOAFco~>1xhX*o-GO9cg+cKosP7RRGYQcFxnR_ppsfPZ! z30=+`p0qW2((W9n|^5<2kGsA=6L{Nn^ z5k6Q(KgjqsuJprF*l{c(PG(mY;UKZN{Mvd3w5i#WibBr={ zj)#oig-XjqSCrhyrPg^e&t)<$=iAP3LObSAU&uDVi0OEe?{MPsvfR)ysfhKN%5tiH zecR%$TimSyI3%nL z9NfPIQ{EasF{ud{K0XGu(YS&@De-7Ef2S!t$H;ykwc{O~2d)EF)g9P)duulhiz5@o z8i>*^-WK`6`Y~mEs>jYl?nv0(jJI?sQ;rK1S9#wJq<5~kkgzglya6*~iKZ|rE*4y_ zDnC>NiFFwV%1rxs!o~#Slz+bU2Cf3=*G z)yuT#0ykTvr86PRJpS^Qo67ol4nLA#Moui(Vw^F5r3@X|mqM4)7SMy(jk&RS4O65$ zinKxuTa#&4J-4Z3ik5z0=-GYu&W(wf!78HxenvIe027+3RWxx!gf@V9BwWrz4~Bb%M+5F`Awz<6zzQyx1;s9CK$`)6H8Y8(IfHj@&}`a$H#%pF ztk`tu`Ko+QD=!L!30@6mqpq1IG<~aRGMX@%bNh>|nES6nIbZ1m6#?XXf1}MQdu~`Y z*dN^kYoG{COAAHO7z)aX1aaRODqkKDT(NVkdBTsA3fHGjr_$+@M8wc6EQdlJ-ZBzz zgB=z^#_qCQc?lO2L-%W3K4W_ZU^M=4Xw~VE%e==pToH8Sbp*F{e zXany7Cd@y1n0btgB%}X;F=CL;1S^ho&?W$5zyxOK?U< z>$bXcd3$qs_)UUPT^>pn%cAF0L*9el&E*#sZ5A&&9cszd+#dPKl_!}YjOSe69^3w6 ze`8t%$+x^tkxZ`ye+`7G>Rww+{E^om7UlH%o90dkBJ5c4I~MPHuqM_{$N~;ca`Y35 zmVDUceO-Tcte-1g-E^rkT3?gkNiHfHz^2q+fD)R>H7F@cw9G#}5cCo3Mckso!hVIy zc(-m34_hS1B00}lRi~*JRAQ!x8+Cfa=aCUNp85>j^4cY-e>HI`>k+`^J-KkkG5vDT z%Fb?}Jrp!F_0ym&a8eZ&1Prt}sVX|C(rC0rGKM^my}X#^Ii*BUbWp=1IkRi@O;KM* z-}JQf$F62(Rsn&bB1Ll`Mx?aHwXL}Ry{sqAT=$^-$*la<{I6!E*DpW)4+n3;HVS2K zWOH1F8ZSKfBF*4CHOSObou^0Klpq8`_JL?ub-D+ew{B` zO-Utv`Mh5~^gLM=F4|1mo6G0=uSF?ku2$tw^L5qDXUKm}DZPK?zwiA04!_MU|E24P zu_m|D`xABj&O_h z|Ni~ryr1T1@%Mj!FaNy!_JeK7LQN?}k~*((*MPa7=+nBGS%!J#tZ%z56t;wo4hPI{%1k>XdTYc4uw;09VM%$Xd zxdp8y<_T8rL=7A@x5KGSp2{sa?24llE8-D0Sck1DEYp95Vkcx?dzVleT65LDwGvza zH(nbF0?fYm>le*7T@+ZXPp@E{A9I@29P?(I$=E=feZxWa%{3Yopzk;=XbVqBIW?_{ z_fBZxPMn8bSa?xZ&bvu-EBYyxs^GNSSo#TI0Z8_lLG=bee*ig>fq7 z5`6Ab`TT$B^QX&yb6&2?s<-RNfPJ>|PzTEMCE6S`F4SNFiu+MMurpM8l{z6%VDrbu zgxX(8<$4kOzg0VL)n8`2fmP(Ulgn12{bc4ui>dnvpV{c=YHAwCu-yPuxApsJ(`a#G>4t_<2u!Jw+R3K`s;rH8=qKPFty-^Q z@0G+=wuSuv?t%0ou+P$4l6s$FUV4#gdx$xTCob&@6bZ{g6Hf%dFxU-U1g!5~52^+a z&j)`c2*3GtL`xj*iH86ky#jxVhm?*Ami*i&j`qJ<$q2~Up(u1Ep5wW4Zi;^MsRLvx z5l>ng?{21J7)O{vqlxwG${`aLF?WfM zOQ_&n&T?dQtb@tH^-N}-_dCj6@NF2PQ|iy7QuTO1!h)XB4W&4V(N&frIf7}aK*N7& z2E%n0$j&1Vho%xeM~i5N`@>nFcWGL-AL70{H88r}i^x6cyrB_)iTptZ@o}!|pd(b# z0)?pN2@ePbEzWuqXx0qO%T%hSGfQx0VE(xcY;c_=vLtzVHZ(76bE;v#9LAH#CsLrbIMKYV zV=MUPW6$c%`%_$tj^T)wR<~K*?rwCLM;jgj30Z#mr8hQ?YlZ#6it2!?aHfA-YwntM zCbY3SP6c|PUkBmHR%C|LKrgg-E7B-^^*;ETb$MIqQ>pX`N$5kyuv3L?`PT57Qzl|!aul^8L^b?1~ z{hwsIK0QHE#Ur^2FwhN>A)0?J^(Guz>6M)E#7`ND_{8F4JvwRN_i$o|_|&cfkqMT~ z(J890QV1}_CLn&`+)FEc-!QqZG!R&gDc>n%9hsbpO?YJ*1l~_%-rwD<)rtXa+JEUt znKor~bfSg1ctTy?qN+(1YtRgFG$Ned!%vQ$lO;83n%b(C*{k%SzT6lB2)RD+RM@DX6YBn(@=N%|-`0i?Y?7%| zZ3EPwsf6QPP&bnfz=kJ;u@5856+VWw9ZPnOMwOjPLcMBjEKQJMoh0G~Nu@W$4JZ z=S@e4G6lKO+h)ifBV?+S5F!J?Z-o*_-@e$~k#0I)7+OfD9-%SKGc* z;3^_R%9v6b799kd6GAZGgXgHYNXyZoj$G!f)@@ZwW5RTMBt{90rjQj#VG|ava=iw} zE@VxlSu#k83P(<08vc?M2{Vt;!5X`CM1K^4ed*R)I}U%}Sv!n$ob>G)5lHr|MpWkb zag7Ma{%MT}7Ve}PC~%`+tZR|PZe92(YQ1J0z%$LtoK$?pv&DF%)MY(L)=2c$M(`!R zE}3%m^Q|KpjSeq@3`=7-&z;48RVBpA#djJ17)EdmLRfY+^n{{~m;~>qDuBQW0-^B9 zRvh*8Zm@qk;EU!*8!9%l10l{0pz48|O-Gh-#2s)sqDy|DoPsF9V82rAp59)3Ym2tv z(cGM0>JB0*`?)N6~y|a!D}Bi}h#8P8dy` zo<$Z+*41E6O2P~FW^0kRAIjO+c0Bn(!7?S_PDF&ZieuA%boMEe2;zzpYC@oBX`vA< zXK8RwI<|p~K?^2C62L5{sc6%<4CDLMFqofPWFI}XgYfFLD5B`@dQ8u4kC*s%r2`df zL|}gzSk6^S4O`ulNfr6_Ap3-#sa}mCUoSl>n^)?)W|)u|BFmR17yWrjbxvXOKAs2V z<+#8%_rTp0RvFljobxShq>gfq-7Ln}PWT~7V!_mwn$JQ>jY?iEB`VY%^zy@>BoH&H*m8+3YZ<&~l1g&W{3_|OrLD`JL*e^r0-j*@LiH26hD zKu??iO=Jf9XVsv5ceuM-V;i-|k)=7wSssQlwjr}DlUYvQusPfuQ`BCaiKZXK^i_Yd zTMhzuxKTL4dWr1bc*)fvA9Y;Ba` za*)+bT4rt(MqF^@dRI@3@wlTdm0D`6VQHVR!Gz4P#~E;gA*1-f%{^`ci{kwV2Uf*3lg4I)WSRE-h4!%r3-0@$0 zd<3JW94v@`^udqD|L&vz{OvFQ2c_OV^_P(t0TZ_hy#WObf6cDzxDDR-Df|M*74>6D zK#)a&c7X1ty}P1|oD*j@oyBz1*RLd!5@pMAPA)ETbL>bo|M`*f^v48~O8;Q;dh$!0 zL!7>TPd9!^pWk-hfB7-}`EPClHAfX;`tg`Pz|BVa3G@t$o_^f_bx}&`t5NA&e_o;c z_UU7lf;D}yJZ)^7kLpY+`WJ|Efa$tkU)GlUa_#QhX>V{eJs0Yi--c}lNg+%tY0C%;;Zg&bUa^`G5dN2o2 ze(+LOY|L<+2|hwnyKQR6Q~==$(1fMng7lp@N%5L^^Of7RUGZNgEset0;6bw93w?Mj zB)1}&9vH*GG<~KNDA-B=U`ujp(Vp&?1d?_me@_u}0PRr3TTqn_r4l9%93uCuN@*8J zH)^I};mY$PY6yP_&t*j}(O!bXZih&O#LB@gqDkzOh|cm`=2Tz7?K5KX;zH-1gtj)4 zNs|;hc2b}vvt^3!sN^8atX-^O!I6qz?!TcOG?LILQ^JDOHM1dvY-Z@ zf7s}xbl_GlWLzw0RiN+e6FRRJu3q$#Vp~&=pkHAn>Vf@mQzUl^p^fE1Yn5%|hNk-Q zLK`hdK;gR@$-vmfsxK(Y8OZHj>{J-oDA-wG9~nO}O$Av#Sl7DB!e{=C8(D?bpwYWa zaGOFH{a2yTC`76Jch;l1G*j1fVXG#Mf9h!8Fn)1cS!!rGa-Fn?3FuQs%STPj0&d{hzpn4=|!rtOrli%KSX7Etvuf2a1& zj2))ku_tUR`xsCqa4>7G>o&btO@qoG|uyG832w&bPKt5%5 zY}m?UReBwvXr1L?m4K^8Pr7=RxWNUHe{n535&8o2c5jup;tyQbc}P*gGQbkx;>K&K z=Aq|onyLrhbBF`9Vx;L9PZfSde`0G-$Y9A_3&1Z6S0X1F#Fd6ZM^~09BJgSeKuQLS zotSTwye36qyFI!ySRp_$+f=~HW*I1}5-(pJxe6+}LOzTjO=_$eq~Rfhfg4E~sIZQm z#vU5CqF+q>maDkw3Vpo_0<+#WRi@!dSHXZ5mLf7-y7aXg*4JC8GP9+ye~KWi^;0iw z^Gy%j*ejYut{x469_O6Yhgq-tSPgb|u2v{N^0V3zapf5Gk({AKL{%*g4gXp$F_8FM zT+Jmk`4FKGk2brIC9}3Au&~ZlYht*8QI`Wiio1?|H?8neUd|c=&nZrZtF5fYBKJ@q z?58+8t4mo(fiPR+TeBQ!e^IBXq#bQ)vn*j`$yl6%Vl8c>?AGcP0m`0}#m*5#*B;Lq zsklX?I#Q_@Y8a~&M0NKquhs^sbM+6S?7K+;`aY33JSb0D=G58QIe~#q&gwuzc(vtG z_9g$xD{(~BGRg>otD52B9xWNg^EOH`ilU z7ZF8w#J`Iq@zv6OXW_u{O39KZK^+z}gfLfbOPisAXACNCYT8foFe+Nrc^ur0OU!046Wg%7;*61AIw;gAt&DLhl&*-ovcOvvLYp##$d@H^Lh zxECPT>nO^a#G#J$)PWS_-A{~%c)#e-_RWFF5TBdO;N7P9@(qlO@1AXy-9|HP;F0ul zX;@sszixKD!71L2=Fe`|B*-`)hZ>2rW9Z$4)=G0&x@rEhZzG1yRp`&u0JAQ|7KF$$ z-uGeRJ3s}CfAo_oF%oRyG|D1$ms6UqjwWX;c1zb2qjjJ~F;CRE2?^V3Pj{f<$S6AT zUBA$ug9>q=UhRm#=d)P%badMpNr>l14$R9_OnB@85-KI2;J1m=czXyB(~ok9N=v)V z=7|7D0gSsEZf)KsM!xjuS3s^vHN+6(DASTFU^`B9f7Sizm}8_S^HT|w_EQBU4bUt` z*0x>B845^)2x;|Dv5S)E=&tgfo^!YvqAKm1IrcMUjvI# z26B4RN}(3+QYWP(w;6YyIul>gAC!`#20rW&1yIS{vmYuFNp7FYlcnO>IodC-m4RWn z3$4LZf34-dXt@lABCVz26%S^n)$a1ckW=OMoHC(JiN%}Ww6jsrC(zc4x>vg9MOJ7& zH&g!XScB>BlpvF(Z7HC2{mW%{)itO7@@z6Cm{lD$7~3D)PE1PAe4smB)z5MBF23VQ zco%|C69_)iv|8HDY~o-j1u-OS>-O)GbO>0_e~S}SsXF_uX9%k66}|)SIyc1OkV+3u zITug;{Pz5VQ;@bV_@(YAC+&EEwoB`1Cx`!WGpOO%#eJMwwBylEx&Pg2P1If)UNwGi z{9GfC#Z`YSzI$zKD6#D%ZX@vG?%ji{z+<(2Q}BbqfZMmX4QKHbf7=cB{c2$oD$Dm~ ze?4ek`w%6>9*qSK&ZG{*`uX9`;TiqzT@f=r;ce&Wd&xg(%+Ru3dl%!CR{kfDw>+Td zP;D=S^>bYLdQqP%yME`*H!P^P=@kUn;K@PfjXr#I7yM;YqAj!TPtGog?I6xV=n3#( zrh+(6;A73OoTn}l=h0lW1NEH*%T|I=e|fX4hkeiGUraqDLx*M$5A9`!enm_j_&`St zK!)Q4v?Qa+L+({y@&}{DHZ1kIa4JXXs(vCZqTHszZqP`r=@m9Nf;ne>E|3 z`fd{5`0DITA1M)Hj-v)*<%f&8dWWh)hqBAeC1HZ!yx4VK*yCt`O zW&OizH77VJ-deA>PF`H6?_dA)1%HY4g?N{L(*ZhvH83Vma%Ev{3V7PJ9LbLC zxb2>=s2^yLR$BrJbqJ6NklP^d7UWRfW#^JP%qhPgSt2P?mY3?6pwV#KmMDtiPP%V@ z-1JSQAAOt5Z5rbc;_d7A^x&`Q_g|aqpMTtb`PJXF8lsB&_G7tyXg^pr-Lx6>Xl_4V z|F|oErOd;sbTyw3Ev{4gbxP?u{eGptmvV2O={G(;j5TSLUZ1GPhrXAQb_Mu?k!gl? z>qxu4ogPz$TSw@pK8OE^_wrJIJ^cD-On)u~M||{x+vV}kAAh?!I}Txri3qU6`C(vm z9#(Kl(DidpzhCA0sq^H&{MaQZUjMiaHU@ux`wtOx8dSRf{pQAT@WI0Uzi)rP{dRmj zdOaTJ(s{DuNyrT`2EabiO-D&LWi*}*(Lsm%mWDdUy#F$LrL?g??O4t%k6xdL_1aQk zpM^fW9mePpM_(Wp9D#olS6Jl=cJ99OBK=hkH4n+$lQ7XQf(1kKjx{1U z$370mM>y`xES$_4r*#Sa$~&6?0W$-C;g$l^n3X=6djWyS{*)rA*i21=QM{+s>_*mni}_%Y!&i}`4VLX4Yuf6?3S6- zsYY*PCGS?fR(}Mcw&#@}<{=AC__p}8yMBVJCC+8;v&8&{Pxhh1SdW01R5N{z0stdH z=)^ocI;*8kfk8L`;KMqk@hcX{NE{06fROOaLBEK z6+Ws4hjN3YnSM^M=;%*871)kcl0b~IlRc$QP>|Ubo++v;&DVZb8)L@xElTBTakwxM zYXT2u^_1Ei#G5_JgEE7ca$ z9)(~pIQhsNQ(8@Eg8Be|rYz`3F)l#`t4XCk$?{|;1CEaKtTataU+`%p+triUBXYmO zVi0#oO6#hsfl!g&7je+fu_|C87PLUCdo4LZ5JglwcNlg8SCoMDOW;&CR}@zjE?EB? zDwyVm8v4xq1%?r2{hlwD_wiM=onWgz<%|2evMHRd(L*$D6UQZg07`ST=n3jYqs$o- za<^1z?oBCkA=)W(c74YJ@%z4`Qk?N%Hw~twwTe#VFENl_=&1x%-8613L4*kreqse7 zL0)i;cnB-DRsd(MV@j;gjCf~*)wyD%JC5}rG7h`(HB;39mVRRAd)k+y8hmPg6; z$O&2eDJ-8FAELv56h#{6%5GIg2!n=d^F~hF%eLe+SWAcf=NH{r&@wB%flVBwDbms)YJQQ5f%PH_( z^`(1xLKx*Aldq|m8ig^V(TsdDq%Y*Kbc};Fg zZmq$~oZ=l#VlhSB$D1OvSOt#q5Msp2lYvy(N~NUy-7s3)x_!c_Po^`piCFHq;{auf zj(#^`f#6Swm$h3u@iE>H2pGcw0oRv$nODj@e5|IWNTerJr2NwM^>#{5nl#gxj)WJe zt6nmTG;d9R0N^i_Dv!1M#!PWUF_B}>PA>6*~A zHO{KLY66f#o0p)}7gLn{1qFmCaLWc=rh8J@L5cnfD zfePmL*g3^cQUiTe)ScEcB&3~>HRwtKm`I8=@S+xf2lT$rUnEyV^~4LB?{7^UjNeL8 ztuuR(*o5f-ij73RWb89sc|jYUIBt0|&vaZ!F%;ZnVrshPe3o7K_fxV+%9bEIm`n#L zGMa|2WtkG0vo!A}|29;#rXg65>o!5o>k(kArZhXfoS_z_&T5DU0*Qg(wzR;4sW$Yq zhuWln@UHL)yS^P-RbpvKh)6eKKj;cIZ&Pd)P|gbtj()uFrM!K(z{Ng%hYfw?tmAt+ zwL6CM=%|oPPZ4(jN-uO>SfJ%&hul7}+@sJYPUIa(NM!I*OoPEv&n8dFFyE;ak`pr# zHvfl88gnQw`g$TQLupKPA>`rS(-cMW6>>X&)jCvn1gr&4;R)1dnt5P=P=DUigMO?B>_`{yTCISwgHGjug6yCX>u#{TKEV(N4E_ZD4RJR78CtX786H* zocjQWLm2yCOx{_dM4x-NoP3^+5iuf$79VMV^Gl!m!^ALO0&N77@x5`&dk~gin zXUNp_aGH})86LUdO3MC!mALx(qFC{k1JgEuwG(^5KxjlU>WH04yVZoDeJgirsuxZ* zfC88Y!RVohCX{kV%eacR^-Qv04i5!?YED#tBd+gP4S6)V?Of4O9c8-v8GBIw9VH9! zWCIR8rI1pII8-5=S3P|06_nVz1L3Rj7+lXaCL<=jIw~ERT+I{hR5QnH6GU&3CzXL- zT%7}VCeW5`lT>WmwvCEy+qR7_wr$%^#kTFFV%zSzZ}b@5{eH#Sd#}0XIRg!WNk)wY zDPY*IDzTF)6{-Zbb6PMv5V`i^&3cTxF&$>+h~7r@-a2GU-w6c)Br7tE+(V0mcTREff{VPZeZ z3%!@iUSQYkckh{m>^e1lx5Xy+UhTCg;C+HvKTy-MGsJD%qDB>NP+p-^1cqN)JahA*7XQ$! z*u0>kj-UAuyn>g{WeeEIyGy7&i7lzLLvXaTp5<|G2*54_;G=p1ZxQ?RTdTm&k&G0qe0cY& zpbk5w@^52~c7&B|U+b-!1#CM}AljhQ^}&UM)46N|L$$SMoynn_XATnmF{tAE)7zDP zKEZT`U z${^JPFiI6?w&kA%ETE0_Y@N5a!TtCu5sqWCx7+Jv}q zTiJp>Wp-M-eW^nqTb9V;(O8rH5&amn0o_*&;DxSNa{^kV1I2IAPlNWs#MK%_-edD_ zry_tof?(0hJ?q{U*vmr4N-8njY2(|0?z43>6BuvSr{HTUYt~*&i)p9k6jUP+g zwOFlI{wo{3m&-UZ$hMG5PNV6{DfWhgYf{bZc-0;Exz!x`Lm<8BrhECZT0zqk zz`!Rj`=CN2Xews=;2?B3Dc-8ADC3mXxGPE{oK%5)Bp-)<;&Z_Qr4Dxk3Fg6BfIX!x}i_y^Ui);H6*BJ$Wg-$ep-z z?USofdi5{Qi`=Pkt|5VL>QzGG%@baR|97y}$=8S3ALHUzS6pah5qKSX_d(k62$%@3!%JAG`Kfb8ziq zyC-5k9l=mDpk%K+YV|?GZ{G-&17TH|B(m6qmOUFHtl}*Of@1@x>%~NxZR9FyJVm&d zz45bLW1I%KyzX^j&GtS9`xruXdcc3+=(qp53Jaz9(KpO0b=*NXIJ6^3S{8O7M16l# zdS7h&+xnBbXUuFRQQiN|@{5oA`vlhG>q`Cy3=_PtB+dT?7&Q%j511Ul!NK&uSG*eS z&Y6opNY@XjUcfY65vag}qW&fUE?L?15=5IynKliU_wNOq81PgR&wy`(y(jw!T=+1S z-7SyMT?oGN$2|N%tiZSf+^|vmvwnuNhq}R+JU>{#=On8In;6>DtuYS07j_MF5PQ+H z+3Vfss49TU)K0C$-nsYeoToTWS*q^rK>}cZyGeV7Vvk`gi(T?Uaqc#+j%n#0D36C5X?}m~~%|V%? z=?3gKX(?we&n|y6hcQjzt1o^ZGqvKj!&5F?PP*EwcC?)N1K3po^3-qvM0>o z?CICr?1%$NGrvsXXe3R{T86+qf|mU@%mfS+U|TNQKNxxEicmzeGxS>-(8#Q{=t9|w z`{|@McD7o%c9NcZJ!tx>EFke`QYG5iG;<{X)v^I`fI1^?WjnzYjL}Gr!pw3Y&vO~c zQAGmFr(nmxhHqsa!Q3C%Z`e9oKai7z#dCXbOVwhe{>lDJ!EB~5ZNSTr5^J&w!UQN^ z5j2a!#g`dILwgvq6;5R++?Qz{u`^~y#gC#O+ zFn8hjK%rS?_r?E%q+VqFkE=F=Y|xUxDfa~d@x%`hP>cDLr6|BeG)g7FVwBO&{U{s# zjDG(+M17>QvzcH9KBx1vXOn!mUkk{9A*}4zCbTO51*2`tQtIz#CVE#fEu@~xTVUQc z;ve1u)UP>aXf2cps?FXx_N8uSCUlIbGt9)}IK}=ki2blGa{n0v-p@TSmfNy2_%2GL zxqLc3bxMN}L1og?E8}Mbp*61~@+yJ@U(6yoeT{}{v#b@HGM~K7$l^%KykK`%)hE*O#pvz3dd>BCAl-^6!d@z zZilH9ygdIzBKr6tsnz^LX)F()&Bxbc&y{oV5;%spDG_WW>3}Ntc$hCTzsQx+ktNe( z8&V+2B9&7Nqe{9S*CSG4DBzzNf&tB}lmB2e4OkHKSZIAuzUV}Y9Y8R94K@>!GPBj< z=KQaSma1wn^@^+du?QjO%}}VQDYSPxXi3`eJ_zJPhCJE1E;h1&{U(v}((zXcTBJ*z zkqBkRVzPS%Hw(}^1G>XuDz&TQD3Q$js#m7m(F&AaZCfd`k}B7m7}$r7zWnmkM`2hL z-CbAWmlxun5&{36V1U$!WG*+55JOr~0q(1cW_0lbEf;vP$ma?%L8!V>v{#CSFWUl; ze05bf1xALR54NSY!vyg*cwsgQAI>nkc{}Q8aCW}KFaynfiY^b~vxCuHU44bAkVEII zOpOOdd+dh>l|HzKeFaIHDLZM3AH1H)H~Iy)fFCS zgrdfLw`?X*EyUB-Z^qDkmJAb%6xd{Bf3_uj7!hHUS*_Q?%#24&^hw(`WW9@x0-De1 zcL7z}pp`*vyI{5noI7S>v4_$j$#2ztmh?#Zs;g78%Ih;+(48qCv|_Y}dqnf}CRw!d zbIN+BFQFEO3cyu4Z`#KI-Dw+er@gczy^mJ*-rO31W&O6Blk!1OlyF*pV{Ozk!->23 zRbntML);?D-e^$PvAlEE&NW;wF^o_92nKDcdBW~K$=28%D1rW4fN>?bHX=MCXKX_N zoW^7$T=iM{a)5j zb;O+ju{I9paQmYQ6q3h){D=>BSS2hxHqU)DuB)eQAn_9=E;?p|EmcjmJ!<8>E%HJW zC)-S^WPrttez0-c-!*XMCokkUA|Gtu8xk;1V_@Uh;ay`hb1qw$-J$)dY?Yt=a8P7$ zhByj=O1kQpMT|>#=Dm#BdhPHUGF>-i2%5t1023@V3Bu`r#0lX`UFxYYWlG!R@5AOG zrxh5r22{hwJ6R!-ZI>?k`ZXOG^QV50F^Kb`V}Ra+Xy=V(I5(BUe$-R?W`%JU8aRer zk%e?FG%_WoTu`uW+I4j6sMCDyta95Y;k^yF!{1B#7Z0jsQ;Js@)tL9<-wdpJfc(3i zrw{zw!hiBJzYlI9i_%BAiOv;vAE*G)r)2#to(zYwCjV*)=0bjjBQ^&OL1~Kf-IBNa zbigMOeP#qG1z|3{?~9e1n}h;^$#7~%n82T7OSJXHi_4x84_4xN35NAduxa|(X-7@z zm9W)?NM7qN*+T7<1A3J}<51cg9Nyy41zKQa9U4Ya`zz97GaZI57E0Su-3JiQutd+; zU z>kUj|aHWQz>y@T?S~uPLpQUD6m_4c#8rzfYVu)O)(?BX zvr4^It4IR3EGze4$jd*CKn`mNQ~`gT*0$Oum_D9ErTmp*R~?blwjZZb7|1#ysGZgdtmMxRaft4QFK7bnOpw!tCn*C7iQ;SjB{|!xR|TQ zwMzOT70Ds!F4<%IsfrzcG4s;kKqSk8rUH@JPXjdY?Nu@czXcQ{|9~t*WNEEMfCa2 zHkF~*=Akv29M!feV_qD?T`R1z5IW{56C_h_d@gv}JQP|d0UtH=0V#sEHF_*rFNEzl ziTgm2P2I%)?lQ++gT1Oz>$$@;fON8dK~E}s$Gu$Z(_&mZyDI^u>Oo%&Cj}V%K23MA zPA=?vcbvFww84+d_>*xcvvx1*VC40f?4|2jR7Hrukr{`aJ~g8HvV6O`H5(J=gvS zEUbFDe0nVCZ=Dc522p1SdLlqL7okVBaaAJ;s7sL0aNBFggb3agk9$3Qu;pvw`AX&9 z>r29V_hm(j%o_y5e|+NxRiGpI0yi<$Hvf_w1Ga> z91Ia-N-lKFKW!-mXKPZ%b-FRn%u@Q05JR0MX#`(gGbm& z$_+eDu}Zr}kW?V%VA3mxltVK{2K;wv3Wxc25L~YFkj&q!ehfCttQ@RM{aFezDEP^R zDV6*clQ!e@!oAF4)(XI*p+#DN=xCUtK73=P2LW4Am@+%wewzL^nM~8Nq-Ix!*%hVQ zocow@Wzn>9vj$o2ZNwX6+W?xyi;;6I1-&Ad_HK@AD4y_OP4W8?vA&7v>RhDh(U#eL zhJbghZxYQWI4r|NAO|vtp$B`9%0>DWt&K6B?wr_g4yt_(6*d58yU_f!KNjJJ0-?h- zL)-M`LSrBZw_x60eD|Z@YB-j6&Ds$5GN?X{kMJ{kv+%7HI?l!Mc$|6rK?Ru-K?pjZ zJI1UBZZyK#ZW*}PrBw8GVQgnbrx8iI=nSQaC%jLDF^OXmIeyF!{R5I3l{^vF5B{<) zYyGMYx09R3=nz0V5Ida?b65rMiFvuIaYv)DL?w zI?d{M2OEa|2#mw}b0nsxPndqFyL*|Yl}*C-8LIiZNK$qsh zDAsl#F{2pS#QFAHflV*O#!!ps*q?A3FTS4pOuF+>fC7Lqpo|d`fn|H=D;-Y)iNz;T zG*tjofhr2*9mCnZ*Sha_opfY`tw|X`7-yaM-z?^Yw@8#z11x8 zSDxq5eu8VP5C+-NsGGbh-lgF&X$-s>eDQ33F^)ws%Sk;KT~LOu$5l2;mQE2Z8ue$-n3_t&7*HDBnKo+uSxX)oFoVPjYj-D#XMw z!tg74o+w1>Z^<>y2PL$E*2WPXj+m)fLqH?(7a2f4%6PqazYJn7VS(h7lJ3jRs8~!5 zm4maaEPn#>K%ql{S;rJ;{Oz$JJp&A;%GrUMtT}1ctX8$Y@2;_VZ=glReH<6hi}m?; zN>O>YCxd5Px0FY0q{)2r=)9Mbmmy;Vlzm4IdjxF$Wb9O3eE_(wAR7}1@&HAxGTHOB z*(qQfmto_sW2Tc4m^LXl$T6*9c8)rHL{p&u zjB7<>r|3u_ZA;5yhzGgq{no0JVc1#wP&nC~5=rzp>^c1lsX>t8LJl~F?vd#OoNJKT z>a7uF16NjI^tXD?_zR*qsx(P+*J17MUI>6;|Aqx8-+T~4WYciVdDnsw38QD;;I}?% zMqKG=={#elLpiM+|EIB^+&f7PYl$+C{mF+yWy6RiuzqV5F9?6}6Q<@V?W1L|P^N9Q zM3x*4h)f6g;Fx?Hc%_}%X1GSwVfW3w=0NrS@CkV+PmPnOJ0|Re9DBsQDI9YNkN_Z} zC5cGx9n?xTC7MX)Se!9~KWu#8pN}pL*#x)Zm>Lpo?Y#!s_JGrP}A{9 z5$QC!&$YdeQk92rW>X%T))=!lQdl(m;|EGa-$kp$B%r+j9e!R#@G9mpC@;3}?~NGI zQ@4It(`>{udu463C(Qxdj@-)ht|MT_>6r2$2ACv2O{52kxj7zHytpr*ui|&KPg`yv zAd{)AqnG+b)SmQ6#1*n&VRZxv)~KZh3O=P$=ID=uwM@~`A1+ak$U6mSj6{EE5oTXg zM9rZBA57JRhpLK@9y{JsYFoL*c&biE{(ziKmA~{l`+{@B?p)G|2|%{o(ZOhjo91Yu z{gg*qTTtO0w8m*}saIrCI6Jgd$k1Pv6^$c9woe=~s%*{%`X&R@Y#UkOkeW?{5_r4? z4(>B}`WPb#d|7Ew(SCNbAjtq7Qf_p*dF9{N@?!<}3z6*rY{#Ag0FH(H(ABA!9O#*X)OV&8Wx%At|c@Y z-yfaPZWaq;!AyGR%N9&nMg|03a;FUq!Y-CRCB$T;uB?{=%ui}5NLuf)!oM!HEfWv4 zj~i{#iVQ$Rr3qZJ$>^=CoYso=&C>3;o}AIg`ApzzubbqNFXff4Lq++w(IH|JFnv;> z&(#iabd=m&?}B5LYM}r^5P*Sc*n9(K1i2j3L^*m_>xnNp$#r+MF{P7FvXj$RU%zdl zpc|DtEKs#%>1EDPRx~uq3BMK=E57^pSVJCph!Bc2pz}3mzUrivk{5O-4|v%!wdkH- z%>$?pkPeEG3ly&ve}YoIr*V*KDT!_vFV`V$^CafQLk)?vSuX%c{(Ha8b=s_k(4q}j z5tjxlq4Tap%b7ouRk_)G8jFjsNCrz-KroB%meoq7yi&I*+7<-K=sI$b=u4>{ti9<} z>xbH8chp5}OO6Mf@mK0@9n6uWw2G2YwwwFiZmpk_m!Kxf@f~H=siInow3L^jGO`++ z5$Ct=rpsmKe9i#2Q)?>Ff?o6ntwAXwKg#8>J3&4@%)!EwPn>f7w{4mwl^)$&1_V2H zd%DS)$FJm@Qj2p?lhCA=uA6qB3x#YYt()zGw^F|t5jOrXV03Ep)6mcpCKMU39uZI; zKJO}0M&Cy0vbB;%CLMRkdFgva>{x&3Mn~HJdH(%!FH!=4k#J+j2*GA8?=`~DVWT1R{Z1yxLanrzRplV{JLjpymMA}D6}bKU%uJulrf@j`Hb@&%XGmg=dH-nzlm=CX*jhbF$Dm_YF$*IOR~%Rv)c2e2inIPM zoleOTd0}Mul}3B6UFHMVNEW}BFh_(Wr}j1v6`n^;y9F9fD*oF<0^erY&ErCvjm(Rn zc!$CkNfizQ+Bm8&wfl+H5$OWr8ZhPr^ch47oTNbwk8hRyQvppUK86RKA|DAp!Loc_%}f7 zS)6!kWq12<{z__#?>~6l9QE$h`Pm#nC|gDyr}5hviyP^6u=)9UPWu6VZXHPY?`0${ z>;;$^z{1S@k8S!NDQS&%d+e`vr0FlT_kgn_U!XvcUwXg(*(;|U2xB@p?!a;0USu09 z$B5T!j7KnGNn1RYbn7CQ&SsN%BOWQ_^>VtRq{GYV_!okD%YJstR(t(&{{dII#Ttd- z_mAy4zl(L7Zz(F!&z8;}zU!J0g#fzE5_RWp3ENfjKVp#Wr9X9#enGS6ncoLT!j>sw z}zsgZ*)9F+z$a8S|-X=`)ld^)q2_Pq<|Wk3h*qI9gJG~6wV+wBg;2W%^D1pt@`sRzyY3nd!Y#R zk3mKeq`@sI2;;pbG^3!MHI~9z+T-waK5*I3bjd7r_wK^SRr=u25V9$*#+1+`eB#SI zGA?-VX?QbDV(Ro5#=}2$D+vlRT?3u46VxrLSS>S|z2MBuY=TAVYqBe#nF*vtoM&gfht zPpvz2o-(W(u5q8+$|_axHo)u@@0`;MkJFJ3CvvE|0Gsn7CofDEgu1$K4TB*=FqzhLp_zKVZ%7#ppL0W-;m zP@z=8J!Lq@NlY?P5?pB;V+}Mz%X4f9 zmWj6>)6v%O0NM{r&Hu1hvHqkO&BG{Jq~8N zS@FQWwcO-ViOF#>1a=xwEg$VjOGn=xg@lEpY{*PlQ)M&`ov75ZS6% zUubS>nmpJK)x1dY1~ZOsj9Xh~f89c?x7S(pjh#1u!4u*iqXy&HH5sRdazpH3xYP@q zYHpkZ?<3Br-xS`LgpjT5V?ppotzFTQ`5TDmytUbr4j8|%tFb2YjOMiQ3-k96X_-}A zCLhr{;Y>ydm}q;^w6YVxp;g;%)8*{a=anG9ATqA;g`O<1S?J^r{P&QSXF%J+`nDIL z=~>k$qozlort2?6TSQThK7gJguMXI=zGQxgdM-J0&dz9?ZCK-5L4SF6Hph3Lb5KK& z4eS@@0i?r(FKyBgOCwa=WdniGK|Gg@4f`w*#Ts%2@rP606G{e<1q00-a1h51qy*AI zZ4bu~xP_~G7*VZ5G{hBpPzyT*L&GIC=8WaLkj9pLMK%z&+qVotbC#njR zgava6w19>UH(~GcX@G;(>nB>A74NtFvlAU70PN9Bt&943sW5hNp1w#pb(RdnbOm5o z@omLhgu@>Wg#AEKI_k6&`}(Y1h*8(Pq+*Kb(beSxCRs0IiLa-u;GPZP4b`;yvO!|2 z=G=^1a6G?bEr(c)uiFW$H6Vv=*dct-r~ISsPfRy3kca5~-zVPI?~*aIrVz!gZ7B@> z0f>)w9c_5$wK!W|ax3ldBNd=}1{;dMNhr;*t4H7D!J=;EolE-c>XP$K@o5BUN+7zy zw?>`APc?T&)|2`unO$|el@Y;TCD6}sc$zG^6%{Q}1+6=Vt8&HUg=D);{@dUs%P z9|5ALcMb%rafK8g4glbx_F14E24k{u0n>&OX zji|hs=_}B*6{kx-QaI4$K~0VH>rJAhzA4nHQ0-{KnI9Nry$-EbkICe?doA?!1vSyY zMSCx-e&hPDhq07EpN-@BFZBd1d8ZW80$Dt?e)0UQpQ z!KIYV!_%IK7$#mmg3CU9E=&vzFfy;O*9;!tQVQwT$BnuU%jhX4t#I z1)h)vlH=@?;6?#=fm12#OW_jTUhX6@oF{o5_QP%{>oToTNL;TVk!x=r0m{WSZpCmm z+~Zu-w=c2c37aiW(;;>ose*#t;Z1z-uV$-ty9~$YvH#ZGsLvF0cR%7isZFSQ=?zqk z#Ca?~F4Gk%p>zt9=}bTIx)jRmuNWiavf>&Q)Z_Pua4*;YWfg0&b{5nNF-=G~!LJ8z z9@g``(9m$%uF_?RgjHtM1~5Rl7C7nHY{v?A@t%XtlXeH0(0iG zSzowv#&e&h9#rePR&fXDuqyTL^kdQc>z{f+Ml38)Brtm`K(^0#*35de!1nA|wbZq&C zrnabtt^c;gj!%Q!=^6YqD3*B{_ zID09F1qd^5$RiAi@=jluMWe3f#CHm4MCETsIH{o99(Em_T`(YV1f-8APqw!v|Dpe` zc1`1u7gfWqdWgKzQdh6($4h8wIkz_1bBESh8%(avom}P{1@r*rA`lo=c_{2)!mIvW zRFHWR&6Z|AeA0F`cCUnP-{PftN2&BKlEX!4GP8A$R*hnPI_zMYjrEg0L!R}uewPwe z#Gs+n&?9cs)g6_*6rPVE^1xohORk|h*km)|N#by7t63BBLKyF~^D~Y+r$&bC^!4KytD#-Mq2o{>9GJC6|? z!lVpksUax`%JobbpCGVATxw7aUyM@f`I5y+#aQAV)+Ik~$s>~AB%)ZXk|LOM)#UUCj(7j-Ur%+r9U0SR8 zQ^EQortZnwOP_g$7wa$OvkM2lX~$yvXOY=Y(PWVxge`|S448{oejsvpp%NP{SZg`1 zxzeo0j*^GV@&H0h^#`J+k$^m2O~1}HdxnDD3~<8EyTb8Z_|@L4IEOZgRD_N@Iv<2O z({*)&Z{}LQvA9{cpwAGI4HFe}$w4*FN~e~tlNll=ZXTk`lRzKM?WaMPbD=%+oQ ziU8B=C*G;F;C}BPXwEsLirXlBOS3Jd5#UZkmOD2$jY+%^J7deOSTnWO7WQ6@g)$hL z2jHw0egX8*@x+U`$5=Jl0^K=B+&6F%ecV3PqiP|0wkR)e>)=({V4?0Shwz`xd4pnh zf@WQ|(tXy;8GV>5TJUXo$6U6t&dqhe#l-U^_r(xd?9k>#<7|35XrAD>Cz@<^MpIQJ zy{O)B9EvMi|5dy*F)c=OCKM^!eQ~d?P1z_f4`v15h z>AL?{YgRu*7$P}0l>Sexc?PH{>-jR0-YGW6jyvkC6aX-ZNS2VCIoR4K=4hak_KEnE zIM4p(?3Ww{IA}duW(*z?QQ<(geF256|B3i-Xl9wui$s#1Ma6JN1~N z#d;a#?0H%qnxDCr1F=&2$mLE)=A>HwD9?asz*{Q zjMv=Ar$m=A)n&)kl1|r6v-$4!*{*hf7qzC{In9ij(@BucB+_n`kTy!vmnMjqCH0Ie z0bc>ZGg$PEVt>)5jWu_zy{IT1>j5DB6Z?l4rk%oCh{~GJvME2gKVA{_s?glvebY4Z zut*$alOdrPiY5tZ7kJ_K!iS>pqji$E*aM%+iVJBe_u$4D0AN7x%Fn8!>TAAf)T(RQ zINVZ*)aPXQQPgN>DNdf~hGKXSrN7QhCS5{4el~Lym8DB2%5z-EJnMgBg9m^rC8M2O zazq-M#n^~4ZN)0vrRteI*gl!Wcg4^WfB{PvM)`|-U@ZV%GjtJfR#%r`WNJ4jOOMRe$-|Uk(7qxW);FL)7Xkk-A;0yO^n1Bt6J0fN5e`UyR}0zUh#L zVp^w*KQNdZYR9mh>NdIi)l}+n1kS`FYXf0+9?76xOZuZZP@9S{49f% zhL}I7JMY0}rx~M@x1aE)gu7M%^J=pNAIbwgT3WJ*syxFoCRx3?TT!F}%l;Q}phH31mzCKmY~HpP23*=m2v&htbX~mrnx~w$TEc;(wL^#1 zP?ZeK;Q2YE4?KVzGk0dl{$OM{N5=NzJ=%K{z?+`qhNZ^`3_+0^Vmd+k`?Nn%V`zNciHTeYI&pJ^DTJnWl1JpNO$86!FJWQk;KdjCj{@jTkZHFjJy?;LZJ0U>m8B>88@7w)J7j^II<%mn-U-xubq?=^7uKI6 zXe_vHWgO&PN+$$Xuq8?J_`4{lXctdmRVJKgkQJ>iWHN;JL)r=0!@wAC1_#`oWJ@mW z0UEh_91bwKL!k1I^=18tDd3g*bI2@$NY3KHc8lzrcGNU6MVYpNUFWSrQmjj%L9m)y zLA&h+LGBRs`g79@Yxms-qQyct!T`d94Y8^|Jy)-SDtpnNPdVx!dqm z8$GHn#ogx~d#?E_7&9Pz$~Qjx)swm4G5JqXyENc6sZ}F15V|d>XwK(|RrKR!T}*Fu zpWQAYoJjkJda}%>SCs1%-hhT$NmH#g*gI??s$y&)zuKr3E#GDe$J+L_bwDRcH@Yx7 z{l;KfiN{xs0IRNNmZRxjbF|&J;8AD7pO<|s(GCs!35vBrnfFN=s1xWXCIxjObedTI_fMfxV&qk+Og-~_614SL7=&^gjv7eZ zo8p+SJiBkVuD?Nx4xNJy0qR3m9|q*3%OO#J*pKoL%D{jZC8EEkxZck&HD_Y;1U4hH z#4BfcsaWtV&#ridJiV!DRbW?ohao14&TEm70~)$HwR%t3HpQ-0^D#Qw6Ga0cMQPdj;1hz2c$QfNgNo&L9F+)pw{rQg^WGx$aJwp7Do5o- z({OijI{8D-91-4?U7ZL%rPtN+stEw1JRL4&i&WK9?J3(nwSrMAlI)!>^0_u1HFP7- z&rrt5RfSR-yPuAJar&C5XO2rsSeI*NK7mAW{6Y}a)t8t-`C6Z6V#OnwQ4gz+g93yA zBF*@G9W)(0F=l^O)8ehSuw|j)D5YoIjtSV7cGIvTfu&fP@nfprPRq8gfC20tN$jF- z_#k*_MQzr*?}vQIHQynB%bFoCiIW~@YQ^v}42e`zr$+AKcSybEbm}4Tcl%eQK&X{k zT4#oThq6s;A))oCxH!y^4-25h&*418=%$oe=HPfIFyfV~D^2z<)w5qK>LbK~t#QXM zSKspOMAQn@&FHdwTI-8BP60$1+PdSVoGco71HQHdE84ld5?2kLFat(Y`l=K>;fe;V z9nFQwqKZO`7m2a3Tl7%<-h-MbLx2a)u`3$K8UD*Fz0clSpw|*@-53ZJT_G# zZ!R-a(+S3w-=u6D?i;~^6^GrJFyQOHE!P-Ci58^sRH)DFm)pQr^i;O{_GtqVM?OO1 zeDwp1ZK#Cn_EcpA;f??)eWv%m&>LbYWc$AzsN zWH5If$*?_By^wWV=m3B>DC3@Y-jtMzb+>IHWVb36T_@pCcweCtG|rQJctx1FB0^D$ZtFQ*_cI9QENgk1#2js~fPS zBS`RWv;&UR{)(zVGD7p`WWVE6Gs3Zn|ANO!TxwUpURW(fOa~kcItdNH$ptOH}1gJrkfn*`6w2eY}?Qbp`r>t{-NwXqW8cqwE?4jW4JJ$*=Tlq_mGqF$$ z)eMDjz7O9VWX(o6*uhJi_ zydvmr-0XheQ-I!fdR(O~Ab|YqaC82jKw(*Xvi9M>{X&kSy0kEmjg)inbKA}4>MjY{ zYuhg9ELlB%u0B7dA+Xzd7mfx zSvUN?{}BHuEP-e_PR!pcdmv^i1Mr06>4&%f2!DVoB$2(;tNq&_;E&etq7eUK!0)eJ zYp+!IAIG*Rm4#j~Ly;|d2U+_{f!mDTN0wxG`^wv@?sbW_9$p+`ZG2hPRjCXYSLLH^@(C%R=&17025wZYN z#C|EaLl`N8giU;dn@GBV6^un5F|B(+noacGia-JJ$>9ue>6Z z-$Q=V6*ywspo;6Qwcg=gsMM$wzGO40s|Y9|ChsNCeJbs3>6_!T#*Q>~@6{fm(=DBv z9YBD_x9F3CTFMb^LD7RLRm2vT2MAt_l|2)J7P?CO2`DAbRBTeOdvIPzWyHv}UV+B? zSuv!|)hZ?d$s*T?{NbH9>cr_gcyL*HD#a~I8d5#x5C6*zeVTZey4|NGM?}fX3k5)2 zCWFtQmcH=uoA;=3X@AuQrX55hv;_Q`#ib`n@x;d~xW637Gxbsf%GDfv=C4wuhIZpz=-WOe zH~5KL+U)-mIvT6!)%W->k%zdJj0Ft*9P?%W;`?lcwWiS+y;b(&&Hc0iJ}_z05Bgxq zX8Ees{ym$CUeuzzCo{d#R2rvYY+n0CTZFSxNCSEe9Ym$SmBKv**QGw~wtm?}FY=-w z2wXtdt}Bv*4^0;NatXViL`@$AtN;>62SjGa+T`mwEl0{!&j=~^z7dT6Oa{nb_Iy4r zM_}L|f{PrZ6fHiC>p;{#bdmUJ0cyj4L9AZe%DpK`p#Yd!}of%(&@xw^#x+ zlU=wOaYPFw?DDg5$N;b5^0DA%cF*=laL7LCml}Vgg&{&fFoDDnXksy-qp>NtFsc#7 zWCvsrey-5abk>ptIIQRP(xjl-?jD&1o=M4cvykUzn~@u2xg=T+%WL;of+aOg)Nu)e zRm~9xm~(2J;R}eoFEw)lSXETAgfu|XUJAMXFoXA`iY_LM`UCJ1J}wufh5{pT^h`3G zbJf`22vZ`+?Po?J^wtv3Q&U)5XsW-_$WmG11R$Ab*)_gea7 z#}Hz#yM7nslqHmaS8tya8*pNN8hcf?V5*8BAN+a2H3SWbk{V`4iNen{TdwP%a)X6u zluC9O;2Q7|djhR#s)Mb-o$>}N+&oA{a{4E;kR!6q5M+vV*=6z%D&-e}T_c0|E zA|p%IEx1XWKSNA0p|7PxeBakdBu|a|cdQJGJUUY$^M;4qz_$!jFy>k0Lwg;AwWY{m z1ye9_lbCy(SoVmQb!MB6naW=N=fe6D4UkG~hEj%S4&N5ns)KYRKDcLF6YJk`bUO9Q? zDP7A(y#s)rNzLrhO*u@Ml2}0slK1Epg~&C>w)tBLQLj+*b0EnjyI)J85j z9@r2}TP4~DLhoMg!Sk?e+WWQ23K~6DDsxGTI!JaR9mB)W^{r;)e8D1LMd4BI(%{NV zd^G1k&X8DJORp}NQu2c-Qn8GNqHqa7lH2`MUc! zC^RIeB`2+%cdnY%D#;I*PHER{n|7dZ!_$pSXELQMF%u+A(MhJ|Rk?WcN4GHLHj|GD z>9Bxcj*&?yhNWwh5$dRN+!mXBGR`91WM;=UopD7^eNf|Cp_)`V!OJRK|_V< zuU4lZ%EC1N$YNz;kFuD0KCn^zGT9LSq6PSApN8~iF{XGAzteb2nf3^#U}ZvBxSOTj;Qd~3I)^a^G@^$baLi-Th^e;#{|eL zFLSNGXL@$hQt-A=F4-@4fnr;UpM@(YtJ+XwSih2$PK!o!cyX_fcWo|Oe(mz`y#8Kj2DM_uAGB5K+CcT5o)lH$v# zHk(kcLO>HO{~iVNM1-JcFUkIhWQEMK)s!p)`ed`0ySE|bldd*4wiK3yV4bD7WIQv> z`}dh-15P;;N6rVUE>$cKrUz?VQjH%lzCXnF z<4N&sGRg2B7vxgWZ8y3&ua46n;6gL*S6H9+8+$+M@@sI21RNPb?o`+`z`iDA43P}B zp@%VFCbo_w%Ckk27*9k*A&Ay39lNru@7*%41%~5_8d`Xr7rItHL`nIG$KKHMoi7V~ z!hT4B?C%^$wHh(@4$s@^IK03#5Zh&U&_UPeGWuUtQScQGdmCPtP0%Bn!tL2eM)|2* z&ji*w)u=_YCl-?MVecGF8#j4BxB5619587$*#9O-uK!yRUDlS4JNSs*k zpGCWM?d$=={ea@-P5tGo?By&DFpuJ3)*f=^n?;|WacBn8Z-Bn|@kL+{$aZ#2+47Bw zqfyx%@kKqU@0cz7@QzyDKmPsfg{1UH@$b#;1=!BM#2H0bS;943#iztsUS<{4!+*&5 zgSWb8y5GUGRnGvemlJf$A?+8JcHN)1?^Vh147w3+@?yMN^#rjn!vt~;o-MVPx9D90 zM7{5a4|?IdkJSjt&eJmhe?~#5qx;un@o~nPXz2w&9+2mEZEooN{drY(e$Tuym+UTKDF};oblgv=?6MpDe{_s8|!jc?VUb5|M;wM+YAE`{$Es`Q+p-~)2w6L zww+AOiEZ1qohLRXwr$(CC$=ZHwX;t4^}Ti!>&_+bYEX53z z1oAz?Ik&z zwYuT9a`lfy31ef%F{P`)Y!{NJ=HW=pABFSvEtdH92v?ABb26?b zBRemrLs;9X#527_wDH@_FfUYvH&Q_~m@^98B&GENqs?_hm)%=c;6$PJ!jG#}oC6^1 z!qIB}sqL4#!VIUxPGNKKdUPKz3k$r(1AOHog-A(-6o^od$^Cw{jke7ur*-Gg?7k26 zX4IPBhyTOMqB0*s03`r0<-V+YJ+PDTYoc|`T zyhzAlv&~;6v8}f?O+$9rZc28u(0=lx1YTVir#_)Nx=@o|yym37^_{=|4!d{Y1c0Xe zfzUN4aNdXN+4a;XCbmozTq-nR5Q@4i~9>!1pYpXJtzAS!5q%|RcN&)xn8L(eG7f&mAys2FPJ z&m09XR}`WbmHDkhF;#G2bnwTX8NO|m)$|CeU<&^l?2!NCD3Qsw?3$Pm1|WM8?7@7n zs=gmW-#I-;eIbG@#G1l`8;q`>U>)Y{VZ&yo28&Vw0Ug?8iMeY*#Ug`sl&Fxg__c!W zFgE8Pa*$DAGi8#lHsCcsw&p39rpUQ}^{_^HwvRw6spsH>+N7pMO6oV$hCeg@>kp0n zZ48eISBx7I8>(rT)^L*oCji2ZCAE70E->X^sHaMgrrn>1W3fn-P?emP34y-yA$uJO zMb)d|q;Y$Ha{`T^6=)%XzyKp_NlLDJ+11bT*}wn2->LvuhBuh?ft_4kLJh>k)sX8pNGS7TU# zF+y7mr7deoQ(}@o0cv1<;sxYZZAsEcs#E^t`}2#l+IISsJDu;{7v35EQ_T^#lonR z{v54b5Os>LP-ADtYAG2?)nE#j!l=8zyj!(zq0R%Q(qYraBh*$g^g6j{8pI?wryZWD zo|a8x7|t^7!wKKw)3ivJ zms4o=6;O5?@kG>X9$C2)#4*^k&Ek(b6mD$fA|IXU6_=40)`&j^-k0PTE4blRy|C>) zvh{-)p^LvY3kwJMMONlP6;*Og=I)3+*reqB(38Ia7ZD4x2n}I^Mm-MUbRNfB!=KX_ zrW=9vMEPSVm`hc$2X==~wabhH7A+$h7kc7o8TqsL#YoSfy z%K0l*rAQ6>4SKXG-BHn7W4pcP)Lk(Q3RFT`8|hPhXUkbgrbIFs7OM+u7J0*tLnE-Q zDSN&F@(<8pReB}TyPH1AEi1{eKN%Wkp{%0^PvA@mL%vLJWUH}>tufY?>>Ph5YRLjqN!pnJ!jNGvv<^@@O0&|>ZH&W&s@A62&=p2(oWme9tFu(mBt?FITm{KGyonoS_xt#d`ZP&w|2-fjQvrSBr zX~jJt%MB^F@<>0$rTG@eu~4RB=s6lr%1vZScg-(1B9BpOzHnJp{viQ_LQUi3R_orv zz<7#4pp;f}SRj{Q1pCTxc-$+ZVI z_)09q%$KaQ({!93qTE23M-y^RWG;dvfMI)msQg2Ce9G7+AoZwCyCxe5#QDl$kdp_!8?T-a~ze3#fQv9vhI!=l+N=!XYh zgo5HLkeZd>;{?RoTYaU-D58!4F)G`cS6Br)&($sVY-|xTRYMGtIQ3IgrNs(7bEF7ddhRN7v0Ug_ zbj#x>hSyT?u0hZL>P6)3=Mq9yTT(l&ccwNIdOtV8w2YTsDM%ta$H_GaSVfM0PHsDw zmTT`+$UR^Yek{8=uvW5V#$+&vfoP-saW4ES?fjH?VH9&X{zF)8v0I%@c*edX@V(ay zNN0A3)67B1z`vh<~&Ewo81V9}{dT{_(b^OX~@st^Yq5SZ8dk372C9|4EpJPxbv?~MsqN<*$yvL zx^&ee?kH7(@(W9E2#+-vYXFuC-42d1Y>Y+^;*JNu#|R3w1aRIRZ&^pgXK!4wzh7Th zs&#+KC*o(zHg*$y`I*<;=L%%P#XRftkWA%ue3Jn}t%NS0^|{xc zMc_$%zTKanuTC&qhEYVLu|bv`6;nD5tDo-iUK{<~DjP1Mx}5OP;s+0Qc{T`FruT$b zi^7a8_JK`jS7pGi?x-)l4hO2-YnE3>*wVMJCI!;@9aW1Z~W<_S&Nrz(VzEZ%1LXM{NKDszD_Tz@L})}Zq9M8k$8f)VpG^45SMxEieRR|h)Hz!n5{j)K z&+%eGJ!^I{taSlKau#A5uYNUqFQeATu&V!Rn2P}N#;iD0+Rufn_A~<+@erm9(i}0g zJUnfSOEyaO!S>@s-SU~&66FpHCq3|snt>1uq0o31?!={XNk(6>Qp=`$AlUA z{SAzTPY^wmlzGc9t@4NCpFqkG&~n2HZmR6JMXwIn`; z##kwjYi0Gr`&p)zs{z!+^gtve+0wt^=fBMjU94p;L4G?vEOsbt1cZcNp-`FXCd)}O z8>QgRZq#xCs6xg*Vr75iTz4X6p5ie#sGip6biK$PEyiYx*-V! zMBifZDzh!>wz(r@EfQ2vf%Rz2o`f52>r$x;Ej0A8+EpP!RZ>+k82W6{} zz|rOd9QjIFY-OPi|DuoWh^C|Ye>qL`FexDELSscvk6DT7XJ;YE7~R12!iA60=9EQG z&UzQ2ZJx78$#1|YTx0OfYR`~;V5xPYz3YbELu*GK?sEjccl%;&R}Bou{K{2Os6Vvy zx92BybZzPd0w-XRDsPYE<46SgLjemD5O=EvNa2NdOX`JhENt(DX{;yD+3{aSqx<2J&!d<(v)_z>cS>j*BW>r|&qvsd5!>{;6|fEsM#mTE|*y zdS*N?(`44LmC?~Z1ZC*qifaX=TtMa^OD=}&p4;FMy)gO0#)-idw;AtH8G&zK)IlzY zlIjoJwXmmS0JJ41WHR;2kclvhjFnLCG?+J(80WB1VmA1+;3PXjzFTK-?>kE%KxDjw z#mZ6z8V4O@aC??iJkt?<7vt#yZXlWdU=&a#;-nx5O7a4>ejM3*zs<2cEa)GcXux8A zVwC->IR8ReFhEzz^Smm|NG67`&%rjqR)q)7e~VU5ZqtapumBgKQ1OqT?DLYG1yqI< z)W5-fCgohAeU^|{I)_py4+BglfIW&QqbkYm7HyD60hJ=7DFhy+*L3qw~m7O7B0c&oQCT;je?2B$3}pzS^Z)27tYmtN&1`C>)r*>8wiXZBS$<@&GS60YmqGxi<+(R^XY zH?(`0T(H{Vui)ZQD~+vWK)a(tgPmkg{;D=~qJbH+--6 zsh5ydy-i%bEu0W~!D9GeZlUF0vpS18spFGV#6|KlxY+HgzdUa`fGbhY1DjF*^e6EN zWa9FoF!ZpFG&M?I#}Ss3=8yT;H0YrA)?cLr+6@u+SI@Gk7aIg!0h8Ar;G2n%sVqD8$w6Fnte_uHI$i)c8pR-2U% zt3%;2rXS2j$BLE9dSNcuIn>Jo zFS~sv9Fu%=4}sCn4NBxRcsPg!N@I2ri1KiY#DFxUp5dwobWOPEkt{?J*;T+Ct>$?G zQ456+$PzOsS_l{{MQ2xs1J?3ql*PaLcnEA5Doh^>v#91jYt$Dr>I8c)me7!`e32z3 z3n02n&Fs6u(8fE@){uM!YRtW_bsn(g)pPi&DLvw~rPEors^lU){O~CX!`$pnnd;s1 z^^R^&F7!{N4XX%>Ymo!JmqxV}=Pu?Fd#*8qqV*r6LJ(%e8LQPol_DS3E21!>;S!4T zm6lN9T76d@OSs5Wx^LizU&_8ltUbS95x>DRGI$45d6@rOD7pS;p5RpR+z z?jsub4=kvPf=*gjH)B@lN@9c2C0OBysg;2c!!Y1Z}L$t52*_(}<$@uW;Fe_#DFm@yp7jB@T>;56ZugBM$Q-vui?3Nwx5@ub!H1pCn)`J#z-lWB5 z;f!4v=QHQ10!;|-_D(6Snmezsf64!nxDZ}!wUdZ+Sl+^ispkf7RT$0(B^wO<2 zwg*^|`PQA~)+L$9EL!o$}IL6$|-oeY4kUedI<^r;4W_kgUpl*Vl%n;7`x`wP983O+&rCwHj?V;Cuk$sDuk z2y=p78&es5CAs)EN?Iy=@Ta$KvQ$MhO|7RfkE-RTR`uJApT_pP#q#+|(;8e4rzsE& zAxo4jfb}^;ID+C*04iC+{HX)u`=r{naHi9`#7-pO_}E5-yRjAE|R(d zgXMKS%bQg2LO<*|sc|>b7y}j@+cTv~ZpXA}Zvh(ot`I-62m2JMix! zagBm(2&=Lgp_XPZoFuxE7{s*VEL!bA^hfu8A{T`@9Ie9=5GjH%?ZugglSeivM^$p| zu&SsEtW>g7(u4^~2r8ug^)N=_(uF&IREG?{36;`6Jd>790@G<5a#wi7ZSoMa5tiNl z@V@Q2I;`LXfWxX-;l*4ZZ)QxhR(YH_DYk6Xa2O1$1hj+>)4CC@v{|l5sOXXCDEUO; z27;xqYdA%S(&QFBy0KGSNzC93XuQV`et5Bf$XU#{gqWp$I0GlFSaUmbh&MUjN0@e&C_(rDNyI8Tap9)-SEQjc08IwDOwy}zNbV|Kz-XFUhe=2NzO>Xm? z@OTIR3OS|$_lA}8jC~ULP#*KyS&~#tSLFgA3-{RTNV2eh;&D}#-ue^}HTbVISyza^ z z7`ylK7vxCre&up*+^8AuvUXrrWm{F*5{KF|q`BbUe%VO@u`kDJ2m^P+5HUjZs13SC z*DlbOX8q$*qMhJ68WNggw0;W~do|A3E&QT*{FlUtQ2GO(=sa`qfn%vaGL2ad<8U^) z0SZ~(Ey~|f5C0vLH4_@X{(A74>p2Lk7SgmZ%c#G%Xo~2k!lLGcKIJ<2|qwXAB5bMey>50)K@+You zi`EyRv$D|@=*|7BbfL|zCoAjDuX8g8F_3E4Z%l0pN3xl-;NP?6;DooW%-L5Z1&)&5 zid)kQ-K|zX$1eff9U1ZvS&HJ@1gKcY9W%mJ+mBGXhQ_RYr=~ugwW`ipSh>|*@1sLE z5XrqkpLtb^;7w>wUI9PJ?BpOGIY-!jqM3HRs+^qkVU%q&@m%BwjthjUxH41qb%Q^@XEA8%RMP@lHUt$z^qQ^5TyIJiWdEx zVlOvKs2Iypifc@Go$oUK+B}ofglUo|TVaMrI36O5s^ZTbdBuF3dk@uz`dvF z-cY-K8wYU_6zU9lG75uZ1vGLP5ywOJ65MgZ$_pm)4B_#TmZ=)>RR)BVg;~+#bgJh2 zJH5N=#+ltuRvxwoi%{$$ z;GCA@>-$Y614jGpY-z-fs1*FF?*zKm@b+%Iyu@RinwL@nZTfY(HuzZQ1Z;L|2xTVD ztlA`nw$Lg=ve_0{dxRw0pYj4sYX$&iwa6lGy3HSvU)Lks!RDk=SHq${&4zV153oD zL0U4Z_!F%?`P?Q|xLb$(nW(=66SoN~gm3Vd^6A#i6OEE>zSWoV8!!hgC~)a&#**Yu z&P0;GEs2e~Q@#};Qw9+**~Xiz&7Lf2B3ypmUj^>He#lA90cOYb-4z*BzHl4T!c=W% zY>!w`sqx|<=(^i;EUhh}s9hSxZdW1X(d$v8QwS;TV&OS(BZbWt1vI0pgUNW$1{bpB zW4Hb4+?MN=1HxSSzMw}=tBifvw=`3G%~qFLCGf^}+0kuZ1|e+)GEXM*9@a$EVbiWZ z6~#&`EpcMtDPGLbqvcYwH2ZXy+}uC3V>6SD&=f-c`kWs!a%Y?~0^U&*>zHIx{dqxn z0383bsvc=g*8BhrTPL&+pk^9m!;l6R%zY;Q7ZmNCM6mkOGZc+!+lSA}KA6-K%dYYX zz=5IK>L`-&rFx~2S$^3D`!D|i42AfOb{*e=h<*b*0&XjW{3QZkmO1{vM)73`<4!?- zC2q;CGgH0sODmaObJGWtVr2udmw^Ny+IdM<^k! zy_WF5+^kW~1M_<=d)EZDxk%jKFOE(>r0bN}Ok1Zh)u5;9*1`M$G9kA6`PQa7Hy5*se{wB-E1s>1kk zcVZ!HL#2|611=M2BqWYK4E=^q;vdl8-9#XqK!I^*Eh35EDaBj&aIiGE z_$|A+y<0A5elb#Z)d;Or zLYk2hL<%c-Ay~RZR(HbUG0`|DqlgIX(eoDIH3OllbifO4#KMvn>PImfu(4IRVbhiG zWV9Eb0N`|I)y3=PcpGOn4Wu@gjuOqMSZovyVWigG?x|lX{*LzZ8hrLN82#fodr+8s>6kbdrkY|HqxU) z%Y$o%`Aps#-oRv;Tx13!3^Dyn1LB~bgbN)+0}!|1RAhx7ef|seC#vmj{#|Tuo>w3ZQrOz;5uovc z;5-QzO7`6)>5?9=;ceaM@cV)Kt&)vYIch7Sa|kLECBKa1DOB4%0}aF9EcwN=-5Sw^e}D# zQhDUvdTncHZEMDo-EKV}qfsg?z5xbd$R1O0;z1WOuI^iK>g8T8>b8NWp zl^2QUcT|Uwc=r@|&(_%qXx5OSJCL)u`R7)vsxCHAfceYfZ-(+BfjlZ)wa|nkz+IVEzk>2H6_;QVHT^4v9=`}I0iQIiw0V{w3munUo* zUMvjIAzXXWzN&-VTIHQkF}c9$fF;2c7X!JZAVgVS13H_>P+iOOHg=Ex8JVaL(OT>} zbG8;<$3myyMbw=VJO%QySu@Dl9G2OV_H!2O9^EM8eI)A1ZA6te6ynb-_{e}#*OkSv zz~7a91?q^*f=Iq$Mnd7e@YF{I#+ABJQxF+G-f2@p!OawaQR;{ANGH`afPbgbu`F!` zi?OcLoN}2|zkjB?LNT9wVMRs4mQ$I%)of&kZTg@)yxYuW=JIV=~k>uEk3q(-lcx>g034&neOCWvL&di{vSrAXlb^Uq(}^bXWg=Y-A7()nE4cqIwEcvFfI@) zUl5OL498>Rg$ktGlom(MqXzUyR<3v6@wOyboc1IXYbtMzeNaiJuxS8_1qZaQ&Y5@k6ifI|xjKYr4pD(sn*)uXCvRj8c?NNr-pV&f=-~`@LA& zg{84Gb~4qW#>W%m3ma_l`Ud%@8`e_CoLVBvFASZp&FNtd5QGDkB*cSc1|*dxDy(fa zhBrZfYO2l8Q%rQmq>giy>#^BRg5(Aej|ShKLP4G8MK~M5K*b_ z!d*}yb*~6QFlV3s&X-#e_)wF!O~AI4MXf(xV^LfhzWEW8`r6Abm2|b;!5kAARD8W~ zWxKCDQMp3^<}=DP-8?k|lE--3)#X090dQRRm84ekG!c!cQynOO(ARRjT%0N=k3Th2 zLu%A0((f6QFq@HH>P)(wohB;Eahklvjoe|X=htlt9g0ur4!;y&YC9bdg5VCa&%C+( z=g@X&%m2wM`m8WC6eC-;rn!07GLhbeIF(tB(Xspmkc17UNv4&aJUN*wM)DTXy`#(J zC!5~Hl9u8(rovK(XzvTeO^`F?Hrem`zJ49fd0SjEzu zoo*Pv&H1&^$gEF!F)y}m00iWvsGVDAd^2YoF?NW3vy|R)_*WjDL2IVTefM7nH4?>6 zFJrj@|4^fwaQks%W$ZOtW12P=9T3v(@bekpxIUeE`-Oe^-Y_r0RFhva=4xtC1Et9k=}$z9_EZ$HwF5 zhhcMm%yzJy#o#2W59O9%@^4_81djQQ?Kv6CDJ@l?9IaI#b$2BFwI{;o%{{qAzYJLA zVeU~<0YL&-#Fy-G03U)mYp!Qxm3kXWrJz>25?FBso}OYf;-QNvPGxul*ZkJKxT+>a z7kIBAE^6*6edV59OD@^6M?z@5D$0YsK<;n=<(1& zMokf`N@!|~P5vWvtw);4kGE>ij6+Jx2Y7Vut*t$2_PUa=J3f zHi)v~@v*HJ02nI+u&KSW_yACAogZsNzzow{$WwBbnBweehNa%2M@2oFSV^RvxEK3g zbDLS>Hbfd%qX|`PeRWqN2&4h`f=ueiI5EZr%(Bsi)`6woY$U`xwbA`Q@{UZGS#)E& zk9?+S2cr?+lK?Pr^dSY-Rw(>qn_#;OkUO{HQKTfn=^CdT2@8o zA8LCH&Q0CptH-{rYY)Wk^d4vEab};VeA%=hir|uT|i6g29%v z$G_6RI~@heWC1kE{R8!heTtT;k+`O@AXK!7@-Q$um9%m=QWUKFm*w77fwzY28+>R} zo~qeU04f%EG~$;4ss8Dc92AIHUh)Kw3+OzcOy80*CtK92AcKU=xHF=<_z*KfjDC>%b~yITf{NtfC77FX z|5%>iD2R-Zm}LZOiqjpOqd2Hl46Flm$Qzo?0i9EenAiz0%$fr%zka2%v2Ma)h@ohSeD);lQNG|>@8T?q9uJRv z0P2dWdTy2X7XJZu11Yf|(9?*X zAykxI#oSgrCOxAG(n5fiAN$xY8f42kxbaSQuXb7xF;D_yH;gE_7-*ngFB@p270gQ{ ztDQ`uCze<(WGw0O{W18)+rl#G1GEFnh*S-ibgRRkB!Ic`-S9=Gc<^X>$uJ*#oS=qo z#dewP^la(kM~kcG{;hz<-9y8#GEi;L6;A?XB+RWbST@LPUy07WQxTB8bqqy+r_MbY zX*4p1upx8XU~=ohSXm*7#SW;ZF1S`~W9UzLzpA_s-1|f>Sw4=b$K91b13>krWp|!e zyoq&G>Yially=THS&&Cn^mbyOiNUp+sZA)UK6jr6jnRyAbrND6*}3JGr}S!v&wBT3 zXoBPX^gskXa9LOZ*aI5|CrM@(FS(=c#2yCGNFTuF!eFyp@BEDJKxq)rwC-pqF)6E0 zUD3wRXCGrfPLCSsR2|SAfbjZ2x|B$xGLwKqdxHm2^lNfX@jo_n2M6lvW2>)b8b9{T z6%V>D0pceEG7@7N0wIeI*4_Et@=Ia)rS9 z60e_cKJwR<)&h81;z*Z7*jhW_4TG|NLjW(isVA~ zPbQ~T52hSQ z{c-B24vhs*OrhKvK;tPixz-w$S&+MAOT&zQ0Xz!9yV7tktI?AfyQdEw1O z_DJzCG}*7P(Ecg?#+(V7SrTNrCO^D@HU7W*My-$To>L>L+{PW?IrTjV0~B5b|4gR- zZB7Fj;vK6w0-+4QLTm^YC(J9V>=zR|f>>)jU>g}YRzv|eJsF^d`8N1838$hb5!iy! zQ%N0Nn5!OL0OU?PtQjEAW`3jkxARqQ<;_x*(mY})du=*uHSEV5;^?zQ2$ar z91!@bSMu?gs%x}U{p9v=;jL8o`Opv6vJT<+S(I(kOMqvlU5sIRxg>Emn-rGgE9V$; z*mb!j{F?ISi1L?g1=ZFzQGWK(D4=VphP9JNTMD!q2B2wIHSa>VEtt)TQyMmpX2eQ$ z9=ooPnlG)>3ZRTwG59oFvu}dOnQI*K{Nwo4(XR%dAc}VpW&5bs$`_{gEZ^5y-K%5W z1wSP^FVe@#!ze+zG{_sn;T?lYw_@6FLqQe+8C++SKDpv)bSp)XTJo1NE7bbMR0woV zmTwAN0e}_L@GL32=gR~*-wt>9Yd@cXF!V&;!KOE7X#|fce|q@&tpYorm+9^Q`-}2H zo_r^qMM2{l=-;V=z)f^nxNV5~$@hpH4~#N51A2S2-1<#Y8B$uuKgZ(mEv zB0K~{MWAwIsU}S6g7Cy3Ah5}kH+Qv#BL@;j2#`RAO0x0KriqZ@bN0j|z^KSjHDZO_ z0MC-}XK;d9POtD(qNW-igY659);U;A?vAG|q_Pq=Xd9*l4Y_%b$(nvC=IM%7@m-7h zSi!u6`UiRHEYJ#>GkoEcwh7roh-J!B116N))~O4jV7$vxQSHfyX{^0e42|$K%m|4u z47j$&Y!ss+-jzVmpHUDgw5c?5q6u5?F~}-<;|l<}_G|NqUib z-Z!mK*)cCZCCP(csEu^xCkhZ#-(LIleUT6XVI9xUI=1bUbd^l1RFmU=vGwq62h|U( z@VLmct5UEv7N9Dz)BADMTNYWymddI0Biu5x|KEG!$9Yyu+xp)XTuJBU&4X815$*Aol$x=Z-X{NxP#aD^+HI)g z=v*DJXa4>6eDk$pKZz(%9-_EkW<1$y+s-5k#s+&3Y}w<}`F$S*P@1R>d~^TuG@b6e zWt61W{yd-j?k=AFIM%=N+6#Q|)Myi`#e9mtLKEEO+d0ieV%ek~Xg#(n*z|(ztRKCr zy(0A;@2R2rIQ_`gUO;Bpx*xrKtF;Gc7tIafoW%SwZ`1Sa;n_}cxm#GXeXOm0_!{3I z{JAICsJgyekoKwoT3=KUY{74{y$nj$1yy6Y-;E!}uSXF_$ibTJ9!ufQ>^}h&wR)Ae zTqEI&9ln29jxI^|_rZV#K1?vglMWep`>_pmf&yN)j=gc}6Q~%Xko)NeKpMTzNqnYr zMYZ&L5inELwmBK-YH(?l>J+`fpSeB>4c^R4SpEwK zQ>2V{r|&%ibn7q#Qat}y!5bw}OuCUZQPOo!G{N?K_9bPQg+jb$=GFZ(XXX=k>fYJ0 zC76t=x%L_gq6g{jTG}2^s#@3=Cw4A6>OB4p>|0`voTsD7SV3Pno4T^IT6`C;{BB`L z!kY%4bLuW6XB=O>J|XBIj4Jc%9%v0*p&A4iNjEzOl+yB6W>Z}7uS+xxbmOt-@cdD2 z#r>`@IzLQUx=*0_qv&GxOf?-Ky*0qP@HKAd3iZJC8%r))kr52)!{F}%Ej1Adi}7=J zH1>Vpg{qbr( z7k1fj+Pw^Yo76gf7gJ{-+}$Cpqe!TqH`mEg41G_oYxiI}F{wi4Q|04*KcsiRSS`ze zh9|=L)aaIa!=Zo#5q3Km?Ss5gKpa@?IIZR(A`ZcmvmBDvF(W?=82GP$ zMi3&`dK>|GW|O~v&O)nz-Vq>hNBg7s+M=$NMma@{3<1vWstvFv;F>77}QxMkgSDV$_Su{xN` z=oph(%>gI66>I_QBFrmkMEYk9OmQexuL2X-j3bH+{IdJ}ah(pNK4Jry)6kFlEE5rE zKCiyIE!!P6r(?SiNfStMbZn^g^r-V0+no7F?soE@Fl^WB+oKxC0 zYRpELWwTRe8g%|`Cel@^SF6YgYJxnM`0JrqWhR--)ka_ew6rvKW+-y5rn{QT%=mK@ zjY%L$5qP^JW)9gbAf7!(Kq(T}(XizXJNcU7E_H(Gpo;AatXN#06LR#v)o`)OPTAC-Q_f8)i^L29Ek19!6J6cEa0DjtC$(uR zb?DeEhDv+lg|~LoDFfKz5$W}5Do)@R#PuYwom`!wE;UdvtYZboG^aqn_=Vp8plz93 zJynaNlqte{!yh=6!?!A&&%B3@EdgQiA~j%@56QXYE0@~A!>&b!vY0-m1A^AKIt@*$ zg(x5I(wFkLN7cZTY>9wz(viOn9OI?sKDx-NKqGA!N0AKfjN|ev$K21A=if})yh9`$ zPupuNWu$P7IK2ZUB<1s>u`IUvR)DmnsEWx+FnS7nTEt;iEWziIORT_e@oU)g?!R!d zPeGgI6ekvUOS;6VZy_>y00HQX4KOzO8r;=h+w=Uj$Yzm$tjQ&*eMOfpap2&SNDLuw z*70e{1@r7NZ21ItvhgmpQ~b&o_|G4-9R-xFFCM0p#xZ+BUbx^99+) z@)2D!OXgzi01O)2=Uc27CKXcT9~K84Tf7*Q@HQ(4aS87WS=4N&W{?F>6TH?}G|NbU@gh|AG00^ZIqb?L+3> zBTmU&=vYfAbn5XaRe>5^(kEY`(~HZbsFE<9x+#wm`G+*%%^jC!n)w+S(Sye{oMZ_r_9`ih~_=V ztL6g1Z$(8w^@M=XVs()qod&{}zCz7i4V?tN`wPpoRo<}j{6^JgSyp@x{kT|ch@;ax=v!l7bb%+3>_T`~u zcd$R5=ZvAX^MSY;S1ws_9451BTtXk}jGv7{E+wxfSfAdNzs&j!wC2b=^PxHcy$nL| z^LMMIg1w7(uL;|!L~XMl3nS)jVNB08?tRZTV31|qJ+R8jsiw4;3Mhr(elE`jzD>I} zC%a`AqM~OrrR&S^kSbl zJ{CfM(GrT%dXO?nM3Xo_DmLU|w0VjwUBup`KOsk8cz6iUvAwk&SaQ&&FO+IW3%9jZ zyPv7OADI5c-vO!Yy8mh7|7*Nj(vprlWJT(^r@ez*Z?mCnDON*}s6%NDX(vYDTZG2s zti$}`M^7a*9X-7|)g)6Zl;MsgJo55+bO`N*#3K9ZH&`;DWXvMm{u&6C_xP;u{JvrF z`CjDoN7M7d(p%mGE1X+E$ODtH@@W5ZOHrx-Xi9fg{xGtg!;=!wuzL0{-o@sw{gbnl z#pq9g)uJ<$oXYauvK}#fj=}8O^4;Cdjqvv=1P%f3_p@IzjC-~Ot+@n%8WCfwj*(H< zug{~C{(q93=kd^vVUtxx*K;uz18aK?yN_be>QF&|9~sf2x0{8`~OjO4&j+b%NCApr(@f;ZFX$iPX5@oZQHi(bkwnJ^v$_s@oir9NNx6<(i>Gw?>Z@OhtLTAcMZ@5{;z^=U7o5V&VFQKOXUAz;EFR%nG7is>U<`x~@t`EbJ~gr#NXrYzn!jDma5RbMzrqgcKF))zPW z>K=6q@=Nzw|C-?;B?zsqq2JJK1N2P^s||DRKt{V8E0qw`wI;LI!PlR3+{oMcD2Y-88je#}1v&3}dKtq!pDoGw5QgW7QAaWiVeF zq-WSZ%QM`UnlSRuhROIPI-W-(m@IfEhT3K^lEMH`tR55oK}UgTB5O`&0t^#5GWinD zEoH2uM9-%w!-w??N2NnaWxVq8jl@Djlniky*5HKbT=rFe4WScH(ih>Ddwm6`@xoA)! z*U(4DAVf(hDEdZ%`vY+LsfNB#YQR17TD8G3}$VoP>QgQx_8F+jV8R}l%k4B`YaQ0SYxV2w^ac4J)i*Z>k& zD5mPBwy5S+;}$nZwG6?4K22jLQUI{qkrr%K^S^rB7P$nPE!5ntNBzd~A(t@xaQMOMJkE$~LK@GE>kTt?$I?rY!U2ftg;ePfa z@7XowI8p)UO0e7fw-|{K$9vq7c&>|B+9Uoo{&DL`2Z5pyufsblx7fAa)7303Cn2sR2+wdW{cATBHWI4e~XM^2PO zJ8hJ;to92d>pem*9|mIG3H`+LI|d)i!CS>m!D-n;uFgXuHRy$iAx@SQ94kl8KvHNE zV`QTkf)w8Y@WmQ))I25@kTh65nIWqR>yX@CW&k)Ny<9#ZNhHh3 zflpdBpi^OC6qiC;Gf%3Z{l`$wh=8%E=8&HGi_?dkZDBQBYRg;&6+S&Nz+O4&H?~Uh zg@kgF=w?%el-Sl7wG08|toDE!Cg+WYAs%b@=%fgAG?XYpphB(@<5g#T}KrBlBt zj7Jr~e7_1d3N{LrhMZMt&lx?K6*JjjcNgfNUe9I0@{l@PY0)jgmM1pMiz*ZIXk#n< zS(lI%$Lb8q)EoG)m2&0GgHDjN*r~)J-6j+^&0!xZM^c*QlTF*!w8@O_f}OPQ^=%+} z=QEc^1)Mt-gW3o#RmtOF{T{i@8@rYDo{ltNjY*M0OCy&6PgrR#1_IEVVCZrmrp#MD zDp->e?b}Ls+Eayr^LjfFO}zioge`WVZ4^-VEP{0h%eQak_zo)3{J9&4-z$FhlMJ1j z!&>bl}sJRXq6q+(1ZOQ(jMrdu!ak_GR+Jc3&iOnFN9Il*HUIHk;?9;5 zmU-TSH~+oT@>?B}M&|4b>Q$PGA(c$x8`>oif+w0AwOe1Dh|iDvqYI~-xGk`8A|=Sq zbdIdF=b=WE0(crANJ}MgGa#!z=^hr&3@a2=mUEz z3UUNw;q6zwVh9DhLm3V2F|{$sITA_}J$CcUB0YW`3cR;poVxn)bl%$l_O#hO zgbhXznA4i17gyB~j|s80K34=)*btN_y0IP^v@jq`4hB);F$twUyuty+{?r7v42nA6 z1zVO1*4#fkp|<}PAjwKRssSon0&{YQN#wu}!gU0T$*ZX3!DmSb`Pl=eD1I?WV-&%` z=g5&RWzXt2Na|JP7}j)5${%@lk1%g&14BTT7ak}A~Xd?EV}I*(V#YFZUF{4U{X^5Yb_XHzo(0eF2%?~RJs|6 zlB{+KPFhVHHW4_L+!7ld;Z6q~LJPw>-?!q!0pb+JpOVzSXypUH44DZLLn*OI_@~`? zU6_Gha-M!qiM~NVHt`;-CNQ|7n@Btz^=LvGx9V2x+#*_jrOjx~&WX=7Sgw zdJ3w!nYaKdHEq<0-X2QV9W^o7m5;XvMM?K6Bo~l+C5Fum~Jl_?W zpzr*Hc>YQ7zmtKbuz$>N>HH!B9?&xbuKiYPf1Pu3fOG{+b#gdNc;5w zMJ_P~FtVc~OMb-lhJntIpcH&I@SkT%SERWw0-v#{C+?M*08J((1Jg1Ah4n08d+S&B zx+Ncm*qP64LZ^C_oMOM{8caBfea3AW=P;VQ4-w8(-1iN)gkqMNFsBbj5M#60k%Doo zqXMv&Fq_RuO`eEq26hDLsQb_>;TvOQ7cS2LKp>1kBQ8DXlu?4zv;X1*2*aX6FxQ;k_i-_juql%&tk<4QgdH&&wqCZ+dnoln>)pP&u06 zQc?UI6;xb`5hO=~<{)0mQjz{wb$}YZK7IC;gONgQHAwR?n(wDV-R_#+>-VD4e^SC+ zQvfx6g1v>HbGfHEVc#dUrqnVEFxZdBL0GvWl+a&kzXzSF6yW=`0R!V|v3Af1FjW{JQ=+1Oezpoxa2sSA=`8!29f1^o>~X9k!FV;J-g zj*u3&borZ#wi)muTMAJ|CsEjF1)sVBPlekN#e+S;j;Aog9XI&zZ2?nSiMGXe2C9>= zK7m`HsGzq(PQg2{FJ~3{V+)snFj^c!?hEzE2L+n^LFRlGaiE1tV~24GytR(f3ASZk zf_M0Y$_5fHAYP95W_3tJ;Q<)hvJo4u3kxqJLD#qjh0p(@BsR3sEpCxCE2$ zjki-O&+~woi;mVui{+Oh?m7G_BP3~o9VwPz#)|dNr;40Fc96H|g}u0p6*m(dBu|jH zD6&lWf*}LHyu=GYmDn=~JoWmKZ#FA1CoY9ivJyx`C*VufA8|zk$pD5125rJo}bBD7_9-VgMtPF^zS2u1U(ot&jyv3Dv3=l*beUND2rTI0I`kWEDqSjnRwA{@wc3fc!rbpligyvJfgI>N?EN_c#OpIF-|+Tdag>7;o;woDmPogapJm z27F<>z^U8ferkk5#)OMA{UOB_d5)(g3f(F#_Y(IW)0tk4+a>spmcKiE;5tx#mod9@ z?;TuN}&v9KDzw;8;s=%ne&qd5gR z+DCIwp1SN&mSK8T$l>_aL%~!Q2g8@xL^nP?e?@>4HdoFz3jFPV8*1Q~kFzi^^^e_1 z>=_;w8uq4XhRyjP8E*Z!WU9PY)|T4j7&gsZv&Zhsv($?(D+O}3(2t6uB!wy@7=y;~ z04x(Ia0KLdT#^+$`W|n}XUn%IUaQ|--=w1}3nI(M(+CdLbB?byDz}C_*=|z@*K4vQ zVNKV?@1FgNZLm=Jb{mgRhCC!6xp^}fX#n680cUFgp1ASg$P>U_%lFbHcnO zuM}jUGq{xv#Y)A1+mHQnzrOD#AHHQyvw_Fs zm8g5uZR5qslc;;wUD{X=9Pw!>{kapHzH&?o^9>k%e7v~Oe(ZfRXQym~Sxk|d*^8Xb z*aN~Tx4&>7*4MtRqsEgUq|n6uMN@$;Ydw{|3&quA5D}K4JxUUnf6pYekWNg!doSF*<@%a=m7QK) zW|5QYWc-O@Z6`136U2dGaWgh_+H|>@>duL4(BYMcAkaG_j{kJryh}U7-{xPx|7;=R zaT!%?B^MWt%qEL46xgp;Q3%;>0SG3j9f9^9xQiHRvn;)Rn2rg;So{}NW}%4Ebu=1Q z0i|<&E#a%Fy8r0JG+MD+H<-u0%gE#Q6lN`UBRpSj+}O33T$?C&ajRn}PXo_y>h$}n zzju~j7ZrgI@1@pyY_lYmd@^W1j@!RnZD9ZYC_0peXfGsCUp!O7?p)|E06c48r&|>c zs|Qoaj?ZuP42)_F&o=mOEOH%4%wXwby=2)|#LW9gqeY2)D~fg=Asm{-C?MTPlV_?` zwPTI7s^c^k4e}&&kJ2*%8b1^h6rqyKe~WI=o6HfOQlaqSp#o*Avw|0N!DdJWSn3BB+@w6>8|4a5B{WLB0+S0#vcA_K!R!C#*Nf zI*!Gw)`^e-hD$FA*d{|me`fjKEC1j63<`jZnkKBwPJLCzEQPLbVkl?27@`f_@_H(v zQ>P1DQq9OeRV2&uAec{$Su>q7{&j_z7h6cfU!F_9)4sLDgLGP20bErQ9P`vC@Za2< z7Dk{CN!Q0@Zt7k{9ew5$>$WVvs;9;n^6a~v)bv;>00)BKw?=3PaayF;p3UM8bxCq? zUl#&eyxFyHN0RwbL3ZyLxIDk$O0QX@P%$7-C2Um(Wt?~ICh#O5yi=p+HZ@s1n~L9i zw?jg%l2usb`b|zR0VMA=bzs@Ygx+lyjm2kKrfZ;frgBab(SoW8o@1H}&RaRmjAw1| zhD}H}n{8K(Tvls4Q2&J27!NuRCYU5VEEF)FU?9%J8&iUhkZ@muqSD()hC+L_pgq#< z#%kX1F)f4itOt75Gn3RjhFr7ilMMQ6nFvxZjt$MKB_7NW0FIj+G!~OMk$mDg56F0J zQ$gFbZ9zfGHjCcCZ{i9;FC8|X(A6Wj%=Vw;^#Ia)-{;q`^96>Z0_7~BTP&~?k%LI~ zC}6y%N3mcYn^r!<`H8~ova+i;ZhL6JZ>>QyHgRgZ`?wWzlHz8xM4mysVALwuVZwWS z*J&p>vpGp506VaZxPyW!{nGxLwwdG8=nZ6%cFm;e(%csM(C(V-ek}v^v^X9o^!4vM z6r9=->=yI!bOrHaBSZlHKU!*>`&r4h%BHsGroH6L&Lj+^Tcx4J>P0fyG?;Y2paA_HEtWL~u-_l!dW z?gb9$*)Zx|?W*mO*tyhKkcW&O=172hhA@31_nCZT>@@l7AQ}<2OHP4$&O|PsOLqKEonw>6YC2BM-E zMM!c&U?**Jkji?pvt}@C+U-=oyKy(x2eM920;oXH{D-5Wejx~0kLn0cQq zKRML%XO48~B{JWT^(wsa&SmE0^qj>Er^pCkN{xP{9{*KlFOq>t{>p#&%P$g_et&Ev zGLg)X`7GDL%ah%*l7gRH)f=@!p10HQ&%0vQv!}1cVYra&0p5 z3OHEbgl}Du^Hk^Kwo{OHjzMUjoixw_>(F~kz(@FcZi?Y|tPDLkTX-9X2~!w!icS;f zyg;zw+rEVj(!p*7uLW=Ntsks5da{u}Sje$DhN3_vgvSU6f2H7qIa2MX`vYR_%j9YzhEI;Khl zqrQAJ`}P>0Mp!~euse^`*FrO9l_TRj-xR7h0ge#(C+W{p+7qLoDV`icJ}_fOUVT&K zpMm>{+z=W69HX2hKFxsP7(2EO;d6GA_9wXu*DESBbB(j$&9oR_1^KR6_A#*BOTeL= zoi6e|qU>d%MLXVzKh2cZ*;8mK6oK_c)@S+#lWiC`Y)Aokl$ykhBfNY4UzB4-x;hyS z?r>A_PMeb{%~*w$sHQi=rL>1%>=+wOy2%d*@8X&6XC~QxvKUUL0*sc>iF~8U2`}2a z-|m0#U7u`LSEDQ+79QCs-BLX#-T)5?DMR}n8&xxMfa3PV8au26qT;I0S(<;B;(jL- z$q(yIIh%muqwyFS#vUq>W*A|L)u=eyrOYH}lBrg5P}6UJmhxf-#7x6I``uMoI2hAe zd%LQX`Wa0wZL5LFb8+oep&dlJJ7iY7ZR3cIDGFE(yMYvBb*c8U`L|goO~8w~zg^O} zZmVJ)3MpVoutzpL2(eNe+VMqpmxJkbnHeo}r$vDvxuAV+kqnV}?Tr9(7ceF}IdO4q z+mw#${&h(3)GvB`J&#ef%NYP3*I-P2&l%M}_H-yQ{TUw`S* z2$_A;{B#wv-Kg0tfn8jc1CSNjNp-iKia`0)4@Wsaosg3bxlVWSYpUpE zeGsgaj~2oFojFNyWPp!@2SzUYsDnrQY;ihF%cmx}hqg!ln+oRtL-p7pa+QkFT_E&G zPToI*d!xl@U)S620-!vsAwaZO%7QHxrxiOK-Gwk#H!pkV+YhxPBLgXwXt?2fPm#;mYlhR<*-_ebf1) z9ZJ?LlGM{0o14-r$n*Re{#a3y@b&Gc_UxNZHS%0{ztJ$K#jHCVob?dM0^PnBluNyz zv0x&x?5pQoE1^#LUjH8TF^hWaXg8}3KwZ8j2DxDDe;4Pv!hj7$FVo#kwjvg=`kDIm zwsowd$~6uL1JIs;Uhd)`_S^MZvnd?O2U7SA&izB!1$cpQUWKXTmq&du|VZQcJ9 zHYzY?-3yiX(Ecy_)p?3JRRtE$?g1e1&Be)6u}4B3;MP7HdM)2(n&IHqUi11kz3VO+ z^zZvlvEb-qO=tsabpNGNv5plV@Q=COQrWoP<@4YE?$F$r=CZ25zjrCz@76hZD_p$1 zPY`wRTbp+$ae9a5ms$v1`Dt+qmh69vW(`QW(~mdL1PGP@ zFWcF~|;QO7@!d zU{ZIjIRm^78TfJ95O4v6-(Z@S!0@D4*2AygQVo{$+h4;5uYuvN(yvY~Cq_F^v>F_Ew% z_zj6!lG*K}DRDa=I|s-AUH6! z!DR00;Z1NEkX>q543R@a3dKSSe?tt?VC?^EsQ``B#WX=|aS6mSyDYRI?!EB zS&9M^_Vylk5kQZ4w96*2;<}Al?NUc}U`pHU8dZ+A~6{`MfP^ z&WKoQ?UVY&;W%&vG56Y+bR$BnxBIkc;25RiA+GbBHP01pISg!vEk^MwLn z{c4-iHUP^iMk?k>lj^~@2`wP$K{%@7U=d#F>KLmnGZYe-G$(dn?Vwi(SeSbyK3kut zL_TArYBO}zD>TW}HnVF^@I~cmM1Sv_)giBzbYg!OCvRM!R#jiv9*?AiW4G2h=Wb!- z4L)Aw1cb5G6dM)6I8x=ev7yM2U^RW&tkX2wa$;zW-8l`2=QAHoW=+Hs#fA$kW!T&d zbIIUoe^|JVD8l!%sbrdK`nqgw)~VG?)SC0KUq{V%NTLy=0N0y!v*Vg}g|_^$+lp0y ze$VOJ)C7+sLKy^w$);b1;Z_yYGr3S){fLOv0N75}+QE<8>e^Hg%DxR22X+@YYt1`n z>K{@4v5{$C!W<;L$mUEWtCQ=-ItnRRbH{?|p-IP{_NP(v;W17_1Jy0oXDm9d_ z0np;rLQbsVzBrhQ{Yp{Comz!dqhLsj3;9zJr4k^f8eT_CMe(kX@W>Oq?K#bD=o17R zo}i`ROXNElI9GL+V!m~#z`UQE$~etD0-ct7*rViMhA=`>r$9~7CEm_&&#)X>5KxjX zs_t<8el&P5CH*@ruPE?zo$o0GNzLIJ51_wC!sY&h<2Ju9<1g4fSGRun3eJL5I~9N# z*fM*I#(b+$b5{cysu~=GmWUv)I7-MC4f_qM0rir<)}59_VlTsN1*Rqn(mf8FpH&^Q zR5~;in&SgBp0FfU+^j2dxX$2r>`MaDm9s-7FfxuAKb}Xd^r}RfiBFWkAg@_22jJ3d zdQj?S5hNtg%)t3GcOQ525C^!R3Zz)G_U;^yEMw0FjU#+}9kV*~Yvlk!rwF6qEL8Hm zZCr<)6!rVLSMMB?KA;#ZE2x|_UIz?m+Ou6SB60Ph^LidlOIIFzTjH{*c01mwFMHSRhwgQUSvUxmV_O%elhd*V>`fv$VG_N>w z`Q=QO9e8*jIWM9c7g0S0j?h!1#V*&KF}hnwLBWr_Xm9y=ylcQ|@F9*nDO6vOBtOcY z#;x3)5@t;`I>>%aYDR3DG_|y;i7KTe47K)ZSt{D9^Rf8k3u+%+dY4k7E`Fg-gX;2i9=LP zoF-*Wg*S|rJu(kg(Au*&Uy+!$ZXP1I7SGcgy;!ofx@4H9o!R{pbks0jmY|ypSS?AZ zBa9{qg>O`~2d2qc+}hPA3!M`t8z~?R7h;_44(g5AhA;9XYlU_NV~X z_NV}E2?os8rl$&S0uR7!b~n{)D=Vo9%P3sPY6FS{!pU5qD-A0N>^$EDadP-w6o}zj`rxl(sCxyQ%)^|)1BWi_A@xO zm`e+tts^)L)&Yb6+nkbdm^$3}%Qf<;#0O=6doR?g2)?ZP#tJZ-t$qaID)IBfGF|3+ zc%^a;O#do~Sn6rzQj?!vv@{K-4;VJh;s0cp6odv;c8L!FhqpH&HR*T2`cJX+hWV~$4w z$}h4!y{tRRa&;erFdCNXn*1LnLCpP~mKavtUYKEu7|OaIn+?)0e67lsM{u%M7`EIk z)n0tj?8bHeI+C%m1QOG^+S%S?|87Bk?{)3;uxoQaVgPy}_3ybmz6GPOmyWTzhZ>E7 z#U|RWX93(COxZYJCBPGdv=i2L;~~Jaw?g8IrBh8-p~ew%1_A{}<1>ykwat;Ec#vKs zJ$j$`n`+fk4?uMD2nvA9-~^w(2k;HFgi*z#t=uK2G)l975t&Q5`6n?+`F-4hY(wDF z#x~4v8vtar1*K3cT_%aYhU^pD#_tANTix($lnbdr;?i1zwP?ZA>5=(PLg&Pe}T`hmygkZ z!Nkgc3l~C>zkRiSIUFcB_;z4vi}8s1g;e>m{(~c`{k~xUyfVC|-pQvCse+@n>6?IG zlLMGp{@dNNjnff(+0OLx`w_7@HBA)Rf|7Ahw|`?Z2^)cRI}z2sUjFlgToW=Xd3i0` z@W61MB!W0)PwWl0 zKG_FQWJ)xRJ$B4R0ALB?JX1CIip!Su=oysaYX4h2vsnFJ$dN$Ope8V&fBuxIK9KCC z>!5{&&%n*00%^(yO?#@^yW^n_+eF@68=gz^aQKW|2dpT#&{*78n=c)sK*#AiF)bdj z_ra_Wq1$iOpW=|ERIW;dI!*4Nj~~u)-x9}83^Vqx%H^O-6VPu;j4V-4FlB=4M6xj6 z_bIzrkFd1yWMTI(6pwFbBz9Jrw?<>nedE1I^OdPLF_5BnRzMLDNt0Q03zRog{86K2 zQuhN+7e(5mM%1H>Sp(4_zZPY|PGmnfg8+-CqEM_R7agf&^zwrLN^?OquXaWKr9aO- z{I{>n)%cW{1>nb8BQmpzDWujMLrNSdC@VK$wRMN}#caBIt-bn)E7DUnrS+5potnJS zT{^vT%Dr>;@KwRlb3&jZJTxvaw=F18!N?;NB6il0-}3Cw!bKai>C zDF7}GfELId|+LRr1XWvOvMc%`UdOH~bZ9V=WHo&w>JvU#XV);PrI z1unj)1hfShH;hnsFK~FIoW|0@#$;M9Q$5$GOrruCt;UB$;i#OFd+V6X#AyZ$4SB16R4(90CgmWl7eY7Mh{Vk_n4N64K0=+0g0bpKD^Z^QBv^E{m260qgTG7$o~Pm**rJlpO^k9*-$p&E32MKGi%6{4xj#xjabCUW<4XT zhQmo&jr+S?nTcpIqiGl4n4R!aLEuB>)XQA>m$A!9OsQ2|N6dQJGlQ%2cB3xey_!qf`Oh2_|p{On1CV;m57&|^?6L?sbK1hxG70cmNy(BH?UQz^f z3pJq$nxG!+9X?R3UO)_PFoYF|vZ|RBs&yCot{OFX5=qpxHXmd@I$WGCEG|_G!su+$ zfLf_$vQ7KkM19s33E_0Rbdsq{*{@b)BOCx*U7tdZPah}TG3~L^m|e)MbwB+a1u$Ky zB%DbQ85Ds+iO^6w>}M9SUq(?jt19^*tUnNIt`?@?mDmEaD|y1O7M7kucbn^xilz!F z@OR}cA2F9DO@m8Y<|r|!AZA3EMp*}$j)B3mvo~QSgb;iJU%=J;$yTs+HKh=#eB87F z+ciQfaUPELQQtB`SO`e#fbCqz0K7QY}*vyws?`p3qq4y@8_IOd8x=2Cy2?y#J~ zQjnVC1i2n8@r&qq?}lQ@Cw^MygzoUjC)qY_V^Zt?X%&A&=P@o-K3KJaj+^3oTgO0(C6U}ZTM)y?0T7T_Q6tx_ zov18W9nM~#hOUQ(kHDly@{uPmDE52$jwGJ`^s{&5N8{A{59+D4lSnq;CmA_Alfe9P ze&#%7+dPM9Bn7MLZ#cCrBi*#!LW&%V;uxfy{Ww72WZbu3h0#X|#df6m#OgC78JP5! zcf@Je>6r9BF_^q%w-C|WfbeZ5xq2~Q#|V((vg$r9;kxHkpdxLYzgCE{Qs6~?rwMrS zl%RY&^;7pY($+8-)kF^_HG5VEorbg@o}jF$!k~P;!oJqggaIScQPE=9+TppfDM=}^ zQ9g?u1WhftA)xo@xchAJ+~c|JvGc)Kk|2**P=t^JNWl?6aK8uV0TD;MHdR^@a6Lti zNX$Qq3Xqog5it-NaK^YKvT%)udW`b3@C2@CE@rT)IAyv3F+SyEY9ND+!UAUnzqez? zBL0M(rgeF)dZ{fT)6(9rRN3nWGv~dOxVS6jCNwp%l^P!o%Z^H+`Qfm$g+G@X$sW%J zaUq4}++-vEqT)?g05d3)(=6VKVBs6@C2RCVI*@vY6tz5s>Z}i%^g}ozPSl^1JOZE|Z zkE8p0YDzDGZ8B3cJ$d=!5UzL)L}yx%G*IMl8|!;$vv)~v-tEL#%E!q&YbmT>n({0YXtAi+26JAc(4PBULp zlwIY`7=!5tQ9O|oi?I{7!pQ`+;GG+(a!MzL#rS3=&P2skU@8pc#^26=$H~rvtE0lz zKlppFyUH`z_i5kj2KQVnCt8DGG&50l%XL9$(zK*{G4}@T>Ug^Z#s?2BD(v}i zifCXYI96gtuCn!D2-w-Hmx}F9V10^M`r|-cqKQG3?(EfUg;xKX~>oANCx62^wv7(XP=CW81W7cqwv`TJ{ZWZj{ zB!I*Lp+d$Cvtmip;`6#0u%Ag25+3BKD&*e#VjGtW{I%t|dnj&-%b|o4cXS$c2Yc>B z1jAN1QY>goCa7-~44bg~Bk5G&>*HJbC<@OzUR-ckqB=XGww_@l{cVnnm)zwED$s6mHB!n>evOUI0&u>pp1Yfoh{7FjFt1R~Llg#~6BY)cA(&?PCkYpnK>5#*;g(Ucm4Y1`0g=Ut9+4(_;+ z?Rt~3KaOvu#tPIuk+?>?)`DI>P>8hNMV3t8aw`rTZy)A`r%D#??Ae`jJD23- zIS(7J9ny}iI?=hEa{5i9y8=p%?SJY&we|PDK&v-4;{O{BnAjUx!EmsoA!mV-16VoO z{=4I7(VD5fX#e2}P<1xqB(; zHI)5KD#!1sY0hN})gh$rZ0@e;6RK^aRDk5W0|Wn}hDW#dp%3us%e)!!p9uk}j+vOk z$ry}+Bwj5new)*G@aMfg0GGNs7myVkJ0SnhG{lSO?j5i;!AW5=@A8#*mbWyw%NU1& zG#y+WfhDq!x4M;DHTD7|>SE`kB%So+6rs6ivsx+XO6IyPwN+rH{k~y>qno9iQrKjY zwZ1X(zMRqnj*-s5tv?~?7Q3>uqL-6nT&nwC>20Zg<4+1Urfj_kQhwIP@noFI797O-`xa3>iIqyc{F9ZW)NR(0w->R8HQOF z(o(85osiB^XqIWA>DY@37>SQ+01LlgsjsfD)a$I1veS&_F^3l+Q_>yb_^rfM%{VE% z5<59pu9)#g+K5e*j-4)3z00l;HXE5@br*H(SPp2?z3dcS&R8mDsb8T}r3ochfk~+4O*@*=F>1t;HU<)4$Tieo>W69I3{WSHOZZKo%9`u4m1d7Q7;E8zgtEQ}Vqd^RdgwurI*-;k#K=3n3aJ|HI zBFAczr}n%Aj69zm-h8!{2t(xh?l&>s6Q7;CLFk9w-EU1mA#1i zCMd3F(_6U;9W#%42_%-gUE6rj!%DuPbr*s?Xq_%`Vl(HrlsU_djxzm(e(tAmXDNFN z$_MM54joXZa^;rg9BW}ODyUBH^aR|iTc7a#_P)DzR zt>$7SD(G5R#)g(yax(8pGByA&z*f;cG*n5K?x(Ac_&0YX zVW(VC+T`ztS8p_>Q$wv>X&EE0cZ`zmE=cpD^>M^svhB(A7dGzt9C|Mi&gnk6sZb8q zC>Lu#;)r{K^eHk-KQ|e@kzB;84moL#j?!+YERb8yg%6f`!}Y(i!tnnnc>|9n_9kJe zs`EONq1?mbZXx+#kEMGhkOC^&3_iR$kA<)}5seW*`$yC-x{+n!jLS5P2u`^+Ujo|N zZ7AI$XCRD7@*sZ}#jPXau>Z06aNq&k>T;IzbG z6IbF%XZiAYFT4j7(t{Qb)YHs`{+_kg1ZAB&9fo1^RlClG(I16*F}ylQAC^i(QNv+i z(rX=1N>f>5m3kc=N4AHGuGtJ+W0^Z8mgBX=kVfSbuwJUEAftJIO31k*`W={+k%L{@ zFlSVUAW#1ld;`d29n?CVuCtQYJi~m@a7Ob?ccBA@DBEaX6M^t@Y3OdWhi~LPuzX6m z7WPwh^L2f`jJ~wgJ*Q>4+}Yc$!cL+q#Q5bb|Dh3J@2kc}O;Id{f{{F*&w(@zPBI5& zw7JN$6F`2pXZ%T+AAPq$3#0lx;drTFC(tdSQhG^e$_A*1h>CB$(Su$bomRxdOrErr z+AvdUz|m*MU^pqolahh)A}gD6FT-`~^WT7b>$Q(MS zjIMoK;z~qUJ235VYdr1$Gi8qvH0_hSxh754|8e8kQ<01`sGPvoNO!{<(;D2=8Efav zaiGVIvkkbm3TtH{KCdr;zfcy$#frx7#VC}2e=mM07BsHsMJf|@k01=Z&vF@S?_F+Y zER;=CHOf=gw|>FWJO>AXentYH_nI z-6L^VbTT_6r47r5rbR;ho{B~dUfxO!@OZcJ00t-s@Ophqi6XXP1yooNge*$vxEHO1 z-Z+C0H{PJxeA7ZGjPSZZfL&C`%Py?L+F3 z0gvuCj-vZ!1ytD`6n-3=Ny5<`kfN@@!vF@KuN=;7*^J5-F%H-Y+Q({e+>vn64rO=D z)&P9Vw0`m5t?jYyrc)`i^r`MSULeHWP_nJi9Jv6wMU&@f(Fm1|P(;oCLl(H&~FJtoI&58e2*9r|Q zuIzmWatljNIb|J(BTk2cc;7g%#fl{GiIvqKW(kxP#DkzP>0-N8zE$u?MWinw9frU1+gX? z)r8$vj?lb=b=Z5$lZ=8{nsI&AD_FGs|$aiF=y%%o7wU4!pbYf!Cd! zFpipgF6jkI7boiX>zQbdC(a+VTi_pmPjc98tGiF;>7%kmvUZu5=f=Oc_Y0GSDl8P} z0w<51EN*T@8rFqNho5(AaO2|jzu%rJ1&>}`mD3BezAZuErI()4CcFT3I>TOHFOMIO zo_taFS1(&XRRGQ${3O?wLNBN)vM@)_A8bsGi!F~5JUM@Ha7?jZq&!O#^k(497ZIUk zyThX}L8bLpXeWA7n?QVE)pIUu7D`tu`BW}Vq6XF4oRN9KGn|hN^v!ThrUQ9{JMHz0fxXi*Ob05-ZcY?9Wb$pt9 zc+3OOs<}M(K;F}$49Sq2mE}CZ5x+~SIgT-u{tUnJ74LK?m&GZTA*vA9%1yGOf{~IW zWhLzr2Z+VS044tDNZeCVcvFFjF~l@K#5?EEU}ULIJ#1y|Tp~c1cPRSyDYXuy(eNK&Yn0QpFi-ddtI3;^EXN&CJP*O4cGW}W9vRfbOKTXP92&6p9yrG^WeT8 zNIPR##vvea$y@@OhL|z(Z;Zb-I=lC+HShJKk2IN4P4eaWZ9la%H70BR)aCZy!CL{I zw|g_Ur)(fo$XNH#CYWF@0|m_)ei@&F^q%a}30-=4&@TAw)!}-~Ky!lS5FGiZYHy2)+>>IPT?`X3b1C#agaSw(v|?QB^gZzm!bWm9Wgd&9{`Aq&Nk2K<{Z>T8NVqzIF7hS_eakA{*~4))E)>VU-8xGp8)4zN>fO(#S_JO2=NZ0aVmL zeR}$ICo9|VtJZkxv>{>X4w`wc(lNk2Cx-36DBoQNYPp2JJf_I@3FfPM)!J5VBUe1u z84o(AOHKu-nQV#m)TWn!E=X%d&(x6&{ec!z#Rj9PP5Q>Q#W?t+chFu^U@`QQ(w-)#6=VoY60qc_e0Sx)==Ff&_UZ-Y z$`=)Bq1LsGOhbb`OrBaL9n;Nvn&+!aq#|fZHQ8wVgur7PNql@OfQ7W9Nv*#-<+RNc zztKVK3lIU7S}7eqe71OYD6$FS5H_i7qn6{i72n}3Ic+Mpn^kDdC?dGKS0Z*N^0K=f z{X~SNA$M0xICXn+1w4zzOcg*+RoS#EMTD*YC?X_bEb0$;TJ+?_Tn!a6Jx{c+h`e3* z3P<+845&4mLU5fwSbC8g#R1m+k>`~nqY;dp&0^!5VuR1W%*^HR=AU#OQ(LGvg{S71 z_&#cnfBDh-ers6qPS;IOM$rW$<;xDad=bC1N zKbwT+RH^hz4D0wTX2yV(Kuork{EuVu*$(L}b$B)q?j@TtAdJ%fsQ``rDU4X#6@zZ6 zISDL-jx0lMs&3afCaiHmCY>!M@6ikx0j#K(ARL3(61e^wawjCG6C>{&&%@j{6xo9w zOJ2#yXg8Z%;k5EomQAZ~95t_Cc%af=|6Mshh=$4-*-c|Gu&Q~xhYlk4aSc>bmsi!V zc0Q+}Qmr6vg=PSH4h0qvm9HC41KpKTqLt9b3r(LJm8GS@($ou1v14MiP;p^5woTgw2MQX;f1e(UojM705}jS&yF7Czl8y;aoF) zMu|@0{Cyjkub$u`km4;})@av!14j7ZxiDv!YA&<)@YZ;9_I#b(vRRzIr|#TslTc(^ zQWu%yPm(*X3F&Oti{zA;cM__RKlPb^UIEyfOI}O&vi@0B@5mb1wtL`rP?p=pI0skc z!3n`P*bgUO-v0ux*jZAU_(8}3jBNi^WAu++{d?%Z_WVD31?faNOFz5O;!NW;M(W6L zmG6Cak%~^G*^n(sJYy99q>*Cr?NcN%KG+Kai~Q5SyR@r|N(7$@aM*?U{?^h3c;Wbc z4#N|QCLx8kI&%7>X}tp_{VEM@y&w>$D(1Ef2dF>!1siXJUuSv`V{cY__Oeq03yV_AX5{wzoTAHBzTYWX?9{t z1$O-KqTGmI!=wzL>?wvD7g+b9$_L*n4=o~mg23DNtO=<=@rJTt^OqP@7cPW-P?Rh#*5}PbIkav|tH3wjA z!~x?3IzQkq~GME_$<5ODsc zgJ7UkIWcHV;PYVX1|z?@RHPjNA<0Hu4ANSC`_ya>+bwUYLDMX^OCvNnG@M;OwG8>) zq}g+?dlb;k>m~30(lcY^HU+WM(nOV*dW1o$mufi1VWqW({mkPb`uSJ*vkniazhTLFcl|;H?8pHMGCT2nyYNEpeROz~T_hG_|P{(YUxT z$ppeE3Q5fL)$VqZ$hfQ6VUAZ6fFq031+1D=oD`}q2N>kM23c3We*!8{c4Z;NUaH4y z1&Yu6`szn)jx!r2hvWjJhB%$b|&-jR)1S2QbE(GPQ94V7DM{spr=pzjwU24~!B zWwJ*iU`(am-GWGQi6+xEKq1GK6qBWn2``orSovEcSUDzo({_IdV9_4FJERKF|0kwc zk&scA)J@H&K5RLM@0c=-DAS{1NTvA;_-(B1guZ6 zRrOse4QoobCHe~}_ZM`L=rbPl%MJ%n&9WQAm$BFyHIqzi2>L3&V>%vFIv#?b53kj| ze0jI8)af0>itL(%XOJmceE7;awa!y&+yYsp@+jSn?&0mh?yAhV&RZOV^!76M(wuTt%9on3t4R^#9Bu4=xw z+Al6n_X=aC(B+@MV!_kV;yH>1KbC;3j}AsrXEGqtBnv+;+HE@nevXHEMIGS5X-Y%Y zvb_Me?b^u&=rY1}6nJa96|38=%!U+3vs0B`PC}dF1Mjiwe{JAlV;aLNEra%ql8I-P|S~?3-7Os zO9iy3d+Gx1vbTMhHo`q&dQ{yf+pbLxn@l{?mQY>^$p62PQeKdhSmN*dWpbL%NNecHx8B(2j{6 z9?uM?@}2SbnWz-&QD(kbh_V$$9}5W_nl5w534t+<$W>mCijd7znd!b zse=GmK&bAyG`D=$OQXtewP4b@hk7%&ixBtxmM~)&`|G}hJ1`Is1DWKz_dt2ulcm}R zKI||%jf~&0^8daP-9|iUuH~X`f2L#yc8ALXA|?E=nF5R7MamonDw-w-gO9fC&xKxzr5VLA(~ zj{P?5;?;xnH*<;BT$R$mD$ipT=k zNd9}A7{g@y@p;^CshT$Fi@}X+p|q}b+Od{a!hWe{d(~vZ%>g_L0q5G&8rOSGHw^eV z0k5(>pJ|Xn|3b`TfzpkEk`k!3S^&-l+A5Po*N{q^3D0@cpl6UEIr%i3%1)h^=Xes2 zOJ6aoo+jBV-*)60Rh)C8=6hQ9Xg7kXtD8`(E;WV;tMTh3YC{h9W-lyVGxK@LbLG-D z<%jcpygOcxjZVe{Fd}-w5g%@2`?9A8C---1CFlTNJa46-Q48N68)3KJ-klx4-Uokn zMa{7Ox3>dV>K!ly8GxDbzr1$MIFkRAFUMTvQ(*b2eZp}6d{KWFkTutPcOi8ABAfZh zYuOrtgkj=J%JFAsM4#7**nNd6&->etUqR4625C=>@_ss>4nK6TpUC__+`K=Z#;<4Q z9RAqd_l%#be;6DJ6(4?i1xq3b;QzEy7C%}6R6Nc%p!d1{#HvEK+_wL@;rXtv-8)!e zuysiTbNpSc@6ex4ZudIIG6-#aAcL|qeUbHC&9Vz!`=b8^ra$28dRK{{?;ac@#S)*AX&#4E_ zxY+^ckuB7g`Tp1$-1(!wLkQD%T51W&7`@Gabs7vGG`1uSsxA9=uibH{-XmS0F@kit zV1=@dTPLfqy^$`1_i>ui_}fX(`f4s#@iPElg~5-iCLLtOE^6#4+1b&=|N z$Lc!lZ9%Dx$V@9F>x1v{*UU^N*BTt3O95;;P3+2toSc`L=n9v@atPuIX%-?Xosa+7 z$2Mfw&aquNkfkAS6|xDMkUG(>j2Q1SiBo_!hdIU;9a-F=jIUSmbBc6V7kgb4pg=ql z)fmXnic!pAgydabRB=EQe$M^ANAltJuN zc&`I_R91I=bgyMjSgS-)5`?a$-~rQo$X94G;(D}C9cgSor6)GOST6H{E{AN0gXW>4 zW)?gQuiuD&vPL9l(A%pgE)~N7kU>6?+}DYXUNC5{dBAg%Nnny?wJ-Gyh99h#(ng0L zE#FBU1Kya9DKmGzidGOIJJdd&L30dz(0!_=Y#ImWug9N4Y>Rw=0RRet|7ce&=KUi`7dP5*9dzTr&&Q ze=-%{fSN+OhL`ko2t||#=m8FQu~&TIvCVOjab;1!jc9xui!pNz*T&u_|1I(WhuuRb zY=)2FFaJBNR%IMbOsML2q4Ae^s74vpg|^%{F_bsc*8t)EedVKUwMq^(3G$0>B{{7! zSZ9iEyGd!hhmAu~)2KiAmt|&-WCHW6oCh_e-H0;h*iuj$%EA)|z_ByvVyG^w-clxg z3!3(N6OtBw+GUZ&ox<8lS(u`D#@|cj55+1^HD~sG#R8>BIzAd|RvX8;$P0N{2dewz z-xqs$ZUcSCMg>(4BsxXDHK1mnf!DLy6MPFH_GrjK)3usXzhEPHopY&AVzTA51CvA;74XjgeA2)#K#-zwOeVuxz;?CVeXdW6bixk@33*ATZ+?hW@gCo6fh z!kn49723c}S?~PTt3*=_gzU*!Uifs9U#o3EE7*3)CsYFqpgu85FwWq5GdI7lrB8jY7%f; ztKB`;9G@L6S=07gNH%~JTq2a_+HDPr?L9m^0$U|oCsGwpUlp_*Jm30$&hpRiSv^!94gcvo$jBHk(n-PHg0%@QEO90fD`YohYF7tMlR{WXo~58_1gi zCTd(UFtWIkMu z0M)sRyqGh(4jtL>B{&4Tp>j_ykd(1hraVKP;{Z^AI2?>d}^QK?W0N*<;X@3pb`cHv*xiVsM~Y@ zJ6x|NBhU&s2Awa1f(G;4(6~^$9z}U(sPJm3xI_&TWn$7;$H4kPKDvjW3jOsM^h*jg zA*q$yvaCDQkdA*%tkD|3cd_W(T#`3s;TZ(+0CS*+0%a3Kba#lt=9y`K7p?@PpGy~{ zC~cKm!l-|9VaRccv}uM(YNgNFp!`)s(pXa1oysbi6v%?^os%Qa3E9ewhZfT=fsM+c zFS5~I&XeU@*z*}21f-a*au?5!Y|TaE5kmTOCm?yk=pb))1o5n}b&t^h0og3>&yUhA z2Pj0LWE$+E?q;%H59mv1i03LkbXn-V_i73`lh-~TkF>)VkEk4=g@-8#PqrS$R##l? zYP~G)oNa_dMajcqzp-6F7ET-I)MeT=`>9T4L0CK{zyf_ul!iooGU!3c{_nKY$j=^R$;lO%h{d zQ%*}=k(b?)wgS}nI3I&mEbRwTD-v#aO;Jq|i>;q{)v0_nkKKw}ovoLxdk8Kj0LQ$+ zKW8VNw}p-CrI%feBo-pw^zTeZlEgoSqkogRHcLc~tanU^JaDEr#szjPjK>!U4qkKg z^EeA~eRMU_gIwtPY5UsbL#*S1Cct}k3 zR1tC>OVrMWcs9K|cbH?Se6&ysk)@>2q@=!!x@hh;G)FZ|ELbX+^_&zx0O%pJ;vJ+X zQWjt5hrmBn^@Q`>{4vYxw5crfMHM?rsMDc}_C?>=v_GUYv^9O|uQPyjzaaZIB}wcX zpO?ahdp-v>=kU#JPn2+}jz98^O}`|D^;=Bkno_D9YQ-o=KXyZH#KLbram*S&vF{BN z_zA;{W#l$5KT>2MudCJ$1fXSGE zt>U44fgChA-ix(e-6@PycFW2`hNMw?YPbmkU5*-|%^d_?jwPoC0H9E)eo6-8-4Q^N zdg4+met6WGt?+$+eI3wXF&09s=uzQ-7k)wdNe)GAu>F>J;bzl7(_W8m%>I!-^>U-| ztoznk;xq=y!JsE*eT=D)OqS=MGsY&d5NxhlB6)@~TwrcHve;6h($0^iEAQKT?c?8Sq16SSAm8&bFq3xT6!9uq4ze- zqgyScWoOAb8KW`r**E_oJU5|oJaL-DFQ0$<8OXsO2S4#FGfqOgTt{uYZX~?0l)W`g z&wkpfyJbzSF)f+Z{e7A+@h-1D^qvis2=A^bWgd9VmU}y$2*4&YJhzu!+On`>NN?_D z5HKj~MGI$~Mx$8AgDJjoXP2S(m@9GfsKMqu!JhNe=wNeIb`6d`$lJu@~+S37up zmW7zHboy4s0I<2exqp4PlfFoaFh@UUsMlZ1sI)#n*lHI0J>4OoOA&`+G0K$h=49HC zmnE|->zRIeuB3iWfiFqz&JW_<$kZ>4p6;5^3HT{7_#G^Klxu{=^ujaGFv}*d6N7n{ z#Xb#5koLDdDD?0Q-S#~Eo@dd*WxK!7kI*a?gY$dM;Dd{bEN0(61b|{(nXS{s3aEZ$ zG-C(-HSJZS5&0shYM#;mdDLgwk*xh+b{Njoer#Z}#H1G_fR^kG3B^C;`L6&7a<~tc zP?Sr>O8wk+<3;T$E;e1SdmdIztFw_W)=43 zVaUVa8w|V8z>L27j({($z&A5IVMr=|XsqdKKV?%B2qjP=Ha|V!vN-8HkIb)f0Vu;h zl7NJ4@|EiVa6`sdN#gfuSlTq8hp2UE2=TF~3=x2F9!}B(#pmi_jle!m$F~a^dqnWb z-yQs52rIz%t&5@NsbbB&d8#I^buuKBkH1L*J=6;#tB7EkMb>}R%LlG7P_-=!u z1OV`YpY3qJ|N3hY-Mvj1lt@O&Ej;WD-VB~lOa@8;pl>$EYMl^Q^8r922(hFAG7d9_7)1Qh_X~3J= zNE1UO6Wyp4*Z=$C1&LYDE(*|vP<0ew+5a$!@2luFlk}kqC21s|MCWM% zr<`2?tm_aEm(`nkz+@Q}StDV7%~$2*GsCF_L?i!Yf@1R`A5J%0jmVsCoEPK1L(X4K zay!KX)kLIOk*JNDfSbYMh)Hn17p4DX7gY;picl8)ePvWo5d&eN+WU9FF1hKy8!5nII$j?s`R z;M7%nxo1-@#36~kyn@@bQ@CGtM(-=FE5}{N1v35)VUd%0d)O#FzSHL16O1Y>k8R6V z7k)dBDhz#&>vV1d@>jr?T8wW|zL{9S#x>OQEIfae7mKKZnV6f8luUiVXN}ep=&x~$ zk5c-DCVCi=#C=bAOisxmOo`YBF7%55z`KeqVs|bKwnt&{9ee*V!YO@A3LO-Uhe<*% zV8&X9*M!$IHP|pGxDLgafd&#l^)1eQ&vjZRY?9o+TGQZUSy06+(yMB^Ss`q_R2hXX zZAj?g)EX%ab#jVCkpU>BD1-2Ev$XQ6!VT@Umqp+3d+Jvt@3qO7tC0s5B5UmW% z!CxDAG;8~_bQ*G3D`aXn!2nZnwBVHk+Ul?-yL!I8+c0QbMr&={0P}aTI_JO>1~&=! zW0j8U-e0t@xP!dwU+%}+MUuT5ct4q@o@z_6TnjJI+O2Fw;xvPDH`@sH($#wV?&(Xs zSe`t;UP2 z8b+Q^m%u<@yzJ@8PPbHechs;EUYk%9(sna&XQILILVxdbdV9qRxrKYQ#6dWN;<=}R zki0Wp0fRW%(^|iAxvRF-O1G^;^WsLwcWfzj6E`z%b5ji_MR!)a&efR|aHFX${PNQ)DRdr}Uohbk@b&ysvx|#`#}jldJuKllGZ&nIG|sYLJFHVQweUGY5EeZ1 zy+>tQ$bWFMoX{=R>ackS;9MK@K*`(*N0$14F_7Y8PFlGmL@5U@la#!KNBjnjmx zX;5=0p2>TPqfc3`lS7GFZe}(|Rwij?tR;9;tT-odv7Jc|NH2M6pk*?S73sv(5|S|iYAyw&?kTksMi*g9 zg0@n}LE+fw7-#O5y@*CFs|}1xLVv0HF`H}h43;2C)7QLaK~FK*CckSzq8U5;RaM-n zV84!z3{M}>cz&>gnTsTnSNyGg5-n^i-ml|%dnwAO5O-5WmhHuI{EP;ewF8z z*d0n0yG!euMQdMfvpY(QsB3gNO-9G+XT)UhWM+c?6Z^4Wv~xik&KdPn6HcbUYHa#> zMN+NwH`?9h0xvh(FC~z~T<5Ek7Fv_Ra_Pft$PdaG zmoP4-!hh}AQ^8Om8XY)eOrR=!<}){j3gP7)!$*G0kH|y$MWChA_-rbI>ZwezwK)y$ zbLdJ^@6D|wK=yhqsCxHke)x*xqQMJYSM+Y27P=OE47m;~p{=xUD&KTDyJsgB6RXr@ zlySrmTs_qQmWIz$kZ zlZQvU>i8Y{#daK4yA9v$Osrg7|I>IirTIVg$nzOsU;^kS zn8%i@%?Nzv@CE6Yy8j50$Yg6yS*waAkw&|Yq|%EN2?S({TPyI~l7LyR%dDq@m#sG# zRiA>B+RPVu`>ojCH29+1d65^lD|mz8gc=Z3gL?1IPsb#seLx;*_noi*`PJ#1(tyNF zx}Sb~6ouEPgJ8%av~V;oyu)D%HDp&&%A&~GtWrp=orB`_BCuQ?9pF~{8}g(-I5)>n z56ifwqiEmt_2Ftoj)unTL=ws}^uWK|)n+73f;&shYx>jg&+6MrYbW&7O>MS9566~( zXug~THQ=nN88Gljo&0m{cf&7Wh)FDDTuR6F3^UitN!rIiWt~Eb=VHxyCA=UFR*P2^boV<+aPwzX#x^devV#eRC=c z+qK;;FcFXUWI&9+hvR30J=ZIl23(FO=uASh@@ulmohDUby;l^-rb~+k%iJ5&ouRud zKaeeoQLde`u!zSx7VmIc?@?4R&m|%^v`M~BhON=1y_z1Hw4DsdIdL?z_HzNvH=d$k z8!OJq0S+okqj5Ij>5I%mhzuk-EIbQOTve+yIkg!eXflA4>iz~qftSp|ssX1naQB@S z@|ZT>^+gzpr#Yu8o~rAR|J7)NU1=aM9K2t7Syu>Iuh9dWZ)?73lptn!rAP?{{q4k% zjt+vQ7Vx^4B(5#SkYgLJHwHX_=y*j<887|K3BclaJ6-#ke@)el(lWOuXy!j~(ON=| z{&Ljgs@JG)&`8cxlk#ieMQ2(GIWZ!VOS5%Y>MDTL&e`Et9kw@21~H7vVQ_{(05<5E zJ<9MZ@9cfx{G}>o+=@=MJRc(}HI6Bx0{@#f@bfP!Amh&5$aa&$f+ES)G*{3&8dU?s z5MYN3TdQR?Jsf<@JY1Qq(X6}_h^lLeorfWJptIC&RbQRgOi=No_}#!9<0ObEfs+Vg zK?duV(-ZGohMsiM6TRhHij<79`zdTY57CVHQF9oSqW-x+R`s2T{%l-)Rh`%(s5%0D zbZJ*L4T;09%%%c84Vw%L+O&2Hn|sE(0f1}ywQOOz@&}CRYDD2}%fDF|=|mf3gq(66 zCS(@cw4w1VgxIZijSC<9di5=Ui#ipODNQHgR(4j0FXKhyEVIBZZM(^FZ+0g2 zLycukqnS5!MRqM592CtOLpC8@t&4U;lY|FIDuu;KPo!BpvB8^vaSt@ zDH>d!Rjj-no}CLdz2|X)-8hJu($%?i$ECIoC+KC<8>7e!Qsh25-P7381v8XniL83# z?3@f2?_E0dnq1dECbHp!0OUINmv*YtD;APiv*}Tup6*x5f&{?orzO5Sq3R5m5<_SX z`ugnHa&HZ6W!knOx4&3+G-`kG+QGaW^_Dx{+KK+k*kQ#*!4*72u{AV`4}jCcm7C>B0uk^`FfY7PXI5Xp8Kf)HX;WS}*rPFyvHn{cZ|8lQqSqXTd)D?x zcl9XM<=n;x_MYG)cD2uM-}TT?@1^@!Hv^Jrz%l1MzU+cFwSlKD}H`7_azgm z`l}KcPpk4<2I|S5*-vqVtFD^{N#^=yd;uTO?>0%+-X#XJT^`#>^oK;_4GL z=2w>NC=1;DzKD7B%tV&&lEpgaUGO`;29yzRb?( zlj-G3t)NdcZhJ0-1*V5>VlQ11=P9eG)cqtE$^AB!mlp6f9>SKFa0hX2 zwAL@R@T$*eCzQH%)QEX9QJ9~fhe!S6GamOMYc$vZNy3+mJhtNCBV+28h4rJOr;58M zf7V_@S!JBmD%GFQJ%-H#*OkI>~XphU9^ z3KkW!4#T14*(5aRI^}Q(zAGHCGhFCVR%{n-RzGW%Q4kU9+Eq~y3V^`m{0{1m=*OPP zBDnt9?ZfE$_GG!jPL-T~WNmcRm+@}lg-QBNlAmE+kaX`A<<=}i!PX?sDw zDE|3J9@@eKA8`8<0=+lXN!LH{ zGG3*BejnYTSMC3~8nQF)QR4;nNf6bF3)Gu>0v1Uu1MUaOtf8s zXK1I#PPUW_iJLnP^Tsxb5m#sBwEBRrq{$3=yfwO9l?Ol({fq&ehcPZxrI>gof?p;j zEnOTVkm~IWhp<;-)Le%kX zSFIE)Kq84z6`c<}LZWH3X|O=qY+j?sC!!b9&M?~8BD_}(doh=|E>WX`tJtU{h08>4 zRUTXPYzvSHk;H#BL0fS)cUq|W*Z7M9Eya7h)fEcPHZ=_i6;uJ!wO}Pa@wBwTa6tvU z1R1eQ-UOpD)VLE9&tw+W}U?xtQzOfQO{y(UhdP?AhUO|xh%@y*HW4}OS>P@DDSF%<(!3s`Hi zQ$Q>#Xd2G(j#eW86CRIH3>!nKJs1{{be7G;GVN$mcTfzo&Z!_>>}`H8PIr7z-e%|f zdj?n%P$T=h>P!)kVDfBsvh7t^BP+}x;}}#=1g7uRKo+f3tuQci_@NUYd-T*sUd~p- z<$9&*xFhzUsazzWr!a{{og!Spg-i&?*K#rJ_jSByl~LC4Btck>vJ-M&iO|5;SZEE^ zgXI0zWnd@Pc>nL;#}8S0#7jU!+r*|eZVSjw`vdQOIPNHuWz?zC4SDo<29Fa36KDNr zi+%Q`M9=;=D|GNOU*Yv>(y%Gk1hg&E-SR{Mj@Ej`@)to!Lq^I^Td zQcQqD(2&(qX6)n1CUek@^56oVjH+1VGBn%o{m>(s{@~_J(8JJ_?TOEonMCKH>=yEn8JFJh#K<$`OpAJIHZ z>i$=HL7IOJVY3=w5Xt2Z%~CS*0+oOvmK^eI5&6oPW7JS`Tm+cfx*HD%R(hwCNj@bd z3-pAp_4<>nL}ky-_*!xDOj%(lp<*m`2DwTTxWQ6$GcpD4e97J!;1GMy{wQr=?kevl zd*de(_8fd$A7!4FT!CO)0f_;sooE1|gkI1lR6;6YzVhyU|F5;7rQ^+S8Bu`Gxy-PG z3w~7Kg6Aw$$?ezW+(N)DXW|Fs@!94||6xH}xa<;Ha>o~!)|q&)ynVQi@B9kooUf2J ze6CMPMWr=kE?RrV8FU$*v#zlZxlp20c@O!A&vgiPj~*5A zI7`hKVLp}1@MbsclxmWTZfC&#)D3qgtb0&`mA)Ak3jA`BMa=U7@k$5b=@Nvxe}bRN zx0qL{y-di!vog~8taYzeddy<0z7TM|8lQhNoQ4D`aQG*^1%K_46hpkdYKS+b@w0V` zG066_AkT@ub#0EdBbF4%yw3BZYT}~9(_ZYWl(8#FnKlhjJ7R`!sWlGW{hjmEFtK&P z)P`C_s2jgl?X^DOmEc>E#P|OW%75i!@yh=J0qmUrbyk0+HBqy{j=1$g^9W+b<%7~T zTOf#&*V*K*?y~o1QMOTn{p$;U2SKxiwo?*aG;ge=d~Y%x>wfYSJ{JO$@;gYVQHVx5 z3U4~sVHZRXKzA+BjUez%43Rga1T*--iz|pM_w*~u-)QjTD3(Kt3J1V7%)=8syUC^( zsFZfgeQ?6%V=mrx>0ywyN9#c1!rP~v_BXpvIxAe>Vb9Fzr4qk6Roko&>3V|TO8XUQ zy3mDy&Mzw{#_|-oclsdrrWZbt#;8dYu^?n&Y~MzJ?lgFQk8{rz{srar55P|!jCD%@ zAy}K_4}du@L*et=5)mMUWa;tw{c`(p>qr$+=JWNO|Mouo7o51bEQG)x1*8KxS8N?@ z`O9}V%EA&E7m_`>|4fAhb$}Bw0HVm!MIef>v2!0Y`c~dACkQ6V@!hOSQ7YXl=8jMc z>9pif_f`*S?vFzI;%_YH(t*QN(fA>B1P(=Hkl5qD)5Y$B6p#SVp!Q$H!DURbB-zU0 zs-H@c{p9^gn9h<=H@jSUTS5;d70 zIp$FcBaz!egI+k1T>gURr&cQ^?lVNofst_wO04(DfIAc{lgJaq3}`rw6| zZG6Cug@Mi82Xz-Nni+k-|7c^f&}W)~lp$NiS5-qC@qPeUgxv-S?nrN9!|UPxz#}h& z40|0G;{ut5x9sDPN;clN(4Hmv>Sk<09=lDM7p&3U6ngYvEp63{F=)@!(i90DU>?C) zhlylbf)qwTcFUnw8e`d>AX=z-4|Qtd7gNRkK9(TH=^rVDc7KS;caVI*NKo;KaATe3 z)1Dhg(&+%?v*%rVj@9E*B&-aXxjGqC1XQC2dO?A5#%=a-TTOW$Diy4D3Lc|Vd%7uA zf3qQLjUcz*B=GEhY-QDx8O{?B7`wF28eOv2f+x!o(m#T0MlKpQ zjh%~f^ELkK@t7~`Zju;nl%;F@m9?o`;g>9_4g+ddpcZm*P2ATXEASW|R`X8*lN(%1 z($x|ZDG`R<8=Za197!NpT(GG6tH*2@A=Hy6&0f%VAwQD%nNz7|&^xswRI<(N^lH1l z%0zYm##GK`WZ$fuQ*29(pt{F2nkyMogzd5#q*#&~3?&LdVul96w~!vI*gFUsv8n`~ zf8+)|pKU)95@ifsOKn1MRGJg$5xqeVbpd>vYy5DPmYFQD8)zj(X^rS!P_p$vwHK*I z^gw^r#NmsO{oJ^rZ}Lpb9o?aJ=2q;eX9G20_)V>|VFkOfrn8!HJwxs$;-She?4f!+ z#owZvu#@xU{%|W|H-ukXT#Zp(tA1l_IzH}!=XaKsdzriNo=2A|gN2a}U5hA!zA-o7 zp)FqnfmXiCb?J$)fhCdVfy{ANg8ekp3$+(?rRRR-D_k_fC5V^lQ5{ zteQ=}+an!1)?>?h$Yf`GB`lkDzikTY&vSYLv_KeyLNBxQfCn`I?NV z>1^MWWay-Hx+N7FHg@#kY+X7#zWku6ZTDYZuN8QWt^vO7Ju{d5!l5Z>4hr5`npCW# z)!THY&{ScwtRoI47R84Xs(*#YO_Q|vp`qhd$!+2|QOG}c>;JT#g9LsmIHjK1_FiraJC4{sDNY;1F2**H zkTAh^J1u3TzM+JW_UAw)EoR(`cP5zhEuri!_Llc1?wd0&xzsl<3VQQz^E_kL;5}pX z>|qd)V}{$4eiNqq9D~L*hb`m%MCQ*Cb0`y060^Sma-Seg`7A>M*%V%$s5Yz_L68^N z$9~!%-q+AZTGL&15NC(kQ&~xorYx^B371(V$!}VJn4~B{ygq0tNkjpEq9kDZypV5H zP2yiQO7KlE9(hVa57asN#Dd_G@JXaFUK9-X7#^W58HYnGtZ#G%YRT|~YQG4mqL~Vh zRwF(E@LvJR9t7_!;J-<3s1IL=H913 z_9cub!hw8K$zb>eAW_O2!YwNxqH#g;K}?GSezB=Kgwj1?c#!!&s7Q#=C>Z@gpA{#0 z(|*LIvjn3qmvDp1i;jqA0Wk};c;JtcCj(1|H!x3zrMjkkO__w9RwE=});5#s2LPJYE*T00YzaAmW|r6Er;+%qr#ViPFCf1| zVTGL~d8q_Bo3LIHROZcg1tj1fGfWsfLiZLxibONVJ_x}OogH-kRcBL6fq95&i@^N~ zpI;7ukRY?AVgMRziWbB|R&73{3=l>DR8R@FG=UTf6Tz;dBt?0!t8^T@pRO4uFjFfw z@zxdyP^wYFO2j^c1H`TLC^hP2vurLWYb?z|g@Ds!s1BufX z_gWcAnSo4$e+Q5Vy+DRDEByATDF$Qy{fo*UmR8`k3HHqpMqAZ8)+6VE4X%dE9lPUwiV@xqnfTt$HPoY^L>H`1%gpnu7+Q z^P5~$*GB_T>7g-jtmswIf89p>__;5=Ok5*~&TS@dDY0IeI=Z{3GHe{5SgoJ9FL`dO zE@ZlG@0|E9Jw3cL_jaYvR1{oHJcz2UevY2|+#9v)OqQAo*q{Ghd;k6m*jV}sk$LOj zYPVSb8>{+eci+&h|2$=?O<#KrKnNDtwG_lW?4 zwC}Nk`s2Ey;=RV|M3uq~)zhKedOx%2QouGF3OfY7#EPwfzrDPn7?hKT@NxkSI_Q{}r;4`qibP9K%G*jOv_PYx_qZW&!#m->w-nf@7c-#@xjdW{>sxzmg(& z83EKCvWiAklpF$_(_7gMnVE|3()}rp9W?vO7vH;cY?Lpjr@N-`$+hKO@`k7XhpTgH&n(*3 zZJdg2S8Ut1tuMCid=*!0+pO5OZL?zAm6NsC#X0*t&%BtwVDvd=f8W;3MtT=u!X04& zWxss0Agp%iT*z;aKbo_)k1xMXj_?2ktn@i*c>*jvQ2h8auB?Kd{j7_B2Hru6j7gbrZVuu^ z%)MO{qA``Jlv)N4UjcL&XTUp>OAL%UwceszYhfcfF)+4V=y5nQ_< zcQni}P)WX${Fnha_k2R!qZ@H}VeFt~$X3l}m6kH9jsmV7UwUVbc>enDNE2A{nLlRr zvN)D$Ue}7_x|E5Dst!!SVObUm#~HMiag?MZ1cdk<^>#CM*xwbLAEiF-?g5?2c!b=v ztJAA7@u~y@ue`Vaq;D%?$?H#TU%#?QP?u2vN7w<(zuYBf<-*|SME+F(wjUCE`UKPd z*slW`Vl{lq`zRg8n>(w$-{kPzw{-V}CWq-MY_fNkQ-x=r(ygyF;qL2Fkz%4hcZ}wU z1@_w=Hc~n@mm45!{@q+gI&^=z&(!}s3Wm1WeVpyp3C>cEA?x*YS};&fuNiq)L-=O_ zd_D1w2{^(S$uiK?4=cZT^5ZM}C`!Bd)r-rwU+8Eu_g0fRA*--e+Q{!mbX6oe0C%DW z54$c<;)Jm8FxAM{qn&hFnmS59+}C9k0LjM@=%z zG?{a=yN=ww>xAO~=|Z0r)-p82a}qcD5Kr8BONqaV`=s8a#pb1}Kx zg&N1L9R9&3TvoLOlO8xpKz=6p^V&r|?jTmVqx1j?{t*6yr9%cBhT%u@q_prGe;oWF z*uCd204FfzCxP$I{sHj-q13PnP*etEkyBN?3FF^x2RZ~d?#+l*3S(crV3YnK?40o?!jaH z{5ZgC(EB6fN6whsDj&=J1e>wpp>nGBK{??(JkJ*1n_{cWkx zAhedef;11_s$#bb+5zIPZZwKioAL^J6A_5BB+=0AJ0#JHllbzT5 zHM#~gIOXKJ}Jz^n2 zPj@ec=om-!0#RqRNBYf#(7Cqs#K3w0PM7&?LVQjch2yb-9u))(xZ3w(qChA|V;KRUXrEX;V%bKo(Cy|`3b zwAE*&)Ar)l>ohO~emgD8IcUV+W~SCq>||xj+sjwGJnC_bQY5vk!{y}h0;s;cZtfeB zU0j#-9z4kL&VBB6+2d!TN5hzk&bgvYxinyzH5j5C#A<*B{=Pt z-F`i}ZFN8n!p+FT*R2^=!UJ8dceURcTa#HLPe;2W3W4hQe;$(WwC^*pm@dJZC6g(MaWqh-p%niq?eK zCqH@VRS-;Peu_^Pm7!=zVf^H`L#*i=&i&=puInz+ipT!_`&*LK zJf$1ShKblXj)uU&_OZ(DsKLn9&P};Vo&V2wM{HulnX@w)>urFke+z^S>QW2b`f+xXxk>G+#e_8v zBbEap;nG*GriH`M8eU(}n{>A&(MZkaZ&>Rx8!|13LD-=LF))GA0Lea8Qg+vuMmrv$ zSniZDd!qgepZtF6_RI9hXs8?3xN*I;t5 zRxpj&9-G?}AX6)mHZ&;IP|K07wCoEENI1Z^#el;_s6XiZ?qQ>jSJ9BT&7{9auJO8XsIY`a8m92n)q8xR>**D}b`?YFdfVEf)5iT9APSz}#m5L-K7B{p zOjl6|q7LGBi1;aRUxDRt0*$7-p{S-sjW?nxE92K z067;d;29rhMSGQ6;1E&W-PWr0s}{Livc72unxHz=Svih|J1Gq9Y}W!;;3{Zl{jOl< z*bW%4$hbc7@%d0O_~l~tw0909AqanLhLFXe3B?p9$n3oCaGpzUOR3`dK{cbIGrmNT zbF4$1iktoWXdqpU_u7826iF~e(~>Au+2$vNw{Xl@qkY*Ys>U&k1Z6WJNx24Z9YPu( z#>I=HH?C;Y&?z|5`C#Io(R8iJ91%BUc`b)RDUqS}ia<9huM*|cM3HPDCg()@8wh}4 zfo87n#3(uNpOMU2lIH}Huo)(1)KBS3d@QxJRFj^h&(+wN*Zr}yHkfIhxKM8Bd4%F0 zp)_4p&<9ItdG^6cRw#6Jm8v?QQ;-o{3S}CIHp04PdDTr<6B}8tscK09aFfZTS8oUy zXy{;wDW1)7q^trMO+#=%n{n?Bcy&#m0LRl}+$FFxsLDvXqZS=A)B4OXad9bc%XN;G zi3$VyuE;+d%N(4Kljvq{+}HL?2YD`$D-xa{6b-`>T(&bpErk9x=cxzmGPS7HOL>e9 zq;z~n?10vYwitV^E{Aj_+oBu$K~JwZ=99gTAmxFlEdI{>yU0BtB5$6f4#%bqnvGhF z=6cn!%y^1dI!rcVPwC6VUZ9Qku+KmjCbK@1QKx4jMhwo8%~i5=YY=7H7i=p_HH#R> zW@R*!Ml2@d%qUgP@J?+F{O|Ee&)fO1C!>jOI!lzt-`|!H3LUaR)x{`_mBV?;#N%fnfvnB#?qi&l+} z|3qG{*UO|_$bbbECH zCFto~wm;3%M~ioPX^8;>SIE_(3WCWHwn1p)e^&YhGcL)|69xN3npih~Hj*9{oA*Go2F-h}K-K-jxD)+CxQq^^-(VZ~Zi4jj*)ulHp=M#TPjeRfbWi8u@aWf#3JkejnJNL>?HmfBeRv+=Vct?-(%|SvBhty$SndA+!FSzhURA-#1KVw3Zm5yvv}6(qJ4?*hW)>wOi^GLSmK=g}o5 zpwBxm5s2_9o!+tT`$F6C1h^301oul@Pdwf?BWxCa&}rwV*5n^iqj#&tVR&apQi_$^ zZAwym`Ho#GA=YFrnmFaIP-&YC-)s%rB$)#}GIWU!lVY~nM1*wRKfs9AZ&9O_IKx4vq zC#K66y18PAodk%h$XVmmh_5SooSz94Tsc(#-v{g9%)e+hlySVk?+sSmaar^4Sqb4Z zeb}TGMRxigWE4$?Y5_l^&ZjR-qEXvaL-(c9Od2DB!g>z8%@6VSB)9^D*F>8lzJwuC zd!)R7L|YGo-v13Ov9tdd5XJJp^GZ`X6VvC-DBpPV2QYK4&fjE)o+!jHar*PX??r6n z|14ttJ`uS^BNnIX{S=h(UseUh5yMgw(!Tqlu{DK-^N^9f;j;;lH^MhKpfDuC3aWBt6 zqU=*2qpqW#udUCncROkEhr|1K#;IJO_R-ax7$e}kiC*dJC1@5Fc{hTrr1LWB-ASy5Y7z5Q z$}MmYqC!aQBFV(l*fzCb@N(!93uS=0KlJlP@zU{-htqV9_?)$lFh3VW&5?iml{1dh zxe7sXJ%#IrlX>Ucj-J8J1&%2mkQA?FMHuJli#VM}m)qXHC~J#N6y_~?LN+8yx$}Ev zKY{bQX!0@mtWMR2ZIRNxeD=;@KksZ~nIeO7+i^%_ZfFOHcuY@fyJ1w0DiZ^tNRtya zTSIc-4w;$p)4MM1teTX}tB>)Y>c8SQAcf-xsBGvMT`eY&(;@D|14|9v093@0BKukhq(6npgBW?BMt9$h>@bj! zAiy)Ex?UdT$1Lk`U>tsXPZ~BF+i+-(a>0C6Mj4_TD9{{Tnigsp<{p?HngoqQ1n)A~ zj8=<&bX$urO5?ey}{sOzZpD!E1g~qJKCv{m53`=BUIg{C_ zgc>R@Nt;cAkJITr9tAE|oDo+{W79d{E_p4M&a?YoIz`4^LQa~}N`rS>?zj4#aFtaS zoD}J$tqoc`9hl{?E4Y(1*xlDM{H>O@XskLp;V~6aiq|x2wB($Va(^6M)?6G?EPNJH zER=^TXhO<4w-Krt--CUJDMFiYL8Fx;J9kQ7tvKWYQn=;6qXA{XwSRECm!BA;$4znn zRCKE6tFh+D(46$5#8};(RKqt%HEBw!@<7lmlFXUNZh!mZ0Y7-wdK{Gyv{3P4aiwE- zpp{%PN#m>NbQ~f=4IQB4xl*3y5QH9*T|eV|tRGWZyX2@y!4rZl{Z_I0&+{xnWc?&h z!YH{!_;W!DhD1@wGSw{h z5SAE>M=90x2-*3uJ{NS;xCrtmX6he{(Xl~FX38eX$qgW@#9lr4L>$L9#>|bn>4Xpv ze;$x8vDGF7`{L|6Zof$h@*CPMZjOQ466LFALrQhl28%mfjwZXEM(U3gJ}*Xrrxa9 zAL0gXEfE-{040jYl?nSK6`T8%oL*;g9L&xThcCa|slZ$;0k^Z>?i2Xia+#*loIkb* z2ILYKR&#(fHB&6~kFLE#GpcPhf@C|Pn3OoVZ~11K0JFS zA(wjdW`C{<%#y|$YiUxpGBr7)ydim3=JfdDN*mCnjD`Bra8p_z>j*0UUd^gkG9XI4 z8*gMAmQe0xYn55`a1{ILO?uNXWg8xkHRj^IcO3g;?yn0W_vRVLbiqgxM|REbVqxH; z?&=eH@GA>0gBC5;p&5au5L53xk22g%T@M}kdg7t`swc1;8H9ajMnhty`u4dtsHY{U zR|r_yq@QZ83fG9(O<-8xc;xt5ZpdV*W44VV*OgE=Lef`7^rcgrx+GFTChj@O$de1b z?UgRg?P}}IwG(i>=}x>fOt-xLRKC~z*QU3nIW?9$v#Z_F{oc}ym_Sb#%*go-#F1_+{>d3^KU#PHN`bLI z))kXGO8M@TizK#bH03r|@~X3>YJ5#l&+CDep)$w*i_BJcdH4yB^&uWM)s%OYEIf&T zO}oz3=xbp(JKHVvfrwq66hfIQHsBu*SH;Y#CTfCo&GgOagpe6cY8I~o{+`v2YlM2! zsSkTf_OPkSAFL8^q^*s8BK5_AxVO-{|u{clc<{Xh1X@0=Pt`~PYw zG-*%7oO8f`=hQyHHN?*lAOPr=jI&#I7MiZ{a#{B4;@2fT250o#(ub z^K9IoynTbGNEAVdb1~YSU0eG;*l)>8kupj1qah{DCFkmS&4@j*?9a6}nQT1#1%{uV0V`QCi*U`Ii`OV+rE|E^} zay7_;72|s7JZ#}JCTT;JaZFX724-9r-1aZww7S^`%t1ni#FGzp*$gu{ zvdTb1?a|qQP8mwYTL3CPhYw}-T&__x!21l-n=|a7ZT-ZHu1w12+jGW(c>76*t`-WW zXP2jx=Oce)n#wJ;z{{oR>f2B0SQ3JB48K|amWL$5@BrE($HP8JEmW6}}|=c4aI#gapcpSBNf1}TmM&HyN%zaIrqIzX2hBQrPr;P1@0#s};-Lo<+- zx?@OwdLg1^DI@x@J#%e}JjT3WTk9m}PlG@i2o<13P2BRqCaoca5ts@xnB44qv>Lhx@x5D=sxJDq)4RO>+!AjVQJ=HG%S11S5Zr03^mM ztZaXLn-bE{`^C;47^dTGB+V=a$18P4{d^FcoohFq2@**18|u#x%BE+tJM9=YbxmVF zUfAL^r~23FhZu0atF{P(@u09>qQ2 z0^*-dn^K?*HvWtW>}l`14|4T@Z&GB{h2>89(&K?s9onu(>x(6?`rP-gn3k>)U+W$d zykGqg-NMr3whL0Z$*OYFny8xA4mD12T`GFLger-fZFxQw-ZcBOH=&|-fu#)5*IF9` zZVr4f-}sGFV_x@?&wxr&2{YiRoK-$ggq_d(lds{jRBh7M!;Ft*IeC=THLb1HPj)TX z4#I*n~p;p(TdJ&-@t-DA4?aY-o64$S4nC z^uR4KF?46CjOqCpCyD@@1ZTucR}U&89QF4_cEwy`@r@V9uZbshM*?86P(_>>KwVz9 zXw*_5-$d&RIZ$=5maY+VWi?b zM=jx(2P@tp%=u=J7*_7mopz~hz(y0d1&d`AhvZ6_oGHeD6B7_%=@rZb_A@^BAQHl~ z6&&+-sbLpKIeOv0f*Q)=9wPgIYm4^-0@e=`yjkzwp#he6e$C=0von94_GJ6VN8@ z*3E}2Z_qPQyicn(uViOZmelZyN1mi!C$SmPnPWWz#ZCHb1+{Uw7`^sn{`DC41?s;? zO!Yr=BULB>l;XPu#P+|^&0YV?FR>{G7K#X(0P37suwTp-hEv1p57_r`>YtE@CV`v=6YMVq$3Kue#p*0de+gFe zFL~&RS-@V_x9Ek*sS#{5`9PUYd?F(7*ZUdG<|=KFdO8zp08Nh2P$)`5hIlMpv}UAJ z1fv>>85vo@qY;Tb^$`tzthdd zZ*Q>%cxlTOdLJMO+Sm(s64j)SP|uHk$Qjh-4O|8DU3zV>axPicX|oI)!7IRe@c64z zodz&09>(9j_HTxQ%W*?~)~UXp&sS@??P&fJ0%|(wTVMGFuk?jx;(E zWht{~B%*@7C0&^`NP*Wo@7g?wA;f|WY>>0hjuSs1VRHB0VWD-TATQqwi4aA%>z7)? zBalLuW@Xb-w#oHNQf?gV0-`wd&aX^t&~+dIGBkqJczQ(wmwp<~0epI~l0HNwK|aVH zRjcNYB^!X3V0 zJe(pZj{W`=B;QQ8SE0_9$@t;ll-#= zX0V)?KO@W1-<>)fkvy+!648?8g%LcXbA17YLB5CEl?_fm`)_b{p(IB*cv z@%HuBEW`f8mnt+cIO_?eLRzsXa4t!Do{U3dyh;4XBbl|F^bLwtaM=}+U?d2&OOBT2 zQKN8?xh(&Dt;7M0sR#S-^DlJZ{6SL1aso2VVn+RQ()df2u5!7bWg*d>YJ5h{>aXls zLVaVR4qgJ=r^_d(M@WIJbQQh)7)R<%iNRG+4&w}alSKZJ zCtdhoQG7^Z2y0V^0@Q5xw~;UfiOzAU?vDlfR+pN~g)4u8kZsF3JBueEt!&g|H|W|~ zw4iGR0dL-+&FGawJYThf*ou!rt;OHKEY2P;3$l`;3t^mrWN&qsZ73mR!q)#(-YTXT zs^pn;d|PFPY?&!lx5iJuXWI=M(jrYB!@=_~pO?{#{kcZ)1Dg3f<@`Tm4?We`6_NtT z%JIM89!wvG;c?5WiE(Wene(;q{$F8!j@*)`Jt7 z?`17v)VMCC2D3sDn6+zqC&(r46XBAP;@bX|*;EFtZ0?E<@3GI^zEJ zi-{Xe(U3Cj@^s|D0BB(n)y0+Ab9o820or-jBO9*)w)8^ZY zBiSx;BTRY^e>@?jnKLX~<+|~swcqD0)pa<`u_ySB^)MIjZnTBawN3xu=fO4Q^^sLL zHC%vuD}XM#dLXV;j-cA+-{$Q*l-u2oKOY7a@XIMfPpAL12l#WA>wDO}kImepV@j@k zaev-Foac0-Q18@&MRePWk!yK-Ub@-d%XO%o3Tsgy_XVL@zaU`!Fb4aGYSlV#6&a)ugj^}J zL{qA&E~w!|1!mXt@dkLObw2ClxmwJwCYhi7t63b$bc;rUOU(W}B~@))P9VOMcf5T# z_Ffk#EsM+c21PO0@@>+;Q&~OoMwQUI>Px(0JQH48k>sVsB->&wJ_<8MR_b~ zE?-vV`(jwSrcOJm5+9ZwV@aty)Dc;u6e@!%#Nys9q(WGjQ+49Vuvl8Iw62B7Xxh=6 zl%L9N+yjkqJpHA~qkhPl$+{tWu)sP$t^~ zfs(_Ueg_FnP(hyVsgdR>}`r)#VgJ+U)}+z0HuW2L9ZcGs#+-I|#v`IHi?`P^@t;E5xl`=8sg}sACXqw=&}^dJ&RZo<7Dd=R zgW*iaU}n^(5i>Y?hFH2%-VOE1#ea3v&^9B~2sCA1%DF{7lfzo6dB5z-!Oe;kfhQtQ z*9;u_ipFYwjR_DOgzA6I>s_&ATr97IV-Bk%L-INhlpGulfwoCw^eg{4bMqMCzt*0a* z3CC|7+*Y(G8%M4iWHqRYhF*L*K(!Ff#bTGqw;xMkyTV!OvUJE!ena~8i5^ye6{;?q zR!oaBRf4y+`Kjx1!{{sU#xmjQ^iX~F*1m1lWfSu0d)OWroQoHE1^isfVVj1U(Gj?k zTqt9FDolS`d7Go6Th-W9(xy)=)6bp!Rm?&7_U2A4?gKCw{M(d({3pFHQm}bxW#&v zO6OMeaQddgC8lz1S0KBYdPK`pI+pw$4Iw?Yh&KvCpe`e-G!<>ldn|;)Nw?r9z9Mz0 zV{?B{=I7sphsjHm5@Ely_yNE3-z^y2feUZ=T7$@G;oU3_ynm-brYy`_#C)Yz1?IIQ zYLPfc#taLMN5wqU&4+gl-8fM6py87`#AcUbuFVl);J01%lYq_6t|*NIQff%{#}Yi3 zdnmB6Z-+T+0?exK*!0)y4z1Ne^2jt`o&rjQ7j8vJ%_I`yNFmsr;#U{MuevVvTN>dk*%E1!BRbqZ{e(ZaM{^d13P3&c7^R)^`pIntRp@X za?z2~xnyz}!>lSszmm`g;^@JY3O&Yp(L5T4N}|#QM;~}gGG@{H7cl^av!R(g;pSr6 ztYfm1k+vC>Q(6psXdvp9>N`_3{ucGY5W2;D{XUt&<80LJlAy4TBujQ#Ek(|P0Va*x z#rA-yxg0%m7&$^EkX+@d(9un#}Qi#IYI|O59ypUTO0f-RxaN+zt$P3gVUFZEk zI=&g5d|DkVZ`0nqVI9`bc5Vfs&()4AFO9BT%Qq(_@*x|6cS(2VP7d8YG3v2A>vdsL zH|Ygu)GQAOVZm)>-EP`a6kF}9|HUjaH}!O7 zk?;fEJqIlJlUS!lu2|3O?L^K%_i ziv`dZsl4I8OyVCyCp$g;7vnc0Nn}p=D5`oxyF=9TEzdE!z5S`%^HY>5nOiWpdawky z|3!eT`jXhQeD`6X!k?RB$QZM(KaCM_ity|Qu1h%ig2ps7s{NJMc2RywH9YIFd%z-5 zt{A`7!Ul3nDdC!st2kj0UHmQgJqCAz1Wzqe@n?a&1EC2JWgvn2V?69m%W=o_Lv-pH zcbzPC;X-RC$1&mhRpZ$niAJ!#Uqu2qsZG1GjPriy3?^A$ct^~AsouF%JZuYD)@b-| z9Yg+VpN$T%gp&ds3coC_ZpddcX&~P5&tLOdZJ7se3WHz#Z8=+f=_fq_AzN}@-@CI$ zL<1CK)_ox`6SIX8T63;k zac0L^c5Z?9ztidvb{P?7*4K}cqHj~M_>~hFf<=@kerBXTY9Ez=-20yQ*3}pSi zh3ve_vvOeUnUGYy$Tk55ox=cT5P0#Y;77jOwH+AATeyG*lmwQ_vJXXM&(x}DUvc%AgASkBSNqR7O= zihv+GnE=2b3`DqRyL7B5ES)DXOBa#W;RbJzoSuvbXo;9B7r;dS*I6T2EouQDYDXN- z>C>b?ZyffvK2FR1phFmaopBI^La4NOjqO6JFi!leFKUgU-@)Ulsid*g%~odQ{Twq` zOyFUc!5#7AA755LK*jXrf~LjxKlxlF^ZGaiqPf0C&s|Pqq6hnLfAQ6q_a*7~rUhFA z*h|rp^MSB&^LcLY51Q^&apAvLt8Z8q1(2KT|GQd!$8=f|zGFIfV7DjMvc0i%u-_IS z&XY9^{lAJAYp$3LXXlzJQV~gqgVVxJH>8x!44vU0QZ%W8jBf?=f_~|fX1E8)`-iuZ z-Z#$=&+kX~HG&L1A7_j@2+HDquXTFW>qr{%SawkS856O`J;3fHl_PWYH?|#4dV$i1 z0-b(jLzaT$_2SE&=71%6~MZm+iY~5+yjxe@HLi+}q{7ws=H#9^W4w zZYw(%V>1oD@D_lnBBTP|{VRu0*F;~fT)c=z5z;?;_k3BI{v)p~UV8LX0LI?E{<;6# z^SO#a<^RtM2WSib@6G`Agstr1Gd2=$qz@Wy=gZ~w_^<`dT3QT&87falcQzXjul!RF!FzF`#Y`|07Wf6lTfz9e`2U?zrSa6VXrj0wrkT-gH_ zpuEdpSAGPt!7efFFa+0Ts*KLOCIhjVy(lhni*iLbz!xpPzcqK5 zb;ak)osHVg1VgEEE8s#N%7N+6WUTf)(kv-3w!xkAQCS5m3YJswZh&>e5ZcTF%}CXz z{Rif117z31I^$!cyzC8+Cbe(AO4y7IAM(P$5;1XGqhf5$$XFS&+|*2MOtYe@jv|!N zY0xNT(C1?M;5AJE0ZmbXB~g#^1T+kPe+X5>>AhR$=dItD(85gH$tnq* z{8YiHmr1d-w3`K%M)c51vPLC~00*veROyT6bkn+)VS{gZi}Fv!XcVksob%^7D+up;{qCn7_EpZVK8-Y0~%n*QMvY>4g^EtweL* z7I0N-|Hbo9?oy zOj9>#VL7BBsmO5TKE(HJz@|r$N%Qb7gN#8{HbdCeEm^4QO<}0S|8*#IL~@v@1e^}J zv;z~~ZSwd%_SN(X6FAIsuTsX` zPpF|rK3WQuaYNziGbHLkQN{y{4;)a&MgB}6ztV~eDRx?FY_0AKhTm5fr}UHDD;F7H zN4+roCx>c*^Cw2C`gUFy;S|$YqjDIqJ}{r1?u?KBA+b0fWXY1*kQQ+z1UrS!D~3Y9vTaI8Cf0A?6QWZN=U)60hp z-NECJ_aJFk#^d0WIQQ>EJZ+eL*<~y;(v}u^I=+1YG$}UI5%Xa9v}TBsQtaf!GHa>n zIn@++#bx+O)aXQe>2-Ry#f=Odyr?v&A6&`00>pK@JNO2m`ayYOx;RPO<($PJl6i6} z{zyP(**5&TGp;Gi2JW0WbY(29qluERnc1US87y}#2%ibpWymb+&&rVl9waUIGwTa1 zS*pxSFlv*W|Hz@;Xiw@aFliQ5_U_|ow*UivY zspPL?5}@%%FNBq*RP?mMr8x3~+@oP+C{UX6WVWE1$(CB`0xfx5rCK$8%AGql$m@Tw z_D@r@YTTpfufDPRk2_Q;*3OT*HpybHR=}Af9 z=#Cu2C(roWl<~ySug)m8=J#WZfy{Zpf`jQTU%~7P)-&scwRH08Sz$i?Vtdm%psB29w!N9kbSWYECg81!Rm^Ov;swV2?gNVwU z9AE)dtx!l8p7m24o8j3Ge`-xGPC)B8-Yh#U>9SM=gwJ~N>~Z*xBgu^;O?MzL-~0K( z>9-IL1DDT3opiZ>l@8L#K8_uSDHu&d0J(CpCTwj4y-yX{!2^-YK94fqvc@7!8&ISTrv=!pU<1(i0;6b}*1_BSP%CeF#}6Wv8`%M{>F z(TY}VGW5Su&6XlsM?CXNc_Yw`M9N3~N#IH8fPxZ;yd+ZCzH_)!*i?{J2*P;`=qKq* z?Dlh>SH&&G7^RB!*u1G(WIHCC2fTy_ypGrW!-NCGx^%pIUhak1dL$6+7A@BKfCmF3PB&+X6FSC6y6@)nT$msEa~g0P8r)a9 zT3uo3WboeV5c$He)r=j@W2a)0vkew&rMY#G8@gH zDrG@unFYnDzP1(V`ab?Yk4m-`yR;o0u1Z~gh-_*5bH>E+9@sXy6no246%QtJ)t~*; z5M5b#4P_1ZGm4tB*_Ai%v!EjSlw@nyR3$Xihg|_A*_v6Oo%jlCrpb(?K^#rr2Bxn7 zmRZL=_4^A*|eRvqrBFg7nZE2(-8ffE~Y}!O7F__!g|2=DJkx051t0@-NbxCb@`Ql5PCk z0R^Nu0&kz=raI#2eN`*IE9a2K+OdxdmBXEdYS;uGABs7neem&v8Y^htAcn@A2msFA zmKM+xXvJp_aqsq|ZXk7^1Yi<=g#MH7P#x#A5aheMb!jwiZ{m4xW<%;FnUVj% zLU`G`Irtc<{UK-VjquN$M9lB5Mcct&r$yY(hPMC2vrRz*sn3Y>;2#}ur&-_my|VM% zbTNW9!wK#K7e_O|sOjmsB}J zkHMt)fS^nG6KZLdN;jW>5L{31v0&wOk8j7vtHYjg<2X;|M9a#db)Yj3AWGf5KGk6c z=m)g?b2(-8(wxh=;3xUw`DY3~7y9F~qUVx8;MKipx}T~+Z?2{CwTyI&We-iVA8neE zbjz7@+c>=?n#tq-@uTHK*&$e04lAmDa zHL2W>Ihe`QON8#)`?_8=mdWsSPpO|V<2lcDn68B1Bs2*#eI?4CfasqKzm6R!Em2y-g!MsZrJ2Z};LT*`cmh8!+*Ax!ktpBo;3ws|5@AglW9( zz~+WPaELg3lO8A@AQ!XFrq+r=5sL8AM`Kad1GADtRdkfx-xT4ORMP?7+T@L2Y5e4( zCP$5G{PH8S-QO^n-kCOpomDtRF z)Q^UNOG|52S#*>gNf)o`+NnW!%YjqN?)4f>tU`k3+~sWmcnH|;M<#htCg@k4J@)bI z#E9qg9$elM!-#=Hxxm_--uBrv`+XdBJ2x8(Yl;zPXql^HIq4Is?$((X@R1-XF1jWe z^D>W-PxQRA`b=79dT)!+<>9}?R=vqc$JdlAy4i_ru&=s|#vYyBB{&au;|fV_z09C0 zB`CP}DFLbqP>h*vCay;L+jj%{1kVbWOx$Np%8&TA90VBsWcW$aMG>{fDUqtZF^x`<-yY$&aaA|`Um(k z0FB_PH#yycsYt}S_Il4oLvE{eEYRS?g}J^SVdaA&a%H3dnMiX!fVM}XSop5-&C|_3 z5JLZn@NHo(CX>z8lLgOQ0@UO|@@lSPC(kd@Y=h(o6dNkyQzk+VRK9{x5h zbN1jDh-;S`dEeb1D-Vtf2LfqwGIyyl?^-oi$LX{W)quIx2AX7jDub@tS4zu;ln312Qv8-z4UDDgr9y{$E;*DO|eQ_kMD z5YUFA3v?Q9R2s6x9Zz3yDn~YXEe|dtGi#=%f^~U}cLag*cWKqJ-H7 z5T198ZpcF@BA_P+VK0@>-Ysmgv+bzv%uZG(Ob#mb2vAWF4b@R1m%2$zJti1K0J@#+SpgJxUkQTI`=|H?&}szDUVIeiv8 zWEwt2s-WRlwLp}|taRMHe4qGr=O{aw_C}>BvApUD6wvL9`)%AI)bJ1*QJg0tAcIHN zp`k$lS5_HGkz+HSq@ao9q@Fdx(|&ZF@$=uvpxg~VnlEkzmNV5C8~E9nK`No`=e^T2 z|Lz~SQ;qY(MRfq^teTqBzwQvMdeNO{>Ei;5q{@lM5U}|^^SWi#-|k*1VqZ_FrbGk` zo^us}bI=SdCkq8w8}hwGov{8V9(tO8!IVxR<-((%5_zB}7ciTPN$u*PF-FVMK&MOC zAWL8~?64woj6l#Xx%50xUn>TZa{+V%Grm&+3Ac{M*+w+i5R8@6HLkrEVeCdycYE0f z-JwlaGBGwTFwNWb!|U2^ro~aCv7{bJ?hx2p^At?Y`AXYLPgcs`_(awK=pl%z{2#qe zFG8C6Nfxe~4WsrEu;>FndOyS+3TQWx=e0!9fR?&aW=V?*D9}~7E%DfhDtjbZ_0%Y` zu1;-o|Bc=9g6wVdVU7&5S^k-@{f>nroa{56C5)D|oLn5WB66+vfrN{HJjEto(6;8@&G&g=O#$5w8;3xBk3QwbECLZ3T>1L0LA=V*~mKcK*w@gDNC zLt{h*?<>QD>UxOKD+PjMAEYMZ;xK8(ts6LR-*)9ULRw2l&cRy5c zSbh7dl5Ic0kS(*s`AAM<(!2OxJn$)R3S%6kX~(kkY0;%C0yt$2rj0;B`yrau*J|=m z>+yKDA-JqGvqgJvAyS`R*V#k5sY*BgGS9wqM3yM+gz>NEMz-@;!)(t`mx4cwWIth( zEA$q2dgdPDlmpq4oCq)h&d5l}85+@)DQ|&MTw^C-wqF-ZQrl!VfM11i(t=-#H|PCY zA?zu9M4-=_DtNV&RdFv?{;oQOVYbpRX>CtjQ<^G+^>|oD?zGD(#vfw&m2LZdM<^bY z;?cBwdlkyH3_g=mHmF5dg+(A)H|vhtr*rH3 z`OpEA4Blm>80i5apChpkzc0;maC!fGcva*54f;O*=iNl3;P{jfle}j!{YNcOd-VQg zmthjCEO)x^=ky_d%HdKiqoS_wN810(K@;#FL9@XpjOT*3`&7CD1jsZl(NFwTJfS#= z2Cytqv<7H9W+)DE<{%&i10W`zmtLylWsqFEz!VM02d{ZVKJWqyMJgjGzC-|Y=;`q< z7ID8~O34{|rI~1|sA06#K@`=O2q0RMjKF`AXTIichvr&%YhtFAUJP-7!Q$CX0XD1# zKs?~Y^@AYF{lGUp%|BA4e6{-Xd!9pH5`E$*%rfSBZ7&2nfdaJ2=rwAvC9b7QLaR*u zB$mTRWE(49y$b98?WjJ0nQSt!E#;zgp=M%S7fCQtGJyFi(OvD&m2{1EG?y<6?ti;V zy{VS_#ydnCNU~BX2EPV-z#W8_0v>bn`E0~i?j!zcyd-57qzee`DSM6f^#mBMhJrN&aPaeZBxiaOKnVstEx2P_wl>o{U(NZ}wwZm0p_c%IY#5*-08 zC+9-lvdf=VqndG5ly_YtvNKZJRgGyEf@O|1%uLOdY-|rZFllm$F^Cg-0c?VF6-6`R zDeSZY6z z?@~ohg7}Ey+A!Mh#4F)D0dAdBs>OL}1kQa@3hi9P3FPWa=#;KG1Fj+&afHm4&FK^~ zOY)tP(2anLl=?XqkzfT$uI4j&s3P);>Xn}&14+d4Xwb&-mIxkvcx?>!Pz1p3%so^a z;J1~)zia!WKlzzrYX8DfW|*}WflShZiTN(&h+CxHs;Q}}-Bog_09HUjn0l3aVxWj& zz^dwC^JEJ&=J(x9sdLsdq@GM?4+6EcG+6LVw`Eq*36+qAFwJ~-zL*h#e|P_b1|wN` zosJ9AS&|kM=W0^8oBF8j{X>JAh^Ff$&;l>on+~XfZmGspBICuF6;*0Hyr+0N5Av|K zc_73{WM8h(e~iWh0j7~E`Js((zyzg%=zVxoI~sH2Jy#qQBy30`gW3)c_Di8=LEMig};}s8LDJ7`x8KR8zK&e`mmZ}*4RpjuQXEJW{@~0t@7O$jaK$!JOPnFnuIKL zug53VqZ%OnDbU8@SVeB$2e@?$a5pF~OMRsp8^W{|3KQ;~aGPDVhB&xVEaK7#udXVr zkyS^P?&4oY_j=jQIb!e>DJ9fy(T(b(i$bOn(h&dNpJEDJP0;X4H?|0^@j>|$L+?gk zq=ukhi3E}AI)5HOhEybUy6f}hk?Jf-vq*Jfj3v;I36d)3#aFE#XmF+#0sP8mFMNC$ zB*Cl7SSIloJaNTZR>LP5pFl%2W^pfg5?uU`3bU$9eM-}-{uPuFjy0z$+2KiH7-JGJ zeZsLl03~HmGOvmrZ7)$8-S-$mubdd&FE0RVg@w%e^H2@GPr?WH#)`cCpQBM6HQ8bg z51T7kxq|_{uDVlg^Q*&r47CWqc(z zii)*Kn3+7}zLe4m5${^w4f9k`+R&f6TG1U-0FLhA7rAh1WY<-&U;UoumjanUF10rW z4q-481`)$M#^IcF&no|i{ixY=9{lJy5@s}51KIXMraJzbm5by_^#*E$nL02!ly%=Zun`?GP0(+cByV?u zm!17ORQNa{(zKN=Eftt#z(K1~~%B3x&dDbhUE5nN+@gnF3d76d8fFG;Ns+MV5{!GBc`P|v%s z)NBm0CGOOIcumAMq=-%qJZA-*ug zQX#|Ssio_~_*ur7~ zmJjzew|IsBugGX|tqG%&lg*zuEzR@{qN} zb=o{dB;Tgr^jsh5FZUrZ=wk4C>N(y8BhO}JZx;!D2%CQXY4_J2)5ysdfLM8_0(HL3 znVx*se=9o? zf&eCt#%lvW&{c@ORp-BYBGd+6Ft-IzSw#^JmCJ|H5ThsFST)z{0ZAn;+buD5meADG z>&f%S%e)^sWSmpY7dMfOPV0*T|%-0dh~D_;>k3%of#){Ne|Ab6Eo6$CV?bNwGY<>oNI{ zWCWJi3UZ+t{oma-Y6W#jcNl-UTM-WI+mR?eOnub`873#Gz@QdqDz}2b8Bdm`dr>v3sW->)4pcZzz`va}`k> z=J6#5u|nm}TE*^*&bVi4p}k(9;l6A9zm6@aR4-*f0dZlc2W-Abo=grOJ1jK50$^=Y z9iWeYFu&EyWspsexv?m*DfyaPF`Y+N-QcYZB*10xZEl=-wvRl{uFH6kq!l-PRDUa5 zhRE_A&j*a_rBGBygiq`iY7fAX(|5xn)WnLw#GMH-abIBPn<=6ZT^z5? zN-SsVT#S6em+|T&(B%5Rj~xZ7@Ak^6`YF9hH z^)w?HDS|rJxd+7Hvx`$pcb}87l2;n-q65sEGh&=4e;1nRUI--!zHZAu?b;9R$aQiv zfLL72de>lh3UV>{tW=D-c?jVyg?si2dx9`=c_e;uaQyi@Tn!bw29O(ETWAI80dGT}niiC8qlFqUs-_HtFyypPiHnpqrrx z#g`Z?VyMZ@T+|U+6A7@fFB)t3($VG%9@j0@hbdI@8pK+CK5RSKHy83jv?#H*OV!oi z@*1;G?MLs0)*8`yAf!4!drc4Xv&G9{`F&sKKW+-f>GQ#0sOiE25R|~o$wEK405(n* z*8jcs+Sb#F$K^=-7p_n^whgJ&-PDc+=9o0`tI26p(#M@JNJvmBMYX0AO0Cqs4e;e3 zu3T|U?|}hYO?8XIIJ^@2>FMc7e0cIc1CAJ#hZ^^dl!evLVA7*(4W22Q$2g0)(i?Xk16dv z?4xpJdc^B{kS-uHS1$<86Va9SL|dA+mH>wb)_#x6To;x^yPEbM{{tF`n#50SE-ws} z_mR1X!X`q3VE6CNtW{i44%grTc;^h8HAX`9(Gzk%RWJ;6tx%0VCk|FK84OCSFmTc{ zQc!vYyxP*2&An*iY zujhbLixM_c>@El=koBMR6t=X0bq*t?z+G4w5}hh(<%wVeX>{>LvB^2qBZ)2FozZ{f>Ual_^q=*XF5xxP6 z%G!_HTnIOTkt{+vCPic^f)3F#r#hb_j?{>u&G`<#F&A|N-Xh9T5Qao7&AuGN-b@-P zEG?`;$g3)ZB{URvk1Sr~kLU$mY_-SO6T-BFBgc67n~-$~ZiZSxW!f2MfOU+BBxNp4 zt%L>8Pg+e5ZIlBJ0lW}kZ$h86VORt$!#pr^*+$lbjoU_Cd%aWzs zFr7j}pU3zv%`arCh*HJY9=cOT&6s`7=$rx1>!Wjjy zrb%}^(O;;Akt0c5Dr+UtRDj?VOARtDmXKr?NRB=)amZR#%tN5h!`8^X(`zrLsh9!L zwUCw`WvnYFGYKKrV9QI7GTD@HJ;NvCeo-m^J4nVEeM+m3USiynQkkPAK~GFOiYy{V zby&ch!?`kf$JTDjYR)m~l#w~X69Y7d2^EJabu?21gIGz8Np*3O_qirbLyldg%aava zI}?bPGhjWCRv1xsxgO0cirRoH973Q1SsW<$Sk@>`#0k-3p({Hee4>2EB@Dnxdg5Dy zJgQ<$5IDJt4XP&N!Ew=4EMn5W(dG39tQh`+`h})uY+gn_heIyZnBb_BGYUWxD3AC5iv0e$w8ujD>SMsD z>eXo|yMk=BBg6`3-Wh;K+T7R(BhV2^WX%(XQnoB|Fn#5J7 zqfK-E#5?r9rEeCvMGp~SETa-8p}O+#=es%)zdkH2+*4K!%8`3bNgH zy1QY9?_%8c{utf!`(t4UEF0nW@$~rmc)y(kx{4Uc2FAuDR_xRt+X3|9ttNJDdMPty zdV7446A!$zgH0e=4#W&{E|b<}RAIwDKmIz?Kb)dH+ZwR& zy`Y?H{qrWtD%;)~@c@vc2gX>2Jq$>dW4O!rE@IFyatGP~MkSlhYxwE5%PY|i0RKlq zfchhGm`sPjuv*{Q;9(KM7gEiP3Qu40#9pR2;?s}8*Ht4Z5lr=u zwFYK{Y}TojYwHHwizxG~6@9t-i$Ru=e7f}gEUAysLUu%SE5Klrz9RAYDE_c+*u}P! zR%#VvirpfE|J(TuUzg8V0jrA|tpNI)7f#%^pykwpbiZBKy~|eE^5Vgbo_Cdi+r`~h zg^I>X{xX3bSg{+psa(v1ZLDT_y}?$I>(zOG7{*19Hr~bsv{!1TN^e;E3V`7E+%!>z zdKk+jT|y0`9U!`HI+fBgLeQL@y8R)E_~ipeZz96gmCP&QJCHXt$(UN$bx+Ij){knTn5TP*hR5{5}^z+ zOU-WX@|e>2m3`@1Qk9sOra*Bsgf(bN0!7WRQoEE6gSvCb%!xVWGX*76qbzDAGFdn7 zu@nb{6@VYS0_Z_H2?xuHkP>!W1N6lWlYPkdM>EW5m;djFGr#H=Z|zDKXI+(FHRfD| z1tcBpD6HsR1fkWs4x`Q-1eP3o_5j$@^;l!2urOiv+wLvV1-<UTa?xfYSnF0h7sPEVZ^+?V? zi)geq!(qp{kAzLXLi{``u|GHwv`^CN<q~^cF7Z*9Nj$JrxZ3CXv(w zmvc#{uAAMieV8ec;a=RAS<$`M zAEBWOs7Z3YN0O?{#cC?KBU2n`zhnxsYQu1rFJ-0)TMZ*H9USG4CEJ))7+#7e-83dU zVSQ`VM=$N_^^i*h&^~1$14*z-X*WmT+=Ze)@68Z+hB_9HW(INwc{~i+6v9=n0AR3y zNH)_F`$6=0!JKQcnd;)MH|Z^*XBQuL$!%5NDoZrtb^<^wUqt5+@(w{=4l@<=hm-B) z!(RiztnX2yvJC4!P26^}AI&A3a8rb+A@rl7HdjJ*=mV9I=p*9B$U0naQ*Rx?VG*NM z`KT|VSLBixDJu-}v)}O3`=4=9fjtYCKQ4Y4^5+pkF|nL!#*18-vEf?v&&$SaDw(qMsM7SNX%^l9+*v)A9?Ys*pa= z-WqB;741*IYVGp=RmPMg5k*fM!nE>p@2b>bF&1-2; zJstDQFNN!~8rRIKLrs-ZmOP2Gurt*S6D}wc=@GE%rm_&~SWA^LxqzLo@*}(rhGvsU zpxEK$-wMs`w9IA0A7c`NKJ3;h<5V1jIQSOsnlE4U?$5rD?c$QG%j}^}N6le+IqEgd z#M~u%Vw6PCA0N=_gX*Qaxp0l(*u z_Epk3zR`VdGSa`0Vq@ zQd1$5*woFx&ym7vuPKtPhs&y^roz?-h|j53{{f{49SKk<1YAjE;|LS7FYa`ZX)LhY&Wuib3U3 zoJ539E%8m$odCyHl$UzdCTv>!T%a;&LPh?jkgYadWxJtnA7@{xt0{bRub7e!uqefb z(iU*G!T`&I`n=kknDOQz)>7n|*lHV-Wkfp-1!oe|7Fv8VH0neJTK%30Z2mSkzui%D z<4tkXW*P|#k|t7E_{N(~zP~PHQPqz}+*3DTHsN<3o@?hQzR0Ns$kMX?i>!db1j?w2AuBQ(8wLNp&%F8T6) z(yz4K!cy5Eq2ukmt*~-{HGJ~0>tDq5@?U}I3Z z4+RjicnIu??Whz|*xc9+>W>%93LGzbTMBLj8UO)X2se}Kg;+g@L4f}f>k4BVis@hh zgo$%L+4=Bd@){woLQmnz7EjhWcV)+r@gw}%d8b+(l`i;tl|;`K$S@&yd0dA%D~97( z9I>lDThxk_S-Z2W%d?Rb_n$cay$XJCJ}q`ULS7D8+uihQZp69eGJT(=%8iseR(5Ir z9?-IN=6?LSRz3XdZ7E{9q?ks@QVoj}9huohn$C6V(7KNERO7=*jJudQC|SM?j+LjA z+trLmKy{zG9$zI0Ifog1@f~7s<$j-qT~1OQbI`JQVO^DO0?tA=@La?0nH7&B(_%8` zERQ0@B2r(xIfmraSQzX5gHt!uB9BU>8K62FMdI|}Y8*V+NR{qZ!^%JCIBegUzyl*U zzYu-*R{D3f)hh2sy{il_?D|ww#UdbV$X_y((9l2~(aaM{&8x+)AG;`K*mTMD2U#Cn zsgqW2DTeFAPxHFXD56It+0hP+0^JzV807?lVo$V9X1=Cec8-OW+g3)Rrbz^M67as( zLijRvN+xA@E?D1g$l|*4fML=(l)*o2Z(082ZiHQaIRQqr@Xcj6cU-a=GE`VyE2)R6 zCR2`SxW9)3M>k6S_*4I@ZF){!4PdY7Dxe@K z@xothqs=H4M}%AnRb9##l5;PC|M4+bW8@()guqw0m{D{7KCpFmaj?dgzs^+96u_@H z4F!;vfiDWU{4)V{q0u!q=l5h>>3~wFULr@`*_&3xk(ey|tjCS^dE(gq0hex_q6;&b zJH^oPa;)rjtaih3gCFC(2uK-2!lrBc$Nilf?gfP0=PrmE@w}dsz-@S_le2R>v{dIyQ;rPiiTAYAvx9p6#A-NwXa+(mY#X)YI9l^wOSus)Q!8d$qq zj`j9AOhLcovX`IzHRW6u#acenb+LD<E0QoUz&>K<2g*qDCO6q$;H;#d@;*8jE&67O;n1rXzmFdE-*S@Nv+6o>I@d7 zU|V$kY3l9_Hk5w+0&LiKw@@`sV@@^Eq6 ziKO4f&qa_GmHa`p(;J(63iZuBitf*?jsK%iWam+p>z}$+RU_TDWIEOY*AOp9IQ5`r z&On6Y1ZsW@NSmQ%AA0eqQ}ID3+j>iUo|@CW_hM6ki%H~^0caGI!#22}T3ps+Dir4F z3o=bclkj>6$+`z#3-{5Kr{~0MDJZPkM13y(33p~|-VT3vV`i8Kbr3wMnOde-)zb`L z9$W3`j?3AE$7;H~A$D)r{Q^!;f0{X!_{)Bk?f7!qC#QL6Azr!1&&NkBK#HDtKepDA zB*V4b%EBE<1jx*rO2ps(WA?kxA>9=M6_m%UH&?64RWUFRJ2jWhhj7)b4<|1@qd8qx z#w#&L=)h#brHEOk7C($#ul7+YqYTL~4o(q{kwwfO>&=B&JI_doz*;YnaIIC(edur0 ztdD>9FhKJ3*cFCIAlpNw<|jjHdI-67#M&#JWXqD$r1safF-NZMgWtXb-c+Pv8bj@%UQZ znfSWujquBCHG>ClFYfY$+?;oR%s#|1^WVll*nmTK@(O8@Q+ZqeqzgYEU48I&R|zb> z3OBSYjHl^9TuD2ZZiY=i&rWV;gNWu%4q=vhkD#f~xr6ZbPKP>X)6QQps6G3``FsW} zNxA$y&2CuQU*`=pGF^M5buZ1OsrZ_^+b{N`YbWG{XE`AX$mdSI3e&;bnWFefZ`BJvC*yK^E^AApACI zOhCjUsJGf|RYAI)#$PqhjJmQmB7LZCMJ9$O89P1usWRJ}avtU4rLz@8@A{3VIh=3Y z#Yz~Y|4Vh1PMir$4#vX4#GJmx2!RJcb7eF{+}m99WARl?E$Q$?IE)7D4$zGkFsoEf zi;K{uN{d05_%$e&3&=Yry&}r%=XOVv3@@(UzK$}yzFwcdF$l;5zO(rP(UinFzdUnh z4MWqu!K4FJ$_d*5ev(wnVluw!`Iv@(2nfZc+Yb+64Fo3tTtvlta?#Y>sU!e)64P0H zQxqoJ{erp!~!$@A@6B-=9p*|4)JdaU}Y(5fF6q?kR{~(L>B)mS}QXJ;g z3$5n=xV)d9ub!%f6psn`8wmiuIcneswOQ!>AyS%`haRqTtw53S>wg{}9<#lYn?MQ^ zhMPcnqlIGU2KN|R#t0J=KF*n{yZ^!R@k7S?7-ArDGjlR)h$EXKl`g1{N>ury(F8P0 z@7g(L1sqC>`%BCGBzJ5XKHo;&t@5?>cmo&<-VW|O69{~R3yJ2-x_1FHiU~piY>Pr> z-Gck*1Pjinp3#1Wu(7B=tU3#GNw2;P7%;fe)R7jd_vLqTR5UpVU2kQqP>}8?I$WA3 z_*7%TDfjyR!T!-+i5YSEh{Q?*xr*$qO?FNq#Z*Ajv)aV-lvPx}95B@X3R)!R?5-3I zKvmHhxKc#72;oLKaYO^$iU$6)<~9G?)MB>x1Ab)kIy*VXj15zRA;R}L``3SuycaS!=9^inbhQRiU^ib0(r^7IB)8Mtg52){0lJM z$U3tlf$sPShp$v){RioVQ=$uv^%msA53PurZlvbI$UyH&mcwd5ZXZYi6`RvjpDas6RNZ{n%AA!t(H zrhc+Z({}|mnzmN}fiWt|4EER2)PU*IqqoUHPvC{pxuTTZm~s=A%DF^4h};wd;m&2k z3nKHOBGY9)AL~)#2CItEq>^3nK&l;%*Bg}xFiirS>3{+@JAtfU3u0-EE3k97>s=!2 zTHd)fggDI@{y_hB%qt&8)jpu|`Kw498-#&qOX`gGL$seYN^JL+N1Q%8CT$KqMGu!- zkIZdbjD-1xxOU29DzQ|RxL;*f_fTX8krB?E`d2R`?s%mRwN9&z+tg;0sqTc>T4Eh9 z->&GCsqH5KZW+4G5Fa5UNrcieZ`IC;#zyY>ey(v*C;W#GHy6CCkS1~($oG+aDrN*f zoDxL|**9ioiz)Q*eLF#1y$U6e9or}cO}rv=XwtpPa=(__DCQ1#N{gX7C!GgpN^N7{ z1GIq`tk4hioso3SCcJAzU|gT9IBL1dI&9W^lAQ$L*w23X+iuOIC#7)iP!5(bcERUu z-7f#}aYwEJo1bAR#W-#-M=lkOOJGkCXxAs=MrDndS^wnC?$c5|8l3kh{ zg7XeQ*g07QOL|0hf$w}b(@T8{OM;d8Q7xmY2?H;g29`CR^`8|coRw$yTu z2I+Ki@T26I^0V8+TP5X{8}8p^_{ZhK!YdoP6V`Y!E7_x#7NJa!^6$ytx?ui7gHtma z7eIxLPFtbQ*0FtXDj953{#P5spP@iGl_`|}I<Vd-P2@T^F+rP;RfII66mnl_^mmW^dvBLL$A!ZED-;)ri{Yr_4BIT=sbP{o1rb;IV z6wn70^in_@IJ_zWFS3U#&B=dzAWpv3Rd&YrU`9!`{UZ!8hkgJ#A5gyzPg4o`2{fCF zOc*}418-<-U`}9Ps^Pz03*sG>D_`KFxuq|mdN~Dl4kDJ=VTozFD-+<0WVmBjzBkqsQ^!rcXdrZv>n`AbV|_&7nWN@1M#t{9yx{DqMMB6!TB+CB z!cT`ry>AMvIOb5HNviZ5qe?A;IAbQJIY;RvYAXBiAx@I7Vc@<0ro#A)mfRxa=|ey! zj?1&dOjwgKBZN0nRW1y~l+z&uxWc(QTXM1nJSP`~wu)0i9sM4E5yu&_?4W2dpTN0g zC<4ogoFr zRV0Nu-fCV@s%}W{@*5AymC4S@Q=_N;O+hQ$WM^1k@wZDwNqm%9kA(>tK1&D-e%+$hc}*QQ@8QIbZk{rBST-JEcH_3Duala- zY^&Ll8|6Ucb~KS_adj4i3cr|P=biW@FEyra3;tos%>4nhMc4~VT(ZvU=v1r^>dW8N z`ka!e7$3wIVZXrxY-X(tU`HArB4Q8!TAu5Km<}7fD}jUTJWiM(E{FAa=|S?iVv3#B zlh00EZ6qf7H~?oCdeRC}@!Yz?s=}d?)bpbl?2QLR6+@RuKX&gZ0w z7{H3KeUdlwDB5}C816*H1zWa+PtZnHEv=M4xna3p_Jo%9{FajtQjDx*-8jH#a4h2$ zY0#kg+al&Lr8ABmkgZ+SqvGb;m&y~K5KMAPK?tHlmZb2YUKCY+DoS^AlafHSRzHLL zs9d8yGjOs4xx=CqAE>g4G!PJBMY*l%DmXgB63)MT({}l?CzL^Z;S@PTuG^;3dg&R% zzLqowz31%CNG=WEgy}?ivLz$oEVG_{eLpjX@r)*GZByI^5RAp^xJJOjTdea!*-CLg zYo3o902iJ17PI;bVf}9@e<4_aps!i%y;8n4HffhG7e)-DWUgOJV&zg<(DQlo9dVCq??>4x?>!tJI*&U}&!^E)6)g}%^_QUNgUugmrufw*61AZZ5E%W=fb)^r`_r3Ozc}RfSJ6w+d@Mi?&9r&;%(7*iz*TU z13e-eTQ0)K`YHC+U~JTQ6kUp1$Byg;S(0$@NH{;n*Mc4)U@t9Lte%`tu0epl0II#| zDTO|RmyFJNcMAeoGdhqiHtVT!eAN8z;G~@0Gl!ARn^W@U$hl2n){GAfFa-(f>C^!+ z`C(B7_(mYM{ZZ>8;Ke>QNJ@pi7&>(B>USu9<1#*La4E;?Ts1T<7~on>8s#m{(m!o2 zC#XBwe&}gN6O0BkyqF0w0d_l`=qx{g5r5Y9e+xN!bG`O-@<+Fg?6m6mqb)p^quyo% z@}R!N(&umEz8rwO!@K^e`(TM`ytE&y1MWou(A89FVJY(?IT?V>8$%prb$B=o>sacvOSTK`dE8Wi*LHyFmg`8to0ME4( z#DA{l8!5j?x>g*aNYR|A9ecKlhBqw;mDd0n+m@CAX|wfmheoVv4GJX5{QdH%DL*p+ z`07FrXT_poc_57E)=x+@f7OnzU#?{uG@s)l1RWA)s)@#T_*I%TkE>T;$jBC$*(-T|XXmB5aSZhOg{AG@@(fObqZO6^%GJ5nw_{x14}~uWl09|`Af?%0 z&^^k%vAU+_k=13FVQq#@JjVDs;cRv#sjMG7Yf_S?v^!;Jf5o$?*ZGPiI(R-90&+V3 z;uED%rS{?GEibCe6F$;hfg(dF7lVgOXq2M|?yB$Yl}qsw4!l-Apah8nkTxhh>R zzoo`852*_=aJC^7(P#BhraEN;EYM{1ZJW52rzV+PsAO2N4Z2jELC|>Cj$nCy)8|a0 z@Jx4a@46sC5jDjztylWTb6W@*xy8>IS$0tVS!KhPmu)=O<*2i-S8K0)oW7tx?;T=X zzQ>w^x&_Q@TaW*C)tNP6gesFd^S1HGIwi~RQ@*;I$1Nm|G5A>C(S9=~Za9Bi75E}N zy~8>DKiX9$cDD3;5J)m@b~dK}t>>!IoroiyfbaRBc>;xjG(jvV2nO~6+8w>g-Vd%U z$%#H??0tQiS;LZ{SC+uQu}*E(94C5v9iN^e#B6u`gv6wwU-3NoJihesJxp)VfFJ_g z*Zq%4=+D6;#CFq2_yJzt>+4`&`jht7{l0?+F}OeMAkU|JX#A5LHiYky!vRAH%x=oQ zicgc%);oOr(B-|uH>n?#0SEr~)9Y!{isp{@QTo*NuE4jy(gLFe9}MyBofqoc=Dm%T z94Gfy{_CsspL`_1=PF?r2;Cn5KsVz_-r!pTq$TF?^8a~+>i!!^w)#vtJ$LvI`ONTx zI|@2>b}q`Ez)8nC+BQ1w`%``QH{H3Ss6@Lg{D*C*nU-3o+e* zr2kli`WPgjLqDOs$F2R#B$Se6vc%cYuP6fDY>!&L|2xm{TPFKm7a;zp{(1KAQ+((n90L6~=Kmv$9(j8zFA6EZN4nC(|e% zBg-Bo!<@@m=qp=hXm$SE{xgMv(gN(Q>HdWI(yY49jqLo7*&U8EMmpX6q*FvSl!7W* zOmXU7;7J9*dvwQgRet#&!%q?1>7O|F|Dx)fqBCo{Ze!cFZQC|GwrxJKI=1bk<8+*k zZQHhullQ+m-_07kYK>hNwd!VJ&Z+UCr&cop*q(on$J0~m4#7>2>-5plrRc7Wi>A`~ z%MRz8q2wWvZHJ42TFm26rq5Io#=S6vHv^VjuDtd3aT{Mt31_bw;on`T6l#;OH^(4= zAhn-nm)1Y_3Ga*HiNr){a?#BvkG1c{45OyGQiB#l&Zvzu?FtgKR;9LelNr?*6WQlgApp21 zIPTYhXEc0et1Juokj_qR#{Cok+{=|Zi9KYQvCklpMgZh zPGxm>IMPA^a|mNfo!M6c@vsTTJ<3G2OPlb}4P+R|tK#pK1dY$pqcgV0m+c?LQRIcO zsO}DQsMa=-&sf$7Mp#tij>Z1T&KudrnN`4zt?cHvrxm3-+7BcpS~(AS*8nku$g5RH zt%~FuOKu1G1Fjxe6=SkQZ!Ct3yQm#f8rqWYM2~z-7q{e{yQQcubD5XLNaD&uslw}h7n_xVkSN(*pzu^=t^)( zT`q`G)IHNt-4HJd4t?mQOxH01V zipvfmF$UP=qb-{7`dx~ zu)rhroy1otn_3*#BLMJ#mesP-$^eHti|E$3vKEGBQTY?6^V!j;ZYAVilblY`?#T;Y z%Jm|xgIKN7U|tINrPkLShG?;Ix0KOROO=_%2{vB)8c#hB)-MxzWYhg8=nL}E4C)Zs zkDNM!UUcqcGY2c`fb&mrbSR!0>o^BT=IZ9gyhB`bb@d#jG5}3Cnma>QiM2dMw@sns z$YA}|yYdfgTe3DKcHVM~h4BN-(oiMpI>A|-BuS+vwk^qdRVo4pUbSRxqihzKaDTjQ zMxYH7=CVK1tGav|0`?unkgDxEBgv#25%1`?v4zCqG}bM+prJ@|AF3dN2Evf~ZpUt` zZX?%-3w!f62O#9=X4I5H9EXy%z__1#UV>c?G{-BC!y8B)iCnuZOc#i&^k6rK4@ipCMz(UX9hY;4bC z>#k^r2(Y%wy2NM`yDsnNOW6Y}$j0A80qEd4jab7+5=C2WPH{&1M98fOBXxl=Y( zb78EH{DrzIj9=~zod6#6-m#k%y_7vY1NlqrG(e?UU{6zt%^R!Ua>5g$JTO<84Gn{p z({1MJXzeQHC99=eaoUxN@ByUeHXY@SB2-|Hoc-Q@L6huEdA@T*5j|z}AR^ywfpGEGV#kTkGmcoV));j z8@ldvb%@>H!q~XttA-7645mwPhvJPt!o329b-y29NMBOg7kh-cF<5DCwq3fRy(glQ z^M{G%rfYIl-@3!wJ;3{+>xTNx%Rf!mKHbA{W!Mu%6pEJWJ9gU?lw}e>@+Uq5Tzi{B zsxJHe)p;a+9^92^O{l2n=aBqN{1~P-aY?$UBl3VW3S{-1Hk;jI)0m#rv8M9t~o zNGS|Ua;`^;3qCnivFeWbZM-KMr6OHq7VTZN^((LsnoD+_+^{t@;G6*m=k&2qgyBlR zM)4>2e266b${xBZbG>MkOK7>$MF8IBIsA%TK?-0CIL-Bm&S-1uO_M8=GVbpRwqp1? zEE(VyI4H2}h*Q~Szas0e$=K7_N`(75n>Q0iqD&Oh%Bm~#BBCqLjaR8qfcMQ`ZncX! zXd9yzyfY3(g*IWM(p`xF}&g-^vZAUSk@iBQ_=B7?A+;BBHf$7eugaJw<;FI zmT4nuqCg|;n8g{T>@3RVN&v59?`1!DdCzjGazQA_aV4mB2(Ix2GE zSA+HneR3H0Ys3wy=7{U=W554;T>U8?{AJ#xMeT02Uf&_RnA!d+j0b^7KO;f=Ib`D< z6ltgb-6kV)y~%DVzm*I#a`K#YuI-b}7lZHJ{5!`+A7WBp*5b0)3?C4t-Bz||mA?}d zpr}h+858j|n|uMQUPcAag`P^ODP`oPWh6`!A62G|+-yQ(#I?T2m2{;LW_Ug$6i!k} z7yxKw<8N-tAsb*a2_w%&7)$z9kk4l+e)K2QoFvytT2s3>ZVLQp6kOHt3KNgVTWoeV z%PuopyX!C3zdPgwt{Xt*LbT4UG2d_cbem>y6jNMQh|2cTH65SlOPwuYJEWgo ze=(Ta*^05>V~j)aVfvOTMl*4^GBxUf9F!&gM-K}|%W7gSOXJOS&d z*Ze@{kF3jZ7>hsj&QXMpS}SKufg&8*oOz;o=ikSAo~H^kds@TVU$A}#7JHV9{uH{; zFbbz{o{whlZ$H|{!@BLLJz+r>q)p1bM%d1}31Cfv$OZ6gf>4#nV>N=XMF*8XlHg9= z^M!*Mu$PaYrk8+}r9-Yj@6Fs3z9e(J%ZE>F3UFy5W26HYxBO*YCDn5!SG~204t6>F zpuMX)XuqWHuIN4lc*IKmD&hMWqcGt4MVVLckl-(IA>{L0!Ei}Yk1@b6u% z_mvbysnDz08v=wnxj(~XGOyeZx_ohr(;9vGhi&+QdMSXu`C7Lce75BmtrskcUqkw& z4AkO3V`2_7t-?v|M-f~GnoPu@=rfyA#Rb`ZU5Y(MM15q^@WING#7xaF_2)3=n4+-J zSioVWW)lTb_KkLHdYD9S?*>h%|0d88e({Ukow$>cF-P?&=>e~9w~BU6!xv``FB+Dk zyNXus!4&|yVqo=@K_$D19c>K5fg{nC3Wfvc-RR-<{*89u9lSZ?YMF;OXr~pQ@nJJj zy)_yUY0!?Z>AP#z?E}q7UQ$2oxNG8)8X;j82-z}gaf$mnRb2255ifg;wf_P$rW$#& z*Esx>^KJ$|{qO7aTMTDQ|9_KBsQ)PQn3*}a(~L~P$pI|?lWaDtwb}njg zpBTB|(~bX9$T_T_XB39l)l-Nb+gUW=KEfg*e%mv0xGr4>WG01An~0Jou0lEz=PUB8 zI@~}#A5&q)-Z{3g2-0vAJ=;SAw(6KK-GBvs6i^HiI^PI)6mvuqC9no%Y_laba8Z<9 z-L34Gpa}6FU=PNV7A$|TfD4ui;%7u~Y)iM1tTAf*?L^*On3}=!6B65#aM_d($gJ;4 zzBJ>yZpjRwWD+TL5Ifz1&i9zpl&IYd*qTilynO~p{?a|5iiz6*EQ{}Aw8njG4 z40OFM+cd|}p?`MDqepKCR@?>c>^$249P6x#5tHewvv<_co_`HvCgf8T{BJ=2FP=;s zTxoTV5TXFK|54pt)U$Kg=SuwY|JO%2537Z|J=$*^kl}Zlv%cA1*x`WK+Uu`mOQA8G z>YJGD`nGJqpKLjwn(}Y~l-UKrQ$XFI^{7^_B|Zl;-mHB9n`+Zy7^U2M0Gj}dwjyF3 z3u0hdql5%&LI>l#D^}i%h*|j%1aLxs%K%T}2lvkRMiJX&k|vi8){Y@arT3g-m+|e* zfOj+Q4Fwa_U}$wM2><0s4=>~08{26Mpz2C)@m^Cv+UyPCPC zrJACbu`U3EmLl&`l7UK|5V1n}E#qE5=UK2P!i~As7HSUjfTd&Et1JnZuyY~|Vm&D; z&CnE>99YVQle1)le81n5enrfg*dC z+@&Papm6O+L_G-cN&pXoV8fXfFE5$pf<04a!_hXUV$t$OlAA@W0id4%8QQztz;+xk zFEz&u4rOHts>2!SH688=Xk3IXp^ zoieQk0$H*5h~p;%1IG9yK_P3noAU1ikXOm;5hJ zb|OQBIE5U*z;=+b=y=d7vY45W5W28oL3gp{xCo*adiwIE6~%hPq(_01)o;jzi9^_; zAmDX(FrRjVn4P%jg5X5sDUB7*l*B;cOSx8D!iwlW0vkyd06cg0Hx_K9WO#Z?Jg?xn zkT4{Y!G;k*1%U|#5x;P&gNl}V*}&vQ33N&5BBJPAiz+0r!hZ!qfK(fgIb!gY5rsOc zKvnbG8ww1Ct65iNk=N1*ISH<Dfr z&@A(3fT&axl*%+LWz7dp6GV~W`wB_eaj@i&-=xLw02Ne)OTxyHiwcJ~ZZ~D7g+>`* zN-&-(31k{7;eW~MRqEt2tJT=}CUo}XxP{=4``I<@X;eTb@0qgTqh>mdEs@Nt3kL&r zli^UaJZB(e8$rz1`qbN1UZKn}C!P;KGK)=>vP=t3eb3qF@@RwUU*M*g_$Y zzFPiu0X`oZo?Esx)i*c&`8M2M9?}}TJ3kBTm%3l6%M3}shc6KcD^7>kzuP~r!QZbs z)&)1eJl{KBF5bUp!wGM{&F9_TpSB$w2*>PQTE{gWuiP~`*lX837H)$L+ytp}tT5Tq zoj^u2;AR{vDTKanH$A>N5Owl?TkF*l{KI=C0TfM;6{ZC;N9i>f1lE>08)(=mYmooJ zl02ds8mHRfVv)S(4c^br>GD(UMpN(L<|A+y7tP%rA(7vOn>966cFO2=n4B`!;Y;lh zRmJ0;_oBe-(@fxgS{5AjVoaz>M%b=)>MRXgQC!vfr1QSVyL=lzvt+Mq*kh`8E;jyB zsGK1=sirMgR$Nyc;6+c9!rfdel@td51(3+5h_15K_DYjG=H}BIE8~IZ$RZp z1{=rA#wz#wga7MjEr(fyF>``bNb7+Fo-_O;YjIe%g~G(}ieA0dSvx*`@qvxJR<#%g zhsj8!CF?%g=f$;0_s54?t`@54QPeuAaWbjdYc0@foPo#Swaxa|%I0eg7Px%^zl;h? z@B*dTb)4JcE~Yvy&K0QJmyT+!0O0MaZ2jNoS6oZpN7~iXu-@$sVEOy4;QMhuy0pFj zA7Yw*0!wkUkt*CC9o#ZDc@t~9t#L_(fiLS_SeRp))NCtEeP=>8RxY!p)w#Tm>m!9z zIE88-K6jE=F7aY^PUDc^g8Z$T?eAJrR(=*qR07<#MpjAYPKPuPwO!%+Ilxv^!Kq1q zw@lc8o{lW@S@e9TWz=S=zx8J>OLGDs`od{a1cQy&=UX|M_q%)Rwf6eAxjF_RDuqd9 zfnM&R3L{z4K^G>)a66yL&d0NH2g7!n-ju|Vhw0?WgtUO5gIPyK9_sTXR%kKoAJ5X= z?0Y$zwwX1hF=i9f$LEI1Wx%$kcyqV8i^wx}YoB=>k-7Fy-m5&3_o=G=+4fLTk^#rt zmcZUBaK77QL=p?**Q&SG1-6S%I z23g~i5_i-q!F{9XgYQfueEYUTs_l-YE zaM>GnQ?ZVt+2K--?yVZ(L$ppTj4}AI9tW}sI8Fh4yawA2z}&I3AQ-5H1j^}ud@`zJyv2w6vTfEC>+`iIUUK%rmMUegh(>{6pP{_ z$S6$)BA+g#zJ&Czf&qYvtXbpPe#(*2T_z9r7Xl6WPv5`fgAd3IR_LE!=sRoZmz7sM zg3j$SM;Qa$XyQ_R49O}PrmW`r>!PcF#b4d{U?GOM=0A_yxP9Iliklp5^>ybulVOQZ zSn2PQqY}a_boUAW9xhitOdp<|TawbSP~wXd$V^P>YF2+1d;;EdtEoQh2*<~pU?qV$ zbS*|$VO_?t-K{O;I;ftcnsJt2MzGwALw4?2m)>eF;=zxZ`v!WDe|Yd+RAH>J}yLSt;CiL7)ji7+kbmizDVVRE&(g`;!lnd5$oKIjmxil73E`pabG#8^}=9@L7-_Umzux|e=gVA67l&N zF`R;%PmNeMvYfh?RhJ}_u({NKb(U@gZG9HGu=qm2qIA2f7*5t%{-4E0&FRymtlL;t z8%Zt1r&AQMlhF{)#g{BK3xm0wZl&|1)>hgmNmL_w6(BAedOQe_mD5;Sj;K>G%qy9| zT0wov>h3=!VE6HC@I}e(gl|h%?6(U;+XfFq9O{^nIQN(9s14$k2C#v=z>2`!;eaT4wp-`9K$P#jnm1>+kR=u zUz0?O7r=4^#!)r${QGM~ljYY$KRyMu#l+Tk)aTKe;-kM{Hy}72ms8isXSbA_+-qX$ zjKlqBV2?hr8dVr#fx9QnL{vugXgKEU8j%ftt?<@k(A(Al)II91BL3e*%;qtOPNLbP z+Fvuhm@7Z-v{2Xy4pp?q*^81DyP=80DNPRxSpYAk!bk=(B~L#mNvjc85e44pQ*q`i znaz7&E7ofZFdLp8X<{~h)3N+&Xa~dkUJbtXMi2fIu#>E}`&HB*Mf(;aHdPwiDx>XS z>0*WfQgSU;n)~jJRG+BsmeAUd7q~E+TKlKO*>tkuwsTf6cCT9ss_lY7#bjsV??>t4Fa-L*RZ*4_%SJ6I*^{|sRYQ(^VB za64z>+YeoaOg`NkeQWs>bTk5U6FXf>O(W`w|NSfNzE3W0B9TFAGDn>W`mYcF^m2Up zuu?zI*dch-Dz>Ef@OkW%Dd-v_-uq$FNo5d}D^{#mn zg~t-W!FEfhi8eD4ZTxE7j<*|a^L_}NUV2Znb$7kX)~{bvdW+iB{CX= zckB$o&RG$?WynaqKgCk=OZE#Uzz;~6kGbtrvQXXM9}i<{ zv}#tubT_Nl#if-|lRYKr1P=FyUgcIxE0z&$(w`B>AddR^{Axz+w4Ix)8JInikw!o0 z>3c_m?aKDg6hZ^uEe_)>%NWEh`Qg26(?7N9f5{yUHh}h5zph{Y7cgUJ_Wpp24+fLh z4#372B?tbTMX__3au~3Ww%_CvsCK~)yV4+ouM zC+dE7_@eV-=S9a`0rgW>S`l8sk5FPeh0FnuWr_}_p0;K|437h=am4QV_q_RCCRs3e zyQRa_6L@E%F;)6`y50B>v){~ick*I?gJs^DnKu2ieEr#2ilFG(O71T2OR!Kqiib0T z{Aw3no+WlyT(i#iK?@*04!@a)8HK&Aay=Dpr<<4}_x#Ao%Ybt{T(k`WT5BPf@4VnP z#J#2Z+J|Cf>g@fh&GLiS)!@B`s>R=Lug+3qg-FlM64qMWjpB?EC-DF)8q#!T77_)V z+E&wbV7P#$gB%+va@(t+97yeWonePeF=xHYAZ76H2TsPb6fmH7cvfpxbdX@1hWc?< zv%ubO9ipvgbBuFSIpNx#%Bq5ZN#}es_du7i!~2!2k&)WI_Mwc~Zu&S-sG4U16*&#(MsVa=xdq7dM$LX|#Hmd=J!WDR4Q$kEE$yRSSXpEi3mR$`fV+0jM2g<8$nut{ z!o+-SxuvMR9WpSJ58}(i(cL{QZfDC?IE7V#ew6q9ZDV`Byn>LQ9+?m)$JZ7qSk6Lzya^*v%Q$DXoX?@ zu7GAIH>vz!eUz!Q8G@>I{QZ57k<-6p6MgZnpaRjSl|2P9PO^x(v(1)Hq&TmJ#O7Dn z8q(OtjvD|mZ=~H~k_Xam4-2mRX1FfLD&GXOjNTZL@jra^+SbAG46CvT7e0 z7?$T!ZIEEF;F-%L&&M~xSefx}_3BH@7{3z^`lVNwl8ak@;W(2|56)+u?~=|Uy7Vyb z(nm5e=m-Y|qz~J|0o`llt8qvb&A&8#B#~4(Rr-L#`F@s~T5fPLVo|KXqFlQ!L>sr| z9Y5~H{*Ek2MQT3n(IUt@cqcrOq<7KgGt$)}K8FMn1n+;s@PsBiXkO=we%mv;KY*1} zQL#dw&F)cJ^DRy(ZY~UTO#^g`uGm;{16KToPI-~zJ(mcOXEZWpHE9Zk3*|XL z&;y{56@C`C2c1MYNK_WsXf|xLdQHSZY1~zSZl&AobE( z^n%RXcQ)eINN~TJAW-<r@?^p5>q#`>xm)SkO=ThDFQTZeMH4iKt`@|UZ8z1sW=b5T>vqe9@biN@bm5^T9&7MW$ zvk$OZm=Z}xv-q(sQ(KcxOXUvU$h>i%>PFO)G9LXoCYO8$J>coUDM<@FYTp1xLT|qE zv!C;PcPW%@y1oMgb?9trAvmc^0p58pxg$z3=>&>+kPAh?;BS@5nPM>tHfYu=uMr4~ zog@X3qz$tH$?VYn6oulG84(EV6%p|nzX1}@ln(TFmf~_lBGtQhY2fl{CQkUGBvnPH zm0YQr1DB>awx&3}9G;b-1n7XQr5=>ltWrP|7)Jxxg&b5uC2$tBNOlEqDw8b{-YFCD z!9xV4tYZwGfp?_Cj1rb( z9UZeL9dTizcoQ9W%%n2*S)yCHNNJA{D$5{vRQ!D1iIg`O&qIldT0Q_QB?tt+91XQx zNL~bmy@#=kCtfYm0{W&(tTLdRB`G8>nei4{24}9b8zkUVj0T~{l>{BqF!NuFVu zb!@lt!hcHr0^u|Bj$$WmT?aTb=V(YmwW>luUAYhg@Wq2r*5y)^0YHdJJH!E9(l@s@xGbfao9I^c_#T(UnTr?LTHuBIpeihy+KK@ek(6xayur&5+a zt>9m7YK6%4Ok6fbWx$au;~$AOh7PDgMBVZ?@jY7#d&JtszR=Afv9>|sU{4&qq98tL zJH*VbSp%XH7l-6eC@UQUjk1QP(1dR{FI3|0cG1A?E zF~umLOAZK{j@(nrkdgAX4%x>ivJ3o)rMDl%Cu7Gb&=03u+pw16$ARc$^#^06N^JVa zsL}oGC86W~S=0kD1&)v@REHf|- z?*Z5gvVy#D3knB);_2-N_Ti5VPfBz&kVKYp`+5&b$E#Y+wi5@m&D3M%TCdcO(zm8g}Et`h2f0Eb!GxmwW*!Yl@$YL%t zU zw6K@XjjgYhlWu>juBnz$aa$s9xLIZ>DE0}!?k%t2^3M*8!NhlhbiXZ{R5!-`4L|L0 z2@~vl^42?T7(Ummqw@LdtnJuKkRm+2t#^BBg}%P)Qq+wQvr8NUuzUjJ5@SH9u>der zCw$Ver4KI>>J&G{M)Z^Ij3Lhs-eW;wzY~t~+`PQ7o)DCdO?L@KE7NgxhT51fP#TwL zW}2$v#F>}4$hJyg$@vQdKss>-dkG}|D@fUQum~k+M>Y*{v^*Rti7oQggcCc{rp(?Z zni4m&TW+>(9B8othdMlD$*2#W%nTq@dc|FdV$D3O3;~&l2}mi&->p=7hp2wDmGf|$ z0GfwV3tmGmZ6cxK2wEse)jJI7v2`MErsny+0kMxgPN8PSoV;1?4-zUR{0xd@U;_kTOAHo> zaUGl?GAw;{SC1K8DvQ$0AqH%2zk9nuA?n@{;b&A-Y2HrRo#FI%)mQRmns@G&uIxlF zE|MKf(RAs_kiOLUe^F%P;LWyfrBgj;^16xSbe4~cUb1(Q*$u4DMBe5$6Z0G;@{|t6 zpO7^(of5Be7mY70R=JjO&;iWI9wV(#3;P%?pPSP>dk8D5vNol0QxG!jqyGEtEs>`f zEiIys=#ZR*@8jrob*)(|YF01LW0j(2`_(vY);fs;P^svzd|Ie=V~A zYmBk8bNtsBBTL)=4S^3}=j7u2|A%XHbmd*h+G4t{Ys-s#NZAyE41_}Z0fwAUJ5~LV zZ94n25{l0u#RTEc%Zvmx+GAoQtg_uyREf|ah(s^()s<>CU2*|V2@^93#|J1WH4pGlPdHh8Y-6_5Y5i#$txTKsV@6XD3ZO+nii;* z1lO!FQTk9T?Q^RYiAN%DL)NmSiNtS5$W59~E#*B6&n+9>eA*7Sh}y=iSl1LryHS)MS=NOP~u%ifsL&Y>;=hPz}xou<6^>NP3E4 z7x|2mqyD-Q+nrkGsJ-Xjm-JcMoi>IEPxFj9iZk-i)U{xCH$gu=WirMXGE%f`Fjrn# zxv2nLV?s5+{j8hzfT*p5ennaMEISI7KTHAA1c+JMMGCz|RoyzR!vxrsmL>AO){!;W z<|x}&3oK9WtsxcX#q-82Q)DqMr*S~|s4t*zhmt9pUiz@RO$S3|`^zCPmxCy!B(okX zv?rkWr#|}0fOp#!AE`77ncm7h!5nSpQP!H}(htWZ&l6)exbVMs#E^dwtQLyWdn!YC4%3y7q^ zs1mdpR;DuXnOX`pBW4zc@4#Te&kg~mZzM!4M!d59V4D<{l_9$F2A-@Yv_A)7>Bt7S zar^;aZYH(*8PL|jp@dSTqt1@Ji{iQ z&+Z&w6I>(?p5d4+3ylf}iMo41^23%xO1o=Wcpe`X#DV%%KL5x_VF(~RH;^k=%0XgZ z$VccE66srFmNP6@Kt~-&UWhJgU?sC$QeBO(wmu;zk_3`@hR+33ilROMD!0w01WLKg zCI?fxDn%0wTDj|~28t2TGjkAUd$Io+TsHaIHjwGZ- zsqjUY(pXFecH%VnU~VLq(z~vlbA?tG!gM}CsdkU>A+y~TUTmjE2++=i^7$NKN8B0q< zCALAD?Inn5n;}3GFL77M6UdLAJX%(QUGht)rkbB1W7Vt@5BF1tB?KqU9QTB%P2z`J z(&T8JBCp1B(}Z`ruH-gchhA3T)wVV8mpIC=!QviKrYmgB2s1e z6DX%tb%jUJ*yviLkXy?MQ}2iNPh1caQ|0iJ%`gy>CTiwR7GSd2P7@^9&heA1CO<`( zs{RrHAR(5H;+e3K&?pu$dyhfJu9V1ia%QP+Scx3n(%9NywP?*Qqk)O6`pN?Xule8= zxOJIY`ZTlqg)D{X$3a1v-KRhtSl9aY+&_K-q{OwoV{&+cEEmu&TNMiaqOFSX8HwL} z2A%yqx&?ExyTqFQ+s8`QlV0S^mpjRJ>lp;ZX+R_NlO5t&H>_n7Yd4!N`@w)|+ijA9 zG_2Kx_I*Xsu5bG0%Ap_Ifbt?tvULL-GPW=XLj_EliUDX@UKBv7VP3V*X zplp!r_gLfl2=)GFu&<6xgfw;2$iUD{Tk0Xvn*P>9F7WW@N>IOIDQaUg?sA)xsZlWE z5B&}wpemWU%^dfQFJlUb33+4bdvFXeB`uiqt)0Al=KZQ1#*^a{IsT=jS1WonM4anY zNt=P3o1XN><`skMopgP9QnJsk=?N&stD%nHzm+?A2%tEB3A)PC=mbTK0xe419{-Y=Bj>=?Pg* zk#i?+jg7ZQfT)LojSvF^X)L=owm~00nEhHKqO#-s)o*yInXP>!db4KpR&CeVv0Gx8 zAJ;J0M$@}BsI$}e9q@9RhyRk*RB(<2+97h`E7q*~Lb&g8r#fHmPDhs~U$2LglT+)S z_bAe|wT(AludUCmrv_ObVDA=e`||K7$T9--(dXvwZ){KmYgNNw)eY~wP$P?5CUR?I zjl}8$cq#kL%)10ANF!I{;1SJ=!W;MqpP$8-W&^6&(si-9-grh;nB{HZRQur84g`u! zi(7oThLxW$bHvZ+xw{=I6Uy8KijM174)`pVX3vix2c=uFz=wYUb0MViLSh~N+(+_L zHVt@%f}To$;<6-*C7)mRv(`F$XhFb!XnGFv?Q|D&q($i*dx!1nwdPrKv(n zVe$*Oa|c)?2z&AR2nid$-~Q>Ji$a+*45|I+LPhig;NnK>6us>J6`*#>FVD8 zWgNX|z>T(F`UMy(z?y$p48l)xj+T(2D?UTECO+1s{n!Kp9nOO7@%N^-g zq0%F@nnn|!-{snQbf+!^z5UzxC*HuZO=I0^)PoQA@jG_ZglRNW_obuknVy+mM2apE zcU0;xt!mU&oOLB3S!;Zv1j==~PlFI-me4Mbru-w;}re@B8CvdN{2tocVUQCGFTDFAwkz zcmp%Od%D}dUyn;0u0_lPczry@l`V%4I~Wjj^M9g#e?L7v+_ldzKl9!(4v1Qikyidn%qaFo_(d(^NVXRLvC`DF@I zs2-N{w+SpQDv@~?SuV>Z%xN7o$4Xs*aJOuoKW3{JoA%VGcyUg|QY3pt>eN9NSX@(q z*pt)*akvioi6k=yisbfgGpJKlXJEa0eQphlH9%&5Ya<2J6eh}*l^+qvZ3~fpqv#n-2gV*%OEbH9V#H#{>0)aR- zQe=NzOcY-m%SJcp_CM^4RtO^4dEJR@F+o5McazatT_R0DiCxj=S0wEbXwpKFf0 zOlJZyzhE)Mh&^&#J+b-g})FPJ?S3KveNB+OM_a~qUYSzYfUF9P z9&=)41tZe5a;obJbJ|59j(DsJU|S+m70?wSiQ*$fNp<~!b5A|$lIWq6io@V+BkJ^$ zI9&yv3o zATA>3*_1y7%6)px!72dYyY^yb;C0xuR%N&PUBOS5u-L+9!kzoDtaG3%(I*c;oTP00 z04~oplCAZT>3vl5If>3^)tz;TI|Ox-A{l<5t#TE_08WVo#lY=sexJ_J=oYY0JZy(u zAkU3j7|0&nf?d@e{sQ7HSQt_^VRDO#*#C~b(SDS@z$f#;0bmKkz;Lq!kpbJbs-i<1 zvKFEOq^_7eO_5Xmz;<7%GjDW1erNA7;Ewt*8!gC!Y{ZC419du4af9n;pWip7(Z~3J z59%(Nz!(g|LqLI2V^LvofeQG@B+VnF4a%Xn(jPgqY+5rJw&$Sta&t3eSt*8^ayZqg zyqo?LtH&lf0i=R#K(&`V%$~HJaSR_eo{0h3`FTpLJ1)2FDg2u-uCSGDx;w@&jg%WZ3 zYaN6?ByNFq=QpF`_*RNI za~M*x>tKXXiXl*YGc{I#{UzMX9_@w*@A_XXQ7G&7MB5U2`_y(F_%|at-q6WB+mZ|0 z3}Z?iSi?rpYVf*MV2lOZL4?9w0UUMB%_Gl008*aykr}&(hel6&Gg2=`Ef~WK;462w zCm>H=oOkM*FH2iqN|XAedIzW4ldVGgVPmCQZ4QAhk8_(6Pf9Phku`}5^68zSNfrFO zuA1Fd>MBi9Ufe-vGKX^mS&ZMfEh%*KB74juyj>n0gOd`2+*I#S!UV$H-vR-j#maQP z0P-rk!*|XydjWqmDz;JUs6p}EqzaQqgcuYDw!3SxP1nrg@ZY~eiR&GzN8)EVM|iEC z-R%cY{#M@ARPyKyst%{4C0x$ALY4;C)z0~>t2d>85*L$aAmhblprgd~ zMzekTAbY91$G*HSGhAS{9SxmGd!Q!r19sh%5(IGWA#E<7yA%ZJ>uFd0N9_G0`JOBo zM4h|)L(wc1AO*xO%EW=&ae`4*e-BS6e-gy}#cfUo4MqAx9gDDz^E=9wJ*@oK260VV zk(g_E&3by}J2yC_U7_RnZn->KVU#NCB}Vyp;QIddKY`C=ftaD7 zsu*IKd$WTLqXy4a6BpA}(2+A&1Hb^CMs7b-Ts|$SYMK*42>2Nt@wVw=3_3Q3Y#7SIASh`!wi{8QyN%Rg!zldJ zSDxe9P+ULLGMt7{e!>y*IxF1)=}2A(SMo3=G9X@)14KlB70OWS%JEm~Gtf!@=Dp_l z<*;-ue8v^u!e5npuD&xV5`f=8+683-i&#p`a$qgpExQW+IGW0i$*Lmp;n9A>Ewg?f znf9K}j*0f3&4pAdwb&t&{QG+G1`=bI9f*q9JWH621rWFOTU~y_6|ima1CA#B&0p3=-hpTAvx@BSLNxV~HBWl* zy+RQ-5)fzF0BuDM8?!sHonpfSjJ?2=C7obp{rFyl+5Vtq4kS2isbh2B_*Yc2sJ#}{ zA2;iK{=ZMUfvfwS?n{O@K%vIR#8z63lRVcYcP-XBfAjq7;6*%6-MxAxHF?^f=~&y| zsPCL>i?JG^n+-H}gGOL*D8CBs=fs%Ay}^#Hl6Ab{0VJKF;DzyO;Gr;5Rs84kxEaES z^O#tMcR}2k)u8CZr^SfG30ez`;e;|norQy1pOZM(%8cL%(I8U+lH2F?rMQ00J-d1O z7&L#+xo&eBo~=hq8H!AhEQ(F%G0bybw`{m&XPC1b6adfFt5@7GoCSVQ&ayDu*ABGM zyg&sk>o*nVflSw&Q0iN&$_WCzykA~#&zFa%zrA0+?)%s0s|0R8(6^@=>eH?b@|bSc z=Ud8J(j?;gN#%2zCo}34DBfnz8%4EnP!a8EfQOY}Vo<-y22yPb_%J!U-q@$Dzh; zK2BYJ6FQ!p-=rmA0i%MlaI^nc=_Unb;$;0%2Eqd{ak2mZweFH%tIiuEDSpqIJN1W9 zYNXE-P~iYWijSQ#Y>x-g3aG?7>w-WUYc_*x7Ze=~6e^X=h*Vcx4}*L2L=^}8Ba$r3$(PXGlBw^shN+kZahtRrSBoGcL5g4+RyAZ(tqw1XE z`;6Ky9iws5SdDEpR%0iP8XJw-@QH2PMq}HyZJYl%(|KpU`Mq1d0X51#I243d3b0n!;Bz5sHrBI+?>7kEO8&e@P5uQvS?}VamaB`Ze6k`ol-t zKrW!$G?OH_zeyjOMDKepVy@zMNid+Gtal*BoZ?GyA!9%+Obn!iiSv%E7=0J+HN+WM z50+4jnLhuw;W|_wC>kNSP`H9Kqbe|NDP&7X1adNoNoZjn$(uMSUx%Yu6k{}}%|3Ui zA~4NwP=q}~!S~e^e@=a*^;qKU2xEef_t9d)d1QA2zroHP2S%j|Z@@{Eqw)YuX!4Ta zNxQf`C+d3>T&npnDXj)7Kggru;?ILyO+Tt<1w zC?Q!0-gWody$rS|EkaUmGE)s;`!9Jx6O%EJR-IMM-!D48N%(wKn1aNE6b>h-76=&z zZ_UY9y=LfkB;o&6ly?*~p+W;R24VYX?^lbVeuK$`3<$%t>it%6z=Z-A7%Er`H|$CR zy~-|0=Zo20>!!pVlZVRF^8kYjzgK{02al#-?;8xM>Cs#At# zm;(bT{dZTeT}VS|P8noigjx-GBrpIjPeDj#0NG#oixe5*1zSb#sEnoK*F()yzqx|j zede@!-}sekyz=grF;wvT1R*9IBI=^_`b_b`Dr%0Nn+Q`ZB|owfBhM9x-kSYmMS7He zU#JYiCp=-iLPODNUg2$c<<{PNDD#m+QXEqJwU9Y9D0T_0+7>vVwi~lAw8uIhz6D$rbT7ws(HbK627oRbmceSa3VJFUL|?iuI_bGYbaa@{ELS-R2k$s z-@+ZzVTWWyRvxw3Br(03?ZgVWGHUvM&b$*=m!Bb==A4rE8iTr~NS2fe4q0$2Vmqv> z-AbtC-zV`Sj323i-=$UKsMNx^l;NwfUqm?<*-&V3B_ijotQEc%k(L+aX^WPNGTSGy z4Jic*H-FqF>wUIyb1Ypp>1__kCrvzOKkTe(PabG#buF3s>4nT5lnUsq5}UYMr{Dbp z$p|Jk-B|#eUGoYDJGVc9=l7+q3xx+!DdpbRvL{}tpDP!@)I`Jc=X*#T*(t`T&|k@q zSG~`de`W57`vOY`DjN&db%Ig1zGeE0CO}(fQm_$Z_&*4?etZU2hvq`J>~F@2Ip6PG zyDoX2rBnL+^d+Nz1=d#&U;OvIN%b@!v^AWIMKat+8!s7~9u-CPU;pWT(W0f;*Sd+| zAk=tV_j)V<&{^#{2~d_#0Hy8zsL8V# zNEPcLXH!;4?z;&1yz=)xl3+v`oiI)o<G72T2hf9 zx!zkf-Z}7WOiqxL7iKWnc;$;VdbWA-lS*x!5|8Dfsc`3Rr#ZTvG1ERSd5LpjEd_Dd zmudozQc;k`0DaYvO&Z?8Sf$%)Hj1+oS}tMeaz0Y)i+gG}uj<{p6zO#h)`*d{9e63w zp}W-@xP3Kjs`W_q2`ZeB1(D3iRK?@e?fIMKMYjg2)BCJ@_%lxeE zQh`ACR;Zb%Ld9zGYbr-OJ4Wdbd!o*TqhcU%A=Qbura}`20z}Mtoiz4-zJ1V<{go8a z=OlhZ+;{j```0Vc!eqZt zg5SqR9p7}Tup?8V4w~k{>V5Z1C9(&F>upi0kV>Dt=6WRZ_QLq_s)8Wv&g~p3W1|2H zQ-SIOnRZ>odcogrp3E8uvAAPVY}@ied|9Vll-Hi-FYv$3R`(7LOnz!NT@(&L2?`S4 z&>+nzgan5gI4FRFw6og|z3#7N+KD3mY+PBI3k=(k_^OCTQ`~X0^;GL}xHlIQCO2a6)R7AmzuoBSJy@qOS!Pg!p>$;`=R*oXWXI za;qcbZEmlSa&jTr#jJ2^aX$wXcI|FV*O{)vk1s2`oNKnFnMZ|IT^#U^db`~HB+jWk zkw5s|F~m_3&U4WYFOMzf{#2{MFG!oSklardgKF;8lT7L6!4Y`-qPn;y)3cKJ~&#*VO>3bZ0 zoCV*fd6f1e!oN$BQLAH&nvmUYY(^!&s~{dsJ6`to9|C{z!jVS%-<$BNVoNKyKK-=!` zXNY&}fXakOcS0DiE1<0Kb~3b`mAcNm5%ql)W-_q7@nfmdVvhodo+C|(-AKaDC`~rg zmTh^n#ld$QRDNp@*LOJceUK@7!mAcc#<6?~Nt4TZ*VguLWBiiMSe}ltUtA!A8HBc{ z=HwaMiudJ0MchZbf_psj{Mp5ORbqB8EyuXWPSO%^ENyf6thJroa5h{qnvfzM0mRwI zRr0wk^V&I!@x%b33ZfeK!NrSGZiUO#*j-VKy=eW<<@%?eU_lm`gDYQyEDB$j4nHJr z%Uh}s90{i;)A$=Q{JYv;dwQQKJj&+<;-K+^PH#czzG$KbUIj=ALf_=+NE0uQI8@ICYJ7ow(I{r1_@eoHPs zRC%cE$lA-rtnMCV6vhSqQd07xgX@q6Rq(Zd!j>MWnZSu6Pw%n~RHBBGa(K-{e(6pF z3SNS_P6nRn$kBje)a(ml%k07puWU;e7n9G%jZeydEyEw~wTu~Ei){4N2IuegcohQb zE=^T$RRI6f9dha#Izz91;koUXcUwZFygBSZNk*rxBh21tK_|35m9k4cTB(njHAd1;?-G}kYRJvuaqr)*28Spzugq|+8cwk7m@=OQ{Vh3-{}$=r_PZ|T(qGK( zk+Eat-lca9Ng5xtR4&faK`r^3=DPWN;>fNiY$5YOvRrs*5g`@llv0H5RnRLTaaRvJ# z7Wk^VtCu8rt&Z{*Un0o8_o^#q}Q`%u}( z+J*Oi&Td zAW7ZQ{Jizrw4M?SeaSu&wdrDYy(4LwGWf7APsZ80jC}?_>fAiU7NOi52&w4k0rVzb zbg(vKqHI$Wqf3naKn|Ll;^oGkI5f34CGmSKOI6GQW}iz@O-_9KZ^|PZe1vu9->bt% z_$uqpzsN?z9>U9-kM{Kggm)5=J8~;R}7!#KawP%$Z9h}dT zaIdN_8)VI|^&wrPWOb|nr&SFb{HRQS>h9PCc<~ZfZ9Lag<{GG~JlPN17kP+l9ks|K zlkf1^H$55ZX}Ush{iTp$vh}nIC6{);5#O0j?g?c56j*L~Y zaJP-|QuCHLq8~Rqe)CJ+bqVXWy6zI@uJ|5-9_y~o2TSwlS26(~;C5s*PX)WQv8^|k zEtlkTJA*R6)s|eQhmkFZT%KgAGVRuiW=`?%Vz#H+ljA{a?MULN z*R)ojtzSVyXiXBmGh1+`lb{EsjEYmwV*2x+fvqqja9q-#N*Ki8K1jWyNaQ1>Iaf@|{HmOI_I@ znzEp{KUfF@_&s~odx^wZA4+1r8==JV%wP!Qr__Zz`$;f+Xg;)!d*2Xh%q%k6W+2?n zw^G7c-WH5m+Lo8xs4)oS3voul3h1kdK13i{=e}BggcI4exncvQ$&DL%=rhLOY@wgf zR^qsu>sPd-gRrNXz{Z0l2hsWP_Fg3+HxG(~6Ek}vpZj+0AHf%9@40A_yIMlXEfG83 z!Ib2onX>Ih%RYF+^jO8$_A80sk%&$Ne6XMFcJ%_>$4%nUo^d!G5=wEI$bo!?WU7F$ zV*bn*x3qZ3pkJ8;F@`+O+kNI$KTT2se&Wg8_^DMh1=%p?P+Z!<=5UukVNO0UW%nIEa!bigMf&4_64V1ramA7* z$;y}fY!LAcUH%#;i{RgfMNg0iL~b*H=!U+%Kp;yVCb9|V&ngxQlX=lxA!(!to2Y_+ zj_L1^;ycE<+Ek~L(w0e8Y+QiMYPi`)Q!o?%4T=H#G*X}gp+ian%0bj&Fk?zGOc`$( z%~7fK?^Ft%0(Uk-6bqz}`AGGN4l2x9iEkMui^MIgJUI?QE=Si!fKw`wh%gI4&0M|1 zZWJZ5Fqp!nQJObb97BazD+`Wm$_8{Y z9LFTQH)gUB4?>oq^c%mPug*UJJqcODHyc?(p?KP7RTwq1UT%em7TIZGmYz0Ds%nxi zIh^7P2H)DHY{3d;aa4^-sz<@=vcZzhwsc7r4+4bp*{t(DLn5 zTdFDSLgfoXS235-`q-IJK+4*Y@*KqFbNgI$gKVE} z;mJxUGtAw(b+b`%72(f;Z?L_PN4Kh;7PAfz4DH<9-Rboi>g{t5^9b^KN&fjqKfvuG zIJvJ6g~u=t&dEl6$KbSXCyvDvlY%E;ppn1tgs4$T426P~NtQm9Ex6(RaB`{DEVqj3 z`6bo_?Yu~fMq^r8d+gWnLRH>K^!W_3?fL}AN1*fkgX{iwb=CC&y!<=4Th8JVb; zYBvm-8Uo=^iSOXC$6C_G7(w^dc!n=P4CWSv0!$t>Dm-EMwW6-kT^e98H4Hv+S33n0-v@MgP!{ zPj+}^$kZyfHmwzY#LuH2pnKfr$&#~$@D92RuxJ`y$y9E9vnh=B;5mFJHFL$)0)e-# z&;VyPK+2oUl81Ni+Mj3jH8o=A1n*D2@eCPvy&jdXf-}yJOfY_|L{Bvf4A=Esdh~?h z&#gT&fAsdRUYy0QG70C#;@&fq1oGz;u1ahtWwd_1A~U8;VO>u~+Ejng>k?*i1%{4gC4|kIQC%=B@wqeyQFc zg7*B)*oU7~O?=JEiJjj$h5CTB^;QX7y@h?S3}O(z9|;S(oD_Z@FJB|fjs3at*t%w0 zV|~}KLB?xr&+aPn+;wF#1ifkKN(+4b1Nm_PDFChf=GkTae&preF&&Mrb?p{!TWwpp z4KNHS`7K@+E1bs{X3aU;+$YQu-DBt{p|9hYPx6D_CjmT0zUr)fVDB96;VlZXzGWuhWZ=I#&`R9hGiW%pvjM%# zC`nIvyh}ej2x<=;M}O?tVO$tIu`$eEy%s~X%Uhj0r+Y1Km||abZ~iH$x?D+DPp0r- ztgWjopZVaE(h)x^pTREQS#f_ke6NXW^l+|y%}&1(SpBGe{-y6Y9lS^=Y14uYRC&n} zeKc&>IU2G)dOSls?|IuRLV*a{nJiUa{JcDjRKY&+)*GRT!^1bmY)`_Uu_Mz3wFWvo zFIwma)3mI+-sxR@bxORvy5;Lzq1!t2CW0Ic*A`O-3^gNMypbto_SVeI0sxEk76Z|E zjyBixA1|5y|A0=2FgMK0Xlt)PpQ--T*&1|Y4g4Q%zPgWyC2p4&DC!87ZQ;AdNuaE?=^0|Pd(x5=Kf zFyasXJEJjx-e2Zwn^=JeJ6NZ)b3t8T>K`%Uc<->TDr-2qIcTUHWc{p|{AO@UFb+KJ zoFHvhZ7wyw5!Kuu>U_Rh*_o=3jW%Dq4tT$}4K3VxKk1x75GfMbcO+{wW?g)`PN~1N z(wBc~xwh_3d9&bkZh}y@VeGp9N8_;lKaE40%$Em^1SD!o#gS8?wx3}>LqOG3dx}y? z8NKwR*t~SDpQQQ8vZm6c%5i1>8)EU}jJ^9s*$+eyBy}%_T?*pP%~OHb*a8Qos01?C z>p}`oYxj`jSW9ql*R0auYi*K-`KLm{(@?$9T+HB(fj-GRNuKdP-(L(0Z^8+(B)N?Y z3L@}zfj`T;u|~cb6oi^28ZP_}LHf`cj%0)(x=>E@cS_WjE}j;>41#5fm4*@njd0ZJ zA>n-o<{}-I0%-_c_4&S7&3h8EnYi9RzLXc>lT=bq1bkLo#xSQ|6GRDVC_`F@rgD|U zs$JgVM+DmLW3(B6)rj265ai+V{{8S!Yym<+2JoveahNsFxVk5xCHl?1;y_I0u2MCl zZz_hQGd3E(pvz<`P7b86Txu?LcyeQ;^KURvRGOqWMw83iY&1Ad55MM@iVA@Hiu;D4 z5?8)r1Vw!jS2d_kX?wN*-gpT#v)!bLcT*}^_;Zje2?tAvfuS`+a`lf8oc7rd5uH^> zF-1j3?vIpCMIeO<>9--lDYILk#^b0$Oh+svu?Br(FZ*ExEm_!eE&?Y>*8Ii4)VT|M z2T!Hzw+45MFs()?9!nG$XBI|9#nwQ}51386-xLic!i8>M8%^7xe(H#6@I0F>|nuOnmiuxnVNbjcuai zp<`dx7{6sOo(55AU#T}TuJ5>?c97=XVK+(F#hiobH(H|JF;G9u^C3xXgs}Zk8G*Wz zetucASbeavSSK79_9%+eq8o zF?F)I=W;c_`QyQ`x+4@Jh7Ad8)*rHDh9`VAt}QfF4IzIpVAP1Uuo^=CZO|TuEU4(8 z%r`X2gpD`N{drxsuv`ccE#1#aPy?*ikyXxwEF(fJ*57rvi1&Xnu^7L@d~qi?q>I?A zA;W40Eu$f5yX75X-n!+f)Ai0{a7>~01*V1X5DW}(ubadL0yX9Lv^`gr^=$L5BG6fr zk`J;kEk0Eb6;*HIRg|-L%d!6W^8J>*+)Vs1HKRYQthH&-z_WQFVY%$MRDdQ#W!+XA zFR_idx>`l9LZXiEKQ;Q!l5M8rwuiVYG>8L)clDqlQhPiCb39n-peA#_c&Wk-$7zxX zp|o{~kk1EZl;GQiW6J!3p=2Y0KHvSzEJo^Rq?+=8>aS_kL_A3|{v4T$A1&zpc~{ky zt10A(`PO>?e7=6XXK!_KGXhzl+}}b$UKexQM_$(m)zi_h%tLPf3^DydV$jayn1DA) z9pBXv&MceTek9m=`=h4iKGs zCcu8P-|{PH{QLbS3>!8&{<4J^&-b{>XVkff-|isE z9-!m-g~T(nmG960PSH%i6*Ng#>}C$>-l(2c_%1>)jZY!E+DpJKSCmmNv}C319U2ig z_Eodo=EzHJ?)SiNlH`eZl>u#)TJRTDE>NKWn}im@IOjvrAdurW)E=P0^=hfLXM9td zmBaE;O_ckuAaK48#8@OWs;a+6K6Owa;^B5^lO$@HulbC+aIAZ1*aAUU9OF6EDK}|= z-Dz5h=1lWJZt?eC6J-p{WffLUyEbj1G|NzOeNAG2>B6;1uWC}=N22KUwg1}z)!P}~ z3hS$x^rqB9H9XSWVc_r3cP`mNuM|9sH}FYS_n9G<+a&K7)ON|D+)L^3Gj`aG0_1`q zmZM70!0tTiU&j>5Om{{t<*ow0@u{Ijj=Bc3OZfRhYjj?8bu0WU$qbRc(>%hWa|;bL zonNF*3_yN$VSRl*XA!)>tah7D>gl0$=hFMgAMg0*B5u{csa4D8+FHEw3-AQxPgo|b zS819vF!J{bbKP`zt58|0-aQpOMY$ZDm@kpz6Q9I&$TuF(Xk_^(b>&{d_N#ga3e?(0 zSh^Qx@E>z#9|>JaYraN5limmjh#2O1o|qKiqk!%5sW)h^m69{pp5P)+K9Nv{8FjzT zlchqYYxXsuavXQA$mY>QkLSEe)<5bxjdly282P30A7_$B-Ft-VCAv5T|IMHTS9D}T z3r2dYhy|?~Fph4W%!gxI>%KbQRN1>9Wn_DkXIrs8DPK!HHq8q3C>jb2?5Z!l;H6kv z1Dbq1RosTWbvnjoZ>Tbd&wUu@o!5I z|AT84GF@e7NldUrkl%FO$;;lGVc2BE+O7AIrfFl<44lc^dYG5?s{4_~`91E%FLub9 zOkkZi&Ea)KG_9)eer~9R8^f2;z9_Sy+5PRU&#rb&cCcWp0e( zU5zXFK2L}8J`I)JOtcu0Y|k7rofiB6kS7yt9v<+mQwRw*cYbViiXkx@mgG%ddAt~1fXVoPW5})?y<_hK-(`I3qy8H|7{|JF z^9dj7r?&Mp`4&6@P{DdTW)eK@v6%Rr8jW__l5FF6GVzU|c{;`TPkz-k_}QwU`>zRP zJ|NBXjJ=22K|24sRB@nVrpWsx4C#--^KtuZ3{(U1=mESu6jQ*GJTCJuyg*neDI;nC z2NHQ*TzcX01$%^Ie>;@B)Kj_yDCi?aEoMj0K>0?L=l{~vX2|*=>Yb{B8o!W|4$~FF zR^~S^w8<(SiHm4thjIm-Z&^Xf-e7K<%^ys zYL2oUlV3>0I!Eme5&Lm}iBHF3W^;rODYF#qB}IOkCsXQF0M=OQ6wqvFbXa%Y@2U1n z;HBQ2KzFS^gesi^YP=Fk=O_Hlcer1KRAR~qn|F(v-UXxd_T~pA@|%#VaIBEvc12;# z);fuqkR*?hq)Yhw=W!!U;iS>pSS{{@zjb1GX_|Qn-B3`Kve7+B~{o z+Zdd@+UJ={a;LpTJ^%)gP8~RVT~YTgl>E~@ZiAASL##RTI?!XE7#azU%F6^sG)VrvwgF#;*7VJ>0<;~M`CH)w_ zGEvD>X9#L^Jv{yUwRx@r`Ud?zw;%j?Ki{{qfsZ3wASbKy7_d_k4gsd+u)V1|P?(qx zsRS)=&)##PM?l^{ysgr?99O~A+-tx-)5q#)Isx-Xe1)dW6C{7dvEe4@4qbD10vP~m zmKJzl?`9=@M?v>IUm#xnC)Ym<(pNG;dbhCiXM!h}TQhT5&>=S}0<-5bouJtZUBPj3 z3gY|Xr*=eO^X$23K;dzs4QwjT_9JTYMoJX(mb~&(%Nvf){J$%HDY~osj8nHv1=5+jl}}ART6^o|Hwgm>K|6)bF7M0<37%_16x(Yb^cNS| z>$OYeOjqSz*m|hEn*)U{X0CLqjCFSqtDbi#X(xtVN2bJYb40s+Pb=^jMt6Euzu)rt zPn%weC#vq-LBxY6aiGgSC=L0m$g5+04UL?cUF^-ZoGP~GsdJ01RoJW>wwFyVa~nE# z+XX<_>e#-j%Ur8=YjN-e`vIh!U9B?Bv#$$`BNt{}x~}l#Gkna{te|iljBi$Sl?o>H z=9!(X_g>Y!d_wS@Y&AW#`l_D>yT4?#dmO!*pVt^fo7}kGbL)D!V$FAMmIpVq^lNH8 zx6KSmH|e9O#W1{dIx%`<{qgJ?RMXMC?*}f|+po^H^|hQ5R@|aY=pMBrt*z$-2WM9W z+@~;sL8AwUrk6oZCZqK^-m2AHj#HM%I)YSDeDsAa^ z-7awue@?PJQ|N1<(kc(Po0kpI8$kQ=;GJkBQt613X>@U6yQOygTW=)PN5Bz4w!Y zJD80(WCTx-M7lNvzufBySoUMSq_2-1nLDLz-EwWrRa8v?zjf0TuL58#fUZ;`%Cp@j zCKvE)xh`0J-EYIG|Z&<$TI!8?iBKfPn<9>cZ287zB z{*U|epJ*y66bm;O`@d`|KETGx!T#UErcz6%oTv${^Qvlj>>opsJq=e16|pe4gNCBM z#T?&#XL$$}j-_AzWa^5|9VGhe!g4Cq%l@1{PCPBzEDLvJ*^HQyD|X8M3%in?w{jLA zY*y{+pEN!S{Fo6sHJ)UuY=@Cmz6Xl?af^FS(CPNaR{A2mUo<02vqPAhvTs&ilDA1r%h8dd3~(=5@D{VH%HpL)hpOL0+>b%WFDD?xK%hg!GXLnlIM>HV|MGRO!#DhVjQIpr^$|Kg z1WTo-U?eHQIAy@tw>Jm_wvT*I9T__Q3DUyCtQ(}yI)+<7W0V^y?6Va`lqCtd!XRv2mGn8t83(s3oI}f3-`5vbdnr@NZ%nbJ^ z6H5%=vvNYl%^ge%Uik$s@|O^Wu^z6Tv7UHm=QeHu9ZG_}iox7hEcv`cNHTpXF^Kds zG8yK7{KrvsD23NrVsPaVYzQG3ax$4(MRK3n#Q_>AZX`Gvl#3cw7d4^fkgeai;VQ_= zE>b0521u=ZLRNU18IRj4CYs#%)YKrsVb{ufqceaT~%oAp10X*gW*k^!H-a96AO z-UubSAezrxwYn~uPYVwTUYngER8-64_v&^4^^ z(`>27)cRHQVeb9}HT0Qh5%y?&GWXAa%cG)H(I3X*<5fok6ZKQ^XWM6{8;9J4JN~0A zZAe6A5>F7!j;r@gWnL++%Fm!5y0-*-56{%Xb;ZBkenzLxIlJcyrvr0XK%|cQ5ObQW zBi=saub`C?XPX?fEVme5*n?I#F`J8Rlw1UxMd_{_Pl%7|Dc*~WY}3^Yv!#f>=dY$+ z(1JM_+;+iZi68GD|MCFHj9X{ewC|-dA35Gd8{RRmEYGv&pm*L^8hdCPcE7%-b>FHZ zU1DPw`)UAVOBbl(1CH$EyuoiaMs|z=X^s|`4+(>;P=yf-=+E(`LWX_jv&qN?ceC~R z(%??>%{iH2;suPXz6KYfney7cj(S$KlE8*__KF_JI5k^D9%P;`xthrqOZx ztj(aA zu~+8N*Gsx{z0D>nGx2GAz4BTPB3cfc%KYnNxp@o+H6OX*m4>P39Cg2+E2v^K)n;ct z{oHPs7}9-`3i9N(o~P8??Pk%%E78lhwq#1otCF$FCpYWv>!~x!lA4l-OlmFNqde=X+-so9o!6<)=RCIY+fG@U|=ycz;1Ch`M29py1K=`6go`RoCpR zjo|lGah>R&Trj7tls%C&x6U$`EZLxY z-u51u!+>;Ccq=fV3A)>pbMml(Xa=1nY-%@oyym;A-deN@+iuO|b1d8b^wJ`mU6+*C zAwnx5}H` z`7-0mi1$g`WapjS=81t@ensXinx}~=g-@?`-lbFBC&l$V($0qo2dCu)ddrbK#&l@_ z(zzY~xXyU43`OS{0~?eozs1Dp=H6U&jN$4fGrl27jCZn!@6{{zeXHqDZCyCg6;^ip z$^*lm%#+Mh^B2Jj9G#_TuMx71(wR)XlGku2zTood+G57qM?#R}VB^VfW4WYx;Jlb4 z?+Sapu~x(MT!CgZvde8Y@btV_%r6Ffyd3Ub4ypq$*9i45{%S7+gKG}CdIEp$-{V+R z#W4xPKOnCZ)5W6i8t3-ph^n5^v940gk_a{pTl)WQlQ!8i+$8Wnwhcx<>t}>rF^}@* zu^}uzSsE#{ULURmD6t7b(ZSYR|$hD&jJaxqg%md2-%8;9>!%$!IP_>x0Gn zz;=EV%Y!uZMbBeTtV7JJJt_)i;s(2*Zl+o z>A=Gzl_V$$@hEJ{aZ0=xvxpT4-54gv^=UiZUc{;;C_B0+G|3;qWi|QvSh5ogeTg7Q zpB&ivWH&b`MKE1>es5hN^cU|gx`vu*3SGchN(G6cOE!1g7J06&Z?S~qyyP-aVs2u_ z!pR8(=7EXt1*Uu#M&h^V7>{L!%0QrnaCe~e@AxLnImHp%Gu!#1*wqifF?`9}qiruN z88h(FRE5`cxq+4AB>nVWXVX6EK9SK&{cA&RJFPveU#P(q?U{|k-C**!Ql1KHWJ{IM z`yzA;X9I1E5A%L3bT@VZQm&fWtk<}~SgR3U~yipy>EAKb$>@xh+ z>G~)4fg6ibnVKp6Qv3zr3)Y(I_RoVp)yu}@tf{9iV*d$AT1&K$Q0iaCkWS7pWRVF3zC_CKbOl(-ZoVAZo) z%52QUNn)z27~n#I1sfz5(pR@l$_T{=y9vtcDL@{Q+mD5R9e1;zDB-(Cm zY3C`+Ox0Mx8@-_0ddqAt{asZ3OzD}TTAODTwaOxjdwrOa(7Od^D`cZkf3aN6+waP- zeb!lEE&M`r#x1&??>Z~9NMA{il6enha-c0!~8;hzI%Sye!R-9S14YmZb%6mf{yy&QypyDgPS(lM6@xsi)tMgiF z!nqCljdieNr-0EMg+2_6LBkJ5w%9>3Wb<)PhMT%4&;3NPey6Vqa>OUpv}YoC&{!sr zHDVGu>$|sZYTR%!opYnOnSa6ZGZ@sTt8xL)qXa#XRtQORb94sO1O?LE{E~J(bm)G+ z=;K+m5-<|IaN1)Epjfq<$39dX`e?4oTs1@nFOV@@|JGGkjJ$AKNwG#z%t|bsJQXHn zvzU&(1c$`_2VM}gEM8hYL^x+Cp7rtcp;ml>zP;2ZmQ-DM^s}}?Fw0%x2n-lAia0>! z)2La4K)6b8DryRL&nYZ1HU@TME&|6PGA8|sKD$$`G@~vLGsdWa&l$F&Tj&sZJ z64{u>g89}MuIJG4#KxZGd9Ys#D*4CmiH*`xUp2YH1Y&Fq$%~bo)Qn6^#5#b6&2CX$ z5Hnz`A~*X>+f+cQHK3yD9s`~#GUfv^}$dwnMNq74kt-}jO=GEJc95!^1q5h zd^nLlflc?gUW@kV1e%^aBuMhB^4jEZGdwbxIS|gQ&`whCtI7Ct%siCz_9KCar~=al zy%e(F4`$8cbE1(k9-DuJYOw-7LY;`Lolj0Fgp>PYwfN-9I+XnsGR`YdQe`L1Xb?O= zy7>HaIJqrE?3*=&Xfg>)4jH?*{t#k+doBK_edd-FKA)DhKHkonnv$=&yxwn{0OIkjx2L^g;N=2j zyQMOVK?8c8D+b;(1Y^+(6h5yXrt~_?yXLY#o}NKXOj|NG3Eoe8SGJ#-0?+p+L&TqD zNAc#@t#4y|3wukq+%w646g(^L(}I|iM3Yd)NIw@2fVYR&{!gu`z0qw_oO=d;?gcH} z{z%~qEf~4j(XNj7DNtO@MIAm@Qtito0`DeP+|WKJZ77LS`>gV1)8@wI7C&x)kcJu@$D>IUweY{2D0k?up z|C}!;L#>l2vBtT(YlUqc@6p ztj2f zd#T3bS;otGq#4VKbh+YHsiaia`UCJCJEBQ;&VFLjEz&u1VXVD%6AjdQnN7~^e2lf3 zD4AcN2ES&}4Sro)mO|uN!Uz?f_t#&B5<)Afki}EG19tATIo{a0I^-axf8$8K;Fnb`%Kg3#gW+XY?t2Ofrs@+x2i-{97Uwt{FNxo-Opi;^!4 z{&?XO75MSJmmw_y1xShcE4gT^$uJQGNSEAU24&e}OX^yWGh}q}L9oV zs6efWb4q9>hZl}j{8;Oj%7p*!XkqA;X6T$utX?ZfJcO^(P|OwoC|=uHq-eC*M|8HZ zEJ7Ai@9D+}XQdp`aq>)BoTDchlC1(LdR={k!H>BQwUqi29FdN;_YG$WBVtXS?JsdL_ z!RWDHiD4FgCjfrOiG*xQdKJoE+FaCcBSfDGE(!zc?3II6*9wmnLwr2M2Wbq7&Dwnv zO1HxCN83Rl2m83pCL@`lm>tX?EWcj_sP?q^DE4cjKR7N5T6pluXhSX_Tmwo-+vL*U zhGq!$*J|xfUV}C1VPq<$- zf*`j-1W|T+-bWxc7bf!km#d%9YOl~T z*6=$fj^zANw5d#y9_8|yZ$oriP@qYF{SVkbGK>}JnUbrn^{6QdnsOSqG1z!0q!sIO z$VT)s!$)+%W2ur8(m^7rC<-6vRNXOqp*TL21+zgmOnCilYq~xipClb?I0$vAcZ?M% zPIuCOfi(`#6c52J6fc`=6lPzrep#a6uy!+bqy9p`GalMJggB}do@g71Hnz#+)JPZa zzJdC;PqT5YWHJVa#ZatV*NU$vf`Bovi7lz&U?BTzG%m`wa;@~w;N#s1V@YtPBVS68 zLg7hCM1RlRNrVKAGJh0@oug%e*f9|JLxRNvMXDCtP31TO`J)XAf;w4|n@7p#muH-k zQSa+Rt=g4VY8u_Hj+OOt?y?IxU`vLK2Udx~;<}xc*s+N`J8@%Q_Y%#_NsDA$j-&l7 z2q%?eYF~|4XwR(fEi#1*%H^OiB)3S|e6anX740mJjupoc<%y=}WiN;yut^-S9QHG48~EPhsxM&7l}BR%)WzjbIf`*=Oqk!b2ScqPMSAJ~?-|d$tDf?C<`K5} z@r^X2^=xd`#Vn+upqO3xgfLm}(HG*WN^{}K(tRDhSwD;xT&jczCPJ}~#8_Gu$2p~y z-c8b%u6}>oHyq#1^20j`TgkwjCpI0NkYNlm8eFB*QeVVqb`c5Vv)#|$71ycJ5bsa5 zUdEXmZ47ZGMv9qhunKA>l>^ju!W+FaDoSgfQte*H@E%j8@wFdd1&&JxGD3picBtq( zwAEOR)){ha-LR4XE$4iFyR!oxG7Ggd;Mhd=@NSm#PTYSu-*Ekup^QNSXKg-#9^t9He#Wv5$J_}DSNd(uR__+y1wCIol}3%bsj`2+uJ~Q4NpcXj!Cff&2hlXnVkKYR z#z1XGt(eYlqCcC&1D^Cd6ah4kM6ne(>%vqejwoA?rX8N$Web?FCysBB`ICu%y791- zvb3pDdeNiWj{o=+;n*xPyvQG<$uCcyINVnewC71904BL;HI@yP2KauDuGoAu>|HBO zG@M_)JLZXlA;qfgby_X6^{tBxhG=@jQfE#pO%U9)rpQGU|w7ZvAJ?u1wd`l|8L&Ju)ZF52lxOB40>9vjvg#;A)QTIiqx zP2;l=P)nnF9Fj7%AmZwosU0n-%m6Op|LJ3NuD*6dmKObKs`86;eL&qME&bsrjuN?x zP2rwN-(-Y?(2}~v!exWQ!R7*(JR{i zxzUgi92|ju&n8%+tltJ^bj2V=&NX-hMdu5YV(RezjDz64i6>7T-lcXH9@OI|)77B! zngi<5UTQ1RJJ}l@^$>~7r>Dvt;Is3Nd|FIKT_{PN@8k!YankQGCv4g zZ%Y%W5odO2kR09L-K>a0x9*56ecZh%HMtye2|djoKB>n?llY^e!n(2RUp90;Dm6x zPkNMug;LXKyAvfu!-Z7V!5vsa_Qo zW-O9hho;cAG2ZW6IQqo^Ga0j9NyB0&D@`2rH2~kzwg~4sZ6eLzO(@VG%OexEdxQQH z2kNhj(mV<+aqz`x)AYNQvqLvVWHI;vMzFO_}l92wTguZi!X>^1 z-$XgP+i^9bR5g?{8=tUxzT*QO7Gd@0#ryN3HMhzNw|5iDOk4sq+Q(%M4YWu6Y%UtY zJ0j=b+-7->V(}KmL9sGIxv&Ps8X#T_|V`A`}o)oEfgOD=|QxZ$~%i+QySPs=7F zGc;yX+-4OnEm2@i0Ou4U@JR!`GL~y>zLATZ)gV6GGWI@gcn{ivahh0Qw+Ms>2rQ$r zCq%X6q@^QT)4M&9q%! zF-@&~@o}lcBj?j)n3FS4iI&4JdEC(FsTIejD%U|UBvocs>6oFO6jR;PBUw7Z2()d9 zBYlNB4rT%a!0>&e zd(D>;JKT8^!1+{_>B;dZd%e^9_4=H_ZUemwey`~LwTh#42xzwv`+H;+*7dW9q4QN+ zvd$+5%!ghSy)=Qcxc0ING~Y(8HB)**S5oU=2+}R2<_Ru6Su3f{E(Cd&P&b!?;>xJo zU`v7Wg0fnY3eeXY>f`FtZ?YI3#l7{^aImG)d&(OA@+Mp&iEOYc%qA)np`~MpDkGW7 z5*;cdEh-~y$`XUhBfZL@r==p@dijh?c6R|51&mVlkGnI3oj)I+UbVP$sIT_@a7zzl z5-H3|Z=&TzDN7>?L2RWrW{Oc&H1)|8Jf%Q=u|h#=I5nM;vV};lq!f}$nq~3y@b|=_ zN@b5Tl| zE|m1Hrbc2ZzIutImaB8_-Q`%8gKgp^oc_|3Ilge*rSh?1;}Li~O&se$R%I+u_XbL$ zl;pqU99Hdh1-)y&9X~L%jr95`f_`8mfTW*Bx51)ecnLPX{u+WHsA|=@<#FZJpM-Gb z)8Bw_<<~!la23#hhj11An0;~;(kFy;{jSdd=_;%*0O=~CF9+!=`mJ-Z1j*gkL=MOi zPTLx&0JnlAX<%eJ8Sg%WKbh=CL;y~vy6F*4X1Zk&PUgC85l$BLJ$OgAH3%lJ+)uJT z&>LKtp+UiMg9=hrU@HV>Y4R9X%>V5Dw`s#CV9){|B@HU3(cW@p?bfmMy zZXG7m1o@v`3VsLK?8l;Tbw+6iJ)giMh`N!%BZ!eL-3?T+#eO+JV*mIR3qWE^{;Gk* zmi{#bNfM1^)m{n~PKx==R;x$)-{5=XFJ6NGmfD+jgp8!JFI0+n`Q61uG|0!u(DFwm zQw#L&*F-CIQ$|5(h*`GkYfgCRVf|nKg4U?M?^}N&@X}*nag=4o(cM1+y&3~z{|)Nd zZvS2`W>1|BVAnfn4mU?6d}OE#QtA)wqCTJ}Uc{)p&e3(mMe0?cgg zeg}Q`6R`ZPF8o1cz=zIj(mO0EM6#*oZ{F+w)j!FS6!;GohE~c6 z?1WZ^LQ@#KBZQG0A%OxZC^jTPf(mXw<u0+Dxd>qITI#v$*$*`{wSwvfg ztaaz$`>)hKB9vIuR_bo~adxy584Qr3P~VFbT$GP&A+2@~&fh6=b7Jcd zDtifUUQKkH#($#MLU|hS-}M5*H7Ig@?F~{s`!KtF!r7~?{Q9dqzqi|R=@*!)&F4HC zBLh-c98ao@Fflk#jTB{lz8nII-^gN+)g-w(kX@R@a1qsrh(H{*sxSDr`zy-&*t|)Q zh-qobGlWI{o}ms@BqGFoWgsz}f}RwT0PSelUthP22&az%MQ|F73QY^+)X38*5+_cf zx}!mtHkk2o7O*?98P>2jh6u4+qE!D?W37f=x?0G=vM|?S;4Ey>rDL6uLRP47mLhrq za1CBb;lYhHvqX^8;-fThe_G{zV?BlY(lb5#GlcvPHER>(^jBQ5Mrj;6R^$b9jc-C= zJ5vOPAxG#=XNvu4zbNd9nSaz0)y5WxLw~0bMLn(`Qb#vmqFKF0OLva#gdl1VWt zox#RS;?TY@#r@iJg8|hIPyK*O1Lk9)-*hNzU#X!$q2e6&r#p9nX=P7#VbBsGSTKcZ zT)}RF(w0@h?+EkwbGaQ2JbgnwIt`m$6eS?3#OgHYKfmie zl{vC|yX|^s7k$#olxSb?q!E;Y0*;CWHA4P)qg+8kw68JYQFy5R9xMR2QPwvI(rgr+ zeSsC`W1Ov*7gYVi*_sYc!&2{!a{D<*GD@iH-qpK*iQr?gU}!zE!oBDL1OT6ujNp%t zQurm`q>!igs8BEr4yB$Um$%oxKM&ue^SY59ygjp|aj#BcVsJNcvT>U*9?z73sS>Lu z0{ggn2=Dl6+?vZSe9U6O`X`GPckhC%vr^Zt%fq~aujs>GE5r9}{ow&7+TNz}KDR}p zlLsy=p=S~hDLg?Zc~@?QJ5Y~tyK&UTpOpLlbX9QDWs5}e?m`$pmYbAxX3;mVWNs`* zCzF>n)A%Dwu3SY{~bA+wG43_9c#94wLs~FuX(J#ajM%&3Ykfb zl+`+B&f#Zh2fIU(o&)Ad?$51M)r|i0-Y8Fy{+_yzZxVkS2O59gZ?)7lItA7{;jnuL zHqDHHY3V$hjde{-S5?pXgA?@fk*Y?2lY=a1b<5B~if?Kb@W7?)G8sPq+PaQ#D%CRK z;b2krL5w*N{RL=fM<#wIX~a6k7rvG$Svyd=R(46D`?HxUI3aMD;>jo=s#(gtBf-sm zwpXM9$}N5-*+ubm5lKEJ8d0DW&oup=tm3OkFqIYfg?GEeehrI0&;E5gR(fcv zV4?J${pij>?N*S>|LSV8;KE>OCuzKHRY(f4!a=<=VF*}_ty~p?=|FI1G%Oo@u4?1v zQ8sf_E(9fbn}E`py;?-J*B}m+k41@#Inj$0l#NS|ECr?##8q6B8>AQT3v6QRCEx{e z`G(!P+M54x<5Lv%?Kr0l3C=PD!3 zIu#*v0Dx%+O35oC&zB!Uy!&`$Ry6P#{yQ$U#16At#hLiA&2arXzt6yL5qir)cXr2w zQptlo)dsm{$GLBPUHa$Z#Fxg^UNBygu^0l8j7nsCDt}b%ar)thA*2-zv1`VayT!W1 zLzXRwAbORwc_}dGw>s++%=A@I3s0;M%Q@|kSp&%H(~b55kn8ZOce&dTnpH#!naSkl z8bouv^n0Sd2}w}Xp|BoXHG6QCYpz-w30xEGoKeR_U%x>QIrxvxgkwgvGsF?(lt&fw zY7Q-h2NV2AzGZ+)-VLayrmU}fIw;Ky-Jfo6^UIUfsg^}>sbA2tG~b`^hgqwBep@0N z^#dxCh&AlLYIvmX5$e{>xW%?jee6_8%k*$cQ#0mdXj+I9hqBeRZ*s~ym25Bn-3d3o zU8&4|Jt3YzFwR9MPw%0Vqd=S)uCA)QA)4^euOwT^)zqQrPmuPsG6e@mz>!?S@JbOf zze!7)ixqFmFjbpuz9dzDLaup-O6L`tlnKbyI4Qcyf+i%ExTtt2P4@FoG7>W5ncH|7 zN*U#ZqdjoZy8_qO9ppwU=tpf$>8notJks*qQ}aM6dG2Eh1u`?iJ2tVkQhNNqouVd~ zix_C7oMuwGbR$q~?irBK`bEkj7j@S1tvTGvc4Y+BNGEGIgo05;>t@%!2}MH_I5d`S>;gTwmL)Zx`iDxV4u_gIn}cBMze11 z#!hrzyuBeuu7@&j{SPzM1|Sf@*dc87OSR)s`OwGk(hy1L?kNx`X6)4b>YuqvGhV`K z(U?{1^fo5;A&VJM>Dt+?oM5G9>Qyfh(JfdTpw}_~uX*lm)H~eV9YZ`}=^z3`8 z1+P6$np52xflT{D9;St5fRv#uoV<==!;WP6EG||{lBdh)swx?v_(I!K5Rtkg+9;5{ zVe(*xvso^b)l~B)Bzj?o+v~yQwLbn-;B`T>{C8ox$1bK%1H^kS@Dj&%aPwVz0c(pC z*1HXPp&84Pu>9yo&z8-us|L;|6!XQ0;-Nv|BG;Nzs>i1fwVj0bJ4mYQAV%tSZxfL! z`}4@?ZckH-{h1h`+lOFwJ33miN$cmK!sJdzn~}cY5i&=0JjHhGq4X4aYyJ_^g_EJr zmhEOzcM8_07|~}QX}{5n*-M};DE@Eu%etI&kA=^L4tK_?U=dGkrJFH6XG!Pju; z_b6;unjdBJ-*i{b`1t)oh0i%QemvjL>DuU7=9QRqg+{jA7nc##>R&V&{4vbm=+HxR(23PmJ&l zJ);Ozg-N=iT?*WGTc!M1k;pN?qfdk2>Me;UFcES7*-HF!)v1t`ZHIe1btCw4-}ZDhd*YV;qgIRmBhEeGL2uA2<0f&8nF()m zz>$Ye(CtdZG`L-?u=ATs5W$WJID^boRO`tDk-jnl%-S%TyM(@~WZZQ5ECf~7S*jBL zN|(K9um7*g3-v#st$gAOGxsAypGax6QD-sKQ<$;aMIs zeiXHuG0zZ)`s3Obf8kDIDX$v%j754|()X`Q24hXW1cxF22(|xTs(ETW%%2hY)896^ zSff$JmoiDA097sIyJ#8jU#wBKzXy?T|1{~bD0wal1~8aXq(@T|iyW7M4B}s2y!Tt9N@ZQH4xW@fRLu)Hgwc@X@haqba zB&nzvDk-dt9)mia0?NoK+&{^ zS*&fH%|evr<;smqiMWe(+u(r|z}BD&<88?ktj=b`rx~~Lq>V5^vZm5Ec~n045h$qX zIo6wjynMEh@2Se}$@#T-?D(zYw>;Yu5c2DO@Y@Al=*xS&Cd$xa03C>n>XL7_Sy!X+}+?< z4c})_AFCnVvXPT6dK}gCd>S-6)XO7=;pt2)7yEuNGOk>>A{0{QB);ixAoPF)$8P;x~B0g@Wb%sJCUP&rC?{;J;{ zAbT-F3%te-0?+-*3n>%2;~{cpEh&h~J#dC~S&ikU;22=W+sqJi;&N7+k1{q1L>`UI z_Iy)=U!CTU%a~>sN3evTJ+nF*XR-++a|rjodAx)DO2WPQhq(D)6wb+Ct6<=hhbv(y z01lS_(z{|eEc=Mi2hY93oR*j*->l*20=koEV-g#TEC{;~B=*deBU%ntCe0595Wl@d z?emBW|RH7z*ls|$V#ZsL3A>*@;w#<6{Oljtz(fQ3?y;NBoS|T@yS0m0=`)!yx3_>sK z4=T(IY<(oRevFu{2`$|k2weH_QE#&A=yqcc%&DxSp-QH_4N}<)BR}xcQ zsGF4{h;K9=j~vdHldKCX>H{O13&vmhBkhiyi!SZ}Y#R!!Q^Jm@3Y>q}C`vj6d9noD zhbfY?+Ga!^IDbRucGU=bm$W3tZk2`bEo@`8pz7edBeOC$&f^UJ`Mm5IO_`au%q@ZncwAsQR8n&^X zEuib#mCc^Merw_QOfoe35i3{Et!%bf6%kl$Z$r#wzVdA8$P(wOSj$lh7tL4Z#Xp|N z>ncqTZrm8H@;I%s8*n=-w$&}OQD4#x+EkL=5=#^@!I>_wU%08r2yR8uYs(V}H-3_A zP?yoe3AF-UG%<>q+ziQ!Y;FTe#F%H0L@B(OqZbH<-Gy!60 zkWxP@?3W;8A!ui;Z)Opmm?C`Bs62#1%3Tl&_{wCywd5hXXF@mM{gT0(G8-YGP&*jm zI%4E|z;(ZHvXHrt$de;5%oq~6GkwTYFqwH*pJBbL$s#kFv)PGOh4TDxX4!sf?gd~) zu77o}A#@FT-1E&nKso%$O;HGKzxNL-C# zE!4KSfT9TwK7l6>^)9o97I%S2*^~pugzFb)+0I~}gWyNy2X8P;nP;ni8kQ)ThaUnD zj6GQg0R|gjlH^AW6oR$>9B5sS@8r2OUXwVMR}*=PcXe*omJ|G$_Rox0ZB}jJN59}R z&Q^5_BM>VI5G}$QMS;%9ClUSp-LXrB>N*uCj*ZfE!dh&Ye&c5LcGB#W%>=}DPS|Do zUT9|soJJ3TK}NZGc6|+SENe@uoY-D1Q4m%^`E_DJBki_cS?z`4*Fc026ZM;p#L$e~_Z=0_>72*Mnbh>UzF@G8R=@e;h$O}`?npX_lN zw}?yNGIiO8gE1uw`GS!r0~#>M$t8#| zco3XSEKS3RFt`k0oXJFW5ETEu^p*c#mpGcZ_+bcf!9Pwi#47#!Hd+WyW~Qb}4Hz2I z4~eyD^(V{;x~ zITNvSvi)~3oEo^Y>p07|ODB>+>+|BFZDG|G# z^f8c`h4}}hnwWbNP_Vy<|MqKNG6`Scw0i7Q^LrA2?^Z;sDmv{BgeFIk8i9VWz$n$qTUPvn_PHZQZ_NCtj6Z{ZmeQOu+ z%gD!2i*%yu7!yYN-^tIslWw(#NFXA5gq&p=HF`6f6Sx6P3j;Cif@F+-3%<~n@L-is zzM&VNZa-5$=u+&FeeJnoBalJG?H)4!PdW+#% z^W-?CJw*(R4X{D)`O|X{@U=Ck=uB#v8vLe*hMN`D-<*fG$!nyRRyA;(YApFJpGjtB zg;DiQSD`)Eo!myTFad@}>8h1EA7p(Ms3oL%85kp}S zhT3jB^}Y&MmAmd``LomdD*_5f43e*+ z1N4%w1=c%FwTT;FyDG7}%CEJI)=S$p^8s{>!eU0zK&D=WD|*TG0-;5>4{+!r=_ z&VOo6!PQ__PxZ~@e*uZXG4s^A%I(GO3YWQCq60JPrn{u7{D%K$0RE>ubfOv>i4Eu` zAHP(AiHhp~Gc*twSHNf-3#sbW&ij|&5?S#LYa(qqwmvCxX zjLnAEV>*bvgzth*5SDOjIgIW8l>j4*7=#DUh3&|=qd(je<4^pr1O%?Hj;uT8!&5PN z#NxtHL3sZpFz*--kHo|iQwqxlWx#XcI5Kxz|62M~2WAQ}2AzVyh^x=uZJlc>Odq5T z--7MPv|~6t5EBj%ANOr|x?}mcyIYwwpsu&`0M{hC<}Ec!lZEK%iq?`fR0IDK_6$Ev zJ~WO|%>NFMahU)0tu^7(n2-Pe3&8&;qem?5@knjf|0PTpiqpZ{dCgC|VbVN)w>UMB z(leX=RTNoOh>Z7&_|P78?m9X2wr8W_JY6=$aee#dEb1#Cl zLW+i4Y7!!mLnkev)G_oDafU98F3;;5IlOszJUJI)BptGg;UxdV5s2|VFt_vI>3X}< zx6=nRi$z)dEx#SsoK*8*Up{Ro;C!`m?%eyh=rcbv);&elf@6BR$?Dlcr#|Q&*(FNN zx<#Pr7&tWEC3y5HJub1fc{w~7zj^v;=%|!lmog-iHSlwujRJwkb0Fz9ul+~|1pnN` zRWe>V;-Zlq;HcyjjBQyThP?m{cdvOA(Ba|9(j=bLKe+X8>2%`i6N+bMdR8}hYBeH zn_dD^O17(5t7*`4cgodbA~DIZNotHH4I{xUUeB2VBCR9ePKgu`*HkF;Bp5~G=nC9FWBxp`};zuU-AWrx5Kc8(c z7U3>%qI-M|1SO*~2}uU1y$A=_5qxKW#iE`-Rzy~j6J(}lhflDrzV3KTFw67gI{H11 z!r%s!CvKm4@Oq(KF-7>7>} z3i!*&v1vSNysqWO9AA|B_ZL#i)PvkK6p>O!>_)7 ziKY+&Qbmf0U_3>2#UuRTAkg-jAy0hpn5&*DpBNGtIgt%cHd%*Jp8dFLK>NGM0Gnn*M+cCbM>5#Yv9pDXsZ@S9?pJZUa5=b5nUCexfuUA->6?mAiS?zhx`t$UJ zA7v{nu`X`FiHJJ-@EeJxTj#-?_jfZUKtTy(rf`7Y7)0k-4wI*A2yXPbhG_fB_A^n+ zacPGoO{dV+aF2nQHu)^v#~xZUvyq0BM1ugq1oWLGLS5O{7=h0PS>kK^KpAc|-YUIa z_zo|fq~?N>;K&?ovT*)4;(!+VW8d=lcAHA)E&35QvopW&;>I~qdkNO$1Z|sNpW;6G z|Gtp2QM8E(a?RluX=^_iY(7a6<%o4z5U^K=n($e4Pi$IiPEkB!{uqwqE!bh_c@k>k zvTJLFMWr>3=M~)Te6>c%23Q}K8;&-~k4mPd#-EQt^Dxg>I`qv`*V~Wzy04q&?@bHA zdW3T%rw0#)XZKl?6LQBD&+(5Vb2q4>-+4kR$d`NGrivbKceZ;5f;B46Ckn5R%jBZ7 zGAGvM2%>fMGG!|ZvCN_oWffkes|5IhJ|!pb$44u|-7Z?*ZH#za0tY%gRH|bfb?1n8 zNYM=9t}BuV&RPjmb&sKfBVO^b@T19m=hFwUim%H#%mahYkFUm_cSRGPcMD5xhljV> zu-tl6SyDRnl;t&)OegtSrjYXopKzCNc9sT~9`ldI878AAjVJqV2@bO5oq2o2+?mql zvTm;SpYGkAZy&HOfS#na;G#eBNihg6Wex)&XeC}NeJUNByEi`-C#x1VC^sB)BW~VT zyf$<*#$-1G1G(-y)wD7Rj7m~x7d5-PQad_Q4DUoFm%SF&@dO1rKA2Ju#_3Ry(Kz;p z)Nl>I{cOShlA#4Zz(6QWZihs?HHYjc=5-tV?ZITR@a0V^E zPWy!Z70ATMS6(0RWAQw8V1mqrJgmz{mksq76LKrOq zgF%wWEq|mga@rjiUv>-5Z57ZxXZ=I+{|q50IA_~n8O-WVtbQRC=Lwkd4(BC{(!{QU zQv9h;R55(H4K#hM;Jd%wmMz^%`#laI3B2uJB{jZt8dBq~hDy99_O#tS7q%I0M1D;O z8U0PXVE5%~YF!A+>%1Fe1xHl5>K7A+BVTcFuiPUDT?8@G%Xsa7VrHq+gVOGzCVt z^YC765P_t2CfOaN=ohWe=IO7hEkiRlXP0dW6Iz&yiLM!MxjU}i32P90x98%)Fn06J z_OUqcMc!rj;q@t@@5URg<4pIq+V0&;W#W0VJ_EjyG~Rno3wLW)ZFF{la++}2I$!oH zq)xsHcHZNH55t~!QMw%${^u;A&4-jsPz3`6&cc~|*#(3Box_lonU#Zyor#IXn4N`{ z#gv)RgvFT6h|$25na$LQouBvrlp|TH8-@s+g)7;n`=80j|FVL@w(3@{x{yZrw@xLlXZ8Hb^oAsFUMlSxZ;Ff;^bXl z`dv4li<8%H1}`biYI3a_wv}ptZl#8gr<#H4S2TpN&W6)z?u{BaeEet{F#;$qPrWf9*1K#94moM5Q80Dp~>>j%8 zE~`&}G*@P}J+zr4rogWC#HO~-phw0el=iTw_87S~$b@P?nxj^)W3>u+Q+eg;`unAF zhq`j_tItS-_R#HWcjRjS_)D1916z|LZj%#C*QV^*mhIW5?%8(J>g2imFBp%IV2=QC zr3v6T{`JVn=T_;~!DkYUcSMPIoP~GP>BV>dk(A+rgyE98>VooZOwT=W!9A11J-*33 z-OWAOA#i;kVi4y!!~qW=yp{kx&h(z#^WS=9mt`{@Vf`H02&1DuL%QbSy)Gf?(2HHK z`f;w7e@`?0jB)rHcH<-J+4X;!oS?)|079#+pgV&YrDs@wQ$7Y9LmS>p$r#Rhp6aqq zzE=B4l2V&xTOKG;71RXR=EssT6qK0M<=2o26mV_V<%i}o7MLX0?I1{$B(TGe#1+Od zQ=Rh0laG^`C~>cnNUbL*R|ooY5*5@{nN*B7s7fCmP19Nsmn2O0m1;~YDh`+hJK9SE zcZ7BGs+whmH_3o_ZGJ<(rzFtDA+`L&GXEwzxi-Io?9P>^QSLAs+Oz_{eqN#_(9Tps zT%sdEYnP!mKYr&nL90q9$vKJjN6UDbu>_VxU&4xmQBpg(MXpb}&Qj#sl0V;4c*oL* z0x|5~eNC;n#y|c^x{LU9uQ9DR&AS`reH#w_L$egd5g7=!XAE{!2W2kvKF```TP8Z1 zWsb(7#IaMkDU8$NP+6oqs;z)QR!&eu#6(t3D;Om{1RgpWe{ufo3@aPCOIbQmp0hoPOT#wP! zc&m8nOW?T6t~Ks5mIS3=5!UYTjIiE<5$xn7aCjLsjv0*p%(%jQk0Tc+n^9Un3e|8_ zW>)f!7*bkKTGlwe*EB0==c~FK{49ZY98Yy_UPdcG9=+|82AC z?qnD%fV^&wem)4*ig;%U6t)XI2bbUa&6`l2Z>)~Qg~x5x?IP9H?!+03f}VpZG#oWh z_XjcF`m-P5s;<6PT|?VlVcK0Io?j81UxN`|DS(~{yCyqd)iwys{%$AS11n~aXphSY zdX{QQyou#jb?jvH2&(yuCWmjFkpK*4pA!tLJXOw2-zUV~<7>fhNoh!ZpIU6Pt7$XKQDyl{<^M9?%M>NaF zxy#e9ChJG%RVSCD@?U5WYRSYXh7{k{d^HsH9C>%U4zkG+$SCI!mO>(z$ade$-V^C? zNF$Y~-tFAXBqCTR@?Qj0C*rUzGGrd#J0z3(e{B1;a%p{7+=3Ti`JcQ2;Uz?XV^Tlt zCZI@N>`WtN7;q8a%C}Mj!BdOYR_#Px+{XHBy}Ao1bp6XBm;63lvK}EwYESyY%{LjB z6^DDITcY26L3>WumHB0Gd?JoNj;BO_FpKt(rX~4HQU~|UlLSHW#^$HHeL=)6eZ);h z#9jNSzdxe3+VIAiO7v&SP9u08s*Y*^yrIjC?)wkZ?Wjn-cd9Q>_@(HQ z)MxDQC4hx9KHE{1n)Bh=dc3aUvBeWnU|V})`zQV1@AO-S^qY$G+gHl=M;485%`2VC zKo5rYh>G?&Tgl(8GJ-uRqvZpGc}M((BERFuC1zaO_^S0`nbon1m#`^+?{PbzIdTQ3 zV}{^thyF|!s_Sj^r0wph@}MoZ=`rc~5g+M-2#M(_iIf*)#GCcSM=P=7(aVZHkH06r z%Nkvh8l3Mm2PS!5hTlaMY&8xWXjtQpTK$k#D#dVmAs`5|+p4#qYJLtH5u=&jP ze`qE#VZLA2oA6yE5dG5#!$lj)fkI$UX%Ocjf&qJ9`jYQk)x#qV#@*{mTm!}e6~@aX zoJOYAxQbHG`}3qm9Hoa$<|H^~ExJ@4{AexSXdO6BEhVz(E*jBQb^N&1#JB~$S4MSgtc^hr%JItT&l*Wx0C6-Ms|icz$ewjilJ&s6 zbzh_P(A`OQ)JgxuNpI5wds{7TTOEv7EtXdu(sM20h5>;1_uozWM|tta_0B8!v7-hE za)K0hME}3=$H0F$WbKK`N2vcWS{G84yWExg(6&1iwtH%;y;UuVE6tfa4+w6KSZ+>8 z_l|nhC!B0NejD6=k#qmiNSBP!7vG{UIlJ~hXYEjB{l87}5{u;?o9v#d_J9WLF|>oM z+9z<^N3`0k1jiP4V%a*q*{kA4gqt7v;o^oO6j7#EbaDgXDQor2y_ zliKr&GfsAuh5zidqnUgxz$1+S$b-$;e}H=_<69+KO=^66a{S+$xiFuEvIi zOX`hYoWlvI?CNdn zf8yPH%r6a^wP~5glHI-h91-Vl02MV3W2x^+RdCFXKUB;IM%ooD)mR(fM?M@x;mxfFA{tNi9;%N ziaG;Dh?bFhOj^g(l}YE-Z%ap{S8V)j%C$;saveg)$w>kOPFI{O3#D4>Z{iiVa}Ik| z+nyuA8HRA%C(HUP{MRM6SBggr4If3Oy++v|;V2n>T8B=;8Ef8Rzor?zscGz+$6I*A z%x*P!MB^O*>NLAlv-ip0#;i1(O6@KY&ox$TD*jQo9hXP$Jcd`XwGg{%ob8C^65Eew z;de@YqW@@_!NlftFS7f`U(vf>b8-(Kx}$i^?`6tp#dHR>QHop5v|)U6@%)&XkFmn& zc?)qQi`QfEB62KrTa?iUbtQZxs@=P*opZ|=4gA=GCmaaB;(Q0TT-Ns>Du!meuBi05 zX|@QwwRMOHD{RM`W&cs?gsy?C2p%bI6n`$ibLOXlnWM{j0kIB6AF+<8^p;2mm!Tzh z+1lV|oY!fjqr8{(v<)SJIZxf!>BsCL@WCJ3;w~Pl#u%zIp1xS*Y~>yq+-EJxvmK8B zA`J6cR`OgQSDZstdoDrWBGUGpRKtfqCC_#uUl;}ys`gE7H&rXt=2mdjRJEzR8g!NP z_DG(|g5BzM_Yu~2=%mCpIEUu&%}g_-Aa)~n?<*+9_}yl0mSUMyTguMH!SIgi9AwwG zy(L!1vo8X9D>v}=YGWKA2{l)oN9BNop>H>_ry2BzIZ>yfG*4>$^Iz|Gn<|JsvmWmL zF-Q?KPbG2{G5zlPQ7@^U1Xzwt_vYRcSaEhO*)Tf{bHN_{PYaAtl*dv#1u!fVz^XKIwn zN)gQxmB~C28cOK9O_^e^Sek)~xMijoN`z3LKj@}@kICJOn_WE2ZL>60$6i1R&ClfVZ zVUdJDMZuhDAlZTZ+LrD|0luo>+SI`iZT8eeT<_Z&8-YWqP^6$jPt#wWv(xQO&sdDl zlw^h1h%R9xir5pj>3)l!VcvKQ#cN;t$2-$Wb1${FNq1)D$eoE?=GhFt=G;gUvx)0H zI||gWe;Wxa)dhAF+48J;WDhB_?ygdPISgN&ue-x==Sk^`i0&VGm8J9?}#-iZQoD9Vw6A>?lMu(;a7@N46dx;%(G(Tm;E=@wj;uk^B zt--YiRngu=_lEte#T;I@H;*rBd;(J=B}&A7Pe#}AzHzjx;&44t@EtLX@CsQDMB!ZXNq<-?#{-oE-dBNjO;W2p zXlB01)(`%6GQM-Fl8`b)PXhe6R*D#n9Hexzni$v2^95^??>W?@2i4r09)pL7t?hO4@ovlx=nyT&H5Z;p)Rt0j^e>le;Rs~rO z&6#1AE|RS%3;D2+K>USR_RI2Wa}vhVz0U}nb~7wBXumDz&dMHHO0DducZYp-H|rTb zD`n_e_w0m(J-rX^D3HhcOFOF_s5RT_`%Xxe*V1p}4Bww)XD?W3&Y=4v-(cs5?~@wy z$oKX~4q1zvKeh2_0lg+e?Z}PgUVr(ip9?r8OxKm8mNliFEwUX+l#*N=V&o+oh=KppfI;6ILZ|#lu zs!z5Snv97fH51{_0>g%W@7t>FKtPDpGU`S`WanIN5(FkFTUkd@Jp>4oP`J9qZFL6t zwWcCf_ykj$eBI!bDznTRKbCphlhHO*P-G|&9Ke5gvP}=Dy>mUlQYwFjepHG`4X2a7 zBh=YVa-+JZ8Y%lY=7$CAOs-1PHS#m)n5JaU&Rr%H5Ht( zu!jn=glM<1Dn^yMgg5b0-2%t@m+xD>G6FdP9M&DNwd@R>>q)(A1_8r+YBxWE?!VEo zcX*@{t;pfJl;j_p^T*D*T;F|yNq{tjXoQ9g{X;ck?_bai(?mm`R3$qSW~uiSJEvFb z9vLUQur(nI>j*ay6|2F}#aS06Av^;l4q{i@Fj&Z*Z z)K1n>x_;@=WwCvJ3yJM1or>Bp6qlz{+9ghSK^X{B>;$@XFS^dtpAOu~Iq*4Q#h$ju z*!}n>OFrOS8t$oqFzJRP&$ZzOTK8jZsWgpD-A&}zO@o^b*fNZtg2Tq4S_qz5oU!7}wGl*D-ESAgKQ zEg{jKb61u51x1-w!r1%e!X2QrKV+A%CD2M-=}=nP_7r=#uB-|SR*8=oU;4`HD%8sN z^vpTu|1QW9gTVwX-~vrD^}=mm>>q?6jK3xD9I>3WqMVu`aL|mP_pkdy#xySeV>Sn7 zB9!W#m~lUhiVqPh)2bX+vo+JhW^Pu-9Xh=Q>O0 zd95WpnIo?!j@M^R%Ui@<6XE`iBd9-dL;#e6?>^ff;~~MbXNG@u8Ohag;%yox@bU7k z+O8n2%vCFG94Q(dE;}$>*gRaCG0bdV*}6vl#3bC9lmD81eoMBAJKU8D8nZ%=8B>Qc z)M=R=8`)jkko4W>-A(ORMRN6>Ov!A6vAazVzYvvuZ3U(=&D7*Q;_-i>BS>hvtw)L9 z{6_#xoD8c|QxnJi6IEXSBLFUw>?tI#JfX-O+BK2f&hI{I^}m9a~tB zop;7AY>_X(!SRD1yEZp<^ftAsvZTb`YInf1gXk$1|SMN&Ruz=S~6q>$|IQ~tEA66p62S7jk;SZxMYo@V;XdQ zr+p-)RI`yH-KkTCz)VAPhGBwcsLW`BS%RqDNduieG4044KdU)Wrw@q$n-k@|Ue6#J z%Jk8awO@2WBgZq_(%jxOS8RSJ*J-g=zEwh3=l&8Hl20FzfNf#io@e4`M@?EgwuN`OGQ1sWAVM#i) ziXg$GNQ~wmD`yeUlxcb59;ee$2A33^#l!EM1aP&>U>r|o0g3T-zkww@xi?R07vJg+ z8U4Qc=>8bzcw#k8_ig3zktN$(Pmf1s8N;F~Gi^_PjG&(|UQaOM<4X^n;0G6kl$TG8 z4!agjiz~jFGg5HM!kJ+1S(L55UVu|(?>ffKvpF=+w~W#IXhYd(x9&!TZ2l5=kXwcu zbtrlw`09T412QQJ=`*+0LDwkm>((3Fw+t@+pYk7_6cx9LoO0%TO4|9D*iD}MP$&S{ LWNUj6>%ZxrRwvgg diff --git a/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_fr.pdf b/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_fr.pdf index af1a69a3c1d833fe6db573c113311cac25933732..6cd8cc4032acd17658a8b820b1c83aa3ffe2e41f 100644 GIT binary patch delta 103577 zcmY&;V{o8N6K!nUwr$(CZENEv#>UuaW7{@1+1R#id+&Rz?vL;O?VdT^U8kmI>deWi zCr>US4{8Qw1qWE!g@oYTJ=`o!9pSv!mkd>BEZQ6cZtB_-9El&JizQ@5Oh}Y=mqmi1 z8e*VW?p4ZS$Y4A5+wt?iUIe8dws7m-5VO)J6hZ2Qr(&h{e<9JHC(cI^JtewU2aXCX z-kK2}2igewI!2D~O(89rD-56f9pqm}sxU$xPKVgh5C;Ar{8}M(Ts8HLiXpJF>3j=L zu$T_SsnpWo;$Rj+#Lrke+l%6M~;}Gr{k@pd6&j^I^DspEZi zUHfejbxBna5S9iS1PndTMezc2hh;J?5?H(a9f;)O`=!cHuEgMf4H67v7O-*AsQNf& z1Kp^OHcFq*f~in=BQLkkjg}&cAPl`y7eQF^-o!3eushm=5)h7dc?<=}gpC_wuth_y zDuA9pMz6D3bzEm@DCMK6V_T3=^^dgKNM7k+JX3c7{GS7&Tv*z=BG=;_hK+Xw1TI-{~BYZIspqxZP1C_$?|LnODny$mLy)thxNmS;wOC6d2rwaeVb4D#a6K)k9#DR*kz5*D=;zXmM`}hrV1HQv@+}C2 zY2Yz3-4NDUPF@l5#^!WF2!}8lAmpj=qh}R=ZLs%enRdQapMo#Upy`bq@aHAAx(IXD z?C1B2v|#Kvg+0&0%G)SwJ~tIw5a^zkfoU;_T6xCr6gCifLkV!o#o&peJN|kA_ZZrD zbr6kBR>A694h1haHP#bgG~H4PR%(HdMXb%htqm&T|u7;8x!WNv5tE! zmO}-iWi(bUm2N>FN~RzzHi{X>L0IxNsyJeXPTDM5YAogBTmS$b;6a8;KJv>ff$QDH zuGQ_!&HuM~Wb)OCH1T!^hwGZ#iNHNE3_Yz_;PIwV4;`f46%Z$jp78 z8~-8%`u^R1-^6?oo`2!h^K!rwt_jkX6ys!(Q0d3Ur zl`D%mZ(?AG?g1EA+ha@%iA>a_U9(!_`&iy{MubFNJ-$6e@RH<^XSEAf7EG`9s*I_} z6N($4ZLqNfgPI3wr>`1XLx%gNG_9O@2W?QG(w5GwHfUn>RS|H#9C_!PNfZ~%JOunA zzy3<$&9Xia*b2yiFDNUw!Y{(0Lrxg~9YwW*GNm&a>;XU`VT`C-y)4HSl1d>FHull- zA1%1k@Co={r&j2Hz(=e=v4|y)G&3Y~z=NlyBdf*aH ziy{L?Pb@s%tA!^r=pYVoQ7$q5a^S>u_R|VaFeadKGEdp_CTm(V4TFL@riOpUHrsIn z#Q1j0pMkIdRTrXqawwTmO@`Vel(<^Wc-U*u!Bti4WGc~&_WisynU|tM{nxIdQBMVSIoYQH6jHq zAn?hBTX*Vx^|$}S3bywNq4!B;J*I;?mvw5+h8gYomi?77v=)`u%K@sdA)(kt_7{rXJs5|sv*IZZk@Qa zZ;iOk`d9YLc^fty2x3d5KB6vqw^5d3AV+mmJ8Rx_azo};TI(>8Uf@jWQ0ui8vCv0# z>`q!s#3_>3_(H0d+dF~q+5d?EfUws?`D=|kA`p*sy6t_vlw1spBzq$<*6Geb(e?W& zc6Js&mCdBkZ)MWN@ad0gEi6{!s7QH6^)i8d+G?K+BRM7E|Lk;Ii6% z;s7T})*%3j)@W(~9;VTTH31_o6T3g~hqbed@zy2MAUz$}?2Jtuyg&HEo3%)cb}oUAtfjn}pN)6& z>l=Df0tP!KX}H20szq?r8QCw5074PAxbLxEhDEu&oZnVad=jZ#ecy8S-gb?&P=Nck zqE!TgDYwn7w`W<5X%&SC^0%B6ju^wALPUMF5n>!T)_WMZM++G=mn!(vRa&EzhVC9a zzn@6D#VMvLS=WF5s(p=kY*?~JMUs%>)v)|i$fE@1HfYuURXB;IQWe`$3wUxfz)3ql zA^fd{T&!fvf&2;K-sOJJqlY_$2JS=Ah~JU3{_{Fk%)y#*XtV{(b^}s6{r75oMaLKg zF09!+S-1cQvQ=&^)QZzd;o#mB3nQb5cD`b0W?$VogUj7!-SRQfCWNVXu+K({n+s?? zF>0`Oyex7%CQcyLdER-fCs0{#Nl`U?N*JsEYh&G9;TeneV!Hev?&s-=m87swXFjZj zl&L^N{vPXCs#o$MExBNxYEeBJLf4UM(f$)Ix7{+gyFV}Ydm?42Q!iW5kZpIJwG?ro z#QN2tBxp+M%0eNsD%sVu+|TP`Xq%mu;#2Cz$qWN|vBhhyY@fbBUBG{jX%t2(yZLk# zHUuYir#+503pw3H{oL*D1I)F#r;hp0y{RjhawEJue)Q}MdFmR;LzkS3L&k^5pTD4fYV@+XgcwO z&R%w864{($ZPINM>_1zb5#9uu+JRoBW3xPiYIEXqTxdZ%pg4Tb^2Mp`QCLPxz7F?9 zz)WM>;Lk*)-%cj$#(pQckrHCxINY(xTL7)fF7)R+cvjJz*(_pxhKc?#hk`y7JCoYb?0( zm*_TY47g?{FvBy;Zx~1m{mwIm1=~8{5YSUHdoRP!HIr^7E@Tl6@%uqzXDB^IG>u+7 zbrhaE_dK+uhQqy^2_!3(Os+WGb71Hx;M#Iw(B*14#eWWTJETCTR@V5>BLF ziAd)8B|+N1NU#8lh~DG^Kop~VWOZ9Mc;4%Pb^%8Ph%4xU2LD;JoGbvPF_p)fU$)hq z1{wf^=5H1GkG&12`w(J6<__Ul%G_dRkLIbE(w#1;h{SjybHf#d?HEir}*-xt`Q9u5YlzdF zxz1D&;J;FCQT#VKtJ=t%xpPAAtI#BDP?U{>igJJiF2BTO)?Ud7k3r-S_gdT1tv8oM zm1MwwB*>cTdPr4h?**^GESJUG$Hb83sOx^*e?>40SC-pdS<` zdY7xSQ_)E6>FIy)W%8rLZ#ZX}>X_lw4m<-7A>2Wp#5K0{UrX$<0KyO_&T0oUyuCmu z^jh&`)}Bxt%%-0FiKTJ3fe2>fomO$|mQm~<*1C@+&3*)2g}!M7cJ6JN&f=%^o(X$_ zGM>A@pIE~@o3cT49Sq40wh*To%CIW!jJ1qOU^!2?kiJ=)^0c#&1OxkY&N;ik;&gzL z6{}SyLEP`e!#MEI`mb*n3=hq1k2F$wi{%VGmCOVWeeisX?kfiIG?^OLo4I8v1n0mY z=7Ec8Gz(p43q!VG+m!q^aJ2D@X*P-I;`&+V-)C=@sb zNn;1u`0QNH(1($=v7*uKN2K&XHpbpwz`}nG_A}1tENv7F1QalShM#}cv4Jm|+1%uU zuJ871&m0IdMm#HhFJ!-+=l%us5Uv7I>ws)}0TuTFJ=BHz&4=2oX;j(%3ioYI;>Wu( z-kU8e+z)DDAGTEPDyyVCtfK$cR5UKAEc^#A`XBt^RN$v;6vy+zK5CcW`^nh7;dr1B z1nhOq-SU>=3okg`$9dRlde6m7?Y!zsG`TmJTJKP5eJzQdhtxbKEi|g0eo)!8~>%#%Ra?%Z%*($5@h^ z4<)ECHU&{+QF;%+E6t+pyRDJPDtr)^I-#ofr8<7Jn7V<+AhqZH_5R&ZK9Gl;FJsZp z_TQ-i2JgVye3IinB5SaKM^f=LZa1bAueZ$8)o0~kT;PdRGz}-b3q7Bj{u37TUAv!8 zC|5Dh=r8OK-7-Ue!V~etT|b1gkK=zEgb3a>RWfjfXyAUm^%0}b>TlqV;8gbB5dl%I zf^6|QeFsr{{ma;eh(?deBon?_?iKI8lOF@nyx+uQ+7l}2b96B1>BJbIv;fcl3L;kq z^3DfR2)!@br^pswqdwpfNRXY7zWN+(h0y#BerH6_i+wvj_B0cXhl-8UQZNwwjS@-O z2?={Hivbt;2j9qip*eH$x+{VKPt<`ge}%2{`h>jlgsPBu+&4vEyw8b5SO*lLM@7tE zUO!jj-BAQ@0YYe}18V70(cynzFDL%-A45-c{(^7f5$bQ$3&Q#RBBzVOBHcXMsNcVD ziw!6-Z$brM=@Y)a?QE{d-{i_l_RhLo?khfH|4Oi+pmw7n{Ru&MYn7ldFq{#PwBjLR zJ2+Y>{wT}*iSZryS(Gx!x;t;rRS`#w-r*fHIXSS+4zvMsdC*bZ-_PEzVdE!l@vzpK zFUEwVL+$_m*;BVzjsN`o*SD3omHu`Y!LqI98^m#Nm1#b`Hppu=V1Oq{C?)q;{;(SC zen-cQ{sO1=&I=s45`=a>_b8B~CKQK6VWr!|9txc(&`q}|rm|Bu3#SS{uW)daSAiir z^(bk%0!&rhF(8KIXy>H3(WvG{F#Tt9*L0g{6WeZC7RZqu6dxUe;0NRK)rcwOKY7KE zYh7?ns@Z;&nW4-jBE{XcTYwOaG5y1k;#^Hf!A4|fc|U79BTz>(JdENmEzpA%y6{Kc z!_U+z)I+;9l8Ezz#?VFT7BhpWL{yZiqiBNB00O&65eLSo=HYZ!MNm z52QOWVrOuzPVOU;qvW=O+(o1PhhX5)v z)!!vU{%O8IA$<;Q%IFeF4gv{ika8wUq&aw{* zp8M7h-u5qRC{+H+dLlkXOsb&qe$`l&lhY8V$#V4rA*&>vG- zCzmAbcSqa!5=v62wA`_90CY(jj!x0Y2n*XcXz@aeXgkP0*KXxWuDYSk`^^w$#T+Ja zeN4;i*Z&E7GTM4}W9FyT^nxZsnG1{e`9F5!>n;Mzr?rsce7zg|R48QaCJOL7aZIK8 zvY7BvcSB&wrG5L1WAuV0$W+1$^*|*}GdZ5O^L3($BGF_it50B*0gRIfrkJ&(8*x#8 z-QsLf3<#Nxr1x#s_$VCP0w#_gCgfZ>Hu6b$31yxZM`QG*wGxl`7R+|r4cK))AE)-R zKbm?*NSl=!W$;XpO6;6Shy5x)llt{#j1YMWd*RwoFykj)-6@O@UVgUQ-&IBTu4pGm zZEnb^L1L&*CD!xlJ ziQ;z{Z%#H4jPfB)qdsNh59qe7UJCCX=8|bS#97%2O2g+v%oK|3?OodmauPduYQ{SU zs^L5PcN9EU3Re+n6$11Yx~-E}<5qB`tif>6?OjI6lrw8?a3vql!5;N=)$#P{{dk}_ zfD_{N>AI*wCL2qYwZ2L|Ww)b>zd9hP(FdhN*-mG1DpT=qu<}p>;^~aN&CC%0qcA*J z65n`c9JPDPHZvBSIxBSE;0Y&PCR|Z%W=46A^?GFdokzqNRJt%9?(c#dkKM$%2dD+n z=O(oti0FF|j2wHi8$9{eS!?0%DkiLE;L;%m@<&*cmjT?QR`Zw41-gUL3Y?Ol$;P?4 zaRoK`l654*ZLxc#*;#h=Z~jw!2pA9S#knYNd_C==nDQI8Zmg>Y=;K)3mD^e-$Hs*6 z%C6HFTwAZrf7_vJhW>&>^Mo&mJ3d`sn-@?_dRbx>1WesU+2YMuuI02czxu zukx=Sb+Jhz#2aOGL8z+hj4bonxSro|5l!jA1{r<{EFK5=KJ!%;Ze$D-?Btf(fw}V5 zaVCRtVQcdt*v~o=9c?00IL8N{z+~yJ>53xXA42gOOsmj!c=0%zHZer!QDx3_1cv6f zvw}Nw-Vy{57-#PBw+g1W3eKl+ZN)e!JFj%oM*}$_URJ`^`_--S?$lfU!xCkAV-l_+ zLqr6zd`_^8UnLQ)wM!2_5(RM{FGWA_8h!1)6)lb)CYb+$L$1Oj!dW_5q%YCIAh#V5 zfc7r|Y`p*bHt8{tPay9=>^;$bMQ+!+fi`(072y(bikV~_9dPP$8zXp5?IZprp;|20 zXxPIZGmyVw8C^*8^YgV_=qoUpI_Y~XMVtC&A8r5a!O!>hSFct$zqmKZ zU&n#$Ut0JDPX`PSyI0XlePv!G2ZHwI3Hs=NON?|~lkq^r6oj5nqSmOQj%OYFfVfOZ|uMEfyPUi!$|T+KDd-Hh+DXtmCR_ zc|%0>sZBv#tlgv+{iQk83x8%`C^0eFNj5Y=hK4z1Rb_vEEAcyP3VEc|z2SPcQctB) zL(Ee*A^DAB$6+$;di1S2-VE#Gna{iqy3~!C{dCJyG%B$jy$(xa&&KXa(&7nK`u4QhCY+W+duCq4)#3zoZd*brJx|>gF>cSz zlM52%YYaN@UKW5ER4-Eh8d^N_KPHb_I*f5sy|y=0s*tobp87adqtf@kmAm%~(i3_P z+*ZFx5~hq>ZQ7G`!@fr$cHZo!7C538SKN6H_an0(mcn!$+Pd8%ys8XsJKK=971HR% z>wRUkP2{0dKf*#()1@+vNLPBq4_f9lX9)wKi@ECJ6 zGYMo+YufAhAk5)Yz*%MbgS+I7jph6&BA>-nq+Nx5{!WBLYaVu!{%>Yz{hedopVu0> zLl~ag#cLq*=j8bFpKQs-BdeiuS-Ji@*ya>HYWu}WOwM3QgLwnkK}^AJrd=4*=TYYs zP;iZ2FE|+y?sy;M@;>GO6gja8swkORH#Dht$tsA9UkEWy$Z%$XR8scX&Ip(Xzp_Wo zZ-_ln2!$Awb7fRMWQvPIvrow><1CD28dUg6h8=)PvG*F%C=vY;trH27b7aY7u>Us6*bul)Arh(SuMC%N$~>2@XX4nV1ij zZKx4A7&>#Qm~X2R)?X}zL`Fmvv!OwAVU)k^JJ1hc6E2X%u~$|)HcfY}V!j_!vTVb` zSKt6sS}Ev3lgOYKeAv-)M`|K5jz)EPx|Osp8E=VbdFjjboDIjef9E~i1Lx(;TUVZ0 z3LA@5jU^c{Eh#L7oY6eZ)2eo5zUs+&B2j3}aefFy0=wI@%7Yij+hfW7r7+*YJ`HN5 zP(7FFR>*cpHqAdaNF+(jH?C=3i{LW7CQ$)ierwSbC2laB6(-`KtW0oHOubbbo7HkW zEr_~bk!UJf({gv0BPf*CdQor~;suqU8E)E(NHV`>eoC-~o0ud<`CzHuA#PATtslt} z{6W?`r`+2y?+AymtxY>s)l^0zSYpCra!Bmwa;}lVC7>!TTn{gN#V983aL7`%mqP&F zDM&&S{rxorPo>oL=P`+#JwYX2uJF5IN_7Udt1+DQZ5Ly-k1aocP!rV1sIrjc9)u!l z%EOG99&idr62#wI4=`-hMJnBPC}tg5Aj-!ND6P8=u1NF{|2Yi#nUJhvm2O4f3{6Ve z>1+lu#^AGQ))+c5PBxTgrs;QiJNXlcM}w)&qMvd&)P-$<);uDm&>-W6^Bk!e7_Z#r z1SLPbq-%&7PxHY_T&mZy-+suMX*fKl@1+LBbOg@@ z&Rx4a<7)1Wf8I~`4M3^b@0gF5(bGNdb!+#qDJ-pN;)R&O?MY$DTksW zfQHPM+jXw6v9a5f6@wLiLUo&%nVvTBL^a%Sk>#*&+&QF^vO$zWQbXSVyt17hl zdBCiE)OrV818>FTcUY&5qd$-9WS-_@eBJ< zu#N^gdk5*2bf2QI!M?HP@Us&CYSRe9bN#c5LVmWrau3;#YZP40jO8^b3C<*{;Lg?r zwrDJqph+6lY6iu@3?`}$c8WSo&S%T>_AZL{VMreyzUvF`$_c>R(^uy;$+H>qbG@~> z?!&ARLt>CqT9~z3icz()h!!8C08C*3?i77NPh$~ETrS>H8)2BMN>VPKrFQv&Xv)mi zG1)$<=&*ZDchdcxm*21^d1Fzy7;a~L(TvKQ9P4HZTLYFZSp%rt-}#+X1M9Ob{N(YE z7H(eaOLplWVJq;|l!ZL%lDKhoG2sz8G!4euIQhq;Yc-OouAT4j?q^c7scIp6GD?0H zuUQ>#0biv&n60VwUT-FK@Ob)0iNv(+u1qI7oMRk)rq$BoG`Ya*o-kr4qSNN{8C6=v z@Rg~69&GZe&eI!q{(H0&{5xuw#W#ra(p%PDM)StvXlI-auFH#Ot``(xg+`P%uWLyN zSQ%0di#Q+$2aaCPGmG1E7JZo`eguX;nzr@#a@$(ZPN7+~e%O~QBi#_zjOY$*#+w}n zZ6%>hz_zAYwoENoc5hy>S4?W7pzoTtng2cU+~iMCyIE6JIZIiEd*3?ok)uaZRmMkE z=qnRb)d#9)#2?!$HJXIj?-Y#LbX<-!HGFhjo@T(+0tb`#;(+P?TCk&C&7VsXOvg-G zf*Pp2o8Q%R3Eg!+$Fyp((o*R?ZW7+3HA(ulxbT4qMUN;1sHuV<9 zTML{jYmJ$|F?-yw=e$w`i0Ob>d(Olr#>p*jl^b$T*E{P$eH?Wn-t>y(I60oep)YjM z_R)C?2T?_rRg$HE3coK)rlZ|->k#xRN9Q{(1T5YA^ zTREZ!sMab6N6Ux1pd6c3wybmXUlOT~kk@2e)?@pVx3@al2qvf5J)H+NQnsn7b^L%9 z^BSdTW1X(;SES{N_|8Xxr(66Ga6AlX-j_~$aKW5=uiIn=QqhatcwdlLkBfsbG8C-@ zN5xE$R4lQr#h({8*rZ$9MqkPAjm}wd6f!RHA&w`^%|^<4Wrf5VF}C(IAVrC zN6W<@UmC}6b_Hk*Ht$I~0vJ~CR7dqk##$6iLhF7Q5|p)@+2#1xF7u8>kT-2Y){DmI zqiQ8z6WCl1pIpSW*Ab#ToG>{BRXo=wbo|+3VuF=*(88%0>Lwz zIang+Q8y@*o}PnFILg_NuZ6{Ut3w+v7ahK=CR}m2S3>U8R@wDO!yi-$d>b0>(g$sWb-gF(8@;>)N<`adu5~aGiBjuFr)Ty!Z zD^Irpcw|S_8d^6=Xb7^_O-(MWO?mpmVga#1bjm;^Sm!w zQ1ifPNACAVWnww7J>5rC{wd#PyF~Vy?LOu^oT-%iL;MG?o$G$^3~^0U_;Dbwo!+?H zE|>nIq0|l)8};jQ>F=^aq!CEMUgU~UXYg@A$^B+U_UHKaBl?=z`Mw8chvX!}AHc#Nz*`<5Rzd)t|IZD0WvK6rFWnd@+-C;T zcgfrT`1s{k53|ejJOWRx%JAV3WFi_{p2W#IX39g(yKUUJvx4DyH%iZMuck3AB;$Z& z?ORz{b+Np(v_2|^wSFq58<-^)8K$hSgL!ubcfuePu!k-zj*2L3o&8Q{H1dGIdfljchRAn!ihH91ZNXU52oK_SYac#tA4LOc8y#1OQ}gx_s3 zC*IaUz%ttFF5Cr-dsO%n9ZJ|B6abq~W`jXygm>rt$Il}3bJk$r(iXL@=$`)!E=WD9HeiRNy`A+ z#0V-8#r6jG9nqnwxTm~LTSN^wh?B!Ji`xU~yB)?srZnv5G|--Zz>|^~+ns~YRZBKE zW8wKJTog{78XrWSY|r>Q1_WK=5ItH35p7qlf%VzJf@OvoHG|Eh6#P17Xdw9oRu!zu zk_SUrN51DggS5-00R;F_tUzDS|dn*EwS!yEzGZa06haN2!LZ3=Oxib(L3Ua z#ZoBD9=g@(ugOm6jxaJ%@W-0<%bX>)Zl_++Q*ym=gXg#f)zMe7opkK~%X_81&nbXE znuLW=45s@h#8{&rf=0$OoD?ow%SLh+(t-qs;NQE-|4wQ6u97yyX$ENo|oT2(Fd-)~-5vh9%Mnm_&AqB5o6wb@cX)9R)g*1fz zx{zEr1SNzDLV3)uN83iCpSrITQq)gznJI=;YytlTst5=5ScY~4+m4PFlqe-_`tT^)-*}v5Ms*+Or{Qmry#1?b)de^x7kH>w};Z{ z!@`s-N9oVGi9jbqQ#2}Pd_w#SC{{g1Z7?}U;Gck8Fo6jru_TPSBo8+Yh9vXDQQoBca5NY%$x87l4!JW_4hxQyNg$EA*!(a_QpS zIsE;+>U`te=gHz>`8?u~K4lkrBxaJ&ht6hyML)ZRdRh7DPUVbH#GemMzG?<@ltIsusGYJMxk zI3~dz8h~^XUN)9k?2;&2-wKhj1x^4neUJczJsECiv$Q;2*l3+FXE83lmPmB4;4;6#IAAhk4=->jz#T*2nZ<6{&eeh$0EcOa;wMysrj*`D|VnA(WG5 zet^g0j+vU1IG*N-+(Jt6SEJA7^5f95vr!}T6Ie&x5gV6et8Hy(or(4W$#j9X*^LalJq% zq8u>=&=kEmRaq#C_ZSC?*SI#;Q8(x&@yXpGfC`p zy4)f&{aEk(I-UzdR<9j=ugAJim2Zyaxic5sQz=h>S1uAxjB(mlnDZWPl*@+dFaNbw zmR6M#tv^_;Pn~QPVsD)*a@vdF2JyZijIC;!4M^^bi z{wTNq$uIPaitRdSGK*pOq-5PO?zyW)eelxZ)HOG#gl@N*8*C2un&nM~;T(fhv4M8n z`f`~OoZh~`yWSbzZ>(b;?{0haH9Ys1CG8}HxUQ#vHgC)x96eY5ZFTw^(A?-B_tk!x z5OA;k(&%|Tz8g4v+fQ%V;^o!hJeeZn&bzH0BXveE8}j$!-66}?pP{tjX+wKZpiN5W z!UWfI6`u8NJbw>#TSb~Wbm_E97w__Z;2q68g47GT2As-_YL^^H&eB5Llw9+aOLDZ&rXu~lR|{XJp7&bvL7Tm*=>C=jKge{dVs6f#`lDJAy55FU}6Nk#*L;7Fmxf!d*RSCSn6K$?4_0kjJER z`K}bM-KpzKt9$QcBu?Mqz8Np8>ipa*77*}%tM-52a9ajiblG|W-wFlFwQ-v7-wOR( z?6CfJBhVjDRp!pD1*$S{XAjt%4d1^Wilfokp^s(bQ)?JednHP~yI=J&Us)P9E%X*E z`v0D4vy6HA@uQF1?q>5`dCrF|2t3_-=oV2@@H1ibQ0bvlwJ zszH#T9T5!xo6689bg>}`{_rIEQkoMe5`=oa9{s0z9_PUqs8^#fzk&RCcQ`$Mnk7gd zq80BB;PuF)c)}d{`W2AhjLlXuNDZC>g2r*EkWWIMe)A%p9=CeOWO*ze^wuxSAo&P7 zYFl8i%EqPZ`2^x`WR3A|$?mAkBooM=9mLGqvs?;rW)DPX><7p$FOoQ3_JVar%VcgCg`{c*JCBOl}LRz z;t&UxqZNI8S=q={IuidPc$!O^jr1T7>NZIi6thJp8*%mJisCEh?&VrN>E6LY_N}-q zK&u{j!M(!sIq56sJ&Plk=6OEdO=Y}6(J4wPZwgTe7_dO18`-r9o7Pe{U7x~m2N*pn z4G?SvUP#v*j+94KI7#{-fE~1H8sk?);j;*`;|#)?CYTAS z>r8)gRdtuk2Q_vqko+ZtEpE;Dn)MwxG815#`>4+0Oj(iFqs(LQRz%6AHRea{F5_j{ zVa#F})0%432X(MibQ_B$*@Q9F!QTWZI`A778UA!VJ9at5Z?sVVaX!Ucw*A4zOB(+1 zJoTSV|HljQFY;S=GY|e`@(BVFBM^zZQvSNa)DrHJ4mER8Sljzrb<~U#8&39r9X`bK zOjoJ`Z}JxUms#UqZd(H53zu`Is`U>D8DQ1Qq?TS`i!PO`U`cL_^H#uMZvLJF|02GAC?AmkmPDfrEjkG{tF9P3f} zgOnLQFR_m=aL3YbV~5pdDNQi}wKJ&U$3hJ-U1k?TchpMyRhk_RS`S_(8DCk1TQzcE z?v&>b^YvYSMr?KDO=l8W^L|bO5nF`pJ24<_x!dtS1|7DrUhmsk=18zp+i`GjGtKAX z1Mu)*7Th$E6?yGXE;RS|JeClLE~Sv*cw(FU1nK17x?}sahtzy|bSG+w$E_MdnEA@; zTo;cqudBjoVqpX#&G? z*=-9Ktzn2{E8*)Vpoo)znfgaqSZJ5dGs;C%sX#^9V%JtZ1L^R3N~^A+IFwz?Q!A58 zfvJTXWkrwJ$eCLp7yddBH(_O+uPJ6KVq(=K_j}Ot>Sp{#&keWiHQl z{Ag{iIw$R`%PS+7&9Nqvb7H}1E;Yu=d!=UEsHXm``=5DAl@t|w25HxrW*4EZU$}#( zI)-L~(mHnuuI3j2r&Z5W!KPQwMJw-Ud-P1;E#7^DU*Ju=d5EpbYZ6K;8Cltyn}u-e@=BD6W|X*=3NOJ{lEcd~|bUu(6g zDXpXTxhPXG%oJ#?67p)u-I3|S%jZ>>FKD64ZJ-Ce|4$!k^b57a=z75B<-m2=7sBz6HUGZJnD6qZ>0e^Y#!D=8-X_7x z8fYH_FWju{3s_+XrrvNNN7nmmc!Q?_QG4IPbl;y(w~;rQT7o`HJ&sr@DNdYk_5nsf z2=o3f<-G&>ua(7LDYs}>J&t}pFyiy9t+W8vl*-w~5rb##+P**ze^>3?#BFt1Lz`n% z+Ek(7G>PGL`Q=04p8dwX&OGfrLT}J46|CmDFo-L+CCa}PE#OB(22QbGbNLBk^Ymr0 z#r_X>1Et?f_1h5JsSizidYvhe1r|PdYTMdHW|J*bj1wgIO~|7LQ<#$R?&F| zLK%Mj_1gJ1(EdF!KE2^pb6<@U@e_@HR-8S&nR=rI$R8^bHjSyodvnxXu1qN^#GUk>irhUSd=iy|EAflusN`U}0k!V0 zx|E(7?WL9G zo}(T&cnik-Ip*MW78D5;#k7CfYR;RceXkHRlvM zDJK_tnaHay3^jkMt<9&uW6r@;G$(NMGR{rueQI4g027#ZUY#$sN5fHe75<(3n2HubZ(fB}@2NHu#>hJIre$ z;^avm*Z@b51TrAnfDB00HGr4ne~mQ5dK2-N?TA|^^q=4*s8972`KmD>nV^loi+_k> z)wT-$o;0&c*+HgMRi3ClzlMi+(fUwS_a{ou{mwAie?_Jur()-~+Iqa>&wYgi`u_W; z3djq5*H!M%JU}Xa3Fr*AO8yNC5vr?jbJ4fW1MLI-4U7bD)E|Le=MS-7*LlPr%xtyn zY~7W8(so*0bCZTsH}5#3I6YfaT+31%u~pm>Fa-T@di^N3VGQ;!RbLQ!pU(S~Ngu|7 z^(9NT9?Z=!1{cJNe(ie5Oz20zMm7_0RP+y=)X2ZRdFfM@`-&gDCo=n{g?U8`{i3ac>MYCmw9S0 zFPDp@MpN+b5;ilghWTNY*wTq6*j^RRX3aLP= zDW5UzL1*CAyw+q!|F*2z;0+KdWo+sR9d(#prhFhU*epxRvk!P*P z_7f(6l;GeW30%vFJzkHN;7=YS>kV5jcwJXQP0wKubGLrbl1;bCl!>k`-UV1QE{$5Q`Y zpJNr@<&g)#{6*7TR5dUuiK&BtTYF{Zf)tUki_JUgMEzpwP)dV0onAkpk7P!1I7e-8 zm@eZzIB@m+IDXneCl$CKS=Kf}La=?e0L)mqostdubm$DEE{whX;ad=_xm~S}5%yD+ zh`cNmF&LV%gBpLPzk3sv6p~Ha?rx%KljD+RYPs$9|0$0;RjQym%^ayMro(77BHQ`%Ua4V4#0W|vVj6UDnu%RKWM{$?w-~J%^}UM0qBGM zCkhxa(lED)LcE38KFmwTuykU2lfpYubYiqt7T8)Qz3@ij1Y%HgRgKZV;d1-QLY=Zu z4zb516U{UXgcwi{C7$zd$X1mb-NsFlrI%4uVaF4+b8~bUrw#rOTkqJNNgHr&c5K_W zZQHhOCmrXCla6iM?%1|%+jge!XJ*!VpIP&*>JL=y+UGuwx~P(amO_;$gp~4`M0^N{ zW$+?63bgF;GdR$Rnjs>#x4;18W)HO$OHQR{eY8X*xH1VE@5eQ?Oid8F)=S!?Ddu2H zz>JL+>mPRxH&G0Im4v*Y$oW6>BIV$qLk{5*SD^M9YZ5+%g!C_Ks~+^n-bNA2_)GVt z^sjQF;$K>k09A|W^I9~ot0G#K5AU85rTXMaamh4$ML>*Tpg5q)GHV0e*PaE=9_E4H zt&bky_fqR?KRS``!%0Dhp5Q5|U>WHJj|9Jg%VXp4=;e)=&m$+j^(b3cHH8>HK8!u`vV4{ zlHSQivG78FfG*JBnjrytcQm0dKm%&nw#A5&z0b%Mw`B@251{Is^LBW7ds-~fFQvpM z@h}fgM07laYBjTKQJe@%kLJUM^-wAtb#C{%G^nfCW>rlcr|P@EAsw_5O=LWm;2WaX zeKfYBZ{1s0O(BPkX&cRzA?c&6NCqi_)aaKLL@N-h5#NI7?;O&1Q*H#`?5Ie~dR@fT+=v7I_pF}GDg(;{tS}Lk& z-K9ij=zX|!#2!4dtziBh0lQlOb7%N8KX;?%v>osAz%P1}Jx{irK^7%byb*51*p5|b z`LmH$M4tx0v#!{C{K>XA&>COa{6m>2&_!Kjs#hJC(}to%aU@Vyz9%jF^ud3;EQfd{ zviP~!i0Up|o`uKR=bm9343Eq9^{Cb{#dxA3ClZZpg&$bn{+l*^VF`0r~WSzE! z+da6m#d_xZAkchk3Ft6qJNm1BvO_JLS`jkfLUW>%tQ=H3EnZc;;-lSD=~Q@T9S(%H z?X5a*xgqZf&s!y0JAOZrpi9L1dB|Ci8``57UJA{ri54p6f~%3`W{qu1JAT2wQtQCt zc`FYHC|Z0qY2rpbXr(P95oI}qvQ|spTle~nRw`)}I81d#sy6;0ub9`STGDg;9G zk{uTah1FS`yl`85v-gjov1a^DEXsb|-p2CUF4(2!Vx?B#Y1-NM+QrN~T?7vr?AeLC zn>Q2l&X(c_ZP$_^TB^c;@WEEVOeTu9Gq3`{9A=y9vA+AVz}uVNjBcR=q_95 z7>;pP?xoQ^t#Dc7B2&2Gt1YteljnKd``V;9qO%m%&M>|rdK$5EN^_K&FPUo4l0Klx z+O5I9N(m7lGP_u|9EW9>4bY7dysp-NxYJ415SK2!Vz>TM_pGo#Dt6r6ejhF{;K~BP zE`nbLx35~ya=n9?%U@tuiY`WlG?zn&%;}lnI9qkYM#w!?;XZ9!Y-vH)#GRn@J_|24@8@ zvi+YStV>%a_JI9A(&`mKl;)hyFis@k8o0}jr==iF*7#)}zdiN)OZg@YPl0%b9vpw8 zLGJD@K510;N1jpXGf1jYibf_XyXI%N7lZd(I~(Aa&F`CnqG((ma^{vUPY6}&1uQOD zfA;h|0#n>OBWOUW2soHY>ccAP8M)BGE%aDzbWMf9?}rTmOdh?SWtSpL+fAf>$m)l)aj+h*~)6LqlgKI~q93iZ`n~nm)9lydJ+k~Xarp<(gONc9u}P6L&f z_h@AZaUj7Q1)wrcr!o~yGo`w{t7L1BzqJ&}GZ?x<6&aN>mw5voA1BZaJ8~KVTau z{tWtPdu}Kjkq5$=Yg?!7kFIM!T0IyP>p00Yxepp*0vMmm#y8jWA6D#8uRJ&;osA4e z-uCEK8`c5MfQSFJf~t=E!{fyyNcn!pCvBHDPV^fd5&-kP>uV&SykkZ>ws9*IR+m5& z4KEX%e2@kn@g^TpgywCIzeF5NmWpBNvUA}LxmT!bp;FU&{K!;ea$D38%=M#++Yd;w zm;}f|;mcT1&H*Yf{fm7F%2P|hDG?%1BY zbD!lSC2Pgx-NhG1>}zO5_g}l&MGKllUtpgEt}OuQ2X`6W_G^Nt4vBr6lqr0|7j&y# z(Vw>@*vaapz9G%hNEIOmaXCqZrd$ivY0H;!0_ymI3L$HdUfhl`sP-`xA+YF;KLUIhGFZuDdyQ0 zm~3eq5wNCInvg^~m<->vBnS3n+~FpiA+2J^I6%W?-?aoO-M4J$*YA=pH$rMB5P*Wj z0aY0wV=-1mq_Tg-qO{;yhX1Lc2G`QCP|lQC*qI$NnXdRL5xjx$)Y-B^e1FM&xP0?f zjROUhaL1u>=9z1zqRqBO`9(Pqm^hBMra$I6@yxyWHbvXsXx*T-b2jfe5HJ zDJ`8}YbYoHtJNr3P${UJ(V3qcqsQV{t)XR2wilcWEIVPu*f`wn_eh~SL~D34S;X3R z(k={VhfApxQA{zH|IpffaKY8bi8yA44vgX{W>z?s-=nX=lhwDDN1!dKmc#Y00V=?C zW`MLFTd72RvxPcU0_fkFZ7hSwR>_jtn8`fK$FWjJ&G0 zlOy6Iifp?8?}c_Y3FvD>gSnUb8@2-^Gcy7P)Xktez&@HIT?_$L$C2e~y7wsP zoU?!l72+e3=$n|etw!s<*ZPWysvG(Mhi3IK;{(g$&4-(Z_K=8%gduYZK*ku3h6Bzr zgD;44(@wlcveT?%$Qv0h@Q;A+aw3^B;{{9EM){rYi3JCmfpw6dSG5>~E=}V@HTare zp$u!=#7^?FWX&vj|p!n)vC(D?-Cm z1ormR-0gh{3cA)avSJnuzzxNvDy?P9;AN@;aoF+N4cAStDe1%BHw~V9)UI7uL*DR0%5@@*(PJz$s8~i{r+TO5@tuXQ zGpRQ$wH`U3SLtDinH`RAlOVbEVc1S*g{Fo$@n9OeK+TGEpE|k^FhSxpRBjT~YdEl= zGKcWY(^5(sPE@aQ_Cy3gLfFJ8qih5PQGQ?5#xwPL3s`Eob6SdO6NF706Lt-E>rSbF}LBpn?(Doi(fp{A)(_(o> zDl-b}^i?d08j&yAAOZ+PNsvpuNlA5KD7Jn4y?Hj&JCN`LsG?~|#bB8066S}awV$s` zQ1I;Qnedw3SZlot-gpJqGDXEo=`wCd(8d~lQj#)KC@&0d-tr8DNBDttvCqN}6MU~# z#U(KcIRfI%5+Xk>4_T`2s3yv{h(|35GP|4eiL zVt_-cP7pW^fQ_B`f29E3i5iv`xa}9JPhfRXDVBs^1ChXT{@3&09R)B1-kWlblI*@; z(!^v+sdrbXVvfeKydp}d3d;TWS?I)ub&UG0}28R z5OMu72w?;-14!uk#eDwAbrl1#8v+1%% zgGBFRIkD1}lBa(B!tGo!r?+wt%H46&GkswF**dQs%-X4<-LreFz`g_!wQm-GiTWf( zCxkhXBW?0V;v_peqI6MMlzov7-WK*BTuP8b0N<|{eU=P@8H8G>nVWICUV{Kc7e}Z` zy_(lIu(Q6N&(*E`&$kaD%bSz|z&N}X(ZG`fL}QJyQ%22?@9W3jN_>Ro#LkYN75z_m zlMroW`JmkEVt>HYVKoEE6{t5fDy1daNpJL;zu9rh*E$eJp72D5>+w=y13BB0KvxI_qsSk-vlT#DZHopTvCx(y`*01 zC%4Tq^ue+Mmy34VUklmonLPOe{?2LC)!r#%{eyG7{&9L?@IV53jW)pT)`wr$#6N~c z9R|mE*xju^Ag)gfk!B7x#gv+*kbncc6D?BzoNl7>Hw!m2Lr6jl4t#Xy@u=;qYUD2) zi|1?QNy%<1?^GLC^i49;o*uYvzbq9P$GJCpWz2FX@m7Oe0Z7DW$EzGzVS$aoQ829e z^!%lhvgH`g;}PX55eYz9`%@J?@{XlyqK1A1>g*1B!`PmIGAw8ilL1^@z-Zv(TG;+( z!=!sQI5-PvD63o6FZ+OsKE%!}rx0Caclqw9H0+xtd`Kx}IK$ym2$nyj-7q2)R^w$~ zeK7kg#8w7K(5amHNw{gIt8=HWympp?+)l5hxmSH*i21zK(b@pQjfnPYSD6cv!S*uj z#v0pU7$>9W

c;XN$<6_gOl zpr$)N;ab0y@DNt3d?&l#hMr7EqqeHXv&v`nR&*|mG7P!DubC%L!VshK2 zb~2P_&{pX|!vNxJnPEcDA#XMd&Wp1GH?(~ivMb(~tV=FU3s;6`Ge~XEJ8l$T#AZ+A z`*&Ls|CIomk%I*oy*d&pKsxxIjZ{r1nbh8qqz^SX7{cmwpv6k_p5}qEVl3Chh(wvY zQp!Z&9fFT@RQX-HiILr}XfmNnC8y^#@qUo)Vj@#qu#ClYnT^55de?-Bh>w*6D|J_= z<*NAeLkp8-9>Wk_w28Nf0We{jT(w;OcR7W<63}7TrVO5YT0NKqOXE6cjn+bqOXKP# z6av{-g_wZ-aItYr#<0v(#4L_8+IyN3ExdN1hIZpWk#sld>(_YXdz1{ zSO|IhHv#wOv0~^3M37Xem9H5(4^L%U9+NbUnFoNRgN^#x4#*B zrTXLW`$({xrHtshBo?(y&HgI{8V5f}Q+mRTfyb~~HP){EeAM5*2cZt5b>9u9%L#;oMmX-)@QN-rLcKwxoicw!U@pnrbM z5EmUe(tAg#lDOTfQx)#G9G$$Fe1^f4jqrT zfbK{|OqpweoZFkts1Jr>N3#_9HiubFJc2DlOec0^lN}Np|1yD$YR|Ngh8~c_upd)J z^ihHa=|3hl$;fP!$_B`ii(#jY;)uwdM-bo%RQKIWawct>_8@wWk!=MEsQvqhr2Wo zKQ1W0x^qwa_L7N^IBT{l$m=LP%nBQmxZKde6hX;|*@0~~a_et&{la;3u{`gd9V45~ z@gP3qVE(fA9Y7sr6j^qqm;#Eu3_>!m6Q?$RU(MUF;5A-c6BJ$@6Ll&RHovCt37 z08}>>x5)8Qf{kCmA{E@;+$O`t*0gfkB&bC6wD7e8%4;QU)GUjAAVEh0_rWms7rB>p(6vj7Uqcf;JDQF!p|A@h`2+ZBMRl;_~K>4odyjU z0-_C=LphbAOb=4ZdSEIYJD8^b5d$oa4Cc6}K?fQdOcyRH+-_*ad^R7Nk!Yb#_nCWO_UcrRNaI{T{xF*CRabsE#?z#TET>Xc9T@u>v`{KI{y zJZs5S){xY;b^ZrM^@OM|+Dj!*t0mS7)i@5aRI-dbUeKJx^b6E1not-3L6IB*Ry|!K z-hOLb7IaF(z+8YPuX9kZ4UAZz;cUxFT}n1liZh|1f|k%D1BJ%2H7~4b)?|AcN8mz^ zer#s(jd<{aI6$|31YM!z=Y=ENW{J^Cm?lJX{P;NXk5C;9oYB}}FhBLmflHwya~-6b zs0e%X@}b=F^}ZixOJJPRBwYbgM@Uy~*prd|uUI#;Z3}3uI7zNlqMLPbSEqhgRbGr$ zXGzYkj~8iz7N=}{@kW;s3|uOBw9%O~lso9N zDRxC&URG5sYlz5tN#WE)-Ch+74suPe2&D)n@iuLdmRWw(NP!T?ThFuFRL@n}>zj+3 zF755C;f;!Wvcj1rL?gBe3?vaF(TY$XNd^(&N>HO_<4IJL&Xz)8P|m9{jwlA9i>2w! zuYp=ZvlMx4Dn*gxZUlef8TX(nKIWQ3e!5_K;WB#UEsUI}Zm8xkhr=mUa6Bt?o3mI^ z8dEPUK*ve@hN$b~ zCxo(bxX@VBb?1m;W5?+Py?!b@hiIe|cawKUQ1%q%<3a zeB}B(kDItI+GY@7pk3eY48O#Gb2}~yAs}3p0{wb7iOVoNEqCFRu$c9LHu%O-w_v>3 z0{h<4TJ1clzzvxk!P?EJhbO^awS%^l*apFY)Qo8JbTM1X+=_^LAg^h2;waf@Et5TC zJL(S`if3r!NsS{ktYm1m%%UH0_x9)n1|#tGj$%W!g; znL<@+UT;4R)p+|nN^PT`=sjUQvDN|^iEFl#(Uk2Z;K{!7O_lC*V_^si=^X-99UF@& zP|Ja*+wJj_Hxv7)&8Dr77_H3u>!|_Q!5api14Su+rru87-U1<>khrpnq{-Q|U}g!q zp6L~WD|dFE#*Q0}iy-K>X8t&!h~f$*D`#wvH|>Kz}tKJ81Icfa_>-4YibQ?8|~MD?UN+F6R{VZ?c&~Xm2pD@Wu0TB zcZbgJUs_F0UN<0xmqI8)9&5fPev3RUB|y~Cf`5VuKR)WIy-Jd{MN#c$(r%{(dlIThlx6Xs%;%vb144w8f*7W=U=rFZsEL3)IqD|X3RUHOfc-5RLdNOQ_`znq2XU}#F!6>}pi3rI!=JYLgA>F(Cei1P8A zc8l6+l7~>gUbcYyuGzQ9Nv*QehaD!SQecoJ9|z*%G7>e^aCzi^QM+#7@sGt4Y#NF8 zfI%TvT33@#i!ebRb=U7{`8e<&$ojl%!%|zqNI=9hBF_P(4GxPR{nJn#;ggkT8IQxs z*)>pv=gsj0Q&cs{u|Fkom#-k40)MuaI%7{Pc4&}Di(INPnm}i^yw2$l(nzH0@cK9$ zpwdHSh@_Lw1rv-1I)$?wDkE(N}Ub(I-db<_SiF4n`GpIZg$8FK{i!f|!B(qBb&pReK5 z!inP#H~vYI@~FE16WA+^^m;mATrp;p;2ur;&6W9I6P2OpKvygxdt42st7y*jPqwI8S=KzbyvTCli?97Oa zse;JZn93~;uH}c70F#sp#O*zmZ@d72wb=9X-qHhdm}3tK0ZbX zOB-iXM@9)7LuXSlQ)7D*Q${&cJ9B3XB34#*=KueKtVvt8hW6hD*^Bxsq6YF4mbBlV zxIcxEtL07gX}jGVZ{EyF5p;Ywnh|@KE0II&V1e&-qAz{8^Pwp<+fv*ta^*BuE`4h#m zT^J7E*dL!oX6&E-rD9)!gIsCRr}&PXc)sJV=$I-sOu5Ks` z0)Z^^O(IthwMLJqi&-FBMmMhtytauIKQ~%*;hSc56h$EI6@NtGxrq;6b`;DsgPz)b zes0ckOY{*>xmn0XZsq5!f1h##s^l?*EMVk4)x>vxnG~f(IVX=vCb*|lJkZ9UK2>7+ zS|UcWHO^s@C`&FLMf_=!9-k!jj}gNFX&UBT0`msAa2@4vbC^D3^RX{LvOG+lzn+=9 z!t~>yCln?JoArjlUU8y=;6`hji zvWN5Wt?})EqmKiUVsh>~-x{<`f-q30ERe@T+OM{pTK4nP{Uw8dJIKN(Bn1O;bcT?( znv2Wv(aq``Z;yiSbI>DZa)$!Y1zhAw>bu$VWV}g@l(t{1Y%p4o9B`$;|Hd?kxF%p4 z{m~q2eg56t-*kDmExy7OXPt7*i~DD<%~;<(2`y|g--2es6lJvuX?g^YV?8-g3)$AT z)q!4&l}eW6X7djWCIKZ8Ug;2rj%lGlqNXm=6|5u`d1Rh;5b9K^&CRfmFt@M|>s@HB zv`80TAZ0vihLR?Kjq;Mxr-YMsbOfW2T9X~)X#h@eM2>u3cEdD%e4p&nKtmfn^%NqK ztkc?Uqxu0X%A#p9icH5bH=(?Ca&P+(_tDbn;1`DF2CCa0*gh6>VuWgv30RPqDw%S= zhH_WDwckLBm?y)8z($}=x1!M|90e|P^mP@>FWc_fKdkmgT~Lue1KQM&zi)+K=b$i( zKSo!G(|;0mG$kYRCZN_`1+Rzj!I5BBvF)}T8{_+z(5%blOEY5N$-cn(kp60>1-I~7 z@_PS@Z=236gG33OaQqiSeD_jrPTSL7GT@4eD@Fiz&LUzoMheBnIb#`cch=uJvzeB5 znN>Bxo|1QO{oUvkO=|?UtPHt#7d;GjPQ?m7L$b~)#D}~)@@puTT6PLb#rRd84 zQ$$#gWvv_YLy3B?C41GLq^E6Cde^^E>ynb&?;=IXfN72*9b>{!A@Ss${#aFeUz_W& z+<3lK{=!-Agk;U)k^-tlRf$%Jw^MXpa`EurU*z)D-A&ZKnziDXKQ?Za_Gwg}%1p0z zu;>iYh-VN@&}G+N4>#&uFWjzlR_I_SyzD%0g!Tlx-Ac{SugO|V z(Wi?q2cw7mK}RyM>j$mF1SeJ);X~OOvEnd3(c8eAB|V$&zFM(D{k$Bs5PKgjF+;l2 zn6u2k#t}BJ4BfD*7*OiuX$u8&(pT-xxmxx8II?0Z#RkZH%be+-bt&O`w-hc>n25Ko zDzV#-y}YdM#*o|4Gp$CpuL@5t7zVM%K*nW4TnmYHi`w{Um@PtR@_J-{2Mm|FwIq&lcV~;*!2F zd5qshC~^V!TN5D<9Mz0mo@455kD{W0H zp0mnP@eF7Afv%0S+QVlNFuv*Oj96k0U2d_7H$&b~S)^=J%K?@pYxYw_nI>A~ zD}oC%jFhnrSvmmR&$`p2?L{2VCNFDXo^;_jO$wwFK6qPy z+i3Gto8Onz+Y-iH(8t(W7xCeS)%?ql?DNs!piwPGy1k zGslFAkbFT^$0H+_CF%mQwDiwmUE!Q}nK{y!AhwlMH_9jOr$u6cCf(v( zt(fkla@I6|97cC9FErbmCEDpuZWOwk)U7oI`dngn9)l`HW}(%$EBTDe=HO71>U3g> z+Ilw$`$fxYQ|rXrQ3?NrkUn42K6vX%*SI9>v366h`3rWDqMcm!nvl-ooN(9<0vgi} z^(#CpGEA>@A+Z5@79WVW*3_)VcYc0a0Tj^b8Z^>(d*?+lGZ% z5_MQP$>s_vgg)y+ca0-^BtS-+IOaLCnr+{jN>qE~I6X}vl@x32H_KzYu@!G{xkvhe z+S*f^X-NgBcImJTKzcoN|G^t$aWK(H>yB#mx^Zo5O5<)!MN3vDeR;|}ZYOcdl0C9^ zQ8oWXiU?HHF@w_R8jFtp&nrwE;_t*!VZEF`e52M;&rr4)L57x$s|AzD1v!>34k~{r zm*?{|SY`f*`|pp3Nv~^WGoB*g(zu>U-@-N&vyQ8$%!)ioLaX9)BaQ{G;Q+~ zyMcNyWOqW3N^z|B>~;sCREi-2xy;FLCZr`-HsOcvdQ|H5^ik)O?$fIyyCDX{Uxh0l zw%u>kcb2>`zFUfR#hS=hLt4raA&#ThGN+8l+bg6dl^}+sL0~w%*E>#Trz5Y7=YV+{}vKsyc5p zU|q(j1H`O)nQ8x-lD{8gQHK4?`UwU*KfI9sI=m%A{tZj^`V1)^Js-D z@%8d3;f}p;cbj7P`~J)h0;#fW2+ZMyUlM+WQ6U!DHh;ThGx7P`?xtYx)NwW8G?t_3 zw(qSMph`BLumf<(;M;6&{|r%2j6U0yGo#>;(@&Y6?hI*5%K$KmFi0!s^&!G!zAaz| z!GlHW`3|cJ2(HrGgvL0yaK6Z_Jon3uN1ZNuI{ffP2Le|qwwKsrAgWh1p-z%+N4&|b zzYmge9dq%wRId zbiO2}zfy>5Ty(z>j52u6QM_XHr4jlft3I!zM4phrXadarKT$&75k-yQJE-T^_b54U zUdl=Ai?F@YmAAuBJyQV=B3i6%j5*b9SQ)KRz__7*i7#Rkt;K#fhaDcn@GtWT(}--$ zTOE0%kXw)ze)QWPmM-n+k6E?1i9_gAk5REG%fuUkJKIW*s8N9u1w>mKk~Y~SiV5;s=VY-< zgk>7yr4Y(`^DOC=;grU56M=`|RV+S4;QOY2K}6W`$|A&vwAo4F3vge8$~TO|<~m%Y zn-^#OjYPwz(oQ|N9L#3n&nTb9IVpPGQN)Nx+bECDN_rV71FR605EuI^X zfMc>~I<@VfWTi#VN#Y~ft0o3!`=s;=Lr_e_cFgj38|7r#by%%O4q!YU&tK0kwQadR z9ElG+2Mm1c7W;BdFg`191cQW>TH#jQGi{znXS5K4>c;vo_HU9}cF_RS=^$}0i>P>V zn|l-i+%2(%LP9Y5jTw{zgF79}xaxoXVu9{?&fk`O`XtE-^H?tFW_61q^{Z-4Ni~;$iP+7h zy;o>g%X|8M)4bJs=F+0=3D~$m#2XA?lWwspR6!+PCmqISnEbi!|BZgLpoeeEXGxj9 zfiD3=>_`OjXp4aYCvo8y#6IUPjB!s=f^@MVxzwT+uEb*%h*x)>V_g;vJG z6IjlTTBU$cV$BQpcf<~I$qZ#(R+|CI!PfOn1zfQ4v>DTsrjP5*q&5z#Ad?qNVLmY; z!BuM_9~!F#v=MJ858~^z{VZ|+5Ra&mN`C_AGMDI3^F9SP>q-jLHtzH)+82C@TTu(p z;f6{9HuO6P!&+idqL|gU%xEev6&d7So5$zS5saF*O=t^o!Seh4TbA^Z@}fW6HpnofV5pjVhdEzo9^Q#agPJLk$n9yPA<5^nzl7ijm2OnQPC z^oN;AzmtMjarHrh#-5fTB|LLhcIido{ZjI2#Pmki%MyC2^1EBXzyZlu6^aXiv^Y<{ zDr|#dQVjiuv;1GJ8gfV0(v9QnM~+7fVyNWf#*j=iR79`E%>99FRd8~=pzk74q0vE= z+Q=SlvVM}<kezSfs+oUwvFqf8G`bRirM_IceZM-_8 zLWgq#Is5T*21CM>B$sYhms;%7k^SJ5s_Kpnhs1lNWaEMH#00m$;DJrkho90oce(%<2dm%>xRk`|qi=VCNY^+ZDfbgN% z0aPS+&H~hv34|l^$kut6Jrqwwh5xCUGU6f}tC6QcHI69=7o!!osUCADMVsEns)$9# z=RZ~ZKN@)EJ`QuR&!BBhQjU_3&G)L<1YOf`p9PTZYfNi7)2<~{{ZgDkd$Hb@$`7w> zz5Hb8X*ve%%CMK>nug=o;zLk`(%nFTMRFv*8>)+uk~V+>YM%x+q(Lelg;%kiRbCKF zyW4}jE>d^xGp~8R(&r_0HL5H))#%HRWB{!y=rF8Q-Z9Sp2(W5P{S~#% ztu`S|q5RExT6hWs{p)hRcwXJ7z#6oD{s!iG`$vJ{RWi_Ns0wX2RX$utgBA~>@AaON z;Ij_~A2J|OJ$VY(^`=L=e3b0JN=Xs~V`!N?l6JXc*IPi{^oczBYFqYn`SY+=70Ns& zem~2qRY*IOugo>`MKwER?+M|Vu#QG;42?6T%gAM_ z{&Q>bLPM3sK;^GY(N!Zn*BXcCijozYZT?{w9*YB{DL_9qZ+OFNCUSB;`NJTz!?-UK zE^_V#S4%FN0r1Vtce<$th+Zg}-#d(jqiq3`@?BoW(#ae^3TaKwy&Bktb=)e=zdBTb zDqR-GVr}Qe!bI$L4+zS1_oG~FFM05xjAG`s`8-?@rRu1KxEJWTM+Rx|!hj3=^@lT{vu7 zv8CE16BWwUjfUN-caf2F9K1w-^SbV70P?fE`SBi%QHdfV1p&{Y^m!74BXlU)`-7Qg z8s@g5%y!|1@4<=vfHR=}J^FO=52{hy0-Y&1d-XPK^b00tPAm1T-pisZQdlfjOJES} zuT2q%&0+XuX2f+0{%SL)oiwS&%Yz4P1>=P?#VaYqqSsZCZdAPp!OvmaYlCgZ`Eg z^1;mE+pV4Nd9BrU)O6ptxwuJDa)f)!V9F@US&@L@I)~375XqW`E#txO9LpYHpDZ#w zt3kxi^Kec0#7`rgsB%u(i8)IB?tUJ)R0`hQ7Xh8LvR9nZPeMEFY7!iod8tZKPwsuEs#8?>243u(5d!GnM=f@}_nhcRPBL5fuBlQu~JB9BJ zJ_Bw{n2%Z)z3RV@<5tpN4PrGBakW?I4o(GS-ayRfXm-Jy! zlDmqih5Zg&H`C9jAccEiVBBPJCy4u)AUUvva*EaSl9(+=hHM#%gVEdZ+Dtp#dQ`#o zCru)B4dy8I@~c)^1Eu$HnAOr0Pl!DfW0>00!g zyg5K%f!ePsH46&4lXrjf0_{ht%=#db=R0a~Z+z5f8ifzq8}Intf6R`lT0GBgoxR&! zYp)bP$4^4tlJQEH+j_y$vK0HT(c}H$JUc^%R%k)Xp7_}KRCt_au;k4pw&g(b)zC0F zoFdjD+R%U)?B&Rz$z{6)ueG4#tab7#td^+3N%nl7bSoo&(;W$up_uw|3yh`^G=JMu zMJeV0^&K}dhV{|>Fl^b@NsaHDAXqxj_+2VgA5pyZ+%}h7b0xqR;o%H?GuaW6JFzMzy0&>{(g4y24)3A(|h&+c=vN>8P66{tUX;g`N}mf>eUg- zMyJZ%Ne+RXeDnPDVw_R+3ZBRk5ZIq6mON6tzW*Do0L#xn7zbHGN#Vl+C=-%Ba(4*k za*VEFY+hz(RQ%@!-+w3O|19@ire#ROV2;30h%91FvTT*Ykyq?yVV2o}*?ZdB`(##f z5BBx`_Nb?j%dh|1zLAdYl2)L4~?)-4cQ@p-C3MRy5s(yZd zj4@2Gd8%~(oIJ)Z*nd>WGx6U2?D%5yecI2#arvib-Njf-@C~B{)RgZn+K?O&7bcof zlgP%$cRePZW9R0I`6p8zHJM(c5~yhz)^nWmmbg4G80F35xcU{suwFx0Bik3DoO4U{ z#BD$2Z>1|ej#}j|K3mhT|Mehwk-r#_%(o$z*}`Vk*&gP+ipH^=F;&-gJNSSWt9r1k zoL&~XycB23sGsn`0nn0ONBLPyl9@Dq%UuL=yoo%p7W2O~`@=&k9z3M+N(V8Gt3`y@ z#IQ2tj3$cFc|P{Kf(hJ>+^@_1c>^HNK~Ak$yS9ewC5^yzUS$&?;sU4dBKgQmvOOOTJ zwoKc$ZCjOgrES}`ZQHhOJ1cG5wmNtB%e|w|!}$>rW5pM1&3TD@%OvT_p`@ahkOH=o z*=Tz_WrzY-;9OI&5gbn(DqTTcoz31>OU=j9%+Hxa7~Y%t&V$+WnNPc zDlvhH)2f6hMHmgfZ3xIXjN=}AWX{u);#S32`9}sU`LN(YLV634jY4n6DE%<@{)Nbe z=?pEaMraI-7uy>G9Sx=9E8o-gP*N0{|1l&Wnr zFHCbs!Pd|h(#m<(?0f-3VRCc#>|=`>mED#-DQF!mvUz) zymhk)W+mixt&z-Qvs;u9AlIR$5iK6}VFOmv;dW~l8pG%NzyYYy^w4k&lfu(MoJ5Z@ z#L1Prp)`eH<1>?qq~I{$0{^UH)pUx(Gag~;8J4UMUKO#Z+6Y6Ae~oh3<`r-c{plJo z_wxD?qPD}!!k&Y+c6?D$a%7Su;lG>+YCvg!AYvL)lnL8a>XKx=UbO{qw|n=t%$i{= z4bjxsdu5S1%H-vpf5?3D72!{{W#O>g76$4aC4mg^V2!ac?i`a#IQ5`{WemWo4X@*8 zFI_g34$l6N*E+0cyJm$H>D7PskWKNIlRc!X6DtHa1Xk6%QDg$+p)^O4zXihgmI)cb zs0sTsX-<>V-hpwXN80%md!Ef|U$naY&$`os1O$p6me#^62-p)&&&dBtN(iIUDQgb*J4vsYlW%^z{?_&}yh~0SJY|ze~ zleWRH$~#;GgMN!NgJb?}{)+IZ-0TIK1t<$hM+27-;Noji7Az~LGEbt_aVcSCM2;|L z=kv>?OilZg|CNMf6u7VmhgoihIOJ9m3}%t_<{kdK=))|H8EX-!sm{DO;!${zOA*1e-QEcZDU@HC)JQzc^? z;#{U)#O6kkk``E&riK=o@1%1rqL+gCWt{d!F{wlo?L~@yfgL>hwi-D+S%~mePboYK z`XFfB|HqFmX*7EB^~S_ zx!Bb;(>d?1-d90DdM)Mby|fV3{;~2kjnP#MIWk;*Q=-L#C`H!s;NZO02h;{vd8d3i zTS1P*^n;LZUguDeEpG{$0yIifZUN@=1Rzgb0hDC3m8^5HNe>M0&IMd5?GWNlYUfT3)Acz2yTi3BVeq97H6Mp~zW!N!d(I=n*jVtON`KLS zoX5HAy@`uThtKE-6N>1Zo(s3t>S2+{+c=~>ZKYwr3G0lLbegITFv7PF#yy1#pL!mU zeYd^So#>I>RKxu5pW^cXTjyzPTn-@QE4Z^Mhj?6BM0cvk<2;9%q$is**aa70Vv1 z!@XV9ZK+xLj=*_SrMQ5`m_7C$Ralp55a({#t##kZ^h%GTqlVTM^}4J^k}siMZ7Ha3 z@|!oTpR3h$t-(}UidxqeT=iED{O_JR*Vx{JEwqDq4sFTcUH2&(tQm;dY|VqHYXAi| zvMOOtz3RC(V6h%XqAv zczVF*1~ha_9oL;f4s`ZbQ7|svCWuSR(SG7*1Z=+W-+cOe=E#^hERa6hnN;5#8q~SQ z+oY#5NWOioWxaWuh$}N^YcgEph@+Rv~DBD}TZ*~&I*8J2@x_VMX zxYRoyoV~u-y5y7&uPuZ!GrYZ136yc#qSFVo`p_6O77zTX^wjkX?z z{x?v!U#vg6>iKV=p7A?SXVKlZ`QcNX7z&z}1=8 zmE=#K{N1O6ZqbvY**vR)cp(u?pvv!Yx)|G?K-I#NTwo2MbE<)jxqk19eW%yT=b;ms zAzlW*u@;RMAo#kr-y@OAXn0;1Hk?B5KW?BAXDW_n8-zmSUcWbpn#m?29=}$ObSGD;Q3@t6a&U6yN^L>xqR|Kfw;_){yUl*kQPyAr-Uz5z443R(1$R}W+B3TfSd=x z=Mhfpvs%?>Fc7EkFCT4Jrq+-A;lv2gk%dY!S6>A5L{Hl4YpZSj)LHrb+$13#Ipt#2 zH~#lHvzbwyiuJ73qF6Yk1%u7ew&R}PN7?p-jmADLVKkwXd2^b62v!J3YiXCy5dW^?Y3LsFyn4r^HYPCoymdjWgU# zz!8DIY;n35d}l?YSBGHpr}O%sB+#=lyd=g5W5`@otnumXkP~U1fh*l?QJP{7NnVzr-yt*;Sk&%BI?_#`%wz6ZQDoR3TXvCRlx04@|?HTOeoy~PzT)}Mf zzbvB|H_t(KRqsA^h=3|rz+@X5y9XfX4)jqo6S*`58g3e>tn4+%!m5|!m8LFDur(u? zRlZswPIuGbzGL;zjMA$yiw!H!&YX>5!kIO-=vAu);OOYj!0ke#b6A2qxRMDYqbAgp zrB^y++rSm=L07ok8y|1<*k}Y--H3KABx)_#j(LQ^wFgF3s{P%O6nL$b!w_88xOt>} z{U(B(+0{WV2Ls4M6=iZCl;uKLZ(sVVCW4q72fvy@R+S?zxi06%izquRN-Tt#-c^RZ zx?g}0o+42yvGF(>m!r{3Ge?2s_2>)*5>}iZ+wRGY{tI_Z!mv~g#l!D}HGao%tgSgu zd9wo~VXOh$VH@NWCS0BnzRoSt+d5^jR#)|!-H7#|btYb&4)Y={E~wG%Hl%yoCG;|2ibEN!{w zOSna$S9lE@4P2?5x)=>e5XX|IqRV9f7QFqVf<4IaoubuU0eXjY5*?@#Z8-!k z7m$Wx1Kc4I&Xm0i~pHfSX|69atN#7AbY7BP#W7Sh-;DWm#~LG2|hS@hA=xAFWm zQ!BC6gV`y_2+Rd;(Q``S@D-2TUBDuSbbydF&Wm$x4BpSZZ`{@(leZx><&l;iM}-j|`;@J8FoT#&FGNL;434IS9B2z|2u z@~lu&Cvc{CQQ0Y)t1oNt2pI0>)tnMeG#7Q$_5Z{Mn|x$(b#3AAG8ld)pFsM zDbbFkxgFC-lt{w=y6Uq^cWFmR6w}2pFJ>nd08V=MJlEM}h8Kv8bHH&XautMC&zw^u z*~h6LO%Qd-h-flPzv0>Z-2{Tk6pNSSkWE{}D8DZz*K|h`h}3v!y*c6(FBjgJicIbK z!~PeDPCZ3YTwl=S)eDL;IJl{0mSDwpZc2)I67q0nF$9t%XN^44XX8)=It_+@mB+1E zMAw@e4NBR`0tXk&IR(*qL8YNOi-*6 z?)By3lnuM>5gg9RQ&ThDEIK%)BsdeKtVPGsgwncpG?fA!o_IR0%pVXQ@E({m^SHPb z?}P=iAL*oL^OvclmOn8;C=U(3Nc{cjH#*Nh_yT_Fw5IHln=eB>hcQqM*;z1Te_6YZ zL#rabuH5*=7EMyG4^e&bv5DACL}i*2Hbiz9Sesta8l1K$D7tqgC<*mEH*s!kOCjb z6A%ew{;(Z|chqm1Tkm$>T<9;BiBTZ+I21#K#u0MJPqp~HSRCmBQX-XP_0Pv}ki};8 z-^*J;mF7}?o|GGJw=lQfVbZWP|IK$<80U_NZVUtkx4)i4%n1K^6f-VCaE>HJ#^SD# z0j`r+MZNyJMOJM1&Vo3|=bAUV+Yu;&gx)qR#M_?UdiAV|HxdtSl^`?#G3%Qk8*%f8 z+%-iV>-I~Z6J`u@l{9|&(X-cj1}=shG*I&aqAUi_KpKL({4)+-Aca#~>NOp=km^$n ztU^hH_*)`IbuIfIQ4F%rhL*TF(#w%7j$OB%+SEqD>6a%t4!Iz{>nF>0`S>{b$Db9} zG~-xd1>$oIh9=b_0*TQn_}iMJfYzQ)KH~PGhLedhJY}C_0RxAmPYmFQU5eYmOTvA0 zVXqj6eIWlve>;9C7Wjz!i+_yU!w+*Am|NO`!+6(82YJ%a%HXaL8E@gB_DenKtbZL4 z1^ZoC>YXGAE~S-MX|v>exxs41>fEDK7G?^?(wkqoB*&bq91E7>Wp zM#jmoEf7C!-pek^+0yS56nLmKyh1G1tC$;>Wg0RDZIbn$tz{;WeGkjqU`D8~94Vpg z92iDBVw9SCL>Em^O3g#_7jv#hY$K1I5;@4G2oZP>h2B9-oBk&f6Ur0!1Jd|*rB;0ENpOfLkyz0CdNst zaduDp`W|VOW$xB$+2QxLqp<7m+rGYJ)!M%XWv+d<4~W^O-qX5z#!K2DSGS@gg4?R1 zd`k5z0hUJ0hIjhKLwoU!X}xgp{<`J--UeNM-Et{X8Frb%_E~P3RvSV-G%^j*Bh>iz zj9NV>!Kt>XIr#KcGqWNl#MWc7EXGU)ho?)Lj|k)6IpH?D~IpLbVsLPsC1 z;pMy2kKh(#jBvfa*-gz;ZppqsmhT&nlkGjjBp?e|G=ZnsXrqF+B6~5|PyNx}p|%KV z5F31L{@7IEz%N7Y^A|0#_&!jXwB`q`<# zGVfJ5KOL=MO>9jNIw)wferFciae2>P@s(Yqk&U9*^Y?o$F3{7D{yCB%7o&}MpRW!yAf)5^N^HxuMqVw!UC{(j$8 zLG*pf5c|tK`k^a994Vkrsnr#{`DXR@V(b7_m@u6$Se6uJR0Vy7jZ@f>Gk^6+Thi+j zVr`}(q|xxy!Y&YmQGngmuvrUT>O8z?wSIl>vzX4Tb+Cc%WY+yfTPf4kJdV0v2Frgt z9`cj0URMPxmseJa6a|C8Pdi3sh+qrcr0WqQRUv?yV&jpy8`wkPavy+FrG*Ti$6)C; z%;~(Cgu&#VEcln=X+nX>I61E|4q8;}AkIttPN-;O5QiSZFPlz6wdQncuo|Ea&~|A+wehqqxUK21qNyVR|@%)liEdfI_3hp!`vYHwHe0 z7`Xd_?Ya#$OAtMTkw=A&aJ>I#y!8e~!rl6B8NX7>fziR*if3k;dtUrrxO)DYNRj|;0UiH)=cQk=;%x;Iu1lcqI1cm z^{oIX@SN%sM|qmL!g40IzL~}fZ^e0W&Je35+xb`qEy1?$P+IKt(wL*8Or=P8ZJUoE zzZ|*a+ya{9taJ#q z<|JvVjZw8}^Qff&N!>`XGWpR3f&6fYv51h=FQ&$L6!m3b8}u*7X=`N|SSZXxE%Utw z_O7h1>We=;^ERcHT-BXMqrA5dEt+dlLzt}N^yU0h%2LJgNII?*@@Z`pWZOeMw5uE1 z^fNlvDj6m8rub|awD|)lrXuOEg}&R?O%$Z>kG)rsE+l|+zGu4G=fuSe&S?V++td7V3KOYG^ST6|hZkk_QXM(;86Rpl7hRa`ggk~z z#Mb)|ER>a$0nN-&>*G&B;}5S0q;Sw9unc4(=|a1&JjE>vo;S4B z!f2Zr3_fm?#{r@0aG41?(6x<89Zo)eT{{oix-+p~c^CDLMfb!O=gzgzS@gOpGjv$j zH)r~)@sULiN0M-as(AK#qW~?&n}#=2tih!{sE|^e!*}@7eh3!zzi30MwMEf+P|b*p zs%(q<2Vp}7#?0#`m^TWR{c(j~tx6G(?VL?mER9z}i)m zLu}_3)3?C)D4}@$&*ed)sitC8FQih@KKmYPd)~MP;VsLQgp>=@aJPj9AGRH95gTX;P ztyuJCGJ<0TrdgooCh;`5T6`2fFj8W=wE5V>uY#xm{p)?koIuCZwHG&EsK-jv4SWN6 z+1ZYn=Ut_l@=*TxU}aMH#Pm(%61NR9A>tp4SbRTuO?(IoOy2x$frBU%mT99#dkZEekR?7iRU_8PJWAO zY>ZZOaCfME*s4l@pVsJK_&p^OE~CdO(vulwxLKHdv3vVzhdh1Oh$pkP;zhw(eUcn5 z7}6&vsDgrtN{h1le8X(}RPTuP*onad0dY!kEARE_B4eP0RBF-IP>6xP@%FhtrxDgH z3XNL!vv{D{>+I}5)~t#nCl6OS?znul`2;;a%XLLgZ&iB_nA)6HtH+rnylK}kn&Z%|{-_M?X9iR3|Ott>;cMeFM__{0i_`WUl0!9_1&iwyVGb;nb|1LFi zu>7Cp<^MpT4{iUImmh&l)HWem-VyYe1Z)x?X~+7vQXIx{Oz0loDeY+$l4vKh0hwO+ zbgk73BAUILE#8d-!Vmbe|5~+ z0t^fW?`>ZX(T;I9eLEa>=rLM-+^4s=KRv~cIQ-w*wZ3$(@)zZgiQc^sl*_>>FVI1e zE6hkg32jOAQo$d)P;N(2x%3UotTejI`IfuyKD=+qzG#kGcG|-C4YwVu9idK|T1MR+ zS#MB7c6aFzvtrmc_{gX#uPdWFWTd>mWTD1*YpU_E8 z_;t#^ih<#eU&TP@7zCm4Dp`Z+S9P73>9^R7D5Z0j?J&NIeTKbITi4Kr(jpmRGUIlS zgUU$j8Ya23{A=4^U1=%d#<0na@q^_c`2BeCw6V#^Ow4$Kw7G@^y9p{NR5}TF z2^F;Qm$hRP%_+C;A1pS+s20Y*@%XD4mla&c{1Wm}% zK%m3`=9w#Kpurt!^4geP3yhW5RwZmYpJHR>q!8O8>KB+5F0y_e5wDws$Wpv83%V11 z_1{Wh7cHV~|DI30r?e1|Q`lLSwV%`u!ktrfPDTSeg&Jiv}BiJB^K;i2=N71NGX zJ;qJ0C@c^?k&E!cTV>8$n>AQm=5kGBGBOlRV)+D0 z@V{7)@?e}3Cf5({q+q-_Tty)7ZWAuoTGkBgHv#JkJaz)K#LwF+m(S!xT-dj+@7k0^>8 z6!|eABv1mTU`(d@#(77h>CkwYKZ+3pMXWa%b_u?jFvvU$)!v&L%v21`^=Y$`GWr6a z=SWR7-RdXBoY$#hzQLtCM+9hY%cW4ieubrSs$ajt0iUw@arGsx&v<6XsQ_hEJPaRQ zH9s6Y-`fw{1y}sAaDK4!kT_ErzsM}RT-Rb8*TqiH_0?_`SA?T7cp=co_T9phLmnT9 zc{%Ap8Fp!*eRX=jT$xmELaSf9Yf&`4e0McFriFhm)<}_b5L5=n1sO^}&@&}VSw8?I zx>sl@v<#AlZMtIfzKmDOMFuD9MM~M0=alT1aC;)`iPb6{O-5lnrkKs`K0~_?tX~Ar_hF_{s+ZBnET7_{mp_q0{2)ohQ#}`>0j&_N?d(~!1&jU;M_@!Z_4!Z-$nC; z00AMvgoy+Ts4l6)E1zJp`LlU#>n&3BgK<7l9Samwp8EQ#!F}xgFsmcV7!IpL&KNVq zuz|hCCwqNdM*?$ej$EwNU1B=fI<&a#((05*5E#BB%GJT<&;50;{ksUFdp@*D#-i{R zu%-h+XKvjnMhlqR#*kJM6nYE42vYzJW|y^`X|#zqZJ~2+%#ZHkNSHa5ns__q=O)*45;y8tYUVZD4Mcr#^I1isZ5Vi+1tw=n;^iLQRS{q7~dC!G=pTD_3> zyl2K>x**l_f-;b1qVf*%CFgK2ABE96w}ckp149Md2IXFVN7=}kLNdULF7OxH8B9)6 z1!ur1f{UskrBWnzCOQgYB=sk!KkaI8`r@qFg21yVXR_#tASW%aOTx#+jP>*x;2k&y zz6!EAX*Vw$)3B@Y`jvgYFISt zNcJmERhw*68yC^VpYnsTS>!&>MA^*p=0t$K?b1JAYr$SS3GS6UY(Z)rLJD~#H9;r_ zme>q6u#ppww?;VhNdpTBT=bYqhaG`gBB0=iKz6;PX-2HpCrlEFQSY@yCB$WHbcYad?$J$(%iZ>48{j%{A#o5~Xl6 z$dr@mpg%u+az?z0n=D@9r5#mw(%!O}Y7g8SDyrK|rNX+ofr~1=-3qyrP1)9!>`h;Q z>*w%P??wU+y>}wY_g)uFK*M-~8uP6C-Wwh=aU2Ed|&b774g6w45ci+~tpC9+WsC?ZtKQSQhbl(UTL-ABh%3 z({n5~6+klTZ-0(VH`YCkwfIgZ2PY_ZFe}WUl}R?6JD;8hf#Xr!?k@$o9X{7D1M1Uk zA$>hu`o$-s?mQVD=Ev+yt}ZVHg*FU1kR1R_1-Hke`-s6Y>AV4e&y7zMN$fd9kSf^G z@_Y2BBra!$5}L+fS#pG3P(Fe-N3%JstLBc{^;;IY#2>IwaC5==UNm$TDyJL&aspu0 z9bqSoH@g7;UEazm8-N$3qaUa~CKLPevpJlP-LAouU9bw=g>})*w0Q8LS*@bx)-;pv z$lP2z%qsMH;3gV^aWfs|&|v84kxOG)W;W-g9XnFwwpHNs3RI~M47W@(AkC9cP5l{q zUpM6^srRmaFj!eh^6Obsm&GMMEB)o^*GEHp{!cOaf4A{tV`BI}V{)^`_zZFDe=+$T zRJgGX8Num42iNrYW&lo8GyPq^5s8~WO1%H!Xte*T1xb`;AGi@p0%Am~xwI<Z1tkj}lrl;C(%jD=@p!9KZlBg%Wmyel7*g|72o4W?3M#DIyU{PU%&z;nAy7SbNrgsn0SJVe*; zGt*ADlH@Qgp+SWbC=DKIyoEX9-@r>Hw5zh%CUz*Q&?P9aDvg{XsooM=)WDY>A)X@I zbkAjWPD`8J#K#Z)J`Ky7+4RVq-ORfc19_3ZyU0oBdJd{4rc5h0tpd`VEY_II1-;Bb zG{zn7qYVw|R_3-nl9EH_gn7O>qeHvdnjNXdjDNmH){q3Jjk|&m$&6=GO$Be6;i$0A zV9HuipfC8r1d8(BN)e0CC0> zLWLwv%|^5{br@MrWCT^DDWS?73BGcxri4`wNj){HtUo0)oj^5VzT*QA1CBD?+j zF#;gtJ})$_0@jaW$LD9fek>=L*8(PqKsh)Wk<{TnR8|s85;fEO1Xt5G}Jyd5r8ZJ0aP-cI5w*9p>H2XXi>9= zKh^n=K>*wxs1PWyh+;TuB^=f+@z4Ia+`!4xT+A1r{eSYbLK!a9bZ-GIav$R~5tM6l zA(mdXv?0&A!ZWNsQvElJKm)YneD2zrOL-zCu0nWZQiM%Oe?!&*b&T}Wd+#RMQoLL^=BjL@yO4#z; zLWfA%2#(g%sCbHp^-ln<7fOj>J$sn`Y$fVIXmoA9i)sOV2t!Ldi6O076;qcycR?wG zkPmqc%a|$2@BNX%AR*z|@55|AF5?Yhh+$-tHRMfn5rZDZdyLBECR@B)#qXZ@4$_S> zZa1V%gbN8us(kt4+dH_Nc3m&B-VWQ)9|02DN3gah1Me1sBwbAM_N$`G=8dQnH z9ZKTw3`LB2|HFH)d;{ua!w63f7 zlj|nE~UGFKy40mcVfu0l`2LW5@fpnHOZ7to){uf6wq$A8zvVBY7IGfYSZx{aGvB$WH|`Lku$M2% z_yjEF{^^*GZQqnEWH{vm?IrMN_l);V+^+Ill0ndu^e2n>0CT(Uk1vI1YMPoLbA<7a zi9+}Cr@SF5K=Kx8@sxX$c`t&cnVJ&3E0H$G(tsOfLDGTJc{vxFjIH2P+5*Wwz41xI zttE(*T|T(!!tEuieAEONstcjrRBW*6(qv$gOXQ+Mo7ikNo;_A-Qs7XDDi$^(XN9t- zZx13WKX#L}aA6&zN5Rul1z71gEH&7`+vckXbY;mrjeZX^YdiHpi+|_~%IT^D9`ZsA zsVio03cHZ!lyTY5d#z9G8cgo98Ps85Hvz|t$+nXt`f#M1szySlJ+ztp+4S|>nHhLF z!kxyy&oAlqF{@gMHc1q$^^5PL%faByw6=svabxy_+yG-OjWr~%WGC5Wrq&}UP4mHd zN$GSB`g9HOPI;7(WExe49&%gJFLHMgBLBI{;(|Z~3SEBuiS-C7e(-DUDD>t{^@tR? zrb*(>aGA;=<43@wdG7)(#CQN~j#_*8ny<^kUoU656y$9WWk?>kiXoT1TR{fBO~#K% z#P;C`5>u1Oeg{i0y#cGW!vC?HvzW7~O;$ysd0$D;6HzY<`si7WCtj|sP@9I4wB8G0 zHmN}kut$kvfJa-Z8QrZw-vcV9ktkE4DXR3*4Q)M*X0TEpHGzFNIL}ynR+1|5(>Uae za9Mn^Crtli0y3wyfs9-`yDS;Zq1+4NKH*u%)H(@L4pu^y zHk8c=Zn&yvmX!a@D8dm_j!I`kHgijwLSBIzHmzN?=z%XBhV}RY?Gn8p*2cubA9vX+ zlXNwDUrlD{4{IZKkqb1NpPcPiE|jA2NBnu9L92yLi7_A@l)}j;i*_#$0u~!RF%5(`DZiPixCtgso+wdDh#tbf)C?E zlXh+Er($QlAljnu2~La;XJuHT2bTSx!%} zB)HQcvIe=2qD?A~YDACH-i#VBbgcCJ?fQ#_42u<*rCOXZR;OnC7cv?JMc6f+j(O936#9OlMz1E8pTB&T(TH2WihwJ*5)qc8tj5Z=Nw8898>c_Bsg*JR8l} ztU8^9Ynm~ooL*5}P9~}LN*Nv8Y})Xa3IH|8wqG(8V)-wPB$x6l*a-~3o*7ht;Ux2N zPDk?}vcAdA`ti`He@Hs3vqUd^16Fu`D>7QTkt%EQ^L2C0nGwa;_HMsgYswVPoZHyQnU?y2>t(^-r z^f_&qvYHp=>XI9Ai|Htlf2~MqigN4e1)cs)p1E(oPA8nx6cZEkZGU)RZ^a)5<2(M(+#iX+CQLqGe_;Op6aLDZULP3#PYSSr z`2G+W{K;EU5Cb*XAR?l(TgI;oT*Cp;fE~vEb#FsSQKHSATTiG_2CpfK%UMvqO+2X5 z#aB_xW?)Bi>3={R|5d4C=X}{+qu~V+vm;zT zpY`4hZN0X}PNPQb^umQ<(uVvLqbfiQ?)1WFNs_QY`~JATp4>hJJA>uNF>;Atk}c(u zr0ZP;?YrpsSVyaNFT^eJ7RstFV5}gkY-Br0?JnlhDfoP0I4?6CkuUu9?8e6)ozy3& zEW!6t3j7nGXlN<`A`%r>X3aHjC(rsfqDaqNnSxLTo-BmyPWgoY;xEZI%s3g>>fZ545EIS^KEtmn~G zAUbbN9>+&qI5_-S!TP&v|3V_f+tVR1zMLbc#SEjL5W;bSvZWzA_0DhqDLj(U zX8PdzPiI@&z~wbC83K^KnIcVnbHmi`3Uy1~Hq%eT)OK|=* zDMW{wdhRpUmdN&bHC5KMbkKY(f6m+r9b6{yKAujdJq?`|-Mlz>@YTJZZ5*GwgF~rT zCnpxP{kSLMO~?*#RmJ5U@UGhgMC;KafuC#qG99DSf<}Yy*yB8}tqI}m{l_#<{|fVl zma(ew#grvW@WGYh8cPT_xdHmjL!rI_zp7gwVg%Ps4K+uu@;*ezl1yejp(o2T$!`WP zqo||Ei#TRZqR~h>e?Z$Q4~DGJ2Q4-4)9qEP5x(_Ocg0ZVJYYhgcQRYy?BIoSds0)p z!`-TNAE+ETb{@%IP2xDe5in#r(<@9NYIn_ory2iihd0`6@VVoNORl%h0C^~<@6E6n z#pz(846DWHq)AYY>@i^j%{}i!6OIzrK_Xs{{Qjhnwl%3c*oYS!eq+os|Q)J|o4t9M-)*2Ql8kDnNVC+I!UUJgjqx|B*7%IoYL6ggQu%|i#u{Ug4ow=9J!ZMDuKaa87;%H8|@-$Em z{fO;DqIO3G#~YX7?{A*@p#GatB%0M!MQIkzi7qlAL|kXWal3M+jG7O(&!xkrFRGE2 z#H!s@s(u6n{mk6szB8_Ra3&ysO`30p92AarJ0Z~-jDZ|J8OGu&?N1dPm6s|_IEjtU zUra%4?8j)YBQ6lNL-gX69&()>brR zJ=1f`?~$23I=2pGPM0RQDuB9Wo8aTAEM%j;&JK*N1*LoUU|G0H5pp10`g(ql zN~M~OAC?qyZiM3OSpBNgwE`jW@@_1!`gEkd!R-nswrB{Z=ukK9)Sasl9n)a!GMg-n zu~D^gWy2wE4f^1v{Ti1)b&dLY=O%4!P^)`@=D)9+) zL$_#}mlfNinOe0t$TP;P)IrG)#ei+FMkmiT*=*_+pk#e>1B`{GDo!a6!T7Sg^(qL8 zHsQ~!-fC?amA?kl7p!+%HQMTK1bVVY2yB58d9aIe07z>hF$!bBj~@ z)_YMFzwaiH>ge~vbLx6W6`Io`N?kJh!8f%72iQUVsQFaa1bJmBk6$ig42BSmE!&uc zMoHV&=RxjGs4~nc>d-^6 zXg&-5fCj({Ex8}sec(eOuTq`<8!(HYuVc2JY&CgT*rW(WlVt3Ls zWcJI~8F0IDNvqY#Y7Y%zFT&{gsjFhU$utZ0H&1)qecfPl-@=!kNa)^*VO<$)!uT2p zI~*&J5}9pXG{q<`M(YN1CTkwoRqay#>)Q}Cg1U(P#LkstD%1bEtF9hULyD`CwaOVD z4gN~U8GNG36!*U9ufM2G5z>@(EWyg6M66bA3`tV|ITB| z!p#1E-d&e8rD8YO5PDuzPvO&!U?k!}(D+cyfF4s^Y(?PjCC`gFNm9SR?rD3BG@ot! zi0m$lhex}5)AK`ZfngRu1OMz3h{+`3ZTDpO&mKRyK73DJ+&+*q0+41{VCbyufdnv6 zfeQc;!__|I(kB6N1AFHSBzu-Zm?B);KDfgfE_OYtuf|ro+jFDzB%B~KH9=ROAh(5H zK``g0sY{j?Z}Oz|@wBI{XtpdLru@A)v`l+y#`TKSJ=jNYie$(@Yl&3H8er)S^X7`~ zY9EyA3JM%`Jv(`UKT>(Ucxv@$mhp2KRG($*cs<%g!Gi-&5ib={xjpka;a+M_{`>PId?HE(e!n`EgKUuvEN}rBNpT9^u(J(@5$M!Khcqw`H|Ae3zCdztzy0!zv3}%s#DO#payUB4s1ES4k`#+L`8cFAPqS z8B{6_d9a(cJfxr|gn$(2W)8tiPAG@{|6%N$nly{HZJV}j+cqk#$}d@I+qP}ntTZca z+qP|+H_wf@5%)ywhy4#$to5+QoTK;F&IF_#P$V2B8@Ae#UdTn9loEXIHe&Xn#V+r} z?fMRgXEP=@PA>$IF-2j6o&P=U66TpUB!Ry4&#nr%n_%QrpQo=szy3Q3&7vx9z8NNu zhkBL}WC%;CjF^~5F{>%yI*zEFy*NrS<+cA1_RQLcFo}>Y$$_q|YL^@vHdMPm1M(XC zK(Y3^DmH!gziviziV`=7euXjgGpOhG!fhJ;-EJR>{}uo_8{V>Gbd2=fSDT7cRn>pY zrLr1z8az*K30+*)?^r$>z9!#X_DXQSx&L*4w8tVur%LjY&vZ7e_xm!-ZGQ9EN2{NT zRHK)fvuAAuknMrxP`BwIH*_K?zU0PoDh1d9=)eyh-r=v9D+VYKNSIqD6Ep56yA&om znkX2SNJnh;OG;mq1Y)(Y)yepq&A+z92A*dGMhR2TW6}^;!43W`1vj{*sVMyS*Ln^n zHEO3cC{q`vD1aQ4lN;ui(z5;rHH{3OYKf~JvqT(3nlI*7t>(hM(5qLY{yO_NZNLL* zuh_y%-)-qhvviIoGPq>w9~PExdL0MR$j%J7%1r*cIl;S}`Rhf`4!1IjLYv9XWB(C- zzgKzS5fX&`kc;1A+l+q!{CUe1Od-VPt8?_*B$WL(>U4t>p2Z*K5Fd?YOATA-j#+&0 z76p|lM{62O2$j(~y|%mRe5wF?Zj9y{hM9<|Y=$|6QWvtZfRm!TqhroGL_EelOeM^O$G zeIz#(+enemx?;vyc)dsm>Epw5RB6qy-{4kK;F)Duj7OV#@-tH^%sdmUBdIy_aQi>% z)%rqaZvQEBr@PZSBO5ehCXq!(6O-iaPmK-{E@?4?lZ|MjfW5@9ovCsx9v=5PE5f9H zrOaf_KYwLq1H=!QinvulOav-$DQ4}&V+hrX!XK^%c&1^~=RH+@V%pAgY{|D>ifOcn zHY2?y{fPu4)L?&^SxO)YxvTgG{1_6!%N@6}NKpjJV}W&p-&M}i=c+Tc7Z}Imi-ahR zC1?}da#womq=(RxRUuU+=Ftu3=gY-G{QIJJqxGq>h1LGb=&ITiMt&ev-HQ!}As^&L1y`ArCIRo2-gSTRj``fz7FXS@p>Ap)4&H79vMM z1Cppn)bQGxZ7Hx{yPGG|SOk8dPxf;?AVjk=hzoP`ZE&$#5#wY=tmAAQoAQ|6TE)6d zMbv9oT^Ntv#V=tS3)VTi5Pi33BtNK!F;4CKj4fF2uRMVG%Htjz!aR=164ij7)d>ZS z^skR%eiD7)Vnpy zErT+Dto&#t8}ZeC5^t&VH`2~bO) z{no7{O@GAY)v#|qzI;eUb>=ygRl}jOi;~{%zcDm-pGDlVYn%wZIkC;!r&?>>V%;a2 zYWoGJP4T0R6KvyQ1~Re&uYh^*50fEgNF|-D0hMeu@4_o-entYDcyeJWU!jmGTy{py zS!}K66vh09FL*dCZswX{(t_BrFX3ezrst&OIvdj8Y8)C)vn(4#lHZ^`ve@8^3O?n@5$=Huqa~06plTrt2;JXF9!59%`RC#zjyo`@nht z((}33;Uulds--et=egat8a3nYaw;KZFFi2LOkJ;)6ZGB(JqZmYr}EVk#+GjH_RHsZ zb?DrCF6!>m$m#XPkBr{u+Ym(>+1%|1^7U~4;7l7_`tf%9qf}$0#0^U-zz_hXgm5Ak z(EiDo!V`%_4ZU-dYGmj^4W;Q)WDI}OXG&1KLyki*I;YrfUKe3Wm6lg_gsh8(QD6ix zZ(Pw$n>XE}(jqko8G-?eLMh-9>zr2pt_(QxW$f%e$z^6Gg8O6(+!M8Arw*y`hwecN z#`v&IU)t&dk_};r0%M;?~l|?b$9-5d$v@%oyF= z(cE0wtEPf$2J7Rm#Ot2`r+pl8+VuGO0v*sy`@h}NQQ$_M-rxBjvUgBcIEM1#e;?lTTTz$#|P3Wc!?s?QdHOu z7#@w=FeYRV9`oR0oSClWGBuz4r)Cm~CXWYFt01c9%mv${6WACtU>~AJ7k52@xRj?$ zh}u64Em9dWA30h&DY5Vj6?~b$tzs_>O1%|aqEHnz^~eN=!_HA2nZUzv;X^_p&rGgr zb=_Kf0D~bGaRzzOrc)N}=*?}v~B5jvpWuSBZ4qs<)_0H@KXp}=Sqjp`WB6J4iR5>X> zQ>wij64~P3;}e8cjO@1)QcRz`Mykg-9+B34OuR8SPlT;V1#_6?$OTbDbsl5k4G#TZ z!k~-TVkXp?i!rMqC>wH-H*)C^^p>sDYBT-!4Fye9YZ`{uNExuUTf>~D)9R2TUeA@knblk$P9^>Rb0ewW9`=q3%k_@nChxdHK-cJ>TO@Wmji-QT;{whPYg@9EQ%!qe2Q;^3+QB{&a|} zTQIBT@!D@Btt!UFmI)nU)w<@`ZpJ&nr?Il~PPp>xi+fEMRaJ(|Z{hp-<4v7DNVz^| z7kOu2zze2hNM*9oZ>Mv;{uHbklC|IW;S}|0$jTfpVW|T8#iPmO#(%?g>B3M^Wf20X zdfVcQMeqdYI(&`(V*imrorG+Ihs=n!Aj~xL*(>g+%o9bst?fUJH<(#Vew7iw^m8pb zq=F@Uk}6oNw1q~fHq6bcZ@^3xk3+uatP^!yXC@qy@Tg@gj9_tCCuJo#e`T1QyY!=N zai>c=R_b`EU!vS`DKo+gnJwK~YwDam-?Rf@r0CJ;H1O5xo$LKO-btc&wh!^&*m5R^ z7>^b6CSNA!!J=upC6t``$K6ErYGbsKcnS zm9c==up6fE-w7;U9Y6Lw>52kTQUj@rTlu~dSA+qc%7s6ZU~57ueq>fC8VRu$NrnHmw+CF4e3c&g@7cg|an!o5Ty z0tK@-kp-NFo#!b=sUp9A)e}7)U92rl@e6vd-NuL59-yITN-qGOhxJLq-PRta@m?A1 z8mSNB51m|Ot48ZqC0eZWBJYj5@eV$x78q*EO5ox7VsRE7e_yV0?Cu)$)WU#dRX|u5 zW+Cz#$4w!1L&~gUH^okjV1{UKPXy7fWnw?kAC7^>B$v!l0}4w9QR@~jBu(~G2}jJR zh0z!F3H6mhFH>PcG}cs97bMW!JGRZ@AbPq50I*%GF+A`PNRhbNmfjmn-FF5d$34e zjQp5r1@$$B&BE!RGwMxl=T5DmPX)|o@wXQE+%V>rzb;HxB1)T}V&o3&nS*e1a?vDhN%!?`8dgkzt-`y z=CMfGax*is1n1HkO3@eK+L@yeB5TbNE4OA5bBS9MU7BOrdtkq+OHc9*PEb?db0`xQe6-T zU9WY!Um^41N%8)}sKxT%wR*U@xc>iZv&R4F!neTxbm2chi+=b@XcovstiN0mH?-r# zR8zBMO_*I1w_^#=#6}(dyaEsz&QzM|m69Y02o$dlpT+3-zEC3*BkTQNYrVcO7(Y-1 zzgNA#AJ^~Zr%jNvzzGKKtTh?>m&ZyVhX@whsOhq8hZ^y@>* zBn*NDLfp5=$?q?8+ph71KgKr^*u|fuVsQZH`1g!(%mP z9#w*yhsN8pVLWoOOd6)x*~zK=@9hMQLUPoc=pC>UStR;}#wC?}^O+joX6(LE$!5wY z|LgfNj7_fud92~tUZG+e%^;yM&F)2Gi%K@dH(a|Kzg@q-rZ=4>1npRcP*@W0=&7=6 z=oN!N?sMzdv?||FT^B%$KM4tCD#;BZ@~EZ8WGW(|6l^k)=a6LCPGQ6Nqx2>G`5Gem zm@|2JG}EdYMG(ehYW99bkt~0YkZgwB3o=YV0&~+^KXOI~ms4RH` zc?Q&tt=@PJjHzaC5$9|MP|oVLZmYu{Y7MSDC;?>`Pn#Wl5=Qq-YTGe3p2AC zpL|^|4(4Ic5B3X*7TLl6G^Rz}Wo&OXORoYKlkH*)<~dP5r(PWNz(C4-aHeu3mUTm_ z!LeLNfh+U6BzF@fZI-1!EF}OMnI>U8G+0PmOXjDB-ykSW;LfA{IH9x^&R@qM^&%#r z=ge&V?2`oP%8g+ax?Iqn!F0qr&Kns3bG~K8l_2R6FX-3@&@TX?)CWn(5FG#Yd+|0< z$2be4AgNS2c}s(@q(y{~CZ)2EA|+~`^?aaj?~^mi-F$xr(q1kC#{Sde0KytNk!$;M z{G2Ows1St78k0NK$iJ#`zrY|tMKN%DVc@qNUJ-;)YO?RRLc=6c_e`x&V?&ggYmP51 z&E>Ne6h3Ml4?2IKN(~4>NH(ln-Pf61%!?Xod*rlR;J%k6@ts<52238@zH{7KuxY!4 z-&$TcEoq#aO5O(fDPHUvE*VCc6(%tWJDkfvas%@j1+uEw(L=FA7i8Y(@+t_%)-G^c4m!H9_hyE*=oT zje)6^gLo+ACp+G%XNCjy6plQ$>3V_S0M#69%1O5L?v2#6eb zRt)H{DA=tZ$h;Of4=m5ii=CNK78Re3bgAB*ki*v+#H2$G=Wkfgm`*UIdU`Du9Lt_s<{t;l2wZA|r~K;C{gwZ@ zSCidw#;?0hD;-_^_B;Sl`p~=ta~YfNSd)0TMcyLQa4E-c2)qU>C=@|u{>hd$8qs8N zz&hU;1OZoTCU?5h#Ji(Zmps>Rb?)uaRfq}|&GIG%R+~ef<%viQ{2LO?e=?UpFVnx< zF;`n-t`@S3C81+kM_`?^4Tcec_P_y=J2rI~Orh+JwcNp0CmAJx5~gsPr?0Ir&|dFi zZ3RV-NUjNnR10_c*NK*TPWkrWEbS^h_5%lj;j`aEhpWT z?2GkcwG@SutRyor#BB~9C+>I}O@4J*Ghz@0Tmj;hd$AJ9v+@xLKseDd8*|h45r1z> zQd;is<<^6tt^MXf2qG)I6ZAaT6a7|Wc}x2x*hY@%bV29FERcDplN8*7Qv!1i8Y>PA zx6B8C92=HWqh(OF7l3o#9Va_@u(~lJeTHQ@xl-+JN&~s9=h4u6|0TI6^$L_*K29pu z6{A>T-iujI0Y!CnWlh5ubMT(b@UL+h)_e@13AT<>mDoYQ(I6#O8+>OjJo`y+yP03G zK*?PUQ&)6=TaE|;$S>WIYlD9QX3(2Vw7`5yYgyJI#8?YF#la75D5T(0MYJx2W;JC) zK=m)95}23E*Qar!OonXy2Vo&NjpVfl}3arDekFcYP~JsD{-^;2@Es`nQjY) z8gmoxnSnlYF*DlAl*Lo@+{|lZhHVw{I8iiTSK^}k={|&3dQ)LGggbL~CIbQJn?IR$ zH|A-F_y94CY>(6!`%4VkeUAYHt&_qmy7;u8T*`DT|*aDl8f}pHn;TIQPvObeNYb9o3AV!OrP0hyK^r6bXx+sJnQlF<}J=! z5Xwa%t!qGP=BFDwQFU-3=)4|7NZ&!)hbc36_9aZm59RYHGX2$YIi9GWfiyM%z5Fb`DkM$Gg<$j)Lp1aIF^=TJ7t;Q*>k%zMdqY{vn(}e;W zjx0ss#cD^+)NJYEq6?g=GnT#rtSj})pzhV;$A>alh=V8~+USI3G&L3fS&b3Bv}RvY zFR9`*^cfPJ;J@~BE?-uuk#9OJ=Lm(c-n6hXhrqM6S!)iHDLMR?li1$Rc(=5v%5%)! z4}kaB5_GZW!3ei43T2+vQ_G*eAwbpFRbDnfrCXnBDz*-@ZVnJBrhORxI!U*By%EWrJf*q%rNLQ zpw0IbjCb{&2w#Vgo5cSaQa}A0IWUcdqv;9 zf=tIf6?F~y7l5`uTw|M&N-ACA1FAlP5K(4{6NQc2d8|7yFq#r9QHjBdQfTc&C)lfo z$bCKi?VziZa1;wK-yP+_s(4G;|E<8SxD_M@OpwQ-d3(;>IN+KLKM@V?$h<%k*Akeo zB2qqT65@VelWH?x1&(%EzjufTefm7uN}|rIztUtFW52y$wlxc2#0NZ zg<}~VYP5M@mr>qRv2N^hxwxE!Qo>6z5L|!py>+9%94MXzqEhRthO8BAkq=>67`@4u zzIslThIHgrkx`?AUY3@8u|Y_ zq$=nCF7p3a$g2Mz{z}#nO)75|7PQI#BI{@5AG}=uzx=C%XQiyjz+#{2ArZmN6e`3^|XcftAy9&X!wPudjJ+-;Xq(7j@Yv6dC$Vfu++SG-PGDC{&L7 z)BVR9-lE@pSe;7Z(cOwu1ixReZ=Pwl3UB@)9)4-k5Y$D&J z`c+$9jdc$TU^i&(+y}qCJ^U;J?FeVOojJSb47-95v?&9QVzf&DwVT%b}szoJ*m9qE3Y8Y+pLzP*bE zv0J?9F2zxxb$xS;x>JmWy?l1h3zq0UKTc8%g(c}>OKvl98&pZbEGvfxm%l=*&Jfhw z;G;3RdoyJ(UJYbvkmI-W-YhgK=xFNH-DI?yI&(yBa|~xD1kJJWj}fv)53xday0^<5 zL4uBBXNG?dHF<^>cxP?JHVs9#FoLAWzbZW)%VTn>?oX0G z2A`V!pP(^}ahF;3D~={9ETrgRHIm~Yx4O--x|f}tYEJA&puR`nuDeMqxU-lCsA=_{ z3KR+H`e^n8$-tI8kSHwtWqy}uA+JIW};1J1*U9Oxb4hBXQAj$!jvTBSyi z`3fpcV+f?Yp$ew>A?-!mGDjEgjdj*3z)qP)`vDt8m4NjA?nXIQFLUugimmJ zV!8SR76V5EMIA<2*IY{$*yw22^az+tT!1Y2;QLZ+GZDN{QPKef*;UC*ZED$gRN7%z7KPITtM-7FG^M4-zE_7nL*fGT z8=iWNwF8{5Ix4t9WtyN>KNzts;~?O?AoBUpREEC+S^A7fZVp1CBn`(`(n6KW!Hr7l zM@t9t?rGq-s3pBiP(4ftj%KB+pDr zB!3LF{fOnFEt>uWrd$tF37Za7F5P5QKE(gxKPIFE1GcNS;KqU`FsI=j(1dR$aWPr^ z?)rWzCOjO%-tC#P(K0t6GMm6#>Zc$&Nf|wjHP+CCW>vW*LU=$-Km!oxsiF6eDsg8+ z(wx@R)Lq;sCMKEjr?x_?Rii#l9nd_Er<;*ywgQ*AwU9ZbDZ(c6=Z`^p4d_r6+{SZ8 z{^q6G>Q0@7nO%ei7&jEiu=T5ct@$R)^0MFiM@C&eI=*g2U2oh>oP~p2gXQ3@){;iLTVBsS4fG{X&{=|JMpP`Ii>L zn1~^KzBJ6~9}>H=s4+X<_!w9v3^2hWk{Rc?P|L`_hKN;BLnWSo*MCGO}!@$Gh4z z290Kha#8Hsc?ok!%>8yn6QjpaXQkaqhKX{Ri()94}Z)PeNAof9Besf|IumxD?k9{d@+y$hbRhDN9jHEm$VgzHc-|)6P`0tc0GuMurS#cZ?**f z^3vk|leit9z5^8bp$J@AVb=ZRMULGQ!b^}I$OvVhALcZ$OSRvB+E+Vc3swK&aG6}? z&3?Rqu=)Hi`;x_qyg{~5h*zN1hr{HSTZm9Sf;j8nGrbrai&yP?*~i@wJZZ+-lKyg& zv_sf-X^-Re9kf1uSI^Mn72#9^DYtk{8MHIIwnZI(o&vAZZ>#%ik zlJj5)b!K=o47v%#(u$@;9U9eqL?))-hY_hOVT!!c+hVMUej)Z=^?Z8o zVT!O{!SZ_hGh3w?KvL;UwtfadclK_8c|JX+OtHwZ*x%6P99PY!v(+0WeU1J4a@fhk z2Bbu+CRHYC?cln`&&;%|Jg@QwKGbraK_j>7Mt@`dTVwC7V{TR0&5f`pXbc#J#sfM! z9Mi%ioA@udr|{qHe6!H@q7eu7(%40x6dEobRfmPg1l%fyP>cpJ{`^TWkE*^r~aT^@54h1S=j;Q-f zGP(-|3}X}piXci5CuE4Q%Sf3BtWk=}&^Cm+i>=YSeEmKSat#l0DLegG8tw9`Ja@;g zHU(h)*)Ho@A=q`)wnu*gt8_6{g)lC!pwvmKsFL=YA>G2x&EMwct!V%;#h9!iZ-9C; zJhjX;e{<`f?1XtZj_IF96K8vU#-+tP6I_Vc`{(uy>asT)OF>S2p8&NuSBXC_qbRpO6XUi=HTQ zx)QK<{j7FkzX#09={stYNU+VZzWAc9$LSSWQ|6k^TO)c(N+E(PL zPud5_fkSVgJ}`(5ST4nfcPeLbb}bGd+dW zAJ1XmzM#GR-JX@6fR=zy*Ui5ul;=5B&;kXbB+_2pUtaLzK0)>v24o4+OLdIRm z__}#d1Sx2uZ>9--JI&D3c6b~xR)#3C7@TJ%vsxtft_W|w7!-%QKh!q!f3gR`Kb+XZ zZsSnA{o8w6Olx{po!w(!-7lY4XKyx&D9f+!b;iKZZ=q2n%=|Q^ErrpraXsP}I-D3> zGuSje*oH12GCIrm8|UrGzL`mGIwlzk53N zA)Zu!w?w)xi>3=kDv&TXC0>cUJf{EkOqq&>4)%K%t+t$5lqhf_Ka-tKw0os6g)iMm zCnrWZ*jKvE5*LB-hWu%oW^)qhU`qHqplNw?L4; z@jBxE6>O*3IpGwK+OGrzJRfXV9og!jcxodwB&pTyfiVR>6%yH2}Zx&i+PHBrjvpS z0w5nIxZ!jZZbPL5jhzR_%8NiKOMHRP7g;(LUfR-dj4h8ey^@C;5H~3V@d0U_?`MA- z9t2Jijm*T_O-ir8Zco0jCHvA=Nasiri~5hDX~Y3TQpZ}i=p#NY(XJpHML-V=0leJoAf$@%55ZaVPN!Cm|$#qxmkO4@q42w z72eq33@ET7x3>2|hjQ~pK!-MJk9k282_D+#-$V31^xW`cM6?YyJlC*UvvY(rQ7z&c zH_mGm#ay!AX1zf$_)KrTI|=KH`P)V5uW%Am))XKa0fEAxwCp zvyOcuyK4Hzct|T^s8%zTLh%D7N6+Rec7_tq6pmmCz?00^*F|~;ZRG-C#+Q8^GZ4+;MnCu4M>mKxb9l22YcbfQHpgND=H$=z8haY z85w%9Pj$^SvZ(;Kk?4WPDhG28kY@37C(!dXDIcU5{(|uj4h(ysDgUil^jJ0jFGYFt zj;Fz=B0;l9$EDyvQ?k0K7j2OAREy4gN!(NfFbv1nbqUqzjAeh6GQK6g;0oz{>I@fH z{%<1SFbYxBgA6n2xj&XyKG*%C04;S6l7fvVi6QeHa?)~CbJXC37alwl0`=fB#cF6rd@H~h$xG{zVo&&6rP|SF{vRVAPL@o9_)|wp^PPXJRit7P@V}Pg4E;G3ZxxJ)1>G5Bif#q!CbIzONoEYa)?5oM2Yh6Pj`dIfn7=pjJZ{uwLDys0?$X&fEyt_ZXG(^Bcj=(g_FB;-H7R>&|RlGND4u z<~$wrby53_Pt|USf1KDguA<)5xD)5_ zC`8+;;OMz2@X2nL@Qo?e*^G3Nou2R#CJzF@e$IGWm_arjVuQHDj^oPRE3W!dPtrb{!xcnBJsZGIkTkDryO@`x#Rr%2X@4&7V=fPj{{4_ z3`_dgd>FH)(M0{bG8mZ?BXGaThn`|VSSu4?t0yObR82u@1cS@U&gUNqVCE)Qs_DM8 zekV=%m+*b6mno-%x>1E(?d_-J{;jXGrJKRdM!Pg=k{RXyf#I$`$6 z1v~%wYvoopSV9I5zT%JWdY7qYE}O?RGf3K$hIl#jmq~8UiDf+v3vtF$U>++?&}=99 z!aF^&yu@9^OHjZC?^*iL`FmT8*uksig1SYyFnzjKz5 zFcwUu6c4f-LL%G)S4~oD^tm}OYPR84yMUry>)*8*sD8tacYyRi%L?KzQ9<<()Yfyp zGk=<>mHvc8>8KNbW}-`eLyL@jnNoX;x{Te-vus}O!ThTQg6jCYIwNlaQs4!Sj4->I zJ<9YE%e-pvneKPd0IOfs5JyjZaE70La;da$Z@>wsUQ1vyWwHh6(>wcfMy_42z(RSJ z^=&MXb?(RHyc3_2I}#Vv@8uq46)zE4!~ zW#fScx{gHP=ruzBh$ePez|=sNRmu)18xsTsZlf>lXmwB;Xe}Q$lUc4jVc}V`YiDK@ zlGjQ06!?HOdcxU{T9rahES$UyV>hqlquY;c7Fvye7@%fxlb;090D{d5)~@(EnQg7J zyZmY%JrWBhEHF|H zsS-1bN$E7Z|8*0S2>{6j=q@hh?6Q;B_C>RA7s>|Hs0S&=9cqLB-DV0 zHMR&QQ9sil27kwbD9*s=FRE6IooAfGXT|P!f<#1fBRX_};CL-(rA{)O@-3f}L%ez~ z!cL6ry)ONj7Qa1@XRG}?EfBt#YYqe)Wn`HjDy5>4Ln5_@1%}s2O(NXLT+3maemdQ9 zFz&%_ezXkhLb7zXGYuO)|G>13O#^y!8U@GI=|kGfg5H-p?x%DR2V;&7=&p2$*h+cp z>X6HDJFVHF4^=?VHDYMFrfw<|M|xGz&riYUM&GAjAAQyEz_$5QRV3T};OafKkh!-f zyI9vqC}p8U?&(t7LfbEurKr2Pwy*qa`r!5WI|+`SPmZvsBPcR z`EQ^+Mk%uYa86|XuZoAPEbJWre}bx0b28@OM?iC}bO1{x0>nX-d{;X+A?=B4y{+Oo zQr_@f=a@F%^#ueh*eup+X2fzw0x;^M3yQ? z`$~e(P`G#G4&K^Gvz9DHx51!R{Wufn zoQ7F0 zn`&o1Pv$(=fuah_;8%U)-$vvmMv9a0qHY|n@hM4z?>3FcCo;Xt3l4qs z2@hTxk-c$6Hen|JU_SYP6v=DAa{U#m*A@ua&Ne%q{}^$x6p@J^BZ#`e=0s$V7OEfu zgM>k`()2`nYdQk}_*8M_Y7Uy_IVN~n%jf$7;)ONY$mK8m(KM6g!D&-iFJ=ekybnpybRnsfj19353JQD~X zS^14(l-f|sE%?#lFeJD~k@kQJF<$!E5g=38ry!H;28lUk86n2sbsi&8Z}JKM{eXg1 zwNd$!-en8!hvgsebIxnIprg~Ea*{WuMQ98#6*0PUjf1~7=xT^lRQsEyI;z?tcg$M$ zwong^Xw*HA2Af_`*kXQRfL{3#GT#2$had~P10T$z2m`v+md6UuFv7ZFY*zOWD#pB2oLltlQW{uyb9^*!ikK9Q)i*oqWlMCA^Y0JlFm_=dw&?oFQM2HSa z^*i=cP5D(cjX&sAO#ND}s)%UeoY^`;^2dT-v?;jnH_6sg9rj)9qktbTe% z@xv3A(kUr$+!#m@2rTU~egH;e)B_IZdV_CC0ca#8QkX7sYBN-@WX;ZRE){f})4 znRII(HO&l&x%$`-@m@C(^(Bw&9!m2>4TL9UPWQ<1cLg-~jJFREPVs%gC&-))H$rWn zY&u)LKX9o(0Xg+PqU;%P5q@x{J|&cOaW@eM#iHFsfu+1bvbj^$+Cv4)7Pq>PoVmZsdBx9cR8j;4wT4ZOarX0 zY2gIq`6g3U4m`GdO}e;7)*|NFK5@}-Gs_rB}dDH=*UsIzI(dML~{Va5!^17yE=;xw|S-4 z3Vs(Np^HN>H`?ki5rlQM0(F;>mgwXMojTaR7;C-~RXeMEmsneP**G6Ps~8y;&~;%S z2D5D?D`~l0T`JhGi3yKqYk1CNpirh6zvi@JjLp%TEVXf~4mX<5EUMba#_ar(A-G}9 zFPd;3rJDVPliTpX;GvWaVeS_Cq3)7%ZEa8j8Heoo*2AL!2s0#;opYEvQO_IDu*?awl8x z7ZVbus`0Bs2Pdo-4O=e2h)qH(&S~n8@#qSNWul|g#~EvvNFGE_V^R+Kd6-{Ay|K@x zOO1d<>NO}m@WHX@1Si4ejVZ}*Q)MAHIlc?Pxg6Uw?WlJ=r@AT$a}mLid~(|3PY*7s zcEsDQf%OkC8CEuQC_LqPbgfi}ADe6i?21PVsyL0J2{>wdbHvqA{&MR+ z@s-Okc{yV$z?kkiGv>S%!pYh)c9?14F`V;dUOfBw08{GcZyNKbDZKQzu{N!i2TI^0 z*A6Zjnu%I>B_tIDXVMKbp<#}B6C+W^TjHcNtC&VB(2fcBDmxJp*kpk$Q0J80s{$p* zCf#LQXTS#u*N-o1Vm1gVbqAj?-Tup4fc%|`f6CeqF335lnU?=F*(Wo@@V6|Z^? zn!b)0=CZ$g>*)M)+o%aE-5aPUD?y28V5Rf>bEL+FIN+~TyhBK zTz<^rV&}`A>zv7(V~eeOZYiBctXR)no(|^+T*&iyHb5bcdKM7m8`L02`j20&YpU@X zd%-hyBtmC4fzj0#ttI<&w=S1PJ7HA6-Mc5Sj!Yv0BRSgg_NH>9dzIN|gPIaNpXLr7 zYe@<=(W&%h;!#y#)stCZUzbnYoQ=Bkm`UWEm;w5^#<7g9EyE3UuW>-C{^X{A*i>Qy zo?q#e_x86Q?l?V5Trk~y!DV`MPwqQcpkO?s^A_w{9&Cl9&+#tr)*X1R7b-jR`e%e; z&OZ>>UB%*NyXp-f-ivA}rad~e$7HRmOn>L#co~XY1IQ1`6ER$l|JphjZ7=Fp-J*pY zTc%D69~2C6ZFlr=S0IJA&7p#;06Y+Kr2zMyAA;7QK$0r44y3VRv%Ad>re4$2UAvnK z;ivC|=hlOx4xx?H(a+Y7ji&elmYwZ!v&wugN#4uDS$&3Y#ol#;fner3K1-`TJhko1 zrf*7H&nm?(w@OK*$BOWXYVSQx*5LH=JU0J_v2*Osv|YPwY}>Z&if!Arom6aAY#SBZ zwr$%sI?sN)NB8crKkPqo-}73>I@c6^^4c7K?@V2(UZ~ls%tPd&rY33Wu3B74qKQoT zJEbD&^4jCe?$NR7I`R8tJ+mqd=q_%{I7$VWwF-*|KZXlyLEukQ zu>bV-Iomu69z95#YUs;AqHez%DsRSR)9%}rIE^x;WtvP2rsck6X|h%3}x zqySFHHFuxoA3Jw3P_S>;w+qq+Qf{9ETU|6=oVL4g;biZm&D9g)_B8_D$LVi1 z!Pn2{aC@tRha4h8nbP-eI-?_sA+mQOy0{7hqIkNR_a0D{pCG8$$)m z{r&9wOf)>c9UuoD^Hc&q2to$rxulr!0V?w^_=WdKgJ@{rzRXM9QVM8@44Z7)CT$tK zE#c0JWU>wtkuxVV-QN8<>x)|U-Ou_1Cl)#SnTQzrEq-cHy>>7JI0Q7jMs)4m}J)El0!R53_%U>^0); z%-R9Tha!6C<~ZhSrmM9N&Gxu<_7!0a!v(Tuf+>&Z|DK9)k=M4JAQ_g8@zVdC-kZwF z%v!!Lxyyve^f1?;xouA8Fs`x&dRr0$Yz#ly0EKmaI~zzY^kJ^62inY> zXk|8Cg6`f6l_iOSsLD1)Ea?pKq%P)G<*B9@u_p`LZ3?l^%L)v-N7NQKd;~L~ISsyMTzLA;yzPF`J2iR!yPf2oZNJx# zvt9tDzHDTqrKzm>+p=Kig4XLe=r1xp>k#IzJDhA?EushFP_NywO;az>@?7eJpI_|M zusJt$)Cq;;ZFQv=Ex_egQA7~sa}+!;8~>-`BLhW#mgsm`q8&_=`ZtjF_X06e{XkFo z1VvmxyEWo^w5kOqG2dOmB&N1!bZpt0W*`(r4T3`*mq!>~1R|N%7+*iA!h>K@5r(3* zhFzD8p3Dh*FO2!@g|eMf;hvRTF6;Jv3ClY zET7z+uZBC1hWoP#UAHohI|M3m)%>nc+P3m4Erm`^E7E$YJ&W*Mu;(%^L~NT?4!7S1r=7-ojk14Sj(BwK z;Mn$zVxux@QmpSd9vo6Wp(gQ&qMfz$Y^6$G)(BSW%iUZugbh}3S2>R0La&7)&4kP* z`|Fz_^6lE_jV6$v4}rBLeOeoX{Idue@ZB?_vrA9yxUnY;gsC!?M7vmQvj>Pe)&UXw z)Hg`l?JXhc`<9g*4|U@uUEHo^`Fhu2@UaGE-}o(@1BbQ;{#f30(Kl?DwcB6u+u4Rd z9N2)+qpm78*R>4QJg|of77EbmIhW$S#)#|KEoIb>OFeRGp9zXsOeCXn64Y8uL*A~A z<-5Z;&p6VI1%sc~QUhBz^9c0Yqh}>t4$$)28|C|@TOYih5g0D&lPrLZz!Hm2SWv;a z%l`(amiGh^&7`IBgDiqh?w05>m=eZQYes_A!wh4Q4>XLt!y+pl9M)xV$6%;C?O4#> zNxKYZtc)5jIcxnzm2E}_9@US$Byk!TnT@vDd=qa8w1r(<4QVUE!aOWH!fjl@V>{t=Ca4SIQ zC_>~KMeC^?^Z$aGf?AfZid9H86yODb`G-srhCevug zn}*Y$2R6%CLZ$t%QqHu3)W*tR3q<_SV&J5F;qd(7`S-6e0?_4K8rYjQUG+`4!_Mq=jV;R#^y>`Zr!Vy;?4sP$ z@v9+X^}?C`5$~gj0Euhsku1XgA8Soqq6j|tjB-;v%O-rF_$JrPLxBDRXl%iKA=A?s z=hVIMQ7x*|brSw-^~Un_noLbAVN-9Xp@Cfmkz~Rn$LUJ%6=I?6nnOjbg1=fN4XOLS zVNflXvJ`qJf;TpiNbeHm>E9+?aLfgsG=$=3jY2W-e+|9UlV|p&A-U1?8yTO@jT&&} zvF>JmcFWCUicqA6z@N^cPs~epQ+nL;LEQWy?ToQPw)T#&eF~!~nV( z^FxminuzpeR&yM#S96!&smWY2nl}J+W%z@Nnaq7tiqt|Y>(&R7xJ_eLTn}Dkgo03x zUhUAX(^W{Fr|xCx4jn!5`|?H=`?-wzA5hFAXPmPPkE#U9!OcY5zC zaJwO`E5%{sy*Dt!btPN0r}f*Ve?;xuqf-@_&bo8KvZ!Cx>i9+$qzL?%s=%}qx2uc} z1o+rHBQn3z!Al8^4pRF(nN4}S%=~nr>H5fa!PHHe?qwO}i|tFY)FeJst5{ZxoW zsQpAUPQ&X1jR}~YMe-ewD|LS&ZJRfX3?{lCF~i&6AJ?GL|V)Zg*|J%=sRpOVFhhcUAk&R)mlq9uIX zsuQIyo;SaS$Po7$8OxVbRjKT}ZqM{@JelorOJE6A&6>+_%A328n#XD8Wjl1;j$@%fzt2MIIgndUf&th0U1hK6M)JWaGu#dA?%sDNh(yYYxCt2X-X3il#Zj$zTt>2e za`f}B@TJpbG&Kw_9{vxff$8BN{ipksFopXxiLhqII zH9goF)ScKhw+y{MA=jWyk6`@Wuq6-9PyQ@?u}< zlMaG>kR>LDd}(?@SZL(8ZYk8U1TZGgBtIbU@S$GH(9gI1%>`)-DZk5ty(oIjp@Tsb zZ*T9^w~2TA31_e)cb$PYcHJ!(q(xlvjRI{UxOu!ymiObCD4G7w{^I>?%MLERdt0ZU z9OnDj;4l1fBthF7@)w-mCp`gLf&YL!dp2`^QFw%YRImxxn5k+~LMPSvF_bDD(`6VPLY0ou^Y9!IL3m2Wx#OYW}{=A5u$V1q0n0rNccK^m)? zAWuj5+!Aol;My1ua(~v{7iuv@Ne*3oz@gE^VfS`UL@Pmdm5X_I)|l=({HSlc)FAgQ zG>gPQn~biRP(!=w5RtKuxGQgd`WJ}Pn=WMpQp>Q^;80wY&B@sGO*iZCBa+#$tpiiS zm%OxAKI@{M*!rdN1nj4CoWq8MRg;jaH`QfHz;n&=i{rz$`2%iN*Kf~G-+h{ zSQING+jvU1_lP-CvY1x|Tl{9OUZh#y^n(3M$|NfNW+)ad-AZ8k*0@R;mw27_StR(o z{8c{PAOOSGDI0ML5EDm^SrDm0O~Rft{Rn(8rp>B}()D(%C4H!a$G;kM$Z)|KP>rC{ zX)p7=)Y&sxTe0lwYV$=H!CO|D_}tuRGmT?23=z4=jyMHsNxa{1)hWC$H&;q&kmRU3 zzhPxJ)<)PJ@N#JgvwTbEz^{nHYFLgTRG0T&XwN885Fe6%x{OPB#=AC= zfx3;SA$+I*vHTW~BCH;=;gopF3P;9iyen?}5vDpY5}BbdP*4`6G;u6>_}riFRlTS! zZfjR&$;Co5xg1UnyQWRqeg>u=eZeHyZiw(ySoOHV+3a=Z9u$~r(HQbVZ}ew7e**AE z5hZ21CG+t{xpnNb_9B#U?#hy&B(gA88Hba8dwSOBYEkPMd*y%?+i{};eoOw_X&g!r zpv5!`LAZ*XX$rcHplumNN1NAl8w+6~NVn_K#RA`e$Mqx2XpzinqgaXFZ#j~N(6z!U zW-qLX?V!>#(pIsKPKIkG7x+y>3@utG$O=K)5R?$qbUEG~7x&g@pE>X0FRi?%^-*ST29kR2tba`JO3=<7aEB^_H~;qJbJ$ z56t*9g0zCCJ((#<o<(dxEH#8G)SzW-=)#MN&lkMZx?{4oH8xDWjIoY!7m3y>D&uDOR6Ajj zhh00(^uyxLaBhCiv@*q+vG#jV#RERt@OZQ|vu9rZq6^c^zqQQiV zQ`{0`NYHx&vPjL@U(E%73rRcq`0A4q563ekxPjo<6R=*pY}rqJ`H>8IGJ^WQUV}5_ z3~?siOT1bP21ph3dB-nwedlC*IW9qJf-ctsfp+;$m2YR^tJ_XL&s-()T(Al2droUrj)8RZ zGH@%sRtgETIj= z+~oA#eS46iDU)HW@N6UarE^DkIN6|=qZJJ9#Fg#bHseW9!po1Gh$O&GSjh zn~Ii{g;DW3d{Y7!tM_YN-%haic13}H!9o-EJ!=*+cXf&5+eK!G>Xo9-Z=cC5=$9_j zLbyEg#$%wNsnW$F=F?N(9|kAinnepb{E3{rz*7iGz<9C z;XrvzG;;s$5 z54NfiKa%Hu=0*`GVkBd}PABt%Yx3W9AF=-GB7`m=gEbXmWgc7s&REL}Et53CA@5=g ziQUJ6N5c^x+Xwfm>E=7+43&Q1S8^KT?Y0EWxHaWc2mSQYq*n|f*nq!$c!6!d!ht~R z4;B?)X4K)YbsN_EdHQ2*-fQ=>Y2XfxPq{dLfAuzf{*pE!-VHZj0|#QsqR_)dXu+l0 zq_NB4%7-V9R=~!_v*7UKRF+6@4gU``&BFZO(KP$NPgwr!DxJ3= z{_H9}0Gq0Nhmp+O5b-np&#+SPMpNA=jVasfCrS<#??LkA6&?(o_h#~-Vr_Ow#Np{O zBw5V2K9eC+z0s1)b@xti&dp=a)h9h)G2ge0Tu<6QTrvK+GteXnJ2C`VeX5W4_u~-f z2=fg)+(w8S-3|U8**gPEb(hrH0GUVybXz`g) z&b_(D_svOkhG`KT6|KG1B0*0s9l)U(*|@{orbj^gdK|6_xqGihPMA77^%W5carpQc zFFZ=Kpq@Yemi^B3xhkt^?fAM?dc0+q!%kg_K;rW^MuQ>Dsa}9Tfi*W>+VP}Jon?a( zgg|Tx-}{NhZ%=5xDOO91MDH5kfKe+jbHWpsTcky-kY+LV9qBzrBcu5K0106#3(EH- zDk?*qj`2ePBw-VRMn79^)CG@F(kz$0Qm60M4LwU8R3YYzUhiiV@*@IAEVW>M(@NY% zR1LDnLZO?y8J@5%J9W{{+*FfB(9%W{btupyPWC-J*Aq#v4%L$asAB} z>=QU;_*-8jMNF9MD%!T4@fC+dbu4Ft6=xwX=+&U#A0uT3k-byO zB6Y5O@x4ghabxo@Yh$9T=5y$I@Gu3+I_C+uu4&rOvXozHqXtlLRJD>>%xu zEpz8mnm+n^!qH`kKh2Ud0Tv`NaoOX;BzPF?iD?9bNMi9(n_XdcjY1~CvaQ_oVaa6U zAz^Yx_Bn|3i*3QI>z*h~cd3d}-Zxd#@+shn8NMWX-fP@B9Z{{4Q9b2s0P#u&ud+Ew zMM%|GF;or0(LMrO_~dt1c!B{$mCN;2j(a%CZWa7WfVN`hz41z{+L%2VVqFR7KBxcPv3>pUS~ zPknv6Tm|FYD*AZErd6q#ljMhZg;tsq3feZ523(*cIvumiQX1hbb9TBisFW|qqhJbE z-as>~b)ybY^_dkbNR<3>(kV5RfR(|6J@&9<=9${!sA=U=NDu}()a|Y;U{YyI;gVyV z{s%P}NibLy8F1>V1d1C;&GKG%OX`GOaDjLCuo7rR4aGbx`P1WIQLC8ygf9B1MsrSi~>Wo^(h()R1o~{XLQYScbdpNoLVINbw(=RJt&^IYey)o-LIG}TD z#frHFKk--Rere63p&W@VuLAK=cZqSjVAQ=PA+0M?ugVj5$3CUVSDLu_nRjs_&^(0f zUMg@ykHWA>HN*Dn&8^3=8ARQ$HS$Sr>SNomT=C?ah@KW)Dm%&{ zxlAQMGjCruS^!{KrCec+`7|oJ7q)tA(2}S*+eUDj8(vh%>OU*KtPoW%xoqtx=(su) zIkQkop_&HSX|J?E&T9zx$~*eGA*l|BK2|g~EGVTG8r3#{)PGK8Nk#wh4 z>LXf=hy{mjt`!@h($$3lC9NzsxMSM`s1_0f)cC*yms2Mp4RoSSb=F~x0ZoCX;J=JK zwqcgo31zIRi}2qK`d!<1kzkvzAyHY2?YU2$jU)%To=5~3+Bqlx+Q2ldZuRHLt8PD8 z0Otx(%_D7df3B7kpg>8wId_mKa)+ker$Kx6i43**Ry=|WGipN2GN}(Ly-VeIt7YLMa94QgT=8#Kr&k*yn2$W zKRhOZDIC$Whg~snSR<%>e9FS+?_z?g<{Vie4!Ta{I_V_9+b;WqO##J6-{pE`Dhlj4f95OamasZSx;OG7^ySMW@}-m0o|I+oWNxq#KaOHX0~c-M06 z#u1Zu`w8bveEb@4bPM%MgU#fs5vjGQttaLkInsDysfZMPTeMIlb7qDt#nP|hF2f)a z31{c2ELt;pf?r|)TtlCbz1n%5osA%(jn8_rR%nE=B4`-dD80Vm7F%=}Z^O0eT+tZW z<#s`X6T9BfFrSyAt2);%WMK%W^ObzKCMj5tdkrA36Ly136+<~VK8A~RYWxh@5QwXT z9wa=iPRT1a2$%@*?y=*~TZ($w`&4!UDO;3=RD8HSmFw)gs6FI$^!-p%XQ4dVaBF1GpBxPe*Gw zhPH;m&^}Kmv$*&i<9002#A{18r(N4vDj(zRn1y25t|$=&4?Cv}pp3iT24CxB4pKOo zy=HbB)q{8Z!C<^jom{3<+L&MeA37(dnP+rX8-ErbV!m2VI;{-?%M>lKiFi{ zQpF3qh{>(bSvvH7Hls`0=9)UrJQ>M}xZaLx*-*N+OY951psFG!g17;VS{Un4{&-Ci zi1>CG;{Q2TUJoGJz+q9M5!zb<)%lBiEFZC`_4QOV7%a*L=gOe}F-cU!@OqV3WN_>F zkrL0}04I{zstZ`vb>7) zuu1{NF$0KVv>mJKq(&PFSwglIH>+PWp)&q7dB$@5PeJ}_Jbr+x%lYwO+P83mp3w6~ z`@8wwR7D`p=(3UrrSOfv_bAD6)9AKEpvT)~(HsY8lo|CtTXv@=CVoc8chJ}i@5FT* zx>q!nz-&ll>+tbab&!J3(bm)zw%|dhO3^@ErUjv>J7>;pQ_J8LgyRZz|G}qv`*p2< zU*|T?FA(;#@W#KSl4Mqr-IeLg;@I73RHrvWM=9}A0Dj&wC1uc@)NT8)0#5ZN+L2YO zGfdA7G$YQ;fTf0HN+VU+=1;(4H6wdzipjVXYkw~K57|uEGQY4Vw1=CHiis&loR#qg zH1YKvz_0eU1%34UOT4uTViE%@`opM4FW=`ciFKp&BgR90f#h)xPO6sJYiS&&jyIEzAso@2DX`-c+{GaYiff77J6`h2Z)e1DXD17mMp z{-;Vl%YW%$XZ<%9(53bde6u0_Z}=t|1pf!Vk@Q{DPB#glU9`r?G)OXDKPh=d6c@%_ zu>l<&cB!?JC5>y(lou)6+WELoD82$^Yh@*b8cun?dyx6|&zlEtL!YnSbKc-67#H}T zd0o&?AWO=DMfvNlKA*PPCH?jMyA*QQa47?+AFi0Yx`Uli^p4inn~}SMexY_L{u5_I zrB|WbqpvgLY&)Qs#8bH8!}zJiyu3{q!^(QcCyevI4rPBt>DA9dHwbdb1pH;-4z{R5pN$F+K)1_e_ND11QT< zD(%gq#H(+?A8#J~>?EpO-ARODWSd@!_pYNThyQrZdahPB=iT}t8*v4hl$K2Hn{l%= z(82h&{`ZJehHGmUNB|c_5`jMmp%tkwO>%rdoZ`!E?mXcN6CEsQmrJKdyf5m6q<@tk z{8x5K@w?SUv1T_waOmESCyr$7+QLo}K>sB6A}sAkV936;HaQptg@WYN{=O!MiydqY z0|24Jp$I20)LD7%?vd-KN6yC*eToD`Z~pyc7cW>rD`ET$CVxlajR+7n_xH80VpeaF z$xsX&z$eHtdS&RQaZ70`Ffoz}4()`N0>cntV1iAQa5iL;c`%;<($dF|`V&uS` z>o@1JT*u1h*KW`F7W*{*b`kY^X)Y>AbQK3J|0R%qnBbuf0Bkk;dI-7MVMYr0I7Ex_^qZcpZFO)p`){n5GD~J58x;;6p6Z4?)yA)P!WbOfd#X zx;lsRd&!c@{h;k?lagY}?G2d=$faQ>Ax<9!>^#7#Z5(mwml*#lt@`;ifdR#u{9;#X7m|ff|Si7AqEXTh5!9x6Q_RLm}|~*6vty zJ#_FMM=6^dE=1Ppg{|6lj}WB0FTkmQcW`WI85nlp^TaBGZRuL-GWe@eM-i^X zqfrY}-&mxdst`>Jj)Nw0-Uq=JH6?Oh4ds^$!`So9w(#@Ej}+Z|!!@YH3VaXJCR!*^ z!@1&#RMvJ*^vVB)>(IjL{A-QxJ_{rOuxTcnZ-+$edXt)lZ1O_{N{0}3LtW*_?oC_mOlP0 z47R8;P#(!R1etUMt#bjr>kp`qzpY~oLnm0CzS#y(zEtNemW3b+qY27tH&Z>kZpLnX~XIb;$c(|HD#W_=K4#)#J^d@T3jc` zuNYdU5^!7zy=MyUfliF3FNq$`r2k*qOHlPWP?kSHEmOIa3sOwE7;FTpd)ths4R&tWmj(uA9yvOU)^{C z5yah`bK>ga(6_0rI2soxRO`2?g8y;F(EQ(g<1^w_J#=?aO|m2M4D`v~`Z!z@wmFtN z*B@a8mq1R#l%M^xjbrPMSD&&>a?wsp{!880EF+M%Omu7QiSi{DNw{GHM7Hw^yxO_O zjO)~;VMO*h*9as#^6DQFT2=Ax>!+MtrIP`wp2);k%9R_!x28hqLX zs<*OON?y(>X@}c{x9bl>XPqR~l?%wda+Z?#yDYU(GnktBC9xAA)pJ(fK#vk*lv*)5q`AjJSt!pp1xn}?I5X^R^Z&J#cx8jES z)xn&NtbZobN%#Uo(1c43+wXkC^WL<+vAHtRAU9Cy%&P`L-hIZQy*R$MY=#GN;z4A* zu}b3wL+7#Rdh=@|z{sP}KCG4j1uj&`pc1=Wy;GAt=(A4X%hUMzIK3$FQwPyk_tbtw z_{h@X38|UT-IDQ7bk0H}Qd6Mtk-zCX@#XQ0R5ux|OXLWKxsZp6EpW?2%(`KVOu50C z9;)pd!5B^NthLd8p8F$%nwxIUIUa6gmt*7|8*R%X-NvTqj8%TL51^5f){(mPu#DG) z&b6{8>CDVmk2C!@BjDx~`E~8tr%ZOJPv2R7U_*CzCFY~5SJN3gRPqRAg8Gx! zz&>jdS*B(tdn&K~ZGB)zv)EZV$B@@~xna~cz?ZGsPSK|i@H0KYvpOjIv#B@mGkM^< zt-?2!emDDQOpm)=ypI2K%d;9JRz8DQG8Ch#1A(S+_IF_O0PS~buLz?g#ewfML6+ug z0@&hh%Jmm~S4c+6e+r5JJ5f6;63K|+5f5}*n2`eNdzbAkVV zmN<=XY0KML-HwJ@PAY!RTqB;@T*h*~(hLqC;0cHcX}I;aZJ#l)eEY}S8Ry&ECHOvb z$o5Aqfv3N-WOLIFOo4j!(dOSjbL=t$d4PTQdu&=90nKK1xxaqL+TieARet7B`y|>$ zH2*6i2L91j28I5P{E3L+4)5gi@U;PQv~Qd$hT4L5?>QbZIJ)kmo1L|2SaR`&?|5qP zC#nfu3j{vqTMyC5`UhEMd30bO@#UzZZmOU4$VhR4tK{oQ*t%xy^CBY>0-(zW&5HjYMsrA{G|x!3%lV=VS@)et50ly` z>&OI##5X$+NT->6h(JS_%!6|MD2pr!2a^2}0I=BWI07>oC?b9RR2t%YH3FZ$;^3{=H~|2l`puwK$hUOJD$gP{%U>pvUO(s4xmQzTQp?MFOcvdrdnMfA@#1tsT%@i2y@^^?xp1eUh?twYcoweA zATd4Rf2RB1;B`WGT&E8`7u&Klkm4C2Yzo(_}#)dBlq0B+nBg0%Q#aSZVo}77Y z`qOt$>$Zb={U-5)9FV7g!-g?MOARoH2dhOl3^LKw8-L3+9jg6KX!y>Ppqh$G8^F`zhdBR=aXMR^1w90;|r7cu`xEz%+hh6wl!RX-E~Zx!T&bAgDFyhqW2Pxhus3rD)3N=#*`376Qy{^ zep_FZv$4iLxsiHR$RpfXuo2SzB6ul{6Lz+2V3K9t{^JZ)KJ4oKM8z%+?6aCu*+D5? z39mp=zJdkFos?Fm2&vO#AyZa-EAKc#O~VSb&aD^XU;Bm|B;@lqAJP{*F3= zNj0?DidUS(7={GSVl-q}AFJ-KcnVg1l zfb3Xsg)?M3q+2eEF7)x~m_@f(57iVK{mA(G-O8wi*YroZ{F`Z?mCaJYIbJE?wc^Z` z^C?GzR(smcuRg3NNUUsR0|Oe9qpc5#AMM4Umfkg5xpb;5u&L-wSDAWTR9jvi`3k?e z(Z-QG6N&Z(k0NSF`xu9#(1D~P-=0y}MlK`?AhL7X(SAKeS1mfZ7GPpdHSnCl&_-_v zK^c^v5m3-DS`!s-BoxkJiqbeozw(LyY?dns5>b-HtqbkBQQ+7|yy{F6&v}#=kx7q$ zAAs|<)VksJh5So;-al#rK4% z-!HH&?-~mVo~8ym63=*DsDF!II=Y3qf9q$Sve#0Dt9oS}@TXE7c90H=O5owY+$GM6 zZ-};+BdqK^%rLw`-r5|a9gIZjauPkpV*+PooVw<;Cn-?1kWsbpT}h1Qsw0q!$OW1-$+147txgugx09RPM8ra3`ZRhhk)D$$3SC*u=m zqd-z7ib1%xT9FjKmrD$DGxZZ{=cl!9fVJM}$^5Mrqg-wVu$Vg|D+b|Wz|3Cinka7? z#68SX{~L3{PNqz}r0VF2p9qZ8Qmi_T==FQ#1V(5PC&@kb2Pjy@A=DFxE(Q>nxGT?)=^w5j%gZ2xYl$geeL2Jx-bM>pj0_ z2r|LV(hjktxprd-Sv--bv`8gx%GYkt+mmxk17}k;VDFT4I^4c6ksM5P>vq{cow&c) zWU{zy$?)+qn+5}7Gv<+mlwA>Lh3%`Hx9P<5qgY4YAEMSYispOXzl5aW4^P}^wq{bn zmyEc#*w`+t!iONS@(|gN!w*hEVc=)kI-Tw2I%|`%Hy*Bxtn(Y;9*||3`UI0RG0o? zJNG^Gj}J4akMr}J`RRRtOwKEPcbyRIC}~G#KmFXn8?MjuV5dKBJM=g$uwryOa7HgN zzH+BH!?EqLU(=v`V>yz1Y40-PyWpBv>=5Yh%t+ty9EsFI!S6e;H)EK5_{NpZ4BnWb zG5-79zIVjmG)El&kRj8*$Z!)4{8lZ68Q*|OyQ3uhxFG!bnH*L0<@tOY{D06;!P+~f zKUhmS9j9aWV2gL}7Pl|j*K2c8p7)EF;q-#zquP9gA!gebJ8{Xnf$8`6_09C|@+F0I z$~2!(S=ZO@Fc@1*1e_1>C=CXaH?I<(z7>DEM&Pql?}T{)K@fsL8U^0B7UFd3AwDT~ z;=Co72*Aeuxthqg15wsVj=)%nfx%s`z3?Tp{VI`1! zq#Hv$`50p({djOZ!bo30JeS-05?gQLZt+ITD*FqMUcxCU#0pzNoXA$l*f5dpa5jxM zQB<~~4B)bw6e(!RqmGv{lVF(Wz>?!AraI-L^%iRT0ra~ChDBza0#NKmSBt%7Eo0EG zjaNnX>Q@Kh!40PvMUyh*Mp$TRgp1sCw6O?#h>%G)@H6Rj6c%yhNn57#b{B6w&a zy%v5CRsnI=^O9@J>r2;52-Q`p=_nnDHF2d86kB#$Nsg;l*x4ut#!F)z-&%eh<%uec zZ3KFtRIru*u?A^W5Fy>T?XVXMuF>?-ZLtHHxRSijAALN`F~(NJFWI%FzS$CVNRo#B zZCJE7npEt!=mNdtcItbuN4HbNH0RgNh)PW#Zt;quiWH%7s#;U{a~q#BB4uSVV^g=4 zjkmPV!Sa_#JfVf5kNLB`k?R#;#uW_74Ec|1_m_zUnQk<}Fg%v0p=mZ{kR9Q8MC~+%atOjs`s1!WB z6E0RGpT+Ul-_uc7U4#2JTz}&`HQjl7Nu_GGt<}OGxnGLtnv>kg}pnTe_4ysszp7&Tg zMwN}QLM$<*#|rd`{Xu>xa0{|xEfT+aRX=rk&$A%PA+0_5jD!yo-u%riOjLAqktAmbgPB20|rWDXfhe*T^8l-Ozh?)pMshmx0)WIVJ zZ4`N;VPqDjy+fR}_gc1Z;8?Pb<7f zR0Qm4tW0SORNCik)c$WCcLE0`X)u z0v1d$RyOAk2(in;HR4exfF*}NUH}0#{Rh?~AlRBC)gZ;Xlxt^8HamChX@uyNz{7O)@4OAKtv2cacUf^vdxwcM{B_@g8nqt5WtGugJrD)sOu~95InJ3BOQVTw@WQMDB*1DuJ(gq*{ zw6JK1@OY|f0$Fq}dN+8QRAf?`p<-mfE9`JrD>Zs%(mKe~!W7VoBMaLK7QOiaYLgrq zes4?hV{ORWw4^Gc|4{t01kA3E2UjYEr!!dFQNTIebSHTZ#z7GN&%oPClIh7Q;jHDR zy;%ILlYOmO^KqaQ_{rp^Y_if}UN?U^0xXh`QejC_T@-_FQ-9d?Guq(-!Bs|8Dd=Ej z0YTA7USYk2>Up71W0~9|TAaIN z$n4~XYUvEg-gMpPS-4w3C(?S)NJqI?tW?Ld1kc0_*f}Z9O?gHy*^iEZSg!tn(P4xW zBmjbOZpbIEUV>72YOpaJ7FV>mRbBLXV&1Knt?cU43sl--og;Hcm@$m{v z_!VoXB%S?g3;4%F2p0wsd!+EKTD|=Wu2{$LKN1D=sDfnC=~$+`>(t%9jrcLgqv}V>lTCzs(Y0>_wAP+!Fn@-er+`xIJ6iMt=ua#Ny@wIzTO`oq2W}sXNMOfS#H) zHB8#KeM8P>DBTYg0$Db`F6D+W&^-PWrspipB@+x3afKMb>xl}u5V(MiUqBfIWB1h9 zs9On%<|xrk1Jt>F?>~-qrltN+6LiL!TLdxHSl`)kg99|LAy(%B01Rj$kL6DG2?3su z?Isesx@qaKifJG_5vXC5gvA)z3hRI1Ns(pozZiSR=uD$%OE(AuI}6S_UU_0kJ10$vH!kfkG1xi>zT8CeOL29O~@Tcwd-@k&dw$}y_A!< zTLPUci}TWL=!%%?FC$!NqTn+P(t;WhBw%#HUDmKrqv>MS<8IOd^15KLMR90G(tsTl z(<9w9J|3>kcj?It%pC7*suZw1`&l}3zt;Cf7&FRr@LzSr|5s-0%xs+hX`Pm)nR_=jYw{C^b zZqv_<_vhUB2dA~%q5gx@)DM^bJDdjk4^G3I!(Lbf6Js3xVpin4>8d99^F+vs>sGPk z)Ad&`Dlw!|dP)Y1JczBqAjYtLiMLF146#}8H)Jdd7!t8)O^C<;gwuMSz66_NVW*V^xHJo}5&yimK=nj3GowhE> zp1c*Fcg0}cEYS_1eY?9tWB?$R{{1mN&1Mj@9VJ2QLKAjYH}(5cvjMou2ILY1kU5cg_jsKq}qLVV9ExjWueJ5|by|stq(-+(Y;3HRvunS)s+rdJ`M~NNA5sQE4rQ~>V-ih^Uop%TUrA0v z{0E5-n**6mv11`Q`yZlPBJpe5MT_)ytgDCk?P(NIyNAV_DLreKHl{l&C%#JpSwA(doVfZmJ5iyN&RC`>JO)M`K|=%O~R{MnTZndE!yAc zUaxOJmR8YFc>GM5ULiDWA`%N-ySoKZ^`FrFj&ANT&{UDr>Qz$uA5XEE{<#_ei}MFl zrQ4CL$Jw|hG~vb+M6pSEceB#NhCDfeq%Y%Wr~AvtU<=nw1IJ6(-jP+PaQKY%fLwB= zPKd*}<Z@O1E08Q;@@tUb1>pQwtOxZvSDT zkvC3mDb9lJFNF&QWUy6wmoT+REtO5`_~l|5IU9-c)Ymm*%v7suag<#h2!WGqn_1A6 zx3(R)c{qgwr>sHY+i50;Sm?$!*H#I(OCJ>OGeBiavi!DP-~uxyMl#p5=O2q{D22)kOnpRgwuN!T zjqw@Z$D)w!P8?{UWA8U!_*Ev{<~6|tuz0(|0^y{XBsj`v3%%6F?r`ph0IwSKStsLh z-~8zO5v)QGD-S3Z)~3I&Nxmpz4OmLRQD-I6-PG;IBL7Zc6Up;U-r(Y-EV*L8jBvUTfm2o1>qOlK{oQ-!_a){*|gjPD>+YQ z&Bt$Zn)yj$n@oQdXeo}p5F;=T@xekO{33M1X>fXBpFhG#FD+tDqvP(t6F;c7|d)hAp_F3p8-+PJEe^7^(nkh z9Bm(^QGbDU<>In_au=bk^aCWJuRh)dB48Jz-=U-WRmqOW+xY4=@+sp$LQbIN0Tll>1fvP2_TmT8w!nobr1BE5BB7)CJLBrQw72FW*y;r(SNW$% zrQnij1An;|+x8=#cqq6^nkLR$(@2)bEABbkc?IN*hi;;9I3Jk*$|Q!aD9Xw8_WS!U zUr6ct+lAdR-c*b10<#NyHd`gN_y!4HL4A6xlDuObu@?Cy%&mcNiM7%vcaA8wlYldf)x=;-n!J< zoB*#__On5yK7Wfx+z~8Uee^i%2nvxxD|pv}@&}aAH9Rc9o+%LWJ9ls~&VxkP{<%Er z7aAV-DvkyDMd)wGe11*WFNpfSo8>i%hC|{bwxkqPM_N`gU?e_?w+-co54@i zk{FQ+VksU-^h}RGL(P@(J4m} z&IYM(*{EwUf^0cz$U$S=nqNQDo5Qn~m=|EcoZf_4VYQo$`O)hWMpGE_jr@1WoMr2{ zn5k*!y6Amf2lf|3Hh03{VM?Z(NTCYvT07P67O;v(Q(=jHIc~J z>2*(*14=s<+X3&AB!ute@wbVPFbj5Dh_S3UzE7oQ!1@Q4+CL+-3{~zu-#j}M3dK`p z?YC*XKPY)IsdNzv8>Epax6bAI$Ooj%B_VkZ>jzrsN1N39;^|)CxPsGf~$RKX%o;&_S*tp$8w9nJYcY$k$fKy!>=g6 zZ+0a~?G^z=q@18JEPnJ)6To@r{N|eZ5llnGfpA&#q74$YrwJ4Ui4ie88B- zorIdi7N(KD~!&;LMYw|qS1<&bW*XA&PAIm&jY@Pa~fMKf7e)L zLD)aH(6Zui7l1L^4=Gz*A}!J;MCgiRHDK+*{`(i*nc@JaU$h>`F~KBQWzd+taLs&F zKOroinxfGxT?izS&;|ZLkcw7JQq=AP{}Z0EUEm_=JDrC^xr8JVdx-+kzjB{48H zmsRB{Dsquz=)95D)0xWuLKPMqaM64_?svg z2Xz_)NTj15<3kx($s8K#%}@_C>P(i(1buLrD}IVyerQ2>9Ia? z0NSn}+V#FCTQt9WzFv^p2-51N`eK(k_EPrJ=cXtwZwXH8z88C~rf$ENa|m6Zi|sex zf1vW${Etr3-#*t2LPChVDMF{0P(s1+JnY4y&Tsd89`(0M$q+1<#K92aV+KX=8pNXw zS{0&Fodly`g1iD!#S9j^7X~3($duS!&S^msiUXwQH&Kvy5uJdtyRc9`4-y0& zLW>(xk|J0^j8PUhb?2EAwAMv`E#@=kPbdOdODC>_(gK%3TEWzb)4|j^_TwEkZv)WS z614W~85y?&I0sS7s?h{Tt{0qwvt#c{DbWJ8goQ2sSVOS@YZ|wjY$J2Mh&a`|MG4Bx zf|^AvVU^U&nRW`r5hkFPFQ$bBun~&Z*bC47P3`}T` zLkLiswWx6-6#L26k-0#bT5+6&^N@iu=yZ{n>D9>i0t~7sf4NAv1YE)!>-SUcF0{je zt&>Va3u;&yTC7o18ED={WOEWh4$9oF@Enl+Wg$u007u9IM!=m`$j_-xooB3+1tJK? zKd8rsV(fM^$_+3W78ZkS4#cCO+aJ3Pz~D*Hf8$Yki(!dss5=gg^x8V9!_Vm3)D$vD zzv&)FsEaqE;I@TauaZNGWFpMS4(u%lh3L}F$aW)Y8Akt*0!}km+Tgmgq!?mG(>@nP za0-CHC1%zV?i@m}a0G2oy^~}eSrPT1WDTwfkZQ7RaQ$~Sk4xeVCUZQFFUtp5MSZHy zdHphIhR5%t%^MijWMj+?q!IUwKDd|Fuiq| zKKFjBVD8&@_T5HHG1YmI745Y+Yj)j@di~Ix&7SPFyQ1s))O%KmQmW-SBEa{GR~ppF z_-5E}C^|Kt6Q+zN;0xp+#We2Bh1K`v@`U>_CNgK>2E z1%b+_=UARF4cd0+Z^Qy$<^6NX%^u*evW@{}xb4Xc->{AeK_-J+aFB)uGna_c3 zcY(i*{FR*_9$!-j2j-6Gq(qC1bV3eY8={aA+lZxp?*}7q=Uu&evsLGBRBz{d{utH{ zH_psZIud3)SaU$Ro6PpOYP-F@+O%nO&*dK4gy?r?v+4Te;y*W3C&|D+|r^ zw)brx7GE9>0YA#7-v|u1gne2&`qZktf7thX&+hg=9s+D>y|$kKMyEY9c|w;t4LRB) z_A6ql%a2mgdQ-rWIMk%)(~yY|UmEtUvip`xc{zm89+_leEpB1l&H=#uo&rP)N|0ER ztimkIRoK6`Tb1zCeODN&CbGP!GCKt(f<3q8r6=7wc>id$f5y`ffrNf1Sgdm;*x5aD z4oqW_V0*fFgD9}|)t1f(R4ORx)-XND20F_hgF&N)ZoY6kExVXs9~S$jhaOvO=BD+z zVqKUaKv`ivH*#B*F7HJ@p8Nd8^dLZD=#kU}MsM48W~Do~Jwlil$CD%GH&@NW4mfiG zc&eBG7Jf+IaeVfBHovc|$~<(uH~!n|(ODgpCm%I5ls*?#c8jspIx+tA0f;`#*D_j+ zI(jWUkIwGG)tZ_*< zQqckUrQ9=LB;Vxz+H-B%I-`zZbII&s00_=wO`eo|X*7f5J2>?hwl~AJ`l&BZ)yGHs z**}B3>!{ut5hYvB8}^sLMZNJ9aenLpJdJ5w<)EOLX@~Xr78{~CcRDkEuna^MBdQFJ zvt*3PP&()2^jd_FxyotbwsMM@2|&W0JjI#JbW@9^n7PBRQV;#|P5|2hf7hOpi<3U2 zzcmJn&HxoW3zPNFf@~R$P~GXs6O8gy>tyb{d$N^S@~w(2%^8#Gjz(gJ*KM%F>Xjm8#Xs31{rUD(BX(@gL80fX`d?_(-W08e z$f`#z$ahfOmR{LhXK(Pl!q&x`*|d*bYH2=2E(r<&eMS&8L(5hk<65$%w@XMCKZ94< zKEfkfqI8hCK}yv0LN`zDC(z)?4^EH$X9Yuh%_|W`ltM~vx&orUE#vd7L7QvPDQJ!k zpn1@%(Qk{Ldi!={<9124P*j)hl#KSO>7V(IMn@V|q74GSMh;j!6Hda!ko&an3iA~a zmLlEed9yC64|<}8F2olD!-Z+bOAIrv3Lw>2i@$R~jj8H>?cOYLwxV%B-_g8eu3&e^ zp=}1Kj-G&!ch94*vfU=`XE5;VeMAr@b+r2-qhx~WU6x#)-OpCYj(gxTQ4lly`WT+o z4XIsD56rl6Z(O8c+WbX5Joa0^0}Bz(E01l->&r{1>Nq)Y4ea30XA9~+-&Ekco1QtT z_G+{nbYm*p1Q|=d1AJ#ayUP<#P>C1)F1vlEnD2HqFY$M1tzk|p#Sv%i6@i=k zt0G=t-oIPYHIOKVKr|;*$Z5+kNojf@XUIOK@mo04=Su~QoL6gx1c-M8v026&P2n45 z1EY%oVAo(pV9MsrT4gSHYr11>xLe&EdE(y=Q?B)9%)8l{m2gp}=qEdPc{_brxE)DUB0Pc6z5#6{4@l&loJijM<<-NWf@3TC`yguCCnk(X z>{aqa0x)s>WR$!V<4eDc3=XTl4%KCJ$$w8#S+i29u{@=@#4_zS6K9tW9=RdtyNlzd zzRd}5O?8FMa-#f4GrG$d=8LkwrmXEKhf%u?yqA|jmUZ5bg(ZOnbH+~&zQ0*R%~w}8 zYr`tNT|m3lSD+^`7zDb=twz6 zZZ{ep$};On`Zw27i#uI2!_vTs;teXu9(M$%a-zZ*ni;Jp3>lKmQ%lZd@tG0de}9MH z=@-3yiM~N(nk`O=_fAp~&TSkFZ#OTNo|hcgg1Cf z;a*cS%r%UvR>1(1QBZW&$P@=BugK~-=tsNu)NiI3QDhUKkGqUEbJ|I(7di$}w5G2I zX}VbEXFAxY$G|u6)xxA$3Awb}Vt~ola9&)VvYs~BFgmD_(X+t%qoZV1m*Lo%k)!Z= zqW{>)|H~rvcLq|%MzwgcgQnMKzeWdZbnOWMMdig>&%!US=hk3d&K}1TS3C(l%5;kU zRMhguvXUb{1x@xv5j1JsBPnu6w?|%ZRudh4nQu6ux1azngt`lg1$VCt%%s zdgF~+t*6DA0g^bv6(kb@Zn+YlEZ=u@(kv=#OAdVL@@#H-abQgIxP)r6zNs*S~(V>*qapxno0F&o3|_cx8k0CmZv z#lWwU>W-4sE$2gcz~q+dJ#&jDCa*O(*yq@T3t@G`MviP81H`>nok#gE-4W{^!wLAd zy!%bIhD(oYIU~X^(OHJlfK=RDYrP8#j*Z+Or3WphYbpUqQ1;|H?gtf?I4#_Jhz2TuELQ`fS_--h6elVk7tr- zSeK^CcG-Lff1aMb=|p>Qc8S!IDmGdt1hpE$8U_0Ha+3F{Zby5Zor_NNwCln&#uA<} z?a66Vk(cH)^?IDjoSELVd?l_qJ`BatF*~hnq;^WjiINUFET%TcuzcoGYo>gb6@P`j z97Jqpm^c3b2EGN{FY@PlR3&~h9|ZQa{%RBSHz@NQ^fYuEbo|>a?i<0kd<}VRtn#1D z7grn^6}T>1*QV>I((9`dA5){Q)@lllL=}m?#%e=Ds+l%|f3q%R8pvX9J_FcM%y8GW z`!2#tE{M?n&xN8ps*_~dY8k_KaZpORWpAg5eGK*+dZB_)bHV5gup5w_eStKS-fI%c zuJ|mz_2l|I;xGEFTXoL`!j|0*<#FL^9C7eHoqSTv$iE4nS$Nx)u!HxEKKMcZ{K93} zLl!=fhW{)v&{QzC-$J9i@N~|W>f~1306Y$^#Q_?Mm5Z@` zqzdFvWGa3FhIdptKNYn8?u-~2CEP4@XRc_tmQsMD_FWzsDKUJm5a0c~qOWU+0M1dU9e{nO&=Xk@dx3zM;!GniaE`L1(ruiqrk`WQU+JS~&yql_xU z?xv2WFqR5&*8dQ93I9Q4Rhoya%peRO^8zI)&Z0i2{D*;3A#l`+{6inef+>3`7!}W> zo4jRfwt+PCjK|RE87WgvrfU zrPHKn;Ky5EB*#lv(p&NsGB%>rmV3H*ywR0%ZnbdP*IuI!YX(NmWSE%aPio7_d()D6 zO2aFH>T5$mD%i`%9Dk`(r7S(Bj^8^R6;dAq`JGS;)2F94tefA*s_0c+S9iulj*Zy8Z(PnJOY1vOd8#7v1Pp zahu-yRY~~tRkC#k73$xAoSTE8?swNJ(T)vNT~P`r(l50B>@^=~Fskg`YPoh-%YOu| zMcag9NKC!Z(U6{Wc5NTy5>(2e>F4aV95HLlTM)iR$HMBC3&USTYW2o3^<8hC4)&+j z8K+pfH$sJ1Q zN7ansJ#muYP&6Lj*jm)roVT|If79{pt6K*=kV3@i*os3(^ent-+y(b z=P43yQHtl(EB3+I{p0=h?{j1F92(E(w7)W3UJ*Z{*%%XcIAI+QJjQF zZ~NrUazmeS`hKiGww|UCxW>dHk$9nTDD#o1Oa{>sJZvp(Pz?ROuDJp-bHt+RV<1nB=wM27?!CApwz~&W zyoN@W6hog7@O4~DRINySuSbKlAMhlqYmT=pB^kM4 zg`=$JN%CwxEyzQ;_%^*bc`KJ`xzRakHBK-M4TrNg{byrZ-Km$Hn^o{}mZJKQ=?|9! z4UgxNVpTV@;*?o|jo|fUQ5xH4k{m5A&$?AL#{N-E6Y}cpc{-7pp`M8o?ECoYUYZ9{AzN51&L+Ztr>HNF(%3lm}6FD}3HbKd)6vw9!G5_)M8q zJ{1%IIqJk)D~Wg%$Q(g32{n%F&)`E#Q!J=c)uIGN=(ZidTtoREkN9uf*kAM`@Sz}- zccoOa_`^OGax2;NR>mrQss#-IIFc_GVW4^8e*s-E_y9Gy&WJ-FnYB(^%4$*o&k-aw z5A;%kRaR6|z9_JY6OKLiD(c<|+8OdJtp!pi;*gxarLEZXb*%n{?6!PtdjY84&I8_o z3`Ww+gye_?-ZC<_<77h&(H|-1bah#=&0$Uzr)BpaR+ft_*CCTii2a9$i@!HPS1nct z&tWi)_1-t0tGG1Xp(NF(DcY+=Ws~)r-IHD}*9&Xv`+H9xBX>s~Rp)_gk2=}Ler^$w zF%Hurx{JvQd`g9;$+#)LPhVWg&IHABrzhX(W4RXTSGi`{kHT{YP^X-LG*^s`()N#u zB$48EH236GarUDp3JOoGZAhH`)?&blu2Md|#7nq%L;d|r{Pg?H z#QyFgpE~Z0Mrz*?KwJQg0QD!r3$m18CR#h{Zq#kSZvflRz|4ITxnaHY20pZEH=u{7 ze>To(de-zv`uox#&%ki;?yxoB?svG?tcQC6ttZ%trHWXLZqKFS&V{8TB}G4;ls(U6 z1E(F}qtNX#N*E^miBPE~7DJps%8F-_n9w;^us0J{s&e*CRotm7IT9`6FYT569wX6m zc9crD=XoHfv_pf2w6*GhlF}4|!u^S*<2upFyQJBsV%$hzKnXf_@rl=xQlHk`6b@IV zHsZPr7IqqWG{KEem*9sO!Y6B64!RKjgdor4;Rz1x{ufGhZ?fG*tyu+Cq)z4SN`;qq z*3`TW@)Tu$@9#GMs50V1Gk;R!D@wxqr_{yuXGA3%pLvUUM%bf+DfwWl7I(n*%gc~u38$VoX3bC$ z4p6KgX)ta=H-G|})#YkF&}HY(&&T8b$!$ARh9GPis<62lR&c2U9kkQp1()wHZiK)$ z!j-WeC#A|dXT&37;2Tiv!}9B0(%C1T&Z089A##D zmQ-`pP;>xgU&dY3G)YEnRDuf4Fl&=+uY1u4a)>M@-;3p+9G5qsz&iyPJ zOYj_9NY0@UseTzGn3(4*NP)dfHhr?}n)KFT)u={V#Xv@E>U?|+^_s}9!@yFGah)Ea zO}+Z$1k-{5Y_#n4r?eXL^Dvnb=9Co;@s@|h{<4ov_bLb3&|5YU^t)j;cA z4~)R^@Pf3IY>ohNlPH#9(xp#_8!uixC!lY`RcBJE@+DES; zUjxsFeC@aOb}XAOwD)mI=0zAamRQEvuKjE7r`3&d1QV;-Ob!2qiM2($JwYtAaUuGA z_$pe}iMlj(nRJX2k4hG_Xm1S$3HKZYNSOCoPl}vk)SoWP=kNhVei87HcJC$5dGUKh z)D@+y8ZNYh)bMY|W_Li>2h~KGT0m${_Qydt;!mtTiyMiUU=n;+g8xO{9>(tN;98!s zp@D1{UwU?&sf@4s7?90#-0eRZN%C&VI~k<<^>4ui?U;&vhBm7Zf$ytCMwz3&@>cD& zUz!6SN(bV!m;F!2dH5OGvgOBv^Fqps+XVyA3vT}vV(!c(rLt?QXy(q$2M2hZcg(|e zG*SYjt6j-cLuWzOUop;OUihSe(SuYLtK-#Tsg(q&s1()7!31$hGd1WJFE7E)JC-T%Yq3b5t87(Zu-qm8#EQp~@L#vK2k|2F)#4Dt8>{4{CC zB$AuAQOnYKbT~&39{guG=-zXBi(8EO^K$JFKKXi^Jnz@A^kWg8opA8FN6s=gNRQ+H zbNe)RzJ~e21x41aKPfJwvOdbeF3F!&7*<&C0~k%YYzi8b_U#ZuEVEU@+_cn>h5Rkz zs8@4-Kss_ieP?j-YTVKIH4|3inK4j{i4N}_YwaSHlv>C6XFL^qQ8+BObVG96VDx;F z4N+e0G#YS_;JFcnEv~t_`2HKalWD1&d)X}qjY7K-dJNsxxseu|-3w#VYkNNs&}&ID zg^!&cb+I7((X%W7ZGyPQo+@A>^e`1-It_Rp!;*q zhKQL!8B7-X_0*KrT`&HA22TAJ2cgTW#%JbJeveLOCNn1rPf@}$1Z!3mRkgn;(WFV$ z9K?+sL*66|&Or{fL7(4A$FFU=DE!-C7hahI3SN`y#)a}Z_Sz%t`WP+VAjo-8`A^+L z4g!P3!Co`-V3@|zAM696+{%V{Mw@xhzP|hk;s;Tfl1}!woRVX$@sD?d{io3uSMqEp zz-|C%A2Khp(Spj;pc2?XfdPvvzAurXhcr^+3gNH(q`$QFnzhM6v7WhDgcF_xV^BJG z$+;lB+03!y#6I(WR(AY0&Q{Zu zLam6~R$61h1(?xiq2Nc^$HZ8({QbPVvw_N(8(o-e-b6L9#x ze;ikasSQDpMrnHuQ<02z3QrpU%4_kR&iO>|2?-LGrIxP)1;xGl%%}dkG1KZBX9&x~ zP_gQDkX>0+9&e+s(POOWM@E9s5d#jzP2a2houBq=J61?AkW30&sIHm`Je-VDW)9RL z@ScFG7 zj#5tEIAip5tm%S$BQTY$AyIyH&xry}Vo~xHud;a2ztHGT1I_qYvCbO!R9q?X3%YnE zJXvOT=;cXH3{$LOrANMz!%7*b+Cc@qUUlc;L_#=b-x(NOZ7P~Wo|nMm8NA$=ZFLTQ z*^PEnkF)}_=2qMNVD_bFI&4@th6>Z(au*78mHZIwLRB~|0(gXaELYRW8vX!yG{-H? zzqy|e?J$Ixu(OS3CNN}CfXFr9a|=mI&QW0JT-*+8^|+upV~s8>aj!;^Y{rVa>I&X$ z&-enUUXhQB8Lh(7nK(Sa>zdX;!J&K!zV)A;RDkLX0DRskiwW1#j&1V3199Xruejd?Q%j>^HEL1kVroW37c?SRkP^O^2%D|ctF zN{BUo{FBsUj(p}>YQB;>Wt7q>%aCAQe>|q+etwNO1B_S1h=40?$)wo}&1=3^% zdLv+yMbaOS5L%HyvKk9Si+(d>c-)UT;vjcXQl8|$9X~cpELBuVy_ajL{smbBXF!ja zW=dDh+*XrH9>7qFcJaL*SdcRU+{BSJIFXx|1vs za0^gnRrg#RM`W-`sU$m{I_KdTv)s>(R(>hotSoa?pp{>32Q+w_1GxuwsL66Mrmk7r zXt~f!p^B`4elE1iuBVGirQ=F4x@)McH3fKntDx~yRvy^|Pin2sBY)3I$PQRD@jOHS zv-@?$Hs7P%odkFDRmuLGX1o?;AFhd<1lqGFQ!x*mUN%LT8DjFV z%Bbsc4F&xfd<&k3l+O99chVqN8-ruW_NFz7{X6uFdyEF}mlco#NyDxtO))^|6SM#p z926p_xwqxQ{aDm%wUB^Jz&t;R?1HTK7&`#4PMZ+F%#SiEb)bhH<{8Z=P~;PRda_86 zqvB?YT`gt2xD-BfzylT{u0>l9Flzm~c<7J1wXoZYE#W6+z)Ky+#vUZn2EuVRf2ydoKT+NKB6_Es6CPAE1Aj3ytwsRtAqU0xEWO+D0 zrgRv>J9)eLyP4Tq(b;jTLyPI5%o#b}!i*1zKB@i&79Z70j_j-_6Ahignr%P2a$aW} zIK`nx&w`mFXOAe`^CNppcWB4PnV<#TLoyX%?8R6PReO!?*<{16w&7DFXvpkro^5&p z+lJ9tvQgol`I*v|LYu&F*2v)@lrxr}(2_cEVj*qd z>TuTblrfD2O~~6k=%r?-UUdS?CG|FcCDNR@CI$sYq&VoB#5XVdx9-|^ zcL@2sHitU!vr*FM9H~uA|MZ~d60`=8!`i0w{us$rzP4=W(`>JNCqANRM;U~*+f_G8 zmi_xe%1x#^l*4S$;23^Vw|F_i@8|rsqvo073i{R>{Ayw|Vw4B7SO-6B#~BGTKmCli z*bJZ?1Eu!WaeS-vZO5Gyn9Yak3e&cSI#T?x%WiYfqTFg5X`1NIt^VV%&~x9%iT0Q; z)7Ak*Djqjdg^j#vUET&YkcdM;J@}3*px@(5GX`s~eB_}Gk32puTq&VL=R0utu^;|lv1fh9E&0{+eDe^VnW_*)OFGjCJjhGiUd zUzNG|H4TjIR(YhI>&!~d+D758ATosAG?FgyhN0e!#x&RmZ6LjYV|Z=zSl4A<{lIXb z47TBC__Vs4FLPbEsXbrjb6;os!y{z?*tF4w> zu9s{HW2esxSgmvlfG)ZcJ#PJCnY$p|jf*Y=ZvzyIA&A%?v56nHQCoznRu0fpXT}Fi z(8c)R1?=ADpP*wT8Vcz3_Sm~yb5s0b)Ot6Wu)``0*M;zdK0DQ;Lvu}yEYq^rtkdO^ zF)sMpOgzM#U2>vKBr*^M8}-y!V(`NN{Nps&IRcXc;llK~cHQW*jK_;a+FMWIv)|El zyU`Jv%{AaHLk{xLJaXC33`vgeo_?me0R@*h-|6CIzAVA;n^EaGZBKcv;Fml4^UK3O z8j<+Y`k!(y8b)t|i9TcUpZOirL(9dc&$O%jp=IMm&9B0Nc^F8OTWKrVUvf7AM4B{a zm`E#@NYTJ})Z`u3JACh}`WxafI@v~2045i0y>5P+?Wx*RLd>;ZXZViHj~|&LVKJ>Y z^90=dq1djhO>`mU!$CUl7k@v|mjG4_-t?9DW!UT9SE&BiseadO-foz{k138|j65gS zZtDTaQh5lrU>xJrf$jSkBC(*Z&=(Ss%@+nrE#t`E_br(&>i1Et@|*J`AwGSH_K8=b zG=%WhGsyjcgV=jt3IzbBf)l}RKTqfHY0iA7*h45n$-#M-!#&?#8Vw4ZXbNQrXhVG% zD_mqq*;MN5cud0Uu*Ww$XYZU!@!ecoAA(i~a>z@PSVJWG#0W7r6C}sn_BDRrEfVDS zms`8Y`{%2n%B=j5|0Kd6#kajac(2^CiOQ$Xy`jBu{a2OI4xjHA*w1%~eE1_)OX)8V zt7ZeJcb`y&di8wI=Fxa{C)Q*!AxWwu<{pp1o?p3CQ-oyEUCWZW_Ws32Ws1|Hleh>= z<#H&g$l;I^G>Rr)foS3kpyXiiMXQ-G#JZNnyq(zVKZ#!6OtX%OjM9AynC22i;hG;U z{frfkFUmg+2--9{KxVnQO%snyo{Cz6(EYXpbB&3&HMJj(H_ceFe^{I+FDTDZZ`M~Y zH*PylrlA?tLGeKmdFo1y8rl_W4T7i5#^6*ot=4xnhSDTHm&(N!7lFO=18NY`+c>lG zSgmANvY{+7>oq?w&e(RM<}S;N=>^cAlz-uX{E9U3szym~pAE@CuS20NOdB(`eK!NE zw}B|7#Q=}$C+VJ?Ey~tO>gXPOCN8oRvLu&tV3-@`2<7cYW-_(>eeT9CX)Zc^IzcXW zpJO|#9-)q;knA(~R20B!+*O|)QpYOaMlN93$UjoS>uxIIqJCDcV))x7t{r;gK06YQ z?23@#8_f^z;}7Tp6H~vf)mNkKUlvXIBN=pgIVp%Xte-TV5p+%EmE6V5jC9MNrJy8X zEmBfYcG|hX)a4>o`l3|!qQpB+jdM#EGsu$h2?V!iu%aXaY!XjjkZ$)x%K8m*Lixyx zk6FRQ^*#F9gS0M4l<}*q0Z)5!-Ha_S4L9aFy7Z2*{HH0UPysThX4TjaYTf8$w(TLL za4TKI^GijR&7!qG(I|ocq%C*K1{g2B(k-8!_URBaFRv+LLs(t0M|jYAGfgRBp(M;p zpWlqvj2X#PlEYUw;z24~gHBPZrk5QU7W%`9Oj-?QL$!qRoaIe9s;*0v1bMqzYuV}2eguW8b zRJmzo2KZCN^FIW-gu?MW0r!9l$qRK~A*Qz*akAPJqbQ0>n*D=-!Rn+iob8(naWeCQ zY+SN-A@93aDe&N1NTa{Atigt8MjNcrPLg&8eWD7NI*Xbu{ierX%4sCTC?uc+9j zLd!5>)Kb&fLd5bYuaKwm(bMY`&lOeAJ_rFxtQQ)#RXT=9!m(49Kyiw*iOJQ@*P^is zrBeq+Pi9Y9544lZ%MC>jDpsOfctM$V-^4?qKF4H$;1^%&4@Y=*h~77B$;Ov7S$QAC!R= zbEq8&b#}tj1~80S8$*{-HZ1Tsk|M6-Q@j!fBqTSo!a`1oLuL-V^ghj1|cgpHg-8 zA+sp9Tj+TYAF3FT0pno^_;9`|4+eX0>97>Us&IL0uBJOlfrA6RaRi!qy5%g{=@`XZXe zTjYDh_Q-NEA?gUf4tzL*JCLyZm5KD1b5gv8Er7N<_ZZX(R7u+z#9)7sqA*lum_pH3 zMkKTp3)9J}Ym=T_=>8xxIV2F>XJ!n1M} z4OK%dQ|aMYTQPbB$}PDVixJYMsbXC_%b^5}rN-y>u9L$)hT zv14z#{n-|VYgG==vjnM?nODAOL#v028K@;P5HTRjHWpZIySOM9q-%wtmKDwffopIcOVXMA~&Q?p=~^Ajy= z>^y&il@Kdf#jKyrAAyw(A^2^ zCsmYb86EuUOPY45=2RH~9Xs&9<@Vh$4)E1*+$+p~9Ddz6+^%8 z;`JE|E;kb71zC}Uy_|VQ9DbEs@XuSBu|6bHdeLwnmV#=Eb7~R<+Lm74!%vZ$WW}c0MpV{*9*Vkw5ZWf*# z`T6z?dk2sXmvRe!mz7HVU8S7lk3X4Bor~ZbqjuzEt>51H-gB8;)m-@ehT#*upN4h9 zPzm2_$0IAaYWNU(Q>z|>55eGffYgO0-i0PA(pnC)Wwy%A%=*igFF7)IIY;6eRpD3d z!N>T`hoMD9*TIrR8DB^(SC7UCf8*AzWwpKx9LM&LiXZ3g_L6lu5!*-sA5(0t8&_L0 zRZ;rimfK`&lHi2Spx}ELVhWymggElChjL=GO3+ycDI1xY>luP!SF<}R+~aMC-ZMA# z`O{-FEx=(+&kzSqtUeYT^yZd9cKW$f?S-s+25J=eUcQW`DD}$yb;(l8w;?_z^&xEX zUf(AyldvTe3U@y%6^^LPprm?Dx9!BuJ|7Q8rD&it==9@-0q*qa*MC%5dU@i9{{JM> z|H~i^!~Y7>T($pSI>i@oNw}w$KoL5y4A_`$;tr_h($EZ9Q~LVRt1vHxa_g1nvnT?L zW#we6c_b1%yyW)&Db5a_^0|(`bBT`V{S-$KvM5z>`_z z;;=*17(WXX)XH)exEX(Wxwj4`%~O)ziG3yo-*EIgXKh(c1C&A&RGg4u&SXPP3GYt5 z4l)A7&?{YV&hIrJoQ7B9W|9oz1Fo?5!7prO&55%M@0= z0fpT-{9)1*)k4t~QOn$ZAaZ0U^9>*}$P( zk-2qS47>%=aztY3UR*Af9>_`9rrrqX1l?_Tzyh(5vvY%*dby;ks;tZX0Hm1}v&OUd zq51+@TtmaHZ8wXLwrYPN1Yun8U~_0kb&5TW3}5 ztR38^q&09jcz1X}_)**}0wHoH7neJ@itA>y9V=Te>F*E}tAI{>U)d}1|FR(YQeQRz zhI=J|amtue+WlzX9C+T3A{ji;CFByTkw=Dz^_Orw{jFQ-h+bwXQ*aJ}XB+KRL)^H~ zgQAUyqX*Uko?R^joWGHp%D$^xHOR}e9{QUiU-5M!j2$Gb=t;LoVy>c^ts`qUF%z%9 z1#sB3Rv3-pqR~I>zK_ZiOFI&|*S5#bKcUWDjaw99iAk+{K@NtQ2p-<-3c~})BiKI{ z?3_a&uXX(}s(XjsgDj*I-%d21eu2yrCx!yRx>@P4Uwq`Hq$ZU#FOhRPB6~TfAn0Er z{Rw#`Nx9@l@_ig*5znDoO7zZKd9~?Pc^XjcDR)x}CbMs?o^8A}Xzb%BDx!_qA0YV z>X$-bRT1J^ARd4E;NulWkmOs3bR^c-289OB<1UPf^#^$P)yKn|5HDaA{u%N1s6Nx_ zvErovq-Y%YP{p|dJ+(7PcNHeeOD^S3DveVMXoCmq#6#5CO7oH9J_jRXUi3Brc?6F5 z*rBC}-sHJsEupRo7GppOc#rM$@0Cqg&4bHWL`%1?rREek*&o@B*JDEC)@5osfza!@ zi&Bi{lXvLT8_gau>&5hH!!f%BNylOJ^CK)ODQn&R$OeLDp;`I|cz=_R0n&*GQezw1 za%Ex9L>pE}iA%lD`bG=j`ZO9$dni6q2*xD^X(p7+e*=jEJD%9Y)#F+_&!P#W3#8Cb zFD6r|)J0hsGtX}CIW|+0A#j2O+Bk2QdN6FPSXe>E3ajR4fe;3{5upPRMX@heUvdm2 z&lDJVXRGj`GCj93At|R|sone+ggJr3z8!~+B2i8yW}1N;w0_kk&yl!Ypan6?cx^yk zjEvS?Av}{@ZbUxFh1`fu8~Xt_W)1#ZYJ*R`vo@XxF>#?OE)Uw2COmc=3ZGSd=o4f? zabWb5AForLNtGLVl~k*H&n%G>s#c=6Yfcub^@XZ$_-jq*K5#W1Qs233Q*t`yC+o?J zc(hJS<}CM_{a(}`wAtYZ9rlG`fE|v7WCk*B6pBc7@Pm`^w;Q%e`Sk$&GS4?qU9E=` z?~#q7siA6pAKP|{F;MTtel?;dXj4_7m_tx3+lRQcidJ){E0jR$n+OO`c$tob7a$FV z`JUB34CfVl4eDQ-Wf-rEQHS+&Ck0)wlUha()z==~xlm=b1H3J{w61K(j6JbKDoLCx zqm%}jse%LHws@^^*J(l5i+jCnPbxyS|0yNr2WI>mO4P z+_?+fsEEPrcR(UNqF#EYUO8ZI-aLZn>WV!~10Z=?!$qM5hmR-_JEUII`-%T<*8;$a zebZu+`gZeaA-6i?W1~-&WqcZH-g|8_+`QIcFQzwI6yLspGf*-u_vV<3GGxiCW=lc4 zBf#^>BV@sM(B}vW;Ha#;o^=&k;R2*t+4DME$yFBE-)#wDr$=v13vs+FBXK$8JnhEn zBF+CzBW>;6JY()0sS7a^ofg||63HU?D}daw@d>VBiv4DOj3?*EP=Kt!-8rNCV0)G; zSf>+a@;LrD*?{w$iEh+A((pvgwXI);i~TCo?{Dw9I1gcm7t^uJ(5hVUbEp1B%Yt=K zNs4QUZ--DBJ8D$4)Aluw110c-l-0Pz={2H_>irq3kev7iZ{WwXh1UE>l!dxiGbFDk z4tthO!aiHXkRCdjOWF~uYl<}gSeb2H!MGLirfu)az6Vk+ctYStKR7XKNmKl;ijp=L zuU1HomG4r!<9z8{FirYhO*x-~8%2>WzuoVx^dA`sAeNx+K|<_XQfuy z>2oBjXY?pVO!RP%$T?b;x$>-AvD=4~=>sObNy4>l(?m4JzKsCcDVt|Cc5bX6J?mZu zufpmU#(S{e{k_YTa6$M;<+9=fnXi@5e#mz0vAH>u>GJ5vmf9Io#j5k{mzXrjMUz z`Cm{5x*Xg8AUQezOGGd;=l`4C{x=;_``C)O^Gf*yWa^Gg2?VYMA_3%__Hq?TXDxkE z`fuT^*ViMXAQXLlr2}LD{zI_iecEXHmz` z8{hZM0|&$`mYcELZb&p*#(^7RJUC(K^P!G?CL|No?=VpQexf9O7=!=w6?*IN=lF!N zd;3c|O#3b+hhAx%VUA5-kK$wt z1ZgxRP)f|CzglX*(PYV~(RpFy=g|BO)HnVbudZvNa1$hJ@`}l$boqqSW@!SRe{-Ng zQ5qctO{z)J^mt;pKQ7Wl(o`%37QrU26$pC*cvMQc$S8ndhx2*U_O$(A<>lKue0YfChQRD~v%V7H+X0 zE3Y?rJ~?)OpJ8hVAQ29ZtoOPq4taa%!emp)Vr>m5RjAHt*#`srkS_Y~!7+w6-y&(SH_?e`xG9#?<5SxC5 zBvZ|_J>$;>3tiMKl_`dP`T>riiIDIH;<|SsOL}7bX`RRXG+)FM(TGWr`iQV5 z-x0*J#D`+=&Lk9BofKJKn$HzSqBd_&jA#=GN(@yX%V0Z|0w7LeD8Hlkmst*}QTT$M z7zcGkQyg#h$3K(fZ=Qvr{40i4sI(#h(%sICA1to`DE1NUbmuMZ0O*N!?RsfG=XKC$ zVJ$0H4;7N)Is6FqcOW+2I2TfUbXV4*;KL&Xm`?V|9sEYiPt1BNw!y8_Ip~a%=oEe7 zl6&i5u*l7M%<>PCchf*s@z3*1ipJ?^*`oe*JDDczq(}h5GK;)lP*DQyZDsj2%E~>g zLtVE(XUvOyzMnU#tidluT{Tfq0(d za9Q&bn+f!~WoAXTV!e1vkE11QT&Y`+{dp|=8pTzj85L@-$Uy3Y3wJav&Y*uodb#MS zedgwRmi)pg>tTbgLECzhF5zTKPx9)uzPRzE!u9u}EqsuXbZQ(8QKA-T&aJA%8Sf~E zKDBo4a`9+cQU{%rieFe);IEi$mL!?sjPVt#lTS)5e{2xk1?-%;%Oe}AO{e*1Wwu?^ zVC0XA0!f9S1~yAF_%aH%rV!7%ZREzvnz<1^<$INnvARdM5-Xju^~dwZ3n@aI_e)X$ zZL7ly;k5N;wRCbKwG#5fi=u^phbe(N<1Vn=BPJbsB_08f6mv18yrzOux0)CK^;(4@ zTHs1-OuwLgL^+v|!0!oEDb1y9Vj9U>^O_Ew?B0eW2`V2DdtAln%N& zBT48P|C;h1LQ)-AS1XIVFuiWTKMV|UH-mwxe@i|n;xCNEPVJknBKVzivN~y>dyrtM zPNh5TgPH!pEE zfqWUqz81}MSFETEZjvYz)-%{A{vi6Spw^0! zT*iJ_OCCQ5)hOH5VZw@a$D_^@)YVAe9iT9gexc2g=9v{^?`=bW zi9af4b+}81p8`OVSGf=gagGNTAW?r4!D~aY9esAq+1PqFtpGGS)%{II?YpgADXtkj zA&f-J?EDELB^hW8nF)M_HfrVbf1Z0<2$dq5$#GRYzsjnAn!|uFY^t#}?M`Nqaoymtd}&UvXM%W)l>ImGDh0orpk0Soqv` zpOsbT!cApFjEAOfvC^7xGhhewcIm6TZViJPmX^fbM`LBe~kIny)dF~%o*8yKRbBseCb(B!avOAlEC0nwU>4(Uhd32zV%)I|Gx3qHU z=+s*q8vDeOEG2ou-ABU?UI_I~km3{r)7^B3% z%<1_8ZO6+YaMKWJpe0|+A;1UbD}Ta|TJNnw)-yG&4{Ym1XPD4@DbgDA501gk6T-c3 zq0A7WIu<<>f4{fE&!mW3>SurDHq7?R(3fEEjc*?&Z{E28NJ1ZeW+k-EUYJ_mD zyO0f!rT?mTuoZ!ba?C9U-+aVDad|%O@@BFojM9!PJablRQ-bT1m1&2Vcc~;wS>`)@yEnXKPV##4&1o<;_5K@UP|8TX?x>_ z#rwzEerEzNN4lZ$Ysg=Qrku)7V*&-IzLPS&4VR0fk+Az@z0!4wjW>Fk{-c(cq`jKY z2M<21>o|J*Nhjpxa@%PwW$dI3yA17Nl2BR$*OK?jzw+^QyQo?A5io8UfPT?&udT4y zkU6v=417xOr%9MMc1nX+ry7Z`IpM86#M`?r%<32I=8q5617|7_R`)VE%k%SU-#0$h zwR_HgQogMJT_S?z{|kTrYc19?x555Xz9*p7XIzN@Ls3Ao{x=J`y7M7EJd3hT5^O%- z7ebQ7V$8kSNdW((Z|gClsA9J_iA$+IIph7Eyo{Qh>&w*p`C}TxowED4+2hY@+<6%O zGzrJ!R@Avsj@%%_@HGhua#Qv{7%-O;-IC}XGx}DE8{M#I`V+5r?+^w&y&vQKA(kE& z+<^RxW1^Ip(B(17!jOYVh&)yNLyAf!c`Xr7NAN0np^NMhHLeWt+^fS~(-%#e3Synjs=9;c#}@4ovM`OEU!RMvF#f8Qd!ziAiH zrZ8e6@`C@!X^8Yj&w;i=u`rtrd6Q{IJPb(d!mM0EX?(=#PLLbS9b<(7Ang(Jzua{s#lT{`B}^FvlgB=lU>kQXCgaY&tneUT^7a1_8g*>ew;>*cVAQ%)0kWp>^t}>O8(>+A}|X z`N5n?c~2+EX*>M~>3DWTrSN71su@2C9VKZPiZE%^C`5w*qh%hxd3EobW9(RS<%i+VwtDPTAMF?(;m z5?md&^GTeeIkVAypfhb%F(a4{D9I1&IfT^vA{?i`uYO6C3yq{AUBa%k zHf{r9yA`DC5zf?#Gi~T%fbP4gGh>yn6v=6pbqK(t`=-{o*ueBox`e(rvL}_$vHB+v zK&Gq`bcA_H9yf5LGGgn6@owe#mzzsN5OWJyE1$W6}+CqD%qDf0?L5Ikx5D4fe zchb!Z=dh$hDIsD`@7Zx0t8W1d<6wr@G)xMl!WB!05MC$Fo;mp32W_PKU&*)U^Y&!e z$FRKQDl#m|FrSL~fS;0)>u2m@Q~|Z7QQE#I8=q6HHs@Zsu>Al;2rU1-*g`w9QJLYkb=)@vvThgxDGgZN$XpWf$ z8MAP~LL1eDX3JJ4t|{=1I3YaGU5Ig*%>HHhVZLT2BX*lnI(XdsSA@`AqqNwXEoN9c zV1mS(%{B&QB`G~*d6~hJ`J2rkqg}cmNn`^M`i^TBc(Qx@@amSZlLogQ=9d1kql#+2 z*_?BtO>91Ec8c@UGsbE1L5{CB9w}alVL+w`YcQ6vC#RqCaGi%cyFaDCY*TrqA>)(Z z!%wP1gE=n($KVW`OJ#$)^kky|Nr$QC2%45^8n($&qdReTzK9AY6>k|aY={ii@UC7W z)RKOPXg%-&qN^rmj?Br$hm}nSl5Bit>YMQRqi19-^cvyP3LEO13&yX8hL`RU*Nt>X z{P&He69GcC7Z|-~u6LkZqpid2PEIlj%5x1mX@Hy3M$bA_mw|=`N!v*(y@dR;**!mJ zv%307g)_q~0Pyx>;*|U*F@F<|`{V&!I(^}5A_cjS9Q0=_bP*Z_YgBA^uaWptnUS?( zcT@p*Kwjy|ceKLWEyg!}1wK=x&N&Y}r{KHQ>9np*Jr>Wteb>}4yXT5~X)U#GzQE{B zFbnVS22D`GGrrdj1wuS#LlOX##J6o(MohJ?HKX6Z{AnBXp{&+eW6B-E`1J^nyQ^U{ z3kuFLy4LN89B(3Si~Fn_T5fuE#yHl2Vcx@5IiUD>zjo%^vaP`Y=ZuXH-a)FX0oX9^ zBgP~EcS2dsL8%`nNhcbWAZIGgw0W4ogbEZ85 z-#=2>BRXBb<}ni7Wk(%IsQW5_3TN6oE@_;8g=?|}aodA;;m{gY%^9rqB}wAh;nK{q zgx)I$9G%8>!mmBwE*9#8bizj7JC?G+qbm3Jfb&xLwO8GgKsO6GTNDVX0)Tr728#?C zUYM;ic`ybuMhoouFY-%EBIUkV+duP_-f-8YryR{C)Xap&Nw3dcZT$(v z8U$It-ECfZy8hX-f2t^-+rDWoF0Ks}gQ;HTzPT7QHX{ zHN;U@=f|{ElNM5%*p0gNCzURxHJk^G_U~t zoNvl4f`~+e#e0VGYLF++9Z%ki#g9#&=(d3NVLB@D^=hH6KQlF6zwh+F;I~JnTK`+f zvoZX47Bq^RtJ0fcXmg7gfuF<_L=2y?^A5bMSs|g2QL`u3$+1HJ&9W6h&yx zkw?IXBSzwvL^+mJ$p%O7Cs+60#?nlq$USOiQs{*bYI`tiAPW!-KO*6Pfc6?&OpL!{ ziPY|nR0)AsBW%6^-j6^2iF z?L#B$S)BA67fyBf`Z+C(HryEh`i?tpJ5FQ&ik4!$)pdAUv7Ruii;rluh@vk%Z@UZI zQ_?6x1__-IcP)yY7u=~~vOevx$}~@^G3mqcl+j%P#)j2vg0u1kUEOL*Cem{LDdqsR z)qZzqIhejOVSHuUVs}Jie)@Pmy}4}LqcYH{T2UvDhNVzlVqzENuuWF}EV%?!Zb_$~UGVv%tG`E z$KG}|3TTu9Mg}@)fc6VuvZ_g9epJ|P+Ic(J#|yALraJv9{Nd4$lb7eGIA*}b^XgnZ zLaZ8ok+nHCuQW42Q6q3TpL(dKY@5EXD|(OKU>mkJ&)#Tgltz~Po@N;L*N)W*5yM8l zQDa)=xZfqLski_^r95W*soB18GP!m~$&yo|TZK{v_KWIPO_+{P=75=zbj0Z(1c!+B zfE5fo^#l8y#ltqPcs`hTOg?U4k&B?cQlR)L7xFF&MJDKy@KQP(PshNmm9*L9Ob|76 z4nl_V^pgrEf~L?^-&Q+=2yJ4uVIy`2{iZ0YrZnAK<>kDdV0f3NQhU%@r(l3>{0?go zdgIL_FfI53L^A$eT+;KV{v>usmlDU3x_~sXJW!m;%z}xZ+)f+|k1Vz_@ItkFBj{bAT2*&Xp zb+?6C|9SiMy0$sLvhQ=;pmZP(>H z<6P?}KUu!Ro%S?AqUO0Z_}Rk48Z`w@#y?lrgmJ5zey302MSgTsS)l`m%XXJ+0tiSK zn$kRs-b3fktY-@RUEbjf!8LhS8GsF?0=gLXo0>ujk@=X%fzXgY6Q@BD{Grtq=Cy^S zg2eYul)CmoYX!c$3U4LUb0_Q3Y`fWtY5Wv>+|CL{T7_i@AlG(x-hX>&NtBZI4XUkU zxU36JKjSL%02%WW(x}8@sTj_kj)|%d*%pP+k^4>SR52&D9p~xtqcl3=JIFF*vYK?= z%m(|PD?Eukxmp?fGE@QFX?3IXN+$g>{6+3!L-!s^!RqH;Q5B55H20pcz*7OTfUNo4 zXsrHzq*bx7U+--ou@Jmfua&7rJ;pO z=()?6JlnRzTj_a=X7JiI(NLF)Eqo6weB60?gmcJaPc{(D0xEOcg?6Du%-=N@=Z3C| zt$3T_?T5G?pk9M)MGbeaeoOsY8?{!+Vw1)%`ZX&0xn+X+0W}wp@fx<0rWpqpF||Qo zpKEKn$C`u%FRk~jM#692z%qPt?eH0#J-?8_91!W}sr>oMrlR&)zf4+UX zy?U7K{JxlR#r0NU0DawCHf#%RBHs$A#CZ1r4a!^NQjZMpgZybBA#G5aKjuZaJyY$x zcDh9*Q9>slg#YM_=aGX@0vS>fxT@dfDg4R4&L6=!Q{;o6ZtC_qM?2lU2&Qyd!zp3hdmDI81opa;{A@|8V1wnl&(!<-56k zk%BLR^OIPrbKBfAnI;!Hz+Bn45Po6$)7QUK4!M?fUk_Q-hkOOA_(yJ+Y|aiP!Jla! zXTAt$$4XgG7ra&eq6)H&!Ls@`dWU}{?Vx+HvWHFv&C^wPtp;VDPcpNhM=4U$Ft7cy zxY=OiEJ0{@qjmqw4Pfp;S--90_gG!tLiHx${T!D9%}XX&TCyMmq4S(H-b5=jl?&9S zx+DSZ4-~4Z*{+`aaM&~>Y)C?AWUB_JPRCn?f5-N&fV@hM|8;MFZGIMdo&)M7X85a| zhpltzO_^*q2iw&GlZr~~DwJ&LR-?_%#T+yC5>59Cc?wZI^h@&8F;7C&*HZ?4?vv)hJT%3-ToscSut@6`GTVrn@{q|-smgEqr zty$H%yl}F?L^wOMY>9quZKh})r24u}fR-_=5HotH#QC>my^DF-TghBXl1e7vnI=t- zrMPeMTi$P}vc+_?D3w9N1(#~)b^~M&HP$OX1+V4+X4ngR2@6Z#9L}!a`{*yg0AU6H zf0AJWl&r*O`_oXnm1VV3bZpAyrw?}u1f1RB0_w7pZo~{Qu z9)nvqK?jF^;N1Ki#3#^{3~{{uy&PTgDdxSCG z7Ta`Tk1ubb_gBV_{X~T`6<)vFL@7jz_s>85(){T9@Gh~@0EmK{V2bTVaT->PL#(Je z9P!;$-G18^v!1OArW=z0M3)@qs?o_{g^bweYK;B8 z0WnWA$#v%8s$T!1^{~8Ne-eQfu+*_vM}mEzC(*7s5ns2|E;=!<8F>$CHr%bonKOi# zX}`J3U+kO>t_iqMDSoN6E0>cxi6|K_kjNcwnc!?-zbCx!tZmvGE&*=(9%g2ZRkg~u zNs(c)f|FUsdVoJtI2JbM&5f^|NVe*U967_Jom zP32YoB-7M{shEhq+f|g1^UQ)LF-Ma|@`HignzPrON?0TC5U8=7X`_-2s?gG!D%hGJ zxuW<&5=dqRC4&N17$@NxRoXC)@oYSiQ6OSrES!*m9~w%i4V?(L5Xn}LhRHUv@(#0B zh(wPB0X~1b&Yeljol!h+XVDCvusd&?9AyFbx7(UM<${yCTn5D3(CaL|M}C78F>tOU zdG$*>9m*q$brwmY)s1M8h6h@bN5h*fYf0qLTyAZ}T75neFC+uQv=9a;#UEhP;qsVeZL5Gp3G%nGsrB)GzI3g0LWzv6*<8nM$XsJ}hVv7B$z_u5jg5 z@?8x`Y`6NBjQ00&tgBLoHoNp7S`+WQ5gJOm%0CVQFK`U%(>~vh2R_zm2C^2U1V^pc z#U(BWtBg0g+3tpi0Q#1vW?*C%>HE5Y01ybG7QSbp^Y+UNNfplS@*VIpg_Q z?sH8*;c6!+L72PyaMhSmwBOj(&ZkEhD5++(6nkte`mUe{Z+yZgF~;riIMI0 zws{`2$hMb3TOiAK;aF|iv`w-4k+K+RP+kkcZ&{Q#(&HPb8>cFJqq_<(V#Q5x0PzOq z#O3VdD8IW069%u)QP`Aa_40-_KHX*lnxm z?Kwo4Ic}kXNz~-MRRigBjF9>8O=g}!KEiTsasUa&!xudwVB~e-vNY+rojI-TIgdT$ z6hrDgdR5pD+E_Cn!80R`9R2TNIg~hUAV6P_N)!ef zJS)6pPZe2GMXyLUh<$Nc6s>$>wtA$m zOn;;&)De?J(%)3EY2|zvfjF*o zd_sEsTR)&tE$5=;UlZnp_{dHd6NRn5s*sB~HuZ1QFW|Yv{2D171#QKRNK0^ct6jrr z&*o_wlsK`W2&2UZ)W_^+M|2m~PhV))Q*Z0|rRCtpD;J`O&BI0(vo&;<^KppJ_uRVR znYNQtG6My9N_ImxnLTt*hr8rYd5$kxo2P>B0pdo>yr=z_p8Z9CnT*w|*k|`!h2we$ z(Z5bUl#FF;vi-A`MHQ8wy-ST3Ho_OQ8B|zU=wb>$S#TygJ7^+q9;+jd#n|4P{YyNz z)fh9Sel}5fzBPl`-=onctu=)WKC zHO!~oW!N+qJr}PPg9Dchp~}dyP5Q8Gh@YY(gkf;~eb4Rnol$!kx_YwF4QBA9v6F0g zItxqJ2Y-a-I8j5uUd!_8wpnzu@|Thgbrd9T8D;CAVD91np1F)E8zP?j>c7+i8EMjPA3zVw_Q+H9294e$MP~urs_s;Hd+FMB* zdoo<-0YO)Qd&OD?Pb(EYW1wLQ(}wZGWKRo>bcX^8eQ2YVMeK?*m=f%=^a3vMnUa22 zjE<_%4)&EPn!-&B+W7V?q*-$vtR7RZ78a;>$%R%9eiRg47t!D)4Mj!O(z99fLMJa{ zh&OmRr-(OnL@(*J*PyBHBEO@w=w!YP<2wsV#R+$qx@Hl&EI{O1R^B{W&60$eizXk- z@Q+P+XqxBM*5;MiOJ4*&3W*^Ik#+28UGwi%76ryH8CnOSw#= zsNE+HE_-sjjpaMEtIpJ7p*>7uxZ#&_@ULuuy^BH1vJHI~Vhe(X+JkWB8C;?(yWo9gYmz}^gvCP40jo)x@xy3507NZ^x5ZcyCD zG>TKp<<@Re+q7oa=bg2Jf3RQQZ%I7eE#>gIu3oN;z2cB*Nyk(o9L+b_p{wExWu2eqW>hyIsU7l z1S{+RKu2)KU5y~ld{e)Hw{D|<0-zy7#Dj1o^96_AJ^VXHk3^C7mRxrDAaV_yi&I51#gI-*?5G=kZS=7yVV5ERD1AG-5_n zk&i|$eS2#7`jVqWMi<+qEE>V5G(%_m+`aROIHmBuGI7;sf0J;d(pyMlr)wu}*4;_( zThBqflLes6l6-f$n%J8`<q%l$m)(O};!5n=fqNf_D8Qi|1M&(b?eSaIO3Y@=e zhz2t~K8UR(kfHkeWR)nHuo3-!xxURlD$0aZe!f0OFHUb`*@z!$81LE1!VR$!pK6p`?kt^eq+v;V&tPTb+h8)Q~ z1e>DmBm(?ls0by*ijy@U?xzGGqE&4{P)ytXLe<%5>?i(Jp+6e;i%x414`6o0ql(je z&Drdc$axvfs^ICZn*8pKJ5v(49X^?%--w=ts8_bPF3zILLyp8-dnUa!7L=cozYx3< z^kQ00)#Sq78$?fiFz%#rIKfhd32!i7bx+j4pKfo~45hEz6u_;nP_E2lALKf>6m z*nH5!7LK9A8tY5E%*giY3P%X{9#Pj{T)=2SE|@L6rk;RWB~dxLU_mTd5sjdrM5n`$ zh!QK4c~y~W)Q~hl%)%N8CV`GK)_@BK4bfq^y4y%jC)@m!I+qke zGu(sDJeqDoDSamzqXbC~g`_w`qEDe`bks_8B@)tY9KtnLtoT=_O2QZSSPw^?`0U;= zftaKC705wr?(-dDQ`CZv^D>xR)XJsbk(Ro|Y=f}B$vT~>16c6VNAL?YvT)?$k zNb7z{vV6EA@QnUvwgD}S9;J~aQJ8DFnDq~8)z9nGX3`I(K%l+AFn~B_0fEx+z7LMl zp$HV;cdy(gCjs~bxuY5}N!u{-#Mvolaf7IA*wvkHphWm`E!#m;AwqOJcXe;&`s%qqq zO)aMGhm3Z*AbKlZCfeII$s3z=VU2~uN#w)W^p_IpJOLrvUJ|@+IY`-dV+|EhE$kT> z(nGjN(t2Q{E1o@7O#qPB<{?67cHB_Ad?YtiN$`1>Ary24 z)flx?@5RKR@jivN9oo7F@4eZAn=cGdBThPUI@DyEH9V zSfylU;y~b3Xm|s0jeGjr4--Xl|HbCZRih;mq0v4RStLwdZI+l^U-h`U`(WC2EkmXg zuhCR2|Ga^2!?nGtEGDPLZ{QD>!6iHi%GXhl6 zf1(TG#9Nl689?Y@Y^Kf3vhc5dWds}sPO1p1-)#G$9O*n*yVk92Rf&Uw@*o8e9p-HM z#l6eLE_~)_Pc+z~jn7J3$2hul?t~HkO#(4U40Ok@2ca6&WN+^u%+XR?F>a!*ik36p zLsVBDJ^7hO?9=Gtg@gF|fOskXuTi_bubu!oH| zkzg#e8(!<(olo+CnCq6CGTO|`WA_sHyik~BX2}QzAgJ z)=qH`mPn1*5(0r4rf`)y0M)$oUZ?{*6)~5&a==l zQhcn)R7+M;e53;c9b--mgb_Kn6z`_C5ehF94UJ|}y?^!bg07i4Xx^!Qep-E$+1b4A z%q6{aqre;cIa&BEXSDr!R`@tBy4HVVY@DGf>P5$_wdn(UK`1ACA~ddx6g^z4yBgb$ zDVAgIWlz%JibBp3HY;puZS!ip#Y5aJGT2cYAUg=HLorS%@R-DyI=>qXmyK>-R(k&o z(baN)WfDG3I0euiizXj3_hBqe2PujhuvqMKO@$ea=8H&vzujOlZXo-RRGv`gaOy=j%5i5>d-nw)I|a^1R~G=0*;m||pN&pQZTpiZ?l z!!!>rY791taj>o?v&}EYXV4|09f-giEW-Y?MR85xUh0#1QOGjLr;S$fVxio|+n|q% z#D^$=biF83=KAw;cJhBXd&eeA!*2xXgcVB>6JRE=JV2bFtdlSle72C`pnI}+Mw%-=cTvWcc{4u+||sjuA!*uxK< z_u198gfLRb!d+LWR*0d|QVH36Hn@E>%a{jy`M%r9&oJyzm@}6~ZrnSVg;Dl)v4gmD zA3i|l`*e9-Xo7Bhsii$iQ-4&T)JFziY$F*%%*iHSerS7Xbn!NR3*8dsTWEtDeC&s9 z7|>QmEack@vzxNSM7z<7aea;tSeJhh_BwdrWbr0ECu@yM6+Cp~ef=|6qg;38um5s= znj=j$!ken-+krw;;MtU}&x8@C%+#xsq0b)-mg>>jIAbK02^GP z_F-Dcr(pa8fv#`cNlAc8Qv#o;-E4J$t5#-5K`uNE-~9!K5~DhT;rAuR6=>zv_xd?S zYL*t&=E&kvu|5GDE{jNvrju?3XhO=R9OYtWBSbZQPS)3 zDqO6UjB4YJZE}3P{#NTS9Svhy6ax_fBlp4@Tr>c0XkpY~%}}v4!s<9~hv-+7Gm1fZ z998ME5K^3)WhgPCmU-NCdw36+5Lo;IHJ5u%-HkkF>R&?tN|$a!06OA*13?lfXCNlM zQoruuo>=YgfyE--C8?7$shYr*t|Kbp%M3WDIePQje{_wcATJu{gCC|k6)x;NdH?aV zkL)xsVW8h#>>}|S?}Vi3Bao3>-9c-{+SB?7+6kQ?bPy;4rEixoA{B<*jo*Mx-}kNy zB8BSZS-ax=M*n06ZQe|JwJBmL~m1W>kugnLj>dEc$2-0zaBim<`4IuNX*x|*% zk@)zR+KmRWEM4w77miSX3V{GjX!^&Hk$@`Ki8TbUNZ|0CdW?R40;VG{ildyW_Ge)k z7s5enm{DQ70z4)_IJQaPaDC1wvvN=vmBw{V`VfiaD8M>_3)t!ew7-x$kRdk^5d-yc z0m(0J9NZmos_zuj%4w$Ya4oC9+E#khi=#gSnu7PvJ!Tp@y**STTsajC%$&j9V z9{DdVMHu&^hA^WO$#TKWX}N-7suN2*yzj?YD#cMXe0PGyWFsTA$GNl#KCPtG2U1eq zSb*m$MPU|S$7TvFS5vY6g(_KavX$vZTCY=A{GD5+q`2!s5MgIp$}QKJU4znOo>p_z z1XW2RKJCC)CpA+jct53~8eBBslzyRMoct zkZKX%j{FB^jeG72`~$(efImP`fmDpohC2Gffm|w9{ZU;bHQ33t$NQN$+TI|pJ%P$>6FIg?u2pXyAl;xltF&nonBDQkkxS-1 zA1p$7s_4P`H=7llL|^f?4jdxDPl#1O>cE)WzRb(_laz$Ex{^fGfH)CN-)zjr3`g4| z5@uXEi#27L;4fC3R35Bf1-9$2m^DW$$OFBybBGZNq`RSYwFWT)ZLq;0hed90ylBqt?(9Daf1G_Fq!*oHM)|WwwW6-C-_Wb zslA59oXirOj|P%6$fB#Yq4FZ`D`OR{fqW%puX6IZxz#Cs)S5M{xOvL+DS|C-lhbHK zQ~PHwQK;-Ec>D7``1wMP}`~51zuIS&L+$l$O*~ z#(nfKv-(lk|C&j`S5z$m`_>4bm=DJNJWs`n&rWFEDcd74wHZstd|7IjD5*cUU-cWd zCxtT+%u+3FmsAR$q`X{r>~U&Q^_-x&cIO}mnZ6ojD~XfbIPE^+Qff)+Yk4tC6~>Wu zMvqxZ5ycfMB&IxRixPqzQG@ z;59{dAQR=*i&cRWzJOzEE3zPDvy7P@V`5M!Lzh=F=7mPZvfqy_* zr8!?^263q;8mr$X)Hsg3(r}hYsDD1<9zoO6&^znB(XH&H$MjN*qX`E-)e_DDw{lm- z`tkUEd!M1#!%a_6Y=fEJIsHycwOqBcZIxa1E@dV`VdbejJE(ivnrnrbBqRr&Tj(`P z=HrSF{-3ofFxkx+0!e7dk+fUm9MR6X3*wi|axt~kW_i!uZc6C{_J;a`J=fDe{sq(x zP$sA9BaKe6=rVA&52IFC4M|tOtJtl;*+8A?b60kw0iX~qe?G$l!S)zN)_>}9GT7hmUWQS0HW zJxW%mNDdn;sm`kVXzK0l{qMYYe`nct>-hTV>H2w*dK8-b2$)K zZ|MH$dzNiRpa;nJpii6A0pKQY;l<8}ZpH2O)fGps^;Y3d@ol_EHwZcY-?NXulVca* zU^;Y>7g2IfAXO08%IzC}Q%$&6VW2tiJFm`X8DAs|Qj{>UZ4gm?Tgbf{DdLTdDla0F z)+Xe^li9nN}LrcmM&BKV;JRBKg(}hI5vt^1m^qc&?fZsx-n4X z>hV^1^F=P#kNXJkpCG;ab^M_n zS-I&z8rO{lzzOCV1Ksv*Ww<*g_@r2G=JDM-zQTX8Ni5xt8@ysYZ zaeojDcmi@gNeb#92je)#2hg#f@OL+c?gK)<@H#m(0JrzpFIB18@|C`TWw0yq7(<_5ga!jiP@+kX)5) z2q%%JPF-fn;(-`Y>?!v35F={sMA}E>QKCr^I$dREZ&70k_HDfZtGQ{907n==NOS1( zz14;37hsPr+JPbHUK)&#>R;PU6fwM^A}_`g+KRcnd+U1)X|l!|8miEPxqu(EDn759 zsdxT*o3W|9zfve{r??08h>5efxu__j3MljKhkxvgOB>fVzEHUKwH!Nx!YHW!wFi48 ze>Veb2vF4$y024?b$jQjTN`qs+gEqZi7In%P8;f^lT5ggn?Y09EJ?c*6F+vcbk+Ea zn#<$9Gg*@S)vhlQ-XYAnw8RxpiY@dv8C&u33B_F2`;puY*C*f)KZHSm5TLk8oAnJP zql+!+m?QrIlLc~#sQCHcOl9#SRW^v#ZUw!pjkTrfNrD6I7>gE+^g)?Zbf;2;4Gi2R z`m2j6ug#5~fpQols<}6nKek_$R4Ls&t@|;hX0`IrsA%l{-Zg2-*Cd-{E}m2kR#P{G zB7{*4W+=*Cv;MZ>j`87l4Inti910WVlZ_D)V6`;b#%YSkB@Gen+Jf|REr$`pVRT9V z0%;$=vL+``36~b80Ym#Cxt~D-N&GG*8m!ua%lhP-(2%6Qt=h13mqs!53O^ za+bs@F0Sh>1q)&K3f>{pQ-Me@vl23`E|O12ApEfPPxR=_RCpW$PA`Pp88|qUY_HP4 zV0s}Js$v-F=shKoBPZroB#84YT_>4pZ>JAD_rsT9D<^QsVK@CR{G&RvU{PGpHH^e( zlE3ggQgGRC2rcZEf;xK?4m3>rp%#q_jA-jzB1_9zm#)kYZy|vZkljFhOD9;gH{ipx zicDRGx`>Lpk>)i+vqnO9wAzOiQD;m?CV62GD&k?_ZU( zS-xGa&w?3w6Q2J&S7|hhIS7eUAuz-RiUrz$)d!=e_`M+FG47HXZho9d(g-q;dDk|R zPgeb&rf4L=Sk{&TDnwzNiHZ*r4CixCGZW|MqGw$Mp-{1PYu!J4OCDHQvcoxQ$i46Y zkt{-~=3i+EG#p3as-Kz)V5De`hBwj4;S+*K|Ed^IkST@JCEDh|EX2fN2`@abG`c z7eNAmxx%cqr;vJKuNhV=7V@5exszZ9bz0_a= zse(vwrC0$z=*N-M}xK8VP)Np(ac9P546jJ4Bd(UR^fTI+PEdWPmBQMAS0XeslZXDIVM}nDJeOD$5MWDWr%Qz+Q3qh&9Mvz*3^fgi{TE+z3ysE* zEUR041hZS(DkrrU=5%ybgsg+MiJ0t;$S#07*ms7OjeU-@+hHM0FVtt3+Z^*mh!_g` zIbW^ieQdX%sZ~7Xn5?&mgD9%0CD>LNHe=x9ty+;HxQr>JotItUZD?i!T@)ZMUe%H_ zeaDMm-FS;*&~x6Yt>CDEVmD1(VR&6BotfY$KbX#Jpxnw*_@{YIFMQqkB<4&01Ey2r zU(eq;ZEc|xItT4G<-g;pY2uy@gWi^m8h#xKv??byh+&=ZVV=Epw;xC!4rebc)NFBJL2x<}=Dd9WmN6EuC34ZyU9Kl=PmtFm9 z_T52r1ct}bXPDuf%tH*Px%BiUY@qOFXyTBnAmzmPYz9`%@R~Ol-to_%v65%xR2Ivj z^pFhydYp$QFfz<&{~dJvRi75-3yRQ2dht$>9E8I>ehWnd4C^V&z&WzTDwYX)q9SJ10^?aXiQ`_5R=f3e60gPh^z#zJ5gozD`s>zf1`FO%eB1dJnGfDQckNu#RPJ_c z7ZHc;xlWJSJBz~2=T&BE39~ejU3WHNB^|O4p~1W8W~%A95=y18ca-Nb2OhA=#!yI8ugwi_kL!# z&!We%D7B-vJS&bS`(A~|ZV~{moA#7Ax3H={>{6Y)QH$|h3EiUKiv)Wz=#$o8TM2!` z*?mEFYc$`E9PE+~!>nB5m9>F=IS&v25A)n>tQNVmZq*aO81jIsIylRe zT#icVPm(HGN)IUuMS^d6m!qD(*im-j@)&o|usuzcDNbCYJ0c6~jAddidT3F#5EB2| z;Mt#%2cT4gsS1VCHmaPg68B&J_edW+c&F5x9+$iE)vNkEF46Scz;Gpu4?S0e;ISXi z;_^0qrewJqkSN`US?l?byG{_M5H)B~P&JwxOHv;tixgS7lLc2`;9IJNF_k;}+APVA z@CN+n0Ncs20DD$>E}EA8<=liX#}$;?$yM6RD#F^SCSQZo(G!3#$8IIoa^Fr5BbIa)=~ih&3G6(8Lsq{&p1)(>GT7y zCf~iszj<(3RA{oEH4G@Jd%9&fQjy7V$0(^#bly4X;EcZ`+TowPulFOE0g|EylcA8j z4GDeex!M>F^*yPm!$&Vwr&>P-*t}|0D(rWM75n#n>JK1OoiyBklbIR+M-nmlP{U!w;oX5{8?%F3^XyH03qU5wbO76<`%N+{6VZy>c4FP4*JIlyUrsFe2DBqu7oP^$9fOuHKt2brAzOXz zr6!CNeQ-AWc-vQJappSQ@6%yR^v|$d?{aJ!N#LD?*{6eW7+OQysNwD9PN-aGp^a_h z?;fiM-Wil~2JmWor30`4mDR>U>*q+~9;AegU~N*`H+Z~y{dHdtE=oe?U-*#rL?_RB zs|ZBOzP?_FkJH7c4{mx(c1q}YP#8~UYxz|9ew>?r`Muw?Y*!#aaDOKG6|n7RQjn}Y zi=m(hCO|*($y)8U*-ed`euzhm)wC$y^S8IOfFz$O;T|(3Tu+7?-B9hCc-B1S4v7Mu zDo_#}Fbp0Lia-Yg93anuNJ?P+qo|~_t{Y9wjT5<)OJ>zNZ7nP7FEK(gA$!R zJP|i_?R?Ng=9w-+QY#1uGLo^9FyFI zI@1T&sF>8yc{mCQWg)AKV={v0IG!IPy_&Ou`({pB_N~3tQ{RI$KpiU`B9RoqD+ol7 zXM41jV@)4EXDhTg-DP;VMoY0yqvh!A@VJ)Sio1CG7V2cWkg|*LYWytY!RzJtDp(0Q z{{re-B}G4R`&_UrVmVM1hMCFoLi9MvL~S?5S)=_3oVP)icvD9$Dfsb^KX&)qXdq*< zv5`%)dg86Hi1j^kI*(97ZGz4TlVx$De<1N(=xVZ6cQF z5-bRDx1X#sSK(0XK+pjKEVo!vvjLT~AS5PJH=f5K}<=uCr( z4oT_x@4d6iS0cH!w9w#<96x{>@IY1>>C;j4>Z_*w(m%8d9@J6*Ou`uTsU^!V^yFn* z2U@QO&l|1omH=y5nS!PRjw33SnjfW<-U9Y(s?XuMDb7`BFe zI1D2@G`RvU8xlp@z$!bd2IxqrZ{xF#=wy&?9EG-6FJGc~&GH6<#*L$2(buTdf1vpg zESnk$l>B?A51&xOsdJB4q9g#{k(!MjidGcKJi$?_Uv&Fq6SBOtHL68;C<@#wOCi1I z;!2Dohs?xH$0!Uw+f*bn03w4BuJ{l7Oys{PrPRx zmlRRthZ)#$OF>9PoiCVGTxMiZ5yQ_|{f&BTO}xhXT5s03oruZME2ZX8jdWH+Zs#xS zJ3Gx@>`}_9T9tq7-6K4cZ|=~0?9ScJDQVev5SSq);{Es&l?W^vNRb30w_BD}7TLPa z)wQD0jbz^8K%#8cU*CaPoeXl)79x>>?c6`o*K=7jtX9|{2BUyL;&p6F_3Y|&++wXa znuE!uw%9)+fhY711)W7t&)IIC=|rpd_ZWu&7B zfa?G;VNf=s?()HJkA!{0y*wxG)G?bl=>q3o3b<|I2o19UAP0L4&g&fe^olG<#^kmW zz@)L{91hVNM)(L5N1Z}jtLRYnJ20fJQt{5frsspeO(L@7? zg0is&>Y(=b#fuK#S`^K?i#eY^VFTvCa1>fDlhwNNQ0?)Y-E#9>96@Pc3sGaZ{-DHa^!WPvF04xN)5gSk3BWG86qAchq`^&Jad-9ZjnYc z5B0!>Mm0rLS9r-9OK4Rebj;1|r;K2B_0)wiFMMkQCYh4jN_|?KBP&+c|3iak4#BxK zBL)&E3jJd|WR-4)PWJ0yg!GxZLf@mY6E^O!c7B}X`i~Xbrd%j(mc0eEw&oI#>lr~9 zC!Nx}a!FGH1rLdm2e@WYX?~#iFo0eCmMoC)+d|ErK<0OsAZ_w7mzTvhc~lfl)FN03 znS*YF+Pq#)@J2v?nf@`~wFk=XDu&}&e+?|101~wEel-MsAQE?BAS7<^s8O~hTjOKZ zs?B+WI^x8yqJ5?C!RSjldpBv-p*@2O?e%v?slGtD}7>ZxSnzYZk`VOAh+rDk`D^;FI@P9vLU z!VE(<7~kO}2vFh=K%!P;*yTYCCVL8$@3?}sJ_e?;8N7y_#r{V`%9HX2UI_zGiYP2@ z9|;yqFf+v*r@HgFGa`L#T_zglKs3ct*%O0NlD~_`_%_ms;(7k#Jn>4tFNN3AO^)%B zd>sTxb?+q`XoLpz)Igu*amHAAO~_RT?==YJssh^N;H@@Np@-5uQPH7J@_IDVux_JL0j9@-lH6KZw3ENUs@4FG9DcXArq+=Ol4hf}M(@+PCsMFmY zmZpPico9RuXtL@}ecwl_3R*a4$QcHm*^C@Gq~6eaHwxWg)ndY2t*Cgwmdded>1WTE zhoFeK5phAp9$%xV|Ay_t&$f$XCH7Glxl!-Wt+H=V6T|9`m+#xPZ}P%H^?#S;{zsNA zrr(vZ|Fi#G`V|U4wEgyxTVQnd*RZAgJEpqr{A<{vL!mv=JpLjq0>`qxK?{TX zEfao7zW&zOpse(xd?r@+I_A>>x5 za^ulyZPIV=ZRXz@6zoHLeLvk5=NWb<99iq5Yt1{`gpK!i&%--?N?x#rf_>lFlm2T{ zYF?e^t5R}|{+jQHvE1Eced6;icR{x__ocJ0z32NL>Frf>6)SBS($)uHoEp8!yIrtX zua=*wailgi0K*!ICg=r5 zdEMg~5FY5M$y_e{d8#SS?a#_^ZHbpNMG51KMcLP<^i~O{rS4l#8=QLuJA?Tav8vI(F<^*k3 zX=@u34p22Z%&Ql;wQKs!(Bbv0Ez-0o`cP4By`@rzNumpf8Quk<@s1SUYicUUCB0~5 z&B1^$ zR^4wxaGfEt_oxWV9TzDTs`VLf+%>84OtwdoIO2ZQ-A2eH!c5AWKHvz23Er9aKl7VyJ}$Z`x>W4veb7 z+M_e4&YIkxg#oHv%qq&%D5As>LMa7b%!R`#>;s0Sfs3%#W7Tej)GnEo)M96I%MXeu zm5ln}R=G?PzJ_xhH7NIOf~il9?6ouiTt}4OV<_rOXQW- ztKm#1=q7%rUs~yL-xB$Q$~{+}H`0#gPALQfAoj#tlF8J?{VW4+;iyg$D3P!zUElL) zW`5OqC^io9{;#APW&b7i)>!IPf&^JkjFO?54q=*Du?QSmhI9?rf-vnZ_j2*gx(i%_ zczQH?b@ABtC1M4LnBVE9*4939{9h@TwFXPQZ~&(q4Al;{8%?V3Q}n?KBB@a%6g%O# zcor?rQQ$U+8=gsTdAo+60z0)7 zf=BOhE79_O_adsCmu1LNIAR#fnCLln<;NeE^p58fKO!D${+{cVLtz`n+=cx6)&1Kdd^-9;*GNv7auFD+AJ>NJv3s}_Ehqaj zP`yVc;j$Fo+9zV7 zMF|vS0m(Jvor^8@PaX@j3wd4OWD+Z5`8T^o%De`s$_*Ul^cOzZ0k-d4(B#_UXR*Dq za$`~f<%Mcc&)z>t%?Ol9N^ol&cBxlpYUKQ(_UNOe)i+!YU@CNMtaz8+H~}@YtU>uH zuS{}QU)u)9a?F`x`QnVmIWp)v7OZGWkBjuz%Ar23VxHL_F}27cZ_)CNOu87YNl4&1 z_{_r9gM~o2M(D>uRVG8tj|5U0H7A+AaO;N#E$5DQkx*!w@7QVCIc5B#AiNd-s5`FP_Z6&Q<%H{8fkW&dVGv7prV~| zPa37S;wKAS&*1P=fyMGWY5ejeBmq*!K_~Y0t0~UUA^%$3^Onc11dJK3=eeLG>L4MI zbso4y<7ciXBtqEL9L~CXy+=@m(j3|EHsgd2TOP=x(URdv#!SYciV#M#4zJM3V4$zf z-ZbvPWr@&}HZ?2!w=MT`C~TYG)Zh*oW26rQo>(^e=KHe{;@i;cR|=`yK-}MY0tdDP z!la}sNXbM7?8jl9sv098EA#yM5HZgHHC;#;%SI!o)a9200)K4`AK&6sM=AHT8Bqh( z2~Gb9Z{}7z4;JZ#YfKqZ@1Z4GDp0Z|-N6_jEhwQv+edY~|Z=;T%fa??I+zA|)v>4&!leJg8;p>R7KskN$RaxB$-&7tI%u#Bro2 zn_Y7wH$9tgTcD-T&Uj?m+`#H5IZW1lAvq*)8!Y|V{~C`{KqB@o9n`bZbBsMP+gVyH zbDPA%1@@@+fWf}*cj2A6I|S!a zV=3ZYDa+IN1Fb}R4MVcOEAO!&=^Vx>0kw zz*(xW!T~0}{2w@qnC?G3J)!1UXJ#P_I@W(Jm>S)2r{lm>-=8q<1$Qc^B?WhWL}P!b92t@DsUq>;BDBT=twdSvzafj~WH?c+)_>XGv-MdDF2u3f9`IrmL#M+M z&FgGN#OC6qe+niA!tUgw+}b6b~qKkZl=r zR3BtvFjFJMJ+qA$=av^(YD{NZMl5ky%(R9%?U2B zO$S19fhU?5sR|p2XSMJxE%uM`xKk_W*oU;M24{OfI?nSUzC2h{uUsKH2Wv*v2kSm} z_R{%~OyT(U2B10EPWPF1p%Q=UZfi#k8Zq8|$W`Lr*e9QBctV#ou?`B`DpQ?686+KK zkd9BlfROu=G+R08=5nsfbjh3-B-f@FG}J+%d^C-|IvJ%gK3~Xq5eA+`Ln_A zB5Q(XG#7hrwIAGlcN1Dn_EhFGEgjWow$r{uf+`Xp8fvt4)cT*rs(yoEgJ{zkx)t5K zf!Wu$mtWDBZVH~yJe1vWd+5=mH;11|!UhO15K#(Ut1m7Gm^+})VW0NvI7k+M=+50v zt5fvBXzt_lESJxs3x&6_92mhc>8TGVf17(J;hip`$QvPLRUp%DHkD6}@G?gjokJOP z(oJjR%4f4$VV_Lcp~x+%)rOD;YOs}SD%DEfFBDtk_HBOf-mWMx(A)EA{l8YLu%<^= z$Z4q+B>tD@>(kx8?sk-}lPt;iyM_KNTj!gc%m`z2$5%UvL7FSw=V$gl_9#^WlIiH- zB{x&ocgF~5K|^5=EN;r5Wd9-g8K4jdM8D`*>t@u9|;73?|WkAPI{gr{cz6NFw70?Cfj!HY)HB z>1`IQEd7xl10WkvWRqK0*+|Ex=LI11U3i7LvTz}dy*oWXmhG#+PS4)Sz`^W8x6Oz1 z6SC=YMnSd{*s_1*+be30s& z@Ok$B!e2K5*V+h$&F^?z8JqvP=yBAt0g!Ov{Ar-2(t;ahhN1dF*?P$k>eC905?`1waq1WfFs~r+dNO5 zuPGCRfDCk2Y=9{FaS@$DA$2354jg82daICh?f6y4t14z1GJ1hPmyh2cG+sxo=46lAq@O5(iG80V&b|4Q9qZ6%xF-;5)f;&Qb1Ds9D1p382 z0v^dP0uGH=L=G^OoN0lu7bzU(waL`I934fLX4o|3+8JLL*lst&E0ulXuqX%s6mpxR z9ELn2dz)&66bd9Rn$6g^CLZt!YRQ*lX^tQf_(OO&a7gbt4DPBtRP1$NzA)eB4&7yy zN@S!hykU?>GB=yBzz0zFzi!$_zL;8(Mz#SK1d@I&b-YL<(lVeD>lec2QYSjR29iNR zzI{mv9_bW3|7<6cFrRu5qcxF(lAfgylndpHk+x{+c6&zt!2-C-MruEFNnPBwdROry z!!+Q(!}6tSsuaeI6=%>Pvc3j{NK}HuX)S7b9H%BTOOW`mP$B zKXNTEQGVwk(hTG#jUxKEc+IP94^m-B7o<_&w*dWQqYxTR4H_+Top1DtJZK^1 zgq=2VRJ!JSIh(YPA1dKcWtV*Yq%gf52kAT|vwzr-&_rzUW18ao&o6*2djP*g|BoSN ziC0_fnKrjukwN`3#nH=rEiJEoH5gZur4FSdF+KMuU-wk_Q~6Mzy@y75mXRaAX@buT zj0s9nmyE@V1Zmw*r1U?8dR8Ltu+sV5?eR*O1)LL7_4_gPjk+phN6m6?$p%DRAIS#J zww~Vg3_LL8fxSkatLajz2MBR#0w}95&y%yF3w(Q9^xUng$%#|fINvKVZGx6yF4naS zX@_T1OSRSmBx84jlQ*0^9n2A0P4cui9!OU;FW>W*bE00l%@gT8okJtCG2$uS5f8P! zb_x=p$AQ2maq;^!i0hRTs5yWxhAl~D#sGMHSIKC;Pm<{Z1KZm>VgO}XlEI<)Ne%zA z#5Mf#_5LyGW+K_?nWio4mKGF;*#&Yh~^n`T=& zUbUYg>@TAv|CZ?=Ao)i$-`e^Zl`yB4@Gd{Yo_mIx;(oYwaIZ^+xbFjrv@*K331kz) z@vgQ!rwD}^2|Q9~VWI?Sgaeo3vi+X;5vcA$Qe_mSj@@v2NGYtA7s02R-=VPX z7|Sw}1(223=rq6{hn^V33>Qdo#`ATzgd1_3Csy?HQ4NB4|1`Ph{6|3HC4>!0qt3%{t3X79qlyr zlW&dxDAJ$iw$|uJcEyY0(de3KciQyhNJ#LadFcLL8dc1YGTS2~QN+=>(x#e;_nA+0 zwIfMezB9H;nU2~={tNuxiLh7%iJ`PCtbA2S_T0bAVRqHQ89d>cakAgSv^-jDt$1x; zo@N1K4WJ8J1A&d*9u6Ib$eiLQtr7FBYr@eQLlq;Cja-hRTVUNUmSw!VN&RD0lb_rB zHQk9Df3&q&IrWZH{^r<)Wl!wrL^LT+9Njog-@SV6-#OvBU^U;`Ajk<`i*o9~729ohapY(v*Z!IL72< zt-1?tfzL))D9%5iWpV|U0Qe|UK6M131Q{>3JtJwK&JBQON61HaBm(DOfSCF2Mko#` zd96zHJ0fmC3?TRs*V+;7x<4p=upRloB7DsfUJm;6t zTD`YqFy)~JlMox%X09uNqGQE>=69@KOKM(5W2AX}qzy}`dmPg4rtQ%X1lun~B4TGt zd5^ZsWQwphEn5HT=4N*llHuKaMkMZ-EXq{sEUnO=m`arK4ySBt(gkwQMR|4p1s6O6 zh*3h8Tv+r%H}ZSB*JYuoPOrD%P=lB%=l1Q;W9>ZE*?cW!1*2jgH1Lznyf4n?YdiD# zFG`{xrx4=5$;?duGfIMuh3Wrn)_*C9nu9ik-^~07bX@mJs^^A)&&2PN_((f8@S-vC zztp&czY^5(6x)})y%rj!VgnvIlndJbcNa|ib-4SRsq5!y<9=b*0YH+vxz1}N1xkFN zT*nVV-sjG)61MEH+wq);A)Ax?)XKGpeAJSeE{PWN!?!0w;n67q> z7pMvOhj`S9E6&Y-y9=f%Yyf*5)Ba)V_2XxEu+wv8LEih*18)jW$9qO4au7-g8f{2%pxUf=5#(I;xkwyiYD0O=Y=l?0vAezXoyyB*2JM90=$LjlrH zkC0XoeiAA`ITjrDs!{GfdeNeKWF(;Chv-DN~_&?$+4YE3%XhaDk;v?p9=X&8pY zuO_#!+jbgAbh_Wrgg3fy1U-ArRe+WedBst~9R{wHd?b}86ek=j41GX-(S}6_ca;`# zJx7X!M}aM#vnXU~#~goScG>D1H;t~In1Z-|GLZu$#33WYlIu$B`iATt;UN;2QLN4% z88BXov=HG%7Q>Ptxk-#EQ+>&}-zYWf%ES6OGb0fXObd@gQo4F+D}sy=sA7Dz)EeV* z4<1F?QcgoJioV8SfVzYZPDVGS^cgkG8s($Bt-vi3xakDD)17yLGNp_$ooim}5Ra_g z4Mb#{A9OU|&!fd$Ikr51kUl=vfGHTQONzM5dH>sBBr!GkgET^w-2l_FiC(vgj6t(C zT!cy)oFSD-!*_^0p0u;{ID)#GlwGf>>LzGN^`g{61LL6b&x1h!E^N7paD$ z7rpZ@{;7AbaP} z4C*G8XfQzI=^TMHx z_u9}z4OV8!+u*hyEYnON&oO9IlBe5MLGB@b0}+YnIg@cWk20nd$e|+nQIi9TrSWwd zE7QQU5mBf9&A2Y$f%y`j&))oUyDWUQMMv?4M%e(AlYq}6Z(GYF(v+aF=e7INu?!2O z(ooZsnjTVC>oX9&>m?*8fOb|QbDIVcHl9*@l@6O?0ML@UXHwoE*TYxKdM;Dm+aCQw zYStj_rjKE`r*D+WssU#`e1gjEzuvmz3%ni<5MfFGP9-!^5`@J(P?h$@=dzKMNJ3Fh zNNIT51Ri?R?i@6m!Pw$qQcG0=@fU=8y@hT|LxDU4;(SQw^A^*i%gO*dJGmBz-7I!r z+rv0o=Wb2|6y_hW_uuc~r2p)gX?e8~Xq|~LwBqfoG6{1KeAm-z(i!-bR3BX@=Ac0c zpDvyTe*_MM#@cFrV((mR>z>HV7c^HuJB0dl55=-uMe&mt6rZ9)`=gLv?f-6sYrD?j z3%+HTx8x)LNP2sv;naPkx@{^LvO7H>R36yTZ@wUK!L?fnk^B_F@6EtOx0FK0zi=KP z)H+&(9ahEOB>olL)L1Bz12;w_RVw04(Feg5kFn$-IK9?Z2soX^mb|8wLHSlBvLa*4 z@*jrK2vVsxIJNMkh{X zp;$Rl=I&=Gu$3;}jIOgVQx+KwxR9-M!qFR9#vEB4`G~@07tJPX&>_MqSAmc|&OlTu z#a6HRc;LaQzT@?b$?}=QErx*ra&k>o*&=PCUGzY^0 z`C)Qk`)khK7@1OA3}jcavb?MYxxUB!QOzZoxryN{gkr;40ll%DW+LN;m8R-piy4kZaV; z5qgyJU!(Tu8<)S9MXvv52A!p{gL>{Q10?}FG!M3q69Hrka}5%g+^JPj#=LOWgg3B@ z>{EeD7-AwQOr-EJAmCODkSkAN>bIT#>E(;qPPC#F&S33_Sq5+ApWD04Y93SaMmlu+ zm65+2;5}x1X{1~tWIer{BCHl{#9WRuy1<~)Pg+L|e4ML0*Q?A{CAtM9qY_;h)Sl5E zEOnX)Q|bffACq!h_x7(q$9KWtw198=p1ki?6bf*b zu5zsOfjSF?=GFHzS6(|=g1o9PeC6|Y-v~5G9hpJ^B4&eKQJw?kXgY)<#<_(=Uz-*b zAh7{ErS=*z?N)Y@HvPSyhDPb!*A`YE!e2$_Z6dbW0OrwRbCei{s!5=$Dor+H{92pG zHAC4398!%@c$>yjkAX(O0*4bE39Gg;sh5qd(6%$)WPk=QLEke-Js*N5y3tZhwj3PtlsXJ7~Y+4Y;slbe`u={auYT)V>A2B!&h z`1$BVIo#W4s^%%=;^+>;)xyIT*`s1p8}*|+>a;#8+U+*+sIFspt2TLTV~oG0r}j$l zDX2bpG@9A4Hly{^&>qc2w({F#B@O!wp`10~K_)oK0=W_vY&?=gR>tcFmG!#-Q7*!+ zh3RO+I~iT|W3^R(a571REXaZSMtrhA>e-W1<|)cU^h9cTSa|93g~e?*utva$bPwD8gY zOPJ`r!v6+go5V+&v3?tgb|YA()GiyuJC^Hx0{o{#4rIBOrrUVAM;X^~$_zJN)hktC_< z!MonbUPQsxszhf0uV+=~*NqMiBx-O207$NtlGU5nA3vcgA=3GY?fO%8hB zl^qmcv%}t#>I{|PHx+;bIz2Q#at3B#&h7e87t8yG=8S8$mtP;aiMJAyFc7kc5k(j) zdPX#M(d$l)L4n(B8xzsg#2E-t6te|Z))qY6iW+>>UaPm3%`*rZgpGAdI*N5xMgIfP zb;>e%=a%)I&rwfV*UiHt^iQXj)msmC^a}qS<}PM_LO=CTS&0)IpVY8)*1S=NkuC)Q z8uLdJ=PU$nHcUK*RwMlWnhMaJeSL_@kZyWsQl~#atp^AmMHds#{yd%7DIEq#Thudb zcQd%`#nbv|uPli9KPJtz8vv$}_)y~rrlB)*gyX`bQL($lx?jSwOv>nKPmIj@c8c?C zTOqWRv|e?i=yGn|H*c2h^GG6l7v2UFY?xNMGPT{os*|zu=`!U_+sfz2BqXX%<|jh= zjIl#;Is3WID$~!`q-9)hnF|bp=pd@S_Bt@e`mE~>py^uAXsWU>lJyq^J}TEYF2=^k z4pn`_nTO)k7ZxGFsgG+W_1oOFeNvlwwBAIL8Nn$+73SiEc+AmXcpr^>ciB7l#bNxT zD9{E2Sr*`Jy~9?c>^et9OtFUx7BP?sUDC6yEW~0}VZsf2RSCOVyGD(3 zP<5jvW)fxR;3b8T{OW%TA|qq2gwG6~Rd+&1fwJWIYCn22@XGT|PR8I^gmd18@xym- zmoYP)Xg}+dqD}Ig#j0Y!2X7 z1oLn`9Jx?8vMT-IsTDOk6+%tL`>Q`HQNN#yFSe(fjiB{9D~W%Ny_PDqMLJw<%caw$ zt3np0OI(-=_4tn$NkI+Ns4{?i<;FFIyhW2-NHe3K8B1xdMM#NM?~Ncqa9CL7ESH~7 zpJ?tY$!uc%6N{&zaNu~2=dk4~XbUctR_?~sN%v%Fl`@>#^nkjwZ~*roMUEYh?_p8C zsOq%SH2f5yRBdhBtQ4|+8%r`ny3R#KN3J}6qV+W@9x1l-BhPTXn5ta0Yv+D}``%ri zzQCb-!7tnZj-TiedT!5K8erj6oJ^ncj;G_^60MD2d2N9oioc}B)J}FKFa?HqOY@h6 zkI>e80Rh`~1^7>WkM7l0n*r=fckg^00q_R0FtE7DRE{oBqIa&YRR@6EPw8m4&H* z%5d--5i#_IqhuW9=XIDFDu94mNcYl4dFb)8oX}BB40f{lyL_WKq$ysq@!V|*UFed* za{1+erW6Bt-cSCagq`$LBv{@^*e6*FbfvOyw^+XyG9}HFv_0t`DO-0_2jk(UN)RS6 zoq~I1l6x6M-)y1v$yW1GorZi5mIF$FWIO0QMwbh*eWg9^IRi}}bE*L8q=?$GGLKez z+>Il)6{FOKER@sdZ$pG^zJF3*w*En=2qm#pvf?Q|kAQ*and!HsowOmQJ7Nz?YCcD* z?bnRo{B7Cia^g=cWh^-k%|sx@17%q-DVs?n_*I}Mx#cCvm*jft*m9Swg&vI}1VrXz zjL!jvmX`WUTXK1-##J$Ygl2l&u2CavRb|vmu%r{STdCnu!naoxW5v!QGGwT|PcFp9>SA*VUTUgi9HqJCG9FM@4)snSCVMiO~eASX+n^4 zp$KB2jJh*+FQaKdG8W!>e?p*pc{C!0j2OtzP?s9WFz-DW9zOq&l~G23wkC$I!=m_(lxDL)5(P#ES_--11PqlaJ4 zc=bwEuop^DB92mzHOlG8EQ%^(;#q|)yO4KVU-3xg&kV36J65IpLNQ}vpP+)_CTg>H z$aTCb16%LJ_^(HZR}aI>`nxt7gEqSYaLaX|e;P`*J`#bjaxAbHJ~FSSC6 zTxyoeCEekZ_?J93zqF68UBbJ0+PFB^_cgnZ6%wN#`b+ZP$^jt*?Q=W`jWGS*(oTcVdJfm%)D}ij4OrJpHD&{f@ zUr(c_UdFTKrUH)8Huh#eZPd)*$b0RM2LTaKmkt5y1(VkQuu7c{LF?3tmkMzJ>QPVh z(Tk@h^pcJ6 zg~@Y9*J!*sdAdSsv0PQ1m`l{1RarId0s{_L7>%l<5w{4s)o;6e)x-WZ2rMBieNl91 zTFl(Eq`C1X4td|C$*X%6uX`#tR^;U*+4G`ktC5Ht=h0bz&TwTg*qexAMU7ZgSwe9( zq!7YMcSZKel4`SMb$G6iy-3ARv!FwLkHY%lrQ<@~zH4;2rh8kxk5|ryBpAMgEH!}~ z;MF`w9%oKm{%^-s%ko$38Ym|qPek+g%@HO(lfR+f>H9JDvFHhVMw_rBa4Zk;B?3gH z9*o3dKjfzZT1JZnsIR<4(}t;EMbsru^Miytd@s&Fc?2i+4bg1#1Q+W7nCYI$no$%a994_2fK(E0O+<=q#KrdxT1{EJU zX{vJ!%bBKSt1!e}WqMy9o8kK0#08O>agkvw!7QA0jb)Y&!r%9?ZL;rqg1afS?{Kl$ zio7?q#pn+ZC|dX8XOku_&un(!;+(cCKpDlj<%AXCs&*z>ssx4!#ed-pB` zt6mCv6@JWPl>eE>7XO{N0snNtP=C5$a)yN8?*rUpw6~0SZ81OUF?2UTd;#Gb&S*yO z`R!fwe<*gr<-mQ5u=OI)wRL)V;2;|EcA^w3$b}GE%>2RWPiXg_yW;so0hC`5wdUBqS5>K)#`0E=!J_n zZ)IFtds(7eTVu!=VBO%Lb>5s~(kr_UTbQFfs%c`N@J&}7YI$ej%Eo#Q87`nNhl51N zJJn$=CmoMEsvHxOSaa7wVfZxB^%{wd1am&x6+9Ax%1JoJ&*Bow4wB1*-HF7aiD%GR zmp3~O88F**k_*)_VG^PVzN2kzs?3#(&|5dRVzh(94DpXiK$1x}&OL#Qq+~DBQO|@z zI_iT}LSVuBVt=6K=Q4yy=!UslMsCO09%{z>eRKMxNc`toF;{^-)~fYDJ) z(Q%=4^6}zSa?8i$jH584Z0lQy^O~k;zmwe>!%)7-_y$VANm-ws5_UT3c0fjef5?=? zPA;@rG~i~at!3zJ$bjMYe=++phx`2KfG zoIffGsB78>PErVdDv(yJTNOb1S=a!fR3!#@tJ$vL>u;`aFJ^%wk|5|Q%&4Mx>LuiN z#!Lt3)Y3&^wBTsTir)~KgqcfTOxyth$1jq)@7}=ZKV%9;fg24C zK&Wp9G}Tz6N?1S+R}&W3jWi;u_O1Z#m{t{ec+$7S2`qx!L<(#YXP=BUtPBxUT$+t7 zZi%p1i|K-mn@+ccnxo~c@h`i04%&QIXd%z=!l(x$w}1zve$y&LFT@pkx09MX417LO zIN{he?!8obyK?Fnj?x_D1A{$2dXvqHGAI%n znr;MjRKM&SLGiJ77N1G=s2km6!6DVDnU(zIa@MjbG)pk#eXfJiSyqRR6adk`Z4C6E z7NP`bf`xXM4^%1JyHi-Xu?13~gpG+h(fRNV5o)^8oRPl%)v@bdRnBzMk}SobOUJOQ z{~vTL*x}tWGQ?|?2Ev*JM=4o*da@&?un%RWQ%l-k2$80hC?S}tBSaZ}5!-p8TCWCr<1BB%I#9fJ~uZn1&TEZt>!y|yat40 zSDI}(K9Q&ER!?xBh12cX^$k@uiv?XS{WBB#OR4r(480&%CtI|6^7V7X_{j~X0VL3h z_<6Ukz=6@tZ9sz3{cLR^wUfNjMJu(*wh>Z!vYPbsIZv>qRZKrAw^WtY zpK9Oc+Va8h0wM)tjqjD;U2;lp#JIxn|LTD1I zFdXdwP@f#uZ%r?$H=s+Q47?FtNml))@Gm^@)D+TjpMw#mlKCA^smDi68?oyamxA$y zmW7i50NV_DfWYqUeL$<0%c$Ewh8fM4)?tK}K{FyqkO+7sTGT$_H=gUjKc6(3<4dre zN(&}i{Xf`9P1WL~sJi#0fNTIC#UzeAIAeNlxRc1XDNSkH#uhj}Nm=@^sq601il|W- zVWkR-Qzj?qqEd5^@3tU86vA#Cwgk$EOy54Y2R#|(p4wSEKqRM!ok;z{2<~G+uLUB5 zQERIOam+QPRozyWdGnL#-t9J1$fW9-hPO2_8IYKn{I^}ak(zmJ4|JekP=62Y>8%;V zDkek|D1no%j9*;1kNz&A%#C!BU_tKkT;qfo;r!B-%_^vA#tdshoFnUR6sj4#V>iWM;Op9#<=kT4f7b^p6i2reD_AJM$p;-a7EdG@o;g z{*uB6@6d|8cG9C{3y?(7*K#+LGem*%DF_#G2ix;x_|danFoju{+;%vr9>)BN_tfwl zQ8JNy96l*s10ST%wv!5R-tUuk+VAfO&?>df6NDWb>usvcuS}AdD<$KA1>xQU-zc#U=Ssw z>f`ggY_I|Y>6{c2NIpi(rRM#NMoPkIc%ME?&OL4>+^7ZEvirX{iFYLv zTzk8@s=B8iV5%#ZwRAb@6TwYyDYU;%pQV@Pkn;G%7Mts$sXU6qK4&1DXrs2S;djgkoJ^T z<@hR#qYWUp4PRjih`E@TDgU<3ViV1C+(9POl#_ndn#45ccU`DK(2g_qx%T7czG^>Q z1Th?8E#I(AciZvswWBiTrZA|IZ@NPUqsUmqoMeK#(d{spgU4>%nx}rq9qo zl}sWi&;{s;3LgzLadvU$U?NOU*x3&^+`ka)eCZ9)4R~Lp3u)>L)#|aI%wdvqZiN~T zOPg%{=-uYVJSTbO#oRpcWEd9D1pM&gk+yt21H-=sTVEH>Q2dS<9971}tU9}*{aibW z_YG;1VdB&bC~HZ!+eiLE7Q0U$;^NDZE+C%mOMdFqh8vL-dy(cwmGbvBijZw>)%uxP zv~>X=JZ+^tx&C1Z4-EYHC{{NLxu9Aj;po9|@s5T#9%5(l{G__!Ov3!S+9--R|G0rw z?aw(1loyS^dwpva*PV>jynXAP6wEMGJmqE?7P(C`g?C|>mNf~#s-nZu7F!UDRx8l> z>v)s#XU^Rb^V1-5$Pp|vQANnmA}@Ve{QmQ}OYeC!%;8t@#6}!!_H?QxKWmcTzw`A^ zd&|7Cb|@|^nkb}dvY*o_y$$0p+rU2L*|C|)f3~gtBt^1VgbT9@jcf$yj#+HLX!-4N zktz{N@s>WSXVLu`CzRG{{<`I1)5vBA1k4?HDtU3{9zewJ3DCPJ$ z?j80hOzM-hOV;P#2c+dYkzU4<_j)NV_$u|;Tx5LziDH>;uns@vL zKOJX_vbO7OI%Q$?G9XFAXfs|F3Z}EC(=iYfm<8#@b$=uU2$;2ALgOen^#Hc`@@?xN zaPFX(Q<|(5fkdGE&9Yw|VD#J$sd06*oX_cB3IWv2gYZ$U4u5>JL&jTvX)p}jlt3yG zr%(Ih)fK1=InnS2VKMuqdBHoiY9~@r06!9k{Se2r;bz(EuXb4zlDJO3ALJw|$SmMy zy{ldgdjkR7B7CTz4j&00IhkO3kW^fi4)NV#@s*3{zFGHpWc%5C47?uZ2a0z>HEf9jUb?A`gN}C$z5Ahu!IecN3w)ikm12BSZVHh$BsABhT zn(I@f`?dXzpew2nYB`0iiWa^I4)2LP5@Hdr*khY1EP~cSQC;LGI$4x{6Tr1n>U@cM zPJejxZnmCIV(_bk9y(v?5VIR*X;Wyqljo_%qPbq1a1R#29`l<=Gf&+kk?{%&Fsugu zwi%`ZYDNI%TkM>s9ko|o>QED2u~d-Q)uireV$@CjTuP7uh$?&$lAn!)JjfiwRnV+$ zq$L%l?O$}smcxjH)?!PDum_Mm2MCf9BCW)8Ng@CauPT?x$l7b9nF@FEE(WkqY9#at zGErT?FFfj#QPcUQtrgQy=dT9?ZLUc84!S3^&=6iU@CErHB3e($Z4pABm=M?S7y5HO zkjp0D ztgz48noH6$e@$pM&i#frYz%M7z`QKHGakD>=f`!T^s-87k;bz>quu8-tQ7Hu=vS1N zLwuTyH-tgiUE1FpfDbikE5|V+UgnO64dnjT<(7{eT6WWm5q>nl8i>Tt7yZ$vB1l!Z z`knO^u;PTzy2qSF{D`$f0MjQrRa=@X-7w0ziKEhqzOB(K5Z@D%g+hE#+VT*Eq)@3)5 zTHNR05G_Mg&VyA(ISKKL5bZu#44No+KaiA;Mep!Ihw;viP!y~xUB0?G45n|9D=z6jvGNaOC^PVL}Fqv4{WAt|Sz@5IXMbMIwKut=x+oL&Jy&19LGwGzcMyFw za*O6%F9uMF%h*X86w)E8n*Dq1Am}p{NIh9h1)83%?5@t{^;aL)jERmE{h1;gcFk77 z@hq8OUJgD*y>EK1MSrBGo~)yaL6XGH)f#8=E}xx_Vh#(u+mZz9dalongZi&O$*JQj zzOCmalbn*xE@EAnXDeW#2c5yDJodHw?{_(x%EhKIa&uKJ==?Um1YXvv4ekb?yHtm| zuzX839!(l79$?MuMO5r7#C7GJ6-0~#0KYxEkoqB+*XZC{y}Y-gO!{{s1zh4&?hBjg zFFtcd$Hk~QuHkNBd&BUiFtX7@py6}wU(@P!HP(L*s@6m47|8QwN<8B*!C=xbPH1iG zq3{Y93b1#nJoBpP(@zq+)F&HkI~<8BKskmz?Gr#M6EP6c;l(Bs%VM1e`hpvvxZg(&WZ}d+5zWX;TN=vY@S8p@e@mJz=ofbFg_uds=T-b~!FSu;A){ zz+gn$pG7y2r9Ap;zWXQGSXX(|IpZ&nm$E9JAD$wF>C=3mfP4SLiAR|p=MU0DR8hXj zOuKjMe{&5Ht?x&EaQzz!rLn$I8g6PL;9$oS-`(C!zril#gc4LI9N2fToPxmU*8p!y zi6a`)An^M-hv7X^L>jvm=f2;`379LNP#+w`|dgpzvc5}G^6-DS#ASt*Gq;VxtoPOHP<^Y}PDDlb#L zhjNKoK+Frhvi2P+3CSQZzgra$w7hZX;|O&c=XVx6xgWeVRW%11;xQ$C_vTdy z59@$Zf6hc2=dcd-$Lx_u=v&xJ*V1843d6qaYh>yGoj#Y`B+iym%2Re!a*I0ac)fY6&VWMdl1qHdS>8j zT{8U=XTQBJp+whn+OFunc+Uk?s@H!)QsyP%%B`%(@}9QzHJXHTi`^^@;y-XQ?^t4J zrz&_)`MUlS+|8?~dRT^Zbw9fPiV1C$AxwZWaJG(4H?v^gy`}VkEP4jA38=#!EZWYt zWM{_#M}+K72hP_(bAHB*mfyIz6Pxe;+H44x?w17WKw#MG59{x`VXsKGRZF&wd=cY> z`Ia%qqu)?}CpxY`+J{Drd1h{RW-qUv4ane%wisc$F!4D^H8L1PMESWoap~M)y$qar zJtni%OWf=*$o?*O_WOQf{Du?>+54YX@9eDqn=yffgPZ;T4{KlPN+-~^{-=R{Bt)9t zUmycEMgTVX@jz$kCWf+|&yWkOW&l2&ES+uXS#SCwVj=mZYb@Lww4RoEChK77ekc|3 z2JxB*t0q5y2_wMF@cV50`@QFfQu*mPi^9|0e7J!8P%5xYAhf#Mj^8}0FaY?|tRJmi z9*Y;~S?|Vd>yOqh!#m~rz`^iGYbRLIih3}GyuPEb>*%4`_BljPo$}L+a{~4~u`ncz zS{eSon{l!`Z83yrmM!2R@la)1^`ytoNEzTH*VleWgRG)!>@4})>RN&p6RNK-A3q&u zcwm}pv(VL3jIlRz5*A3z$;~6uF2jCCz{ba8*uqC0><^-H6!;c~R`mSA7^9_0!k)16 z-3f605x#QRv#eh)?G2#ebJV3LV}Yz7f)Dp?YZbu?tapV;;=udw9ilEs4nd0U9Yns$zcj}3dORvpk#Nyj17YTE71s)mNvjoVC;LS8^ zy!;F>V#2n!?O(CiU5JllVxJ|QZ}63LbyxcA~qMdE3A=7efI~u<6)IRu`Q7i5~ zNrpD}@LMzijuX%Q6Thy!p3d`^`vH8KT)R0+Y*uEUU|I%X0)Oq&7yH*R5Ph^IMA1=DY7)U6A0kkWC@PjIJeCN2ZpJtHWL= zH~+|cr%Lil9t)TcLW~?_HtX27OZuXBhJtLwmx&_+!p7T_@hff~ zmo5XB&pWwp$csJhNTl!~XatpUe(PmfVJpuu(yp8F^qfR2{D-~Dhn^mW*a}rx`KESc zJLsbv@8Xf$2(R7!gpp}1icuy1ldZo}4eoxPg-*awyK-9Lh!DEUMQHfy7Ga)F!xdSw zju2@vBgHHNm%+H|f9y?iIg~hB=;#9)akR2NL9=+NjSB;Du+y=LnWRBx=-&$&NgrzL zhDbHEhuN@GDxSr>fxWq&xM-Q{)M~3lCj3$!>bUl0IgNlwUeZZP6&i!#xyH!xc-urw z{~=ZsZ_Bl14rafTP;nRrCA*!sIR@TLj7}p=buwS;kbK#Yus%$e5?#W=6OfG+o2$OP zeukYeZp+D&A3(-pFIH-9{I7vXxSqZ-j2}0hhGrYdX0@W4W@df1$v?tXZofZW$*;0U zX`m31M`^!$1@{g+2gg^DLmYyQY*CIuv2bK!HgJ2&%KdKPWR@U#BI4?#JxxVIXm~j^ z>0f_!!19SpV%_6qZiX&Mw}sxJA`x`sM3d#jCyfnKo;^hiP76{2;W%k9(A zqRaq=Y%R`cgw4);@*lc7qa@W=QHh4xlUfZwT6E^$vT}JPI8rQ4xY zbH&aY#Q$8CSBwX6uDK?N^S)%}_Z75GT)*4$)k_m-P7^^iMJ_DS(5x=>tsCS7wgU(9 zN%V}|!<#pXtbm6e;%Uj2&&XP2qFZ-l(kIvF(_cujxueVmG$QU~MJiMI5K~^T$li%i zmNP{)A{G?%ZdTm8H~wND{taw5&u21H&M-w8Y0_v(vn?f@XD?ky$3EAs^d=Ums7NUr zFb*fx7j>o)?O%O(9n6k{+&^kr?4A0S1lAhb-68)%B@Gqt!VmxMFd%Vw7hL z1TJ&i5V`<)(OhDPY0mI)ADB=4xvKdo+~TG4ax&)cv>J@m8pF9TA|Bcm^K8 zIxH;mdZf?`);pG?B`hS0)J;ptqZ5YVtsHLe>luZUC|FK+W623^&^>WV@SfvB8Kc%K zzV{&Oa%qmn@y`6qUiLCxaXG^4AyPPg@1C_KU`@33O@8^AYqI})yf#S`2xm!H}z z3*Z=!Eyf?7lm^(AT(i}vm8voEIr6ZCx!_9 zStfa`5tPP>4c=oA3DT5`|6-$I%l5Pq|dN4)1Mo;KUz#hAT6pi3ZB%Qcl(|mrL z*)wThRyFryC}01jCjA5jto3+j+`j<95q59K`2x8NsuGp}#{)wVJw;}MEA!Q|T}~0l z;=o1!4TVIM-}7Ep}o4 zQGOJoX1#L(-_VO9{5R#7il2AiE>lnS>j!^ZQaNGu#MlNk_k$7^7oO6PIj33kqVxA4 z4`9;ShWDDq4SG%8AEAH}Df6IrFU*q0Lg0uhpF1U~g9+Can>-($7t5de5=-ciYCtm? z3aM`DBgFbXj!$ixO*;-N7JCHFh_12D`Je9m9A2Xq?MbsT9K|1sngnh#w;q0R4W>8H z@JeGO4^014vY>vKKWzj2ISqKTwiq8q2TqSKEZ92vX7+O1dSgKM;v^{3Fc+5f#b5Z}<~w zW*NKZ;0vv@g+oT}oR@;{`@ljvD4_po>CN%KInA=NF#R7O$<_~YP1=s!{qghkaG$9S z73tilk2T2A^kw>1n8y5l|HtVE_&7!(3zfC0Ai%AkSE^!3BMWWli89I$;O~!)40LMT zH~aB*6bJ-Da|XZ^1j_9M0zBULB>h2V_+FgeTMA}=w0_TEKNY(&$CqAxF32}vz(8>4 zPcGgsNa5e!4e$2B-hrSSz!i}Y-EmLx`GD?s6zUbBr4-^QFAISD|IOH;52Wb6`X#s5 z{(l*}>Dl|Hp9>{tl<|up=f*Zjyq}Dn;y>Pk=pU`0l-FB}Hz4~bW4F`$`S$z2tjVsO z1@6whn{|}P{w_{bXTb3d?(g8hcMqzf`_GGL>6^zhLv@k#JEzY{Y3#wjDPEtmi-wAV zvrSB@f`M-podEh7csW~fO2JSw1iGxA%`?nQ^f4yOK`-jeWd>FesH7I`Rn)+$%lYu{ ztR`(4&=cRgGVNT8O(cdJ@63sHvPPEUy`+a^O#;C^5Lmv`%)%h*QYzHjnGk58JnV36 zH!p)odfu_rfhPj;nY|v%v(X#fKMqF42rHwwWqko!T3FJD`Af|MJ<2$SsD{ViE{mSh%?SEO8dXu~k3aSm(G zhpT;yPo?@Bxpjb&l?YQs`O8 zT3S0g+QF)6S#%49+j_*;DLDTAVH*#nvHHDXD0`>>D!}6G6&5*y5>`TCMLcKvXOQ84 zGeRGbECnNkQyec&+jr2Yq|Kav%92ww6*aDC zC8b65EM;Szw(f1O!n4;{l(DGsWx3FX_%Edh`cW~Shzte9)X&E+KG}3{?+kg*4n!o9Nyu+NMFF1==9knmwx69ki*AZ??PdW5 zsxV~!qGxt-oL|R1{ZeH1?aCr~(FQ^V{uEotgwFgI6@)Az1~DqPd+4}f9Y}8!`jcE; zE{TFSEK<6wmtKTQRUk)uh#F8pO@$7Ufd}gef*U%LlDrh5jDurR?W#yM1fEWV5l@oB z&*D5hejV{O|9#4DO&k(U8=Qd0?gVi~uU~$d#px_2Bk?3kHdC~Vw@ZTP<>Ph%hM*ta zutj)thQ#&QKAGRD(VcQpTtOw=B1#1hn-1*WfeeWZODMEY{8XL3QIF83?3iCvj*%f|`5{IfjK9Hlao<#JZz zA`BtcVmOzW(=L*QjH^|o@*`3d$UBRQFa2}d`k~J&wer=3h8gI9GKm#Nx*d;ohNU6O zGU@{Qk|OInPRj3w*fiq8FYH2HkwDAXo%FR@%%iGo;XoeX@l$z9UtDInSbeYWD9P4$ zB}tjfq)DG6t}m_nC)e+56~lR8Z_xXyNE1Ka=4%5{`apc2 z{o;HqG4YIe08i#dr77thp~l83 z7%x!LNWJY1?BSa_4WJXA^2CTUA=C=sblnRT+ZlS0X*uc>Yia)9Mh#p#G3V*F)&nOK z&F$fim}-+BdRXAJg7s2IzmVu;UL;T$B>l|QEDd0+jJrDi{;m~JL+Pxz_1lEuk|j9x z2zRK}&_G||cwaDDfxDeRwQ4^-aybkkM!;q7Kvc~QQ8W9{^~T^K+4pO#pLzjrI;^|~ z{c9`5THy$zp^>TrMC|LvF^oP^mOWYZXah1m1f>nZs_SUpaHL_-z%-;<;?r9&of?!U zO%j97+l!>nera)q`9d(KP&}V5fp|4S7BxgX@zw=ECP7G6jzTnD(s=BMab?TXJEf`wb+omga0x+K6?K4o2sVtuiX7@0!}K#}5G zcm1{fR>4pWd=JLbMpHUxW7~|?Duw(|mvG~)H9I$4b_TxCuo@l6)N}88Udm*O=p~6d!>f7{xTIo_S?Xg+XlW? z`U{IL%M6A)tlO?~vR05R60q&v?Q85=lS& z*jX8A3VrKC9+1qu)pL@=ji-IkXW}~7Y*TrZ@xBhO+{6cnyxCM9~ACz z%-&tDW(Y^b0uhmJtxExue`(vPXV9X)u}DV!>(nH4Eq3|KL*6rEm0N$|?DfN)+(zQa z*&dnKp2OGFu@FGu%6Qr^J_|p<0jC}cYnSG}Q(KkvAdZlQ6Wl9~f13BL<5Jie2--cl z8eweHhLKC|F8g^wVah5vSH;gEu6I4UdUqrj2xN9O^&*a2?>o`!YLq4yG2za-DO+ab z@3o@(iyd?JN-zODtoH<0TF9}Clel&G%qQq6lpjGVe@K? z)RNKqLBY+gb6Ea>7%p-M1rks;cXv>vmv5SFHnFi}Z@Q)wr%oAtSE^4F4$#m30_^Q} zkOUCYw-MY=+iS$})=DQH_b9mV1fwV9ev1D#BLivy$%=A52}cxFUTK5kPR9hVLy%Q z;=4+#j`$rSZxtXdLBZ5;tO@g^D9`V6Fvw`@Rm6FFqFP=C-B|FXQd91sp z=B#GSH9v^9J2_WSbavQ?U?oGb}Y*Rybn{+%A0#KXTlhAjcDk8Pw z$Z&CalqD?%VVGO3_~}{$H~a#N6ZF8~1K^XaBj}V+2NwRAhogYX^mO2>KgYO?J?h2o zd|Hs-2X$$uMm-vB@vvUDr__N*P}NBc0OAQ`t%EGcrxEB?Aw1-*%yq)OCWTLGAex`Viq z^5(B;5pv`8xh{1l*-J&odr=9OJ1yGkZ4mvG-W}rWParLXK1IK$VevhUbeTF#QUlv;l#JY?N7|sHe|z2Bvh{xup3+QaO&-_if+KdhkF!Gpka^!Hx$#z$1aZ z2L|LMyUukPpd#E?>=M%ldznW*5*jfJn+xerP;LJhC|D#gT(DI8S`_HA)F66IbO@u|RGgZ=naUURn4gL|RT%$ukL5w3$gYhNFP&9=H<=^`hD-d6Mh zQic!gP;Me%lOcIbtr1*wP|ltww1fdHv4ZWmNYC8OPf|aDK19Gl>lVJu56RzDFCqUu!TZ}XBJi7K+&n7{`R*oAAuuoCx^znR z>upkTxuBPOjfs}L;ubb)Er?=&G3_0=8<@Unp3C4?n-&$VpZjG}?5XXh(MN3|aL#VE zRN~?3*_T>k+KyOfdw>bMIvUaxZZPi{e3B=iC>+~eiCTDouJpG|lqQ4>Q28blIaQb8 zUNU@G*1+ePM{Ymr^li`ZtPxKf3c3#=Z8nJiB9jwJ8GljZa^&#(r6FI|^;TyEe16h( zjDhY}ranx*uy_5)NBZwoqq~_TPd#QjNkxq1@fuxtt4z!^&sf2X`E2fO(uw3~T9Mbk zjQq@X!?wWJ6Oq({){aISR(m&Lz&Mi&d0k?4OakBo?nG-fFCaP+Cps3jb~@H-^lef< zWQfoi2?J9&Q_j&_W_$W{3iZSE%3oTYNlv*osvX|YIooRpsg{0RHqN<}P~tce7%gjxDOeaem?&H5X^-IZK*GX}7y&s$t|>g#E%4Y}`djF< ziCfvGslwsM4IcX&aLYbIc-8`pTHbtwoMaa z3uGNi|5%p)=KssNm*bQnp@~%JVf}sJXujJ!oKTj}d4T1)V%cq;A zot1JHbnLIN0Lm+@L&a|DB4}t%ezJn?iAJRk{zf5iCFJ%2-A$=`De}*nNt}ehQ!U+2 z-oC1G7|TC8s_!U(?XCB|IYADOOx;aQR7np=D10AR+cAeSXpJMSOc%btfdB5a?DxU1 z6@9Ok3l_YKttJ82nSf*u=`@1*0xD#heGCE9&#e_gUbbB;W)p+h*WgkUR6|;u0|?QqoZ8b}oFsTP{2Cbz4e`Z}tA%%5rCNkB{H9@pjPmwDWDd8iaIN)EwNexG zFy?Bk+(jKnCQXMbv+(7=n@rnX|Kg)7%ZV)rseNop&OYHTrt0hUFt)7Ce_5BILGabF zj*+X9tK&=-w#xT#_pcL}xIHHtLtA?!YO^g?64|Z&DbkRO^*d(gPLP(!_qfj8yb9EJ zV1zDFS!523TmN;;JcfQihM}Kyp?#XpNVNpntKugK_*0}Nv7W@bxP$7hY4UBmHcpu~+9@k<7qf)=n<{!l%V*h>pvNI8vy z-Wn%6+mvi-!oue_D1gTVH6_j(3!pS zEzo*ZZmj#y+X){dOFgj6RW{W>zvdN7IM#mUHN=;9cq#%_mi@&Q##kT@CLleb39D8WqtXN}IS0%q78R$kFn zX}Vk@f3&u}J1O@_1FRNU`ZPu3JCPy@O}5!ZX-)t(>CO_C@RT%q`j^QO$}FktthgSv zyfn$oSnYazykfGw@8gQnyDb9Ua2=(Ghj51)$m zR8L71?kv}?GJ7AMHj-7j`&_h5vhPwqG9>dzF-$`_&qnVrzrK_G=XDhp`G&Rddi_p_ zrMBeT@E$+~l|FIetjj2MjO6v}6NQ@h>ZDptF#L@NU6vZ6n$%}}_^QJ-Y2&hhiMl^2Ot%iq=g%S5pYpK0KR@ziFgJS;`d7x>6OR(GxG54qHb ziNtTe%X$kIky2wY44UyTd|_IbN@A$g^RybI2*l}!GDD6|OfJP< z-mApp*z7p4pagW6q-rgur<8$^4XJGw06*Vq4qb|A&l>nNQAVjB*yu#*rg$7~EL7=L^@zX}ly4 z7uc}9?6h5b2#&=Mu$m9)=p8(&qzKHBwsLWkpu1{V>@k;K4){D(wzu2UfE*+d690rSo8}h3MyUi#& zQ6Pd+ePyPu2%NYnNrdslc!2u&moQSUFkl;mh=bSY9`r2A;2M6J4rp<%G>M)g?)qoQ zF^J)!Kv+D>e1&`PaOCGQ2mZg-k-l2pWy2ZBsAVoIJ%}|wq4Pp*KSI0` z(+dq+#o&=A2n`7^EbqY?q0ARiM4_>0%jrwuc|yLEeUnwVxd;pw4!eG@&=aoGQ_wcO zZ2MR$;XZq6z1{dieig`zf~?(|GHvMOokkQ15bV*K$vK2Sg0lUH41$f)2`jUAYw+4m z;`X8O#p3PV-=H|;)EZp$Iw7cK0LB_*gN9doQz3WO90k$+TxKs%EW-`^HJ|7$Ke*~q zxqPxQOK4+t>BXzDJ!X&@)3=)&8?svL z)svSB%L4qP^vmEAxH-z=K@0B`PJ2^6VRUy(ptytbXApvqygtsEb-;ZtWq`yc9|z*b zgq!MZn<;=KSNq1J=xAbValdExM9V4W(<2mKY8Y-_a=tMi&fSBTnVizCO3-3@tM&KQ zZ&;&Gt1dWP+s~M8@MWRm8YtPobn|UPe7C@*r%_TLJ|oDE|ZiKm<|FNh0t=aYcYV~$%#sx%{s+r!MdJ3FqUrC`4ikj7} z``xYx{Q>?U8IXA+i?tybdVO_Iqf>NcVmIffy&?4?bxPsW$vFK1n79PqHT4VWl-rOo znNT*s-RRro>Rd*dazU6+^SHsa^*v|czyD_)i}EJHNr&=2_JKWD&l%CvsqF!7K-n7X{yaJcCobtt((^|F!IsIZYerD#i6<8A zyv;_UlTijWqNSa$82MIRAZhw4GA&Bso@zTnXu^~z7uM9>V?^qT5HX7$=sMz}3WoAZnKeMLffpc zfg4(R6UZ&I>a7P5slV%>6kX$Hua3v?n-6gM_uMz0Ebb3hz9GCkyXen5DM@>qT ze+z>*O$B3{W$jcxtH3kw1`w^AAGCet?9*!C%~K4dBd2mnw(exFiZiOp$d<~$OL0LT zu_7_Jz0BAPK(ysg4~}cBkfXGC!h1k>NB}xW7)m5D==ysm%vq10%cqP9l7#hwk6X{< zs-(dsJV^g~m&$THSDodM=t;Ycq&R3&K+{W}&z}Pp8(mFS>`C0y^w5=)9kF5L^g>N#qDnP=Ri>8(l|DK}M| z+LJ}uB`xja0kQU^#!2#`4BBg1{ha}@aO&=bkgC=ZjwUJ!LZ}5xp=EOckV?(G{7vx5 zkWR6YG==sNLXeL$<7_b2MiU|_$^IRTQjR7P#MX~_dX|PC?kR&Gjin^)jE*=J^jQ#z zINW_k6L?bm3&|{m{i#@%QP{^So;5~Rr)$PI^iSYtqh@3pu07h8uWc&mthbuffBr?9 zFS=qJ<9>kF-Js|2@>WSVpsJ`<=8VEuSu>+ugl1nTH1#GO!zq6#rqyxw$)*qG1bQ7n zM4pEHIw4QI@_-8g_CL4n`2vJ8oyHoxdY0OYa^no6Q=l)5tw_o`7mwdhNL6j` z(&1+^Jy%6TJKVjvQQwsGGWtjA6c0QH4l8D30Jjf7iW(AzHy3g!jz(nEL(&-!)}*^= znrza|Kh*Nhm-a1uUH664TnQ6oQv$jf8~tSm9$KA z>;F3~QzchToTy^0UWdCA*GLv8k$YCI&~hfM*k@Ui+eu_37wCnZjp1^G2WT7*+mS@O zntz97PWFKf3oL5bs?gRxU(qOAPgRpk-i&dUTbo3=$n9MTe>z;{*Mn?Cyn&2|?_7XB zj|3C-kMhxWc_X~0flVH4=LY|NszbW*3tWwBZPGfi7_dU3;Vg#Y_9O(~tP~Vmj+EMc zUnfO%kVoS6ULxQa=KDS-IxPo2L^a}yjyGEJRsY9E8A8;V>K+XzArXFRAVFq+y za^)d@uuy|#8F)xRxvg64WI8V*o@}y%x#_L90GsHGvNag6lrmkyFs+rR+Dst` zYC?b&Zk!!z|4faKPeo%oVGKP?CI5B4NQRdT9i-7y*Oy+Z^{RS@iKyC9DlX=D%)^hq2rV&rDN-$n*+MArd zuNjp{6|dJ03ffZ%szhgP!l~%AK%4GJCGLbS1Xfmq=KhLno3v4~7q}(5paX$5Y_3aC z3cY+TE86{PH{s*u+ZwGHFXE#{R?2(GU!NAe7?{fKcQhN(0Z_npnT<85>Xk~e3;XN2 z3n<^6%oRZzcYr=tN2HcoFq*EFC1VP`t&M)2HqopmLU?2oMK37ZAS=b>c*!kMleoI{ zPMkPa6atEF@J)Zl6=%Vbf>nIala1qO@uYTEm!7k_?fc7~i1{<1^d5z!)FP>W>o(5q zZ>hrs*AQwezNXKrwJl9_hMqTJ=?n;`O_6tl(DwlBwaTew{Vl|wazbI#@&?{*ga_I# z#Z7U!?E9T9dNXh~uQ5WrXQwBs3y)@z<(m=`xL2M72z9EUBu$$3gHw(@>oytl*({7rO(u1C&F*y+t@+7OQQLtjL(){ z`8j)^GF=1IDH|r5?-8=MqXSU=8_rINjZ20K%S$=d_okyR>RSu(!VN@WrXcB&B1%m= zNk<`KwBF{i?DJ_EHkf`9{S$v#yVtm^<=ceJ$hCes(qBH7O+kroeh}0P`Q2*KU1giw zIxAV0xRmFA)%cgvt8Pq?SmLeD;L#$~igE-RLF zBX)V~0i(F+DXpZ*MB0&j$k{HTUM@MwtUhrxbXyORf}H-^oj}(2oJvlThXy7(0hf@s zoch~1=S)mw9Mk)fd^=;q6Ou9dRDEcwyZ3<8=~;Y!Oz)o=iAyySh=8cR%P7wMa=Rr{ z;mYG1!$MfHu-S=mDgZM9==OI9#&wz2cgBJU59tK+kF$@vSF!dRCHGJEzu%umue)Mh_N|^ruXnfV zvf6ctt07S-I1Sz#-!7)n6EJ3G!x>W7(l;>6r%o^L@XPA%uTimn{QXixQa34G*}Rf-Uf3AjJ}0j^a`8V# zMruQU&@vO$UGo!u^1oe8cJB$Im`xXD`;WKN{OEiB79963oORJeZpqJ;k5=o|)&kHK z9+r$lhT(peUUWVxQ*IJkp-o48kb>HA+RF?Ct3{he0z>R5k3_72R}4Ay=3*;~|i1o1RjMO>9M7sQ+;pJ^i7hI9}b` ztX&PI@m3vEp^%suy%^Nc9O@;=sE9ZgLCbAcSAnFZuvIPanZ?^=zdsftFqxQ~#o6SF zSfPO02kSTKxFJuwL5*Z=nn#fd-U9)~|B~i?LC(07f#)1HPj%hfm%S1?P8^aSxO&a1 z#@1%Kjv8Tb=_ax$jo)h*M~1*u@I=)J6W8(~;j>V94=L!9xr5m4F(ZViwdT~8F>&s3 z$G)>;-5^6R5~-g?pV0zC#47?(BjUbkEBtM^suxU=t8n(jWwKB+bXKe4 zy-7QAG)9E-f!Xdx{oC!Tk4<*>yVWIjSeG;ZNKea^`{b>=XjHoUQ znw1fAzRdkzxfR?XuCCF9RLcg!V)29nc9<0LIstdBN9eJC2v`+gMW09N->-1283kSc z3mclJ-$hKp)ixbH<7I@;spgy8tUKYEO?+X|wTi?sKUuQ0O3m?WU?56^QoB7xgpt#- zF>DH2Vx1yF=(~J*e3NbQRR=Nv+r0fgUsk=t^u@bi7>x3dC}~diT~h#Fg+FnY!l>n=sQP~x3+et>;lY|R zQ&g(JAUoxzLihDl)U?!AMpE?{vmqsY43??HE8th2sK>}=Gxe43AkrB~+sB?0ULueB z$H6y&@q8R`j9y3QfOX!`ntA#^O5%Qr=nn{!Uf+QT@=T zl3SYnE57Ctdgcr@NH+=L1czQ7p^RQZ_He^;)B!e&3h`D@ieR+-n-r^jWc0<-T(JX7={d2Uqq_87IUu>x> za<)=q6REjPEECE0`^N?5>m1FnSDTQ)a_;Uib*#Am#Yrq7uF{yC@1MMq@hs^BT64?&q?(owF`ynvkIH zopC8RBL0%`cLiO;L363CdtFpUYUbc&X;FL6$^7Sb+ia)ulCQ#XJGEw=1+;hBewm^u zGLVc*2*#eP?_|rK{VNA9eKbaeS^~eSZ@Er@jo>?y1hm_-<^+~VwXF*7^iM3(jUtZ( zW>K|94jd|}TOWlGBJtqpXw<{06mIZ|9`y{hmAl z?8@0#Of6rMiT-J) zi$$(Yc}@@!biw_*UQ>hGBGq#py*FE|on&$r^JDfzkf<;A>w5d}8`a@!3g*q|ZKf|P93X*L|nTy~9n)jT0v z>$3m;@~6Ze<$^0)QN26{b;8Jb`fHAt|L@HP)DD`GkDJ{a5+=7blTQ&{ylgZ&B+R=l^hLFG# zS=BS9|IEWOXTW#FQaL%%H$dX+yEz{oX>wlI?KMj~HyQRsqROZ>dEI`lBUPhHUrC#ZCUp{+% zoi1Y3zw{c>PJFLAsDb`v%m;WIZZxH+UH^0<>vZ@Wb3hsU{4Wn}G?hHxwv}>y^q7tb9PpV8^lws>1?P;Hy_b`ahW& zeK%GQUe~7ITwX|V5~YcQ&zK~7r&HaX*RRP@UY>-o_zYpye=jwIA=~;`=LYcLAtJSY zH)L}uziUwiw7(&qLby;+@(xu3kRLlC_~zMjU%{tOGvL23^oexJv>WO~6ynFsxc(|8 zk#0ZHRTWl{FDN#Hh*dH7SK+;W?zb07xR#Y+r$2;%giaa6EjK=~sG~-vEyKuvYx0SPPg)^PyFXvmsI+>&Q zg87(w!kTH3 zZ~sU5+502>9CY_xcKA%M5ZryP(<3LN1F6k6E?RlP9t$C(W`Zyq*?7g?WSiDwz?&J1Ha)4*b7fG25s9tmBS!qx23gEr#l}SG*b>Xm5R@k;UjmE&4w+DECWQ}U zrg@D?=^A^BK~IkPLka;YNg5Cp)5Iia==gsSl(%6Fu*d?Z+k0|r3^Zq=?>+&~)2{B} ze;#w&)Yt=sdvQ;jj*MIYEC?lkO>>w@1P<6lsiJM!xh%&ym2u8{j!jAw1r{T;lT@lj z&HpK!bePG*28X|5V>sSxP*7;q|9x}Eh7};qk7_4ruaqjfqp+%Ji&X_l1&z6NH@#~C zhHvdD+E=OXitbRb@1@?5(&-FC++Q4Kmtg4b3=W-zMM7g8Li3Ll02vkQAd|h3Xb-(+ zZ&n6_(j=o=Uo&dL2~6L=TU)u(y5XE2W}o62Nv9At*0}oK2Q_bSk+E*-pn?IV{AAo{K~lHYrYC1Bk+^$WIrK z0jvZ|6;BS^i%Q-t1E8{2+NV`styaVR-Vg*%$G9hvmv{*5$9fIi14SIPelRN{A@{}_ z`AUwc%09-;XutQTZIBCA6FNAkv1fvq?L?mG_tfenh+bN|f@Or6NNm6d~5*a6;%vwlNiFAQ%>MF zpOT`5Jfak@HHU?1*wc+CP-gQ`2$6{>6r+NdWScW@;%&+VhO=tpZ;5zIY^;!y=Sv(s zyM{ZH+F3gb+XiPEAZx+Rjl_IUl!@SVjLvLOjt{Q`hSl&487~=X{RkN?QPw^MfD!x- zRxsAk!V(6PD+?6@(rT(Ny11hklu{vS-7XOAM#VchuoTIoeby}=@7Uw8Co#o(#RpMz zF|)=2P{MW0YnzJ@0#kxUkKfP>2%T)btdgyINLcMhPIIZoRK9H)=9H&bCOi^l!F>%| zG!Kq#?=UH{?4IRQ|G)hJ^`s-Qs{g&!SKF1#0UH5m?vX^TWg^Y>(B|qEUYX=_2PLeUM3b{ zEomar782&)ER%9-%vcE6Y|aUr0aK&K-;|1)q$WsbKwO9^e?V~!m(>>wi4-pRLNkiL zUsYUO0@HZeQ#atd?r0mbK|0k9OFlf`p7ehovn>_bCTL;sGhUyyp{}%&BH<~*S<>x+ zlF@J9y{*M8>j>Ld_+)G4304VZbQhx9lHDe%h7V|3)lNn8P%=-yNX=+JW4osLE_bqo z=b&E6&MLg=hK+UmRlW&UGGe{!ov`xjEX?t8GiLS+x_X>y%lYRN>$9X^C)tbJWCx|{ zvf1|~qskfM#`bW-VtR4@O>!^>cN%sW++{o@g#G$1!+lo0ewgi~TAOI)apv9QUX^ew z^|E=?zm9eHOvWZB!je#|f^eIR<64_wh3|NKADX?rxzlM-dNUHek1v>Lu&#L|WYR4% zvSrLBMc@U2XBikpob3q(pa^DZ8e3{tH-k?><=H5az6VpU<%zdZ`D>p zk)^1Hx-^yz>oxe?7SG$Wb#-zIN-vlp605nud0hE6?AfS8{LsDBSVm$H(Rv>|QvO^P zHW1A+Wpj$_)<(DH5hKJ`WR-LC*i{5BkjNNH->9%cQ7);KfXBm{ISUtLG2NAqK2v3) zE^DQT_2jOabY4$>tx3QKF`EaTFnk#JKnmz)<+n#}>Vx`lfHJ!6D@=0qIIMP&Xnmo@ zc<#9IaA2_DJ@Oi3kiwV36mU%~ssPkK;p+5dy4DYRV2i#SelqT%I1_H-_pb_|qg5`g z8ejdXbjhq}ay!1^ERVg5bQe4GU0=YX`o!&l*c6Qgur9sa@+*8U&-sdL>hk7Eb65sP z?55|7Yg}kGoMy0zNjU5MQy>P)mJc!G6$l|tjvqyUkdwH;k_pdLq^+v#a~6x}np^TX z>oT38+Fn|4TqeCgp3V%pp{j-^$tgxo!U5IU>v`0%V+2@=vNi1sUZUAxu0{uB(wtMK zVP`9k(ZZVwS(Kf$gF7%dV%*|7aaNMQ@Lgc<;nkKX7%2$SOIMR&!|fv+#IHCLzEQ!A zaV&H-(L!7*B_fe&;YitXXvJ8LDwX#)hm-%!tA`&);?_G$)H|r2;#7hpzk@Zwa1U8@ z^XJ$K2y3OpKX_CJz8z1Mh0|WM3%w^v=Tb8Cb@Wf>HjjJHu9w2k5TPdsIxMz@p|VPh zhd?{IQ7aM1#n>a)=06O<*p0<&WX^&G=IB`0frapkGTh+jdYLFtEW|dbDUh3GvaoWZ z_+iY8z-;tAz{`<#Z*?VrjMa3V#g&3!>a)*{@?8jT#CyP^cn4BVL4|uRfnx*;J**QB zx$)52Xsrw&@Nf(03blFKT}|s`DdC(W3Q8UwB?>T|0KJ0eNjT>dD-BfX^a^8L1phoT$MSAfj$~2PnXmfL{Qk0Nl;=sgSPQz=i!Sl?b z++!lS#f2AMdw43(f?wAhZ|7RBiK^A9;=ca7+%k6=ijp&!D>`K9hBBB$ym330c9RA4 zJT!-zKS56)ST$0d_;1(Hf}f2)TsFs8ZJcusFIT-jfD~LUx$@T4TpNBdm8J0zc1F{i zFBgS=0kYD#FCNv9E~f*Qs`XNn*0ZhwC6DBt-^N?k;`a#ov|)OS)V9+=P@p@d9KoZ` ziS|1$_Zj&a`O`Y%J4^R5JV{s76a>qJ&GE$p%~C+$$Idfzkn1RKlStKRF&Sgg-R$63hnT6ifjky}9u14Re;a=F3HV&)%6oph5cX@ZebD5^6QS~d zGmFh>Eko1-9%W8&+PF_@>`qEI2m3z312 zg(oA!5b0VJOJ|!de&>36&DJ^WN859j;TR=y9)nLAa9ICRa*>AbnHrdjOluey4B!CE zrbH|?5dyc)7EI$bL7{wUAAGL3c<1#?L^g6ZkW)V`@#)ob`A{7AGm*(RKDk*Rn^0HA zpxnAdlP4pdNxU;8RT|tR-i=pif$& z)aw%y7jF;$kcy*qT@+AiwbukS*F7nE#v3?iNE#Tjrc&X+6^D3f6nzwvpZzCFwFtE8ho%fh z;OwNmHFX_dwUKGGZ(rvS2Ub1O7|w|6W_1&kCkX66V^w@Kdc((YoJpQ5a58q6=CRs_hsZkB2-}$RLT2EI%n{q|g)NhevSH{Yg zieDpkzm2hSSp*jjEi^EP+Mn{zmmG14|1~ieC#tUTwu}k(t zMMRQojxPBsTY1%09A3B8`GSH(onU%%1*bN}ZLcdjA~0m`YUE4VNrwCoTa0T zEX?M>SUx&2xv~=?IqEpEci~^BMU7gQ;4fxePd0eS_iD>^{0jDlIGf^j6p*frQZiI` zHW@4VGv!=z1jfs#?u@cef&dxi?MUeqE7YJ=N^_7B*A$~k!2qYuO-T)iJNa=Ed4&QO z#rM%5?L2O0pX=U36}RVpej?S<-Zq`@R5<9gJ(Mg(VZ;av?Qf{|EznYRO%;957PNsJ z;syJSQ1P_4&0NF+c za#FaE!z7pP_kzTysUq%(!EuH>Vf}Y-D2EHcDKp~k4>WLxNEb+Ja6}5hheWOCVQC1; zAI>r!^zEZqbp0}&;_Znvu~Z*hq4Obx+%NV9QV2L|)vBw=i_0OCk*!?fOO=^d9k6%_ zd&wbkKT&D& z8RZLskxysj)(!!1u}Q97;W9>H^zGnZ{6fdtY@68jCJ-WcaRgb|{=2LA%$_{Bl6zOt ze!QI{9-V)j}?KT*ngkBXs1yHgVIi43y!p+|2MA5lN#@wSpXN8Zcy3ef1%AHaFR>B!yr8z98am0@DdEeEYaH)M1 zzo249ut6sC;v}#YDN|S^FM3Xy+7Ok^F=&sDIkiDe#j^!+5( zHN$|&^?1smR#S)7Tyh%yx6-HEdL^i8^Tm$o%jJ-)`euyquWm?+qU;3~4Iut0z&~7u zNwH&Ik2_alhk2kR*(-WSn8yg<^f8H-lOHwHF6(^~=`l)VxJ}Cxg@ApccxCk4<{Ecf zSloj7Jfe@kOj+8#n*K-0Qj~KWK53>iI{+flwbQ)$Xxn7K0m=)XW=_VHS6x3NLU*q| z?~s!nlowCoXuX9>UAXWZ2)e)~;2=pP=-#QHOG}78DTgDNYgI}2pwY)WCs2R<`b?j0 z*Lw;;d@@EnafUm#u(~ks;1KBI@eU~DPKK!-LwjF=IdY9(K2)40Uu5`0S0*?7`7yN> zmfU#1#k(z3F~adSof@y_PgO&OboA)qB!jk_iC6Kc)dUyOqh^Lf{q=QTeJuU*7sL>q z%*TLai?FrT8PmVDr<00Bx={8lZf~=@<^ZX$GHTs^B(+p6bV7fK^qCM&g0R=E+O~v~ z1(kixaU@W4L&6?$i(rj&4l0SW?N56t~8 zgBN3Ed=_0-wG!eq|257%Uy?&`%J=C|s=P1)#xa9pNCs~79n~+kF0uJ#d1J~+maHNY z;Cza!CGfqwosCuZ-)QBW|GU_gi49)tE!#I*|4vHCe`# zsp|( zwIfd?MNZ-ON8m40H<3L(WQkSj@wyKZ1L@mD7{mwh93xF_`!cb z2q#zuhWLIUgfjmZLU??vNAW+Yt9+x7wKvSc2Qpel5Dv53JM^{N4b1nQM|r`+*ZW|x z&e5rW#_v#vkB{}@X48A({bN5lzdT=`YP5Ar9fbCJ-CRYh)4)0WKJvV+U?=hUS zsg57&Hdq0e0^1vun@Ztf{G`$2k>UPGe#ZG-0+{%Ly>&*K29q(#n7YWCxrWpp1l?~- zEZ9E3bJS%=YL{kGGvsN|oK+8-NJezE_HG#oL> z$N>L6L!wi0Tl6eEg&uT{bQEvuEF55Z&MEZbq-Xk)h0-(2v_yD1{$N@5pd61<3l*sf zeW&#=0W5Gg4;AD$k+R~icxg)L!dJzhqDjm0ujhyLs4prEAZbEmJ^k59bsmd=_W-D% z1~9hI1{p6J1Apj~_|DY^;($}IK+K(1!*)d3b9(FG=XK3i-&~=g45p473XH=aerw-2 zC@OuH$^b!VbX9;5;j=lH**!hoWC%ZnUKQ`U;z!#l+DAGNpIr)C z2wEC%2-@3%r1B~j0*T)WQrEi2<*-5@?s^eV<@q2P|4q%+G94UA&1osl1!!0X#laa` zd3i?G#R`+kpInvw%fejG7f-Dys^$H=()apmD@r*O3ySU~)joGtK@}1Uk-_G`vjO$3 zS`O@TM1G;|VMs$fSog?zI~zorBh2aV<;$gDC%;y%$Jq?yWua5l7!cA`w9`#bqB8JA5;H;?6s z(<)82t&DK!8oi%7sVoPC>V4WLoJ%A+L+bk9x~X2q8cQ9UvLof=^a0BgS!6`~$|{?O zQJ{FV3lQ4~f5YM1aA{c>8D$xY(RdKh9X2!v=ti#)C$=)Gf|aTb)KqdTPa;(4A#@8V zT4#NV9dAlymZs9UMJ?wr@_HKOdQ?nLl23>P9~`b^n8d%N>I@+pOLyS>HDpWadt_z4 zb;YBhSs?niVkx)v2yih4zr~@Gs2)V{9nM>rnX@b|NOzLYZcFkVFyq#H*#~Xuv9Pz5 zE<~e{bWmmOe`z^a)X1{(?!a$&OTB_em@~ycpCnFf{%%e#qaJ`4z9Rco`#4Z2^V&b- zmTB2}CZWPT6)8(HqiABWwhzMg^p6b5!GtEDT~=Qrb9c-qIyc#&wl8W-uC z#hgG|OQ!%f`=~Z%8Jp8A5kwgY`589!+f-Lkz>inMJxnXs>gMkmKqqk zCkQf%fGOT(65m5O#IJ4*ccbIWJm@)UDB#0^!9wm|7^ufZ4G%CuDt!b<^SI3E1a=Ql zzFm%!iX^zvByo@CP)i>K#k(I1bTGc^Jpha3oWn;3UU*oQeFKSM_SN`e=&pfl7#*j~ z_SZtr=~RwsV9P9S_U?(=$Il&$_3^9esz0)X1=UlNCNWbzjdzr<7mUB^tIsx~t{BhbPWvy#=w=%oz5XyVu|z6X65mqUd9cD7hxBtlA}eBu z9Z3GcLtY=IG7rfpST$JB>SWcc30um~F?-u|EdNeG;IIw&)8iW-r-Jw!r~FUUN(zk+ zFBMuW5Jte*ESI%C4Ej2o7`meM#CQRjlBb6lGj9UU6b`H@xc=b5TqOYQO>#s>G4P?&+M_pnoFY;uhPvp z*neC$8LL^XMo9+%{)$7dVVTuEMGE;J@PnNbFj zct;pT*UM)F9g&BqsaH9`)Xo(HNk0Q?6>2~!XOxj72WGMmF!&>?bnJRSNBllALSV^&T0!pkMGUxB^P3l%?goUr9g`a|;z{n3a}X#0tLVmPT#% z=Ve5`t4&#T6)k;#vn-A`W$rRrnxv-;=pFL%C+^coWx$kxT1gBDnMT+zN_#$N!7x8+ zW!cNO;KV*C!aw8VUhswSNiYbr3@q|^7SPC@o5)P{GgF?!eYyO}+p0w#?eaG3bUvgp zefdhLSL%1XCzI7Q>Z=#GXLPY_3vJgHJb9n<{gUElbJ`B-z=X0^c);!XeqCNmyztv| zVG3jc@T|E>rs03j&~$yjm3;$ap;LGNmuQ#se--VrFtYy#2&4vQqL!w@A+PQRp*_qD zB=JzBcv8G6>)@)8);o56)fhcV#@ElEIx?{I(w3*=?$Ln*Riul+{%xOBj`%ByqDbmEP^YfvJPl5>y>ELu^-#OKFu0N+Z^PpN*;OhG?B+;WvWK?|r zv0cG|%Gw9dm(Pe9v2XuksQ|&P(Hx2QVXaw-3h+aFt_gm2?#WA9Y(8+n`2B&*aDvo_ zH;Z~3Z0?RdCX%l>LeGR%%dcKg01R-pe+l0X>#s!7`K0UUXnDPG_g7a&zi8#qn>vD? z+-UeDRB}c1QF8QOX=RuI*)3wnHoKRvM322~Uu(y5?{9}p=bNVofxY-Fz{ltN*yO!& z*YNf?*XRDjI(xH(=JLn)vmQ9YcT^&goT8kp*9aMjtr2t|#?Q*+8J92dt;uNTqoAq> zM4!WHMi+G+rJ?R+TQv=ZQQ^g%OHH0B-9$%wU}O7QU^R7hLadWZqt@hR zhe$wUlpqAPQ&-$EfhtYhTXovh3%~@0hAw)6rLzo5{`tzmrnJWt7;DnSI3#YGS_whY z2V;p9JZj*=tesq%`i^t^&NN_iDsw|4 zEd!k495I3^h{jqlWEOk3(u#1t4`6@FnMF37b<)QM9qmWPh>B1Vczb!q&`Vn{c$h;I zpoPQ01Rb7Q1|#!1j1dZ^Yq7c{Xb*Q9y`Uz?&3O1r2c;Sp9uhsFQpi~HzSsB!nsUPa zX)c2ne(~W8bd)<#+Is0ol30<@gI``JmTQYLIiiht4TO#AQoXr=`inmc&Z&Zvf`ybO z#u9exinowCEJt#LwB+VJz$>i~stnW87#@%QMy50^N-x5SHDhi|v*`stltxr@PX~_@ z;}1!46l;ppLV7v(RzXZk8_(?L=>=wa=$|~g;F_^HB&20+?|FIvN-g9(Cc5)zdo*Fr za0ND`y(-a=Sieq8`$7qu+ukHb?Ci{EKdjy4T4Rb=vUS;fHgs_~>_rKu?Xa)HL%4FX zlygDw6=0D|LJJ8r!j4TpTvcK}X%j8jEw2UvU%DN`0!1h?CS z@b`GLq(3-QYQ0*{ap~E-bw>Z#rD8B!5*Ot)0V$_)>90YJjR*woo;Gv%fkQqa(O(6b zSj@9h`xzO-=>0yA_-%p{72;|F_O!HKj0RxxQ>mI2MqEFJLtv>9O0Hc>=JOmy=GR}- zIW<|vu{+oq9=pFvaxy?BqgLe5Kn-da8+uC_5k|)*NTdylTjVDBXV*G(+0KaTir{-& zR(P{DVNU%)!pP(oU`tuGn}Jl>B6>Mh2A+A)c7*nc)E@buPwdmujMO z1Pa=AYM>r0GrIF@u9aNGUo(QH0)Hz~cwVY6RVkGU4KVxa2Oy#;ZVu+(kcC_a8qvGG zO@zkv{TOqC=x}9@{XJQTr_LkT|4K(Yh>?Nhh(LLiGYBnAfMuD1uOOUd>+rQAK-`Xr z@kPcUg6p*}8p4450_Hn0eI8O>ceXbT)pkVydJ(y+JYFgz_BY9aGj42D_1}!tX}O!P zp6oNOp}4rO^|6U`Hd)vtrL+V6Ka8DIVlX z)mwn8<6t${NtthDZW9nzUU4~nm}>t7?5tr`23}vGggd1ns2+K-m9nu|QPRdvreA-O z3UzNOlH&2w=h61te6XG(i&{RyBo3Px(M>ZNjy7Kf2zrDUqXko`k63Y?Nhd)UYYk)<*b|GFnYQd! zeIBnO5&V^>N+%Zt7dDk67Y^D}2$e?c&6lDB^Mm_9Ywc4L^N5+2p6p$Bi+T>~POd3E zKC1VmeT^y2H-VHJvtnZ8Iz5b-EEm-)E>!aPCBDx68T#aQEW;xGOM)K#|v%Jo5an(Gd0Jcx=1v6C9Ha73^m1D%z#kAs^I z+VLSle*Tz^V2_DmGk{?kJI0RpAc~3B^K`d|NI|Lkz=ACsClIPL*e|;>jmCAx9;**R zj$Bjypv{~I#;to#cnD^azghF)&AYo(m-PUdaPn)IR{kWrzRICQ>HcVKt@Rs-WdbV4 z!x`wvC;>a6w65Rd@9?&y0CmPf6sj7_BJ5Lp7Ou-yp!;KTin9)GmDTNxQ*qkzM}zHU zG=e;x1J$X)WWMvk@HffwOSz9kC&-rarM=IQEXW_sBMkK^JMh zgu*J*$O@tQoQKaNf(_krA_j$&p;KLK66@WJ_hj2rm6zH|s_afHDWyi$y z8R}8q#KC=qiOlo%6P;0-6WTo-&7X!@=O!Hi(y79>N*Z2xVs7QL#oUEV`pRlX*8q8` zadX;LYgwbhpOtW)+Pb&sPq0@VW&TsM=*3=c7#SPb?+5tRSD|s5sl%mrvdFpz_4iDh zxHRnI-6LQJBT|Jxf5{G00o@YySP*te6YB*X95r!DhqE_-eN$arewVBHO0VpQDRXF& ztZU2t8N9G^Y-Yh%p4jpV-t+T^nJ9aA?-=ykHNM}?(4yJy3yb#e0`jHU-E4BbD~%h~ zmHQP!_aWu#sF*V24ShpxlSz}D=qjD>WSE>YRuMNskWe*b?^qpd%G>9bW}lvn1*ZQ%)wX{Ee}fhCM78HB@A#Tk|5wYD`@=nwYs7@|eEpPe|fG-=e z3SVdgJ-rN}tI<-B;;@As1xMvg-_6a8&b%))1J1#pal`tbTsO=5fLxtfz*7w|j59URi{ z##gfhzdTW(4FMOqYq~KZ=JOe{KWjKYKCdQd<11w+a(V=9Y1HM*UT7Eg=XF|>wlFlC zKY_zx!&NbwtzAFo^q-eM-@IMlPaF4x@*clte!JFrZKT4Ok+o|IFlY?lU){}8pAgvg z)&6dat_AeLIelL4@ZYmu|7^;Jws!s~??pa`hfgF1cIIw=@pktJTD=~$4&weJf6&TsRi^Tv!()wn zo#jowd&dp{={%=~Sb*Va+l1S5<9vISZ_+uz%JQE@<9sf-f{49NSo zsh|*Bz))}{*;tn--jdGTaE{-3&~#P#vXggzZ*OJM`c6tQGZPntFbFMhit@;`Tuy1G zns&txy3MKOE66CJpJW;za8K{LZsPL(T6w1!m<$x{e@sEf*~8shEwkRV{hkPNabGOQ ztb|K>oCqenDJDwpwo3L?H>3rGl2rU*534i3>Np$Qr+i z@u0<7JERIIaQ~uV8(DdOdC46g-3bi-wWy_!(rGrWW)mNuOuaNE_Mnx{+S9H0$4PT$ zz)~eG%oTaB^PI#UJbR+iN?yEsf#lM$gY$YlyMi zrzhy+z^2gW_=cauc??b}u zz~6gj2_i**-`X5POM}xvQ5mD%qU4WVT!EGiEW-G!KMu6`!cftWIv+Htq{Ox|kV>#U zrU0vMh6<8-;sp}cnGmQJ$(b64e30K zYI7?p2cyLSC8X7K(tENYzNQhbtqQ7HQrL}|n>p`bj(XaqoP!Y#CvagVz9Ro(G^rga z^QAQyVSHHDvk?%K+pukyWKjw(&1+w!k?Y=R8k(?tl6HWRRE;T+z!Q~tUIvx$y6qWz z#>Y~y&1;)@=~aH4w43F2Q(n!hd6%LBq&-m>ZD#He|9DX_y(|(QMeWaZ77+DWw{sm_%qasx`K=Hk zc}V)NKM<~~Hd99O1q(=L&7$k5S6vT@7AeKfzbAQYGpr&K_$=d3R4Ty96{}lz%Q^_h ziOx+R6T~hoZRyZL*M0-xdy5ow&HRH5O79!HKr<+~q`1|t*?#5Yv{JO=jMauH-GFDOC_zrG`+_AzUY&VRPs|LlBLLhU=o z$KC5rM5qjqIX^Bk7mS&DSF(`q3;|*Tp+_4+!c0YyB1@yT{8-}K zIrt#Huc5A8=MLh!vM|Le$p11YwGMU|JG;&U*{KvV)M_fQ9|)yA(UCpz?}cr1rC3$+ zcIy$)GL?K=M@8L93-f3c^#M1`&@2vXn0StDqt;?NB$ak!HQb9c4rWd%vi1X15m{6a z(&nkJZGcGU7Nf>o^$pUd%*o?Say{65J8hiY5{rw?_g93n(r=yPMjz7%DaA&J1p~Xp ziPC&O3c$K$rdIY$aAHv}|Dcqh#}FJ4Tq_rcRXYZb7nF37XzqDv=@;`2QBWs>&k)nB zY96rU8B7WGT*TjUVxl)POsO`2cqufDn8p~bUMe_ zAwNV6nK<5d^NKXZ=6wukn6#&T&laT!f9 zP2%I_x@2tE8CF<2;I@Sz#UKxP^bTc2fV;`tNiK$bxvMzmIZKQDn*9-(-&Mk`ut`W? ze4-(;xYJ=qRye^U8hpV~Xdv2aXkL=6m=dy37wU525z2t4yc`|l+&uXWx7WsP1#AqM7>oJ&$ z5OWI-Ssyu4EySr^h()we87$F$l>)&QEVW2fa(3~IJ+bMr%3U+ryjD~h0I8w^iIxsN z6f8fEg2N!ohOkELiRt^@AE#gDQ9g-kuEkoCVXcz=V@R7jrenmFd1<6B0j?9Y66dx! zlWf%_$a4l+RbQm0D@>18*z@d>+qZ@oOr^eS8D6ar7vcwxlZi0@`x3?S#m zJc`qo^Ne#kLYL=fs6@%5i8{_s>uc~v;XdhvRO;9%O{4SHnc1HS?>wCS&=fXf)WuIG zXyS=;`4!TVmX)SWyei`c;}GL;T2m^2wT>T6V=$pl`-n!C7=Jlt6AP?s1OS(G76p#g zyK)(gs*ptK!KSqI$CLS*Dk_{m0uL^`Il>KfIk_wl9iv;X80ys8L*7A1iME$V0WWgZ z0iuTwMKJWj%#J_ka1+IHT=iolT427M#-C+oREj&@5g}1cFc-186zB~qO69o2*gY#N%(#SaT&SRe6T`cZ1LC`wk9&*pu!=!YPx8Dw)%bgD)fZY< zDC~5xQ}ZlM^=LsT=L%W4`4;GC{1E}SWqLE=lVVcQ!1HTUMUc_H#9WDpuvLv0z`yu0 zarkC$B(v2i78yDR42j8Aiw)9f8 z>b`ysj|V&1Nfz!rL0s_qTE|F#yon`gV-pOwFO90VL?ZYq#lQV{{Lbw?Phs1c4`$11HCNeOc*b`z{ITfjvV7T zGFiTD6Gc`!OW|%4p>s5HTq7RZ(rd724c*v0$M~JO#FAl z9!e4Vg@4O~-B-`&c?r}#A#fjv{N$8Uz9+?H3*c*(2Osm1&7(%|3h7Y|UtCnc4G2PCB^sY(z^jWJxG)T!%1 z5OyPM%NYlv8BRt0h6G$(OfZb*d3BDWyX)BBz7%du zpB!s&cL0E?tMv1Ph=MU;yolz{jy|C~e3}eeElq>V`~Sks`37~O_AZQq z98AeJ;UfH(1(xG`#GWd%^!{KM)a@jKAAcD@&hMR5ngepudc80Ho>8qY#12*JZor~kdMpH@Q6v8ij#L0OoT5irKIoY|kC*%rY}8Nv2aephF=b3pP&Idl85F4_ zLyuyFbdZoiP|z$jU{BmtQY*1) z)veHWQh*i{z-N)h(YE1E*Ekvy-GGI&HdU)X{f+s>5fITCz38CLQUy~GO{=!_OS)t0 zul~J-R|>~Cej9TO6blc+nkn9ZiBrE`hRhgHEIgSU`rvM($eB$fgRvnf}mt}ldmJi%Zx zh=bO^Ao<}YcKqm&l2v$dRAt5jtp6mXA$

{Q}R+1M!<(L6qer zk2Bg95d0BgCz*REz?IqaI3(2@G(D3L!J~RQ>zlFX@Y|ce*47&~IwUmIFGcW+W|@RH zOhTViGdf~3nseaCQzCPeJq)Hy4N&NDEf}qw#am(Fqh?l_X2))os^@?YG`On3>70c)K16FQnQ>y78}@H#LXU6z zC7oUIdtDA_{g{QGZWh8-W~Q0J*Klb z3?~2&2y4ZA0n$dfJ~PWs>;2Mw^^Yd}{sEp0xV9lbCf=L=BdQZLovPtRojkQzV{75|rF;DQ5Ypz4W7o-`q1RRIIZ>REc zS$|&#DyLX6P&UQA;Y3C4IQz#u*)#RKwe*&fz4SELeq*mjvbLq90H>^eG4XoNgGIEnE>%e0X9pwBgi<5hF0% ztw&Hc=qeyubR#>Eql-Z@r6UlfYl3PA#}M22(s4Be#*%0)UeJ0VudKjvO~EA>{`~5L zDY#?`F3CxpzLXZ}v4*#6RcB(N+j%tQz3`&()U{EMY?(=Y}q& zrEI{ohGY42bc_NR(rX*$Cv=4nXUzsnSnPaV%BhpcgW``Ygk(Fc92SpEf_3na|2H7; z7PzTTu>W8u{sGceE8;>iM~=8?VQ6aqM_Kfjh@J_v200%#T*?{9MF!1*0Nx5b8-6W` zHJ;#izA%_FtCeJAaAdn3=PDW&5t=h)K_D-TDM>ld>ae>g87<Kg+r8mwBG3#o|}HRU1C z3<&u*c?kplb|BZ0E^O#(0e%B65KSJ=DED?KKRBbHKh!(kI@pjO0*aqdLX=?+dwPdU z?%mYd4>DoAcXzIJ;;fh2A)&#KCqi^WRiDQ`f<4)jX%0=NQ z1LsdjIM694oSROaGkk-A(||V>!$*k0pA)Q!XwA9?aTV$+t_P)%Lq#OZazX;8K!xeCb(Wq-?IKv5bux`59RL!XLmbRv$`Gg3#Qwl%v!pp zXKLMx^UQud(xyi5ujUe$)`s}j%whz{N_wa+uEb$`C=X(=B+4flr}@^vJKo*DhyPL8 z`FKayCut$mAKuvF59j9=SNIw9U&S|&dD6QN@0V*kmEDh$8oa^UjjhGGwZC&MZOwjD z{6~K`l->Q!@2+j!Om6BfzUhD7td&1b_pkcT>vzkgda`l1T&}z8qVI9CR%v}4tMtCY zfM3%X@LaFZ{MUo9=K&8;pi zZ_eLdT3uVey}7kKw>iIXdvk7Ob-g?{zqz!&zB;T!nZHn%d?o4qcjB9GIO&OI=Y2+{ zg)G|60GkEShbkgo6`7m{t$*05E}6w44kJ+ZDms(nPmA-*WAU>8X0GW8YG0b$6>lZ0 z_YZ4L@E21#gL>PK;=Lla%e)PzM5H-3ZP#vIZr{@E_K6mpjS@q5h95%---l}Kvd+kQ z6}<+{2w`&j2`1l?(^I^yue?GRKef6AxLIZ_Ay{i8+#9e+*h1YBuhP~uz;*RNHaHh= z;#rTB$NL9GQAud4a^WA5n}*4EsoH4{LjzRp-86;ex}Wuk2it(R3Ow=k+&kks*J6mi z^V9UUKLa3u(OJN%#6g<6eIs$SUQG~5T9J;Fg)Mx>U~6^ME>To%2bBGI(Iuhp;YTEI zEB2AzoDFT!4jrt&1T2KM-Nub~-oFfj8Rvw1BVK)1$>l5F-=FB$pNB`GJu72u`Dx%Tu*>RTkNqh|0`v-%}$UeRZeXt6oQ*fWDhDNuHq79<>?j; zKU^q2%#_EPUzWsvD_7==9&;ykyc88!w`fDM*qfxUbUe_?^oEk&x8WPoiz+c<=7ugU zeu7#!@fPvR3fA>-Fy=8-#!h=gS+7fD06sp#9}h4sO+86T1Iz&03(;i_IaZSz=TFiT z*J4v>3UKFOiVZb#N7ekZ=J7G(K24c*=?og0CY4zxY+`1j>;?x$-Zy+OHnhcg_LtcwD3zy~Dk8>ieVa?9mB8GvkNWV}^-mQbE zuCrI6%POz(Dn9NB9{PsE>-N8}c$ZNfQV0KYyhmozhvu!$Y_&lk7KppDAde1qcmN$Eqw$X$O4bL*I+nb?aG8c0 zgEEi_NsM6lqX>+mJ&q~Tw8LO2t7-xWsDu)`7F4b&T)C8u{3p2Q6RddYqFG?S@XJD> zi!268uaYSHK2{k|ZFXxX`^HX*O&?-O??=Q48x0U)YoIki5TQ1HuhD}r4Vug|rHhHU z$1kM<)yD}nju<;kL)1n9VTc?#?vG?IfMFO7duA=dw(PuaUAGIkk3#kcgjIpJj^UHU zZRcahwr;u#4#7>S@8C=@KSa+pj`ux6YSnfY$o+gKZo_;6khA97$iU!q@B8UPrsGFyn4dV zPkv_1v{%KWt;0PL z+`-QE4fvuLoV4L5eVvp&i|fsX7{MLu88VXyL8bJJm}t}N>#BOmfG=+elQnr-Zn?KO z`I#n*(NB@*{!%w?#RdZh4|pW1u-lji3)#kl4tlgw_dJoU6)xiWW_h|PyO&Lctb*rs zH;;Tb=V!D@@5c}UG14+|DYiqx%ZBae%yxi5UIh&7q_rl3Z&zQ=t-=&65=^*X`k4yc+iOO6;BVyh!04)@vzlzg$4t8%u0Y-nRT$G#e(cSwrPxv1hl%8=na%? ze5?!iUOAWX(PvaK|53IXPN6=JyjT>8v)BOFWZe}DWX0fQ4`BVeCe*}X#ugSi!`v^b zmfnIkfD2&8xSU%rZKkQeYL*hWM}t7X*5BvP?qoNNGx-_kSM7%JV$nx`1yqD_UB}fl zUQBv_^dV@Go0x#canI3m%xoD0oFN_;J{dkQ4NJMCS>yju>A1=u34)1$jX=r^N~<;? z-t>mdX;z5qrxuEzns;3wfAPjY8xo<&m_t*y5&-aiY|!8&VW}oQvO;Xhf&P=h@Oy-p zBMY0gD@=A05Q`3UYOy5Zy(yR%2fpTx#OA}g>#_iYH`N>lq%AM?mA?SUfsfekKT%M0 zjZun8xuVxanFgx$$XNo&nNB$`GQ^0Wp99)i%5BFdg%l%CesVO#NwcZR58a7Urr)DyUvN?P5n5W+J-k?I0;?gCP|n+%cdpOVF#G zQ1h>8Rg|1`AvH(%%dt5n5*bNfmzs1jWGHI0(D}3{b{Y{l#;g`OgVGLGs{w=e2?SzC z!H05Y11* z4nX!g0AU#8dx`u@8mptGO^;}XR1jV1S=cl@_*+l2Tse|WpHP@-V}@ePAkj`~kaiq` zr0l2Hjw)D=3Wg>weP8}ky$L^WIqG3z9uk0zd#8c{fOsmpIF9Pc%)?MU?y8fYTSG=eo_ zXemxu4_|G|p>W28pVoZ$|HAn* zXRuThGU1J)+fyD_mtZMT%uIY)ua$jieF2BJg;`TH^$qp|$Q|`0O%0`C9*l0gS}X7F zRW^$bPf$$q8w76q-*9AU$+7|42oDX}$OHQIGdQrPHe+vF(wbl}i~}(0{9`Q*XILNc z<9!Cs6VINU3=5A8^|UZA-nSWdI?HGaAoF~He~6KIaHlO~`M?Od0rCp%J`4Tmk)Id| zi#_ioAR2u!&116NCd~6OHBKj8izk8y8u?|V8kcJ_1)2Wq@cV@GX)T;A#7*0*`PHUQ z&Z#|-#ryKiqD^`M@AL?|5}$K$1lu$sZ9Mw^3P0Q6&KvIc*BaC`F;Hj@ll2OyYImv& z(N@AgJA%r5-JuBIFDQv*dw2XRqg#kkee3zC#((&bCM7_ z%buu*dZCc|YlIy^aY^?Gy=-xSFb*oFad<5Q2NfDcIY~CIg3@xrz_5#OmXD*P^sSCdPCUX&3u%fQ zHik0w4mX~~b|5&ypCFc96?K?q`^ljC1yJzX`=83SEf^=UX=X{ripnA`qiiPAE^_@^ z#g_E{hQ&svne2r>pJuYtOg1;6)^d(ASsFJ&;xsIscKAJDOrY!-TlFRzKQ?)~HZ0^5 zuvnWVpWw969C#F!eV_1MX@xY6hv{3yPntrICa&n81eNx~D3Y82@=eVY9AFWrG(8&u z;@W&~q{yxZ1cf6Gbwfdl92$zvf|;o5;-s%fX$J0zCWjMD{%JsInn;cObmu3Rk4`Ff zb+1lO3UFAd@m`?-4IAh`VvAZ^k4~>;CH-=Qpr=JO851Vd41>CY5^w2r)FqLtg90&$ zAA-=nlmIqpzqFH?%}Q-^zfwAP#U;xw=)4uDUmb-{_Vfkr zYm&f=)&Q{Lho+P^Ci=)T1ntBVuIVv+gJYN<5SU$&_(n}ATICz)wV&ElK(Bs)*b3=L z<)}Vyc1G;O@En3V5K+n0LCu~cfI|%xJZ(RpKu0ka>>>V%{Z@$W7J#7+geopgKj* zRVc{=p*SqAi4+Zst>;1w8Y*N&dakaZZAhRRs0~Sa!v7$1K~tjaKSlWRqx8(TY4Dhi zB5Dj^$<@0$Dr;LaP@&-?8sAmVOoOmr76ww4yoA5Q6QY(}Dbev-cfoa^WAgw|OrkOI z6mA)pEJV((ehzcI>FT6EYQl3u$}25`lfugf2_ll50zGblAh#Cb(IYhuDS+6&phTpz z7lxPGTF>f6EG)$&yvHLhI+gIo59j9=SNR#a$G=v|8jK!ckkd^p6&ECp>!bc6yW4Y*IJt?z zjl*kf5d2p11xi2PqYflySk%W*V=?%cK|){^cg9JNWAra+xJch==ZuUL%Hot#VJyVu znV5cWf+hpkPx7MC$1w9Gfq))!=1=*z)4zLO)N__9r@)kjwU63FQ}mnwp`Z<)Q3Kmz^t{~Ea6I7TM94;| z%`ZzdD!IYziR6JGlS}_XkM*h#PN|cm&dqmV9Ow{Jqm-v}rOFe$RcFg%;T9&YdPL($ zGi9DyG}13R1~J{(_>8_nfqh?X}FBt^gR+=a;5{tD(HBf8>TZ@=@UVh z355hu*qyn4vsBucrJd#)4(O$E((4NJT)TOrkZipD4@tJMJrX9YWuTLkkl`CC4(grh ztuw@{3T*b5H0j! z5%);qd+CEc*L_yW%R!?9!rt&}wN1cb&Y zCW9y*ZYt{$bEMjkUnO+HTXt0tClx|2#za+t-B?J#Rz~8hLda1=Y^9Hp>vu*Rj;y~{ zBAorM`o3<6>gX2ts{6IgvKvCgjvg{Z!d5545IT$_wuEC?4&BxO!4jzd(*Xo$DbXeJ zIW1R2KKQYw$)v?GK;Ur7GWo0Xm!S7F!~squ8FLan!QRQaiWzvL6aZyoHLA@Yu~R3Q zNH7qCE_5(1&({5+$0C(*?s1ZWC9Ug!ox4~0M?9fFS?CT_RN>N;U> zI-{!4pqR3oMSm*~?@KolFC@r3(ZO~y0NSipq$4hoK@lFJzEym_vsOT?Ta^yizWT@^ zePB&kz3(!+*x}-0CN2AdMa#Z=WxiP7uk98k>CAYhVA4w^w?6#f*Vd&j@5GOaVtr6O zNI-@&4syiu%B4wnom#GB=2orrak;iv+DSg#Q$^|z$~&cpdr7HQ-A`Zoudm&jO^@tf z{Xc{Y!!BfV513;zM+b7ajt4r?GTUl{#2yHb)THu_E>B`3mEi#$jE8Zlltp27ad8$x zBsOq$uMcZMR0W;1=_Gd8A*+9?G6Z37+CreiDG(cwo2>tF{^R$f0Y9#YOC$-mS|M1> z16{$hSU$Rx1v6W^3Ah{#?R1*x!k=G#Fr6lvP7~z|N2NH*U6FqzpX?G(scZOm z1gJZ-%9uq%-Gt|E6Ma!?mUxU<{pLCJW{wq$#F19{>zEQ5^gAyGcL_Zxn6YNO=ngn? z6h@N)0{&i?9vW4xArUq(td?k=4Hz!523~NrB+oZXR=rFEIhJ~Y*>FmQKcNz!+Wy2` zW_Zh9{lGLQy%$jPg;N0S7J})+ceepdk14yM=CR39d&J@cLE0edQc*jId!aV=nx%u$ z2=NOy++I`J&Fn41DIJ;@vYPXvR^!zh()CcQdtBs~;gVFp6|B>!gUb^m-+L!9!*7u{_2v3Fvl(!$AU+HhdAdDx{%R^N5tVo;mh{_LS0#Iwlu&u#Vq~7_ont_-Wdw60#?IpSAC#>CZ ztlNvangKM5vQr)9-ZBpui8(IgwPo;#u~!qo-KYyl-^Tx8@71l;0xM zg)LXMZR+UUHTLLE%7U1&g_XN3qjnJJ=;uNeZv1EzJ=*$PIvuh42U2Y zBnAoyU0zHpij%{}NClFA9HArW92qRR?H0cssq}zKa1W+#Vhv)I)gZd>w&d7VyFjme zc&l`Nd1YxtW|s6392_#UkRzzX@Hp9XE3_pt^*Un78;DxG(3y-FKMM4?fPhW(Kx~}I zYBA||iF0{G+<-Lr{h=XgdTh+HWt51$M&H`mu?nV3HFzL#YeydX8E*wg9eAaht+Vts zw^~>6T~9IIeh`uc86DPy59{Dip6L%O-it0pPk;whASeUWIXuSM-iNd2iv+8A91#l^ zi4$2CB>s@rm>O49ImftO zC$}MFEII?q^xN?`AI{R}$75>1kB6E}IN&Koc1jrMGGkfCWHGmOe*R1A_m~8vGCyCk z=z_jumP+=|$7D?TPqIv>#V{g83;2#n2cD8I2i)YSERNg4bPdc4?Ju6j4NkU!Jw5|jz);92cDU!di1TahVnD8)4NC-oryygy+5)46jiY^XN54L|h_+}E1f2ig-vH%ZnTD{eKX+m`xplR673r+U^LXG6Ja#h_O8}I3N{O&2rL{L(c{K2H{w( z!>4+x@{U(~{Y9w$mf8zh3DsbUjKAms@bR3!2CIl(gmq#GtE}+({vqrZomNe7XXFVN z_)}5)pn2tfGqndiIWjRgaGA?Km=`;To#zRI<3uL!S$OxAdmv*Kl4-K`DY9Vaue_l? zxUQ{s3M(8TV^(>)RwYy}EZ#;iSW6Pt=i~ylBy7B@xlXMhd&hLvO7h#4IWq zTdl3Fd7kFw#0(JqiUwN%DfiZb#w{r6Z`BqZMTqS8GBF$0@1;Au_@jO=f<@8w9};6x zq^iUps3qPtUHi8-Wd zk(*`ap1R>!Ek%pSxEUzqGCv&2`BBv@Lx!nplbe+))vs1% zgS=<%RX`l89j*JIEPO8cg`b(p=IFxT+hM+dxqDqX$YPOjMQ=FN%r%|#4WnWf2l0?k zb!G9U=;BG?oTsZ{6-@`%1(t1~E|2N1EYUPwB5nuDm6~%38&=gUROtyFkj0rvc5!6Q z37j+DijV%dW|d;K-_y8R6Mi>K`JGH5=sT%pm0o25mYr53ZKT^s5pn`<%Cj_e&%i+R z-n=^(Glj zeCS8nfqb#QZz~>!fr#mR_$n<@4EB`)E{9?04WJ!(d?KULQW?Gah*J zq6Q8_z;8f^^H&iAb|=TVN8P3r{_F(97T~}P7vVN*P^B~34i!C66{V8BOU>X;1huon z^DTxfny6_+4xpY=T&rQ@K5-OpH)K>c7!#0)SEY1uwf zskHX-V6kH{@S9z(T4`!vuA9yt^?^3caRqJwIiikOOa8u^~yHB-YX8sPqAgwe37(c4l{R(8}nt zYY4zynvChE$xwWzdj4 zyyAg>*4_M_rV9_(JL)|nTT;4xV2^;K=%v^~k+=q=1`dRrdXhgvVC1kuBZ_3x)0z^~ zgA&~Zcy#wc_wskHqzLCE!rix@$b?_r?`b|LM5tYys ztr%Yc+3lB13`9F#5Qc9=w={A4o(TYl(l-ij$bFDhKDmLHnOb$jq!wA1)j~M&#J;Zs zE?_VaNc9cXzu^+A`c8zrN#NmlKTNY$(`gk#r)O2UiC&wqi-j1iPR>Lo8#*yn9B zu^q6tbq%%Cza|0m_6Z3FBL?2vq7U4nX32fi*esis3b{!K=1Hh-N!$GWn<;O^Mpy{Q zF{U)t1b7=215{vsoP}CErJx@L;XJm6@P?e)fu5o2#ibql91}UdkYgWr;vy?m+vtR~ zB6vmLMbQ19@T&h~0X{+0PuuP6cM!ks=VB9PO$R&?_cLBa#A}#e3R?JQiVe`jqEO93 zrm)ilmRu=|FWKDNp-rRa&(kD`E<2JJB^;k%T|MXM zZ}KbnKzyY5>F#Hu5dcHFvQPwG@dh2^0~xlHJ@PNb^#go^gXZUZD1!;u6D#|BIJq zBrHGkWm__6dtD8m1Su&d4V$G>I_Q-njdkGZLJ^UD8hlx^E0uKKs+uGZCH3S^xlpQA zx_HTdn9twg!iIItcyBZ@+9@nHSy9CM1%TQ(L}$TGF1l>E%z0p-SoZiU`pm$g>^Gpn zB5*?x1mh=OPtB8^FHuQC@xU_?VSmX3@K8+D{v0$AIxBwW98Or`a`M8Xg?Z_T1Z&E# z-FH2c?M#}2wRGsDuZx}xm5Y={mV}MylO!&n0pFL2=7F~bS$OxUl&=RnRGVX&xh$W7 zCT8ez?3$|~&8V<37tG{LW()AITAaL-_iW1j zPgYB-B-FlfK9xAbUC_UJAzPk7@xMEt7cc~-6drc?VA)D$sHDv(mG(#l0m9oAvsSdz zj!`b!TZB$$)pW?ZS!OP@-AzMo`Tg6ebN7G zd_ly1-rxzYm%*mQuRq}>U^22UnmRJcYpD5%7cIdYA)VncE^{8*(XI{fhlN?cvX#y` zl6|6C1`%$Ec>S@0M`wk|Op46Yy$$KNGB_vZTr_^S&IV%qK~`g^Z43s9hLOi9zj}r1 zn+xS(c#}-&IyXgOX!cex5sD}<4q$8@{|cc<*L`vc`XC9Psy(qz|;F(%k3Nlb$gks6M>9xAZY+3 zTnz9%o0*&*dcjYs{-m1+2pbw`@mNu67ycAu<}EB%{fQ@XT!t!vxeH_r)CLS~wSgj= z3nQC~mLefTtQu(GWyq{p>*Zd;MPQAe^6b0B_jG{&(EfcVXp_MY`Y!C1jV*f7Ye69^ z-OcDN%rTs|Hr*NvtK-}0Gl7i7_R&0Ga>@fcb?%2qUN6Z>=K8@BH0@ymP7%-*(gt$@ za-7K}=$QLy%0eaTKnG!JN*Aoj9c|8-0|qI$+Gh&<-HqTVY{)|(|@!c{iRdQ#6WjCm% zyH_q*<*vnMZrxe9$HhfEDSt(Su? zd+!)dao2DZ!i>eP#s=TXFQx*qJ~vOrLxQ2#ls;DICLlbCPYtChHI<*X1#ue0tvdwWec*+~S~Zg=3;0@-cZkhgoHV>fB8obS<`=iug$&>$H@rx^JUO#F?B(v!yba@HXf#7NbJxxHzzy#p`2tQ?=wJfr9`Cb(`#bl7=OG2U)i zPg~{TZLle2xuJr*Qv_~|*Sw0J6YG;P_tUm)Apc*OkaEO-)BW<5w66jPgQN#w`#j<) zGfs<+v`Wud#MBLzDmJ)V*Y}yAQIuZ50l9BGr6Rd+6-~w^F~kA{oPs2uzk7`y^KMF$ zP=r6a=7=}&%)XS?1ie8wGNkP{Y|GKPR{O}xa3E71q5dEJTl#{7zL9r|+(YU%?u)^& zqH$j$^YvQp!Xd|@Kw9ew$E?1H^koPF%m6tdX%bmWDMmT~0o*54K4j7){MPi;OiG}a z7eW>_51|*NW$RX4dKBHj3s9Lp&f0-+V#hQSoz`(PkvPF+7v7Ao=+sk2gbNU|ZP%tpxXc(Y`qY$$sML)gE0q8^RrdwoDLF#wa#NtP-ID%7}VDkVL&* z6VDh#4u=vW1tR9+bWX+J`kR<|c>vHv4fMef(PoZ#S3@u!UUm&WcF=eC-Tb}xnL$NX zx=A7N?)?>nva{sgbS^VXI5djeq@p^=7xGin5bb~B`&IXvhU^8DBK$t5J0IG<$7KP+k>HrT3N+`E$UqD1TNl$H4B z6Yfc|Z-_38hh(f!GOVo%7W?~O4joZJKs&|~kOpH|(+_w^;FNHy4cWGpC$M)?I+VLd zs2PHB4SQ)MTh7*Z2Ru5 zJECxe8;kXjbV(hPc``S`!{*>$ehO$+p7M3$+wzM01gr@Jm4xQ$1V0M?QdWZ#Q9$t0 z_uQ`uR<*Pww-{3V$e|$F=(6jpc7c)t;?P-z>1E);_`>8$5CbZE2BV1?x*b^~UO4P5soBE+j6Y z(f~5?NScHq+{fZ=9ibRV>pPS=rj&Wc=#jqafV#v#w7!=JMb172mj(~5F~3TZrF_PP zbl~koDxfT9b9s{40wgtEYk#I0Z)*`t7vk!#P3F@3QdW?}lwNHDSSPk&PKW?yv$27@ z5*=d&hFTxWjPjycsTk`fF+5xuq|ilmwm3H*3r1QO{SFn+LU@0V0C;fXvpZ8*GRr%V zpuFK@d_a86wW&~JjBn7X1%oGngpi2oC~%x$sj%#a^2qDXh$eg9My5lcX=)|LeMg^Z zJ3eXZnjqbpgIqngRly=T;ycIbI?m^2iTFl@eb#!3adNITp0|*|un~YP2un%Ki)x+0 z-|1?Nn$2Adgl}=A`R`dA{NyU6)(X(4#3xyUzLfV?ADD$|+A&M;I&@VRjqU9&q8INi zFLK5QwFIvoULY5|^1gOUO2ETb^6b#h6ziqfLu3In3mjep)9bl785m1^4u_@TSK|It z=L%va87}5FJprnbu-M|DOHSED`1+DjsqETLv1<~uvXnwfPz>kQ(R32_ zTHPD-10tEG>MHua20P`cd}}G#LIwU87_lYTjKV_4#dr_#{_%KLANYo(+P#; zRlKaPzkzJ(Iy_7!+=FVPTHUT(zjkeRclWBjYgD$c+Rpklzv_tHzH88xj<`N}2buTG zJ+fdr)(+~OTeUK_z{qw><1F2HZ{b!}+9XQnHTU`uSAkk}e=4diJbvA|wNOggE&$ju7)WSdu@$j&FMoMP-OzSUSVu;){duA zo1<=39_NA5K0*YPN>}PDfcL!D;75s}-SK_@K` zfhvo&S|k`s7w?VMiPBsZh3R>$7ZFWO@pgFg!lod*3i2Rv5r!{7YC%F>*ktLo^8@BF zAY;PmRYlGcpf0VZ4~qkTtql~^#;(+|BZDP1lVB)mcO`d;&AP|PH z8oDnEbkE!sMCrMu`7H(8IVAF*-?gfR4SLC}m?d+2!!DcTeX~k0pUtkFgZ#?-DFOFC zfj|$3(ek(;Plh(webEveuUKL(lE+`DTN3a&Qmo(6kFD=pKd_(ZW9Ux;5e7obav!cA zeD0VjPd&Tph-0>b^ZrSqP8R9Hnib4!5Mc{4u)53b>>acHY|tgD7uDNPx9w~6dV$9$ z_rmjbx$4-ZOL*~l0dnS1PaoDKU)jJ5<0S5*Ev_B`Rh_XGXZJt)ggI zWae5*3yTQjz(eHff{uh+D+!>W0>T??6s9Q_E7Sjagfy#usDhW>M(vOWJ$QtA_R`c~ z198zrhld*=y{=g@#`1v{l&BkN@OC}{s!>J(83D}UEmB}MVH%{~CqV?BeOz70B% z*t(6w7~+c0*QHDoE|6y}>u?~$Wru*t_8cg(U8pi{OtcKB5YLqI7!NW^(gzOyIWO&5 z<#n=TINdAGT3(Wc{chK$FGLpBb;#=yh$5kQAQ)_qQ`#VW$_q_y2slU`;#+dZPZ6|s zrr?&eIs7lhy~G-k9Y-bhz9tN6!bX1SbF(${to3OAQljmHsUule#9OKa0W0)i1YH=V z9&M=bMELOh?8;?-_7&csA#Agr*dkT9&+(=ekni)?IdCd5jfBx!BBLfy^7>q$GdQGU z@Xy?qT{SNWGq`-~PD%^OW19O3Ea|bg>z;(<$?Ueo8n(ZJj+C$Awyk@DE`5kNJm>WW zU5xStqhzeo0X{GRFmW5H>nh!nr2GfB0V=^_L7($Xtk)HW>)wZ+aLN6SgnpOx)jTnW zHq{YVXWq!@hl_WWbe^l+IBC@Zl83Y(3LC>a1Ncat!N5agdPqH%@2U41@#2@|#O8$; z`+J_ogxbi5z8hQdX_-D_eZZ+?vp)^HbY;-m(?q2iR(k2?I6Zf{3gg$q!+3|3_(-$( zylxZInaofet;iPk3CdDSL%|l&HAym&JeNuHBT)(U60^9F)X@V>gLxcXk&ft};~_oXy&H z*9lMZbBmnu#Fuk93@_Lc1>KdInEPi^^18;w5 zFchvR*pQC9WHkLHg;FmcdY#m>!7ojgB1dn|HEX@r-HuW`l*1PL1*$orxuTU_*q_O~ z+q3wjZ9xqPIX$8I-1xv7>bPN&3}#bxO(xK2uXoxci#rgCoutHOHI!Wb;t+4Qc()6x z4qhSm+FL&WH?G?UynaQFuk%d373^4tsekFO!=X}|+4&O7NP-IxhX<*I z8fs(M`oPneOKG*rYqqn6cq5}+B<2pod2bnIdV6klv9VYF&dtRu0y3juq0gmR1*i0^ z^(sJVt`H3bU=A&Pt7z6K2~z)0WW-cy_QouxPnBB_F%VIxJV5|MKYuQ&mYV+do^4+{ zGN9)Sg)AcA+e7~ON>}FKXA;4P(7&|)EggFOoCe&BF!LL;6e{ z|L>q;Wj5gvD5*!td8sy-29r_EVsTuYU_e7q8B4TqPLcz)GpNW6@e1HG%rLpBAhkbJ zNY+kp%?PWt5EV~sq?-lBb(H9R0N_ow;y?27ZKVl{CY z0#%Bsb87tbp_)`kLBuGMon4ah>Vzc?wuX!gyDB z{=OFId#~XKnl@$lO0f7F+4`*|dt@^Gi}yrZws6$giC%nR zOBU8hC?OehB+{|UJggxIilE$e8Mi6r>rCExet(fG*e3o8xrm$KJcjb4AISTzg;+eF zQuH>kISW)TdA3$utG+L#e9>KSaD->*VYZazi*X$uGUhp44ITM|4vXnqJTdXWY&toC z@#Yc@z#W>i;26|guNWortEyG9s+Nh(+}@vC>6+cK@~ijtwBAwjuh8-}xa+EztfI`A zH}~R(3w;R?j873-2f!zJaC|1TS`mK=0g(f)e?^PL4s!mJGqVFPAXa(3WNIj9y4D^R zB;rpkU)R0>fFqJYSr4jYwdMcaLlbjy&T|yr-sh0|{gR{X(rph|_J9RHK#M|1r9o8- zW*N>n&sDvplxiqFO4K4%?C#~VIEYZtCm082UtYTNep*CZuB0O7!W}y=ausHV*mIES zu|T(;{S^1HAOcetptINL!omRp&^yG3AT)Ih_D~&2IXSJHXHMv69w4q!klFDyy2nV? zl|a|I9f5(u;EC&exD*E5Q$NFMNM0pyg2yurJNj@q5;|}kN#0s7r>WYWyA%qjeEwc4 zlEWz+^`Lef(SgYiRPMq9seZ$t?4tHr<>NkeQPfXF7b;zdoa%~sxCt3sQtRjX7Y_8QqT zs-|NZrS4&aZ`_lKP+y_AhMuR1i9Te=e62Q@M5Z5b{m{a}Q^Yp+sV2eCvm$P*wFbZ; z16`ILJBC#E##Lr{hDO0nnsao&6Zn`TooSV?4&h9*XXRv8-k zV^6j#76kg{%0_9gVs%dh=jT$Yh`ds(rcv&c6t--U!h147uv^K`1$(QiH8Yyts;*1~ zGv!KC1TF1NN=bCKJe@3c!c2tCa>Nr{JmxP(T*MjCZW|^L`xR^%|`6Wbc3tjK1{c4ZZOIrS=Qeets@L_(>;mtcvE2 zS+chovW1kaHM6i+=w1)S{K8#EX!;Xu*r}4@fYWu1U6iaab9di zq&@WvWGN4fN-2m`@^B}-Nsc!os3#3?;43kfIrdB!1IDbHwps$>at|N?3b@Rrr!nv{ zRHY{9TCGGxNN&+AY#3#$vemWhh>v^7lN0GElB(x2(&O!vLGb!k93YL;=b40Tmg1d& zh^mMbW4s)So=RU_mwFZ@Uy(6_faJhYw3{tViJ#XO?mXCzhFeV~*j7l?*}M)gweO`% zV45AtyQvQjP0yC!zl}{*WDT)9VT8!QMI=Acd-DU&padtdL{DG89Kp^~D{p!TJsHnn zivGN$jIPf>bcT|dJ<>Ap5Jv={cMQYx9+TI)~ zc9CbCxoj!HR^|x?`h5A$IA&#IIoXdZIbT28mt{=lhZwNOnmJU0=&(H0FcfHmL%v)e zn3nrq^#>h6;V{d-c6W|?7g2kvTUm=*3)Ciqy!W0ZIgqIZnnp9;8W_#;h zJi#RKSZ^o&{1@~;IRFr;0Y54f4TFKWT!S2nv$BnLd!z*US7qR!9%D@@j;TW+J&A>b!rU2oI&TDq`d z7B)%MCRP4HtzXC=YJ>{}hF!2$ zMe|rqa^444KJ(T)dmsd7Zk{Dn&AO#R+Y>RZ>+Y`F+IM61%Tq}vMh zGFMtnPguaC*frW&lm`a*!1e4wYCc8{2?9r7E2PVB2t82SPq6s|9?Gygq)FJSc;8MH z4_%mrmzy1GNJ25J0?8MJiA2~^B!nj2>)I>zk#Mto>3J#tHQD6eesDF|$DUZuz#o3e zmUY+IGacCtsB6mqZax*>!A4dSf`G^)1mJw>sLGh%IYDC$^A>>Z^u@Yg;2(tc);W@1 zsZ!*QM+Rl-F+`q4yxV`;2R}}%V5KXJ8Ftw$8G99CICiaE>?UG*Eu2v@u zV;$09k=YCEfob*p^Q2uJWd}76+TE@^Lfst(O#{{_)G?l6TvmspZfFDo@5zQ9Y^%d* zpPi4u#!3Z-!Je7Q4SY4&ic_mpsby+@M0FBG7|rsI<=EwJGIy-pyeYa1gC6ikF=U5W z9^ltTiXv1@T}xr(xf50S&_pST2-WF;K~2em5Fk7drh#B2KJ?V_4}RAMAuLNJqslm6 zSe&cYJ@CuQ(xQql#Clv|J}A`Yyv3dHBiheA-1YC|7tcw@2HY7P!s;YIWPv@|upN`P zqlk{q2+}|B*(r~XDl>m3Q=~4nQH%G_ZgT)Xi^3iu8ki?`+#nf?!E#LGSD3>cQpsbb z|5m|7JE~i9C#@h3f%OTULioUvZ(NhH7JtuMb???RTy@5AC2nZtRB}Q2D9n9~SJLZK zy2wD~$59)32PE`5#d|(_;Rzt{b4zzpe%Jy`>oZ<({bfq?p7@6x;HcJr%J6=$V4|U? zA`;%k3pg;Z@BoOK6bKr91F<)5Qi>Y9mf(tEpTb-ON}L^sZ-WzNC&7nAbjw#xTbvUI zr{$uK+}~>#A)HA4k!o4++84Yd6k4(~fMLSjA-tkv9wWrEmani+24CD~+Ppev9dp5( zY8yyQ3Vp>Dm6~oE^n?GavIRHIvRScf4n6r@FIyk`)$*Mb?}O`>WP27oShuZKe|tj7 z{3?R2A@Z;sp?}jvKs=@k_2@aFQI5lUXK(@>&!Bp`0|pI9yJRx#&3KX68TaC4i(W4Q zhoFibct1QKOn2>WRvS`Dx_iDP$+eCvIoi~4T@Yl3ar*i*96;@M%8im!bghSAf6;p` z?GgI(Kh`cqUHt0Kg4ksV)mPh}>RW1uDv+o?+z5}NL!`t1{+tT`fCuhvq*#w6={?XR z%TKhp^1;X7d|*0V6&-27dp7WzLK7zDK^KGj<|?*6fJ`2J{8p{p<+51LOeBl?S`ERA>~C?vS>#kY zQ1JeM$q<0?aPNZy5TY1dUXM3u=m*LH$I{6V6utUL#D%BR5^cuZK9`a`j~n8kfLN>8 z@7oH)ISM9gjgcaGZ1S)GvG4o>^nG9<%4;kTIRp}zw+owQmDu!x>t?F$em<`dXSi_F zx=RkpJQO)0P0kIIUXsYxZ8P(Q`g?yk*?mQ<$U+3@K|MhL&LWTEr>Arxd+e;1y_CmEqte-;@&UltlDdQ1*oGzv^(9+0XPvn+4>z+3R#bO^` z&5h5Jc}DlS#%`!?g=Wz+K}F3S6K^6skS3059DXRssv0shwvV9<>=? zdUG{EOcu>m9o{va;OepF>sKPO_c%l5w!!;L=(-S7{&+WKJ;P3pRG!lqPo*1WAIs@Toa9$6l zq69N8v)G7tX{) zy7wj1_O4Ocj=TBUPS*E(@4(vCO;(d;FRn?WB$&^cd*&sDkXFvVzrIMYY;6tZ_F%(UcHNpzg&iXHJ_&C|COdtpn*r~X-oST?vn@K~cRI@W&5iqvUw&ny zb;F9e3_6bu(`2)8EVI%TgC}S!%(H<>o(;?(ICS77ty}Fmn@M(STfcMh5$eje8WH=L zoCAqo6yn|MtcXSgsQl>~#T2h&;KI!S%Akbcb83b#DaFjXc(>?=UEEtSKkCS;{1H>l zzKRHRLF9X$L9JOxnut16kXmJbXv)>RoP734$ozKuqn)g&5RH7mgs$0=mg5YF{kjC$ZsRI zLVQ}KUpJg$;#+#D(For;>)iR(Dg4Puh3^lRdhJE4%!1?8ShUyD)eSn8%d!{m@PQfq z@d^x_toonql1K;V-L)IwQl0*wAY4=&ry|91CQ=+>st#j8yCgBp%K?)Wzg*Y6W-;Hc ziQOf8%;J4IxaV|IHxrpL$|+K((9(BB$i8)-pQHwwm}^>ynGP4zs;lu(z%ijk0Bywy2+3DVfeS@j~6S zCX?TW#XBp@Hvv{jEy4Syu~}vc@Fsn}>415d@WxCh99ojD|E_s;%c?pi=)u9-gQfX9 zu4yi;@e19PTDf4Al0F$zr7a}bdA}x+XdMERn z@d4d=-`?I8-6Y7E_|@I{E4|wCE`?4mu;q8>2Yt8QS{O2Ub=(^%OM2hB1olv@&Ko7; zV>D&v0~!K*IU! z0nQobk%dg_(!9>!LrXupF*hv z6fcFWHW7qvtf#d?hootO@|-)=oSN@t`x}tCaQ5e~y;9WF zwB__J5PON25FvZ+Qd0PNaqC!R?q|r~M+Pnc{{9401*mZ_q5Cywk>DgdyyBwHTSoKX zMeq!!kO;_qAr7=WVAUung^frlyo_A;xf^gMDFPdwt}+T8Lz6F$po36Ig?Q}>wh-gO zaSr#IkRPQb0~;sdxXX0%VAOBDYv7XkD{n$o;Mm+1#09*-kW~m_qiDdOFFQ=Q$e|0X z@$Z~FoypDt<6R3`jk{NPu@g3?{s{wj7g`ifgdBHqK>*!Grfv`TKqoOlCN7u=JQB{j z{ve;MuK?%-iW~yVaH4G@z)>SDrQaiHB&s9-1A1WWM-VT|o}?jXhc|DnD=g`L@>^cm z=8_U(|BX}BY&?J}xuk+j{j81$N^zeCy7ftN9|48&26bP-$hZiAB~q>&-^HOaKXXcg z*BtQFW&2$?GXKmC0Z~(W8mdATIz2R;5JhR;izQUiQh_#xA^>hr zF|3Nk=F~qaJA>jY8qH{!>>kS^Azq;KnIKZSaJ!SFY(t&lQU1l*F+yeVBtM*EAZO;315vf$xAkNpnisgEt+PF z2PiGaTo{|7mg_(C`>P@cv81k$Y@NdJl$t68LC42ZUbm|A9W)Sx6m1|;iQ#F{13$~@Q~hxxg2j07KwZVv|c{QWUgkIOVOkH#R+9-qn&sa4z&D~?1jskg4t6YR@J;9UhwpdjBZC0@q(HHWeM=i* zjsl-!SlmHpx)#3a|3$K8` zjAC7igDXNf)XG92K;8dbucmfA2oy{fa8byJY*4mTslUu47fJ zW|>%Jvb|T`@G%-C99U0q^%BnE<4UdCTjZAQtTUXkUAj(gn`M9?(A8p7bIc91T!B)+ z8}}9~WX+-9pSO$VFYl6jwd!^)7V<(D)}D>RH%%+}rVqz6Q)}Z>nYFA@EEK4rGC7_# za+xV(HD^w(P0dVB77CM76S=NfFMp+qPCkEe6fr1d`q&oIeEoRR4FNO2m>tJ9e)dc9snbn$`@8fw(ht{|kS*KvcNzAblEMEAiuK@^ z^LDAWRpy_t-+MkN+wa^k%0>BKA1MEY`f@xwE|yiD`)$W6vLDy!zx0VXzf5jMV8Xlm z`8CfRsyHb}P7Z53#Vb^unkoNEe5ru{yX2gwja0?Id;LK{d|oowI;oqYFwHkGOV+OSRC^7MLAYq(J9Y<8lz=TB?aC5+F^WU}YF zIKA77iM~A0+40GlJ~`0YK07;`y5;Hhq}Fhu(%D?D4-a(0NZd>|u=ss+pyzJp)0!Ff z{76rXPiMPyOglc(xv9Qdo=x5I^mD`f@nCZV;I!;1n*D>Z{$v3azD)CL@tts2v3m**9TYseu6gS=MBvja3 zCpYI|vu_shpZU0Zo>cnPJ!qc^6wP%NixLJexB!lb{lveA)ch|X=bSHpTObT z9yB_8-aimnGQj3OXRSC9tOT&zz=M2G;Bc1Xl!BE)I1z8IrSw!HmKvg*|RzgAN7hy6CLRwP9Cq20!|T zCH`SAO-zRg@0eqF$Me@V47vDLtIt;au2rsmL?*A!cpaP0w7fRXkT4tlSnGSB&&!TyrmjRp9HM9L(=2NhZC6%@HM1484^7qQkwuvR z*geF?WWcH~yhT4Xz5GM&levrr)K%2ky}dkW5m1H!y`5`)c|B97NGVQn`?h}qD(slB zCZ!NHz+v)GOHQk1&1pZ41Vd><@8mTg+Gx)=Vxr*nMEZ79g=qCbOM z;D`mGPWhR9jm1oGIlB$q0M+_h!2fxf@1bweqN=JOx5?bn9o=k`7)EP=By_57KsniMvwVq067Q5PXjHhSJ@NtZ6WH$a0B9Fk zuH|1Zt^8*B{oB8pyL2S4Q_7h*93 z$cwQMB$4L2pc|B?QA#C8sw;ebetO!vYz-uUPzoKN2N)R}fHV_H;ytdmKn~Qtrx&%V{t$%2u8(RC$BOp>V5NUz|k>aiI<-tW`%Mav>4vCtWg|aIpL4M^&@ToHtV4FbRKCQnt&5^V>^}q(w8ezS1YN z31bJAZ_SgL$;-vh4v%Q`ike|$tqz1_^nizFBpH}f>R-v|5{IG~yw@uq$X@o(%Cm(h zV-pKE^VjJA%yl7)JlceFr*>x~{k>WE<@qjfB#qYn+^O9t*}H32Wn;AXy)eT@Qs0|} zrNaOM-e_9)|^R{V_>gC)~AWiE7eJ#TTSN?ch#XJ+HD#L?UVk*VLnalDyS@z@;%+m zZkEhK)v?P~ffVeb$u^&i-JHL1C51qy03wRWmX>kbZPMxeIb=rUwo$UJ%C&jB#vnUn zkxqe(-JV~(!iHg7ChgDK-_UPelxDDmj_?F??4G7!pCWpS0h_QPHTKmyM7k)* z%p+&dbLhKugk(HIn(99vld*Z2KxoU(z_@^_P+DDKC$WHl%GP7?d;5m<6o0L2`P(ZT zg-75hCUt1)FrE`TO*ko$yBoMd2b|BBbiECPpvGEWNJ8Niv82w<~ouZJ>hOT88MyY z+O7Pq{Ro>R)B`y?p4{~%6IpJ~lf{#@_2;ApAy@k?a*O_J>;Gwe)B3*k`_}i`G@zgv zRr0=sdiRXN;hWa~+xq9$Z(IM?`U8E;|7v~59w8>w0EP!XA)Gl9Pyo>&bU|rDxMEJyY1+zNK&QudV+^ z=l-3CWuU#UW7n_G}9vD*g zXSna*wf^8+yy&F+AL!Dt;(rhS2-|d)!DacVM(Z%e#(s%8+&X>hhw!3E=&es+10WzE zI8-*NjHDQ8$${VtfyL85) zn(Cm1B$tC!HV0G<@eh@?W#8r9z62vAC)x#0egF-G<!RTjqYM``!=&|Bc?d&PBY!3=-g892IhR;YhpT6H2jnY*PFMFlWaJ3a0TLw^JYMZKacFCNen8GKX|N}Jds%V-s6bc0{$=|c zd7-?N-bOeIWv$o~B9^8MJ9J+qNL!)B)y{GaBH(sbg-bV4jEe%KZ4pH>u=LC-x)N#Xt? zCsHS4o8}(br4I!NTZH}9;I}UQP%9$7N7l;t(7!$WR@xF$iqUxef}KSs(7vX3d^p}I zPdpW5^)WpZ^sw+`}e{rmScu;F>BvD5Ih|+4acY2$!S@IC{iF*jG$9L#G>W4+&&kSEl${*!XNiUxHpn zjzH#P(n;;Jtwg3aCc1D0!TJf_cZc2`jozA$c)Gp^DFm)J<%J1v5?F^>oCub|Pl0*t z33SWV9ouVRN=%htSR2iryKOX^=&wHICi4+*zZrRMz`66EbFoj7{Se3-zvQ^(y0;f% zt8vA(3Kc1S4X<$wxLWvQ-h0XehE^Y~Q}l?&4%(6+0|>wNsyQl6V@z5DQg}r`w_zx3 zd)q)$%hN6Enof*B_sKN_p16eI1!gfAh$ov!bzi2=fr2;;QVVr5DB-E z^MW95`8Tp#ZM3KuvU`Np1#msZ`$p1#L2oocvx06uK_%k3Qs9dBv=PR0^aRkIXRTNM zf(4y`oM#fz9rg#eBtD@tV&8Ar@~X4^y^CO^S2i+IK8x} z=sz?67$fGwaT2ERIq~&WROa37s2Qj@R%Hx~`!7T$;EX3?==0ehAIbL8{x#!4&sScS z`}4z{N1P}BP)Ri~H@<-tuyLg4g*L&;0(x^ducW+z|MTXP*x1aoigHMKTV1gu5CNFG zIk#{rvBw{L4v{C$?2R1x`U-oMGgHa>RYOpj|3Qi+$8D-3a zUcuZCveApe-O2Z&ZU7!&d$t$MN7PX>+yBrEq*;NeVMncNS?k)#(1Je*wtE(s<3iocXd|S8 zGOWq1zCW^(iu`cKFbfmrY%#M|SX<4l<;Jtcsf=k%n^Tj;LSbrVCOezW<%(U&JANtUU!J_+2?@h{WQFYNPApUftJ}K8wr5%Gj)*=k1KKR z46z=*Oks&`m!}!w5SV+ z;NJk0^}kww#Bv3^uRO=t#k_&j0m{HnvM*k+4sU+I3?IySD@7^tq@9Y=>y9Y! z@p2VC5D*2x8wkKuLTK;bhMan4c1D{!zwqbRb_Xuk9@JSrC!yDV=zwS3doeK$&wA9R z_By7Le`jtYoy+t^SJlb!g!}D6@67CY;N=D*=9y>^s}JO?f5a?d@CmkPof%IDx}S{% ztv3p7Vx|j?=tc@{BxhcQ);D4{QfNahXcPT{tr;n_p_Vgdp;TE=$pp69W zG6e0tn|&i`quX;>2FK)W?3&A)tVF4`LG{k z8)7sg`5wvlaLV^Y|0wUb&s!gfc2`w*ra$C5mwfH~L}oflWk)YfC&ey*Z)|PFU=;A`37$jXF zJ;_XD$NN}My*(n<7rZ)?;|Y@#a1jd_K5wsxv46q}x1oCWn)*9$arWdn#o1}BlS%uU zmh7jY% zmnwPME``;O@?JhoEI@n7s{=WEu&<~Q%6+xdg%@fQQM_VxM2z9kkLYYWnw;htj`=P~THsv@g3kyE=v+raGQ?Rw~_J^BxGwRKr=f%UP?~ z7q(euJbBw}HZvZ8M)i?xRwch6nd@YW{OybXAd}OX@kuf^IYkz&8&^_foBgtbP!M}q zRy-^-JDHmzW0~0tKa4$PLOw2=otdGJ%Z5I#*Gt*QyiS!au{mAjj3pfN2VT+HOh1PL zxABa<4|1ISKQhxyjAytUJM@<`9UO~oJY(`<^oUJOUiex3h{>nr$k;?S^l80b$UZ({ zt9^9B5>6S%@cR0kS2ROPvW)7dsMOp}c8z++{I`*AL zC8e~Cuzuo1L0ue3hq*m64>b(JaZ)&%yeG?SUJLtOE-ELQ9anOq-ehRlJEUD2&Gcq* ztr9mK+7YGofA4TP>tu{-+=>n@6qXI1QJTJbhD@ox133I1Xrc1W$z7bp;96h>IcJ`xa!LiC-8j7n+V`cj(n&x{)q(7CrWk&s`t zoz84wyf8Uy7INnFggKF&nOe(bXJ)gr#p&!!ajG~oK9!vsFA4~8vYuS${%llmK+A~z zcKCH8aOcS1iyuE3fjhf5%MrM91nwMxJG(u#5xBFLf-wSj4*v-oA>umokw@A35hAY7 zj_e2#H#)K-MBG3f*%2acbYL&{zz#klP8a_6GhQga%Z~eg=S6-^DflNA2YbqUFTY}t zwlwsL#a6!cw6}3`R{&ps^3Q;%Gw`);)~s37eBP*^Jns+98_>310%t=5+W@mZ^UwlU zcB8J7zdd|L|1Y$OG_X80TcH#F_24l+h3Uof-OpPH7)*4d5zjw2s&@ zq~}U<0`=E?2O^V2Rb#XL3A+i?t^a`g{TN!;pAw(zhw1(_J1&JqBrkoWmVy@-=UP4(ANM5H7CxdRz(e+8eQX$PIt8EqL@ z1E36Zx6o(>Q3h8dt5+4 z=t%`!@BH-9YupXI2J;t>*cM>)z;lYh`Fua{C$AW1X2_q2#o+goFDAhpTfgxo7&oCj zvhNpgO{@kZFMSQcqce70^X2iCg5p}-oS#4cy^@Mw{A>Gb>Wo7`>XbYG`ysJ|?^=KG zg)YJ=TX`(zNecf=7iz!*&i?le!d|*KcQ#>&iW<+)O$Bb>fx(q$6ORAixRjOf1$q-$ zhAyUirl&8wCRYgyG=IkElwD80)l88)@7>(V_)gy+THl49KKgeoAc?^_7KmekK{qgW z$WAAkXd&uTmqqZ`mU{!eIVFqmg2fBzyk4{X!At3{fI^V|N|#EdfA5Y>LVcx>dgyK_ z*B^tX%nNmj0TKa8_8m~b>?({7DTlo+6|8^f#`h`vW`MaHhbQn6lc_q3a8L<)OVl#G zqJ9A519`Q96oT&50{uK;)iW`jFhJR}1ketvCt;9~7kIrdw$eIUZaORS|{id4+PHvPdFLD%E2TW*T4TW)H!Zt>S` zVus5b{b96j@z*Vv&EUGxA4cmIcWUpYvlA1rZdLlj=4jpGuiK1Rx0%tpb+B%e-n=(o|j#a}m7zm3){{<^99ZM1H2r#4@s z|4as%vqtL`v0m9+E)!s)8?9IfyV$)2>dcRiM69C)V*tF-f_1Q9^tS9Td}6;Z*i>fn z@>^>U@`BA|W=BUd=G4~KiW}xg>36tbBc??4c;A_70`2{)guVbixe2etAV!V$_uzHEr0{9<%KChs(;2Sn3Tlg0QSDpT@ zsi`pF_1Y(}2z4?>e?G-Q`7GIn;9EhJ0(-(ypzjM?TtKZVxH{OeBS0b7+4LAp>kIm4 zU$nnbfOhna81-b6j(o}hz_4&In-p2Oo4=ON-@PI?ELi``o73nvCwxPLa+d-jVl!qa zY{ZMXSh6Mn2fyYohy};65Om?+UIfsnI`@BX{gz7C3lIiIUU0&WNnc%|{mVHU3)0k! ziG7c^4CofAWBS*0>pOCy>twaX@1tCb6k4K_vA zj7pW5JEpU@yJ0%!NG5wOlXExo>G@v77VPfiF&uD_tc%b(v)u_ASl9QpjV~ogO9s!#gDL4yjqjs0q9QwV3R7;hliW z(D;`KhQ=qHjPYUXCunDK%DW<~h&lFf4?ks7L&b`CvloDa13Ix})&6C2W?lGde0yPX z*{Mk_?Cspouk8*z9PZqc-#c|a;K;aMTO&7%3;8)RcC!ct!YOjII5|1fAF=U?T=KTb z%y?v%x?amnAD5PV$R)+CCQlJjiQgykGL@{n;2V#mSxGqL zz#BwP^>u^DK9(2O0%JMP`e5YyBtqH+$9QHu6GfUm5|2pn$alL-%1BDyFnrQ$DS<1; zDDRO?bB|Q4kNX7UF_AFDXdv#IPI~KT0%Ovp)(6IBJndE=LzNFJmV8Lvt!EG#gO87} zMiL4b53o)$9caL^m(Z8g?hd_GcXjf7omf!&}&lE&X!-3X=UF zw|)Y0{c~Ec`nQk8+dQxR=Gm0Vgy9_Q{H3$w7st0G-R*p`3*F8c{ndqEu%}H=CKJwW z^VN8R-U6)M2^3>v!SOznD?<(VLkMi|%U&2?L2>=l;Hfxc)z~k2&r?Qif67X?PgxY3 zeesC2PTXE|O6@iLAw0GYO&>&!xu)yJA)V(BQ0@N^N~TX?lJxkVTupk15(Yg&3HU#? z_hnaRR_+eLZ&(dj2W$rkar|%C51(MmF1`Yuf_mBWG^qXXApw=eKGdjhG6tQZUtrr4 zk{!=ZlGcl>0juN!Bbbw6xR@-5t_h6(K9 z@XG_%w~6W#P|asReZtsNo~ATSq?n>UV@e&A3se3F;wbPjUVzqm!gV#LU*RcWWCx*t z`~urYu@7SR31dFUwXomKMtLte#e3m*wWl9bx|oLLJ%T2&4SvypQ6AS($#kmm11+Jh zV^bx~93mIU`=SbdfiC+2c4Ff%neB?x^*iq;3IA0Ns&4S`|NXF*!ALOqHv*noCL}zg89^i%DI-_^QXF$?K zr?U@NHa%ot2)ZKC(+#PKptl;k`M<=`&{h!R3FC>LxKn!mx#4>1X?BY$=D=<1296+8 zD}mPqb>m$=s;&NtgikzRyb$A0nCbqwSzTd zU*}J`472k)wj4k4>FkSF;gStqviV}M<=p2I!&tZEDxKiO;Q&xEZ$C@nd#ijrW+$fC3ago}C{3TDR|(db8UK{4o>%O{lzMD({P=(zo_Qkx@+-*P7Fd5lQ3i$$^TFYeKI9B$Fdj%SSo5-% zD*HHaHK;KGMU30~33rs96q}S-M`@-MU|EqWj|tS7d+D4>9oXax0#_>DpK##Ov}7Cl zljn{ETpu%T_l44ByNEjHgx!r&m#XG3?AU(mgm442&YiEOSa;OD4bCgqIs~8VP#y2f z{$KJR1@Ry~1do}p3wk|I@Ckf;YOK(2wT@W_i<)Cq_pVkys&ckNW>uepi2*&#aZ4}+ z^#Zl_BF7jixncqN!f*z_Ta5m5qsIxth zC^0#D9b#P#W+i+Ddv^q9>`by6!j4Tv8+}Byy56KNNXS>nR=vLpn^l@$8YpQjlz&Px0^D zpR+p%H}e(uuBAakc#O3URHr|o7D4t(dJQ-RzcLekn#xRrhiu3KH)|2$kQi3mT1qc1L+FTk)BdX%oeW3SrP z3e%%0*gkf5!)_d);*xnZ`X3*rm*Ly#6=PkhGz`0&afw-QYWomq-(jIkgM;IriibX_Ub}(~@EoiVZn~WY?Hac;ImB@3_t|%!x#phcg_v^T4btmS+W^-glaZIMdC5L% zg7#vb(WR0RBVom1ZNo(h0>YEfgo#W(wmuW35;y%oejbGrKxF zK3mKbX6S#;PR*_vQ&X#xUGYjWEQ$K`HF#Q4K`$O*rYou>LbWv0{o;u7JE4J}KZM)o zi5DTkgA?F`3NKO#VBx(+Egi{dtqGt(0Ef`YpixeTOZj3Oa*2K9*@2iH+=flBT0*lz zlTPNB(ZkSvOJOYSITLa>V(Xa#h7!^1ZEzbOEJuE8f9{6cbe^6}r{hfMD*O>bKSE35 zH}`Sz64p&qU2x5O_8qfBK!~Jq1JOO*YGVLR8@B*z^;2%5;07w0a2~(lz6fkR^HRpB z!vuB@7%~{9MKA+SS zg?=b8J zfXn(hyeee=xP$Zww|f9*hFxJaL2r&UqStyIG&8+lQZjJi3;IDfpTH%;uy7jdUMlSWCtbLoY&h>>l!nbcn?1JcEfy&tO{d45o9FMqxTTJ2jad&*o+`{Qo0gEMBgpi>muPG-;?hCf5{ohv#1dU%XFeL^eta=bxP;nYGYBcHEf`1S-u=1!63Ndk zE~@Avd@gEl`53gyn>_mZ8A$Pw8@=$j%Md5QLwAyrIWUb?=Dpw*(D_%29JqqSk1980 z(Cv!$&D;x8`gmTI(SDY&UoqVcb^jbMaMwaQh>F66r5Jw_k+hc5mFiR2M;6ba4Lw)R;Q}EAOwh0g`)f^jkl>gbe_!xRmn(@Ez8Ul2DxQ9B0D5d$F;^}A5w74% zO50tAP`L;yMBRkgQ(wBx{Ddxl$PFsLi3OV^pv`r5FQ~sigUu2s3dloi+Bt=4$lJF*nScVA0-}-1$C8iD2(bi~y@PAU>#0#`wO=k3s9XXaf)_ z7MuF{F9?DF5jq0=1?YXqTl{>SQlJk?hS&Ab>EH8Dy{%-QLui2-7e60gAtGwSCVWJf zSNQXqvahDF>yID-@fcJ1-uQ*4!zrBxNI!&~l-&P5%lX4=ghq{;O3Pa@F?9Oq4+s&W z?{ozMWX}RX8ZAT|BVlS=SPt~XY50^kKfns+7B?*zMD)oG3s_)Ri~cA{F}6!1K<;o1*5eiqwKKZX!Eb3Aw~kz>nU6>}ymU~gh7Y(XKF zs=tpJ(1TAFE94TpQMbsgbe*pgah3zcU~xCL|Di-P$w7${ zE^fyd>dJ;=8db7r7ft%7>tud|{bzo|G^;T{K>e^R30Gr#mSu}C%Rnr}MAFsLJj!mb zRd)@?By*KY%`wUalPnrl0F^T*`W*U*kpqMfBae1}AH?Nb{zxzkOG@bq@5&wM%@#eY+oE~%ZGejDc za91GZLca|NGIkjS5N!O;3OanpN~4q95c3cTPqaP9f_nM>2Mmn}MW<-` z_+s<)yPspt&WW%n1xooRSg$jTOaY+^Gm*K!2EPQ1&?6r42O|XPiC`RzWSxNRDty+H z-VltBcZ*s}N!hW{Ov6gcx;kE*$H5`0Mmh)c8+^kp@S+IBZiktRMyfsa@ zV8F&n6z!cMS=BrL^;hrBQ46$UY*>yRZ%q@XvD-4Nk87JoHx~5TZf}`R-=(Hxh2(4W zH7c7{ywy#Z7VklYk3J*nzJTr{1$JxEGbyD$m6`J0=S4XbKZ zHlhgEdM!G0<)UNmk{xR2uud-ds$JNOCq@Z7xpW3}0>*=3RC&u5UDU;R%bGCZ+9vg~ zs~fg6G$s#qQ#OkxxoK<~6{{L=O%rB1$0-cSdM;Xp4Z|#v+lI4l)k>w9_D;fX&epmZ zen^&e+1Q3yoh7VwH`L$NSjWdDk|bb#lY0ndNfKc+Paft_Ms(%wT}TCu%ke#*S4a3#L)spcdS^ z8E;_|c0&XMLDAUh%GKO!mG`c_Q6}?-t&-<84{^|*V-bt%yQL^ z7m1us*xz|zZLPuRL$aKUMzw0%WQl$pZ#@%sbQUMs_)9~wnt5~8s8lVpOx7*xyczM9 zG+{p{zhqnG>g2_#%llZJ=BwroU0o6PxM3JE)j-0I&rWfb4m~7N`>yGjTYKb&U0&bV zr3*U0VaE&b&Lr&mJb;N5=sc=5BD zguNfSjRu>=kgVvku?8_o$28+z%QH#$+lC3i_!n3lrq zCF(ovyC>{q6zC}{S*A1F&+RMUGa0(({#A0{h#4xFN!W4N+}))^574=ZG-_?9$WUM# zrn42(Ntj94NqA6UgQwSaixsnQ;brZlGW=Qx-;L8pYBpg5zi5^iD$d*eut z!rsFc8$WGqTb45{3Sh~oIt(VVu)7ymMicfS3U<+Sw&^tNVR6hbF*RQ@oXvPa>Dh$c zh$5Rn0me@o!x>31HjNF#sgZl@MkQXDdNyH)q{^pYvl$GDN6$E;T3 zEo{Qx4i#Ign8^*#rB$`}j7p819_Y2ESiVbEHf$#@HXt{i zu(!YfyXDG;QM7kwFW#-YzqBu1&@H1vSe0QcIAm@-VV}XMY?sYycW}GCw!)Tev&69b z&Q>f-Avd0|>)_DwD=_?!Nb9>MeWfzFZRmNUM-9+m7LSfvLL9+Ka7 ztn#{9jd`ggY|mHN94cZ819VU$7j}Ekv148&33~u#+o^68x9!rfl-Imtlq=*N({W5E zR&*qnN!Y#EpcB~M*dCze)UHaxPROF+d^C}XoyF~yubD~Mv6wfUl3kgjMoqbBM%ik; zJ~qF$%k;)vu2tfxp-jTQ!k$A%o}KOr^0gNV9cpXIqG3HSotP_{ba{qR-ZHH8`%(N= zgS4b~YpeGE_anLCnAJ*QqikBmcv+iVCSfOGmCnH097g-@=8i$FXUABxsKp-(1e(hv z>}s$&KR*7D$n9K}E~@GHoXY6Gi2?A)Ws=T4REH3Vq`1tC_ zLn4?9_Lfz){;_6~i2;=@JdYvF!AA$%qU|_gZom%$*{gp+V+0 zH;mm_0KHr`@%+fnP+EGD)yb+<80UVhwM{xVQm{*V)!Oi+gsWtZ#nCD;Q6brcT@z~D zRVxo7ndM+5$d%jQQG;T<8BIz0uI)Pmre@K?}UAtV~Bl*Hc*{W98W7>8T3Hu>1 z33m>|s9p0`X~#0i2mkrsOYz*2iG3G4Mmb(EWHMnx->Pg` z6?5AdPSY+QlSMZ-nXpHZHy%7Nic5CQ8GPSzGGTARS&e32>GhGkVV2FJwOJ)Mj9Sdt zPtxr?w~R{FD6syn!=mS~ThY6QQ=}GdyfsbOnRviv@Bk+;jJj^oa5l+}np2Kj!!en3 zP4)~9K0p$yU6zFXmSUx_v1>RV&-QbX)%@P7>7?hjxASHpmhj{fc0tq$47dR0680ok ztkns}ip>A@l_I)fRm*0ja-Z6j@kA+MA7K^8-=*UZkR(N_5M#?S%d2**#&o${!Y+aw zeMnZ58X;zpESmAUUgdHLy9N)o=*Vx%LD*j_D&TOYS=x&0$mWuUF;)2J!)V*xaLh6z z&%F1yhyUliT`t@4+>%_vZb_|Dd0-Ds2RvxmXpt4G8n5ARE|+wAgH51X9hP>#tVB1x zgxrv~9+;(=w^hPkh*2%oKC-G^snowrBQoj6fQ&njB^n3CihSR+N@UR}7GsizB;Dbh zjgP|*kR(OM2LzPSbd0Ulcx#%lC$qHV2nl=gh9aVdyuo1=CGPr)S zVdl+p#kAtViIZ+2)CClI98=lJ9JOAbox7H?74Ntt>=>|t7wlEmU6dZ1A<;y)9D^>}f?2lWMFx^?`Tf8w zT9rbzD}6#3GoBnJY{J9%F#M1lP9Wtb%jWvJ6*st+ zbWd+~KiCeR!H_I#zP4vje>3k`JFF@tX5nAb9m6Xyi`;lFijShNHD9!==xmZDJ9d0M z=|2ufEipz(v8a3 z?Nz6`K0xcKU6h2~k+qVYUM)qfN?&QY+ck@NPc>@qEd1yHy;focj`3tEVV`7O%p*N4 zB@HWfZH*qxIg1|Cm}{D_S5k!;qz#zCkgV!^rp0)HY`a)8RJYg`OIByu`evI-9j@*bl*kGGyl_cFJ)jH*33EFj;! zRVEn0{o3Nu(bSg0T0LiL$S(0u_XcjGJ!{{|5sP-+DF zJwoq!fL38$Q@pW3fQ#pr-TEXbPI28F)D+t(_nIu50x9@lxZ*5e!$@RlLd~r$f(Ga3 z?GM@SbnH0T*9ubhwe^fMEpcr#?zP4|PDP!fUzIj@sZYn}>;_V!arB%KH5vD0E4v{E z?el3M-P_1|jWW8Z+-!5~a5T~>8-dff#R78PZ=Kp8yzY)eTq+no z(+2#NP}LE7QgNuHmu%tMlBxN-x3VW9v?V6B!pW?R>;^J+uUD2Y3&7P0)Fj^ERY><5 z)X1y{Z9|;s_d#U5r!&6kfr$l-PO?pznlJljkcsFCcZO#3Ja%9bYY1Gz*bzjWZ3~;~ zbz@kJe-=t7tfQc0V?)`KI7u%x*eTEuqdxMLQ0!6Qh@K*9uI*BMkX|Em9<&Q_^1g&z zw$?&Q0h!gRW!JiLigc)MVKmDTe1y zLglCYIIfdeb_Z)e3*o$ode<+gSBg*xhO1YqM5V)Mw6?%=%=C+{*B)`CEn6x$T55`F?giJJ<~*Y2n(l+mgyJJV2~CVaI?HPdqgxs4 zj4lGqoJ~QZ2u~wwBI(dImF*O0h{KMd1b!ZvLLnmnabe!*f=kg+|On;)n<1d+q9ba$=u)~DUWrLk+k7$8 zNDADDnqoTPnFtGk4RO-v&`266O9Koj%AUk!%~pX@enU*!GmuSkImMZixQy|#eF?LH zraas2YZLlD2V#MAPvR0L_P3GyS;>Oo6Znw+pkv3BJ1 zlydQg`>2Xt%%CRCo^Um3&_YH(Y_=KrDWbU5NR(=7QtfiTk1X1?f*h^V<~0?r1n+o) z33AvIS5NDpLBQ^iUV|nE){f+FtOtcc_IXj0a)X!O5O4igz=&t7l3|uB4PJgT^7Qi{?Bxvr4NR?M{g+7N6hiXD-pS8AlI8J5c$@+&El=5;fN~6s-jm zH5xEg+KhF^#{Q+&2DkN?n&{dqu$SKulWLi;4EdCrn&mp-D{i1k%Q-r*N~!nXjhG?V za;ZtOv!I1>jcSdiX2iBmh)UMYW4n@2Q*C)HIT+-~q~^Eg0m}Hh5;Yp42hBsA-KTP% zFBf8d!Y=fpaf^1;wA0E5ptQbx(^aZH6}S|Rnx9%0n^vrormWHXdD4Z4bAl%vw?s$H zWt|zPOwyDUy2poS)(38LyCdls{59QD{4;a*iYLKFP1`{GV{>bewIu+nQtefjG3`cbUI53fP+d_|OOJHMm4K#9$39tHu!Q?;agNGv zuBbVweL1s8xbfn5^>9NBJ1i-aP!=UFXO<$?Y5pNtZew zXV*J72|&tTrZ<)q$?(gkv$O7Xbbj6bv_Ca4;be4saeZ^PKj~9?7tXdX+nrtGY0ANe z?jfJ-{&oA>S6=&1_<5LxAI&+P`S&ijAKQuw zKi%hWILlpmSiZN_``deAz<u=SS|Je*#cT0|XQR0tg5IzYc+cuK^D>?Sd z?gK>eDrwJV=k(Z4;u$;Xu{z0~ebIqPNQ49e8~~JB{p+_tbz5u)658!}T$9UbNtD2^ zz(U6^u=HP=f6KNK`ng4)Vwv{ z!B3?5{zYwV`(IIH%9=IQj8w}cTv;jIPz!JMI%;XTrE3-?<8cw`;TSI-kNMrrp=D1Q zQLR?IWUp1(HB4I1z>(~lCDQ=^#dmM3?_cP*Rs7<+8>-jLe*fa*#Sx7A;=Aapp)mF! znE41HIYBsH`Rey))&iL)1nB_5{k5-+Vb7NHPhn&y7=z1S8_7yZdqbCkeZ-NUaD2S@ zwNY63?Fm6~LeO70UXH*1R46Nz9q{I4I2HF7zcz|eHSW?0#PkH>;hG=A{r6|5@7Ii0 zOy5u3p9k?c>{$Tu_)`SwzZyaODT3r*jUaiDcukba8bPoIMjg6vZSe>x|g zL-6O_fj6L~Ps(b*SPiQ6I|4xw zErnV~8>1xQ5+(_5tm%>qZVzPF3Hk7jJ9&2;>Ak7|@S9uswxnNG$o-L^G@JdAAh-pL zSuTpZ}U-Yd!G9C6eONUa)E-urRb^y6(=n(`#UUNxl4<= zyVjHUl0LdlsH_OnT4~ZSV}LMNaHA8c*Glm6fRxVZ^Xb&e7&7OUEk3Y+y2rWr z0lvdDP^{U`ty`o#J$wFw?TKFWM9)jjTj#7`CpRhbFQE6(TD8`+t$DeaTcttlqNFlT z$Iqtn^)K%iuY_72BLUc-=PdgoLYLIAYVp7GId(eZ@fSQ%<}Oo#TD9iSr|$~r-)pdrpXsjs@7|#7;)0|{FV4X*Kew%%T7>@ z(@Iar&tHr0L5eP}jNxnPZite;Bz?Yt`ipa+6O?4d)5){R`l$Rco7_qMe7+14__DqK z2B|3kkZVH4T7g4dHz>kB>G=5;&b3xnSs2pA21NJopg!XC`Q(0hGru{7Loia8jGymQ z&6#mq<%{=J0w1FlvRVFo5^rkl2y*ZRRy!b>d;xu$O4BNB7w_nSY2>^*d%m{(6|RD$ z;X7KoD4nwRwkt+DzktmDegAIp0DAETgsMd!lT2qm`Kp?h0ebhlQK?6Vc4SqgRVS-7 zqHN90E{;cSwZcF_mii3w2ha^IqgIJSoQ`t>eTJp^~x;1Jv)xVyW%ySoKqS)2-B?z(9&+(d0-Hz27V)+IQrs! zcjb%X0%1NJJwd#;w(B{f{N(Aa>uCc{$X+aRs9z@e5j^m&n|}wqvO04ytxEd-+aVw%}WYtowAAhV=uVm3vs^a_} zsW2`2q_yyEOW%N)_FBc^2l*&pwAaeo;kPyxnEE+ElG!5pNwP*8#WP1rAVL3Rk#$;p z`VX33piS#x8;TTwdta({*hWM7DK1(W1M-Qm%m~F zcjkinnMgGsE7WmS8CH#Ya}hT-mPZYsV(!H#f47=SP!QQBfIDHXIq)7*<+1mnF#9L~ zyPdM+`?-Nf-PqgU&abs!f1a_0_S*}s9=bGbr4Sn_fP9na)iLe6!c)HP6vMSn;tdg? zC(co6R@UheCjBX}0Uuh5fyFR9G52Lcio%l|XWmB(>IQFt75c5cZyHWK5SY{%M}syUSn%`jTk0B$W3e|ZBr5kgip8!MN{o#O4KOeXIM^5UW(Z1g2Qpz$# z$NUfk{@j}I?IzTzfpJw=IE^BaWoxR4fEf~ErjL=mP!8>nZw}q}m@dfMfd&r&gvkS7 z9P|+SP+b764>yL&qqNQ1gT+4fuVl;Sh@H0DrS$a|T*&;xyQ9BfFz1CcXuqUa*{g@P z*-`q1Kh+s$YB$lNmFw&gNxS+#ieDM~%|#F6FLc}4bwi79cVeT*HQd2I#*U)gF^PO~ zqxJsyje33)UkLjX6DXYhML~An%U(iJ|Nfp8SKr5LacVI#qs4XD-u)@WZq>m5$u61m zOnkns<8wI!ceZi_M00J!Ht7KY`_lti2-Aiq|krE5WR~~uBRS{4m zDk6Pf@)p+^faCV66pr8r4*>klZ6e<-l+Yv{MSYxcI)?2Io;&Fwuoju@O#uwH0<*5@*mrVFr zaQl|E#mlAsp=}vp5;WRdq`FXU{PbjD%Aq@?#}UO??BwKcOWv3`tRzM@&fZE4ynDz z1&FryQZuFU^ydp&t2%xR8pWR(!u*Z{OQ|grG#Ea3HVGOno?!*87p;qB%!2$*<6-{Y zOd?XmJH@s_r1oNPI5xB6Sr2Ulm}C&|VlCg|xaYfpqOs?;VWgE*K6e>gbsOsqQ*R zJ6{cjTtW}AOzf|^4V#7ygnkw&f~ha&!crq90T$`wN%eBYdfYc%dIUEwNNqDA45Ym; zlUKIZB&b7z*N&Q$`y+OL(JM_GuO?3#&4kA|U%e5G7)jI`j$U>O`t47>1BOpE9+Srt z_*-Rcw;KX*7*%MGfuL7>iduf`Rb=4*_1Y!#vmib7P?aOX1UCGaESO;MZp^?7A;LoQ zfkb&muWjU-8SAct?*&sW8MS{-P?=b_=qvET8t>U9@dB%<`+J%-h`E1Z)MTa|<3{p! zj4hJ-hGW$or)tLZUV#GVq*an`P|*>|`kScCx`H99;%X^jkpI?@*s~m2?3U0mHU(m?MFflBQX>irgN$9R^IVMxHB3Y>*6r^OR6WQqw~S zg+$i2?KuXKV5Gjv5jmipZRMU287rJIiVj=8fL5+p*uV@k zphosAH3dIJ1PueoKM$y?Ogxr@6&(>-rss}jYZo*aibUABD8opWB>0rIw&-UUjzi&2 zt-!W423SR|wC$ZwC9;Z^X~4ccE{pocFDASucG&FG*Wo+Q}*Sx_ZgXvbRzOP#%|Fws!55*c#O zvIM0CWaic}rkq&znJ#RSMqy_BpXMfCI;OQO-S^08|m;(igm3D_L%J@#F zkNDf0robYsNTwB*t#k*k>WnNRjj9`3lgwVZk}uZQ-Xo7DJ}VS|VFp<;v(Kavzpi0n zj)hg|C%qQP^ZQ!3H(!SJc!AbT+4X zL^?<2ATO2{2qYr}iO;PH+sVay;5G81x(EEB7KnF3=%#30jlMnsmkUt!HS&5^u)HO; zXk&u0A$n@hv3xChL`59*^{~nYRxchU;6v-XQ)BeCNe%o*7Xs9AOWe59n_%xOPzgCh z9Wlx&MTw;-k=^?CSB<(eVQ!E!ElSB7s2s^|{29#6+f=;R+PCUa7Qh-@wFvTS1p^dB zTCM{)sOqplgKSeiN&ly9*x(fW3h83{*z+qvKmG0zObY{43`c!5DrAV()kq5HQJE#{2hK~#Wco`}^o*BRs={G_$C1QmmTaUa7N~1# zbo2Vdt>aD5h7@vJ5O3s1Z%22-fc))2v`0tbeEbD%|u~E_dRoDj`~m=#Z?u@IXxPRq0AqlAo4Iqr%-&^lpkMi0Ze3tm+~rBHYi< zgz$9%SJ4_I7G)WfX)$!lG!AuKD+rhYtX$owb()0sPplq!7?;N)xf0fr9aGo{6Pbs;DDmTl(qi77t^6pSyp$7h?fMLTb@|0y=8pNL5~PxV zwPeO}{t^x~ga&)+^Z|dC3R7gEZxL)G1JoFg{W20f(hr!gr^|R^n@j}ifaaRYFF~JY zrOwT$A{%bHBUn>8?FB+fstaJ<&;6UuXG2Pn~>TPUw>J-;)67I+)A%1l14>U;& z2Cyqs!^PTZ6moSI!_qTC^;RN^#vSn%4SjFf(GqSek-#g3bR4j$MB!SyBe5SVMA+l_ zj!#EcP_+~oyUlj9FU(5Fb21aJhtXG2^p(rTBy>SK*Pu~ptF%-JeG6gi%@ax9?+5mlccSDxX|jql7RFXy1A?k}on{NdDa?5$L}V=r z`yWF>xWH72*pe~8;NoXCs*v)xu`Y?L1Iu-3et*ff*;Cg28VB zzp^)@4;BkaO{D3P`+=gj-XoF8MeY)}bk&Sskj6!%eTuUtORYJ8Gt5{kXnIZt`&GjU z##kZ6Nl(AyD8u2<;&VdI2M$!?X0laiwz@dF6iw~@Cwy4FAbh^HLnKAiR;~-%I`3WrLWxWWdyGZcc3xg#WrxXkI zi^kGCJ%zhAFAWN^N|L&Trd3w?VF&tUt8tqU!gPqaMJXO!>iuL8ssdt+h~kB8@sm~h z9-MIuF_#<2^C{6Bs_y0%oo3~~Z^A{VXEH}Yc3ciMvM!+%DE!(EwoW2oc2a%H@xY_&{b`c;GEsBe z>#9m&sFU@CeDq;06w=r{k&hKfPe5?zOBi9Rx73oh*Zot5ZkpKo*s(T%bq z|8@wBGhFd5cGh!RDTymNh*_`=6vXP-lDpd;pFe%HV;Ym*v8ujjKQwtT*Y!1X?r`64 zu2RVzcIalJ1WI+(a*;d8=)xf%g$H~#Ok{U>s8#v)krCcq=evcAV^}jn-$2FjVWfw* zzW5_ISX<{8Uv=@*Zs*$()}(-fGg@RWQBfxobqC$E(z!E6y?Hb1j)16xfP=37@LLnB zb|7_wd+9>wo3SdBO!y_nB>(DOW71n)L)`DAD4&dtL$Is|gHs};KhILtInaN|hlTE7 zi<^tA2+b_%AeI)J&W_oNzq!1N^`arND*Yq`6BJIPbbi2fF18i1-C9SZL|B02CmGbH zG<;ZtIDqeq0xeZ1BTZcHnxTTfG1@#%moNSWrfZY(GguOdA-scD!%@S4xxzc9J4Zq* zwGVQ@s?|lSI>@Yw?Wa8@!PqGe^;J1!$sc6M7fnimgl+Ig`0z7`Dt&!q)E;UdF~y7~U*?*44X=Sde@m_`evprR>5(>shuOxZ5Mt1AN*h`(I4!twlU7EfNDl$(!6;Yu$zo}l5f1}p!;hh?(-%kcn;2$ z11ziOb6H)kKe}2ad>H!Sss8?vP9SJ0NjYD_3ND&FiI&^S_d9!UXaBhlKrTtC!3uHNzen=Zlz(}4*EGxs>s!2D90yct zvKnTq(uW8riqgAyWv8aRj~v*)Dz6WUAk!yVG2lA+?0s&gz~agbrv#2PGG$9l1*!4| z>9+F*$2E6oWluQ96|FD}(U=U?peI_i@BOxsnVlc`1RV#%R?|!#z85*`#T-lax~#_U z7qQ?aWqE*+SYo2rr*OTiX=M>rG{SU$zwYMjKoj=>&OTA$N*c&lZNsB&m)rSy-SE1N zMXyv?JhfJSsJ9n?C}QY4ME~uucRvN+7XUi)(31=Dh+soXd&~|SZp?ajG#*9DEH)R_ zHRLBk@={B`X3pSqPdTUB%dR(zO=$l$bYs{lIJ;S+VzysK^A2$jxr8arR@z9lqY%z7 z>*_SL6%I?T5sbJ~)3sELgzuy)qK`BPbgD+|3WqBtYgWu|$Wp^vrB{r)d?k;tX+P0Z z*lhw-(FWxfJ3xWU1Lj6-;_#qu1+~RJ#R*aowe(oD1(ZKK{ZQz>6I~$~!>Vd}wfGnc z2v_iWpkpkkxftY}zOQUC_N7C~`sF2h@Tf=1qjnb8=PctR`Drrm@&lEo>RXP+7kN_0 zYfpZ?Go?gSHa=w*z2eA1i6EPOLl!GbjZH_xt@Ce^M3eQBKU+25rZgUxYG_d1Cy2GQ zgVrHZeVfvG@~GP5O@Y0NUU+Kc;8BY->v89O4v@M1K}tb(QLoW4?nIoCPihCC<8C=WzM6Y$t(nm^IJK5SMeb_WUmtEWK)*h1x&kN7 zYgt<<8*pGQoPamDYqJi~J7*bVZVzLkYt*p=i4BvxNfxOE>S@P^6OVV!_J=L~?;bah z_SjtZemNW9Yg`M(wZLPD3k_Z|md!)!`@z<28@rsnXL42!yd91|w}1XG)gCMEs~R8# z14B>+2Lo;Xn`)cd**V+VIh#2BH`aE-=dAyrrGDN20b|dlmZ+5_Yhg3!un^l+l4zZc zjb#eG=idj04ki-$a$m}vOh*F_C%IAOuTo1TZIYk;?rVYfv;|@1EwwyeXgdUr>9OU6)t;Hmed8slA~5L$I6aCAJ%ZexBE zICXjAPVnpLAo2vWAuNvR3YVNS<|OsR^Lsf5O^Bwb6^H`QupoV|vKWSH@v1)$>3of0 zb!wS`Q2}gmE?!wm_D9(j{2>;y;CLk!y82XS+MCWU1DHx!QJh7}y_Q=zdolbN^`2W& z&C4Uc_9i!@;_{?vKe7RQ?yKBJ$EsaZj%xF=CB7v0x#G>Qr;xEKmK==+xBYgFN#XD! zil4{!>v}dWpxyn24VtgyLZvVn{J6oN(f0cG%6y_iw^u{^t-;LnN&Cll%KqDORbscI zF3Ni)INkGv8Ezl`Y)xE|gSGm8%7?7iuh^TtR_V}@?5pigQOTudlLB>s>8OAsk75rq zLS@o_L14E{ji#AKEBB`V3xNkwqSS;_$U9;GJaUf$!>1DQR2e_mbB#(_iTrvvN7iP) z=c!gd-yXl_AT&Rq^qG!~O;4wBVk>8j)-F z_|Em`X?90Vm7!)XbQnrd<4vLkgFL%oZ`l~==i|`kPPtfx2Nd0#VUq>=D>Z3y_lGCd z9Om}%wEHSz(t8Q9%hB=?3jCq-1*2|nWeTk=dKFB*BR{@Hnv0tVkyA*-l&74eIBmG; zwRWU@zI|qq*c!cfz%0rK6Rd&7q=iCunJs{QE!sWQ;!4xhFfowC#z%ek3wjBkJxqE% z9)COGCkRYvH-7WZwVa5KYGveCfb))49Ws5smF%=^BpvF(RzLSQzJa>4pph+Y)afks zDoMCKIeT8YF>}WvL)x4f5j{@sYSLkzd4@9nIPHDyCp_xMN3Fo}kzvVx-mA3afj(M) z6-yyH??_NdQ0=Ok4X?-KT;(Eixkm#)X`Hb3T?)1|Mt&uKaQHd_SCtkwYa9yYc@m?# zCd65<#{d;2Gf2Z0ZU$VMzWk(zPlFh89=pq2#znVvxVA7Y6z6Z9&R8y{;aZTR$qez=hQ zGihNPLLP^fMl+9ltgXH(+?lss4Zpr&& z2It{5rAGj?U#dso3-ZtT#uX;MoiPR!<1(5Gb{)<7Wd}=6OEZoi>ISftC!q-Us#Kq8P85ANO6!|(~B%|3+mKeDb%N$>rBhV4|ih#DE z;t7QTKP=1D_S!9}-oyu};RC%T({3S;O`t5P2K;>=_Ur)NX4lSdGX!X9kWgwSz?oYn z!evA_1P^B^R3Cn77Q~~Zx!p#nY3wAgh~UP#!?uaigKEEx|toR?Zv@_5{&q+@VuvWol2S z1%8oM@3=mJAx=3)1LLv64|>?|PBIZ1p?$F9IiyNvNzCx1Y}rq9xT`GNVt&zORZTnh zOnBcK$Y*6#=`?5QW5#S!?AVfD>*cSM=68sPA4ArX=3D}iAm>{~kt^3{0VsEZGR5sa zZ7pMOlRJzTn}6Qr6xvRXBYi4ITtWgC`qFMYOPf?UwPC-~O_Du(T$poA*H%UQwzjuN z>rRi{hi>KV(UFEyJqJu@TA+8KMV}Z{L3kjUp#n@Cc9iMmOROj8Jc{Q+8`9>ljHY`c z_7=GYTKn1tZwwt9ckwrVW_~_$`XzeV_7kB=n@$J4xq-YK>Ny}V()x^Bu4-0$8B-*K+cE7>20{j z%psbt;sTB^GqDT#ni*VQ@4-{M((7c*UC9jjZYuv?mMjVl*;A6@h5{)Z`VlgQV>HoL zrpFM3fSeLWn7;&A&7?{(*8~u$gW;gW!g~d$ z@e=1GkLvZ}?wf&>ud1vRwdx3$T@d&LA-B3Ryc08kH7y2#>32lYwd$*9ghBIBpIDMU z)h9fc*Z|84et(fjh)TPh;ZF;0ob*1`=^kd%p}oC~-WFk`eF91w^(_@9oOb0kT>lVY zyZUXwKLl7U295JC0eW(~~-*lNQGNy8N&B@R%?2omc-$fQhcHloignX%(D6)0_=f)hOVPT0SzL+`x@I>XTHI19|tM>R0P9x zc@BqZkoqd$DH4sZ@b`fw&mqe@T&BYx9y`IywH+ZJgB~qW!{od z@X{QUlla;-$vGMwq5&@68)SJ(!#p69ZgJz1Yg<9t9 zf0}9$6n_CqrlL$ipui^NQOPkTf{ogGRKKKj_cV&;;XzK(5NzN4<|O`ubDU#M72As$ z9-f9FBVvIw__G#x&4)6@p-D|(+Vj*YpjDrF3LPPedeyF-0zU*saO2{+u||_Yhfkvr zZ8r*_ry*}i#BJDx4gpv01Lsi4#20FT45>^X3;;k+V2f{4VFBe9jfzau6GFjH`Zz5< zU@b+3OjYphfeNt8yu^rLHK@)oCpi5~sotI&2yXT%rj?kbXd%FH?_0Gva8|%Zfu+5K z)@FQ>Q5{k-*AfQ;#-ZA8ms=J-5k<4KXVbpVg;3V*g{r$uoj3m5`!C^(@KNIE`Wo}D zd|*M!15%L%qFe|O+Op4)>0*)?AF`i@R@)^hxZ(BI-165y`-{~I__m(0>lG}m@lH9Z z&ZY)&*C;UAo^<#;f~yZ_fOQYRmaNC)bGAT)Ng&L{FXjc?rK=9(48}*Uac)HfdWI|92s{R1V7-Q9`1sP)Lq`YHwk|sW7(XKLaBp?ZdDH}#Acq-RBA|F zL=?}KCko$Ku#OVG!4g7VVv$v}w)g}~Gw0n;o@RxSU$^E4*k@i!RkSFf`Y!y5O0k;V zTR*Pwlnte^XmMrV9x>8i_Mk)P1bl(8L89IHMlekdDYvEY1$uC7pF|;d#8Mp|N@0_C z#3-*O+SMf}2x{k+WVAo&C{ejwVM#+&-x9sUbY62i9x}vE?*7w)Nxw5=Fv&ddL^`%G znqdm3elO5Xiw4RBO}vldaeR|U3=v-&9s|H}E4X5?T-&xX#TT2DntK?mQaq0gnBvtR ztNC6|pLqGF)1vNV9Y;w$KJNi5?ch z1(*B^{(T;wY+}(PV15dphB~$WL{PBCz|(I%-#?S`aQq@PNmrFQHZVfawCd9-aP^8E zx~lE6d4se{yNo_@cuPZ2-$Bw&VQgj+Vu1LplqB;(VkJ1L+n%PTXGAWs^&2<`6G=dp z*txw-&?rDBV6AbjF7`oUglwWvCn&qAAT#okJ!?_00F%xxms#7TXVRvK zuCk6(gh&jOCN4~;;b+ov4U|TWs&y5jd1y&*(!NeH$=~~___2kPU9gBJI4zRXkJ)Y!#Ba zK0S%<5JZFFVoBIy77{#oDim~;O?O&j%#4Kl7u2^E>#b}oZ8i+-2a^EX&T-qYA_FRf zB5TN9JUGCQ7UaGermp^;Dp7s8prbbCzg1!}P6b)#?$;Gar$E1#h6(_D*Q_`WfaVY8q z+y;Qtsucx^Dhvfk=5fPr*;;m}O6%&w|1s&T=8t?#bubA_68P!kLTw;{qgUZ_bgp^s!um51=|t_+2j zwbI;X>H&~f&@a*?NEkMPms!!MZ80YQ3jp8T7!0i76fGtks{sF)We*ti00oOkO z7-=16!Yagw>wf_7X9a(xy}tlh#1I^?M4}L}W0^P5ho@|P^5X3^QNYmfg}?25ZJvf83(r?v@Ch#f}Z=1T7>M=r8h~nz*%DklR z?AW}^i&7?2!-u(;gz%ebEpR0`!w=`Ns_;y}qB`-t5hN`y(LyH5?EcgQr`-!8Z$i@~ zOy|-KDS_F=fdvYvqFY}*#$B<*@fYqo<7(3IA|}QmOe+0n?Z?%qUhr@IrNDk50cJnJ zpg@MQoA(F*y!t{_pfB3}FjJ8vQMIzyiOS^Mt1|}xxd;>Dg2J+roUdmbgf%g*krWw# z{dTW2!GwnV0c+4bpTr&p1_wg5k`LLB0;O?>kl`-5GBY36!#JR5X#Ks=RtXQfQh!vLGMbsMX>B5XYg(pjw~ViWwJak7KH+5O7e z#&IM#DB)a)0isbsF`8&FGYZBUzO>7-T9z{}C=f{&%#Q9rJw0o-GNyzSc2qYGiV^qV zCz}aC+750dZY>_uK>QNo7u*HA=TIdZ?$m9OfVSqTJe`Kk3_8p=_t0x31?wq6ix<^qiXuuJ*H zrvqDt5)*mw3$cM$TY@E}q+L3NbhRd8-mPGioZXn_cDSE0cp(aWau^4fdvP~NST9(CY@AIx3 z^gCNt;R!*s8)5aaM2|s@4}O>SVS(0ih5c8A!Sojn>}lWh8z6$iyD?rXb~`#9P>+US^7C?v zH@BXIoSJBcSNv33Lgco%7`QNgsLX+{cZ7pr6Jgg{=eV#Z!4ma*M$&tG(CZ)m8+5*K zaPL2}4&uLVHqeD*TVUC*t`9_a;Kyh(4328*GGD7xwV4v>28@TnS@5#cp9o?F6r7#_ z<;lra^;gQQXp95qWmn_d3OttWy^$B6G-m0^W!eK`@t{aS^9HkCa~EW`hMQ!sVU69m>O2SFxO+2sRTQpyy{MH#u_?hDN#VOirNE3V z--1v{{XVv64YDO4wUX>^U~O<>6>tEY*PG_T-{}~PMS2d+9Zn7+v3k-+b6i@eQmPb- z{}gUC8tUs%1PO#jvgwC z<%X6Pd(gJ`?cqMEviG#mL0Ff%ZLd=Iv#yXym;3nF{0HQ_9YBh6e`r{XT~D3#Pdntp z+%{?4wj-O}8CbUu?3{54qD!}TFAmbr9J@|481uSM7pxzwj|Id|3L+QWKPbs#KHGHs z@!~KR-WaZFiP9_Ex(9sNmmWQALkwxY*}J&3wH9SI*GyYElm{QJpDJ2s)uvobt~DPA zReKaRtrExgGqj@ncsgCb^x`AFCO(N-y=T0#c-1lfVrkdtbfmUo|L%Ckd=^nVdm+D; z$VE{L3FF+?jn6!s$@Mx(L-I%No4)$yH6k6e+I*-6M#P^bHL*vt3wdD%hRyZd;-_0+ zr%TvjE)@k_e;kTZ&T_I%s&~2TS6B_Uti3P(d}(M>e@d??j|_rB_S@0lQT&_j4dS3Nep z^YGT}0$IO-vpaF;i`NeE_~E!fW@E6qCGIDJ*i9iFa})YZON`BO( zBg~Qb42GNE+Hbp!FuGYc-zD6B()w3}mV1S0A|d@3|CJE85!t#OHr4wN|K()6i>+H_ z$qM*~{|apqs(aZ?-+}n=p+8Y(OBlPAN=8^0i2s_p*!(a5E&t1ZD{cSsU)R6<_ho_| z#D6U~I;=XiQ>JY=c4}tOiKZObC6CD%Ny%Dd2Z378Kj!k{ar@-wz9n^tb^FEO!8bM_kn5JJVciynpfp&)js7+EHuTo_ z>DK1c79W5g(LjvxGus2Y{SKbWuKkWTdKEzz`4d}K=!%z;m&lH!ah7gY<^{^HL|PH< zHe!JQIqyR1=T@@Y=hDmJtW&wNAj*&1(#O3-OHP%OY%;Y>q-hz)@^#bZYOlAP5fyyrl3oU+i|nQa7p=52{UgZP6u~XTsbP6dXIf@B;LRiK!l=mFzlu;aEhYGKRMj88 zT+6<>ymp^VM61`Th;NI3SC-bPnXR|vS|;HC0AB9agr*K-rbV}L-?)`WK*fI9iKu0z zm!U+v%fpnk-t9$=}`DTa&Z6{CK zfrRe@uPcX>)1K0jy+4F!8u2o5EPc7G2+!l4aZ7-0udxhr`#t=50~+(TqIIQB=dqKk zm%g8Mj6nQ%vk1h0?c|2m)7;1?Nt6*VHsuejIB;RPS+@P7a}VH)N8XG~3l#V`SJrnMva14IY^_JCv78?BzIQso|2b<2 zyCK@9aV@CGC!CVnSvvN7+;w7(*KEHlQ>;VjlPz-VGbpdS#{@07zHb|VgObrJ8t*yl z*6dh6m?Q{?ZK5>uz;f~F07fwAb&=kRcrCrX)3W^X!Ch`Q^&=}WI-!kphxTbnQ!pUE z>4WniNQhdzeKyQW49?5QNPPaPLLiD~O^cnRp*R|vfG)lvm%MjPmxU1()&JP#qPHrF z1Tl$g93@?+)jd;-?F56-k1;dm#(g5VTTh~Ytyvt_l+6{pWp}Mu*|XU1^IMEJ24D1z z_LjXXrzgA52qVb9;U}Z58=jlz_o*wF$*b819{CGOb8nqBO1cK+zX13Y1b}DlvBf>! zYCAS58yDf$k~E?LkJNh4kQc{XVh)co2OVAqbQc(d`oqh!PsW+WR1+pIbMHADdTY-v z4g#_{U>6WD7p2F9-7&k`FE3dWTRHtkWUoFWs(#`4zJy~*yaHweVuP*Yn;)P5F96oF z+K=Hv1_PV_4GxC(KLFU)#m3OY(Zbg3FZw;t9=F{ULmSlVXQ~^-{rPLDC_z$CagQWw z+1h{1aI#(|E~##`jFt`*P>`=N^E3Ub=-HnlTqTtn zhWTHwgJ}I9Cs}b(&%?5bwX-G<2gzNoa`K7R&7Berk9Kl@J{WxWvwd&x)jm(upZ0qs zVvEbe2U+`Y$Toc5{Gn^ZQQ0tU&etJ@HG6+5`gJtzbbtTg-ntEko{@1@gQb0_^fP?N zC%1GSnkqS36aXno zu|Ibk>YC7xU#u~e_WMfh4t))6l?l9^@6{(7@=f_t05zBl#X1 zv8^uJ98=nGldJiz@dzAuCAXgzW#Ox|Y4~ZbAyAzj3^@E68>^7jSch+~C=FBLSk7Ma z0_7lq4s*$OyTO)g$U64Cyy(jA5I7t?o!`*1JUm~0cl=|})O>s2JMXMArWCcj+;Z7q z!q1nBJ+CvHkM?d+#KmtZm|RhkRv` z=j?pxEpOM8m4~fvPKVE}>Ca3xJ6tP)OnbGBoXpK+vzeWJj`(p)-Q;leufSa{Yy1I@ zyOErAJgi_W#*5e-y~)F2)5}|(o9l};KfjO3k3K!q`E3tJ4csc= zLhGvk$YU4x{Ms_m!};;z?SWj^G|MHU=bn!KUO`AtrI@-jgKqdG^8|Y&k++g*=1 zZ1jlE(|I=1d0c+1ytMc{a5-t2UVaX7@Tjf_rj>;ael3w?D~X7OY&+!p1--A&rv4U| z4n6PBMkTrm_i=>h3{xbu-S0>32+%FxKp zz&y0})l(>G;eP0whC{-<=iJ2qxDHWsXaoaNp;#v4Hz zHVE(Y*8q3yuf6gV@xM!2ObunMPD8x(&eo%2G&s^1ud-uw5wckS)P_4IqZah<5~8W^ z7t>UB(*rpSZq4=uP{}{$ou`16JbDNeF_ZTpRQ zaUHBv7QWQxC9WZ|7@6gg@dRwMGh20epbkcW>O=ZZeOpucZ9vRC1#RXMA1!lNVN83% ztp`Lw);!!PM0031(5?S>X;sk4hf#3bBhtad&npxyVYl^yf6(9be=Px-7FMYL9P`=# z;KkJcx7+9;?doPuejBz0Cj=WH6MXz1>kNPBf0ve_Gfz9frOc{YvDGi3hX^rSM;sow zq5orwJ0+tP^v^-hU~G#mfaFLET%LugDsDGEA|oEb|2_5pZKQzU@mDGAC2NH7Z7yeS z?AFqM_2h2@FxX&0efnGCn9|-vRd9%7W#-tN?PRjeB`gyRIlIPZjlJse`FLMs_`GJ4 zS<7iROJ@-^xR^3%ok3om{zw({Qhb<~zT5PBrKWdB95id?cSo3d*tj!Z)BAO#bM+Tw z+fMaU-D%z4C|3SfJ?5ed;ew*+%ZDh{n``&Hi~0p;K9pHfkJ}#m&-LEffOR{l!54uqw;+Ai${~HV98=dDVK5_Et1+9p3v748;An}8)t1FV+{|_1ZW#Y?_Fi_5; zr+bMwU2{w3_PYb2|1Cd2Cbjv$V#nJ32srL*Yo6vv%oEvMj zgM0|nu0KpCj9jl77Amc}wdS-gmSy&lQFyxrP*cuec6)g3&y1V4G zt}~5ZIPF@sZ<@D?5-j}X!{RHfVX^Z)r2mHwCm)>lCw80vhqHGKuPj&^g=0-@+qRud zjEQYbY}>YNOl)gn+t$R{v3WD+ocBHF+~<3~ANNOh*Q!<3dq1mdRd;pQssa}Rw2>^d z+ce_yFjrRNG!4ff0@@W43EQf1zI1)Xnb?=^@38q2+3GW~FSUBwuJARe9X9vx^G*{( z9?Z>KFvKy$wzyGsz8QF|^A@uR-!jUYj{hps{~yI%1U9LMTz9$bdxM$;Da)z-itM5L zTGHknA>U5=gx|O|{*e02=B@QsO)@`?n0`?Vboq5zg+NDq#@n)dIe{=1IL+ST`*EVD{PS^I;63sD zZHvZwnzjFNY@KEDy6fgaropSGlW(4Po5psUb^agd`!BRpLzi*v)Z>A{I9AV~%EEVM zX^i>j{qPqQ&-czVKj+__;=ffZ0-Xm6#0OL@L!1ZdUyA z&cd9(+9l$%ur7Y2^~xVhNUwav&FU@n0FPwAQrRZhyZ&`K$d1hcqvt>z4s8194_tQC zuh=(mzO!b(U_;i7kMY@A*G~FfCYZ21LN@FY^L^Br*`9}k*SeLb!If2gEc!l zW%KF^;hL!t3J)t*=2QOaN=cs#=B$;Kk^y;!8GCaXBZ?9$&bo41IBiC>HT47-=Hw7N znrUB@sZk~jORrc%oosOWmwED+ZRekCAOBF;oA&`?fYZ*#c+qCd1G*#aXBvRH;(sPuiM+Xw7b}qvKrI( ziY8GhqLpw(A!ilPvstU_e(5SRoSd==)Ye zIy$*q{nNh~prhfs&iUn9%hff_ z(qkX6xfQe7bk=q~J+52I(mtXujFP0^;fz-gmDL~f#8lyng&a!^;p239QHTqe1p_ca zalA6xNubUmU38+_{_OApp2vd{J;DPHVf4!ZVhjM5 z5d{i;`xR<0X?eqW0TIGNZMOjzih_hW!5A9ubCCcK$lBi8eikyT;foM;H&$TQf?bj7 zNPjabCh3s?b3x(!R^No6i%TZZ&tUMt@;dmT0q%pV5!T<*7vXc3HNJs%6 z&sl=l1Tl8wS0X$7kwfm1ny#*6V}#ER!&7H3J6V?t9@hq z`9P6|4&P8Rw3z%rSS!=G;7Q<|eg`?-eQsrOZ(zc zz_>~@lah9e{2;?cT6FX_d=A~j77=@Vz{AJ9=2#(}AhM?wC0czT>Xt_x7>v8f1_S|z z@EGl5MIzV)3D$rOX5jJ0>ic^OBeOw-APO_$20;bv5`rPZLK6AxaE6MNz`{prV&S6C zGIP?d6$eC!b$lUQz7POrPO!Dj);e)fjNnI!_O*%ajc>%L-`oIO&+PYbh~)Xa-(Cmd z0Ua}2+gg&u?Q{159IW5i1*&k8%BuZ@9Y52HCQg3qeEJD4pm4JC(E!!4RsjvnHGv=s zt@A7Daog`~5q;-h4t2K5`|Sa{&Qm1E5U{t(6i|exVsH?Glp{Q1&m{V+w0G0pe*+%- zE_%F%1S`}(CI-_Ih(#_Y(DmD0ka^iY32N^)j*$c2_3T98~HReIW($g?pW>wq)Rs&^K*J zmsX*GSL6hzM>&~V!WzKlmWUFI1tmclaNkuj=1vt}yQCbnY>$oIOzVV^llrF+F4+7d zRjpmUR4xM3xB;_kYh+aDj!@PPksCr(sneJQ7?x2dg&Wj9U#|$x+Clu7{w0_=X`x)S_K5o!222+(DOO`G&0suYGp8}mE{M4 zesj{}iWv4(AO3~!9uYcpYHJ+5+y(~Q^b^xuW&Jh)h=$EID_DJTZmF%@l~#0=ZT*4&h?c+e&8}BNEbUGM*ifp*k7(mgoT?J4PumR}vwR z5be2g;N28tAM@h3#+U!_JMUq3lCzAPwTil#oB5ZAQ;B?ejBG_jm7Gk)LvXp~f%?jB zpfd5$i^>}>rSizGI*t5yYx921cN)Inaufa7pPA@F#Ev(H~9+T%QD9U@d0L_Q_JA9 zfs0?^<~Du{n1?A6(FQgN3z(+Ok{Sf2MGK6FOHyB$<^@cW%z$Wh=7Bqdo7yk#pE~M0i2K<+KK~W2-B;~)m z{Wo(-v+)1TY4HEdsqp{CnV-C1^?l(y(XUzoeevoRgwDO*#`{1(X_?fdN!`6irniwb z7rZyn~;iv*;>O{~o{<*vljB5tlu%zg@8|bVL8LDx?94mYWL70 z!f7ePvbsdVw2Eri0={a%Ftq|fHk^&xr3VI4bMz14kOfp#Pz0?KJx z?6B>=xTe3lCLazy#-6fA0-5+{`LBNG9KH_Kv4hmKz4LO17Qy6}v}N-K4=t9UYg$j8 z`)S|{Y~0A|D^1-7Z>zs5mb$OXvBA`hthVW^I@Ns7X;%=+xDZ z_uX)4q&D0y-HBt8sg)JmI&%k(y76k5UION&=L_y46<-p%q9rAGW{sA;suBy^CECqH zTsH3|9a1%}_s@vh+9qQJNHNk5Kqm+r&Q@9@XSttoo@Gs~;&|aA6n@eS>m=GcF8kFH zRar}2O?M~J`Z)Y4tR##N?)Va=^|?S%>K<9F%2#DFCVkDx zyTnJKuo@I7$u+M>O)KN6G(;Yo$VWTs614c8h+_O&Kc&WqV6b!rwRgKBl`m*S8G%@d z&p7=QYjmLu@GGfd%ZpXd3CMvwLb;_Bz3d_qt!ztzSaDS(OyZu1cu^d^%m;_KNj;jU z%bX;B4zp~FCHdF2LP2{)uOTn6^cWB^6{xW!RwEHr;rE|2fW?HQiA7F(R#wG%0g5vF z2H!)Z1f2khSw!ORBF0qM{I*osS&67k)NB!c#2uvtoDYOO#l*=Jq0GxJ2@SU6H%0B+ z!bDJQ96qp7$^pQ~JdxnzND5iJ%Az9A3T@QpUCb9`*4BXHdg0I8t!-3*tq-G^0KP3v z3ByGAk$2<#a$wh?POO!Yqw2XAC9>red$S7?}G;P>eR{+tl&MUZ#;SRA^kg5=5~ZH*)(qhgH(u(0WM#C$Oe zj@+Y-rR(zW3**wZsBp3iN(!EM>-UWLRpVK_n8R{ZX(nmer%EXg5}s5Qt^t1s^p1pS z!!xV5HnqNBZWL(wh|txlyXWlNQMfxGT`UvxdQZ2r4q|A&?gUwfR=%>qnuOt5JUY*J zYV?CL^rjv=WwB*}#WE$+G~{_ozW7bPH<>W1+nE?>$W+?dOJ8jHYn+*E^7F3BF?HhsRqTPDRo=d6<@c&nR+QJCoW!m z3}n)>;84U$WH7rp$(?w9_6OHdVGJ?Ee(P%3?Hfq?mY6ymY>L7}j!`YsW_N$ndSyv* zbZRV)ka2#TPsVfe)X%zVUoZ9SkbvjBj9B5m9(vOpJG9Op*FrHKJRRHur+TZd$|b<7 znHqc;o0(d7K$@>(a?i?o5=cVzU8R@sZ|l0BbZS(h7a+mOWY)yFoOu=0R{Zu)E^eEI^@oI4bZD*P$PZ^udryptk-kO!rLy-9~b$ zPCvF_a?EQPh4i{;r+y&)*vAMOX>jSDw>z?ugXW=j18bN>!_F6d-W9aIyJ%Gtrn!Vg z<1r=ZIyj&bTSI*^C2;Tu-M7K{1+)8CS@0m|2OY!@chhXP+rW^~QVX^MlU=8Pc6fzr zwhebq(bX)2yySW+@gqP{m74h&m-MXvzD2p%`KC$OVg0eX%x`oD5ot<=j4ETCMkMDT_V>auQZ*wxC zt>Dr!Ser{7>2pO&aD!A_%c_Q30Pfy5XmQVO@)12T-uDbbak;p{(laZaVwmDDh8t0oC4p6D?5 zY3WIwg}_cu>Af_Abl_Po5i?F*Qm!hhGJudhG2Z%tTtZCosV6S#3bZ;U{tj@+T)*cY zNKZmRaiSLSer>YjhaE0f!=Wy#_ROd>8^?w7_@+MB-ml=Ri+e%eO6=^#8$-@NCJ}FB3+>AKz z)kF41yTQg#o4gA8xAL&$^6bVlrLwpR^XGm_|ssZ0f4avujf+DDoA3fp`; zA*4AAHO_GQn`wo+jd1j{9*JYYI>u-15^`;yoM`S&9f@G4pBUHcS2S4;#XVT9ekGCG zRN)z@^!!6pop9M|@Y=|S#uZ87)czRniw)LFaHd`P`4X5{1Op`uijfA%-Y4s*{u?C zfqbEIt&<0zK`IoCgq)C>cyoquBWMuU+fWreDd-QjB@MK@Fg+1dQF{cByu^Zb8Tyb4 zotXw2P1*d0X|7$J#!Wm)UigkS!ICc`BsGtMt~9%;J)@Vf0&OxP@!4V`RQe4v(@Ycp z;+!)xxg+p+xw)}Sb+Sb{u~b@!2iclGv}T;Gsi!XDQwch~=VrTqCP#I#p3xR625Z`S z7sNOmWeac%qY(jfJF#Z_C9hwxlUNHrW}UhZpvIRXYElg+mf+!3@Ktg z_i%5H26sL1deVsmU3|>zIT!IL=Gx6g|@(^YF)dnjk!7-Z)*mBjC)F) zkVkb#gj@G6PT?_9BWl>-6>K-~!Yk$f%)VfsTM6iB$MH|8VH5>xRFWkX?ZI|m>!8f7 zy>^Lj%^aV?6@#^a%O_^jF9L-$NGJN!Ok>TJv^Fu4#UX%K-QPpD zeEy@-weh391#Rbt>0=Z775Tw(|ErPloN;b-y3X91B1vD$yGsU@ z?TT$Fntg{)CSap^1HKv3oZlcd*l^%uB!ohDk{V~bp)E~?@5eExUP4VlHh8yN^I2)d zlnM)wC!3y)jsDxK;=XVFF5=>o(SXfEcRqZK+UWKgx#^s{1zIJ`u`*U2@}yYlz5lCv z#@JLm!?BT=F0h%Cq%p&@77U)0d0YYMI#IWUSF%}QCb6$%EKYSL-y{t7jiQYE?BEmw)D_RfFXbA*%BH>6Vm(@{ICp_(?m6Z0a% zvB007b0e}>gs@>W2{Gbx07c{U$@+b{x>QFUG^#$2o?4^Vkfk{1Tn5XzPnxyYeRmLb zJc_9*fMkbG66?ubo{>^LiK~ZL$BpFDQNhl6d*=-ZPl|IJC1(fyG^jv?wceU#cctVo zMIwB+42886Pd1;e*a=fHn?q>LJL`D%T+s?nG?OflL=%({2bwRl< zu(liMwMUgI&}R3QSMq!UI`~gY#I%>sr)g+6@%c`~loz5>>_}m3LEb1(^SYd6?=Um$ z0eT4~=WWK4<9!LNP}N1_F`>1^Tx?-+zU2$xi6C31ox~ z(E~q_6LC!=2fI_e2XE#RL=_Gf-5X&y_IxdFw9;9W{e>Z(^6uMXRl4TgN|Xtk0InAa zC_zlW#@0NGZF2MF`NLqitXy{vv;vAVmhf8%%W{?_R8eZK%RYh~F-pD(euhep3f~0G z3N(OSH2etSSs8VDj_Pa>e1Azl@2ryDbEc3b2LtNy8yG=w9u{h8Z&`~!I`)F0sGjbR zwgznfynXFJn(3tR2Fj98)I^+=?p8Y0T6t+LREtSty7H%CkHAF)#Doa(H++T=NX#Dj z9s!KOd-*ZL(cInz;lQ6~!_UYys+SEQ;H=K*K zQoTHlL@H*~pxN~P`zaFGfTFB^ol@C@00ANW&uNvBt@Yn5FaL;#lReuT(NBm7v7-jP zr8Li%^gZK2@d3ISfpCabcqkqV&v-+{RU~orezq~jrOWTLVX73 zGPSK~|NdUqGx+QzGe+olA78O?sZp#7%LGA2mf0I{hzD`zSS1dEcbja(Oyul8qkcHi zOWBigNGQa^fDW<5xbir)@-5@!BOqWPpRf^)i03rz=&%=@9=q9)xCXr(;wKc=tNIb# zuh4p2GA3WC3C5J}MqAaD$KvE5T^0>-?k){mJJY~8CHsOSH!3Se-JXvd$_S~PkN-=W z(9UQkJ-?)>@n6s3E7Q#n2U|Nw1|wSslfTZP#R;-<{fvmgHHId++~(%N1?;qfm4d4U@`tv1W;{p@-B-x3Q1Lpi0I?Aw8aTBp9mNctpstbS${F@_hMFTf=b)hOMn~(NTbt=_gk-ZBCvj-M{bA zkTFSWN$=B6oFEZ*q2&r(tJvWS&mlrft#FpUCcQ<~{d$-g*T|MX7=%g-DLHYJK19}gM}TJ3<2nf6KPGidy{d}*!FBam z=R|kTZT$uO&Q&`S+HYMY8bE*j0SSNMpm&uTZHStIvz9|(HZw=Ti-9W|9vVg!Elv~y zOn7qgvk$$LvvB#{2J)To5%Rk(e+p}}yS3aAG#sp0T^iJKuV~m@F3~V&&~rs6SP>qR ztG!x1t}Dj6*%%(eOWyZMs5xY7M&Eqvlk}y*8!7 zsPS~s4>MsqKVet=FrvS)aP$}0Aq)_Dx8+Q>Nju`551Vs=yqDbbE*uA#K1m}UOcwnv zMK~=Bu^-YHe9qKBRI=3*l9QKgDXFzZDBVq@Zm2G_ItTA`# zZM%+De^-4a$;V~?(F%U{_IQF-P#yTMfo~oYB*OOUXw>qZ>(6L-Zb$pG(ZF=D=zYkp zx~l_PB&Ye8THWZ(O?+yq)d~LbRP9=cuW=^e7)m?Is4(wwbxOHv=t7F#QMdRvAvkZ# zBWPD^Q(Kd+YX{Nd0)4KeiRzWemy@g+GNnk7W^P#WX1@czVL$G(j6p;NW9oY3Rzenoh^Qpp8|wqGR}|sNFxQbYGNqgf5DCyuL-Xdfc@a4D<$pH@;cDIqw_Bg}vp0Dt zs9^x>Q3~3}@>Si~3h0lTSwB z94kgV<_(!a=j3GK?qWF#l~`DkTRJEpWL)Sl#pWmZ{#zcD)}YXL2_G5ON^7V$80E8W zR--8zYgYPH8vU9C)32wquTrtBIpb<_$RII@`)MV3r55%nUH_}cKimMzYwEn`X8p`lk zyeU2?iq$IA(GDQ?r+%p9bAZWfOh_nPQ~K=9zGuG?-?AMI5y2IqLu@Q`7#z9sRg7H6 zTt+)E$>I3@pt~o;Y$!;?k>K-VPPF@@Bv*#iR54Mjy2bO5Q(J=;Mkoq4li`Bdxfy4^ zmRX$_H6UVk`@q9ICNtW1Dj--8uKBFUn0pU^?zWab+YjBwrwfkP`*Q!~w`Gni9fns- zH}J8@3kV<1J2j>SLHF5)FAs)W9ncy<_qsZNTh(^&7V{l6N^;I@t2`Rr!V8QB9pRxQ z?S{Vf93HDB^eeRT%Bt!Oezf%^O^{0^_9UQWZAv?s0k4Q5#yCy_WL`te^Igi6Z?-T> zVV7;O9yr>)91orp z>d6rZ@O$4i44z`kkZhjbKkB``-zi-!-(KnpJded3aeqAK^1lL>832O$pnBf#=dl>m zy56_XxdOa(zdK-KoSul}5Ft5cm|A5~xR}O)%mzNP2Mu8BY-VLi;FZ!=)n`DFaE@^t zCGxJR5bM)6`&Yuw_~9`RoM?aZ!FnKSi8zFb z4_Rnp>GX$BjBkkjI9v~#{Lq;x960QbjgcwZK#N<^CN>PZrp|&+Q^)ELIv(MpG{hMV zwe)lHJT*ezI}gVkUSEjszmNnsS0bbFJL zL&3?Xw6Scw>Df|GAAGmiA`fWyBm(amuXPr$8h>KnXm@)}3VzzNbS0RY(~_{k_;%Oj z)RTJg+2v%rK7GWnLKCf;`m|SGy+NvV2{4iw@lQi(98PX`AQb$W4 z!eWOMSPqMcmaC6MFknX=T2_uk+--+v&seOTgHXPD%5z58V4NG`ZrP;Cn=S=PsS3F9 zqFOsJC%st`bG(OYcB-+6_fV#XGH(7131Ux^EU+P(rNy2m%r|wRr(HuwubOyQML)HS zM{D~8n)r&~ypa{JZ5x-zIId))XZ*Oq(nXhc*l3w@(!^4IlxQ9p)Vv{syv7`55Vn*# z&GnT=Tnf%ZgOc5xRqK*?IX$e>98_`=n={3;`a+TeILjrgt`lp_kU9Cott2x})O;9v zfOzKfyGBV=B>x|KcqN_ZHxyb#P%sLIsxx!KlL)P*rHMl~q0uH93(<~23JFXx3ryVK8xfFA$)9a*u;u8CFlWLg$9tw#2|A9k?Go=?st3HYILoyh?G`M z--*(P?CcAU4RiWc+$F^`Lk-*cX&SoICMd@e?v_d~R>d?z$uqRz@bfFq|Q=}c&vFx`>dtb^Y;luWH z%Peqe$d8Y^wV%D+b+VCq(Nvs>bCKTm#1FKgl`Zq>DL^JLFE|mXb(ilgbM(p^JB3E8 zI+7K~&z7WhrYqDSb(`ic7xBmP!Z^!3o>xSkc|{H*IT*^l_W{z1+6@fgtW-+Q2=p{Y z_YcLI>mLu``dI0Z(QCCjwvX7wE?qpdZST4j3lBJ5iaom=ul?PZO>6z3@SKYJEn1J8 zLwPC|%HBPH*r~DJRXY}(ESsv=&zm7^9(ReC91aIvk#q+w9|^wZjQ?I-{GC-;oJa%K zzSg33aQ|h4+Bhj27+U?qZ1|HRE5FW&IeeM;fLE|V#86aIKuGD7$;t^^lC3jrT{-At z+(FmX=Y53N9Lor(mF&2(rnWzzIj>6;R=`<04>m7U#W|{bpWfHY@tp%~vZQbu5u>4X z?n7jDpCQJ4mwB$;@8$iNC zO6`O(6*GxRa3LUtnTvLn;rT-TtSdD8gOA6RcxNc`-3xEmbOc9fi+_iOKurYo7mu>D zUiM5V%A;(RGAlW>NOWEx7amGSO``<&G&QdtMm*qP7HT9NpiB`C_umSdM8(peQpbO4 z9-hI zTVg?82>K!(G!2i&%7;kHu~sLoTWO(!#oTc~zjrk0{=3CK)}C-YP{TK1;sv~h**py7xQoz*pM}Qs!)+};MPCNB5Pvbh_q~!jX==}3Y28=QK4JeR>TsvT((#mLPF}EmW5o z8P07F|5ODE8#q2Xg$9x9GWf+*zf35sg>^vUyt4j2V!BO0l7tXtEh2 z5=tA)uwPERn>YIGl1Qx^=(Ol9{SPuZjTdD*7;N)v1gzpn#kJJNB2tfLRGG*;&ORx! zd~)S73y5%4wC|W~_ydIE6jMkCoJc9)QujC5A9}4q z0v0KPFvCP^bgJxT4L5A3+_Nw&$c+d>dGJy$4B&N2%vTx9D;BV5Xz93>2gWqd8`>mP&Ns$HQ^+ng@bHkr4+(W`oIc10wUI_- zuE5^5{drQ4p%0ipjK1NK%?XAAW?k6yzB`B81ctsIM3f%_?Pxskur5%ObcfaC$96g8 zeIc+;kYbLKWeoV0-&LGHB6yEfvuO)HNVxUq{bV7}IrWD@*}tt={gwl9Vb(7N=DAmI zHpoQgSf4U(PJb9)(ljq(g+pC_g^?)e))Sp3oL+~&0T^vSDnqr~I=@Q18LShw>U=09)Yp2!mLGfu~m>_bzA$yci+^k4W13i9!gwdzniz9XoRA}tmL8(!jiSW zuc7X2Rzc^=ei)d>K1ub|tgXfd2qY#RlS%Wk4opJfRtGJ}H{@QR66^?La5OoOP_G9+ zqR@991Dn~tu+-G@&_5#wU3$E#F0I|rlBrsfGT%vJY_Qn=gd0Z=qa%FW$>@L?WwkD^ z5kh@a?M^nhXy{4jlO-PpIC$A+u|)i|9zXd&Tf{}ssXF|idN^x+y@6v@#Cul!74;)( z31GzckQ8;XT?iip`?MH9QP4OQz#8Kjt|B}}CXP%h$#C_04>NW_xE#P9c=0>`GsJzy z7XIb!6zD~wq}sz?q~LUo#E!f{qcw7^>Ib-gRl}W~{O$gSgzDMeZA^O>T>2i};bXJ> zqEw^vcGz6FL)Q1<7y|2B+tA6J0vzqV2YOn`t;|Hm+LH8E8Bk9YSxTh?};9Wmq*{DlB^ zn*$%7ON4pF*dI{v-5&tCW_=k^Nh(Y>8<*rZucxP3kK&ow-yW&XJ3&@JbqmK98`7W8 z|MswX)Sj`4VXYQ&Xjna^&rg%VOFMpeX!x;QO0eDfTzS@Dny!*hMSqC!ox|7l`Q6oa z`RHu#bh_YjpQA%V*}VOhyC-e?;r-OB?)YZCV5+^LmO7*Lmb=k;X*d=zSunNcd!cH3 z^P{G|yOX-2-dCLvXu5?Nu>33N?2MU#Kj^KRKEubX$1IYXI;5n7PHj`p`kl?*@%ee0L)NUJf|~lfScBQ&Dq-g{ zj%UXz?BLV=xZ4u__^VAvcGWb8OYIJ3ltceTMXlEp<9YjZ`7z?{UhVZxE(Db@{DjSW zgQQ;%9xmGB6<;wnmYX*PZj3VMbKpH_@#h4ajk8=RITL>G0;8GF1(1N_YSM__4EzO( zaIwCdfr}$^BBpnxuEayZ8x9+H4#be!)iT4b`N681@93jB@)9EAn(q*v!BS#X%EcH_ zIty&1EZ)S0J50F&^|J~h-S(7oM6Kh6rg{y4P}S<2l#zxLjbryi2uXuUf{IUo3Q=iL zOM*dKTB2Dna4P=Z?RryA!&Gy@8Ny*9XLiwlFti=yX0YLYf>u(5*jg2T}UfQ zD<2#RaVHn>Tb5r%0q%tFt_8ck6V8$n4-_0E&{j>n;k?k=h%87=af5# z6ZMm!?B#>A{ehpn93x>mbW_As+}9 zUO-w9R4l2RIw4AFr><^H5(Gl&Ecf({O{B6LCJ0E1Yg=(&zvTnidIfQxkp(`!q~)2Q z8);v^CQ5@4g?t)WFKDmF&3W{dL{O-bpqau=tf-q?ag<5Y{llnR)cWq%>{{UQRQ3Ft z8rv^0T25W*`*~klx4Jc*qy6!-JTs<5dT?l+_)W*YrWyrY61 z>Q+UT^v?tD_dIGRb6Sf${`^S2GWtqTpwTgua>$>1QKe z9-}@s&d_6ZYtywV7K3e0awGoa9&TkNO8gEGp=VW`z?)todmBsM-eicXJZvnoYI_7S*4*~R@Jnqx$s+X!R{h={&ls%Iz_Z+{za33X)Ju7qO$v=5wC{Jv=m2< z$J6OfeE9Y8k^;MUEzUs1Y9~*~2aeU8bADz@2Ja`u8>l19hpe1rGi$WcemXgicl%a( zc{#v%Q!-jyUw=xvUb(43&!ZgmX@tJJYLr;BnN1cD*$(C^%@q^yk^0UQ@|^uS*3ko^>#JdPua9S!qS#cD z@pN!=;%MBYbDjyLnh~UYWEQ2qHnf(42pS28Z z?5egV4LtYUx_lj}ZB*%tM636gdlVy;wQHkcSZi*x89^qUh<2=5V4=9MzShUtD2IHa z$r+FKMQS$w^%k2J5l93LYuT!7b54?zP0ZO1TWleuAPkiJ+{THzwf&UT)Sp=CSoD*# zatqNV7n5}n7idiEvcZO_Y6H36U>iD$k#(^IJQviJ?d4JfWp&tP4Mx~ST_y)EjW@s8 zSXrH@+zBBt1@vlqR|Dy42)7qEcE0qk)|{tkFO)QrP(1#G-1U@-ioP5sIP}WGjIrnV z<63@%Nb}96O7rPvGX0>}Z!U%4>3l}YBu36VgqFo)_4KrgUUF1>Q^vddKH z&Ndd|uu)|tjs5c1tKR-*NAa>M-KI4;sR}U45qBN5H7Op~D)I#(htmUKL&4h~E;cPK)vE1B zA;Eg{MjykuXCUBkjm-me1mW`_-$UY0Pfu|j2+P8$2w~+GvTFk&5!T+;ZR+gzhr?&Z zwWi{5b4h3abU&@)t*sG{{AjxjtJ3Hia!I*ptj{)a*&BdPooS@w5m*oTbGQcNJ;cBF z-2fL!PB4kuU{xd(L8~cfxqdlywZs|6+Hh2KJe9<7Ey|qT;ZCAdIt{FgOEq<1MQBBk zlskNln^vVm_o>p$whb@U!!Yl6Vv_NsM^rRwEiR_^w)@cwqaY&{!ve$Q!up;lZ{bU9 z_z6wb!xIw@n?({P-*nuc1<+YHozXskWsu~o>dpyZ-DTzD#(OI?DhifnwkV6+x*QIN zUmIHzS@w#Ugk;`au;YYg!s~Q_s$!*QyZLg(K&2dkrbkTE_I>T%Wp4#qsC}Q^{L~nS z5C`lMhv>OjJHS%-HOkbY687wmg^*SRXqe=nv z2Z=C%Zk;AJnl%tM!&Fj?RKnD>gk0SCNzD56y@%0RODhtv?kSjfS&L~BZH*!qj06FT zslPvfdu!7^THRq2Q{>{0HUvYb_2b)P4$i5^upK`!fmJqG?}bi>)t`}g)#jhEJxeuu z40Nsir=+s-WBigTJ;U<26bw=!^GLgPOu_TXP<#vgynkLuZs6==+zzMxZPlHXCN{0Wq%+fCe}mc8~Q~+_DAZ%6t9Mna=#V;}ib) z>nAhK0k!$U+(dG@EVlZ8GRX+?tFlQ}HIQsl|%&7{^PMQABb+ui2;X}_9IPpN5WXc7?|B5^c5S!>bI(C7!J z!cMRR3E?J~m2FBoE<1)zr_#;e$&h-t)c3k{^esBs7{`3yj)&n3Ey^uAu}~=F5RGK& z7<`{?&zH1p`9it$6+w(vh$h>8dg;Dd{bFQ8;YaO6?r^Ny#xq z@O?JGpJpsR)sAk|)93Mg- z5Y<_n-L#dsJh1Jtj^%quvtH|5weVLsB|&-i|8(deT%gGYL0%iCLT|$mJ!AZ*d{s*PU3A9Wj0oAfK_VrgHE_qbKg8NP(L6hf2$Fvxw z3xORrSWGDK>gp;#W0mzj*DDlq zLdj&7>G%DJbF18uv^LT)?Y{4g;4R2LTO7Kco8>eWI)h4!eiN{Pk~W>!Pflyw^cHCq!BwQ!uulRpqWLR|ZoXUBHs`FcH5H zrrcf+`qoIQTo_OTq7zfR{$GN`H8oKKZA`K>c1L#(tCnl_#hO4j?X>Z26e0nysgEAHn*&6gwNT1wSo`eeC{M5ISt0 zrRr2hsuVasj1WKM9uZHkBa=DIOIkgf;b6cCLC;SMKe6#CEG=cy4ugzG4Dz3_b0#7a zIc(B5^XHQsTeaB%Dx9c0-$*%i8BUL*9SouXpjgjjC&sH6%o@KlH>Sg}I$~5P2}J%!QGvMLvVK|xVyW%yF>8c1PkuYL4&)yOK^8S?(H5uy8C_q!5(|BnorfP zwdPDV?O(P}#EfU22Fqf?G$B6$)klQw{Zp9NDycmKLBjlmXBmATxyybL)FhLrs?kW4 z%T0)eeBCHYqD&`HvKkuCyl@j~1%i8l29_1*2j&wH^uge)m>-nl+0V|tcBLN^T$11% zUJ6$?)9Npfe?Z_sEjJgvsx$INm7k%8NqoGpp_@2G`|IoL0d%>#yWLXjmda0ex;N97 zh+WWO!Jk+2mv(#YNEf5QiBhD+h*)=@Ps0I?Q*ZYMI!@A2CPwBr2bg5K^ZeF#mama& zgw?=EeNlzLiwznH5_&Y>+yW`$3(Bu%?s*q+QnTj@MLL-lyD@d0CgYNym$d1w^69^` zj0K-SC}$TPm+JfMOKa%GZidFIJ*OKURVvl2+knQdkC%VvUp7-zBH=&>-=OgM!MdH~ ziW&y3UBpm}J;fL1_8y2opYxhOd%-QNGrnczslR3#{#&eSAS~eph(dGknOht^ zbseMRlH?yJm&j6-{~I{QqwX@%Fgr5ua4kiOqJz~i1Uf;otG3&=pqSa>KrI+hI}Dt9 zXsp#QrSU8l8FePo#9%SjPx)QAxIgkg(p*vu!(fty33ufn18d7X_((i)64}exd`*xw!kWv4&i$MdnoeqFO!D&((WyI_czpyV)%Am|*;R9k&qJ%Q~&@xNsfE&4~W~ zB=>=Ufkp!{k*{jRU~X~{rP=COfB;E?e?|VGU0wPq=h(NjavE?l`Rn4<+&K1I&fgzE zir&a+htqB19Uo(ak~NQ2Dlev1^9v*{oQ#)`*Gms<3ij~dtr&R$A6`C(D;DPm8v0J< zajD2|Wb64nd-3i(uE+UQWrj(OwCMQVnMe#1gn*qsRzYV$N`aa93Ypcyy>7+CAIxWfpfeyuI3+_-p*V zTk5BU8h*01o$7B5kc>t&`cIQa-w|igLE^UgN`bg?=zMrm+AkbZcM{ouDbGa0uFY7h zb=zh){r@rc1VEh{Fzp^(GPHDDw9BR#mMKQ6HF+HVSxIYo5>LowwThHP#Ub;ut|gIH zd}-=1v!wu&<}u`nte3=Mm7CXql(Z&avDkW9Y&k;)p#r}_;t1vk8Af@dxRLWvSsHe~ zEYy5I?6)3%jI*X-m(zbCEF_!;?7{TB3L{zm!oi0Ikdew8T}`^?Z%FM` ztu?Rt{9D8aPrrb_0!T;h5Kb)@T+UDI=W^P$v$@K|IQN+r=l0O_YBD zQ|w8BXhhqLyT}PbFDZ$Z21c8_*N$Z@^o&GYdQ8pV5LQ4FjhNHeewxnB4gEuDPxszr0)qLrT;da2Wx{eYZ|MYA$O&kB?L=a z&*g?y`XF_pZtTMK9fGs(KBS^_yFIAfK7+SKRutw>coKkR3N{AD75d#i< z2EwObrEYv&EYZl+yU6=K z>~$fqS}bxZT9V?!l{wGGpJ67T-Sn)?MOlFbQIC;BA{ZqUaTCrr^A`djvTv_lBGz3u zC3sSa1p0!G^`3+Q02lTz5fO)y0`eO7@OmUaDv^?bTS5izLNn=4d zga%ipZI7ECT*%dmp>~a^I#~2hv}}xdsVh0#C%e$fWXoZ?Jo=!g7F|cAzTgv?64V-l?89!3xPw zjv;~TRz+)>iWX}BJ~ubwV@%71h3l)eh+h~PP@rCZBkQPzGUfA)*mj@A67sQWZldxJ zsb2266K#082tzQ19jE8VfLE?1|7F(Cqa?{fxcN=))uH!HOrVFMCbG*PEeVQXB&o=V za2F%rAutW2c_zG-&FKekpWQ0ip&_Ax!4@BlOuMuW=qP#eq{dKxlRnRJ0le|carHl& z!^8n{HN*TJF;TsjM)^3Q_r{xp%-zRBi|O4@;vKR}E8BkJXuvF~QfCH+4CG$};Ubqw zL2g9%!uT)X4gNa?5ji{|Jy|TjH?EuUXTg~vloDyWM zl$T%spgwa+kCiV{vO`7b2Z$(H@_{E$3IitlP3jHM%8Mi`32KyK#Dc(|5U(>P<_G1r z8m&^OClbs2m6Cr^-fr_4I>Ml_Pi%P|xZ|WU(8&g1_hl#w)ajy#PKzfI~K&q z`##BthAJD+dyyhi;FDI>R_xFNCKvl!r)w|J$TS`q3S&J0e=VQ4MitN2My5-|!f6Ng z>SFJ!gR0g^lhYq#n0%;OD3|x3pYys%Y2pIUR`+50&XXJ@fk6@V7~ss*no+ixwO~W& z(>INX?!Us<2KB5EKTIT!fQw2pIu&s3GWD+4;vd5Mob&{I+XiVN>(ss&U6EJ3)~?3^ zr#k4<)})N?cB2Lfy>QlH$f>D38xFf3{~W~P=s=J9L)o5wlNsuL1xgg4V5=A+LIZwJ zVqRQUKGaJiXxU2f#e4k7*YWocLhq|!{92~Ys7JF*o8=B=Z#{nq3Fw|Mr*QNZA_99& zK&E{yzo?`$MH;_J6{2&9UXg3zXgn%dKy@C6D)-3Zp=ygN!rSF{`{8Bh(d}JLaBaCJ zWie)<`@WtobuXgHBfpDACaI5$36=4vTA0%$=*TV)tot76>U%DD&d@l^%nE_QA}^P{;5Wb^R}Kpyck4t#ji4Bc11N{pX;3Jl(w za^Ky-a|Kz&}Auz}+1vIY<*~S?h*V;&V9pj7UqIjFbTmL-0QEWfpyR znE<$glwf*bKqh)=ZmI(>d}FK<@oeLF%WO%atsi9AuHhfsp6I=Ymb=Ec(+Z8!CzCW0 zIX<&6`J+Nj3n}N5nW5M7QsYMou}GjIi8@xmGOD5}-Y^(w`x7o=B2V3g_aQsi%=sJl@K|2N#yCTmaYwkm=suu^1E^wU~Z9B^)-Q?hzNySx#&Jp{_*PSrFZ!rf=<*3D36kIeF zU6p+Y8%=O{?!UR*0N$X`gTBVkx2ezl0^5xEoXkF!uzFeOHW&((%b8zYRjV&xQ-5*9 zqgjfzk|y7`W>}dl1^r%JxrT7@hu~Ybs0FU!4jMZ55fE{TmVWlVR6C2}VDoVnqj3){ zu?&TMB!fLk+^G58zRF*}H^%_1kyh1(3*F*LO_J^LkS&F>C;oDVFc?HS&u zP$$op&h6M=#5E$RU~-`n3P%eM0D*{j!-;=(bQP7bg+-HjN7RiRA%dRb7bb;vWp?#b zdr27dZvJLMK<;qGdkj*%`L94-%=;3P9J2}QAOW9Z@(gSpMvwc3dNuu|-1{QYo{{O9 zUi~Y;+7n&xc4K0G&0L`y={BSR73m*RN`xJsf7wL=R9&Z}+)E#%?@{?sOSOqAzd6)6 znv3S63V-zVqxb~UdZr0{L@7ptOZw#Ou2|$c?Gdgw$TGiE^aoL;OoL0!eM}wyQi)eD2KCL-Py?dzR8dd8F z=wqS4VatL@Axz9#BO`!K6Ae?wMtq@uuDy27kC%!V=zzE*dB=E*hz7iZ3kJJdfPgW+ zNn~GAuq|+@vNyd;8iCA8imiX$4A64;|T&YKNN1jTB<^1#3tpJqhuAl1Sv_T|F=Znl1avh+c5OPHOGz)7f1wH1ShQp`T00Hl62 z74DzVChV_g(T{~uVzV>_AWSE+vtrCNW5}PU-+YU`)(gP2OPFl7We^ z;n$wL*^AQGV926AWN2k#YD8mQOxR&R{WAIuK9em7mgwM+W~<;=ofSq1k_*hxl~09z znstyUhF&X5BWT;i7@3fBUSkFf`+>L&l}T@JT*RK0DBqK6kg7L(mP}rJ2ge=m^7_ar zw!7dRmM=&{3+uNIZ}SvdvqV*cHUFtcXXD|iQsnonIUmoU2Z&Tt%7k`(dzqog9CsD0 zaCmJ}L`^^-Hq68*_ugtqofX1kP@R$KENmpnEv~jB;`-DB+FEK+oNyfHEk7)W)^bbM zJ6up3kqXMhzk){;ASa=eyvDBbC%c0b2`5s7RZ@j0d*XJ7BZGz}1_J)S>~(Z=9)W|# zypQ?AP0u1Wet@?`1yWI%maeL*S>F4)sPQ%gai=qy*Vc#M!)s|kX`IKRHRC1&3VI#w zyY&Gbvq85A{`EZF3jcy}U51ILW$=DTT_$%Ungp~&9iY7Cr65654UVxr4q7w3F}9q5 zWnkTlt6Z?DdP1R`u%@$KZJcF5bnbC%Vwl48DhLusNlM)Pr`t<;y{@=q9a`@n%opLF zD=LP7Bf{4SRYe}in_u41L*Kltnbvyi~Rrt!K$2~XXm#h|^l()Wem@ofi zfDrmx8wxi$nl6I!+x5|(`(^S4gUx={KCuP76?H&3?aVIjCL7b|s@a~g6lOOnCZbf{ z-z0d9EL)9OEeh(*@S#Ci5pYu3s_mlSw{2gJr);sN_VtM8Rjl z&LI{?x@l&9uWMWJR0XRtBT9r%H7xB(FJ&$`khE3Q3Z6HDW4HB~oxzJOTW%eDhaXv* zc8sSw+ncwp_42RBzZOh0sY2?0SExVIH8r8*6tg)Bu6v+ZBEa4RPN&79jc@1~-OQ*L z3sg@&rjE&vgP)%c6%N^-#+Gy5zGxA7fF(DvOKW>*7zGD>f|;ladLpGS(rDG8*6S{E z(-R-VUJ(16eB(qEgSl43k~VI*NB{@JXgK(WPSl?eTne^6-s{ZxkDQc9=Ws}kSnl~Z zB5)p8PPD763$ffgUpmVCy&olDq{{P3j|Me~1jQbB5#g2~k@4Lw8vV0LFn4viiW}jl z?ofw`0$gBN4Au)Bd4^E})?+TJXv%Wfub`pKfLlJ4;Mhc=jNd|X^%<*_?mqv3t<&ab z_bv7tJ{Ql1uMpcXw1{UTEUcU=DaYnx*v-_zFz-`Hqd7I?=R?I5Z{s{{zJjiu1h%p; z6GngGS-7u^U)b&PSp32PBVt^bL5iE|O_^#4Llyd+U}u`uVMMLpgV=?XR{MV!3f1}u zc-JfqdwRChse3U0WWvqXMSzYKFT^3_Se3>Y`YkGkiwjUwbUX^G0%>!SwG=8*^WgIzOw#sLgjN6{)E8Fc0Re-!K6}k=>$eMwdu#Oo z`UMzW)8cjejdt;lrnC+UvEEu-vz=v;2;w5+S+TEM{9+^47hjgJ+nE7C!?IAaywJ!c z$Wu~weo1moCkGQ+kURVz88CJb{T+i$zbEG?Waiq(k9~U@hd=U-fQf9BRl~5KSTROvUDs(3`0GV?dUoqH zRzvid>t@qT`(k-23S-jpkzfwoDBiQgS9eti4h`3X7>(i%-LC;j{^{D9bVH*wp^L%1 z_CI)8yW)DK9`;O(>wjMp8u?g8K$C3&LefV@AP^vINC{WC;+LFq2LdISa&>L%`ZAcs zb_9BRH_fdr=O|4o1$XoR!irWIG8k{yKA<6Fis9wF0caCdfLeV0J14!jLEj4j65+rd zKEZrJUlb@ZboR*4I2+vkr>(wcPbJ5&>%v}GTVCB_d3`8d_a1r1|B+Ws`$|Nq z!wHqkAvPaKZjUFi@Yp@DbNPbaXm)?IA_SoDM(=rFbOe%D<>gtaghj-kTHo|^%iY?O z)fiuS<__gGfJ+H=xk?W<82Oc--yA_BYj3-w2@0a&m_@l;C2owe#hgKERRVe!KQMJJ z4Sh?{cv$z}N<&%>mEf!DQtIn939N4dPSeWfQW_#DMe}7tFe-#Y*7=}=<}XvoDj20P z;s((nVZ^{oeeKrc=}|j7?QYe#B;tDUYSGK2>T%uCw6a-1MGSBP5I|dYctt?KLqy#D z>-lk};*pVUhEBDhwD5z8#9)L-DQFdk_igg*e0*SMJ=asR(CEsL{pF$KMnvh#sc6?q z^$l| z2yI6L;AX{28Bys^mJ_7!#xnX?q?AP54GCOX>|yTn${9njJ?JM;89F?bF^6J(J(6#^ zwtoo#&lxETKfB51J)6l4$i7Isd~?9;H$&vL@3V?*nANd^Q=FSq9;9V-dKvKf`hdU) z1Nkom|GEcR!;|N$=Oi3!Gm~D6?0aMzWtfSHM2x^QlUvduK?r!_1*Y#V5bK@%7dT%` z_Sg7}gvI^aRz9QFS>n&1bf0f=gfR|U^RgWy*9z*}2*(5Tcqtb<##1fr|9H7gZd;Lx z5xhY1Xd(3;4G-hWg(wm;I30V{;twygO9UW!Sb;_9cn}&&4pomN4j$HoiNA2pcY7qIW-7d4sYX^_Dg+s|=jZ#dX&w$Br85 zf!tMS2lps-!u zG__!C+h2Lqe%m|@+VhBO8EEHwUO>te*~T8J@>d(D$G|q&U-ecD{nE&Wlc*aw z!fKCX!1LtNg9G9C%;v1S!ebt9{PRKAqollOZx~f`OXJ>0thD6ZcL7&|iv^TMwl;@) zN!9F0OVv@dQPdKsGpx~5`zuUjcTR7y=-c9IcE`$f)y!z*`hN5^LJ~?N_V2@{B;H{` zL1A)th_U#->*;Hv7a#yx`=AV7vlajt#on3jSkoHz z#>H%x%$m88Qs7u(E_eeTU`7E|V>hWF%|F2MUj@nf;>rWQPVIui8k)#+xNgHIHA z;G(DfHk!rR^f?J5q0WgUPVB*x*t9byFoVS>TvnW@4X8IR=8UPhF0Qioy8q@J7F-_j z@3)k7gHe$r%1>-`erDZlXM}{?T|PWfQA<=dWU2lbj#OS556{T~ck#;%U(8_OJ`s?u zbSmrO-Yeq)ON^PnD(|h5$DSsc1v>38GyF_oG(1GgaotHut~#X7NQ4tOu6z}=4tbM0a&*{@ zng|EZw%2ar(l4d`56!2;-Fl`^IFAAqxhOTqD7o~vT(&Kn`NW+RxebFCvS(OsT!Uo7 z<#LBb4Vx>;_xF>D-6XE2Zy|ifv9Qp>o-eY-IO@KZ2DR9hsWUEH+~*2F-a@>JuI0wubq}ne-sFiS4l_q*KHVb6c3KElo^)Y zWSdcQX~?c0m_tIg=Kfl~-D=tN1GF7ZwVg4jDW^xIJh77oahB#l9~(3Ft`lt=4iLtT z;{#+@3jcXg5L95-7`Aa`bSxcATr4`7!9TXa8~T)V*g;W}-rYH{oS3XOBZga3fP{TB z*{cd&;Xo0ZgeX?+ZD2P4E2#;Y5zh9UiT?Hv4`*afzS?@+D8!#>KsfSrh(&*G4=gaT z%KK49NGK)OkSNv<>pJ-Z_`7y`_(aYmWau&!J*O~LeN}8LBej7-&e{2H9T$#@^#yiz z<|5Z}Eo{28!(}pv?3W@uTWWj~@74HRz+ED3g5c!bDH6Il^uO{SwoO2kfE9%OcXt!g1HH{8KzLTy3lFQ7njsQ4g=&6l?Q%V@L{+F- zKD%Yvrl$MUYrm*T%6)Wy#J#j0C*W<5*r(e47yH_LdGxxBbsyjD(bS`v8HH1l?a&A5 zG{ZCvi(k-(vIs^N6qlW#w4nhF$vH@se7Q3s5MSCpmgO<8;IdA0{E-!$DJgthfOg-8 ztr_i1Mh=0wB@My&Oh^s3M?5ja?ym$5OmOK)VKR=C{ysM<1L*{&0q3S4kt@n?(>DGk z$=D5^M`3i`*$|FsV2dIaCHuAS@JTSC5DMpM0m(*r2=){Y1NPl=n@hS4CY7#bWu9-? zM{lZ>sBQe$IvMkS>L<27stoJaVL&kRT8FmEv)zyg{*>1?>K8#OCPBvxU!gPL&-Sc0 zrUj}Owqr=2!4lQ)Akz*q5NK8`DAdq_L96ajc1Xqu2iJlJG)PfMVx(=s)>+5~r&PoY zBV@R7{ERWS&4@;>(XJcKb9Nlwi1}kWN+EqgZC>|IUt)!r)e^Kazy+SH&chj~K zov}dSOSP1>uxhVzg0i-X4ki+ovT&%Ft}-3=M}&1Vahgy?HaUb5*>h;8vWDTlMDrUA zT{WE*2n>=J79p{3%oI}K+Ss|Lcwwh$*m?um>!QuV@5j^8{X9qPUlCzcTR_^+svqcr zlrwlz6W6f`>bJ|C(lofY$&pyJjgsY=qGt!+z!0VI*!IQC{nzdSFOPf!|c9|ux(^_`)685Zc zLVP|+Fe4asw$=-aeE_-Clf&f!daR$%%u#u1S%*oYeYZfiQ)H`yuP>Mp)<4Ezv$8d209889{o4bmRgX%x0<#_7aacIbMK@2YykZVrL$ zcAVTx;6KzMPdroH!q5v=?;m_wEA^+xwrZQ0d)LZt6Vl9PWRJJn?W$%Z{&<%ZbUtRW zc(COHrdvG|K}7pHKak~A50a0^3fc@I1HzLs>c;JhsYyMF>iff(~vLEL1nA9poaj+^r(9)ZO(;AiMXxJ<=#8NVU44346Ya zywPA$)5QoaesG%wGzu1s_6eyc*D6DFY3Pg=Z=8-py7eMsA|jjjG3*n2K+95QPJzV< zuKbzfuHT6E$iTFL@6b8o|M@ETv3L2xzG&6Nkgbn#UzoTBOmL4V&MxZu5p-h!bJ z-cFGIVDOd0jXCqGKqW5w9-ip6&Rm7wg+{;#_t&!{_OR4tI9!gU;ns})z4v=+3_`Y1 zUD?3mB6%V%N{5(hIFhQw$)0+Ce*PF>r;^tEHjj~VZ9L53xGJuPjdvjt8adG1-)YDV z%dXTBZjL;z1~kh@Pj%+oi~oVW-Rl2dw6G8_=(+@)O9C6F%!IqTf)$9JJT2n*nEV*c z%`P0qVxvjTRhrRv3jSK@mc$e!;~4a&EcQu0B+F@WCYA*72qi&ka*IW)1Q@!oCe&eyiW6*6zLgtM_ zjV9V4gLnM~w)W#!`?Bu=kVh^YV3D6F5;}M7c*QH5tN9(EnnEcxX&V|rUVfeuYBLDC zt-$GElsE$sdg5gaCWrpkI@5H`*xD{IM{f%-{5Ia_LhS`jp`+HzeE|O~`1k z|Be*I$Z%ygN8p@)T?W{h!RQJJkHuE9%AxO>}Oe;YMy;)cl z#<$)cn;k@BdgJryDxmnW>wCo%&XXut`sgW~ahAl3mcDCgg-Mp!_$@N(F{Tu%K^k3= zgv!IB@=DMrvUZ0i1ydB~uUHlUqX0Y07sM_dgzH6F*z0?_X9;ZJq{9v&3j!r#tNyJC zODd9fWYN%Haj{~4m1g#GE4O3bAU#&zW*3J1F{TeD7*T~}Njuw6(LSo`3|jtb!FD6& zQmQI#RL!TYjZcjz%2MN-@=JUB2eb@PNucMr&hNW0N+aQ~b}jlqzd+d|nK2yi6%!8Z#ROLm>vkrB2y!uM z4(#f`&h?iJ48^v~uPPvXBcj6L>#I}RU7NVnfJ8}B6icKJlkZRtky?C`h!`^P>0yTl zkaOu0;_!7wY{9UXS26k#ggM2EAyHA@1TKI zRU)nG^W|0J9Ah$o9EbQbGF-#JjwrA8zzk8&x9JAQ*j9=NjQ(d}u?13XxFJ{(Em1v=naZ6LQcQ09Sk$!p!G~lDnqB=3Hda@x)g&E{!OLb=9QIQ=X=?|P z=T_>)Hvn7mp7DS*tkEs%@9r_*lp|M*;zGxG=qYj4cC2@+?}W}H3s^PIm_$Gwm; zuZTY%{=nO5fxtQCJ3dys4z9cRk6M3r za+^kZv)c&~{`Tzq!|fVsT}MByQ4{#lU_u$mLuP<@X!hdMVuj?fV0k?zY&Z}w$c+|y z8Of8&uXxBjRI_t?v$K|R{g@YkJF0B$agI%lyF=^CfJjtU)k{n!NgItpN-NlRtq`;G z^9^c=RoK@JbU9z92yrL=n0R0p~wic4PueRzgf<_rcY=V{?sSoCWMLscD*rh82t>!0#^G~lC7 za&2^Bxm>vIn~o~oB+7;K1CRaF59>-NCg7<^z9oom?rsD%|JwBCdJ}K$r%qn0lYc{3 zEdj=Aak5U^)b2CF;g{Ie$>(l6^?A4pJwZrKiM7!@qxm>kaA`UUh@}L;xO}rvhqR66%e^kqMt)_Im&Csa@DF z`62~-?N{5B`trt!{Bi{O{|Oq~f6Ugt1T8)r_+=_Ue@~criQ)3MoW_(Ht7$@SVM8Er zi5sNtnFQG)(aWH~kgx?*0B< zi*zbY%)D4Bneup?!F$#Bqp^CIkBvxE7GEQaiiTO1(8Shi5>TfKDpyuNAEo^PQMnPX z8cuJy8{37m+cT`4yKc!(Z8A?V)=@4%vZ z;z0YUxpG+t{i-0c)LlyryvhtGbw$tTNnp99*u4l*+CY zB7?K+f+nEoTTe!DG!Y=h?3{=5PoO4^l}mNaH>ROkLly_p;e;IS=)(8vSx~R@vw@Ec zbHQ1l=swpq_MrIl@IWuIBN?(&6AszV6u%B7M1Ad=r<$dGFg~I!2_wlFI94i>?GvNP z0uXpkH}CY+J8Q|4uIfav3B`%CJp6&>0$F<|FwnVRG_^ZK-W9-L*MsXeO&BLAvF0vc z=FAnut117ol~(L0H!iEden%y|cdkz-x(TlY7&#Lb@V)v^A!>eB5T zinvjSxAI)Kz^?_M&|v`_dQD!(KPnVv+#lTzaH#Wx?N;`sOW!ZJnps8&JM^-;Epf)j zrveg&A-mq4|HxP2OR4%OR{VN!F(qh^ zVwDRAQ&=vCLZG~la`T(6)-c)b6n~s9!HyG(YBMNm9RDS#hLH(}N~KSY zP3$X=4hfm~b%r$v8TC(KL4*s1wKE@EFp4Od!!D)X^c6hnA4eQlLdXg_AyF*J!;d&~*gjVyEluJq957gWca-2kVcEY3J7aZxE^}`0%;!(iHmG%C_ z)R!st-VI}gz`wYMkwsd=EzrCINgwFalAKeu;IrF#h3BaJr-$fI%A*{ZI7RNXdf+nI zIxAtT?nn8BW&T1Hu`+x5^i_TV6xfpZ?h~`DQF70Fm4D>){KF?JTP-)pZ=dVAMyBY^ z&v^TB87<6`{6*^NGDlq+>W63UQ^mY41=sP45QE_|cr44w$`vEI6%LU=p3)$#Hxbep zOGhF1AWxm}l)ys(3pSXvKzQUIWUmS)^?{Z=`ZYWnGpYXZTAAetZJgL-v*V+0hnSjBk!;hs!!iXyZaJ}<&CfGBMwbN+|8fz~4L1re(@NBfgjevV?Tw zrm0l`6MV%L%0eCb*lEyXx`f8wDmxp{OMALLe_#Y&D*&>#vMOTH+n%vxa6wBEZIB1! zd(AC{?l_jyZJ=qG!lPv-0AySJ7*SdaGkrsNPl^NBp&{tw+{W+}2XPb8S&dpXkhbdM zEU8SDH21m9JL_5SyY&NO@s475embg!;It!)e@h*!=)G4!9lp8RdX)_F)ZZ=vgK2V1 zwP%*d#r02l;P)M*?`78?HRqwoUYA9_F$$uZyPW!5(PCC|Q6smYZr|8`q_Jm(X0KJ* z9EJEd$KD?Cu4JRml^AW_;@hEf7Dy4mxRTZd{q&R7O~HY?Q>4o!@(Xe9p8x8%#|jy~ z5O*G#s%8V>TQ(x}#ki?@dxn&}fbbFioa~)`L#*cp;p5>L&^tveOkGc;sGwZ17Vx#8 zuprSxWdVlnsIxYE;c>(Jy5x{cyl|?ZhF%n*UW0LlEk;S(j8Q7i#mwH&&!C`CPVQBR zdau*pjoPh2_{52v&J7B8Qn~bHUd}q%Fu`Cq;`}-$MY?EI!iDsoWFMU*ZlY3RK1TEd z$zrQ^xF$nbF`(eRH< z3ZfJwM#ld}lcYY{CoSwuQ5pRM88>;8W12FGI3(~!~5cb;9i&E@;h z@@x*A@o=ze(Vx-v47#8nX-=b8%9)soZ@o3$jmoK72(n$MUL;rx+}@{>vPe9^PH;KK zSr~iESIwRR%%CNY3^8cv56(#FA_CXM7~b*%ZQy2nbb?Ts1fgjlD(QtoPc}lK zu;|RhGdMAS=65AI*$K9xuhxU@|Vav5&G z1y)Ar5x})U6XK#%?27}5jHa=~5{fhC??^woljNXmzJtI z#{PCYa*=;~k0{U5@L&>>@Ffus=9J+vN7ZL^;xDqTi?>`|5C0oUG_hQO@aS0Yy#+E(QF?Zb=m%DNHkah!~c`i+7ZzVBT;C}nM{-D zde(RxaH&*mNVqsCU6L+@}puX)hIOVbz;L3-h`&QMIAuoi-Km;R!SG z)sgRC^gHyk1l0cB7iodopK8+NtmLnoNS$imGm@K8D!0_s`gE^>1c{CLWQIVvY3e8CRZDL&*^Jjy>1Xk}i&|3d7K| zVC&>UiQDl=Jw{?#MwGAcKM7{**zw|{qxTcvLEi~qmsL%W!3cVgcDUTHB6fR=tna%U zy9`}b&#m_T8pr%FR!6gY@io7{qsS)rOl4$qROEAg8@Y1+p%QNIQVW~B66ni*3j6mH zRsFfl;CeDKu9q(&JEnEw-UM_v=3zo_GumR;3Ldmy0ActOc5W6PBj-p%s(enyM$%`) zH6qnMo~__F;c$TYM;g3v3^rKopG9WWKjbdCukc+3U!@n6Ht7v0Is7@h4P=-x4CC(~+as--n zZC>YaBc5K}svSq%1eU{m+Vo|My4u+l=Zf+OpYJC}63{Q12GbT`gvawnuCI2S1H~cY zq-if_@|9U~k~Y3o(BX)lR?^Y5@xNSoW7jA-N2qIZIWQ!e>cE+`!ayk-QNbP(yPEx6 zx5``yKR8uQ)#M(&p&w;D8m|-hTeJcqG~;JwtTm=Fib=cAzJ-zcRgmc4CuHpcPL~dW zoj#ZJ>;XJcEWD;To!BVbx_$FpjOnAfh}&~IM$QTPH#jNS?n**;O0#wwp01V2q{)vG z0>=ootZqYn+M`eia8s-P}F!;s*KaIc_ytb2Dy~?_%HZ0!&-)W5O;N7 zWHOd|(wC|2eq1EFF9?4;=X(vE-FTemU#Ar8JQf+2xu5Uag<6coHpbDnHCubxVQ3mZ z6p~+lo2_q~_HUnB`S!<}RyBTn8&>J(ZTQ!qiqljsFhQkYCpLc-_P2FY7{P}T_zsNh z2d2>@Ltr2dB@y1eUc!x=+K$ak7lY;j~4RgAJfwQtC6)M&!|% zkj;lED5K|S>!)7kS=P036}Ho(X1W>wh4c*4x6WBjcsPj2FfF4OlKYG%ihd^5nPr%` zCrr4Qpc#xK_CLL2?^(P1v1A8ybw{U%0~+Z+$z}bwnTA=5#5O__9+EobhK2baP&{a9 z@3^wM&?&XPg-8xwe{u(oxjMYgy}9xPRzh9m@`3GZ(3mQ%wQTNz8m~VI=fH^ zp7f%Ct&btaDwfFC54T~3i1$ar=v31st6lDneGvLcf5Op_DBY!?ErKz>A(OLqyzS+9 z6Qk~L_OY>pzaRJRi&3_+QflUr)949jk_=}kM}nVs{%pEZ_MkHrL@oxx6?)p0X(zGv zJ}7hx@my!RW0BmFM#p30q|)UTrCgrwe{Bo+d+dWEy(%VZ0whNGy6yb&X-E zv)^{n9dyDUt);dRbB^S~ew{4P-!{5UEuX{wNgx>AJl7r<$`udiR<$p~b&q*dp! zarbnhLxR@e*x%tHCxTZQv&-<S;Q4vGzTJr6Y*Z9d5DXXkrF5RcMPyl>$h(LNC>?utEg zwVdX@?q8ba7`-MF>NlKO31i1CrtVQgN8*M_oBfTp=)f!n(i2mip z`zC&$E@kFuZ4rJn`((qGzYR8;lSt4;%fw|rDyw-keko7qA*z)w;j<3RP#&YpQFjS* zA-XXWEUDawAJ#yxtKY&%2Yg3%eNuh5xl@!sdk4igtWB4~nG)$HdWfp>XdjS*tfQZx z{mVsYab)V8v}EAINSz3>a-(%i+@33KC9 z?-buJjv>$g!sryTAwwBFsz6}R6}LZNG*4|yN&qZ12MoZ@b39i-4YbsiMffe@sK@aj z6~o=;%18>6SV(h*>tv4Vzq{**pCU8w@UbO3=u~(k?AWtL!EU0?3N&pV^-a~5FZXx`Tpsb?AX{cNYN^AkC*ZVMQr3E3 zUF&t9i^`D0i!r*8mXR7aGn5V$H{|#Vo{6U3sUDcJmzDPIY~$`ljjPxKBpT%N&lp1x zIqkH%+0QO&_M2nB?@G6+ z@AI>Ir+Zv2r{%saS##bgmTtzr70&d%$6p?)NPZJnG_9HRG4KaR=(y6~mz!6)+ZFeD zU)joB8@tvn8uJt)s9>E{qb-%4qOb4MQ-k9(lXg9CZ$z(Xqr3K`QkCf%oUFzKAixr`^yGGQrgp8+IN`|zB8OoiQa%$MTg^PlhjV6C7a&cPImnA|37R-0 zomRkKuWRkxIAVT2he0)O{>&lIth+JP@4@J%vk8%;J(W;Jpe{g1(*-9x0t8pC{u_DHTd*`=d4EmT0cA@G2q+-L=pnR)Qx9{*e5ENby zu(n5*L*yJ{L1~M=m!pT^4}JdpPA#}DpdjIr(&Xn$_YwI|y=SbU>orqv-r*@Pe~;s< z-%~C$dme(LDkmYFD)-`dt@w2`(dI7;Uf8>}u;DbsZLhsbQYu+-f9kcvn%&d^?Dg-% zN&O*j|1Yi#eg)dxz%s4y(QhcI$DjZ24vzon<7i=HWM=ZeG;)OH0IeHS|7+y96j9Ux ze!;X56;+ZJ6(t2%G?`jhn?OO)#C|X|RFPt!88AXOG#nVEr$uyhRr&NOLdCFayc;P< zM2IFWSyy)j7j5OMABI=kw{G}c=Dz_WUn)@OS7f9a72qa){kY$@WEThd`@eZUpuxmU z3svLkXC0ew&Eom&lOBvSX-o%fuR>_GqTjU8tZTQWNI<&(E~*fx0ebQ%Ozmf8qA%D` zH96-2e%T*nd{j!I2QKhKAQ0?SifeyT8tDp}XA@&ru!-U++jx|SQQa{z>W3q;KYu8* zu(Gh57(xZV6+7D!vUg(*&k+7Z1|?!01@k=cK?M#DA_)H`ULP(5mKO=>R`u0;%Mc_a z=xZdTn@x%&>_p*6BV$%mL(<+CQ27YbsN};dK47Y!>TM|m^*_BWcQasnVck3fu2PE?Ckn=@~GpXN6*D*?b}F3 zis!?Y`({hs#aR1+yD!^Yhb4@OOxjn72r*Fq>t{AdNG|P5bh7xcx!G7iJV{^AeF z&Cbbcp5!r&oBO5G&CTFi|FPPyTcZo#>-8``?`yRmWFDt~UQgsA2sDUS^dFzZC%^d+ zZcwf@=fQA>N3B3;<1X+0O+$8}*`dM4nE;;P^)qzRCq5*ULV1PJ#BO#3oJi4{Oa>6A zt?}U&r>%89$V;611JE<$^_=5bsjjMQwZkM59E&rREJQAjQjuvej%xbnb7*J^^_{6W zI(0hf3W1u-o13&8;v0%5z6X4{4%(-0hfX?#)O02A-S+OABX~R>>z~rO-BlDaxpTZT zRsI$!X8q)2?0{AK5`;i08iEu@_CaFsa@mZkA(O*OLps|h@9A0eW5&o<{*e^j8Qkyl z&Rvgqw#xto25x9oG<5xN^{b;89@{I<{lC!TW7fZF2me-eG5wl~V>455C--z=>|LDs zWq(T{1pV))Q`k>Jewlj=LcFmdn`FFIsaI<@PW-D1Ddpy34+EEjHVWg@EAkNI!8mcp zjUh@fYmj#L6B&gD;Y_opCr zX5${ihYTDjnDhZS)JW-Ch*(Svw5o;m2~lbxFj9U`e00gc`q57{M}LJOE<^kc`kFyT z(>Mn=8Fh?r8g0-qG1m|87nBU3w|^APM5F~L`qxRtzK-Lx(e{38X!Z2?R-S?Jc|g@x zeRMeeqx`PRr=$Gg#_nn>%h$ZO{tzKX8HU3N6fRIM=4AEaK4Bg_}DB{Mj z>>I4o{jIHwA^NCz^atS2&)lpaj5-=ST;`;~FL8cW88wPMWmGHiFy>RI{$G87FG}HauN_gkVzpat z-FQyEiB=&;YF4Q`S#2a*qE(Z7d3E*fo%)W%Q%^Be1}3h3+WjX7^bc+`-c5d^O?d)b z+0F#TJn6GVcna0NAc2Qlr>ozenJJWW#abJNL!R8r?O9-U^xYzW4bkUGM8=KM*--_< zlq-$wdTA+@DAmmiv*dLmzdcuxwmzP<%qyde@#GE`MfhH9 zL8HG#V9;h7>3p!H7eykte>=7i2;-I9O`YZSI^(S?Wc}GQ0XctB>L=`CnG|>c@u-s$ z)uQ!&Vt$y!(Z{h?z7pz`SCg(<&i3yO#~N;sXvTTU3;At4e)}<*$L(d!?eQ=(tMLGu z`{j!N;9RvQ`XLH*Ro8v%>E4Xu@#g4XqUXP9o;2_;XxYkaNGRj?HLeHx+p{%!FvQ#| zzoLHW)Ad0haxzxs>=twa zIr}@4qX8aQU_ik7&k7yK zlTG=(6UcSD$6l&#i=%j@ZYM*rrSIw&SRUW|_Qrh`vxPw;Xp71GSp5zU=|PnO!lh7x zxTg$UD-8^gSU>=DPm3AL;2i`Jo`0e4!Ufzsx;c_U=?&nMG9wNJRbxx@lq=IYZnMVcT&ZG=|pQA)>AH2%myeA1|c z0A@7RA`ZFxxb_Ws`&V7jNDBXawLp7^k(+X7EP3eqP@-&YS$f#7YUAO}1_`>L#yr2N z{{zO*adBxtC-IqxtRYTfHhPrXXR@swXv`LUedKZlb_VKsTZ^r`E~H~G&Mz!5>7)5$e| zOaon&2VMnwRJ+z4_A+EgBp)Wz>z5~EYbY?w-9>?Z$W12mKPzfo_OwBij!ai`=cQf6 zC{}H%^m@3v(C)iAY+7l0(pzYdgPl4i34>Mbd$oasSIpN<%+vpOnA?HIFJHO^fsHBwC|jQDTRn(h^es&Sds`PMm51U-r|l@))Ri ziOJP!Y;X3OY8}=jh;$n4REv4_i|vhQZ|-kW$uL65!>?e7i|gUxRYU!qeoYoQ-ru^P zB-Z-D9TMAu3UqdhNiqBVr=wZMG>P_#)NK4t#rS z*ge?Pld@RPK_rPwWBlcL!B;BdE^ab#dzcqZVKS6(P8<`|g%g3IPy|B#NRayZ$e+CGUqR%jnz zLJB`*1bZ}X*o5T7RCK8aRp3&{@@FY!pW3wJCb9DoOzniNR0)gS5?{*E&4J_LiZFpi zWpwGra8lB<=PzX1-HuKzVk(|o=Vp1Z4mfB4dA{?wzsw^&UC@LP_pzj{8Y!JFMG$eK z?UXhIKt9#MDF;!x%k!dgT&Vj>(Dc;YsD?g^XPuDdpB?Ad2V%i?@3YpbQVCa$KEM0R zHB{>J+Ji#)t_r1`fT=PA1F+-Fm;IHT77+lpvv_y`JXJ!TWYnLfPAr1ci;E=xp$~QK z*I7?nX7Z!uytvBZ{V0>_eN_Mh2glnS>dggiEvHMx!6@mPPnW8L zaMU$mni%*42Zo1pzQK<9&HLWN;8n+nCpMR%G?;B(dr(;X>$Q9u`>S>AQ&R+Z_?T;C ze5s6afp{1M4385f9?s|RyNhj_-=c`1A ze#rNT`V9pPf>T|UuwqCAym0#<=XX4w=ev_ycsBIvr4&9sKIcU698EC(Y-VHdUnYGY z_PDCX+EU2P6l~IIRr0H0TaFEN6|2b*h0R=jZ1@lxMxP%Ig&~Fia1!%yaV)vXbye38Fz<-np@ha) z0RkeCRe(Deo{lR>|4VJVae$>Fz2xv6@+Wni_D@-9yTXr%OzyBEE$W>cXYZBYm~f-< z_?`Zl5aqO+Tc;%V5QvDT*GS0nxemjC*Z-)-gZnR(D|?l#tV$HC*XCjYH>%TQ`)=>D zxqMub#G4|6*A+V`T~(@k2nNEaN7vzThVEwX@i~D>Pg|mtFRf;+_XtAfK=_nd(?Sc_ zO)a#$*Rfm9Dg^`tFnl!BRj1Od)IAoRsZ=ReBGXJ;@u668fJRk&mUFcBZ4iha>-&ps z#0SftP(XWNx~}3k6S8ygt=94XAo=bYgv)wmr@gs`W0N0+(1GELlmOdI>Tev20>fi( zx|ulDyJOaCrFewsJauNCut7iz80?jff0PyU-w>lb#kk8wy3Ha}=^@NXfaQ6JV{Jat zSiM%~Sb&eUH`;TFDORwbxheS;O;QuSbs4E}DX(U0FDjDDpaZa`CV+R!|DS>S!L$eX zDdKZ%JsgGB+stbK`1t;BV6uR>$M%n=D$+U?w`D*{I`}uB)dX)bU57PE_hqZ6VqfN^)gxIeg zQb}B^as0cxg|??^@<7Y$e*N&Se47v?JY%q9WI$}vzYg|&5(IL~b{9pY{!oJl_tIPl zn&G{(yh*1^Xz=awiKBP5mE9IMk?NL$R?HGe48x!r$QBMs%QU2a6w2FJ z-4?&AE4=;QP}UnsFrzsp9Tg8l_}Y&!%|^Qk0>TJ)eaAGXi2A94dekxu0=kww$ByVf zFD?WPpw>EOR1Ah!|m?8yEz#fEUts#q=c+g#*JeU8J@`P?UwAWRow z0c3}hGHIL@!#4Jk=%oHQFs9>~jLWXuuTiZbicRlMHYaO7^y55V#eZU?F+$BSxuG`| z$X#Cc51s553$re8qn6WU!$2D{|6ae!Bbitsn|Jl%)>s6?-;lePsoSHMH< zBf5bqRsi-dt3-iY^=F`{4>MqiWRXjvv=z(oKNTnQV65$?ZqH^63Wi;m-7!<&W|)kn zzoSw}r2vf3wFqw?EWirIGhKS0%jE~47E&whTa0Z!@>jvl@gz)ImE=4qPs%4C$xDpt z2H?6=IVOvh$>(ut5pkFpJ|u*i0&$+vOGb$U{ZJpe+0^T7S`*03#-D{Z2U1i4vZXv+ z$bS+|wv!spiwOJs`=>g5Vba%3q}PPdsuoRVU;SQK!$)vS7Xob8xR4cnuJ7i}VfQnO zl4IEU4c@Jz=R+v}zPA^|k1;Zp%Wf&5P(F3`+dQH~7@25jcve={c&0faH-c8Mkiy2@ zr)t}_^)lT$j|L<{mTtPs;ulZYj#hx*UPLO*^@O%Mn}E}11SOP2AxtSQ$ix`THCo~P zGQEw2k?Q^m6H|pwoJJ{=aA-eX`7u<)d>F#?(Z+0F{E4O3m+E$r80`_fqxk!?vf(zz zPjhoXIWPZPQI@v8CY=;?rxdAvyBn+Rty>8|y^JBt3i45e{EofYtt!(0dJc4!RKE&D z*b3bil~i_HYj%vL`DhI4C=Ij$CVfL&)MVrszeog91C!A6J(K-~76^&>BZKQi%rILe z9VVdz-}isJ4MUb^^KO=z+zuk0cbf!(4$aGa5yELo4EOpQuaN5u{*)5;5 zlN4RcCbQ(oJ)CLMsujnm-Z*?fKcs?IEs_Vfxiv{=b$YMg-`zCg0;e^R55$Q{F)Y%$ zRtEJJ4j|%x_{dR0^2Dm)%8-T}7w?#wqw=!f?=>wC2|nEBiOPQCh-G-kdUe*cOyRn} z@a^Llh;%m`Or>5I)e98DnCxs)_v_t~N6j2gTTt_8@d5FL%~Ji~B(L2I7AedbRQkUJ?NwtE{e%bKj%?@kUT#tlOn!seCzE&4F)j2xm zb1;kV-pN0ySBIcgTVGy1PyAf9gkvyJAe)4Q*GwDF@*Q66}xUc%JY@5bayQrXI1B?6%NVx)I``=XBZl9(V> z;R1%;P(0PXT|`GJW>4%1`xHOQ$W$whDhP0CZG1F&uBWQ24Qt<`aXcjP(%j3$=;%V}e+YO&;OsP+$dlj^32 z*BUE!Kig5aSnljFSp^SNm59Wr6#tCfP#&cg0aGrL?Xoxbn9h;USoV1srL*KIc+oC@ zLvJ^Lh(*WUkVVZU0CJqCJJZAQdbP|?yar36-$q0#QG)QvP$GSyNLcwv791)BB%>r7 z5q!a9UPeQeW&@z9aq|~M4ak@x-Y?-mBbWaZfCo6)&YCP#i-rt*?@UTjcGI6QTR!n_ z6^YRj)xv>N^)fyVm!g~Psg^pma;=H&yXNNzm#qGl>Se*}KXt3^{cV(ikSi+@L1?l4 z#V{GO)$6L(22a)DiE-N}_?bkc9{#R%yj(Z?xHFJs;ImDmX$vg+ki=iDL`6DBB)Gn- z(Pq9-U95>d-R1_5 zvbScPt;(i652OLTbGC{`j`gd0ReX8$5_OBi>gTM-B?x9yNNM-?_YlGth!uB7{Ura} zqxByjef#m+`B&@5GW`#e4H<+yPD3C`EE=BiXO0_yOcJs~aBq|}KsWUhmCMyj=Xql# zl`kJfVv;LeMZC?D%53BNv=MxCG4-Q6AY@om*qjeVtFPTS&S898vFvqTDQ%B6^23%Ks< z4zw<6@;dL*fZ$iX&H@yy*8u!B5+=F3~Pt8eoyYpSlFkk-u z(no!F0ZG(tae7H*RZcaY$seykCw31K*cz&l*H2&`zhM|Y+o|5qXAeG?Jto1Ca}(p^ ziW0PnWfanJxYMxnl+UuLs!fKmZEgYIO{~X8n*O=AqE@A^w=-2yCaK!mcy!S9Fq9vL z@zEwe@~NGY@_(K`K`uE$=+x}(dN3in`J`-@&m8OY4K0Z z9uZhd5M_zCXCf4Ql;SzvPd3={{z}~t79RWPcRJHf+FX)9G4Zp(ev*-?ZaLpRH%#ZJ z9#;ZK0-2u56%ddzyouVItkYDiBDmU_E))Hx)~nGHmFnNh*VR-`bi-f3q5l&-_y(4x}q&K>wwdLKFNZ-8r*n!65WTSS@k+l%kc^|vo5Je;F>KZTaX zQ+F~L0BN)QohnFAt%mIr?&o5){q;=i+{$kxDq}R?~}n2 z?YtB_pmWBDS)&&^YhVJz#ik+7w}Zg7NyYP zVk(a**TH>4-0Rs!8JYCIdqTSLD}zDeu>4Z|=KZC;=0`T;u47PVvO%YgWRVtm&FK%4 zfG#`%{@i|aw=Pld!Gb+1+yWTfdpIOJNn zBWgm-y=%VrLBstiZ#{6HxtWkp_kue@>mPK|NiHAymJb(Pep=19{jq2NA4af`<_5y7 z3$ri`Nw^VEhBS3z5MNvnm#xRSnnf%m{pa1g386!%JVg79>D{6G6k~*1Fa8*zSe);i z!BiS_F~w6WLR>$0(F0-4!Lr@0xecVb8>73rx>Rp=8r~4ICsk=xx@!Wa@ukAlb#D$! zC4ve#g=276SKD+Z*Dlh*A;1VSiZ8L`(>OntvRh6`tw_t(P(N#j*Kc)})~PJ98cgTL1U*ECq37>dyWDF*Yq0)b8InJR;V>_qh!?nqRsF;$ zzG18k44aNqW0a1gO7!!CvN77h@yxWE0u?3QTnG!T?y5|>?KGNIx(H6uJxpkmC{J7{Ci+>FRXI3SfKYVF z4U?6f5{70%e!VS|T7514NSHK~Lp|Kc{8xsS=pj`xtsi%IO$Oe2o?FAm28E%AloND7 zul2%X1>9~834Yw8oBfNauScSBsWj8Lw}8txb$$MqI+0Fe3Q1H0cNj>v1=~pmG9VC@ zXGe|y^$R@%F>lEK`HOXs10dvcQ>vsnz_okTZcl2!4AHYpXO>mjm`LIGba4m54q%Bz z>!WF!tY%}k$EE@|7rEk}^F?pYTcf%_4ZviLDz)DHDdd|*xfYp0lSSTNd&}ukNaN|*2e1fnGD_&mC+L0`F@c5=ur7ph zhzPjiP!FduZ-rf9GNTVVE;7IBW$<5oDNdm=dL4SDh-=rx(Lkk>qND@%G>!UM0GZ?1&gEtJ1d`%NKvocI*)cO)Dl z@Not-MQ1I;6FmU=*0`f}+RyvmKZ*^4E#B&mUDsVBCWDqz zc!{T6r`J`wqa3_#Xcj1!DNUE(AzUmRQ{;QG2Xch6Ml0G@=Zi0mPCyX*30Zk$U-ZTS zT)zI$$762~;HiAQ)mPLjFZh3HzT;)Ho&By-Bu#$k5{iMewCz-C=776e@qU-Rw>XSN z!}SXsD7PMHOg0(M|AO+Eb$iB#*`tF&EOqGR{H@qsKUe|g<#DB(2;3d}fKs68A+FMN zhiE^FN{$Gu#Z+}H%S^1)UyTam?Kn#9VoermHbERFU7CvNk8#8f-$-EFl`8bwG$716 zRK5>)O$Ema1cDwj9zszJZuUmoReTvn>p>1Dfv5s8DwfCab;JJ?-2Jy;qKJ834^Q!% zg0d3rRssXg_q>h@D;XTK$?UpV&B0qLudr4%6&62$Y~%dEBz$5x>u~hO*LNF>A-kPK)@mag#a;M7hYuY!5 zU)aF8-i;z~EBWxqSa{C|AQDWoN(PUt{7A_~a3O9|Zv8sY;&$}jrsp{pQab#bzTqNu z(}+m?w*d45ar+Q{g$Laz<>dZS)Nm@lSph23uvzoNc5ZGYA~qex^fdqG*Jy#sFYJ1D zznU(3+g^=Lfb@dwp9|vU!r!-lUabah;HbC3=%=}zU*%h>kN!wjE*U#nC$7Zso8X^4 zA=)ArnOjxXEp)ahIb00|Id7Kp1hJX6JOhT!f?u-g_@Dp{Bs%wixlKGDu*@!dJea`x^>C>Up4gHgv4^>k6KQUtT@ zzqGwy6GnI4CjQ5}vWq?(m2z`sJZ^hZm)59J`QA7>5QM|5e z4WnfBUboE-DhhZ@F^a?oB<$upuFbKvTNlf|NvR;KmT zNRS(P8}>>CjwUI*CgG&W;S;%K$|sO^^_9rq0?#O#Lt`s? z+YW|6@jdSQeF2qF?dFQgyhl(pNk`G)kSAf}SjaO4#r2;~N`NL*IrEOqYzVknW@LQ! z?^F{;EBUyxP}?5>Gaw@=u3lyqc+ds)1@EmxIc{x*N9D!deJ1vqK@fUm@%qh$?Zb3r6Nm%@m&TTy`MTJ$MK;#XHn$hXUBQM%I~ zpMTt0_(fxDodolRGUo1Vmu#7Y$3yI;IO^5wfW*&9Od(f&Qh8KJ;qW)r0VC-gsz3rF z>rDSkOG^45@(=!+vwhg#?v9dC2T`7VAD->#4$>Y4B3H)&bklA}`N^UyK;(=or6VlM z@mQ6lbpP+XgWL0G`AdE?1QFQ%QN(8R_XK%WdK?8V$$rz`bzw0+JJAJfe^ue2OTJ`I%? ze<}68BM#h>%+IDTh)DU=D`JTo-U742&I%+I_bxfSJ-lfd@$^y3uS=s8)e2a$cln?| zx72c}8&8aRVzd~+)oXpHE}**@MhQ$ppb#j<5NTa(Hu^B&Ax57xRc=}hsccY?z$`+?PcE^=(kg1&mvNalf!>GgrC8$ z^!Sw08EQ%J&sJ$S40#}`kUx^aPkvC92B07tf~r0dEdOwe(W7xYCkLIJ+|LiU4Mix= zZ&KLlaS>_$DO&v%<@!Wj+*;7mTD_I08)qMz<-3nQtR?|^(YY7fcU$3Db2k|2BE&RX zXs+Tod4-#cd340@#L--$9_bvnEL5GALBs7(#b+P$yv>}iq4jisVz(W(k6-4Qma3J! zo}b!VMj@#&RY<#fxoK4wW{b+A_S^;0stP1bvh8EAU{Lc%T=CChyJbhd=ZF>nS=JG# zKgF&q*o7F)piKR-nBl&tozudP^UhxB(dW{@ucWFMDG+VXG%@op=Ng&>XMx*k%7gRB zL-VWhvxHxfVm=pUatLog07|!n<#ajib2y~Kl#?HGl0kE@1Pg*1uhefAFWhMFoMMJTI_zd@}vUhubG=F^n=zt@>H4@7vH}hZ}?qzy6v_VfcPoT#R z$HiVYls_16+#f~6R1&&|32Grh5=6bl`K|P*Hb;TVhRpH1jPZ5g9+E)W9|E1S&bt^X z9zeYzO0Oj3@x5OQUwNg@h2XM+G$ zFJI##YL*m%TX+R%H`-FyfcIp~((e|w;&M>SC8IT}V?12zyBh+hNd%2dz>c}zn9kt| z(I_Cu92k=Vsvw2W?Il^8^;|uzF@HNq?-}57Z~?vybQ4rNwx%x8IQ=rrV?;Za!}48F zl&KmLl1C?fua)?9>x5Y#>6~cJN}cx2kLP(9FkHKOZLWjswDAB{%NKl1`&nx|h+gwv zKPA1zQTpS?nHg+LZUjG#v#5I_)MU9~A%PJF<_)@#&uVFwmk6`Y4Y7!&0<^v?6j?4H zT+hlBzj^FE`)*_i64*1ZK{?Yg()iCT@ADLfWI=-$D%M|+przuK@4DY4D1sZ0lqP)*-C#8hvW>Ntf_6)_?>x@- zHxi6aMi=Zt*pX3tfq)czdv`qaVnYD_1WSeIwluuqvJ|i-YF%dG5vnN7kVfVmZ?dnF zNJ(q`(V?UPuGWjZAJwJ$Kq0Mrxbs!z=X&d3D&U-3PR;IOS(E8HsQ;Te?-_=sgXXkc zkop!$VwUoSyEs6OCb14T9O2hGvjSUGg;_M=|VG~uCx7-lLI%^T=JDMgf@anb}G3!arihnz>%1*xcgX@pr}oXHV=F^Yjk zHqRn+{&!iC*L7!C>Ekg_AVcxqMu-;3BqE;Z9g+Zo4!B}1yhur)$$oo_O1qoGVCq?m z5yz#ctAK&$9*3*T#h*^qLWPNMS=v8Q8Yi3s@gIl^jhNI_0Fm8r@ePzJ?WyEnc7K3T!V4)dzY|6&dqq zXr7RG>(bY=^joF3fP1d|E}xP*d#oK6@ekMOb)gv6^WPY#y@$!)iWZM+GS!LGShU7d z*d*WA4P-AWIDj$`ePO6rDCC`)X!hFv@aKIUuP=!MZ;+^>9ej_X2{dD-(2=~a9k3f$Sv9tmmG>N2p--BZq>EzT)n*%aMB6pTUNSAO4|{@cy}6)g=Z9Z zX_e^fSWZ`JmAJ57X>U2-Xp^siUs-SQO~B2!+dcf^^}kuj zFei+0VfbidAGj|(9*X=gU`wR<=!?!BgP8d^W2t@S>MbB)*iK@0wrh(pXxoULRXK;x9z`zywdxtVC-Gzy*ZLYW+MF8TsT9!vg;IXhhzwXXn7s!vz{gDM^Z zVKgW-%^{GjdEX~;usLy-K&xt5r@Bue`%`umLPTr~N54Cyx>ib_t>8Z&mt0400~MC(0^ZtV#jwQB+}yqm zw@t$^XVCndR@^u%c$D=0s1drGFDk-0zn)E6{w|{Gsx3Ct=9~F_A8;dwe@2KM^E&tu ztAKhJ{0+96r4IqC7>TP6SuOePd$BSw7b!qMwYb174=hQ98At1)$ukAzTow6{udR=~ z4_l`#zw)i}LbQ29$iL1SO%v=4>l(tNFdq6;TuZCd zYE@^?vn_H993*-u%Czf<-0NNyalXa7MVls;40Xd`z$&vVfTd|3XCy= zUF}z!X>mH>=!o&BW0T1r9$)KFFc!4FU<65%@Oo*jY}aXuYgsFg|LzwN7Y%NTrtT!j zrWys>7cDsHav|p0dgfpMw!`ymvVz~0K!g!Gy~wU~D|^?jJx6}GP$qF`(Nu4VWK6wh zoS)@dlFA;ldwstvd|Mzr%aW&jOr0KgRg!)yHI7n7>Xmv@cT&Fd_GIdth57ynCnOg* zw;n6vBTN3vMH~sYvciGxAhgO1qPHKzPtjVer*u0!8YoMTd$=bg)TMJ{{FGtvIjr-8 zh1MtuYrXm$Z379I_ zclR6>y4ihB8WD$%0aWCckfHh?ri%;bfN@z)@5h>9gz!-aNftP-|B-_*r1U!&nc}(M zEB#uu?parVX<{5XFg$C07qLsS1wE-`h(3J1++&7($d$nFpBtQhWo_B>*r>dUzi?xWOJ z;GDv$-HP|NfG*rz37$4Y8T&Kcj|!WRusU!~PDi7}a|Hhk#YzJHZ6+;m364`fZ`jaZ zn%o-qYfoGeUiu6YevkF-O3~}U8OqGSaC%9Md@!%larOidMh|%6rLL(0AI4=vMhkUjip~x6pfT$I^a2GESIUlyq?opoe-kkdN={`9gn=yNNRWZJVR*gDc z&bS)cpH3>bK{0(z#i6%!>t?O2`S&FvjD{;G)4GMtOFv6=G_jeq^QodY-M!$529IOY zBL7PoNT3TfI4R;c8v;LugBu0}_aa$d67nnDY0mcVF$Uhp3AD#a#|!29c_ET{%0AcI z)H;|`qRBgk1!dH*@vYC*ZTo%Iq9k#zVr=_oU{GiVY_6J)7lMqoLBKqx37Gis&D>~^ zcrPL29Rz9@55(?QZnC!O!O@;)`;6}Dsho;0ky00@ILKZ*3>Ncfwv6hKU5Mgg(Z!1Q z?|gqH{QH6e3i>d?vVx8@6w)IKH=NnAswpOs{AXCA*LJZj7&Mz$#Qr&)$arzAIk!yn zJ}>l!%hB?+V4NN-oC1Y5INs5mBTA!{y>e1bDe4*4>VVr=j+Pr_&q%+{7m=Fmqth+> zLlxG>-X^6m;=HR=$u~$qRUgf7>y#N3;FFwedG3-S8o3NGivM?*gdAaocP;FKHb2^8 zs=3CL!lK0S3tPvx&w1g{QqR>c9}v}XYl4n7&VopLRhi9T$ejU~EoQ?l2H30-ME8{4=q9uB7VU2XBe!S9Y(n4n+LD0Me=4hBhg*v`k}(Cu688Io&)drRh~5h?;A1!S5USP zR{K7GtL#`hk9zQ5-l~z#9wpT0g)W&vyOeWR9Ds+>DZAP=i7G8K-dA#lD2>kBVyO?U zPKUoBv4hlG{1^%yN;91B4K5wQr#~hbQ{`f*t7^%_7rd`p4YR3V5kD!b>WtH{tc98R zDANnGQsT#FteRjZZ-5nI>invLXUFS7!=2szL$OY8!qrOvjf&v2CtIjXrOh--_(O^l z@U?xU6_Lk6?z# zSB{a-ik5R5X_{1VKaOB8q`xeKM)W|4keaD9h^J4gGGF4+k`ymac)BBe({y2IJNiHJ~F4W<{CX5Y%8VS&3@m{d~ak79ZMXA(tv7YsptuRS(U!m3@& zF5q25`iX7#ueY+|Sn<1`@^tLb0VmHwhI#~%Q7~+ymhGQkgTjmew7l;DxuSZV2d`Tk zHz!T`0z_Y;IU+F&V`6!{QzEmwI^Iyx->8SjUQgz8xlLYK#r=!AFBnrao;hUYF!kml zx@_ZvbOv36sXeklW%C<_hmWlrW6LXVc&>SDKtp*F^za?GI&h}2*Ex^s@;&RYW<=@$ zS!t-5v+)+CNV#Njx_(Z4pJXGyFNTfC3uZwY%w;I>T#1jKm zznYal(3cdnG0|`bBM@RnzEMRfvvdRfNPPO*X5}&>cIN+>!>ApLMQIf(I_$x34#bMS z^e!nowtc--t<0(#{1Y6*#nfw*h3=GxTJ@BW0f+NUy1V@$Qbr%vxg*U9E;fHzs+2_` z*0CQG2Rhqoa9ECAF~1&#?=;6ai2Z-aIt!?(w(ji<90{dE=`IQB?m9F`90Vn$yE_D= zOArC2k&tdt8tHDNq&uWLzjf~azVE&7_{KP6=ooshn|=0PYp!QL&u=oKhn6_XIQv*VEPTkgH64Ijw5I zNW=An0O{N@Q`iXpMB$QN=wI)4a6|`=Dji|p2YPvs9HRHM+tl1)cSD9iEFL#(HgLFO z-Fd!!F%drNH>*{uUtjnWQpHo~|Ktf_h*8)hUI(}Bad|E|=tpe7g(lzRIDB%s{8kLM z(gP;n?DzA&Ua~$1)E5u$>p{S8BoU->6ol_RaBM8g%J^=pdUm3d`Kdp(bIj(WiL4jh zDE!p#xR@n*m_BJeabK<$xI-0zkTt{C;fl!k1rjqc9tq}p_{NZl6nak6Sc?6n0-jJm zU=!ijBBVR;$(9%ssgn~4{Ne~J)QkgWnA%Bgh&P+YymG$qy%V7+B*lBzI*3<_FB^hM z(M=PBrVwEb8O>8W32D=f`#7#PhX&L1U{}q(1X#<0ZlbjAOf=QHUyFX z2(_CkmjJ!XCtngZ(vyo|6=AdA?L&8Mem#mXhlGv_79thWr3st*O*Ld+&6o-i_Pv-O zQItk(V~9#Y=*b`vL{f*y_2NJKmKxR_8J3blMyE4s@+x6hB~7RYxRu(_si=|6m!-o^ zM_1)>>da^w+kj~V-Q0;`Q-#p?&sA4&;#$ZfUl+%N?PGB_hL!_O| z<&I26pD{;UYRydMBzYcjg*QE%8CF{CK4vo%iAH&auYxiGW5S{-qv;OVtyIIC_}>3y zbs=A;C~?dxa~QLO6p`JB`dml)a%hn!tkC_L#xp7NUd`kRyti$O;YnIW1BM}aVeQL! zovOoygwM5qQ2uUTW+UOp5%tp;@R6bI-nUwnq5R_a=SswB&Z}Mx?;hz>|D}HIS<17Q z<46~v@5O^t=DoQZ#ldRtb!X;jiA!ri|h3 z)u|T`K^~bf^9{ELyR$_|*77`sheVgi1IwH!Y>zgbf&5xvKcfjL{01OFzMiVe;~FPa z{>~dI_RR@*w^v(Zi;5-1upx17t0qYBTc|wc>l&NnpSQZ~KEY{? z-HdTVq$4YiYJ&P2ujv>^aQC=x!&AeYMGwiE?K}0=M96^eo z^8IdK`bCIKI~3UTd;%ZPU%3||azN!yiFs)4=Nq8hf5vQiVR#>aI>Z+gK%oA(QMi2I zo0JYW7 zaVkF?n43ETyerp;BB7=@FrthEa&5?9ymEQhV z=cu;s<(P!-er`NyUKpe_KGY$w41d!L7LZ_ZGT3kx04$a6ZV!v*2a>a3Zj4t;24n(( zzbD1MiKw`KECV!>CtAJkwMy^sukrjRX@rF<8dyGIC?)Zx(f%gTCcm z#x!LblCwj?KVd z2J61hZuKpvFNUB4gr@BSP%OPaQ^=z)Gz)Y)VhZbvxmtSxz3ln@-E~=??PdjyS!csY zzU6q|`qymK40%D5 zo8Fr%^ol@X;x%?)4AUm)RA(7Ol{H29gnnZid3(_o24`*U@ETZ8`~dzE_r~c;kw`po zyQy20GiyZ)m|8KTZ^+39DkF`G&nny61STb8<)v26KZYA};CuP#{ z*zVf)bq2a|z<0BAyE!G1hPQ>iC5;o&kVy@DTn|M;Dhfs{;)p}Y{7bAkc5)gMT~&_l zhG7j^pbF9&Vj+H2NgLHu%MoKz&k5W6Q~9$TvS@1(q;~vK!qUFgYJbXr0fS#`#93fX zUXCO20U?RexUkW1RYe8&R9ymU=8Ns>0*yA-{N2*@6wL_9(CFl>m5I4OQxmshR~NAUYA3#m>R53lE?EPsE20 zA0JKhe-e;#<9L}e#y}qR1Y~k>XerNRE~SGx&Oy5=HdQy~sKM{Hjb*@1l_? zILiiZ7vQg;(Y{z>fb*}+Y)^Nip~@nbAeVYziwIq{1uo?u?J*#X`qRtsW7={^9=F{6QnTkpZ7=t5?b6(h;E13v$vX|ar7JLC$8;4#nKEpLfVM|2*a4wF zIZH+X@4{-2pMw5xJ{sUAj>n!yzv<1F=SY7bIn0q&>i&p}20grVlwC4uxg&z(;rk+# z_MY2={(^cn4T8r&MXZNd<>Nnt67sw!75K7-5Hp&OW}gbm+BzZ3?`K`bNRJ*6QV~rQ zcMelYnO=k~C9=;Gb3khf*aAQV%MvS>JqRSrIC30=?iY0d;N$pMHKClyXg3bF;dgsF znd|&@kZDp{Bmf}+7r04U?58rbfL)sJ2E%7}mY7L4dm5@NJnp_TKWE)7_T%kB?4$R! zbBuNyJPsoK*x4Q#>Ps&fwdDSi0A8Z${&4siOU(ijTn;e0y$xD~@;tRM0gEUt$CxCc z*CdDNE`Y%Dr|x04XfQ;VE|%vtFW67s@2M5a2|R2w`v@Iq)+%*@xzC+lYX_&3JY$D` zv!B#I+UR4;hQ8;_5sZ(!sjACE(UR8`&l}TzmNG3{Y^4S^Y+Un0jAw> z;4*#$c~PuxFaMb{*Nz9}F1Ya0wB)@<`ZNaAKqJE#4^Wa@T0Io=7V%$E~JinR3uVNjMEA_BYB>W|dsq(Dh zfth}q{W)I);Fi8qo2UaBzB~eqqrH(jQ9+M7KQIuwly9-aoA}SqJ=8i_Z~hkRo1l?L z^VKZ#ihkEsKz(|?Zv)2V5 z@A+fcRFs>jG~VAF4IXUaEc%`E@g*9*CX9dS&^nLOHIRV3{nXG9T+_o2#&m|*nFo8& zREl(lHgZsI_0t*#89k6;g5TaiN9d|M-|}yV#0VV07XN^AtB4I$LPurx<=+RSIAE~sg6~D1{sv@4;z0CTzKSgc?Z^&}9TJwM1c4Cs zjVi(PonbSPC91gl_`>T)NB~jItAz2ID2b+XV`HYKL74V@SSoaLJ5%( z(GPk#F=CYkdEZD*hdH8wp9bKrP074i*D! z)DngU@M)U{zqEp12{EzP1-!;BJi%D)e$8Otc>f`655Q8&)#y^m+jv?jcmP-++1FbyuLQAm0J9K_N-52lbJrDwR%bH8C8DDfWNoKEu zbN(8L;nultE4|B)H6f5MeBP_qv_rk{_P&v-_CYbH%C-dJAT~R74rD%buFfsny&4IH z+Mvnjja%5U*JFHavsqxr>zRYOET0OFJUV#Q#G5PRZ} zyE`+?9)@dP>YJOxY}vdj?q$&p3ck{qQ9tOlmu^nJt!$R8_|Eww7QP=pHpHg39f=Azzb#T?PzPv!wll3rh2e#OT1yEee{NQ8tplwQJahuntDB0>30 zqM(+V+sbaHx@SD#D{Mj$EQxOlF>zdDZjyn^FBYdwRt`?1n~7S8_n*X@sx*!K2m+nR z_uSfCaOjSK(^~&p`A>?3EI3R>uikCqk@Mkw&m{;odhZJ~#}9gc@@*bA=7$QG6CD~B zbZIv>MtdL=##4;tZ~gg-(Itx*g2 _x!o@9f{v>{k;}csWcqqj-=C=ZF`zQRZ$cf z8NK_3X!g3-OE=>g_^-L&`Ga!+t6U?|S403^c z$nyP!935im%@A6w*r?B(3Lrwbm9Vvrrjg@d6yQkc89RWxYEY_GlB_egGg^j|o?I~= zowDqS$YI;VbEbeNXTs$yNY5FWWp>7_SCl3inTeOy~y%CWS`EX4->?KsIWB{qW4jF?9(20l%kQKpKWBOx zZiRV&vbv=a`rXx~jj(W-wBr~8EO%MnU%@g}$J~PqmMIox@b;nZbES)|j-dbeF2+N- zP*`OW6{fv(xwWh2@b-EWSr|!Y>Bc1k{dM^xgcAR$rM9|4ygiahvv{c?BWww|!Zb*_ zI^0Q9Vce1+PI9Q4L zXbKw=L`LHu&4*lmeHege1pTie9vO}qSyimVFE;o&XwX|?&i7JY6Ca|VL=A~Id2$kQ zTje;7zi#ERqE=1+3+T6Q?TQf6@aK7*4b3J!-*oG?58$xO96FU5M3y^FZj+bKsaFI)NS zdVSjI7&S=jOAUKZx|^GDr?(4@-rwhM`6trTB!_5-wZVRtYtZahX?aW!N3a5$f#4VA z%f=);aZX*r`gpKrfo!C2Q~JrJ*9qasH);Vl=psf!*`I!jI`jTdYNKCO*}5IA5_dH% z6`8b(Ews)Pcb`sd{RgFKh>tLD9z{*!SZ_kkk&^UwNn^NA`hpK+9H~=J6M;y4PcF;| zNDq_s6klhmq~a)LQ8aTLaGq&rX2OvgoW55swO)S;v+JFNBJsi~#G1_VgDNY-$Q$BKLAq6pYqxPkWhIih3x+aDZ)3~ zj$is5R>`+-k^w-w2gEAAy$_0?`FYv|$dHIw0kR>OeM8qX>^^<8^?pb$QT+WjarB zYyv|5PW$sBzQpFtak%1=GwtEHimlRUJo`OxSaQZePW$;!{e%lqrlDRrA*Ur-kK@+( z$-!30=sHCsn8|K6Uui}b2~ziH=qd0-BLy`^^YqVbXmR!j?|%!J^`C%wQPEIjgU@)QBdq^^34);KTf zgCNXG;!c5(ex)Ol;c&St9&(6hv9PrUvxKxDK73@M9|Me(Q11OW-p{DNX+F{Xfsl6! zIIoYRN5;qqunhl? zFMu670FY57i=iWF&~d*?03vl>@5i~_{kG6n1y=76_y(y1Lj5eSs^xZfznPB*FvT|e zYZhy&9j*5;k7Ud86_RMolw3H<{P~eWAhZ(g zj94>m?BoAnb|H9S1yB)z|D5PNHVCUYmDDe`;JDna8lnYwcP}2xS~qo&odmh^SkS9}rSd%=Um>1XSu^Fp z9Sev3n%L{&z-VBW^zz+*-sitC?PrvR(&H1~b|(LDcv#7Uf7u$*==WSdCRsl?&y*N# z=lTG~S}sUQar)hOT%M)a1Lzcs7msa`Tcz0m(>r9$58$Qr4wg6u=bykgOgQpsL)#t= za%$3b{KvO|akbaK{`;3WVh<7`tupa(R6l8}7S{04vG(^%uAc zY%tMioqZQh3_PQlVgp9`csvHxZjk?!WSXN1HFL^&)%{V&X>E`$_%T7^1JkI$?`CTX z38sU;1!@GpfM9b?LeqRHOKCPZZt~cEI=FayJiw>Clkq_U@~I7H6&jMu-fsZM z-qP);4QgmGLlfZ{pdR|yBi+J-=ukfV+HSs~pmD#&@!kJ*{&7$_tkMOXJI8xxQ7fQR zJakTo?9{MgZME0W4VqYhyDuJe1whB$o7=vn`@Cka3{EpjH25|i<^5~o2sU7t8ARp0 z^d%UKPkCty(gJ}G$?YbJUM9uS$UdScE`H9TsqRQv;k4Rq=T_$_&Ju>cgTAEy^p8M3m0kDAlAujaTZ^pUD6!DA!wIgXz>iBLQ zyHyuNsca=Cb^&RuyUF*u`eD`(us@dzLxQGW7HKJqmK+vL75oS@>%VaZPE7%gQvJq4 z67!%E6l7!tP@4m4E_2;CYfUNsF2Gu#qJF$uxZP z`uoGL`asPIU@zjJDFO?H-JpM*OC6nDnz;hsk}+|?T}-~ER>;nKC(9Bz08)kYfKNO6 z#KTDvd)bHbz#r~|y}La(5CAnrZo~bH37{igy&3N}gyjFe^8)mGPP1LY=(5@9;IRiz zc{4vViHZf$w}BN7l&>{%MTsRg8@43EnD&=ZAaS9k{rG<0tQ)L(JY|kTd9m#8p8k6f z1T%I^JuRup$w%M|?**{G;210~byGM2KMO60kY@msC`XO!#Aw8v>{7A30f?C;62D)> zmR|xVy3@&&ngGZ>gXm{(c5rB{&^Lh4SI_psn1#85nAV5Hd#B^Xfh$rbSo*q6e`+}6?cK8jGg|?wJK%S3{)fX_ z^=KI$`a1yjFeF2yf(~fV2QwkUl^8f<{#VwrRC4C9BD`2%TQd^#xp?v1pq6E_R6pK& zvaDx-gm3LEZ5Cd%@69zcT-^4oFdUssYXqR=8L)_XvhG>qf)4)x7zYKg*75Yw>#Pxe zyNumQ0v_FlC1LN$PWco!fM-n}ATV;<>*-bjMfD@F5hdqFsGg+&DxyZ0FKE?qYM=}a z{>Aw@aZ&s|4LLBN`kIFL)6K@;w37TrV<>KXQEcse}3HX~G`> z(56-1=AKz*HpUbg1Z$$zU)0OsyW|}eZ0+-N!Rc?_N!+%hnn3ScYft|@PKKzX%xjg- z?)agf%9UX+5BMR_ME{`@Q>n-7X*WwCO#k&Vk!H@P`f;yDX4dzj44$g_~Ng^^Y&YH32X-XeO*@|cGd@q4(f3f=u*HtovG7#6&(`=7;S8)+dWvAjxVuAYZphU4Tl=X@AcdYpF|>{BeZw&x3SYM_f;E*ykx* zT)g$YzV2Tkj_#BN#R|L ze12r`97kdgMm^fk z6*KHgm`Fyjx={e|iaxJaG-TZmum0Q(&3m>?JNP=@7*1|Cp3i%~e?kY5aG?%+5=Z&U z<-?}l39j0Q*dRu#Aj)9uMiiaK*QPi{rDx6Ncb+MFH4PvHm3HpeWxnfeZzpgr1l)P4 z-g^S1djS|JUGHUmg-s;+BiA-K55L%AKS22V6DzsM6L+8yq86X9R<6&w;1#((l%e`i zT3rzp)&BwNCy5rYBR9G9MAiJZqbc&Z2=Vu~LIk2@Ht-J;kp~vKh8Mo&t+Si1>j2 znV5N;>1pX5Pp@n-b+FWFU@IZc0e-Am?2BeK4U=ZAXS-?;1cU?#zwvq0XD;0%Y|UIY z5?m4++MF>U0nw=dtxK|y#)~UxjhaHdqGxR@l=fv{+C0v!$cAj+?dalHOeoAq1o&W&j9R|3cTp{n9yIK2c(_=F$V4lNCkH904fZvW5 z7$SJmM65LB^OQb^nFmo)8uB3UVuH~L>3~9G={iY%-laG^oxg>xlB}U_g17nya1vZV z#d-y5NOT&8t};icN5Mhh!1UtjBTx4ZdC9FtmywX(h zYNy*^^=a38FagDsko$1%J^trs6lN1G8e<;=GI9QS1s)*up_V&KJjS_p8ksau+>a+y zN(^6>XgG9My5(EQnQ7IbaZTnPy@sNI=Wkwuk{3&=qY{Q9+GHUq-eQGlQ%u6{;LnPY z+#g{~2YpiY;k+Wr1f)Ll0e<5no#KFeD7Bqvy9vVs371t)Bvie}KusfX}2atGEtXJ-)aDZPU{ZReF- zyQ6^Pa?pH4XQtlbVGE%G_8fW>k@4q)halZaaF&?#P3Vnjh%aHsWBo#MTwL4^eV^h$ z@sN`(m%#wirXn5)Q97jh5FFiHItx0jq7I}9B?-E1iktR*%;L;d z9244akfI6Bat0CjYE?q<{hQmf7dmDe@IVlekhaFM zGQ5Hj_KtGi>W6a;TggVVEPw3yiOyPz?}jn|xmtgJPe|P(`vEYj!g>kS>GsOC?)kF4 z6Z+u62SHb>USQa&Si?nQa=yJzUOAHjkE_o+{{`g^tn{slo8Nqc+!)YW_XT}mSo=6D z@4`(e2_dk%$MbDa)K~C3pPxf@edFc4eeyOvS+@o-CZJ}nF=E8}`p?cE*)CLw+{jj2 zoifoF;dBiLZAwr!9{kcY8*gxw!a^NJ{AZyMZ!twAjj_53LZhaINi9#L2}T(0;v)}% zqzPA`7bs=Cdxm?Us!e<$;Qr^+9Gq-vj0v6BuSrv5k9lKE8oq)cV9Fw~nc_?}m~ts6 zbBCMwgqv)UYSd@Fm&|5ej^WrjDHy|3UH9?(}C3LjFrO62VJ02DbH!du;Gv)Yu5-YHv0|VpzaFv|($1g_vrppYX%^u3(hlHt;`>EVyyf zD*ndSg9PL z38DgcdbGTlLP1H{$4+-3X03h@Z8-D&ZHDp7DTBR?m4ky$zDJv~=C=!|r-rWUN}k*!oc}z?7xV#fts2M69g)?}8!BaxmU#f9A?K+%Kr(q} z#%nZ%zCY39DCBH1q(a(Ej)+LPNR03dIuKi5+VR_2dF_)TO_+Uu)QeUTL<8Sb0@ho< z0`COd7m-O%WEu8Y#5T@UGQus!SBHrCtdu|^JrY~h9Q>krmvA(0z#>n?!ipdQN(? zA;LHNg><(FZ!ZHl%YPW`EYYktpNu;qWWd}PwBt<^sjqSQavmN>xbC0|5nqK|Tn^hD z))x)u_oSO?f3P~ElJN$;^sfRLLs{VVdhkT;z6oI$L~9}8w0$3&k1>c!z?Hv;mM8ZM`9He+G1dR`eSiAb#Zv*B-y< zh#-i@Kps5E5q_Jd;J7YJ$Ri>aVuA3_v+qLLa(?qT$mn=3hRhNio(1!Blu-QU;o$p< z;J2c0f;q#ayF&uFbo*8OhI%3?DHnGj{IyBb%kF%%?Yq2bc5G;gnSuk49;VT>AXgD_ znGFw-__>t^Dl5XL#B}cZ+Id?+-;A3m0mDu%08u7f$fgD-W$sVccOCp%Jr`!yDb*D) zUO6YtOo>kIJexGCb67%rd-H)*%rVs?rP;7)>8H*&1z4eOEhi9yHghX4fGSX!bh)5L zI^WLoiV@?VQi>9rEa2jBWh^lGu_YKxRlT`Wmd(6fbq!kqL$;7Kw+nhgh)_{K$@p`nsHSs%_PhSWSCu?olLjEzAS*wx zn8J}5Ui^TB!n2?wQldhD*)aHszyfF;MiZop!)>Cd=Yi%lU=)Li%?(G_zA4r~c2~?O zfbVSqm7L8qTg+{j@bK*N_fYiOmaEkyKwv%!wkBZHqsqJ@W;XT=U|x~c`DdSefZ&Yg zP&o<&Sq&q{_o84blJQz%t%!%YwN3w$ZP(c!9OUlvoh4(p^`4X@;B1uxBObzDVA_kf z>_MisdUoDe75XjKT+1We-h(e@;1I79k7U|Mg8zxB((>MsGp|LZ5m)8fA22{9(s0~` zMZ%pv3gV67M5;WmJvA0D!i{u~nbVAPp9l1c*tYtQu8Y&k^Pm+a1I}4_0AtB`;+hWV>e_we#D!27~YD5yFgzxo<=d+X_@_HB2T)U8RFrCTxvDhM5R7g4p zB&h?eK~g?CrwDM=(y{etqg%E#zUJibcA*JthHs$rwUQ&Wz{me-G~^w-b6 zs9GON=QRRtv@1WhetM{O38dDft;YM~XiyTEbb7Vj2G{g;0|zq%n1y4ggChx3vN1_` z1oAdO`YhboNgu6FQaEOa{w);g3X9!uip=zo&kVfb6<8F)VLI|3|9h5zzu|NUXY9I7 zZypYSDGeZ4_~FpTurI(O{{(0hVc$VTL^RVu(37lyO5^l!iBdh=Ou3g?Sdfa+kO48E z>wQY;^NlSvt8pd9KnyAI7Cc12NzVgD(P1Diidc4PxfW>_NZMdWsq8H@tEMYyJ0PD} zEgP7O>h||Ku_%Z70G$q6NfCp$QgFcecpiR&wbaOGL#2I@>Khk558r|Q``M?%1`{Q{ zzH2aeRY@Qv3%W9~f@uOY9}~`Fv={0AmNscCSTJ)RyKpZym9EDjWPYrkq~KhKh0&HJ!49H z{7g6BVao3eB(;maR`>|-N;M1zf(Kz2$-~OZkz5?@zZZrbt4tZq{v6B$2;_Y<)CvNv zI9>BW-83!CJ78Fb4B#RoH|jKt`Z7fI>`oyfApDiR9(I|ysKcAZvwyD26M>SQ_Z8K* zMig996sZL8)to&;-u?NB)w+hTYqvlRF0YK7jburMqE7eN&(+D?qMR_qRG^K7J{U?B z!rRwO?8L%XN$w%Wn|b)p{lX4Q76%j+i!a&{O@D^Of>)&2-ee<5KMw%V+3**7w*@wz zIl1kA^Dmoop`va|F9Px%ZCn0lQ9Z#9V4h1H-gd#xj1+}TWeWJTA0!1n+sV!nRt8*6 z*003pH0p06`;32Ay1rGa~(b2JFlOL2z{4elN!TukVlm z0+eoLxbaPnvo0EbZUsIc`k1#Uak7h`a^SXJS1Q!bLX0Nk3gMsShJbmx<%&U%S62tk z6v=U3^VUR#q`~l~>r?51oiGuzva&)XoPn)8=Dp84o4N2%N>{D_a5^y$5fhtbm0k_4~<)zxJn{Aq?)la^6Y0pVu5-|xx@dq|LVM{dm z@Mk9C`JEZZKspzRSSC(>zGwE4VA0XJ42JE=qkk{`1PGXsnvGtr#JoN~;wHSmqUxPa zul9`RDU&eiRMOIErmk`_HU7C0C~E+q2MQkB(I9Y4Fr73Kw@<+{6dD9!y__g&gS(s6 zbEUw?`BgKWA!=hfnxY1K;RhGQ0#>wtX7|0xlYI_I8m9fHxJGq2+BC+9vgvo)kSF&j z+`abu2AE1hybyH)2$mQ9)93o}~h#D1uQ6(*$rXve-8*SrNB!Pz(| zn^60|oTswLCFI}us_~eeJpTKRYvB;`y5z(3vM8|2gT%qKRYs6g=4~dq7?+eGPuTQXO!|ndV47KH$Hr^Tk59(LH1h7=CC;r z$nfS3hmoviQkvn$p9>4`M#}CWPyA|Q;d;d_K|;>b4vzr?FMb`986l5nkJ$Ypn71&U zyXX1&CMP`J0ua)vXP30HpL>PN>){B*1#(|$5~JBTws)%X0?Tyl#y6Mk5{a8>+kr^lvlI0&J4cKb(ei%{Fj&{_rG;;TXgpNaWTjB zKse)jiuHIt&e}lAB)b_h3d)!pPMhhkU7hi7iZ8#KZCWo@vhb1Gatk1HrE3TMZUasH)hs;ihlE}e%fW1NS}@4Sv4oxwie?PqS)#%om!Tsj{W zZ>H*Kz=}3k@WhhrZ2UwMUZahDRsL!@_LZnY4eST@CJJRQ%hJCpXE)(NH0gKLF0Yp% z#Q6U{WjqLAM+8ZG%6TSOA^sUr^ADO2I0C{#WSuH^eF8uXtWPrqLzB6|%pqcShs?B4 zggGASmW6PHHxug^IQv?Opx-Q3Y?<3PL=hSi@+|NvWea4g&tdAo=;UBYD&wJgjg5|1 z)m@6+`}<$Y$HF`V>{dtOxC|;vNGRwzV1Vh^Z?^T(hRfr8u&Q(_znevpk@<=$>~}L& z;Kcc;1BYwrf3^v1Fy8?9$<)yfcUxb3EX5k^#;&k?q+jv5F|e8PF_UUv+?h146MQJs zDv(^ek5*$WqNv^>fpkWbDeiXDDvpAsdP(>67z}Zncp3Fa^uVYM7Ukem{-BGGNW_fW z5n0H9ASQddN>=rKh&}WJWhmmyz|t4_pM1gquyTdw{aw@5c9CYCi{-2PW3M{T9r~zb z@)4KPBcQ~mGBajr>IOHn;fB1U|3~EmDjsE&xVZQOz(X0DY8Az2vaFcgC%_#U;4 z4)=v;S~SC;1edG1`Rh7)rv&N6!18eP{vbK{@ZT;!l&= zjSw*?M1=#JJdh9vaW8B}X+Z^8Sk*Dd)WzWlA~i%=rRv#v3RquI@eiN^0m{ubUqCaR zX;LZ|5nvedigl{IiUU8VCl`aXB_HsN9X=TGAA^uTI}0(F68X1A0`Au0J;cM5+#b`I zK`0Ik&l?5&aTNd%WBxPW_*y4*(7yRHWTwV8(p)UH_&JVY{k&luz6DrHo=-S`1-|ZR zkO}9;DeQ~^L$!mjihYh>ELF-ecZD~7VQ3+$F&|7N@}**1xOVINUH}{}c~M7aC9`?e zD;BFa!N)O47uH;eg;G9XBdVCr3atD0N+~Kw3Gk<#N2j2+9{Z51Xn7q&1|20I9Jc%B z5U8d?43u+ov~rv#w~|+hgxo9b;Zk~aZocw7xj;#XjZMODMQM`pFS&vnnU{I5es$lI z*n%c{0l>%K`z|gq$G|M}QpK>c^F9lg*uY1KYPp@O8!(~$cKiqE`#rFQ=IOELPD*9iU$NCU=tPmgu%!dq;dl(JX~6C(3ii8ec>l7 zpg1>=r-CmGvw}vSIuMJ6j@@>K8$M|v*LQnd2Q&@~K&{ozb9v}pb+mvX!PB65NCtHAZ_9EZi{t@uXtMhRsEGHy2=%z~b9xj0A_VaW@ zbO+GQ62rO-J-diqy2*PePVd6tW6+dS z-rDu)*!e60_`xVASR})=J2;Zvs&|p8UOAmxo$gt?{bR|<{4ekQ{%>>f z2>{)}+XA1I zyQCqhT`BRkQ=WvdQ>6bE53#b8z@wuHX54y`Wv(Tm=4kF>pL~$K015Vk(Jk;ys{ySq z*MXllDj6HQJo$mSp#5B4^w?ad)}I2;Y1wF96$&c0XWdo8*1t**KaBj~jiOghesOFz zpjWhNwgobMKXkaRtVr*Fy~G$Di68MU>)o;5)+{&)LHhH*3(z`5zeGJ)A?Z1*DSjv> z*@w~R#18|yQOl7g%;Om}>fQcO&yuZ~SHQfj^lN&V!$z8o%#U9zlj*%#IrdD6J(IKJi?p*{g8s+e?V=Z z>CuSidL!m{qy6ER#S_RKP0LV>0oyBSQs!TW8I@x^skCZCj5{e2R z{x|u##6W1@rPrxt|fxhXFv-#ARr>w(G$K_dab_DXN%)2t?IR3N-BamgPGh zZwz^>lezNHw}?e?nGFtWO9>P@KIsKohsN$yXKFyI$`=cm)|vC(-ZC8_Pj*Y`T32CN z$xS_wY5pnvhcjB-7kp)bXO0^-0=gOM`|m|LzbSJ+;R#@(u2~1K?w99_>*O9*b!eCq zU+7+3PQ0`P<00S%A&WkNs^fd;06J0XGv-`$@5H$V&v^$cLzDoVINU93Eg~=UH}XMurTg3n})!WSNwFTJ(_- zR*8T5bZ;#6n_@7COi5UM2h&Ef!51SRK1mI8q_Dkdc$000OvvMV(%)A8?^?2$J{G_p zfmaJ{uGZLYc`6i(;*|*g$wn|F0{@xhzU!V6sJnPYq%$f+wN5!Dc&#J>@uGq5yY zs*@&w7RVT235TtG&i?>3O}TyI`Q%ZYlwUuAM5AooHxa@w`lvFaUIAn6-~Xt1i!UPZ z*ts=3;qy?4dSG{u`=BF^;4PZB)}3w>ad5pX(N_iyGLE^-9%91hrl2Pgu20hA4eL1m zD9n;!>o-^DdIIb!*Zmif1gy|^C>UB+!zNR2fz3+Lnb+zGlct=P*d|E615?gf0}kKo z?vDahA1PS)CM0|=bKr%zMb}=vfo%>X#6-9v5LWfMS?&Ati86x>P*JSgz`pkp zK?jQIAsa5Qk<<<^!tv5IW%Z&_A>j1Z%J$SMCr%dz@4*4*XBL>pP)jB-B50nR#0n_$ ziE|HU_ySshA{O-mfu4I!3vas8%(aM|Dd1m6J5V?Okfkg^A_(VI>L$V>uNcqkxidvSss8%`{jHAv-S@MbFIqczq}vMRfVgpd*zi z`BB9a+7?tG#=F}xG<|8Mtg9oc= zJkqfy28U|aOUWnKz|%4eq@HSRr#=44=DREA;GiJ>d4=2Si$mjOk7!Gln0PAJ7y48D z2CA?}_vzqx_pcTD0i>7)8zqL}`A@rrETqP>8SCd05=OVELA9^f2IFN5++<@&)n>#5 z-7{JM3fgjHS!R#VFg_Vrv$Lt*oyt906+c_;!2|Z1+LaQzw-t~%+rspW&$hS;XfDe8_Pe=HOC;6uV`%$8e-j` z^$z)jLL8Vj1@rOpki1`_=wUqaw(p2kOp0acel)mu=D2=h34G64^%EkcT@_j$;YdNK z)6^5G4;S}{&o`)ZP-&eIN$omp5cc!Km+MJ*NOlnrgmA?NZG^~qHqjB!Xs~N;QYoZi zkJyq{Q;3Aoi-aGQo|7@YIS0|!-$;)9Q2A zi=<_=FTW!gx^)BTY7aD)hxr%??z!p5*I1T!0K8I}SKU_l;M-SJcZ^7=*W zx4yXq^wG|=!loFY(=Q~R+(<*ks~(a&nBlpWiV&qca1LT^K=CRxN#jaJZGK9bk4u|+ zVD|ofO;OhL=3c>I&1hE=?{t^xl$PnIIsAjm={IJ)BDg)vkbnWD_?fR$ZYYtfn}nPY0q=b{7}3YU`fZ&Z1MJ?EFfK=%ap~X8tg0B`{DniN z@rgF9Apefc@x1#&J}jwkQam_X1V=u3aLFeV1ss0e&-$X7S zhVqADNr)yMVFnoi2FU^01-rJRwoBhh!rvbS zLS1aE{>P{-gg6H06RkWhR!C4`B^nrkoRa9*tm(#=_J~l9srK|Y(zV2VD};I`G(vNO@uFc*~6r{AiGyd{^)z)i+0ES6cwsM zgeATgrQ9XRiN4A?s7f|nn;nn-t}F_T*}XGFkTO#UfhdHT2#=u7S+gV~DqKNV7DfR( zp}-43{gnb*p&H<9W?V>PE5>Fy2PFFHvypNE$P-q5X)N0Qyp-&;of2AwPhlbGl4zMMaHoTS*= zemtUiJ^uAel=D`pTohV(sy}{qUeGXgob`KEiI#bY$<5$gsCnHQLooWjHqkkG;yZ~@ zePzl(wRqWAITmWUNb|MEp`&*ro+l7^p#*{oVNJ2oXX`y_p?NB43Z{LD6Z$)I-fm-< z%1sm!FJoEczT<@$7w^G@pJ{52@mCL$7D-bJe42J@do1PhX+RF@4SetHjnhHlxS!|q zgfQqq`JHAp^6RH3F%LPBk()_1(JAWgHwNui_m`dD=JYkQSW)?9;bfLU0++1u|3}wb z09Dnt`@?`Jp>%gjNGaVQ-Ki1^NJtAJ-JsIl-64q5g3^-GARr;q(%m57ck#UcbI$vy z-^?BchS_VceXl#N_yqun<|Qofd0sYAp!LjmgqZnTnqNWA#c}B@&;g-ji!_0uZ3snE znf*C~QJ+1hzK>?vL%ExBFr5qODNYCCupU3%GSs`@tK*RjycfVX3?>(HiZsiKB*^W0~CRYQ}IQ|pgz2bRM^-zQsWJopRA z7M>shiNO6t5=-o^919j=c1=IF9PO;AT)Xpx8D?P0mAIW+zqNuClq(~wbl5cc3`cKH zv-Uw-yR|})(`J$_XEl%F{AP5di=+#JXtmqnvOKJd^4_R_%9v32;XO4v`N$hUs}v;WuW<>&Rrq;SX-~puEqu45bBp>bF2D0d-3o0SXaepoOmZs@M-sCNAw4IH%By#;Rx^F^g z^4a4AIy05L`RO{>3YeEC-N;q8(<-THQ^mO0*y2!=6vZIpRkGk@bv}MdKILu zrXCQ(_!(7d!<@=nkFKdh(otA>ME{}~$NgjFTa@V>+3>na6459bACVc8)eg z4SG+ zBwxY!$`%hv4G(!3_c01KNjr;>P+NfrZShgx&cTyFie1&u#C#K#SiW)@Ghm|g+5vez z?%Eb%UI4YkQsdd~b-g;5JI!WJF7sPksuUB>nZOZ?2@McuA>Q7-uYeKt|6+C(Y8~h@^R;?ib7?v`#{uMxU#$g@BIXhzDMdYw z^ZI*EXKphH=}WlYYi{8;7amfv{V7xuYYfdZ;S`-ra<(saAfafS$_ zUy3RN@FE|Rl27|Zafd4jDX9X$=e|mk5LJGT5yDbV&~4@GUn;x95(T z1kpp2Pss^JM!Plg6g5-%?e-Dp@)-aJZC7DBJi==`ERzyAKV6*hXyFzlgc^V?PrDcVfGC{rP$k9L983)t zFo6ER-{dY7|? z&rU<_VH{oy6}wy;8aYg<-Xu)SFCnH=b3QCL z$M@=3FUu0yqQTBnuki3gSCH-O&UA3m)6+~eGP5I)k zBYs>oTAUo#U3pk~Hpv}J$wP1a@f{1gop5inbnpia>2KvgwvEkB(JRi=xMr)K<3ZPG zK1j=4-zms3dA~|6OJeguSk)9LrB-4%zo`TE2mXLDOV00%w=5!#Kl z4jwDob8@OK#wNwV2N$IpUb2*jYW2E~$s$&~01xkNiQj))Y~RC1%rla~rB$MTGu-dB zhCbw9b0#;YsG)oq&lw5{#t`5d^D4t+eyKk0jS%|+MT6WKrtG9a(Uff_6;_75o_IxC znwdTdp&pyBP8(^0j=^L0YE@v~8R*j7GU`_nQC>G5g3q?P=5ogi`&keIqh}}qOT40E zDzk?MtJpNHQK;m?r6yD^v@sMc$YUfmO0(5t(4;JeFGIZ_;Hkc_`N%39sE>9SMk2ld zb@9D~#Cmq99469uUL(EZfqbw&9y6vnMCKP0@(dM0?+3`I%lTv<&z#Z6e|w`spVxw% zs1rZ~H4Gp|vR5RB4D=D%FX579(JbO!iumEkj-SN`At52j#g~24^E~mbD5baU1v7=3 zqWIC_lsld^PmGiHPL^8HNIZ3*S;)eClmeMnET65uflNr*OYq|bmjk&Ide=qI!*R2& zEge1BIMIQV5uI%THJm_34H^jMe3`%zpe9(z?l*ED7EM*3ju)%d(wza~lZ^b*ZWly38hrEjnY z(dyyr`*Y?3Pr4Ot*#S>yD#!b52j%2B5?P-@!}B~qi;W2#7I8EVZ|s*VQR#b$DMr(z ziS#*~ZR%blqVV-eK{mPREnMm?#+HC@+1#7uCe3s4eQJBJU!$FN?NMYlE9rp+5-60i zu<%;$M(KpyT#nDk^pGsc33%LwP7sy{1$-XHbl)SVvX@8xecki*=VvpaOPuB8HO*|s z`AV^1MyU11+@K1CH@`S6$k)Jnkh7X5BD;{Lr+Unxt)p>&?qnvYk26N#xre3D*@a6p zM|ll-_j!z}XpnWna6dFsWT1hm@pIt4U3z3BL9O1Rvy@i)z;)yvYHIs(Hz<8OsGCRz zfK?PIjSPdiy*+72ZX8q)WpB9TPn=0VDc@t?3MaQc-v%Xf=9)pzz`ROLfifG|>bvd*X0bEVu2R+~A0Rr`8}0 zRo|Jm2xWIMuvmR7emiIpP-M$3APQ#5whL5`w{U@;uKC z&3|tbldz?OqqrxH>M=d?UXjQR!uOEcx>FH%!ksVnIvP;qe8LmvbhoJpt&}E2tGyF? zjM!j46cZbX$GJc9Q5jS7@YByN#Weh)iwP@1Iv*QqY#D0Z98;g$=5MM7_K2KX{4osC z=lvcbu{ zqdSk~a3nOc6rB^WL^Cs_7mWjdB3}|MAa|fu;iOgM=Wi%3%XMk~Xyk`p?yq7Hd~;CD z5_?Kw0>QvMvA)18xRm$JtNtZm^cJp8?Ro)+PtlX!jmVCcjWwn6tTbDagQlsGgOl-H z1ci_c#YA<&>CcUu0kmC)rJk=C9jk4pDW8z2I^(nGrvjR0$%3l@3n?Bu@M}RQ>AfQT z@3_+0YbL!D?*}*9MPpD)t9>y2qXBrW33q3{xny4mjR|~c>%_>Imzb{K-c0$#w{dku zvGPZr5DFIMJweiRhe!f%jg=;;CFK;Jm^Vn%p$#0SqXO}%t5T{OD7OlCp3pLAb;q+Y zOP!f^#+pX=Ur}}R&au%`O$n^>+S0ENOgM6{eWuX`8Nw~9#TO@gD_ruOl(AUssYpbv zTUtfc)A3d7skLvIh2P?+a*;dKAtMr@aa&G~wUHJROamgNekA)URHAy{2Qxi=`}j%D zwp(Y+Jcwr^J;g4?@J$R$CUu#!CO~{vV$f(qR^W7hKj6L?)6o}J^*Utb6hURywpE4H zps|EDuvGau3mt@H$;#aTs$mE6Vl89W=)~S58D@_7%q7sjT^$%p6aW~aC0iW^hh7c+ zdk$NRRJ<5RymT~A(bGWws7xjKSSFl$W`+@m_)!CIJ<9@Q-iAiTcr-5nj|v)Z%T)uj zJ&=HgA~!>|@0Nh$>OE3wi47MkrJ-|Lbve47OxB;t9iEr_sc}}{AZt0k z`{=!keQFx)m4mg-iN=1`z=6@nW1)o%=LNB*I)XR-jl?}aqK5=HbhcsAirLeEvQ(gr zFI{Ct!(-rn!1Z}JYOC?GjV@B-{MuV8-_jO`Qn4gmq|m$3Yoe|EY_k^1V8Dq1o>27+ zgJ{HJPm*MBGH)JPbQ(Ut$*byO+U;aKq$`8z2#hAczj@~%a^lu>zI|{kSjU^Q(0d{+ zN)WUT*k1{-N{=W{)e&;ZQ;5!$@3q9-@bPg#xq?6dDE>rmVl`d2+GS1Je7?5G_Wl08;JJ&_;g_}$g^o5FT9fv) zdx9Ulh0Ii``ZjI+o{`UYW_X&m%9*ILy;V9EbL17aGu`WoyEXXi&g@MV#odsO#FBb2 zAK46{vO2k-xK1hPIs>r{XXuvoGvh09dVY>ecebUPp_1{Qq8$+AD`A3;<~_@URjTnH zC0jk*HC@iOwcpD54_E04%>^+-RoTZ3d5X}G_HFXy{F)t#sd@|U3XwS0!M#PGF8)waRO*o_u zU!53j65W%X{P2y&%Y?fnsyrlV*=DTHkxWLJ8AU8vCLs{z`N$;%3CK=dOxK|!6i6X!(_HfaFNi=RGH0nJWZ#A z8w}V@?)x7?(U@2E>Bat-wnwH?ar`;0^8F5O(o1lbW70z^GJ=_S=Rk# zygK_fDTV-qIW;cfAloH*Zs(6>c%#5;EHIdEX!pccb?XkNq14ynH8tx>6*!Z1!9be8 zdv?p5s)KNzYzcY_EEEIPbA}fLc3CeI6=z;Mis5jGRZEPiY1KY>IxjOiYHTXlB4iPr zs~~KiHW=3Z>eVaa3jg(wC{e1^{QQahiY1nVpWLU>uN_Q##2h=DErnA&a3K1MLdFG= zhnY3#a%Z9wu;6x78yPT}(9C-IgH;gn^*!8(ii(QeP7q-~58H97zXsuE+TQ#-F zhZ`;$g+;etjnOznFd9qgVV6dW3zd=1)Y>-k6#sm1&>fRPZs}iruTWDnY*e2Mm&jfl z4YPJGthrGOQkLxLRuk;$rS5PcastT=*hX$?e-Yy_BbojW|Lap-lak=GrRo7`~^LngS{nl^PWD7uzM?{e^n86`K$qvz<&mX9_p{ z<%V)dq@M}(=r~TBi~8@hH-6RaybmJTll0oby&1Z8mm#G23IDZ@4zca6MvKPVCYuEM z(%$G-INeiu{}&4Ex68R*Q0##bUtj$p1)tV@Jn7{ z;0Kgj^i|fh{>9(PS&ntR)L%u--KGnWE~h{25_Z|nBs@Bj6ulsJA|&cl#UBaq8ItK0 zG%`&z7A(N$ZF={p?8QWgQXIBDsx>xNce$;EVj$V3^F-Zz9Hq=6xnIG(>ZfWuBY?-K=2ectYFL05a!4zVuQc=Vm; zG`!X(av4+nGKGEtk_v{%PfA=a!gq0XNXiz;W5_(%W~O5vXVGzxm>K^dn0?pguhih% z$aJxqI&$)oU9TYZHtx9kDVp(w%X{Hpyq7O=5`rHJklkmhXQicAM+a+YaY1-Q~UA#5q z37xdhZ3$Th;hmY8UKSVfX^X{PyG?fe8WWEQ7=ovz5pOZ>XM_>@6N!nvrn0(M802-g z$qCs-fZyO7A**)gJ?93|vYiONfbCbhDrMQjI}ck%8zAk#WfWXoqniHp`NNjoKGleU z%6iMuU9GluyX_Oo&pQv>8nryqMwI!}La4qEsKh-WHxikssO3*N)z>`XXfl z8a2)(QIDlM$|{c7Gsy0wQF$2mcaM)Be zM-MJW)oYssj<&SW`#`g$49Fp-Bps0b4Ci(a|&W)(8Bp2U9+uijTSU} zRsW2fvcsccC%}KY?yg{_p0~Ppw9|%iv5b$}|80k&dhI9?gZ;^? zgxdgQ6vya(svES#_&@d+bc=+uoWKOZIOHvZssk}zZS#kuN7g~D3pNsV8!FVB zzM=Azc2o<$wmc&nnXD$S1i9Y~IASy)%Lw{OcF`SUJ()2t8i*0&@%={_qpyob0-qQA z7gr=cP8FRtlQH5ljjKpVPB&*N)nibOO`)q-tsVSYLnU3C~{iA?{0sA9!W!b^~X1;*+_gf*Hk6f&-q4nQZF*4RNeCaoT zZL-)nGK-I6K7+^IDe_YqP0FG zrjhrt&pXSgVy;z-3mb1+Qlg@c#rY_Xi-4NU>o$G?F49&mq_bzW)+e0(q^?;`#i<{c zVU;6q6BdN~^Ri7)%_SRTjujUg$)$SF8YWmx@6T|jI2Man-(5@-K&7-_+DHGIQ zNwMzQrf6_4go9lKt6#VwP_|mFHTDg329G0lCi0Q_XTJdGv=ftZr;pZjUdTO-c0Ht` z^$|;lB5p?*l`2MSS6(7LP)IAycZ}#hYAHP_n|4GBk`7hlEq(S#^D_A2K|W5hEj<2S z`EtmQM{51s^$wlIX(p9T6hy>Yyl0&SoiCq)_5h)=e|5fDz^5A=%9wKf?LEvfuhoD* zC!&e^p6+I(KKxK|Se*YaKGi4Zio-gi{`BnjjuI&eD_BAs6ZWJZuPW{yJas zu$tYo+9U|as{8AeASu@iz(}K$J*9!;;T3+xQco5jz4*T~aj5?C8t0@_j~$(S*)(9h74xWX&FbZggH*_neDGaMsI_A$s7 zSVi58Dmh;-M5UoSoa>E!#OLFEbwY4_0eSVLw6(EZ0T8tkpweAX1nLUtX{-R+8-`qj_;9OvfTl}%We0CUTOP{2)@ceUrY@kX6`gQZMQPQ;0Ij} zK4l#{R&|Zb?eUdY9~@3_H^$0ZZpJCbu}aUkhv&dU&;+seM{h!!)A2s1UX@YqXP&6I z+Cm2+0zbNzuVO6_?f6!u>)Q>bVbU*gVMPX5Gd4#*FTMuk&Lv zAF;MiYw8)HtZ_#Dpp{Sz*;76*p$*bIq7(@XGsiwaMv}TAb=Y;baWq{B3BAl1!hvq# zpwIj)n3edhj+B(hAf_DXD$%PP-<{;B|Mdx_^+?iGVZ?GI)cDir4Y?j+g1X5M`8?e9G=r1l+c~D03__oP4#EZ$H_?-bNxa z?Y<>)Iv*hxdYrVqekwLQZ1H6P0vC%NzG-SoLwrUGZ?le&^+k|li4;sqfzaK!bCENu z05NHmPK@98gU!T`sKJb3bQYQ_CAk#v()fg3$A1_ zTT#c2FLCRUjzV92U1kGPv%(XwS8v_6O!hXpl!}Rw#wDeAW$XVK|M`X-y>jyKZ5x}P zd#Vs|A%X5q*ZXT~6KqK96r4t_s1s%Oj0aS=eZ~S&T$98hnh6U~Ih=aT!HNoP)7=*2)8aRqqSUm(azkuk zw`DVe_Hni4ESdcwxwPq2K}0KPCzywQu=7$sUffZR`dDllmOOJr3smd9g}d=RI?F&~ zO*Y3@#}KWiM7Oo*8^*j7fDjPG@3@;Q5av2|se~nL{mHq=UhNRJW?~>lEt&gmcb%@h z&REW6==e$&t^_+?=*ZQu)?T4diDC-%hJg97d24TG$``yriRK<6M>l8H6fXG%@y#yr zw+$t3N-m)c@=dw41j=>{Gj~lW_pqfh+$$HKrk-I#<{u=r z{q*V6eoI$eg0X57VzSqX`3$6_}`Js?=i~f23ehgeF6q zKa)e+e+C#6EaK)7?7zlNQ2=kqqNLMDJ`O4vMiCfk^$0EahdV?c_ZGfFi7?<&gA^XV zLwLEmVK9S!vNio&ihAG@GAJ`Dh`1kcRsj%)_|5@uh<1eg(MHYylkl?0*2quY8Ts@% z+9?`$y5RyHJe^2o{?;E-sSZ;h94Ie#w*B%BVvRv+!qlzxJFQDt(=83UdBMEtKGu_O zHD8C9K}939fiP)pH1IY(4Xs0DHM#+jRmdGaoEY4?N4S?g$TZ|Jk~fka;q6W!k$>uX z?lv!K4lKES&@9;^ugq27vAtSSUckKRJ9eEAuO?bNN9Q5V_UD35tXjzX@<4_2$IEm& zBj;@lOVHqsUCYivD)N(ML#gHXrQq7a#RX@A;2X5GY-$h#SJ}-hf=o+XYsC6Bk^5em zRt9D>rP5_>1)LmCK9hC4nyPT-*ubB9?qTl@lsag~-D%WJsro!+Pp%qK|ACy6N;{5b z>2bbX)QgE~TU%>@CUC`<*gg8PK^uzHu~1b}N)v-o?dV4|vqozXy_qy~Liu!fc~GXx zLG;?Xc+;K14a!YF#+wR(H;)LUC+kNohcf}jK7La9ViOjG4faf_?v~T4iM5CF{0P!F zDb`)U$Y{|42B5sT*B-{Duv>^gQ^eY!+ht1gAgmC0uj>p6f#xpUT0J-;< z7#zrA#9=mQz6*9bH>h)o3MOP$08&1+z71v>l`lwFn7`u=OS$ zy`$6ReI1|a@#N=}G*8`^S(YV8(=5+~C8zk?w?L0V`sb^oMMOgvC|3CJ;&BZ6E(A0M z&moo?41}{}Z!QNyl{yn81=KCe^h72a zUW4@5K(Xj=Y&3$qu^@qu2JI5!kFG`-)?Ql9C>WX=u zR`$P=nccgUl6c(Ley=#EeG=FT z3B6FKZ`mA12hw9;V{bDc)p6(O?3t=FxM_%dg`&MW2r=C&GW>Z#1Q2(izI`)^$ zl6R=@)y22H{?YeCT@7V@!ogf59Xt)b8=J3H(>VK-^)+1XT0d~dD=*^=;g0}f8?#pc zIvI)c_24|$sS9jkAn%aB1XBH=VcE{kV-D|dJ+r*hSsp;@$Le?lR0M}L_SXf6@X;q# z?8<@K)3yqd$GiDb5wkX@#c6lyhOayIShngnKaIp)GvI>uGUQ-8j$H0l*0J}k&-en4 zDO&0yi)At0R+O5Ia~QB}vOjMMf+90pduR6v{~9wyLt#x#cdrCd={v;IybQREl^yT( z@(Mzt8u2Fh*aj$=TE$#snf!a!?V%)bYe-j9>6-Rp>Wq9DiCt@N^6GPv)5bfMMXeNT zf9dlUC?pa?cr{IV9jkPynYt^6(VE!N+JlmxH@v=QirKDhcMwp^#`9$MUKAW&9tx~= zY-97ZS!2hJxOX}eC0YmO-hQzjn+e^ndxbuCj(n`!-aT3ZrG!WQo1i3RXLCV!u`6&Q zp89e&6cH02!Rn(B3-pl}@HT7-Y*&m(WNuJg_=izh>(`O<}VU45f>YXV& z=Y;waXB1A>J*oAsC!ff>sec(qXuakJFCfc~SRUa`=8CViA zyX8H}6S%t-J+B}5i$N)}=>v)p3QNbi8fU{VoW}cSDQ(`G!E2_1ce1*Vq&`rUUkKlg zm{M-Shr(Rla}RQg_)psy+cHs~V(P^px&!JrAl#-skJ92LPYaG@?@1FcP;cT9i+Kt6 zrrv2ezozuIv-6f|PpXAch&lSd5WM@ekCis1ILo?Y+S*?gCq_Cd9dAob0yQc%CS%h@PEvpbay&t%$;Nz2ojK09}*wjA1$}cfFeYTEC*s|ex?s`AzoiZoJ z*`0rh`ye3NGBn93=gJ=GOw5Uw9YNg_L>8@mCZ|1D? z?&Apa^o?M?{@zLVP12D*XRKb8Kwa%}hHzjXL(fi-3TmKma zAD@rNN_>{(ZX&HMW$c%-ajVmfVl;~x?6SyiE()2CbUYa_$cdjVGR|3+cjU7_pKC=+7O>A}Ulqr~-VPLR zQy_T1SJ0B{yBDzk=_LyHvnGTk7Hzd%a3{$fE6Y10*Ul8F`JZw9KZ?e-G}4!JBeB&X zS(bDzv!2YD<`3}1YVqXaI0*>Ybm7EkDp)z2ok2Fer2aL$Sctx?2Lgvge)DSY|Iv>A zmu~^zJ(q+BQdMbypzvrt#L{&Kb|lErMYsqEA|tP>WI~Lqi!lp&Sh_1YMVvr}$v@d! zw8+!XXz+Z$cQ%5K9sA!*qW|3SK(r5c4nxEPKHFZP$>A_!zJL-x8n77B0h9Tr_jbCd z>zgq4np@5O2I<aJX)FTBtVAc0VtFfV?Mq9&X za;(fjJtr?C{sw893k9N>nAjV=qAK2bw_W`7s$ zeI(3RYAVlt91yLvYFPx@)Nqb0mfI}GbN?Z{#)|qe`drt zoJgBt6WZ@JPM1m{7FW$Ch6^hVTE|}b_@tq6TaT$-KbSosKQJT)U9>bIXZBSj^uxN5 z@|!<;;uP=pFXR68b{_|+a|Own?`Cb^`yxMvI;6MkaI~qHHvEE}dIr}QG-fmlHS!+4 zq06~lo*}E^c*!|B|B@HAb#LDSREff{$%AWTtN&aF)Q`~-6+@HXT0s881iXxVrl$|+ zh@_e`RmDzP-!6h4A`{I3WRW+|{kQJD4xO4k&^QrfVhX&rzg42)C--xcR(MIk0r79s zVqK|;Glzlk`l+_$l{rxSumBk>CsF@_?;U9POlm%tMzOKYAY>DFSn_bGCr7J4eIF2X z=6R&5tf2R%&ytpT<1hQ-2g%E;vK*}zm1u+|^L!uFw4_i;v^!kaDfG;=!;X~CbgfwA zOo=Fa3KK$#8;IQ#4W90;SUfHrc#6WGfTsR`3-*5=SS?;DXbP43-yo5&yMk0XNBDdR z)6r{7#0^Y?9=P2lxnx^`LMIbA?er1y)sqYJ{F1DJ&b`I1S;qO1FGGooL=a>AW%uXz z*9-vWPvAvw>Kf|gNl=}$*fyO{y>h8UN5400)<}mIcsBm2Jo1E%w9yQvu zp5MU07*XM4LPolSWBya+TVn9z#-M*NI*?3rl}Ya151b&}Nf@8hcKI=c&{g_Lg|lwM!vwMQGwz+|x8T7zQOjaz|YM7LX^@ z?)sM02O8iKB5sEc`Al8^?;!i%T^)Y$*+69iz~?*A22}$PU?p<30zGCjzu}Acn!C){ zf#Krdqr?Pi3xfoA95Xmbd2B%%1^g)U;K)qw`tr72CgejKL_&Z2u{s$ppLyja9_CuHFD~CvYF09vFHX?FXa5%?PGD_ z$-GuFpw!`j%tLL}qKFFr3h<39ZAOykK@0&C3ps@Ev>S^ErKB$WErsa@euKh9EGY80(oR$EkiDn3;Dq-92PT;^J z!{EP*3g@#pc*P*^gVaV|(dyO`M?KaE#aW$~2nKEzlS3RZpy#V<8@e|yEC znM2RLtX?+{{XGGRpJN;pINV+jGB&}#n5_Sd^16(;P!7YDb%>+@GAjEp9w_74m>b`QAeF5g z!3p;Dd5K`gu(fZ)*zu6r`<;Ruz4Qq&>Gv{YluM0qu(qEkR(SL6d$p~>E%0>`ygI=3 zmwj4WNnA0AGkAGgorO#ijY{_-GQ2o_1r6~xhhb^%a)T62?Tv}!%5X6UYo zSxtOk4K<(PGD(zojY|Z#?qy<92qp8HawGpS?g&Uu)R}qeF`rGawT=7sHdAHkR|c; z=Fqk*ZKE|ARW-<>@YkUtr;BCPlXxc<&|B{uUp@c*Y=BLS`lZiT8RbJ!kU%hNZ6{9q z(J@j~2yD#lvEdWyyL>OjLl)VXAW6s{LJeFJNl#9_@wV-ut@^WPr7NjD)}?8IYd_uI z>6-EeRsFe^#G81LD|szB+hUnDzx3!-$SoZwzhxxj1-O*wJL9dgbnIz{Cd#-iCy!AF z)SdY@zItT>3}6W)>T=tv@D&?q4b~5N#xraBU&AC{c5uZ<{(X+Zl(nVHtXGfmwU3Tb z4Zs{p7vYfh)}mh*f8elz6{pJbIp~Q(ER*4_m&j03XdGhIbO zM|JQjsVJ1W13b)Xo9|G7eV+}x%`JY?KIhJ$^f7x8$O8JbB;^<~<=zx}IiUD*>pkJCvlwDnrJmCSI)$2( z7G<^A!hA#_gn5+JFR%UWA#5UBKN$v7%S@dLvr7`%`z5dC0UA2qY2YPPjuN1sGWY^+ zR|7zE$|QAqVaY{W@3Q;0>SckAnExztTrNi@tRQR~Dc~>12m&hhcvnFu3M;r5a63+L z2U9%s9uWw6-f|6N85Sx3sJOTg5`eGw4Xd$~2U+aqTJtN7pU_pba$dq-hG4gNxBm5A z!!8k%IGt?R^CI@&x!#wb>BEORFwIGfb^tJ84ah6##&f1+fiIrV5JraAvHsEr8Wy`t z{i-m^JKAhQBs>|yt`Z<^m1$?(;U;XuLMj)}N&*1!0Dk-5m5%<|j4t(#tSyF3Mu2Le zr2I6JKhW_RI~K(P2X=LrpPbQ1o;3^Rsur1}jfBhuhV z>SDk;%j;k2<6%?sk?qR-FX`j|9W`^QrYad_Q+@^34wDjPAyoH(1A?hMJVvF`mo)=} z0jSRwcVP$pC}M3H4vMwzaj-HQ+U!1|e3wHc)P+eV?<1j`t* zoMh&?xyvopeE{<+u=!O)q{zjD=o##mLmQ`5Gfje`_uYC&zmqa?M1%vb{~>Hc4*SdM zmfMRd4giuUs@eaLA?kUmR)2aRVuOP5zc>GXzrfQdeXkyah3X!7sYwSQ?58R76$&Pg zyo#i+*SHwqJgoGfn}7Uz>48(<%F**eE%WaoHeiYfKOk#NRbNK{tcuT;*ho$*k&}u zg1yUY7eHNoDt!I`|8z0MHuT0)>dK@_^V`O=RTjEf|FnJo;=ddnnZZ7zBs?T0pazod zwDGOTXw|6^vWt5LCPMlZreWWnX3~Ni2Q{evUFy@lZWb`| zGini#nainqTb#)1ppHS=NojQERZVUo7lX9gv6vLILehT`>h~E=xF1+B4{z^Lva5=Thns~uy}*Q zIGUi3nY|k4d+l!@M~9?uHN0SaTf;=O_}5|zuORuaLJ;VB-lA4vU?LCa`z@q{)vq~F zn3Eaz1Oz5CM9b=%2_Ik14+8urDVg`F0@PR{$KztFpnIrjFGZUJ%sx2_s<6LBwS0Kn z0Btmr$N-KAR5FI*J0dZ7tV_YF3B3#v1qtaEs)JiK9>f3wUy83UaA2=2m5VKG$#7lR zpyn)AnDv`Do4NfYuXdQ&Ur~R~Q!mN=x1&s7rl}|_+2ifm*_nAwSQv^w--KBP$+grF z-hG+9@~se6%m79d5W`c3^WN3s3^*9xD_rAL+no0LHVysx`aSF8f`Gw#V=>f8INm|D z@wb8z7qXEE(VWuV+5}hd{HUkn%-NcF4>Pkw%^X|$XQ%rXqyvqO8;rCrXupop@BrE-Gv$(ao8d2~e`%^uKM7CLGjnq$ z$Bl`R!)|R?*7bJ+V4?;BW%P}HK0aF5F1rh8y-6Y|`6?+gSrL@uZc5~%2_5PWTM;ki z1^#>`N;WZuC5MKGF+e#ff28O^lB9+qOR7sQ2rRX`MAIw3QNweFx7m?IVM(+cua9$)!qWAG^i|*PUd&BJQ(|7g zIeaN!VADs$d^zx<2|{9vw}Av}7rxFH4Mww)5bb=1Y8yAAk>f2Youe?ptUW1?V% zKN2$IoU40FLQ@kLw&0e#JP)FE0KgdYVkP!D!kgi*u4vPM$=Fv?e;1cg{t`bY*CwsO z@z)*K=LGrj@L9r&R8*_+>Hf+h-h(ltFj5}#ftgRSJXR0m<&+I=SpLM5tq{Y zZ0Zi?Pngf3MTRGFFkvjw-KCoi9+Uwl$HL zty6wTrBI^b1!)8~kd96b+?}Z=?>jEpoyDNYN#I6D`e4WA5~o|y`C`m9U;F%7BI|uO zCpFTKPgnik)qF224&gkodw_obS?!B4#EB>Bb~WZMk*f&V_i&qugOP8G`y(JCqDj!w zT>G4E|By)W<-*F*v#l*pv%bmcE$1zfB@Y9}v%Mdw?xGjR#;R>`>FLEkO#Smk?5TYa zkWl~ohtC$WoTa{TEku(d=1wvt#l;Pa!L^MOKT5ewdj={khVY4qmNp+R*IQjZBqUn% zBhrsNcV2v-13s;82cwM-G&G_|CFm%TvBeP(|LeyK6`x#F5y^71eoAG&&PE9FM(szw zi;efb+Vq}5R8HcQzH{f!CZ_*XtxRTat`tYI$s*+IdP7U?4iJe9>TY)%-0E6)>ht~W zb`g*oh^Px)DU56J_9_cCpTykJ7uL|wxD-2tCW5;9;Gq7EsKgiInU$6IphY$eE_(O1 zw1|*JEKk^lA74<2oG#~}U%zg3(p8A_-}n2^?XMD07wT|yXL!AR`*zqmrgW_8>9^|1 zADfC`95L{Ayn+V^I`1up+P{Aq_?d~r?=s_4k#hoC(!vMf6ShdQQc}xFW*H-3e%5fp zm4Wl`0l^k;!a}0wvGws-`EnD&P+8kzeb1Ld-#rCrXzs=^sD6#5`lY?0oE>w;Hy?Gu zcDfiE>z2T6Qg)r>>2GasUv1R)(h(34C|=>Bkp9mvm@gIf)3Zty}p6 zL11l@>iqNgy#f%lGWgX);=6`E*80o;VC?{EmR$`IU)MU=swcCxl;)~{Nve+(cl_H! z#75Ocj7|&3^k@$)&=7 z`Bo-|U&}>`cBOgLdXFjQe@%-2Tpl$QLB3aJA|WBcDt=t#3`m0(3o)DZB6M^uuC_B` zQ2)!#r9ZkR(f?5DG01VboxdNAO-OhRju_?As}7Pkv66oc94BO4+?$=9wOMBOl=^)% zhF~;OZrAbf@FWX47cWg$xUz-mC0`uT$t94y3u2yIESdWaB}vZCS; zq&hrK>)O0fwZ-Nw81?h>Q=zr5cQwmbUJRH3EEEi$0RkEq2pDz08z0ol=0t-a!UEYai4tCse*1eZ!9 zz}M&LqUYbLSz~YO=&0pO#9ll3bOj|0tpDDrV8pnk;PR5Oq;?T{H9xl{v4ZFa z?{n8miLkIJN-9MU#p~C*S9A{Cr)=~r7mD-VACz_bb$;~TaqU4IC^l7BeIJNSOF9`d zj$pneIDzp!FXCT2Azc4eC4#&%)eZ07wh*_ep0P(|Mt)e9&fam%8{b$M89U^kP5f9z zs|y%1dubW7#v62U5zhv$Wv?x*tUSNQKV+%$j<~+q?`%p~%X95C?Dr>JfEGEtKO1Pv z)0rzv=_&=bj~}rf+BuKFG_KjG`o{gZ3E@e~F5mgjig7hA|NTf;D$~1neVr1cGcrm5 zQ^uRayCs&Kl2YW_cs6FesWxaJN9<=3ukF73%#I`PLDcxNKm~uy&AyXC%?CdJ_z3%)!_g8YJ^2hexRZrcjB~dRR zCmF2{Jz2EfV{#?^ZT|ZDz#_cSgk1;K#bm4a zhTR6q>6vc}BW!v#Oz$-r9XW5lw>NWK9aD$%K<&9gu!fSng2JwqQBi(=yS&oGkJ+lR zGBLZe58=N)j+x|NirF1vCc3@P*ZeL$Y2`~9h5z@Q?Mc64#WW?-oxNdr)-K(ok_5=_5{UNQBhIa^V#OBOFUN&?_a4(6>?U&fB$|K24&{*M&F{U z*mVfA-ki-lD!nC*w4UJ8UnTO`L zui_)Fh6+RY!myO^8aZ#)KO`!HT%@@h7Brz1{Zm5i1NxY#foPsc*e6I#n-Kw%&tz z^$)U4nLj@FnIF7e>&DQC3MA56uPX*Y$A)1qDklzv15>GXhdN zHg)03u3^t~gWmOCQ;Dl5C+rcgHtC+-pII|m?D@H+rJ&F?a@|AX_m4$H4u#u}I3pP& zNeLljA9jjaSP*Y|hXmnZUyo8sPvuts!taq2Tw@gvLbHtE5O0=Sx4wYHWb4 z_i*TBm}qI66|-=z|8Wn;cVSUcMZU}mf;jEq>o;4glkz90`$MWPvlRDfTA`;zcW@2| zB!JqUn40=)@4xyzMnFJfV}=v_CXb%RXgGyX;`3`wdL}1(hllSeC*J;~ zV>HzuiNY5kG5tpbN-YPm{}73!9lW4vKPeL;tsyNBDb&!3G-8FB)RS8 zq%K93;9#N*i!J>#2Ev9I=t>r)$%R@P#viln|GxOkOXdFKN=(E=%st80UXSJVRrs*Vsx^zNX z*576YGVGJ4)WdpHrWO{374|jC&o;*^I(`feoZI4=59NnFfBu~N3o8dzd`i*S*qCi? zn$@4*!p8u<#i`$TZCI+Xs|GYyzb-1LR6hO2%S*D`q&5xKP+dG|N-3>%^Wj3nHI7zT zQqrh@TxI4a45mJ5FG7cgv6FH?Uu}W+_H4j}DSG$t6=7-&Yf(W#-SI2e%(pY|c0ue8 zm<+3#m`VTNA{6)&`7(ZcJSmwy0*)*zk};EK%UIrO5QeO`OOpE%1%`$WKb`)W&UM{B zQr_ec06<}0NMfw}e=c%T8kng#+LIH)h$+LBoxK$K_?wf3UnB#PwP;lN5*qoWfX6l5__G5P8*x0D0B^JDTj?3JMt`=xu8RtXTWRCcF2|JsQV1bc=+ zsjZaTEzQmQX~lXYM~B}=pdI*ne|cOJ2M4FYB2xE{Re%6OvT#Nr2rBCv%s|Y3i=Ex6 zOW%H~+BO4LmD4$j#Bp$%Z&FlL765&U`kfn#pcGyJ8B)1W{Ga(V0+K!XDaHH zu)Dpzy(adV;Eyf-|C_^s#lWm)YqepaKp3z|ZTI_)F|e`!vP1K@|C|e)#+NUj`?h7i zz46mSt=x{jiPO7pFG&R+7=A_5G<4;&Ia%lC`W`Y`>n*-?rb}8(OiaLWhv(RG0I<#T zWxK`OpP>t$J#r15@x5f;+7%ZhgZCNCKOY_j%$#1K&tiT)KVN3HV(!<Tnk68bl&5R5T+qf7Qgh2{XK(upyUP)?RNqk6UL27ZV zUPW#Wx&hnEm%M)t)N~1GEH{egCqQH4i&Arn_4Pm`y2hoejMi`b&B(AIh@U|aMdKHs zQRVqXDf%h-$)&kK>#^C}o9>k~M~;EvNGv0R42t$E{}>_KA(kT>g4H2smL6GiOcv<+ zFh&L-g#=c~G9jCkmY-jemtT@v3~~=vqvErl_FC{UFkC&v$RLDd5Cg+%Yp79qrMXF| zMVWc&*gQ4=bgZMbBm;xLJ|hD^ihf})sQ%)T${dIb&;xW2gK(x8FwDJ~8PF`RPKIhm z@d3Ji`8;Ofn?Oqofx(X&AqP{S`jhi>LGb|&0Cer5ueHxs1FheJq5Whk69X_70*dkr ziuIH8i&9};*M%lT;94MtjL!1uprq-1u)&n$#{F&z6IBSmNT)V zC*wt#NV=0ti%arzVFn;uzbZ)ezA_sFL$?$IgD8siE3=`VFUd&FP1OgJhS-cSE>UT^ z1@ys2Ui9$)4-8Upf=&Zwr;x;?9C!#I`(dt%pl9f;IiO);<}xi%@`O!7}bQ-TBr%RsVSL> z`bC~8MuvI?dFh}ufb0fIC4&Wvfo`Y=CSKG?^a3Uea1dmqCZ?noVGY3FhePgp00XcC z7yzicrFWv}HpUkGugwl7gA&gfVE#kZJ#jaRZX;~E&;32ejoog>15n+d%#&J#)o!^- zuOx+885rDwnI6^d@eg-8+t>=*AjqnQXhHzW}5AGBEi|BS$*} z_gScJNI{4c^6#J~W;sCh~E iJk%gaI?BvVOizU-BvxSNV_=X1!s$R(;3i;3U;qG92yJ@+ literal 0 HcmV?d00001 diff --git a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.flat.json b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.flat.json new file mode 100644 index 0000000000..d637dcf5c6 --- /dev/null +++ b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.flat.json @@ -0,0 +1,3109 @@ +{ + "requirements": [ + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.1", + "section_name": "Архитектура кодировки и нейтрализации", + "req_id": "V1.1.1", + "req_description": "Убедитесь, что входные данные декодируются или деэкранируются в каноническую форму (в стандартное представление) только один раз. Декодирование происходит только тогда, когда ожидаются закодированные данные в этой форме, и что это делается перед дальнейшей обработкой входных данных, например, это не выполняется после проверки или нейтрализации.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.1", + "section_name": "Архитектура кодировки и нейтрализации", + "req_id": "V1.1.2", + "req_description": "Убедитесь, что приложение выполняет кодирование и экранирование выходных данных либо в качестве последнего шага перед использованием интерпретатором, для которого оно предназначено, либо самим интерпретатором.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.1", + "req_description": "Убедитесь, что выходная кодировка для ответа HTTP, документа HTML или документа XML соответствует требуемому контексту, например, кодировка соответствующих символов для элементов HTML, атрибутов HTML, комментариев HTML, CSS или полей заголовка HTTP делается таким способом, чтобы избежать изменения структуры сообщения или документа.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.2", + "req_description": "Убедитесь, что при динамическом построении URL-адресов недоверенные данные кодируются в соответствии с их контекстом (например, кодирование URL-адресов или кодирование base64url для query или path параметров или пути). Убедитесь, что разрешены только безопасные протоколы URL-адресов (например, запрещен javascript: или data:).", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.3", + "req_description": "Убедитесь, что при динамическом построении содержимого JavaScript (включая JSON) используется кодирование или экранирование выходных данных, чтобы избежать изменения структуры сообщения или документа (чтобы избежать JavaScript и JSON-инъекций).", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.4", + "req_description": "Убедитесь, что выборка данных (Redis, Memcached, чтение из файлов, обращение по API) или запросы к базе данных (например, SQL, HQL, NoSQL, Cypher) используют параметризованные запросы, ORM, Entity Frameworks или иным образом защищены от SQL-инъекций и других атак. Это также актуально при написании хранимых процедур.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.5", + "req_description": "Убедитесь, что приложение защищено от внедрения команд ОС и что вызовы операционной системы используют параметризованные запросы к ОС или используют контекстное кодирование вывода командной строки.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.6", + "req_description": "Убедитесь, что приложение защищено от LDAP-инъекций, или что реализованы специальные меры безопасности для их предотвращения.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.7", + "req_description": "Убедитесь, что приложение защищено от атак с использованием XPath-инъекций с помощью параметризации запросов или предварительно скомпилированных запросов.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.8", + "req_description": "Убедитесь, что процессоры LaTeX настроены безопасно (например, не используется флаг «–shell‑escape») и используется разрешенный список команд для предотвращения LaTeX-инъекций.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.9", + "req_description": "Убедитесь, что приложение экранирует специальные символы в регулярных выражениях (обычно с помощью обратной косой черты), чтобы предотвратить их ошибочную интерпретацию как метасимволов.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.10", + "req_description": "Убедитесь, что приложение защищено от внедрения формул CSV (CSV Injection). Приложение должно следовать правилам экранирования, определенным в RFC 4180, разделы 2.6 и 2.7, при экспорте содержимого CSV. Кроме того, при экспорте в CSV или другие форматы электронных таблиц (такие как XLS, XLSX или ODF) специальные символы (включая '=', '+', '-', '@', '\\t' (табуляция), и '\\0' (нулевой символ)) должны экранироваться одинарной кавычкой, если они появляются в качестве первого символа в значении поля.", + "L": "3" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.1", + "req_description": "Убедитесь, что все ненадежные входные данные HTML из редакторов WYSIWYG или аналогичных программ нейтрализуются с помощью известных и безопасных библиотек или функций фреймворка для санитизации HTML.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.2", + "req_description": "Убедитесь, что приложение избегает использования eval() или других динамических функций выполнения кода, таких как Spring Expression Language (SpEL). Если нет альтернативы, любой пользовательский ввод должен быть нейтрализован перед выполнением.", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.3", + "req_description": "Убедитесь, что данные, передаваемые в потенциально опасный контекст, предварительно нейтрализованы, чтобы обеспечить соблюдение мер безопасности, таких как разрешение только тех символов, которые безопасны для данного контекста, и обрезка слишком длинного ввода.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.4", + "req_description": "Убедитесь, что предоставленный пользователем файл .SVG проверен или нейтрализован, чтобы он содержал только теги и атрибуты (например, относящиеся к рисованию), которые безопасны для приложения, например, не содержат скриптов и foreignObject.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.5", + "req_description": "Убедитесь, что приложение нейтралует или отключает предоставленные пользователем скриптовые данные или выражения шаблонных языков, такие как таблицы стилей Markdown, CSS или XSL, BBCode или аналогичные.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.6", + "req_description": "Убедитесь, что приложение защищено от атак с подделкой запросов на стороне сервера (SSRF), проверяя ненадежные данные по разрешенному списку протоколов, доменов, путей и портов, а также нейтрализуя потенциально опасные символы перед использованием данных для вызова другой службы.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.7", + "req_description": "Убедитесь, что приложение защищено от атак с внедрением шаблонов (template injection), не позволяя создавать шаблоны на основе недоверенных входных данных. Если нет альтернативы, любые недоверенные входные данные, включаемые динамически во время создания шаблона, должны быть нейтрализованы или тщательно провалидированы.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.8", + "req_description": "Убедитесь, что приложение надлежащим образом нейтрализует недоверенные входные данные перед использованием в запросах Java Naming and Directory Interface (JNDI) и что JNDI настроен безопасно для предотвращения атак с использованием JNDI-инъекций.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.9", + "req_description": "Убедитесь, что приложение нейтрализует данные перед отправкой в Memcache, чтобы предотвратить атаки методом инъекций.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.10", + "req_description": "Убедитесь, что строки форматирования, которые могут быть использованы неожидаемым или вредоносным образом, нейтрализуются перед дальнейшим использованием.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.11", + "req_description": "Убедитесь, что приложение нейтрализует вводимые пользователем данные перед передачей в почтовые системы для защиты от SMTP или IMAP-инъекций.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.12", + "req_description": "Убедитесь, что регулярные выражения не содержат элементов, вызывающих экспоненциальный возврат, и убедитесь в нейтрализации недоверенных входных данных для предотвращения атак ReDoS или Runaway Regex.", + "L": "3" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.4", + "section_name": "Память, строки и неуправляемый код", + "req_id": "V1.4.1", + "req_description": "Убедитесь, что для обнаружения или предотвращения ситуаций переполнения стека, буфера или кучи приложение учитывает размер доступной области памяти при строковых операциях, копировании в память, в арифметике указателей и т.п.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.4", + "section_name": "Память, строки и неуправляемый код", + "req_id": "V1.4.2", + "req_description": "Убедитесь, что для предотвращения целочисленного переполнения применяется контроль знака, диапазона и типа допустимых входных данных.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.4", + "section_name": "Память, строки и неуправляемый код", + "req_id": "V1.4.3", + "req_description": "Убедитесь, что динамически выделенная память и ресурсы освобождены, а ссылки или указатели на освобожденную память удалены или установлены в значение null, чтобы предотвратить появление висячих указателей и уязвимостей, связанных с использованием памяти после освобождения.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.5", + "section_name": "Безопасная десериализация", + "req_id": "V1.5.1", + "req_description": "Убедитесь, что приложение настраивает XML-парсеры на использование строгой конфигурации и что небезопасные функции, такие как разрешение внешних сущностей, отключены для предотвращения атак XML eXternal Entity (XXE).", + "L": "1" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.5", + "section_name": "Безопасная десериализация", + "req_id": "V1.5.2", + "req_description": "Убедитесь, что десериализация недоверенных данных обеспечивает безопасную обработку ввода, например, используя список разрешенных типов объектов или ограничивая типы объектов, определяемые клиентом, для предотвращения атак десериализации. Механизмы десериализации, которые явно определены как небезопасные, не должны использоваться с недоверенным вводом.", + "L": "2" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.5", + "section_name": "Безопасная десериализация", + "req_id": "V1.5.3", + "req_description": "Убедитесь, что различные парсеры, используемые в приложении для одного и того же типа данных (например, парсеры JSON, XML, URL), выполняют парсинг согласованным образом и используют один и тот же механизм кодирования символов, чтобы избежать таких проблем, как уязвимости взаимодействия JSON (JSON Interoperability) или различное поведение анализа URI или файлов, которые могут использоваться в атаках удаленного включения файлов (RFI) или подделки запросов на стороне сервера (SSRF).", + "L": "3" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.1", + "section_name": "Документация валидации и бизнес-логики", + "req_id": "V2.1.1", + "req_description": "Убедитесь, что в документации приложения определены правила проверки входных данных на соответствие ожидаемой структуре. Это могут быть распространённые форматы данных, такие как номера кредитных карт, адреса электронной почты, номера телефонов, или внутренний формат данных.", + "L": "1" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.1", + "section_name": "Документация валидации и бизнес-логики", + "req_id": "V2.1.2", + "req_description": "Убедитесь, что в документации приложения указано, как проверять логическую и контекстную согласованность объединенных данных, например, проверять соответствие района и почтового индекса.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.1", + "section_name": "Документация валидации и бизнес-логики", + "req_id": "V2.1.3", + "req_description": "Убедитесь, что ожидания относительно ограничений и проверок бизнес-логики задокументированы как для уровня отдельного пользователя, так и для глобального уровня всего приложения.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.2", + "section_name": "Валидация ввода", + "req_id": "V2.2.1", + "req_description": "Убедитесь, что входные данные провалидированы для обеспечения соответствия бизнес- или функциональным ожиданиям. Валидация должна осуществляться либо по списку допустимых значений, шаблонов и диапазонов, либо путем сравнения входных данных с ожидаемой структурой и логическими ограничениями в соответствии с предопределенными правилами. Для L1 валидация может быть сосредоточена на входных данных, используемых для принятия конкретных бизнес-решений или решений, связанных с безопасностью. Для L2 и выше это должно применяться ко всем входным данным.", + "L": "1" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.2", + "section_name": "Валидация ввода", + "req_id": "V2.2.2", + "req_description": "Убедитесь, что приложение разработано с принудительной валидацией входных данных на уровне доверенного сервиса. Хотя проверка на стороне клиента повышает удобство использования и должна поощряться, на неё не следует полагаться как на средство контроля безопасности.", + "L": "1" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.2", + "section_name": "Валидация ввода", + "req_id": "V2.2.3", + "req_description": "Убедитесь, что приложение обеспечивает обоснованность комбинаций данных в соответствии с предопределенными правилам. Например: возраст должен соответствовать дате рождения; страна и почтовый индекс; количество товара в заказе и на складе.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.3", + "section_name": "Безопасность бизнес-логики", + "req_id": "V2.3.1", + "req_description": "Убедитесь, что приложение обрабатывает потоки бизнес-логики для одного и того же пользователя в ожидаемом последовательном порядке шагов и без пропуска шагов.", + "L": "1" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.3", + "section_name": "Безопасность бизнес-логики", + "req_id": "V2.3.2", + "req_description": "Убедитесь, что ограничения бизнес-логики реализованы в соответствии с документацией приложения, чтобы избежать эксплуатации её недостатков.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.3", + "section_name": "Безопасность бизнес-логики", + "req_id": "V2.3.3", + "req_description": "Убедитесь, что транзакции используются на уровне бизнес-логики таким образом, что операция бизнес-логики либо выполняется полностью, либо откатывается к предыдущему корректному состоянию.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.3", + "section_name": "Безопасность бизнес-логики", + "req_id": "V2.3.4", + "req_description": "Убедитесь, что на уровне бизнес-логики используются механизмы блокировки, чтобы гарантировать невозможность двойного бронирования ограниченных по количеству ресурсов (например, мест в театре или слотов доставки) путем манипулирования логикой приложения.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.3", + "section_name": "Безопасность бизнес-логики", + "req_id": "V2.3.5", + "req_description": "Убедитесь, что для важных потоков бизнес-логики требуется многопользовательское (multi-user) одобрение, чтобы предотвратить несанкционированные или случайные действия. Потоки бизнес-логики могут включать, помимо прочего, крупные денежные переводы, утверждение контрактов, доступ к секретной информации или обход ограничений безопасности на производстве.", + "L": "3" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.4", + "section_name": "Анти-автоматизация", + "req_id": "V2.4.1", + "req_description": "Убедитесь, что используются средства противодействия автоматизации для защиты от чрезмерных вызовов функций приложения, которые могут привести к утечке данных, созданию ненужных данных, исчерпанию квот, нарушению ограничений скорости, отказу в обслуживании или чрезмерному использованию дорогостоящих ресурсов.", + "L": "2" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.4", + "section_name": "Анти-автоматизация", + "req_id": "V2.4.2", + "req_description": "Убедитесь, что потоки бизнес-логики требуют реалистичного человеческого времени, предотвращая чрезмерно быструю отправку транзакций.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.1", + "section_name": "Документация по безопасности веб-интерфейса", + "req_id": "V3.1.1", + "req_description": "Убедитесь, что в документации приложения описаны ожидаемые функции безопасности, которые должны поддерживать браузеры, использующие приложение (такие как HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) и другие соответствующие механизмы безопасности HTTP). В документации также должно быть обязательно определено, как приложение должно себя вести, если некоторые из этих функций недоступны (например, предупреждать пользователя или блокировать доступ).", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.2", + "section_name": "Непреднамеренная интерпретация контента", + "req_id": "V3.2.1", + "req_description": "Убедитесь, что реализованы меры безопасности, предотвращающие отображение контента или функций браузерами в HTTP-ответах в некорректном контексте (например, запрос API, загруженный пользователем файл или другой ресурс запрашивается напрямую). Возможные способы контроля включают: не обрабатывать содержимое, если поля заголовка HTTP-запроса (например, Sec-Fetch-*) не указывают на корректность контекста; использование заголовка и значения Content-Security-Policy: sandbox directive; или использование заголовка и значения Content-Disposition: attachment.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.2", + "section_name": "Непреднамеренная интерпретация контента", + "req_id": "V3.2.2", + "req_description": "Убедитесь, что данные, предназначенные для отображения в виде текста, а не визуализации в виде HTML, обрабатывается с использованием безопасных функций визуализации (таких как createTextNode или textContent), чтобы предотвратить непреднамеренное выполнение содержимого, такого как HTML или JavaScript.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.2", + "section_name": "Непреднамеренная интерпретация контента", + "req_id": "V3.2.3", + "req_description": "Убедитесь, что приложение избегает затирания DOM при использовании JavaScript на стороне клиента, применяя явные объявления переменных, выполняя строгую проверку типов, избегая сохранения глобальных переменных в объекте документа и реализуя изоляцию пространства имен.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.3", + "section_name": "Настройка файлов cookie", + "req_id": "V3.3.1", + "req_description": "Убедитесь, что у файлов cookie установлен атрибут «Secure», и если префикс «__Host‑» не используется в названии cookie, необходимо использовать префикс «__Secure‑».", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.3", + "section_name": "Настройка файлов cookie", + "req_id": "V3.3.2", + "req_description": "Убедитесь, что значение атрибута SameSite каждой cookie установлено в соответствии с назначением cookie, чтобы ограничить подверженность атакам на восстановление пользовательского интерфейса и атакам с подделкой запросов на уровне браузера, обычно называемым подделкой межсайтовых запросов (CSRF).", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.3", + "section_name": "Настройка файлов cookie", + "req_id": "V3.3.3", + "req_description": "Убедитесь, что cookie имеют префикс «__Host‑» в названии, если только они явно не предназначены для совместного использования с другими хостами.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.3", + "section_name": "Настройка файлов cookie", + "req_id": "V3.3.4", + "req_description": "Убедитесь, что если значение cookie не должно быть доступно для клиентских скриптов (например, сессионный токен), для cookie должен быть установлен атрибут «HttpOnly», а само значение должно передаваться клиенту только через поле заголовка «Set-Cookie».", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.3", + "section_name": "Настройка файлов cookie", + "req_id": "V3.3.5", + "req_description": "Убедитесь, что при записи cookie приложением общая длина имени и значения cookie не превышает 4096 байт. Слишком большие cookie не будут сохраняться браузером и, следовательно, не будут отправляться с запросами, что помешает пользователю использовать функции приложения, зависящие от этого cookie.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.4", + "section_name": "Заголовки механизма безопасности браузера", + "req_id": "V3.4.1", + "req_description": "Убедитесь, что поле заголовка Strict‑Transport‑Security включено во все ответы для реализации политики HTTP Strict Transport Security (HSTS). Необходимо указать максимальное время не менее 1 года, а для L2 и выше политика должна применяться также ко всем поддоменам.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.4", + "section_name": "Заголовки механизма безопасности браузера", + "req_id": "V3.4.2", + "req_description": "Убедитесь, что поле заголовка Cross‑Origin Resource Sharing (CORS) «Access‑Control‑Allow‑Origin» имеет фиксированное значение, заданное приложением, или, если используется заголовок Origin, оно проверяется по списку доверенных источников. При необходимости использования «Access‑Control‑Allow‑Origin: *» убедитесь, что ответ не содержит конфиденциальной информации.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.4", + "section_name": "Заголовки механизма безопасности браузера", + "req_id": "V3.4.3", + "req_description": "Убедитесь, что HTTP-ответы содержат поле заголовка Content-Security-Policy, которое определяет директивы, гарантирующие загрузку и выполнение браузером только доверенного контента или ресурсов, чтобы ограничить выполнение вредоносного JavaScript. Как минимум, необходимо использовать глобальную политику, включающую директивы object-src «none» и base-uri «none», а также определяющую список разрешенных адресов или использующую одноразовые коды или хэши. Для приложений L3 необходимо определить политику использования 'nonce' или hash-конструкций для каждого ответа.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.4", + "section_name": "Заголовки механизма безопасности браузера", + "req_id": "V3.4.4", + "req_description": "Убедитесь, что все HTTP-ответы содержат поле заголовка «X‑Content‑Type‑Options: nosniff». Это предписывает браузерам не использовать анализ контента и определение типа MIME для данного ответа, а также требовать, чтобы значение поля заголовка Content‑Type в ответе соответствовало целевому ресурсу. Например, ответ на запрос стиля принимается только в том случае, если Content‑Type в ответе — «text/css». Это также позволяет браузеру использовать функцию Cross‑Origin Read Blocking (CORB).", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.4", + "section_name": "Заголовки механизма безопасности браузера", + "req_id": "V3.4.5", + "req_description": "Убедитесь, что приложение устанавливает политику реферера для предотвращения утечки технически конфиденциальных данных сторонним сервисам через поле заголовка HTTP-запроса «Referer». Это можно сделать с помощью поля заголовка HTTP-ответа «Referrer‑Policy» или через атрибуты HTML-элемента. Конфиденциальные данные могут включать путь и данные запроса в URL-адресе, а для внутренних непубличных приложений также имя хоста.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.4", + "section_name": "Заголовки механизма безопасности браузера", + "req_id": "V3.4.6", + "req_description": "Убедитесь, что веб-приложение использует директиву frame‑ancestors поля заголовка Content‑Security‑Policy для каждого HTTP-ответа, чтобы гарантировать невозможность его внедрения по умолчанию и внедрение определённых ресурсов разрешено только при необходимости. Обратите внимание, что поле заголовка X‑Frame‑Options, хотя и поддерживается браузерами, устарело и не может быть использовано в качестве основы.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.4", + "section_name": "Заголовки механизма безопасности браузера", + "req_id": "V3.4.7", + "req_description": "Убедитесь, что в поле заголовка Content‑Security‑Policy указано место, куда следует сообщать о нарушениях.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.4", + "section_name": "Заголовки механизма безопасности браузера", + "req_id": "V3.4.8", + "req_description": "Убедитесь, что все HTTP-ответы, инициирующие рендеринг документа (например, ответы с типом содержимого text/html), включают поле заголовка Cross-Origin-Opener-Policy с директивой same-origin или same-origin-allow-popups (при необходимости). Это предотвращает атаки, злоупотребляющие общим доступом к объектам Window, такие как Tabnabbing и Frame Counting.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.5", + "section_name": "Браузерное разделение источников", + "req_id": "V3.5.1", + "req_description": "Убедитесь, что, если приложение не использует механизм предварительной проверки CORS для предотвращения запрещённых кросс-доменных запросов на использование чувствительного функционала, эти запросы валидируются на предмет их происхождения от самого приложения. Это можно сделать, используя и проверяя специальные токены для защиты от подделки или требуя дополнительные поля HTTP-заголовка, не входящие в список «простых заголовков» (CORS-safelisted request-header). Это необходимо для защиты от атак с подделкой запросов через браузер, широко известных как межсайтовая подделка запросов (CSRF).", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.5", + "section_name": "Браузерное разделение источников", + "req_id": "V3.5.2", + "req_description": "Убедитесь, что если приложение использует механизм предварительной проверки CORS для предотвращения неразрешённого использования чувствительного функционала между источниками, вызов этого функционала невозможен с помощью запроса, который не запускает предварительную проверку CORS. Для этого может потребоваться проверка значений полей заголовка запроса «Origin» и «Content-Type» или использование дополнительного поля заголовка, не входящего в безопасный список CORS.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.5", + "section_name": "Браузерное разделение источников", + "req_id": "V3.5.3", + "req_description": "Убедитесь, что HTTP-запросы к чувствительному функционалу используют соответствующие HTTP-методы, такие как POST, PUT, PATCH или DELETE, а не методы, определённые спецификацией HTTP как «безопасные», такие как HEAD, OPTIONS или GET. В качестве альтернативы можно использовать строгую валидацию полей заголовка запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, навигационного запроса или загрузки ресурса (например, источника изображения), где это не ожидается.", + "L": "1" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.5", + "section_name": "Браузерное разделение источников", + "req_id": "V3.5.4", + "req_description": "Убедитесь, что отдельные приложения размещены на разных именах хостов, чтобы использовать ограничения, предусмотренные политикой same-origin, включая то, как документы или скрипты, загруженные одним источником, могут взаимодействовать с ресурсами из другого источника, а также ограничения на cookie на основе имени хоста.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.5", + "section_name": "Браузерное разделение источников", + "req_id": "V3.5.5", + "req_description": "Убедитесь, что сообщения, полученные интерфейсом postMessage, отвергаются, если источник сообщения не является доверенным или если синтаксис сообщения недействителен.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.5", + "section_name": "Браузерное разделение источников", + "req_id": "V3.5.6", + "req_description": "Убедитесь, что функциональность JSONP не включена нигде в приложении, чтобы избежать атак с использованием межсайтового включения скриптов (XSSI).", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.5", + "section_name": "Браузерное разделение источников", + "req_id": "V3.5.7", + "req_description": "Убедитесь, что данные, требующие авторизации, не включены в ответы ресурсов скриптов, таких как файлы JavaScript, чтобы предотвратить атаки с использованием межсайтового включения скриптов (XSSI).", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.5", + "section_name": "Браузерное разделение источников", + "req_id": "V3.5.8", + "req_description": "Убедитесь, что аутентифицированные ресурсы (такие как изображения, видео, скрипты и другие документы) могут быть загружены или внедрены от имени пользователя только по назначению. Этого можно добиться путём строгой валидации полей заголовка HTTP-запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, или путём установки ограничительного поля заголовка HTTP-ответа Cross‑Origin‑Resource‑Policy, чтобы браузер блокировал возвращаемый контент.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.6", + "section_name": "Целостность внешних ресурсов", + "req_id": "V3.6.1", + "req_description": "Убедитесь, что клиентские ресурсы, такие как библиотеки JavaScript, CSS или веб-шрифты, размещаются только на внешнем сервере (например, в сети доставки контента (Content Delivery Network)), если ресурс статический и имеет версии, а для проверки целостности ресурса используется механизм проверки целостности подресурсов (SRI). Если это невозможно, для каждого ресурса должно быть задокументировано решение по безопасности, обосновывающее это.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.7", + "section_name": "Другие соображения по безопасности браузера", + "req_id": "V3.7.1", + "req_description": "Убедитесь, что приложение использует только те клиентские технологии, которые по-прежнему поддерживаются и считаются безопасными. Примерами технологий, не соответствующих этому требованию, являются плагины NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL или клиентские Java-апплеты.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.7", + "section_name": "Другие соображения по безопасности браузера", + "req_id": "V3.7.2", + "req_description": "Убедитесь, что приложение будет автоматически перенаправлять пользователя на другое имя хоста или домен (который не контролируется приложением), только если этот хост или домен указаны в списке разрешенных.", + "L": "2" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.7", + "section_name": "Другие соображения по безопасности браузера", + "req_id": "V3.7.3", + "req_description": "Убедитесь, что приложение отображает уведомление, что пользователь перенаправляется на URL-адрес, находящийся вне контроля приложения, с возможностью отмены навигации.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.7", + "section_name": "Другие соображения по безопасности браузера", + "req_id": "V3.7.4", + "req_description": "Убедитесь, что домен верхнего уровня приложения (например, site.tld) ​​добавлен в публичный список предварительной загрузки (preload list) для HTTP Strict Transport Security (HSTS). Это гарантирует, что использование TLS для приложения будет встроено непосредственно в основные браузеры, а не будет полагаться только на поле заголовка ответа Strict-Transport-Security.", + "L": "3" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.7", + "section_name": "Другие соображения по безопасности браузера", + "req_id": "V3.7.5", + "req_description": "Убедитесь, что приложение ведет себя так, как описано в документации (например, предупреждает пользователя или блокирует доступ), если браузер, используемый для доступа к приложению, не поддерживает ожидаемые функции безопасности.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.1", + "section_name": "Общая безопасность веб-сервисов", + "req_id": "V4.1.1", + "req_description": "Убедитесь, что каждый HTTP-ответ с телом сообщения содержит заголовок Content-Type, который соответствует фактическому содержимому ответа, таким как «text/», «/+xml» и «/xml», включая параметр charset для указания безопасной кодировки символов (например, UTF-8, ISO-8859-1) согласно IANA Media Types.", + "L": "1" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.1", + "section_name": "Общая безопасность веб-сервисов", + "req_id": "V4.1.2", + "req_description": "Убедитесь, что только конечные точки, предназначенные для взаимодействия с пользователем через веб-браузер, автоматически перенаправляют HTTP на HTTPS, в то время как другие сервисы или конечные точки не реализуют прозрачные редиректы. Это необходимо, чтобы избежать ситуации, когда клиент ошибочно отправляет незашифрованные HTTP-запросы а из-за того, что запрос по HTTP автоматически перенаправляется на HTTPS другим сервисом без обработки на входе, утечка чувствительных данных остаётся незамеченной.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.1", + "section_name": "Общая безопасность веб-сервисов", + "req_id": "V4.1.3", + "req_description": "Убедитесь, что любой HTTP-заголовок, используемый приложением и устанавливаемый промежуточным уровнем, таким как балансировщик нагрузки, веб-прокси или backend-for-frontend сервис, не может быть переопределён конечным пользователем. Примеры заголовков: X-Real-IP, X-Forwarded-*, X-User-ID.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.1", + "section_name": "Общая безопасность веб-сервисов", + "req_id": "V4.1.4", + "req_description": "Убедитесь, что разрешены только HTTP-методы, которые явно поддерживаются приложением или его API (включая OPTIONS для preflight-запросов), а неиспользуемые методы заблокированы.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.1", + "section_name": "Общая безопасность веб-сервисов", + "req_id": "V4.1.5", + "req_description": "Убедитесь, что для особо чувствительных запросов или транзакций, проходящих через несколько систем, используются цифровые подписи на уровне сообщений, дополнительно к транспортным средствам защиты.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.2", + "section_name": "Валидация структуры HTTP-сообщений", + "req_id": "V4.2.1", + "req_description": "Убедитесь, что все компоненты приложения (включая балансировщики нагрузки, файрволы и серверы приложений) определяют границы входящих HTTP-сообщений с использованием механизма, соответствующего версии HTTP, чтобы предотвратить HTTP request smuggling. В HTTP/1.x, если присутствует заголовок Transfer-Encoding, заголовок Content-Length должен игнорироваться согласно RFC 2616. При использовании HTTP/2 или HTTP/3, если присутствует Content-Length, веб-сервер должен убедиться, что он совпадает с длиной DATA-фреймов.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.2", + "section_name": "Валидация структуры HTTP-сообщений", + "req_id": "V4.2.2", + "req_description": "Убедитесь, что при генерации HTTP-сообщений заголовок Content-Length не конфликтует с длиной содержимого, определяемой рамками протокола HTTP, чтобы предотвратить HTTP Request Smuggling.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.2", + "section_name": "Валидация структуры HTTP-сообщений", + "req_id": "V4.2.3", + "req_description": "Убедитесь, что приложение не отправляет и не принимает HTTP/2 и HTTP/3 сообщения с заголовками, специфичными для соединения, такими как Transfer-Encoding, чтобы предотвратить HTTP Response Splitting и HTTP Header Injection.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.2", + "section_name": "Валидация структуры HTTP-сообщений", + "req_id": "V4.2.4", + "req_description": "Убедитесь, что приложение принимает HTTP/2 и HTTP/3 запросы только в случае, если поля заголовков и их значения не содержат последовательностей CR (\\r), LF (\\n) или CRLF (\\r\\n), чтобы предотвратить HTTP Header Injection.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.2", + "section_name": "Валидация структуры HTTP-сообщений", + "req_id": "V4.2.5", + "req_description": "Убедитесь, что если приложение (бекенд или фронтенд) формирует и отправляет запросы, оно использует валидацию, очистку или другие механизмы, чтобы не создавать URI (например, для API-вызовов) или HTTP-заголовки (например, Authorization или Cookie) слишком большой длины, чтобы их не принимал приёмник. Это может привести к отказу в обслуживании, например, при отправке слишком длинного запроса (длинный cookie-заголовок), из-за чего сервер постоянно возвращает ошибку.", + "L": "3" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.3", + "section_name": "GraphQL", + "req_id": "V4.3.1", + "req_description": "Убедитесь, что используется белый список запросов, ограничение глубины вложенности, ограничение количества или анализ стоимости запроса, чтобы предотвратить DoS-атаки на уровне GraphQL или слоя данных из-за дорогостоящих вложенных запросов.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.3", + "section_name": "GraphQL", + "req_id": "V4.3.2", + "req_description": "Убедитесь, что introspection-запросы GraphQL отключены в продакшен-среде, если GraphQL API не предназначен для использования сторонними клиентами.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.1", + "req_description": "Убедитесь, что для всех WebSocket-соединений используется WebSocket поверх TLS (WSS).", + "L": "1" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.2", + "req_description": "Убедитесь, что при первоначальном HTTP WebSocket handshake заголовок Origin проверяется на соответствие списку разрешённых источников для приложения.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.3", + "req_description": "Убедитесь, что если стандартное управление сессиями приложения не может быть использовано, применяются специальные токены, соответствующие требованиям безопасности управления сессиями.", + "L": "2" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.4", + "req_description": "Убедитесь, что специальные токены управления сессиями WebSocket изначально получаются или валидируются через ранее аутентифицированную HTTPS-сессию при переходе от HTTPS к WebSocket.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.1", + "section_name": "Документация по работе с файлами", + "req_id": "V5.1.1", + "req_description": "Убедитесь, что документация определяет допустимые типы файлов, ожидаемые расширения и максимальный размер (включая распакованный размер) для каждой функции загрузки. Также убедитесь, что в документации указано, как файлы обезвреживаются для конечных пользователей (например, как приложение ведёт себя при обнаружении вредоносного файла).", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.2", + "section_name": "Загрузка файлов и содержимое", + "req_id": "V5.2.1", + "req_description": "Убедитесь, что приложение принимает только те файлы, которые может обработать без потери производительности или отказа в обслуживании.", + "L": "1" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.2", + "section_name": "Загрузка файлов и содержимое", + "req_id": "V5.2.2", + "req_description": "Убедитесь, что при загрузке файла (включая файлы внутри архивов, таких как ZIP) приложение проверяет, соответствует ли расширение ожидаемому, и валидирует, соответствует ли содержимое типу, указанному в расширении. Это включает проверку начальных 'magic bytes', перезапись изображений, использование специализированных библиотек. Для уровня 1 — достаточно проверок для файлов, критичных с точки зрения бизнеса или безопасности. Для уровней 2 и выше — для всех файлов.", + "L": "1" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.2", + "section_name": "Загрузка файлов и содержимое", + "req_id": "V5.2.3", + "req_description": "Убедитесь, что приложение проверяет архивы (например, zip, gz, docx, odt) на максимально допустимый распакованный размер и максимальное количество файлов до распаковки.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.2", + "section_name": "Загрузка файлов и содержимое", + "req_id": "V5.2.4", + "req_description": "Убедитесь, что для каждого пользователя установлены квоты на общий размер и количество файлов, чтобы один пользователь не мог переполнить хранилище.", + "L": "3" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.2", + "section_name": "Загрузка файлов и содержимое", + "req_id": "V5.2.5", + "req_description": "Убедитесь, что приложение не позволяет загружать архивы с символьными ссылками (symlinks), если это не требуется по бизнес-логике. Если требуется — разрешён только строго определённый список допустимых символьных ссылок.", + "L": "3" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.2", + "section_name": "Загрузка файлов и содержимое", + "req_id": "V5.2.6", + "req_description": "Убедитесь, что приложение отклоняет изображения с числом пикселей выше допустимого, чтобы предотвратить атаки 'pixel flood'.", + "L": "3" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.3", + "section_name": "Хранение файлов", + "req_id": "V5.3.1", + "req_description": "Убедитесь, что загруженные или сгенерированные из недоверенного ввода файлы, находящиеся в публичной директории, не исполняются как серверный код при обращении к ним по HTTP.", + "L": "1" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.3", + "section_name": "Хранение файлов", + "req_id": "V5.3.2", + "req_description": "Убедитесь, что при создании путей к файлам приложение использует внутренние или доверенные данные, а не пользовательские имена файлов. Если использование пользовательских имён или метаданных необходимо — требуется строгая проверка и очистка. Это защита от path traversal, LFI, RFI и SSRF.", + "L": "1" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.3", + "section_name": "Хранение файлов", + "req_id": "V5.3.3", + "req_description": "Убедитесь, что при обработке файлов на сервере (например, при распаковке) игнорируются пути, заданные пользователем, во избежание уязвимостей типа 'zip slip'.", + "L": "3" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.4", + "section_name": "Скачивание файлов", + "req_id": "V5.4.1", + "req_description": "Убедитесь, что приложение валидирует или игнорирует имена файлов, переданных пользователем (включая в JSON, JSONP или URL-параметре), и указывает имя файла в заголовке Content-Disposition при ответе.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.4", + "section_name": "Скачивание файлов", + "req_id": "V5.4.2", + "req_description": "Убедитесь, что имена файлов, передаваемые (например, в HTTP-заголовках или вложениях в email), кодируются или очищаются (например, по RFC 6266), чтобы сохранить структуру документа и предотвратить инъекции.", + "L": "2" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.4", + "section_name": "Скачивание файлов", + "req_id": "V5.4.3", + "req_description": "Убедитесь, что файлы, полученные из недоверенных источников, сканируются антивирусом, чтобы не распространять известное вредоносное содержимое.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.1", + "section_name": "Документация по аутентификации", + "req_id": "V6.1.1", + "req_description": "Убедитесь, что в документации приложения описано, как используются механизмы, такие как ограничение частоты запросов (rate limiting), защита от автоматизации и адаптивные реакции, для защиты от атак, таких как подстановка учётных данных и перебор паролей. Документация должна ясно описывать конфигурацию этих механизмов и предотвращение злонамеренной блокировки аккаунтов.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.1", + "section_name": "Документация по аутентификации", + "req_id": "V6.1.2", + "req_description": "Убедитесь, что задокументирован список контекстно-зависимых слов, запрещённых к использованию в паролях. В него могут входить производные от названий организаций, продуктов, идентификаторов систем, кодовых названий проектов, названий отделов или ролей и тому подобное.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.1", + "section_name": "Документация по аутентификации", + "req_id": "V6.1.3", + "req_description": "Убедитесь, что если приложение поддерживает несколько способов аутентификации, то все они документированы вместе с описанием применяемых средств защиты и уровнем стойкости аутентификации, которые должны быть одинаково применены ко всем способам.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.1", + "req_description": "Убедитесь, что пользовательские пароли содержат не менее 8 символов. Рекомендуется минимальная длина в 15 символов.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.2", + "req_description": "Убедитесь, что пользователи могут менять свои пароли.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.3", + "req_description": "Убедитесь, что для смены пароля требуется ввести как текущий, так и новый пароль.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.4", + "req_description": "Убедитесь, что при регистрации или смене пароля введённый пароль проверяется по списку как минимум из 3000 самых популярных паролей, соответствующих политике (например, минимальной длине).", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.5", + "req_description": "Убедитесь, что допускаются пароли любой структуры, без ограничений на использование определённых символов. Не должно быть требований по обязательному наличию заглавных/строчных букв, цифр или специальных символов.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.6", + "req_description": "Убедитесь, что поля ввода пароля используют type=password для скрытия символов. Разрешено временное отображение всего пароля или последнего введённого символа.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.7", + "req_description": "Убедитесь, что разрешены вставка (paste), использование менеджеров паролей браузера и внешних менеджеров паролей.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.8", + "req_description": "Убедитесь, что пароль проверяется строго в том виде, в котором он был введён пользователем — без обрезки, изменения регистра и других модификаций.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.9", + "req_description": "Убедитесь, что система позволяет использовать пароли длиной не менее 64 символов.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.10", + "req_description": "Убедитесь, что пароль остаётся действительным, пока не будет скомпрометирован или не будет изменён пользователем. Приложение не должно требовать регулярной смены пароля.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.11", + "req_description": "Убедитесь, что используется документированный список контекстно-зависимых слов (например, названия компаний, проектов и т.д.) для предотвращения использования легко угадываемых паролей.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.12", + "req_description": "Убедитесь, что при регистрации или смене пароля проверяется, не входит ли он в список скомпрометированных (утёкших) паролей.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.3", + "section_name": "Общие требования к безопасности аутентификации", + "req_id": "V6.3.1", + "req_description": "Убедитесь, что реализованы меры защиты от атак типа credential stuffing (массовая подстановка учётных данных) и brute-force (перебор паролей), согласно документации по безопасности приложения.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.3", + "section_name": "Общие требования к безопасности аутентификации", + "req_id": "V6.3.2", + "req_description": "Убедитесь, что в приложении отсутствуют или отключены учётные записи по умолчанию (например, root, admin, sa).", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.3", + "section_name": "Общие требования к безопасности аутентификации", + "req_id": "V6.3.3", + "req_description": "Убедитесь, что для доступа к приложению используется либо механизм многофакторной аутентификации, либо комбинация однофакторных. Для уровня L3 один из факторов должен быть аппаратным, обеспечивающим защиту от фишинга, устойчивость к компрометации и подтверждение намерения аутентификации через явное действие пользователя (например, нажатие кнопки на FIDO-ключе или телефоне). Ослабление этих требований допускается только при наличии обоснования и компенсирующих мер.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.3", + "section_name": "Общие требования к безопасности аутентификации", + "req_id": "V6.3.4", + "req_description": "Убедитесь, что при наличии нескольких способов аутентификации, они все задокументированы, и для них единообразно применяются меры защиты и уровни доверия.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.3", + "section_name": "Общие требования к безопасности аутентификации", + "req_id": "V6.3.5", + "req_description": "Убедитесь, что пользователи получают уведомления о подозрительных попытках аутентификации (удачных и неудачных). Это может включать попытки (например, подключения) с необычного устройства или места, частично успешную MFA, попытку после долгого отсутствия или успешную аутентификацию после серии неудачных.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.3", + "section_name": "Общие требования к безопасности аутентификации", + "req_id": "V6.3.6", + "req_description": "Убедитесь, что email не используется ни как однофакторный, ни как многофакторный механизм аутентификации.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.3", + "section_name": "Общие требования к безопасности аутентификации", + "req_id": "V6.3.7", + "req_description": "Убедитесь, что пользователи получают уведомление при изменении данных аутентификации, таких как сброс пароля или изменение логина/email.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.3", + "section_name": "Общие требования к безопасности аутентификации", + "req_id": "V6.3.8", + "req_description": "Убедитесь, что из сообщений об ошибке, HTTP-кодов ответа или различий во времени ответа нельзя определить, существует ли пользователь с таким логином. Это правило также должно применяться к функциям регистрации и восстановления пароля.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.4", + "section_name": "Жизненный цикл и восстановление факторов аутентификации", + "req_id": "V6.4.1", + "req_description": "Убедитесь, что начальные пароли или коды активации, генерируемые системой, создаются с использованием надёжного генератора случайных чисел, соответствуют текущей политике паролей и истекают через короткий период времени либо после первого использования. Эти секреты не должны использоваться как постоянные пароли.", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.4", + "section_name": "Жизненный цикл и восстановление факторов аутентификации", + "req_id": "V6.4.2", + "req_description": "Убедитесь, что в системе отсутствуют подсказки к паролю или вопросы на знание («секретные вопросы»).", + "L": "1" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.4", + "section_name": "Жизненный цикл и восстановление факторов аутентификации", + "req_id": "V6.4.3", + "req_description": "Убедитесь, что реализован безопасный процесс сброса забытого пароля, который не обходит активные механизмы многофакторной аутентификации.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.4", + "section_name": "Жизненный цикл и восстановление факторов аутентификации", + "req_id": "V6.4.4", + "req_description": "Убедитесь, что в случае утраты одного из факторов MFA проводится удостоверение личности (identity proofing) на том же уровне, что и при первичной регистрации.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.4", + "section_name": "Жизненный цикл и восстановление факторов аутентификации", + "req_id": "V6.4.5", + "req_description": "Убедитесь, что инструкции по обновлению истекающих механизмов аутентификации отправляются заранее, с достаточным запасом времени для выполнения замены, при необходимости с настройкой автоматических напоминаний.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.4", + "section_name": "Жизненный цикл и восстановление факторов аутентификации", + "req_id": "V6.4.6", + "req_description": "Убедитесь, что администраторы могут инициировать процесс сброса пароля, но не могут задать или выбрать новый пароль за пользователя. Это исключает ситуацию, при которой администратор знает пароль пользователя.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.5", + "section_name": "Общие требования к многофакторной аутентификации", + "req_id": "V6.5.1", + "req_description": "Убедитесь, что lookup-секреты, внеполосные коды/запросы и TOTP-коды можно использовать только один раз.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.5", + "section_name": "Общие требования к многофакторной аутентификации", + "req_id": "V6.5.2", + "req_description": "Убедитесь, что при хранении lookup-секретов с энтропией менее 112 бит (например, 19 случайных буквенно-цифровых символов или 34 случайные цифры) они хэшируются с использованием разрешённого алгоритма хеширования паролей и случайной соли минимум 32 бита. Если у секрета ≥112 бит энтропии — допустимо использовать стандартный хэш.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.5", + "section_name": "Общие требования к многофакторной аутентификации", + "req_id": "V6.5.3", + "req_description": "Убедитесь, что lookup-секреты, коды внеполосной аутентификации и сиды для TOTP генерируются с использованием криптографически стойкого генератора случайных чисел (CSPRNG), чтобы избежать предсказуемых значений.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.5", + "section_name": "Общие требования к многофакторной аутентификации", + "req_id": "V6.5.4", + "req_description": "Убедитесь, что lookup-секреты и внеполосные коды аутентификации имеют минимум 20 бит энтропии (достаточно, например, 4 случайных алфавитно-цифровых символов или 6 случайных цифр).", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.5", + "section_name": "Общие требования к многофакторной аутентификации", + "req_id": "V6.5.5", + "req_description": "Убедитесь, что все внеполосные запросы, коды и токены, а также TOTP-коды имеют ограниченный срок действия. Максимум для out-of-band — 10 минут, для TOTP — 30 секунд.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.5", + "section_name": "Общие требования к многофакторной аутентификации", + "req_id": "V6.5.6", + "req_description": "Убедитесь, что любой фактор аутентификации (включая физические устройства) может быть отозван в случае кражи или утери.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.5", + "section_name": "Общие требования к многофакторной аутентификации", + "req_id": "V6.5.7", + "req_description": "Убедитесь, что биометрические механизмы аутентификации используются только как вторичный фактор — в сочетании с «чем-то, что вы знаете» или «чем-то, что у вас есть».", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.5", + "section_name": "Общие требования к многофакторной аутентификации", + "req_id": "V6.5.8", + "req_description": "Убедитесь, что TOTP-коды проверяются по источнику времени, полученному от доверенного сервиса, а не от клиента или недоверенного источника.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.6", + "section_name": "Внеполосные механизмы аутентификации", + "req_id": "V6.6.1", + "req_description": "Убедитесь, что механизмы аутентификации через телефонную сеть общего пользования (PSTN) для доставки одноразовых паролей (OTP) по телефону или SMS используются только в случае предварительной валидации номера, при этом предлагаются альтернативные более безопасные методы (например, TOTP), и пользователю сообщаются риски. Для приложений уровня L3 использование телефона и SMS недопустимо.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.6", + "section_name": "Внеполосные механизмы аутентификации", + "req_id": "V6.6.2", + "req_description": "Убедитесь, что внеполосные запросы, коды или токены привязаны к исходному запросу аутентификации, для которого они были сгенерированы, и не могут быть использованы повторно для других попыток.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.6", + "section_name": "Внеполосные механизмы аутентификации", + "req_id": "V6.6.3", + "req_description": "Убедитесь, что внеполосные механизмы на основе кода защищены от атак методом подбора (brute force) путём применения ограничения частоты запросов (rate limiting). Также рекомендуется использовать коды с энтропией не менее 64 бит.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.6", + "section_name": "Внеполосные механизмы аутентификации", + "req_id": "V6.6.4", + "req_description": "Убедитесь, что при использовании push-уведомлений для MFA применяется ограничение частоты (rate limiting), чтобы предотвратить атаки push-бомбинга. Также может помочь механизм сопоставления номеров (number matching).", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.7", + "section_name": "Криптографические механизмы аутентификации", + "req_id": "V6.7.1", + "req_description": "Убедитесь, что сертификаты, используемые для проверки криптографических утверждений об аутентификации, хранятся таким образом, чтобы исключить возможность их модификации.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.7", + "section_name": "Криптографические механизмы аутентификации", + "req_id": "V6.7.2", + "req_description": "Убедитесь, что nonce (случайная строка), используемая в процессе вызова, имеет длину не менее 64 бит и является статистически уникальной или уникальной на протяжении всего срока службы криптографического устройства.", + "L": "3" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.8", + "section_name": "Аутентификация с использованием провайдера идентификаций (IdP)", + "req_id": "V6.8.1", + "req_description": "Убедитесь, что при поддержке несколькими IdP, невозможно подделать личность пользователя через другой IdP (например, с тем же user ID). Стандартным способом защиты является регистрация пользователя с использованием сочетания ID самого IdP (в качестве пространства имён) и пользовательского ID внутри IdP.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.8", + "section_name": "Аутентификация с использованием провайдера идентификаций (IdP)", + "req_id": "V6.8.2", + "req_description": "Убедитесь, что наличие и целостность цифровой подписи в утверждениях аутентификации (например, в JWT или SAML) всегда проверяются, а неподписанные или недействительные утверждения отклоняются.", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.8", + "section_name": "Аутентификация с использованием провайдера идентификаций (IdP)", + "req_id": "V6.8.3", + "req_description": "Убедитесь, что SAML-утверждения обрабатываются только один раз в течение периода их действия, чтобы исключить атаки воспроизведения (replay attacks).", + "L": "2" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.8", + "section_name": "Аутентификация с использованием провайдера идентификаций (IdP)", + "req_id": "V6.8.4", + "req_description": "Убедитесь, что если приложение использует внешний поставщик идентификации (IdP) и для определенных функций требуется особый уровень, метод или срок действия аутентификации, то приложение использует данные, возвращаемые IdP, для проверки этих условий. Например, при использовании OIDC можно проверить значения полей ID Token — acr, amr, auth_time (если они есть). Если IdP не предоставляет эти данные, приложение должно иметь документированный план действий по умолчанию, предполагающий использование минимально допустимой силы аутентификации (например, одноступенчатая — логин и пароль).", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.1", + "section_name": "Документация по управлению сессиями", + "req_id": "V7.1.1", + "req_description": "Убедитесь, что тайм-аут бездействия и абсолютное максимальное время жизни сессии задокументированы, соответствуют другим контрольным мерам и сопровождаются обоснованием любых отклонений от требований повторной аутентификации NIST SP 800-63B.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.1", + "section_name": "Документация по управлению сессиями", + "req_id": "V7.1.2", + "req_description": "Убедитесь, что документация определяет допустимое количество одновременных (параллельных) сессий для одного аккаунта, а также поведение системы и действия при достижении этого лимита.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.1", + "section_name": "Документация по управлению сессиями", + "req_id": "V7.1.3", + "req_description": "Убедитесь, что все системы, создающие и управляющие сессиями пользователей в рамках федеративной идентификации (например, SSO), задокументированы вместе с механизмами координации сроков действия сессий, условий завершения и случаев, требующих повторной аутентификации.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.2", + "section_name": "Базовая безопасность сессий", + "req_id": "V7.2.1", + "req_description": "Убедитесь, что все проверки сессионных токенов выполняются на доверенной серверной стороне.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.2", + "section_name": "Базовая безопасность сессий", + "req_id": "V7.2.2", + "req_description": "Убедитесь, что приложение использует либо автономные токены, либо ссылочные токены, которые генерируются динамически, не используя статические API-секреты или ключи.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.2", + "section_name": "Базовая безопасность сессий", + "req_id": "V7.2.3", + "req_description": "Убедитесь, что ссылочные токены являются уникальными, создаются с использованием криптографически безопасного генератора псевдослучайных чисел (CSPRNG) и обладают энтропией не менее 128 бит.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.2", + "section_name": "Базовая безопасность сессий", + "req_id": "V7.2.4", + "req_description": "Убедитесь, что при аутентификации пользователя (включая повторную) создается новый токен сессии, а текущий — аннулируется.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.3", + "section_name": "Тайм-ауты сессии", + "req_id": "V7.3.1", + "req_description": "Убедитесь, что есть тайм-аут бездействия, после которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.3", + "section_name": "Тайм-ауты сессии", + "req_id": "V7.3.2", + "req_description": "Убедитесь, что установлено абсолютное максимальное время жизни сессии, по истечении которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.4", + "section_name": "Завершение сессий", + "req_id": "V7.4.1", + "req_description": "Убедитесь, что после завершения сессии (logout, истечение срока) дальнейшее её использование невозможно. Для ссылочных токенов или сессий с сохранением состояния это означает аннулирование на сервере. Для self-contained токенов необходимо реализовать механизм отзыва, например, список отозванных токенов, проверку времени выпуска или ротацию ключей подписи для каждого пользователя.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.4", + "section_name": "Завершение сессий", + "req_id": "V7.4.2", + "req_description": "Убедитесь, что при удалении или отключении пользователя все активные сессии немедленно завершаются.", + "L": "1" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.4", + "section_name": "Завершение сессий", + "req_id": "V7.4.3", + "req_description": "Убедитесь, что после изменения или удаления факторов аутентификации (например, смена пароля или MFA) приложение предлагает завершить все другие активные сессии.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.4", + "section_name": "Завершение сессий", + "req_id": "V7.4.4", + "req_description": "Убедитесь, что на всех страницах, требующих аутентификации, имеется простой и видимый способ выхода.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.4", + "section_name": "Завершение сессий", + "req_id": "V7.4.5", + "req_description": "Убедитесь, что администраторы могут завершать активные сессии конкретного пользователя или всех пользователей.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.5", + "section_name": "Защита от злоупотреблений сессией", + "req_id": "V7.5.1", + "req_description": "Убедитесь, что приложение требует полной повторной аутентификации перед изменением чувствительных атрибутов аккаунта, которые могут влиять на аутентификацию (например, email, номер телефона, настройки MFA или данных восстановления доступа).", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.5", + "section_name": "Защита от злоупотреблений сессией", + "req_id": "V7.5.2", + "req_description": "Убедитесь, что пользователь может просматривать и (после повторной аутентификации хотя бы по одному фактору) завершать активные сессии.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.5", + "section_name": "Защита от злоупотреблений сессией", + "req_id": "V7.5.3", + "req_description": "Убедитесь, что перед выполнением критически важных операций приложение требует повторной аутентификации (по крайней мере, одного фактора) или дополнительной проверки.", + "L": "3" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.6", + "section_name": "Федеративная повторная аутентификация", + "req_id": "V7.6.1", + "req_description": "Убедитесь, что срок действия и завершение сессий между RP и IdP соответствуют документации и включают повторную аутентификацию, если достигнут максимальный допустимый интервал между событиями аутентификации.", + "L": "2" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.6", + "section_name": "Федеративная повторная аутентификация", + "req_id": "V7.6.2", + "req_description": "Убедитесь, что создание сессии требует согласия пользователя или явного действия, предотвращающего несанкционированное создание сессий без участия пользователя.", + "L": "2" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.1", + "section_name": "Документация по авторизации", + "req_id": "V8.1.1", + "req_description": "Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне функций и на уровне данных на основе прав субъекта и атрибутов ресурса.", + "L": "1" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.1", + "section_name": "Документация по авторизации", + "req_id": "V8.1.2", + "req_description": "Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне полей (как на чтение, так и на запись) на основе прав субъекта и атрибутов ресурса. Эти правила могут зависеть от других атрибутов объекта данных, например, статуса.", + "L": "2" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.1", + "section_name": "Документация по авторизации", + "req_id": "V8.1.3", + "req_description": "Убедитесь, что документация определяет, какие атрибуты окружения и контекста (например, время суток, IP-адрес, местоположение, устройство) используются приложением для принятия решений в области аутентификации и авторизации.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.1", + "section_name": "Документация по авторизации", + "req_id": "V8.1.4", + "req_description": "Убедитесь, что документация по аутентификации и авторизации определяет, как используются факторы окружения и контекста в принятии решений, наряду с правилами доступа к функциям, данным и полям. Документация должна содержать оцениваемые атрибуты, пороговые значения риска, действия (разрешить, отказать, повысить уровень аутентификации и др.).", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.2", + "section_name": "Архитектура авторизации", + "req_id": "V8.2.1", + "req_description": "Убедитесь, что приложение обеспечивает доступ на уровне функций (function-level) только субъектам с явными разрешениями.", + "L": "1" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.2", + "section_name": "Архитектура авторизации", + "req_id": "V8.2.2", + "req_description": "Убедитесь, что приложение обеспечивает доступ на уровне данных (data-specific) только тем субъектам, которым явно предоставлены права к определённым элементам данных, чтобы предотвратить IDOR (Insecure Direct Object Reference) и BOLA-уязвимости (Broken Object Level Authorization).", + "L": "1" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.2", + "section_name": "Архитектура авторизации", + "req_id": "V8.2.3", + "req_description": "Убедитесь, что приложение обеспечивает доступ на уровне полей (field-level) только тем субъектам, которым явно предоставлены права к определённым полям, чтобы предотвратить BOPLA (Broken Object Property Level Authorization).", + "L": "2" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.2", + "section_name": "Архитектура авторизации", + "req_id": "V8.2.4", + "req_description": "Убедитесь, что реализованы адаптивные меры безопасности, основанные на атрибутах окружения и контекста субъекта (время, местоположение, IP, устройство), которые используются для принятия решений об аутентификации и авторизации, как это определено в документации приложения. Эти меры должны применяться как при попытке субъекта начать новую сессию, так и во время существующей сессии.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.3", + "section_name": "Авторизация на уровне операций", + "req_id": "V8.3.1", + "req_description": "Убедитесь, что правила авторизации реализуются на доверенном сервисном уровне и не зависят от элементов, которые может контролировать клиент (например, JavaScript на стороне клиента).", + "L": "1" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.3", + "section_name": "Авторизация на уровне операций", + "req_id": "V8.3.2", + "req_description": "Убедитесь, что изменения значений, влияющих на авторизацию, применяются немедленно. Если это невозможно (например, при использовании автономных токенов), должны быть реализованы компенсирующие меры: оповещения о попытке несанкционированного действия и откат изменений. Обратите внимание, что данный подход не предотвращает утечку информации.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.3", + "section_name": "Авторизация на уровне операций", + "req_id": "V8.3.3", + "req_description": "Убедитесь, что доступ к объекту осуществляется на основе прав субъекта, инициировавшего запрос, а не прав промежуточного сервиса, действующего от его имени. Например, если пользователь обращается к веб-сервису с автономным токеном для аутентификации, а сервис затем запрашивает данные у другого сервиса, второй сервис должен использовать токен пользователя, а не токен первого сервиса для принятия решения о доступе.", + "L": "3" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.4", + "section_name": "Прочие аспекты авторизации", + "req_id": "V8.4.1", + "req_description": "Убедитесь, что в мультитенантных приложениях реализованы механизмы, предотвращающие действия потребителя в отношении арендаторов, к которым у него нет доступа.", + "L": "2" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.4", + "section_name": "Прочие аспекты авторизации", + "req_id": "V8.4.2", + "req_description": "Убедитесь, что доступ к административным интерфейсам защищён несколькими уровнями контроля, включая непрерывную проверку личности, контроль защищённости устройства и анализ контекстных рисков. Недостаточно опираться только на IP-адрес или доверенные устройства.", + "L": "3" + }, + { + "chapter_id": "V9", + "chapter_name": "Автономные токены", + "section_id": "V9.1", + "section_name": "Источник токена и его целостность", + "req_id": "V9.1.1", + "req_description": "Убедитесь, что автономные токены проверяются на целостность с помощью цифровой подписи или MAC, прежде чем доверять их содержимому.", + "L": "1" + }, + { + "chapter_id": "V9", + "chapter_name": "Автономные токены", + "section_id": "V9.1", + "section_name": "Источник токена и его целостность", + "req_id": "V9.1.2", + "req_description": "Проверяйте, что автономные токены создаются и проверяются исключительно с помощью алгоритмов из списка допустимых в данном контексте. Список допустимых алгоритмов должен включать только разрешенные алгоритмы (желательно либо только симметричные, либо только асимметричные) и ни в коем случае не содержать алгоритм None. Если необходимо поддерживать оба типа алгоритмов, потребуются дополнительные средства контроля для предотвращения путаницы с ключами (key confusion).", + "L": "1" + }, + { + "chapter_id": "V9", + "chapter_name": "Автономные токены", + "section_id": "V9.1", + "section_name": "Источник токена и его целостность", + "req_id": "V9.1.3", + "req_description": "Убедитесь, что ключи, используемые для проверки автономных токенов, получены из доверенных, предварительно настроенных источников. Это предотвращает возможность указания злоумышленниками ненадёжных источников и ключей. Для JWT и других JWS структур заголовки 'jku', 'x5u' и 'jwk' должны проверяться по белому списку.", + "L": "1" + }, + { + "chapter_id": "V9", + "chapter_name": "Автономные токены", + "section_id": "V9.2", + "section_name": "Содержимое токена", + "req_id": "V9.2.1", + "req_description": "Убедитесь, что при указанном сроке действия токен и его содержимое принимаются только в том случае, если срок действия токена не истёк. Например, для JWT нужно проверить поля 'nbf' и 'exp'.", + "L": "1" + }, + { + "chapter_id": "V9", + "chapter_name": "Автономные токены", + "section_id": "V9.2", + "section_name": "Содержимое токена", + "req_id": "V9.2.2", + "req_description": "Убедитесь, что сервис, принимающий токен, проверяет его тип и соответствие назначению перед обработкой содержимого токена. Например, для принятия решений об авторизации могут быть приняты только Access Token, а для подтверждения аутентификации пользователя — только ID Token.", + "L": "2" + }, + { + "chapter_id": "V9", + "chapter_name": "Автономные токены", + "section_id": "V9.2", + "section_name": "Содержимое токена", + "req_id": "V9.2.3", + "req_description": "Убедитесь, что сервис принимает только токены, предназначенные для использования с этим сервисом (audience). Для JWT это можно сделать, проверив наличие утверждения «aud» по белому списку, определенному в сервисе.", + "L": "2" + }, + { + "chapter_id": "V9", + "chapter_name": "Автономные токены", + "section_id": "V9.2", + "section_name": "Содержимое токена", + "req_id": "V9.2.4", + "req_description": "Убедитесь, что, если эмитент токенов использует один и тот же закрытый ключ для выпуска токенов различным сервисам (audiences), выпущенные токены содержат явное указание целевых сервисов. Это предотвратит повторное использования токенов в не предназначенных для них сервисах. Если идентификатор сервиса (audience identifier) назначается динамически, эмитент токенов должен проверить audiences для исключения подмены получателей (audience impersonation).", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.1", + "section_name": "Общие требования безопасности OAuth и OIDC", + "req_id": "V10.1.1", + "req_description": "Убедитесь, что токены передаются только тем компонентам, которым они действительно необходимы. Например, при использовании схемы backend-for-frontend для браузерных JavaScript-приложений, access и refresh токены должны быть доступны только на backend.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.1", + "section_name": "Общие требования безопасности OAuth и OIDC", + "req_id": "V10.1.2", + "req_description": "Убедитесь, что клиент принимает значения от авторизационного сервера (например, authorization code или ID Token) только если они получены в результате авторизационного потока, инициированного в той же сессии пользовательского агента и в рамках той же транзакции. Для этого клиентские секреты, такие как proof key для code exchange (PKCE) — 'code_verifier', 'state' или OIDC 'nonce' — должны быть непредсказуемыми, специфичными для транзакции и надежно привязанными как к клиенту, так и к сессии пользовательского агента, в которой началась транзакция.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.2", + "section_name": "Клиент OAuth", + "req_id": "V10.2.1", + "req_description": "Убедитесь, что если используется механизм authorization code flow, OAuth клиент защищён от CSRF, вызывающих запросы токенов либо за счёт использования механизма proof key for code exchange (PKCE), либо за счёт проверки параметра 'state', который был отправлен в запросе авторизации.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.2", + "section_name": "Клиент OAuth", + "req_id": "V10.2.2", + "req_description": "Убедитесь, что если OAuth клиент может взаимодействовать с более чем одним сервером авторизации, у него есть защита от атак смешивания (mix-up attacks). Например, клиент должен требовать, чтобы сервер авторизации возвращал параметр 'iss' и проверять его в ответах на авторизацию и токены.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.2", + "section_name": "Клиент OAuth", + "req_id": "V10.2.3", + "req_description": "Убедитесь, что OAuth клиент запрашивает только необходимые области доступа (scopes) или другие параметры авторизации в запросах к серверу авторизации.", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.3", + "section_name": "Сервер ресурсов OAuth", + "req_id": "V10.3.1", + "req_description": "Убедитесь, что сервер ресурсов принимает только те access токены, которые предназначены для использования с этим сервисом (свойство audience). Эта принадлежность сервису может быть включена в структурированный access токен (например, в поле 'aud' в JWT) или проверяться через endpoint интроспекции токена.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.3", + "section_name": "Сервер ресурсов OAuth", + "req_id": "V10.3.2", + "req_description": "Убедитесь, что сервер ресурсов принимает решения по авторизации на основе claims из access токена, определяющих делегированную авторизацию. Если присутствуют claims, такие как 'sub', 'scope' и 'authorization_details', они должны участвовать в принятии решения.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.3", + "section_name": "Сервер ресурсов OAuth", + "req_id": "V10.3.3", + "req_description": "Убедитесь, что если для принятия решения по контролю доступа необходимо однозначно идентифицировать пользователя из access токена (JWT или ответа интроспекции), сервер ресурсов использует claims, которые не могут быть переприсвоены другим пользователям. Обычно это комбинация claims 'iss' и 'sub'.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.3", + "section_name": "Сервер ресурсов OAuth", + "req_id": "V10.3.4", + "req_description": "Убедитесь, что если сервер ресурсов требует определённой силы аутентификации, методов или свежести аутентификации, он проверяет, что предъявленный access токен удовлетворяет этим требованиям. Например, при наличии, могут использоваться claims OIDC 'acr', 'amr' и 'auth_time'.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.3", + "section_name": "Сервер ресурсов OAuth", + "req_id": "V10.3.5", + "req_description": "Убедитесь, что сервер ресурсов предотвращает использование украденных access токенов или их повторное использование (replay) неавторизованными лицами, требуя access токены с подтверждением отправителя — например, Mutual TLS для OAuth 2 или OAuth 2 Demonstration of Proof of Possession (DPoP).", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.1", + "req_description": "Убедитесь, что сервер авторизации проверяет URI перенаправления (redirect URI), сверяя его с заранее зарегистрированным списком разрешённых URI для данного клиента (allowlist), используя точное сравнение строк.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.2", + "req_description": "Убедитесь, что если сервер авторизации возвращает authorization code в ответе авторизации, этот код может быть использован только один раз для запроса токена. При втором валидном запросе с уже использованным кодом сервер должен отклонить запрос и отозвать любые токены, связанные с этим кодом.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.3", + "req_description": "Убедитесь, что authorization code имеет короткое время жизни. Максимальная продолжительность — до 10 минут для приложений L1 и L2 и до 1 минуты для приложений L3.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.4", + "req_description": "Убедитесь, что сервер авторизации для конкретного клиента разрешает использование только тех типов авторизации, которые необходимы этому клиенту. Обратите внимание, что тип авторизации Implicit flow и Resource Owner Password Credentials flow больше не должны использоваться.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.5", + "req_description": "Убедитесь, что сервер авторизации предотвращает атаки повторного использования refresh токенов для публичных клиентов, предпочтительно используя sender-constrained refresh токены, такие как DPoP или сертификат-связанные токены с mutual TLS (mTLS). Для L1 и L2 допускается ротация refresh токенов с обязательной их инвалидацией после использования. Если используется ротация, сервер должен отозвать все refresh токены при попытке использовать уже инвалидированный токен.", + "L": "1" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.6", + "req_description": "Убедитесь, что при использовании типа авторизации «Authorization Code» сервер предотвращает атаки перехвата authorization code, требуя Proof Key for Code Exchange (PKCE). В запросах авторизации сервер должен требовать валидное значение 'code_challenge' и не принимать 'code_challenge_method' со значением 'plain'. В запросах токена обязательно валидировать параметр 'code_verifier'.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.7", + "req_description": "Убедитесь, что если сервер авторизации поддерживает динамическую регистрацию клиентов без аутентификации, он минимизирует риски вредоносных клиентов. Сервер должен валидировать метаданные клиента (например, зарегистрированные URI), обеспечивать согласие пользователя и предупреждать пользователя перед обработкой запроса авторизации от недоверенного клиента.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.8", + "req_description": "Убедитесь, что refresh токены имеют абсолютный срок действия, включая случаи, когда применяется скользящее время истечения срока.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.9", + "req_description": "Убедитесь, что пользователи могут отзывать refresh токены и reference access токены через пользовательский интерфейс сервера авторизации для снижения риска от вредоносных клиентов или кражи токенов.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.10", + "req_description": "Убедитесь, что конфиденциальный клиент аутентифицируется при взаимодействии с сервером авторизации через backchannel, например при запросах токена, pushed authorization requests (PAR) и запросах на отзыв токенов.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.11", + "req_description": "Убедитесь, что конфигурация сервера авторизации назначает OAuth клиенту только необходимые области доступа (scopes).", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.12", + "req_description": "Убедитесь, что для конкретного клиента сервер авторизации разрешает только те значения 'response_mode', которые необходимы этому клиенту. Например, сервер должен валидировать это значение против ожидаемых или использовать pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.13", + "req_description": "Убедитесь, что грант типа 'code' всегда используется вместе с pushed authorization requests (PAR).", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.14", + "req_description": "Убедитесь, что сервер авторизации выдаёт только sender-constrained (Proof-of-Possession) access токены, либо с сертификат-связанными токенами через mutual TLS (mTLS), либо DPoP-bound токены (Demonstration of Proof of Possession).", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.15", + "req_description": "Убедитесь, что для серверного клиента (не выполняющегося на устройстве конечного пользователя) сервер авторизации проверяет, что значение параметра 'authorization_details' исходит из клиентского backend и что пользователь не изменял его. Например, это достигается использованием pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.16", + "req_description": "Убедитесь, что клиент является конфиденциальным и сервер авторизации требует использования сильных методов аутентификации клиента (основанных на криптографии с открытым ключом и устойчивых к атакам повторного воспроизведения), таких как mutual TLS ('tls_client_auth', 'self_signed_tls_client_auth') или private key JWT ('private_key_jwt').", + "L": "3" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.5", + "section_name": "Клиент OIDC", + "req_id": "V10.5.1", + "req_description": "Убедитесь, что клиент (relying party) защищается от повторного использования ID Token (replay-атак). Например, это достигается проверкой того, что значение 'nonce' в ID Token совпадает со значением 'nonce', отправленным в запросе аутентификации провайдеру OpenID (authorization server).", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.5", + "section_name": "Клиент OIDC", + "req_id": "V10.5.2", + "req_description": "Убедитесь, что клиент однозначно идентифицирует пользователя по утверждениям (claims) ID Token, обычно это 'sub', который не может быть переназначен другому пользователю (в пределах конкретного провайдера идентификации).", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.5", + "section_name": "Клиент OIDC", + "req_id": "V10.5.3", + "req_description": "Убедитесь, что клиент отклоняет попытки злоумышленного сервера авторизации выдавать себя за другой сервер авторизации через метаданные сервера авторизации. Клиент должен отклонить метаданные, если URL издателя (issuer) в метаданных не совпадает точно с преднастроенным URL издателя, ожидаемым клиентом.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.5", + "section_name": "Клиент OIDC", + "req_id": "V10.5.4", + "req_description": "Убедитесь, что клиент проверяет, что ID Token предназначен для него (проверка audience), сравнивая значение 'aud' в токене с 'client_id' клиента.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.5", + "section_name": "Клиент OIDC", + "req_id": "V10.5.5", + "req_description": "Убедитесь, что при использовании OIDC back-channel logout клиент снижает риск отказа в обслуживании, вызванный принудительным выходом из системы и путаницей между разными типами JWT (cross-JWT confusion) в процессе логаута. Клиент должен проверить, что токен выхода корректно типизирован со значением 'logout+jwt', содержит claim 'event' с правильным именем участника и не содержит 'nonce'. Также рекомендуется установить короткий срок действия токена (например, 2 минуты).", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.6", + "section_name": "Провайдер OpenID", + "req_id": "V10.6.1", + "req_description": "Убедитесь, что провайдер OpenID допускает только значения 'code', 'ciba', 'id_token' или 'id_token code' для параметра response mode. При этом предпочтение отдаётся 'code' по сравнению с 'id_token code' (гибридный поток OIDC), а значение 'token' (любой Implicit flow) не должно использоваться.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.6", + "section_name": "Провайдер OpenID", + "req_id": "V10.6.2", + "req_description": "Убедитесь, что провайдер OpenID предотвращает отказ в обслуживании (DoS) через принудительный выход (logout), запрашивая явное подтверждение от конечного пользователя или, если применимо, проверяя параметры в запросе выхода (инициированном relying party), например параметр 'id_token_hint'.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.7", + "section_name": "Управление согласием", + "req_id": "V10.7.1", + "req_description": "Убедитесь, что авторизационный сервер обеспечивает получение согласия пользователя для каждого запроса авторизации. Если личность клиента не может быть подтверждена, сервер авторизации всегда должен явно запрашивать согласие пользователя.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.7", + "section_name": "Управление согласием", + "req_id": "V10.7.2", + "req_description": "Убедитесь, что при запросе согласия пользователя авторизационный сервер предоставляет достаточную и понятную информацию о том, на что даётся согласие. При необходимости это должно включать характер запрашиваемых разрешений (обычно основанных на scope, ресурсном сервере, деталях авторизации Rich Authorization Requests (RAR)), идентификацию авторизованного приложения и срок действия этих разрешений.", + "L": "2" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.7", + "section_name": "Управление согласием", + "req_id": "V10.7.3", + "req_description": "Убедитесь, что пользователь может просматривать, изменять и отзывать согласия, которые он предоставил, через авторизационный сервер.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.1", + "section_name": "Инвентаризация и документирование криптографии", + "req_id": "V11.1.1", + "req_description": "Убедитесь, что задокументирована политика управления криптографическими ключами и описан их жизненный цикл в соответствии со стандартом управления ключей, таким как NIST SP 800-57. Убедитесь, что ключи известны только тем сущностям, которым они должны быть доступны (например, ключи не передавались более чем двум участникам для общих секретов и более чем одному участнику для приватных ключей).", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.1", + "section_name": "Инвентаризация и документирование криптографии", + "req_id": "V11.1.2", + "req_description": "Убедитесь, что проводится инвентаризация криптографических средств, которая непрерывно поддерживается, регулярно обновляется и включает все криптографические ключи, алгоритмы и сертификаты, используемые в приложении. Также должна быть задокументирована информация о том, где ключи могут и не могут использоваться в системе, а также какие типы данных могут и не могут быть защищены с помощью этих ключей.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.1", + "section_name": "Инвентаризация и документирование криптографии", + "req_id": "V11.1.3", + "req_description": "Убедитесь, что используются механизмы обнаружения криптографии для идентификации всех случаев применения криптографии в системе , включая операции шифрования, хеширования и цифровой подписи.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.1", + "section_name": "Инвентаризация и документирование криптографии", + "req_id": "V11.1.4", + "req_description": "Убедитесь, что ведётся и поддерживается инвентаризация криптографических средств. В неё должен входить документированный план, описывающий переход на новые криптографические стандарты, такие как постквантовая криптография, чтобы своевременно реагировать на будущие угрозы.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.2", + "section_name": "Безопасная реализация криптографии", + "req_id": "V11.2.1", + "req_description": "Убедитесь, что для криптографических операций используются утвержденные в индустрии реализации (включая библиотеки и аппаратные реализации).", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.2", + "section_name": "Безопасная реализация криптографии", + "req_id": "V11.2.2", + "req_description": "Убедитесь, что архитектура приложения поддерживает быструю реконфигурацию, усовершенствование или смену в любой момент случайных чисел, аутентифицированного шифрования, MAC, алгоритмов хеширования, длин ключей, количества раундов, шифров и режимов шифрования для защиты от криптографических атак. Также должна поддерживаться возможность смены ключей, паролей и повторного шифрования данных. Это позволит беспрепятственно перейти на постквантовую криптографию (PQC), как только станут широко доступны высоконадёжные реализации одобренных схем или стандартов PQC.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.2", + "section_name": "Безопасная реализация криптографии", + "req_id": "V11.2.3", + "req_description": "Убедитесь, что все криптографические примитивы используют как минимум 128-бит стойкости с учетом алгоритма, размера ключа и конфигурации. Например, 256-битный ECC ключ обеспечивает примерно 128 бит безопасности, тогда как для достижения того же уровня безопасности в RSA требуется ключ длиной 3072 бита.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.2", + "section_name": "Безопасная реализация криптографии", + "req_id": "V11.2.4", + "req_description": "Убедитесь, что все криптографические операции выполняются за константное время, без использования «short-circuit» операций в сравнениях, вычислениях, возвратах функций для избежания утечек информации.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.2", + "section_name": "Безопасная реализация криптографии", + "req_id": "V11.2.5", + "req_description": "Убедитесь, что все криптографические модули обеспечивают безопасное завершение работы при ошибках, а обработка ошибок реализована таким образом, чтобы не создавать уязвимостей, например, таких как атаки Padding Oracle.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.3", + "section_name": "Алгоритмы шифрования", + "req_id": "V11.3.1", + "req_description": "Убедитесь, что не используются небезопасные режимы блочного шифрования (н-р, ECB) и слабые схемы дополнения (padding) (н-р, PKCS#1 v1.5).", + "L": "1" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.3", + "section_name": "Алгоритмы шифрования", + "req_id": "V11.3.2", + "req_description": "Убедитесь, что используются только утверждённые шифры и режимы, такие как AES с GCM.", + "L": "1" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.3", + "section_name": "Алгоритмы шифрования", + "req_id": "V11.3.3", + "req_description": "Убедитесь, что зашифрованные данные защищены от несанкционированного изменения, предпочтительно с использованием утверждённого метода аутентифицированного шифрования или путём комбинирования утверждённого метода шифрования с утверждённым алгоритмом MAC.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.3", + "section_name": "Алгоритмы шифрования", + "req_id": "V11.3.4", + "req_description": "Убедитесь, что случайные числа (nonce), векторы инициализации (IV) и другие одноразовые числа не используются более одного раза для одной и той же пары ключа шифрования и элемента данных. Метод их генерации должен соответствовать требованиям используемого алгоритма.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.3", + "section_name": "Алгоритмы шифрования", + "req_id": "V11.3.5", + "req_description": "Убедитесь, что любая комбинация алгоритма шифрования и алгоритма MAC работает в режиме encrypt-then-MAC (EtM).", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.4", + "section_name": "Хеширование и функции на основе хеширования", + "req_id": "V11.4.1", + "req_description": "Убедитесь, что только утвержденные хэш-функции используются для стандартных сценариев использования в криптографии, включая цифровую подпись, HMAC, KDF, генерацию случайных чисел. Запрещено использовать неустойчивые хэш-функции, (н-р, MD5) для любого использования в криптографии.", + "L": "1" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.4", + "section_name": "Хеширование и функции на основе хеширования", + "req_id": "V11.4.2", + "req_description": "Убедитесь, что пароли хранятся с использованием утверждённой, вычислительно затратной функции генерации ключа (также известной как «функция хеширования паролей»), с параметрами, настроенными в соответствии с актуальными рекомендациями. Настройки должны обеспечивать баланс между безопасностью и производительностью, чтобы сделать атаки перебором достаточно сложными для требуемого уровня безопасности.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.4", + "section_name": "Хеширование и функции на основе хеширования", + "req_id": "V11.4.3", + "req_description": "Убедитесь, что хэш-функции, используемые в формировании цифровой подписи, как часть аутентификации и целостности данных, устойчивы к коллизиям и имеют достаточную длину.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.4", + "section_name": "Хеширование и функции на основе хеширования", + "req_id": "V11.4.4", + "req_description": "Убедитесь, что приложение использует утвержденную функцию генерации ключа с использованием параметров расширения ключа (key stretching) при генерации ключа из пароля. Параметры должны быть сбалансированы с точки зрения безопасности, производительности и устойчивости к атакам полного перебора при компрометации результирующего криптографического ключа.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.5", + "section_name": "Случайные значения", + "req_id": "V11.5.1", + "req_description": "Убедитесь, что все случайные числа и строки, которые должны быть непредсказуемы, должны быть сгенерированы с помощью CSPRNG и иметь хотя бы 128 бит энтропии. Учтите, что UUID не удовлетворяют данному условию.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.5", + "section_name": "Случайные значения", + "req_id": "V11.5.2", + "req_description": "Убедитесь, что механизм генерации случайных чисел является надежным даже при высокой нагрузке.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.6", + "section_name": "Криптография с публичным ключом", + "req_id": "V11.6.1", + "req_description": "Убедитесь, что только утвержденные криптографические алгоритмы и режимы операций используются для генерации ключа и инициализации случайного значения для его генерации (seeding), а также для генерации цифровой подписи и верификации. Алгоритмы генерации ключей не должны генерировать небезопасные ключи уязвимые к известным атакам, например, ключи RSA уязвимы к факторизации Ферма.", + "L": "2" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.6", + "section_name": "Криптография с публичным ключом", + "req_id": "V11.6.2", + "req_description": "Убедитесь, что для обмена ключами используются утверждённые криптографические алгоритмы (например, Диффи-Хеллман) с особым вниманием к обеспечению использования безопасных параметров. Это предотвратит атаки на процесс установления ключа, которые могут привести к атакам «человек посередине» или криптографическим взломам.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.7", + "section_name": "Шифрование данных в процессе использования", + "req_id": "V11.7.1", + "req_description": "Убедитесь, что используется полное шифрование памяти, которое защищает конфиденциальные данные во время их использования, предотвращая доступ к ним неавторизованных пользователей или процессов.", + "L": "3" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.7", + "section_name": "Шифрование данных в процессе использования", + "req_id": "V11.7.2", + "req_description": "Убедитесь, что минимизация данных обеспечивает раскрытие минимально необходимого объёма данных во время обработки, а также что данные шифруются сразу после использования или как можно скорее.", + "L": "3" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.1", + "section_name": "Общие рекомендации по безопасности TLS", + "req_id": "V12.1.1", + "req_description": "Убедитесь, что включены только актуальные и рекомендуемые версии протокола TLS, такие как TLS 1.2 и TLS 1.3. Наиболее свежая версия TLS должна быть выбрана как предпочтительная.", + "L": "1" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.1", + "section_name": "Общие рекомендации по безопасности TLS", + "req_id": "V12.1.2", + "req_description": "Убедитесь, что включены рекомендуемые шифронаборы (cipher suites), предпочтение также стоит отдать самому сильному шифронабору. L3 приложения должны поддерживать только те наборы шифров (cipher suites), которые обеспечивают прямую (forward) секретность. Пояснение: Прямая секретность (Forward Secrecy, FS) — это криптографическая особенность, при которой сессионные ключи уникальны для каждой сессии и не зависят от долгосрочных ключей. Это гарантирует, что даже при компрометации долгосрочного ключа злоумышленник не сможет расшифровать ранее перехваченные зашифрованные сессии.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.1", + "section_name": "Общие рекомендации по безопасности TLS", + "req_id": "V12.1.3", + "req_description": "Убедитесь, что приложение проверяет доверенность клиентских сертификатов mTLS, прежде чем использовать идентификацию по сертификату для аутентификации или авторизации.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.1", + "section_name": "Общие рекомендации по безопасности TLS", + "req_id": "V12.1.4", + "req_description": "Убедитесь, что включена и настроена правильная проверка отзыва сертификатов, такая как Online Certificate Status Protocol (OCSP) Stapling.", + "L": "3" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.1", + "section_name": "Общие рекомендации по безопасности TLS", + "req_id": "V12.1.5", + "req_description": "Убедитесь, что в настройках TLS приложения включена функция Encrypted Client Hello (ECH) для предотвращения раскрытия конфиденциальных метаданных, таких как Server Name Indication (SNI), во время процесса TLS-рукопожатия.", + "L": "3" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.2", + "section_name": "HTTPS коммуникация с внешними сервисами", + "req_id": "V12.2.1", + "req_description": "Убедитесь, что для всех соединений между клиентом и внешними HTTP-сервисами используется TLS и не происходит отката к небезопасным или незашифрованным протоколам.", + "L": "1" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.2", + "section_name": "HTTPS коммуникация с внешними сервисами", + "req_id": "V12.2.2", + "req_description": "Убедитесь, что внешние сервисы используют публично доверенные TLS-сертификаты.", + "L": "1" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.3", + "section_name": "Общая безопасность межсервисного взаимодействия", + "req_id": "V12.3.1", + "req_description": "Убедитесь, что для всех входящих и исходящих соединений приложения используется зашифрованный протокол, например TLS, включая системы мониторинга, инструменты управления, удалённый доступ и SSH, промежуточное ПО, базы данных, мейнфреймы, партнёрские системы и внешние API. Сервер не должен допускать откат к небезопасным или незашифрованным протоколам.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.3", + "section_name": "Общая безопасность межсервисного взаимодействия", + "req_id": "V12.3.2", + "req_description": "Убедитесь, что TLS-клиент проверяет сертификат сервера до установления защищенного соединения с TLS-сервером.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.3", + "section_name": "Общая безопасность межсервисного взаимодействия", + "req_id": "V12.3.3", + "req_description": "Убедитесь, что все внутренние HTTP-взаимодействия между компонентами приложения используют TLS или другой подходящий механизм транспортного шифрования, и не происходит откат к небезопасным или незашифрованным коммуникациям.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.3", + "section_name": "Общая безопасность межсервисного взаимодействия", + "req_id": "V12.3.4", + "req_description": "Убедитесь, что TLS-соединения между внутренними сервисами используют доверенные сертификаты. Если используются внутренние или самоподписанные сертификаты, потребляющий сервис должен быть настроен на доверие только к конкретным внутренним центрам сертификации (CA) и конкретным самоподписанным сертификатам.", + "L": "2" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.3", + "section_name": "Общая безопасность межсервисного взаимодействия", + "req_id": "V12.3.5", + "req_description": "Убедитесь, что сервисы, взаимодействующие внутри системы (intra-service communications), используют строгую аутентификацию для проверки каждого конечного узла. Для проверки подлинности взаимодействующих сторон должны применяться методы строгой аутентификации, такие как аутентификация TLS-клиента, с использованием инфраструктуры открытых ключей и механизмов, устойчивых к атакам повтора (replay attacks). Для микросервисных архитектур рекомендуется использование service mesh для упрощения управления сертификатами и повышения безопасности.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.1", + "section_name": "Документация конфигурации", + "req_id": "V13.1.1", + "req_description": "Убедитесь, что все необходимые доступы приложения задокументированы. Сюда должны быть включены как внешние сервисы, от которых зависит приложение, так и сценарии, когда конечный пользователь может задавать адреса для внешнего подключения.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.1", + "section_name": "Документация конфигурации", + "req_id": "V13.1.2", + "req_description": "Убедитесь, что для каждого сервиса, используемого приложением, в документации определено максимальное количество одновременных соединений (например, лимиты пула соединений) и описано поведение приложения при достижении этого лимита, включая любые механизмы отказоустойчивости или восстановления, чтобы предотвратить ситуации отказа в обслуживании (DoS).", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.1", + "section_name": "Документация конфигурации", + "req_id": "V13.1.3", + "req_description": "Убедитесь, что в документации приложения определены стратегии управления ресурсами для каждой внешней системы или сервиса, которые оно использует (например, базы данных, файловые дескрипторы, потоки, HTTP-соединения). Стратегии должны включать процедуры освобождения ресурсов, настройки таймаутов, обработку сбоев, а также, если реализована логика повторных попыток, указание лимитов, задержек и алгоритмов back-off. Для синхронных HTTP-запросов должны быть заданы короткие таймауты, а повторные запросы должны быть отключены, либо строго ограничены по числу попыток, чтобы предотвратить каскадные задержки и истощение ресурсов.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.1", + "section_name": "Документация конфигурации", + "req_id": "V13.1.4", + "req_description": "Убедитесь, что в документации приложения определены секреты, критически важные для безопасности приложения, а также установлен график их ротации в соответствии с моделью угроз организации и её бизнес-требованиями.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.2", + "section_name": "Конфигурация бэкенд соединений", + "req_id": "V13.2.1", + "req_description": "Убедитесь, что коммуникации между компонентами бэкенда приложения (включая API, промежуточное ПО и уровни данных), которые не поддерживают стандартный механизм пользовательских сессий, проходят с аутентификацией. Аутентификация должна использовать индивидуальные сервисные аккаунты, краткосрочные токены или аутентификацию на основе сертификатов, а не постоянные учётные данные, такие как пароли, API-ключи или общие аккаунты с привилегированным доступом.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.2", + "section_name": "Конфигурация бэкенд соединений", + "req_id": "V13.2.2", + "req_description": "Убедитесь, что коммуникации между компонентами бэкенда приложения, включая локальные или системные службы, API, промежуточное ПО и уровни данных, выполняются с использованием аккаунтов, которым назначены минимально необходимые привилегии.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.2", + "section_name": "Конфигурация бэкенд соединений", + "req_id": "V13.2.3", + "req_description": "Убедитесь, что если для аутентификации в сервисе используются учётные данные, то используемые потребителем учётные данные не являются стандартными (например, root/root или admin/admin).", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.2", + "section_name": "Конфигурация бэкенд соединений", + "req_id": "V13.2.4", + "req_description": "Убедитесь, что используется белый список (allowlist) для определения внешних ресурсов или систем, с которыми приложению разрешено взаимодействовать (например, для исходящих запросов, загрузки данных или доступа к файлам). Этот белый список может быть реализован на уровне приложения, веб-сервера, межсетевого экрана или комбинации различных уровней.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.2", + "section_name": "Конфигурация бэкенд соединений", + "req_id": "V13.2.5", + "req_description": "Убедитесь, что веб- или прикладной сервер настроен с белым списком ресурсов или систем, к которым сервер может отправлять запросы или из которых может загружать данные и файлы.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.2", + "section_name": "Конфигурация бэкенд соединений", + "req_id": "V13.2.6", + "req_description": "Убедитесь, что при подключении приложения к другим сервисам соблюдается задокументированная конфигурация для каждого соединения, включая максимальное количество параллельных соединений, поведение при достижении их максимума, таймауты и стратегии повторных попыток подключения.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.3", + "section_name": "Управление секретами", + "req_id": "V13.3.1", + "req_description": "Убедитесь, что для безопасного создания, хранения, контроля доступа и уничтожения секретов бэкенда используется решение для управления секретами, например, хранилище ключей (key vault). Секретами могут быть пароли, ключевой материал, интеграции с базами данных и сторонними системами, ключи и seed-значения для токенов с ограниченным временем действия, другие внутренние секреты и API-ключи. Секреты не должны включаться в исходный код приложения или артефакты сборки. Для приложений уровня L3 необходимо использовать аппаратное решение, например, аппаратный модуль безопасности (HSM).", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.3", + "section_name": "Управление секретами", + "req_id": "V13.3.2", + "req_description": "Убедитесь, что доступ к секретным ресурсам осуществляется в соответствии с принципом минимально необходимых привилегий (least privilege).", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.3", + "section_name": "Управление секретами", + "req_id": "V13.3.3", + "req_description": "Убедитесь, что все криптографические операции выполняются с использованием изолированного модуля безопасности (например, хранилища ключей или аппаратного модуля безопасности), чтобы надежно управлять ключевым материалом и защищать его от утечки за пределы модуля безопасности.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.3", + "section_name": "Управление секретами", + "req_id": "V13.3.4", + "req_description": "Убедитесь, что секреты настроены на срок действия и ротацию в соответствии с документацией приложения.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.4", + "section_name": "Непреднамеренная утечка информации", + "req_id": "V13.4.1", + "req_description": "Убедитесь, что приложение развернуто либо без метаданных систем контроля версий (включая папки .git или .svn), либо так, чтобы эти папки были недоступны как извне, так и для самого приложения.", + "L": "1" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.4", + "section_name": "Непреднамеренная утечка информации", + "req_id": "V13.4.2", + "req_description": "Убедитесь, что режимы отладки отключены для всех компонентов в промышленной среде, чтобы предотвратить раскрытие функций отладки и утечку информации.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.4", + "section_name": "Непреднамеренная утечка информации", + "req_id": "V13.4.3", + "req_description": "Убедитесь, что веб-серверы не показывают клиентам списки содержимого каталогов, если это явно не предусмотрено.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.4", + "section_name": "Непреднамеренная утечка информации", + "req_id": "V13.4.4", + "req_description": "Убедитесь, что метод HTTP TRACE не поддерживается в продуктовой среде, чтобы избежать потенциальной утечки информации.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.4", + "section_name": "Непреднамеренная утечка информации", + "req_id": "V13.4.5", + "req_description": "Убедитесь, что документация (например, по внутренним API) и мониторинговые эндпоинты не доступны, если это явно не предусмотрено.", + "L": "2" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.4", + "section_name": "Непреднамеренная утечка информации", + "req_id": "V13.4.6", + "req_description": "Убедитесь, что приложение не раскрывает подробную информацию о версиях компонентов бэкенда.", + "L": "3" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.4", + "section_name": "Непреднамеренная утечка информации", + "req_id": "V13.4.7", + "req_description": "Убедитесь, что веб-слой настроен на обслуживание только файлов с определёнными расширениями, чтобы предотвратить непреднамеренную утечку информации, конфигураций и исходного кода.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.1", + "section_name": "Документация по защите информации", + "req_id": "V14.1.1", + "req_description": "Убедитесь, что все конфиденциальные данные, создаваемые и обрабатываемые приложением, идентифицированы и классифицированы по уровням защиты. Включая закодированные данные, которые легко декодируются, например, строки Base64 или незашифрованные данные в полезной нагрузке JWT. Уровни защиты должны учитывать требования по защите данных и конфиденциальности, которым должно соответствовать приложение.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.1", + "section_name": "Документация по защите информации", + "req_id": "V14.1.2", + "req_description": "Убедитесь, что для каждого уровня защиты конфиденциальных данных требования к защите задокументированы. Они должны включать (но не ограничиваться) требования по шифрованию, проверке целостности, срокам хранения, способам логирования данных, контролю доступа к чувствительным данным в логах, шифрованию на уровне базы данных, применению технологий повышения конфиденциальности, а также другим требованиям по конфиденциальности.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.2", + "section_name": "Базовые меры по защите информации", + "req_id": "V14.2.1", + "req_description": "Убедитесь, что конфиденциальные данные передаются на сервер только в теле HTTP-запроса или в заголовках. URL и строка запроса не должны содержать конфиденциальную информацию, такую как API-ключ или сессионный токен.", + "L": "1" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.2", + "section_name": "Базовые меры по защите информации", + "req_id": "V14.2.2", + "req_description": "Убедитесь, что приложение предотвращает кэширование конфиденциальных данных в серверных компонентах, таких как балансировщики нагрузки и кэши приложений, либо гарантирует их надежное удаление после использования.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.2", + "section_name": "Базовые меры по защите информации", + "req_id": "V14.2.3", + "req_description": "Убедитесь, что заранее определённые конфиденциальные данные не отправляются ненадёжным сторонам (например, системам трекинга пользователей), чтобы предотвратить нежелательный сбор данных вне контроля приложения.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.2", + "section_name": "Базовые меры по защите информации", + "req_id": "V14.2.4", + "req_description": "Убедитесь, что для конфиденциальных данных реализованы меры по шифрованию, проверке целостности, срокам хранения, способам логирования, контролю доступа к данным в логах, а также применяются технологии повышения конфиденциальности в соответствии с документацией для соответствующего уровня защиты данных.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.2", + "section_name": "Базовые меры по защите информации", + "req_id": "V14.2.5", + "req_description": "Убедитесь, что механизмы кэширования настроены так, чтобы кэшировать только ответы с ожидаемым типом содержимого для данного ресурса и не содержать конфиденциального динамического контента. При обращении к несуществующему файлу, веб-сервер должен возвращать ответ 404 или 302, а не подменять на другой существующий файл, что позволит предотвратить атаки типа Web Cache Deception.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.2", + "section_name": "Базовые меры по защите информации", + "req_id": "V14.2.6", + "req_description": "Убедитесь, что приложение возвращает только минимально необходимый объем конфиденциальных данных для выполнения своей функциональности. Например, показывает только часть цифр номера кредитной карты, а не полный номер. Если требуется отображение полных данных, они должны быть замаскированы в пользовательском интерфейсе, пока пользователь специально не запросил их просмотр.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.2", + "section_name": "Базовые меры по защите информации", + "req_id": "V14.2.7", + "req_description": "Убедитесь, что конфиденциальная информация подлежит классификации по срокам хранения, чтобы устаревшие или ненужные данные удалялись автоматически, по расписанию или по мере необходимости.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.2", + "section_name": "Базовые меры по защите информации", + "req_id": "V14.2.8", + "req_description": "Убедитесь, что конфиденциальная информация удаляется из метаданных файлов, загружаемых пользователями, если пользователь явно не согласился на ее хранение.", + "L": "3" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.3", + "section_name": "Защита данных на стороне клиента", + "req_id": "V14.3.1", + "req_description": "Убедитесь, что аутентифицированные данные очищаются из клиентского хранилища, например, из DOM браузера, после завершения работы клиента или сессии. Заголовок HTTP-ответа Clear-Site-Data может помочь в этом, но клиентская сторона также должна уметь очищать данные, если соединение с сервером недоступно при завершении сессии.", + "L": "1" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.3", + "section_name": "Защита данных на стороне клиента", + "req_id": "V14.3.2", + "req_description": "Убедитесь, что приложение устанавливает HTTP-заголовки, достаточные для предотвращения кэширования (например, Cache-Control: no-store), чтобы конфиденциальные данные не сохранялись в браузерах.", + "L": "2" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.3", + "section_name": "Защита данных на стороне клиента", + "req_id": "V14.3.3", + "req_description": "Убедитесь, что данные, хранящиеся в браузерном хранилище (например, localStorage, sessionStorage, IndexedDB или cookie), не содержат конфиденциальной информации, за исключением сессионных токенов.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.1", + "section_name": "Документация по безопасной разработке и архитектуре", + "req_id": "V15.1.1", + "req_description": "Убедитесь, что в документации по приложению определены сроки устранения уязвимостей на основе оценки рисков для внешних зависимостей с уязвимостями и для обновления библиотек в целом, чтобы минимизировать риск, связанный с этими компонентами.", + "L": "1" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.1", + "section_name": "Документация по безопасной разработке и архитектуре", + "req_id": "V15.1.2", + "req_description": "Убедитесь, что ведется реестр всех используемых сторонних библиотек (например, Software Bill of Materials, SBOM), с обязательной проверкой, что компоненты получены из предопределенных, доверенных и регулярно поддерживаемых репозиториев.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.1", + "section_name": "Документация по безопасной разработке и архитектуре", + "req_id": "V15.1.3", + "req_description": "Убедитесь, что в документации приложения указан функционал, требующий значительных временных или вычислительных ресурсов. Необходимо указать, как предотвратить потерю доступности из-за чрезмерного использования этого функционала и как избежать ситуаций, когда формирование ответа занимает больше времени, чем установленный системой таймаут. Возможные меры защиты могут включать асинхронную обработку, использование очередей и ограничение количества параллельных процессов для каждого пользователя и приложения.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.1", + "section_name": "Документация по безопасной разработке и архитектуре", + "req_id": "V15.1.4", + "req_description": "Убедитесь, что в документации приложения указаны внешние библиотеки, которые считаются «компонентами с повышенным риском».", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.1", + "section_name": "Документация по безопасной разработке и архитектуре", + "req_id": "V15.1.5", + "req_description": "Убедитесь, что в документации приложения выделены те части приложения, в которых используются «функционал с повышенным риском».", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.2", + "section_name": "Архитектура безопасности и зависимости", + "req_id": "V15.2.1", + "req_description": "Убедитесь, что приложение содержит только те компоненты, которые не нарушили задокументированные сроки обновления и исправления.", + "L": "1" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.2", + "section_name": "Архитектура безопасности и зависимости", + "req_id": "V15.2.2", + "req_description": "Убедитесь, что в приложении реализованы меры защиты от потери доступности из-за функциональности, требующей много времени или ресурсов, на основе задокументированных решений и стратегий безопасности для этого.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.2", + "section_name": "Архитектура безопасности и зависимости", + "req_id": "V15.2.3", + "req_description": "Убедитесь, что производственная среда включает только те функции, которые необходимы для работы приложения, и не предоставляет лишние функции, такие как тестовый код, примеры кода и инструменты разработки.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.2", + "section_name": "Архитектура безопасности и зависимости", + "req_id": "V15.2.4", + "req_description": "Убедитесь, что сторонние компоненты и все их транзитивные зависимости загружаются только из ожидаемых репозиториев (внутренних или внешних) и отсутствует риск атаки через подмену зависимостей (dependency confusion attack)", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.2", + "section_name": "Архитектура безопасности и зависимости", + "req_id": "V15.2.5", + "req_description": "Убедитесь, что приложение реализует дополнительные меры защиты для тех частей приложения, которые документированы как содержащие «функционал с повышенным риском» или использующие сторонние библиотеки, считающиеся «функционалом с повышенным риском». Это могут быть такие методы, как «песочница», инкапсуляция, контейнеризация или изоляция на сетевом уровне, чтобы задержать и предотвратить продвижение (pivoting) злоумышленников, скомпрометировавших одну часть приложения, к другим частям приложения.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.3", + "section_name": "Безопасное программирование", + "req_id": "V15.3.1", + "req_description": "Убедитесь, что приложение возвращает только необходимое подмножество полей из объекта данных. Например, оно не должно возвращать весь объект данных, поскольку некоторые отдельные поля должны быть недоступны пользователям.", + "L": "1" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.3", + "section_name": "Безопасное программирование", + "req_id": "V15.3.2", + "req_description": "Убедитесь, что при вызовах внешних URL-адресов бэкэнд приложения настроен так, чтобы не выполнять перенаправления, если только это не предусмотрено функционалом.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.3", + "section_name": "Безопасное программирование", + "req_id": "V15.3.3", + "req_description": "Убедитесь, что в приложении реализованы защитные механизмы против атак типа массового присвоения (mass assignment) путем строгого ограничения разрешенных полей для каждого контроллера и действия, исключая возможность добавления или изменения значений полей, которые не должны быть доступны для данной конкретной операции.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.3", + "section_name": "Безопасное программирование", + "req_id": "V15.3.4", + "req_description": "Убедитесь, что все прокси и промежуточное ПО корректно передают исходный IP-адрес пользователя, используя доверенные поля данных, которые не могут быть изменены конечным пользователем, а приложение и веб-сервер используют это правильное значение для ведения логирования и принятия решений по безопасности, таких как ограничение запросов. При этом следует учитывать, что даже исходный IP-адрес может быть ненадежным из-за динамических IP-адресов, VPN или корпоративных файрволов.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.3", + "section_name": "Безопасное программирование", + "req_id": "V15.3.5", + "req_description": "Убедитесь, что приложение явно проверяет соответствие переменных ожидаемому типу данных и использует строгие операции сравнения. Это необходимо для предотвращения уязвимостей, связанных с type juggling и type confusion, вызванных тем, что код приложения делает предположения о типе переменной.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.3", + "section_name": "Безопасное программирование", + "req_id": "V15.3.6", + "req_description": "Убедитесь, что JavaScript-код написан таким образом, чтобы предотвратить prototype pollution, например, используя Set() или Map() вместо обычных литералов объекта.", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.3", + "section_name": "Безопасное программирование", + "req_id": "V15.3.7", + "req_description": "Убедитесь, что приложение защищено от атак типа HTTP Parameter Pollution (HPP), особенно если используемый фреймворк не различает источники параметров запроса (строка запроса, тело запроса, куки или заголовки).", + "L": "2" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.4", + "section_name": "Безопасная работа с параллельными процессами", + "req_id": "V15.4.1", + "req_description": "Убедитесь, что к общим объектам в многопоточном коде (например, кэшам, файлам или объектам в памяти, используемым несколькими потоками) используется безопасный многопоточный доступ и механизмов синхронизации, таких как блокировки или семафоры, чтобы избежать состояний гонки и повреждения данных.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.4", + "section_name": "Безопасная работа с параллельными процессами", + "req_id": "V15.4.2", + "req_description": "Убедитесь, что проверки состояния ресурса, например его существования или разрешений, а также зависящие от него действия выполняются как одна атомарная операция, чтобы предотвратить условия гонки времени проверки и времени использования (TOCTOU). Например, проверка существования файла перед его открытием или проверка прав доступа пользователя перед его предоставлением.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.4", + "section_name": "Безопасная работа с параллельными процессами", + "req_id": "V15.4.3", + "req_description": "Убедитесь, что блокировки применяются согласованно, чтобы предотвратить взаимные блокировки потоков (deadlocks) или их бесконечные повторы, а также что логика блокировки инкапсулирована в коде, отвечающем за управление ресурсом. Это гарантирует, что блокировки не могут быть случайно или намеренно изменены внешними классами или кодом.", + "L": "3" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.4", + "section_name": "Безопасная работа с параллельными процессами", + "req_id": "V15.4.4", + "req_description": "Убедитесь, что политики распределения ресурсов предотвращают нехватку ресурсов у потоков, обеспечивая справедливый доступ к ресурсам, например, используя пулы потоков, позволяя потокам с более низким приоритетом выполняться в течение разумного периода времени.", + "L": "3" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.1", + "section_name": "Документация по ведению логов", + "req_id": "V16.1.1", + "req_description": "Убедитесь в существовании реестра, в котором документируется ведение журнала на каждом уровне технологического стека приложения, включая какие события регистрируются, форматы логов, где хранятся эти журналы, как они используются, как контролируется доступ к ним и как долго хранятся журналы.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.2", + "section_name": "Общее журналирование", + "req_id": "V16.2.1", + "req_description": "Убедитесь, что каждая запись журнала содержит необходимые метаданные (например, когда, где, кто, что), которые позволят провести подробное исследование временной шкалы, когда произошло событие.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.2", + "section_name": "Общее журналирование", + "req_id": "V16.2.2", + "req_description": "Убедитесь, что все источники времени компонентов системы журналирования синхронизированы, а временные метки в метаданных событий безопасности используют UTC или содержат явное указание смещения часового пояса. Рекомендуется применять UTC для обеспечения согласованности в распределённых системах и предотвращения ошибок при переходе на летнее/зимнее время.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.2", + "section_name": "Общее журналирование", + "req_id": "V16.2.3", + "req_description": "Убедитесь, что приложение записывает и передаёт логи исключительно в те файлы и сервисы, которые указаны в реестре журналирования.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.2", + "section_name": "Общее журналирование", + "req_id": "V16.2.4", + "req_description": "Убедитесь, что логи могут быть прочитаны и коррелированы используемой системой обработки журналов, предпочтительно с использованием общего стандартного формата логирования.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.2", + "section_name": "Общее журналирование", + "req_id": "V16.2.5", + "req_description": "Убедитесь, что приложение применяет соответствующие меры защиты при логировании конфиденциальных данных в зависимости от уровня их чувствительности: например, полностью запрещает запись в логи таких данных, как учетные данные или платежные реквизиты, а для других данных (например, сессионных токенов) использует хеширование или частичное/полное маскирование.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.3", + "section_name": "Инциденты безопасности", + "req_id": "V16.3.1", + "req_description": "Убедитесь, что все операции аутентификации регистрируются, включая успешные и неудачные попытки. Также следует фиксировать дополнительные метаданные, такие как тип аутентификации или использованные факторы проверки.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.3", + "section_name": "Инциденты безопасности", + "req_id": "V16.3.2", + "req_description": "Убедитесь, что ведется журнал неудачных попыток авторизации. Для уровня L3 это должно включать в себя журналирование всех решений об авторизации, включая журналирование доступа к конфиденциальным данным (без регистрации самих конфиденциальных данных).", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.3", + "section_name": "Инциденты безопасности", + "req_id": "V16.3.3", + "req_description": "Убедитесь, что приложение регистрирует все события безопасности, определенные в документации, а также фиксирует попытки обхода механизмов защиты, включая проверку входных данных, бизнес-логики и системы защиты от автоматизированных атак.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.3", + "section_name": "Инциденты безопасности", + "req_id": "V16.3.4", + "req_description": "Убедитесь, что приложение регистрирует в журналах неожиданные ошибки и сбои механизмов безопасности, включая, например, ошибки TLS-соединения на стороне сервера.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.4", + "section_name": "Защита журналов", + "req_id": "V16.4.1", + "req_description": "Убедитесь, что все компоненты системы логирования корректно кодируют данные, чтобы предотвратить атаки типа внедрения в журналы (log injection).", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.4", + "section_name": "Защита журналов", + "req_id": "V16.4.2", + "req_description": "Убедитесь, что логи защищены от неавторизованного доступа и не могут быть модифицированы.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.4", + "section_name": "Защита журналов", + "req_id": "V16.4.3", + "req_description": "Убедитесь, что логи безопасно передаются в логически изолированную систему для анализа, обнаружения угроз, генерации оповещений и эскалации инцидентов. Это гарантирует сохранность журналов даже в случае компрометации основного приложения.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.5", + "section_name": "Обработка ошибок", + "req_id": "V16.5.1", + "req_description": "Убедитесь, что при возникновении непредвиденной или связанной с безопасностью ошибки пользователю возвращается только общее сообщение, гарантируя отсутствие раскрытия конфиденциальных внутренних данных системы, таких как трассировки стека, запросы, секретные ключи и токены.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.5", + "section_name": "Обработка ошибок", + "req_id": "V16.5.2", + "req_description": "Убедитесь, что приложение продолжает работать в безопасном режиме при недоступности внешних ресурсов, используя такие механизмы, как автоматические выключатели (circuit breakers) или плавное снижение функциональности (graceful degradation).", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.5", + "section_name": "Обработка ошибок", + "req_id": "V16.5.3", + "req_description": "Убедитесь, что приложение корректно и безопасно завершает работу при возникновении исключений, предотвращая опасные сценарии по типу «fail-open», когда, например, транзакция ошибочно выполняется, несмотря на ошибки в логике валидации.", + "L": "2" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.5", + "section_name": "Обработка ошибок", + "req_id": "V16.5.4", + "req_description": "Убедитесь, что определён обработчик ошибок «крайние меры», который будет перехватывать все необработанные ошибки. Это необходимо как для предотвращения потери информации об ошибках, которая должна быть записана в файлы журналов, так и для того, чтобы ошибка не остановила весь процесс приложения, что привело бы к потере доступности.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.1", + "section_name": "TURN-сервер", + "req_id": "V17.1.1", + "req_description": "Убедитесь, что сервис TURN (Traversal Using Relays around NAT) разрешает доступ только к IP-адресам, не зарезервированным для специальных целей (например, внутренние сети, широковещательная рассылка, loopback-адреса). Данное требование применяется как к IPv4, так и к IPv6 адресам.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.1", + "section_name": "TURN-сервер", + "req_id": "V17.1.2", + "req_description": "Убедитесь, что сервис TURN (Traversal Using Relays around NAT) защищен от исчерпания ресурсов при попытках легитимных пользователей открыть чрезмерное количество портов на сервере.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Требования к медиасерверам", + "req_id": "V17.2.1", + "req_description": "Убедитесь, что ключ сертификата Datagram Transport Layer Security (DTLS) управляется и защищается в соответствии с документированной политикой управления криптографическими ключами.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Требования к медиасерверам", + "req_id": "V17.2.2", + "req_description": "Убедитесь, что медиасервер настроен на использование только одобренных наборов шифров Datagram Transport Layer Security (DTLS) и защищенного профиля безопасности для расширения DTLS, применяемого при установке ключей для Secure Real-time Transport Protocol (DTLS-SRTP).", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Требования к медиасерверам", + "req_id": "V17.2.3", + "req_description": "Убедитесь, что медиасервер проверяет аутентификацию Secure Real-time Transport Protocol (SRTP) для предотвращения атак с внедрением Real-time Transport Protocol (RTP), которые могут привести к отказу в обслуживании (Denial of Service) или вставке поддельного аудио-/видеоконтента в медиапотоки.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Требования к медиасерверам", + "req_id": "V17.2.4", + "req_description": "Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика при получении некорректных пакетов Secure Real-time Transport Protocol (SRTP).", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Требования к медиасерверам", + "req_id": "V17.2.5", + "req_description": "Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетами Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Требования к медиасерверам", + "req_id": "V17.2.6", + "req_description": "Убедитесь, что медиасервер не подвержен уязвимости «Гонка ClientHello» (ClientHello Race Condition) в Datagram Transport Layer Security (DTLS), проверив наличие известных уязвимостей в публичных источниках или выполнив тестирование на воспроизведение условий гонки.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Требования к медиасерверам", + "req_id": "V17.2.7", + "req_description": "Убедитесь, что механизмы аудио- и видеозаписи, связанные с медиасервером, способны продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетов Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Требования к медиасерверам", + "req_id": "V17.2.8", + "req_description": "Убедитесь, что сертификат Datagram Transport Layer Security (DTLS) проверяется на соответствие атрибуту отпечатка (fingerprint) в Session Description Protocol (SDP), с немедленным прекращением медиапотока в случае несоответствия — это гарантирует подлинность передаваемых данных.", + "L": "3" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.3", + "section_name": "Сигнализация", + "req_id": "V17.3.1", + "req_description": "Убедитесь, что сигнальный сервер способен продолжать обработку легитимных входящих сообщений сигнализации даже в условиях флуд-атаки. Для этого необходимо реализовать механизм ограничения частоты запросов (rate limiting) на уровне сигнализации.", + "L": "2" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.3", + "section_name": "Сигнализация", + "req_id": "V17.3.2", + "req_description": "Убедитесь, что сигнальный сервер способен продолжать обработку легитимных сообщений сигнализации даже при получении некорректных сообщений, которые могут вызвать отказ в обслуживании (Denial of Service, DoS). Для этого необходимо реализовать: проверку входных данных (input validation), безопасную обработку целочисленных переполнений (integer overflows), защиту от переполнения буферов (buffer overflows) и другие надежные методы обработки ошибок.", + "L": "2" + } + ] +} diff --git a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.flat.legacy.json b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.flat.legacy.json new file mode 100644 index 0000000000..04adb2eb46 --- /dev/null +++ b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.flat.legacy.json @@ -0,0 +1,4489 @@ +{ + "requirements": [ + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.1", + "section_name": "Архитектура кодировки и нейтрализации", + "req_id": "V1.1.1", + "req_description": "Убедитесь, что входные данные декодируются или деэкранируются в каноническую форму (в стандартное представление) только один раз. Декодирование происходит только тогда, когда ожидаются закодированные данные в этой форме, и что это делается перед дальнейшей обработкой входных данных, например, это не выполняется после проверки или нейтрализации.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.1", + "section_name": "Архитектура кодировки и нейтрализации", + "req_id": "V1.1.2", + "req_description": "Убедитесь, что приложение выполняет кодирование и экранирование выходных данных либо в качестве последнего шага перед использованием интерпретатором, для которого оно предназначено, либо самим интерпретатором.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.1", + "req_description": "Убедитесь, что выходная кодировка для ответа HTTP, документа HTML или документа XML соответствует требуемому контексту, например, кодировка соответствующих символов для элементов HTML, атрибутов HTML, комментариев HTML, CSS или полей заголовка HTTP делается таким способом, чтобы избежать изменения структуры сообщения или документа.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.2", + "req_description": "Убедитесь, что при динамическом построении URL-адресов недоверенные данные кодируются в соответствии с их контекстом (например, кодирование URL-адресов или кодирование base64url для query или path параметров или пути). Убедитесь, что разрешены только безопасные протоколы URL-адресов (например, запрещен javascript: или data:).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.3", + "req_description": "Убедитесь, что при динамическом построении содержимого JavaScript (включая JSON) используется кодирование или экранирование выходных данных, чтобы избежать изменения структуры сообщения или документа (чтобы избежать JavaScript и JSON-инъекций).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.4", + "req_description": "Убедитесь, что выборка данных (Redis, Memcached, чтение из файлов, обращение по API) или запросы к базе данных (например, SQL, HQL, NoSQL, Cypher) используют параметризованные запросы, ORM, Entity Frameworks или иным образом защищены от SQL-инъекций и других атак. Это также актуально при написании хранимых процедур.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.5", + "req_description": "Убедитесь, что приложение защищено от внедрения команд ОС и что вызовы операционной системы используют параметризованные запросы к ОС или используют контекстное кодирование вывода командной строки.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.6", + "req_description": "Убедитесь, что приложение защищено от LDAP-инъекций, или что реализованы специальные меры безопасности для их предотвращения.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.7", + "req_description": "Убедитесь, что приложение защищено от атак с использованием XPath-инъекций с помощью параметризации запросов или предварительно скомпилированных запросов.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.8", + "req_description": "Убедитесь, что процессоры LaTeX настроены безопасно (например, не используется флаг «–shell‑escape») и используется разрешенный список команд для предотвращения LaTeX-инъекций.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.9", + "req_description": "Убедитесь, что приложение экранирует специальные символы в регулярных выражениях (обычно с помощью обратной косой черты), чтобы предотвратить их ошибочную интерпретацию как метасимволов.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.2", + "section_name": "Предотвращение инъекций", + "req_id": "V1.2.10", + "req_description": "Убедитесь, что приложение защищено от внедрения формул CSV (CSV Injection). Приложение должно следовать правилам экранирования, определенным в RFC 4180, разделы 2.6 и 2.7, при экспорте содержимого CSV. Кроме того, при экспорте в CSV или другие форматы электронных таблиц (такие как XLS, XLSX или ODF) специальные символы (включая '=', '+', '-', '@', '\\t' (табуляция), и '\\0' (нулевой символ)) должны экранироваться одинарной кавычкой, если они появляются в качестве первого символа в значении поля.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.1", + "req_description": "Убедитесь, что все ненадежные входные данные HTML из редакторов WYSIWYG или аналогичных программ нейтрализуются с помощью известных и безопасных библиотек или функций фреймворка для санитизации HTML.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.2", + "req_description": "Убедитесь, что приложение избегает использования eval() или других динамических функций выполнения кода, таких как Spring Expression Language (SpEL). Если нет альтернативы, любой пользовательский ввод должен быть нейтрализован перед выполнением.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.3", + "req_description": "Убедитесь, что данные, передаваемые в потенциально опасный контекст, предварительно нейтрализованы, чтобы обеспечить соблюдение мер безопасности, таких как разрешение только тех символов, которые безопасны для данного контекста, и обрезка слишком длинного ввода.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.4", + "req_description": "Убедитесь, что предоставленный пользователем файл .SVG проверен или нейтрализован, чтобы он содержал только теги и атрибуты (например, относящиеся к рисованию), которые безопасны для приложения, например, не содержат скриптов и foreignObject.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.5", + "req_description": "Убедитесь, что приложение нейтралует или отключает предоставленные пользователем скриптовые данные или выражения шаблонных языков, такие как таблицы стилей Markdown, CSS или XSL, BBCode или аналогичные.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.6", + "req_description": "Убедитесь, что приложение защищено от атак с подделкой запросов на стороне сервера (SSRF), проверяя ненадежные данные по разрешенному списку протоколов, доменов, путей и портов, а также нейтрализуя потенциально опасные символы перед использованием данных для вызова другой службы.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.7", + "req_description": "Убедитесь, что приложение защищено от атак с внедрением шаблонов (template injection), не позволяя создавать шаблоны на основе недоверенных входных данных. Если нет альтернативы, любые недоверенные входные данные, включаемые динамически во время создания шаблона, должны быть нейтрализованы или тщательно провалидированы.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.8", + "req_description": "Убедитесь, что приложение надлежащим образом нейтрализует недоверенные входные данные перед использованием в запросах Java Naming and Directory Interface (JNDI) и что JNDI настроен безопасно для предотвращения атак с использованием JNDI-инъекций.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.9", + "req_description": "Убедитесь, что приложение нейтрализует данные перед отправкой в Memcache, чтобы предотвратить атаки методом инъекций.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.10", + "req_description": "Убедитесь, что строки форматирования, которые могут быть использованы неожидаемым или вредоносным образом, нейтрализуются перед дальнейшим использованием.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.11", + "req_description": "Убедитесь, что приложение нейтрализует вводимые пользователем данные перед передачей в почтовые системы для защиты от SMTP или IMAP-инъекций.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.3", + "section_name": "Нейтрализация", + "req_id": "V1.3.12", + "req_description": "Убедитесь, что регулярные выражения не содержат элементов, вызывающих экспоненциальный возврат, и убедитесь в нейтрализации недоверенных входных данных для предотвращения атак ReDoS или Runaway Regex.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.4", + "section_name": "Память, строки и неуправляемый код", + "req_id": "V1.4.1", + "req_description": "Убедитесь, что для обнаружения или предотвращения ситуаций переполнения стека, буфера или кучи приложение учитывает размер доступной области памяти при строковых операциях, копировании в память, в арифметике указателей и т.п.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.4", + "section_name": "Память, строки и неуправляемый код", + "req_id": "V1.4.2", + "req_description": "Убедитесь, что для предотвращения целочисленного переполнения применяется контроль знака, диапазона и типа допустимых входных данных.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.4", + "section_name": "Память, строки и неуправляемый код", + "req_id": "V1.4.3", + "req_description": "Убедитесь, что динамически выделенная память и ресурсы освобождены, а ссылки или указатели на освобожденную память удалены или установлены в значение null, чтобы предотвратить появление висячих указателей и уязвимостей, связанных с использованием памяти после освобождения.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.5", + "section_name": "Безопасная десериализация", + "req_id": "V1.5.1", + "req_description": "Убедитесь, что приложение настраивает XML-парсеры на использование строгой конфигурации и что небезопасные функции, такие как разрешение внешних сущностей, отключены для предотвращения атак XML eXternal Entity (XXE).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.5", + "section_name": "Безопасная десериализация", + "req_id": "V1.5.2", + "req_description": "Убедитесь, что десериализация недоверенных данных обеспечивает безопасную обработку ввода, например, используя список разрешенных типов объектов или ограничивая типы объектов, определяемые клиентом, для предотвращения атак десериализации. Механизмы десериализации, которые явно определены как небезопасные, не должны использоваться с недоверенным вводом.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V1", + "chapter_name": "Кодировка и нейтрализация", + "section_id": "V1.5", + "section_name": "Безопасная десериализация", + "req_id": "V1.5.3", + "req_description": "Убедитесь, что различные парсеры, используемые в приложении для одного и того же типа данных (например, парсеры JSON, XML, URL), выполняют парсинг согласованным образом и используют один и тот же механизм кодирования символов, чтобы избежать таких проблем, как уязвимости взаимодействия JSON (JSON Interoperability) или различное поведение анализа URI или файлов, которые могут использоваться в атаках удаленного включения файлов (RFI) или подделки запросов на стороне сервера (SSRF).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.1", + "section_name": "Документация валидации и бизнес-логики", + "req_id": "V2.1.1", + "req_description": "Убедитесь, что в документации приложения определены правила проверки входных данных на соответствие ожидаемой структуре. Это могут быть распространённые форматы данных, такие как номера кредитных карт, адреса электронной почты, номера телефонов, или внутренний формат данных.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.1", + "section_name": "Документация валидации и бизнес-логики", + "req_id": "V2.1.2", + "req_description": "Убедитесь, что в документации приложения указано, как проверять логическую и контекстную согласованность объединенных данных, например, проверять соответствие района и почтового индекса.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.1", + "section_name": "Документация валидации и бизнес-логики", + "req_id": "V2.1.3", + "req_description": "Убедитесь, что ожидания относительно ограничений и проверок бизнес-логики задокументированы как для уровня отдельного пользователя, так и для глобального уровня всего приложения.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.2", + "section_name": "Валидация ввода", + "req_id": "V2.2.1", + "req_description": "Убедитесь, что входные данные провалидированы для обеспечения соответствия бизнес- или функциональным ожиданиям. Валидация должна осуществляться либо по списку допустимых значений, шаблонов и диапазонов, либо путем сравнения входных данных с ожидаемой структурой и логическими ограничениями в соответствии с предопределенными правилами. Для L1 валидация может быть сосредоточена на входных данных, используемых для принятия конкретных бизнес-решений или решений, связанных с безопасностью. Для L2 и выше это должно применяться ко всем входным данным.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.2", + "section_name": "Валидация ввода", + "req_id": "V2.2.2", + "req_description": "Убедитесь, что приложение разработано с принудительной валидацией входных данных на уровне доверенного сервиса. Хотя проверка на стороне клиента повышает удобство использования и должна поощряться, на неё не следует полагаться как на средство контроля безопасности.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.2", + "section_name": "Валидация ввода", + "req_id": "V2.2.3", + "req_description": "Убедитесь, что приложение обеспечивает обоснованность комбинаций данных в соответствии с предопределенными правилам. Например: возраст должен соответствовать дате рождения; страна и почтовый индекс; количество товара в заказе и на складе.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.3", + "section_name": "Безопасность бизнес-логики", + "req_id": "V2.3.1", + "req_description": "Убедитесь, что приложение обрабатывает потоки бизнес-логики для одного и того же пользователя в ожидаемом последовательном порядке шагов и без пропуска шагов.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.3", + "section_name": "Безопасность бизнес-логики", + "req_id": "V2.3.2", + "req_description": "Убедитесь, что ограничения бизнес-логики реализованы в соответствии с документацией приложения, чтобы избежать эксплуатации её недостатков.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.3", + "section_name": "Безопасность бизнес-логики", + "req_id": "V2.3.3", + "req_description": "Убедитесь, что транзакции используются на уровне бизнес-логики таким образом, что операция бизнес-логики либо выполняется полностью, либо откатывается к предыдущему корректному состоянию.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.3", + "section_name": "Безопасность бизнес-логики", + "req_id": "V2.3.4", + "req_description": "Убедитесь, что на уровне бизнес-логики используются механизмы блокировки, чтобы гарантировать невозможность двойного бронирования ограниченных по количеству ресурсов (например, мест в театре или слотов доставки) путем манипулирования логикой приложения.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.3", + "section_name": "Безопасность бизнес-логики", + "req_id": "V2.3.5", + "req_description": "Убедитесь, что для важных потоков бизнес-логики требуется многопользовательское (multi-user) одобрение, чтобы предотвратить несанкционированные или случайные действия. Потоки бизнес-логики могут включать, помимо прочего, крупные денежные переводы, утверждение контрактов, доступ к секретной информации или обход ограничений безопасности на производстве.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.4", + "section_name": "Анти-автоматизация", + "req_id": "V2.4.1", + "req_description": "Убедитесь, что используются средства противодействия автоматизации для защиты от чрезмерных вызовов функций приложения, которые могут привести к утечке данных, созданию ненужных данных, исчерпанию квот, нарушению ограничений скорости, отказу в обслуживании или чрезмерному использованию дорогостоящих ресурсов.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V2", + "chapter_name": "Валидация и бизнес-логика", + "section_id": "V2.4", + "section_name": "Анти-автоматизация", + "req_id": "V2.4.2", + "req_description": "Убедитесь, что потоки бизнес-логики требуют реалистичного человеческого времени, предотвращая чрезмерно быструю отправку транзакций.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.1", + "section_name": "Документация по безопасности веб-интерфейса", + "req_id": "V3.1.1", + "req_description": "Убедитесь, что в документации приложения описаны ожидаемые функции безопасности, которые должны поддерживать браузеры, использующие приложение (такие как HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) и другие соответствующие механизмы безопасности HTTP). В документации также должно быть обязательно определено, как приложение должно себя вести, если некоторые из этих функций недоступны (например, предупреждать пользователя или блокировать доступ).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.2", + "section_name": "Непреднамеренная интерпретация контента", + "req_id": "V3.2.1", + "req_description": "Убедитесь, что реализованы меры безопасности, предотвращающие отображение контента или функций браузерами в HTTP-ответах в некорректном контексте (например, запрос API, загруженный пользователем файл или другой ресурс запрашивается напрямую). Возможные способы контроля включают: не обрабатывать содержимое, если поля заголовка HTTP-запроса (например, Sec-Fetch-*) не указывают на корректность контекста; использование заголовка и значения Content-Security-Policy: sandbox directive; или использование заголовка и значения Content-Disposition: attachment.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.2", + "section_name": "Непреднамеренная интерпретация контента", + "req_id": "V3.2.2", + "req_description": "Убедитесь, что данные, предназначенные для отображения в виде текста, а не визуализации в виде HTML, обрабатывается с использованием безопасных функций визуализации (таких как createTextNode или textContent), чтобы предотвратить непреднамеренное выполнение содержимого, такого как HTML или JavaScript.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.2", + "section_name": "Непреднамеренная интерпретация контента", + "req_id": "V3.2.3", + "req_description": "Убедитесь, что приложение избегает затирания DOM при использовании JavaScript на стороне клиента, применяя явные объявления переменных, выполняя строгую проверку типов, избегая сохранения глобальных переменных в объекте документа и реализуя изоляцию пространства имен.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.3", + "section_name": "Настройка файлов cookie", + "req_id": "V3.3.1", + "req_description": "Убедитесь, что у файлов cookie установлен атрибут «Secure», и если префикс «__Host‑» не используется в названии cookie, необходимо использовать префикс «__Secure‑».", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.3", + "section_name": "Настройка файлов cookie", + "req_id": "V3.3.2", + "req_description": "Убедитесь, что значение атрибута SameSite каждой cookie установлено в соответствии с назначением cookie, чтобы ограничить подверженность атакам на восстановление пользовательского интерфейса и атакам с подделкой запросов на уровне браузера, обычно называемым подделкой межсайтовых запросов (CSRF).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.3", + "section_name": "Настройка файлов cookie", + "req_id": "V3.3.3", + "req_description": "Убедитесь, что cookie имеют префикс «__Host‑» в названии, если только они явно не предназначены для совместного использования с другими хостами.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.3", + "section_name": "Настройка файлов cookie", + "req_id": "V3.3.4", + "req_description": "Убедитесь, что если значение cookie не должно быть доступно для клиентских скриптов (например, сессионный токен), для cookie должен быть установлен атрибут «HttpOnly», а само значение должно передаваться клиенту только через поле заголовка «Set-Cookie».", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.3", + "section_name": "Настройка файлов cookie", + "req_id": "V3.3.5", + "req_description": "Убедитесь, что при записи cookie приложением общая длина имени и значения cookie не превышает 4096 байт. Слишком большие cookie не будут сохраняться браузером и, следовательно, не будут отправляться с запросами, что помешает пользователю использовать функции приложения, зависящие от этого cookie.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.4", + "section_name": "Заголовки механизма безопасности браузера", + "req_id": "V3.4.1", + "req_description": "Убедитесь, что поле заголовка Strict‑Transport‑Security включено во все ответы для реализации политики HTTP Strict Transport Security (HSTS). Необходимо указать максимальное время не менее 1 года, а для L2 и выше политика должна применяться также ко всем поддоменам.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.4", + "section_name": "Заголовки механизма безопасности браузера", + "req_id": "V3.4.2", + "req_description": "Убедитесь, что поле заголовка Cross‑Origin Resource Sharing (CORS) «Access‑Control‑Allow‑Origin» имеет фиксированное значение, заданное приложением, или, если используется заголовок Origin, оно проверяется по списку доверенных источников. При необходимости использования «Access‑Control‑Allow‑Origin: *» убедитесь, что ответ не содержит конфиденциальной информации.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.4", + "section_name": "Заголовки механизма безопасности браузера", + "req_id": "V3.4.3", + "req_description": "Убедитесь, что HTTP-ответы содержат поле заголовка Content-Security-Policy, которое определяет директивы, гарантирующие загрузку и выполнение браузером только доверенного контента или ресурсов, чтобы ограничить выполнение вредоносного JavaScript. Как минимум, необходимо использовать глобальную политику, включающую директивы object-src «none» и base-uri «none», а также определяющую список разрешенных адресов или использующую одноразовые коды или хэши. Для приложений L3 необходимо определить политику использования 'nonce' или hash-конструкций для каждого ответа.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.4", + "section_name": "Заголовки механизма безопасности браузера", + "req_id": "V3.4.4", + "req_description": "Убедитесь, что все HTTP-ответы содержат поле заголовка «X‑Content‑Type‑Options: nosniff». Это предписывает браузерам не использовать анализ контента и определение типа MIME для данного ответа, а также требовать, чтобы значение поля заголовка Content‑Type в ответе соответствовало целевому ресурсу. Например, ответ на запрос стиля принимается только в том случае, если Content‑Type в ответе — «text/css». Это также позволяет браузеру использовать функцию Cross‑Origin Read Blocking (CORB).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.4", + "section_name": "Заголовки механизма безопасности браузера", + "req_id": "V3.4.5", + "req_description": "Убедитесь, что приложение устанавливает политику реферера для предотвращения утечки технически конфиденциальных данных сторонним сервисам через поле заголовка HTTP-запроса «Referer». Это можно сделать с помощью поля заголовка HTTP-ответа «Referrer‑Policy» или через атрибуты HTML-элемента. Конфиденциальные данные могут включать путь и данные запроса в URL-адресе, а для внутренних непубличных приложений также имя хоста.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.4", + "section_name": "Заголовки механизма безопасности браузера", + "req_id": "V3.4.6", + "req_description": "Убедитесь, что веб-приложение использует директиву frame‑ancestors поля заголовка Content‑Security‑Policy для каждого HTTP-ответа, чтобы гарантировать невозможность его внедрения по умолчанию и внедрение определённых ресурсов разрешено только при необходимости. Обратите внимание, что поле заголовка X‑Frame‑Options, хотя и поддерживается браузерами, устарело и не может быть использовано в качестве основы.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.4", + "section_name": "Заголовки механизма безопасности браузера", + "req_id": "V3.4.7", + "req_description": "Убедитесь, что в поле заголовка Content‑Security‑Policy указано место, куда следует сообщать о нарушениях.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.4", + "section_name": "Заголовки механизма безопасности браузера", + "req_id": "V3.4.8", + "req_description": "Убедитесь, что все HTTP-ответы, инициирующие рендеринг документа (например, ответы с типом содержимого text/html), включают поле заголовка Cross-Origin-Opener-Policy с директивой same-origin или same-origin-allow-popups (при необходимости). Это предотвращает атаки, злоупотребляющие общим доступом к объектам Window, такие как Tabnabbing и Frame Counting.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.5", + "section_name": "Браузерное разделение источников", + "req_id": "V3.5.1", + "req_description": "Убедитесь, что, если приложение не использует механизм предварительной проверки CORS для предотвращения запрещённых кросс-доменных запросов на использование чувствительного функционала, эти запросы валидируются на предмет их происхождения от самого приложения. Это можно сделать, используя и проверяя специальные токены для защиты от подделки или требуя дополнительные поля HTTP-заголовка, не входящие в список «простых заголовков» (CORS-safelisted request-header). Это необходимо для защиты от атак с подделкой запросов через браузер, широко известных как межсайтовая подделка запросов (CSRF).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.5", + "section_name": "Браузерное разделение источников", + "req_id": "V3.5.2", + "req_description": "Убедитесь, что если приложение использует механизм предварительной проверки CORS для предотвращения неразрешённого использования чувствительного функционала между источниками, вызов этого функционала невозможен с помощью запроса, который не запускает предварительную проверку CORS. Для этого может потребоваться проверка значений полей заголовка запроса «Origin» и «Content-Type» или использование дополнительного поля заголовка, не входящего в безопасный список CORS.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.5", + "section_name": "Браузерное разделение источников", + "req_id": "V3.5.3", + "req_description": "Убедитесь, что HTTP-запросы к чувствительному функционалу используют соответствующие HTTP-методы, такие как POST, PUT, PATCH или DELETE, а не методы, определённые спецификацией HTTP как «безопасные», такие как HEAD, OPTIONS или GET. В качестве альтернативы можно использовать строгую валидацию полей заголовка запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, навигационного запроса или загрузки ресурса (например, источника изображения), где это не ожидается.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.5", + "section_name": "Браузерное разделение источников", + "req_id": "V3.5.4", + "req_description": "Убедитесь, что отдельные приложения размещены на разных именах хостов, чтобы использовать ограничения, предусмотренные политикой same-origin, включая то, как документы или скрипты, загруженные одним источником, могут взаимодействовать с ресурсами из другого источника, а также ограничения на cookie на основе имени хоста.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.5", + "section_name": "Браузерное разделение источников", + "req_id": "V3.5.5", + "req_description": "Убедитесь, что сообщения, полученные интерфейсом postMessage, отвергаются, если источник сообщения не является доверенным или если синтаксис сообщения недействителен.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.5", + "section_name": "Браузерное разделение источников", + "req_id": "V3.5.6", + "req_description": "Убедитесь, что функциональность JSONP не включена нигде в приложении, чтобы избежать атак с использованием межсайтового включения скриптов (XSSI).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.5", + "section_name": "Браузерное разделение источников", + "req_id": "V3.5.7", + "req_description": "Убедитесь, что данные, требующие авторизации, не включены в ответы ресурсов скриптов, таких как файлы JavaScript, чтобы предотвратить атаки с использованием межсайтового включения скриптов (XSSI).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.5", + "section_name": "Браузерное разделение источников", + "req_id": "V3.5.8", + "req_description": "Убедитесь, что аутентифицированные ресурсы (такие как изображения, видео, скрипты и другие документы) могут быть загружены или внедрены от имени пользователя только по назначению. Этого можно добиться путём строгой валидации полей заголовка HTTP-запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, или путём установки ограничительного поля заголовка HTTP-ответа Cross‑Origin‑Resource‑Policy, чтобы браузер блокировал возвращаемый контент.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.6", + "section_name": "Целостность внешних ресурсов", + "req_id": "V3.6.1", + "req_description": "Убедитесь, что клиентские ресурсы, такие как библиотеки JavaScript, CSS или веб-шрифты, размещаются только на внешнем сервере (например, в сети доставки контента (Content Delivery Network)), если ресурс статический и имеет версии, а для проверки целостности ресурса используется механизм проверки целостности подресурсов (SRI). Если это невозможно, для каждого ресурса должно быть задокументировано решение по безопасности, обосновывающее это.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.7", + "section_name": "Другие соображения по безопасности браузера", + "req_id": "V3.7.1", + "req_description": "Убедитесь, что приложение использует только те клиентские технологии, которые по-прежнему поддерживаются и считаются безопасными. Примерами технологий, не соответствующих этому требованию, являются плагины NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL или клиентские Java-апплеты.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.7", + "section_name": "Другие соображения по безопасности браузера", + "req_id": "V3.7.2", + "req_description": "Убедитесь, что приложение будет автоматически перенаправлять пользователя на другое имя хоста или домен (который не контролируется приложением), только если этот хост или домен указаны в списке разрешенных.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.7", + "section_name": "Другие соображения по безопасности браузера", + "req_id": "V3.7.3", + "req_description": "Убедитесь, что приложение отображает уведомление, что пользователь перенаправляется на URL-адрес, находящийся вне контроля приложения, с возможностью отмены навигации.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.7", + "section_name": "Другие соображения по безопасности браузера", + "req_id": "V3.7.4", + "req_description": "Убедитесь, что домен верхнего уровня приложения (например, site.tld) ​​добавлен в публичный список предварительной загрузки (preload list) для HTTP Strict Transport Security (HSTS). Это гарантирует, что использование TLS для приложения будет встроено непосредственно в основные браузеры, а не будет полагаться только на поле заголовка ответа Strict-Transport-Security.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V3", + "chapter_name": "Безопасность веб-интерфейса", + "section_id": "V3.7", + "section_name": "Другие соображения по безопасности браузера", + "req_id": "V3.7.5", + "req_description": "Убедитесь, что приложение ведет себя так, как описано в документации (например, предупреждает пользователя или блокирует доступ), если браузер, используемый для доступа к приложению, не поддерживает ожидаемые функции безопасности.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.1", + "section_name": "Общая безопасность веб-сервисов", + "req_id": "V4.1.1", + "req_description": "Убедитесь, что каждый HTTP-ответ с телом сообщения содержит заголовок Content-Type, который соответствует фактическому содержимому ответа, таким как «text/», «/+xml» и «/xml», включая параметр charset для указания безопасной кодировки символов (например, UTF-8, ISO-8859-1) согласно IANA Media Types.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.1", + "section_name": "Общая безопасность веб-сервисов", + "req_id": "V4.1.2", + "req_description": "Убедитесь, что только конечные точки, предназначенные для взаимодействия с пользователем через веб-браузер, автоматически перенаправляют HTTP на HTTPS, в то время как другие сервисы или конечные точки не реализуют прозрачные редиректы. Это необходимо, чтобы избежать ситуации, когда клиент ошибочно отправляет незашифрованные HTTP-запросы а из-за того, что запрос по HTTP автоматически перенаправляется на HTTPS другим сервисом без обработки на входе, утечка чувствительных данных остаётся незамеченной.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.1", + "section_name": "Общая безопасность веб-сервисов", + "req_id": "V4.1.3", + "req_description": "Убедитесь, что любой HTTP-заголовок, используемый приложением и устанавливаемый промежуточным уровнем, таким как балансировщик нагрузки, веб-прокси или backend-for-frontend сервис, не может быть переопределён конечным пользователем. Примеры заголовков: X-Real-IP, X-Forwarded-*, X-User-ID.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.1", + "section_name": "Общая безопасность веб-сервисов", + "req_id": "V4.1.4", + "req_description": "Убедитесь, что разрешены только HTTP-методы, которые явно поддерживаются приложением или его API (включая OPTIONS для preflight-запросов), а неиспользуемые методы заблокированы.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.1", + "section_name": "Общая безопасность веб-сервисов", + "req_id": "V4.1.5", + "req_description": "Убедитесь, что для особо чувствительных запросов или транзакций, проходящих через несколько систем, используются цифровые подписи на уровне сообщений, дополнительно к транспортным средствам защиты.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.2", + "section_name": "Валидация структуры HTTP-сообщений", + "req_id": "V4.2.1", + "req_description": "Убедитесь, что все компоненты приложения (включая балансировщики нагрузки, файрволы и серверы приложений) определяют границы входящих HTTP-сообщений с использованием механизма, соответствующего версии HTTP, чтобы предотвратить HTTP request smuggling. В HTTP/1.x, если присутствует заголовок Transfer-Encoding, заголовок Content-Length должен игнорироваться согласно RFC 2616. При использовании HTTP/2 или HTTP/3, если присутствует Content-Length, веб-сервер должен убедиться, что он совпадает с длиной DATA-фреймов.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.2", + "section_name": "Валидация структуры HTTP-сообщений", + "req_id": "V4.2.2", + "req_description": "Убедитесь, что при генерации HTTP-сообщений заголовок Content-Length не конфликтует с длиной содержимого, определяемой рамками протокола HTTP, чтобы предотвратить HTTP Request Smuggling.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.2", + "section_name": "Валидация структуры HTTP-сообщений", + "req_id": "V4.2.3", + "req_description": "Убедитесь, что приложение не отправляет и не принимает HTTP/2 и HTTP/3 сообщения с заголовками, специфичными для соединения, такими как Transfer-Encoding, чтобы предотвратить HTTP Response Splitting и HTTP Header Injection.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.2", + "section_name": "Валидация структуры HTTP-сообщений", + "req_id": "V4.2.4", + "req_description": "Убедитесь, что приложение принимает HTTP/2 и HTTP/3 запросы только в случае, если поля заголовков и их значения не содержат последовательностей CR (\\r), LF (\\n) или CRLF (\\r\\n), чтобы предотвратить HTTP Header Injection.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.2", + "section_name": "Валидация структуры HTTP-сообщений", + "req_id": "V4.2.5", + "req_description": "Убедитесь, что если приложение (бекенд или фронтенд) формирует и отправляет запросы, оно использует валидацию, очистку или другие механизмы, чтобы не создавать URI (например, для API-вызовов) или HTTP-заголовки (например, Authorization или Cookie) слишком большой длины, чтобы их не принимал приёмник. Это может привести к отказу в обслуживании, например, при отправке слишком длинного запроса (длинный cookie-заголовок), из-за чего сервер постоянно возвращает ошибку.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.3", + "section_name": "GraphQL", + "req_id": "V4.3.1", + "req_description": "Убедитесь, что используется белый список запросов, ограничение глубины вложенности, ограничение количества или анализ стоимости запроса, чтобы предотвратить DoS-атаки на уровне GraphQL или слоя данных из-за дорогостоящих вложенных запросов.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.3", + "section_name": "GraphQL", + "req_id": "V4.3.2", + "req_description": "Убедитесь, что introspection-запросы GraphQL отключены в продакшен-среде, если GraphQL API не предназначен для использования сторонними клиентами.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.1", + "req_description": "Убедитесь, что для всех WebSocket-соединений используется WebSocket поверх TLS (WSS).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.2", + "req_description": "Убедитесь, что при первоначальном HTTP WebSocket handshake заголовок Origin проверяется на соответствие списку разрешённых источников для приложения.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.3", + "req_description": "Убедитесь, что если стандартное управление сессиями приложения не может быть использовано, применяются специальные токены, соответствующие требованиям безопасности управления сессиями.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V4", + "chapter_name": "API и Веб-сервис", + "section_id": "V4.4", + "section_name": "WebSocket", + "req_id": "V4.4.4", + "req_description": "Убедитесь, что специальные токены управления сессиями WebSocket изначально получаются или валидируются через ранее аутентифицированную HTTPS-сессию при переходе от HTTPS к WebSocket.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.1", + "section_name": "Документация по работе с файлами", + "req_id": "V5.1.1", + "req_description": "Убедитесь, что документация определяет допустимые типы файлов, ожидаемые расширения и максимальный размер (включая распакованный размер) для каждой функции загрузки. Также убедитесь, что в документации указано, как файлы обезвреживаются для конечных пользователей (например, как приложение ведёт себя при обнаружении вредоносного файла).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.2", + "section_name": "Загрузка файлов и содержимое", + "req_id": "V5.2.1", + "req_description": "Убедитесь, что приложение принимает только те файлы, которые может обработать без потери производительности или отказа в обслуживании.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.2", + "section_name": "Загрузка файлов и содержимое", + "req_id": "V5.2.2", + "req_description": "Убедитесь, что при загрузке файла (включая файлы внутри архивов, таких как ZIP) приложение проверяет, соответствует ли расширение ожидаемому, и валидирует, соответствует ли содержимое типу, указанному в расширении. Это включает проверку начальных 'magic bytes', перезапись изображений, использование специализированных библиотек. Для уровня 1 — достаточно проверок для файлов, критичных с точки зрения бизнеса или безопасности. Для уровней 2 и выше — для всех файлов.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.2", + "section_name": "Загрузка файлов и содержимое", + "req_id": "V5.2.3", + "req_description": "Убедитесь, что приложение проверяет архивы (например, zip, gz, docx, odt) на максимально допустимый распакованный размер и максимальное количество файлов до распаковки.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.2", + "section_name": "Загрузка файлов и содержимое", + "req_id": "V5.2.4", + "req_description": "Убедитесь, что для каждого пользователя установлены квоты на общий размер и количество файлов, чтобы один пользователь не мог переполнить хранилище.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.2", + "section_name": "Загрузка файлов и содержимое", + "req_id": "V5.2.5", + "req_description": "Убедитесь, что приложение не позволяет загружать архивы с символьными ссылками (symlinks), если это не требуется по бизнес-логике. Если требуется — разрешён только строго определённый список допустимых символьных ссылок.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.2", + "section_name": "Загрузка файлов и содержимое", + "req_id": "V5.2.6", + "req_description": "Убедитесь, что приложение отклоняет изображения с числом пикселей выше допустимого, чтобы предотвратить атаки 'pixel flood'.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.3", + "section_name": "Хранение файлов", + "req_id": "V5.3.1", + "req_description": "Убедитесь, что загруженные или сгенерированные из недоверенного ввода файлы, находящиеся в публичной директории, не исполняются как серверный код при обращении к ним по HTTP.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.3", + "section_name": "Хранение файлов", + "req_id": "V5.3.2", + "req_description": "Убедитесь, что при создании путей к файлам приложение использует внутренние или доверенные данные, а не пользовательские имена файлов. Если использование пользовательских имён или метаданных необходимо — требуется строгая проверка и очистка. Это защита от path traversal, LFI, RFI и SSRF.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.3", + "section_name": "Хранение файлов", + "req_id": "V5.3.3", + "req_description": "Убедитесь, что при обработке файлов на сервере (например, при распаковке) игнорируются пути, заданные пользователем, во избежание уязвимостей типа 'zip slip'.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.4", + "section_name": "Скачивание файлов", + "req_id": "V5.4.1", + "req_description": "Убедитесь, что приложение валидирует или игнорирует имена файлов, переданных пользователем (включая в JSON, JSONP или URL-параметре), и указывает имя файла в заголовке Content-Disposition при ответе.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.4", + "section_name": "Скачивание файлов", + "req_id": "V5.4.2", + "req_description": "Убедитесь, что имена файлов, передаваемые (например, в HTTP-заголовках или вложениях в email), кодируются или очищаются (например, по RFC 6266), чтобы сохранить структуру документа и предотвратить инъекции.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V5", + "chapter_name": "Работа с файлами", + "section_id": "V5.4", + "section_name": "Скачивание файлов", + "req_id": "V5.4.3", + "req_description": "Убедитесь, что файлы, полученные из недоверенных источников, сканируются антивирусом, чтобы не распространять известное вредоносное содержимое.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.1", + "section_name": "Документация по аутентификации", + "req_id": "V6.1.1", + "req_description": "Убедитесь, что в документации приложения описано, как используются механизмы, такие как ограничение частоты запросов (rate limiting), защита от автоматизации и адаптивные реакции, для защиты от атак, таких как подстановка учётных данных и перебор паролей. Документация должна ясно описывать конфигурацию этих механизмов и предотвращение злонамеренной блокировки аккаунтов.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.1", + "section_name": "Документация по аутентификации", + "req_id": "V6.1.2", + "req_description": "Убедитесь, что задокументирован список контекстно-зависимых слов, запрещённых к использованию в паролях. В него могут входить производные от названий организаций, продуктов, идентификаторов систем, кодовых названий проектов, названий отделов или ролей и тому подобное.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.1", + "section_name": "Документация по аутентификации", + "req_id": "V6.1.3", + "req_description": "Убедитесь, что если приложение поддерживает несколько способов аутентификации, то все они документированы вместе с описанием применяемых средств защиты и уровнем стойкости аутентификации, которые должны быть одинаково применены ко всем способам.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.1", + "req_description": "Убедитесь, что пользовательские пароли содержат не менее 8 символов. Рекомендуется минимальная длина в 15 символов.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.2", + "req_description": "Убедитесь, что пользователи могут менять свои пароли.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.3", + "req_description": "Убедитесь, что для смены пароля требуется ввести как текущий, так и новый пароль.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.4", + "req_description": "Убедитесь, что при регистрации или смене пароля введённый пароль проверяется по списку как минимум из 3000 самых популярных паролей, соответствующих политике (например, минимальной длине).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.5", + "req_description": "Убедитесь, что допускаются пароли любой структуры, без ограничений на использование определённых символов. Не должно быть требований по обязательному наличию заглавных/строчных букв, цифр или специальных символов.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.6", + "req_description": "Убедитесь, что поля ввода пароля используют type=password для скрытия символов. Разрешено временное отображение всего пароля или последнего введённого символа.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.7", + "req_description": "Убедитесь, что разрешены вставка (paste), использование менеджеров паролей браузера и внешних менеджеров паролей.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.8", + "req_description": "Убедитесь, что пароль проверяется строго в том виде, в котором он был введён пользователем — без обрезки, изменения регистра и других модификаций.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.9", + "req_description": "Убедитесь, что система позволяет использовать пароли длиной не менее 64 символов.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.10", + "req_description": "Убедитесь, что пароль остаётся действительным, пока не будет скомпрометирован или не будет изменён пользователем. Приложение не должно требовать регулярной смены пароля.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.11", + "req_description": "Убедитесь, что используется документированный список контекстно-зависимых слов (например, названия компаний, проектов и т.д.) для предотвращения использования легко угадываемых паролей.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.2", + "section_name": "Безопасность паролей", + "req_id": "V6.2.12", + "req_description": "Убедитесь, что при регистрации или смене пароля проверяется, не входит ли он в список скомпрометированных (утёкших) паролей.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.3", + "section_name": "Общие требования к безопасности аутентификации", + "req_id": "V6.3.1", + "req_description": "Убедитесь, что реализованы меры защиты от атак типа credential stuffing (массовая подстановка учётных данных) и brute-force (перебор паролей), согласно документации по безопасности приложения.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.3", + "section_name": "Общие требования к безопасности аутентификации", + "req_id": "V6.3.2", + "req_description": "Убедитесь, что в приложении отсутствуют или отключены учётные записи по умолчанию (например, root, admin, sa).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.3", + "section_name": "Общие требования к безопасности аутентификации", + "req_id": "V6.3.3", + "req_description": "Убедитесь, что для доступа к приложению используется либо механизм многофакторной аутентификации, либо комбинация однофакторных. Для уровня L3 один из факторов должен быть аппаратным, обеспечивающим защиту от фишинга, устойчивость к компрометации и подтверждение намерения аутентификации через явное действие пользователя (например, нажатие кнопки на FIDO-ключе или телефоне). Ослабление этих требований допускается только при наличии обоснования и компенсирующих мер.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.3", + "section_name": "Общие требования к безопасности аутентификации", + "req_id": "V6.3.4", + "req_description": "Убедитесь, что при наличии нескольких способов аутентификации, они все задокументированы, и для них единообразно применяются меры защиты и уровни доверия.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.3", + "section_name": "Общие требования к безопасности аутентификации", + "req_id": "V6.3.5", + "req_description": "Убедитесь, что пользователи получают уведомления о подозрительных попытках аутентификации (удачных и неудачных). Это может включать попытки (например, подключения) с необычного устройства или места, частично успешную MFA, попытку после долгого отсутствия или успешную аутентификацию после серии неудачных.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.3", + "section_name": "Общие требования к безопасности аутентификации", + "req_id": "V6.3.6", + "req_description": "Убедитесь, что email не используется ни как однофакторный, ни как многофакторный механизм аутентификации.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.3", + "section_name": "Общие требования к безопасности аутентификации", + "req_id": "V6.3.7", + "req_description": "Убедитесь, что пользователи получают уведомление при изменении данных аутентификации, таких как сброс пароля или изменение логина/email.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.3", + "section_name": "Общие требования к безопасности аутентификации", + "req_id": "V6.3.8", + "req_description": "Убедитесь, что из сообщений об ошибке, HTTP-кодов ответа или различий во времени ответа нельзя определить, существует ли пользователь с таким логином. Это правило также должно применяться к функциям регистрации и восстановления пароля.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.4", + "section_name": "Жизненный цикл и восстановление факторов аутентификации", + "req_id": "V6.4.1", + "req_description": "Убедитесь, что начальные пароли или коды активации, генерируемые системой, создаются с использованием надёжного генератора случайных чисел, соответствуют текущей политике паролей и истекают через короткий период времени либо после первого использования. Эти секреты не должны использоваться как постоянные пароли.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.4", + "section_name": "Жизненный цикл и восстановление факторов аутентификации", + "req_id": "V6.4.2", + "req_description": "Убедитесь, что в системе отсутствуют подсказки к паролю или вопросы на знание («секретные вопросы»).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.4", + "section_name": "Жизненный цикл и восстановление факторов аутентификации", + "req_id": "V6.4.3", + "req_description": "Убедитесь, что реализован безопасный процесс сброса забытого пароля, который не обходит активные механизмы многофакторной аутентификации.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.4", + "section_name": "Жизненный цикл и восстановление факторов аутентификации", + "req_id": "V6.4.4", + "req_description": "Убедитесь, что в случае утраты одного из факторов MFA проводится удостоверение личности (identity proofing) на том же уровне, что и при первичной регистрации.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.4", + "section_name": "Жизненный цикл и восстановление факторов аутентификации", + "req_id": "V6.4.5", + "req_description": "Убедитесь, что инструкции по обновлению истекающих механизмов аутентификации отправляются заранее, с достаточным запасом времени для выполнения замены, при необходимости с настройкой автоматических напоминаний.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.4", + "section_name": "Жизненный цикл и восстановление факторов аутентификации", + "req_id": "V6.4.6", + "req_description": "Убедитесь, что администраторы могут инициировать процесс сброса пароля, но не могут задать или выбрать новый пароль за пользователя. Это исключает ситуацию, при которой администратор знает пароль пользователя.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.5", + "section_name": "Общие требования к многофакторной аутентификации", + "req_id": "V6.5.1", + "req_description": "Убедитесь, что lookup-секреты, внеполосные коды/запросы и TOTP-коды можно использовать только один раз.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.5", + "section_name": "Общие требования к многофакторной аутентификации", + "req_id": "V6.5.2", + "req_description": "Убедитесь, что при хранении lookup-секретов с энтропией менее 112 бит (например, 19 случайных буквенно-цифровых символов или 34 случайные цифры) они хэшируются с использованием разрешённого алгоритма хеширования паролей и случайной соли минимум 32 бита. Если у секрета ≥112 бит энтропии — допустимо использовать стандартный хэш.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.5", + "section_name": "Общие требования к многофакторной аутентификации", + "req_id": "V6.5.3", + "req_description": "Убедитесь, что lookup-секреты, коды внеполосной аутентификации и сиды для TOTP генерируются с использованием криптографически стойкого генератора случайных чисел (CSPRNG), чтобы избежать предсказуемых значений.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.5", + "section_name": "Общие требования к многофакторной аутентификации", + "req_id": "V6.5.4", + "req_description": "Убедитесь, что lookup-секреты и внеполосные коды аутентификации имеют минимум 20 бит энтропии (достаточно, например, 4 случайных алфавитно-цифровых символов или 6 случайных цифр).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.5", + "section_name": "Общие требования к многофакторной аутентификации", + "req_id": "V6.5.5", + "req_description": "Убедитесь, что все внеполосные запросы, коды и токены, а также TOTP-коды имеют ограниченный срок действия. Максимум для out-of-band — 10 минут, для TOTP — 30 секунд.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.5", + "section_name": "Общие требования к многофакторной аутентификации", + "req_id": "V6.5.6", + "req_description": "Убедитесь, что любой фактор аутентификации (включая физические устройства) может быть отозван в случае кражи или утери.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.5", + "section_name": "Общие требования к многофакторной аутентификации", + "req_id": "V6.5.7", + "req_description": "Убедитесь, что биометрические механизмы аутентификации используются только как вторичный фактор — в сочетании с «чем-то, что вы знаете» или «чем-то, что у вас есть».", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.5", + "section_name": "Общие требования к многофакторной аутентификации", + "req_id": "V6.5.8", + "req_description": "Убедитесь, что TOTP-коды проверяются по источнику времени, полученному от доверенного сервиса, а не от клиента или недоверенного источника.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.6", + "section_name": "Внеполосные механизмы аутентификации", + "req_id": "V6.6.1", + "req_description": "Убедитесь, что механизмы аутентификации через телефонную сеть общего пользования (PSTN) для доставки одноразовых паролей (OTP) по телефону или SMS используются только в случае предварительной валидации номера, при этом предлагаются альтернативные более безопасные методы (например, TOTP), и пользователю сообщаются риски. Для приложений уровня L3 использование телефона и SMS недопустимо.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.6", + "section_name": "Внеполосные механизмы аутентификации", + "req_id": "V6.6.2", + "req_description": "Убедитесь, что внеполосные запросы, коды или токены привязаны к исходному запросу аутентификации, для которого они были сгенерированы, и не могут быть использованы повторно для других попыток.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.6", + "section_name": "Внеполосные механизмы аутентификации", + "req_id": "V6.6.3", + "req_description": "Убедитесь, что внеполосные механизмы на основе кода защищены от атак методом подбора (brute force) путём применения ограничения частоты запросов (rate limiting). Также рекомендуется использовать коды с энтропией не менее 64 бит.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.6", + "section_name": "Внеполосные механизмы аутентификации", + "req_id": "V6.6.4", + "req_description": "Убедитесь, что при использовании push-уведомлений для MFA применяется ограничение частоты (rate limiting), чтобы предотвратить атаки push-бомбинга. Также может помочь механизм сопоставления номеров (number matching).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.7", + "section_name": "Криптографические механизмы аутентификации", + "req_id": "V6.7.1", + "req_description": "Убедитесь, что сертификаты, используемые для проверки криптографических утверждений об аутентификации, хранятся таким образом, чтобы исключить возможность их модификации.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.7", + "section_name": "Криптографические механизмы аутентификации", + "req_id": "V6.7.2", + "req_description": "Убедитесь, что nonce (случайная строка), используемая в процессе вызова, имеет длину не менее 64 бит и является статистически уникальной или уникальной на протяжении всего срока службы криптографического устройства.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.8", + "section_name": "Аутентификация с использованием провайдера идентификаций (IdP)", + "req_id": "V6.8.1", + "req_description": "Убедитесь, что при поддержке несколькими IdP, невозможно подделать личность пользователя через другой IdP (например, с тем же user ID). Стандартным способом защиты является регистрация пользователя с использованием сочетания ID самого IdP (в качестве пространства имён) и пользовательского ID внутри IdP.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.8", + "section_name": "Аутентификация с использованием провайдера идентификаций (IdP)", + "req_id": "V6.8.2", + "req_description": "Убедитесь, что наличие и целостность цифровой подписи в утверждениях аутентификации (например, в JWT или SAML) всегда проверяются, а неподписанные или недействительные утверждения отклоняются.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.8", + "section_name": "Аутентификация с использованием провайдера идентификаций (IdP)", + "req_id": "V6.8.3", + "req_description": "Убедитесь, что SAML-утверждения обрабатываются только один раз в течение периода их действия, чтобы исключить атаки воспроизведения (replay attacks).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V6", + "chapter_name": "Аутентификация", + "section_id": "V6.8", + "section_name": "Аутентификация с использованием провайдера идентификаций (IdP)", + "req_id": "V6.8.4", + "req_description": "Убедитесь, что если приложение использует внешний поставщик идентификации (IdP) и для определенных функций требуется особый уровень, метод или срок действия аутентификации, то приложение использует данные, возвращаемые IdP, для проверки этих условий. Например, при использовании OIDC можно проверить значения полей ID Token — acr, amr, auth_time (если они есть). Если IdP не предоставляет эти данные, приложение должно иметь документированный план действий по умолчанию, предполагающий использование минимально допустимой силы аутентификации (например, одноступенчатая — логин и пароль).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.1", + "section_name": "Документация по управлению сессиями", + "req_id": "V7.1.1", + "req_description": "Убедитесь, что тайм-аут бездействия и абсолютное максимальное время жизни сессии задокументированы, соответствуют другим контрольным мерам и сопровождаются обоснованием любых отклонений от требований повторной аутентификации NIST SP 800-63B.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.1", + "section_name": "Документация по управлению сессиями", + "req_id": "V7.1.2", + "req_description": "Убедитесь, что документация определяет допустимое количество одновременных (параллельных) сессий для одного аккаунта, а также поведение системы и действия при достижении этого лимита.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.1", + "section_name": "Документация по управлению сессиями", + "req_id": "V7.1.3", + "req_description": "Убедитесь, что все системы, создающие и управляющие сессиями пользователей в рамках федеративной идентификации (например, SSO), задокументированы вместе с механизмами координации сроков действия сессий, условий завершения и случаев, требующих повторной аутентификации.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.2", + "section_name": "Базовая безопасность сессий", + "req_id": "V7.2.1", + "req_description": "Убедитесь, что все проверки сессионных токенов выполняются на доверенной серверной стороне.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.2", + "section_name": "Базовая безопасность сессий", + "req_id": "V7.2.2", + "req_description": "Убедитесь, что приложение использует либо автономные токены, либо ссылочные токены, которые генерируются динамически, не используя статические API-секреты или ключи.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.2", + "section_name": "Базовая безопасность сессий", + "req_id": "V7.2.3", + "req_description": "Убедитесь, что ссылочные токены являются уникальными, создаются с использованием криптографически безопасного генератора псевдослучайных чисел (CSPRNG) и обладают энтропией не менее 128 бит.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.2", + "section_name": "Базовая безопасность сессий", + "req_id": "V7.2.4", + "req_description": "Убедитесь, что при аутентификации пользователя (включая повторную) создается новый токен сессии, а текущий — аннулируется.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.3", + "section_name": "Тайм-ауты сессии", + "req_id": "V7.3.1", + "req_description": "Убедитесь, что есть тайм-аут бездействия, после которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.3", + "section_name": "Тайм-ауты сессии", + "req_id": "V7.3.2", + "req_description": "Убедитесь, что установлено абсолютное максимальное время жизни сессии, по истечении которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.4", + "section_name": "Завершение сессий", + "req_id": "V7.4.1", + "req_description": "Убедитесь, что после завершения сессии (logout, истечение срока) дальнейшее её использование невозможно. Для ссылочных токенов или сессий с сохранением состояния это означает аннулирование на сервере. Для self-contained токенов необходимо реализовать механизм отзыва, например, список отозванных токенов, проверку времени выпуска или ротацию ключей подписи для каждого пользователя.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.4", + "section_name": "Завершение сессий", + "req_id": "V7.4.2", + "req_description": "Убедитесь, что при удалении или отключении пользователя все активные сессии немедленно завершаются.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.4", + "section_name": "Завершение сессий", + "req_id": "V7.4.3", + "req_description": "Убедитесь, что после изменения или удаления факторов аутентификации (например, смена пароля или MFA) приложение предлагает завершить все другие активные сессии.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.4", + "section_name": "Завершение сессий", + "req_id": "V7.4.4", + "req_description": "Убедитесь, что на всех страницах, требующих аутентификации, имеется простой и видимый способ выхода.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.4", + "section_name": "Завершение сессий", + "req_id": "V7.4.5", + "req_description": "Убедитесь, что администраторы могут завершать активные сессии конкретного пользователя или всех пользователей.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.5", + "section_name": "Защита от злоупотреблений сессией", + "req_id": "V7.5.1", + "req_description": "Убедитесь, что приложение требует полной повторной аутентификации перед изменением чувствительных атрибутов аккаунта, которые могут влиять на аутентификацию (например, email, номер телефона, настройки MFA или данных восстановления доступа).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.5", + "section_name": "Защита от злоупотреблений сессией", + "req_id": "V7.5.2", + "req_description": "Убедитесь, что пользователь может просматривать и (после повторной аутентификации хотя бы по одному фактору) завершать активные сессии.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.5", + "section_name": "Защита от злоупотреблений сессией", + "req_id": "V7.5.3", + "req_description": "Убедитесь, что перед выполнением критически важных операций приложение требует повторной аутентификации (по крайней мере, одного фактора) или дополнительной проверки.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.6", + "section_name": "Федеративная повторная аутентификация", + "req_id": "V7.6.1", + "req_description": "Убедитесь, что срок действия и завершение сессий между RP и IdP соответствуют документации и включают повторную аутентификацию, если достигнут максимальный допустимый интервал между событиями аутентификации.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V7", + "chapter_name": "Управление сессиями", + "section_id": "V7.6", + "section_name": "Федеративная повторная аутентификация", + "req_id": "V7.6.2", + "req_description": "Убедитесь, что создание сессии требует согласия пользователя или явного действия, предотвращающего несанкционированное создание сессий без участия пользователя.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.1", + "section_name": "Документация по авторизации", + "req_id": "V8.1.1", + "req_description": "Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне функций и на уровне данных на основе прав субъекта и атрибутов ресурса.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.1", + "section_name": "Документация по авторизации", + "req_id": "V8.1.2", + "req_description": "Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне полей (как на чтение, так и на запись) на основе прав субъекта и атрибутов ресурса. Эти правила могут зависеть от других атрибутов объекта данных, например, статуса.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.1", + "section_name": "Документация по авторизации", + "req_id": "V8.1.3", + "req_description": "Убедитесь, что документация определяет, какие атрибуты окружения и контекста (например, время суток, IP-адрес, местоположение, устройство) используются приложением для принятия решений в области аутентификации и авторизации.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.1", + "section_name": "Документация по авторизации", + "req_id": "V8.1.4", + "req_description": "Убедитесь, что документация по аутентификации и авторизации определяет, как используются факторы окружения и контекста в принятии решений, наряду с правилами доступа к функциям, данным и полям. Документация должна содержать оцениваемые атрибуты, пороговые значения риска, действия (разрешить, отказать, повысить уровень аутентификации и др.).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.2", + "section_name": "Архитектура авторизации", + "req_id": "V8.2.1", + "req_description": "Убедитесь, что приложение обеспечивает доступ на уровне функций (function-level) только субъектам с явными разрешениями.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.2", + "section_name": "Архитектура авторизации", + "req_id": "V8.2.2", + "req_description": "Убедитесь, что приложение обеспечивает доступ на уровне данных (data-specific) только тем субъектам, которым явно предоставлены права к определённым элементам данных, чтобы предотвратить IDOR (Insecure Direct Object Reference) и BOLA-уязвимости (Broken Object Level Authorization).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.2", + "section_name": "Архитектура авторизации", + "req_id": "V8.2.3", + "req_description": "Убедитесь, что приложение обеспечивает доступ на уровне полей (field-level) только тем субъектам, которым явно предоставлены права к определённым полям, чтобы предотвратить BOPLA (Broken Object Property Level Authorization).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.2", + "section_name": "Архитектура авторизации", + "req_id": "V8.2.4", + "req_description": "Убедитесь, что реализованы адаптивные меры безопасности, основанные на атрибутах окружения и контекста субъекта (время, местоположение, IP, устройство), которые используются для принятия решений об аутентификации и авторизации, как это определено в документации приложения. Эти меры должны применяться как при попытке субъекта начать новую сессию, так и во время существующей сессии.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.3", + "section_name": "Авторизация на уровне операций", + "req_id": "V8.3.1", + "req_description": "Убедитесь, что правила авторизации реализуются на доверенном сервисном уровне и не зависят от элементов, которые может контролировать клиент (например, JavaScript на стороне клиента).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.3", + "section_name": "Авторизация на уровне операций", + "req_id": "V8.3.2", + "req_description": "Убедитесь, что изменения значений, влияющих на авторизацию, применяются немедленно. Если это невозможно (например, при использовании автономных токенов), должны быть реализованы компенсирующие меры: оповещения о попытке несанкционированного действия и откат изменений. Обратите внимание, что данный подход не предотвращает утечку информации.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.3", + "section_name": "Авторизация на уровне операций", + "req_id": "V8.3.3", + "req_description": "Убедитесь, что доступ к объекту осуществляется на основе прав субъекта, инициировавшего запрос, а не прав промежуточного сервиса, действующего от его имени. Например, если пользователь обращается к веб-сервису с автономным токеном для аутентификации, а сервис затем запрашивает данные у другого сервиса, второй сервис должен использовать токен пользователя, а не токен первого сервиса для принятия решения о доступе.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.4", + "section_name": "Прочие аспекты авторизации", + "req_id": "V8.4.1", + "req_description": "Убедитесь, что в мультитенантных приложениях реализованы механизмы, предотвращающие действия потребителя в отношении арендаторов, к которым у него нет доступа.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V8", + "chapter_name": "Авторизация", + "section_id": "V8.4", + "section_name": "Прочие аспекты авторизации", + "req_id": "V8.4.2", + "req_description": "Убедитесь, что доступ к административным интерфейсам защищён несколькими уровнями контроля, включая непрерывную проверку личности, контроль защищённости устройства и анализ контекстных рисков. Недостаточно опираться только на IP-адрес или доверенные устройства.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Автономные токены", + "section_id": "V9.1", + "section_name": "Источник токена и его целостность", + "req_id": "V9.1.1", + "req_description": "Убедитесь, что автономные токены проверяются на целостность с помощью цифровой подписи или MAC, прежде чем доверять их содержимому.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Автономные токены", + "section_id": "V9.1", + "section_name": "Источник токена и его целостность", + "req_id": "V9.1.2", + "req_description": "Проверяйте, что автономные токены создаются и проверяются исключительно с помощью алгоритмов из списка допустимых в данном контексте. Список допустимых алгоритмов должен включать только разрешенные алгоритмы (желательно либо только симметричные, либо только асимметричные) и ни в коем случае не содержать алгоритм None. Если необходимо поддерживать оба типа алгоритмов, потребуются дополнительные средства контроля для предотвращения путаницы с ключами (key confusion).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Автономные токены", + "section_id": "V9.1", + "section_name": "Источник токена и его целостность", + "req_id": "V9.1.3", + "req_description": "Убедитесь, что ключи, используемые для проверки автономных токенов, получены из доверенных, предварительно настроенных источников. Это предотвращает возможность указания злоумышленниками ненадёжных источников и ключей. Для JWT и других JWS структур заголовки 'jku', 'x5u' и 'jwk' должны проверяться по белому списку.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Автономные токены", + "section_id": "V9.2", + "section_name": "Содержимое токена", + "req_id": "V9.2.1", + "req_description": "Убедитесь, что при указанном сроке действия токен и его содержимое принимаются только в том случае, если срок действия токена не истёк. Например, для JWT нужно проверить поля 'nbf' и 'exp'.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Автономные токены", + "section_id": "V9.2", + "section_name": "Содержимое токена", + "req_id": "V9.2.2", + "req_description": "Убедитесь, что сервис, принимающий токен, проверяет его тип и соответствие назначению перед обработкой содержимого токена. Например, для принятия решений об авторизации могут быть приняты только Access Token, а для подтверждения аутентификации пользователя — только ID Token.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Автономные токены", + "section_id": "V9.2", + "section_name": "Содержимое токена", + "req_id": "V9.2.3", + "req_description": "Убедитесь, что сервис принимает только токены, предназначенные для использования с этим сервисом (audience). Для JWT это можно сделать, проверив наличие утверждения «aud» по белому списку, определенному в сервисе.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V9", + "chapter_name": "Автономные токены", + "section_id": "V9.2", + "section_name": "Содержимое токена", + "req_id": "V9.2.4", + "req_description": "Убедитесь, что, если эмитент токенов использует один и тот же закрытый ключ для выпуска токенов различным сервисам (audiences), выпущенные токены содержат явное указание целевых сервисов. Это предотвратит повторное использования токенов в не предназначенных для них сервисах. Если идентификатор сервиса (audience identifier) назначается динамически, эмитент токенов должен проверить audiences для исключения подмены получателей (audience impersonation).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.1", + "section_name": "Общие требования безопасности OAuth и OIDC", + "req_id": "V10.1.1", + "req_description": "Убедитесь, что токены передаются только тем компонентам, которым они действительно необходимы. Например, при использовании схемы backend-for-frontend для браузерных JavaScript-приложений, access и refresh токены должны быть доступны только на backend.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.1", + "section_name": "Общие требования безопасности OAuth и OIDC", + "req_id": "V10.1.2", + "req_description": "Убедитесь, что клиент принимает значения от авторизационного сервера (например, authorization code или ID Token) только если они получены в результате авторизационного потока, инициированного в той же сессии пользовательского агента и в рамках той же транзакции. Для этого клиентские секреты, такие как proof key для code exchange (PKCE) — 'code_verifier', 'state' или OIDC 'nonce' — должны быть непредсказуемыми, специфичными для транзакции и надежно привязанными как к клиенту, так и к сессии пользовательского агента, в которой началась транзакция.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.2", + "section_name": "Клиент OAuth", + "req_id": "V10.2.1", + "req_description": "Убедитесь, что если используется механизм authorization code flow, OAuth клиент защищён от CSRF, вызывающих запросы токенов либо за счёт использования механизма proof key for code exchange (PKCE), либо за счёт проверки параметра 'state', который был отправлен в запросе авторизации.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.2", + "section_name": "Клиент OAuth", + "req_id": "V10.2.2", + "req_description": "Убедитесь, что если OAuth клиент может взаимодействовать с более чем одним сервером авторизации, у него есть защита от атак смешивания (mix-up attacks). Например, клиент должен требовать, чтобы сервер авторизации возвращал параметр 'iss' и проверять его в ответах на авторизацию и токены.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.2", + "section_name": "Клиент OAuth", + "req_id": "V10.2.3", + "req_description": "Убедитесь, что OAuth клиент запрашивает только необходимые области доступа (scopes) или другие параметры авторизации в запросах к серверу авторизации.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.3", + "section_name": "Сервер ресурсов OAuth", + "req_id": "V10.3.1", + "req_description": "Убедитесь, что сервер ресурсов принимает только те access токены, которые предназначены для использования с этим сервисом (свойство audience). Эта принадлежность сервису может быть включена в структурированный access токен (например, в поле 'aud' в JWT) или проверяться через endpoint интроспекции токена.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.3", + "section_name": "Сервер ресурсов OAuth", + "req_id": "V10.3.2", + "req_description": "Убедитесь, что сервер ресурсов принимает решения по авторизации на основе claims из access токена, определяющих делегированную авторизацию. Если присутствуют claims, такие как 'sub', 'scope' и 'authorization_details', они должны участвовать в принятии решения.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.3", + "section_name": "Сервер ресурсов OAuth", + "req_id": "V10.3.3", + "req_description": "Убедитесь, что если для принятия решения по контролю доступа необходимо однозначно идентифицировать пользователя из access токена (JWT или ответа интроспекции), сервер ресурсов использует claims, которые не могут быть переприсвоены другим пользователям. Обычно это комбинация claims 'iss' и 'sub'.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.3", + "section_name": "Сервер ресурсов OAuth", + "req_id": "V10.3.4", + "req_description": "Убедитесь, что если сервер ресурсов требует определённой силы аутентификации, методов или свежести аутентификации, он проверяет, что предъявленный access токен удовлетворяет этим требованиям. Например, при наличии, могут использоваться claims OIDC 'acr', 'amr' и 'auth_time'.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.3", + "section_name": "Сервер ресурсов OAuth", + "req_id": "V10.3.5", + "req_description": "Убедитесь, что сервер ресурсов предотвращает использование украденных access токенов или их повторное использование (replay) неавторизованными лицами, требуя access токены с подтверждением отправителя — например, Mutual TLS для OAuth 2 или OAuth 2 Demonstration of Proof of Possession (DPoP).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.1", + "req_description": "Убедитесь, что сервер авторизации проверяет URI перенаправления (redirect URI), сверяя его с заранее зарегистрированным списком разрешённых URI для данного клиента (allowlist), используя точное сравнение строк.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.2", + "req_description": "Убедитесь, что если сервер авторизации возвращает authorization code в ответе авторизации, этот код может быть использован только один раз для запроса токена. При втором валидном запросе с уже использованным кодом сервер должен отклонить запрос и отозвать любые токены, связанные с этим кодом.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.3", + "req_description": "Убедитесь, что authorization code имеет короткое время жизни. Максимальная продолжительность — до 10 минут для приложений L1 и L2 и до 1 минуты для приложений L3.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.4", + "req_description": "Убедитесь, что сервер авторизации для конкретного клиента разрешает использование только тех типов авторизации, которые необходимы этому клиенту. Обратите внимание, что тип авторизации Implicit flow и Resource Owner Password Credentials flow больше не должны использоваться.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.5", + "req_description": "Убедитесь, что сервер авторизации предотвращает атаки повторного использования refresh токенов для публичных клиентов, предпочтительно используя sender-constrained refresh токены, такие как DPoP или сертификат-связанные токены с mutual TLS (mTLS). Для L1 и L2 допускается ротация refresh токенов с обязательной их инвалидацией после использования. Если используется ротация, сервер должен отозвать все refresh токены при попытке использовать уже инвалидированный токен.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.6", + "req_description": "Убедитесь, что при использовании типа авторизации «Authorization Code» сервер предотвращает атаки перехвата authorization code, требуя Proof Key for Code Exchange (PKCE). В запросах авторизации сервер должен требовать валидное значение 'code_challenge' и не принимать 'code_challenge_method' со значением 'plain'. В запросах токена обязательно валидировать параметр 'code_verifier'.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.7", + "req_description": "Убедитесь, что если сервер авторизации поддерживает динамическую регистрацию клиентов без аутентификации, он минимизирует риски вредоносных клиентов. Сервер должен валидировать метаданные клиента (например, зарегистрированные URI), обеспечивать согласие пользователя и предупреждать пользователя перед обработкой запроса авторизации от недоверенного клиента.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.8", + "req_description": "Убедитесь, что refresh токены имеют абсолютный срок действия, включая случаи, когда применяется скользящее время истечения срока.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.9", + "req_description": "Убедитесь, что пользователи могут отзывать refresh токены и reference access токены через пользовательский интерфейс сервера авторизации для снижения риска от вредоносных клиентов или кражи токенов.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.10", + "req_description": "Убедитесь, что конфиденциальный клиент аутентифицируется при взаимодействии с сервером авторизации через backchannel, например при запросах токена, pushed authorization requests (PAR) и запросах на отзыв токенов.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.11", + "req_description": "Убедитесь, что конфигурация сервера авторизации назначает OAuth клиенту только необходимые области доступа (scopes).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.12", + "req_description": "Убедитесь, что для конкретного клиента сервер авторизации разрешает только те значения 'response_mode', которые необходимы этому клиенту. Например, сервер должен валидировать это значение против ожидаемых или использовать pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.13", + "req_description": "Убедитесь, что грант типа 'code' всегда используется вместе с pushed authorization requests (PAR).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.14", + "req_description": "Убедитесь, что сервер авторизации выдаёт только sender-constrained (Proof-of-Possession) access токены, либо с сертификат-связанными токенами через mutual TLS (mTLS), либо DPoP-bound токены (Demonstration of Proof of Possession).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.15", + "req_description": "Убедитесь, что для серверного клиента (не выполняющегося на устройстве конечного пользователя) сервер авторизации проверяет, что значение параметра 'authorization_details' исходит из клиентского backend и что пользователь не изменял его. Например, это достигается использованием pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.4", + "section_name": "Сервер авторизации OAuth", + "req_id": "V10.4.16", + "req_description": "Убедитесь, что клиент является конфиденциальным и сервер авторизации требует использования сильных методов аутентификации клиента (основанных на криптографии с открытым ключом и устойчивых к атакам повторного воспроизведения), таких как mutual TLS ('tls_client_auth', 'self_signed_tls_client_auth') или private key JWT ('private_key_jwt').", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.5", + "section_name": "Клиент OIDC", + "req_id": "V10.5.1", + "req_description": "Убедитесь, что клиент (relying party) защищается от повторного использования ID Token (replay-атак). Например, это достигается проверкой того, что значение 'nonce' в ID Token совпадает со значением 'nonce', отправленным в запросе аутентификации провайдеру OpenID (authorization server).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.5", + "section_name": "Клиент OIDC", + "req_id": "V10.5.2", + "req_description": "Убедитесь, что клиент однозначно идентифицирует пользователя по утверждениям (claims) ID Token, обычно это 'sub', который не может быть переназначен другому пользователю (в пределах конкретного провайдера идентификации).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.5", + "section_name": "Клиент OIDC", + "req_id": "V10.5.3", + "req_description": "Убедитесь, что клиент отклоняет попытки злоумышленного сервера авторизации выдавать себя за другой сервер авторизации через метаданные сервера авторизации. Клиент должен отклонить метаданные, если URL издателя (issuer) в метаданных не совпадает точно с преднастроенным URL издателя, ожидаемым клиентом.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.5", + "section_name": "Клиент OIDC", + "req_id": "V10.5.4", + "req_description": "Убедитесь, что клиент проверяет, что ID Token предназначен для него (проверка audience), сравнивая значение 'aud' в токене с 'client_id' клиента.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.5", + "section_name": "Клиент OIDC", + "req_id": "V10.5.5", + "req_description": "Убедитесь, что при использовании OIDC back-channel logout клиент снижает риск отказа в обслуживании, вызванный принудительным выходом из системы и путаницей между разными типами JWT (cross-JWT confusion) в процессе логаута. Клиент должен проверить, что токен выхода корректно типизирован со значением 'logout+jwt', содержит claim 'event' с правильным именем участника и не содержит 'nonce'. Также рекомендуется установить короткий срок действия токена (например, 2 минуты).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.6", + "section_name": "Провайдер OpenID", + "req_id": "V10.6.1", + "req_description": "Убедитесь, что провайдер OpenID допускает только значения 'code', 'ciba', 'id_token' или 'id_token code' для параметра response mode. При этом предпочтение отдаётся 'code' по сравнению с 'id_token code' (гибридный поток OIDC), а значение 'token' (любой Implicit flow) не должно использоваться.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.6", + "section_name": "Провайдер OpenID", + "req_id": "V10.6.2", + "req_description": "Убедитесь, что провайдер OpenID предотвращает отказ в обслуживании (DoS) через принудительный выход (logout), запрашивая явное подтверждение от конечного пользователя или, если применимо, проверяя параметры в запросе выхода (инициированном relying party), например параметр 'id_token_hint'.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.7", + "section_name": "Управление согласием", + "req_id": "V10.7.1", + "req_description": "Убедитесь, что авторизационный сервер обеспечивает получение согласия пользователя для каждого запроса авторизации. Если личность клиента не может быть подтверждена, сервер авторизации всегда должен явно запрашивать согласие пользователя.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.7", + "section_name": "Управление согласием", + "req_id": "V10.7.2", + "req_description": "Убедитесь, что при запросе согласия пользователя авторизационный сервер предоставляет достаточную и понятную информацию о том, на что даётся согласие. При необходимости это должно включать характер запрашиваемых разрешений (обычно основанных на scope, ресурсном сервере, деталях авторизации Rich Authorization Requests (RAR)), идентификацию авторизованного приложения и срок действия этих разрешений.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V10", + "chapter_name": "OAuth и OIDC", + "section_id": "V10.7", + "section_name": "Управление согласием", + "req_id": "V10.7.3", + "req_description": "Убедитесь, что пользователь может просматривать, изменять и отзывать согласия, которые он предоставил, через авторизационный сервер.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.1", + "section_name": "Инвентаризация и документирование криптографии", + "req_id": "V11.1.1", + "req_description": "Убедитесь, что задокументирована политика управления криптографическими ключами и описан их жизненный цикл в соответствии со стандартом управления ключей, таким как NIST SP 800-57. Убедитесь, что ключи известны только тем сущностям, которым они должны быть доступны (например, ключи не передавались более чем двум участникам для общих секретов и более чем одному участнику для приватных ключей).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.1", + "section_name": "Инвентаризация и документирование криптографии", + "req_id": "V11.1.2", + "req_description": "Убедитесь, что проводится инвентаризация криптографических средств, которая непрерывно поддерживается, регулярно обновляется и включает все криптографические ключи, алгоритмы и сертификаты, используемые в приложении. Также должна быть задокументирована информация о том, где ключи могут и не могут использоваться в системе, а также какие типы данных могут и не могут быть защищены с помощью этих ключей.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.1", + "section_name": "Инвентаризация и документирование криптографии", + "req_id": "V11.1.3", + "req_description": "Убедитесь, что используются механизмы обнаружения криптографии для идентификации всех случаев применения криптографии в системе , включая операции шифрования, хеширования и цифровой подписи.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.1", + "section_name": "Инвентаризация и документирование криптографии", + "req_id": "V11.1.4", + "req_description": "Убедитесь, что ведётся и поддерживается инвентаризация криптографических средств. В неё должен входить документированный план, описывающий переход на новые криптографические стандарты, такие как постквантовая криптография, чтобы своевременно реагировать на будущие угрозы.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.2", + "section_name": "Безопасная реализация криптографии", + "req_id": "V11.2.1", + "req_description": "Убедитесь, что для криптографических операций используются утвержденные в индустрии реализации (включая библиотеки и аппаратные реализации).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.2", + "section_name": "Безопасная реализация криптографии", + "req_id": "V11.2.2", + "req_description": "Убедитесь, что архитектура приложения поддерживает быструю реконфигурацию, усовершенствование или смену в любой момент случайных чисел, аутентифицированного шифрования, MAC, алгоритмов хеширования, длин ключей, количества раундов, шифров и режимов шифрования для защиты от криптографических атак. Также должна поддерживаться возможность смены ключей, паролей и повторного шифрования данных. Это позволит беспрепятственно перейти на постквантовую криптографию (PQC), как только станут широко доступны высоконадёжные реализации одобренных схем или стандартов PQC.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.2", + "section_name": "Безопасная реализация криптографии", + "req_id": "V11.2.3", + "req_description": "Убедитесь, что все криптографические примитивы используют как минимум 128-бит стойкости с учетом алгоритма, размера ключа и конфигурации. Например, 256-битный ECC ключ обеспечивает примерно 128 бит безопасности, тогда как для достижения того же уровня безопасности в RSA требуется ключ длиной 3072 бита.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.2", + "section_name": "Безопасная реализация криптографии", + "req_id": "V11.2.4", + "req_description": "Убедитесь, что все криптографические операции выполняются за константное время, без использования «short-circuit» операций в сравнениях, вычислениях, возвратах функций для избежания утечек информации.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.2", + "section_name": "Безопасная реализация криптографии", + "req_id": "V11.2.5", + "req_description": "Убедитесь, что все криптографические модули обеспечивают безопасное завершение работы при ошибках, а обработка ошибок реализована таким образом, чтобы не создавать уязвимостей, например, таких как атаки Padding Oracle.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.3", + "section_name": "Алгоритмы шифрования", + "req_id": "V11.3.1", + "req_description": "Убедитесь, что не используются небезопасные режимы блочного шифрования (н-р, ECB) и слабые схемы дополнения (padding) (н-р, PKCS#1 v1.5).", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.3", + "section_name": "Алгоритмы шифрования", + "req_id": "V11.3.2", + "req_description": "Убедитесь, что используются только утверждённые шифры и режимы, такие как AES с GCM.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.3", + "section_name": "Алгоритмы шифрования", + "req_id": "V11.3.3", + "req_description": "Убедитесь, что зашифрованные данные защищены от несанкционированного изменения, предпочтительно с использованием утверждённого метода аутентифицированного шифрования или путём комбинирования утверждённого метода шифрования с утверждённым алгоритмом MAC.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.3", + "section_name": "Алгоритмы шифрования", + "req_id": "V11.3.4", + "req_description": "Убедитесь, что случайные числа (nonce), векторы инициализации (IV) и другие одноразовые числа не используются более одного раза для одной и той же пары ключа шифрования и элемента данных. Метод их генерации должен соответствовать требованиям используемого алгоритма.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.3", + "section_name": "Алгоритмы шифрования", + "req_id": "V11.3.5", + "req_description": "Убедитесь, что любая комбинация алгоритма шифрования и алгоритма MAC работает в режиме encrypt-then-MAC (EtM).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.4", + "section_name": "Хеширование и функции на основе хеширования", + "req_id": "V11.4.1", + "req_description": "Убедитесь, что только утвержденные хэш-функции используются для стандартных сценариев использования в криптографии, включая цифровую подпись, HMAC, KDF, генерацию случайных чисел. Запрещено использовать неустойчивые хэш-функции, (н-р, MD5) для любого использования в криптографии.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.4", + "section_name": "Хеширование и функции на основе хеширования", + "req_id": "V11.4.2", + "req_description": "Убедитесь, что пароли хранятся с использованием утверждённой, вычислительно затратной функции генерации ключа (также известной как «функция хеширования паролей»), с параметрами, настроенными в соответствии с актуальными рекомендациями. Настройки должны обеспечивать баланс между безопасностью и производительностью, чтобы сделать атаки перебором достаточно сложными для требуемого уровня безопасности.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.4", + "section_name": "Хеширование и функции на основе хеширования", + "req_id": "V11.4.3", + "req_description": "Убедитесь, что хэш-функции, используемые в формировании цифровой подписи, как часть аутентификации и целостности данных, устойчивы к коллизиям и имеют достаточную длину.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.4", + "section_name": "Хеширование и функции на основе хеширования", + "req_id": "V11.4.4", + "req_description": "Убедитесь, что приложение использует утвержденную функцию генерации ключа с использованием параметров расширения ключа (key stretching) при генерации ключа из пароля. Параметры должны быть сбалансированы с точки зрения безопасности, производительности и устойчивости к атакам полного перебора при компрометации результирующего криптографического ключа.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.5", + "section_name": "Случайные значения", + "req_id": "V11.5.1", + "req_description": "Убедитесь, что все случайные числа и строки, которые должны быть непредсказуемы, должны быть сгенерированы с помощью CSPRNG и иметь хотя бы 128 бит энтропии. Учтите, что UUID не удовлетворяют данному условию.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.5", + "section_name": "Случайные значения", + "req_id": "V11.5.2", + "req_description": "Убедитесь, что механизм генерации случайных чисел является надежным даже при высокой нагрузке.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.6", + "section_name": "Криптография с публичным ключом", + "req_id": "V11.6.1", + "req_description": "Убедитесь, что только утвержденные криптографические алгоритмы и режимы операций используются для генерации ключа и инициализации случайного значения для его генерации (seeding), а также для генерации цифровой подписи и верификации. Алгоритмы генерации ключей не должны генерировать небезопасные ключи уязвимые к известным атакам, например, ключи RSA уязвимы к факторизации Ферма.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.6", + "section_name": "Криптография с публичным ключом", + "req_id": "V11.6.2", + "req_description": "Убедитесь, что для обмена ключами используются утверждённые криптографические алгоритмы (например, Диффи-Хеллман) с особым вниманием к обеспечению использования безопасных параметров. Это предотвратит атаки на процесс установления ключа, которые могут привести к атакам «человек посередине» или криптографическим взломам.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.7", + "section_name": "Шифрование данных в процессе использования", + "req_id": "V11.7.1", + "req_description": "Убедитесь, что используется полное шифрование памяти, которое защищает конфиденциальные данные во время их использования, предотвращая доступ к ним неавторизованных пользователей или процессов.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V11", + "chapter_name": "Криптография", + "section_id": "V11.7", + "section_name": "Шифрование данных в процессе использования", + "req_id": "V11.7.2", + "req_description": "Убедитесь, что минимизация данных обеспечивает раскрытие минимально необходимого объёма данных во время обработки, а также что данные шифруются сразу после использования или как можно скорее.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.1", + "section_name": "Общие рекомендации по безопасности TLS", + "req_id": "V12.1.1", + "req_description": "Убедитесь, что включены только актуальные и рекомендуемые версии протокола TLS, такие как TLS 1.2 и TLS 1.3. Наиболее свежая версия TLS должна быть выбрана как предпочтительная.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.1", + "section_name": "Общие рекомендации по безопасности TLS", + "req_id": "V12.1.2", + "req_description": "Убедитесь, что включены рекомендуемые шифронаборы (cipher suites), предпочтение также стоит отдать самому сильному шифронабору. L3 приложения должны поддерживать только те наборы шифров (cipher suites), которые обеспечивают прямую (forward) секретность. Пояснение: Прямая секретность (Forward Secrecy, FS) — это криптографическая особенность, при которой сессионные ключи уникальны для каждой сессии и не зависят от долгосрочных ключей. Это гарантирует, что даже при компрометации долгосрочного ключа злоумышленник не сможет расшифровать ранее перехваченные зашифрованные сессии.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.1", + "section_name": "Общие рекомендации по безопасности TLS", + "req_id": "V12.1.3", + "req_description": "Убедитесь, что приложение проверяет доверенность клиентских сертификатов mTLS, прежде чем использовать идентификацию по сертификату для аутентификации или авторизации.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.1", + "section_name": "Общие рекомендации по безопасности TLS", + "req_id": "V12.1.4", + "req_description": "Убедитесь, что включена и настроена правильная проверка отзыва сертификатов, такая как Online Certificate Status Protocol (OCSP) Stapling.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.1", + "section_name": "Общие рекомендации по безопасности TLS", + "req_id": "V12.1.5", + "req_description": "Убедитесь, что в настройках TLS приложения включена функция Encrypted Client Hello (ECH) для предотвращения раскрытия конфиденциальных метаданных, таких как Server Name Indication (SNI), во время процесса TLS-рукопожатия.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.2", + "section_name": "HTTPS коммуникация с внешними сервисами", + "req_id": "V12.2.1", + "req_description": "Убедитесь, что для всех соединений между клиентом и внешними HTTP-сервисами используется TLS и не происходит отката к небезопасным или незашифрованным протоколам.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.2", + "section_name": "HTTPS коммуникация с внешними сервисами", + "req_id": "V12.2.2", + "req_description": "Убедитесь, что внешние сервисы используют публично доверенные TLS-сертификаты.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.3", + "section_name": "Общая безопасность межсервисного взаимодействия", + "req_id": "V12.3.1", + "req_description": "Убедитесь, что для всех входящих и исходящих соединений приложения используется зашифрованный протокол, например TLS, включая системы мониторинга, инструменты управления, удалённый доступ и SSH, промежуточное ПО, базы данных, мейнфреймы, партнёрские системы и внешние API. Сервер не должен допускать откат к небезопасным или незашифрованным протоколам.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.3", + "section_name": "Общая безопасность межсервисного взаимодействия", + "req_id": "V12.3.2", + "req_description": "Убедитесь, что TLS-клиент проверяет сертификат сервера до установления защищенного соединения с TLS-сервером.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.3", + "section_name": "Общая безопасность межсервисного взаимодействия", + "req_id": "V12.3.3", + "req_description": "Убедитесь, что все внутренние HTTP-взаимодействия между компонентами приложения используют TLS или другой подходящий механизм транспортного шифрования, и не происходит откат к небезопасным или незашифрованным коммуникациям.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.3", + "section_name": "Общая безопасность межсервисного взаимодействия", + "req_id": "V12.3.4", + "req_description": "Убедитесь, что TLS-соединения между внутренними сервисами используют доверенные сертификаты. Если используются внутренние или самоподписанные сертификаты, потребляющий сервис должен быть настроен на доверие только к конкретным внутренним центрам сертификации (CA) и конкретным самоподписанным сертификатам.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V12", + "chapter_name": "Безопасная коммуникация", + "section_id": "V12.3", + "section_name": "Общая безопасность межсервисного взаимодействия", + "req_id": "V12.3.5", + "req_description": "Убедитесь, что сервисы, взаимодействующие внутри системы (intra-service communications), используют строгую аутентификацию для проверки каждого конечного узла. Для проверки подлинности взаимодействующих сторон должны применяться методы строгой аутентификации, такие как аутентификация TLS-клиента, с использованием инфраструктуры открытых ключей и механизмов, устойчивых к атакам повтора (replay attacks). Для микросервисных архитектур рекомендуется использование service mesh для упрощения управления сертификатами и повышения безопасности.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.1", + "section_name": "Документация конфигурации", + "req_id": "V13.1.1", + "req_description": "Убедитесь, что все необходимые доступы приложения задокументированы. Сюда должны быть включены как внешние сервисы, от которых зависит приложение, так и сценарии, когда конечный пользователь может задавать адреса для внешнего подключения.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.1", + "section_name": "Документация конфигурации", + "req_id": "V13.1.2", + "req_description": "Убедитесь, что для каждого сервиса, используемого приложением, в документации определено максимальное количество одновременных соединений (например, лимиты пула соединений) и описано поведение приложения при достижении этого лимита, включая любые механизмы отказоустойчивости или восстановления, чтобы предотвратить ситуации отказа в обслуживании (DoS).", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.1", + "section_name": "Документация конфигурации", + "req_id": "V13.1.3", + "req_description": "Убедитесь, что в документации приложения определены стратегии управления ресурсами для каждой внешней системы или сервиса, которые оно использует (например, базы данных, файловые дескрипторы, потоки, HTTP-соединения). Стратегии должны включать процедуры освобождения ресурсов, настройки таймаутов, обработку сбоев, а также, если реализована логика повторных попыток, указание лимитов, задержек и алгоритмов back-off. Для синхронных HTTP-запросов должны быть заданы короткие таймауты, а повторные запросы должны быть отключены, либо строго ограничены по числу попыток, чтобы предотвратить каскадные задержки и истощение ресурсов.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.1", + "section_name": "Документация конфигурации", + "req_id": "V13.1.4", + "req_description": "Убедитесь, что в документации приложения определены секреты, критически важные для безопасности приложения, а также установлен график их ротации в соответствии с моделью угроз организации и её бизнес-требованиями.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.2", + "section_name": "Конфигурация бэкенд соединений", + "req_id": "V13.2.1", + "req_description": "Убедитесь, что коммуникации между компонентами бэкенда приложения (включая API, промежуточное ПО и уровни данных), которые не поддерживают стандартный механизм пользовательских сессий, проходят с аутентификацией. Аутентификация должна использовать индивидуальные сервисные аккаунты, краткосрочные токены или аутентификацию на основе сертификатов, а не постоянные учётные данные, такие как пароли, API-ключи или общие аккаунты с привилегированным доступом.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.2", + "section_name": "Конфигурация бэкенд соединений", + "req_id": "V13.2.2", + "req_description": "Убедитесь, что коммуникации между компонентами бэкенда приложения, включая локальные или системные службы, API, промежуточное ПО и уровни данных, выполняются с использованием аккаунтов, которым назначены минимально необходимые привилегии.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.2", + "section_name": "Конфигурация бэкенд соединений", + "req_id": "V13.2.3", + "req_description": "Убедитесь, что если для аутентификации в сервисе используются учётные данные, то используемые потребителем учётные данные не являются стандартными (например, root/root или admin/admin).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.2", + "section_name": "Конфигурация бэкенд соединений", + "req_id": "V13.2.4", + "req_description": "Убедитесь, что используется белый список (allowlist) для определения внешних ресурсов или систем, с которыми приложению разрешено взаимодействовать (например, для исходящих запросов, загрузки данных или доступа к файлам). Этот белый список может быть реализован на уровне приложения, веб-сервера, межсетевого экрана или комбинации различных уровней.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.2", + "section_name": "Конфигурация бэкенд соединений", + "req_id": "V13.2.5", + "req_description": "Убедитесь, что веб- или прикладной сервер настроен с белым списком ресурсов или систем, к которым сервер может отправлять запросы или из которых может загружать данные и файлы.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.2", + "section_name": "Конфигурация бэкенд соединений", + "req_id": "V13.2.6", + "req_description": "Убедитесь, что при подключении приложения к другим сервисам соблюдается задокументированная конфигурация для каждого соединения, включая максимальное количество параллельных соединений, поведение при достижении их максимума, таймауты и стратегии повторных попыток подключения.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.3", + "section_name": "Управление секретами", + "req_id": "V13.3.1", + "req_description": "Убедитесь, что для безопасного создания, хранения, контроля доступа и уничтожения секретов бэкенда используется решение для управления секретами, например, хранилище ключей (key vault). Секретами могут быть пароли, ключевой материал, интеграции с базами данных и сторонними системами, ключи и seed-значения для токенов с ограниченным временем действия, другие внутренние секреты и API-ключи. Секреты не должны включаться в исходный код приложения или артефакты сборки. Для приложений уровня L3 необходимо использовать аппаратное решение, например, аппаратный модуль безопасности (HSM).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.3", + "section_name": "Управление секретами", + "req_id": "V13.3.2", + "req_description": "Убедитесь, что доступ к секретным ресурсам осуществляется в соответствии с принципом минимально необходимых привилегий (least privilege).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.3", + "section_name": "Управление секретами", + "req_id": "V13.3.3", + "req_description": "Убедитесь, что все криптографические операции выполняются с использованием изолированного модуля безопасности (например, хранилища ключей или аппаратного модуля безопасности), чтобы надежно управлять ключевым материалом и защищать его от утечки за пределы модуля безопасности.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.3", + "section_name": "Управление секретами", + "req_id": "V13.3.4", + "req_description": "Убедитесь, что секреты настроены на срок действия и ротацию в соответствии с документацией приложения.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.4", + "section_name": "Непреднамеренная утечка информации", + "req_id": "V13.4.1", + "req_description": "Убедитесь, что приложение развернуто либо без метаданных систем контроля версий (включая папки .git или .svn), либо так, чтобы эти папки были недоступны как извне, так и для самого приложения.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.4", + "section_name": "Непреднамеренная утечка информации", + "req_id": "V13.4.2", + "req_description": "Убедитесь, что режимы отладки отключены для всех компонентов в промышленной среде, чтобы предотвратить раскрытие функций отладки и утечку информации.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.4", + "section_name": "Непреднамеренная утечка информации", + "req_id": "V13.4.3", + "req_description": "Убедитесь, что веб-серверы не показывают клиентам списки содержимого каталогов, если это явно не предусмотрено.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.4", + "section_name": "Непреднамеренная утечка информации", + "req_id": "V13.4.4", + "req_description": "Убедитесь, что метод HTTP TRACE не поддерживается в продуктовой среде, чтобы избежать потенциальной утечки информации.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.4", + "section_name": "Непреднамеренная утечка информации", + "req_id": "V13.4.5", + "req_description": "Убедитесь, что документация (например, по внутренним API) и мониторинговые эндпоинты не доступны, если это явно не предусмотрено.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.4", + "section_name": "Непреднамеренная утечка информации", + "req_id": "V13.4.6", + "req_description": "Убедитесь, что приложение не раскрывает подробную информацию о версиях компонентов бэкенда.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V13", + "chapter_name": "Конфигурация", + "section_id": "V13.4", + "section_name": "Непреднамеренная утечка информации", + "req_id": "V13.4.7", + "req_description": "Убедитесь, что веб-слой настроен на обслуживание только файлов с определёнными расширениями, чтобы предотвратить непреднамеренную утечку информации, конфигураций и исходного кода.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.1", + "section_name": "Документация по защите информации", + "req_id": "V14.1.1", + "req_description": "Убедитесь, что все конфиденциальные данные, создаваемые и обрабатываемые приложением, идентифицированы и классифицированы по уровням защиты. Включая закодированные данные, которые легко декодируются, например, строки Base64 или незашифрованные данные в полезной нагрузке JWT. Уровни защиты должны учитывать требования по защите данных и конфиденциальности, которым должно соответствовать приложение.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.1", + "section_name": "Документация по защите информации", + "req_id": "V14.1.2", + "req_description": "Убедитесь, что для каждого уровня защиты конфиденциальных данных требования к защите задокументированы. Они должны включать (но не ограничиваться) требования по шифрованию, проверке целостности, срокам хранения, способам логирования данных, контролю доступа к чувствительным данным в логах, шифрованию на уровне базы данных, применению технологий повышения конфиденциальности, а также другим требованиям по конфиденциальности.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.2", + "section_name": "Базовые меры по защите информации", + "req_id": "V14.2.1", + "req_description": "Убедитесь, что конфиденциальные данные передаются на сервер только в теле HTTP-запроса или в заголовках. URL и строка запроса не должны содержать конфиденциальную информацию, такую как API-ключ или сессионный токен.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.2", + "section_name": "Базовые меры по защите информации", + "req_id": "V14.2.2", + "req_description": "Убедитесь, что приложение предотвращает кэширование конфиденциальных данных в серверных компонентах, таких как балансировщики нагрузки и кэши приложений, либо гарантирует их надежное удаление после использования.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.2", + "section_name": "Базовые меры по защите информации", + "req_id": "V14.2.3", + "req_description": "Убедитесь, что заранее определённые конфиденциальные данные не отправляются ненадёжным сторонам (например, системам трекинга пользователей), чтобы предотвратить нежелательный сбор данных вне контроля приложения.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.2", + "section_name": "Базовые меры по защите информации", + "req_id": "V14.2.4", + "req_description": "Убедитесь, что для конфиденциальных данных реализованы меры по шифрованию, проверке целостности, срокам хранения, способам логирования, контролю доступа к данным в логах, а также применяются технологии повышения конфиденциальности в соответствии с документацией для соответствующего уровня защиты данных.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.2", + "section_name": "Базовые меры по защите информации", + "req_id": "V14.2.5", + "req_description": "Убедитесь, что механизмы кэширования настроены так, чтобы кэшировать только ответы с ожидаемым типом содержимого для данного ресурса и не содержать конфиденциального динамического контента. При обращении к несуществующему файлу, веб-сервер должен возвращать ответ 404 или 302, а не подменять на другой существующий файл, что позволит предотвратить атаки типа Web Cache Deception.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.2", + "section_name": "Базовые меры по защите информации", + "req_id": "V14.2.6", + "req_description": "Убедитесь, что приложение возвращает только минимально необходимый объем конфиденциальных данных для выполнения своей функциональности. Например, показывает только часть цифр номера кредитной карты, а не полный номер. Если требуется отображение полных данных, они должны быть замаскированы в пользовательском интерфейсе, пока пользователь специально не запросил их просмотр.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.2", + "section_name": "Базовые меры по защите информации", + "req_id": "V14.2.7", + "req_description": "Убедитесь, что конфиденциальная информация подлежит классификации по срокам хранения, чтобы устаревшие или ненужные данные удалялись автоматически, по расписанию или по мере необходимости.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.2", + "section_name": "Базовые меры по защите информации", + "req_id": "V14.2.8", + "req_description": "Убедитесь, что конфиденциальная информация удаляется из метаданных файлов, загружаемых пользователями, если пользователь явно не согласился на ее хранение.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.3", + "section_name": "Защита данных на стороне клиента", + "req_id": "V14.3.1", + "req_description": "Убедитесь, что аутентифицированные данные очищаются из клиентского хранилища, например, из DOM браузера, после завершения работы клиента или сессии. Заголовок HTTP-ответа Clear-Site-Data может помочь в этом, но клиентская сторона также должна уметь очищать данные, если соединение с сервером недоступно при завершении сессии.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.3", + "section_name": "Защита данных на стороне клиента", + "req_id": "V14.3.2", + "req_description": "Убедитесь, что приложение устанавливает HTTP-заголовки, достаточные для предотвращения кэширования (например, Cache-Control: no-store), чтобы конфиденциальные данные не сохранялись в браузерах.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V14", + "chapter_name": "Защита информации", + "section_id": "V14.3", + "section_name": "Защита данных на стороне клиента", + "req_id": "V14.3.3", + "req_description": "Убедитесь, что данные, хранящиеся в браузерном хранилище (например, localStorage, sessionStorage, IndexedDB или cookie), не содержат конфиденциальной информации, за исключением сессионных токенов.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.1", + "section_name": "Документация по безопасной разработке и архитектуре", + "req_id": "V15.1.1", + "req_description": "Убедитесь, что в документации по приложению определены сроки устранения уязвимостей на основе оценки рисков для внешних зависимостей с уязвимостями и для обновления библиотек в целом, чтобы минимизировать риск, связанный с этими компонентами.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.1", + "section_name": "Документация по безопасной разработке и архитектуре", + "req_id": "V15.1.2", + "req_description": "Убедитесь, что ведется реестр всех используемых сторонних библиотек (например, Software Bill of Materials, SBOM), с обязательной проверкой, что компоненты получены из предопределенных, доверенных и регулярно поддерживаемых репозиториев.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.1", + "section_name": "Документация по безопасной разработке и архитектуре", + "req_id": "V15.1.3", + "req_description": "Убедитесь, что в документации приложения указан функционал, требующий значительных временных или вычислительных ресурсов. Необходимо указать, как предотвратить потерю доступности из-за чрезмерного использования этого функционала и как избежать ситуаций, когда формирование ответа занимает больше времени, чем установленный системой таймаут. Возможные меры защиты могут включать асинхронную обработку, использование очередей и ограничение количества параллельных процессов для каждого пользователя и приложения.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.1", + "section_name": "Документация по безопасной разработке и архитектуре", + "req_id": "V15.1.4", + "req_description": "Убедитесь, что в документации приложения указаны внешние библиотеки, которые считаются «компонентами с повышенным риском».", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.1", + "section_name": "Документация по безопасной разработке и архитектуре", + "req_id": "V15.1.5", + "req_description": "Убедитесь, что в документации приложения выделены те части приложения, в которых используются «функционал с повышенным риском».", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.2", + "section_name": "Архитектура безопасности и зависимости", + "req_id": "V15.2.1", + "req_description": "Убедитесь, что приложение содержит только те компоненты, которые не нарушили задокументированные сроки обновления и исправления.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.2", + "section_name": "Архитектура безопасности и зависимости", + "req_id": "V15.2.2", + "req_description": "Убедитесь, что в приложении реализованы меры защиты от потери доступности из-за функциональности, требующей много времени или ресурсов, на основе задокументированных решений и стратегий безопасности для этого.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.2", + "section_name": "Архитектура безопасности и зависимости", + "req_id": "V15.2.3", + "req_description": "Убедитесь, что производственная среда включает только те функции, которые необходимы для работы приложения, и не предоставляет лишние функции, такие как тестовый код, примеры кода и инструменты разработки.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.2", + "section_name": "Архитектура безопасности и зависимости", + "req_id": "V15.2.4", + "req_description": "Убедитесь, что сторонние компоненты и все их транзитивные зависимости загружаются только из ожидаемых репозиториев (внутренних или внешних) и отсутствует риск атаки через подмену зависимостей (dependency confusion attack)", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.2", + "section_name": "Архитектура безопасности и зависимости", + "req_id": "V15.2.5", + "req_description": "Убедитесь, что приложение реализует дополнительные меры защиты для тех частей приложения, которые документированы как содержащие «функционал с повышенным риском» или использующие сторонние библиотеки, считающиеся «функционалом с повышенным риском». Это могут быть такие методы, как «песочница», инкапсуляция, контейнеризация или изоляция на сетевом уровне, чтобы задержать и предотвратить продвижение (pivoting) злоумышленников, скомпрометировавших одну часть приложения, к другим частям приложения.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.3", + "section_name": "Безопасное программирование", + "req_id": "V15.3.1", + "req_description": "Убедитесь, что приложение возвращает только необходимое подмножество полей из объекта данных. Например, оно не должно возвращать весь объект данных, поскольку некоторые отдельные поля должны быть недоступны пользователям.", + "level1": "✓", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.3", + "section_name": "Безопасное программирование", + "req_id": "V15.3.2", + "req_description": "Убедитесь, что при вызовах внешних URL-адресов бэкэнд приложения настроен так, чтобы не выполнять перенаправления, если только это не предусмотрено функционалом.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.3", + "section_name": "Безопасное программирование", + "req_id": "V15.3.3", + "req_description": "Убедитесь, что в приложении реализованы защитные механизмы против атак типа массового присвоения (mass assignment) путем строгого ограничения разрешенных полей для каждого контроллера и действия, исключая возможность добавления или изменения значений полей, которые не должны быть доступны для данной конкретной операции.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.3", + "section_name": "Безопасное программирование", + "req_id": "V15.3.4", + "req_description": "Убедитесь, что все прокси и промежуточное ПО корректно передают исходный IP-адрес пользователя, используя доверенные поля данных, которые не могут быть изменены конечным пользователем, а приложение и веб-сервер используют это правильное значение для ведения логирования и принятия решений по безопасности, таких как ограничение запросов. При этом следует учитывать, что даже исходный IP-адрес может быть ненадежным из-за динамических IP-адресов, VPN или корпоративных файрволов.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.3", + "section_name": "Безопасное программирование", + "req_id": "V15.3.5", + "req_description": "Убедитесь, что приложение явно проверяет соответствие переменных ожидаемому типу данных и использует строгие операции сравнения. Это необходимо для предотвращения уязвимостей, связанных с type juggling и type confusion, вызванных тем, что код приложения делает предположения о типе переменной.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.3", + "section_name": "Безопасное программирование", + "req_id": "V15.3.6", + "req_description": "Убедитесь, что JavaScript-код написан таким образом, чтобы предотвратить prototype pollution, например, используя Set() или Map() вместо обычных литералов объекта.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.3", + "section_name": "Безопасное программирование", + "req_id": "V15.3.7", + "req_description": "Убедитесь, что приложение защищено от атак типа HTTP Parameter Pollution (HPP), особенно если используемый фреймворк не различает источники параметров запроса (строка запроса, тело запроса, куки или заголовки).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.4", + "section_name": "Безопасная работа с параллельными процессами", + "req_id": "V15.4.1", + "req_description": "Убедитесь, что к общим объектам в многопоточном коде (например, кэшам, файлам или объектам в памяти, используемым несколькими потоками) используется безопасный многопоточный доступ и механизмов синхронизации, таких как блокировки или семафоры, чтобы избежать состояний гонки и повреждения данных.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.4", + "section_name": "Безопасная работа с параллельными процессами", + "req_id": "V15.4.2", + "req_description": "Убедитесь, что проверки состояния ресурса, например его существования или разрешений, а также зависящие от него действия выполняются как одна атомарная операция, чтобы предотвратить условия гонки времени проверки и времени использования (TOCTOU). Например, проверка существования файла перед его открытием или проверка прав доступа пользователя перед его предоставлением.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.4", + "section_name": "Безопасная работа с параллельными процессами", + "req_id": "V15.4.3", + "req_description": "Убедитесь, что блокировки применяются согласованно, чтобы предотвратить взаимные блокировки потоков (deadlocks) или их бесконечные повторы, а также что логика блокировки инкапсулирована в коде, отвечающем за управление ресурсом. Это гарантирует, что блокировки не могут быть случайно или намеренно изменены внешними классами или кодом.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V15", + "chapter_name": "Безопасная разработка и архитектура", + "section_id": "V15.4", + "section_name": "Безопасная работа с параллельными процессами", + "req_id": "V15.4.4", + "req_description": "Убедитесь, что политики распределения ресурсов предотвращают нехватку ресурсов у потоков, обеспечивая справедливый доступ к ресурсам, например, используя пулы потоков, позволяя потокам с более низким приоритетом выполняться в течение разумного периода времени.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.1", + "section_name": "Документация по ведению логов", + "req_id": "V16.1.1", + "req_description": "Убедитесь в существовании реестра, в котором документируется ведение журнала на каждом уровне технологического стека приложения, включая какие события регистрируются, форматы логов, где хранятся эти журналы, как они используются, как контролируется доступ к ним и как долго хранятся журналы.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.2", + "section_name": "Общее журналирование", + "req_id": "V16.2.1", + "req_description": "Убедитесь, что каждая запись журнала содержит необходимые метаданные (например, когда, где, кто, что), которые позволят провести подробное исследование временной шкалы, когда произошло событие.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.2", + "section_name": "Общее журналирование", + "req_id": "V16.2.2", + "req_description": "Убедитесь, что все источники времени компонентов системы журналирования синхронизированы, а временные метки в метаданных событий безопасности используют UTC или содержат явное указание смещения часового пояса. Рекомендуется применять UTC для обеспечения согласованности в распределённых системах и предотвращения ошибок при переходе на летнее/зимнее время.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.2", + "section_name": "Общее журналирование", + "req_id": "V16.2.3", + "req_description": "Убедитесь, что приложение записывает и передаёт логи исключительно в те файлы и сервисы, которые указаны в реестре журналирования.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.2", + "section_name": "Общее журналирование", + "req_id": "V16.2.4", + "req_description": "Убедитесь, что логи могут быть прочитаны и коррелированы используемой системой обработки журналов, предпочтительно с использованием общего стандартного формата логирования.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.2", + "section_name": "Общее журналирование", + "req_id": "V16.2.5", + "req_description": "Убедитесь, что приложение применяет соответствующие меры защиты при логировании конфиденциальных данных в зависимости от уровня их чувствительности: например, полностью запрещает запись в логи таких данных, как учетные данные или платежные реквизиты, а для других данных (например, сессионных токенов) использует хеширование или частичное/полное маскирование.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.3", + "section_name": "Инциденты безопасности", + "req_id": "V16.3.1", + "req_description": "Убедитесь, что все операции аутентификации регистрируются, включая успешные и неудачные попытки. Также следует фиксировать дополнительные метаданные, такие как тип аутентификации или использованные факторы проверки.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.3", + "section_name": "Инциденты безопасности", + "req_id": "V16.3.2", + "req_description": "Убедитесь, что ведется журнал неудачных попыток авторизации. Для уровня L3 это должно включать в себя журналирование всех решений об авторизации, включая журналирование доступа к конфиденциальным данным (без регистрации самих конфиденциальных данных).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.3", + "section_name": "Инциденты безопасности", + "req_id": "V16.3.3", + "req_description": "Убедитесь, что приложение регистрирует все события безопасности, определенные в документации, а также фиксирует попытки обхода механизмов защиты, включая проверку входных данных, бизнес-логики и системы защиты от автоматизированных атак.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.3", + "section_name": "Инциденты безопасности", + "req_id": "V16.3.4", + "req_description": "Убедитесь, что приложение регистрирует в журналах неожиданные ошибки и сбои механизмов безопасности, включая, например, ошибки TLS-соединения на стороне сервера.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.4", + "section_name": "Защита журналов", + "req_id": "V16.4.1", + "req_description": "Убедитесь, что все компоненты системы логирования корректно кодируют данные, чтобы предотвратить атаки типа внедрения в журналы (log injection).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.4", + "section_name": "Защита журналов", + "req_id": "V16.4.2", + "req_description": "Убедитесь, что логи защищены от неавторизованного доступа и не могут быть модифицированы.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.4", + "section_name": "Защита журналов", + "req_id": "V16.4.3", + "req_description": "Убедитесь, что логи безопасно передаются в логически изолированную систему для анализа, обнаружения угроз, генерации оповещений и эскалации инцидентов. Это гарантирует сохранность журналов даже в случае компрометации основного приложения.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.5", + "section_name": "Обработка ошибок", + "req_id": "V16.5.1", + "req_description": "Убедитесь, что при возникновении непредвиденной или связанной с безопасностью ошибки пользователю возвращается только общее сообщение, гарантируя отсутствие раскрытия конфиденциальных внутренних данных системы, таких как трассировки стека, запросы, секретные ключи и токены.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.5", + "section_name": "Обработка ошибок", + "req_id": "V16.5.2", + "req_description": "Убедитесь, что приложение продолжает работать в безопасном режиме при недоступности внешних ресурсов, используя такие механизмы, как автоматические выключатели (circuit breakers) или плавное снижение функциональности (graceful degradation).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.5", + "section_name": "Обработка ошибок", + "req_id": "V16.5.3", + "req_description": "Убедитесь, что приложение корректно и безопасно завершает работу при возникновении исключений, предотвращая опасные сценарии по типу «fail-open», когда, например, транзакция ошибочно выполняется, несмотря на ошибки в логике валидации.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V16", + "chapter_name": "Журналирование событий безопасности и обработка ошибок", + "section_id": "V16.5", + "section_name": "Обработка ошибок", + "req_id": "V16.5.4", + "req_description": "Убедитесь, что определён обработчик ошибок «крайние меры», который будет перехватывать все необработанные ошибки. Это необходимо как для предотвращения потери информации об ошибках, которая должна быть записана в файлы журналов, так и для того, чтобы ошибка не остановила весь процесс приложения, что привело бы к потере доступности.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.1", + "section_name": "TURN-сервер", + "req_id": "V17.1.1", + "req_description": "Убедитесь, что сервис TURN (Traversal Using Relays around NAT) разрешает доступ только к IP-адресам, не зарезервированным для специальных целей (например, внутренние сети, широковещательная рассылка, loopback-адреса). Данное требование применяется как к IPv4, так и к IPv6 адресам.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.1", + "section_name": "TURN-сервер", + "req_id": "V17.1.2", + "req_description": "Убедитесь, что сервис TURN (Traversal Using Relays around NAT) защищен от исчерпания ресурсов при попытках легитимных пользователей открыть чрезмерное количество портов на сервере.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Требования к медиасерверам", + "req_id": "V17.2.1", + "req_description": "Убедитесь, что ключ сертификата Datagram Transport Layer Security (DTLS) управляется и защищается в соответствии с документированной политикой управления криптографическими ключами.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Требования к медиасерверам", + "req_id": "V17.2.2", + "req_description": "Убедитесь, что медиасервер настроен на использование только одобренных наборов шифров Datagram Transport Layer Security (DTLS) и защищенного профиля безопасности для расширения DTLS, применяемого при установке ключей для Secure Real-time Transport Protocol (DTLS-SRTP).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Требования к медиасерверам", + "req_id": "V17.2.3", + "req_description": "Убедитесь, что медиасервер проверяет аутентификацию Secure Real-time Transport Protocol (SRTP) для предотвращения атак с внедрением Real-time Transport Protocol (RTP), которые могут привести к отказу в обслуживании (Denial of Service) или вставке поддельного аудио-/видеоконтента в медиапотоки.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Требования к медиасерверам", + "req_id": "V17.2.4", + "req_description": "Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика при получении некорректных пакетов Secure Real-time Transport Protocol (SRTP).", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Требования к медиасерверам", + "req_id": "V17.2.5", + "req_description": "Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетами Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Требования к медиасерверам", + "req_id": "V17.2.6", + "req_description": "Убедитесь, что медиасервер не подвержен уязвимости «Гонка ClientHello» (ClientHello Race Condition) в Datagram Transport Layer Security (DTLS), проверив наличие известных уязвимостей в публичных источниках или выполнив тестирование на воспроизведение условий гонки.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Требования к медиасерверам", + "req_id": "V17.2.7", + "req_description": "Убедитесь, что механизмы аудио- и видеозаписи, связанные с медиасервером, способны продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетов Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.2", + "section_name": "Требования к медиасерверам", + "req_id": "V17.2.8", + "req_description": "Убедитесь, что сертификат Datagram Transport Layer Security (DTLS) проверяется на соответствие атрибуту отпечатка (fingerprint) в Session Description Protocol (SDP), с немедленным прекращением медиапотока в случае несоответствия — это гарантирует подлинность передаваемых данных.", + "level1": "", + "level2": "", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.3", + "section_name": "Сигнализация", + "req_id": "V17.3.1", + "req_description": "Убедитесь, что сигнальный сервер способен продолжать обработку легитимных входящих сообщений сигнализации даже в условиях флуд-атаки. Для этого необходимо реализовать механизм ограничения частоты запросов (rate limiting) на уровне сигнализации.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + }, + { + "chapter_id": "V17", + "chapter_name": "WebRTC", + "section_id": "V17.3", + "section_name": "Сигнализация", + "req_id": "V17.3.2", + "req_description": "Убедитесь, что сигнальный сервер способен продолжать обработку легитимных сообщений сигнализации даже при получении некорректных сообщений, которые могут вызвать отказ в обслуживании (Denial of Service, DoS). Для этого необходимо реализовать: проверку входных данных (input validation), безопасную обработку целочисленных переполнений (integer overflows), защиту от переполнения буферов (buffer overflows) и другие надежные методы обработки ошибок.", + "level1": "", + "level2": "✓", + "level3": "✓", + "cwe": "", + "nist": "" + } + ] +} diff --git a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.json b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.json new file mode 100644 index 0000000000..9ba0fb1896 --- /dev/null +++ b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.json @@ -0,0 +1,2774 @@ +{ + "Name": "Application Security Verification Standard Project", + "ShortName": "ASVS", + "Version": "", + "Description": "The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.", + "Requirements": [ + { + "Shortcode": "V1", + "Ordinal": 1, + "ShortName": "Encoding", + "Name": "Кодировка и нейтрализация", + "Items": [ + { + "Shortcode": "V1.1", + "Ordinal": 1, + "Name": "Архитектура кодировки и нейтрализации", + "Items": [ + { + "Shortcode": "V1.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что входные данные декодируются или деэкранируются в каноническую форму (в стандартное представление) только один раз. Декодирование происходит только тогда, когда ожидаются закодированные данные в этой форме, и что это делается перед дальнейшей обработкой входных данных, например, это не выполняется после проверки или нейтрализации.", + "L": "2" + }, + { + "Shortcode": "V1.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение выполняет кодирование и экранирование выходных данных либо в качестве последнего шага перед использованием интерпретатором, для которого оно предназначено, либо самим интерпретатором.", + "L": "2" + } + ] + }, + { + "Shortcode": "V1.2", + "Ordinal": 2, + "Name": "Предотвращение инъекций", + "Items": [ + { + "Shortcode": "V1.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что выходная кодировка для ответа HTTP, документа HTML или документа XML соответствует требуемому контексту, например, кодировка соответствующих символов для элементов HTML, атрибутов HTML, комментариев HTML, CSS или полей заголовка HTTP делается таким способом, чтобы избежать изменения структуры сообщения или документа.", + "L": "1" + }, + { + "Shortcode": "V1.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что при динамическом построении URL-адресов недоверенные данные кодируются в соответствии с их контекстом (например, кодирование URL-адресов или кодирование base64url для query или path параметров или пути). Убедитесь, что разрешены только безопасные протоколы URL-адресов (например, запрещен javascript: или data:).", + "L": "1" + }, + { + "Shortcode": "V1.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что при динамическом построении содержимого JavaScript (включая JSON) используется кодирование или экранирование выходных данных, чтобы избежать изменения структуры сообщения или документа (чтобы избежать JavaScript и JSON-инъекций).", + "L": "1" + }, + { + "Shortcode": "V1.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что выборка данных (Redis, Memcached, чтение из файлов, обращение по API) или запросы к базе данных (например, SQL, HQL, NoSQL, Cypher) используют параметризованные запросы, ORM, Entity Frameworks или иным образом защищены от SQL-инъекций и других атак. Это также актуально при написании хранимых процедур.", + "L": "1" + }, + { + "Shortcode": "V1.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что приложение защищено от внедрения команд ОС и что вызовы операционной системы используют параметризованные запросы к ОС или используют контекстное кодирование вывода командной строки.", + "L": "1" + }, + { + "Shortcode": "V1.2.6", + "Ordinal": 6, + "Description": "Убедитесь, что приложение защищено от LDAP-инъекций, или что реализованы специальные меры безопасности для их предотвращения.", + "L": "2" + }, + { + "Shortcode": "V1.2.7", + "Ordinal": 7, + "Description": "Убедитесь, что приложение защищено от атак с использованием XPath-инъекций с помощью параметризации запросов или предварительно скомпилированных запросов.", + "L": "2" + }, + { + "Shortcode": "V1.2.8", + "Ordinal": 8, + "Description": "Убедитесь, что процессоры LaTeX настроены безопасно (например, не используется флаг «–shell‑escape») и используется разрешенный список команд для предотвращения LaTeX-инъекций.", + "L": "2" + }, + { + "Shortcode": "V1.2.9", + "Ordinal": 9, + "Description": "Убедитесь, что приложение экранирует специальные символы в регулярных выражениях (обычно с помощью обратной косой черты), чтобы предотвратить их ошибочную интерпретацию как метасимволов.", + "L": "2" + }, + { + "Shortcode": "V1.2.10", + "Ordinal": 10, + "Description": "Убедитесь, что приложение защищено от внедрения формул CSV (CSV Injection). Приложение должно следовать правилам экранирования, определенным в RFC 4180, разделы 2.6 и 2.7, при экспорте содержимого CSV. Кроме того, при экспорте в CSV или другие форматы электронных таблиц (такие как XLS, XLSX или ODF) специальные символы (включая '=', '+', '-', '@', '\\t' (табуляция), и '\\0' (нулевой символ)) должны экранироваться одинарной кавычкой, если они появляются в качестве первого символа в значении поля.", + "L": "3" + } + ] + }, + { + "Shortcode": "V1.3", + "Ordinal": 3, + "Name": "Нейтрализация", + "Items": [ + { + "Shortcode": "V1.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что все ненадежные входные данные HTML из редакторов WYSIWYG или аналогичных программ нейтрализуются с помощью известных и безопасных библиотек или функций фреймворка для санитизации HTML.", + "L": "1" + }, + { + "Shortcode": "V1.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение избегает использования eval() или других динамических функций выполнения кода, таких как Spring Expression Language (SpEL). Если нет альтернативы, любой пользовательский ввод должен быть нейтрализован перед выполнением.", + "L": "1" + }, + { + "Shortcode": "V1.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что данные, передаваемые в потенциально опасный контекст, предварительно нейтрализованы, чтобы обеспечить соблюдение мер безопасности, таких как разрешение только тех символов, которые безопасны для данного контекста, и обрезка слишком длинного ввода.", + "L": "2" + }, + { + "Shortcode": "V1.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что предоставленный пользователем файл .SVG проверен или нейтрализован, чтобы он содержал только теги и атрибуты (например, относящиеся к рисованию), которые безопасны для приложения, например, не содержат скриптов и foreignObject.", + "L": "2" + }, + { + "Shortcode": "V1.3.5", + "Ordinal": 5, + "Description": "Убедитесь, что приложение нейтралует или отключает предоставленные пользователем скриптовые данные или выражения шаблонных языков, такие как таблицы стилей Markdown, CSS или XSL, BBCode или аналогичные.", + "L": "2" + }, + { + "Shortcode": "V1.3.6", + "Ordinal": 6, + "Description": "Убедитесь, что приложение защищено от атак с подделкой запросов на стороне сервера (SSRF), проверяя ненадежные данные по разрешенному списку протоколов, доменов, путей и портов, а также нейтрализуя потенциально опасные символы перед использованием данных для вызова другой службы.", + "L": "2" + }, + { + "Shortcode": "V1.3.7", + "Ordinal": 7, + "Description": "Убедитесь, что приложение защищено от атак с внедрением шаблонов (template injection), не позволяя создавать шаблоны на основе недоверенных входных данных. Если нет альтернативы, любые недоверенные входные данные, включаемые динамически во время создания шаблона, должны быть нейтрализованы или тщательно провалидированы.", + "L": "2" + }, + { + "Shortcode": "V1.3.8", + "Ordinal": 8, + "Description": "Убедитесь, что приложение надлежащим образом нейтрализует недоверенные входные данные перед использованием в запросах Java Naming and Directory Interface (JNDI) и что JNDI настроен безопасно для предотвращения атак с использованием JNDI-инъекций.", + "L": "2" + }, + { + "Shortcode": "V1.3.9", + "Ordinal": 9, + "Description": "Убедитесь, что приложение нейтрализует данные перед отправкой в Memcache, чтобы предотвратить атаки методом инъекций.", + "L": "2" + }, + { + "Shortcode": "V1.3.10", + "Ordinal": 10, + "Description": "Убедитесь, что строки форматирования, которые могут быть использованы неожидаемым или вредоносным образом, нейтрализуются перед дальнейшим использованием.", + "L": "2" + }, + { + "Shortcode": "V1.3.11", + "Ordinal": 11, + "Description": "Убедитесь, что приложение нейтрализует вводимые пользователем данные перед передачей в почтовые системы для защиты от SMTP или IMAP-инъекций.", + "L": "2" + }, + { + "Shortcode": "V1.3.12", + "Ordinal": 12, + "Description": "Убедитесь, что регулярные выражения не содержат элементов, вызывающих экспоненциальный возврат, и убедитесь в нейтрализации недоверенных входных данных для предотвращения атак ReDoS или Runaway Regex.", + "L": "3" + } + ] + }, + { + "Shortcode": "V1.4", + "Ordinal": 4, + "Name": "Память, строки и неуправляемый код", + "Items": [ + { + "Shortcode": "V1.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что для обнаружения или предотвращения ситуаций переполнения стека, буфера или кучи приложение учитывает размер доступной области памяти при строковых операциях, копировании в память, в арифметике указателей и т.п.", + "L": "2" + }, + { + "Shortcode": "V1.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что для предотвращения целочисленного переполнения применяется контроль знака, диапазона и типа допустимых входных данных.", + "L": "2" + }, + { + "Shortcode": "V1.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что динамически выделенная память и ресурсы освобождены, а ссылки или указатели на освобожденную память удалены или установлены в значение null, чтобы предотвратить появление висячих указателей и уязвимостей, связанных с использованием памяти после освобождения.", + "L": "2" + } + ] + }, + { + "Shortcode": "V1.5", + "Ordinal": 5, + "Name": "Безопасная десериализация", + "Items": [ + { + "Shortcode": "V1.5.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение настраивает XML-парсеры на использование строгой конфигурации и что небезопасные функции, такие как разрешение внешних сущностей, отключены для предотвращения атак XML eXternal Entity (XXE).", + "L": "1" + }, + { + "Shortcode": "V1.5.2", + "Ordinal": 2, + "Description": "Убедитесь, что десериализация недоверенных данных обеспечивает безопасную обработку ввода, например, используя список разрешенных типов объектов или ограничивая типы объектов, определяемые клиентом, для предотвращения атак десериализации. Механизмы десериализации, которые явно определены как небезопасные, не должны использоваться с недоверенным вводом.", + "L": "2" + }, + { + "Shortcode": "V1.5.3", + "Ordinal": 3, + "Description": "Убедитесь, что различные парсеры, используемые в приложении для одного и того же типа данных (например, парсеры JSON, XML, URL), выполняют парсинг согласованным образом и используют один и тот же механизм кодирования символов, чтобы избежать таких проблем, как уязвимости взаимодействия JSON (JSON Interoperability) или различное поведение анализа URI или файлов, которые могут использоваться в атаках удаленного включения файлов (RFI) или подделки запросов на стороне сервера (SSRF).", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V2", + "Ordinal": 2, + "ShortName": "Validation", + "Name": "Валидация и бизнес-логика", + "Items": [ + { + "Shortcode": "V2.1", + "Ordinal": 1, + "Name": "Документация валидации и бизнес-логики", + "Items": [ + { + "Shortcode": "V2.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что в документации приложения определены правила проверки входных данных на соответствие ожидаемой структуре. Это могут быть распространённые форматы данных, такие как номера кредитных карт, адреса электронной почты, номера телефонов, или внутренний формат данных.", + "L": "1" + }, + { + "Shortcode": "V2.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что в документации приложения указано, как проверять логическую и контекстную согласованность объединенных данных, например, проверять соответствие района и почтового индекса.", + "L": "2" + }, + { + "Shortcode": "V2.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что ожидания относительно ограничений и проверок бизнес-логики задокументированы как для уровня отдельного пользователя, так и для глобального уровня всего приложения.", + "L": "2" + } + ] + }, + { + "Shortcode": "V2.2", + "Ordinal": 2, + "Name": "Валидация ввода", + "Items": [ + { + "Shortcode": "V2.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что входные данные провалидированы для обеспечения соответствия бизнес- или функциональным ожиданиям. Валидация должна осуществляться либо по списку допустимых значений, шаблонов и диапазонов, либо путем сравнения входных данных с ожидаемой структурой и логическими ограничениями в соответствии с предопределенными правилами. Для L1 валидация может быть сосредоточена на входных данных, используемых для принятия конкретных бизнес-решений или решений, связанных с безопасностью. Для L2 и выше это должно применяться ко всем входным данным.", + "L": "1" + }, + { + "Shortcode": "V2.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение разработано с принудительной валидацией входных данных на уровне доверенного сервиса. Хотя проверка на стороне клиента повышает удобство использования и должна поощряться, на неё не следует полагаться как на средство контроля безопасности.", + "L": "1" + }, + { + "Shortcode": "V2.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение обеспечивает обоснованность комбинаций данных в соответствии с предопределенными правилам. Например: возраст должен соответствовать дате рождения; страна и почтовый индекс; количество товара в заказе и на складе.", + "L": "2" + } + ] + }, + { + "Shortcode": "V2.3", + "Ordinal": 3, + "Name": "Безопасность бизнес-логики", + "Items": [ + { + "Shortcode": "V2.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение обрабатывает потоки бизнес-логики для одного и того же пользователя в ожидаемом последовательном порядке шагов и без пропуска шагов.", + "L": "1" + }, + { + "Shortcode": "V2.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что ограничения бизнес-логики реализованы в соответствии с документацией приложения, чтобы избежать эксплуатации её недостатков.", + "L": "2" + }, + { + "Shortcode": "V2.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что транзакции используются на уровне бизнес-логики таким образом, что операция бизнес-логики либо выполняется полностью, либо откатывается к предыдущему корректному состоянию.", + "L": "2" + }, + { + "Shortcode": "V2.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что на уровне бизнес-логики используются механизмы блокировки, чтобы гарантировать невозможность двойного бронирования ограниченных по количеству ресурсов (например, мест в театре или слотов доставки) путем манипулирования логикой приложения.", + "L": "2" + }, + { + "Shortcode": "V2.3.5", + "Ordinal": 5, + "Description": "Убедитесь, что для важных потоков бизнес-логики требуется многопользовательское (multi-user) одобрение, чтобы предотвратить несанкционированные или случайные действия. Потоки бизнес-логики могут включать, помимо прочего, крупные денежные переводы, утверждение контрактов, доступ к секретной информации или обход ограничений безопасности на производстве.", + "L": "3" + } + ] + }, + { + "Shortcode": "V2.4", + "Ordinal": 4, + "Name": "Анти-автоматизация", + "Items": [ + { + "Shortcode": "V2.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что используются средства противодействия автоматизации для защиты от чрезмерных вызовов функций приложения, которые могут привести к утечке данных, созданию ненужных данных, исчерпанию квот, нарушению ограничений скорости, отказу в обслуживании или чрезмерному использованию дорогостоящих ресурсов.", + "L": "2" + }, + { + "Shortcode": "V2.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что потоки бизнес-логики требуют реалистичного человеческого времени, предотвращая чрезмерно быструю отправку транзакций.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V3", + "Ordinal": 3, + "ShortName": "Web", + "Name": "Безопасность веб-интерфейса", + "Items": [ + { + "Shortcode": "V3.1", + "Ordinal": 1, + "Name": "Документация по безопасности веб-интерфейса", + "Items": [ + { + "Shortcode": "V3.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что в документации приложения описаны ожидаемые функции безопасности, которые должны поддерживать браузеры, использующие приложение (такие как HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) и другие соответствующие механизмы безопасности HTTP). В документации также должно быть обязательно определено, как приложение должно себя вести, если некоторые из этих функций недоступны (например, предупреждать пользователя или блокировать доступ).", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.2", + "Ordinal": 2, + "Name": "Непреднамеренная интерпретация контента", + "Items": [ + { + "Shortcode": "V3.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что реализованы меры безопасности, предотвращающие отображение контента или функций браузерами в HTTP-ответах в некорректном контексте (например, запрос API, загруженный пользователем файл или другой ресурс запрашивается напрямую). Возможные способы контроля включают: не обрабатывать содержимое, если поля заголовка HTTP-запроса (например, Sec-Fetch-*) не указывают на корректность контекста; использование заголовка и значения Content-Security-Policy: sandbox directive; или использование заголовка и значения Content-Disposition: attachment.", + "L": "1" + }, + { + "Shortcode": "V3.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что данные, предназначенные для отображения в виде текста, а не визуализации в виде HTML, обрабатывается с использованием безопасных функций визуализации (таких как createTextNode или textContent), чтобы предотвратить непреднамеренное выполнение содержимого, такого как HTML или JavaScript.", + "L": "1" + }, + { + "Shortcode": "V3.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение избегает затирания DOM при использовании JavaScript на стороне клиента, применяя явные объявления переменных, выполняя строгую проверку типов, избегая сохранения глобальных переменных в объекте документа и реализуя изоляцию пространства имен.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.3", + "Ordinal": 3, + "Name": "Настройка файлов cookie", + "Items": [ + { + "Shortcode": "V3.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что у файлов cookie установлен атрибут «Secure», и если префикс «__Host‑» не используется в названии cookie, необходимо использовать префикс «__Secure‑».", + "L": "1" + }, + { + "Shortcode": "V3.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что значение атрибута SameSite каждой cookie установлено в соответствии с назначением cookie, чтобы ограничить подверженность атакам на восстановление пользовательского интерфейса и атакам с подделкой запросов на уровне браузера, обычно называемым подделкой межсайтовых запросов (CSRF).", + "L": "2" + }, + { + "Shortcode": "V3.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что cookie имеют префикс «__Host‑» в названии, если только они явно не предназначены для совместного использования с другими хостами.", + "L": "2" + }, + { + "Shortcode": "V3.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что если значение cookie не должно быть доступно для клиентских скриптов (например, сессионный токен), для cookie должен быть установлен атрибут «HttpOnly», а само значение должно передаваться клиенту только через поле заголовка «Set-Cookie».", + "L": "2" + }, + { + "Shortcode": "V3.3.5", + "Ordinal": 5, + "Description": "Убедитесь, что при записи cookie приложением общая длина имени и значения cookie не превышает 4096 байт. Слишком большие cookie не будут сохраняться браузером и, следовательно, не будут отправляться с запросами, что помешает пользователю использовать функции приложения, зависящие от этого cookie.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.4", + "Ordinal": 4, + "Name": "Заголовки механизма безопасности браузера", + "Items": [ + { + "Shortcode": "V3.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что поле заголовка Strict‑Transport‑Security включено во все ответы для реализации политики HTTP Strict Transport Security (HSTS). Необходимо указать максимальное время не менее 1 года, а для L2 и выше политика должна применяться также ко всем поддоменам.", + "L": "1" + }, + { + "Shortcode": "V3.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что поле заголовка Cross‑Origin Resource Sharing (CORS) «Access‑Control‑Allow‑Origin» имеет фиксированное значение, заданное приложением, или, если используется заголовок Origin, оно проверяется по списку доверенных источников. При необходимости использования «Access‑Control‑Allow‑Origin: *» убедитесь, что ответ не содержит конфиденциальной информации.", + "L": "1" + }, + { + "Shortcode": "V3.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что HTTP-ответы содержат поле заголовка Content-Security-Policy, которое определяет директивы, гарантирующие загрузку и выполнение браузером только доверенного контента или ресурсов, чтобы ограничить выполнение вредоносного JavaScript. Как минимум, необходимо использовать глобальную политику, включающую директивы object-src «none» и base-uri «none», а также определяющую список разрешенных адресов или использующую одноразовые коды или хэши. Для приложений L3 необходимо определить политику использования 'nonce' или hash-конструкций для каждого ответа.", + "L": "2" + }, + { + "Shortcode": "V3.4.4", + "Ordinal": 4, + "Description": "Убедитесь, что все HTTP-ответы содержат поле заголовка «X‑Content‑Type‑Options: nosniff». Это предписывает браузерам не использовать анализ контента и определение типа MIME для данного ответа, а также требовать, чтобы значение поля заголовка Content‑Type в ответе соответствовало целевому ресурсу. Например, ответ на запрос стиля принимается только в том случае, если Content‑Type в ответе — «text/css». Это также позволяет браузеру использовать функцию Cross‑Origin Read Blocking (CORB).", + "L": "2" + }, + { + "Shortcode": "V3.4.5", + "Ordinal": 5, + "Description": "Убедитесь, что приложение устанавливает политику реферера для предотвращения утечки технически конфиденциальных данных сторонним сервисам через поле заголовка HTTP-запроса «Referer». Это можно сделать с помощью поля заголовка HTTP-ответа «Referrer‑Policy» или через атрибуты HTML-элемента. Конфиденциальные данные могут включать путь и данные запроса в URL-адресе, а для внутренних непубличных приложений также имя хоста.", + "L": "2" + }, + { + "Shortcode": "V3.4.6", + "Ordinal": 6, + "Description": "Убедитесь, что веб-приложение использует директиву frame‑ancestors поля заголовка Content‑Security‑Policy для каждого HTTP-ответа, чтобы гарантировать невозможность его внедрения по умолчанию и внедрение определённых ресурсов разрешено только при необходимости. Обратите внимание, что поле заголовка X‑Frame‑Options, хотя и поддерживается браузерами, устарело и не может быть использовано в качестве основы.", + "L": "2" + }, + { + "Shortcode": "V3.4.7", + "Ordinal": 7, + "Description": "Убедитесь, что в поле заголовка Content‑Security‑Policy указано место, куда следует сообщать о нарушениях.", + "L": "3" + }, + { + "Shortcode": "V3.4.8", + "Ordinal": 8, + "Description": "Убедитесь, что все HTTP-ответы, инициирующие рендеринг документа (например, ответы с типом содержимого text/html), включают поле заголовка Cross-Origin-Opener-Policy с директивой same-origin или same-origin-allow-popups (при необходимости). Это предотвращает атаки, злоупотребляющие общим доступом к объектам Window, такие как Tabnabbing и Frame Counting.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.5", + "Ordinal": 5, + "Name": "Браузерное разделение источников", + "Items": [ + { + "Shortcode": "V3.5.1", + "Ordinal": 1, + "Description": "Убедитесь, что, если приложение не использует механизм предварительной проверки CORS для предотвращения запрещённых кросс-доменных запросов на использование чувствительного функционала, эти запросы валидируются на предмет их происхождения от самого приложения. Это можно сделать, используя и проверяя специальные токены для защиты от подделки или требуя дополнительные поля HTTP-заголовка, не входящие в список «простых заголовков» (CORS-safelisted request-header). Это необходимо для защиты от атак с подделкой запросов через браузер, широко известных как межсайтовая подделка запросов (CSRF).", + "L": "1" + }, + { + "Shortcode": "V3.5.2", + "Ordinal": 2, + "Description": "Убедитесь, что если приложение использует механизм предварительной проверки CORS для предотвращения неразрешённого использования чувствительного функционала между источниками, вызов этого функционала невозможен с помощью запроса, который не запускает предварительную проверку CORS. Для этого может потребоваться проверка значений полей заголовка запроса «Origin» и «Content-Type» или использование дополнительного поля заголовка, не входящего в безопасный список CORS.", + "L": "1" + }, + { + "Shortcode": "V3.5.3", + "Ordinal": 3, + "Description": "Убедитесь, что HTTP-запросы к чувствительному функционалу используют соответствующие HTTP-методы, такие как POST, PUT, PATCH или DELETE, а не методы, определённые спецификацией HTTP как «безопасные», такие как HEAD, OPTIONS или GET. В качестве альтернативы можно использовать строгую валидацию полей заголовка запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, навигационного запроса или загрузки ресурса (например, источника изображения), где это не ожидается.", + "L": "1" + }, + { + "Shortcode": "V3.5.4", + "Ordinal": 4, + "Description": "Убедитесь, что отдельные приложения размещены на разных именах хостов, чтобы использовать ограничения, предусмотренные политикой same-origin, включая то, как документы или скрипты, загруженные одним источником, могут взаимодействовать с ресурсами из другого источника, а также ограничения на cookie на основе имени хоста.", + "L": "2" + }, + { + "Shortcode": "V3.5.5", + "Ordinal": 5, + "Description": "Убедитесь, что сообщения, полученные интерфейсом postMessage, отвергаются, если источник сообщения не является доверенным или если синтаксис сообщения недействителен.", + "L": "2" + }, + { + "Shortcode": "V3.5.6", + "Ordinal": 6, + "Description": "Убедитесь, что функциональность JSONP не включена нигде в приложении, чтобы избежать атак с использованием межсайтового включения скриптов (XSSI).", + "L": "3" + }, + { + "Shortcode": "V3.5.7", + "Ordinal": 7, + "Description": "Убедитесь, что данные, требующие авторизации, не включены в ответы ресурсов скриптов, таких как файлы JavaScript, чтобы предотвратить атаки с использованием межсайтового включения скриптов (XSSI).", + "L": "3" + }, + { + "Shortcode": "V3.5.8", + "Ordinal": 8, + "Description": "Убедитесь, что аутентифицированные ресурсы (такие как изображения, видео, скрипты и другие документы) могут быть загружены или внедрены от имени пользователя только по назначению. Этого можно добиться путём строгой валидации полей заголовка HTTP-запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, или путём установки ограничительного поля заголовка HTTP-ответа Cross‑Origin‑Resource‑Policy, чтобы браузер блокировал возвращаемый контент.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.6", + "Ordinal": 6, + "Name": "Целостность внешних ресурсов", + "Items": [ + { + "Shortcode": "V3.6.1", + "Ordinal": 1, + "Description": "Убедитесь, что клиентские ресурсы, такие как библиотеки JavaScript, CSS или веб-шрифты, размещаются только на внешнем сервере (например, в сети доставки контента (Content Delivery Network)), если ресурс статический и имеет версии, а для проверки целостности ресурса используется механизм проверки целостности подресурсов (SRI). Если это невозможно, для каждого ресурса должно быть задокументировано решение по безопасности, обосновывающее это.", + "L": "3" + } + ] + }, + { + "Shortcode": "V3.7", + "Ordinal": 7, + "Name": "Другие соображения по безопасности браузера", + "Items": [ + { + "Shortcode": "V3.7.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение использует только те клиентские технологии, которые по-прежнему поддерживаются и считаются безопасными. Примерами технологий, не соответствующих этому требованию, являются плагины NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL или клиентские Java-апплеты.", + "L": "2" + }, + { + "Shortcode": "V3.7.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение будет автоматически перенаправлять пользователя на другое имя хоста или домен (который не контролируется приложением), только если этот хост или домен указаны в списке разрешенных.", + "L": "2" + }, + { + "Shortcode": "V3.7.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение отображает уведомление, что пользователь перенаправляется на URL-адрес, находящийся вне контроля приложения, с возможностью отмены навигации.", + "L": "3" + }, + { + "Shortcode": "V3.7.4", + "Ordinal": 4, + "Description": "Убедитесь, что домен верхнего уровня приложения (например, site.tld) ​​добавлен в публичный список предварительной загрузки (preload list) для HTTP Strict Transport Security (HSTS). Это гарантирует, что использование TLS для приложения будет встроено непосредственно в основные браузеры, а не будет полагаться только на поле заголовка ответа Strict-Transport-Security.", + "L": "3" + }, + { + "Shortcode": "V3.7.5", + "Ordinal": 5, + "Description": "Убедитесь, что приложение ведет себя так, как описано в документации (например, предупреждает пользователя или блокирует доступ), если браузер, используемый для доступа к приложению, не поддерживает ожидаемые функции безопасности.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V4", + "Ordinal": 4, + "ShortName": "API", + "Name": "API и Веб-сервис", + "Items": [ + { + "Shortcode": "V4.1", + "Ordinal": 1, + "Name": "Общая безопасность веб-сервисов", + "Items": [ + { + "Shortcode": "V4.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что каждый HTTP-ответ с телом сообщения содержит заголовок Content-Type, который соответствует фактическому содержимому ответа, таким как «text/», «/+xml» и «/xml», включая параметр charset для указания безопасной кодировки символов (например, UTF-8, ISO-8859-1) согласно IANA Media Types.", + "L": "1" + }, + { + "Shortcode": "V4.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что только конечные точки, предназначенные для взаимодействия с пользователем через веб-браузер, автоматически перенаправляют HTTP на HTTPS, в то время как другие сервисы или конечные точки не реализуют прозрачные редиректы. Это необходимо, чтобы избежать ситуации, когда клиент ошибочно отправляет незашифрованные HTTP-запросы а из-за того, что запрос по HTTP автоматически перенаправляется на HTTPS другим сервисом без обработки на входе, утечка чувствительных данных остаётся незамеченной.", + "L": "2" + }, + { + "Shortcode": "V4.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что любой HTTP-заголовок, используемый приложением и устанавливаемый промежуточным уровнем, таким как балансировщик нагрузки, веб-прокси или backend-for-frontend сервис, не может быть переопределён конечным пользователем. Примеры заголовков: X-Real-IP, X-Forwarded-*, X-User-ID.", + "L": "2" + }, + { + "Shortcode": "V4.1.4", + "Ordinal": 4, + "Description": "Убедитесь, что разрешены только HTTP-методы, которые явно поддерживаются приложением или его API (включая OPTIONS для preflight-запросов), а неиспользуемые методы заблокированы.", + "L": "3" + }, + { + "Shortcode": "V4.1.5", + "Ordinal": 5, + "Description": "Убедитесь, что для особо чувствительных запросов или транзакций, проходящих через несколько систем, используются цифровые подписи на уровне сообщений, дополнительно к транспортным средствам защиты.", + "L": "3" + } + ] + }, + { + "Shortcode": "V4.2", + "Ordinal": 2, + "Name": "Валидация структуры HTTP-сообщений", + "Items": [ + { + "Shortcode": "V4.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что все компоненты приложения (включая балансировщики нагрузки, файрволы и серверы приложений) определяют границы входящих HTTP-сообщений с использованием механизма, соответствующего версии HTTP, чтобы предотвратить HTTP request smuggling. В HTTP/1.x, если присутствует заголовок Transfer-Encoding, заголовок Content-Length должен игнорироваться согласно RFC 2616. При использовании HTTP/2 или HTTP/3, если присутствует Content-Length, веб-сервер должен убедиться, что он совпадает с длиной DATA-фреймов.", + "L": "2" + }, + { + "Shortcode": "V4.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что при генерации HTTP-сообщений заголовок Content-Length не конфликтует с длиной содержимого, определяемой рамками протокола HTTP, чтобы предотвратить HTTP Request Smuggling.", + "L": "3" + }, + { + "Shortcode": "V4.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение не отправляет и не принимает HTTP/2 и HTTP/3 сообщения с заголовками, специфичными для соединения, такими как Transfer-Encoding, чтобы предотвратить HTTP Response Splitting и HTTP Header Injection.", + "L": "3" + }, + { + "Shortcode": "V4.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что приложение принимает HTTP/2 и HTTP/3 запросы только в случае, если поля заголовков и их значения не содержат последовательностей CR (\\r), LF (\\n) или CRLF (\\r\\n), чтобы предотвратить HTTP Header Injection.", + "L": "3" + }, + { + "Shortcode": "V4.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что если приложение (бекенд или фронтенд) формирует и отправляет запросы, оно использует валидацию, очистку или другие механизмы, чтобы не создавать URI (например, для API-вызовов) или HTTP-заголовки (например, Authorization или Cookie) слишком большой длины, чтобы их не принимал приёмник. Это может привести к отказу в обслуживании, например, при отправке слишком длинного запроса (длинный cookie-заголовок), из-за чего сервер постоянно возвращает ошибку.", + "L": "3" + } + ] + }, + { + "Shortcode": "V4.3", + "Ordinal": 3, + "Name": "GraphQL", + "Items": [ + { + "Shortcode": "V4.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что используется белый список запросов, ограничение глубины вложенности, ограничение количества или анализ стоимости запроса, чтобы предотвратить DoS-атаки на уровне GraphQL или слоя данных из-за дорогостоящих вложенных запросов.", + "L": "2" + }, + { + "Shortcode": "V4.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что introspection-запросы GraphQL отключены в продакшен-среде, если GraphQL API не предназначен для использования сторонними клиентами.", + "L": "2" + } + ] + }, + { + "Shortcode": "V4.4", + "Ordinal": 4, + "Name": "WebSocket", + "Items": [ + { + "Shortcode": "V4.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что для всех WebSocket-соединений используется WebSocket поверх TLS (WSS).", + "L": "1" + }, + { + "Shortcode": "V4.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что при первоначальном HTTP WebSocket handshake заголовок Origin проверяется на соответствие списку разрешённых источников для приложения.", + "L": "2" + }, + { + "Shortcode": "V4.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что если стандартное управление сессиями приложения не может быть использовано, применяются специальные токены, соответствующие требованиям безопасности управления сессиями.", + "L": "2" + }, + { + "Shortcode": "V4.4.4", + "Ordinal": 4, + "Description": "Убедитесь, что специальные токены управления сессиями WebSocket изначально получаются или валидируются через ранее аутентифицированную HTTPS-сессию при переходе от HTTPS к WebSocket.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V5", + "Ordinal": 5, + "ShortName": "File", + "Name": "Работа с файлами", + "Items": [ + { + "Shortcode": "V5.1", + "Ordinal": 1, + "Name": "Документация по работе с файлами", + "Items": [ + { + "Shortcode": "V5.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что документация определяет допустимые типы файлов, ожидаемые расширения и максимальный размер (включая распакованный размер) для каждой функции загрузки. Также убедитесь, что в документации указано, как файлы обезвреживаются для конечных пользователей (например, как приложение ведёт себя при обнаружении вредоносного файла).", + "L": "2" + } + ] + }, + { + "Shortcode": "V5.2", + "Ordinal": 2, + "Name": "Загрузка файлов и содержимое", + "Items": [ + { + "Shortcode": "V5.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение принимает только те файлы, которые может обработать без потери производительности или отказа в обслуживании.", + "L": "1" + }, + { + "Shortcode": "V5.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что при загрузке файла (включая файлы внутри архивов, таких как ZIP) приложение проверяет, соответствует ли расширение ожидаемому, и валидирует, соответствует ли содержимое типу, указанному в расширении. Это включает проверку начальных 'magic bytes', перезапись изображений, использование специализированных библиотек. Для уровня 1 — достаточно проверок для файлов, критичных с точки зрения бизнеса или безопасности. Для уровней 2 и выше — для всех файлов.", + "L": "1" + }, + { + "Shortcode": "V5.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение проверяет архивы (например, zip, gz, docx, odt) на максимально допустимый распакованный размер и максимальное количество файлов до распаковки.", + "L": "2" + }, + { + "Shortcode": "V5.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что для каждого пользователя установлены квоты на общий размер и количество файлов, чтобы один пользователь не мог переполнить хранилище.", + "L": "3" + }, + { + "Shortcode": "V5.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что приложение не позволяет загружать архивы с символьными ссылками (symlinks), если это не требуется по бизнес-логике. Если требуется — разрешён только строго определённый список допустимых символьных ссылок.", + "L": "3" + }, + { + "Shortcode": "V5.2.6", + "Ordinal": 6, + "Description": "Убедитесь, что приложение отклоняет изображения с числом пикселей выше допустимого, чтобы предотвратить атаки 'pixel flood'.", + "L": "3" + } + ] + }, + { + "Shortcode": "V5.3", + "Ordinal": 3, + "Name": "Хранение файлов", + "Items": [ + { + "Shortcode": "V5.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что загруженные или сгенерированные из недоверенного ввода файлы, находящиеся в публичной директории, не исполняются как серверный код при обращении к ним по HTTP.", + "L": "1" + }, + { + "Shortcode": "V5.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что при создании путей к файлам приложение использует внутренние или доверенные данные, а не пользовательские имена файлов. Если использование пользовательских имён или метаданных необходимо — требуется строгая проверка и очистка. Это защита от path traversal, LFI, RFI и SSRF.", + "L": "1" + }, + { + "Shortcode": "V5.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что при обработке файлов на сервере (например, при распаковке) игнорируются пути, заданные пользователем, во избежание уязвимостей типа 'zip slip'.", + "L": "3" + } + ] + }, + { + "Shortcode": "V5.4", + "Ordinal": 4, + "Name": "Скачивание файлов", + "Items": [ + { + "Shortcode": "V5.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение валидирует или игнорирует имена файлов, переданных пользователем (включая в JSON, JSONP или URL-параметре), и указывает имя файла в заголовке Content-Disposition при ответе.", + "L": "2" + }, + { + "Shortcode": "V5.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что имена файлов, передаваемые (например, в HTTP-заголовках или вложениях в email), кодируются или очищаются (например, по RFC 6266), чтобы сохранить структуру документа и предотвратить инъекции.", + "L": "2" + }, + { + "Shortcode": "V5.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что файлы, полученные из недоверенных источников, сканируются антивирусом, чтобы не распространять известное вредоносное содержимое.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V6", + "Ordinal": 6, + "ShortName": "Authentication", + "Name": "Аутентификация", + "Items": [ + { + "Shortcode": "V6.1", + "Ordinal": 1, + "Name": "Документация по аутентификации", + "Items": [ + { + "Shortcode": "V6.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что в документации приложения описано, как используются механизмы, такие как ограничение частоты запросов (rate limiting), защита от автоматизации и адаптивные реакции, для защиты от атак, таких как подстановка учётных данных и перебор паролей. Документация должна ясно описывать конфигурацию этих механизмов и предотвращение злонамеренной блокировки аккаунтов.", + "L": "1" + }, + { + "Shortcode": "V6.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что задокументирован список контекстно-зависимых слов, запрещённых к использованию в паролях. В него могут входить производные от названий организаций, продуктов, идентификаторов систем, кодовых названий проектов, названий отделов или ролей и тому подобное.", + "L": "2" + }, + { + "Shortcode": "V6.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что если приложение поддерживает несколько способов аутентификации, то все они документированы вместе с описанием применяемых средств защиты и уровнем стойкости аутентификации, которые должны быть одинаково применены ко всем способам.", + "L": "2" + } + ] + }, + { + "Shortcode": "V6.2", + "Ordinal": 2, + "Name": "Безопасность паролей", + "Items": [ + { + "Shortcode": "V6.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что пользовательские пароли содержат не менее 8 символов. Рекомендуется минимальная длина в 15 символов.", + "L": "1" + }, + { + "Shortcode": "V6.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что пользователи могут менять свои пароли.", + "L": "1" + }, + { + "Shortcode": "V6.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что для смены пароля требуется ввести как текущий, так и новый пароль.", + "L": "1" + }, + { + "Shortcode": "V6.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что при регистрации или смене пароля введённый пароль проверяется по списку как минимум из 3000 самых популярных паролей, соответствующих политике (например, минимальной длине).", + "L": "1" + }, + { + "Shortcode": "V6.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что допускаются пароли любой структуры, без ограничений на использование определённых символов. Не должно быть требований по обязательному наличию заглавных/строчных букв, цифр или специальных символов.", + "L": "1" + }, + { + "Shortcode": "V6.2.6", + "Ordinal": 6, + "Description": "Убедитесь, что поля ввода пароля используют type=password для скрытия символов. Разрешено временное отображение всего пароля или последнего введённого символа.", + "L": "1" + }, + { + "Shortcode": "V6.2.7", + "Ordinal": 7, + "Description": "Убедитесь, что разрешены вставка (paste), использование менеджеров паролей браузера и внешних менеджеров паролей.", + "L": "1" + }, + { + "Shortcode": "V6.2.8", + "Ordinal": 8, + "Description": "Убедитесь, что пароль проверяется строго в том виде, в котором он был введён пользователем — без обрезки, изменения регистра и других модификаций.", + "L": "1" + }, + { + "Shortcode": "V6.2.9", + "Ordinal": 9, + "Description": "Убедитесь, что система позволяет использовать пароли длиной не менее 64 символов.", + "L": "2" + }, + { + "Shortcode": "V6.2.10", + "Ordinal": 10, + "Description": "Убедитесь, что пароль остаётся действительным, пока не будет скомпрометирован или не будет изменён пользователем. Приложение не должно требовать регулярной смены пароля.", + "L": "2" + }, + { + "Shortcode": "V6.2.11", + "Ordinal": 11, + "Description": "Убедитесь, что используется документированный список контекстно-зависимых слов (например, названия компаний, проектов и т.д.) для предотвращения использования легко угадываемых паролей.", + "L": "2" + }, + { + "Shortcode": "V6.2.12", + "Ordinal": 12, + "Description": "Убедитесь, что при регистрации или смене пароля проверяется, не входит ли он в список скомпрометированных (утёкших) паролей.", + "L": "2" + } + ] + }, + { + "Shortcode": "V6.3", + "Ordinal": 3, + "Name": "Общие требования к безопасности аутентификации", + "Items": [ + { + "Shortcode": "V6.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что реализованы меры защиты от атак типа credential stuffing (массовая подстановка учётных данных) и brute-force (перебор паролей), согласно документации по безопасности приложения.", + "L": "1" + }, + { + "Shortcode": "V6.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что в приложении отсутствуют или отключены учётные записи по умолчанию (например, root, admin, sa).", + "L": "1" + }, + { + "Shortcode": "V6.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что для доступа к приложению используется либо механизм многофакторной аутентификации, либо комбинация однофакторных. Для уровня L3 один из факторов должен быть аппаратным, обеспечивающим защиту от фишинга, устойчивость к компрометации и подтверждение намерения аутентификации через явное действие пользователя (например, нажатие кнопки на FIDO-ключе или телефоне). Ослабление этих требований допускается только при наличии обоснования и компенсирующих мер.", + "L": "2" + }, + { + "Shortcode": "V6.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что при наличии нескольких способов аутентификации, они все задокументированы, и для них единообразно применяются меры защиты и уровни доверия.", + "L": "2" + }, + { + "Shortcode": "V6.3.5", + "Ordinal": 5, + "Description": "Убедитесь, что пользователи получают уведомления о подозрительных попытках аутентификации (удачных и неудачных). Это может включать попытки (например, подключения) с необычного устройства или места, частично успешную MFA, попытку после долгого отсутствия или успешную аутентификацию после серии неудачных.", + "L": "3" + }, + { + "Shortcode": "V6.3.6", + "Ordinal": 6, + "Description": "Убедитесь, что email не используется ни как однофакторный, ни как многофакторный механизм аутентификации.", + "L": "3" + }, + { + "Shortcode": "V6.3.7", + "Ordinal": 7, + "Description": "Убедитесь, что пользователи получают уведомление при изменении данных аутентификации, таких как сброс пароля или изменение логина/email.", + "L": "3" + }, + { + "Shortcode": "V6.3.8", + "Ordinal": 8, + "Description": "Убедитесь, что из сообщений об ошибке, HTTP-кодов ответа или различий во времени ответа нельзя определить, существует ли пользователь с таким логином. Это правило также должно применяться к функциям регистрации и восстановления пароля.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.4", + "Ordinal": 4, + "Name": "Жизненный цикл и восстановление факторов аутентификации", + "Items": [ + { + "Shortcode": "V6.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что начальные пароли или коды активации, генерируемые системой, создаются с использованием надёжного генератора случайных чисел, соответствуют текущей политике паролей и истекают через короткий период времени либо после первого использования. Эти секреты не должны использоваться как постоянные пароли.", + "L": "1" + }, + { + "Shortcode": "V6.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что в системе отсутствуют подсказки к паролю или вопросы на знание («секретные вопросы»).", + "L": "1" + }, + { + "Shortcode": "V6.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что реализован безопасный процесс сброса забытого пароля, который не обходит активные механизмы многофакторной аутентификации.", + "L": "2" + }, + { + "Shortcode": "V6.4.4", + "Ordinal": 4, + "Description": "Убедитесь, что в случае утраты одного из факторов MFA проводится удостоверение личности (identity proofing) на том же уровне, что и при первичной регистрации.", + "L": "2" + }, + { + "Shortcode": "V6.4.5", + "Ordinal": 5, + "Description": "Убедитесь, что инструкции по обновлению истекающих механизмов аутентификации отправляются заранее, с достаточным запасом времени для выполнения замены, при необходимости с настройкой автоматических напоминаний.", + "L": "3" + }, + { + "Shortcode": "V6.4.6", + "Ordinal": 6, + "Description": "Убедитесь, что администраторы могут инициировать процесс сброса пароля, но не могут задать или выбрать новый пароль за пользователя. Это исключает ситуацию, при которой администратор знает пароль пользователя.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.5", + "Ordinal": 5, + "Name": "Общие требования к многофакторной аутентификации", + "Items": [ + { + "Shortcode": "V6.5.1", + "Ordinal": 1, + "Description": "Убедитесь, что lookup-секреты, внеполосные коды/запросы и TOTP-коды можно использовать только один раз.", + "L": "2" + }, + { + "Shortcode": "V6.5.2", + "Ordinal": 2, + "Description": "Убедитесь, что при хранении lookup-секретов с энтропией менее 112 бит (например, 19 случайных буквенно-цифровых символов или 34 случайные цифры) они хэшируются с использованием разрешённого алгоритма хеширования паролей и случайной соли минимум 32 бита. Если у секрета ≥112 бит энтропии — допустимо использовать стандартный хэш.", + "L": "2" + }, + { + "Shortcode": "V6.5.3", + "Ordinal": 3, + "Description": "Убедитесь, что lookup-секреты, коды внеполосной аутентификации и сиды для TOTP генерируются с использованием криптографически стойкого генератора случайных чисел (CSPRNG), чтобы избежать предсказуемых значений.", + "L": "2" + }, + { + "Shortcode": "V6.5.4", + "Ordinal": 4, + "Description": "Убедитесь, что lookup-секреты и внеполосные коды аутентификации имеют минимум 20 бит энтропии (достаточно, например, 4 случайных алфавитно-цифровых символов или 6 случайных цифр).", + "L": "2" + }, + { + "Shortcode": "V6.5.5", + "Ordinal": 5, + "Description": "Убедитесь, что все внеполосные запросы, коды и токены, а также TOTP-коды имеют ограниченный срок действия. Максимум для out-of-band — 10 минут, для TOTP — 30 секунд.", + "L": "2" + }, + { + "Shortcode": "V6.5.6", + "Ordinal": 6, + "Description": "Убедитесь, что любой фактор аутентификации (включая физические устройства) может быть отозван в случае кражи или утери.", + "L": "3" + }, + { + "Shortcode": "V6.5.7", + "Ordinal": 7, + "Description": "Убедитесь, что биометрические механизмы аутентификации используются только как вторичный фактор — в сочетании с «чем-то, что вы знаете» или «чем-то, что у вас есть».", + "L": "3" + }, + { + "Shortcode": "V6.5.8", + "Ordinal": 8, + "Description": "Убедитесь, что TOTP-коды проверяются по источнику времени, полученному от доверенного сервиса, а не от клиента или недоверенного источника.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.6", + "Ordinal": 6, + "Name": "Внеполосные механизмы аутентификации", + "Items": [ + { + "Shortcode": "V6.6.1", + "Ordinal": 1, + "Description": "Убедитесь, что механизмы аутентификации через телефонную сеть общего пользования (PSTN) для доставки одноразовых паролей (OTP) по телефону или SMS используются только в случае предварительной валидации номера, при этом предлагаются альтернативные более безопасные методы (например, TOTP), и пользователю сообщаются риски. Для приложений уровня L3 использование телефона и SMS недопустимо.", + "L": "2" + }, + { + "Shortcode": "V6.6.2", + "Ordinal": 2, + "Description": "Убедитесь, что внеполосные запросы, коды или токены привязаны к исходному запросу аутентификации, для которого они были сгенерированы, и не могут быть использованы повторно для других попыток.", + "L": "2" + }, + { + "Shortcode": "V6.6.3", + "Ordinal": 3, + "Description": "Убедитесь, что внеполосные механизмы на основе кода защищены от атак методом подбора (brute force) путём применения ограничения частоты запросов (rate limiting). Также рекомендуется использовать коды с энтропией не менее 64 бит.", + "L": "2" + }, + { + "Shortcode": "V6.6.4", + "Ordinal": 4, + "Description": "Убедитесь, что при использовании push-уведомлений для MFA применяется ограничение частоты (rate limiting), чтобы предотвратить атаки push-бомбинга. Также может помочь механизм сопоставления номеров (number matching).", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.7", + "Ordinal": 7, + "Name": "Криптографические механизмы аутентификации", + "Items": [ + { + "Shortcode": "V6.7.1", + "Ordinal": 1, + "Description": "Убедитесь, что сертификаты, используемые для проверки криптографических утверждений об аутентификации, хранятся таким образом, чтобы исключить возможность их модификации.", + "L": "3" + }, + { + "Shortcode": "V6.7.2", + "Ordinal": 2, + "Description": "Убедитесь, что nonce (случайная строка), используемая в процессе вызова, имеет длину не менее 64 бит и является статистически уникальной или уникальной на протяжении всего срока службы криптографического устройства.", + "L": "3" + } + ] + }, + { + "Shortcode": "V6.8", + "Ordinal": 8, + "Name": "Аутентификация с использованием провайдера идентификаций (IdP)", + "Items": [ + { + "Shortcode": "V6.8.1", + "Ordinal": 1, + "Description": "Убедитесь, что при поддержке несколькими IdP, невозможно подделать личность пользователя через другой IdP (например, с тем же user ID). Стандартным способом защиты является регистрация пользователя с использованием сочетания ID самого IdP (в качестве пространства имён) и пользовательского ID внутри IdP.", + "L": "2" + }, + { + "Shortcode": "V6.8.2", + "Ordinal": 2, + "Description": "Убедитесь, что наличие и целостность цифровой подписи в утверждениях аутентификации (например, в JWT или SAML) всегда проверяются, а неподписанные или недействительные утверждения отклоняются.", + "L": "2" + }, + { + "Shortcode": "V6.8.3", + "Ordinal": 3, + "Description": "Убедитесь, что SAML-утверждения обрабатываются только один раз в течение периода их действия, чтобы исключить атаки воспроизведения (replay attacks).", + "L": "2" + }, + { + "Shortcode": "V6.8.4", + "Ordinal": 4, + "Description": "Убедитесь, что если приложение использует внешний поставщик идентификации (IdP) и для определенных функций требуется особый уровень, метод или срок действия аутентификации, то приложение использует данные, возвращаемые IdP, для проверки этих условий. Например, при использовании OIDC можно проверить значения полей ID Token — acr, amr, auth_time (если они есть). Если IdP не предоставляет эти данные, приложение должно иметь документированный план действий по умолчанию, предполагающий использование минимально допустимой силы аутентификации (например, одноступенчатая — логин и пароль).", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V7", + "Ordinal": 7, + "ShortName": "Session", + "Name": "Управление сессиями", + "Items": [ + { + "Shortcode": "V7.1", + "Ordinal": 1, + "Name": "Документация по управлению сессиями", + "Items": [ + { + "Shortcode": "V7.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что тайм-аут бездействия и абсолютное максимальное время жизни сессии задокументированы, соответствуют другим контрольным мерам и сопровождаются обоснованием любых отклонений от требований повторной аутентификации NIST SP 800-63B.", + "L": "2" + }, + { + "Shortcode": "V7.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что документация определяет допустимое количество одновременных (параллельных) сессий для одного аккаунта, а также поведение системы и действия при достижении этого лимита.", + "L": "2" + }, + { + "Shortcode": "V7.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что все системы, создающие и управляющие сессиями пользователей в рамках федеративной идентификации (например, SSO), задокументированы вместе с механизмами координации сроков действия сессий, условий завершения и случаев, требующих повторной аутентификации.", + "L": "2" + } + ] + }, + { + "Shortcode": "V7.2", + "Ordinal": 2, + "Name": "Базовая безопасность сессий", + "Items": [ + { + "Shortcode": "V7.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что все проверки сессионных токенов выполняются на доверенной серверной стороне.", + "L": "1" + }, + { + "Shortcode": "V7.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение использует либо автономные токены, либо ссылочные токены, которые генерируются динамически, не используя статические API-секреты или ключи.", + "L": "1" + }, + { + "Shortcode": "V7.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что ссылочные токены являются уникальными, создаются с использованием криптографически безопасного генератора псевдослучайных чисел (CSPRNG) и обладают энтропией не менее 128 бит.", + "L": "1" + }, + { + "Shortcode": "V7.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что при аутентификации пользователя (включая повторную) создается новый токен сессии, а текущий — аннулируется.", + "L": "1" + } + ] + }, + { + "Shortcode": "V7.3", + "Ordinal": 3, + "Name": "Тайм-ауты сессии", + "Items": [ + { + "Shortcode": "V7.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что есть тайм-аут бездействия, после которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.", + "L": "2" + }, + { + "Shortcode": "V7.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что установлено абсолютное максимальное время жизни сессии, по истечении которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.", + "L": "2" + } + ] + }, + { + "Shortcode": "V7.4", + "Ordinal": 4, + "Name": "Завершение сессий", + "Items": [ + { + "Shortcode": "V7.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что после завершения сессии (logout, истечение срока) дальнейшее её использование невозможно. Для ссылочных токенов или сессий с сохранением состояния это означает аннулирование на сервере. Для self-contained токенов необходимо реализовать механизм отзыва, например, список отозванных токенов, проверку времени выпуска или ротацию ключей подписи для каждого пользователя.", + "L": "1" + }, + { + "Shortcode": "V7.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что при удалении или отключении пользователя все активные сессии немедленно завершаются.", + "L": "1" + }, + { + "Shortcode": "V7.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что после изменения или удаления факторов аутентификации (например, смена пароля или MFA) приложение предлагает завершить все другие активные сессии.", + "L": "2" + }, + { + "Shortcode": "V7.4.4", + "Ordinal": 4, + "Description": "Убедитесь, что на всех страницах, требующих аутентификации, имеется простой и видимый способ выхода.", + "L": "2" + }, + { + "Shortcode": "V7.4.5", + "Ordinal": 5, + "Description": "Убедитесь, что администраторы могут завершать активные сессии конкретного пользователя или всех пользователей.", + "L": "2" + } + ] + }, + { + "Shortcode": "V7.5", + "Ordinal": 5, + "Name": "Защита от злоупотреблений сессией", + "Items": [ + { + "Shortcode": "V7.5.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение требует полной повторной аутентификации перед изменением чувствительных атрибутов аккаунта, которые могут влиять на аутентификацию (например, email, номер телефона, настройки MFA или данных восстановления доступа).", + "L": "2" + }, + { + "Shortcode": "V7.5.2", + "Ordinal": 2, + "Description": "Убедитесь, что пользователь может просматривать и (после повторной аутентификации хотя бы по одному фактору) завершать активные сессии.", + "L": "2" + }, + { + "Shortcode": "V7.5.3", + "Ordinal": 3, + "Description": "Убедитесь, что перед выполнением критически важных операций приложение требует повторной аутентификации (по крайней мере, одного фактора) или дополнительной проверки.", + "L": "3" + } + ] + }, + { + "Shortcode": "V7.6", + "Ordinal": 6, + "Name": "Федеративная повторная аутентификация", + "Items": [ + { + "Shortcode": "V7.6.1", + "Ordinal": 1, + "Description": "Убедитесь, что срок действия и завершение сессий между RP и IdP соответствуют документации и включают повторную аутентификацию, если достигнут максимальный допустимый интервал между событиями аутентификации.", + "L": "2" + }, + { + "Shortcode": "V7.6.2", + "Ordinal": 2, + "Description": "Убедитесь, что создание сессии требует согласия пользователя или явного действия, предотвращающего несанкционированное создание сессий без участия пользователя.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V8", + "Ordinal": 8, + "ShortName": "Authorization", + "Name": "Авторизация", + "Items": [ + { + "Shortcode": "V8.1", + "Ordinal": 1, + "Name": "Документация по авторизации", + "Items": [ + { + "Shortcode": "V8.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне функций и на уровне данных на основе прав субъекта и атрибутов ресурса.", + "L": "1" + }, + { + "Shortcode": "V8.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне полей (как на чтение, так и на запись) на основе прав субъекта и атрибутов ресурса. Эти правила могут зависеть от других атрибутов объекта данных, например, статуса.", + "L": "2" + }, + { + "Shortcode": "V8.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что документация определяет, какие атрибуты окружения и контекста (например, время суток, IP-адрес, местоположение, устройство) используются приложением для принятия решений в области аутентификации и авторизации.", + "L": "3" + }, + { + "Shortcode": "V8.1.4", + "Ordinal": 4, + "Description": "Убедитесь, что документация по аутентификации и авторизации определяет, как используются факторы окружения и контекста в принятии решений, наряду с правилами доступа к функциям, данным и полям. Документация должна содержать оцениваемые атрибуты, пороговые значения риска, действия (разрешить, отказать, повысить уровень аутентификации и др.).", + "L": "3" + } + ] + }, + { + "Shortcode": "V8.2", + "Ordinal": 2, + "Name": "Архитектура авторизации", + "Items": [ + { + "Shortcode": "V8.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение обеспечивает доступ на уровне функций (function-level) только субъектам с явными разрешениями.", + "L": "1" + }, + { + "Shortcode": "V8.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение обеспечивает доступ на уровне данных (data-specific) только тем субъектам, которым явно предоставлены права к определённым элементам данных, чтобы предотвратить IDOR (Insecure Direct Object Reference) и BOLA-уязвимости (Broken Object Level Authorization).", + "L": "1" + }, + { + "Shortcode": "V8.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение обеспечивает доступ на уровне полей (field-level) только тем субъектам, которым явно предоставлены права к определённым полям, чтобы предотвратить BOPLA (Broken Object Property Level Authorization).", + "L": "2" + }, + { + "Shortcode": "V8.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что реализованы адаптивные меры безопасности, основанные на атрибутах окружения и контекста субъекта (время, местоположение, IP, устройство), которые используются для принятия решений об аутентификации и авторизации, как это определено в документации приложения. Эти меры должны применяться как при попытке субъекта начать новую сессию, так и во время существующей сессии.", + "L": "3" + } + ] + }, + { + "Shortcode": "V8.3", + "Ordinal": 3, + "Name": "Авторизация на уровне операций", + "Items": [ + { + "Shortcode": "V8.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что правила авторизации реализуются на доверенном сервисном уровне и не зависят от элементов, которые может контролировать клиент (например, JavaScript на стороне клиента).", + "L": "1" + }, + { + "Shortcode": "V8.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что изменения значений, влияющих на авторизацию, применяются немедленно. Если это невозможно (например, при использовании автономных токенов), должны быть реализованы компенсирующие меры: оповещения о попытке несанкционированного действия и откат изменений. Обратите внимание, что данный подход не предотвращает утечку информации.", + "L": "3" + }, + { + "Shortcode": "V8.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что доступ к объекту осуществляется на основе прав субъекта, инициировавшего запрос, а не прав промежуточного сервиса, действующего от его имени. Например, если пользователь обращается к веб-сервису с автономным токеном для аутентификации, а сервис затем запрашивает данные у другого сервиса, второй сервис должен использовать токен пользователя, а не токен первого сервиса для принятия решения о доступе.", + "L": "3" + } + ] + }, + { + "Shortcode": "V8.4", + "Ordinal": 4, + "Name": "Прочие аспекты авторизации", + "Items": [ + { + "Shortcode": "V8.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что в мультитенантных приложениях реализованы механизмы, предотвращающие действия потребителя в отношении арендаторов, к которым у него нет доступа.", + "L": "2" + }, + { + "Shortcode": "V8.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что доступ к административным интерфейсам защищён несколькими уровнями контроля, включая непрерывную проверку личности, контроль защищённости устройства и анализ контекстных рисков. Недостаточно опираться только на IP-адрес или доверенные устройства.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V9", + "Ordinal": 9, + "ShortName": "Self", + "Name": "Автономные токены", + "Items": [ + { + "Shortcode": "V9.1", + "Ordinal": 1, + "Name": "Источник токена и его целостность", + "Items": [ + { + "Shortcode": "V9.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что автономные токены проверяются на целостность с помощью цифровой подписи или MAC, прежде чем доверять их содержимому.", + "L": "1" + }, + { + "Shortcode": "V9.1.2", + "Ordinal": 2, + "Description": "Проверяйте, что автономные токены создаются и проверяются исключительно с помощью алгоритмов из списка допустимых в данном контексте. Список допустимых алгоритмов должен включать только разрешенные алгоритмы (желательно либо только симметричные, либо только асимметричные) и ни в коем случае не содержать алгоритм None. Если необходимо поддерживать оба типа алгоритмов, потребуются дополнительные средства контроля для предотвращения путаницы с ключами (key confusion).", + "L": "1" + }, + { + "Shortcode": "V9.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что ключи, используемые для проверки автономных токенов, получены из доверенных, предварительно настроенных источников. Это предотвращает возможность указания злоумышленниками ненадёжных источников и ключей. Для JWT и других JWS структур заголовки 'jku', 'x5u' и 'jwk' должны проверяться по белому списку.", + "L": "1" + } + ] + }, + { + "Shortcode": "V9.2", + "Ordinal": 2, + "Name": "Содержимое токена", + "Items": [ + { + "Shortcode": "V9.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что при указанном сроке действия токен и его содержимое принимаются только в том случае, если срок действия токена не истёк. Например, для JWT нужно проверить поля 'nbf' и 'exp'.", + "L": "1" + }, + { + "Shortcode": "V9.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что сервис, принимающий токен, проверяет его тип и соответствие назначению перед обработкой содержимого токена. Например, для принятия решений об авторизации могут быть приняты только Access Token, а для подтверждения аутентификации пользователя — только ID Token.", + "L": "2" + }, + { + "Shortcode": "V9.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что сервис принимает только токены, предназначенные для использования с этим сервисом (audience). Для JWT это можно сделать, проверив наличие утверждения «aud» по белому списку, определенному в сервисе.", + "L": "2" + }, + { + "Shortcode": "V9.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что, если эмитент токенов использует один и тот же закрытый ключ для выпуска токенов различным сервисам (audiences), выпущенные токены содержат явное указание целевых сервисов. Это предотвратит повторное использования токенов в не предназначенных для них сервисах. Если идентификатор сервиса (audience identifier) назначается динамически, эмитент токенов должен проверить audiences для исключения подмены получателей (audience impersonation).", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V10", + "Ordinal": 10, + "ShortName": "OAuth", + "Name": "OAuth и OIDC", + "Items": [ + { + "Shortcode": "V10.1", + "Ordinal": 1, + "Name": "Общие требования безопасности OAuth и OIDC", + "Items": [ + { + "Shortcode": "V10.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что токены передаются только тем компонентам, которым они действительно необходимы. Например, при использовании схемы backend-for-frontend для браузерных JavaScript-приложений, access и refresh токены должны быть доступны только на backend.", + "L": "2" + }, + { + "Shortcode": "V10.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что клиент принимает значения от авторизационного сервера (например, authorization code или ID Token) только если они получены в результате авторизационного потока, инициированного в той же сессии пользовательского агента и в рамках той же транзакции. Для этого клиентские секреты, такие как proof key для code exchange (PKCE) — 'code_verifier', 'state' или OIDC 'nonce' — должны быть непредсказуемыми, специфичными для транзакции и надежно привязанными как к клиенту, так и к сессии пользовательского агента, в которой началась транзакция.", + "L": "2" + } + ] + }, + { + "Shortcode": "V10.2", + "Ordinal": 2, + "Name": "Клиент OAuth", + "Items": [ + { + "Shortcode": "V10.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что если используется механизм authorization code flow, OAuth клиент защищён от CSRF, вызывающих запросы токенов либо за счёт использования механизма proof key for code exchange (PKCE), либо за счёт проверки параметра 'state', который был отправлен в запросе авторизации.", + "L": "2" + }, + { + "Shortcode": "V10.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что если OAuth клиент может взаимодействовать с более чем одним сервером авторизации, у него есть защита от атак смешивания (mix-up attacks). Например, клиент должен требовать, чтобы сервер авторизации возвращал параметр 'iss' и проверять его в ответах на авторизацию и токены.", + "L": "2" + }, + { + "Shortcode": "V10.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что OAuth клиент запрашивает только необходимые области доступа (scopes) или другие параметры авторизации в запросах к серверу авторизации.", + "L": "3" + } + ] + }, + { + "Shortcode": "V10.3", + "Ordinal": 3, + "Name": "Сервер ресурсов OAuth", + "Items": [ + { + "Shortcode": "V10.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что сервер ресурсов принимает только те access токены, которые предназначены для использования с этим сервисом (свойство audience). Эта принадлежность сервису может быть включена в структурированный access токен (например, в поле 'aud' в JWT) или проверяться через endpoint интроспекции токена.", + "L": "2" + }, + { + "Shortcode": "V10.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что сервер ресурсов принимает решения по авторизации на основе claims из access токена, определяющих делегированную авторизацию. Если присутствуют claims, такие как 'sub', 'scope' и 'authorization_details', они должны участвовать в принятии решения.", + "L": "2" + }, + { + "Shortcode": "V10.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что если для принятия решения по контролю доступа необходимо однозначно идентифицировать пользователя из access токена (JWT или ответа интроспекции), сервер ресурсов использует claims, которые не могут быть переприсвоены другим пользователям. Обычно это комбинация claims 'iss' и 'sub'.", + "L": "2" + }, + { + "Shortcode": "V10.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что если сервер ресурсов требует определённой силы аутентификации, методов или свежести аутентификации, он проверяет, что предъявленный access токен удовлетворяет этим требованиям. Например, при наличии, могут использоваться claims OIDC 'acr', 'amr' и 'auth_time'.", + "L": "2" + }, + { + "Shortcode": "V10.3.5", + "Ordinal": 5, + "Description": "Убедитесь, что сервер ресурсов предотвращает использование украденных access токенов или их повторное использование (replay) неавторизованными лицами, требуя access токены с подтверждением отправителя — например, Mutual TLS для OAuth 2 или OAuth 2 Demonstration of Proof of Possession (DPoP).", + "L": "3" + } + ] + }, + { + "Shortcode": "V10.4", + "Ordinal": 4, + "Name": "Сервер авторизации OAuth", + "Items": [ + { + "Shortcode": "V10.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что сервер авторизации проверяет URI перенаправления (redirect URI), сверяя его с заранее зарегистрированным списком разрешённых URI для данного клиента (allowlist), используя точное сравнение строк.", + "L": "1" + }, + { + "Shortcode": "V10.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что если сервер авторизации возвращает authorization code в ответе авторизации, этот код может быть использован только один раз для запроса токена. При втором валидном запросе с уже использованным кодом сервер должен отклонить запрос и отозвать любые токены, связанные с этим кодом.", + "L": "1" + }, + { + "Shortcode": "V10.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что authorization code имеет короткое время жизни. Максимальная продолжительность — до 10 минут для приложений L1 и L2 и до 1 минуты для приложений L3.", + "L": "1" + }, + { + "Shortcode": "V10.4.4", + "Ordinal": 4, + "Description": "Убедитесь, что сервер авторизации для конкретного клиента разрешает использование только тех типов авторизации, которые необходимы этому клиенту. Обратите внимание, что тип авторизации Implicit flow и Resource Owner Password Credentials flow больше не должны использоваться.", + "L": "1" + }, + { + "Shortcode": "V10.4.5", + "Ordinal": 5, + "Description": "Убедитесь, что сервер авторизации предотвращает атаки повторного использования refresh токенов для публичных клиентов, предпочтительно используя sender-constrained refresh токены, такие как DPoP или сертификат-связанные токены с mutual TLS (mTLS). Для L1 и L2 допускается ротация refresh токенов с обязательной их инвалидацией после использования. Если используется ротация, сервер должен отозвать все refresh токены при попытке использовать уже инвалидированный токен.", + "L": "1" + }, + { + "Shortcode": "V10.4.6", + "Ordinal": 6, + "Description": "Убедитесь, что при использовании типа авторизации «Authorization Code» сервер предотвращает атаки перехвата authorization code, требуя Proof Key for Code Exchange (PKCE). В запросах авторизации сервер должен требовать валидное значение 'code_challenge' и не принимать 'code_challenge_method' со значением 'plain'. В запросах токена обязательно валидировать параметр 'code_verifier'.", + "L": "2" + }, + { + "Shortcode": "V10.4.7", + "Ordinal": 7, + "Description": "Убедитесь, что если сервер авторизации поддерживает динамическую регистрацию клиентов без аутентификации, он минимизирует риски вредоносных клиентов. Сервер должен валидировать метаданные клиента (например, зарегистрированные URI), обеспечивать согласие пользователя и предупреждать пользователя перед обработкой запроса авторизации от недоверенного клиента.", + "L": "2" + }, + { + "Shortcode": "V10.4.8", + "Ordinal": 8, + "Description": "Убедитесь, что refresh токены имеют абсолютный срок действия, включая случаи, когда применяется скользящее время истечения срока.", + "L": "2" + }, + { + "Shortcode": "V10.4.9", + "Ordinal": 9, + "Description": "Убедитесь, что пользователи могут отзывать refresh токены и reference access токены через пользовательский интерфейс сервера авторизации для снижения риска от вредоносных клиентов или кражи токенов.", + "L": "2" + }, + { + "Shortcode": "V10.4.10", + "Ordinal": 10, + "Description": "Убедитесь, что конфиденциальный клиент аутентифицируется при взаимодействии с сервером авторизации через backchannel, например при запросах токена, pushed authorization requests (PAR) и запросах на отзыв токенов.", + "L": "2" + }, + { + "Shortcode": "V10.4.11", + "Ordinal": 11, + "Description": "Убедитесь, что конфигурация сервера авторизации назначает OAuth клиенту только необходимые области доступа (scopes).", + "L": "2" + }, + { + "Shortcode": "V10.4.12", + "Ordinal": 12, + "Description": "Убедитесь, что для конкретного клиента сервер авторизации разрешает только те значения 'response_mode', которые необходимы этому клиенту. Например, сервер должен валидировать это значение против ожидаемых или использовать pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).", + "L": "3" + }, + { + "Shortcode": "V10.4.13", + "Ordinal": 13, + "Description": "Убедитесь, что грант типа 'code' всегда используется вместе с pushed authorization requests (PAR).", + "L": "3" + }, + { + "Shortcode": "V10.4.14", + "Ordinal": 14, + "Description": "Убедитесь, что сервер авторизации выдаёт только sender-constrained (Proof-of-Possession) access токены, либо с сертификат-связанными токенами через mutual TLS (mTLS), либо DPoP-bound токены (Demonstration of Proof of Possession).", + "L": "3" + }, + { + "Shortcode": "V10.4.15", + "Ordinal": 15, + "Description": "Убедитесь, что для серверного клиента (не выполняющегося на устройстве конечного пользователя) сервер авторизации проверяет, что значение параметра 'authorization_details' исходит из клиентского backend и что пользователь не изменял его. Например, это достигается использованием pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).", + "L": "3" + }, + { + "Shortcode": "V10.4.16", + "Ordinal": 16, + "Description": "Убедитесь, что клиент является конфиденциальным и сервер авторизации требует использования сильных методов аутентификации клиента (основанных на криптографии с открытым ключом и устойчивых к атакам повторного воспроизведения), таких как mutual TLS ('tls_client_auth', 'self_signed_tls_client_auth') или private key JWT ('private_key_jwt').", + "L": "3" + } + ] + }, + { + "Shortcode": "V10.5", + "Ordinal": 5, + "Name": "Клиент OIDC", + "Items": [ + { + "Shortcode": "V10.5.1", + "Ordinal": 1, + "Description": "Убедитесь, что клиент (relying party) защищается от повторного использования ID Token (replay-атак). Например, это достигается проверкой того, что значение 'nonce' в ID Token совпадает со значением 'nonce', отправленным в запросе аутентификации провайдеру OpenID (authorization server).", + "L": "2" + }, + { + "Shortcode": "V10.5.2", + "Ordinal": 2, + "Description": "Убедитесь, что клиент однозначно идентифицирует пользователя по утверждениям (claims) ID Token, обычно это 'sub', который не может быть переназначен другому пользователю (в пределах конкретного провайдера идентификации).", + "L": "2" + }, + { + "Shortcode": "V10.5.3", + "Ordinal": 3, + "Description": "Убедитесь, что клиент отклоняет попытки злоумышленного сервера авторизации выдавать себя за другой сервер авторизации через метаданные сервера авторизации. Клиент должен отклонить метаданные, если URL издателя (issuer) в метаданных не совпадает точно с преднастроенным URL издателя, ожидаемым клиентом.", + "L": "2" + }, + { + "Shortcode": "V10.5.4", + "Ordinal": 4, + "Description": "Убедитесь, что клиент проверяет, что ID Token предназначен для него (проверка audience), сравнивая значение 'aud' в токене с 'client_id' клиента.", + "L": "2" + }, + { + "Shortcode": "V10.5.5", + "Ordinal": 5, + "Description": "Убедитесь, что при использовании OIDC back-channel logout клиент снижает риск отказа в обслуживании, вызванный принудительным выходом из системы и путаницей между разными типами JWT (cross-JWT confusion) в процессе логаута. Клиент должен проверить, что токен выхода корректно типизирован со значением 'logout+jwt', содержит claim 'event' с правильным именем участника и не содержит 'nonce'. Также рекомендуется установить короткий срок действия токена (например, 2 минуты).", + "L": "2" + } + ] + }, + { + "Shortcode": "V10.6", + "Ordinal": 6, + "Name": "Провайдер OpenID", + "Items": [ + { + "Shortcode": "V10.6.1", + "Ordinal": 1, + "Description": "Убедитесь, что провайдер OpenID допускает только значения 'code', 'ciba', 'id_token' или 'id_token code' для параметра response mode. При этом предпочтение отдаётся 'code' по сравнению с 'id_token code' (гибридный поток OIDC), а значение 'token' (любой Implicit flow) не должно использоваться.", + "L": "2" + }, + { + "Shortcode": "V10.6.2", + "Ordinal": 2, + "Description": "Убедитесь, что провайдер OpenID предотвращает отказ в обслуживании (DoS) через принудительный выход (logout), запрашивая явное подтверждение от конечного пользователя или, если применимо, проверяя параметры в запросе выхода (инициированном relying party), например параметр 'id_token_hint'.", + "L": "2" + } + ] + }, + { + "Shortcode": "V10.7", + "Ordinal": 7, + "Name": "Управление согласием", + "Items": [ + { + "Shortcode": "V10.7.1", + "Ordinal": 1, + "Description": "Убедитесь, что авторизационный сервер обеспечивает получение согласия пользователя для каждого запроса авторизации. Если личность клиента не может быть подтверждена, сервер авторизации всегда должен явно запрашивать согласие пользователя.", + "L": "2" + }, + { + "Shortcode": "V10.7.2", + "Ordinal": 2, + "Description": "Убедитесь, что при запросе согласия пользователя авторизационный сервер предоставляет достаточную и понятную информацию о том, на что даётся согласие. При необходимости это должно включать характер запрашиваемых разрешений (обычно основанных на scope, ресурсном сервере, деталях авторизации Rich Authorization Requests (RAR)), идентификацию авторизованного приложения и срок действия этих разрешений.", + "L": "2" + }, + { + "Shortcode": "V10.7.3", + "Ordinal": 3, + "Description": "Убедитесь, что пользователь может просматривать, изменять и отзывать согласия, которые он предоставил, через авторизационный сервер.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V11", + "Ordinal": 11, + "ShortName": "Cryptography", + "Name": "Криптография", + "Items": [ + { + "Shortcode": "V11.1", + "Ordinal": 1, + "Name": "Инвентаризация и документирование криптографии", + "Items": [ + { + "Shortcode": "V11.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что задокументирована политика управления криптографическими ключами и описан их жизненный цикл в соответствии со стандартом управления ключей, таким как NIST SP 800-57. Убедитесь, что ключи известны только тем сущностям, которым они должны быть доступны (например, ключи не передавались более чем двум участникам для общих секретов и более чем одному участнику для приватных ключей).", + "L": "2" + }, + { + "Shortcode": "V11.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что проводится инвентаризация криптографических средств, которая непрерывно поддерживается, регулярно обновляется и включает все криптографические ключи, алгоритмы и сертификаты, используемые в приложении. Также должна быть задокументирована информация о том, где ключи могут и не могут использоваться в системе, а также какие типы данных могут и не могут быть защищены с помощью этих ключей.", + "L": "2" + }, + { + "Shortcode": "V11.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что используются механизмы обнаружения криптографии для идентификации всех случаев применения криптографии в системе , включая операции шифрования, хеширования и цифровой подписи.", + "L": "3" + }, + { + "Shortcode": "V11.1.4", + "Ordinal": 4, + "Description": "Убедитесь, что ведётся и поддерживается инвентаризация криптографических средств. В неё должен входить документированный план, описывающий переход на новые криптографические стандарты, такие как постквантовая криптография, чтобы своевременно реагировать на будущие угрозы.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.2", + "Ordinal": 2, + "Name": "Безопасная реализация криптографии", + "Items": [ + { + "Shortcode": "V11.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что для криптографических операций используются утвержденные в индустрии реализации (включая библиотеки и аппаратные реализации).", + "L": "2" + }, + { + "Shortcode": "V11.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что архитектура приложения поддерживает быструю реконфигурацию, усовершенствование или смену в любой момент случайных чисел, аутентифицированного шифрования, MAC, алгоритмов хеширования, длин ключей, количества раундов, шифров и режимов шифрования для защиты от криптографических атак. Также должна поддерживаться возможность смены ключей, паролей и повторного шифрования данных. Это позволит беспрепятственно перейти на постквантовую криптографию (PQC), как только станут широко доступны высоконадёжные реализации одобренных схем или стандартов PQC.", + "L": "2" + }, + { + "Shortcode": "V11.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что все криптографические примитивы используют как минимум 128-бит стойкости с учетом алгоритма, размера ключа и конфигурации. Например, 256-битный ECC ключ обеспечивает примерно 128 бит безопасности, тогда как для достижения того же уровня безопасности в RSA требуется ключ длиной 3072 бита.", + "L": "2" + }, + { + "Shortcode": "V11.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что все криптографические операции выполняются за константное время, без использования «short-circuit» операций в сравнениях, вычислениях, возвратах функций для избежания утечек информации.", + "L": "3" + }, + { + "Shortcode": "V11.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что все криптографические модули обеспечивают безопасное завершение работы при ошибках, а обработка ошибок реализована таким образом, чтобы не создавать уязвимостей, например, таких как атаки Padding Oracle.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.3", + "Ordinal": 3, + "Name": "Алгоритмы шифрования", + "Items": [ + { + "Shortcode": "V11.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что не используются небезопасные режимы блочного шифрования (н-р, ECB) и слабые схемы дополнения (padding) (н-р, PKCS#1 v1.5).", + "L": "1" + }, + { + "Shortcode": "V11.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что используются только утверждённые шифры и режимы, такие как AES с GCM.", + "L": "1" + }, + { + "Shortcode": "V11.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что зашифрованные данные защищены от несанкционированного изменения, предпочтительно с использованием утверждённого метода аутентифицированного шифрования или путём комбинирования утверждённого метода шифрования с утверждённым алгоритмом MAC.", + "L": "2" + }, + { + "Shortcode": "V11.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что случайные числа (nonce), векторы инициализации (IV) и другие одноразовые числа не используются более одного раза для одной и той же пары ключа шифрования и элемента данных. Метод их генерации должен соответствовать требованиям используемого алгоритма.", + "L": "3" + }, + { + "Shortcode": "V11.3.5", + "Ordinal": 5, + "Description": "Убедитесь, что любая комбинация алгоритма шифрования и алгоритма MAC работает в режиме encrypt-then-MAC (EtM).", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.4", + "Ordinal": 4, + "Name": "Хеширование и функции на основе хеширования", + "Items": [ + { + "Shortcode": "V11.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что только утвержденные хэш-функции используются для стандартных сценариев использования в криптографии, включая цифровую подпись, HMAC, KDF, генерацию случайных чисел. Запрещено использовать неустойчивые хэш-функции, (н-р, MD5) для любого использования в криптографии.", + "L": "1" + }, + { + "Shortcode": "V11.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что пароли хранятся с использованием утверждённой, вычислительно затратной функции генерации ключа (также известной как «функция хеширования паролей»), с параметрами, настроенными в соответствии с актуальными рекомендациями. Настройки должны обеспечивать баланс между безопасностью и производительностью, чтобы сделать атаки перебором достаточно сложными для требуемого уровня безопасности.", + "L": "2" + }, + { + "Shortcode": "V11.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что хэш-функции, используемые в формировании цифровой подписи, как часть аутентификации и целостности данных, устойчивы к коллизиям и имеют достаточную длину.", + "L": "2" + }, + { + "Shortcode": "V11.4.4", + "Ordinal": 4, + "Description": "Убедитесь, что приложение использует утвержденную функцию генерации ключа с использованием параметров расширения ключа (key stretching) при генерации ключа из пароля. Параметры должны быть сбалансированы с точки зрения безопасности, производительности и устойчивости к атакам полного перебора при компрометации результирующего криптографического ключа.", + "L": "2" + } + ] + }, + { + "Shortcode": "V11.5", + "Ordinal": 5, + "Name": "Случайные значения", + "Items": [ + { + "Shortcode": "V11.5.1", + "Ordinal": 1, + "Description": "Убедитесь, что все случайные числа и строки, которые должны быть непредсказуемы, должны быть сгенерированы с помощью CSPRNG и иметь хотя бы 128 бит энтропии. Учтите, что UUID не удовлетворяют данному условию.", + "L": "2" + }, + { + "Shortcode": "V11.5.2", + "Ordinal": 2, + "Description": "Убедитесь, что механизм генерации случайных чисел является надежным даже при высокой нагрузке.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.6", + "Ordinal": 6, + "Name": "Криптография с публичным ключом", + "Items": [ + { + "Shortcode": "V11.6.1", + "Ordinal": 1, + "Description": "Убедитесь, что только утвержденные криптографические алгоритмы и режимы операций используются для генерации ключа и инициализации случайного значения для его генерации (seeding), а также для генерации цифровой подписи и верификации. Алгоритмы генерации ключей не должны генерировать небезопасные ключи уязвимые к известным атакам, например, ключи RSA уязвимы к факторизации Ферма.", + "L": "2" + }, + { + "Shortcode": "V11.6.2", + "Ordinal": 2, + "Description": "Убедитесь, что для обмена ключами используются утверждённые криптографические алгоритмы (например, Диффи-Хеллман) с особым вниманием к обеспечению использования безопасных параметров. Это предотвратит атаки на процесс установления ключа, которые могут привести к атакам «человек посередине» или криптографическим взломам.", + "L": "3" + } + ] + }, + { + "Shortcode": "V11.7", + "Ordinal": 7, + "Name": "Шифрование данных в процессе использования", + "Items": [ + { + "Shortcode": "V11.7.1", + "Ordinal": 1, + "Description": "Убедитесь, что используется полное шифрование памяти, которое защищает конфиденциальные данные во время их использования, предотвращая доступ к ним неавторизованных пользователей или процессов.", + "L": "3" + }, + { + "Shortcode": "V11.7.2", + "Ordinal": 2, + "Description": "Убедитесь, что минимизация данных обеспечивает раскрытие минимально необходимого объёма данных во время обработки, а также что данные шифруются сразу после использования или как можно скорее.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V12", + "Ordinal": 12, + "ShortName": "Secure", + "Name": "Безопасная коммуникация", + "Items": [ + { + "Shortcode": "V12.1", + "Ordinal": 1, + "Name": "Общие рекомендации по безопасности TLS", + "Items": [ + { + "Shortcode": "V12.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что включены только актуальные и рекомендуемые версии протокола TLS, такие как TLS 1.2 и TLS 1.3. Наиболее свежая версия TLS должна быть выбрана как предпочтительная.", + "L": "1" + }, + { + "Shortcode": "V12.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что включены рекомендуемые шифронаборы (cipher suites), предпочтение также стоит отдать самому сильному шифронабору. L3 приложения должны поддерживать только те наборы шифров (cipher suites), которые обеспечивают прямую (forward) секретность. Пояснение: Прямая секретность (Forward Secrecy, FS) — это криптографическая особенность, при которой сессионные ключи уникальны для каждой сессии и не зависят от долгосрочных ключей. Это гарантирует, что даже при компрометации долгосрочного ключа злоумышленник не сможет расшифровать ранее перехваченные зашифрованные сессии.", + "L": "2" + }, + { + "Shortcode": "V12.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение проверяет доверенность клиентских сертификатов mTLS, прежде чем использовать идентификацию по сертификату для аутентификации или авторизации.", + "L": "2" + }, + { + "Shortcode": "V12.1.4", + "Ordinal": 4, + "Description": "Убедитесь, что включена и настроена правильная проверка отзыва сертификатов, такая как Online Certificate Status Protocol (OCSP) Stapling.", + "L": "3" + }, + { + "Shortcode": "V12.1.5", + "Ordinal": 5, + "Description": "Убедитесь, что в настройках TLS приложения включена функция Encrypted Client Hello (ECH) для предотвращения раскрытия конфиденциальных метаданных, таких как Server Name Indication (SNI), во время процесса TLS-рукопожатия.", + "L": "3" + } + ] + }, + { + "Shortcode": "V12.2", + "Ordinal": 2, + "Name": "HTTPS коммуникация с внешними сервисами", + "Items": [ + { + "Shortcode": "V12.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что для всех соединений между клиентом и внешними HTTP-сервисами используется TLS и не происходит отката к небезопасным или незашифрованным протоколам.", + "L": "1" + }, + { + "Shortcode": "V12.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что внешние сервисы используют публично доверенные TLS-сертификаты.", + "L": "1" + } + ] + }, + { + "Shortcode": "V12.3", + "Ordinal": 3, + "Name": "Общая безопасность межсервисного взаимодействия", + "Items": [ + { + "Shortcode": "V12.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что для всех входящих и исходящих соединений приложения используется зашифрованный протокол, например TLS, включая системы мониторинга, инструменты управления, удалённый доступ и SSH, промежуточное ПО, базы данных, мейнфреймы, партнёрские системы и внешние API. Сервер не должен допускать откат к небезопасным или незашифрованным протоколам.", + "L": "2" + }, + { + "Shortcode": "V12.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что TLS-клиент проверяет сертификат сервера до установления защищенного соединения с TLS-сервером.", + "L": "2" + }, + { + "Shortcode": "V12.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что все внутренние HTTP-взаимодействия между компонентами приложения используют TLS или другой подходящий механизм транспортного шифрования, и не происходит откат к небезопасным или незашифрованным коммуникациям.", + "L": "2" + }, + { + "Shortcode": "V12.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что TLS-соединения между внутренними сервисами используют доверенные сертификаты. Если используются внутренние или самоподписанные сертификаты, потребляющий сервис должен быть настроен на доверие только к конкретным внутренним центрам сертификации (CA) и конкретным самоподписанным сертификатам.", + "L": "2" + }, + { + "Shortcode": "V12.3.5", + "Ordinal": 5, + "Description": "Убедитесь, что сервисы, взаимодействующие внутри системы (intra-service communications), используют строгую аутентификацию для проверки каждого конечного узла. Для проверки подлинности взаимодействующих сторон должны применяться методы строгой аутентификации, такие как аутентификация TLS-клиента, с использованием инфраструктуры открытых ключей и механизмов, устойчивых к атакам повтора (replay attacks). Для микросервисных архитектур рекомендуется использование service mesh для упрощения управления сертификатами и повышения безопасности.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V13", + "Ordinal": 13, + "ShortName": "Configuration", + "Name": "Конфигурация", + "Items": [ + { + "Shortcode": "V13.1", + "Ordinal": 1, + "Name": "Документация конфигурации", + "Items": [ + { + "Shortcode": "V13.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что все необходимые доступы приложения задокументированы. Сюда должны быть включены как внешние сервисы, от которых зависит приложение, так и сценарии, когда конечный пользователь может задавать адреса для внешнего подключения.", + "L": "2" + }, + { + "Shortcode": "V13.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что для каждого сервиса, используемого приложением, в документации определено максимальное количество одновременных соединений (например, лимиты пула соединений) и описано поведение приложения при достижении этого лимита, включая любые механизмы отказоустойчивости или восстановления, чтобы предотвратить ситуации отказа в обслуживании (DoS).", + "L": "3" + }, + { + "Shortcode": "V13.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что в документации приложения определены стратегии управления ресурсами для каждой внешней системы или сервиса, которые оно использует (например, базы данных, файловые дескрипторы, потоки, HTTP-соединения). Стратегии должны включать процедуры освобождения ресурсов, настройки таймаутов, обработку сбоев, а также, если реализована логика повторных попыток, указание лимитов, задержек и алгоритмов back-off. Для синхронных HTTP-запросов должны быть заданы короткие таймауты, а повторные запросы должны быть отключены, либо строго ограничены по числу попыток, чтобы предотвратить каскадные задержки и истощение ресурсов.", + "L": "3" + }, + { + "Shortcode": "V13.1.4", + "Ordinal": 4, + "Description": "Убедитесь, что в документации приложения определены секреты, критически важные для безопасности приложения, а также установлен график их ротации в соответствии с моделью угроз организации и её бизнес-требованиями.", + "L": "3" + } + ] + }, + { + "Shortcode": "V13.2", + "Ordinal": 2, + "Name": "Конфигурация бэкенд соединений", + "Items": [ + { + "Shortcode": "V13.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что коммуникации между компонентами бэкенда приложения (включая API, промежуточное ПО и уровни данных), которые не поддерживают стандартный механизм пользовательских сессий, проходят с аутентификацией. Аутентификация должна использовать индивидуальные сервисные аккаунты, краткосрочные токены или аутентификацию на основе сертификатов, а не постоянные учётные данные, такие как пароли, API-ключи или общие аккаунты с привилегированным доступом.", + "L": "2" + }, + { + "Shortcode": "V13.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что коммуникации между компонентами бэкенда приложения, включая локальные или системные службы, API, промежуточное ПО и уровни данных, выполняются с использованием аккаунтов, которым назначены минимально необходимые привилегии.", + "L": "2" + }, + { + "Shortcode": "V13.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что если для аутентификации в сервисе используются учётные данные, то используемые потребителем учётные данные не являются стандартными (например, root/root или admin/admin).", + "L": "2" + }, + { + "Shortcode": "V13.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что используется белый список (allowlist) для определения внешних ресурсов или систем, с которыми приложению разрешено взаимодействовать (например, для исходящих запросов, загрузки данных или доступа к файлам). Этот белый список может быть реализован на уровне приложения, веб-сервера, межсетевого экрана или комбинации различных уровней.", + "L": "2" + }, + { + "Shortcode": "V13.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что веб- или прикладной сервер настроен с белым списком ресурсов или систем, к которым сервер может отправлять запросы или из которых может загружать данные и файлы.", + "L": "2" + }, + { + "Shortcode": "V13.2.6", + "Ordinal": 6, + "Description": "Убедитесь, что при подключении приложения к другим сервисам соблюдается задокументированная конфигурация для каждого соединения, включая максимальное количество параллельных соединений, поведение при достижении их максимума, таймауты и стратегии повторных попыток подключения.", + "L": "3" + } + ] + }, + { + "Shortcode": "V13.3", + "Ordinal": 3, + "Name": "Управление секретами", + "Items": [ + { + "Shortcode": "V13.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что для безопасного создания, хранения, контроля доступа и уничтожения секретов бэкенда используется решение для управления секретами, например, хранилище ключей (key vault). Секретами могут быть пароли, ключевой материал, интеграции с базами данных и сторонними системами, ключи и seed-значения для токенов с ограниченным временем действия, другие внутренние секреты и API-ключи. Секреты не должны включаться в исходный код приложения или артефакты сборки. Для приложений уровня L3 необходимо использовать аппаратное решение, например, аппаратный модуль безопасности (HSM).", + "L": "2" + }, + { + "Shortcode": "V13.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что доступ к секретным ресурсам осуществляется в соответствии с принципом минимально необходимых привилегий (least privilege).", + "L": "2" + }, + { + "Shortcode": "V13.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что все криптографические операции выполняются с использованием изолированного модуля безопасности (например, хранилища ключей или аппаратного модуля безопасности), чтобы надежно управлять ключевым материалом и защищать его от утечки за пределы модуля безопасности.", + "L": "3" + }, + { + "Shortcode": "V13.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что секреты настроены на срок действия и ротацию в соответствии с документацией приложения.", + "L": "3" + } + ] + }, + { + "Shortcode": "V13.4", + "Ordinal": 4, + "Name": "Непреднамеренная утечка информации", + "Items": [ + { + "Shortcode": "V13.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение развернуто либо без метаданных систем контроля версий (включая папки .git или .svn), либо так, чтобы эти папки были недоступны как извне, так и для самого приложения.", + "L": "1" + }, + { + "Shortcode": "V13.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что режимы отладки отключены для всех компонентов в промышленной среде, чтобы предотвратить раскрытие функций отладки и утечку информации.", + "L": "2" + }, + { + "Shortcode": "V13.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что веб-серверы не показывают клиентам списки содержимого каталогов, если это явно не предусмотрено.", + "L": "2" + }, + { + "Shortcode": "V13.4.4", + "Ordinal": 4, + "Description": "Убедитесь, что метод HTTP TRACE не поддерживается в продуктовой среде, чтобы избежать потенциальной утечки информации.", + "L": "2" + }, + { + "Shortcode": "V13.4.5", + "Ordinal": 5, + "Description": "Убедитесь, что документация (например, по внутренним API) и мониторинговые эндпоинты не доступны, если это явно не предусмотрено.", + "L": "2" + }, + { + "Shortcode": "V13.4.6", + "Ordinal": 6, + "Description": "Убедитесь, что приложение не раскрывает подробную информацию о версиях компонентов бэкенда.", + "L": "3" + }, + { + "Shortcode": "V13.4.7", + "Ordinal": 7, + "Description": "Убедитесь, что веб-слой настроен на обслуживание только файлов с определёнными расширениями, чтобы предотвратить непреднамеренную утечку информации, конфигураций и исходного кода.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V14", + "Ordinal": 14, + "ShortName": "Data", + "Name": "Защита информации", + "Items": [ + { + "Shortcode": "V14.1", + "Ordinal": 1, + "Name": "Документация по защите информации", + "Items": [ + { + "Shortcode": "V14.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что все конфиденциальные данные, создаваемые и обрабатываемые приложением, идентифицированы и классифицированы по уровням защиты. Включая закодированные данные, которые легко декодируются, например, строки Base64 или незашифрованные данные в полезной нагрузке JWT. Уровни защиты должны учитывать требования по защите данных и конфиденциальности, которым должно соответствовать приложение.", + "L": "2" + }, + { + "Shortcode": "V14.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что для каждого уровня защиты конфиденциальных данных требования к защите задокументированы. Они должны включать (но не ограничиваться) требования по шифрованию, проверке целостности, срокам хранения, способам логирования данных, контролю доступа к чувствительным данным в логах, шифрованию на уровне базы данных, применению технологий повышения конфиденциальности, а также другим требованиям по конфиденциальности.", + "L": "2" + } + ] + }, + { + "Shortcode": "V14.2", + "Ordinal": 2, + "Name": "Базовые меры по защите информации", + "Items": [ + { + "Shortcode": "V14.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что конфиденциальные данные передаются на сервер только в теле HTTP-запроса или в заголовках. URL и строка запроса не должны содержать конфиденциальную информацию, такую как API-ключ или сессионный токен.", + "L": "1" + }, + { + "Shortcode": "V14.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение предотвращает кэширование конфиденциальных данных в серверных компонентах, таких как балансировщики нагрузки и кэши приложений, либо гарантирует их надежное удаление после использования.", + "L": "2" + }, + { + "Shortcode": "V14.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что заранее определённые конфиденциальные данные не отправляются ненадёжным сторонам (например, системам трекинга пользователей), чтобы предотвратить нежелательный сбор данных вне контроля приложения.", + "L": "2" + }, + { + "Shortcode": "V14.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что для конфиденциальных данных реализованы меры по шифрованию, проверке целостности, срокам хранения, способам логирования, контролю доступа к данным в логах, а также применяются технологии повышения конфиденциальности в соответствии с документацией для соответствующего уровня защиты данных.", + "L": "2" + }, + { + "Shortcode": "V14.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что механизмы кэширования настроены так, чтобы кэшировать только ответы с ожидаемым типом содержимого для данного ресурса и не содержать конфиденциального динамического контента. При обращении к несуществующему файлу, веб-сервер должен возвращать ответ 404 или 302, а не подменять на другой существующий файл, что позволит предотвратить атаки типа Web Cache Deception.", + "L": "3" + }, + { + "Shortcode": "V14.2.6", + "Ordinal": 6, + "Description": "Убедитесь, что приложение возвращает только минимально необходимый объем конфиденциальных данных для выполнения своей функциональности. Например, показывает только часть цифр номера кредитной карты, а не полный номер. Если требуется отображение полных данных, они должны быть замаскированы в пользовательском интерфейсе, пока пользователь специально не запросил их просмотр.", + "L": "3" + }, + { + "Shortcode": "V14.2.7", + "Ordinal": 7, + "Description": "Убедитесь, что конфиденциальная информация подлежит классификации по срокам хранения, чтобы устаревшие или ненужные данные удалялись автоматически, по расписанию или по мере необходимости.", + "L": "3" + }, + { + "Shortcode": "V14.2.8", + "Ordinal": 8, + "Description": "Убедитесь, что конфиденциальная информация удаляется из метаданных файлов, загружаемых пользователями, если пользователь явно не согласился на ее хранение.", + "L": "3" + } + ] + }, + { + "Shortcode": "V14.3", + "Ordinal": 3, + "Name": "Защита данных на стороне клиента", + "Items": [ + { + "Shortcode": "V14.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что аутентифицированные данные очищаются из клиентского хранилища, например, из DOM браузера, после завершения работы клиента или сессии. Заголовок HTTP-ответа Clear-Site-Data может помочь в этом, но клиентская сторона также должна уметь очищать данные, если соединение с сервером недоступно при завершении сессии.", + "L": "1" + }, + { + "Shortcode": "V14.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение устанавливает HTTP-заголовки, достаточные для предотвращения кэширования (например, Cache-Control: no-store), чтобы конфиденциальные данные не сохранялись в браузерах.", + "L": "2" + }, + { + "Shortcode": "V14.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что данные, хранящиеся в браузерном хранилище (например, localStorage, sessionStorage, IndexedDB или cookie), не содержат конфиденциальной информации, за исключением сессионных токенов.", + "L": "2" + } + ] + } + ] + }, + { + "Shortcode": "V15", + "Ordinal": 15, + "ShortName": "Secure", + "Name": "Безопасная разработка и архитектура", + "Items": [ + { + "Shortcode": "V15.1", + "Ordinal": 1, + "Name": "Документация по безопасной разработке и архитектуре", + "Items": [ + { + "Shortcode": "V15.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что в документации по приложению определены сроки устранения уязвимостей на основе оценки рисков для внешних зависимостей с уязвимостями и для обновления библиотек в целом, чтобы минимизировать риск, связанный с этими компонентами.", + "L": "1" + }, + { + "Shortcode": "V15.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что ведется реестр всех используемых сторонних библиотек (например, Software Bill of Materials, SBOM), с обязательной проверкой, что компоненты получены из предопределенных, доверенных и регулярно поддерживаемых репозиториев.", + "L": "2" + }, + { + "Shortcode": "V15.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что в документации приложения указан функционал, требующий значительных временных или вычислительных ресурсов. Необходимо указать, как предотвратить потерю доступности из-за чрезмерного использования этого функционала и как избежать ситуаций, когда формирование ответа занимает больше времени, чем установленный системой таймаут. Возможные меры защиты могут включать асинхронную обработку, использование очередей и ограничение количества параллельных процессов для каждого пользователя и приложения.", + "L": "2" + }, + { + "Shortcode": "V15.1.4", + "Ordinal": 4, + "Description": "Убедитесь, что в документации приложения указаны внешние библиотеки, которые считаются «компонентами с повышенным риском».", + "L": "3" + }, + { + "Shortcode": "V15.1.5", + "Ordinal": 5, + "Description": "Убедитесь, что в документации приложения выделены те части приложения, в которых используются «функционал с повышенным риском».", + "L": "3" + } + ] + }, + { + "Shortcode": "V15.2", + "Ordinal": 2, + "Name": "Архитектура безопасности и зависимости", + "Items": [ + { + "Shortcode": "V15.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение содержит только те компоненты, которые не нарушили задокументированные сроки обновления и исправления.", + "L": "1" + }, + { + "Shortcode": "V15.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что в приложении реализованы меры защиты от потери доступности из-за функциональности, требующей много времени или ресурсов, на основе задокументированных решений и стратегий безопасности для этого.", + "L": "2" + }, + { + "Shortcode": "V15.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что производственная среда включает только те функции, которые необходимы для работы приложения, и не предоставляет лишние функции, такие как тестовый код, примеры кода и инструменты разработки.", + "L": "2" + }, + { + "Shortcode": "V15.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что сторонние компоненты и все их транзитивные зависимости загружаются только из ожидаемых репозиториев (внутренних или внешних) и отсутствует риск атаки через подмену зависимостей (dependency confusion attack)", + "L": "3" + }, + { + "Shortcode": "V15.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что приложение реализует дополнительные меры защиты для тех частей приложения, которые документированы как содержащие «функционал с повышенным риском» или использующие сторонние библиотеки, считающиеся «функционалом с повышенным риском». Это могут быть такие методы, как «песочница», инкапсуляция, контейнеризация или изоляция на сетевом уровне, чтобы задержать и предотвратить продвижение (pivoting) злоумышленников, скомпрометировавших одну часть приложения, к другим частям приложения.", + "L": "3" + } + ] + }, + { + "Shortcode": "V15.3", + "Ordinal": 3, + "Name": "Безопасное программирование", + "Items": [ + { + "Shortcode": "V15.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение возвращает только необходимое подмножество полей из объекта данных. Например, оно не должно возвращать весь объект данных, поскольку некоторые отдельные поля должны быть недоступны пользователям.", + "L": "1" + }, + { + "Shortcode": "V15.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что при вызовах внешних URL-адресов бэкэнд приложения настроен так, чтобы не выполнять перенаправления, если только это не предусмотрено функционалом.", + "L": "2" + }, + { + "Shortcode": "V15.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что в приложении реализованы защитные механизмы против атак типа массового присвоения (mass assignment) путем строгого ограничения разрешенных полей для каждого контроллера и действия, исключая возможность добавления или изменения значений полей, которые не должны быть доступны для данной конкретной операции.", + "L": "2" + }, + { + "Shortcode": "V15.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что все прокси и промежуточное ПО корректно передают исходный IP-адрес пользователя, используя доверенные поля данных, которые не могут быть изменены конечным пользователем, а приложение и веб-сервер используют это правильное значение для ведения логирования и принятия решений по безопасности, таких как ограничение запросов. При этом следует учитывать, что даже исходный IP-адрес может быть ненадежным из-за динамических IP-адресов, VPN или корпоративных файрволов.", + "L": "2" + }, + { + "Shortcode": "V15.3.5", + "Ordinal": 5, + "Description": "Убедитесь, что приложение явно проверяет соответствие переменных ожидаемому типу данных и использует строгие операции сравнения. Это необходимо для предотвращения уязвимостей, связанных с type juggling и type confusion, вызванных тем, что код приложения делает предположения о типе переменной.", + "L": "2" + }, + { + "Shortcode": "V15.3.6", + "Ordinal": 6, + "Description": "Убедитесь, что JavaScript-код написан таким образом, чтобы предотвратить prototype pollution, например, используя Set() или Map() вместо обычных литералов объекта.", + "L": "2" + }, + { + "Shortcode": "V15.3.7", + "Ordinal": 7, + "Description": "Убедитесь, что приложение защищено от атак типа HTTP Parameter Pollution (HPP), особенно если используемый фреймворк не различает источники параметров запроса (строка запроса, тело запроса, куки или заголовки).", + "L": "2" + } + ] + }, + { + "Shortcode": "V15.4", + "Ordinal": 4, + "Name": "Безопасная работа с параллельными процессами", + "Items": [ + { + "Shortcode": "V15.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что к общим объектам в многопоточном коде (например, кэшам, файлам или объектам в памяти, используемым несколькими потоками) используется безопасный многопоточный доступ и механизмов синхронизации, таких как блокировки или семафоры, чтобы избежать состояний гонки и повреждения данных.", + "L": "3" + }, + { + "Shortcode": "V15.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что проверки состояния ресурса, например его существования или разрешений, а также зависящие от него действия выполняются как одна атомарная операция, чтобы предотвратить условия гонки времени проверки и времени использования (TOCTOU). Например, проверка существования файла перед его открытием или проверка прав доступа пользователя перед его предоставлением.", + "L": "3" + }, + { + "Shortcode": "V15.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что блокировки применяются согласованно, чтобы предотвратить взаимные блокировки потоков (deadlocks) или их бесконечные повторы, а также что логика блокировки инкапсулирована в коде, отвечающем за управление ресурсом. Это гарантирует, что блокировки не могут быть случайно или намеренно изменены внешними классами или кодом.", + "L": "3" + }, + { + "Shortcode": "V15.4.4", + "Ordinal": 4, + "Description": "Убедитесь, что политики распределения ресурсов предотвращают нехватку ресурсов у потоков, обеспечивая справедливый доступ к ресурсам, например, используя пулы потоков, позволяя потокам с более низким приоритетом выполняться в течение разумного периода времени.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V16", + "Ordinal": 16, + "ShortName": "Security", + "Name": "Журналирование событий безопасности и обработка ошибок", + "Items": [ + { + "Shortcode": "V16.1", + "Ordinal": 1, + "Name": "Документация по ведению логов", + "Items": [ + { + "Shortcode": "V16.1.1", + "Ordinal": 1, + "Description": "Убедитесь в существовании реестра, в котором документируется ведение журнала на каждом уровне технологического стека приложения, включая какие события регистрируются, форматы логов, где хранятся эти журналы, как они используются, как контролируется доступ к ним и как долго хранятся журналы.", + "L": "2" + } + ] + }, + { + "Shortcode": "V16.2", + "Ordinal": 2, + "Name": "Общее журналирование", + "Items": [ + { + "Shortcode": "V16.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что каждая запись журнала содержит необходимые метаданные (например, когда, где, кто, что), которые позволят провести подробное исследование временной шкалы, когда произошло событие.", + "L": "2" + }, + { + "Shortcode": "V16.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что все источники времени компонентов системы журналирования синхронизированы, а временные метки в метаданных событий безопасности используют UTC или содержат явное указание смещения часового пояса. Рекомендуется применять UTC для обеспечения согласованности в распределённых системах и предотвращения ошибок при переходе на летнее/зимнее время.", + "L": "2" + }, + { + "Shortcode": "V16.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение записывает и передаёт логи исключительно в те файлы и сервисы, которые указаны в реестре журналирования.", + "L": "2" + }, + { + "Shortcode": "V16.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что логи могут быть прочитаны и коррелированы используемой системой обработки журналов, предпочтительно с использованием общего стандартного формата логирования.", + "L": "2" + }, + { + "Shortcode": "V16.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что приложение применяет соответствующие меры защиты при логировании конфиденциальных данных в зависимости от уровня их чувствительности: например, полностью запрещает запись в логи таких данных, как учетные данные или платежные реквизиты, а для других данных (например, сессионных токенов) использует хеширование или частичное/полное маскирование.", + "L": "2" + } + ] + }, + { + "Shortcode": "V16.3", + "Ordinal": 3, + "Name": "Инциденты безопасности", + "Items": [ + { + "Shortcode": "V16.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что все операции аутентификации регистрируются, включая успешные и неудачные попытки. Также следует фиксировать дополнительные метаданные, такие как тип аутентификации или использованные факторы проверки.", + "L": "2" + }, + { + "Shortcode": "V16.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что ведется журнал неудачных попыток авторизации. Для уровня L3 это должно включать в себя журналирование всех решений об авторизации, включая журналирование доступа к конфиденциальным данным (без регистрации самих конфиденциальных данных).", + "L": "2" + }, + { + "Shortcode": "V16.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение регистрирует все события безопасности, определенные в документации, а также фиксирует попытки обхода механизмов защиты, включая проверку входных данных, бизнес-логики и системы защиты от автоматизированных атак.", + "L": "2" + }, + { + "Shortcode": "V16.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что приложение регистрирует в журналах неожиданные ошибки и сбои механизмов безопасности, включая, например, ошибки TLS-соединения на стороне сервера.", + "L": "2" + } + ] + }, + { + "Shortcode": "V16.4", + "Ordinal": 4, + "Name": "Защита журналов", + "Items": [ + { + "Shortcode": "V16.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что все компоненты системы логирования корректно кодируют данные, чтобы предотвратить атаки типа внедрения в журналы (log injection).", + "L": "2" + }, + { + "Shortcode": "V16.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что логи защищены от неавторизованного доступа и не могут быть модифицированы.", + "L": "2" + }, + { + "Shortcode": "V16.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что логи безопасно передаются в логически изолированную систему для анализа, обнаружения угроз, генерации оповещений и эскалации инцидентов. Это гарантирует сохранность журналов даже в случае компрометации основного приложения.", + "L": "2" + } + ] + }, + { + "Shortcode": "V16.5", + "Ordinal": 5, + "Name": "Обработка ошибок", + "Items": [ + { + "Shortcode": "V16.5.1", + "Ordinal": 1, + "Description": "Убедитесь, что при возникновении непредвиденной или связанной с безопасностью ошибки пользователю возвращается только общее сообщение, гарантируя отсутствие раскрытия конфиденциальных внутренних данных системы, таких как трассировки стека, запросы, секретные ключи и токены.", + "L": "2" + }, + { + "Shortcode": "V16.5.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение продолжает работать в безопасном режиме при недоступности внешних ресурсов, используя такие механизмы, как автоматические выключатели (circuit breakers) или плавное снижение функциональности (graceful degradation).", + "L": "2" + }, + { + "Shortcode": "V16.5.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение корректно и безопасно завершает работу при возникновении исключений, предотвращая опасные сценарии по типу «fail-open», когда, например, транзакция ошибочно выполняется, несмотря на ошибки в логике валидации.", + "L": "2" + }, + { + "Shortcode": "V16.5.4", + "Ordinal": 4, + "Description": "Убедитесь, что определён обработчик ошибок «крайние меры», который будет перехватывать все необработанные ошибки. Это необходимо как для предотвращения потери информации об ошибках, которая должна быть записана в файлы журналов, так и для того, чтобы ошибка не остановила весь процесс приложения, что привело бы к потере доступности.", + "L": "3" + } + ] + } + ] + }, + { + "Shortcode": "V17", + "Ordinal": 17, + "ShortName": "WebRTC", + "Name": "WebRTC", + "Items": [ + { + "Shortcode": "V17.1", + "Ordinal": 1, + "Name": "TURN-сервер", + "Items": [ + { + "Shortcode": "V17.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что сервис TURN (Traversal Using Relays around NAT) разрешает доступ только к IP-адресам, не зарезервированным для специальных целей (например, внутренние сети, широковещательная рассылка, loopback-адреса). Данное требование применяется как к IPv4, так и к IPv6 адресам.", + "L": "2" + }, + { + "Shortcode": "V17.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что сервис TURN (Traversal Using Relays around NAT) защищен от исчерпания ресурсов при попытках легитимных пользователей открыть чрезмерное количество портов на сервере.", + "L": "3" + } + ] + }, + { + "Shortcode": "V17.2", + "Ordinal": 2, + "Name": "Требования к медиасерверам", + "Items": [ + { + "Shortcode": "V17.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что ключ сертификата Datagram Transport Layer Security (DTLS) управляется и защищается в соответствии с документированной политикой управления криптографическими ключами.", + "L": "2" + }, + { + "Shortcode": "V17.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что медиасервер настроен на использование только одобренных наборов шифров Datagram Transport Layer Security (DTLS) и защищенного профиля безопасности для расширения DTLS, применяемого при установке ключей для Secure Real-time Transport Protocol (DTLS-SRTP).", + "L": "2" + }, + { + "Shortcode": "V17.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что медиасервер проверяет аутентификацию Secure Real-time Transport Protocol (SRTP) для предотвращения атак с внедрением Real-time Transport Protocol (RTP), которые могут привести к отказу в обслуживании (Denial of Service) или вставке поддельного аудио-/видеоконтента в медиапотоки.", + "L": "2" + }, + { + "Shortcode": "V17.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика при получении некорректных пакетов Secure Real-time Transport Protocol (SRTP).", + "L": "2" + }, + { + "Shortcode": "V17.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетами Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.", + "L": "3" + }, + { + "Shortcode": "V17.2.6", + "Ordinal": 6, + "Description": "Убедитесь, что медиасервер не подвержен уязвимости «Гонка ClientHello» (ClientHello Race Condition) в Datagram Transport Layer Security (DTLS), проверив наличие известных уязвимостей в публичных источниках или выполнив тестирование на воспроизведение условий гонки.", + "L": "3" + }, + { + "Shortcode": "V17.2.7", + "Ordinal": 7, + "Description": "Убедитесь, что механизмы аудио- и видеозаписи, связанные с медиасервером, способны продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетов Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.", + "L": "3" + }, + { + "Shortcode": "V17.2.8", + "Ordinal": 8, + "Description": "Убедитесь, что сертификат Datagram Transport Layer Security (DTLS) проверяется на соответствие атрибуту отпечатка (fingerprint) в Session Description Protocol (SDP), с немедленным прекращением медиапотока в случае несоответствия — это гарантирует подлинность передаваемых данных.", + "L": "3" + } + ] + }, + { + "Shortcode": "V17.3", + "Ordinal": 3, + "Name": "Сигнализация", + "Items": [ + { + "Shortcode": "V17.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что сигнальный сервер способен продолжать обработку легитимных входящих сообщений сигнализации даже в условиях флуд-атаки. Для этого необходимо реализовать механизм ограничения частоты запросов (rate limiting) на уровне сигнализации.", + "L": "2" + }, + { + "Shortcode": "V17.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что сигнальный сервер способен продолжать обработку легитимных сообщений сигнализации даже при получении некорректных сообщений, которые могут вызвать отказ в обслуживании (Denial of Service, DoS). Для этого необходимо реализовать: проверку входных данных (input validation), безопасную обработку целочисленных переполнений (integer overflows), защиту от переполнения буферов (buffer overflows) и другие надежные методы обработки ошибок.", + "L": "2" + } + ] + } + ] + } + ] +} diff --git a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.csv b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.csv new file mode 100644 index 0000000000..ee9c1f89e8 --- /dev/null +++ b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.csv @@ -0,0 +1,347 @@ +chapter_id,chapter_name,section_id,section_name,req_id,req_description,level1,level2,level3,cwe,nist +V1,Кодировка и нейтрализация,V1.1,Архитектура кодировки и нейтрализации,V1.1.1,"Убедитесь, что входные данные декодируются или деэкранируются в каноническую форму (в стандартное представление) только один раз. Декодирование происходит только тогда, когда ожидаются закодированные данные в этой форме, и что это делается перед дальнейшей обработкой входных данных, например, это не выполняется после проверки или нейтрализации.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.1,Архитектура кодировки и нейтрализации,V1.1.2,"Убедитесь, что приложение выполняет кодирование и экранирование выходных данных либо в качестве последнего шага перед использованием интерпретатором, для которого оно предназначено, либо самим интерпретатором.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.1,"Убедитесь, что выходная кодировка для ответа HTTP, документа HTML или документа XML соответствует требуемому контексту, например, кодировка соответствующих символов для элементов HTML, атрибутов HTML, комментариев HTML, CSS или полей заголовка HTTP делается таким способом, чтобы избежать изменения структуры сообщения или документа.",✓,✓,✓,, +V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.2,"Убедитесь, что при динамическом построении URL-адресов недоверенные данные кодируются в соответствии с их контекстом (например, кодирование URL-адресов или кодирование base64url для query или path параметров или пути). Убедитесь, что разрешены только безопасные протоколы URL-адресов (например, запрещен javascript: или data:).",✓,✓,✓,, +V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.3,"Убедитесь, что при динамическом построении содержимого JavaScript (включая JSON) используется кодирование или экранирование выходных данных, чтобы избежать изменения структуры сообщения или документа (чтобы избежать JavaScript и JSON-инъекций).",✓,✓,✓,, +V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.4,"Убедитесь, что выборка данных (Redis, Memcached, чтение из файлов, обращение по API) или запросы к базе данных (например, SQL, HQL, NoSQL, Cypher) используют параметризованные запросы, ORM, Entity Frameworks или иным образом защищены от SQL-инъекций и других атак. Это также актуально при написании хранимых процедур.",✓,✓,✓,, +V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.5,"Убедитесь, что приложение защищено от внедрения команд ОС и что вызовы операционной системы используют параметризованные запросы к ОС или используют контекстное кодирование вывода командной строки.",✓,✓,✓,, +V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.6,"Убедитесь, что приложение защищено от LDAP-инъекций, или что реализованы специальные меры безопасности для их предотвращения.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.7,"Убедитесь, что приложение защищено от атак с использованием XPath-инъекций с помощью параметризации запросов или предварительно скомпилированных запросов.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.8,"Убедитесь, что процессоры LaTeX настроены безопасно (например, не используется флаг «–shell‑escape») и используется разрешенный список команд для предотвращения LaTeX-инъекций.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.9,"Убедитесь, что приложение экранирует специальные символы в регулярных выражениях (обычно с помощью обратной косой черты), чтобы предотвратить их ошибочную интерпретацию как метасимволов.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.2,Предотвращение инъекций,V1.2.10,"Убедитесь, что приложение защищено от внедрения формул CSV (CSV Injection). Приложение должно следовать правилам экранирования, определенным в RFC 4180, разделы 2.6 и 2.7, при экспорте содержимого CSV. Кроме того, при экспорте в CSV или другие форматы электронных таблиц (такие как XLS, XLSX или ODF) специальные символы (включая '=', '+', '-', '@', '\t' (табуляция), и '\0' (нулевой символ)) должны экранироваться одинарной кавычкой, если они появляются в качестве первого символа в значении поля.",,,✓,, +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.1,"Убедитесь, что все ненадежные входные данные HTML из редакторов WYSIWYG или аналогичных программ нейтрализуются с помощью известных и безопасных библиотек или функций фреймворка для санитизации HTML.",✓,✓,✓,, +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.2,"Убедитесь, что приложение избегает использования eval() или других динамических функций выполнения кода, таких как Spring Expression Language (SpEL). Если нет альтернативы, любой пользовательский ввод должен быть нейтрализован перед выполнением.",✓,✓,✓,, +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.3,"Убедитесь, что данные, передаваемые в потенциально опасный контекст, предварительно нейтрализованы, чтобы обеспечить соблюдение мер безопасности, таких как разрешение только тех символов, которые безопасны для данного контекста, и обрезка слишком длинного ввода.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.4,"Убедитесь, что предоставленный пользователем файл .SVG проверен или нейтрализован, чтобы он содержал только теги и атрибуты (например, относящиеся к рисованию), которые безопасны для приложения, например, не содержат скриптов и foreignObject.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.5,"Убедитесь, что приложение нейтралует или отключает предоставленные пользователем скриптовые данные или выражения шаблонных языков, такие как таблицы стилей Markdown, CSS или XSL, BBCode или аналогичные.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.6,"Убедитесь, что приложение защищено от атак с подделкой запросов на стороне сервера (SSRF), проверяя ненадежные данные по разрешенному списку протоколов, доменов, путей и портов, а также нейтрализуя потенциально опасные символы перед использованием данных для вызова другой службы.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.7,"Убедитесь, что приложение защищено от атак с внедрением шаблонов (template injection), не позволяя создавать шаблоны на основе недоверенных входных данных. Если нет альтернативы, любые недоверенные входные данные, включаемые динамически во время создания шаблона, должны быть нейтрализованы или тщательно провалидированы.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.8,"Убедитесь, что приложение надлежащим образом нейтрализует недоверенные входные данные перед использованием в запросах Java Naming and Directory Interface (JNDI) и что JNDI настроен безопасно для предотвращения атак с использованием JNDI-инъекций.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.9,"Убедитесь, что приложение нейтрализует данные перед отправкой в Memcache, чтобы предотвратить атаки методом инъекций.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.10,"Убедитесь, что строки форматирования, которые могут быть использованы неожидаемым или вредоносным образом, нейтрализуются перед дальнейшим использованием.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.11,"Убедитесь, что приложение нейтрализует вводимые пользователем данные перед передачей в почтовые системы для защиты от SMTP или IMAP-инъекций.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.3,Нейтрализация,V1.3.12,"Убедитесь, что регулярные выражения не содержат элементов, вызывающих экспоненциальный возврат, и убедитесь в нейтрализации недоверенных входных данных для предотвращения атак ReDoS или Runaway Regex.",,,✓,, +V1,Кодировка и нейтрализация,V1.4,"Память, строки и неуправляемый код",V1.4.1,"Убедитесь, что для обнаружения или предотвращения ситуаций переполнения стека, буфера или кучи приложение учитывает размер доступной области памяти при строковых операциях, копировании в память, в арифметике указателей и т.п.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.4,"Память, строки и неуправляемый код",V1.4.2,"Убедитесь, что для предотвращения целочисленного переполнения применяется контроль знака, диапазона и типа допустимых входных данных.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.4,"Память, строки и неуправляемый код",V1.4.3,"Убедитесь, что динамически выделенная память и ресурсы освобождены, а ссылки или указатели на освобожденную память удалены или установлены в значение null, чтобы предотвратить появление висячих указателей и уязвимостей, связанных с использованием памяти после освобождения.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.5,Безопасная десериализация,V1.5.1,"Убедитесь, что приложение настраивает XML-парсеры на использование строгой конфигурации и что небезопасные функции, такие как разрешение внешних сущностей, отключены для предотвращения атак XML eXternal Entity (XXE).",✓,✓,✓,, +V1,Кодировка и нейтрализация,V1.5,Безопасная десериализация,V1.5.2,"Убедитесь, что десериализация недоверенных данных обеспечивает безопасную обработку ввода, например, используя список разрешенных типов объектов или ограничивая типы объектов, определяемые клиентом, для предотвращения атак десериализации. Механизмы десериализации, которые явно определены как небезопасные, не должны использоваться с недоверенным вводом.",,✓,✓,, +V1,Кодировка и нейтрализация,V1.5,Безопасная десериализация,V1.5.3,"Убедитесь, что различные парсеры, используемые в приложении для одного и того же типа данных (например, парсеры JSON, XML, URL), выполняют парсинг согласованным образом и используют один и тот же механизм кодирования символов, чтобы избежать таких проблем, как уязвимости взаимодействия JSON (JSON Interoperability) или различное поведение анализа URI или файлов, которые могут использоваться в атаках удаленного включения файлов (RFI) или подделки запросов на стороне сервера (SSRF).",,,✓,, +V2,Валидация и бизнес-логика,V2.1,Документация валидации и бизнес-логики,V2.1.1,"Убедитесь, что в документации приложения определены правила проверки входных данных на соответствие ожидаемой структуре. Это могут быть распространённые форматы данных, такие как номера кредитных карт, адреса электронной почты, номера телефонов, или внутренний формат данных.",✓,✓,✓,, +V2,Валидация и бизнес-логика,V2.1,Документация валидации и бизнес-логики,V2.1.2,"Убедитесь, что в документации приложения указано, как проверять логическую и контекстную согласованность объединенных данных, например, проверять соответствие района и почтового индекса.",,✓,✓,, +V2,Валидация и бизнес-логика,V2.1,Документация валидации и бизнес-логики,V2.1.3,"Убедитесь, что ожидания относительно ограничений и проверок бизнес-логики задокументированы как для уровня отдельного пользователя, так и для глобального уровня всего приложения.",,✓,✓,, +V2,Валидация и бизнес-логика,V2.2,Валидация ввода,V2.2.1,"Убедитесь, что входные данные провалидированы для обеспечения соответствия бизнес- или функциональным ожиданиям. Валидация должна осуществляться либо по списку допустимых значений, шаблонов и диапазонов, либо путем сравнения входных данных с ожидаемой структурой и логическими ограничениями в соответствии с предопределенными правилами. Для L1 валидация может быть сосредоточена на входных данных, используемых для принятия конкретных бизнес-решений или решений, связанных с безопасностью. Для L2 и выше это должно применяться ко всем входным данным.",✓,✓,✓,, +V2,Валидация и бизнес-логика,V2.2,Валидация ввода,V2.2.2,"Убедитесь, что приложение разработано с принудительной валидацией входных данных на уровне доверенного сервиса. Хотя проверка на стороне клиента повышает удобство использования и должна поощряться, на неё не следует полагаться как на средство контроля безопасности.",✓,✓,✓,, +V2,Валидация и бизнес-логика,V2.2,Валидация ввода,V2.2.3,"Убедитесь, что приложение обеспечивает обоснованность комбинаций данных в соответствии с предопределенными правилам. Например: возраст должен соответствовать дате рождения; страна и почтовый индекс; количество товара в заказе и на складе.",,✓,✓,, +V2,Валидация и бизнес-логика,V2.3,Безопасность бизнес-логики,V2.3.1,"Убедитесь, что приложение обрабатывает потоки бизнес-логики для одного и того же пользователя в ожидаемом последовательном порядке шагов и без пропуска шагов.",✓,✓,✓,, +V2,Валидация и бизнес-логика,V2.3,Безопасность бизнес-логики,V2.3.2,"Убедитесь, что ограничения бизнес-логики реализованы в соответствии с документацией приложения, чтобы избежать эксплуатации её недостатков.",,✓,✓,, +V2,Валидация и бизнес-логика,V2.3,Безопасность бизнес-логики,V2.3.3,"Убедитесь, что транзакции используются на уровне бизнес-логики таким образом, что операция бизнес-логики либо выполняется полностью, либо откатывается к предыдущему корректному состоянию.",,✓,✓,, +V2,Валидация и бизнес-логика,V2.3,Безопасность бизнес-логики,V2.3.4,"Убедитесь, что на уровне бизнес-логики используются механизмы блокировки, чтобы гарантировать невозможность двойного бронирования ограниченных по количеству ресурсов (например, мест в театре или слотов доставки) путем манипулирования логикой приложения.",,✓,✓,, +V2,Валидация и бизнес-логика,V2.3,Безопасность бизнес-логики,V2.3.5,"Убедитесь, что для важных потоков бизнес-логики требуется многопользовательское (multi-user) одобрение, чтобы предотвратить несанкционированные или случайные действия. Потоки бизнес-логики могут включать, помимо прочего, крупные денежные переводы, утверждение контрактов, доступ к секретной информации или обход ограничений безопасности на производстве.",,,✓,, +V2,Валидация и бизнес-логика,V2.4,Анти-автоматизация,V2.4.1,"Убедитесь, что используются средства противодействия автоматизации для защиты от чрезмерных вызовов функций приложения, которые могут привести к утечке данных, созданию ненужных данных, исчерпанию квот, нарушению ограничений скорости, отказу в обслуживании или чрезмерному использованию дорогостоящих ресурсов.",,✓,✓,, +V2,Валидация и бизнес-логика,V2.4,Анти-автоматизация,V2.4.2,"Убедитесь, что потоки бизнес-логики требуют реалистичного человеческого времени, предотвращая чрезмерно быструю отправку транзакций.",,,✓,, +V3,Безопасность веб-интерфейса,V3.1,Документация по безопасности веб-интерфейса,V3.1.1,"Убедитесь, что в документации приложения описаны ожидаемые функции безопасности, которые должны поддерживать браузеры, использующие приложение (такие как HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) и другие соответствующие механизмы безопасности HTTP). В документации также должно быть обязательно определено, как приложение должно себя вести, если некоторые из этих функций недоступны (например, предупреждать пользователя или блокировать доступ).",,,✓,, +V3,Безопасность веб-интерфейса,V3.2,Непреднамеренная интерпретация контента,V3.2.1,"Убедитесь, что реализованы меры безопасности, предотвращающие отображение контента или функций браузерами в HTTP-ответах в некорректном контексте (например, запрос API, загруженный пользователем файл или другой ресурс запрашивается напрямую). Возможные способы контроля включают: не обрабатывать содержимое, если поля заголовка HTTP-запроса (например, Sec-Fetch-*) не указывают на корректность контекста; использование заголовка и значения Content-Security-Policy: sandbox directive; или использование заголовка и значения Content-Disposition: attachment.",✓,✓,✓,, +V3,Безопасность веб-интерфейса,V3.2,Непреднамеренная интерпретация контента,V3.2.2,"Убедитесь, что данные, предназначенные для отображения в виде текста, а не визуализации в виде HTML, обрабатывается с использованием безопасных функций визуализации (таких как createTextNode или textContent), чтобы предотвратить непреднамеренное выполнение содержимого, такого как HTML или JavaScript.",✓,✓,✓,, +V3,Безопасность веб-интерфейса,V3.2,Непреднамеренная интерпретация контента,V3.2.3,"Убедитесь, что приложение избегает затирания DOM при использовании JavaScript на стороне клиента, применяя явные объявления переменных, выполняя строгую проверку типов, избегая сохранения глобальных переменных в объекте документа и реализуя изоляцию пространства имен.",,,✓,, +V3,Безопасность веб-интерфейса,V3.3,Настройка файлов cookie,V3.3.1,"Убедитесь, что у файлов cookie установлен атрибут «Secure», и если префикс «__Host‑» не используется в названии cookie, необходимо использовать префикс «__Secure‑».",✓,✓,✓,, +V3,Безопасность веб-интерфейса,V3.3,Настройка файлов cookie,V3.3.2,"Убедитесь, что значение атрибута SameSite каждой cookie установлено в соответствии с назначением cookie, чтобы ограничить подверженность атакам на восстановление пользовательского интерфейса и атакам с подделкой запросов на уровне браузера, обычно называемым подделкой межсайтовых запросов (CSRF).",,✓,✓,, +V3,Безопасность веб-интерфейса,V3.3,Настройка файлов cookie,V3.3.3,"Убедитесь, что cookie имеют префикс «__Host‑» в названии, если только они явно не предназначены для совместного использования с другими хостами.",,✓,✓,, +V3,Безопасность веб-интерфейса,V3.3,Настройка файлов cookie,V3.3.4,"Убедитесь, что если значение cookie не должно быть доступно для клиентских скриптов (например, сессионный токен), для cookie должен быть установлен атрибут «HttpOnly», а само значение должно передаваться клиенту только через поле заголовка «Set-Cookie».",,✓,✓,, +V3,Безопасность веб-интерфейса,V3.3,Настройка файлов cookie,V3.3.5,"Убедитесь, что при записи cookie приложением общая длина имени и значения cookie не превышает 4096 байт. Слишком большие cookie не будут сохраняться браузером и, следовательно, не будут отправляться с запросами, что помешает пользователю использовать функции приложения, зависящие от этого cookie.",,,✓,, +V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.1,"Убедитесь, что поле заголовка Strict‑Transport‑Security включено во все ответы для реализации политики HTTP Strict Transport Security (HSTS). Необходимо указать максимальное время не менее 1 года, а для L2 и выше политика должна применяться также ко всем поддоменам.",✓,✓,✓,, +V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.2,"Убедитесь, что поле заголовка Cross‑Origin Resource Sharing (CORS) «Access‑Control‑Allow‑Origin» имеет фиксированное значение, заданное приложением, или, если используется заголовок Origin, оно проверяется по списку доверенных источников. При необходимости использования «Access‑Control‑Allow‑Origin: *» убедитесь, что ответ не содержит конфиденциальной информации.",✓,✓,✓,, +V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.3,"Убедитесь, что HTTP-ответы содержат поле заголовка Content-Security-Policy, которое определяет директивы, гарантирующие загрузку и выполнение браузером только доверенного контента или ресурсов, чтобы ограничить выполнение вредоносного JavaScript. Как минимум, необходимо использовать глобальную политику, включающую директивы object-src «none» и base-uri «none», а также определяющую список разрешенных адресов или использующую одноразовые коды или хэши. Для приложений L3 необходимо определить политику использования 'nonce' или hash-конструкций для каждого ответа.",,✓,✓,, +V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.4,"Убедитесь, что все HTTP-ответы содержат поле заголовка «X‑Content‑Type‑Options: nosniff». Это предписывает браузерам не использовать анализ контента и определение типа MIME для данного ответа, а также требовать, чтобы значение поля заголовка Content‑Type в ответе соответствовало целевому ресурсу. Например, ответ на запрос стиля принимается только в том случае, если Content‑Type в ответе — «text/css». Это также позволяет браузеру использовать функцию Cross‑Origin Read Blocking (CORB).",,✓,✓,, +V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.5,"Убедитесь, что приложение устанавливает политику реферера для предотвращения утечки технически конфиденциальных данных сторонним сервисам через поле заголовка HTTP-запроса «Referer». Это можно сделать с помощью поля заголовка HTTP-ответа «Referrer‑Policy» или через атрибуты HTML-элемента. Конфиденциальные данные могут включать путь и данные запроса в URL-адресе, а для внутренних непубличных приложений также имя хоста.",,✓,✓,, +V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.6,"Убедитесь, что веб-приложение использует директиву frame‑ancestors поля заголовка Content‑Security‑Policy для каждого HTTP-ответа, чтобы гарантировать невозможность его внедрения по умолчанию и внедрение определённых ресурсов разрешено только при необходимости. Обратите внимание, что поле заголовка X‑Frame‑Options, хотя и поддерживается браузерами, устарело и не может быть использовано в качестве основы.",,✓,✓,, +V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.7,"Убедитесь, что в поле заголовка Content‑Security‑Policy указано место, куда следует сообщать о нарушениях.",,,✓,, +V3,Безопасность веб-интерфейса,V3.4,Заголовки механизма безопасности браузера,V3.4.8,"Убедитесь, что все HTTP-ответы, инициирующие рендеринг документа (например, ответы с типом содержимого text/html), включают поле заголовка Cross-Origin-Opener-Policy с директивой same-origin или same-origin-allow-popups (при необходимости). Это предотвращает атаки, злоупотребляющие общим доступом к объектам Window, такие как Tabnabbing и Frame Counting.",,,✓,, +V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.1,"Убедитесь, что, если приложение не использует механизм предварительной проверки CORS для предотвращения запрещённых кросс-доменных запросов на использование чувствительного функционала, эти запросы валидируются на предмет их происхождения от самого приложения. Это можно сделать, используя и проверяя специальные токены для защиты от подделки или требуя дополнительные поля HTTP-заголовка, не входящие в список «простых заголовков» (CORS-safelisted request-header). Это необходимо для защиты от атак с подделкой запросов через браузер, широко известных как межсайтовая подделка запросов (CSRF).",✓,✓,✓,, +V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.2,"Убедитесь, что если приложение использует механизм предварительной проверки CORS для предотвращения неразрешённого использования чувствительного функционала между источниками, вызов этого функционала невозможен с помощью запроса, который не запускает предварительную проверку CORS. Для этого может потребоваться проверка значений полей заголовка запроса «Origin» и «Content-Type» или использование дополнительного поля заголовка, не входящего в безопасный список CORS.",✓,✓,✓,, +V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.3,"Убедитесь, что HTTP-запросы к чувствительному функционалу используют соответствующие HTTP-методы, такие как POST, PUT, PATCH или DELETE, а не методы, определённые спецификацией HTTP как «безопасные», такие как HEAD, OPTIONS или GET. В качестве альтернативы можно использовать строгую валидацию полей заголовка запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, навигационного запроса или загрузки ресурса (например, источника изображения), где это не ожидается.",✓,✓,✓,, +V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.4,"Убедитесь, что отдельные приложения размещены на разных именах хостов, чтобы использовать ограничения, предусмотренные политикой same-origin, включая то, как документы или скрипты, загруженные одним источником, могут взаимодействовать с ресурсами из другого источника, а также ограничения на cookie на основе имени хоста.",,✓,✓,, +V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.5,"Убедитесь, что сообщения, полученные интерфейсом postMessage, отвергаются, если источник сообщения не является доверенным или если синтаксис сообщения недействителен.",,✓,✓,, +V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.6,"Убедитесь, что функциональность JSONP не включена нигде в приложении, чтобы избежать атак с использованием межсайтового включения скриптов (XSSI).",,,✓,, +V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.7,"Убедитесь, что данные, требующие авторизации, не включены в ответы ресурсов скриптов, таких как файлы JavaScript, чтобы предотвратить атаки с использованием межсайтового включения скриптов (XSSI).",,,✓,, +V3,Безопасность веб-интерфейса,V3.5,Браузерное разделение источников,V3.5.8,"Убедитесь, что аутентифицированные ресурсы (такие как изображения, видео, скрипты и другие документы) могут быть загружены или внедрены от имени пользователя только по назначению. Этого можно добиться путём строгой валидации полей заголовка HTTP-запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, или путём установки ограничительного поля заголовка HTTP-ответа Cross‑Origin‑Resource‑Policy, чтобы браузер блокировал возвращаемый контент.",,,✓,, +V3,Безопасность веб-интерфейса,V3.6,Целостность внешних ресурсов,V3.6.1,"Убедитесь, что клиентские ресурсы, такие как библиотеки JavaScript, CSS или веб-шрифты, размещаются только на внешнем сервере (например, в сети доставки контента (Content Delivery Network)), если ресурс статический и имеет версии, а для проверки целостности ресурса используется механизм проверки целостности подресурсов (SRI). Если это невозможно, для каждого ресурса должно быть задокументировано решение по безопасности, обосновывающее это.",,,✓,, +V3,Безопасность веб-интерфейса,V3.7,Другие соображения по безопасности браузера,V3.7.1,"Убедитесь, что приложение использует только те клиентские технологии, которые по-прежнему поддерживаются и считаются безопасными. Примерами технологий, не соответствующих этому требованию, являются плагины NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL или клиентские Java-апплеты.",,✓,✓,, +V3,Безопасность веб-интерфейса,V3.7,Другие соображения по безопасности браузера,V3.7.2,"Убедитесь, что приложение будет автоматически перенаправлять пользователя на другое имя хоста или домен (который не контролируется приложением), только если этот хост или домен указаны в списке разрешенных.",,✓,✓,, +V3,Безопасность веб-интерфейса,V3.7,Другие соображения по безопасности браузера,V3.7.3,"Убедитесь, что приложение отображает уведомление, что пользователь перенаправляется на URL-адрес, находящийся вне контроля приложения, с возможностью отмены навигации.",,,✓,, +V3,Безопасность веб-интерфейса,V3.7,Другие соображения по безопасности браузера,V3.7.4,"Убедитесь, что домен верхнего уровня приложения (например, site.tld) ​​добавлен в публичный список предварительной загрузки (preload list) для HTTP Strict Transport Security (HSTS). Это гарантирует, что использование TLS для приложения будет встроено непосредственно в основные браузеры, а не будет полагаться только на поле заголовка ответа Strict-Transport-Security.",,,✓,, +V3,Безопасность веб-интерфейса,V3.7,Другие соображения по безопасности браузера,V3.7.5,"Убедитесь, что приложение ведет себя так, как описано в документации (например, предупреждает пользователя или блокирует доступ), если браузер, используемый для доступа к приложению, не поддерживает ожидаемые функции безопасности.",,,✓,, +V4,API и Веб-сервис,V4.1,Общая безопасность веб-сервисов,V4.1.1,"Убедитесь, что каждый HTTP-ответ с телом сообщения содержит заголовок Content-Type, который соответствует фактическому содержимому ответа, таким как «text/», «/+xml» и «/xml», включая параметр charset для указания безопасной кодировки символов (например, UTF-8, ISO-8859-1) согласно IANA Media Types.",✓,✓,✓,, +V4,API и Веб-сервис,V4.1,Общая безопасность веб-сервисов,V4.1.2,"Убедитесь, что только конечные точки, предназначенные для взаимодействия с пользователем через веб-браузер, автоматически перенаправляют HTTP на HTTPS, в то время как другие сервисы или конечные точки не реализуют прозрачные редиректы. Это необходимо, чтобы избежать ситуации, когда клиент ошибочно отправляет незашифрованные HTTP-запросы а из-за того, что запрос по HTTP автоматически перенаправляется на HTTPS другим сервисом без обработки на входе, утечка чувствительных данных остаётся незамеченной.",,✓,✓,, +V4,API и Веб-сервис,V4.1,Общая безопасность веб-сервисов,V4.1.3,"Убедитесь, что любой HTTP-заголовок, используемый приложением и устанавливаемый промежуточным уровнем, таким как балансировщик нагрузки, веб-прокси или backend-for-frontend сервис, не может быть переопределён конечным пользователем. Примеры заголовков: X-Real-IP, X-Forwarded-*, X-User-ID.",,✓,✓,, +V4,API и Веб-сервис,V4.1,Общая безопасность веб-сервисов,V4.1.4,"Убедитесь, что разрешены только HTTP-методы, которые явно поддерживаются приложением или его API (включая OPTIONS для preflight-запросов), а неиспользуемые методы заблокированы.",,,✓,, +V4,API и Веб-сервис,V4.1,Общая безопасность веб-сервисов,V4.1.5,"Убедитесь, что для особо чувствительных запросов или транзакций, проходящих через несколько систем, используются цифровые подписи на уровне сообщений, дополнительно к транспортным средствам защиты.",,,✓,, +V4,API и Веб-сервис,V4.2,Валидация структуры HTTP-сообщений,V4.2.1,"Убедитесь, что все компоненты приложения (включая балансировщики нагрузки, файрволы и серверы приложений) определяют границы входящих HTTP-сообщений с использованием механизма, соответствующего версии HTTP, чтобы предотвратить HTTP request smuggling. В HTTP/1.x, если присутствует заголовок Transfer-Encoding, заголовок Content-Length должен игнорироваться согласно RFC 2616. При использовании HTTP/2 или HTTP/3, если присутствует Content-Length, веб-сервер должен убедиться, что он совпадает с длиной DATA-фреймов.",,✓,✓,, +V4,API и Веб-сервис,V4.2,Валидация структуры HTTP-сообщений,V4.2.2,"Убедитесь, что при генерации HTTP-сообщений заголовок Content-Length не конфликтует с длиной содержимого, определяемой рамками протокола HTTP, чтобы предотвратить HTTP Request Smuggling.",,,✓,, +V4,API и Веб-сервис,V4.2,Валидация структуры HTTP-сообщений,V4.2.3,"Убедитесь, что приложение не отправляет и не принимает HTTP/2 и HTTP/3 сообщения с заголовками, специфичными для соединения, такими как Transfer-Encoding, чтобы предотвратить HTTP Response Splitting и HTTP Header Injection.",,,✓,, +V4,API и Веб-сервис,V4.2,Валидация структуры HTTP-сообщений,V4.2.4,"Убедитесь, что приложение принимает HTTP/2 и HTTP/3 запросы только в случае, если поля заголовков и их значения не содержат последовательностей CR (\r), LF (\n) или CRLF (\r\n), чтобы предотвратить HTTP Header Injection.",,,✓,, +V4,API и Веб-сервис,V4.2,Валидация структуры HTTP-сообщений,V4.2.5,"Убедитесь, что если приложение (бекенд или фронтенд) формирует и отправляет запросы, оно использует валидацию, очистку или другие механизмы, чтобы не создавать URI (например, для API-вызовов) или HTTP-заголовки (например, Authorization или Cookie) слишком большой длины, чтобы их не принимал приёмник. Это может привести к отказу в обслуживании, например, при отправке слишком длинного запроса (длинный cookie-заголовок), из-за чего сервер постоянно возвращает ошибку.",,,✓,, +V4,API и Веб-сервис,V4.3,GraphQL,V4.3.1,"Убедитесь, что используется белый список запросов, ограничение глубины вложенности, ограничение количества или анализ стоимости запроса, чтобы предотвратить DoS-атаки на уровне GraphQL или слоя данных из-за дорогостоящих вложенных запросов.",,✓,✓,, +V4,API и Веб-сервис,V4.3,GraphQL,V4.3.2,"Убедитесь, что introspection-запросы GraphQL отключены в продакшен-среде, если GraphQL API не предназначен для использования сторонними клиентами.",,✓,✓,, +V4,API и Веб-сервис,V4.4,WebSocket,V4.4.1,"Убедитесь, что для всех WebSocket-соединений используется WebSocket поверх TLS (WSS).",✓,✓,✓,, +V4,API и Веб-сервис,V4.4,WebSocket,V4.4.2,"Убедитесь, что при первоначальном HTTP WebSocket handshake заголовок Origin проверяется на соответствие списку разрешённых источников для приложения.",,✓,✓,, +V4,API и Веб-сервис,V4.4,WebSocket,V4.4.3,"Убедитесь, что если стандартное управление сессиями приложения не может быть использовано, применяются специальные токены, соответствующие требованиям безопасности управления сессиями.",,✓,✓,, +V4,API и Веб-сервис,V4.4,WebSocket,V4.4.4,"Убедитесь, что специальные токены управления сессиями WebSocket изначально получаются или валидируются через ранее аутентифицированную HTTPS-сессию при переходе от HTTPS к WebSocket.",,✓,✓,, +V5,Работа с файлами,V5.1,Документация по работе с файлами,V5.1.1,"Убедитесь, что документация определяет допустимые типы файлов, ожидаемые расширения и максимальный размер (включая распакованный размер) для каждой функции загрузки. Также убедитесь, что в документации указано, как файлы обезвреживаются для конечных пользователей (например, как приложение ведёт себя при обнаружении вредоносного файла).",,✓,✓,, +V5,Работа с файлами,V5.2,Загрузка файлов и содержимое,V5.2.1,"Убедитесь, что приложение принимает только те файлы, которые может обработать без потери производительности или отказа в обслуживании.",✓,✓,✓,, +V5,Работа с файлами,V5.2,Загрузка файлов и содержимое,V5.2.2,"Убедитесь, что при загрузке файла (включая файлы внутри архивов, таких как ZIP) приложение проверяет, соответствует ли расширение ожидаемому, и валидирует, соответствует ли содержимое типу, указанному в расширении. Это включает проверку начальных 'magic bytes', перезапись изображений, использование специализированных библиотек. Для уровня 1 — достаточно проверок для файлов, критичных с точки зрения бизнеса или безопасности. Для уровней 2 и выше — для всех файлов.",✓,✓,✓,, +V5,Работа с файлами,V5.2,Загрузка файлов и содержимое,V5.2.3,"Убедитесь, что приложение проверяет архивы (например, zip, gz, docx, odt) на максимально допустимый распакованный размер и максимальное количество файлов до распаковки.",,✓,✓,, +V5,Работа с файлами,V5.2,Загрузка файлов и содержимое,V5.2.4,"Убедитесь, что для каждого пользователя установлены квоты на общий размер и количество файлов, чтобы один пользователь не мог переполнить хранилище.",,,✓,, +V5,Работа с файлами,V5.2,Загрузка файлов и содержимое,V5.2.5,"Убедитесь, что приложение не позволяет загружать архивы с символьными ссылками (symlinks), если это не требуется по бизнес-логике. Если требуется — разрешён только строго определённый список допустимых символьных ссылок.",,,✓,, +V5,Работа с файлами,V5.2,Загрузка файлов и содержимое,V5.2.6,"Убедитесь, что приложение отклоняет изображения с числом пикселей выше допустимого, чтобы предотвратить атаки 'pixel flood'.",,,✓,, +V5,Работа с файлами,V5.3,Хранение файлов,V5.3.1,"Убедитесь, что загруженные или сгенерированные из недоверенного ввода файлы, находящиеся в публичной директории, не исполняются как серверный код при обращении к ним по HTTP.",✓,✓,✓,, +V5,Работа с файлами,V5.3,Хранение файлов,V5.3.2,"Убедитесь, что при создании путей к файлам приложение использует внутренние или доверенные данные, а не пользовательские имена файлов. Если использование пользовательских имён или метаданных необходимо — требуется строгая проверка и очистка. Это защита от path traversal, LFI, RFI и SSRF.",✓,✓,✓,, +V5,Работа с файлами,V5.3,Хранение файлов,V5.3.3,"Убедитесь, что при обработке файлов на сервере (например, при распаковке) игнорируются пути, заданные пользователем, во избежание уязвимостей типа 'zip slip'.",,,✓,, +V5,Работа с файлами,V5.4,Скачивание файлов,V5.4.1,"Убедитесь, что приложение валидирует или игнорирует имена файлов, переданных пользователем (включая в JSON, JSONP или URL-параметре), и указывает имя файла в заголовке Content-Disposition при ответе.",,✓,✓,, +V5,Работа с файлами,V5.4,Скачивание файлов,V5.4.2,"Убедитесь, что имена файлов, передаваемые (например, в HTTP-заголовках или вложениях в email), кодируются или очищаются (например, по RFC 6266), чтобы сохранить структуру документа и предотвратить инъекции.",,✓,✓,, +V5,Работа с файлами,V5.4,Скачивание файлов,V5.4.3,"Убедитесь, что файлы, полученные из недоверенных источников, сканируются антивирусом, чтобы не распространять известное вредоносное содержимое.",,✓,✓,, +V6,Аутентификация,V6.1,Документация по аутентификации,V6.1.1,"Убедитесь, что в документации приложения описано, как используются механизмы, такие как ограничение частоты запросов (rate limiting), защита от автоматизации и адаптивные реакции, для защиты от атак, таких как подстановка учётных данных и перебор паролей. Документация должна ясно описывать конфигурацию этих механизмов и предотвращение злонамеренной блокировки аккаунтов.",✓,✓,✓,, +V6,Аутентификация,V6.1,Документация по аутентификации,V6.1.2,"Убедитесь, что задокументирован список контекстно-зависимых слов, запрещённых к использованию в паролях. В него могут входить производные от названий организаций, продуктов, идентификаторов систем, кодовых названий проектов, названий отделов или ролей и тому подобное.",,✓,✓,, +V6,Аутентификация,V6.1,Документация по аутентификации,V6.1.3,"Убедитесь, что если приложение поддерживает несколько способов аутентификации, то все они документированы вместе с описанием применяемых средств защиты и уровнем стойкости аутентификации, которые должны быть одинаково применены ко всем способам.",,✓,✓,, +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.1,"Убедитесь, что пользовательские пароли содержат не менее 8 символов. Рекомендуется минимальная длина в 15 символов.",✓,✓,✓,, +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.2,"Убедитесь, что пользователи могут менять свои пароли.",✓,✓,✓,, +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.3,"Убедитесь, что для смены пароля требуется ввести как текущий, так и новый пароль.",✓,✓,✓,, +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.4,"Убедитесь, что при регистрации или смене пароля введённый пароль проверяется по списку как минимум из 3000 самых популярных паролей, соответствующих политике (например, минимальной длине).",✓,✓,✓,, +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.5,"Убедитесь, что допускаются пароли любой структуры, без ограничений на использование определённых символов. Не должно быть требований по обязательному наличию заглавных/строчных букв, цифр или специальных символов.",✓,✓,✓,, +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.6,"Убедитесь, что поля ввода пароля используют type=password для скрытия символов. Разрешено временное отображение всего пароля или последнего введённого символа.",✓,✓,✓,, +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.7,"Убедитесь, что разрешены вставка (paste), использование менеджеров паролей браузера и внешних менеджеров паролей.",✓,✓,✓,, +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.8,"Убедитесь, что пароль проверяется строго в том виде, в котором он был введён пользователем — без обрезки, изменения регистра и других модификаций.",✓,✓,✓,, +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.9,"Убедитесь, что система позволяет использовать пароли длиной не менее 64 символов.",,✓,✓,, +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.10,"Убедитесь, что пароль остаётся действительным, пока не будет скомпрометирован или не будет изменён пользователем. Приложение не должно требовать регулярной смены пароля.",,✓,✓,, +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.11,"Убедитесь, что используется документированный список контекстно-зависимых слов (например, названия компаний, проектов и т.д.) для предотвращения использования легко угадываемых паролей.",,✓,✓,, +V6,Аутентификация,V6.2,Безопасность паролей,V6.2.12,"Убедитесь, что при регистрации или смене пароля проверяется, не входит ли он в список скомпрометированных (утёкших) паролей.",,✓,✓,, +V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.1,"Убедитесь, что реализованы меры защиты от атак типа credential stuffing (массовая подстановка учётных данных) и brute-force (перебор паролей), согласно документации по безопасности приложения.",✓,✓,✓,, +V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.2,"Убедитесь, что в приложении отсутствуют или отключены учётные записи по умолчанию (например, root, admin, sa).",✓,✓,✓,, +V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.3,"Убедитесь, что для доступа к приложению используется либо механизм многофакторной аутентификации, либо комбинация однофакторных. Для уровня L3 один из факторов должен быть аппаратным, обеспечивающим защиту от фишинга, устойчивость к компрометации и подтверждение намерения аутентификации через явное действие пользователя (например, нажатие кнопки на FIDO-ключе или телефоне). Ослабление этих требований допускается только при наличии обоснования и компенсирующих мер.",,✓,✓,, +V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.4,"Убедитесь, что при наличии нескольких способов аутентификации, они все задокументированы, и для них единообразно применяются меры защиты и уровни доверия.",,✓,✓,, +V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.5,"Убедитесь, что пользователи получают уведомления о подозрительных попытках аутентификации (удачных и неудачных). Это может включать попытки (например, подключения) с необычного устройства или места, частично успешную MFA, попытку после долгого отсутствия или успешную аутентификацию после серии неудачных.",,,✓,, +V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.6,"Убедитесь, что email не используется ни как однофакторный, ни как многофакторный механизм аутентификации.",,,✓,, +V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.7,"Убедитесь, что пользователи получают уведомление при изменении данных аутентификации, таких как сброс пароля или изменение логина/email.",,,✓,, +V6,Аутентификация,V6.3,Общие требования к безопасности аутентификации,V6.3.8,"Убедитесь, что из сообщений об ошибке, HTTP-кодов ответа или различий во времени ответа нельзя определить, существует ли пользователь с таким логином. Это правило также должно применяться к функциям регистрации и восстановления пароля.",,,✓,, +V6,Аутентификация,V6.4,Жизненный цикл и восстановление факторов аутентификации,V6.4.1,"Убедитесь, что начальные пароли или коды активации, генерируемые системой, создаются с использованием надёжного генератора случайных чисел, соответствуют текущей политике паролей и истекают через короткий период времени либо после первого использования. Эти секреты не должны использоваться как постоянные пароли.",✓,✓,✓,, +V6,Аутентификация,V6.4,Жизненный цикл и восстановление факторов аутентификации,V6.4.2,"Убедитесь, что в системе отсутствуют подсказки к паролю или вопросы на знание («секретные вопросы»).",✓,✓,✓,, +V6,Аутентификация,V6.4,Жизненный цикл и восстановление факторов аутентификации,V6.4.3,"Убедитесь, что реализован безопасный процесс сброса забытого пароля, который не обходит активные механизмы многофакторной аутентификации.",,✓,✓,, +V6,Аутентификация,V6.4,Жизненный цикл и восстановление факторов аутентификации,V6.4.4,"Убедитесь, что в случае утраты одного из факторов MFA проводится удостоверение личности (identity proofing) на том же уровне, что и при первичной регистрации.",,✓,✓,, +V6,Аутентификация,V6.4,Жизненный цикл и восстановление факторов аутентификации,V6.4.5,"Убедитесь, что инструкции по обновлению истекающих механизмов аутентификации отправляются заранее, с достаточным запасом времени для выполнения замены, при необходимости с настройкой автоматических напоминаний.",,,✓,, +V6,Аутентификация,V6.4,Жизненный цикл и восстановление факторов аутентификации,V6.4.6,"Убедитесь, что администраторы могут инициировать процесс сброса пароля, но не могут задать или выбрать новый пароль за пользователя. Это исключает ситуацию, при которой администратор знает пароль пользователя.",,,✓,, +V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.1,"Убедитесь, что lookup-секреты, внеполосные коды/запросы и TOTP-коды можно использовать только один раз.",,✓,✓,, +V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.2,"Убедитесь, что при хранении lookup-секретов с энтропией менее 112 бит (например, 19 случайных буквенно-цифровых символов или 34 случайные цифры) они хэшируются с использованием разрешённого алгоритма хеширования паролей и случайной соли минимум 32 бита. Если у секрета ≥112 бит энтропии — допустимо использовать стандартный хэш.",,✓,✓,, +V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.3,"Убедитесь, что lookup-секреты, коды внеполосной аутентификации и сиды для TOTP генерируются с использованием криптографически стойкого генератора случайных чисел (CSPRNG), чтобы избежать предсказуемых значений.",,✓,✓,, +V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.4,"Убедитесь, что lookup-секреты и внеполосные коды аутентификации имеют минимум 20 бит энтропии (достаточно, например, 4 случайных алфавитно-цифровых символов или 6 случайных цифр).",,✓,✓,, +V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.5,"Убедитесь, что все внеполосные запросы, коды и токены, а также TOTP-коды имеют ограниченный срок действия. Максимум для out-of-band — 10 минут, для TOTP — 30 секунд.",,✓,✓,, +V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.6,"Убедитесь, что любой фактор аутентификации (включая физические устройства) может быть отозван в случае кражи или утери.",,,✓,, +V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.7,"Убедитесь, что биометрические механизмы аутентификации используются только как вторичный фактор — в сочетании с «чем-то, что вы знаете» или «чем-то, что у вас есть».",,,✓,, +V6,Аутентификация,V6.5,Общие требования к многофакторной аутентификации,V6.5.8,"Убедитесь, что TOTP-коды проверяются по источнику времени, полученному от доверенного сервиса, а не от клиента или недоверенного источника.",,,✓,, +V6,Аутентификация,V6.6,Внеполосные механизмы аутентификации,V6.6.1,"Убедитесь, что механизмы аутентификации через телефонную сеть общего пользования (PSTN) для доставки одноразовых паролей (OTP) по телефону или SMS используются только в случае предварительной валидации номера, при этом предлагаются альтернативные более безопасные методы (например, TOTP), и пользователю сообщаются риски. Для приложений уровня L3 использование телефона и SMS недопустимо.",,✓,✓,, +V6,Аутентификация,V6.6,Внеполосные механизмы аутентификации,V6.6.2,"Убедитесь, что внеполосные запросы, коды или токены привязаны к исходному запросу аутентификации, для которого они были сгенерированы, и не могут быть использованы повторно для других попыток.",,✓,✓,, +V6,Аутентификация,V6.6,Внеполосные механизмы аутентификации,V6.6.3,"Убедитесь, что внеполосные механизмы на основе кода защищены от атак методом подбора (brute force) путём применения ограничения частоты запросов (rate limiting). Также рекомендуется использовать коды с энтропией не менее 64 бит.",,✓,✓,, +V6,Аутентификация,V6.6,Внеполосные механизмы аутентификации,V6.6.4,"Убедитесь, что при использовании push-уведомлений для MFA применяется ограничение частоты (rate limiting), чтобы предотвратить атаки push-бомбинга. Также может помочь механизм сопоставления номеров (number matching).",,,✓,, +V6,Аутентификация,V6.7,Криптографические механизмы аутентификации,V6.7.1,"Убедитесь, что сертификаты, используемые для проверки криптографических утверждений об аутентификации, хранятся таким образом, чтобы исключить возможность их модификации.",,,✓,, +V6,Аутентификация,V6.7,Криптографические механизмы аутентификации,V6.7.2,"Убедитесь, что nonce (случайная строка), используемая в процессе вызова, имеет длину не менее 64 бит и является статистически уникальной или уникальной на протяжении всего срока службы криптографического устройства.",,,✓,, +V6,Аутентификация,V6.8,Аутентификация с использованием провайдера идентификаций (IdP),V6.8.1,"Убедитесь, что при поддержке несколькими IdP, невозможно подделать личность пользователя через другой IdP (например, с тем же user ID). Стандартным способом защиты является регистрация пользователя с использованием сочетания ID самого IdP (в качестве пространства имён) и пользовательского ID внутри IdP.",,✓,✓,, +V6,Аутентификация,V6.8,Аутентификация с использованием провайдера идентификаций (IdP),V6.8.2,"Убедитесь, что наличие и целостность цифровой подписи в утверждениях аутентификации (например, в JWT или SAML) всегда проверяются, а неподписанные или недействительные утверждения отклоняются.",,✓,✓,, +V6,Аутентификация,V6.8,Аутентификация с использованием провайдера идентификаций (IdP),V6.8.3,"Убедитесь, что SAML-утверждения обрабатываются только один раз в течение периода их действия, чтобы исключить атаки воспроизведения (replay attacks).",,✓,✓,, +V6,Аутентификация,V6.8,Аутентификация с использованием провайдера идентификаций (IdP),V6.8.4,"Убедитесь, что если приложение использует внешний поставщик идентификации (IdP) и для определенных функций требуется особый уровень, метод или срок действия аутентификации, то приложение использует данные, возвращаемые IdP, для проверки этих условий. Например, при использовании OIDC можно проверить значения полей ID Token — acr, amr, auth_time (если они есть). Если IdP не предоставляет эти данные, приложение должно иметь документированный план действий по умолчанию, предполагающий использование минимально допустимой силы аутентификации (например, одноступенчатая — логин и пароль).",,✓,✓,, +V7,Управление сессиями,V7.1,Документация по управлению сессиями,V7.1.1,"Убедитесь, что тайм-аут бездействия и абсолютное максимальное время жизни сессии задокументированы, соответствуют другим контрольным мерам и сопровождаются обоснованием любых отклонений от требований повторной аутентификации NIST SP 800-63B.",,✓,✓,, +V7,Управление сессиями,V7.1,Документация по управлению сессиями,V7.1.2,"Убедитесь, что документация определяет допустимое количество одновременных (параллельных) сессий для одного аккаунта, а также поведение системы и действия при достижении этого лимита.",,✓,✓,, +V7,Управление сессиями,V7.1,Документация по управлению сессиями,V7.1.3,"Убедитесь, что все системы, создающие и управляющие сессиями пользователей в рамках федеративной идентификации (например, SSO), задокументированы вместе с механизмами координации сроков действия сессий, условий завершения и случаев, требующих повторной аутентификации.",,✓,✓,, +V7,Управление сессиями,V7.2,Базовая безопасность сессий,V7.2.1,"Убедитесь, что все проверки сессионных токенов выполняются на доверенной серверной стороне.",✓,✓,✓,, +V7,Управление сессиями,V7.2,Базовая безопасность сессий,V7.2.2,"Убедитесь, что приложение использует либо автономные токены, либо ссылочные токены, которые генерируются динамически, не используя статические API-секреты или ключи.",✓,✓,✓,, +V7,Управление сессиями,V7.2,Базовая безопасность сессий,V7.2.3,"Убедитесь, что ссылочные токены являются уникальными, создаются с использованием криптографически безопасного генератора псевдослучайных чисел (CSPRNG) и обладают энтропией не менее 128 бит.",✓,✓,✓,, +V7,Управление сессиями,V7.2,Базовая безопасность сессий,V7.2.4,"Убедитесь, что при аутентификации пользователя (включая повторную) создается новый токен сессии, а текущий — аннулируется.",✓,✓,✓,, +V7,Управление сессиями,V7.3,Тайм-ауты сессии,V7.3.1,"Убедитесь, что есть тайм-аут бездействия, после которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.",,✓,✓,, +V7,Управление сессиями,V7.3,Тайм-ауты сессии,V7.3.2,"Убедитесь, что установлено абсолютное максимальное время жизни сессии, по истечении которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.",,✓,✓,, +V7,Управление сессиями,V7.4,Завершение сессий,V7.4.1,"Убедитесь, что после завершения сессии (logout, истечение срока) дальнейшее её использование невозможно. Для ссылочных токенов или сессий с сохранением состояния это означает аннулирование на сервере. Для self-contained токенов необходимо реализовать механизм отзыва, например, список отозванных токенов, проверку времени выпуска или ротацию ключей подписи для каждого пользователя.",✓,✓,✓,, +V7,Управление сессиями,V7.4,Завершение сессий,V7.4.2,"Убедитесь, что при удалении или отключении пользователя все активные сессии немедленно завершаются.",✓,✓,✓,, +V7,Управление сессиями,V7.4,Завершение сессий,V7.4.3,"Убедитесь, что после изменения или удаления факторов аутентификации (например, смена пароля или MFA) приложение предлагает завершить все другие активные сессии.",,✓,✓,, +V7,Управление сессиями,V7.4,Завершение сессий,V7.4.4,"Убедитесь, что на всех страницах, требующих аутентификации, имеется простой и видимый способ выхода.",,✓,✓,, +V7,Управление сессиями,V7.4,Завершение сессий,V7.4.5,"Убедитесь, что администраторы могут завершать активные сессии конкретного пользователя или всех пользователей.",,✓,✓,, +V7,Управление сессиями,V7.5,Защита от злоупотреблений сессией,V7.5.1,"Убедитесь, что приложение требует полной повторной аутентификации перед изменением чувствительных атрибутов аккаунта, которые могут влиять на аутентификацию (например, email, номер телефона, настройки MFA или данных восстановления доступа).",,✓,✓,, +V7,Управление сессиями,V7.5,Защита от злоупотреблений сессией,V7.5.2,"Убедитесь, что пользователь может просматривать и (после повторной аутентификации хотя бы по одному фактору) завершать активные сессии.",,✓,✓,, +V7,Управление сессиями,V7.5,Защита от злоупотреблений сессией,V7.5.3,"Убедитесь, что перед выполнением критически важных операций приложение требует повторной аутентификации (по крайней мере, одного фактора) или дополнительной проверки.",,,✓,, +V7,Управление сессиями,V7.6,Федеративная повторная аутентификация,V7.6.1,"Убедитесь, что срок действия и завершение сессий между RP и IdP соответствуют документации и включают повторную аутентификацию, если достигнут максимальный допустимый интервал между событиями аутентификации.",,✓,✓,, +V7,Управление сессиями,V7.6,Федеративная повторная аутентификация,V7.6.2,"Убедитесь, что создание сессии требует согласия пользователя или явного действия, предотвращающего несанкционированное создание сессий без участия пользователя.",,✓,✓,, +V8,Авторизация,V8.1,Документация по авторизации,V8.1.1,"Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне функций и на уровне данных на основе прав субъекта и атрибутов ресурса.",✓,✓,✓,, +V8,Авторизация,V8.1,Документация по авторизации,V8.1.2,"Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне полей (как на чтение, так и на запись) на основе прав субъекта и атрибутов ресурса. Эти правила могут зависеть от других атрибутов объекта данных, например, статуса.",,✓,✓,, +V8,Авторизация,V8.1,Документация по авторизации,V8.1.3,"Убедитесь, что документация определяет, какие атрибуты окружения и контекста (например, время суток, IP-адрес, местоположение, устройство) используются приложением для принятия решений в области аутентификации и авторизации.",,,✓,, +V8,Авторизация,V8.1,Документация по авторизации,V8.1.4,"Убедитесь, что документация по аутентификации и авторизации определяет, как используются факторы окружения и контекста в принятии решений, наряду с правилами доступа к функциям, данным и полям. Документация должна содержать оцениваемые атрибуты, пороговые значения риска, действия (разрешить, отказать, повысить уровень аутентификации и др.).",,,✓,, +V8,Авторизация,V8.2,Архитектура авторизации,V8.2.1,"Убедитесь, что приложение обеспечивает доступ на уровне функций (function-level) только субъектам с явными разрешениями.",✓,✓,✓,, +V8,Авторизация,V8.2,Архитектура авторизации,V8.2.2,"Убедитесь, что приложение обеспечивает доступ на уровне данных (data-specific) только тем субъектам, которым явно предоставлены права к определённым элементам данных, чтобы предотвратить IDOR (Insecure Direct Object Reference) и BOLA-уязвимости (Broken Object Level Authorization).",✓,✓,✓,, +V8,Авторизация,V8.2,Архитектура авторизации,V8.2.3,"Убедитесь, что приложение обеспечивает доступ на уровне полей (field-level) только тем субъектам, которым явно предоставлены права к определённым полям, чтобы предотвратить BOPLA (Broken Object Property Level Authorization).",,✓,✓,, +V8,Авторизация,V8.2,Архитектура авторизации,V8.2.4,"Убедитесь, что реализованы адаптивные меры безопасности, основанные на атрибутах окружения и контекста субъекта (время, местоположение, IP, устройство), которые используются для принятия решений об аутентификации и авторизации, как это определено в документации приложения. Эти меры должны применяться как при попытке субъекта начать новую сессию, так и во время существующей сессии.",,,✓,, +V8,Авторизация,V8.3,Авторизация на уровне операций,V8.3.1,"Убедитесь, что правила авторизации реализуются на доверенном сервисном уровне и не зависят от элементов, которые может контролировать клиент (например, JavaScript на стороне клиента).",✓,✓,✓,, +V8,Авторизация,V8.3,Авторизация на уровне операций,V8.3.2,"Убедитесь, что изменения значений, влияющих на авторизацию, применяются немедленно. Если это невозможно (например, при использовании автономных токенов), должны быть реализованы компенсирующие меры: оповещения о попытке несанкционированного действия и откат изменений. Обратите внимание, что данный подход не предотвращает утечку информации.",,,✓,, +V8,Авторизация,V8.3,Авторизация на уровне операций,V8.3.3,"Убедитесь, что доступ к объекту осуществляется на основе прав субъекта, инициировавшего запрос, а не прав промежуточного сервиса, действующего от его имени. Например, если пользователь обращается к веб-сервису с автономным токеном для аутентификации, а сервис затем запрашивает данные у другого сервиса, второй сервис должен использовать токен пользователя, а не токен первого сервиса для принятия решения о доступе.",,,✓,, +V8,Авторизация,V8.4,Прочие аспекты авторизации,V8.4.1,"Убедитесь, что в мультитенантных приложениях реализованы механизмы, предотвращающие действия потребителя в отношении арендаторов, к которым у него нет доступа.",,✓,✓,, +V8,Авторизация,V8.4,Прочие аспекты авторизации,V8.4.2,"Убедитесь, что доступ к административным интерфейсам защищён несколькими уровнями контроля, включая непрерывную проверку личности, контроль защищённости устройства и анализ контекстных рисков. Недостаточно опираться только на IP-адрес или доверенные устройства.",,,✓,, +V9,Автономные токены,V9.1,Источник токена и его целостность,V9.1.1,"Убедитесь, что автономные токены проверяются на целостность с помощью цифровой подписи или MAC, прежде чем доверять их содержимому.",✓,✓,✓,, +V9,Автономные токены,V9.1,Источник токена и его целостность,V9.1.2,"Проверяйте, что автономные токены создаются и проверяются исключительно с помощью алгоритмов из списка допустимых в данном контексте. Список допустимых алгоритмов должен включать только разрешенные алгоритмы (желательно либо только симметричные, либо только асимметричные) и ни в коем случае не содержать алгоритм None. Если необходимо поддерживать оба типа алгоритмов, потребуются дополнительные средства контроля для предотвращения путаницы с ключами (key confusion).",✓,✓,✓,, +V9,Автономные токены,V9.1,Источник токена и его целостность,V9.1.3,"Убедитесь, что ключи, используемые для проверки автономных токенов, получены из доверенных, предварительно настроенных источников. Это предотвращает возможность указания злоумышленниками ненадёжных источников и ключей. Для JWT и других JWS структур заголовки 'jku', 'x5u' и 'jwk' должны проверяться по белому списку.",✓,✓,✓,, +V9,Автономные токены,V9.2,Содержимое токена,V9.2.1,"Убедитесь, что при указанном сроке действия токен и его содержимое принимаются только в том случае, если срок действия токена не истёк. Например, для JWT нужно проверить поля 'nbf' и 'exp'.",✓,✓,✓,, +V9,Автономные токены,V9.2,Содержимое токена,V9.2.2,"Убедитесь, что сервис, принимающий токен, проверяет его тип и соответствие назначению перед обработкой содержимого токена. Например, для принятия решений об авторизации могут быть приняты только Access Token, а для подтверждения аутентификации пользователя — только ID Token.",,✓,✓,, +V9,Автономные токены,V9.2,Содержимое токена,V9.2.3,"Убедитесь, что сервис принимает только токены, предназначенные для использования с этим сервисом (audience). Для JWT это можно сделать, проверив наличие утверждения «aud» по белому списку, определенному в сервисе.",,✓,✓,, +V9,Автономные токены,V9.2,Содержимое токена,V9.2.4,"Убедитесь, что, если эмитент токенов использует один и тот же закрытый ключ для выпуска токенов различным сервисам (audiences), выпущенные токены содержат явное указание целевых сервисов. Это предотвратит повторное использования токенов в не предназначенных для них сервисах. Если идентификатор сервиса (audience identifier) назначается динамически, эмитент токенов должен проверить audiences для исключения подмены получателей (audience impersonation).",,✓,✓,, +V10,OAuth и OIDC,V10.1,Общие требования безопасности OAuth и OIDC,V10.1.1,"Убедитесь, что токены передаются только тем компонентам, которым они действительно необходимы. Например, при использовании схемы backend-for-frontend для браузерных JavaScript-приложений, access и refresh токены должны быть доступны только на backend.",,✓,✓,, +V10,OAuth и OIDC,V10.1,Общие требования безопасности OAuth и OIDC,V10.1.2,"Убедитесь, что клиент принимает значения от авторизационного сервера (например, authorization code или ID Token) только если они получены в результате авторизационного потока, инициированного в той же сессии пользовательского агента и в рамках той же транзакции. Для этого клиентские секреты, такие как proof key для code exchange (PKCE) — 'code_verifier', 'state' или OIDC 'nonce' — должны быть непредсказуемыми, специфичными для транзакции и надежно привязанными как к клиенту, так и к сессии пользовательского агента, в которой началась транзакция.",,✓,✓,, +V10,OAuth и OIDC,V10.2,Клиент OAuth,V10.2.1,"Убедитесь, что если используется механизм authorization code flow, OAuth клиент защищён от CSRF, вызывающих запросы токенов либо за счёт использования механизма proof key for code exchange (PKCE), либо за счёт проверки параметра 'state', который был отправлен в запросе авторизации.",,✓,✓,, +V10,OAuth и OIDC,V10.2,Клиент OAuth,V10.2.2,"Убедитесь, что если OAuth клиент может взаимодействовать с более чем одним сервером авторизации, у него есть защита от атак смешивания (mix-up attacks). Например, клиент должен требовать, чтобы сервер авторизации возвращал параметр 'iss' и проверять его в ответах на авторизацию и токены.",,✓,✓,, +V10,OAuth и OIDC,V10.2,Клиент OAuth,V10.2.3,"Убедитесь, что OAuth клиент запрашивает только необходимые области доступа (scopes) или другие параметры авторизации в запросах к серверу авторизации.",,,✓,, +V10,OAuth и OIDC,V10.3,Сервер ресурсов OAuth,V10.3.1,"Убедитесь, что сервер ресурсов принимает только те access токены, которые предназначены для использования с этим сервисом (свойство audience). Эта принадлежность сервису может быть включена в структурированный access токен (например, в поле 'aud' в JWT) или проверяться через endpoint интроспекции токена.",,✓,✓,, +V10,OAuth и OIDC,V10.3,Сервер ресурсов OAuth,V10.3.2,"Убедитесь, что сервер ресурсов принимает решения по авторизации на основе claims из access токена, определяющих делегированную авторизацию. Если присутствуют claims, такие как 'sub', 'scope' и 'authorization_details', они должны участвовать в принятии решения.",,✓,✓,, +V10,OAuth и OIDC,V10.3,Сервер ресурсов OAuth,V10.3.3,"Убедитесь, что если для принятия решения по контролю доступа необходимо однозначно идентифицировать пользователя из access токена (JWT или ответа интроспекции), сервер ресурсов использует claims, которые не могут быть переприсвоены другим пользователям. Обычно это комбинация claims 'iss' и 'sub'.",,✓,✓,, +V10,OAuth и OIDC,V10.3,Сервер ресурсов OAuth,V10.3.4,"Убедитесь, что если сервер ресурсов требует определённой силы аутентификации, методов или свежести аутентификации, он проверяет, что предъявленный access токен удовлетворяет этим требованиям. Например, при наличии, могут использоваться claims OIDC 'acr', 'amr' и 'auth_time'.",,✓,✓,, +V10,OAuth и OIDC,V10.3,Сервер ресурсов OAuth,V10.3.5,"Убедитесь, что сервер ресурсов предотвращает использование украденных access токенов или их повторное использование (replay) неавторизованными лицами, требуя access токены с подтверждением отправителя — например, Mutual TLS для OAuth 2 или OAuth 2 Demonstration of Proof of Possession (DPoP).",,,✓,, +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.1,"Убедитесь, что сервер авторизации проверяет URI перенаправления (redirect URI), сверяя его с заранее зарегистрированным списком разрешённых URI для данного клиента (allowlist), используя точное сравнение строк.",✓,✓,✓,, +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.2,"Убедитесь, что если сервер авторизации возвращает authorization code в ответе авторизации, этот код может быть использован только один раз для запроса токена. При втором валидном запросе с уже использованным кодом сервер должен отклонить запрос и отозвать любые токены, связанные с этим кодом.",✓,✓,✓,, +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.3,"Убедитесь, что authorization code имеет короткое время жизни. Максимальная продолжительность — до 10 минут для приложений L1 и L2 и до 1 минуты для приложений L3.",✓,✓,✓,, +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.4,"Убедитесь, что сервер авторизации для конкретного клиента разрешает использование только тех типов авторизации, которые необходимы этому клиенту. Обратите внимание, что тип авторизации Implicit flow и Resource Owner Password Credentials flow больше не должны использоваться.",✓,✓,✓,, +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.5,"Убедитесь, что сервер авторизации предотвращает атаки повторного использования refresh токенов для публичных клиентов, предпочтительно используя sender-constrained refresh токены, такие как DPoP или сертификат-связанные токены с mutual TLS (mTLS). Для L1 и L2 допускается ротация refresh токенов с обязательной их инвалидацией после использования. Если используется ротация, сервер должен отозвать все refresh токены при попытке использовать уже инвалидированный токен.",✓,✓,✓,, +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.6,"Убедитесь, что при использовании типа авторизации «Authorization Code» сервер предотвращает атаки перехвата authorization code, требуя Proof Key for Code Exchange (PKCE). В запросах авторизации сервер должен требовать валидное значение 'code_challenge' и не принимать 'code_challenge_method' со значением 'plain'. В запросах токена обязательно валидировать параметр 'code_verifier'.",,✓,✓,, +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.7,"Убедитесь, что если сервер авторизации поддерживает динамическую регистрацию клиентов без аутентификации, он минимизирует риски вредоносных клиентов. Сервер должен валидировать метаданные клиента (например, зарегистрированные URI), обеспечивать согласие пользователя и предупреждать пользователя перед обработкой запроса авторизации от недоверенного клиента.",,✓,✓,, +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.8,"Убедитесь, что refresh токены имеют абсолютный срок действия, включая случаи, когда применяется скользящее время истечения срока.",,✓,✓,, +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.9,"Убедитесь, что пользователи могут отзывать refresh токены и reference access токены через пользовательский интерфейс сервера авторизации для снижения риска от вредоносных клиентов или кражи токенов.",,✓,✓,, +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.10,"Убедитесь, что конфиденциальный клиент аутентифицируется при взаимодействии с сервером авторизации через backchannel, например при запросах токена, pushed authorization requests (PAR) и запросах на отзыв токенов.",,✓,✓,, +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.11,"Убедитесь, что конфигурация сервера авторизации назначает OAuth клиенту только необходимые области доступа (scopes).",,✓,✓,, +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.12,"Убедитесь, что для конкретного клиента сервер авторизации разрешает только те значения 'response_mode', которые необходимы этому клиенту. Например, сервер должен валидировать это значение против ожидаемых или использовать pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).",,,✓,, +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.13,"Убедитесь, что грант типа 'code' всегда используется вместе с pushed authorization requests (PAR).",,,✓,, +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.14,"Убедитесь, что сервер авторизации выдаёт только sender-constrained (Proof-of-Possession) access токены, либо с сертификат-связанными токенами через mutual TLS (mTLS), либо DPoP-bound токены (Demonstration of Proof of Possession).",,,✓,, +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.15,"Убедитесь, что для серверного клиента (не выполняющегося на устройстве конечного пользователя) сервер авторизации проверяет, что значение параметра 'authorization_details' исходит из клиентского backend и что пользователь не изменял его. Например, это достигается использованием pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).",,,✓,, +V10,OAuth и OIDC,V10.4,Сервер авторизации OAuth,V10.4.16,"Убедитесь, что клиент является конфиденциальным и сервер авторизации требует использования сильных методов аутентификации клиента (основанных на криптографии с открытым ключом и устойчивых к атакам повторного воспроизведения), таких как mutual TLS ('tls_client_auth', 'self_signed_tls_client_auth') или private key JWT ('private_key_jwt').",,,✓,, +V10,OAuth и OIDC,V10.5,Клиент OIDC,V10.5.1,"Убедитесь, что клиент (relying party) защищается от повторного использования ID Token (replay-атак). Например, это достигается проверкой того, что значение 'nonce' в ID Token совпадает со значением 'nonce', отправленным в запросе аутентификации провайдеру OpenID (authorization server).",,✓,✓,, +V10,OAuth и OIDC,V10.5,Клиент OIDC,V10.5.2,"Убедитесь, что клиент однозначно идентифицирует пользователя по утверждениям (claims) ID Token, обычно это 'sub', который не может быть переназначен другому пользователю (в пределах конкретного провайдера идентификации).",,✓,✓,, +V10,OAuth и OIDC,V10.5,Клиент OIDC,V10.5.3,"Убедитесь, что клиент отклоняет попытки злоумышленного сервера авторизации выдавать себя за другой сервер авторизации через метаданные сервера авторизации. Клиент должен отклонить метаданные, если URL издателя (issuer) в метаданных не совпадает точно с преднастроенным URL издателя, ожидаемым клиентом.",,✓,✓,, +V10,OAuth и OIDC,V10.5,Клиент OIDC,V10.5.4,"Убедитесь, что клиент проверяет, что ID Token предназначен для него (проверка audience), сравнивая значение 'aud' в токене с 'client_id' клиента.",,✓,✓,, +V10,OAuth и OIDC,V10.5,Клиент OIDC,V10.5.5,"Убедитесь, что при использовании OIDC back-channel logout клиент снижает риск отказа в обслуживании, вызванный принудительным выходом из системы и путаницей между разными типами JWT (cross-JWT confusion) в процессе логаута. Клиент должен проверить, что токен выхода корректно типизирован со значением 'logout+jwt', содержит claim 'event' с правильным именем участника и не содержит 'nonce'. Также рекомендуется установить короткий срок действия токена (например, 2 минуты).",,✓,✓,, +V10,OAuth и OIDC,V10.6,Провайдер OpenID,V10.6.1,"Убедитесь, что провайдер OpenID допускает только значения 'code', 'ciba', 'id_token' или 'id_token code' для параметра response mode. При этом предпочтение отдаётся 'code' по сравнению с 'id_token code' (гибридный поток OIDC), а значение 'token' (любой Implicit flow) не должно использоваться.",,✓,✓,, +V10,OAuth и OIDC,V10.6,Провайдер OpenID,V10.6.2,"Убедитесь, что провайдер OpenID предотвращает отказ в обслуживании (DoS) через принудительный выход (logout), запрашивая явное подтверждение от конечного пользователя или, если применимо, проверяя параметры в запросе выхода (инициированном relying party), например параметр 'id_token_hint'.",,✓,✓,, +V10,OAuth и OIDC,V10.7,Управление согласием,V10.7.1,"Убедитесь, что авторизационный сервер обеспечивает получение согласия пользователя для каждого запроса авторизации. Если личность клиента не может быть подтверждена, сервер авторизации всегда должен явно запрашивать согласие пользователя.",,✓,✓,, +V10,OAuth и OIDC,V10.7,Управление согласием,V10.7.2,"Убедитесь, что при запросе согласия пользователя авторизационный сервер предоставляет достаточную и понятную информацию о том, на что даётся согласие. При необходимости это должно включать характер запрашиваемых разрешений (обычно основанных на scope, ресурсном сервере, деталях авторизации Rich Authorization Requests (RAR)), идентификацию авторизованного приложения и срок действия этих разрешений.",,✓,✓,, +V10,OAuth и OIDC,V10.7,Управление согласием,V10.7.3,"Убедитесь, что пользователь может просматривать, изменять и отзывать согласия, которые он предоставил, через авторизационный сервер.",,✓,✓,, +V11,Криптография,V11.1,Инвентаризация и документирование криптографии,V11.1.1,"Убедитесь, что задокументирована политика управления криптографическими ключами и описан их жизненный цикл в соответствии со стандартом управления ключей, таким как NIST SP 800-57. Убедитесь, что ключи известны только тем сущностям, которым они должны быть доступны (например, ключи не передавались более чем двум участникам для общих секретов и более чем одному участнику для приватных ключей).",,✓,✓,, +V11,Криптография,V11.1,Инвентаризация и документирование криптографии,V11.1.2,"Убедитесь, что проводится инвентаризация криптографических средств, которая непрерывно поддерживается, регулярно обновляется и включает все криптографические ключи, алгоритмы и сертификаты, используемые в приложении. Также должна быть задокументирована информация о том, где ключи могут и не могут использоваться в системе, а также какие типы данных могут и не могут быть защищены с помощью этих ключей.",,✓,✓,, +V11,Криптография,V11.1,Инвентаризация и документирование криптографии,V11.1.3,"Убедитесь, что используются механизмы обнаружения криптографии для идентификации всех случаев применения криптографии в системе , включая операции шифрования, хеширования и цифровой подписи.",,,✓,, +V11,Криптография,V11.1,Инвентаризация и документирование криптографии,V11.1.4,"Убедитесь, что ведётся и поддерживается инвентаризация криптографических средств. В неё должен входить документированный план, описывающий переход на новые криптографические стандарты, такие как постквантовая криптография, чтобы своевременно реагировать на будущие угрозы.",,,✓,, +V11,Криптография,V11.2,Безопасная реализация криптографии,V11.2.1,"Убедитесь, что для криптографических операций используются утвержденные в индустрии реализации (включая библиотеки и аппаратные реализации).",,✓,✓,, +V11,Криптография,V11.2,Безопасная реализация криптографии,V11.2.2,"Убедитесь, что архитектура приложения поддерживает быструю реконфигурацию, усовершенствование или смену в любой момент случайных чисел, аутентифицированного шифрования, MAC, алгоритмов хеширования, длин ключей, количества раундов, шифров и режимов шифрования для защиты от криптографических атак. Также должна поддерживаться возможность смены ключей, паролей и повторного шифрования данных. Это позволит беспрепятственно перейти на постквантовую криптографию (PQC), как только станут широко доступны высоконадёжные реализации одобренных схем или стандартов PQC.",,✓,✓,, +V11,Криптография,V11.2,Безопасная реализация криптографии,V11.2.3,"Убедитесь, что все криптографические примитивы используют как минимум 128-бит стойкости с учетом алгоритма, размера ключа и конфигурации. Например, 256-битный ECC ключ обеспечивает примерно 128 бит безопасности, тогда как для достижения того же уровня безопасности в RSA требуется ключ длиной 3072 бита.",,✓,✓,, +V11,Криптография,V11.2,Безопасная реализация криптографии,V11.2.4,"Убедитесь, что все криптографические операции выполняются за константное время, без использования «short-circuit» операций в сравнениях, вычислениях, возвратах функций для избежания утечек информации.",,,✓,, +V11,Криптография,V11.2,Безопасная реализация криптографии,V11.2.5,"Убедитесь, что все криптографические модули обеспечивают безопасное завершение работы при ошибках, а обработка ошибок реализована таким образом, чтобы не создавать уязвимостей, например, таких как атаки Padding Oracle.",,,✓,, +V11,Криптография,V11.3,Алгоритмы шифрования,V11.3.1,"Убедитесь, что не используются небезопасные режимы блочного шифрования (н-р, ECB) и слабые схемы дополнения (padding) (н-р, PKCS#1 v1.5).",✓,✓,✓,, +V11,Криптография,V11.3,Алгоритмы шифрования,V11.3.2,"Убедитесь, что используются только утверждённые шифры и режимы, такие как AES с GCM.",✓,✓,✓,, +V11,Криптография,V11.3,Алгоритмы шифрования,V11.3.3,"Убедитесь, что зашифрованные данные защищены от несанкционированного изменения, предпочтительно с использованием утверждённого метода аутентифицированного шифрования или путём комбинирования утверждённого метода шифрования с утверждённым алгоритмом MAC.",,✓,✓,, +V11,Криптография,V11.3,Алгоритмы шифрования,V11.3.4,"Убедитесь, что случайные числа (nonce), векторы инициализации (IV) и другие одноразовые числа не используются более одного раза для одной и той же пары ключа шифрования и элемента данных. Метод их генерации должен соответствовать требованиям используемого алгоритма.",,,✓,, +V11,Криптография,V11.3,Алгоритмы шифрования,V11.3.5,"Убедитесь, что любая комбинация алгоритма шифрования и алгоритма MAC работает в режиме encrypt-then-MAC (EtM).",,,✓,, +V11,Криптография,V11.4,Хеширование и функции на основе хеширования,V11.4.1,"Убедитесь, что только утвержденные хэш-функции используются для стандартных сценариев использования в криптографии, включая цифровую подпись, HMAC, KDF, генерацию случайных чисел. Запрещено использовать неустойчивые хэш-функции, (н-р, MD5) для любого использования в криптографии.",✓,✓,✓,, +V11,Криптография,V11.4,Хеширование и функции на основе хеширования,V11.4.2,"Убедитесь, что пароли хранятся с использованием утверждённой, вычислительно затратной функции генерации ключа (также известной как «функция хеширования паролей»), с параметрами, настроенными в соответствии с актуальными рекомендациями. Настройки должны обеспечивать баланс между безопасностью и производительностью, чтобы сделать атаки перебором достаточно сложными для требуемого уровня безопасности.",,✓,✓,, +V11,Криптография,V11.4,Хеширование и функции на основе хеширования,V11.4.3,"Убедитесь, что хэш-функции, используемые в формировании цифровой подписи, как часть аутентификации и целостности данных, устойчивы к коллизиям и имеют достаточную длину.",,✓,✓,, +V11,Криптография,V11.4,Хеширование и функции на основе хеширования,V11.4.4,"Убедитесь, что приложение использует утвержденную функцию генерации ключа с использованием параметров расширения ключа (key stretching) при генерации ключа из пароля. Параметры должны быть сбалансированы с точки зрения безопасности, производительности и устойчивости к атакам полного перебора при компрометации результирующего криптографического ключа.",,✓,✓,, +V11,Криптография,V11.5,Случайные значения,V11.5.1,"Убедитесь, что все случайные числа и строки, которые должны быть непредсказуемы, должны быть сгенерированы с помощью CSPRNG и иметь хотя бы 128 бит энтропии. Учтите, что UUID не удовлетворяют данному условию.",,✓,✓,, +V11,Криптография,V11.5,Случайные значения,V11.5.2,"Убедитесь, что механизм генерации случайных чисел является надежным даже при высокой нагрузке.",,,✓,, +V11,Криптография,V11.6,Криптография с публичным ключом,V11.6.1,"Убедитесь, что только утвержденные криптографические алгоритмы и режимы операций используются для генерации ключа и инициализации случайного значения для его генерации (seeding), а также для генерации цифровой подписи и верификации. Алгоритмы генерации ключей не должны генерировать небезопасные ключи уязвимые к известным атакам, например, ключи RSA уязвимы к факторизации Ферма.",,✓,✓,, +V11,Криптография,V11.6,Криптография с публичным ключом,V11.6.2,"Убедитесь, что для обмена ключами используются утверждённые криптографические алгоритмы (например, Диффи-Хеллман) с особым вниманием к обеспечению использования безопасных параметров. Это предотвратит атаки на процесс установления ключа, которые могут привести к атакам «человек посередине» или криптографическим взломам.",,,✓,, +V11,Криптография,V11.7,Шифрование данных в процессе использования,V11.7.1,"Убедитесь, что используется полное шифрование памяти, которое защищает конфиденциальные данные во время их использования, предотвращая доступ к ним неавторизованных пользователей или процессов.",,,✓,, +V11,Криптография,V11.7,Шифрование данных в процессе использования,V11.7.2,"Убедитесь, что минимизация данных обеспечивает раскрытие минимально необходимого объёма данных во время обработки, а также что данные шифруются сразу после использования или как можно скорее.",,,✓,, +V12,Безопасная коммуникация,V12.1,Общие рекомендации по безопасности TLS,V12.1.1,"Убедитесь, что включены только актуальные и рекомендуемые версии протокола TLS, такие как TLS 1.2 и TLS 1.3. Наиболее свежая версия TLS должна быть выбрана как предпочтительная.",✓,✓,✓,, +V12,Безопасная коммуникация,V12.1,Общие рекомендации по безопасности TLS,V12.1.2,"Убедитесь, что включены рекомендуемые шифронаборы (cipher suites), предпочтение также стоит отдать самому сильному шифронабору. L3 приложения должны поддерживать только те наборы шифров (cipher suites), которые обеспечивают прямую (forward) секретность. Пояснение: Прямая секретность (Forward Secrecy, FS) — это криптографическая особенность, при которой сессионные ключи уникальны для каждой сессии и не зависят от долгосрочных ключей. Это гарантирует, что даже при компрометации долгосрочного ключа злоумышленник не сможет расшифровать ранее перехваченные зашифрованные сессии.",,✓,✓,, +V12,Безопасная коммуникация,V12.1,Общие рекомендации по безопасности TLS,V12.1.3,"Убедитесь, что приложение проверяет доверенность клиентских сертификатов mTLS, прежде чем использовать идентификацию по сертификату для аутентификации или авторизации.",,✓,✓,, +V12,Безопасная коммуникация,V12.1,Общие рекомендации по безопасности TLS,V12.1.4,"Убедитесь, что включена и настроена правильная проверка отзыва сертификатов, такая как Online Certificate Status Protocol (OCSP) Stapling.",,,✓,, +V12,Безопасная коммуникация,V12.1,Общие рекомендации по безопасности TLS,V12.1.5,"Убедитесь, что в настройках TLS приложения включена функция Encrypted Client Hello (ECH) для предотвращения раскрытия конфиденциальных метаданных, таких как Server Name Indication (SNI), во время процесса TLS-рукопожатия.",,,✓,, +V12,Безопасная коммуникация,V12.2,HTTPS коммуникация с внешними сервисами,V12.2.1,"Убедитесь, что для всех соединений между клиентом и внешними HTTP-сервисами используется TLS и не происходит отката к небезопасным или незашифрованным протоколам.",✓,✓,✓,, +V12,Безопасная коммуникация,V12.2,HTTPS коммуникация с внешними сервисами,V12.2.2,"Убедитесь, что внешние сервисы используют публично доверенные TLS-сертификаты.",✓,✓,✓,, +V12,Безопасная коммуникация,V12.3,Общая безопасность межсервисного взаимодействия,V12.3.1,"Убедитесь, что для всех входящих и исходящих соединений приложения используется зашифрованный протокол, например TLS, включая системы мониторинга, инструменты управления, удалённый доступ и SSH, промежуточное ПО, базы данных, мейнфреймы, партнёрские системы и внешние API. Сервер не должен допускать откат к небезопасным или незашифрованным протоколам.",,✓,✓,, +V12,Безопасная коммуникация,V12.3,Общая безопасность межсервисного взаимодействия,V12.3.2,"Убедитесь, что TLS-клиент проверяет сертификат сервера до установления защищенного соединения с TLS-сервером.",,✓,✓,, +V12,Безопасная коммуникация,V12.3,Общая безопасность межсервисного взаимодействия,V12.3.3,"Убедитесь, что все внутренние HTTP-взаимодействия между компонентами приложения используют TLS или другой подходящий механизм транспортного шифрования, и не происходит откат к небезопасным или незашифрованным коммуникациям.",,✓,✓,, +V12,Безопасная коммуникация,V12.3,Общая безопасность межсервисного взаимодействия,V12.3.4,"Убедитесь, что TLS-соединения между внутренними сервисами используют доверенные сертификаты. Если используются внутренние или самоподписанные сертификаты, потребляющий сервис должен быть настроен на доверие только к конкретным внутренним центрам сертификации (CA) и конкретным самоподписанным сертификатам.",,✓,✓,, +V12,Безопасная коммуникация,V12.3,Общая безопасность межсервисного взаимодействия,V12.3.5,"Убедитесь, что сервисы, взаимодействующие внутри системы (intra-service communications), используют строгую аутентификацию для проверки каждого конечного узла. Для проверки подлинности взаимодействующих сторон должны применяться методы строгой аутентификации, такие как аутентификация TLS-клиента, с использованием инфраструктуры открытых ключей и механизмов, устойчивых к атакам повтора (replay attacks). Для микросервисных архитектур рекомендуется использование service mesh для упрощения управления сертификатами и повышения безопасности.",,,✓,, +V13,Конфигурация,V13.1,Документация конфигурации,V13.1.1,"Убедитесь, что все необходимые доступы приложения задокументированы. Сюда должны быть включены как внешние сервисы, от которых зависит приложение, так и сценарии, когда конечный пользователь может задавать адреса для внешнего подключения.",,✓,✓,, +V13,Конфигурация,V13.1,Документация конфигурации,V13.1.2,"Убедитесь, что для каждого сервиса, используемого приложением, в документации определено максимальное количество одновременных соединений (например, лимиты пула соединений) и описано поведение приложения при достижении этого лимита, включая любые механизмы отказоустойчивости или восстановления, чтобы предотвратить ситуации отказа в обслуживании (DoS).",,,✓,, +V13,Конфигурация,V13.1,Документация конфигурации,V13.1.3,"Убедитесь, что в документации приложения определены стратегии управления ресурсами для каждой внешней системы или сервиса, которые оно использует (например, базы данных, файловые дескрипторы, потоки, HTTP-соединения). Стратегии должны включать процедуры освобождения ресурсов, настройки таймаутов, обработку сбоев, а также, если реализована логика повторных попыток, указание лимитов, задержек и алгоритмов back-off. Для синхронных HTTP-запросов должны быть заданы короткие таймауты, а повторные запросы должны быть отключены, либо строго ограничены по числу попыток, чтобы предотвратить каскадные задержки и истощение ресурсов.",,,✓,, +V13,Конфигурация,V13.1,Документация конфигурации,V13.1.4,"Убедитесь, что в документации приложения определены секреты, критически важные для безопасности приложения, а также установлен график их ротации в соответствии с моделью угроз организации и её бизнес-требованиями.",,,✓,, +V13,Конфигурация,V13.2,Конфигурация бэкенд соединений,V13.2.1,"Убедитесь, что коммуникации между компонентами бэкенда приложения (включая API, промежуточное ПО и уровни данных), которые не поддерживают стандартный механизм пользовательских сессий, проходят с аутентификацией. Аутентификация должна использовать индивидуальные сервисные аккаунты, краткосрочные токены или аутентификацию на основе сертификатов, а не постоянные учётные данные, такие как пароли, API-ключи или общие аккаунты с привилегированным доступом.",,✓,✓,, +V13,Конфигурация,V13.2,Конфигурация бэкенд соединений,V13.2.2,"Убедитесь, что коммуникации между компонентами бэкенда приложения, включая локальные или системные службы, API, промежуточное ПО и уровни данных, выполняются с использованием аккаунтов, которым назначены минимально необходимые привилегии.",,✓,✓,, +V13,Конфигурация,V13.2,Конфигурация бэкенд соединений,V13.2.3,"Убедитесь, что если для аутентификации в сервисе используются учётные данные, то используемые потребителем учётные данные не являются стандартными (например, root/root или admin/admin).",,✓,✓,, +V13,Конфигурация,V13.2,Конфигурация бэкенд соединений,V13.2.4,"Убедитесь, что используется белый список (allowlist) для определения внешних ресурсов или систем, с которыми приложению разрешено взаимодействовать (например, для исходящих запросов, загрузки данных или доступа к файлам). Этот белый список может быть реализован на уровне приложения, веб-сервера, межсетевого экрана или комбинации различных уровней.",,✓,✓,, +V13,Конфигурация,V13.2,Конфигурация бэкенд соединений,V13.2.5,"Убедитесь, что веб- или прикладной сервер настроен с белым списком ресурсов или систем, к которым сервер может отправлять запросы или из которых может загружать данные и файлы.",,✓,✓,, +V13,Конфигурация,V13.2,Конфигурация бэкенд соединений,V13.2.6,"Убедитесь, что при подключении приложения к другим сервисам соблюдается задокументированная конфигурация для каждого соединения, включая максимальное количество параллельных соединений, поведение при достижении их максимума, таймауты и стратегии повторных попыток подключения.",,,✓,, +V13,Конфигурация,V13.3,Управление секретами,V13.3.1,"Убедитесь, что для безопасного создания, хранения, контроля доступа и уничтожения секретов бэкенда используется решение для управления секретами, например, хранилище ключей (key vault). Секретами могут быть пароли, ключевой материал, интеграции с базами данных и сторонними системами, ключи и seed-значения для токенов с ограниченным временем действия, другие внутренние секреты и API-ключи. Секреты не должны включаться в исходный код приложения или артефакты сборки. Для приложений уровня L3 необходимо использовать аппаратное решение, например, аппаратный модуль безопасности (HSM).",,✓,✓,, +V13,Конфигурация,V13.3,Управление секретами,V13.3.2,"Убедитесь, что доступ к секретным ресурсам осуществляется в соответствии с принципом минимально необходимых привилегий (least privilege).",,✓,✓,, +V13,Конфигурация,V13.3,Управление секретами,V13.3.3,"Убедитесь, что все криптографические операции выполняются с использованием изолированного модуля безопасности (например, хранилища ключей или аппаратного модуля безопасности), чтобы надежно управлять ключевым материалом и защищать его от утечки за пределы модуля безопасности.",,,✓,, +V13,Конфигурация,V13.3,Управление секретами,V13.3.4,"Убедитесь, что секреты настроены на срок действия и ротацию в соответствии с документацией приложения.",,,✓,, +V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.1,"Убедитесь, что приложение развернуто либо без метаданных систем контроля версий (включая папки .git или .svn), либо так, чтобы эти папки были недоступны как извне, так и для самого приложения.",✓,✓,✓,, +V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.2,"Убедитесь, что режимы отладки отключены для всех компонентов в промышленной среде, чтобы предотвратить раскрытие функций отладки и утечку информации.",,✓,✓,, +V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.3,"Убедитесь, что веб-серверы не показывают клиентам списки содержимого каталогов, если это явно не предусмотрено.",,✓,✓,, +V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.4,"Убедитесь, что метод HTTP TRACE не поддерживается в продуктовой среде, чтобы избежать потенциальной утечки информации.",,✓,✓,, +V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.5,"Убедитесь, что документация (например, по внутренним API) и мониторинговые эндпоинты не доступны, если это явно не предусмотрено.",,✓,✓,, +V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.6,"Убедитесь, что приложение не раскрывает подробную информацию о версиях компонентов бэкенда.",,,✓,, +V13,Конфигурация,V13.4,Непреднамеренная утечка информации,V13.4.7,"Убедитесь, что веб-слой настроен на обслуживание только файлов с определёнными расширениями, чтобы предотвратить непреднамеренную утечку информации, конфигураций и исходного кода.",,,✓,, +V14,Защита информации,V14.1,Документация по защите информации,V14.1.1,"Убедитесь, что все конфиденциальные данные, создаваемые и обрабатываемые приложением, идентифицированы и классифицированы по уровням защиты. Включая закодированные данные, которые легко декодируются, например, строки Base64 или незашифрованные данные в полезной нагрузке JWT. Уровни защиты должны учитывать требования по защите данных и конфиденциальности, которым должно соответствовать приложение.",,✓,✓,, +V14,Защита информации,V14.1,Документация по защите информации,V14.1.2,"Убедитесь, что для каждого уровня защиты конфиденциальных данных требования к защите задокументированы. Они должны включать (но не ограничиваться) требования по шифрованию, проверке целостности, срокам хранения, способам логирования данных, контролю доступа к чувствительным данным в логах, шифрованию на уровне базы данных, применению технологий повышения конфиденциальности, а также другим требованиям по конфиденциальности.",,✓,✓,, +V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.1,"Убедитесь, что конфиденциальные данные передаются на сервер только в теле HTTP-запроса или в заголовках. URL и строка запроса не должны содержать конфиденциальную информацию, такую как API-ключ или сессионный токен.",✓,✓,✓,, +V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.2,"Убедитесь, что приложение предотвращает кэширование конфиденциальных данных в серверных компонентах, таких как балансировщики нагрузки и кэши приложений, либо гарантирует их надежное удаление после использования.",,✓,✓,, +V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.3,"Убедитесь, что заранее определённые конфиденциальные данные не отправляются ненадёжным сторонам (например, системам трекинга пользователей), чтобы предотвратить нежелательный сбор данных вне контроля приложения.",,✓,✓,, +V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.4,"Убедитесь, что для конфиденциальных данных реализованы меры по шифрованию, проверке целостности, срокам хранения, способам логирования, контролю доступа к данным в логах, а также применяются технологии повышения конфиденциальности в соответствии с документацией для соответствующего уровня защиты данных.",,✓,✓,, +V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.5,"Убедитесь, что механизмы кэширования настроены так, чтобы кэшировать только ответы с ожидаемым типом содержимого для данного ресурса и не содержать конфиденциального динамического контента. При обращении к несуществующему файлу, веб-сервер должен возвращать ответ 404 или 302, а не подменять на другой существующий файл, что позволит предотвратить атаки типа Web Cache Deception.",,,✓,, +V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.6,"Убедитесь, что приложение возвращает только минимально необходимый объем конфиденциальных данных для выполнения своей функциональности. Например, показывает только часть цифр номера кредитной карты, а не полный номер. Если требуется отображение полных данных, они должны быть замаскированы в пользовательском интерфейсе, пока пользователь специально не запросил их просмотр.",,,✓,, +V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.7,"Убедитесь, что конфиденциальная информация подлежит классификации по срокам хранения, чтобы устаревшие или ненужные данные удалялись автоматически, по расписанию или по мере необходимости.",,,✓,, +V14,Защита информации,V14.2,Базовые меры по защите информации,V14.2.8,"Убедитесь, что конфиденциальная информация удаляется из метаданных файлов, загружаемых пользователями, если пользователь явно не согласился на ее хранение.",,,✓,, +V14,Защита информации,V14.3,Защита данных на стороне клиента,V14.3.1,"Убедитесь, что аутентифицированные данные очищаются из клиентского хранилища, например, из DOM браузера, после завершения работы клиента или сессии. Заголовок HTTP-ответа Clear-Site-Data может помочь в этом, но клиентская сторона также должна уметь очищать данные, если соединение с сервером недоступно при завершении сессии.",✓,✓,✓,, +V14,Защита информации,V14.3,Защита данных на стороне клиента,V14.3.2,"Убедитесь, что приложение устанавливает HTTP-заголовки, достаточные для предотвращения кэширования (например, Cache-Control: no-store), чтобы конфиденциальные данные не сохранялись в браузерах.",,✓,✓,, +V14,Защита информации,V14.3,Защита данных на стороне клиента,V14.3.3,"Убедитесь, что данные, хранящиеся в браузерном хранилище (например, localStorage, sessionStorage, IndexedDB или cookie), не содержат конфиденциальной информации, за исключением сессионных токенов.",,✓,✓,, +V15,Безопасная разработка и архитектура,V15.1,Документация по безопасной разработке и архитектуре,V15.1.1,"Убедитесь, что в документации по приложению определены сроки устранения уязвимостей на основе оценки рисков для внешних зависимостей с уязвимостями и для обновления библиотек в целом, чтобы минимизировать риск, связанный с этими компонентами.",✓,✓,✓,, +V15,Безопасная разработка и архитектура,V15.1,Документация по безопасной разработке и архитектуре,V15.1.2,"Убедитесь, что ведется реестр всех используемых сторонних библиотек (например, Software Bill of Materials, SBOM), с обязательной проверкой, что компоненты получены из предопределенных, доверенных и регулярно поддерживаемых репозиториев.",,✓,✓,, +V15,Безопасная разработка и архитектура,V15.1,Документация по безопасной разработке и архитектуре,V15.1.3,"Убедитесь, что в документации приложения указан функционал, требующий значительных временных или вычислительных ресурсов. Необходимо указать, как предотвратить потерю доступности из-за чрезмерного использования этого функционала и как избежать ситуаций, когда формирование ответа занимает больше времени, чем установленный системой таймаут. Возможные меры защиты могут включать асинхронную обработку, использование очередей и ограничение количества параллельных процессов для каждого пользователя и приложения.",,✓,✓,, +V15,Безопасная разработка и архитектура,V15.1,Документация по безопасной разработке и архитектуре,V15.1.4,"Убедитесь, что в документации приложения указаны внешние библиотеки, которые считаются «компонентами с повышенным риском».",,,✓,, +V15,Безопасная разработка и архитектура,V15.1,Документация по безопасной разработке и архитектуре,V15.1.5,"Убедитесь, что в документации приложения выделены те части приложения, в которых используются «функционал с повышенным риском».",,,✓,, +V15,Безопасная разработка и архитектура,V15.2,Архитектура безопасности и зависимости,V15.2.1,"Убедитесь, что приложение содержит только те компоненты, которые не нарушили задокументированные сроки обновления и исправления.",✓,✓,✓,, +V15,Безопасная разработка и архитектура,V15.2,Архитектура безопасности и зависимости,V15.2.2,"Убедитесь, что в приложении реализованы меры защиты от потери доступности из-за функциональности, требующей много времени или ресурсов, на основе задокументированных решений и стратегий безопасности для этого.",,✓,✓,, +V15,Безопасная разработка и архитектура,V15.2,Архитектура безопасности и зависимости,V15.2.3,"Убедитесь, что производственная среда включает только те функции, которые необходимы для работы приложения, и не предоставляет лишние функции, такие как тестовый код, примеры кода и инструменты разработки.",,✓,✓,, +V15,Безопасная разработка и архитектура,V15.2,Архитектура безопасности и зависимости,V15.2.4,"Убедитесь, что сторонние компоненты и все их транзитивные зависимости загружаются только из ожидаемых репозиториев (внутренних или внешних) и отсутствует риск атаки через подмену зависимостей (dependency confusion attack)",,,✓,, +V15,Безопасная разработка и архитектура,V15.2,Архитектура безопасности и зависимости,V15.2.5,"Убедитесь, что приложение реализует дополнительные меры защиты для тех частей приложения, которые документированы как содержащие «функционал с повышенным риском» или использующие сторонние библиотеки, считающиеся «функционалом с повышенным риском». Это могут быть такие методы, как «песочница», инкапсуляция, контейнеризация или изоляция на сетевом уровне, чтобы задержать и предотвратить продвижение (pivoting) злоумышленников, скомпрометировавших одну часть приложения, к другим частям приложения.",,,✓,, +V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.1,"Убедитесь, что приложение возвращает только необходимое подмножество полей из объекта данных. Например, оно не должно возвращать весь объект данных, поскольку некоторые отдельные поля должны быть недоступны пользователям.",✓,✓,✓,, +V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.2,"Убедитесь, что при вызовах внешних URL-адресов бэкэнд приложения настроен так, чтобы не выполнять перенаправления, если только это не предусмотрено функционалом.",,✓,✓,, +V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.3,"Убедитесь, что в приложении реализованы защитные механизмы против атак типа массового присвоения (mass assignment) путем строгого ограничения разрешенных полей для каждого контроллера и действия, исключая возможность добавления или изменения значений полей, которые не должны быть доступны для данной конкретной операции.",,✓,✓,, +V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.4,"Убедитесь, что все прокси и промежуточное ПО корректно передают исходный IP-адрес пользователя, используя доверенные поля данных, которые не могут быть изменены конечным пользователем, а приложение и веб-сервер используют это правильное значение для ведения логирования и принятия решений по безопасности, таких как ограничение запросов. При этом следует учитывать, что даже исходный IP-адрес может быть ненадежным из-за динамических IP-адресов, VPN или корпоративных файрволов.",,✓,✓,, +V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.5,"Убедитесь, что приложение явно проверяет соответствие переменных ожидаемому типу данных и использует строгие операции сравнения. Это необходимо для предотвращения уязвимостей, связанных с type juggling и type confusion, вызванных тем, что код приложения делает предположения о типе переменной.",,✓,✓,, +V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.6,"Убедитесь, что JavaScript-код написан таким образом, чтобы предотвратить prototype pollution, например, используя Set() или Map() вместо обычных литералов объекта.",,✓,✓,, +V15,Безопасная разработка и архитектура,V15.3,Безопасное программирование,V15.3.7,"Убедитесь, что приложение защищено от атак типа HTTP Parameter Pollution (HPP), особенно если используемый фреймворк не различает источники параметров запроса (строка запроса, тело запроса, куки или заголовки).",,✓,✓,, +V15,Безопасная разработка и архитектура,V15.4,Безопасная работа с параллельными процессами,V15.4.1,"Убедитесь, что к общим объектам в многопоточном коде (например, кэшам, файлам или объектам в памяти, используемым несколькими потоками) используется безопасный многопоточный доступ и механизмов синхронизации, таких как блокировки или семафоры, чтобы избежать состояний гонки и повреждения данных.",,,✓,, +V15,Безопасная разработка и архитектура,V15.4,Безопасная работа с параллельными процессами,V15.4.2,"Убедитесь, что проверки состояния ресурса, например его существования или разрешений, а также зависящие от него действия выполняются как одна атомарная операция, чтобы предотвратить условия гонки времени проверки и времени использования (TOCTOU). Например, проверка существования файла перед его открытием или проверка прав доступа пользователя перед его предоставлением.",,,✓,, +V15,Безопасная разработка и архитектура,V15.4,Безопасная работа с параллельными процессами,V15.4.3,"Убедитесь, что блокировки применяются согласованно, чтобы предотвратить взаимные блокировки потоков (deadlocks) или их бесконечные повторы, а также что логика блокировки инкапсулирована в коде, отвечающем за управление ресурсом. Это гарантирует, что блокировки не могут быть случайно или намеренно изменены внешними классами или кодом.",,,✓,, +V15,Безопасная разработка и архитектура,V15.4,Безопасная работа с параллельными процессами,V15.4.4,"Убедитесь, что политики распределения ресурсов предотвращают нехватку ресурсов у потоков, обеспечивая справедливый доступ к ресурсам, например, используя пулы потоков, позволяя потокам с более низким приоритетом выполняться в течение разумного периода времени.",,,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.1,Документация по ведению логов,V16.1.1,"Убедитесь в существовании реестра, в котором документируется ведение журнала на каждом уровне технологического стека приложения, включая какие события регистрируются, форматы логов, где хранятся эти журналы, как они используются, как контролируется доступ к ним и как долго хранятся журналы.",,✓,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.2,Общее журналирование,V16.2.1,"Убедитесь, что каждая запись журнала содержит необходимые метаданные (например, когда, где, кто, что), которые позволят провести подробное исследование временной шкалы, когда произошло событие.",,✓,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.2,Общее журналирование,V16.2.2,"Убедитесь, что все источники времени компонентов системы журналирования синхронизированы, а временные метки в метаданных событий безопасности используют UTC или содержат явное указание смещения часового пояса. Рекомендуется применять UTC для обеспечения согласованности в распределённых системах и предотвращения ошибок при переходе на летнее/зимнее время.",,✓,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.2,Общее журналирование,V16.2.3,"Убедитесь, что приложение записывает и передаёт логи исключительно в те файлы и сервисы, которые указаны в реестре журналирования.",,✓,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.2,Общее журналирование,V16.2.4,"Убедитесь, что логи могут быть прочитаны и коррелированы используемой системой обработки журналов, предпочтительно с использованием общего стандартного формата логирования.",,✓,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.2,Общее журналирование,V16.2.5,"Убедитесь, что приложение применяет соответствующие меры защиты при логировании конфиденциальных данных в зависимости от уровня их чувствительности: например, полностью запрещает запись в логи таких данных, как учетные данные или платежные реквизиты, а для других данных (например, сессионных токенов) использует хеширование или частичное/полное маскирование.",,✓,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.3,Инциденты безопасности,V16.3.1,"Убедитесь, что все операции аутентификации регистрируются, включая успешные и неудачные попытки. Также следует фиксировать дополнительные метаданные, такие как тип аутентификации или использованные факторы проверки.",,✓,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.3,Инциденты безопасности,V16.3.2,"Убедитесь, что ведется журнал неудачных попыток авторизации. Для уровня L3 это должно включать в себя журналирование всех решений об авторизации, включая журналирование доступа к конфиденциальным данным (без регистрации самих конфиденциальных данных).",,✓,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.3,Инциденты безопасности,V16.3.3,"Убедитесь, что приложение регистрирует все события безопасности, определенные в документации, а также фиксирует попытки обхода механизмов защиты, включая проверку входных данных, бизнес-логики и системы защиты от автоматизированных атак.",,✓,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.3,Инциденты безопасности,V16.3.4,"Убедитесь, что приложение регистрирует в журналах неожиданные ошибки и сбои механизмов безопасности, включая, например, ошибки TLS-соединения на стороне сервера.",,✓,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.4,Защита журналов,V16.4.1,"Убедитесь, что все компоненты системы логирования корректно кодируют данные, чтобы предотвратить атаки типа внедрения в журналы (log injection).",,✓,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.4,Защита журналов,V16.4.2,"Убедитесь, что логи защищены от неавторизованного доступа и не могут быть модифицированы.",,✓,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.4,Защита журналов,V16.4.3,"Убедитесь, что логи безопасно передаются в логически изолированную систему для анализа, обнаружения угроз, генерации оповещений и эскалации инцидентов. Это гарантирует сохранность журналов даже в случае компрометации основного приложения.",,✓,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.5,Обработка ошибок,V16.5.1,"Убедитесь, что при возникновении непредвиденной или связанной с безопасностью ошибки пользователю возвращается только общее сообщение, гарантируя отсутствие раскрытия конфиденциальных внутренних данных системы, таких как трассировки стека, запросы, секретные ключи и токены.",,✓,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.5,Обработка ошибок,V16.5.2,"Убедитесь, что приложение продолжает работать в безопасном режиме при недоступности внешних ресурсов, используя такие механизмы, как автоматические выключатели (circuit breakers) или плавное снижение функциональности (graceful degradation).",,✓,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.5,Обработка ошибок,V16.5.3,"Убедитесь, что приложение корректно и безопасно завершает работу при возникновении исключений, предотвращая опасные сценарии по типу «fail-open», когда, например, транзакция ошибочно выполняется, несмотря на ошибки в логике валидации.",,✓,✓,, +V16,Журналирование событий безопасности и обработка ошибок,V16.5,Обработка ошибок,V16.5.4,"Убедитесь, что определён обработчик ошибок «крайние меры», который будет перехватывать все необработанные ошибки. Это необходимо как для предотвращения потери информации об ошибках, которая должна быть записана в файлы журналов, так и для того, чтобы ошибка не остановила весь процесс приложения, что привело бы к потере доступности.",,,✓,, +V17,WebRTC,V17.1,TURN-сервер,V17.1.1,"Убедитесь, что сервис TURN (Traversal Using Relays around NAT) разрешает доступ только к IP-адресам, не зарезервированным для специальных целей (например, внутренние сети, широковещательная рассылка, loopback-адреса). Данное требование применяется как к IPv4, так и к IPv6 адресам.",,✓,✓,, +V17,WebRTC,V17.1,TURN-сервер,V17.1.2,"Убедитесь, что сервис TURN (Traversal Using Relays around NAT) защищен от исчерпания ресурсов при попытках легитимных пользователей открыть чрезмерное количество портов на сервере.",,,✓,, +V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.1,"Убедитесь, что ключ сертификата Datagram Transport Layer Security (DTLS) управляется и защищается в соответствии с документированной политикой управления криптографическими ключами.",,✓,✓,, +V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.2,"Убедитесь, что медиасервер настроен на использование только одобренных наборов шифров Datagram Transport Layer Security (DTLS) и защищенного профиля безопасности для расширения DTLS, применяемого при установке ключей для Secure Real-time Transport Protocol (DTLS-SRTP).",,✓,✓,, +V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.3,"Убедитесь, что медиасервер проверяет аутентификацию Secure Real-time Transport Protocol (SRTP) для предотвращения атак с внедрением Real-time Transport Protocol (RTP), которые могут привести к отказу в обслуживании (Denial of Service) или вставке поддельного аудио-/видеоконтента в медиапотоки.",,✓,✓,, +V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.4,"Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика при получении некорректных пакетов Secure Real-time Transport Protocol (SRTP).",,✓,✓,, +V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.5,"Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетами Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.",,,✓,, +V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.6,"Убедитесь, что медиасервер не подвержен уязвимости «Гонка ClientHello» (ClientHello Race Condition) в Datagram Transport Layer Security (DTLS), проверив наличие известных уязвимостей в публичных источниках или выполнив тестирование на воспроизведение условий гонки.",,,✓,, +V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.7,"Убедитесь, что механизмы аудио- и видеозаписи, связанные с медиасервером, способны продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетов Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.",,,✓,, +V17,WebRTC,V17.2,Требования к медиасерверам,V17.2.8,"Убедитесь, что сертификат Datagram Transport Layer Security (DTLS) проверяется на соответствие атрибуту отпечатка (fingerprint) в Session Description Protocol (SDP), с немедленным прекращением медиапотока в случае несоответствия — это гарантирует подлинность передаваемых данных.",,,✓,, +V17,WebRTC,V17.3,Сигнализация,V17.3.1,"Убедитесь, что сигнальный сервер способен продолжать обработку легитимных входящих сообщений сигнализации даже в условиях флуд-атаки. Для этого необходимо реализовать механизм ограничения частоты запросов (rate limiting) на уровне сигнализации.",,✓,✓,, +V17,WebRTC,V17.3,Сигнализация,V17.3.2,"Убедитесь, что сигнальный сервер способен продолжать обработку легитимных сообщений сигнализации даже при получении некорректных сообщений, которые могут вызвать отказ в обслуживании (Denial of Service, DoS). Для этого необходимо реализовать: проверку входных данных (input validation), безопасную обработку целочисленных переполнений (integer overflows), защиту от переполнения буферов (buffer overflows) и другие надежные методы обработки ошибок.",,✓,✓,, + diff --git a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.json b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.json new file mode 100644 index 0000000000..8c9bf3051f --- /dev/null +++ b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.json @@ -0,0 +1,7259 @@ +{ + "Name": "Application Security Verification Standard Project", + "ShortName": "ASVS", + "Version": "", + "Description": "The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.", + "Requirements": [ + { + "Shortcode": "V1", + "Ordinal": 1, + "ShortName": "Encoding", + "Name": "Кодировка и нейтрализация", + "Items": [ + { + "Shortcode": "V1.1", + "Ordinal": 1, + "Name": "Архитектура кодировки и нейтрализации", + "Items": [ + { + "Shortcode": "V1.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что входные данные декодируются или деэкранируются в каноническую форму (в стандартное представление) только один раз. Декодирование происходит только тогда, когда ожидаются закодированные данные в этой форме, и что это делается перед дальнейшей обработкой входных данных, например, это не выполняется после проверки или нейтрализации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение выполняет кодирование и экранирование выходных данных либо в качестве последнего шага перед использованием интерпретатором, для которого оно предназначено, либо самим интерпретатором.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V1.2", + "Ordinal": 2, + "Name": "Предотвращение инъекций", + "Items": [ + { + "Shortcode": "V1.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что выходная кодировка для ответа HTTP, документа HTML или документа XML соответствует требуемому контексту, например, кодировка соответствующих символов для элементов HTML, атрибутов HTML, комментариев HTML, CSS или полей заголовка HTTP делается таким способом, чтобы избежать изменения структуры сообщения или документа.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что при динамическом построении URL-адресов недоверенные данные кодируются в соответствии с их контекстом (например, кодирование URL-адресов или кодирование base64url для query или path параметров или пути). Убедитесь, что разрешены только безопасные протоколы URL-адресов (например, запрещен javascript: или data:).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что при динамическом построении содержимого JavaScript (включая JSON) используется кодирование или экранирование выходных данных, чтобы избежать изменения структуры сообщения или документа (чтобы избежать JavaScript и JSON-инъекций).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что выборка данных (Redis, Memcached, чтение из файлов, обращение по API) или запросы к базе данных (например, SQL, HQL, NoSQL, Cypher) используют параметризованные запросы, ORM, Entity Frameworks или иным образом защищены от SQL-инъекций и других атак. Это также актуально при написании хранимых процедур.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что приложение защищено от внедрения команд ОС и что вызовы операционной системы используют параметризованные запросы к ОС или используют контекстное кодирование вывода командной строки.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.6", + "Ordinal": 6, + "Description": "Убедитесь, что приложение защищено от LDAP-инъекций, или что реализованы специальные меры безопасности для их предотвращения.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.7", + "Ordinal": 7, + "Description": "Убедитесь, что приложение защищено от атак с использованием XPath-инъекций с помощью параметризации запросов или предварительно скомпилированных запросов.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.8", + "Ordinal": 8, + "Description": "Убедитесь, что процессоры LaTeX настроены безопасно (например, не используется флаг «–shell‑escape») и используется разрешенный список команд для предотвращения LaTeX-инъекций.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.9", + "Ordinal": 9, + "Description": "Убедитесь, что приложение экранирует специальные символы в регулярных выражениях (обычно с помощью обратной косой черты), чтобы предотвратить их ошибочную интерпретацию как метасимволов.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.2.10", + "Ordinal": 10, + "Description": "Убедитесь, что приложение защищено от внедрения формул CSV (CSV Injection). Приложение должно следовать правилам экранирования, определенным в RFC 4180, разделы 2.6 и 2.7, при экспорте содержимого CSV. Кроме того, при экспорте в CSV или другие форматы электронных таблиц (такие как XLS, XLSX или ODF) специальные символы (включая '=', '+', '-', '@', '\\t' (табуляция), и '\\0' (нулевой символ)) должны экранироваться одинарной кавычкой, если они появляются в качестве первого символа в значении поля.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V1.3", + "Ordinal": 3, + "Name": "Нейтрализация", + "Items": [ + { + "Shortcode": "V1.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что все ненадежные входные данные HTML из редакторов WYSIWYG или аналогичных программ нейтрализуются с помощью известных и безопасных библиотек или функций фреймворка для санитизации HTML.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение избегает использования eval() или других динамических функций выполнения кода, таких как Spring Expression Language (SpEL). Если нет альтернативы, любой пользовательский ввод должен быть нейтрализован перед выполнением.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что данные, передаваемые в потенциально опасный контекст, предварительно нейтрализованы, чтобы обеспечить соблюдение мер безопасности, таких как разрешение только тех символов, которые безопасны для данного контекста, и обрезка слишком длинного ввода.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что предоставленный пользователем файл .SVG проверен или нейтрализован, чтобы он содержал только теги и атрибуты (например, относящиеся к рисованию), которые безопасны для приложения, например, не содержат скриптов и foreignObject.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.5", + "Ordinal": 5, + "Description": "Убедитесь, что приложение нейтралует или отключает предоставленные пользователем скриптовые данные или выражения шаблонных языков, такие как таблицы стилей Markdown, CSS или XSL, BBCode или аналогичные.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.6", + "Ordinal": 6, + "Description": "Убедитесь, что приложение защищено от атак с подделкой запросов на стороне сервера (SSRF), проверяя ненадежные данные по разрешенному списку протоколов, доменов, путей и портов, а также нейтрализуя потенциально опасные символы перед использованием данных для вызова другой службы.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.7", + "Ordinal": 7, + "Description": "Убедитесь, что приложение защищено от атак с внедрением шаблонов (template injection), не позволяя создавать шаблоны на основе недоверенных входных данных. Если нет альтернативы, любые недоверенные входные данные, включаемые динамически во время создания шаблона, должны быть нейтрализованы или тщательно провалидированы.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.8", + "Ordinal": 8, + "Description": "Убедитесь, что приложение надлежащим образом нейтрализует недоверенные входные данные перед использованием в запросах Java Naming and Directory Interface (JNDI) и что JNDI настроен безопасно для предотвращения атак с использованием JNDI-инъекций.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.9", + "Ordinal": 9, + "Description": "Убедитесь, что приложение нейтрализует данные перед отправкой в Memcache, чтобы предотвратить атаки методом инъекций.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.10", + "Ordinal": 10, + "Description": "Убедитесь, что строки форматирования, которые могут быть использованы неожидаемым или вредоносным образом, нейтрализуются перед дальнейшим использованием.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.11", + "Ordinal": 11, + "Description": "Убедитесь, что приложение нейтрализует вводимые пользователем данные перед передачей в почтовые системы для защиты от SMTP или IMAP-инъекций.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.3.12", + "Ordinal": 12, + "Description": "Убедитесь, что регулярные выражения не содержат элементов, вызывающих экспоненциальный возврат, и убедитесь в нейтрализации недоверенных входных данных для предотвращения атак ReDoS или Runaway Regex.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V1.4", + "Ordinal": 4, + "Name": "Память, строки и неуправляемый код", + "Items": [ + { + "Shortcode": "V1.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что для обнаружения или предотвращения ситуаций переполнения стека, буфера или кучи приложение учитывает размер доступной области памяти при строковых операциях, копировании в память, в арифметике указателей и т.п.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что для предотвращения целочисленного переполнения применяется контроль знака, диапазона и типа допустимых входных данных.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что динамически выделенная память и ресурсы освобождены, а ссылки или указатели на освобожденную память удалены или установлены в значение null, чтобы предотвратить появление висячих указателей и уязвимостей, связанных с использованием памяти после освобождения.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V1.5", + "Ordinal": 5, + "Name": "Безопасная десериализация", + "Items": [ + { + "Shortcode": "V1.5.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение настраивает XML-парсеры на использование строгой конфигурации и что небезопасные функции, такие как разрешение внешних сущностей, отключены для предотвращения атак XML eXternal Entity (XXE).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.5.2", + "Ordinal": 2, + "Description": "Убедитесь, что десериализация недоверенных данных обеспечивает безопасную обработку ввода, например, используя список разрешенных типов объектов или ограничивая типы объектов, определяемые клиентом, для предотвращения атак десериализации. Механизмы десериализации, которые явно определены как небезопасные, не должны использоваться с недоверенным вводом.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V1.5.3", + "Ordinal": 3, + "Description": "Убедитесь, что различные парсеры, используемые в приложении для одного и того же типа данных (например, парсеры JSON, XML, URL), выполняют парсинг согласованным образом и используют один и тот же механизм кодирования символов, чтобы избежать таких проблем, как уязвимости взаимодействия JSON (JSON Interoperability) или различное поведение анализа URI или файлов, которые могут использоваться в атаках удаленного включения файлов (RFI) или подделки запросов на стороне сервера (SSRF).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V2", + "Ordinal": 2, + "ShortName": "Validation", + "Name": "Валидация и бизнес-логика", + "Items": [ + { + "Shortcode": "V2.1", + "Ordinal": 1, + "Name": "Документация валидации и бизнес-логики", + "Items": [ + { + "Shortcode": "V2.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что в документации приложения определены правила проверки входных данных на соответствие ожидаемой структуре. Это могут быть распространённые форматы данных, такие как номера кредитных карт, адреса электронной почты, номера телефонов, или внутренний формат данных.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что в документации приложения указано, как проверять логическую и контекстную согласованность объединенных данных, например, проверять соответствие района и почтового индекса.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что ожидания относительно ограничений и проверок бизнес-логики задокументированы как для уровня отдельного пользователя, так и для глобального уровня всего приложения.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V2.2", + "Ordinal": 2, + "Name": "Валидация ввода", + "Items": [ + { + "Shortcode": "V2.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что входные данные провалидированы для обеспечения соответствия бизнес- или функциональным ожиданиям. Валидация должна осуществляться либо по списку допустимых значений, шаблонов и диапазонов, либо путем сравнения входных данных с ожидаемой структурой и логическими ограничениями в соответствии с предопределенными правилами. Для L1 валидация может быть сосредоточена на входных данных, используемых для принятия конкретных бизнес-решений или решений, связанных с безопасностью. Для L2 и выше это должно применяться ко всем входным данным.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение разработано с принудительной валидацией входных данных на уровне доверенного сервиса. Хотя проверка на стороне клиента повышает удобство использования и должна поощряться, на неё не следует полагаться как на средство контроля безопасности.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение обеспечивает обоснованность комбинаций данных в соответствии с предопределенными правилам. Например: возраст должен соответствовать дате рождения; страна и почтовый индекс; количество товара в заказе и на складе.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V2.3", + "Ordinal": 3, + "Name": "Безопасность бизнес-логики", + "Items": [ + { + "Shortcode": "V2.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение обрабатывает потоки бизнес-логики для одного и того же пользователя в ожидаемом последовательном порядке шагов и без пропуска шагов.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что ограничения бизнес-логики реализованы в соответствии с документацией приложения, чтобы избежать эксплуатации её недостатков.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что транзакции используются на уровне бизнес-логики таким образом, что операция бизнес-логики либо выполняется полностью, либо откатывается к предыдущему корректному состоянию.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что на уровне бизнес-логики используются механизмы блокировки, чтобы гарантировать невозможность двойного бронирования ограниченных по количеству ресурсов (например, мест в театре или слотов доставки) путем манипулирования логикой приложения.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.3.5", + "Ordinal": 5, + "Description": "Убедитесь, что для важных потоков бизнес-логики требуется многопользовательское (multi-user) одобрение, чтобы предотвратить несанкционированные или случайные действия. Потоки бизнес-логики могут включать, помимо прочего, крупные денежные переводы, утверждение контрактов, доступ к секретной информации или обход ограничений безопасности на производстве.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V2.4", + "Ordinal": 4, + "Name": "Анти-автоматизация", + "Items": [ + { + "Shortcode": "V2.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что используются средства противодействия автоматизации для защиты от чрезмерных вызовов функций приложения, которые могут привести к утечке данных, созданию ненужных данных, исчерпанию квот, нарушению ограничений скорости, отказу в обслуживании или чрезмерному использованию дорогостоящих ресурсов.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V2.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что потоки бизнес-логики требуют реалистичного человеческого времени, предотвращая чрезмерно быструю отправку транзакций.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V3", + "Ordinal": 3, + "ShortName": "Web", + "Name": "Безопасность веб-интерфейса", + "Items": [ + { + "Shortcode": "V3.1", + "Ordinal": 1, + "Name": "Документация по безопасности веб-интерфейса", + "Items": [ + { + "Shortcode": "V3.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что в документации приложения описаны ожидаемые функции безопасности, которые должны поддерживать браузеры, использующие приложение (такие как HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) и другие соответствующие механизмы безопасности HTTP). В документации также должно быть обязательно определено, как приложение должно себя вести, если некоторые из этих функций недоступны (например, предупреждать пользователя или блокировать доступ).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.2", + "Ordinal": 2, + "Name": "Непреднамеренная интерпретация контента", + "Items": [ + { + "Shortcode": "V3.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что реализованы меры безопасности, предотвращающие отображение контента или функций браузерами в HTTP-ответах в некорректном контексте (например, запрос API, загруженный пользователем файл или другой ресурс запрашивается напрямую). Возможные способы контроля включают: не обрабатывать содержимое, если поля заголовка HTTP-запроса (например, Sec-Fetch-*) не указывают на корректность контекста; использование заголовка и значения Content-Security-Policy: sandbox directive; или использование заголовка и значения Content-Disposition: attachment.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что данные, предназначенные для отображения в виде текста, а не визуализации в виде HTML, обрабатывается с использованием безопасных функций визуализации (таких как createTextNode или textContent), чтобы предотвратить непреднамеренное выполнение содержимого, такого как HTML или JavaScript.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение избегает затирания DOM при использовании JavaScript на стороне клиента, применяя явные объявления переменных, выполняя строгую проверку типов, избегая сохранения глобальных переменных в объекте документа и реализуя изоляцию пространства имен.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.3", + "Ordinal": 3, + "Name": "Настройка файлов cookie", + "Items": [ + { + "Shortcode": "V3.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что у файлов cookie установлен атрибут «Secure», и если префикс «__Host‑» не используется в названии cookie, необходимо использовать префикс «__Secure‑».", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что значение атрибута SameSite каждой cookie установлено в соответствии с назначением cookie, чтобы ограничить подверженность атакам на восстановление пользовательского интерфейса и атакам с подделкой запросов на уровне браузера, обычно называемым подделкой межсайтовых запросов (CSRF).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что cookie имеют префикс «__Host‑» в названии, если только они явно не предназначены для совместного использования с другими хостами.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что если значение cookie не должно быть доступно для клиентских скриптов (например, сессионный токен), для cookie должен быть установлен атрибут «HttpOnly», а само значение должно передаваться клиенту только через поле заголовка «Set-Cookie».", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.3.5", + "Ordinal": 5, + "Description": "Убедитесь, что при записи cookie приложением общая длина имени и значения cookie не превышает 4096 байт. Слишком большие cookie не будут сохраняться браузером и, следовательно, не будут отправляться с запросами, что помешает пользователю использовать функции приложения, зависящие от этого cookie.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.4", + "Ordinal": 4, + "Name": "Заголовки механизма безопасности браузера", + "Items": [ + { + "Shortcode": "V3.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что поле заголовка Strict‑Transport‑Security включено во все ответы для реализации политики HTTP Strict Transport Security (HSTS). Необходимо указать максимальное время не менее 1 года, а для L2 и выше политика должна применяться также ко всем поддоменам.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что поле заголовка Cross‑Origin Resource Sharing (CORS) «Access‑Control‑Allow‑Origin» имеет фиксированное значение, заданное приложением, или, если используется заголовок Origin, оно проверяется по списку доверенных источников. При необходимости использования «Access‑Control‑Allow‑Origin: *» убедитесь, что ответ не содержит конфиденциальной информации.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что HTTP-ответы содержат поле заголовка Content-Security-Policy, которое определяет директивы, гарантирующие загрузку и выполнение браузером только доверенного контента или ресурсов, чтобы ограничить выполнение вредоносного JavaScript. Как минимум, необходимо использовать глобальную политику, включающую директивы object-src «none» и base-uri «none», а также определяющую список разрешенных адресов или использующую одноразовые коды или хэши. Для приложений L3 необходимо определить политику использования 'nonce' или hash-конструкций для каждого ответа.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.4", + "Ordinal": 4, + "Description": "Убедитесь, что все HTTP-ответы содержат поле заголовка «X‑Content‑Type‑Options: nosniff». Это предписывает браузерам не использовать анализ контента и определение типа MIME для данного ответа, а также требовать, чтобы значение поля заголовка Content‑Type в ответе соответствовало целевому ресурсу. Например, ответ на запрос стиля принимается только в том случае, если Content‑Type в ответе — «text/css». Это также позволяет браузеру использовать функцию Cross‑Origin Read Blocking (CORB).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.5", + "Ordinal": 5, + "Description": "Убедитесь, что приложение устанавливает политику реферера для предотвращения утечки технически конфиденциальных данных сторонним сервисам через поле заголовка HTTP-запроса «Referer». Это можно сделать с помощью поля заголовка HTTP-ответа «Referrer‑Policy» или через атрибуты HTML-элемента. Конфиденциальные данные могут включать путь и данные запроса в URL-адресе, а для внутренних непубличных приложений также имя хоста.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.6", + "Ordinal": 6, + "Description": "Убедитесь, что веб-приложение использует директиву frame‑ancestors поля заголовка Content‑Security‑Policy для каждого HTTP-ответа, чтобы гарантировать невозможность его внедрения по умолчанию и внедрение определённых ресурсов разрешено только при необходимости. Обратите внимание, что поле заголовка X‑Frame‑Options, хотя и поддерживается браузерами, устарело и не может быть использовано в качестве основы.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.7", + "Ordinal": 7, + "Description": "Убедитесь, что в поле заголовка Content‑Security‑Policy указано место, куда следует сообщать о нарушениях.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.4.8", + "Ordinal": 8, + "Description": "Убедитесь, что все HTTP-ответы, инициирующие рендеринг документа (например, ответы с типом содержимого text/html), включают поле заголовка Cross-Origin-Opener-Policy с директивой same-origin или same-origin-allow-popups (при необходимости). Это предотвращает атаки, злоупотребляющие общим доступом к объектам Window, такие как Tabnabbing и Frame Counting.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.5", + "Ordinal": 5, + "Name": "Браузерное разделение источников", + "Items": [ + { + "Shortcode": "V3.5.1", + "Ordinal": 1, + "Description": "Убедитесь, что, если приложение не использует механизм предварительной проверки CORS для предотвращения запрещённых кросс-доменных запросов на использование чувствительного функционала, эти запросы валидируются на предмет их происхождения от самого приложения. Это можно сделать, используя и проверяя специальные токены для защиты от подделки или требуя дополнительные поля HTTP-заголовка, не входящие в список «простых заголовков» (CORS-safelisted request-header). Это необходимо для защиты от атак с подделкой запросов через браузер, широко известных как межсайтовая подделка запросов (CSRF).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.2", + "Ordinal": 2, + "Description": "Убедитесь, что если приложение использует механизм предварительной проверки CORS для предотвращения неразрешённого использования чувствительного функционала между источниками, вызов этого функционала невозможен с помощью запроса, который не запускает предварительную проверку CORS. Для этого может потребоваться проверка значений полей заголовка запроса «Origin» и «Content-Type» или использование дополнительного поля заголовка, не входящего в безопасный список CORS.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.3", + "Ordinal": 3, + "Description": "Убедитесь, что HTTP-запросы к чувствительному функционалу используют соответствующие HTTP-методы, такие как POST, PUT, PATCH или DELETE, а не методы, определённые спецификацией HTTP как «безопасные», такие как HEAD, OPTIONS или GET. В качестве альтернативы можно использовать строгую валидацию полей заголовка запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, навигационного запроса или загрузки ресурса (например, источника изображения), где это не ожидается.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.4", + "Ordinal": 4, + "Description": "Убедитесь, что отдельные приложения размещены на разных именах хостов, чтобы использовать ограничения, предусмотренные политикой same-origin, включая то, как документы или скрипты, загруженные одним источником, могут взаимодействовать с ресурсами из другого источника, а также ограничения на cookie на основе имени хоста.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.5", + "Ordinal": 5, + "Description": "Убедитесь, что сообщения, полученные интерфейсом postMessage, отвергаются, если источник сообщения не является доверенным или если синтаксис сообщения недействителен.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.6", + "Ordinal": 6, + "Description": "Убедитесь, что функциональность JSONP не включена нигде в приложении, чтобы избежать атак с использованием межсайтового включения скриптов (XSSI).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.7", + "Ordinal": 7, + "Description": "Убедитесь, что данные, требующие авторизации, не включены в ответы ресурсов скриптов, таких как файлы JavaScript, чтобы предотвратить атаки с использованием межсайтового включения скриптов (XSSI).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.5.8", + "Ordinal": 8, + "Description": "Убедитесь, что аутентифицированные ресурсы (такие как изображения, видео, скрипты и другие документы) могут быть загружены или внедрены от имени пользователя только по назначению. Этого можно добиться путём строгой валидации полей заголовка HTTP-запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, или путём установки ограничительного поля заголовка HTTP-ответа Cross‑Origin‑Resource‑Policy, чтобы браузер блокировал возвращаемый контент.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.6", + "Ordinal": 6, + "Name": "Целостность внешних ресурсов", + "Items": [ + { + "Shortcode": "V3.6.1", + "Ordinal": 1, + "Description": "Убедитесь, что клиентские ресурсы, такие как библиотеки JavaScript, CSS или веб-шрифты, размещаются только на внешнем сервере (например, в сети доставки контента (Content Delivery Network)), если ресурс статический и имеет версии, а для проверки целостности ресурса используется механизм проверки целостности подресурсов (SRI). Если это невозможно, для каждого ресурса должно быть задокументировано решение по безопасности, обосновывающее это.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V3.7", + "Ordinal": 7, + "Name": "Другие соображения по безопасности браузера", + "Items": [ + { + "Shortcode": "V3.7.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение использует только те клиентские технологии, которые по-прежнему поддерживаются и считаются безопасными. Примерами технологий, не соответствующих этому требованию, являются плагины NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL или клиентские Java-апплеты.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.7.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение будет автоматически перенаправлять пользователя на другое имя хоста или домен (который не контролируется приложением), только если этот хост или домен указаны в списке разрешенных.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.7.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение отображает уведомление, что пользователь перенаправляется на URL-адрес, находящийся вне контроля приложения, с возможностью отмены навигации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.7.4", + "Ordinal": 4, + "Description": "Убедитесь, что домен верхнего уровня приложения (например, site.tld) ​​добавлен в публичный список предварительной загрузки (preload list) для HTTP Strict Transport Security (HSTS). Это гарантирует, что использование TLS для приложения будет встроено непосредственно в основные браузеры, а не будет полагаться только на поле заголовка ответа Strict-Transport-Security.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V3.7.5", + "Ordinal": 5, + "Description": "Убедитесь, что приложение ведет себя так, как описано в документации (например, предупреждает пользователя или блокирует доступ), если браузер, используемый для доступа к приложению, не поддерживает ожидаемые функции безопасности.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V4", + "Ordinal": 4, + "ShortName": "API", + "Name": "API и Веб-сервис", + "Items": [ + { + "Shortcode": "V4.1", + "Ordinal": 1, + "Name": "Общая безопасность веб-сервисов", + "Items": [ + { + "Shortcode": "V4.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что каждый HTTP-ответ с телом сообщения содержит заголовок Content-Type, который соответствует фактическому содержимому ответа, таким как «text/», «/+xml» и «/xml», включая параметр charset для указания безопасной кодировки символов (например, UTF-8, ISO-8859-1) согласно IANA Media Types.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что только конечные точки, предназначенные для взаимодействия с пользователем через веб-браузер, автоматически перенаправляют HTTP на HTTPS, в то время как другие сервисы или конечные точки не реализуют прозрачные редиректы. Это необходимо, чтобы избежать ситуации, когда клиент ошибочно отправляет незашифрованные HTTP-запросы а из-за того, что запрос по HTTP автоматически перенаправляется на HTTPS другим сервисом без обработки на входе, утечка чувствительных данных остаётся незамеченной.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что любой HTTP-заголовок, используемый приложением и устанавливаемый промежуточным уровнем, таким как балансировщик нагрузки, веб-прокси или backend-for-frontend сервис, не может быть переопределён конечным пользователем. Примеры заголовков: X-Real-IP, X-Forwarded-*, X-User-ID.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.1.4", + "Ordinal": 4, + "Description": "Убедитесь, что разрешены только HTTP-методы, которые явно поддерживаются приложением или его API (включая OPTIONS для preflight-запросов), а неиспользуемые методы заблокированы.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.1.5", + "Ordinal": 5, + "Description": "Убедитесь, что для особо чувствительных запросов или транзакций, проходящих через несколько систем, используются цифровые подписи на уровне сообщений, дополнительно к транспортным средствам защиты.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V4.2", + "Ordinal": 2, + "Name": "Валидация структуры HTTP-сообщений", + "Items": [ + { + "Shortcode": "V4.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что все компоненты приложения (включая балансировщики нагрузки, файрволы и серверы приложений) определяют границы входящих HTTP-сообщений с использованием механизма, соответствующего версии HTTP, чтобы предотвратить HTTP request smuggling. В HTTP/1.x, если присутствует заголовок Transfer-Encoding, заголовок Content-Length должен игнорироваться согласно RFC 2616. При использовании HTTP/2 или HTTP/3, если присутствует Content-Length, веб-сервер должен убедиться, что он совпадает с длиной DATA-фреймов.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что при генерации HTTP-сообщений заголовок Content-Length не конфликтует с длиной содержимого, определяемой рамками протокола HTTP, чтобы предотвратить HTTP Request Smuggling.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение не отправляет и не принимает HTTP/2 и HTTP/3 сообщения с заголовками, специфичными для соединения, такими как Transfer-Encoding, чтобы предотвратить HTTP Response Splitting и HTTP Header Injection.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что приложение принимает HTTP/2 и HTTP/3 запросы только в случае, если поля заголовков и их значения не содержат последовательностей CR (\\r), LF (\\n) или CRLF (\\r\\n), чтобы предотвратить HTTP Header Injection.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что если приложение (бекенд или фронтенд) формирует и отправляет запросы, оно использует валидацию, очистку или другие механизмы, чтобы не создавать URI (например, для API-вызовов) или HTTP-заголовки (например, Authorization или Cookie) слишком большой длины, чтобы их не принимал приёмник. Это может привести к отказу в обслуживании, например, при отправке слишком длинного запроса (длинный cookie-заголовок), из-за чего сервер постоянно возвращает ошибку.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V4.3", + "Ordinal": 3, + "Name": "GraphQL", + "Items": [ + { + "Shortcode": "V4.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что используется белый список запросов, ограничение глубины вложенности, ограничение количества или анализ стоимости запроса, чтобы предотвратить DoS-атаки на уровне GraphQL или слоя данных из-за дорогостоящих вложенных запросов.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что introspection-запросы GraphQL отключены в продакшен-среде, если GraphQL API не предназначен для использования сторонними клиентами.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V4.4", + "Ordinal": 4, + "Name": "WebSocket", + "Items": [ + { + "Shortcode": "V4.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что для всех WebSocket-соединений используется WebSocket поверх TLS (WSS).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что при первоначальном HTTP WebSocket handshake заголовок Origin проверяется на соответствие списку разрешённых источников для приложения.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что если стандартное управление сессиями приложения не может быть использовано, применяются специальные токены, соответствующие требованиям безопасности управления сессиями.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V4.4.4", + "Ordinal": 4, + "Description": "Убедитесь, что специальные токены управления сессиями WebSocket изначально получаются или валидируются через ранее аутентифицированную HTTPS-сессию при переходе от HTTPS к WebSocket.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V5", + "Ordinal": 5, + "ShortName": "File", + "Name": "Работа с файлами", + "Items": [ + { + "Shortcode": "V5.1", + "Ordinal": 1, + "Name": "Документация по работе с файлами", + "Items": [ + { + "Shortcode": "V5.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что документация определяет допустимые типы файлов, ожидаемые расширения и максимальный размер (включая распакованный размер) для каждой функции загрузки. Также убедитесь, что в документации указано, как файлы обезвреживаются для конечных пользователей (например, как приложение ведёт себя при обнаружении вредоносного файла).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V5.2", + "Ordinal": 2, + "Name": "Загрузка файлов и содержимое", + "Items": [ + { + "Shortcode": "V5.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение принимает только те файлы, которые может обработать без потери производительности или отказа в обслуживании.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что при загрузке файла (включая файлы внутри архивов, таких как ZIP) приложение проверяет, соответствует ли расширение ожидаемому, и валидирует, соответствует ли содержимое типу, указанному в расширении. Это включает проверку начальных 'magic bytes', перезапись изображений, использование специализированных библиотек. Для уровня 1 — достаточно проверок для файлов, критичных с точки зрения бизнеса или безопасности. Для уровней 2 и выше — для всех файлов.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение проверяет архивы (например, zip, gz, docx, odt) на максимально допустимый распакованный размер и максимальное количество файлов до распаковки.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что для каждого пользователя установлены квоты на общий размер и количество файлов, чтобы один пользователь не мог переполнить хранилище.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что приложение не позволяет загружать архивы с символьными ссылками (symlinks), если это не требуется по бизнес-логике. Если требуется — разрешён только строго определённый список допустимых символьных ссылок.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.2.6", + "Ordinal": 6, + "Description": "Убедитесь, что приложение отклоняет изображения с числом пикселей выше допустимого, чтобы предотвратить атаки 'pixel flood'.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V5.3", + "Ordinal": 3, + "Name": "Хранение файлов", + "Items": [ + { + "Shortcode": "V5.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что загруженные или сгенерированные из недоверенного ввода файлы, находящиеся в публичной директории, не исполняются как серверный код при обращении к ним по HTTP.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что при создании путей к файлам приложение использует внутренние или доверенные данные, а не пользовательские имена файлов. Если использование пользовательских имён или метаданных необходимо — требуется строгая проверка и очистка. Это защита от path traversal, LFI, RFI и SSRF.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что при обработке файлов на сервере (например, при распаковке) игнорируются пути, заданные пользователем, во избежание уязвимостей типа 'zip slip'.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V5.4", + "Ordinal": 4, + "Name": "Скачивание файлов", + "Items": [ + { + "Shortcode": "V5.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение валидирует или игнорирует имена файлов, переданных пользователем (включая в JSON, JSONP или URL-параметре), и указывает имя файла в заголовке Content-Disposition при ответе.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что имена файлов, передаваемые (например, в HTTP-заголовках или вложениях в email), кодируются или очищаются (например, по RFC 6266), чтобы сохранить структуру документа и предотвратить инъекции.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V5.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что файлы, полученные из недоверенных источников, сканируются антивирусом, чтобы не распространять известное вредоносное содержимое.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V6", + "Ordinal": 6, + "ShortName": "Authentication", + "Name": "Аутентификация", + "Items": [ + { + "Shortcode": "V6.1", + "Ordinal": 1, + "Name": "Документация по аутентификации", + "Items": [ + { + "Shortcode": "V6.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что в документации приложения описано, как используются механизмы, такие как ограничение частоты запросов (rate limiting), защита от автоматизации и адаптивные реакции, для защиты от атак, таких как подстановка учётных данных и перебор паролей. Документация должна ясно описывать конфигурацию этих механизмов и предотвращение злонамеренной блокировки аккаунтов.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что задокументирован список контекстно-зависимых слов, запрещённых к использованию в паролях. В него могут входить производные от названий организаций, продуктов, идентификаторов систем, кодовых названий проектов, названий отделов или ролей и тому подобное.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что если приложение поддерживает несколько способов аутентификации, то все они документированы вместе с описанием применяемых средств защиты и уровнем стойкости аутентификации, которые должны быть одинаково применены ко всем способам.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.2", + "Ordinal": 2, + "Name": "Безопасность паролей", + "Items": [ + { + "Shortcode": "V6.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что пользовательские пароли содержат не менее 8 символов. Рекомендуется минимальная длина в 15 символов.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что пользователи могут менять свои пароли.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что для смены пароля требуется ввести как текущий, так и новый пароль.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что при регистрации или смене пароля введённый пароль проверяется по списку как минимум из 3000 самых популярных паролей, соответствующих политике (например, минимальной длине).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что допускаются пароли любой структуры, без ограничений на использование определённых символов. Не должно быть требований по обязательному наличию заглавных/строчных букв, цифр или специальных символов.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.6", + "Ordinal": 6, + "Description": "Убедитесь, что поля ввода пароля используют type=password для скрытия символов. Разрешено временное отображение всего пароля или последнего введённого символа.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.7", + "Ordinal": 7, + "Description": "Убедитесь, что разрешены вставка (paste), использование менеджеров паролей браузера и внешних менеджеров паролей.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.8", + "Ordinal": 8, + "Description": "Убедитесь, что пароль проверяется строго в том виде, в котором он был введён пользователем — без обрезки, изменения регистра и других модификаций.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.9", + "Ordinal": 9, + "Description": "Убедитесь, что система позволяет использовать пароли длиной не менее 64 символов.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.10", + "Ordinal": 10, + "Description": "Убедитесь, что пароль остаётся действительным, пока не будет скомпрометирован или не будет изменён пользователем. Приложение не должно требовать регулярной смены пароля.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.11", + "Ordinal": 11, + "Description": "Убедитесь, что используется документированный список контекстно-зависимых слов (например, названия компаний, проектов и т.д.) для предотвращения использования легко угадываемых паролей.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.2.12", + "Ordinal": 12, + "Description": "Убедитесь, что при регистрации или смене пароля проверяется, не входит ли он в список скомпрометированных (утёкших) паролей.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.3", + "Ordinal": 3, + "Name": "Общие требования к безопасности аутентификации", + "Items": [ + { + "Shortcode": "V6.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что реализованы меры защиты от атак типа credential stuffing (массовая подстановка учётных данных) и brute-force (перебор паролей), согласно документации по безопасности приложения.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что в приложении отсутствуют или отключены учётные записи по умолчанию (например, root, admin, sa).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что для доступа к приложению используется либо механизм многофакторной аутентификации, либо комбинация однофакторных. Для уровня L3 один из факторов должен быть аппаратным, обеспечивающим защиту от фишинга, устойчивость к компрометации и подтверждение намерения аутентификации через явное действие пользователя (например, нажатие кнопки на FIDO-ключе или телефоне). Ослабление этих требований допускается только при наличии обоснования и компенсирующих мер.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что при наличии нескольких способов аутентификации, они все задокументированы, и для них единообразно применяются меры защиты и уровни доверия.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.5", + "Ordinal": 5, + "Description": "Убедитесь, что пользователи получают уведомления о подозрительных попытках аутентификации (удачных и неудачных). Это может включать попытки (например, подключения) с необычного устройства или места, частично успешную MFA, попытку после долгого отсутствия или успешную аутентификацию после серии неудачных.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.6", + "Ordinal": 6, + "Description": "Убедитесь, что email не используется ни как однофакторный, ни как многофакторный механизм аутентификации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.7", + "Ordinal": 7, + "Description": "Убедитесь, что пользователи получают уведомление при изменении данных аутентификации, таких как сброс пароля или изменение логина/email.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.3.8", + "Ordinal": 8, + "Description": "Убедитесь, что из сообщений об ошибке, HTTP-кодов ответа или различий во времени ответа нельзя определить, существует ли пользователь с таким логином. Это правило также должно применяться к функциям регистрации и восстановления пароля.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.4", + "Ordinal": 4, + "Name": "Жизненный цикл и восстановление факторов аутентификации", + "Items": [ + { + "Shortcode": "V6.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что начальные пароли или коды активации, генерируемые системой, создаются с использованием надёжного генератора случайных чисел, соответствуют текущей политике паролей и истекают через короткий период времени либо после первого использования. Эти секреты не должны использоваться как постоянные пароли.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что в системе отсутствуют подсказки к паролю или вопросы на знание («секретные вопросы»).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что реализован безопасный процесс сброса забытого пароля, который не обходит активные механизмы многофакторной аутентификации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.4", + "Ordinal": 4, + "Description": "Убедитесь, что в случае утраты одного из факторов MFA проводится удостоверение личности (identity proofing) на том же уровне, что и при первичной регистрации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.5", + "Ordinal": 5, + "Description": "Убедитесь, что инструкции по обновлению истекающих механизмов аутентификации отправляются заранее, с достаточным запасом времени для выполнения замены, при необходимости с настройкой автоматических напоминаний.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.4.6", + "Ordinal": 6, + "Description": "Убедитесь, что администраторы могут инициировать процесс сброса пароля, но не могут задать или выбрать новый пароль за пользователя. Это исключает ситуацию, при которой администратор знает пароль пользователя.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.5", + "Ordinal": 5, + "Name": "Общие требования к многофакторной аутентификации", + "Items": [ + { + "Shortcode": "V6.5.1", + "Ordinal": 1, + "Description": "Убедитесь, что lookup-секреты, внеполосные коды/запросы и TOTP-коды можно использовать только один раз.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.2", + "Ordinal": 2, + "Description": "Убедитесь, что при хранении lookup-секретов с энтропией менее 112 бит (например, 19 случайных буквенно-цифровых символов или 34 случайные цифры) они хэшируются с использованием разрешённого алгоритма хеширования паролей и случайной соли минимум 32 бита. Если у секрета ≥112 бит энтропии — допустимо использовать стандартный хэш.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.3", + "Ordinal": 3, + "Description": "Убедитесь, что lookup-секреты, коды внеполосной аутентификации и сиды для TOTP генерируются с использованием криптографически стойкого генератора случайных чисел (CSPRNG), чтобы избежать предсказуемых значений.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.4", + "Ordinal": 4, + "Description": "Убедитесь, что lookup-секреты и внеполосные коды аутентификации имеют минимум 20 бит энтропии (достаточно, например, 4 случайных алфавитно-цифровых символов или 6 случайных цифр).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.5", + "Ordinal": 5, + "Description": "Убедитесь, что все внеполосные запросы, коды и токены, а также TOTP-коды имеют ограниченный срок действия. Максимум для out-of-band — 10 минут, для TOTP — 30 секунд.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.6", + "Ordinal": 6, + "Description": "Убедитесь, что любой фактор аутентификации (включая физические устройства) может быть отозван в случае кражи или утери.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.7", + "Ordinal": 7, + "Description": "Убедитесь, что биометрические механизмы аутентификации используются только как вторичный фактор — в сочетании с «чем-то, что вы знаете» или «чем-то, что у вас есть».", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.5.8", + "Ordinal": 8, + "Description": "Убедитесь, что TOTP-коды проверяются по источнику времени, полученному от доверенного сервиса, а не от клиента или недоверенного источника.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.6", + "Ordinal": 6, + "Name": "Внеполосные механизмы аутентификации", + "Items": [ + { + "Shortcode": "V6.6.1", + "Ordinal": 1, + "Description": "Убедитесь, что механизмы аутентификации через телефонную сеть общего пользования (PSTN) для доставки одноразовых паролей (OTP) по телефону или SMS используются только в случае предварительной валидации номера, при этом предлагаются альтернативные более безопасные методы (например, TOTP), и пользователю сообщаются риски. Для приложений уровня L3 использование телефона и SMS недопустимо.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.6.2", + "Ordinal": 2, + "Description": "Убедитесь, что внеполосные запросы, коды или токены привязаны к исходному запросу аутентификации, для которого они были сгенерированы, и не могут быть использованы повторно для других попыток.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.6.3", + "Ordinal": 3, + "Description": "Убедитесь, что внеполосные механизмы на основе кода защищены от атак методом подбора (brute force) путём применения ограничения частоты запросов (rate limiting). Также рекомендуется использовать коды с энтропией не менее 64 бит.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.6.4", + "Ordinal": 4, + "Description": "Убедитесь, что при использовании push-уведомлений для MFA применяется ограничение частоты (rate limiting), чтобы предотвратить атаки push-бомбинга. Также может помочь механизм сопоставления номеров (number matching).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.7", + "Ordinal": 7, + "Name": "Криптографические механизмы аутентификации", + "Items": [ + { + "Shortcode": "V6.7.1", + "Ordinal": 1, + "Description": "Убедитесь, что сертификаты, используемые для проверки криптографических утверждений об аутентификации, хранятся таким образом, чтобы исключить возможность их модификации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.7.2", + "Ordinal": 2, + "Description": "Убедитесь, что nonce (случайная строка), используемая в процессе вызова, имеет длину не менее 64 бит и является статистически уникальной или уникальной на протяжении всего срока службы криптографического устройства.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V6.8", + "Ordinal": 8, + "Name": "Аутентификация с использованием провайдера идентификаций (IdP)", + "Items": [ + { + "Shortcode": "V6.8.1", + "Ordinal": 1, + "Description": "Убедитесь, что при поддержке несколькими IdP, невозможно подделать личность пользователя через другой IdP (например, с тем же user ID). Стандартным способом защиты является регистрация пользователя с использованием сочетания ID самого IdP (в качестве пространства имён) и пользовательского ID внутри IdP.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.8.2", + "Ordinal": 2, + "Description": "Убедитесь, что наличие и целостность цифровой подписи в утверждениях аутентификации (например, в JWT или SAML) всегда проверяются, а неподписанные или недействительные утверждения отклоняются.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.8.3", + "Ordinal": 3, + "Description": "Убедитесь, что SAML-утверждения обрабатываются только один раз в течение периода их действия, чтобы исключить атаки воспроизведения (replay attacks).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V6.8.4", + "Ordinal": 4, + "Description": "Убедитесь, что если приложение использует внешний поставщик идентификации (IdP) и для определенных функций требуется особый уровень, метод или срок действия аутентификации, то приложение использует данные, возвращаемые IdP, для проверки этих условий. Например, при использовании OIDC можно проверить значения полей ID Token — acr, amr, auth_time (если они есть). Если IdP не предоставляет эти данные, приложение должно иметь документированный план действий по умолчанию, предполагающий использование минимально допустимой силы аутентификации (например, одноступенчатая — логин и пароль).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V7", + "Ordinal": 7, + "ShortName": "Session", + "Name": "Управление сессиями", + "Items": [ + { + "Shortcode": "V7.1", + "Ordinal": 1, + "Name": "Документация по управлению сессиями", + "Items": [ + { + "Shortcode": "V7.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что тайм-аут бездействия и абсолютное максимальное время жизни сессии задокументированы, соответствуют другим контрольным мерам и сопровождаются обоснованием любых отклонений от требований повторной аутентификации NIST SP 800-63B.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что документация определяет допустимое количество одновременных (параллельных) сессий для одного аккаунта, а также поведение системы и действия при достижении этого лимита.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что все системы, создающие и управляющие сессиями пользователей в рамках федеративной идентификации (например, SSO), задокументированы вместе с механизмами координации сроков действия сессий, условий завершения и случаев, требующих повторной аутентификации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.2", + "Ordinal": 2, + "Name": "Базовая безопасность сессий", + "Items": [ + { + "Shortcode": "V7.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что все проверки сессионных токенов выполняются на доверенной серверной стороне.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение использует либо автономные токены, либо ссылочные токены, которые генерируются динамически, не используя статические API-секреты или ключи.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что ссылочные токены являются уникальными, создаются с использованием криптографически безопасного генератора псевдослучайных чисел (CSPRNG) и обладают энтропией не менее 128 бит.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что при аутентификации пользователя (включая повторную) создается новый токен сессии, а текущий — аннулируется.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.3", + "Ordinal": 3, + "Name": "Тайм-ауты сессии", + "Items": [ + { + "Shortcode": "V7.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что есть тайм-аут бездействия, после которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что установлено абсолютное максимальное время жизни сессии, по истечении которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.4", + "Ordinal": 4, + "Name": "Завершение сессий", + "Items": [ + { + "Shortcode": "V7.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что после завершения сессии (logout, истечение срока) дальнейшее её использование невозможно. Для ссылочных токенов или сессий с сохранением состояния это означает аннулирование на сервере. Для self-contained токенов необходимо реализовать механизм отзыва, например, список отозванных токенов, проверку времени выпуска или ротацию ключей подписи для каждого пользователя.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что при удалении или отключении пользователя все активные сессии немедленно завершаются.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что после изменения или удаления факторов аутентификации (например, смена пароля или MFA) приложение предлагает завершить все другие активные сессии.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.4.4", + "Ordinal": 4, + "Description": "Убедитесь, что на всех страницах, требующих аутентификации, имеется простой и видимый способ выхода.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.4.5", + "Ordinal": 5, + "Description": "Убедитесь, что администраторы могут завершать активные сессии конкретного пользователя или всех пользователей.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.5", + "Ordinal": 5, + "Name": "Защита от злоупотреблений сессией", + "Items": [ + { + "Shortcode": "V7.5.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение требует полной повторной аутентификации перед изменением чувствительных атрибутов аккаунта, которые могут влиять на аутентификацию (например, email, номер телефона, настройки MFA или данных восстановления доступа).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.5.2", + "Ordinal": 2, + "Description": "Убедитесь, что пользователь может просматривать и (после повторной аутентификации хотя бы по одному фактору) завершать активные сессии.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.5.3", + "Ordinal": 3, + "Description": "Убедитесь, что перед выполнением критически важных операций приложение требует повторной аутентификации (по крайней мере, одного фактора) или дополнительной проверки.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V7.6", + "Ordinal": 6, + "Name": "Федеративная повторная аутентификация", + "Items": [ + { + "Shortcode": "V7.6.1", + "Ordinal": 1, + "Description": "Убедитесь, что срок действия и завершение сессий между RP и IdP соответствуют документации и включают повторную аутентификацию, если достигнут максимальный допустимый интервал между событиями аутентификации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V7.6.2", + "Ordinal": 2, + "Description": "Убедитесь, что создание сессии требует согласия пользователя или явного действия, предотвращающего несанкционированное создание сессий без участия пользователя.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V8", + "Ordinal": 8, + "ShortName": "Authorization", + "Name": "Авторизация", + "Items": [ + { + "Shortcode": "V8.1", + "Ordinal": 1, + "Name": "Документация по авторизации", + "Items": [ + { + "Shortcode": "V8.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне функций и на уровне данных на основе прав субъекта и атрибутов ресурса.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне полей (как на чтение, так и на запись) на основе прав субъекта и атрибутов ресурса. Эти правила могут зависеть от других атрибутов объекта данных, например, статуса.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что документация определяет, какие атрибуты окружения и контекста (например, время суток, IP-адрес, местоположение, устройство) используются приложением для принятия решений в области аутентификации и авторизации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.1.4", + "Ordinal": 4, + "Description": "Убедитесь, что документация по аутентификации и авторизации определяет, как используются факторы окружения и контекста в принятии решений, наряду с правилами доступа к функциям, данным и полям. Документация должна содержать оцениваемые атрибуты, пороговые значения риска, действия (разрешить, отказать, повысить уровень аутентификации и др.).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V8.2", + "Ordinal": 2, + "Name": "Архитектура авторизации", + "Items": [ + { + "Shortcode": "V8.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение обеспечивает доступ на уровне функций (function-level) только субъектам с явными разрешениями.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение обеспечивает доступ на уровне данных (data-specific) только тем субъектам, которым явно предоставлены права к определённым элементам данных, чтобы предотвратить IDOR (Insecure Direct Object Reference) и BOLA-уязвимости (Broken Object Level Authorization).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение обеспечивает доступ на уровне полей (field-level) только тем субъектам, которым явно предоставлены права к определённым полям, чтобы предотвратить BOPLA (Broken Object Property Level Authorization).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что реализованы адаптивные меры безопасности, основанные на атрибутах окружения и контекста субъекта (время, местоположение, IP, устройство), которые используются для принятия решений об аутентификации и авторизации, как это определено в документации приложения. Эти меры должны применяться как при попытке субъекта начать новую сессию, так и во время существующей сессии.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V8.3", + "Ordinal": 3, + "Name": "Авторизация на уровне операций", + "Items": [ + { + "Shortcode": "V8.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что правила авторизации реализуются на доверенном сервисном уровне и не зависят от элементов, которые может контролировать клиент (например, JavaScript на стороне клиента).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что изменения значений, влияющих на авторизацию, применяются немедленно. Если это невозможно (например, при использовании автономных токенов), должны быть реализованы компенсирующие меры: оповещения о попытке несанкционированного действия и откат изменений. Обратите внимание, что данный подход не предотвращает утечку информации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что доступ к объекту осуществляется на основе прав субъекта, инициировавшего запрос, а не прав промежуточного сервиса, действующего от его имени. Например, если пользователь обращается к веб-сервису с автономным токеном для аутентификации, а сервис затем запрашивает данные у другого сервиса, второй сервис должен использовать токен пользователя, а не токен первого сервиса для принятия решения о доступе.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V8.4", + "Ordinal": 4, + "Name": "Прочие аспекты авторизации", + "Items": [ + { + "Shortcode": "V8.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что в мультитенантных приложениях реализованы механизмы, предотвращающие действия потребителя в отношении арендаторов, к которым у него нет доступа.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V8.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что доступ к административным интерфейсам защищён несколькими уровнями контроля, включая непрерывную проверку личности, контроль защищённости устройства и анализ контекстных рисков. Недостаточно опираться только на IP-адрес или доверенные устройства.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V9", + "Ordinal": 9, + "ShortName": "Self", + "Name": "Автономные токены", + "Items": [ + { + "Shortcode": "V9.1", + "Ordinal": 1, + "Name": "Источник токена и его целостность", + "Items": [ + { + "Shortcode": "V9.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что автономные токены проверяются на целостность с помощью цифровой подписи или MAC, прежде чем доверять их содержимому.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.1.2", + "Ordinal": 2, + "Description": "Проверяйте, что автономные токены создаются и проверяются исключительно с помощью алгоритмов из списка допустимых в данном контексте. Список допустимых алгоритмов должен включать только разрешенные алгоритмы (желательно либо только симметричные, либо только асимметричные) и ни в коем случае не содержать алгоритм None. Если необходимо поддерживать оба типа алгоритмов, потребуются дополнительные средства контроля для предотвращения путаницы с ключами (key confusion).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что ключи, используемые для проверки автономных токенов, получены из доверенных, предварительно настроенных источников. Это предотвращает возможность указания злоумышленниками ненадёжных источников и ключей. Для JWT и других JWS структур заголовки 'jku', 'x5u' и 'jwk' должны проверяться по белому списку.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V9.2", + "Ordinal": 2, + "Name": "Содержимое токена", + "Items": [ + { + "Shortcode": "V9.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что при указанном сроке действия токен и его содержимое принимаются только в том случае, если срок действия токена не истёк. Например, для JWT нужно проверить поля 'nbf' и 'exp'.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что сервис, принимающий токен, проверяет его тип и соответствие назначению перед обработкой содержимого токена. Например, для принятия решений об авторизации могут быть приняты только Access Token, а для подтверждения аутентификации пользователя — только ID Token.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что сервис принимает только токены, предназначенные для использования с этим сервисом (audience). Для JWT это можно сделать, проверив наличие утверждения «aud» по белому списку, определенному в сервисе.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V9.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что, если эмитент токенов использует один и тот же закрытый ключ для выпуска токенов различным сервисам (audiences), выпущенные токены содержат явное указание целевых сервисов. Это предотвратит повторное использования токенов в не предназначенных для них сервисах. Если идентификатор сервиса (audience identifier) назначается динамически, эмитент токенов должен проверить audiences для исключения подмены получателей (audience impersonation).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V10", + "Ordinal": 10, + "ShortName": "OAuth", + "Name": "OAuth и OIDC", + "Items": [ + { + "Shortcode": "V10.1", + "Ordinal": 1, + "Name": "Общие требования безопасности OAuth и OIDC", + "Items": [ + { + "Shortcode": "V10.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что токены передаются только тем компонентам, которым они действительно необходимы. Например, при использовании схемы backend-for-frontend для браузерных JavaScript-приложений, access и refresh токены должны быть доступны только на backend.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что клиент принимает значения от авторизационного сервера (например, authorization code или ID Token) только если они получены в результате авторизационного потока, инициированного в той же сессии пользовательского агента и в рамках той же транзакции. Для этого клиентские секреты, такие как proof key для code exchange (PKCE) — 'code_verifier', 'state' или OIDC 'nonce' — должны быть непредсказуемыми, специфичными для транзакции и надежно привязанными как к клиенту, так и к сессии пользовательского агента, в которой началась транзакция.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.2", + "Ordinal": 2, + "Name": "Клиент OAuth", + "Items": [ + { + "Shortcode": "V10.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что если используется механизм authorization code flow, OAuth клиент защищён от CSRF, вызывающих запросы токенов либо за счёт использования механизма proof key for code exchange (PKCE), либо за счёт проверки параметра 'state', который был отправлен в запросе авторизации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что если OAuth клиент может взаимодействовать с более чем одним сервером авторизации, у него есть защита от атак смешивания (mix-up attacks). Например, клиент должен требовать, чтобы сервер авторизации возвращал параметр 'iss' и проверять его в ответах на авторизацию и токены.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что OAuth клиент запрашивает только необходимые области доступа (scopes) или другие параметры авторизации в запросах к серверу авторизации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.3", + "Ordinal": 3, + "Name": "Сервер ресурсов OAuth", + "Items": [ + { + "Shortcode": "V10.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что сервер ресурсов принимает только те access токены, которые предназначены для использования с этим сервисом (свойство audience). Эта принадлежность сервису может быть включена в структурированный access токен (например, в поле 'aud' в JWT) или проверяться через endpoint интроспекции токена.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что сервер ресурсов принимает решения по авторизации на основе claims из access токена, определяющих делегированную авторизацию. Если присутствуют claims, такие как 'sub', 'scope' и 'authorization_details', они должны участвовать в принятии решения.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что если для принятия решения по контролю доступа необходимо однозначно идентифицировать пользователя из access токена (JWT или ответа интроспекции), сервер ресурсов использует claims, которые не могут быть переприсвоены другим пользователям. Обычно это комбинация claims 'iss' и 'sub'.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что если сервер ресурсов требует определённой силы аутентификации, методов или свежести аутентификации, он проверяет, что предъявленный access токен удовлетворяет этим требованиям. Например, при наличии, могут использоваться claims OIDC 'acr', 'amr' и 'auth_time'.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.3.5", + "Ordinal": 5, + "Description": "Убедитесь, что сервер ресурсов предотвращает использование украденных access токенов или их повторное использование (replay) неавторизованными лицами, требуя access токены с подтверждением отправителя — например, Mutual TLS для OAuth 2 или OAuth 2 Demonstration of Proof of Possession (DPoP).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.4", + "Ordinal": 4, + "Name": "Сервер авторизации OAuth", + "Items": [ + { + "Shortcode": "V10.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что сервер авторизации проверяет URI перенаправления (redirect URI), сверяя его с заранее зарегистрированным списком разрешённых URI для данного клиента (allowlist), используя точное сравнение строк.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что если сервер авторизации возвращает authorization code в ответе авторизации, этот код может быть использован только один раз для запроса токена. При втором валидном запросе с уже использованным кодом сервер должен отклонить запрос и отозвать любые токены, связанные с этим кодом.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что authorization code имеет короткое время жизни. Максимальная продолжительность — до 10 минут для приложений L1 и L2 и до 1 минуты для приложений L3.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.4", + "Ordinal": 4, + "Description": "Убедитесь, что сервер авторизации для конкретного клиента разрешает использование только тех типов авторизации, которые необходимы этому клиенту. Обратите внимание, что тип авторизации Implicit flow и Resource Owner Password Credentials flow больше не должны использоваться.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.5", + "Ordinal": 5, + "Description": "Убедитесь, что сервер авторизации предотвращает атаки повторного использования refresh токенов для публичных клиентов, предпочтительно используя sender-constrained refresh токены, такие как DPoP или сертификат-связанные токены с mutual TLS (mTLS). Для L1 и L2 допускается ротация refresh токенов с обязательной их инвалидацией после использования. Если используется ротация, сервер должен отозвать все refresh токены при попытке использовать уже инвалидированный токен.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.6", + "Ordinal": 6, + "Description": "Убедитесь, что при использовании типа авторизации «Authorization Code» сервер предотвращает атаки перехвата authorization code, требуя Proof Key for Code Exchange (PKCE). В запросах авторизации сервер должен требовать валидное значение 'code_challenge' и не принимать 'code_challenge_method' со значением 'plain'. В запросах токена обязательно валидировать параметр 'code_verifier'.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.7", + "Ordinal": 7, + "Description": "Убедитесь, что если сервер авторизации поддерживает динамическую регистрацию клиентов без аутентификации, он минимизирует риски вредоносных клиентов. Сервер должен валидировать метаданные клиента (например, зарегистрированные URI), обеспечивать согласие пользователя и предупреждать пользователя перед обработкой запроса авторизации от недоверенного клиента.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.8", + "Ordinal": 8, + "Description": "Убедитесь, что refresh токены имеют абсолютный срок действия, включая случаи, когда применяется скользящее время истечения срока.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.9", + "Ordinal": 9, + "Description": "Убедитесь, что пользователи могут отзывать refresh токены и reference access токены через пользовательский интерфейс сервера авторизации для снижения риска от вредоносных клиентов или кражи токенов.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.10", + "Ordinal": 10, + "Description": "Убедитесь, что конфиденциальный клиент аутентифицируется при взаимодействии с сервером авторизации через backchannel, например при запросах токена, pushed authorization requests (PAR) и запросах на отзыв токенов.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.11", + "Ordinal": 11, + "Description": "Убедитесь, что конфигурация сервера авторизации назначает OAuth клиенту только необходимые области доступа (scopes).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.12", + "Ordinal": 12, + "Description": "Убедитесь, что для конкретного клиента сервер авторизации разрешает только те значения 'response_mode', которые необходимы этому клиенту. Например, сервер должен валидировать это значение против ожидаемых или использовать pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.13", + "Ordinal": 13, + "Description": "Убедитесь, что грант типа 'code' всегда используется вместе с pushed authorization requests (PAR).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.14", + "Ordinal": 14, + "Description": "Убедитесь, что сервер авторизации выдаёт только sender-constrained (Proof-of-Possession) access токены, либо с сертификат-связанными токенами через mutual TLS (mTLS), либо DPoP-bound токены (Demonstration of Proof of Possession).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.15", + "Ordinal": 15, + "Description": "Убедитесь, что для серверного клиента (не выполняющегося на устройстве конечного пользователя) сервер авторизации проверяет, что значение параметра 'authorization_details' исходит из клиентского backend и что пользователь не изменял его. Например, это достигается использованием pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.4.16", + "Ordinal": 16, + "Description": "Убедитесь, что клиент является конфиденциальным и сервер авторизации требует использования сильных методов аутентификации клиента (основанных на криптографии с открытым ключом и устойчивых к атакам повторного воспроизведения), таких как mutual TLS ('tls_client_auth', 'self_signed_tls_client_auth') или private key JWT ('private_key_jwt').", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.5", + "Ordinal": 5, + "Name": "Клиент OIDC", + "Items": [ + { + "Shortcode": "V10.5.1", + "Ordinal": 1, + "Description": "Убедитесь, что клиент (relying party) защищается от повторного использования ID Token (replay-атак). Например, это достигается проверкой того, что значение 'nonce' в ID Token совпадает со значением 'nonce', отправленным в запросе аутентификации провайдеру OpenID (authorization server).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.5.2", + "Ordinal": 2, + "Description": "Убедитесь, что клиент однозначно идентифицирует пользователя по утверждениям (claims) ID Token, обычно это 'sub', который не может быть переназначен другому пользователю (в пределах конкретного провайдера идентификации).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.5.3", + "Ordinal": 3, + "Description": "Убедитесь, что клиент отклоняет попытки злоумышленного сервера авторизации выдавать себя за другой сервер авторизации через метаданные сервера авторизации. Клиент должен отклонить метаданные, если URL издателя (issuer) в метаданных не совпадает точно с преднастроенным URL издателя, ожидаемым клиентом.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.5.4", + "Ordinal": 4, + "Description": "Убедитесь, что клиент проверяет, что ID Token предназначен для него (проверка audience), сравнивая значение 'aud' в токене с 'client_id' клиента.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.5.5", + "Ordinal": 5, + "Description": "Убедитесь, что при использовании OIDC back-channel logout клиент снижает риск отказа в обслуживании, вызванный принудительным выходом из системы и путаницей между разными типами JWT (cross-JWT confusion) в процессе логаута. Клиент должен проверить, что токен выхода корректно типизирован со значением 'logout+jwt', содержит claim 'event' с правильным именем участника и не содержит 'nonce'. Также рекомендуется установить короткий срок действия токена (например, 2 минуты).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.6", + "Ordinal": 6, + "Name": "Провайдер OpenID", + "Items": [ + { + "Shortcode": "V10.6.1", + "Ordinal": 1, + "Description": "Убедитесь, что провайдер OpenID допускает только значения 'code', 'ciba', 'id_token' или 'id_token code' для параметра response mode. При этом предпочтение отдаётся 'code' по сравнению с 'id_token code' (гибридный поток OIDC), а значение 'token' (любой Implicit flow) не должно использоваться.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.6.2", + "Ordinal": 2, + "Description": "Убедитесь, что провайдер OpenID предотвращает отказ в обслуживании (DoS) через принудительный выход (logout), запрашивая явное подтверждение от конечного пользователя или, если применимо, проверяя параметры в запросе выхода (инициированном relying party), например параметр 'id_token_hint'.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V10.7", + "Ordinal": 7, + "Name": "Управление согласием", + "Items": [ + { + "Shortcode": "V10.7.1", + "Ordinal": 1, + "Description": "Убедитесь, что авторизационный сервер обеспечивает получение согласия пользователя для каждого запроса авторизации. Если личность клиента не может быть подтверждена, сервер авторизации всегда должен явно запрашивать согласие пользователя.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.7.2", + "Ordinal": 2, + "Description": "Убедитесь, что при запросе согласия пользователя авторизационный сервер предоставляет достаточную и понятную информацию о том, на что даётся согласие. При необходимости это должно включать характер запрашиваемых разрешений (обычно основанных на scope, ресурсном сервере, деталях авторизации Rich Authorization Requests (RAR)), идентификацию авторизованного приложения и срок действия этих разрешений.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V10.7.3", + "Ordinal": 3, + "Description": "Убедитесь, что пользователь может просматривать, изменять и отзывать согласия, которые он предоставил, через авторизационный сервер.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V11", + "Ordinal": 11, + "ShortName": "Cryptography", + "Name": "Криптография", + "Items": [ + { + "Shortcode": "V11.1", + "Ordinal": 1, + "Name": "Инвентаризация и документирование криптографии", + "Items": [ + { + "Shortcode": "V11.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что задокументирована политика управления криптографическими ключами и описан их жизненный цикл в соответствии со стандартом управления ключей, таким как NIST SP 800-57. Убедитесь, что ключи известны только тем сущностям, которым они должны быть доступны (например, ключи не передавались более чем двум участникам для общих секретов и более чем одному участнику для приватных ключей).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что проводится инвентаризация криптографических средств, которая непрерывно поддерживается, регулярно обновляется и включает все криптографические ключи, алгоритмы и сертификаты, используемые в приложении. Также должна быть задокументирована информация о том, где ключи могут и не могут использоваться в системе, а также какие типы данных могут и не могут быть защищены с помощью этих ключей.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что используются механизмы обнаружения криптографии для идентификации всех случаев применения криптографии в системе , включая операции шифрования, хеширования и цифровой подписи.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.1.4", + "Ordinal": 4, + "Description": "Убедитесь, что ведётся и поддерживается инвентаризация криптографических средств. В неё должен входить документированный план, описывающий переход на новые криптографические стандарты, такие как постквантовая криптография, чтобы своевременно реагировать на будущие угрозы.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.2", + "Ordinal": 2, + "Name": "Безопасная реализация криптографии", + "Items": [ + { + "Shortcode": "V11.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что для криптографических операций используются утвержденные в индустрии реализации (включая библиотеки и аппаратные реализации).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что архитектура приложения поддерживает быструю реконфигурацию, усовершенствование или смену в любой момент случайных чисел, аутентифицированного шифрования, MAC, алгоритмов хеширования, длин ключей, количества раундов, шифров и режимов шифрования для защиты от криптографических атак. Также должна поддерживаться возможность смены ключей, паролей и повторного шифрования данных. Это позволит беспрепятственно перейти на постквантовую криптографию (PQC), как только станут широко доступны высоконадёжные реализации одобренных схем или стандартов PQC.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что все криптографические примитивы используют как минимум 128-бит стойкости с учетом алгоритма, размера ключа и конфигурации. Например, 256-битный ECC ключ обеспечивает примерно 128 бит безопасности, тогда как для достижения того же уровня безопасности в RSA требуется ключ длиной 3072 бита.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что все криптографические операции выполняются за константное время, без использования «short-circuit» операций в сравнениях, вычислениях, возвратах функций для избежания утечек информации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что все криптографические модули обеспечивают безопасное завершение работы при ошибках, а обработка ошибок реализована таким образом, чтобы не создавать уязвимостей, например, таких как атаки Padding Oracle.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.3", + "Ordinal": 3, + "Name": "Алгоритмы шифрования", + "Items": [ + { + "Shortcode": "V11.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что не используются небезопасные режимы блочного шифрования (н-р, ECB) и слабые схемы дополнения (padding) (н-р, PKCS#1 v1.5).", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что используются только утверждённые шифры и режимы, такие как AES с GCM.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что зашифрованные данные защищены от несанкционированного изменения, предпочтительно с использованием утверждённого метода аутентифицированного шифрования или путём комбинирования утверждённого метода шифрования с утверждённым алгоритмом MAC.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что случайные числа (nonce), векторы инициализации (IV) и другие одноразовые числа не используются более одного раза для одной и той же пары ключа шифрования и элемента данных. Метод их генерации должен соответствовать требованиям используемого алгоритма.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.3.5", + "Ordinal": 5, + "Description": "Убедитесь, что любая комбинация алгоритма шифрования и алгоритма MAC работает в режиме encrypt-then-MAC (EtM).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.4", + "Ordinal": 4, + "Name": "Хеширование и функции на основе хеширования", + "Items": [ + { + "Shortcode": "V11.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что только утвержденные хэш-функции используются для стандартных сценариев использования в криптографии, включая цифровую подпись, HMAC, KDF, генерацию случайных чисел. Запрещено использовать неустойчивые хэш-функции, (н-р, MD5) для любого использования в криптографии.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что пароли хранятся с использованием утверждённой, вычислительно затратной функции генерации ключа (также известной как «функция хеширования паролей»), с параметрами, настроенными в соответствии с актуальными рекомендациями. Настройки должны обеспечивать баланс между безопасностью и производительностью, чтобы сделать атаки перебором достаточно сложными для требуемого уровня безопасности.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что хэш-функции, используемые в формировании цифровой подписи, как часть аутентификации и целостности данных, устойчивы к коллизиям и имеют достаточную длину.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.4.4", + "Ordinal": 4, + "Description": "Убедитесь, что приложение использует утвержденную функцию генерации ключа с использованием параметров расширения ключа (key stretching) при генерации ключа из пароля. Параметры должны быть сбалансированы с точки зрения безопасности, производительности и устойчивости к атакам полного перебора при компрометации результирующего криптографического ключа.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.5", + "Ordinal": 5, + "Name": "Случайные значения", + "Items": [ + { + "Shortcode": "V11.5.1", + "Ordinal": 1, + "Description": "Убедитесь, что все случайные числа и строки, которые должны быть непредсказуемы, должны быть сгенерированы с помощью CSPRNG и иметь хотя бы 128 бит энтропии. Учтите, что UUID не удовлетворяют данному условию.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.5.2", + "Ordinal": 2, + "Description": "Убедитесь, что механизм генерации случайных чисел является надежным даже при высокой нагрузке.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.6", + "Ordinal": 6, + "Name": "Криптография с публичным ключом", + "Items": [ + { + "Shortcode": "V11.6.1", + "Ordinal": 1, + "Description": "Убедитесь, что только утвержденные криптографические алгоритмы и режимы операций используются для генерации ключа и инициализации случайного значения для его генерации (seeding), а также для генерации цифровой подписи и верификации. Алгоритмы генерации ключей не должны генерировать небезопасные ключи уязвимые к известным атакам, например, ключи RSA уязвимы к факторизации Ферма.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.6.2", + "Ordinal": 2, + "Description": "Убедитесь, что для обмена ключами используются утверждённые криптографические алгоритмы (например, Диффи-Хеллман) с особым вниманием к обеспечению использования безопасных параметров. Это предотвратит атаки на процесс установления ключа, которые могут привести к атакам «человек посередине» или криптографическим взломам.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V11.7", + "Ordinal": 7, + "Name": "Шифрование данных в процессе использования", + "Items": [ + { + "Shortcode": "V11.7.1", + "Ordinal": 1, + "Description": "Убедитесь, что используется полное шифрование памяти, которое защищает конфиденциальные данные во время их использования, предотвращая доступ к ним неавторизованных пользователей или процессов.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V11.7.2", + "Ordinal": 2, + "Description": "Убедитесь, что минимизация данных обеспечивает раскрытие минимально необходимого объёма данных во время обработки, а также что данные шифруются сразу после использования или как можно скорее.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V12", + "Ordinal": 12, + "ShortName": "Secure", + "Name": "Безопасная коммуникация", + "Items": [ + { + "Shortcode": "V12.1", + "Ordinal": 1, + "Name": "Общие рекомендации по безопасности TLS", + "Items": [ + { + "Shortcode": "V12.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что включены только актуальные и рекомендуемые версии протокола TLS, такие как TLS 1.2 и TLS 1.3. Наиболее свежая версия TLS должна быть выбрана как предпочтительная.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что включены рекомендуемые шифронаборы (cipher suites), предпочтение также стоит отдать самому сильному шифронабору. L3 приложения должны поддерживать только те наборы шифров (cipher suites), которые обеспечивают прямую (forward) секретность. Пояснение: Прямая секретность (Forward Secrecy, FS) — это криптографическая особенность, при которой сессионные ключи уникальны для каждой сессии и не зависят от долгосрочных ключей. Это гарантирует, что даже при компрометации долгосрочного ключа злоумышленник не сможет расшифровать ранее перехваченные зашифрованные сессии.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение проверяет доверенность клиентских сертификатов mTLS, прежде чем использовать идентификацию по сертификату для аутентификации или авторизации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.1.4", + "Ordinal": 4, + "Description": "Убедитесь, что включена и настроена правильная проверка отзыва сертификатов, такая как Online Certificate Status Protocol (OCSP) Stapling.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.1.5", + "Ordinal": 5, + "Description": "Убедитесь, что в настройках TLS приложения включена функция Encrypted Client Hello (ECH) для предотвращения раскрытия конфиденциальных метаданных, таких как Server Name Indication (SNI), во время процесса TLS-рукопожатия.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V12.2", + "Ordinal": 2, + "Name": "HTTPS коммуникация с внешними сервисами", + "Items": [ + { + "Shortcode": "V12.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что для всех соединений между клиентом и внешними HTTP-сервисами используется TLS и не происходит отката к небезопасным или незашифрованным протоколам.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что внешние сервисы используют публично доверенные TLS-сертификаты.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V12.3", + "Ordinal": 3, + "Name": "Общая безопасность межсервисного взаимодействия", + "Items": [ + { + "Shortcode": "V12.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что для всех входящих и исходящих соединений приложения используется зашифрованный протокол, например TLS, включая системы мониторинга, инструменты управления, удалённый доступ и SSH, промежуточное ПО, базы данных, мейнфреймы, партнёрские системы и внешние API. Сервер не должен допускать откат к небезопасным или незашифрованным протоколам.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что TLS-клиент проверяет сертификат сервера до установления защищенного соединения с TLS-сервером.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что все внутренние HTTP-взаимодействия между компонентами приложения используют TLS или другой подходящий механизм транспортного шифрования, и не происходит откат к небезопасным или незашифрованным коммуникациям.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что TLS-соединения между внутренними сервисами используют доверенные сертификаты. Если используются внутренние или самоподписанные сертификаты, потребляющий сервис должен быть настроен на доверие только к конкретным внутренним центрам сертификации (CA) и конкретным самоподписанным сертификатам.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V12.3.5", + "Ordinal": 5, + "Description": "Убедитесь, что сервисы, взаимодействующие внутри системы (intra-service communications), используют строгую аутентификацию для проверки каждого конечного узла. Для проверки подлинности взаимодействующих сторон должны применяться методы строгой аутентификации, такие как аутентификация TLS-клиента, с использованием инфраструктуры открытых ключей и механизмов, устойчивых к атакам повтора (replay attacks). Для микросервисных архитектур рекомендуется использование service mesh для упрощения управления сертификатами и повышения безопасности.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V13", + "Ordinal": 13, + "ShortName": "Configuration", + "Name": "Конфигурация", + "Items": [ + { + "Shortcode": "V13.1", + "Ordinal": 1, + "Name": "Документация конфигурации", + "Items": [ + { + "Shortcode": "V13.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что все необходимые доступы приложения задокументированы. Сюда должны быть включены как внешние сервисы, от которых зависит приложение, так и сценарии, когда конечный пользователь может задавать адреса для внешнего подключения.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что для каждого сервиса, используемого приложением, в документации определено максимальное количество одновременных соединений (например, лимиты пула соединений) и описано поведение приложения при достижении этого лимита, включая любые механизмы отказоустойчивости или восстановления, чтобы предотвратить ситуации отказа в обслуживании (DoS).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что в документации приложения определены стратегии управления ресурсами для каждой внешней системы или сервиса, которые оно использует (например, базы данных, файловые дескрипторы, потоки, HTTP-соединения). Стратегии должны включать процедуры освобождения ресурсов, настройки таймаутов, обработку сбоев, а также, если реализована логика повторных попыток, указание лимитов, задержек и алгоритмов back-off. Для синхронных HTTP-запросов должны быть заданы короткие таймауты, а повторные запросы должны быть отключены, либо строго ограничены по числу попыток, чтобы предотвратить каскадные задержки и истощение ресурсов.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.1.4", + "Ordinal": 4, + "Description": "Убедитесь, что в документации приложения определены секреты, критически важные для безопасности приложения, а также установлен график их ротации в соответствии с моделью угроз организации и её бизнес-требованиями.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V13.2", + "Ordinal": 2, + "Name": "Конфигурация бэкенд соединений", + "Items": [ + { + "Shortcode": "V13.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что коммуникации между компонентами бэкенда приложения (включая API, промежуточное ПО и уровни данных), которые не поддерживают стандартный механизм пользовательских сессий, проходят с аутентификацией. Аутентификация должна использовать индивидуальные сервисные аккаунты, краткосрочные токены или аутентификацию на основе сертификатов, а не постоянные учётные данные, такие как пароли, API-ключи или общие аккаунты с привилегированным доступом.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что коммуникации между компонентами бэкенда приложения, включая локальные или системные службы, API, промежуточное ПО и уровни данных, выполняются с использованием аккаунтов, которым назначены минимально необходимые привилегии.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что если для аутентификации в сервисе используются учётные данные, то используемые потребителем учётные данные не являются стандартными (например, root/root или admin/admin).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что используется белый список (allowlist) для определения внешних ресурсов или систем, с которыми приложению разрешено взаимодействовать (например, для исходящих запросов, загрузки данных или доступа к файлам). Этот белый список может быть реализован на уровне приложения, веб-сервера, межсетевого экрана или комбинации различных уровней.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что веб- или прикладной сервер настроен с белым списком ресурсов или систем, к которым сервер может отправлять запросы или из которых может загружать данные и файлы.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.2.6", + "Ordinal": 6, + "Description": "Убедитесь, что при подключении приложения к другим сервисам соблюдается задокументированная конфигурация для каждого соединения, включая максимальное количество параллельных соединений, поведение при достижении их максимума, таймауты и стратегии повторных попыток подключения.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V13.3", + "Ordinal": 3, + "Name": "Управление секретами", + "Items": [ + { + "Shortcode": "V13.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что для безопасного создания, хранения, контроля доступа и уничтожения секретов бэкенда используется решение для управления секретами, например, хранилище ключей (key vault). Секретами могут быть пароли, ключевой материал, интеграции с базами данных и сторонними системами, ключи и seed-значения для токенов с ограниченным временем действия, другие внутренние секреты и API-ключи. Секреты не должны включаться в исходный код приложения или артефакты сборки. Для приложений уровня L3 необходимо использовать аппаратное решение, например, аппаратный модуль безопасности (HSM).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что доступ к секретным ресурсам осуществляется в соответствии с принципом минимально необходимых привилегий (least privilege).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что все криптографические операции выполняются с использованием изолированного модуля безопасности (например, хранилища ключей или аппаратного модуля безопасности), чтобы надежно управлять ключевым материалом и защищать его от утечки за пределы модуля безопасности.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что секреты настроены на срок действия и ротацию в соответствии с документацией приложения.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V13.4", + "Ordinal": 4, + "Name": "Непреднамеренная утечка информации", + "Items": [ + { + "Shortcode": "V13.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение развернуто либо без метаданных систем контроля версий (включая папки .git или .svn), либо так, чтобы эти папки были недоступны как извне, так и для самого приложения.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что режимы отладки отключены для всех компонентов в промышленной среде, чтобы предотвратить раскрытие функций отладки и утечку информации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что веб-серверы не показывают клиентам списки содержимого каталогов, если это явно не предусмотрено.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.4", + "Ordinal": 4, + "Description": "Убедитесь, что метод HTTP TRACE не поддерживается в продуктовой среде, чтобы избежать потенциальной утечки информации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.5", + "Ordinal": 5, + "Description": "Убедитесь, что документация (например, по внутренним API) и мониторинговые эндпоинты не доступны, если это явно не предусмотрено.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.6", + "Ordinal": 6, + "Description": "Убедитесь, что приложение не раскрывает подробную информацию о версиях компонентов бэкенда.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V13.4.7", + "Ordinal": 7, + "Description": "Убедитесь, что веб-слой настроен на обслуживание только файлов с определёнными расширениями, чтобы предотвратить непреднамеренную утечку информации, конфигураций и исходного кода.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V14", + "Ordinal": 14, + "ShortName": "Data", + "Name": "Защита информации", + "Items": [ + { + "Shortcode": "V14.1", + "Ordinal": 1, + "Name": "Документация по защите информации", + "Items": [ + { + "Shortcode": "V14.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что все конфиденциальные данные, создаваемые и обрабатываемые приложением, идентифицированы и классифицированы по уровням защиты. Включая закодированные данные, которые легко декодируются, например, строки Base64 или незашифрованные данные в полезной нагрузке JWT. Уровни защиты должны учитывать требования по защите данных и конфиденциальности, которым должно соответствовать приложение.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что для каждого уровня защиты конфиденциальных данных требования к защите задокументированы. Они должны включать (но не ограничиваться) требования по шифрованию, проверке целостности, срокам хранения, способам логирования данных, контролю доступа к чувствительным данным в логах, шифрованию на уровне базы данных, применению технологий повышения конфиденциальности, а также другим требованиям по конфиденциальности.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V14.2", + "Ordinal": 2, + "Name": "Базовые меры по защите информации", + "Items": [ + { + "Shortcode": "V14.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что конфиденциальные данные передаются на сервер только в теле HTTP-запроса или в заголовках. URL и строка запроса не должны содержать конфиденциальную информацию, такую как API-ключ или сессионный токен.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение предотвращает кэширование конфиденциальных данных в серверных компонентах, таких как балансировщики нагрузки и кэши приложений, либо гарантирует их надежное удаление после использования.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что заранее определённые конфиденциальные данные не отправляются ненадёжным сторонам (например, системам трекинга пользователей), чтобы предотвратить нежелательный сбор данных вне контроля приложения.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что для конфиденциальных данных реализованы меры по шифрованию, проверке целостности, срокам хранения, способам логирования, контролю доступа к данным в логах, а также применяются технологии повышения конфиденциальности в соответствии с документацией для соответствующего уровня защиты данных.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что механизмы кэширования настроены так, чтобы кэшировать только ответы с ожидаемым типом содержимого для данного ресурса и не содержать конфиденциального динамического контента. При обращении к несуществующему файлу, веб-сервер должен возвращать ответ 404 или 302, а не подменять на другой существующий файл, что позволит предотвратить атаки типа Web Cache Deception.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.6", + "Ordinal": 6, + "Description": "Убедитесь, что приложение возвращает только минимально необходимый объем конфиденциальных данных для выполнения своей функциональности. Например, показывает только часть цифр номера кредитной карты, а не полный номер. Если требуется отображение полных данных, они должны быть замаскированы в пользовательском интерфейсе, пока пользователь специально не запросил их просмотр.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.7", + "Ordinal": 7, + "Description": "Убедитесь, что конфиденциальная информация подлежит классификации по срокам хранения, чтобы устаревшие или ненужные данные удалялись автоматически, по расписанию или по мере необходимости.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.2.8", + "Ordinal": 8, + "Description": "Убедитесь, что конфиденциальная информация удаляется из метаданных файлов, загружаемых пользователями, если пользователь явно не согласился на ее хранение.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V14.3", + "Ordinal": 3, + "Name": "Защита данных на стороне клиента", + "Items": [ + { + "Shortcode": "V14.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что аутентифицированные данные очищаются из клиентского хранилища, например, из DOM браузера, после завершения работы клиента или сессии. Заголовок HTTP-ответа Clear-Site-Data может помочь в этом, но клиентская сторона также должна уметь очищать данные, если соединение с сервером недоступно при завершении сессии.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение устанавливает HTTP-заголовки, достаточные для предотвращения кэширования (например, Cache-Control: no-store), чтобы конфиденциальные данные не сохранялись в браузерах.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V14.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что данные, хранящиеся в браузерном хранилище (например, localStorage, sessionStorage, IndexedDB или cookie), не содержат конфиденциальной информации, за исключением сессионных токенов.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V15", + "Ordinal": 15, + "ShortName": "Secure", + "Name": "Безопасная разработка и архитектура", + "Items": [ + { + "Shortcode": "V15.1", + "Ordinal": 1, + "Name": "Документация по безопасной разработке и архитектуре", + "Items": [ + { + "Shortcode": "V15.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что в документации по приложению определены сроки устранения уязвимостей на основе оценки рисков для внешних зависимостей с уязвимостями и для обновления библиотек в целом, чтобы минимизировать риск, связанный с этими компонентами.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что ведется реестр всех используемых сторонних библиотек (например, Software Bill of Materials, SBOM), с обязательной проверкой, что компоненты получены из предопределенных, доверенных и регулярно поддерживаемых репозиториев.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.1.3", + "Ordinal": 3, + "Description": "Убедитесь, что в документации приложения указан функционал, требующий значительных временных или вычислительных ресурсов. Необходимо указать, как предотвратить потерю доступности из-за чрезмерного использования этого функционала и как избежать ситуаций, когда формирование ответа занимает больше времени, чем установленный системой таймаут. Возможные меры защиты могут включать асинхронную обработку, использование очередей и ограничение количества параллельных процессов для каждого пользователя и приложения.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.1.4", + "Ordinal": 4, + "Description": "Убедитесь, что в документации приложения указаны внешние библиотеки, которые считаются «компонентами с повышенным риском».", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.1.5", + "Ordinal": 5, + "Description": "Убедитесь, что в документации приложения выделены те части приложения, в которых используются «функционал с повышенным риском».", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V15.2", + "Ordinal": 2, + "Name": "Архитектура безопасности и зависимости", + "Items": [ + { + "Shortcode": "V15.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение содержит только те компоненты, которые не нарушили задокументированные сроки обновления и исправления.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что в приложении реализованы меры защиты от потери доступности из-за функциональности, требующей много времени или ресурсов, на основе задокументированных решений и стратегий безопасности для этого.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что производственная среда включает только те функции, которые необходимы для работы приложения, и не предоставляет лишние функции, такие как тестовый код, примеры кода и инструменты разработки.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что сторонние компоненты и все их транзитивные зависимости загружаются только из ожидаемых репозиториев (внутренних или внешних) и отсутствует риск атаки через подмену зависимостей (dependency confusion attack)", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что приложение реализует дополнительные меры защиты для тех частей приложения, которые документированы как содержащие «функционал с повышенным риском» или использующие сторонние библиотеки, считающиеся «функционалом с повышенным риском». Это могут быть такие методы, как «песочница», инкапсуляция, контейнеризация или изоляция на сетевом уровне, чтобы задержать и предотвратить продвижение (pivoting) злоумышленников, скомпрометировавших одну часть приложения, к другим частям приложения.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V15.3", + "Ordinal": 3, + "Name": "Безопасное программирование", + "Items": [ + { + "Shortcode": "V15.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что приложение возвращает только необходимое подмножество полей из объекта данных. Например, оно не должно возвращать весь объект данных, поскольку некоторые отдельные поля должны быть недоступны пользователям.", + "L1": { + "Required": true, + "Requirement": "✓" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что при вызовах внешних URL-адресов бэкэнд приложения настроен так, чтобы не выполнять перенаправления, если только это не предусмотрено функционалом.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что в приложении реализованы защитные механизмы против атак типа массового присвоения (mass assignment) путем строгого ограничения разрешенных полей для каждого контроллера и действия, исключая возможность добавления или изменения значений полей, которые не должны быть доступны для данной конкретной операции.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что все прокси и промежуточное ПО корректно передают исходный IP-адрес пользователя, используя доверенные поля данных, которые не могут быть изменены конечным пользователем, а приложение и веб-сервер используют это правильное значение для ведения логирования и принятия решений по безопасности, таких как ограничение запросов. При этом следует учитывать, что даже исходный IP-адрес может быть ненадежным из-за динамических IP-адресов, VPN или корпоративных файрволов.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.5", + "Ordinal": 5, + "Description": "Убедитесь, что приложение явно проверяет соответствие переменных ожидаемому типу данных и использует строгие операции сравнения. Это необходимо для предотвращения уязвимостей, связанных с type juggling и type confusion, вызванных тем, что код приложения делает предположения о типе переменной.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.6", + "Ordinal": 6, + "Description": "Убедитесь, что JavaScript-код написан таким образом, чтобы предотвратить prototype pollution, например, используя Set() или Map() вместо обычных литералов объекта.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.3.7", + "Ordinal": 7, + "Description": "Убедитесь, что приложение защищено от атак типа HTTP Parameter Pollution (HPP), особенно если используемый фреймворк не различает источники параметров запроса (строка запроса, тело запроса, куки или заголовки).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V15.4", + "Ordinal": 4, + "Name": "Безопасная работа с параллельными процессами", + "Items": [ + { + "Shortcode": "V15.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что к общим объектам в многопоточном коде (например, кэшам, файлам или объектам в памяти, используемым несколькими потоками) используется безопасный многопоточный доступ и механизмов синхронизации, таких как блокировки или семафоры, чтобы избежать состояний гонки и повреждения данных.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что проверки состояния ресурса, например его существования или разрешений, а также зависящие от него действия выполняются как одна атомарная операция, чтобы предотвратить условия гонки времени проверки и времени использования (TOCTOU). Например, проверка существования файла перед его открытием или проверка прав доступа пользователя перед его предоставлением.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что блокировки применяются согласованно, чтобы предотвратить взаимные блокировки потоков (deadlocks) или их бесконечные повторы, а также что логика блокировки инкапсулирована в коде, отвечающем за управление ресурсом. Это гарантирует, что блокировки не могут быть случайно или намеренно изменены внешними классами или кодом.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V15.4.4", + "Ordinal": 4, + "Description": "Убедитесь, что политики распределения ресурсов предотвращают нехватку ресурсов у потоков, обеспечивая справедливый доступ к ресурсам, например, используя пулы потоков, позволяя потокам с более низким приоритетом выполняться в течение разумного периода времени.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V16", + "Ordinal": 16, + "ShortName": "Security", + "Name": "Журналирование событий безопасности и обработка ошибок", + "Items": [ + { + "Shortcode": "V16.1", + "Ordinal": 1, + "Name": "Документация по ведению логов", + "Items": [ + { + "Shortcode": "V16.1.1", + "Ordinal": 1, + "Description": "Убедитесь в существовании реестра, в котором документируется ведение журнала на каждом уровне технологического стека приложения, включая какие события регистрируются, форматы логов, где хранятся эти журналы, как они используются, как контролируется доступ к ним и как долго хранятся журналы.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V16.2", + "Ordinal": 2, + "Name": "Общее журналирование", + "Items": [ + { + "Shortcode": "V16.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что каждая запись журнала содержит необходимые метаданные (например, когда, где, кто, что), которые позволят провести подробное исследование временной шкалы, когда произошло событие.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что все источники времени компонентов системы журналирования синхронизированы, а временные метки в метаданных событий безопасности используют UTC или содержат явное указание смещения часового пояса. Рекомендуется применять UTC для обеспечения согласованности в распределённых системах и предотвращения ошибок при переходе на летнее/зимнее время.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение записывает и передаёт логи исключительно в те файлы и сервисы, которые указаны в реестре журналирования.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что логи могут быть прочитаны и коррелированы используемой системой обработки журналов, предпочтительно с использованием общего стандартного формата логирования.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что приложение применяет соответствующие меры защиты при логировании конфиденциальных данных в зависимости от уровня их чувствительности: например, полностью запрещает запись в логи таких данных, как учетные данные или платежные реквизиты, а для других данных (например, сессионных токенов) использует хеширование или частичное/полное маскирование.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V16.3", + "Ordinal": 3, + "Name": "Инциденты безопасности", + "Items": [ + { + "Shortcode": "V16.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что все операции аутентификации регистрируются, включая успешные и неудачные попытки. Также следует фиксировать дополнительные метаданные, такие как тип аутентификации или использованные факторы проверки.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что ведется журнал неудачных попыток авторизации. Для уровня L3 это должно включать в себя журналирование всех решений об авторизации, включая журналирование доступа к конфиденциальным данным (без регистрации самих конфиденциальных данных).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.3.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение регистрирует все события безопасности, определенные в документации, а также фиксирует попытки обхода механизмов защиты, включая проверку входных данных, бизнес-логики и системы защиты от автоматизированных атак.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.3.4", + "Ordinal": 4, + "Description": "Убедитесь, что приложение регистрирует в журналах неожиданные ошибки и сбои механизмов безопасности, включая, например, ошибки TLS-соединения на стороне сервера.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V16.4", + "Ordinal": 4, + "Name": "Защита журналов", + "Items": [ + { + "Shortcode": "V16.4.1", + "Ordinal": 1, + "Description": "Убедитесь, что все компоненты системы логирования корректно кодируют данные, чтобы предотвратить атаки типа внедрения в журналы (log injection).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.4.2", + "Ordinal": 2, + "Description": "Убедитесь, что логи защищены от неавторизованного доступа и не могут быть модифицированы.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.4.3", + "Ordinal": 3, + "Description": "Убедитесь, что логи безопасно передаются в логически изолированную систему для анализа, обнаружения угроз, генерации оповещений и эскалации инцидентов. Это гарантирует сохранность журналов даже в случае компрометации основного приложения.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V16.5", + "Ordinal": 5, + "Name": "Обработка ошибок", + "Items": [ + { + "Shortcode": "V16.5.1", + "Ordinal": 1, + "Description": "Убедитесь, что при возникновении непредвиденной или связанной с безопасностью ошибки пользователю возвращается только общее сообщение, гарантируя отсутствие раскрытия конфиденциальных внутренних данных системы, таких как трассировки стека, запросы, секретные ключи и токены.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.5.2", + "Ordinal": 2, + "Description": "Убедитесь, что приложение продолжает работать в безопасном режиме при недоступности внешних ресурсов, используя такие механизмы, как автоматические выключатели (circuit breakers) или плавное снижение функциональности (graceful degradation).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.5.3", + "Ordinal": 3, + "Description": "Убедитесь, что приложение корректно и безопасно завершает работу при возникновении исключений, предотвращая опасные сценарии по типу «fail-open», когда, например, транзакция ошибочно выполняется, несмотря на ошибки в логике валидации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V16.5.4", + "Ordinal": 4, + "Description": "Убедитесь, что определён обработчик ошибок «крайние меры», который будет перехватывать все необработанные ошибки. Это необходимо как для предотвращения потери информации об ошибках, которая должна быть записана в файлы журналов, так и для того, чтобы ошибка не остановила весь процесс приложения, что привело бы к потере доступности.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + }, + { + "Shortcode": "V17", + "Ordinal": 17, + "ShortName": "WebRTC", + "Name": "WebRTC", + "Items": [ + { + "Shortcode": "V17.1", + "Ordinal": 1, + "Name": "TURN-сервер", + "Items": [ + { + "Shortcode": "V17.1.1", + "Ordinal": 1, + "Description": "Убедитесь, что сервис TURN (Traversal Using Relays around NAT) разрешает доступ только к IP-адресам, не зарезервированным для специальных целей (например, внутренние сети, широковещательная рассылка, loopback-адреса). Данное требование применяется как к IPv4, так и к IPv6 адресам.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.1.2", + "Ordinal": 2, + "Description": "Убедитесь, что сервис TURN (Traversal Using Relays around NAT) защищен от исчерпания ресурсов при попытках легитимных пользователей открыть чрезмерное количество портов на сервере.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V17.2", + "Ordinal": 2, + "Name": "Требования к медиасерверам", + "Items": [ + { + "Shortcode": "V17.2.1", + "Ordinal": 1, + "Description": "Убедитесь, что ключ сертификата Datagram Transport Layer Security (DTLS) управляется и защищается в соответствии с документированной политикой управления криптографическими ключами.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.2", + "Ordinal": 2, + "Description": "Убедитесь, что медиасервер настроен на использование только одобренных наборов шифров Datagram Transport Layer Security (DTLS) и защищенного профиля безопасности для расширения DTLS, применяемого при установке ключей для Secure Real-time Transport Protocol (DTLS-SRTP).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.3", + "Ordinal": 3, + "Description": "Убедитесь, что медиасервер проверяет аутентификацию Secure Real-time Transport Protocol (SRTP) для предотвращения атак с внедрением Real-time Transport Protocol (RTP), которые могут привести к отказу в обслуживании (Denial of Service) или вставке поддельного аудио-/видеоконтента в медиапотоки.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.4", + "Ordinal": 4, + "Description": "Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика при получении некорректных пакетов Secure Real-time Transport Protocol (SRTP).", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.5", + "Ordinal": 5, + "Description": "Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетами Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.6", + "Ordinal": 6, + "Description": "Убедитесь, что медиасервер не подвержен уязвимости «Гонка ClientHello» (ClientHello Race Condition) в Datagram Transport Layer Security (DTLS), проверив наличие известных уязвимостей в публичных источниках или выполнив тестирование на воспроизведение условий гонки.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.7", + "Ordinal": 7, + "Description": "Убедитесь, что механизмы аудио- и видеозаписи, связанные с медиасервером, способны продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетов Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.2.8", + "Ordinal": 8, + "Description": "Убедитесь, что сертификат Datagram Transport Layer Security (DTLS) проверяется на соответствие атрибуту отпечатка (fingerprint) в Session Description Protocol (SDP), с немедленным прекращением медиапотока в случае несоответствия — это гарантирует подлинность передаваемых данных.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": false, + "Requirement": "" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + }, + { + "Shortcode": "V17.3", + "Ordinal": 3, + "Name": "Сигнализация", + "Items": [ + { + "Shortcode": "V17.3.1", + "Ordinal": 1, + "Description": "Убедитесь, что сигнальный сервер способен продолжать обработку легитимных входящих сообщений сигнализации даже в условиях флуд-атаки. Для этого необходимо реализовать механизм ограничения частоты запросов (rate limiting) на уровне сигнализации.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + }, + { + "Shortcode": "V17.3.2", + "Ordinal": 2, + "Description": "Убедитесь, что сигнальный сервер способен продолжать обработку легитимных сообщений сигнализации даже при получении некорректных сообщений, которые могут вызвать отказ в обслуживании (Denial of Service, DoS). Для этого необходимо реализовать: проверку входных данных (input validation), безопасную обработку целочисленных переполнений (integer overflows), защиту от переполнения буферов (buffer overflows) и другие надежные методы обработки ошибок.", + "L1": { + "Required": false, + "Requirement": "" + }, + "L2": { + "Required": true, + "Requirement": "✓" + }, + "L3": { + "Required": true, + "Requirement": "✓" + }, + "CWE": [], + "NIST": [] + } + ] + } + ] + } + ] +} diff --git a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.xml b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.xml new file mode 100644 index 0000000000..6141d39972 --- /dev/null +++ b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.legacy.xml @@ -0,0 +1 @@ +Application Security Verification Standard ProjectASVSThe OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.V11EncodingКодировка и нейтрализацияV1.11Архитектура кодировки и нейтрализацииV1.1.11Убедитесь, что входные данные декодируются или деэкранируются в каноническую форму (в стандартное представление) только один раз. Декодирование происходит только тогда, когда ожидаются закодированные данные в этой форме, и что это делается перед дальнейшей обработкой входных данных, например, это не выполняется после проверки или нейтрализации.FalseTrue✓True✓V1.1.22Убедитесь, что приложение выполняет кодирование и экранирование выходных данных либо в качестве последнего шага перед использованием интерпретатором, для которого оно предназначено, либо самим интерпретатором.FalseTrue✓True✓V1.22Предотвращение инъекцийV1.2.11Убедитесь, что выходная кодировка для ответа HTTP, документа HTML или документа XML соответствует требуемому контексту, например, кодировка соответствующих символов для элементов HTML, атрибутов HTML, комментариев HTML, CSS или полей заголовка HTTP делается таким способом, чтобы избежать изменения структуры сообщения или документа.True✓True✓True✓V1.2.22Убедитесь, что при динамическом построении URL-адресов недоверенные данные кодируются в соответствии с их контекстом (например, кодирование URL-адресов или кодирование base64url для query или path параметров или пути). Убедитесь, что разрешены только безопасные протоколы URL-адресов (например, запрещен javascript: или data:).True✓True✓True✓V1.2.33Убедитесь, что при динамическом построении содержимого JavaScript (включая JSON) используется кодирование или экранирование выходных данных, чтобы избежать изменения структуры сообщения или документа (чтобы избежать JavaScript и JSON-инъекций).True✓True✓True✓V1.2.44Убедитесь, что выборка данных (Redis, Memcached, чтение из файлов, обращение по API) или запросы к базе данных (например, SQL, HQL, NoSQL, Cypher) используют параметризованные запросы, ORM, Entity Frameworks или иным образом защищены от SQL-инъекций и других атак. Это также актуально при написании хранимых процедур.True✓True✓True✓V1.2.55Убедитесь, что приложение защищено от внедрения команд ОС и что вызовы операционной системы используют параметризованные запросы к ОС или используют контекстное кодирование вывода командной строки.True✓True✓True✓V1.2.66Убедитесь, что приложение защищено от LDAP-инъекций, или что реализованы специальные меры безопасности для их предотвращения.FalseTrue✓True✓V1.2.77Убедитесь, что приложение защищено от атак с использованием XPath-инъекций с помощью параметризации запросов или предварительно скомпилированных запросов.FalseTrue✓True✓V1.2.88Убедитесь, что процессоры LaTeX настроены безопасно (например, не используется флаг «–shell‑escape») и используется разрешенный список команд для предотвращения LaTeX-инъекций.FalseTrue✓True✓V1.2.99Убедитесь, что приложение экранирует специальные символы в регулярных выражениях (обычно с помощью обратной косой черты), чтобы предотвратить их ошибочную интерпретацию как метасимволов.FalseTrue✓True✓V1.2.1010Убедитесь, что приложение защищено от внедрения формул CSV (CSV Injection). Приложение должно следовать правилам экранирования, определенным в RFC 4180, разделы 2.6 и 2.7, при экспорте содержимого CSV. Кроме того, при экспорте в CSV или другие форматы электронных таблиц (такие как XLS, XLSX или ODF) специальные символы (включая '=', '+', '-', '@', '\t' (табуляция), и '\0' (нулевой символ)) должны экранироваться одинарной кавычкой, если они появляются в качестве первого символа в значении поля.FalseFalseTrue✓V1.33НейтрализацияV1.3.11Убедитесь, что все ненадежные входные данные HTML из редакторов WYSIWYG или аналогичных программ нейтрализуются с помощью известных и безопасных библиотек или функций фреймворка для санитизации HTML.True✓True✓True✓V1.3.22Убедитесь, что приложение избегает использования eval() или других динамических функций выполнения кода, таких как Spring Expression Language (SpEL). Если нет альтернативы, любой пользовательский ввод должен быть нейтрализован перед выполнением.True✓True✓True✓V1.3.33Убедитесь, что данные, передаваемые в потенциально опасный контекст, предварительно нейтрализованы, чтобы обеспечить соблюдение мер безопасности, таких как разрешение только тех символов, которые безопасны для данного контекста, и обрезка слишком длинного ввода.FalseTrue✓True✓V1.3.44Убедитесь, что предоставленный пользователем файл .SVG проверен или нейтрализован, чтобы он содержал только теги и атрибуты (например, относящиеся к рисованию), которые безопасны для приложения, например, не содержат скриптов и foreignObject.FalseTrue✓True✓V1.3.55Убедитесь, что приложение нейтралует или отключает предоставленные пользователем скриптовые данные или выражения шаблонных языков, такие как таблицы стилей Markdown, CSS или XSL, BBCode или аналогичные.FalseTrue✓True✓V1.3.66Убедитесь, что приложение защищено от атак с подделкой запросов на стороне сервера (SSRF), проверяя ненадежные данные по разрешенному списку протоколов, доменов, путей и портов, а также нейтрализуя потенциально опасные символы перед использованием данных для вызова другой службы.FalseTrue✓True✓V1.3.77Убедитесь, что приложение защищено от атак с внедрением шаблонов (template injection), не позволяя создавать шаблоны на основе недоверенных входных данных. Если нет альтернативы, любые недоверенные входные данные, включаемые динамически во время создания шаблона, должны быть нейтрализованы или тщательно провалидированы.FalseTrue✓True✓V1.3.88Убедитесь, что приложение надлежащим образом нейтрализует недоверенные входные данные перед использованием в запросах Java Naming and Directory Interface (JNDI) и что JNDI настроен безопасно для предотвращения атак с использованием JNDI-инъекций.FalseTrue✓True✓V1.3.99Убедитесь, что приложение нейтрализует данные перед отправкой в Memcache, чтобы предотвратить атаки методом инъекций.FalseTrue✓True✓V1.3.1010Убедитесь, что строки форматирования, которые могут быть использованы неожидаемым или вредоносным образом, нейтрализуются перед дальнейшим использованием.FalseTrue✓True✓V1.3.1111Убедитесь, что приложение нейтрализует вводимые пользователем данные перед передачей в почтовые системы для защиты от SMTP или IMAP-инъекций.FalseTrue✓True✓V1.3.1212Убедитесь, что регулярные выражения не содержат элементов, вызывающих экспоненциальный возврат, и убедитесь в нейтрализации недоверенных входных данных для предотвращения атак ReDoS или Runaway Regex.FalseFalseTrue✓V1.44Память, строки и неуправляемый кодV1.4.11Убедитесь, что для обнаружения или предотвращения ситуаций переполнения стека, буфера или кучи приложение учитывает размер доступной области памяти при строковых операциях, копировании в память, в арифметике указателей и т.п.FalseTrue✓True✓V1.4.22Убедитесь, что для предотвращения целочисленного переполнения применяется контроль знака, диапазона и типа допустимых входных данных.FalseTrue✓True✓V1.4.33Убедитесь, что динамически выделенная память и ресурсы освобождены, а ссылки или указатели на освобожденную память удалены или установлены в значение null, чтобы предотвратить появление висячих указателей и уязвимостей, связанных с использованием памяти после освобождения.FalseTrue✓True✓V1.55Безопасная десериализацияV1.5.11Убедитесь, что приложение настраивает XML-парсеры на использование строгой конфигурации и что небезопасные функции, такие как разрешение внешних сущностей, отключены для предотвращения атак XML eXternal Entity (XXE).True✓True✓True✓V1.5.22Убедитесь, что десериализация недоверенных данных обеспечивает безопасную обработку ввода, например, используя список разрешенных типов объектов или ограничивая типы объектов, определяемые клиентом, для предотвращения атак десериализации. Механизмы десериализации, которые явно определены как небезопасные, не должны использоваться с недоверенным вводом.FalseTrue✓True✓V1.5.33Убедитесь, что различные парсеры, используемые в приложении для одного и того же типа данных (например, парсеры JSON, XML, URL), выполняют парсинг согласованным образом и используют один и тот же механизм кодирования символов, чтобы избежать таких проблем, как уязвимости взаимодействия JSON (JSON Interoperability) или различное поведение анализа URI или файлов, которые могут использоваться в атаках удаленного включения файлов (RFI) или подделки запросов на стороне сервера (SSRF).FalseFalseTrue✓V22ValidationВалидация и бизнес-логикаV2.11Документация валидации и бизнес-логикиV2.1.11Убедитесь, что в документации приложения определены правила проверки входных данных на соответствие ожидаемой структуре. Это могут быть распространённые форматы данных, такие как номера кредитных карт, адреса электронной почты, номера телефонов, или внутренний формат данных.True✓True✓True✓V2.1.22Убедитесь, что в документации приложения указано, как проверять логическую и контекстную согласованность объединенных данных, например, проверять соответствие района и почтового индекса.FalseTrue✓True✓V2.1.33Убедитесь, что ожидания относительно ограничений и проверок бизнес-логики задокументированы как для уровня отдельного пользователя, так и для глобального уровня всего приложения.FalseTrue✓True✓V2.22Валидация вводаV2.2.11Убедитесь, что входные данные провалидированы для обеспечения соответствия бизнес- или функциональным ожиданиям. Валидация должна осуществляться либо по списку допустимых значений, шаблонов и диапазонов, либо путем сравнения входных данных с ожидаемой структурой и логическими ограничениями в соответствии с предопределенными правилами. Для L1 валидация может быть сосредоточена на входных данных, используемых для принятия конкретных бизнес-решений или решений, связанных с безопасностью. Для L2 и выше это должно применяться ко всем входным данным.True✓True✓True✓V2.2.22Убедитесь, что приложение разработано с принудительной валидацией входных данных на уровне доверенного сервиса. Хотя проверка на стороне клиента повышает удобство использования и должна поощряться, на неё не следует полагаться как на средство контроля безопасности.True✓True✓True✓V2.2.33Убедитесь, что приложение обеспечивает обоснованность комбинаций данных в соответствии с предопределенными правилам. Например: возраст должен соответствовать дате рождения; страна и почтовый индекс; количество товара в заказе и на складе.FalseTrue✓True✓V2.33Безопасность бизнес-логикиV2.3.11Убедитесь, что приложение обрабатывает потоки бизнес-логики для одного и того же пользователя в ожидаемом последовательном порядке шагов и без пропуска шагов.True✓True✓True✓V2.3.22Убедитесь, что ограничения бизнес-логики реализованы в соответствии с документацией приложения, чтобы избежать эксплуатации её недостатков.FalseTrue✓True✓V2.3.33Убедитесь, что транзакции используются на уровне бизнес-логики таким образом, что операция бизнес-логики либо выполняется полностью, либо откатывается к предыдущему корректному состоянию.FalseTrue✓True✓V2.3.44Убедитесь, что на уровне бизнес-логики используются механизмы блокировки, чтобы гарантировать невозможность двойного бронирования ограниченных по количеству ресурсов (например, мест в театре или слотов доставки) путем манипулирования логикой приложения.FalseTrue✓True✓V2.3.55Убедитесь, что для важных потоков бизнес-логики требуется многопользовательское (multi-user) одобрение, чтобы предотвратить несанкционированные или случайные действия. Потоки бизнес-логики могут включать, помимо прочего, крупные денежные переводы, утверждение контрактов, доступ к секретной информации или обход ограничений безопасности на производстве.FalseFalseTrue✓V2.44Анти-автоматизацияV2.4.11Убедитесь, что используются средства противодействия автоматизации для защиты от чрезмерных вызовов функций приложения, которые могут привести к утечке данных, созданию ненужных данных, исчерпанию квот, нарушению ограничений скорости, отказу в обслуживании или чрезмерному использованию дорогостоящих ресурсов.FalseTrue✓True✓V2.4.22Убедитесь, что потоки бизнес-логики требуют реалистичного человеческого времени, предотвращая чрезмерно быструю отправку транзакций.FalseFalseTrue✓V33WebБезопасность веб-интерфейсаV3.11Документация по безопасности веб-интерфейсаV3.1.11Убедитесь, что в документации приложения описаны ожидаемые функции безопасности, которые должны поддерживать браузеры, использующие приложение (такие как HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) и другие соответствующие механизмы безопасности HTTP). В документации также должно быть обязательно определено, как приложение должно себя вести, если некоторые из этих функций недоступны (например, предупреждать пользователя или блокировать доступ).FalseFalseTrue✓V3.22Непреднамеренная интерпретация контентаV3.2.11Убедитесь, что реализованы меры безопасности, предотвращающие отображение контента или функций браузерами в HTTP-ответах в некорректном контексте (например, запрос API, загруженный пользователем файл или другой ресурс запрашивается напрямую). Возможные способы контроля включают: не обрабатывать содержимое, если поля заголовка HTTP-запроса (например, Sec-Fetch-*) не указывают на корректность контекста; использование заголовка и значения Content-Security-Policy: sandbox directive; или использование заголовка и значения Content-Disposition: attachment.True✓True✓True✓V3.2.22Убедитесь, что данные, предназначенные для отображения в виде текста, а не визуализации в виде HTML, обрабатывается с использованием безопасных функций визуализации (таких как createTextNode или textContent), чтобы предотвратить непреднамеренное выполнение содержимого, такого как HTML или JavaScript.True✓True✓True✓V3.2.33Убедитесь, что приложение избегает затирания DOM при использовании JavaScript на стороне клиента, применяя явные объявления переменных, выполняя строгую проверку типов, избегая сохранения глобальных переменных в объекте документа и реализуя изоляцию пространства имен.FalseFalseTrue✓V3.33Настройка файлов cookieV3.3.11Убедитесь, что у файлов cookie установлен атрибут «Secure», и если префикс «__Host‑» не используется в названии cookie, необходимо использовать префикс «__Secure‑».True✓True✓True✓V3.3.22Убедитесь, что значение атрибута SameSite каждой cookie установлено в соответствии с назначением cookie, чтобы ограничить подверженность атакам на восстановление пользовательского интерфейса и атакам с подделкой запросов на уровне браузера, обычно называемым подделкой межсайтовых запросов (CSRF).FalseTrue✓True✓V3.3.33Убедитесь, что cookie имеют префикс «__Host‑» в названии, если только они явно не предназначены для совместного использования с другими хостами.FalseTrue✓True✓V3.3.44Убедитесь, что если значение cookie не должно быть доступно для клиентских скриптов (например, сессионный токен), для cookie должен быть установлен атрибут «HttpOnly», а само значение должно передаваться клиенту только через поле заголовка «Set-Cookie».FalseTrue✓True✓V3.3.55Убедитесь, что при записи cookie приложением общая длина имени и значения cookie не превышает 4096 байт. Слишком большие cookie не будут сохраняться браузером и, следовательно, не будут отправляться с запросами, что помешает пользователю использовать функции приложения, зависящие от этого cookie.FalseFalseTrue✓V3.44Заголовки механизма безопасности браузераV3.4.11Убедитесь, что поле заголовка Strict‑Transport‑Security включено во все ответы для реализации политики HTTP Strict Transport Security (HSTS). Необходимо указать максимальное время не менее 1 года, а для L2 и выше политика должна применяться также ко всем поддоменам.True✓True✓True✓V3.4.22Убедитесь, что поле заголовка Cross‑Origin Resource Sharing (CORS) «Access‑Control‑Allow‑Origin» имеет фиксированное значение, заданное приложением, или, если используется заголовок Origin, оно проверяется по списку доверенных источников. При необходимости использования «Access‑Control‑Allow‑Origin: *» убедитесь, что ответ не содержит конфиденциальной информации.True✓True✓True✓V3.4.33Убедитесь, что HTTP-ответы содержат поле заголовка Content-Security-Policy, которое определяет директивы, гарантирующие загрузку и выполнение браузером только доверенного контента или ресурсов, чтобы ограничить выполнение вредоносного JavaScript. Как минимум, необходимо использовать глобальную политику, включающую директивы object-src «none» и base-uri «none», а также определяющую список разрешенных адресов или использующую одноразовые коды или хэши. Для приложений L3 необходимо определить политику использования 'nonce' или hash-конструкций для каждого ответа.FalseTrue✓True✓V3.4.44Убедитесь, что все HTTP-ответы содержат поле заголовка «X‑Content‑Type‑Options: nosniff». Это предписывает браузерам не использовать анализ контента и определение типа MIME для данного ответа, а также требовать, чтобы значение поля заголовка Content‑Type в ответе соответствовало целевому ресурсу. Например, ответ на запрос стиля принимается только в том случае, если Content‑Type в ответе — «text/css». Это также позволяет браузеру использовать функцию Cross‑Origin Read Blocking (CORB).FalseTrue✓True✓V3.4.55Убедитесь, что приложение устанавливает политику реферера для предотвращения утечки технически конфиденциальных данных сторонним сервисам через поле заголовка HTTP-запроса «Referer». Это можно сделать с помощью поля заголовка HTTP-ответа «Referrer‑Policy» или через атрибуты HTML-элемента. Конфиденциальные данные могут включать путь и данные запроса в URL-адресе, а для внутренних непубличных приложений также имя хоста.FalseTrue✓True✓V3.4.66Убедитесь, что веб-приложение использует директиву frame‑ancestors поля заголовка Content‑Security‑Policy для каждого HTTP-ответа, чтобы гарантировать невозможность его внедрения по умолчанию и внедрение определённых ресурсов разрешено только при необходимости. Обратите внимание, что поле заголовка X‑Frame‑Options, хотя и поддерживается браузерами, устарело и не может быть использовано в качестве основы.FalseTrue✓True✓V3.4.77Убедитесь, что в поле заголовка Content‑Security‑Policy указано место, куда следует сообщать о нарушениях.FalseFalseTrue✓V3.4.88Убедитесь, что все HTTP-ответы, инициирующие рендеринг документа (например, ответы с типом содержимого text/html), включают поле заголовка Cross-Origin-Opener-Policy с директивой same-origin или same-origin-allow-popups (при необходимости). Это предотвращает атаки, злоупотребляющие общим доступом к объектам Window, такие как Tabnabbing и Frame Counting.FalseFalseTrue✓V3.55Браузерное разделение источниковV3.5.11Убедитесь, что, если приложение не использует механизм предварительной проверки CORS для предотвращения запрещённых кросс-доменных запросов на использование чувствительного функционала, эти запросы валидируются на предмет их происхождения от самого приложения. Это можно сделать, используя и проверяя специальные токены для защиты от подделки или требуя дополнительные поля HTTP-заголовка, не входящие в список «простых заголовков» (CORS-safelisted request-header). Это необходимо для защиты от атак с подделкой запросов через браузер, широко известных как межсайтовая подделка запросов (CSRF).True✓True✓True✓V3.5.22Убедитесь, что если приложение использует механизм предварительной проверки CORS для предотвращения неразрешённого использования чувствительного функционала между источниками, вызов этого функционала невозможен с помощью запроса, который не запускает предварительную проверку CORS. Для этого может потребоваться проверка значений полей заголовка запроса «Origin» и «Content-Type» или использование дополнительного поля заголовка, не входящего в безопасный список CORS.True✓True✓True✓V3.5.33Убедитесь, что HTTP-запросы к чувствительному функционалу используют соответствующие HTTP-методы, такие как POST, PUT, PATCH или DELETE, а не методы, определённые спецификацией HTTP как «безопасные», такие как HEAD, OPTIONS или GET. В качестве альтернативы можно использовать строгую валидацию полей заголовка запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, навигационного запроса или загрузки ресурса (например, источника изображения), где это не ожидается.True✓True✓True✓V3.5.44Убедитесь, что отдельные приложения размещены на разных именах хостов, чтобы использовать ограничения, предусмотренные политикой same-origin, включая то, как документы или скрипты, загруженные одним источником, могут взаимодействовать с ресурсами из другого источника, а также ограничения на cookie на основе имени хоста.FalseTrue✓True✓V3.5.55Убедитесь, что сообщения, полученные интерфейсом postMessage, отвергаются, если источник сообщения не является доверенным или если синтаксис сообщения недействителен.FalseTrue✓True✓V3.5.66Убедитесь, что функциональность JSONP не включена нигде в приложении, чтобы избежать атак с использованием межсайтового включения скриптов (XSSI).FalseFalseTrue✓V3.5.77Убедитесь, что данные, требующие авторизации, не включены в ответы ресурсов скриптов, таких как файлы JavaScript, чтобы предотвратить атаки с использованием межсайтового включения скриптов (XSSI).FalseFalseTrue✓V3.5.88Убедитесь, что аутентифицированные ресурсы (такие как изображения, видео, скрипты и другие документы) могут быть загружены или внедрены от имени пользователя только по назначению. Этого можно добиться путём строгой валидации полей заголовка HTTP-запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, или путём установки ограничительного поля заголовка HTTP-ответа Cross‑Origin‑Resource‑Policy, чтобы браузер блокировал возвращаемый контент.FalseFalseTrue✓V3.66Целостность внешних ресурсовV3.6.11Убедитесь, что клиентские ресурсы, такие как библиотеки JavaScript, CSS или веб-шрифты, размещаются только на внешнем сервере (например, в сети доставки контента (Content Delivery Network)), если ресурс статический и имеет версии, а для проверки целостности ресурса используется механизм проверки целостности подресурсов (SRI). Если это невозможно, для каждого ресурса должно быть задокументировано решение по безопасности, обосновывающее это.FalseFalseTrue✓V3.77Другие соображения по безопасности браузераV3.7.11Убедитесь, что приложение использует только те клиентские технологии, которые по-прежнему поддерживаются и считаются безопасными. Примерами технологий, не соответствующих этому требованию, являются плагины NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL или клиентские Java-апплеты.FalseTrue✓True✓V3.7.22Убедитесь, что приложение будет автоматически перенаправлять пользователя на другое имя хоста или домен (который не контролируется приложением), только если этот хост или домен указаны в списке разрешенных.FalseTrue✓True✓V3.7.33Убедитесь, что приложение отображает уведомление, что пользователь перенаправляется на URL-адрес, находящийся вне контроля приложения, с возможностью отмены навигации.FalseFalseTrue✓V3.7.44Убедитесь, что домен верхнего уровня приложения (например, site.tld) ​​добавлен в публичный список предварительной загрузки (preload list) для HTTP Strict Transport Security (HSTS). Это гарантирует, что использование TLS для приложения будет встроено непосредственно в основные браузеры, а не будет полагаться только на поле заголовка ответа Strict-Transport-Security.FalseFalseTrue✓V3.7.55Убедитесь, что приложение ведет себя так, как описано в документации (например, предупреждает пользователя или блокирует доступ), если браузер, используемый для доступа к приложению, не поддерживает ожидаемые функции безопасности.FalseFalseTrue✓V44APIAPI и Веб-сервисV4.11Общая безопасность веб-сервисовV4.1.11Убедитесь, что каждый HTTP-ответ с телом сообщения содержит заголовок Content-Type, который соответствует фактическому содержимому ответа, таким как «text/», «/+xml» и «/xml», включая параметр charset для указания безопасной кодировки символов (например, UTF-8, ISO-8859-1) согласно IANA Media Types.True✓True✓True✓V4.1.22Убедитесь, что только конечные точки, предназначенные для взаимодействия с пользователем через веб-браузер, автоматически перенаправляют HTTP на HTTPS, в то время как другие сервисы или конечные точки не реализуют прозрачные редиректы. Это необходимо, чтобы избежать ситуации, когда клиент ошибочно отправляет незашифрованные HTTP-запросы а из-за того, что запрос по HTTP автоматически перенаправляется на HTTPS другим сервисом без обработки на входе, утечка чувствительных данных остаётся незамеченной.FalseTrue✓True✓V4.1.33Убедитесь, что любой HTTP-заголовок, используемый приложением и устанавливаемый промежуточным уровнем, таким как балансировщик нагрузки, веб-прокси или backend-for-frontend сервис, не может быть переопределён конечным пользователем. Примеры заголовков: X-Real-IP, X-Forwarded-*, X-User-ID.FalseTrue✓True✓V4.1.44Убедитесь, что разрешены только HTTP-методы, которые явно поддерживаются приложением или его API (включая OPTIONS для preflight-запросов), а неиспользуемые методы заблокированы.FalseFalseTrue✓V4.1.55Убедитесь, что для особо чувствительных запросов или транзакций, проходящих через несколько систем, используются цифровые подписи на уровне сообщений, дополнительно к транспортным средствам защиты.FalseFalseTrue✓V4.22Валидация структуры HTTP-сообщенийV4.2.11Убедитесь, что все компоненты приложения (включая балансировщики нагрузки, файрволы и серверы приложений) определяют границы входящих HTTP-сообщений с использованием механизма, соответствующего версии HTTP, чтобы предотвратить HTTP request smuggling. В HTTP/1.x, если присутствует заголовок Transfer-Encoding, заголовок Content-Length должен игнорироваться согласно RFC 2616. При использовании HTTP/2 или HTTP/3, если присутствует Content-Length, веб-сервер должен убедиться, что он совпадает с длиной DATA-фреймов.FalseTrue✓True✓V4.2.22Убедитесь, что при генерации HTTP-сообщений заголовок Content-Length не конфликтует с длиной содержимого, определяемой рамками протокола HTTP, чтобы предотвратить HTTP Request Smuggling.FalseFalseTrue✓V4.2.33Убедитесь, что приложение не отправляет и не принимает HTTP/2 и HTTP/3 сообщения с заголовками, специфичными для соединения, такими как Transfer-Encoding, чтобы предотвратить HTTP Response Splitting и HTTP Header Injection.FalseFalseTrue✓V4.2.44Убедитесь, что приложение принимает HTTP/2 и HTTP/3 запросы только в случае, если поля заголовков и их значения не содержат последовательностей CR (\r), LF (\n) или CRLF (\r\n), чтобы предотвратить HTTP Header Injection.FalseFalseTrue✓V4.2.55Убедитесь, что если приложение (бекенд или фронтенд) формирует и отправляет запросы, оно использует валидацию, очистку или другие механизмы, чтобы не создавать URI (например, для API-вызовов) или HTTP-заголовки (например, Authorization или Cookie) слишком большой длины, чтобы их не принимал приёмник. Это может привести к отказу в обслуживании, например, при отправке слишком длинного запроса (длинный cookie-заголовок), из-за чего сервер постоянно возвращает ошибку.FalseFalseTrue✓V4.33GraphQLV4.3.11Убедитесь, что используется белый список запросов, ограничение глубины вложенности, ограничение количества или анализ стоимости запроса, чтобы предотвратить DoS-атаки на уровне GraphQL или слоя данных из-за дорогостоящих вложенных запросов.FalseTrue✓True✓V4.3.22Убедитесь, что introspection-запросы GraphQL отключены в продакшен-среде, если GraphQL API не предназначен для использования сторонними клиентами.FalseTrue✓True✓V4.44WebSocketV4.4.11Убедитесь, что для всех WebSocket-соединений используется WebSocket поверх TLS (WSS).True✓True✓True✓V4.4.22Убедитесь, что при первоначальном HTTP WebSocket handshake заголовок Origin проверяется на соответствие списку разрешённых источников для приложения.FalseTrue✓True✓V4.4.33Убедитесь, что если стандартное управление сессиями приложения не может быть использовано, применяются специальные токены, соответствующие требованиям безопасности управления сессиями.FalseTrue✓True✓V4.4.44Убедитесь, что специальные токены управления сессиями WebSocket изначально получаются или валидируются через ранее аутентифицированную HTTPS-сессию при переходе от HTTPS к WebSocket.FalseTrue✓True✓V55FileРабота с файламиV5.11Документация по работе с файламиV5.1.11Убедитесь, что документация определяет допустимые типы файлов, ожидаемые расширения и максимальный размер (включая распакованный размер) для каждой функции загрузки. Также убедитесь, что в документации указано, как файлы обезвреживаются для конечных пользователей (например, как приложение ведёт себя при обнаружении вредоносного файла).FalseTrue✓True✓V5.22Загрузка файлов и содержимоеV5.2.11Убедитесь, что приложение принимает только те файлы, которые может обработать без потери производительности или отказа в обслуживании.True✓True✓True✓V5.2.22Убедитесь, что при загрузке файла (включая файлы внутри архивов, таких как ZIP) приложение проверяет, соответствует ли расширение ожидаемому, и валидирует, соответствует ли содержимое типу, указанному в расширении. Это включает проверку начальных 'magic bytes', перезапись изображений, использование специализированных библиотек. Для уровня 1 — достаточно проверок для файлов, критичных с точки зрения бизнеса или безопасности. Для уровней 2 и выше — для всех файлов.True✓True✓True✓V5.2.33Убедитесь, что приложение проверяет архивы (например, zip, gz, docx, odt) на максимально допустимый распакованный размер и максимальное количество файлов до распаковки.FalseTrue✓True✓V5.2.44Убедитесь, что для каждого пользователя установлены квоты на общий размер и количество файлов, чтобы один пользователь не мог переполнить хранилище.FalseFalseTrue✓V5.2.55Убедитесь, что приложение не позволяет загружать архивы с символьными ссылками (symlinks), если это не требуется по бизнес-логике. Если требуется — разрешён только строго определённый список допустимых символьных ссылок.FalseFalseTrue✓V5.2.66Убедитесь, что приложение отклоняет изображения с числом пикселей выше допустимого, чтобы предотвратить атаки 'pixel flood'.FalseFalseTrue✓V5.33Хранение файловV5.3.11Убедитесь, что загруженные или сгенерированные из недоверенного ввода файлы, находящиеся в публичной директории, не исполняются как серверный код при обращении к ним по HTTP.True✓True✓True✓V5.3.22Убедитесь, что при создании путей к файлам приложение использует внутренние или доверенные данные, а не пользовательские имена файлов. Если использование пользовательских имён или метаданных необходимо — требуется строгая проверка и очистка. Это защита от path traversal, LFI, RFI и SSRF.True✓True✓True✓V5.3.33Убедитесь, что при обработке файлов на сервере (например, при распаковке) игнорируются пути, заданные пользователем, во избежание уязвимостей типа 'zip slip'.FalseFalseTrue✓V5.44Скачивание файловV5.4.11Убедитесь, что приложение валидирует или игнорирует имена файлов, переданных пользователем (включая в JSON, JSONP или URL-параметре), и указывает имя файла в заголовке Content-Disposition при ответе.FalseTrue✓True✓V5.4.22Убедитесь, что имена файлов, передаваемые (например, в HTTP-заголовках или вложениях в email), кодируются или очищаются (например, по RFC 6266), чтобы сохранить структуру документа и предотвратить инъекции.FalseTrue✓True✓V5.4.33Убедитесь, что файлы, полученные из недоверенных источников, сканируются антивирусом, чтобы не распространять известное вредоносное содержимое.FalseTrue✓True✓V66AuthenticationАутентификацияV6.11Документация по аутентификацииV6.1.11Убедитесь, что в документации приложения описано, как используются механизмы, такие как ограничение частоты запросов (rate limiting), защита от автоматизации и адаптивные реакции, для защиты от атак, таких как подстановка учётных данных и перебор паролей. Документация должна ясно описывать конфигурацию этих механизмов и предотвращение злонамеренной блокировки аккаунтов.True✓True✓True✓V6.1.22Убедитесь, что задокументирован список контекстно-зависимых слов, запрещённых к использованию в паролях. В него могут входить производные от названий организаций, продуктов, идентификаторов систем, кодовых названий проектов, названий отделов или ролей и тому подобное.FalseTrue✓True✓V6.1.33Убедитесь, что если приложение поддерживает несколько способов аутентификации, то все они документированы вместе с описанием применяемых средств защиты и уровнем стойкости аутентификации, которые должны быть одинаково применены ко всем способам.FalseTrue✓True✓V6.22Безопасность паролейV6.2.11Убедитесь, что пользовательские пароли содержат не менее 8 символов. Рекомендуется минимальная длина в 15 символов.True✓True✓True✓V6.2.22Убедитесь, что пользователи могут менять свои пароли.True✓True✓True✓V6.2.33Убедитесь, что для смены пароля требуется ввести как текущий, так и новый пароль.True✓True✓True✓V6.2.44Убедитесь, что при регистрации или смене пароля введённый пароль проверяется по списку как минимум из 3000 самых популярных паролей, соответствующих политике (например, минимальной длине).True✓True✓True✓V6.2.55Убедитесь, что допускаются пароли любой структуры, без ограничений на использование определённых символов. Не должно быть требований по обязательному наличию заглавных/строчных букв, цифр или специальных символов.True✓True✓True✓V6.2.66Убедитесь, что поля ввода пароля используют type=password для скрытия символов. Разрешено временное отображение всего пароля или последнего введённого символа.True✓True✓True✓V6.2.77Убедитесь, что разрешены вставка (paste), использование менеджеров паролей браузера и внешних менеджеров паролей.True✓True✓True✓V6.2.88Убедитесь, что пароль проверяется строго в том виде, в котором он был введён пользователем — без обрезки, изменения регистра и других модификаций.True✓True✓True✓V6.2.99Убедитесь, что система позволяет использовать пароли длиной не менее 64 символов.FalseTrue✓True✓V6.2.1010Убедитесь, что пароль остаётся действительным, пока не будет скомпрометирован или не будет изменён пользователем. Приложение не должно требовать регулярной смены пароля.FalseTrue✓True✓V6.2.1111Убедитесь, что используется документированный список контекстно-зависимых слов (например, названия компаний, проектов и т.д.) для предотвращения использования легко угадываемых паролей.FalseTrue✓True✓V6.2.1212Убедитесь, что при регистрации или смене пароля проверяется, не входит ли он в список скомпрометированных (утёкших) паролей.FalseTrue✓True✓V6.33Общие требования к безопасности аутентификацииV6.3.11Убедитесь, что реализованы меры защиты от атак типа credential stuffing (массовая подстановка учётных данных) и brute-force (перебор паролей), согласно документации по безопасности приложения.True✓True✓True✓V6.3.22Убедитесь, что в приложении отсутствуют или отключены учётные записи по умолчанию (например, root, admin, sa).True✓True✓True✓V6.3.33Убедитесь, что для доступа к приложению используется либо механизм многофакторной аутентификации, либо комбинация однофакторных. Для уровня L3 один из факторов должен быть аппаратным, обеспечивающим защиту от фишинга, устойчивость к компрометации и подтверждение намерения аутентификации через явное действие пользователя (например, нажатие кнопки на FIDO-ключе или телефоне). Ослабление этих требований допускается только при наличии обоснования и компенсирующих мер.FalseTrue✓True✓V6.3.44Убедитесь, что при наличии нескольких способов аутентификации, они все задокументированы, и для них единообразно применяются меры защиты и уровни доверия.FalseTrue✓True✓V6.3.55Убедитесь, что пользователи получают уведомления о подозрительных попытках аутентификации (удачных и неудачных). Это может включать попытки (например, подключения) с необычного устройства или места, частично успешную MFA, попытку после долгого отсутствия или успешную аутентификацию после серии неудачных.FalseFalseTrue✓V6.3.66Убедитесь, что email не используется ни как однофакторный, ни как многофакторный механизм аутентификации.FalseFalseTrue✓V6.3.77Убедитесь, что пользователи получают уведомление при изменении данных аутентификации, таких как сброс пароля или изменение логина/email.FalseFalseTrue✓V6.3.88Убедитесь, что из сообщений об ошибке, HTTP-кодов ответа или различий во времени ответа нельзя определить, существует ли пользователь с таким логином. Это правило также должно применяться к функциям регистрации и восстановления пароля.FalseFalseTrue✓V6.44Жизненный цикл и восстановление факторов аутентификацииV6.4.11Убедитесь, что начальные пароли или коды активации, генерируемые системой, создаются с использованием надёжного генератора случайных чисел, соответствуют текущей политике паролей и истекают через короткий период времени либо после первого использования. Эти секреты не должны использоваться как постоянные пароли.True✓True✓True✓V6.4.22Убедитесь, что в системе отсутствуют подсказки к паролю или вопросы на знание («секретные вопросы»).True✓True✓True✓V6.4.33Убедитесь, что реализован безопасный процесс сброса забытого пароля, который не обходит активные механизмы многофакторной аутентификации.FalseTrue✓True✓V6.4.44Убедитесь, что в случае утраты одного из факторов MFA проводится удостоверение личности (identity proofing) на том же уровне, что и при первичной регистрации.FalseTrue✓True✓V6.4.55Убедитесь, что инструкции по обновлению истекающих механизмов аутентификации отправляются заранее, с достаточным запасом времени для выполнения замены, при необходимости с настройкой автоматических напоминаний.FalseFalseTrue✓V6.4.66Убедитесь, что администраторы могут инициировать процесс сброса пароля, но не могут задать или выбрать новый пароль за пользователя. Это исключает ситуацию, при которой администратор знает пароль пользователя.FalseFalseTrue✓V6.55Общие требования к многофакторной аутентификацииV6.5.11Убедитесь, что lookup-секреты, внеполосные коды/запросы и TOTP-коды можно использовать только один раз.FalseTrue✓True✓V6.5.22Убедитесь, что при хранении lookup-секретов с энтропией менее 112 бит (например, 19 случайных буквенно-цифровых символов или 34 случайные цифры) они хэшируются с использованием разрешённого алгоритма хеширования паролей и случайной соли минимум 32 бита. Если у секрета ≥112 бит энтропии — допустимо использовать стандартный хэш.FalseTrue✓True✓V6.5.33Убедитесь, что lookup-секреты, коды внеполосной аутентификации и сиды для TOTP генерируются с использованием криптографически стойкого генератора случайных чисел (CSPRNG), чтобы избежать предсказуемых значений.FalseTrue✓True✓V6.5.44Убедитесь, что lookup-секреты и внеполосные коды аутентификации имеют минимум 20 бит энтропии (достаточно, например, 4 случайных алфавитно-цифровых символов или 6 случайных цифр).FalseTrue✓True✓V6.5.55Убедитесь, что все внеполосные запросы, коды и токены, а также TOTP-коды имеют ограниченный срок действия. Максимум для out-of-band — 10 минут, для TOTP — 30 секунд.FalseTrue✓True✓V6.5.66Убедитесь, что любой фактор аутентификации (включая физические устройства) может быть отозван в случае кражи или утери.FalseFalseTrue✓V6.5.77Убедитесь, что биометрические механизмы аутентификации используются только как вторичный фактор — в сочетании с «чем-то, что вы знаете» или «чем-то, что у вас есть».FalseFalseTrue✓V6.5.88Убедитесь, что TOTP-коды проверяются по источнику времени, полученному от доверенного сервиса, а не от клиента или недоверенного источника.FalseFalseTrue✓V6.66Внеполосные механизмы аутентификацииV6.6.11Убедитесь, что механизмы аутентификации через телефонную сеть общего пользования (PSTN) для доставки одноразовых паролей (OTP) по телефону или SMS используются только в случае предварительной валидации номера, при этом предлагаются альтернативные более безопасные методы (например, TOTP), и пользователю сообщаются риски. Для приложений уровня L3 использование телефона и SMS недопустимо.FalseTrue✓True✓V6.6.22Убедитесь, что внеполосные запросы, коды или токены привязаны к исходному запросу аутентификации, для которого они были сгенерированы, и не могут быть использованы повторно для других попыток.FalseTrue✓True✓V6.6.33Убедитесь, что внеполосные механизмы на основе кода защищены от атак методом подбора (brute force) путём применения ограничения частоты запросов (rate limiting). Также рекомендуется использовать коды с энтропией не менее 64 бит.FalseTrue✓True✓V6.6.44Убедитесь, что при использовании push-уведомлений для MFA применяется ограничение частоты (rate limiting), чтобы предотвратить атаки push-бомбинга. Также может помочь механизм сопоставления номеров (number matching).FalseFalseTrue✓V6.77Криптографические механизмы аутентификацииV6.7.11Убедитесь, что сертификаты, используемые для проверки криптографических утверждений об аутентификации, хранятся таким образом, чтобы исключить возможность их модификации.FalseFalseTrue✓V6.7.22Убедитесь, что nonce (случайная строка), используемая в процессе вызова, имеет длину не менее 64 бит и является статистически уникальной или уникальной на протяжении всего срока службы криптографического устройства.FalseFalseTrue✓V6.88Аутентификация с использованием провайдера идентификаций (IdP)V6.8.11Убедитесь, что при поддержке несколькими IdP, невозможно подделать личность пользователя через другой IdP (например, с тем же user ID). Стандартным способом защиты является регистрация пользователя с использованием сочетания ID самого IdP (в качестве пространства имён) и пользовательского ID внутри IdP.FalseTrue✓True✓V6.8.22Убедитесь, что наличие и целостность цифровой подписи в утверждениях аутентификации (например, в JWT или SAML) всегда проверяются, а неподписанные или недействительные утверждения отклоняются.FalseTrue✓True✓V6.8.33Убедитесь, что SAML-утверждения обрабатываются только один раз в течение периода их действия, чтобы исключить атаки воспроизведения (replay attacks).FalseTrue✓True✓V6.8.44Убедитесь, что если приложение использует внешний поставщик идентификации (IdP) и для определенных функций требуется особый уровень, метод или срок действия аутентификации, то приложение использует данные, возвращаемые IdP, для проверки этих условий. Например, при использовании OIDC можно проверить значения полей ID Token — acr, amr, auth_time (если они есть). Если IdP не предоставляет эти данные, приложение должно иметь документированный план действий по умолчанию, предполагающий использование минимально допустимой силы аутентификации (например, одноступенчатая — логин и пароль).FalseTrue✓True✓V77SessionУправление сессиямиV7.11Документация по управлению сессиямиV7.1.11Убедитесь, что тайм-аут бездействия и абсолютное максимальное время жизни сессии задокументированы, соответствуют другим контрольным мерам и сопровождаются обоснованием любых отклонений от требований повторной аутентификации NIST SP 800-63B.FalseTrue✓True✓V7.1.22Убедитесь, что документация определяет допустимое количество одновременных (параллельных) сессий для одного аккаунта, а также поведение системы и действия при достижении этого лимита.FalseTrue✓True✓V7.1.33Убедитесь, что все системы, создающие и управляющие сессиями пользователей в рамках федеративной идентификации (например, SSO), задокументированы вместе с механизмами координации сроков действия сессий, условий завершения и случаев, требующих повторной аутентификации.FalseTrue✓True✓V7.22Базовая безопасность сессийV7.2.11Убедитесь, что все проверки сессионных токенов выполняются на доверенной серверной стороне.True✓True✓True✓V7.2.22Убедитесь, что приложение использует либо автономные токены, либо ссылочные токены, которые генерируются динамически, не используя статические API-секреты или ключи.True✓True✓True✓V7.2.33Убедитесь, что ссылочные токены являются уникальными, создаются с использованием криптографически безопасного генератора псевдослучайных чисел (CSPRNG) и обладают энтропией не менее 128 бит.True✓True✓True✓V7.2.44Убедитесь, что при аутентификации пользователя (включая повторную) создается новый токен сессии, а текущий — аннулируется.True✓True✓True✓V7.33Тайм-ауты сессииV7.3.11Убедитесь, что есть тайм-аут бездействия, после которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.FalseTrue✓True✓V7.3.22Убедитесь, что установлено абсолютное максимальное время жизни сессии, по истечении которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.FalseTrue✓True✓V7.44Завершение сессийV7.4.11Убедитесь, что после завершения сессии (logout, истечение срока) дальнейшее её использование невозможно. Для ссылочных токенов или сессий с сохранением состояния это означает аннулирование на сервере. Для self-contained токенов необходимо реализовать механизм отзыва, например, список отозванных токенов, проверку времени выпуска или ротацию ключей подписи для каждого пользователя.True✓True✓True✓V7.4.22Убедитесь, что при удалении или отключении пользователя все активные сессии немедленно завершаются.True✓True✓True✓V7.4.33Убедитесь, что после изменения или удаления факторов аутентификации (например, смена пароля или MFA) приложение предлагает завершить все другие активные сессии.FalseTrue✓True✓V7.4.44Убедитесь, что на всех страницах, требующих аутентификации, имеется простой и видимый способ выхода.FalseTrue✓True✓V7.4.55Убедитесь, что администраторы могут завершать активные сессии конкретного пользователя или всех пользователей.FalseTrue✓True✓V7.55Защита от злоупотреблений сессиейV7.5.11Убедитесь, что приложение требует полной повторной аутентификации перед изменением чувствительных атрибутов аккаунта, которые могут влиять на аутентификацию (например, email, номер телефона, настройки MFA или данных восстановления доступа).FalseTrue✓True✓V7.5.22Убедитесь, что пользователь может просматривать и (после повторной аутентификации хотя бы по одному фактору) завершать активные сессии.FalseTrue✓True✓V7.5.33Убедитесь, что перед выполнением критически важных операций приложение требует повторной аутентификации (по крайней мере, одного фактора) или дополнительной проверки.FalseFalseTrue✓V7.66Федеративная повторная аутентификацияV7.6.11Убедитесь, что срок действия и завершение сессий между RP и IdP соответствуют документации и включают повторную аутентификацию, если достигнут максимальный допустимый интервал между событиями аутентификации.FalseTrue✓True✓V7.6.22Убедитесь, что создание сессии требует согласия пользователя или явного действия, предотвращающего несанкционированное создание сессий без участия пользователя.FalseTrue✓True✓V88AuthorizationАвторизацияV8.11Документация по авторизацииV8.1.11Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне функций и на уровне данных на основе прав субъекта и атрибутов ресурса.True✓True✓True✓V8.1.22Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне полей (как на чтение, так и на запись) на основе прав субъекта и атрибутов ресурса. Эти правила могут зависеть от других атрибутов объекта данных, например, статуса.FalseTrue✓True✓V8.1.33Убедитесь, что документация определяет, какие атрибуты окружения и контекста (например, время суток, IP-адрес, местоположение, устройство) используются приложением для принятия решений в области аутентификации и авторизации.FalseFalseTrue✓V8.1.44Убедитесь, что документация по аутентификации и авторизации определяет, как используются факторы окружения и контекста в принятии решений, наряду с правилами доступа к функциям, данным и полям. Документация должна содержать оцениваемые атрибуты, пороговые значения риска, действия (разрешить, отказать, повысить уровень аутентификации и др.).FalseFalseTrue✓V8.22Архитектура авторизацииV8.2.11Убедитесь, что приложение обеспечивает доступ на уровне функций (function-level) только субъектам с явными разрешениями.True✓True✓True✓V8.2.22Убедитесь, что приложение обеспечивает доступ на уровне данных (data-specific) только тем субъектам, которым явно предоставлены права к определённым элементам данных, чтобы предотвратить IDOR (Insecure Direct Object Reference) и BOLA-уязвимости (Broken Object Level Authorization).True✓True✓True✓V8.2.33Убедитесь, что приложение обеспечивает доступ на уровне полей (field-level) только тем субъектам, которым явно предоставлены права к определённым полям, чтобы предотвратить BOPLA (Broken Object Property Level Authorization).FalseTrue✓True✓V8.2.44Убедитесь, что реализованы адаптивные меры безопасности, основанные на атрибутах окружения и контекста субъекта (время, местоположение, IP, устройство), которые используются для принятия решений об аутентификации и авторизации, как это определено в документации приложения. Эти меры должны применяться как при попытке субъекта начать новую сессию, так и во время существующей сессии.FalseFalseTrue✓V8.33Авторизация на уровне операцийV8.3.11Убедитесь, что правила авторизации реализуются на доверенном сервисном уровне и не зависят от элементов, которые может контролировать клиент (например, JavaScript на стороне клиента).True✓True✓True✓V8.3.22Убедитесь, что изменения значений, влияющих на авторизацию, применяются немедленно. Если это невозможно (например, при использовании автономных токенов), должны быть реализованы компенсирующие меры: оповещения о попытке несанкционированного действия и откат изменений. Обратите внимание, что данный подход не предотвращает утечку информации.FalseFalseTrue✓V8.3.33Убедитесь, что доступ к объекту осуществляется на основе прав субъекта, инициировавшего запрос, а не прав промежуточного сервиса, действующего от его имени. Например, если пользователь обращается к веб-сервису с автономным токеном для аутентификации, а сервис затем запрашивает данные у другого сервиса, второй сервис должен использовать токен пользователя, а не токен первого сервиса для принятия решения о доступе.FalseFalseTrue✓V8.44Прочие аспекты авторизацииV8.4.11Убедитесь, что в мультитенантных приложениях реализованы механизмы, предотвращающие действия потребителя в отношении арендаторов, к которым у него нет доступа.FalseTrue✓True✓V8.4.22Убедитесь, что доступ к административным интерфейсам защищён несколькими уровнями контроля, включая непрерывную проверку личности, контроль защищённости устройства и анализ контекстных рисков. Недостаточно опираться только на IP-адрес или доверенные устройства.FalseFalseTrue✓V99SelfАвтономные токеныV9.11Источник токена и его целостностьV9.1.11Убедитесь, что автономные токены проверяются на целостность с помощью цифровой подписи или MAC, прежде чем доверять их содержимому.True✓True✓True✓V9.1.22Проверяйте, что автономные токены создаются и проверяются исключительно с помощью алгоритмов из списка допустимых в данном контексте. Список допустимых алгоритмов должен включать только разрешенные алгоритмы (желательно либо только симметричные, либо только асимметричные) и ни в коем случае не содержать алгоритм None. Если необходимо поддерживать оба типа алгоритмов, потребуются дополнительные средства контроля для предотвращения путаницы с ключами (key confusion).True✓True✓True✓V9.1.33Убедитесь, что ключи, используемые для проверки автономных токенов, получены из доверенных, предварительно настроенных источников. Это предотвращает возможность указания злоумышленниками ненадёжных источников и ключей. Для JWT и других JWS структур заголовки 'jku', 'x5u' и 'jwk' должны проверяться по белому списку.True✓True✓True✓V9.22Содержимое токенаV9.2.11Убедитесь, что при указанном сроке действия токен и его содержимое принимаются только в том случае, если срок действия токена не истёк. Например, для JWT нужно проверить поля 'nbf' и 'exp'.True✓True✓True✓V9.2.22Убедитесь, что сервис, принимающий токен, проверяет его тип и соответствие назначению перед обработкой содержимого токена. Например, для принятия решений об авторизации могут быть приняты только Access Token, а для подтверждения аутентификации пользователя — только ID Token.FalseTrue✓True✓V9.2.33Убедитесь, что сервис принимает только токены, предназначенные для использования с этим сервисом (audience). Для JWT это можно сделать, проверив наличие утверждения «aud» по белому списку, определенному в сервисе.FalseTrue✓True✓V9.2.44Убедитесь, что, если эмитент токенов использует один и тот же закрытый ключ для выпуска токенов различным сервисам (audiences), выпущенные токены содержат явное указание целевых сервисов. Это предотвратит повторное использования токенов в не предназначенных для них сервисах. Если идентификатор сервиса (audience identifier) назначается динамически, эмитент токенов должен проверить audiences для исключения подмены получателей (audience impersonation).FalseTrue✓True✓V1010OAuthOAuth и OIDCV10.11Общие требования безопасности OAuth и OIDCV10.1.11Убедитесь, что токены передаются только тем компонентам, которым они действительно необходимы. Например, при использовании схемы backend-for-frontend для браузерных JavaScript-приложений, access и refresh токены должны быть доступны только на backend.FalseTrue✓True✓V10.1.22Убедитесь, что клиент принимает значения от авторизационного сервера (например, authorization code или ID Token) только если они получены в результате авторизационного потока, инициированного в той же сессии пользовательского агента и в рамках той же транзакции. Для этого клиентские секреты, такие как proof key для code exchange (PKCE) — 'code_verifier', 'state' или OIDC 'nonce' — должны быть непредсказуемыми, специфичными для транзакции и надежно привязанными как к клиенту, так и к сессии пользовательского агента, в которой началась транзакция.FalseTrue✓True✓V10.22Клиент OAuthV10.2.11Убедитесь, что если используется механизм authorization code flow, OAuth клиент защищён от CSRF, вызывающих запросы токенов либо за счёт использования механизма proof key for code exchange (PKCE), либо за счёт проверки параметра 'state', который был отправлен в запросе авторизации.FalseTrue✓True✓V10.2.22Убедитесь, что если OAuth клиент может взаимодействовать с более чем одним сервером авторизации, у него есть защита от атак смешивания (mix-up attacks). Например, клиент должен требовать, чтобы сервер авторизации возвращал параметр 'iss' и проверять его в ответах на авторизацию и токены.FalseTrue✓True✓V10.2.33Убедитесь, что OAuth клиент запрашивает только необходимые области доступа (scopes) или другие параметры авторизации в запросах к серверу авторизации.FalseFalseTrue✓V10.33Сервер ресурсов OAuthV10.3.11Убедитесь, что сервер ресурсов принимает только те access токены, которые предназначены для использования с этим сервисом (свойство audience). Эта принадлежность сервису может быть включена в структурированный access токен (например, в поле 'aud' в JWT) или проверяться через endpoint интроспекции токена.FalseTrue✓True✓V10.3.22Убедитесь, что сервер ресурсов принимает решения по авторизации на основе claims из access токена, определяющих делегированную авторизацию. Если присутствуют claims, такие как 'sub', 'scope' и 'authorization_details', они должны участвовать в принятии решения.FalseTrue✓True✓V10.3.33Убедитесь, что если для принятия решения по контролю доступа необходимо однозначно идентифицировать пользователя из access токена (JWT или ответа интроспекции), сервер ресурсов использует claims, которые не могут быть переприсвоены другим пользователям. Обычно это комбинация claims 'iss' и 'sub'.FalseTrue✓True✓V10.3.44Убедитесь, что если сервер ресурсов требует определённой силы аутентификации, методов или свежести аутентификации, он проверяет, что предъявленный access токен удовлетворяет этим требованиям. Например, при наличии, могут использоваться claims OIDC 'acr', 'amr' и 'auth_time'.FalseTrue✓True✓V10.3.55Убедитесь, что сервер ресурсов предотвращает использование украденных access токенов или их повторное использование (replay) неавторизованными лицами, требуя access токены с подтверждением отправителя — например, Mutual TLS для OAuth 2 или OAuth 2 Demonstration of Proof of Possession (DPoP).FalseFalseTrue✓V10.44Сервер авторизации OAuthV10.4.11Убедитесь, что сервер авторизации проверяет URI перенаправления (redirect URI), сверяя его с заранее зарегистрированным списком разрешённых URI для данного клиента (allowlist), используя точное сравнение строк.True✓True✓True✓V10.4.22Убедитесь, что если сервер авторизации возвращает authorization code в ответе авторизации, этот код может быть использован только один раз для запроса токена. При втором валидном запросе с уже использованным кодом сервер должен отклонить запрос и отозвать любые токены, связанные с этим кодом.True✓True✓True✓V10.4.33Убедитесь, что authorization code имеет короткое время жизни. Максимальная продолжительность — до 10 минут для приложений L1 и L2 и до 1 минуты для приложений L3.True✓True✓True✓V10.4.44Убедитесь, что сервер авторизации для конкретного клиента разрешает использование только тех типов авторизации, которые необходимы этому клиенту. Обратите внимание, что тип авторизации Implicit flow и Resource Owner Password Credentials flow больше не должны использоваться.True✓True✓True✓V10.4.55Убедитесь, что сервер авторизации предотвращает атаки повторного использования refresh токенов для публичных клиентов, предпочтительно используя sender-constrained refresh токены, такие как DPoP или сертификат-связанные токены с mutual TLS (mTLS). Для L1 и L2 допускается ротация refresh токенов с обязательной их инвалидацией после использования. Если используется ротация, сервер должен отозвать все refresh токены при попытке использовать уже инвалидированный токен.True✓True✓True✓V10.4.66Убедитесь, что при использовании типа авторизации «Authorization Code» сервер предотвращает атаки перехвата authorization code, требуя Proof Key for Code Exchange (PKCE). В запросах авторизации сервер должен требовать валидное значение 'code_challenge' и не принимать 'code_challenge_method' со значением 'plain'. В запросах токена обязательно валидировать параметр 'code_verifier'.FalseTrue✓True✓V10.4.77Убедитесь, что если сервер авторизации поддерживает динамическую регистрацию клиентов без аутентификации, он минимизирует риски вредоносных клиентов. Сервер должен валидировать метаданные клиента (например, зарегистрированные URI), обеспечивать согласие пользователя и предупреждать пользователя перед обработкой запроса авторизации от недоверенного клиента.FalseTrue✓True✓V10.4.88Убедитесь, что refresh токены имеют абсолютный срок действия, включая случаи, когда применяется скользящее время истечения срока.FalseTrue✓True✓V10.4.99Убедитесь, что пользователи могут отзывать refresh токены и reference access токены через пользовательский интерфейс сервера авторизации для снижения риска от вредоносных клиентов или кражи токенов.FalseTrue✓True✓V10.4.1010Убедитесь, что конфиденциальный клиент аутентифицируется при взаимодействии с сервером авторизации через backchannel, например при запросах токена, pushed authorization requests (PAR) и запросах на отзыв токенов.FalseTrue✓True✓V10.4.1111Убедитесь, что конфигурация сервера авторизации назначает OAuth клиенту только необходимые области доступа (scopes).FalseTrue✓True✓V10.4.1212Убедитесь, что для конкретного клиента сервер авторизации разрешает только те значения 'response_mode', которые необходимы этому клиенту. Например, сервер должен валидировать это значение против ожидаемых или использовать pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).FalseFalseTrue✓V10.4.1313Убедитесь, что грант типа 'code' всегда используется вместе с pushed authorization requests (PAR).FalseFalseTrue✓V10.4.1414Убедитесь, что сервер авторизации выдаёт только sender-constrained (Proof-of-Possession) access токены, либо с сертификат-связанными токенами через mutual TLS (mTLS), либо DPoP-bound токены (Demonstration of Proof of Possession).FalseFalseTrue✓V10.4.1515Убедитесь, что для серверного клиента (не выполняющегося на устройстве конечного пользователя) сервер авторизации проверяет, что значение параметра 'authorization_details' исходит из клиентского backend и что пользователь не изменял его. Например, это достигается использованием pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).FalseFalseTrue✓V10.4.1616Убедитесь, что клиент является конфиденциальным и сервер авторизации требует использования сильных методов аутентификации клиента (основанных на криптографии с открытым ключом и устойчивых к атакам повторного воспроизведения), таких как mutual TLS ('tls_client_auth', 'self_signed_tls_client_auth') или private key JWT ('private_key_jwt').FalseFalseTrue✓V10.55Клиент OIDCV10.5.11Убедитесь, что клиент (relying party) защищается от повторного использования ID Token (replay-атак). Например, это достигается проверкой того, что значение 'nonce' в ID Token совпадает со значением 'nonce', отправленным в запросе аутентификации провайдеру OpenID (authorization server).FalseTrue✓True✓V10.5.22Убедитесь, что клиент однозначно идентифицирует пользователя по утверждениям (claims) ID Token, обычно это 'sub', который не может быть переназначен другому пользователю (в пределах конкретного провайдера идентификации).FalseTrue✓True✓V10.5.33Убедитесь, что клиент отклоняет попытки злоумышленного сервера авторизации выдавать себя за другой сервер авторизации через метаданные сервера авторизации. Клиент должен отклонить метаданные, если URL издателя (issuer) в метаданных не совпадает точно с преднастроенным URL издателя, ожидаемым клиентом.FalseTrue✓True✓V10.5.44Убедитесь, что клиент проверяет, что ID Token предназначен для него (проверка audience), сравнивая значение 'aud' в токене с 'client_id' клиента.FalseTrue✓True✓V10.5.55Убедитесь, что при использовании OIDC back-channel logout клиент снижает риск отказа в обслуживании, вызванный принудительным выходом из системы и путаницей между разными типами JWT (cross-JWT confusion) в процессе логаута. Клиент должен проверить, что токен выхода корректно типизирован со значением 'logout+jwt', содержит claim 'event' с правильным именем участника и не содержит 'nonce'. Также рекомендуется установить короткий срок действия токена (например, 2 минуты).FalseTrue✓True✓V10.66Провайдер OpenIDV10.6.11Убедитесь, что провайдер OpenID допускает только значения 'code', 'ciba', 'id_token' или 'id_token code' для параметра response mode. При этом предпочтение отдаётся 'code' по сравнению с 'id_token code' (гибридный поток OIDC), а значение 'token' (любой Implicit flow) не должно использоваться.FalseTrue✓True✓V10.6.22Убедитесь, что провайдер OpenID предотвращает отказ в обслуживании (DoS) через принудительный выход (logout), запрашивая явное подтверждение от конечного пользователя или, если применимо, проверяя параметры в запросе выхода (инициированном relying party), например параметр 'id_token_hint'.FalseTrue✓True✓V10.77Управление согласиемV10.7.11Убедитесь, что авторизационный сервер обеспечивает получение согласия пользователя для каждого запроса авторизации. Если личность клиента не может быть подтверждена, сервер авторизации всегда должен явно запрашивать согласие пользователя.FalseTrue✓True✓V10.7.22Убедитесь, что при запросе согласия пользователя авторизационный сервер предоставляет достаточную и понятную информацию о том, на что даётся согласие. При необходимости это должно включать характер запрашиваемых разрешений (обычно основанных на scope, ресурсном сервере, деталях авторизации Rich Authorization Requests (RAR)), идентификацию авторизованного приложения и срок действия этих разрешений.FalseTrue✓True✓V10.7.33Убедитесь, что пользователь может просматривать, изменять и отзывать согласия, которые он предоставил, через авторизационный сервер.FalseTrue✓True✓V1111CryptographyКриптографияV11.11Инвентаризация и документирование криптографииV11.1.11Убедитесь, что задокументирована политика управления криптографическими ключами и описан их жизненный цикл в соответствии со стандартом управления ключей, таким как NIST SP 800-57. Убедитесь, что ключи известны только тем сущностям, которым они должны быть доступны (например, ключи не передавались более чем двум участникам для общих секретов и более чем одному участнику для приватных ключей).FalseTrue✓True✓V11.1.22Убедитесь, что проводится инвентаризация криптографических средств, которая непрерывно поддерживается, регулярно обновляется и включает все криптографические ключи, алгоритмы и сертификаты, используемые в приложении. Также должна быть задокументирована информация о том, где ключи могут и не могут использоваться в системе, а также какие типы данных могут и не могут быть защищены с помощью этих ключей.FalseTrue✓True✓V11.1.33Убедитесь, что используются механизмы обнаружения криптографии для идентификации всех случаев применения криптографии в системе , включая операции шифрования, хеширования и цифровой подписи.FalseFalseTrue✓V11.1.44Убедитесь, что ведётся и поддерживается инвентаризация криптографических средств. В неё должен входить документированный план, описывающий переход на новые криптографические стандарты, такие как постквантовая криптография, чтобы своевременно реагировать на будущие угрозы.FalseFalseTrue✓V11.22Безопасная реализация криптографииV11.2.11Убедитесь, что для криптографических операций используются утвержденные в индустрии реализации (включая библиотеки и аппаратные реализации).FalseTrue✓True✓V11.2.22Убедитесь, что архитектура приложения поддерживает быструю реконфигурацию, усовершенствование или смену в любой момент случайных чисел, аутентифицированного шифрования, MAC, алгоритмов хеширования, длин ключей, количества раундов, шифров и режимов шифрования для защиты от криптографических атак. Также должна поддерживаться возможность смены ключей, паролей и повторного шифрования данных. Это позволит беспрепятственно перейти на постквантовую криптографию (PQC), как только станут широко доступны высоконадёжные реализации одобренных схем или стандартов PQC.FalseTrue✓True✓V11.2.33Убедитесь, что все криптографические примитивы используют как минимум 128-бит стойкости с учетом алгоритма, размера ключа и конфигурации. Например, 256-битный ECC ключ обеспечивает примерно 128 бит безопасности, тогда как для достижения того же уровня безопасности в RSA требуется ключ длиной 3072 бита.FalseTrue✓True✓V11.2.44Убедитесь, что все криптографические операции выполняются за константное время, без использования «short-circuit» операций в сравнениях, вычислениях, возвратах функций для избежания утечек информации.FalseFalseTrue✓V11.2.55Убедитесь, что все криптографические модули обеспечивают безопасное завершение работы при ошибках, а обработка ошибок реализована таким образом, чтобы не создавать уязвимостей, например, таких как атаки Padding Oracle.FalseFalseTrue✓V11.33Алгоритмы шифрованияV11.3.11Убедитесь, что не используются небезопасные режимы блочного шифрования (н-р, ECB) и слабые схемы дополнения (padding) (н-р, PKCS#1 v1.5).True✓True✓True✓V11.3.22Убедитесь, что используются только утверждённые шифры и режимы, такие как AES с GCM.True✓True✓True✓V11.3.33Убедитесь, что зашифрованные данные защищены от несанкционированного изменения, предпочтительно с использованием утверждённого метода аутентифицированного шифрования или путём комбинирования утверждённого метода шифрования с утверждённым алгоритмом MAC.FalseTrue✓True✓V11.3.44Убедитесь, что случайные числа (nonce), векторы инициализации (IV) и другие одноразовые числа не используются более одного раза для одной и той же пары ключа шифрования и элемента данных. Метод их генерации должен соответствовать требованиям используемого алгоритма.FalseFalseTrue✓V11.3.55Убедитесь, что любая комбинация алгоритма шифрования и алгоритма MAC работает в режиме encrypt-then-MAC (EtM).FalseFalseTrue✓V11.44Хеширование и функции на основе хешированияV11.4.11Убедитесь, что только утвержденные хэш-функции используются для стандартных сценариев использования в криптографии, включая цифровую подпись, HMAC, KDF, генерацию случайных чисел. Запрещено использовать неустойчивые хэш-функции, (н-р, MD5) для любого использования в криптографии.True✓True✓True✓V11.4.22Убедитесь, что пароли хранятся с использованием утверждённой, вычислительно затратной функции генерации ключа (также известной как «функция хеширования паролей»), с параметрами, настроенными в соответствии с актуальными рекомендациями. Настройки должны обеспечивать баланс между безопасностью и производительностью, чтобы сделать атаки перебором достаточно сложными для требуемого уровня безопасности.FalseTrue✓True✓V11.4.33Убедитесь, что хэш-функции, используемые в формировании цифровой подписи, как часть аутентификации и целостности данных, устойчивы к коллизиям и имеют достаточную длину.FalseTrue✓True✓V11.4.44Убедитесь, что приложение использует утвержденную функцию генерации ключа с использованием параметров расширения ключа (key stretching) при генерации ключа из пароля. Параметры должны быть сбалансированы с точки зрения безопасности, производительности и устойчивости к атакам полного перебора при компрометации результирующего криптографического ключа.FalseTrue✓True✓V11.55Случайные значенияV11.5.11Убедитесь, что все случайные числа и строки, которые должны быть непредсказуемы, должны быть сгенерированы с помощью CSPRNG и иметь хотя бы 128 бит энтропии. Учтите, что UUID не удовлетворяют данному условию.FalseTrue✓True✓V11.5.22Убедитесь, что механизм генерации случайных чисел является надежным даже при высокой нагрузке.FalseFalseTrue✓V11.66Криптография с публичным ключомV11.6.11Убедитесь, что только утвержденные криптографические алгоритмы и режимы операций используются для генерации ключа и инициализации случайного значения для его генерации (seeding), а также для генерации цифровой подписи и верификации. Алгоритмы генерации ключей не должны генерировать небезопасные ключи уязвимые к известным атакам, например, ключи RSA уязвимы к факторизации Ферма.FalseTrue✓True✓V11.6.22Убедитесь, что для обмена ключами используются утверждённые криптографические алгоритмы (например, Диффи-Хеллман) с особым вниманием к обеспечению использования безопасных параметров. Это предотвратит атаки на процесс установления ключа, которые могут привести к атакам «человек посередине» или криптографическим взломам.FalseFalseTrue✓V11.77Шифрование данных в процессе использованияV11.7.11Убедитесь, что используется полное шифрование памяти, которое защищает конфиденциальные данные во время их использования, предотвращая доступ к ним неавторизованных пользователей или процессов.FalseFalseTrue✓V11.7.22Убедитесь, что минимизация данных обеспечивает раскрытие минимально необходимого объёма данных во время обработки, а также что данные шифруются сразу после использования или как можно скорее.FalseFalseTrue✓V1212SecureБезопасная коммуникацияV12.11Общие рекомендации по безопасности TLSV12.1.11Убедитесь, что включены только актуальные и рекомендуемые версии протокола TLS, такие как TLS 1.2 и TLS 1.3. Наиболее свежая версия TLS должна быть выбрана как предпочтительная.True✓True✓True✓V12.1.22Убедитесь, что включены рекомендуемые шифронаборы (cipher suites), предпочтение также стоит отдать самому сильному шифронабору. L3 приложения должны поддерживать только те наборы шифров (cipher suites), которые обеспечивают прямую (forward) секретность. Пояснение: Прямая секретность (Forward Secrecy, FS) — это криптографическая особенность, при которой сессионные ключи уникальны для каждой сессии и не зависят от долгосрочных ключей. Это гарантирует, что даже при компрометации долгосрочного ключа злоумышленник не сможет расшифровать ранее перехваченные зашифрованные сессии.FalseTrue✓True✓V12.1.33Убедитесь, что приложение проверяет доверенность клиентских сертификатов mTLS, прежде чем использовать идентификацию по сертификату для аутентификации или авторизации.FalseTrue✓True✓V12.1.44Убедитесь, что включена и настроена правильная проверка отзыва сертификатов, такая как Online Certificate Status Protocol (OCSP) Stapling.FalseFalseTrue✓V12.1.55Убедитесь, что в настройках TLS приложения включена функция Encrypted Client Hello (ECH) для предотвращения раскрытия конфиденциальных метаданных, таких как Server Name Indication (SNI), во время процесса TLS-рукопожатия.FalseFalseTrue✓V12.22HTTPS коммуникация с внешними сервисамиV12.2.11Убедитесь, что для всех соединений между клиентом и внешними HTTP-сервисами используется TLS и не происходит отката к небезопасным или незашифрованным протоколам.True✓True✓True✓V12.2.22Убедитесь, что внешние сервисы используют публично доверенные TLS-сертификаты.True✓True✓True✓V12.33Общая безопасность межсервисного взаимодействияV12.3.11Убедитесь, что для всех входящих и исходящих соединений приложения используется зашифрованный протокол, например TLS, включая системы мониторинга, инструменты управления, удалённый доступ и SSH, промежуточное ПО, базы данных, мейнфреймы, партнёрские системы и внешние API. Сервер не должен допускать откат к небезопасным или незашифрованным протоколам.FalseTrue✓True✓V12.3.22Убедитесь, что TLS-клиент проверяет сертификат сервера до установления защищенного соединения с TLS-сервером.FalseTrue✓True✓V12.3.33Убедитесь, что все внутренние HTTP-взаимодействия между компонентами приложения используют TLS или другой подходящий механизм транспортного шифрования, и не происходит откат к небезопасным или незашифрованным коммуникациям.FalseTrue✓True✓V12.3.44Убедитесь, что TLS-соединения между внутренними сервисами используют доверенные сертификаты. Если используются внутренние или самоподписанные сертификаты, потребляющий сервис должен быть настроен на доверие только к конкретным внутренним центрам сертификации (CA) и конкретным самоподписанным сертификатам.FalseTrue✓True✓V12.3.55Убедитесь, что сервисы, взаимодействующие внутри системы (intra-service communications), используют строгую аутентификацию для проверки каждого конечного узла. Для проверки подлинности взаимодействующих сторон должны применяться методы строгой аутентификации, такие как аутентификация TLS-клиента, с использованием инфраструктуры открытых ключей и механизмов, устойчивых к атакам повтора (replay attacks). Для микросервисных архитектур рекомендуется использование service mesh для упрощения управления сертификатами и повышения безопасности.FalseFalseTrue✓V1313ConfigurationКонфигурацияV13.11Документация конфигурацииV13.1.11Убедитесь, что все необходимые доступы приложения задокументированы. Сюда должны быть включены как внешние сервисы, от которых зависит приложение, так и сценарии, когда конечный пользователь может задавать адреса для внешнего подключения.FalseTrue✓True✓V13.1.22Убедитесь, что для каждого сервиса, используемого приложением, в документации определено максимальное количество одновременных соединений (например, лимиты пула соединений) и описано поведение приложения при достижении этого лимита, включая любые механизмы отказоустойчивости или восстановления, чтобы предотвратить ситуации отказа в обслуживании (DoS).FalseFalseTrue✓V13.1.33Убедитесь, что в документации приложения определены стратегии управления ресурсами для каждой внешней системы или сервиса, которые оно использует (например, базы данных, файловые дескрипторы, потоки, HTTP-соединения). Стратегии должны включать процедуры освобождения ресурсов, настройки таймаутов, обработку сбоев, а также, если реализована логика повторных попыток, указание лимитов, задержек и алгоритмов back-off. Для синхронных HTTP-запросов должны быть заданы короткие таймауты, а повторные запросы должны быть отключены, либо строго ограничены по числу попыток, чтобы предотвратить каскадные задержки и истощение ресурсов.FalseFalseTrue✓V13.1.44Убедитесь, что в документации приложения определены секреты, критически важные для безопасности приложения, а также установлен график их ротации в соответствии с моделью угроз организации и её бизнес-требованиями.FalseFalseTrue✓V13.22Конфигурация бэкенд соединенийV13.2.11Убедитесь, что коммуникации между компонентами бэкенда приложения (включая API, промежуточное ПО и уровни данных), которые не поддерживают стандартный механизм пользовательских сессий, проходят с аутентификацией. Аутентификация должна использовать индивидуальные сервисные аккаунты, краткосрочные токены или аутентификацию на основе сертификатов, а не постоянные учётные данные, такие как пароли, API-ключи или общие аккаунты с привилегированным доступом.FalseTrue✓True✓V13.2.22Убедитесь, что коммуникации между компонентами бэкенда приложения, включая локальные или системные службы, API, промежуточное ПО и уровни данных, выполняются с использованием аккаунтов, которым назначены минимально необходимые привилегии.FalseTrue✓True✓V13.2.33Убедитесь, что если для аутентификации в сервисе используются учётные данные, то используемые потребителем учётные данные не являются стандартными (например, root/root или admin/admin).FalseTrue✓True✓V13.2.44Убедитесь, что используется белый список (allowlist) для определения внешних ресурсов или систем, с которыми приложению разрешено взаимодействовать (например, для исходящих запросов, загрузки данных или доступа к файлам). Этот белый список может быть реализован на уровне приложения, веб-сервера, межсетевого экрана или комбинации различных уровней.FalseTrue✓True✓V13.2.55Убедитесь, что веб- или прикладной сервер настроен с белым списком ресурсов или систем, к которым сервер может отправлять запросы или из которых может загружать данные и файлы.FalseTrue✓True✓V13.2.66Убедитесь, что при подключении приложения к другим сервисам соблюдается задокументированная конфигурация для каждого соединения, включая максимальное количество параллельных соединений, поведение при достижении их максимума, таймауты и стратегии повторных попыток подключения.FalseFalseTrue✓V13.33Управление секретамиV13.3.11Убедитесь, что для безопасного создания, хранения, контроля доступа и уничтожения секретов бэкенда используется решение для управления секретами, например, хранилище ключей (key vault). Секретами могут быть пароли, ключевой материал, интеграции с базами данных и сторонними системами, ключи и seed-значения для токенов с ограниченным временем действия, другие внутренние секреты и API-ключи. Секреты не должны включаться в исходный код приложения или артефакты сборки. Для приложений уровня L3 необходимо использовать аппаратное решение, например, аппаратный модуль безопасности (HSM).FalseTrue✓True✓V13.3.22Убедитесь, что доступ к секретным ресурсам осуществляется в соответствии с принципом минимально необходимых привилегий (least privilege).FalseTrue✓True✓V13.3.33Убедитесь, что все криптографические операции выполняются с использованием изолированного модуля безопасности (например, хранилища ключей или аппаратного модуля безопасности), чтобы надежно управлять ключевым материалом и защищать его от утечки за пределы модуля безопасности.FalseFalseTrue✓V13.3.44Убедитесь, что секреты настроены на срок действия и ротацию в соответствии с документацией приложения.FalseFalseTrue✓V13.44Непреднамеренная утечка информацииV13.4.11Убедитесь, что приложение развернуто либо без метаданных систем контроля версий (включая папки .git или .svn), либо так, чтобы эти папки были недоступны как извне, так и для самого приложения.True✓True✓True✓V13.4.22Убедитесь, что режимы отладки отключены для всех компонентов в промышленной среде, чтобы предотвратить раскрытие функций отладки и утечку информации.FalseTrue✓True✓V13.4.33Убедитесь, что веб-серверы не показывают клиентам списки содержимого каталогов, если это явно не предусмотрено.FalseTrue✓True✓V13.4.44Убедитесь, что метод HTTP TRACE не поддерживается в продуктовой среде, чтобы избежать потенциальной утечки информации.FalseTrue✓True✓V13.4.55Убедитесь, что документация (например, по внутренним API) и мониторинговые эндпоинты не доступны, если это явно не предусмотрено.FalseTrue✓True✓V13.4.66Убедитесь, что приложение не раскрывает подробную информацию о версиях компонентов бэкенда.FalseFalseTrue✓V13.4.77Убедитесь, что веб-слой настроен на обслуживание только файлов с определёнными расширениями, чтобы предотвратить непреднамеренную утечку информации, конфигураций и исходного кода.FalseFalseTrue✓V1414DataЗащита информацииV14.11Документация по защите информацииV14.1.11Убедитесь, что все конфиденциальные данные, создаваемые и обрабатываемые приложением, идентифицированы и классифицированы по уровням защиты. Включая закодированные данные, которые легко декодируются, например, строки Base64 или незашифрованные данные в полезной нагрузке JWT. Уровни защиты должны учитывать требования по защите данных и конфиденциальности, которым должно соответствовать приложение.FalseTrue✓True✓V14.1.22Убедитесь, что для каждого уровня защиты конфиденциальных данных требования к защите задокументированы. Они должны включать (но не ограничиваться) требования по шифрованию, проверке целостности, срокам хранения, способам логирования данных, контролю доступа к чувствительным данным в логах, шифрованию на уровне базы данных, применению технологий повышения конфиденциальности, а также другим требованиям по конфиденциальности.FalseTrue✓True✓V14.22Базовые меры по защите информацииV14.2.11Убедитесь, что конфиденциальные данные передаются на сервер только в теле HTTP-запроса или в заголовках. URL и строка запроса не должны содержать конфиденциальную информацию, такую как API-ключ или сессионный токен.True✓True✓True✓V14.2.22Убедитесь, что приложение предотвращает кэширование конфиденциальных данных в серверных компонентах, таких как балансировщики нагрузки и кэши приложений, либо гарантирует их надежное удаление после использования.FalseTrue✓True✓V14.2.33Убедитесь, что заранее определённые конфиденциальные данные не отправляются ненадёжным сторонам (например, системам трекинга пользователей), чтобы предотвратить нежелательный сбор данных вне контроля приложения.FalseTrue✓True✓V14.2.44Убедитесь, что для конфиденциальных данных реализованы меры по шифрованию, проверке целостности, срокам хранения, способам логирования, контролю доступа к данным в логах, а также применяются технологии повышения конфиденциальности в соответствии с документацией для соответствующего уровня защиты данных.FalseTrue✓True✓V14.2.55Убедитесь, что механизмы кэширования настроены так, чтобы кэшировать только ответы с ожидаемым типом содержимого для данного ресурса и не содержать конфиденциального динамического контента. При обращении к несуществующему файлу, веб-сервер должен возвращать ответ 404 или 302, а не подменять на другой существующий файл, что позволит предотвратить атаки типа Web Cache Deception.FalseFalseTrue✓V14.2.66Убедитесь, что приложение возвращает только минимально необходимый объем конфиденциальных данных для выполнения своей функциональности. Например, показывает только часть цифр номера кредитной карты, а не полный номер. Если требуется отображение полных данных, они должны быть замаскированы в пользовательском интерфейсе, пока пользователь специально не запросил их просмотр.FalseFalseTrue✓V14.2.77Убедитесь, что конфиденциальная информация подлежит классификации по срокам хранения, чтобы устаревшие или ненужные данные удалялись автоматически, по расписанию или по мере необходимости.FalseFalseTrue✓V14.2.88Убедитесь, что конфиденциальная информация удаляется из метаданных файлов, загружаемых пользователями, если пользователь явно не согласился на ее хранение.FalseFalseTrue✓V14.33Защита данных на стороне клиентаV14.3.11Убедитесь, что аутентифицированные данные очищаются из клиентского хранилища, например, из DOM браузера, после завершения работы клиента или сессии. Заголовок HTTP-ответа Clear-Site-Data может помочь в этом, но клиентская сторона также должна уметь очищать данные, если соединение с сервером недоступно при завершении сессии.True✓True✓True✓V14.3.22Убедитесь, что приложение устанавливает HTTP-заголовки, достаточные для предотвращения кэширования (например, Cache-Control: no-store), чтобы конфиденциальные данные не сохранялись в браузерах.FalseTrue✓True✓V14.3.33Убедитесь, что данные, хранящиеся в браузерном хранилище (например, localStorage, sessionStorage, IndexedDB или cookie), не содержат конфиденциальной информации, за исключением сессионных токенов.FalseTrue✓True✓V1515SecureБезопасная разработка и архитектураV15.11Документация по безопасной разработке и архитектуреV15.1.11Убедитесь, что в документации по приложению определены сроки устранения уязвимостей на основе оценки рисков для внешних зависимостей с уязвимостями и для обновления библиотек в целом, чтобы минимизировать риск, связанный с этими компонентами.True✓True✓True✓V15.1.22Убедитесь, что ведется реестр всех используемых сторонних библиотек (например, Software Bill of Materials, SBOM), с обязательной проверкой, что компоненты получены из предопределенных, доверенных и регулярно поддерживаемых репозиториев.FalseTrue✓True✓V15.1.33Убедитесь, что в документации приложения указан функционал, требующий значительных временных или вычислительных ресурсов. Необходимо указать, как предотвратить потерю доступности из-за чрезмерного использования этого функционала и как избежать ситуаций, когда формирование ответа занимает больше времени, чем установленный системой таймаут. Возможные меры защиты могут включать асинхронную обработку, использование очередей и ограничение количества параллельных процессов для каждого пользователя и приложения.FalseTrue✓True✓V15.1.44Убедитесь, что в документации приложения указаны внешние библиотеки, которые считаются «компонентами с повышенным риском».FalseFalseTrue✓V15.1.55Убедитесь, что в документации приложения выделены те части приложения, в которых используются «функционал с повышенным риском».FalseFalseTrue✓V15.22Архитектура безопасности и зависимостиV15.2.11Убедитесь, что приложение содержит только те компоненты, которые не нарушили задокументированные сроки обновления и исправления.True✓True✓True✓V15.2.22Убедитесь, что в приложении реализованы меры защиты от потери доступности из-за функциональности, требующей много времени или ресурсов, на основе задокументированных решений и стратегий безопасности для этого.FalseTrue✓True✓V15.2.33Убедитесь, что производственная среда включает только те функции, которые необходимы для работы приложения, и не предоставляет лишние функции, такие как тестовый код, примеры кода и инструменты разработки.FalseTrue✓True✓V15.2.44Убедитесь, что сторонние компоненты и все их транзитивные зависимости загружаются только из ожидаемых репозиториев (внутренних или внешних) и отсутствует риск атаки через подмену зависимостей (dependency confusion attack)FalseFalseTrue✓V15.2.55Убедитесь, что приложение реализует дополнительные меры защиты для тех частей приложения, которые документированы как содержащие «функционал с повышенным риском» или использующие сторонние библиотеки, считающиеся «функционалом с повышенным риском». Это могут быть такие методы, как «песочница», инкапсуляция, контейнеризация или изоляция на сетевом уровне, чтобы задержать и предотвратить продвижение (pivoting) злоумышленников, скомпрометировавших одну часть приложения, к другим частям приложения.FalseFalseTrue✓V15.33Безопасное программированиеV15.3.11Убедитесь, что приложение возвращает только необходимое подмножество полей из объекта данных. Например, оно не должно возвращать весь объект данных, поскольку некоторые отдельные поля должны быть недоступны пользователям.True✓True✓True✓V15.3.22Убедитесь, что при вызовах внешних URL-адресов бэкэнд приложения настроен так, чтобы не выполнять перенаправления, если только это не предусмотрено функционалом.FalseTrue✓True✓V15.3.33Убедитесь, что в приложении реализованы защитные механизмы против атак типа массового присвоения (mass assignment) путем строгого ограничения разрешенных полей для каждого контроллера и действия, исключая возможность добавления или изменения значений полей, которые не должны быть доступны для данной конкретной операции.FalseTrue✓True✓V15.3.44Убедитесь, что все прокси и промежуточное ПО корректно передают исходный IP-адрес пользователя, используя доверенные поля данных, которые не могут быть изменены конечным пользователем, а приложение и веб-сервер используют это правильное значение для ведения логирования и принятия решений по безопасности, таких как ограничение запросов. При этом следует учитывать, что даже исходный IP-адрес может быть ненадежным из-за динамических IP-адресов, VPN или корпоративных файрволов.FalseTrue✓True✓V15.3.55Убедитесь, что приложение явно проверяет соответствие переменных ожидаемому типу данных и использует строгие операции сравнения. Это необходимо для предотвращения уязвимостей, связанных с type juggling и type confusion, вызванных тем, что код приложения делает предположения о типе переменной.FalseTrue✓True✓V15.3.66Убедитесь, что JavaScript-код написан таким образом, чтобы предотвратить prototype pollution, например, используя Set() или Map() вместо обычных литералов объекта.FalseTrue✓True✓V15.3.77Убедитесь, что приложение защищено от атак типа HTTP Parameter Pollution (HPP), особенно если используемый фреймворк не различает источники параметров запроса (строка запроса, тело запроса, куки или заголовки).FalseTrue✓True✓V15.44Безопасная работа с параллельными процессамиV15.4.11Убедитесь, что к общим объектам в многопоточном коде (например, кэшам, файлам или объектам в памяти, используемым несколькими потоками) используется безопасный многопоточный доступ и механизмов синхронизации, таких как блокировки или семафоры, чтобы избежать состояний гонки и повреждения данных.FalseFalseTrue✓V15.4.22Убедитесь, что проверки состояния ресурса, например его существования или разрешений, а также зависящие от него действия выполняются как одна атомарная операция, чтобы предотвратить условия гонки времени проверки и времени использования (TOCTOU). Например, проверка существования файла перед его открытием или проверка прав доступа пользователя перед его предоставлением.FalseFalseTrue✓V15.4.33Убедитесь, что блокировки применяются согласованно, чтобы предотвратить взаимные блокировки потоков (deadlocks) или их бесконечные повторы, а также что логика блокировки инкапсулирована в коде, отвечающем за управление ресурсом. Это гарантирует, что блокировки не могут быть случайно или намеренно изменены внешними классами или кодом.FalseFalseTrue✓V15.4.44Убедитесь, что политики распределения ресурсов предотвращают нехватку ресурсов у потоков, обеспечивая справедливый доступ к ресурсам, например, используя пулы потоков, позволяя потокам с более низким приоритетом выполняться в течение разумного периода времени.FalseFalseTrue✓V1616SecurityЖурналирование событий безопасности и обработка ошибокV16.11Документация по ведению логовV16.1.11Убедитесь в существовании реестра, в котором документируется ведение журнала на каждом уровне технологического стека приложения, включая какие события регистрируются, форматы логов, где хранятся эти журналы, как они используются, как контролируется доступ к ним и как долго хранятся журналы.FalseTrue✓True✓V16.22Общее журналированиеV16.2.11Убедитесь, что каждая запись журнала содержит необходимые метаданные (например, когда, где, кто, что), которые позволят провести подробное исследование временной шкалы, когда произошло событие.FalseTrue✓True✓V16.2.22Убедитесь, что все источники времени компонентов системы журналирования синхронизированы, а временные метки в метаданных событий безопасности используют UTC или содержат явное указание смещения часового пояса. Рекомендуется применять UTC для обеспечения согласованности в распределённых системах и предотвращения ошибок при переходе на летнее/зимнее время.FalseTrue✓True✓V16.2.33Убедитесь, что приложение записывает и передаёт логи исключительно в те файлы и сервисы, которые указаны в реестре журналирования.FalseTrue✓True✓V16.2.44Убедитесь, что логи могут быть прочитаны и коррелированы используемой системой обработки журналов, предпочтительно с использованием общего стандартного формата логирования.FalseTrue✓True✓V16.2.55Убедитесь, что приложение применяет соответствующие меры защиты при логировании конфиденциальных данных в зависимости от уровня их чувствительности: например, полностью запрещает запись в логи таких данных, как учетные данные или платежные реквизиты, а для других данных (например, сессионных токенов) использует хеширование или частичное/полное маскирование.FalseTrue✓True✓V16.33Инциденты безопасностиV16.3.11Убедитесь, что все операции аутентификации регистрируются, включая успешные и неудачные попытки. Также следует фиксировать дополнительные метаданные, такие как тип аутентификации или использованные факторы проверки.FalseTrue✓True✓V16.3.22Убедитесь, что ведется журнал неудачных попыток авторизации. Для уровня L3 это должно включать в себя журналирование всех решений об авторизации, включая журналирование доступа к конфиденциальным данным (без регистрации самих конфиденциальных данных).FalseTrue✓True✓V16.3.33Убедитесь, что приложение регистрирует все события безопасности, определенные в документации, а также фиксирует попытки обхода механизмов защиты, включая проверку входных данных, бизнес-логики и системы защиты от автоматизированных атак.FalseTrue✓True✓V16.3.44Убедитесь, что приложение регистрирует в журналах неожиданные ошибки и сбои механизмов безопасности, включая, например, ошибки TLS-соединения на стороне сервера.FalseTrue✓True✓V16.44Защита журналовV16.4.11Убедитесь, что все компоненты системы логирования корректно кодируют данные, чтобы предотвратить атаки типа внедрения в журналы (log injection).FalseTrue✓True✓V16.4.22Убедитесь, что логи защищены от неавторизованного доступа и не могут быть модифицированы.FalseTrue✓True✓V16.4.33Убедитесь, что логи безопасно передаются в логически изолированную систему для анализа, обнаружения угроз, генерации оповещений и эскалации инцидентов. Это гарантирует сохранность журналов даже в случае компрометации основного приложения.FalseTrue✓True✓V16.55Обработка ошибокV16.5.11Убедитесь, что при возникновении непредвиденной или связанной с безопасностью ошибки пользователю возвращается только общее сообщение, гарантируя отсутствие раскрытия конфиденциальных внутренних данных системы, таких как трассировки стека, запросы, секретные ключи и токены.FalseTrue✓True✓V16.5.22Убедитесь, что приложение продолжает работать в безопасном режиме при недоступности внешних ресурсов, используя такие механизмы, как автоматические выключатели (circuit breakers) или плавное снижение функциональности (graceful degradation).FalseTrue✓True✓V16.5.33Убедитесь, что приложение корректно и безопасно завершает работу при возникновении исключений, предотвращая опасные сценарии по типу «fail-open», когда, например, транзакция ошибочно выполняется, несмотря на ошибки в логике валидации.FalseTrue✓True✓V16.5.44Убедитесь, что определён обработчик ошибок «крайние меры», который будет перехватывать все необработанные ошибки. Это необходимо как для предотвращения потери информации об ошибках, которая должна быть записана в файлы журналов, так и для того, чтобы ошибка не остановила весь процесс приложения, что привело бы к потере доступности.FalseFalseTrue✓V1717WebRTCWebRTCV17.11TURN-серверV17.1.11Убедитесь, что сервис TURN (Traversal Using Relays around NAT) разрешает доступ только к IP-адресам, не зарезервированным для специальных целей (например, внутренние сети, широковещательная рассылка, loopback-адреса). Данное требование применяется как к IPv4, так и к IPv6 адресам.FalseTrue✓True✓V17.1.22Убедитесь, что сервис TURN (Traversal Using Relays around NAT) защищен от исчерпания ресурсов при попытках легитимных пользователей открыть чрезмерное количество портов на сервере.FalseFalseTrue✓V17.22Требования к медиасерверамV17.2.11Убедитесь, что ключ сертификата Datagram Transport Layer Security (DTLS) управляется и защищается в соответствии с документированной политикой управления криптографическими ключами.FalseTrue✓True✓V17.2.22Убедитесь, что медиасервер настроен на использование только одобренных наборов шифров Datagram Transport Layer Security (DTLS) и защищенного профиля безопасности для расширения DTLS, применяемого при установке ключей для Secure Real-time Transport Protocol (DTLS-SRTP).FalseTrue✓True✓V17.2.33Убедитесь, что медиасервер проверяет аутентификацию Secure Real-time Transport Protocol (SRTP) для предотвращения атак с внедрением Real-time Transport Protocol (RTP), которые могут привести к отказу в обслуживании (Denial of Service) или вставке поддельного аудио-/видеоконтента в медиапотоки.FalseTrue✓True✓V17.2.44Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика при получении некорректных пакетов Secure Real-time Transport Protocol (SRTP).FalseTrue✓True✓V17.2.55Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетами Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.FalseFalseTrue✓V17.2.66Убедитесь, что медиасервер не подвержен уязвимости «Гонка ClientHello» (ClientHello Race Condition) в Datagram Transport Layer Security (DTLS), проверив наличие известных уязвимостей в публичных источниках или выполнив тестирование на воспроизведение условий гонки.FalseFalseTrue✓V17.2.77Убедитесь, что механизмы аудио- и видеозаписи, связанные с медиасервером, способны продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетов Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.FalseFalseTrue✓V17.2.88Убедитесь, что сертификат Datagram Transport Layer Security (DTLS) проверяется на соответствие атрибуту отпечатка (fingerprint) в Session Description Protocol (SDP), с немедленным прекращением медиапотока в случае несоответствия — это гарантирует подлинность передаваемых данных.FalseFalseTrue✓V17.33СигнализацияV17.3.11Убедитесь, что сигнальный сервер способен продолжать обработку легитимных входящих сообщений сигнализации даже в условиях флуд-атаки. Для этого необходимо реализовать механизм ограничения частоты запросов (rate limiting) на уровне сигнализации.FalseTrue✓True✓V17.3.22Убедитесь, что сигнальный сервер способен продолжать обработку легитимных сообщений сигнализации даже при получении некорректных сообщений, которые могут вызвать отказ в обслуживании (Denial of Service, DoS). Для этого необходимо реализовать: проверку входных данных (input validation), безопасную обработку целочисленных переполнений (integer overflows), защиту от переполнения буферов (buffer overflows) и другие надежные методы обработки ошибок.FalseTrue✓True✓ diff --git a/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.xml b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.xml new file mode 100644 index 0000000000..ef668c334f --- /dev/null +++ b/5.0/docs_ru/OWASP_Application_Security_Verification_Standard_5.0.0_ru.xml @@ -0,0 +1 @@ +Application Security Verification Standard ProjectASVSThe OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.V11EncodingКодировка и нейтрализацияV1.11Архитектура кодировки и нейтрализацииV1.1.11Убедитесь, что входные данные декодируются или деэкранируются в каноническую форму (в стандартное представление) только один раз. Декодирование происходит только тогда, когда ожидаются закодированные данные в этой форме, и что это делается перед дальнейшей обработкой входных данных, например, это не выполняется после проверки или нейтрализации.2V1.1.22Убедитесь, что приложение выполняет кодирование и экранирование выходных данных либо в качестве последнего шага перед использованием интерпретатором, для которого оно предназначено, либо самим интерпретатором.2V1.22Предотвращение инъекцийV1.2.11Убедитесь, что выходная кодировка для ответа HTTP, документа HTML или документа XML соответствует требуемому контексту, например, кодировка соответствующих символов для элементов HTML, атрибутов HTML, комментариев HTML, CSS или полей заголовка HTTP делается таким способом, чтобы избежать изменения структуры сообщения или документа.1V1.2.22Убедитесь, что при динамическом построении URL-адресов недоверенные данные кодируются в соответствии с их контекстом (например, кодирование URL-адресов или кодирование base64url для query или path параметров или пути). Убедитесь, что разрешены только безопасные протоколы URL-адресов (например, запрещен javascript: или data:).1V1.2.33Убедитесь, что при динамическом построении содержимого JavaScript (включая JSON) используется кодирование или экранирование выходных данных, чтобы избежать изменения структуры сообщения или документа (чтобы избежать JavaScript и JSON-инъекций).1V1.2.44Убедитесь, что выборка данных (Redis, Memcached, чтение из файлов, обращение по API) или запросы к базе данных (например, SQL, HQL, NoSQL, Cypher) используют параметризованные запросы, ORM, Entity Frameworks или иным образом защищены от SQL-инъекций и других атак. Это также актуально при написании хранимых процедур.1V1.2.55Убедитесь, что приложение защищено от внедрения команд ОС и что вызовы операционной системы используют параметризованные запросы к ОС или используют контекстное кодирование вывода командной строки.1V1.2.66Убедитесь, что приложение защищено от LDAP-инъекций, или что реализованы специальные меры безопасности для их предотвращения.2V1.2.77Убедитесь, что приложение защищено от атак с использованием XPath-инъекций с помощью параметризации запросов или предварительно скомпилированных запросов.2V1.2.88Убедитесь, что процессоры LaTeX настроены безопасно (например, не используется флаг «–shell‑escape») и используется разрешенный список команд для предотвращения LaTeX-инъекций.2V1.2.99Убедитесь, что приложение экранирует специальные символы в регулярных выражениях (обычно с помощью обратной косой черты), чтобы предотвратить их ошибочную интерпретацию как метасимволов.2V1.2.1010Убедитесь, что приложение защищено от внедрения формул CSV (CSV Injection). Приложение должно следовать правилам экранирования, определенным в RFC 4180, разделы 2.6 и 2.7, при экспорте содержимого CSV. Кроме того, при экспорте в CSV или другие форматы электронных таблиц (такие как XLS, XLSX или ODF) специальные символы (включая '=', '+', '-', '@', '\t' (табуляция), и '\0' (нулевой символ)) должны экранироваться одинарной кавычкой, если они появляются в качестве первого символа в значении поля.3V1.33НейтрализацияV1.3.11Убедитесь, что все ненадежные входные данные HTML из редакторов WYSIWYG или аналогичных программ нейтрализуются с помощью известных и безопасных библиотек или функций фреймворка для санитизации HTML.1V1.3.22Убедитесь, что приложение избегает использования eval() или других динамических функций выполнения кода, таких как Spring Expression Language (SpEL). Если нет альтернативы, любой пользовательский ввод должен быть нейтрализован перед выполнением.1V1.3.33Убедитесь, что данные, передаваемые в потенциально опасный контекст, предварительно нейтрализованы, чтобы обеспечить соблюдение мер безопасности, таких как разрешение только тех символов, которые безопасны для данного контекста, и обрезка слишком длинного ввода.2V1.3.44Убедитесь, что предоставленный пользователем файл .SVG проверен или нейтрализован, чтобы он содержал только теги и атрибуты (например, относящиеся к рисованию), которые безопасны для приложения, например, не содержат скриптов и foreignObject.2V1.3.55Убедитесь, что приложение нейтралует или отключает предоставленные пользователем скриптовые данные или выражения шаблонных языков, такие как таблицы стилей Markdown, CSS или XSL, BBCode или аналогичные.2V1.3.66Убедитесь, что приложение защищено от атак с подделкой запросов на стороне сервера (SSRF), проверяя ненадежные данные по разрешенному списку протоколов, доменов, путей и портов, а также нейтрализуя потенциально опасные символы перед использованием данных для вызова другой службы.2V1.3.77Убедитесь, что приложение защищено от атак с внедрением шаблонов (template injection), не позволяя создавать шаблоны на основе недоверенных входных данных. Если нет альтернативы, любые недоверенные входные данные, включаемые динамически во время создания шаблона, должны быть нейтрализованы или тщательно провалидированы.2V1.3.88Убедитесь, что приложение надлежащим образом нейтрализует недоверенные входные данные перед использованием в запросах Java Naming and Directory Interface (JNDI) и что JNDI настроен безопасно для предотвращения атак с использованием JNDI-инъекций.2V1.3.99Убедитесь, что приложение нейтрализует данные перед отправкой в Memcache, чтобы предотвратить атаки методом инъекций.2V1.3.1010Убедитесь, что строки форматирования, которые могут быть использованы неожидаемым или вредоносным образом, нейтрализуются перед дальнейшим использованием.2V1.3.1111Убедитесь, что приложение нейтрализует вводимые пользователем данные перед передачей в почтовые системы для защиты от SMTP или IMAP-инъекций.2V1.3.1212Убедитесь, что регулярные выражения не содержат элементов, вызывающих экспоненциальный возврат, и убедитесь в нейтрализации недоверенных входных данных для предотвращения атак ReDoS или Runaway Regex.3V1.44Память, строки и неуправляемый кодV1.4.11Убедитесь, что для обнаружения или предотвращения ситуаций переполнения стека, буфера или кучи приложение учитывает размер доступной области памяти при строковых операциях, копировании в память, в арифметике указателей и т.п.2V1.4.22Убедитесь, что для предотвращения целочисленного переполнения применяется контроль знака, диапазона и типа допустимых входных данных.2V1.4.33Убедитесь, что динамически выделенная память и ресурсы освобождены, а ссылки или указатели на освобожденную память удалены или установлены в значение null, чтобы предотвратить появление висячих указателей и уязвимостей, связанных с использованием памяти после освобождения.2V1.55Безопасная десериализацияV1.5.11Убедитесь, что приложение настраивает XML-парсеры на использование строгой конфигурации и что небезопасные функции, такие как разрешение внешних сущностей, отключены для предотвращения атак XML eXternal Entity (XXE).1V1.5.22Убедитесь, что десериализация недоверенных данных обеспечивает безопасную обработку ввода, например, используя список разрешенных типов объектов или ограничивая типы объектов, определяемые клиентом, для предотвращения атак десериализации. Механизмы десериализации, которые явно определены как небезопасные, не должны использоваться с недоверенным вводом.2V1.5.33Убедитесь, что различные парсеры, используемые в приложении для одного и того же типа данных (например, парсеры JSON, XML, URL), выполняют парсинг согласованным образом и используют один и тот же механизм кодирования символов, чтобы избежать таких проблем, как уязвимости взаимодействия JSON (JSON Interoperability) или различное поведение анализа URI или файлов, которые могут использоваться в атаках удаленного включения файлов (RFI) или подделки запросов на стороне сервера (SSRF).3V22ValidationВалидация и бизнес-логикаV2.11Документация валидации и бизнес-логикиV2.1.11Убедитесь, что в документации приложения определены правила проверки входных данных на соответствие ожидаемой структуре. Это могут быть распространённые форматы данных, такие как номера кредитных карт, адреса электронной почты, номера телефонов, или внутренний формат данных.1V2.1.22Убедитесь, что в документации приложения указано, как проверять логическую и контекстную согласованность объединенных данных, например, проверять соответствие района и почтового индекса.2V2.1.33Убедитесь, что ожидания относительно ограничений и проверок бизнес-логики задокументированы как для уровня отдельного пользователя, так и для глобального уровня всего приложения.2V2.22Валидация вводаV2.2.11Убедитесь, что входные данные провалидированы для обеспечения соответствия бизнес- или функциональным ожиданиям. Валидация должна осуществляться либо по списку допустимых значений, шаблонов и диапазонов, либо путем сравнения входных данных с ожидаемой структурой и логическими ограничениями в соответствии с предопределенными правилами. Для L1 валидация может быть сосредоточена на входных данных, используемых для принятия конкретных бизнес-решений или решений, связанных с безопасностью. Для L2 и выше это должно применяться ко всем входным данным.1V2.2.22Убедитесь, что приложение разработано с принудительной валидацией входных данных на уровне доверенного сервиса. Хотя проверка на стороне клиента повышает удобство использования и должна поощряться, на неё не следует полагаться как на средство контроля безопасности.1V2.2.33Убедитесь, что приложение обеспечивает обоснованность комбинаций данных в соответствии с предопределенными правилам. Например: возраст должен соответствовать дате рождения; страна и почтовый индекс; количество товара в заказе и на складе.2V2.33Безопасность бизнес-логикиV2.3.11Убедитесь, что приложение обрабатывает потоки бизнес-логики для одного и того же пользователя в ожидаемом последовательном порядке шагов и без пропуска шагов.1V2.3.22Убедитесь, что ограничения бизнес-логики реализованы в соответствии с документацией приложения, чтобы избежать эксплуатации её недостатков.2V2.3.33Убедитесь, что транзакции используются на уровне бизнес-логики таким образом, что операция бизнес-логики либо выполняется полностью, либо откатывается к предыдущему корректному состоянию.2V2.3.44Убедитесь, что на уровне бизнес-логики используются механизмы блокировки, чтобы гарантировать невозможность двойного бронирования ограниченных по количеству ресурсов (например, мест в театре или слотов доставки) путем манипулирования логикой приложения.2V2.3.55Убедитесь, что для важных потоков бизнес-логики требуется многопользовательское (multi-user) одобрение, чтобы предотвратить несанкционированные или случайные действия. Потоки бизнес-логики могут включать, помимо прочего, крупные денежные переводы, утверждение контрактов, доступ к секретной информации или обход ограничений безопасности на производстве.3V2.44Анти-автоматизацияV2.4.11Убедитесь, что используются средства противодействия автоматизации для защиты от чрезмерных вызовов функций приложения, которые могут привести к утечке данных, созданию ненужных данных, исчерпанию квот, нарушению ограничений скорости, отказу в обслуживании или чрезмерному использованию дорогостоящих ресурсов.2V2.4.22Убедитесь, что потоки бизнес-логики требуют реалистичного человеческого времени, предотвращая чрезмерно быструю отправку транзакций.3V33WebБезопасность веб-интерфейсаV3.11Документация по безопасности веб-интерфейсаV3.1.11Убедитесь, что в документации приложения описаны ожидаемые функции безопасности, которые должны поддерживать браузеры, использующие приложение (такие как HTTPS, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) и другие соответствующие механизмы безопасности HTTP). В документации также должно быть обязательно определено, как приложение должно себя вести, если некоторые из этих функций недоступны (например, предупреждать пользователя или блокировать доступ).3V3.22Непреднамеренная интерпретация контентаV3.2.11Убедитесь, что реализованы меры безопасности, предотвращающие отображение контента или функций браузерами в HTTP-ответах в некорректном контексте (например, запрос API, загруженный пользователем файл или другой ресурс запрашивается напрямую). Возможные способы контроля включают: не обрабатывать содержимое, если поля заголовка HTTP-запроса (например, Sec-Fetch-*) не указывают на корректность контекста; использование заголовка и значения Content-Security-Policy: sandbox directive; или использование заголовка и значения Content-Disposition: attachment.1V3.2.22Убедитесь, что данные, предназначенные для отображения в виде текста, а не визуализации в виде HTML, обрабатывается с использованием безопасных функций визуализации (таких как createTextNode или textContent), чтобы предотвратить непреднамеренное выполнение содержимого, такого как HTML или JavaScript.1V3.2.33Убедитесь, что приложение избегает затирания DOM при использовании JavaScript на стороне клиента, применяя явные объявления переменных, выполняя строгую проверку типов, избегая сохранения глобальных переменных в объекте документа и реализуя изоляцию пространства имен.3V3.33Настройка файлов cookieV3.3.11Убедитесь, что у файлов cookie установлен атрибут «Secure», и если префикс «__Host‑» не используется в названии cookie, необходимо использовать префикс «__Secure‑».1V3.3.22Убедитесь, что значение атрибута SameSite каждой cookie установлено в соответствии с назначением cookie, чтобы ограничить подверженность атакам на восстановление пользовательского интерфейса и атакам с подделкой запросов на уровне браузера, обычно называемым подделкой межсайтовых запросов (CSRF).2V3.3.33Убедитесь, что cookie имеют префикс «__Host‑» в названии, если только они явно не предназначены для совместного использования с другими хостами.2V3.3.44Убедитесь, что если значение cookie не должно быть доступно для клиентских скриптов (например, сессионный токен), для cookie должен быть установлен атрибут «HttpOnly», а само значение должно передаваться клиенту только через поле заголовка «Set-Cookie».2V3.3.55Убедитесь, что при записи cookie приложением общая длина имени и значения cookie не превышает 4096 байт. Слишком большие cookie не будут сохраняться браузером и, следовательно, не будут отправляться с запросами, что помешает пользователю использовать функции приложения, зависящие от этого cookie.3V3.44Заголовки механизма безопасности браузераV3.4.11Убедитесь, что поле заголовка Strict‑Transport‑Security включено во все ответы для реализации политики HTTP Strict Transport Security (HSTS). Необходимо указать максимальное время не менее 1 года, а для L2 и выше политика должна применяться также ко всем поддоменам.1V3.4.22Убедитесь, что поле заголовка Cross‑Origin Resource Sharing (CORS) «Access‑Control‑Allow‑Origin» имеет фиксированное значение, заданное приложением, или, если используется заголовок Origin, оно проверяется по списку доверенных источников. При необходимости использования «Access‑Control‑Allow‑Origin: *» убедитесь, что ответ не содержит конфиденциальной информации.1V3.4.33Убедитесь, что HTTP-ответы содержат поле заголовка Content-Security-Policy, которое определяет директивы, гарантирующие загрузку и выполнение браузером только доверенного контента или ресурсов, чтобы ограничить выполнение вредоносного JavaScript. Как минимум, необходимо использовать глобальную политику, включающую директивы object-src «none» и base-uri «none», а также определяющую список разрешенных адресов или использующую одноразовые коды или хэши. Для приложений L3 необходимо определить политику использования 'nonce' или hash-конструкций для каждого ответа.2V3.4.44Убедитесь, что все HTTP-ответы содержат поле заголовка «X‑Content‑Type‑Options: nosniff». Это предписывает браузерам не использовать анализ контента и определение типа MIME для данного ответа, а также требовать, чтобы значение поля заголовка Content‑Type в ответе соответствовало целевому ресурсу. Например, ответ на запрос стиля принимается только в том случае, если Content‑Type в ответе — «text/css». Это также позволяет браузеру использовать функцию Cross‑Origin Read Blocking (CORB).2V3.4.55Убедитесь, что приложение устанавливает политику реферера для предотвращения утечки технически конфиденциальных данных сторонним сервисам через поле заголовка HTTP-запроса «Referer». Это можно сделать с помощью поля заголовка HTTP-ответа «Referrer‑Policy» или через атрибуты HTML-элемента. Конфиденциальные данные могут включать путь и данные запроса в URL-адресе, а для внутренних непубличных приложений также имя хоста.2V3.4.66Убедитесь, что веб-приложение использует директиву frame‑ancestors поля заголовка Content‑Security‑Policy для каждого HTTP-ответа, чтобы гарантировать невозможность его внедрения по умолчанию и внедрение определённых ресурсов разрешено только при необходимости. Обратите внимание, что поле заголовка X‑Frame‑Options, хотя и поддерживается браузерами, устарело и не может быть использовано в качестве основы.2V3.4.77Убедитесь, что в поле заголовка Content‑Security‑Policy указано место, куда следует сообщать о нарушениях.3V3.4.88Убедитесь, что все HTTP-ответы, инициирующие рендеринг документа (например, ответы с типом содержимого text/html), включают поле заголовка Cross-Origin-Opener-Policy с директивой same-origin или same-origin-allow-popups (при необходимости). Это предотвращает атаки, злоупотребляющие общим доступом к объектам Window, такие как Tabnabbing и Frame Counting.3V3.55Браузерное разделение источниковV3.5.11Убедитесь, что, если приложение не использует механизм предварительной проверки CORS для предотвращения запрещённых кросс-доменных запросов на использование чувствительного функционала, эти запросы валидируются на предмет их происхождения от самого приложения. Это можно сделать, используя и проверяя специальные токены для защиты от подделки или требуя дополнительные поля HTTP-заголовка, не входящие в список «простых заголовков» (CORS-safelisted request-header). Это необходимо для защиты от атак с подделкой запросов через браузер, широко известных как межсайтовая подделка запросов (CSRF).1V3.5.22Убедитесь, что если приложение использует механизм предварительной проверки CORS для предотвращения неразрешённого использования чувствительного функционала между источниками, вызов этого функционала невозможен с помощью запроса, который не запускает предварительную проверку CORS. Для этого может потребоваться проверка значений полей заголовка запроса «Origin» и «Content-Type» или использование дополнительного поля заголовка, не входящего в безопасный список CORS.1V3.5.33Убедитесь, что HTTP-запросы к чувствительному функционалу используют соответствующие HTTP-методы, такие как POST, PUT, PATCH или DELETE, а не методы, определённые спецификацией HTTP как «безопасные», такие как HEAD, OPTIONS или GET. В качестве альтернативы можно использовать строгую валидацию полей заголовка запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, навигационного запроса или загрузки ресурса (например, источника изображения), где это не ожидается.1V3.5.44Убедитесь, что отдельные приложения размещены на разных именах хостов, чтобы использовать ограничения, предусмотренные политикой same-origin, включая то, как документы или скрипты, загруженные одним источником, могут взаимодействовать с ресурсами из другого источника, а также ограничения на cookie на основе имени хоста.2V3.5.55Убедитесь, что сообщения, полученные интерфейсом postMessage, отвергаются, если источник сообщения не является доверенным или если синтаксис сообщения недействителен.2V3.5.66Убедитесь, что функциональность JSONP не включена нигде в приложении, чтобы избежать атак с использованием межсайтового включения скриптов (XSSI).3V3.5.77Убедитесь, что данные, требующие авторизации, не включены в ответы ресурсов скриптов, таких как файлы JavaScript, чтобы предотвратить атаки с использованием межсайтового включения скриптов (XSSI).3V3.5.88Убедитесь, что аутентифицированные ресурсы (такие как изображения, видео, скрипты и другие документы) могут быть загружены или внедрены от имени пользователя только по назначению. Этого можно добиться путём строгой валидации полей заголовка HTTP-запроса Sec‑Fetch‑*, чтобы убедиться, что запрос не исходит из недопустимого кросс-доменного вызова, или путём установки ограничительного поля заголовка HTTP-ответа Cross‑Origin‑Resource‑Policy, чтобы браузер блокировал возвращаемый контент.3V3.66Целостность внешних ресурсовV3.6.11Убедитесь, что клиентские ресурсы, такие как библиотеки JavaScript, CSS или веб-шрифты, размещаются только на внешнем сервере (например, в сети доставки контента (Content Delivery Network)), если ресурс статический и имеет версии, а для проверки целостности ресурса используется механизм проверки целостности подресурсов (SRI). Если это невозможно, для каждого ресурса должно быть задокументировано решение по безопасности, обосновывающее это.3V3.77Другие соображения по безопасности браузераV3.7.11Убедитесь, что приложение использует только те клиентские технологии, которые по-прежнему поддерживаются и считаются безопасными. Примерами технологий, не соответствующих этому требованию, являются плагины NSAPI, Flash, Shockwave, ActiveX, Silverlight, NACL или клиентские Java-апплеты.2V3.7.22Убедитесь, что приложение будет автоматически перенаправлять пользователя на другое имя хоста или домен (который не контролируется приложением), только если этот хост или домен указаны в списке разрешенных.2V3.7.33Убедитесь, что приложение отображает уведомление, что пользователь перенаправляется на URL-адрес, находящийся вне контроля приложения, с возможностью отмены навигации.3V3.7.44Убедитесь, что домен верхнего уровня приложения (например, site.tld) ​​добавлен в публичный список предварительной загрузки (preload list) для HTTP Strict Transport Security (HSTS). Это гарантирует, что использование TLS для приложения будет встроено непосредственно в основные браузеры, а не будет полагаться только на поле заголовка ответа Strict-Transport-Security.3V3.7.55Убедитесь, что приложение ведет себя так, как описано в документации (например, предупреждает пользователя или блокирует доступ), если браузер, используемый для доступа к приложению, не поддерживает ожидаемые функции безопасности.3V44APIAPI и Веб-сервисV4.11Общая безопасность веб-сервисовV4.1.11Убедитесь, что каждый HTTP-ответ с телом сообщения содержит заголовок Content-Type, который соответствует фактическому содержимому ответа, таким как «text/», «/+xml» и «/xml», включая параметр charset для указания безопасной кодировки символов (например, UTF-8, ISO-8859-1) согласно IANA Media Types.1V4.1.22Убедитесь, что только конечные точки, предназначенные для взаимодействия с пользователем через веб-браузер, автоматически перенаправляют HTTP на HTTPS, в то время как другие сервисы или конечные точки не реализуют прозрачные редиректы. Это необходимо, чтобы избежать ситуации, когда клиент ошибочно отправляет незашифрованные HTTP-запросы а из-за того, что запрос по HTTP автоматически перенаправляется на HTTPS другим сервисом без обработки на входе, утечка чувствительных данных остаётся незамеченной.2V4.1.33Убедитесь, что любой HTTP-заголовок, используемый приложением и устанавливаемый промежуточным уровнем, таким как балансировщик нагрузки, веб-прокси или backend-for-frontend сервис, не может быть переопределён конечным пользователем. Примеры заголовков: X-Real-IP, X-Forwarded-*, X-User-ID.2V4.1.44Убедитесь, что разрешены только HTTP-методы, которые явно поддерживаются приложением или его API (включая OPTIONS для preflight-запросов), а неиспользуемые методы заблокированы.3V4.1.55Убедитесь, что для особо чувствительных запросов или транзакций, проходящих через несколько систем, используются цифровые подписи на уровне сообщений, дополнительно к транспортным средствам защиты.3V4.22Валидация структуры HTTP-сообщенийV4.2.11Убедитесь, что все компоненты приложения (включая балансировщики нагрузки, файрволы и серверы приложений) определяют границы входящих HTTP-сообщений с использованием механизма, соответствующего версии HTTP, чтобы предотвратить HTTP request smuggling. В HTTP/1.x, если присутствует заголовок Transfer-Encoding, заголовок Content-Length должен игнорироваться согласно RFC 2616. При использовании HTTP/2 или HTTP/3, если присутствует Content-Length, веб-сервер должен убедиться, что он совпадает с длиной DATA-фреймов.2V4.2.22Убедитесь, что при генерации HTTP-сообщений заголовок Content-Length не конфликтует с длиной содержимого, определяемой рамками протокола HTTP, чтобы предотвратить HTTP Request Smuggling.3V4.2.33Убедитесь, что приложение не отправляет и не принимает HTTP/2 и HTTP/3 сообщения с заголовками, специфичными для соединения, такими как Transfer-Encoding, чтобы предотвратить HTTP Response Splitting и HTTP Header Injection.3V4.2.44Убедитесь, что приложение принимает HTTP/2 и HTTP/3 запросы только в случае, если поля заголовков и их значения не содержат последовательностей CR (\r), LF (\n) или CRLF (\r\n), чтобы предотвратить HTTP Header Injection.3V4.2.55Убедитесь, что если приложение (бекенд или фронтенд) формирует и отправляет запросы, оно использует валидацию, очистку или другие механизмы, чтобы не создавать URI (например, для API-вызовов) или HTTP-заголовки (например, Authorization или Cookie) слишком большой длины, чтобы их не принимал приёмник. Это может привести к отказу в обслуживании, например, при отправке слишком длинного запроса (длинный cookie-заголовок), из-за чего сервер постоянно возвращает ошибку.3V4.33GraphQLV4.3.11Убедитесь, что используется белый список запросов, ограничение глубины вложенности, ограничение количества или анализ стоимости запроса, чтобы предотвратить DoS-атаки на уровне GraphQL или слоя данных из-за дорогостоящих вложенных запросов.2V4.3.22Убедитесь, что introspection-запросы GraphQL отключены в продакшен-среде, если GraphQL API не предназначен для использования сторонними клиентами.2V4.44WebSocketV4.4.11Убедитесь, что для всех WebSocket-соединений используется WebSocket поверх TLS (WSS).1V4.4.22Убедитесь, что при первоначальном HTTP WebSocket handshake заголовок Origin проверяется на соответствие списку разрешённых источников для приложения.2V4.4.33Убедитесь, что если стандартное управление сессиями приложения не может быть использовано, применяются специальные токены, соответствующие требованиям безопасности управления сессиями.2V4.4.44Убедитесь, что специальные токены управления сессиями WebSocket изначально получаются или валидируются через ранее аутентифицированную HTTPS-сессию при переходе от HTTPS к WebSocket.2V55FileРабота с файламиV5.11Документация по работе с файламиV5.1.11Убедитесь, что документация определяет допустимые типы файлов, ожидаемые расширения и максимальный размер (включая распакованный размер) для каждой функции загрузки. Также убедитесь, что в документации указано, как файлы обезвреживаются для конечных пользователей (например, как приложение ведёт себя при обнаружении вредоносного файла).2V5.22Загрузка файлов и содержимоеV5.2.11Убедитесь, что приложение принимает только те файлы, которые может обработать без потери производительности или отказа в обслуживании.1V5.2.22Убедитесь, что при загрузке файла (включая файлы внутри архивов, таких как ZIP) приложение проверяет, соответствует ли расширение ожидаемому, и валидирует, соответствует ли содержимое типу, указанному в расширении. Это включает проверку начальных 'magic bytes', перезапись изображений, использование специализированных библиотек. Для уровня 1 — достаточно проверок для файлов, критичных с точки зрения бизнеса или безопасности. Для уровней 2 и выше — для всех файлов.1V5.2.33Убедитесь, что приложение проверяет архивы (например, zip, gz, docx, odt) на максимально допустимый распакованный размер и максимальное количество файлов до распаковки.2V5.2.44Убедитесь, что для каждого пользователя установлены квоты на общий размер и количество файлов, чтобы один пользователь не мог переполнить хранилище.3V5.2.55Убедитесь, что приложение не позволяет загружать архивы с символьными ссылками (symlinks), если это не требуется по бизнес-логике. Если требуется — разрешён только строго определённый список допустимых символьных ссылок.3V5.2.66Убедитесь, что приложение отклоняет изображения с числом пикселей выше допустимого, чтобы предотвратить атаки 'pixel flood'.3V5.33Хранение файловV5.3.11Убедитесь, что загруженные или сгенерированные из недоверенного ввода файлы, находящиеся в публичной директории, не исполняются как серверный код при обращении к ним по HTTP.1V5.3.22Убедитесь, что при создании путей к файлам приложение использует внутренние или доверенные данные, а не пользовательские имена файлов. Если использование пользовательских имён или метаданных необходимо — требуется строгая проверка и очистка. Это защита от path traversal, LFI, RFI и SSRF.1V5.3.33Убедитесь, что при обработке файлов на сервере (например, при распаковке) игнорируются пути, заданные пользователем, во избежание уязвимостей типа 'zip slip'.3V5.44Скачивание файловV5.4.11Убедитесь, что приложение валидирует или игнорирует имена файлов, переданных пользователем (включая в JSON, JSONP или URL-параметре), и указывает имя файла в заголовке Content-Disposition при ответе.2V5.4.22Убедитесь, что имена файлов, передаваемые (например, в HTTP-заголовках или вложениях в email), кодируются или очищаются (например, по RFC 6266), чтобы сохранить структуру документа и предотвратить инъекции.2V5.4.33Убедитесь, что файлы, полученные из недоверенных источников, сканируются антивирусом, чтобы не распространять известное вредоносное содержимое.2V66AuthenticationАутентификацияV6.11Документация по аутентификацииV6.1.11Убедитесь, что в документации приложения описано, как используются механизмы, такие как ограничение частоты запросов (rate limiting), защита от автоматизации и адаптивные реакции, для защиты от атак, таких как подстановка учётных данных и перебор паролей. Документация должна ясно описывать конфигурацию этих механизмов и предотвращение злонамеренной блокировки аккаунтов.1V6.1.22Убедитесь, что задокументирован список контекстно-зависимых слов, запрещённых к использованию в паролях. В него могут входить производные от названий организаций, продуктов, идентификаторов систем, кодовых названий проектов, названий отделов или ролей и тому подобное.2V6.1.33Убедитесь, что если приложение поддерживает несколько способов аутентификации, то все они документированы вместе с описанием применяемых средств защиты и уровнем стойкости аутентификации, которые должны быть одинаково применены ко всем способам.2V6.22Безопасность паролейV6.2.11Убедитесь, что пользовательские пароли содержат не менее 8 символов. Рекомендуется минимальная длина в 15 символов.1V6.2.22Убедитесь, что пользователи могут менять свои пароли.1V6.2.33Убедитесь, что для смены пароля требуется ввести как текущий, так и новый пароль.1V6.2.44Убедитесь, что при регистрации или смене пароля введённый пароль проверяется по списку как минимум из 3000 самых популярных паролей, соответствующих политике (например, минимальной длине).1V6.2.55Убедитесь, что допускаются пароли любой структуры, без ограничений на использование определённых символов. Не должно быть требований по обязательному наличию заглавных/строчных букв, цифр или специальных символов.1V6.2.66Убедитесь, что поля ввода пароля используют type=password для скрытия символов. Разрешено временное отображение всего пароля или последнего введённого символа.1V6.2.77Убедитесь, что разрешены вставка (paste), использование менеджеров паролей браузера и внешних менеджеров паролей.1V6.2.88Убедитесь, что пароль проверяется строго в том виде, в котором он был введён пользователем — без обрезки, изменения регистра и других модификаций.1V6.2.99Убедитесь, что система позволяет использовать пароли длиной не менее 64 символов.2V6.2.1010Убедитесь, что пароль остаётся действительным, пока не будет скомпрометирован или не будет изменён пользователем. Приложение не должно требовать регулярной смены пароля.2V6.2.1111Убедитесь, что используется документированный список контекстно-зависимых слов (например, названия компаний, проектов и т.д.) для предотвращения использования легко угадываемых паролей.2V6.2.1212Убедитесь, что при регистрации или смене пароля проверяется, не входит ли он в список скомпрометированных (утёкших) паролей.2V6.33Общие требования к безопасности аутентификацииV6.3.11Убедитесь, что реализованы меры защиты от атак типа credential stuffing (массовая подстановка учётных данных) и brute-force (перебор паролей), согласно документации по безопасности приложения.1V6.3.22Убедитесь, что в приложении отсутствуют или отключены учётные записи по умолчанию (например, root, admin, sa).1V6.3.33Убедитесь, что для доступа к приложению используется либо механизм многофакторной аутентификации, либо комбинация однофакторных. Для уровня L3 один из факторов должен быть аппаратным, обеспечивающим защиту от фишинга, устойчивость к компрометации и подтверждение намерения аутентификации через явное действие пользователя (например, нажатие кнопки на FIDO-ключе или телефоне). Ослабление этих требований допускается только при наличии обоснования и компенсирующих мер.2V6.3.44Убедитесь, что при наличии нескольких способов аутентификации, они все задокументированы, и для них единообразно применяются меры защиты и уровни доверия.2V6.3.55Убедитесь, что пользователи получают уведомления о подозрительных попытках аутентификации (удачных и неудачных). Это может включать попытки (например, подключения) с необычного устройства или места, частично успешную MFA, попытку после долгого отсутствия или успешную аутентификацию после серии неудачных.3V6.3.66Убедитесь, что email не используется ни как однофакторный, ни как многофакторный механизм аутентификации.3V6.3.77Убедитесь, что пользователи получают уведомление при изменении данных аутентификации, таких как сброс пароля или изменение логина/email.3V6.3.88Убедитесь, что из сообщений об ошибке, HTTP-кодов ответа или различий во времени ответа нельзя определить, существует ли пользователь с таким логином. Это правило также должно применяться к функциям регистрации и восстановления пароля.3V6.44Жизненный цикл и восстановление факторов аутентификацииV6.4.11Убедитесь, что начальные пароли или коды активации, генерируемые системой, создаются с использованием надёжного генератора случайных чисел, соответствуют текущей политике паролей и истекают через короткий период времени либо после первого использования. Эти секреты не должны использоваться как постоянные пароли.1V6.4.22Убедитесь, что в системе отсутствуют подсказки к паролю или вопросы на знание («секретные вопросы»).1V6.4.33Убедитесь, что реализован безопасный процесс сброса забытого пароля, который не обходит активные механизмы многофакторной аутентификации.2V6.4.44Убедитесь, что в случае утраты одного из факторов MFA проводится удостоверение личности (identity proofing) на том же уровне, что и при первичной регистрации.2V6.4.55Убедитесь, что инструкции по обновлению истекающих механизмов аутентификации отправляются заранее, с достаточным запасом времени для выполнения замены, при необходимости с настройкой автоматических напоминаний.3V6.4.66Убедитесь, что администраторы могут инициировать процесс сброса пароля, но не могут задать или выбрать новый пароль за пользователя. Это исключает ситуацию, при которой администратор знает пароль пользователя.3V6.55Общие требования к многофакторной аутентификацииV6.5.11Убедитесь, что lookup-секреты, внеполосные коды/запросы и TOTP-коды можно использовать только один раз.2V6.5.22Убедитесь, что при хранении lookup-секретов с энтропией менее 112 бит (например, 19 случайных буквенно-цифровых символов или 34 случайные цифры) они хэшируются с использованием разрешённого алгоритма хеширования паролей и случайной соли минимум 32 бита. Если у секрета ≥112 бит энтропии — допустимо использовать стандартный хэш.2V6.5.33Убедитесь, что lookup-секреты, коды внеполосной аутентификации и сиды для TOTP генерируются с использованием криптографически стойкого генератора случайных чисел (CSPRNG), чтобы избежать предсказуемых значений.2V6.5.44Убедитесь, что lookup-секреты и внеполосные коды аутентификации имеют минимум 20 бит энтропии (достаточно, например, 4 случайных алфавитно-цифровых символов или 6 случайных цифр).2V6.5.55Убедитесь, что все внеполосные запросы, коды и токены, а также TOTP-коды имеют ограниченный срок действия. Максимум для out-of-band — 10 минут, для TOTP — 30 секунд.2V6.5.66Убедитесь, что любой фактор аутентификации (включая физические устройства) может быть отозван в случае кражи или утери.3V6.5.77Убедитесь, что биометрические механизмы аутентификации используются только как вторичный фактор — в сочетании с «чем-то, что вы знаете» или «чем-то, что у вас есть».3V6.5.88Убедитесь, что TOTP-коды проверяются по источнику времени, полученному от доверенного сервиса, а не от клиента или недоверенного источника.3V6.66Внеполосные механизмы аутентификацииV6.6.11Убедитесь, что механизмы аутентификации через телефонную сеть общего пользования (PSTN) для доставки одноразовых паролей (OTP) по телефону или SMS используются только в случае предварительной валидации номера, при этом предлагаются альтернативные более безопасные методы (например, TOTP), и пользователю сообщаются риски. Для приложений уровня L3 использование телефона и SMS недопустимо.2V6.6.22Убедитесь, что внеполосные запросы, коды или токены привязаны к исходному запросу аутентификации, для которого они были сгенерированы, и не могут быть использованы повторно для других попыток.2V6.6.33Убедитесь, что внеполосные механизмы на основе кода защищены от атак методом подбора (brute force) путём применения ограничения частоты запросов (rate limiting). Также рекомендуется использовать коды с энтропией не менее 64 бит.2V6.6.44Убедитесь, что при использовании push-уведомлений для MFA применяется ограничение частоты (rate limiting), чтобы предотвратить атаки push-бомбинга. Также может помочь механизм сопоставления номеров (number matching).3V6.77Криптографические механизмы аутентификацииV6.7.11Убедитесь, что сертификаты, используемые для проверки криптографических утверждений об аутентификации, хранятся таким образом, чтобы исключить возможность их модификации.3V6.7.22Убедитесь, что nonce (случайная строка), используемая в процессе вызова, имеет длину не менее 64 бит и является статистически уникальной или уникальной на протяжении всего срока службы криптографического устройства.3V6.88Аутентификация с использованием провайдера идентификаций (IdP)V6.8.11Убедитесь, что при поддержке несколькими IdP, невозможно подделать личность пользователя через другой IdP (например, с тем же user ID). Стандартным способом защиты является регистрация пользователя с использованием сочетания ID самого IdP (в качестве пространства имён) и пользовательского ID внутри IdP.2V6.8.22Убедитесь, что наличие и целостность цифровой подписи в утверждениях аутентификации (например, в JWT или SAML) всегда проверяются, а неподписанные или недействительные утверждения отклоняются.2V6.8.33Убедитесь, что SAML-утверждения обрабатываются только один раз в течение периода их действия, чтобы исключить атаки воспроизведения (replay attacks).2V6.8.44Убедитесь, что если приложение использует внешний поставщик идентификации (IdP) и для определенных функций требуется особый уровень, метод или срок действия аутентификации, то приложение использует данные, возвращаемые IdP, для проверки этих условий. Например, при использовании OIDC можно проверить значения полей ID Token — acr, amr, auth_time (если они есть). Если IdP не предоставляет эти данные, приложение должно иметь документированный план действий по умолчанию, предполагающий использование минимально допустимой силы аутентификации (например, одноступенчатая — логин и пароль).2V77SessionУправление сессиямиV7.11Документация по управлению сессиямиV7.1.11Убедитесь, что тайм-аут бездействия и абсолютное максимальное время жизни сессии задокументированы, соответствуют другим контрольным мерам и сопровождаются обоснованием любых отклонений от требований повторной аутентификации NIST SP 800-63B.2V7.1.22Убедитесь, что документация определяет допустимое количество одновременных (параллельных) сессий для одного аккаунта, а также поведение системы и действия при достижении этого лимита.2V7.1.33Убедитесь, что все системы, создающие и управляющие сессиями пользователей в рамках федеративной идентификации (например, SSO), задокументированы вместе с механизмами координации сроков действия сессий, условий завершения и случаев, требующих повторной аутентификации.2V7.22Базовая безопасность сессийV7.2.11Убедитесь, что все проверки сессионных токенов выполняются на доверенной серверной стороне.1V7.2.22Убедитесь, что приложение использует либо автономные токены, либо ссылочные токены, которые генерируются динамически, не используя статические API-секреты или ключи.1V7.2.33Убедитесь, что ссылочные токены являются уникальными, создаются с использованием криптографически безопасного генератора псевдослучайных чисел (CSPRNG) и обладают энтропией не менее 128 бит.1V7.2.44Убедитесь, что при аутентификации пользователя (включая повторную) создается новый токен сессии, а текущий — аннулируется.1V7.33Тайм-ауты сессииV7.3.11Убедитесь, что есть тайм-аут бездействия, после которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.2V7.3.22Убедитесь, что установлено абсолютное максимальное время жизни сессии, по истечении которого требуется повторная аутентификация, в соответствии с анализом рисков и документированными решениями.2V7.44Завершение сессийV7.4.11Убедитесь, что после завершения сессии (logout, истечение срока) дальнейшее её использование невозможно. Для ссылочных токенов или сессий с сохранением состояния это означает аннулирование на сервере. Для self-contained токенов необходимо реализовать механизм отзыва, например, список отозванных токенов, проверку времени выпуска или ротацию ключей подписи для каждого пользователя.1V7.4.22Убедитесь, что при удалении или отключении пользователя все активные сессии немедленно завершаются.1V7.4.33Убедитесь, что после изменения или удаления факторов аутентификации (например, смена пароля или MFA) приложение предлагает завершить все другие активные сессии.2V7.4.44Убедитесь, что на всех страницах, требующих аутентификации, имеется простой и видимый способ выхода.2V7.4.55Убедитесь, что администраторы могут завершать активные сессии конкретного пользователя или всех пользователей.2V7.55Защита от злоупотреблений сессиейV7.5.11Убедитесь, что приложение требует полной повторной аутентификации перед изменением чувствительных атрибутов аккаунта, которые могут влиять на аутентификацию (например, email, номер телефона, настройки MFA или данных восстановления доступа).2V7.5.22Убедитесь, что пользователь может просматривать и (после повторной аутентификации хотя бы по одному фактору) завершать активные сессии.2V7.5.33Убедитесь, что перед выполнением критически важных операций приложение требует повторной аутентификации (по крайней мере, одного фактора) или дополнительной проверки.3V7.66Федеративная повторная аутентификацияV7.6.11Убедитесь, что срок действия и завершение сессий между RP и IdP соответствуют документации и включают повторную аутентификацию, если достигнут максимальный допустимый интервал между событиями аутентификации.2V7.6.22Убедитесь, что создание сессии требует согласия пользователя или явного действия, предотвращающего несанкционированное создание сессий без участия пользователя.2V88AuthorizationАвторизацияV8.11Документация по авторизацииV8.1.11Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне функций и на уровне данных на основе прав субъекта и атрибутов ресурса.1V8.1.22Убедитесь, что документация по авторизации определяет правила ограничения доступа на уровне полей (как на чтение, так и на запись) на основе прав субъекта и атрибутов ресурса. Эти правила могут зависеть от других атрибутов объекта данных, например, статуса.2V8.1.33Убедитесь, что документация определяет, какие атрибуты окружения и контекста (например, время суток, IP-адрес, местоположение, устройство) используются приложением для принятия решений в области аутентификации и авторизации.3V8.1.44Убедитесь, что документация по аутентификации и авторизации определяет, как используются факторы окружения и контекста в принятии решений, наряду с правилами доступа к функциям, данным и полям. Документация должна содержать оцениваемые атрибуты, пороговые значения риска, действия (разрешить, отказать, повысить уровень аутентификации и др.).3V8.22Архитектура авторизацииV8.2.11Убедитесь, что приложение обеспечивает доступ на уровне функций (function-level) только субъектам с явными разрешениями.1V8.2.22Убедитесь, что приложение обеспечивает доступ на уровне данных (data-specific) только тем субъектам, которым явно предоставлены права к определённым элементам данных, чтобы предотвратить IDOR (Insecure Direct Object Reference) и BOLA-уязвимости (Broken Object Level Authorization).1V8.2.33Убедитесь, что приложение обеспечивает доступ на уровне полей (field-level) только тем субъектам, которым явно предоставлены права к определённым полям, чтобы предотвратить BOPLA (Broken Object Property Level Authorization).2V8.2.44Убедитесь, что реализованы адаптивные меры безопасности, основанные на атрибутах окружения и контекста субъекта (время, местоположение, IP, устройство), которые используются для принятия решений об аутентификации и авторизации, как это определено в документации приложения. Эти меры должны применяться как при попытке субъекта начать новую сессию, так и во время существующей сессии.3V8.33Авторизация на уровне операцийV8.3.11Убедитесь, что правила авторизации реализуются на доверенном сервисном уровне и не зависят от элементов, которые может контролировать клиент (например, JavaScript на стороне клиента).1V8.3.22Убедитесь, что изменения значений, влияющих на авторизацию, применяются немедленно. Если это невозможно (например, при использовании автономных токенов), должны быть реализованы компенсирующие меры: оповещения о попытке несанкционированного действия и откат изменений. Обратите внимание, что данный подход не предотвращает утечку информации.3V8.3.33Убедитесь, что доступ к объекту осуществляется на основе прав субъекта, инициировавшего запрос, а не прав промежуточного сервиса, действующего от его имени. Например, если пользователь обращается к веб-сервису с автономным токеном для аутентификации, а сервис затем запрашивает данные у другого сервиса, второй сервис должен использовать токен пользователя, а не токен первого сервиса для принятия решения о доступе.3V8.44Прочие аспекты авторизацииV8.4.11Убедитесь, что в мультитенантных приложениях реализованы механизмы, предотвращающие действия потребителя в отношении арендаторов, к которым у него нет доступа.2V8.4.22Убедитесь, что доступ к административным интерфейсам защищён несколькими уровнями контроля, включая непрерывную проверку личности, контроль защищённости устройства и анализ контекстных рисков. Недостаточно опираться только на IP-адрес или доверенные устройства.3V99SelfАвтономные токеныV9.11Источник токена и его целостностьV9.1.11Убедитесь, что автономные токены проверяются на целостность с помощью цифровой подписи или MAC, прежде чем доверять их содержимому.1V9.1.22Проверяйте, что автономные токены создаются и проверяются исключительно с помощью алгоритмов из списка допустимых в данном контексте. Список допустимых алгоритмов должен включать только разрешенные алгоритмы (желательно либо только симметричные, либо только асимметричные) и ни в коем случае не содержать алгоритм None. Если необходимо поддерживать оба типа алгоритмов, потребуются дополнительные средства контроля для предотвращения путаницы с ключами (key confusion).1V9.1.33Убедитесь, что ключи, используемые для проверки автономных токенов, получены из доверенных, предварительно настроенных источников. Это предотвращает возможность указания злоумышленниками ненадёжных источников и ключей. Для JWT и других JWS структур заголовки 'jku', 'x5u' и 'jwk' должны проверяться по белому списку.1V9.22Содержимое токенаV9.2.11Убедитесь, что при указанном сроке действия токен и его содержимое принимаются только в том случае, если срок действия токена не истёк. Например, для JWT нужно проверить поля 'nbf' и 'exp'.1V9.2.22Убедитесь, что сервис, принимающий токен, проверяет его тип и соответствие назначению перед обработкой содержимого токена. Например, для принятия решений об авторизации могут быть приняты только Access Token, а для подтверждения аутентификации пользователя — только ID Token.2V9.2.33Убедитесь, что сервис принимает только токены, предназначенные для использования с этим сервисом (audience). Для JWT это можно сделать, проверив наличие утверждения «aud» по белому списку, определенному в сервисе.2V9.2.44Убедитесь, что, если эмитент токенов использует один и тот же закрытый ключ для выпуска токенов различным сервисам (audiences), выпущенные токены содержат явное указание целевых сервисов. Это предотвратит повторное использования токенов в не предназначенных для них сервисах. Если идентификатор сервиса (audience identifier) назначается динамически, эмитент токенов должен проверить audiences для исключения подмены получателей (audience impersonation).2V1010OAuthOAuth и OIDCV10.11Общие требования безопасности OAuth и OIDCV10.1.11Убедитесь, что токены передаются только тем компонентам, которым они действительно необходимы. Например, при использовании схемы backend-for-frontend для браузерных JavaScript-приложений, access и refresh токены должны быть доступны только на backend.2V10.1.22Убедитесь, что клиент принимает значения от авторизационного сервера (например, authorization code или ID Token) только если они получены в результате авторизационного потока, инициированного в той же сессии пользовательского агента и в рамках той же транзакции. Для этого клиентские секреты, такие как proof key для code exchange (PKCE) — 'code_verifier', 'state' или OIDC 'nonce' — должны быть непредсказуемыми, специфичными для транзакции и надежно привязанными как к клиенту, так и к сессии пользовательского агента, в которой началась транзакция.2V10.22Клиент OAuthV10.2.11Убедитесь, что если используется механизм authorization code flow, OAuth клиент защищён от CSRF, вызывающих запросы токенов либо за счёт использования механизма proof key for code exchange (PKCE), либо за счёт проверки параметра 'state', который был отправлен в запросе авторизации.2V10.2.22Убедитесь, что если OAuth клиент может взаимодействовать с более чем одним сервером авторизации, у него есть защита от атак смешивания (mix-up attacks). Например, клиент должен требовать, чтобы сервер авторизации возвращал параметр 'iss' и проверять его в ответах на авторизацию и токены.2V10.2.33Убедитесь, что OAuth клиент запрашивает только необходимые области доступа (scopes) или другие параметры авторизации в запросах к серверу авторизации.3V10.33Сервер ресурсов OAuthV10.3.11Убедитесь, что сервер ресурсов принимает только те access токены, которые предназначены для использования с этим сервисом (свойство audience). Эта принадлежность сервису может быть включена в структурированный access токен (например, в поле 'aud' в JWT) или проверяться через endpoint интроспекции токена.2V10.3.22Убедитесь, что сервер ресурсов принимает решения по авторизации на основе claims из access токена, определяющих делегированную авторизацию. Если присутствуют claims, такие как 'sub', 'scope' и 'authorization_details', они должны участвовать в принятии решения.2V10.3.33Убедитесь, что если для принятия решения по контролю доступа необходимо однозначно идентифицировать пользователя из access токена (JWT или ответа интроспекции), сервер ресурсов использует claims, которые не могут быть переприсвоены другим пользователям. Обычно это комбинация claims 'iss' и 'sub'.2V10.3.44Убедитесь, что если сервер ресурсов требует определённой силы аутентификации, методов или свежести аутентификации, он проверяет, что предъявленный access токен удовлетворяет этим требованиям. Например, при наличии, могут использоваться claims OIDC 'acr', 'amr' и 'auth_time'.2V10.3.55Убедитесь, что сервер ресурсов предотвращает использование украденных access токенов или их повторное использование (replay) неавторизованными лицами, требуя access токены с подтверждением отправителя — например, Mutual TLS для OAuth 2 или OAuth 2 Demonstration of Proof of Possession (DPoP).3V10.44Сервер авторизации OAuthV10.4.11Убедитесь, что сервер авторизации проверяет URI перенаправления (redirect URI), сверяя его с заранее зарегистрированным списком разрешённых URI для данного клиента (allowlist), используя точное сравнение строк.1V10.4.22Убедитесь, что если сервер авторизации возвращает authorization code в ответе авторизации, этот код может быть использован только один раз для запроса токена. При втором валидном запросе с уже использованным кодом сервер должен отклонить запрос и отозвать любые токены, связанные с этим кодом.1V10.4.33Убедитесь, что authorization code имеет короткое время жизни. Максимальная продолжительность — до 10 минут для приложений L1 и L2 и до 1 минуты для приложений L3.1V10.4.44Убедитесь, что сервер авторизации для конкретного клиента разрешает использование только тех типов авторизации, которые необходимы этому клиенту. Обратите внимание, что тип авторизации Implicit flow и Resource Owner Password Credentials flow больше не должны использоваться.1V10.4.55Убедитесь, что сервер авторизации предотвращает атаки повторного использования refresh токенов для публичных клиентов, предпочтительно используя sender-constrained refresh токены, такие как DPoP или сертификат-связанные токены с mutual TLS (mTLS). Для L1 и L2 допускается ротация refresh токенов с обязательной их инвалидацией после использования. Если используется ротация, сервер должен отозвать все refresh токены при попытке использовать уже инвалидированный токен.1V10.4.66Убедитесь, что при использовании типа авторизации «Authorization Code» сервер предотвращает атаки перехвата authorization code, требуя Proof Key for Code Exchange (PKCE). В запросах авторизации сервер должен требовать валидное значение 'code_challenge' и не принимать 'code_challenge_method' со значением 'plain'. В запросах токена обязательно валидировать параметр 'code_verifier'.2V10.4.77Убедитесь, что если сервер авторизации поддерживает динамическую регистрацию клиентов без аутентификации, он минимизирует риски вредоносных клиентов. Сервер должен валидировать метаданные клиента (например, зарегистрированные URI), обеспечивать согласие пользователя и предупреждать пользователя перед обработкой запроса авторизации от недоверенного клиента.2V10.4.88Убедитесь, что refresh токены имеют абсолютный срок действия, включая случаи, когда применяется скользящее время истечения срока.2V10.4.99Убедитесь, что пользователи могут отзывать refresh токены и reference access токены через пользовательский интерфейс сервера авторизации для снижения риска от вредоносных клиентов или кражи токенов.2V10.4.1010Убедитесь, что конфиденциальный клиент аутентифицируется при взаимодействии с сервером авторизации через backchannel, например при запросах токена, pushed authorization requests (PAR) и запросах на отзыв токенов.2V10.4.1111Убедитесь, что конфигурация сервера авторизации назначает OAuth клиенту только необходимые области доступа (scopes).2V10.4.1212Убедитесь, что для конкретного клиента сервер авторизации разрешает только те значения 'response_mode', которые необходимы этому клиенту. Например, сервер должен валидировать это значение против ожидаемых или использовать pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).3V10.4.1313Убедитесь, что грант типа 'code' всегда используется вместе с pushed authorization requests (PAR).3V10.4.1414Убедитесь, что сервер авторизации выдаёт только sender-constrained (Proof-of-Possession) access токены, либо с сертификат-связанными токенами через mutual TLS (mTLS), либо DPoP-bound токены (Demonstration of Proof of Possession).3V10.4.1515Убедитесь, что для серверного клиента (не выполняющегося на устройстве конечного пользователя) сервер авторизации проверяет, что значение параметра 'authorization_details' исходит из клиентского backend и что пользователь не изменял его. Например, это достигается использованием pushed authorization request (PAR) или JWT-secured Authorization Request (JAR).3V10.4.1616Убедитесь, что клиент является конфиденциальным и сервер авторизации требует использования сильных методов аутентификации клиента (основанных на криптографии с открытым ключом и устойчивых к атакам повторного воспроизведения), таких как mutual TLS ('tls_client_auth', 'self_signed_tls_client_auth') или private key JWT ('private_key_jwt').3V10.55Клиент OIDCV10.5.11Убедитесь, что клиент (relying party) защищается от повторного использования ID Token (replay-атак). Например, это достигается проверкой того, что значение 'nonce' в ID Token совпадает со значением 'nonce', отправленным в запросе аутентификации провайдеру OpenID (authorization server).2V10.5.22Убедитесь, что клиент однозначно идентифицирует пользователя по утверждениям (claims) ID Token, обычно это 'sub', который не может быть переназначен другому пользователю (в пределах конкретного провайдера идентификации).2V10.5.33Убедитесь, что клиент отклоняет попытки злоумышленного сервера авторизации выдавать себя за другой сервер авторизации через метаданные сервера авторизации. Клиент должен отклонить метаданные, если URL издателя (issuer) в метаданных не совпадает точно с преднастроенным URL издателя, ожидаемым клиентом.2V10.5.44Убедитесь, что клиент проверяет, что ID Token предназначен для него (проверка audience), сравнивая значение 'aud' в токене с 'client_id' клиента.2V10.5.55Убедитесь, что при использовании OIDC back-channel logout клиент снижает риск отказа в обслуживании, вызванный принудительным выходом из системы и путаницей между разными типами JWT (cross-JWT confusion) в процессе логаута. Клиент должен проверить, что токен выхода корректно типизирован со значением 'logout+jwt', содержит claim 'event' с правильным именем участника и не содержит 'nonce'. Также рекомендуется установить короткий срок действия токена (например, 2 минуты).2V10.66Провайдер OpenIDV10.6.11Убедитесь, что провайдер OpenID допускает только значения 'code', 'ciba', 'id_token' или 'id_token code' для параметра response mode. При этом предпочтение отдаётся 'code' по сравнению с 'id_token code' (гибридный поток OIDC), а значение 'token' (любой Implicit flow) не должно использоваться.2V10.6.22Убедитесь, что провайдер OpenID предотвращает отказ в обслуживании (DoS) через принудительный выход (logout), запрашивая явное подтверждение от конечного пользователя или, если применимо, проверяя параметры в запросе выхода (инициированном relying party), например параметр 'id_token_hint'.2V10.77Управление согласиемV10.7.11Убедитесь, что авторизационный сервер обеспечивает получение согласия пользователя для каждого запроса авторизации. Если личность клиента не может быть подтверждена, сервер авторизации всегда должен явно запрашивать согласие пользователя.2V10.7.22Убедитесь, что при запросе согласия пользователя авторизационный сервер предоставляет достаточную и понятную информацию о том, на что даётся согласие. При необходимости это должно включать характер запрашиваемых разрешений (обычно основанных на scope, ресурсном сервере, деталях авторизации Rich Authorization Requests (RAR)), идентификацию авторизованного приложения и срок действия этих разрешений.2V10.7.33Убедитесь, что пользователь может просматривать, изменять и отзывать согласия, которые он предоставил, через авторизационный сервер.2V1111CryptographyКриптографияV11.11Инвентаризация и документирование криптографииV11.1.11Убедитесь, что задокументирована политика управления криптографическими ключами и описан их жизненный цикл в соответствии со стандартом управления ключей, таким как NIST SP 800-57. Убедитесь, что ключи известны только тем сущностям, которым они должны быть доступны (например, ключи не передавались более чем двум участникам для общих секретов и более чем одному участнику для приватных ключей).2V11.1.22Убедитесь, что проводится инвентаризация криптографических средств, которая непрерывно поддерживается, регулярно обновляется и включает все криптографические ключи, алгоритмы и сертификаты, используемые в приложении. Также должна быть задокументирована информация о том, где ключи могут и не могут использоваться в системе, а также какие типы данных могут и не могут быть защищены с помощью этих ключей.2V11.1.33Убедитесь, что используются механизмы обнаружения криптографии для идентификации всех случаев применения криптографии в системе , включая операции шифрования, хеширования и цифровой подписи.3V11.1.44Убедитесь, что ведётся и поддерживается инвентаризация криптографических средств. В неё должен входить документированный план, описывающий переход на новые криптографические стандарты, такие как постквантовая криптография, чтобы своевременно реагировать на будущие угрозы.3V11.22Безопасная реализация криптографииV11.2.11Убедитесь, что для криптографических операций используются утвержденные в индустрии реализации (включая библиотеки и аппаратные реализации).2V11.2.22Убедитесь, что архитектура приложения поддерживает быструю реконфигурацию, усовершенствование или смену в любой момент случайных чисел, аутентифицированного шифрования, MAC, алгоритмов хеширования, длин ключей, количества раундов, шифров и режимов шифрования для защиты от криптографических атак. Также должна поддерживаться возможность смены ключей, паролей и повторного шифрования данных. Это позволит беспрепятственно перейти на постквантовую криптографию (PQC), как только станут широко доступны высоконадёжные реализации одобренных схем или стандартов PQC.2V11.2.33Убедитесь, что все криптографические примитивы используют как минимум 128-бит стойкости с учетом алгоритма, размера ключа и конфигурации. Например, 256-битный ECC ключ обеспечивает примерно 128 бит безопасности, тогда как для достижения того же уровня безопасности в RSA требуется ключ длиной 3072 бита.2V11.2.44Убедитесь, что все криптографические операции выполняются за константное время, без использования «short-circuit» операций в сравнениях, вычислениях, возвратах функций для избежания утечек информации.3V11.2.55Убедитесь, что все криптографические модули обеспечивают безопасное завершение работы при ошибках, а обработка ошибок реализована таким образом, чтобы не создавать уязвимостей, например, таких как атаки Padding Oracle.3V11.33Алгоритмы шифрованияV11.3.11Убедитесь, что не используются небезопасные режимы блочного шифрования (н-р, ECB) и слабые схемы дополнения (padding) (н-р, PKCS#1 v1.5).1V11.3.22Убедитесь, что используются только утверждённые шифры и режимы, такие как AES с GCM.1V11.3.33Убедитесь, что зашифрованные данные защищены от несанкционированного изменения, предпочтительно с использованием утверждённого метода аутентифицированного шифрования или путём комбинирования утверждённого метода шифрования с утверждённым алгоритмом MAC.2V11.3.44Убедитесь, что случайные числа (nonce), векторы инициализации (IV) и другие одноразовые числа не используются более одного раза для одной и той же пары ключа шифрования и элемента данных. Метод их генерации должен соответствовать требованиям используемого алгоритма.3V11.3.55Убедитесь, что любая комбинация алгоритма шифрования и алгоритма MAC работает в режиме encrypt-then-MAC (EtM).3V11.44Хеширование и функции на основе хешированияV11.4.11Убедитесь, что только утвержденные хэш-функции используются для стандартных сценариев использования в криптографии, включая цифровую подпись, HMAC, KDF, генерацию случайных чисел. Запрещено использовать неустойчивые хэш-функции, (н-р, MD5) для любого использования в криптографии.1V11.4.22Убедитесь, что пароли хранятся с использованием утверждённой, вычислительно затратной функции генерации ключа (также известной как «функция хеширования паролей»), с параметрами, настроенными в соответствии с актуальными рекомендациями. Настройки должны обеспечивать баланс между безопасностью и производительностью, чтобы сделать атаки перебором достаточно сложными для требуемого уровня безопасности.2V11.4.33Убедитесь, что хэш-функции, используемые в формировании цифровой подписи, как часть аутентификации и целостности данных, устойчивы к коллизиям и имеют достаточную длину.2V11.4.44Убедитесь, что приложение использует утвержденную функцию генерации ключа с использованием параметров расширения ключа (key stretching) при генерации ключа из пароля. Параметры должны быть сбалансированы с точки зрения безопасности, производительности и устойчивости к атакам полного перебора при компрометации результирующего криптографического ключа.2V11.55Случайные значенияV11.5.11Убедитесь, что все случайные числа и строки, которые должны быть непредсказуемы, должны быть сгенерированы с помощью CSPRNG и иметь хотя бы 128 бит энтропии. Учтите, что UUID не удовлетворяют данному условию.2V11.5.22Убедитесь, что механизм генерации случайных чисел является надежным даже при высокой нагрузке.3V11.66Криптография с публичным ключомV11.6.11Убедитесь, что только утвержденные криптографические алгоритмы и режимы операций используются для генерации ключа и инициализации случайного значения для его генерации (seeding), а также для генерации цифровой подписи и верификации. Алгоритмы генерации ключей не должны генерировать небезопасные ключи уязвимые к известным атакам, например, ключи RSA уязвимы к факторизации Ферма.2V11.6.22Убедитесь, что для обмена ключами используются утверждённые криптографические алгоритмы (например, Диффи-Хеллман) с особым вниманием к обеспечению использования безопасных параметров. Это предотвратит атаки на процесс установления ключа, которые могут привести к атакам «человек посередине» или криптографическим взломам.3V11.77Шифрование данных в процессе использованияV11.7.11Убедитесь, что используется полное шифрование памяти, которое защищает конфиденциальные данные во время их использования, предотвращая доступ к ним неавторизованных пользователей или процессов.3V11.7.22Убедитесь, что минимизация данных обеспечивает раскрытие минимально необходимого объёма данных во время обработки, а также что данные шифруются сразу после использования или как можно скорее.3V1212SecureБезопасная коммуникацияV12.11Общие рекомендации по безопасности TLSV12.1.11Убедитесь, что включены только актуальные и рекомендуемые версии протокола TLS, такие как TLS 1.2 и TLS 1.3. Наиболее свежая версия TLS должна быть выбрана как предпочтительная.1V12.1.22Убедитесь, что включены рекомендуемые шифронаборы (cipher suites), предпочтение также стоит отдать самому сильному шифронабору. L3 приложения должны поддерживать только те наборы шифров (cipher suites), которые обеспечивают прямую (forward) секретность. Пояснение: Прямая секретность (Forward Secrecy, FS) — это криптографическая особенность, при которой сессионные ключи уникальны для каждой сессии и не зависят от долгосрочных ключей. Это гарантирует, что даже при компрометации долгосрочного ключа злоумышленник не сможет расшифровать ранее перехваченные зашифрованные сессии.2V12.1.33Убедитесь, что приложение проверяет доверенность клиентских сертификатов mTLS, прежде чем использовать идентификацию по сертификату для аутентификации или авторизации.2V12.1.44Убедитесь, что включена и настроена правильная проверка отзыва сертификатов, такая как Online Certificate Status Protocol (OCSP) Stapling.3V12.1.55Убедитесь, что в настройках TLS приложения включена функция Encrypted Client Hello (ECH) для предотвращения раскрытия конфиденциальных метаданных, таких как Server Name Indication (SNI), во время процесса TLS-рукопожатия.3V12.22HTTPS коммуникация с внешними сервисамиV12.2.11Убедитесь, что для всех соединений между клиентом и внешними HTTP-сервисами используется TLS и не происходит отката к небезопасным или незашифрованным протоколам.1V12.2.22Убедитесь, что внешние сервисы используют публично доверенные TLS-сертификаты.1V12.33Общая безопасность межсервисного взаимодействияV12.3.11Убедитесь, что для всех входящих и исходящих соединений приложения используется зашифрованный протокол, например TLS, включая системы мониторинга, инструменты управления, удалённый доступ и SSH, промежуточное ПО, базы данных, мейнфреймы, партнёрские системы и внешние API. Сервер не должен допускать откат к небезопасным или незашифрованным протоколам.2V12.3.22Убедитесь, что TLS-клиент проверяет сертификат сервера до установления защищенного соединения с TLS-сервером.2V12.3.33Убедитесь, что все внутренние HTTP-взаимодействия между компонентами приложения используют TLS или другой подходящий механизм транспортного шифрования, и не происходит откат к небезопасным или незашифрованным коммуникациям.2V12.3.44Убедитесь, что TLS-соединения между внутренними сервисами используют доверенные сертификаты. Если используются внутренние или самоподписанные сертификаты, потребляющий сервис должен быть настроен на доверие только к конкретным внутренним центрам сертификации (CA) и конкретным самоподписанным сертификатам.2V12.3.55Убедитесь, что сервисы, взаимодействующие внутри системы (intra-service communications), используют строгую аутентификацию для проверки каждого конечного узла. Для проверки подлинности взаимодействующих сторон должны применяться методы строгой аутентификации, такие как аутентификация TLS-клиента, с использованием инфраструктуры открытых ключей и механизмов, устойчивых к атакам повтора (replay attacks). Для микросервисных архитектур рекомендуется использование service mesh для упрощения управления сертификатами и повышения безопасности.3V1313ConfigurationКонфигурацияV13.11Документация конфигурацииV13.1.11Убедитесь, что все необходимые доступы приложения задокументированы. Сюда должны быть включены как внешние сервисы, от которых зависит приложение, так и сценарии, когда конечный пользователь может задавать адреса для внешнего подключения.2V13.1.22Убедитесь, что для каждого сервиса, используемого приложением, в документации определено максимальное количество одновременных соединений (например, лимиты пула соединений) и описано поведение приложения при достижении этого лимита, включая любые механизмы отказоустойчивости или восстановления, чтобы предотвратить ситуации отказа в обслуживании (DoS).3V13.1.33Убедитесь, что в документации приложения определены стратегии управления ресурсами для каждой внешней системы или сервиса, которые оно использует (например, базы данных, файловые дескрипторы, потоки, HTTP-соединения). Стратегии должны включать процедуры освобождения ресурсов, настройки таймаутов, обработку сбоев, а также, если реализована логика повторных попыток, указание лимитов, задержек и алгоритмов back-off. Для синхронных HTTP-запросов должны быть заданы короткие таймауты, а повторные запросы должны быть отключены, либо строго ограничены по числу попыток, чтобы предотвратить каскадные задержки и истощение ресурсов.3V13.1.44Убедитесь, что в документации приложения определены секреты, критически важные для безопасности приложения, а также установлен график их ротации в соответствии с моделью угроз организации и её бизнес-требованиями.3V13.22Конфигурация бэкенд соединенийV13.2.11Убедитесь, что коммуникации между компонентами бэкенда приложения (включая API, промежуточное ПО и уровни данных), которые не поддерживают стандартный механизм пользовательских сессий, проходят с аутентификацией. Аутентификация должна использовать индивидуальные сервисные аккаунты, краткосрочные токены или аутентификацию на основе сертификатов, а не постоянные учётные данные, такие как пароли, API-ключи или общие аккаунты с привилегированным доступом.2V13.2.22Убедитесь, что коммуникации между компонентами бэкенда приложения, включая локальные или системные службы, API, промежуточное ПО и уровни данных, выполняются с использованием аккаунтов, которым назначены минимально необходимые привилегии.2V13.2.33Убедитесь, что если для аутентификации в сервисе используются учётные данные, то используемые потребителем учётные данные не являются стандартными (например, root/root или admin/admin).2V13.2.44Убедитесь, что используется белый список (allowlist) для определения внешних ресурсов или систем, с которыми приложению разрешено взаимодействовать (например, для исходящих запросов, загрузки данных или доступа к файлам). Этот белый список может быть реализован на уровне приложения, веб-сервера, межсетевого экрана или комбинации различных уровней.2V13.2.55Убедитесь, что веб- или прикладной сервер настроен с белым списком ресурсов или систем, к которым сервер может отправлять запросы или из которых может загружать данные и файлы.2V13.2.66Убедитесь, что при подключении приложения к другим сервисам соблюдается задокументированная конфигурация для каждого соединения, включая максимальное количество параллельных соединений, поведение при достижении их максимума, таймауты и стратегии повторных попыток подключения.3V13.33Управление секретамиV13.3.11Убедитесь, что для безопасного создания, хранения, контроля доступа и уничтожения секретов бэкенда используется решение для управления секретами, например, хранилище ключей (key vault). Секретами могут быть пароли, ключевой материал, интеграции с базами данных и сторонними системами, ключи и seed-значения для токенов с ограниченным временем действия, другие внутренние секреты и API-ключи. Секреты не должны включаться в исходный код приложения или артефакты сборки. Для приложений уровня L3 необходимо использовать аппаратное решение, например, аппаратный модуль безопасности (HSM).2V13.3.22Убедитесь, что доступ к секретным ресурсам осуществляется в соответствии с принципом минимально необходимых привилегий (least privilege).2V13.3.33Убедитесь, что все криптографические операции выполняются с использованием изолированного модуля безопасности (например, хранилища ключей или аппаратного модуля безопасности), чтобы надежно управлять ключевым материалом и защищать его от утечки за пределы модуля безопасности.3V13.3.44Убедитесь, что секреты настроены на срок действия и ротацию в соответствии с документацией приложения.3V13.44Непреднамеренная утечка информацииV13.4.11Убедитесь, что приложение развернуто либо без метаданных систем контроля версий (включая папки .git или .svn), либо так, чтобы эти папки были недоступны как извне, так и для самого приложения.1V13.4.22Убедитесь, что режимы отладки отключены для всех компонентов в промышленной среде, чтобы предотвратить раскрытие функций отладки и утечку информации.2V13.4.33Убедитесь, что веб-серверы не показывают клиентам списки содержимого каталогов, если это явно не предусмотрено.2V13.4.44Убедитесь, что метод HTTP TRACE не поддерживается в продуктовой среде, чтобы избежать потенциальной утечки информации.2V13.4.55Убедитесь, что документация (например, по внутренним API) и мониторинговые эндпоинты не доступны, если это явно не предусмотрено.2V13.4.66Убедитесь, что приложение не раскрывает подробную информацию о версиях компонентов бэкенда.3V13.4.77Убедитесь, что веб-слой настроен на обслуживание только файлов с определёнными расширениями, чтобы предотвратить непреднамеренную утечку информации, конфигураций и исходного кода.3V1414DataЗащита информацииV14.11Документация по защите информацииV14.1.11Убедитесь, что все конфиденциальные данные, создаваемые и обрабатываемые приложением, идентифицированы и классифицированы по уровням защиты. Включая закодированные данные, которые легко декодируются, например, строки Base64 или незашифрованные данные в полезной нагрузке JWT. Уровни защиты должны учитывать требования по защите данных и конфиденциальности, которым должно соответствовать приложение.2V14.1.22Убедитесь, что для каждого уровня защиты конфиденциальных данных требования к защите задокументированы. Они должны включать (но не ограничиваться) требования по шифрованию, проверке целостности, срокам хранения, способам логирования данных, контролю доступа к чувствительным данным в логах, шифрованию на уровне базы данных, применению технологий повышения конфиденциальности, а также другим требованиям по конфиденциальности.2V14.22Базовые меры по защите информацииV14.2.11Убедитесь, что конфиденциальные данные передаются на сервер только в теле HTTP-запроса или в заголовках. URL и строка запроса не должны содержать конфиденциальную информацию, такую как API-ключ или сессионный токен.1V14.2.22Убедитесь, что приложение предотвращает кэширование конфиденциальных данных в серверных компонентах, таких как балансировщики нагрузки и кэши приложений, либо гарантирует их надежное удаление после использования.2V14.2.33Убедитесь, что заранее определённые конфиденциальные данные не отправляются ненадёжным сторонам (например, системам трекинга пользователей), чтобы предотвратить нежелательный сбор данных вне контроля приложения.2V14.2.44Убедитесь, что для конфиденциальных данных реализованы меры по шифрованию, проверке целостности, срокам хранения, способам логирования, контролю доступа к данным в логах, а также применяются технологии повышения конфиденциальности в соответствии с документацией для соответствующего уровня защиты данных.2V14.2.55Убедитесь, что механизмы кэширования настроены так, чтобы кэшировать только ответы с ожидаемым типом содержимого для данного ресурса и не содержать конфиденциального динамического контента. При обращении к несуществующему файлу, веб-сервер должен возвращать ответ 404 или 302, а не подменять на другой существующий файл, что позволит предотвратить атаки типа Web Cache Deception.3V14.2.66Убедитесь, что приложение возвращает только минимально необходимый объем конфиденциальных данных для выполнения своей функциональности. Например, показывает только часть цифр номера кредитной карты, а не полный номер. Если требуется отображение полных данных, они должны быть замаскированы в пользовательском интерфейсе, пока пользователь специально не запросил их просмотр.3V14.2.77Убедитесь, что конфиденциальная информация подлежит классификации по срокам хранения, чтобы устаревшие или ненужные данные удалялись автоматически, по расписанию или по мере необходимости.3V14.2.88Убедитесь, что конфиденциальная информация удаляется из метаданных файлов, загружаемых пользователями, если пользователь явно не согласился на ее хранение.3V14.33Защита данных на стороне клиентаV14.3.11Убедитесь, что аутентифицированные данные очищаются из клиентского хранилища, например, из DOM браузера, после завершения работы клиента или сессии. Заголовок HTTP-ответа Clear-Site-Data может помочь в этом, но клиентская сторона также должна уметь очищать данные, если соединение с сервером недоступно при завершении сессии.1V14.3.22Убедитесь, что приложение устанавливает HTTP-заголовки, достаточные для предотвращения кэширования (например, Cache-Control: no-store), чтобы конфиденциальные данные не сохранялись в браузерах.2V14.3.33Убедитесь, что данные, хранящиеся в браузерном хранилище (например, localStorage, sessionStorage, IndexedDB или cookie), не содержат конфиденциальной информации, за исключением сессионных токенов.2V1515SecureБезопасная разработка и архитектураV15.11Документация по безопасной разработке и архитектуреV15.1.11Убедитесь, что в документации по приложению определены сроки устранения уязвимостей на основе оценки рисков для внешних зависимостей с уязвимостями и для обновления библиотек в целом, чтобы минимизировать риск, связанный с этими компонентами.1V15.1.22Убедитесь, что ведется реестр всех используемых сторонних библиотек (например, Software Bill of Materials, SBOM), с обязательной проверкой, что компоненты получены из предопределенных, доверенных и регулярно поддерживаемых репозиториев.2V15.1.33Убедитесь, что в документации приложения указан функционал, требующий значительных временных или вычислительных ресурсов. Необходимо указать, как предотвратить потерю доступности из-за чрезмерного использования этого функционала и как избежать ситуаций, когда формирование ответа занимает больше времени, чем установленный системой таймаут. Возможные меры защиты могут включать асинхронную обработку, использование очередей и ограничение количества параллельных процессов для каждого пользователя и приложения.2V15.1.44Убедитесь, что в документации приложения указаны внешние библиотеки, которые считаются «компонентами с повышенным риском».3V15.1.55Убедитесь, что в документации приложения выделены те части приложения, в которых используются «функционал с повышенным риском».3V15.22Архитектура безопасности и зависимостиV15.2.11Убедитесь, что приложение содержит только те компоненты, которые не нарушили задокументированные сроки обновления и исправления.1V15.2.22Убедитесь, что в приложении реализованы меры защиты от потери доступности из-за функциональности, требующей много времени или ресурсов, на основе задокументированных решений и стратегий безопасности для этого.2V15.2.33Убедитесь, что производственная среда включает только те функции, которые необходимы для работы приложения, и не предоставляет лишние функции, такие как тестовый код, примеры кода и инструменты разработки.2V15.2.44Убедитесь, что сторонние компоненты и все их транзитивные зависимости загружаются только из ожидаемых репозиториев (внутренних или внешних) и отсутствует риск атаки через подмену зависимостей (dependency confusion attack)3V15.2.55Убедитесь, что приложение реализует дополнительные меры защиты для тех частей приложения, которые документированы как содержащие «функционал с повышенным риском» или использующие сторонние библиотеки, считающиеся «функционалом с повышенным риском». Это могут быть такие методы, как «песочница», инкапсуляция, контейнеризация или изоляция на сетевом уровне, чтобы задержать и предотвратить продвижение (pivoting) злоумышленников, скомпрометировавших одну часть приложения, к другим частям приложения.3V15.33Безопасное программированиеV15.3.11Убедитесь, что приложение возвращает только необходимое подмножество полей из объекта данных. Например, оно не должно возвращать весь объект данных, поскольку некоторые отдельные поля должны быть недоступны пользователям.1V15.3.22Убедитесь, что при вызовах внешних URL-адресов бэкэнд приложения настроен так, чтобы не выполнять перенаправления, если только это не предусмотрено функционалом.2V15.3.33Убедитесь, что в приложении реализованы защитные механизмы против атак типа массового присвоения (mass assignment) путем строгого ограничения разрешенных полей для каждого контроллера и действия, исключая возможность добавления или изменения значений полей, которые не должны быть доступны для данной конкретной операции.2V15.3.44Убедитесь, что все прокси и промежуточное ПО корректно передают исходный IP-адрес пользователя, используя доверенные поля данных, которые не могут быть изменены конечным пользователем, а приложение и веб-сервер используют это правильное значение для ведения логирования и принятия решений по безопасности, таких как ограничение запросов. При этом следует учитывать, что даже исходный IP-адрес может быть ненадежным из-за динамических IP-адресов, VPN или корпоративных файрволов.2V15.3.55Убедитесь, что приложение явно проверяет соответствие переменных ожидаемому типу данных и использует строгие операции сравнения. Это необходимо для предотвращения уязвимостей, связанных с type juggling и type confusion, вызванных тем, что код приложения делает предположения о типе переменной.2V15.3.66Убедитесь, что JavaScript-код написан таким образом, чтобы предотвратить prototype pollution, например, используя Set() или Map() вместо обычных литералов объекта.2V15.3.77Убедитесь, что приложение защищено от атак типа HTTP Parameter Pollution (HPP), особенно если используемый фреймворк не различает источники параметров запроса (строка запроса, тело запроса, куки или заголовки).2V15.44Безопасная работа с параллельными процессамиV15.4.11Убедитесь, что к общим объектам в многопоточном коде (например, кэшам, файлам или объектам в памяти, используемым несколькими потоками) используется безопасный многопоточный доступ и механизмов синхронизации, таких как блокировки или семафоры, чтобы избежать состояний гонки и повреждения данных.3V15.4.22Убедитесь, что проверки состояния ресурса, например его существования или разрешений, а также зависящие от него действия выполняются как одна атомарная операция, чтобы предотвратить условия гонки времени проверки и времени использования (TOCTOU). Например, проверка существования файла перед его открытием или проверка прав доступа пользователя перед его предоставлением.3V15.4.33Убедитесь, что блокировки применяются согласованно, чтобы предотвратить взаимные блокировки потоков (deadlocks) или их бесконечные повторы, а также что логика блокировки инкапсулирована в коде, отвечающем за управление ресурсом. Это гарантирует, что блокировки не могут быть случайно или намеренно изменены внешними классами или кодом.3V15.4.44Убедитесь, что политики распределения ресурсов предотвращают нехватку ресурсов у потоков, обеспечивая справедливый доступ к ресурсам, например, используя пулы потоков, позволяя потокам с более низким приоритетом выполняться в течение разумного периода времени.3V1616SecurityЖурналирование событий безопасности и обработка ошибокV16.11Документация по ведению логовV16.1.11Убедитесь в существовании реестра, в котором документируется ведение журнала на каждом уровне технологического стека приложения, включая какие события регистрируются, форматы логов, где хранятся эти журналы, как они используются, как контролируется доступ к ним и как долго хранятся журналы.2V16.22Общее журналированиеV16.2.11Убедитесь, что каждая запись журнала содержит необходимые метаданные (например, когда, где, кто, что), которые позволят провести подробное исследование временной шкалы, когда произошло событие.2V16.2.22Убедитесь, что все источники времени компонентов системы журналирования синхронизированы, а временные метки в метаданных событий безопасности используют UTC или содержат явное указание смещения часового пояса. Рекомендуется применять UTC для обеспечения согласованности в распределённых системах и предотвращения ошибок при переходе на летнее/зимнее время.2V16.2.33Убедитесь, что приложение записывает и передаёт логи исключительно в те файлы и сервисы, которые указаны в реестре журналирования.2V16.2.44Убедитесь, что логи могут быть прочитаны и коррелированы используемой системой обработки журналов, предпочтительно с использованием общего стандартного формата логирования.2V16.2.55Убедитесь, что приложение применяет соответствующие меры защиты при логировании конфиденциальных данных в зависимости от уровня их чувствительности: например, полностью запрещает запись в логи таких данных, как учетные данные или платежные реквизиты, а для других данных (например, сессионных токенов) использует хеширование или частичное/полное маскирование.2V16.33Инциденты безопасностиV16.3.11Убедитесь, что все операции аутентификации регистрируются, включая успешные и неудачные попытки. Также следует фиксировать дополнительные метаданные, такие как тип аутентификации или использованные факторы проверки.2V16.3.22Убедитесь, что ведется журнал неудачных попыток авторизации. Для уровня L3 это должно включать в себя журналирование всех решений об авторизации, включая журналирование доступа к конфиденциальным данным (без регистрации самих конфиденциальных данных).2V16.3.33Убедитесь, что приложение регистрирует все события безопасности, определенные в документации, а также фиксирует попытки обхода механизмов защиты, включая проверку входных данных, бизнес-логики и системы защиты от автоматизированных атак.2V16.3.44Убедитесь, что приложение регистрирует в журналах неожиданные ошибки и сбои механизмов безопасности, включая, например, ошибки TLS-соединения на стороне сервера.2V16.44Защита журналовV16.4.11Убедитесь, что все компоненты системы логирования корректно кодируют данные, чтобы предотвратить атаки типа внедрения в журналы (log injection).2V16.4.22Убедитесь, что логи защищены от неавторизованного доступа и не могут быть модифицированы.2V16.4.33Убедитесь, что логи безопасно передаются в логически изолированную систему для анализа, обнаружения угроз, генерации оповещений и эскалации инцидентов. Это гарантирует сохранность журналов даже в случае компрометации основного приложения.2V16.55Обработка ошибокV16.5.11Убедитесь, что при возникновении непредвиденной или связанной с безопасностью ошибки пользователю возвращается только общее сообщение, гарантируя отсутствие раскрытия конфиденциальных внутренних данных системы, таких как трассировки стека, запросы, секретные ключи и токены.2V16.5.22Убедитесь, что приложение продолжает работать в безопасном режиме при недоступности внешних ресурсов, используя такие механизмы, как автоматические выключатели (circuit breakers) или плавное снижение функциональности (graceful degradation).2V16.5.33Убедитесь, что приложение корректно и безопасно завершает работу при возникновении исключений, предотвращая опасные сценарии по типу «fail-open», когда, например, транзакция ошибочно выполняется, несмотря на ошибки в логике валидации.2V16.5.44Убедитесь, что определён обработчик ошибок «крайние меры», который будет перехватывать все необработанные ошибки. Это необходимо как для предотвращения потери информации об ошибках, которая должна быть записана в файлы журналов, так и для того, чтобы ошибка не остановила весь процесс приложения, что привело бы к потере доступности.3V1717WebRTCWebRTCV17.11TURN-серверV17.1.11Убедитесь, что сервис TURN (Traversal Using Relays around NAT) разрешает доступ только к IP-адресам, не зарезервированным для специальных целей (например, внутренние сети, широковещательная рассылка, loopback-адреса). Данное требование применяется как к IPv4, так и к IPv6 адресам.2V17.1.22Убедитесь, что сервис TURN (Traversal Using Relays around NAT) защищен от исчерпания ресурсов при попытках легитимных пользователей открыть чрезмерное количество портов на сервере.3V17.22Требования к медиасерверамV17.2.11Убедитесь, что ключ сертификата Datagram Transport Layer Security (DTLS) управляется и защищается в соответствии с документированной политикой управления криптографическими ключами.2V17.2.22Убедитесь, что медиасервер настроен на использование только одобренных наборов шифров Datagram Transport Layer Security (DTLS) и защищенного профиля безопасности для расширения DTLS, применяемого при установке ключей для Secure Real-time Transport Protocol (DTLS-SRTP).2V17.2.33Убедитесь, что медиасервер проверяет аутентификацию Secure Real-time Transport Protocol (SRTP) для предотвращения атак с внедрением Real-time Transport Protocol (RTP), которые могут привести к отказу в обслуживании (Denial of Service) или вставке поддельного аудио-/видеоконтента в медиапотоки.2V17.2.44Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика при получении некорректных пакетов Secure Real-time Transport Protocol (SRTP).2V17.2.55Убедитесь, что медиасервер способен продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетами Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.3V17.2.66Убедитесь, что медиасервер не подвержен уязвимости «Гонка ClientHello» (ClientHello Race Condition) в Datagram Transport Layer Security (DTLS), проверив наличие известных уязвимостей в публичных источниках или выполнив тестирование на воспроизведение условий гонки.3V17.2.77Убедитесь, что механизмы аудио- и видеозаписи, связанные с медиасервером, способны продолжать обработку входящего медиатрафика даже при флуде (массовой атаке) пакетов Secure Real-time Transport Protocol (SRTP) от легитимных пользователей.3V17.2.88Убедитесь, что сертификат Datagram Transport Layer Security (DTLS) проверяется на соответствие атрибуту отпечатка (fingerprint) в Session Description Protocol (SDP), с немедленным прекращением медиапотока в случае несоответствия — это гарантирует подлинность передаваемых данных.3V17.33СигнализацияV17.3.11Убедитесь, что сигнальный сервер способен продолжать обработку легитимных входящих сообщений сигнализации даже в условиях флуд-атаки. Для этого необходимо реализовать механизм ограничения частоты запросов (rate limiting) на уровне сигнализации.2V17.3.22Убедитесь, что сигнальный сервер способен продолжать обработку легитимных сообщений сигнализации даже при получении некорректных сообщений, которые могут вызвать отказ в обслуживании (Denial of Service, DoS). Для этого необходимо реализовать: проверку входных данных (input validation), безопасную обработку целочисленных переполнений (integer overflows), защиту от переполнения буферов (buffer overflows) и другие надежные методы обработки ошибок.2 diff --git a/5.0/docs_ru/ru b/5.0/docs_ru/ru new file mode 100644 index 0000000000..e69de29bb2 diff --git a/5.0/languages.txt b/5.0/languages.txt index ed3b016662..467572f40e 100644 --- a/5.0/languages.txt +++ b/5.0/languages.txt @@ -1 +1 @@ -en tr \ No newline at end of file +en tr ru \ No newline at end of file diff --git a/5.0/ru/0x00-Header.yaml b/5.0/ru/0x00-Header.yaml new file mode 100644 index 0000000000..eb86984808 --- /dev/null +++ b/5.0/ru/0x00-Header.yaml @@ -0,0 +1,15 @@ +--- + title: "Стандарт верификации требований к безопасности приложений" + subtitle: "Версия 5.0.0" + date: Май 2025 + titlepage: true + titlepage-rule-height: 0 + titlepage-logo: "images/owasp_logo_1c_notext.png" + table-use-row-colors: true + toc: true + toc-own-page: true + geometry: "left=2cm,right=2cm,top=3cm,bottom=3cm" + CJKmainfont: "Noto Sans CJK JP" + mainfont: "Source Serif 4" + sansfont: "Source Sans 3" +--- diff --git a/5.0/ru/0x01-Frontispiece.md b/5.0/ru/0x01-Frontispiece.md new file mode 100644 index 0000000000..55578529a5 --- /dev/null +++ b/5.0/ru/0x01-Frontispiece.md @@ -0,0 +1,46 @@ +# Фронтиспис + +## О стандарте + +Стандарт верификации требований к безопасности приложений — это перечень требований к безопасности приложений (тестов), которыми могут пользоваться архитекторы, разработчики, тестировщики, специалисты по безопасности, разработчики инструментов и конечные пользователи для проектирования, разработки, тестирования и контроля безопасных приложений. + +## Авторские права и лицензия + +Версия 5.0.0, май 2025 + +![лицензия](../images/license.png) + +Copyright © 2008-2025 The OWASP Foundation. + +Этот документ выпущен под [лицензией Creative Commons Attribution-ShareAlike 4.0 International](https://creativecommons.org/licenses/by-sa/4.0/). + +При воспроизведении или распространении этого документа необходимо разъяснить условия лицензии на него. + +## Руководители проекта + +| | | +|---------------------- |----------------- | +| Elar Lang | Josh C Grossman | +| Jim Manico | Daniel Cuthbert | + +## Рабочая группа + +| | | | | +|---------------- |------------------ |------------------- |----------------- | +| Tobias Ahnoff | Ralph Andalis | Ryan Armstrong | Gabriel Corona | +| Meghan Jacquot | Shanni Prutchi | Iman Sharafaldin | Eden Yardeni | + +## Основные участники + +| | | +|-------------------|-------------------| +| Sjoerd Langkemper | Isaac Lewis | +| Mark Carney | Sandro Gauci | + +## Другие участники и рецензенты + +Список остальных участников перечислен в Приложении E. + +Если Вы — участник проекта, но Вашего имени нет в приведенном выше списке, пожалуйста, зарегистрируйте issue на GitHub для признания в будущих обновлениях. + +Пятая версия стандарта верификации требований к безопасности приложений опирается на предыдущие версии ASVS, начиная с первой, вышедшей в 2008 году, и до четвертой, в 2019 году. Большая часть разделов оглавления и пунктов требований, до сих пор присутствующих в ASVS, изначально были написаны Эндрю ван дер Стоком, Майком Боберски, Джеффом Уильямсом и Дэйвом Уичерсом, но участников было гораздо больше - спасибо им всем. Полные списки всех, кто внес свой вклад в более ранние версии, есть в соответствующих версиях документа. diff --git a/5.0/ru/0x02-Preface.md b/5.0/ru/0x02-Preface.md new file mode 100644 index 0000000000..4470b3236f --- /dev/null +++ b/5.0/ru/0x02-Preface.md @@ -0,0 +1,29 @@ +# Предисловие + +Добро пожаловать в Стандарт верификации требований к безопасности приложений (ASVS) версии 5.0 + +## Введение + +Изначально представленный в 2008 году совместными усилиями мирового сообщества, ASVS определяет исчерпывающий набор требований безопасности для проектирования, разработки и тестирования современных веб-приложений и сервисов. + +После выхода версии ASVS 4.0 в 2019 году и ее незначительного обновления (v4.0.3) в 2021 году, версия 5.0 является значительным шагом вперед — она была модернизирована, чтобы учесть последние достижения в области безопасности программного обеспечения. + +ASVS 5.0 стал результатом масштабного вклада руководителей проекта, членов рабочей группы и широкого сообщества OWASP, направленного на обновление и совершенствование этого важного стандарта. + +## Ключевые принципы версии 5.0 + +Эта масштабная редакция была разработана с учетом нескольких ключевых принципов: + +* Уточнение границ и целей: Данная версия стандарта была разработана для более точного соответствия основным принципам, отраженным в его названии: Приложение (Application), Безопасность (Security), Проверка (Verification), Стандарт (Standard). Требования были переформулированы - теперь они направлены на предотвращение недостатков безопасности, а не на обязательное применение конкретных технических решений. Тексты требований являются самодостаточными и поясняют свою необходимость. + +* Поддержка документирования решений по безопасности: ASVS 5.0 вводит требования к документированию ключевых решений по безопасности. Данный подход улучшает отслеживаемость решений и способствует контекстуально-ориентированным реализациям, предоставляя организациям возможность настраивать свою защиту в соответствии с индивидуальными требованиями и рисками. + +* Обновленные уровни: Несмотря на сохранение трехуровневой модели, определения уровней были пересмотрены для упрощения внедрения ASVS. Уровень 1 предназначен для начального этапа внедрения стандарта и обеспечивает базовый уровень защиты. Уровень 2 представляет собой комплексный набор стандартных практик безопасности. Уровень 3 охватывает расширенные требования для обеспечения повышенной гарантии безопасности. + +* Реструктуризированное и расширенное содержание: ASVS 5.0 включает приблизительно 350 требований, распределенных по 17 главам. Структура глав была переработана для большей ясности и удобства использования. Для облегчения перехода предоставлено двустороннее соответствие между версиями 4.0 и 5.0. + +## Взгляд в будущее + +Так же, как и обеспечение безопасности приложения никогда не может быть полностью завершено, работа над ASVS также никогда не прекращается. Несмотря на то, что версия 5.0 является крупным релизом, разработка стандарта продолжается. Данный выпуск позволяет сообществу воспользоваться преимуществами накопленных улучшений и дополнений, а также закладывает основу для будущего развития. Это может включать в себя инициативы сообщества по созданию руководств по внедрению и проверке, основанных на базовом наборе требований. + +ASVS 5.0 предназначен для того, чтобы служить надежной основой для разработки безопасного программного обеспечения. Сообществу предлагается применять этот стандарт, вносить в него свой вклад и развивать его, чтобы совместно двигать вперёд состояние безопасности приложений. diff --git a/5.0/ru/0x03-What-is-the-ASVS.md b/5.0/ru/0x03-What-is-the-ASVS.md new file mode 100644 index 0000000000..bc1d58331e --- /dev/null +++ b/5.0/ru/0x03-What-is-the-ASVS.md @@ -0,0 +1,195 @@ +# Что такое ASVS? + +Стандарт верификации требований к безопасности приложений (ASVS) определяет требования безопасности для веб-приложений и сервисов, представляя собой ценный ресурс для всех, кто стремится проектировать, разрабатывать и поддерживать безопасные приложения или оценивать их уровень защищённости. + +В этой главе описываются ключевые аспекты применения ASVS, включая его область действия, структуру уровней, основанных на приоритетах, и основные сценарии использования стандарта. + +## Область действия ASVS + +Область действия ASVS определяется его названием: Приложение (Application), Безопасность (Security), Верификация (Verification) и Стандарт (Standard). Он устанавливает, какие требования включены в стандарт, а какие — исключены из него, с глобальной целью определения основополагающих принципов безопасности, которые должны быть достигнуты. Область действия также учитывает требования к документации, которые служат основой для требований к реализации. + +Не существует такого понятия, как «область действия» для злоумышленника. Поэтому требования ASVS должны оцениваться в совокупности с рекомендациями по другим аспектам жизненного цикла приложения, включая процессы CI/CD, хостинг и операционную деятельность. + +### Приложение + +ASVS определяет «Приложение» как разрабатываемый программный продукт, в который должны быть интегрированы механизмы безопасности. ASVS не регламентирует процессы жизненного цикла разработки и не указывает на методы сборки приложения в CI/CD. Его задача — описать требуемый уровень защищённости, который должен быть достигнут в конечном продукте. + +Компоненты для обработки HTTP-трафика (WAF, балансировщики нагрузки, прокси) могут считаться частью приложения в контексте безопасности, поскольку некоторые механизмы безопасности напрямую зависят от них или могут быть реализованы с их помощью. Это касается требований по кешированию, rate limiting, а также фильтрации входящих/исходящих подключений по источнику и получателю. + +В свою очередь, ASVS не включает требования, не относящиеся к приложению напрямую или находящиеся за пределами его зоны ответственности. Так, например, проблемы DNS обычно относятся в ведении отдельной команды или функции. + +Аналогично, хотя в зону ответственности приложения входит обработка входящих данных и генерация исходящих данных, если внешний процесс взаимодействует с приложением или его данными, это считается выходящим за рамки ASVS. Например, резервное копирование приложения или его данных обычно выполняется внешними процессами и не контролируется самим приложением или его разработчиками. + +### Безопасность + +Каждое требование должно иметь очевидное влияние на безопасность. Отсутствие требования должно привести к снижению уровня защищённости приложения, а реализация требования должна либо уменьшить вероятность возникновения риска безопасности, либо смягчить последствия. + +Все прочие аспекты, такие как функциональные характеристики, стиль кода или требования политик, выходят за рамки стандарта. + +### Верификация + +Требование должно быть верифицируемым, а его проверка должна приводить к однозначному решению: «не выполнено» или «выполнено». + +### Стандарт + +ASVS представляет собой набор требований безопасности, которые необходимо реализовать для соответствия стандарту. Это означает, что требования ограничиваются определением целевого показателя безопасности, которого необходимо достичь. Прочая сопутствующая информация может быть надстроена на основе ASVS или связана с ним через сопоставления. + +В частности, в рамках OWASP существует множество проектов, и ASVS намеренно избегает дублирования содержания других проектов. Например, у разработчиков может возникнуть вопрос: «как мне реализовать конкретное требование в моем технологическом стеке или окружении?» — на него должен отвечать проект Cheat Sheet Series. У тестировщиков может возникнуть вопрос: «как мне проверить это требование в данном окружении?» — на него должен отвечать проект Web Security Testing Guide. + +Хотя ASVS предназначен не только для специалистов по безопасности, он ожидает, что читатель обладает техническими знаниями для понимания содержания или способен самостоятельно изучить конкретные концепции. + +### Требование + +Слово «Требование» специально используется в ASVS, поскольку оно описывает обязательное условие, которое должно быть достигнуто для его выполнения. ASVS содержит только требования (обязательные к выполнению) и не содержит рекомендаций. + +Другими словами, рекомендации, независимо от того, являются ли они лишь одним из многих возможных вариантов для решения проблем или вопросов стиля кода, не удовлетворяют определению требования. + +Требования ASVS определяют цели безопасности, не привязываясь к конкретным технологиям или методам реализации. Их назначение понятно из самого текста, и они не предписывают, как именно следует проводить проверку. + +### Документированные решения по безопасности + +В области безопасности программного обеспечения заблаговременное планирование архитектуры безопасности и защитных механизмов позволяет добиться более последовательной и предсказуемой реализации в конечном продукте или функции. + +Кроме того, некоторые требования сложны в реализации и зависят от специфики приложения. Например, система прав доступа, проверка вводимых данных и защита данных с разной степенью чувствительности. + +Чтобы учесть это, вместо общих формулировок, таких как «все данные должны быть зашифрованы», или попыток охватить каждый возможный случай в требовании, были включены требования к документации. Они предписывают, чтобы подход и конфигурация, выбранные разработчиком приложения для механизмов управления, были задокументированы. Это позволяет провести оценку целесообразности подхода, а затем сравнить фактическую реализацию с документацией, чтобы оценить, соответствует ли реализация ожиданиям. + +Задача этих требований — фиксировать решения, которые организация-разработчик приняла в отношении того, каким образом реализовать определенные требования безопасности. + +Требования к документации всегда размещаются в первом разделе главы (хотя присутствуют не в каждой из них), и каждое из них всегда связано с соответствующим требованием к реализации, в рамках которого документированные решения должны быть воплощены на практике. Ключевая идея заключается в том, что проверка наличия документации и проверка фактической реализации — это два самостоятельных вида деятельности. + +Существует две ключевые причины для включения этих требований. Первая причина заключается в том, что требование информационной безопасности часто предполагает принудительное применение правил, например, какие типы файлов разрешены для загрузки, какие бизнес-контроли должны быть реализованы, какие символы допустимы для конкретного поля. Эти правила уникальны для каждого приложения и поэтому ASVS не может предписать, какими они должны быть. Ни чек-лист, ни развернутое руководство в данном случае не будут полезны. Также, если эти решения не документированы, то невозможно проверить реализацию на соответствие требованиям. + +Вторая причина заключается в необходимости обеспечить гибкость для разработчиков приложения в выборе подходов к решению отдельных вопросов безопасности. Например, в прошлых версиях ASVS ограничения времени жизни сессии были строго фиксированы. На практике многие приложения, особенно ориентированные на прямое взаимодействие с потребителями, применяют более мягкие правила, отдавая предпочтение иным компенсирующим механизмам защиты. Таким образом, настоящие требования к документации прямо разрешают такую гибкость. + +Очевидно, что предполагается, что подобные решения будут приниматься и документироваться не отдельными разработчиками, а организацией в целом. На организацию возлагается ответственность за принятие данных решений, доведение их до сведения разработчиков и обеспечение их соблюдения. + +Предоставление разработчикам спецификаций и проектов новых функций является стандартной практикой в процессе разработки программного обеспечения. Аналогичным образом, от разработчиков ожидается использование общепринятых компонентов и механизмов пользовательского интерфейса, а не принятие самостоятельных решений каждый раз. Таким образом, распространение данного подхода на безопасность не должно восприниматься как нечто удивительное или спорное. + +Кроме того, существует гибкость в выборе способа достижения данной цели. Решения в области безопасности могут быть документированы в виде явного документа, с которым разработчики обязаны знакомиться. Альтернативно, эти решения могут быть документированы и реализованы в рамках общей библиотеки, которую все разработчики обязаны использовать. Результат достигается в обоих случаях. + +## Уровни соответствия ASVS + +Стандарт верификации требований к безопасности приложений определяет три уровня соответствия, каждый из которых усиливает требования предыдущего. Рекомендуемый подход для организаций — начинать с первого уровня для митигации наиболее критичных рисков безопасности с последующим переходом на более высокие уровни в зависимости от конкретных потребностей приложения и организации. В документации и требованиях используются сокращения L1, L2 и L3. + +Каждый уровень соответствия определяет требования безопасности, которые необходимо выполнить для его достижения. Требования же вышестоящих уровней носят рекомендательный характер. + +Во избежание дублирования требований или наличия требований, теряющих актуальность на более высоких уровнях, некоторые из них применяются к конкретному уровню, но предусматривают более строгие условия для последующих уровней. + +### Оценка уровней соответствия + +Уровни соответствия определяются путём приоритизационной оценки каждого требования, основанной на опыте их внедрения и тестирования. Основное внимание уделяется сопоставлению снижения рисков с усилиями по реализации требования. Другим ключевым фактором является сохранение низкого порога вхождения. + +Оценка снижения риска рассматривает, насколько требование уменьшает уровень риска безопасности в приложении. При этом принимаются во внимание классические факторы воздействия на Конфиденциальность, Целостность и Доступность, а также то, является ли данное требование основным рубежом обороны или же оно рассматривается как элемент эшелонированной защиты. + +В результате тщательных обсуждений как самих критериев, так и решений по отнесению их к уровням соответствия, была выработана классификация, которая должна оставаться справедливой для подавляющего большинства случаев, при этом допуская, что она не может быть универсальной для всех ситуаций. Это означает, что в отдельных случаях организации могут пожелать отдать приоритет требованиям более высокого уровня ранее, основываясь на собственной оценке рисков. + +Требования на каждом уровне можно охарактеризовать следующим образом: + +### Уровень 1 + +Данный уровень содержит минимальный набор требований для обеспечения безопасности приложения, и представляет собой критически важную отправную точку. На этот уровень приходится около 20% требований ASVS. Цель этого уровня — иметь как можно меньше требований для снижения порога вхождения. + +Эти требования, как правило, являются критически важными или базовыми, представляя собой первый рубеж защиты от распространённых атак, для эксплуатации которых не требуется наличия других уязвимостей или предварительных условий. + +Помимо требований первого рубежа защиты, некоторые требования имеют меньшее значение на более высоких уровнях, например, требования, связанные с паролями. Они более важны для первого уровня, поскольку, начиная с более высоких уровней становятся актуальными требования многофакторной аутентификации. + +Первый уровень не обязательно поддаётся полноценному тестированию на проникновение внешним специалистом без доступа ко внутренней документации или коду (например, при тестировании по методу «чёрного ящика»), хотя меньшее количество требований должно упростить процесс верификации. + +### Уровень 2 + +Большинству приложений следует стремиться к достижению данного уровня безопасности. На Уровень 2 (L2) приходится около 50% требований ASVS, что означает, что приложению необходимо реализовать порядка 70% требований ASVS (все требования уровней L1 и L2) для соответствия этому уровню. + +Эти требования, как правило, связаны либо с менее распространёнными атаками, либо с более сложными механизмами защиты от распространённых атак. Они могут по-прежнему представлять собой первый рубеж обороны, либо же для успешной атаки могут требоваться определённые предварительные условия. + +### Уровень 3 + +Данный уровень должен быть целью для приложений, стремящихся продемонстрировать наивысший уровень защищённости, и содержит оставшиеся ~30% требований для полного соответствия. + +Требования в данном разделе, как правило, представляют собой либо механизмы глубокой эшелонированной обороны (defense-in-depth), либо иные полезные, но сложные в реализации средства контроля. + +### Какого уровня следует достичь + +Уровни, основанные на приоритетах, призваны отражать степень зрелости системы безопасности организации и приложения. Вместо того, чтобы предписывать, какого уровня должно достигать приложение, ASVS предлагает организации проанализировать свои риски и самостоятельно определить целевой уровень, исходя из критичности приложения и, конечно же, ожиданий его пользователей. + +Например, стартап на ранней стадии, собирающий лишь ограниченный объём конфиденциальных данных, может принять решение сфокусироваться на первом уровне на начальном этапе. В то же время банк не сможет объяснить клиентам выбор уровня ниже, чем Уровень 3, для своего онлайн банковского приложения. + +## Как применять этот стандарт + +### Структура ASVS + +ASVS состоит в общей сложности из приблизительно 350 требований, которые разделены на 17 глав. Каждая глава, в свою очередь, делится на разделы. + +Цель такого деления на главы и разделы — упростить выбор или исключение соответствующих глав и разделов в зависимости от релевантности для конкретного приложения. Например, требования главы V3, касающиеся веб-интерфейсов, не будут актуальны в случае API для межмашинного взаимодействия. Если в системе не используется OAuth или WebRTC, то соответствующие главы также могут быть проигнорированы. + +### Стратегия выпусков + +Выпуски ASVS следуют схеме "Major.Minor.Patch", где номера версий указывают на характер изменений в выпуске. При мажорном выпуске изменяется первое число, при минорном — второе, а при патче — третье. + +* Мажорный выпуск (Major release) — Полная реорганизация. Могут быть изменены практически все элементы, включая нумерацию требований. Для подтверждения соответствия потребуется проведение повторной оценки (например, переход с версии 4.0.3 на 5.0.0). +* Минорный выпуск (Minor release) — Требования могут добавляться или удаляться, но общая структура нумерации остаётся прежней. Для подтверждения соответствия потребуется повторная оценка, но она должна быть проще (например, переход с версии 5.0.0 на 5.1.0). +* Выпуск патча (Patch release) — Требования могут быть удалены (например, если они являются дубликатами или устарели) или смягчены. Приложение, соответствовавшее предыдущему выпуску, будет соответствовать и патч-выпуску (например, переход с версии 5.0.0 на 5.0.1). + +Вышеизложенное относится только к самим требованиям. Изменения в пояснительных текстах и приложениях не являются критическими. + +### Гибкость использования ASVS + +Ряд рассмотренных принципов (например, требования к документации и система уровней) предоставляет возможность применять ASVS гибко, с учётом специфики организации. + +Кроме того, организациям настоятельно рекомендуется создавать специализированные ответвления (форки) стандарта, адаптированные для организации или домена, которые корректируют требования исходя из специфических характеристик и уровней риска их приложений. Однако важно сохранять прослеживаемость (traceability), чтобы соответствие требованию, например, 4.1.1, означало одно и то же во всех версиях. + +В идеале, каждой организации следует создавать собственную адаптированную версию ASVS, исключая нерелевантные разделы (например, GraphQL, WebSockets, SOAP, если они не используются). Версия ASVS, адаптированная под организацию, или дополнение к ней также является хорошим способом предоставить специфичные для организации руководства по реализации, уточняя библиотеки или ресурсы, которые следует использовать для выполнения требований. + +### Как ссылаться на требования ASVS + +Каждое требование имеет идентификатор в формате `.